diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
new file mode 100644
index 0000000000000..88a87436aa5f0
--- /dev/null
+++ b/.git-blame-ignore-revs
@@ -0,0 +1,5 @@
+# If you would like `git blame` to ignore commits from this file, run...
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+
+# chore: format code with semicolons when using prettier (#9555)
+988c9af0153561397686c119da9d1336d2433fdd
diff --git a/.github/actions/setup-go/action.yaml b/.github/actions/setup-go/action.yaml
index 4d696ef298b12..d699ba4ea1f1c 100644
--- a/.github/actions/setup-go/action.yaml
+++ b/.github/actions/setup-go/action.yaml
@@ -4,7 +4,7 @@ description: |
 inputs:
   version:
     description: "The Go version to use."
-    default: "1.20.6"
+    default: "1.20.10"
 runs:
   using: "composite"
   steps:
diff --git a/.github/actions/setup-sqlc/action.yaml b/.github/actions/setup-sqlc/action.yaml
index 354e55e8213f6..054bc78e202be 100644
--- a/.github/actions/setup-sqlc/action.yaml
+++ b/.github/actions/setup-sqlc/action.yaml
@@ -5,6 +5,6 @@ runs:
   using: "composite"
   steps:
     - name: Setup sqlc
-      uses: sqlc-dev/setup-sqlc@v3
+      uses: sqlc-dev/setup-sqlc@v4
       with:
-        sqlc-version: "1.19.1"
+        sqlc-version: "1.20.0"
diff --git a/.github/actions/setup-tf/action.yaml b/.github/actions/setup-tf/action.yaml
index 16472c9fafd6e..63a539a3fd922 100644
--- a/.github/actions/setup-tf/action.yaml
+++ b/.github/actions/setup-tf/action.yaml
@@ -7,5 +7,5 @@ runs:
     - name: Install Terraform
       uses: hashicorp/setup-terraform@v2
       with:
-        terraform_version: ~1.5
+        terraform_version: 1.5.5
         terraform_wrapper: false
diff --git a/.github/actions/upload-datadog/action.yaml b/.github/actions/upload-datadog/action.yaml
index 252329b16024d..8201b1a76d08a 100644
--- a/.github/actions/upload-datadog/action.yaml
+++ b/.github/actions/upload-datadog/action.yaml
@@ -20,7 +20,7 @@ runs:
           echo "No API key provided, skipping..."
           exit 0
         fi
-        npm install -g @datadog/datadog-ci@2.10.0
+        npm install -g @datadog/datadog-ci@2.21.0
         datadog-ci junit upload --service coder ./gotests.xml \
           --tags os:${{runner.os}} --tags runner_name:${{runner.name}}
       env:
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index 5b9f7a9c6597a..d0d75f78a7b99 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -8,7 +8,7 @@ updates:
       timezone: "America/Chicago"
     labels: []
     commit-message:
-      prefix: "chore"
+      prefix: "ci"
     ignore:
       # These actions deliver the latest versions by updating the major
       # release tag, so ignore minor and patch versions
@@ -92,6 +92,7 @@ updates:
       - dependency-name: "@types/node"
         update-types:
           - version-update:semver-major
+    open-pull-requests-limit: 15
     groups:
       react:
         patterns:
@@ -117,11 +118,6 @@ updates:
           - "@eslint*"
           - "@typescript-eslint/eslint-plugin"
           - "@typescript-eslint/parser"
-      jest:
-        patterns:
-          - "jest*"
-          - "@swc/jest"
-          - "@types/jest"
 
   - package-ecosystem: "npm"
     directory: "/offlinedocs/"
@@ -146,20 +142,6 @@ updates:
           - version-update:semver-major
 
   # Update dogfood.
-  - package-ecosystem: "docker"
-    directory: "/dogfood/"
-    schedule:
-      interval: "weekly"
-      time: "06:00"
-      timezone: "America/Chicago"
-    commit-message:
-      prefix: "chore"
-    labels: []
-    groups:
-      dogfood-docker:
-        patterns:
-          - "*"
-
   - package-ecosystem: "terraform"
     directory: "/dogfood/"
     schedule:
diff --git a/.github/pr-deployments/certificate.yaml b/.github/pr-deployments/certificate.yaml
new file mode 100644
index 0000000000000..cf441a98bbc88
--- /dev/null
+++ b/.github/pr-deployments/certificate.yaml
@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: pr${PR_NUMBER}-tls
+  namespace: pr-deployment-certs
+spec:
+  secretName: pr${PR_NUMBER}-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - "${PR_HOSTNAME}"
+    - "*.${PR_HOSTNAME}"
diff --git a/.github/pr-deployments/rbac.yaml b/.github/pr-deployments/rbac.yaml
new file mode 100644
index 0000000000000..0d37cae7daebe
--- /dev/null
+++ b/.github/pr-deployments/rbac.yaml
@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: coder-workspace-pr${PR_NUMBER}
+  namespace: pr${PR_NUMBER}
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-pr${PR_NUMBER}
+  namespace: pr${PR_NUMBER}
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: coder-workspace-pr${PR_NUMBER}
+  namespace: pr${PR_NUMBER}
+subjects:
+  - kind: ServiceAccount
+    name: coder-workspace-pr${PR_NUMBER}
+    namespace: pr${PR_NUMBER}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-pr${PR_NUMBER}
diff --git a/.github/pr-deployments/template/main.tf b/.github/pr-deployments/template/main.tf
new file mode 100644
index 0000000000000..f914089900729
--- /dev/null
+++ b/.github/pr-deployments/template/main.tf
@@ -0,0 +1,314 @@
+terraform {
+  required_providers {
+    coder = {
+      source = "coder/coder"
+    }
+    kubernetes = {
+      source = "hashicorp/kubernetes"
+    }
+  }
+}
+
+provider "coder" {
+}
+
+variable "namespace" {
+  type        = string
+  description = "The Kubernetes namespace to create workspaces in (must exist prior to creating workspaces)"
+}
+
+data "coder_parameter" "cpu" {
+  name         = "cpu"
+  display_name = "CPU"
+  description  = "The number of CPU cores"
+  default      = "2"
+  icon         = "/icon/memory.svg"
+  mutable      = true
+  option {
+    name  = "2 Cores"
+    value = "2"
+  }
+  option {
+    name  = "4 Cores"
+    value = "4"
+  }
+  option {
+    name  = "6 Cores"
+    value = "6"
+  }
+  option {
+    name  = "8 Cores"
+    value = "8"
+  }
+}
+
+data "coder_parameter" "memory" {
+  name         = "memory"
+  display_name = "Memory"
+  description  = "The amount of memory in GB"
+  default      = "2"
+  icon         = "/icon/memory.svg"
+  mutable      = true
+  option {
+    name  = "2 GB"
+    value = "2"
+  }
+  option {
+    name  = "4 GB"
+    value = "4"
+  }
+  option {
+    name  = "6 GB"
+    value = "6"
+  }
+  option {
+    name  = "8 GB"
+    value = "8"
+  }
+}
+
+data "coder_parameter" "home_disk_size" {
+  name         = "home_disk_size"
+  display_name = "Home disk size"
+  description  = "The size of the home disk in GB"
+  default      = "10"
+  type         = "number"
+  icon         = "/emojis/1f4be.png"
+  mutable      = false
+  validation {
+    min = 1
+    max = 99999
+  }
+}
+
+provider "kubernetes" {
+  config_path = null
+}
+
+data "coder_workspace" "me" {}
+
+resource "coder_agent" "main" {
+  os                     = "linux"
+  arch                   = "amd64"
+  startup_script_timeout = 180
+  startup_script         = <<-EOT
+    set -e
+
+    # install and start code-server
+    curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server
+    /tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &
+
+  EOT
+
+  # The following metadata blocks are optional. They are used to display
+  # information about your workspace in the dashboard. You can remove them
+  # if you don't want to display any information.
+  # For basic resources, you can use the `coder stat` command.
+  # If you need more control, you can write your own script.
+  metadata {
+    display_name = "CPU Usage"
+    key          = "0_cpu_usage"
+    script       = "coder stat cpu"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "RAM Usage"
+    key          = "1_ram_usage"
+    script       = "coder stat mem"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Home Disk"
+    key          = "3_home_disk"
+    script       = "coder stat disk --path $${HOME}"
+    interval     = 60
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "CPU Usage (Host)"
+    key          = "4_cpu_usage_host"
+    script       = "coder stat cpu --host"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Memory Usage (Host)"
+    key          = "5_mem_usage_host"
+    script       = "coder stat mem --host"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Load Average (Host)"
+    key          = "6_load_host"
+    # get load avg scaled by number of cores
+    script   = <<EOT
+      echo "`cat /proc/loadavg | awk '{ print $1 }'` `nproc`" | awk '{ printf "%0.2f", $1/$2 }'
+    EOT
+    interval = 60
+    timeout  = 1
+  }
+}
+
+# code-server
+resource "coder_app" "code-server" {
+  agent_id     = coder_agent.main.id
+  slug         = "code-server"
+  display_name = "code-server"
+  icon         = "/icon/code.svg"
+  url          = "http://localhost:13337?folder=/home/coder"
+  subdomain    = false
+  share        = "owner"
+
+  healthcheck {
+    url       = "http://localhost:13337/healthz"
+    interval  = 3
+    threshold = 10
+  }
+}
+
+resource "kubernetes_persistent_volume_claim" "home" {
+  metadata {
+    name      = "coder-${lower(data.coder_workspace.me.owner)}-${lower(data.coder_workspace.me.name)}-home"
+    namespace = var.namespace
+    labels = {
+      "app.kubernetes.io/name"     = "coder-pvc"
+      "app.kubernetes.io/instance" = "coder-pvc-${lower(data.coder_workspace.me.owner)}-${lower(data.coder_workspace.me.name)}"
+      "app.kubernetes.io/part-of"  = "coder"
+      //Coder-specific labels.
+      "com.coder.resource"       = "true"
+      "com.coder.workspace.id"   = data.coder_workspace.me.id
+      "com.coder.workspace.name" = data.coder_workspace.me.name
+      "com.coder.user.id"        = data.coder_workspace.me.owner_id
+      "com.coder.user.username"  = data.coder_workspace.me.owner
+    }
+    annotations = {
+      "com.coder.user.email" = data.coder_workspace.me.owner_email
+    }
+  }
+  wait_until_bound = false
+  spec {
+    access_modes = ["ReadWriteOnce"]
+    resources {
+      requests = {
+        storage = "${data.coder_parameter.home_disk_size.value}Gi"
+      }
+    }
+  }
+}
+
+resource "kubernetes_deployment" "main" {
+  count = data.coder_workspace.me.start_count
+  depends_on = [
+    kubernetes_persistent_volume_claim.home
+  ]
+  wait_for_rollout = false
+  metadata {
+    name      = "coder-${lower(data.coder_workspace.me.owner)}-${lower(data.coder_workspace.me.name)}"
+    namespace = var.namespace
+    labels = {
+      "app.kubernetes.io/name"     = "coder-workspace"
+      "app.kubernetes.io/instance" = "coder-workspace-${lower(data.coder_workspace.me.owner)}-${lower(data.coder_workspace.me.name)}"
+      "app.kubernetes.io/part-of"  = "coder"
+      "com.coder.resource"         = "true"
+      "com.coder.workspace.id"     = data.coder_workspace.me.id
+      "com.coder.workspace.name"   = data.coder_workspace.me.name
+      "com.coder.user.id"          = data.coder_workspace.me.owner_id
+      "com.coder.user.username"    = data.coder_workspace.me.owner
+    }
+    annotations = {
+      "com.coder.user.email" = data.coder_workspace.me.owner_email
+    }
+  }
+
+  spec {
+    replicas = 1
+    selector {
+      match_labels = {
+        "app.kubernetes.io/name" = "coder-workspace"
+      }
+    }
+    strategy {
+      type = "Recreate"
+    }
+
+    template {
+      metadata {
+        labels = {
+          "app.kubernetes.io/name" = "coder-workspace"
+        }
+      }
+      spec {
+        security_context {
+          run_as_user = 1000
+          fs_group    = 1000
+        }
+
+        service_account_name = "coder-workspace-${var.namespace}"
+        container {
+          name              = "dev"
+          image             = "bencdr/devops-tools"
+          image_pull_policy = "Always"
+          command           = ["sh", "-c", coder_agent.main.init_script]
+          security_context {
+            run_as_user = "1000"
+          }
+          env {
+            name  = "CODER_AGENT_TOKEN"
+            value = coder_agent.main.token
+          }
+          resources {
+            requests = {
+              "cpu"    = "250m"
+              "memory" = "512Mi"
+            }
+            limits = {
+              "cpu"    = "${data.coder_parameter.cpu.value}"
+              "memory" = "${data.coder_parameter.memory.value}Gi"
+            }
+          }
+          volume_mount {
+            mount_path = "/home/coder"
+            name       = "home"
+            read_only  = false
+          }
+        }
+
+        volume {
+          name = "home"
+          persistent_volume_claim {
+            claim_name = kubernetes_persistent_volume_claim.home.metadata.0.name
+            read_only  = false
+          }
+        }
+
+        affinity {
+          // This affinity attempts to spread out all workspace pods evenly across
+          // nodes.
+          pod_anti_affinity {
+            preferred_during_scheduling_ignored_during_execution {
+              weight = 1
+              pod_affinity_term {
+                topology_key = "kubernetes.io/hostname"
+                label_selector {
+                  match_expressions {
+                    key      = "app.kubernetes.io/name"
+                    operator = "In"
+                    values   = ["coder-workspace"]
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/.github/pr-deployments/values.yaml b/.github/pr-deployments/values.yaml
new file mode 100644
index 0000000000000..9d246ec8aaa83
--- /dev/null
+++ b/.github/pr-deployments/values.yaml
@@ -0,0 +1,38 @@
+coder:
+  image:
+    repo: "${REPO}"
+    tag: "pr${PR_NUMBER}"
+    pullPolicy: Always
+  service:
+    type: ClusterIP
+  ingress:
+    enable: true
+    className: traefik
+    host: "${PR_HOSTNAME}"
+    wildcardHost: "*.${PR_HOSTNAME}"
+    tls:
+      enable: true
+      secretName: "pr${PR_NUMBER}-tls"
+      wildcardSecretName: "pr${PR_NUMBER}-tls"
+  env:
+    - name: "CODER_ACCESS_URL"
+      value: "https://${PR_HOSTNAME}"
+    - name: "CODER_WILDCARD_ACCESS_URL"
+      value: "*.${PR_HOSTNAME}"
+    - name: "CODER_EXPERIMENTS"
+      value: "${EXPERIMENTS}"
+    - name: CODER_PG_CONNECTION_URL
+      valueFrom:
+        secretKeyRef:
+          name: coder-db-url
+          key: url
+    - name: "CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS"
+      value: "true"
+    - name: "CODER_OAUTH2_GITHUB_CLIENT_ID"
+      value: "${PR_DEPLOYMENTS_GITHUB_OAUTH_CLIENT_ID}"
+    - name: "CODER_OAUTH2_GITHUB_CLIENT_SECRET"
+      value: "${PR_DEPLOYMENTS_GITHUB_OAUTH_CLIENT_SECRET}"
+    - name: "CODER_OAUTH2_GITHUB_ALLOWED_ORGS"
+      value: "coder"
+    - name: "CODER_DERP_CONFIG_URL"
+      value: "https://controlplane.tailscale.com/derpmap/default"
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 55796e29cb446..9d8efa8d42f76 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -24,7 +24,7 @@ permissions:
 # additional changes
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
   changes:
@@ -39,7 +39,7 @@ jobs:
       offlinedocs: ${{ steps.filter.outputs.offlinedocs }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
       # For pull requests it's not necessary to checkout the code
@@ -53,7 +53,6 @@ jobs:
             docs:
               - "docs/**"
               - "README.md"
-              - "examples/templates/**"
               - "examples/web-server/**"
               - "examples/monitoring/**"
               - "examples/lima/**"
@@ -110,7 +109,7 @@ jobs:
     runs-on: ${{ github.repository_owner == 'coder' && 'buildjet-8vcpu-ubuntu-2204' || 'ubuntu-latest' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
@@ -137,7 +136,7 @@ jobs:
 
       # Check for any typos
       - name: Check for typos
-        uses: crate-ci/typos@v1.16.1
+        uses: crate-ci/typos@v1.16.21
         with:
           config: .github/workflows/typos.toml
 
@@ -165,7 +164,7 @@ jobs:
     if: needs.changes.outputs.docs-only == 'false' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
@@ -188,16 +187,13 @@ jobs:
 
       - name: Install Protoc
         run: |
-          # protoc must be in lockstep with our dogfood Dockerfile or the
-          # version in the comments will differ. This is also defined in
-          # security.yaml
-          set -x
-          cd dogfood
-          DOCKER_BUILDKIT=1 docker build . --target proto -t protoc
-          protoc_path=/usr/local/bin/protoc
-          docker run --rm --entrypoint cat protoc /tmp/bin/protoc > $protoc_path
-          chmod +x $protoc_path
-          protoc --version
+          mkdir -p /tmp/proto
+          pushd /tmp/proto
+          curl -L -o protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v23.3/protoc-23.3-linux-x86_64.zip
+          unzip protoc.zip
+          cp -r ./bin/* /usr/local/bin
+          cp -r ./include /usr/local/bin/include
+          popd
 
       - name: make gen
         run: "make --output-sync -j -B gen"
@@ -212,7 +208,7 @@ jobs:
     timeout-minutes: 7
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
@@ -224,10 +220,10 @@ jobs:
         with:
           # This doesn't need caching. It's super fast anyways!
           cache: false
-          go-version: 1.20.6
+          go-version: 1.20.10
 
       - name: Install shfmt
-        run: go install mvdan.cc/sh/v3/cmd/shfmt@v3.5.0
+        run: go install mvdan.cc/sh/v3/cmd/shfmt@v3.7.0
 
       - name: make fmt
         run: |
@@ -238,7 +234,7 @@ jobs:
         run: ./scripts/check_unstaged.sh
 
   test-go:
-    runs-on: ${{ matrix.os == 'ubuntu-latest' && github.repository_owner == 'coder' && 'buildjet-4vcpu-ubuntu-2204' || matrix.os == 'macos-latest' && github.repository_owner == 'coder' && 'macos-latest-xl' || matrix.os == 'windows-2019' && github.repository_owner == 'coder' && 'windows-latest-8-cores' || matrix.os }}
+    runs-on: ${{ matrix.os == 'ubuntu-latest' && github.repository_owner == 'coder' && 'buildjet-4vcpu-ubuntu-2204' || matrix.os == 'macos-latest' && github.repository_owner == 'coder' && 'macos-latest-xlarge' || matrix.os == 'windows-2022' && github.repository_owner == 'coder' && 'windows-latest-16-cores' || matrix.os }}
     needs: changes
     if: needs.changes.outputs.go == 'true' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
     timeout-minutes: 20
@@ -248,10 +244,10 @@ jobs:
         os:
           - ubuntu-latest
           - macos-latest
-          - windows-2019
+          - windows-2022
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
@@ -275,22 +271,29 @@ jobs:
             echo "cover=false" >> $GITHUB_OUTPUT
           fi
 
+          # if macOS, install google-chrome for scaletests. As another concern,
+          # should we really have this kind of external dependency requirement
+          # on standard CI?
+          if [ "${{ matrix.os }}" == "macos-latest" ]; then
+            brew install google-chrome
+          fi
+
           # By default Go will use the number of logical CPUs, which
           # is a fine default.
           PARALLEL_FLAG=""
 
+          # macOS will output "The default interactive shell is now zsh"
+          # intermittently in CI...
+          if [ "${{ matrix.os }}" == "macos-latest" ]; then
+            touch ~/.bash_profile && echo "export BASH_SILENCE_DEPRECATION_WARNING=1" >> ~/.bash_profile
+          fi
           export TS_DEBUG_DISCO=true
           gotestsum --junitfile="gotests.xml" --jsonfile="gotests.json" \
             --packages="./..." -- $PARALLEL_FLAG -short -failfast $COVERAGE_FLAGS
 
-      - name: Print test stats
-        if: success() || failure()
-        run: |
-          # Artifacts are not available after rerunning a job,
-          # so we need to print the test stats to the log.
-          go run ./scripts/ci-report/main.go gotests.json | tee gotests_stats.json
-
       - name: Upload test stats to Datadog
+        timeout-minutes: 1
+        continue-on-error: true
         uses: ./.github/actions/upload-datadog
         if: success() || failure()
         with:
@@ -320,7 +323,7 @@ jobs:
     timeout-minutes: 25
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
@@ -335,14 +338,9 @@ jobs:
           export TS_DEBUG_DISCO=true
           make test-postgres
 
-      - name: Print test stats
-        if: success() || failure()
-        run: |
-          # Artifacts are not available after rerunning a job,
-          # so we need to print the test stats to the log.
-          go run ./scripts/ci-report/main.go gotests.json | tee gotests_stats.json
-
       - name: Upload test stats to Datadog
+        timeout-minutes: 1
+        continue-on-error: true
         uses: ./.github/actions/upload-datadog
         if: success() || failure()
         with:
@@ -368,7 +366,7 @@ jobs:
     timeout-minutes: 25
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
@@ -383,6 +381,8 @@ jobs:
           gotestsum --junitfile="gotests.xml" -- -race ./...
 
       - name: Upload test stats to Datadog
+        timeout-minutes: 1
+        continue-on-error: true
         uses: ./.github/actions/upload-datadog
         if: always()
         with:
@@ -390,7 +390,7 @@ jobs:
 
   deploy:
     name: "deploy"
-    runs-on: ${{ github.repository_owner == 'coder' && 'buildjet-8vcpu-ubuntu-2204' || 'ubuntu-latest' }}
+    runs-on: ${{ github.repository_owner == 'coder' && 'buildjet-16vcpu-ubuntu-2204' || 'ubuntu-latest' }}
     timeout-minutes: 30
     needs: changes
     if: |
@@ -401,7 +401,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -489,7 +489,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
@@ -513,13 +513,13 @@ jobs:
           flags: unittest-js
 
   test-e2e:
-    runs-on: ${{ github.repository_owner == 'coder' && 'buildjet-8vcpu-ubuntu-2204' || 'ubuntu-latest' }}
+    runs-on: ${{ github.repository_owner == 'coder' && 'buildjet-16vcpu-ubuntu-2204' || 'ubuntu-latest' }}
     needs: changes
     if: needs.changes.outputs.go == 'true' || needs.changes.outputs.ts == 'true' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 1
 
@@ -532,6 +532,24 @@ jobs:
       - name: Setup Terraform
         uses: ./.github/actions/setup-tf
 
+      - name: go install tools
+        run: |
+          go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.30
+          go install storj.io/drpc/cmd/protoc-gen-go-drpc@v0.0.33
+          go install golang.org/x/tools/cmd/goimports@latest
+          go install github.com/mikefarah/yq/v4@v4.30.6
+          go install github.com/golang/mock/mockgen@v1.6.0
+
+      - name: Install Protoc
+        run: |
+          mkdir -p /tmp/proto
+          pushd /tmp/proto
+          curl -L -o protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v23.3/protoc-23.3-linux-x86_64.zip
+          unzip protoc.zip
+          cp -r ./bin/* /usr/local/bin
+          cp -r ./include /usr/local/bin/include
+          popd
+
       - name: Build
         run: |
           make -B site/out/index.html
@@ -539,7 +557,7 @@ jobs:
       - run: pnpm playwright:install
         working-directory: site
 
-      - run: pnpm playwright:test
+      - run: pnpm playwright:test --workers 1
         env:
           DEBUG: pw:api
         working-directory: site
@@ -552,6 +570,14 @@ jobs:
           path: ./site/test-results/**/*.webm
           retention-days: 7
 
+      - name: Upload pprof dumps
+        if: always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
+        uses: actions/upload-artifact@v3
+        with:
+          name: debug-pprof-dumps
+          path: ./site/test-results/**/debug-pprof-*.txt
+          retention-days: 7
+
   chromatic:
     # REMARK: this is only used to build storybook and deploy it to Chromatic.
     runs-on: ubuntu-latest
@@ -559,7 +585,7 @@ jobs:
     if: needs.changes.outputs.ts == 'true' || needs.changes.outputs.ci == 'true'
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # Required by Chromatic for build-over-build history, otherwise we
           # only get 1 commit on shallow checkout.
@@ -586,6 +612,7 @@ jobs:
           # https://www.chromatic.com/docs/github-actions#forked-repositories
           projectToken: 695c25b6cb65
           workingDir: "./site"
+          storybookBaseDir: "./site"
           # Prevent excessive build runs on minor version changes
           skip: "@(renovate/**|dependabot/**)"
           # Run TurboSnap to trace file dependencies to related stories
@@ -611,6 +638,7 @@ jobs:
           buildScriptName: "storybook:build"
           projectToken: 695c25b6cb65
           workingDir: "./site"
+          storybookBaseDir: "./site"
           # Run TurboSnap to trace file dependencies to related stories
           # and tell chromatic to only take snapshots of relevent stories
           onlyChanged: true
@@ -622,7 +650,7 @@ jobs:
     if: needs.changes.outputs.offlinedocs == 'true' || needs.changes.outputs.ci == 'true'
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           # 0 is required here for version.sh to work.
           fetch-depth: 0
@@ -640,9 +668,7 @@ jobs:
           go install github.com/golang/mock/mockgen@v1.6.0
 
       - name: Setup sqlc
-        uses: sqlc-dev/setup-sqlc@v3
-        with:
-          sqlc-version: "1.19.1"
+        uses: ./.github/actions/setup-sqlc
 
       - name: Format
         run: |
@@ -668,6 +694,7 @@ jobs:
       - test-go-pg
       - test-go-race
       - test-js
+      - test-e2e
       - offlinedocs
     # Allow this job to run even if the needed jobs fail, are skipped or
     # cancelled.
@@ -703,7 +730,7 @@ jobs:
       DOCKER_CLI_EXPERIMENTAL: "enabled"
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -717,13 +744,14 @@ jobs:
         uses: ./.github/actions/setup-sqlc
 
       - name: GHCR Login
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push Linux amd64 Docker image
+        id: build_and_push
         run: |
           set -euxo pipefail
           go mod download
@@ -738,3 +766,19 @@ jobs:
             --version $version \
             --push \
             build/coder_linux_amd64
+
+          # Tag image with new package tag and push
+          tag=$(echo "$version" | sed 's/+/-/g')
+          docker tag ghcr.io/coder/coder-preview:main ghcr.io/coder/coder-preview:main-$tag
+          docker push ghcr.io/coder/coder-preview:main-$tag
+
+      - name: Prune old images
+        uses: vlaurin/action-ghcr-prune@v0.5.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          organization: coder
+          container: coder-preview
+          keep-younger-than: 7 # days
+          keep-tags-regexes: ^pr
+          prune-tags-regexes: ^main-
+          prune-untagged: true
diff --git a/.github/workflows/contrib.yaml b/.github/workflows/contrib.yaml
index e3365d1abe24c..d7efb4274e14a 100644
--- a/.github/workflows/contrib.yaml
+++ b/.github/workflows/contrib.yaml
@@ -34,7 +34,7 @@ jobs:
     steps:
       - name: cla
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
-        uses: contributor-assistant/github-action@v2.3.0
+        uses: contributor-assistant/github-action@v2.3.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # the below token should have repo scope and must be manually added by you in the repository's secret
@@ -46,7 +46,8 @@ jobs:
           path-to-document: "https://github.com/coder/cla/blob/main/README.md"
           # branch should not be protected
           branch: "main"
-          allowlist: dependabot*
+          # Some users have signed a corporate CLA with Coder so are exempt from signing our community one.
+          allowlist: "coryb,aaronlehmann,dependabot*"
 
   release-labels:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/docker-base.yaml b/.github/workflows/docker-base.yaml
index 7eb4a01c8e806..c88bea3ef182a 100644
--- a/.github/workflows/docker-base.yaml
+++ b/.github/workflows/docker-base.yaml
@@ -32,10 +32,10 @@ jobs:
     if: github.repository_owner == 'coder'
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Docker login
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/dogfood.yaml b/.github/workflows/dogfood.yaml
index f1a6c2e712fd0..b265504c0c73f 100644
--- a/.github/workflows/dogfood.yaml
+++ b/.github/workflows/dogfood.yaml
@@ -5,11 +5,15 @@ on:
     branches:
       - main
     paths:
+      - "flake.nix"
+      - "flake.lock"
       - "dogfood/**"
       - ".github/workflows/dogfood.yaml"
   # Uncomment these lines when testing with CI.
   # pull_request:
   #   paths:
+  #     - "flake.nix"
+  #     - "flake.lock"
   #     - "dogfood/**"
   #     - ".github/workflows/dogfood.yaml"
   workflow_dispatch:
@@ -18,6 +22,9 @@ jobs:
   deploy_image:
     runs-on: buildjet-4vcpu-ubuntu-2204
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Get branch name
         id: branch-name
         uses: tj-actions/branch-names@v6.5
@@ -30,34 +37,31 @@ jobs:
           tag=${tag//\//--}
           echo "tag=${tag}" >> $GITHUB_OUTPUT
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v6
+
+      - name: Run the Magic Nix Cache
+        uses: DeterminateSystems/magic-nix-cache-action@v2
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+      - run: nix build .#devEnvImage && ./result | docker load
 
       - name: Login to DockerHub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-      - name: Build and push
-        uses: docker/build-push-action@v4
-        with:
-          context: "{{defaultContext}}:dogfood"
-          pull: true
-          push: true
-          tags: "codercom/oss-dogfood:${{ steps.docker-tag-name.outputs.tag }},codercom/oss-dogfood:latest"
-          cache-from: type=registry,ref=codercom/oss-dogfood:latest
-          cache-to: type=inline
+      - name: Tag and Push
+        run: |
+          docker tag codercom/oss-dogfood:latest codercom/oss-dogfood:${{ steps.docker-tag-name.outputs.tag }}
+          docker push codercom/oss-dogfood -a
 
   deploy_template:
     needs: deploy_image
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Get short commit SHA
         id: vars
diff --git a/.github/workflows/nightly-gauntlet.yaml b/.github/workflows/nightly-gauntlet.yaml
index 3e18a1a85058b..592abe921c013 100644
--- a/.github/workflows/nightly-gauntlet.yaml
+++ b/.github/workflows/nightly-gauntlet.yaml
@@ -17,7 +17,7 @@ jobs:
     timeout-minutes: 240
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup Go
         uses: ./.github/actions/setup-go
@@ -44,7 +44,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup Go
         uses: ./.github/actions/setup-go
diff --git a/.github/workflows/pr-auto-assign.yaml b/.github/workflows/pr-auto-assign.yaml
index 94afac8290931..ba6ad2fa05314 100644
--- a/.github/workflows/pr-auto-assign.yaml
+++ b/.github/workflows/pr-auto-assign.yaml
@@ -14,4 +14,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Assign author
-        uses: toshimaru/auto-author-assign@v1.6.2
+        uses: toshimaru/auto-author-assign@v2.0.1
diff --git a/.github/workflows/pr-cleanup.yaml b/.github/workflows/pr-cleanup.yaml
index 510c8f4299361..d32ea2f5d49b7 100644
--- a/.github/workflows/pr-cleanup.yaml
+++ b/.github/workflows/pr-cleanup.yaml
@@ -1,4 +1,4 @@
-name: Cleanup PR deployment and image
+name: pr-cleanup
 on:
   pull_request:
     types: closed
@@ -35,14 +35,14 @@ jobs:
 
       - name: Set up kubeconfig
         run: |
-          set -euxo pipefail
+          set -euo pipefail
           mkdir -p ~/.kube
           echo "${{ secrets.PR_DEPLOYMENTS_KUBECONFIG }}" > ~/.kube/config
           export KUBECONFIG=~/.kube/config
 
       - name: Delete helm release
         run: |
-          set -euxo pipefail
+          set -euo pipefail
           helm delete --namespace "pr${{ steps.pr_number.outputs.PR_NUMBER }}" "pr${{ steps.pr_number.outputs.PR_NUMBER }}" || echo "helm release not found"
 
       - name: "Remove PR namespace"
@@ -51,7 +51,7 @@ jobs:
 
       - name: "Remove DNS records"
         run: |
-          set -euxo pipefail
+          set -euo pipefail
           # Get identifier for the record
           record_id=$(curl -X GET "https://api.cloudflare.com/client/v4/zones/${{ secrets.PR_DEPLOYMENTS_ZONE_ID }}/dns_records?name=%2A.pr${{ steps.pr_number.outputs.PR_NUMBER }}.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}" \
           -H "Authorization: Bearer ${{ secrets.PR_DEPLOYMENTS_CLOUDFLARE_API_TOKEN }}" \
diff --git a/.github/workflows/pr-deploy.yaml b/.github/workflows/pr-deploy.yaml
index adc0e2d25c376..858821c08a6cc 100644
--- a/.github/workflows/pr-deploy.yaml
+++ b/.github/workflows/pr-deploy.yaml
@@ -4,24 +4,30 @@
 # 3. when a PR is updated
 name: Deploy PR
 on:
-  pull_request:
-    types: synchronize
+  push:
+    branches-ignore:
+      - main
   workflow_dispatch:
     inputs:
       pr_number:
         description: "PR number"
         type: number
         required: true
-      skip_build:
-        description: "Skip build job"
-        required: false
-        type: boolean
-        default: false
       experiments:
         description: "Experiments to enable"
         required: false
         type: string
         default: "*"
+      build:
+        description: "Force new build"
+        required: false
+        type: boolean
+        default: false
+      deploy:
+        description: "Force new deployment"
+        required: false
+        type: boolean
+        default: false
 
 env:
   REPO: ghcr.io/coder/coder-preview
@@ -29,43 +35,66 @@ env:
 permissions:
   contents: read
   packages: write
-  pull-requests: write
-
-concurrency:
-  group: ${{ github.workflow }}-PR-${{ github.event.pull_request.number || github.event.inputs.pr_number }}
-  cancel-in-progress: true
+  pull-requests: write # needed for commenting on PRs
 
 jobs:
+  check_pr:
+    runs-on: ubuntu-latest
+    outputs:
+      PR_OPEN: ${{ steps.check_pr.outputs.pr_open }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check if PR is open
+        id: check_pr
+        run: |
+          set -euo pipefail
+          pr_open=true
+          if [[ "$(gh pr view --json state | jq -r '.state')" != "OPEN" ]]; then
+            echo "PR doesn't exist or is closed."
+            pr_open=false
+          fi
+          echo "pr_open=$pr_open" >> $GITHUB_OUTPUT
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   get_info:
-    if: github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request'
+    needs: check_pr
+    if: ${{ needs.check_pr.outputs.PR_OPEN == 'true' }}
     outputs:
       PR_NUMBER: ${{ steps.pr_info.outputs.PR_NUMBER }}
       PR_TITLE: ${{ steps.pr_info.outputs.PR_TITLE }}
       PR_URL: ${{ steps.pr_info.outputs.PR_URL }}
-      PR_BRANCH: ${{ steps.pr_info.outputs.PR_BRANCH }}
       CODER_BASE_IMAGE_TAG: ${{ steps.set_tags.outputs.CODER_BASE_IMAGE_TAG }}
       CODER_IMAGE_TAG: ${{ steps.set_tags.outputs.CODER_IMAGE_TAG }}
-      NEW: ${{ steps.check_deployment.outputs.new }}
-      BUILD: ${{ steps.filter.outputs.all_count > steps.filter.outputs.ignored_count || steps.check_deployment.outputs.new }}
+      NEW: ${{ steps.check_deployment.outputs.NEW }}
+      BUILD: ${{ steps.build_conditionals.outputs.first_or_force_build == 'true' || steps.build_conditionals.outputs.automatic_rebuild == 'true' }}
 
     runs-on: "ubuntu-latest"
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
       - name: Get PR number, title, and branch name
         id: pr_info
         run: |
-          set -euxo pipefail
-          PR_NUMBER=${{ github.event.inputs.pr_number || github.event.pull_request.number }}
-          PR_TITLE=$(curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" https://api.github.com/repos/coder/coder/pulls/$PR_NUMBER | jq -r '.title')
-          PR_BRANCH=$(curl -s -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" https://api.github.com/repos/coder/coder/pulls/$PR_NUMBER | jq -r '.head.ref')
-          echo "PR_URL=https://github.com/coder/coder/pull/$PR_NUMBER" >> $GITHUB_OUTPUT
+          set -euo pipefail
+          PR_NUMBER=$(gh pr view --json number | jq -r '.number')
+          PR_TITLE=$(gh pr view --json title | jq -r '.title')
+          PR_URL=$(gh pr view --json url | jq -r '.url')
+          echo "PR_URL=$PR_URL" >> $GITHUB_OUTPUT
           echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_OUTPUT
           echo "PR_TITLE=$PR_TITLE" >> $GITHUB_OUTPUT
-          echo "PR_BRANCH=$PR_BRANCH" >> $GITHUB_OUTPUT
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set required tags
         id: set_tags
         run: |
-          set -euxo pipefail
+          set -euo pipefail
           echo "CODER_BASE_IMAGE_TAG=$CODER_BASE_IMAGE_TAG" >> $GITHUB_OUTPUT
           echo "CODER_IMAGE_TAG=$CODER_IMAGE_TAG" >> $GITHUB_OUTPUT
         env:
@@ -74,61 +103,30 @@ jobs:
 
       - name: Set up kubeconfig
         run: |
-          set -euxo pipefail
+          set -euo pipefail
           mkdir -p ~/.kube
           echo "${{ secrets.PR_DEPLOYMENTS_KUBECONFIG }}" > ~/.kube/config
+          chmod 644 ~/.kube/config
           export KUBECONFIG=~/.kube/config
 
       - name: Check if the helm deployment already exists
         id: check_deployment
         run: |
-          set -euxo pipefail
+          set -euo pipefail
           if helm status "pr${{ steps.pr_info.outputs.PR_NUMBER }}" --namespace "pr${{ steps.pr_info.outputs.PR_NUMBER }}" > /dev/null 2>&1; then
             echo "Deployment already exists. Skipping deployment."
-            new=false
+            NEW=false
           else
             echo "Deployment doesn't exist."
-            new=true
+            NEW=true
           fi
-          echo "new=$new" >> $GITHUB_OUTPUT
-
-      - name: Find Comment
-        uses: peter-evans/find-comment@v2
-        if: github.event_name == 'workflow_dispatch' || steps.check_deployment.outputs.NEW == 'false'
-        id: fc
-        with:
-          issue-number: ${{ steps.pr_info.outputs.PR_NUMBER }}
-          comment-author: "github-actions[bot]"
-          body-includes: ":rocket:"
-          direction: last
-
-      - name: Comment on PR
-        id: comment_id
-        if: github.event_name == 'workflow_dispatch' || steps.check_deployment.outputs.NEW == 'false'
-        uses: peter-evans/create-or-update-comment@v3
-        with:
-          comment-id: ${{ steps.fc.outputs.comment-id }}
-          issue-number: ${{ steps.pr_info.outputs.PR_NUMBER }}
-          edit-mode: replace
-          body: |
-            ---
-            :rocket: Deploying PR ${{ steps.pr_info.outputs.PR_NUMBER }} ...
-            ---
-          reactions: eyes
-          reactions-edit-mode: replace
-
-      - name: Checkout
-        if: github.event_name == 'workflow_dispatch' || steps.check_deployment.outputs.NEW == 'false'
-        uses: actions/checkout@v3
-        with:
-          ref: ${{ steps.pr_info.outputs.PR_BRANCH }}
-          fetch-depth: 0
+          echo "NEW=$NEW" >> $GITHUB_OUTPUT
 
       - name: Check changed files
-        if: github.event_name == 'workflow_dispatch' || steps.check_deployment.outputs.NEW == 'false'
         uses: dorny/paths-filter@v2
         id: filter
         with:
+          base: ${{ github.ref }}
           filters: |
             all:
               - "**"
@@ -149,57 +147,85 @@ jobs:
               - "scripts/**/*[^D][^o][^c][^k][^e][^r][^f][^i][^l][^e][.][b][^a][^s][^e]*"
 
       - name: Print number of changed files
-        if: github.event_name == 'workflow_dispatch' || steps.check_deployment.outputs.NEW == 'false'
         run: |
-          set -euxo pipefail
+          set -euo pipefail
           echo "Total number of changed files: ${{ steps.filter.outputs.all_count }}"
           echo "Number of ignored files: ${{ steps.filter.outputs.ignored_count }}"
 
+      - name: Build conditionals
+        id: build_conditionals
+        run: |
+          set -euo pipefail
+          # build if the workflow is manually triggered and the deployment doesn't exist (first build or force rebuild)
+          echo "first_or_force_build=${{ (github.event_name == 'workflow_dispatch' && steps.check_deployment.outputs.NEW == 'true') || github.event.inputs.build == 'true' }}" >> $GITHUB_OUTPUT
+          # build if the deployment alreday exist and there are changes in the files that we care about (automatic updates)
+          echo "automatic_rebuild=${{ steps.check_deployment.outputs.NEW == 'false' && steps.filter.outputs.all_count > steps.filter.outputs.ignored_count }}" >> $GITHUB_OUTPUT
+
+  comment-pr:
+    needs: get_info
+    if: needs.get_info.outputs.BUILD == 'true' || github.event.inputs.deploy == 'true'
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: Find Comment
+        uses: peter-evans/find-comment@v2
+        id: fc
+        with:
+          issue-number: ${{ needs.get_info.outputs.PR_NUMBER }}
+          comment-author: "github-actions[bot]"
+          body-includes: ":rocket:"
+          direction: last
+
+      - name: Comment on PR
+        id: comment_id
+        uses: peter-evans/create-or-update-comment@v3
+        with:
+          comment-id: ${{ steps.fc.outputs.comment-id }}
+          issue-number: ${{ needs.get_info.outputs.PR_NUMBER }}
+          edit-mode: replace
+          body: |
+            ---
+            :rocket: Deploying PR ${{ needs.get_info.outputs.PR_NUMBER }} ...
+            ---
+          reactions: eyes
+          reactions-edit-mode: replace
+
   build:
     needs: get_info
-    # Skips the build job if the workflow was triggered by a workflow_dispatch event and the skip_build input is set to true
-    # or if the workflow was triggered by an issue_comment event and the comment body contains --skip-build
-    # always run the build job if a pull_request event triggered the workflow
-    if: |
-      (github.event_name == 'workflow_dispatch' && github.event.inputs.skip_build == 'false') ||
-      (github.event_name == 'pull_request' && needs.get_info.result == 'success' && needs.get_info.outputs.NEW == 'false')
+    # Run build job only if there are changes in the files that we care about or if the workflow is manually triggered with --build flag
+    if: needs.get_info.outputs.BUILD == 'true'
     runs-on: ${{ github.repository_owner == 'coder' && 'buildjet-8vcpu-ubuntu-2204' || 'ubuntu-latest' }}
+    # This concurrency only cancels build jobs if a new build is triggred. It will avoid cancelling the current deployemtn in case of docs chnages.
+    concurrency:
+      group: build-${{ github.workflow }}-${{ github.ref }}-${{ needs.get_info.outputs.BUILD }}
+      cancel-in-progress: true
     env:
       DOCKER_CLI_EXPERIMENTAL: "enabled"
       CODER_IMAGE_TAG: ${{ needs.get_info.outputs.CODER_IMAGE_TAG }}
-      PR_NUMBER: ${{ needs.get_info.outputs.PR_NUMBER }}
-      PR_BRANCH: ${{ needs.get_info.outputs.PR_BRANCH }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
-          ref: ${{ env.PR_BRANCH }}
           fetch-depth: 0
 
       - name: Setup Node
-        if: needs.get_info.outputs.BUILD == 'true'
         uses: ./.github/actions/setup-node
 
       - name: Setup Go
-        if: needs.get_info.outputs.BUILD == 'true'
         uses: ./.github/actions/setup-go
 
       - name: Setup sqlc
-        if: needs.get_info.outputs.BUILD == 'true'
         uses: ./.github/actions/setup-sqlc
 
       - name: GHCR Login
-        if: needs.get_info.outputs.BUILD == 'true'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push Linux amd64 Docker image
-        if: needs.get_info.outputs.BUILD == 'true'
         run: |
-          set -euxo pipefail
+          set -euo pipefail
           go mod download
           make gen/mark-fresh
           export DOCKER_IMAGE_NO_PREREQUISITES=true
@@ -217,35 +243,43 @@ jobs:
     needs: [build, get_info]
     # Run deploy job only if build job was successful or skipped
     if: |
-      always() && (needs.build.result == 'success' || needs.build.result == 'skipped') && 
-      (github.event_name == 'workflow_dispatch' || needs.get_info.outputs.NEW == 'false')
+      always() && (needs.build.result == 'success' || needs.build.result == 'skipped') &&
+      (needs.get_info.outputs.BUILD == 'true' || github.event.inputs.deploy == 'true')
     runs-on: "ubuntu-latest"
     env:
       CODER_IMAGE_TAG: ${{ needs.get_info.outputs.CODER_IMAGE_TAG }}
       PR_NUMBER: ${{ needs.get_info.outputs.PR_NUMBER }}
       PR_TITLE: ${{ needs.get_info.outputs.PR_TITLE }}
       PR_URL: ${{ needs.get_info.outputs.PR_URL }}
-      PR_BRANCH: ${{ needs.get_info.outputs.PR_BRANCH }}
-      PR_DEPLOYMENT_ACCESS_URL: "pr${{ needs.get_info.outputs.PR_NUMBER }}.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}"
+      PR_HOSTNAME: "pr${{ needs.get_info.outputs.PR_NUMBER }}.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}"
     steps:
       - name: Set up kubeconfig
         run: |
-          set -euxo pipefail
+          set -euo pipefail
           mkdir -p ~/.kube
           echo "${{ secrets.PR_DEPLOYMENTS_KUBECONFIG }}" > ~/.kube/config
+          chmod 644 ~/.kube/config
           export KUBECONFIG=~/.kube/config
 
       - name: Check if image exists
-        if: needs.get_info.outputs.NEW == 'true'
         run: |
-          set -euxo pipefail
-          foundTag=$(curl -fsSL https://github.com/coder/coder/pkgs/container/coder-preview | grep -o ${{ env.CODER_IMAGE_TAG }} | head -n 1)
+          set -euo pipefail
+          foundTag=$(
+            gh api /orgs/coder/packages/container/coder-preview/versions |
+            jq -r --arg tag "pr${{ env.PR_NUMBER }}" '.[] |
+            select(.metadata.container.tags == [$tag]) |
+            .metadata.container.tags[0]'
+          )
           if [ -z "$foundTag" ]; then
             echo "Image not found"
             echo "${{ env.CODER_IMAGE_TAG }} not found in ghcr.io/coder/coder-preview"
-            echo "Please remove --skip-build from the comment and try again"
             exit 1
+          else
+            echo "Image found"
+            echo "$foundTag tag found in ghcr.io/coder/coder-preview"
           fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Add DNS record to Cloudflare
         if: needs.get_info.outputs.NEW == 'true'
@@ -253,43 +287,27 @@ jobs:
           curl -X POST "https://api.cloudflare.com/client/v4/zones/${{ secrets.PR_DEPLOYMENTS_ZONE_ID }}/dns_records" \
             -H "Authorization: Bearer ${{ secrets.PR_DEPLOYMENTS_CLOUDFLARE_API_TOKEN }}" \
             -H "Content-Type:application/json" \
-            --data '{"type":"CNAME","name":"*.${{ env.PR_DEPLOYMENT_ACCESS_URL }}","content":"${{ env.PR_DEPLOYMENT_ACCESS_URL }}","ttl":1,"proxied":false}'
-
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          ref: ${{ env.PR_BRANCH }}
+            --data '{"type":"CNAME","name":"*.${{ env.PR_HOSTNAME }}","content":"${{ env.PR_HOSTNAME }}","ttl":1,"proxied":false}'
 
       - name: Create PR namespace
-        if: needs.get_info.outputs.NEW == 'true'
+        if: needs.get_info.outputs.NEW == 'true' || github.event.inputs.deploy == 'true'
         run: |
-          set -euxo pipefail
+          set -euo pipefail
           # try to delete the namespace, but don't fail if it doesn't exist
           kubectl delete namespace "pr${{ env.PR_NUMBER }}" || true
           kubectl create namespace "pr${{ env.PR_NUMBER }}"
 
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Check and Create Certificate
-        if: needs.get_info.outputs.NEW == 'true'
+        if: needs.get_info.outputs.NEW == 'true' || github.event.inputs.deploy == 'true'
         run: |
           # Using kubectl to check if a Certificate resource already exists
           # we are doing this to avoid letsenrypt rate limits
           if ! kubectl get certificate pr${{ env.PR_NUMBER }}-tls -n pr-deployment-certs > /dev/null 2>&1; then
             echo "Certificate doesn't exist. Creating a new one."
-            cat <<EOF | kubectl apply -f -
-            apiVersion: cert-manager.io/v1
-            kind: Certificate
-            metadata:
-              name: pr${{ env.PR_NUMBER }}-tls
-              namespace: pr-deployment-certs
-            spec:
-              secretName: pr${{ env.PR_NUMBER }}-tls
-              issuerRef:
-                name: letsencrypt
-                kind: ClusterIssuer
-              dnsNames:
-              - "${{ env.PR_DEPLOYMENT_ACCESS_URL }}"
-              - "*.${{ env.PR_DEPLOYMENT_ACCESS_URL }}"
-          EOF
+            envsubst < ./.github/pr-deployments/certificate.yaml | kubectl apply -f -
           else
             echo "Certificate exists. Skipping certificate creation."
           fi
@@ -306,7 +324,7 @@ jobs:
           )
 
       - name: Set up PostgreSQL database
-        if: needs.get_info.outputs.NEW == 'true'
+        if: needs.get_info.outputs.NEW == 'true' || github.event.inputs.deploy == 'true'
         run: |
           helm repo add bitnami https://charts.bitnami.com/bitnami
           helm install coder-db bitnami/postgresql \
@@ -318,82 +336,45 @@ jobs:
           kubectl create secret generic coder-db-url -n pr${{ env.PR_NUMBER }} \
             --from-literal=url="postgres://coder:coder@coder-db-postgresql.pr${{ env.PR_NUMBER }}.svc.cluster.local:5432/coder?sslmode=disable"
 
+      - name: Create a service account, role, and rolebinding for the PR namespace
+        if: needs.get_info.outputs.NEW == 'true' || github.event.inputs.deploy == 'true'
+        run: |
+          set -euo pipefail
+          # Create service account, role, rolebinding
+          envsubst < ./.github/pr-deployments/rbac.yaml | kubectl apply -f -
+
       - name: Create values.yaml
-        if: github.event_name == 'workflow_dispatch'
+        env:
+          EXPERIMENTS: ${{ github.event.inputs.experiments }}
+          PR_DEPLOYMENTS_GITHUB_OAUTH_CLIENT_ID: ${{ secrets.PR_DEPLOYMENTS_GITHUB_OAUTH_CLIENT_ID }}
+          PR_DEPLOYMENTS_GITHUB_OAUTH_CLIENT_SECRET: ${{ secrets.PR_DEPLOYMENTS_GITHUB_OAUTH_CLIENT_SECRET }}
         run: |
-          cat <<EOF > pr-deploy-values.yaml
-          coder:
-            image:
-              repo: ${{ env.REPO }}
-              tag: pr${{ env.PR_NUMBER }}
-              pullPolicy: Always
-            service:
-              type: ClusterIP
-            ingress:
-              enable: true
-              className: traefik
-              host: ${{ env.PR_DEPLOYMENT_ACCESS_URL }}
-              wildcardHost: "*.${{ env.PR_DEPLOYMENT_ACCESS_URL }}"
-              tls:
-                enable: true
-                secretName: pr${{ env.PR_NUMBER }}-tls
-                wildcardSecretName: pr${{ env.PR_NUMBER }}-tls
-            env:
-              - name: "CODER_ACCESS_URL"
-                value: "https://${{ env.PR_DEPLOYMENT_ACCESS_URL }}"
-              - name: "CODER_WILDCARD_ACCESS_URL"
-                value: "*.${{ env.PR_DEPLOYMENT_ACCESS_URL }}"
-              - name: "CODER_EXPERIMENTS"
-                value: "${{ github.event.inputs.experiments }}"
-              - name: CODER_PG_CONNECTION_URL
-                valueFrom:
-                  secretKeyRef:
-                    name: coder-db-url
-                    key: url
-              - name: "CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS"
-                value: "true"
-              - name: "CODER_OAUTH2_GITHUB_CLIENT_ID"
-                value: "${{ secrets.PR_DEPLOYMENTS_GITHUB_OAUTH_CLIENT_ID }}"
-              - name: "CODER_OAUTH2_GITHUB_CLIENT_SECRET"
-                value: "${{ secrets.PR_DEPLOYMENTS_GITHUB_OAUTH_CLIENT_SECRET }}"
-              - name: "CODER_OAUTH2_GITHUB_ALLOWED_ORGS"
-                value: "coder"
-          EOF
+          set -euo pipefail
+          envsubst < ./.github/pr-deployments/values.yaml > ./pr-deploy-values.yaml
 
       - name: Install/Upgrade Helm chart
         run: |
-          set -euxo pipefail
-          if [[ ${{ github.event_name }} == "workflow_dispatch" ]]; then
-            helm upgrade --install "pr${{ env.PR_NUMBER }}" ./helm \
-            --namespace "pr${{ env.PR_NUMBER }}" \
-            --values ./pr-deploy-values.yaml \
-            --force
-          else
-            if [[ ${{ needs.get_info.outputs.BUILD }} == "true" ]]; then
-              helm upgrade --install "pr${{ env.PR_NUMBER }}" ./helm \
-              --namespace "pr${{ env.PR_NUMBER }}" \
-              --reuse-values \
-              --force
-            else
-              echo "Skipping helm upgrade, as there is no new image to deploy"
-            fi
-          fi
+          set -euo pipefail
+          helm upgrade --install "pr${{ env.PR_NUMBER }}" ./helm/coder \
+          --namespace "pr${{ env.PR_NUMBER }}" \
+          --values ./pr-deploy-values.yaml \
+          --force
 
       - name: Install coder-logstream-kube
-        if: needs.get_info.outputs.NEW == 'true'
+        if: needs.get_info.outputs.NEW == 'true' || github.event.inputs.deploy == 'true'
         run: |
           helm repo add coder-logstream-kube https://helm.coder.com/logstream-kube
           helm upgrade --install coder-logstream-kube coder-logstream-kube/coder-logstream-kube \
             --namespace "pr${{ env.PR_NUMBER }}" \
-            --set url="https://pr${{ env.PR_NUMBER }}.${{ secrets.PR_DEPLOYMENTS_DOMAIN }}"
+            --set url="https://${{ env.PR_HOSTNAME }}"
 
       - name: Get Coder binary
-        if: needs.get_info.outputs.NEW == 'true'
+        if: needs.get_info.outputs.NEW == 'true' || github.event.inputs.deploy == 'true'
         run: |
-          set -euxo pipefail
+          set -euo pipefail
 
           DEST="${HOME}/coder"
-          URL="https://${{ env.PR_DEPLOYMENT_ACCESS_URL }}/bin/coder-linux-amd64"
+          URL="https://${{ env.PR_HOSTNAME }}/bin/coder-linux-amd64"
 
           mkdir -p "$(dirname ${DEST})"
 
@@ -414,10 +395,10 @@ jobs:
           mv "${DEST}" /usr/local/bin/coder
 
       - name: Create first user, template and workspace
-        if: needs.get_info.outputs.NEW == 'true'
+        if: needs.get_info.outputs.NEW == 'true' || github.event.inputs.deploy == 'true'
         id: setup_deployment
         run: |
-          set -euxo pipefail
+          set -euo pipefail
 
           # Create first user
 
@@ -429,28 +410,23 @@ jobs:
           echo "password=$password" >> $GITHUB_OUTPUT
 
           coder login \
-            --first-user-username test \
+            --first-user-username coder \
             --first-user-email pr${{ env.PR_NUMBER }}@coder.com \
             --first-user-password $password \
             --first-user-trial \
             --use-token-as-session \
-            https://${{ env.PR_DEPLOYMENT_ACCESS_URL }}
+            https://${{ env.PR_HOSTNAME }}
 
           # Create template
-          coder templates init --id kubernetes && cd ./kubernetes/ && coder templates create -y --variable namespace=pr${{ env.PR_NUMBER }}
+          cd ./.github/pr-deployments/template
+          coder templates create -y --variable namespace=pr${{ env.PR_NUMBER }} kubernetes
 
           # Create workspace
-          cat <<EOF > workspace.yaml
-          cpu: "2"
-          memory: "4"
-          home_disk_size: "2"
-          EOF
-
-          coder create --template="kubernetes" test --rich-parameter-file ./workspace.yaml -y
-          coder stop test -y
+          coder create --template="kubernetes" kube --parameter cpu=2 --parameter memory=4 --parameter home_disk_size=2 -y
+          coder stop kube -y
 
       - name: Send Slack notification
-        if: needs.get_info.outputs.NEW == 'true'
+        if: needs.get_info.outputs.NEW == 'true' || github.event.inputs.deploy == 'true'
         run: |
           curl -s -o /dev/null -X POST -H 'Content-type: application/json' \
             -d \
@@ -458,7 +434,7 @@ jobs:
               "pr_number": "'"${{ env.PR_NUMBER }}"'",
               "pr_url": "'"${{ env.PR_URL }}"'",
               "pr_title": "'"${{ env.PR_TITLE }}"'",
-              "pr_access_url": "'"https://${{ env.PR_DEPLOYMENT_ACCESS_URL }}"'",
+              "pr_access_url": "'"https://${{ env.PR_HOSTNAME }}"'",
               "pr_username": "'"test"'",
               "pr_email": "'"pr${{ env.PR_NUMBER }}@coder.com"'",
               "pr_password": "'"${{ steps.setup_deployment.outputs.password }}"'",
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 95f07feda29ca..f0b1f2d631379 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -28,10 +28,6 @@ env:
   # https://github.blog/changelog/2022-06-10-github-actions-inputs-unified-across-manual-and-reusable-workflows/
   CODER_RELEASE: ${{ !inputs.dry_run }}
   CODER_DRY_RUN: ${{ inputs.dry_run }}
-  # For some reason, setup-go won't actually pick up a new patch version if
-  # it has an old one cached. We need to manually specify the versions so we
-  # can get the latest release. Never use "~1.xx" here!
-  CODER_GO_VERSION: "1.20.6"
 
 jobs:
   release:
@@ -44,7 +40,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -89,7 +85,7 @@ jobs:
           cat "$CODER_RELEASE_NOTES_FILE"
 
       - name: Docker Login
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -98,16 +94,8 @@ jobs:
       - name: Setup Go
         uses: ./.github/actions/setup-go
 
-      - name: Cache Node
-        id: cache-node
-        uses: buildjet/cache@v3
-        with:
-          path: |
-            **/node_modules
-            .eslintcache
-          key: js-${{ runner.os }}-test-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            js-${{ runner.os }}-
+      - name: Setup Node
+        uses: ./.github/actions/setup-node
 
       - name: Install nsis and zstd
         run: sudo apt-get install -y nsis zstd
@@ -153,7 +141,8 @@ jobs:
             build/coder_"$version"_linux_{amd64,armv7,arm64}.{tar.gz,apk,deb,rpm} \
             build/coder_"$version"_{darwin,windows}_{amd64,arm64}.zip \
             build/coder_"$version"_windows_amd64_installer.exe \
-            build/coder_helm_"$version".tgz
+            build/coder_helm_"$version".tgz \
+            build/provisioner_helm_"$version".tgz
         env:
           CODER_SIGN_DARWIN: "1"
           AC_CERTIFICATE_FILE: /tmp/apple_cert.p12
@@ -307,9 +296,11 @@ jobs:
           version="$(./scripts/version.sh)"
           mkdir -p build/helm
           cp "build/coder_helm_${version}.tgz" build/helm
+          cp "build/provisioner_helm_${version}.tgz" build/helm
           gsutil cp gs://helm.coder.com/v2/index.yaml build/helm/index.yaml
           helm repo index build/helm --url https://helm.coder.com/v2 --merge build/helm/index.yaml
           gsutil -h "Cache-Control:no-cache,max-age=0" cp build/helm/coder_helm_${version}.tgz gs://helm.coder.com/v2
+          gsutil -h "Cache-Control:no-cache,max-age=0" cp build/helm/provisioner_helm_${version}.tgz gs://helm.coder.com/v2
           gsutil -h "Cache-Control:no-cache,max-age=0" cp build/helm/index.yaml gs://helm.coder.com/v2
           gsutil -h "Cache-Control:no-cache,max-age=0" cp helm/artifacthub-repo.yml gs://helm.coder.com/v2
 
@@ -337,13 +328,88 @@ jobs:
           event-type: coder-release
           client-payload: '{"coder_version": "${{ steps.version.outputs.version }}"}'
 
+  publish-homebrew:
+    name: Publish to Homebrew tap
+    runs-on: ubuntu-latest
+    needs: release
+    if: ${{ !inputs.dry_run }}
+
+    steps:
+      # TODO: skip this if it's not a new release (i.e. a backport). This is
+      #       fine right now because it just makes a PR that we can close.
+      - name: Update homebrew
+        env:
+          # Variables used by the `gh` command
+          GH_REPO: coder/homebrew-coder
+          GH_TOKEN: ${{ secrets.CDRCI_GITHUB_TOKEN }}
+        run: |
+          # Keep version number around for reference, removing any potential leading v
+          coder_version="$(echo "${{ needs.release.outputs.version }}" | tr -d v)"
+
+          set -euxo pipefail
+
+          # Setup Git
+          git config --global user.email "ci@coder.com"
+          git config --global user.name "Coder CI"
+          git config --global credential.helper "store"
+
+          temp_dir="$(mktemp -d)"
+          cd "$temp_dir"
+
+          # Download checksums
+          checksums_url="$(gh release view --repo coder/coder "v$coder_version" --json assets \
+            | jq -r ".assets | map(.url) | .[]" \
+            | grep -e ".checksums.txt\$")"
+          wget "$checksums_url" -O checksums.txt
+
+          # Get the SHAs
+          darwin_arm_sha="$(cat checksums.txt | grep "darwin_arm64.zip" | awk '{ print $1 }')"
+          darwin_intel_sha="$(cat checksums.txt | grep "darwin_amd64.zip" | awk '{ print $1 }')"
+          linux_sha="$(cat checksums.txt | grep "linux_amd64.tar.gz" | awk '{ print $1 }')"
+
+          echo "macOS arm64: $darwin_arm_sha"
+          echo "macOS amd64: $darwin_intel_sha"
+          echo "Linux amd64: $linux_sha"
+
+          # Check out the homebrew repo
+          git clone "https://github.com/$GH_REPO" homebrew-coder
+          brew_branch="auto-release/$coder_version"
+          cd homebrew-coder
+
+          # Check if a PR already exists.
+          pr_count="$(gh pr list --search "head:$brew_branch" --json id,closed | jq -r ".[] | select(.closed == false) | .id" | wc -l)"
+          if [[ "$pr_count" > 0 ]]; then
+            echo "Bailing out as PR already exists" 2>&1
+            exit 0
+          fi
+
+          # Set up cdrci credentials for pushing to homebrew-coder
+          echo "https://x-access-token:$GH_TOKEN@github.com" >> ~/.git-credentials
+          # Update the formulae and push
+          git checkout -b "$brew_branch"
+          ./scripts/update-v2.sh "$coder_version" "$darwin_arm_sha" "$darwin_intel_sha" "$linux_sha"
+          git add .
+          git commit -m "coder $coder_version"
+          git push -u origin -f "$brew_branch"
+
+          # Create PR
+          gh pr create \
+            -B master -H "$brew_branch" \
+            -t "coder $coder_version" \
+            -b "" \
+            -r "${{ github.actor }}" \
+            -a "${{ github.actor }}" \
+            -b "This automatic PR was triggered by the release of Coder v$coder_version"
+
   publish-winget:
     name: Publish to winget-pkgs
     runs-on: windows-latest
     needs: release
+    if: ${{ !inputs.dry_run }}
+
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -376,12 +442,6 @@ jobs:
           echo "Installer URL: ${installer_url}"
           echo "Package version: ${version}"
 
-          # Bail if dry-run.
-          if ($env:CODER_DRY_RUN -match "t") {
-            echo "Skipping submission due to dry-run."
-            exit 0
-          }
-
           # The URL "|X64" suffix forces the architecture as it cannot be
           # sniffed properly from the URL. wingetcreate checks both the URL and
           # binary magic bytes for the architecture and they need to both match,
@@ -405,7 +465,6 @@ jobs:
           WINGET_GH_TOKEN: ${{ secrets.CDRCI_GITHUB_TOKEN }}
 
       - name: Comment on PR
-        if: ${{ !inputs.dry_run }}
         run: |
           # wait 30 seconds
           Start-Sleep -Seconds 30.0
@@ -421,3 +480,66 @@ jobs:
           # For gh CLI. We need a real token since we're commenting on a PR in a
           # different repo.
           GH_TOKEN: ${{ secrets.CDRCI_GITHUB_TOKEN }}
+
+  publish-chocolatey:
+    name: Publish to Chocolatey
+    runs-on: windows-latest
+    needs: release
+    if: ${{ !inputs.dry_run }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # Same reason as for release.
+      - name: Fetch git tags
+        run: git fetch --tags --force
+
+      # From https://chocolatey.org
+      - name: Install Chocolatey
+        run: |
+          Set-ExecutionPolicy Bypass -Scope Process -Force
+          [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
+
+          iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
+
+      - name: Build chocolatey package
+        run: |
+          cd scripts/chocolatey
+
+          # The package version is the same as the tag minus the leading "v".
+          # The version in this output already has the leading "v" removed but
+          # we do it again to be safe.
+          $version = "${{ needs.release.outputs.version }}".Trim('v')
+
+          $release_assets = gh release view --repo coder/coder "v${version}" --json assets | `
+            ConvertFrom-Json
+
+          # Get the URL for the Windows ZIP from the release assets.
+          $zip_url = $release_assets.assets | `
+            Where-Object name -Match ".*_windows_amd64.zip$" | `
+            Select -ExpandProperty url
+
+          echo "ZIP URL: ${zip_url}"
+          echo "Package version: ${version}"
+
+          echo "Downloading ZIP..."
+          Invoke-WebRequest $zip_url -OutFile assets.zip
+
+          echo "Extracting ZIP..."
+          Expand-Archive assets.zip -DestinationPath assets/
+
+          # No need to specify nuspec if there's only one in the directory.
+          choco pack --version=$version binary_path=assets/coder.exe
+
+          choco apikey --api-key $env:CHOCO_API_KEY --source https://push.chocolatey.org/
+
+          # No need to specify nupkg if there's only one in the directory.
+          choco push --source https://push.chocolatey.org/
+
+        env:
+          CHOCO_API_KEY: ${{ secrets.CHOCO_API_KEY }}
+          # We need a GitHub token for the gh CLI to function under GitHub Actions
+          GH_TOKEN: ${{ secrets.CDRCI_GITHUB_TOKEN }}
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index daed19ee5dff5..0f26a126da995 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -21,15 +21,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-security
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-env:
-  CODER_GO_VERSION: "1.20.6"
-
 jobs:
   codeql:
     runs-on: ${{ github.repository_owner == 'coder' && 'buildjet-8vcpu-ubuntu-2204' || 'ubuntu-latest' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2
@@ -62,23 +59,15 @@ jobs:
     runs-on: ${{ github.repository_owner == 'coder' && 'buildjet-8vcpu-ubuntu-2204' || 'ubuntu-latest' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Setup Go
         uses: ./.github/actions/setup-go
 
-      - name: Cache Node
-        id: cache-node
-        uses: buildjet/cache@v3
-        with:
-          path: |
-            **/node_modules
-            .eslintcache
-          key: js-${{ runner.os }}-test-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            js-${{ runner.os }}-
+      - name: Setup Node
+        uses: ./.github/actions/setup-node
 
       - name: Setup sqlc
         uses: ./.github/actions/setup-sqlc
@@ -133,7 +122,7 @@ jobs:
           image_name: ${{ steps.build.outputs.image }}
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@41f05d9ecffa2ed3f1580af306000f734b733e54
+        uses: aquasecurity/trivy-action@b77b85c0254bba6789e787844f0585cde1e56320
         with:
           image-ref: ${{ steps.build.outputs.image }}
           format: sarif
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index 3490763f0be10..ed6d1d0127bc0 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Run delete-old-branches-action
         uses: beatlabs/delete-old-branches-action@v0.0.10
         with:
@@ -52,8 +52,8 @@ jobs:
         with:
           token: ${{ github.token }}
           repository: ${{ github.repository }}
-          retain_days: 1
-          keep_minimum_runs: 1
+          retain_days: 30
+          keep_minimum_runs: 30
           delete_workflow_pattern: pr-cleanup.yaml
 
       - name: Delete PR Deploy workflow skipped runs
@@ -61,7 +61,6 @@ jobs:
         with:
           token: ${{ github.token }}
           repository: ${{ github.repository }}
-          retain_days: 0
-          keep_minimum_runs: 0
-          delete_run_by_conclusion_pattern: skipped
+          retain_days: 30
+          keep_minimum_runs: 30
           delete_workflow_pattern: pr-deploy.yaml
diff --git a/.gitignore b/.gitignore
index b22db03c2089e..2ccd459b811b9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,15 +30,14 @@ site/e2e/states/*.json
 site/e2e/.auth.json
 site/playwright-report/*
 site/.swc
-site/dist/
 
 # Make target for updating golden files (any dir).
 .gen-golden
 
 # Build
-/build/
-/dist/
-site/out/
+build/
+dist/
+out/
 
 # Bundle analysis
 site/stats/
@@ -61,3 +60,12 @@ site/stats/
 ./scaletest/terraform/.terraform.lock.hcl
 scaletest/terraform/secrets.tfvars
 .terraform.tfstate.*
+
+# Nix
+result
+
+# Data dumps from unit tests
+**/*.test.sql
+
+# Filebrowser.db
+**/filebrowser.db
diff --git a/.golangci.yaml b/.golangci.yaml
index e3f3797d06b81..f2ecce63da607 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -2,12 +2,19 @@
 # Over time we should try tightening some of these.
 
 linters-settings:
+  dupl:
+    # goal: 100
+    threshold: 412
+
   exhaustruct:
     include:
       # Gradually extend to cover more of the codebase.
       - 'httpmw\.\w+'
+      # We want to enforce all values are specified when inserting or updating
+      # a database row. Ref: #9936
+      - 'github.com/coder/coder/v2/coderd/database\.[^G][^e][^t]\w+Params'
   gocognit:
-    min-complexity: 46 # Min code complexity (def 30).
+    min-complexity: 300
 
   goconst:
     min-len: 4 # Min length of string consts (def 3).
@@ -118,10 +125,6 @@ linters-settings:
   goimports:
     local-prefixes: coder.com,cdr.dev,go.coder.com,github.com/cdr,github.com/coder
 
-  gocyclo:
-    # goal: 30
-    min-complexity: 47
-
   importas:
     no-unaliased: true
 
@@ -131,7 +134,8 @@ linters-settings:
       - trialer
 
   nestif:
-    min-complexity: 4 # Min complexity of if statements (def 5, goal 4)
+    # goal: 10
+    min-complexity: 20
 
   revive:
     # see https://github.com/mgechev/revive#available-rules for details.
@@ -211,6 +215,7 @@ issues:
 run:
   skip-dirs:
     - node_modules
+    - .git
   skip-files:
     - scripts/rules.go
   timeout: 10m
@@ -231,7 +236,12 @@ linters:
     - exportloopref
     - forcetypeassert
     - gocritic
-    - gocyclo
+    # gocyclo is may be useful in the future when we start caring
+    # about testing complexity, but for the time being we should
+    # create a good culture around cognitive complexity.
+    # - gocyclo
+    - gocognit
+    - nestif
     - goimports
     - gomodguard
     - gosec
@@ -267,3 +277,4 @@ linters:
     - typecheck
     - unconvert
     - unused
+    - dupl
diff --git a/.prettierignore b/.prettierignore
index 9296d15d8802e..c7882767e85af 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -33,15 +33,14 @@ site/e2e/states/*.json
 site/e2e/.auth.json
 site/playwright-report/*
 site/.swc
-site/dist/
 
 # Make target for updating golden files (any dir).
 .gen-golden
 
 # Build
-/build/
-/dist/
-site/out/
+build/
+dist/
+out/
 
 # Bundle analysis
 site/stats/
@@ -64,10 +63,19 @@ site/stats/
 ./scaletest/terraform/.terraform.lock.hcl
 scaletest/terraform/secrets.tfvars
 .terraform.tfstate.*
+
+# Nix
+result
+
+# Data dumps from unit tests
+**/*.test.sql
+
+# Filebrowser.db
+**/filebrowser.db
 # .prettierignore.include:
 # Helm templates contain variables that are invalid YAML and can't be formatted
 # by Prettier.
-helm/templates/*.yaml
+helm/**/templates/*.yaml
 
 # Terraform state files used in tests, these are automatically generated.
 # Example: provisioner/terraform/testdata/instance-id/instance-id.tfstate.json
@@ -80,3 +88,6 @@ scripts/apitypings/testdata/**/*.ts
 site/e2e/provisionerGenerated.ts
 
 **/pnpm-lock.yaml
+
+# Ignore generated JSON (e.g. examples/examples.gen.json).
+**/*.gen.json
diff --git a/.prettierignore.include b/.prettierignore.include
index 1f60eda9c54a7..3a42bc75ecf9f 100644
--- a/.prettierignore.include
+++ b/.prettierignore.include
@@ -1,6 +1,6 @@
 # Helm templates contain variables that are invalid YAML and can't be formatted
 # by Prettier.
-helm/templates/*.yaml
+helm/**/templates/*.yaml
 
 # Terraform state files used in tests, these are automatically generated.
 # Example: provisioner/terraform/testdata/instance-id/instance-id.tfstate.json
@@ -13,3 +13,6 @@ scripts/apitypings/testdata/**/*.ts
 site/e2e/provisionerGenerated.ts
 
 **/pnpm-lock.yaml
+
+# Ignore generated JSON (e.g. examples/examples.gen.json).
+**/*.gen.json
diff --git a/.prettierrc.yaml b/.prettierrc.yaml
index 9ba1d2ca9db7a..189b2580f6244 100644
--- a/.prettierrc.yaml
+++ b/.prettierrc.yaml
@@ -1,18 +1,18 @@
 # This config file is used in conjunction with `.editorconfig` to specify
 # formatting for prettier-supported files. See `.editorconfig` and
-# `site/.editorconfig`for whitespace formatting options.
+# `site/.editorconfig` for whitespace formatting options.
 printWidth: 80
-semi: false
+proseWrap: always
 trailingComma: all
 useTabs: false
 tabWidth: 2
 overrides:
   - files:
       - README.md
+      - docs/api/**/*.md
+      - docs/cli/**/*.md
+      - docs/changelogs/*.md
+      - .github/**/*.{yaml,yml,toml}
+      - scripts/**/*.{yaml,yml,toml}
     options:
       proseWrap: preserve
-  - files:
-      - "site/**/*.yaml"
-      - "site/**/*.yml"
-    options:
-      proseWrap: always
diff --git a/.swaggo b/.swaggo
index e4b76f3ed82d9..bf8a6bad030c2 100644
--- a/.swaggo
+++ b/.swaggo
@@ -1,8 +1,8 @@
 // Replace all NullTime with string
-replace github.com/coder/coder/codersdk.NullTime string
+replace github.com/coder/coder/v2/codersdk.NullTime string
 // Prevent swaggo from rendering enums for time.Duration
 replace time.Duration int64
 // Do not expose "echo" provider
-replace github.com/coder/coder/codersdk.ProvisionerType string
+replace github.com/coder/coder/v2/codersdk.ProvisionerType string
 // Do not render netip.Addr
 replace netip.Addr string
diff --git a/.vscode/settings.json b/.vscode/settings.json
index 1ff3ea0883482..6f726162d260a 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -20,7 +20,7 @@
     "codersdk",
     "cronstrue",
     "databasefake",
-    "dbfake",
+    "dbmem",
     "dbgen",
     "dbtype",
     "DERP",
@@ -39,6 +39,7 @@
     "enterprisemeta",
     "errgroup",
     "eventsourcemock",
+    "externalauth",
     "Failf",
     "fatih",
     "Formik",
@@ -186,12 +187,20 @@
     ]
   },
   "eslint.workingDirectories": ["./site"],
-  "files.exclude": {
-    "**/node_modules": true
-  },
   "search.exclude": {
+    "**.pb.go": true,
+    "**/*.gen.json": true,
+    "**/testdata/*": true,
+    "**Generated.ts": true,
+    "coderd/apidoc/**": true,
+    "docs/api/*.md": true,
+    "docs/templates/*.md": true,
+    "LICENSE": true,
     "scripts/metricsdocgen/metrics": true,
-    "docs/api/*.md": true
+    "site/out/**": true,
+    "site/storybook-static/**": true,
+    "**.map": true,
+    "pnpm-lock.yaml": true
   },
   // Ensure files always have a newline.
   "files.insertFinalNewline": true,
diff --git a/Makefile b/Makefile
index c9089a9d4e452..72e44308c6f03 100644
--- a/Makefile
+++ b/Makefile
@@ -107,9 +107,9 @@ endif
 
 
 clean:
-	rm -rf build site/out
-	mkdir -p build site/out/bin
-	git restore site/out
+	rm -rf build/ site/build/ site/out/
+	mkdir -p build/ site/out/bin/
+	git restore site/out/
 .PHONY: clean
 
 build-slim: $(CODER_SLIM_BINARIES)
@@ -344,15 +344,19 @@ push/$(CODER_MAIN_IMAGE): $(CODER_MAIN_IMAGE)
 	docker manifest push "$$image_tag"
 .PHONY: push/$(CODER_MAIN_IMAGE)
 
+# Helm charts that are available
+charts = coder provisioner
+
 # Shortcut for Helm chart package.
-build/coder_helm.tgz: build/coder_helm_$(VERSION).tgz
+$(foreach chart,$(charts),build/$(chart)_helm.tgz): build/%_helm.tgz: build/%_helm_$(VERSION).tgz
 	rm -f "$@"
 	ln "$<" "$@"
 
 # Helm chart package.
-build/coder_helm_$(VERSION).tgz:
+$(foreach chart,$(charts),build/$(chart)_helm_$(VERSION).tgz): build/%_helm_$(VERSION).tgz:
 	./scripts/helm.sh \
 		--version "$(VERSION)" \
+		--chart $* \
 		--output "$@"
 
 site/out/index.html: site/package.json $(shell find ./site $(FIND_EXCLUSIONS) -type f \( -name '*.ts' -o -name '*.tsx' \))
@@ -415,7 +419,6 @@ lint: lint/shellcheck lint/go lint/ts lint/helm lint/site-icons
 
 lint/site-icons:
 	./scripts/check_site_icons.sh
-
 .PHONY: lint/site-icons
 
 lint/ts:
@@ -445,17 +448,19 @@ lint/helm:
 DB_GEN_FILES := \
 	coderd/database/querier.go \
 	coderd/database/unique_constraint.go \
-	coderd/database/dbfake/dbfake.go \
+	coderd/database/dbmem/dbmem.go \
 	coderd/database/dbmetrics/dbmetrics.go \
 	coderd/database/dbauthz/dbauthz.go \
 	coderd/database/dbmock/dbmock.go
 
 # all gen targets should be added here and to gen/mark-fresh
 gen: \
-	coderd/database/dump.sql \
-	$(DB_GEN_FILES) \
+	tailnet/proto/tailnet.pb.go \
+	agent/proto/agent.pb.go \
 	provisionersdk/proto/provisioner.pb.go \
 	provisionerd/proto/provisionerd.pb.go \
+	coderd/database/dump.sql \
+	$(DB_GEN_FILES) \
 	site/src/api/typesGenerated.ts \
 	coderd/rbac/object_gen.go \
 	docs/admin/prometheus.md \
@@ -466,17 +471,22 @@ gen: \
 	.prettierignore \
 	site/.prettierrc.yaml \
 	site/.prettierignore \
-	site/.eslintignore
+	site/.eslintignore \
+	site/e2e/provisionerGenerated.ts \
+	site/src/theme/icons.json \
+	examples/examples.gen.json
 .PHONY: gen
 
 # Mark all generated files as fresh so make thinks they're up-to-date. This is
 # used during releases so we don't run generation scripts.
 gen/mark-fresh:
 	files="\
-		coderd/database/dump.sql \
-		$(DB_GEN_FILES) \
+		tailnet/proto/tailnet.pb.go \
+		agent/proto/agent.pb.go \
 		provisionersdk/proto/provisioner.pb.go \
 		provisionerd/proto/provisionerd.pb.go \
+		coderd/database/dump.sql \
+		$(DB_GEN_FILES) \
 		site/src/api/typesGenerated.ts \
 		coderd/rbac/object_gen.go \
 		docs/admin/prometheus.md \
@@ -488,6 +498,9 @@ gen/mark-fresh:
 		site/.prettierrc.yaml \
 		site/.prettierignore \
 		site/.eslintignore \
+		site/e2e/provisionerGenerated.ts \
+		site/src/theme/icons.json \
+		examples/examples.gen.json \
 	"
 	for file in $$files; do
 		echo "$$file"
@@ -507,12 +520,30 @@ coderd/database/dump.sql: coderd/database/gen/dump/main.go $(wildcard coderd/dat
 	go run ./coderd/database/gen/dump/main.go
 
 # Generates Go code for querying the database.
+# coderd/database/queries.sql.go
+# coderd/database/models.go
 coderd/database/querier.go: coderd/database/sqlc.yaml coderd/database/dump.sql $(wildcard coderd/database/queries/*.sql)
 	./coderd/database/generate.sh
 
 coderd/database/dbmock/dbmock.go: coderd/database/db.go coderd/database/querier.go
 	go generate ./coderd/database/dbmock/
 
+tailnet/proto/tailnet.pb.go: tailnet/proto/tailnet.proto
+	protoc \
+		--go_out=. \
+		--go_opt=paths=source_relative \
+		--go-drpc_out=. \
+		--go-drpc_opt=paths=source_relative \
+		./tailnet/proto/tailnet.proto
+
+agent/proto/agent.pb.go: agent/proto/agent.proto
+	protoc \
+		--go_out=. \
+		--go_opt=paths=source_relative \
+		--go-drpc_out=. \
+		--go-drpc_opt=paths=source_relative \
+		./agent/proto/agent.proto
+
 provisionersdk/proto/provisioner.pb.go: provisionersdk/proto/provisioner.proto
 	protoc \
 		--go_out=. \
@@ -529,10 +560,21 @@ provisionerd/proto/provisionerd.pb.go: provisionerd/proto/provisionerd.proto
 		--go-drpc_opt=paths=source_relative \
 		./provisionerd/proto/provisionerd.proto
 
-site/src/api/typesGenerated.ts: scripts/apitypings/main.go $(shell find ./codersdk $(FIND_EXCLUSIONS) -type f -name '*.go')
-	go run scripts/apitypings/main.go > site/src/api/typesGenerated.ts
+site/src/api/typesGenerated.ts: $(wildcard scripts/apitypings/*) $(shell find ./codersdk $(FIND_EXCLUSIONS) -type f -name '*.go')
+	go run ./scripts/apitypings/ > $@
+	pnpm run format:write:only "$@"
+
+site/e2e/provisionerGenerated.ts: provisionerd/proto/provisionerd.pb.go provisionersdk/proto/provisioner.pb.go
 	cd site
-	pnpm run format:types
+	../scripts/pnpm_install.sh
+	pnpm run gen:provisioner
+
+site/src/theme/icons.json: $(wildcard scripts/gensite/*) $(wildcard site/static/icon/*)
+	go run ./scripts/gensite/ -icons "$@"
+	pnpm run format:write:only "$@"
+
+examples/examples.gen.json: scripts/examplegen/main.go examples/examples.go $(shell find ./examples/templates)
+	go run ./scripts/examplegen/main.go > examples/examples.gen.json
 
 coderd/rbac/object_gen.go: scripts/rbacgen/main.go coderd/rbac/object.go
 	go run scripts/rbacgen/main.go ./coderd/rbac > coderd/rbac/object_gen.go
@@ -541,8 +583,8 @@ docs/admin/prometheus.md: scripts/metricsdocgen/main.go scripts/metricsdocgen/me
 	go run scripts/metricsdocgen/main.go
 	pnpm run format:write:only ./docs/admin/prometheus.md
 
-docs/cli.md: scripts/clidocgen/main.go $(GO_SRC_FILES)
-	BASE_PATH="." go run ./scripts/clidocgen
+docs/cli.md: scripts/clidocgen/main.go examples/examples.gen.json $(GO_SRC_FILES)
+	CI=true BASE_PATH="." go run ./scripts/clidocgen
 	pnpm run format:write:only ./docs/cli.md ./docs/cli/*.md ./docs/manifest.json
 
 docs/admin/audit-logs.md: scripts/auditdocgen/main.go enterprise/audit/table.go coderd/rbac/object_gen.go
@@ -553,7 +595,7 @@ coderd/apidoc/swagger.json: $(shell find ./scripts/apidocgen $(FIND_EXCLUSIONS)
 	./scripts/apidocgen/generate.sh
 	pnpm run format:write:only ./docs/api ./docs/manifest.json ./coderd/apidoc/swagger.json
 
-update-golden-files: cli/testdata/.gen-golden helm/tests/testdata/.gen-golden scripts/ci-report/testdata/.gen-golden enterprise/cli/testdata/.gen-golden
+update-golden-files: cli/testdata/.gen-golden helm/coder/tests/testdata/.gen-golden helm/provisioner/tests/testdata/.gen-golden scripts/ci-report/testdata/.gen-golden enterprise/cli/testdata/.gen-golden coderd/.gen-golden provisioner/terraform/testdata/.gen-golden
 .PHONY: update-golden-files
 
 cli/testdata/.gen-golden: $(wildcard cli/testdata/*.golden) $(wildcard cli/*.tpl) $(GO_SRC_FILES) $(wildcard cli/*_test.go)
@@ -564,8 +606,20 @@ enterprise/cli/testdata/.gen-golden: $(wildcard enterprise/cli/testdata/*.golden
 	go test ./enterprise/cli -run="TestEnterpriseCommandHelp" -update
 	touch "$@"
 
-helm/tests/testdata/.gen-golden: $(wildcard helm/tests/testdata/*.yaml) $(wildcard helm/tests/testdata/*.golden) $(GO_SRC_FILES) $(wildcard helm/tests/*_test.go)
-	go test ./helm/tests -run=TestUpdateGoldenFiles -update
+helm/coder/tests/testdata/.gen-golden: $(wildcard helm/coder/tests/testdata/*.yaml) $(wildcard helm/coder/tests/testdata/*.golden) $(GO_SRC_FILES) $(wildcard helm/coder/tests/*_test.go)
+	go test ./helm/coder/tests -run=TestUpdateGoldenFiles -update
+	touch "$@"
+
+helm/provisioner/tests/testdata/.gen-golden: $(wildcard helm/provisioner/tests/testdata/*.yaml) $(wildcard helm/provisioner/tests/testdata/*.golden) $(GO_SRC_FILES) $(wildcard helm/provisioner/tests/*_test.go)
+	go test ./helm/provisioner/tests -run=TestUpdateGoldenFiles -update
+	touch "$@"
+
+coderd/.gen-golden: $(wildcard coderd/testdata/*/*.golden) $(GO_SRC_FILES) $(wildcard coderd/*_test.go)
+	go test ./coderd -run="Test.*Golden$$" -update
+	touch "$@"
+
+provisioner/terraform/testdata/.gen-golden: $(wildcard provisioner/terraform/testdata/*/*.golden) $(GO_SRC_FILES) $(wildcard provisioner/terraform/*_test.go)
+	go test ./provisioner/terraform -run="Test.*Golden$$" -update
 	touch "$@"
 
 scripts/ci-report/testdata/.gen-golden: $(wildcard scripts/ci-report/testdata/*) $(wildcard scripts/ci-report/*.go)
@@ -586,7 +640,7 @@ site/.prettierrc.yaml: .prettierrc.yaml
 	# - ./ -> ../
 	# - ./site -> ./
 	yq \
-		'.overrides[].files |= map(. | sub("^./"; "") | sub("^"; "../") | sub("../site/"; "./"))' \
+		'.overrides[].files |= map(. | sub("^./"; "") | sub("^"; "../") | sub("../site/"; "./") | sub("../!"; "!../"))' \
 		"$<" >> "$@"
 
 # Combine .gitignore with .prettierignore.include to generate .prettierignore.
diff --git a/README.md b/README.md
index 9443eb6b701fd..27634813adf34 100644
--- a/README.md
+++ b/README.md
@@ -70,11 +70,11 @@ curl -L https://coder.com/install.sh | sh
 
 You can run the install script with `--dry-run` to see the commands that will be used to install without executing them. You can modify the installation process by including flags. Run the install script with `--help` for reference.
 
-> See [install](docs/install) for additional methods.
+> See [install](https://coder.com/docs/v2/latest/install) for additional methods.
 
 Once installed, you can start a production deployment<sup>1</sup> with a single command:
 
-```console
+```shell
 # Automatically sets up an external access URL on *.try.coder.app
 coder server
 
diff --git a/SECURITY.md b/SECURITY.md
index 46986c9d3aadf..ee5ac8075eaf9 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,7 +1,7 @@
 # Coder Security
 
-Coder welcomes feedback from security researchers and the general public
-to help improve our security. If you believe you have discovered a vulnerability,
+Coder welcomes feedback from security researchers and the general public to help
+improve our security. If you believe you have discovered a vulnerability,
 privacy issue, exposed data, or other security issues in any of our assets, we
 want to hear from you. This policy outlines steps for reporting vulnerabilities
 to us, what we expect, what you can expect from us.
@@ -10,64 +10,72 @@ You can see the pretty version [here](https://coder.com/security/policy)
 
 # Why Coder's security matters
 
-If an attacker could fully compromise a Coder installation, they could spin
-up expensive workstations, steal valuable credentials, or steal proprietary
-source code. We take this risk very seriously and employ routine pen testing,
-vulnerability scanning, and code reviews. We also welcome the contributions
-from the community that helped make this product possible.
+If an attacker could fully compromise a Coder installation, they could spin up
+expensive workstations, steal valuable credentials, or steal proprietary source
+code. We take this risk very seriously and employ routine pen testing,
+vulnerability scanning, and code reviews. We also welcome the contributions from
+the community that helped make this product possible.
 
 # Where should I report security issues?
 
-Please report security issues to security@coder.com, providing
-all relevant information. The more details you provide, the easier it will be
-for us to triage and fix the issue.
+Please report security issues to security@coder.com, providing all relevant
+information. The more details you provide, the easier it will be for us to
+triage and fix the issue.
 
 # Out of Scope
 
-Our primary concern is around an abuse of the Coder application that allows
-an attacker to gain access to another users workspace, or spin up unwanted
+Our primary concern is around an abuse of the Coder application that allows an
+attacker to gain access to another users workspace, or spin up unwanted
 workspaces.
 
 - DOS/DDOS attacks affecting availability --> While we do support rate limiting
-  of requests, we primarily leave this to the owner of the Coder installation. Our
-  rationale is that a DOS attack only affecting availability is not a valuable
-  target for attackers.
+  of requests, we primarily leave this to the owner of the Coder installation.
+  Our rationale is that a DOS attack only affecting availability is not a
+  valuable target for attackers.
 - Abuse of a compromised user credential --> If a user credential is compromised
-  outside of the Coder ecosystem, then we consider it beyond the scope of our application.
-  However, if an unprivileged user could escalate their permissions or gain access
-  to another workspace, that is a cause for concern.
+  outside of the Coder ecosystem, then we consider it beyond the scope of our
+  application. However, if an unprivileged user could escalate their permissions
+  or gain access to another workspace, that is a cause for concern.
 - Vulnerabilities in third party systems --> Vulnerabilities discovered in
-  out-of-scope systems should be reported to the appropriate vendor or applicable authority.
+  out-of-scope systems should be reported to the appropriate vendor or
+  applicable authority.
 
 # Our Commitments
 
 When working with us, according to this policy, you can expect us to:
 
-- Respond to your report promptly, and work with you to understand and validate your report;
-- Strive to keep you informed about the progress of a vulnerability as it is processed;
-- Work to remediate discovered vulnerabilities in a timely manner, within our operational constraints; and
-- Extend Safe Harbor for your vulnerability research that is related to this policy.
+- Respond to your report promptly, and work with you to understand and validate
+  your report;
+- Strive to keep you informed about the progress of a vulnerability as it is
+  processed;
+- Work to remediate discovered vulnerabilities in a timely manner, within our
+  operational constraints; and
+- Extend Safe Harbor for your vulnerability research that is related to this
+  policy.
 
 # Our Expectations
 
-In participating in our vulnerability disclosure program in good faith, we ask that you:
+In participating in our vulnerability disclosure program in good faith, we ask
+that you:
 
-- Play by the rules, including following this policy and any other relevant agreements.
-  If there is any inconsistency between this policy and any other applicable terms, the
-  terms of this policy will prevail;
+- Play by the rules, including following this policy and any other relevant
+  agreements. If there is any inconsistency between this policy and any other
+  applicable terms, the terms of this policy will prevail;
 - Report any vulnerability you’ve discovered promptly;
-- Avoid violating the privacy of others, disrupting our systems, destroying data, and/or
-  harming user experience;
+- Avoid violating the privacy of others, disrupting our systems, destroying
+  data, and/or harming user experience;
 - Use only the Official Channels to discuss vulnerability information with us;
-- Provide us a reasonable amount of time (at least 90 days from the initial report) to
-  resolve the issue before you disclose it publicly;
-- Perform testing only on in-scope systems, and respect systems and activities which
-  are out-of-scope;
-- If a vulnerability provides unintended access to data: Limit the amount of data you
-  access to the minimum required for effectively demonstrating a Proof of Concept; and
-  cease testing and submit a report immediately if you encounter any user data during testing,
-  such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI),
-  credit card data, or proprietary information;
-- You should only interact with test accounts you own or with explicit permission from
+- Provide us a reasonable amount of time (at least 90 days from the initial
+  report) to resolve the issue before you disclose it publicly;
+- Perform testing only on in-scope systems, and respect systems and activities
+  which are out-of-scope;
+- If a vulnerability provides unintended access to data: Limit the amount of
+  data you access to the minimum required for effectively demonstrating a Proof
+  of Concept; and cease testing and submit a report immediately if you encounter
+  any user data during testing, such as Personally Identifiable Information
+  (PII), Personal Healthcare Information (PHI), credit card data, or proprietary
+  information;
+- You should only interact with test accounts you own or with explicit
+  permission from
 - the account holder; and
 - Do not engage in extortion.
diff --git a/agent/agent.go b/agent/agent.go
index 52c423787fb44..0d2326d2ab9d3 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -12,16 +12,17 @@ import (
 	"net/http"
 	"net/netip"
 	"os"
-	"os/exec"
 	"os/user"
 	"path/filepath"
+	"runtime"
+	"runtime/debug"
 	"sort"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
 
-	"github.com/armon/circbuf"
+	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/spf13/afero"
@@ -34,14 +35,16 @@ import (
 	"tailscale.com/types/netlogtype"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/agent/agentssh"
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/pty"
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/agent/agentproc"
+	"github.com/coder/coder/v2/agent/agentscripts"
+	"github.com/coder/coder/v2/agent/agentssh"
+	"github.com/coder/coder/v2/agent/reconnectingpty"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/cli/gitauth"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/tailnet"
 	"github.com/coder/retry"
 )
 
@@ -51,6 +54,10 @@ const (
 	ProtocolDial            = "dial"
 )
 
+// EnvProcPrioMgmt determines whether we attempt to manage
+// process CPU and OOM Killer priority.
+const EnvProcPrioMgmt = "CODER_PROC_PRIO_MGMT"
+
 type Options struct {
 	Filesystem                   afero.Fs
 	LogDir                       string
@@ -63,11 +70,16 @@ type Options struct {
 	IgnorePorts                  map[int]string
 	SSHMaxTimeout                time.Duration
 	TailnetListenPort            uint16
-	Subsystem                    codersdk.AgentSubsystem
+	Subsystems                   []codersdk.AgentSubsystem
 	Addresses                    []netip.Prefix
 	PrometheusRegistry           *prometheus.Registry
 	ReportMetadataInterval       time.Duration
 	ServiceBannerRefreshInterval time.Duration
+	Syscaller                    agentproc.Syscaller
+	// ModifiedProcesses is used for testing process priority management.
+	ModifiedProcesses chan []*agentproc.Process
+	// ProcessManagementTick is used for testing process priority management.
+	ProcessManagementTick <-chan time.Time
 }
 
 type Client interface {
@@ -78,7 +90,7 @@ type Client interface {
 	PostLifecycle(ctx context.Context, state agentsdk.PostLifecycleRequest) error
 	PostAppHealth(ctx context.Context, req agentsdk.PostAppHealthsRequest) error
 	PostStartup(ctx context.Context, req agentsdk.PostStartupRequest) error
-	PostMetadata(ctx context.Context, key string, req agentsdk.PostMetadataRequest) error
+	PostMetadata(ctx context.Context, req agentsdk.PostMetadataRequest) error
 	PatchLogs(ctx context.Context, req agentsdk.PatchLogs) error
 	GetServiceBanner(ctx context.Context) (codersdk.ServiceBannerConfig, error)
 }
@@ -91,9 +103,6 @@ type Agent interface {
 }
 
 func New(options Options) Agent {
-	if options.ReconnectingPTYTimeout == 0 {
-		options.ReconnectingPTYTimeout = 5 * time.Minute
-	}
 	if options.Filesystem == nil {
 		options.Filesystem = afero.NewOsFs()
 	}
@@ -123,6 +132,10 @@ func New(options Options) Agent {
 		prometheusRegistry = prometheus.NewRegistry()
 	}
 
+	if options.Syscaller == nil {
+		options.Syscaller = agentproc.NewSyscaller()
+	}
+
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	a := &agent{
 		tailnetListenPort:            options.TailnetListenPort,
@@ -144,8 +157,11 @@ func New(options Options) Agent {
 		reportMetadataInterval:       options.ReportMetadataInterval,
 		serviceBannerRefreshInterval: options.ServiceBannerRefreshInterval,
 		sshMaxTimeout:                options.SSHMaxTimeout,
-		subsystem:                    options.Subsystem,
+		subsystems:                   options.Subsystems,
 		addresses:                    options.Addresses,
+		syscaller:                    options.Syscaller,
+		modifiedProcs:                options.ModifiedProcesses,
+		processManagementTick:        options.ProcessManagementTick,
 
 		prometheusRegistry: prometheusRegistry,
 		metrics:            newAgentMetrics(prometheusRegistry),
@@ -166,7 +182,7 @@ type agent struct {
 	// listing all listening ports. This is helpful to hide ports that
 	// are used by the agent, that the user does not care about.
 	ignorePorts map[int]string
-	subsystem   codersdk.AgentSubsystem
+	subsystems  []codersdk.AgentSubsystem
 
 	reconnectingPTYs       sync.Map
 	reconnectingPTYTimeout time.Duration
@@ -180,6 +196,7 @@ type agent struct {
 
 	manifest                     atomic.Pointer[agentsdk.Manifest] // manifest is atomic because values can change after reconnection.
 	reportMetadataInterval       time.Duration
+	scriptRunner                 *agentscripts.Runner
 	serviceBanner                atomic.Pointer[codersdk.ServiceBannerConfig] // serviceBanner is atomic because it is periodically updated.
 	serviceBannerRefreshInterval time.Duration
 	sessionToken                 atomic.Pointer[string]
@@ -200,6 +217,12 @@ type agent struct {
 
 	prometheusRegistry *prometheus.Registry
 	metrics            *agentMetrics
+	syscaller          agentproc.Syscaller
+
+	// modifiedProcs is used for testing process priority management.
+	modifiedProcs chan []*agentproc.Process
+	// processManagementTick is used for testing process priority management.
+	processManagementTick <-chan time.Time
 }
 
 func (a *agent) TailnetConn() *tailnet.Conn {
@@ -216,7 +239,13 @@ func (a *agent) init(ctx context.Context) {
 	sshSrv.Manifest = &a.manifest
 	sshSrv.ServiceBanner = &a.serviceBanner
 	a.sshServer = sshSrv
-
+	a.scriptRunner = agentscripts.New(agentscripts.Options{
+		LogDir:     a.logDir,
+		Logger:     a.logger,
+		SSHServer:  sshSrv,
+		Filesystem: a.filesystem,
+		PatchLogs:  a.client.PatchLogs,
+	})
 	go a.runLoop(ctx)
 }
 
@@ -228,6 +257,7 @@ func (a *agent) runLoop(ctx context.Context) {
 	go a.reportLifecycleLoop(ctx)
 	go a.reportMetadataLoop(ctx)
 	go a.fetchServiceBannerLoop(ctx)
+	go a.manageProcessPriorityLoop(ctx)
 
 	for retrier := retry.New(100*time.Millisecond, 10*time.Second); retrier.Wait(ctx); {
 		a.logger.Info(ctx, "connecting to coderd")
@@ -332,140 +362,210 @@ func (t *trySingleflight) Do(key string, fn func()) {
 }
 
 func (a *agent) reportMetadataLoop(ctx context.Context) {
-	const metadataLimit = 128
+	tickerDone := make(chan struct{})
+	collectDone := make(chan struct{})
+	ctx, cancel := context.WithCancel(ctx)
+	defer func() {
+		cancel()
+		<-collectDone
+		<-tickerDone
+	}()
 
 	var (
-		baseTicker        = time.NewTicker(a.reportMetadataInterval)
-		lastCollectedAtMu sync.RWMutex
-		lastCollectedAts  = make(map[string]time.Time)
-		metadataResults   = make(chan metadataResultAndKey, metadataLimit)
-		logger            = a.logger.Named("metadata")
+		logger          = a.logger.Named("metadata")
+		report          = make(chan struct{}, 1)
+		collect         = make(chan struct{}, 1)
+		metadataResults = make(chan metadataResultAndKey, 1)
 	)
-	defer baseTicker.Stop()
-
-	// We use a custom singleflight that immediately returns if there is already
-	// a goroutine running for a given key. This is to prevent a build-up of
-	// goroutines waiting on Do when the script takes many multiples of
-	// baseInterval to run.
-	flight := trySingleflight{m: map[string]struct{}{}}
-
-	postMetadata := func(mr metadataResultAndKey) {
-		err := a.client.PostMetadata(ctx, mr.key, *mr.result)
-		if err != nil {
-			a.logger.Error(ctx, "agent failed to report metadata", slog.Error(err))
-		}
-	}
 
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case mr := <-metadataResults:
-			postMetadata(mr)
-			continue
-		case <-baseTicker.C:
+	// Set up collect and report as a single ticker with two channels,
+	// this is to allow collection and reporting to be triggered
+	// independently of each other.
+	go func() {
+		t := time.NewTicker(a.reportMetadataInterval)
+		defer func() {
+			t.Stop()
+			close(report)
+			close(collect)
+			close(tickerDone)
+		}()
+		wake := func(c chan<- struct{}) {
+			select {
+			case c <- struct{}{}:
+			default:
+			}
 		}
+		wake(collect) // Start immediately.
 
-		if len(metadataResults) > 0 {
-			// The inner collection loop expects the channel is empty before spinning up
-			// all the collection goroutines.
-			logger.Debug(ctx, "metadata collection backpressured",
-				slog.F("queue_len", len(metadataResults)),
-			)
-			continue
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-t.C:
+				wake(report)
+				wake(collect)
+			}
 		}
+	}()
 
-		manifest := a.manifest.Load()
-		if manifest == nil {
-			continue
-		}
+	go func() {
+		defer close(collectDone)
+
+		var (
+			// We use a custom singleflight that immediately returns if there is already
+			// a goroutine running for a given key. This is to prevent a build-up of
+			// goroutines waiting on Do when the script takes many multiples of
+			// baseInterval to run.
+			flight            = trySingleflight{m: map[string]struct{}{}}
+			lastCollectedAtMu sync.RWMutex
+			lastCollectedAts  = make(map[string]time.Time)
+		)
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-collect:
+			}
 
-		if len(manifest.Metadata) > metadataLimit {
-			logger.Error(
-				ctx, "metadata limit exceeded",
-				slog.F("limit", metadataLimit), slog.F("got", len(manifest.Metadata)),
-			)
-			continue
-		}
+			manifest := a.manifest.Load()
+			if manifest == nil {
+				continue
+			}
 
-		// If the manifest changes (e.g. on agent reconnect) we need to
-		// purge old cache values to prevent lastCollectedAt from growing
-		// boundlessly.
-		lastCollectedAtMu.Lock()
-		for key := range lastCollectedAts {
-			if slices.IndexFunc(manifest.Metadata, func(md codersdk.WorkspaceAgentMetadataDescription) bool {
-				return md.Key == key
-			}) < 0 {
-				logger.Debug(ctx, "deleting lastCollected key, missing from manifest",
-					slog.F("key", key),
-				)
-				delete(lastCollectedAts, key)
+			// If the manifest changes (e.g. on agent reconnect) we need to
+			// purge old cache values to prevent lastCollectedAt from growing
+			// boundlessly.
+			lastCollectedAtMu.Lock()
+			for key := range lastCollectedAts {
+				if slices.IndexFunc(manifest.Metadata, func(md codersdk.WorkspaceAgentMetadataDescription) bool {
+					return md.Key == key
+				}) < 0 {
+					logger.Debug(ctx, "deleting lastCollected key, missing from manifest",
+						slog.F("key", key),
+					)
+					delete(lastCollectedAts, key)
+				}
 			}
-		}
-		lastCollectedAtMu.Unlock()
-
-		// Spawn a goroutine for each metadata collection, and use a
-		// channel to synchronize the results and avoid both messy
-		// mutex logic and overloading the API.
-		for _, md := range manifest.Metadata {
-			md := md
-			// We send the result to the channel in the goroutine to avoid
-			// sending the same result multiple times. So, we don't care about
-			// the return values.
-			go flight.Do(md.Key, func() {
-				ctx := slog.With(ctx, slog.F("key", md.Key))
-				lastCollectedAtMu.RLock()
-				collectedAt, ok := lastCollectedAts[md.Key]
-				lastCollectedAtMu.RUnlock()
-				if ok {
-					// If the interval is zero, we assume the user just wants
-					// a single collection at startup, not a spinning loop.
-					if md.Interval == 0 {
-						return
+			lastCollectedAtMu.Unlock()
+
+			// Spawn a goroutine for each metadata collection, and use a
+			// channel to synchronize the results and avoid both messy
+			// mutex logic and overloading the API.
+			for _, md := range manifest.Metadata {
+				md := md
+				// We send the result to the channel in the goroutine to avoid
+				// sending the same result multiple times. So, we don't care about
+				// the return values.
+				go flight.Do(md.Key, func() {
+					ctx := slog.With(ctx, slog.F("key", md.Key))
+					lastCollectedAtMu.RLock()
+					collectedAt, ok := lastCollectedAts[md.Key]
+					lastCollectedAtMu.RUnlock()
+					if ok {
+						// If the interval is zero, we assume the user just wants
+						// a single collection at startup, not a spinning loop.
+						if md.Interval == 0 {
+							return
+						}
+						intervalUnit := time.Second
+						// reportMetadataInterval is only less than a second in tests,
+						// so adjust the interval unit for them.
+						if a.reportMetadataInterval < time.Second {
+							intervalUnit = 100 * time.Millisecond
+						}
+						// The last collected value isn't quite stale yet, so we skip it.
+						if collectedAt.Add(time.Duration(md.Interval) * intervalUnit).After(time.Now()) {
+							return
+						}
 					}
-					intervalUnit := time.Second
-					// reportMetadataInterval is only less than a second in tests,
-					// so adjust the interval unit for them.
-					if a.reportMetadataInterval < time.Second {
-						intervalUnit = 100 * time.Millisecond
+
+					timeout := md.Timeout
+					if timeout == 0 {
+						if md.Interval != 0 {
+							timeout = md.Interval
+						} else if interval := int64(a.reportMetadataInterval.Seconds()); interval != 0 {
+							// Fallback to the report interval
+							timeout = interval * 3
+						} else {
+							// If the interval is still 0 (possible if the interval
+							// is less than a second), default to 5. This was
+							// randomly picked.
+							timeout = 5
+						}
 					}
-					// The last collected value isn't quite stale yet, so we skip it.
-					if collectedAt.Add(time.Duration(md.Interval) * intervalUnit).After(time.Now()) {
-						return
+					ctxTimeout := time.Duration(timeout) * time.Second
+					ctx, cancel := context.WithTimeout(ctx, ctxTimeout)
+					defer cancel()
+
+					now := time.Now()
+					select {
+					case <-ctx.Done():
+						logger.Warn(ctx, "metadata collection timed out", slog.F("timeout", ctxTimeout))
+					case metadataResults <- metadataResultAndKey{
+						key:    md.Key,
+						result: a.collectMetadata(ctx, md, now),
+					}:
+						lastCollectedAtMu.Lock()
+						lastCollectedAts[md.Key] = now
+						lastCollectedAtMu.Unlock()
 					}
-				}
+				})
+			}
+		}
+	}()
 
-				timeout := md.Timeout
-				if timeout == 0 {
-					if md.Interval != 0 {
-						timeout = md.Interval
-					} else if interval := int64(a.reportMetadataInterval.Seconds()); interval != 0 {
-						// Fallback to the report interval
-						timeout = interval * 3
-					} else {
-						// If the interval is still 0 (possible if the interval
-						// is less than a second), default to 5. This was
-						// randomly picked.
-						timeout = 5
-					}
-				}
-				ctxTimeout := time.Duration(timeout) * time.Second
-				ctx, cancel := context.WithTimeout(ctx, ctxTimeout)
-				defer cancel()
+	// Gather metadata updates and report them once every interval. If a
+	// previous report is in flight, wait for it to complete before
+	// sending a new one. If the network conditions are bad, we won't
+	// benefit from canceling the previous send and starting a new one.
+	var (
+		updatedMetadata = make(map[string]*codersdk.WorkspaceAgentMetadataResult)
+		reportTimeout   = 30 * time.Second
+		reportSemaphore = make(chan struct{}, 1)
+	)
+	reportSemaphore <- struct{}{}
 
-				now := time.Now()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case mr := <-metadataResults:
+			// This can overwrite unsent values, but that's fine because
+			// we're only interested about up-to-date values.
+			updatedMetadata[mr.key] = mr.result
+			continue
+		case <-report:
+			if len(updatedMetadata) > 0 {
 				select {
-				case <-ctx.Done():
-					logger.Warn(ctx, "metadata collection timed out", slog.F("timeout", ctxTimeout))
-				case metadataResults <- metadataResultAndKey{
-					key:    md.Key,
-					result: a.collectMetadata(ctx, md, now),
-				}:
-					lastCollectedAtMu.Lock()
-					lastCollectedAts[md.Key] = now
-					lastCollectedAtMu.Unlock()
+				case <-reportSemaphore:
+				default:
+					// If there's already a report in flight, don't send
+					// another one, wait for next tick instead.
+					continue
 				}
-			})
+
+				metadata := make([]agentsdk.Metadata, 0, len(updatedMetadata))
+				for key, result := range updatedMetadata {
+					metadata = append(metadata, agentsdk.Metadata{
+						Key:                          key,
+						WorkspaceAgentMetadataResult: *result,
+					})
+					delete(updatedMetadata, key)
+				}
+
+				go func() {
+					ctx, cancel := context.WithTimeout(ctx, reportTimeout)
+					defer func() {
+						cancel()
+						reportSemaphore <- struct{}{}
+					}()
+
+					err := a.client.PostMetadata(ctx, agentsdk.PostMetadataRequest{Metadata: metadata})
+					if err != nil {
+						a.logger.Error(ctx, "agent failed to report metadata", slog.Error(err))
+					}
+				}()
+			}
 		}
 	}
 }
@@ -526,7 +626,7 @@ func (a *agent) reportLifecycleLoop(ctx context.Context) {
 func (a *agent) setLifecycle(ctx context.Context, state codersdk.WorkspaceAgentLifecycle) {
 	report := agentsdk.PostLifecycleRequest{
 		State:     state,
-		ChangedAt: database.Now(),
+		ChangedAt: dbtime.Now(),
 	}
 
 	a.lifecycleMu.Lock()
@@ -608,7 +708,7 @@ func (a *agent) run(ctx context.Context) error {
 	err = a.client.PostStartup(ctx, agentsdk.PostStartupRequest{
 		Version:           buildinfo.Version(),
 		ExpandedDirectory: manifest.Directory,
-		Subsystem:         a.subsystem,
+		Subsystems:        a.subsystems,
 	})
 	if err != nil {
 		return xerrors.Errorf("update workspace agent version: %w", err)
@@ -634,41 +734,29 @@ func (a *agent) run(ctx context.Context) error {
 			}
 		}
 
-		lifecycleState := codersdk.WorkspaceAgentLifecycleReady
-		scriptDone := make(chan error, 1)
-		err = a.trackConnGoroutine(func() {
-			defer close(scriptDone)
-			scriptDone <- a.runStartupScript(ctx, manifest.StartupScript)
-		})
+		err = a.scriptRunner.Init(manifest.Scripts)
 		if err != nil {
-			return xerrors.Errorf("track startup script: %w", err)
+			return xerrors.Errorf("init script runner: %w", err)
 		}
-		go func() {
-			var timeout <-chan time.Time
-			// If timeout is zero, an older version of the coder
-			// provider was used. Otherwise a timeout is always > 0.
-			if manifest.StartupScriptTimeout > 0 {
-				t := time.NewTimer(manifest.StartupScriptTimeout)
-				defer t.Stop()
-				timeout = t.C
-			}
-
-			var err error
-			select {
-			case err = <-scriptDone:
-			case <-timeout:
-				a.logger.Warn(ctx, "script timed out", slog.F("lifecycle", "startup"), slog.F("timeout", manifest.ShutdownScriptTimeout))
-				a.setLifecycle(ctx, codersdk.WorkspaceAgentLifecycleStartTimeout)
-				err = <-scriptDone // The script can still complete after a timeout.
-			}
+		err = a.trackConnGoroutine(func() {
+			err := a.scriptRunner.Execute(ctx, func(script codersdk.WorkspaceAgentScript) bool {
+				return script.RunOnStart
+			})
 			if err != nil {
-				if errors.Is(err, context.Canceled) {
-					return
+				a.logger.Warn(ctx, "startup script(s) failed", slog.Error(err))
+				if errors.Is(err, agentscripts.ErrTimeout) {
+					a.setLifecycle(ctx, codersdk.WorkspaceAgentLifecycleStartTimeout)
+				} else {
+					a.setLifecycle(ctx, codersdk.WorkspaceAgentLifecycleStartError)
 				}
-				lifecycleState = codersdk.WorkspaceAgentLifecycleStartError
+			} else {
+				a.setLifecycle(ctx, codersdk.WorkspaceAgentLifecycleReady)
 			}
-			a.setLifecycle(ctx, lifecycleState)
-		}()
+			a.scriptRunner.StartCron()
+		})
+		if err != nil {
+			return xerrors.Errorf("track conn goroutine: %w", err)
+		}
 	}
 
 	// This automatically closes when the context ends!
@@ -681,7 +769,7 @@ func (a *agent) run(ctx context.Context) error {
 	network := a.network
 	a.closeMutex.Unlock()
 	if network == nil {
-		network, err = a.createTailnet(ctx, manifest.AgentID, manifest.DERPMap, manifest.DisableDirectConnections)
+		network, err = a.createTailnet(ctx, manifest.AgentID, manifest.DERPMap, manifest.DERPForceWebSockets, manifest.DisableDirectConnections)
 		if err != nil {
 			return xerrors.Errorf("create tailnet: %w", err)
 		}
@@ -704,8 +792,10 @@ func (a *agent) run(ctx context.Context) error {
 		if err != nil {
 			a.logger.Error(ctx, "update tailnet addresses", slog.Error(err))
 		}
-		// Update the DERP map and allow/disallow direct connections.
+		// Update the DERP map, force WebSocket setting and allow/disallow
+		// direct connections.
 		network.SetDERPMap(manifest.DERPMap)
+		network.SetDERPForceWebSockets(manifest.DERPForceWebSockets)
 		network.SetBlockEndpoints(manifest.DisableDirectConnections)
 	}
 
@@ -759,13 +849,15 @@ func (a *agent) trackConnGoroutine(fn func()) error {
 	return nil
 }
 
-func (a *agent) createTailnet(ctx context.Context, agentID uuid.UUID, derpMap *tailcfg.DERPMap, disableDirectConnections bool) (_ *tailnet.Conn, err error) {
+func (a *agent) createTailnet(ctx context.Context, agentID uuid.UUID, derpMap *tailcfg.DERPMap, derpForceWebSockets, disableDirectConnections bool) (_ *tailnet.Conn, err error) {
 	network, err := tailnet.NewConn(&tailnet.Options{
-		Addresses:      a.wireguardAddresses(agentID),
-		DERPMap:        derpMap,
-		Logger:         a.logger.Named("net.tailnet"),
-		ListenPort:     a.tailnetListenPort,
-		BlockEndpoints: disableDirectConnections,
+		ID:                  agentID,
+		Addresses:           a.wireguardAddresses(agentID),
+		DERPMap:             derpMap,
+		DERPForceWebSockets: derpForceWebSockets,
+		Logger:              a.logger.Named("net.tailnet"),
+		ListenPort:          a.tailnetListenPort,
+		BlockEndpoints:      disableDirectConnections,
 	})
 	if err != nil {
 		return nil, xerrors.Errorf("create tailnet: %w", err)
@@ -811,7 +903,10 @@ func (a *agent) createTailnet(ctx context.Context, agentID uuid.UUID, derpMap *t
 				}
 				break
 			}
-			logger.Debug(ctx, "accepted conn", slog.F("remote", conn.RemoteAddr().String()))
+			clog := logger.With(
+				slog.F("remote", conn.RemoteAddr().String()),
+				slog.F("local", conn.LocalAddr().String()))
+			clog.Info(ctx, "accepted conn")
 			wg.Add(1)
 			closed := make(chan struct{})
 			go func() {
@@ -843,7 +938,7 @@ func (a *agent) createTailnet(ctx context.Context, agentID uuid.UUID, derpMap *t
 					logger.Warn(ctx, "failed to unmarshal init", slog.F("raw", data))
 					return
 				}
-				_ = a.handleReconnectingPTY(ctx, logger, msg, conn)
+				_ = a.handleReconnectingPTY(ctx, clog, msg, conn)
 			}()
 		}
 		wg.Wait()
@@ -870,6 +965,10 @@ func (a *agent) createTailnet(ctx context.Context, agentID uuid.UUID, derpMap *t
 				}
 				break
 			}
+			clog := a.logger.Named("speedtest").With(
+				slog.F("remote", conn.RemoteAddr().String()),
+				slog.F("local", conn.LocalAddr().String()))
+			clog.Info(ctx, "accepted conn")
 			wg.Add(1)
 			closed := make(chan struct{})
 			go func() {
@@ -882,7 +981,12 @@ func (a *agent) createTailnet(ctx context.Context, agentID uuid.UUID, derpMap *t
 			}()
 			go func() {
 				defer close(closed)
-				_ = speedtest.ServeConn(conn)
+				sErr := speedtest.ServeConn(conn)
+				if sErr != nil {
+					clog.Error(ctx, "test ended with error", slog.Error(sErr))
+					return
+				}
+				clog.Info(ctx, "test ended")
 			}()
 		}
 		wg.Wait()
@@ -979,93 +1083,6 @@ func (a *agent) runDERPMapSubscriber(ctx context.Context, network *tailnet.Conn)
 	}
 }
 
-func (a *agent) runStartupScript(ctx context.Context, script string) error {
-	return a.runScript(ctx, "startup", script)
-}
-
-func (a *agent) runShutdownScript(ctx context.Context, script string) error {
-	return a.runScript(ctx, "shutdown", script)
-}
-
-func (a *agent) runScript(ctx context.Context, lifecycle, script string) (err error) {
-	if script == "" {
-		return nil
-	}
-
-	logger := a.logger.With(slog.F("lifecycle", lifecycle))
-
-	logger.Info(ctx, fmt.Sprintf("running %s script", lifecycle), slog.F("script", script))
-	fileWriter, err := a.filesystem.OpenFile(filepath.Join(a.logDir, fmt.Sprintf("coder-%s-script.log", lifecycle)), os.O_CREATE|os.O_RDWR, 0o600)
-	if err != nil {
-		return xerrors.Errorf("open %s script log file: %w", lifecycle, err)
-	}
-	defer func() {
-		err := fileWriter.Close()
-		if err != nil {
-			logger.Warn(ctx, fmt.Sprintf("close %s script log file", lifecycle), slog.Error(err))
-		}
-	}()
-
-	cmdPty, err := a.sshServer.CreateCommand(ctx, script, nil)
-	if err != nil {
-		return xerrors.Errorf("%s script: create command: %w", lifecycle, err)
-	}
-	cmd := cmdPty.AsExec()
-
-	var stdout, stderr io.Writer = fileWriter, fileWriter
-	if lifecycle == "startup" {
-		send, flushAndClose := agentsdk.LogsSender(a.client.PatchLogs, logger)
-		// If ctx is canceled here (or in a writer below), we may be
-		// discarding logs, but that's okay because we're shutting down
-		// anyway. We could consider creating a new context here if we
-		// want better control over flush during shutdown.
-		defer func() {
-			if err := flushAndClose(ctx); err != nil {
-				logger.Warn(ctx, "flush startup logs failed", slog.Error(err))
-			}
-		}()
-
-		infoW := agentsdk.StartupLogsWriter(ctx, send, codersdk.WorkspaceAgentLogSourceStartupScript, codersdk.LogLevelInfo)
-		defer infoW.Close()
-		errW := agentsdk.StartupLogsWriter(ctx, send, codersdk.WorkspaceAgentLogSourceStartupScript, codersdk.LogLevelError)
-		defer errW.Close()
-
-		stdout = io.MultiWriter(fileWriter, infoW)
-		stderr = io.MultiWriter(fileWriter, errW)
-	}
-
-	cmd.Stdout = stdout
-	cmd.Stderr = stderr
-
-	start := time.Now()
-	defer func() {
-		end := time.Now()
-		execTime := end.Sub(start)
-		exitCode := 0
-		if err != nil {
-			exitCode = 255 // Unknown status.
-			var exitError *exec.ExitError
-			if xerrors.As(err, &exitError) {
-				exitCode = exitError.ExitCode()
-			}
-			logger.Warn(ctx, fmt.Sprintf("%s script failed", lifecycle), slog.F("execution_time", execTime), slog.F("exit_code", exitCode), slog.Error(err))
-		} else {
-			logger.Info(ctx, fmt.Sprintf("%s script completed", lifecycle), slog.F("execution_time", execTime), slog.F("exit_code", exitCode))
-		}
-	}()
-
-	err = cmd.Run()
-	if err != nil {
-		// cmd.Run does not return a context canceled error, it returns "signal: killed".
-		if ctx.Err() != nil {
-			return ctx.Err()
-		}
-
-		return xerrors.Errorf("%s script: run: %w", lifecycle, err)
-	}
-	return nil
-}
-
 func (a *agent) handleReconnectingPTY(ctx context.Context, logger slog.Logger, msg codersdk.WorkspaceAgentReconnectingPTYInit, conn net.Conn) (retErr error) {
 	defer conn.Close()
 	a.metrics.connectionsTotal.Add(1)
@@ -1074,8 +1091,8 @@ func (a *agent) handleReconnectingPTY(ctx context.Context, logger slog.Logger, m
 	defer a.connCountReconnectingPTY.Add(-1)
 
 	connectionID := uuid.NewString()
-	logger = logger.With(slog.F("message_id", msg.ID), slog.F("connection_id", connectionID))
-	logger.Debug(ctx, "starting handler")
+	connLogger := logger.With(slog.F("message_id", msg.ID), slog.F("connection_id", connectionID))
+	connLogger.Debug(ctx, "starting handler")
 
 	defer func() {
 		if err := retErr; err != nil {
@@ -1086,22 +1103,22 @@ func (a *agent) handleReconnectingPTY(ctx context.Context, logger slog.Logger, m
 			// If the agent is closed, we don't want to
 			// log this as an error since it's expected.
 			if closed {
-				logger.Debug(ctx, "reconnecting PTY failed with session error (agent closed)", slog.Error(err))
+				connLogger.Info(ctx, "reconnecting pty failed with attach error (agent closed)", slog.Error(err))
 			} else {
-				logger.Error(ctx, "reconnecting PTY failed with session error", slog.Error(err))
+				connLogger.Error(ctx, "reconnecting pty failed with attach error", slog.Error(err))
 			}
 		}
-		logger.Debug(ctx, "session closed")
+		connLogger.Info(ctx, "reconnecting pty connection closed")
 	}()
 
-	var rpty *reconnectingPTY
-	sendConnected := make(chan *reconnectingPTY, 1)
+	var rpty reconnectingpty.ReconnectingPTY
+	sendConnected := make(chan reconnectingpty.ReconnectingPTY, 1)
 	// On store, reserve this ID to prevent multiple concurrent new connections.
 	waitReady, ok := a.reconnectingPTYs.LoadOrStore(msg.ID, sendConnected)
 	if ok {
 		close(sendConnected) // Unused.
-		logger.Debug(ctx, "connecting to existing session")
-		c, ok := waitReady.(chan *reconnectingPTY)
+		connLogger.Debug(ctx, "connecting to existing reconnecting pty")
+		c, ok := waitReady.(chan reconnectingpty.ReconnectingPTY)
 		if !ok {
 			return xerrors.Errorf("found invalid type in reconnecting pty map: %T", waitReady)
 		}
@@ -1111,7 +1128,7 @@ func (a *agent) handleReconnectingPTY(ctx context.Context, logger slog.Logger, m
 		}
 		c <- rpty // Put it back for the next reconnect.
 	} else {
-		logger.Debug(ctx, "creating new session")
+		connLogger.Debug(ctx, "creating new reconnecting pty")
 
 		connected := false
 		defer func() {
@@ -1127,169 +1144,24 @@ func (a *agent) handleReconnectingPTY(ctx context.Context, logger slog.Logger, m
 			a.metrics.reconnectingPTYErrors.WithLabelValues("create_command").Add(1)
 			return xerrors.Errorf("create command: %w", err)
 		}
-		cmd.Env = append(cmd.Env, "TERM=xterm-256color")
-
-		// Default to buffer 64KiB.
-		circularBuffer, err := circbuf.NewBuffer(64 << 10)
-		if err != nil {
-			return xerrors.Errorf("create circular buffer: %w", err)
-		}
 
-		ptty, process, err := pty.Start(cmd)
-		if err != nil {
-			a.metrics.reconnectingPTYErrors.WithLabelValues("start_command").Add(1)
-			return xerrors.Errorf("start command: %w", err)
-		}
+		rpty = reconnectingpty.New(ctx, cmd, &reconnectingpty.Options{
+			Timeout: a.reconnectingPTYTimeout,
+			Metrics: a.metrics.reconnectingPTYErrors,
+		}, logger.With(slog.F("message_id", msg.ID)))
 
-		ctx, cancel := context.WithCancel(ctx)
-		rpty = &reconnectingPTY{
-			activeConns: map[string]net.Conn{
-				// We have to put the connection in the map instantly otherwise
-				// the connection won't be closed if the process instantly dies.
-				connectionID: conn,
-			},
-			ptty: ptty,
-			// Timeouts created with an after func can be reset!
-			timeout:        time.AfterFunc(a.reconnectingPTYTimeout, cancel),
-			circularBuffer: circularBuffer,
-		}
-		// We don't need to separately monitor for the process exiting.
-		// When it exits, our ptty.OutputReader() will return EOF after
-		// reading all process output.
 		if err = a.trackConnGoroutine(func() {
-			buffer := make([]byte, 1024)
-			for {
-				read, err := rpty.ptty.OutputReader().Read(buffer)
-				if err != nil {
-					// When the PTY is closed, this is triggered.
-					// Error is typically a benign EOF, so only log for debugging.
-					if errors.Is(err, io.EOF) {
-						logger.Debug(ctx, "unable to read pty output, command might have exited", slog.Error(err))
-					} else {
-						logger.Warn(ctx, "unable to read pty output, command might have exited", slog.Error(err))
-						a.metrics.reconnectingPTYErrors.WithLabelValues("output_reader").Add(1)
-					}
-					break
-				}
-				part := buffer[:read]
-				rpty.circularBufferMutex.Lock()
-				_, err = rpty.circularBuffer.Write(part)
-				rpty.circularBufferMutex.Unlock()
-				if err != nil {
-					logger.Error(ctx, "write to circular buffer", slog.Error(err))
-					break
-				}
-				rpty.activeConnsMutex.Lock()
-				for cid, conn := range rpty.activeConns {
-					_, err = conn.Write(part)
-					if err != nil {
-						logger.Warn(ctx,
-							"error writing to active conn",
-							slog.F("other_conn_id", cid),
-							slog.Error(err),
-						)
-						a.metrics.reconnectingPTYErrors.WithLabelValues("write").Add(1)
-					}
-				}
-				rpty.activeConnsMutex.Unlock()
-			}
-
-			// Cleanup the process, PTY, and delete it's
-			// ID from memory.
-			_ = process.Kill()
-			rpty.Close()
+			rpty.Wait()
 			a.reconnectingPTYs.Delete(msg.ID)
 		}); err != nil {
-			_ = process.Kill()
-			_ = ptty.Close()
+			rpty.Close(err)
 			return xerrors.Errorf("start routine: %w", err)
 		}
+
 		connected = true
 		sendConnected <- rpty
 	}
-	// Resize the PTY to initial height + width.
-	err := rpty.ptty.Resize(msg.Height, msg.Width)
-	if err != nil {
-		// We can continue after this, it's not fatal!
-		logger.Error(ctx, "reconnecting PTY initial resize failed, but will continue", slog.Error(err))
-		a.metrics.reconnectingPTYErrors.WithLabelValues("resize").Add(1)
-	}
-	// Write any previously stored data for the TTY.
-	rpty.circularBufferMutex.RLock()
-	prevBuf := slices.Clone(rpty.circularBuffer.Bytes())
-	rpty.circularBufferMutex.RUnlock()
-	// Note that there is a small race here between writing buffered
-	// data and storing conn in activeConns. This is likely a very minor
-	// edge case, but we should look into ways to avoid it. Holding
-	// activeConnsMutex would be one option, but holding this mutex
-	// while also holding circularBufferMutex seems dangerous.
-	_, err = conn.Write(prevBuf)
-	if err != nil {
-		a.metrics.reconnectingPTYErrors.WithLabelValues("write").Add(1)
-		return xerrors.Errorf("write buffer to conn: %w", err)
-	}
-	// Multiple connections to the same TTY are permitted.
-	// This could easily be used for terminal sharing, but
-	// we do it because it's a nice user experience to
-	// copy/paste a terminal URL and have it _just work_.
-	rpty.activeConnsMutex.Lock()
-	rpty.activeConns[connectionID] = conn
-	rpty.activeConnsMutex.Unlock()
-	// Resetting this timeout prevents the PTY from exiting.
-	rpty.timeout.Reset(a.reconnectingPTYTimeout)
-
-	ctx, cancelFunc := context.WithCancel(ctx)
-	defer cancelFunc()
-	heartbeat := time.NewTicker(a.reconnectingPTYTimeout / 2)
-	defer heartbeat.Stop()
-	go func() {
-		// Keep updating the activity while this
-		// connection is alive!
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-heartbeat.C:
-			}
-			rpty.timeout.Reset(a.reconnectingPTYTimeout)
-		}
-	}()
-	defer func() {
-		// After this connection ends, remove it from
-		// the PTYs active connections. If it isn't
-		// removed, all PTY data will be sent to it.
-		rpty.activeConnsMutex.Lock()
-		delete(rpty.activeConns, connectionID)
-		rpty.activeConnsMutex.Unlock()
-	}()
-	decoder := json.NewDecoder(conn)
-	var req codersdk.ReconnectingPTYRequest
-	for {
-		err = decoder.Decode(&req)
-		if xerrors.Is(err, io.EOF) {
-			return nil
-		}
-		if err != nil {
-			logger.Warn(ctx, "reconnecting PTY failed with read error", slog.Error(err))
-			return nil
-		}
-		_, err = rpty.ptty.InputWriter().Write([]byte(req.Data))
-		if err != nil {
-			logger.Warn(ctx, "reconnecting PTY failed with write error", slog.Error(err))
-			a.metrics.reconnectingPTYErrors.WithLabelValues("input_writer").Add(1)
-			return nil
-		}
-		// Check if a resize needs to happen!
-		if req.Height == 0 || req.Width == 0 {
-			continue
-		}
-		err = rpty.ptty.Resize(req.Height, req.Width)
-		if err != nil {
-			// We can continue after this, it's not fatal!
-			logger.Error(ctx, "reconnecting PTY resize failed, but will continue", slog.Error(err))
-			a.metrics.reconnectingPTYErrors.WithLabelValues("resize").Add(1)
-		}
-	}
+	return rpty.Attach(ctx, connectionID, conn, msg.Height, msg.Width, connLogger)
 }
 
 // startReportingConnectionStats runs the connection stats reporting goroutine.
@@ -1397,6 +1269,115 @@ func (a *agent) startReportingConnectionStats(ctx context.Context) {
 	}
 }
 
+var prioritizedProcs = []string{"coder agent"}
+
+func (a *agent) manageProcessPriorityLoop(ctx context.Context) {
+	defer func() {
+		if r := recover(); r != nil {
+			a.logger.Critical(ctx, "recovered from panic",
+				slog.F("panic", r),
+				slog.F("stack", string(debug.Stack())),
+			)
+		}
+	}()
+
+	if val := a.envVars[EnvProcPrioMgmt]; val == "" || runtime.GOOS != "linux" {
+		a.logger.Debug(ctx, "process priority not enabled, agent will not manage process niceness/oom_score_adj ",
+			slog.F("env_var", EnvProcPrioMgmt),
+			slog.F("value", val),
+			slog.F("goos", runtime.GOOS),
+		)
+		return
+	}
+
+	if a.processManagementTick == nil {
+		ticker := time.NewTicker(time.Second)
+		defer ticker.Stop()
+		a.processManagementTick = ticker.C
+	}
+
+	for {
+		procs, err := a.manageProcessPriority(ctx)
+		if err != nil {
+			a.logger.Error(ctx, "manage process priority",
+				slog.Error(err),
+			)
+		}
+		if a.modifiedProcs != nil {
+			a.modifiedProcs <- procs
+		}
+
+		select {
+		case <-a.processManagementTick:
+		case <-ctx.Done():
+			return
+		}
+	}
+}
+
+func (a *agent) manageProcessPriority(ctx context.Context) ([]*agentproc.Process, error) {
+	const (
+		niceness = 10
+	)
+
+	procs, err := agentproc.List(a.filesystem, a.syscaller)
+	if err != nil {
+		return nil, xerrors.Errorf("list: %w", err)
+	}
+
+	var (
+		modProcs = []*agentproc.Process{}
+		logger   slog.Logger
+	)
+
+	for _, proc := range procs {
+		logger = a.logger.With(
+			slog.F("cmd", proc.Cmd()),
+			slog.F("pid", proc.PID),
+		)
+
+		containsFn := func(e string) bool {
+			contains := strings.Contains(proc.Cmd(), e)
+			return contains
+		}
+
+		// If the process is prioritized we should adjust
+		// it's oom_score_adj and avoid lowering its niceness.
+		if slices.ContainsFunc[[]string, string](prioritizedProcs, containsFn) {
+			continue
+		}
+
+		score, err := proc.Niceness(a.syscaller)
+		if err != nil {
+			logger.Warn(ctx, "unable to get proc niceness",
+				slog.Error(err),
+			)
+			continue
+		}
+
+		// We only want processes that don't have a nice value set
+		// so we don't override user nice values.
+		// Getpriority actually returns priority for the nice value
+		// which is niceness + 20, so here 20 = a niceness of 0 (aka unset).
+		if score != 20 {
+			// We don't log here since it can get spammy
+			continue
+		}
+
+		err = proc.SetNiceness(a.syscaller, niceness)
+		if err != nil {
+			logger.Warn(ctx, "unable to set proc niceness",
+				slog.F("niceness", niceness),
+				slog.Error(err),
+			)
+			continue
+		}
+
+		modProcs = append(modProcs, proc)
+	}
+	return modProcs, nil
+}
+
 // isClosed returns whether the API is closed or not.
 func (a *agent) isClosed() bool {
 	select {
@@ -1408,24 +1389,57 @@ func (a *agent) isClosed() bool {
 }
 
 func (a *agent) HTTPDebug() http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	r := chi.NewRouter()
+
+	requireNetwork := func(w http.ResponseWriter) (*tailnet.Conn, bool) {
 		a.closeMutex.Lock()
 		network := a.network
 		a.closeMutex.Unlock()
 
 		if network == nil {
-			w.WriteHeader(http.StatusOK)
+			w.WriteHeader(http.StatusNotFound)
 			_, _ = w.Write([]byte("network is not ready yet"))
+			return nil, false
+		}
+
+		return network, true
+	}
+
+	r.Get("/debug/magicsock", func(w http.ResponseWriter, r *http.Request) {
+		network, ok := requireNetwork(w)
+		if !ok {
 			return
 		}
+		network.MagicsockServeHTTPDebug(w, r)
+	})
 
-		if r.URL.Path == "/debug/magicsock" {
-			network.MagicsockServeHTTPDebug(w, r)
-		} else {
-			w.WriteHeader(http.StatusNotFound)
-			_, _ = w.Write([]byte("404 not found"))
+	r.Get("/debug/magicsock/debug-logging/{state}", func(w http.ResponseWriter, r *http.Request) {
+		state := chi.URLParam(r, "state")
+		stateBool, err := strconv.ParseBool(state)
+		if err != nil {
+			w.WriteHeader(http.StatusBadRequest)
+			_, _ = fmt.Fprintf(w, "invalid state %q, must be a boolean", state)
+			return
+		}
+
+		network, ok := requireNetwork(w)
+		if !ok {
+			return
 		}
+
+		network.MagicsockSetDebugLoggingEnabled(stateBool)
+		a.logger.Info(r.Context(), "updated magicsock debug logging due to debug request", slog.F("new_state", stateBool))
+
+		w.WriteHeader(http.StatusOK)
+		_, _ = fmt.Fprintf(w, "updated magicsock debug logging to %v", stateBool)
+	})
+
+	r.NotFound(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+		_, _ = w.Write([]byte("404 not found"))
 	})
+
+	return r
 }
 
 func (a *agent) Close() error {
@@ -1447,39 +1461,24 @@ func (a *agent) Close() error {
 	}
 
 	lifecycleState := codersdk.WorkspaceAgentLifecycleOff
-	if manifest := a.manifest.Load(); manifest != nil && manifest.ShutdownScript != "" {
-		scriptDone := make(chan error, 1)
-		go func() {
-			defer close(scriptDone)
-			scriptDone <- a.runShutdownScript(ctx, manifest.ShutdownScript)
-		}()
-
-		var timeout <-chan time.Time
-		// If timeout is zero, an older version of the coder
-		// provider was used. Otherwise a timeout is always > 0.
-		if manifest.ShutdownScriptTimeout > 0 {
-			t := time.NewTimer(manifest.ShutdownScriptTimeout)
-			defer t.Stop()
-			timeout = t.C
-		}
-
-		var err error
-		select {
-		case err = <-scriptDone:
-		case <-timeout:
-			a.logger.Warn(ctx, "script timed out", slog.F("lifecycle", "shutdown"), slog.F("timeout", manifest.ShutdownScriptTimeout))
-			a.setLifecycle(ctx, codersdk.WorkspaceAgentLifecycleShutdownTimeout)
-			err = <-scriptDone // The script can still complete after a timeout.
-		}
-		if err != nil {
+	err = a.scriptRunner.Execute(ctx, func(script codersdk.WorkspaceAgentScript) bool {
+		return script.RunOnStop
+	})
+	if err != nil {
+		a.logger.Warn(ctx, "shutdown script(s) failed", slog.Error(err))
+		if errors.Is(err, agentscripts.ErrTimeout) {
+			lifecycleState = codersdk.WorkspaceAgentLifecycleShutdownTimeout
+		} else {
 			lifecycleState = codersdk.WorkspaceAgentLifecycleShutdownError
 		}
 	}
-
-	// Set final state and wait for it to be reported because context
-	// cancellation will stop the report loop.
 	a.setLifecycle(ctx, lifecycleState)
 
+	err = a.scriptRunner.Close()
+	if err != nil {
+		a.logger.Error(ctx, "script runner close", slog.Error(err))
+	}
+
 	// Wait for the lifecycle to be reported, but don't wait forever so
 	// that we don't break user expectations.
 	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
@@ -1507,31 +1506,6 @@ lifecycleWaitLoop:
 	return nil
 }
 
-type reconnectingPTY struct {
-	activeConnsMutex sync.Mutex
-	activeConns      map[string]net.Conn
-
-	circularBuffer      *circbuf.Buffer
-	circularBufferMutex sync.RWMutex
-	timeout             *time.Timer
-	ptty                pty.PTYCmd
-}
-
-// Close ends all connections to the reconnecting
-// PTY and clear the circular buffer.
-func (r *reconnectingPTY) Close() {
-	r.activeConnsMutex.Lock()
-	defer r.activeConnsMutex.Unlock()
-	for _, conn := range r.activeConns {
-		_ = conn.Close()
-	}
-	_ = r.ptty.Close()
-	r.circularBufferMutex.Lock()
-	r.circularBuffer.Reset()
-	r.circularBufferMutex.Unlock()
-	r.timeout.Stop()
-}
-
 // userHomeDir returns the home directory of the current user, giving
 // priority to the $HOME environment variable.
 func userHomeDir() (string, error) {
diff --git a/agent/agent_test.go b/agent/agent_test.go
index 34637992536b7..b54f877fcdab9 100644
--- a/agent/agent_test.go
+++ b/agent/agent_test.go
@@ -1,7 +1,6 @@
 package agent_test
 
 import (
-	"bufio"
 	"bytes"
 	"context"
 	"encoding/json"
@@ -12,6 +11,7 @@ import (
 	"net/http/httptest"
 	"net/netip"
 	"os"
+	"os/exec"
 	"os/user"
 	"path"
 	"path/filepath"
@@ -21,10 +21,12 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
+	"syscall"
 	"testing"
 	"time"
 
 	scp "github.com/bramvdbogaerde/go-scp"
+	"github.com/golang/mock/gomock"
 	"github.com/google/uuid"
 	"github.com/pion/udp"
 	"github.com/pkg/sftp"
@@ -41,18 +43,20 @@ import (
 	"tailscale.com/tailcfg"
 
 	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/sloghuman"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/agent/agentssh"
-	"github.com/coder/coder/agent/agenttest"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/pty"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/tailnet"
-	"github.com/coder/coder/tailnet/tailnettest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/agent/agentproc"
+	"github.com/coder/coder/v2/agent/agentproc/agentproctest"
+	"github.com/coder/coder/v2/agent/agentssh"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/pty"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/tailnet/tailnettest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
@@ -102,7 +106,7 @@ func TestAgent_Stats_ReconnectingPTY(t *testing.T) {
 	//nolint:dogsled
 	conn, _, stats, _, _ := setupAgent(t, agentsdk.Manifest{}, 0)
 
-	ptyConn, err := conn.ReconnectingPTY(ctx, uuid.New(), 128, 128, "/bin/bash")
+	ptyConn, err := conn.ReconnectingPTY(ctx, uuid.New(), 128, 128, "bash")
 	require.NoError(t, err)
 	defer ptyConn.Close()
 
@@ -346,13 +350,18 @@ func TestAgent_Session_TTY_MOTD(t *testing.T) {
 			unexpected: []string{},
 		},
 		{
-			name:     "Trim",
-			manifest: agentsdk.Manifest{},
+			name: "Trim",
+			// Enable motd since it will be printed after the banner,
+			// this ensures that we can test for an exact mount of
+			// newlines.
+			manifest: agentsdk.Manifest{
+				MOTDFile: name,
+			},
 			banner: codersdk.ServiceBannerConfig{
 				Enabled: true,
 				Message: "\n\n\n\n\n\nbanner\n\n\n\n\n\n",
 			},
-			expectedRe: regexp.MustCompile("([^\n\r]|^)banner\r\n\r\n[^\r\n]"),
+			expectedRe: regexp.MustCompile(`([^\n\r]|^)banner\r\n\r\n[^\r\n]`),
 		},
 	}
 
@@ -371,6 +380,7 @@ func TestAgent_Session_TTY_MOTD(t *testing.T) {
 	}
 }
 
+//nolint:tparallel // Sub tests need to run sequentially.
 func TestAgent_Session_TTY_MOTD_Update(t *testing.T) {
 	t.Parallel()
 	if runtime.GOOS == "windows" {
@@ -430,33 +440,38 @@ func TestAgent_Session_TTY_MOTD_Update(t *testing.T) {
 	}
 	//nolint:dogsled // Allow the blank identifiers.
 	conn, client, _, _, _ := setupAgent(t, agentsdk.Manifest{}, 0, setSBInterval)
-	for _, test := range tests {
+
+	sshClient, err := conn.SSHClient(ctx)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_ = sshClient.Close()
+	})
+
+	//nolint:paralleltest // These tests need to swap the banner func.
+	for i, test := range tests {
 		test := test
-		// Set new banner func and wait for the agent to call it to update the
-		// banner.
-		ready := make(chan struct{}, 2)
-		client.SetServiceBannerFunc(func() (codersdk.ServiceBannerConfig, error) {
-			select {
-			case ready <- struct{}{}:
-			default:
-			}
-			return test.banner, nil
-		})
-		<-ready
-		<-ready // Wait for two updates to ensure the value has propagated.
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			// Set new banner func and wait for the agent to call it to update the
+			// banner.
+			ready := make(chan struct{}, 2)
+			client.SetServiceBannerFunc(func() (codersdk.ServiceBannerConfig, error) {
+				select {
+				case ready <- struct{}{}:
+				default:
+				}
+				return test.banner, nil
+			})
+			<-ready
+			<-ready // Wait for two updates to ensure the value has propagated.
 
-		sshClient, err := conn.SSHClient(ctx)
-		require.NoError(t, err)
-		t.Cleanup(func() {
-			_ = sshClient.Close()
-		})
-		session, err := sshClient.NewSession()
-		require.NoError(t, err)
-		t.Cleanup(func() {
-			_ = session.Close()
-		})
+			session, err := sshClient.NewSession()
+			require.NoError(t, err)
+			t.Cleanup(func() {
+				_ = session.Close()
+			})
 
-		testSessionOutput(t, session, test.expected, test.unexpected, nil)
+			testSessionOutput(t, session, test.expected, test.unexpected, nil)
+		})
 	}
 }
 
@@ -1055,84 +1070,6 @@ func TestAgent_SSHConnectionEnvVars(t *testing.T) {
 	}
 }
 
-func TestAgent_StartupScript(t *testing.T) {
-	t.Parallel()
-	output := "something"
-	command := "sh -c 'echo " + output + "'"
-	if runtime.GOOS == "windows" {
-		command = "cmd.exe /c echo " + output
-	}
-	t.Run("Success", func(t *testing.T) {
-		t.Parallel()
-		logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
-		client := agenttest.NewClient(t,
-			logger,
-			uuid.New(),
-			agentsdk.Manifest{
-				StartupScript: command,
-				DERPMap:       &tailcfg.DERPMap{},
-			},
-			make(chan *agentsdk.Stats),
-			tailnet.NewCoordinator(logger),
-		)
-		closer := agent.New(agent.Options{
-			Client:                 client,
-			Filesystem:             afero.NewMemMapFs(),
-			Logger:                 logger.Named("agent"),
-			ReconnectingPTYTimeout: 0,
-		})
-		t.Cleanup(func() {
-			_ = closer.Close()
-		})
-		assert.Eventually(t, func() bool {
-			got := client.GetLifecycleStates()
-			return len(got) > 0 && got[len(got)-1] == codersdk.WorkspaceAgentLifecycleReady
-		}, testutil.WaitShort, testutil.IntervalMedium)
-
-		require.Len(t, client.GetStartupLogs(), 1)
-		require.Equal(t, output, client.GetStartupLogs()[0].Output)
-	})
-	// This ensures that even when coderd sends back that the startup
-	// script has written too many lines it will still succeed!
-	t.Run("OverflowsAndSkips", func(t *testing.T) {
-		t.Parallel()
-		logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
-		client := agenttest.NewClient(t,
-			logger,
-			uuid.New(),
-			agentsdk.Manifest{
-				StartupScript: command,
-				DERPMap:       &tailcfg.DERPMap{},
-			},
-			make(chan *agentsdk.Stats, 50),
-			tailnet.NewCoordinator(logger),
-		)
-		client.PatchWorkspaceLogs = func() error {
-			resp := httptest.NewRecorder()
-			httpapi.Write(context.Background(), resp, http.StatusRequestEntityTooLarge, codersdk.Response{
-				Message: "Too many lines!",
-			})
-			res := resp.Result()
-			defer res.Body.Close()
-			return codersdk.ReadBodyAsError(res)
-		}
-		closer := agent.New(agent.Options{
-			Client:                 client,
-			Filesystem:             afero.NewMemMapFs(),
-			Logger:                 logger.Named("agent"),
-			ReconnectingPTYTimeout: 0,
-		})
-		t.Cleanup(func() {
-			_ = closer.Close()
-		})
-		assert.Eventually(t, func() bool {
-			got := client.GetLifecycleStates()
-			return len(got) > 0 && got[len(got)-1] == codersdk.WorkspaceAgentLifecycleReady
-		}, testutil.WaitShort, testutil.IntervalMedium)
-		require.Len(t, client.GetStartupLogs(), 0)
-	})
-}
-
 func TestAgent_Metadata(t *testing.T) {
 	t.Parallel()
 
@@ -1140,34 +1077,43 @@ func TestAgent_Metadata(t *testing.T) {
 
 	t.Run("Once", func(t *testing.T) {
 		t.Parallel()
+
 		//nolint:dogsled
 		_, client, _, _, _ := setupAgent(t, agentsdk.Manifest{
 			Metadata: []codersdk.WorkspaceAgentMetadataDescription{
 				{
-					Key:      "greeting",
+					Key:      "greeting1",
 					Interval: 0,
 					Script:   echoHello,
 				},
+				{
+					Key:      "greeting2",
+					Interval: 1,
+					Script:   echoHello,
+				},
 			},
 		}, 0, func(_ *agenttest.Client, opts *agent.Options) {
-			opts.ReportMetadataInterval = 100 * time.Millisecond
+			opts.ReportMetadataInterval = testutil.IntervalFast
 		})
 
-		var gotMd map[string]agentsdk.PostMetadataRequest
+		var gotMd map[string]agentsdk.Metadata
 		require.Eventually(t, func() bool {
 			gotMd = client.GetMetadata()
-			return len(gotMd) == 1
-		}, testutil.WaitShort, testutil.IntervalMedium)
+			return len(gotMd) == 2
+		}, testutil.WaitShort, testutil.IntervalFast/2)
 
-		collectedAt := gotMd["greeting"].CollectedAt
+		collectedAt1 := gotMd["greeting1"].CollectedAt
+		collectedAt2 := gotMd["greeting2"].CollectedAt
 
-		require.Never(t, func() bool {
+		require.Eventually(t, func() bool {
 			gotMd = client.GetMetadata()
-			if len(gotMd) != 1 {
+			if len(gotMd) != 2 {
 				panic("unexpected number of metadata")
 			}
-			return !gotMd["greeting"].CollectedAt.Equal(collectedAt)
-		}, testutil.WaitShort, testutil.IntervalMedium)
+			return !gotMd["greeting2"].CollectedAt.Equal(collectedAt2)
+		}, testutil.WaitShort, testutil.IntervalFast/2)
+
+		require.Equal(t, gotMd["greeting1"].CollectedAt, collectedAt1, "metadata should not be collected again")
 	})
 
 	t.Run("Many", func(t *testing.T) {
@@ -1186,7 +1132,7 @@ func TestAgent_Metadata(t *testing.T) {
 			opts.ReportMetadataInterval = testutil.IntervalFast
 		})
 
-		var gotMd map[string]agentsdk.PostMetadataRequest
+		var gotMd map[string]agentsdk.Metadata
 		require.Eventually(t, func() bool {
 			gotMd = client.GetMetadata()
 			return len(gotMd) == 1
@@ -1287,8 +1233,11 @@ func TestAgent_Lifecycle(t *testing.T) {
 		t.Parallel()
 
 		_, client, _, _, _ := setupAgent(t, agentsdk.Manifest{
-			StartupScript:        "sleep 3",
-			StartupScriptTimeout: time.Nanosecond,
+			Scripts: []codersdk.WorkspaceAgentScript{{
+				Script:     "sleep 3",
+				Timeout:    time.Millisecond,
+				RunOnStart: true,
+			}},
 		}, 0)
 
 		want := []codersdk.WorkspaceAgentLifecycle{
@@ -1309,8 +1258,11 @@ func TestAgent_Lifecycle(t *testing.T) {
 		t.Parallel()
 
 		_, client, _, _, _ := setupAgent(t, agentsdk.Manifest{
-			StartupScript:        "false",
-			StartupScriptTimeout: 30 * time.Second,
+			Scripts: []codersdk.WorkspaceAgentScript{{
+				Script:     "false",
+				Timeout:    30 * time.Second,
+				RunOnStart: true,
+			}},
 		}, 0)
 
 		want := []codersdk.WorkspaceAgentLifecycle{
@@ -1331,8 +1283,11 @@ func TestAgent_Lifecycle(t *testing.T) {
 		t.Parallel()
 
 		_, client, _, _, _ := setupAgent(t, agentsdk.Manifest{
-			StartupScript:        "true",
-			StartupScriptTimeout: 30 * time.Second,
+			Scripts: []codersdk.WorkspaceAgentScript{{
+				Script:     "true",
+				Timeout:    30 * time.Second,
+				RunOnStart: true,
+			}},
 		}, 0)
 
 		want := []codersdk.WorkspaceAgentLifecycle{
@@ -1353,8 +1308,11 @@ func TestAgent_Lifecycle(t *testing.T) {
 		t.Parallel()
 
 		_, client, _, _, closer := setupAgent(t, agentsdk.Manifest{
-			ShutdownScript:       "sleep 3",
-			StartupScriptTimeout: 30 * time.Second,
+			Scripts: []codersdk.WorkspaceAgentScript{{
+				Script:    "sleep 3",
+				Timeout:   30 * time.Second,
+				RunOnStop: true,
+			}},
 		}, 0)
 
 		assert.Eventually(t, func() bool {
@@ -1391,8 +1349,11 @@ func TestAgent_Lifecycle(t *testing.T) {
 		t.Parallel()
 
 		_, client, _, _, closer := setupAgent(t, agentsdk.Manifest{
-			ShutdownScript:        "sleep 3",
-			ShutdownScriptTimeout: time.Nanosecond,
+			Scripts: []codersdk.WorkspaceAgentScript{{
+				Script:    "sleep 3",
+				Timeout:   time.Millisecond,
+				RunOnStop: true,
+			}},
 		}, 0)
 
 		assert.Eventually(t, func() bool {
@@ -1430,8 +1391,11 @@ func TestAgent_Lifecycle(t *testing.T) {
 		t.Parallel()
 
 		_, client, _, _, closer := setupAgent(t, agentsdk.Manifest{
-			ShutdownScript:        "false",
-			ShutdownScriptTimeout: 30 * time.Second,
+			Scripts: []codersdk.WorkspaceAgentScript{{
+				Script:    "false",
+				Timeout:   30 * time.Second,
+				RunOnStop: true,
+			}},
 		}, 0)
 
 		assert.Eventually(t, func() bool {
@@ -1475,9 +1439,16 @@ func TestAgent_Lifecycle(t *testing.T) {
 			logger,
 			uuid.New(),
 			agentsdk.Manifest{
-				DERPMap:        derpMap,
-				StartupScript:  "echo 1",
-				ShutdownScript: "echo " + expected,
+				DERPMap: derpMap,
+				Scripts: []codersdk.WorkspaceAgentScript{{
+					LogPath:    "coder-startup-script.log",
+					Script:     "echo 1",
+					RunOnStart: true,
+				}, {
+					LogPath:   "coder-shutdown-script.log",
+					Script:    "echo " + expected,
+					RunOnStop: true,
+				}},
 			},
 			make(chan *agentsdk.Stats, 50),
 			tailnet.NewCoordinator(logger),
@@ -1528,9 +1499,7 @@ func TestAgent_Startup(t *testing.T) {
 		t.Parallel()
 
 		_, client, _, _, _ := setupAgent(t, agentsdk.Manifest{
-			StartupScript:        "true",
-			StartupScriptTimeout: 30 * time.Second,
-			Directory:            "",
+			Directory: "",
 		}, 0)
 		assert.Eventually(t, func() bool {
 			return client.GetStartup().Version != ""
@@ -1542,9 +1511,7 @@ func TestAgent_Startup(t *testing.T) {
 		t.Parallel()
 
 		_, client, _, _, _ := setupAgent(t, agentsdk.Manifest{
-			StartupScript:        "true",
-			StartupScriptTimeout: 30 * time.Second,
-			Directory:            "~",
+			Directory: "~",
 		}, 0)
 		assert.Eventually(t, func() bool {
 			return client.GetStartup().Version != ""
@@ -1558,9 +1525,7 @@ func TestAgent_Startup(t *testing.T) {
 		t.Parallel()
 
 		_, client, _, _, _ := setupAgent(t, agentsdk.Manifest{
-			StartupScript:        "true",
-			StartupScriptTimeout: 30 * time.Second,
-			Directory:            "coder/coder",
+			Directory: "coder/coder",
 		}, 0)
 		assert.Eventually(t, func() bool {
 			return client.GetStartup().Version != ""
@@ -1574,9 +1539,7 @@ func TestAgent_Startup(t *testing.T) {
 		t.Parallel()
 
 		_, client, _, _, _ := setupAgent(t, agentsdk.Manifest{
-			StartupScript:        "true",
-			StartupScriptTimeout: 30 * time.Second,
-			Directory:            "$HOME",
+			Directory: "$HOME",
 		}, 0)
 		assert.Eventually(t, func() bool {
 			return client.GetStartup().Version != ""
@@ -1587,8 +1550,8 @@ func TestAgent_Startup(t *testing.T) {
 	})
 }
 
+//nolint:paralleltest // This test sets an environment variable.
 func TestAgent_ReconnectingPTY(t *testing.T) {
-	t.Parallel()
 	if runtime.GOOS == "windows" {
 		// This might be our implementation, or ConPTY itself.
 		// It's difficult to find extensive tests for it, so
@@ -1596,61 +1559,136 @@ func TestAgent_ReconnectingPTY(t *testing.T) {
 		t.Skip("ConPTY appears to be inconsistent on Windows.")
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-	defer cancel()
+	backends := []string{"Buffered", "Screen"}
 
-	//nolint:dogsled
-	conn, _, _, _, _ := setupAgent(t, agentsdk.Manifest{}, 0)
-	id := uuid.New()
-	netConn, err := conn.ReconnectingPTY(ctx, id, 100, 100, "/bin/bash")
-	require.NoError(t, err)
-	defer netConn.Close()
+	_, err := exec.LookPath("screen")
+	hasScreen := err == nil
 
-	bufRead := bufio.NewReader(netConn)
+	// Make sure UTF-8 works even with LANG set to something like C.
+	t.Setenv("LANG", "C")
 
-	// Brief pause to reduce the likelihood that we send keystrokes while
-	// the shell is simultaneously sending a prompt.
-	time.Sleep(100 * time.Millisecond)
+	for _, backendType := range backends {
+		backendType := backendType
+		t.Run(backendType, func(t *testing.T) {
+			if backendType == "Screen" {
+				if runtime.GOOS != "linux" {
+					t.Skipf("`screen` is not supported on %s", runtime.GOOS)
+				} else if !hasScreen {
+					t.Skip("`screen` not found")
+				}
+			} else if hasScreen && runtime.GOOS == "linux" {
+				// Set up a PATH that does not have screen in it.
+				bashPath, err := exec.LookPath("bash")
+				require.NoError(t, err)
+				dir, err := os.MkdirTemp("/tmp", "coder-test-reconnecting-pty-PATH")
+				require.NoError(t, err, "create temp dir for reconnecting pty PATH")
+				err = os.Symlink(bashPath, filepath.Join(dir, "bash"))
+				require.NoError(t, err, "symlink bash into reconnecting pty PATH")
+				t.Setenv("PATH", dir)
+			}
 
-	data, err := json.Marshal(codersdk.ReconnectingPTYRequest{
-		Data: "echo test\r\n",
-	})
-	require.NoError(t, err)
-	_, err = netConn.Write(data)
-	require.NoError(t, err)
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+			defer cancel()
 
-	expectLine := func(matcher func(string) bool) {
-		for {
-			line, err := bufRead.ReadString('\n')
+			//nolint:dogsled
+			conn, _, _, _, _ := setupAgent(t, agentsdk.Manifest{}, 0)
+			id := uuid.New()
+			// --norc disables executing .bashrc, which is often used to customize the bash prompt
+			netConn1, err := conn.ReconnectingPTY(ctx, id, 80, 80, "bash --norc")
+			require.NoError(t, err)
+			defer netConn1.Close()
+			tr1 := testutil.NewTerminalReader(t, netConn1)
+
+			// A second simultaneous connection.
+			netConn2, err := conn.ReconnectingPTY(ctx, id, 80, 80, "bash --norc")
 			require.NoError(t, err)
-			if matcher(line) {
-				break
+			defer netConn2.Close()
+			tr2 := testutil.NewTerminalReader(t, netConn2)
+
+			matchPrompt := func(line string) bool {
+				return strings.Contains(line, "$ ") || strings.Contains(line, "# ")
+			}
+			matchEchoCommand := func(line string) bool {
+				return strings.Contains(line, "echo test")
+			}
+			matchEchoOutput := func(line string) bool {
+				return strings.Contains(line, "test") && !strings.Contains(line, "echo")
+			}
+			matchExitCommand := func(line string) bool {
+				return strings.Contains(line, "exit")
+			}
+			matchExitOutput := func(line string) bool {
+				return strings.Contains(line, "exit") || strings.Contains(line, "logout")
 			}
-		}
-	}
 
-	matchEchoCommand := func(line string) bool {
-		return strings.Contains(line, "echo test")
-	}
-	matchEchoOutput := func(line string) bool {
-		return strings.Contains(line, "test") && !strings.Contains(line, "echo")
-	}
+			// Wait for the prompt before writing commands.  If the command arrives before the prompt is written, screen
+			// will sometimes put the command output on the same line as the command and the test will flake
+			require.NoError(t, tr1.ReadUntil(ctx, matchPrompt), "find prompt")
+			require.NoError(t, tr2.ReadUntil(ctx, matchPrompt), "find prompt")
+
+			data, err := json.Marshal(codersdk.ReconnectingPTYRequest{
+				Data: "echo test\r",
+			})
+			require.NoError(t, err)
+			_, err = netConn1.Write(data)
+			require.NoError(t, err)
 
-	// Once for typing the command...
-	expectLine(matchEchoCommand)
-	// And another time for the actual output.
-	expectLine(matchEchoOutput)
+			// Once for typing the command...
+			require.NoError(t, tr1.ReadUntil(ctx, matchEchoCommand), "find echo command")
+			// And another time for the actual output.
+			require.NoError(t, tr1.ReadUntil(ctx, matchEchoOutput), "find echo output")
 
-	_ = netConn.Close()
-	netConn, err = conn.ReconnectingPTY(ctx, id, 100, 100, "/bin/bash")
-	require.NoError(t, err)
-	defer netConn.Close()
+			// Same for the other connection.
+			require.NoError(t, tr2.ReadUntil(ctx, matchEchoCommand), "find echo command")
+			require.NoError(t, tr2.ReadUntil(ctx, matchEchoOutput), "find echo output")
+
+			_ = netConn1.Close()
+			_ = netConn2.Close()
+			netConn3, err := conn.ReconnectingPTY(ctx, id, 80, 80, "bash --norc")
+			require.NoError(t, err)
+			defer netConn3.Close()
+			tr3 := testutil.NewTerminalReader(t, netConn3)
 
-	bufRead = bufio.NewReader(netConn)
+			// Same output again!
+			require.NoError(t, tr3.ReadUntil(ctx, matchEchoCommand), "find echo command")
+			require.NoError(t, tr3.ReadUntil(ctx, matchEchoOutput), "find echo output")
 
-	// Same output again!
-	expectLine(matchEchoCommand)
-	expectLine(matchEchoOutput)
+			// Exit should cause the connection to close.
+			data, err = json.Marshal(codersdk.ReconnectingPTYRequest{
+				Data: "exit\r",
+			})
+			require.NoError(t, err)
+			_, err = netConn3.Write(data)
+			require.NoError(t, err)
+
+			// Once for the input and again for the output.
+			require.NoError(t, tr3.ReadUntil(ctx, matchExitCommand), "find exit command")
+			require.NoError(t, tr3.ReadUntil(ctx, matchExitOutput), "find exit output")
+
+			// Wait for the connection to close.
+			require.ErrorIs(t, tr3.ReadUntil(ctx, nil), io.EOF)
+
+			// Try a non-shell command.  It should output then immediately exit.
+			netConn4, err := conn.ReconnectingPTY(ctx, uuid.New(), 80, 80, "echo test")
+			require.NoError(t, err)
+			defer netConn4.Close()
+
+			tr4 := testutil.NewTerminalReader(t, netConn4)
+			require.NoError(t, tr4.ReadUntil(ctx, matchEchoOutput), "find echo output")
+			require.ErrorIs(t, tr4.ReadUntil(ctx, nil), io.EOF)
+
+			// Ensure that UTF-8 is supported.  Avoid the terminal emulator because it
+			// does not appear to support UTF-8, just make sure the bytes that come
+			// back have the character in it.
+			netConn5, err := conn.ReconnectingPTY(ctx, uuid.New(), 80, 80, "echo ❯")
+			require.NoError(t, err)
+			defer netConn5.Close()
+
+			bytes, err := io.ReadAll(netConn5)
+			require.NoError(t, err)
+			require.Contains(t, string(bytes), "❯")
+		})
+	}
 }
 
 func TestAgent_Dial(t *testing.T) {
@@ -1843,13 +1881,16 @@ func TestAgent_UpdatedDERP(t *testing.T) {
 func TestAgent_Speedtest(t *testing.T) {
 	t.Parallel()
 	t.Skip("This test is relatively flakey because of Tailscale's speedtest code...")
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
 	derpMap, _ := tailnettest.RunDERPAndSTUN(t)
 	//nolint:dogsled
 	conn, _, _, _, _ := setupAgent(t, agentsdk.Manifest{
 		DERPMap: derpMap,
-	}, 0)
+	}, 0, func(client *agenttest.Client, options *agent.Options) {
+		options.Logger = logger.Named("agent")
+	})
 	defer conn.Close()
 	res, err := conn.Speedtest(ctx, speedtest.Upload, 250*time.Millisecond)
 	require.NoError(t, err)
@@ -1932,6 +1973,96 @@ func TestAgent_WriteVSCodeConfigs(t *testing.T) {
 	}, testutil.WaitShort, testutil.IntervalFast)
 }
 
+func TestAgent_DebugServer(t *testing.T) {
+	t.Parallel()
+
+	derpMap, _ := tailnettest.RunDERPAndSTUN(t)
+	//nolint:dogsled
+	conn, _, _, _, agnt := setupAgent(t, agentsdk.Manifest{
+		DERPMap: derpMap,
+	}, 0)
+
+	awaitReachableCtx := testutil.Context(t, testutil.WaitLong)
+	ok := conn.AwaitReachable(awaitReachableCtx)
+	require.True(t, ok)
+	_ = conn.Close()
+
+	srv := httptest.NewServer(agnt.HTTPDebug())
+	t.Cleanup(srv.Close)
+
+	t.Run("MagicsockDebug", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitLong)
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL+"/debug/magicsock", nil)
+		require.NoError(t, err)
+
+		res, err := srv.Client().Do(req)
+		require.NoError(t, err)
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		resBody, err := io.ReadAll(res.Body)
+		require.NoError(t, err)
+		require.Contains(t, string(resBody), "<h1>magicsock</h1>")
+	})
+
+	t.Run("MagicsockDebugLogging", func(t *testing.T) {
+		t.Parallel()
+
+		t.Run("Enable", func(t *testing.T) {
+			t.Parallel()
+
+			ctx := testutil.Context(t, testutil.WaitLong)
+			req, err := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL+"/debug/magicsock/debug-logging/t", nil)
+			require.NoError(t, err)
+
+			res, err := srv.Client().Do(req)
+			require.NoError(t, err)
+			defer res.Body.Close()
+			require.Equal(t, http.StatusOK, res.StatusCode)
+
+			resBody, err := io.ReadAll(res.Body)
+			require.NoError(t, err)
+			require.Contains(t, string(resBody), "updated magicsock debug logging to true")
+		})
+
+		t.Run("Disable", func(t *testing.T) {
+			t.Parallel()
+
+			ctx := testutil.Context(t, testutil.WaitLong)
+			req, err := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL+"/debug/magicsock/debug-logging/0", nil)
+			require.NoError(t, err)
+
+			res, err := srv.Client().Do(req)
+			require.NoError(t, err)
+			defer res.Body.Close()
+			require.Equal(t, http.StatusOK, res.StatusCode)
+
+			resBody, err := io.ReadAll(res.Body)
+			require.NoError(t, err)
+			require.Contains(t, string(resBody), "updated magicsock debug logging to false")
+		})
+
+		t.Run("Invalid", func(t *testing.T) {
+			t.Parallel()
+
+			ctx := testutil.Context(t, testutil.WaitLong)
+			req, err := http.NewRequestWithContext(ctx, http.MethodGet, srv.URL+"/debug/magicsock/debug-logging/blah", nil)
+			require.NoError(t, err)
+
+			res, err := srv.Client().Do(req)
+			require.NoError(t, err)
+			defer res.Body.Close()
+			require.Equal(t, http.StatusBadRequest, res.StatusCode)
+
+			resBody, err := io.ReadAll(res.Body)
+			require.NoError(t, err)
+			require.Contains(t, string(resBody), `invalid state "blah", must be a boolean`)
+		})
+	})
+}
+
 func setupSSHCommand(t *testing.T, beforeArgs []string, afterArgs []string) (*ptytest.PTYCmd, pty.Process) {
 	//nolint:dogsled
 	agentConn, _, _, _, _ := setupAgent(t, agentsdk.Manifest{}, 0)
@@ -2013,7 +2144,7 @@ func setupAgent(t *testing.T, metadata agentsdk.Manifest, ptyTimeout time.Durati
 	*agenttest.Client,
 	<-chan *agentsdk.Stats,
 	afero.Fs,
-	io.Closer,
+	agent.Agent,
 ) {
 	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
 	if metadata.DERPMap == nil {
@@ -2250,6 +2381,173 @@ func TestAgent_Metrics_SSH(t *testing.T) {
 	require.NoError(t, err)
 }
 
+func TestAgent_ManageProcessPriority(t *testing.T) {
+	t.Parallel()
+
+	t.Run("OK", func(t *testing.T) {
+		t.Parallel()
+
+		if runtime.GOOS != "linux" {
+			t.Skip("Skipping non-linux environment")
+		}
+
+		var (
+			expectedProcs = map[int32]agentproc.Process{}
+			fs            = afero.NewMemMapFs()
+			syscaller     = agentproctest.NewMockSyscaller(gomock.NewController(t))
+			ticker        = make(chan time.Time)
+			modProcs      = make(chan []*agentproc.Process)
+			logger        = slog.Make(sloghuman.Sink(io.Discard))
+		)
+
+		// Create some processes.
+		for i := 0; i < 4; i++ {
+			// Create a prioritized process. This process should
+			// have it's oom_score_adj set to -500 and its nice
+			// score should be untouched.
+			var proc agentproc.Process
+			if i == 0 {
+				proc = agentproctest.GenerateProcess(t, fs,
+					func(p *agentproc.Process) {
+						p.CmdLine = "./coder\x00agent\x00--no-reap"
+						p.PID = int32(i)
+					},
+				)
+			} else {
+				proc = agentproctest.GenerateProcess(t, fs,
+					func(p *agentproc.Process) {
+						// Make the cmd something similar to a prioritized
+						// process but differentiate the arguments.
+						p.CmdLine = "./coder\x00stat"
+					},
+				)
+
+				syscaller.EXPECT().SetPriority(proc.PID, 10).Return(nil)
+				syscaller.EXPECT().GetPriority(proc.PID).Return(20, nil)
+			}
+			syscaller.EXPECT().
+				Kill(proc.PID, syscall.Signal(0)).
+				Return(nil)
+
+			expectedProcs[proc.PID] = proc
+		}
+
+		_, _, _, _, _ = setupAgent(t, agentsdk.Manifest{}, 0, func(c *agenttest.Client, o *agent.Options) {
+			o.Syscaller = syscaller
+			o.ModifiedProcesses = modProcs
+			o.EnvironmentVariables = map[string]string{agent.EnvProcPrioMgmt: "1"}
+			o.Filesystem = fs
+			o.Logger = logger
+			o.ProcessManagementTick = ticker
+		})
+		actualProcs := <-modProcs
+		require.Len(t, actualProcs, len(expectedProcs)-1)
+	})
+
+	t.Run("IgnoreCustomNice", func(t *testing.T) {
+		t.Parallel()
+
+		if runtime.GOOS != "linux" {
+			t.Skip("Skipping non-linux environment")
+		}
+
+		var (
+			expectedProcs = map[int32]agentproc.Process{}
+			fs            = afero.NewMemMapFs()
+			ticker        = make(chan time.Time)
+			syscaller     = agentproctest.NewMockSyscaller(gomock.NewController(t))
+			modProcs      = make(chan []*agentproc.Process)
+			logger        = slog.Make(sloghuman.Sink(io.Discard))
+		)
+
+		// Create some processes.
+		for i := 0; i < 2; i++ {
+			proc := agentproctest.GenerateProcess(t, fs)
+			syscaller.EXPECT().
+				Kill(proc.PID, syscall.Signal(0)).
+				Return(nil)
+
+			if i == 0 {
+				// Set a random nice score. This one should not be adjusted by
+				// our management loop.
+				syscaller.EXPECT().GetPriority(proc.PID).Return(25, nil)
+			} else {
+				syscaller.EXPECT().GetPriority(proc.PID).Return(20, nil)
+				syscaller.EXPECT().SetPriority(proc.PID, 10).Return(nil)
+			}
+
+			expectedProcs[proc.PID] = proc
+		}
+
+		_, _, _, _, _ = setupAgent(t, agentsdk.Manifest{}, 0, func(c *agenttest.Client, o *agent.Options) {
+			o.Syscaller = syscaller
+			o.ModifiedProcesses = modProcs
+			o.EnvironmentVariables = map[string]string{agent.EnvProcPrioMgmt: "1"}
+			o.Filesystem = fs
+			o.Logger = logger
+			o.ProcessManagementTick = ticker
+		})
+		actualProcs := <-modProcs
+		// We should ignore the process with a custom nice score.
+		require.Len(t, actualProcs, 1)
+	})
+
+	t.Run("DisabledByDefault", func(t *testing.T) {
+		t.Parallel()
+
+		if runtime.GOOS != "linux" {
+			t.Skip("Skipping non-linux environment")
+		}
+
+		var (
+			buf bytes.Buffer
+			wr  = &syncWriter{
+				w: &buf,
+			}
+		)
+		log := slog.Make(sloghuman.Sink(wr)).Leveled(slog.LevelDebug)
+
+		_, _, _, _, _ = setupAgent(t, agentsdk.Manifest{}, 0, func(c *agenttest.Client, o *agent.Options) {
+			o.Logger = log
+		})
+
+		require.Eventually(t, func() bool {
+			wr.mu.Lock()
+			defer wr.mu.Unlock()
+			return strings.Contains(buf.String(), "process priority not enabled")
+		}, testutil.WaitLong, testutil.IntervalFast)
+	})
+
+	t.Run("DisabledForNonLinux", func(t *testing.T) {
+		t.Parallel()
+
+		if runtime.GOOS == "linux" {
+			t.Skip("Skipping linux environment")
+		}
+
+		var (
+			buf bytes.Buffer
+			wr  = &syncWriter{
+				w: &buf,
+			}
+		)
+		log := slog.Make(sloghuman.Sink(wr)).Leveled(slog.LevelDebug)
+
+		_, _, _, _, _ = setupAgent(t, agentsdk.Manifest{}, 0, func(c *agenttest.Client, o *agent.Options) {
+			o.Logger = log
+			// Try to enable it so that we can assert that non-linux
+			// environments are truly disabled.
+			o.EnvironmentVariables = map[string]string{agent.EnvProcPrioMgmt: "1"}
+		})
+		require.Eventually(t, func() bool {
+			wr.mu.Lock()
+			defer wr.mu.Unlock()
+
+			return strings.Contains(buf.String(), "process priority not enabled")
+		}, testutil.WaitLong, testutil.IntervalFast)
+	})
+}
+
 func verifyCollectedMetrics(t *testing.T, expected []agentsdk.AgentMetric, actual []*promgo.MetricFamily) bool {
 	t.Helper()
 
@@ -2271,3 +2569,14 @@ func verifyCollectedMetrics(t *testing.T, expected []agentsdk.AgentMetric, actua
 	}
 	return true
 }
+
+type syncWriter struct {
+	mu sync.Mutex
+	w  io.Writer
+}
+
+func (s *syncWriter) Write(p []byte) (int, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.w.Write(p)
+}
diff --git a/agent/agentproc/agentproctest/doc.go b/agent/agentproc/agentproctest/doc.go
new file mode 100644
index 0000000000000..5007b36268f76
--- /dev/null
+++ b/agent/agentproc/agentproctest/doc.go
@@ -0,0 +1,5 @@
+// Package agentproctest contains utility functions
+// for testing process management in the agent.
+package agentproctest
+
+//go:generate mockgen -destination ./syscallermock.go -package agentproctest github.com/coder/coder/v2/agent/agentproc Syscaller
diff --git a/agent/agentproc/agentproctest/proc.go b/agent/agentproc/agentproctest/proc.go
new file mode 100644
index 0000000000000..c36e04ec1cdc3
--- /dev/null
+++ b/agent/agentproc/agentproctest/proc.go
@@ -0,0 +1,49 @@
+package agentproctest
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/agent/agentproc"
+	"github.com/coder/coder/v2/cryptorand"
+)
+
+func GenerateProcess(t *testing.T, fs afero.Fs, muts ...func(*agentproc.Process)) agentproc.Process {
+	t.Helper()
+
+	pid, err := cryptorand.Intn(1<<31 - 1)
+	require.NoError(t, err)
+
+	arg1, err := cryptorand.String(5)
+	require.NoError(t, err)
+
+	arg2, err := cryptorand.String(5)
+	require.NoError(t, err)
+
+	arg3, err := cryptorand.String(5)
+	require.NoError(t, err)
+
+	cmdline := fmt.Sprintf("%s\x00%s\x00%s", arg1, arg2, arg3)
+
+	process := agentproc.Process{
+		CmdLine: cmdline,
+		PID:     int32(pid),
+	}
+
+	for _, mut := range muts {
+		mut(&process)
+	}
+
+	process.Dir = fmt.Sprintf("%s/%d", "/proc", process.PID)
+
+	err = fs.MkdirAll(process.Dir, 0o555)
+	require.NoError(t, err)
+
+	err = afero.WriteFile(fs, fmt.Sprintf("%s/cmdline", process.Dir), []byte(process.CmdLine), 0o444)
+	require.NoError(t, err)
+
+	return process
+}
diff --git a/agent/agentproc/agentproctest/syscallermock.go b/agent/agentproc/agentproctest/syscallermock.go
new file mode 100644
index 0000000000000..8d9697bc559ef
--- /dev/null
+++ b/agent/agentproc/agentproctest/syscallermock.go
@@ -0,0 +1,78 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/coder/coder/v2/agent/agentproc (interfaces: Syscaller)
+
+// Package agentproctest is a generated GoMock package.
+package agentproctest
+
+import (
+	reflect "reflect"
+	syscall "syscall"
+
+	gomock "github.com/golang/mock/gomock"
+)
+
+// MockSyscaller is a mock of Syscaller interface.
+type MockSyscaller struct {
+	ctrl     *gomock.Controller
+	recorder *MockSyscallerMockRecorder
+}
+
+// MockSyscallerMockRecorder is the mock recorder for MockSyscaller.
+type MockSyscallerMockRecorder struct {
+	mock *MockSyscaller
+}
+
+// NewMockSyscaller creates a new mock instance.
+func NewMockSyscaller(ctrl *gomock.Controller) *MockSyscaller {
+	mock := &MockSyscaller{ctrl: ctrl}
+	mock.recorder = &MockSyscallerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockSyscaller) EXPECT() *MockSyscallerMockRecorder {
+	return m.recorder
+}
+
+// GetPriority mocks base method.
+func (m *MockSyscaller) GetPriority(arg0 int32) (int, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetPriority", arg0)
+	ret0, _ := ret[0].(int)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetPriority indicates an expected call of GetPriority.
+func (mr *MockSyscallerMockRecorder) GetPriority(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPriority", reflect.TypeOf((*MockSyscaller)(nil).GetPriority), arg0)
+}
+
+// Kill mocks base method.
+func (m *MockSyscaller) Kill(arg0 int32, arg1 syscall.Signal) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Kill", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Kill indicates an expected call of Kill.
+func (mr *MockSyscallerMockRecorder) Kill(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Kill", reflect.TypeOf((*MockSyscaller)(nil).Kill), arg0, arg1)
+}
+
+// SetPriority mocks base method.
+func (m *MockSyscaller) SetPriority(arg0 int32, arg1 int) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "SetPriority", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// SetPriority indicates an expected call of SetPriority.
+func (mr *MockSyscallerMockRecorder) SetPriority(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetPriority", reflect.TypeOf((*MockSyscaller)(nil).SetPriority), arg0, arg1)
+}
diff --git a/agent/agentproc/doc.go b/agent/agentproc/doc.go
new file mode 100644
index 0000000000000..8b15c52c5f9fb
--- /dev/null
+++ b/agent/agentproc/doc.go
@@ -0,0 +1,3 @@
+// Package agentproc contains logic for interfacing with local
+// processes running in the same context as the agent.
+package agentproc
diff --git a/agent/agentproc/proc_other.go b/agent/agentproc/proc_other.go
new file mode 100644
index 0000000000000..c0c4e2a25ce32
--- /dev/null
+++ b/agent/agentproc/proc_other.go
@@ -0,0 +1,24 @@
+//go:build !linux
+// +build !linux
+
+package agentproc
+
+import (
+	"github.com/spf13/afero"
+)
+
+func (p *Process) Niceness(sc Syscaller) (int, error) {
+	return 0, errUnimplemented
+}
+
+func (p *Process) SetNiceness(sc Syscaller, score int) error {
+	return errUnimplemented
+}
+
+func (p *Process) Cmd() string {
+	return ""
+}
+
+func List(fs afero.Fs, syscaller Syscaller) ([]*Process, error) {
+	return nil, errUnimplemented
+}
diff --git a/agent/agentproc/proc_test.go b/agent/agentproc/proc_test.go
new file mode 100644
index 0000000000000..37991679503c6
--- /dev/null
+++ b/agent/agentproc/proc_test.go
@@ -0,0 +1,166 @@
+package agentproc_test
+
+import (
+	"runtime"
+	"syscall"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/agent/agentproc"
+	"github.com/coder/coder/v2/agent/agentproc/agentproctest"
+)
+
+func TestList(t *testing.T) {
+	t.Parallel()
+
+	if runtime.GOOS != "linux" {
+		t.Skipf("skipping non-linux environment")
+	}
+
+	t.Run("OK", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			fs            = afero.NewMemMapFs()
+			sc            = agentproctest.NewMockSyscaller(gomock.NewController(t))
+			expectedProcs = make(map[int32]agentproc.Process)
+		)
+
+		for i := 0; i < 4; i++ {
+			proc := agentproctest.GenerateProcess(t, fs)
+			expectedProcs[proc.PID] = proc
+
+			sc.EXPECT().
+				Kill(proc.PID, syscall.Signal(0)).
+				Return(nil)
+		}
+
+		actualProcs, err := agentproc.List(fs, sc)
+		require.NoError(t, err)
+		require.Len(t, actualProcs, len(expectedProcs))
+		for _, proc := range actualProcs {
+			expected, ok := expectedProcs[proc.PID]
+			require.True(t, ok)
+			require.Equal(t, expected.PID, proc.PID)
+			require.Equal(t, expected.CmdLine, proc.CmdLine)
+			require.Equal(t, expected.Dir, proc.Dir)
+		}
+	})
+
+	t.Run("FinishedProcess", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			fs            = afero.NewMemMapFs()
+			sc            = agentproctest.NewMockSyscaller(gomock.NewController(t))
+			expectedProcs = make(map[int32]agentproc.Process)
+		)
+
+		for i := 0; i < 3; i++ {
+			proc := agentproctest.GenerateProcess(t, fs)
+			expectedProcs[proc.PID] = proc
+
+			sc.EXPECT().
+				Kill(proc.PID, syscall.Signal(0)).
+				Return(nil)
+		}
+
+		// Create a process that's already finished. We're not adding
+		// it to the map because it should be skipped over.
+		proc := agentproctest.GenerateProcess(t, fs)
+		sc.EXPECT().
+			Kill(proc.PID, syscall.Signal(0)).
+			Return(xerrors.New("os: process already finished"))
+
+		actualProcs, err := agentproc.List(fs, sc)
+		require.NoError(t, err)
+		require.Len(t, actualProcs, len(expectedProcs))
+		for _, proc := range actualProcs {
+			expected, ok := expectedProcs[proc.PID]
+			require.True(t, ok)
+			require.Equal(t, expected.PID, proc.PID)
+			require.Equal(t, expected.CmdLine, proc.CmdLine)
+			require.Equal(t, expected.Dir, proc.Dir)
+		}
+	})
+
+	t.Run("NoSuchProcess", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			fs            = afero.NewMemMapFs()
+			sc            = agentproctest.NewMockSyscaller(gomock.NewController(t))
+			expectedProcs = make(map[int32]agentproc.Process)
+		)
+
+		for i := 0; i < 3; i++ {
+			proc := agentproctest.GenerateProcess(t, fs)
+			expectedProcs[proc.PID] = proc
+
+			sc.EXPECT().
+				Kill(proc.PID, syscall.Signal(0)).
+				Return(nil)
+		}
+
+		// Create a process that doesn't exist. We're not adding
+		// it to the map because it should be skipped over.
+		proc := agentproctest.GenerateProcess(t, fs)
+		sc.EXPECT().
+			Kill(proc.PID, syscall.Signal(0)).
+			Return(syscall.ESRCH)
+
+		actualProcs, err := agentproc.List(fs, sc)
+		require.NoError(t, err)
+		require.Len(t, actualProcs, len(expectedProcs))
+		for _, proc := range actualProcs {
+			expected, ok := expectedProcs[proc.PID]
+			require.True(t, ok)
+			require.Equal(t, expected.PID, proc.PID)
+			require.Equal(t, expected.CmdLine, proc.CmdLine)
+			require.Equal(t, expected.Dir, proc.Dir)
+		}
+	})
+}
+
+// These tests are not very interesting but they provide some modicum of
+// confidence.
+func TestProcess(t *testing.T) {
+	t.Parallel()
+
+	if runtime.GOOS != "linux" {
+		t.Skipf("skipping non-linux environment")
+	}
+
+	t.Run("SetNiceness", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			sc   = agentproctest.NewMockSyscaller(gomock.NewController(t))
+			proc = &agentproc.Process{
+				PID: 32,
+			}
+			score = 20
+		)
+
+		sc.EXPECT().SetPriority(proc.PID, score).Return(nil)
+		err := proc.SetNiceness(sc, score)
+		require.NoError(t, err)
+	})
+
+	t.Run("Cmd", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			proc = &agentproc.Process{
+				CmdLine: "helloworld\x00--arg1\x00--arg2",
+			}
+			expectedName = "helloworld --arg1 --arg2"
+		)
+
+		require.Equal(t, expectedName, proc.Cmd())
+	})
+}
diff --git a/agent/agentproc/proc_unix.go b/agent/agentproc/proc_unix.go
new file mode 100644
index 0000000000000..f52caed52ee33
--- /dev/null
+++ b/agent/agentproc/proc_unix.go
@@ -0,0 +1,109 @@
+//go:build linux
+// +build linux
+
+package agentproc
+
+import (
+	"errors"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+
+	"github.com/spf13/afero"
+	"golang.org/x/xerrors"
+)
+
+func List(fs afero.Fs, syscaller Syscaller) ([]*Process, error) {
+	d, err := fs.Open(defaultProcDir)
+	if err != nil {
+		return nil, xerrors.Errorf("open dir %q: %w", defaultProcDir, err)
+	}
+	defer d.Close()
+
+	entries, err := d.Readdirnames(0)
+	if err != nil {
+		return nil, xerrors.Errorf("readdirnames: %w", err)
+	}
+
+	processes := make([]*Process, 0, len(entries))
+	for _, entry := range entries {
+		pid, err := strconv.ParseInt(entry, 10, 32)
+		if err != nil {
+			continue
+		}
+
+		// Check that the process still exists.
+		exists, err := isProcessExist(syscaller, int32(pid))
+		if err != nil {
+			return nil, xerrors.Errorf("check process exists: %w", err)
+		}
+		if !exists {
+			continue
+		}
+
+		cmdline, err := afero.ReadFile(fs, filepath.Join(defaultProcDir, entry, "cmdline"))
+		if err != nil {
+			var errNo syscall.Errno
+			if xerrors.As(err, &errNo) && errNo == syscall.EPERM {
+				continue
+			}
+			return nil, xerrors.Errorf("read cmdline: %w", err)
+		}
+		processes = append(processes, &Process{
+			PID:     int32(pid),
+			CmdLine: string(cmdline),
+			Dir:     filepath.Join(defaultProcDir, entry),
+		})
+	}
+
+	return processes, nil
+}
+
+func isProcessExist(syscaller Syscaller, pid int32) (bool, error) {
+	err := syscaller.Kill(pid, syscall.Signal(0))
+	if err == nil {
+		return true, nil
+	}
+	if err.Error() == "os: process already finished" {
+		return false, nil
+	}
+
+	var errno syscall.Errno
+	if !errors.As(err, &errno) {
+		return false, err
+	}
+
+	switch errno {
+	case syscall.ESRCH:
+		return false, nil
+	case syscall.EPERM:
+		return true, nil
+	}
+
+	return false, xerrors.Errorf("kill: %w", err)
+}
+
+func (p *Process) Niceness(sc Syscaller) (int, error) {
+	nice, err := sc.GetPriority(p.PID)
+	if err != nil {
+		return 0, xerrors.Errorf("get priority for %q: %w", p.CmdLine, err)
+	}
+	return nice, nil
+}
+
+func (p *Process) SetNiceness(sc Syscaller, score int) error {
+	err := sc.SetPriority(p.PID, score)
+	if err != nil {
+		return xerrors.Errorf("set priority for %q: %w", p.CmdLine, err)
+	}
+	return nil
+}
+
+func (p *Process) Cmd() string {
+	return strings.Join(p.cmdLine(), " ")
+}
+
+func (p *Process) cmdLine() []string {
+	return strings.Split(p.CmdLine, "\x00")
+}
diff --git a/agent/agentproc/syscaller.go b/agent/agentproc/syscaller.go
new file mode 100644
index 0000000000000..1cd6640e36b43
--- /dev/null
+++ b/agent/agentproc/syscaller.go
@@ -0,0 +1,19 @@
+package agentproc
+
+import (
+	"syscall"
+)
+
+type Syscaller interface {
+	SetPriority(pid int32, priority int) error
+	GetPriority(pid int32) (int, error)
+	Kill(pid int32, sig syscall.Signal) error
+}
+
+const defaultProcDir = "/proc"
+
+type Process struct {
+	Dir     string
+	CmdLine string
+	PID     int32
+}
diff --git a/agent/agentproc/syscaller_other.go b/agent/agentproc/syscaller_other.go
new file mode 100644
index 0000000000000..114c553e43da2
--- /dev/null
+++ b/agent/agentproc/syscaller_other.go
@@ -0,0 +1,30 @@
+//go:build !linux
+// +build !linux
+
+package agentproc
+
+import (
+	"syscall"
+
+	"golang.org/x/xerrors"
+)
+
+func NewSyscaller() Syscaller {
+	return nopSyscaller{}
+}
+
+var errUnimplemented = xerrors.New("unimplemented")
+
+type nopSyscaller struct{}
+
+func (nopSyscaller) SetPriority(pid int32, priority int) error {
+	return errUnimplemented
+}
+
+func (nopSyscaller) GetPriority(pid int32) (int, error) {
+	return 0, errUnimplemented
+}
+
+func (nopSyscaller) Kill(pid int32, sig syscall.Signal) error {
+	return errUnimplemented
+}
diff --git a/agent/agentproc/syscaller_unix.go b/agent/agentproc/syscaller_unix.go
new file mode 100644
index 0000000000000..e63e56b50f724
--- /dev/null
+++ b/agent/agentproc/syscaller_unix.go
@@ -0,0 +1,42 @@
+//go:build linux
+// +build linux
+
+package agentproc
+
+import (
+	"syscall"
+
+	"golang.org/x/sys/unix"
+	"golang.org/x/xerrors"
+)
+
+func NewSyscaller() Syscaller {
+	return UnixSyscaller{}
+}
+
+type UnixSyscaller struct{}
+
+func (UnixSyscaller) SetPriority(pid int32, nice int) error {
+	err := unix.Setpriority(unix.PRIO_PROCESS, int(pid), nice)
+	if err != nil {
+		return xerrors.Errorf("set priority: %w", err)
+	}
+	return nil
+}
+
+func (UnixSyscaller) GetPriority(pid int32) (int, error) {
+	nice, err := unix.Getpriority(0, int(pid))
+	if err != nil {
+		return 0, xerrors.Errorf("get priority: %w", err)
+	}
+	return nice, nil
+}
+
+func (UnixSyscaller) Kill(pid int32, sig syscall.Signal) error {
+	err := syscall.Kill(int(pid), sig)
+	if err != nil {
+		return xerrors.Errorf("kill: %w", err)
+	}
+
+	return nil
+}
diff --git a/agent/agentscripts/agentscripts.go b/agent/agentscripts/agentscripts.go
new file mode 100644
index 0000000000000..3acc48b0a140c
--- /dev/null
+++ b/agent/agentscripts/agentscripts.go
@@ -0,0 +1,314 @@
+package agentscripts
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"os/user"
+	"path/filepath"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/robfig/cron/v3"
+	"github.com/spf13/afero"
+	"golang.org/x/sync/errgroup"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+	"github.com/coder/coder/v2/agent/agentssh"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+)
+
+var (
+	// ErrTimeout is returned when a script times out.
+	ErrTimeout = xerrors.New("script timed out")
+	// ErrOutputPipesOpen is returned when a script exits leaving the output
+	// pipe(s) (stdout, stderr) open. This happens because we set WaitDelay on
+	// the command, which gives us two things:
+	//
+	// 1. The ability to ensure that a script exits (this is important for e.g.
+	//    blocking login, and avoiding doing so indefinitely)
+	// 2. Improved command cancellation on timeout
+	ErrOutputPipesOpen = xerrors.New("script exited without closing output pipes")
+
+	parser = cron.NewParser(cron.Second | cron.Minute | cron.Hour | cron.Dom | cron.Month | cron.DowOptional)
+)
+
+// Options are a set of options for the runner.
+type Options struct {
+	LogDir     string
+	Logger     slog.Logger
+	SSHServer  *agentssh.Server
+	Filesystem afero.Fs
+	PatchLogs  func(ctx context.Context, req agentsdk.PatchLogs) error
+}
+
+// New creates a runner for the provided scripts.
+func New(opts Options) *Runner {
+	cronCtx, cronCtxCancel := context.WithCancel(context.Background())
+	return &Runner{
+		Options:       opts,
+		cronCtx:       cronCtx,
+		cronCtxCancel: cronCtxCancel,
+		cron:          cron.New(cron.WithParser(parser)),
+		closed:        make(chan struct{}),
+	}
+}
+
+type Runner struct {
+	Options
+
+	cronCtx       context.Context
+	cronCtxCancel context.CancelFunc
+	cmdCloseWait  sync.WaitGroup
+	closed        chan struct{}
+	closeMutex    sync.Mutex
+	cron          *cron.Cron
+	initialized   atomic.Bool
+	scripts       []codersdk.WorkspaceAgentScript
+}
+
+// Init initializes the runner with the provided scripts.
+// It also schedules any scripts that have a schedule.
+// This function must be called before Execute.
+func (r *Runner) Init(scripts []codersdk.WorkspaceAgentScript) error {
+	if r.initialized.Load() {
+		return xerrors.New("init: already initialized")
+	}
+	r.initialized.Store(true)
+	r.scripts = scripts
+	r.Logger.Info(r.cronCtx, "initializing agent scripts", slog.F("script_count", len(scripts)), slog.F("log_dir", r.LogDir))
+
+	for _, script := range scripts {
+		if script.Cron == "" {
+			continue
+		}
+		script := script
+		_, err := r.cron.AddFunc(script.Cron, func() {
+			err := r.run(r.cronCtx, script)
+			if err != nil {
+				r.Logger.Warn(context.Background(), "run agent script on schedule", slog.Error(err))
+			}
+		})
+		if err != nil {
+			return xerrors.Errorf("add schedule: %w", err)
+		}
+	}
+	return nil
+}
+
+// StartCron starts the cron scheduler.
+// This is done async to allow for the caller to execute scripts prior.
+func (r *Runner) StartCron() {
+	// cron.Start() and cron.Stop() does not guarantee that the cron goroutine
+	// has exited by the time the `cron.Stop()` context returns, so we need to
+	// track it manually.
+	err := r.trackCommandGoroutine(func() {
+		r.cron.Run()
+	})
+	if err != nil {
+		r.Logger.Warn(context.Background(), "start cron failed", slog.Error(err))
+	}
+}
+
+// Execute runs a set of scripts according to a filter.
+func (r *Runner) Execute(ctx context.Context, filter func(script codersdk.WorkspaceAgentScript) bool) error {
+	if filter == nil {
+		// Execute em' all!
+		filter = func(script codersdk.WorkspaceAgentScript) bool {
+			return true
+		}
+	}
+	var eg errgroup.Group
+	for _, script := range r.scripts {
+		if !filter(script) {
+			continue
+		}
+		script := script
+		eg.Go(func() error {
+			err := r.run(ctx, script)
+			if err != nil {
+				return xerrors.Errorf("run agent script %q: %w", script.LogSourceID, err)
+			}
+			return nil
+		})
+	}
+	return eg.Wait()
+}
+
+// run executes the provided script with the timeout.
+// If the timeout is exceeded, the process is sent an interrupt signal.
+// If the process does not exit after a few seconds, it is forcefully killed.
+// This function immediately returns after a timeout, and does not wait for the process to exit.
+func (r *Runner) run(ctx context.Context, script codersdk.WorkspaceAgentScript) error {
+	logPath := script.LogPath
+	if logPath == "" {
+		logPath = fmt.Sprintf("coder-script-%s.log", script.LogSourceID)
+	}
+	if logPath[0] == '~' {
+		// First we check the environment.
+		homeDir, err := os.UserHomeDir()
+		if err != nil {
+			u, err := user.Current()
+			if err != nil {
+				return xerrors.Errorf("current user: %w", err)
+			}
+			homeDir = u.HomeDir
+		}
+		logPath = filepath.Join(homeDir, logPath[1:])
+	}
+	logPath = os.ExpandEnv(logPath)
+	if !filepath.IsAbs(logPath) {
+		logPath = filepath.Join(r.LogDir, logPath)
+	}
+	logger := r.Logger.With(slog.F("log_path", logPath))
+	logger.Info(ctx, "running agent script", slog.F("script", script.Script))
+
+	fileWriter, err := r.Filesystem.OpenFile(logPath, os.O_CREATE|os.O_RDWR, 0o600)
+	if err != nil {
+		return xerrors.Errorf("open %s script log file: %w", logPath, err)
+	}
+	defer func() {
+		err := fileWriter.Close()
+		if err != nil {
+			logger.Warn(ctx, fmt.Sprintf("close %s script log file", logPath), slog.Error(err))
+		}
+	}()
+
+	var cmd *exec.Cmd
+	cmdCtx := ctx
+	if script.Timeout > 0 {
+		var ctxCancel context.CancelFunc
+		cmdCtx, ctxCancel = context.WithTimeout(ctx, script.Timeout)
+		defer ctxCancel()
+	}
+	cmdPty, err := r.SSHServer.CreateCommand(cmdCtx, script.Script, nil)
+	if err != nil {
+		return xerrors.Errorf("%s script: create command: %w", logPath, err)
+	}
+	cmd = cmdPty.AsExec()
+	cmd.SysProcAttr = cmdSysProcAttr()
+	cmd.WaitDelay = 10 * time.Second
+	cmd.Cancel = cmdCancel(cmd)
+
+	send, flushAndClose := agentsdk.LogsSender(script.LogSourceID, r.PatchLogs, logger)
+	// If ctx is canceled here (or in a writer below), we may be
+	// discarding logs, but that's okay because we're shutting down
+	// anyway. We could consider creating a new context here if we
+	// want better control over flush during shutdown.
+	defer func() {
+		if err := flushAndClose(ctx); err != nil {
+			logger.Warn(ctx, "flush startup logs failed", slog.Error(err))
+		}
+	}()
+
+	infoW := agentsdk.LogsWriter(ctx, send, script.LogSourceID, codersdk.LogLevelInfo)
+	defer infoW.Close()
+	errW := agentsdk.LogsWriter(ctx, send, script.LogSourceID, codersdk.LogLevelError)
+	defer errW.Close()
+	cmd.Stdout = io.MultiWriter(fileWriter, infoW)
+	cmd.Stderr = io.MultiWriter(fileWriter, errW)
+
+	start := time.Now()
+	defer func() {
+		end := time.Now()
+		execTime := end.Sub(start)
+		exitCode := 0
+		if err != nil {
+			exitCode = 255 // Unknown status.
+			var exitError *exec.ExitError
+			if xerrors.As(err, &exitError) {
+				exitCode = exitError.ExitCode()
+			}
+			logger.Warn(ctx, fmt.Sprintf("%s script failed", logPath), slog.F("execution_time", execTime), slog.F("exit_code", exitCode), slog.Error(err))
+		} else {
+			logger.Info(ctx, fmt.Sprintf("%s script completed", logPath), slog.F("execution_time", execTime), slog.F("exit_code", exitCode))
+		}
+	}()
+
+	err = cmd.Start()
+	if err != nil {
+		if errors.Is(err, context.DeadlineExceeded) {
+			return ErrTimeout
+		}
+		return xerrors.Errorf("%s script: start command: %w", logPath, err)
+	}
+
+	cmdDone := make(chan error, 1)
+	err = r.trackCommandGoroutine(func() {
+		cmdDone <- cmd.Wait()
+	})
+	if err != nil {
+		return xerrors.Errorf("%s script: track command goroutine: %w", logPath, err)
+	}
+	select {
+	case <-cmdCtx.Done():
+		// Wait for the command to drain!
+		select {
+		case <-cmdDone:
+		case <-time.After(10 * time.Second):
+		}
+		err = cmdCtx.Err()
+	case err = <-cmdDone:
+	}
+	switch {
+	case errors.Is(err, exec.ErrWaitDelay):
+		err = ErrOutputPipesOpen
+		message := fmt.Sprintf("script exited successfully, but output pipes were not closed after %s", cmd.WaitDelay)
+		details := fmt.Sprint(
+			"This usually means a child process was started with references to stdout or stderr. As a result, this " +
+				"process may now have been terminated. Consider redirecting the output or using a separate " +
+				"\"coder_script\" for the process, see " +
+				"https://coder.com/docs/v2/latest/templates/troubleshooting#startup-script-issues for more information.",
+		)
+		// Inform the user by propagating the message via log writers.
+		_, _ = fmt.Fprintf(cmd.Stderr, "WARNING: %s. %s\n", message, details)
+		// Also log to agent logs for ease of debugging.
+		r.Logger.Warn(ctx, message, slog.F("details", details), slog.Error(err))
+
+	case errors.Is(err, context.DeadlineExceeded):
+		err = ErrTimeout
+	}
+	return err
+}
+
+func (r *Runner) Close() error {
+	r.closeMutex.Lock()
+	defer r.closeMutex.Unlock()
+	if r.isClosed() {
+		return nil
+	}
+	close(r.closed)
+	r.cronCtxCancel()
+	<-r.cron.Stop().Done()
+	r.cmdCloseWait.Wait()
+	return nil
+}
+
+func (r *Runner) trackCommandGoroutine(fn func()) error {
+	r.closeMutex.Lock()
+	defer r.closeMutex.Unlock()
+	if r.isClosed() {
+		return xerrors.New("track command goroutine: closed")
+	}
+	r.cmdCloseWait.Add(1)
+	go func() {
+		defer r.cmdCloseWait.Done()
+		fn()
+	}()
+	return nil
+}
+
+func (r *Runner) isClosed() bool {
+	select {
+	case <-r.closed:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/agent/agentscripts/agentscripts_other.go b/agent/agentscripts/agentscripts_other.go
new file mode 100644
index 0000000000000..a7ab83276e67d
--- /dev/null
+++ b/agent/agentscripts/agentscripts_other.go
@@ -0,0 +1,20 @@
+//go:build !windows
+
+package agentscripts
+
+import (
+	"os/exec"
+	"syscall"
+)
+
+func cmdSysProcAttr() *syscall.SysProcAttr {
+	return &syscall.SysProcAttr{
+		Setsid: true,
+	}
+}
+
+func cmdCancel(cmd *exec.Cmd) func() error {
+	return func() error {
+		return syscall.Kill(-cmd.Process.Pid, syscall.SIGHUP)
+	}
+}
diff --git a/agent/agentscripts/agentscripts_test.go b/agent/agentscripts/agentscripts_test.go
new file mode 100644
index 0000000000000..1570e35d59b31
--- /dev/null
+++ b/agent/agentscripts/agentscripts_test.go
@@ -0,0 +1,80 @@
+package agentscripts_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/atomic"
+	"go.uber.org/goleak"
+
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/agent/agentscripts"
+	"github.com/coder/coder/v2/agent/agentssh"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+)
+
+func TestMain(m *testing.M) {
+	goleak.VerifyTestMain(m)
+}
+
+func TestExecuteBasic(t *testing.T) {
+	t.Parallel()
+	logs := make(chan agentsdk.PatchLogs, 1)
+	runner := setup(t, func(ctx context.Context, req agentsdk.PatchLogs) error {
+		logs <- req
+		return nil
+	})
+	defer runner.Close()
+	err := runner.Init([]codersdk.WorkspaceAgentScript{{
+		Script: "echo hello",
+	}})
+	require.NoError(t, err)
+	require.NoError(t, runner.Execute(context.Background(), func(script codersdk.WorkspaceAgentScript) bool {
+		return true
+	}))
+	log := <-logs
+	require.Equal(t, "hello", log.Logs[0].Output)
+}
+
+func TestTimeout(t *testing.T) {
+	t.Parallel()
+	runner := setup(t, nil)
+	defer runner.Close()
+	err := runner.Init([]codersdk.WorkspaceAgentScript{{
+		Script:  "sleep infinity",
+		Timeout: time.Millisecond,
+	}})
+	require.NoError(t, err)
+	require.ErrorIs(t, runner.Execute(context.Background(), nil), agentscripts.ErrTimeout)
+}
+
+func setup(t *testing.T, patchLogs func(ctx context.Context, req agentsdk.PatchLogs) error) *agentscripts.Runner {
+	t.Helper()
+	if patchLogs == nil {
+		// noop
+		patchLogs = func(ctx context.Context, req agentsdk.PatchLogs) error {
+			return nil
+		}
+	}
+	fs := afero.NewMemMapFs()
+	logger := slogtest.Make(t, nil)
+	s, err := agentssh.NewServer(context.Background(), logger, prometheus.NewRegistry(), fs, 0, "")
+	require.NoError(t, err)
+	s.AgentToken = func() string { return "" }
+	s.Manifest = atomic.NewPointer(&agentsdk.Manifest{})
+	t.Cleanup(func() {
+		_ = s.Close()
+	})
+	return agentscripts.New(agentscripts.Options{
+		LogDir:     t.TempDir(),
+		Logger:     logger,
+		SSHServer:  s,
+		Filesystem: fs,
+		PatchLogs:  patchLogs,
+	})
+}
diff --git a/agent/agentscripts/agentscripts_windows.go b/agent/agentscripts/agentscripts_windows.go
new file mode 100644
index 0000000000000..cda1b3fcc39e1
--- /dev/null
+++ b/agent/agentscripts/agentscripts_windows.go
@@ -0,0 +1,17 @@
+package agentscripts
+
+import (
+	"os"
+	"os/exec"
+	"syscall"
+)
+
+func cmdSysProcAttr() *syscall.SysProcAttr {
+	return &syscall.SysProcAttr{}
+}
+
+func cmdCancel(cmd *exec.Cmd) func() error {
+	return func() error {
+		return cmd.Process.Signal(os.Interrupt)
+	}
+}
diff --git a/agent/agentssh/agentssh.go b/agent/agentssh/agentssh.go
index 729cadd423ce2..19831c0d7caa8 100644
--- a/agent/agentssh/agentssh.go
+++ b/agent/agentssh/agentssh.go
@@ -19,6 +19,7 @@ import (
 	"time"
 
 	"github.com/gliderlabs/ssh"
+	"github.com/kballard/go-shellquote"
 	"github.com/pkg/sftp"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/spf13/afero"
@@ -28,10 +29,10 @@ import (
 
 	"cdr.dev/slog"
 
-	"github.com/coder/coder/agent/usershell"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/pty"
+	"github.com/coder/coder/v2/agent/usershell"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/pty"
 )
 
 const (
@@ -254,11 +255,13 @@ func (s *Server) sessionStart(session ssh.Session, extraEnv []string) (retErr er
 		magicType = strings.TrimPrefix(kv, MagicSessionTypeEnvironmentVariable+"=")
 		env = append(env[:index], env[index+1:]...)
 	}
-	switch magicType {
-	case MagicSessionTypeVSCode:
+
+	// Always force lowercase checking to be case-insensitive.
+	switch strings.ToLower(magicType) {
+	case strings.ToLower(MagicSessionTypeVSCode):
 		s.connCountVSCode.Add(1)
 		defer s.connCountVSCode.Add(-1)
-	case MagicSessionTypeJetBrains:
+	case strings.ToLower(MagicSessionTypeJetBrains):
 		s.connCountJetBrains.Add(1)
 		defer s.connCountJetBrains.Add(-1)
 	case "":
@@ -513,8 +516,32 @@ func (s *Server) CreateCommand(ctx context.Context, script string, env []string)
 	if runtime.GOOS == "windows" {
 		caller = "/c"
 	}
+	name := shell
 	args := []string{caller, script}
 
+	// A preceding space is generally not idiomatic for a shebang,
+	// but in Terraform it's quite standard to use <<EOF for a multi-line
+	// string which would indent with spaces, so we accept it for user-ease.
+	if strings.HasPrefix(strings.TrimSpace(script), "#!") {
+		// If the script starts with a shebang, we should
+		// execute it directly. This is useful for running
+		// scripts that aren't executable.
+		shebang := strings.SplitN(strings.TrimSpace(script), "\n", 2)[0]
+		shebang = strings.TrimSpace(shebang)
+		shebang = strings.TrimPrefix(shebang, "#!")
+		words, err := shellquote.Split(shebang)
+		if err != nil {
+			return nil, xerrors.Errorf("split shebang: %w", err)
+		}
+		name = words[0]
+		if len(words) > 1 {
+			args = words[1:]
+		} else {
+			args = []string{}
+		}
+		args = append(args, caller, script)
+	}
+
 	// gliderlabs/ssh returns a command slice of zero
 	// when a shell is requested.
 	if len(script) == 0 {
@@ -526,7 +553,7 @@ func (s *Server) CreateCommand(ctx context.Context, script string, env []string)
 		}
 	}
 
-	cmd := pty.CommandContext(ctx, shell, args...)
+	cmd := pty.CommandContext(ctx, name, args...)
 	cmd.Dir = manifest.Directory
 
 	// If the metadata directory doesn't exist, we run the command
diff --git a/agent/agentssh/agentssh_internal_test.go b/agent/agentssh/agentssh_internal_test.go
index ba4295bdbc149..aa4cfe0236261 100644
--- a/agent/agentssh/agentssh_internal_test.go
+++ b/agent/agentssh/agentssh_internal_test.go
@@ -15,8 +15,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/pty"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/pty"
+	"github.com/coder/coder/v2/testutil"
 
 	"cdr.dev/slog/sloggers/slogtest"
 )
diff --git a/agent/agentssh/agentssh_test.go b/agent/agentssh/agentssh_test.go
index 2467f1f221d6d..b72da96e4ce43 100644
--- a/agent/agentssh/agentssh_test.go
+++ b/agent/agentssh/agentssh_test.go
@@ -6,6 +6,7 @@ import (
 	"bytes"
 	"context"
 	"net"
+	"runtime"
 	"strings"
 	"sync"
 	"testing"
@@ -20,9 +21,9 @@ import (
 
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/agent/agentssh"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/agent/agentssh"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestMain(m *testing.M) {
@@ -71,6 +72,42 @@ func TestNewServer_ServeClient(t *testing.T) {
 	<-done
 }
 
+func TestNewServer_ExecuteShebang(t *testing.T) {
+	t.Parallel()
+	if runtime.GOOS == "windows" {
+		t.Skip("bash doesn't exist on Windows")
+	}
+
+	ctx := context.Background()
+	logger := slogtest.Make(t, nil)
+	s, err := agentssh.NewServer(ctx, logger, prometheus.NewRegistry(), afero.NewMemMapFs(), 0, "")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_ = s.Close()
+	})
+	s.AgentToken = func() string { return "" }
+	s.Manifest = atomic.NewPointer(&agentsdk.Manifest{})
+
+	t.Run("Basic", func(t *testing.T) {
+		t.Parallel()
+		cmd, err := s.CreateCommand(ctx, `#!/bin/bash
+		echo test`, nil)
+		require.NoError(t, err)
+		output, err := cmd.AsExec().CombinedOutput()
+		require.NoError(t, err)
+		require.Equal(t, "test\n", string(output))
+	})
+	t.Run("Args", func(t *testing.T) {
+		t.Parallel()
+		cmd, err := s.CreateCommand(ctx, `#!/usr/bin/env bash
+		echo test`, nil)
+		require.NoError(t, err)
+		output, err := cmd.AsExec().CombinedOutput()
+		require.NoError(t, err)
+		require.Equal(t, "test\n", string(output))
+	})
+}
+
 func TestNewServer_CloseActiveConnections(t *testing.T) {
 	t.Parallel()
 
diff --git a/agent/agentssh/metrics.go b/agent/agentssh/metrics.go
index 88ee100d65d9a..9c6f2fbb3c5d5 100644
--- a/agent/agentssh/metrics.go
+++ b/agent/agentssh/metrics.go
@@ -1,6 +1,8 @@
 package agentssh
 
 import (
+	"strings"
+
 	"github.com/prometheus/client_golang/prometheus"
 )
 
@@ -78,5 +80,6 @@ func magicTypeMetricLabel(magicType string) string {
 	default:
 		magicType = "unknown"
 	}
-	return magicType
+	// Always be case insensitive
+	return strings.ToLower(magicType)
 }
diff --git a/agent/agentssh/x11_test.go b/agent/agentssh/x11_test.go
index 1fce885bab780..e5f3f62ddce74 100644
--- a/agent/agentssh/x11_test.go
+++ b/agent/agentssh/x11_test.go
@@ -19,9 +19,9 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent/agentssh"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agentssh"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestServer_X11(t *testing.T) {
diff --git a/agent/agenttest/agent.go b/agent/agenttest/agent.go
new file mode 100644
index 0000000000000..77b7c6e368822
--- /dev/null
+++ b/agent/agenttest/agent.go
@@ -0,0 +1,57 @@
+package agenttest
+
+import (
+	"context"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+)
+
+// New starts a new agent for use in tests.
+// The agent will use the provided coder URL and session token.
+// The options passed to agent.New() can be modified by passing an optional
+// variadic func(*agent.Options).
+// Returns the agent. Closing the agent is handled by the test cleanup.
+// It is the responsibility of the caller to call coderdtest.AwaitWorkspaceAgents
+// to ensure agent is connected.
+func New(t testing.TB, coderURL *url.URL, agentToken string, opts ...func(*agent.Options)) agent.Agent {
+	t.Helper()
+
+	var o agent.Options
+	log := slogtest.Make(t, nil).Leveled(slog.LevelDebug).Named("agent")
+	o.Logger = log
+
+	for _, opt := range opts {
+		opt(&o)
+	}
+
+	if o.Client == nil {
+		agentClient := agentsdk.New(coderURL)
+		agentClient.SetSessionToken(agentToken)
+		agentClient.SDK.SetLogger(log)
+		o.Client = agentClient
+	}
+
+	if o.ExchangeToken == nil {
+		o.ExchangeToken = func(_ context.Context) (string, error) {
+			return agentToken, nil
+		}
+	}
+
+	if o.LogDir == "" {
+		o.LogDir = t.TempDir()
+	}
+
+	agt := agent.New(o)
+	t.Cleanup(func() {
+		assert.NoError(t, agt.Close(), "failed to close agent during cleanup")
+	})
+
+	return agt
+}
diff --git a/agent/agenttest/client.go b/agent/agenttest/client.go
index cc9d365b5331d..22933f4fd2aa7 100644
--- a/agent/agenttest/client.go
+++ b/agent/agenttest/client.go
@@ -13,10 +13,10 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/tailnet"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func NewClient(t testing.TB,
@@ -45,7 +45,7 @@ type Client struct {
 	logger               slog.Logger
 	agentID              uuid.UUID
 	manifest             agentsdk.Manifest
-	metadata             map[string]agentsdk.PostMetadataRequest
+	metadata             map[string]agentsdk.Metadata
 	statsChan            chan *agentsdk.Stats
 	coordinator          tailnet.Coordinator
 	LastWorkspaceAgent   func()
@@ -136,20 +136,22 @@ func (c *Client) GetStartup() agentsdk.PostStartupRequest {
 	return c.startup
 }
 
-func (c *Client) GetMetadata() map[string]agentsdk.PostMetadataRequest {
+func (c *Client) GetMetadata() map[string]agentsdk.Metadata {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	return maps.Clone(c.metadata)
 }
 
-func (c *Client) PostMetadata(ctx context.Context, key string, req agentsdk.PostMetadataRequest) error {
+func (c *Client) PostMetadata(ctx context.Context, req agentsdk.PostMetadataRequest) error {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	if c.metadata == nil {
-		c.metadata = make(map[string]agentsdk.PostMetadataRequest)
+		c.metadata = make(map[string]agentsdk.Metadata)
+	}
+	for _, md := range req.Metadata {
+		c.metadata[md.Key] = md
+		c.logger.Debug(ctx, "post metadata", slog.F("key", md.Key), slog.F("md", md))
 	}
-	c.metadata[key] = req
-	c.logger.Debug(ctx, "post metadata", slog.F("key", key), slog.F("req", req))
 	return nil
 }
 
diff --git a/agent/api.go b/agent/api.go
index c2cea963fbe66..0886b35bc0db1 100644
--- a/agent/api.go
+++ b/agent/api.go
@@ -5,10 +5,10 @@ import (
 	"sync"
 	"time"
 
-	"github.com/go-chi/chi"
+	"github.com/go-chi/chi/v5"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (a *agent) apiHandler() http.Handler {
diff --git a/agent/apphealth.go b/agent/apphealth.go
index 3d93b6c85ac26..c32a9a6339668 100644
--- a/agent/apphealth.go
+++ b/agent/apphealth.go
@@ -10,8 +10,8 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
 	"github.com/coder/retry"
 )
 
diff --git a/agent/apphealth_test.go b/agent/apphealth_test.go
index 20c0d152760fc..748a88356e2aa 100644
--- a/agent/apphealth_test.go
+++ b/agent/apphealth_test.go
@@ -13,11 +13,11 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestAppHealth_Healthy(t *testing.T) {
diff --git a/agent/metrics.go b/agent/metrics.go
index dc5fb6c018474..ddbe6f49beed1 100644
--- a/agent/metrics.go
+++ b/agent/metrics.go
@@ -11,7 +11,7 @@ import (
 
 	"cdr.dev/slog"
 
-	"github.com/coder/coder/codersdk/agentsdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
 )
 
 type agentMetrics struct {
diff --git a/agent/ports_supported.go b/agent/ports_supported.go
index 7f9d30f3e9d05..81d177ee63de9 100644
--- a/agent/ports_supported.go
+++ b/agent/ports_supported.go
@@ -8,7 +8,7 @@ import (
 	"github.com/cakturk/go-netstat/netstat"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (lp *listeningPortsHandler) getListeningPorts() ([]codersdk.WorkspaceAgentListeningPort, error) {
diff --git a/agent/ports_unsupported.go b/agent/ports_unsupported.go
index 0ab26ac299736..0af99d1dc79b4 100644
--- a/agent/ports_unsupported.go
+++ b/agent/ports_unsupported.go
@@ -2,7 +2,7 @@
 
 package agent
 
-import "github.com/coder/coder/codersdk"
+import "github.com/coder/coder/v2/codersdk"
 
 func (lp *listeningPortsHandler) getListeningPorts() ([]codersdk.WorkspaceAgentListeningPort, error) {
 	// Can't scan for ports on non-linux or non-windows_amd64 systems at the
diff --git a/agent/proto/agent.pb.go b/agent/proto/agent.pb.go
new file mode 100644
index 0000000000000..fb75710f1cd56
--- /dev/null
+++ b/agent/proto/agent.pb.go
@@ -0,0 +1,2453 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        v4.23.3
+// source: agent/proto/agent.proto
+
+package proto
+
+import (
+	proto "github.com/coder/coder/v2/tailnet/proto"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type AppHealth int32
+
+const (
+	AppHealth_APP_HEALTH_UNSPECIFIED AppHealth = 0
+	AppHealth_DISABLED               AppHealth = 1
+	AppHealth_INITIALIZING           AppHealth = 2
+	AppHealth_HEALTHY                AppHealth = 3
+	AppHealth_UNHEALTHY              AppHealth = 4
+)
+
+// Enum value maps for AppHealth.
+var (
+	AppHealth_name = map[int32]string{
+		0: "APP_HEALTH_UNSPECIFIED",
+		1: "DISABLED",
+		2: "INITIALIZING",
+		3: "HEALTHY",
+		4: "UNHEALTHY",
+	}
+	AppHealth_value = map[string]int32{
+		"APP_HEALTH_UNSPECIFIED": 0,
+		"DISABLED":               1,
+		"INITIALIZING":           2,
+		"HEALTHY":                3,
+		"UNHEALTHY":              4,
+	}
+)
+
+func (x AppHealth) Enum() *AppHealth {
+	p := new(AppHealth)
+	*p = x
+	return p
+}
+
+func (x AppHealth) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (AppHealth) Descriptor() protoreflect.EnumDescriptor {
+	return file_agent_proto_agent_proto_enumTypes[0].Descriptor()
+}
+
+func (AppHealth) Type() protoreflect.EnumType {
+	return &file_agent_proto_agent_proto_enumTypes[0]
+}
+
+func (x AppHealth) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use AppHealth.Descriptor instead.
+func (AppHealth) EnumDescriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{0}
+}
+
+type WorkspaceApp_SharingLevel int32
+
+const (
+	WorkspaceApp_SHARING_LEVEL_UNSPECIFIED WorkspaceApp_SharingLevel = 0
+	WorkspaceApp_OWNER                     WorkspaceApp_SharingLevel = 1
+	WorkspaceApp_AUTHENTICATED             WorkspaceApp_SharingLevel = 2
+	WorkspaceApp_PUBLIC                    WorkspaceApp_SharingLevel = 3
+)
+
+// Enum value maps for WorkspaceApp_SharingLevel.
+var (
+	WorkspaceApp_SharingLevel_name = map[int32]string{
+		0: "SHARING_LEVEL_UNSPECIFIED",
+		1: "OWNER",
+		2: "AUTHENTICATED",
+		3: "PUBLIC",
+	}
+	WorkspaceApp_SharingLevel_value = map[string]int32{
+		"SHARING_LEVEL_UNSPECIFIED": 0,
+		"OWNER":                     1,
+		"AUTHENTICATED":             2,
+		"PUBLIC":                    3,
+	}
+)
+
+func (x WorkspaceApp_SharingLevel) Enum() *WorkspaceApp_SharingLevel {
+	p := new(WorkspaceApp_SharingLevel)
+	*p = x
+	return p
+}
+
+func (x WorkspaceApp_SharingLevel) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (WorkspaceApp_SharingLevel) Descriptor() protoreflect.EnumDescriptor {
+	return file_agent_proto_agent_proto_enumTypes[1].Descriptor()
+}
+
+func (WorkspaceApp_SharingLevel) Type() protoreflect.EnumType {
+	return &file_agent_proto_agent_proto_enumTypes[1]
+}
+
+func (x WorkspaceApp_SharingLevel) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use WorkspaceApp_SharingLevel.Descriptor instead.
+func (WorkspaceApp_SharingLevel) EnumDescriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type WorkspaceApp_Health int32
+
+const (
+	WorkspaceApp_HEALTH_UNSPECIFIED WorkspaceApp_Health = 0
+	WorkspaceApp_DISABLED           WorkspaceApp_Health = 1
+	WorkspaceApp_INITIALIZING       WorkspaceApp_Health = 2
+	WorkspaceApp_HEALTHY            WorkspaceApp_Health = 3
+	WorkspaceApp_UNHEALTHY          WorkspaceApp_Health = 4
+)
+
+// Enum value maps for WorkspaceApp_Health.
+var (
+	WorkspaceApp_Health_name = map[int32]string{
+		0: "HEALTH_UNSPECIFIED",
+		1: "DISABLED",
+		2: "INITIALIZING",
+		3: "HEALTHY",
+		4: "UNHEALTHY",
+	}
+	WorkspaceApp_Health_value = map[string]int32{
+		"HEALTH_UNSPECIFIED": 0,
+		"DISABLED":           1,
+		"INITIALIZING":       2,
+		"HEALTHY":            3,
+		"UNHEALTHY":          4,
+	}
+)
+
+func (x WorkspaceApp_Health) Enum() *WorkspaceApp_Health {
+	p := new(WorkspaceApp_Health)
+	*p = x
+	return p
+}
+
+func (x WorkspaceApp_Health) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (WorkspaceApp_Health) Descriptor() protoreflect.EnumDescriptor {
+	return file_agent_proto_agent_proto_enumTypes[2].Descriptor()
+}
+
+func (WorkspaceApp_Health) Type() protoreflect.EnumType {
+	return &file_agent_proto_agent_proto_enumTypes[2]
+}
+
+func (x WorkspaceApp_Health) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use WorkspaceApp_Health.Descriptor instead.
+func (WorkspaceApp_Health) EnumDescriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{0, 1}
+}
+
+type Stats_Metric_Type int32
+
+const (
+	Stats_Metric_TYPE_UNSPECIFIED Stats_Metric_Type = 0
+	Stats_Metric_COUNTER          Stats_Metric_Type = 1
+	Stats_Metric_GAUGE            Stats_Metric_Type = 2
+)
+
+// Enum value maps for Stats_Metric_Type.
+var (
+	Stats_Metric_Type_name = map[int32]string{
+		0: "TYPE_UNSPECIFIED",
+		1: "COUNTER",
+		2: "GAUGE",
+	}
+	Stats_Metric_Type_value = map[string]int32{
+		"TYPE_UNSPECIFIED": 0,
+		"COUNTER":          1,
+		"GAUGE":            2,
+	}
+)
+
+func (x Stats_Metric_Type) Enum() *Stats_Metric_Type {
+	p := new(Stats_Metric_Type)
+	*p = x
+	return p
+}
+
+func (x Stats_Metric_Type) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Stats_Metric_Type) Descriptor() protoreflect.EnumDescriptor {
+	return file_agent_proto_agent_proto_enumTypes[3].Descriptor()
+}
+
+func (Stats_Metric_Type) Type() protoreflect.EnumType {
+	return &file_agent_proto_agent_proto_enumTypes[3]
+}
+
+func (x Stats_Metric_Type) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Stats_Metric_Type.Descriptor instead.
+func (Stats_Metric_Type) EnumDescriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{5, 1, 0}
+}
+
+type Lifecycle_State int32
+
+const (
+	Lifecycle_STATE_UNSPECIFIED Lifecycle_State = 0
+	Lifecycle_CREATED           Lifecycle_State = 1
+	Lifecycle_STARTED           Lifecycle_State = 2
+	Lifecycle_START_TIMEOUT     Lifecycle_State = 3
+	Lifecycle_START_ERROR       Lifecycle_State = 4
+	Lifecycle_READY             Lifecycle_State = 5
+	Lifecycle_SHUTTING_DOWN     Lifecycle_State = 6
+	Lifecycle_SHUTDOWN_TIMEOUT  Lifecycle_State = 7
+	Lifecycle_SHUTDOWN_ERROR    Lifecycle_State = 8
+	Lifecycle_OFF               Lifecycle_State = 9
+)
+
+// Enum value maps for Lifecycle_State.
+var (
+	Lifecycle_State_name = map[int32]string{
+		0: "STATE_UNSPECIFIED",
+		1: "CREATED",
+		2: "STARTED",
+		3: "START_TIMEOUT",
+		4: "START_ERROR",
+		5: "READY",
+		6: "SHUTTING_DOWN",
+		7: "SHUTDOWN_TIMEOUT",
+		8: "SHUTDOWN_ERROR",
+		9: "OFF",
+	}
+	Lifecycle_State_value = map[string]int32{
+		"STATE_UNSPECIFIED": 0,
+		"CREATED":           1,
+		"STARTED":           2,
+		"START_TIMEOUT":     3,
+		"START_ERROR":       4,
+		"READY":             5,
+		"SHUTTING_DOWN":     6,
+		"SHUTDOWN_TIMEOUT":  7,
+		"SHUTDOWN_ERROR":    8,
+		"OFF":               9,
+	}
+)
+
+func (x Lifecycle_State) Enum() *Lifecycle_State {
+	p := new(Lifecycle_State)
+	*p = x
+	return p
+}
+
+func (x Lifecycle_State) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Lifecycle_State) Descriptor() protoreflect.EnumDescriptor {
+	return file_agent_proto_agent_proto_enumTypes[4].Descriptor()
+}
+
+func (Lifecycle_State) Type() protoreflect.EnumType {
+	return &file_agent_proto_agent_proto_enumTypes[4]
+}
+
+func (x Lifecycle_State) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Lifecycle_State.Descriptor instead.
+func (Lifecycle_State) EnumDescriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{8, 0}
+}
+
+type Log_Level int32
+
+const (
+	Log_LEVEL_UNSPECIFIED Log_Level = 0
+	Log_TRACE             Log_Level = 1
+	Log_DEBUG             Log_Level = 2
+	Log_INFO              Log_Level = 3
+	Log_WARN              Log_Level = 4
+	Log_ERROR             Log_Level = 5
+)
+
+// Enum value maps for Log_Level.
+var (
+	Log_Level_name = map[int32]string{
+		0: "LEVEL_UNSPECIFIED",
+		1: "TRACE",
+		2: "DEBUG",
+		3: "INFO",
+		4: "WARN",
+		5: "ERROR",
+	}
+	Log_Level_value = map[string]int32{
+		"LEVEL_UNSPECIFIED": 0,
+		"TRACE":             1,
+		"DEBUG":             2,
+		"INFO":              3,
+		"WARN":              4,
+		"ERROR":             5,
+	}
+)
+
+func (x Log_Level) Enum() *Log_Level {
+	p := new(Log_Level)
+	*p = x
+	return p
+}
+
+func (x Log_Level) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Log_Level) Descriptor() protoreflect.EnumDescriptor {
+	return file_agent_proto_agent_proto_enumTypes[5].Descriptor()
+}
+
+func (Log_Level) Type() protoreflect.EnumType {
+	return &file_agent_proto_agent_proto_enumTypes[5]
+}
+
+func (x Log_Level) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Log_Level.Descriptor instead.
+func (Log_Level) EnumDescriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{17, 0}
+}
+
+type WorkspaceApp struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Uuid          []byte                    `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	Url           string                    `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
+	External      bool                      `protobuf:"varint,3,opt,name=external,proto3" json:"external,omitempty"`
+	Slug          string                    `protobuf:"bytes,4,opt,name=slug,proto3" json:"slug,omitempty"`
+	DisplayName   string                    `protobuf:"bytes,5,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	Command       string                    `protobuf:"bytes,6,opt,name=command,proto3" json:"command,omitempty"`
+	Icon          string                    `protobuf:"bytes,7,opt,name=icon,proto3" json:"icon,omitempty"`
+	Subdomain     bool                      `protobuf:"varint,8,opt,name=subdomain,proto3" json:"subdomain,omitempty"`
+	SubdomainName string                    `protobuf:"bytes,9,opt,name=subdomain_name,json=subdomainName,proto3" json:"subdomain_name,omitempty"`
+	SharingLevel  WorkspaceApp_SharingLevel `protobuf:"varint,10,opt,name=sharing_level,json=sharingLevel,proto3,enum=coder.agent.v2.WorkspaceApp_SharingLevel" json:"sharing_level,omitempty"`
+	Healthcheck   *WorkspaceApp_HealthCheck `protobuf:"bytes,11,opt,name=healthcheck,proto3" json:"healthcheck,omitempty"`
+	Health        WorkspaceApp_Health       `protobuf:"varint,12,opt,name=health,proto3,enum=coder.agent.v2.WorkspaceApp_Health" json:"health,omitempty"`
+}
+
+func (x *WorkspaceApp) Reset() {
+	*x = WorkspaceApp{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WorkspaceApp) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WorkspaceApp) ProtoMessage() {}
+
+func (x *WorkspaceApp) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WorkspaceApp.ProtoReflect.Descriptor instead.
+func (*WorkspaceApp) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *WorkspaceApp) GetUuid() []byte {
+	if x != nil {
+		return x.Uuid
+	}
+	return nil
+}
+
+func (x *WorkspaceApp) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+func (x *WorkspaceApp) GetExternal() bool {
+	if x != nil {
+		return x.External
+	}
+	return false
+}
+
+func (x *WorkspaceApp) GetSlug() string {
+	if x != nil {
+		return x.Slug
+	}
+	return ""
+}
+
+func (x *WorkspaceApp) GetDisplayName() string {
+	if x != nil {
+		return x.DisplayName
+	}
+	return ""
+}
+
+func (x *WorkspaceApp) GetCommand() string {
+	if x != nil {
+		return x.Command
+	}
+	return ""
+}
+
+func (x *WorkspaceApp) GetIcon() string {
+	if x != nil {
+		return x.Icon
+	}
+	return ""
+}
+
+func (x *WorkspaceApp) GetSubdomain() bool {
+	if x != nil {
+		return x.Subdomain
+	}
+	return false
+}
+
+func (x *WorkspaceApp) GetSubdomainName() string {
+	if x != nil {
+		return x.SubdomainName
+	}
+	return ""
+}
+
+func (x *WorkspaceApp) GetSharingLevel() WorkspaceApp_SharingLevel {
+	if x != nil {
+		return x.SharingLevel
+	}
+	return WorkspaceApp_SHARING_LEVEL_UNSPECIFIED
+}
+
+func (x *WorkspaceApp) GetHealthcheck() *WorkspaceApp_HealthCheck {
+	if x != nil {
+		return x.Healthcheck
+	}
+	return nil
+}
+
+func (x *WorkspaceApp) GetHealth() WorkspaceApp_Health {
+	if x != nil {
+		return x.Health
+	}
+	return WorkspaceApp_HEALTH_UNSPECIFIED
+}
+
+type Manifest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	GitAuthConfigs     uint32          `protobuf:"varint,1,opt,name=git_auth_configs,json=gitAuthConfigs,proto3" json:"git_auth_configs,omitempty"`
+	VsCodePortProxyUri string          `protobuf:"bytes,2,opt,name=vs_code_port_proxy_uri,json=vsCodePortProxyUri,proto3" json:"vs_code_port_proxy_uri,omitempty"`
+	Apps               []*WorkspaceApp `protobuf:"bytes,3,rep,name=apps,proto3" json:"apps,omitempty"`
+	DerpMap            *proto.DERPMap  `protobuf:"bytes,4,opt,name=derp_map,json=derpMap,proto3" json:"derp_map,omitempty"`
+}
+
+func (x *Manifest) Reset() {
+	*x = Manifest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Manifest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Manifest) ProtoMessage() {}
+
+func (x *Manifest) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Manifest.ProtoReflect.Descriptor instead.
+func (*Manifest) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *Manifest) GetGitAuthConfigs() uint32 {
+	if x != nil {
+		return x.GitAuthConfigs
+	}
+	return 0
+}
+
+func (x *Manifest) GetVsCodePortProxyUri() string {
+	if x != nil {
+		return x.VsCodePortProxyUri
+	}
+	return ""
+}
+
+func (x *Manifest) GetApps() []*WorkspaceApp {
+	if x != nil {
+		return x.Apps
+	}
+	return nil
+}
+
+func (x *Manifest) GetDerpMap() *proto.DERPMap {
+	if x != nil {
+		return x.DerpMap
+	}
+	return nil
+}
+
+type GetManifestRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *GetManifestRequest) Reset() {
+	*x = GetManifestRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetManifestRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetManifestRequest) ProtoMessage() {}
+
+func (x *GetManifestRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetManifestRequest.ProtoReflect.Descriptor instead.
+func (*GetManifestRequest) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{2}
+}
+
+type ServiceBanner struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Enabled         bool   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	Message         string `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
+	BackgroundColor string `protobuf:"bytes,3,opt,name=background_color,json=backgroundColor,proto3" json:"background_color,omitempty"`
+}
+
+func (x *ServiceBanner) Reset() {
+	*x = ServiceBanner{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceBanner) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceBanner) ProtoMessage() {}
+
+func (x *ServiceBanner) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceBanner.ProtoReflect.Descriptor instead.
+func (*ServiceBanner) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ServiceBanner) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *ServiceBanner) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
+func (x *ServiceBanner) GetBackgroundColor() string {
+	if x != nil {
+		return x.BackgroundColor
+	}
+	return ""
+}
+
+type GetServiceBannerRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *GetServiceBannerRequest) Reset() {
+	*x = GetServiceBannerRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetServiceBannerRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetServiceBannerRequest) ProtoMessage() {}
+
+func (x *GetServiceBannerRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetServiceBannerRequest.ProtoReflect.Descriptor instead.
+func (*GetServiceBannerRequest) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{4}
+}
+
+type Stats struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// ConnectionsByProto is a count of connections by protocol.
+	ConnectionsByProto map[string]int64 `protobuf:"bytes,1,rep,name=connections_by_proto,json=connectionsByProto,proto3" json:"connections_by_proto,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"varint,2,opt,name=value,proto3"`
+	// ConnectionCount is the number of connections received by an agent.
+	ConnectionCount int64 `protobuf:"varint,2,opt,name=connection_count,json=connectionCount,proto3" json:"connection_count,omitempty"`
+	// ConnectionMedianLatencyMS is the median latency of all connections in milliseconds.
+	ConnectionMedianLatencyMs float64 `protobuf:"fixed64,3,opt,name=connection_median_latency_ms,json=connectionMedianLatencyMs,proto3" json:"connection_median_latency_ms,omitempty"`
+	// RxPackets is the number of received packets.
+	RxPackets int64 `protobuf:"varint,4,opt,name=rx_packets,json=rxPackets,proto3" json:"rx_packets,omitempty"`
+	// RxBytes is the number of received bytes.
+	RxBytes int64 `protobuf:"varint,5,opt,name=rx_bytes,json=rxBytes,proto3" json:"rx_bytes,omitempty"`
+	// TxPackets is the number of transmitted bytes.
+	TxPackets int64 `protobuf:"varint,6,opt,name=tx_packets,json=txPackets,proto3" json:"tx_packets,omitempty"`
+	// TxBytes is the number of transmitted bytes.
+	TxBytes int64 `protobuf:"varint,7,opt,name=tx_bytes,json=txBytes,proto3" json:"tx_bytes,omitempty"`
+	// SessionCountVSCode is the number of connections received by an agent
+	// that are from our VS Code extension.
+	SessionCountVscode int64 `protobuf:"varint,8,opt,name=session_count_vscode,json=sessionCountVscode,proto3" json:"session_count_vscode,omitempty"`
+	// SessionCountJetBrains is the number of connections received by an agent
+	// that are from our JetBrains extension.
+	SessionCountJetbrains int64 `protobuf:"varint,9,opt,name=session_count_jetbrains,json=sessionCountJetbrains,proto3" json:"session_count_jetbrains,omitempty"`
+	// SessionCountReconnectingPTY is the number of connections received by an agent
+	// that are from the reconnecting web terminal.
+	SessionCountReconnectingPty int64 `protobuf:"varint,10,opt,name=session_count_reconnecting_pty,json=sessionCountReconnectingPty,proto3" json:"session_count_reconnecting_pty,omitempty"`
+	// SessionCountSSH is the number of connections received by an agent
+	// that are normal, non-tagged SSH sessions.
+	SessionCountSsh int64 `protobuf:"varint,11,opt,name=session_count_ssh,json=sessionCountSsh,proto3" json:"session_count_ssh,omitempty"`
+}
+
+func (x *Stats) Reset() {
+	*x = Stats{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Stats) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Stats) ProtoMessage() {}
+
+func (x *Stats) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Stats.ProtoReflect.Descriptor instead.
+func (*Stats) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *Stats) GetConnectionsByProto() map[string]int64 {
+	if x != nil {
+		return x.ConnectionsByProto
+	}
+	return nil
+}
+
+func (x *Stats) GetConnectionCount() int64 {
+	if x != nil {
+		return x.ConnectionCount
+	}
+	return 0
+}
+
+func (x *Stats) GetConnectionMedianLatencyMs() float64 {
+	if x != nil {
+		return x.ConnectionMedianLatencyMs
+	}
+	return 0
+}
+
+func (x *Stats) GetRxPackets() int64 {
+	if x != nil {
+		return x.RxPackets
+	}
+	return 0
+}
+
+func (x *Stats) GetRxBytes() int64 {
+	if x != nil {
+		return x.RxBytes
+	}
+	return 0
+}
+
+func (x *Stats) GetTxPackets() int64 {
+	if x != nil {
+		return x.TxPackets
+	}
+	return 0
+}
+
+func (x *Stats) GetTxBytes() int64 {
+	if x != nil {
+		return x.TxBytes
+	}
+	return 0
+}
+
+func (x *Stats) GetSessionCountVscode() int64 {
+	if x != nil {
+		return x.SessionCountVscode
+	}
+	return 0
+}
+
+func (x *Stats) GetSessionCountJetbrains() int64 {
+	if x != nil {
+		return x.SessionCountJetbrains
+	}
+	return 0
+}
+
+func (x *Stats) GetSessionCountReconnectingPty() int64 {
+	if x != nil {
+		return x.SessionCountReconnectingPty
+	}
+	return 0
+}
+
+func (x *Stats) GetSessionCountSsh() int64 {
+	if x != nil {
+		return x.SessionCountSsh
+	}
+	return 0
+}
+
+type UpdateStatsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Stats *Stats `protobuf:"bytes,1,opt,name=stats,proto3" json:"stats,omitempty"`
+}
+
+func (x *UpdateStatsRequest) Reset() {
+	*x = UpdateStatsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateStatsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateStatsRequest) ProtoMessage() {}
+
+func (x *UpdateStatsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateStatsRequest.ProtoReflect.Descriptor instead.
+func (*UpdateStatsRequest) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *UpdateStatsRequest) GetStats() *Stats {
+	if x != nil {
+		return x.Stats
+	}
+	return nil
+}
+
+type UpdateStatsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ReportIntervalNanoseconds *durationpb.Duration `protobuf:"bytes,1,opt,name=report_interval_nanoseconds,json=reportIntervalNanoseconds,proto3" json:"report_interval_nanoseconds,omitempty"`
+}
+
+func (x *UpdateStatsResponse) Reset() {
+	*x = UpdateStatsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateStatsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateStatsResponse) ProtoMessage() {}
+
+func (x *UpdateStatsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateStatsResponse.ProtoReflect.Descriptor instead.
+func (*UpdateStatsResponse) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *UpdateStatsResponse) GetReportIntervalNanoseconds() *durationpb.Duration {
+	if x != nil {
+		return x.ReportIntervalNanoseconds
+	}
+	return nil
+}
+
+type Lifecycle struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	State Lifecycle_State `protobuf:"varint,1,opt,name=state,proto3,enum=coder.agent.v2.Lifecycle_State" json:"state,omitempty"`
+}
+
+func (x *Lifecycle) Reset() {
+	*x = Lifecycle{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Lifecycle) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Lifecycle) ProtoMessage() {}
+
+func (x *Lifecycle) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Lifecycle.ProtoReflect.Descriptor instead.
+func (*Lifecycle) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *Lifecycle) GetState() Lifecycle_State {
+	if x != nil {
+		return x.State
+	}
+	return Lifecycle_STATE_UNSPECIFIED
+}
+
+type UpdateLifecycleRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Lifecycle *Lifecycle `protobuf:"bytes,1,opt,name=lifecycle,proto3" json:"lifecycle,omitempty"`
+}
+
+func (x *UpdateLifecycleRequest) Reset() {
+	*x = UpdateLifecycleRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateLifecycleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateLifecycleRequest) ProtoMessage() {}
+
+func (x *UpdateLifecycleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateLifecycleRequest.ProtoReflect.Descriptor instead.
+func (*UpdateLifecycleRequest) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *UpdateLifecycleRequest) GetLifecycle() *Lifecycle {
+	if x != nil {
+		return x.Lifecycle
+	}
+	return nil
+}
+
+type BatchUpdateAppHealthRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Updates []*BatchUpdateAppHealthRequest_HealthUpdate `protobuf:"bytes,1,rep,name=updates,proto3" json:"updates,omitempty"`
+}
+
+func (x *BatchUpdateAppHealthRequest) Reset() {
+	*x = BatchUpdateAppHealthRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BatchUpdateAppHealthRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchUpdateAppHealthRequest) ProtoMessage() {}
+
+func (x *BatchUpdateAppHealthRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchUpdateAppHealthRequest.ProtoReflect.Descriptor instead.
+func (*BatchUpdateAppHealthRequest) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *BatchUpdateAppHealthRequest) GetUpdates() []*BatchUpdateAppHealthRequest_HealthUpdate {
+	if x != nil {
+		return x.Updates
+	}
+	return nil
+}
+
+type BatchUpdateAppHealthResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *BatchUpdateAppHealthResponse) Reset() {
+	*x = BatchUpdateAppHealthResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BatchUpdateAppHealthResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchUpdateAppHealthResponse) ProtoMessage() {}
+
+func (x *BatchUpdateAppHealthResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchUpdateAppHealthResponse.ProtoReflect.Descriptor instead.
+func (*BatchUpdateAppHealthResponse) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{11}
+}
+
+type Startup struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Version           string   `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
+	ExpandedDirectory string   `protobuf:"bytes,2,opt,name=expanded_directory,json=expandedDirectory,proto3" json:"expanded_directory,omitempty"`
+	Subsystems        []string `protobuf:"bytes,3,rep,name=subsystems,proto3" json:"subsystems,omitempty"`
+}
+
+func (x *Startup) Reset() {
+	*x = Startup{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Startup) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Startup) ProtoMessage() {}
+
+func (x *Startup) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Startup.ProtoReflect.Descriptor instead.
+func (*Startup) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *Startup) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *Startup) GetExpandedDirectory() string {
+	if x != nil {
+		return x.ExpandedDirectory
+	}
+	return ""
+}
+
+func (x *Startup) GetSubsystems() []string {
+	if x != nil {
+		return x.Subsystems
+	}
+	return nil
+}
+
+type UpdateStartupRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Startup *Startup `protobuf:"bytes,1,opt,name=startup,proto3" json:"startup,omitempty"`
+}
+
+func (x *UpdateStartupRequest) Reset() {
+	*x = UpdateStartupRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateStartupRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateStartupRequest) ProtoMessage() {}
+
+func (x *UpdateStartupRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateStartupRequest.ProtoReflect.Descriptor instead.
+func (*UpdateStartupRequest) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *UpdateStartupRequest) GetStartup() *Startup {
+	if x != nil {
+		return x.Startup
+	}
+	return nil
+}
+
+type Metadata struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key         string                 `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	CollectedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=collected_at,json=collectedAt,proto3" json:"collected_at,omitempty"`
+	Age         int64                  `protobuf:"varint,3,opt,name=age,proto3" json:"age,omitempty"`
+	Value       string                 `protobuf:"bytes,4,opt,name=value,proto3" json:"value,omitempty"`
+	Error       string                 `protobuf:"bytes,5,opt,name=error,proto3" json:"error,omitempty"`
+}
+
+func (x *Metadata) Reset() {
+	*x = Metadata{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Metadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Metadata) ProtoMessage() {}
+
+func (x *Metadata) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Metadata.ProtoReflect.Descriptor instead.
+func (*Metadata) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *Metadata) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *Metadata) GetCollectedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.CollectedAt
+	}
+	return nil
+}
+
+func (x *Metadata) GetAge() int64 {
+	if x != nil {
+		return x.Age
+	}
+	return 0
+}
+
+func (x *Metadata) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+func (x *Metadata) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
+type BatchUpdateMetadataRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Metadata []*Metadata `protobuf:"bytes,2,rep,name=metadata,proto3" json:"metadata,omitempty"`
+}
+
+func (x *BatchUpdateMetadataRequest) Reset() {
+	*x = BatchUpdateMetadataRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BatchUpdateMetadataRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchUpdateMetadataRequest) ProtoMessage() {}
+
+func (x *BatchUpdateMetadataRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchUpdateMetadataRequest.ProtoReflect.Descriptor instead.
+func (*BatchUpdateMetadataRequest) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *BatchUpdateMetadataRequest) GetMetadata() []*Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+type BatchUpdateMetadataResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *BatchUpdateMetadataResponse) Reset() {
+	*x = BatchUpdateMetadataResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BatchUpdateMetadataResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchUpdateMetadataResponse) ProtoMessage() {}
+
+func (x *BatchUpdateMetadataResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchUpdateMetadataResponse.ProtoReflect.Descriptor instead.
+func (*BatchUpdateMetadataResponse) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{16}
+}
+
+type Log struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	Output    string                 `protobuf:"bytes,2,opt,name=output,proto3" json:"output,omitempty"`
+	Level     Log_Level              `protobuf:"varint,3,opt,name=level,proto3,enum=coder.agent.v2.Log_Level" json:"level,omitempty"`
+}
+
+func (x *Log) Reset() {
+	*x = Log{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Log) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Log) ProtoMessage() {}
+
+func (x *Log) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Log.ProtoReflect.Descriptor instead.
+func (*Log) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *Log) GetCreatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return nil
+}
+
+func (x *Log) GetOutput() string {
+	if x != nil {
+		return x.Output
+	}
+	return ""
+}
+
+func (x *Log) GetLevel() Log_Level {
+	if x != nil {
+		return x.Level
+	}
+	return Log_LEVEL_UNSPECIFIED
+}
+
+type BatchCreateLogsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	SourceId []byte `protobuf:"bytes,1,opt,name=source_id,json=sourceId,proto3" json:"source_id,omitempty"`
+	Logs     []*Log `protobuf:"bytes,2,rep,name=logs,proto3" json:"logs,omitempty"`
+}
+
+func (x *BatchCreateLogsRequest) Reset() {
+	*x = BatchCreateLogsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BatchCreateLogsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchCreateLogsRequest) ProtoMessage() {}
+
+func (x *BatchCreateLogsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchCreateLogsRequest.ProtoReflect.Descriptor instead.
+func (*BatchCreateLogsRequest) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *BatchCreateLogsRequest) GetSourceId() []byte {
+	if x != nil {
+		return x.SourceId
+	}
+	return nil
+}
+
+func (x *BatchCreateLogsRequest) GetLogs() []*Log {
+	if x != nil {
+		return x.Logs
+	}
+	return nil
+}
+
+type BatchCreateLogsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *BatchCreateLogsResponse) Reset() {
+	*x = BatchCreateLogsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BatchCreateLogsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchCreateLogsResponse) ProtoMessage() {}
+
+func (x *BatchCreateLogsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchCreateLogsResponse.ProtoReflect.Descriptor instead.
+func (*BatchCreateLogsResponse) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{19}
+}
+
+type WorkspaceApp_HealthCheck struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Url       string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
+	Interval  int32  `protobuf:"varint,2,opt,name=interval,proto3" json:"interval,omitempty"`
+	Threshold int32  `protobuf:"varint,3,opt,name=threshold,proto3" json:"threshold,omitempty"`
+}
+
+func (x *WorkspaceApp_HealthCheck) Reset() {
+	*x = WorkspaceApp_HealthCheck{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WorkspaceApp_HealthCheck) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WorkspaceApp_HealthCheck) ProtoMessage() {}
+
+func (x *WorkspaceApp_HealthCheck) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WorkspaceApp_HealthCheck.ProtoReflect.Descriptor instead.
+func (*WorkspaceApp_HealthCheck) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *WorkspaceApp_HealthCheck) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+func (x *WorkspaceApp_HealthCheck) GetInterval() int32 {
+	if x != nil {
+		return x.Interval
+	}
+	return 0
+}
+
+func (x *WorkspaceApp_HealthCheck) GetThreshold() int32 {
+	if x != nil {
+		return x.Threshold
+	}
+	return 0
+}
+
+type Stats_Metric struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name   string            `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Type   Stats_Metric_Type `protobuf:"varint,2,opt,name=type,proto3,enum=coder.agent.v2.Stats_Metric_Type" json:"type,omitempty"`
+	Value  float64           `protobuf:"fixed64,3,opt,name=value,proto3" json:"value,omitempty"`
+	Labels map[string]string `protobuf:"bytes,4,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *Stats_Metric) Reset() {
+	*x = Stats_Metric{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[22]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Stats_Metric) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Stats_Metric) ProtoMessage() {}
+
+func (x *Stats_Metric) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[22]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Stats_Metric.ProtoReflect.Descriptor instead.
+func (*Stats_Metric) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{5, 1}
+}
+
+func (x *Stats_Metric) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Stats_Metric) GetType() Stats_Metric_Type {
+	if x != nil {
+		return x.Type
+	}
+	return Stats_Metric_TYPE_UNSPECIFIED
+}
+
+func (x *Stats_Metric) GetValue() float64 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+func (x *Stats_Metric) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+type BatchUpdateAppHealthRequest_HealthUpdate struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Uuid   []byte    `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	Health AppHealth `protobuf:"varint,2,opt,name=health,proto3,enum=coder.agent.v2.AppHealth" json:"health,omitempty"`
+}
+
+func (x *BatchUpdateAppHealthRequest_HealthUpdate) Reset() {
+	*x = BatchUpdateAppHealthRequest_HealthUpdate{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_agent_proto_agent_proto_msgTypes[24]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BatchUpdateAppHealthRequest_HealthUpdate) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BatchUpdateAppHealthRequest_HealthUpdate) ProtoMessage() {}
+
+func (x *BatchUpdateAppHealthRequest_HealthUpdate) ProtoReflect() protoreflect.Message {
+	mi := &file_agent_proto_agent_proto_msgTypes[24]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BatchUpdateAppHealthRequest_HealthUpdate.ProtoReflect.Descriptor instead.
+func (*BatchUpdateAppHealthRequest_HealthUpdate) Descriptor() ([]byte, []int) {
+	return file_agent_proto_agent_proto_rawDescGZIP(), []int{10, 0}
+}
+
+func (x *BatchUpdateAppHealthRequest_HealthUpdate) GetUuid() []byte {
+	if x != nil {
+		return x.Uuid
+	}
+	return nil
+}
+
+func (x *BatchUpdateAppHealthRequest_HealthUpdate) GetHealth() AppHealth {
+	if x != nil {
+		return x.Health
+	}
+	return AppHealth_APP_HEALTH_UNSPECIFIED
+}
+
+var File_agent_proto_agent_proto protoreflect.FileDescriptor
+
+var file_agent_proto_agent_proto_rawDesc = []byte{
+	0x0a, 0x17, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x61, 0x67,
+	0x65, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0e, 0x63, 0x6f, 0x64, 0x65, 0x72,
+	0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x1a, 0x1b, 0x74, 0x61, 0x69, 0x6c, 0x6e,
+	0x65, 0x74, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xe5, 0x05, 0x0a, 0x0c, 0x57, 0x6f, 0x72, 0x6b,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x41, 0x70, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x75, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x75, 0x75, 0x69, 0x64, 0x12, 0x10, 0x0a, 0x03,
+	0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x1a,
+	0x0a, 0x08, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x08, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x6c,
+	0x75, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x73, 0x6c, 0x75, 0x67, 0x12, 0x21,
+	0x0a, 0x0c, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d,
+	0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x69,
+	0x63, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x69, 0x63, 0x6f, 0x6e, 0x12,
+	0x1c, 0x0a, 0x09, 0x73, 0x75, 0x62, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x08, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x09, 0x73, 0x75, 0x62, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x25, 0x0a,
+	0x0e, 0x73, 0x75, 0x62, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x73, 0x75, 0x62, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x4e, 0x0a, 0x0d, 0x73, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x5f,
+	0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x29, 0x2e, 0x63, 0x6f,
+	0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x57, 0x6f, 0x72,
+	0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x41, 0x70, 0x70, 0x2e, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e,
+	0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x0c, 0x73, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x4c,
+	0x65, 0x76, 0x65, 0x6c, 0x12, 0x4a, 0x0a, 0x0b, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x63, 0x68,
+	0x65, 0x63, 0x6b, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x63, 0x6f, 0x64, 0x65,
+	0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x41, 0x70, 0x70, 0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68,
+	0x65, 0x63, 0x6b, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x63, 0x68, 0x65, 0x63, 0x6b,
+	0x12, 0x3b, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x23, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76,
+	0x32, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x41, 0x70, 0x70, 0x2e, 0x48,
+	0x65, 0x61, 0x6c, 0x74, 0x68, 0x52, 0x06, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x1a, 0x59, 0x0a,
+	0x0b, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x10, 0x0a, 0x03,
+	0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x1a,
+	0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05,
+	0x52, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x68,
+	0x72, 0x65, 0x73, 0x68, 0x6f, 0x6c, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x74,
+	0x68, 0x72, 0x65, 0x73, 0x68, 0x6f, 0x6c, 0x64, 0x22, 0x57, 0x0a, 0x0c, 0x53, 0x68, 0x61, 0x72,
+	0x69, 0x6e, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x1d, 0x0a, 0x19, 0x53, 0x48, 0x41, 0x52,
+	0x49, 0x4e, 0x47, 0x5f, 0x4c, 0x45, 0x56, 0x45, 0x4c, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
+	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x4f, 0x57, 0x4e, 0x45, 0x52,
+	0x10, 0x01, 0x12, 0x11, 0x0a, 0x0d, 0x41, 0x55, 0x54, 0x48, 0x45, 0x4e, 0x54, 0x49, 0x43, 0x41,
+	0x54, 0x45, 0x44, 0x10, 0x02, 0x12, 0x0a, 0x0a, 0x06, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x10,
+	0x03, 0x22, 0x5c, 0x0a, 0x06, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x12, 0x16, 0x0a, 0x12, 0x48,
+	0x45, 0x41, 0x4c, 0x54, 0x48, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45,
+	0x44, 0x10, 0x00, 0x12, 0x0c, 0x0a, 0x08, 0x44, 0x49, 0x53, 0x41, 0x42, 0x4c, 0x45, 0x44, 0x10,
+	0x01, 0x12, 0x10, 0x0a, 0x0c, 0x49, 0x4e, 0x49, 0x54, 0x49, 0x41, 0x4c, 0x49, 0x5a, 0x49, 0x4e,
+	0x47, 0x10, 0x02, 0x12, 0x0b, 0x0a, 0x07, 0x48, 0x45, 0x41, 0x4c, 0x54, 0x48, 0x59, 0x10, 0x03,
+	0x12, 0x0d, 0x0a, 0x09, 0x55, 0x4e, 0x48, 0x45, 0x41, 0x4c, 0x54, 0x48, 0x59, 0x10, 0x04, 0x22,
+	0xd0, 0x01, 0x0a, 0x08, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x10,
+	0x67, 0x69, 0x74, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x67, 0x69, 0x74, 0x41, 0x75, 0x74, 0x68, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x12, 0x32, 0x0a, 0x16, 0x76, 0x73, 0x5f, 0x63, 0x6f, 0x64,
+	0x65, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x5f, 0x75, 0x72, 0x69,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x76, 0x73, 0x43, 0x6f, 0x64, 0x65, 0x50, 0x6f,
+	0x72, 0x74, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x55, 0x72, 0x69, 0x12, 0x30, 0x0a, 0x04, 0x61, 0x70,
+	0x70, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72,
+	0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x41, 0x70, 0x70, 0x52, 0x04, 0x61, 0x70, 0x70, 0x73, 0x12, 0x34, 0x0a, 0x08,
+	0x64, 0x65, 0x72, 0x70, 0x5f, 0x6d, 0x61, 0x70, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19,
+	0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76,
+	0x32, 0x2e, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x52, 0x07, 0x64, 0x65, 0x72, 0x70, 0x4d,
+	0x61, 0x70, 0x22, 0x14, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73,
+	0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x6e, 0x0a, 0x0d, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x42, 0x61, 0x6e, 0x6e, 0x65, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61,
+	0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x29, 0x0a,
+	0x10, 0x62, 0x61, 0x63, 0x6b, 0x67, 0x72, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x63, 0x6f, 0x6c, 0x6f,
+	0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x62, 0x61, 0x63, 0x6b, 0x67, 0x72, 0x6f,
+	0x75, 0x6e, 0x64, 0x43, 0x6f, 0x6c, 0x6f, 0x72, 0x22, 0x19, 0x0a, 0x17, 0x47, 0x65, 0x74, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x42, 0x61, 0x6e, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x22, 0x89, 0x07, 0x0a, 0x05, 0x53, 0x74, 0x61, 0x74, 0x73, 0x12, 0x5f, 0x0a,
+	0x14, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x5f, 0x62, 0x79, 0x5f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f,
+	0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x74, 0x61,
+	0x74, 0x73, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x79,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x12, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x29,
+	0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x3f, 0x0a, 0x1c, 0x63, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x6e, 0x5f, 0x6c,
+	0x61, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x5f, 0x6d, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x01, 0x52,
+	0x19, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x65, 0x64, 0x69, 0x61,
+	0x6e, 0x4c, 0x61, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x4d, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x72, 0x78,
+	0x5f, 0x70, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09,
+	0x72, 0x78, 0x50, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x78, 0x5f,
+	0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x72, 0x78, 0x42,
+	0x79, 0x74, 0x65, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x78, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x65,
+	0x74, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x74, 0x78, 0x50, 0x61, 0x63, 0x6b,
+	0x65, 0x74, 0x73, 0x12, 0x19, 0x0a, 0x08, 0x74, 0x78, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x74, 0x78, 0x42, 0x79, 0x74, 0x65, 0x73, 0x12, 0x30,
+	0x0a, 0x14, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f,
+	0x76, 0x73, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x03, 0x52, 0x12, 0x73, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x56, 0x73, 0x63, 0x6f, 0x64, 0x65,
+	0x12, 0x36, 0x0a, 0x17, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x75, 0x6e,
+	0x74, 0x5f, 0x6a, 0x65, 0x74, 0x62, 0x72, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x09, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x15, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x4a,
+	0x65, 0x74, 0x62, 0x72, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x43, 0x0a, 0x1e, 0x73, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x69, 0x6e, 0x67, 0x5f, 0x70, 0x74, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x1b, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65,
+	0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6e, 0x67, 0x50, 0x74, 0x79, 0x12, 0x2a, 0x0a,
+	0x11, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x73,
+	0x73, 0x68, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x53, 0x73, 0x68, 0x1a, 0x45, 0x0a, 0x17, 0x43, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x79, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
+	0x1a, 0x9c, 0x02, 0x0a, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x35, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x21, 0x2e,
+	0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x53,
+	0x74, 0x61, 0x74, 0x73, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x2e, 0x54, 0x79, 0x70, 0x65,
+	0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x01, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x40, 0x0a, 0x06,
+	0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x63,
+	0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x74,
+	0x61, 0x74, 0x73, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c,
+	0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x1a, 0x39,
+	0x0a, 0x0b, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x34, 0x0a, 0x04, 0x54, 0x79, 0x70,
+	0x65, 0x12, 0x14, 0x0a, 0x10, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
+	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x43, 0x4f, 0x55, 0x4e, 0x54,
+	0x45, 0x52, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x47, 0x41, 0x55, 0x47, 0x45, 0x10, 0x02, 0x22,
+	0x41, 0x0a, 0x12, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x73, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2b, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x73, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65,
+	0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x73, 0x52, 0x05, 0x73, 0x74, 0x61,
+	0x74, 0x73, 0x22, 0x70, 0x0a, 0x13, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x59, 0x0a, 0x1b, 0x72, 0x65, 0x70,
+	0x6f, 0x72, 0x74, 0x5f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x5f, 0x6e, 0x61, 0x6e,
+	0x6f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x19, 0x72, 0x65, 0x70, 0x6f, 0x72,
+	0x74, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x4e, 0x61, 0x6e, 0x6f, 0x73, 0x65, 0x63,
+	0x6f, 0x6e, 0x64, 0x73, 0x22, 0xf2, 0x01, 0x0a, 0x09, 0x4c, 0x69, 0x66, 0x65, 0x63, 0x79, 0x63,
+	0x6c, 0x65, 0x12, 0x35, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x1f, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e,
+	0x76, 0x32, 0x2e, 0x4c, 0x69, 0x66, 0x65, 0x63, 0x79, 0x63, 0x6c, 0x65, 0x2e, 0x53, 0x74, 0x61,
+	0x74, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x22, 0xad, 0x01, 0x0a, 0x05, 0x53, 0x74,
+	0x61, 0x74, 0x65, 0x12, 0x15, 0x0a, 0x11, 0x53, 0x54, 0x41, 0x54, 0x45, 0x5f, 0x55, 0x4e, 0x53,
+	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x43, 0x52,
+	0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x01, 0x12, 0x0b, 0x0a, 0x07, 0x53, 0x54, 0x41, 0x52, 0x54,
+	0x45, 0x44, 0x10, 0x02, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x54, 0x41, 0x52, 0x54, 0x5f, 0x54, 0x49,
+	0x4d, 0x45, 0x4f, 0x55, 0x54, 0x10, 0x03, 0x12, 0x0f, 0x0a, 0x0b, 0x53, 0x54, 0x41, 0x52, 0x54,
+	0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x04, 0x12, 0x09, 0x0a, 0x05, 0x52, 0x45, 0x41, 0x44,
+	0x59, 0x10, 0x05, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x48, 0x55, 0x54, 0x54, 0x49, 0x4e, 0x47, 0x5f,
+	0x44, 0x4f, 0x57, 0x4e, 0x10, 0x06, 0x12, 0x14, 0x0a, 0x10, 0x53, 0x48, 0x55, 0x54, 0x44, 0x4f,
+	0x57, 0x4e, 0x5f, 0x54, 0x49, 0x4d, 0x45, 0x4f, 0x55, 0x54, 0x10, 0x07, 0x12, 0x12, 0x0a, 0x0e,
+	0x53, 0x48, 0x55, 0x54, 0x44, 0x4f, 0x57, 0x4e, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x08,
+	0x12, 0x07, 0x0a, 0x03, 0x4f, 0x46, 0x46, 0x10, 0x09, 0x22, 0x51, 0x0a, 0x16, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x4c, 0x69, 0x66, 0x65, 0x63, 0x79, 0x63, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x37, 0x0a, 0x09, 0x6c, 0x69, 0x66, 0x65, 0x63, 0x79, 0x63, 0x6c, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61,
+	0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x4c, 0x69, 0x66, 0x65, 0x63, 0x79, 0x63, 0x6c,
+	0x65, 0x52, 0x09, 0x6c, 0x69, 0x66, 0x65, 0x63, 0x79, 0x63, 0x6c, 0x65, 0x22, 0xc8, 0x01, 0x0a,
+	0x1b, 0x42, 0x61, 0x74, 0x63, 0x68, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x70, 0x70, 0x48,
+	0x65, 0x61, 0x6c, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x52, 0x0a, 0x07,
+	0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e,
+	0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x42,
+	0x61, 0x74, 0x63, 0x68, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x70, 0x70, 0x48, 0x65, 0x61,
+	0x6c, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74,
+	0x68, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x07, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x73,
+	0x1a, 0x55, 0x0a, 0x0c, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x12, 0x12, 0x0a, 0x04, 0x75, 0x75, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04,
+	0x75, 0x75, 0x69, 0x64, 0x12, 0x31, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65,
+	0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x41, 0x70, 0x70, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x52,
+	0x06, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x22, 0x1e, 0x0a, 0x1c, 0x42, 0x61, 0x74, 0x63, 0x68,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x70, 0x70, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x72, 0x0a, 0x07, 0x53, 0x74, 0x61, 0x72, 0x74,
+	0x75, 0x70, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2d, 0x0a, 0x12,
+	0x65, 0x78, 0x70, 0x61, 0x6e, 0x64, 0x65, 0x64, 0x5f, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f,
+	0x72, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x65, 0x78, 0x70, 0x61, 0x6e, 0x64,
+	0x65, 0x64, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x1e, 0x0a, 0x0a, 0x73,
+	0x75, 0x62, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x0a, 0x73, 0x75, 0x62, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x73, 0x22, 0x49, 0x0a, 0x14, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x31, 0x0a, 0x07, 0x73, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65,
+	0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x52, 0x07, 0x73,
+	0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x22, 0x99, 0x01, 0x0a, 0x08, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x3d, 0x0a, 0x0c, 0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74,
+	0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0b, 0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74,
+	0x65, 0x64, 0x41, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x61, 0x67, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x03, 0x61, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72,
+	0x6f, 0x72, 0x22, 0x52, 0x0a, 0x1a, 0x42, 0x61, 0x74, 0x63, 0x68, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x34, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x18, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74,
+	0x2e, 0x76, 0x32, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x1d, 0x0a, 0x1b, 0x42, 0x61, 0x74, 0x63, 0x68, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xde, 0x01, 0x0a, 0x03, 0x4c, 0x6f, 0x67, 0x12, 0x39, 0x0a,
+	0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x75, 0x74, 0x70,
+	0x75, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74,
+	0x12, 0x2f, 0x0a, 0x05, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x19, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32,
+	0x2e, 0x4c, 0x6f, 0x67, 0x2e, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x05, 0x6c, 0x65, 0x76, 0x65,
+	0x6c, 0x22, 0x53, 0x0a, 0x05, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x15, 0x0a, 0x11, 0x4c, 0x45,
+	0x56, 0x45, 0x4c, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
+	0x00, 0x12, 0x09, 0x0a, 0x05, 0x54, 0x52, 0x41, 0x43, 0x45, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05,
+	0x44, 0x45, 0x42, 0x55, 0x47, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x4e, 0x46, 0x4f, 0x10,
+	0x03, 0x12, 0x08, 0x0a, 0x04, 0x57, 0x41, 0x52, 0x4e, 0x10, 0x04, 0x12, 0x09, 0x0a, 0x05, 0x45,
+	0x52, 0x52, 0x4f, 0x52, 0x10, 0x05, 0x22, 0x5e, 0x0a, 0x16, 0x42, 0x61, 0x74, 0x63, 0x68, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x4c, 0x6f, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x1b, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x12, 0x27, 0x0a,
+	0x04, 0x6c, 0x6f, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x63, 0x6f,
+	0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x4c, 0x6f, 0x67,
+	0x52, 0x04, 0x6c, 0x6f, 0x67, 0x73, 0x22, 0x19, 0x0a, 0x17, 0x42, 0x61, 0x74, 0x63, 0x68, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x4c, 0x6f, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x2a, 0x63, 0x0a, 0x09, 0x41, 0x70, 0x70, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x12, 0x1a,
+	0x0a, 0x16, 0x41, 0x50, 0x50, 0x5f, 0x48, 0x45, 0x41, 0x4c, 0x54, 0x48, 0x5f, 0x55, 0x4e, 0x53,
+	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0c, 0x0a, 0x08, 0x44, 0x49,
+	0x53, 0x41, 0x42, 0x4c, 0x45, 0x44, 0x10, 0x01, 0x12, 0x10, 0x0a, 0x0c, 0x49, 0x4e, 0x49, 0x54,
+	0x49, 0x41, 0x4c, 0x49, 0x5a, 0x49, 0x4e, 0x47, 0x10, 0x02, 0x12, 0x0b, 0x0a, 0x07, 0x48, 0x45,
+	0x41, 0x4c, 0x54, 0x48, 0x59, 0x10, 0x03, 0x12, 0x0d, 0x0a, 0x09, 0x55, 0x4e, 0x48, 0x45, 0x41,
+	0x4c, 0x54, 0x48, 0x59, 0x10, 0x04, 0x32, 0xb2, 0x07, 0x0a, 0x05, 0x41, 0x67, 0x65, 0x6e, 0x74,
+	0x12, 0x4b, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x12,
+	0x22, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32,
+	0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e,
+	0x74, 0x2e, 0x76, 0x32, 0x2e, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x12, 0x5a, 0x0a,
+	0x10, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x42, 0x61, 0x6e, 0x6e, 0x65,
+	0x72, 0x12, 0x27, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e,
+	0x76, 0x32, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x42, 0x61, 0x6e,
+	0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x63, 0x6f, 0x64,
+	0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x42, 0x61, 0x6e, 0x6e, 0x65, 0x72, 0x12, 0x56, 0x0a, 0x0b, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x73, 0x12, 0x22, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72,
+	0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x53, 0x74, 0x61, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x63,
+	0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x54, 0x0a, 0x0f, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4c, 0x69, 0x66, 0x65, 0x63,
+	0x79, 0x63, 0x6c, 0x65, 0x12, 0x26, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65,
+	0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4c, 0x69, 0x66, 0x65,
+	0x63, 0x79, 0x63, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x63,
+	0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x4c, 0x69,
+	0x66, 0x65, 0x63, 0x79, 0x63, 0x6c, 0x65, 0x12, 0x72, 0x0a, 0x15, 0x42, 0x61, 0x74, 0x63, 0x68,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x70, 0x70, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x73,
+	0x12, 0x2b, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76,
+	0x32, 0x2e, 0x42, 0x61, 0x74, 0x63, 0x68, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x70, 0x70,
+	0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e,
+	0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x42,
+	0x61, 0x74, 0x63, 0x68, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x70, 0x70, 0x48, 0x65, 0x61,
+	0x6c, 0x74, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4e, 0x0a, 0x0d, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x12, 0x24, 0x2e, 0x63,
+	0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x17, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74,
+	0x2e, 0x76, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x12, 0x6e, 0x0a, 0x13, 0x42,
+	0x61, 0x74, 0x63, 0x68, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x12, 0x2a, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74,
+	0x2e, 0x76, 0x32, 0x2e, 0x42, 0x61, 0x74, 0x63, 0x68, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b,
+	0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e,
+	0x42, 0x61, 0x74, 0x63, 0x68, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x62, 0x0a, 0x0f, 0x42,
+	0x61, 0x74, 0x63, 0x68, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4c, 0x6f, 0x67, 0x73, 0x12, 0x26,
+	0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e,
+	0x42, 0x61, 0x74, 0x63, 0x68, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4c, 0x6f, 0x67, 0x73, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x61,
+	0x67, 0x65, 0x6e, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x42, 0x61, 0x74, 0x63, 0x68, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x4c, 0x6f, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x56, 0x0a, 0x0e, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70,
+	0x73, 0x12, 0x27, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65,
+	0x74, 0x2e, 0x76, 0x32, 0x2e, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x44, 0x45, 0x52, 0x50, 0x4d,
+	0x61, 0x70, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x63, 0x6f, 0x64,
+	0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x44, 0x45,
+	0x52, 0x50, 0x4d, 0x61, 0x70, 0x30, 0x01, 0x12, 0x62, 0x0a, 0x11, 0x43, 0x6f, 0x6f, 0x72, 0x64,
+	0x69, 0x6e, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x23, 0x2e, 0x63,
+	0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e,
+	0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x24, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65,
+	0x74, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x42, 0x27, 0x5a, 0x25, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f,
+	0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x76, 0x32, 0x2f, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_agent_proto_agent_proto_rawDescOnce sync.Once
+	file_agent_proto_agent_proto_rawDescData = file_agent_proto_agent_proto_rawDesc
+)
+
+func file_agent_proto_agent_proto_rawDescGZIP() []byte {
+	file_agent_proto_agent_proto_rawDescOnce.Do(func() {
+		file_agent_proto_agent_proto_rawDescData = protoimpl.X.CompressGZIP(file_agent_proto_agent_proto_rawDescData)
+	})
+	return file_agent_proto_agent_proto_rawDescData
+}
+
+var file_agent_proto_agent_proto_enumTypes = make([]protoimpl.EnumInfo, 6)
+var file_agent_proto_agent_proto_msgTypes = make([]protoimpl.MessageInfo, 25)
+var file_agent_proto_agent_proto_goTypes = []interface{}{
+	(AppHealth)(0),                                   // 0: coder.agent.v2.AppHealth
+	(WorkspaceApp_SharingLevel)(0),                   // 1: coder.agent.v2.WorkspaceApp.SharingLevel
+	(WorkspaceApp_Health)(0),                         // 2: coder.agent.v2.WorkspaceApp.Health
+	(Stats_Metric_Type)(0),                           // 3: coder.agent.v2.Stats.Metric.Type
+	(Lifecycle_State)(0),                             // 4: coder.agent.v2.Lifecycle.State
+	(Log_Level)(0),                                   // 5: coder.agent.v2.Log.Level
+	(*WorkspaceApp)(nil),                             // 6: coder.agent.v2.WorkspaceApp
+	(*Manifest)(nil),                                 // 7: coder.agent.v2.Manifest
+	(*GetManifestRequest)(nil),                       // 8: coder.agent.v2.GetManifestRequest
+	(*ServiceBanner)(nil),                            // 9: coder.agent.v2.ServiceBanner
+	(*GetServiceBannerRequest)(nil),                  // 10: coder.agent.v2.GetServiceBannerRequest
+	(*Stats)(nil),                                    // 11: coder.agent.v2.Stats
+	(*UpdateStatsRequest)(nil),                       // 12: coder.agent.v2.UpdateStatsRequest
+	(*UpdateStatsResponse)(nil),                      // 13: coder.agent.v2.UpdateStatsResponse
+	(*Lifecycle)(nil),                                // 14: coder.agent.v2.Lifecycle
+	(*UpdateLifecycleRequest)(nil),                   // 15: coder.agent.v2.UpdateLifecycleRequest
+	(*BatchUpdateAppHealthRequest)(nil),              // 16: coder.agent.v2.BatchUpdateAppHealthRequest
+	(*BatchUpdateAppHealthResponse)(nil),             // 17: coder.agent.v2.BatchUpdateAppHealthResponse
+	(*Startup)(nil),                                  // 18: coder.agent.v2.Startup
+	(*UpdateStartupRequest)(nil),                     // 19: coder.agent.v2.UpdateStartupRequest
+	(*Metadata)(nil),                                 // 20: coder.agent.v2.Metadata
+	(*BatchUpdateMetadataRequest)(nil),               // 21: coder.agent.v2.BatchUpdateMetadataRequest
+	(*BatchUpdateMetadataResponse)(nil),              // 22: coder.agent.v2.BatchUpdateMetadataResponse
+	(*Log)(nil),                                      // 23: coder.agent.v2.Log
+	(*BatchCreateLogsRequest)(nil),                   // 24: coder.agent.v2.BatchCreateLogsRequest
+	(*BatchCreateLogsResponse)(nil),                  // 25: coder.agent.v2.BatchCreateLogsResponse
+	(*WorkspaceApp_HealthCheck)(nil),                 // 26: coder.agent.v2.WorkspaceApp.HealthCheck
+	nil,                                              // 27: coder.agent.v2.Stats.ConnectionsByProtoEntry
+	(*Stats_Metric)(nil),                             // 28: coder.agent.v2.Stats.Metric
+	nil,                                              // 29: coder.agent.v2.Stats.Metric.LabelsEntry
+	(*BatchUpdateAppHealthRequest_HealthUpdate)(nil), // 30: coder.agent.v2.BatchUpdateAppHealthRequest.HealthUpdate
+	(*proto.DERPMap)(nil),                            // 31: coder.tailnet.v2.DERPMap
+	(*durationpb.Duration)(nil),                      // 32: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),                    // 33: google.protobuf.Timestamp
+	(*proto.StreamDERPMapsRequest)(nil),              // 34: coder.tailnet.v2.StreamDERPMapsRequest
+	(*proto.CoordinateRequest)(nil),                  // 35: coder.tailnet.v2.CoordinateRequest
+	(*proto.CoordinateResponse)(nil),                 // 36: coder.tailnet.v2.CoordinateResponse
+}
+var file_agent_proto_agent_proto_depIdxs = []int32{
+	1,  // 0: coder.agent.v2.WorkspaceApp.sharing_level:type_name -> coder.agent.v2.WorkspaceApp.SharingLevel
+	26, // 1: coder.agent.v2.WorkspaceApp.healthcheck:type_name -> coder.agent.v2.WorkspaceApp.HealthCheck
+	2,  // 2: coder.agent.v2.WorkspaceApp.health:type_name -> coder.agent.v2.WorkspaceApp.Health
+	6,  // 3: coder.agent.v2.Manifest.apps:type_name -> coder.agent.v2.WorkspaceApp
+	31, // 4: coder.agent.v2.Manifest.derp_map:type_name -> coder.tailnet.v2.DERPMap
+	27, // 5: coder.agent.v2.Stats.connections_by_proto:type_name -> coder.agent.v2.Stats.ConnectionsByProtoEntry
+	11, // 6: coder.agent.v2.UpdateStatsRequest.stats:type_name -> coder.agent.v2.Stats
+	32, // 7: coder.agent.v2.UpdateStatsResponse.report_interval_nanoseconds:type_name -> google.protobuf.Duration
+	4,  // 8: coder.agent.v2.Lifecycle.state:type_name -> coder.agent.v2.Lifecycle.State
+	14, // 9: coder.agent.v2.UpdateLifecycleRequest.lifecycle:type_name -> coder.agent.v2.Lifecycle
+	30, // 10: coder.agent.v2.BatchUpdateAppHealthRequest.updates:type_name -> coder.agent.v2.BatchUpdateAppHealthRequest.HealthUpdate
+	18, // 11: coder.agent.v2.UpdateStartupRequest.startup:type_name -> coder.agent.v2.Startup
+	33, // 12: coder.agent.v2.Metadata.collected_at:type_name -> google.protobuf.Timestamp
+	20, // 13: coder.agent.v2.BatchUpdateMetadataRequest.metadata:type_name -> coder.agent.v2.Metadata
+	33, // 14: coder.agent.v2.Log.created_at:type_name -> google.protobuf.Timestamp
+	5,  // 15: coder.agent.v2.Log.level:type_name -> coder.agent.v2.Log.Level
+	23, // 16: coder.agent.v2.BatchCreateLogsRequest.logs:type_name -> coder.agent.v2.Log
+	3,  // 17: coder.agent.v2.Stats.Metric.type:type_name -> coder.agent.v2.Stats.Metric.Type
+	29, // 18: coder.agent.v2.Stats.Metric.labels:type_name -> coder.agent.v2.Stats.Metric.LabelsEntry
+	0,  // 19: coder.agent.v2.BatchUpdateAppHealthRequest.HealthUpdate.health:type_name -> coder.agent.v2.AppHealth
+	8,  // 20: coder.agent.v2.Agent.GetManifest:input_type -> coder.agent.v2.GetManifestRequest
+	10, // 21: coder.agent.v2.Agent.GetServiceBanner:input_type -> coder.agent.v2.GetServiceBannerRequest
+	12, // 22: coder.agent.v2.Agent.UpdateStats:input_type -> coder.agent.v2.UpdateStatsRequest
+	15, // 23: coder.agent.v2.Agent.UpdateLifecycle:input_type -> coder.agent.v2.UpdateLifecycleRequest
+	16, // 24: coder.agent.v2.Agent.BatchUpdateAppHealths:input_type -> coder.agent.v2.BatchUpdateAppHealthRequest
+	19, // 25: coder.agent.v2.Agent.UpdateStartup:input_type -> coder.agent.v2.UpdateStartupRequest
+	21, // 26: coder.agent.v2.Agent.BatchUpdateMetadata:input_type -> coder.agent.v2.BatchUpdateMetadataRequest
+	24, // 27: coder.agent.v2.Agent.BatchCreateLogs:input_type -> coder.agent.v2.BatchCreateLogsRequest
+	34, // 28: coder.agent.v2.Agent.StreamDERPMaps:input_type -> coder.tailnet.v2.StreamDERPMapsRequest
+	35, // 29: coder.agent.v2.Agent.CoordinateTailnet:input_type -> coder.tailnet.v2.CoordinateRequest
+	7,  // 30: coder.agent.v2.Agent.GetManifest:output_type -> coder.agent.v2.Manifest
+	9,  // 31: coder.agent.v2.Agent.GetServiceBanner:output_type -> coder.agent.v2.ServiceBanner
+	13, // 32: coder.agent.v2.Agent.UpdateStats:output_type -> coder.agent.v2.UpdateStatsResponse
+	14, // 33: coder.agent.v2.Agent.UpdateLifecycle:output_type -> coder.agent.v2.Lifecycle
+	17, // 34: coder.agent.v2.Agent.BatchUpdateAppHealths:output_type -> coder.agent.v2.BatchUpdateAppHealthResponse
+	18, // 35: coder.agent.v2.Agent.UpdateStartup:output_type -> coder.agent.v2.Startup
+	22, // 36: coder.agent.v2.Agent.BatchUpdateMetadata:output_type -> coder.agent.v2.BatchUpdateMetadataResponse
+	25, // 37: coder.agent.v2.Agent.BatchCreateLogs:output_type -> coder.agent.v2.BatchCreateLogsResponse
+	31, // 38: coder.agent.v2.Agent.StreamDERPMaps:output_type -> coder.tailnet.v2.DERPMap
+	36, // 39: coder.agent.v2.Agent.CoordinateTailnet:output_type -> coder.tailnet.v2.CoordinateResponse
+	30, // [30:40] is the sub-list for method output_type
+	20, // [20:30] is the sub-list for method input_type
+	20, // [20:20] is the sub-list for extension type_name
+	20, // [20:20] is the sub-list for extension extendee
+	0,  // [0:20] is the sub-list for field type_name
+}
+
+func init() { file_agent_proto_agent_proto_init() }
+func file_agent_proto_agent_proto_init() {
+	if File_agent_proto_agent_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_agent_proto_agent_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WorkspaceApp); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Manifest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetManifestRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServiceBanner); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetServiceBannerRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Stats); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateStatsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateStatsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Lifecycle); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateLifecycleRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BatchUpdateAppHealthRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BatchUpdateAppHealthResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Startup); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateStartupRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Metadata); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BatchUpdateMetadataRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BatchUpdateMetadataResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Log); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BatchCreateLogsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BatchCreateLogsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WorkspaceApp_HealthCheck); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Stats_Metric); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_agent_proto_agent_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BatchUpdateAppHealthRequest_HealthUpdate); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_agent_proto_agent_proto_rawDesc,
+			NumEnums:      6,
+			NumMessages:   25,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_agent_proto_agent_proto_goTypes,
+		DependencyIndexes: file_agent_proto_agent_proto_depIdxs,
+		EnumInfos:         file_agent_proto_agent_proto_enumTypes,
+		MessageInfos:      file_agent_proto_agent_proto_msgTypes,
+	}.Build()
+	File_agent_proto_agent_proto = out.File
+	file_agent_proto_agent_proto_rawDesc = nil
+	file_agent_proto_agent_proto_goTypes = nil
+	file_agent_proto_agent_proto_depIdxs = nil
+}
diff --git a/agent/proto/agent.proto b/agent/proto/agent.proto
new file mode 100644
index 0000000000000..5d6c09c167db0
--- /dev/null
+++ b/agent/proto/agent.proto
@@ -0,0 +1,211 @@
+syntax = "proto3";
+option go_package = "github.com/coder/coder/v2/agent/proto";
+
+package coder.agent.v2;
+
+import "tailnet/proto/tailnet.proto";
+import "google/protobuf/timestamp.proto";
+import "google/protobuf/duration.proto";
+
+message WorkspaceApp {
+	bytes uuid = 1;
+	string url = 2;
+	bool external = 3;
+	string slug = 4;
+	string display_name = 5;
+	string command = 6;
+	string icon = 7;
+	bool subdomain = 8;
+	string subdomain_name = 9;
+
+	enum SharingLevel {
+		SHARING_LEVEL_UNSPECIFIED = 0;
+		OWNER = 1;
+		AUTHENTICATED = 2;
+		PUBLIC = 3;
+	}
+	SharingLevel sharing_level = 10;
+
+	message HealthCheck {
+		string url = 1;
+		int32 interval = 2;
+		int32 threshold = 3;
+	}
+	HealthCheck healthcheck = 11;
+
+	enum Health {
+		HEALTH_UNSPECIFIED = 0;
+		DISABLED = 1;
+		INITIALIZING = 2;
+		HEALTHY = 3;
+		UNHEALTHY = 4;
+	}
+	Health health = 12;
+}
+
+message Manifest {
+	uint32 git_auth_configs = 1;
+	string vs_code_port_proxy_uri = 2;
+	repeated WorkspaceApp apps = 3;
+	coder.tailnet.v2.DERPMap derp_map = 4;
+}
+
+message GetManifestRequest {}
+
+message ServiceBanner {
+	bool enabled = 1;
+	string message = 2;
+	string background_color = 3;
+}
+
+message GetServiceBannerRequest {}
+
+message Stats {
+	// ConnectionsByProto is a count of connections by protocol.
+	map<string, int64> connections_by_proto = 1;
+	// ConnectionCount is the number of connections received by an agent.
+	int64 connection_count = 2;
+	// ConnectionMedianLatencyMS is the median latency of all connections in milliseconds.
+	double connection_median_latency_ms = 3;
+	// RxPackets is the number of received packets.
+	int64 rx_packets = 4;
+	// RxBytes is the number of received bytes.
+	int64 rx_bytes = 5;
+	// TxPackets is the number of transmitted bytes.
+	int64 tx_packets = 6;
+	// TxBytes is the number of transmitted bytes.
+	int64 tx_bytes = 7;
+
+	// SessionCountVSCode is the number of connections received by an agent
+	// that are from our VS Code extension.
+	int64 session_count_vscode = 8;
+	// SessionCountJetBrains is the number of connections received by an agent
+	// that are from our JetBrains extension.
+	int64 session_count_jetbrains = 9;
+	// SessionCountReconnectingPTY is the number of connections received by an agent
+	// that are from the reconnecting web terminal.
+	int64 session_count_reconnecting_pty = 10;
+	// SessionCountSSH is the number of connections received by an agent
+	// that are normal, non-tagged SSH sessions.
+	int64 session_count_ssh = 11;
+
+	message Metric {
+		string name = 1;
+
+		enum Type {
+			TYPE_UNSPECIFIED = 0;
+			COUNTER = 1;
+			GAUGE = 2;
+		}
+		Type type = 2;
+
+		double value = 3;
+		map<string, string> labels = 4;
+	}
+}
+
+message UpdateStatsRequest{
+	Stats stats = 1;
+}
+
+message UpdateStatsResponse {
+	google.protobuf.Duration report_interval_nanoseconds = 1;
+}
+
+message Lifecycle {
+	enum State {
+		STATE_UNSPECIFIED = 0;
+		CREATED = 1;
+		STARTED = 2;
+		START_TIMEOUT = 3;
+		START_ERROR = 4;
+		READY = 5;
+		SHUTTING_DOWN = 6;
+		SHUTDOWN_TIMEOUT = 7;
+		SHUTDOWN_ERROR = 8;
+		OFF = 9;
+	}
+	State state = 1;
+}
+
+message UpdateLifecycleRequest {
+	Lifecycle lifecycle = 1;
+}
+
+enum AppHealth {
+	APP_HEALTH_UNSPECIFIED = 0;
+	DISABLED = 1;
+	INITIALIZING = 2;
+	HEALTHY = 3;
+	UNHEALTHY = 4;
+}
+
+message BatchUpdateAppHealthRequest {
+	message HealthUpdate {
+		bytes uuid = 1;
+		AppHealth health = 2;
+	}
+	repeated HealthUpdate updates = 1;
+}
+
+message BatchUpdateAppHealthResponse {}
+
+message Startup {
+	string version = 1;
+	string expanded_directory = 2;
+	repeated string subsystems = 3;
+}
+
+message UpdateStartupRequest{
+	Startup startup = 1;
+}
+
+message Metadata {
+	string key = 1;
+	google.protobuf.Timestamp collected_at = 2;
+	int64 age = 3;
+	string value = 4;
+	string error = 5;
+}
+
+message BatchUpdateMetadataRequest {
+	repeated Metadata metadata = 2;
+}
+
+message BatchUpdateMetadataResponse {}
+
+message Log {
+	google.protobuf.Timestamp created_at = 1;
+	string output = 2;
+
+	enum Level {
+		LEVEL_UNSPECIFIED = 0;
+		TRACE = 1;
+		DEBUG = 2;
+		INFO = 3;
+		WARN = 4;
+		ERROR = 5;
+	}
+	Level level = 3;
+}
+
+message BatchCreateLogsRequest {
+	bytes source_id = 1;
+	repeated Log logs = 2;
+}
+
+message BatchCreateLogsResponse {}
+
+service Agent {
+	rpc GetManifest(GetManifestRequest) returns (Manifest);
+	rpc GetServiceBanner(GetServiceBannerRequest) returns (ServiceBanner);
+	rpc UpdateStats(UpdateStatsRequest) returns (UpdateStatsResponse);
+	rpc UpdateLifecycle(UpdateLifecycleRequest) returns (Lifecycle);
+	rpc BatchUpdateAppHealths(BatchUpdateAppHealthRequest) returns (BatchUpdateAppHealthResponse);
+	rpc UpdateStartup(UpdateStartupRequest) returns (Startup);
+	rpc BatchUpdateMetadata(BatchUpdateMetadataRequest) returns (BatchUpdateMetadataResponse);
+	rpc BatchCreateLogs(BatchCreateLogsRequest) returns (BatchCreateLogsResponse);
+
+	rpc StreamDERPMaps(tailnet.v2.StreamDERPMapsRequest) returns (stream tailnet.v2.DERPMap);
+	rpc CoordinateTailnet(stream tailnet.v2.CoordinateRequest) returns (stream tailnet.v2.CoordinateResponse);
+}
diff --git a/agent/proto/agent_drpc.pb.go b/agent/proto/agent_drpc.pb.go
new file mode 100644
index 0000000000000..b64ca2b4f2bc7
--- /dev/null
+++ b/agent/proto/agent_drpc.pb.go
@@ -0,0 +1,539 @@
+// Code generated by protoc-gen-go-drpc. DO NOT EDIT.
+// protoc-gen-go-drpc version: v0.0.33
+// source: agent/proto/agent.proto
+
+package proto
+
+import (
+	context "context"
+	errors "errors"
+	proto1 "github.com/coder/coder/v2/tailnet/proto"
+	protojson "google.golang.org/protobuf/encoding/protojson"
+	proto "google.golang.org/protobuf/proto"
+	drpc "storj.io/drpc"
+	drpcerr "storj.io/drpc/drpcerr"
+)
+
+type drpcEncoding_File_agent_proto_agent_proto struct{}
+
+func (drpcEncoding_File_agent_proto_agent_proto) Marshal(msg drpc.Message) ([]byte, error) {
+	return proto.Marshal(msg.(proto.Message))
+}
+
+func (drpcEncoding_File_agent_proto_agent_proto) MarshalAppend(buf []byte, msg drpc.Message) ([]byte, error) {
+	return proto.MarshalOptions{}.MarshalAppend(buf, msg.(proto.Message))
+}
+
+func (drpcEncoding_File_agent_proto_agent_proto) Unmarshal(buf []byte, msg drpc.Message) error {
+	return proto.Unmarshal(buf, msg.(proto.Message))
+}
+
+func (drpcEncoding_File_agent_proto_agent_proto) JSONMarshal(msg drpc.Message) ([]byte, error) {
+	return protojson.Marshal(msg.(proto.Message))
+}
+
+func (drpcEncoding_File_agent_proto_agent_proto) JSONUnmarshal(buf []byte, msg drpc.Message) error {
+	return protojson.Unmarshal(buf, msg.(proto.Message))
+}
+
+type DRPCAgentClient interface {
+	DRPCConn() drpc.Conn
+
+	GetManifest(ctx context.Context, in *GetManifestRequest) (*Manifest, error)
+	GetServiceBanner(ctx context.Context, in *GetServiceBannerRequest) (*ServiceBanner, error)
+	UpdateStats(ctx context.Context, in *UpdateStatsRequest) (*UpdateStatsResponse, error)
+	UpdateLifecycle(ctx context.Context, in *UpdateLifecycleRequest) (*Lifecycle, error)
+	BatchUpdateAppHealths(ctx context.Context, in *BatchUpdateAppHealthRequest) (*BatchUpdateAppHealthResponse, error)
+	UpdateStartup(ctx context.Context, in *UpdateStartupRequest) (*Startup, error)
+	BatchUpdateMetadata(ctx context.Context, in *BatchUpdateMetadataRequest) (*BatchUpdateMetadataResponse, error)
+	BatchCreateLogs(ctx context.Context, in *BatchCreateLogsRequest) (*BatchCreateLogsResponse, error)
+	StreamDERPMaps(ctx context.Context, in *proto1.StreamDERPMapsRequest) (DRPCAgent_StreamDERPMapsClient, error)
+	CoordinateTailnet(ctx context.Context) (DRPCAgent_CoordinateTailnetClient, error)
+}
+
+type drpcAgentClient struct {
+	cc drpc.Conn
+}
+
+func NewDRPCAgentClient(cc drpc.Conn) DRPCAgentClient {
+	return &drpcAgentClient{cc}
+}
+
+func (c *drpcAgentClient) DRPCConn() drpc.Conn { return c.cc }
+
+func (c *drpcAgentClient) GetManifest(ctx context.Context, in *GetManifestRequest) (*Manifest, error) {
+	out := new(Manifest)
+	err := c.cc.Invoke(ctx, "/coder.agent.v2.Agent/GetManifest", drpcEncoding_File_agent_proto_agent_proto{}, in, out)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *drpcAgentClient) GetServiceBanner(ctx context.Context, in *GetServiceBannerRequest) (*ServiceBanner, error) {
+	out := new(ServiceBanner)
+	err := c.cc.Invoke(ctx, "/coder.agent.v2.Agent/GetServiceBanner", drpcEncoding_File_agent_proto_agent_proto{}, in, out)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *drpcAgentClient) UpdateStats(ctx context.Context, in *UpdateStatsRequest) (*UpdateStatsResponse, error) {
+	out := new(UpdateStatsResponse)
+	err := c.cc.Invoke(ctx, "/coder.agent.v2.Agent/UpdateStats", drpcEncoding_File_agent_proto_agent_proto{}, in, out)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *drpcAgentClient) UpdateLifecycle(ctx context.Context, in *UpdateLifecycleRequest) (*Lifecycle, error) {
+	out := new(Lifecycle)
+	err := c.cc.Invoke(ctx, "/coder.agent.v2.Agent/UpdateLifecycle", drpcEncoding_File_agent_proto_agent_proto{}, in, out)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *drpcAgentClient) BatchUpdateAppHealths(ctx context.Context, in *BatchUpdateAppHealthRequest) (*BatchUpdateAppHealthResponse, error) {
+	out := new(BatchUpdateAppHealthResponse)
+	err := c.cc.Invoke(ctx, "/coder.agent.v2.Agent/BatchUpdateAppHealths", drpcEncoding_File_agent_proto_agent_proto{}, in, out)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *drpcAgentClient) UpdateStartup(ctx context.Context, in *UpdateStartupRequest) (*Startup, error) {
+	out := new(Startup)
+	err := c.cc.Invoke(ctx, "/coder.agent.v2.Agent/UpdateStartup", drpcEncoding_File_agent_proto_agent_proto{}, in, out)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *drpcAgentClient) BatchUpdateMetadata(ctx context.Context, in *BatchUpdateMetadataRequest) (*BatchUpdateMetadataResponse, error) {
+	out := new(BatchUpdateMetadataResponse)
+	err := c.cc.Invoke(ctx, "/coder.agent.v2.Agent/BatchUpdateMetadata", drpcEncoding_File_agent_proto_agent_proto{}, in, out)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *drpcAgentClient) BatchCreateLogs(ctx context.Context, in *BatchCreateLogsRequest) (*BatchCreateLogsResponse, error) {
+	out := new(BatchCreateLogsResponse)
+	err := c.cc.Invoke(ctx, "/coder.agent.v2.Agent/BatchCreateLogs", drpcEncoding_File_agent_proto_agent_proto{}, in, out)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *drpcAgentClient) StreamDERPMaps(ctx context.Context, in *proto1.StreamDERPMapsRequest) (DRPCAgent_StreamDERPMapsClient, error) {
+	stream, err := c.cc.NewStream(ctx, "/coder.agent.v2.Agent/StreamDERPMaps", drpcEncoding_File_agent_proto_agent_proto{})
+	if err != nil {
+		return nil, err
+	}
+	x := &drpcAgent_StreamDERPMapsClient{stream}
+	if err := x.MsgSend(in, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
+		return nil, err
+	}
+	if err := x.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type DRPCAgent_StreamDERPMapsClient interface {
+	drpc.Stream
+	Recv() (*proto1.DERPMap, error)
+}
+
+type drpcAgent_StreamDERPMapsClient struct {
+	drpc.Stream
+}
+
+func (x *drpcAgent_StreamDERPMapsClient) GetStream() drpc.Stream {
+	return x.Stream
+}
+
+func (x *drpcAgent_StreamDERPMapsClient) Recv() (*proto1.DERPMap, error) {
+	m := new(proto1.DERPMap)
+	if err := x.MsgRecv(m, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (x *drpcAgent_StreamDERPMapsClient) RecvMsg(m *proto1.DERPMap) error {
+	return x.MsgRecv(m, drpcEncoding_File_agent_proto_agent_proto{})
+}
+
+func (c *drpcAgentClient) CoordinateTailnet(ctx context.Context) (DRPCAgent_CoordinateTailnetClient, error) {
+	stream, err := c.cc.NewStream(ctx, "/coder.agent.v2.Agent/CoordinateTailnet", drpcEncoding_File_agent_proto_agent_proto{})
+	if err != nil {
+		return nil, err
+	}
+	x := &drpcAgent_CoordinateTailnetClient{stream}
+	return x, nil
+}
+
+type DRPCAgent_CoordinateTailnetClient interface {
+	drpc.Stream
+	Send(*proto1.CoordinateRequest) error
+	Recv() (*proto1.CoordinateResponse, error)
+}
+
+type drpcAgent_CoordinateTailnetClient struct {
+	drpc.Stream
+}
+
+func (x *drpcAgent_CoordinateTailnetClient) GetStream() drpc.Stream {
+	return x.Stream
+}
+
+func (x *drpcAgent_CoordinateTailnetClient) Send(m *proto1.CoordinateRequest) error {
+	return x.MsgSend(m, drpcEncoding_File_agent_proto_agent_proto{})
+}
+
+func (x *drpcAgent_CoordinateTailnetClient) Recv() (*proto1.CoordinateResponse, error) {
+	m := new(proto1.CoordinateResponse)
+	if err := x.MsgRecv(m, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (x *drpcAgent_CoordinateTailnetClient) RecvMsg(m *proto1.CoordinateResponse) error {
+	return x.MsgRecv(m, drpcEncoding_File_agent_proto_agent_proto{})
+}
+
+type DRPCAgentServer interface {
+	GetManifest(context.Context, *GetManifestRequest) (*Manifest, error)
+	GetServiceBanner(context.Context, *GetServiceBannerRequest) (*ServiceBanner, error)
+	UpdateStats(context.Context, *UpdateStatsRequest) (*UpdateStatsResponse, error)
+	UpdateLifecycle(context.Context, *UpdateLifecycleRequest) (*Lifecycle, error)
+	BatchUpdateAppHealths(context.Context, *BatchUpdateAppHealthRequest) (*BatchUpdateAppHealthResponse, error)
+	UpdateStartup(context.Context, *UpdateStartupRequest) (*Startup, error)
+	BatchUpdateMetadata(context.Context, *BatchUpdateMetadataRequest) (*BatchUpdateMetadataResponse, error)
+	BatchCreateLogs(context.Context, *BatchCreateLogsRequest) (*BatchCreateLogsResponse, error)
+	StreamDERPMaps(*proto1.StreamDERPMapsRequest, DRPCAgent_StreamDERPMapsStream) error
+	CoordinateTailnet(DRPCAgent_CoordinateTailnetStream) error
+}
+
+type DRPCAgentUnimplementedServer struct{}
+
+func (s *DRPCAgentUnimplementedServer) GetManifest(context.Context, *GetManifestRequest) (*Manifest, error) {
+	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
+func (s *DRPCAgentUnimplementedServer) GetServiceBanner(context.Context, *GetServiceBannerRequest) (*ServiceBanner, error) {
+	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
+func (s *DRPCAgentUnimplementedServer) UpdateStats(context.Context, *UpdateStatsRequest) (*UpdateStatsResponse, error) {
+	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
+func (s *DRPCAgentUnimplementedServer) UpdateLifecycle(context.Context, *UpdateLifecycleRequest) (*Lifecycle, error) {
+	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
+func (s *DRPCAgentUnimplementedServer) BatchUpdateAppHealths(context.Context, *BatchUpdateAppHealthRequest) (*BatchUpdateAppHealthResponse, error) {
+	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
+func (s *DRPCAgentUnimplementedServer) UpdateStartup(context.Context, *UpdateStartupRequest) (*Startup, error) {
+	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
+func (s *DRPCAgentUnimplementedServer) BatchUpdateMetadata(context.Context, *BatchUpdateMetadataRequest) (*BatchUpdateMetadataResponse, error) {
+	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
+func (s *DRPCAgentUnimplementedServer) BatchCreateLogs(context.Context, *BatchCreateLogsRequest) (*BatchCreateLogsResponse, error) {
+	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
+func (s *DRPCAgentUnimplementedServer) StreamDERPMaps(*proto1.StreamDERPMapsRequest, DRPCAgent_StreamDERPMapsStream) error {
+	return drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
+func (s *DRPCAgentUnimplementedServer) CoordinateTailnet(DRPCAgent_CoordinateTailnetStream) error {
+	return drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
+type DRPCAgentDescription struct{}
+
+func (DRPCAgentDescription) NumMethods() int { return 10 }
+
+func (DRPCAgentDescription) Method(n int) (string, drpc.Encoding, drpc.Receiver, interface{}, bool) {
+	switch n {
+	case 0:
+		return "/coder.agent.v2.Agent/GetManifest", drpcEncoding_File_agent_proto_agent_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return srv.(DRPCAgentServer).
+					GetManifest(
+						ctx,
+						in1.(*GetManifestRequest),
+					)
+			}, DRPCAgentServer.GetManifest, true
+	case 1:
+		return "/coder.agent.v2.Agent/GetServiceBanner", drpcEncoding_File_agent_proto_agent_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return srv.(DRPCAgentServer).
+					GetServiceBanner(
+						ctx,
+						in1.(*GetServiceBannerRequest),
+					)
+			}, DRPCAgentServer.GetServiceBanner, true
+	case 2:
+		return "/coder.agent.v2.Agent/UpdateStats", drpcEncoding_File_agent_proto_agent_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return srv.(DRPCAgentServer).
+					UpdateStats(
+						ctx,
+						in1.(*UpdateStatsRequest),
+					)
+			}, DRPCAgentServer.UpdateStats, true
+	case 3:
+		return "/coder.agent.v2.Agent/UpdateLifecycle", drpcEncoding_File_agent_proto_agent_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return srv.(DRPCAgentServer).
+					UpdateLifecycle(
+						ctx,
+						in1.(*UpdateLifecycleRequest),
+					)
+			}, DRPCAgentServer.UpdateLifecycle, true
+	case 4:
+		return "/coder.agent.v2.Agent/BatchUpdateAppHealths", drpcEncoding_File_agent_proto_agent_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return srv.(DRPCAgentServer).
+					BatchUpdateAppHealths(
+						ctx,
+						in1.(*BatchUpdateAppHealthRequest),
+					)
+			}, DRPCAgentServer.BatchUpdateAppHealths, true
+	case 5:
+		return "/coder.agent.v2.Agent/UpdateStartup", drpcEncoding_File_agent_proto_agent_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return srv.(DRPCAgentServer).
+					UpdateStartup(
+						ctx,
+						in1.(*UpdateStartupRequest),
+					)
+			}, DRPCAgentServer.UpdateStartup, true
+	case 6:
+		return "/coder.agent.v2.Agent/BatchUpdateMetadata", drpcEncoding_File_agent_proto_agent_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return srv.(DRPCAgentServer).
+					BatchUpdateMetadata(
+						ctx,
+						in1.(*BatchUpdateMetadataRequest),
+					)
+			}, DRPCAgentServer.BatchUpdateMetadata, true
+	case 7:
+		return "/coder.agent.v2.Agent/BatchCreateLogs", drpcEncoding_File_agent_proto_agent_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return srv.(DRPCAgentServer).
+					BatchCreateLogs(
+						ctx,
+						in1.(*BatchCreateLogsRequest),
+					)
+			}, DRPCAgentServer.BatchCreateLogs, true
+	case 8:
+		return "/coder.agent.v2.Agent/StreamDERPMaps", drpcEncoding_File_agent_proto_agent_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return nil, srv.(DRPCAgentServer).
+					StreamDERPMaps(
+						in1.(*proto1.StreamDERPMapsRequest),
+						&drpcAgent_StreamDERPMapsStream{in2.(drpc.Stream)},
+					)
+			}, DRPCAgentServer.StreamDERPMaps, true
+	case 9:
+		return "/coder.agent.v2.Agent/CoordinateTailnet", drpcEncoding_File_agent_proto_agent_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return nil, srv.(DRPCAgentServer).
+					CoordinateTailnet(
+						&drpcAgent_CoordinateTailnetStream{in1.(drpc.Stream)},
+					)
+			}, DRPCAgentServer.CoordinateTailnet, true
+	default:
+		return "", nil, nil, nil, false
+	}
+}
+
+func DRPCRegisterAgent(mux drpc.Mux, impl DRPCAgentServer) error {
+	return mux.Register(impl, DRPCAgentDescription{})
+}
+
+type DRPCAgent_GetManifestStream interface {
+	drpc.Stream
+	SendAndClose(*Manifest) error
+}
+
+type drpcAgent_GetManifestStream struct {
+	drpc.Stream
+}
+
+func (x *drpcAgent_GetManifestStream) SendAndClose(m *Manifest) error {
+	if err := x.MsgSend(m, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
+		return err
+	}
+	return x.CloseSend()
+}
+
+type DRPCAgent_GetServiceBannerStream interface {
+	drpc.Stream
+	SendAndClose(*ServiceBanner) error
+}
+
+type drpcAgent_GetServiceBannerStream struct {
+	drpc.Stream
+}
+
+func (x *drpcAgent_GetServiceBannerStream) SendAndClose(m *ServiceBanner) error {
+	if err := x.MsgSend(m, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
+		return err
+	}
+	return x.CloseSend()
+}
+
+type DRPCAgent_UpdateStatsStream interface {
+	drpc.Stream
+	SendAndClose(*UpdateStatsResponse) error
+}
+
+type drpcAgent_UpdateStatsStream struct {
+	drpc.Stream
+}
+
+func (x *drpcAgent_UpdateStatsStream) SendAndClose(m *UpdateStatsResponse) error {
+	if err := x.MsgSend(m, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
+		return err
+	}
+	return x.CloseSend()
+}
+
+type DRPCAgent_UpdateLifecycleStream interface {
+	drpc.Stream
+	SendAndClose(*Lifecycle) error
+}
+
+type drpcAgent_UpdateLifecycleStream struct {
+	drpc.Stream
+}
+
+func (x *drpcAgent_UpdateLifecycleStream) SendAndClose(m *Lifecycle) error {
+	if err := x.MsgSend(m, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
+		return err
+	}
+	return x.CloseSend()
+}
+
+type DRPCAgent_BatchUpdateAppHealthsStream interface {
+	drpc.Stream
+	SendAndClose(*BatchUpdateAppHealthResponse) error
+}
+
+type drpcAgent_BatchUpdateAppHealthsStream struct {
+	drpc.Stream
+}
+
+func (x *drpcAgent_BatchUpdateAppHealthsStream) SendAndClose(m *BatchUpdateAppHealthResponse) error {
+	if err := x.MsgSend(m, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
+		return err
+	}
+	return x.CloseSend()
+}
+
+type DRPCAgent_UpdateStartupStream interface {
+	drpc.Stream
+	SendAndClose(*Startup) error
+}
+
+type drpcAgent_UpdateStartupStream struct {
+	drpc.Stream
+}
+
+func (x *drpcAgent_UpdateStartupStream) SendAndClose(m *Startup) error {
+	if err := x.MsgSend(m, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
+		return err
+	}
+	return x.CloseSend()
+}
+
+type DRPCAgent_BatchUpdateMetadataStream interface {
+	drpc.Stream
+	SendAndClose(*BatchUpdateMetadataResponse) error
+}
+
+type drpcAgent_BatchUpdateMetadataStream struct {
+	drpc.Stream
+}
+
+func (x *drpcAgent_BatchUpdateMetadataStream) SendAndClose(m *BatchUpdateMetadataResponse) error {
+	if err := x.MsgSend(m, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
+		return err
+	}
+	return x.CloseSend()
+}
+
+type DRPCAgent_BatchCreateLogsStream interface {
+	drpc.Stream
+	SendAndClose(*BatchCreateLogsResponse) error
+}
+
+type drpcAgent_BatchCreateLogsStream struct {
+	drpc.Stream
+}
+
+func (x *drpcAgent_BatchCreateLogsStream) SendAndClose(m *BatchCreateLogsResponse) error {
+	if err := x.MsgSend(m, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
+		return err
+	}
+	return x.CloseSend()
+}
+
+type DRPCAgent_StreamDERPMapsStream interface {
+	drpc.Stream
+	Send(*proto1.DERPMap) error
+}
+
+type drpcAgent_StreamDERPMapsStream struct {
+	drpc.Stream
+}
+
+func (x *drpcAgent_StreamDERPMapsStream) Send(m *proto1.DERPMap) error {
+	return x.MsgSend(m, drpcEncoding_File_agent_proto_agent_proto{})
+}
+
+type DRPCAgent_CoordinateTailnetStream interface {
+	drpc.Stream
+	Send(*proto1.CoordinateResponse) error
+	Recv() (*proto1.CoordinateRequest, error)
+}
+
+type drpcAgent_CoordinateTailnetStream struct {
+	drpc.Stream
+}
+
+func (x *drpcAgent_CoordinateTailnetStream) Send(m *proto1.CoordinateResponse) error {
+	return x.MsgSend(m, drpcEncoding_File_agent_proto_agent_proto{})
+}
+
+func (x *drpcAgent_CoordinateTailnetStream) Recv() (*proto1.CoordinateRequest, error) {
+	m := new(proto1.CoordinateRequest)
+	if err := x.MsgRecv(m, drpcEncoding_File_agent_proto_agent_proto{}); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (x *drpcAgent_CoordinateTailnetStream) RecvMsg(m *proto1.CoordinateRequest) error {
+	return x.MsgRecv(m, drpcEncoding_File_agent_proto_agent_proto{})
+}
diff --git a/agent/reaper/reaper_test.go b/agent/reaper/reaper_test.go
index 0509edb382c6b..84246fba0619b 100644
--- a/agent/reaper/reaper_test.go
+++ b/agent/reaper/reaper_test.go
@@ -14,8 +14,8 @@ import (
 	"github.com/hashicorp/go-reap"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/agent/reaper"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/reaper"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // TestReap checks that's the reaper is successfully reaping
diff --git a/agent/reconnectingpty/buffered.go b/agent/reconnectingpty/buffered.go
new file mode 100644
index 0000000000000..d53b22ffe2153
--- /dev/null
+++ b/agent/reconnectingpty/buffered.go
@@ -0,0 +1,241 @@
+package reconnectingpty
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"time"
+
+	"github.com/armon/circbuf"
+	"github.com/prometheus/client_golang/prometheus"
+	"golang.org/x/exp/slices"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/pty"
+)
+
+// bufferedReconnectingPTY provides a reconnectable PTY by using a ring buffer to store
+// scrollback.
+type bufferedReconnectingPTY struct {
+	command *pty.Cmd
+
+	activeConns    map[string]net.Conn
+	circularBuffer *circbuf.Buffer
+
+	ptty    pty.PTYCmd
+	process pty.Process
+
+	metrics *prometheus.CounterVec
+
+	state *ptyState
+	// timer will close the reconnecting pty when it expires.  The timer will be
+	// reset as long as there are active connections.
+	timer   *time.Timer
+	timeout time.Duration
+}
+
+// newBuffered starts the buffered pty.  If the context ends the process will be
+// killed.
+func newBuffered(ctx context.Context, cmd *pty.Cmd, options *Options, logger slog.Logger) *bufferedReconnectingPTY {
+	rpty := &bufferedReconnectingPTY{
+		activeConns: map[string]net.Conn{},
+		command:     cmd,
+		metrics:     options.Metrics,
+		state:       newState(),
+		timeout:     options.Timeout,
+	}
+
+	// Default to buffer 64KiB.
+	circularBuffer, err := circbuf.NewBuffer(64 << 10)
+	if err != nil {
+		rpty.state.setState(StateDone, xerrors.Errorf("create circular buffer: %w", err))
+		return rpty
+	}
+	rpty.circularBuffer = circularBuffer
+
+	// Add TERM then start the command with a pty.  pty.Cmd duplicates Path as the
+	// first argument so remove it.
+	cmdWithEnv := pty.CommandContext(ctx, cmd.Path, cmd.Args[1:]...)
+	cmdWithEnv.Env = append(rpty.command.Env, "TERM=xterm-256color")
+	cmdWithEnv.Dir = rpty.command.Dir
+	ptty, process, err := pty.Start(cmdWithEnv)
+	if err != nil {
+		rpty.state.setState(StateDone, xerrors.Errorf("start pty: %w", err))
+		return rpty
+	}
+	rpty.ptty = ptty
+	rpty.process = process
+
+	go rpty.lifecycle(ctx, logger)
+
+	// Multiplex the output onto the circular buffer and each active connection.
+	// We do not need to separately monitor for the process exiting.  When it
+	// exits, our ptty.OutputReader() will return EOF after reading all process
+	// output.
+	go func() {
+		buffer := make([]byte, 1024)
+		for {
+			read, err := ptty.OutputReader().Read(buffer)
+			if err != nil {
+				// When the PTY is closed, this is triggered.
+				// Error is typically a benign EOF, so only log for debugging.
+				if errors.Is(err, io.EOF) {
+					logger.Debug(ctx, "unable to read pty output, command might have exited", slog.Error(err))
+				} else {
+					logger.Warn(ctx, "unable to read pty output, command might have exited", slog.Error(err))
+					rpty.metrics.WithLabelValues("output_reader").Add(1)
+				}
+				// Could have been killed externally or failed to start at all (command
+				// not found for example).
+				// TODO: Should we check the process's exit code in case the command was
+				//       invalid?
+				rpty.Close(nil)
+				break
+			}
+			part := buffer[:read]
+			rpty.state.cond.L.Lock()
+			_, err = rpty.circularBuffer.Write(part)
+			if err != nil {
+				logger.Error(ctx, "write to circular buffer", slog.Error(err))
+				rpty.metrics.WithLabelValues("write_buffer").Add(1)
+			}
+			// TODO: Instead of ranging over a map, could we send the output to a
+			// channel and have each individual Attach read from that?
+			for cid, conn := range rpty.activeConns {
+				_, err = conn.Write(part)
+				if err != nil {
+					logger.Warn(ctx,
+						"error writing to active connection",
+						slog.F("connection_id", cid),
+						slog.Error(err),
+					)
+					rpty.metrics.WithLabelValues("write").Add(1)
+				}
+			}
+			rpty.state.cond.L.Unlock()
+		}
+	}()
+
+	return rpty
+}
+
+// lifecycle manages the lifecycle of the reconnecting pty.  If the context ends
+// or the reconnecting pty closes the pty will be shut down.
+func (rpty *bufferedReconnectingPTY) lifecycle(ctx context.Context, logger slog.Logger) {
+	rpty.timer = time.AfterFunc(attachTimeout, func() {
+		rpty.Close(xerrors.New("reconnecting pty timeout"))
+	})
+
+	logger.Debug(ctx, "reconnecting pty ready")
+	rpty.state.setState(StateReady, nil)
+
+	state, reasonErr := rpty.state.waitForStateOrContext(ctx, StateClosing)
+	if state < StateClosing {
+		// If we have not closed yet then the context is what unblocked us (which
+		// means the agent is shutting down) so move into the closing phase.
+		rpty.Close(reasonErr)
+	}
+	rpty.timer.Stop()
+
+	rpty.state.cond.L.Lock()
+	// Log these closes only for debugging since the connections or processes
+	// might have already closed on their own.
+	for _, conn := range rpty.activeConns {
+		err := conn.Close()
+		if err != nil {
+			logger.Debug(ctx, "closed conn with error", slog.Error(err))
+		}
+	}
+	// Connections get removed once they close but it is possible there is still
+	// some data that will be written before that happens so clear the map now to
+	// avoid writing to closed connections.
+	rpty.activeConns = map[string]net.Conn{}
+	rpty.state.cond.L.Unlock()
+
+	// Log close/kill only for debugging since the process might have already
+	// closed on its own.
+	err := rpty.ptty.Close()
+	if err != nil {
+		logger.Debug(ctx, "closed ptty with error", slog.Error(err))
+	}
+
+	err = rpty.process.Kill()
+	if err != nil {
+		logger.Debug(ctx, "killed process with error", slog.Error(err))
+	}
+
+	logger.Info(ctx, "closed reconnecting pty")
+	rpty.state.setState(StateDone, reasonErr)
+}
+
+func (rpty *bufferedReconnectingPTY) Attach(ctx context.Context, connID string, conn net.Conn, height, width uint16, logger slog.Logger) error {
+	logger.Info(ctx, "attach to reconnecting pty")
+
+	// This will kill the heartbeat once we hit EOF or an error.
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	err := rpty.doAttach(connID, conn)
+	if err != nil {
+		return err
+	}
+
+	defer func() {
+		rpty.state.cond.L.Lock()
+		defer rpty.state.cond.L.Unlock()
+		delete(rpty.activeConns, connID)
+	}()
+
+	state, err := rpty.state.waitForStateOrContext(ctx, StateReady)
+	if state != StateReady {
+		return err
+	}
+
+	go heartbeat(ctx, rpty.timer, rpty.timeout)
+
+	// Resize the PTY to initial height + width.
+	err = rpty.ptty.Resize(height, width)
+	if err != nil {
+		// We can continue after this, it's not fatal!
+		logger.Warn(ctx, "reconnecting PTY initial resize failed, but will continue", slog.Error(err))
+		rpty.metrics.WithLabelValues("resize").Add(1)
+	}
+
+	// Pipe conn -> pty and block.  pty -> conn is handled in newBuffered().
+	readConnLoop(ctx, conn, rpty.ptty, rpty.metrics, logger)
+	return nil
+}
+
+// doAttach adds the connection to the map and replays the buffer.  It exists
+// separately only for convenience to defer the mutex unlock which is not
+// possible in Attach since it blocks.
+func (rpty *bufferedReconnectingPTY) doAttach(connID string, conn net.Conn) error {
+	rpty.state.cond.L.Lock()
+	defer rpty.state.cond.L.Unlock()
+
+	// Write any previously stored data for the TTY.  Since the command might be
+	// short-lived and have already exited, make sure we always at least output
+	// the buffer before returning, mostly just so tests pass.
+	prevBuf := slices.Clone(rpty.circularBuffer.Bytes())
+	_, err := conn.Write(prevBuf)
+	if err != nil {
+		rpty.metrics.WithLabelValues("write").Add(1)
+		return xerrors.Errorf("write buffer to conn: %w", err)
+	}
+
+	rpty.activeConns[connID] = conn
+
+	return nil
+}
+
+func (rpty *bufferedReconnectingPTY) Wait() {
+	_, _ = rpty.state.waitForState(StateClosing)
+}
+
+func (rpty *bufferedReconnectingPTY) Close(error error) {
+	// The closing state change will be handled by the lifecycle.
+	rpty.state.setState(StateClosing, error)
+}
diff --git a/agent/reconnectingpty/reconnectingpty.go b/agent/reconnectingpty/reconnectingpty.go
new file mode 100644
index 0000000000000..280cf62aaa841
--- /dev/null
+++ b/agent/reconnectingpty/reconnectingpty.go
@@ -0,0 +1,226 @@
+package reconnectingpty
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net"
+	"os/exec"
+	"runtime"
+	"sync"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty"
+)
+
+// attachTimeout is the initial timeout for attaching and will probably be far
+// shorter than the reconnect timeout in most cases; in tests it might be
+// longer.  It should be at least long enough for the first screen attach to be
+// able to start up the daemon and for the buffered pty to start.
+const attachTimeout = 30 * time.Second
+
+// Options allows configuring the reconnecting pty.
+type Options struct {
+	// Timeout describes how long to keep the pty alive without any connections.
+	// Once elapsed the pty will be killed.
+	Timeout time.Duration
+	// Metrics tracks various error counters.
+	Metrics *prometheus.CounterVec
+}
+
+// ReconnectingPTY is a pty that can be reconnected within a timeout and to
+// simultaneous connections.  The reconnecting pty can be backed by screen if
+// installed or a (buggy) buffer replay fallback.
+type ReconnectingPTY interface {
+	// Attach pipes the connection and pty, spawning it if necessary, replays
+	// history, then blocks until EOF, an error, or the context's end.  The
+	// connection is expected to send JSON-encoded messages and accept raw output
+	// from the ptty.  If the context ends or the process dies the connection will
+	// be detached.
+	Attach(ctx context.Context, connID string, conn net.Conn, height, width uint16, logger slog.Logger) error
+	// Wait waits for the reconnecting pty to close.  The underlying process might
+	// still be exiting.
+	Wait()
+	// Close kills the reconnecting pty process.
+	Close(err error)
+}
+
+// New sets up a new reconnecting pty that wraps the provided command.  Any
+// errors with starting are returned on Attach().  The reconnecting pty will
+// close itself (and all connections to it) if nothing is attached for the
+// duration of the timeout, if the context ends, or the process exits (buffered
+// backend only).
+func New(ctx context.Context, cmd *pty.Cmd, options *Options, logger slog.Logger) ReconnectingPTY {
+	if options.Timeout == 0 {
+		options.Timeout = 5 * time.Minute
+	}
+	// Screen seems flaky on Darwin.  Locally the tests pass 100% of the time (100
+	// runs) but in CI screen often incorrectly claims the session name does not
+	// exist even though screen -list shows it.  For now, restrict screen to
+	// Linux.
+	backendType := "buffered"
+	if runtime.GOOS == "linux" {
+		_, err := exec.LookPath("screen")
+		if err == nil {
+			backendType = "screen"
+		}
+	}
+
+	logger.Info(ctx, "start reconnecting pty", slog.F("backend_type", backendType))
+
+	switch backendType {
+	case "screen":
+		return newScreen(ctx, cmd, options, logger)
+	default:
+		return newBuffered(ctx, cmd, options, logger)
+	}
+}
+
+// heartbeat resets timer before timeout elapses and blocks until ctx ends.
+func heartbeat(ctx context.Context, timer *time.Timer, timeout time.Duration) {
+	// Reset now in case it is near the end.
+	timer.Reset(timeout)
+
+	// Reset when the context ends to ensure the pty stays up for the full
+	// timeout.
+	defer timer.Reset(timeout)
+
+	heartbeat := time.NewTicker(timeout / 2)
+	defer heartbeat.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-heartbeat.C:
+			timer.Reset(timeout)
+		}
+	}
+}
+
+// State represents the current state of the reconnecting pty.  States are
+// sequential and will only move forward.
+type State int
+
+const (
+	// StateStarting is the default/start state.  Attaching will block until the
+	// reconnecting pty becomes ready.
+	StateStarting = iota
+	// StateReady means the reconnecting pty is ready to be attached.
+	StateReady
+	// StateClosing means the reconnecting pty has begun closing.  The underlying
+	// process may still be exiting.  Attaching will result in an error.
+	StateClosing
+	// StateDone means the reconnecting pty has completely shut down and the
+	// process has exited.  Attaching will result in an error.
+	StateDone
+)
+
+// ptyState is a helper for tracking the reconnecting PTY's state.
+type ptyState struct {
+	// cond broadcasts state changes and any accompanying errors.
+	cond *sync.Cond
+	// error describes the error that caused the state change, if there was one.
+	// It is not safe to access outside of cond.L.
+	error error
+	// state holds the current reconnecting pty state.  It is not safe to access
+	// this outside of cond.L.
+	state State
+}
+
+func newState() *ptyState {
+	return &ptyState{
+		cond:  sync.NewCond(&sync.Mutex{}),
+		state: StateStarting,
+	}
+}
+
+// setState sets and broadcasts the provided state if it is greater than the
+// current state and the error if one has not already been set.
+func (s *ptyState) setState(state State, err error) {
+	s.cond.L.Lock()
+	defer s.cond.L.Unlock()
+	// Cannot regress states.  For example, trying to close after the process is
+	// done should leave us in the done state and not the closing state.
+	if state <= s.state {
+		return
+	}
+	s.error = err
+	s.state = state
+	s.cond.Broadcast()
+}
+
+// waitForState blocks until the state or a greater one is reached.
+func (s *ptyState) waitForState(state State) (State, error) {
+	s.cond.L.Lock()
+	defer s.cond.L.Unlock()
+	for state > s.state {
+		s.cond.Wait()
+	}
+	return s.state, s.error
+}
+
+// waitForStateOrContext blocks until the state or a greater one is reached or
+// the provided context ends.
+func (s *ptyState) waitForStateOrContext(ctx context.Context, state State) (State, error) {
+	s.cond.L.Lock()
+	defer s.cond.L.Unlock()
+
+	nevermind := make(chan struct{})
+	defer close(nevermind)
+	go func() {
+		select {
+		case <-ctx.Done():
+			// Wake up when the context ends.
+			s.cond.Broadcast()
+		case <-nevermind:
+		}
+	}()
+
+	for ctx.Err() == nil && state > s.state {
+		s.cond.Wait()
+	}
+	if ctx.Err() != nil {
+		return s.state, ctx.Err()
+	}
+	return s.state, s.error
+}
+
+// readConnLoop reads messages from conn and writes to ptty as needed.  Blocks
+// until EOF or an error writing to ptty or reading from conn.
+func readConnLoop(ctx context.Context, conn net.Conn, ptty pty.PTYCmd, metrics *prometheus.CounterVec, logger slog.Logger) {
+	decoder := json.NewDecoder(conn)
+	for {
+		var req codersdk.ReconnectingPTYRequest
+		err := decoder.Decode(&req)
+		if xerrors.Is(err, io.EOF) {
+			return
+		}
+		if err != nil {
+			logger.Warn(ctx, "reconnecting pty failed with read error", slog.Error(err))
+			return
+		}
+		_, err = ptty.InputWriter().Write([]byte(req.Data))
+		if err != nil {
+			logger.Warn(ctx, "reconnecting pty failed with write error", slog.Error(err))
+			metrics.WithLabelValues("input_writer").Add(1)
+			return
+		}
+		// Check if a resize needs to happen!
+		if req.Height == 0 || req.Width == 0 {
+			continue
+		}
+		err = ptty.Resize(req.Height, req.Width)
+		if err != nil {
+			// We can continue after this, it's not fatal!
+			logger.Warn(ctx, "reconnecting pty resize failed, but will continue", slog.Error(err))
+			metrics.WithLabelValues("resize").Add(1)
+		}
+	}
+}
diff --git a/agent/reconnectingpty/screen.go b/agent/reconnectingpty/screen.go
new file mode 100644
index 0000000000000..3d0f7b2ef52d9
--- /dev/null
+++ b/agent/reconnectingpty/screen.go
@@ -0,0 +1,389 @@
+package reconnectingpty
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"io"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gliderlabs/ssh"
+	"github.com/prometheus/client_golang/prometheus"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+	"github.com/coder/coder/v2/pty"
+)
+
+// screenReconnectingPTY provides a reconnectable PTY via `screen`.
+type screenReconnectingPTY struct {
+	command *pty.Cmd
+
+	// id holds the id of the session for both creating and attaching.  This will
+	// be generated uniquely for each session because without control of the
+	// screen daemon we do not have its PID and without the PID screen will do
+	// partial matching.  Enforcing a unique ID should guarantee we match on the
+	// right session.
+	id string
+
+	// mutex prevents concurrent attaches to the session.  Screen will happily
+	// spawn two separate sessions with the same name if multiple attaches happen
+	// in a close enough interval.  We are not able to control the screen daemon
+	// ourselves to prevent this because the daemon will spawn with a hardcoded
+	// 24x80 size which results in confusing padding above the prompt once the
+	// attach comes in and resizes.
+	mutex sync.Mutex
+
+	configFile string
+
+	metrics *prometheus.CounterVec
+
+	state *ptyState
+	// timer will close the reconnecting pty when it expires.  The timer will be
+	// reset as long as there are active connections.
+	timer   *time.Timer
+	timeout time.Duration
+}
+
+// newScreen creates a new screen-backed reconnecting PTY.  It writes config
+// settings and creates the socket directory.  If we could, we would want to
+// spawn the daemon here and attach each connection to it but since doing that
+// spawns the daemon with a hardcoded 24x80 size it is not a very good user
+// experience.  Instead we will let the attach command spawn the daemon on its
+// own which causes it to spawn with the specified size.
+func newScreen(ctx context.Context, cmd *pty.Cmd, options *Options, logger slog.Logger) *screenReconnectingPTY {
+	rpty := &screenReconnectingPTY{
+		command: cmd,
+		metrics: options.Metrics,
+		state:   newState(),
+		timeout: options.Timeout,
+	}
+
+	go rpty.lifecycle(ctx, logger)
+
+	// Socket paths are limited to around 100 characters on Linux and macOS which
+	// depending on the temporary directory can be a problem.  To give more leeway
+	// use a short ID.
+	buf := make([]byte, 4)
+	_, err := rand.Read(buf)
+	if err != nil {
+		rpty.state.setState(StateDone, xerrors.Errorf("generate screen id: %w", err))
+		return rpty
+	}
+	rpty.id = hex.EncodeToString(buf)
+
+	settings := []string{
+		// Tell screen not to handle motion for xterm* terminals which allows
+		// scrolling the terminal via the mouse wheel or scroll bar (by default
+		// screen uses it to cycle through the command history).  There does not
+		// seem to be a way to make screen itself scroll on mouse wheel.  tmux can
+		// do it but then there is no scroll bar and it kicks you into copy mode
+		// where keys stop working until you exit copy mode which seems like it
+		// could be confusing.
+		"termcapinfo xterm* ti@:te@",
+		// Enable alternate screen emulation otherwise applications get rendered in
+		// the current window which wipes out visible output resulting in missing
+		// output when scrolling back with the mouse wheel (copy mode still works
+		// since that is screen itself scrolling).
+		"altscreen on",
+		// Remap the control key to C-s since C-a may be used in applications.  C-s
+		// is chosen because it cannot actually be used because by default it will
+		// pause and C-q to resume will just kill the browser window.  We may not
+		// want people using the control key anyway since it will not be obvious
+		// they are in screen and doing things like switching windows makes mouse
+		// wheel scroll wonky due to the terminal doing the scrolling rather than
+		// screen itself (but again copy mode will work just fine).
+		"escape ^Ss",
+	}
+
+	rpty.configFile = filepath.Join(os.TempDir(), "coder-screen", "config")
+	err = os.MkdirAll(filepath.Dir(rpty.configFile), 0o700)
+	if err != nil {
+		rpty.state.setState(StateDone, xerrors.Errorf("make screen config dir: %w", err))
+		return rpty
+	}
+
+	err = os.WriteFile(rpty.configFile, []byte(strings.Join(settings, "\n")), 0o600)
+	if err != nil {
+		rpty.state.setState(StateDone, xerrors.Errorf("create config file: %w", err))
+		return rpty
+	}
+
+	return rpty
+}
+
+// lifecycle manages the lifecycle of the reconnecting pty.  If the context ends
+// the reconnecting pty will be closed.
+func (rpty *screenReconnectingPTY) lifecycle(ctx context.Context, logger slog.Logger) {
+	rpty.timer = time.AfterFunc(attachTimeout, func() {
+		rpty.Close(xerrors.New("reconnecting pty timeout"))
+	})
+
+	logger.Debug(ctx, "reconnecting pty ready")
+	rpty.state.setState(StateReady, nil)
+
+	state, reasonErr := rpty.state.waitForStateOrContext(ctx, StateClosing)
+	if state < StateClosing {
+		// If we have not closed yet then the context is what unblocked us (which
+		// means the agent is shutting down) so move into the closing phase.
+		rpty.Close(reasonErr)
+	}
+	rpty.timer.Stop()
+
+	// If the command errors that the session is already gone that is fine.
+	err := rpty.sendCommand(context.Background(), "quit", []string{"No screen session found"})
+	if err != nil {
+		logger.Error(ctx, "close screen session", slog.Error(err))
+	}
+
+	logger.Info(ctx, "closed reconnecting pty")
+	rpty.state.setState(StateDone, reasonErr)
+}
+
+func (rpty *screenReconnectingPTY) Attach(ctx context.Context, _ string, conn net.Conn, height, width uint16, logger slog.Logger) error {
+	logger.Info(ctx, "attach to reconnecting pty")
+
+	// This will kill the heartbeat once we hit EOF or an error.
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	state, err := rpty.state.waitForStateOrContext(ctx, StateReady)
+	if state != StateReady {
+		return err
+	}
+
+	go heartbeat(ctx, rpty.timer, rpty.timeout)
+
+	ptty, process, err := rpty.doAttach(ctx, conn, height, width, logger)
+	if err != nil {
+		if errors.Is(err, context.Canceled) {
+			// Likely the process was too short-lived and canceled the version command.
+			// TODO: Is it worth distinguishing between that and a cancel from the
+			//       Attach() caller?  Additionally, since this could also happen if
+			//       the command was invalid, should we check the process's exit code?
+			return nil
+		}
+		return err
+	}
+
+	defer func() {
+		// Log only for debugging since the process might have already exited on its
+		// own.
+		err := ptty.Close()
+		if err != nil {
+			logger.Debug(ctx, "closed ptty with error", slog.Error(err))
+		}
+		err = process.Kill()
+		if err != nil {
+			logger.Debug(ctx, "killed process with error", slog.Error(err))
+		}
+	}()
+
+	// Pipe conn -> pty and block.
+	readConnLoop(ctx, conn, ptty, rpty.metrics, logger)
+	return nil
+}
+
+// doAttach spawns the screen client and starts the heartbeat.  It exists
+// separately only so we can defer the mutex unlock which is not possible in
+// Attach since it blocks.
+func (rpty *screenReconnectingPTY) doAttach(ctx context.Context, conn net.Conn, height, width uint16, logger slog.Logger) (pty.PTYCmd, pty.Process, error) {
+	// Ensure another attach does not come in and spawn a duplicate session.
+	rpty.mutex.Lock()
+	defer rpty.mutex.Unlock()
+
+	logger.Debug(ctx, "spawning screen client", slog.F("screen_id", rpty.id))
+
+	// Wrap the command with screen and tie it to the connection's context.
+	cmd := pty.CommandContext(ctx, "screen", append([]string{
+		// -S is for setting the session's name.
+		"-S", rpty.id,
+		// -U tells screen to use UTF-8 encoding.
+		// -x allows attaching to an already attached session.
+		// -RR reattaches to the daemon or creates the session daemon if missing.
+		// -q disables the "New screen..." message that appears for five seconds
+		//    when creating a new session with -RR.
+		// -c is the flag for the config file.
+		"-UxRRqc", rpty.configFile,
+		rpty.command.Path,
+		// pty.Cmd duplicates Path as the first argument so remove it.
+	}, rpty.command.Args[1:]...)...)
+	cmd.Env = append(rpty.command.Env, "TERM=xterm-256color")
+	cmd.Dir = rpty.command.Dir
+	ptty, process, err := pty.Start(cmd, pty.WithPTYOption(
+		pty.WithSSHRequest(ssh.Pty{
+			Window: ssh.Window{
+				// Make sure to spawn at the right size because if we resize afterward it
+				// leaves confusing padding (screen will resize such that the screen
+				// contents are aligned to the bottom).
+				Height: int(height),
+				Width:  int(width),
+			},
+		}),
+	))
+	if err != nil {
+		rpty.metrics.WithLabelValues("screen_spawn").Add(1)
+		return nil, nil, err
+	}
+
+	// This context lets us abort the version command if the process dies.
+	versionCtx, versionCancel := context.WithCancel(ctx)
+	defer versionCancel()
+
+	// Pipe pty -> conn and close the connection when the process exits.
+	// We do not need to separately monitor for the process exiting.  When it
+	// exits, our ptty.OutputReader() will return EOF after reading all process
+	// output.
+	go func() {
+		defer versionCancel()
+		defer func() {
+			err := conn.Close()
+			if err != nil {
+				// Log only for debugging since the connection might have already closed
+				// on its own.
+				logger.Debug(ctx, "closed connection with error", slog.Error(err))
+			}
+		}()
+		buffer := make([]byte, 1024)
+		for {
+			read, err := ptty.OutputReader().Read(buffer)
+			if err != nil {
+				// When the PTY is closed, this is triggered.
+				// Error is typically a benign EOF, so only log for debugging.
+				if errors.Is(err, io.EOF) {
+					logger.Debug(ctx, "unable to read pty output; screen might have exited", slog.Error(err))
+				} else {
+					logger.Warn(ctx, "unable to read pty output; screen might have exited", slog.Error(err))
+					rpty.metrics.WithLabelValues("screen_output_reader").Add(1)
+				}
+				// The process might have died because the session itself died or it
+				// might have been separately killed and the session is still up (for
+				// example `exit` or we killed it when the connection closed).  If the
+				// session is still up we might leave the reconnecting pty in memory
+				// around longer than it needs to be but it will eventually clean up
+				// with the timer or context, or the next attach will respawn the screen
+				// daemon which is fine too.
+				break
+			}
+			part := buffer[:read]
+			_, err = conn.Write(part)
+			if err != nil {
+				// Connection might have been closed.
+				if errors.Unwrap(err).Error() != "endpoint is closed for send" {
+					logger.Warn(ctx, "error writing to active conn", slog.Error(err))
+					rpty.metrics.WithLabelValues("screen_write").Add(1)
+				}
+				break
+			}
+		}
+	}()
+
+	// Version seems to be the only command without a side effect (other than
+	// making the version pop up briefly) so use it to wait for the session to
+	// come up.  If we do not wait we could end up spawning multiple sessions with
+	// the same name.
+	err = rpty.sendCommand(versionCtx, "version", nil)
+	if err != nil {
+		// Log only for debugging since the process might already have closed.
+		closeErr := ptty.Close()
+		if closeErr != nil {
+			logger.Debug(ctx, "closed ptty with error", slog.Error(closeErr))
+		}
+		closeErr = process.Kill()
+		if closeErr != nil {
+			logger.Debug(ctx, "killed process with error", slog.Error(closeErr))
+		}
+		rpty.metrics.WithLabelValues("screen_wait").Add(1)
+		return nil, nil, err
+	}
+
+	return ptty, process, nil
+}
+
+// sendCommand runs a screen command against a running screen session.  If the
+// command fails with an error matching anything in successErrors it will be
+// considered a success state (for example "no session" when quitting and the
+// session is already dead).  The command will be retried until successful, the
+// timeout is reached, or the context ends.  A canceled context will return the
+// canceled context's error as-is while a timed-out context returns together
+// with the last error from the command.
+func (rpty *screenReconnectingPTY) sendCommand(ctx context.Context, command string, successErrors []string) error {
+	ctx, cancel := context.WithTimeout(ctx, attachTimeout)
+	defer cancel()
+
+	var lastErr error
+	run := func() bool {
+		var stdout bytes.Buffer
+		//nolint:gosec
+		cmd := exec.CommandContext(ctx, "screen",
+			// -x targets an attached session.
+			"-x", rpty.id,
+			// -c is the flag for the config file.
+			"-c", rpty.configFile,
+			// -X runs a command in the matching session.
+			"-X", command,
+		)
+		cmd.Env = append(rpty.command.Env, "TERM=xterm-256color")
+		cmd.Dir = rpty.command.Dir
+		cmd.Stdout = &stdout
+		err := cmd.Run()
+		if err == nil {
+			return true
+		}
+
+		stdoutStr := stdout.String()
+		for _, se := range successErrors {
+			if strings.Contains(stdoutStr, se) {
+				return true
+			}
+		}
+
+		// Things like "exit status 1" are imprecise so include stdout as it may
+		// contain more information ("no screen session found" for example).
+		if !errors.Is(err, context.Canceled) && !errors.Is(err, context.DeadlineExceeded) {
+			lastErr = xerrors.Errorf("`screen -x %s -X %s`: %w: %s", rpty.id, command, err, stdoutStr)
+		}
+
+		return false
+	}
+
+	// Run immediately.
+	if done := run(); done {
+		return nil
+	}
+
+	// Then run on an interval.
+	ticker := time.NewTicker(250 * time.Millisecond)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			if errors.Is(ctx.Err(), context.Canceled) {
+				return ctx.Err()
+			}
+			return errors.Join(ctx.Err(), lastErr)
+		case <-ticker.C:
+			if done := run(); done {
+				return nil
+			}
+		}
+	}
+}
+
+func (rpty *screenReconnectingPTY) Wait() {
+	_, _ = rpty.state.waitForState(StateClosing)
+}
+
+func (rpty *screenReconnectingPTY) Close(err error) {
+	// The closing state change will be handled by the lifecycle.
+	rpty.state.setState(StateClosing, err)
+}
diff --git a/agent/usershell/usershell_test.go b/agent/usershell/usershell_test.go
index 676ee462ffe63..ee49afcb14412 100644
--- a/agent/usershell/usershell_test.go
+++ b/agent/usershell/usershell_test.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/agent/usershell"
+	"github.com/coder/coder/v2/agent/usershell"
 )
 
 //nolint:paralleltest,tparallel // This test sets an environment variable.
diff --git a/buildinfo/boring.go b/buildinfo/boring.go
new file mode 100644
index 0000000000000..ec2f0b4e3c286
--- /dev/null
+++ b/buildinfo/boring.go
@@ -0,0 +1,7 @@
+//go:build boringcrypto
+
+package buildinfo
+
+import "crypto/boring"
+
+var boringcrypto = boring.Enabled()
diff --git a/buildinfo/buildinfo.go b/buildinfo/buildinfo.go
index bafd3a916bcf2..e1fd90fe2fadb 100644
--- a/buildinfo/buildinfo.go
+++ b/buildinfo/buildinfo.go
@@ -30,8 +30,15 @@ var (
 )
 
 const (
-	// develPrefix is prefixed to developer versions of the application.
-	develPrefix = "v0.0.0-devel"
+	// noVersion is the reported version when the version cannot be determined.
+	// Usually because `go build` is run instead of `make build`.
+	noVersion = "v0.0.0"
+
+	// develPreRelease is the pre-release tag for developer versions of the
+	// application. This includes CI builds. The pre-release tag should be appended
+	// to the version with a "-".
+	// Example: v0.0.0-devel
+	develPreRelease = "devel"
 )
 
 // Version returns the semantic version of the build.
@@ -45,7 +52,8 @@ func Version() string {
 		if tag == "" {
 			// This occurs when the tag hasn't been injected,
 			// like when using "go run".
-			version = develPrefix + revision
+			// <version>-<pre-release>+<revision>
+			version = fmt.Sprintf("%s-%s%s", noVersion, develPreRelease, revision)
 			return
 		}
 		version = "v" + tag
@@ -63,18 +71,23 @@ func Version() string {
 // disregarded. If it detects that either version is a developer build it
 // returns true.
 func VersionsMatch(v1, v2 string) bool {
-	// Developer versions are disregarded...hopefully they know what they are
-	// doing.
-	if strings.HasPrefix(v1, develPrefix) || strings.HasPrefix(v2, develPrefix) {
+	// If no version is attached, then it is a dev build outside of CI. The version
+	// will be disregarded... hopefully they know what they are doing.
+	if strings.Contains(v1, noVersion) || strings.Contains(v2, noVersion) {
 		return true
 	}
 
 	return semver.MajorMinor(v1) == semver.MajorMinor(v2)
 }
 
+func IsDevVersion(v string) bool {
+	return strings.Contains(v, "-"+develPreRelease)
+}
+
 // IsDev returns true if this is a development build.
+// CI builds are also considered development builds.
 func IsDev() bool {
-	return strings.HasPrefix(Version(), develPrefix)
+	return IsDevVersion(Version())
 }
 
 // IsSlim returns true if this is a slim build.
@@ -87,6 +100,10 @@ func IsAGPL() bool {
 	return strings.Contains(agpl, "t")
 }
 
+func IsBoringCrypto() bool {
+	return boringcrypto
+}
+
 // ExternalURL returns a URL referencing the current Coder version.
 // For production builds, this will link directly to a release.
 // For development builds, this will link to a commit.
diff --git a/buildinfo/buildinfo_test.go b/buildinfo/buildinfo_test.go
index 12cc8c99a3ee7..b83c106148e9e 100644
--- a/buildinfo/buildinfo_test.go
+++ b/buildinfo/buildinfo_test.go
@@ -7,7 +7,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/mod/semver"
 
-	"github.com/coder/coder/buildinfo"
+	"github.com/coder/coder/v2/buildinfo"
 )
 
 func TestBuildInfo(t *testing.T) {
@@ -57,13 +57,19 @@ func TestBuildInfo(t *testing.T) {
 				expectMatch: true,
 			},
 			// Our CI instance uses a "-devel" prerelease
-			// flag. This is not the same as a developer WIP build.
+			// flag.
 			{
-				name:        "DevelPreleaseNotIgnored",
+				name:        "DevelPreleaseMajor",
 				v1:          "v1.1.1-devel+123abac",
 				v2:          "v1.2.3",
 				expectMatch: false,
 			},
+			{
+				name:        "DevelPreleaseSame",
+				v1:          "v1.1.1-devel+123abac",
+				v2:          "v1.1.9",
+				expectMatch: true,
+			},
 			{
 				name:        "MajorMismatch",
 				v1:          "v1.2.3",
diff --git a/buildinfo/notboring.go b/buildinfo/notboring.go
new file mode 100644
index 0000000000000..70799b2c8d1eb
--- /dev/null
+++ b/buildinfo/notboring.go
@@ -0,0 +1,5 @@
+//go:build !boringcrypto
+
+package buildinfo
+
+var boringcrypto = false
diff --git a/cli/agent.go b/cli/agent.go
index 1d9a2ba02d51c..8a836cd4c3c04 100644
--- a/cli/agent.go
+++ b/cli/agent.go
@@ -12,6 +12,7 @@ import (
 	"path/filepath"
 	"runtime"
 	"strconv"
+	"strings"
 	"sync"
 	"time"
 
@@ -27,12 +28,13 @@ import (
 	"cdr.dev/slog/sloggers/sloghuman"
 	"cdr.dev/slog/sloggers/slogjson"
 	"cdr.dev/slog/sloggers/slogstackdriver"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/agent/reaper"
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/agent/agentproc"
+	"github.com/coder/coder/v2/agent/reaper"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
 )
 
 func (r *RootCmd) workspaceAgent() *clibase.Cmd {
@@ -197,9 +199,19 @@ func (r *RootCmd) workspaceAgent() *clibase.Cmd {
 			var exchangeToken func(context.Context) (agentsdk.AuthenticateResponse, error)
 			switch auth {
 			case "token":
-				token, err := inv.ParsedFlags().GetString(varAgentToken)
-				if err != nil {
-					return xerrors.Errorf("CODER_AGENT_TOKEN must be set for token auth: %w", err)
+				token, _ := inv.ParsedFlags().GetString(varAgentToken)
+				if token == "" {
+					tokenFile, _ := inv.ParsedFlags().GetString(varAgentTokenFile)
+					if tokenFile != "" {
+						tokenBytes, err := os.ReadFile(tokenFile)
+						if err != nil {
+							return xerrors.Errorf("read token file %q: %w", tokenFile, err)
+						}
+						token = strings.TrimSpace(string(tokenBytes))
+					}
+				}
+				if token == "" {
+					return xerrors.Errorf("CODER_AGENT_TOKEN or CODER_AGENT_TOKEN_FILE must be set for token auth")
 				}
 				client.SetSessionToken(token)
 			case "google-instance-identity":
@@ -253,7 +265,21 @@ func (r *RootCmd) workspaceAgent() *clibase.Cmd {
 			}
 
 			prometheusRegistry := prometheus.NewRegistry()
-			subsystem := inv.Environ.Get(agent.EnvAgentSubsystem)
+			subsystemsRaw := inv.Environ.Get(agent.EnvAgentSubsystem)
+			subsystems := []codersdk.AgentSubsystem{}
+			for _, s := range strings.Split(subsystemsRaw, ",") {
+				subsystem := codersdk.AgentSubsystem(strings.TrimSpace(s))
+				if subsystem == "" {
+					continue
+				}
+				if !subsystem.Valid() {
+					return xerrors.Errorf("invalid subsystem %q", subsystem)
+				}
+				subsystems = append(subsystems, subsystem)
+			}
+
+			procTicker := time.NewTicker(time.Second)
+			defer procTicker.Stop()
 			agnt := agent.New(agent.Options{
 				Client:            client,
 				Logger:            logger,
@@ -271,13 +297,18 @@ func (r *RootCmd) workspaceAgent() *clibase.Cmd {
 					return resp.SessionToken, nil
 				},
 				EnvironmentVariables: map[string]string{
-					"GIT_ASKPASS": executablePath,
+					"GIT_ASKPASS":         executablePath,
+					agent.EnvProcPrioMgmt: os.Getenv(agent.EnvProcPrioMgmt),
 				},
 				IgnorePorts:   ignorePorts,
 				SSHMaxTimeout: sshMaxTimeout,
-				Subsystem:     codersdk.AgentSubsystem(subsystem),
+				Subsystems:    subsystems,
 
 				PrometheusRegistry: prometheusRegistry,
+				Syscaller:          agentproc.NewSyscaller(),
+				// Intentionally set this to nil. It's mainly used
+				// for testing.
+				ModifiedProcesses: nil,
 			})
 
 			prometheusSrvClose := ServeHandler(ctx, logger, prometheusMetricsHandler(prometheusRegistry, logger), prometheusAddress, "prometheus")
diff --git a/cli/agent_test.go b/cli/agent_test.go
index 462ef3c204541..dd2266ec14394 100644
--- a/cli/agent_test.go
+++ b/cli/agent_test.go
@@ -2,6 +2,7 @@ package cli_test
 
 import (
 	"context"
+	"fmt"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -12,13 +13,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestWorkspaceAgent(t *testing.T) {
@@ -37,9 +38,9 @@ func TestWorkspaceAgent(t *testing.T) {
 			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		logDir := t.TempDir()
 		inv, _ := clitest.New(t,
@@ -74,9 +75,9 @@ func TestWorkspaceAgent(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "somename",
 							Type: "someinstance",
@@ -91,9 +92,9 @@ func TestWorkspaceAgent(t *testing.T) {
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		inv, _ := clitest.New(t, "agent", "--auth", "azure-instance-identity", "--agent-url", client.URL.String())
 		inv = inv.WithContext(
@@ -126,9 +127,9 @@ func TestWorkspaceAgent(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "somename",
 							Type: "someinstance",
@@ -143,9 +144,9 @@ func TestWorkspaceAgent(t *testing.T) {
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		inv, _ := clitest.New(t, "agent", "--auth", "aws-instance-identity", "--agent-url", client.URL.String())
 		inv = inv.WithContext(
@@ -175,12 +176,13 @@ func TestWorkspaceAgent(t *testing.T) {
 			GoogleTokenValidator:     validator,
 			IncludeProvisionerDaemon: true,
 		})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "somename",
 							Type: "someinstance",
@@ -194,14 +196,14 @@ func TestWorkspaceAgent(t *testing.T) {
 				},
 			}},
 		})
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		inv, cfg := clitest.New(t, "agent", "--auth", "google-instance-identity", "--agent-url", client.URL.String())
 		ptytest.New(t).Attach(inv)
-		clitest.SetupConfig(t, client, cfg)
+		clitest.SetupConfig(t, member, cfg)
 		clitest.Start(t,
 			inv.WithContext(
 				//nolint:revive,staticcheck
@@ -252,9 +254,9 @@ func TestWorkspaceAgent(t *testing.T) {
 			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		logDir := t.TempDir()
 		inv, _ := clitest.New(t,
@@ -264,8 +266,8 @@ func TestWorkspaceAgent(t *testing.T) {
 			"--agent-url", client.URL.String(),
 			"--log-dir", logDir,
 		)
-		// Set the subsystem for the agent.
-		inv.Environ.Set(agent.EnvAgentSubsystem, string(codersdk.AgentSubsystemEnvbox))
+		// Set the subsystems for the agent.
+		inv.Environ.Set(agent.EnvAgentSubsystem, fmt.Sprintf("%s,%s", codersdk.AgentSubsystemExectrace, codersdk.AgentSubsystemEnvbox))
 
 		pty := ptytest.New(t).Attach(inv)
 
@@ -275,6 +277,9 @@ func TestWorkspaceAgent(t *testing.T) {
 		resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 		require.Len(t, resources, 1)
 		require.Len(t, resources[0].Agents, 1)
-		require.Equal(t, codersdk.AgentSubsystemEnvbox, resources[0].Agents[0].Subsystem)
+		require.Len(t, resources[0].Agents[0].Subsystems, 2)
+		// Sorted
+		require.Equal(t, codersdk.AgentSubsystemEnvbox, resources[0].Agents[0].Subsystems[0])
+		require.Equal(t, codersdk.AgentSubsystemExectrace, resources[0].Agents[0].Subsystems[1])
 	})
 }
diff --git a/cli/clibase/cmd.go b/cli/clibase/cmd.go
index 3e7dfe3903633..c3729d2d586cb 100644
--- a/cli/clibase/cmd.go
+++ b/cli/clibase/cmd.go
@@ -14,6 +14,8 @@ import (
 	"golang.org/x/exp/slices"
 	"golang.org/x/xerrors"
 	"gopkg.in/yaml.v3"
+
+	"github.com/coder/coder/v2/coderd/util/slice"
 )
 
 // Cmd describes an executable command.
@@ -102,11 +104,11 @@ func (c *Cmd) PrepareAll() error {
 		}
 	}
 
-	slices.SortFunc(c.Options, func(a, b Option) bool {
-		return a.Name < b.Name
+	slices.SortFunc(c.Options, func(a, b Option) int {
+		return slice.Ascending(a.Name, b.Name)
 	})
-	slices.SortFunc(c.Children, func(a, b *Cmd) bool {
-		return a.Name() < b.Name()
+	slices.SortFunc(c.Children, func(a, b *Cmd) int {
+		return slice.Ascending(a.Name(), b.Name())
 	})
 	for _, child := range c.Children {
 		child.Parent = c
diff --git a/cli/clibase/cmd_test.go b/cli/clibase/cmd_test.go
index fedbcd0cf2fd7..f0c21dd0b0bbb 100644
--- a/cli/clibase/cmd_test.go
+++ b/cli/clibase/cmd_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
+	"github.com/coder/coder/v2/cli/clibase"
 )
 
 // ioBufs is the standard input, output, and error for a command.
diff --git a/cli/clibase/env_test.go b/cli/clibase/env_test.go
index d8830e64f580f..19dcc4e76d9a9 100644
--- a/cli/clibase/env_test.go
+++ b/cli/clibase/env_test.go
@@ -4,7 +4,7 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/coder/coder/cli/clibase"
+	"github.com/coder/coder/v2/cli/clibase"
 )
 
 func TestFilterNamePrefix(t *testing.T) {
diff --git a/cli/clibase/option.go b/cli/clibase/option.go
index 8c7fed92e20f7..5743b3a4d1efe 100644
--- a/cli/clibase/option.go
+++ b/cli/clibase/option.go
@@ -1,6 +1,8 @@
 package clibase
 
 import (
+	"bytes"
+	"encoding/json"
 	"os"
 	"strings"
 
@@ -65,6 +67,20 @@ type Option struct {
 	ValueSource ValueSource `json:"value_source,omitempty"`
 }
 
+// optionNoMethods is just a wrapper around Option so we can defer to the
+// default json.Unmarshaler behavior.
+type optionNoMethods Option
+
+func (o *Option) UnmarshalJSON(data []byte) error {
+	// If an option has no values, we have no idea how to unmarshal it.
+	// So just discard the json data.
+	if o.Value == nil {
+		o.Value = &DiscardValue
+	}
+
+	return json.Unmarshal(data, (*optionNoMethods)(o))
+}
+
 func (o Option) YAMLPath() string {
 	if o.YAML == "" {
 		return ""
@@ -79,15 +95,101 @@ func (o Option) YAMLPath() string {
 // OptionSet is a group of options that can be applied to a command.
 type OptionSet []Option
 
+// UnmarshalJSON implements json.Unmarshaler for OptionSets. Options have an
+// interface Value type that cannot handle unmarshalling because the types cannot
+// be inferred. Since it is a slice, instantiating the Options first does not
+// help.
+//
+// However, we typically do instantiate the slice to have the correct types.
+// So this unmarshaller will attempt to find the named option in the existing
+// set, if it cannot, the value is discarded. If the option exists, the value
+// is unmarshalled into the existing option, and replaces the existing option.
+//
+// The value is discarded if it's type cannot be inferred. This behavior just
+// feels "safer", although it should never happen if the correct option set
+// is passed in. The situation where this could occur is if a client and server
+// are on different versions with different options.
+func (optSet *OptionSet) UnmarshalJSON(data []byte) error {
+	dec := json.NewDecoder(bytes.NewBuffer(data))
+	// Should be a json array, so consume the starting open bracket.
+	t, err := dec.Token()
+	if err != nil {
+		return xerrors.Errorf("read array open bracket: %w", err)
+	}
+	if t != json.Delim('[') {
+		return xerrors.Errorf("expected array open bracket, got %q", t)
+	}
+
+	// As long as json elements exist, consume them. The counter is used for
+	// better errors.
+	var i int
+OptionSetDecodeLoop:
+	for dec.More() {
+		var opt Option
+		// jValue is a placeholder value that allows us to capture the
+		// raw json for the value to attempt to unmarshal later.
+		var jValue jsonValue
+		opt.Value = &jValue
+		err := dec.Decode(&opt)
+		if err != nil {
+			return xerrors.Errorf("decode %d option: %w", i, err)
+		}
+		// This counter is used to contextualize errors to show which element of
+		// the array we failed to decode. It is only used in the error above, as
+		// if the above works, we can instead use the Option.Name which is more
+		// descriptive and useful. So increment here for the next decode.
+		i++
+
+		// Try to see if the option already exists in the option set.
+		// If it does, just update the existing option.
+		for optIndex, have := range *optSet {
+			if have.Name == opt.Name {
+				if jValue != nil {
+					err := json.Unmarshal(jValue, &(*optSet)[optIndex].Value)
+					if err != nil {
+						return xerrors.Errorf("decode option %q value: %w", have.Name, err)
+					}
+					// Set the opt's value
+					opt.Value = (*optSet)[optIndex].Value
+				} else {
+					// Hopefully the user passed empty values in the option set. There is no easy way
+					// to tell, and if we do not do this, it breaks json.Marshal if we do it again on
+					// this new option set.
+					opt.Value = (*optSet)[optIndex].Value
+				}
+				// Override the existing.
+				(*optSet)[optIndex] = opt
+				// Go to the next option to decode.
+				continue OptionSetDecodeLoop
+			}
+		}
+
+		// If the option doesn't exist, the value will be discarded.
+		// We do this because we cannot infer the type of the value.
+		opt.Value = DiscardValue
+		*optSet = append(*optSet, opt)
+	}
+
+	t, err = dec.Token()
+	if err != nil {
+		return xerrors.Errorf("read array close bracket: %w", err)
+	}
+	if t != json.Delim(']') {
+		return xerrors.Errorf("expected array close bracket, got %q", t)
+	}
+
+	return nil
+}
+
 // Add adds the given Options to the OptionSet.
-func (s *OptionSet) Add(opts ...Option) {
-	*s = append(*s, opts...)
+func (optSet *OptionSet) Add(opts ...Option) {
+	*optSet = append(*optSet, opts...)
 }
 
 // Filter will only return options that match the given filter. (return true)
-func (s OptionSet) Filter(filter func(opt Option) bool) OptionSet {
+func (optSet OptionSet) Filter(filter func(opt Option) bool) OptionSet {
 	cpy := make(OptionSet, 0)
-	for _, opt := range s {
+	for _, opt := range optSet {
 		if filter(opt) {
 			cpy = append(cpy, opt)
 		}
@@ -96,13 +198,13 @@ func (s OptionSet) Filter(filter func(opt Option) bool) OptionSet {
 }
 
 // FlagSet returns a pflag.FlagSet for the OptionSet.
-func (s *OptionSet) FlagSet() *pflag.FlagSet {
-	if s == nil {
+func (optSet *OptionSet) FlagSet() *pflag.FlagSet {
+	if optSet == nil {
 		return &pflag.FlagSet{}
 	}
 
 	fs := pflag.NewFlagSet("", pflag.ContinueOnError)
-	for _, opt := range *s {
+	for _, opt := range *optSet {
 		if opt.Flag == "" {
 			continue
 		}
@@ -139,8 +241,8 @@ func (s *OptionSet) FlagSet() *pflag.FlagSet {
 
 // ParseEnv parses the given environment variables into the OptionSet.
 // Use EnvsWithPrefix to filter out prefixes.
-func (s *OptionSet) ParseEnv(vs []EnvVar) error {
-	if s == nil {
+func (optSet *OptionSet) ParseEnv(vs []EnvVar) error {
+	if optSet == nil {
 		return nil
 	}
 
@@ -154,12 +256,21 @@ func (s *OptionSet) ParseEnv(vs []EnvVar) error {
 		envs[v.Name] = v.Value
 	}
 
-	for i, opt := range *s {
+	for i, opt := range *optSet {
 		if opt.Env == "" {
 			continue
 		}
 
 		envVal, ok := envs[opt.Env]
+		if !ok {
+			// Homebrew strips all environment variables that do not start with `HOMEBREW_`.
+			// This prevented using brew to invoke the Coder agent, because the environment
+			// variables to not get passed down.
+			//
+			// A customer wanted to use their custom tap inside a workspace, which was failing
+			// because the agent lacked the environment variables to authenticate with Git.
+			envVal, ok = envs[`HOMEBREW_`+opt.Env]
+		}
 		// Currently, empty values are treated as if the environment variable is
 		// unset. This behavior is technically not correct as there is now no
 		// way for a user to change a Default value to an empty string from
@@ -172,7 +283,7 @@ func (s *OptionSet) ParseEnv(vs []EnvVar) error {
 			continue
 		}
 
-		(*s)[i].ValueSource = ValueSourceEnv
+		(*optSet)[i].ValueSource = ValueSourceEnv
 		if err := opt.Value.Set(envVal); err != nil {
 			merr = multierror.Append(
 				merr, xerrors.Errorf("parse %q: %w", opt.Name, err),
@@ -185,14 +296,14 @@ func (s *OptionSet) ParseEnv(vs []EnvVar) error {
 
 // SetDefaults sets the default values for each Option, skipping values
 // that already have a value source.
-func (s *OptionSet) SetDefaults() error {
-	if s == nil {
+func (optSet *OptionSet) SetDefaults() error {
+	if optSet == nil {
 		return nil
 	}
 
 	var merr *multierror.Error
 
-	for i, opt := range *s {
+	for i, opt := range *optSet {
 		// Skip values that may have already been set by the user.
 		if opt.ValueSource != ValueSourceNone {
 			continue
@@ -212,7 +323,7 @@ func (s *OptionSet) SetDefaults() error {
 			)
 			continue
 		}
-		(*s)[i].ValueSource = ValueSourceDefault
+		(*optSet)[i].ValueSource = ValueSourceDefault
 		if err := opt.Value.Set(opt.Default); err != nil {
 			merr = multierror.Append(
 				merr, xerrors.Errorf("parse %q: %w", opt.Name, err),
@@ -224,9 +335,9 @@ func (s *OptionSet) SetDefaults() error {
 
 // ByName returns the Option with the given name, or nil if no such option
 // exists.
-func (s *OptionSet) ByName(name string) *Option {
-	for i := range *s {
-		opt := &(*s)[i]
+func (optSet *OptionSet) ByName(name string) *Option {
+	for i := range *optSet {
+		opt := &(*optSet)[i]
 		if opt.Name == name {
 			return opt
 		}
diff --git a/cli/clibase/option_test.go b/cli/clibase/option_test.go
index cacd8d3a10793..f093a20ec18da 100644
--- a/cli/clibase/option_test.go
+++ b/cli/clibase/option_test.go
@@ -1,11 +1,17 @@
 package clibase_test
 
 import (
+	"bytes"
+	"encoding/json"
+	"regexp"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestOptionSet_ParseFlags(t *testing.T) {
@@ -72,6 +78,40 @@ func TestOptionSet_ParseFlags(t *testing.T) {
 		err := os.FlagSet().Parse([]string{"--some-unknown", "foo"})
 		require.Error(t, err)
 	})
+
+	t.Run("RegexValid", func(t *testing.T) {
+		t.Parallel()
+
+		var regexpString clibase.Regexp
+
+		os := clibase.OptionSet{
+			clibase.Option{
+				Name:  "RegexpString",
+				Value: &regexpString,
+				Flag:  "regexp-string",
+			},
+		}
+
+		err := os.FlagSet().Parse([]string{"--regexp-string", "$test^"})
+		require.NoError(t, err)
+	})
+
+	t.Run("RegexInvalid", func(t *testing.T) {
+		t.Parallel()
+
+		var regexpString clibase.Regexp
+
+		os := clibase.OptionSet{
+			clibase.Option{
+				Name:  "RegexpString",
+				Value: &regexpString,
+				Flag:  "regexp-string",
+			},
+		}
+
+		err := os.FlagSet().Parse([]string{"--regexp-string", "(("})
+		require.Error(t, err)
+	})
 }
 
 func TestOptionSet_ParseEnv(t *testing.T) {
@@ -166,4 +206,186 @@ func TestOptionSet_ParseEnv(t *testing.T) {
 		require.NoError(t, err)
 		require.EqualValues(t, expected, actual.Value)
 	})
+
+	t.Run("Homebrew", func(t *testing.T) {
+		t.Parallel()
+
+		var agentToken clibase.String
+
+		os := clibase.OptionSet{
+			clibase.Option{
+				Name:  "Agent Token",
+				Value: &agentToken,
+				Env:   "AGENT_TOKEN",
+			},
+		}
+
+		err := os.ParseEnv([]clibase.EnvVar{
+			{Name: "HOMEBREW_AGENT_TOKEN", Value: "foo"},
+		})
+		require.NoError(t, err)
+		require.EqualValues(t, "foo", agentToken)
+	})
+}
+
+func TestOptionSet_JsonMarshal(t *testing.T) {
+	t.Parallel()
+
+	// This unit test ensures if the source optionset is missing the option
+	// and cannot determine the type, it will not panic. The unmarshal will
+	// succeed with a best effort.
+	t.Run("MissingSrcOption", func(t *testing.T) {
+		t.Parallel()
+
+		var str clibase.String = "something"
+		var arr clibase.StringArray = []string{"foo", "bar"}
+		opts := clibase.OptionSet{
+			clibase.Option{
+				Name:  "StringOpt",
+				Value: &str,
+			},
+			clibase.Option{
+				Name:  "ArrayOpt",
+				Value: &arr,
+			},
+		}
+		data, err := json.Marshal(opts)
+		require.NoError(t, err, "marshal option set")
+
+		tgt := clibase.OptionSet{}
+		err = json.Unmarshal(data, &tgt)
+		require.NoError(t, err, "unmarshal option set")
+		for i := range opts {
+			compareOptionsExceptValues(t, opts[i], tgt[i])
+			require.Empty(t, tgt[i].Value.String(), "unknown value types are empty")
+		}
+	})
+
+	t.Run("RegexCase", func(t *testing.T) {
+		t.Parallel()
+
+		val := clibase.Regexp(*regexp.MustCompile(".*"))
+		opts := clibase.OptionSet{
+			clibase.Option{
+				Name:    "Regex",
+				Value:   &val,
+				Default: ".*",
+			},
+		}
+		data, err := json.Marshal(opts)
+		require.NoError(t, err, "marshal option set")
+
+		var foundVal clibase.Regexp
+		newOpts := clibase.OptionSet{
+			clibase.Option{
+				Name:  "Regex",
+				Value: &foundVal,
+			},
+		}
+		err = json.Unmarshal(data, &newOpts)
+		require.NoError(t, err, "unmarshal option set")
+
+		require.EqualValues(t, opts[0].Value.String(), newOpts[0].Value.String())
+	})
+
+	t.Run("AllValues", func(t *testing.T) {
+		t.Parallel()
+
+		vals := coderdtest.DeploymentValues(t)
+		opts := vals.Options()
+		sources := []clibase.ValueSource{
+			clibase.ValueSourceNone,
+			clibase.ValueSourceFlag,
+			clibase.ValueSourceEnv,
+			clibase.ValueSourceYAML,
+			clibase.ValueSourceDefault,
+		}
+		for i := range opts {
+			opts[i].ValueSource = sources[i%len(sources)]
+		}
+
+		data, err := json.Marshal(opts)
+		require.NoError(t, err, "marshal option set")
+
+		newOpts := (&codersdk.DeploymentValues{}).Options()
+		err = json.Unmarshal(data, &newOpts)
+		require.NoError(t, err, "unmarshal option set")
+
+		for i := range opts {
+			exp := opts[i]
+			found := newOpts[i]
+
+			compareOptionsExceptValues(t, exp, found)
+			compareValues(t, exp, found)
+		}
+
+		thirdOpts := (&codersdk.DeploymentValues{}).Options()
+		data, err = json.Marshal(newOpts)
+		require.NoError(t, err, "marshal option set")
+
+		err = json.Unmarshal(data, &thirdOpts)
+		require.NoError(t, err, "unmarshal option set")
+		// Compare to the original opts again
+		for i := range opts {
+			exp := opts[i]
+			found := thirdOpts[i]
+
+			compareOptionsExceptValues(t, exp, found)
+			compareValues(t, exp, found)
+		}
+	})
+}
+
+func compareOptionsExceptValues(t *testing.T, exp, found clibase.Option) {
+	t.Helper()
+
+	require.Equalf(t, exp.Name, found.Name, "option name %q", exp.Name)
+	require.Equalf(t, exp.Description, found.Description, "option description %q", exp.Name)
+	require.Equalf(t, exp.Required, found.Required, "option required %q", exp.Name)
+	require.Equalf(t, exp.Flag, found.Flag, "option flag %q", exp.Name)
+	require.Equalf(t, exp.FlagShorthand, found.FlagShorthand, "option flag shorthand %q", exp.Name)
+	require.Equalf(t, exp.Env, found.Env, "option env %q", exp.Name)
+	require.Equalf(t, exp.YAML, found.YAML, "option yaml %q", exp.Name)
+	require.Equalf(t, exp.Default, found.Default, "option default %q", exp.Name)
+	require.Equalf(t, exp.ValueSource, found.ValueSource, "option value source %q", exp.Name)
+	require.Equalf(t, exp.Hidden, found.Hidden, "option hidden %q", exp.Name)
+	require.Equalf(t, exp.Annotations, found.Annotations, "option annotations %q", exp.Name)
+	require.Equalf(t, exp.Group, found.Group, "option group %q", exp.Name)
+	// UseInstead is the same comparison problem, just check the length
+	require.Equalf(t, len(exp.UseInstead), len(found.UseInstead), "option use instead %q", exp.Name)
+}
+
+func compareValues(t *testing.T, exp, found clibase.Option) {
+	t.Helper()
+
+	if (exp.Value == nil || found.Value == nil) || (exp.Value.String() != found.Value.String() && found.Value.String() == "") {
+		// If the string values are different, this can be a "nil" issue.
+		// So only run this case if the found string is the empty string.
+		// We use MarshalYAML for struct strings, and it will return an
+		// empty string '""' for nil slices/maps/etc.
+		// So use json to compare.
+
+		expJSON, err := json.Marshal(exp.Value)
+		require.NoError(t, err, "marshal")
+		foundJSON, err := json.Marshal(found.Value)
+		require.NoError(t, err, "marshal")
+
+		expJSON = normalizeJSON(expJSON)
+		foundJSON = normalizeJSON(foundJSON)
+		assert.Equalf(t, string(expJSON), string(foundJSON), "option value %q", exp.Name)
+	} else {
+		assert.Equal(t,
+			exp.Value.String(),
+			found.Value.String(),
+			"option value %q", exp.Name)
+	}
+}
+
+// normalizeJSON handles the fact that an empty map/slice is not the same
+// as a nil empty/slice. For our purposes, they are the same.
+func normalizeJSON(data []byte) []byte {
+	if bytes.Equal(data, []byte("[]")) || bytes.Equal(data, []byte("{}")) {
+		return []byte("null")
+	}
+	return data
 }
diff --git a/cli/clibase/values.go b/cli/clibase/values.go
index 288a7c372b152..d390fe2f89bc6 100644
--- a/cli/clibase/values.go
+++ b/cli/clibase/values.go
@@ -7,6 +7,7 @@ import (
 	"net"
 	"net/url"
 	"reflect"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -429,6 +430,35 @@ func (discardValue) Type() string {
 	return "discard"
 }
 
+func (discardValue) UnmarshalJSON([]byte) error {
+	return nil
+}
+
+// jsonValue is intentionally not exported. It is just used to store the raw JSON
+// data for a value to defer it's unmarshal. It implements the pflag.Value to be
+// usable in an Option.
+type jsonValue json.RawMessage
+
+func (jsonValue) Set(string) error {
+	return xerrors.Errorf("json value is read-only")
+}
+
+func (jsonValue) String() string {
+	return ""
+}
+
+func (jsonValue) Type() string {
+	return "json"
+}
+
+func (j *jsonValue) UnmarshalJSON(data []byte) error {
+	if j == nil {
+		return xerrors.New("json.RawMessage: UnmarshalJSON on nil pointer")
+	}
+	*j = append((*j)[0:0], data...)
+	return nil
+}
+
 var _ pflag.Value = (*Enum)(nil)
 
 type Enum struct {
@@ -461,6 +491,62 @@ func (e *Enum) String() string {
 	return *e.Value
 }
 
+type Regexp regexp.Regexp
+
+func (r *Regexp) MarshalJSON() ([]byte, error) {
+	return json.Marshal(r.String())
+}
+
+func (r *Regexp) UnmarshalJSON(data []byte) error {
+	var source string
+	err := json.Unmarshal(data, &source)
+	if err != nil {
+		return err
+	}
+
+	exp, err := regexp.Compile(source)
+	if err != nil {
+		return xerrors.Errorf("invalid regex expression: %w", err)
+	}
+	*r = Regexp(*exp)
+	return nil
+}
+
+func (r *Regexp) MarshalYAML() (interface{}, error) {
+	return yaml.Node{
+		Kind:  yaml.ScalarNode,
+		Value: r.String(),
+	}, nil
+}
+
+func (r *Regexp) UnmarshalYAML(n *yaml.Node) error {
+	return r.Set(n.Value)
+}
+
+func (r *Regexp) Set(v string) error {
+	exp, err := regexp.Compile(v)
+	if err != nil {
+		return xerrors.Errorf("invalid regex expression: %w", err)
+	}
+	*r = Regexp(*exp)
+	return nil
+}
+
+func (r Regexp) String() string {
+	return r.Value().String()
+}
+
+func (r *Regexp) Value() *regexp.Regexp {
+	if r == nil {
+		return nil
+	}
+	return (*regexp.Regexp)(r)
+}
+
+func (Regexp) Type() string {
+	return "regexp"
+}
+
 var _ pflag.Value = (*YAMLConfigPath)(nil)
 
 // YAMLConfigPath is a special value type that encodes a path to a YAML
diff --git a/cli/clibase/yaml.go b/cli/clibase/yaml.go
index fbb1529b3bf4d..9bb1763571eb4 100644
--- a/cli/clibase/yaml.go
+++ b/cli/clibase/yaml.go
@@ -51,12 +51,12 @@ func deepMapNode(n *yaml.Node, path []string, headComment string) *yaml.Node {
 // the stack.
 //
 // It is isomorphic with FromYAML.
-func (s *OptionSet) MarshalYAML() (any, error) {
+func (optSet *OptionSet) MarshalYAML() (any, error) {
 	root := yaml.Node{
 		Kind: yaml.MappingNode,
 	}
 
-	for _, opt := range *s {
+	for _, opt := range *optSet {
 		if opt.YAML == "" {
 			continue
 		}
@@ -222,7 +222,7 @@ func (o *Option) setFromYAMLNode(n *yaml.Node) error {
 
 // UnmarshalYAML converts the given YAML node into the option set.
 // It is isomorphic with ToYAML.
-func (s *OptionSet) UnmarshalYAML(rootNode *yaml.Node) error {
+func (optSet *OptionSet) UnmarshalYAML(rootNode *yaml.Node) error {
 	// The rootNode will be a DocumentNode if it's read from a file. We do
 	// not support multiple documents in a single file.
 	if rootNode.Kind == yaml.DocumentNode {
@@ -240,8 +240,8 @@ func (s *OptionSet) UnmarshalYAML(rootNode *yaml.Node) error {
 	matchedNodes := make(map[string]*yaml.Node, len(yamlNodes))
 
 	var merr error
-	for i := range *s {
-		opt := &(*s)[i]
+	for i := range *optSet {
+		opt := &(*optSet)[i]
 		if opt.YAML == "" {
 			continue
 		}
diff --git a/cli/clibase/yaml_test.go b/cli/clibase/yaml_test.go
index d14bfc7c75ea6..77a8880019649 100644
--- a/cli/clibase/yaml_test.go
+++ b/cli/clibase/yaml_test.go
@@ -8,7 +8,7 @@ import (
 	"golang.org/x/exp/slices"
 	"gopkg.in/yaml.v3"
 
-	"github.com/coder/coder/cli/clibase"
+	"github.com/coder/coder/v2/cli/clibase"
 )
 
 func TestOptionSet_YAML(t *testing.T) {
diff --git a/cli/clitest/clitest.go b/cli/clitest/clitest.go
index 00ec1310043dc..23acc7c01b9d3 100644
--- a/cli/clitest/clitest.go
+++ b/cli/clitest/clitest.go
@@ -19,17 +19,17 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/cli"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/config"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/config"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // New creates a CLI instance with a configuration pointed to a
 // temporary testing directory.
-func New(t *testing.T, args ...string) (*clibase.Invocation, config.Root) {
+func New(t testing.TB, args ...string) (*clibase.Invocation, config.Root) {
 	var root cli.RootCmd
 
 	cmd, err := root.Command(root.AGPL())
@@ -56,7 +56,7 @@ func (l *logWriter) Write(p []byte) (n int, err error) {
 }
 
 func NewWithCommand(
-	t *testing.T, cmd *clibase.Cmd, args ...string,
+	t testing.TB, cmd *clibase.Cmd, args ...string,
 ) (*clibase.Invocation, config.Root) {
 	configDir := config.Root(t.TempDir())
 	logger := slogtest.Make(t, nil)
diff --git a/cli/clitest/clitest_test.go b/cli/clitest/clitest_test.go
index 283f7b48ca588..db31513d182c7 100644
--- a/cli/clitest/clitest_test.go
+++ b/cli/clitest/clitest_test.go
@@ -5,9 +5,9 @@ import (
 
 	"go.uber.org/goleak"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/cli/clitest/golden.go b/cli/clitest/golden.go
index ba445efcea577..2a3ad2dc605c9 100644
--- a/cli/clitest/golden.go
+++ b/cli/clitest/golden.go
@@ -11,16 +11,14 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/charmbracelet/lipgloss"
-	"github.com/muesli/termenv"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/config"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/config"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // UpdateGoldenFiles indicates golden files should be updated.
@@ -28,7 +26,7 @@ import (
 // make update-golden-files
 var UpdateGoldenFiles = flag.Bool("update", false, "update .golden files")
 
-var timestampRegex = regexp.MustCompile(`(?i)\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(.\d+)?Z`)
+var timestampRegex = regexp.MustCompile(`(?i)\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(.\d+)?(Z|[+-]\d+:\d+)`)
 
 type CommandHelpCase struct {
 	Name string
@@ -50,16 +48,8 @@ func DefaultCases() []CommandHelpCase {
 
 // TestCommandHelp will test the help output of the given commands
 // using golden files.
-//
-//nolint:tparallel,paralleltest
 func TestCommandHelp(t *testing.T, getRoot func(t *testing.T) *clibase.Cmd, cases []CommandHelpCase) {
-	ogColorProfile := lipgloss.ColorProfile()
-	// ANSI256 escape codes are far easier for humans to parse in a diff,
-	// but TrueColor is probably more popular with modern terminals.
-	lipgloss.SetColorProfile(termenv.ANSI)
-	t.Cleanup(func() {
-		lipgloss.SetColorProfile(ogColorProfile)
-	})
+	t.Parallel()
 	rootClient, replacements := prepareTestData(t)
 
 	root := getRoot(t)
@@ -192,14 +182,14 @@ func prepareTestData(t *testing.T) (*codersdk.Client, map[string]string) {
 	})
 	require.NoError(t, err)
 	version := coderdtest.CreateTemplateVersion(t, rootClient, firstUser.OrganizationID, nil)
-	version = coderdtest.AwaitTemplateVersionJob(t, rootClient, version.ID)
+	version = coderdtest.AwaitTemplateVersionJobCompleted(t, rootClient, version.ID)
 	template := coderdtest.CreateTemplate(t, rootClient, firstUser.OrganizationID, version.ID, func(req *codersdk.CreateTemplateRequest) {
 		req.Name = "test-template"
 	})
 	workspace := coderdtest.CreateWorkspace(t, rootClient, firstUser.OrganizationID, template.ID, func(req *codersdk.CreateWorkspaceRequest) {
 		req.Name = "test-workspace"
 	})
-	workspaceBuild := coderdtest.AwaitWorkspaceBuildJob(t, rootClient, workspace.LatestBuild.ID)
+	workspaceBuild := coderdtest.AwaitWorkspaceBuildJobCompleted(t, rootClient, workspace.LatestBuild.ID)
 
 	replacements := map[string]string{
 		firstUser.UserID.String():            "[first user ID]",
diff --git a/cli/clitest/handlers.go b/cli/clitest/handlers.go
index 5151bc6c0ed6c..2af0c4a5bee0c 100644
--- a/cli/clitest/handlers.go
+++ b/cli/clitest/handlers.go
@@ -3,7 +3,7 @@ package clitest
 import (
 	"testing"
 
-	"github.com/coder/coder/cli/clibase"
+	"github.com/coder/coder/v2/cli/clibase"
 )
 
 // HandlersOK asserts that all commands have a handler.
diff --git a/cli/cliui/agent.go b/cli/cliui/agent.go
index faad31f411f90..7620efa83b1e6 100644
--- a/cli/cliui/agent.go
+++ b/cli/cliui/agent.go
@@ -8,7 +8,7 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 var errAgentShuttingDown = xerrors.New("agent is shutting down")
@@ -80,6 +80,10 @@ func Agent(ctx context.Context, writer io.Writer, agentID uuid.UUID, opts AgentO
 	if err != nil {
 		return xerrors.Errorf("fetch: %w", err)
 	}
+	logSources := map[uuid.UUID]codersdk.WorkspaceAgentLogSource{}
+	for _, source := range agent.LogSources {
+		logSources[source.ID] = source
+	}
 
 	sw := &stageWriter{w: writer}
 
@@ -123,7 +127,7 @@ func Agent(ctx context.Context, writer io.Writer, agentID uuid.UUID, opts AgentO
 				return nil
 			}
 
-			stage := "Running workspace agent startup script"
+			stage := "Running workspace agent startup scripts"
 			follow := opts.Wait
 			if !follow {
 				stage += " (non-blocking)"
@@ -173,7 +177,12 @@ func Agent(ctx context.Context, writer io.Writer, agentID uuid.UUID, opts AgentO
 							return nil
 						}
 						for _, log := range logs {
-							sw.Log(log.CreatedAt, log.Level, log.Output)
+							source, hasSource := logSources[log.SourceID]
+							output := log.Output
+							if hasSource && source.DisplayName != "" {
+								output = source.DisplayName + ": " + output
+							}
+							sw.Log(log.CreatedAt, log.Level, output)
 							lastLog = log
 						}
 					}
@@ -192,16 +201,19 @@ func Agent(ctx context.Context, writer io.Writer, agentID uuid.UUID, opts AgentO
 			switch agent.LifecycleState {
 			case codersdk.WorkspaceAgentLifecycleReady:
 				sw.Complete(stage, agent.ReadyAt.Sub(*agent.StartedAt))
+			case codersdk.WorkspaceAgentLifecycleStartTimeout:
+				sw.Fail(stage, 0)
+				sw.Log(time.Time{}, codersdk.LogLevelWarn, "Warning: A startup script timed out and your workspace may be incomplete.")
 			case codersdk.WorkspaceAgentLifecycleStartError:
 				sw.Fail(stage, agent.ReadyAt.Sub(*agent.StartedAt))
 				// Use zero time (omitted) to separate these from the startup logs.
-				sw.Log(time.Time{}, codersdk.LogLevelWarn, "Warning: The startup script exited with an error and your workspace may be incomplete.")
+				sw.Log(time.Time{}, codersdk.LogLevelWarn, "Warning: A startup script exited with an error and your workspace may be incomplete.")
 				sw.Log(time.Time{}, codersdk.LogLevelWarn, troubleshootingMessage(agent, "https://coder.com/docs/v2/latest/templates#startup-script-exited-with-an-error"))
 			default:
 				switch {
 				case agent.LifecycleState.Starting():
 					// Use zero time (omitted) to separate these from the startup logs.
-					sw.Log(time.Time{}, codersdk.LogLevelWarn, "Notice: The startup script is still running and your workspace may be incomplete.")
+					sw.Log(time.Time{}, codersdk.LogLevelWarn, "Notice: The startup scripts are still running and your workspace may be incomplete.")
 					sw.Log(time.Time{}, codersdk.LogLevelWarn, troubleshootingMessage(agent, "https://coder.com/docs/v2/latest/templates#your-workspace-may-be-incomplete"))
 					// Note: We don't complete or fail the stage here, it's
 					// intentionally left open to indicate this stage didn't
@@ -225,12 +237,14 @@ func Agent(ctx context.Context, writer io.Writer, agentID uuid.UUID, opts AgentO
 			sw.Start(stage)
 			sw.Log(time.Now(), codersdk.LogLevelWarn, "Wait for it to reconnect or restart your workspace.")
 			sw.Log(time.Now(), codersdk.LogLevelWarn, troubleshootingMessage(agent, "https://coder.com/docs/v2/latest/templates#agent-connection-issues"))
+
+			disconnectedAt := *agent.DisconnectedAt
 			for agent.Status == codersdk.WorkspaceAgentDisconnected {
 				if agent, err = fetch(); err != nil {
 					return xerrors.Errorf("fetch: %w", err)
 				}
 			}
-			sw.Complete(stage, agent.LastConnectedAt.Sub(*agent.DisconnectedAt))
+			sw.Complete(stage, agent.LastConnectedAt.Sub(disconnectedAt))
 		}
 	}
 }
diff --git a/cli/cliui/agent_test.go b/cli/cliui/agent_test.go
index c910bf11c301a..4cb10d8ec073e 100644
--- a/cli/cliui/agent_test.go
+++ b/cli/cliui/agent_test.go
@@ -5,29 +5,53 @@ import (
 	"bytes"
 	"context"
 	"io"
+	"os"
 	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestAgent(t *testing.T) {
 	t.Parallel()
 
+	waitLines := func(t *testing.T, output <-chan string, lines ...string) error {
+		t.Helper()
+
+		var got []string
+	outerLoop:
+		for _, want := range lines {
+			for {
+				select {
+				case line := <-output:
+					got = append(got, line)
+					if strings.Contains(line, want) {
+						continue outerLoop
+					}
+				case <-time.After(testutil.WaitShort):
+					assert.Failf(t, "timed out waiting for line", "want: %q; got: %q", want, got)
+					return xerrors.Errorf("timed out waiting for line: %q; got: %q", want, got)
+				}
+			}
+		}
+		return nil
+	}
+
 	for _, tc := range []struct {
 		name    string
-		iter    []func(context.Context, *codersdk.WorkspaceAgent, chan []codersdk.WorkspaceAgentLog) error
+		iter    []func(context.Context, *testing.T, *codersdk.WorkspaceAgent, <-chan string, chan []codersdk.WorkspaceAgentLog) error
 		logs    chan []codersdk.WorkspaceAgentLog
 		opts    cliui.AgentOptions
 		want    []string
@@ -38,12 +62,15 @@ func TestAgent(t *testing.T) {
 			opts: cliui.AgentOptions{
 				FetchInterval: time.Millisecond,
 			},
-			iter: []func(context.Context, *codersdk.WorkspaceAgent, chan []codersdk.WorkspaceAgentLog) error{
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, _ chan []codersdk.WorkspaceAgentLog) error {
+			iter: []func(context.Context, *testing.T, *codersdk.WorkspaceAgent, <-chan string, chan []codersdk.WorkspaceAgentLog) error{
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentConnecting
 					return nil
 				},
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, logs chan []codersdk.WorkspaceAgentLog) error {
+				func(_ context.Context, t *testing.T, agent *codersdk.WorkspaceAgent, output <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
+					return waitLines(t, output, "⧗ Waiting for the workspace agent to connect")
+				},
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentConnected
 					agent.FirstConnectedAt = ptr.Ref(time.Now())
 					return nil
@@ -52,28 +79,62 @@ func TestAgent(t *testing.T) {
 			want: []string{
 				"⧗ Waiting for the workspace agent to connect",
 				"✔ Waiting for the workspace agent to connect",
-				"⧗ Running workspace agent startup script (non-blocking)",
-				"Notice: The startup script is still running and your workspace may be incomplete.",
+				"⧗ Running workspace agent startup scripts (non-blocking)",
+				"Notice: The startup scripts are still running and your workspace may be incomplete.",
 				"For more information and troubleshooting, see",
 			},
 		},
+		{
+			name: "Start timeout",
+			opts: cliui.AgentOptions{
+				FetchInterval: time.Millisecond,
+			},
+			iter: []func(context.Context, *testing.T, *codersdk.WorkspaceAgent, <-chan string, chan []codersdk.WorkspaceAgentLog) error{
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
+					agent.Status = codersdk.WorkspaceAgentConnecting
+					return nil
+				},
+				func(_ context.Context, t *testing.T, agent *codersdk.WorkspaceAgent, output <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
+					return waitLines(t, output, "⧗ Waiting for the workspace agent to connect")
+				},
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
+					agent.Status = codersdk.WorkspaceAgentConnected
+					agent.LifecycleState = codersdk.WorkspaceAgentLifecycleStartTimeout
+					agent.FirstConnectedAt = ptr.Ref(time.Now())
+					return nil
+				},
+			},
+			want: []string{
+				"⧗ Waiting for the workspace agent to connect",
+				"✔ Waiting for the workspace agent to connect",
+				"⧗ Running workspace agent startup scripts (non-blocking)",
+				"✘ Running workspace agent startup scripts (non-blocking)",
+				"Warning: A startup script timed out and your workspace may be incomplete.",
+			},
+		},
 		{
 			name: "Initial connection timeout",
 			opts: cliui.AgentOptions{
 				FetchInterval: 1 * time.Millisecond,
 			},
-			iter: []func(context.Context, *codersdk.WorkspaceAgent, chan []codersdk.WorkspaceAgentLog) error{
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, _ chan []codersdk.WorkspaceAgentLog) error {
+			iter: []func(context.Context, *testing.T, *codersdk.WorkspaceAgent, <-chan string, chan []codersdk.WorkspaceAgentLog) error{
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentConnecting
 					agent.LifecycleState = codersdk.WorkspaceAgentLifecycleStarting
 					agent.StartedAt = ptr.Ref(time.Now())
 					return nil
 				},
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, _ chan []codersdk.WorkspaceAgentLog) error {
+				func(_ context.Context, t *testing.T, agent *codersdk.WorkspaceAgent, output <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
+					return waitLines(t, output, "⧗ Waiting for the workspace agent to connect")
+				},
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentTimeout
 					return nil
 				},
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, logs chan []codersdk.WorkspaceAgentLog) error {
+				func(_ context.Context, t *testing.T, agent *codersdk.WorkspaceAgent, output <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
+					return waitLines(t, output, "The workspace agent is having trouble connecting, wait for it to connect or restart your workspace.")
+				},
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentConnected
 					agent.FirstConnectedAt = ptr.Ref(time.Now())
 					agent.LifecycleState = codersdk.WorkspaceAgentLifecycleReady
@@ -86,8 +147,8 @@ func TestAgent(t *testing.T) {
 				"The workspace agent is having trouble connecting, wait for it to connect or restart your workspace.",
 				"For more information and troubleshooting, see",
 				"✔ Waiting for the workspace agent to connect",
-				"⧗ Running workspace agent startup script (non-blocking)",
-				"✔ Running workspace agent startup script (non-blocking)",
+				"⧗ Running workspace agent startup scripts (non-blocking)",
+				"✔ Running workspace agent startup scripts (non-blocking)",
 			},
 		},
 		{
@@ -95,8 +156,8 @@ func TestAgent(t *testing.T) {
 			opts: cliui.AgentOptions{
 				FetchInterval: 1 * time.Millisecond,
 			},
-			iter: []func(context.Context, *codersdk.WorkspaceAgent, chan []codersdk.WorkspaceAgentLog) error{
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, _ chan []codersdk.WorkspaceAgentLog) error {
+			iter: []func(context.Context, *testing.T, *codersdk.WorkspaceAgent, <-chan string, chan []codersdk.WorkspaceAgentLog) error{
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentDisconnected
 					agent.FirstConnectedAt = ptr.Ref(time.Now().Add(-1 * time.Minute))
 					agent.LastConnectedAt = ptr.Ref(time.Now().Add(-1 * time.Minute))
@@ -106,8 +167,12 @@ func TestAgent(t *testing.T) {
 					agent.ReadyAt = ptr.Ref(time.Now())
 					return nil
 				},
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, _ chan []codersdk.WorkspaceAgentLog) error {
+				func(_ context.Context, t *testing.T, agent *codersdk.WorkspaceAgent, output <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
+					return waitLines(t, output, "⧗ The workspace agent lost connection")
+				},
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentConnected
+					agent.DisconnectedAt = nil
 					agent.LastConnectedAt = ptr.Ref(time.Now())
 					return nil
 				},
@@ -120,26 +185,31 @@ func TestAgent(t *testing.T) {
 			},
 		},
 		{
-			name: "Startup script logs",
+			name: "Startup Logs",
 			opts: cliui.AgentOptions{
 				FetchInterval: time.Millisecond,
 				Wait:          true,
 			},
-			iter: []func(context.Context, *codersdk.WorkspaceAgent, chan []codersdk.WorkspaceAgentLog) error{
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, logs chan []codersdk.WorkspaceAgentLog) error {
+			iter: []func(context.Context, *testing.T, *codersdk.WorkspaceAgent, <-chan string, chan []codersdk.WorkspaceAgentLog) error{
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, logs chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentConnected
 					agent.FirstConnectedAt = ptr.Ref(time.Now())
 					agent.LifecycleState = codersdk.WorkspaceAgentLifecycleStarting
 					agent.StartedAt = ptr.Ref(time.Now())
+					agent.LogSources = []codersdk.WorkspaceAgentLogSource{{
+						ID:          uuid.Nil,
+						DisplayName: "testing",
+					}}
 					logs <- []codersdk.WorkspaceAgentLog{
 						{
 							CreatedAt: time.Now(),
 							Output:    "Hello world",
+							SourceID:  uuid.Nil,
 						},
 					}
 					return nil
 				},
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, logs chan []codersdk.WorkspaceAgentLog) error {
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, logs chan []codersdk.WorkspaceAgentLog) error {
 					agent.LifecycleState = codersdk.WorkspaceAgentLifecycleReady
 					agent.ReadyAt = ptr.Ref(time.Now())
 					logs <- []codersdk.WorkspaceAgentLog{
@@ -152,10 +222,10 @@ func TestAgent(t *testing.T) {
 				},
 			},
 			want: []string{
-				"⧗ Running workspace agent startup script",
-				"Hello world",
+				"⧗ Running workspace agent startup scripts",
+				"testing: Hello world",
 				"Bye now",
-				"✔ Running workspace agent startup script",
+				"✔ Running workspace agent startup scripts",
 			},
 		},
 		{
@@ -164,8 +234,8 @@ func TestAgent(t *testing.T) {
 				FetchInterval: time.Millisecond,
 				Wait:          true,
 			},
-			iter: []func(context.Context, *codersdk.WorkspaceAgent, chan []codersdk.WorkspaceAgentLog) error{
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, logs chan []codersdk.WorkspaceAgentLog) error {
+			iter: []func(context.Context, *testing.T, *codersdk.WorkspaceAgent, <-chan string, chan []codersdk.WorkspaceAgentLog) error{
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, output <-chan string, logs chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentConnected
 					agent.FirstConnectedAt = ptr.Ref(time.Now())
 					agent.StartedAt = ptr.Ref(time.Now())
@@ -181,10 +251,10 @@ func TestAgent(t *testing.T) {
 				},
 			},
 			want: []string{
-				"⧗ Running workspace agent startup script",
+				"⧗ Running workspace agent startup scripts",
 				"Hello world",
-				"✘ Running workspace agent startup script",
-				"Warning: The startup script exited with an error and your workspace may be incomplete.",
+				"✘ Running workspace agent startup scripts",
+				"Warning: A startup script exited with an error and your workspace may be incomplete.",
 				"For more information and troubleshooting, see",
 			},
 		},
@@ -193,8 +263,8 @@ func TestAgent(t *testing.T) {
 			opts: cliui.AgentOptions{
 				FetchInterval: time.Millisecond,
 			},
-			iter: []func(context.Context, *codersdk.WorkspaceAgent, chan []codersdk.WorkspaceAgentLog) error{
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, logs chan []codersdk.WorkspaceAgentLog) error {
+			iter: []func(context.Context, *testing.T, *codersdk.WorkspaceAgent, <-chan string, chan []codersdk.WorkspaceAgentLog) error{
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, output <-chan string, logs chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentDisconnected
 					agent.LifecycleState = codersdk.WorkspaceAgentLifecycleOff
 					return nil
@@ -208,8 +278,8 @@ func TestAgent(t *testing.T) {
 				FetchInterval: time.Millisecond,
 				Wait:          true,
 			},
-			iter: []func(context.Context, *codersdk.WorkspaceAgent, chan []codersdk.WorkspaceAgentLog) error{
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, logs chan []codersdk.WorkspaceAgentLog) error {
+			iter: []func(context.Context, *testing.T, *codersdk.WorkspaceAgent, <-chan string, chan []codersdk.WorkspaceAgentLog) error{
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, output <-chan string, logs chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentConnected
 					agent.FirstConnectedAt = ptr.Ref(time.Now())
 					agent.LifecycleState = codersdk.WorkspaceAgentLifecycleStarting
@@ -222,16 +292,19 @@ func TestAgent(t *testing.T) {
 					}
 					return nil
 				},
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, logs chan []codersdk.WorkspaceAgentLog) error {
+				func(_ context.Context, t *testing.T, agent *codersdk.WorkspaceAgent, output <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
+					return waitLines(t, output, "Hello world")
+				},
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
 					agent.ReadyAt = ptr.Ref(time.Now())
 					agent.LifecycleState = codersdk.WorkspaceAgentLifecycleShuttingDown
 					return nil
 				},
 			},
 			want: []string{
-				"⧗ Running workspace agent startup script",
+				"⧗ Running workspace agent startup scripts",
 				"Hello world",
-				"✔ Running workspace agent startup script",
+				"✔ Running workspace agent startup scripts",
 			},
 			wantErr: true,
 		},
@@ -241,12 +314,15 @@ func TestAgent(t *testing.T) {
 				FetchInterval: time.Millisecond,
 				Wait:          true,
 			},
-			iter: []func(context.Context, *codersdk.WorkspaceAgent, chan []codersdk.WorkspaceAgentLog) error{
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, _ chan []codersdk.WorkspaceAgentLog) error {
+			iter: []func(context.Context, *testing.T, *codersdk.WorkspaceAgent, <-chan string, chan []codersdk.WorkspaceAgentLog) error{
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentConnecting
 					return nil
 				},
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, _ chan []codersdk.WorkspaceAgentLog) error {
+				func(_ context.Context, t *testing.T, agent *codersdk.WorkspaceAgent, output <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
+					return waitLines(t, output, "⧗ Waiting for the workspace agent to connect")
+				},
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
 					return xerrors.New("bad")
 				},
 			},
@@ -261,13 +337,16 @@ func TestAgent(t *testing.T) {
 				FetchInterval: time.Millisecond,
 				Wait:          true,
 			},
-			iter: []func(context.Context, *codersdk.WorkspaceAgent, chan []codersdk.WorkspaceAgentLog) error{
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, _ chan []codersdk.WorkspaceAgentLog) error {
+			iter: []func(context.Context, *testing.T, *codersdk.WorkspaceAgent, <-chan string, chan []codersdk.WorkspaceAgentLog) error{
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, _ <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
 					agent.Status = codersdk.WorkspaceAgentTimeout
 					agent.TroubleshootingURL = "https://troubleshoot"
 					return nil
 				},
-				func(_ context.Context, agent *codersdk.WorkspaceAgent, _ chan []codersdk.WorkspaceAgentLog) error {
+				func(_ context.Context, t *testing.T, agent *codersdk.WorkspaceAgent, output <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
+					return waitLines(t, output, "The workspace agent is having trouble connecting, wait for it to connect or restart your workspace.")
+				},
+				func(_ context.Context, _ *testing.T, agent *codersdk.WorkspaceAgent, output <-chan string, _ chan []codersdk.WorkspaceAgentLog) error {
 					return xerrors.New("bad")
 				},
 			},
@@ -286,22 +365,27 @@ func TestAgent(t *testing.T) {
 			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
 			defer cancel()
 
-			var buf bytes.Buffer
+			r, w, err := os.Pipe()
+			require.NoError(t, err, "create pipe failed")
+			defer r.Close()
+			defer w.Close()
+
 			agent := codersdk.WorkspaceAgent{
-				ID:                    uuid.New(),
-				Status:                codersdk.WorkspaceAgentConnecting,
-				StartupScriptBehavior: codersdk.WorkspaceAgentStartupScriptBehaviorNonBlocking,
-				CreatedAt:             time.Now(),
-				LifecycleState:        codersdk.WorkspaceAgentLifecycleCreated,
+				ID:             uuid.New(),
+				Status:         codersdk.WorkspaceAgentConnecting,
+				CreatedAt:      time.Now(),
+				LifecycleState: codersdk.WorkspaceAgentLifecycleCreated,
 			}
+			output := make(chan string, 100) // Buffered to avoid blocking, overflow is discarded.
 			logs := make(chan []codersdk.WorkspaceAgentLog, 1)
 
 			cmd := &clibase.Cmd{
 				Handler: func(inv *clibase.Invocation) error {
 					tc.opts.Fetch = func(_ context.Context, _ uuid.UUID) (codersdk.WorkspaceAgent, error) {
+						t.Log("iter", len(tc.iter))
 						var err error
 						if len(tc.iter) > 0 {
-							err = tc.iter[0](ctx, &agent, logs)
+							err = tc.iter[0](ctx, t, &agent, output, logs)
 							tc.iter = tc.iter[1:]
 						}
 						return agent, err
@@ -322,25 +406,26 @@ func TestAgent(t *testing.T) {
 						close(fetchLogs)
 						return fetchLogs, closeFunc(func() error { return nil }), nil
 					}
-					err := cliui.Agent(inv.Context(), &buf, uuid.Nil, tc.opts)
+					err := cliui.Agent(inv.Context(), w, uuid.Nil, tc.opts)
+					_ = w.Close()
 					return err
 				},
 			}
 			inv := cmd.Invoke()
 
-			w := clitest.StartWithWaiter(t, inv)
-			if tc.wantErr {
-				w.RequireError()
-			} else {
-				w.RequireSuccess()
-			}
+			waiter := clitest.StartWithWaiter(t, inv)
 
-			s := bufio.NewScanner(&buf)
+			s := bufio.NewScanner(r)
 			for s.Scan() {
 				line := s.Text()
 				t.Log(line)
+				select {
+				case output <- line:
+				default:
+					t.Logf("output overflow: %s", line)
+				}
 				if len(tc.want) == 0 {
-					require.Fail(t, "unexpected line: "+line)
+					require.Fail(t, "unexpected line", line)
 				}
 				require.Contains(t, line, tc.want[0])
 				tc.want = tc.want[1:]
@@ -349,6 +434,12 @@ func TestAgent(t *testing.T) {
 			if len(tc.want) > 0 {
 				require.Fail(t, "missing lines: "+strings.Join(tc.want, ", "))
 			}
+
+			if tc.wantErr {
+				waiter.RequireError()
+			} else {
+				waiter.RequireSuccess()
+			}
 		})
 	}
 
diff --git a/cli/cliui/cliui.go b/cli/cliui/cliui.go
index b59ccd61298cc..db655749e94bf 100644
--- a/cli/cliui/cliui.go
+++ b/cli/cliui/cliui.go
@@ -1,12 +1,15 @@
 package cliui
 
 import (
+	"flag"
 	"os"
+	"sync"
+	"time"
 
-	"github.com/charmbracelet/charm/ui/common"
-	"github.com/charmbracelet/lipgloss"
 	"github.com/muesli/termenv"
 	"golang.org/x/xerrors"
+
+	"github.com/coder/pretty"
 )
 
 var Canceled = xerrors.New("canceled")
@@ -15,55 +18,147 @@ var Canceled = xerrors.New("canceled")
 var DefaultStyles Styles
 
 type Styles struct {
-	Bold,
-	Checkmark,
 	Code,
-	Crossmark,
 	DateTimeStamp,
 	Error,
 	Field,
 	Keyword,
-	Paragraph,
 	Placeholder,
 	Prompt,
 	FocusedPrompt,
 	Fuchsia,
-	Logo,
 	Warn,
-	Wrap lipgloss.Style
+	Wrap pretty.Style
 }
 
-func init() {
-	lipgloss.SetDefaultRenderer(
-		lipgloss.NewRenderer(os.Stdout, termenv.WithColorCache(true)),
-	)
+var (
+	color     termenv.Profile
+	colorOnce sync.Once
+)
+
+var (
+	Green   = Color("#04B575")
+	Red     = Color("#ED567A")
+	Fuchsia = Color("#EE6FF8")
+	Yellow  = Color("#ECFD65")
+	Blue    = Color("#5000ff")
+)
+
+// Color returns a color for the given string.
+func Color(s string) termenv.Color {
+	colorOnce.Do(func() {
+		color = termenv.NewOutput(os.Stdout).ColorProfile()
+		if flag.Lookup("test.v") != nil {
+			// Use a consistent colorless profile in tests so that results
+			// are deterministic.
+			color = termenv.Ascii
+		}
+	})
+	return color.Color(s)
+}
+
+func isTerm() bool {
+	return color != termenv.Ascii
+}
+
+// Bold returns a formatter that renders text in bold
+// if the terminal supports it.
+func Bold(s string) string {
+	if !isTerm() {
+		return s
+	}
+	return pretty.Sprint(pretty.Bold(), s)
+}
+
+// BoldFmt returns a formatter that renders text in bold
+// if the terminal supports it.
+func BoldFmt() pretty.Formatter {
+	if !isTerm() {
+		return pretty.Style{}
+	}
+	return pretty.Bold()
+}
 
-	// All Styles are set after we change the DefaultRenderer so that the ColorCache
-	// is in effect, mitigating the severe performance issue seen here:
-	// https://github.com/coder/coder/issues/7884.
+// Timestamp formats a timestamp for display.
+func Timestamp(t time.Time) string {
+	return pretty.Sprint(DefaultStyles.DateTimeStamp, t.Format(time.Stamp))
+}
+
+// Keyword formats a keyword for display.
+func Keyword(s string) string {
+	return pretty.Sprint(DefaultStyles.Keyword, s)
+}
+
+// Placeholder formats a placeholder for display.
+func Placeholder(s string) string {
+	return pretty.Sprint(DefaultStyles.Placeholder, s)
+}
+
+// Wrap prevents the text from overflowing the terminal.
+func Wrap(s string) string {
+	return pretty.Sprint(DefaultStyles.Wrap, s)
+}
+
+// Code formats code for display.
+func Code(s string) string {
+	return pretty.Sprint(DefaultStyles.Code, s)
+}
+
+// Field formats a field for display.
+func Field(s string) string {
+	return pretty.Sprint(DefaultStyles.Field, s)
+}
 
-	charmStyles := common.DefaultStyles()
+func ifTerm(fmt pretty.Formatter) pretty.Formatter {
+	if !isTerm() {
+		return pretty.Nop
+	}
+	return fmt
+}
 
+func init() {
+	// We do not adapt the color based on whether the terminal is light or dark.
+	// Doing so would require a round-trip between the program and the terminal
+	// due to the OSC query and response.
 	DefaultStyles = Styles{
-		Bold:          lipgloss.NewStyle().Bold(true),
-		Checkmark:     charmStyles.Checkmark,
-		Code:          charmStyles.Code,
-		Crossmark:     charmStyles.Error.Copy().SetString("✘"),
-		DateTimeStamp: charmStyles.LabelDim,
-		Error:         charmStyles.Error,
-		Field:         charmStyles.Code.Copy().Foreground(lipgloss.AdaptiveColor{Light: "#000000", Dark: "#FFFFFF"}),
-		Keyword:       charmStyles.Keyword,
-		Paragraph:     charmStyles.Paragraph,
-		Placeholder:   lipgloss.NewStyle().Foreground(lipgloss.AdaptiveColor{Light: "#585858", Dark: "#4d46b3"}),
-		Prompt:        charmStyles.Prompt.Copy().Foreground(lipgloss.AdaptiveColor{Light: "#9B9B9B", Dark: "#5C5C5C"}),
-		FocusedPrompt: charmStyles.FocusedPrompt.Copy().Foreground(lipgloss.Color("#651fff")),
-		Fuchsia:       charmStyles.SelectedMenuItem.Copy(),
-		Logo:          charmStyles.Logo.Copy().SetString("Coder"),
-		Warn: lipgloss.NewStyle().Foreground(
-			lipgloss.AdaptiveColor{Light: "#04B575", Dark: "#ECFD65"},
-		),
-		Wrap: lipgloss.NewStyle().Width(80),
+		Code: pretty.Style{
+			ifTerm(pretty.XPad(1, 1)),
+			pretty.FgColor(Red),
+			pretty.BgColor(color.Color("#2c2c2c")),
+		},
+		DateTimeStamp: pretty.Style{
+			pretty.FgColor(color.Color("#7571F9")),
+		},
+		Error: pretty.Style{
+			pretty.FgColor(Red),
+		},
+		Field: pretty.Style{
+			pretty.XPad(1, 1),
+			pretty.FgColor(color.Color("#FFFFFF")),
+			pretty.BgColor(color.Color("#2b2a2a")),
+		},
+		Keyword: pretty.Style{
+			pretty.FgColor(Green),
+		},
+		Placeholder: pretty.Style{
+			pretty.FgColor(color.Color("#4d46b3")),
+		},
+		Prompt: pretty.Style{
+			pretty.FgColor(color.Color("#5C5C5C")),
+			pretty.Wrap("> ", ""),
+		},
+		Warn: pretty.Style{
+			pretty.FgColor(Yellow),
+		},
+		Wrap: pretty.Style{
+			pretty.LineWrap(80),
+		},
 	}
+
+	DefaultStyles.FocusedPrompt = append(
+		DefaultStyles.Prompt,
+		pretty.FgColor(Blue),
+	)
 }
 
 // ValidateNotEmpty is a helper function to disallow empty inputs!
diff --git a/cli/cliui/externalauth.go b/cli/cliui/externalauth.go
new file mode 100644
index 0000000000000..2e416ae3b5825
--- /dev/null
+++ b/cli/cliui/externalauth.go
@@ -0,0 +1,72 @@
+package cliui
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"time"
+
+	"github.com/briandowns/spinner"
+
+	"github.com/coder/coder/v2/codersdk"
+)
+
+type ExternalAuthOptions struct {
+	Fetch         func(context.Context) ([]codersdk.TemplateVersionExternalAuth, error)
+	FetchInterval time.Duration
+}
+
+func ExternalAuth(ctx context.Context, writer io.Writer, opts ExternalAuthOptions) error {
+	if opts.FetchInterval == 0 {
+		opts.FetchInterval = 500 * time.Millisecond
+	}
+	gitAuth, err := opts.Fetch(ctx)
+	if err != nil {
+		return err
+	}
+
+	spin := spinner.New(spinner.CharSets[78], 100*time.Millisecond, spinner.WithColor("fgHiGreen"))
+	spin.Writer = writer
+	spin.ForceOutput = true
+	spin.Suffix = " Waiting for Git authentication..."
+	defer spin.Stop()
+
+	ticker := time.NewTicker(opts.FetchInterval)
+	defer ticker.Stop()
+	for _, auth := range gitAuth {
+		if auth.Authenticated {
+			return nil
+		}
+
+		_, _ = fmt.Fprintf(writer, "You must authenticate with %s to create a workspace with this template. Visit:\n\n\t%s\n\n", auth.DisplayName, auth.AuthenticateURL)
+
+		ticker.Reset(opts.FetchInterval)
+		spin.Start()
+		for {
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			case <-ticker.C:
+			}
+			gitAuth, err := opts.Fetch(ctx)
+			if err != nil {
+				return err
+			}
+			var authed bool
+			for _, a := range gitAuth {
+				if !a.Authenticated || a.ID != auth.ID {
+					continue
+				}
+				authed = true
+				break
+			}
+			// The user authenticated with the provider!
+			if authed {
+				break
+			}
+		}
+		spin.Stop()
+		_, _ = fmt.Fprintf(writer, "Successfully authenticated with %s!\n\n", auth.DisplayName)
+	}
+	return nil
+}
diff --git a/cli/cliui/externalauth_test.go b/cli/cliui/externalauth_test.go
new file mode 100644
index 0000000000000..32deb7290502a
--- /dev/null
+++ b/cli/cliui/externalauth_test.go
@@ -0,0 +1,57 @@
+package cliui_test
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestExternalAuth(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+
+	ptty := ptytest.New(t)
+	cmd := &clibase.Cmd{
+		Handler: func(inv *clibase.Invocation) error {
+			var fetched atomic.Bool
+			return cliui.ExternalAuth(inv.Context(), inv.Stdout, cliui.ExternalAuthOptions{
+				Fetch: func(ctx context.Context) ([]codersdk.TemplateVersionExternalAuth, error) {
+					defer fetched.Store(true)
+					return []codersdk.TemplateVersionExternalAuth{{
+						ID:              "github",
+						DisplayName:     "GitHub",
+						Type:            codersdk.EnhancedExternalAuthProviderGitHub.String(),
+						Authenticated:   fetched.Load(),
+						AuthenticateURL: "https://example.com/gitauth/github",
+					}}, nil
+				},
+				FetchInterval: time.Millisecond,
+			})
+		},
+	}
+
+	inv := cmd.Invoke().WithContext(ctx)
+
+	ptty.Attach(inv)
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		err := inv.Run()
+		assert.NoError(t, err)
+	}()
+	ptty.ExpectMatchContext(ctx, "You must authenticate with")
+	ptty.ExpectMatchContext(ctx, "https://example.com/gitauth/github")
+	ptty.ExpectMatchContext(ctx, "Successfully authenticated with GitHub")
+	<-done
+}
diff --git a/cli/cliui/gitauth.go b/cli/cliui/gitauth.go
deleted file mode 100644
index 7b4bd6f30e264..0000000000000
--- a/cli/cliui/gitauth.go
+++ /dev/null
@@ -1,72 +0,0 @@
-package cliui
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"time"
-
-	"github.com/briandowns/spinner"
-
-	"github.com/coder/coder/codersdk"
-)
-
-type GitAuthOptions struct {
-	Fetch         func(context.Context) ([]codersdk.TemplateVersionGitAuth, error)
-	FetchInterval time.Duration
-}
-
-func GitAuth(ctx context.Context, writer io.Writer, opts GitAuthOptions) error {
-	if opts.FetchInterval == 0 {
-		opts.FetchInterval = 500 * time.Millisecond
-	}
-	gitAuth, err := opts.Fetch(ctx)
-	if err != nil {
-		return err
-	}
-
-	spin := spinner.New(spinner.CharSets[78], 100*time.Millisecond, spinner.WithColor("fgHiGreen"))
-	spin.Writer = writer
-	spin.ForceOutput = true
-	spin.Suffix = " Waiting for Git authentication..."
-	defer spin.Stop()
-
-	ticker := time.NewTicker(opts.FetchInterval)
-	defer ticker.Stop()
-	for _, auth := range gitAuth {
-		if auth.Authenticated {
-			return nil
-		}
-
-		_, _ = fmt.Fprintf(writer, "You must authenticate with %s to create a workspace with this template. Visit:\n\n\t%s\n\n", auth.Type.Pretty(), auth.AuthenticateURL)
-
-		ticker.Reset(opts.FetchInterval)
-		spin.Start()
-		for {
-			select {
-			case <-ctx.Done():
-				return ctx.Err()
-			case <-ticker.C:
-			}
-			gitAuth, err := opts.Fetch(ctx)
-			if err != nil {
-				return err
-			}
-			var authed bool
-			for _, a := range gitAuth {
-				if !a.Authenticated || a.ID != auth.ID {
-					continue
-				}
-				authed = true
-				break
-			}
-			// The user authenticated with the provider!
-			if authed {
-				break
-			}
-		}
-		spin.Stop()
-		_, _ = fmt.Fprintf(writer, "Successfully authenticated with %s!\n\n", auth.Type.Pretty())
-	}
-	return nil
-}
diff --git a/cli/cliui/gitauth_test.go b/cli/cliui/gitauth_test.go
deleted file mode 100644
index dfe142f99be28..0000000000000
--- a/cli/cliui/gitauth_test.go
+++ /dev/null
@@ -1,56 +0,0 @@
-package cliui_test
-
-import (
-	"context"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
-)
-
-func TestGitAuth(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
-	defer cancel()
-
-	ptty := ptytest.New(t)
-	cmd := &clibase.Cmd{
-		Handler: func(inv *clibase.Invocation) error {
-			var fetched atomic.Bool
-			return cliui.GitAuth(inv.Context(), inv.Stdout, cliui.GitAuthOptions{
-				Fetch: func(ctx context.Context) ([]codersdk.TemplateVersionGitAuth, error) {
-					defer fetched.Store(true)
-					return []codersdk.TemplateVersionGitAuth{{
-						ID:              "github",
-						Type:            codersdk.GitProviderGitHub,
-						Authenticated:   fetched.Load(),
-						AuthenticateURL: "https://example.com/gitauth/github",
-					}}, nil
-				},
-				FetchInterval: time.Millisecond,
-			})
-		},
-	}
-
-	inv := cmd.Invoke().WithContext(ctx)
-
-	ptty.Attach(inv)
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		err := inv.Run()
-		assert.NoError(t, err)
-	}()
-	ptty.ExpectMatchContext(ctx, "You must authenticate with")
-	ptty.ExpectMatchContext(ctx, "https://example.com/gitauth/github")
-	ptty.ExpectMatchContext(ctx, "Successfully authenticated with GitHub")
-	<-done
-}
diff --git a/cli/cliui/log.go b/cli/cliui/log.go
index fcc1d9b317c17..675aed0adc53c 100644
--- a/cli/cliui/log.go
+++ b/cli/cliui/log.go
@@ -5,12 +5,12 @@ import (
 	"io"
 	"strings"
 
-	"github.com/charmbracelet/lipgloss"
+	"github.com/coder/pretty"
 )
 
 // cliMessage provides a human-readable message for CLI errors and messages.
 type cliMessage struct {
-	Style  lipgloss.Style
+	Style  pretty.Style
 	Header string
 	Prefix string
 	Lines  []string
@@ -21,13 +21,13 @@ func (m cliMessage) String() string {
 	var str strings.Builder
 
 	if m.Prefix != "" {
-		_, _ = str.WriteString(m.Style.Bold(true).Render(m.Prefix))
+		_, _ = str.WriteString(Bold(m.Prefix))
 	}
 
-	_, _ = str.WriteString(m.Style.Bold(false).Render(m.Header))
+	pretty.Fprint(&str, m.Style, m.Header)
 	_, _ = str.WriteString("\r\n")
 	for _, line := range m.Lines {
-		_, _ = fmt.Fprintf(&str, "  %s %s\r\n", m.Style.Render("|"), line)
+		_, _ = fmt.Fprintf(&str, "  %s %s\r\n", pretty.Sprint(m.Style, "|"), line)
 	}
 	return str.String()
 }
@@ -35,7 +35,7 @@ func (m cliMessage) String() string {
 // Warn writes a log to the writer provided.
 func Warn(wtr io.Writer, header string, lines ...string) {
 	_, _ = fmt.Fprint(wtr, cliMessage{
-		Style:  DefaultStyles.Warn.Copy(),
+		Style:  DefaultStyles.Warn,
 		Prefix: "WARN: ",
 		Header: header,
 		Lines:  lines,
@@ -63,7 +63,7 @@ func Infof(wtr io.Writer, fmtStr string, args ...interface{}) {
 // Error writes a log to the writer provided.
 func Error(wtr io.Writer, header string, lines ...string) {
 	_, _ = fmt.Fprint(wtr, cliMessage{
-		Style:  DefaultStyles.Error.Copy(),
+		Style:  DefaultStyles.Error,
 		Prefix: "ERROR: ",
 		Header: header,
 		Lines:  lines,
diff --git a/cli/cliui/output.go b/cli/cliui/output.go
index d4cada78f1a03..63a4d4ee5d2c4 100644
--- a/cli/cliui/output.go
+++ b/cli/cliui/output.go
@@ -9,7 +9,7 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
+	"github.com/coder/coder/v2/cli/clibase"
 )
 
 type OutputFormat interface {
diff --git a/cli/cliui/output_test.go b/cli/cliui/output_test.go
index 22ef241fba7ea..e74213803f09b 100644
--- a/cli/cliui/output_test.go
+++ b/cli/cliui/output_test.go
@@ -8,8 +8,8 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
 )
 
 type format struct {
diff --git a/cli/cliui/parameter.go b/cli/cliui/parameter.go
index f0f4fd99e45d0..3482e285e002d 100644
--- a/cli/cliui/parameter.go
+++ b/cli/cliui/parameter.go
@@ -5,8 +5,9 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/pretty"
 )
 
 func RichParameter(inv *clibase.Invocation, templateVersionParameter codersdk.TemplateVersionParameter) (string, error) {
@@ -16,10 +17,10 @@ func RichParameter(inv *clibase.Invocation, templateVersionParameter codersdk.Te
 	}
 
 	if templateVersionParameter.Ephemeral {
-		label += DefaultStyles.Warn.Render(" (build option)")
+		label += pretty.Sprint(DefaultStyles.Warn, " (build option)")
 	}
 
-	_, _ = fmt.Fprintln(inv.Stdout, DefaultStyles.Bold.Render(label))
+	_, _ = fmt.Fprintln(inv.Stdout, Bold(label))
 
 	if templateVersionParameter.DescriptionPlaintext != "" {
 		_, _ = fmt.Fprintln(inv.Stdout, "  "+strings.TrimSpace(strings.Join(strings.Split(templateVersionParameter.DescriptionPlaintext, "\n"), "\n  "))+"\n")
@@ -45,7 +46,10 @@ func RichParameter(inv *clibase.Invocation, templateVersionParameter codersdk.Te
 			}
 
 			_, _ = fmt.Fprintln(inv.Stdout)
-			_, _ = fmt.Fprintln(inv.Stdout, "  "+DefaultStyles.Prompt.String()+DefaultStyles.Field.Render(strings.Join(values, ", ")))
+			pretty.Fprintf(
+				inv.Stdout,
+				DefaultStyles.Prompt, "%s\n", strings.Join(values, ", "),
+			)
 			value = string(v)
 		}
 	} else if len(templateVersionParameter.Options) > 0 {
@@ -59,7 +63,7 @@ func RichParameter(inv *clibase.Invocation, templateVersionParameter codersdk.Te
 		})
 		if err == nil {
 			_, _ = fmt.Fprintln(inv.Stdout)
-			_, _ = fmt.Fprintln(inv.Stdout, "  "+DefaultStyles.Prompt.String()+DefaultStyles.Field.Render(richParameterOption.Name))
+			pretty.Fprintf(inv.Stdout, DefaultStyles.Prompt, "%s\n", richParameterOption.Name)
 			value = richParameterOption.Value
 		}
 	} else {
@@ -70,7 +74,7 @@ func RichParameter(inv *clibase.Invocation, templateVersionParameter codersdk.Te
 		text += ":"
 
 		value, err = Prompt(inv, PromptOptions{
-			Text: DefaultStyles.Bold.Render(text),
+			Text: Bold(text),
 			Validate: func(value string) error {
 				return validateRichPrompt(value, templateVersionParameter)
 			},
diff --git a/cli/cliui/prompt.go b/cli/cliui/prompt.go
index f927b60749769..4d7cb6d4166df 100644
--- a/cli/cliui/prompt.go
+++ b/cli/cliui/prompt.go
@@ -13,7 +13,8 @@ import (
 	"github.com/mattn/go-isatty"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/pretty"
 )
 
 // PromptOptions supply a set of options to the prompt.
@@ -55,21 +56,24 @@ func Prompt(inv *clibase.Invocation, opts PromptOptions) (string, error) {
 		}
 	}
 
-	_, _ = fmt.Fprint(inv.Stdout, DefaultStyles.FocusedPrompt.String()+opts.Text+" ")
+	pretty.Fprintf(inv.Stdout, DefaultStyles.FocusedPrompt, "")
+	pretty.Fprintf(inv.Stdout, pretty.Nop, "%s ", opts.Text)
 	if opts.IsConfirm {
 		if len(opts.Default) == 0 {
 			opts.Default = ConfirmYes
 		}
-		renderedYes := DefaultStyles.Placeholder.Render(ConfirmYes)
-		renderedNo := DefaultStyles.Placeholder.Render(ConfirmNo)
+		var (
+			renderedYes = pretty.Sprint(DefaultStyles.Placeholder, ConfirmYes)
+			renderedNo  = pretty.Sprint(DefaultStyles.Placeholder, ConfirmNo)
+		)
 		if opts.Default == ConfirmYes {
-			renderedYes = DefaultStyles.Bold.Render(ConfirmYes)
+			renderedYes = Bold(ConfirmYes)
 		} else {
-			renderedNo = DefaultStyles.Bold.Render(ConfirmNo)
+			renderedNo = Bold(ConfirmNo)
 		}
-		_, _ = fmt.Fprint(inv.Stdout, DefaultStyles.Placeholder.Render("("+renderedYes+DefaultStyles.Placeholder.Render("/"+renderedNo+DefaultStyles.Placeholder.Render(") "))))
+		pretty.Fprintf(inv.Stdout, DefaultStyles.Placeholder, "(%s/%s)", renderedYes, renderedNo)
 	} else if opts.Default != "" {
-		_, _ = fmt.Fprint(inv.Stdout, DefaultStyles.Placeholder.Render("("+opts.Default+") "))
+		_, _ = fmt.Fprint(inv.Stdout, pretty.Sprint(DefaultStyles.Placeholder, "("+opts.Default+") "))
 	}
 	interrupt := make(chan os.Signal, 1)
 
@@ -126,7 +130,7 @@ func Prompt(inv *clibase.Invocation, opts PromptOptions) (string, error) {
 		if opts.Validate != nil {
 			err := opts.Validate(line)
 			if err != nil {
-				_, _ = fmt.Fprintln(inv.Stdout, DefaultStyles.Error.Render(err.Error()))
+				_, _ = fmt.Fprintln(inv.Stdout, pretty.Sprint(DefaultStyles.Error, err.Error()))
 				return Prompt(inv, opts)
 			}
 		}
diff --git a/cli/cliui/prompt_test.go b/cli/cliui/prompt_test.go
index 49f6dee46e957..69fc3a539f4df 100644
--- a/cli/cliui/prompt_test.go
+++ b/cli/cliui/prompt_test.go
@@ -11,11 +11,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/pty"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/pty"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestPrompt(t *testing.T) {
diff --git a/cli/cliui/provisionerjob.go b/cli/cliui/provisionerjob.go
index 16d2f366e531c..aeaea7a34cf45 100644
--- a/cli/cliui/provisionerjob.go
+++ b/cli/cliui/provisionerjob.go
@@ -14,7 +14,8 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/pretty"
 )
 
 func WorkspaceBuild(ctx context.Context, writer io.Writer, client *codersdk.Client, build uuid.UUID) error {
@@ -54,7 +55,7 @@ func (err *ProvisionerJobError) Error() string {
 }
 
 // ProvisionerJob renders a provisioner job with interactive cancellation.
-func ProvisionerJob(ctx context.Context, writer io.Writer, opts ProvisionerJobOptions) error {
+func ProvisionerJob(ctx context.Context, wr io.Writer, opts ProvisionerJobOptions) error {
 	if opts.FetchInterval == 0 {
 		opts.FetchInterval = time.Second
 	}
@@ -70,7 +71,7 @@ func ProvisionerJob(ctx context.Context, writer io.Writer, opts ProvisionerJobOp
 		jobMutex sync.Mutex
 	)
 
-	sw := &stageWriter{w: writer, verbose: opts.Verbose, silentLogs: opts.Silent}
+	sw := &stageWriter{w: wr, verbose: opts.Verbose, silentLogs: opts.Silent}
 
 	printStage := func() {
 		sw.Start(currentStage)
@@ -127,7 +128,11 @@ func ProvisionerJob(ctx context.Context, writer io.Writer, opts ProvisionerJobOp
 					return
 				}
 			}
-			_, _ = fmt.Fprintf(writer, DefaultStyles.FocusedPrompt.String()+DefaultStyles.Bold.Render("Gracefully canceling...")+"\n\n")
+			pretty.Fprintf(
+				wr,
+				DefaultStyles.FocusedPrompt.With(BoldFmt()),
+				"Gracefully canceling...\n\n",
+			)
 			err := opts.Cancel()
 			if err != nil {
 				errChan <- xerrors.Errorf("cancel: %w", err)
@@ -236,7 +241,7 @@ func (s *stageWriter) Log(createdAt time.Time, level codersdk.LogLevel, line str
 		w = &s.logBuf
 	}
 
-	render := func(s ...string) string { return strings.Join(s, " ") }
+	var style pretty.Style
 
 	var lines []string
 	if !createdAt.IsZero() {
@@ -249,14 +254,14 @@ func (s *stageWriter) Log(createdAt time.Time, level codersdk.LogLevel, line str
 		if !s.verbose {
 			return
 		}
-		render = DefaultStyles.Placeholder.Render
+		style = DefaultStyles.Placeholder
 	case codersdk.LogLevelError:
-		render = DefaultStyles.Error.Render
+		style = DefaultStyles.Error
 	case codersdk.LogLevelWarn:
-		render = DefaultStyles.Warn.Render
+		style = DefaultStyles.Warn
 	case codersdk.LogLevelInfo:
 	}
-	_, _ = fmt.Fprintf(w, "%s\n", render(lines...))
+	pretty.Fprintf(w, style, "%s\n", strings.Join(lines, " "))
 }
 
 func (s *stageWriter) flushLogs() {
diff --git a/cli/cliui/provisionerjob_test.go b/cli/cliui/provisionerjob_test.go
index 2aa25b6046517..b180a1ec9b52d 100644
--- a/cli/cliui/provisionerjob_test.go
+++ b/cli/cliui/provisionerjob_test.go
@@ -11,11 +11,11 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 // This cannot be ran in parallel because it uses a signal.
@@ -29,13 +29,13 @@ func TestProvisionerJob(t *testing.T) {
 			<-test.Next
 			test.JobMutex.Lock()
 			test.Job.Status = codersdk.ProvisionerJobRunning
-			now := database.Now()
+			now := dbtime.Now()
 			test.Job.StartedAt = &now
 			test.JobMutex.Unlock()
 			<-test.Next
 			test.JobMutex.Lock()
 			test.Job.Status = codersdk.ProvisionerJobSucceeded
-			now = database.Now()
+			now = dbtime.Now()
 			test.Job.CompletedAt = &now
 			close(test.Logs)
 			test.JobMutex.Unlock()
@@ -56,17 +56,17 @@ func TestProvisionerJob(t *testing.T) {
 			<-test.Next
 			test.JobMutex.Lock()
 			test.Job.Status = codersdk.ProvisionerJobRunning
-			now := database.Now()
+			now := dbtime.Now()
 			test.Job.StartedAt = &now
 			test.Logs <- codersdk.ProvisionerJobLog{
-				CreatedAt: database.Now(),
+				CreatedAt: dbtime.Now(),
 				Stage:     "Something",
 			}
 			test.JobMutex.Unlock()
 			<-test.Next
 			test.JobMutex.Lock()
 			test.Job.Status = codersdk.ProvisionerJobSucceeded
-			now = database.Now()
+			now = dbtime.Now()
 			test.Job.CompletedAt = &now
 			close(test.Logs)
 			test.JobMutex.Unlock()
@@ -99,7 +99,7 @@ func TestProvisionerJob(t *testing.T) {
 			<-test.Next
 			test.JobMutex.Lock()
 			test.Job.Status = codersdk.ProvisionerJobCanceled
-			now := database.Now()
+			now := dbtime.Now()
 			test.Job.CompletedAt = &now
 			close(test.Logs)
 			test.JobMutex.Unlock()
@@ -123,7 +123,7 @@ type provisionerJobTest struct {
 func newProvisionerJob(t *testing.T) provisionerJobTest {
 	job := &codersdk.ProvisionerJob{
 		Status:    codersdk.ProvisionerJobPending,
-		CreatedAt: database.Now(),
+		CreatedAt: dbtime.Now(),
 	}
 	jobLock := sync.Mutex{}
 	logs := make(chan codersdk.ProvisionerJobLog, 1)
diff --git a/cli/cliui/resources.go b/cli/cliui/resources.go
index 586d37eb5cc81..a9204c968c10a 100644
--- a/cli/cliui/resources.go
+++ b/cli/cliui/resources.go
@@ -9,9 +9,9 @@ import (
 	"github.com/jedib0t/go-pretty/v6/table"
 	"golang.org/x/mod/semver"
 
-	"github.com/coder/coder/coderd/database"
-
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/pretty"
 )
 
 type WorkspaceResourcesOptions struct {
@@ -79,7 +79,7 @@ func WorkspaceResources(writer io.Writer, resources []codersdk.WorkspaceResource
 
 		// Display a line for the resource.
 		tableWriter.AppendRow(table.Row{
-			DefaultStyles.Bold.Render(resourceAddress),
+			Bold(resourceAddress),
 			"",
 			"",
 			"",
@@ -108,7 +108,7 @@ func WorkspaceResources(writer io.Writer, resources []codersdk.WorkspaceResource
 				if totalAgents > 1 {
 					sshCommand += "." + agent.Name
 				}
-				sshCommand = DefaultStyles.Code.Render(sshCommand)
+				sshCommand = pretty.Sprint(DefaultStyles.Code, sshCommand)
 				row = append(row, sshCommand)
 			}
 			tableWriter.AppendRow(row)
@@ -122,32 +122,32 @@ func WorkspaceResources(writer io.Writer, resources []codersdk.WorkspaceResource
 func renderAgentStatus(agent codersdk.WorkspaceAgent) string {
 	switch agent.Status {
 	case codersdk.WorkspaceAgentConnecting:
-		since := database.Now().Sub(agent.CreatedAt)
-		return DefaultStyles.Warn.Render("⦾ connecting") + " " +
-			DefaultStyles.Placeholder.Render("["+strconv.Itoa(int(since.Seconds()))+"s]")
+		since := dbtime.Now().Sub(agent.CreatedAt)
+		return pretty.Sprint(DefaultStyles.Warn, "⦾ connecting") + " " +
+			pretty.Sprint(DefaultStyles.Placeholder, "["+strconv.Itoa(int(since.Seconds()))+"s]")
 	case codersdk.WorkspaceAgentDisconnected:
-		since := database.Now().Sub(*agent.DisconnectedAt)
-		return DefaultStyles.Error.Render("⦾ disconnected") + " " +
-			DefaultStyles.Placeholder.Render("["+strconv.Itoa(int(since.Seconds()))+"s]")
+		since := dbtime.Now().Sub(*agent.DisconnectedAt)
+		return pretty.Sprint(DefaultStyles.Error, "⦾ disconnected") + " " +
+			pretty.Sprint(DefaultStyles.Placeholder, "["+strconv.Itoa(int(since.Seconds()))+"s]")
 	case codersdk.WorkspaceAgentTimeout:
-		since := database.Now().Sub(agent.CreatedAt)
+		since := dbtime.Now().Sub(agent.CreatedAt)
 		return fmt.Sprintf(
 			"%s %s",
-			DefaultStyles.Warn.Render("⦾ timeout"),
-			DefaultStyles.Placeholder.Render("["+strconv.Itoa(int(since.Seconds()))+"s]"),
+			pretty.Sprint(DefaultStyles.Warn, "⦾ timeout"),
+			pretty.Sprint(DefaultStyles.Placeholder, "["+strconv.Itoa(int(since.Seconds()))+"s]"),
 		)
 	case codersdk.WorkspaceAgentConnected:
-		return DefaultStyles.Keyword.Render("⦿ connected")
+		return pretty.Sprint(DefaultStyles.Keyword, "⦿ connected")
 	default:
-		return DefaultStyles.Warn.Render("○ unknown")
+		return pretty.Sprint(DefaultStyles.Warn, "○ unknown")
 	}
 }
 
 func renderAgentHealth(agent codersdk.WorkspaceAgent) string {
 	if agent.Health.Healthy {
-		return DefaultStyles.Keyword.Render("✔ healthy")
+		return pretty.Sprint(DefaultStyles.Keyword, "✔ healthy")
 	}
-	return DefaultStyles.Error.Render("✘ " + agent.Health.Reason)
+	return pretty.Sprint(DefaultStyles.Error, "✘ "+agent.Health.Reason)
 }
 
 func renderAgentVersion(agentVersion, serverVersion string) string {
@@ -155,11 +155,11 @@ func renderAgentVersion(agentVersion, serverVersion string) string {
 		agentVersion = "(unknown)"
 	}
 	if !semver.IsValid(serverVersion) || !semver.IsValid(agentVersion) {
-		return DefaultStyles.Placeholder.Render(agentVersion)
+		return pretty.Sprint(DefaultStyles.Placeholder, agentVersion)
 	}
 	outdated := semver.Compare(agentVersion, serverVersion) < 0
 	if outdated {
-		return DefaultStyles.Warn.Render(agentVersion + " (outdated)")
+		return pretty.Sprint(DefaultStyles.Warn, agentVersion+" (outdated)")
 	}
-	return DefaultStyles.Keyword.Render(agentVersion)
+	return pretty.Sprint(DefaultStyles.Keyword, agentVersion)
 }
diff --git a/cli/cliui/resources_internal_test.go b/cli/cliui/resources_internal_test.go
index 21212f8873691..0c76e18eb1d1f 100644
--- a/cli/cliui/resources_internal_test.go
+++ b/cli/cliui/resources_internal_test.go
@@ -44,7 +44,7 @@ func TestRenderAgentVersion(t *testing.T) {
 		t.Run(testCase.name, func(t *testing.T) {
 			t.Parallel()
 			actual := renderAgentVersion(testCase.agentVersion, testCase.serverVersion)
-			assert.Equal(t, testCase.expected, actual)
+			assert.Equal(t, testCase.expected, (actual))
 		})
 	}
 }
diff --git a/cli/cliui/resources_test.go b/cli/cliui/resources_test.go
index c9d87c258a6e4..fb9bea8773cac 100644
--- a/cli/cliui/resources_test.go
+++ b/cli/cliui/resources_test.go
@@ -6,10 +6,10 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestWorkspaceResources(t *testing.T) {
@@ -44,7 +44,7 @@ func TestWorkspaceResources(t *testing.T) {
 	t.Run("MultipleStates", func(t *testing.T) {
 		t.Parallel()
 		ptty := ptytest.New(t)
-		disconnected := database.Now().Add(-4 * time.Second)
+		disconnected := dbtime.Now().Add(-4 * time.Second)
 		done := make(chan struct{})
 		go func() {
 			err := cliui.WorkspaceResources(ptty.Output(), []codersdk.WorkspaceResource{{
@@ -60,7 +60,7 @@ func TestWorkspaceResources(t *testing.T) {
 				Type:       "google_compute_instance",
 				Name:       "dev",
 				Agents: []codersdk.WorkspaceAgent{{
-					CreatedAt:       database.Now().Add(-10 * time.Second),
+					CreatedAt:       dbtime.Now().Add(-10 * time.Second),
 					Status:          codersdk.WorkspaceAgentConnecting,
 					LifecycleState:  codersdk.WorkspaceAgentLifecycleCreated,
 					Name:            "dev",
diff --git a/cli/cliui/select.go b/cli/cliui/select.go
index 52a255367ebcf..fafd1c9fcd368 100644
--- a/cli/cliui/select.go
+++ b/cli/cliui/select.go
@@ -10,8 +10,8 @@ import (
 	"github.com/AlecAivazis/survey/v2/terminal"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func init() {
diff --git a/cli/cliui/select_test.go b/cli/cliui/select_test.go
index f7467098cb263..9465d82b45c8f 100644
--- a/cli/cliui/select_test.go
+++ b/cli/cliui/select_test.go
@@ -6,10 +6,10 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestSelect(t *testing.T) {
diff --git a/cli/cliui/table_test.go b/cli/cliui/table_test.go
index aca6f7bc825fd..32159abb9fc2b 100644
--- a/cli/cliui/table_test.go
+++ b/cli/cliui/table_test.go
@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/cliui"
+	"github.com/coder/coder/v2/cli/cliui"
 )
 
 type stringWrapper struct {
diff --git a/cli/config/file_test.go b/cli/config/file_test.go
index b3ca15322e217..3177bbfaca101 100644
--- a/cli/config/file_test.go
+++ b/cli/config/file_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/config"
+	"github.com/coder/coder/v2/cli/config"
 )
 
 func TestFile(t *testing.T) {
diff --git a/cli/configssh.go b/cli/configssh.go
index 162c3c2a95855..7e9e8109ea554 100644
--- a/cli/configssh.go
+++ b/cli/configssh.go
@@ -22,9 +22,10 @@ import (
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 const (
@@ -189,7 +190,6 @@ func sshPrepareWorkspaceConfigs(ctx context.Context, client *codersdk.Client) (r
 	}
 }
 
-//nolint:gocyclo
 func (r *RootCmd) configSSH() *clibase.Cmd {
 	var (
 		sshConfigFile       string
@@ -367,8 +367,8 @@ func (r *RootCmd) configSSH() *clibase.Cmd {
 			}
 
 			// Ensure stable sorting of output.
-			slices.SortFunc(workspaceConfigs, func(a, b sshWorkspaceConfig) bool {
-				return a.Name < b.Name
+			slices.SortFunc(workspaceConfigs, func(a, b sshWorkspaceConfig) int {
+				return slice.Ascending(a.Name, b.Name)
 			})
 			for _, wc := range workspaceConfigs {
 				sort.Strings(wc.Hosts)
diff --git a/cli/configssh_test.go b/cli/configssh_test.go
index 34da7dd03fcc0..a39afe606f873 100644
--- a/cli/configssh_test.go
+++ b/cli/configssh_test.go
@@ -19,17 +19,14 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"cdr.dev/slog/sloggers/slogtest"
-
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func sshConfigFileName(t *testing.T) (sshConfig string) {
@@ -78,13 +75,14 @@ func TestConfigSSH(t *testing.T) {
 			},
 		},
 	})
-	user := coderdtest.CreateFirstUser(t, client)
+	owner := coderdtest.CreateFirstUser(t, client)
+	member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 	authToken := uuid.NewString()
-	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+	version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
 		Parse: echo.ParseComplete,
-		ProvisionPlan: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionPlan: []*proto.Response{{
+			Type: &proto.Response_Plan{
+				Plan: &proto.PlanComplete{
 					Resources: []*proto.Resource{{
 						Name: "example",
 						Type: "aws_instance",
@@ -98,19 +96,11 @@ func TestConfigSSH(t *testing.T) {
 		}},
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: slogtest.Make(t, nil).Named("agent"),
-	})
-	defer func() {
-		_ = agentCloser.Close()
-	}()
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+	template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+	workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+	_ = agenttest.New(t, client.URL, authToken)
 	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 	agentConn, err := client.DialWorkspaceAgent(context.Background(), resources[0].Agents[0].ID, nil)
 	require.NoError(t, err)
@@ -156,7 +146,7 @@ func TestConfigSSH(t *testing.T) {
 		"--ssh-option", "Port "+strconv.Itoa(tcpAddr.Port),
 		"--ssh-config-file", sshConfigFile,
 		"--skip-proxy-command")
-	clitest.SetupConfig(t, client, root)
+	clitest.SetupConfig(t, member, root)
 	pty := ptytest.New(t)
 	inv.Stdin = pty.Input()
 	inv.Stdout = pty.Output()
@@ -605,10 +595,10 @@ func TestConfigSSH_FileWriteAndOptionsFlow(t *testing.T) {
 				client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 				user      = coderdtest.CreateFirstUser(t, client)
 				version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, tt.echoResponse)
-				_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+				_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 				project   = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 				workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID)
-				_         = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+				_         = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 			)
 
 			// Prepare ssh config files.
@@ -720,31 +710,21 @@ func TestConfigSSH_Hostnames(t *testing.T) {
 				resources = append(resources, resource)
 			}
 
-			provisionResponse := []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Resources: resources,
-					},
-				},
-			}}
-
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
+			owner := coderdtest.CreateFirstUser(t, client)
+			member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 			// authToken := uuid.NewString()
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-				Parse:          echo.ParseComplete,
-				ProvisionPlan:  provisionResponse,
-				ProvisionApply: provisionResponse,
-			})
-			coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-			workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-			coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+			version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID,
+				echo.WithResources(resources))
+			coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+			workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 			sshConfigFile := sshConfigFileName(t)
 
 			inv, root := clitest.New(t, "config-ssh", "--ssh-config-file", sshConfigFile)
-			clitest.SetupConfig(t, client, root)
+			clitest.SetupConfig(t, member, root)
 
 			pty := ptytest.New(t)
 			inv.Stdin = pty.Input()
diff --git a/cli/create.go b/cli/create.go
index 602b7b40a45bc..733eb99a7103d 100644
--- a/cli/create.go
+++ b/cli/create.go
@@ -10,19 +10,24 @@ import (
 	"golang.org/x/exp/slices"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) create() *clibase.Cmd {
 	var (
-		richParameterFile string
-		templateName      string
-		startAt           string
-		stopAfter         time.Duration
-		workspaceName     string
+		templateName  string
+		startAt       string
+		stopAfter     time.Duration
+		workspaceName string
+
+		parameterFlags workspaceParameterFlags
+		autoUpdates    string
 	)
 	client := new(codersdk.Client)
 	cmd := &clibase.Cmd{
@@ -73,15 +78,15 @@ func (r *RootCmd) create() *clibase.Cmd {
 
 			var template codersdk.Template
 			if templateName == "" {
-				_, _ = fmt.Fprintln(inv.Stdout, cliui.DefaultStyles.Wrap.Render("Select a template below to preview the provisioned infrastructure:"))
+				_, _ = fmt.Fprintln(inv.Stdout, pretty.Sprint(cliui.DefaultStyles.Wrap, "Select a template below to preview the provisioned infrastructure:"))
 
 				templates, err := client.TemplatesByOrganization(inv.Context(), organization.ID)
 				if err != nil {
 					return err
 				}
 
-				slices.SortFunc(templates, func(a, b codersdk.Template) bool {
-					return a.ActiveUserCount > b.ActiveUserCount
+				slices.SortFunc(templates, func(a, b codersdk.Template) int {
+					return slice.Descending(a.ActiveUserCount, b.ActiveUserCount)
 				})
 
 				templateNames := make([]string, 0, len(templates))
@@ -91,7 +96,7 @@ func (r *RootCmd) create() *clibase.Cmd {
 					templateName := template.Name
 
 					if template.ActiveUserCount > 0 {
-						templateName += cliui.DefaultStyles.Placeholder.Render(
+						templateName += cliui.Placeholder(
 							fmt.Sprintf(
 								" (used by %s)",
 								formatActiveDevelopers(template.ActiveUserCount),
@@ -129,10 +134,18 @@ func (r *RootCmd) create() *clibase.Cmd {
 				schedSpec = ptr.Ref(sched.String())
 			}
 
-			buildParams, err := prepWorkspaceBuild(inv, client, prepWorkspaceBuildArgs{
-				Template:          template,
-				RichParameterFile: richParameterFile,
-				NewWorkspaceName:  workspaceName,
+			cliRichParameters, err := asWorkspaceBuildParameters(parameterFlags.richParameters)
+			if err != nil {
+				return xerrors.Errorf("can't parse given parameter values: %w", err)
+			}
+
+			richParameters, err := prepWorkspaceBuild(inv, client, prepWorkspaceBuildArgs{
+				Action:           WorkspaceCreate,
+				Template:         template,
+				NewWorkspaceName: workspaceName,
+
+				RichParameterFile: parameterFlags.richParameterFile,
+				RichParameters:    cliRichParameters,
 			})
 			if err != nil {
 				return xerrors.Errorf("prepare build: %w", err)
@@ -156,7 +169,8 @@ func (r *RootCmd) create() *clibase.Cmd {
 				Name:                workspaceName,
 				AutostartSchedule:   schedSpec,
 				TTLMillis:           ttlMillis,
-				RichParameterValues: buildParams.richParameters,
+				RichParameterValues: richParameters,
+				AutomaticUpdates:    codersdk.AutomaticUpdates(autoUpdates),
 			})
 			if err != nil {
 				return xerrors.Errorf("create workspace: %w", err)
@@ -167,7 +181,12 @@ func (r *RootCmd) create() *clibase.Cmd {
 				return xerrors.Errorf("watch build: %w", err)
 			}
 
-			_, _ = fmt.Fprintf(inv.Stdout, "\nThe %s workspace has been created at %s!\n", cliui.DefaultStyles.Keyword.Render(workspace.Name), cliui.DefaultStyles.DateTimeStamp.Render(time.Now().Format(time.Stamp)))
+			_, _ = fmt.Fprintf(
+				inv.Stdout,
+				"\nThe %s workspace has been created at %s!\n",
+				cliui.Keyword(workspace.Name),
+				cliui.Timestamp(time.Now()),
+			)
 			return nil
 		},
 	}
@@ -179,12 +198,6 @@ func (r *RootCmd) create() *clibase.Cmd {
 			Description:   "Specify a template name.",
 			Value:         clibase.StringOf(&templateName),
 		},
-		clibase.Option{
-			Flag:        "rich-parameter-file",
-			Env:         "CODER_RICH_PARAMETER_FILE",
-			Description: "Specify a file path with values for rich parameters defined in the template.",
-			Value:       clibase.StringOf(&richParameterFile),
-		},
 		clibase.Option{
 			Flag:        "start-at",
 			Env:         "CODER_WORKSPACE_START_AT",
@@ -197,106 +210,73 @@ func (r *RootCmd) create() *clibase.Cmd {
 			Description: "Specify a duration after which the workspace should shut down (e.g. 8h).",
 			Value:       clibase.DurationOf(&stopAfter),
 		},
+		clibase.Option{
+			Flag:        "automatic-updates",
+			Env:         "CODER_WORKSPACE_AUTOMATIC_UPDATES",
+			Description: "Specify automatic updates setting for the workspace (accepts 'always' or 'never').",
+			Default:     string(codersdk.AutomaticUpdatesNever),
+			Value:       clibase.StringOf(&autoUpdates),
+		},
 		cliui.SkipPromptOption(),
 	)
+	cmd.Options = append(cmd.Options, parameterFlags.cliParameters()...)
 	return cmd
 }
 
 type prepWorkspaceBuildArgs struct {
-	Template           codersdk.Template
-	ExistingRichParams []codersdk.WorkspaceBuildParameter
-	RichParameterFile  string
-	NewWorkspaceName   string
-
-	UpdateWorkspace bool
-	BuildOptions    bool
-	WorkspaceID     uuid.UUID
-}
+	Action           WorkspaceCLIAction
+	Template         codersdk.Template
+	NewWorkspaceName string
+	WorkspaceID      uuid.UUID
 
-type buildParameters struct {
-	// Rich parameters stores values for build parameters annotated with description, icon, type, etc.
-	richParameters []codersdk.WorkspaceBuildParameter
+	LastBuildParameters []codersdk.WorkspaceBuildParameter
+
+	PromptBuildOptions bool
+	BuildOptions       []codersdk.WorkspaceBuildParameter
+
+	PromptRichParameters bool
+	RichParameters       []codersdk.WorkspaceBuildParameter
+	RichParameterFile    string
 }
 
 // prepWorkspaceBuild will ensure a workspace build will succeed on the latest template version.
-// Any missing params will be prompted to the user. It supports legacy and rich parameters.
-func prepWorkspaceBuild(inv *clibase.Invocation, client *codersdk.Client, args prepWorkspaceBuildArgs) (*buildParameters, error) {
+// Any missing params will be prompted to the user. It supports rich parameters.
+func prepWorkspaceBuild(inv *clibase.Invocation, client *codersdk.Client, args prepWorkspaceBuildArgs) ([]codersdk.WorkspaceBuildParameter, error) {
 	ctx := inv.Context()
 
 	templateVersion, err := client.TemplateVersion(ctx, args.Template.ActiveVersionID)
 	if err != nil {
-		return nil, err
+		return nil, xerrors.Errorf("get template version: %w", err)
 	}
 
-	// Rich parameters
 	templateVersionParameters, err := client.TemplateVersionRichParameters(inv.Context(), templateVersion.ID)
 	if err != nil {
 		return nil, xerrors.Errorf("get template version rich parameters: %w", err)
 	}
 
-	parameterMapFromFile := map[string]string{}
-	useParamFile := false
+	parameterFile := map[string]string{}
 	if args.RichParameterFile != "" {
-		useParamFile = true
-		_, _ = fmt.Fprintln(inv.Stdout, cliui.DefaultStyles.Paragraph.Render("Attempting to read the variables from the rich parameter file.")+"\r\n")
-		parameterMapFromFile, err = createParameterMapFromFile(args.RichParameterFile)
+		parameterFile, err = parseParameterMapFile(args.RichParameterFile)
 		if err != nil {
-			return nil, err
+			return nil, xerrors.Errorf("can't parse parameter map file: %w", err)
 		}
 	}
-	disclaimerPrinted := false
-	richParameters := make([]codersdk.WorkspaceBuildParameter, 0)
-PromptRichParamLoop:
-	for _, templateVersionParameter := range templateVersionParameters {
-		if !args.BuildOptions && templateVersionParameter.Ephemeral {
-			continue
-		}
-
-		if !disclaimerPrinted {
-			_, _ = fmt.Fprintln(inv.Stdout, cliui.DefaultStyles.Paragraph.Render("This template has customizable parameters. Values can be changed after create, but may have unintended side effects (like data loss).")+"\r\n")
-			disclaimerPrinted = true
-		}
-
-		// Param file is all or nothing
-		if !useParamFile && !templateVersionParameter.Ephemeral {
-			for _, e := range args.ExistingRichParams {
-				if e.Name == templateVersionParameter.Name {
-					// If the param already exists, we do not need to prompt it again.
-					// The workspace scope will reuse params for each build.
-					continue PromptRichParamLoop
-				}
-			}
-		}
 
-		if args.UpdateWorkspace && !templateVersionParameter.Mutable {
-			// Check if the immutable parameter was used in the previous build. If so, then it isn't a fresh one
-			// and the user should be warned.
-			exists, err := workspaceBuildParameterExists(ctx, client, args.WorkspaceID, templateVersionParameter)
-			if err != nil {
-				return nil, err
-			}
-
-			if exists {
-				_, _ = fmt.Fprintln(inv.Stdout, cliui.DefaultStyles.Warn.Render(fmt.Sprintf(`Parameter %q is not mutable, so can't be customized after workspace creation.`, templateVersionParameter.Name)))
-				continue
-			}
-		}
-
-		parameterValue, err := getWorkspaceBuildParameterValueFromMapOrInput(inv, parameterMapFromFile, templateVersionParameter)
-		if err != nil {
-			return nil, err
-		}
-
-		richParameters = append(richParameters, *parameterValue)
-	}
-
-	if disclaimerPrinted {
-		_, _ = fmt.Fprintln(inv.Stdout)
+	resolver := new(ParameterResolver).
+		WithLastBuildParameters(args.LastBuildParameters).
+		WithPromptBuildOptions(args.PromptBuildOptions).
+		WithBuildOptions(args.BuildOptions).
+		WithPromptRichParameters(args.PromptRichParameters).
+		WithRichParameters(args.RichParameters).
+		WithRichParametersFile(parameterFile)
+	buildParameters, err := resolver.Resolve(inv, args.Action, templateVersionParameters)
+	if err != nil {
+		return nil, err
 	}
 
-	err = cliui.GitAuth(ctx, inv.Stdout, cliui.GitAuthOptions{
-		Fetch: func(ctx context.Context) ([]codersdk.TemplateVersionGitAuth, error) {
-			return client.TemplateVersionGitAuth(ctx, templateVersion.ID)
+	err = cliui.ExternalAuth(ctx, inv.Stdout, cliui.ExternalAuthOptions{
+		Fetch: func(ctx context.Context) ([]codersdk.TemplateVersionExternalAuth, error) {
+			return client.TemplateVersionExternalAuth(ctx, templateVersion.ID)
 		},
 	})
 	if err != nil {
@@ -306,7 +286,7 @@ PromptRichParamLoop:
 	// Run a dry-run with the given parameters to check correctness
 	dryRun, err := client.CreateTemplateVersionDryRun(inv.Context(), templateVersion.ID, codersdk.CreateTemplateVersionDryRunRequest{
 		WorkspaceName:       args.NewWorkspaceName,
-		RichParameterValues: richParameters,
+		RichParameterValues: buildParameters,
 	})
 	if err != nil {
 		return nil, xerrors.Errorf("begin workspace dry-run: %w", err)
@@ -346,21 +326,5 @@ PromptRichParamLoop:
 		return nil, xerrors.Errorf("get resources: %w", err)
 	}
 
-	return &buildParameters{
-		richParameters: richParameters,
-	}, nil
-}
-
-func workspaceBuildParameterExists(ctx context.Context, client *codersdk.Client, workspaceID uuid.UUID, templateVersionParameter codersdk.TemplateVersionParameter) (bool, error) {
-	lastBuildParameters, err := client.WorkspaceBuildParameters(ctx, workspaceID)
-	if err != nil {
-		return false, xerrors.Errorf("can't fetch last workspace build parameters: %w", err)
-	}
-
-	for _, p := range lastBuildParameters {
-		if p.Name == templateVersionParameter.Name {
-			return true, nil
-		}
-	}
-	return false, nil
+	return buildParameters, nil
 }
diff --git a/cli/create_test.go b/cli/create_test.go
index 8f2bb6719a377..993ae9e57b441 100644
--- a/cli/create_test.go
+++ b/cli/create_test.go
@@ -2,6 +2,7 @@ package cli_test
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 	"os"
 	"regexp"
@@ -11,15 +12,15 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestCreate(t *testing.T) {
@@ -27,23 +28,21 @@ func TestCreate(t *testing.T) {
 	t.Run("Create", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			Parse:          echo.ParseComplete,
-			ProvisionApply: provisionCompleteWithAgent,
-			ProvisionPlan:  provisionCompleteWithAgent,
-		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, completeWithAgent())
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 		args := []string{
 			"create",
 			"my-workspace",
 			"--template", template.Name,
 			"--start-at", "9:30AM Mon-Fri US/Central",
 			"--stop-after", "8h",
+			"--automatic-updates", "always",
 		}
 		inv, root := clitest.New(t, args...)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -67,7 +66,7 @@ func TestCreate(t *testing.T) {
 		}
 		<-doneChan
 
-		ws, err := client.WorkspaceByOwnerAndName(context.Background(), "testuser", "my-workspace", codersdk.WorkspaceOptions{})
+		ws, err := member.WorkspaceByOwnerAndName(context.Background(), codersdk.Me, "my-workspace", codersdk.WorkspaceOptions{})
 		if assert.NoError(t, err, "expected workspace to be created") {
 			assert.Equal(t, ws.TemplateName, template.Name)
 			if assert.NotNil(t, ws.AutostartSchedule) {
@@ -76,6 +75,7 @@ func TestCreate(t *testing.T) {
 			if assert.NotNil(t, ws.TTLMillis) {
 				assert.Equal(t, *ws.TTLMillis, 8*time.Hour.Milliseconds())
 			}
+			assert.Equal(t, codersdk.AutomaticUpdatesAlways, ws.AutomaticUpdates)
 		}
 	})
 
@@ -83,12 +83,8 @@ func TestCreate(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		owner := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
-			Parse:          echo.ParseComplete,
-			ProvisionApply: provisionCompleteWithAgent,
-			ProvisionPlan:  provisionCompleteWithAgent,
-		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, completeWithAgent())
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 		_, user := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 		args := []string{
@@ -100,6 +96,7 @@ func TestCreate(t *testing.T) {
 		}
 
 		inv, root := clitest.New(t, args...)
+		//nolint:gocritic // Creating a workspace for another user requires owner permissions.
 		clitest.SetupConfig(t, client, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
@@ -139,14 +136,11 @@ func TestCreate(t *testing.T) {
 	t.Run("InheritStopAfterFromTemplate", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			Parse:          echo.ParseComplete,
-			ProvisionApply: provisionCompleteWithAgent,
-			ProvisionPlan:  provisionCompleteWithAgent,
-		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, completeWithAgent())
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 			var defaultTTLMillis int64 = 2 * 60 * 60 * 1000 // 2 hours
 			ctr.DefaultTTLMillis = &defaultTTLMillis
 		})
@@ -156,7 +150,7 @@ func TestCreate(t *testing.T) {
 			"--template", template.Name,
 		}
 		inv, root := clitest.New(t, args...)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		pty := ptytest.New(t).Attach(inv)
 		waiter := clitest.StartWithWaiter(t, inv)
 		matches := []struct {
@@ -175,7 +169,7 @@ func TestCreate(t *testing.T) {
 		}
 		waiter.RequireSuccess()
 
-		ws, err := client.WorkspaceByOwnerAndName(context.Background(), "testuser", "my-workspace", codersdk.WorkspaceOptions{})
+		ws, err := member.WorkspaceByOwnerAndName(context.Background(), codersdk.Me, "my-workspace", codersdk.WorkspaceOptions{})
 		require.NoError(t, err, "expected workspace to be created")
 		assert.Equal(t, ws.TemplateName, template.Name)
 		assert.Equal(t, *ws.TTLMillis, template.DefaultTTLMillis)
@@ -186,7 +180,7 @@ func TestCreate(t *testing.T) {
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		_ = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		inv, root := clitest.New(t, "create", "my-workspace", "-y")
 
@@ -206,12 +200,13 @@ func TestCreate(t *testing.T) {
 	t.Run("FromNothing", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 		inv, root := clitest.New(t, "create", "")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -231,7 +226,7 @@ func TestCreate(t *testing.T) {
 		}
 		<-doneChan
 
-		ws, err := client.WorkspaceByOwnerAndName(inv.Context(), "testuser", "my-workspace", codersdk.WorkspaceOptions{})
+		ws, err := member.WorkspaceByOwnerAndName(inv.Context(), codersdk.Me, "my-workspace", codersdk.WorkspaceOptions{})
 		if assert.NoError(t, err, "expected workspace to be created") {
 			assert.Equal(t, ws.TemplateName, template.Name)
 			assert.Nil(t, ws.AutostartSchedule, "expected workspace autostart schedule to be nil")
@@ -239,6 +234,22 @@ func TestCreate(t *testing.T) {
 	})
 }
 
+func prepareEchoResponses(parameters []*proto.RichParameter) *echo.Responses {
+	return &echo.Responses{
+		Parse: echo.ParseComplete,
+		ProvisionPlan: []*proto.Response{
+			{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
+						Parameters: parameters,
+					},
+				},
+			},
+		},
+		ProvisionApply: echo.ApplyComplete,
+	}
+}
+
 func TestCreateWithRichParameters(t *testing.T) {
 	t.Parallel()
 
@@ -257,40 +268,26 @@ func TestCreateWithRichParameters(t *testing.T) {
 		immutableParameterValue       = "4"
 	)
 
-	echoResponses := &echo.Responses{
-		Parse: echo.ParseComplete,
-		ProvisionPlan: []*proto.Provision_Response{
-			{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Parameters: []*proto.RichParameter{
-							{Name: firstParameterName, Description: firstParameterDescription, Mutable: true},
-							{Name: secondParameterName, DisplayName: secondParameterDisplayName, Description: secondParameterDescription, Mutable: true},
-							{Name: immutableParameterName, Description: immutableParameterDescription, Mutable: false},
-						},
-					},
-				},
-			},
-		},
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{},
-			},
-		}},
-	}
+	echoResponses := prepareEchoResponses([]*proto.RichParameter{
+		{Name: firstParameterName, Description: firstParameterDescription, Mutable: true},
+		{Name: secondParameterName, DisplayName: secondParameterDisplayName, Description: secondParameterDescription, Mutable: true},
+		{Name: immutableParameterName, Description: immutableParameterDescription, Mutable: false},
+	},
+	)
 
 	t.Run("InputParameters", func(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, echoResponses)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -322,11 +319,12 @@ func TestCreateWithRichParameters(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, echoResponses)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		tempDir := t.TempDir()
 		removeTmpDirUntilSuccessAfterTest(t, tempDir)
@@ -336,7 +334,7 @@ func TestCreateWithRichParameters(t *testing.T) {
 				secondParameterName + ": " + secondParameterValue + "\n" +
 				immutableParameterName + ": " + immutableParameterValue)
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name, "--rich-parameter-file", parameterFile.Name())
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
@@ -357,6 +355,42 @@ func TestCreateWithRichParameters(t *testing.T) {
 		}
 		<-doneChan
 	})
+
+	t.Run("ParameterFlags", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+
+		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name,
+			"--parameter", fmt.Sprintf("%s=%s", firstParameterName, firstParameterValue),
+			"--parameter", fmt.Sprintf("%s=%s", secondParameterName, secondParameterValue),
+			"--parameter", fmt.Sprintf("%s=%s", immutableParameterName, immutableParameterValue))
+		clitest.SetupConfig(t, member, root)
+		doneChan := make(chan struct{})
+		pty := ptytest.New(t).Attach(inv)
+		go func() {
+			defer close(doneChan)
+			err := inv.Run()
+			assert.NoError(t, err)
+		}()
+
+		matches := []string{
+			"Confirm create?", "yes",
+		}
+		for i := 0; i < len(matches); i += 2 {
+			match := matches[i]
+			value := matches[i+1]
+			pty.ExpectMatch(match)
+			pty.WriteLine(value)
+		}
+		<-doneChan
+	})
 }
 
 func TestCreateValidateRichParameters(t *testing.T) {
@@ -391,40 +425,19 @@ func TestCreateValidateRichParameters(t *testing.T) {
 		{Name: boolParameterName, Type: "bool", Mutable: true},
 	}
 
-	prepareEchoResponses := func(richParameters []*proto.RichParameter) *echo.Responses {
-		return &echo.Responses{
-			Parse: echo.ParseComplete,
-			ProvisionPlan: []*proto.Provision_Response{
-				{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
-							Parameters: richParameters,
-						},
-					},
-				},
-			},
-			ProvisionApply: []*proto.Provision_Response{
-				{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{},
-					},
-				},
-			},
-		}
-	}
-
 	t.Run("ValidateString", func(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(stringRichParameters))
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(stringRichParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -443,7 +456,9 @@ func TestCreateValidateRichParameters(t *testing.T) {
 			match := matches[i]
 			value := matches[i+1]
 			pty.ExpectMatch(match)
-			pty.WriteLine(value)
+			if value != "" {
+				pty.WriteLine(value)
+			}
 		}
 		<-doneChan
 	})
@@ -452,14 +467,15 @@ func TestCreateValidateRichParameters(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(numberRichParameters))
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(numberRichParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -478,7 +494,6 @@ func TestCreateValidateRichParameters(t *testing.T) {
 			match := matches[i]
 			value := matches[i+1]
 			pty.ExpectMatch(match)
-
 			if value != "" {
 				pty.WriteLine(value)
 			}
@@ -490,14 +505,15 @@ func TestCreateValidateRichParameters(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(boolRichParameters))
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(boolRichParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -516,7 +532,9 @@ func TestCreateValidateRichParameters(t *testing.T) {
 			match := matches[i]
 			value := matches[i+1]
 			pty.ExpectMatch(match)
-			pty.WriteLine(value)
+			if value != "" {
+				pty.WriteLine(value)
+			}
 		}
 		<-doneChan
 	})
@@ -525,13 +543,14 @@ func TestCreateValidateRichParameters(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(listOfStringsRichParameters))
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(listOfStringsRichParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		pty := ptytest.New(t).Attach(inv)
 		clitest.Start(t, inv)
 
@@ -554,10 +573,11 @@ func TestCreateValidateRichParameters(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(listOfStringsRichParameters))
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(listOfStringsRichParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		tempDir := t.TempDir()
 		removeTmpDirUntilSuccessAfterTest(t, tempDir)
@@ -567,7 +587,7 @@ func TestCreateValidateRichParameters(t *testing.T) {
   - eee
   - fff`)
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name, "--rich-parameter-file", parameterFile.Name())
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		pty := ptytest.New(t).Attach(inv)
 
 		clitest.Start(t, inv)
@@ -590,43 +610,41 @@ func TestCreateWithGitAuth(t *testing.T) {
 	t.Parallel()
 	echoResponses := &echo.Responses{
 		Parse: echo.ParseComplete,
-		ProvisionPlan: []*proto.Provision_Response{
+		ProvisionPlan: []*proto.Response{
 			{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						GitAuthProviders: []string{"github"},
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
+						ExternalAuthProviders: []string{"github"},
 					},
 				},
 			},
 		},
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{},
-			},
-		}},
+		ProvisionApply: echo.ApplyComplete,
 	}
 
 	client := coderdtest.New(t, &coderdtest.Options{
-		GitAuthConfigs: []*gitauth.Config{{
+		ExternalAuthConfigs: []*externalauth.Config{{
 			OAuth2Config: &testutil.OAuth2Config{},
 			ID:           "github",
 			Regex:        regexp.MustCompile(`github\.com`),
-			Type:         codersdk.GitProviderGitHub,
+			Type:         codersdk.EnhancedExternalAuthProviderGitHub.String(),
+			DisplayName:  "GitHub",
 		}},
 		IncludeProvisionerDaemon: true,
 	})
-	user := coderdtest.CreateFirstUser(t, client)
-	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, echoResponses)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+	owner := coderdtest.CreateFirstUser(t, client)
+	member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+	version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+	template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 	inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name)
-	clitest.SetupConfig(t, client, root)
+	clitest.SetupConfig(t, member, root)
 	pty := ptytest.New(t).Attach(inv)
 	clitest.Start(t, inv)
 
 	pty.ExpectMatch("You must authenticate with GitHub to create a workspace")
-	resp := coderdtest.RequestGitAuthCallback(t, "github", client)
+	resp := coderdtest.RequestExternalAuthCallback(t, "github", member)
 	_ = resp.Body.Close()
 	require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
 	pty.ExpectMatch("Confirm create?")
diff --git a/cli/delete.go b/cli/delete.go
index 867abe0326a30..a29a821490d9f 100644
--- a/cli/delete.go
+++ b/cli/delete.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // nolint
@@ -22,16 +22,19 @@ func (r *RootCmd) deleteWorkspace() *clibase.Cmd {
 			r.InitClient(client),
 		),
 		Handler: func(inv *clibase.Invocation) error {
-			_, err := cliui.Prompt(inv, cliui.PromptOptions{
-				Text:      "Confirm delete workspace?",
-				IsConfirm: true,
-				Default:   cliui.ConfirmNo,
-			})
+			workspace, err := namedWorkspace(inv.Context(), client, inv.Args[0])
 			if err != nil {
 				return err
 			}
 
-			workspace, err := namedWorkspace(inv.Context(), client, inv.Args[0])
+			sinceLastUsed := time.Since(workspace.LastUsedAt)
+			cliui.Infof(inv.Stderr, "%v was last used %.0f days ago", workspace.FullName(), sinceLastUsed.Hours()/24)
+
+			_, err = cliui.Prompt(inv, cliui.PromptOptions{
+				Text:      "Confirm delete workspace?",
+				IsConfirm: true,
+				Default:   cliui.ConfirmNo,
+			})
 			if err != nil {
 				return err
 			}
@@ -51,7 +54,11 @@ func (r *RootCmd) deleteWorkspace() *clibase.Cmd {
 				return err
 			}
 
-			_, _ = fmt.Fprintf(inv.Stdout, "\nThe %s workspace has been deleted at %s!\n", cliui.DefaultStyles.Keyword.Render(workspace.Name), cliui.DefaultStyles.DateTimeStamp.Render(time.Now().Format(time.Stamp)))
+			_, _ = fmt.Fprintf(
+				inv.Stdout,
+				"\n%s has been deleted at %s!\n", cliui.Keyword(workspace.FullName()),
+				cliui.Timestamp(time.Now()),
+			)
 			return nil
 		},
 	}
diff --git a/cli/delete_test.go b/cli/delete_test.go
index 40f5b9ac22168..a44cd6e5b2e3c 100644
--- a/cli/delete_test.go
+++ b/cli/delete_test.go
@@ -9,13 +9,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestDelete(t *testing.T) {
@@ -23,14 +23,15 @@ func TestDelete(t *testing.T) {
 	t.Run("WithParameter", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		inv, root := clitest.New(t, "delete", workspace.Name, "-y")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -41,21 +42,22 @@ func TestDelete(t *testing.T) {
 				assert.ErrorIs(t, err, io.EOF)
 			}
 		}()
-		pty.ExpectMatch("workspace has been deleted")
+		pty.ExpectMatch("has been deleted")
 		<-doneChan
 	})
 
 	t.Run("Orphan", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		inv, root := clitest.New(t, "delete", workspace.Name, "-y", "--orphan")
 
+		//nolint:gocritic // Deleting orphaned workspaces requires an admin.
 		clitest.SetupConfig(t, client, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
@@ -68,7 +70,7 @@ func TestDelete(t *testing.T) {
 				assert.ErrorIs(t, err, io.EOF)
 			}
 		}()
-		pty.ExpectMatch("workspace has been deleted")
+		pty.ExpectMatch("has been deleted")
 		<-doneChan
 	})
 
@@ -80,14 +82,14 @@ func TestDelete(t *testing.T) {
 	t.Run("OrphanDeletedUser", func(t *testing.T) {
 		t.Parallel()
 		client, _, api := coderdtest.NewWithAPI(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		deleteMeClient, deleteMeUser := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		deleteMeClient, deleteMeUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
-		workspace := coderdtest.CreateWorkspace(t, deleteMeClient, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, deleteMeClient, workspace.LatestBuild.ID)
+		workspace := coderdtest.CreateWorkspace(t, deleteMeClient, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, deleteMeClient, workspace.LatestBuild.ID)
 
 		// The API checks if the user has any workspaces, so we cannot delete a user
 		// this way.
@@ -101,6 +103,7 @@ func TestDelete(t *testing.T) {
 
 		inv, root := clitest.New(t, "delete", fmt.Sprintf("%s/%s", deleteMeUser.ID, workspace.Name), "-y", "--orphan")
 
+		//nolint:gocritic // Deleting orphaned workspaces requires an admin.
 		clitest.SetupConfig(t, client, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
@@ -113,7 +116,7 @@ func TestDelete(t *testing.T) {
 				assert.ErrorIs(t, err, io.EOF)
 			}
 		}()
-		pty.ExpectMatch("workspace has been deleted")
+		pty.ExpectMatch("has been deleted")
 		<-doneChan
 	})
 
@@ -127,12 +130,13 @@ func TestDelete(t *testing.T) {
 		require.NoError(t, err)
 
 		version := coderdtest.CreateTemplateVersion(t, adminClient, orgID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, adminClient, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, adminClient, version.ID)
 		template := coderdtest.CreateTemplate(t, adminClient, orgID, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, orgID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		inv, root := clitest.New(t, "delete", user.Username+"/"+workspace.Name, "-y")
+		//nolint:gocritic // This requires an admin.
 		clitest.SetupConfig(t, adminClient, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
@@ -145,7 +149,7 @@ func TestDelete(t *testing.T) {
 			}
 		}()
 
-		pty.ExpectMatch("workspace has been deleted")
+		pty.ExpectMatch("has been deleted")
 		<-doneChan
 
 		workspace, err = client.Workspace(context.Background(), workspace.ID)
diff --git a/cli/dotfiles.go b/cli/dotfiles.go
index 60be52a0fc629..f3d15515585e3 100644
--- a/cli/dotfiles.go
+++ b/cli/dotfiles.go
@@ -13,13 +13,16 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
 )
 
 func (r *RootCmd) dotfiles() *clibase.Cmd {
 	var symlinkDir string
 	var gitbranch string
+	var dotfilesRepoDir string
 
 	cmd := &clibase.Cmd{
 		Use:        "dotfiles <git_repo_url>",
@@ -33,11 +36,10 @@ func (r *RootCmd) dotfiles() *clibase.Cmd {
 		),
 		Handler: func(inv *clibase.Invocation) error {
 			var (
-				dotfilesRepoDir = "dotfiles"
-				gitRepo         = inv.Args[0]
-				cfg             = r.createConfig()
-				cfgDir          = string(cfg)
-				dotfilesDir     = filepath.Join(cfgDir, dotfilesRepoDir)
+				gitRepo     = inv.Args[0]
+				cfg         = r.createConfig()
+				cfgDir      = string(cfg)
+				dotfilesDir = filepath.Join(cfgDir, dotfilesRepoDir)
 				// This follows the same pattern outlined by others in the market:
 				// https://github.com/coder/coder/pull/1696#issue-1245742312
 				installScriptSet = []string{
@@ -143,7 +145,7 @@ func (r *RootCmd) dotfiles() *clibase.Cmd {
 					return err
 				}
 				// if the repo exists we soft fail the update operation and try to continue
-				_, _ = fmt.Fprintln(inv.Stdout, cliui.DefaultStyles.Error.Render("Failed to update repo, continuing..."))
+				_, _ = fmt.Fprintln(inv.Stdout, pretty.Sprint(cliui.DefaultStyles.Error, "Failed to update repo, continuing..."))
 			}
 
 			if dotfilesExists && gitbranch != "" {
@@ -159,7 +161,7 @@ func (r *RootCmd) dotfiles() *clibase.Cmd {
 				if err != nil {
 					// Do not block on this error, just log it and continue
 					_, _ = fmt.Fprintln(inv.Stdout,
-						cliui.DefaultStyles.Error.Render(fmt.Sprintf("Failed to use branch %q (%s), continuing...", err.Error(), gitbranch)))
+						pretty.Sprint(cliui.DefaultStyles.Error, fmt.Sprintf("Failed to use branch %q (%s), continuing...", err.Error(), gitbranch)))
 				}
 			}
 
@@ -176,8 +178,8 @@ func (r *RootCmd) dotfiles() *clibase.Cmd {
 
 			var dotfiles []string
 			for _, f := range files {
-				// make sure we do not copy `.git*` files
-				if strings.HasPrefix(f.Name(), ".") && !strings.HasPrefix(f.Name(), ".git") {
+				// make sure we do not copy `.git*` files except `.gitconfig`
+				if strings.HasPrefix(f.Name(), ".") && (!strings.HasPrefix(f.Name(), ".git") || f.Name() == ".gitconfig") {
 					dotfiles = append(dotfiles, f.Name())
 				}
 			}
@@ -288,6 +290,13 @@ func (r *RootCmd) dotfiles() *clibase.Cmd {
 				"If empty, will default to cloning the default branch or using the existing branch in the cloned repo on disk.",
 			Value: clibase.StringOf(&gitbranch),
 		},
+		{
+			Flag:        "repo-dir",
+			Default:     "dotfiles",
+			Env:         "CODER_DOTFILES_REPO_DIR",
+			Description: "Specifies the directory for the dotfiles repository, relative to global config directory.",
+			Value:       clibase.StringOf(&dotfilesRepoDir),
+		},
 		cliui.SkipPromptOption(),
 	}
 	return cmd
diff --git a/cli/dotfiles_test.go b/cli/dotfiles_test.go
index e979fec3e7980..6726f35b785ad 100644
--- a/cli/dotfiles_test.go
+++ b/cli/dotfiles_test.go
@@ -10,9 +10,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/cli/config"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/config"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 func TestDotfiles(t *testing.T) {
@@ -50,6 +50,68 @@ func TestDotfiles(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, string(b), "wow")
 	})
+	t.Run("SwitchRepoDir", func(t *testing.T) {
+		t.Parallel()
+		_, root := clitest.New(t)
+		testRepo := testGitRepo(t, root)
+
+		// nolint:gosec
+		err := os.WriteFile(filepath.Join(testRepo, ".bashrc"), []byte("wow"), 0o750)
+		require.NoError(t, err)
+
+		c := exec.Command("git", "add", ".bashrc")
+		c.Dir = testRepo
+		err = c.Run()
+		require.NoError(t, err)
+
+		c = exec.Command("git", "commit", "-m", `"add .bashrc"`)
+		c.Dir = testRepo
+		out, err := c.CombinedOutput()
+		require.NoError(t, err, string(out))
+
+		inv, _ := clitest.New(t, "dotfiles", "--global-config", string(root), "--symlink-dir", string(root), "--repo-dir", "testrepo", "-y", testRepo)
+		err = inv.Run()
+		require.NoError(t, err)
+
+		b, err := os.ReadFile(filepath.Join(string(root), ".bashrc"))
+		require.NoError(t, err)
+		require.Equal(t, string(b), "wow")
+
+		stat, staterr := os.Stat(filepath.Join(string(root), "testrepo"))
+		require.NoError(t, staterr)
+		require.True(t, stat.IsDir())
+	})
+	t.Run("SwitchRepoDirRelative", func(t *testing.T) {
+		t.Parallel()
+		_, root := clitest.New(t)
+		testRepo := testGitRepo(t, root)
+
+		// nolint:gosec
+		err := os.WriteFile(filepath.Join(testRepo, ".bashrc"), []byte("wow"), 0o750)
+		require.NoError(t, err)
+
+		c := exec.Command("git", "add", ".bashrc")
+		c.Dir = testRepo
+		err = c.Run()
+		require.NoError(t, err)
+
+		c = exec.Command("git", "commit", "-m", `"add .bashrc"`)
+		c.Dir = testRepo
+		out, err := c.CombinedOutput()
+		require.NoError(t, err, string(out))
+
+		inv, _ := clitest.New(t, "dotfiles", "--global-config", string(root), "--symlink-dir", string(root), "--repo-dir", "./relrepo", "-y", testRepo)
+		err = inv.Run()
+		require.NoError(t, err)
+
+		b, err := os.ReadFile(filepath.Join(string(root), ".bashrc"))
+		require.NoError(t, err)
+		require.Equal(t, string(b), "wow")
+
+		stat, staterr := os.Stat(filepath.Join(string(root), "relrepo"))
+		require.NoError(t, staterr)
+		require.True(t, stat.IsDir())
+	})
 	t.Run("InstallScript", func(t *testing.T) {
 		t.Parallel()
 		if runtime.GOOS == "windows" {
diff --git a/cli/errors.go b/cli/errors.go
new file mode 100644
index 0000000000000..12567e0400ac5
--- /dev/null
+++ b/cli/errors.go
@@ -0,0 +1,106 @@
+package cli
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+func (RootCmd) errorExample() *clibase.Cmd {
+	errorCmd := func(use string, err error) *clibase.Cmd {
+		return &clibase.Cmd{
+			Use: use,
+			Handler: func(inv *clibase.Invocation) error {
+				return err
+			},
+		}
+	}
+
+	// Make an api error
+	recorder := httptest.NewRecorder()
+	recorder.WriteHeader(http.StatusBadRequest)
+	resp := recorder.Result()
+	_ = resp.Body.Close()
+	resp.Request, _ = http.NewRequest(http.MethodPost, "http://example.com", nil)
+	apiError := codersdk.ReadBodyAsError(resp)
+	//nolint:errorlint,forcetypeassert
+	apiError.(*codersdk.Error).Response = codersdk.Response{
+		Message: "Top level sdk error message.",
+		Detail:  "magic dust unavailable, please try again later",
+		Validations: []codersdk.ValidationError{
+			{
+				Field:  "region",
+				Detail: "magic dust is not available in your region",
+			},
+		},
+	}
+	//nolint:errorlint,forcetypeassert
+	apiError.(*codersdk.Error).Helper = "Have you tried turning it off and on again?"
+
+	// Some flags
+	var magicWord clibase.String
+
+	cmd := &clibase.Cmd{
+		Use:   "example-error",
+		Short: "Shows what different error messages look like",
+		Long: "This command is pretty pointless, but without it testing errors is" +
+			"difficult to visually inspect. Error message formatting is inherently" +
+			"visual, so we need a way to quickly see what they look like.",
+		Handler: func(inv *clibase.Invocation) error {
+			return inv.Command.HelpHandler(inv)
+		},
+		Children: []*clibase.Cmd{
+			// Typical codersdk api error
+			errorCmd("api", apiError),
+
+			// Typical cli error
+			errorCmd("cmd", xerrors.Errorf("some error: %w", errorWithStackTrace())),
+
+			// A multi-error
+			{
+				Use: "multi-error",
+				Handler: func(inv *clibase.Invocation) error {
+					// Closing the stdin file descriptor will cause the next close
+					// to fail. This is joined to the returned Command error.
+					if f, ok := inv.Stdin.(*os.File); ok {
+						_ = f.Close()
+					}
+
+					return xerrors.Errorf("some error: %w", errorWithStackTrace())
+				},
+			},
+
+			{
+				Use: "validation",
+				Options: clibase.OptionSet{
+					clibase.Option{
+						Name:        "magic-word",
+						Description: "Take a good guess.",
+						Required:    true,
+						Flag:        "magic-word",
+						Default:     "",
+						Value: clibase.Validate(&magicWord, func(value *clibase.String) error {
+							return xerrors.Errorf("magic word is incorrect")
+						}),
+					},
+				},
+				Handler: func(i *clibase.Invocation) error {
+					_, _ = fmt.Fprint(i.Stdout, "Try setting the --magic-word flag\n")
+					return nil
+				},
+			},
+		},
+	}
+
+	return cmd
+}
+
+func errorWithStackTrace() error {
+	return xerrors.Errorf("function decided not to work, and it never will")
+}
diff --git a/cli/exp.go b/cli/exp.go
index 2513a8fda43ee..e190653f0f321 100644
--- a/cli/exp.go
+++ b/cli/exp.go
@@ -1,6 +1,6 @@
 package cli
 
-import "github.com/coder/coder/cli/clibase"
+import "github.com/coder/coder/v2/cli/clibase"
 
 func (r *RootCmd) expCmd() *clibase.Cmd {
 	cmd := &clibase.Cmd{
@@ -12,6 +12,7 @@ func (r *RootCmd) expCmd() *clibase.Cmd {
 		Hidden: true,
 		Children: []*clibase.Cmd{
 			r.scaletestCmd(),
+			r.errorExample(),
 		},
 	}
 	return cmd
diff --git a/cli/exp_scaletest.go b/cli/exp_scaletest.go
index d2ee36c1819eb..f615e650b53b2 100644
--- a/cli/exp_scaletest.go
+++ b/cli/exp_scaletest.go
@@ -1,3 +1,5 @@
+//go:build !slim
+
 package cli
 
 import (
@@ -5,6 +7,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"math/rand"
 	"net/http"
 	"os"
 	"strconv"
@@ -22,19 +25,19 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/scaletest/agentconn"
-	"github.com/coder/coder/scaletest/createworkspaces"
-	"github.com/coder/coder/scaletest/dashboard"
-	"github.com/coder/coder/scaletest/harness"
-	"github.com/coder/coder/scaletest/reconnectingpty"
-	"github.com/coder/coder/scaletest/workspacebuild"
-	"github.com/coder/coder/scaletest/workspacetraffic"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/scaletest/agentconn"
+	"github.com/coder/coder/v2/scaletest/createworkspaces"
+	"github.com/coder/coder/v2/scaletest/dashboard"
+	"github.com/coder/coder/v2/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/reconnectingpty"
+	"github.com/coder/coder/v2/scaletest/workspacebuild"
+	"github.com/coder/coder/v2/scaletest/workspacetraffic"
 )
 
 const scaletestTracerName = "coder_scaletest"
@@ -105,7 +108,6 @@ func (s *scaletestTracingFlags) provider(ctx context.Context) (trace.TracerProvi
 
 	tracerProvider, closeTracing, err := tracing.TracerProvider(ctx, scaletestTracerName, tracing.TracerOpts{
 		Default:   s.traceEnable,
-		Coder:     s.traceCoder,
 		Honeycomb: s.traceHoneycombAPIKey,
 	})
 	if err != nil {
@@ -427,7 +429,7 @@ func (r *RootCmd) scaletestCleanup() *clibase.Cmd {
 
 			cliui.Errorf(inv.Stderr, "Found %d scaletest workspaces\n", len(workspaces))
 			if len(workspaces) != 0 {
-				cliui.Infof(inv.Stdout, "Deleting scaletest workspaces..."+"\n")
+				cliui.Infof(inv.Stdout, "Deleting scaletest workspaces...")
 				harness := harness.NewTestHarness(cleanupStrategy.toStrategy(), harness.ConcurrentExecutionStrategy{})
 
 				for i, w := range workspaces {
@@ -443,7 +445,7 @@ func (r *RootCmd) scaletestCleanup() *clibase.Cmd {
 					return xerrors.Errorf("run test harness to delete workspaces (harness failure, not a test failure): %w", err)
 				}
 
-				cliui.Infof(inv.Stdout, "Done deleting scaletest workspaces:"+"\n")
+				cliui.Infof(inv.Stdout, "Done deleting scaletest workspaces:")
 				res := harness.Results()
 				res.PrintText(inv.Stderr)
 
@@ -460,7 +462,7 @@ func (r *RootCmd) scaletestCleanup() *clibase.Cmd {
 
 			cliui.Errorf(inv.Stderr, "Found %d scaletest users\n", len(users))
 			if len(users) != 0 {
-				cliui.Infof(inv.Stdout, "Deleting scaletest users..."+"\n")
+				cliui.Infof(inv.Stdout, "Deleting scaletest users...")
 				harness := harness.NewTestHarness(cleanupStrategy.toStrategy(), harness.ConcurrentExecutionStrategy{})
 
 				for i, u := range users {
@@ -479,7 +481,7 @@ func (r *RootCmd) scaletestCleanup() *clibase.Cmd {
 					return xerrors.Errorf("run test harness to delete users (harness failure, not a test failure): %w", err)
 				}
 
-				cliui.Infof(inv.Stdout, "Done deleting scaletest users:"+"\n")
+				cliui.Infof(inv.Stdout, "Done deleting scaletest users:")
 				res := harness.Results()
 				res.PrintText(inv.Stderr)
 
@@ -501,7 +503,6 @@ func (r *RootCmd) scaletestCreateWorkspaces() *clibase.Cmd {
 		count    int64
 		template string
 
-		noPlan    bool
 		noCleanup bool
 		// TODO: implement this flag
 		// noCleanupFailures bool
@@ -523,6 +524,8 @@ func (r *RootCmd) scaletestCreateWorkspaces() *clibase.Cmd {
 
 		useHostUser bool
 
+		parameterFlags workspaceParameterFlags
+
 		tracingFlags    = &scaletestTracingFlags{}
 		strategy        = &scaletestStrategyFlags{}
 		cleanupStrategy = &scaletestStrategyFlags{cleanup: true}
@@ -590,37 +593,22 @@ func (r *RootCmd) scaletestCreateWorkspaces() *clibase.Cmd {
 			if tpl.ID == uuid.Nil {
 				return xerrors.Errorf("could not find template %q in any organization", template)
 			}
-			templateVersion, err := client.TemplateVersion(ctx, tpl.ActiveVersionID)
+
+			cliRichParameters, err := asWorkspaceBuildParameters(parameterFlags.richParameters)
 			if err != nil {
-				return xerrors.Errorf("get template version %q: %w", tpl.ActiveVersionID, err)
+				return xerrors.Errorf("can't parse given parameter values: %w", err)
 			}
 
-			// Do a dry-run to ensure the template and parameters are valid
-			// before we start creating users and workspaces.
-			if !noPlan {
-				dryRun, err := client.CreateTemplateVersionDryRun(ctx, templateVersion.ID, codersdk.CreateTemplateVersionDryRunRequest{
-					WorkspaceName: "scaletest",
-				})
-				if err != nil {
-					return xerrors.Errorf("start dry run workspace creation: %w", err)
-				}
-				_, _ = fmt.Fprintln(inv.Stdout, "Planning workspace...")
-				err = cliui.ProvisionerJob(inv.Context(), inv.Stdout, cliui.ProvisionerJobOptions{
-					Fetch: func() (codersdk.ProvisionerJob, error) {
-						return client.TemplateVersionDryRun(inv.Context(), templateVersion.ID, dryRun.ID)
-					},
-					Cancel: func() error {
-						return client.CancelTemplateVersionDryRun(inv.Context(), templateVersion.ID, dryRun.ID)
-					},
-					Logs: func() (<-chan codersdk.ProvisionerJobLog, io.Closer, error) {
-						return client.TemplateVersionDryRunLogsAfter(inv.Context(), templateVersion.ID, dryRun.ID, 0)
-					},
-					// Don't show log output for the dry-run unless there's an error.
-					Silent: true,
-				})
-				if err != nil {
-					return xerrors.Errorf("dry-run workspace: %w", err)
-				}
+			richParameters, err := prepWorkspaceBuild(inv, client, prepWorkspaceBuildArgs{
+				Action:           WorkspaceCreate,
+				Template:         tpl,
+				NewWorkspaceName: "scaletest-N", // TODO: the scaletest runner will pass in a different name here. Does this matter?
+
+				RichParameterFile: parameterFlags.richParameterFile,
+				RichParameters:    cliRichParameters,
+			})
+			if err != nil {
+				return xerrors.Errorf("prepare build: %w", err)
 			}
 
 			tracerProvider, closeTracing, tracingEnabled, err := tracingFlags.provider(ctx)
@@ -651,7 +639,8 @@ func (r *RootCmd) scaletestCreateWorkspaces() *clibase.Cmd {
 						OrganizationID: me.OrganizationIDs[0],
 						// UserID is set by the test automatically.
 						Request: codersdk.CreateWorkspaceRequest{
-							TemplateID: tpl.ID,
+							TemplateID:          tpl.ID,
+							RichParameterValues: richParameters,
 						},
 						NoWaitForAgents: noWaitForAgents,
 					},
@@ -770,12 +759,6 @@ func (r *RootCmd) scaletestCreateWorkspaces() *clibase.Cmd {
 			Description:   "Required: Name or ID of the template to use for workspaces.",
 			Value:         clibase.StringOf(&template),
 		},
-		{
-			Flag:        "no-plan",
-			Env:         "CODER_SCALETEST_NO_PLAN",
-			Description: `Skip the dry-run step to plan the workspace creation. This step ensures that the given parameters are valid for the given template.`,
-			Value:       clibase.BoolOf(&noPlan),
-		},
 		{
 			Flag:        "no-cleanup",
 			Env:         "CODER_SCALETEST_NO_CLEANUP",
@@ -858,11 +841,12 @@ func (r *RootCmd) scaletestCreateWorkspaces() *clibase.Cmd {
 			Flag:        "use-host-login",
 			Env:         "CODER_SCALETEST_USE_HOST_LOGIN",
 			Default:     "false",
-			Description: "Use the use logged in on the host machine, instead of creating users.",
+			Description: "Use the user logged in on the host machine, instead of creating users.",
 			Value:       clibase.BoolOf(&useHostUser),
 		},
 	}
 
+	cmd.Options = append(cmd.Options, parameterFlags.cliParameters()...)
 	tracingFlags.attach(&cmd.Options)
 	strategy.attach(&cmd.Options)
 	cleanupStrategy.attach(&cmd.Options)
@@ -1047,9 +1031,10 @@ func (r *RootCmd) scaletestWorkspaceTraffic() *clibase.Cmd {
 
 func (r *RootCmd) scaletestDashboard() *clibase.Cmd {
 	var (
-		count   int64
-		minWait time.Duration
-		maxWait time.Duration
+		interval time.Duration
+		jitter   time.Duration
+		headless bool
+		randSeed int64
 
 		client          = &codersdk.Client{}
 		tracingFlags    = &scaletestTracingFlags{}
@@ -1066,8 +1051,17 @@ func (r *RootCmd) scaletestDashboard() *clibase.Cmd {
 			r.InitClient(client),
 		),
 		Handler: func(inv *clibase.Invocation) error {
+			if !(interval > 0) {
+				return xerrors.Errorf("--interval must be greater than zero")
+			}
+			if !(jitter < interval) {
+				return xerrors.Errorf("--jitter must be less than --interval")
+			}
 			ctx := inv.Context()
 			logger := slog.Make(sloghuman.Sink(inv.Stdout)).Leveled(slog.LevelInfo)
+			if r.verbose {
+				logger = logger.Leveled(slog.LevelDebug)
+			}
 			tracerProvider, closeTracing, tracingEnabled, err := tracingFlags.provider(ctx)
 			if err != nil {
 				return xerrors.Errorf("create tracer provider: %w", err)
@@ -1095,19 +1089,47 @@ func (r *RootCmd) scaletestDashboard() *clibase.Cmd {
 
 			th := harness.NewTestHarness(strategy.toStrategy(), cleanupStrategy.toStrategy())
 
-			for i := int64(0); i < count; i++ {
-				name := fmt.Sprintf("dashboard-%d", i)
+			users, err := getScaletestUsers(ctx, client)
+			if err != nil {
+				return xerrors.Errorf("get scaletest users")
+			}
+
+			for _, usr := range users {
+				//nolint:gosec // not used for cryptographic purposes
+				rndGen := rand.New(rand.NewSource(randSeed))
+				name := fmt.Sprintf("dashboard-%s", usr.Username)
+				userTokResp, err := client.CreateToken(ctx, usr.ID.String(), codersdk.CreateTokenRequest{
+					Lifetime:  30 * 24 * time.Hour,
+					Scope:     "",
+					TokenName: fmt.Sprintf("scaletest-%d", time.Now().Unix()),
+				})
+				if err != nil {
+					return xerrors.Errorf("create token for user: %w", err)
+				}
+
+				userClient := codersdk.New(client.URL)
+				userClient.SetSessionToken(userTokResp.Key)
+
 				config := dashboard.Config{
-					MinWait:   minWait,
-					MaxWait:   maxWait,
-					Trace:     tracingEnabled,
-					Logger:    logger.Named(name),
-					RollTable: dashboard.DefaultActions,
+					Interval: interval,
+					Jitter:   jitter,
+					Trace:    tracingEnabled,
+					Logger:   logger.Named(name),
+					Headless: headless,
+					RandIntn: rndGen.Intn,
+				}
+				// Only take a screenshot if we're in verbose mode.
+				// This could be useful for debugging, but it will blow up the disk.
+				if r.verbose {
+					config.Screenshot = dashboard.Screenshot
 				}
+				//nolint:gocritic
+				logger.Info(ctx, "runner config", slog.F("interval", interval), slog.F("jitter", jitter), slog.F("headless", headless), slog.F("trace", tracingEnabled))
 				if err := config.Validate(); err != nil {
+					logger.Fatal(ctx, "validate config", slog.Error(err))
 					return err
 				}
-				var runner harness.Runnable = dashboard.NewRunner(client, metrics, config)
+				var runner harness.Runnable = dashboard.NewRunner(userClient, metrics, config)
 				if tracingEnabled {
 					runner = &runnableTraceWrapper{
 						tracer:   tracer,
@@ -1144,25 +1166,32 @@ func (r *RootCmd) scaletestDashboard() *clibase.Cmd {
 
 	cmd.Options = []clibase.Option{
 		{
-			Flag:        "count",
-			Env:         "CODER_SCALETEST_DASHBOARD_COUNT",
-			Default:     "1",
-			Description: "Number of concurrent workers.",
-			Value:       clibase.Int64Of(&count),
+			Flag:        "interval",
+			Env:         "CODER_SCALETEST_DASHBOARD_INTERVAL",
+			Default:     "10s",
+			Description: "Interval between actions.",
+			Value:       clibase.DurationOf(&interval),
 		},
 		{
-			Flag:        "min-wait",
-			Env:         "CODER_SCALETEST_DASHBOARD_MIN_WAIT",
-			Default:     "100ms",
-			Description: "Minimum wait between fetches.",
-			Value:       clibase.DurationOf(&minWait),
+			Flag:        "jitter",
+			Env:         "CODER_SCALETEST_DASHBOARD_JITTER",
+			Default:     "5s",
+			Description: "Jitter between actions.",
+			Value:       clibase.DurationOf(&jitter),
 		},
 		{
-			Flag:        "max-wait",
-			Env:         "CODER_SCALETEST_DASHBOARD_MAX_WAIT",
-			Default:     "1s",
-			Description: "Maximum wait between fetches.",
-			Value:       clibase.DurationOf(&maxWait),
+			Flag:        "headless",
+			Env:         "CODER_SCALETEST_DASHBOARD_HEADLESS",
+			Default:     "true",
+			Description: "Controls headless mode. Setting to false is useful for debugging.",
+			Value:       clibase.BoolOf(&headless),
+		},
+		{
+			Flag:        "rand-seed",
+			Env:         "CODER_SCALETEST_DASHBOARD_RAND_SEED",
+			Default:     "0",
+			Description: "Seed for the random number generator.",
+			Value:       clibase.Int64Of(&randSeed),
 		},
 	}
 
@@ -1212,7 +1241,7 @@ func (r *runnableTraceWrapper) Run(ctx context.Context, id string, logs io.Write
 	return r.runner.Run(ctx2, id, logs)
 }
 
-func (r *runnableTraceWrapper) Cleanup(ctx context.Context, id string) error {
+func (r *runnableTraceWrapper) Cleanup(ctx context.Context, id string, logs io.Writer) error {
 	c, ok := r.runner.(harness.Cleanable)
 	if !ok {
 		return nil
@@ -1224,7 +1253,7 @@ func (r *runnableTraceWrapper) Cleanup(ctx context.Context, id string) error {
 	ctx, span := r.tracer.Start(ctx, r.spanName+" cleanup")
 	defer span.End()
 
-	return c.Cleanup(ctx, id)
+	return c.Cleanup(ctx, id, logs)
 }
 
 // newScaleTestUser returns a random username and email address that can be used
diff --git a/cli/exp_scaletest_slim.go b/cli/exp_scaletest_slim.go
new file mode 100644
index 0000000000000..d9ccd325e5ccd
--- /dev/null
+++ b/cli/exp_scaletest_slim.go
@@ -0,0 +1,18 @@
+//go:build slim
+
+package cli
+
+import "github.com/coder/coder/v2/cli/clibase"
+
+func (r *RootCmd) scaletestCmd() *clibase.Cmd {
+	cmd := &clibase.Cmd{
+		Use:   "scaletest",
+		Short: "Run a scale test against the Coder API",
+		Handler: func(inv *clibase.Invocation) error {
+			SlimUnsupported(inv.Stderr, "exp scaletest")
+			return nil
+		},
+	}
+
+	return cmd
+}
diff --git a/cli/exp_scaletest_test.go b/cli/exp_scaletest_test.go
index 4c10b722ca357..556aed6c21a82 100644
--- a/cli/exp_scaletest_test.go
+++ b/cli/exp_scaletest_test.go
@@ -1,17 +1,18 @@
 package cli_test
 
 import (
-	"bytes"
 	"context"
 	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"cdr.dev/slog/sloggers/slogtest"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestScaleTestCreateWorkspaces(t *testing.T) {
@@ -22,7 +23,12 @@ func TestScaleTestCreateWorkspaces(t *testing.T) {
 	ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancelFunc()
 
-	client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+	log := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
+	client := coderdtest.New(t, &coderdtest.Options{
+		// We are not including any provisioner daemons because we do not actually
+		// build any workspaces here.
+		Logger: &log,
+	})
 	_ = coderdtest.CreateFirstUser(t, client)
 
 	// Write a parameters file.
@@ -42,6 +48,8 @@ func TestScaleTestCreateWorkspaces(t *testing.T) {
 		"--cleanup-job-timeout", "15s",
 		"--output", "text",
 		"--output", "json:"+outputFile,
+		"--parameter", "foo=baz",
+		"--rich-parameter-file", "/path/to/some/parameter/file.ext",
 	)
 	clitest.SetupConfig(t, client, root)
 	pty := ptytest.New(t)
@@ -60,7 +68,10 @@ func TestScaleTestWorkspaceTraffic(t *testing.T) {
 	ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitMedium)
 	defer cancelFunc()
 
-	client := coderdtest.New(t, nil)
+	log := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
+	client := coderdtest.New(t, &coderdtest.Options{
+		Logger: &log,
+	})
 	_ = coderdtest.CreateFirstUser(t, client)
 
 	inv, root := clitest.New(t, "exp", "scaletest", "workspace-traffic",
@@ -72,9 +83,10 @@ func TestScaleTestWorkspaceTraffic(t *testing.T) {
 		"--ssh",
 	)
 	clitest.SetupConfig(t, client, root)
-	var stdout, stderr bytes.Buffer
-	inv.Stdout = &stdout
-	inv.Stderr = &stderr
+	pty := ptytest.New(t)
+	inv.Stdout = pty.Output()
+	inv.Stderr = pty.Output()
+
 	err := inv.WithContext(ctx).Run()
 	require.ErrorContains(t, err, "no scaletest workspaces exist")
 }
@@ -82,25 +94,78 @@ func TestScaleTestWorkspaceTraffic(t *testing.T) {
 // This test just validates that the CLI command accepts its known arguments.
 func TestScaleTestDashboard(t *testing.T) {
 	t.Parallel()
-
-	ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitMedium)
-	defer cancelFunc()
-
-	client := coderdtest.New(t, nil)
-	_ = coderdtest.CreateFirstUser(t, client)
-
-	inv, root := clitest.New(t, "exp", "scaletest", "dashboard",
-		"--count", "1",
-		"--min-wait", "100ms",
-		"--max-wait", "1s",
-		"--timeout", "1s",
-		"--scaletest-prometheus-address", "127.0.0.1:0",
-		"--scaletest-prometheus-wait", "0s",
-	)
-	clitest.SetupConfig(t, client, root)
-	var stdout, stderr bytes.Buffer
-	inv.Stdout = &stdout
-	inv.Stderr = &stderr
-	err := inv.WithContext(ctx).Run()
-	require.NoError(t, err, "")
+	t.Run("MinWait", func(t *testing.T) {
+		t.Parallel()
+		ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancelFunc()
+
+		log := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
+		client := coderdtest.New(t, &coderdtest.Options{
+			Logger: &log,
+		})
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		inv, root := clitest.New(t, "exp", "scaletest", "dashboard",
+			"--interval", "0s",
+		)
+		clitest.SetupConfig(t, client, root)
+		pty := ptytest.New(t)
+		inv.Stdout = pty.Output()
+		inv.Stderr = pty.Output()
+
+		err := inv.WithContext(ctx).Run()
+		require.ErrorContains(t, err, "--interval must be greater than zero")
+	})
+
+	t.Run("MaxWait", func(t *testing.T) {
+		t.Parallel()
+		ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancelFunc()
+
+		log := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
+		client := coderdtest.New(t, &coderdtest.Options{
+			Logger: &log,
+		})
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		inv, root := clitest.New(t, "exp", "scaletest", "dashboard",
+			"--interval", "1s",
+			"--jitter", "1s",
+		)
+		clitest.SetupConfig(t, client, root)
+		pty := ptytest.New(t)
+		inv.Stdout = pty.Output()
+		inv.Stderr = pty.Output()
+
+		err := inv.WithContext(ctx).Run()
+		require.ErrorContains(t, err, "--jitter must be less than --interval")
+	})
+
+	t.Run("OK", func(t *testing.T) {
+		t.Parallel()
+		ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitMedium)
+		defer cancelFunc()
+
+		log := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
+		client := coderdtest.New(t, &coderdtest.Options{
+			Logger: &log,
+		})
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		inv, root := clitest.New(t, "exp", "scaletest", "dashboard",
+			"--interval", "1s",
+			"--jitter", "500ms",
+			"--timeout", "5s",
+			"--scaletest-prometheus-address", "127.0.0.1:0",
+			"--scaletest-prometheus-wait", "0s",
+			"--rand-seed", "1234567890",
+		)
+		clitest.SetupConfig(t, client, root)
+		pty := ptytest.New(t)
+		inv.Stdout = pty.Output()
+		inv.Stderr = pty.Output()
+
+		err := inv.WithContext(ctx).Run()
+		require.NoError(t, err, "")
+	})
 }
diff --git a/cli/externalauth.go b/cli/externalauth.go
new file mode 100644
index 0000000000000..c81795d95d6fc
--- /dev/null
+++ b/cli/externalauth.go
@@ -0,0 +1,109 @@
+package cli
+
+import (
+	"encoding/json"
+	"os/signal"
+
+	"golang.org/x/xerrors"
+
+	"github.com/tidwall/gjson"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+)
+
+func (r *RootCmd) externalAuth() *clibase.Cmd {
+	return &clibase.Cmd{
+		Use:   "external-auth",
+		Short: "Manage external authentication",
+		Long:  "Authenticate with external services inside of a workspace.",
+		Handler: func(i *clibase.Invocation) error {
+			return i.Command.HelpHandler(i)
+		},
+		Children: []*clibase.Cmd{
+			r.externalAuthAccessToken(),
+		},
+	}
+}
+
+func (r *RootCmd) externalAuthAccessToken() *clibase.Cmd {
+	var extra string
+	return &clibase.Cmd{
+		Use:   "access-token <provider>",
+		Short: "Print auth for an external provider",
+		Long: "Print an access-token for an external auth provider. " +
+			"The access-token will be validated and sent to stdout with exit code 0. " +
+			"If a valid access-token cannot be obtained, the URL to authenticate will be sent to stdout with exit code 1\n" + formatExamples(
+			example{
+				Description: "Ensure that the user is authenticated with GitHub before cloning.",
+				Command: `#!/usr/bin/env sh
+
+OUTPUT=$(coder external-auth access-token github)
+if [ $? -eq 0 ]; then
+  echo "Authenticated with GitHub"
+else
+  echo "Please authenticate with GitHub:"
+  echo $OUTPUT
+fi
+`,
+			},
+			example{
+				Description: "Obtain an extra property of an access token for additional metadata.",
+				Command:     "coder external-auth access-token slack --extra \"authed_user.id\"",
+			},
+		),
+		Options: clibase.OptionSet{{
+			Name:        "Extra",
+			Flag:        "extra",
+			Description: "Extract a field from the \"extra\" properties of the OAuth token.",
+			Value:       clibase.StringOf(&extra),
+		}},
+
+		Handler: func(inv *clibase.Invocation) error {
+			ctx := inv.Context()
+
+			ctx, stop := signal.NotifyContext(ctx, InterruptSignals...)
+			defer stop()
+
+			client, err := r.createAgentClient()
+			if err != nil {
+				return xerrors.Errorf("create agent client: %w", err)
+			}
+
+			extAuth, err := client.ExternalAuth(ctx, agentsdk.ExternalAuthRequest{
+				ID: inv.Args[0],
+			})
+			if err != nil {
+				return xerrors.Errorf("get external auth token: %w", err)
+			}
+			if extAuth.URL != "" {
+				_, err = inv.Stdout.Write([]byte(extAuth.URL))
+				if err != nil {
+					return err
+				}
+				return cliui.Canceled
+			}
+			if extra != "" {
+				if extAuth.TokenExtra == nil {
+					return xerrors.Errorf("no extra properties found for token")
+				}
+				data, err := json.Marshal(extAuth.TokenExtra)
+				if err != nil {
+					return xerrors.Errorf("marshal extra properties: %w", err)
+				}
+				result := gjson.GetBytes(data, extra)
+				_, err = inv.Stdout.Write([]byte(result.String()))
+				if err != nil {
+					return err
+				}
+				return nil
+			}
+			_, err = inv.Stdout.Write([]byte(extAuth.AccessToken))
+			if err != nil {
+				return err
+			}
+			return nil
+		},
+	}
+}
diff --git a/cli/externalauth_test.go b/cli/externalauth_test.go
new file mode 100644
index 0000000000000..63b058c3fd764
--- /dev/null
+++ b/cli/externalauth_test.go
@@ -0,0 +1,67 @@
+package cli_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/pty/ptytest"
+)
+
+func TestExternalAuth(t *testing.T) {
+	t.Parallel()
+	t.Run("CanceledWithURL", func(t *testing.T) {
+		t.Parallel()
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			httpapi.Write(context.Background(), w, http.StatusOK, agentsdk.ExternalAuthResponse{
+				URL: "https://github.com",
+			})
+		}))
+		t.Cleanup(srv.Close)
+		url := srv.URL
+		inv, _ := clitest.New(t, "--agent-url", url, "external-auth", "access-token", "github")
+		pty := ptytest.New(t)
+		inv.Stdout = pty.Output()
+		waiter := clitest.StartWithWaiter(t, inv)
+		pty.ExpectMatch("https://github.com")
+		waiter.RequireIs(cliui.Canceled)
+	})
+	t.Run("SuccessWithToken", func(t *testing.T) {
+		t.Parallel()
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			httpapi.Write(context.Background(), w, http.StatusOK, agentsdk.ExternalAuthResponse{
+				AccessToken: "bananas",
+			})
+		}))
+		t.Cleanup(srv.Close)
+		url := srv.URL
+		inv, _ := clitest.New(t, "--agent-url", url, "external-auth", "access-token", "github")
+		pty := ptytest.New(t)
+		inv.Stdout = pty.Output()
+		clitest.Start(t, inv)
+		pty.ExpectMatch("bananas")
+	})
+	t.Run("SuccessWithExtra", func(t *testing.T) {
+		t.Parallel()
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			httpapi.Write(context.Background(), w, http.StatusOK, agentsdk.ExternalAuthResponse{
+				AccessToken: "bananas",
+				TokenExtra: map[string]interface{}{
+					"hey": "there",
+				},
+			})
+		}))
+		t.Cleanup(srv.Close)
+		url := srv.URL
+		inv, _ := clitest.New(t, "--agent-url", url, "external-auth", "access-token", "github", "--extra", "hey")
+		pty := ptytest.New(t)
+		inv.Stdout = pty.Output()
+		clitest.Start(t, inv)
+		pty.ExpectMatch("there")
+	})
+}
diff --git a/cli/gitaskpass.go b/cli/gitaskpass.go
index 5bb67adf82416..83ac98094e72e 100644
--- a/cli/gitaskpass.go
+++ b/cli/gitaskpass.go
@@ -9,10 +9,11 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/cli/gitauth"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
 	"github.com/coder/retry"
 )
 
@@ -38,30 +39,41 @@ func (r *RootCmd) gitAskpass() *clibase.Cmd {
 				return xerrors.Errorf("create agent client: %w", err)
 			}
 
-			token, err := client.GitAuth(ctx, host, false)
+			token, err := client.ExternalAuth(ctx, agentsdk.ExternalAuthRequest{
+				Match: host,
+			})
 			if err != nil {
 				var apiError *codersdk.Error
 				if errors.As(err, &apiError) && apiError.StatusCode() == http.StatusNotFound {
 					// This prevents the "Run 'coder --help' for usage"
 					// message from occurring.
-					cliui.Errorf(inv.Stderr, "%s\n", apiError.Message)
+					lines := []string{apiError.Message}
+					if apiError.Detail != "" {
+						lines = append(lines, apiError.Detail)
+					}
+					cliui.Warn(inv.Stderr, "Coder was unable to handle this git request. The default git behavior will be used instead.",
+						lines...,
+					)
 					return cliui.Canceled
 				}
 				return xerrors.Errorf("get git token: %w", err)
 			}
 			if token.URL != "" {
 				if err := openURL(inv, token.URL); err == nil {
-					cliui.Infof(inv.Stderr, "Your browser has been opened to authenticate with Git:\n\n%s\n", token.URL)
+					cliui.Infof(inv.Stderr, "Your browser has been opened to authenticate with Git:\n%s", token.URL)
 				} else {
-					cliui.Infof(inv.Stderr, "Open the following URL to authenticate with Git:\n\n%s\n", token.URL)
+					cliui.Infof(inv.Stderr, "Open the following URL to authenticate with Git:\n%s", token.URL)
 				}
 
 				for r := retry.New(250*time.Millisecond, 10*time.Second); r.Wait(ctx); {
-					token, err = client.GitAuth(ctx, host, true)
+					token, err = client.ExternalAuth(ctx, agentsdk.ExternalAuthRequest{
+						Match:  host,
+						Listen: true,
+					})
 					if err != nil {
 						continue
 					}
-					cliui.Infof(inv.Stderr, "You've been authenticated with Git!\n")
+					cliui.Infof(inv.Stderr, "You've been authenticated with Git!")
 					break
 				}
 			}
diff --git a/cli/gitaskpass_test.go b/cli/gitaskpass_test.go
index 809bc1035005f..92fe3943c1eb8 100644
--- a/cli/gitaskpass_test.go
+++ b/cli/gitaskpass_test.go
@@ -10,12 +10,12 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestGitAskpass(t *testing.T) {
@@ -23,7 +23,7 @@ func TestGitAskpass(t *testing.T) {
 	t.Run("UsernameAndPassword", func(t *testing.T) {
 		t.Parallel()
 		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			httpapi.Write(context.Background(), w, http.StatusOK, agentsdk.GitAuthResponse{
+			httpapi.Write(context.Background(), w, http.StatusOK, agentsdk.ExternalAuthResponse{
 				Username: "something",
 				Password: "bananas",
 			})
@@ -65,8 +65,8 @@ func TestGitAskpass(t *testing.T) {
 
 	t.Run("Poll", func(t *testing.T) {
 		t.Parallel()
-		resp := atomic.Pointer[agentsdk.GitAuthResponse]{}
-		resp.Store(&agentsdk.GitAuthResponse{
+		resp := atomic.Pointer[agentsdk.ExternalAuthResponse]{}
+		resp.Store(&agentsdk.ExternalAuthResponse{
 			URL: "https://something.org",
 		})
 		poll := make(chan struct{}, 10)
@@ -96,7 +96,7 @@ func TestGitAskpass(t *testing.T) {
 		}()
 		<-poll
 		stderr.ExpectMatch("Open the following URL to authenticate")
-		resp.Store(&agentsdk.GitAuthResponse{
+		resp.Store(&agentsdk.ExternalAuthResponse{
 			Username: "username",
 			Password: "password",
 		})
diff --git a/coderd/gitauth/askpass.go b/cli/gitauth/askpass.go
similarity index 100%
rename from coderd/gitauth/askpass.go
rename to cli/gitauth/askpass.go
diff --git a/coderd/gitauth/askpass_test.go b/cli/gitauth/askpass_test.go
similarity index 97%
rename from coderd/gitauth/askpass_test.go
rename to cli/gitauth/askpass_test.go
index ce7cc75989603..d70e791c97afb 100644
--- a/coderd/gitauth/askpass_test.go
+++ b/cli/gitauth/askpass_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/gitauth"
+	"github.com/coder/coder/v2/cli/gitauth"
 )
 
 func TestCheckCommand(t *testing.T) {
diff --git a/coderd/gitauth/vscode.go b/cli/gitauth/vscode.go
similarity index 100%
rename from coderd/gitauth/vscode.go
rename to cli/gitauth/vscode.go
diff --git a/coderd/gitauth/vscode_test.go b/cli/gitauth/vscode_test.go
similarity index 97%
rename from coderd/gitauth/vscode_test.go
rename to cli/gitauth/vscode_test.go
index f61fb97ea681a..7bff62fafdb06 100644
--- a/coderd/gitauth/vscode_test.go
+++ b/cli/gitauth/vscode_test.go
@@ -10,7 +10,7 @@ import (
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/gitauth"
+	"github.com/coder/coder/v2/cli/gitauth"
 )
 
 func TestOverrideVSCodeConfigs(t *testing.T) {
diff --git a/cli/gitssh.go b/cli/gitssh.go
index 6c4046c03cafe..ea461394c3241 100644
--- a/cli/gitssh.go
+++ b/cli/gitssh.go
@@ -14,8 +14,9 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/pretty"
 )
 
 func (r *RootCmd) gitssh() *clibase.Cmd {
@@ -90,12 +91,15 @@ func (r *RootCmd) gitssh() *clibase.Cmd {
 				exitErr := &exec.ExitError{}
 				if xerrors.As(err, &exitErr) && exitErr.ExitCode() == 255 {
 					_, _ = fmt.Fprintln(inv.Stderr,
-						"\n"+cliui.DefaultStyles.Wrap.Render("Coder authenticates with "+cliui.DefaultStyles.Field.Render("git")+
-							" using the public key below. All clones with SSH are authenticated automatically 🪄.")+"\n")
-					_, _ = fmt.Fprintln(inv.Stderr, cliui.DefaultStyles.Code.Render(strings.TrimSpace(key.PublicKey))+"\n")
+						"\n"+pretty.Sprintf(
+							cliui.DefaultStyles.Wrap,
+							"Coder authenticates with "+pretty.Sprint(cliui.DefaultStyles.Field, "git")+
+								" using the public key below. All clones with SSH are authenticated automatically 🪄.")+"\n",
+					)
+					_, _ = fmt.Fprintln(inv.Stderr, pretty.Sprint(cliui.DefaultStyles.Code, strings.TrimSpace(key.PublicKey))+"\n")
 					_, _ = fmt.Fprintln(inv.Stderr, "Add to GitHub and GitLab:")
-					_, _ = fmt.Fprintln(inv.Stderr, cliui.DefaultStyles.Prompt.String()+"https://github.com/settings/ssh/new")
-					_, _ = fmt.Fprintln(inv.Stderr, cliui.DefaultStyles.Prompt.String()+"https://gitlab.com/-/profile/keys")
+					pretty.Fprintf(inv.Stderr, cliui.DefaultStyles.Prompt, "%s", "https://github.com/settings/ssh/new\n\n")
+					pretty.Fprintf(inv.Stderr, cliui.DefaultStyles.Prompt, "%s", "https://gitlab.com/-/profile/keys\n\n")
 					_, _ = fmt.Fprintln(inv.Stderr)
 					return err
 				}
diff --git a/cli/gitssh_test.go b/cli/gitssh_test.go
index 39daab430c01c..354a57c732953 100644
--- a/cli/gitssh_test.go
+++ b/cli/gitssh_test.go
@@ -20,15 +20,18 @@ import (
 	"github.com/stretchr/testify/require"
 	gossh "golang.org/x/crypto/ssh"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
-func prepareTestGitSSH(ctx context.Context, t *testing.T) (*codersdk.Client, string, gossh.PublicKey) {
+func prepareTestGitSSH(ctx context.Context, t *testing.T) (*agentsdk.Client, string, gossh.PublicKey) {
 	t.Helper()
 
 	client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
@@ -48,22 +51,21 @@ func prepareTestGitSSH(ctx context.Context, t *testing.T) (*codersdk.Client, str
 	agentToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:          echo.ParseComplete,
-		ProvisionPlan:  echo.ProvisionComplete,
+		ProvisionPlan:  echo.PlanComplete,
 		ProvisionApply: echo.ProvisionApplyWithAgent(agentToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	// start workspace agent
-	inv, root := clitest.New(t, "agent", "--agent-token", agentToken, "--agent-url", client.URL.String())
-	agentClient := codersdk.New(client.URL)
+	agentClient := agentsdk.New(client.URL)
 	agentClient.SetSessionToken(agentToken)
-	clitest.SetupConfig(t, agentClient, root)
-	clitest.Start(t, inv)
-
-	coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+	_ = agenttest.New(t, client.URL, agentToken, func(o *agent.Options) {
+		o.Client = agentClient
+	})
+	_ = coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 	return agentClient, agentToken, pubkey
 }
 
@@ -140,7 +142,7 @@ func TestGitSSH(t *testing.T) {
 		// set to agent config dir
 		inv, _ := clitest.New(t,
 			"gitssh",
-			"--agent-url", client.URL.String(),
+			"--agent-url", client.SDK.URL.String(),
 			"--agent-token", token,
 			"--",
 			fmt.Sprintf("-p%d", addr.Port),
@@ -203,7 +205,7 @@ func TestGitSSH(t *testing.T) {
 		pty := ptytest.New(t)
 		cmdArgs := []string{
 			"gitssh",
-			"--agent-url", client.URL.String(),
+			"--agent-url", client.SDK.URL.String(),
 			"--agent-token", token,
 			"--",
 			"-F", config,
diff --git a/cli/help.go b/cli/help.go
index fa813febc53e9..e0c043e7951d4 100644
--- a/cli/help.go
+++ b/cli/help.go
@@ -2,23 +2,22 @@ package cli
 
 import (
 	"bufio"
-	"bytes"
 	_ "embed"
 	"fmt"
-	"io"
 	"regexp"
 	"sort"
 	"strings"
 	"text/tabwriter"
 	"text/template"
-	"unicode"
 
 	"github.com/mitchellh/go-wordwrap"
 	"golang.org/x/crypto/ssh/terminal"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/pretty"
 )
 
 //go:embed help.tpl
@@ -44,203 +43,222 @@ func wrapTTY(s string) string {
 	return wordwrap.WrapString(s, uint(ttyWidth()))
 }
 
-var usageTemplate = template.Must(
-	template.New("usage").Funcs(
-		template.FuncMap{
-			"wrapTTY": func(s string) string {
-				return wrapTTY(s)
-			},
-			"trimNewline": func(s string) string {
-				return strings.TrimSuffix(s, "\n")
-			},
-			"typeHelper": func(opt *clibase.Option) string {
-				switch v := opt.Value.(type) {
-				case *clibase.Enum:
-					return strings.Join(v.Choices, "|")
-				default:
-					return v.Type()
-				}
-			},
-			"joinStrings": func(s []string) string {
-				return strings.Join(s, ", ")
-			},
-			"indent": func(body string, spaces int) string {
-				twidth := ttyWidth()
-
-				spacing := strings.Repeat(" ", spaces)
-
-				body = wordwrap.WrapString(body, uint(twidth-len(spacing)))
-
-				var sb strings.Builder
-				for _, line := range strings.Split(body, "\n") {
-					// Remove existing indent, if any.
-					line = strings.TrimSpace(line)
-					// Use spaces so we can easily calculate wrapping.
-					_, _ = sb.WriteString(spacing)
-					_, _ = sb.WriteString(line)
-					_, _ = sb.WriteString("\n")
-				}
-				return sb.String()
-			},
-			"formatSubcommand": func(cmd *clibase.Cmd) string {
-				// Minimize padding by finding the longest neighboring name.
-				maxNameLength := len(cmd.Name())
-				if parent := cmd.Parent; parent != nil {
-					for _, c := range parent.Children {
-						if len(c.Name()) > maxNameLength {
-							maxNameLength = len(c.Name())
-						}
+var usageTemplate = func() *template.Template {
+	var (
+		optionFg = pretty.FgColor(
+			cliui.Color("#04A777"),
+		)
+		headerFg = pretty.FgColor(
+			cliui.Color("#337CA0"),
+		)
+	)
+	return template.Must(
+		template.New("usage").Funcs(
+			template.FuncMap{
+				"version": func() string {
+					return buildinfo.Version()
+				},
+				"wrapTTY": func(s string) string {
+					return wrapTTY(s)
+				},
+				"trimNewline": func(s string) string {
+					return strings.TrimSuffix(s, "\n")
+				},
+				"keyword": func(s string) string {
+					txt := pretty.String(s)
+					optionFg.Format(txt)
+					return txt.String()
+				},
+				"prettyHeader": func(s string) string {
+					s = strings.ToUpper(s)
+					txt := pretty.String(s, ":")
+					headerFg.Format(txt)
+					return txt.String()
+				},
+				"typeHelper": func(opt *clibase.Option) string {
+					switch v := opt.Value.(type) {
+					case *clibase.Enum:
+						return strings.Join(v.Choices, "|")
+					default:
+						return v.Type()
 					}
-				}
+				},
+				"joinStrings": func(s []string) string {
+					return strings.Join(s, ", ")
+				},
+				"indent": func(body string, spaces int) string {
+					twidth := ttyWidth()
 
-				var sb strings.Builder
-				_, _ = fmt.Fprintf(
-					&sb, "%s%s%s",
-					strings.Repeat(" ", 4), cmd.Name(), strings.Repeat(" ", maxNameLength-len(cmd.Name())+4),
-				)
+					spacing := strings.Repeat(" ", spaces)
 
-				// This is the point at which indentation begins if there's a
-				// next line.
-				descStart := sb.Len()
+					wrapLim := twidth - len(spacing)
+					body = wordwrap.WrapString(body, uint(wrapLim))
 
-				twidth := ttyWidth()
+					sc := bufio.NewScanner(strings.NewReader(body))
 
-				for i, line := range strings.Split(
-					wordwrap.WrapString(cmd.Short, uint(twidth-descStart)), "\n",
-				) {
-					if i > 0 {
-						_, _ = sb.WriteString(strings.Repeat(" ", descStart))
+					var sb strings.Builder
+					for sc.Scan() {
+						// Remove existing indent, if any.
+						// line = strings.TrimSpace(line)
+						// Use spaces so we can easily calculate wrapping.
+						_, _ = sb.WriteString(spacing)
+						_, _ = sb.Write(sc.Bytes())
+						_, _ = sb.WriteString("\n")
 					}
-					_, _ = sb.WriteString(line)
-					_, _ = sb.WriteString("\n")
-				}
-
-				return sb.String()
-			},
-			"envName": func(opt clibase.Option) string {
-				if opt.Env == "" {
-					return ""
-				}
-				return opt.Env
-			},
-			"flagName": func(opt clibase.Option) string {
-				return opt.Flag
-			},
-			"prettyHeader": func(s string) string {
-				return cliui.DefaultStyles.Bold.Render(s)
-			},
-			"isEnterprise": func(opt clibase.Option) bool {
-				return opt.Annotations.IsSet("enterprise")
-			},
-			"isDeprecated": func(opt clibase.Option) bool {
-				return len(opt.UseInstead) > 0
-			},
-			"useInstead": func(opt clibase.Option) string {
-				var sb strings.Builder
-				for i, s := range opt.UseInstead {
-					if i > 0 {
-						if i == len(opt.UseInstead)-1 {
-							_, _ = sb.WriteString(" and ")
-						} else {
-							_, _ = sb.WriteString(", ")
+					return sb.String()
+				},
+				"formatSubcommand": func(cmd *clibase.Cmd) string {
+					// Minimize padding by finding the longest neighboring name.
+					maxNameLength := len(cmd.Name())
+					if parent := cmd.Parent; parent != nil {
+						for _, c := range parent.Children {
+							if len(c.Name()) > maxNameLength {
+								maxNameLength = len(c.Name())
+							}
 						}
 					}
-					if s.Flag != "" {
-						_, _ = sb.WriteString("--")
-						_, _ = sb.WriteString(s.Flag)
-					} else if s.FlagShorthand != "" {
-						_, _ = sb.WriteString("-")
-						_, _ = sb.WriteString(s.FlagShorthand)
-					} else if s.Env != "" {
-						_, _ = sb.WriteString("$")
-						_, _ = sb.WriteString(s.Env)
-					} else {
-						_, _ = sb.WriteString(s.Name)
+
+					var sb strings.Builder
+					_, _ = fmt.Fprintf(
+						&sb, "%s%s%s",
+						strings.Repeat(" ", 4), cmd.Name(), strings.Repeat(" ", maxNameLength-len(cmd.Name())+4),
+					)
+
+					// This is the point at which indentation begins if there's a
+					// next line.
+					descStart := sb.Len()
+
+					twidth := ttyWidth()
+
+					for i, line := range strings.Split(
+						wordwrap.WrapString(cmd.Short, uint(twidth-descStart)), "\n",
+					) {
+						if i > 0 {
+							_, _ = sb.WriteString(strings.Repeat(" ", descStart))
+						}
+						_, _ = sb.WriteString(line)
+						_, _ = sb.WriteString("\n")
 					}
-				}
-				return sb.String()
-			},
-			"formatLong": func(long string) string {
-				// We intentionally don't wrap here because it would misformat
-				// examples, where the new line would start without the prior
-				// line's indentation.
-				return strings.TrimSpace(long)
-			},
-			"formatGroupDescription": func(s string) string {
-				s = strings.ReplaceAll(s, "\n", "")
-				s = s + "\n"
-				s = wrapTTY(s)
-				return s
-			},
-			"visibleChildren": func(cmd *clibase.Cmd) []*clibase.Cmd {
-				return filterSlice(cmd.Children, func(c *clibase.Cmd) bool {
-					return !c.Hidden
-				})
-			},
-			"optionGroups": func(cmd *clibase.Cmd) []optionGroup {
-				groups := []optionGroup{{
-					// Default group.
-					Name:        "",
-					Description: "",
-				}}
-
-				enterpriseGroup := optionGroup{
-					Name:        "Enterprise",
-					Description: `These options are only available in the Enterprise Edition.`,
-				}
-
-				// Sort options lexicographically.
-				sort.Slice(cmd.Options, func(i, j int) bool {
-					return cmd.Options[i].Name < cmd.Options[j].Name
-				})
-
-			optionLoop:
-				for _, opt := range cmd.Options {
-					if opt.Hidden {
-						continue
+
+					return sb.String()
+				},
+				"envName": func(opt clibase.Option) string {
+					if opt.Env == "" {
+						return ""
 					}
-					// Enterprise options are always grouped separately.
-					if opt.Annotations.IsSet("enterprise") {
-						enterpriseGroup.Options = append(enterpriseGroup.Options, opt)
-						continue
+					return opt.Env
+				},
+				"flagName": func(opt clibase.Option) string {
+					return opt.Flag
+				},
+
+				"isEnterprise": func(opt clibase.Option) bool {
+					return opt.Annotations.IsSet("enterprise")
+				},
+				"isDeprecated": func(opt clibase.Option) bool {
+					return len(opt.UseInstead) > 0
+				},
+				"useInstead": func(opt clibase.Option) string {
+					var sb strings.Builder
+					for i, s := range opt.UseInstead {
+						if i > 0 {
+							if i == len(opt.UseInstead)-1 {
+								_, _ = sb.WriteString(" and ")
+							} else {
+								_, _ = sb.WriteString(", ")
+							}
+						}
+						if s.Flag != "" {
+							_, _ = sb.WriteString("--")
+							_, _ = sb.WriteString(s.Flag)
+						} else if s.FlagShorthand != "" {
+							_, _ = sb.WriteString("-")
+							_, _ = sb.WriteString(s.FlagShorthand)
+						} else if s.Env != "" {
+							_, _ = sb.WriteString("$")
+							_, _ = sb.WriteString(s.Env)
+						} else {
+							_, _ = sb.WriteString(s.Name)
+						}
 					}
-					if len(opt.Group.Ancestry()) == 0 {
-						// Just add option to default group.
-						groups[0].Options = append(groups[0].Options, opt)
-						continue
+					return sb.String()
+				},
+				"formatGroupDescription": func(s string) string {
+					s = strings.ReplaceAll(s, "\n", "")
+					s = s + "\n"
+					s = wrapTTY(s)
+					return s
+				},
+				"visibleChildren": func(cmd *clibase.Cmd) []*clibase.Cmd {
+					return filterSlice(cmd.Children, func(c *clibase.Cmd) bool {
+						return !c.Hidden
+					})
+				},
+				"optionGroups": func(cmd *clibase.Cmd) []optionGroup {
+					groups := []optionGroup{{
+						// Default group.
+						Name:        "",
+						Description: "",
+					}}
+
+					enterpriseGroup := optionGroup{
+						Name:        "Enterprise",
+						Description: `These options are only available in the Enterprise Edition.`,
 					}
 
-					groupName := opt.Group.FullName()
+					// Sort options lexicographically.
+					sort.Slice(cmd.Options, func(i, j int) bool {
+						return cmd.Options[i].Name < cmd.Options[j].Name
+					})
 
-					for i, foundGroup := range groups {
-						if foundGroup.Name != groupName {
+				optionLoop:
+					for _, opt := range cmd.Options {
+						if opt.Hidden {
+							continue
+						}
+						// Enterprise options are always grouped separately.
+						if opt.Annotations.IsSet("enterprise") {
+							enterpriseGroup.Options = append(enterpriseGroup.Options, opt)
+							continue
+						}
+						if len(opt.Group.Ancestry()) == 0 {
+							// Just add option to default group.
+							groups[0].Options = append(groups[0].Options, opt)
 							continue
 						}
-						groups[i].Options = append(groups[i].Options, opt)
-						continue optionLoop
+
+						groupName := opt.Group.FullName()
+
+						for i, foundGroup := range groups {
+							if foundGroup.Name != groupName {
+								continue
+							}
+							groups[i].Options = append(groups[i].Options, opt)
+							continue optionLoop
+						}
+
+						groups = append(groups, optionGroup{
+							Name:        groupName,
+							Description: opt.Group.Description,
+							Options:     clibase.OptionSet{opt},
+						})
 					}
+					sort.Slice(groups, func(i, j int) bool {
+						// Sort groups lexicographically.
+						return groups[i].Name < groups[j].Name
+					})
 
-					groups = append(groups, optionGroup{
-						Name:        groupName,
-						Description: opt.Group.Description,
-						Options:     clibase.OptionSet{opt},
+					// Always show enterprise group last.
+					groups = append(groups, enterpriseGroup)
+
+					return filterSlice(groups, func(g optionGroup) bool {
+						return len(g.Options) > 0
 					})
-				}
-				sort.Slice(groups, func(i, j int) bool {
-					// Sort groups lexicographically.
-					return groups[i].Name < groups[j].Name
-				})
-
-				// Always show enterprise group last.
-				groups = append(groups, enterpriseGroup)
-
-				return filterSlice(groups, func(g optionGroup) bool {
-					return len(g.Options) > 0
-				})
+				},
 			},
-		},
-	).Parse(helpTemplateRaw),
-)
+		).Parse(helpTemplateRaw),
+	)
+}()
 
 func filterSlice[T any](s []T, f func(T) bool) []T {
 	var r []T
@@ -254,31 +272,41 @@ func filterSlice[T any](s []T, f func(T) bool) []T {
 
 // newLineLimiter makes working with Go templates more bearable. Without this,
 // modifying the template is a slow toil of counting newlines and constantly
-// checking that a change to one command's help doesn't clobber break another.
+// checking that a change to one command's help doesn't break another.
 type newlineLimiter struct {
-	w     io.Writer
+	// w is not an interface since we call WriteRune byte-wise,
+	// and the devirtualization overhead is significant.
+	w     *bufio.Writer
 	limit int
 
 	newLineCounter int
 }
 
+// isSpace is a based on unicode.IsSpace, but only checks ASCII characters.
+func isSpace(b byte) bool {
+	switch b {
+	case '\t', '\n', '\v', '\f', '\r', ' ', 0x85, 0xA0:
+		return true
+	}
+	return false
+}
+
 func (lm *newlineLimiter) Write(p []byte) (int, error) {
-	rd := bytes.NewReader(p)
-	for r, n, _ := rd.ReadRune(); n > 0; r, n, _ = rd.ReadRune() {
+	for _, b := range p {
 		switch {
-		case r == '\r':
+		case b == '\r':
 			// Carriage returns can sneak into `help.tpl` when `git clone`
 			// is configured to automatically convert line endings.
 			continue
-		case r == '\n':
+		case b == '\n':
 			lm.newLineCounter++
 			if lm.newLineCounter > lm.limit {
 				continue
 			}
-		case !unicode.IsSpace(r):
+		case !isSpace(b):
 			lm.newLineCounter = 0
 		}
-		_, err := lm.w.Write([]byte(string(r)))
+		err := lm.w.WriteByte(b)
 		if err != nil {
 			return 0, err
 		}
diff --git a/cli/help.tpl b/cli/help.tpl
index 97d79db936e43..59e1f0dce50a7 100644
--- a/cli/help.tpl
+++ b/cli/help.tpl
@@ -1,20 +1,22 @@
-{{- /* Heavily inspired by the Go toolchain formatting. */ -}}
-Usage: {{.FullUsage}}
+{{- /* Heavily inspired by the Go toolchain and fd */ -}}
+coder {{version}}
+
+{{prettyHeader "Usage"}}
+{{indent .FullUsage 2}}
 
 
 {{ with .Short }}
-{{- wrapTTY . }}
+{{- indent . 2 | wrapTTY }}
 {{"\n"}}
 {{- end}}
 
 {{ with .Aliases }}
-{{ "\n" }}
-{{ "Aliases:"}} {{ joinStrings .}}
-{{ "\n" }}
+{{"  Aliases: "}} {{- joinStrings .}}
 {{- end }}
 
 {{- with .Long}}
-{{- formatLong . }}
+{{"\n"}}
+{{- indent . 2}}
 {{ "\n" }}
 {{- end }}
 {{ with visibleChildren . }}
@@ -34,11 +36,11 @@ Usage: {{.FullUsage}}
 {{- else }}
 {{- end }}
     {{- range $index, $option := $group.Options }}
-	{{- if not (eq $option.FlagShorthand "") }}{{- print "\n  -" $option.FlagShorthand ", " -}}
+	{{- if not (eq $option.FlagShorthand "") }}{{- print "\n "}} {{ keyword "-"}}{{keyword $option.FlagShorthand }}{{", "}}
 	{{- else }}{{- print "\n      " -}}
 	{{- end }}
-    {{- with flagName $option }}--{{ . }}{{ end }} {{- with typeHelper $option }} {{ . }}{{ end }}
-    {{- with envName $option }}, ${{ . }}{{ end }}
+    {{- with flagName $option }}{{keyword "--"}}{{ keyword . }}{{ end }} {{- with typeHelper $option }} {{ . }}{{ end }}
+    {{- with envName $option }}, {{ print "$" . | keyword }}{{ end }}
     {{- with $option.Default }} (default: {{ . }}){{ end }}
         {{- with $option.Description }}
             {{- $desc := $option.Description }}
@@ -47,7 +49,7 @@ Usage: {{.FullUsage}}
         {{- end -}}
     {{- end }}
 {{- end }}
----
+———
 {{- if .Parent }}
 Run `coder --help` for a list of global options.
 {{- else }}
diff --git a/cli/list.go b/cli/list.go
index 4b50ba16a7d34..b82d6f31579bf 100644
--- a/cli/list.go
+++ b/cli/list.go
@@ -7,11 +7,13 @@ import (
 
 	"github.com/google/uuid"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // workspaceListRow is the type provided to the OutputFormatter. This is a bit
@@ -30,6 +32,7 @@ type workspaceListRow struct {
 	Outdated      bool   `json:"-" table:"outdated"`
 	StartsAt      string `json:"-" table:"starts at"`
 	StopsAfter    string `json:"-" table:"stops after"`
+	DailyCost     string `json:"-" table:"daily cost"`
 }
 
 func workspaceListRowFromWorkspace(now time.Time, usersByID map[uuid.UUID]codersdk.User, workspace codersdk.Workspace) workspaceListRow {
@@ -38,7 +41,7 @@ func workspaceListRowFromWorkspace(now time.Time, usersByID map[uuid.UUID]coders
 	lastBuilt := now.UTC().Sub(workspace.LatestBuild.Job.CreatedAt).Truncate(time.Second)
 	autostartDisplay := "-"
 	if !ptr.NilOrEmpty(workspace.AutostartSchedule) {
-		if sched, err := schedule.Weekly(*workspace.AutostartSchedule); err == nil {
+		if sched, err := cron.Weekly(*workspace.AutostartSchedule); err == nil {
 			autostartDisplay = fmt.Sprintf("%s %s (%s)", sched.Time(), sched.DaysOfWeek(), sched.Location())
 		}
 	}
@@ -68,6 +71,7 @@ func workspaceListRowFromWorkspace(now time.Time, usersByID map[uuid.UUID]coders
 		Outdated:      workspace.Outdated,
 		StartsAt:      autostartDisplay,
 		StopsAfter:    autostopDisplay,
+		DailyCost:     strconv.Itoa(int(workspace.LatestBuild.DailyCost)),
 	}
 }
 
@@ -78,7 +82,19 @@ func (r *RootCmd) list() *clibase.Cmd {
 		searchQuery       string
 		displayWorkspaces []workspaceListRow
 		formatter         = cliui.NewOutputFormatter(
-			cliui.TableFormat([]workspaceListRow{}, nil),
+			cliui.TableFormat(
+				[]workspaceListRow{},
+				[]string{
+					"workspace",
+					"template",
+					"status",
+					"healthy",
+					"last built",
+					"outdated",
+					"starts at",
+					"stops after",
+				},
+			),
 			cliui.JSONFormat(),
 		)
 	)
@@ -105,9 +121,9 @@ func (r *RootCmd) list() *clibase.Cmd {
 				return err
 			}
 			if len(res.Workspaces) == 0 {
-				_, _ = fmt.Fprintln(inv.Stderr, cliui.DefaultStyles.Prompt.String()+"No workspaces found! Create one:")
+				pretty.Fprintf(inv.Stderr, cliui.DefaultStyles.Prompt, "No workspaces found! Create one:\n")
 				_, _ = fmt.Fprintln(inv.Stderr)
-				_, _ = fmt.Fprintln(inv.Stderr, "  "+cliui.DefaultStyles.Code.Render("coder create <name>"))
+				_, _ = fmt.Fprintln(inv.Stderr, "  "+pretty.Sprint(cliui.DefaultStyles.Code, "coder create <name>"))
 				_, _ = fmt.Fprintln(inv.Stderr)
 				return nil
 			}
diff --git a/cli/list_test.go b/cli/list_test.go
index 39567cd6d9167..cdc47821b0ced 100644
--- a/cli/list_test.go
+++ b/cli/list_test.go
@@ -9,11 +9,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestList(t *testing.T) {
@@ -21,14 +21,15 @@ func TestList(t *testing.T) {
 	t.Run("Single", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		inv, root := clitest.New(t, "ls")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		pty := ptytest.New(t).Attach(inv)
 
 		ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -48,15 +49,16 @@ func TestList(t *testing.T) {
 	t.Run("JSON", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		inv, root := clitest.New(t, "list", "--output=json")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 
 		ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancelFunc()
diff --git a/cli/login.go b/cli/login.go
index e16118dfec0d6..2727743e1b487 100644
--- a/cli/login.go
+++ b/cli/login.go
@@ -16,10 +16,12 @@ import (
 	"github.com/pkg/browser"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/userpassword"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/userpassword"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 const (
@@ -37,6 +39,91 @@ func init() {
 	browser.Stdout = io.Discard
 }
 
+func promptFirstUsername(inv *clibase.Invocation) (string, error) {
+	currentUser, err := user.Current()
+	if err != nil {
+		return "", xerrors.Errorf("get current user: %w", err)
+	}
+	username, err := cliui.Prompt(inv, cliui.PromptOptions{
+		Text:    "What " + pretty.Sprint(cliui.DefaultStyles.Field, "username") + " would you like?",
+		Default: currentUser.Username,
+	})
+	if errors.Is(err, cliui.Canceled) {
+		return "", nil
+	}
+	if err != nil {
+		return "", err
+	}
+
+	return username, nil
+}
+
+func promptFirstPassword(inv *clibase.Invocation) (string, error) {
+retry:
+	password, err := cliui.Prompt(inv, cliui.PromptOptions{
+		Text:   "Enter a " + pretty.Sprint(cliui.DefaultStyles.Field, "password") + ":",
+		Secret: true,
+		Validate: func(s string) error {
+			return userpassword.Validate(s)
+		},
+	})
+	if err != nil {
+		return "", xerrors.Errorf("specify password prompt: %w", err)
+	}
+	confirm, err := cliui.Prompt(inv, cliui.PromptOptions{
+		Text:     "Confirm " + pretty.Sprint(cliui.DefaultStyles.Field, "password") + ":",
+		Secret:   true,
+		Validate: cliui.ValidateNotEmpty,
+	})
+	if err != nil {
+		return "", xerrors.Errorf("confirm password prompt: %w", err)
+	}
+
+	if confirm != password {
+		_, _ = fmt.Fprintln(inv.Stdout, pretty.Sprint(cliui.DefaultStyles.Error, "Passwords do not match"))
+		goto retry
+	}
+
+	return password, nil
+}
+
+func (r *RootCmd) loginWithPassword(
+	inv *clibase.Invocation,
+	client *codersdk.Client,
+	email, password string,
+) error {
+	resp, err := client.LoginWithPassword(inv.Context(), codersdk.LoginWithPasswordRequest{
+		Email:    email,
+		Password: password,
+	})
+	if err != nil {
+		return xerrors.Errorf("login with password: %w", err)
+	}
+
+	sessionToken := resp.SessionToken
+	config := r.createConfig()
+	err = config.Session().Write(sessionToken)
+	if err != nil {
+		return xerrors.Errorf("write session token: %w", err)
+	}
+
+	client.SetSessionToken(sessionToken)
+
+	// Nice side-effect: validates the token.
+	u, err := client.User(inv.Context(), "me")
+	if err != nil {
+		return xerrors.Errorf("get user: %w", err)
+	}
+
+	_, _ = fmt.Fprintf(
+		inv.Stdout,
+		"Welcome to Coder, %s! You're authenticated.",
+		pretty.Sprint(cliui.DefaultStyles.Keyword, u.Username),
+	)
+
+	return nil
+}
+
 func (r *RootCmd) login() *clibase.Cmd {
 	const firstUserTrialEnv = "CODER_FIRST_USER_TRIAL"
 
@@ -76,7 +163,7 @@ func (r *RootCmd) login() *clibase.Cmd {
 				serverURL.Scheme = "https"
 			}
 
-			client, err := r.createUnauthenticatedClient(serverURL)
+			client, err := r.createUnauthenticatedClient(ctx, serverURL)
 			if err != nil {
 				return err
 			}
@@ -88,50 +175,39 @@ func (r *RootCmd) login() *clibase.Cmd {
 			if err != nil {
 				// Checking versions isn't a fatal error so we print a warning
 				// and proceed.
-				_, _ = fmt.Fprintln(inv.Stderr, cliui.DefaultStyles.Warn.Render(err.Error()))
+				_, _ = fmt.Fprintln(inv.Stderr, pretty.Sprint(cliui.DefaultStyles.Warn, err.Error()))
 			}
 
-			hasInitialUser, err := client.HasFirstUser(ctx)
+			hasFirstUser, err := client.HasFirstUser(ctx)
 			if err != nil {
 				return xerrors.Errorf("Failed to check server %q for first user, is the URL correct and is coder accessible from your browser? Error - has initial user: %w", serverURL.String(), err)
 			}
-			if !hasInitialUser {
+			if !hasFirstUser {
 				_, _ = fmt.Fprintf(inv.Stdout, Caret+"Your Coder deployment hasn't been set up!\n")
 
 				if username == "" {
 					if !isTTY(inv) {
 						return xerrors.New("the initial user cannot be created in non-interactive mode. use the API")
 					}
+
 					_, err := cliui.Prompt(inv, cliui.PromptOptions{
 						Text:      "Would you like to create the first user?",
 						Default:   cliui.ConfirmYes,
 						IsConfirm: true,
 					})
-					if errors.Is(err, cliui.Canceled) {
-						return nil
-					}
 					if err != nil {
 						return err
 					}
-					currentUser, err := user.Current()
-					if err != nil {
-						return xerrors.Errorf("get current user: %w", err)
-					}
-					username, err = cliui.Prompt(inv, cliui.PromptOptions{
-						Text:    "What " + cliui.DefaultStyles.Field.Render("username") + " would you like?",
-						Default: currentUser.Username,
-					})
-					if errors.Is(err, cliui.Canceled) {
-						return nil
-					}
+
+					username, err = promptFirstUsername(inv)
 					if err != nil {
-						return xerrors.Errorf("pick username prompt: %w", err)
+						return err
 					}
 				}
 
 				if email == "" {
 					email, err = cliui.Prompt(inv, cliui.PromptOptions{
-						Text: "What's your " + cliui.DefaultStyles.Field.Render("email") + "?",
+						Text: "What's your " + pretty.Sprint(cliui.DefaultStyles.Field, "email") + "?",
 						Validate: func(s string) error {
 							err := validator.New().Var(s, "email")
 							if err != nil {
@@ -141,37 +217,14 @@ func (r *RootCmd) login() *clibase.Cmd {
 						},
 					})
 					if err != nil {
-						return xerrors.Errorf("specify email prompt: %w", err)
+						return err
 					}
 				}
 
 				if password == "" {
-					var matching bool
-
-					for !matching {
-						password, err = cliui.Prompt(inv, cliui.PromptOptions{
-							Text:   "Enter a " + cliui.DefaultStyles.Field.Render("password") + ":",
-							Secret: true,
-							Validate: func(s string) error {
-								return userpassword.Validate(s)
-							},
-						})
-						if err != nil {
-							return xerrors.Errorf("specify password prompt: %w", err)
-						}
-						confirm, err := cliui.Prompt(inv, cliui.PromptOptions{
-							Text:     "Confirm " + cliui.DefaultStyles.Field.Render("password") + ":",
-							Secret:   true,
-							Validate: cliui.ValidateNotEmpty,
-						})
-						if err != nil {
-							return xerrors.Errorf("confirm password prompt: %w", err)
-						}
-
-						matching = confirm == password
-						if !matching {
-							_, _ = fmt.Fprintln(inv.Stdout, cliui.DefaultStyles.Error.Render("Passwords do not match"))
-						}
+					password, err = promptFirstPassword(inv)
+					if err != nil {
+						return err
 					}
 				}
 
@@ -193,30 +246,22 @@ func (r *RootCmd) login() *clibase.Cmd {
 				if err != nil {
 					return xerrors.Errorf("create initial user: %w", err)
 				}
-				resp, err := client.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{
-					Email:    email,
-					Password: password,
-				})
-				if err != nil {
-					return xerrors.Errorf("login with password: %w", err)
-				}
 
-				sessionToken := resp.SessionToken
-				config := r.createConfig()
-				err = config.Session().Write(sessionToken)
+				err := r.loginWithPassword(inv, client, email, password)
 				if err != nil {
-					return xerrors.Errorf("write session token: %w", err)
+					return err
 				}
-				err = config.URL().Write(serverURL.String())
+
+				err = r.createConfig().URL().Write(serverURL.String())
 				if err != nil {
 					return xerrors.Errorf("write server url: %w", err)
 				}
 
-				_, _ = fmt.Fprintf(inv.Stdout,
-					cliui.DefaultStyles.Paragraph.Render(fmt.Sprintf("Welcome to Coder, %s! You're authenticated.", cliui.DefaultStyles.Keyword.Render(username)))+"\n")
-
-				_, _ = fmt.Fprintf(inv.Stdout,
-					cliui.DefaultStyles.Paragraph.Render("Get started by creating a template: "+cliui.DefaultStyles.Code.Render("coder templates init"))+"\n")
+				_, _ = fmt.Fprintf(
+					inv.Stdout,
+					"Get started by creating a template: %s\n",
+					pretty.Sprint(cliui.DefaultStyles.Code, "coder templates init"),
+				)
 				return nil
 			}
 
@@ -233,8 +278,7 @@ func (r *RootCmd) login() *clibase.Cmd {
 				}
 
 				sessionToken, err = cliui.Prompt(inv, cliui.PromptOptions{
-					Text:   "Paste your token here:",
-					Secret: true,
+					Text: "Paste your token here:",
 					Validate: func(token string) error {
 						client.SetSessionToken(token)
 						_, err := client.User(ctx, codersdk.Me)
@@ -282,7 +326,7 @@ func (r *RootCmd) login() *clibase.Cmd {
 				return xerrors.Errorf("write server url: %w", err)
 			}
 
-			_, _ = fmt.Fprintf(inv.Stdout, Caret+"Welcome to Coder, %s! You're authenticated.\n", cliui.DefaultStyles.Keyword.Render(resp.Username))
+			_, _ = fmt.Fprintf(inv.Stdout, Caret+"Welcome to Coder, %s! You're authenticated.\n", pretty.Sprint(cliui.DefaultStyles.Keyword, resp.Username))
 			return nil
 		},
 	}
diff --git a/cli/login_test.go b/cli/login_test.go
index 1bab4721ea181..3bda6bcd1d22f 100644
--- a/cli/login_test.go
+++ b/cli/login_test.go
@@ -3,15 +3,18 @@ package cli_test
 import (
 	"context"
 	"fmt"
+	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestLogin(t *testing.T) {
@@ -97,16 +100,15 @@ func TestLogin(t *testing.T) {
 	t.Run("InitialUserFlags", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
-		doneChan := make(chan struct{})
-		root, _ := clitest.New(t, "login", client.URL.String(), "--first-user-username", "testuser", "--first-user-email", "user@coder.com", "--first-user-password", "SomeSecurePassword!", "--first-user-trial")
-		pty := ptytest.New(t).Attach(root)
-		go func() {
-			defer close(doneChan)
-			err := root.Run()
-			assert.NoError(t, err)
-		}()
+		inv, _ := clitest.New(
+			t, "login", client.URL.String(),
+			"--first-user-username", "testuser", "--first-user-email", "user@coder.com",
+			"--first-user-password", "SomeSecurePassword!", "--first-user-trial",
+		)
+		pty := ptytest.New(t).Attach(inv)
+		w := clitest.StartWithWaiter(t, inv)
 		pty.ExpectMatch("Welcome to Coder")
-		<-doneChan
+		w.RequireSuccess()
 	})
 
 	t.Run("InitialUserTTYConfirmPasswordFailAndReprompt", func(t *testing.T) {
@@ -142,7 +144,7 @@ func TestLogin(t *testing.T) {
 
 		// Validate that we reprompt for matching passwords.
 		pty.ExpectMatch("Passwords do not match")
-		pty.ExpectMatch("Enter a " + cliui.DefaultStyles.Field.Render("password"))
+		pty.ExpectMatch("Enter a " + pretty.Sprint(cliui.DefaultStyles.Field, "password"))
 
 		pty.WriteLine("SomeSecurePassword!")
 		pty.ExpectMatch("Confirm")
@@ -169,6 +171,10 @@ func TestLogin(t *testing.T) {
 
 		pty.ExpectMatch("Paste your token here:")
 		pty.WriteLine(client.SessionToken())
+		if runtime.GOOS != "windows" {
+			// For some reason, the match does not show up on Windows.
+			pty.ExpectMatch(client.SessionToken())
+		}
 		pty.ExpectMatch("Welcome to Coder")
 		<-doneChan
 	})
@@ -192,6 +198,10 @@ func TestLogin(t *testing.T) {
 
 		pty.ExpectMatch("Paste your token here:")
 		pty.WriteLine("an-invalid-token")
+		if runtime.GOOS != "windows" {
+			// For some reason, the match does not show up on Windows.
+			pty.ExpectMatch("an-invalid-token")
+		}
 		pty.ExpectMatch("That's not a valid token!")
 		cancelFunc()
 		<-doneChan
diff --git a/cli/logout.go b/cli/logout.go
index 6a4e8872bd227..4e4008e4ffad5 100644
--- a/cli/logout.go
+++ b/cli/logout.go
@@ -7,9 +7,9 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) logout() *clibase.Cmd {
diff --git a/cli/logout_test.go b/cli/logout_test.go
index 849016a68ce81..b7c1a571a6605 100644
--- a/cli/logout_test.go
+++ b/cli/logout_test.go
@@ -8,10 +8,10 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/cli/config"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/config"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestLogout(t *testing.T) {
diff --git a/cli/netcheck.go b/cli/netcheck.go
index b670e9c12b8ed..5ca7a3d99975b 100644
--- a/cli/netcheck.go
+++ b/cli/netcheck.go
@@ -8,9 +8,9 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/coderd/healthcheck"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/coderd/healthcheck/derphealth"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) netcheck() *clibase.Cmd {
@@ -33,8 +33,8 @@ func (r *RootCmd) netcheck() *clibase.Cmd {
 
 			_, _ = fmt.Fprint(inv.Stderr, "Gathering a network report. This may take a few seconds...\n\n")
 
-			var report healthcheck.DERPReport
-			report.Run(ctx, &healthcheck.DERPReportOptions{
+			var report derphealth.Report
+			report.Run(ctx, &derphealth.ReportOptions{
 				DERPMap: connInfo.DERPMap,
 			})
 
diff --git a/cli/netcheck_test.go b/cli/netcheck_test.go
index 890260c1a704e..79abf775562e2 100644
--- a/cli/netcheck_test.go
+++ b/cli/netcheck_test.go
@@ -8,9 +8,9 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/healthcheck"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/healthcheck/derphealth"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestNetcheck(t *testing.T) {
@@ -27,11 +27,11 @@ func TestNetcheck(t *testing.T) {
 
 	b := out.Bytes()
 	t.Log(string(b))
-	var report healthcheck.DERPReport
+	var report derphealth.Report
 	require.NoError(t, json.Unmarshal(b, &report))
 
 	assert.True(t, report.Healthy)
-	require.Len(t, report.Regions, 1)
+	require.Len(t, report.Regions, 1+1) // 1 built-in region + 1 test-managed STUN region
 	for _, v := range report.Regions {
 		require.Len(t, v.NodeReports, len(v.Region.Nodes))
 	}
diff --git a/cli/parameter.go b/cli/parameter.go
index 77e8ccdc8ee67..bca83ee1a62b1 100644
--- a/cli/parameter.go
+++ b/cli/parameter.go
@@ -4,71 +4,98 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"strings"
 
 	"golang.org/x/xerrors"
 	"gopkg.in/yaml.v3"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/codersdk"
 )
 
-// Reads a YAML file and populates a string -> string map.
-// Throws an error if the file name is empty.
-func createParameterMapFromFile(parameterFile string) (map[string]string, error) {
-	if parameterFile != "" {
-		parameterFileContents, err := os.ReadFile(parameterFile)
-		if err != nil {
-			return nil, err
-		}
+// workspaceParameterFlags are used by commands processing rich parameters and/or build options.
+type workspaceParameterFlags struct {
+	promptBuildOptions bool
+	buildOptions       []string
 
-		mapStringInterface := make(map[string]interface{})
-		err = yaml.Unmarshal(parameterFileContents, &mapStringInterface)
-		if err != nil {
-			return nil, err
-		}
+	richParameterFile string
+	richParameters    []string
+}
 
-		parameterMap := map[string]string{}
-		for k, v := range mapStringInterface {
-			switch val := v.(type) {
-			case string, bool, int:
-				parameterMap[k] = fmt.Sprintf("%v", val)
-			case []interface{}:
-				b, err := json.Marshal(&val)
-				if err != nil {
-					return nil, err
-				}
-				parameterMap[k] = string(b)
-			default:
-				return nil, xerrors.Errorf("invalid parameter type: %T", v)
-			}
-		}
-		return parameterMap, nil
+func (wpf *workspaceParameterFlags) cliBuildOptions() []clibase.Option {
+	return clibase.OptionSet{
+		{
+			Flag:        "build-option",
+			Env:         "CODER_BUILD_OPTION",
+			Description: `Build option value in the format "name=value".`,
+			Value:       clibase.StringArrayOf(&wpf.buildOptions),
+		},
+		{
+			Flag:        "build-options",
+			Description: "Prompt for one-time build options defined with ephemeral parameters.",
+			Value:       clibase.BoolOf(&wpf.promptBuildOptions),
+		},
+	}
+}
+
+func (wpf *workspaceParameterFlags) cliParameters() []clibase.Option {
+	return clibase.OptionSet{
+		clibase.Option{
+			Flag:        "parameter",
+			Env:         "CODER_RICH_PARAMETER",
+			Description: `Rich parameter value in the format "name=value".`,
+			Value:       clibase.StringArrayOf(&wpf.richParameters),
+		},
+		clibase.Option{
+			Flag:        "rich-parameter-file",
+			Env:         "CODER_RICH_PARAMETER_FILE",
+			Description: "Specify a file path with values for rich parameters defined in the template.",
+			Value:       clibase.StringOf(&wpf.richParameterFile),
+		},
 	}
+}
 
-	return nil, xerrors.Errorf("Parameter file name is not specified")
+func asWorkspaceBuildParameters(nameValuePairs []string) ([]codersdk.WorkspaceBuildParameter, error) {
+	var params []codersdk.WorkspaceBuildParameter
+	for _, nameValue := range nameValuePairs {
+		split := strings.SplitN(nameValue, "=", 2)
+		if len(split) < 2 {
+			return nil, xerrors.Errorf("format key=value expected, but got %s", nameValue)
+		}
+		params = append(params, codersdk.WorkspaceBuildParameter{
+			Name:  split[0],
+			Value: split[1],
+		})
+	}
+	return params, nil
 }
 
-func getWorkspaceBuildParameterValueFromMapOrInput(inv *clibase.Invocation, parameterMap map[string]string, templateVersionParameter codersdk.TemplateVersionParameter) (*codersdk.WorkspaceBuildParameter, error) {
-	var parameterValue string
-	var err error
-	if parameterMap != nil {
-		var ok bool
-		parameterValue, ok = parameterMap[templateVersionParameter.Name]
-		if !ok {
-			parameterValue, err = cliui.RichParameter(inv, templateVersionParameter)
+func parseParameterMapFile(parameterFile string) (map[string]string, error) {
+	parameterFileContents, err := os.ReadFile(parameterFile)
+	if err != nil {
+		return nil, err
+	}
+
+	mapStringInterface := make(map[string]interface{})
+	err = yaml.Unmarshal(parameterFileContents, &mapStringInterface)
+	if err != nil {
+		return nil, err
+	}
+
+	parameterMap := map[string]string{}
+	for k, v := range mapStringInterface {
+		switch val := v.(type) {
+		case string, bool, int:
+			parameterMap[k] = fmt.Sprintf("%v", val)
+		case []interface{}:
+			b, err := json.Marshal(&val)
 			if err != nil {
 				return nil, err
 			}
-		}
-	} else {
-		parameterValue, err = cliui.RichParameter(inv, templateVersionParameter)
-		if err != nil {
-			return nil, err
+			parameterMap[k] = string(b)
+		default:
+			return nil, xerrors.Errorf("invalid parameter type: %T", v)
 		}
 	}
-	return &codersdk.WorkspaceBuildParameter{
-		Name:  templateVersionParameter.Name,
-		Value: parameterValue,
-	}, nil
+	return parameterMap, nil
 }
diff --git a/cli/parameter_internal_test.go b/cli/parameter_internal_test.go
index 81dfcefdf49b2..935486c6eae26 100644
--- a/cli/parameter_internal_test.go
+++ b/cli/parameter_internal_test.go
@@ -16,7 +16,7 @@ func TestCreateParameterMapFromFile(t *testing.T) {
 		parameterFile, _ := os.CreateTemp(tempDir, "testParameterFile*.yaml")
 		_, _ = parameterFile.WriteString("region: \"bananas\"\ndisk: \"20\"\n")
 
-		parameterMapFromFile, err := createParameterMapFromFile(parameterFile.Name())
+		parameterMapFromFile, err := parseParameterMapFile(parameterFile.Name())
 
 		expectedMap := map[string]string{
 			"region": "bananas",
@@ -28,18 +28,10 @@ func TestCreateParameterMapFromFile(t *testing.T) {
 
 		removeTmpDirUntilSuccess(t, tempDir)
 	})
-	t.Run("WithEmptyFilename", func(t *testing.T) {
-		t.Parallel()
-
-		parameterMapFromFile, err := createParameterMapFromFile("")
-
-		assert.Nil(t, parameterMapFromFile)
-		assert.EqualError(t, err, "Parameter file name is not specified")
-	})
 	t.Run("WithInvalidFilename", func(t *testing.T) {
 		t.Parallel()
 
-		parameterMapFromFile, err := createParameterMapFromFile("invalidFile.yaml")
+		parameterMapFromFile, err := parseParameterMapFile("invalidFile.yaml")
 
 		assert.Nil(t, parameterMapFromFile)
 
@@ -57,7 +49,7 @@ func TestCreateParameterMapFromFile(t *testing.T) {
 		parameterFile, _ := os.CreateTemp(tempDir, "testParameterFile*.yaml")
 		_, _ = parameterFile.WriteString("region = \"bananas\"\ndisk = \"20\"\n")
 
-		parameterMapFromFile, err := createParameterMapFromFile(parameterFile.Name())
+		parameterMapFromFile, err := parseParameterMapFile(parameterFile.Name())
 
 		assert.Nil(t, parameterMapFromFile)
 		assert.EqualError(t, err, "yaml: unmarshal errors:\n  line 1: cannot unmarshal !!str `region ...` into map[string]interface {}")
diff --git a/cli/parameterresolver.go b/cli/parameterresolver.go
new file mode 100644
index 0000000000000..97cf622b75c33
--- /dev/null
+++ b/cli/parameterresolver.go
@@ -0,0 +1,256 @@
+package cli
+
+import (
+	"fmt"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+type WorkspaceCLIAction int
+
+const (
+	WorkspaceCreate WorkspaceCLIAction = iota
+	WorkspaceStart
+	WorkspaceUpdate
+	WorkspaceRestart
+)
+
+type ParameterResolver struct {
+	lastBuildParameters []codersdk.WorkspaceBuildParameter
+
+	richParameters     []codersdk.WorkspaceBuildParameter
+	richParametersFile map[string]string
+	buildOptions       []codersdk.WorkspaceBuildParameter
+
+	promptRichParameters bool
+	promptBuildOptions   bool
+}
+
+func (pr *ParameterResolver) WithLastBuildParameters(params []codersdk.WorkspaceBuildParameter) *ParameterResolver {
+	pr.lastBuildParameters = params
+	return pr
+}
+
+func (pr *ParameterResolver) WithRichParameters(params []codersdk.WorkspaceBuildParameter) *ParameterResolver {
+	pr.richParameters = params
+	return pr
+}
+
+func (pr *ParameterResolver) WithBuildOptions(params []codersdk.WorkspaceBuildParameter) *ParameterResolver {
+	pr.buildOptions = params
+	return pr
+}
+
+func (pr *ParameterResolver) WithRichParametersFile(fileMap map[string]string) *ParameterResolver {
+	pr.richParametersFile = fileMap
+	return pr
+}
+
+func (pr *ParameterResolver) WithPromptRichParameters(promptRichParameters bool) *ParameterResolver {
+	pr.promptRichParameters = promptRichParameters
+	return pr
+}
+
+func (pr *ParameterResolver) WithPromptBuildOptions(promptBuildOptions bool) *ParameterResolver {
+	pr.promptBuildOptions = promptBuildOptions
+	return pr
+}
+
+func (pr *ParameterResolver) Resolve(inv *clibase.Invocation, action WorkspaceCLIAction, templateVersionParameters []codersdk.TemplateVersionParameter) ([]codersdk.WorkspaceBuildParameter, error) {
+	var staged []codersdk.WorkspaceBuildParameter
+	var err error
+
+	staged = pr.resolveWithParametersMapFile(staged)
+	staged = pr.resolveWithCommandLineOrEnv(staged)
+	staged = pr.resolveWithLastBuildParameters(staged, templateVersionParameters)
+	if err = pr.verifyConstraints(staged, action, templateVersionParameters); err != nil {
+		return nil, err
+	}
+	if staged, err = pr.resolveWithInput(staged, inv, action, templateVersionParameters); err != nil {
+		return nil, err
+	}
+	return staged, nil
+}
+
+func (pr *ParameterResolver) resolveWithParametersMapFile(resolved []codersdk.WorkspaceBuildParameter) []codersdk.WorkspaceBuildParameter {
+next:
+	for name, value := range pr.richParametersFile {
+		for i, r := range resolved {
+			if r.Name == name {
+				resolved[i].Value = value
+				continue next
+			}
+		}
+
+		resolved = append(resolved, codersdk.WorkspaceBuildParameter{
+			Name:  name,
+			Value: value,
+		})
+	}
+	return resolved
+}
+
+func (pr *ParameterResolver) resolveWithCommandLineOrEnv(resolved []codersdk.WorkspaceBuildParameter) []codersdk.WorkspaceBuildParameter {
+nextRichParameter:
+	for _, richParameter := range pr.richParameters {
+		for i, r := range resolved {
+			if r.Name == richParameter.Name {
+				resolved[i].Value = richParameter.Value
+				continue nextRichParameter
+			}
+		}
+
+		resolved = append(resolved, richParameter)
+	}
+
+nextBuildOption:
+	for _, buildOption := range pr.buildOptions {
+		for i, r := range resolved {
+			if r.Name == buildOption.Name {
+				resolved[i].Value = buildOption.Value
+				continue nextBuildOption
+			}
+		}
+
+		resolved = append(resolved, buildOption)
+	}
+	return resolved
+}
+
+func (pr *ParameterResolver) resolveWithLastBuildParameters(resolved []codersdk.WorkspaceBuildParameter, templateVersionParameters []codersdk.TemplateVersionParameter) []codersdk.WorkspaceBuildParameter {
+	if pr.promptRichParameters {
+		return resolved // don't pull parameters from last build
+	}
+
+next:
+	for _, buildParameter := range pr.lastBuildParameters {
+		tvp := findTemplateVersionParameter(buildParameter, templateVersionParameters)
+		if tvp == nil {
+			continue // it looks like this parameter is not present anymore
+		}
+
+		if tvp.Ephemeral {
+			continue // ephemeral parameters should not be passed to consecutive builds
+		}
+
+		if !tvp.Mutable {
+			continue // immutables should not be passed to consecutive builds
+		}
+
+		if len(tvp.Options) > 0 && !isValidTemplateParameterOption(buildParameter, tvp.Options) {
+			continue // do not propagate invalid options
+		}
+
+		for i, r := range resolved {
+			if r.Name == buildParameter.Name {
+				resolved[i].Value = buildParameter.Value
+				continue next
+			}
+		}
+
+		resolved = append(resolved, buildParameter)
+	}
+	return resolved
+}
+
+func (pr *ParameterResolver) verifyConstraints(resolved []codersdk.WorkspaceBuildParameter, action WorkspaceCLIAction, templateVersionParameters []codersdk.TemplateVersionParameter) error {
+	for _, r := range resolved {
+		tvp := findTemplateVersionParameter(r, templateVersionParameters)
+		if tvp == nil {
+			return xerrors.Errorf("parameter %q is not present in the template", r.Name)
+		}
+
+		if tvp.Ephemeral && !pr.promptBuildOptions && findWorkspaceBuildParameter(tvp.Name, pr.buildOptions) == nil {
+			return xerrors.Errorf("ephemeral parameter %q can be used only with --build-options or --build-option flag", r.Name)
+		}
+
+		if !tvp.Mutable && action != WorkspaceCreate {
+			return xerrors.Errorf("parameter %q is immutable and cannot be updated", r.Name)
+		}
+	}
+	return nil
+}
+
+func (pr *ParameterResolver) resolveWithInput(resolved []codersdk.WorkspaceBuildParameter, inv *clibase.Invocation, action WorkspaceCLIAction, templateVersionParameters []codersdk.TemplateVersionParameter) ([]codersdk.WorkspaceBuildParameter, error) {
+	for _, tvp := range templateVersionParameters {
+		p := findWorkspaceBuildParameter(tvp.Name, resolved)
+		if p != nil {
+			continue
+		}
+		// Parameter has not been resolved yet, so CLI needs to determine if user should input it.
+
+		firstTimeUse := pr.isFirstTimeUse(tvp.Name)
+		promptParameterOption := pr.isLastBuildParameterInvalidOption(tvp)
+
+		if (tvp.Ephemeral && pr.promptBuildOptions) ||
+			(action == WorkspaceCreate && tvp.Required) ||
+			(action == WorkspaceCreate && !tvp.Ephemeral) ||
+			(action == WorkspaceUpdate && promptParameterOption) ||
+			(action == WorkspaceUpdate && tvp.Mutable && tvp.Required) ||
+			(action == WorkspaceUpdate && !tvp.Mutable && firstTimeUse) ||
+			(action == WorkspaceUpdate && tvp.Mutable && !tvp.Ephemeral && pr.promptRichParameters) {
+			parameterValue, err := cliui.RichParameter(inv, tvp)
+			if err != nil {
+				return nil, err
+			}
+
+			resolved = append(resolved, codersdk.WorkspaceBuildParameter{
+				Name:  tvp.Name,
+				Value: parameterValue,
+			})
+		} else if action == WorkspaceUpdate && !tvp.Mutable && !firstTimeUse {
+			_, _ = fmt.Fprintln(inv.Stdout, pretty.Sprint(cliui.DefaultStyles.Warn, fmt.Sprintf("Parameter %q is not mutable, and cannot be customized after workspace creation.", tvp.Name)))
+		}
+	}
+	return resolved, nil
+}
+
+func (pr *ParameterResolver) isFirstTimeUse(parameterName string) bool {
+	return findWorkspaceBuildParameter(parameterName, pr.lastBuildParameters) == nil
+}
+
+func (pr *ParameterResolver) isLastBuildParameterInvalidOption(templateVersionParameter codersdk.TemplateVersionParameter) bool {
+	if len(templateVersionParameter.Options) == 0 {
+		return false
+	}
+
+	for _, buildParameter := range pr.lastBuildParameters {
+		if buildParameter.Name == templateVersionParameter.Name {
+			return !isValidTemplateParameterOption(buildParameter, templateVersionParameter.Options)
+		}
+	}
+	return false
+}
+
+func findTemplateVersionParameter(workspaceBuildParameter codersdk.WorkspaceBuildParameter, templateVersionParameters []codersdk.TemplateVersionParameter) *codersdk.TemplateVersionParameter {
+	for _, tvp := range templateVersionParameters {
+		if tvp.Name == workspaceBuildParameter.Name {
+			return &tvp
+		}
+	}
+	return nil
+}
+
+func findWorkspaceBuildParameter(parameterName string, params []codersdk.WorkspaceBuildParameter) *codersdk.WorkspaceBuildParameter {
+	for _, p := range params {
+		if p.Name == parameterName {
+			return &p
+		}
+	}
+	return nil
+}
+
+func isValidTemplateParameterOption(buildParameter codersdk.WorkspaceBuildParameter, options []codersdk.TemplateVersionParameterOption) bool {
+	for _, opt := range options {
+		if opt.Value == buildParameter.Value {
+			return true
+		}
+	}
+	return false
+}
diff --git a/cli/ping.go b/cli/ping.go
index f69958666a044..2df0d57446780 100644
--- a/cli/ping.go
+++ b/cli/ping.go
@@ -10,9 +10,11 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) ping() *clibase.Cmd {
@@ -104,14 +106,14 @@ func (r *RootCmd) ping() *clibase.Cmd {
 				if p2p {
 					if !didP2p {
 						_, _ = fmt.Fprintln(inv.Stdout, "p2p connection established in",
-							cliui.DefaultStyles.DateTimeStamp.Render(time.Since(start).Round(time.Millisecond).String()),
+							pretty.Sprint(cliui.DefaultStyles.DateTimeStamp, time.Since(start).Round(time.Millisecond).String()),
 						)
 					}
 					didP2p = true
 
 					via = fmt.Sprintf("%s via %s",
-						cliui.DefaultStyles.Fuchsia.Render("p2p"),
-						cliui.DefaultStyles.Code.Render(pong.Endpoint),
+						pretty.Sprint(cliui.DefaultStyles.Fuchsia, "p2p"),
+						pretty.Sprint(cliui.DefaultStyles.Code, pong.Endpoint),
 					)
 				} else {
 					derpName := "unknown"
@@ -120,15 +122,15 @@ func (r *RootCmd) ping() *clibase.Cmd {
 						derpName = derpRegion.RegionName
 					}
 					via = fmt.Sprintf("%s via %s",
-						cliui.DefaultStyles.Fuchsia.Render("proxied"),
-						cliui.DefaultStyles.Code.Render(fmt.Sprintf("DERP(%s)", derpName)),
+						pretty.Sprint(cliui.DefaultStyles.Fuchsia, "proxied"),
+						pretty.Sprint(cliui.DefaultStyles.Code, fmt.Sprintf("DERP(%s)", derpName)),
 					)
 				}
 
 				_, _ = fmt.Fprintf(inv.Stdout, "pong from %s %s in %s\n",
-					cliui.DefaultStyles.Keyword.Render(workspaceName),
+					pretty.Sprint(cliui.DefaultStyles.Keyword, workspaceName),
 					via,
-					cliui.DefaultStyles.DateTimeStamp.Render(dur.String()),
+					pretty.Sprint(cliui.DefaultStyles.DateTimeStamp, dur.String()),
 				)
 
 				if n == int(pingNum) {
diff --git a/cli/ping_test.go b/cli/ping_test.go
index 959c11c8ed9b4..f2bd4b5ff88a1 100644
--- a/cli/ping_test.go
+++ b/cli/ping_test.go
@@ -6,13 +6,11 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"cdr.dev/slog/sloggers/slogtest"
-
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestPing(t *testing.T) {
@@ -29,15 +27,8 @@ func TestPing(t *testing.T) {
 		inv.Stderr = pty.Output()
 		inv.Stdout = pty.Output()
 
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(agentToken)
-		agentCloser := agent.New(agent.Options{
-			Client: agentClient,
-			Logger: slogtest.Make(t, nil).Named("agent"),
-		})
-		defer func() {
-			_ = agentCloser.Close()
-		}()
+		_ = agenttest.New(t, client.URL, agentToken)
+		_ = coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
diff --git a/cli/portforward.go b/cli/portforward.go
index 3df1a6f6c9d9f..034b14f894db7 100644
--- a/cli/portforward.go
+++ b/cli/portforward.go
@@ -18,10 +18,10 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
 
-	"github.com/coder/coder/agent/agentssh"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/agent/agentssh"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) portForward() *clibase.Cmd {
diff --git a/cli/portforward_test.go b/cli/portforward_test.go
index 5ae1997285ab7..ef4d36ee05e5a 100644
--- a/cli/portforward_test.go
+++ b/cli/portforward_test.go
@@ -7,28 +7,32 @@ import (
 	"net"
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/google/uuid"
 	"github.com/pion/udp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestPortForward_None(t *testing.T) {
 	t.Parallel()
 
 	client := coderdtest.New(t, nil)
-	_ = coderdtest.CreateFirstUser(t, client)
+	owner := coderdtest.CreateFirstUser(t, client)
+	member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
 	inv, root := clitest.New(t, "port-forward", "blah")
-	clitest.SetupConfig(t, client, root)
+	clitest.SetupConfig(t, member, root)
 	pty := ptytest.New(t).Attach(inv)
 	inv.Stderr = pty.Output()
 
@@ -129,8 +133,9 @@ func TestPortForward(t *testing.T) {
 	// non-parallel setup).
 	var (
 		client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user      = coderdtest.CreateFirstUser(t, client)
-		workspace = runAgent(t, client, user.UserID)
+		admin     = coderdtest.CreateFirstUser(t, client)
+		member, _ = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+		workspace = runAgent(t, client, member)
 	)
 
 	for _, c := range cases {
@@ -148,7 +153,7 @@ func TestPortForward(t *testing.T) {
 			// Launch port-forward in a goroutine so we can start dialing
 			// the "local" listener.
 			inv, root := clitest.New(t, "-v", "port-forward", workspace.Name, flag)
-			clitest.SetupConfig(t, client, root)
+			clitest.SetupConfig(t, member, root)
 			pty := ptytest.New(t)
 			inv.Stdin = pty.Input()
 			inv.Stdout = pty.Output()
@@ -195,7 +200,7 @@ func TestPortForward(t *testing.T) {
 			// Launch port-forward in a goroutine so we can start dialing
 			// the "local" listeners.
 			inv, root := clitest.New(t, "-v", "port-forward", workspace.Name, flag1, flag2)
-			clitest.SetupConfig(t, client, root)
+			clitest.SetupConfig(t, member, root)
 			pty := ptytest.New(t)
 			inv.Stdin = pty.Input()
 			inv.Stdout = pty.Output()
@@ -250,7 +255,7 @@ func TestPortForward(t *testing.T) {
 		// Launch port-forward in a goroutine so we can start dialing
 		// the "local" listeners.
 		inv, root := clitest.New(t, append([]string{"-v", "port-forward", workspace.Name}, flags...)...)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		pty := ptytest.New(t).Attach(inv)
 		inv.Stderr = pty.Output()
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -291,46 +296,33 @@ func TestPortForward(t *testing.T) {
 // runAgent creates a fake workspace and starts an agent locally for that
 // workspace. The agent will be cleaned up on test completion.
 // nolint:unused
-func runAgent(t *testing.T, client *codersdk.Client, userID uuid.UUID) codersdk.Workspace {
+func runAgent(t *testing.T, adminClient, userClient *codersdk.Client) codersdk.Workspace {
 	ctx := context.Background()
-	user, err := client.User(ctx, userID.String())
+	user, err := userClient.User(ctx, codersdk.Me)
 	require.NoError(t, err, "specified user does not exist")
 	require.Greater(t, len(user.OrganizationIDs), 0, "user has no organizations")
 	orgID := user.OrganizationIDs[0]
 
 	// Setup template
 	agentToken := uuid.NewString()
-	version := coderdtest.CreateTemplateVersion(t, client, orgID, &echo.Responses{
+	version := coderdtest.CreateTemplateVersion(t, adminClient, orgID, &echo.Responses{
 		Parse:          echo.ParseComplete,
-		ProvisionPlan:  echo.ProvisionComplete,
+		ProvisionPlan:  echo.PlanComplete,
 		ProvisionApply: echo.ProvisionApplyWithAgent(agentToken),
 	})
 
 	// Create template and workspace
-	template := coderdtest.CreateTemplate(t, client, orgID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-	workspace := coderdtest.CreateWorkspace(t, client, orgID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-
-	// Start workspace agent in a goroutine
-	inv, root := clitest.New(t, "agent", "--agent-token", agentToken, "--agent-url", client.URL.String())
-	clitest.SetupConfig(t, client, root)
-	pty := ptytest.New(t)
-	inv.Stdin = pty.Input()
-	inv.Stdout = pty.Output()
-	inv.Stderr = pty.Output()
-	errC := make(chan error)
-	agentCtx, agentCancel := context.WithCancel(ctx)
-	t.Cleanup(func() {
-		agentCancel()
-		err := <-errC
-		require.NoError(t, err)
-	})
-	go func() {
-		errC <- inv.WithContext(agentCtx).Run()
-	}()
-
-	coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+	template := coderdtest.CreateTemplate(t, adminClient, orgID, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, adminClient, version.ID)
+	workspace := coderdtest.CreateWorkspace(t, userClient, orgID, template.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, adminClient, workspace.LatestBuild.ID)
+
+	_ = agenttest.New(t, adminClient.URL, agentToken,
+		func(o *agent.Options) {
+			o.SSHMaxTimeout = 60 * time.Second
+		},
+	)
+	coderdtest.AwaitWorkspaceAgents(t, adminClient, workspace.ID)
 
 	return workspace
 }
diff --git a/cli/publickey.go b/cli/publickey.go
index 43537eec428a1..f6e145377e407 100644
--- a/cli/publickey.go
+++ b/cli/publickey.go
@@ -5,9 +5,11 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) publickey() *clibase.Cmd {
@@ -44,13 +46,13 @@ func (r *RootCmd) publickey() *clibase.Cmd {
 			}
 
 			cliui.Infof(inv.Stdout,
-				"This is your public key for using "+cliui.DefaultStyles.Field.Render("git")+" in "+
-					"Coder. All clones with SSH will be authenticated automatically 🪄.\n\n",
+				"This is your public key for using "+pretty.Sprint(cliui.DefaultStyles.Field, "git")+" in "+
+					"Coder. All clones with SSH will be authenticated automatically 🪄.",
 			)
-			cliui.Infof(inv.Stdout, cliui.DefaultStyles.Code.Render(strings.TrimSpace(key.PublicKey))+"\n\n")
-			cliui.Infof(inv.Stdout, "Add to GitHub and GitLab:"+"\n")
-			cliui.Infof(inv.Stdout, cliui.DefaultStyles.Prompt.String()+"https://github.com/settings/ssh/new"+"\n")
-			cliui.Infof(inv.Stdout, cliui.DefaultStyles.Prompt.String()+"https://gitlab.com/-/profile/keys"+"\n")
+			cliui.Infof(inv.Stdout, pretty.Sprint(cliui.DefaultStyles.Code, strings.TrimSpace(key.PublicKey))+"\n")
+			cliui.Infof(inv.Stdout, "Add to GitHub and GitLab:")
+			cliui.Infof(inv.Stdout, "> https://github.com/settings/ssh/new")
+			cliui.Infof(inv.Stdout, "> https://gitlab.com/-/profile/keys")
 
 			return nil
 		},
diff --git a/cli/publickey_test.go b/cli/publickey_test.go
index a5664ec2bda07..8d04a9b66af53 100644
--- a/cli/publickey_test.go
+++ b/cli/publickey_test.go
@@ -6,8 +6,8 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
 )
 
 func TestPublicKey(t *testing.T) {
diff --git a/cli/remoteforward.go b/cli/remoteforward.go
index 9e53669a7ee47..2c4207583b289 100644
--- a/cli/remoteforward.go
+++ b/cli/remoteforward.go
@@ -5,13 +5,14 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"os"
 	"regexp"
 	"strconv"
 
 	gossh "golang.org/x/crypto/ssh"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/agent/agentssh"
+	"github.com/coder/coder/v2/agent/agentssh"
 )
 
 // cookieAddr is a special net.Addr accepted by sshRemoteForward() which includes a
@@ -23,15 +24,24 @@ type cookieAddr struct {
 
 // Format:
 // remote_port:local_address:local_port
-var remoteForwardRegex = regexp.MustCompile(`^(\d+):(.+):(\d+)$`)
+var remoteForwardRegexTCP = regexp.MustCompile(`^(\d+):(.+):(\d+)$`)
 
-func validateRemoteForward(flag string) bool {
-	return remoteForwardRegex.MatchString(flag)
+// remote_socket_path:local_socket_path (both absolute paths)
+var remoteForwardRegexUnixSocket = regexp.MustCompile(`^(\/.+):(\/.+)$`)
+
+func isRemoteForwardTCP(flag string) bool {
+	return remoteForwardRegexTCP.MatchString(flag)
 }
 
-func parseRemoteForward(flag string) (net.Addr, net.Addr, error) {
-	matches := remoteForwardRegex.FindStringSubmatch(flag)
+func isRemoteForwardUnixSocket(flag string) bool {
+	return remoteForwardRegexUnixSocket.MatchString(flag)
+}
+
+func validateRemoteForward(flag string) bool {
+	return isRemoteForwardTCP(flag) || isRemoteForwardUnixSocket(flag)
+}
 
+func parseRemoteForwardTCP(matches []string) (net.Addr, net.Addr, error) {
 	remotePort, err := strconv.Atoi(matches[1])
 	if err != nil {
 		return nil, nil, xerrors.Errorf("remote port is invalid: %w", err)
@@ -57,6 +67,46 @@ func parseRemoteForward(flag string) (net.Addr, net.Addr, error) {
 	return localAddr, remoteAddr, nil
 }
 
+func parseRemoteForwardUnixSocket(matches []string) (net.Addr, net.Addr, error) {
+	remoteSocket := matches[1]
+	localSocket := matches[2]
+
+	fileInfo, err := os.Stat(localSocket)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	if fileInfo.Mode()&os.ModeSocket == 0 {
+		return nil, nil, xerrors.New("File is not a Unix domain socket file")
+	}
+
+	remoteAddr := &net.UnixAddr{
+		Name: remoteSocket,
+		Net:  "unix",
+	}
+
+	localAddr := &net.UnixAddr{
+		Name: localSocket,
+		Net:  "unix",
+	}
+	return localAddr, remoteAddr, nil
+}
+
+func parseRemoteForward(flag string) (net.Addr, net.Addr, error) {
+	tcpMatches := remoteForwardRegexTCP.FindStringSubmatch(flag)
+
+	if len(tcpMatches) > 0 {
+		return parseRemoteForwardTCP(tcpMatches)
+	}
+
+	unixSocketMatches := remoteForwardRegexUnixSocket.FindStringSubmatch(flag)
+	if len(unixSocketMatches) > 0 {
+		return parseRemoteForwardUnixSocket(unixSocketMatches)
+	}
+
+	return nil, nil, xerrors.New("Could not match forward arguments")
+}
+
 // sshRemoteForward starts forwarding connections from a remote listener to a
 // local address via SSH in a goroutine.
 //
diff --git a/cli/rename.go b/cli/rename.go
index d9e2af5316603..24a201ab7d3d0 100644
--- a/cli/rename.go
+++ b/cli/rename.go
@@ -5,9 +5,11 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) rename() *clibase.Cmd {
@@ -27,7 +29,7 @@ func (r *RootCmd) rename() *clibase.Cmd {
 			}
 
 			_, _ = fmt.Fprintf(inv.Stdout, "%s\n\n",
-				cliui.DefaultStyles.Wrap.Render("WARNING: A rename can result in data loss if a resource references the workspace name in the template (e.g volumes). Please backup any data before proceeding."),
+				pretty.Sprint(cliui.DefaultStyles.Wrap, "WARNING: A rename can result in data loss if a resource references the workspace name in the template (e.g volumes). Please backup any data before proceeding."),
 			)
 			_, _ = fmt.Fprintf(inv.Stdout, "See: %s\n\n", "https://coder.com/docs/coder-oss/latest/templates/resource-persistence#%EF%B8%8F-persistence-pitfalls")
 			_, err = cliui.Prompt(inv, cliui.PromptOptions{
diff --git a/cli/rename_test.go b/cli/rename_test.go
index 6cd92ff9e1451..5a08d29c5a7c4 100644
--- a/cli/rename_test.go
+++ b/cli/rename_test.go
@@ -6,22 +6,23 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestRename(t *testing.T) {
 	t.Parallel()
 
 	client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-	user := coderdtest.CreateFirstUser(t, client)
-	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	owner := coderdtest.CreateFirstUser(t, client)
+	member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+	version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+	template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+	workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
@@ -30,7 +31,7 @@ func TestRename(t *testing.T) {
 	// E.g. "compassionate-chandrasekhar82" + "t".
 	want := workspace.Name + "t"
 	inv, root := clitest.New(t, "rename", workspace.Name, want, "--yes")
-	clitest.SetupConfig(t, client, root)
+	clitest.SetupConfig(t, member, root)
 	pty := ptytest.New(t)
 	pty.Attach(inv)
 	clitest.Start(t, inv)
diff --git a/cli/resetpassword.go b/cli/resetpassword.go
index 02a98993368cc..887aa9575a45e 100644
--- a/cli/resetpassword.go
+++ b/cli/resetpassword.go
@@ -1,3 +1,5 @@
+//go:build !slim
+
 package cli
 
 import (
@@ -6,11 +8,13 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/migrations"
-	"github.com/coder/coder/coderd/userpassword"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/migrations"
+	"github.com/coder/coder/v2/coderd/userpassword"
 )
 
 func (*RootCmd) resetPassword() *clibase.Cmd {
@@ -47,7 +51,7 @@ func (*RootCmd) resetPassword() *clibase.Cmd {
 			}
 
 			password, err := cliui.Prompt(inv, cliui.PromptOptions{
-				Text:   "Enter new " + cliui.DefaultStyles.Field.Render("password") + ":",
+				Text:   "Enter new " + pretty.Sprint(cliui.DefaultStyles.Field, "password") + ":",
 				Secret: true,
 				Validate: func(s string) error {
 					return userpassword.Validate(s)
@@ -57,7 +61,7 @@ func (*RootCmd) resetPassword() *clibase.Cmd {
 				return xerrors.Errorf("password prompt: %w", err)
 			}
 			confirmedPassword, err := cliui.Prompt(inv, cliui.PromptOptions{
-				Text:     "Confirm " + cliui.DefaultStyles.Field.Render("password") + ":",
+				Text:     "Confirm " + pretty.Sprint(cliui.DefaultStyles.Field, "password") + ":",
 				Secret:   true,
 				Validate: cliui.ValidateNotEmpty,
 			})
@@ -81,7 +85,7 @@ func (*RootCmd) resetPassword() *clibase.Cmd {
 				return xerrors.Errorf("updating password: %w", err)
 			}
 
-			_, _ = fmt.Fprintf(inv.Stdout, "\nPassword has been reset for user %s!\n", cliui.DefaultStyles.Keyword.Render(user.Username))
+			_, _ = fmt.Fprintf(inv.Stdout, "\nPassword has been reset for user %s!\n", pretty.Sprint(cliui.DefaultStyles.Keyword, user.Username))
 			return nil
 		},
 	}
diff --git a/cli/resetpassword_slim.go b/cli/resetpassword_slim.go
new file mode 100644
index 0000000000000..1b69b8d8b65a5
--- /dev/null
+++ b/cli/resetpassword_slim.go
@@ -0,0 +1,23 @@
+//go:build slim
+
+package cli
+
+import (
+	"github.com/coder/coder/v2/cli/clibase"
+)
+
+func (*RootCmd) resetPassword() *clibase.Cmd {
+	root := &clibase.Cmd{
+		Use:   "reset-password <username>",
+		Short: "Directly connect to the database to reset a user's password",
+		// We accept RawArgs so all commands and flags are accepted.
+		RawArgs: true,
+		Hidden:  true,
+		Handler: func(inv *clibase.Invocation) error {
+			SlimUnsupported(inv.Stderr, "reset-password")
+			return nil
+		},
+	}
+
+	return root
+}
diff --git a/cli/resetpassword_test.go b/cli/resetpassword_test.go
index 40cfc1042dcdc..3ae1c4acb8acb 100644
--- a/cli/resetpassword_test.go
+++ b/cli/resetpassword_test.go
@@ -9,11 +9,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/database/postgres"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/database/postgres"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // nolint:paralleltest
diff --git a/cli/restart.go b/cli/restart.go
index 4cff7ac7571d7..e5182ff481d1c 100644
--- a/cli/restart.go
+++ b/cli/restart.go
@@ -2,11 +2,15 @@ package cli
 
 import (
 	"fmt"
+	"net/http"
 	"time"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/pretty"
 )
 
 func (r *RootCmd) restart() *clibase.Cmd {
@@ -21,7 +25,7 @@ func (r *RootCmd) restart() *clibase.Cmd {
 			clibase.RequireNArgs(1),
 			r.InitClient(client),
 		),
-		Options: append(parameterFlags.options(), cliui.SkipPromptOption()),
+		Options: append(parameterFlags.cliBuildOptions(), cliui.SkipPromptOption()),
 		Handler: func(inv *clibase.Invocation) error {
 			ctx := inv.Context()
 			out := inv.Stdout
@@ -31,14 +35,24 @@ func (r *RootCmd) restart() *clibase.Cmd {
 				return err
 			}
 
-			template, err := client.Template(inv.Context(), workspace.TemplateID)
+			lastBuildParameters, err := client.WorkspaceBuildParameters(inv.Context(), workspace.LatestBuild.ID)
 			if err != nil {
 				return err
 			}
 
-			buildParams, err := prepStartWorkspace(inv, client, prepStartWorkspaceArgs{
-				Template:     template,
-				BuildOptions: parameterFlags.buildOptions,
+			buildOptions, err := asWorkspaceBuildParameters(parameterFlags.buildOptions)
+			if err != nil {
+				return xerrors.Errorf("can't parse build options: %w", err)
+			}
+
+			buildParameters, err := prepStartWorkspace(inv, client, prepStartWorkspaceArgs{
+				Action:            WorkspaceRestart,
+				TemplateVersionID: workspace.LatestBuild.TemplateVersionID,
+
+				LastBuildParameters: lastBuildParameters,
+
+				PromptBuildOptions: parameterFlags.promptBuildOptions,
+				BuildOptions:       buildOptions,
 			})
 			if err != nil {
 				return err
@@ -63,19 +77,38 @@ func (r *RootCmd) restart() *clibase.Cmd {
 				return err
 			}
 
-			build, err = client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+			req := codersdk.CreateWorkspaceBuildRequest{
 				Transition:          codersdk.WorkspaceTransitionStart,
-				RichParameterValues: buildParams.richParameters,
-			})
-			if err != nil {
+				RichParameterValues: buildParameters,
+				TemplateVersionID:   workspace.LatestBuild.TemplateVersionID,
+			}
+
+			build, err = client.CreateWorkspaceBuild(ctx, workspace.ID, req)
+			// It's possible for a workspace build to fail due to the template requiring starting
+			// workspaces with the active version.
+			if cerr, ok := codersdk.AsError(err); ok && cerr.StatusCode() == http.StatusUnauthorized {
+				build, err = startWorkspaceActiveVersion(inv, client, startWorkspaceActiveVersionArgs{
+					BuildOptions:        buildOptions,
+					LastBuildParameters: lastBuildParameters,
+					PromptBuildOptions:  parameterFlags.promptBuildOptions,
+					Workspace:           workspace,
+				})
+				if err != nil {
+					return xerrors.Errorf("start workspace with active template version: %w", err)
+				}
+			} else if err != nil {
 				return err
 			}
+
 			err = cliui.WorkspaceBuild(ctx, out, client, build.ID)
 			if err != nil {
 				return err
 			}
 
-			_, _ = fmt.Fprintf(out, "\nThe %s workspace has been restarted at %s!\n", cliui.DefaultStyles.Keyword.Render(workspace.Name), cliui.DefaultStyles.DateTimeStamp.Render(time.Now().Format(time.Stamp)))
+			_, _ = fmt.Fprintf(out,
+				"\nThe %s workspace has been restarted at %s!\n",
+				pretty.Sprint(cliui.DefaultStyles.Keyword, workspace.Name), cliui.Timestamp(time.Now()),
+			)
 			return nil
 		},
 	}
diff --git a/cli/restart_test.go b/cli/restart_test.go
index 83b066e4defc5..cdf22c9b982c2 100644
--- a/cli/restart_test.go
+++ b/cli/restart_test.go
@@ -2,63 +2,49 @@ package cli_test
 
 import (
 	"context"
+	"fmt"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestRestart(t *testing.T) {
 	t.Parallel()
 
-	echoResponses := &echo.Responses{
-		Parse: echo.ParseComplete,
-		ProvisionPlan: []*proto.Provision_Response{
-			{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Parameters: []*proto.RichParameter{
-							{
-								Name:        ephemeralParameterName,
-								Description: ephemeralParameterDescription,
-								Mutable:     true,
-								Ephemeral:   true,
-							},
-						},
-					},
-				},
-			},
+	echoResponses := prepareEchoResponses([]*proto.RichParameter{
+		{
+			Name:        ephemeralParameterName,
+			Description: ephemeralParameterDescription,
+			Mutable:     true,
+			Ephemeral:   true,
 		},
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{},
-			},
-		}},
-	}
+	})
 
 	t.Run("OK", func(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx := testutil.Context(t, testutil.WaitLong)
 
 		inv, root := clitest.New(t, "restart", workspace.Name, "--yes")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 
 		pty := ptytest.New(t).Attach(inv)
 
@@ -78,15 +64,16 @@ func TestRestart(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, echoResponses)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, memberUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		inv, root := clitest.New(t, "restart", workspace.Name, "--build-options")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -117,7 +104,61 @@ func TestRestart(t *testing.T) {
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
 		defer cancel()
 
-		workspace, err := client.WorkspaceByOwnerAndName(ctx, user.UserID.String(), workspace.Name, codersdk.WorkspaceOptions{})
+		workspace, err := client.WorkspaceByOwnerAndName(ctx, memberUser.ID.String(), workspace.Name, codersdk.WorkspaceOptions{})
+		require.NoError(t, err)
+		actualParameters, err := client.WorkspaceBuildParameters(ctx, workspace.LatestBuild.ID)
+		require.NoError(t, err)
+		require.Contains(t, actualParameters, codersdk.WorkspaceBuildParameter{
+			Name:  ephemeralParameterName,
+			Value: ephemeralParameterValue,
+		})
+	})
+
+	t.Run("BuildOptionFlags", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, memberUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		inv, root := clitest.New(t, "restart", workspace.Name,
+			"--build-option", fmt.Sprintf("%s=%s", ephemeralParameterName, ephemeralParameterValue))
+		clitest.SetupConfig(t, member, root)
+		doneChan := make(chan struct{})
+		pty := ptytest.New(t).Attach(inv)
+		go func() {
+			defer close(doneChan)
+			err := inv.Run()
+			assert.NoError(t, err)
+		}()
+
+		matches := []string{
+			"Confirm restart workspace?", "yes",
+			"Stopping workspace", "",
+			"Starting workspace", "",
+			"workspace has been restarted", "",
+		}
+		for i := 0; i < len(matches); i += 2 {
+			match := matches[i]
+			value := matches[i+1]
+			pty.ExpectMatch(match)
+
+			if value != "" {
+				pty.WriteLine(value)
+			}
+		}
+		<-doneChan
+
+		// Verify if build option is set
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+
+		workspace, err := client.WorkspaceByOwnerAndName(ctx, memberUser.ID.String(), workspace.Name, codersdk.WorkspaceOptions{})
 		require.NoError(t, err)
 		actualParameters, err := client.WorkspaceBuildParameters(ctx, workspace.LatestBuild.ID)
 		require.NoError(t, err)
@@ -127,3 +168,75 @@ func TestRestart(t *testing.T) {
 		})
 	})
 }
+
+func TestRestartWithParameters(t *testing.T) {
+	t.Parallel()
+
+	echoResponses := &echo.Responses{
+		Parse: echo.ParseComplete,
+		ProvisionPlan: []*proto.Response{
+			{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
+						Parameters: []*proto.RichParameter{
+							{
+								Name:        immutableParameterName,
+								Description: immutableParameterDescription,
+								Required:    true,
+							},
+						},
+					},
+				},
+			},
+		},
+		ProvisionApply: echo.ApplyComplete,
+	}
+
+	t.Run("DoNotAskForImmutables", func(t *testing.T) {
+		t.Parallel()
+
+		// Create the workspace
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
+			cwr.RichParameterValues = []codersdk.WorkspaceBuildParameter{
+				{
+					Name:  immutableParameterName,
+					Value: immutableParameterValue,
+				},
+			}
+		})
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		// Restart the workspace again
+		inv, root := clitest.New(t, "restart", workspace.Name, "-y")
+		clitest.SetupConfig(t, member, root)
+		doneChan := make(chan struct{})
+		pty := ptytest.New(t).Attach(inv)
+		go func() {
+			defer close(doneChan)
+			err := inv.Run()
+			assert.NoError(t, err)
+		}()
+
+		pty.ExpectMatch("workspace has been restarted")
+		<-doneChan
+
+		// Verify if immutable parameter is set
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+
+		workspace, err := client.WorkspaceByOwnerAndName(ctx, workspace.OwnerName, workspace.Name, codersdk.WorkspaceOptions{})
+		require.NoError(t, err)
+		actualParameters, err := client.WorkspaceBuildParameters(ctx, workspace.LatestBuild.ID)
+		require.NoError(t, err)
+		require.Contains(t, actualParameters, codersdk.WorkspaceBuildParameter{
+			Name:  immutableParameterName,
+			Value: immutableParameterValue,
+		})
+	})
+}
diff --git a/cli/root.go b/cli/root.go
index 4c268235a0f96..b4d416295cd62 100644
--- a/cli/root.go
+++ b/cli/root.go
@@ -1,11 +1,12 @@
 package cli
 
 import (
+	"bufio"
+	"bytes"
 	"context"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
-	"flag"
 	"fmt"
 	"io"
 	"math/rand"
@@ -13,6 +14,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"os/exec"
 	"os/signal"
 	"path/filepath"
 	"runtime"
@@ -21,26 +23,26 @@ import (
 	"text/tabwriter"
 	"time"
 
-	"github.com/charmbracelet/lipgloss"
 	"github.com/mattn/go-isatty"
 	"github.com/mitchellh/go-wordwrap"
 	"golang.org/x/exp/slices"
 	"golang.org/x/xerrors"
 
+	"github.com/coder/pretty"
+
 	"cdr.dev/slog"
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/cli/config"
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/cli/config"
+	"github.com/coder/coder/v2/cli/gitauth"
+	"github.com/coder/coder/v2/cli/telemetry"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
 )
 
 var (
-	Caret = cliui.DefaultStyles.Prompt.String()
+	Caret = pretty.Sprint(cliui.DefaultStyles.Prompt, "")
 
 	// Applied as annotations to workspace commands
 	// so they display in a separated "help" section.
@@ -53,8 +55,10 @@ const (
 	varURL              = "url"
 	varToken            = "token"
 	varAgentToken       = "agent-token"
+	varAgentTokenFile   = "agent-token-file"
 	varAgentURL         = "agent-url"
 	varHeader           = "header"
+	varHeaderCommand    = "header-command"
 	varNoOpen           = "no-open"
 	varNoVersionCheck   = "no-version-warning"
 	varNoFeatureWarning = "no-feature-warning"
@@ -68,7 +72,9 @@ const (
 	envSessionToken     = "CODER_SESSION_TOKEN"
 	//nolint:gosec
 	envAgentToken = "CODER_AGENT_TOKEN"
-	envURL        = "CODER_URL"
+	//nolint:gosec
+	envAgentTokenFile = "CODER_AGENT_TOKEN_FILE"
+	envURL            = "CODER_URL"
 )
 
 var errUnauthenticated = xerrors.New(notLoggedInMessage)
@@ -77,6 +83,7 @@ func (r *RootCmd) Core() []*clibase.Cmd {
 	// Please re-sort this list alphabetically if you change it!
 	return []*clibase.Cmd{
 		r.dotfiles(),
+		r.externalAuth(),
 		r.login(),
 		r.logout(),
 		r.netcheck(),
@@ -115,10 +122,7 @@ func (r *RootCmd) Core() []*clibase.Cmd {
 }
 
 func (r *RootCmd) AGPL() []*clibase.Cmd {
-	all := append(r.Core(), r.Server(func(_ context.Context, o *coderd.Options) (*coderd.API, io.Closer, error) {
-		api := coderd.New(o)
-		return api, api, nil
-	}))
+	all := append(r.Core(), r.Server( /* Do not import coderd here. */ nil))
 	return all
 }
 
@@ -130,14 +134,13 @@ func (r *RootCmd) RunMain(subcommands []*clibase.Cmd) {
 	if err != nil {
 		panic(err)
 	}
-
 	err = cmd.Invoke().WithOS().Run()
 	if err != nil {
 		if errors.Is(err, cliui.Canceled) {
 			//nolint:revive
 			os.Exit(1)
 		}
-		f := prettyErrorFormatter{w: os.Stderr}
+		f := prettyErrorFormatter{w: os.Stderr, verbose: r.verbose}
 		f.format(err)
 		//nolint:revive
 		os.Exit(1)
@@ -160,7 +163,9 @@ func (r *RootCmd) Command(subcommands []*clibase.Cmd) (*clibase.Cmd, error) {
 			},
 		),
 		Handler: func(i *clibase.Invocation) error {
-			// fmt.Fprintf(i.Stderr, "env debug: %+v", i.Environ)
+			if r.versionFlag {
+				return r.version(defaultVersionInfo).Handler(i)
+			}
 			// The GIT_ASKPASS environment variable must point at
 			// a binary with no arguments. To prevent writing
 			// cross-platform scripts to invoke the Coder binary
@@ -327,6 +332,14 @@ func (r *RootCmd) Command(subcommands []*clibase.Cmd) (*clibase.Cmd, error) {
 			Hidden:      true,
 			Group:       globalGroup,
 		},
+		{
+			Flag:        varAgentTokenFile,
+			Env:         envAgentTokenFile,
+			Description: "A file containing an agent authentication token.",
+			Value:       clibase.StringOf(&r.agentTokenFile),
+			Hidden:      true,
+			Group:       globalGroup,
+		},
 		{
 			Flag:        varAgentURL,
 			Env:         "CODER_AGENT_URL",
@@ -356,6 +369,13 @@ func (r *RootCmd) Command(subcommands []*clibase.Cmd) (*clibase.Cmd, error) {
 			Value:       clibase.StringArrayOf(&r.header),
 			Group:       globalGroup,
 		},
+		{
+			Flag:        varHeaderCommand,
+			Env:         "CODER_HEADER_COMMAND",
+			Description: "An external command that outputs additional HTTP headers added to all requests. The command must output each header as `key=value` on its own line.",
+			Value:       clibase.StringOf(&r.headerCommand),
+			Group:       globalGroup,
+		},
 		{
 			Flag:        varNoOpen,
 			Env:         "CODER_NO_OPEN",
@@ -402,6 +422,15 @@ func (r *RootCmd) Command(subcommands []*clibase.Cmd) (*clibase.Cmd, error) {
 			Value:       clibase.StringOf(&r.globalConfig),
 			Group:       globalGroup,
 		},
+		{
+			Flag: "version",
+			// This was requested by a customer to assist with their migration.
+			// They have two Coder CLIs, and want to tell the difference by running
+			// the same base command.
+			Description: "Run the version command. Useful for v1 customers migrating to v2.",
+			Value:       clibase.BoolOf(&r.versionFlag),
+			Hidden:      true,
+		},
 	}
 
 	err := cmd.PrepareAll()
@@ -427,23 +456,22 @@ func LoggerFromContext(ctx context.Context) (slog.Logger, bool) {
 	return l, ok
 }
 
-func isTest() bool {
-	return flag.Lookup("test.v") != nil
-}
-
 // RootCmd contains parameters and helpers useful to all commands.
 type RootCmd struct {
-	clientURL     *url.URL
-	token         string
-	globalConfig  string
-	header        []string
-	agentToken    string
-	agentURL      *url.URL
-	forceTTY      bool
-	noOpen        bool
-	verbose       bool
-	disableDirect bool
-	debugHTTP     bool
+	clientURL      *url.URL
+	token          string
+	globalConfig   string
+	header         []string
+	headerCommand  string
+	agentToken     string
+	agentTokenFile string
+	agentURL       *url.URL
+	forceTTY       bool
+	noOpen         bool
+	verbose        bool
+	versionFlag    bool
+	disableDirect  bool
+	debugHTTP      bool
 
 	noVersionCheck   bool
 	noFeatureWarning bool
@@ -459,17 +487,17 @@ func addTelemetryHeader(client *codersdk.Client, inv *clibase.Invocation) {
 		client.HTTPClient.Transport = transport
 	}
 
-	var topts []telemetry.CLIOption
+	var topts []telemetry.Option
 	for _, opt := range inv.Command.FullOptions() {
 		if opt.ValueSource == clibase.ValueSourceNone || opt.ValueSource == clibase.ValueSourceDefault {
 			continue
 		}
-		topts = append(topts, telemetry.CLIOption{
+		topts = append(topts, telemetry.Option{
 			Name:        opt.Name,
 			ValueSource: string(opt.ValueSource),
 		})
 	}
-	ti := telemetry.CLIInvocation{
+	ti := telemetry.Invocation{
 		Command:   inv.Command.FullName(),
 		Options:   topts,
 		InvokedAt: time.Now(),
@@ -494,6 +522,15 @@ func addTelemetryHeader(client *codersdk.Client, inv *clibase.Invocation) {
 // InitClient sets client to a new client.
 // It reads from global configuration files if flags are not set.
 func (r *RootCmd) InitClient(client *codersdk.Client) clibase.MiddlewareFunc {
+	return r.initClientInternal(client, false)
+}
+
+func (r *RootCmd) InitClientMissingTokenOK(client *codersdk.Client) clibase.MiddlewareFunc {
+	return r.initClientInternal(client, true)
+}
+
+// nolint: revive
+func (r *RootCmd) initClientInternal(client *codersdk.Client, allowTokenMissing bool) clibase.MiddlewareFunc {
 	if client == nil {
 		panic("client is nil")
 	}
@@ -508,7 +545,7 @@ func (r *RootCmd) InitClient(client *codersdk.Client) clibase.MiddlewareFunc {
 				rawURL, err := conf.URL().Read()
 				// If the configuration files are absent, the user is logged out
 				if os.IsNotExist(err) {
-					return (errUnauthenticated)
+					return errUnauthenticated
 				}
 				if err != nil {
 					return err
@@ -524,15 +561,14 @@ func (r *RootCmd) InitClient(client *codersdk.Client) clibase.MiddlewareFunc {
 				r.token, err = conf.Session().Read()
 				// If the configuration files are absent, the user is logged out
 				if os.IsNotExist(err) {
-					return (errUnauthenticated)
-				}
-				if err != nil {
+					if !allowTokenMissing {
+						return errUnauthenticated
+					}
+				} else if err != nil {
 					return err
 				}
 			}
-			err = r.setClient(
-				client, r.clientURL,
-			)
+			err = r.setClient(inv.Context(), client, r.clientURL)
 			if err != nil {
 				return err
 			}
@@ -565,15 +601,13 @@ func (r *RootCmd) InitClient(client *codersdk.Client) clibase.MiddlewareFunc {
 			if err = <-versionErr; err != nil {
 				// Just log the error here. We never want to fail a command
 				// due to a pre-run.
-				_, _ = fmt.Fprintf(inv.Stderr,
-					cliui.DefaultStyles.Warn.Render("check versions error: %s"), err)
+				pretty.Fprintf(inv.Stderr, cliui.DefaultStyles.Warn, "check versions error: %s", err)
 				_, _ = fmt.Fprintln(inv.Stderr)
 			}
 
 			if err = <-warningErr; err != nil {
 				// Same as above
-				_, _ = fmt.Fprintf(inv.Stderr,
-					cliui.DefaultStyles.Warn.Render("check entitlement warnings error: %s"), err)
+				pretty.Fprintf(inv.Stderr, cliui.DefaultStyles.Warn, "check entitlement warnings error: %s", err)
 				_, _ = fmt.Fprintln(inv.Stderr)
 			}
 
@@ -582,12 +616,38 @@ func (r *RootCmd) InitClient(client *codersdk.Client) clibase.MiddlewareFunc {
 	}
 }
 
-func (r *RootCmd) setClient(client *codersdk.Client, serverURL *url.URL) error {
+func (r *RootCmd) setClient(ctx context.Context, client *codersdk.Client, serverURL *url.URL) error {
 	transport := &headerTransport{
 		transport: http.DefaultTransport,
 		header:    http.Header{},
 	}
-	for _, header := range r.header {
+	headers := r.header
+	if r.headerCommand != "" {
+		shell := "sh"
+		caller := "-c"
+		if runtime.GOOS == "windows" {
+			shell = "cmd.exe"
+			caller = "/c"
+		}
+		var outBuf bytes.Buffer
+		// #nosec
+		cmd := exec.CommandContext(ctx, shell, caller, r.headerCommand)
+		cmd.Env = append(os.Environ(), "CODER_URL="+serverURL.String())
+		cmd.Stdout = &outBuf
+		cmd.Stderr = io.Discard
+		err := cmd.Run()
+		if err != nil {
+			return xerrors.Errorf("failed to run %v: %w", cmd.Args, err)
+		}
+		scanner := bufio.NewScanner(&outBuf)
+		for scanner.Scan() {
+			headers = append(headers, scanner.Text())
+		}
+		if err := scanner.Err(); err != nil {
+			return xerrors.Errorf("scan %v: %w", cmd.Args, err)
+		}
+	}
+	for _, header := range headers {
 		parts := strings.SplitN(header, "=", 2)
 		if len(parts) < 2 {
 			return xerrors.Errorf("split header %q had less than two parts", header)
@@ -601,9 +661,9 @@ func (r *RootCmd) setClient(client *codersdk.Client, serverURL *url.URL) error {
 	return nil
 }
 
-func (r *RootCmd) createUnauthenticatedClient(serverURL *url.URL) (*codersdk.Client, error) {
+func (r *RootCmd) createUnauthenticatedClient(ctx context.Context, serverURL *url.URL) (*codersdk.Client, error) {
 	var client codersdk.Client
-	err := r.setClient(&client, serverURL)
+	err := r.setClient(ctx, &client, serverURL)
 	return &client, err
 }
 
@@ -711,18 +771,18 @@ type example struct {
 func formatExamples(examples ...example) string {
 	var sb strings.Builder
 
-	padStyle := cliui.DefaultStyles.Wrap.Copy().PaddingLeft(4)
+	padStyle := cliui.DefaultStyles.Wrap.With(pretty.XPad(4, 0))
 	for i, e := range examples {
 		if len(e.Description) > 0 {
 			wordwrap.WrapString(e.Description, 80)
 			_, _ = sb.WriteString(
-				"  - " + padStyle.Render(e.Description + ":")[4:] + "\n\n    ",
+				"  - " + pretty.Sprint(padStyle, e.Description+":")[4:] + "\n\n    ",
 			)
 		}
 		// We add 1 space here because `cliui.DefaultStyles.Code` adds an extra
 		// space. This makes the code block align at an even 2 or 6
 		// spaces for symmetry.
-		_, _ = sb.WriteString(" " + cliui.DefaultStyles.Code.Render(fmt.Sprintf("$ %s", e.Command)))
+		_, _ = sb.WriteString(" " + pretty.Sprint(cliui.DefaultStyles.Code, fmt.Sprintf("$ %s", e.Command)))
 		if i < len(examples)-1 {
 			_, _ = sb.WriteString("\n\n")
 		}
@@ -760,8 +820,8 @@ func (r *RootCmd) checkVersions(i *clibase.Invocation, client *codersdk.Client)
 	}
 
 	if !buildinfo.VersionsMatch(clientVersion, info.Version) {
-		warn := cliui.DefaultStyles.Warn.Copy().Align(lipgloss.Left)
-		_, _ = fmt.Fprintf(i.Stderr, warn.Render(fmtWarningText), clientVersion, info.Version, strings.TrimPrefix(info.CanonicalVersion(), "v"))
+		warn := cliui.DefaultStyles.Warn
+		_, _ = fmt.Fprintf(i.Stderr, pretty.Sprint(warn, fmtWarningText), clientVersion, info.Version, strings.TrimPrefix(info.CanonicalVersion(), "v"))
 		_, _ = fmt.Fprintln(i.Stderr)
 	}
 
@@ -776,15 +836,30 @@ func (r *RootCmd) checkWarnings(i *clibase.Invocation, client *codersdk.Client)
 	ctx, cancel := context.WithTimeout(i.Context(), 10*time.Second)
 	defer cancel()
 
+	user, err := client.User(ctx, codersdk.Me)
+	if err != nil {
+		return xerrors.Errorf("get user me: %w", err)
+	}
+
 	entitlements, err := client.Entitlements(ctx)
 	if err == nil {
-		for _, w := range entitlements.Warnings {
-			_, _ = fmt.Fprintln(i.Stderr, cliui.DefaultStyles.Warn.Render(w))
+		// Don't show warning to regular users.
+		if len(user.Roles) > 0 {
+			for _, w := range entitlements.Warnings {
+				_, _ = fmt.Fprintln(i.Stderr, pretty.Sprint(cliui.DefaultStyles.Warn, w))
+			}
 		}
 	}
 	return nil
 }
 
+// Verbosef logs a message if verbose mode is enabled.
+func (r *RootCmd) Verbosef(inv *clibase.Invocation, fmtStr string, args ...interface{}) {
+	if r.verbose {
+		cliui.Infof(inv.Stdout, fmtStr, args...)
+	}
+}
+
 type headerTransport struct {
 	transport http.RoundTripper
 	header    http.Header
@@ -908,63 +983,157 @@ func isConnectionError(err error) bool {
 
 type prettyErrorFormatter struct {
 	w io.Writer
+	// verbose turns on more detailed error logs, such as stack traces.
+	verbose bool
 }
 
+// format formats the error to the console. This error should be human
+// readable.
 func (p *prettyErrorFormatter) format(err error) {
-	errTail := errors.Unwrap(err)
+	output := cliHumanFormatError(err, &formatOpts{
+		Verbose: p.verbose,
+	})
+	// always trail with a newline
+	_, _ = p.w.Write([]byte(output + "\n"))
+}
 
-	//nolint:errorlint
-	if _, ok := err.(*clibase.RunCommandError); ok && errTail != nil {
-		// Avoid extra nesting.
-		p.format(errTail)
-		return
+type formatOpts struct {
+	Verbose bool
+}
+
+const indent = "    "
+
+// cliHumanFormatError formats an error for the CLI. Newlines and styling are
+// included.
+func cliHumanFormatError(err error, opts *formatOpts) string {
+	if opts == nil {
+		opts = &formatOpts{}
 	}
 
-	var headErr string
-	if errTail != nil {
-		headErr = strings.TrimSuffix(err.Error(), ": "+errTail.Error())
-	} else {
-		headErr = err.Error()
+	//nolint:errorlint
+	if multi, ok := err.(interface{ Unwrap() []error }); ok {
+		multiErrors := multi.Unwrap()
+		if len(multiErrors) == 1 {
+			// Format as a single error
+			return cliHumanFormatError(multiErrors[0], opts)
+		}
+		return formatMultiError(multiErrors, opts)
 	}
 
-	var msg string
+	// First check for sentinel errors that we want to handle specially.
+	// Order does matter! We want to check for the most specific errors first.
 	var sdkError *codersdk.Error
 	if errors.As(err, &sdkError) {
-		// We don't want to repeat the same error message twice, so we
-		// only show the SDK error on the top of the stack.
-		msg = sdkError.Message
-		if sdkError.Helper != "" {
-			msg = msg + "\n" + sdkError.Helper
+		return formatCoderSDKError(sdkError, opts)
+	}
+
+	var cmdErr *clibase.RunCommandError
+	if errors.As(err, &cmdErr) {
+		return formatRunCommandError(cmdErr, opts)
+	}
+
+	// Default just printing the error. Use +v for verbose to handle stack
+	// traces of xerrors.
+	if opts.Verbose {
+		return pretty.Sprint(headLineStyle(), fmt.Sprintf("%+v", err))
+	}
+
+	return pretty.Sprint(headLineStyle(), fmt.Sprintf("%v", err))
+}
+
+// formatMultiError formats a multi-error. It formats it as a list of errors.
+//
+//	Multiple Errors:
+//	<# errors encountered>:
+//		1. <heading error message>
+//		   <verbose error message>
+//		2. <heading error message>
+//		   <verbose error message>
+func formatMultiError(multi []error, opts *formatOpts) string {
+	var errorStrings []string
+	for _, err := range multi {
+		errorStrings = append(errorStrings, cliHumanFormatError(err, opts))
+	}
+
+	// Write errors out
+	var str strings.Builder
+	_, _ = str.WriteString(pretty.Sprint(headLineStyle(), fmt.Sprintf("%d errors encountered:", len(multi))))
+	for i, errStr := range errorStrings {
+		// Indent each error
+		errStr = strings.ReplaceAll(errStr, "\n", "\n"+indent)
+		// Error now looks like
+		// |  <line>
+		// |  <line>
+		prefix := fmt.Sprintf("%d. ", i+1)
+		if len(prefix) < len(indent) {
+			// Indent the prefix to match the indent
+			prefix = prefix + strings.Repeat(" ", len(indent)-len(prefix))
 		}
-		// The SDK error is usually good enough, and we don't want to overwhelm
-		// the user with output.
-		errTail = nil
-	} else {
-		msg = headErr
+		errStr = prefix + errStr
+		// Now looks like
+		// |1.<line>
+		// |  <line>
+		_, _ = str.WriteString("\n" + errStr)
 	}
+	return str.String()
+}
 
-	headStyle := lipgloss.NewStyle().Foreground(lipgloss.Color("#D16644"))
-	p.printf(
-		headStyle,
-		"%s",
-		msg,
-	)
+// formatRunCommandError are cli command errors. This kind of error is very
+// broad, as it contains all errors that occur when running a command.
+// If you know the error is something else, like a codersdk.Error, make a new
+// formatter and add it to cliHumanFormatError function.
+func formatRunCommandError(err *clibase.RunCommandError, opts *formatOpts) string {
+	var str strings.Builder
+	_, _ = str.WriteString(pretty.Sprint(headLineStyle(), fmt.Sprintf("Encountered an error running %q", err.Cmd.FullName())))
+
+	msgString := fmt.Sprintf("%v", err.Err)
+	if opts.Verbose {
+		// '%+v' includes stack traces
+		msgString = fmt.Sprintf("%+v", err.Err)
+	}
+	_, _ = str.WriteString("\n")
+	_, _ = str.WriteString(pretty.Sprint(tailLineStyle(), msgString))
+	return str.String()
+}
 
-	tailStyle := headStyle.Copy().Foreground(lipgloss.Color("#969696"))
+// formatCoderSDKError come from API requests. In verbose mode, add the
+// request debug information.
+func formatCoderSDKError(err *codersdk.Error, opts *formatOpts) string {
+	var str strings.Builder
+	if opts.Verbose {
+		_, _ = str.WriteString(pretty.Sprint(headLineStyle(), fmt.Sprintf("API request error to \"%s:%s\". Status code %d", err.Method(), err.URL(), err.StatusCode())))
+		_, _ = str.WriteString("\n")
+	}
 
-	if errTail != nil {
-		p.printf(headStyle, ": ")
-		// Grey out the less important, deep errors.
-		p.printf(tailStyle, "%s", errTail.Error())
+	_, _ = str.WriteString(pretty.Sprint(headLineStyle(), err.Message))
+	if err.Helper != "" {
+		_, _ = str.WriteString("\n")
+		_, _ = str.WriteString(pretty.Sprint(tailLineStyle(), err.Helper))
 	}
-	p.printf(tailStyle, "\n")
+	// By default we do not show the Detail with the helper.
+	if opts.Verbose || (err.Helper == "" && err.Detail != "") {
+		_, _ = str.WriteString("\n")
+		_, _ = str.WriteString(pretty.Sprint(tailLineStyle(), err.Detail))
+	}
+	return str.String()
 }
 
-func (p *prettyErrorFormatter) printf(style lipgloss.Style, format string, a ...interface{}) {
-	s := style.Render(fmt.Sprintf(format, a...))
-	_, _ = p.w.Write(
-		[]byte(
-			s,
-		),
-	)
+// These styles are arbitrary.
+func headLineStyle() pretty.Style {
+	return cliui.DefaultStyles.Error
+}
+
+func tailLineStyle() pretty.Style {
+	return pretty.Style{pretty.Nop}
+}
+
+//nolint:unused
+func SlimUnsupported(w io.Writer, cmd string) {
+	_, _ = fmt.Fprintf(w, "You are using a 'slim' build of Coder, which does not support the %s subcommand.\n", pretty.Sprint(cliui.DefaultStyles.Code, cmd))
+	_, _ = fmt.Fprintln(w, "")
+	_, _ = fmt.Fprintln(w, "Please use a build of Coder from GitHub releases:")
+	_, _ = fmt.Fprintln(w, "  https://github.com/coder/coder/releases")
+
+	//nolint:revive
+	os.Exit(1)
 }
diff --git a/cli/root_internal_test.go b/cli/root_internal_test.go
index e8c463e95cc90..2d99ab8247518 100644
--- a/cli/root_internal_test.go
+++ b/cli/root_internal_test.go
@@ -1,6 +1,8 @@
 package cli
 
 import (
+	"os"
+	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -67,6 +69,11 @@ func Test_formatExamples(t *testing.T) {
 }
 
 func TestMain(m *testing.M) {
+	if runtime.GOOS == "windows" {
+		// Don't run goleak on windows tests, they're super flaky right now.
+		// See: https://github.com/coder/coder/issues/8954
+		os.Exit(m.Run())
+	}
 	goleak.VerifyTestMain(m,
 		// The lumberjack library is used by by agent and seems to leave
 		// goroutines after Close(), fails TestGitSSH tests.
diff --git a/cli/root_test.go b/cli/root_test.go
index c892701a3acbc..4d95e5381b578 100644
--- a/cli/root_test.go
+++ b/cli/root_test.go
@@ -5,23 +5,24 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"runtime"
 	"strings"
 	"sync/atomic"
 	"testing"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/cli"
-	"github.com/coder/coder/cli/clitest"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clitest"
 )
 
 //nolint:tparallel,paralleltest
@@ -72,20 +73,29 @@ func TestRoot(t *testing.T) {
 	t.Run("Header", func(t *testing.T) {
 		t.Parallel()
 
+		var url string
 		var called int64
 		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			atomic.AddInt64(&called, 1)
 			assert.Equal(t, "wow", r.Header.Get("X-Testing"))
 			assert.Equal(t, "Dean was Here!", r.Header.Get("Cool-Header"))
+			assert.Equal(t, "very-wow-"+url, r.Header.Get("X-Process-Testing"))
+			assert.Equal(t, "more-wow", r.Header.Get("X-Process-Testing2"))
 			w.WriteHeader(http.StatusGone)
 		}))
 		defer srv.Close()
+		url = srv.URL
 		buf := new(bytes.Buffer)
+		coderURLEnv := "$CODER_URL"
+		if runtime.GOOS == "windows" {
+			coderURLEnv = "%CODER_URL%"
+		}
 		inv, _ := clitest.New(t,
 			"--no-feature-warning",
 			"--no-version-warning",
 			"--header", "X-Testing=wow",
 			"--header", "Cool-Header=Dean was Here!",
+			"--header-command", "printf X-Process-Testing=very-wow-"+coderURLEnv+"'\\r\\n'X-Process-Testing2=more-wow",
 			"login", srv.URL,
 		)
 		inv.Stdout = buf
@@ -97,14 +107,18 @@ func TestRoot(t *testing.T) {
 	})
 }
 
-// TestDERPHeaders ensures that the client sends the global `--header`s to the
-// DERP server when connecting.
+// TestDERPHeaders ensures that the client sends the global `--header`s and
+// `--header-command` to the DERP server when connecting.
 func TestDERPHeaders(t *testing.T) {
 	t.Parallel()
 
 	// Create a coderd API instance the hard way since we need to change the
 	// handler to inject our custom /derp handler.
-	setHandler, cancelFunc, serverURL, newOptions := coderdtest.NewOptions(t, nil)
+	dv := coderdtest.DeploymentValues(t)
+	dv.DERP.Config.BlockDirect = true
+	setHandler, cancelFunc, serverURL, newOptions := coderdtest.NewOptions(t, &coderdtest.Options{
+		DeploymentValues: dv,
+	})
 
 	// We set the handler after server creation for the access URL.
 	coderAPI := coderd.New(newOptions)
@@ -122,15 +136,17 @@ func TestDERPHeaders(t *testing.T) {
 	})
 
 	var (
-		user      = coderdtest.CreateFirstUser(t, client)
-		workspace = runAgent(t, client, user.UserID)
+		admin     = coderdtest.CreateFirstUser(t, client)
+		member, _ = coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+		workspace = runAgent(t, client, member)
 	)
 
 	// Inject custom /derp handler so we can inspect the headers.
 	var (
 		expectedHeaders = map[string]string{
-			"X-Test-Header": "test-value",
-			"Cool-Header":   "Dean was Here!",
+			"X-Test-Header":     "test-value",
+			"Cool-Header":       "Dean was Here!",
+			"X-Process-Testing": "very-wow",
 		}
 		derpCalled int64
 	)
@@ -155,16 +171,20 @@ func TestDERPHeaders(t *testing.T) {
 
 	// Connect with the headers set as args.
 	args := []string{
+		"-v",
 		"--no-feature-warning",
 		"--no-version-warning",
 		"ping", workspace.Name,
 		"-n", "1",
+		"--header-command", "printf X-Process-Testing=very-wow",
 	}
 	for k, v := range expectedHeaders {
-		args = append(args, "--header", fmt.Sprintf("%s=%s", k, v))
+		if k != "X-Process-Testing" {
+			args = append(args, "--header", fmt.Sprintf("%s=%s", k, v))
+		}
 	}
 	inv, root := clitest.New(t, args...)
-	clitest.SetupConfig(t, client, root)
+	clitest.SetupConfig(t, member, root)
 	pty := ptytest.New(t)
 	inv.Stdin = pty.Input()
 	inv.Stderr = pty.Output()
diff --git a/cli/schedule.go b/cli/schedule.go
index 8fff0121ae8db..6b0f105875c80 100644
--- a/cli/schedule.go
+++ b/cli/schedule.go
@@ -8,12 +8,12 @@ import (
 	"github.com/jedib0t/go-pretty/v6/table"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/coderd/util/tz"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/coderd/util/tz"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 const (
@@ -255,7 +255,7 @@ func displaySchedule(workspace codersdk.Workspace, out io.Writer) error {
 		schedNextStop  = "-"
 	)
 	if !ptr.NilOrEmpty(workspace.AutostartSchedule) {
-		sched, err := schedule.Weekly(ptr.NilToEmpty(workspace.AutostartSchedule))
+		sched, err := cron.Weekly(ptr.NilToEmpty(workspace.AutostartSchedule))
 		if err != nil {
 			// This should never happen.
 			_, _ = fmt.Fprintf(out, "Invalid autostart schedule %q for workspace %s: %s\n", *workspace.AutostartSchedule, workspace.Name, err.Error())
diff --git a/cli/schedule_test.go b/cli/schedule_test.go
index d1e6fe2da543f..dfb992976bc62 100644
--- a/cli/schedule_test.go
+++ b/cli/schedule_test.go
@@ -11,11 +11,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestScheduleShow(t *testing.T) {
@@ -31,13 +31,13 @@ func TestScheduleShow(t *testing.T) {
 			client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 			user      = coderdtest.CreateFirstUser(t, client)
 			version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			project   = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 				cwr.AutostartSchedule = ptr.Ref(schedCron)
 				cwr.TTLMillis = ptr.Ref(ttl.Milliseconds())
 			})
-			_         = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+			_         = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 			cmdArgs   = []string{"schedule", "show", workspace.Name}
 			stdoutBuf = &bytes.Buffer{}
 		)
@@ -68,13 +68,13 @@ func TestScheduleShow(t *testing.T) {
 			client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 			user      = coderdtest.CreateFirstUser(t, client)
 			version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			project   = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 				cwr.AutostartSchedule = nil
 				cwr.TTLMillis = nil
 			})
-			_         = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+			_         = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 			cmdArgs   = []string{"schedule", "show", workspace.Name}
 			stdoutBuf = &bytes.Buffer{}
 		)
@@ -101,7 +101,7 @@ func TestScheduleShow(t *testing.T) {
 			client  = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 			user    = coderdtest.CreateFirstUser(t, client)
 			version = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_       = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			_       = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		)
 
 		inv, root := clitest.New(t, "schedule", "show", "doesnotexist")
@@ -120,12 +120,12 @@ func TestScheduleStart(t *testing.T) {
 		client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user      = coderdtest.CreateFirstUser(t, client)
 		version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		project   = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 			cwr.AutostartSchedule = nil
 		})
-		_         = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		_         = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		tz        = "Europe/Dublin"
 		sched     = "CRON_TZ=Europe/Dublin 30 9 * * Mon-Fri"
 		stdoutBuf = &bytes.Buffer{}
@@ -177,11 +177,11 @@ func TestScheduleStop(t *testing.T) {
 		client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user      = coderdtest.CreateFirstUser(t, client)
 		version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		project   = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		ttl       = 8*time.Hour + 30*time.Minute
 		workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID)
-		_         = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		_         = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		stdoutBuf = &bytes.Buffer{}
 	)
 
@@ -230,7 +230,7 @@ func TestScheduleOverride(t *testing.T) {
 			client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 			user      = coderdtest.CreateFirstUser(t, client)
 			version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			project   = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID)
 			cmdArgs   = []string{"schedule", "override-stop", workspace.Name, "10h"}
@@ -238,7 +238,7 @@ func TestScheduleOverride(t *testing.T) {
 		)
 
 		// Given: we wait for the workspace to be built
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		workspace, err = client.Workspace(ctx, workspace.ID)
 		require.NoError(t, err)
 		expectedDeadline := time.Now().Add(10 * time.Hour)
@@ -271,7 +271,7 @@ func TestScheduleOverride(t *testing.T) {
 			client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 			user      = coderdtest.CreateFirstUser(t, client)
 			version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			project   = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID)
 			cmdArgs   = []string{"schedule", "override-stop", workspace.Name, "kwyjibo"}
@@ -279,7 +279,7 @@ func TestScheduleOverride(t *testing.T) {
 		)
 
 		// Given: we wait for the workspace to be built
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		workspace, err = client.Workspace(ctx, workspace.ID)
 		require.NoError(t, err)
 
@@ -307,7 +307,7 @@ func TestScheduleOverride(t *testing.T) {
 			client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 			user      = coderdtest.CreateFirstUser(t, client)
 			version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			template  = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 				cwr.TTLMillis = nil
@@ -316,8 +316,8 @@ func TestScheduleOverride(t *testing.T) {
 			stdoutBuf = &bytes.Buffer{}
 		)
 		require.Zero(t, template.DefaultTTLMillis)
-		require.Empty(t, template.RestartRequirement.DaysOfWeek)
-		require.Zero(t, template.RestartRequirement.Weeks)
+		require.Empty(t, template.AutostopRequirement.DaysOfWeek)
+		require.EqualValues(t, 1, template.AutostopRequirement.Weeks)
 
 		// Unset the workspace TTL
 		err = client.UpdateWorkspaceTTL(ctx, workspace.ID, codersdk.UpdateWorkspaceTTLRequest{TTLMillis: nil})
@@ -327,7 +327,7 @@ func TestScheduleOverride(t *testing.T) {
 		require.Nil(t, workspace.TTLMillis)
 
 		// Given: we wait for the workspace to build
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		workspace, err = client.Workspace(ctx, workspace.ID)
 		require.NoError(t, err)
 
@@ -362,7 +362,7 @@ func TestScheduleStartDefaults(t *testing.T) {
 		client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user      = coderdtest.CreateFirstUser(t, client)
 		version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		project   = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 			cwr.AutostartSchedule = nil
diff --git a/cli/server.go b/cli/server.go
index 170b7c5eb9f00..61755840382e1 100644
--- a/cli/server.go
+++ b/cli/server.go
@@ -41,7 +41,8 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/collectors"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
-	"github.com/spf13/afero"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/propagation"
 	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/mod/semver"
 	"golang.org/x/oauth2"
@@ -53,140 +54,216 @@ import (
 	"gopkg.in/yaml.v3"
 	"tailscale.com/tailcfg"
 
+	"github.com/coder/pretty"
+
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
 	"cdr.dev/slog/sloggers/slogjson"
 	"cdr.dev/slog/sloggers/slogstackdriver"
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/cli/config"
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/autobuild"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbmetrics"
-	"github.com/coder/coder/coderd/database/dbpurge"
-	"github.com/coder/coder/coderd/database/migrations"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/coderd/devtunnel"
-	"github.com/coder/coder/coderd/dormancy"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/gitsshkey"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/prometheusmetrics"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/coderd/unhanger"
-	"github.com/coder/coder/coderd/updatecheck"
-	"github.com/coder/coder/coderd/util/slice"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisioner/terraform"
-	"github.com/coder/coder/provisionerd"
-	"github.com/coder/coder/provisionerd/proto"
-	"github.com/coder/coder/provisionersdk"
-	sdkproto "github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/cli/config"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/autobuild"
+	"github.com/coder/coder/v2/coderd/batchstats"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbmetrics"
+	"github.com/coder/coder/v2/coderd/database/dbpurge"
+	"github.com/coder/coder/v2/coderd/database/migrations"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/devtunnel"
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/coderd/gitsshkey"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/oauthpki"
+	"github.com/coder/coder/v2/coderd/prometheusmetrics"
+	"github.com/coder/coder/v2/coderd/prometheusmetrics/insights"
+	"github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/unhanger"
+	"github.com/coder/coder/v2/coderd/updatecheck"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisioner/terraform"
+	"github.com/coder/coder/v2/provisionerd"
+	"github.com/coder/coder/v2/provisionerd/proto"
+	"github.com/coder/coder/v2/provisionersdk"
+	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/tailnet"
 	"github.com/coder/retry"
 	"github.com/coder/wgtunnel/tunnelsdk"
 )
 
-// ReadGitAuthProvidersFromEnv is provided for compatibility purposes with the
-// viper CLI.
-// DEPRECATED
-func ReadGitAuthProvidersFromEnv(environ []string) ([]codersdk.GitAuthConfig, error) {
-	// The index numbers must be in-order.
-	sort.Strings(environ)
+func createOIDCConfig(ctx context.Context, vals *codersdk.DeploymentValues) (*coderd.OIDCConfig, error) {
+	if vals.OIDC.ClientID == "" {
+		return nil, xerrors.Errorf("OIDC client ID must be set!")
+	}
+	if vals.OIDC.IssuerURL == "" {
+		return nil, xerrors.Errorf("OIDC issuer URL must be set!")
+	}
 
-	var providers []codersdk.GitAuthConfig
-	for _, v := range clibase.ParseEnviron(environ, "CODER_GITAUTH_") {
-		tokens := strings.SplitN(v.Name, "_", 2)
-		if len(tokens) != 2 {
-			return nil, xerrors.Errorf("invalid env var: %s", v.Name)
+	oidcProvider, err := oidc.NewProvider(
+		ctx, vals.OIDC.IssuerURL.String(),
+	)
+	if err != nil {
+		return nil, xerrors.Errorf("configure oidc provider: %w", err)
+	}
+	redirectURL, err := vals.AccessURL.Value().Parse("/api/v2/users/oidc/callback")
+	if err != nil {
+		return nil, xerrors.Errorf("parse oidc oauth callback url: %w", err)
+	}
+	// If the scopes contain 'groups', we enable group support.
+	// Do not override any custom value set by the user.
+	if slice.Contains(vals.OIDC.Scopes, "groups") && vals.OIDC.GroupField == "" {
+		vals.OIDC.GroupField = "groups"
+	}
+	oauthCfg := &oauth2.Config{
+		ClientID:     vals.OIDC.ClientID.String(),
+		ClientSecret: vals.OIDC.ClientSecret.String(),
+		RedirectURL:  redirectURL.String(),
+		Endpoint:     oidcProvider.Endpoint(),
+		Scopes:       vals.OIDC.Scopes,
+	}
+
+	var useCfg httpmw.OAuth2Config = oauthCfg
+	if vals.OIDC.ClientKeyFile != "" {
+		// PKI authentication is done in the params. If a
+		// counter example is found, we can add a config option to
+		// change this.
+		oauthCfg.Endpoint.AuthStyle = oauth2.AuthStyleInParams
+		if vals.OIDC.ClientSecret != "" {
+			return nil, xerrors.Errorf("cannot specify both oidc client secret and oidc client key file")
 		}
 
-		providerNum, err := strconv.Atoi(tokens[0])
+		pkiCfg, err := configureOIDCPKI(oauthCfg, vals.OIDC.ClientKeyFile.Value(), vals.OIDC.ClientCertFile.Value())
 		if err != nil {
-			return nil, xerrors.Errorf("parse number: %s", v.Name)
+			return nil, xerrors.Errorf("configure oauth pki authentication: %w", err)
 		}
+		useCfg = pkiCfg
+	}
+	return &coderd.OIDCConfig{
+		OAuth2Config: useCfg,
+		Provider:     oidcProvider,
+		Verifier: oidcProvider.Verifier(&oidc.Config{
+			ClientID: vals.OIDC.ClientID.String(),
+		}),
+		EmailDomain:         vals.OIDC.EmailDomain,
+		AllowSignups:        vals.OIDC.AllowSignups.Value(),
+		UsernameField:       vals.OIDC.UsernameField.String(),
+		EmailField:          vals.OIDC.EmailField.String(),
+		AuthURLParams:       vals.OIDC.AuthURLParams.Value,
+		IgnoreUserInfo:      vals.OIDC.IgnoreUserInfo.Value(),
+		GroupField:          vals.OIDC.GroupField.String(),
+		GroupFilter:         vals.OIDC.GroupRegexFilter.Value(),
+		CreateMissingGroups: vals.OIDC.GroupAutoCreate.Value(),
+		GroupMapping:        vals.OIDC.GroupMapping.Value,
+		UserRoleField:       vals.OIDC.UserRoleField.String(),
+		UserRoleMapping:     vals.OIDC.UserRoleMapping.Value,
+		UserRolesDefault:    vals.OIDC.UserRolesDefault.GetSlice(),
+		SignInText:          vals.OIDC.SignInText.String(),
+		IconURL:             vals.OIDC.IconURL.String(),
+		IgnoreEmailVerified: vals.OIDC.IgnoreEmailVerified.Value(),
+	}, nil
+}
 
-		var provider codersdk.GitAuthConfig
-		switch {
-		case len(providers) < providerNum:
-			return nil, xerrors.Errorf(
-				"provider num %v skipped: %s",
-				len(providers),
-				v.Name,
-			)
-		case len(providers) == providerNum:
-			// At the next next provider.
-			providers = append(providers, provider)
-		case len(providers) == providerNum+1:
-			// At the current provider.
-			provider = providers[providerNum]
+func afterCtx(ctx context.Context, fn func()) {
+	go func() {
+		<-ctx.Done()
+		fn()
+	}()
+}
+
+func enablePrometheus(
+	ctx context.Context,
+	logger slog.Logger,
+	vals *codersdk.DeploymentValues,
+	options *coderd.Options,
+) (closeFn func(), err error) {
+	options.PrometheusRegistry.MustRegister(collectors.NewGoCollector())
+	options.PrometheusRegistry.MustRegister(collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}))
+
+	closeUsersFunc, err := prometheusmetrics.ActiveUsers(ctx, options.PrometheusRegistry, options.Database, 0)
+	if err != nil {
+		return nil, xerrors.Errorf("register active users prometheus metric: %w", err)
+	}
+	afterCtx(ctx, closeUsersFunc)
+
+	closeWorkspacesFunc, err := prometheusmetrics.Workspaces(ctx, options.PrometheusRegistry, options.Database, 0)
+	if err != nil {
+		return nil, xerrors.Errorf("register workspaces prometheus metric: %w", err)
+	}
+	afterCtx(ctx, closeWorkspacesFunc)
+
+	insightsMetricsCollector, err := insights.NewMetricsCollector(options.Database, options.Logger, 0, 0)
+	if err != nil {
+		return nil, xerrors.Errorf("unable to initialize insights metrics collector: %w", err)
+	}
+	err = options.PrometheusRegistry.Register(insightsMetricsCollector)
+	if err != nil {
+		return nil, xerrors.Errorf("unable to register insights metrics collector: %w", err)
+	}
+
+	closeInsightsMetricsCollector, err := insightsMetricsCollector.Run(ctx)
+	if err != nil {
+		return nil, xerrors.Errorf("unable to run insights metrics collector: %w", err)
+	}
+	afterCtx(ctx, closeInsightsMetricsCollector)
+
+	if vals.Prometheus.CollectAgentStats {
+		closeAgentStatsFunc, err := prometheusmetrics.AgentStats(ctx, logger, options.PrometheusRegistry, options.Database, time.Now(), 0)
+		if err != nil {
+			return nil, xerrors.Errorf("register agent stats prometheus metric: %w", err)
 		}
+		afterCtx(ctx, closeAgentStatsFunc)
 
-		key := tokens[1]
-		switch key {
-		case "ID":
-			provider.ID = v.Value
-		case "TYPE":
-			provider.Type = v.Value
-		case "CLIENT_ID":
-			provider.ClientID = v.Value
-		case "CLIENT_SECRET":
-			provider.ClientSecret = v.Value
-		case "AUTH_URL":
-			provider.AuthURL = v.Value
-		case "TOKEN_URL":
-			provider.TokenURL = v.Value
-		case "VALIDATE_URL":
-			provider.ValidateURL = v.Value
-		case "REGEX":
-			provider.Regex = v.Value
-		case "DEVICE_FLOW":
-			b, err := strconv.ParseBool(v.Value)
-			if err != nil {
-				return nil, xerrors.Errorf("parse bool: %s", v.Value)
-			}
-			provider.DeviceFlow = b
-		case "DEVICE_CODE_URL":
-			provider.DeviceCodeURL = v.Value
-		case "NO_REFRESH":
-			b, err := strconv.ParseBool(v.Value)
-			if err != nil {
-				return nil, xerrors.Errorf("parse bool: %s", v.Value)
-			}
-			provider.NoRefresh = b
-		case "SCOPES":
-			provider.Scopes = strings.Split(v.Value, " ")
-		case "APP_INSTALL_URL":
-			provider.AppInstallURL = v.Value
-		case "APP_INSTALLATIONS_URL":
-			provider.AppInstallationsURL = v.Value
+		metricsAggregator, err := prometheusmetrics.NewMetricsAggregator(logger, options.PrometheusRegistry, 0)
+		if err != nil {
+			return nil, xerrors.Errorf("can't initialize metrics aggregator: %w", err)
+		}
+
+		cancelMetricsAggregator := metricsAggregator.Run(ctx)
+		afterCtx(ctx, cancelMetricsAggregator)
+
+		options.UpdateAgentMetrics = metricsAggregator.Update
+		err = options.PrometheusRegistry.Register(metricsAggregator)
+		if err != nil {
+			return nil, xerrors.Errorf("can't register metrics aggregator as collector: %w", err)
 		}
-		providers[providerNum] = provider
 	}
-	return providers, nil
+
+	//nolint:revive
+	return ServeHandler(
+		ctx, logger, promhttp.InstrumentMetricHandler(
+			options.PrometheusRegistry, promhttp.HandlerFor(options.PrometheusRegistry, promhttp.HandlerOpts{}),
+		), vals.Prometheus.Address.String(), "prometheus",
+	), nil
 }
 
-// nolint:gocyclo
 func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.API, io.Closer, error)) *clibase.Cmd {
+	if newAPI == nil {
+		newAPI = func(_ context.Context, o *coderd.Options) (*coderd.API, io.Closer, error) {
+			api := coderd.New(o)
+			return api, api, nil
+		}
+	}
+
 	var (
-		cfg  = new(codersdk.DeploymentValues)
-		opts = cfg.Options()
+		vals = new(codersdk.DeploymentValues)
+		opts = vals.Options()
 	)
 	serverCmd := &clibase.Cmd{
 		Use:     "server",
 		Short:   "Start a Coder server",
 		Options: opts,
 		Middleware: clibase.Chain(
-			WriteConfigMW(cfg),
+			WriteConfigMW(vals),
 			PrintDeprecatedOptions(),
 			clibase.RequireNArgs(0),
 		),
@@ -196,32 +273,32 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 			ctx, cancel := context.WithCancel(inv.Context())
 			defer cancel()
 
-			if cfg.Config != "" {
+			if vals.Config != "" {
 				cliui.Warnf(inv.Stderr, "YAML support is experimental and offers no compatibility guarantees.")
 			}
 
 			go DumpHandler(ctx)
 
 			// Validate bind addresses.
-			if cfg.Address.String() != "" {
-				if cfg.TLS.Enable {
-					cfg.HTTPAddress = ""
-					cfg.TLS.Address = cfg.Address
+			if vals.Address.String() != "" {
+				if vals.TLS.Enable {
+					vals.HTTPAddress = ""
+					vals.TLS.Address = vals.Address
 				} else {
-					_ = cfg.HTTPAddress.Set(cfg.Address.String())
-					cfg.TLS.Address.Host = ""
-					cfg.TLS.Address.Port = ""
+					_ = vals.HTTPAddress.Set(vals.Address.String())
+					vals.TLS.Address.Host = ""
+					vals.TLS.Address.Port = ""
 				}
 			}
-			if cfg.TLS.Enable && cfg.TLS.Address.String() == "" {
+			if vals.TLS.Enable && vals.TLS.Address.String() == "" {
 				return xerrors.Errorf("TLS address must be set if TLS is enabled")
 			}
-			if !cfg.TLS.Enable && cfg.HTTPAddress.String() == "" {
+			if !vals.TLS.Enable && vals.HTTPAddress.String() == "" {
 				return xerrors.Errorf("TLS is disabled. Enable with --tls-enable or specify a HTTP address")
 			}
 
-			if cfg.AccessURL.String() != "" &&
-				!(cfg.AccessURL.Scheme == "http" || cfg.AccessURL.Scheme == "https") {
+			if vals.AccessURL.String() != "" &&
+				!(vals.AccessURL.Scheme == "http" || vals.AccessURL.Scheme == "https") {
 				return xerrors.Errorf("access-url must include a scheme (e.g. 'http://' or 'https://)")
 			}
 
@@ -229,14 +306,14 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 			// was specified.
 			loginRateLimit := 60
 			filesRateLimit := 12
-			if cfg.RateLimit.DisableAll {
-				cfg.RateLimit.API = -1
+			if vals.RateLimit.DisableAll {
+				vals.RateLimit.API = -1
 				loginRateLimit = -1
 				filesRateLimit = -1
 			}
 
 			PrintLogo(inv, "Coder")
-			logger, logCloser, err := BuildLogger(inv, cfg)
+			logger, logCloser, err := BuildLogger(inv, vals)
 			if err != nil {
 				return xerrors.Errorf("make logger: %w", err)
 			}
@@ -259,7 +336,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 			notifyCtx, notifyStop := signal.NotifyContext(ctx, InterruptSignals...)
 			defer notifyStop()
 
-			cacheDir := cfg.CacheDir.String()
+			cacheDir := vals.CacheDir.String()
 			err = os.MkdirAll(cacheDir, 0o700)
 			if err != nil {
 				return xerrors.Errorf("create cache directory: %w", err)
@@ -270,14 +347,14 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 			// which is caught by goleaks.
 			defer http.DefaultClient.CloseIdleConnections()
 
-			tracerProvider, sqlDriver, closeTracing := ConfigureTraceProvider(ctx, logger, inv, cfg)
+			tracerProvider, sqlDriver, closeTracing := ConfigureTraceProvider(ctx, logger, vals)
 			defer func() {
 				logger.Debug(ctx, "closing tracing")
 				traceCloseErr := shutdownWithTimeout(closeTracing, 5*time.Second)
 				logger.Debug(ctx, "tracing closed", slog.Error(traceCloseErr))
 			}()
 
-			httpServers, err := ConfigureHTTPServers(inv, cfg)
+			httpServers, err := ConfigureHTTPServers(inv, vals)
 			if err != nil {
 				return xerrors.Errorf("configure http(s): %w", err)
 			}
@@ -287,7 +364,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 
 			builtinPostgres := false
 			// Only use built-in if PostgreSQL URL isn't specified!
-			if !cfg.InMemoryDatabase && cfg.PostgresURL == "" {
+			if !vals.InMemoryDatabase && vals.PostgresURL == "" {
 				var closeFunc func() error
 				cliui.Infof(inv.Stdout, "Using built-in PostgreSQL (%s)", config.PostgresPath())
 				pgURL, closeFunc, err := startBuiltinPostgres(ctx, config, logger)
@@ -295,7 +372,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 					return err
 				}
 
-				err = cfg.PostgresURL.Set(pgURL)
+				err = vals.PostgresURL.Set(pgURL)
 				if err != nil {
 					return err
 				}
@@ -319,9 +396,9 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 
 			ctx, httpClient, err := ConfigureHTTPClient(
 				ctx,
-				cfg.TLS.ClientCertFile.String(),
-				cfg.TLS.ClientKeyFile.String(),
-				cfg.TLS.ClientCAFile.String(),
+				vals.TLS.ClientCertFile.String(),
+				vals.TLS.ClientKeyFile.String(),
+				vals.TLS.ClientCAFile.String(),
 			)
 			if err != nil {
 				return xerrors.Errorf("configure http client: %w", err)
@@ -333,30 +410,30 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				tunnel     *tunnelsdk.Tunnel
 				tunnelDone <-chan struct{} = make(chan struct{}, 1)
 			)
-			if cfg.AccessURL.String() == "" {
+			if vals.AccessURL.String() == "" {
 				cliui.Infof(inv.Stderr, "Opening tunnel so workspaces can connect to your deployment. For production scenarios, specify an external access URL")
-				tunnel, err = devtunnel.New(ctx, logger.Named("net.devtunnel"), cfg.WgtunnelHost.String())
+				tunnel, err = devtunnel.New(ctx, logger.Named("net.devtunnel"), vals.WgtunnelHost.String())
 				if err != nil {
 					return xerrors.Errorf("create tunnel: %w", err)
 				}
 				defer tunnel.Close()
 				tunnelDone = tunnel.Wait()
-				cfg.AccessURL = clibase.URL(*tunnel.URL)
+				vals.AccessURL = clibase.URL(*tunnel.URL)
 
-				if cfg.WildcardAccessURL.String() == "" {
+				if vals.WildcardAccessURL.String() == "" {
 					// Suffixed wildcard access URL.
 					u, err := url.Parse(fmt.Sprintf("*--%s", tunnel.URL.Hostname()))
 					if err != nil {
 						return xerrors.Errorf("parse wildcard url: %w", err)
 					}
-					cfg.WildcardAccessURL = clibase.URL(*u)
+					vals.WildcardAccessURL = clibase.URL(*u)
 				}
 			}
 
-			_, accessURLPortRaw, _ := net.SplitHostPort(cfg.AccessURL.Host)
+			_, accessURLPortRaw, _ := net.SplitHostPort(vals.AccessURL.Host)
 			if accessURLPortRaw == "" {
 				accessURLPortRaw = "80"
-				if cfg.AccessURL.Scheme == "https" {
+				if vals.AccessURL.Scheme == "https" {
 					accessURLPortRaw = "443"
 				}
 			}
@@ -366,8 +443,8 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				return xerrors.Errorf("parse access URL port: %w", err)
 			}
 
-			// Warn the user if the access URL appears to be a loopback address.
-			isLocal, err := IsLocalURL(ctx, cfg.AccessURL.Value())
+			// Warn the user if the access URL is loopback or unresolvable.
+			isLocal, err := IsLocalURL(ctx, vals.AccessURL.Value())
 			if isLocal || err != nil {
 				reason := "could not be resolved"
 				if isLocal {
@@ -376,12 +453,12 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				cliui.Warnf(
 					inv.Stderr,
 					"The access URL %s %s, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\n",
-					cliui.DefaultStyles.Field.Render(cfg.AccessURL.String()), reason,
+					pretty.Sprint(cliui.DefaultStyles.Field, vals.AccessURL.String()), reason,
 				)
 			}
 
 			// A newline is added before for visibility in terminal output.
-			cliui.Infof(inv.Stdout, "\nView the Web UI: %s", cfg.AccessURL.String())
+			cliui.Infof(inv.Stdout, "\nView the Web UI: %s", vals.AccessURL.String())
 
 			// Used for zero-trust instance identity with Google Cloud.
 			googleTokenValidator, err := idtoken.NewValidator(ctx, option.WithoutAuthentication())
@@ -389,51 +466,39 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				return err
 			}
 
-			sshKeygenAlgorithm, err := gitsshkey.ParseAlgorithm(cfg.SSHKeygenAlgorithm.String())
+			sshKeygenAlgorithm, err := gitsshkey.ParseAlgorithm(vals.SSHKeygenAlgorithm.String())
 			if err != nil {
-				return xerrors.Errorf("parse ssh keygen algorithm %s: %w", cfg.SSHKeygenAlgorithm, err)
+				return xerrors.Errorf("parse ssh keygen algorithm %s: %w", vals.SSHKeygenAlgorithm, err)
 			}
 
 			defaultRegion := &tailcfg.DERPRegion{
 				EmbeddedRelay: true,
-				RegionID:      int(cfg.DERP.Server.RegionID.Value()),
-				RegionCode:    cfg.DERP.Server.RegionCode.String(),
-				RegionName:    cfg.DERP.Server.RegionName.String(),
+				RegionID:      int(vals.DERP.Server.RegionID.Value()),
+				RegionCode:    vals.DERP.Server.RegionCode.String(),
+				RegionName:    vals.DERP.Server.RegionName.String(),
 				Nodes: []*tailcfg.DERPNode{{
-					Name:      fmt.Sprintf("%db", cfg.DERP.Server.RegionID),
-					RegionID:  int(cfg.DERP.Server.RegionID.Value()),
-					HostName:  cfg.AccessURL.Value().Hostname(),
+					Name:      fmt.Sprintf("%db", vals.DERP.Server.RegionID),
+					RegionID:  int(vals.DERP.Server.RegionID.Value()),
+					HostName:  vals.AccessURL.Value().Hostname(),
 					DERPPort:  accessURLPort,
 					STUNPort:  -1,
-					ForceHTTP: cfg.AccessURL.Scheme == "http",
+					ForceHTTP: vals.AccessURL.Scheme == "http",
 				}},
 			}
-			if !cfg.DERP.Server.Enable {
+			if !vals.DERP.Server.Enable {
 				defaultRegion = nil
 			}
 
-			// HACK: see https://github.com/coder/coder/issues/6791.
-			for _, addr := range cfg.DERP.Server.STUNAddresses {
-				if addr != "disable" {
-					continue
-				}
-				err := cfg.DERP.Server.STUNAddresses.Replace(nil)
-				if err != nil {
-					panic(err)
-				}
-				break
-			}
-
 			derpMap, err := tailnet.NewDERPMap(
-				ctx, defaultRegion, cfg.DERP.Server.STUNAddresses,
-				cfg.DERP.Config.URL.String(), cfg.DERP.Config.Path.String(),
-				cfg.DERP.Config.BlockDirect.Value(),
+				ctx, defaultRegion, vals.DERP.Server.STUNAddresses,
+				vals.DERP.Config.URL.String(), vals.DERP.Config.Path.String(),
+				vals.DERP.Config.BlockDirect.Value(),
 			)
 			if err != nil {
 				return xerrors.Errorf("create derp map: %w", err)
 			}
 
-			appHostname := cfg.WildcardAccessURL.String()
+			appHostname := vals.WildcardAccessURL.String()
 			var appHostnameRegex *regexp.Regexp
 			if appHostname != "" {
 				appHostnameRegex, err = httpapi.CompileHostnamePattern(appHostname)
@@ -442,64 +507,68 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				}
 			}
 
-			gitAuthEnv, err := ReadGitAuthProvidersFromEnv(os.Environ())
+			extAuthEnv, err := ReadExternalAuthProvidersFromEnv(os.Environ())
 			if err != nil {
-				return xerrors.Errorf("read git auth providers from env: %w", err)
+				return xerrors.Errorf("read external auth providers from env: %w", err)
 			}
 
-			cfg.GitAuthProviders.Value = append(cfg.GitAuthProviders.Value, gitAuthEnv...)
-			gitAuthConfigs, err := gitauth.ConvertConfig(
-				cfg.GitAuthProviders.Value,
-				cfg.AccessURL.Value(),
+			vals.ExternalAuthConfigs.Value = append(vals.ExternalAuthConfigs.Value, extAuthEnv...)
+			externalAuthConfigs, err := externalauth.ConvertConfig(
+				vals.ExternalAuthConfigs.Value,
+				vals.AccessURL.Value(),
 			)
 			if err != nil {
-				return xerrors.Errorf("convert git auth config: %w", err)
+				return xerrors.Errorf("convert external auth config: %w", err)
 			}
-			for _, c := range gitAuthConfigs {
+			for _, c := range externalAuthConfigs {
 				logger.Debug(
-					ctx, "loaded git auth config",
+					ctx, "loaded external auth config",
 					slog.F("id", c.ID),
 				)
 			}
 
-			realIPConfig, err := httpmw.ParseRealIPConfig(cfg.ProxyTrustedHeaders, cfg.ProxyTrustedOrigins)
+			realIPConfig, err := httpmw.ParseRealIPConfig(vals.ProxyTrustedHeaders, vals.ProxyTrustedOrigins)
 			if err != nil {
 				return xerrors.Errorf("parse real ip config: %w", err)
 			}
 
-			configSSHOptions, err := cfg.SSHConfig.ParseOptions()
+			configSSHOptions, err := vals.SSHConfig.ParseOptions()
 			if err != nil {
-				return xerrors.Errorf("parse ssh config options %q: %w", cfg.SSHConfig.SSHConfigOptions.String(), err)
+				return xerrors.Errorf("parse ssh config options %q: %w", vals.SSHConfig.SSHConfigOptions.String(), err)
 			}
 
 			options := &coderd.Options{
-				AccessURL:                   cfg.AccessURL.Value(),
+				AccessURL:                   vals.AccessURL.Value(),
 				AppHostname:                 appHostname,
 				AppHostnameRegex:            appHostnameRegex,
 				Logger:                      logger.Named("coderd"),
-				Database:                    dbfake.New(),
+				Database:                    dbmem.New(),
 				BaseDERPMap:                 derpMap,
 				Pubsub:                      pubsub.NewInMemory(),
 				CacheDir:                    cacheDir,
 				GoogleTokenValidator:        googleTokenValidator,
-				GitAuthConfigs:              gitAuthConfigs,
+				ExternalAuthConfigs:         externalAuthConfigs,
 				RealIPConfig:                realIPConfig,
-				SecureAuthCookie:            cfg.SecureAuthCookie.Value(),
+				SecureAuthCookie:            vals.SecureAuthCookie.Value(),
 				SSHKeygenAlgorithm:          sshKeygenAlgorithm,
 				TracerProvider:              tracerProvider,
 				Telemetry:                   telemetry.NewNoop(),
-				MetricsCacheRefreshInterval: cfg.MetricsCacheRefreshInterval.Value(),
-				AgentStatsRefreshInterval:   cfg.AgentStatRefreshInterval.Value(),
-				DeploymentValues:            cfg,
+				MetricsCacheRefreshInterval: vals.MetricsCacheRefreshInterval.Value(),
+				AgentStatsRefreshInterval:   vals.AgentStatRefreshInterval.Value(),
+				DeploymentValues:            vals,
+				// Do not pass secret values to DeploymentOptions. All values should be read from
+				// the DeploymentValues instead, this just serves to indicate the source of each
+				// option. This is just defensive to prevent accidentally leaking.
+				DeploymentOptions:           codersdk.DeploymentOptionsWithoutSecrets(opts),
 				PrometheusRegistry:          prometheus.NewRegistry(),
-				APIRateLimit:                int(cfg.RateLimit.API.Value()),
+				APIRateLimit:                int(vals.RateLimit.API.Value()),
 				LoginRateLimit:              loginRateLimit,
 				FilesRateLimit:              filesRateLimit,
 				HTTPClient:                  httpClient,
 				TemplateScheduleStore:       &atomic.Pointer[schedule.TemplateScheduleStore]{},
 				UserQuietHoursScheduleStore: &atomic.Pointer[schedule.UserQuietHoursScheduleStore]{},
 				SSHConfig: codersdk.SSHConfigResponse{
-					HostnamePrefix:   cfg.SSHConfig.DeploymentName.String(),
+					HostnamePrefix:   vals.SSHConfig.DeploymentName.String(),
 					SSHConfigOptions: configSSHOptions,
 				},
 			}
@@ -507,16 +576,16 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				options.TLSCertificates = httpServers.TLSConfig.Certificates
 			}
 
-			if cfg.StrictTransportSecurity > 0 {
+			if vals.StrictTransportSecurity > 0 {
 				options.StrictTransportSecurityCfg, err = httpmw.HSTSConfigOptions(
-					int(cfg.StrictTransportSecurity.Value()), cfg.StrictTransportSecurityOptions,
+					int(vals.StrictTransportSecurity.Value()), vals.StrictTransportSecurityOptions,
 				)
 				if err != nil {
-					return xerrors.Errorf("coderd: setting hsts header failed (options: %v): %w", cfg.StrictTransportSecurityOptions, err)
+					return xerrors.Errorf("coderd: setting hsts header failed (options: %v): %w", vals.StrictTransportSecurityOptions, err)
 				}
 			}
 
-			if cfg.UpdateCheck {
+			if vals.UpdateCheck {
 				options.UpdateCheckOptions = &updatecheck.Options{
 					// Avoid spamming GitHub API checking for updates.
 					Interval: 24 * time.Hour,
@@ -535,83 +604,39 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				}
 			}
 
-			if cfg.OAuth2.Github.ClientSecret != "" {
-				options.GithubOAuth2Config, err = configureGithubOAuth2(cfg.AccessURL.Value(),
-					cfg.OAuth2.Github.ClientID.String(),
-					cfg.OAuth2.Github.ClientSecret.String(),
-					cfg.OAuth2.Github.AllowSignups.Value(),
-					cfg.OAuth2.Github.AllowEveryone.Value(),
-					cfg.OAuth2.Github.AllowedOrgs,
-					cfg.OAuth2.Github.AllowedTeams,
-					cfg.OAuth2.Github.EnterpriseBaseURL.String(),
+			if vals.OAuth2.Github.ClientSecret != "" {
+				options.GithubOAuth2Config, err = configureGithubOAuth2(vals.AccessURL.Value(),
+					vals.OAuth2.Github.ClientID.String(),
+					vals.OAuth2.Github.ClientSecret.String(),
+					vals.OAuth2.Github.AllowSignups.Value(),
+					vals.OAuth2.Github.AllowEveryone.Value(),
+					vals.OAuth2.Github.AllowedOrgs,
+					vals.OAuth2.Github.AllowedTeams,
+					vals.OAuth2.Github.EnterpriseBaseURL.String(),
 				)
 				if err != nil {
 					return xerrors.Errorf("configure github oauth2: %w", err)
 				}
 			}
 
-			if cfg.OIDC.ClientSecret != "" {
-				if cfg.OIDC.ClientID == "" {
-					return xerrors.Errorf("OIDC client ID be set!")
-				}
-				if cfg.OIDC.IssuerURL == "" {
-					return xerrors.Errorf("OIDC issuer URL must be set!")
-				}
-
-				if cfg.OIDC.IgnoreEmailVerified {
+			if vals.OIDC.ClientKeyFile != "" || vals.OIDC.ClientSecret != "" {
+				if vals.OIDC.IgnoreEmailVerified {
 					logger.Warn(ctx, "coder will not check email_verified for OIDC logins")
 				}
 
-				oidcProvider, err := oidc.NewProvider(
-					ctx, cfg.OIDC.IssuerURL.String(),
-				)
-				if err != nil {
-					return xerrors.Errorf("configure oidc provider: %w", err)
-				}
-				redirectURL, err := cfg.AccessURL.Value().Parse("/api/v2/users/oidc/callback")
+				oc, err := createOIDCConfig(ctx, vals)
 				if err != nil {
-					return xerrors.Errorf("parse oidc oauth callback url: %w", err)
-				}
-				// If the scopes contain 'groups', we enable group support.
-				// Do not override any custom value set by the user.
-				if slice.Contains(cfg.OIDC.Scopes, "groups") && cfg.OIDC.GroupField == "" {
-					cfg.OIDC.GroupField = "groups"
-				}
-				options.OIDCConfig = &coderd.OIDCConfig{
-					OAuth2Config: &oauth2.Config{
-						ClientID:     cfg.OIDC.ClientID.String(),
-						ClientSecret: cfg.OIDC.ClientSecret.String(),
-						RedirectURL:  redirectURL.String(),
-						Endpoint:     oidcProvider.Endpoint(),
-						Scopes:       cfg.OIDC.Scopes,
-					},
-					Provider: oidcProvider,
-					Verifier: oidcProvider.Verifier(&oidc.Config{
-						ClientID: cfg.OIDC.ClientID.String(),
-					}),
-					EmailDomain:         cfg.OIDC.EmailDomain,
-					AllowSignups:        cfg.OIDC.AllowSignups.Value(),
-					UsernameField:       cfg.OIDC.UsernameField.String(),
-					EmailField:          cfg.OIDC.EmailField.String(),
-					AuthURLParams:       cfg.OIDC.AuthURLParams.Value,
-					IgnoreUserInfo:      cfg.OIDC.IgnoreUserInfo.Value(),
-					GroupField:          cfg.OIDC.GroupField.String(),
-					GroupMapping:        cfg.OIDC.GroupMapping.Value,
-					UserRoleField:       cfg.OIDC.UserRoleField.String(),
-					UserRoleMapping:     cfg.OIDC.UserRoleMapping.Value,
-					UserRolesDefault:    cfg.OIDC.UserRolesDefault.GetSlice(),
-					SignInText:          cfg.OIDC.SignInText.String(),
-					IconURL:             cfg.OIDC.IconURL.String(),
-					IgnoreEmailVerified: cfg.OIDC.IgnoreEmailVerified.Value(),
+					return xerrors.Errorf("create oidc config: %w", err)
 				}
+				options.OIDCConfig = oc
 			}
 
-			if cfg.InMemoryDatabase {
+			if vals.InMemoryDatabase {
 				// This is only used for testing.
-				options.Database = dbfake.New()
+				options.Database = dbmem.New()
 				options.Pubsub = pubsub.NewInMemory()
 			} else {
-				sqlDB, err := connectToPostgres(ctx, logger, sqlDriver, cfg.PostgresURL.String())
+				sqlDB, err := ConnectToPostgres(ctx, logger, sqlDriver, vals.PostgresURL.String())
 				if err != nil {
 					return xerrors.Errorf("connect to postgres: %w", err)
 				}
@@ -620,7 +645,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				}()
 
 				options.Database = database.New(sqlDB)
-				options.Pubsub, err = pubsub.New(ctx, sqlDB, cfg.PostgresURL.String())
+				options.Pubsub, err = pubsub.New(ctx, sqlDB, vals.PostgresURL.String())
 				if err != nil {
 					return xerrors.Errorf("create pubsub: %w", err)
 				}
@@ -727,10 +752,10 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				return err
 			}
 
-			if cfg.Telemetry.Enable {
+			if vals.Telemetry.Enable {
 				gitAuth := make([]telemetry.GitAuth, 0)
 				// TODO:
-				var gitAuthConfigs []codersdk.GitAuthConfig
+				var gitAuthConfigs []codersdk.ExternalAuthConfig
 				for _, cfg := range gitAuthConfigs {
 					gitAuth = append(gitAuth, telemetry.GitAuth{
 						Type: cfg.Type,
@@ -742,79 +767,57 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 					DeploymentID:       deploymentID,
 					Database:           options.Database,
 					Logger:             logger.Named("telemetry"),
-					URL:                cfg.Telemetry.URL.Value(),
-					Wildcard:           cfg.WildcardAccessURL.String() != "",
-					DERPServerRelayURL: cfg.DERP.Server.RelayURL.String(),
+					URL:                vals.Telemetry.URL.Value(),
+					Wildcard:           vals.WildcardAccessURL.String() != "",
+					DERPServerRelayURL: vals.DERP.Server.RelayURL.String(),
 					GitAuth:            gitAuth,
-					GitHubOAuth:        cfg.OAuth2.Github.ClientID != "",
-					OIDCAuth:           cfg.OIDC.ClientID != "",
-					OIDCIssuerURL:      cfg.OIDC.IssuerURL.String(),
-					Prometheus:         cfg.Prometheus.Enable.Value(),
-					STUN:               len(cfg.DERP.Server.STUNAddresses) != 0,
+					GitHubOAuth:        vals.OAuth2.Github.ClientID != "",
+					OIDCAuth:           vals.OIDC.ClientID != "",
+					OIDCIssuerURL:      vals.OIDC.IssuerURL.String(),
+					Prometheus:         vals.Prometheus.Enable.Value(),
+					STUN:               len(vals.DERP.Server.STUNAddresses) != 0,
 					Tunnel:             tunnel != nil,
 				})
 				if err != nil {
 					return xerrors.Errorf("create telemetry reporter: %w", err)
 				}
 				defer options.Telemetry.Close()
+			} else {
+				logger.Warn(ctx, `telemetry disabled, unable to notify of security issues. Read more: https://coder.com/docs/v2/latest/admin/telemetry`)
 			}
 
 			// This prevents the pprof import from being accidentally deleted.
 			_ = pprof.Handler
-			if cfg.Pprof.Enable {
+			if vals.Pprof.Enable {
 				//nolint:revive
-				defer ServeHandler(ctx, logger, nil, cfg.Pprof.Address.String(), "pprof")()
-			}
-			if cfg.Prometheus.Enable {
-				options.PrometheusRegistry.MustRegister(collectors.NewGoCollector())
-				options.PrometheusRegistry.MustRegister(collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}))
-
-				closeUsersFunc, err := prometheusmetrics.ActiveUsers(ctx, options.PrometheusRegistry, options.Database, 0)
-				if err != nil {
-					return xerrors.Errorf("register active users prometheus metric: %w", err)
-				}
-				defer closeUsersFunc()
-
-				closeWorkspacesFunc, err := prometheusmetrics.Workspaces(ctx, options.PrometheusRegistry, options.Database, 0)
+				defer ServeHandler(ctx, logger, nil, vals.Pprof.Address.String(), "pprof")()
+			}
+			if vals.Prometheus.Enable {
+				closeFn, err := enablePrometheus(
+					ctx,
+					logger.Named("prometheus"),
+					vals,
+					options,
+				)
 				if err != nil {
-					return xerrors.Errorf("register workspaces prometheus metric: %w", err)
-				}
-				defer closeWorkspacesFunc()
-
-				if cfg.Prometheus.CollectAgentStats {
-					closeAgentStatsFunc, err := prometheusmetrics.AgentStats(ctx, logger, options.PrometheusRegistry, options.Database, time.Now(), 0)
-					if err != nil {
-						return xerrors.Errorf("register agent stats prometheus metric: %w", err)
-					}
-					defer closeAgentStatsFunc()
-
-					metricsAggregator, err := prometheusmetrics.NewMetricsAggregator(logger, options.PrometheusRegistry, 0)
-					if err != nil {
-						return xerrors.Errorf("can't initialize metrics aggregator: %w", err)
-					}
-
-					cancelMetricsAggregator := metricsAggregator.Run(ctx)
-					defer cancelMetricsAggregator()
-
-					options.UpdateAgentMetrics = metricsAggregator.Update
-					err = options.PrometheusRegistry.Register(metricsAggregator)
-					if err != nil {
-						return xerrors.Errorf("can't register metrics aggregator as collector: %w", err)
-					}
+					return xerrors.Errorf("enable prometheus: %w", err)
 				}
-
-				//nolint:revive
-				defer ServeHandler(ctx, logger, promhttp.InstrumentMetricHandler(
-					options.PrometheusRegistry, promhttp.HandlerFor(options.PrometheusRegistry, promhttp.HandlerOpts{}),
-				), cfg.Prometheus.Address.String(), "prometheus")()
+				defer closeFn()
 			}
 
-			if cfg.Swagger.Enable {
-				options.SwaggerEndpoint = cfg.Swagger.Enable.Value()
+			if vals.Swagger.Enable {
+				options.SwaggerEndpoint = vals.Swagger.Enable.Value()
 			}
 
-			closeCheckInactiveUsersFunc := dormancy.CheckInactiveUsers(ctx, logger, options.Database)
-			defer closeCheckInactiveUsersFunc()
+			batcher, closeBatcher, err := batchstats.New(ctx,
+				batchstats.WithLogger(options.Logger.Named("batchstats")),
+				batchstats.WithStore(options.Database),
+			)
+			if err != nil {
+				return xerrors.Errorf("failed to create agent stats batcher: %w", err)
+			}
+			options.StatsBatcher = batcher
+			defer closeBatcher()
 
 			// We use a separate coderAPICloser so the Enterprise API
 			// can have it's own close functions. This is cleaner
@@ -824,7 +827,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				return xerrors.Errorf("create coder API: %w", err)
 			}
 
-			if cfg.Prometheus.Enable {
+			if vals.Prometheus.Enable {
 				// Agent metrics require reference to the tailnet coordinator, so must be initiated after Coder API.
 				closeAgentsFunc, err := prometheusmetrics.Agents(ctx, logger, options.PrometheusRegistry, coderAPI.Database, &coderAPI.TailnetCoordinator, coderAPI.DERPMap, coderAPI.Options.AgentInactiveDisconnectTimeout, 0)
 				if err != nil {
@@ -872,10 +875,10 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 			var provisionerdWaitGroup sync.WaitGroup
 			defer provisionerdWaitGroup.Wait()
 			provisionerdMetrics := provisionerd.NewMetrics(options.PrometheusRegistry)
-			for i := int64(0); i < cfg.Provisioner.Daemons.Value(); i++ {
+			for i := int64(0); i < vals.Provisioner.Daemons.Value(); i++ {
 				daemonCacheDir := filepath.Join(cacheDir, fmt.Sprintf("provisioner-%d", i))
 				daemon, err := newProvisionerDaemon(
-					ctx, coderAPI, provisionerdMetrics, logger, cfg, daemonCacheDir, errCh, &provisionerdWaitGroup,
+					ctx, coderAPI, provisionerdMetrics, logger, vals, daemonCacheDir, errCh, &provisionerdWaitGroup,
 				)
 				if err != nil {
 					return xerrors.Errorf("create provisioner daemon: %w", err)
@@ -894,8 +897,8 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 			// Wrap the server in middleware that redirects to the access URL if
 			// the request is not to a local IP.
 			var handler http.Handler = coderAPI.RootHandler
-			if cfg.RedirectToAccessURL {
-				handler = redirectToAccessURL(handler, cfg.AccessURL.Value(), tunnel != nil, appHostnameRegex)
+			if vals.RedirectToAccessURL {
+				handler = redirectToAccessURL(handler, vals.AccessURL.Value(), tunnel != nil, appHostnameRegex)
 			}
 
 			// ReadHeaderTimeout is purposefully not enabled. It caused some
@@ -952,12 +955,13 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				return xerrors.Errorf("notify systemd: %w", err)
 			}
 
-			autobuildTicker := time.NewTicker(cfg.AutobuildPollInterval.Value())
+			autobuildTicker := time.NewTicker(vals.AutobuildPollInterval.Value())
 			defer autobuildTicker.Stop()
-			autobuildExecutor := autobuild.NewExecutor(ctx, options.Database, coderAPI.TemplateScheduleStore, logger, autobuildTicker.C)
+			autobuildExecutor := autobuild.NewExecutor(
+				ctx, options.Database, options.Pubsub, coderAPI.TemplateScheduleStore, &coderAPI.Auditor, coderAPI.AccessControlStore, logger, autobuildTicker.C)
 			autobuildExecutor.Run()
 
-			hangDetectorTicker := time.NewTicker(cfg.JobHangDetectorInterval.Value())
+			hangDetectorTicker := time.NewTicker(vals.JobHangDetectorInterval.Value())
 			defer hangDetectorTicker.Stop()
 			hangDetector := unhanger.New(ctx, options.Database, options.Pubsub, logger, hangDetectorTicker.C)
 			hangDetector.Start()
@@ -970,9 +974,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 			select {
 			case <-notifyCtx.Done():
 				exitErr = notifyCtx.Err()
-				_, _ = fmt.Fprintln(inv.Stdout, cliui.DefaultStyles.Bold.Render(
-					"Interrupt caught, gracefully exiting. Use ctrl+\\ to force quit",
-				))
+				_, _ = io.WriteString(inv.Stdout, cliui.Bold("Interrupt caught, gracefully exiting. Use ctrl+\\ to force quit"))
 			case <-tunnelDone:
 				exitErr = xerrors.New("dev tunnel closed unexpectedly")
 			case exitErr = <-errCh:
@@ -1016,9 +1018,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				go func() {
 					defer wg.Done()
 
-					if ok, _ := inv.ParsedFlags().GetBool(varVerbose); ok {
-						cliui.Infof(inv.Stdout, "Shutting down provisioner daemon %d...\n", id)
-					}
+					r.Verbosef(inv, "Shutting down provisioner daemon %d...", id)
 					err := shutdownWithTimeout(provisionerDaemon.Shutdown, 5*time.Second)
 					if err != nil {
 						cliui.Errorf(inv.Stderr, "Failed to shutdown provisioner daemon %d: %s\n", id, err)
@@ -1029,9 +1029,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 						cliui.Errorf(inv.Stderr, "Close provisioner daemon %d: %s\n", id, err)
 						return
 					}
-					if ok, _ := inv.ParsedFlags().GetBool(varVerbose); ok {
-						cliui.Infof(inv.Stdout, "Gracefully shut down provisioner daemon %d\n", id)
-					}
+					r.Verbosef(inv, "Gracefully shut down provisioner daemon %d", id)
 				}()
 			}
 			wg.Wait()
@@ -1082,7 +1080,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 			if pgRawURL {
 				_, _ = fmt.Fprintf(inv.Stdout, "%s\n", url)
 			} else {
-				_, _ = fmt.Fprintf(inv.Stdout, "%s\n", cliui.DefaultStyles.Code.Render(fmt.Sprintf("psql %q", url)))
+				_, _ = fmt.Fprintf(inv.Stdout, "%s\n", pretty.Sprint(cliui.DefaultStyles.Code, fmt.Sprintf("psql %q", url)))
 			}
 			return nil
 		},
@@ -1112,7 +1110,7 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 			if pgRawURL {
 				_, _ = fmt.Fprintf(inv.Stdout, "%s\n", url)
 			} else {
-				_, _ = fmt.Fprintf(inv.Stdout, "%s\n", cliui.DefaultStyles.Code.Render(fmt.Sprintf("psql %q", url)))
+				_, _ = fmt.Fprintf(inv.Stdout, "%s\n", pretty.Sprint(cliui.DefaultStyles.Code, fmt.Sprintf("psql %q", url)))
 			}
 
 			<-ctx.Done()
@@ -1208,6 +1206,14 @@ func WriteConfigMW(cfg *codersdk.DeploymentValues) clibase.MiddlewareFunc {
 // isLocalURL returns true if the hostname of the provided URL appears to
 // resolve to a loopback address.
 func IsLocalURL(ctx context.Context, u *url.URL) (bool, error) {
+	// In tests, we commonly use "example.com" or "google.com", which
+	// are not loopback, so avoid the DNS lookup to avoid flakes.
+	if flag.Lookup("test.v") != nil {
+		if u.Hostname() == "example.com" || u.Hostname() == "google.com" {
+			return false, nil
+		}
+	}
+
 	resolver := &net.Resolver{}
 	ips, err := resolver.LookupIPAddr(ctx, u.Hostname())
 	if err != nil {
@@ -1257,7 +1263,7 @@ func newProvisionerDaemon(
 		return nil, xerrors.Errorf("mkdir work dir: %w", err)
 	}
 
-	provisioners := provisionerd.Provisioners{}
+	connector := provisionerd.LocalProvisioners{}
 	if cfg.Provisioner.DaemonsEcho {
 		echoClient, echoServer := provisionersdk.MemTransportPipe()
 		wg.Add(1)
@@ -1272,7 +1278,11 @@ func newProvisionerDaemon(
 			defer wg.Done()
 			defer cancel()
 
-			err := echo.Serve(ctx, afero.NewOsFs(), &provisionersdk.ServeOptions{Listener: echoServer})
+			err := echo.Serve(ctx, &provisionersdk.ServeOptions{
+				Listener:      echoServer,
+				WorkDirectory: workDir,
+				Logger:        logger.Named("echo"),
+			})
 			if err != nil {
 				select {
 				case errCh <- err:
@@ -1280,7 +1290,7 @@ func newProvisionerDaemon(
 				}
 			}
 		}()
-		provisioners[string(database.ProvisionerTypeEcho)] = sdkproto.NewDRPCProvisionerClient(echoClient)
+		connector[string(database.ProvisionerTypeEcho)] = sdkproto.NewDRPCProvisionerClient(echoClient)
 	} else {
 		tfDir := filepath.Join(cacheDir, "tf")
 		err = os.MkdirAll(tfDir, 0o700)
@@ -1304,10 +1314,11 @@ func newProvisionerDaemon(
 
 			err := terraform.Serve(ctx, &terraform.ServeOptions{
 				ServeOptions: &provisionersdk.ServeOptions{
-					Listener: terraformServer,
+					Listener:      terraformServer,
+					Logger:        logger.Named("terraform"),
+					WorkDirectory: workDir,
 				},
 				CachePath: tfDir,
-				Logger:    logger,
 				Tracer:    tracer,
 			})
 			if err != nil && !xerrors.Is(err, context.Canceled) {
@@ -1318,23 +1329,18 @@ func newProvisionerDaemon(
 			}
 		}()
 
-		provisioners[string(database.ProvisionerTypeTerraform)] = sdkproto.NewDRPCProvisionerClient(terraformClient)
+		connector[string(database.ProvisionerTypeTerraform)] = sdkproto.NewDRPCProvisionerClient(terraformClient)
 	}
 
-	debounce := time.Second
 	return provisionerd.New(func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 		// This debounces calls to listen every second. Read the comment
 		// in provisionerdserver.go to learn more!
-		return coderAPI.CreateInMemoryProvisionerDaemon(ctx, debounce)
+		return coderAPI.CreateInMemoryProvisionerDaemon(ctx)
 	}, &provisionerd.Options{
-		Logger:              logger,
-		JobPollInterval:     cfg.Provisioner.DaemonPollInterval.Value(),
-		JobPollJitter:       cfg.Provisioner.DaemonPollJitter.Value(),
-		JobPollDebounce:     debounce,
+		Logger:              logger.Named("provisionerd"),
 		UpdateInterval:      time.Second,
 		ForceCancelInterval: cfg.Provisioner.ForceCancelInterval.Value(),
-		Provisioners:        provisioners,
-		WorkDirectory:       workDir,
+		Connector:           connector,
 		TracerProvider:      coderAPI.TracerProvider,
 		Metrics:             &metrics,
 	}), nil
@@ -1347,7 +1353,7 @@ func PrintLogo(inv *clibase.Invocation, daemonTitle string) {
 		return
 	}
 
-	versionString := cliui.DefaultStyles.Bold.Render(daemonTitle + " " + buildinfo.Version())
+	versionString := cliui.Bold(daemonTitle + " " + buildinfo.Version())
 
 	_, _ = fmt.Fprintf(inv.Stdout, "%s - Your Self-Hosted Remote Development Platform\n", versionString)
 }
@@ -1481,6 +1487,33 @@ func configureTLS(tlsMinVersion, tlsClientAuth string, tlsCertFiles, tlsKeyFiles
 	return tlsConfig, nil
 }
 
+func configureOIDCPKI(orig *oauth2.Config, keyFile string, certFile string) (*oauthpki.Config, error) {
+	// Read the files
+	keyData, err := os.ReadFile(keyFile)
+	if err != nil {
+		return nil, xerrors.Errorf("read oidc client key file: %w", err)
+	}
+
+	var certData []byte
+	// According to the spec, this is not required. So do not require it on the initial loading
+	// of the PKI config.
+	if certFile != "" {
+		certData, err = os.ReadFile(certFile)
+		if err != nil {
+			return nil, xerrors.Errorf("read oidc client cert file: %w", err)
+		}
+	}
+
+	return oauthpki.NewOauth2PKIConfig(oauthpki.ConfigParams{
+		ClientID:       orig.ClientID,
+		TokenURL:       orig.Endpoint.TokenURL,
+		Scopes:         orig.Scopes,
+		PemEncodedKey:  keyData,
+		PemEncodedCert: certData,
+		Config:         orig,
+	})
+}
+
 func configureCAPool(tlsClientCAFile string, tlsConfig *tls.Config) error {
 	if tlsClientCAFile != "" {
 		caPool := x509.NewCertPool()
@@ -1786,7 +1819,7 @@ func (f *debugFilterSink) compile(res []string) error {
 func (f *debugFilterSink) LogEntry(ctx context.Context, ent slog.SinkEntry) {
 	if ent.Level == slog.LevelDebug {
 		logName := strings.Join(ent.LoggerNames, ".")
-		if f.re != nil && !f.re.MatchString(logName) {
+		if f.re != nil && !f.re.MatchString(logName) && !f.re.MatchString(ent.Message) {
 			return
 		}
 	}
@@ -1870,45 +1903,49 @@ func BuildLogger(inv *clibase.Invocation, cfg *codersdk.DeploymentValues) (slog.
 	}, nil
 }
 
-func connectToPostgres(ctx context.Context, logger slog.Logger, driver string, dbURL string) (*sql.DB, error) {
+func ConnectToPostgres(ctx context.Context, logger slog.Logger, driver string, dbURL string) (sqlDB *sql.DB, err error) {
 	logger.Debug(ctx, "connecting to postgresql")
 
 	// Try to connect for 30 seconds.
 	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
 	defer cancel()
 
-	var (
-		sqlDB *sql.DB
-		err   error
-		ok    = false
-		tries int
-	)
+	defer func() {
+		if err == nil {
+			return
+		}
+		if sqlDB != nil {
+			_ = sqlDB.Close()
+			sqlDB = nil
+		}
+		logger.Error(ctx, "connect to postgres failed", slog.Error(err))
+	}()
+
+	var tries int
 	for r := retry.New(time.Second, 3*time.Second); r.Wait(ctx); {
 		tries++
 
 		sqlDB, err = sql.Open(driver, dbURL)
 		if err != nil {
-			logger.Warn(ctx, "connect to postgres; retrying", slog.Error(err), slog.F("try", tries))
+			logger.Warn(ctx, "connect to postgres: retrying", slog.Error(err), slog.F("try", tries))
 			continue
 		}
 
 		err = pingPostgres(ctx, sqlDB)
 		if err != nil {
-			logger.Warn(ctx, "ping postgres; retrying", slog.Error(err), slog.F("try", tries))
+			logger.Warn(ctx, "ping postgres: retrying", slog.Error(err), slog.F("try", tries))
+			_ = sqlDB.Close()
+			sqlDB = nil
 			continue
 		}
 
 		break
 	}
-	// Make sure we close the DB in case it opened but the ping failed for some
-	// reason.
-	defer func() {
-		if !ok && sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	}()
+	if err == nil {
+		err = ctx.Err()
+	}
 	if err != nil {
-		return nil, xerrors.Errorf("connect to postgres; tries %d; last error: %w", tries, err)
+		return nil, xerrors.Errorf("unable to connect after %d tries; last error: %w", tries, err)
 	}
 
 	// Ensure the PostgreSQL version is >=13.0.0!
@@ -1953,7 +1990,6 @@ func connectToPostgres(ctx context.Context, logger slog.Logger, driver string, d
 	// of connection churn.
 	sqlDB.SetMaxIdleConns(3)
 
-	ok = true
 	return sqlDB, nil
 }
 
@@ -2004,7 +2040,6 @@ func (s *HTTPServers) Close() {
 func ConfigureTraceProvider(
 	ctx context.Context,
 	logger slog.Logger,
-	inv *clibase.Invocation,
 	cfg *codersdk.DeploymentValues,
 ) (trace.TracerProvider, string, func(context.Context) error) {
 	var (
@@ -2012,19 +2047,18 @@ func ConfigureTraceProvider(
 		closeTracing   = func(context.Context) error { return nil }
 		sqlDriver      = "postgres"
 	)
-	// Coder tracing should be disabled if telemetry is disabled unless
-	// --telemetry-trace was explicitly provided.
-	shouldCoderTrace := cfg.Telemetry.Enable.Value() && !isTest()
-	// Only override if telemetryTraceEnable was specifically set.
-	// By default we want it to be controlled by telemetryEnable.
-	if inv.ParsedFlags().Changed("telemetry-trace") {
-		shouldCoderTrace = cfg.Telemetry.Trace.Value()
-	}
 
-	if cfg.Trace.Enable.Value() || shouldCoderTrace || cfg.Trace.HoneycombAPIKey != "" {
+	otel.SetTextMapPropagator(
+		propagation.NewCompositeTextMapPropagator(
+			propagation.TraceContext{},
+			propagation.Baggage{},
+		),
+	)
+
+	if cfg.Trace.Enable.Value() || cfg.Trace.DataDog.Value() || cfg.Trace.HoneycombAPIKey != "" {
 		sdkTracerProvider, _closeTracing, err := tracing.TracerProvider(ctx, "coderd", tracing.TracerOpts{
 			Default:   cfg.Trace.Enable.Value(),
-			Coder:     shouldCoderTrace,
+			DataDog:   cfg.Trace.DataDog.Value(),
 			Honeycomb: cfg.Trace.HoneycombAPIKey.String(),
 		})
 		if err != nil {
@@ -2167,3 +2201,103 @@ func ConfigureHTTPServers(inv *clibase.Invocation, cfg *codersdk.DeploymentValue
 
 	return httpServers, nil
 }
+
+// ReadExternalAuthProvidersFromEnv is provided for compatibility purposes with
+// the viper CLI.
+func ReadExternalAuthProvidersFromEnv(environ []string) ([]codersdk.ExternalAuthConfig, error) {
+	providers, err := parseExternalAuthProvidersFromEnv("CODER_EXTERNAL_AUTH_", environ)
+	if err != nil {
+		return nil, err
+	}
+	// Deprecated: To support legacy git auth!
+	gitProviders, err := parseExternalAuthProvidersFromEnv("CODER_GITAUTH_", environ)
+	if err != nil {
+		return nil, err
+	}
+	return append(providers, gitProviders...), nil
+}
+
+// parseExternalAuthProvidersFromEnv consumes environment variables to parse
+// external auth providers. A prefix is provided to support the legacy
+// parsing of `GITAUTH` environment variables.
+func parseExternalAuthProvidersFromEnv(prefix string, environ []string) ([]codersdk.ExternalAuthConfig, error) {
+	// The index numbers must be in-order.
+	sort.Strings(environ)
+
+	var providers []codersdk.ExternalAuthConfig
+	for _, v := range clibase.ParseEnviron(environ, prefix) {
+		tokens := strings.SplitN(v.Name, "_", 2)
+		if len(tokens) != 2 {
+			return nil, xerrors.Errorf("invalid env var: %s", v.Name)
+		}
+
+		providerNum, err := strconv.Atoi(tokens[0])
+		if err != nil {
+			return nil, xerrors.Errorf("parse number: %s", v.Name)
+		}
+
+		var provider codersdk.ExternalAuthConfig
+		switch {
+		case len(providers) < providerNum:
+			return nil, xerrors.Errorf(
+				"provider num %v skipped: %s",
+				len(providers),
+				v.Name,
+			)
+		case len(providers) == providerNum:
+			// At the next next provider.
+			providers = append(providers, provider)
+		case len(providers) == providerNum+1:
+			// At the current provider.
+			provider = providers[providerNum]
+		}
+
+		key := tokens[1]
+		switch key {
+		case "ID":
+			provider.ID = v.Value
+		case "TYPE":
+			provider.Type = v.Value
+		case "CLIENT_ID":
+			provider.ClientID = v.Value
+		case "CLIENT_SECRET":
+			provider.ClientSecret = v.Value
+		case "AUTH_URL":
+			provider.AuthURL = v.Value
+		case "TOKEN_URL":
+			provider.TokenURL = v.Value
+		case "VALIDATE_URL":
+			provider.ValidateURL = v.Value
+		case "REGEX":
+			provider.Regex = v.Value
+		case "DEVICE_FLOW":
+			b, err := strconv.ParseBool(v.Value)
+			if err != nil {
+				return nil, xerrors.Errorf("parse bool: %s", v.Value)
+			}
+			provider.DeviceFlow = b
+		case "DEVICE_CODE_URL":
+			provider.DeviceCodeURL = v.Value
+		case "NO_REFRESH":
+			b, err := strconv.ParseBool(v.Value)
+			if err != nil {
+				return nil, xerrors.Errorf("parse bool: %s", v.Value)
+			}
+			provider.NoRefresh = b
+		case "SCOPES":
+			provider.Scopes = strings.Split(v.Value, " ")
+		case "EXTRA_TOKEN_KEYS":
+			provider.ExtraTokenKeys = strings.Split(v.Value, " ")
+		case "APP_INSTALL_URL":
+			provider.AppInstallURL = v.Value
+		case "APP_INSTALLATIONS_URL":
+			provider.AppInstallationsURL = v.Value
+		case "DISPLAY_NAME":
+			provider.DisplayName = v.Value
+		case "DISPLAY_ICON":
+			provider.DisplayIcon = v.Value
+		}
+		providers[providerNum] = provider
+	}
+	return providers, nil
+}
diff --git a/cli/server_createadminuser.go b/cli/server_createadminuser.go
index fbdfed6b8016e..fa82e4fbcd051 100644
--- a/cli/server_createadminuser.go
+++ b/cli/server_createadminuser.go
@@ -12,14 +12,15 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/gitsshkey"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/userpassword"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/gitsshkey"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/userpassword"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) newCreateAdminUserCommand() *clibase.Cmd {
@@ -51,7 +52,7 @@ func (r *RootCmd) newCreateAdminUserCommand() *clibase.Cmd {
 			defer cancel()
 
 			if newUserDBURL == "" {
-				cliui.Infof(inv.Stdout, "Using built-in PostgreSQL (%s)\n", cfg.PostgresPath())
+				cliui.Infof(inv.Stdout, "Using built-in PostgreSQL (%s)", cfg.PostgresPath())
 				url, closePg, err := startBuiltinPostgres(ctx, cfg, logger)
 				if err != nil {
 					return err
@@ -62,7 +63,7 @@ func (r *RootCmd) newCreateAdminUserCommand() *clibase.Cmd {
 				newUserDBURL = url
 			}
 
-			sqlDB, err := connectToPostgres(ctx, logger, "postgres", newUserDBURL)
+			sqlDB, err := ConnectToPostgres(ctx, logger, "postgres", newUserDBURL)
 			if err != nil {
 				return xerrors.Errorf("connect to postgres: %w", err)
 			}
@@ -180,8 +181,8 @@ func (r *RootCmd) newCreateAdminUserCommand() *clibase.Cmd {
 					Email:          newUserEmail,
 					Username:       newUserUsername,
 					HashedPassword: []byte(hashedPassword),
-					CreatedAt:      database.Now(),
-					UpdatedAt:      database.Now(),
+					CreatedAt:      dbtime.Now(),
+					UpdatedAt:      dbtime.Now(),
 					RBACRoles:      []string{rbac.RoleOwner()},
 					LoginType:      database.LoginTypePassword,
 				})
@@ -196,8 +197,8 @@ func (r *RootCmd) newCreateAdminUserCommand() *clibase.Cmd {
 				}
 				_, err = tx.InsertGitSSHKey(ctx, database.InsertGitSSHKeyParams{
 					UserID:     newUser.ID,
-					CreatedAt:  database.Now(),
-					UpdatedAt:  database.Now(),
+					CreatedAt:  dbtime.Now(),
+					UpdatedAt:  dbtime.Now(),
 					PrivateKey: privateKey,
 					PublicKey:  publicKey,
 				})
@@ -210,8 +211,8 @@ func (r *RootCmd) newCreateAdminUserCommand() *clibase.Cmd {
 					_, err := tx.InsertOrganizationMember(ctx, database.InsertOrganizationMemberParams{
 						OrganizationID: org.ID,
 						UserID:         newUser.ID,
-						CreatedAt:      database.Now(),
-						UpdatedAt:      database.Now(),
+						CreatedAt:      dbtime.Now(),
+						UpdatedAt:      dbtime.Now(),
 						Roles:          []string{rbac.RoleOrgAdmin(org.ID)},
 					})
 					if err != nil {
diff --git a/cli/server_createadminuser_test.go b/cli/server_createadminuser_test.go
index 4daca225d71f7..024c3f50f231d 100644
--- a/cli/server_createadminuser_test.go
+++ b/cli/server_createadminuser_test.go
@@ -11,13 +11,14 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/postgres"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/userpassword"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/postgres"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/userpassword"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 //nolint:paralleltest, tparallel
@@ -106,15 +107,15 @@ func TestServerCreateAdminUser(t *testing.T) {
 		_, err = db.InsertOrganization(ctx, database.InsertOrganizationParams{
 			ID:        org1ID,
 			Name:      org1Name,
-			CreatedAt: database.Now(),
-			UpdatedAt: database.Now(),
+			CreatedAt: dbtime.Now(),
+			UpdatedAt: dbtime.Now(),
 		})
 		require.NoError(t, err)
 		_, err = db.InsertOrganization(ctx, database.InsertOrganizationParams{
 			ID:        org2ID,
 			Name:      org2Name,
-			CreatedAt: database.Now(),
-			UpdatedAt: database.Now(),
+			CreatedAt: dbtime.Now(),
+			UpdatedAt: dbtime.Now(),
 		})
 		require.NoError(t, err)
 
diff --git a/cli/server_slim.go b/cli/server_slim.go
index 4703f20b7669f..d3a4693ec7634 100644
--- a/cli/server_slim.go
+++ b/cli/server_slim.go
@@ -3,17 +3,10 @@
 package cli
 
 import (
-	"context"
-	"fmt"
-	"io"
-	"os"
-
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd"
+	"github.com/coder/coder/v2/cli/clibase"
 )
 
-func (r *RootCmd) Server(_ func(context.Context, *coderd.Options) (*coderd.API, io.Closer, error)) *clibase.Cmd {
+func (r *RootCmd) Server(_ func()) *clibase.Cmd {
 	root := &clibase.Cmd{
 		Use:   "server",
 		Short: "Start a Coder server",
@@ -21,18 +14,10 @@ func (r *RootCmd) Server(_ func(context.Context, *coderd.Options) (*coderd.API,
 		RawArgs: true,
 		Hidden:  true,
 		Handler: func(inv *clibase.Invocation) error {
-			serverUnsupported(inv.Stderr)
+			SlimUnsupported(inv.Stderr, "server")
 			return nil
 		},
 	}
 
 	return root
 }
-
-func serverUnsupported(w io.Writer) {
-	_, _ = fmt.Fprintf(w, "You are using a 'slim' build of Coder, which does not support the %s subcommand.\n", cliui.DefaultStyles.Code.Render("server"))
-	_, _ = fmt.Fprintln(w, "")
-	_, _ = fmt.Fprintln(w, "Please use a build of Coder from GitHub releases:")
-	_, _ = fmt.Fprintln(w, "  https://github.com/coder/coder/releases")
-	os.Exit(1)
-}
diff --git a/cli/server_test.go b/cli/server_test.go
index ee00499c4d2a6..7034f2fa33d33 100644
--- a/cli/server_test.go
+++ b/cli/server_test.go
@@ -34,23 +34,65 @@ import (
 	"go.uber.org/goleak"
 	"gopkg.in/yaml.v3"
 
-	"github.com/coder/coder/cli"
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/cli/config"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database/postgres"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"cdr.dev/slog/sloggers/slogtest"
+
+	"github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/config"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/postgres"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
+func TestReadExternalAuthProvidersFromEnv(t *testing.T) {
+	t.Parallel()
+	t.Run("Valid", func(t *testing.T) {
+		t.Parallel()
+		providers, err := cli.ReadExternalAuthProvidersFromEnv([]string{
+			"CODER_EXTERNAL_AUTH_0_ID=1",
+			"CODER_EXTERNAL_AUTH_0_TYPE=gitlab",
+			"CODER_EXTERNAL_AUTH_1_ID=2",
+			"CODER_EXTERNAL_AUTH_1_CLIENT_ID=sid",
+			"CODER_EXTERNAL_AUTH_1_CLIENT_SECRET=hunter12",
+			"CODER_EXTERNAL_AUTH_1_TOKEN_URL=google.com",
+			"CODER_EXTERNAL_AUTH_1_VALIDATE_URL=bing.com",
+			"CODER_EXTERNAL_AUTH_1_SCOPES=repo:read repo:write",
+			"CODER_EXTERNAL_AUTH_1_NO_REFRESH=true",
+			"CODER_EXTERNAL_AUTH_1_DISPLAY_NAME=Google",
+			"CODER_EXTERNAL_AUTH_1_DISPLAY_ICON=/icon/google.svg",
+		})
+		require.NoError(t, err)
+		require.Len(t, providers, 2)
+
+		// Validate the first provider.
+		assert.Equal(t, "1", providers[0].ID)
+		assert.Equal(t, "gitlab", providers[0].Type)
+
+		// Validate the second provider.
+		assert.Equal(t, "2", providers[1].ID)
+		assert.Equal(t, "sid", providers[1].ClientID)
+		assert.Equal(t, "hunter12", providers[1].ClientSecret)
+		assert.Equal(t, "google.com", providers[1].TokenURL)
+		assert.Equal(t, "bing.com", providers[1].ValidateURL)
+		assert.Equal(t, []string{"repo:read", "repo:write"}, providers[1].Scopes)
+		assert.Equal(t, true, providers[1].NoRefresh)
+		assert.Equal(t, "Google", providers[1].DisplayName)
+		assert.Equal(t, "/icon/google.svg", providers[1].DisplayIcon)
+	})
+}
+
+// TestReadGitAuthProvidersFromEnv ensures that the deprecated `CODER_GITAUTH_`
+// environment variables are still supported.
 func TestReadGitAuthProvidersFromEnv(t *testing.T) {
 	t.Parallel()
 	t.Run("Empty", func(t *testing.T) {
 		t.Parallel()
-		providers, err := cli.ReadGitAuthProvidersFromEnv([]string{
+		providers, err := cli.ReadExternalAuthProvidersFromEnv([]string{
 			"HOME=/home/frodo",
 		})
 		require.NoError(t, err)
@@ -58,7 +100,7 @@ func TestReadGitAuthProvidersFromEnv(t *testing.T) {
 	})
 	t.Run("InvalidKey", func(t *testing.T) {
 		t.Parallel()
-		providers, err := cli.ReadGitAuthProvidersFromEnv([]string{
+		providers, err := cli.ReadExternalAuthProvidersFromEnv([]string{
 			"CODER_GITAUTH_XXX=invalid",
 		})
 		require.Error(t, err, "providers: %+v", providers)
@@ -66,7 +108,7 @@ func TestReadGitAuthProvidersFromEnv(t *testing.T) {
 	})
 	t.Run("SkipKey", func(t *testing.T) {
 		t.Parallel()
-		providers, err := cli.ReadGitAuthProvidersFromEnv([]string{
+		providers, err := cli.ReadExternalAuthProvidersFromEnv([]string{
 			"CODER_GITAUTH_0_ID=invalid",
 			"CODER_GITAUTH_2_ID=invalid",
 		})
@@ -75,7 +117,7 @@ func TestReadGitAuthProvidersFromEnv(t *testing.T) {
 	})
 	t.Run("Valid", func(t *testing.T) {
 		t.Parallel()
-		providers, err := cli.ReadGitAuthProvidersFromEnv([]string{
+		providers, err := cli.ReadExternalAuthProvidersFromEnv([]string{
 			"CODER_GITAUTH_0_ID=1",
 			"CODER_GITAUTH_0_TYPE=gitlab",
 			"CODER_GITAUTH_1_ID=2",
@@ -1185,6 +1227,22 @@ func TestServer(t *testing.T) {
 			require.Equal(t, map[string]string{"serious_business_unit": "serious_business_unit"}, deploymentConfig.Values.OIDC.GroupMapping.Value)
 			require.Equal(t, "Sign In With Coder", deploymentConfig.Values.OIDC.SignInText.Value())
 			require.Equal(t, "https://example.com/icon.png", deploymentConfig.Values.OIDC.IconURL.Value().String())
+
+			// Verify the option values
+			for _, opt := range deploymentConfig.Options {
+				switch opt.Flag {
+				case "access-url":
+					require.Equal(t, "http://example.com", opt.Value.String())
+				case "oidc-icon-url":
+					require.Equal(t, "https://example.com/icon.png", opt.Value.String())
+				case "oidc-sign-in-text":
+					require.Equal(t, "Sign In With Coder", opt.Value.String())
+				case "redirect-to-access-url":
+					require.Equal(t, "false", opt.Value.String())
+				case "derp-server-region-id":
+					require.Equal(t, "999", opt.Value.String())
+				}
+			}
 		})
 	})
 
@@ -1309,6 +1367,7 @@ func TestServer(t *testing.T) {
 				"--in-memory",
 				"--http-address", ":0",
 				"--access-url", "http://example.com",
+				"--provisioner-daemons-echo",
 				"--log-human", fiName,
 			)
 			clitest.Start(t, root)
@@ -1326,6 +1385,7 @@ func TestServer(t *testing.T) {
 				"--in-memory",
 				"--http-address", ":0",
 				"--access-url", "http://example.com",
+				"--provisioner-daemons-echo",
 				"--log-human", fi,
 			)
 			clitest.Start(t, root)
@@ -1343,6 +1403,7 @@ func TestServer(t *testing.T) {
 				"--in-memory",
 				"--http-address", ":0",
 				"--access-url", "http://example.com",
+				"--provisioner-daemons-echo",
 				"--log-json", fi,
 			)
 			clitest.Start(t, root)
@@ -1363,6 +1424,7 @@ func TestServer(t *testing.T) {
 				"--in-memory",
 				"--http-address", ":0",
 				"--access-url", "http://example.com",
+				"--provisioner-daemons-echo",
 				"--log-stackdriver", fi,
 			)
 			// Attach pty so we get debug output from the command if this test
@@ -1397,6 +1459,7 @@ func TestServer(t *testing.T) {
 				"--in-memory",
 				"--http-address", ":0",
 				"--access-url", "http://example.com",
+				"--provisioner-daemons-echo",
 				"--log-human", fi1,
 				"--log-json", fi2,
 				"--log-stackdriver", fi3,
@@ -1480,6 +1543,9 @@ func TestServer(t *testing.T) {
 			gotConfig.Options.ByName("Config Path").Value.Set("")
 			// We check the options individually for better error messages.
 			for i := range wantConfig.Options {
+				// ValueSource is not going to be correct on the `want`, so just
+				// match that field.
+				wantConfig.Options[i].ValueSource = gotConfig.Options[i].ValueSource
 				assert.Equal(
 					t, wantConfig.Options[i],
 					gotConfig.Options[i],
@@ -1491,31 +1557,6 @@ func TestServer(t *testing.T) {
 			w.RequireSuccess()
 		})
 	})
-	t.Run("DisableDERP", func(t *testing.T) {
-		t.Parallel()
-
-		// Make sure that $CODER_DERP_SERVER_STUN_ADDRESSES can be set to
-		// disable STUN.
-
-		inv, cfg := clitest.New(t,
-			"server",
-			"--in-memory",
-			"--http-address", ":0",
-			"--access-url", "https://example.com",
-		)
-		inv.Environ.Set("CODER_DERP_SERVER_STUN_ADDRESSES", "disable")
-		ptytest.New(t).Attach(inv)
-		clitest.Start(t, inv)
-		gotURL := waitAccessURL(t, cfg)
-		client := codersdk.New(gotURL)
-
-		ctx := testutil.Context(t, testutil.WaitMedium)
-		_ = coderdtest.CreateFirstUser(t, client)
-		gotConfig, err := client.DeploymentConfig(ctx)
-		require.NoError(t, err)
-
-		require.Len(t, gotConfig.Values.DERP.Server.STUNAddresses, 0)
-	})
 }
 
 func TestServer_Production(t *testing.T) {
@@ -1581,6 +1622,20 @@ func TestServer_Shutdown(t *testing.T) {
 	require.NoError(t, err)
 }
 
+func BenchmarkServerHelp(b *testing.B) {
+	// server --help is a good proxy for measuring the
+	// constant overhead of each command.
+
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		inv, _ := clitest.New(b, "server", "--help")
+		inv.Stdout = io.Discard
+		inv.Stderr = io.Discard
+		err := inv.Run()
+		require.NoError(b, err)
+	}
+}
+
 func generateTLSCertificate(t testing.TB, commonName ...string) (certPath, keyPath string) {
 	dir := t.TempDir()
 
@@ -1677,3 +1732,26 @@ func TestServerYAMLConfig(t *testing.T) {
 
 	require.Equal(t, string(wantByt), string(got))
 }
+
+func TestConnectToPostgres(t *testing.T) {
+	t.Parallel()
+
+	if !dbtestutil.WillUsePostgres() {
+		t.Skip("this test does not make sense without postgres")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	t.Cleanup(cancel)
+
+	log := slogtest.Make(t, nil)
+
+	dbURL, closeFunc, err := postgres.Open()
+	require.NoError(t, err)
+	t.Cleanup(closeFunc)
+
+	sqlDB, err := cli.ConnectToPostgres(ctx, log, "postgres", dbURL)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_ = sqlDB.Close()
+	})
+	require.NoError(t, sqlDB.PingContext(ctx))
+}
diff --git a/cli/show.go b/cli/show.go
index 3dff78fcaefdc..477c6e0ffbb60 100644
--- a/cli/show.go
+++ b/cli/show.go
@@ -3,9 +3,9 @@ package cli
 import (
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) show() *clibase.Cmd {
diff --git a/cli/show_test.go b/cli/show_test.go
index 6f5faaa3fde11..eff2789e75a02 100644
--- a/cli/show_test.go
+++ b/cli/show_test.go
@@ -5,10 +5,9 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestShow(t *testing.T) {
@@ -16,23 +15,20 @@ func TestShow(t *testing.T) {
 	t.Run("Exists", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			Parse:          echo.ParseComplete,
-			ProvisionApply: provisionCompleteWithAgent,
-			ProvisionPlan:  provisionCompleteWithAgent,
-		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, completeWithAgent())
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		args := []string{
 			"show",
 			workspace.Name,
 		}
 		inv, root := clitest.New(t, args...)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
diff --git a/cli/speedtest.go b/cli/speedtest.go
index 150605b3330ce..ca6c5e50a6f05 100644
--- a/cli/speedtest.go
+++ b/cli/speedtest.go
@@ -11,9 +11,9 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) speedtest() *clibase.Cmd {
@@ -85,14 +85,14 @@ func (r *RootCmd) speedtest() *clibase.Cmd {
 					}
 					peer := status.Peer[status.Peers()[0]]
 					if !p2p && direct {
-						cliui.Infof(inv.Stdout, "Waiting for a direct connection... (%dms via %s)\n", dur.Milliseconds(), peer.Relay)
+						cliui.Infof(inv.Stdout, "Waiting for a direct connection... (%dms via %s)", dur.Milliseconds(), peer.Relay)
 						continue
 					}
 					via := peer.Relay
 					if via == "" {
 						via = "direct"
 					}
-					cliui.Infof(inv.Stdout, "%dms via %s\n", dur.Milliseconds(), via)
+					cliui.Infof(inv.Stdout, "%dms via %s", dur.Milliseconds(), via)
 					break
 				}
 			} else {
@@ -107,7 +107,7 @@ func (r *RootCmd) speedtest() *clibase.Cmd {
 			default:
 				return xerrors.Errorf("invalid direction: %q", direction)
 			}
-			cliui.Infof(inv.Stdout, "Starting a %ds %s test...\n", int(duration.Seconds()), tsDir)
+			cliui.Infof(inv.Stdout, "Starting a %ds %s test...", int(duration.Seconds()), tsDir)
 			results, err := conn.Speedtest(ctx, tsDir, duration)
 			if err != nil {
 				return err
diff --git a/cli/speedtest_test.go b/cli/speedtest_test.go
index b05e3689347a3..f16b769cc85e7 100644
--- a/cli/speedtest_test.go
+++ b/cli/speedtest_test.go
@@ -9,14 +9,13 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/cli"
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestSpeedtest(t *testing.T) {
@@ -26,13 +25,7 @@ func TestSpeedtest(t *testing.T) {
 		t.Skip("This test takes a minimum of 5ms per a hardcoded value in Tailscale!")
 	}
 	client, workspace, agentToken := setupWorkspaceForAgent(t, nil)
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(agentToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: slogtest.Make(t, nil).Named("agent").Leveled(slog.LevelDebug),
-	})
-	defer agentCloser.Close()
+	_ = agenttest.New(t, client.URL, agentToken)
 	coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
diff --git a/cli/ssh.go b/cli/ssh.go
index 2db1f4b4e2cb4..dbff0ea52017e 100644
--- a/cli/ssh.go
+++ b/cli/ssh.go
@@ -26,12 +26,12 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/autobuild/notify"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/autobuild/notify"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
 	"github.com/coder/retry"
 )
 
@@ -40,7 +40,6 @@ var (
 	autostopNotifyCountdown = []time.Duration{30 * time.Minute}
 )
 
-//nolint:gocyclo
 func (r *RootCmd) ssh() *clibase.Cmd {
 	var (
 		stdio          bool
@@ -144,13 +143,11 @@ func (r *RootCmd) ssh() *clibase.Cmd {
 			case "no":
 				wait = false
 			case "auto":
-				switch workspaceAgent.StartupScriptBehavior {
-				case codersdk.WorkspaceAgentStartupScriptBehaviorBlocking:
-					wait = true
-				case codersdk.WorkspaceAgentStartupScriptBehaviorNonBlocking:
-					wait = false
-				default:
-					return xerrors.Errorf("unknown startup script behavior %q", workspaceAgent.StartupScriptBehavior)
+				for _, script := range workspaceAgent.Scripts {
+					if script.StartBlocksLogin {
+						wait = true
+						break
+					}
 				}
 			default:
 				return xerrors.Errorf("unknown wait value %q", waitEnum)
diff --git a/cli/ssh_internal_test.go b/cli/ssh_internal_test.go
index d9624f393dfa6..07a6a3c5802f2 100644
--- a/cli/ssh_internal_test.go
+++ b/cli/ssh_internal_test.go
@@ -7,7 +7,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 const (
diff --git a/cli/ssh_test.go b/cli/ssh_test.go
index e933839e9ba48..9a0f6b6f6e4e2 100644
--- a/cli/ssh_test.go
+++ b/cli/ssh_test.go
@@ -29,18 +29,22 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/pty"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/pty"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
+)
+
+const (
+	startupScriptPattern = "i-am-ready"
 )
 
 func setupWorkspaceForAgent(t *testing.T, mutate func([]*proto.Agent) []*proto.Agent) (*codersdk.Client, codersdk.Workspace, string) {
@@ -56,10 +60,10 @@ func setupWorkspaceForAgent(t *testing.T, mutate func([]*proto.Agent) []*proto.A
 	agentToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:         echo.ParseComplete,
-		ProvisionPlan: echo.ProvisionComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionPlan: echo.PlanComplete,
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "dev",
 						Type: "google_compute_instance",
@@ -68,16 +72,22 @@ func setupWorkspaceForAgent(t *testing.T, mutate func([]*proto.Agent) []*proto.A
 							Auth: &proto.Agent_Token{
 								Token: agentToken,
 							},
+							Scripts: []*proto.Script{
+								{
+									Script:     fmt.Sprintf("echo '%s'", startupScriptPattern),
+									RunOnStart: true,
+								},
+							},
 						}}),
 					}},
 				},
 			},
 		}},
 	})
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	workspace, err := client.Workspace(context.Background(), workspace.ID)
 	require.NoError(t, err)
 
@@ -103,15 +113,8 @@ func TestSSH(t *testing.T) {
 		})
 		pty.ExpectMatch("Waiting")
 
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(agentToken)
-		agentCloser := agent.New(agent.Options{
-			Client: agentClient,
-			Logger: slogtest.Make(t, nil).Named("agent"),
-		})
-		defer func() {
-			_ = agentCloser.Close()
-		}()
+		_ = agenttest.New(t, client.URL, agentToken)
+		coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 		// Shells on Mac, Windows, and Linux all exit shells with the "exit" command.
 		pty.WriteLine("exit")
@@ -167,15 +170,8 @@ func TestSSH(t *testing.T) {
 		})
 		pty.ExpectMatch("Waiting")
 
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(agentToken)
-		agentCloser := agent.New(agent.Options{
-			Client: agentClient,
-			Logger: slogtest.Make(t, nil).Named("agent"),
-		})
-		defer func() {
-			_ = agentCloser.Close()
-		}()
+		_ = agenttest.New(t, client.URL, agentToken)
+		coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 		// Ensure the agent is connected.
 		pty.WriteLine("echo hell'o'")
@@ -196,14 +192,8 @@ func TestSSH(t *testing.T) {
 		_, _ = tGoContext(t, func(ctx context.Context) {
 			// Run this async so the SSH command has to wait for
 			// the build and agent to connect!
-			agentClient := agentsdk.New(client.URL)
-			agentClient.SetSessionToken(agentToken)
-			agentCloser := agent.New(agent.Options{
-				Client: agentClient,
-				Logger: slogtest.Make(t, nil).Named("agent"),
-			})
+			_ = agenttest.New(t, client.URL, agentToken)
 			<-ctx.Done()
-			_ = agentCloser.Close()
 		})
 
 		clientOutput, clientInput := io.Pipe()
@@ -264,14 +254,8 @@ func TestSSH(t *testing.T) {
 		_, _ = tGoContext(t, func(ctx context.Context) {
 			// Run this async so the SSH command has to wait for
 			// the build and agent to connect.
-			agentClient := agentsdk.New(client.URL)
-			agentClient.SetSessionToken(agentToken)
-			agentCloser := agent.New(agent.Options{
-				Client: agentClient,
-				Logger: slogtest.Make(t, nil).Named("agent"),
-			})
+			_ = agenttest.New(t, client.URL, agentToken)
 			<-ctx.Done()
-			_ = agentCloser.Close()
 		})
 
 		clientOutput, clientInput := io.Pipe()
@@ -333,13 +317,8 @@ func TestSSH(t *testing.T) {
 
 		client, workspace, agentToken := setupWorkspaceForAgent(t, nil)
 
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(agentToken)
-		agentCloser := agent.New(agent.Options{
-			Client: agentClient,
-			Logger: slogtest.Make(t, nil).Named("agent"),
-		})
-		defer agentCloser.Close()
+		_ = agenttest.New(t, client.URL, agentToken)
+		coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 		// Generate private key.
 		privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
@@ -397,7 +376,7 @@ func TestSSH(t *testing.T) {
 		// Ensure that SSH_AUTH_SOCK is set.
 		// Linux: /tmp/auth-agent3167016167/listener.sock
 		// macOS: /var/folders/ng/m1q0wft14hj0t3rtjxrdnzsr0000gn/T/auth-agent3245553419/listener.sock
-		pty.WriteLine("env")
+		pty.WriteLine(`env | grep SSH_AUTH_SOCK=`)
 		pty.ExpectMatch("SSH_AUTH_SOCK=")
 		// Ensure that ssh-add lists our key.
 		pty.WriteLine("ssh-add -L")
@@ -424,22 +403,68 @@ func TestSSH(t *testing.T) {
 
 		client, workspace, agentToken := setupWorkspaceForAgent(t, nil)
 
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(agentToken)
-		agentCloser := agent.New(agent.Options{
-			Client: agentClient,
-			Logger: slogtest.Make(t, nil).Named("agent"),
+		inv, root := clitest.New(t,
+			"ssh",
+			workspace.Name,
+			"--remote-forward",
+			"8222:"+httpServer.Listener.Addr().String(),
+		)
+		clitest.SetupConfig(t, client, root)
+		pty := ptytest.New(t).Attach(inv)
+		inv.Stderr = pty.Output()
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		cmdDone := tGo(t, func() {
+			err := inv.WithContext(ctx).Run()
+			assert.NoError(t, err, "ssh command failed")
 		})
-		defer agentCloser.Close()
+
+		// Agent is still starting
+		pty.ExpectMatch("Waiting")
+
+		_ = agenttest.New(t, client.URL, agentToken)
+		coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+
+		// Startup script has just finished
+		pty.ExpectMatch(startupScriptPattern)
+
+		// Download the test page
+		pty.WriteLine("curl localhost:8222")
+		pty.ExpectMatch("hello world")
+
+		// And we're done.
+		pty.WriteLine("exit")
+		<-cmdDone
+	})
+
+	t.Run("RemoteForwardUnixSocket", func(t *testing.T) {
+		if runtime.GOOS == "windows" {
+			t.Skip("Test not supported on windows")
+		}
+
+		t.Parallel()
+
+		client, workspace, agentToken := setupWorkspaceForAgent(t, nil)
+
+		_ = agenttest.New(t, client.URL, agentToken)
+		coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
+		tmpdir := tempDirUnixSocket(t)
+		agentSock := filepath.Join(tmpdir, "agent.sock")
+		l, err := net.Listen("unix", agentSock)
+		require.NoError(t, err)
+		defer l.Close()
+
 		inv, root := clitest.New(t,
 			"ssh",
 			workspace.Name,
 			"--remote-forward",
-			"8222:"+httpServer.Listener.Addr().String(),
+			"/tmp/test.sock:"+agentSock,
 		)
 		clitest.SetupConfig(t, client, root)
 		pty := ptytest.New(t).Attach(inv)
@@ -454,8 +479,8 @@ func TestSSH(t *testing.T) {
 		_ = pty.Peek(ctx, 1)
 
 		// Download the test page
-		pty.WriteLine("curl localhost:8222")
-		pty.ExpectMatch("hello world")
+		pty.WriteLine("ss -xl state listening src /tmp/test.sock | wc -l")
+		pty.ExpectMatch("2")
 
 		// And we're done.
 		pty.WriteLine("exit")
@@ -475,15 +500,8 @@ func TestSSH(t *testing.T) {
 
 		pty.ExpectMatch("Waiting")
 
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(agentToken)
-		agentCloser := agent.New(agent.Options{
-			Client: agentClient,
-			Logger: slogtest.Make(t, nil).Named("agent"),
-		})
-		defer func() {
-			_ = agentCloser.Close()
-		}()
+		agenttest.New(t, client.URL, agentToken)
+		coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 		// Shells on Mac, Windows, and Linux all exit shells with the "exit" command.
 		pty.WriteLine("exit")
@@ -651,16 +669,12 @@ Expire-Date: 0
 
 	client, workspace, agentToken := setupWorkspaceForAgent(t, nil)
 
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(agentToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		EnvironmentVariables: map[string]string{
+	_ = agenttest.New(t, client.URL, agentToken, func(o *agent.Options) {
+		o.EnvironmentVariables = map[string]string{
 			"GNUPGHOME": gnupgHomeWorkspace,
-		},
-		Logger: slogtest.Make(t, nil).Named("agent"),
+		}
 	})
-	defer agentCloser.Close()
+	coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 	inv, root := clitest.New(t,
 		"ssh",
diff --git a/cli/start.go b/cli/start.go
index 5bd35867fd105..b74426570e75f 100644
--- a/cli/start.go
+++ b/cli/start.go
@@ -2,30 +2,17 @@ package cli
 
 import (
 	"fmt"
+	"net/http"
 	"time"
 
+	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
-// workspaceParameterFlags are used by "start", "restart", and "update".
-type workspaceParameterFlags struct {
-	buildOptions bool
-}
-
-func (wpf *workspaceParameterFlags) options() []clibase.Option {
-	return clibase.OptionSet{
-		{
-			Flag:        "build-options",
-			Description: "Prompt for one-time build options defined with ephemeral parameters.",
-			Value:       clibase.BoolOf(&wpf.buildOptions),
-		},
-	}
-}
-
 func (r *RootCmd) start() *clibase.Cmd {
 	var parameterFlags workspaceParameterFlags
 
@@ -38,31 +25,56 @@ func (r *RootCmd) start() *clibase.Cmd {
 			clibase.RequireNArgs(1),
 			r.InitClient(client),
 		),
-		Options: append(parameterFlags.options(), cliui.SkipPromptOption()),
+		Options: append(parameterFlags.cliBuildOptions(), cliui.SkipPromptOption()),
 		Handler: func(inv *clibase.Invocation) error {
 			workspace, err := namedWorkspace(inv.Context(), client, inv.Args[0])
 			if err != nil {
 				return err
 			}
 
-			template, err := client.Template(inv.Context(), workspace.TemplateID)
+			lastBuildParameters, err := client.WorkspaceBuildParameters(inv.Context(), workspace.LatestBuild.ID)
 			if err != nil {
 				return err
 			}
 
-			buildParams, err := prepStartWorkspace(inv, client, prepStartWorkspaceArgs{
-				Template:     template,
-				BuildOptions: parameterFlags.buildOptions,
+			buildOptions, err := asWorkspaceBuildParameters(parameterFlags.buildOptions)
+			if err != nil {
+				return xerrors.Errorf("unable to parse build options: %w", err)
+			}
+
+			buildParameters, err := prepStartWorkspace(inv, client, prepStartWorkspaceArgs{
+				Action:            WorkspaceStart,
+				TemplateVersionID: workspace.LatestBuild.TemplateVersionID,
+
+				LastBuildParameters: lastBuildParameters,
+
+				PromptBuildOptions: parameterFlags.promptBuildOptions,
+				BuildOptions:       buildOptions,
 			})
 			if err != nil {
 				return err
 			}
 
-			build, err := client.CreateWorkspaceBuild(inv.Context(), workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+			req := codersdk.CreateWorkspaceBuildRequest{
 				Transition:          codersdk.WorkspaceTransitionStart,
-				RichParameterValues: buildParams.richParameters,
-			})
-			if err != nil {
+				RichParameterValues: buildParameters,
+				TemplateVersionID:   workspace.LatestBuild.TemplateVersionID,
+			}
+
+			build, err := client.CreateWorkspaceBuild(inv.Context(), workspace.ID, req)
+			// It's possible for a workspace build to fail due to the template requiring starting
+			// workspaces with the active version.
+			if cerr, ok := codersdk.AsError(err); ok && cerr.StatusCode() == http.StatusUnauthorized {
+				build, err = startWorkspaceActiveVersion(inv, client, startWorkspaceActiveVersionArgs{
+					BuildOptions:        buildOptions,
+					LastBuildParameters: lastBuildParameters,
+					PromptBuildOptions:  parameterFlags.promptBuildOptions,
+					Workspace:           workspace,
+				})
+				if err != nil {
+					return xerrors.Errorf("start workspace with active template version: %w", err)
+				}
+			} else if err != nil {
 				return err
 			}
 
@@ -71,7 +83,10 @@ func (r *RootCmd) start() *clibase.Cmd {
 				return err
 			}
 
-			_, _ = fmt.Fprintf(inv.Stdout, "\nThe %s workspace has been started at %s!\n", cliui.DefaultStyles.Keyword.Render(workspace.Name), cliui.DefaultStyles.DateTimeStamp.Render(time.Now().Format(time.Stamp)))
+			_, _ = fmt.Fprintf(
+				inv.Stdout, "\nThe %s workspace has been started at %s!\n",
+				cliui.Keyword(workspace.Name), cliui.Timestamp(time.Now()),
+			)
 			return nil
 		},
 	}
@@ -79,16 +94,21 @@ func (r *RootCmd) start() *clibase.Cmd {
 }
 
 type prepStartWorkspaceArgs struct {
-	Template     codersdk.Template
-	BuildOptions bool
+	Action            WorkspaceCLIAction
+	TemplateVersionID uuid.UUID
+
+	LastBuildParameters []codersdk.WorkspaceBuildParameter
+
+	PromptBuildOptions bool
+	BuildOptions       []codersdk.WorkspaceBuildParameter
 }
 
-func prepStartWorkspace(inv *clibase.Invocation, client *codersdk.Client, args prepStartWorkspaceArgs) (*buildParameters, error) {
+func prepStartWorkspace(inv *clibase.Invocation, client *codersdk.Client, args prepStartWorkspaceArgs) ([]codersdk.WorkspaceBuildParameter, error) {
 	ctx := inv.Context()
 
-	templateVersion, err := client.TemplateVersion(ctx, args.Template.ActiveVersionID)
+	templateVersion, err := client.TemplateVersion(ctx, args.TemplateVersionID)
 	if err != nil {
-		return nil, err
+		return nil, xerrors.Errorf("get template version: %w", err)
 	}
 
 	templateVersionParameters, err := client.TemplateVersionRichParameters(inv.Context(), templateVersion.ID)
@@ -96,30 +116,49 @@ func prepStartWorkspace(inv *clibase.Invocation, client *codersdk.Client, args p
 		return nil, xerrors.Errorf("get template version rich parameters: %w", err)
 	}
 
-	richParameters := make([]codersdk.WorkspaceBuildParameter, 0)
-	if !args.BuildOptions {
-		return &buildParameters{
-			richParameters: richParameters,
-		}, nil
+	resolver := new(ParameterResolver).
+		WithLastBuildParameters(args.LastBuildParameters).
+		WithPromptBuildOptions(args.PromptBuildOptions).
+		WithBuildOptions(args.BuildOptions)
+	return resolver.Resolve(inv, args.Action, templateVersionParameters)
+}
+
+type startWorkspaceActiveVersionArgs struct {
+	BuildOptions        []codersdk.WorkspaceBuildParameter
+	LastBuildParameters []codersdk.WorkspaceBuildParameter
+	PromptBuildOptions  bool
+	Workspace           codersdk.Workspace
+}
+
+func startWorkspaceActiveVersion(inv *clibase.Invocation, client *codersdk.Client, args startWorkspaceActiveVersionArgs) (codersdk.WorkspaceBuild, error) {
+	_, _ = fmt.Fprintln(inv.Stdout, "Failed to restart with the template version from your last build. Policy may require you to restart with the current active template version.")
+
+	template, err := client.Template(inv.Context(), args.Workspace.TemplateID)
+	if err != nil {
+		return codersdk.WorkspaceBuild{}, xerrors.Errorf("get template: %w", err)
 	}
 
-	for _, templateVersionParameter := range templateVersionParameters {
-		if !templateVersionParameter.Ephemeral {
-			continue
-		}
+	buildParameters, err := prepStartWorkspace(inv, client, prepStartWorkspaceArgs{
+		Action:            WorkspaceStart,
+		TemplateVersionID: template.ActiveVersionID,
+
+		LastBuildParameters: args.LastBuildParameters,
 
-		parameterValue, err := cliui.RichParameter(inv, templateVersionParameter)
-		if err != nil {
-			return nil, err
-		}
+		PromptBuildOptions: args.PromptBuildOptions,
+		BuildOptions:       args.BuildOptions,
+	})
+	if err != nil {
+		return codersdk.WorkspaceBuild{}, err
+	}
 
-		richParameters = append(richParameters, codersdk.WorkspaceBuildParameter{
-			Name:  templateVersionParameter.Name,
-			Value: parameterValue,
-		})
+	build, err := client.CreateWorkspaceBuild(inv.Context(), args.Workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+		Transition:          codersdk.WorkspaceTransitionStart,
+		RichParameterValues: buildParameters,
+		TemplateVersionID:   template.ActiveVersionID,
+	})
+	if err != nil {
+		return codersdk.WorkspaceBuild{}, err
 	}
 
-	return &buildParameters{
-		richParameters: richParameters,
-	}, nil
+	return build, nil
 }
diff --git a/cli/start_test.go b/cli/start_test.go
index a302fe2ac1c40..8a0e015f5c2ea 100644
--- a/cli/start_test.go
+++ b/cli/start_test.go
@@ -1,25 +1,31 @@
 package cli_test
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/context"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 const (
 	ephemeralParameterName        = "ephemeral_parameter"
 	ephemeralParameterDescription = "This is ephemeral parameter"
 	ephemeralParameterValue       = "3"
+
+	immutableParameterName        = "immutable_parameter"
+	immutableParameterDescription = "This is immutable parameter"
+	immutableParameterValue       = "abc"
 )
 
 func TestStart(t *testing.T) {
@@ -27,10 +33,10 @@ func TestStart(t *testing.T) {
 
 	echoResponses := &echo.Responses{
 		Parse: echo.ParseComplete,
-		ProvisionPlan: []*proto.Provision_Response{
+		ProvisionPlan: []*proto.Response{
 			{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
 						Parameters: []*proto.RichParameter{
 							{
 								Name:        ephemeralParameterName,
@@ -43,26 +49,23 @@ func TestStart(t *testing.T) {
 				},
 			},
 		},
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{},
-			},
-		}},
+		ProvisionApply: echo.ApplyComplete,
 	}
 
 	t.Run("BuildOptions", func(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, echoResponses)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		inv, root := clitest.New(t, "start", workspace.Name, "--build-options")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -99,4 +102,120 @@ func TestStart(t *testing.T) {
 			Value: ephemeralParameterValue,
 		})
 	})
+
+	t.Run("BuildOptionFlags", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		inv, root := clitest.New(t, "start", workspace.Name,
+			"--build-option", fmt.Sprintf("%s=%s", ephemeralParameterName, ephemeralParameterValue))
+		clitest.SetupConfig(t, member, root)
+		doneChan := make(chan struct{})
+		pty := ptytest.New(t).Attach(inv)
+		go func() {
+			defer close(doneChan)
+			err := inv.Run()
+			assert.NoError(t, err)
+		}()
+
+		pty.ExpectMatch("workspace has been started")
+		<-doneChan
+
+		// Verify if build option is set
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+
+		workspace, err := client.WorkspaceByOwnerAndName(ctx, workspace.OwnerName, workspace.Name, codersdk.WorkspaceOptions{})
+		require.NoError(t, err)
+		actualParameters, err := client.WorkspaceBuildParameters(ctx, workspace.LatestBuild.ID)
+		require.NoError(t, err)
+		require.Contains(t, actualParameters, codersdk.WorkspaceBuildParameter{
+			Name:  ephemeralParameterName,
+			Value: ephemeralParameterValue,
+		})
+	})
+}
+
+func TestStartWithParameters(t *testing.T) {
+	t.Parallel()
+
+	echoResponses := &echo.Responses{
+		Parse: echo.ParseComplete,
+		ProvisionPlan: []*proto.Response{
+			{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
+						Parameters: []*proto.RichParameter{
+							{
+								Name:        immutableParameterName,
+								Description: immutableParameterDescription,
+								Required:    true,
+							},
+						},
+					},
+				},
+			},
+		},
+		ProvisionApply: echo.ApplyComplete,
+	}
+
+	t.Run("DoNotAskForImmutables", func(t *testing.T) {
+		t.Parallel()
+
+		// Create the workspace
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, member, owner.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
+			cwr.RichParameterValues = []codersdk.WorkspaceBuildParameter{
+				{
+					Name:  immutableParameterName,
+					Value: immutableParameterValue,
+				},
+			}
+		})
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		// Stop the workspace
+		workspaceBuild := coderdtest.CreateWorkspaceBuild(t, client, workspace, database.WorkspaceTransitionStop)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspaceBuild.ID)
+
+		// Start the workspace again
+		inv, root := clitest.New(t, "start", workspace.Name)
+		clitest.SetupConfig(t, member, root)
+		doneChan := make(chan struct{})
+		pty := ptytest.New(t).Attach(inv)
+		go func() {
+			defer close(doneChan)
+			err := inv.Run()
+			assert.NoError(t, err)
+		}()
+
+		pty.ExpectMatch("workspace has been started")
+		<-doneChan
+
+		// Verify if immutable parameter is set
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+
+		workspace, err := client.WorkspaceByOwnerAndName(ctx, workspace.OwnerName, workspace.Name, codersdk.WorkspaceOptions{})
+		require.NoError(t, err)
+		actualParameters, err := client.WorkspaceBuildParameters(ctx, workspace.LatestBuild.ID)
+		require.NoError(t, err)
+		require.Contains(t, actualParameters, codersdk.WorkspaceBuildParameter{
+			Name:  immutableParameterName,
+			Value: immutableParameterValue,
+		})
+	})
 }
diff --git a/cli/stat.go b/cli/stat.go
index 3e32c4187f93b..a2a79fdd39571 100644
--- a/cli/stat.go
+++ b/cli/stat.go
@@ -7,36 +7,48 @@ import (
 	"github.com/spf13/afero"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/clistat"
-	"github.com/coder/coder/cli/cliui"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/clistat"
+	"github.com/coder/coder/v2/cli/cliui"
 )
 
-func (r *RootCmd) stat() *clibase.Cmd {
-	fs := afero.NewReadOnlyFs(afero.NewOsFs())
-	defaultCols := []string{
-		"host_cpu",
-		"host_memory",
-		"home_disk",
-		"container_cpu",
-		"container_memory",
-	}
-	formatter := cliui.NewOutputFormatter(
-		cliui.TableFormat([]statsRow{}, defaultCols),
-		cliui.JSONFormat(),
-	)
-	st, err := clistat.New(clistat.WithFS(fs))
-	if err != nil {
-		panic(xerrors.Errorf("initialize workspace stats collector: %w", err))
+func initStatterMW(tgt **clistat.Statter, fs afero.Fs) clibase.MiddlewareFunc {
+	return func(next clibase.HandlerFunc) clibase.HandlerFunc {
+		return func(i *clibase.Invocation) error {
+			var err error
+			stat, err := clistat.New(clistat.WithFS(fs))
+			if err != nil {
+				return xerrors.Errorf("initialize workspace stats collector: %w", err)
+			}
+			*tgt = stat
+			return next(i)
+		}
 	}
+}
 
+func (r *RootCmd) stat() *clibase.Cmd {
+	var (
+		st        *clistat.Statter
+		fs        = afero.NewReadOnlyFs(afero.NewOsFs())
+		formatter = cliui.NewOutputFormatter(
+			cliui.TableFormat([]statsRow{}, []string{
+				"host_cpu",
+				"host_memory",
+				"home_disk",
+				"container_cpu",
+				"container_memory",
+			}),
+			cliui.JSONFormat(),
+		)
+	)
 	cmd := &clibase.Cmd{
-		Use:   "stat",
-		Short: "Show resource usage for the current workspace.",
+		Use:        "stat",
+		Short:      "Show resource usage for the current workspace.",
+		Middleware: initStatterMW(&st, fs),
 		Children: []*clibase.Cmd{
-			r.statCPU(st, fs),
-			r.statMem(st, fs),
-			r.statDisk(st),
+			r.statCPU(fs),
+			r.statMem(fs),
+			r.statDisk(fs),
 		},
 		Handler: func(inv *clibase.Invocation) error {
 			var sr statsRow
@@ -118,12 +130,16 @@ func (r *RootCmd) stat() *clibase.Cmd {
 	return cmd
 }
 
-func (*RootCmd) statCPU(s *clistat.Statter, fs afero.Fs) *clibase.Cmd {
-	var hostArg bool
-	formatter := cliui.NewOutputFormatter(cliui.TextFormat(), cliui.JSONFormat())
+func (*RootCmd) statCPU(fs afero.Fs) *clibase.Cmd {
+	var (
+		hostArg   bool
+		st        *clistat.Statter
+		formatter = cliui.NewOutputFormatter(cliui.TextFormat(), cliui.JSONFormat())
+	)
 	cmd := &clibase.Cmd{
-		Use:   "cpu",
-		Short: "Show CPU usage, in cores.",
+		Use:        "cpu",
+		Short:      "Show CPU usage, in cores.",
+		Middleware: initStatterMW(&st, fs),
 		Options: clibase.OptionSet{
 			{
 				Flag:        "host",
@@ -135,9 +151,9 @@ func (*RootCmd) statCPU(s *clistat.Statter, fs afero.Fs) *clibase.Cmd {
 			var cs *clistat.Result
 			var err error
 			if ok, _ := clistat.IsContainerized(fs); ok && !hostArg {
-				cs, err = s.ContainerCPU()
+				cs, err = st.ContainerCPU()
 			} else {
-				cs, err = s.HostCPU()
+				cs, err = st.HostCPU()
 			}
 			if err != nil {
 				return err
@@ -155,13 +171,17 @@ func (*RootCmd) statCPU(s *clistat.Statter, fs afero.Fs) *clibase.Cmd {
 	return cmd
 }
 
-func (*RootCmd) statMem(s *clistat.Statter, fs afero.Fs) *clibase.Cmd {
-	var hostArg bool
-	var prefixArg string
-	formatter := cliui.NewOutputFormatter(cliui.TextFormat(), cliui.JSONFormat())
+func (*RootCmd) statMem(fs afero.Fs) *clibase.Cmd {
+	var (
+		hostArg   bool
+		prefixArg string
+		st        *clistat.Statter
+		formatter = cliui.NewOutputFormatter(cliui.TextFormat(), cliui.JSONFormat())
+	)
 	cmd := &clibase.Cmd{
-		Use:   "mem",
-		Short: "Show memory usage, in gigabytes.",
+		Use:        "mem",
+		Short:      "Show memory usage, in gigabytes.",
+		Middleware: initStatterMW(&st, fs),
 		Options: clibase.OptionSet{
 			{
 				Flag:        "host",
@@ -185,9 +205,9 @@ func (*RootCmd) statMem(s *clistat.Statter, fs afero.Fs) *clibase.Cmd {
 			var ms *clistat.Result
 			var err error
 			if ok, _ := clistat.IsContainerized(fs); ok && !hostArg {
-				ms, err = s.ContainerMemory(pfx)
+				ms, err = st.ContainerMemory(pfx)
 			} else {
-				ms, err = s.HostMemory(pfx)
+				ms, err = st.HostMemory(pfx)
 			}
 			if err != nil {
 				return err
@@ -205,13 +225,17 @@ func (*RootCmd) statMem(s *clistat.Statter, fs afero.Fs) *clibase.Cmd {
 	return cmd
 }
 
-func (*RootCmd) statDisk(s *clistat.Statter) *clibase.Cmd {
-	var pathArg string
-	var prefixArg string
-	formatter := cliui.NewOutputFormatter(cliui.TextFormat(), cliui.JSONFormat())
+func (*RootCmd) statDisk(fs afero.Fs) *clibase.Cmd {
+	var (
+		pathArg   string
+		prefixArg string
+		st        *clistat.Statter
+		formatter = cliui.NewOutputFormatter(cliui.TextFormat(), cliui.JSONFormat())
+	)
 	cmd := &clibase.Cmd{
-		Use:   "disk",
-		Short: "Show disk usage, in gigabytes.",
+		Use:        "disk",
+		Short:      "Show disk usage, in gigabytes.",
+		Middleware: initStatterMW(&st, fs),
 		Options: clibase.OptionSet{
 			{
 				Flag:        "path",
@@ -233,8 +257,16 @@ func (*RootCmd) statDisk(s *clistat.Statter) *clibase.Cmd {
 		},
 		Handler: func(inv *clibase.Invocation) error {
 			pfx := clistat.ParsePrefix(prefixArg)
-			ds, err := s.Disk(pfx, pathArg)
+			// Users may also call `coder stat disk <path>`.
+			if len(inv.Args) > 0 {
+				pathArg = inv.Args[0]
+			}
+			ds, err := st.Disk(pfx, pathArg)
 			if err != nil {
+				if os.IsNotExist(err) {
+					//nolint:gocritic // fmt.Errorf produces a more concise error.
+					return fmt.Errorf("not found: %q", pathArg)
+				}
 				return err
 			}
 
diff --git a/cli/stat_test.go b/cli/stat_test.go
index d92574e339b89..74d7d109f98d5 100644
--- a/cli/stat_test.go
+++ b/cli/stat_test.go
@@ -9,9 +9,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clistat"
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clistat"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // This just tests that the stat command is recognized and does not output
@@ -74,7 +74,7 @@ func TestStatCPUCmd(t *testing.T) {
 		t.Parallel()
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
 		t.Cleanup(cancel)
-		inv, _ := clitest.New(t, "stat", "cpu", "--output=text")
+		inv, _ := clitest.New(t, "stat", "cpu", "--output=text", "--host")
 		buf := new(bytes.Buffer)
 		inv.Stdout = buf
 		err := inv.WithContext(ctx).Run()
@@ -87,7 +87,7 @@ func TestStatCPUCmd(t *testing.T) {
 		t.Parallel()
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
 		t.Cleanup(cancel)
-		inv, _ := clitest.New(t, "stat", "cpu", "--output=json")
+		inv, _ := clitest.New(t, "stat", "cpu", "--output=json", "--host")
 		buf := new(bytes.Buffer)
 		inv.Stdout = buf
 		err := inv.WithContext(ctx).Run()
@@ -170,4 +170,16 @@ func TestStatDiskCmd(t *testing.T) {
 		require.NotZero(t, *tmp.Total)
 		require.Equal(t, "B", tmp.Unit)
 	})
+
+	t.Run("PosArg", func(t *testing.T) {
+		t.Parallel()
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		t.Cleanup(cancel)
+		inv, _ := clitest.New(t, "stat", "disk", "/this/path/does/not/exist", "--output=text")
+		buf := new(bytes.Buffer)
+		inv.Stdout = buf
+		err := inv.WithContext(ctx).Run()
+		require.Error(t, err)
+		require.Contains(t, err.Error(), `not found: "/this/path/does/not/exist"`)
+	})
 }
diff --git a/cli/state.go b/cli/state.go
index dd18e56d90f41..8175cdaa68635 100644
--- a/cli/state.go
+++ b/cli/state.go
@@ -6,9 +6,9 @@ import (
 	"os"
 	"strconv"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) state() *clibase.Cmd {
diff --git a/cli/state_test.go b/cli/state_test.go
index 2a208fd64d25c..5ca96f5089013 100644
--- a/cli/state_test.go
+++ b/cli/state_test.go
@@ -10,10 +10,11 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 func TestStatePull(t *testing.T) {
@@ -21,25 +22,27 @@ func TestStatePull(t *testing.T) {
 	t.Run("File", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 		wantState := []byte("some state")
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						State: wantState,
 					},
 				},
 			}},
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		// Need to create workspace as templateAdmin to ensure we can read state.
+		workspace := coderdtest.CreateWorkspace(t, templateAdmin, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		statefilePath := filepath.Join(t.TempDir(), "state")
 		inv, root := clitest.New(t, "state", "pull", workspace.Name, statefilePath)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 		err := inv.Run()
 		require.NoError(t, err)
 		gotState, err := os.ReadFile(statefilePath)
@@ -49,26 +52,27 @@ func TestStatePull(t *testing.T) {
 	t.Run("Stdout", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 		wantState := []byte("some state")
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						State: wantState,
 					},
 				},
 			}},
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, templateAdmin, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		inv, root := clitest.New(t, "state", "pull", workspace.Name)
 		var gotState bytes.Buffer
 		inv.Stdout = &gotState
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 		err := inv.Run()
 		require.NoError(t, err)
 		require.Equal(t, wantState, bytes.TrimSpace(gotState.Bytes()))
@@ -80,15 +84,16 @@ func TestStatePush(t *testing.T) {
 	t.Run("File", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, templateAdmin, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		stateFile, err := os.CreateTemp(t.TempDir(), "")
 		require.NoError(t, err)
 		wantState := []byte("some magic state")
@@ -97,7 +102,7 @@ func TestStatePush(t *testing.T) {
 		err = stateFile.Close()
 		require.NoError(t, err)
 		inv, root := clitest.New(t, "state", "push", workspace.Name, stateFile.Name())
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 		err = inv.Run()
 		require.NoError(t, err)
 	})
@@ -105,17 +110,18 @@ func TestStatePush(t *testing.T) {
 	t.Run("Stdin", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, templateAdmin, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		inv, root := clitest.New(t, "state", "push", "--build", strconv.Itoa(int(workspace.LatestBuild.BuildNumber)), workspace.Name, "-")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 		inv.Stdin = strings.NewReader("some magic state")
 		err := inv.Run()
 		require.NoError(t, err)
diff --git a/cli/stop.go b/cli/stop.go
index 1dbf446ed2979..ea26e426e6323 100644
--- a/cli/stop.go
+++ b/cli/stop.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) stop() *clibase.Cmd {
@@ -47,7 +47,12 @@ func (r *RootCmd) stop() *clibase.Cmd {
 				return err
 			}
 
-			_, _ = fmt.Fprintf(inv.Stdout, "\nThe %s workspace has been stopped at %s!\n", cliui.DefaultStyles.Keyword.Render(workspace.Name), cliui.DefaultStyles.DateTimeStamp.Render(time.Now().Format(time.Stamp)))
+			_, _ = fmt.Fprintf(
+				inv.Stdout,
+				"\nThe %s workspace has been stopped at %s!\n", cliui.Keyword(workspace.Name),
+
+				cliui.Timestamp(time.Now()),
+			)
 			return nil
 		},
 	}
diff --git a/cli/telemetry/telemetry.go b/cli/telemetry/telemetry.go
new file mode 100644
index 0000000000000..e2ef8adc7409c
--- /dev/null
+++ b/cli/telemetry/telemetry.go
@@ -0,0 +1,15 @@
+package telemetry
+
+import "time"
+
+type Option struct {
+	Name        string `json:"name"`
+	ValueSource string `json:"value_source"`
+}
+
+type Invocation struct {
+	Command string   `json:"command"`
+	Options []Option `json:"options"`
+	// InvokedAt is provided for deduplication purposes.
+	InvokedAt time.Time `json:"invoked_at"`
+}
diff --git a/cli/templatecreate.go b/cli/templatecreate.go
index 77a869bdc0518..da0793121d949 100644
--- a/cli/templatecreate.go
+++ b/cli/templatecreate.go
@@ -14,24 +14,27 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisionerd"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) templateCreate() *clibase.Cmd {
 	var (
-		provisioner     string
-		provisionerTags []string
-		variablesFile   string
-		variables       []string
-		disableEveryone bool
-		defaultTTL      time.Duration
-		failureTTL      time.Duration
-		inactivityTTL   time.Duration
+		provisioner          string
+		provisionerTags      []string
+		variablesFile        string
+		variables            []string
+		disableEveryone      bool
+		requireActiveVersion bool
+
+		defaultTTL    time.Duration
+		failureTTL    time.Duration
+		inactivityTTL time.Duration
+		maxTTL        time.Duration
 
 		uploadFlags templateUploadFlags
 	)
@@ -44,27 +47,47 @@ func (r *RootCmd) templateCreate() *clibase.Cmd {
 			r.InitClient(client),
 		),
 		Handler: func(inv *clibase.Invocation) error {
-			if failureTTL != 0 || inactivityTTL != 0 {
-				// This call can be removed when workspace_actions is no longer experimental
-				experiments, exErr := client.Experiments(inv.Context())
-				if exErr != nil {
-					return xerrors.Errorf("get experiments: %w", exErr)
-				}
-
-				if !experiments.Enabled(codersdk.ExperimentWorkspaceActions) {
-					return xerrors.Errorf("--failure-ttl and --inactivityTTL are experimental features. Use the workspace_actions CODER_EXPERIMENTS flag to set these configuration values.")
+			isTemplateSchedulingOptionsSet := failureTTL != 0 || inactivityTTL != 0 || maxTTL != 0
+
+			if isTemplateSchedulingOptionsSet || requireActiveVersion {
+				if failureTTL != 0 || inactivityTTL != 0 {
+					// This call can be removed when workspace_actions is no longer experimental
+					experiments, exErr := client.Experiments(inv.Context())
+					if exErr != nil {
+						return xerrors.Errorf("get experiments: %w", exErr)
+					}
+
+					if !experiments.Enabled(codersdk.ExperimentWorkspaceActions) {
+						return xerrors.Errorf("--failure-ttl and --inactivity-ttl are experimental features. Use the workspace_actions CODER_EXPERIMENTS flag to set these configuration values.")
+					}
 				}
 
 				entitlements, err := client.Entitlements(inv.Context())
-				var sdkErr *codersdk.Error
-				if xerrors.As(err, &sdkErr) && sdkErr.StatusCode() == http.StatusNotFound {
-					return xerrors.Errorf("your deployment appears to be an AGPL deployment, so you cannot set --failure-ttl or --inactivityTTL")
+				if cerr, ok := codersdk.AsError(err); ok && cerr.StatusCode() == http.StatusNotFound {
+					return xerrors.Errorf("your deployment appears to be an AGPL deployment, so you cannot set enterprise-only flags")
 				} else if err != nil {
 					return xerrors.Errorf("get entitlements: %w", err)
 				}
 
-				if !entitlements.Features[codersdk.FeatureAdvancedTemplateScheduling].Enabled {
-					return xerrors.Errorf("your license is not entitled to use advanced template scheduling, so you cannot set --failure-ttl or --inactivityTTL")
+				if isTemplateSchedulingOptionsSet {
+					if !entitlements.Features[codersdk.FeatureAdvancedTemplateScheduling].Enabled {
+						return xerrors.Errorf("your license is not entitled to use advanced template scheduling, so you cannot set --failure-ttl, --inactivity-ttl, or --max-ttl")
+					}
+				}
+
+				if requireActiveVersion {
+					if !entitlements.Features[codersdk.FeatureAccessControl].Enabled {
+						return xerrors.Errorf("your license is not entitled to use enterprise access control, so you cannot set --require-active-version")
+					}
+
+					experiments, exErr := client.Experiments(inv.Context())
+					if exErr != nil {
+						return xerrors.Errorf("get experiments: %w", exErr)
+					}
+
+					if !experiments.Enabled(codersdk.ExperimentTemplateUpdatePolicies) {
+						return xerrors.Errorf("--require-active-version is an experimental feature, contact an administrator to enable the 'template_update_policies' experiment on your Coder server")
+					}
 				}
 			}
 
@@ -109,7 +132,7 @@ func (r *RootCmd) templateCreate() *clibase.Cmd {
 				Message:         message,
 				Client:          client,
 				Organization:    organization,
-				Provisioner:     database.ProvisionerType(provisioner),
+				Provisioner:     codersdk.ProvisionerType(provisioner),
 				FileID:          resp.ID,
 				ProvisionerTags: tags,
 				VariablesFile:   variablesFile,
@@ -134,8 +157,10 @@ func (r *RootCmd) templateCreate() *clibase.Cmd {
 				VersionID:                  job.ID,
 				DefaultTTLMillis:           ptr.Ref(defaultTTL.Milliseconds()),
 				FailureTTLMillis:           ptr.Ref(failureTTL.Milliseconds()),
-				InactivityTTLMillis:        ptr.Ref(inactivityTTL.Milliseconds()),
+				MaxTTLMillis:               ptr.Ref(maxTTL.Milliseconds()),
+				TimeTilDormantMillis:       ptr.Ref(inactivityTTL.Milliseconds()),
 				DisableEveryoneGroupAccess: disableEveryone,
+				RequireActiveVersion:       requireActiveVersion,
 			}
 
 			_, err = client.CreateTemplate(inv.Context(), organization.ID, createReq)
@@ -143,11 +168,13 @@ func (r *RootCmd) templateCreate() *clibase.Cmd {
 				return err
 			}
 
-			_, _ = fmt.Fprintln(inv.Stdout, "\n"+cliui.DefaultStyles.Wrap.Render(
-				"The "+cliui.DefaultStyles.Keyword.Render(templateName)+" template has been created at "+cliui.DefaultStyles.DateTimeStamp.Render(time.Now().Format(time.Stamp))+"! "+
+			_, _ = fmt.Fprintln(inv.Stdout, "\n"+pretty.Sprint(cliui.DefaultStyles.Wrap,
+				"The "+pretty.Sprint(
+					cliui.DefaultStyles.Keyword, templateName)+" template has been created at "+
+					pretty.Sprint(cliui.DefaultStyles.DateTimeStamp, time.Now().Format(time.Stamp))+"! "+
 					"Developers can provision a workspace with this template using:")+"\n")
 
-			_, _ = fmt.Fprintln(inv.Stdout, "  "+cliui.DefaultStyles.Code.Render(fmt.Sprintf("coder create --template=%q [workspace name]", templateName)))
+			_, _ = fmt.Fprintln(inv.Stdout, "  "+pretty.Sprint(cliui.DefaultStyles.Code, fmt.Sprintf("coder create --template=%q [workspace name]", templateName)))
 			_, _ = fmt.Fprintln(inv.Stdout)
 
 			return nil
@@ -182,22 +209,27 @@ func (r *RootCmd) templateCreate() *clibase.Cmd {
 		},
 		{
 			Flag:        "default-ttl",
-			Description: "Specify a default TTL for workspaces created from this template.",
+			Description: "Specify a default TTL for workspaces created from this template. It is the default time before shutdown - workspaces created from this template default to this value. Maps to \"Default autostop\" in the UI.",
 			Default:     "24h",
 			Value:       clibase.DurationOf(&defaultTTL),
 		},
 		{
 			Flag:        "failure-ttl",
-			Description: "Specify a failure TTL for workspaces created from this template. This licensed feature's default is 0h (off).",
+			Description: "Specify a failure TTL for workspaces created from this template. It is the amount of time after a failed \"start\" build before coder automatically schedules a \"stop\" build to cleanup.This licensed feature's default is 0h (off). Maps to \"Failure cleanup\"in the UI.",
 			Default:     "0h",
 			Value:       clibase.DurationOf(&failureTTL),
 		},
 		{
 			Flag:        "inactivity-ttl",
-			Description: "Specify an inactivity TTL for workspaces created from this template. This licensed feature's default is 0h (off).",
+			Description: "Specify an inactivity TTL for workspaces created from this template. It is the amount of time the workspace is not used before it is be stopped and auto-locked. This includes across multiple builds (e.g. auto-starts and stops). This licensed feature's default is 0h (off). Maps to \"Dormancy threshold\" in the UI.",
 			Default:     "0h",
 			Value:       clibase.DurationOf(&inactivityTTL),
 		},
+		{
+			Flag:        "max-ttl",
+			Description: "Edit the template maximum time before shutdown - workspaces created from this template must shutdown within the given duration after starting. This is an enterprise-only feature.",
+			Value:       clibase.DurationOf(&maxTTL),
+		},
 		{
 			Flag:        "test.provisioner",
 			Description: "Customize the provisioner backend.",
@@ -205,6 +237,13 @@ func (r *RootCmd) templateCreate() *clibase.Cmd {
 			Value:       clibase.StringOf(&provisioner),
 			Hidden:      true,
 		},
+		{
+			Flag:        "require-active-version",
+			Description: "Requires workspace builds to use the active template version. This setting does not apply to template admins. This is an enterprise-only feature.",
+			Value:       clibase.BoolOf(&requireActiveVersion),
+			Default:     "false",
+		},
+
 		cliui.SkipPromptOption(),
 	}
 	cmd.Options = append(cmd.Options, uploadFlags.options()...)
@@ -216,7 +255,7 @@ type createValidTemplateVersionArgs struct {
 	Message      string
 	Client       *codersdk.Client
 	Organization codersdk.Organization
-	Provisioner  database.ProvisionerType
+	Provisioner  codersdk.ProvisionerType
 	FileID       uuid.UUID
 
 	VariablesFile string
@@ -250,7 +289,7 @@ func createValidTemplateVersion(inv *clibase.Invocation, args createValidTemplat
 		Message:            args.Message,
 		StorageMethod:      codersdk.ProvisionerStorageMethodFile,
 		FileID:             args.FileID,
-		Provisioner:        codersdk.ProvisionerType(args.Provisioner),
+		Provisioner:        args.Provisioner,
 		ProvisionerTags:    args.ProvisionerTags,
 		UserVariableValues: variableValues,
 	}
@@ -276,7 +315,10 @@ func createValidTemplateVersion(inv *clibase.Invocation, args createValidTemplat
 	})
 	if err != nil {
 		var jobErr *cliui.ProvisionerJobError
-		if errors.As(err, &jobErr) && !provisionerd.IsMissingParameterErrorCode(string(jobErr.Code)) {
+		if errors.As(err, &jobErr) && !codersdk.JobIsMissingParameterErrorCode(jobErr.Code) {
+			return nil, err
+		}
+		if err != nil {
 			return nil, err
 		}
 	}
@@ -322,12 +364,12 @@ func prettyDirectoryPath(dir string) string {
 	if err != nil {
 		return dir
 	}
-	pretty := dir
-	if strings.HasPrefix(pretty, homeDir) {
-		pretty = strings.TrimPrefix(pretty, homeDir)
-		pretty = "~" + pretty
+	prettyDir := dir
+	if strings.HasPrefix(prettyDir, homeDir) {
+		prettyDir = strings.TrimPrefix(prettyDir, homeDir)
+		prettyDir = "~" + prettyDir
 	}
-	return pretty
+	return prettyDir
 }
 
 func ParseProvisionerTags(rawTags []string) (map[string]string, error) {
diff --git a/cli/templatecreate_test.go b/cli/templatecreate_test.go
index 06e180f7dcd6c..ec1720ba2a6a4 100644
--- a/cli/templatecreate_test.go
+++ b/cli/templatecreate_test.go
@@ -10,35 +10,62 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
-var provisionCompleteWithAgent = []*proto.Provision_Response{
-	{
-		Type: &proto.Provision_Response_Complete{
-			Complete: &proto.Provision_Complete{
-				Resources: []*proto.Resource{
-					{
-						Type: "compute",
-						Name: "main",
-						Agents: []*proto.Agent{
+func completeWithAgent() *echo.Responses {
+	return &echo.Responses{
+		Parse: echo.ParseComplete,
+		ProvisionPlan: []*proto.Response{
+			{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
+						Resources: []*proto.Resource{
+							{
+								Type: "compute",
+								Name: "main",
+								Agents: []*proto.Agent{
+									{
+										Name:            "smith",
+										OperatingSystem: "linux",
+										Architecture:    "i386",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+		ProvisionApply: []*proto.Response{
+			{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
+						Resources: []*proto.Resource{
 							{
-								Name:            "smith",
-								OperatingSystem: "linux",
-								Architecture:    "i386",
+								Type: "compute",
+								Name: "main",
+								Agents: []*proto.Agent{
+									{
+										Name:            "smith",
+										OperatingSystem: "linux",
+										Architecture:    "i386",
+									},
+								},
 							},
 						},
 					},
 				},
 			},
 		},
-	},
+	}
 }
 
 func TestTemplateCreate(t *testing.T) {
@@ -47,10 +74,7 @@ func TestTemplateCreate(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		coderdtest.CreateFirstUser(t, client)
-		source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
-			Parse:          echo.ParseComplete,
-			ProvisionApply: provisionCompleteWithAgent,
-		})
+		source := clitest.CreateTemplateVersionSource(t, completeWithAgent())
 		args := []string{
 			"templates",
 			"create",
@@ -85,10 +109,7 @@ func TestTemplateCreate(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		coderdtest.CreateFirstUser(t, client)
-		source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
-			Parse:          echo.ParseComplete,
-			ProvisionApply: provisionCompleteWithAgent,
-		})
+		source := clitest.CreateTemplateVersionSource(t, completeWithAgent())
 		require.NoError(t, os.Remove(filepath.Join(source, ".terraform.lock.hcl")))
 		args := []string{
 			"templates",
@@ -128,10 +149,7 @@ func TestTemplateCreate(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		coderdtest.CreateFirstUser(t, client)
-		source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
-			Parse:          echo.ParseComplete,
-			ProvisionApply: provisionCompleteWithAgent,
-		})
+		source := clitest.CreateTemplateVersionSource(t, completeWithAgent())
 		require.NoError(t, os.Remove(filepath.Join(source, ".terraform.lock.hcl")))
 		args := []string{
 			"templates",
@@ -167,10 +185,7 @@ func TestTemplateCreate(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		coderdtest.CreateFirstUser(t, client)
-		source, err := echo.Tar(&echo.Responses{
-			Parse:          echo.ParseComplete,
-			ProvisionApply: provisionCompleteWithAgent,
-		})
+		source, err := echo.Tar(completeWithAgent())
 		require.NoError(t, err)
 
 		args := []string{
@@ -196,10 +211,7 @@ func TestTemplateCreate(t *testing.T) {
 		coderdtest.CreateFirstUser(t, client)
 
 		create := func() error {
-			source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
-				Parse:          echo.ParseComplete,
-				ProvisionApply: provisionCompleteWithAgent,
-			})
+			source := clitest.CreateTemplateVersionSource(t, completeWithAgent())
 			args := []string{
 				"templates",
 				"create",
@@ -382,6 +394,36 @@ func TestTemplateCreate(t *testing.T) {
 			}
 		}
 	})
+
+	t.Run("RequireActiveVersionInvalid", func(t *testing.T) {
+		t.Parallel()
+
+		dv := coderdtest.DeploymentValues(t)
+		dv.Experiments = []string{
+			string(codersdk.ExperimentTemplateUpdatePolicies),
+		}
+
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+			DeploymentValues:         dv,
+		})
+		coderdtest.CreateFirstUser(t, client)
+		source := clitest.CreateTemplateVersionSource(t, completeWithAgent())
+		args := []string{
+			"templates",
+			"create",
+			"my-template",
+			"--directory", source,
+			"--test.provisioner", string(database.ProvisionerTypeEcho),
+			"--require-active-version",
+		}
+		inv, root := clitest.New(t, args...)
+		clitest.SetupConfig(t, client, root)
+
+		err := inv.Run()
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "your deployment appears to be an AGPL deployment, so you cannot set enterprise-only flags")
+	})
 }
 
 // Need this for Windows because of a known issue with Go:
diff --git a/cli/templatedelete.go b/cli/templatedelete.go
index d954dbf44c081..e15fe4bd48722 100644
--- a/cli/templatedelete.go
+++ b/cli/templatedelete.go
@@ -7,9 +7,11 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) templateDelete() *clibase.Cmd {
@@ -46,38 +48,18 @@ func (r *RootCmd) templateDelete() *clibase.Cmd {
 					templates = append(templates, template)
 				}
 			} else {
-				allTemplates, err := client.TemplatesByOrganization(ctx, organization.ID)
-				if err != nil {
-					return xerrors.Errorf("get templates by organization: %w", err)
-				}
-
-				if len(allTemplates) == 0 {
-					return xerrors.Errorf("no templates exist in the current organization %q", organization.Name)
-				}
-
-				opts := make([]string, 0, len(allTemplates))
-				for _, template := range allTemplates {
-					opts = append(opts, template.Name)
-				}
-
-				selection, err := cliui.Select(inv, cliui.SelectOptions{
-					Options: opts,
-				})
+				template, err := selectTemplate(inv, client, organization)
 				if err != nil {
-					return xerrors.Errorf("select template: %w", err)
+					return err
 				}
 
-				for _, template := range allTemplates {
-					if template.Name == selection {
-						templates = append(templates, template)
-						templateNames = append(templateNames, template.Name)
-					}
-				}
+				templates = append(templates, template)
+				templateNames = append(templateNames, template.Name)
 			}
 
 			// Confirm deletion of the template.
 			_, err = cliui.Prompt(inv, cliui.PromptOptions{
-				Text:      fmt.Sprintf("Delete these templates: %s?", cliui.DefaultStyles.Code.Render(strings.Join(templateNames, ", "))),
+				Text:      fmt.Sprintf("Delete these templates: %s?", pretty.Sprint(cliui.DefaultStyles.Code, strings.Join(templateNames, ", "))),
 				IsConfirm: true,
 				Default:   cliui.ConfirmNo,
 			})
@@ -91,7 +73,9 @@ func (r *RootCmd) templateDelete() *clibase.Cmd {
 					return xerrors.Errorf("delete template %q: %w", template.Name, err)
 				}
 
-				_, _ = fmt.Fprintln(inv.Stdout, "Deleted template "+cliui.DefaultStyles.Code.Render(template.Name)+" at "+cliui.DefaultStyles.DateTimeStamp.Render(time.Now().Format(time.Stamp))+"!")
+				_, _ = fmt.Fprintln(
+					inv.Stdout, "Deleted template "+pretty.Sprint(cliui.DefaultStyles.Keyword, template.Name)+" at "+cliui.Timestamp(time.Now()),
+				)
 			}
 
 			return nil
diff --git a/cli/templatedelete_test.go b/cli/templatedelete_test.go
index 1f7c032b11d59..d81a3235f59f5 100644
--- a/cli/templatedelete_test.go
+++ b/cli/templatedelete_test.go
@@ -8,11 +8,14 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestTemplateDelete(t *testing.T) {
@@ -22,14 +25,15 @@ func TestTemplateDelete(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		inv, root := clitest.New(t, "templates", "delete", template.Name)
 
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 		pty := ptytest.New(t).Attach(inv)
 
 		execDone := make(chan error)
@@ -37,7 +41,7 @@ func TestTemplateDelete(t *testing.T) {
 			execDone <- inv.Run()
 		}()
 
-		pty.ExpectMatch(fmt.Sprintf("Delete these templates: %s?", cliui.DefaultStyles.Code.Render(template.Name)))
+		pty.ExpectMatch(fmt.Sprintf("Delete these templates: %s?", pretty.Sprint(cliui.DefaultStyles.Code, template.Name)))
 		pty.WriteLine("yes")
 
 		require.NoError(t, <-execDone)
@@ -50,19 +54,20 @@ func TestTemplateDelete(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 		templates := []codersdk.Template{}
 		templateNames := []string{}
 		for i := 0; i < 3; i++ {
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+			version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 			templates = append(templates, template)
 			templateNames = append(templateNames, template.Name)
 		}
 
 		inv, root := clitest.New(t, append([]string{"templates", "delete", "--yes"}, templateNames...)...)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 		require.NoError(t, inv.Run())
 
 		for _, template := range templates {
@@ -75,19 +80,20 @@ func TestTemplateDelete(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 		templates := []codersdk.Template{}
 		templateNames := []string{}
 		for i := 0; i < 3; i++ {
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+			version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 			templates = append(templates, template)
 			templateNames = append(templateNames, template.Name)
 		}
 
 		inv, root := clitest.New(t, append([]string{"templates", "delete"}, templateNames...)...)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 		pty := ptytest.New(t).Attach(inv)
 
 		execDone := make(chan error)
@@ -95,7 +101,7 @@ func TestTemplateDelete(t *testing.T) {
 			execDone <- inv.Run()
 		}()
 
-		pty.ExpectMatch(fmt.Sprintf("Delete these templates: %s?", cliui.DefaultStyles.Code.Render(strings.Join(templateNames, ", "))))
+		pty.ExpectMatch(fmt.Sprintf("Delete these templates: %s?", pretty.Sprint(cliui.DefaultStyles.Code, strings.Join(templateNames, ", "))))
 		pty.WriteLine("yes")
 
 		require.NoError(t, <-execDone)
@@ -110,13 +116,14 @@ func TestTemplateDelete(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		inv, root := clitest.New(t, "templates", "delete")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 
 		pty := ptytest.New(t).Attach(inv)
 
diff --git a/cli/templateedit.go b/cli/templateedit.go
index 6c8173c452817..1c17ec52bcab3 100644
--- a/cli/templateedit.go
+++ b/cli/templateedit.go
@@ -8,26 +8,30 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) templateEdit() *clibase.Cmd {
 	var (
-		name                         string
-		displayName                  string
-		description                  string
-		icon                         string
-		defaultTTL                   time.Duration
-		maxTTL                       time.Duration
-		restartRequirementDaysOfWeek []string
-		restartRequirementWeeks      int64
-		failureTTL                   time.Duration
-		inactivityTTL                time.Duration
-		allowUserCancelWorkspaceJobs bool
-		allowUserAutostart           bool
-		allowUserAutostop            bool
+		name                           string
+		displayName                    string
+		description                    string
+		icon                           string
+		defaultTTL                     time.Duration
+		maxTTL                         time.Duration
+		autostopRequirementDaysOfWeek  []string
+		autostopRequirementWeeks       int64
+		autostartRequirementDaysOfWeek []string
+		failureTTL                     time.Duration
+		inactivityTTL                  time.Duration
+		allowUserCancelWorkspaceJobs   bool
+		allowUserAutostart             bool
+		allowUserAutostop              bool
+		requireActiveVersion           bool
 	)
 	client := new(codersdk.Client)
 
@@ -47,30 +51,47 @@ func (r *RootCmd) templateEdit() *clibase.Cmd {
 				}
 
 				if !experiments.Enabled(codersdk.ExperimentWorkspaceActions) {
-					return xerrors.Errorf("--failure-ttl and --inactivityTTL are experimental features. Use the workspace_actions CODER_EXPERIMENTS flag to set these configuration values.")
+					return xerrors.Errorf("--failure-ttl and --inactivity-ttl are experimental features. Use the workspace_actions CODER_EXPERIMENTS flag to set these configuration values.")
 				}
 			}
 
-			unsetRestartRequirementDaysOfWeek := len(restartRequirementDaysOfWeek) == 1 && restartRequirementDaysOfWeek[0] == "none"
-			requiresEntitlement := (len(restartRequirementDaysOfWeek) > 0 && !unsetRestartRequirementDaysOfWeek) ||
-				restartRequirementWeeks > 0 ||
+			unsetAutostopRequirementDaysOfWeek := len(autostopRequirementDaysOfWeek) == 1 && autostopRequirementDaysOfWeek[0] == "none"
+			requiresScheduling := (len(autostopRequirementDaysOfWeek) > 0 && !unsetAutostopRequirementDaysOfWeek) ||
+				autostopRequirementWeeks > 0 ||
 				!allowUserAutostart ||
 				!allowUserAutostop ||
 				maxTTL != 0 ||
 				failureTTL != 0 ||
-				inactivityTTL != 0
+				inactivityTTL != 0 ||
+				len(autostartRequirementDaysOfWeek) > 0
+
+			requiresEntitlement := requiresScheduling || requireActiveVersion
 			if requiresEntitlement {
 				entitlements, err := client.Entitlements(inv.Context())
-				var sdkErr *codersdk.Error
-				if xerrors.As(err, &sdkErr) && sdkErr.StatusCode() == http.StatusNotFound {
-					return xerrors.Errorf("your deployment appears to be an AGPL deployment, so you cannot set --max-ttl, --failure-ttl, --inactivityTTL, --allow-user-autostart=false or --allow-user-autostop=false")
+				if cerr, ok := codersdk.AsError(err); ok && cerr.StatusCode() == http.StatusNotFound {
+					return xerrors.Errorf("your deployment appears to be an AGPL deployment, so you cannot set enterprise-only flags")
 				} else if err != nil {
 					return xerrors.Errorf("get entitlements: %w", err)
 				}
 
-				if !entitlements.Features[codersdk.FeatureAdvancedTemplateScheduling].Enabled {
+				if requiresScheduling && !entitlements.Features[codersdk.FeatureAdvancedTemplateScheduling].Enabled {
 					return xerrors.Errorf("your license is not entitled to use advanced template scheduling, so you cannot set --max-ttl, --failure-ttl, --inactivityTTL, --allow-user-autostart=false or --allow-user-autostop=false")
 				}
+
+				if requireActiveVersion {
+					if !entitlements.Features[codersdk.FeatureAccessControl].Enabled {
+						return xerrors.Errorf("your license is not entitled to use enterprise access control, so you cannot set --require-active-version")
+					}
+
+					experiments, exErr := client.Experiments(inv.Context())
+					if exErr != nil {
+						return xerrors.Errorf("get experiments: %w", exErr)
+					}
+
+					if !experiments.Enabled(codersdk.ExperimentTemplateUpdatePolicies) {
+						return xerrors.Errorf("--require-active-version is an experimental feature, contact an administrator to enable the 'template_update_policies' experiment on your Coder server")
+					}
+				}
 			}
 
 			organization, err := CurrentOrganization(inv, client)
@@ -84,11 +105,17 @@ func (r *RootCmd) templateEdit() *clibase.Cmd {
 
 			// Copy the default value if the list is empty, or if the user
 			// specified the "none" value clear the list.
-			if len(restartRequirementDaysOfWeek) == 0 {
-				restartRequirementDaysOfWeek = template.RestartRequirement.DaysOfWeek
+			if len(autostopRequirementDaysOfWeek) == 0 {
+				autostopRequirementDaysOfWeek = template.AutostopRequirement.DaysOfWeek
+			}
+			if len(autostartRequirementDaysOfWeek) == 1 && autostartRequirementDaysOfWeek[0] == "all" {
+				// Set it to every day of the week
+				autostartRequirementDaysOfWeek = []string{"monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday"}
+			} else if len(autostartRequirementDaysOfWeek) == 0 {
+				autostartRequirementDaysOfWeek = template.AutostartRequirement.DaysOfWeek
 			}
-			if unsetRestartRequirementDaysOfWeek {
-				restartRequirementDaysOfWeek = []string{}
+			if unsetAutostopRequirementDaysOfWeek {
+				autostopRequirementDaysOfWeek = []string{}
 			}
 
 			// NOTE: coderd will ignore empty fields.
@@ -99,22 +126,26 @@ func (r *RootCmd) templateEdit() *clibase.Cmd {
 				Icon:             icon,
 				DefaultTTLMillis: defaultTTL.Milliseconds(),
 				MaxTTLMillis:     maxTTL.Milliseconds(),
-				RestartRequirement: &codersdk.TemplateRestartRequirement{
-					DaysOfWeek: restartRequirementDaysOfWeek,
-					Weeks:      restartRequirementWeeks,
+				AutostopRequirement: &codersdk.TemplateAutostopRequirement{
+					DaysOfWeek: autostopRequirementDaysOfWeek,
+					Weeks:      autostopRequirementWeeks,
+				},
+				AutostartRequirement: &codersdk.TemplateAutostartRequirement{
+					DaysOfWeek: autostartRequirementDaysOfWeek,
 				},
 				FailureTTLMillis:             failureTTL.Milliseconds(),
-				InactivityTTLMillis:          inactivityTTL.Milliseconds(),
+				TimeTilDormantMillis:         inactivityTTL.Milliseconds(),
 				AllowUserCancelWorkspaceJobs: allowUserCancelWorkspaceJobs,
 				AllowUserAutostart:           allowUserAutostart,
 				AllowUserAutostop:            allowUserAutostop,
+				RequireActiveVersion:         requireActiveVersion,
 			}
 
 			_, err = client.UpdateTemplateMeta(inv.Context(), template.ID, req)
 			if err != nil {
 				return xerrors.Errorf("update template metadata: %w", err)
 			}
-			_, _ = fmt.Fprintf(inv.Stdout, "Updated template metadata at %s!\n", cliui.DefaultStyles.DateTimeStamp.Render(time.Now().Format(time.Stamp)))
+			_, _ = fmt.Fprintf(inv.Stdout, "Updated template metadata at %s!\n", pretty.Sprint(cliui.DefaultStyles.DateTimeStamp, time.Now().Format(time.Stamp)))
 			return nil
 		},
 	}
@@ -142,47 +173,63 @@ func (r *RootCmd) templateEdit() *clibase.Cmd {
 		},
 		{
 			Flag:        "default-ttl",
-			Description: "Edit the template default time before shutdown - workspaces created from this template default to this value.",
+			Description: "Edit the template default time before shutdown - workspaces created from this template default to this value. Maps to \"Default autostop\" in the UI.",
 			Value:       clibase.DurationOf(&defaultTTL),
 		},
 		{
 			Flag:        "max-ttl",
-			Description: "Edit the template maximum time before shutdown - workspaces created from this template must shutdown within the given duration after starting. This is an enterprise-only feature.",
+			Description: "Edit the template maximum time before shutdown - workspaces created from this template must shutdown within the given duration after starting, regardless of user activity. This is an enterprise-only feature. Maps to \"Max lifetime\" in the UI.",
 			Value:       clibase.DurationOf(&maxTTL),
 		},
 		{
-			Flag:        "restart-requirement-weekdays",
-			Description: "Edit the template restart requirement weekdays - workspaces created from this template must be restarted on the given weekdays. To unset this value for the template (and disable the restart requirement for the template), pass 'none'.",
+			Flag: "autostart-requirement-weekdays",
+			// workspaces created from this template must be restarted on the given weekdays. To unset this value for the template (and disable the autostop requirement for the template), pass 'none'.
+			Description: "Edit the template autostart requirement weekdays - workspaces created from this template can only autostart on the given weekdays. To unset this value for the template (and allow autostart on all days), pass 'all'.",
+			Value: clibase.Validate(clibase.StringArrayOf(&autostartRequirementDaysOfWeek), func(value *clibase.StringArray) error {
+				v := value.GetSlice()
+				if len(v) == 1 && v[0] == "all" {
+					return nil
+				}
+				_, err := codersdk.WeekdaysToBitmap(v)
+				if err != nil {
+					return xerrors.Errorf("invalid autostart requirement days of week %q: %w", strings.Join(v, ","), err)
+				}
+				return nil
+			}),
+		},
+		{
+			Flag:        "autostop-requirement-weekdays",
+			Description: "Edit the template autostop requirement weekdays - workspaces created from this template must be restarted on the given weekdays. To unset this value for the template (and disable the autostop requirement for the template), pass 'none'.",
 			// TODO(@dean): unhide when we delete max_ttl
 			Hidden: true,
-			Value: clibase.Validate(clibase.StringArrayOf(&restartRequirementDaysOfWeek), func(value *clibase.StringArray) error {
+			Value: clibase.Validate(clibase.StringArrayOf(&autostopRequirementDaysOfWeek), func(value *clibase.StringArray) error {
 				v := value.GetSlice()
 				if len(v) == 1 && v[0] == "none" {
 					return nil
 				}
 				_, err := codersdk.WeekdaysToBitmap(v)
 				if err != nil {
-					return xerrors.Errorf("invalid restart requirement days of week %q: %w", strings.Join(v, ","), err)
+					return xerrors.Errorf("invalid autostop requirement days of week %q: %w", strings.Join(v, ","), err)
 				}
 				return nil
 			}),
 		},
 		{
-			Flag:        "restart-requirement-weeks",
-			Description: "Edit the template restart requirement weeks - workspaces created from this template must be restarted on an n-weekly basis.",
+			Flag:        "autostop-requirement-weeks",
+			Description: "Edit the template autostop requirement weeks - workspaces created from this template must be restarted on an n-weekly basis.",
 			// TODO(@dean): unhide when we delete max_ttl
 			Hidden: true,
-			Value:  clibase.Int64Of(&restartRequirementWeeks),
+			Value:  clibase.Int64Of(&autostopRequirementWeeks),
 		},
 		{
 			Flag:        "failure-ttl",
-			Description: "Specify a failure TTL for workspaces created from this template. This licensed feature's default is 0h (off).",
+			Description: "Specify a failure TTL for workspaces created from this template. It is the amount of time after a failed \"start\" build before coder automatically schedules a \"stop\" build to cleanup.This licensed feature's default is 0h (off). Maps to \"Failure cleanup\" in the UI.",
 			Default:     "0h",
 			Value:       clibase.DurationOf(&failureTTL),
 		},
 		{
 			Flag:        "inactivity-ttl",
-			Description: "Specify an inactivity TTL for workspaces created from this template. This licensed feature's default is 0h (off).",
+			Description: "Specify an inactivity TTL for workspaces created from this template. It is the amount of time the workspace is not used before it is be stopped and auto-locked. This includes across multiple builds (e.g. auto-starts and stops). This licensed feature's default is 0h (off). Maps to \"Dormancy threshold\" in the UI.",
 			Default:     "0h",
 			Value:       clibase.DurationOf(&inactivityTTL),
 		},
@@ -204,6 +251,12 @@ func (r *RootCmd) templateEdit() *clibase.Cmd {
 			Default:     "true",
 			Value:       clibase.BoolOf(&allowUserAutostop),
 		},
+		{
+			Flag:        "require-active-version",
+			Description: "Requires workspace builds to use the active template version. This setting does not apply to template admins. This is an enterprise-only feature.",
+			Value:       clibase.BoolOf(&requireActiveVersion),
+			Default:     "false",
+		},
 		cliui.SkipPromptOption(),
 	}
 
diff --git a/cli/templateedit_test.go b/cli/templateedit_test.go
index 87944cd5a0f60..de2e52894a444 100644
--- a/cli/templateedit_test.go
+++ b/cli/templateedit_test.go
@@ -18,11 +18,12 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestTemplateEdit(t *testing.T) {
@@ -31,10 +32,11 @@ func TestTemplateEdit(t *testing.T) {
 	t.Run("FirstEmptyThenModified", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		// Test the cli command.
 		name := "new-template-name"
@@ -56,7 +58,7 @@ func TestTemplateEdit(t *testing.T) {
 			"--allow-user-cancel-workspace-jobs=" + strconv.FormatBool(allowUserCancelWorkspaceJobs),
 		}
 		inv, root := clitest.New(t, cmdArgs...)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 
 		ctx := testutil.Context(t, testutil.WaitLong)
 		err := inv.WithContext(ctx).Run()
@@ -76,10 +78,11 @@ func TestTemplateEdit(t *testing.T) {
 	t.Run("FirstEmptyThenNotModified", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		// Test the cli command.
 		cmdArgs := []string{
@@ -93,7 +96,7 @@ func TestTemplateEdit(t *testing.T) {
 			"--allow-user-cancel-workspace-jobs=" + strconv.FormatBool(template.AllowUserCancelWorkspaceJobs),
 		}
 		inv, root := clitest.New(t, cmdArgs...)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 
 		ctx := testutil.Context(t, testutil.WaitLong)
 		err := inv.WithContext(ctx).Run()
@@ -112,10 +115,11 @@ func TestTemplateEdit(t *testing.T) {
 	t.Run("InvalidDisplayName", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		// Test the cli command.
 		cmdArgs := []string{
@@ -126,7 +130,7 @@ func TestTemplateEdit(t *testing.T) {
 			"--display-name", " a-b-c",
 		}
 		inv, root := clitest.New(t, cmdArgs...)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 
 		ctx := testutil.Context(t, testutil.WaitLong)
 		err := inv.WithContext(ctx).Run()
@@ -144,15 +148,16 @@ func TestTemplateEdit(t *testing.T) {
 	t.Run("WithPropertiesThenModified", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		initialDisplayName := "This is a template"
 		initialDescription := "This is description"
 		initialIcon := "/img/icon.png"
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 			ctr.DisplayName = initialDisplayName
 			ctr.Description = initialDescription
 			ctr.Icon = initialIcon
@@ -178,7 +183,7 @@ func TestTemplateEdit(t *testing.T) {
 			"--icon", icon,
 		}
 		inv, root := clitest.New(t, cmdArgs...)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 
 		ctx := testutil.Context(t, testutil.WaitLong)
 		err = inv.WithContext(ctx).Run()
@@ -196,15 +201,16 @@ func TestTemplateEdit(t *testing.T) {
 	t.Run("WithPropertiesThenEmptyEdit", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		initialDisplayName := "This is a template"
 		initialDescription := "This is description"
 		initialIcon := "/img/icon.png"
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 			ctr.DisplayName = initialDisplayName
 			ctr.Description = initialDescription
 			ctr.Icon = initialIcon
@@ -224,7 +230,7 @@ func TestTemplateEdit(t *testing.T) {
 			template.Name,
 		}
 		inv, root := clitest.New(t, cmdArgs...)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 
 		ctx := testutil.Context(t, testutil.WaitLong)
 		err = inv.WithContext(ctx).Run()
@@ -242,17 +248,18 @@ func TestTemplateEdit(t *testing.T) {
 		assert.Equal(t, "", updated.Icon)
 		assert.Equal(t, "", updated.DisplayName)
 	})
-	t.Run("RestartRequirement", func(t *testing.T) {
+	t.Run("Autostop/startRequirement", func(t *testing.T) {
 		t.Parallel()
 		t.Run("BlockedAGPL", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+			version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 				ctr.DefaultTTLMillis = nil
-				ctr.RestartRequirement = nil
+				ctr.AutostopRequirement = nil
 			})
 
 			cases := []struct {
@@ -263,20 +270,26 @@ func TestTemplateEdit(t *testing.T) {
 				{
 					name: "Weekdays",
 					flags: []string{
-						"--restart-requirement-weekdays", "monday",
+						"--autostop-requirement-weekdays", "monday",
 					},
 				},
 				{
 					name: "WeekdaysNoneAllowed",
 					flags: []string{
-						"--restart-requirement-weekdays", "none",
+						"--autostop-requirement-weekdays", "none",
 					},
 					ok: true,
 				},
 				{
 					name: "Weeks",
 					flags: []string{
-						"--restart-requirement-weeks", "1",
+						"--autostop-requirement-weeks", "1",
+					},
+				},
+				{
+					name: "AutostartDays",
+					flags: []string{
+						"--autostart-requirement-weekdays", "monday",
 					},
 				},
 			}
@@ -293,7 +306,7 @@ func TestTemplateEdit(t *testing.T) {
 					}
 					cmdArgs = append(cmdArgs, c.flags...)
 					inv, root := clitest.New(t, cmdArgs...)
-					clitest.SetupConfig(t, client, root)
+					clitest.SetupConfig(t, templateAdmin, root)
 
 					ctx := testutil.Context(t, testutil.WaitLong)
 					err := inv.WithContext(ctx).Run()
@@ -312,8 +325,10 @@ func TestTemplateEdit(t *testing.T) {
 					assert.Equal(t, template.Icon, updated.Icon)
 					assert.Equal(t, template.DisplayName, updated.DisplayName)
 					assert.Equal(t, template.DefaultTTLMillis, updated.DefaultTTLMillis)
-					assert.Equal(t, template.RestartRequirement.DaysOfWeek, updated.RestartRequirement.DaysOfWeek)
-					assert.Equal(t, template.RestartRequirement.Weeks, updated.RestartRequirement.Weeks)
+					assert.Equal(t, template.AutostopRequirement.DaysOfWeek, updated.AutostopRequirement.DaysOfWeek)
+					assert.Equal(t, template.AutostopRequirement.Weeks, updated.AutostopRequirement.Weeks)
+					assert.Equal(t, template.AutostartRequirement.DaysOfWeek, updated.AutostartRequirement.DaysOfWeek)
+					assert.Equal(t, template.AutostartRequirement.DaysOfWeek, updated.AutostartRequirement.DaysOfWeek)
 				})
 			}
 		})
@@ -321,12 +336,13 @@ func TestTemplateEdit(t *testing.T) {
 		t.Run("BlockedNotEntitled", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+			version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 				ctr.DefaultTTLMillis = nil
-				ctr.RestartRequirement = nil
+				ctr.AutostopRequirement = nil
 			})
 
 			// Make a proxy server that will return a valid entitlements
@@ -366,7 +382,7 @@ func TestTemplateEdit(t *testing.T) {
 			proxyURL, err := url.Parse(proxy.URL)
 			require.NoError(t, err)
 			proxyClient := codersdk.New(proxyURL)
-			proxyClient.SetSessionToken(client.SessionToken())
+			proxyClient.SetSessionToken(templateAdmin.SessionToken())
 			t.Cleanup(proxyClient.HTTPClient.CloseIdleConnections)
 
 			cases := []struct {
@@ -377,20 +393,20 @@ func TestTemplateEdit(t *testing.T) {
 				{
 					name: "Weekdays",
 					flags: []string{
-						"--restart-requirement-weekdays", "monday",
+						"--autostop-requirement-weekdays", "monday",
 					},
 				},
 				{
 					name: "WeekdaysNoneAllowed",
 					flags: []string{
-						"--restart-requirement-weekdays", "none",
+						"--autostop-requirement-weekdays", "none",
 					},
 					ok: true,
 				},
 				{
 					name: "Weeks",
 					flags: []string{
-						"--restart-requirement-weeks", "1",
+						"--autostop-requirement-weeks", "1",
 					},
 				},
 			}
@@ -426,20 +442,22 @@ func TestTemplateEdit(t *testing.T) {
 					assert.Equal(t, template.Icon, updated.Icon)
 					assert.Equal(t, template.DisplayName, updated.DisplayName)
 					assert.Equal(t, template.DefaultTTLMillis, updated.DefaultTTLMillis)
-					assert.Equal(t, template.RestartRequirement.DaysOfWeek, updated.RestartRequirement.DaysOfWeek)
-					assert.Equal(t, template.RestartRequirement.Weeks, updated.RestartRequirement.Weeks)
+					assert.Equal(t, template.AutostopRequirement.DaysOfWeek, updated.AutostopRequirement.DaysOfWeek)
+					assert.Equal(t, template.AutostopRequirement.Weeks, updated.AutostopRequirement.Weeks)
+					assert.Equal(t, template.AutostartRequirement.DaysOfWeek, updated.AutostartRequirement.DaysOfWeek)
 				})
 			}
 		})
 		t.Run("Entitled", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+			version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 				ctr.DefaultTTLMillis = nil
-				ctr.RestartRequirement = nil
+				ctr.AutostopRequirement = nil
 			})
 
 			// Make a proxy server that will return a valid entitlements
@@ -475,8 +493,8 @@ func TestTemplateEdit(t *testing.T) {
 					var req codersdk.UpdateTemplateMeta
 					err = json.Unmarshal(body, &req)
 					require.NoError(t, err)
-					assert.Equal(t, req.RestartRequirement.DaysOfWeek, []string{"monday", "tuesday"})
-					assert.EqualValues(t, req.RestartRequirement.Weeks, 3)
+					assert.Equal(t, req.AutostopRequirement.DaysOfWeek, []string{"monday", "tuesday"})
+					assert.EqualValues(t, req.AutostopRequirement.Weeks, 3)
 
 					r.Body = io.NopCloser(bytes.NewReader(body))
 					atomic.AddInt64(&updateTemplateCalled, 1)
@@ -496,7 +514,7 @@ func TestTemplateEdit(t *testing.T) {
 			proxyURL, err := url.Parse(proxy.URL)
 			require.NoError(t, err)
 			proxyClient := codersdk.New(proxyURL)
-			proxyClient.SetSessionToken(client.SessionToken())
+			proxyClient.SetSessionToken(templateAdmin.SessionToken())
 			t.Cleanup(proxyClient.HTTPClient.CloseIdleConnections)
 
 			// Test the cli command.
@@ -504,8 +522,8 @@ func TestTemplateEdit(t *testing.T) {
 				"templates",
 				"edit",
 				template.Name,
-				"--restart-requirement-weekdays", "monday,tuesday",
-				"--restart-requirement-weeks", "3",
+				"--autostop-requirement-weekdays", "monday,tuesday",
+				"--autostop-requirement-weeks", "3",
 			}
 			inv, root := clitest.New(t, cmdArgs...)
 			clitest.SetupConfig(t, proxyClient, root)
@@ -525,8 +543,9 @@ func TestTemplateEdit(t *testing.T) {
 			assert.Equal(t, template.Icon, updated.Icon)
 			assert.Equal(t, template.DisplayName, updated.DisplayName)
 			assert.Equal(t, template.DefaultTTLMillis, updated.DefaultTTLMillis)
-			assert.Equal(t, template.RestartRequirement.DaysOfWeek, updated.RestartRequirement.DaysOfWeek)
-			assert.Equal(t, template.RestartRequirement.Weeks, updated.RestartRequirement.Weeks)
+			assert.Equal(t, template.AutostopRequirement.DaysOfWeek, updated.AutostopRequirement.DaysOfWeek)
+			assert.Equal(t, template.AutostopRequirement.Weeks, updated.AutostopRequirement.Weeks)
+			assert.Equal(t, template.AutostartRequirement.DaysOfWeek, updated.AutostartRequirement.DaysOfWeek)
 		})
 	})
 	// TODO(@dean): remove this test when we remove max_ttl
@@ -535,10 +554,11 @@ func TestTemplateEdit(t *testing.T) {
 		t.Run("BlockedAGPL", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+			version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 				ctr.DefaultTTLMillis = nil
 				ctr.MaxTTLMillis = nil
 			})
@@ -551,7 +571,7 @@ func TestTemplateEdit(t *testing.T) {
 				"--max-ttl", "1h",
 			}
 			inv, root := clitest.New(t, cmdArgs...)
-			clitest.SetupConfig(t, client, root)
+			clitest.SetupConfig(t, templateAdmin, root)
 
 			ctx := testutil.Context(t, testutil.WaitLong)
 			err := inv.WithContext(ctx).Run()
@@ -572,10 +592,11 @@ func TestTemplateEdit(t *testing.T) {
 		t.Run("BlockedNotEntitled", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+			version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 				ctr.DefaultTTLMillis = nil
 				ctr.MaxTTLMillis = nil
 			})
@@ -617,7 +638,7 @@ func TestTemplateEdit(t *testing.T) {
 			proxyURL, err := url.Parse(proxy.URL)
 			require.NoError(t, err)
 			proxyClient := codersdk.New(proxyURL)
-			proxyClient.SetSessionToken(client.SessionToken())
+			proxyClient.SetSessionToken(templateAdmin.SessionToken())
 			t.Cleanup(proxyClient.HTTPClient.CloseIdleConnections)
 
 			// Test the cli command.
@@ -648,10 +669,11 @@ func TestTemplateEdit(t *testing.T) {
 		t.Run("Entitled", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+			version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 				ctr.DefaultTTLMillis = nil
 				ctr.MaxTTLMillis = nil
 			})
@@ -709,7 +731,7 @@ func TestTemplateEdit(t *testing.T) {
 			proxyURL, err := url.Parse(proxy.URL)
 			require.NoError(t, err)
 			proxyClient := codersdk.New(proxyURL)
-			proxyClient.SetSessionToken(client.SessionToken())
+			proxyClient.SetSessionToken(templateAdmin.SessionToken())
 			t.Cleanup(proxyClient.HTTPClient.CloseIdleConnections)
 
 			// Test the cli command.
@@ -745,14 +767,15 @@ func TestTemplateEdit(t *testing.T) {
 		t.Run("BlockedAGPL", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+			version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 				ctr.DefaultTTLMillis = nil
-				ctr.RestartRequirement = nil
+				ctr.AutostopRequirement = nil
 				ctr.FailureTTLMillis = nil
-				ctr.InactivityTTLMillis = nil
+				ctr.TimeTilDormantMillis = nil
 			})
 
 			// Test the cli command with --allow-user-autostart.
@@ -763,7 +786,7 @@ func TestTemplateEdit(t *testing.T) {
 				"--allow-user-autostart=false",
 			}
 			inv, root := clitest.New(t, cmdArgs...)
-			clitest.SetupConfig(t, client, root)
+			clitest.SetupConfig(t, templateAdmin, root)
 
 			ctx := testutil.Context(t, testutil.WaitLong)
 			err := inv.WithContext(ctx).Run()
@@ -778,7 +801,7 @@ func TestTemplateEdit(t *testing.T) {
 				"--allow-user-autostop=false",
 			}
 			inv, root = clitest.New(t, cmdArgs...)
-			clitest.SetupConfig(t, client, root)
+			clitest.SetupConfig(t, templateAdmin, root)
 
 			ctx = testutil.Context(t, testutil.WaitLong)
 			err = inv.WithContext(ctx).Run()
@@ -793,21 +816,23 @@ func TestTemplateEdit(t *testing.T) {
 			assert.Equal(t, template.Icon, updated.Icon)
 			assert.Equal(t, template.DisplayName, updated.DisplayName)
 			assert.Equal(t, template.DefaultTTLMillis, updated.DefaultTTLMillis)
-			assert.Equal(t, template.RestartRequirement.DaysOfWeek, updated.RestartRequirement.DaysOfWeek)
-			assert.Equal(t, template.RestartRequirement.Weeks, updated.RestartRequirement.Weeks)
+			assert.Equal(t, template.AutostopRequirement.DaysOfWeek, updated.AutostopRequirement.DaysOfWeek)
+			assert.Equal(t, template.AutostopRequirement.Weeks, updated.AutostopRequirement.Weeks)
+			assert.Equal(t, template.AutostartRequirement.DaysOfWeek, updated.AutostartRequirement.DaysOfWeek)
 			assert.Equal(t, template.AllowUserAutostart, updated.AllowUserAutostart)
 			assert.Equal(t, template.AllowUserAutostop, updated.AllowUserAutostop)
 			assert.Equal(t, template.FailureTTLMillis, updated.FailureTTLMillis)
-			assert.Equal(t, template.InactivityTTLMillis, updated.InactivityTTLMillis)
+			assert.Equal(t, template.TimeTilDormantMillis, updated.TimeTilDormantMillis)
 		})
 
 		t.Run("BlockedNotEntitled", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+			version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 			// Make a proxy server that will return a valid entitlements
 			// response, but without advanced scheduling entitlement.
@@ -846,7 +871,7 @@ func TestTemplateEdit(t *testing.T) {
 			proxyURL, err := url.Parse(proxy.URL)
 			require.NoError(t, err)
 			proxyClient := codersdk.New(proxyURL)
-			proxyClient.SetSessionToken(client.SessionToken())
+			proxyClient.SetSessionToken(templateAdmin.SessionToken())
 			t.Cleanup(proxyClient.HTTPClient.CloseIdleConnections)
 
 			// Test the cli command with --allow-user-autostart.
@@ -887,20 +912,22 @@ func TestTemplateEdit(t *testing.T) {
 			assert.Equal(t, template.Icon, updated.Icon)
 			assert.Equal(t, template.DisplayName, updated.DisplayName)
 			assert.Equal(t, template.DefaultTTLMillis, updated.DefaultTTLMillis)
-			assert.Equal(t, template.RestartRequirement.DaysOfWeek, updated.RestartRequirement.DaysOfWeek)
-			assert.Equal(t, template.RestartRequirement.Weeks, updated.RestartRequirement.Weeks)
+			assert.Equal(t, template.AutostopRequirement.DaysOfWeek, updated.AutostopRequirement.DaysOfWeek)
+			assert.Equal(t, template.AutostopRequirement.Weeks, updated.AutostopRequirement.Weeks)
+			assert.Equal(t, template.AutostartRequirement.DaysOfWeek, updated.AutostartRequirement.DaysOfWeek)
 			assert.Equal(t, template.AllowUserAutostart, updated.AllowUserAutostart)
 			assert.Equal(t, template.AllowUserAutostop, updated.AllowUserAutostop)
 			assert.Equal(t, template.FailureTTLMillis, updated.FailureTTLMillis)
-			assert.Equal(t, template.InactivityTTLMillis, updated.InactivityTTLMillis)
+			assert.Equal(t, template.TimeTilDormantMillis, updated.TimeTilDormantMillis)
 		})
 		t.Run("Entitled", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+			version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 			// Make a proxy server that will return a valid entitlements
 			// response, including a valid advanced scheduling entitlement.
@@ -956,7 +983,7 @@ func TestTemplateEdit(t *testing.T) {
 			proxyURL, err := url.Parse(proxy.URL)
 			require.NoError(t, err)
 			proxyClient := codersdk.New(proxyURL)
-			proxyClient.SetSessionToken(client.SessionToken())
+			proxyClient.SetSessionToken(templateAdmin.SessionToken())
 			t.Cleanup(proxyClient.HTTPClient.CloseIdleConnections)
 
 			// Test the cli command.
@@ -985,12 +1012,39 @@ func TestTemplateEdit(t *testing.T) {
 			assert.Equal(t, template.Icon, updated.Icon)
 			assert.Equal(t, template.DisplayName, updated.DisplayName)
 			assert.Equal(t, template.DefaultTTLMillis, updated.DefaultTTLMillis)
-			assert.Equal(t, template.RestartRequirement.DaysOfWeek, updated.RestartRequirement.DaysOfWeek)
-			assert.Equal(t, template.RestartRequirement.Weeks, updated.RestartRequirement.Weeks)
+			assert.Equal(t, template.AutostopRequirement.DaysOfWeek, updated.AutostopRequirement.DaysOfWeek)
+			assert.Equal(t, template.AutostopRequirement.Weeks, updated.AutostopRequirement.Weeks)
+			assert.Equal(t, template.AutostartRequirement.DaysOfWeek, updated.AutostartRequirement.DaysOfWeek)
 			assert.Equal(t, template.AllowUserAutostart, updated.AllowUserAutostart)
 			assert.Equal(t, template.AllowUserAutostop, updated.AllowUserAutostop)
 			assert.Equal(t, template.FailureTTLMillis, updated.FailureTTLMillis)
-			assert.Equal(t, template.InactivityTTLMillis, updated.InactivityTTLMillis)
+			assert.Equal(t, template.TimeTilDormantMillis, updated.TimeTilDormantMillis)
 		})
 	})
+
+	t.Run("RequireActiveVersion", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {})
+
+		// Test the cli command with --allow-user-autostart.
+		cmdArgs := []string{
+			"templates",
+			"edit",
+			template.Name,
+			"--require-active-version",
+		}
+		inv, root := clitest.New(t, cmdArgs...)
+		//nolint
+		clitest.SetupConfig(t, client, root)
+
+		ctx := testutil.Context(t, testutil.WaitLong)
+		err := inv.WithContext(ctx).Run()
+		require.Error(t, err)
+		require.ErrorContains(t, err, "appears to be an AGPL deployment")
+	})
 }
diff --git a/cli/templateinit.go b/cli/templateinit.go
index b42e555fde074..a9577733bc0fb 100644
--- a/cli/templateinit.go
+++ b/cli/templateinit.go
@@ -12,11 +12,12 @@ import (
 	"golang.org/x/exp/maps"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/examples"
-	"github.com/coder/coder/provisionersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/examples"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/pretty"
 )
 
 func (*RootCmd) templateInit() *clibase.Cmd {
@@ -42,17 +43,21 @@ func (*RootCmd) templateInit() *clibase.Cmd {
 				for _, example := range exampleList {
 					name := fmt.Sprintf(
 						"%s\n%s\n%s\n",
-						cliui.DefaultStyles.Bold.Render(example.Name),
-						cliui.DefaultStyles.Wrap.Copy().PaddingLeft(6).Render(example.Description),
-						cliui.DefaultStyles.Keyword.Copy().PaddingLeft(6).Render(example.URL),
+						cliui.Bold(example.Name),
+						pretty.Sprint(cliui.DefaultStyles.Wrap.With(pretty.XPad(6, 0)), example.Description),
+						pretty.Sprint(cliui.DefaultStyles.Keyword.With(pretty.XPad(6, 0)), example.URL),
 					)
 					optsToID[name] = example.ID
 				}
 				opts := maps.Keys(optsToID)
 				sort.Strings(opts)
-				_, _ = fmt.Fprintln(inv.Stdout, cliui.DefaultStyles.Wrap.Render(
-					"A template defines infrastructure as code to be provisioned "+
-						"for individual developer workspaces. Select an example to be copied to the active directory:\n"))
+				_, _ = fmt.Fprintln(
+					inv.Stdout,
+					pretty.Sprint(
+						cliui.DefaultStyles.Wrap,
+						"A template defines infrastructure as code to be provisioned "+
+							"for individual developer workspaces. Select an example to be copied to the active directory:\n"),
+				)
 				selected, err := cliui.Select(inv, cliui.SelectOptions{
 					Options: opts,
 				})
@@ -94,7 +99,7 @@ func (*RootCmd) templateInit() *clibase.Cmd {
 			} else {
 				relPath = "./" + relPath
 			}
-			_, _ = fmt.Fprintf(inv.Stdout, "Extracting %s to %s...\n", cliui.DefaultStyles.Field.Render(selectedTemplate.ID), relPath)
+			_, _ = fmt.Fprintf(inv.Stdout, "Extracting %s to %s...\n", pretty.Sprint(cliui.DefaultStyles.Field, selectedTemplate.ID), relPath)
 			err = os.MkdirAll(directory, 0o700)
 			if err != nil {
 				return err
@@ -104,8 +109,13 @@ func (*RootCmd) templateInit() *clibase.Cmd {
 				return err
 			}
 			_, _ = fmt.Fprintln(inv.Stdout, "Create your template by running:")
-			_, _ = fmt.Fprintln(inv.Stdout, cliui.DefaultStyles.Paragraph.Render(cliui.DefaultStyles.Code.Render("cd "+relPath+" && coder templates create"))+"\n")
-			_, _ = fmt.Fprintln(inv.Stdout, cliui.DefaultStyles.Wrap.Render("Examples provide a starting point and are expected to be edited! 🎨"))
+			_, _ = fmt.Fprintln(
+				inv.Stdout,
+				pretty.Sprint(
+					cliui.DefaultStyles.Code,
+					"cd "+relPath+" && coder templates create"),
+			)
+			_, _ = fmt.Fprintln(inv.Stdout, pretty.Sprint(cliui.DefaultStyles.Wrap, "\nExamples provide a starting point and are expected to be edited! 🎨"))
 			return nil
 		},
 	}
diff --git a/cli/templateinit_test.go b/cli/templateinit_test.go
index ba99f76e95ece..f8172df25f560 100644
--- a/cli/templateinit_test.go
+++ b/cli/templateinit_test.go
@@ -6,8 +6,8 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestTemplateInit(t *testing.T) {
diff --git a/cli/templatelist.go b/cli/templatelist.go
index ba17bf218e695..6d95521dad321 100644
--- a/cli/templatelist.go
+++ b/cli/templatelist.go
@@ -5,9 +5,9 @@ import (
 
 	"github.com/fatih/color"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) templateList() *clibase.Cmd {
diff --git a/cli/templatelist_test.go b/cli/templatelist_test.go
index 8e29c8f49edbc..98796a3906b06 100644
--- a/cli/templatelist_test.go
+++ b/cli/templatelist_test.go
@@ -9,11 +9,12 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestTemplateList(t *testing.T) {
@@ -21,17 +22,18 @@ func TestTemplateList(t *testing.T) {
 	t.Run("ListTemplates", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		firstVersion := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, firstVersion.ID)
-		firstTemplate := coderdtest.CreateTemplate(t, client, user.OrganizationID, firstVersion.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		firstVersion := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, firstVersion.ID)
+		firstTemplate := coderdtest.CreateTemplate(t, client, owner.OrganizationID, firstVersion.ID)
 
-		secondVersion := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, secondVersion.ID)
-		secondTemplate := coderdtest.CreateTemplate(t, client, user.OrganizationID, secondVersion.ID)
+		secondVersion := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, secondVersion.ID)
+		secondTemplate := coderdtest.CreateTemplate(t, client, owner.OrganizationID, secondVersion.ID)
 
 		inv, root := clitest.New(t, "templates", "list")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 
 		pty := ptytest.New(t).Attach(inv)
 
@@ -56,17 +58,18 @@ func TestTemplateList(t *testing.T) {
 	t.Run("ListTemplatesJSON", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		firstVersion := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, firstVersion.ID)
-		_ = coderdtest.CreateTemplate(t, client, user.OrganizationID, firstVersion.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		firstVersion := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, firstVersion.ID)
+		_ = coderdtest.CreateTemplate(t, client, owner.OrganizationID, firstVersion.ID)
 
-		secondVersion := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, secondVersion.ID)
-		_ = coderdtest.CreateTemplate(t, client, user.OrganizationID, secondVersion.ID)
+		secondVersion := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, secondVersion.ID)
+		_ = coderdtest.CreateTemplate(t, client, owner.OrganizationID, secondVersion.ID)
 
 		inv, root := clitest.New(t, "templates", "list", "--output=json")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 
 		ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancelFunc()
@@ -83,10 +86,11 @@ func TestTemplateList(t *testing.T) {
 	t.Run("NoTemplates", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{})
-		coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
 		inv, root := clitest.New(t, "templates", "list")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 
 		pty := ptytest.New(t)
 		inv.Stdin = pty.Input()
diff --git a/cli/templateplan.go b/cli/templateplan.go
deleted file mode 100644
index bc99d2f4e3cdf..0000000000000
--- a/cli/templateplan.go
+++ /dev/null
@@ -1,18 +0,0 @@
-package cli
-
-import (
-	"github.com/coder/coder/cli/clibase"
-)
-
-func (*RootCmd) templatePlan() *clibase.Cmd {
-	return &clibase.Cmd{
-		Use: "plan <directory>",
-		Middleware: clibase.Chain(
-			clibase.RequireNArgs(1),
-		),
-		Short: "Plan a template push from the current directory",
-		Handler: func(inv *clibase.Invocation) error {
-			return nil
-		},
-	}
-}
diff --git a/cli/templatepull.go b/cli/templatepull.go
index 5994807325713..13286ab0331cd 100644
--- a/cli/templatepull.go
+++ b/cli/templatepull.go
@@ -9,18 +9,21 @@ import (
 	"github.com/codeclysm/extract/v3"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) templatePull() *clibase.Cmd {
-	var tarMode bool
+	var (
+		tarMode     bool
+		versionName string
+	)
 
 	client := new(codersdk.Client)
 	cmd := &clibase.Cmd{
 		Use:   "pull <name> [destination]",
-		Short: "Download the latest version of a template to a path.",
+		Short: "Download the active, latest, or specified version of a template to a path.",
 		Middleware: clibase.Chain(
 			clibase.RequireRangeArgs(1, 2),
 			r.InitClient(client),
@@ -36,39 +39,67 @@ func (r *RootCmd) templatePull() *clibase.Cmd {
 				dest = inv.Args[1]
 			}
 
-			// TODO(JonA): Do we need to add a flag for organization?
 			organization, err := CurrentOrganization(inv, client)
 			if err != nil {
-				return xerrors.Errorf("current organization: %w", err)
+				return xerrors.Errorf("get current organization: %w", err)
 			}
 
 			template, err := client.TemplateByName(ctx, organization.ID, templateName)
 			if err != nil {
-				return xerrors.Errorf("template by name: %w", err)
+				return xerrors.Errorf("get template by name: %w", err)
 			}
 
-			// Pull the versions for the template. We'll find the latest
-			// one and download the source.
-			versions, err := client.TemplateVersionsByTemplate(ctx, codersdk.TemplateVersionsByTemplateRequest{
-				TemplateID: template.ID,
-			})
-			if err != nil {
-				return xerrors.Errorf("template versions by template: %w", err)
-			}
+			var latestVersion codersdk.TemplateVersion
+			{
+				// Determine the latest template version and compare with the
+				// active version. If they aren't the same, warn the user.
+				versions, err := client.TemplateVersionsByTemplate(ctx, codersdk.TemplateVersionsByTemplateRequest{
+					TemplateID: template.ID,
+				})
+				if err != nil {
+					return xerrors.Errorf("template versions by template: %w", err)
+				}
+
+				if len(versions) == 0 {
+					return xerrors.Errorf("no template versions for template %q", templateName)
+				}
+
+				// Sort the slice from newest to oldest template.
+				sort.SliceStable(versions, func(i, j int) bool {
+					return versions[i].CreatedAt.After(versions[j].CreatedAt)
+				})
 
-			if len(versions) == 0 {
-				return xerrors.Errorf("no template versions for template %q", templateName)
+				latestVersion = versions[0]
 			}
 
-			// Sort the slice from newest to oldest template.
-			sort.SliceStable(versions, func(i, j int) bool {
-				return versions[i].CreatedAt.After(versions[j].CreatedAt)
-			})
+			var templateVersion codersdk.TemplateVersion
+			switch versionName {
+			case "", "active":
+				activeVersion, err := client.TemplateVersion(ctx, template.ActiveVersionID)
+				if err != nil {
+					return xerrors.Errorf("get active template version: %w", err)
+				}
+				if versionName == "" && activeVersion.ID != latestVersion.ID {
+					cliui.Warn(inv.Stderr,
+						"A newer template version than the active version exists. Pulling the active version instead.",
+						"Use "+cliui.Code("--template latest")+" to pull the latest version.",
+					)
+				}
+				templateVersion = activeVersion
+			case "latest":
+				templateVersion = latestVersion
+			default:
+				version, err := client.TemplateVersionByName(ctx, template.ID, versionName)
+				if err != nil {
+					return xerrors.Errorf("get template version: %w", err)
+				}
+				templateVersion = version
+			}
 
-			latest := versions[0]
+			cliui.Info(inv.Stderr, "Pulling template version "+cliui.Bold(templateVersion.Name)+"...")
 
 			// Download the tar archive.
-			raw, ctype, err := client.Download(ctx, latest.Job.FileID)
+			raw, ctype, err := client.Download(ctx, templateVersion.Job.FileID)
 			if err != nil {
 				return xerrors.Errorf("download template: %w", err)
 			}
@@ -83,7 +114,7 @@ func (r *RootCmd) templatePull() *clibase.Cmd {
 			}
 
 			if dest == "" {
-				dest = templateName + "/"
+				dest = templateName
 			}
 
 			err = os.MkdirAll(dest, 0o750)
@@ -121,6 +152,12 @@ func (r *RootCmd) templatePull() *clibase.Cmd {
 
 			Value: clibase.BoolOf(&tarMode),
 		},
+		{
+			Description: "The name of the template version to pull. Use 'active' to pull the active version, 'latest' to pull the latest version, or the name of the template version to pull.",
+			Flag:        "version",
+
+			Value: clibase.StringOf(&versionName),
+		},
 		cliui.SkipPromptOption(),
 	}
 
diff --git a/cli/templatepull_test.go b/cli/templatepull_test.go
index 1fdfe80d6ef50..782859c6a93ca 100644
--- a/cli/templatepull_test.go
+++ b/cli/templatepull_test.go
@@ -7,17 +7,19 @@ import (
 	"encoding/hex"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/codeclysm/extract/v3"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 // dirSum calculates a checksum of the files in a directory.
@@ -40,174 +42,367 @@ func dirSum(t *testing.T, dir string) string {
 	return hex.EncodeToString(sum.Sum(nil))
 }
 
-func TestTemplatePull(t *testing.T) {
+func TestTemplatePull_NoName(t *testing.T) {
 	t.Parallel()
 
-	t.Run("NoName", func(t *testing.T) {
-		t.Parallel()
+	inv, _ := clitest.New(t, "templates", "pull")
+	err := inv.Run()
+	require.Error(t, err)
+}
+
+// Stdout tests that 'templates pull' pulls down the active template
+// and writes it to stdout.
+func TestTemplatePull_Stdout(t *testing.T) {
+	t.Parallel()
 
-		inv, _ := clitest.New(t, "templates", "pull")
-		err := inv.Run()
-		require.Error(t, err)
+	client := coderdtest.New(t, &coderdtest.Options{
+		IncludeProvisionerDaemon: true,
 	})
+	owner := coderdtest.CreateFirstUser(t, client)
+	templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
-	// Stdout tests that 'templates pull' pulls down the latest template
-	// and writes it to stdout.
-	t.Run("Stdout", func(t *testing.T) {
-		t.Parallel()
+	// Create an initial template bundle.
+	source1 := genTemplateVersionSource()
+	// Create an updated template bundle. This will be used to ensure
+	// that templates are correctly returned in order from latest to oldest.
+	source2 := genTemplateVersionSource()
 
-		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
+	expected, err := echo.Tar(source2)
+	require.NoError(t, err)
 
-		// Create an initial template bundle.
-		source1 := genTemplateVersionSource()
-		// Create an updated template bundle. This will be used to ensure
-		// that templates are correctly returned in order from latest to oldest.
-		source2 := genTemplateVersionSource()
+	version1 := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, source1)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version1.ID)
 
-		expected, err := echo.Tar(source2)
-		require.NoError(t, err)
+	template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version1.ID)
 
-		version1 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, source1)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version1.ID)
+	// Update the template version so that we can assert that templates
+	// are being sorted correctly.
+	updatedVersion := coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, source2, template.ID)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, updatedVersion.ID)
+	coderdtest.UpdateActiveTemplateVersion(t, client, template.ID, updatedVersion.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version1.ID)
+	inv, root := clitest.New(t, "templates", "pull", "--tar", template.Name)
+	clitest.SetupConfig(t, templateAdmin, root)
 
-		// Update the template version so that we can assert that templates
-		// are being sorted correctly.
-		_ = coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, source2, template.ID)
+	var buf bytes.Buffer
+	inv.Stdout = &buf
 
-		inv, root := clitest.New(t, "templates", "pull", "--tar", template.Name)
-		clitest.SetupConfig(t, client, root)
+	err = inv.Run()
+	require.NoError(t, err)
 
-		var buf bytes.Buffer
-		inv.Stdout = &buf
+	require.True(t, bytes.Equal(expected, buf.Bytes()), "tar files differ")
+}
 
-		err = inv.Run()
-		require.NoError(t, err)
+// Stdout tests that 'templates pull' pulls down the non-latest active template
+// and writes it to stdout.
+func TestTemplatePull_ActiveOldStdout(t *testing.T) {
+	t.Parallel()
 
-		require.True(t, bytes.Equal(expected, buf.Bytes()), "tar files differ")
+	client := coderdtest.New(t, &coderdtest.Options{
+		IncludeProvisionerDaemon: true,
 	})
+	owner := coderdtest.CreateFirstUser(t, client)
+	templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
-	// ToDir tests that 'templates pull' pulls down the latest template
-	// and writes it to the correct directory.
-	t.Run("ToDir", func(t *testing.T) {
-		t.Parallel()
+	source1 := genTemplateVersionSource()
+	source2 := genTemplateVersionSource()
 
-		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
+	expected, err := echo.Tar(source1)
+	require.NoError(t, err)
 
-		// Create an initial template bundle.
-		source1 := genTemplateVersionSource()
-		// Create an updated template bundle. This will be used to ensure
-		// that templates are correctly returned in order from latest to oldest.
-		source2 := genTemplateVersionSource()
+	version1 := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, source1)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version1.ID)
 
-		expected, err := echo.Tar(source2)
-		require.NoError(t, err)
+	template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version1.ID)
+
+	updatedVersion := coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, source2, template.ID)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, updatedVersion.ID)
 
-		version1 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, source1)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version1.ID)
+	inv, root := clitest.New(t, "templates", "pull", "--tar", template.Name)
+	clitest.SetupConfig(t, templateAdmin, root)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version1.ID)
+	var buf bytes.Buffer
+	inv.Stdout = &buf
+	var stderr strings.Builder
+	inv.Stderr = &stderr
 
-		// Update the template version so that we can assert that templates
-		// are being sorted correctly.
-		_ = coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, source2, template.ID)
+	err = inv.Run()
+	require.NoError(t, err)
+
+	require.True(t, bytes.Equal(expected, buf.Bytes()), "tar files differ")
+	require.Contains(t, stderr.String(), "A newer template version than the active version exists.")
+}
 
-		dir := t.TempDir()
+// Stdout tests that 'templates pull' pulls down the specified template and
+// writes it to stdout.
+func TestTemplatePull_SpecifiedStdout(t *testing.T) {
+	t.Parallel()
 
-		expectedDest := filepath.Join(dir, "expected")
-		actualDest := filepath.Join(dir, "actual")
-		ctx := context.Background()
+	client := coderdtest.New(t, &coderdtest.Options{
+		IncludeProvisionerDaemon: true,
+	})
+	owner := coderdtest.CreateFirstUser(t, client)
+	templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
-		err = extract.Tar(ctx, bytes.NewReader(expected), expectedDest, nil)
-		require.NoError(t, err)
+	source1 := genTemplateVersionSource()
+	source2 := genTemplateVersionSource()
+	source3 := genTemplateVersionSource()
 
-		inv, root := clitest.New(t, "templates", "pull", template.Name, actualDest)
-		clitest.SetupConfig(t, client, root)
+	expected, err := echo.Tar(source1)
+	require.NoError(t, err)
 
-		ptytest.New(t).Attach(inv)
+	version1 := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, source1)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version1.ID)
 
-		require.NoError(t, inv.Run())
+	template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version1.ID)
 
-		require.Equal(t,
-			dirSum(t, expectedDest),
-			dirSum(t, actualDest),
-		)
+	updatedVersion := coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, source2, template.ID)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, updatedVersion.ID)
+
+	updatedVersion2 := coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, source3, template.ID)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, updatedVersion2.ID)
+	coderdtest.UpdateActiveTemplateVersion(t, client, template.ID, updatedVersion2.ID)
+
+	inv, root := clitest.New(t, "templates", "pull", "--tar", template.Name, "--version", version1.Name)
+	clitest.SetupConfig(t, templateAdmin, root)
+
+	var buf bytes.Buffer
+	inv.Stdout = &buf
+
+	err = inv.Run()
+	require.NoError(t, err)
+
+	require.True(t, bytes.Equal(expected, buf.Bytes()), "tar files differ")
+}
+
+// Stdout tests that 'templates pull' pulls down the latest template
+// and writes it to stdout.
+func TestTemplatePull_LatestStdout(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, &coderdtest.Options{
+		IncludeProvisionerDaemon: true,
 	})
+	owner := coderdtest.CreateFirstUser(t, client)
+	templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
-	// FolderConflict tests that 'templates pull' fails when a folder with has
-	// existing
-	t.Run("FolderConflict", func(t *testing.T) {
-		t.Parallel()
+	source1 := genTemplateVersionSource()
+	source2 := genTemplateVersionSource()
 
-		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
+	expected, err := echo.Tar(source1)
+	require.NoError(t, err)
 
-		// Create an initial template bundle.
-		source1 := genTemplateVersionSource()
-		// Create an updated template bundle. This will be used to ensure
-		// that templates are correctly returned in order from latest to oldest.
-		source2 := genTemplateVersionSource()
+	version1 := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, source1)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version1.ID)
 
-		expected, err := echo.Tar(source2)
-		require.NoError(t, err)
+	template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version1.ID)
 
-		version1 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, source1)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version1.ID)
+	updatedVersion := coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, source2, template.ID)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, updatedVersion.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version1.ID)
+	inv, root := clitest.New(t, "templates", "pull", "--tar", template.Name, "latest")
+	clitest.SetupConfig(t, templateAdmin, root)
 
-		// Update the template version so that we can assert that templates
-		// are being sorted correctly.
-		_ = coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, source2, template.ID)
+	var buf bytes.Buffer
+	inv.Stdout = &buf
 
-		dir := t.TempDir()
+	err = inv.Run()
+	require.NoError(t, err)
 
-		expectedDest := filepath.Join(dir, "expected")
-		conflictDest := filepath.Join(dir, "conflict")
+	require.True(t, bytes.Equal(expected, buf.Bytes()), "tar files differ")
+}
 
-		err = os.MkdirAll(conflictDest, 0o700)
-		require.NoError(t, err)
+// ToDir tests that 'templates pull' pulls down the active template
+// and writes it to the correct directory.
+func TestTemplatePull_ToDir(t *testing.T) {
+	t.Parallel()
 
-		err = os.WriteFile(
-			filepath.Join(conflictDest, "conflict-file"),
-			[]byte("conflict"), 0o600,
-		)
-		require.NoError(t, err)
+	client := coderdtest.New(t, &coderdtest.Options{
+		IncludeProvisionerDaemon: true,
+	})
+	owner := coderdtest.CreateFirstUser(t, client)
+	templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
-		ctx := context.Background()
+	// Create an initial template bundle.
+	source1 := genTemplateVersionSource()
+	// Create an updated template bundle. This will be used to ensure
+	// that templates are correctly returned in order from latest to oldest.
+	source2 := genTemplateVersionSource()
 
-		err = extract.Tar(ctx, bytes.NewReader(expected), expectedDest, nil)
-		require.NoError(t, err)
+	expected, err := echo.Tar(source2)
+	require.NoError(t, err)
 
-		inv, root := clitest.New(t, "templates", "pull", template.Name, conflictDest)
-		clitest.SetupConfig(t, client, root)
+	version1 := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, source1)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version1.ID)
 
-		pty := ptytest.New(t).Attach(inv)
+	template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version1.ID)
 
-		waiter := clitest.StartWithWaiter(t, inv)
+	// Update the template version so that we can assert that templates
+	// are being sorted correctly.
+	updatedVersion := coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, source2, template.ID)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, updatedVersion.ID)
+	coderdtest.UpdateActiveTemplateVersion(t, client, template.ID, updatedVersion.ID)
 
-		pty.ExpectMatch("not empty")
-		pty.WriteLine("no")
+	dir := t.TempDir()
 
-		waiter.RequireError()
+	expectedDest := filepath.Join(dir, "expected")
+	actualDest := filepath.Join(dir, "actual")
+	ctx := context.Background()
 
-		ents, err := os.ReadDir(conflictDest)
-		require.NoError(t, err)
+	err = extract.Tar(ctx, bytes.NewReader(expected), expectedDest, nil)
+	require.NoError(t, err)
+
+	inv, root := clitest.New(t, "templates", "pull", template.Name, actualDest)
+	clitest.SetupConfig(t, templateAdmin, root)
+
+	ptytest.New(t).Attach(inv)
 
-		require.Len(t, ents, 1, "conflict folder should have single conflict file")
+	require.NoError(t, inv.Run())
+
+	require.Equal(t,
+		dirSum(t, expectedDest),
+		dirSum(t, actualDest),
+	)
+}
+
+// ToDir tests that 'templates pull' pulls down the active template and writes
+// it to a directory with the name of the template if the path is not implicitly
+// supplied.
+// nolint: paralleltest
+func TestTemplatePull_ToImplicit(t *testing.T) {
+	client := coderdtest.New(t, &coderdtest.Options{
+		IncludeProvisionerDaemon: true,
+	})
+	owner := coderdtest.CreateFirstUser(t, client)
+	templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+
+	// Create an initial template bundle.
+	source1 := genTemplateVersionSource()
+	// Create an updated template bundle. This will be used to ensure
+	// that templates are correctly returned in order from latest to oldest.
+	source2 := genTemplateVersionSource()
+
+	expected, err := echo.Tar(source2)
+	require.NoError(t, err)
+
+	version1 := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, source1)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version1.ID)
+
+	template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version1.ID)
+
+	// Update the template version so that we can assert that templates
+	// are being sorted correctly.
+	updatedVersion := coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, source2, template.ID)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, updatedVersion.ID)
+	coderdtest.UpdateActiveTemplateVersion(t, client, template.ID, updatedVersion.ID)
+
+	// create a tempdir and change the working directory to it for the duration of the test (cannot run in parallel)
+	dir := t.TempDir()
+	wd, err := os.Getwd()
+	require.NoError(t, err)
+	err = os.Chdir(dir)
+	require.NoError(t, err)
+	defer func() {
+		err := os.Chdir(wd)
+		require.NoError(t, err, "if this fails, it can break other subsequent tests due to wrong working directory")
+	}()
+
+	expectedDest := filepath.Join(dir, "expected")
+	actualDest := filepath.Join(dir, template.Name)
+
+	ctx := context.Background()
+
+	err = extract.Tar(ctx, bytes.NewReader(expected), expectedDest, nil)
+	require.NoError(t, err)
+
+	inv, root := clitest.New(t, "templates", "pull", template.Name)
+	clitest.SetupConfig(t, templateAdmin, root)
+
+	ptytest.New(t).Attach(inv)
+
+	require.NoError(t, inv.Run())
+
+	require.Equal(t,
+		dirSum(t, expectedDest),
+		dirSum(t, actualDest),
+	)
+}
+
+// FolderConflict tests that 'templates pull' fails when a folder with has
+// existing
+func TestTemplatePull_FolderConflict(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, &coderdtest.Options{
+		IncludeProvisionerDaemon: true,
 	})
+	owner := coderdtest.CreateFirstUser(t, client)
+	templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+
+	// Create an initial template bundle.
+	source1 := genTemplateVersionSource()
+	// Create an updated template bundle. This will be used to ensure
+	// that templates are correctly returned in order from latest to oldest.
+	source2 := genTemplateVersionSource()
+
+	expected, err := echo.Tar(source2)
+	require.NoError(t, err)
+
+	version1 := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, source1)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version1.ID)
+
+	template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version1.ID)
+
+	// Update the template version so that we can assert that templates
+	// are being sorted correctly.
+	updatedVersion := coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, source2, template.ID)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, updatedVersion.ID)
+	coderdtest.UpdateActiveTemplateVersion(t, client, template.ID, updatedVersion.ID)
+
+	dir := t.TempDir()
+
+	expectedDest := filepath.Join(dir, "expected")
+	conflictDest := filepath.Join(dir, "conflict")
+
+	err = os.MkdirAll(conflictDest, 0o700)
+	require.NoError(t, err)
+
+	err = os.WriteFile(
+		filepath.Join(conflictDest, "conflict-file"),
+		[]byte("conflict"), 0o600,
+	)
+	require.NoError(t, err)
+
+	ctx := context.Background()
+
+	err = extract.Tar(ctx, bytes.NewReader(expected), expectedDest, nil)
+	require.NoError(t, err)
+
+	inv, root := clitest.New(t, "templates", "pull", template.Name, conflictDest)
+	clitest.SetupConfig(t, templateAdmin, root)
+
+	pty := ptytest.New(t).Attach(inv)
+
+	waiter := clitest.StartWithWaiter(t, inv)
+
+	pty.ExpectMatch("not empty")
+	pty.WriteLine("no")
+
+	waiter.RequireError()
+
+	ents, err := os.ReadDir(conflictDest)
+	require.NoError(t, err)
+
+	require.Len(t, ents, 1, "conflict folder should have single conflict file")
 }
 
 // genTemplateVersionSource returns a unique bundle that can be used to create
 // a template version source.
 func genTemplateVersionSource() *echo.Responses {
 	return &echo.Responses{
-		Parse: []*proto.Parse_Response{
+		Parse: []*proto.Response{
 			{
-				Type: &proto.Parse_Response_Log{
+				Type: &proto.Response_Log{
 					Log: &proto.Log{
 						Output: uuid.NewString(),
 					},
@@ -215,11 +410,11 @@ func genTemplateVersionSource() *echo.Responses {
 			},
 
 			{
-				Type: &proto.Parse_Response_Complete{
-					Complete: &proto.Parse_Complete{},
+				Type: &proto.Response_Parse{
+					Parse: &proto.ParseComplete{},
 				},
 			},
 		},
-		ProvisionApply: echo.ProvisionComplete,
+		ProvisionApply: echo.ApplyComplete,
 	}
 }
diff --git a/cli/templatepush.go b/cli/templatepush.go
index 52342874144b7..ad4403324dfc4 100644
--- a/cli/templatepush.go
+++ b/cli/templatepush.go
@@ -11,11 +11,12 @@ import (
 	"github.com/briandowns/spinner"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisionersdk"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisionersdk"
 )
 
 // templateUploadFlags is shared by `templates create` and `templates push`.
@@ -86,7 +87,7 @@ func (pf *templateUploadFlags) upload(inv *clibase.Invocation, client *codersdk.
 
 	spin := spinner.New(spinner.CharSets[5], 100*time.Millisecond)
 	spin.Writer = inv.Stdout
-	spin.Suffix = cliui.DefaultStyles.Keyword.Render(" Uploading directory...")
+	spin.Suffix = pretty.Sprint(cliui.DefaultStyles.Keyword, " Uploading directory...")
 	spin.Start()
 	defer spin.Stop()
 
@@ -111,7 +112,7 @@ func (pf *templateUploadFlags) checkForLockfile(inv *clibase.Invocation) error {
 	if !hasLockfile {
 		cliui.Warn(inv.Stdout, "No .terraform.lock.hcl file found",
 			"When provisioning, Coder will be unable to cache providers without a lockfile and must download them from the internet each time.",
-			"Create one by running "+cliui.DefaultStyles.Code.Render("terraform init")+" in your template directory.",
+			"Create one by running "+pretty.Sprint(cliui.DefaultStyles.Code, "terraform init")+" in your template directory.",
 		)
 	}
 	return nil
@@ -216,7 +217,7 @@ func (r *RootCmd) templatePush() *clibase.Cmd {
 				Message:         message,
 				Client:          client,
 				Organization:    organization,
-				Provisioner:     database.ProvisionerType(provisioner),
+				Provisioner:     codersdk.ProvisionerType(provisioner),
 				FileID:          resp.ID,
 				ProvisionerTags: tags,
 				VariablesFile:   variablesFile,
@@ -247,9 +248,10 @@ func (r *RootCmd) templatePush() *clibase.Cmd {
 					return err
 				}
 
-				_, _ = fmt.Fprintln(inv.Stdout, "\n"+cliui.DefaultStyles.Wrap.Render(
-					"The "+cliui.DefaultStyles.Keyword.Render(name)+" template has been created at "+cliui.DefaultStyles.DateTimeStamp.Render(time.Now().Format(time.Stamp))+"! "+
-						"Developers can provision a workspace with this template using:")+"\n")
+				_, _ = fmt.Fprintln(
+					inv.Stdout, "\n"+cliui.Wrap(
+						"The "+cliui.Keyword(name)+" template has been created at "+cliui.Timestamp(time.Now())+"! "+
+							"Developers can provision a workspace with this template using:")+"\n")
 			} else if activate {
 				err = client.UpdateActiveTemplateVersion(inv.Context(), template.ID, codersdk.UpdateActiveTemplateVersion{
 					ID: job.ID,
@@ -259,7 +261,7 @@ func (r *RootCmd) templatePush() *clibase.Cmd {
 				}
 			}
 
-			_, _ = fmt.Fprintf(inv.Stdout, "Updated version at %s!\n", cliui.DefaultStyles.DateTimeStamp.Render(time.Now().Format(time.Stamp)))
+			_, _ = fmt.Fprintf(inv.Stdout, "Updated version at %s!\n", pretty.Sprint(cliui.DefaultStyles.DateTimeStamp, time.Now().Format(time.Stamp)))
 			return nil
 		},
 	}
diff --git a/cli/templatepush_test.go b/cli/templatepush_test.go
index 88a1ce250543c..5736df8cc2edf 100644
--- a/cli/templatepush_test.go
+++ b/cli/templatepush_test.go
@@ -13,14 +13,15 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestTemplatePush(t *testing.T) {
@@ -29,19 +30,20 @@ func TestTemplatePush(t *testing.T) {
 	t.Run("OK", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		// Test the cli command.
 		source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 		inv, root := clitest.New(t, "templates", "push", template.Name, "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho), "--name", "example")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 		pty := ptytest.New(t).Attach(inv)
 
 		execDone := make(chan error)
@@ -75,20 +77,21 @@ func TestTemplatePush(t *testing.T) {
 	t.Run("Message less than or equal to 72 chars", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 		source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 
 		wantMessage := strings.Repeat("a", 72)
 
 		inv, root := clitest.New(t, "templates", "push", template.Name, "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho), "--name", "example", "--message", wantMessage, "--yes")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 		pty := ptytest.New(t).Attach(inv)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
@@ -114,14 +117,15 @@ func TestTemplatePush(t *testing.T) {
 	t.Run("Message too long, warn but continue", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 		source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -134,8 +138,13 @@ func TestTemplatePush(t *testing.T) {
 			{wantMessage: strings.Repeat("a", 73), wantMatch: "Template message is longer than 72 characters"},
 			{wantMessage: "This is my title\n\nAnd this is my body.", wantMatch: "Template message contains newlines"},
 		} {
-			inv, root := clitest.New(t, "templates", "push", template.Name, "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho), "--message", tt.wantMessage, "--yes")
-			clitest.SetupConfig(t, client, root)
+			inv, root := clitest.New(t, "templates", "push", template.Name,
+				"--directory", source,
+				"--test.provisioner", string(database.ProvisionerTypeEcho),
+				"--message", tt.wantMessage,
+				"--yes",
+			)
+			clitest.SetupConfig(t, templateAdmin, root)
 			pty := ptytest.New(t).Attach(inv)
 
 			inv = inv.WithContext(ctx)
@@ -159,21 +168,26 @@ func TestTemplatePush(t *testing.T) {
 	t.Run("NoLockfile", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		// Test the cli command.
 		source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 		require.NoError(t, os.Remove(filepath.Join(source, ".terraform.lock.hcl")))
 
-		inv, root := clitest.New(t, "templates", "push", template.Name, "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho), "--name", "example")
-		clitest.SetupConfig(t, client, root)
+		inv, root := clitest.New(t, "templates", "push", template.Name,
+			"--directory", source,
+			"--test.provisioner", string(database.ProvisionerTypeEcho),
+			"--name", "example",
+		)
+		clitest.SetupConfig(t, templateAdmin, root)
 		pty := ptytest.New(t).Attach(inv)
 
 		execDone := make(chan error)
@@ -202,21 +216,27 @@ func TestTemplatePush(t *testing.T) {
 	t.Run("NoLockfileIgnored", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		// Test the cli command.
 		source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 		require.NoError(t, os.Remove(filepath.Join(source, ".terraform.lock.hcl")))
 
-		inv, root := clitest.New(t, "templates", "push", template.Name, "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho), "--name", "example", "--ignore-lockfile")
-		clitest.SetupConfig(t, client, root)
+		inv, root := clitest.New(t, "templates", "push", template.Name,
+			"--directory", source,
+			"--test.provisioner", string(database.ProvisionerTypeEcho),
+			"--name", "example",
+			"--ignore-lockfile",
+		)
+		clitest.SetupConfig(t, templateAdmin, root)
 		pty := ptytest.New(t).Attach(inv)
 
 		execDone := make(chan error)
@@ -239,19 +259,25 @@ func TestTemplatePush(t *testing.T) {
 	t.Run("PushInactiveTemplateVersion", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		// Test the cli command.
 		source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
-		inv, root := clitest.New(t, "templates", "push", template.Name, "--activate=false", "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho), "--name", "example")
-		clitest.SetupConfig(t, client, root)
+		inv, root := clitest.New(t, "templates", "push", template.Name,
+			"--activate=false",
+			"--directory", source,
+			"--test.provisioner", string(database.ProvisionerTypeEcho),
+			"--name", "example",
+		)
+		clitest.SetupConfig(t, templateAdmin, root)
 		pty := ptytest.New(t).Attach(inv)
 		w := clitest.StartWithWaiter(t, inv)
 
@@ -286,25 +312,29 @@ func TestTemplatePush(t *testing.T) {
 		}
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		// Test the cli command.
 		source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID,
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID,
 			func(r *codersdk.CreateTemplateRequest) {
 				r.Name = filepath.Base(source)
 			})
 
 		// Don't pass the name of the template, it should use the
 		// directory of the source.
-		inv, root := clitest.New(t, "templates", "push", "--test.provisioner", string(database.ProvisionerTypeEcho), "--test.workdir", source)
-		clitest.SetupConfig(t, client, root)
+		inv, root := clitest.New(t, "templates", "push",
+			"--test.provisioner", string(database.ProvisionerTypeEcho),
+			"--test.workdir", source,
+		)
+		clitest.SetupConfig(t, templateAdmin, root)
 		pty := ptytest.New(t).Attach(inv)
 
 		waiter := clitest.StartWithWaiter(t, inv)
@@ -334,24 +364,25 @@ func TestTemplatePush(t *testing.T) {
 	t.Run("Stdin", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		source, err := echo.Tar(&echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 		require.NoError(t, err)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		inv, root := clitest.New(
 			t, "templates", "push", "--directory", "-",
 			"--test.provisioner", string(database.ProvisionerTypeEcho),
 			template.Name,
 		)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, templateAdmin, root)
 		pty := ptytest.New(t)
 		inv.Stdin = bytes.NewReader(source)
 		inv.Stdout = pty.Output()
@@ -389,11 +420,12 @@ func TestTemplatePush(t *testing.T) {
 		t.Run("VariableIsRequired", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
-			templateVersion := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, createEchoResponsesWithTemplateVariables(initialTemplateVariables))
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, templateVersion.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, templateVersion.ID)
+			templateVersion := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, createEchoResponsesWithTemplateVariables(initialTemplateVariables))
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateVersion.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, templateVersion.ID)
 
 			// Test the cli command.
 			modifiedTemplateVariables := append(initialTemplateVariables,
@@ -409,8 +441,13 @@ func TestTemplatePush(t *testing.T) {
 			removeTmpDirUntilSuccessAfterTest(t, tempDir)
 			variablesFile, _ := os.CreateTemp(tempDir, "variables*.yaml")
 			_, _ = variablesFile.WriteString(`second_variable: foobar`)
-			inv, root := clitest.New(t, "templates", "push", template.Name, "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho), "--name", "example", "--variables-file", variablesFile.Name())
-			clitest.SetupConfig(t, client, root)
+			inv, root := clitest.New(t, "templates", "push", template.Name,
+				"--directory", source,
+				"--test.provisioner", string(database.ProvisionerTypeEcho),
+				"--name", "example",
+				"--variables-file", variablesFile.Name(),
+			)
+			clitest.SetupConfig(t, templateAdmin, root)
 			pty := ptytest.New(t)
 			inv.Stdin = pty.Input()
 			inv.Stdout = pty.Output()
@@ -452,11 +489,12 @@ func TestTemplatePush(t *testing.T) {
 		t.Run("VariableIsRequiredButNotProvided", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
-			templateVersion := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, createEchoResponsesWithTemplateVariables(initialTemplateVariables))
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, templateVersion.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, templateVersion.ID)
+			templateVersion := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, createEchoResponsesWithTemplateVariables(initialTemplateVariables))
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateVersion.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, templateVersion.ID)
 
 			// Test the cli command.
 			modifiedTemplateVariables := append(initialTemplateVariables,
@@ -469,7 +507,7 @@ func TestTemplatePush(t *testing.T) {
 			)
 			source := clitest.CreateTemplateVersionSource(t, createEchoResponsesWithTemplateVariables(modifiedTemplateVariables))
 			inv, root := clitest.New(t, "templates", "push", template.Name, "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho), "--name", "example")
-			clitest.SetupConfig(t, client, root)
+			clitest.SetupConfig(t, templateAdmin, root)
 			pty := ptytest.New(t)
 			inv.Stdin = pty.Input()
 			inv.Stdout = pty.Output()
@@ -498,11 +536,12 @@ func TestTemplatePush(t *testing.T) {
 		t.Run("VariableIsOptionalButNotProvided", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
-			templateVersion := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, createEchoResponsesWithTemplateVariables(initialTemplateVariables))
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, templateVersion.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, templateVersion.ID)
+			templateVersion := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, createEchoResponsesWithTemplateVariables(initialTemplateVariables))
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateVersion.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, templateVersion.ID)
 
 			// Test the cli command.
 			modifiedTemplateVariables := append(initialTemplateVariables,
@@ -515,8 +554,12 @@ func TestTemplatePush(t *testing.T) {
 				},
 			)
 			source := clitest.CreateTemplateVersionSource(t, createEchoResponsesWithTemplateVariables(modifiedTemplateVariables))
-			inv, root := clitest.New(t, "templates", "push", template.Name, "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho), "--name", "example")
-			clitest.SetupConfig(t, client, root)
+			inv, root := clitest.New(t, "templates", "push", template.Name,
+				"--directory", source,
+				"--test.provisioner", string(database.ProvisionerTypeEcho),
+				"--name", "example",
+			)
+			clitest.SetupConfig(t, templateAdmin, root)
 			pty := ptytest.New(t)
 			inv.Stdin = pty.Input()
 			inv.Stdout = pty.Output()
@@ -559,11 +602,12 @@ func TestTemplatePush(t *testing.T) {
 		t.Run("WithVariableOption", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
-			templateVersion := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, createEchoResponsesWithTemplateVariables(initialTemplateVariables))
-			_ = coderdtest.AwaitTemplateVersionJob(t, client, templateVersion.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, templateVersion.ID)
+			templateVersion := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, createEchoResponsesWithTemplateVariables(initialTemplateVariables))
+			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateVersion.ID)
+			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, templateVersion.ID)
 
 			// Test the cli command.
 			modifiedTemplateVariables := append(initialTemplateVariables,
@@ -575,8 +619,14 @@ func TestTemplatePush(t *testing.T) {
 				},
 			)
 			source := clitest.CreateTemplateVersionSource(t, createEchoResponsesWithTemplateVariables(modifiedTemplateVariables))
-			inv, root := clitest.New(t, "templates", "push", template.Name, "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho), "--name", "example", "--variable", "second_variable=foobar")
-			clitest.SetupConfig(t, client, root)
+			inv, root := clitest.New(t,
+				"templates", "push", template.Name,
+				"--directory", source,
+				"--test.provisioner", string(database.ProvisionerTypeEcho),
+				"--name", "example",
+				"--variable", "second_variable=foobar",
+			)
+			clitest.SetupConfig(t, templateAdmin, root)
 			pty := ptytest.New(t)
 			inv.Stdin = pty.Input()
 			inv.Stdout = pty.Output()
@@ -618,11 +668,9 @@ func TestTemplatePush(t *testing.T) {
 		t.Run("CreateTemplate", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
-			source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
-				Parse:          echo.ParseComplete,
-				ProvisionApply: provisionCompleteWithAgent,
-			})
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+			source := clitest.CreateTemplateVersionSource(t, completeWithAgent())
 
 			const templateName = "my-template"
 			args := []string{
@@ -634,7 +682,7 @@ func TestTemplatePush(t *testing.T) {
 				"--create",
 			}
 			inv, root := clitest.New(t, args...)
-			clitest.SetupConfig(t, client, root)
+			clitest.SetupConfig(t, templateAdmin, root)
 			pty := ptytest.New(t).Attach(inv)
 
 			waiter := clitest.StartWithWaiter(t, inv)
@@ -655,7 +703,7 @@ func TestTemplatePush(t *testing.T) {
 
 			waiter.RequireSuccess()
 
-			template, err := client.TemplateByName(context.Background(), user.OrganizationID, templateName)
+			template, err := client.TemplateByName(context.Background(), owner.OrganizationID, templateName)
 			require.NoError(t, err)
 			require.Equal(t, templateName, template.Name)
 			require.NotEqual(t, uuid.Nil, template.ActiveVersionID)
@@ -665,16 +713,16 @@ func TestTemplatePush(t *testing.T) {
 
 func createEchoResponsesWithTemplateVariables(templateVariables []*proto.TemplateVariable) *echo.Responses {
 	return &echo.Responses{
-		Parse: []*proto.Parse_Response{
+		Parse: []*proto.Response{
 			{
-				Type: &proto.Parse_Response_Complete{
-					Complete: &proto.Parse_Complete{
+				Type: &proto.Response_Parse{
+					Parse: &proto.ParseComplete{
 						TemplateVariables: templateVariables,
 					},
 				},
 			},
 		},
-		ProvisionPlan:  echo.ProvisionComplete,
-		ProvisionApply: echo.ProvisionComplete,
+		ProvisionPlan:  echo.PlanComplete,
+		ProvisionApply: echo.ApplyComplete,
 	}
 }
diff --git a/cli/templates.go b/cli/templates.go
index ad347a138ba91..4f5b4f8f36d0b 100644
--- a/cli/templates.go
+++ b/cli/templates.go
@@ -4,10 +4,12 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/pretty"
 )
 
 func (r *RootCmd) templates() *clibase.Cmd {
@@ -37,17 +39,49 @@ func (r *RootCmd) templates() *clibase.Cmd {
 			r.templateEdit(),
 			r.templateInit(),
 			r.templateList(),
-			r.templatePlan(),
 			r.templatePush(),
 			r.templateVersions(),
 			r.templateDelete(),
 			r.templatePull(),
+			r.archiveTemplateVersions(),
 		},
 	}
 
 	return cmd
 }
 
+func selectTemplate(inv *clibase.Invocation, client *codersdk.Client, organization codersdk.Organization) (codersdk.Template, error) {
+	var empty codersdk.Template
+	ctx := inv.Context()
+	allTemplates, err := client.TemplatesByOrganization(ctx, organization.ID)
+	if err != nil {
+		return empty, xerrors.Errorf("get templates by organization: %w", err)
+	}
+
+	if len(allTemplates) == 0 {
+		return empty, xerrors.Errorf("no templates exist in the current organization %q", organization.Name)
+	}
+
+	opts := make([]string, 0, len(allTemplates))
+	for _, template := range allTemplates {
+		opts = append(opts, template.Name)
+	}
+
+	selection, err := cliui.Select(inv, cliui.SelectOptions{
+		Options: opts,
+	})
+	if err != nil {
+		return empty, xerrors.Errorf("select template: %w", err)
+	}
+
+	for _, template := range allTemplates {
+		if template.Name == selection {
+			return template, nil
+		}
+	}
+	return empty, xerrors.Errorf("no template selected")
+}
+
 type templateTableRow struct {
 	// Used by json format:
 	Template codersdk.Template
@@ -76,7 +110,7 @@ func templatesToRows(templates ...codersdk.Template) []templateTableRow {
 			OrganizationID:  template.OrganizationID,
 			Provisioner:     template.Provisioner,
 			ActiveVersionID: template.ActiveVersionID,
-			UsedBy:          cliui.DefaultStyles.Fuchsia.Render(formatActiveDevelopers(template.ActiveUserCount)),
+			UsedBy:          pretty.Sprint(cliui.DefaultStyles.Fuchsia, formatActiveDevelopers(template.ActiveUserCount)),
 			DefaultTTL:      (time.Duration(template.DefaultTTLMillis) * time.Millisecond),
 		}
 	}
diff --git a/cli/templatevariables.go b/cli/templatevariables.go
index 888b8a04e30f5..801e65cb8d82f 100644
--- a/cli/templatevariables.go
+++ b/cli/templatevariables.go
@@ -7,7 +7,7 @@ import (
 	"golang.org/x/xerrors"
 	"gopkg.in/yaml.v3"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func loadVariableValuesFromFile(variablesFile string) ([]codersdk.VariableValue, error) {
diff --git a/cli/templateversionarchive.go b/cli/templateversionarchive.go
new file mode 100644
index 0000000000000..63c9d8a3de212
--- /dev/null
+++ b/cli/templateversionarchive.go
@@ -0,0 +1,184 @@
+package cli
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/pretty"
+)
+
+func (r *RootCmd) unarchiveTemplateVersion() *clibase.Cmd {
+	return r.setArchiveTemplateVersion(false)
+}
+
+func (r *RootCmd) archiveTemplateVersion() *clibase.Cmd {
+	return r.setArchiveTemplateVersion(true)
+}
+
+//nolint:revive
+func (r *RootCmd) setArchiveTemplateVersion(archive bool) *clibase.Cmd {
+	presentVerb := "archive"
+	pastVerb := "archived"
+	if !archive {
+		presentVerb = "unarchive"
+		pastVerb = "unarchived"
+	}
+
+	client := new(codersdk.Client)
+	cmd := &clibase.Cmd{
+		Use:   presentVerb + " <template-name> [template-version-names...] ",
+		Short: strings.ToUpper(string(presentVerb[0])) + presentVerb[1:] + " a template version(s).",
+		Middleware: clibase.Chain(
+			r.InitClient(client),
+		),
+		Options: clibase.OptionSet{
+			cliui.SkipPromptOption(),
+		},
+		Handler: func(inv *clibase.Invocation) error {
+			var (
+				ctx      = inv.Context()
+				versions []codersdk.TemplateVersion
+			)
+
+			organization, err := CurrentOrganization(inv, client)
+			if err != nil {
+				return err
+			}
+
+			if len(inv.Args) == 0 {
+				return xerrors.Errorf("missing template name")
+			}
+			if len(inv.Args) < 2 {
+				return xerrors.Errorf("missing template version name(s)")
+			}
+
+			templateName := inv.Args[0]
+			template, err := client.TemplateByName(ctx, organization.ID, templateName)
+			if err != nil {
+				return xerrors.Errorf("get template by name: %w", err)
+			}
+			for _, versionName := range inv.Args[1:] {
+				version, err := client.TemplateVersionByOrganizationAndName(ctx, organization.ID, template.Name, versionName)
+				if err != nil {
+					return xerrors.Errorf("get template version by name %q: %w", versionName, err)
+				}
+				versions = append(versions, version)
+			}
+
+			for _, version := range versions {
+				if version.Archived == archive {
+					_, _ = fmt.Fprintln(
+						inv.Stdout, fmt.Sprintf("Version "+pretty.Sprint(cliui.DefaultStyles.Keyword, version.Name)+" already "+pastVerb),
+					)
+					continue
+				}
+
+				err := client.SetArchiveTemplateVersion(ctx, version.ID, archive)
+				if err != nil {
+					return xerrors.Errorf("%s template version %q: %w", presentVerb, version.Name, err)
+				}
+
+				_, _ = fmt.Fprintln(
+					inv.Stdout, fmt.Sprintf("Version "+pretty.Sprint(cliui.DefaultStyles.Keyword, version.Name)+" "+pastVerb+" at "+cliui.Timestamp(time.Now())),
+				)
+			}
+			return nil
+		},
+	}
+
+	return cmd
+}
+
+func (r *RootCmd) archiveTemplateVersions() *clibase.Cmd {
+	var all clibase.Bool
+	client := new(codersdk.Client)
+	cmd := &clibase.Cmd{
+		Use:   "archive [template-name...] ",
+		Short: "Archive unused or failed template versions from a given template(s)",
+		Middleware: clibase.Chain(
+			r.InitClient(client),
+		),
+		Options: clibase.OptionSet{
+			cliui.SkipPromptOption(),
+			clibase.Option{
+				Name:        "all",
+				Description: "Include all unused template versions. By default, only failed template versions are archived.",
+				Flag:        "all",
+				Value:       &all,
+			},
+		},
+		Handler: func(inv *clibase.Invocation) error {
+			var (
+				ctx           = inv.Context()
+				templateNames = []string{}
+				templates     = []codersdk.Template{}
+			)
+
+			organization, err := CurrentOrganization(inv, client)
+			if err != nil {
+				return err
+			}
+
+			if len(inv.Args) > 0 {
+				templateNames = inv.Args
+
+				for _, templateName := range templateNames {
+					template, err := client.TemplateByName(ctx, organization.ID, templateName)
+					if err != nil {
+						return xerrors.Errorf("get template by name: %w", err)
+					}
+					templates = append(templates, template)
+				}
+			} else {
+				template, err := selectTemplate(inv, client, organization)
+				if err != nil {
+					return err
+				}
+
+				templates = append(templates, template)
+				templateNames = append(templateNames, template.Name)
+			}
+
+			// Confirm archive of the template.
+			_, err = cliui.Prompt(inv, cliui.PromptOptions{
+				Text:      fmt.Sprintf("Archive template versions of these templates: %s?", pretty.Sprint(cliui.DefaultStyles.Code, strings.Join(templateNames, ", "))),
+				IsConfirm: true,
+				Default:   cliui.ConfirmNo,
+			})
+			if err != nil {
+				return err
+			}
+
+			for _, template := range templates {
+				resp, err := client.ArchiveTemplateVersions(ctx, template.ID, all.Value())
+				if err != nil {
+					return xerrors.Errorf("archive template %q: %w", template.Name, err)
+				}
+
+				_, _ = fmt.Fprintln(
+					inv.Stdout, fmt.Sprintf("Archived %d versions from "+pretty.Sprint(cliui.DefaultStyles.Keyword, template.Name)+" at "+cliui.Timestamp(time.Now()), len(resp.ArchivedIDs)),
+				)
+
+				if ok, _ := inv.ParsedFlags().GetBool("verbose"); err == nil && ok {
+					data, err := json.Marshal(resp)
+					if err != nil {
+						return xerrors.Errorf("marshal verbose response: %w", err)
+					}
+					_, _ = fmt.Fprintln(
+						inv.Stdout, string(data),
+					)
+				}
+			}
+			return nil
+		},
+	}
+
+	return cmd
+}
diff --git a/cli/templateversionarchive_test.go b/cli/templateversionarchive_test.go
new file mode 100644
index 0000000000000..02fb72a6b7b74
--- /dev/null
+++ b/cli/templateversionarchive_test.go
@@ -0,0 +1,108 @@
+package cli_test
+
+import (
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestTemplateVersionsArchive(t *testing.T) {
+	t.Parallel()
+	t.Run("Archive-Unarchive", func(t *testing.T) {
+		t.Parallel()
+		ownerClient := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, ownerClient)
+
+		client, _ := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		other := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil, func(request *codersdk.CreateTemplateVersionRequest) {
+			request.TemplateID = template.ID
+		})
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, other.ID)
+
+		// Archive
+		inv, root := clitest.New(t, "templates", "versions", "archive", template.Name, other.Name, "-y")
+		clitest.SetupConfig(t, client, root)
+		w := clitest.StartWithWaiter(t, inv)
+		w.RequireSuccess()
+
+		// Verify archived
+		ctx := testutil.Context(t, testutil.WaitMedium)
+		found, err := client.TemplateVersion(ctx, other.ID)
+		require.NoError(t, err)
+		require.True(t, found.Archived, "expect archived")
+
+		// Unarchive
+		inv, root = clitest.New(t, "templates", "versions", "unarchive", template.Name, other.Name, "-y")
+		clitest.SetupConfig(t, client, root)
+		w = clitest.StartWithWaiter(t, inv)
+		w.RequireSuccess()
+
+		// Verify unarchived
+		ctx = testutil.Context(t, testutil.WaitMedium)
+		found, err = client.TemplateVersion(ctx, other.ID)
+		require.NoError(t, err)
+		require.False(t, found.Archived, "expect unarchived")
+	})
+
+	t.Run("ArchiveMany", func(t *testing.T) {
+		t.Parallel()
+		ownerClient := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, ownerClient)
+
+		client, _ := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+
+		// Add a failed
+		expArchived := map[uuid.UUID]bool{}
+		failed := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionApply: echo.ApplyFailed,
+			ProvisionPlan:  echo.PlanFailed,
+		}, func(request *codersdk.CreateTemplateVersionRequest) {
+			request.TemplateID = template.ID
+		})
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, failed.ID)
+		expArchived[failed.ID] = true
+		// Add unused
+		unused := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil, func(request *codersdk.CreateTemplateVersionRequest) {
+			request.TemplateID = template.ID
+		})
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, unused.ID)
+		expArchived[unused.ID] = true
+
+		// Archive all unused versions
+		inv, root := clitest.New(t, "templates", "archive", template.Name, "-y", "--all")
+		clitest.SetupConfig(t, client, root)
+		w := clitest.StartWithWaiter(t, inv)
+		w.RequireSuccess()
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+		all, err := client.TemplateVersionsByTemplate(ctx, codersdk.TemplateVersionsByTemplateRequest{
+			TemplateID:      template.ID,
+			IncludeArchived: true,
+		})
+		require.NoError(t, err, "query all versions")
+		for _, v := range all {
+			if _, ok := expArchived[v.ID]; ok {
+				require.True(t, v.Archived, "expect archived")
+				delete(expArchived, v.ID)
+			} else {
+				require.False(t, v.Archived, "expect unarchived")
+			}
+		}
+		require.Len(t, expArchived, 0, "expect all archived")
+	})
+}
diff --git a/cli/templateversions.go b/cli/templateversions.go
index ed7688d3f3108..a27d6a6d65af3 100644
--- a/cli/templateversions.go
+++ b/cli/templateversions.go
@@ -8,9 +8,10 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/pretty"
 )
 
 func (r *RootCmd) templateVersions() *clibase.Cmd {
@@ -29,6 +30,8 @@ func (r *RootCmd) templateVersions() *clibase.Cmd {
 		},
 		Children: []*clibase.Cmd{
 			r.templateVersionsList(),
+			r.archiveTemplateVersion(),
+			r.unarchiveTemplateVersion(),
 		},
 	}
 
@@ -36,19 +39,59 @@ func (r *RootCmd) templateVersions() *clibase.Cmd {
 }
 
 func (r *RootCmd) templateVersionsList() *clibase.Cmd {
+	defaultColumns := []string{
+		"Name",
+		"Created At",
+		"Created By",
+		"Status",
+		"Active",
+	}
 	formatter := cliui.NewOutputFormatter(
-		cliui.TableFormat([]templateVersionRow{}, nil),
+		cliui.TableFormat([]templateVersionRow{}, defaultColumns),
 		cliui.JSONFormat(),
 	)
 	client := new(codersdk.Client)
 
+	var includeArchived clibase.Bool
+
 	cmd := &clibase.Cmd{
 		Use: "list <template>",
 		Middleware: clibase.Chain(
 			clibase.RequireNArgs(1),
 			r.InitClient(client),
+			func(next clibase.HandlerFunc) clibase.HandlerFunc {
+				return func(i *clibase.Invocation) error {
+					// This is the only way to dynamically add the "archived"
+					// column if '--include-archived' is true.
+					// It does not make sense to show this column if the
+					// flag is false.
+					if includeArchived {
+						for _, opt := range i.Command.Options {
+							if opt.Flag == "column" {
+								if opt.ValueSource == clibase.ValueSourceDefault {
+									v, ok := opt.Value.(*clibase.StringArray)
+									if ok {
+										// Add the extra new default column.
+										*v = append(*v, "Archived")
+									}
+								}
+								break
+							}
+						}
+					}
+					return next(i)
+				}
+			},
 		),
 		Short: "List all the versions of the specified template",
+		Options: clibase.OptionSet{
+			{
+				Name:        "include-archived",
+				Description: "Include archived versions in the result list.",
+				Flag:        "include-archived",
+				Value:       &includeArchived,
+			},
+		},
 		Handler: func(inv *clibase.Invocation) error {
 			organization, err := CurrentOrganization(inv, client)
 			if err != nil {
@@ -59,7 +102,8 @@ func (r *RootCmd) templateVersionsList() *clibase.Cmd {
 				return xerrors.Errorf("get template by name: %w", err)
 			}
 			req := codersdk.TemplateVersionsByTemplateRequest{
-				TemplateID: template.ID,
+				TemplateID:      template.ID,
+				IncludeArchived: includeArchived.Value(),
 			}
 
 			versions, err := client.TemplateVersionsByTemplate(inv.Context(), req)
@@ -92,6 +136,7 @@ type templateVersionRow struct {
 	CreatedBy string    `json:"-" table:"created by"`
 	Status    string    `json:"-" table:"status"`
 	Active    string    `json:"-" table:"active"`
+	Archived  string    `json:"-" table:"archived"`
 }
 
 // templateVersionsToRows converts a list of template versions to a list of rows
@@ -101,7 +146,12 @@ func templateVersionsToRows(activeVersionID uuid.UUID, templateVersions ...coder
 	for i, templateVersion := range templateVersions {
 		activeStatus := ""
 		if templateVersion.ID == activeVersionID {
-			activeStatus = cliui.DefaultStyles.Code.Render(cliui.DefaultStyles.Keyword.Render("Active"))
+			activeStatus = cliui.Keyword("Active")
+		}
+
+		archivedStatus := ""
+		if templateVersion.Archived {
+			archivedStatus = pretty.Sprint(cliui.DefaultStyles.Warn, "Archived")
 		}
 
 		rows[i] = templateVersionRow{
@@ -111,6 +161,7 @@ func templateVersionsToRows(activeVersionID uuid.UUID, templateVersions ...coder
 			CreatedBy:       templateVersion.CreatedBy.Username,
 			Status:          strings.Title(string(templateVersion.Job.Status)),
 			Active:          activeStatus,
+			Archived:        archivedStatus,
 		}
 	}
 
diff --git a/cli/templateversions_test.go b/cli/templateversions_test.go
index f3be61322c29a..8a017fb15da62 100644
--- a/cli/templateversions_test.go
+++ b/cli/templateversions_test.go
@@ -5,9 +5,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestTemplateVersions(t *testing.T) {
@@ -15,13 +15,14 @@ func TestTemplateVersions(t *testing.T) {
 	t.Run("ListVersions", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		inv, root := clitest.New(t, "templates", "versions", "list", template.Name)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 
 		pty := ptytest.New(t).Attach(inv)
 
diff --git a/cli/testdata/coder_--help.golden b/cli/testdata/coder_--help.golden
index e074756680e84..d04546ce01959 100644
--- a/cli/testdata/coder_--help.golden
+++ b/cli/testdata/coder_--help.golden
@@ -1,21 +1,26 @@
-Usage: coder [global-flags] <subcommand>
-
-Coder v0.0.0-devel — A tool for provisioning self-hosted development environments with Terraform.
-  - Start a Coder server:                                                       
-
-      $ coder server 
-
-  - Get started by creating a template from an example:                         
-
-      $ coder templates init 
-
-Subcommands
+coder v0.0.0-devel
+
+USAGE:
+  coder [global-flags] <subcommand>
+
+  Coder v0.0.0-devel — A tool for provisioning self-hosted development
+  environments with Terraform.
+    - Start a Coder server:
+  
+       $ coder server
+  
+    - Get started by creating a template from an example:
+  
+       $ coder templates init
+
+SUBCOMMANDS:
     config-ssh        Add an SSH Host entry for your workspaces "ssh
                       coder.workspace"
     create            Create a workspace
     delete            Delete a workspace
     dotfiles          Personalize your workspace by applying a canonical
                       dotfiles repository
+    external-auth     Manage external authentication
     list              List workspaces
     login             Authenticate with Coder deployment
     logout            Unauthenticate your local session
@@ -45,7 +50,7 @@ Coder v0.0.0-devel — A tool for provisioning self-hosted development environme
     users             Manage users
     version           Show coder version
 
-Global Options 
+GLOBAL OPTIONS: 
 Global options are applied to all commands. They can be set using environment
 variables or flags.
 
@@ -62,6 +67,11 @@ variables or flags.
           Additional HTTP headers added to all requests. Provide as key=value.
           Can be specified multiple times.
 
+      --header-command string, $CODER_HEADER_COMMAND
+          An external command that outputs additional HTTP headers added to all
+          requests. The command must output each header as `key=value` on its
+          own line.
+
       --no-feature-warning bool, $CODER_NO_FEATURE_WARNING
           Suppress warnings about unlicensed features.
 
@@ -78,5 +88,5 @@ variables or flags.
   -v, --verbose bool, $CODER_VERBOSE
           Enable verbose output.
 
----
+———
 Report bugs and request features at https://github.com/coder/coder/issues/new
diff --git a/cli/testdata/coder_agent_--help.golden b/cli/testdata/coder_agent_--help.golden
index 723afce139810..08dab47a21e14 100644
--- a/cli/testdata/coder_agent_--help.golden
+++ b/cli/testdata/coder_agent_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder agent [flags]
+coder v0.0.0-devel
 
-Starts the Coder workspace agent.
+USAGE:
+  coder agent [flags]
 
-Options
+  Starts the Coder workspace agent.
+
+OPTIONS:
       --log-human string, $CODER_AGENT_LOGGING_HUMAN (default: /dev/stderr)
           Output human-readable logs to a given file.
 
@@ -37,5 +40,5 @@ Starts the Coder workspace agent.
       --tailnet-listen-port int, $CODER_AGENT_TAILNET_LISTEN_PORT (default: 0)
           Specify a static port for Tailscale to use for listening.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_config-ssh_--help.golden b/cli/testdata/coder_config-ssh_--help.golden
index 8aa547ccb467f..66ecba4d354e0 100644
--- a/cli/testdata/coder_config-ssh_--help.golden
+++ b/cli/testdata/coder_config-ssh_--help.golden
@@ -1,17 +1,21 @@
-Usage: coder config-ssh [flags]
+coder v0.0.0-devel
 
-Add an SSH Host entry for your workspaces "ssh coder.workspace"
+USAGE:
+  coder config-ssh [flags]
 
-- You can use -o (or --ssh-option) so set SSH options to be used for all your 
-    workspaces:                                                                 
+  Add an SSH Host entry for your workspaces "ssh coder.workspace"
 
-      $ coder config-ssh -o ForwardAgent=yes 
+    - You can use -o (or --ssh-option) so set SSH options to be used for all
+  your
+  workspaces:
+  
+       $ coder config-ssh -o ForwardAgent=yes
+  
+    - You can use --dry-run (or -n) to see the changes that would be made:
+  
+       $ coder config-ssh --dry-run
 
-  - You can use --dry-run (or -n) to see the changes that would be made:        
-
-      $ coder config-ssh --dry-run 
-
-Options
+OPTIONS:
       --coder-binary-path string, $CODER_SSH_CONFIG_BINARY_PATH
           Optionally specify the absolute path to the coder binary used in
           ProxyCommand. By default, the binary invoking this command ('config
@@ -47,5 +51,5 @@ Add an SSH Host entry for your workspaces "ssh coder.workspace"
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_create_--help.golden b/cli/testdata/coder_create_--help.golden
index 6c8bcc46908c9..2d4031999c3d6 100644
--- a/cli/testdata/coder_create_--help.golden
+++ b/cli/testdata/coder_create_--help.golden
@@ -1,12 +1,22 @@
-Usage: coder create [flags] [name]
+coder v0.0.0-devel
 
-Create a workspace
+USAGE:
+  coder create [flags] [name]
 
-- Create a workspace for another user (if you have permission):               
+  Create a workspace
 
-      $ coder create <username>/<workspace_name> 
+    - Create a workspace for another user (if you have permission):
+  
+       $ coder create <username>/<workspace_name>
+
+OPTIONS:
+      --automatic-updates string, $CODER_WORKSPACE_AUTOMATIC_UPDATES (default: never)
+          Specify automatic updates setting for the workspace (accepts 'always'
+          or 'never').
+
+      --parameter string-array, $CODER_RICH_PARAMETER
+          Rich parameter value in the format "name=value".
 
-Options
       --rich-parameter-file string, $CODER_RICH_PARAMETER_FILE
           Specify a file path with values for rich parameters defined in the
           template.
@@ -25,5 +35,5 @@ Create a workspace
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_delete_--help.golden b/cli/testdata/coder_delete_--help.golden
index ff9fee6b77e7e..3f9800f135840 100644
--- a/cli/testdata/coder_delete_--help.golden
+++ b/cli/testdata/coder_delete_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder delete [flags] <workspace>
+coder v0.0.0-devel
 
-Delete a workspace
+USAGE:
+  coder delete [flags] <workspace>
 
-Aliases: rm
+  Delete a workspace
 
-Options
+  Aliases: rm
+
+OPTIONS:
       --orphan bool
           Delete a workspace without deleting its resources. This can delete a
           workspace in a broken state, but may also lead to unaccounted cloud
@@ -13,5 +16,5 @@ Aliases: rm
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_dotfiles_--help.golden b/cli/testdata/coder_dotfiles_--help.golden
index 0ff91b7dd1870..14991512127da 100644
--- a/cli/testdata/coder_dotfiles_--help.golden
+++ b/cli/testdata/coder_dotfiles_--help.golden
@@ -1,17 +1,24 @@
-Usage: coder dotfiles [flags] <git_repo_url>
+coder v0.0.0-devel
 
-Personalize your workspace by applying a canonical dotfiles repository
+USAGE:
+  coder dotfiles [flags] <git_repo_url>
 
-- Check out and install a dotfiles repository without prompts:                
+  Personalize your workspace by applying a canonical dotfiles repository
 
-      $ coder dotfiles --yes git@github.com:example/dotfiles.git 
+    - Check out and install a dotfiles repository without prompts:
+  
+       $ coder dotfiles --yes git@github.com:example/dotfiles.git
 
-Options
+OPTIONS:
   -b, --branch string
           Specifies which branch to clone. If empty, will default to cloning the
           default branch or using the existing branch in the cloned repo on
           disk.
 
+      --repo-dir string, $CODER_DOTFILES_REPO_DIR (default: dotfiles)
+          Specifies the directory for the dotfiles repository, relative to
+          global config directory.
+
       --symlink-dir string, $CODER_SYMLINK_DIR
           Specifies the directory for the dotfiles symlink destinations. If
           empty, will use $HOME.
@@ -19,5 +26,5 @@ Personalize your workspace by applying a canonical dotfiles repository
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_external-auth_--help.golden b/cli/testdata/coder_external-auth_--help.golden
new file mode 100644
index 0000000000000..42b465068d9c8
--- /dev/null
+++ b/cli/testdata/coder_external-auth_--help.golden
@@ -0,0 +1,14 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder external-auth
+
+  Manage external authentication
+
+  Authenticate with external services inside of a workspace.
+
+SUBCOMMANDS:
+    access-token    Print auth for an external provider
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_external-auth_access-token_--help.golden b/cli/testdata/coder_external-auth_access-token_--help.golden
new file mode 100644
index 0000000000000..e4693a6fb9a6d
--- /dev/null
+++ b/cli/testdata/coder_external-auth_access-token_--help.golden
@@ -0,0 +1,32 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder external-auth access-token [flags] <provider>
+
+  Print auth for an external provider
+
+  Print an access-token for an external auth provider. The access-token will be
+  validated and sent to stdout with exit code 0. If a valid access-token cannot
+  be obtained, the URL to authenticate will be sent to stdout with exit code 1
+    - Ensure that the user is authenticated with GitHub before cloning.:
+  
+       $ #!/usr/bin/env sh
+  
+  OUTPUT=$(coder external-auth access-token github)
+  if [ $? -eq 0 ]; then
+    echo "Authenticated with GitHub"
+  else
+    echo "Please authenticate with GitHub:"
+    echo $OUTPUT
+  fi
+  
+      - Obtain an extra property of an access token for additional metadata.:
+  
+       $ coder external-auth access-token slack --extra "authed_user.id"
+
+OPTIONS:
+      --extra string
+          Extract a field from the "extra" properties of the OAuth token.
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_list_--help.golden b/cli/testdata/coder_list_--help.golden
index a9bb8218ba1c0..15ff7a5878d51 100644
--- a/cli/testdata/coder_list_--help.golden
+++ b/cli/testdata/coder_list_--help.golden
@@ -1,17 +1,20 @@
-Usage: coder list [flags]
+coder v0.0.0-devel
 
-List workspaces
+USAGE:
+  coder list [flags]
 
-Aliases: ls
+  List workspaces
 
-Options
+  Aliases: ls
+
+OPTIONS:
   -a, --all bool
           Specifies whether all workspaces will be listed or not.
 
   -c, --column string-array (default: workspace,template,status,healthy,last built,outdated,starts at,stops after)
           Columns to display in table output. Available columns: workspace,
           template, status, healthy, last built, outdated, starts at, stops
-          after.
+          after, daily cost.
 
   -o, --output string (default: table)
           Output format. Available formats: table, json.
@@ -19,5 +22,5 @@ Aliases: ls
       --search string (default: owner:me)
           Search for a workspace with a query.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_list_--output_json.golden b/cli/testdata/coder_list_--output_json.golden
index 49e51d408285c..fb6bea96e82ba 100644
--- a/cli/testdata/coder_list_--output_json.golden
+++ b/cli/testdata/coder_list_--output_json.golden
@@ -11,6 +11,8 @@
     "template_display_name": "",
     "template_icon": "",
     "template_allow_user_cancel_workspace_jobs": false,
+    "template_active_version_id": "[version ID]",
+    "template_require_active_version": false,
     "latest_build": {
       "id": "[workspace build ID]",
       "created_at": "[timestamp]",
@@ -52,10 +54,11 @@
     "ttl_ms": 28800000,
     "last_used_at": "[timestamp]",
     "deleting_at": null,
-    "locked_at": null,
+    "dormant_at": null,
     "health": {
       "healthy": true,
       "failing_agents": []
-    }
+    },
+    "automatic_updates": "never"
   }
 ]
diff --git a/cli/testdata/coder_login_--help.golden b/cli/testdata/coder_login_--help.golden
index bb458ca999854..7e0b8ce3248dd 100644
--- a/cli/testdata/coder_login_--help.golden
+++ b/cli/testdata/coder_login_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder login [flags] <url>
+coder v0.0.0-devel
 
-Authenticate with Coder deployment
+USAGE:
+  coder login [flags] <url>
 
-Options
+  Authenticate with Coder deployment
+
+OPTIONS:
       --first-user-email string, $CODER_FIRST_USER_EMAIL
           Specifies an email address to use if creating the first user for the
           deployment.
@@ -23,5 +26,5 @@ Authenticate with Coder deployment
           By default, the CLI will generate a new session token when logging in.
           This flag will instead use the provided token as the session token.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_logout_--help.golden b/cli/testdata/coder_logout_--help.golden
index 6fb9b92e4276d..8ec08c2ad7553 100644
--- a/cli/testdata/coder_logout_--help.golden
+++ b/cli/testdata/coder_logout_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder logout [flags]
+coder v0.0.0-devel
 
-Unauthenticate your local session
+USAGE:
+  coder logout [flags]
 
-Options
+  Unauthenticate your local session
+
+OPTIONS:
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_netcheck_--help.golden b/cli/testdata/coder_netcheck_--help.golden
index c502f6b8da90b..9f3a2ccecb031 100644
--- a/cli/testdata/coder_netcheck_--help.golden
+++ b/cli/testdata/coder_netcheck_--help.golden
@@ -1,6 +1,9 @@
-Usage: coder netcheck
+coder v0.0.0-devel
 
-Print network debug information for DERP and STUN
+USAGE:
+  coder netcheck
 
----
+  Print network debug information for DERP and STUN
+
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_ping_--help.golden b/cli/testdata/coder_ping_--help.golden
index 55e5df16dbf6b..9410f272bdb91 100644
--- a/cli/testdata/coder_ping_--help.golden
+++ b/cli/testdata/coder_ping_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder ping [flags] <workspace>
+coder v0.0.0-devel
 
-Ping a workspace
+USAGE:
+  coder ping [flags] <workspace>
 
-Options
+  Ping a workspace
+
+OPTIONS:
   -n, --num int (default: 10)
           Specifies the number of pings to perform.
 
@@ -12,5 +15,5 @@ Ping a workspace
       --wait duration (default: 1s)
           Specifies how long to wait between pings.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_port-forward_--help.golden b/cli/testdata/coder_port-forward_--help.golden
index 35c314d400699..d4f8e761846f8 100644
--- a/cli/testdata/coder_port-forward_--help.golden
+++ b/cli/testdata/coder_port-forward_--help.golden
@@ -1,33 +1,39 @@
-Usage: coder port-forward [flags] <workspace>
-
-Forward ports from a workspace to the local machine. For reverse port
-forwarding, use "coder ssh -R".
-
-Aliases: tunnel
-
-- Port forward a single TCP port from 1234 in the workspace to port 5678 on   
-    your local machine:                                                         
-
-      $ coder port-forward <workspace> --tcp 5678:1234 
-
-  - Port forward a single UDP port from port 9000 to port 9000 on your local    
-    machine:                                                                    
-
-      $ coder port-forward <workspace> --udp 9000 
-
-  - Port forward multiple TCP ports and a UDP port:                             
-
-      $ coder port-forward <workspace> --tcp 8080:8080 --tcp 9000:3000 --udp 5353:53 
-
-  - Port forward multiple ports (TCP or UDP) in condensed syntax:               
-
-      $ coder port-forward <workspace> --tcp 8080,9000:3000,9090-9092,10000-10002:10010-10012 
-
-  - Port forward specifying the local address to bind to:                       
-
-      $ coder port-forward <workspace> --tcp 1.2.3.4:8080:8080 
-
-Options
+coder v0.0.0-devel
+
+USAGE:
+  coder port-forward [flags] <workspace>
+
+  Forward ports from a workspace to the local machine. For reverse port
+  forwarding, use "coder ssh -R".
+
+  Aliases: tunnel
+
+    - Port forward a single TCP port from 1234 in the workspace to port 5678 on
+  your
+  local machine:
+  
+       $ coder port-forward <workspace> --tcp 5678:1234
+  
+    - Port forward a single UDP port from port 9000 to port 9000 on your local
+  machine:
+  
+       $ coder port-forward <workspace> --udp 9000
+  
+    - Port forward multiple TCP ports and a UDP port:
+  
+       $ coder port-forward <workspace> --tcp 8080:8080 --tcp 9000:3000 --udp
+  5353:53
+  
+    - Port forward multiple ports (TCP or UDP) in condensed syntax:
+  
+       $ coder port-forward <workspace> --tcp
+  8080,9000:3000,9090-9092,10000-10002:10010-10012
+  
+    - Port forward specifying the local address to bind to:
+  
+       $ coder port-forward <workspace> --tcp 1.2.3.4:8080:8080
+
+OPTIONS:
   -p, --tcp string-array, $CODER_PORT_FORWARD_TCP
           Forward TCP port(s) from the workspace to the local machine.
 
@@ -35,5 +41,5 @@ Aliases: tunnel
           Forward UDP port(s) from the workspace to the local machine. The UDP
           connection has TCP-like semantics to support stateful UDP protocols.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_publickey_--help.golden b/cli/testdata/coder_publickey_--help.golden
index d6f99f3da7c2a..7346f892836b0 100644
--- a/cli/testdata/coder_publickey_--help.golden
+++ b/cli/testdata/coder_publickey_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder publickey [flags]
+coder v0.0.0-devel
 
-Output your Coder public key used for Git operations
+USAGE:
+  coder publickey [flags]
 
-Aliases: pubkey
+  Output your Coder public key used for Git operations
 
-Options
+  Aliases: pubkey
+
+OPTIONS:
       --reset bool
           Regenerate your public key. This will require updating the key on any
           services it's registered with.
@@ -12,5 +15,5 @@ Aliases: pubkey
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_rename_--help.golden b/cli/testdata/coder_rename_--help.golden
index 297e96c4b6521..33f9c460006a2 100644
--- a/cli/testdata/coder_rename_--help.golden
+++ b/cli/testdata/coder_rename_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder rename [flags] <workspace> <new name>
+coder v0.0.0-devel
 
-Rename a workspace
+USAGE:
+  coder rename [flags] <workspace> <new name>
 
-Options
+  Rename a workspace
+
+OPTIONS:
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_reset-password_--help.golden b/cli/testdata/coder_reset-password_--help.golden
index 198025681d5e2..a7d53df12ad90 100644
--- a/cli/testdata/coder_reset-password_--help.golden
+++ b/cli/testdata/coder_reset-password_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder reset-password [flags] <username>
+coder v0.0.0-devel
 
-Directly connect to the database to reset a user's password
+USAGE:
+  coder reset-password [flags] <username>
 
-Options
+  Directly connect to the database to reset a user's password
+
+OPTIONS:
       --postgres-url string, $CODER_PG_CONNECTION_URL
           URL of a PostgreSQL database to connect to.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_restart_--help.golden b/cli/testdata/coder_restart_--help.golden
index c2079b9065dca..db0f600d7cbce 100644
--- a/cli/testdata/coder_restart_--help.golden
+++ b/cli/testdata/coder_restart_--help.golden
@@ -1,13 +1,19 @@
-Usage: coder restart [flags] <workspace>
+coder v0.0.0-devel
 
-Restart a workspace
+USAGE:
+  coder restart [flags] <workspace>
+
+  Restart a workspace
+
+OPTIONS:
+      --build-option string-array, $CODER_BUILD_OPTION
+          Build option value in the format "name=value".
 
-Options
       --build-options bool
           Prompt for one-time build options defined with ephemeral parameters.
 
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_schedule_--help.golden b/cli/testdata/coder_schedule_--help.golden
index b9e8d46588c7d..97bae2719a603 100644
--- a/cli/testdata/coder_schedule_--help.golden
+++ b/cli/testdata/coder_schedule_--help.golden
@@ -1,13 +1,16 @@
-Usage: coder schedule { show | start | stop | override } <workspace>
+coder v0.0.0-devel
 
-Schedule automated start and stop times for workspaces
+USAGE:
+  coder schedule { show | start | stop | override } <workspace>
 
-Subcommands
+  Schedule automated start and stop times for workspaces
+
+SUBCOMMANDS:
     override-stop    Override the stop time of a currently running workspace
                      instance.
     show             Show workspace schedule
     start            Edit workspace start schedule
     stop             Edit workspace stop schedule
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_schedule_override-stop_--help.golden b/cli/testdata/coder_schedule_override-stop_--help.golden
index b0b5ca3050ca9..77fd2d5c4f57d 100644
--- a/cli/testdata/coder_schedule_override-stop_--help.golden
+++ b/cli/testdata/coder_schedule_override-stop_--help.golden
@@ -1,12 +1,15 @@
-Usage: coder schedule override-stop <workspace-name> <duration from now>
+coder v0.0.0-devel
 
-Override the stop time of a currently running workspace instance.
+USAGE:
+  coder schedule override-stop <workspace-name> <duration from now>
 
-* The new stop time is calculated from *now*.
-  * The new stop time must be at least 30 minutes in the future.
-  * The workspace template may restrict the maximum workspace runtime.
+  Override the stop time of a currently running workspace instance.
 
-  $ coder schedule override-stop my-workspace 90m 
+      * The new stop time is calculated from *now*.
+    * The new stop time must be at least 30 minutes in the future.
+    * The workspace template may restrict the maximum workspace runtime.
+  
+   $ coder schedule override-stop my-workspace 90m
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_schedule_show_--help.golden b/cli/testdata/coder_schedule_show_--help.golden
index c68afab451ef5..f9b5d47e6a381 100644
--- a/cli/testdata/coder_schedule_show_--help.golden
+++ b/cli/testdata/coder_schedule_show_--help.golden
@@ -1,12 +1,15 @@
-Usage: coder schedule show <workspace-name>
+coder v0.0.0-devel
 
-Show workspace schedule
+USAGE:
+  coder schedule show <workspace-name>
 
-Shows the following information for the given workspace:
-  * The automatic start schedule
-  * The next scheduled start time
-  * The duration after which it will stop
-  * The next scheduled stop time
+  Show workspace schedule
 
----
+  Shows the following information for the given workspace:
+    * The automatic start schedule
+    * The next scheduled start time
+    * The duration after which it will stop
+    * The next scheduled stop time
+
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_schedule_start_--help.golden b/cli/testdata/coder_schedule_start_--help.golden
index 21854d2e39081..a74999d36fb56 100644
--- a/cli/testdata/coder_schedule_start_--help.golden
+++ b/cli/testdata/coder_schedule_start_--help.golden
@@ -1,20 +1,29 @@
-Usage: coder schedule start <workspace-name> { <start-time> [day-of-week] [location] | manual }
+coder v0.0.0-devel
 
-Edit workspace start schedule
+USAGE:
+  coder schedule start <workspace-name> { <start-time> [day-of-week] [location]
+  | manual }
 
-Schedules a workspace to regularly start at a specific time.
-Schedule format: <start-time> [day-of-week] [location].
-  * Start-time (required) is accepted either in 12-hour (hh:mm{am|pm}) format, or 24-hour format hh:mm.
-  * Day-of-week (optional) allows specifying in the cron format, e.g. 1,3,5 or Mon-Fri.
-    Aliases such as @daily are not supported.
-    Default: * (every day)
-  * Location (optional) must be a valid location in the IANA timezone database.
-    If omitted, we will fall back to either the TZ environment variable or /etc/localtime.
-    You can check your corresponding location by visiting https://ipinfo.io - it shows in the demo widget on the right.
+  Edit workspace start schedule
 
-  - Set the workspace to start at 9:30am (in Dublin) from Monday to Friday:     
+  Schedules a workspace to regularly start at a specific time.
+  Schedule format: <start-time> [day-of-week] [location].
+    * Start-time (required) is accepted either in 12-hour (hh:mm{am|pm}) format,
+  or 24-hour format hh:mm.
+    * Day-of-week (optional) allows specifying in the cron format, e.g. 1,3,5 or
+  Mon-Fri.
+      Aliases such as @daily are not supported.
+      Default: * (every day)
+    * Location (optional) must be a valid location in the IANA timezone
+  database.
+      If omitted, we will fall back to either the TZ environment variable or
+  /etc/localtime.
+      You can check your corresponding location by visiting https://ipinfo.io -
+  it shows in the demo widget on the right.
+  
+    - Set the workspace to start at 9:30am (in Dublin) from Monday to Friday:
+  
+       $ coder schedule start my-workspace 9:30AM Mon-Fri Europe/Dublin
 
-      $ coder schedule start my-workspace 9:30AM Mon-Fri Europe/Dublin 
-
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_schedule_stop_--help.golden b/cli/testdata/coder_schedule_stop_--help.golden
index 44cda6c083d72..894b3d9580255 100644
--- a/cli/testdata/coder_schedule_stop_--help.golden
+++ b/cli/testdata/coder_schedule_stop_--help.golden
@@ -1,21 +1,28 @@
-Usage: coder schedule stop <workspace-name> { <duration> | manual }
+coder v0.0.0-devel
 
-Edit workspace stop schedule
+USAGE:
+  coder schedule stop <workspace-name> { <duration> | manual }
 
-Schedules a workspace to stop after a given duration has elapsed.
-  * Workspace runtime is measured from the time that the workspace build completed.
-  * The minimum scheduled stop time is 1 minute.
-  * The workspace template may place restrictions on the maximum shutdown time.
-  * Changes to workspace schedules only take effect upon the next build of the workspace,
-    and do not affect a running instance of a workspace.
+  Edit workspace stop schedule
 
-When enabling scheduled stop, enter a duration in one of the following formats:
-  * 3h2m (3 hours and two minutes)
-  * 3h   (3 hours)
-  * 2m   (2 minutes)
-  * 2    (2 minutes)
+  Schedules a workspace to stop after a given duration has elapsed.
+    * Workspace runtime is measured from the time that the workspace build
+  completed.
+    * The minimum scheduled stop time is 1 minute.
+    * The workspace template may place restrictions on the maximum shutdown
+  time.
+    * Changes to workspace schedules only take effect upon the next build of the
+  workspace,
+      and do not affect a running instance of a workspace.
+  
+  When enabling scheduled stop, enter a duration in one of the following
+  formats:
+    * 3h2m (3 hours and two minutes)
+    * 3h   (3 hours)
+    * 2m   (2 minutes)
+    * 2    (2 minutes)
+  
+   $ coder schedule stop my-workspace 2h30m
 
-  $ coder schedule stop my-workspace 2h30m 
-
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_server_--help.golden b/cli/testdata/coder_server_--help.golden
index cb7ca61b4913a..68953eb14e434 100644
--- a/cli/testdata/coder_server_--help.golden
+++ b/cli/testdata/coder_server_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder server [flags]
+coder v0.0.0-devel
 
-Start a Coder server
+USAGE:
+  coder server [flags]
 
-Subcommands
+  Start a Coder server
+
+SUBCOMMANDS:
     create-admin-user         Create a new admin user with the given username,
                               email and password and adds it to every
                               organization.
@@ -10,7 +13,7 @@ Start a Coder server
     postgres-builtin-url      Output the connection URL for the built-in
                               PostgreSQL deployment.
 
-Options
+OPTIONS:
       --cache-dir string, $CODER_CACHE_DIRECTORY (default: [cache dir])
           The directory to cache temporary files. If unspecified and
           $CACHE_DIRECTORY is set, it will be used for compatibility with
@@ -50,7 +53,7 @@ Start a Coder server
           Periodically check for new releases of Coder and inform the owner. The
           check is performed once per day.
 
-Client Options 
+CLIENT OPTIONS: 
 These options change the behavior of how clients interact with the Coder.
 Clients include the coder cli, vs code extension, and the web UI.
 
@@ -63,7 +66,11 @@ Clients include the coder cli, vs code extension, and the web UI.
       --ssh-hostname-prefix string, $CODER_SSH_HOSTNAME_PREFIX (default: coder.)
           The SSH deployment prefix is used in the Host of the ssh config.
 
-Config Options 
+      --web-terminal-renderer string, $CODER_WEB_TERMINAL_RENDERER (default: canvas)
+          The renderer to use when opening a web terminal. Valid values are
+          'canvas', 'webgl', or 'dom'.
+
+CONFIG OPTIONS: 
 Use a YAML configuration file when your server launch become unwieldy.
 
   -c, --config yaml-config-path, $CODER_CONFIG_PATH
@@ -73,7 +80,7 @@ Use a YAML configuration file when your server launch become unwieldy.
           
           Write out the current server config as YAML to stdout.
 
-Introspection / Logging Options 
+INTROSPECTION / LOGGING OPTIONS: 
       --enable-terraform-debug-mode bool, $CODER_ENABLE_TERRAFORM_DEBUG_MODE (default: false)
           Allow administrators to enable Terraform debug output.
 
@@ -90,7 +97,7 @@ Use a YAML configuration file when your server launch become unwieldy.
       --log-stackdriver string, $CODER_LOGGING_STACKDRIVER
           Output Stackdriver compatible logs to a given file.
 
-Introspection / Prometheus Options 
+INTROSPECTION / PROMETHEUS OPTIONS: 
       --prometheus-address host:port, $CODER_PROMETHEUS_ADDRESS (default: 127.0.0.1:2112)
           The bind address to serve prometheus metrics.
 
@@ -103,7 +110,7 @@ Use a YAML configuration file when your server launch become unwieldy.
       --prometheus-enable bool, $CODER_PROMETHEUS_ENABLE
           Serve prometheus metrics on the address defined by prometheus address.
 
-Introspection / Tracing Options 
+INTROSPECTION / TRACING OPTIONS: 
       --trace-logs bool, $CODER_TRACE_LOGS
           Enables capturing of logs as events in traces. This is useful for
           debugging, but may result in a very large amount of events being sent
@@ -117,14 +124,14 @@ Use a YAML configuration file when your server launch become unwieldy.
       --trace-honeycomb-api-key string, $CODER_TRACE_HONEYCOMB_API_KEY
           Enables trace exporting to Honeycomb.io using the provided API Key.
 
-Introspection / pprof Options 
+INTROSPECTION / PPROF OPTIONS: 
       --pprof-address host:port, $CODER_PPROF_ADDRESS (default: 127.0.0.1:6060)
           The bind address to serve pprof.
 
       --pprof-enable bool, $CODER_PPROF_ENABLE
           Serve pprof metrics on the address defined by pprof address.
 
-Networking Options 
+NETWORKING OPTIONS: 
       --access-url url, $CODER_ACCESS_URL
           The URL that users will use to access the Coder deployment.
 
@@ -150,7 +157,7 @@ Use a YAML configuration file when your server launch become unwieldy.
           Specifies the wildcard hostname to use for workspace applications in
           the form "*.example.com".
 
-Networking / DERP Options 
+NETWORKING / DERP OPTIONS: 
 Most Coder deployments never have to think about DERP because all connections
 between workspaces and users are peer-to-peer. However, when Coder cannot
 establish a peer to peer connection, Coder uses a distributed relay network
@@ -172,23 +179,27 @@ backed by Tailscale and WireGuard.
           URL to fetch a DERP mapping on startup. See:
           https://tailscale.com/kb/1118/custom-derp-servers/.
 
+      --derp-force-websockets bool, $CODER_DERP_FORCE_WEBSOCKETS
+          Force clients and agents to always use WebSocket to connect to DERP
+          relay servers. By default, DERP uses `Upgrade: derp`, which may cause
+          issues with some reverse proxies. Clients may automatically fallback
+          to WebSocket if they detect an issue with `Upgrade: derp`, but this
+          does not work in all situations.
+
       --derp-server-enable bool, $CODER_DERP_SERVER_ENABLE (default: true)
           Whether to enable or disable the embedded DERP relay server.
 
-      --derp-server-region-code string, $CODER_DERP_SERVER_REGION_CODE (default: coder)
-          Region code to use for the embedded DERP server.
-
-      --derp-server-region-id int, $CODER_DERP_SERVER_REGION_ID (default: 999)
-          Region ID to use for the embedded DERP server.
-
       --derp-server-region-name string, $CODER_DERP_SERVER_REGION_NAME (default: Coder Embedded Relay)
           Region name that for the embedded DERP server.
 
-      --derp-server-stun-addresses string-array, $CODER_DERP_SERVER_STUN_ADDRESSES (default: stun.l.google.com:19302)
-          Addresses for STUN servers to establish P2P connections. Use special
-          value 'disable' to turn off STUN.
+      --derp-server-stun-addresses string-array, $CODER_DERP_SERVER_STUN_ADDRESSES (default: stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302,stun3.l.google.com:19302,stun4.l.google.com:19302)
+          Addresses for STUN servers to establish P2P connections. It's
+          recommended to have at least two STUN servers to give users the best
+          chance of connecting P2P to workspaces. Each STUN server will get it's
+          own DERP region, with region IDs starting at `--derp-server-region-id
+          + 1`. Use special value 'disable' to turn off STUN completely.
 
-Networking / HTTP Options 
+NETWORKING / HTTP OPTIONS: 
       --disable-password-auth bool, $CODER_DISABLE_PASSWORD_AUTH
           Disable password authentication. This is recommended for security
           purposes in production deployments that rely on an identity provider.
@@ -219,7 +230,7 @@ backed by Tailscale and WireGuard.
           longer if they are actively making requests, but this functionality
           can be disabled via --disable-session-expiry-refresh.
 
-Networking / TLS Options 
+NETWORKING / TLS OPTIONS: 
 Configure TLS / HTTPS for your Coder deployment. If you're running Coder behind
 a TLS-terminating reverse proxy or are accessing Coder over a secure link, you
 can safely ignore these settings.
@@ -272,7 +283,7 @@ can safely ignore these settings.
           Minimum supported version of TLS. Accepted values are "tls10",
           "tls11", "tls12" or "tls13".
 
-OAuth2 / GitHub Options 
+OAUTH2 / GITHUB OPTIONS: 
       --oauth2-github-allow-everyone bool, $CODER_OAUTH2_GITHUB_ALLOW_EVERYONE
           Allow all logins, setting this option means allowed orgs and teams
           must be empty.
@@ -297,16 +308,29 @@ can safely ignore these settings.
           Base URL of a GitHub Enterprise deployment to use for Login with
           GitHub.
 
-OIDC Options 
+OIDC OPTIONS: 
+      --oidc-group-auto-create bool, $CODER_OIDC_GROUP_AUTO_CREATE (default: false)
+          Automatically creates missing groups from a user's groups claim.
+
       --oidc-allow-signups bool, $CODER_OIDC_ALLOW_SIGNUPS (default: true)
           Whether new users can sign up with OIDC.
 
       --oidc-auth-url-params struct[map[string]string], $CODER_OIDC_AUTH_URL_PARAMS (default: {"access_type": "offline"})
           OIDC auth URL parameters to pass to the upstream provider.
 
+      --oidc-client-cert-file string, $CODER_OIDC_CLIENT_CERT_FILE
+          Pem encoded certificate file to use for oauth2 PKI/JWT authorization.
+          The public certificate that accompanies oidc-client-key-file. A
+          standard x509 certificate is expected.
+
       --oidc-client-id string, $CODER_OIDC_CLIENT_ID
           Client ID to use for Login with OIDC.
 
+      --oidc-client-key-file string, $CODER_OIDC_CLIENT_KEY_FILE
+          Pem encoded RSA private key to use for oauth2 PKI/JWT authorization.
+          This can be used instead of oidc-client-secret if your IDP supports
+          it.
+
       --oidc-client-secret string, $CODER_OIDC_CLIENT_SECRET
           Client secret to use for Login with OIDC.
 
@@ -334,6 +358,11 @@ can safely ignore these settings.
       --oidc-issuer-url string, $CODER_OIDC_ISSUER_URL
           Issuer URL to use for Login with OIDC.
 
+      --oidc-group-regex-filter regexp, $CODER_OIDC_GROUP_REGEX_FILTER (default: .*)
+          If provided any group name not matching the regex is ignored. This
+          allows for filtering out groups that are not needed. This filter is
+          applied after the group mapping.
+
       --oidc-scopes string-array, $CODER_OIDC_SCOPES (default: openid,profile,email)
           Scopes to grant when authenticating with OIDC.
 
@@ -358,9 +387,9 @@ can safely ignore these settings.
           The text to show on the OpenID Connect sign in button.
 
       --oidc-icon-url url, $CODER_OIDC_ICON_URL
-          URL pointing to the icon to use on the OepnID Connect login button.
+          URL pointing to the icon to use on the OpenID Connect login button.
 
-Provisioning Options 
+PROVISIONING OPTIONS: 
 Tune the behavior of the provisioner, which is responsible for creating,
 updating, and deleting workspace resources.
 
@@ -368,16 +397,20 @@ updating, and deleting workspace resources.
           Time to force cancel provisioning tasks that are stuck.
 
       --provisioner-daemon-poll-interval duration, $CODER_PROVISIONER_DAEMON_POLL_INTERVAL (default: 1s)
-          Time to wait before polling for a new job.
+          Deprecated and ignored.
 
       --provisioner-daemon-poll-jitter duration, $CODER_PROVISIONER_DAEMON_POLL_JITTER (default: 100ms)
-          Random jitter added to the poll interval.
+          Deprecated and ignored.
+
+      --provisioner-daemon-psk string, $CODER_PROVISIONER_DAEMON_PSK
+          Pre-shared key to authenticate external provisioner daemons to Coder
+          server.
 
       --provisioner-daemons int, $CODER_PROVISIONER_DAEMONS (default: 3)
           Number of provisioner daemons to create on start. If builds are stuck
           in queued state for a long time, consider increasing this.
 
-Telemetry Options 
+TELEMETRY OPTIONS: 
 Telemetry is critical to our ability to improve Coder. We strip all
 personalinformation before sending data to our servers. Please only disable
 telemetrywhen required by your organization's security policy.
@@ -386,12 +419,7 @@ telemetrywhen required by your organization's security policy.
           Whether telemetry is enabled or not. Coder collects anonymized usage
           data to help improve our product.
 
-      --telemetry-trace bool, $CODER_TELEMETRY_TRACE (default: false)
-          Whether Opentelemetry traces are sent to Coder. Coder collects
-          anonymized application tracing to help improve our product. Disabling
-          telemetry also disables this option.
-
-User Quiet Hours Schedule Options 
+USER QUIET HOURS SCHEDULE OPTIONS: 
 Allow users to set quiet hours schedules each day for workspaces to avoid
 workspaces stopping during the day due to template max TTL.
 
@@ -405,7 +433,7 @@ workspaces stopping during the day due to template max TTL.
           one hour and minute can be specified (ranges or comma separated values
           are not supported).
 
-⚠️ Dangerous Options 
+⚠️ DANGEROUS OPTIONS: 
       --dangerous-allow-path-app-sharing bool, $CODER_DANGEROUS_ALLOW_PATH_APP_SHARING
           Allow workspace apps that are not served from subdomains to be shared.
           Path-based app sharing is DISABLED by default for security purposes.
@@ -422,7 +450,7 @@ workspaces stopping during the day due to template max TTL.
           can be disabled entirely with --disable-path-apps for further
           security.
 
-Enterprise Options 
+ENTERPRISE OPTIONS: 
 These options are only available in the Enterprise Edition.
 
       --browser-only bool, $CODER_BROWSER_ONLY
@@ -432,9 +460,19 @@ These options are only available in the Enterprise Edition.
           An HTTP URL that is accessible by other replicas to relay DERP
           traffic. Required for high availability.
 
+      --external-token-encryption-keys string-array, $CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS
+          Encrypt OIDC and Git authentication tokens with AES-256-GCM in the
+          database. The value must be a comma-separated list of base64-encoded
+          keys. Each key, when base64-decoded, must be exactly 32 bytes in
+          length. The first key will be used to encrypt new values. Subsequent
+          keys will be used as a fallback when decrypting. During normal
+          operation it is recommended to only set one key unless you are in the
+          process of rotating keys with the `coder server dbcrypt rotate`
+          command.
+
       --scim-auth-header string, $CODER_SCIM_AUTH_HEADER
           Enables SCIM and sets the authentication header for the built-in SCIM
           server. New users are automatically created with OIDC authentication.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_server_create-admin-user_--help.golden b/cli/testdata/coder_server_create-admin-user_--help.golden
index 6c95fb1954756..e600132a976d8 100644
--- a/cli/testdata/coder_server_create-admin-user_--help.golden
+++ b/cli/testdata/coder_server_create-admin-user_--help.golden
@@ -1,9 +1,12 @@
-Usage: coder server create-admin-user [flags]
+coder v0.0.0-devel
 
-Create a new admin user with the given username, email and password and adds it
-to every organization.
+USAGE:
+  coder server create-admin-user [flags]
 
-Options
+  Create a new admin user with the given username, email and password and adds
+  it to every organization.
+
+OPTIONS:
       --email string, $CODER_EMAIL
           The email of the new user. If not specified, you will be prompted via
           stdin.
@@ -28,5 +31,5 @@ to every organization.
           The username of the new user. If not specified, you will be prompted
           via stdin.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_server_postgres-builtin-serve_--help.golden b/cli/testdata/coder_server_postgres-builtin-serve_--help.golden
index bb61bd8292916..18b87581c5b71 100644
--- a/cli/testdata/coder_server_postgres-builtin-serve_--help.golden
+++ b/cli/testdata/coder_server_postgres-builtin-serve_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder server postgres-builtin-serve [flags]
+coder v0.0.0-devel
 
-Run the built-in PostgreSQL deployment.
+USAGE:
+  coder server postgres-builtin-serve [flags]
 
-Options
+  Run the built-in PostgreSQL deployment.
+
+OPTIONS:
       --raw-url bool
           Output the raw connection URL instead of a psql command.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_server_postgres-builtin-url_--help.golden b/cli/testdata/coder_server_postgres-builtin-url_--help.golden
index af6ca07dc1c61..647ad7ae26c21 100644
--- a/cli/testdata/coder_server_postgres-builtin-url_--help.golden
+++ b/cli/testdata/coder_server_postgres-builtin-url_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder server postgres-builtin-url [flags]
+coder v0.0.0-devel
 
-Output the connection URL for the built-in PostgreSQL deployment.
+USAGE:
+  coder server postgres-builtin-url [flags]
 
-Options
+  Output the connection URL for the built-in PostgreSQL deployment.
+
+OPTIONS:
       --raw-url bool
           Output the raw connection URL instead of a psql command.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_show_--help.golden b/cli/testdata/coder_show_--help.golden
index ff4ac563d75b4..fc048aa067ea6 100644
--- a/cli/testdata/coder_show_--help.golden
+++ b/cli/testdata/coder_show_--help.golden
@@ -1,6 +1,9 @@
-Usage: coder show <workspace>
+coder v0.0.0-devel
 
-Display details of a workspace's resources and agents
+USAGE:
+  coder show <workspace>
 
----
+  Display details of a workspace's resources and agents
+
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_speedtest_--help.golden b/cli/testdata/coder_speedtest_--help.golden
index 3ed266699d376..57c4c5237bfd6 100644
--- a/cli/testdata/coder_speedtest_--help.golden
+++ b/cli/testdata/coder_speedtest_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder speedtest [flags] <workspace>
+coder v0.0.0-devel
 
-Run upload and download tests from your machine to a workspace
+USAGE:
+  coder speedtest [flags] <workspace>
 
-Options
+  Run upload and download tests from your machine to a workspace
+
+OPTIONS:
   -d, --direct bool
           Specifies whether to wait for a direct connection before testing
           speed.
@@ -14,5 +17,5 @@ Run upload and download tests from your machine to a workspace
   -t, --time duration (default: 5s)
           Specifies the duration to monitor traffic.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_ssh_--help.golden b/cli/testdata/coder_ssh_--help.golden
index 74ce84d2b677a..14e3ec2f5d973 100644
--- a/cli/testdata/coder_ssh_--help.golden
+++ b/cli/testdata/coder_ssh_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder ssh [flags] <workspace>
+coder v0.0.0-devel
 
-Start a shell into a workspace
+USAGE:
+  coder ssh [flags] <workspace>
 
-Options
+  Start a shell into a workspace
+
+OPTIONS:
   -A, --forward-agent bool, $CODER_SSH_FORWARD_AGENT
           Specifies whether to forward the SSH agent specified in
           $SSH_AUTH_SOCK.
@@ -41,5 +44,5 @@ Start a shell into a workspace
       --workspace-poll-interval duration, $CODER_WORKSPACE_POLL_INTERVAL (default: 1m)
           Specifies how often to poll for workspace automated shutdown.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_start_--help.golden b/cli/testdata/coder_start_--help.golden
index aa447240e9bbb..0c129342b43ba 100644
--- a/cli/testdata/coder_start_--help.golden
+++ b/cli/testdata/coder_start_--help.golden
@@ -1,13 +1,19 @@
-Usage: coder start [flags] <workspace>
+coder v0.0.0-devel
 
-Start a workspace
+USAGE:
+  coder start [flags] <workspace>
+
+  Start a workspace
+
+OPTIONS:
+      --build-option string-array, $CODER_BUILD_OPTION
+          Build option value in the format "name=value".
 
-Options
       --build-options bool
           Prompt for one-time build options defined with ephemeral parameters.
 
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_stat_--help.golden b/cli/testdata/coder_stat_--help.golden
index e2eddcb30fcf2..e8557f5059827 100644
--- a/cli/testdata/coder_stat_--help.golden
+++ b/cli/testdata/coder_stat_--help.golden
@@ -1,13 +1,16 @@
-Usage: coder stat [flags]
+coder v0.0.0-devel
 
-Show resource usage for the current workspace.
+USAGE:
+  coder stat [flags]
 
-Subcommands
+  Show resource usage for the current workspace.
+
+SUBCOMMANDS:
     cpu     Show CPU usage, in cores.
     disk    Show disk usage, in gigabytes.
     mem     Show memory usage, in gigabytes.
 
-Options
+OPTIONS:
   -c, --column string-array (default: host_cpu,host_memory,home_disk,container_cpu,container_memory)
           Columns to display in table output. Available columns: host cpu, host
           memory, home disk, container cpu, container memory.
@@ -15,5 +18,5 @@ Show resource usage for the current workspace.
   -o, --output string (default: table)
           Output format. Available formats: table, json.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_stat_cpu_--help.golden b/cli/testdata/coder_stat_cpu_--help.golden
index f9cc1124b2637..ec92a6845704f 100644
--- a/cli/testdata/coder_stat_cpu_--help.golden
+++ b/cli/testdata/coder_stat_cpu_--help.golden
@@ -1,13 +1,16 @@
-Usage: coder stat cpu [flags]
+coder v0.0.0-devel
 
-Show CPU usage, in cores.
+USAGE:
+  coder stat cpu [flags]
 
-Options
+  Show CPU usage, in cores.
+
+OPTIONS:
       --host bool
           Force host CPU measurement.
 
   -o, --output string (default: text)
           Output format. Available formats: text, json.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_stat_disk_--help.golden b/cli/testdata/coder_stat_disk_--help.golden
index 4a6c0c5cf19da..815d81bc45362 100644
--- a/cli/testdata/coder_stat_disk_--help.golden
+++ b/cli/testdata/coder_stat_disk_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder stat disk [flags]
+coder v0.0.0-devel
 
-Show disk usage, in gigabytes.
+USAGE:
+  coder stat disk [flags]
 
-Options
+  Show disk usage, in gigabytes.
+
+OPTIONS:
   -o, --output string (default: text)
           Output format. Available formats: text, json.
 
@@ -12,5 +15,5 @@ Show disk usage, in gigabytes.
       --prefix Ki|Mi|Gi|Ti (default: Gi)
           SI Prefix for disk measurement.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_stat_mem_--help.golden b/cli/testdata/coder_stat_mem_--help.golden
index 189d8da2c36bd..97eaaff83604a 100644
--- a/cli/testdata/coder_stat_mem_--help.golden
+++ b/cli/testdata/coder_stat_mem_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder stat mem [flags]
+coder v0.0.0-devel
 
-Show memory usage, in gigabytes.
+USAGE:
+  coder stat mem [flags]
 
-Options
+  Show memory usage, in gigabytes.
+
+OPTIONS:
       --host bool
           Force host memory measurement.
 
@@ -12,5 +15,5 @@ Show memory usage, in gigabytes.
       --prefix Ki|Mi|Gi|Ti (default: Gi)
           SI Prefix for memory measurement.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_state_--help.golden b/cli/testdata/coder_state_--help.golden
index c23e1300ddac2..7d2e2e78760a1 100644
--- a/cli/testdata/coder_state_--help.golden
+++ b/cli/testdata/coder_state_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder state
+coder v0.0.0-devel
 
-Manually manage Terraform state to fix broken workspaces
+USAGE:
+  coder state
 
-Subcommands
+  Manually manage Terraform state to fix broken workspaces
+
+SUBCOMMANDS:
     pull    Pull a Terraform state file from a workspace.
     push    Push a Terraform state file to a workspace.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_state_pull_--help.golden b/cli/testdata/coder_state_pull_--help.golden
index ff99e3fe6156c..6d4761d4519e4 100644
--- a/cli/testdata/coder_state_pull_--help.golden
+++ b/cli/testdata/coder_state_pull_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder state pull [flags] <workspace> [file]
+coder v0.0.0-devel
 
-Pull a Terraform state file from a workspace.
+USAGE:
+  coder state pull [flags] <workspace> [file]
 
-Options
+  Pull a Terraform state file from a workspace.
+
+OPTIONS:
   -b, --build int
           Specify a workspace build to target by name. Defaults to latest.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_state_push_--help.golden b/cli/testdata/coder_state_push_--help.golden
index 119238cb92fa7..06764846c3378 100644
--- a/cli/testdata/coder_state_push_--help.golden
+++ b/cli/testdata/coder_state_push_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder state push [flags] <workspace> <file>
+coder v0.0.0-devel
 
-Push a Terraform state file to a workspace.
+USAGE:
+  coder state push [flags] <workspace> <file>
 
-Options
+  Push a Terraform state file to a workspace.
+
+OPTIONS:
   -b, --build int
           Specify a workspace build to target by name. Defaults to latest.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_stop_--help.golden b/cli/testdata/coder_stop_--help.golden
index 7226537a91230..529c38484668e 100644
--- a/cli/testdata/coder_stop_--help.golden
+++ b/cli/testdata/coder_stop_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder stop [flags] <workspace>
+coder v0.0.0-devel
 
-Stop a workspace
+USAGE:
+  coder stop [flags] <workspace>
 
-Options
+  Stop a workspace
+
+OPTIONS:
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_--help.golden b/cli/testdata/coder_templates_--help.golden
index 0bcc6c7978df7..f9ce76a9ff2c5 100644
--- a/cli/testdata/coder_templates_--help.golden
+++ b/cli/testdata/coder_templates_--help.golden
@@ -1,34 +1,41 @@
-Usage: coder templates
-
-Manage templates
-
-Aliases: template
-
-Templates are written in standard Terraform and describe the infrastructure for workspaces
-  - Create a template for developers to create workspaces:                      
-
-      $ coder templates create 
-
-  - Make changes to your template, and plan the changes:                        
-
-      $ coder templates plan my-template 
-
-  - Push an update to the template. Your developers can update their workspaces:
-
-      $ coder templates push my-template 
-
-Subcommands
+coder v0.0.0-devel
+
+USAGE:
+  coder templates
+
+  Manage templates
+
+  Aliases: template
+
+  Templates are written in standard Terraform and describe the infrastructure
+  for workspaces
+    - Create a template for developers to create workspaces:
+  
+       $ coder templates create
+  
+    - Make changes to your template, and plan the changes:
+  
+       $ coder templates plan my-template
+  
+    - Push an update to the template. Your developers can update their
+  workspaces:
+  
+       $ coder templates push my-template
+
+SUBCOMMANDS:
+    archive     Archive unused or failed template versions from a given
+                template(s)
     create      Create a template from the current directory or as specified by
                 flag
     delete      Delete templates
     edit        Edit the metadata of a template by name.
     init        Get started with a templated template.
     list        List all the templates available for the organization
-    plan        Plan a template push from the current directory
-    pull        Download the latest version of a template to a path.
+    pull        Download the active, latest, or specified version of a template
+                to a path.
     push        Push a new template version from the current directory or as
                 specified by flag
     versions    Manage different versions of the specified template
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_archive_--help.golden b/cli/testdata/coder_templates_archive_--help.golden
new file mode 100644
index 0000000000000..ad9778ad9990c
--- /dev/null
+++ b/cli/testdata/coder_templates_archive_--help.golden
@@ -0,0 +1,17 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder templates archive [flags] [template-name...] 
+
+  Archive unused or failed template versions from a given template(s)
+
+OPTIONS:
+      --all bool
+          Include all unused template versions. By default, only failed template
+          versions are archived.
+
+  -y, --yes bool
+          Bypass prompts.
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_create_--help.golden b/cli/testdata/coder_templates_create_--help.golden
index a88fe64bdeba3..f458d3954dd62 100644
--- a/cli/testdata/coder_templates_create_--help.golden
+++ b/cli/testdata/coder_templates_create_--help.golden
@@ -1,17 +1,24 @@
-Usage: coder templates create [flags] [name]
+coder v0.0.0-devel
 
-Create a template from the current directory or as specified by flag
+USAGE:
+  coder templates create [flags] [name]
 
-Options
+  Create a template from the current directory or as specified by flag
+
+OPTIONS:
       --default-ttl duration (default: 24h)
-          Specify a default TTL for workspaces created from this template.
+          Specify a default TTL for workspaces created from this template. It is
+          the default time before shutdown - workspaces created from this
+          template default to this value. Maps to "Default autostop" in the UI.
 
   -d, --directory string (default: .)
           Specify the directory to create from, use '-' to read tar from stdin.
 
       --failure-ttl duration (default: 0h)
-          Specify a failure TTL for workspaces created from this template. This
-          licensed feature's default is 0h (off).
+          Specify a failure TTL for workspaces created from this template. It is
+          the amount of time after a failed "start" build before coder
+          automatically schedules a "stop" build to cleanup.This licensed
+          feature's default is 0h (off). Maps to "Failure cleanup"in the UI.
 
       --ignore-lockfile bool (default: false)
           Ignore warnings about not having a .terraform.lock.hcl file present in
@@ -19,7 +26,15 @@ Create a template from the current directory or as specified by flag
 
       --inactivity-ttl duration (default: 0h)
           Specify an inactivity TTL for workspaces created from this template.
-          This licensed feature's default is 0h (off).
+          It is the amount of time the workspace is not used before it is be
+          stopped and auto-locked. This includes across multiple builds (e.g.
+          auto-starts and stops). This licensed feature's default is 0h (off).
+          Maps to "Dormancy threshold" in the UI.
+
+      --max-ttl duration
+          Edit the template maximum time before shutdown - workspaces created
+          from this template must shutdown within the given duration after
+          starting. This is an enterprise-only feature.
 
   -m, --message string
           Specify a message describing the changes in this version of the
@@ -34,6 +49,11 @@ Create a template from the current directory or as specified by flag
       --provisioner-tag string-array
           Specify a set of tags to target provisioner daemons.
 
+      --require-active-version bool (default: false)
+          Requires workspace builds to use the active template version. This
+          setting does not apply to template admins. This is an enterprise-only
+          feature.
+
       --var string-array
           Alias of --variable.
 
@@ -46,5 +66,5 @@ Create a template from the current directory or as specified by flag
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_delete_--help.golden b/cli/testdata/coder_templates_delete_--help.golden
index e580264ba72f0..2ba706b7d2aab 100644
--- a/cli/testdata/coder_templates_delete_--help.golden
+++ b/cli/testdata/coder_templates_delete_--help.golden
@@ -1,12 +1,15 @@
-Usage: coder templates delete [flags] [name...]
+coder v0.0.0-devel
 
-Delete templates
+USAGE:
+  coder templates delete [flags] [name...]
 
-Aliases: rm
+  Delete templates
 
-Options
+  Aliases: rm
+
+OPTIONS:
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_edit_--help.golden b/cli/testdata/coder_templates_edit_--help.golden
index 09c0b7209e78a..fd5841125e708 100644
--- a/cli/testdata/coder_templates_edit_--help.golden
+++ b/cli/testdata/coder_templates_edit_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder templates edit [flags] <template>
+coder v0.0.0-devel
 
-Edit the metadata of a template by name.
+USAGE:
+  coder templates edit [flags] <template>
 
-Options
+  Edit the metadata of a template by name.
+
+OPTIONS:
       --allow-user-autostart bool (default: true)
           Allow users to configure autostart for workspaces on this template.
           This can only be disabled in enterprise.
@@ -14,9 +17,16 @@ Edit the metadata of a template by name.
       --allow-user-cancel-workspace-jobs bool (default: true)
           Allow users to cancel in-progress workspace jobs.
 
+      --autostart-requirement-weekdays string-array
+          Edit the template autostart requirement weekdays - workspaces created
+          from this template can only autostart on the given weekdays. To unset
+          this value for the template (and allow autostart on all days), pass
+          'all'.
+
       --default-ttl duration
           Edit the template default time before shutdown - workspaces created
-          from this template default to this value.
+          from this template default to this value. Maps to "Default autostop"
+          in the UI.
 
       --description string
           Edit the template description.
@@ -25,26 +35,37 @@ Edit the metadata of a template by name.
           Edit the template display name.
 
       --failure-ttl duration (default: 0h)
-          Specify a failure TTL for workspaces created from this template. This
-          licensed feature's default is 0h (off).
+          Specify a failure TTL for workspaces created from this template. It is
+          the amount of time after a failed "start" build before coder
+          automatically schedules a "stop" build to cleanup.This licensed
+          feature's default is 0h (off). Maps to "Failure cleanup" in the UI.
 
       --icon string
           Edit the template icon path.
 
       --inactivity-ttl duration (default: 0h)
           Specify an inactivity TTL for workspaces created from this template.
-          This licensed feature's default is 0h (off).
+          It is the amount of time the workspace is not used before it is be
+          stopped and auto-locked. This includes across multiple builds (e.g.
+          auto-starts and stops). This licensed feature's default is 0h (off).
+          Maps to "Dormancy threshold" in the UI.
 
       --max-ttl duration
           Edit the template maximum time before shutdown - workspaces created
           from this template must shutdown within the given duration after
-          starting. This is an enterprise-only feature.
+          starting, regardless of user activity. This is an enterprise-only
+          feature. Maps to "Max lifetime" in the UI.
 
       --name string
           Edit the template name.
 
+      --require-active-version bool (default: false)
+          Requires workspace builds to use the active template version. This
+          setting does not apply to template admins. This is an enterprise-only
+          feature.
+
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_init_--help.golden b/cli/testdata/coder_templates_init_--help.golden
index 2a60cc6e0c2d8..c46f383c29f22 100644
--- a/cli/testdata/coder_templates_init_--help.golden
+++ b/cli/testdata/coder_templates_init_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder templates init [flags] [directory]
+coder v0.0.0-devel
 
-Get started with a templated template.
+USAGE:
+  coder templates init [flags] [directory]
 
-Options
-      --id aws-ecs-container|aws-linux|aws-windows|azure-linux|do-linux|docker|docker-with-dotfiles|fly-docker-image|gcp-linux|gcp-vm-container|gcp-windows|kubernetes
+  Get started with a templated template.
+
+OPTIONS:
+      --id aws-ecs-container|aws-linux|aws-windows|azure-linux|do-linux|docker|docker-with-dotfiles|gcp-linux|gcp-vm-container|gcp-windows|kubernetes|nomad-docker
           Specify a given example template by ID.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_list_--help.golden b/cli/testdata/coder_templates_list_--help.golden
index 2dffbf8e10823..c76905cae27f4 100644
--- a/cli/testdata/coder_templates_list_--help.golden
+++ b/cli/testdata/coder_templates_list_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder templates list [flags]
+coder v0.0.0-devel
 
-List all the templates available for the organization
+USAGE:
+  coder templates list [flags]
 
-Aliases: ls
+  List all the templates available for the organization
 
-Options
+  Aliases: ls
+
+OPTIONS:
   -c, --column string-array (default: name,last updated,used by)
           Columns to display in table output. Available columns: name, created
           at, last updated, organization id, provisioner, active version id,
@@ -13,5 +16,5 @@ Aliases: ls
   -o, --output string (default: table)
           Output format. Available formats: table, json.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_pull_--help.golden b/cli/testdata/coder_templates_pull_--help.golden
index 1377efbff0a48..65cb302a65a8c 100644
--- a/cli/testdata/coder_templates_pull_--help.golden
+++ b/cli/testdata/coder_templates_pull_--help.golden
@@ -1,13 +1,21 @@
-Usage: coder templates pull [flags] <name> [destination]
+coder v0.0.0-devel
 
-Download the latest version of a template to a path.
+USAGE:
+  coder templates pull [flags] <name> [destination]
 
-Options
+  Download the active, latest, or specified version of a template to a path.
+
+OPTIONS:
       --tar bool
           Output the template as a tar archive to stdout.
 
+      --version string
+          The name of the template version to pull. Use 'active' to pull the
+          active version, 'latest' to pull the latest version, or the name of
+          the template version to pull.
+
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_push_--help.golden b/cli/testdata/coder_templates_push_--help.golden
index 54608e84513c3..9d255c1f8bc23 100644
--- a/cli/testdata/coder_templates_push_--help.golden
+++ b/cli/testdata/coder_templates_push_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder templates push [flags] [template]
+coder v0.0.0-devel
 
-Push a new template version from the current directory or as specified by flag
+USAGE:
+  coder templates push [flags] [template]
 
-Options
+  Push a new template version from the current directory or as specified by flag
+
+OPTIONS:
       --activate bool (default: true)
           Whether the new template will be marked active.
 
@@ -44,5 +47,5 @@ Push a new template version from the current directory or as specified by flag
   -y, --yes bool
           Bypass prompts.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_versions_--help.golden b/cli/testdata/coder_templates_versions_--help.golden
index 58636e2ccdf6c..8d10e4a0f8d00 100644
--- a/cli/testdata/coder_templates_versions_--help.golden
+++ b/cli/testdata/coder_templates_versions_--help.golden
@@ -1,15 +1,20 @@
-Usage: coder templates versions
+coder v0.0.0-devel
 
-Manage different versions of the specified template
+USAGE:
+  coder templates versions
 
-Aliases: version
+  Manage different versions of the specified template
 
-- List versions of a specific template:                                       
+  Aliases: version
 
-      $ coder templates versions list my-template 
+    - List versions of a specific template:
+  
+       $ coder templates versions list my-template
 
-Subcommands
-    list    List all the versions of the specified template
+SUBCOMMANDS:
+    archive      Archive a template version(s).
+    list         List all the versions of the specified template
+    unarchive    Unarchive a template version(s).
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_versions_archive_--help.golden b/cli/testdata/coder_templates_versions_archive_--help.golden
new file mode 100644
index 0000000000000..463a83cf22a1d
--- /dev/null
+++ b/cli/testdata/coder_templates_versions_archive_--help.golden
@@ -0,0 +1,14 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder templates versions archive [flags] <template-name>
+  [template-version-names...] 
+
+  Archive a template version(s).
+
+OPTIONS:
+  -y, --yes bool
+          Bypass prompts.
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_versions_list_--help.golden b/cli/testdata/coder_templates_versions_list_--help.golden
index 97ea9bb93585b..3646c2dada80e 100644
--- a/cli/testdata/coder_templates_versions_list_--help.golden
+++ b/cli/testdata/coder_templates_versions_list_--help.golden
@@ -1,14 +1,20 @@
-Usage: coder templates versions list [flags] <template>
+coder v0.0.0-devel
 
-List all the versions of the specified template
+USAGE:
+  coder templates versions list [flags] <template>
 
-Options
-  -c, --column string-array (default: name,created at,created by,status,active)
+  List all the versions of the specified template
+
+OPTIONS:
+  -c, --column string-array (default: Name,Created At,Created By,Status,Active)
           Columns to display in table output. Available columns: name, created
-          at, created by, status, active.
+          at, created by, status, active, archived.
+
+      --include-archived bool
+          Include archived versions in the result list.
 
   -o, --output string (default: table)
           Output format. Available formats: table, json.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_templates_versions_unarchive_--help.golden b/cli/testdata/coder_templates_versions_unarchive_--help.golden
new file mode 100644
index 0000000000000..e2241b14bc018
--- /dev/null
+++ b/cli/testdata/coder_templates_versions_unarchive_--help.golden
@@ -0,0 +1,14 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder templates versions unarchive [flags] <template-name>
+  [template-version-names...] 
+
+  Unarchive a template version(s).
+
+OPTIONS:
+  -y, --yes bool
+          Bypass prompts.
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_tokens_--help.golden b/cli/testdata/coder_tokens_--help.golden
index 0ba7c3f1fe316..7247c42a4bd1d 100644
--- a/cli/testdata/coder_tokens_--help.golden
+++ b/cli/testdata/coder_tokens_--help.golden
@@ -1,26 +1,29 @@
-Usage: coder tokens
+coder v0.0.0-devel
 
-Manage personal access tokens
+USAGE:
+  coder tokens
 
-Aliases: token
+  Manage personal access tokens
 
-Tokens are used to authenticate automated clients to Coder.
-  - Create a token for automation:                                              
+  Aliases: token
 
-      $ coder tokens create 
+  Tokens are used to authenticate automated clients to Coder.
+    - Create a token for automation:
+  
+       $ coder tokens create
+  
+    - List your tokens:
+  
+       $ coder tokens ls
+  
+    - Remove a token by ID:
+  
+       $ coder tokens rm WuoWs4ZsMX
 
-  - List your tokens:                                                           
-
-      $ coder tokens ls 
-
-  - Remove a token by ID:                                                       
-
-      $ coder tokens rm WuoWs4ZsMX 
-
-Subcommands
+SUBCOMMANDS:
     create    Create a token
     list      List tokens
     remove    Delete a token
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_tokens_create_--help.golden b/cli/testdata/coder_tokens_create_--help.golden
index 118b772b39454..f36d80f229783 100644
--- a/cli/testdata/coder_tokens_create_--help.golden
+++ b/cli/testdata/coder_tokens_create_--help.golden
@@ -1,13 +1,16 @@
-Usage: coder tokens create [flags]
+coder v0.0.0-devel
 
-Create a token
+USAGE:
+  coder tokens create [flags]
 
-Options
+  Create a token
+
+OPTIONS:
       --lifetime duration, $CODER_TOKEN_LIFETIME (default: 720h0m0s)
           Specify a duration for the lifetime of the token.
 
   -n, --name string, $CODER_TOKEN_NAME
           Specify a human-readable name.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_tokens_list_--help.golden b/cli/testdata/coder_tokens_list_--help.golden
index 43a0c973be832..7e52e11c5636b 100644
--- a/cli/testdata/coder_tokens_list_--help.golden
+++ b/cli/testdata/coder_tokens_list_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder tokens list [flags]
+coder v0.0.0-devel
 
-List tokens
+USAGE:
+  coder tokens list [flags]
 
-Aliases: ls
+  List tokens
 
-Options
+  Aliases: ls
+
+OPTIONS:
   -a, --all bool
           Specifies whether all users' tokens will be listed or not (must have
           Owner role to see all tokens).
@@ -16,5 +19,5 @@ Aliases: ls
   -o, --output string (default: table)
           Output format. Available formats: table, json.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_tokens_remove_--help.golden b/cli/testdata/coder_tokens_remove_--help.golden
index fce69ef0982ef..30440e8ef2e7c 100644
--- a/cli/testdata/coder_tokens_remove_--help.golden
+++ b/cli/testdata/coder_tokens_remove_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder tokens remove <name>
+coder v0.0.0-devel
 
-Delete a token
+USAGE:
+  coder tokens remove <name>
 
-Aliases: delete, rm
+  Delete a token
 
----
+  Aliases: delete, rm
+
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_update_--help.golden b/cli/testdata/coder_update_--help.golden
index 40e899cd37348..896747ca7f495 100644
--- a/cli/testdata/coder_update_--help.golden
+++ b/cli/testdata/coder_update_--help.golden
@@ -1,20 +1,29 @@
-Usage: coder update [flags] <workspace>
+coder v0.0.0-devel
 
-Will update and start a given workspace if it is out of date
+USAGE:
+  coder update [flags] <workspace>
 
-Use --always-prompt to change the parameter values of the workspace.
+  Will update and start a given workspace if it is out of date
 
-Options
+  Use --always-prompt to change the parameter values of the workspace.
+
+OPTIONS:
       --always-prompt bool
           Always prompt all parameters. Does not pull parameter values from
           existing workspace.
 
+      --build-option string-array, $CODER_BUILD_OPTION
+          Build option value in the format "name=value".
+
       --build-options bool
           Prompt for one-time build options defined with ephemeral parameters.
 
+      --parameter string-array, $CODER_RICH_PARAMETER
+          Rich parameter value in the format "name=value".
+
       --rich-parameter-file string, $CODER_RICH_PARAMETER_FILE
           Specify a file path with values for rich parameters defined in the
           template.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_users_--help.golden b/cli/testdata/coder_users_--help.golden
index d4774b4406022..338fea4febc86 100644
--- a/cli/testdata/coder_users_--help.golden
+++ b/cli/testdata/coder_users_--help.golden
@@ -1,18 +1,22 @@
-Usage: coder users [subcommand]
+coder v0.0.0-devel
 
-Manage users
+USAGE:
+  coder users [subcommand]
 
-Aliases: user
+  Manage users
 
-Subcommands
+  Aliases: user
+
+SUBCOMMANDS:
     activate    Update a user's status to 'active'. Active users can fully
                 interact with the platform
     create      
+    delete      Delete a user by username or user_id.
     list        
     show        Show a single user. Use 'me' to indicate the currently
                 authenticated user.
     suspend     Update a user's status to 'suspended'. A suspended user cannot
                 log into the platform
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_users_activate_--help.golden b/cli/testdata/coder_users_activate_--help.golden
index 2d76f7257242e..471fdd195d50d 100644
--- a/cli/testdata/coder_users_activate_--help.golden
+++ b/cli/testdata/coder_users_activate_--help.golden
@@ -1,15 +1,18 @@
-Usage: coder users activate [flags] <username|user_id>
+coder v0.0.0-devel
 
-Update a user's status to 'active'. Active users can fully interact with the
-platform
+USAGE:
+  coder users activate [flags] <username|user_id>
 
-Aliases: active
+  Update a user's status to 'active'. Active users can fully interact with the
+  platform
 
- $ coder users activate example_user 
+  Aliases: active
 
-Options
+   $ coder users activate example_user
+
+OPTIONS:
   -c, --column string-array (default: username,email,created_at,status)
           Specify a column to filter in the table.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_users_create_--help.golden b/cli/testdata/coder_users_create_--help.golden
index bb94cac633bc0..5216e00f3467b 100644
--- a/cli/testdata/coder_users_create_--help.golden
+++ b/cli/testdata/coder_users_create_--help.golden
@@ -1,20 +1,23 @@
-Usage: coder users create [flags]
+coder v0.0.0-devel
 
-Options
-      --disable-login bool
-          Disabling login for a user prevents the user from authenticating via
-          password or IdP login. Authentication requires an API key/token
-          generated by an admin. Be careful when using this flag as it can lock
-          the user out of their account.
+USAGE:
+  coder users create [flags]
 
+OPTIONS:
   -e, --email string
           Specifies an email address for the new user.
 
+      --login-type string
+          Optionally specify the login type for the user. Valid values are:
+          password, none, github, oidc. Using 'none' prevents the user from
+          authenticating and requires an API key/token to be generated by an
+          admin.
+
   -p, --password string
           Specifies a password for the new user.
 
   -u, --username string
           Specifies a username for the new user.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_users_delete_--help.golden b/cli/testdata/coder_users_delete_--help.golden
new file mode 100644
index 0000000000000..a8494101ab6d5
--- /dev/null
+++ b/cli/testdata/coder_users_delete_--help.golden
@@ -0,0 +1,11 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder users delete <username|user_id>
+
+  Delete a user by username or user_id.
+
+  Aliases: rm
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_users_list_--help.golden b/cli/testdata/coder_users_list_--help.golden
index 7b10f2da5df57..de9d3c2d2840d 100644
--- a/cli/testdata/coder_users_list_--help.golden
+++ b/cli/testdata/coder_users_list_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder users list [flags]
+coder v0.0.0-devel
 
-Aliases: ls
+USAGE:
+  coder users list [flags]
 
-Options
+  Aliases: ls
+
+OPTIONS:
   -c, --column string-array (default: username,email,created_at,status)
           Columns to display in table output. Available columns: id, username,
           email, created at, status.
@@ -10,5 +13,5 @@ Aliases: ls
   -o, --output string (default: table)
           Output format. Available formats: table, json.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_users_show_--help.golden b/cli/testdata/coder_users_show_--help.golden
index 2d20c844dd5f6..9340c0ac1c973 100644
--- a/cli/testdata/coder_users_show_--help.golden
+++ b/cli/testdata/coder_users_show_--help.golden
@@ -1,12 +1,15 @@
-Usage: coder users show [flags] <username|user_id|'me'>
+coder v0.0.0-devel
 
-Show a single user. Use 'me' to indicate the currently authenticated user.
+USAGE:
+  coder users show [flags] <username|user_id|'me'>
 
- $ coder users show me 
+  Show a single user. Use 'me' to indicate the currently authenticated user.
 
-Options
+   $ coder users show me
+
+OPTIONS:
   -o, --output string (default: table)
           Output format. Available formats: table, json.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_users_suspend_--help.golden b/cli/testdata/coder_users_suspend_--help.golden
index b5abb4a2c908e..8b706e92d6d7a 100644
--- a/cli/testdata/coder_users_suspend_--help.golden
+++ b/cli/testdata/coder_users_suspend_--help.golden
@@ -1,15 +1,16 @@
-Usage: coder users suspend [flags] <username|user_id>
+coder v0.0.0-devel
 
-Update a user's status to 'suspended'. A suspended user cannot log into the
-platform
+USAGE:
+  coder users suspend [flags] <username|user_id>
 
-Aliases: rm, delete
+  Update a user's status to 'suspended'. A suspended user cannot log into the
+  platform
 
- $ coder users suspend example_user 
+   $ coder users suspend example_user
 
-Options
+OPTIONS:
   -c, --column string-array (default: username,email,created_at,status)
           Specify a column to filter in the table.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_version_--help.golden b/cli/testdata/coder_version_--help.golden
index 4fa4b6b2c5561..ec14e8a6a8222 100644
--- a/cli/testdata/coder_version_--help.golden
+++ b/cli/testdata/coder_version_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder version [flags]
+coder v0.0.0-devel
 
-Show coder version
+USAGE:
+  coder version [flags]
 
-Options
+  Show coder version
+
+OPTIONS:
   -o, --output string (default: text)
           Output format. Available formats: text, json.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/server-config.yaml.golden b/cli/testdata/server-config.yaml.golden
index c7a8df03414e6..31304d68e1633 100644
--- a/cli/testdata/server-config.yaml.golden
+++ b/cli/testdata/server-config.yaml.golden
@@ -111,11 +111,20 @@ networking:
     # Region name that for the embedded DERP server.
     # (default: Coder Embedded Relay, type: string)
     regionName: Coder Embedded Relay
-    # Addresses for STUN servers to establish P2P connections. Use special value
-    # 'disable' to turn off STUN.
-    # (default: stun.l.google.com:19302, type: string-array)
+    # Addresses for STUN servers to establish P2P connections. It's recommended to
+    # have at least two STUN servers to give users the best chance of connecting P2P
+    # to workspaces. Each STUN server will get it's own DERP region, with region IDs
+    # starting at `--derp-server-region-id + 1`. Use special value 'disable' to turn
+    # off STUN completely.
+    # (default:
+    # stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302,stun3.l.google.com:19302,stun4.l.google.com:19302,
+    # type: string-array)
     stunAddresses:
       - stun.l.google.com:19302
+      - stun1.l.google.com:19302
+      - stun2.l.google.com:19302
+      - stun3.l.google.com:19302
+      - stun4.l.google.com:19302
     # An HTTP URL that is accessible by other replicas to relay DERP traffic. Required
     # for high availability.
     # (default: <unset>, type: url)
@@ -127,6 +136,12 @@ networking:
     # this change has been made, but new connections will still be proxied regardless.
     # (default: <unset>, type: bool)
     blockDirect: false
+    # Force clients and agents to always use WebSocket to connect to DERP relay
+    # servers. By default, DERP uses `Upgrade: derp`, which may cause issues with some
+    # reverse proxies. Clients may automatically fallback to WebSocket if they detect
+    # an issue with `Upgrade: derp`, but this does not work in all situations.
+    # (default: <unset>, type: bool)
+    forceWebSockets: false
     # URL to fetch a DERP mapping on startup. See:
     # https://tailscale.com/kb/1118/custom-derp-servers/.
     # (default: <unset>, type: string)
@@ -186,6 +201,9 @@ introspection:
     # which may incur significant costs.
     # (default: <unset>, type: bool)
     captureLogs: false
+    # Enables sending Go runtime traces to the local DataDog agent.
+    # (default: false, type: bool)
+    dataDog: false
   logging:
     # Output debug-level logs.
     # (default: <unset>, type: bool)
@@ -235,6 +253,15 @@ oidc:
   # Client ID to use for Login with OIDC.
   # (default: <unset>, type: string)
   clientID: ""
+  # Pem encoded RSA private key to use for oauth2 PKI/JWT authorization. This can be
+  # used instead of oidc-client-secret if your IDP supports it.
+  # (default: <unset>, type: string)
+  oidcClientKeyFile: ""
+  # Pem encoded certificate file to use for oauth2 PKI/JWT authorization. The public
+  # certificate that accompanies oidc-client-key-file. A standard x509 certificate
+  # is expected.
+  # (default: <unset>, type: string)
+  oidcClientCertFile: ""
   # Email domains that clients logging in with OIDC must match.
   # (default: <unset>, type: string-array)
   emailDomain: []
@@ -271,6 +298,14 @@ oidc:
   # for when OIDC providers only return group IDs.
   # (default: {}, type: struct[map[string]string])
   groupMapping: {}
+  # Automatically creates missing groups from a user's groups claim.
+  # (default: false, type: bool)
+  enableGroupAutoCreate: false
+  # If provided any group name not matching the regex is ignored. This allows for
+  # filtering out groups that are not needed. This filter is applied after the group
+  # mapping.
+  # (default: .*, type: regexp)
+  groupRegexFilter: .*
   # This field must be set if using the user roles sync feature. Set this to the
   # name of the claim used to store the user's role. The roles should be sent as an
   # array of strings.
@@ -288,7 +323,7 @@ oidc:
   # The text to show on the OpenID Connect sign in button.
   # (default: OpenID Connect, type: string)
   signInText: OpenID Connect
-  # URL pointing to the icon to use on the OepnID Connect login button.
+  # URL pointing to the icon to use on the OpenID Connect login button.
   # (default: <unset>, type: url)
   iconURL:
 # Telemetry is critical to our ability to improve Coder. We strip all personal
@@ -299,11 +334,6 @@ telemetry:
   # help improve our product.
   # (default: false, type: bool)
   enable: false
-  # Whether Opentelemetry traces are sent to Coder. Coder collects anonymized
-  # application tracing to help improve our product. Disabling telemetry also
-  # disables this option.
-  # (default: false, type: bool)
-  trace: false
   # URL to send telemetry.
   # (default: https://telemetry.coder.com, type: url)
   url: https://telemetry.coder.com
@@ -318,15 +348,18 @@ provisioning:
   # tests.
   # (default: false, type: bool)
   daemonsEcho: false
-  # Time to wait before polling for a new job.
+  # Deprecated and ignored.
   # (default: 1s, type: duration)
   daemonPollInterval: 1s
-  # Random jitter added to the poll interval.
+  # Deprecated and ignored.
   # (default: 100ms, type: duration)
   daemonPollJitter: 100ms
   # Time to force cancel provisioning tasks that are stuck.
   # (default: 10m0s, type: duration)
   forceCancelInterval: 10m0s
+  # Pre-shared key to authenticate external provisioner daemons to Coder server.
+  # (default: <unset>, type: string)
+  daemonPSK: ""
 # Enable one or more experiments. These are not ready for production. Separate
 # multiple experiments with commas, or enter '*' to opt-in to all available
 # experiments.
@@ -378,6 +411,10 @@ client:
   # incorrectly can break SSH to your deployment, use cautiously.
   # (default: <unset>, type: string-array)
   sshConfigOptions: []
+  # The renderer to use when opening a web terminal. Valid values are 'canvas',
+  # 'webgl', or 'dom'.
+  # (default: canvas, type: string)
+  webTerminalRenderer: canvas
 # Support links to display in the top right drop down menu.
 # (default: <unset>, type: struct[[]codersdk.LinkConfig])
 supportLinks: []
diff --git a/cli/tokens.go b/cli/tokens.go
index 1f34287c4e9a3..579a15fc5f1fe 100644
--- a/cli/tokens.go
+++ b/cli/tokens.go
@@ -8,9 +8,9 @@ import (
 	"golang.org/x/exp/slices"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) tokens() *clibase.Cmd {
diff --git a/cli/tokens_test.go b/cli/tokens_test.go
index f31dd847e0396..fdb062b959a3b 100644
--- a/cli/tokens_test.go
+++ b/cli/tokens_test.go
@@ -8,10 +8,10 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestTokens(t *testing.T) {
diff --git a/cli/update.go b/cli/update.go
index 64710217bb996..cdff4b4a8df26 100644
--- a/cli/update.go
+++ b/cli/update.go
@@ -3,14 +3,15 @@ package cli
 import (
 	"fmt"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/codersdk"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) update() *clibase.Cmd {
 	var (
-		richParameterFile string
-		alwaysPrompt      bool
+		alwaysPrompt bool
 
 		parameterFlags workspaceParameterFlags
 	)
@@ -30,33 +31,45 @@ func (r *RootCmd) update() *clibase.Cmd {
 			if err != nil {
 				return err
 			}
-			if !workspace.Outdated && !alwaysPrompt && !parameterFlags.buildOptions {
+			if !workspace.Outdated && !alwaysPrompt && !parameterFlags.promptBuildOptions && len(parameterFlags.buildOptions) == 0 {
 				_, _ = fmt.Fprintf(inv.Stdout, "Workspace isn't outdated!\n")
 				return nil
 			}
+
+			buildOptions, err := asWorkspaceBuildParameters(parameterFlags.buildOptions)
+			if err != nil {
+				return err
+			}
+
 			template, err := client.Template(inv.Context(), workspace.TemplateID)
 			if err != nil {
 				return err
 			}
 
-			var existingRichParams []codersdk.WorkspaceBuildParameter
-			if !alwaysPrompt {
-				existingRichParams, err = client.WorkspaceBuildParameters(inv.Context(), workspace.LatestBuild.ID)
-				if err != nil {
-					return err
-				}
+			lastBuildParameters, err := client.WorkspaceBuildParameters(inv.Context(), workspace.LatestBuild.ID)
+			if err != nil {
+				return err
+			}
+
+			cliRichParameters, err := asWorkspaceBuildParameters(parameterFlags.richParameters)
+			if err != nil {
+				return xerrors.Errorf("can't parse given parameter values: %w", err)
 			}
 
-			buildParams, err := prepWorkspaceBuild(inv, client, prepWorkspaceBuildArgs{
-				Template:           template,
-				ExistingRichParams: existingRichParams,
-				RichParameterFile:  richParameterFile,
-				NewWorkspaceName:   workspace.Name,
+			buildParameters, err := prepWorkspaceBuild(inv, client, prepWorkspaceBuildArgs{
+				Action:           WorkspaceUpdate,
+				Template:         template,
+				NewWorkspaceName: workspace.Name,
+				WorkspaceID:      workspace.LatestBuild.ID,
 
-				UpdateWorkspace: true,
-				WorkspaceID:     workspace.LatestBuild.ID,
+				LastBuildParameters: lastBuildParameters,
 
-				BuildOptions: parameterFlags.buildOptions,
+				PromptBuildOptions: parameterFlags.promptBuildOptions,
+				BuildOptions:       buildOptions,
+
+				PromptRichParameters: alwaysPrompt,
+				RichParameters:       cliRichParameters,
+				RichParameterFile:    parameterFlags.richParameterFile,
 			})
 			if err != nil {
 				return err
@@ -65,7 +78,7 @@ func (r *RootCmd) update() *clibase.Cmd {
 			build, err := client.CreateWorkspaceBuild(inv.Context(), workspace.ID, codersdk.CreateWorkspaceBuildRequest{
 				TemplateVersionID:   template.ActiveVersionID,
 				Transition:          codersdk.WorkspaceTransitionStart,
-				RichParameterValues: buildParams.richParameters,
+				RichParameterValues: buildParameters,
 			})
 			if err != nil {
 				return err
@@ -92,13 +105,8 @@ func (r *RootCmd) update() *clibase.Cmd {
 			Description: "Always prompt all parameters. Does not pull parameter values from existing workspace.",
 			Value:       clibase.BoolOf(&alwaysPrompt),
 		},
-		{
-			Flag:        "rich-parameter-file",
-			Description: "Specify a file path with values for rich parameters defined in the template.",
-			Env:         "CODER_RICH_PARAMETER_FILE",
-			Value:       clibase.StringOf(&richParameterFile),
-		},
 	}
-	cmd.Options = append(cmd.Options, parameterFlags.options()...)
+	cmd.Options = append(cmd.Options, parameterFlags.cliBuildOptions()...)
+	cmd.Options = append(cmd.Options, parameterFlags.cliParameters()...)
 	return cmd
 }
diff --git a/cli/update_test.go b/cli/update_test.go
index 886adf9bea264..ce81807b21669 100644
--- a/cli/update_test.go
+++ b/cli/update_test.go
@@ -9,14 +9,14 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestUpdate(t *testing.T) {
@@ -35,32 +35,33 @@ func TestUpdate(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version1 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, memberUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version1 := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
 
-		coderdtest.AwaitTemplateVersionJob(t, client, version1.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version1.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version1.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version1.ID)
 
 		inv, root := clitest.New(t, "create",
 			"my-workspace",
 			"--template", template.Name,
 			"-y",
 		)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 
 		err := inv.Run()
 		require.NoError(t, err)
 
-		ws, err := client.WorkspaceByOwnerAndName(context.Background(), "testuser", "my-workspace", codersdk.WorkspaceOptions{})
+		ws, err := client.WorkspaceByOwnerAndName(context.Background(), memberUser.Username, "my-workspace", codersdk.WorkspaceOptions{})
 		require.NoError(t, err)
 		require.Equal(t, version1.ID.String(), ws.LatestBuild.TemplateVersionID.String())
 
-		version2 := coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+		version2 := coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionApply: echo.ProvisionComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
+			ProvisionApply: echo.ApplyComplete,
+			ProvisionPlan:  echo.PlanComplete,
 		}, template.ID)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version2.ID)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version2.ID)
 
 		err = client.UpdateActiveTemplateVersion(context.Background(), template.ID, codersdk.UpdateActiveTemplateVersion{
 			ID: version2.ID,
@@ -68,12 +69,12 @@ func TestUpdate(t *testing.T) {
 		require.NoError(t, err)
 
 		inv, root = clitest.New(t, "update", ws.Name)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 
 		err = inv.Run()
 		require.NoError(t, err)
 
-		ws, err = client.WorkspaceByOwnerAndName(context.Background(), "testuser", "my-workspace", codersdk.WorkspaceOptions{})
+		ws, err = member.WorkspaceByOwnerAndName(context.Background(), memberUser.Username, "my-workspace", codersdk.WorkspaceOptions{})
 		require.NoError(t, err)
 		require.Equal(t, version2.ID.String(), ws.LatestBuild.TemplateVersionID.String())
 	})
@@ -100,38 +101,24 @@ func TestUpdateWithRichParameters(t *testing.T) {
 		immutableParameterValue       = "4"
 	)
 
-	echoResponses := &echo.Responses{
-		Parse: echo.ParseComplete,
-		ProvisionPlan: []*proto.Provision_Response{
-			{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Parameters: []*proto.RichParameter{
-							{Name: firstParameterName, Description: firstParameterDescription, Mutable: true},
-							{Name: immutableParameterName, Description: immutableParameterDescription, Mutable: false},
-							{Name: secondParameterName, Description: secondParameterDescription, Mutable: true},
-							{Name: ephemeralParameterName, Description: ephemeralParameterDescription, Mutable: true, Ephemeral: true},
-						},
-					},
-				},
-			},
-		},
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{},
-			},
-		}},
-	}
+	echoResponses := prepareEchoResponses([]*proto.RichParameter{
+		{Name: firstParameterName, Description: firstParameterDescription, Mutable: true},
+		{Name: immutableParameterName, Description: immutableParameterDescription, Mutable: false},
+		{Name: secondParameterName, Description: secondParameterDescription, Mutable: true},
+		{Name: ephemeralParameterName, Description: ephemeralParameterDescription, Mutable: true, Ephemeral: true},
+	},
+	)
 
 	t.Run("ImmutableCannotBeCustomized", func(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, echoResponses)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		tempDir := t.TempDir()
 		removeTmpDirUntilSuccessAfterTest(t, tempDir)
@@ -142,12 +129,12 @@ func TestUpdateWithRichParameters(t *testing.T) {
 				secondParameterName + ": " + secondParameterValue)
 
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name, "--rich-parameter-file", parameterFile.Name(), "-y")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		err := inv.Run()
 		assert.NoError(t, err)
 
 		inv, root = clitest.New(t, "update", "my-workspace", "--always-prompt")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
@@ -159,7 +146,7 @@ func TestUpdateWithRichParameters(t *testing.T) {
 
 		matches := []string{
 			firstParameterDescription, firstParameterValue,
-			fmt.Sprintf("Parameter %q is not mutable, so can't be customized after workspace creation.", immutableParameterName), "",
+			fmt.Sprintf("Parameter %q is not mutable, and cannot be customized after workspace creation.", immutableParameterName), "",
 			secondParameterDescription, secondParameterValue,
 		}
 		for i := 0; i < len(matches); i += 2 {
@@ -177,11 +164,12 @@ func TestUpdateWithRichParameters(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, echoResponses)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, memberUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		tempDir := t.TempDir()
 		removeTmpDirUntilSuccessAfterTest(t, tempDir)
@@ -194,12 +182,12 @@ func TestUpdateWithRichParameters(t *testing.T) {
 		const workspaceName = "my-workspace"
 
 		inv, root := clitest.New(t, "create", workspaceName, "--template", template.Name, "--rich-parameter-file", parameterFile.Name(), "-y")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		err := inv.Run()
 		assert.NoError(t, err)
 
 		inv, root = clitest.New(t, "update", workspaceName, "--build-options")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
@@ -227,7 +215,57 @@ func TestUpdateWithRichParameters(t *testing.T) {
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
 		defer cancel()
 
-		workspace, err := client.WorkspaceByOwnerAndName(ctx, user.UserID.String(), workspaceName, codersdk.WorkspaceOptions{})
+		workspace, err := client.WorkspaceByOwnerAndName(ctx, memberUser.ID.String(), workspaceName, codersdk.WorkspaceOptions{})
+		require.NoError(t, err)
+		actualParameters, err := client.WorkspaceBuildParameters(ctx, workspace.LatestBuild.ID)
+		require.NoError(t, err)
+		require.Contains(t, actualParameters, codersdk.WorkspaceBuildParameter{
+			Name:  ephemeralParameterName,
+			Value: ephemeralParameterValue,
+		})
+	})
+
+	t.Run("BuildOptionFlags", func(t *testing.T) {
+		t.Parallel()
+
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, memberUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, echoResponses)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+
+		const workspaceName = "my-workspace"
+
+		inv, root := clitest.New(t, "create", workspaceName, "--template", template.Name, "-y",
+			"--parameter", fmt.Sprintf("%s=%s", firstParameterName, firstParameterValue),
+			"--parameter", fmt.Sprintf("%s=%s", immutableParameterName, immutableParameterValue),
+			"--parameter", fmt.Sprintf("%s=%s", secondParameterName, secondParameterValue))
+		clitest.SetupConfig(t, member, root)
+		err := inv.Run()
+		assert.NoError(t, err)
+
+		inv, root = clitest.New(t, "update", workspaceName,
+			"--build-option", fmt.Sprintf("%s=%s", ephemeralParameterName, ephemeralParameterValue))
+		clitest.SetupConfig(t, member, root)
+
+		doneChan := make(chan struct{})
+		pty := ptytest.New(t).Attach(inv)
+		go func() {
+			defer close(doneChan)
+			err := inv.Run()
+			assert.NoError(t, err)
+		}()
+
+		pty.ExpectMatch("Planning workspace")
+		<-doneChan
+
+		// Verify if build option is set
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+
+		workspace, err := client.WorkspaceByOwnerAndName(ctx, memberUser.ID.String(), workspaceName, codersdk.WorkspaceOptions{})
 		require.NoError(t, err)
 		actualParameters, err := client.WorkspaceBuildParameters(ctx, workspace.LatestBuild.ID)
 		require.NoError(t, err)
@@ -264,36 +302,15 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 		{Name: boolParameterName, Type: "bool", Mutable: true},
 	}
 
-	prepareEchoResponses := func(richParameters []*proto.RichParameter) *echo.Responses {
-		return &echo.Responses{
-			Parse: echo.ParseComplete,
-			ProvisionPlan: []*proto.Provision_Response{
-				{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
-							Parameters: richParameters,
-						},
-					},
-				},
-			},
-			ProvisionApply: []*proto.Provision_Response{
-				{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{},
-					},
-				},
-			},
-		}
-	}
-
 	t.Run("ValidateString", func(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(stringRichParameters))
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(stringRichParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		tempDir := t.TempDir()
 		removeTmpDirUntilSuccessAfterTest(t, tempDir)
@@ -302,12 +319,12 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 			stringParameterName + ": " + stringParameterValue)
 
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name, "--rich-parameter-file", parameterFile.Name(), "-y")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		err := inv.Run()
 		require.NoError(t, err)
 
 		inv, root = clitest.New(t, "update", "my-workspace", "--always-prompt")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -334,11 +351,12 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(numberRichParameters))
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(numberRichParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		tempDir := t.TempDir()
 		removeTmpDirUntilSuccessAfterTest(t, tempDir)
@@ -347,12 +365,12 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 			numberParameterName + ": " + numberParameterValue)
 
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name, "--rich-parameter-file", parameterFile.Name(), "-y")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		err := inv.Run()
 		require.NoError(t, err)
 
 		inv, root = clitest.New(t, "update", "my-workspace", "--always-prompt")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -382,11 +400,12 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(boolRichParameters))
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(boolRichParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		tempDir := t.TempDir()
 		removeTmpDirUntilSuccessAfterTest(t, tempDir)
@@ -395,12 +414,12 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 			boolParameterName + ": " + boolParameterValue)
 
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name, "--rich-parameter-file", parameterFile.Name(), "-y")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		err := inv.Run()
 		require.NoError(t, err)
 
 		inv, root = clitest.New(t, "update", "my-workspace", "--always-prompt")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -427,12 +446,13 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
 		// Upload the initial template
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(stringRichParameters))
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(stringRichParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		tempDir := t.TempDir()
 		removeTmpDirUntilSuccessAfterTest(t, tempDir)
@@ -442,7 +462,7 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 
 		// Create workspace
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name, "--rich-parameter-file", parameterFile.Name(), "-y")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		err := inv.Run()
 		require.NoError(t, err)
 
@@ -457,8 +477,8 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 			Mutable:  true,
 			Required: true,
 		})
-		version = coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(modifiedParameters), template.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		version = coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(modifiedParameters), template.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		err = client.UpdateActiveTemplateVersion(context.Background(), template.ID, codersdk.UpdateActiveTemplateVersion{
 			ID: version.ID,
 		})
@@ -466,7 +486,7 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 
 		// Update the workspace
 		inv, root = clitest.New(t, "update", "my-workspace")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -495,12 +515,13 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
 		// Upload the initial template
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(stringRichParameters))
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(stringRichParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		tempDir := t.TempDir()
 		removeTmpDirUntilSuccessAfterTest(t, tempDir)
@@ -510,7 +531,7 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 
 		// Create workspace
 		inv, root := clitest.New(t, "create", "my-workspace", "--template", template.Name, "--rich-parameter-file", parameterFile.Name(), "-y")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
 		err := inv.Run()
 		require.NoError(t, err)
 
@@ -526,8 +547,8 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 			DefaultValue: "foobar",
 			Required:     false,
 		})
-		version = coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(modifiedParameters), template.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		version = coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(modifiedParameters), template.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		err = client.UpdateActiveTemplateVersion(context.Background(), template.ID, codersdk.UpdateActiveTemplateVersion{
 			ID: version.ID,
 		})
@@ -535,7 +556,64 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 
 		// Update the workspace
 		inv, root = clitest.New(t, "update", "my-workspace")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, member, root)
+		doneChan := make(chan struct{})
+		pty := ptytest.New(t).Attach(inv)
+		go func() {
+			defer close(doneChan)
+			err := inv.Run()
+			assert.NoError(t, err)
+		}()
+
+		pty.ExpectMatch("Planning workspace...")
+		<-doneChan
+	})
+
+	t.Run("ParameterOptionChanged", func(t *testing.T) {
+		t.Parallel()
+
+		// Create template and workspace
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		user := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
+
+		templateParameters := []*proto.RichParameter{
+			{Name: stringParameterName, Type: "string", Mutable: true, Required: true, Options: []*proto.RichParameterOption{
+				{Name: "First option", Description: "This is first option", Value: "1st"},
+				{Name: "Second option", Description: "This is second option", Value: "2nd"},
+				{Name: "Third option", Description: "This is third option", Value: "3rd"},
+			}},
+		}
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(templateParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+
+		// Create new workspace
+		inv, root := clitest.New(t, "create", "my-workspace", "--yes", "--template", template.Name, "--parameter", fmt.Sprintf("%s=%s", stringParameterName, "2nd"))
+		clitest.SetupConfig(t, member, root)
+		err := inv.Run()
+		require.NoError(t, err)
+
+		// Update template
+		updatedTemplateParameters := []*proto.RichParameter{
+			// The order of rich parameter options must be maintained because `cliui.Select` automatically selects the first option during tests.
+			{Name: stringParameterName, Type: "string", Mutable: true, Required: true, Options: []*proto.RichParameterOption{
+				{Name: "first_option", Description: "This is first option", Value: "1"},
+				{Name: "second_option", Description: "This is second option", Value: "2"},
+				{Name: "third_option", Description: "This is third option", Value: "3"},
+			}},
+		}
+
+		updatedVersion := coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, prepareEchoResponses(updatedTemplateParameters), template.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, updatedVersion.ID)
+		err = client.UpdateActiveTemplateVersion(context.Background(), template.ID, codersdk.UpdateActiveTemplateVersion{
+			ID: updatedVersion.ID,
+		})
+		require.NoError(t, err)
+
+		// Update the workspace
+		inv, root = clitest.New(t, "update", "my-workspace")
+		clitest.SetupConfig(t, member, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -545,15 +623,226 @@ func TestUpdateValidateRichParameters(t *testing.T) {
 		}()
 
 		matches := []string{
-			"added_parameter", "",
-			`Enter a value (default: "foobar")`, "abc",
+			// `cliui.Select` will automatically pick the first option
+			"Planning workspace...", "",
 		}
 		for i := 0; i < len(matches); i += 2 {
 			match := matches[i]
 			value := matches[i+1]
 			pty.ExpectMatch(match)
-			pty.WriteLine(value)
+
+			if value != "" {
+				pty.WriteLine(value)
+			}
+		}
+
+		<-doneChan
+	})
+
+	t.Run("ParameterOptionDisappeared", func(t *testing.T) {
+		t.Parallel()
+
+		// Create template and workspace
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		templateParameters := []*proto.RichParameter{
+			{Name: stringParameterName, Type: "string", Mutable: true, Required: true, Options: []*proto.RichParameterOption{
+				{Name: "First option", Description: "This is first option", Value: "1st"},
+				{Name: "Second option", Description: "This is second option", Value: "2nd"},
+				{Name: "Third option", Description: "This is third option", Value: "3rd"},
+			}},
+		}
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(templateParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+
+		// Create new workspace
+		inv, root := clitest.New(t, "create", "my-workspace", "--yes", "--template", template.Name, "--parameter", fmt.Sprintf("%s=%s", stringParameterName, "2nd"))
+		clitest.SetupConfig(t, member, root)
+		ptytest.New(t).Attach(inv)
+		err := inv.Run()
+		require.NoError(t, err)
+
+		// Update template - 2nd option disappeared, 4th option added
+		updatedTemplateParameters := []*proto.RichParameter{
+			// The order of rich parameter options must be maintained because `cliui.Select` automatically selects the first option during tests.
+			{Name: stringParameterName, Type: "string", Mutable: true, Required: true, Options: []*proto.RichParameterOption{
+				{Name: "Third option", Description: "This is third option", Value: "3rd"},
+				{Name: "First option", Description: "This is first option", Value: "1st"},
+				{Name: "Fourth option", Description: "This is fourth option", Value: "4th"},
+			}},
+		}
+
+		updatedVersion := coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(updatedTemplateParameters), template.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, updatedVersion.ID)
+		err = client.UpdateActiveTemplateVersion(context.Background(), template.ID, codersdk.UpdateActiveTemplateVersion{
+			ID: updatedVersion.ID,
+		})
+		require.NoError(t, err)
+
+		// Update the workspace
+		inv, root = clitest.New(t, "update", "my-workspace")
+		clitest.SetupConfig(t, member, root)
+		doneChan := make(chan struct{})
+		pty := ptytest.New(t).Attach(inv)
+		go func() {
+			defer close(doneChan)
+			err := inv.Run()
+			assert.NoError(t, err)
+		}()
+
+		matches := []string{
+			// `cliui.Select` will automatically pick the first option
+			"Planning workspace...", "",
+		}
+		for i := 0; i < len(matches); i += 2 {
+			match := matches[i]
+			value := matches[i+1]
+			pty.ExpectMatch(match)
+
+			if value != "" {
+				pty.WriteLine(value)
+			}
+		}
+
+		<-doneChan
+	})
+
+	t.Run("ImmutableRequiredParameterExists_MutableRequiredParameterAdded", func(t *testing.T) {
+		t.Parallel()
+
+		// Create template and workspace
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		templateParameters := []*proto.RichParameter{
+			{Name: stringParameterName, Type: "string", Mutable: false, Required: true, Options: []*proto.RichParameterOption{
+				{Name: "First option", Description: "This is first option", Value: "1st"},
+				{Name: "Second option", Description: "This is second option", Value: "2nd"},
+				{Name: "Third option", Description: "This is third option", Value: "3rd"},
+			}},
 		}
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(templateParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+
+		inv, root := clitest.New(t, "create", "my-workspace", "--yes", "--template", template.Name, "--parameter", fmt.Sprintf("%s=%s", stringParameterName, "2nd"))
+		clitest.SetupConfig(t, member, root)
+		err := inv.Run()
+		require.NoError(t, err)
+
+		// Update template: add required, mutable parameter
+		const mutableParameterName = "foobar"
+		updatedTemplateParameters := []*proto.RichParameter{
+			templateParameters[0],
+			{Name: mutableParameterName, Type: "string", Mutable: true, Required: true},
+		}
+
+		updatedVersion := coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(updatedTemplateParameters), template.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, updatedVersion.ID)
+		err = client.UpdateActiveTemplateVersion(context.Background(), template.ID, codersdk.UpdateActiveTemplateVersion{
+			ID: updatedVersion.ID,
+		})
+		require.NoError(t, err)
+
+		// Update the workspace
+		inv, root = clitest.New(t, "update", "my-workspace")
+		clitest.SetupConfig(t, member, root)
+		doneChan := make(chan struct{})
+		pty := ptytest.New(t).Attach(inv)
+		go func() {
+			defer close(doneChan)
+			err := inv.Run()
+			assert.NoError(t, err)
+		}()
+
+		matches := []string{
+			mutableParameterName, "hello",
+			"Planning workspace...", "",
+		}
+		for i := 0; i < len(matches); i += 2 {
+			match := matches[i]
+			value := matches[i+1]
+			pty.ExpectMatch(match)
+
+			if value != "" {
+				pty.WriteLine(value)
+			}
+		}
+
+		<-doneChan
+	})
+
+	t.Run("MutableRequiredParameterExists_ImmutableRequiredParameterAdded", func(t *testing.T) {
+		t.Parallel()
+
+		// Create template and workspace
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		templateParameters := []*proto.RichParameter{
+			{Name: stringParameterName, Type: "string", Mutable: true, Required: true, Options: []*proto.RichParameterOption{
+				{Name: "First option", Description: "This is first option", Value: "1st"},
+				{Name: "Second option", Description: "This is second option", Value: "2nd"},
+				{Name: "Third option", Description: "This is third option", Value: "3rd"},
+			}},
+		}
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(templateParameters))
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+
+		inv, root := clitest.New(t, "create", "my-workspace", "--yes", "--template", template.Name, "--parameter", fmt.Sprintf("%s=%s", stringParameterName, "2nd"))
+		clitest.SetupConfig(t, member, root)
+		err := inv.Run()
+		require.NoError(t, err)
+
+		// Update template: add required, immutable parameter
+		updatedTemplateParameters := []*proto.RichParameter{
+			templateParameters[0],
+			// The order of rich parameter options must be maintained because `cliui.Select` automatically selects the first option during tests.
+			{Name: immutableParameterName, Type: "string", Mutable: false, Required: true, Options: []*proto.RichParameterOption{
+				{Name: "thi", Description: "This is third option for immutable parameter", Value: "III"},
+				{Name: "fir", Description: "This is first option for immutable parameter", Value: "I"},
+				{Name: "sec", Description: "This is second option for immutable parameter", Value: "II"},
+			}},
+		}
+
+		updatedVersion := coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, prepareEchoResponses(updatedTemplateParameters), template.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, updatedVersion.ID)
+		err = client.UpdateActiveTemplateVersion(context.Background(), template.ID, codersdk.UpdateActiveTemplateVersion{
+			ID: updatedVersion.ID,
+		})
+		require.NoError(t, err)
+
+		// Update the workspace
+		inv, root = clitest.New(t, "update", "my-workspace")
+		clitest.SetupConfig(t, member, root)
+		doneChan := make(chan struct{})
+		pty := ptytest.New(t).Attach(inv)
+		go func() {
+			defer close(doneChan)
+			err := inv.Run()
+			assert.NoError(t, err)
+		}()
+
+		matches := []string{
+			// `cliui.Select` will automatically pick the first option
+			"Planning workspace...", "",
+		}
+		for i := 0; i < len(matches); i += 2 {
+			match := matches[i]
+			value := matches[i+1]
+			pty.ExpectMatch(match)
+
+			if value != "" {
+				pty.WriteLine(value)
+			}
+		}
+
 		<-doneChan
 	})
 }
diff --git a/cli/user_delete_test.go b/cli/user_delete_test.go
new file mode 100644
index 0000000000000..9ee546ca7a925
--- /dev/null
+++ b/cli/user_delete_test.go
@@ -0,0 +1,163 @@
+package cli_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/pty/ptytest"
+)
+
+func TestUserDelete(t *testing.T) {
+	t.Parallel()
+	t.Run("Username", func(t *testing.T) {
+		t.Parallel()
+		ctx := context.Background()
+		client := coderdtest.New(t, nil)
+		owner := coderdtest.CreateFirstUser(t, client)
+		userAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleUserAdmin())
+
+		pw, err := cryptorand.String(16)
+		require.NoError(t, err)
+
+		_, err = client.CreateUser(ctx, codersdk.CreateUserRequest{
+			Email:          "colin5@coder.com",
+			Username:       "coolin",
+			Password:       pw,
+			UserLoginType:  codersdk.LoginTypePassword,
+			OrganizationID: owner.OrganizationID,
+			DisableLogin:   false,
+		})
+		require.NoError(t, err)
+
+		inv, root := clitest.New(t, "users", "delete", "coolin")
+		clitest.SetupConfig(t, userAdmin, root)
+		pty := ptytest.New(t).Attach(inv)
+		errC := make(chan error)
+		go func() {
+			errC <- inv.Run()
+		}()
+		require.NoError(t, <-errC)
+		pty.ExpectMatch("coolin")
+	})
+
+	t.Run("UserID", func(t *testing.T) {
+		t.Parallel()
+		ctx := context.Background()
+		client := coderdtest.New(t, nil)
+		owner := coderdtest.CreateFirstUser(t, client)
+		userAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleUserAdmin())
+
+		pw, err := cryptorand.String(16)
+		require.NoError(t, err)
+
+		user, err := client.CreateUser(ctx, codersdk.CreateUserRequest{
+			Email:          "colin5@coder.com",
+			Username:       "coolin",
+			Password:       pw,
+			UserLoginType:  codersdk.LoginTypePassword,
+			OrganizationID: owner.OrganizationID,
+			DisableLogin:   false,
+		})
+		require.NoError(t, err)
+
+		inv, root := clitest.New(t, "users", "delete", user.ID.String())
+		clitest.SetupConfig(t, userAdmin, root)
+		pty := ptytest.New(t).Attach(inv)
+		errC := make(chan error)
+		go func() {
+			errC <- inv.Run()
+		}()
+		require.NoError(t, <-errC)
+		pty.ExpectMatch("coolin")
+	})
+
+	t.Run("UserID", func(t *testing.T) {
+		t.Parallel()
+		ctx := context.Background()
+		client := coderdtest.New(t, nil)
+		owner := coderdtest.CreateFirstUser(t, client)
+		userAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleUserAdmin())
+
+		pw, err := cryptorand.String(16)
+		require.NoError(t, err)
+
+		user, err := client.CreateUser(ctx, codersdk.CreateUserRequest{
+			Email:          "colin5@coder.com",
+			Username:       "coolin",
+			Password:       pw,
+			UserLoginType:  codersdk.LoginTypePassword,
+			OrganizationID: owner.OrganizationID,
+			DisableLogin:   false,
+		})
+		require.NoError(t, err)
+
+		inv, root := clitest.New(t, "users", "delete", user.ID.String())
+		clitest.SetupConfig(t, userAdmin, root)
+		pty := ptytest.New(t).Attach(inv)
+		errC := make(chan error)
+		go func() {
+			errC <- inv.Run()
+		}()
+		require.NoError(t, <-errC)
+		pty.ExpectMatch("coolin")
+	})
+
+	// TODO: reenable this test case. Fetching users without perms returns a
+	// "user "testuser@coder.com" must be a member of at least one organization"
+	// error.
+	// t.Run("NoPerms", func(t *testing.T) {
+	// 	t.Parallel()
+	// 	ctx := context.Background()
+	// 	client := coderdtest.New(t, nil)
+	// 	aUser := coderdtest.CreateFirstUser(t, client)
+
+	// 	pw, err := cryptorand.String(16)
+	// 	require.NoError(t, err)
+
+	// 	toDelete, err := client.CreateUser(ctx, codersdk.CreateUserRequest{
+	// 		Email:          "colin5@coder.com",
+	// 		Username:       "coolin",
+	// 		Password:       pw,
+	// 		UserLoginType:  codersdk.LoginTypePassword,
+	// 		OrganizationID: aUser.OrganizationID,
+	// 		DisableLogin:   false,
+	// 	})
+	// 	require.NoError(t, err)
+
+	// 	uClient, _ := coderdtest.CreateAnotherUser(t, client, aUser.OrganizationID)
+	// 	_ = uClient
+	// 	_ = toDelete
+
+	// 	inv, root := clitest.New(t, "users", "delete", "coolin")
+	// 	clitest.SetupConfig(t, uClient, root)
+	// 	require.ErrorContains(t, inv.Run(), "...")
+	// })
+
+	t.Run("DeleteSelf", func(t *testing.T) {
+		t.Parallel()
+		t.Run("Owner", func(t *testing.T) {
+			client := coderdtest.New(t, nil)
+			_ = coderdtest.CreateFirstUser(t, client)
+			inv, root := clitest.New(t, "users", "delete", "me")
+			//nolint:gocritic // The point of the test is to validate that a user cannot delete
+			// themselves, the owner user is probably the most important user to test this with.
+			clitest.SetupConfig(t, client, root)
+			require.ErrorContains(t, inv.Run(), "You cannot delete yourself!")
+		})
+		t.Run("UserAdmin", func(t *testing.T) {
+			client := coderdtest.New(t, nil)
+			owner := coderdtest.CreateFirstUser(t, client)
+			userAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleUserAdmin())
+			inv, root := clitest.New(t, "users", "delete", "me")
+			clitest.SetupConfig(t, userAdmin, root)
+			require.ErrorContains(t, inv.Run(), "You cannot delete yourself!")
+		})
+	})
+}
diff --git a/cli/usercreate.go b/cli/usercreate.go
index b38bbb2d6401f..478cc98e16e47 100644
--- a/cli/usercreate.go
+++ b/cli/usercreate.go
@@ -2,14 +2,17 @@ package cli
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/go-playground/validator/v10"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 func (r *RootCmd) userCreate() *clibase.Cmd {
@@ -18,6 +21,7 @@ func (r *RootCmd) userCreate() *clibase.Cmd {
 		username     string
 		password     string
 		disableLogin bool
+		loginType    string
 	)
 	client := new(codersdk.Client)
 	cmd := &clibase.Cmd{
@@ -54,7 +58,18 @@ func (r *RootCmd) userCreate() *clibase.Cmd {
 					return err
 				}
 			}
-			if password == "" && !disableLogin {
+			userLoginType := codersdk.LoginTypePassword
+			if disableLogin && loginType != "" {
+				return xerrors.New("You cannot specify both --disable-login and --login-type")
+			}
+			if disableLogin {
+				userLoginType = codersdk.LoginTypeNone
+			} else if loginType != "" {
+				userLoginType = codersdk.LoginType(loginType)
+			}
+
+			if password == "" && userLoginType == codersdk.LoginTypePassword {
+				// Generate a random password
 				password, err = cryptorand.StringCharset(cryptorand.Human, 20)
 				if err != nil {
 					return err
@@ -66,28 +81,36 @@ func (r *RootCmd) userCreate() *clibase.Cmd {
 				Username:       username,
 				Password:       password,
 				OrganizationID: organization.ID,
-				DisableLogin:   disableLogin,
+				UserLoginType:  userLoginType,
 			})
 			if err != nil {
 				return err
 			}
-			authenticationMethod := `Your password is: ` + cliui.DefaultStyles.Field.Render(password)
-			if disableLogin {
+
+			authenticationMethod := ""
+			switch codersdk.LoginType(strings.ToLower(string(userLoginType))) {
+			case codersdk.LoginTypePassword:
+				authenticationMethod = `Your password is: ` + pretty.Sprint(cliui.DefaultStyles.Field, password)
+			case codersdk.LoginTypeNone:
 				authenticationMethod = "Login has been disabled for this user. Contact your administrator to authenticate."
+			case codersdk.LoginTypeGithub:
+				authenticationMethod = `Login is authenticated through GitHub.`
+			case codersdk.LoginTypeOIDC:
+				authenticationMethod = `Login is authenticated through the configured OIDC provider.`
 			}
 
 			_, _ = fmt.Fprintln(inv.Stderr, `A new user has been created!
 Share the instructions below to get them started.
-`+cliui.DefaultStyles.Placeholder.Render("—————————————————————————————————————————————————")+`
+`+pretty.Sprint(cliui.DefaultStyles.Placeholder, "—————————————————————————————————————————————————")+`
 Download the Coder command line for your operating system:
 https://github.com/coder/coder/releases
 
-Run `+cliui.DefaultStyles.Code.Render("coder login "+client.URL.String())+` to authenticate.
+Run `+pretty.Sprint(cliui.DefaultStyles.Code, "coder login "+client.URL.String())+` to authenticate.
 
-Your email is: `+cliui.DefaultStyles.Field.Render(email)+`
+Your email is: `+pretty.Sprint(cliui.DefaultStyles.Field, email)+`
 `+authenticationMethod+`
 
-Create a workspace  `+cliui.DefaultStyles.Code.Render("coder create")+`!`)
+Create a workspace  `+pretty.Sprint(cliui.DefaultStyles.Code, "coder create")+`!`)
 			return nil
 		},
 	}
@@ -111,11 +134,22 @@ Create a workspace  `+cliui.DefaultStyles.Code.Render("coder create")+`!`)
 			Value:         clibase.StringOf(&password),
 		},
 		{
-			Flag: "disable-login",
-			Description: "Disabling login for a user prevents the user from authenticating via password or IdP login. Authentication requires an API key/token generated by an admin. " +
+			Flag:   "disable-login",
+			Hidden: true,
+			Description: "Deprecated: Use '--login-type=none'. \nDisabling login for a user prevents the user from authenticating via password or IdP login. Authentication requires an API key/token generated by an admin. " +
 				"Be careful when using this flag as it can lock the user out of their account.",
 			Value: clibase.BoolOf(&disableLogin),
 		},
+		{
+			Flag: "login-type",
+			Description: fmt.Sprintf("Optionally specify the login type for the user. Valid values are: %s. "+
+				"Using 'none' prevents the user from authenticating and requires an API key/token to be generated by an admin.",
+				strings.Join([]string{
+					string(codersdk.LoginTypePassword), string(codersdk.LoginTypeNone), string(codersdk.LoginTypeGithub), string(codersdk.LoginTypeOIDC),
+				}, ", ",
+				)),
+			Value: clibase.StringOf(&loginType),
+		},
 	}
 	return cmd
 }
diff --git a/cli/usercreate_test.go b/cli/usercreate_test.go
index 01e2137a9e53b..5726cc84d25b5 100644
--- a/cli/usercreate_test.go
+++ b/cli/usercreate_test.go
@@ -5,9 +5,9 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestUserCreate(t *testing.T) {
diff --git a/cli/userdelete.go b/cli/userdelete.go
new file mode 100644
index 0000000000000..aeafc3bfa00d2
--- /dev/null
+++ b/cli/userdelete.go
@@ -0,0 +1,42 @@
+package cli
+
+import (
+	"fmt"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/pretty"
+)
+
+func (r *RootCmd) userDelete() *clibase.Cmd {
+	client := new(codersdk.Client)
+	cmd := &clibase.Cmd{
+		Use:   "delete <username|user_id>",
+		Short: "Delete a user by username or user_id.",
+		Middleware: clibase.Chain(
+			clibase.RequireNArgs(1),
+			r.InitClient(client),
+		),
+		Handler: func(inv *clibase.Invocation) error {
+			ctx := inv.Context()
+			user, err := client.User(ctx, inv.Args[0])
+			if err != nil {
+				return xerrors.Errorf("fetch user: %w", err)
+			}
+
+			err = client.DeleteUser(ctx, user.ID)
+			if err != nil {
+				return xerrors.Errorf("delete user: %w", err)
+			}
+
+			_, _ = fmt.Fprintln(inv.Stderr,
+				"Successfully deleted "+pretty.Sprint(cliui.DefaultStyles.Keyword, user.Username)+".",
+			)
+			return nil
+		},
+	}
+	return cmd
+}
diff --git a/cli/userlist.go b/cli/userlist.go
index 0f05578a9fe61..ce50a12849fa3 100644
--- a/cli/userlist.go
+++ b/cli/userlist.go
@@ -8,9 +8,9 @@ import (
 	"github.com/jedib0t/go-pretty/v6/table"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) userList() *clibase.Cmd {
diff --git a/cli/userlist_test.go b/cli/userlist_test.go
index 71c58f38147a7..64565e1dde911 100644
--- a/cli/userlist_test.go
+++ b/cli/userlist_test.go
@@ -9,10 +9,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestUserList(t *testing.T) {
@@ -20,9 +21,10 @@ func TestUserList(t *testing.T) {
 	t.Run("Table", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
-		coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
+		userAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleUserAdmin())
 		inv, root := clitest.New(t, "users", "list")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, userAdmin, root)
 		pty := ptytest.New(t).Attach(inv)
 		errC := make(chan error)
 		go func() {
@@ -35,9 +37,10 @@ func TestUserList(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, nil)
-		coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
+		userAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleUserAdmin())
 		inv, root := clitest.New(t, "users", "list", "-o", "json")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, userAdmin, root)
 		doneChan := make(chan struct{})
 
 		buf := bytes.NewBuffer(nil)
@@ -53,7 +56,7 @@ func TestUserList(t *testing.T) {
 		var users []codersdk.User
 		err := json.Unmarshal(buf.Bytes(), &users)
 		require.NoError(t, err, "unmarshal JSON output")
-		require.Len(t, users, 1)
+		require.Len(t, users, 2)
 		require.Contains(t, users[0].Email, "coder.com")
 	})
 	t.Run("NoURLFileErrorHasHelperText", func(t *testing.T) {
@@ -84,10 +87,11 @@ func TestUserShow(t *testing.T) {
 	t.Run("Table", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
-		admin := coderdtest.CreateFirstUser(t, client)
-		_, otherUser := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		userAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleUserAdmin())
+		_, otherUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 		inv, root := clitest.New(t, "users", "show", otherUser.Username)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, userAdmin, root)
 		doneChan := make(chan struct{})
 		pty := ptytest.New(t).Attach(inv)
 		go func() {
@@ -104,12 +108,13 @@ func TestUserShow(t *testing.T) {
 
 		ctx := context.Background()
 		client := coderdtest.New(t, nil)
-		admin := coderdtest.CreateFirstUser(t, client)
-		other, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		userAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleUserAdmin())
+		other, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 		otherUser, err := other.User(ctx, codersdk.Me)
 		require.NoError(t, err, "fetch other user")
 		inv, root := clitest.New(t, "users", "show", otherUser.Username, "-o", "json")
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, userAdmin, root)
 		doneChan := make(chan struct{})
 
 		buf := bytes.NewBuffer(nil)
diff --git a/cli/users.go b/cli/users.go
index 76615d05d7f04..160a17b77fa4a 100644
--- a/cli/users.go
+++ b/cli/users.go
@@ -1,8 +1,8 @@
 package cli
 
 import (
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) users() *clibase.Cmd {
@@ -17,6 +17,7 @@ func (r *RootCmd) users() *clibase.Cmd {
 			r.userCreate(),
 			r.userList(),
 			r.userSingle(),
+			r.userDelete(),
 			r.createUserStatusCommand(codersdk.UserStatusActive),
 			r.createUserStatusCommand(codersdk.UserStatusSuspended),
 		},
diff --git a/cli/userstatus.go b/cli/userstatus.go
index 6a2ada1a7cd19..7590626cfbf44 100644
--- a/cli/userstatus.go
+++ b/cli/userstatus.go
@@ -6,9 +6,11 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // createUserStatusCommand sets a user status.
@@ -26,7 +28,6 @@ func (r *RootCmd) createUserStatusCommand(sdkStatus codersdk.UserStatus) *clibas
 	case codersdk.UserStatusSuspended:
 		verb = "suspend"
 		pastVerb = "suspended"
-		aliases = []string{"rm", "delete"}
 		short = "Update a user's status to 'suspended'. A suspended user cannot log into the platform"
 	default:
 		panic(fmt.Sprintf("%s is not supported", sdkStatus))
@@ -89,7 +90,7 @@ func (r *RootCmd) createUserStatusCommand(sdkStatus codersdk.UserStatus) *clibas
 				return xerrors.Errorf("%s user: %w", verb, err)
 			}
 
-			_, _ = fmt.Fprintf(inv.Stdout, "\nUser %s has been %s!\n", cliui.DefaultStyles.Keyword.Render(user.Username), pastVerb)
+			_, _ = fmt.Fprintf(inv.Stdout, "\nUser %s has been %s!\n", pretty.Sprint(cliui.DefaultStyles.Keyword, user.Username), pastVerb)
 			return nil
 		},
 	}
diff --git a/cli/userstatus_test.go b/cli/userstatus_test.go
index 348559e10de5d..607132c094cf3 100644
--- a/cli/userstatus_test.go
+++ b/cli/userstatus_test.go
@@ -7,9 +7,10 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestUserStatus(t *testing.T) {
@@ -35,13 +36,14 @@ func TestUserStatus(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, nil)
-		admin := coderdtest.CreateFirstUser(t, client)
-		other, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		userAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleUserAdmin())
+		other, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 		otherUser, err := other.User(context.Background(), codersdk.Me)
 		require.NoError(t, err, "fetch user")
 
 		inv, root := clitest.New(t, "users", "suspend", otherUser.Username)
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, userAdmin, root)
 		// Yes to the prompt
 		inv.Stdin = bytes.NewReader([]byte("yes\n"))
 		err = inv.Run()
@@ -54,7 +56,7 @@ func TestUserStatus(t *testing.T) {
 
 		// Set back to active. Try using a uuid as well
 		inv, root = clitest.New(t, "users", "activate", otherUser.ID.String())
-		clitest.SetupConfig(t, client, root)
+		clitest.SetupConfig(t, userAdmin, root)
 		// Yes to the prompt
 		inv.Stdin = bytes.NewReader([]byte("yes\n"))
 		err = inv.Run()
diff --git a/cli/util.go b/cli/util.go
index 777335d0a7d80..0b86c10a2cb0d 100644
--- a/cli/util.go
+++ b/cli/util.go
@@ -8,8 +8,8 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/util/tz"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
+	"github.com/coder/coder/v2/coderd/util/tz"
 )
 
 var (
@@ -74,7 +74,7 @@ func relative(d time.Duration) string {
 }
 
 // parseCLISchedule parses a schedule in the format HH:MM{AM|PM} [DOW] [LOCATION]
-func parseCLISchedule(parts ...string) (*schedule.Schedule, error) {
+func parseCLISchedule(parts ...string) (*cron.Schedule, error) {
 	// If the user was careful and quoted the schedule, un-quote it.
 	// In the case that only time was specified, this will be a no-op.
 	if len(parts) == 1 {
@@ -121,7 +121,7 @@ func parseCLISchedule(parts ...string) (*schedule.Schedule, error) {
 		}
 	}
 
-	sched, err := schedule.Weekly(fmt.Sprintf(
+	sched, err := cron.Weekly(fmt.Sprintf(
 		"CRON_TZ=%s %d %d * * %s",
 		loc.String(),
 		minute,
diff --git a/cli/version.go b/cli/version.go
index fb33749f004f9..76ae3ffcf6de9 100644
--- a/cli/version.go
+++ b/cli/version.go
@@ -5,19 +5,22 @@ import (
 	"strings"
 	"time"
 
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
 )
 
 // versionInfo wraps the stuff we get from buildinfo so that it's
 // easier to emit in different formats.
 type versionInfo struct {
-	Version     string    `json:"version"`
-	BuildTime   time.Time `json:"build_time"`
-	ExternalURL string    `json:"external_url"`
-	Slim        bool      `json:"slim"`
-	AGPL        bool      `json:"agpl"`
+	Version      string    `json:"version"`
+	BuildTime    time.Time `json:"build_time"`
+	ExternalURL  string    `json:"external_url"`
+	Slim         bool      `json:"slim"`
+	AGPL         bool      `json:"agpl"`
+	BoringCrypto bool      `json:"boring_crypto"`
 }
 
 // String() implements Stringer
@@ -28,6 +31,9 @@ func (vi versionInfo) String() string {
 		_, _ = str.WriteString("(AGPL) ")
 	}
 	_, _ = str.WriteString(vi.Version)
+	if vi.BoringCrypto {
+		_, _ = str.WriteString(" BoringCrypto")
+	}
 
 	if !vi.BuildTime.IsZero() {
 		_, _ = str.WriteString(" " + vi.BuildTime.Format(time.UnixDate))
@@ -35,9 +41,9 @@ func (vi versionInfo) String() string {
 	_, _ = str.WriteString("\r\n" + vi.ExternalURL + "\r\n\r\n")
 
 	if vi.Slim {
-		_, _ = str.WriteString(fmt.Sprintf("Slim build of Coder, does not support the %s subcommand.", cliui.DefaultStyles.Code.Render("server")))
+		_, _ = str.WriteString(fmt.Sprintf("Slim build of Coder, does not support the %s subcommand.", pretty.Sprint(cliui.DefaultStyles.Code, "server")))
 	} else {
-		_, _ = str.WriteString(fmt.Sprintf("Full build of Coder, supports the %s subcommand.", cliui.DefaultStyles.Code.Render("server")))
+		_, _ = str.WriteString(fmt.Sprintf("Full build of Coder, supports the %s subcommand.", pretty.Sprint(cliui.DefaultStyles.Code, "server")))
 	}
 	return str.String()
 }
@@ -45,11 +51,12 @@ func (vi versionInfo) String() string {
 func defaultVersionInfo() *versionInfo {
 	buildTime, _ := buildinfo.Time()
 	return &versionInfo{
-		Version:     buildinfo.Version(),
-		BuildTime:   buildTime,
-		ExternalURL: buildinfo.ExternalURL(),
-		Slim:        buildinfo.IsSlim(),
-		AGPL:        buildinfo.IsAGPL(),
+		Version:      buildinfo.Version(),
+		BuildTime:    buildTime,
+		ExternalURL:  buildinfo.ExternalURL(),
+		Slim:         buildinfo.IsSlim(),
+		AGPL:         buildinfo.IsAGPL(),
+		BoringCrypto: buildinfo.IsBoringCrypto(),
 	}
 }
 
diff --git a/cli/version_test.go b/cli/version_test.go
index 4267e46f9ad69..5802fff6f10f0 100644
--- a/cli/version_test.go
+++ b/cli/version_test.go
@@ -6,35 +6,27 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/charmbracelet/lipgloss"
-	"github.com/muesli/termenv"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/testutil"
 )
 
-// We need to override the global color profile to test escape codes.
-//
-//nolint:tparallel,paralleltest
 func TestVersion(t *testing.T) {
-	ogColorProfile := lipgloss.ColorProfile()
-	lipgloss.SetColorProfile(termenv.ANSI)
-	t.Cleanup(func() {
-		lipgloss.SetColorProfile(ogColorProfile)
-	})
+	t.Parallel()
 
 	expectedText := `Coder v0.0.0-devel
 https://github.com/coder/coder
 
-Full build of Coder, supports the  server  subcommand.
+Full build of Coder, supports the server subcommand.
 `
 	expectedJSON := `{
   "version": "v0.0.0-devel",
   "build_time": "0001-01-01T00:00:00Z",
   "external_url": "https://github.com/coder/coder",
   "slim": false,
-  "agpl": false
+  "agpl": false,
+  "boring_crypto": false
 }
 `
 	for _, tt := range []struct {
diff --git a/cli/vscodessh.go b/cli/vscodessh.go
index 136a0d727c17a..19a836214773f 100644
--- a/cli/vscodessh.go
+++ b/cli/vscodessh.go
@@ -20,8 +20,8 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // vscodeSSH is used by the Coder VS Code extension to establish
@@ -40,9 +40,9 @@ func (r *RootCmd) vscodeSSH() *clibase.Cmd {
 	cmd := &clibase.Cmd{
 		// A SSH config entry is added by the VS Code extension that
 		// passes %h to ProxyCommand. The prefix of `coder-vscode--`
-		// is a magical string represented in our VS Cod extension.
+		// is a magical string represented in our VS Code extension.
 		// It's not important here, only the delimiter `--` is.
-		Use:        "vscodessh <coder-vscode--<owner>-<workspace>-<agent?>>",
+		Use:        "vscodessh <coder-vscode--<owner>--<workspace>--<agent?>>",
 		Hidden:     true,
 		Middleware: clibase.RequireNArgs(1),
 		Handler: func(inv *clibase.Invocation) error {
@@ -86,14 +86,14 @@ func (r *RootCmd) vscodeSSH() *clibase.Cmd {
 			client.SetSessionToken(string(sessionToken))
 
 			// This adds custom headers to the request!
-			err = r.setClient(client, serverURL)
+			err = r.setClient(ctx, client, serverURL)
 			if err != nil {
 				return xerrors.Errorf("set client: %w", err)
 			}
 
 			parts := strings.Split(inv.Args[0], "--")
 			if len(parts) < 3 {
-				return xerrors.Errorf("invalid argument format. must be: coder-vscode--<owner>-<name>-<agent?>")
+				return xerrors.Errorf("invalid argument format. must be: coder-vscode--<owner>--<name>--<agent?>")
 			}
 			owner := parts[1]
 			name := parts[2]
diff --git a/cli/vscodessh_test.go b/cli/vscodessh_test.go
index a134903005c4a..dc3e65f5bdb9c 100644
--- a/cli/vscodessh_test.go
+++ b/cli/vscodessh_test.go
@@ -9,15 +9,12 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"cdr.dev/slog/sloggers/slogtest"
-
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // TestVSCodeSSH ensures the agent connects properly with SSH
@@ -29,16 +26,8 @@ func TestVSCodeSSH(t *testing.T) {
 	user, err := client.User(ctx, codersdk.Me)
 	require.NoError(t, err)
 
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(agentToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: slogtest.Make(t, nil).Named("agent"),
-	})
-	defer func() {
-		_ = agentCloser.Close()
-	}()
-	coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+	_ = agenttest.New(t, client.URL, agentToken)
+	_ = coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 	fs := afero.NewMemMapFs()
 	err = afero.WriteFile(fs, "/url", []byte(client.URL.String()), 0o600)
diff --git a/cmd/cliui/main.go b/cmd/cliui/main.go
index 60e8f6536f7a8..9a30127be7d8b 100644
--- a/cmd/cliui/main.go
+++ b/cmd/cliui/main.go
@@ -15,23 +15,33 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func main() {
-	root := &clibase.Cmd{
+	var root *clibase.Cmd
+	root = &clibase.Cmd{
 		Use:   "cliui",
 		Short: "Used for visually testing UI components for the CLI.",
+		HelpHandler: func(inv *clibase.Invocation) error {
+			_, _ = fmt.Fprintln(inv.Stdout, "This command is used for visually testing UI components for the CLI.")
+			_, _ = fmt.Fprintln(inv.Stdout, "It is not intended to be used by end users.")
+			_, _ = fmt.Fprintln(inv.Stdout, "Subcommands: ")
+			for _, child := range root.Children {
+				_, _ = fmt.Fprintf(inv.Stdout, "- %s\n", child.Use)
+			}
+			return nil
+		},
 	}
 
 	root.Children = append(root.Children, &clibase.Cmd{
 		Use: "prompt",
 		Handler: func(inv *clibase.Invocation) error {
 			_, err := cliui.Prompt(inv, cliui.PromptOptions{
-				Text:    "What is our " + cliui.DefaultStyles.Field.Render("company name") + "?",
+				Text:    "What is our " + cliui.Field("company name") + "?",
 				Default: "acme-corp",
 				Validate: func(s string) error {
 					if !strings.EqualFold(s, "coder") {
@@ -82,21 +92,21 @@ func main() {
 		Handler: func(inv *clibase.Invocation) error {
 			job := codersdk.ProvisionerJob{
 				Status:    codersdk.ProvisionerJobPending,
-				CreatedAt: database.Now(),
+				CreatedAt: dbtime.Now(),
 			}
 			go func() {
 				time.Sleep(time.Second)
 				if job.Status != codersdk.ProvisionerJobPending {
 					return
 				}
-				started := database.Now()
+				started := dbtime.Now()
 				job.StartedAt = &started
 				job.Status = codersdk.ProvisionerJobRunning
 				time.Sleep(3 * time.Second)
 				if job.Status != codersdk.ProvisionerJobRunning {
 					return
 				}
-				completed := database.Now()
+				completed := dbtime.Now()
 				job.CompletedAt = &completed
 				job.Status = codersdk.ProvisionerJobSucceeded
 			}()
@@ -154,7 +164,7 @@ func main() {
 					job.Status = codersdk.ProvisionerJobCanceling
 					time.Sleep(time.Second)
 					job.Status = codersdk.ProvisionerJobCanceled
-					completed := database.Now()
+					completed := dbtime.Now()
 					job.CompletedAt = &completed
 					return nil
 				},
@@ -236,7 +246,7 @@ func main() {
 								time.Sleep(144 * time.Millisecond)
 							}
 							agent.LifecycleState = codersdk.WorkspaceAgentLifecycleReady
-							readyAt := database.Now()
+							readyAt := dbtime.Now()
 							agent.ReadyAt = &readyAt
 						}()
 					} else {
@@ -258,7 +268,7 @@ func main() {
 	root.Children = append(root.Children, &clibase.Cmd{
 		Use: "resources",
 		Handler: func(inv *clibase.Invocation) error {
-			disconnected := database.Now().Add(-4 * time.Second)
+			disconnected := dbtime.Now().Add(-4 * time.Second)
 			return cliui.WorkspaceResources(inv.Stdout, []codersdk.WorkspaceResource{{
 				Transition: codersdk.WorkspaceTransitionStart,
 				Type:       "google_compute_disk",
@@ -272,7 +282,7 @@ func main() {
 				Type:       "google_compute_instance",
 				Name:       "dev",
 				Agents: []codersdk.WorkspaceAgent{{
-					CreatedAt:       database.Now().Add(-10 * time.Second),
+					CreatedAt:       dbtime.Now().Add(-10 * time.Second),
 					Status:          codersdk.WorkspaceAgentConnecting,
 					LifecycleState:  codersdk.WorkspaceAgentLifecycleCreated,
 					Name:            "dev",
@@ -321,17 +331,17 @@ func main() {
 				// Complete the auth!
 				gitlabAuthed.Store(true)
 			}()
-			return cliui.GitAuth(inv.Context(), inv.Stdout, cliui.GitAuthOptions{
-				Fetch: func(ctx context.Context) ([]codersdk.TemplateVersionGitAuth, error) {
+			return cliui.ExternalAuth(inv.Context(), inv.Stdout, cliui.ExternalAuthOptions{
+				Fetch: func(ctx context.Context) ([]codersdk.TemplateVersionExternalAuth, error) {
 					count.Add(1)
-					return []codersdk.TemplateVersionGitAuth{{
+					return []codersdk.TemplateVersionExternalAuth{{
 						ID:              "github",
-						Type:            codersdk.GitProviderGitHub,
+						Type:            codersdk.EnhancedExternalAuthProviderGitHub.String(),
 						Authenticated:   githubAuthed.Load(),
 						AuthenticateURL: "https://example.com/gitauth/github?redirect=" + url.QueryEscape("/gitauth?notify"),
 					}, {
 						ID:              "gitlab",
-						Type:            codersdk.GitProviderGitLab,
+						Type:            codersdk.EnhancedExternalAuthProviderGitLab.String(),
 						Authenticated:   gitlabAuthed.Load(),
 						AuthenticateURL: "https://example.com/gitauth/gitlab?redirect=" + url.QueryEscape("/gitauth?notify"),
 					}}, nil
diff --git a/cmd/coder/main.go b/cmd/coder/main.go
index 7ca0f63d0e70a..5d1cea2f8097d 100644
--- a/cmd/coder/main.go
+++ b/cmd/coder/main.go
@@ -3,7 +3,7 @@ package main
 import (
 	_ "time/tzdata"
 
-	"github.com/coder/coder/cli"
+	"github.com/coder/coder/v2/cli"
 )
 
 func main() {
diff --git a/coderd/activitybump.go b/coderd/activitybump.go
index 972d59a31f93b..87e9ede552d2e 100644
--- a/coderd/activitybump.go
+++ b/coderd/activitybump.go
@@ -2,15 +2,13 @@ package coderd
 
 import (
 	"context"
-	"database/sql"
-	"errors"
 	"time"
 
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/database"
 )
 
 // activityBumpWorkspace automatically bumps the workspace's auto-off timer
@@ -20,72 +18,7 @@ func activityBumpWorkspace(ctx context.Context, log slog.Logger, db database.Sto
 	// low priority operations fail first.
 	ctx, cancel := context.WithTimeout(ctx, time.Second*15)
 	defer cancel()
-
-	err := db.InTx(func(s database.Store) error {
-		build, err := s.GetLatestWorkspaceBuildByWorkspaceID(ctx, workspaceID)
-		if errors.Is(err, sql.ErrNoRows) {
-			return nil
-		} else if err != nil {
-			return xerrors.Errorf("get latest workspace build: %w", err)
-		}
-
-		job, err := s.GetProvisionerJobByID(ctx, build.JobID)
-		if err != nil {
-			return xerrors.Errorf("get provisioner job: %w", err)
-		}
-
-		if build.Transition != database.WorkspaceTransitionStart || !job.CompletedAt.Valid {
-			return nil
-		}
-
-		if build.Deadline.IsZero() {
-			// Workspace shutdown is manual
-			return nil
-		}
-
-		workspace, err := s.GetWorkspaceByID(ctx, workspaceID)
-		if err != nil {
-			return xerrors.Errorf("get workspace: %w", err)
-		}
-
-		var (
-			// We bump by the original TTL to prevent counter-intuitive behavior
-			// as the TTL wraps. For example, if I set the TTL to 12 hours, sign off
-			// work at midnight, come back at 10am, I would want another full day
-			// of uptime. In the prior implementation, the workspace would enter
-			// a state of always expiring 1 hour in the future
-			bumpAmount = time.Duration(workspace.Ttl.Int64)
-			// DB writes are expensive so we only bump when 5% of the deadline
-			// has elapsed.
-			bumpEvery         = bumpAmount / 20
-			timeSinceLastBump = bumpAmount - time.Until(build.Deadline)
-		)
-
-		if timeSinceLastBump < bumpEvery {
-			return nil
-		}
-
-		if bumpAmount == 0 {
-			return nil
-		}
-
-		newDeadline := database.Now().Add(bumpAmount)
-		if !build.MaxDeadline.IsZero() && newDeadline.After(build.MaxDeadline) {
-			newDeadline = build.MaxDeadline
-		}
-
-		if err := s.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
-			ID:               build.ID,
-			UpdatedAt:        database.Now(),
-			ProvisionerState: build.ProvisionerState,
-			Deadline:         newDeadline,
-			MaxDeadline:      build.MaxDeadline,
-		}); err != nil {
-			return xerrors.Errorf("update workspace build: %w", err)
-		}
-		return nil
-	}, nil)
-	if err != nil {
+	if err := db.ActivityBumpWorkspace(ctx, workspaceID); err != nil {
 		if !xerrors.Is(err, context.Canceled) && !database.IsQueryCanceledError(err) {
 			// Bump will fail if the context is canceled, but this is ok.
 			log.Error(ctx, "bump failed", slog.Error(err),
diff --git a/coderd/activitybump_internal_test.go b/coderd/activitybump_internal_test.go
new file mode 100644
index 0000000000000..3e5f7c1848db3
--- /dev/null
+++ b/coderd/activitybump_internal_test.go
@@ -0,0 +1,262 @@
+package coderd
+
+import (
+	"database/sql"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/testutil"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_ActivityBumpWorkspace(t *testing.T) {
+	t.Parallel()
+
+	// We test the below in multiple timezones specifically
+	// chosen to trigger timezone-related bugs.
+	timezones := []string{
+		"Asia/Kolkata",        // No DST, positive fractional offset
+		"Canada/Newfoundland", // DST, negative fractional offset
+		"Europe/Paris",        // DST, positive offset
+		"US/Arizona",          // No DST, negative offset
+		"UTC",                 // Baseline
+	}
+
+	for _, tt := range []struct {
+		name                          string
+		transition                    database.WorkspaceTransition
+		jobCompletedAt                sql.NullTime
+		buildDeadlineOffset           *time.Duration
+		maxDeadlineOffset             *time.Duration
+		workspaceTTL                  time.Duration
+		templateTTL                   time.Duration
+		templateDisallowsUserAutostop bool
+		expectedBump                  time.Duration
+	}{
+		{
+			name:                "NotFinishedYet",
+			transition:          database.WorkspaceTransitionStart,
+			jobCompletedAt:      sql.NullTime{},
+			buildDeadlineOffset: ptr.Ref(8 * time.Hour),
+			workspaceTTL:        8 * time.Hour,
+			expectedBump:        0,
+		},
+		{
+			name:                "ManualShutdown",
+			transition:          database.WorkspaceTransitionStart,
+			jobCompletedAt:      sql.NullTime{Valid: true, Time: dbtime.Now()},
+			buildDeadlineOffset: nil,
+			expectedBump:        0,
+		},
+		{
+			name:                "NotTimeToBumpYet",
+			transition:          database.WorkspaceTransitionStart,
+			jobCompletedAt:      sql.NullTime{Valid: true, Time: dbtime.Now()},
+			buildDeadlineOffset: ptr.Ref(8 * time.Hour),
+			workspaceTTL:        8 * time.Hour,
+			expectedBump:        0,
+		},
+		{
+			name:                "TimeToBump",
+			transition:          database.WorkspaceTransitionStart,
+			jobCompletedAt:      sql.NullTime{Valid: true, Time: dbtime.Now().Add(-24 * time.Minute)},
+			buildDeadlineOffset: ptr.Ref(8*time.Hour - 24*time.Minute),
+			workspaceTTL:        8 * time.Hour,
+			expectedBump:        8 * time.Hour,
+		},
+		{
+			name:                "MaxDeadline",
+			transition:          database.WorkspaceTransitionStart,
+			jobCompletedAt:      sql.NullTime{Valid: true, Time: dbtime.Now().Add(-24 * time.Minute)},
+			buildDeadlineOffset: ptr.Ref(time.Minute), // last chance to bump!
+			maxDeadlineOffset:   ptr.Ref(time.Hour),
+			workspaceTTL:        8 * time.Hour,
+			expectedBump:        1 * time.Hour,
+		},
+		{
+			// A workspace that is still running, has passed its deadline, but has not
+			// yet been auto-stopped should still bump the deadline.
+			name:                "PastDeadlineStillBumps",
+			transition:          database.WorkspaceTransitionStart,
+			jobCompletedAt:      sql.NullTime{Valid: true, Time: dbtime.Now().Add(-24 * time.Minute)},
+			buildDeadlineOffset: ptr.Ref(-time.Minute),
+			workspaceTTL:        8 * time.Hour,
+			expectedBump:        8 * time.Hour,
+		},
+		{
+			// A stopped workspace should never bump.
+			name:                "StoppedWorkspace",
+			transition:          database.WorkspaceTransitionStop,
+			jobCompletedAt:      sql.NullTime{Valid: true, Time: dbtime.Now().Add(-time.Minute)},
+			buildDeadlineOffset: ptr.Ref(-time.Minute),
+			workspaceTTL:        8 * time.Hour,
+		},
+		{
+			// A workspace built from a template that disallows user autostop should bump
+			// by the template TTL instead.
+			name:                          "TemplateDisallowsUserAutostop",
+			transition:                    database.WorkspaceTransitionStart,
+			jobCompletedAt:                sql.NullTime{Valid: true, Time: dbtime.Now().Add(-24 * time.Minute)},
+			buildDeadlineOffset:           ptr.Ref(8*time.Hour - 24*time.Minute),
+			workspaceTTL:                  6 * time.Hour,
+			templateTTL:                   8 * time.Hour,
+			templateDisallowsUserAutostop: true,
+			expectedBump:                  8 * time.Hour,
+		},
+	} {
+		tt := tt
+		for _, tz := range timezones {
+			tz := tz
+			t.Run(tt.name+"/"+tz, func(t *testing.T) {
+				t.Parallel()
+
+				var (
+					now   = dbtime.Now()
+					ctx   = testutil.Context(t, testutil.WaitShort)
+					log   = slogtest.Make(t, nil)
+					db, _ = dbtestutil.NewDB(t, dbtestutil.WithTimezone(tz))
+					org   = dbgen.Organization(t, db, database.Organization{})
+					user  = dbgen.User(t, db, database.User{
+						Status: database.UserStatusActive,
+					})
+					_ = dbgen.OrganizationMember(t, db, database.OrganizationMember{
+						UserID:         user.ID,
+						OrganizationID: org.ID,
+					})
+					templateVersion = dbgen.TemplateVersion(t, db, database.TemplateVersion{
+						OrganizationID: org.ID,
+						CreatedBy:      user.ID,
+					})
+					template = dbgen.Template(t, db, database.Template{
+						OrganizationID:  org.ID,
+						ActiveVersionID: templateVersion.ID,
+						CreatedBy:       user.ID,
+					})
+					ws = dbgen.Workspace(t, db, database.Workspace{
+						OwnerID:        user.ID,
+						OrganizationID: org.ID,
+						TemplateID:     template.ID,
+						Ttl:            sql.NullInt64{Valid: true, Int64: int64(tt.workspaceTTL)},
+					})
+					job = dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
+						OrganizationID: org.ID,
+						CompletedAt:    tt.jobCompletedAt,
+					})
+					_ = dbgen.WorkspaceResource(t, db, database.WorkspaceResource{
+						JobID: job.ID,
+					})
+					buildID = uuid.New()
+				)
+
+				require.NoError(t, db.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
+					ID:                template.ID,
+					UpdatedAt:         dbtime.Now(),
+					AllowUserAutostop: !tt.templateDisallowsUserAutostop,
+					DefaultTTL:        int64(tt.templateTTL),
+				}), "unexpected error updating template schedule")
+
+				var buildNumber int32 = 1
+				// Insert a number of previous workspace builds.
+				for i := 0; i < 5; i++ {
+					insertPrevWorkspaceBuild(t, db, org.ID, templateVersion.ID, ws.ID, database.WorkspaceTransitionStart, buildNumber)
+					buildNumber++
+					insertPrevWorkspaceBuild(t, db, org.ID, templateVersion.ID, ws.ID, database.WorkspaceTransitionStop, buildNumber)
+					buildNumber++
+				}
+
+				// dbgen.WorkspaceBuild automatically sets deadline to now+1 hour if not set
+				var buildDeadline time.Time
+				if tt.buildDeadlineOffset != nil {
+					buildDeadline = now.Add(*tt.buildDeadlineOffset)
+				}
+				var maxDeadline time.Time
+				if tt.maxDeadlineOffset != nil {
+					maxDeadline = now.Add(*tt.maxDeadlineOffset)
+				}
+				err := db.InsertWorkspaceBuild(ctx, database.InsertWorkspaceBuildParams{
+					ID:                buildID,
+					CreatedAt:         dbtime.Now(),
+					UpdatedAt:         dbtime.Now(),
+					BuildNumber:       buildNumber,
+					InitiatorID:       user.ID,
+					Reason:            database.BuildReasonInitiator,
+					WorkspaceID:       ws.ID,
+					JobID:             job.ID,
+					TemplateVersionID: templateVersion.ID,
+					Transition:        tt.transition,
+					Deadline:          buildDeadline,
+					MaxDeadline:       maxDeadline,
+				})
+				require.NoError(t, err, "unexpected error inserting workspace build")
+				bld, err := db.GetWorkspaceBuildByID(ctx, buildID)
+				require.NoError(t, err, "unexpected error fetching inserted workspace build")
+
+				// Validate our initial state before bump
+				require.Equal(t, tt.transition, bld.Transition, "unexpected transition before bump")
+				require.Equal(t, tt.jobCompletedAt.Time.UTC(), job.CompletedAt.Time.UTC(), "unexpected job completed at before bump")
+				require.Equal(t, buildDeadline.UTC(), bld.Deadline.UTC(), "unexpected build deadline before bump")
+				require.Equal(t, maxDeadline.UTC(), bld.MaxDeadline.UTC(), "unexpected max deadline before bump")
+				require.Equal(t, tt.workspaceTTL, time.Duration(ws.Ttl.Int64), "unexpected workspace TTL before bump")
+
+				// Wait a bit before bumping as dbtime is rounded to the nearest millisecond.
+				// This should also hopefully be enough for Windows time resolution to register
+				// a tick (win32 max timer resolution is apparently between 0.5 and 15.6ms)
+				<-time.After(testutil.IntervalFast)
+
+				// Bump duration is measured from the time of the bump, so we measure from here.
+				start := dbtime.Now()
+				activityBumpWorkspace(ctx, log, db, bld.WorkspaceID)
+				end := dbtime.Now()
+
+				// Validate our state after bump
+				updatedBuild, err := db.GetLatestWorkspaceBuildByWorkspaceID(ctx, bld.WorkspaceID)
+				require.NoError(t, err, "unexpected error getting latest workspace build")
+				require.Equal(t, bld.MaxDeadline.UTC(), updatedBuild.MaxDeadline.UTC(), "max_deadline should not have changed")
+				if tt.expectedBump == 0 {
+					assert.Equal(t, bld.UpdatedAt.UTC(), updatedBuild.UpdatedAt.UTC(), "should not have bumped updated_at")
+					assert.Equal(t, bld.Deadline.UTC(), updatedBuild.Deadline.UTC(), "should not have bumped deadline")
+					return
+				}
+				assert.NotEqual(t, bld.UpdatedAt.UTC(), updatedBuild.UpdatedAt.UTC(), "should have bumped updated_at")
+				if tt.maxDeadlineOffset != nil {
+					assert.Equal(t, bld.MaxDeadline.UTC(), updatedBuild.MaxDeadline.UTC(), "new deadline must equal original max deadline")
+					return
+				}
+
+				// Assert that the bump occurred between start and end.
+				expectedDeadlineStart := start.Add(tt.expectedBump)
+				expectedDeadlineEnd := end.Add(tt.expectedBump)
+				require.GreaterOrEqual(t, updatedBuild.Deadline, expectedDeadlineStart, "new deadline should be greater than or equal to start")
+				require.LessOrEqual(t, updatedBuild.Deadline, expectedDeadlineEnd, "new deadline should be lesser than or equal to end")
+			})
+		}
+	}
+}
+
+func insertPrevWorkspaceBuild(t *testing.T, db database.Store, orgID, tvID, workspaceID uuid.UUID, transition database.WorkspaceTransition, buildNumber int32) {
+	t.Helper()
+
+	job := dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
+		OrganizationID: orgID,
+	})
+	_ = dbgen.WorkspaceResource(t, db, database.WorkspaceResource{
+		JobID: job.ID,
+	})
+	_ = dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
+		BuildNumber:       buildNumber,
+		WorkspaceID:       workspaceID,
+		JobID:             job.ID,
+		TemplateVersionID: tvID,
+		Transition:        transition,
+	})
+}
diff --git a/coderd/activitybump_test.go b/coderd/activitybump_test.go
index b9c757e98986e..30c338b37a7c7 100644
--- a/coderd/activitybump_test.go
+++ b/coderd/activitybump_test.go
@@ -9,16 +9,15 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestWorkspaceActivityBump(t *testing.T) {
@@ -27,9 +26,10 @@ func TestWorkspaceActivityBump(t *testing.T) {
 	ctx := context.Background()
 
 	// deadline allows you to forcibly set a max_deadline on the build. This
-	// doesn't use template restart requirements and instead edits the
+	// doesn't use template autostop requirements and instead edits the
 	// max_deadline on the build directly in the database.
 	setupActivityTest := func(t *testing.T, deadline ...time.Duration) (client *codersdk.Client, workspace codersdk.Workspace, assertBumped func(want bool)) {
+		t.Helper()
 		const ttl = time.Minute
 		maxTTL := time.Duration(0)
 		if len(deadline) > 0 {
@@ -50,7 +50,7 @@ func TestWorkspaceActivityBump(t *testing.T) {
 						UserAutostopEnabled: true,
 						DefaultTTL:          ttl,
 						// We set max_deadline manually below.
-						RestartRequirement: schedule.TemplateRestartRequirement{},
+						AutostopRequirement: schedule.TemplateAutostopRequirement{},
 					}, nil
 				},
 			},
@@ -60,57 +60,32 @@ func TestWorkspaceActivityBump(t *testing.T) {
 		ttlMillis := int64(ttl / time.Millisecond)
 		agentToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Resources: []*proto.Resource{{
-							Name: "example",
-							Type: "aws_instance",
-							Agents: []*proto.Agent{{
-								Id:   uuid.NewString(),
-								Name: "agent",
-								Auth: &proto.Agent_Token{
-									Token: agentToken,
-								},
-							}},
-						}},
-					},
-				},
-			}},
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ProvisionApplyWithAgent(agentToken),
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 			cwr.TTLMillis = &ttlMillis
 		})
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		// Update the max deadline.
 		if maxTTL != 0 {
 			dbBuild, err := db.GetWorkspaceBuildByID(ctx, workspace.LatestBuild.ID)
 			require.NoError(t, err)
 
-			err = db.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
-				ID:               workspace.LatestBuild.ID,
-				UpdatedAt:        database.Now(),
-				ProvisionerState: dbBuild.ProvisionerState,
-				Deadline:         dbBuild.Deadline,
-				MaxDeadline:      database.Now().Add(maxTTL),
+			err = db.UpdateWorkspaceBuildDeadlineByID(ctx, database.UpdateWorkspaceBuildDeadlineByIDParams{
+				ID:          workspace.LatestBuild.ID,
+				UpdatedAt:   dbtime.Now(),
+				Deadline:    dbBuild.Deadline,
+				MaxDeadline: dbtime.Now().Add(maxTTL),
 			})
 			require.NoError(t, err)
 		}
 
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(agentToken)
-		agentCloser := agent.New(agent.Options{
-			Client: agentClient,
-			Logger: slogtest.Make(t, nil).Named("agent"),
-		})
-		t.Cleanup(func() {
-			_ = agentCloser.Close()
-		})
+		_ = agenttest.New(t, client.URL, agentToken)
 		coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 		// Sanity-check that deadline is near.
@@ -136,6 +111,7 @@ func TestWorkspaceActivityBump(t *testing.T) {
 		_ = coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 		return client, workspace, func(want bool) {
+			t.Helper()
 			if !want {
 				// It is difficult to test the absence of a call in a non-racey
 				// way. In general, it is difficult for the API to generate
@@ -150,24 +126,32 @@ func TestWorkspaceActivityBump(t *testing.T) {
 				return
 			}
 
+			var updatedAfter time.Time
 			// The Deadline bump occurs asynchronously.
 			require.Eventuallyf(t,
 				func() bool {
 					workspace, err = client.Workspace(ctx, workspace.ID)
 					require.NoError(t, err)
-					return workspace.LatestBuild.Deadline.Time != firstDeadline
+					updatedAfter = dbtime.Now()
+					if workspace.LatestBuild.Deadline.Time == firstDeadline {
+						updatedAfter = time.Now()
+						return false
+					}
+					return true
 				},
 				testutil.WaitLong, testutil.IntervalFast,
 				"deadline %v never updated", firstDeadline,
 			)
 
+			require.Greater(t, workspace.LatestBuild.Deadline.Time, updatedAfter)
+
 			// If the workspace has a max deadline, the deadline must not exceed
 			// it.
-			if maxTTL != 0 && database.Now().Add(ttl).After(workspace.LatestBuild.MaxDeadline.Time) {
-				require.Equal(t, workspace.LatestBuild.Deadline.Time, workspace.LatestBuild.MaxDeadline.Time)
+			if workspace.LatestBuild.MaxDeadline.Valid {
+				require.LessOrEqual(t, workspace.LatestBuild.Deadline.Time, workspace.LatestBuild.MaxDeadline.Time)
 				return
 			}
-			require.WithinDuration(t, database.Now().Add(ttl), workspace.LatestBuild.Deadline.Time, 3*time.Second)
+			require.WithinDuration(t, dbtime.Now().Add(ttl), workspace.LatestBuild.Deadline.Time, testutil.WaitShort)
 		}
 	}
 
@@ -226,12 +210,6 @@ func TestWorkspaceActivityBump(t *testing.T) {
 		require.NoError(t, err)
 		_ = sshConn.Close()
 
-		assertBumped(true)
-
-		// Double check that the workspace build's deadline is equal to the
-		// max deadline.
-		workspace, err = client.Workspace(ctx, workspace.ID)
-		require.NoError(t, err)
-		require.Equal(t, workspace.LatestBuild.Deadline.Time, workspace.LatestBuild.MaxDeadline.Time)
+		assertBumped(true) // also asserts max ttl not exceeded
 	})
 }
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 2c115a30c3261..76daf4c798e2f 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -587,8 +587,8 @@ const docTemplate = `{
                 "tags": [
                     "General"
                 ],
-                "summary": "Get experiments",
-                "operationId": "get-experiments",
+                "summary": "Get enabled experiments",
+                "operationId": "get-enabled-experiments",
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -602,82 +602,70 @@ const docTemplate = `{
                 }
             }
         },
-        "/files": {
-            "post": {
+        "/experiments/available": {
+            "get": {
                 "security": [
                     {
                         "CoderSessionToken": []
                     }
                 ],
-                "description": "Swagger notice: Swagger 2.0 doesn't support file upload with a ` + "`" + `content-type` + "`" + ` different than ` + "`" + `application/x-www-form-urlencoded` + "`" + `.",
-                "consumes": [
-                    "application/x-tar"
-                ],
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "Files"
-                ],
-                "summary": "Upload file",
-                "operationId": "upload-file",
-                "parameters": [
-                    {
-                        "type": "string",
-                        "default": "application/x-tar",
-                        "description": "Content-Type must be ` + "`" + `application/x-tar` + "`" + `",
-                        "name": "Content-Type",
-                        "in": "header",
-                        "required": true
-                    },
-                    {
-                        "type": "file",
-                        "description": "File to be uploaded",
-                        "name": "file",
-                        "in": "formData",
-                        "required": true
-                    }
+                    "General"
                 ],
+                "summary": "Get safe experiments",
+                "operationId": "get-safe-experiments",
                 "responses": {
-                    "201": {
-                        "description": "Created",
+                    "200": {
+                        "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/codersdk.UploadResponse"
+                            "type": "array",
+                            "items": {
+                                "$ref": "#/definitions/codersdk.Experiment"
+                            }
                         }
                     }
                 }
             }
         },
-        "/files/{fileID}": {
+        "/external-auth/{externalauth}": {
             "get": {
                 "security": [
                     {
                         "CoderSessionToken": []
                     }
                 ],
+                "produces": [
+                    "application/json"
+                ],
                 "tags": [
-                    "Files"
+                    "Git"
                 ],
-                "summary": "Get file by ID",
-                "operationId": "get-file-by-id",
+                "summary": "Get external auth by ID",
+                "operationId": "get-external-auth-by-id",
                 "parameters": [
                     {
                         "type": "string",
-                        "format": "uuid",
-                        "description": "File ID",
-                        "name": "fileID",
+                        "format": "string",
+                        "description": "Git Provider ID",
+                        "name": "externalauth",
                         "in": "path",
                         "required": true
                     }
                 ],
                 "responses": {
                     "200": {
-                        "description": "OK"
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.ExternalAuth"
+                        }
                     }
                 }
             }
         },
-        "/gitauth/{gitauth}": {
+        "/external-auth/{externalauth}/device": {
             "get": {
                 "security": [
                     {
@@ -690,14 +678,14 @@ const docTemplate = `{
                 "tags": [
                     "Git"
                 ],
-                "summary": "Get git auth by ID",
-                "operationId": "get-git-auth-by-id",
+                "summary": "Get external auth device by ID.",
+                "operationId": "get-external-auth-device-by-id",
                 "parameters": [
                     {
                         "type": "string",
                         "format": "string",
                         "description": "Git Provider ID",
-                        "name": "gitauth",
+                        "name": "externalauth",
                         "in": "path",
                         "required": true
                     }
@@ -706,70 +694,110 @@ const docTemplate = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/codersdk.GitAuth"
+                            "$ref": "#/definitions/codersdk.ExternalAuthDevice"
                         }
                     }
                 }
+            },
+            "post": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Git"
+                ],
+                "summary": "Post external auth device by ID",
+                "operationId": "post-external-auth-device-by-id",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "format": "string",
+                        "description": "External Provider ID",
+                        "name": "externalauth",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "204": {
+                        "description": "No Content"
+                    }
+                }
             }
         },
-        "/gitauth/{gitauth}/device": {
-            "get": {
+        "/files": {
+            "post": {
                 "security": [
                     {
                         "CoderSessionToken": []
                     }
                 ],
+                "description": "Swagger notice: Swagger 2.0 doesn't support file upload with a ` + "`" + `content-type` + "`" + ` different than ` + "`" + `application/x-www-form-urlencoded` + "`" + `.",
+                "consumes": [
+                    "application/x-tar"
+                ],
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
-                    "Git"
+                    "Files"
                 ],
-                "summary": "Get git auth device by ID.",
-                "operationId": "get-git-auth-device-by-id",
+                "summary": "Upload file",
+                "operationId": "upload-file",
                 "parameters": [
                     {
                         "type": "string",
-                        "format": "string",
-                        "description": "Git Provider ID",
-                        "name": "gitauth",
-                        "in": "path",
+                        "default": "application/x-tar",
+                        "description": "Content-Type must be ` + "`" + `application/x-tar` + "`" + `",
+                        "name": "Content-Type",
+                        "in": "header",
+                        "required": true
+                    },
+                    {
+                        "type": "file",
+                        "description": "File to be uploaded",
+                        "name": "file",
+                        "in": "formData",
                         "required": true
                     }
                 ],
                 "responses": {
-                    "200": {
-                        "description": "OK",
+                    "201": {
+                        "description": "Created",
                         "schema": {
-                            "$ref": "#/definitions/codersdk.GitAuthDevice"
+                            "$ref": "#/definitions/codersdk.UploadResponse"
                         }
                     }
                 }
-            },
-            "post": {
+            }
+        },
+        "/files/{fileID}": {
+            "get": {
                 "security": [
                     {
                         "CoderSessionToken": []
                     }
                 ],
                 "tags": [
-                    "Git"
+                    "Files"
                 ],
-                "summary": "Post git auth device by ID",
-                "operationId": "post-git-auth-device-by-id",
+                "summary": "Get file by ID",
+                "operationId": "get-file-by-id",
                 "parameters": [
                     {
                         "type": "string",
-                        "format": "string",
-                        "description": "Git Provider ID",
-                        "name": "gitauth",
+                        "format": "uuid",
+                        "description": "File ID",
+                        "name": "fileID",
                         "in": "path",
                         "required": true
                     }
                 ],
                 "responses": {
-                    "204": {
-                        "description": "No Content"
+                    "200": {
+                        "description": "OK"
                     }
                 }
             }
@@ -787,12 +815,12 @@ const docTemplate = `{
                 "tags": [
                     "Enterprise"
                 ],
-                "summary": "Get group by name",
-                "operationId": "get-group-by-name",
+                "summary": "Get group by ID",
+                "operationId": "get-group-by-id",
                 "parameters": [
                     {
                         "type": "string",
-                        "description": "Group name",
+                        "description": "Group id",
                         "name": "group",
                         "in": "path",
                         "required": true
@@ -845,6 +873,9 @@ const docTemplate = `{
                         "CoderSessionToken": []
                     }
                 ],
+                "consumes": [
+                    "application/json"
+                ],
                 "produces": [
                     "application/json"
                 ],
@@ -860,6 +891,15 @@ const docTemplate = `{
                         "name": "group",
                         "in": "path",
                         "required": true
+                    },
+                    {
+                        "description": "Patch group request",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.PatchGroupRequest"
+                        }
                     }
                 ],
                 "responses": {
@@ -922,6 +962,31 @@ const docTemplate = `{
                 }
             }
         },
+        "/insights/user-activity": {
+            "get": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Insights"
+                ],
+                "summary": "Get insights about user activity",
+                "operationId": "get-insights-about-user-activity",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.UserActivityInsightsResponse"
+                        }
+                    }
+                }
+            }
+        },
         "/insights/user-latency": {
             "get": {
                 "security": [
@@ -1012,6 +1077,31 @@ const docTemplate = `{
                 }
             }
         },
+        "/licenses/refresh-entitlements": {
+            "post": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Organizations"
+                ],
+                "summary": "Update license entitlements",
+                "operationId": "update-license-entitlements",
+                "responses": {
+                    "201": {
+                        "description": "Created",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.Response"
+                        }
+                    }
+                }
+            }
+        },
         "/licenses/{id}": {
             "delete": {
                 "security": [
@@ -2232,6 +2322,12 @@ const docTemplate = `{
                         "name": "after_id",
                         "in": "query"
                     },
+                    {
+                        "type": "boolean",
+                        "description": "Include archived versions in the list",
+                        "name": "include_archived",
+                        "in": "query"
+                    },
                     {
                         "type": "integer",
                         "description": "Page limit",
@@ -2303,6 +2399,53 @@ const docTemplate = `{
                 }
             }
         },
+        "/templates/{template}/versions/archive": {
+            "post": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Templates"
+                ],
+                "summary": "Archive template unused versions by template id",
+                "operationId": "archive-template-unused-versions-by-template-id",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "format": "uuid",
+                        "description": "Template ID",
+                        "name": "template",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "description": "Archive request",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.ArchiveTemplateVersionsRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.Response"
+                        }
+                    }
+                }
+            }
+        },
         "/templates/{template}/versions/{templateversionname}": {
             "get": {
                 "security": [
@@ -2428,8 +2571,8 @@ const docTemplate = `{
                 }
             }
         },
-        "/templateversions/{templateversion}/cancel": {
-            "patch": {
+        "/templateversions/{templateversion}/archive": {
+            "post": {
                 "security": [
                     {
                         "CoderSessionToken": []
@@ -2441,8 +2584,8 @@ const docTemplate = `{
                 "tags": [
                     "Templates"
                 ],
-                "summary": "Cancel template version by ID",
-                "operationId": "cancel-template-version-by-id",
+                "summary": "Archive template version",
+                "operationId": "archive-template-version",
                 "parameters": [
                     {
                         "type": "string",
@@ -2463,24 +2606,21 @@ const docTemplate = `{
                 }
             }
         },
-        "/templateversions/{templateversion}/dry-run": {
-            "post": {
+        "/templateversions/{templateversion}/cancel": {
+            "patch": {
                 "security": [
                     {
                         "CoderSessionToken": []
                     }
                 ],
-                "consumes": [
-                    "application/json"
-                ],
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
                     "Templates"
                 ],
-                "summary": "Create template version dry-run",
-                "operationId": "create-template-version-dry-run",
+                "summary": "Cancel template version by ID",
+                "operationId": "cancel-template-version-by-id",
                 "parameters": [
                     {
                         "type": "string",
@@ -2489,22 +2629,60 @@ const docTemplate = `{
                         "name": "templateversion",
                         "in": "path",
                         "required": true
-                    },
-                    {
-                        "description": "Dry-run request",
-                        "name": "request",
-                        "in": "body",
-                        "required": true,
-                        "schema": {
-                            "$ref": "#/definitions/codersdk.CreateTemplateVersionDryRunRequest"
-                        }
                     }
                 ],
                 "responses": {
-                    "201": {
-                        "description": "Created",
+                    "200": {
+                        "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/codersdk.ProvisionerJob"
+                            "$ref": "#/definitions/codersdk.Response"
+                        }
+                    }
+                }
+            }
+        },
+        "/templateversions/{templateversion}/dry-run": {
+            "post": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Templates"
+                ],
+                "summary": "Create template version dry-run",
+                "operationId": "create-template-version-dry-run",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "format": "uuid",
+                        "description": "Template version ID",
+                        "name": "templateversion",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "description": "Dry-run request",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.CreateTemplateVersionDryRunRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "201": {
+                        "description": "Created",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.ProvisionerJob"
                         }
                     }
                 }
@@ -2706,7 +2884,7 @@ const docTemplate = `{
                 }
             }
         },
-        "/templateversions/{templateversion}/gitauth": {
+        "/templateversions/{templateversion}/external-auth": {
             "get": {
                 "security": [
                     {
@@ -2719,8 +2897,8 @@ const docTemplate = `{
                 "tags": [
                     "Templates"
                 ],
-                "summary": "Get git auth by template version",
-                "operationId": "get-git-auth-by-template-version",
+                "summary": "Get external auth by template version",
+                "operationId": "get-external-auth-by-template-version",
                 "parameters": [
                     {
                         "type": "string",
@@ -2737,7 +2915,7 @@ const docTemplate = `{
                         "schema": {
                             "type": "array",
                             "items": {
-                                "$ref": "#/definitions/codersdk.TemplateVersionGitAuth"
+                                "$ref": "#/definitions/codersdk.TemplateVersionExternalAuth"
                             }
                         }
                     }
@@ -2934,6 +3112,41 @@ const docTemplate = `{
                 }
             }
         },
+        "/templateversions/{templateversion}/unarchive": {
+            "post": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Templates"
+                ],
+                "summary": "Unarchive template version",
+                "operationId": "unarchive-template-version",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "format": "uuid",
+                        "description": "Template version ID",
+                        "name": "templateversion",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.Response"
+                        }
+                    }
+                }
+            }
+        },
         "/templateversions/{templateversion}/variables": {
             "get": {
                 "security": [
@@ -3311,7 +3524,7 @@ const docTemplate = `{
                 "parameters": [
                     {
                         "type": "string",
-                        "description": "User ID, name, or me",
+                        "description": "User ID, username, or me",
                         "name": "user",
                         "in": "path",
                         "required": true
@@ -4499,6 +4712,53 @@ const docTemplate = `{
                 }
             }
         },
+        "/workspaceagents/me/external-auth": {
+            "get": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Agents"
+                ],
+                "summary": "Get workspace agent external auth",
+                "operationId": "get-workspace-agent-external-auth",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Match",
+                        "name": "match",
+                        "in": "query",
+                        "required": true
+                    },
+                    {
+                        "type": "string",
+                        "description": "Provider ID",
+                        "name": "id",
+                        "in": "query",
+                        "required": true
+                    },
+                    {
+                        "type": "boolean",
+                        "description": "Wait for a new token to be issued",
+                        "name": "listen",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/agentsdk.ExternalAuthResponse"
+                        }
+                    }
+                }
+            }
+        },
         "/workspaceagents/me/gitauth": {
             "get": {
                 "security": [
@@ -4512,14 +4772,20 @@ const docTemplate = `{
                 "tags": [
                     "Agents"
                 ],
-                "summary": "Get workspace agent Git auth",
-                "operationId": "get-workspace-agent-git-auth",
+                "summary": "Removed: Get workspace agent git auth",
+                "operationId": "removed-get-workspace-agent-git-auth",
                 "parameters": [
                     {
                         "type": "string",
-                        "format": "uri",
-                        "description": "Git URL",
-                        "name": "url",
+                        "description": "Match",
+                        "name": "match",
+                        "in": "query",
+                        "required": true
+                    },
+                    {
+                        "type": "string",
+                        "description": "Provider ID",
+                        "name": "id",
                         "in": "query",
                         "required": true
                     },
@@ -4534,7 +4800,7 @@ const docTemplate = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/agentsdk.GitAuthResponse"
+                            "$ref": "#/definitions/agentsdk.ExternalAuthResponse"
                         }
                     }
                 }
@@ -4629,7 +4895,7 @@ const docTemplate = `{
                 }
             }
         },
-        "/workspaceagents/me/metadata/{key}": {
+        "/workspaceagents/me/metadata": {
             "post": {
                 "security": [
                     {
@@ -4651,7 +4917,46 @@ const docTemplate = `{
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/agentsdk.PostMetadataRequest"
+                            "type": "array",
+                            "items": {
+                                "$ref": "#/definitions/agentsdk.PostMetadataRequest"
+                            }
+                        }
+                    }
+                ],
+                "responses": {
+                    "204": {
+                        "description": "Success"
+                    }
+                },
+                "x-apidocgen": {
+                    "skip": true
+                }
+            }
+        },
+        "/workspaceagents/me/metadata/{key}": {
+            "post": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Agents"
+                ],
+                "summary": "Removed: Submit workspace agent metadata",
+                "operationId": "removed-submit-workspace-agent-metadata",
+                "parameters": [
+                    {
+                        "description": "Workspace agent metadata request",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/agentsdk.PostMetadataRequestDeprecated"
                         }
                     },
                     {
@@ -5479,6 +5784,42 @@ const docTemplate = `{
                 }
             }
         },
+        "/workspaceproxies/me/app-stats": {
+            "post": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Enterprise"
+                ],
+                "summary": "Report workspace app stats",
+                "operationId": "report-workspace-app-stats",
+                "parameters": [
+                    {
+                        "description": "Report app stats request",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/wsproxysdk.ReportAppStatsRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "204": {
+                        "description": "No Content"
+                    }
+                },
+                "x-apidocgen": {
+                    "skip": true
+                }
+            }
+        },
         "/workspaceproxies/me/coordinate": {
             "get": {
                 "security": [
@@ -5900,6 +6241,47 @@ const docTemplate = `{
                 }
             }
         },
+        "/workspaces/{workspace}/autoupdates": {
+            "put": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "consumes": [
+                    "application/json"
+                ],
+                "tags": [
+                    "Workspaces"
+                ],
+                "summary": "Update workspace automatic updates by ID",
+                "operationId": "update-workspace-automatic-updates-by-id",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "format": "uuid",
+                        "description": "Workspace ID",
+                        "name": "workspace",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "description": "Automatic updates request",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.UpdateWorkspaceAutomaticUpdatesRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "204": {
+                        "description": "No Content"
+                    }
+                }
+            }
+        },
         "/workspaces/{workspace}/builds": {
             "get": {
                 "security": [
@@ -6009,7 +6391,7 @@ const docTemplate = `{
                 }
             }
         },
-        "/workspaces/{workspace}/extend": {
+        "/workspaces/{workspace}/dormant": {
             "put": {
                 "security": [
                     {
@@ -6025,8 +6407,8 @@ const docTemplate = `{
                 "tags": [
                     "Workspaces"
                 ],
-                "summary": "Extend workspace deadline by ID",
-                "operationId": "extend-workspace-deadline-by-id",
+                "summary": "Update workspace dormancy status by id.",
+                "operationId": "update-workspace-dormancy-status-by-id",
                 "parameters": [
                     {
                         "type": "string",
@@ -6037,12 +6419,12 @@ const docTemplate = `{
                         "required": true
                     },
                     {
-                        "description": "Extend deadline update request",
+                        "description": "Make a workspace dormant or active",
                         "name": "request",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/codersdk.PutExtendWorkspaceRequest"
+                            "$ref": "#/definitions/codersdk.UpdateWorkspaceDormancy"
                         }
                     }
                 ],
@@ -6050,13 +6432,13 @@ const docTemplate = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/codersdk.Response"
+                            "$ref": "#/definitions/codersdk.Workspace"
                         }
                     }
                 }
             }
         },
-        "/workspaces/{workspace}/lock": {
+        "/workspaces/{workspace}/extend": {
             "put": {
                 "security": [
                     {
@@ -6072,8 +6454,8 @@ const docTemplate = `{
                 "tags": [
                     "Workspaces"
                 ],
-                "summary": "Update workspace lock by id.",
-                "operationId": "update-workspace-lock-by-id",
+                "summary": "Extend workspace deadline by ID",
+                "operationId": "extend-workspace-deadline-by-id",
                 "parameters": [
                     {
                         "type": "string",
@@ -6084,12 +6466,12 @@ const docTemplate = `{
                         "required": true
                     },
                     {
-                        "description": "Lock or unlock a workspace",
+                        "description": "Extend deadline update request",
                         "name": "request",
                         "in": "body",
                         "required": true,
                         "schema": {
-                            "$ref": "#/definitions/codersdk.UpdateWorkspaceLock"
+                            "$ref": "#/definitions/codersdk.PutExtendWorkspaceRequest"
                         }
                     }
                 ],
@@ -6278,16 +6660,27 @@ const docTemplate = `{
                 }
             }
         },
-        "agentsdk.GitAuthResponse": {
+        "agentsdk.ExternalAuthResponse": {
             "type": "object",
             "properties": {
+                "access_token": {
+                    "type": "string"
+                },
                 "password": {
                     "type": "string"
                 },
+                "token_extra": {
+                    "type": "object",
+                    "additionalProperties": true
+                },
+                "type": {
+                    "type": "string"
+                },
                 "url": {
                     "type": "string"
                 },
                 "username": {
+                    "description": "Deprecated: Only supported on ` + "`" + `/workspaceagents/me/gitauth` + "`" + `\nfor backwards compatibility.",
                     "type": "string"
                 }
             }
@@ -6325,9 +6718,6 @@ const docTemplate = `{
                 },
                 "output": {
                     "type": "string"
-                },
-                "source": {
-                    "$ref": "#/definitions/codersdk.WorkspaceAgentLogSource"
                 }
             }
         },
@@ -6343,6 +6733,9 @@ const docTemplate = `{
                         "$ref": "#/definitions/codersdk.WorkspaceApp"
                     }
                 },
+                "derp_force_websockets": {
+                    "type": "boolean"
+                },
                 "derpmap": {
                     "$ref": "#/definitions/tailcfg.DERPMap"
                 },
@@ -6371,19 +6764,35 @@ const docTemplate = `{
                 "motd_file": {
                     "type": "string"
                 },
-                "shutdown_script": {
-                    "type": "string"
+                "scripts": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.WorkspaceAgentScript"
+                    }
                 },
-                "shutdown_script_timeout": {
+                "vscode_port_proxy_uri": {
+                    "type": "string"
+                }
+            }
+        },
+        "agentsdk.Metadata": {
+            "type": "object",
+            "properties": {
+                "age": {
+                    "description": "Age is the number of seconds since the metadata was collected.\nIt is provided in addition to CollectedAt to protect against clock skew.",
                     "type": "integer"
                 },
-                "startup_script": {
+                "collected_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "error": {
                     "type": "string"
                 },
-                "startup_script_timeout": {
-                    "type": "integer"
+                "key": {
+                    "type": "string"
                 },
-                "vscode_port_proxy_uri": {
+                "value": {
                     "type": "string"
                 }
             }
@@ -6391,6 +6800,9 @@ const docTemplate = `{
         "agentsdk.PatchLogs": {
             "type": "object",
             "properties": {
+                "log_source_id": {
+                    "type": "string"
+                },
                 "logs": {
                     "type": "array",
                     "items": {
@@ -6423,6 +6835,17 @@ const docTemplate = `{
             }
         },
         "agentsdk.PostMetadataRequest": {
+            "type": "object",
+            "properties": {
+                "metadata": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/agentsdk.Metadata"
+                    }
+                }
+            }
+        },
+        "agentsdk.PostMetadataRequestDeprecated": {
             "type": "object",
             "properties": {
                 "age": {
@@ -6447,8 +6870,11 @@ const docTemplate = `{
                 "expanded_directory": {
                     "type": "string"
                 },
-                "subsystem": {
-                    "$ref": "#/definitions/codersdk.AgentSubsystem"
+                "subsystems": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.AgentSubsystem"
+                    }
                 },
                 "version": {
                     "type": "string"
@@ -6624,13 +7050,16 @@ const docTemplate = `{
                 }
             }
         },
-        "clibase.Struct-array_codersdk_GitAuthConfig": {
+        "clibase.Regexp": {
+            "type": "object"
+        },
+        "clibase.Struct-array_codersdk_ExternalAuthConfig": {
             "type": "object",
             "properties": {
                 "value": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/codersdk.GitAuthConfig"
+                        "$ref": "#/definitions/codersdk.ExternalAuthConfig"
                     }
                 }
             }
@@ -6900,10 +7329,14 @@ const docTemplate = `{
         "codersdk.AgentSubsystem": {
             "type": "string",
             "enum": [
-                "envbox"
+                "envbox",
+                "envbuilder",
+                "exectrace"
             ],
             "x-enum-varnames": [
-                "AgentSubsystemEnvbox"
+                "AgentSubsystemEnvbox",
+                "AgentSubsystemEnvbuilder",
+                "AgentSubsystemExectrace"
             ]
         },
         "codersdk.AppHostResponse": {
@@ -6918,6 +7351,9 @@ const docTemplate = `{
         "codersdk.AppearanceConfig": {
             "type": "object",
             "properties": {
+                "application_name": {
+                    "type": "string"
+                },
                 "logo_url": {
                     "type": "string"
                 },
@@ -6932,6 +7368,15 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.ArchiveTemplateVersionsRequest": {
+            "type": "object",
+            "properties": {
+                "all": {
+                    "description": "By default, only failed versions are archived. Set this to true\nto archive all unused versions regardless of job status.",
+                    "type": "boolean"
+                }
+            }
+        },
         "codersdk.AssignableRoles": {
             "type": "object",
             "properties": {
@@ -7156,6 +7601,17 @@ const docTemplate = `{
                 "type": "boolean"
             }
         },
+        "codersdk.AutomaticUpdates": {
+            "type": "string",
+            "enum": [
+                "always",
+                "never"
+            ],
+            "x-enum-varnames": [
+                "AutomaticUpdatesAlways",
+                "AutomaticUpdatesNever"
+            ]
+        },
         "codersdk.BuildInfoResponse": {
             "type": "object",
             "properties": {
@@ -7304,10 +7760,30 @@ const docTemplate = `{
                     "description": "Allow users to cancel in-progress workspace jobs.\n*bool as the default value is \"true\".",
                     "type": "boolean"
                 },
+                "autostart_requirement": {
+                    "description": "AutostartRequirement allows optionally specifying the autostart allowed days\nfor workspaces created from this template. This is an enterprise feature.",
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/codersdk.TemplateAutostartRequirement"
+                        }
+                    ]
+                },
+                "autostop_requirement": {
+                    "description": "AutostopRequirement allows optionally specifying the autostop requirement\nfor workspaces created from this template. This is an enterprise feature.",
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/codersdk.TemplateAutostopRequirement"
+                        }
+                    ]
+                },
                 "default_ttl_ms": {
                     "description": "DefaultTTLMillis allows optionally specifying the default TTL\nfor all workspaces created from this template.",
                     "type": "integer"
                 },
+                "delete_ttl_ms": {
+                    "description": "TimeTilDormantAutoDeleteMillis allows optionally specifying the max lifetime before Coder\npermanently deletes dormant workspaces created from this template.",
+                    "type": "integer"
+                },
                 "description": {
                     "description": "Description is a description of what the template contains. It must be\nless than 128 bytes.",
                     "type": "string"
@@ -7320,6 +7796,10 @@ const docTemplate = `{
                     "description": "DisplayName is the displayed name of the template.",
                     "type": "string"
                 },
+                "dormant_ttl_ms": {
+                    "description": "TimeTilDormantMillis allows optionally specifying the max lifetime before Coder\nlocks inactive workspaces created from this template.",
+                    "type": "integer"
+                },
                 "failure_ttl_ms": {
                     "description": "FailureTTLMillis allows optionally specifying the max lifetime before Coder\nstops all resources for failed workspaces created from this template.",
                     "type": "integer"
@@ -7328,29 +7808,17 @@ const docTemplate = `{
                     "description": "Icon is a relative path or external URL that specifies\nan icon to be displayed in the dashboard.",
                     "type": "string"
                 },
-                "inactivity_ttl_ms": {
-                    "description": "InactivityTTLMillis allows optionally specifying the max lifetime before Coder\nlocks inactive workspaces created from this template.",
-                    "type": "integer"
-                },
-                "locked_ttl_ms": {
-                    "description": "LockedTTLMillis allows optionally specifying the max lifetime before Coder\npermanently deletes locked workspaces created from this template.",
-                    "type": "integer"
-                },
                 "max_ttl_ms": {
-                    "description": "TODO(@dean): remove max_ttl once restart_requirement is matured",
+                    "description": "TODO(@dean): remove max_ttl once autostop_requirement is matured",
                     "type": "integer"
                 },
                 "name": {
                     "description": "Name is the name of the template.",
                     "type": "string"
                 },
-                "restart_requirement": {
-                    "description": "RestartRequirement allows optionally specifying the restart requirement\nfor workspaces created from this template. This is an enterprise feature.",
-                    "allOf": [
-                        {
-                            "$ref": "#/definitions/codersdk.TemplateRestartRequirement"
-                        }
-                    ]
+                "require_active_version": {
+                    "description": "RequireActiveVersion mandates that workspaces are built with the active\ntemplate version.",
+                    "type": "boolean"
                 },
                 "template_version_id": {
                     "description": "VersionID is an in-progress or completed job to use as an initial version\nof the template.\n\nThis is required on creation to enable a user-flow of validating a\ntemplate works. There is no reason the data-model cannot support empty\ntemplates, but it doesn't make sense for users.",
@@ -7526,13 +7994,21 @@ const docTemplate = `{
             ],
             "properties": {
                 "disable_login": {
-                    "description": "DisableLogin sets the user's login type to 'none'. This prevents the user\nfrom being able to use a password or any other authentication method to login.",
+                    "description": "DisableLogin sets the user's login type to 'none'. This prevents the user\nfrom being able to use a password or any other authentication method to login.\nDeprecated: Set UserLoginType=LoginTypeDisabled instead.",
                     "type": "boolean"
                 },
                 "email": {
                     "type": "string",
                     "format": "email"
                 },
+                "login_type": {
+                    "description": "UserLoginType defaults to LoginTypePassword.",
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/codersdk.LoginType"
+                        }
+                    ]
+                },
                 "organization_id": {
                     "type": "string",
                     "format": "uuid"
@@ -7621,10 +8097,12 @@ const docTemplate = `{
         "codersdk.CreateWorkspaceRequest": {
             "type": "object",
             "required": [
-                "name",
-                "template_id"
+                "name"
             ],
             "properties": {
+                "automatic_updates": {
+                    "$ref": "#/definitions/codersdk.AutomaticUpdates"
+                },
                 "autostart_schedule": {
                     "type": "string"
                 },
@@ -7632,13 +8110,19 @@ const docTemplate = `{
                     "type": "string"
                 },
                 "rich_parameter_values": {
-                    "description": "ParameterValues allows for additional parameters to be provided\nduring the initial provision.",
+                    "description": "RichParameterValues allows for additional parameters to be provided\nduring the initial provision.",
                     "type": "array",
                     "items": {
                         "$ref": "#/definitions/codersdk.WorkspaceBuildParameter"
                     }
                 },
                 "template_id": {
+                    "description": "TemplateID specifies which template should be used for creating the workspace.",
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "template_version_id": {
+                    "description": "TemplateVersionID can be used to specify a specific version of a template for creating the workspace.",
                     "type": "string",
                     "format": "uuid"
                 },
@@ -7690,6 +8174,9 @@ const docTemplate = `{
                 "block_direct": {
                     "type": "boolean"
                 },
+                "force_websockets": {
+                    "type": "boolean"
+                },
                 "path": {
                     "type": "string"
                 },
@@ -7854,8 +8341,14 @@ const docTemplate = `{
                         "type": "string"
                     }
                 },
-                "git_auth": {
-                    "$ref": "#/definitions/clibase.Struct-array_codersdk_GitAuthConfig"
+                "external_auth": {
+                    "$ref": "#/definitions/clibase.Struct-array_codersdk_ExternalAuthConfig"
+                },
+                "external_token_encryption_keys": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
                 },
                 "http_address": {
                     "description": "HTTPAddress is a string because it may be set to zero to disable.",
@@ -7960,6 +8453,9 @@ const docTemplate = `{
                 "verbose": {
                     "type": "boolean"
                 },
+                "web_terminal_renderer": {
+                    "type": "string"
+                },
                 "wgtunnel_host": {
                     "type": "string"
                 },
@@ -7971,6 +8467,23 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.DisplayApp": {
+            "type": "string",
+            "enum": [
+                "vscode",
+                "vscode_insiders",
+                "web_terminal",
+                "port_forwarding_helper",
+                "ssh_helper"
+            ],
+            "x-enum-varnames": [
+                "DisplayAppVSCodeDesktop",
+                "DisplayAppVSCodeInsiders",
+                "DisplayAppWebTerminal",
+                "DisplayAppPortForward",
+                "DisplayAppSSH"
+            ]
+        },
         "codersdk.Entitlement": {
             "type": "string",
             "enum": [
@@ -8002,6 +8515,10 @@ const docTemplate = `{
                 "has_license": {
                     "type": "boolean"
                 },
+                "refreshed_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
                 "require_telemetry": {
                     "type": "boolean"
                 },
@@ -8023,58 +8540,23 @@ const docTemplate = `{
                 "workspace_actions",
                 "tailnet_pg_coordinator",
                 "single_tailnet",
-                "template_restart_requirement",
-                "deployment_health_page"
+                "template_autostop_requirement",
+                "deployment_health_page",
+                "dashboard_theme",
+                "template_update_policies"
             ],
             "x-enum-varnames": [
                 "ExperimentMoons",
                 "ExperimentWorkspaceActions",
                 "ExperimentTailnetPGCoordinator",
                 "ExperimentSingleTailnet",
-                "ExperimentTemplateRestartRequirement",
-                "ExperimentDeploymentHealthPage"
+                "ExperimentTemplateAutostopRequirement",
+                "ExperimentDeploymentHealthPage",
+                "ExperimentDashboardTheme",
+                "ExperimentTemplateUpdatePolicies"
             ]
         },
-        "codersdk.Feature": {
-            "type": "object",
-            "properties": {
-                "actual": {
-                    "type": "integer"
-                },
-                "enabled": {
-                    "type": "boolean"
-                },
-                "entitlement": {
-                    "$ref": "#/definitions/codersdk.Entitlement"
-                },
-                "limit": {
-                    "type": "integer"
-                }
-            }
-        },
-        "codersdk.GenerateAPIKeyResponse": {
-            "type": "object",
-            "properties": {
-                "key": {
-                    "type": "string"
-                }
-            }
-        },
-        "codersdk.GetUsersResponse": {
-            "type": "object",
-            "properties": {
-                "count": {
-                    "type": "integer"
-                },
-                "users": {
-                    "type": "array",
-                    "items": {
-                        "$ref": "#/definitions/codersdk.User"
-                    }
-                }
-            }
-        },
-        "codersdk.GitAuth": {
+        "codersdk.ExternalAuth": {
             "type": "object",
             "properties": {
                 "app_install_url": {
@@ -8091,31 +8573,31 @@ const docTemplate = `{
                 "device": {
                     "type": "boolean"
                 },
+                "display_name": {
+                    "type": "string"
+                },
                 "installations": {
                     "description": "AppInstallations are the installations that the user has access to.",
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/codersdk.GitAuthAppInstallation"
+                        "$ref": "#/definitions/codersdk.ExternalAuthAppInstallation"
                     }
                 },
-                "type": {
-                    "type": "string"
-                },
                 "user": {
                     "description": "User is the user that authenticated with the provider.",
                     "allOf": [
                         {
-                            "$ref": "#/definitions/codersdk.GitAuthUser"
+                            "$ref": "#/definitions/codersdk.ExternalAuthUser"
                         }
                     ]
                 }
             }
         },
-        "codersdk.GitAuthAppInstallation": {
+        "codersdk.ExternalAuthAppInstallation": {
             "type": "object",
             "properties": {
                 "account": {
-                    "$ref": "#/definitions/codersdk.GitAuthUser"
+                    "$ref": "#/definitions/codersdk.ExternalAuthUser"
                 },
                 "configure_url": {
                     "type": "string"
@@ -8125,7 +8607,7 @@ const docTemplate = `{
                 }
             }
         },
-        "codersdk.GitAuthConfig": {
+        "codersdk.ExternalAuthConfig": {
             "type": "object",
             "properties": {
                 "app_install_url": {
@@ -8146,13 +8628,29 @@ const docTemplate = `{
                 "device_flow": {
                     "type": "boolean"
                 },
+                "display_icon": {
+                    "description": "DisplayIcon is a URL to an icon to display in the UI.",
+                    "type": "string"
+                },
+                "display_name": {
+                    "description": "DisplayName is shown in the UI to identify the auth config.",
+                    "type": "string"
+                },
+                "extra_token_keys": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
                 "id": {
+                    "description": "ID is a unique identifier for the auth config.\nIt defaults to ` + "`" + `type` + "`" + ` when not provided.",
                     "type": "string"
                 },
                 "no_refresh": {
                     "type": "boolean"
                 },
                 "regex": {
+                    "description": "Regex allows API requesters to match an auth config by\na string (e.g. coder.com) instead of by it's type.\n\nGit clone makes use of this by parsing the URL from:\n'Username for \"https://github.com\":'\nAnd sending it to the Coder server to match against the Regex.",
                     "type": "string"
                 },
                 "scopes": {
@@ -8165,6 +8663,7 @@ const docTemplate = `{
                     "type": "string"
                 },
                 "type": {
+                    "description": "Type is the type of external auth config.",
                     "type": "string"
                 },
                 "validate_url": {
@@ -8172,7 +8671,7 @@ const docTemplate = `{
                 }
             }
         },
-        "codersdk.GitAuthDevice": {
+        "codersdk.ExternalAuthDevice": {
             "type": "object",
             "properties": {
                 "device_code": {
@@ -8192,7 +8691,7 @@ const docTemplate = `{
                 }
             }
         },
-        "codersdk.GitAuthUser": {
+        "codersdk.ExternalAuthUser": {
             "type": "object",
             "properties": {
                 "avatar_url": {
@@ -8209,20 +8708,44 @@ const docTemplate = `{
                 }
             }
         },
-        "codersdk.GitProvider": {
-            "type": "string",
-            "enum": [
-                "azure-devops",
-                "github",
-                "gitlab",
-                "bitbucket"
-            ],
-            "x-enum-varnames": [
-                "GitProviderAzureDevops",
-                "GitProviderGitHub",
-                "GitProviderGitLab",
-                "GitProviderBitBucket"
-            ]
+        "codersdk.Feature": {
+            "type": "object",
+            "properties": {
+                "actual": {
+                    "type": "integer"
+                },
+                "enabled": {
+                    "type": "boolean"
+                },
+                "entitlement": {
+                    "$ref": "#/definitions/codersdk.Entitlement"
+                },
+                "limit": {
+                    "type": "integer"
+                }
+            }
+        },
+        "codersdk.GenerateAPIKeyResponse": {
+            "type": "object",
+            "properties": {
+                "key": {
+                    "type": "string"
+                }
+            }
+        },
+        "codersdk.GetUsersResponse": {
+            "type": "object",
+            "properties": {
+                "count": {
+                    "type": "integer"
+                },
+                "users": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.User"
+                    }
+                }
+            }
         },
         "codersdk.GitSSHKey": {
             "type": "object",
@@ -8272,9 +8795,23 @@ const docTemplate = `{
                 },
                 "quota_allowance": {
                     "type": "integer"
+                },
+                "source": {
+                    "$ref": "#/definitions/codersdk.GroupSource"
                 }
             }
         },
+        "codersdk.GroupSource": {
+            "type": "string",
+            "enum": [
+                "user",
+                "oidc"
+            ],
+            "x-enum-varnames": [
+                "GroupSourceUser",
+                "GroupSourceOIDC"
+            ]
+        },
         "codersdk.Healthcheck": {
             "type": "object",
             "properties": {
@@ -8295,10 +8832,12 @@ const docTemplate = `{
         "codersdk.InsightsReportInterval": {
             "type": "string",
             "enum": [
-                "day"
+                "day",
+                "week"
             ],
             "x-enum-varnames": [
-                "InsightsReportIntervalDay"
+                "InsightsReportIntervalDay",
+                "InsightsReportIntervalWeek"
             ]
         },
         "codersdk.IssueReconnectingPTYSignedTokenRequest": {
@@ -8329,11 +8868,9 @@ const docTemplate = `{
         "codersdk.JobErrorCode": {
             "type": "string",
             "enum": [
-                "MISSING_TEMPLATE_PARAMETER",
                 "REQUIRED_TEMPLATE_VARIABLES"
             ],
             "x-enum-varnames": [
-                "MissingTemplateParameter",
                 "RequiredTemplateVariables"
             ]
         },
@@ -8423,6 +8960,7 @@ const docTemplate = `{
         "codersdk.LoginType": {
             "type": "string",
             "enum": [
+                "",
                 "password",
                 "github",
                 "oidc",
@@ -8430,6 +8968,7 @@ const docTemplate = `{
                 "none"
             ],
             "x-enum-varnames": [
+                "LoginTypeUnknown",
                 "LoginTypePassword",
                 "LoginTypeGithub",
                 "LoginTypeOIDC",
@@ -8566,9 +9105,16 @@ const docTemplate = `{
                 "auth_url_params": {
                     "type": "object"
                 },
+                "client_cert_file": {
+                    "type": "string"
+                },
                 "client_id": {
                     "type": "string"
                 },
+                "client_key_file": {
+                    "description": "ClientKeyFile \u0026 ClientCertFile are used in place of ClientSecret for PKI auth.",
+                    "type": "string"
+                },
                 "client_secret": {
                     "type": "string"
                 },
@@ -8581,9 +9127,15 @@ const docTemplate = `{
                 "email_field": {
                     "type": "string"
                 },
+                "group_auto_create": {
+                    "type": "boolean"
+                },
                 "group_mapping": {
                     "type": "object"
                 },
+                "group_regex_filter": {
+                    "$ref": "#/definitions/clibase.Regexp"
+                },
                 "groups_field": {
                     "type": "string"
                 },
@@ -8678,6 +9230,35 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.PatchGroupRequest": {
+            "type": "object",
+            "properties": {
+                "add_users": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
+                "avatar_url": {
+                    "type": "string"
+                },
+                "display_name": {
+                    "type": "string"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "quota_allowance": {
+                    "type": "integer"
+                },
+                "remove_users": {
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                }
+            }
+        },
         "codersdk.PatchTemplateVersionRequest": {
             "type": "object",
             "properties": {
@@ -8753,6 +9334,9 @@ const docTemplate = `{
                 "daemon_poll_jitter": {
                     "type": "integer"
                 },
+                "daemon_psk": {
+                    "type": "string"
+                },
                 "daemons": {
                     "type": "integer"
                 },
@@ -8820,7 +9404,6 @@ const docTemplate = `{
                 },
                 "error_code": {
                     "enum": [
-                        "MISSING_TEMPLATE_PARAMETER",
                         "REQUIRED_TEMPLATE_VARIABLES"
                     ],
                     "allOf": [
@@ -8917,7 +9500,8 @@ const docTemplate = `{
                 "succeeded",
                 "canceling",
                 "canceled",
-                "failed"
+                "failed",
+                "unknown"
             ],
             "x-enum-varnames": [
                 "ProvisionerJobPending",
@@ -8925,7 +9509,8 @@ const docTemplate = `{
                 "ProvisionerJobSucceeded",
                 "ProvisionerJobCanceling",
                 "ProvisionerJobCanceled",
-                "ProvisionerJobFailed"
+                "ProvisionerJobFailed",
+                "ProvisionerJobUnknown"
             ]
         },
         "codersdk.ProvisionerLogLevel": {
@@ -9152,7 +9737,9 @@ const docTemplate = `{
                 "api_key",
                 "group",
                 "license",
-                "convert_login"
+                "convert_login",
+                "workspace_proxy",
+                "organization"
             ],
             "x-enum-varnames": [
                 "ResourceTypeTemplate",
@@ -9164,7 +9751,9 @@ const docTemplate = `{
                 "ResourceTypeAPIKey",
                 "ResourceTypeGroup",
                 "ResourceTypeLicense",
-                "ResourceTypeConvertLogin"
+                "ResourceTypeConvertLogin",
+                "ResourceTypeWorkspaceProxy",
+                "ResourceTypeOrganization"
             ]
         },
         "codersdk.Response": {
@@ -9351,6 +9940,17 @@ const docTemplate = `{
                 "allow_user_cancel_workspace_jobs": {
                     "type": "boolean"
                 },
+                "autostart_requirement": {
+                    "$ref": "#/definitions/codersdk.TemplateAutostartRequirement"
+                },
+                "autostop_requirement": {
+                    "description": "AutostopRequirement and AutostartRequirement are enterprise features. Its\nvalue is only used if your license is entitled to use the advanced template\nscheduling feature.",
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/codersdk.TemplateAutostopRequirement"
+                        }
+                    ]
+                },
                 "build_time_stats": {
                     "$ref": "#/definitions/codersdk.TemplateBuildTimeStats"
                 },
@@ -9375,7 +9975,7 @@ const docTemplate = `{
                     "type": "string"
                 },
                 "failure_ttl_ms": {
-                    "description": "FailureTTLMillis, InactivityTTLMillis, and LockedTTLMillis are enterprise-only. Their\nvalues are used if your license is entitled to use the advanced\ntemplate scheduling feature.",
+                    "description": "FailureTTLMillis, TimeTilDormantMillis, and TimeTilDormantAutoDeleteMillis are enterprise-only. Their\nvalues are used if your license is entitled to use the advanced\ntemplate scheduling feature.",
                     "type": "integer"
                 },
                 "icon": {
@@ -9385,14 +9985,8 @@ const docTemplate = `{
                     "type": "string",
                     "format": "uuid"
                 },
-                "inactivity_ttl_ms": {
-                    "type": "integer"
-                },
-                "locked_ttl_ms": {
-                    "type": "integer"
-                },
                 "max_ttl_ms": {
-                    "description": "TODO(@dean): remove max_ttl once restart_requirement is matured",
+                    "description": "TODO(@dean): remove max_ttl once autostop_requirement is matured",
                     "type": "integer"
                 },
                 "name": {
@@ -9408,13 +10002,15 @@ const docTemplate = `{
                         "terraform"
                     ]
                 },
-                "restart_requirement": {
-                    "description": "RestartRequirement is an enterprise feature. Its value is only used if\nyour license is entitled to use the advanced template scheduling feature.",
-                    "allOf": [
-                        {
-                            "$ref": "#/definitions/codersdk.TemplateRestartRequirement"
-                        }
-                    ]
+                "require_active_version": {
+                    "description": "RequireActiveVersion mandates that workspaces are built with the active\ntemplate version.",
+                    "type": "boolean"
+                },
+                "time_til_dormant_autodelete_ms": {
+                    "type": "integer"
+                },
+                "time_til_dormant_ms": {
+                    "type": "integer"
                 },
                 "updated_at": {
                     "type": "string",
@@ -9460,12 +10056,60 @@ const docTemplate = `{
         "codersdk.TemplateAppsType": {
             "type": "string",
             "enum": [
-                "builtin"
+                "builtin",
+                "app"
             ],
             "x-enum-varnames": [
-                "TemplateAppsTypeBuiltin"
+                "TemplateAppsTypeBuiltin",
+                "TemplateAppsTypeApp"
             ]
         },
+        "codersdk.TemplateAutostartRequirement": {
+            "type": "object",
+            "properties": {
+                "days_of_week": {
+                    "description": "DaysOfWeek is a list of days of the week in which autostart is allowed\nto happen. If no days are specified, autostart is not allowed.",
+                    "type": "array",
+                    "items": {
+                        "type": "string",
+                        "enum": [
+                            "monday",
+                            "tuesday",
+                            "wednesday",
+                            "thursday",
+                            "friday",
+                            "saturday",
+                            "sunday"
+                        ]
+                    }
+                }
+            }
+        },
+        "codersdk.TemplateAutostopRequirement": {
+            "type": "object",
+            "properties": {
+                "days_of_week": {
+                    "description": "DaysOfWeek is a list of days of the week on which restarts are required.\nRestarts happen within the user's quiet hours (in their configured\ntimezone). If no days are specified, restarts are not required. Weekdays\ncannot be specified twice.\n\nRestarts will only happen on weekdays in this list on weeks which line up\nwith Weeks.",
+                    "type": "array",
+                    "items": {
+                        "type": "string",
+                        "enum": [
+                            "monday",
+                            "tuesday",
+                            "wednesday",
+                            "thursday",
+                            "friday",
+                            "saturday",
+                            "sunday"
+                        ]
+                    }
+                },
+                "weeks": {
+                    "description": "Weeks is the number of weeks between required restarts. Weeks are synced\nacross all workspaces (and Coder deployments) using modulo math on a\nhardcoded epoch week of January 2nd, 2023 (the first Monday of 2023).\nValues of 0 or 1 indicate weekly restarts. Values of 2 indicate\nfortnightly restarts, etc.",
+                    "type": "integer"
+                }
+            }
+        },
         "codersdk.TemplateBuildTimeStats": {
             "type": "object",
             "additionalProperties": {
@@ -9514,7 +10158,12 @@ const docTemplate = `{
                     "format": "date-time"
                 },
                 "interval": {
-                    "$ref": "#/definitions/codersdk.InsightsReportInterval"
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/codersdk.InsightsReportInterval"
+                        }
+                    ],
+                    "example": "week"
                 },
                 "start_time": {
                     "type": "string",
@@ -9582,6 +10231,9 @@ const docTemplate = `{
         "codersdk.TemplateParameterUsage": {
             "type": "object",
             "properties": {
+                "description": {
+                    "type": "string"
+                },
                 "display_name": {
                     "type": "string"
                 },
@@ -9601,6 +10253,9 @@ const docTemplate = `{
                         "format": "uuid"
                     }
                 },
+                "type": {
+                    "type": "string"
+                },
                 "values": {
                     "type": "array",
                     "items": {
@@ -9620,31 +10275,6 @@ const docTemplate = `{
                 }
             }
         },
-        "codersdk.TemplateRestartRequirement": {
-            "type": "object",
-            "properties": {
-                "days_of_week": {
-                    "description": "DaysOfWeek is a list of days of the week on which restarts are required.\nRestarts happen within the user's quiet hours (in their configured\ntimezone). If no days are specified, restarts are not required. Weekdays\ncannot be specified twice.\n\nRestarts will only happen on weekdays in this list on weeks which line up\nwith Weeks.",
-                    "type": "array",
-                    "items": {
-                        "type": "string",
-                        "enum": [
-                            "monday",
-                            "tuesday",
-                            "wednesday",
-                            "thursday",
-                            "friday",
-                            "saturday",
-                            "sunday"
-                        ]
-                    }
-                },
-                "weeks": {
-                    "description": "Weeks is the number of weeks between required restarts. Weeks are synced\nacross all workspaces (and Coder deployments) using modulo math on a\nhardcoded epoch week of January 2nd, 2023 (the first Monday of 2023).\nValues of 0 or 1 indicate weekly restarts. Values of 2 indicate\nfortnightly restarts, etc.",
-                    "type": "integer"
-                }
-            }
-        },
         "codersdk.TemplateRole": {
             "type": "string",
             "enum": [
@@ -9733,6 +10363,9 @@ const docTemplate = `{
         "codersdk.TemplateVersion": {
             "type": "object",
             "properties": {
+                "archived": {
+                    "type": "boolean"
+                },
                 "created_at": {
                     "type": "string",
                     "format": "date-time"
@@ -9779,7 +10412,7 @@ const docTemplate = `{
                 }
             }
         },
-        "codersdk.TemplateVersionGitAuth": {
+        "codersdk.TemplateVersionExternalAuth": {
             "type": "object",
             "properties": {
                 "authenticate_url": {
@@ -9788,11 +10421,17 @@ const docTemplate = `{
                 "authenticated": {
                     "type": "boolean"
                 },
+                "display_icon": {
+                    "type": "string"
+                },
+                "display_name": {
+                    "type": "string"
+                },
                 "id": {
                     "type": "string"
                 },
                 "type": {
-                    "$ref": "#/definitions/codersdk.GitProvider"
+                    "type": "string"
                 }
             }
         },
@@ -9937,6 +10576,9 @@ const docTemplate = `{
                 "capture_logs": {
                     "type": "boolean"
                 },
+                "data_dog": {
+                    "type": "boolean"
+                },
                 "enable": {
                     "type": "boolean"
                 },
@@ -9973,6 +10615,9 @@ const docTemplate = `{
         "codersdk.UpdateAppearanceConfig": {
             "type": "object",
             "properties": {
+                "application_name": {
+                    "type": "string"
+                },
                 "logo_url": {
                     "type": "string"
                 },
@@ -10073,6 +10718,14 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.UpdateWorkspaceAutomaticUpdatesRequest": {
+            "type": "object",
+            "properties": {
+                "automatic_updates": {
+                    "$ref": "#/definitions/codersdk.AutomaticUpdates"
+                }
+            }
+        },
         "codersdk.UpdateWorkspaceAutostartRequest": {
             "type": "object",
             "properties": {
@@ -10081,10 +10734,10 @@ const docTemplate = `{
                 }
             }
         },
-        "codersdk.UpdateWorkspaceLock": {
+        "codersdk.UpdateWorkspaceDormancy": {
             "type": "object",
             "properties": {
-                "lock": {
+                "dormant": {
                     "type": "boolean"
                 }
             }
@@ -10175,6 +10828,67 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.UserActivity": {
+            "type": "object",
+            "properties": {
+                "avatar_url": {
+                    "type": "string",
+                    "format": "uri"
+                },
+                "seconds": {
+                    "type": "integer",
+                    "example": 80500
+                },
+                "template_ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "string",
+                        "format": "uuid"
+                    }
+                },
+                "user_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "username": {
+                    "type": "string"
+                }
+            }
+        },
+        "codersdk.UserActivityInsightsReport": {
+            "type": "object",
+            "properties": {
+                "end_time": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "start_time": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "template_ids": {
+                    "type": "array",
+                    "items": {
+                        "type": "string",
+                        "format": "uuid"
+                    }
+                },
+                "users": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.UserActivity"
+                    }
+                }
+            }
+        },
+        "codersdk.UserActivityInsightsResponse": {
+            "type": "object",
+            "properties": {
+                "report": {
+                    "$ref": "#/definitions/codersdk.UserActivityInsightsReport"
+                }
+            }
+        },
         "codersdk.UserLatency": {
             "type": "object",
             "properties": {
@@ -10329,6 +11043,17 @@ const docTemplate = `{
         "codersdk.Workspace": {
             "type": "object",
             "properties": {
+                "automatic_updates": {
+                    "enum": [
+                        "always",
+                        "never"
+                    ],
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/codersdk.AutomaticUpdates"
+                        }
+                    ]
+                },
                 "autostart_schedule": {
                     "type": "string"
                 },
@@ -10337,7 +11062,12 @@ const docTemplate = `{
                     "format": "date-time"
                 },
                 "deleting_at": {
-                    "description": "DeletingAt indicates the time of the upcoming workspace deletion, if applicable; otherwise it is nil.\nWorkspaces may have impending deletions if Template.InactivityTTL feature is turned on and the workspace is inactive.",
+                    "description": "DeletingAt indicates the time at which the workspace will be permanently deleted.\nA workspace is eligible for deletion if it is dormant (a non-nil dormant_at value)\nand a value has been specified for time_til_dormant_autodelete on its template.",
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "dormant_at": {
+                    "description": "DormantAt being non-nil indicates a workspace that is dormant.\nA dormant workspace is no longer accessible must be activated.\nIt is subject to deletion if it breaches\nthe duration of the time_til_ field on its template.",
                     "type": "string",
                     "format": "date-time"
                 },
@@ -10360,11 +11090,6 @@ const docTemplate = `{
                 "latest_build": {
                     "$ref": "#/definitions/codersdk.WorkspaceBuild"
                 },
-                "locked_at": {
-                    "description": "LockedAt being non-nil indicates a workspace that has been locked.\nA locked workspace is no longer accessible by a user and must be\nunlocked by an admin. It is subject to deletion if it breaches\nthe duration of the locked_ttl field on its template.",
-                    "type": "string",
-                    "format": "date-time"
-                },
                 "name": {
                     "type": "string"
                 },
@@ -10382,6 +11107,10 @@ const docTemplate = `{
                 "owner_name": {
                     "type": "string"
                 },
+                "template_active_version_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
                 "template_allow_user_cancel_workspace_jobs": {
                     "type": "boolean"
                 },
@@ -10398,6 +11127,9 @@ const docTemplate = `{
                 "template_name": {
                     "type": "string"
                 },
+                "template_require_active_version": {
+                    "type": "boolean"
+                },
                 "ttl_ms": {
                     "type": "integer"
                 },
@@ -10433,6 +11165,12 @@ const docTemplate = `{
                     "type": "string",
                     "format": "date-time"
                 },
+                "display_apps": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.DisplayApp"
+                    }
+                },
                 "environment_variables": {
                     "type": "object",
                     "additionalProperties": {
@@ -10475,9 +11213,11 @@ const docTemplate = `{
                 "lifecycle_state": {
                     "$ref": "#/definitions/codersdk.WorkspaceAgentLifecycle"
                 },
-                "login_before_ready": {
-                    "description": "Deprecated: Use StartupScriptBehavior instead.",
-                    "type": "boolean"
+                "log_sources": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.WorkspaceAgentLogSource"
+                    }
                 },
                 "logs_length": {
                     "type": "integer"
@@ -10499,31 +11239,32 @@ const docTemplate = `{
                     "type": "string",
                     "format": "uuid"
                 },
-                "shutdown_script": {
-                    "type": "string"
-                },
-                "shutdown_script_timeout_seconds": {
-                    "type": "integer"
+                "scripts": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.WorkspaceAgentScript"
+                    }
                 },
                 "started_at": {
                     "type": "string",
                     "format": "date-time"
                 },
-                "startup_script": {
-                    "type": "string"
-                },
                 "startup_script_behavior": {
-                    "$ref": "#/definitions/codersdk.WorkspaceAgentStartupScriptBehavior"
-                },
-                "startup_script_timeout_seconds": {
-                    "description": "StartupScriptTimeoutSeconds is the number of seconds to wait for the startup script to complete. If the script does not complete within this time, the agent lifecycle will be marked as start_timeout.",
-                    "type": "integer"
+                    "description": "StartupScriptBehavior is a legacy field that is deprecated in favor\nof the ` + "`" + `coder_script` + "`" + ` resource. It's only referenced by old clients.\nDeprecated: Remove in the future!",
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/codersdk.WorkspaceAgentStartupScriptBehavior"
+                        }
+                    ]
                 },
                 "status": {
                     "$ref": "#/definitions/codersdk.WorkspaceAgentStatus"
                 },
-                "subsystem": {
-                    "$ref": "#/definitions/codersdk.AgentSubsystem"
+                "subsystems": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.AgentSubsystem"
+                    }
                 },
                 "troubleshooting_url": {
                     "type": "string"
@@ -10540,6 +11281,9 @@ const docTemplate = `{
         "codersdk.WorkspaceAgentConnectionInfo": {
             "type": "object",
             "properties": {
+                "derp_force_websockets": {
+                    "type": "boolean"
+                },
                 "derp_map": {
                     "$ref": "#/definitions/tailcfg.DERPMap"
                 },
@@ -10631,27 +11375,35 @@ const docTemplate = `{
                 },
                 "output": {
                     "type": "string"
+                },
+                "source_id": {
+                    "type": "string",
+                    "format": "uuid"
                 }
             }
         },
         "codersdk.WorkspaceAgentLogSource": {
-            "type": "string",
-            "enum": [
-                "startup_script",
-                "shutdown_script",
-                "kubernetes",
-                "envbox",
-                "envbuilder",
-                "external"
-            ],
-            "x-enum-varnames": [
-                "WorkspaceAgentLogSourceStartupScript",
-                "WorkspaceAgentLogSourceShutdownScript",
-                "WorkspaceAgentLogSourceKubernetes",
-                "WorkspaceAgentLogSourceEnvbox",
-                "WorkspaceAgentLogSourceEnvbuilder",
-                "WorkspaceAgentLogSourceExternal"
-            ]
+            "type": "object",
+            "properties": {
+                "created_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "display_name": {
+                    "type": "string"
+                },
+                "icon": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "workspace_agent_id": {
+                    "type": "string",
+                    "format": "uuid"
+                }
+            }
         },
         "codersdk.WorkspaceAgentMetadataDescription": {
             "type": "object",
@@ -10673,6 +11425,36 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.WorkspaceAgentScript": {
+            "type": "object",
+            "properties": {
+                "cron": {
+                    "type": "string"
+                },
+                "log_path": {
+                    "type": "string"
+                },
+                "log_source_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "run_on_start": {
+                    "type": "boolean"
+                },
+                "run_on_stop": {
+                    "type": "boolean"
+                },
+                "script": {
+                    "type": "string"
+                },
+                "start_blocks_login": {
+                    "type": "boolean"
+                },
+                "timeout": {
+                    "type": "integer"
+                }
+            }
+        },
         "codersdk.WorkspaceAgentStartupScriptBehavior": {
             "type": "string",
             "enum": [
@@ -10752,6 +11534,10 @@ const docTemplate = `{
                     "description": "Subdomain denotes whether the app should be accessed via a path on the\n` + "`" + `coder server` + "`" + ` or via a hostname-based dev URL. If this is set to true\nand there is no app wildcard configured on the server, the app will not\nbe accessible in the UI.",
                     "type": "boolean"
                 },
+                "subdomain_name": {
+                    "description": "SubdomainName is the application domain exposed on the ` + "`" + `coder server` + "`" + `.",
+                    "type": "string"
+                },
                 "url": {
                     "description": "URL is the address being proxied to inside the workspace.\nIf external is specified, this will be opened on the client.",
                     "type": "string"
@@ -11188,30 +11974,7 @@ const docTemplate = `{
                 }
             }
         },
-        "healthcheck.AccessURLReport": {
-            "type": "object",
-            "properties": {
-                "access_url": {
-                    "type": "string"
-                },
-                "error": {
-                    "type": "string"
-                },
-                "healthy": {
-                    "type": "boolean"
-                },
-                "healthz_response": {
-                    "type": "string"
-                },
-                "reachable": {
-                    "type": "boolean"
-                },
-                "status_code": {
-                    "type": "integer"
-                }
-            }
-        },
-        "healthcheck.DERPNodeReport": {
+        "derphealth.NodeReport": {
             "type": "object",
             "properties": {
                 "can_exchange_messages": {
@@ -11254,14 +12017,14 @@ const docTemplate = `{
                     "type": "integer"
                 },
                 "stun": {
-                    "$ref": "#/definitions/healthcheck.DERPStunReport"
+                    "$ref": "#/definitions/derphealth.StunReport"
                 },
                 "uses_websocket": {
                     "type": "boolean"
                 }
             }
         },
-        "healthcheck.DERPRegionReport": {
+        "derphealth.RegionReport": {
             "type": "object",
             "properties": {
                 "error": {
@@ -11273,7 +12036,7 @@ const docTemplate = `{
                 "node_reports": {
                     "type": "array",
                     "items": {
-                        "$ref": "#/definitions/healthcheck.DERPNodeReport"
+                        "$ref": "#/definitions/derphealth.NodeReport"
                     }
                 },
                 "region": {
@@ -11281,7 +12044,7 @@ const docTemplate = `{
                 }
             }
         },
-        "healthcheck.DERPReport": {
+        "derphealth.Report": {
             "type": "object",
             "properties": {
                 "error": {
@@ -11305,12 +12068,12 @@ const docTemplate = `{
                 "regions": {
                     "type": "object",
                     "additionalProperties": {
-                        "$ref": "#/definitions/healthcheck.DERPRegionReport"
+                        "$ref": "#/definitions/derphealth.RegionReport"
                     }
                 }
             }
         },
-        "healthcheck.DERPStunReport": {
+        "derphealth.StunReport": {
             "type": "object",
             "properties": {
                 "canSTUN": {
@@ -11324,6 +12087,29 @@ const docTemplate = `{
                 }
             }
         },
+        "healthcheck.AccessURLReport": {
+            "type": "object",
+            "properties": {
+                "access_url": {
+                    "type": "string"
+                },
+                "error": {
+                    "type": "string"
+                },
+                "healthy": {
+                    "type": "boolean"
+                },
+                "healthz_response": {
+                    "type": "string"
+                },
+                "reachable": {
+                    "type": "boolean"
+                },
+                "status_code": {
+                    "type": "integer"
+                }
+            }
+        },
         "healthcheck.DatabaseReport": {
             "type": "object",
             "properties": {
@@ -11358,7 +12144,7 @@ const docTemplate = `{
                     "$ref": "#/definitions/healthcheck.DatabaseReport"
                 },
                 "derp": {
-                    "$ref": "#/definitions/healthcheck.DERPReport"
+                    "$ref": "#/definitions/derphealth.Report"
                 },
                 "failing_sections": {
                     "description": "FailingSections is a list of sections that have failed their healthcheck.",
@@ -11499,11 +12285,31 @@ const docTemplate = `{
                 }
             }
         },
+        "tailcfg.DERPHomeParams": {
+            "type": "object",
+            "properties": {
+                "regionScore": {
+                    "description": "RegionScore scales latencies of DERP regions by a given scaling\nfactor when determining which region to use as the home\n(\"preferred\") DERP. Scores in the range (0, 1) will cause this\nregion to be proportionally more preferred, and scores in the range\n(1, ∞) will penalize a region.\n\nIf a region is not present in this map, it is treated as having a\nscore of 1.0.\n\nScores should not be 0 or negative; such scores will be ignored.\n\nA nil map means no change from the previous value (if any); an empty\nnon-nil map can be sent to reset all scores back to 1.0.",
+                    "type": "object",
+                    "additionalProperties": {
+                        "type": "number"
+                    }
+                }
+            }
+        },
         "tailcfg.DERPMap": {
             "type": "object",
             "properties": {
+                "homeParams": {
+                    "description": "HomeParams, if non-nil, is a change in home parameters.\n\nThe rest of the DEPRMap fields, if zero, means unchanged.",
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/tailcfg.DERPHomeParams"
+                        }
+                    ]
+                },
                 "omitDefaultRegions": {
-                    "description": "OmitDefaultRegions specifies to not use Tailscale's DERP servers, and only use those\nspecified in this DERPMap. If there are none set outside of the defaults, this is a noop.",
+                    "description": "OmitDefaultRegions specifies to not use Tailscale's DERP servers, and only use those\nspecified in this DERPMap. If there are none set outside of the defaults, this is a noop.\n\nThis field is only meaningful if the Regions map is non-nil (indicating a change).",
                     "type": "boolean"
                 },
                 "regions": {
@@ -11518,6 +12324,10 @@ const docTemplate = `{
         "tailcfg.DERPNode": {
             "type": "object",
             "properties": {
+                "canPort80": {
+                    "description": "CanPort80 specifies whether this DERP node is accessible over HTTP\non port 80 specifically. This is used for captive portal checks.",
+                    "type": "boolean"
+                },
                 "certName": {
                     "description": "CertName optionally specifies the expected TLS cert common\nname. If empty, HostName is used. If CertName is non-empty,\nHostName is only used for the TCP dial (if IPv4/IPv6 are\nnot present) + TLS ClientHello.",
                     "type": "string"
@@ -11654,6 +12464,10 @@ const docTemplate = `{
                     "description": "AgentNameOrID is not required if the workspace has only one agent.",
                     "type": "string"
                 },
+                "app_prefix": {
+                    "description": "Prefix is the prefix of the subdomain app URL. Prefix should have a\ntrailing \"---\" if set.",
+                    "type": "string"
+                },
                 "app_slug_or_port": {
                     "type": "string"
                 },
@@ -11670,6 +12484,39 @@ const docTemplate = `{
                 }
             }
         },
+        "workspaceapps.StatsReport": {
+            "type": "object",
+            "properties": {
+                "access_method": {
+                    "$ref": "#/definitions/workspaceapps.AccessMethod"
+                },
+                "agent_id": {
+                    "type": "string"
+                },
+                "requests": {
+                    "type": "integer"
+                },
+                "session_ended_at": {
+                    "description": "Updated periodically while app is in use active and when the last connection is closed.",
+                    "type": "string"
+                },
+                "session_id": {
+                    "type": "string"
+                },
+                "session_started_at": {
+                    "type": "string"
+                },
+                "slug_or_port": {
+                    "type": "string"
+                },
+                "user_id": {
+                    "type": "string"
+                },
+                "workspace_id": {
+                    "type": "string"
+                }
+            }
+        },
         "wsproxysdk.AgentIsLegacyResponse": {
             "type": "object",
             "properties": {
@@ -11746,6 +12593,12 @@ const docTemplate = `{
                 "app_security_key": {
                     "type": "string"
                 },
+                "derp_force_websockets": {
+                    "type": "boolean"
+                },
+                "derp_map": {
+                    "$ref": "#/definitions/tailcfg.DERPMap"
+                },
                 "derp_mesh_key": {
                     "type": "string"
                 },
@@ -11760,6 +12613,17 @@ const docTemplate = `{
                     }
                 }
             }
+        },
+        "wsproxysdk.ReportAppStatsRequest": {
+            "type": "object",
+            "properties": {
+                "stats": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/workspaceapps.StatsReport"
+                    }
+                }
+            }
         }
     },
     "securityDefinitions": {
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 7f7d12a51a53a..a6908efc1e61e 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -497,8 +497,8 @@
         ],
         "produces": ["application/json"],
         "tags": ["General"],
-        "summary": "Get experiments",
-        "operationId": "get-experiments",
+        "summary": "Get enabled experiments",
+        "operationId": "get-enabled-experiments",
         "responses": {
           "200": {
             "description": "OK",
@@ -512,74 +512,62 @@
         }
       }
     },
-    "/files": {
-      "post": {
+    "/experiments/available": {
+      "get": {
         "security": [
           {
             "CoderSessionToken": []
           }
         ],
-        "description": "Swagger notice: Swagger 2.0 doesn't support file upload with a `content-type` different than `application/x-www-form-urlencoded`.",
-        "consumes": ["application/x-tar"],
         "produces": ["application/json"],
-        "tags": ["Files"],
-        "summary": "Upload file",
-        "operationId": "upload-file",
-        "parameters": [
-          {
-            "type": "string",
-            "default": "application/x-tar",
-            "description": "Content-Type must be `application/x-tar`",
-            "name": "Content-Type",
-            "in": "header",
-            "required": true
-          },
-          {
-            "type": "file",
-            "description": "File to be uploaded",
-            "name": "file",
-            "in": "formData",
-            "required": true
-          }
-        ],
+        "tags": ["General"],
+        "summary": "Get safe experiments",
+        "operationId": "get-safe-experiments",
         "responses": {
-          "201": {
-            "description": "Created",
+          "200": {
+            "description": "OK",
             "schema": {
-              "$ref": "#/definitions/codersdk.UploadResponse"
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/codersdk.Experiment"
+              }
             }
           }
         }
       }
     },
-    "/files/{fileID}": {
+    "/external-auth/{externalauth}": {
       "get": {
         "security": [
           {
             "CoderSessionToken": []
           }
         ],
-        "tags": ["Files"],
-        "summary": "Get file by ID",
-        "operationId": "get-file-by-id",
+        "produces": ["application/json"],
+        "tags": ["Git"],
+        "summary": "Get external auth by ID",
+        "operationId": "get-external-auth-by-id",
         "parameters": [
           {
             "type": "string",
-            "format": "uuid",
-            "description": "File ID",
-            "name": "fileID",
+            "format": "string",
+            "description": "Git Provider ID",
+            "name": "externalauth",
             "in": "path",
             "required": true
           }
         ],
         "responses": {
           "200": {
-            "description": "OK"
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/codersdk.ExternalAuth"
+            }
           }
         }
       }
     },
-    "/gitauth/{gitauth}": {
+    "/external-auth/{externalauth}/device": {
       "get": {
         "security": [
           {
@@ -588,14 +576,14 @@
         ],
         "produces": ["application/json"],
         "tags": ["Git"],
-        "summary": "Get git auth by ID",
-        "operationId": "get-git-auth-by-id",
+        "summary": "Get external auth device by ID.",
+        "operationId": "get-external-auth-device-by-id",
         "parameters": [
           {
             "type": "string",
             "format": "string",
             "description": "Git Provider ID",
-            "name": "gitauth",
+            "name": "externalauth",
             "in": "path",
             "required": true
           }
@@ -604,64 +592,100 @@
           "200": {
             "description": "OK",
             "schema": {
-              "$ref": "#/definitions/codersdk.GitAuth"
+              "$ref": "#/definitions/codersdk.ExternalAuthDevice"
             }
           }
         }
-      }
-    },
-    "/gitauth/{gitauth}/device": {
-      "get": {
+      },
+      "post": {
         "security": [
           {
             "CoderSessionToken": []
           }
         ],
-        "produces": ["application/json"],
         "tags": ["Git"],
-        "summary": "Get git auth device by ID.",
-        "operationId": "get-git-auth-device-by-id",
+        "summary": "Post external auth device by ID",
+        "operationId": "post-external-auth-device-by-id",
         "parameters": [
           {
             "type": "string",
             "format": "string",
-            "description": "Git Provider ID",
-            "name": "gitauth",
+            "description": "External Provider ID",
+            "name": "externalauth",
             "in": "path",
             "required": true
           }
         ],
         "responses": {
-          "200": {
-            "description": "OK",
+          "204": {
+            "description": "No Content"
+          }
+        }
+      }
+    },
+    "/files": {
+      "post": {
+        "security": [
+          {
+            "CoderSessionToken": []
+          }
+        ],
+        "description": "Swagger notice: Swagger 2.0 doesn't support file upload with a `content-type` different than `application/x-www-form-urlencoded`.",
+        "consumes": ["application/x-tar"],
+        "produces": ["application/json"],
+        "tags": ["Files"],
+        "summary": "Upload file",
+        "operationId": "upload-file",
+        "parameters": [
+          {
+            "type": "string",
+            "default": "application/x-tar",
+            "description": "Content-Type must be `application/x-tar`",
+            "name": "Content-Type",
+            "in": "header",
+            "required": true
+          },
+          {
+            "type": "file",
+            "description": "File to be uploaded",
+            "name": "file",
+            "in": "formData",
+            "required": true
+          }
+        ],
+        "responses": {
+          "201": {
+            "description": "Created",
             "schema": {
-              "$ref": "#/definitions/codersdk.GitAuthDevice"
+              "$ref": "#/definitions/codersdk.UploadResponse"
             }
           }
         }
-      },
-      "post": {
+      }
+    },
+    "/files/{fileID}": {
+      "get": {
         "security": [
           {
             "CoderSessionToken": []
           }
         ],
-        "tags": ["Git"],
-        "summary": "Post git auth device by ID",
-        "operationId": "post-git-auth-device-by-id",
+        "tags": ["Files"],
+        "summary": "Get file by ID",
+        "operationId": "get-file-by-id",
         "parameters": [
           {
             "type": "string",
-            "format": "string",
-            "description": "Git Provider ID",
-            "name": "gitauth",
+            "format": "uuid",
+            "description": "File ID",
+            "name": "fileID",
             "in": "path",
             "required": true
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "description": "OK"
           }
         }
       }
@@ -675,12 +699,12 @@
         ],
         "produces": ["application/json"],
         "tags": ["Enterprise"],
-        "summary": "Get group by name",
-        "operationId": "get-group-by-name",
+        "summary": "Get group by ID",
+        "operationId": "get-group-by-id",
         "parameters": [
           {
             "type": "string",
-            "description": "Group name",
+            "description": "Group id",
             "name": "group",
             "in": "path",
             "required": true
@@ -729,6 +753,7 @@
             "CoderSessionToken": []
           }
         ],
+        "consumes": ["application/json"],
         "produces": ["application/json"],
         "tags": ["Enterprise"],
         "summary": "Update group by name",
@@ -740,6 +765,15 @@
             "name": "group",
             "in": "path",
             "required": true
+          },
+          {
+            "description": "Patch group request",
+            "name": "request",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/codersdk.PatchGroupRequest"
+            }
           }
         ],
         "responses": {
@@ -794,6 +828,27 @@
         }
       }
     },
+    "/insights/user-activity": {
+      "get": {
+        "security": [
+          {
+            "CoderSessionToken": []
+          }
+        ],
+        "produces": ["application/json"],
+        "tags": ["Insights"],
+        "summary": "Get insights about user activity",
+        "operationId": "get-insights-about-user-activity",
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/codersdk.UserActivityInsightsResponse"
+            }
+          }
+        }
+      }
+    },
     "/insights/user-latency": {
       "get": {
         "security": [
@@ -870,6 +925,27 @@
         }
       }
     },
+    "/licenses/refresh-entitlements": {
+      "post": {
+        "security": [
+          {
+            "CoderSessionToken": []
+          }
+        ],
+        "produces": ["application/json"],
+        "tags": ["Organizations"],
+        "summary": "Update license entitlements",
+        "operationId": "update-license-entitlements",
+        "responses": {
+          "201": {
+            "description": "Created",
+            "schema": {
+              "$ref": "#/definitions/codersdk.Response"
+            }
+          }
+        }
+      }
+    },
     "/licenses/{id}": {
       "delete": {
         "security": [
@@ -1950,6 +2026,12 @@
             "name": "after_id",
             "in": "query"
           },
+          {
+            "type": "boolean",
+            "description": "Include archived versions in the list",
+            "name": "include_archived",
+            "in": "query"
+          },
           {
             "type": "integer",
             "description": "Page limit",
@@ -2015,6 +2097,47 @@
         }
       }
     },
+    "/templates/{template}/versions/archive": {
+      "post": {
+        "security": [
+          {
+            "CoderSessionToken": []
+          }
+        ],
+        "consumes": ["application/json"],
+        "produces": ["application/json"],
+        "tags": ["Templates"],
+        "summary": "Archive template unused versions by template id",
+        "operationId": "archive-template-unused-versions-by-template-id",
+        "parameters": [
+          {
+            "type": "string",
+            "format": "uuid",
+            "description": "Template ID",
+            "name": "template",
+            "in": "path",
+            "required": true
+          },
+          {
+            "description": "Archive request",
+            "name": "request",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/codersdk.ArchiveTemplateVersionsRequest"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/codersdk.Response"
+            }
+          }
+        }
+      }
+    },
     "/templates/{template}/versions/{templateversionname}": {
       "get": {
         "security": [
@@ -2126,6 +2249,37 @@
         }
       }
     },
+    "/templateversions/{templateversion}/archive": {
+      "post": {
+        "security": [
+          {
+            "CoderSessionToken": []
+          }
+        ],
+        "produces": ["application/json"],
+        "tags": ["Templates"],
+        "summary": "Archive template version",
+        "operationId": "archive-template-version",
+        "parameters": [
+          {
+            "type": "string",
+            "format": "uuid",
+            "description": "Template version ID",
+            "name": "templateversion",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/codersdk.Response"
+            }
+          }
+        }
+      }
+    },
     "/templateversions/{templateversion}/cancel": {
       "patch": {
         "security": [
@@ -2378,7 +2532,7 @@
         }
       }
     },
-    "/templateversions/{templateversion}/gitauth": {
+    "/templateversions/{templateversion}/external-auth": {
       "get": {
         "security": [
           {
@@ -2387,8 +2541,8 @@
         ],
         "produces": ["application/json"],
         "tags": ["Templates"],
-        "summary": "Get git auth by template version",
-        "operationId": "get-git-auth-by-template-version",
+        "summary": "Get external auth by template version",
+        "operationId": "get-external-auth-by-template-version",
         "parameters": [
           {
             "type": "string",
@@ -2405,7 +2559,7 @@
             "schema": {
               "type": "array",
               "items": {
-                "$ref": "#/definitions/codersdk.TemplateVersionGitAuth"
+                "$ref": "#/definitions/codersdk.TemplateVersionExternalAuth"
               }
             }
           }
@@ -2586,8 +2740,8 @@
         }
       }
     },
-    "/templateversions/{templateversion}/variables": {
-      "get": {
+    "/templateversions/{templateversion}/unarchive": {
+      "post": {
         "security": [
           {
             "CoderSessionToken": []
@@ -2595,8 +2749,8 @@
         ],
         "produces": ["application/json"],
         "tags": ["Templates"],
-        "summary": "Get template variables by template version",
-        "operationId": "get-template-variables-by-template-version",
+        "summary": "Unarchive template version",
+        "operationId": "unarchive-template-version",
         "parameters": [
           {
             "type": "string",
@@ -2611,29 +2765,60 @@
           "200": {
             "description": "OK",
             "schema": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/codersdk.TemplateVersionVariable"
-              }
+              "$ref": "#/definitions/codersdk.Response"
             }
           }
         }
       }
     },
-    "/updatecheck": {
+    "/templateversions/{templateversion}/variables": {
       "get": {
-        "produces": ["application/json"],
-        "tags": ["General"],
-        "summary": "Update check",
-        "operationId": "update-check",
-        "responses": {
-          "200": {
-            "description": "OK",
-            "schema": {
-              "$ref": "#/definitions/codersdk.UpdateCheckResponse"
-            }
+        "security": [
+          {
+            "CoderSessionToken": []
           }
-        }
+        ],
+        "produces": ["application/json"],
+        "tags": ["Templates"],
+        "summary": "Get template variables by template version",
+        "operationId": "get-template-variables-by-template-version",
+        "parameters": [
+          {
+            "type": "string",
+            "format": "uuid",
+            "description": "Template version ID",
+            "name": "templateversion",
+            "in": "path",
+            "required": true
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/codersdk.TemplateVersionVariable"
+              }
+            }
+          }
+        }
+      }
+    },
+    "/updatecheck": {
+      "get": {
+        "produces": ["application/json"],
+        "tags": ["General"],
+        "summary": "Update check",
+        "operationId": "update-check",
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/codersdk.UpdateCheckResponse"
+            }
+          }
+        }
       }
     },
     "/users": {
@@ -2909,7 +3094,7 @@
         "parameters": [
           {
             "type": "string",
-            "description": "User ID, name, or me",
+            "description": "User ID, username, or me",
             "name": "user",
             "in": "path",
             "required": true
@@ -3959,6 +4144,49 @@
         }
       }
     },
+    "/workspaceagents/me/external-auth": {
+      "get": {
+        "security": [
+          {
+            "CoderSessionToken": []
+          }
+        ],
+        "produces": ["application/json"],
+        "tags": ["Agents"],
+        "summary": "Get workspace agent external auth",
+        "operationId": "get-workspace-agent-external-auth",
+        "parameters": [
+          {
+            "type": "string",
+            "description": "Match",
+            "name": "match",
+            "in": "query",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "Provider ID",
+            "name": "id",
+            "in": "query",
+            "required": true
+          },
+          {
+            "type": "boolean",
+            "description": "Wait for a new token to be issued",
+            "name": "listen",
+            "in": "query"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "schema": {
+              "$ref": "#/definitions/agentsdk.ExternalAuthResponse"
+            }
+          }
+        }
+      }
+    },
     "/workspaceagents/me/gitauth": {
       "get": {
         "security": [
@@ -3968,14 +4196,20 @@
         ],
         "produces": ["application/json"],
         "tags": ["Agents"],
-        "summary": "Get workspace agent Git auth",
-        "operationId": "get-workspace-agent-git-auth",
+        "summary": "Removed: Get workspace agent git auth",
+        "operationId": "removed-get-workspace-agent-git-auth",
         "parameters": [
           {
             "type": "string",
-            "format": "uri",
-            "description": "Git URL",
-            "name": "url",
+            "description": "Match",
+            "name": "match",
+            "in": "query",
+            "required": true
+          },
+          {
+            "type": "string",
+            "description": "Provider ID",
+            "name": "id",
             "in": "query",
             "required": true
           },
@@ -3990,7 +4224,7 @@
           "200": {
             "description": "OK",
             "schema": {
-              "$ref": "#/definitions/agentsdk.GitAuthResponse"
+              "$ref": "#/definitions/agentsdk.ExternalAuthResponse"
             }
           }
         }
@@ -4071,7 +4305,7 @@
         }
       }
     },
-    "/workspaceagents/me/metadata/{key}": {
+    "/workspaceagents/me/metadata": {
       "post": {
         "security": [
           {
@@ -4089,7 +4323,42 @@
             "in": "body",
             "required": true,
             "schema": {
-              "$ref": "#/definitions/agentsdk.PostMetadataRequest"
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/agentsdk.PostMetadataRequest"
+              }
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "Success"
+          }
+        },
+        "x-apidocgen": {
+          "skip": true
+        }
+      }
+    },
+    "/workspaceagents/me/metadata/{key}": {
+      "post": {
+        "security": [
+          {
+            "CoderSessionToken": []
+          }
+        ],
+        "consumes": ["application/json"],
+        "tags": ["Agents"],
+        "summary": "Removed: Submit workspace agent metadata",
+        "operationId": "removed-submit-workspace-agent-metadata",
+        "parameters": [
+          {
+            "description": "Workspace agent metadata request",
+            "name": "request",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/agentsdk.PostMetadataRequestDeprecated"
             }
           },
           {
@@ -4831,6 +5100,38 @@
         }
       }
     },
+    "/workspaceproxies/me/app-stats": {
+      "post": {
+        "security": [
+          {
+            "CoderSessionToken": []
+          }
+        ],
+        "consumes": ["application/json"],
+        "tags": ["Enterprise"],
+        "summary": "Report workspace app stats",
+        "operationId": "report-workspace-app-stats",
+        "parameters": [
+          {
+            "description": "Report app stats request",
+            "name": "request",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/wsproxysdk.ReportAppStatsRequest"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          }
+        },
+        "x-apidocgen": {
+          "skip": true
+        }
+      }
+    },
     "/workspaceproxies/me/coordinate": {
       "get": {
         "security": [
@@ -5204,6 +5505,43 @@
         }
       }
     },
+    "/workspaces/{workspace}/autoupdates": {
+      "put": {
+        "security": [
+          {
+            "CoderSessionToken": []
+          }
+        ],
+        "consumes": ["application/json"],
+        "tags": ["Workspaces"],
+        "summary": "Update workspace automatic updates by ID",
+        "operationId": "update-workspace-automatic-updates-by-id",
+        "parameters": [
+          {
+            "type": "string",
+            "format": "uuid",
+            "description": "Workspace ID",
+            "name": "workspace",
+            "in": "path",
+            "required": true
+          },
+          {
+            "description": "Automatic updates request",
+            "name": "request",
+            "in": "body",
+            "required": true,
+            "schema": {
+              "$ref": "#/definitions/codersdk.UpdateWorkspaceAutomaticUpdatesRequest"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          }
+        }
+      }
+    },
     "/workspaces/{workspace}/builds": {
       "get": {
         "security": [
@@ -5303,7 +5641,7 @@
         }
       }
     },
-    "/workspaces/{workspace}/extend": {
+    "/workspaces/{workspace}/dormant": {
       "put": {
         "security": [
           {
@@ -5313,8 +5651,8 @@
         "consumes": ["application/json"],
         "produces": ["application/json"],
         "tags": ["Workspaces"],
-        "summary": "Extend workspace deadline by ID",
-        "operationId": "extend-workspace-deadline-by-id",
+        "summary": "Update workspace dormancy status by id.",
+        "operationId": "update-workspace-dormancy-status-by-id",
         "parameters": [
           {
             "type": "string",
@@ -5325,12 +5663,12 @@
             "required": true
           },
           {
-            "description": "Extend deadline update request",
+            "description": "Make a workspace dormant or active",
             "name": "request",
             "in": "body",
             "required": true,
             "schema": {
-              "$ref": "#/definitions/codersdk.PutExtendWorkspaceRequest"
+              "$ref": "#/definitions/codersdk.UpdateWorkspaceDormancy"
             }
           }
         ],
@@ -5338,13 +5676,13 @@
           "200": {
             "description": "OK",
             "schema": {
-              "$ref": "#/definitions/codersdk.Response"
+              "$ref": "#/definitions/codersdk.Workspace"
             }
           }
         }
       }
     },
-    "/workspaces/{workspace}/lock": {
+    "/workspaces/{workspace}/extend": {
       "put": {
         "security": [
           {
@@ -5354,8 +5692,8 @@
         "consumes": ["application/json"],
         "produces": ["application/json"],
         "tags": ["Workspaces"],
-        "summary": "Update workspace lock by id.",
-        "operationId": "update-workspace-lock-by-id",
+        "summary": "Extend workspace deadline by ID",
+        "operationId": "extend-workspace-deadline-by-id",
         "parameters": [
           {
             "type": "string",
@@ -5366,12 +5704,12 @@
             "required": true
           },
           {
-            "description": "Lock or unlock a workspace",
+            "description": "Extend deadline update request",
             "name": "request",
             "in": "body",
             "required": true,
             "schema": {
-              "$ref": "#/definitions/codersdk.UpdateWorkspaceLock"
+              "$ref": "#/definitions/codersdk.PutExtendWorkspaceRequest"
             }
           }
         ],
@@ -5530,16 +5868,27 @@
         }
       }
     },
-    "agentsdk.GitAuthResponse": {
+    "agentsdk.ExternalAuthResponse": {
       "type": "object",
       "properties": {
+        "access_token": {
+          "type": "string"
+        },
         "password": {
           "type": "string"
         },
+        "token_extra": {
+          "type": "object",
+          "additionalProperties": true
+        },
+        "type": {
+          "type": "string"
+        },
         "url": {
           "type": "string"
         },
         "username": {
+          "description": "Deprecated: Only supported on `/workspaceagents/me/gitauth`\nfor backwards compatibility.",
           "type": "string"
         }
       }
@@ -5575,9 +5924,6 @@
         },
         "output": {
           "type": "string"
-        },
-        "source": {
-          "$ref": "#/definitions/codersdk.WorkspaceAgentLogSource"
         }
       }
     },
@@ -5593,6 +5939,9 @@
             "$ref": "#/definitions/codersdk.WorkspaceApp"
           }
         },
+        "derp_force_websockets": {
+          "type": "boolean"
+        },
         "derpmap": {
           "$ref": "#/definitions/tailcfg.DERPMap"
         },
@@ -5621,19 +5970,35 @@
         "motd_file": {
           "type": "string"
         },
-        "shutdown_script": {
-          "type": "string"
+        "scripts": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/codersdk.WorkspaceAgentScript"
+          }
         },
-        "shutdown_script_timeout": {
+        "vscode_port_proxy_uri": {
+          "type": "string"
+        }
+      }
+    },
+    "agentsdk.Metadata": {
+      "type": "object",
+      "properties": {
+        "age": {
+          "description": "Age is the number of seconds since the metadata was collected.\nIt is provided in addition to CollectedAt to protect against clock skew.",
           "type": "integer"
         },
-        "startup_script": {
+        "collected_at": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "error": {
           "type": "string"
         },
-        "startup_script_timeout": {
-          "type": "integer"
+        "key": {
+          "type": "string"
         },
-        "vscode_port_proxy_uri": {
+        "value": {
           "type": "string"
         }
       }
@@ -5641,6 +6006,9 @@
     "agentsdk.PatchLogs": {
       "type": "object",
       "properties": {
+        "log_source_id": {
+          "type": "string"
+        },
         "logs": {
           "type": "array",
           "items": {
@@ -5673,6 +6041,17 @@
       }
     },
     "agentsdk.PostMetadataRequest": {
+      "type": "object",
+      "properties": {
+        "metadata": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/agentsdk.Metadata"
+          }
+        }
+      }
+    },
+    "agentsdk.PostMetadataRequestDeprecated": {
       "type": "object",
       "properties": {
         "age": {
@@ -5697,8 +6076,11 @@
         "expanded_directory": {
           "type": "string"
         },
-        "subsystem": {
-          "$ref": "#/definitions/codersdk.AgentSubsystem"
+        "subsystems": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/codersdk.AgentSubsystem"
+          }
         },
         "version": {
           "type": "string"
@@ -5874,13 +6256,16 @@
         }
       }
     },
-    "clibase.Struct-array_codersdk_GitAuthConfig": {
+    "clibase.Regexp": {
+      "type": "object"
+    },
+    "clibase.Struct-array_codersdk_ExternalAuthConfig": {
       "type": "object",
       "properties": {
         "value": {
           "type": "array",
           "items": {
-            "$ref": "#/definitions/codersdk.GitAuthConfig"
+            "$ref": "#/definitions/codersdk.ExternalAuthConfig"
           }
         }
       }
@@ -6127,8 +6512,12 @@
     },
     "codersdk.AgentSubsystem": {
       "type": "string",
-      "enum": ["envbox"],
-      "x-enum-varnames": ["AgentSubsystemEnvbox"]
+      "enum": ["envbox", "envbuilder", "exectrace"],
+      "x-enum-varnames": [
+        "AgentSubsystemEnvbox",
+        "AgentSubsystemEnvbuilder",
+        "AgentSubsystemExectrace"
+      ]
     },
     "codersdk.AppHostResponse": {
       "type": "object",
@@ -6142,6 +6531,9 @@
     "codersdk.AppearanceConfig": {
       "type": "object",
       "properties": {
+        "application_name": {
+          "type": "string"
+        },
         "logo_url": {
           "type": "string"
         },
@@ -6156,6 +6548,15 @@
         }
       }
     },
+    "codersdk.ArchiveTemplateVersionsRequest": {
+      "type": "object",
+      "properties": {
+        "all": {
+          "description": "By default, only failed versions are archived. Set this to true\nto archive all unused versions regardless of job status.",
+          "type": "boolean"
+        }
+      }
+    },
     "codersdk.AssignableRoles": {
       "type": "object",
       "properties": {
@@ -6375,6 +6776,11 @@
         "type": "boolean"
       }
     },
+    "codersdk.AutomaticUpdates": {
+      "type": "string",
+      "enum": ["always", "never"],
+      "x-enum-varnames": ["AutomaticUpdatesAlways", "AutomaticUpdatesNever"]
+    },
     "codersdk.BuildInfoResponse": {
       "type": "object",
       "properties": {
@@ -6507,10 +6913,30 @@
           "description": "Allow users to cancel in-progress workspace jobs.\n*bool as the default value is \"true\".",
           "type": "boolean"
         },
-        "default_ttl_ms": {
-          "description": "DefaultTTLMillis allows optionally specifying the default TTL\nfor all workspaces created from this template.",
-          "type": "integer"
-        },
+        "autostart_requirement": {
+          "description": "AutostartRequirement allows optionally specifying the autostart allowed days\nfor workspaces created from this template. This is an enterprise feature.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/codersdk.TemplateAutostartRequirement"
+            }
+          ]
+        },
+        "autostop_requirement": {
+          "description": "AutostopRequirement allows optionally specifying the autostop requirement\nfor workspaces created from this template. This is an enterprise feature.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/codersdk.TemplateAutostopRequirement"
+            }
+          ]
+        },
+        "default_ttl_ms": {
+          "description": "DefaultTTLMillis allows optionally specifying the default TTL\nfor all workspaces created from this template.",
+          "type": "integer"
+        },
+        "delete_ttl_ms": {
+          "description": "TimeTilDormantAutoDeleteMillis allows optionally specifying the max lifetime before Coder\npermanently deletes dormant workspaces created from this template.",
+          "type": "integer"
+        },
         "description": {
           "description": "Description is a description of what the template contains. It must be\nless than 128 bytes.",
           "type": "string"
@@ -6523,6 +6949,10 @@
           "description": "DisplayName is the displayed name of the template.",
           "type": "string"
         },
+        "dormant_ttl_ms": {
+          "description": "TimeTilDormantMillis allows optionally specifying the max lifetime before Coder\nlocks inactive workspaces created from this template.",
+          "type": "integer"
+        },
         "failure_ttl_ms": {
           "description": "FailureTTLMillis allows optionally specifying the max lifetime before Coder\nstops all resources for failed workspaces created from this template.",
           "type": "integer"
@@ -6531,29 +6961,17 @@
           "description": "Icon is a relative path or external URL that specifies\nan icon to be displayed in the dashboard.",
           "type": "string"
         },
-        "inactivity_ttl_ms": {
-          "description": "InactivityTTLMillis allows optionally specifying the max lifetime before Coder\nlocks inactive workspaces created from this template.",
-          "type": "integer"
-        },
-        "locked_ttl_ms": {
-          "description": "LockedTTLMillis allows optionally specifying the max lifetime before Coder\npermanently deletes locked workspaces created from this template.",
-          "type": "integer"
-        },
         "max_ttl_ms": {
-          "description": "TODO(@dean): remove max_ttl once restart_requirement is matured",
+          "description": "TODO(@dean): remove max_ttl once autostop_requirement is matured",
           "type": "integer"
         },
         "name": {
           "description": "Name is the name of the template.",
           "type": "string"
         },
-        "restart_requirement": {
-          "description": "RestartRequirement allows optionally specifying the restart requirement\nfor workspaces created from this template. This is an enterprise feature.",
-          "allOf": [
-            {
-              "$ref": "#/definitions/codersdk.TemplateRestartRequirement"
-            }
-          ]
+        "require_active_version": {
+          "description": "RequireActiveVersion mandates that workspaces are built with the active\ntemplate version.",
+          "type": "boolean"
         },
         "template_version_id": {
           "description": "VersionID is an in-progress or completed job to use as an initial version\nof the template.\n\nThis is required on creation to enable a user-flow of validating a\ntemplate works. There is no reason the data-model cannot support empty\ntemplates, but it doesn't make sense for users.",
@@ -6705,13 +7123,21 @@
       "required": ["email", "username"],
       "properties": {
         "disable_login": {
-          "description": "DisableLogin sets the user's login type to 'none'. This prevents the user\nfrom being able to use a password or any other authentication method to login.",
+          "description": "DisableLogin sets the user's login type to 'none'. This prevents the user\nfrom being able to use a password or any other authentication method to login.\nDeprecated: Set UserLoginType=LoginTypeDisabled instead.",
           "type": "boolean"
         },
         "email": {
           "type": "string",
           "format": "email"
         },
+        "login_type": {
+          "description": "UserLoginType defaults to LoginTypePassword.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/codersdk.LoginType"
+            }
+          ]
+        },
         "organization_id": {
           "type": "string",
           "format": "uuid"
@@ -6788,8 +7214,11 @@
     },
     "codersdk.CreateWorkspaceRequest": {
       "type": "object",
-      "required": ["name", "template_id"],
+      "required": ["name"],
       "properties": {
+        "automatic_updates": {
+          "$ref": "#/definitions/codersdk.AutomaticUpdates"
+        },
         "autostart_schedule": {
           "type": "string"
         },
@@ -6797,13 +7226,19 @@
           "type": "string"
         },
         "rich_parameter_values": {
-          "description": "ParameterValues allows for additional parameters to be provided\nduring the initial provision.",
+          "description": "RichParameterValues allows for additional parameters to be provided\nduring the initial provision.",
           "type": "array",
           "items": {
             "$ref": "#/definitions/codersdk.WorkspaceBuildParameter"
           }
         },
         "template_id": {
+          "description": "TemplateID specifies which template should be used for creating the workspace.",
+          "type": "string",
+          "format": "uuid"
+        },
+        "template_version_id": {
+          "description": "TemplateVersionID can be used to specify a specific version of a template for creating the workspace.",
           "type": "string",
           "format": "uuid"
         },
@@ -6855,6 +7290,9 @@
         "block_direct": {
           "type": "boolean"
         },
+        "force_websockets": {
+          "type": "boolean"
+        },
         "path": {
           "type": "string"
         },
@@ -7019,8 +7457,14 @@
             "type": "string"
           }
         },
-        "git_auth": {
-          "$ref": "#/definitions/clibase.Struct-array_codersdk_GitAuthConfig"
+        "external_auth": {
+          "$ref": "#/definitions/clibase.Struct-array_codersdk_ExternalAuthConfig"
+        },
+        "external_token_encryption_keys": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
         },
         "http_address": {
           "description": "HTTPAddress is a string because it may be set to zero to disable.",
@@ -7125,6 +7569,9 @@
         "verbose": {
           "type": "boolean"
         },
+        "web_terminal_renderer": {
+          "type": "string"
+        },
         "wgtunnel_host": {
           "type": "string"
         },
@@ -7136,6 +7583,23 @@
         }
       }
     },
+    "codersdk.DisplayApp": {
+      "type": "string",
+      "enum": [
+        "vscode",
+        "vscode_insiders",
+        "web_terminal",
+        "port_forwarding_helper",
+        "ssh_helper"
+      ],
+      "x-enum-varnames": [
+        "DisplayAppVSCodeDesktop",
+        "DisplayAppVSCodeInsiders",
+        "DisplayAppWebTerminal",
+        "DisplayAppPortForward",
+        "DisplayAppSSH"
+      ]
+    },
     "codersdk.Entitlement": {
       "type": "string",
       "enum": ["entitled", "grace_period", "not_entitled"],
@@ -7163,6 +7627,10 @@
         "has_license": {
           "type": "boolean"
         },
+        "refreshed_at": {
+          "type": "string",
+          "format": "date-time"
+        },
         "require_telemetry": {
           "type": "boolean"
         },
@@ -7184,58 +7652,23 @@
         "workspace_actions",
         "tailnet_pg_coordinator",
         "single_tailnet",
-        "template_restart_requirement",
-        "deployment_health_page"
+        "template_autostop_requirement",
+        "deployment_health_page",
+        "dashboard_theme",
+        "template_update_policies"
       ],
       "x-enum-varnames": [
         "ExperimentMoons",
         "ExperimentWorkspaceActions",
         "ExperimentTailnetPGCoordinator",
         "ExperimentSingleTailnet",
-        "ExperimentTemplateRestartRequirement",
-        "ExperimentDeploymentHealthPage"
+        "ExperimentTemplateAutostopRequirement",
+        "ExperimentDeploymentHealthPage",
+        "ExperimentDashboardTheme",
+        "ExperimentTemplateUpdatePolicies"
       ]
     },
-    "codersdk.Feature": {
-      "type": "object",
-      "properties": {
-        "actual": {
-          "type": "integer"
-        },
-        "enabled": {
-          "type": "boolean"
-        },
-        "entitlement": {
-          "$ref": "#/definitions/codersdk.Entitlement"
-        },
-        "limit": {
-          "type": "integer"
-        }
-      }
-    },
-    "codersdk.GenerateAPIKeyResponse": {
-      "type": "object",
-      "properties": {
-        "key": {
-          "type": "string"
-        }
-      }
-    },
-    "codersdk.GetUsersResponse": {
-      "type": "object",
-      "properties": {
-        "count": {
-          "type": "integer"
-        },
-        "users": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/codersdk.User"
-          }
-        }
-      }
-    },
-    "codersdk.GitAuth": {
+    "codersdk.ExternalAuth": {
       "type": "object",
       "properties": {
         "app_install_url": {
@@ -7252,31 +7685,31 @@
         "device": {
           "type": "boolean"
         },
+        "display_name": {
+          "type": "string"
+        },
         "installations": {
           "description": "AppInstallations are the installations that the user has access to.",
           "type": "array",
           "items": {
-            "$ref": "#/definitions/codersdk.GitAuthAppInstallation"
+            "$ref": "#/definitions/codersdk.ExternalAuthAppInstallation"
           }
         },
-        "type": {
-          "type": "string"
-        },
         "user": {
           "description": "User is the user that authenticated with the provider.",
           "allOf": [
             {
-              "$ref": "#/definitions/codersdk.GitAuthUser"
+              "$ref": "#/definitions/codersdk.ExternalAuthUser"
             }
           ]
         }
       }
     },
-    "codersdk.GitAuthAppInstallation": {
+    "codersdk.ExternalAuthAppInstallation": {
       "type": "object",
       "properties": {
         "account": {
-          "$ref": "#/definitions/codersdk.GitAuthUser"
+          "$ref": "#/definitions/codersdk.ExternalAuthUser"
         },
         "configure_url": {
           "type": "string"
@@ -7286,7 +7719,7 @@
         }
       }
     },
-    "codersdk.GitAuthConfig": {
+    "codersdk.ExternalAuthConfig": {
       "type": "object",
       "properties": {
         "app_install_url": {
@@ -7307,13 +7740,29 @@
         "device_flow": {
           "type": "boolean"
         },
+        "display_icon": {
+          "description": "DisplayIcon is a URL to an icon to display in the UI.",
+          "type": "string"
+        },
+        "display_name": {
+          "description": "DisplayName is shown in the UI to identify the auth config.",
+          "type": "string"
+        },
+        "extra_token_keys": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
         "id": {
+          "description": "ID is a unique identifier for the auth config.\nIt defaults to `type` when not provided.",
           "type": "string"
         },
         "no_refresh": {
           "type": "boolean"
         },
         "regex": {
+          "description": "Regex allows API requesters to match an auth config by\na string (e.g. coder.com) instead of by it's type.\n\nGit clone makes use of this by parsing the URL from:\n'Username for \"https://github.com\":'\nAnd sending it to the Coder server to match against the Regex.",
           "type": "string"
         },
         "scopes": {
@@ -7326,6 +7775,7 @@
           "type": "string"
         },
         "type": {
+          "description": "Type is the type of external auth config.",
           "type": "string"
         },
         "validate_url": {
@@ -7333,7 +7783,7 @@
         }
       }
     },
-    "codersdk.GitAuthDevice": {
+    "codersdk.ExternalAuthDevice": {
       "type": "object",
       "properties": {
         "device_code": {
@@ -7353,7 +7803,7 @@
         }
       }
     },
-    "codersdk.GitAuthUser": {
+    "codersdk.ExternalAuthUser": {
       "type": "object",
       "properties": {
         "avatar_url": {
@@ -7370,15 +7820,44 @@
         }
       }
     },
-    "codersdk.GitProvider": {
-      "type": "string",
-      "enum": ["azure-devops", "github", "gitlab", "bitbucket"],
-      "x-enum-varnames": [
-        "GitProviderAzureDevops",
-        "GitProviderGitHub",
-        "GitProviderGitLab",
-        "GitProviderBitBucket"
-      ]
+    "codersdk.Feature": {
+      "type": "object",
+      "properties": {
+        "actual": {
+          "type": "integer"
+        },
+        "enabled": {
+          "type": "boolean"
+        },
+        "entitlement": {
+          "$ref": "#/definitions/codersdk.Entitlement"
+        },
+        "limit": {
+          "type": "integer"
+        }
+      }
+    },
+    "codersdk.GenerateAPIKeyResponse": {
+      "type": "object",
+      "properties": {
+        "key": {
+          "type": "string"
+        }
+      }
+    },
+    "codersdk.GetUsersResponse": {
+      "type": "object",
+      "properties": {
+        "count": {
+          "type": "integer"
+        },
+        "users": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/codersdk.User"
+          }
+        }
+      }
     },
     "codersdk.GitSSHKey": {
       "type": "object",
@@ -7428,9 +7907,17 @@
         },
         "quota_allowance": {
           "type": "integer"
+        },
+        "source": {
+          "$ref": "#/definitions/codersdk.GroupSource"
         }
       }
     },
+    "codersdk.GroupSource": {
+      "type": "string",
+      "enum": ["user", "oidc"],
+      "x-enum-varnames": ["GroupSourceUser", "GroupSourceOIDC"]
+    },
     "codersdk.Healthcheck": {
       "type": "object",
       "properties": {
@@ -7450,8 +7937,11 @@
     },
     "codersdk.InsightsReportInterval": {
       "type": "string",
-      "enum": ["day"],
-      "x-enum-varnames": ["InsightsReportIntervalDay"]
+      "enum": ["day", "week"],
+      "x-enum-varnames": [
+        "InsightsReportIntervalDay",
+        "InsightsReportIntervalWeek"
+      ]
     },
     "codersdk.IssueReconnectingPTYSignedTokenRequest": {
       "type": "object",
@@ -7477,11 +7967,8 @@
     },
     "codersdk.JobErrorCode": {
       "type": "string",
-      "enum": ["MISSING_TEMPLATE_PARAMETER", "REQUIRED_TEMPLATE_VARIABLES"],
-      "x-enum-varnames": [
-        "MissingTemplateParameter",
-        "RequiredTemplateVariables"
-      ]
+      "enum": ["REQUIRED_TEMPLATE_VARIABLES"],
+      "x-enum-varnames": ["RequiredTemplateVariables"]
     },
     "codersdk.License": {
       "type": "object",
@@ -7556,8 +8043,9 @@
     },
     "codersdk.LoginType": {
       "type": "string",
-      "enum": ["password", "github", "oidc", "token", "none"],
+      "enum": ["", "password", "github", "oidc", "token", "none"],
       "x-enum-varnames": [
+        "LoginTypeUnknown",
         "LoginTypePassword",
         "LoginTypeGithub",
         "LoginTypeOIDC",
@@ -7686,9 +8174,16 @@
         "auth_url_params": {
           "type": "object"
         },
+        "client_cert_file": {
+          "type": "string"
+        },
         "client_id": {
           "type": "string"
         },
+        "client_key_file": {
+          "description": "ClientKeyFile \u0026 ClientCertFile are used in place of ClientSecret for PKI auth.",
+          "type": "string"
+        },
         "client_secret": {
           "type": "string"
         },
@@ -7701,9 +8196,15 @@
         "email_field": {
           "type": "string"
         },
+        "group_auto_create": {
+          "type": "boolean"
+        },
         "group_mapping": {
           "type": "object"
         },
+        "group_regex_filter": {
+          "$ref": "#/definitions/clibase.Regexp"
+        },
         "groups_field": {
           "type": "string"
         },
@@ -7793,6 +8294,35 @@
         }
       }
     },
+    "codersdk.PatchGroupRequest": {
+      "type": "object",
+      "properties": {
+        "add_users": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "avatar_url": {
+          "type": "string"
+        },
+        "display_name": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        },
+        "quota_allowance": {
+          "type": "integer"
+        },
+        "remove_users": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
     "codersdk.PatchTemplateVersionRequest": {
       "type": "object",
       "properties": {
@@ -7863,6 +8393,9 @@
         "daemon_poll_jitter": {
           "type": "integer"
         },
+        "daemon_psk": {
+          "type": "string"
+        },
         "daemons": {
           "type": "integer"
         },
@@ -7929,7 +8462,7 @@
           "type": "string"
         },
         "error_code": {
-          "enum": ["MISSING_TEMPLATE_PARAMETER", "REQUIRED_TEMPLATE_VARIABLES"],
+          "enum": ["REQUIRED_TEMPLATE_VARIABLES"],
           "allOf": [
             {
               "$ref": "#/definitions/codersdk.JobErrorCode"
@@ -8018,7 +8551,8 @@
         "succeeded",
         "canceling",
         "canceled",
-        "failed"
+        "failed",
+        "unknown"
       ],
       "x-enum-varnames": [
         "ProvisionerJobPending",
@@ -8026,7 +8560,8 @@
         "ProvisionerJobSucceeded",
         "ProvisionerJobCanceling",
         "ProvisionerJobCanceled",
-        "ProvisionerJobFailed"
+        "ProvisionerJobFailed",
+        "ProvisionerJobUnknown"
       ]
     },
     "codersdk.ProvisionerLogLevel": {
@@ -8238,7 +8773,9 @@
         "api_key",
         "group",
         "license",
-        "convert_login"
+        "convert_login",
+        "workspace_proxy",
+        "organization"
       ],
       "x-enum-varnames": [
         "ResourceTypeTemplate",
@@ -8250,7 +8787,9 @@
         "ResourceTypeAPIKey",
         "ResourceTypeGroup",
         "ResourceTypeLicense",
-        "ResourceTypeConvertLogin"
+        "ResourceTypeConvertLogin",
+        "ResourceTypeWorkspaceProxy",
+        "ResourceTypeOrganization"
       ]
     },
     "codersdk.Response": {
@@ -8437,6 +8976,17 @@
         "allow_user_cancel_workspace_jobs": {
           "type": "boolean"
         },
+        "autostart_requirement": {
+          "$ref": "#/definitions/codersdk.TemplateAutostartRequirement"
+        },
+        "autostop_requirement": {
+          "description": "AutostopRequirement and AutostartRequirement are enterprise features. Its\nvalue is only used if your license is entitled to use the advanced template\nscheduling feature.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/codersdk.TemplateAutostopRequirement"
+            }
+          ]
+        },
         "build_time_stats": {
           "$ref": "#/definitions/codersdk.TemplateBuildTimeStats"
         },
@@ -8461,7 +9011,7 @@
           "type": "string"
         },
         "failure_ttl_ms": {
-          "description": "FailureTTLMillis, InactivityTTLMillis, and LockedTTLMillis are enterprise-only. Their\nvalues are used if your license is entitled to use the advanced\ntemplate scheduling feature.",
+          "description": "FailureTTLMillis, TimeTilDormantMillis, and TimeTilDormantAutoDeleteMillis are enterprise-only. Their\nvalues are used if your license is entitled to use the advanced\ntemplate scheduling feature.",
           "type": "integer"
         },
         "icon": {
@@ -8471,14 +9021,8 @@
           "type": "string",
           "format": "uuid"
         },
-        "inactivity_ttl_ms": {
-          "type": "integer"
-        },
-        "locked_ttl_ms": {
-          "type": "integer"
-        },
         "max_ttl_ms": {
-          "description": "TODO(@dean): remove max_ttl once restart_requirement is matured",
+          "description": "TODO(@dean): remove max_ttl once autostop_requirement is matured",
           "type": "integer"
         },
         "name": {
@@ -8492,13 +9036,15 @@
           "type": "string",
           "enum": ["terraform"]
         },
-        "restart_requirement": {
-          "description": "RestartRequirement is an enterprise feature. Its value is only used if\nyour license is entitled to use the advanced template scheduling feature.",
-          "allOf": [
-            {
-              "$ref": "#/definitions/codersdk.TemplateRestartRequirement"
-            }
-          ]
+        "require_active_version": {
+          "description": "RequireActiveVersion mandates that workspaces are built with the active\ntemplate version.",
+          "type": "boolean"
+        },
+        "time_til_dormant_autodelete_ms": {
+          "type": "integer"
+        },
+        "time_til_dormant_ms": {
+          "type": "integer"
         },
         "updated_at": {
           "type": "string",
@@ -8543,38 +9089,84 @@
     },
     "codersdk.TemplateAppsType": {
       "type": "string",
-      "enum": ["builtin"],
-      "x-enum-varnames": ["TemplateAppsTypeBuiltin"]
-    },
-    "codersdk.TemplateBuildTimeStats": {
-      "type": "object",
-      "additionalProperties": {
-        "$ref": "#/definitions/codersdk.TransitionStats"
-      }
+      "enum": ["builtin", "app"],
+      "x-enum-varnames": ["TemplateAppsTypeBuiltin", "TemplateAppsTypeApp"]
     },
-    "codersdk.TemplateExample": {
+    "codersdk.TemplateAutostartRequirement": {
       "type": "object",
       "properties": {
-        "description": {
-          "type": "string"
-        },
-        "icon": {
-          "type": "string"
-        },
-        "id": {
-          "type": "string",
-          "format": "uuid"
-        },
-        "markdown": {
-          "type": "string"
-        },
-        "name": {
-          "type": "string"
-        },
-        "tags": {
+        "days_of_week": {
+          "description": "DaysOfWeek is a list of days of the week in which autostart is allowed\nto happen. If no days are specified, autostart is not allowed.",
           "type": "array",
           "items": {
-            "type": "string"
+            "type": "string",
+            "enum": [
+              "monday",
+              "tuesday",
+              "wednesday",
+              "thursday",
+              "friday",
+              "saturday",
+              "sunday"
+            ]
+          }
+        }
+      }
+    },
+    "codersdk.TemplateAutostopRequirement": {
+      "type": "object",
+      "properties": {
+        "days_of_week": {
+          "description": "DaysOfWeek is a list of days of the week on which restarts are required.\nRestarts happen within the user's quiet hours (in their configured\ntimezone). If no days are specified, restarts are not required. Weekdays\ncannot be specified twice.\n\nRestarts will only happen on weekdays in this list on weeks which line up\nwith Weeks.",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "monday",
+              "tuesday",
+              "wednesday",
+              "thursday",
+              "friday",
+              "saturday",
+              "sunday"
+            ]
+          }
+        },
+        "weeks": {
+          "description": "Weeks is the number of weeks between required restarts. Weeks are synced\nacross all workspaces (and Coder deployments) using modulo math on a\nhardcoded epoch week of January 2nd, 2023 (the first Monday of 2023).\nValues of 0 or 1 indicate weekly restarts. Values of 2 indicate\nfortnightly restarts, etc.",
+          "type": "integer"
+        }
+      }
+    },
+    "codersdk.TemplateBuildTimeStats": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/definitions/codersdk.TransitionStats"
+      }
+    },
+    "codersdk.TemplateExample": {
+      "type": "object",
+      "properties": {
+        "description": {
+          "type": "string"
+        },
+        "icon": {
+          "type": "string"
+        },
+        "id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "markdown": {
+          "type": "string"
+        },
+        "name": {
+          "type": "string"
+        },
+        "tags": {
+          "type": "array",
+          "items": {
+            "type": "string"
           }
         },
         "url": {
@@ -8594,7 +9186,12 @@
           "format": "date-time"
         },
         "interval": {
-          "$ref": "#/definitions/codersdk.InsightsReportInterval"
+          "allOf": [
+            {
+              "$ref": "#/definitions/codersdk.InsightsReportInterval"
+            }
+          ],
+          "example": "week"
         },
         "start_time": {
           "type": "string",
@@ -8662,6 +9259,9 @@
     "codersdk.TemplateParameterUsage": {
       "type": "object",
       "properties": {
+        "description": {
+          "type": "string"
+        },
         "display_name": {
           "type": "string"
         },
@@ -8681,6 +9281,9 @@
             "format": "uuid"
           }
         },
+        "type": {
+          "type": "string"
+        },
         "values": {
           "type": "array",
           "items": {
@@ -8700,31 +9303,6 @@
         }
       }
     },
-    "codersdk.TemplateRestartRequirement": {
-      "type": "object",
-      "properties": {
-        "days_of_week": {
-          "description": "DaysOfWeek is a list of days of the week on which restarts are required.\nRestarts happen within the user's quiet hours (in their configured\ntimezone). If no days are specified, restarts are not required. Weekdays\ncannot be specified twice.\n\nRestarts will only happen on weekdays in this list on weeks which line up\nwith Weeks.",
-          "type": "array",
-          "items": {
-            "type": "string",
-            "enum": [
-              "monday",
-              "tuesday",
-              "wednesday",
-              "thursday",
-              "friday",
-              "saturday",
-              "sunday"
-            ]
-          }
-        },
-        "weeks": {
-          "description": "Weeks is the number of weeks between required restarts. Weeks are synced\nacross all workspaces (and Coder deployments) using modulo math on a\nhardcoded epoch week of January 2nd, 2023 (the first Monday of 2023).\nValues of 0 or 1 indicate weekly restarts. Values of 2 indicate\nfortnightly restarts, etc.",
-          "type": "integer"
-        }
-      }
-    },
     "codersdk.TemplateRole": {
       "type": "string",
       "enum": ["admin", "use", ""],
@@ -8798,6 +9376,9 @@
     "codersdk.TemplateVersion": {
       "type": "object",
       "properties": {
+        "archived": {
+          "type": "boolean"
+        },
         "created_at": {
           "type": "string",
           "format": "date-time"
@@ -8842,7 +9423,7 @@
         }
       }
     },
-    "codersdk.TemplateVersionGitAuth": {
+    "codersdk.TemplateVersionExternalAuth": {
       "type": "object",
       "properties": {
         "authenticate_url": {
@@ -8851,11 +9432,17 @@
         "authenticated": {
           "type": "boolean"
         },
+        "display_icon": {
+          "type": "string"
+        },
+        "display_name": {
+          "type": "string"
+        },
         "id": {
           "type": "string"
         },
         "type": {
-          "$ref": "#/definitions/codersdk.GitProvider"
+          "type": "string"
         }
       }
     },
@@ -8984,6 +9571,9 @@
         "capture_logs": {
           "type": "boolean"
         },
+        "data_dog": {
+          "type": "boolean"
+        },
         "enable": {
           "type": "boolean"
         },
@@ -9018,6 +9608,9 @@
     "codersdk.UpdateAppearanceConfig": {
       "type": "object",
       "properties": {
+        "application_name": {
+          "type": "string"
+        },
         "logo_url": {
           "type": "string"
         },
@@ -9112,6 +9705,14 @@
         }
       }
     },
+    "codersdk.UpdateWorkspaceAutomaticUpdatesRequest": {
+      "type": "object",
+      "properties": {
+        "automatic_updates": {
+          "$ref": "#/definitions/codersdk.AutomaticUpdates"
+        }
+      }
+    },
     "codersdk.UpdateWorkspaceAutostartRequest": {
       "type": "object",
       "properties": {
@@ -9120,10 +9721,10 @@
         }
       }
     },
-    "codersdk.UpdateWorkspaceLock": {
+    "codersdk.UpdateWorkspaceDormancy": {
       "type": "object",
       "properties": {
-        "lock": {
+        "dormant": {
           "type": "boolean"
         }
       }
@@ -9206,6 +9807,67 @@
         }
       }
     },
+    "codersdk.UserActivity": {
+      "type": "object",
+      "properties": {
+        "avatar_url": {
+          "type": "string",
+          "format": "uri"
+        },
+        "seconds": {
+          "type": "integer",
+          "example": 80500
+        },
+        "template_ids": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "format": "uuid"
+          }
+        },
+        "user_id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "username": {
+          "type": "string"
+        }
+      }
+    },
+    "codersdk.UserActivityInsightsReport": {
+      "type": "object",
+      "properties": {
+        "end_time": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "start_time": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "template_ids": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "format": "uuid"
+          }
+        },
+        "users": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/codersdk.UserActivity"
+          }
+        }
+      }
+    },
+    "codersdk.UserActivityInsightsResponse": {
+      "type": "object",
+      "properties": {
+        "report": {
+          "$ref": "#/definitions/codersdk.UserActivityInsightsReport"
+        }
+      }
+    },
     "codersdk.UserLatency": {
       "type": "object",
       "properties": {
@@ -9350,6 +10012,14 @@
     "codersdk.Workspace": {
       "type": "object",
       "properties": {
+        "automatic_updates": {
+          "enum": ["always", "never"],
+          "allOf": [
+            {
+              "$ref": "#/definitions/codersdk.AutomaticUpdates"
+            }
+          ]
+        },
         "autostart_schedule": {
           "type": "string"
         },
@@ -9358,7 +10028,12 @@
           "format": "date-time"
         },
         "deleting_at": {
-          "description": "DeletingAt indicates the time of the upcoming workspace deletion, if applicable; otherwise it is nil.\nWorkspaces may have impending deletions if Template.InactivityTTL feature is turned on and the workspace is inactive.",
+          "description": "DeletingAt indicates the time at which the workspace will be permanently deleted.\nA workspace is eligible for deletion if it is dormant (a non-nil dormant_at value)\nand a value has been specified for time_til_dormant_autodelete on its template.",
+          "type": "string",
+          "format": "date-time"
+        },
+        "dormant_at": {
+          "description": "DormantAt being non-nil indicates a workspace that is dormant.\nA dormant workspace is no longer accessible must be activated.\nIt is subject to deletion if it breaches\nthe duration of the time_til_ field on its template.",
           "type": "string",
           "format": "date-time"
         },
@@ -9381,11 +10056,6 @@
         "latest_build": {
           "$ref": "#/definitions/codersdk.WorkspaceBuild"
         },
-        "locked_at": {
-          "description": "LockedAt being non-nil indicates a workspace that has been locked.\nA locked workspace is no longer accessible by a user and must be\nunlocked by an admin. It is subject to deletion if it breaches\nthe duration of the locked_ttl field on its template.",
-          "type": "string",
-          "format": "date-time"
-        },
         "name": {
           "type": "string"
         },
@@ -9403,6 +10073,10 @@
         "owner_name": {
           "type": "string"
         },
+        "template_active_version_id": {
+          "type": "string",
+          "format": "uuid"
+        },
         "template_allow_user_cancel_workspace_jobs": {
           "type": "boolean"
         },
@@ -9419,6 +10093,9 @@
         "template_name": {
           "type": "string"
         },
+        "template_require_active_version": {
+          "type": "boolean"
+        },
         "ttl_ms": {
           "type": "integer"
         },
@@ -9454,6 +10131,12 @@
           "type": "string",
           "format": "date-time"
         },
+        "display_apps": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/codersdk.DisplayApp"
+          }
+        },
         "environment_variables": {
           "type": "object",
           "additionalProperties": {
@@ -9496,9 +10179,11 @@
         "lifecycle_state": {
           "$ref": "#/definitions/codersdk.WorkspaceAgentLifecycle"
         },
-        "login_before_ready": {
-          "description": "Deprecated: Use StartupScriptBehavior instead.",
-          "type": "boolean"
+        "log_sources": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/codersdk.WorkspaceAgentLogSource"
+          }
         },
         "logs_length": {
           "type": "integer"
@@ -9520,31 +10205,32 @@
           "type": "string",
           "format": "uuid"
         },
-        "shutdown_script": {
-          "type": "string"
-        },
-        "shutdown_script_timeout_seconds": {
-          "type": "integer"
+        "scripts": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/codersdk.WorkspaceAgentScript"
+          }
         },
         "started_at": {
           "type": "string",
           "format": "date-time"
         },
-        "startup_script": {
-          "type": "string"
-        },
         "startup_script_behavior": {
-          "$ref": "#/definitions/codersdk.WorkspaceAgentStartupScriptBehavior"
-        },
-        "startup_script_timeout_seconds": {
-          "description": "StartupScriptTimeoutSeconds is the number of seconds to wait for the startup script to complete. If the script does not complete within this time, the agent lifecycle will be marked as start_timeout.",
-          "type": "integer"
+          "description": "StartupScriptBehavior is a legacy field that is deprecated in favor\nof the `coder_script` resource. It's only referenced by old clients.\nDeprecated: Remove in the future!",
+          "allOf": [
+            {
+              "$ref": "#/definitions/codersdk.WorkspaceAgentStartupScriptBehavior"
+            }
+          ]
         },
         "status": {
           "$ref": "#/definitions/codersdk.WorkspaceAgentStatus"
         },
-        "subsystem": {
-          "$ref": "#/definitions/codersdk.AgentSubsystem"
+        "subsystems": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/codersdk.AgentSubsystem"
+          }
         },
         "troubleshooting_url": {
           "type": "string"
@@ -9561,6 +10247,9 @@
     "codersdk.WorkspaceAgentConnectionInfo": {
       "type": "object",
       "properties": {
+        "derp_force_websockets": {
+          "type": "boolean"
+        },
         "derp_map": {
           "$ref": "#/definitions/tailcfg.DERPMap"
         },
@@ -9652,27 +10341,35 @@
         },
         "output": {
           "type": "string"
+        },
+        "source_id": {
+          "type": "string",
+          "format": "uuid"
         }
       }
     },
     "codersdk.WorkspaceAgentLogSource": {
-      "type": "string",
-      "enum": [
-        "startup_script",
-        "shutdown_script",
-        "kubernetes",
-        "envbox",
-        "envbuilder",
-        "external"
-      ],
-      "x-enum-varnames": [
-        "WorkspaceAgentLogSourceStartupScript",
-        "WorkspaceAgentLogSourceShutdownScript",
-        "WorkspaceAgentLogSourceKubernetes",
-        "WorkspaceAgentLogSourceEnvbox",
-        "WorkspaceAgentLogSourceEnvbuilder",
-        "WorkspaceAgentLogSourceExternal"
-      ]
+      "type": "object",
+      "properties": {
+        "created_at": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "display_name": {
+          "type": "string"
+        },
+        "icon": {
+          "type": "string"
+        },
+        "id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "workspace_agent_id": {
+          "type": "string",
+          "format": "uuid"
+        }
+      }
     },
     "codersdk.WorkspaceAgentMetadataDescription": {
       "type": "object",
@@ -9694,6 +10391,36 @@
         }
       }
     },
+    "codersdk.WorkspaceAgentScript": {
+      "type": "object",
+      "properties": {
+        "cron": {
+          "type": "string"
+        },
+        "log_path": {
+          "type": "string"
+        },
+        "log_source_id": {
+          "type": "string",
+          "format": "uuid"
+        },
+        "run_on_start": {
+          "type": "boolean"
+        },
+        "run_on_stop": {
+          "type": "boolean"
+        },
+        "script": {
+          "type": "string"
+        },
+        "start_blocks_login": {
+          "type": "boolean"
+        },
+        "timeout": {
+          "type": "integer"
+        }
+      }
+    },
     "codersdk.WorkspaceAgentStartupScriptBehavior": {
       "type": "string",
       "enum": ["blocking", "non-blocking"],
@@ -9761,6 +10488,10 @@
           "description": "Subdomain denotes whether the app should be accessed via a path on the\n`coder server` or via a hostname-based dev URL. If this is set to true\nand there is no app wildcard configured on the server, the app will not\nbe accessible in the UI.",
           "type": "boolean"
         },
+        "subdomain_name": {
+          "description": "SubdomainName is the application domain exposed on the `coder server`.",
+          "type": "string"
+        },
         "url": {
           "description": "URL is the address being proxied to inside the workspace.\nIf external is specified, this will be opened on the client.",
           "type": "string"
@@ -10172,30 +10903,7 @@
         }
       }
     },
-    "healthcheck.AccessURLReport": {
-      "type": "object",
-      "properties": {
-        "access_url": {
-          "type": "string"
-        },
-        "error": {
-          "type": "string"
-        },
-        "healthy": {
-          "type": "boolean"
-        },
-        "healthz_response": {
-          "type": "string"
-        },
-        "reachable": {
-          "type": "boolean"
-        },
-        "status_code": {
-          "type": "integer"
-        }
-      }
-    },
-    "healthcheck.DERPNodeReport": {
+    "derphealth.NodeReport": {
       "type": "object",
       "properties": {
         "can_exchange_messages": {
@@ -10238,14 +10946,14 @@
           "type": "integer"
         },
         "stun": {
-          "$ref": "#/definitions/healthcheck.DERPStunReport"
+          "$ref": "#/definitions/derphealth.StunReport"
         },
         "uses_websocket": {
           "type": "boolean"
         }
       }
     },
-    "healthcheck.DERPRegionReport": {
+    "derphealth.RegionReport": {
       "type": "object",
       "properties": {
         "error": {
@@ -10257,7 +10965,7 @@
         "node_reports": {
           "type": "array",
           "items": {
-            "$ref": "#/definitions/healthcheck.DERPNodeReport"
+            "$ref": "#/definitions/derphealth.NodeReport"
           }
         },
         "region": {
@@ -10265,7 +10973,7 @@
         }
       }
     },
-    "healthcheck.DERPReport": {
+    "derphealth.Report": {
       "type": "object",
       "properties": {
         "error": {
@@ -10289,12 +10997,12 @@
         "regions": {
           "type": "object",
           "additionalProperties": {
-            "$ref": "#/definitions/healthcheck.DERPRegionReport"
+            "$ref": "#/definitions/derphealth.RegionReport"
           }
         }
       }
     },
-    "healthcheck.DERPStunReport": {
+    "derphealth.StunReport": {
       "type": "object",
       "properties": {
         "canSTUN": {
@@ -10308,6 +11016,29 @@
         }
       }
     },
+    "healthcheck.AccessURLReport": {
+      "type": "object",
+      "properties": {
+        "access_url": {
+          "type": "string"
+        },
+        "error": {
+          "type": "string"
+        },
+        "healthy": {
+          "type": "boolean"
+        },
+        "healthz_response": {
+          "type": "string"
+        },
+        "reachable": {
+          "type": "boolean"
+        },
+        "status_code": {
+          "type": "integer"
+        }
+      }
+    },
     "healthcheck.DatabaseReport": {
       "type": "object",
       "properties": {
@@ -10342,7 +11073,7 @@
           "$ref": "#/definitions/healthcheck.DatabaseReport"
         },
         "derp": {
-          "$ref": "#/definitions/healthcheck.DERPReport"
+          "$ref": "#/definitions/derphealth.Report"
         },
         "failing_sections": {
           "description": "FailingSections is a list of sections that have failed their healthcheck.",
@@ -10483,11 +11214,31 @@
         }
       }
     },
+    "tailcfg.DERPHomeParams": {
+      "type": "object",
+      "properties": {
+        "regionScore": {
+          "description": "RegionScore scales latencies of DERP regions by a given scaling\nfactor when determining which region to use as the home\n(\"preferred\") DERP. Scores in the range (0, 1) will cause this\nregion to be proportionally more preferred, and scores in the range\n(1, ∞) will penalize a region.\n\nIf a region is not present in this map, it is treated as having a\nscore of 1.0.\n\nScores should not be 0 or negative; such scores will be ignored.\n\nA nil map means no change from the previous value (if any); an empty\nnon-nil map can be sent to reset all scores back to 1.0.",
+          "type": "object",
+          "additionalProperties": {
+            "type": "number"
+          }
+        }
+      }
+    },
     "tailcfg.DERPMap": {
       "type": "object",
       "properties": {
+        "homeParams": {
+          "description": "HomeParams, if non-nil, is a change in home parameters.\n\nThe rest of the DEPRMap fields, if zero, means unchanged.",
+          "allOf": [
+            {
+              "$ref": "#/definitions/tailcfg.DERPHomeParams"
+            }
+          ]
+        },
         "omitDefaultRegions": {
-          "description": "OmitDefaultRegions specifies to not use Tailscale's DERP servers, and only use those\nspecified in this DERPMap. If there are none set outside of the defaults, this is a noop.",
+          "description": "OmitDefaultRegions specifies to not use Tailscale's DERP servers, and only use those\nspecified in this DERPMap. If there are none set outside of the defaults, this is a noop.\n\nThis field is only meaningful if the Regions map is non-nil (indicating a change).",
           "type": "boolean"
         },
         "regions": {
@@ -10502,6 +11253,10 @@
     "tailcfg.DERPNode": {
       "type": "object",
       "properties": {
+        "canPort80": {
+          "description": "CanPort80 specifies whether this DERP node is accessible over HTTP\non port 80 specifically. This is used for captive portal checks.",
+          "type": "boolean"
+        },
         "certName": {
           "description": "CertName optionally specifies the expected TLS cert common\nname. If empty, HostName is used. If CertName is non-empty,\nHostName is only used for the TCP dial (if IPv4/IPv6 are\nnot present) + TLS ClientHello.",
           "type": "string"
@@ -10634,6 +11389,10 @@
           "description": "AgentNameOrID is not required if the workspace has only one agent.",
           "type": "string"
         },
+        "app_prefix": {
+          "description": "Prefix is the prefix of the subdomain app URL. Prefix should have a\ntrailing \"---\" if set.",
+          "type": "string"
+        },
         "app_slug_or_port": {
           "type": "string"
         },
@@ -10650,6 +11409,39 @@
         }
       }
     },
+    "workspaceapps.StatsReport": {
+      "type": "object",
+      "properties": {
+        "access_method": {
+          "$ref": "#/definitions/workspaceapps.AccessMethod"
+        },
+        "agent_id": {
+          "type": "string"
+        },
+        "requests": {
+          "type": "integer"
+        },
+        "session_ended_at": {
+          "description": "Updated periodically while app is in use active and when the last connection is closed.",
+          "type": "string"
+        },
+        "session_id": {
+          "type": "string"
+        },
+        "session_started_at": {
+          "type": "string"
+        },
+        "slug_or_port": {
+          "type": "string"
+        },
+        "user_id": {
+          "type": "string"
+        },
+        "workspace_id": {
+          "type": "string"
+        }
+      }
+    },
     "wsproxysdk.AgentIsLegacyResponse": {
       "type": "object",
       "properties": {
@@ -10726,6 +11518,12 @@
         "app_security_key": {
           "type": "string"
         },
+        "derp_force_websockets": {
+          "type": "boolean"
+        },
+        "derp_map": {
+          "$ref": "#/definitions/tailcfg.DERPMap"
+        },
         "derp_mesh_key": {
           "type": "string"
         },
@@ -10740,6 +11538,17 @@
           }
         }
       }
+    },
+    "wsproxysdk.ReportAppStatsRequest": {
+      "type": "object",
+      "properties": {
+        "stats": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/workspaceapps.StatsReport"
+          }
+        }
+      }
     }
   },
   "securityDefinitions": {
diff --git a/coderd/apikey.go b/coderd/apikey.go
index c3934d076cbdc..02db2029d15db 100644
--- a/coderd/apikey.go
+++ b/coderd/apikey.go
@@ -12,14 +12,15 @@ import (
 	"github.com/moby/moby/pkg/namesgenerator"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/apikey"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/apikey"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // Creates a new token API key that effectively doesn't expire.
@@ -84,13 +85,13 @@ func (api *API) postToken(rw http.ResponseWriter, r *http.Request) {
 		UserID:           user.ID,
 		LoginType:        database.LoginTypeToken,
 		DeploymentValues: api.DeploymentValues,
-		ExpiresAt:        database.Now().Add(lifeTime),
+		ExpiresAt:        dbtime.Now().Add(lifeTime),
 		Scope:            scope,
 		LifetimeSeconds:  int64(lifeTime.Seconds()),
 		TokenName:        tokenName,
 	})
 	if err != nil {
-		if database.IsUniqueViolation(err, database.UniqueIndexApiKeyName) {
+		if database.IsUniqueViolation(err, database.UniqueIndexAPIKeyName) {
 			httpapi.Write(ctx, rw, http.StatusConflict, codersdk.Response{
 				Message: fmt.Sprintf("A token with name %q already exists.", tokenName),
 				Validations: []codersdk.ValidationError{{
@@ -132,7 +133,7 @@ func (api *API) postAPIKey(rw http.ResponseWriter, r *http.Request) {
 		RemoteAddr:       r.RemoteAddr,
 		// All api generated keys will last 1 week. Browser login tokens have
 		// a shorter life.
-		ExpiresAt:       database.Now().Add(lifeTime),
+		ExpiresAt:       dbtime.Now().Add(lifeTime),
 		LifetimeSeconds: int64(lifeTime.Seconds()),
 	})
 	if err != nil {
diff --git a/coderd/apikey/apikey.go b/coderd/apikey/apikey.go
index 8abba96421914..3ae3c0d6e9bb8 100644
--- a/coderd/apikey/apikey.go
+++ b/coderd/apikey/apikey.go
@@ -10,9 +10,10 @@ import (
 	"github.com/sqlc-dev/pqtype"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 type CreateParams struct {
@@ -43,9 +44,9 @@ func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error)
 	// set.
 	if params.ExpiresAt.IsZero() {
 		if params.LifetimeSeconds != 0 {
-			params.ExpiresAt = database.Now().Add(time.Duration(params.LifetimeSeconds) * time.Second)
+			params.ExpiresAt = dbtime.Now().Add(time.Duration(params.LifetimeSeconds) * time.Second)
 		} else {
-			params.ExpiresAt = database.Now().Add(params.DeploymentValues.SessionDuration.Value())
+			params.ExpiresAt = dbtime.Now().Add(params.DeploymentValues.SessionDuration.Value())
 			params.LifetimeSeconds = int64(params.DeploymentValues.SessionDuration.Value().Seconds())
 		}
 	}
@@ -75,6 +76,7 @@ func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error)
 	return database.InsertAPIKeyParams{
 		ID:              keyID,
 		UserID:          params.UserID,
+		LastUsed:        time.Time{},
 		LifetimeSeconds: params.LifetimeSeconds,
 		IPAddress: pqtype.Inet{
 			IPNet: net.IPNet{
@@ -85,8 +87,8 @@ func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error)
 		},
 		// Make sure in UTC time for common time zone
 		ExpiresAt:    params.ExpiresAt.UTC(),
-		CreatedAt:    database.Now(),
-		UpdatedAt:    database.Now(),
+		CreatedAt:    dbtime.Now(),
+		UpdatedAt:    dbtime.Now(),
 		HashedSecret: hashed[:],
 		LoginType:    params.LoginType,
 		Scope:        scope,
diff --git a/coderd/apikey/apikey_test.go b/coderd/apikey/apikey_test.go
index 89fc3a6fade02..b2d8a7768b76f 100644
--- a/coderd/apikey/apikey_test.go
+++ b/coderd/apikey/apikey_test.go
@@ -10,10 +10,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/coderd/apikey"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/coderd/apikey"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestGenerate(t *testing.T) {
@@ -121,8 +122,8 @@ func TestGenerate(t *testing.T) {
 			assert.ElementsMatch(t, hashed, key.HashedSecret[:])
 
 			assert.Equal(t, tc.params.UserID, key.UserID)
-			assert.WithinDuration(t, database.Now(), key.CreatedAt, time.Second*5)
-			assert.WithinDuration(t, database.Now(), key.UpdatedAt, time.Second*5)
+			assert.WithinDuration(t, dbtime.Now(), key.CreatedAt, time.Second*5)
+			assert.WithinDuration(t, dbtime.Now(), key.UpdatedAt, time.Second*5)
 
 			if tc.params.LifetimeSeconds > 0 {
 				assert.Equal(t, tc.params.LifetimeSeconds, key.LifetimeSeconds)
@@ -136,9 +137,9 @@ func TestGenerate(t *testing.T) {
 			if !tc.params.ExpiresAt.IsZero() {
 				assert.Equal(t, tc.params.ExpiresAt.UTC(), key.ExpiresAt)
 			} else if tc.params.LifetimeSeconds > 0 {
-				assert.WithinDuration(t, database.Now().Add(time.Duration(tc.params.LifetimeSeconds)), key.ExpiresAt, time.Second*5)
+				assert.WithinDuration(t, dbtime.Now().Add(time.Duration(tc.params.LifetimeSeconds)), key.ExpiresAt, time.Second*5)
 			} else {
-				assert.WithinDuration(t, database.Now().Add(tc.params.DeploymentValues.SessionDuration.Value()), key.ExpiresAt, time.Second*5)
+				assert.WithinDuration(t, dbtime.Now().Add(tc.params.DeploymentValues.SessionDuration.Value()), key.ExpiresAt, time.Second*5)
 			}
 
 			if tc.params.RemoteAddr != "" {
diff --git a/coderd/apikey_test.go b/coderd/apikey_test.go
index 412f7bebae660..9be09761d6401 100644
--- a/coderd/apikey_test.go
+++ b/coderd/apikey_test.go
@@ -10,13 +10,14 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestTokenCRUD(t *testing.T) {
@@ -181,7 +182,7 @@ func TestSessionExpiry(t *testing.T) {
 	err = db.UpdateAPIKeyByID(ctx, database.UpdateAPIKeyByIDParams{
 		ID:        apiKey.ID,
 		LastUsed:  apiKey.LastUsed,
-		ExpiresAt: database.Now().Add(-time.Hour),
+		ExpiresAt: dbtime.Now().Add(-time.Hour),
 		IPAddress: apiKey.IPAddress,
 	})
 	require.NoError(t, err)
diff --git a/coderd/apiroot.go b/coderd/apiroot.go
index 6974ca5133e24..a0dee428e3970 100644
--- a/coderd/apiroot.go
+++ b/coderd/apiroot.go
@@ -3,8 +3,8 @@ package coderd
 import (
 	"net/http"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // @Summary API root handler
diff --git a/coderd/audit.go b/coderd/audit.go
index 18eb155743c0e..b0d75d1a5bf91 100644
--- a/coderd/audit.go
+++ b/coderd/audit.go
@@ -15,14 +15,14 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/searchquery"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/searchquery"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // @Summary Get audit logs
@@ -154,6 +154,9 @@ func (api *API) generateFakeAuditLog(rw http.ResponseWriter, r *http.Request) {
 		Diff:             diff,
 		StatusCode:       http.StatusOK,
 		AdditionalFields: params.AdditionalFields,
+		RequestID:        uuid.Nil, // no request ID to attach this to
+		ResourceIcon:     "",
+		OrganizationID:   uuid.New(),
 	})
 	if err != nil {
 		httpapi.InternalServerError(rw, err)
diff --git a/coderd/audit/audit.go b/coderd/audit/audit.go
index d3e83d19e85fb..4d256541d05f6 100644
--- a/coderd/audit/audit.go
+++ b/coderd/audit/audit.go
@@ -4,7 +4,7 @@ import (
 	"context"
 	"sync"
 
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/database"
 )
 
 type Auditor interface {
diff --git a/coderd/audit/diff.go b/coderd/audit/diff.go
index 858334493cf8d..8cf0a1d0ddaf3 100644
--- a/coderd/audit/diff.go
+++ b/coderd/audit/diff.go
@@ -1,7 +1,7 @@
 package audit
 
 import (
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/database"
 )
 
 // Auditable is mostly a marker interface. It contains a definitive list of all
diff --git a/coderd/audit/request.go b/coderd/audit/request.go
index aec89ef3d308e..cc1f60779a7dc 100644
--- a/coderd/audit/request.go
+++ b/coderd/audit/request.go
@@ -11,11 +11,14 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/sqlc-dev/pqtype"
+	"go.opentelemetry.io/otel/baggage"
+	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 type RequestParams struct {
@@ -33,12 +36,14 @@ type Request[T Auditable] struct {
 	Old T
 	New T
 
-	// This optional field can be passed in when the userID cannot be determined from the API Key
-	// such as in the case of login, when the audit log is created prior the API Key's existence.
+	// UserID is an optional field can be passed in when the userID cannot be
+	// determined from the API Key such as in the case of login, when the audit
+	// log is created prior the API Key's existence.
 	UserID uuid.UUID
 
-	// This optional field can be passed in if the AuditAction must be overridden
-	// such as in the case of new user authentication when the Audit Action is 'register', not 'login'.
+	// Action is an optional field can be passed in if the AuditAction must be
+	// overridden such as in the case of new user authentication when the Audit
+	// Action is 'register', not 'login'.
 	Action database.AuditAction
 }
 
@@ -50,6 +55,8 @@ type BuildAuditParams[T Auditable] struct {
 	JobID            uuid.UUID
 	Status           int
 	Action           database.AuditAction
+	OrganizationID   uuid.UUID
+	IP               string
 	AdditionalFields json.RawMessage
 
 	New T
@@ -217,7 +224,7 @@ func InitRequest[T Auditable](w http.ResponseWriter, p *RequestParams) (*Request
 		ip := parseIP(p.Request.RemoteAddr)
 		auditLog := database.AuditLog{
 			ID:               uuid.New(),
-			Time:             database.Now(),
+			Time:             dbtime.Now(),
 			UserID:           userID,
 			Ip:               ip,
 			UserAgent:        sql.NullString{String: p.Request.UserAgent(), Valid: true},
@@ -241,12 +248,10 @@ func InitRequest[T Auditable](w http.ResponseWriter, p *RequestParams) (*Request
 	}
 }
 
-// BuildAudit creates an audit log for a workspace build.
+// WorkspaceBuildAudit creates an audit log for a workspace build.
 // The audit log is committed upon invocation.
-func BuildAudit[T Auditable](ctx context.Context, p *BuildAuditParams[T]) {
-	// As the audit request has not been initiated directly by a user, we omit
-	// certain user details.
-	ip := parseIP("")
+func WorkspaceBuildAudit[T Auditable](ctx context.Context, p *BuildAuditParams[T]) {
+	ip := parseIP(p.IP)
 
 	diff := Diff(p.Audit, p.Old, p.New)
 	var err error
@@ -262,8 +267,9 @@ func BuildAudit[T Auditable](ctx context.Context, p *BuildAuditParams[T]) {
 
 	auditLog := database.AuditLog{
 		ID:               uuid.New(),
-		Time:             database.Now(),
+		Time:             dbtime.Now(),
 		UserID:           p.UserID,
+		OrganizationID:   p.OrganizationID,
 		Ip:               ip,
 		UserAgent:        sql.NullString{},
 		ResourceType:     either(p.Old, p.New, ResourceType[T], p.Action),
@@ -275,16 +281,70 @@ func BuildAudit[T Auditable](ctx context.Context, p *BuildAuditParams[T]) {
 		RequestID:        p.JobID,
 		AdditionalFields: p.AdditionalFields,
 	}
-	exportErr := p.Audit.Export(ctx, auditLog)
-	if exportErr != nil {
+	err = p.Audit.Export(ctx, auditLog)
+	if err != nil {
 		p.Log.Error(ctx, "export audit log",
 			slog.F("audit_log", auditLog),
 			slog.Error(err),
 		)
-		return
 	}
 }
 
+type WorkspaceBuildBaggage struct {
+	IP string
+}
+
+func (b WorkspaceBuildBaggage) Props() ([]baggage.Property, error) {
+	ipProp, err := baggage.NewKeyValueProperty("ip", b.IP)
+	if err != nil {
+		return nil, xerrors.Errorf("create ip kv property: %w", err)
+	}
+
+	return []baggage.Property{ipProp}, nil
+}
+
+func WorkspaceBuildBaggageFromRequest(r *http.Request) WorkspaceBuildBaggage {
+	return WorkspaceBuildBaggage{IP: r.RemoteAddr}
+}
+
+type Baggage interface {
+	Props() ([]baggage.Property, error)
+}
+
+func BaggageToContext(ctx context.Context, d Baggage) (context.Context, error) {
+	props, err := d.Props()
+	if err != nil {
+		return ctx, xerrors.Errorf("create baggage properties: %w", err)
+	}
+
+	m, err := baggage.NewMember("audit", "baggage", props...)
+	if err != nil {
+		return ctx, xerrors.Errorf("create new baggage member: %w", err)
+	}
+
+	b, err := baggage.New(m)
+	if err != nil {
+		return ctx, xerrors.Errorf("create new baggage carrier: %w", err)
+	}
+
+	return baggage.ContextWithBaggage(ctx, b), nil
+}
+
+func BaggageFromContext(ctx context.Context) WorkspaceBuildBaggage {
+	d := WorkspaceBuildBaggage{}
+	b := baggage.FromContext(ctx)
+	props := b.Member("audit").Properties()
+	for _, prop := range props {
+		switch prop.Key() {
+		case "ip":
+			d.IP, _ = prop.Value()
+		default:
+		}
+	}
+
+	return d
+}
+
 func either[T Auditable, R any](old, new T, fn func(T) R, auditAction database.AuditAction) R {
 	if ResourceID(new) != uuid.Nil {
 		return fn(new)
diff --git a/coderd/audit/request_test.go b/coderd/audit/request_test.go
new file mode 100644
index 0000000000000..e0040425d4683
--- /dev/null
+++ b/coderd/audit/request_test.go
@@ -0,0 +1,33 @@
+package audit_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel/propagation"
+
+	"github.com/coder/coder/v2/coderd/audit"
+)
+
+func TestBaggage(t *testing.T) {
+	t.Parallel()
+	prop := propagation.NewCompositeTextMapPropagator(
+		propagation.TraceContext{},
+		propagation.Baggage{},
+	)
+
+	expected := audit.WorkspaceBuildBaggage{
+		IP: "127.0.0.1",
+	}
+
+	ctx, err := audit.BaggageToContext(context.Background(), expected)
+	require.NoError(t, err)
+
+	carrier := propagation.MapCarrier{}
+	prop.Inject(ctx, carrier)
+	bCtx := prop.Extract(ctx, carrier)
+	got := audit.BaggageFromContext(bCtx)
+
+	require.Equal(t, expected, got)
+}
diff --git a/coderd/audit_test.go b/coderd/audit_test.go
index cc8698775bd22..b8b62cf27ecf0 100644
--- a/coderd/audit_test.go
+++ b/coderd/audit_test.go
@@ -10,10 +10,10 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestAuditLogs(t *testing.T) {
@@ -53,9 +53,9 @@ func TestAuditLogs(t *testing.T) {
 			template = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		)
 
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		buildResourceInfo := audit.AdditionalFields{
 			WorkspaceName: workspace.Name,
@@ -100,7 +100,7 @@ func TestAuditLogsFilter(t *testing.T) {
 			template = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		)
 
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 
 		// Create two logs with "Create"
diff --git a/coderd/authorize.go b/coderd/authorize.go
index 229c7e4624655..e8d4274ab89a0 100644
--- a/coderd/authorize.go
+++ b/coderd/authorize.go
@@ -8,10 +8,10 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // AuthorizeFilter takes a list of objects and returns the filtered list of
diff --git a/coderd/authorize_test.go b/coderd/authorize_test.go
index 55214d10473a7..3fcb2f6c8e64f 100644
--- a/coderd/authorize_test.go
+++ b/coderd/authorize_test.go
@@ -7,10 +7,10 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestCheckPermissions(t *testing.T) {
@@ -32,7 +32,7 @@ func TestCheckPermissions(t *testing.T) {
 	require.NoError(t, err)
 
 	version := coderdtest.CreateTemplateVersion(t, adminClient, adminUser.OrganizationID, nil)
-	coderdtest.AwaitTemplateVersionJob(t, adminClient, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, adminClient, version.ID)
 	template := coderdtest.CreateTemplate(t, adminClient, adminUser.OrganizationID, version.ID)
 
 	// With admin, member, and org admin
diff --git a/coderd/autobuild/lifecycle_executor.go b/coderd/autobuild/lifecycle_executor.go
index f7176ae8cd721..d2fb16b033946 100644
--- a/coderd/autobuild/lifecycle_executor.go
+++ b/coderd/autobuild/lifecycle_executor.go
@@ -3,6 +3,9 @@ package autobuild
 import (
 	"context"
 	"database/sql"
+	"encoding/json"
+	"net/http"
+	"strconv"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -12,19 +15,25 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/wsbuilder"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/provisionerjobs"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
+	"github.com/coder/coder/v2/coderd/wsbuilder"
 )
 
 // Executor automatically starts or stops workspaces.
 type Executor struct {
 	ctx                   context.Context
 	db                    database.Store
+	ps                    pubsub.Pubsub
 	templateScheduleStore *atomic.Pointer[schedule.TemplateScheduleStore]
+	accessControlStore    *atomic.Pointer[dbauthz.AccessControlStore]
+	auditor               *atomic.Pointer[audit.Auditor]
 	log                   slog.Logger
 	tick                  <-chan time.Time
 	statsCh               chan<- Stats
@@ -38,14 +47,17 @@ type Stats struct {
 }
 
 // New returns a new wsactions executor.
-func NewExecutor(ctx context.Context, db database.Store, tss *atomic.Pointer[schedule.TemplateScheduleStore], log slog.Logger, tick <-chan time.Time) *Executor {
+func NewExecutor(ctx context.Context, db database.Store, ps pubsub.Pubsub, tss *atomic.Pointer[schedule.TemplateScheduleStore], auditor *atomic.Pointer[audit.Auditor], acs *atomic.Pointer[dbauthz.AccessControlStore], log slog.Logger, tick <-chan time.Time) *Executor {
 	le := &Executor{
 		//nolint:gocritic // Autostart has a limited set of permissions.
 		ctx:                   dbauthz.AsAutostart(ctx),
 		db:                    db,
+		ps:                    ps,
 		templateScheduleStore: tss,
 		tick:                  tick,
 		log:                   log.Named("autobuild"),
+		auditor:               auditor,
+		accessControlStore:    acs,
 	}
 	return le
 }
@@ -127,6 +139,7 @@ func (e *Executor) runOnce(t time.Time) Stats {
 		log := e.log.With(slog.F("workspace_id", wsID))
 
 		eg.Go(func() error {
+			var job *database.ProvisionerJob
 			err := e.db.InTx(func(tx database.Store) error {
 				// Re-check eligibility since the first check was outside the
 				// transaction and the workspace settings may have changed.
@@ -148,6 +161,12 @@ func (e *Executor) runOnce(t time.Time) Stats {
 					return nil
 				}
 
+				template, err := tx.GetTemplateByID(e.ctx, ws.TemplateID)
+				if err != nil {
+					log.Warn(e.ctx, "get template by id", slog.Error(err))
+				}
+				accessControl := (*(e.accessControlStore.Load())).GetTemplateAccessControl(template)
+
 				latestJob, err := tx.GetProvisionerJobByID(e.ctx, latestBuild.JobID)
 				if err != nil {
 					log.Warn(e.ctx, "get last provisioner job for workspace %q: %w", slog.Error(err))
@@ -160,13 +179,22 @@ func (e *Executor) runOnce(t time.Time) Stats {
 					return nil
 				}
 
+				var build *database.WorkspaceBuild
 				if nextTransition != "" {
 					builder := wsbuilder.New(ws, nextTransition).
 						SetLastWorkspaceBuildInTx(&latestBuild).
 						SetLastWorkspaceBuildJobInTx(&latestJob).
 						Reason(reason)
+					log.Debug(e.ctx, "auto building workspace", slog.F("transition", nextTransition))
+					if nextTransition == database.WorkspaceTransitionStart &&
+						useActiveVersion(accessControl, ws) {
+						log.Debug(e.ctx, "autostarting with active version")
+						builder = builder.ActiveVersion()
+					}
+
+					build, job, err = builder.Build(e.ctx, tx, nil, audit.WorkspaceBuildBaggage{IP: "127.0.0.1"})
 
-					if _, _, err := builder.Build(e.ctx, tx, nil); err != nil {
+					if err != nil {
 						log.Error(e.ctx, "unable to transition workspace",
 							slog.F("transition", nextTransition),
 							slog.Error(err),
@@ -175,35 +203,46 @@ func (e *Executor) runOnce(t time.Time) Stats {
 					}
 				}
 
-				// Lock the workspace if it has breached the template's
+				//  Transition the workspace to dormant if it has breached the template's
 				// threshold for inactivity.
 				if reason == database.BuildReasonAutolock {
-					err = tx.UpdateWorkspaceLockedDeletingAt(e.ctx, database.UpdateWorkspaceLockedDeletingAtParams{
+					wsOld := ws
+					ws, err = tx.UpdateWorkspaceDormantDeletingAt(e.ctx, database.UpdateWorkspaceDormantDeletingAtParams{
 						ID: ws.ID,
-						LockedAt: sql.NullTime{
-							Time:  database.Now(),
+						DormantAt: sql.NullTime{
+							Time:  dbtime.Now(),
 							Valid: true,
 						},
 					})
+
+					auditBuild(e.ctx, e.log, *e.auditor.Load(), auditParams{
+						Build:   build,
+						Job:     latestJob,
+						Reason:  reason,
+						Old:     wsOld,
+						New:     ws,
+						Success: err == nil,
+					})
+
 					if err != nil {
-						log.Error(e.ctx, "unable to lock workspace",
+						log.Error(e.ctx, "unable to transition workspace to dormant",
 							slog.F("transition", nextTransition),
 							slog.Error(err),
 						)
 						return nil
 					}
 
-					log.Info(e.ctx, "locked workspace",
+					log.Info(e.ctx, "dormant workspace",
 						slog.F("last_used_at", ws.LastUsedAt),
-						slog.F("inactivity_ttl", templateSchedule.InactivityTTL),
+						slog.F("time_til_dormant", templateSchedule.TimeTilDormant),
 						slog.F("since_last_used_at", time.Since(ws.LastUsedAt)),
 					)
 				}
 
 				if reason == database.BuildReasonAutodelete {
 					log.Info(e.ctx, "deleted workspace",
-						slog.F("locked_at", ws.LockedAt.Time),
-						slog.F("locked_ttl", templateSchedule.LockedTTL),
+						slog.F("dormant_at", ws.DormantAt.Time),
+						slog.F("time_til_dormant_autodelete", templateSchedule.TimeTilDormantAutoDelete),
 					)
 				}
 
@@ -228,6 +267,17 @@ func (e *Executor) runOnce(t time.Time) Stats {
 			if err != nil {
 				log.Error(e.ctx, "workspace scheduling failed", slog.Error(err))
 			}
+			if job != nil && err == nil {
+				// Note that we can't refactor such that posting the job happens inside wsbuilder because it's called
+				// with an outer transaction like this, and we need to make sure the outer transaction commits before
+				// posting the job.  If we post before the transaction commits, provisionerd might try to acquire the
+				// job, fail, and then sit idle instead of picking up the job.
+				err = provisionerjobs.PostJob(e.ps, *job)
+				if err != nil {
+					// Client probably doesn't care about this error, so just log it.
+					log.Error(e.ctx, "failed to post provisioner job to pubsub", slog.Error(err))
+				}
+			}
 			return nil
 		})
 	}
@@ -246,7 +296,7 @@ func (e *Executor) runOnce(t time.Time) Stats {
 // for this function to return a nil error as well as an empty transition.
 // In such cases it means no provisioning should occur but the workspace
 // may be "transitioning" to a new state (such as an inactive, stopped
-// workspace transitioning to the locked state).
+// workspace transitioning to the dormant state).
 func getNextTransition(
 	ws database.Workspace,
 	latestBuild database.WorkspaceBuild,
@@ -265,16 +315,16 @@ func getNextTransition(
 		return database.WorkspaceTransitionStart, database.BuildReasonAutostart, nil
 	case isEligibleForFailedStop(latestBuild, latestJob, templateSchedule, currentTick):
 		return database.WorkspaceTransitionStop, database.BuildReasonAutostop, nil
-	case isEligibleForLockedStop(ws, templateSchedule, currentTick):
+	case isEligibleForDormantStop(ws, templateSchedule, currentTick):
 		// Only stop started workspaces.
 		if latestBuild.Transition == database.WorkspaceTransitionStart {
 			return database.WorkspaceTransitionStop, database.BuildReasonAutolock, nil
 		}
 		// We shouldn't transition the workspace but we should still
-		// lock it.
+		// make it dormant.
 		return "", database.BuildReasonAutolock, nil
 
-	case isEligibleForDelete(ws, templateSchedule, currentTick):
+	case isEligibleForDelete(ws, templateSchedule, latestBuild, latestJob, currentTick):
 		return database.WorkspaceTransitionDelete, database.BuildReasonAutodelete, nil
 	default:
 		return "", "", xerrors.Errorf("last transition not valid for autostart or autostop")
@@ -284,12 +334,12 @@ func getNextTransition(
 // isEligibleForAutostart returns true if the workspace should be autostarted.
 func isEligibleForAutostart(ws database.Workspace, build database.WorkspaceBuild, job database.ProvisionerJob, templateSchedule schedule.TemplateScheduleOptions, currentTick time.Time) bool {
 	// Don't attempt to autostart failed workspaces.
-	if db2sdk.ProvisionerJobStatus(job) == codersdk.ProvisionerJobFailed {
+	if job.JobStatus == database.ProvisionerJobStatusFailed {
 		return false
 	}
 
-	// If the workspace is locked we should not autostart it.
-	if ws.LockedAt.Valid {
+	// If the workspace is dormant we should not autostart it.
+	if ws.DormantAt.Valid {
 		return false
 	}
 
@@ -305,7 +355,7 @@ func isEligibleForAutostart(ws database.Workspace, build database.WorkspaceBuild
 		return false
 	}
 
-	sched, err := schedule.Weekly(ws.AutostartSchedule.String)
+	sched, err := cron.Weekly(ws.AutostartSchedule.String)
 	if err != nil {
 		return false
 	}
@@ -313,17 +363,28 @@ func isEligibleForAutostart(ws database.Workspace, build database.WorkspaceBuild
 	// Truncate is probably not necessary here, but doing it anyway to be sure.
 	nextTransition := sched.Next(build.CreatedAt).Truncate(time.Minute)
 
+	// The nextTransition is when the auto start should kick off. If it lands on a
+	// forbidden day, do not allow the auto start. We use the time location of the
+	// schedule to determine the weekday. So if "Saturday" is disallowed, the
+	// definition of "Saturday" depends on the location of the schedule.
+	zonedTransition := nextTransition.In(sched.Location())
+	allowed := templateSchedule.AutostartRequirement.DaysMap()[zonedTransition.Weekday()]
+	if !allowed {
+		return false
+	}
+
+	// Must used '.Before' vs '.After' so equal times are considered "valid for autostart".
 	return !currentTick.Before(nextTransition)
 }
 
 // isEligibleForAutostart returns true if the workspace should be autostopped.
 func isEligibleForAutostop(ws database.Workspace, build database.WorkspaceBuild, job database.ProvisionerJob, currentTick time.Time) bool {
-	if db2sdk.ProvisionerJobStatus(job) == codersdk.ProvisionerJobFailed {
+	if job.JobStatus == database.ProvisionerJobStatusFailed {
 		return false
 	}
 
-	// If the workspace is locked we should not autostop it.
-	if ws.LockedAt.Valid {
+	// If the workspace is dormant we should not autostop it.
+	if ws.DormantAt.Valid {
 		return false
 	}
 
@@ -334,24 +395,32 @@ func isEligibleForAutostop(ws database.Workspace, build database.WorkspaceBuild,
 		!currentTick.Before(build.Deadline)
 }
 
-// isEligibleForLockedStop returns true if the workspace should be locked
+// isEligibleForDormantStop returns true if the workspace should be dormant
 // for breaching the inactivity threshold of the template.
-func isEligibleForLockedStop(ws database.Workspace, templateSchedule schedule.TemplateScheduleOptions, currentTick time.Time) bool {
-	// Only attempt to lock workspaces not already locked.
-	return !ws.LockedAt.Valid &&
-		// The template must specify an inactivity TTL.
-		templateSchedule.InactivityTTL > 0 &&
-		// The workspace must breach the inactivity TTL.
-		currentTick.Sub(ws.LastUsedAt) > templateSchedule.InactivityTTL
+func isEligibleForDormantStop(ws database.Workspace, templateSchedule schedule.TemplateScheduleOptions, currentTick time.Time) bool {
+	// Only attempt against workspaces not already dormant.
+	return !ws.DormantAt.Valid &&
+		// The template must specify an time_til_dormant value.
+		templateSchedule.TimeTilDormant > 0 &&
+		// The workspace must breach the time_til_dormant value.
+		currentTick.Sub(ws.LastUsedAt) > templateSchedule.TimeTilDormant
 }
 
-func isEligibleForDelete(ws database.Workspace, templateSchedule schedule.TemplateScheduleOptions, currentTick time.Time) bool {
-	// Only attempt to delete locked workspaces.
-	return ws.LockedAt.Valid && ws.DeletingAt.Valid &&
-		// Locked workspaces should only be deleted if a locked_ttl is specified.
-		templateSchedule.LockedTTL > 0 &&
-		// The workspace must breach the locked_ttl.
+func isEligibleForDelete(ws database.Workspace, templateSchedule schedule.TemplateScheduleOptions, lastBuild database.WorkspaceBuild, lastJob database.ProvisionerJob, currentTick time.Time) bool {
+	eligible := ws.DormantAt.Valid && ws.DeletingAt.Valid &&
+		// Dormant workspaces should only be deleted if a time_til_dormant_autodelete value is specified.
+		templateSchedule.TimeTilDormantAutoDelete > 0 &&
+		// The workspace must breach the time_til_dormant_autodelete value.
 		currentTick.After(ws.DeletingAt.Time)
+
+	// If the last delete job failed we should wait 24 hours before trying again.
+	// Builds are resource-intensive so retrying every minute is not productive
+	// and will hold compute hostage.
+	if lastBuild.Transition == database.WorkspaceTransitionDelete && lastJob.JobStatus == database.ProvisionerJobStatusFailed {
+		return eligible && lastJob.Finished() && currentTick.Sub(lastJob.FinishedAt()) > time.Hour*24
+	}
+
+	return eligible
 }
 
 // isEligibleForFailedStop returns true if the workspace is eligible to be stopped
@@ -360,9 +429,56 @@ func isEligibleForFailedStop(build database.WorkspaceBuild, job database.Provisi
 	// If the template has specified a failure TLL.
 	return templateSchedule.FailureTTL > 0 &&
 		// And the job resulted in failure.
-		db2sdk.ProvisionerJobStatus(job) == codersdk.ProvisionerJobFailed &&
+		job.JobStatus == database.ProvisionerJobStatusFailed &&
 		build.Transition == database.WorkspaceTransitionStart &&
 		// And sufficient time has elapsed since the job has completed.
 		job.CompletedAt.Valid &&
 		currentTick.Sub(job.CompletedAt.Time) > templateSchedule.FailureTTL
 }
+
+type auditParams struct {
+	Build   *database.WorkspaceBuild
+	Job     database.ProvisionerJob
+	Reason  database.BuildReason
+	Old     database.Workspace
+	New     database.Workspace
+	Success bool
+}
+
+func auditBuild(ctx context.Context, log slog.Logger, auditor audit.Auditor, params auditParams) {
+	fields := audit.AdditionalFields{
+		WorkspaceName: params.New.Name,
+		BuildReason:   params.Reason,
+	}
+
+	if params.Build != nil {
+		fields.BuildNumber = strconv.FormatInt(int64(params.Build.BuildNumber), 10)
+	}
+
+	raw, err := json.Marshal(fields)
+	if err != nil {
+		log.Error(ctx, "marshal resource info for successful job", slog.Error(err))
+	}
+
+	status := http.StatusInternalServerError
+	if params.Success {
+		status = http.StatusOK
+	}
+
+	audit.WorkspaceBuildAudit(ctx, &audit.BuildAuditParams[database.Workspace]{
+		Audit:            auditor,
+		Log:              log,
+		UserID:           params.Job.InitiatorID,
+		OrganizationID:   params.New.OrganizationID,
+		JobID:            params.Job.ID,
+		Action:           database.AuditActionWrite,
+		Old:              params.Old,
+		New:              params.New,
+		Status:           status,
+		AdditionalFields: raw,
+	})
+}
+
+func useActiveVersion(opts dbauthz.TemplateAccessControl, ws database.Workspace) bool {
+	return opts.RequireActiveVersion || ws.AutomaticUpdates == database.AutomaticUpdatesAlways
+}
diff --git a/coderd/autobuild/lifecycle_executor_internal_test.go b/coderd/autobuild/lifecycle_executor_internal_test.go
new file mode 100644
index 0000000000000..33d3143fac19d
--- /dev/null
+++ b/coderd/autobuild/lifecycle_executor_internal_test.go
@@ -0,0 +1,146 @@
+package autobuild
+
+import (
+	"database/sql"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/schedule"
+)
+
+func Test_isEligibleForAutostart(t *testing.T) {
+	t.Parallel()
+
+	// okXXX should be set to values that make 'isEligibleForAutostart' return true.
+
+	// Intentionally chosen to be a non UTC time that changes the day of the week
+	// when converted to UTC.
+	localLocation, err := time.LoadLocation("America/Chicago")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// 5s after the autostart in UTC.
+	okTick := time.Date(2021, 1, 1, 20, 0, 5, 0, localLocation).UTC()
+	okWorkspace := database.Workspace{
+		DormantAt: sql.NullTime{Valid: false},
+		AutostartSchedule: sql.NullString{
+			Valid: true,
+			// Every day at 8pm America/Chicago, which is 2am UTC the next day.
+			String: "CRON_TZ=America/Chicago 0 20 * * *",
+		},
+	}
+	okBuild := database.WorkspaceBuild{
+		Transition: database.WorkspaceTransitionStop,
+		// Put 24hr before the tick so it's eligible for autostart.
+		CreatedAt: okTick.Add(time.Hour * -24),
+	}
+	okJob := database.ProvisionerJob{
+		JobStatus: database.ProvisionerJobStatusSucceeded,
+	}
+	okTemplateSchedule := schedule.TemplateScheduleOptions{
+		UserAutostartEnabled: true,
+		AutostartRequirement: schedule.TemplateAutostartRequirement{
+			DaysOfWeek: 0b01111111,
+		},
+	}
+	var okWeekdayBit uint8
+	for i, weekday := range schedule.DaysOfWeek {
+		// Find the local weekday
+		if okTick.In(localLocation).Weekday() == weekday {
+			okWeekdayBit = 1 << uint(i)
+		}
+	}
+
+	testCases := []struct {
+		Name             string
+		Workspace        database.Workspace
+		Build            database.WorkspaceBuild
+		Job              database.ProvisionerJob
+		TemplateSchedule schedule.TemplateScheduleOptions
+		Tick             time.Time
+
+		ExpectedResponse bool
+	}{
+		{
+			Name:             "Ok",
+			Workspace:        okWorkspace,
+			Build:            okBuild,
+			Job:              okJob,
+			TemplateSchedule: okTemplateSchedule,
+			Tick:             okTick,
+			ExpectedResponse: true,
+		},
+		{
+			Name:      "AutostartOnlyDayEnabled",
+			Workspace: okWorkspace,
+			Build:     okBuild,
+			Job:       okJob,
+			TemplateSchedule: schedule.TemplateScheduleOptions{
+				UserAutostartEnabled: true,
+				AutostartRequirement: schedule.TemplateAutostartRequirement{
+					// Specific day of week is allowed
+					DaysOfWeek: okWeekdayBit,
+				},
+			},
+			Tick:             okTick,
+			ExpectedResponse: true,
+		},
+		{
+			Name:      "AutostartOnlyDayDisabled",
+			Workspace: okWorkspace,
+			Build:     okBuild,
+			Job:       okJob,
+			TemplateSchedule: schedule.TemplateScheduleOptions{
+				UserAutostartEnabled: true,
+				AutostartRequirement: schedule.TemplateAutostartRequirement{
+					// Specific day of week is disallowed
+					DaysOfWeek: 0b01111111 & (^okWeekdayBit),
+				},
+			},
+			Tick:             okTick,
+			ExpectedResponse: false,
+		},
+		{
+			Name:      "AutostartAllDaysDisabled",
+			Workspace: okWorkspace,
+			Build:     okBuild,
+			Job:       okJob,
+			TemplateSchedule: schedule.TemplateScheduleOptions{
+				UserAutostartEnabled: true,
+				AutostartRequirement: schedule.TemplateAutostartRequirement{
+					// All days disabled
+					DaysOfWeek: 0,
+				},
+			},
+			Tick:             okTick,
+			ExpectedResponse: false,
+		},
+		{
+			Name:      "BuildTransitionNotStop",
+			Workspace: okWorkspace,
+			Build: func(b database.WorkspaceBuild) database.WorkspaceBuild {
+				cpy := b
+				cpy.Transition = database.WorkspaceTransitionStart
+				return cpy
+			}(okBuild),
+			Job:              okJob,
+			TemplateSchedule: okTemplateSchedule,
+			Tick:             okTick,
+			ExpectedResponse: false,
+		},
+	}
+
+	for _, c := range testCases {
+		c := c
+		t.Run(c.Name, func(t *testing.T) {
+			t.Parallel()
+
+			autostart := isEligibleForAutostart(c.Workspace, c.Build, c.Job, c.TemplateSchedule, c.Tick)
+			require.Equal(t, c.ExpectedResponse, autostart, "autostart not expected")
+		})
+	}
+}
diff --git a/coderd/autobuild/lifecycle_executor_test.go b/coderd/autobuild/lifecycle_executor_test.go
index 7803c9fcd41da..81bbf80603898 100644
--- a/coderd/autobuild/lifecycle_executor_test.go
+++ b/coderd/autobuild/lifecycle_executor_test.go
@@ -11,16 +11,19 @@ import (
 	"github.com/stretchr/testify/require"
 	"go.uber.org/goleak"
 
+	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/coderd/autobuild"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/coderd/autobuild"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestExecutorAutostartOK(t *testing.T) {
@@ -58,55 +61,140 @@ func TestExecutorAutostartOK(t *testing.T) {
 
 	workspace = coderdtest.MustWorkspace(t, client, workspace.ID)
 	assert.Equal(t, codersdk.BuildReasonAutostart, workspace.LatestBuild.Reason)
+	// Assert some template props. If this is not set correctly, the test
+	// will fail.
+	ctx := testutil.Context(t, testutil.WaitShort)
+	template, err := client.Template(ctx, workspace.TemplateID)
+	require.NoError(t, err)
+	require.Equal(t, template.AutostartRequirement.DaysOfWeek, []string{"monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday"})
 }
 
 func TestExecutorAutostartTemplateUpdated(t *testing.T) {
 	t.Parallel()
 
-	var (
-		sched   = mustSchedule(t, "CRON_TZ=UTC 0 * * * *")
-		ctx     = context.Background()
-		err     error
-		tickCh  = make(chan time.Time)
-		statsCh = make(chan autobuild.Stats)
-		client  = coderdtest.New(t, &coderdtest.Options{
-			AutobuildTicker:          tickCh,
-			IncludeProvisionerDaemon: true,
-			AutobuildStats:           statsCh,
-		})
-		// Given: we have a user with a workspace that has autostart enabled
-		workspace = mustProvisionWorkspace(t, client, func(cwr *codersdk.CreateWorkspaceRequest) {
-			cwr.AutostartSchedule = ptr.Ref(sched.String())
-		})
-	)
-	// Given: workspace is stopped
-	workspace = coderdtest.MustTransitionWorkspace(t, client, workspace.ID, database.WorkspaceTransitionStart, database.WorkspaceTransitionStop)
-
-	// Given: the workspace template has been updated
-	orgs, err := client.OrganizationsByUser(ctx, workspace.OwnerID.String())
-	require.NoError(t, err)
-	require.Len(t, orgs, 1)
-
-	newVersion := coderdtest.UpdateTemplateVersion(t, client, orgs[0].ID, nil, workspace.TemplateID)
-	coderdtest.AwaitTemplateVersionJob(t, client, newVersion.ID)
-	require.NoError(t, client.UpdateActiveTemplateVersion(ctx, workspace.TemplateID, codersdk.UpdateActiveTemplateVersion{
-		ID: newVersion.ID,
-	}))
+	testCases := []struct {
+		name                 string
+		automaticUpdates     codersdk.AutomaticUpdates
+		compatibleParameters bool
+		expectStart          bool
+		expectUpdate         bool
+	}{
+		{
+			name:                 "Never",
+			automaticUpdates:     codersdk.AutomaticUpdatesNever,
+			compatibleParameters: true,
+			expectStart:          true,
+			expectUpdate:         false,
+		},
+		{
+			name:                 "Always_Compatible",
+			automaticUpdates:     codersdk.AutomaticUpdatesAlways,
+			compatibleParameters: true,
+			expectStart:          true,
+			expectUpdate:         true,
+		},
+		{
+			name:                 "Always_Incompatible",
+			automaticUpdates:     codersdk.AutomaticUpdatesAlways,
+			compatibleParameters: false,
+			expectStart:          false,
+			expectUpdate:         false,
+		},
+	}
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			var (
+				sched   = mustSchedule(t, "CRON_TZ=UTC 0 * * * *")
+				ctx     = context.Background()
+				err     error
+				tickCh  = make(chan time.Time)
+				statsCh = make(chan autobuild.Stats)
+				logger  = slogtest.Make(t, &slogtest.Options{IgnoreErrors: !tc.expectStart}).Leveled(slog.LevelDebug)
+				client  = coderdtest.New(t, &coderdtest.Options{
+					AutobuildTicker:          tickCh,
+					IncludeProvisionerDaemon: true,
+					AutobuildStats:           statsCh,
+					Logger:                   &logger,
+				})
+				// Given: we have a user with a workspace that has autostart enabled
+				workspace = mustProvisionWorkspace(t, client, func(cwr *codersdk.CreateWorkspaceRequest) {
+					cwr.AutostartSchedule = ptr.Ref(sched.String())
+					// Given: automatic updates from the test case
+					cwr.AutomaticUpdates = tc.automaticUpdates
+				})
+			)
+			// Given: workspace is stopped
+			workspace = coderdtest.MustTransitionWorkspace(
+				t, client, workspace.ID, database.WorkspaceTransitionStart, database.WorkspaceTransitionStop)
+
+			orgs, err := client.OrganizationsByUser(ctx, workspace.OwnerID.String())
+			require.NoError(t, err)
+			require.Len(t, orgs, 1)
+
+			var res *echo.Responses
+			if !tc.compatibleParameters {
+				// Given, parameters of the new version are not compatible.
+				// Since initial version has no parameters, any parameters in the new version will be incompatible
+				res = &echo.Responses{
+					Parse: echo.ParseComplete,
+					ProvisionApply: []*proto.Response{{
+						Type: &proto.Response_Apply{
+							Apply: &proto.ApplyComplete{
+								Parameters: []*proto.RichParameter{
+									{
+										Name:     "new",
+										Mutable:  false,
+										Required: true,
+									},
+								},
+							},
+						},
+					}},
+				}
+			}
 
-	// When: the autobuild executor ticks after the scheduled time
-	go func() {
-		tickCh <- sched.Next(workspace.LatestBuild.CreatedAt)
-		close(tickCh)
-	}()
+			// Given: the workspace template has been updated
+			newVersion := coderdtest.UpdateTemplateVersion(t, client, orgs[0].ID, res, workspace.TemplateID)
+			coderdtest.AwaitTemplateVersionJobCompleted(t, client, newVersion.ID)
+			require.NoError(t, client.UpdateActiveTemplateVersion(
+				ctx, workspace.TemplateID, codersdk.UpdateActiveTemplateVersion{
+					ID: newVersion.ID,
+				},
+			))
+
+			t.Log("sending autobuild tick")
+			// When: the autobuild executor ticks after the scheduled time
+			go func() {
+				tickCh <- sched.Next(workspace.LatestBuild.CreatedAt)
+				close(tickCh)
+			}()
+
+			stats := <-statsCh
+			assert.NoError(t, stats.Error)
+			if !tc.expectStart {
+				// Then: the workspace should not be started
+				assert.Len(t, stats.Transitions, 0)
+				return
+			}
 
-	// Then: the workspace should be started using the previous template version, and not the updated version.
-	stats := <-statsCh
-	assert.NoError(t, stats.Error)
-	assert.Len(t, stats.Transitions, 1)
-	assert.Contains(t, stats.Transitions, workspace.ID)
-	assert.Equal(t, database.WorkspaceTransitionStart, stats.Transitions[workspace.ID])
-	ws := coderdtest.MustWorkspace(t, client, workspace.ID)
-	assert.Equal(t, workspace.LatestBuild.TemplateVersionID, ws.LatestBuild.TemplateVersionID, "expected workspace build to be using the old template version")
+			// Then: the workspace should be started
+			assert.Len(t, stats.Transitions, 1)
+			assert.Contains(t, stats.Transitions, workspace.ID)
+			assert.Equal(t, database.WorkspaceTransitionStart, stats.Transitions[workspace.ID])
+			ws := coderdtest.MustWorkspace(t, client, workspace.ID)
+			if tc.expectUpdate {
+				// Then: uses the updated version
+				assert.Equal(t, newVersion.ID, ws.LatestBuild.TemplateVersionID,
+					"expected workspace build to be using the updated template version")
+			} else {
+				// Then: uses the previous template version
+				assert.Equal(t, workspace.LatestBuild.TemplateVersionID, ws.LatestBuild.TemplateVersionID,
+					"expected workspace build to be using the old template version")
+			}
+		})
+	}
 }
 
 func TestExecutorAutostartAlreadyRunning(t *testing.T) {
@@ -466,7 +554,7 @@ func TestExecutorWorkspaceAutostopNoWaitChangedMyMind(t *testing.T) {
 
 	// Wait for stop to complete
 	updated = coderdtest.MustWorkspace(t, client, workspace.ID)
-	_ = coderdtest.AwaitWorkspaceBuildJob(t, client, updated.LatestBuild.ID)
+	_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, updated.LatestBuild.ID)
 
 	// Start the workspace again
 	workspace = coderdtest.MustTransitionWorkspace(t, client, workspace.ID, database.WorkspaceTransitionStop, database.WorkspaceTransitionStart)
@@ -623,7 +711,7 @@ func TestExecutorAutostartTemplateDisabled(t *testing.T) {
 						UserAutostartEnabled: false,
 						UserAutostopEnabled:  true,
 						DefaultTTL:           0,
-						RestartRequirement:   schedule.TemplateRestartRequirement{},
+						AutostopRequirement:  schedule.TemplateAutostopRequirement{},
 					}, nil
 				},
 			},
@@ -650,6 +738,101 @@ func TestExecutorAutostartTemplateDisabled(t *testing.T) {
 	assert.Len(t, stats.Transitions, 0)
 }
 
+func TestExecutorAutostopTemplateDisabled(t *testing.T) {
+	t.Parallel()
+
+	// Given: we have a workspace built from a template that disallows user autostop
+	var (
+		sched   = mustSchedule(t, "CRON_TZ=UTC 0 * * * *")
+		tickCh  = make(chan time.Time)
+		statsCh = make(chan autobuild.Stats)
+
+		client = coderdtest.New(t, &coderdtest.Options{
+			AutobuildTicker:          tickCh,
+			IncludeProvisionerDaemon: true,
+			AutobuildStats:           statsCh,
+			// We are using a mock store here as the AGPL store does not implement this.
+			TemplateScheduleStore: schedule.MockTemplateScheduleStore{
+				GetFn: func(_ context.Context, _ database.Store, _ uuid.UUID) (schedule.TemplateScheduleOptions, error) {
+					return schedule.TemplateScheduleOptions{
+						UserAutostopEnabled: false,
+						DefaultTTL:          time.Hour,
+					}, nil
+				},
+			},
+		})
+		// Given: we have a user with a workspace configured to autostart some time in the future
+		workspace = mustProvisionWorkspace(t, client, func(cwr *codersdk.CreateWorkspaceRequest) {
+			cwr.TTLMillis = ptr.Ref(8 * time.Hour.Milliseconds())
+		})
+	)
+
+	// When: we create the workspace
+	// Then: the deadline should be set to the template default TTL
+	assert.WithinDuration(t, workspace.LatestBuild.CreatedAt.Add(time.Hour), workspace.LatestBuild.Deadline.Time, time.Minute)
+
+	// When: the autobuild executor ticks before the next scheduled time
+	go func() {
+		tickCh <- sched.Next(workspace.LatestBuild.CreatedAt).Add(time.Minute)
+		close(tickCh)
+	}()
+
+	// Then: nothing should happen
+	stats := <-statsCh
+	assert.NoError(t, stats.Error)
+	assert.Len(t, stats.Transitions, 0)
+}
+
+// Test that an AGPL AccessControlStore properly disables
+// functionality.
+func TestExecutorRequireActiveVersion(t *testing.T) {
+	t.Parallel()
+
+	var (
+		sched  = mustSchedule(t, "CRON_TZ=UTC 0 * * * *")
+		ticker = make(chan time.Time)
+		statCh = make(chan autobuild.Stats)
+
+		ownerClient = coderdtest.New(t, &coderdtest.Options{
+			AutobuildTicker:          ticker,
+			IncludeProvisionerDaemon: true,
+			AutobuildStats:           statCh,
+			TemplateScheduleStore:    schedule.NewAGPLTemplateScheduleStore(),
+		})
+	)
+	owner := coderdtest.CreateFirstUser(t, ownerClient)
+
+	// Create an active and inactive template version. We'll
+	// build a regular member's workspace using a non-active
+	// template version and assert that the field is not abided
+	// since there is no enterprise license.
+	activeVersion := coderdtest.CreateTemplateVersion(t, ownerClient, owner.OrganizationID, nil)
+	template := coderdtest.CreateTemplate(t, ownerClient, owner.OrganizationID, activeVersion.ID, func(ctr *codersdk.CreateTemplateRequest) {
+		ctr.RequireActiveVersion = true
+		ctr.VersionID = activeVersion.ID
+	})
+	inactiveVersion := coderdtest.CreateTemplateVersion(t, ownerClient, owner.OrganizationID, nil, func(ctvr *codersdk.CreateTemplateVersionRequest) {
+		ctvr.TemplateID = template.ID
+	})
+	coderdtest.AwaitTemplateVersionJobCompleted(t, ownerClient, activeVersion.ID)
+	memberClient, _ := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID)
+	ws := coderdtest.CreateWorkspace(t, memberClient, owner.OrganizationID, uuid.Nil, func(cwr *codersdk.CreateWorkspaceRequest) {
+		cwr.TemplateVersionID = inactiveVersion.ID
+		cwr.AutostartSchedule = ptr.Ref(sched.String())
+	})
+	_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, ownerClient, ws.LatestBuild.ID)
+	ws = coderdtest.MustTransitionWorkspace(t, memberClient, ws.ID, database.WorkspaceTransitionStart, database.WorkspaceTransitionStop, func(req *codersdk.CreateWorkspaceBuildRequest) {
+		req.TemplateVersionID = inactiveVersion.ID
+	})
+	require.Equal(t, inactiveVersion.ID, ws.LatestBuild.TemplateVersionID)
+	ticker <- sched.Next(ws.LatestBuild.CreatedAt)
+	stats := <-statCh
+	require.Len(t, stats.Transitions, 1)
+
+	ws = coderdtest.MustWorkspace(t, memberClient, ws.ID)
+	require.Equal(t, inactiveVersion.ID, ws.LatestBuild.TemplateVersionID)
+}
+
 // TestExecutorFailedWorkspace test AGPL functionality which mainly
 // ensures that autostop actions as a result of a failed workspace
 // build do not trigger.
@@ -683,15 +866,15 @@ func TestExecutorFailedWorkspace(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionFailed,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyFailed,
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 			ctr.FailureTTLMillis = ptr.Ref[int64](failureTTL.Milliseconds())
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		require.Equal(t, codersdk.WorkspaceStatusFailed, build.Status)
 		ticker <- build.Job.CompletedAt.Add(failureTTL * 2)
 		stats := <-statCh
@@ -733,15 +916,15 @@ func TestExecutorInactiveWorkspace(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
-			ctr.InactivityTTLMillis = ptr.Ref[int64](inactiveTTL.Milliseconds())
+			ctr.TimeTilDormantMillis = ptr.Ref[int64](inactiveTTL.Milliseconds())
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		require.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
 		ticker <- ws.LastUsedAt.Add(inactiveTTL * 2)
 		stats := <-statCh
@@ -755,9 +938,9 @@ func mustProvisionWorkspace(t *testing.T, client *codersdk.Client, mut ...func(*
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID, mut...)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 	return coderdtest.MustWorkspace(t, client, ws.ID)
 }
 
@@ -766,33 +949,27 @@ func mustProvisionWorkspaceWithParameters(t *testing.T, client *codersdk.Client,
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse: echo.ParseComplete,
-		ProvisionPlan: []*proto.Provision_Response{
+		ProvisionPlan: []*proto.Response{
 			{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
 						Parameters: richParameters,
 					},
 				},
 			},
 		},
-		ProvisionApply: []*proto.Provision_Response{
-			{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{},
-				},
-			},
-		},
+		ProvisionApply: echo.ApplyComplete,
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID, mut...)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 	return coderdtest.MustWorkspace(t, client, ws.ID)
 }
 
-func mustSchedule(t *testing.T, s string) *schedule.Schedule {
+func mustSchedule(t *testing.T, s string) *cron.Schedule {
 	t.Helper()
-	sched, err := schedule.Weekly(s)
+	sched, err := cron.Weekly(s)
 	require.NoError(t, err)
 	return sched
 }
diff --git a/coderd/autobuild/notify/notifier_test.go b/coderd/autobuild/notify/notifier_test.go
index fb547defd5b36..09e8158abaa99 100644
--- a/coderd/autobuild/notify/notifier_test.go
+++ b/coderd/autobuild/notify/notifier_test.go
@@ -9,7 +9,7 @@ import (
 	"go.uber.org/atomic"
 	"go.uber.org/goleak"
 
-	"github.com/coder/coder/coderd/autobuild/notify"
+	"github.com/coder/coder/v2/coderd/autobuild/notify"
 )
 
 func TestNotifier(t *testing.T) {
diff --git a/coderd/awsidentity/awsidentity.go b/coderd/awsidentity/awsidentity.go
index 98d0e694786c9..ff96fd2b0af1f 100644
--- a/coderd/awsidentity/awsidentity.go
+++ b/coderd/awsidentity/awsidentity.go
@@ -16,16 +16,23 @@ import (
 type Region string
 
 const (
-	Other    Region = "other"
-	HongKong Region = "hongkong"
-	Bahrain  Region = "bahrain"
-	CapeTown Region = "capetown"
-	Milan    Region = "milan"
-	China    Region = "china"
-	GovCloud Region = "govcloud"
+	Other     Region = "other"
+	CapeTown  Region = "capetown"
+	HongKong  Region = "hongkong"
+	Hyderabad Region = "hyderabad"
+	Jakarta   Region = "jakarta"
+	Melbourne Region = "melbourne"
+	China     Region = "china"
+	Milan     Region = "milan"
+	Spain     Region = "spain"
+	Zurich    Region = "zurich"
+	TelAviv   Region = "telaviv"
+	Bahrain   Region = "bahrain"
+	UAE       Region = "uae"
+	GovCloud  Region = "govcloud"
 )
 
-var All = []Region{Other, HongKong, Bahrain, CapeTown, Milan, China, GovCloud}
+var All = []Region{Other, CapeTown, HongKong, Hyderabad, Jakarta, Melbourne, China, Milan, Spain, Zurich, TelAviv, Bahrain, UAE, GovCloud}
 
 // Certificates hold public keys for various AWS regions. See:
 type Certificates map[Region]string
@@ -193,6 +200,104 @@ WtgIe3M3iwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAHzQC5XZVeuD9GTJTsbO5AyH
 ZQvki/jfARNrD9dgBRYZzLC/NOkWG6M9wlrmks9RtdNxc53nLxKq4I2Dd73gI0yQ
 wYu9YYwmM/LMgmPlI33Rg2Ohwq4DVgT3hO170PL6Fsgiq3dMvctSImJvjWktBQaT
 bcAgaZLHGIpXPrWSA2d+
+-----END CERTIFICATE-----`,
+	TelAviv: `-----BEGIN CERTIFICATE-----
+MIICMzCCAZygAwIBAgIGAX0QQGVLMA0GCSqGSIb3DQEBBQUAMFwxCzAJBgNVBAYT
+AlVTMRkwFwYDVQQIDBBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHDAdTZWF0dGxl
+MSAwHgYDVQQKDBdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMTExMTExODI2
+MzVaGA8yMjAwMTExMTE4MjYzNVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgMEFdh
+c2hpbmd0b24gU3RhdGUxEDAOBgNVBAcMB1NlYXR0bGUxIDAeBgNVBAoMF0FtYXpv
+biBXZWIgU2VydmljZXMgTExDMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDr
+c24u3AgFxnoPgzxR6yFXOamcPuxYXhYKWmapb+S8vOy5hpLoRe4RkOrY0cM3bN07
+GdEMlin5mU0y1t8y3ct4YewvmkgT42kTyMM+t1K4S0xsqjXxxS716uGYh7eWtkxr
+Cihj8AbXN/6pa095h+7TZyl2n83keiNUzM2KoqQVMwIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBADwA6VVEIIZD2YL00F12po40xDLzIc9XvqFPS9iFaWi2ho8wLio7wA49
+VYEFZSI9CR3SGB9tL8DUib97mlxmd1AcGShMmMlhSB29vhuhrUNB/FmU7H8s62/j
+D6cOR1A1cClIyZUe1yT1ZbPySCs43J+Thr8i8FSRxzDBSZZi5foW
+-----END CERTIFICATE-----`,
+	UAE: `-----BEGIN CERTIFICATE-----
+MIICMzCCAZygAwIBAgIGAXjRrnDjMA0GCSqGSIb3DQEBBQUAMFwxCzAJBgNVBAYT
+AlVTMRkwFwYDVQQIDBBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHDAdTZWF0dGxl
+MSAwHgYDVQQKDBdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMTA0MTQxODM5
+MzNaGA8yMjAwMDQxNDE4MzkzM1owXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgMEFdh
+c2hpbmd0b24gU3RhdGUxEDAOBgNVBAcMB1NlYXR0bGUxIDAeBgNVBAoMF0FtYXpv
+biBXZWIgU2VydmljZXMgTExDMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDc
+aTgW/KyA6zyruJQrYy00a6wqLA7eeUzk3bMiTkLsTeDQfrkaZMfBAjGaaOymRo1C
+3qzE4rIenmahvUplu9ZmLwL1idWXMRX2RlSvIt+d2SeoKOKQWoc2UOFZMHYxDue7
+zkyk1CIRaBukTeY13/RIrlc6X61zJ5BBtZXlHwayjQIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBABTqTy3R6RXKPW45FA+cgo7YZEj/Cnz5YaoUivRRdX2A83BHuBTvJE2+
+WX00FTEj4hRVjameE1nENoO8Z7fUVloAFDlDo69fhkJeSvn51D1WRrPnoWGgEfr1
++OfK1bAcKTtfkkkP9r4RdwSjKzO5Zu/B+Wqm3kVEz/QNcz6npmA6
+-----END CERTIFICATE-----`,
+	Zurich: `-----BEGIN CERTIFICATE-----
+MIICMzCCAZygAwIBAgIGAXjSGFGiMA0GCSqGSIb3DQEBBQUAMFwxCzAJBgNVBAYT
+AlVTMRkwFwYDVQQIDBBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHDAdTZWF0dGxl
+MSAwHgYDVQQKDBdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMTA0MTQyMDM1
+MTJaGA8yMjAwMDQxNDIwMzUxMlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgMEFdh
+c2hpbmd0b24gU3RhdGUxEDAOBgNVBAcMB1NlYXR0bGUxIDAeBgNVBAoMF0FtYXpv
+biBXZWIgU2VydmljZXMgTExDMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2
+mdGdps5Rz2jzYcGNsgETTGUthJRrVqSnUWJXTlVaIbkGPLKO6Or7AfWKFp2sgRJ8
+vLsjoBVR5cESVK7cuK1wItjvJyi/opKZAUusJx2hpgU3pUHhlp9ATh/VeVD582jT
+d9IY+8t5MDa6Z3fGliByEiXz0LEHdi8MBacLREu1TwIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAILlpoE3k9o7KdALAxsFJNitVS+g3RMzdbiFM+7MA63Nv5fsf+0xgcjS
+NBElvPCDKFvTJl4QQhToy056llO5GvdS9RK+H8xrP2mrqngApoKTApv93vHBixgF
+Sn5KrczRO0YSm3OjkqbydU7DFlmkXXR7GYE+5jbHvQHYiT1J5sMu
+-----END CERTIFICATE-----`,
+	Spain: `-----BEGIN CERTIFICATE-----
+MIICMzCCAZygAwIBAgIGAXjwLkiaMA0GCSqGSIb3DQEBBQUAMFwxCzAJBgNVBAYT
+AlVTMRkwFwYDVQQIDBBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHDAdTZWF0dGxl
+MSAwHgYDVQQKDBdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMTA0MjAxNjQ3
+NDhaGA8yMjAwMDQyMDE2NDc0OFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgMEFdh
+c2hpbmd0b24gU3RhdGUxEDAOBgNVBAcMB1NlYXR0bGUxIDAeBgNVBAoMF0FtYXpv
+biBXZWIgU2VydmljZXMgTExDMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDB
+/VvR1+45Aey5zn3vPk6xBm5o9grSDL6D2iAuprQnfVXn8CIbSDbWFhA3fi5ippjK
+kh3sl8VyCvCOUXKdOaNrYBrPRkrdHdBuL2Tc84RO+3m/rxIUZ2IK1fDlC6sWAjdd
+f6sBrV2w2a78H0H8EwuwiSgttURBjwJ7KPPJCqaqrQIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAKR+FzqQDzun/iMMzcFucmLMl5BxEblrFXOz7IIuOeiGkndmrqUeDCyk
+ztLku45s7hxdNy4ltTuVAaE5aNBdw5J8U1mRvsKvHLy2ThH6hAWKwTqtPAJp7M21
+GDwgDDOkPSz6XVOehg+hBgiphYp84DUbWVYeP8YqLEJSqscKscWC
+-----END CERTIFICATE-----`,
+	Melbourne: `-----BEGIN CERTIFICATE-----
+MIICMzCCAZygAwIBAgIGAXjSh40SMA0GCSqGSIb3DQEBBQUAMFwxCzAJBgNVBAYT
+AlVTMRkwFwYDVQQIDBBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHDAdTZWF0dGxl
+MSAwHgYDVQQKDBdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMTA0MTQyMjM2
+NDJaGA8yMjAwMDQxNDIyMzY0MlowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgMEFdh
+c2hpbmd0b24gU3RhdGUxEDAOBgNVBAcMB1NlYXR0bGUxIDAeBgNVBAoMF0FtYXpv
+biBXZWIgU2VydmljZXMgTExDMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDH
+ezwQr2VQpQSTW5TXNefiQrP+qWTGAbGsPeMX4hBMjAJUKys2NIRcRZaLM/BCew2F
+IPVjNtlaj6Gwn9ipU4Mlz3zIwAMWi1AvGMSreppt+wV6MRtfOjh0Dvj/veJe88aE
+ZJMozNgkJFRS+WFWsckQeL56tf6kY6QTlNo8V/0CsQIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAF7vpPghH0FRo5gu49EArRNPrIvW1egMdZHrzJNqbztLCtV/wcgkqIww
+uXYj+1rhlL+/iMpQWjdVGEqIZSeXn5fLmdx50eegFCwND837r9e8XYTiQS143Sxt
+9+Yi6BZ7U7YD8kK9NBWoJxFqUeHdpRCs0O7COjT3gwm7ZxvAmssh
+-----END CERTIFICATE-----`,
+	Jakarta: `-----BEGIN CERTIFICATE-----
+MIICMzCCAZygAwIBAgIGAXbVDG2yMA0GCSqGSIb3DQEBBQUAMFwxCzAJBgNVBAYT
+AlVTMRkwFwYDVQQIDBBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHDAdTZWF0dGxl
+MSAwHgYDVQQKDBdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMTAxMDYwMDE1
+MzBaGA8yMjAwMDEwNjAwMTUzMFowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgMEFdh
+c2hpbmd0b24gU3RhdGUxEDAOBgNVBAcMB1NlYXR0bGUxIDAeBgNVBAoMF0FtYXpv
+biBXZWIgU2VydmljZXMgTExDMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCn
+CS/Vbt0gQ1ebWcur2hSO7PnJifE4OPxQ7RgSAlc4/spJp1sDP+ZrS0LO1ZJfKhXf
+1R9S3AUwLnsc7b+IuVXdY5LK9RKqu64nyXP5dx170zoL8loEyCSuRR2fs+04i2Qs
+WBVP+KFNAn7P5L1EHRjkgTO8kjNKviwRV+OkP9ab5wIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAI4WUy6+DKh0JDSzQEZNyBgNlSoSuC2owtMxCwGB6nBfzzfcekWvs6eo
+fLTSGovrReX7MtVgrcJBZjmPIentw5dWUs+87w/g9lNwUnUt0ZHYyh2tuBG6hVJu
+UEwDJ/z3wDd6wQviLOTF3MITawt9P8siR1hXqLJNxpjRQFZrgHqi
+-----END CERTIFICATE-----`,
+	Hyderabad: `-----BEGIN CERTIFICATE-----
+MIICMzCCAZygAwIBAgIGAXjwLj9CMA0GCSqGSIb3DQEBBQUAMFwxCzAJBgNVBAYT
+AlVTMRkwFwYDVQQIDBBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHDAdTZWF0dGxl
+MSAwHgYDVQQKDBdBbWF6b24gV2ViIFNlcnZpY2VzIExMQzAgFw0yMTA0MjAxNjQ3
+NDVaGA8yMjAwMDQyMDE2NDc0NVowXDELMAkGA1UEBhMCVVMxGTAXBgNVBAgMEFdh
+c2hpbmd0b24gU3RhdGUxEDAOBgNVBAcMB1NlYXR0bGUxIDAeBgNVBAoMF0FtYXpv
+biBXZWIgU2VydmljZXMgTExDMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDT
+wHu0ND+sFcobrjvcAYm0PNRD8f4R1jAzvoLt2+qGeOTAyO1Httj6cmsYN3AP1hN5
+iYuppFiYsl2eNPa/CD0Vg0BAfDFlV5rzjpA0j7TJabVh4kj7JvtD+xYMi6wEQA4x
+6SPONY4OeZ2+8o/HS8nucpWDVdPRO6ciWUlMhjmDmwIDAQABMA0GCSqGSIb3DQEB
+BQUAA4GBAAy6sgTdRkTqELHBeWj69q60xHyUmsWqHAQNXKVc9ApWGG4onzuqlMbG
+ETwUZ9mTq2vxlV0KvuetCDNS5u4cJsxe/TGGbYP0yP2qfMl0cCImzRI5W0gn8gog
+dervfeT7nH5ih0TWEy/QDWfkQ601L4erm4yh4YQq8vcqAPSkf04N
 -----END CERTIFICATE-----`,
 	GovCloud: `-----BEGIN CERTIFICATE-----
 MIIDCzCCAnSgAwIBAgIJAIe9Hnq82O7UMA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNV
diff --git a/coderd/awsidentity/awsidentity_test.go b/coderd/awsidentity/awsidentity_test.go
index 755079fc87b80..50aeec98aea22 100644
--- a/coderd/awsidentity/awsidentity_test.go
+++ b/coderd/awsidentity/awsidentity_test.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/awsidentity"
+	"github.com/coder/coder/v2/coderd/awsidentity"
 )
 
 const (
diff --git a/coderd/azureidentity/azureidentity_test.go b/coderd/azureidentity/azureidentity_test.go
index 08dda41976166..1ae35d0385429 100644
--- a/coderd/azureidentity/azureidentity_test.go
+++ b/coderd/azureidentity/azureidentity_test.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/azureidentity"
+	"github.com/coder/coder/v2/coderd/azureidentity"
 )
 
 func TestValidate(t *testing.T) {
diff --git a/coderd/batchstats/batcher.go b/coderd/batchstats/batcher.go
new file mode 100644
index 0000000000000..cc234c693e462
--- /dev/null
+++ b/coderd/batchstats/batcher.go
@@ -0,0 +1,301 @@
+package batchstats
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/sloghuman"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+)
+
+const (
+	defaultBufferSize    = 1024
+	defaultFlushInterval = time.Second
+)
+
+// Batcher holds a buffer of agent stats and periodically flushes them to
+// its configured store. It also updates the workspace's last used time.
+type Batcher struct {
+	store database.Store
+	log   slog.Logger
+
+	mu sync.Mutex
+	// TODO: make this a buffered chan instead?
+	buf *database.InsertWorkspaceAgentStatsParams
+	// NOTE: we batch this separately as it's a jsonb field and
+	// pq.Array + unnest doesn't play nicely with this.
+	connectionsByProto []map[string]int64
+	batchSize          int
+
+	// tickCh is used to periodically flush the buffer.
+	tickCh   <-chan time.Time
+	ticker   *time.Ticker
+	interval time.Duration
+	// flushLever is used to signal the flusher to flush the buffer immediately.
+	flushLever  chan struct{}
+	flushForced atomic.Bool
+	// flushed is used during testing to signal that a flush has completed.
+	flushed chan<- int
+}
+
+// Option is a functional option for configuring a Batcher.
+type Option func(b *Batcher)
+
+// WithStore sets the store to use for storing stats.
+func WithStore(store database.Store) Option {
+	return func(b *Batcher) {
+		b.store = store
+	}
+}
+
+// WithBatchSize sets the number of stats to store in a batch.
+func WithBatchSize(size int) Option {
+	return func(b *Batcher) {
+		b.batchSize = size
+	}
+}
+
+// WithInterval sets the interval for flushes.
+func WithInterval(d time.Duration) Option {
+	return func(b *Batcher) {
+		b.interval = d
+	}
+}
+
+// WithLogger sets the logger to use for logging.
+func WithLogger(log slog.Logger) Option {
+	return func(b *Batcher) {
+		b.log = log
+	}
+}
+
+// New creates a new Batcher and starts it.
+func New(ctx context.Context, opts ...Option) (*Batcher, func(), error) {
+	b := &Batcher{}
+	b.log = slog.Make(sloghuman.Sink(os.Stderr))
+	b.flushLever = make(chan struct{}, 1) // Buffered so that it doesn't block.
+	for _, opt := range opts {
+		opt(b)
+	}
+
+	if b.store == nil {
+		return nil, nil, xerrors.Errorf("no store configured for batcher")
+	}
+
+	if b.interval == 0 {
+		b.interval = defaultFlushInterval
+	}
+
+	if b.batchSize == 0 {
+		b.batchSize = defaultBufferSize
+	}
+
+	if b.tickCh == nil {
+		b.ticker = time.NewTicker(b.interval)
+		b.tickCh = b.ticker.C
+	}
+
+	b.initBuf(b.batchSize)
+
+	cancelCtx, cancelFunc := context.WithCancel(ctx)
+	done := make(chan struct{})
+	go func() {
+		b.run(cancelCtx)
+		close(done)
+	}()
+
+	closer := func() {
+		cancelFunc()
+		if b.ticker != nil {
+			b.ticker.Stop()
+		}
+		<-done
+	}
+
+	return b, closer, nil
+}
+
+// Add adds a stat to the batcher for the given workspace and agent.
+func (b *Batcher) Add(
+	now time.Time,
+	agentID uuid.UUID,
+	templateID uuid.UUID,
+	userID uuid.UUID,
+	workspaceID uuid.UUID,
+	st agentsdk.Stats,
+) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	now = dbtime.Time(now)
+
+	b.buf.ID = append(b.buf.ID, uuid.New())
+	b.buf.CreatedAt = append(b.buf.CreatedAt, now)
+	b.buf.AgentID = append(b.buf.AgentID, agentID)
+	b.buf.UserID = append(b.buf.UserID, userID)
+	b.buf.TemplateID = append(b.buf.TemplateID, templateID)
+	b.buf.WorkspaceID = append(b.buf.WorkspaceID, workspaceID)
+
+	// Store the connections by proto separately as it's a jsonb field. We marshal on flush.
+	// b.buf.ConnectionsByProto = append(b.buf.ConnectionsByProto, st.ConnectionsByProto)
+	b.connectionsByProto = append(b.connectionsByProto, st.ConnectionsByProto)
+
+	b.buf.ConnectionCount = append(b.buf.ConnectionCount, st.ConnectionCount)
+	b.buf.RxPackets = append(b.buf.RxPackets, st.RxPackets)
+	b.buf.RxBytes = append(b.buf.RxBytes, st.RxBytes)
+	b.buf.TxPackets = append(b.buf.TxPackets, st.TxPackets)
+	b.buf.TxBytes = append(b.buf.TxBytes, st.TxBytes)
+	b.buf.SessionCountVSCode = append(b.buf.SessionCountVSCode, st.SessionCountVSCode)
+	b.buf.SessionCountJetBrains = append(b.buf.SessionCountJetBrains, st.SessionCountJetBrains)
+	b.buf.SessionCountReconnectingPTY = append(b.buf.SessionCountReconnectingPTY, st.SessionCountReconnectingPTY)
+	b.buf.SessionCountSSH = append(b.buf.SessionCountSSH, st.SessionCountSSH)
+	b.buf.ConnectionMedianLatencyMS = append(b.buf.ConnectionMedianLatencyMS, st.ConnectionMedianLatencyMS)
+
+	// If the buffer is over 80% full, signal the flusher to flush immediately.
+	// We want to trigger flushes early to reduce the likelihood of
+	// accidentally growing the buffer over batchSize.
+	filled := float64(len(b.buf.ID)) / float64(b.batchSize)
+	if filled >= 0.8 && !b.flushForced.Load() {
+		b.flushLever <- struct{}{}
+		b.flushForced.Store(true)
+	}
+	return nil
+}
+
+// Run runs the batcher.
+func (b *Batcher) run(ctx context.Context) {
+	// nolint:gocritic // This is only ever used for one thing - inserting agent stats.
+	authCtx := dbauthz.AsSystemRestricted(ctx)
+	for {
+		select {
+		case <-b.tickCh:
+			b.flush(authCtx, false, "scheduled")
+		case <-b.flushLever:
+			// If the flush lever is depressed, flush the buffer immediately.
+			b.flush(authCtx, true, "reaching capacity")
+		case <-ctx.Done():
+			b.log.Debug(ctx, "context done, flushing before exit")
+
+			// We must create a new context here as the parent context is done.
+			ctxTimeout, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+			defer cancel() //nolint:revive // We're returning, defer is fine.
+
+			// nolint:gocritic // This is only ever used for one thing - inserting agent stats.
+			b.flush(dbauthz.AsSystemRestricted(ctxTimeout), true, "exit")
+			return
+		}
+	}
+}
+
+// flush flushes the batcher's buffer.
+func (b *Batcher) flush(ctx context.Context, forced bool, reason string) {
+	b.mu.Lock()
+	b.flushForced.Store(true)
+	start := time.Now()
+	count := len(b.buf.ID)
+	defer func() {
+		b.flushForced.Store(false)
+		b.mu.Unlock()
+		if count > 0 {
+			elapsed := time.Since(start)
+			b.log.Debug(ctx, "flush complete",
+				slog.F("count", count),
+				slog.F("elapsed", elapsed),
+				slog.F("forced", forced),
+				slog.F("reason", reason),
+			)
+		}
+		// Notify that a flush has completed. This only happens in tests.
+		if b.flushed != nil {
+			select {
+			case <-ctx.Done():
+				close(b.flushed)
+			default:
+				b.flushed <- count
+			}
+		}
+	}()
+
+	if len(b.buf.ID) == 0 {
+		return
+	}
+
+	// marshal connections by proto
+	payload, err := json.Marshal(b.connectionsByProto)
+	if err != nil {
+		b.log.Error(ctx, "unable to marshal agent connections by proto, dropping data", slog.Error(err))
+		b.buf.ConnectionsByProto = json.RawMessage(`[]`)
+	} else {
+		b.buf.ConnectionsByProto = payload
+	}
+
+	err = b.store.InsertWorkspaceAgentStats(ctx, *b.buf)
+	elapsed := time.Since(start)
+	if err != nil {
+		if database.IsQueryCanceledError(err) {
+			b.log.Debug(ctx, "query canceled, skipping insert of workspace agent stats", slog.F("elapsed", elapsed))
+			return
+		}
+		b.log.Error(ctx, "error inserting workspace agent stats", slog.Error(err), slog.F("elapsed", elapsed))
+		return
+	}
+
+	b.resetBuf()
+}
+
+// initBuf resets the buffer. b MUST be locked.
+func (b *Batcher) initBuf(size int) {
+	b.buf = &database.InsertWorkspaceAgentStatsParams{
+		ID:                          make([]uuid.UUID, 0, b.batchSize),
+		CreatedAt:                   make([]time.Time, 0, b.batchSize),
+		UserID:                      make([]uuid.UUID, 0, b.batchSize),
+		WorkspaceID:                 make([]uuid.UUID, 0, b.batchSize),
+		TemplateID:                  make([]uuid.UUID, 0, b.batchSize),
+		AgentID:                     make([]uuid.UUID, 0, b.batchSize),
+		ConnectionsByProto:          json.RawMessage("[]"),
+		ConnectionCount:             make([]int64, 0, b.batchSize),
+		RxPackets:                   make([]int64, 0, b.batchSize),
+		RxBytes:                     make([]int64, 0, b.batchSize),
+		TxPackets:                   make([]int64, 0, b.batchSize),
+		TxBytes:                     make([]int64, 0, b.batchSize),
+		SessionCountVSCode:          make([]int64, 0, b.batchSize),
+		SessionCountJetBrains:       make([]int64, 0, b.batchSize),
+		SessionCountReconnectingPTY: make([]int64, 0, b.batchSize),
+		SessionCountSSH:             make([]int64, 0, b.batchSize),
+		ConnectionMedianLatencyMS:   make([]float64, 0, b.batchSize),
+	}
+
+	b.connectionsByProto = make([]map[string]int64, 0, size)
+}
+
+func (b *Batcher) resetBuf() {
+	b.buf.ID = b.buf.ID[:0]
+	b.buf.CreatedAt = b.buf.CreatedAt[:0]
+	b.buf.UserID = b.buf.UserID[:0]
+	b.buf.WorkspaceID = b.buf.WorkspaceID[:0]
+	b.buf.TemplateID = b.buf.TemplateID[:0]
+	b.buf.AgentID = b.buf.AgentID[:0]
+	b.buf.ConnectionsByProto = json.RawMessage(`[]`)
+	b.buf.ConnectionCount = b.buf.ConnectionCount[:0]
+	b.buf.RxPackets = b.buf.RxPackets[:0]
+	b.buf.RxBytes = b.buf.RxBytes[:0]
+	b.buf.TxPackets = b.buf.TxPackets[:0]
+	b.buf.TxBytes = b.buf.TxBytes[:0]
+	b.buf.SessionCountVSCode = b.buf.SessionCountVSCode[:0]
+	b.buf.SessionCountJetBrains = b.buf.SessionCountJetBrains[:0]
+	b.buf.SessionCountReconnectingPTY = b.buf.SessionCountReconnectingPTY[:0]
+	b.buf.SessionCountSSH = b.buf.SessionCountSSH[:0]
+	b.buf.ConnectionMedianLatencyMS = b.buf.ConnectionMedianLatencyMS[:0]
+	b.connectionsByProto = b.connectionsByProto[:0]
+}
diff --git a/coderd/batchstats/batcher_internal_test.go b/coderd/batchstats/batcher_internal_test.go
new file mode 100644
index 0000000000000..f9bc9e13726fa
--- /dev/null
+++ b/coderd/batchstats/batcher_internal_test.go
@@ -0,0 +1,228 @@
+package batchstats
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/cryptorand"
+)
+
+func TestBatchStats(t *testing.T) {
+	t.Parallel()
+
+	// Given: a fresh batcher with no data
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	log := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+	store, ps := dbtestutil.NewDB(t)
+
+	// Set up some test dependencies.
+	deps1 := setupDeps(t, store, ps)
+	deps2 := setupDeps(t, store, ps)
+	tick := make(chan time.Time)
+	flushed := make(chan int, 1)
+
+	b, closer, err := New(ctx,
+		WithStore(store),
+		WithLogger(log),
+		func(b *Batcher) {
+			b.tickCh = tick
+			b.flushed = flushed
+		},
+	)
+	require.NoError(t, err)
+	t.Cleanup(closer)
+
+	// Given: no data points are added for workspace
+	// When: it becomes time to report stats
+	t1 := dbtime.Now()
+	// Signal a tick and wait for a flush to complete.
+	tick <- t1
+	f := <-flushed
+	require.Equal(t, 0, f, "expected no data to be flushed")
+	t.Logf("flush 1 completed")
+
+	// Then: it should report no stats.
+	stats, err := store.GetWorkspaceAgentStats(ctx, t1)
+	require.NoError(t, err, "should not error getting stats")
+	require.Empty(t, stats, "should have no stats for workspace")
+
+	// Given: a single data point is added for workspace
+	t2 := t1.Add(time.Second)
+	t.Logf("inserting 1 stat")
+	require.NoError(t, b.Add(t2.Add(time.Millisecond), deps1.Agent.ID, deps1.User.ID, deps1.Template.ID, deps1.Workspace.ID, randAgentSDKStats(t)))
+
+	// When: it becomes time to report stats
+	// Signal a tick and wait for a flush to complete.
+	tick <- t2
+	f = <-flushed // Wait for a flush to complete.
+	require.Equal(t, 1, f, "expected one stat to be flushed")
+	t.Logf("flush 2 completed")
+
+	// Then: it should report a single stat.
+	stats, err = store.GetWorkspaceAgentStats(ctx, t2)
+	require.NoError(t, err, "should not error getting stats")
+	require.Len(t, stats, 1, "should have stats for workspace")
+
+	// Given: a lot of data points are added for both workspaces
+	// (equal to batch size)
+	t3 := t2.Add(time.Second)
+	done := make(chan struct{})
+
+	go func() {
+		defer close(done)
+		t.Logf("inserting %d stats", defaultBufferSize)
+		for i := 0; i < defaultBufferSize; i++ {
+			if i%2 == 0 {
+				require.NoError(t, b.Add(t3.Add(time.Millisecond), deps1.Agent.ID, deps1.User.ID, deps1.Template.ID, deps1.Workspace.ID, randAgentSDKStats(t)))
+			} else {
+				require.NoError(t, b.Add(t3.Add(time.Millisecond), deps2.Agent.ID, deps2.User.ID, deps2.Template.ID, deps2.Workspace.ID, randAgentSDKStats(t)))
+			}
+		}
+	}()
+
+	// When: the buffer comes close to capacity
+	// Then: The buffer will force-flush once.
+	f = <-flushed
+	t.Logf("flush 3 completed")
+	require.Greater(t, f, 819, "expected at least 819 stats to be flushed (>=80% of buffer)")
+	// And we should finish inserting the stats
+	<-done
+
+	stats, err = store.GetWorkspaceAgentStats(ctx, t3)
+	require.NoError(t, err, "should not error getting stats")
+	require.Len(t, stats, 2, "should have stats for both workspaces")
+
+	// Ensures that a subsequent flush pushes all the remaining data
+	t4 := t3.Add(time.Second)
+	tick <- t4
+	f2 := <-flushed
+	t.Logf("flush 4 completed")
+	expectedCount := defaultBufferSize - f
+	require.Equal(t, expectedCount, f2, "did not flush expected remaining rows")
+
+	// Ensure that a subsequent flush does not push stale data.
+	t5 := t4.Add(time.Second)
+	tick <- t5
+	f = <-flushed
+	require.Zero(t, f, "expected zero stats to have been flushed")
+	t.Logf("flush 5 completed")
+
+	stats, err = store.GetWorkspaceAgentStats(ctx, t5)
+	require.NoError(t, err, "should not error getting stats")
+	require.Len(t, stats, 0, "should have no stats for workspace")
+
+	// Ensure that buf never grew beyond what we expect
+	require.Equal(t, defaultBufferSize, cap(b.buf.ID), "buffer grew beyond expected capacity")
+}
+
+// randAgentSDKStats returns a random agentsdk.Stats
+func randAgentSDKStats(t *testing.T, opts ...func(*agentsdk.Stats)) agentsdk.Stats {
+	t.Helper()
+	s := agentsdk.Stats{
+		ConnectionsByProto: map[string]int64{
+			"ssh":              mustRandInt64n(t, 9) + 1,
+			"vscode":           mustRandInt64n(t, 9) + 1,
+			"jetbrains":        mustRandInt64n(t, 9) + 1,
+			"reconnecting_pty": mustRandInt64n(t, 9) + 1,
+		},
+		ConnectionCount:             mustRandInt64n(t, 99) + 1,
+		ConnectionMedianLatencyMS:   float64(mustRandInt64n(t, 99) + 1),
+		RxPackets:                   mustRandInt64n(t, 99) + 1,
+		RxBytes:                     mustRandInt64n(t, 99) + 1,
+		TxPackets:                   mustRandInt64n(t, 99) + 1,
+		TxBytes:                     mustRandInt64n(t, 99) + 1,
+		SessionCountVSCode:          mustRandInt64n(t, 9) + 1,
+		SessionCountJetBrains:       mustRandInt64n(t, 9) + 1,
+		SessionCountReconnectingPTY: mustRandInt64n(t, 9) + 1,
+		SessionCountSSH:             mustRandInt64n(t, 9) + 1,
+		Metrics:                     []agentsdk.AgentMetric{},
+	}
+	for _, opt := range opts {
+		opt(&s)
+	}
+	return s
+}
+
+// deps is a set of test dependencies.
+type deps struct {
+	Agent     database.WorkspaceAgent
+	Template  database.Template
+	User      database.User
+	Workspace database.Workspace
+}
+
+// setupDeps sets up a set of test dependencies.
+// It creates an organization, user, template, workspace, and agent
+// along with all the other miscellaneous plumbing required to link
+// them together.
+func setupDeps(t *testing.T, store database.Store, ps pubsub.Pubsub) deps {
+	t.Helper()
+
+	org := dbgen.Organization(t, store, database.Organization{})
+	user := dbgen.User(t, store, database.User{})
+	_, err := store.InsertOrganizationMember(context.Background(), database.InsertOrganizationMemberParams{
+		OrganizationID: org.ID,
+		UserID:         user.ID,
+		Roles:          []string{rbac.RoleOrgMember(org.ID)},
+	})
+	require.NoError(t, err)
+	tv := dbgen.TemplateVersion(t, store, database.TemplateVersion{
+		OrganizationID: org.ID,
+		CreatedBy:      user.ID,
+	})
+	tpl := dbgen.Template(t, store, database.Template{
+		CreatedBy:       user.ID,
+		OrganizationID:  org.ID,
+		ActiveVersionID: tv.ID,
+	})
+	ws := dbgen.Workspace(t, store, database.Workspace{
+		TemplateID:     tpl.ID,
+		OwnerID:        user.ID,
+		OrganizationID: org.ID,
+		LastUsedAt:     time.Now().Add(-time.Hour),
+	})
+	pj := dbgen.ProvisionerJob(t, store, ps, database.ProvisionerJob{
+		InitiatorID:    user.ID,
+		OrganizationID: org.ID,
+	})
+	_ = dbgen.WorkspaceBuild(t, store, database.WorkspaceBuild{
+		TemplateVersionID: tv.ID,
+		WorkspaceID:       ws.ID,
+		JobID:             pj.ID,
+	})
+	res := dbgen.WorkspaceResource(t, store, database.WorkspaceResource{
+		Transition: database.WorkspaceTransitionStart,
+		JobID:      pj.ID,
+	})
+	agt := dbgen.WorkspaceAgent(t, store, database.WorkspaceAgent{
+		ResourceID: res.ID,
+	})
+	return deps{
+		Agent:     agt,
+		Template:  tpl,
+		User:      user,
+		Workspace: ws,
+	}
+}
+
+// mustRandInt64n returns a random int64 in the range [0, n).
+func mustRandInt64n(t *testing.T, n int64) int64 {
+	t.Helper()
+	i, err := cryptorand.Intn(int(n))
+	require.NoError(t, err)
+	return int64(i)
+}
diff --git a/coderd/client_test.go b/coderd/client_test.go
index 0ba31c8d32014..79002e767fb5d 100644
--- a/coderd/client_test.go
+++ b/coderd/client_test.go
@@ -6,8 +6,8 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // Issue: https://github.com/coder/coder/issues/5249
diff --git a/coderd/coderd.go b/coderd/coderd.go
index d7b80ff273097..81ec1e87e6b18 100644
--- a/coderd/coderd.go
+++ b/coderd/coderd.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
-	"encoding/json"
 	"flag"
 	"fmt"
 	"io"
@@ -37,36 +36,38 @@ import (
 	"tailscale.com/util/singleflight"
 
 	// Used for swagger docs.
-	_ "github.com/coder/coder/coderd/apidoc"
+	_ "github.com/coder/coder/v2/coderd/apidoc"
+	"github.com/coder/coder/v2/coderd/externalauth"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/awsidentity"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/gitsshkey"
-	"github.com/coder/coder/coderd/healthcheck"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/metricscache"
-	"github.com/coder/coder/coderd/provisionerdserver"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/coderd/updatecheck"
-	"github.com/coder/coder/coderd/util/slice"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/coderd/wsconncache"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisionerd/proto"
-	"github.com/coder/coder/provisionersdk"
-	"github.com/coder/coder/site"
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/awsidentity"
+	"github.com/coder/coder/v2/coderd/batchstats"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/gitsshkey"
+	"github.com/coder/coder/v2/coderd/healthcheck"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/metricscache"
+	"github.com/coder/coder/v2/coderd/provisionerdserver"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/updatecheck"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/coderd/wsconncache"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/provisionerd/proto"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/site"
+	"github.com/coder/coder/v2/tailnet"
 )
 
 // We must only ever instantiate one httpSwagger.Handler because of a data race
@@ -114,7 +115,7 @@ type Options struct {
 	SSHKeygenAlgorithm             gitsshkey.Algorithm
 	Telemetry                      telemetry.Reporter
 	TracerProvider                 trace.TracerProvider
-	GitAuthConfigs                 []*gitauth.Config
+	ExternalAuthConfigs            []*externalauth.Config
 	RealIPConfig                   *httpmw.RealIPConfig
 	TrialGenerator                 func(ctx context.Context, email string) error
 	// TLSCertificates is used to mesh DERP servers securely.
@@ -126,10 +127,11 @@ type Options struct {
 	BaseDERPMap                 *tailcfg.DERPMap
 	DERPMapUpdateFrequency      time.Duration
 	SwaggerEndpoint             bool
-	SetUserGroups               func(ctx context.Context, tx database.Store, userID uuid.UUID, groupNames []string) error
-	SetUserSiteRoles            func(ctx context.Context, tx database.Store, userID uuid.UUID, roles []string) error
+	SetUserGroups               func(ctx context.Context, logger slog.Logger, tx database.Store, userID uuid.UUID, groupNames []string, createMissingGroups bool) error
+	SetUserSiteRoles            func(ctx context.Context, logger slog.Logger, tx database.Store, userID uuid.UUID, roles []string) error
 	TemplateScheduleStore       *atomic.Pointer[schedule.TemplateScheduleStore]
 	UserQuietHoursScheduleStore *atomic.Pointer[schedule.UserQuietHoursScheduleStore]
+	AccessControlStore          *atomic.Pointer[dbauthz.AccessControlStore]
 	// AppSecurityKey is the crypto key used to sign and encrypt tokens related to
 	// workspace applications. It consists of both a signing and encryption key.
 	AppSecurityKey     workspaceapps.SecurityKey
@@ -152,7 +154,12 @@ type Options struct {
 	MetricsCacheRefreshInterval time.Duration
 	AgentStatsRefreshInterval   time.Duration
 	DeploymentValues            *codersdk.DeploymentValues
-	UpdateCheckOptions          *updatecheck.Options // Set non-nil to enable update checking.
+	// DeploymentOptions do contain the copy of DeploymentValues, and contain
+	// contextual information about how the values were set.
+	// Do not use DeploymentOptions to retrieve values, use DeploymentValues instead.
+	// All secrets values are stripped.
+	DeploymentOptions  clibase.OptionSet
+	UpdateCheckOptions *updatecheck.Options // Set non-nil to enable update checking.
 
 	// SSHConfig is the response clients use to configure config-ssh locally.
 	SSHConfig codersdk.SSHConfigResponse
@@ -160,6 +167,9 @@ type Options struct {
 	HTTPClient *http.Client
 
 	UpdateAgentMetrics func(ctx context.Context, username, workspaceName, agentName string, metrics []agentsdk.AgentMetric)
+	StatsBatcher       *batchstats.Batcher
+
+	WorkspaceAppsStatsCollectorOptions workspaceapps.StatsCollectorOptions
 }
 
 // @title Coder API
@@ -199,11 +209,20 @@ func New(options *Options) *API {
 	if options.Authorizer == nil {
 		options.Authorizer = rbac.NewCachingAuthorizer(options.PrometheusRegistry)
 	}
+
+	if options.AccessControlStore == nil {
+		options.AccessControlStore = &atomic.Pointer[dbauthz.AccessControlStore]{}
+		var tacs dbauthz.AccessControlStore = dbauthz.AGPLTemplateAccessControlStore{}
+		options.AccessControlStore.Store(&tacs)
+	}
+
 	options.Database = dbauthz.New(
 		options.Database,
 		options.Authorizer,
 		options.Logger.Named("authz_querier"),
+		options.AccessControlStore,
 	)
+
 	experiments := ReadExperiments(
 		options.Logger, options.DeploymentValues.Experiments.Value(),
 	)
@@ -258,16 +277,16 @@ func New(options *Options) *API {
 		options.TracerProvider = trace.NewNoopTracerProvider()
 	}
 	if options.SetUserGroups == nil {
-		options.SetUserGroups = func(ctx context.Context, _ database.Store, userID uuid.UUID, groups []string) error {
-			options.Logger.Warn(ctx, "attempted to assign OIDC groups without enterprise license",
-				slog.F("user_id", userID), slog.F("groups", groups),
+		options.SetUserGroups = func(ctx context.Context, logger slog.Logger, _ database.Store, userID uuid.UUID, groups []string, createMissingGroups bool) error {
+			logger.Warn(ctx, "attempted to assign OIDC groups without enterprise license",
+				slog.F("user_id", userID), slog.F("groups", groups), slog.F("create_missing_groups", createMissingGroups),
 			)
 			return nil
 		}
 	}
 	if options.SetUserSiteRoles == nil {
-		options.SetUserSiteRoles = func(ctx context.Context, _ database.Store, userID uuid.UUID, roles []string) error {
-			options.Logger.Warn(ctx, "attempted to assign OIDC user roles without enterprise license",
+		options.SetUserSiteRoles = func(ctx context.Context, logger slog.Logger, _ database.Store, userID uuid.UUID, roles []string) error {
+			logger.Warn(ctx, "attempted to assign OIDC user roles without enterprise license",
 				slog.F("user_id", userID), slog.F("roles", roles),
 			)
 			return nil
@@ -288,6 +307,10 @@ func New(options *Options) *API {
 		options.UserQuietHoursScheduleStore.Store(&v)
 	}
 
+	if options.StatsBatcher == nil {
+		panic("developer error: options.StatsBatcher is nil")
+	}
+
 	siteCacheDir := options.CacheDir
 	if siteCacheDir != "" {
 		siteCacheDir = filepath.Join(siteCacheDir, "site")
@@ -356,8 +379,14 @@ func New(options *Options) *API {
 		Auditor:                     atomic.Pointer[audit.Auditor]{},
 		TemplateScheduleStore:       options.TemplateScheduleStore,
 		UserQuietHoursScheduleStore: options.UserQuietHoursScheduleStore,
+		AccessControlStore:          options.AccessControlStore,
 		Experiments:                 experiments,
 		healthCheckGroup:            &singleflight.Group[string, *healthcheck.Report]{},
+		Acquirer: provisionerdserver.NewAcquirer(
+			ctx,
+			options.Logger.Named("acquirer"),
+			options.Database,
+			options.Pubsub),
 	}
 	if options.UpdateCheckOptions != nil {
 		api.updateChecker = updatecheck.New(
@@ -394,11 +423,13 @@ func New(options *Options) *API {
 		api.agentProvider, err = NewServerTailnet(api.ctx,
 			options.Logger,
 			options.DERPServer,
-			options.BaseDERPMap,
+			api.DERPMap,
+			options.DeploymentValues.DERP.Config.ForceWebSockets.Value(),
 			func(context.Context) (tailnet.MultiAgentConn, error) {
 				return (*api.TailnetCoordinator.Load()).ServeMultiAgent(uuid.New()), nil
 			},
 			wsconncache.New(api._dialWorkspaceAgentTailnet, 0),
+			api.TracerProvider,
 		)
 		if err != nil {
 			panic("failed to setup server tailnet: " + err.Error())
@@ -409,8 +440,17 @@ func New(options *Options) *API {
 		}
 	}
 
+	workspaceAppsLogger := options.Logger.Named("workspaceapps")
+	if options.WorkspaceAppsStatsCollectorOptions.Logger == nil {
+		named := workspaceAppsLogger.Named("stats_collector")
+		options.WorkspaceAppsStatsCollectorOptions.Logger = &named
+	}
+	if options.WorkspaceAppsStatsCollectorOptions.Reporter == nil {
+		options.WorkspaceAppsStatsCollectorOptions.Reporter = workspaceapps.NewStatsDBReporter(options.Database, workspaceapps.DefaultStatsDBReporterBatchSize)
+	}
+
 	api.workspaceAppServer = &workspaceapps.Server{
-		Logger: options.Logger.Named("workspaceapps"),
+		Logger: workspaceAppsLogger,
 
 		DashboardURL:  api.AccessURL,
 		AccessURL:     api.AccessURL,
@@ -421,6 +461,7 @@ func New(options *Options) *API {
 		SignedTokenProvider: api.WorkspaceAppsProvider,
 		AgentProvider:       api.agentProvider,
 		AppSecurityKey:      options.AppSecurityKey,
+		StatsCollector:      workspaceapps.NewStatsCollector(options.WorkspaceAppsStatsCollectorOptions),
 
 		DisablePathApps:  options.DeploymentValues.DisablePathApps.Value(),
 		SecureAuthCookie: options.DeploymentValues.SecureAuthCookie.Value(),
@@ -462,6 +503,8 @@ func New(options *Options) *API {
 	cors := httpmw.Cors(options.DeploymentValues.Dangerous.AllowAllCors.Value())
 	prometheusMW := httpmw.Prometheus(options.PrometheusRegistry)
 
+	api.statsBatcher = options.StatsBatcher
+
 	r.Use(
 		httpmw.Recover(api.Logger),
 		tracing.StatusWriterMiddleware,
@@ -514,21 +557,24 @@ func New(options *Options) *API {
 	})
 
 	// Register callback handlers for each OAuth2 provider.
-	r.Route("/gitauth", func(r chi.Router) {
-		for _, gitAuthConfig := range options.GitAuthConfigs {
-			// We don't need to register a callback handler for device auth.
-			if gitAuthConfig.DeviceAuth != nil {
-				continue
+	// We must support gitauth and externalauth for backwards compatibility.
+	for _, route := range []string{"gitauth", "external-auth"} {
+		r.Route("/"+route, func(r chi.Router) {
+			for _, externalAuthConfig := range options.ExternalAuthConfigs {
+				// We don't need to register a callback handler for device auth.
+				if externalAuthConfig.DeviceAuth != nil {
+					continue
+				}
+				r.Route(fmt.Sprintf("/%s/callback", externalAuthConfig.ID), func(r chi.Router) {
+					r.Use(
+						apiKeyMiddlewareRedirect,
+						httpmw.ExtractOAuth2(externalAuthConfig, options.HTTPClient, nil),
+					)
+					r.Get("/", api.externalAuthCallback(externalAuthConfig))
+				})
 			}
-			r.Route(fmt.Sprintf("/%s/callback", gitAuthConfig.ID), func(r chi.Router) {
-				r.Use(
-					apiKeyMiddlewareRedirect,
-					httpmw.ExtractOAuth2(gitAuthConfig, options.HTTPClient, nil),
-				)
-				r.Get("/", api.gitAuthCallback(gitAuthConfig))
-			})
-		}
-	})
+		})
+	}
 
 	r.Route("/api/v2", func(r chi.Router) {
 		api.APIHandler = r
@@ -562,6 +608,7 @@ func New(options *Options) *API {
 		})
 		r.Route("/experiments", func(r chi.Router) {
 			r.Use(apiKeyMiddleware)
+			r.Get("/available", handleExperimentsSafe)
 			r.Get("/", api.handleExperimentsGet)
 		})
 		r.Get("/updatecheck", api.updateCheck)
@@ -581,14 +628,14 @@ func New(options *Options) *API {
 			r.Get("/{fileID}", api.fileByID)
 			r.Post("/", api.postFile)
 		})
-		r.Route("/gitauth/{gitauth}", func(r chi.Router) {
+		r.Route("/external-auth/{externalauth}", func(r chi.Router) {
 			r.Use(
 				apiKeyMiddleware,
-				httpmw.ExtractGitAuthParam(options.GitAuthConfigs),
+				httpmw.ExtractExternalAuthParam(options.ExternalAuthConfigs),
 			)
-			r.Get("/", api.gitAuthByID)
-			r.Post("/device", api.postGitAuthDeviceByID)
-			r.Get("/device", api.gitAuthDeviceByID)
+			r.Get("/", api.externalAuthByID)
+			r.Post("/device", api.postExternalAuthDeviceByID)
+			r.Get("/device", api.externalAuthDeviceByID)
 		})
 		r.Route("/organizations", func(r chi.Router) {
 			r.Use(
@@ -617,7 +664,6 @@ func New(options *Options) *API {
 					r.Get("/roles", api.assignableOrgRoles)
 					r.Route("/{user}", func(r chi.Router) {
 						r.Use(
-							httpmw.ExtractUserParam(options.Database, false),
 							httpmw.ExtractOrganizationMemberParam(options.Database),
 						)
 						r.Put("/roles", api.putMemberRoles)
@@ -636,6 +682,7 @@ func New(options *Options) *API {
 			r.Delete("/", api.deleteTemplate)
 			r.Patch("/", api.patchTemplateMeta)
 			r.Route("/versions", func(r chi.Router) {
+				r.Post("/archive", api.postArchiveTemplateVersions)
 				r.Get("/", api.templateVersionsByTemplate)
 				r.Patch("/", api.patchActiveTemplateVersion)
 				r.Get("/{templateversionname}", api.templateVersionByName)
@@ -649,12 +696,14 @@ func New(options *Options) *API {
 			r.Get("/", api.templateVersion)
 			r.Patch("/", api.patchTemplateVersion)
 			r.Patch("/cancel", api.patchCancelTemplateVersion)
+			r.Post("/archive", api.postArchiveTemplateVersion())
+			r.Post("/unarchive", api.postUnarchiveTemplateVersion())
 			// Old agents may expect a non-error response from /schema and /parameters endpoints.
 			// The idea is to return an empty [], so that the coder CLI won't get blocked accidentally.
 			r.Get("/schema", templateVersionSchemaDeprecated)
 			r.Get("/parameters", templateVersionParametersDeprecated)
 			r.Get("/rich-parameters", api.templateVersionRichParameters)
-			r.Get("/gitauth", api.templateVersionGitAuth)
+			r.Get("/external-auth", api.templateVersionExternalAuth)
 			r.Get("/variables", api.templateVersionVariables)
 			r.Get("/resources", api.templateVersionResources)
 			r.Get("/logs", api.templateVersionLogs)
@@ -683,7 +732,6 @@ func New(options *Options) *API {
 					r.Route("/github", func(r chi.Router) {
 						r.Use(
 							httpmw.ExtractOAuth2(options.GithubOAuth2Config, options.HTTPClient, nil),
-							apiKeyMiddlewareOptional,
 						)
 						r.Get("/callback", api.userOAuth2Github)
 					})
@@ -691,7 +739,6 @@ func New(options *Options) *API {
 				r.Route("/oidc/callback", func(r chi.Router) {
 					r.Use(
 						httpmw.ExtractOAuth2(options.OIDCConfig, options.HTTPClient, oidcAuthURLParams),
-						apiKeyMiddlewareOptional,
 					)
 					r.Get("/", api.userOIDC)
 				})
@@ -708,7 +755,7 @@ func New(options *Options) *API {
 					r.Get("/", api.assignableSiteRoles)
 				})
 				r.Route("/{user}", func(r chi.Router) {
-					r.Use(httpmw.ExtractUserParam(options.Database, false))
+					r.Use(httpmw.ExtractUserParam(options.Database))
 					r.Post("/convert-login", api.postConvertLoginType)
 					r.Delete("/", api.deleteUser)
 					r.Get("/", api.userByName)
@@ -779,12 +826,15 @@ func New(options *Options) *API {
 				r.Patch("/startup-logs", api.patchWorkspaceAgentLogsDeprecated)
 				r.Patch("/logs", api.patchWorkspaceAgentLogs)
 				r.Post("/app-health", api.postWorkspaceAppHealth)
+				// Deprecated: Required to support legacy agents
 				r.Get("/gitauth", api.workspaceAgentsGitAuth)
+				r.Get("/external-auth", api.workspaceAgentsExternalAuth)
 				r.Get("/gitsshkey", api.agentGitSSHKey)
 				r.Get("/coordinate", api.workspaceAgentCoordinate)
 				r.Post("/report-stats", api.workspaceAgentReportStats)
 				r.Post("/report-lifecycle", api.workspaceAgentReportLifecycle)
-				r.Post("/metadata/{key}", api.workspaceAgentPostMetadata)
+				r.Post("/metadata", api.workspaceAgentPostMetadata)
+				r.Post("/metadata/{key}", api.workspaceAgentPostMetadataDeprecated)
 			})
 			r.Route("/{workspaceagent}", func(r chi.Router) {
 				r.Use(
@@ -833,7 +883,8 @@ func New(options *Options) *API {
 				})
 				r.Get("/watch", api.watchWorkspace)
 				r.Put("/extend", api.putExtendWorkspace)
-				r.Put("/lock", api.putWorkspaceLock)
+				r.Put("/dormant", api.putWorkspaceDormant)
+				r.Put("/autoupdates", api.putWorkspaceAutoupdates)
 			})
 		})
 		r.Route("/workspacebuilds/{workspacebuild}", func(r chi.Router) {
@@ -871,6 +922,7 @@ func New(options *Options) *API {
 		r.Route("/insights", func(r chi.Router) {
 			r.Use(apiKeyMiddleware)
 			r.Get("/daus", api.deploymentDAUs)
+			r.Get("/user-activity", api.insightsUserActivity)
 			r.Get("/user-latency", api.insightsUserLatency)
 			r.Get("/templates", api.insightsTemplates)
 		})
@@ -967,6 +1019,9 @@ type API struct {
 	UserQuietHoursScheduleStore *atomic.Pointer[schedule.UserQuietHoursScheduleStore]
 	// DERPMapper mutates the DERPMap to include workspace proxies.
 	DERPMapper atomic.Pointer[func(derpMap *tailcfg.DERPMap) *tailcfg.DERPMap]
+	// AccessControlStore is a pointer to an atomic pointer since it is
+	// passed to dbauthz.
+	AccessControlStore *atomic.Pointer[dbauthz.AccessControlStore]
 
 	HTTPAuth *HTTPAuthorizer
 
@@ -994,6 +1049,10 @@ type API struct {
 
 	healthCheckGroup *singleflight.Group[string, *healthcheck.Report]
 	healthCheckCache atomic.Pointer[healthcheck.Report]
+
+	statsBatcher *batchstats.Batcher
+
+	Acquirer *provisionerdserver.Acquirer
 }
 
 // Close waits for all WebSocket connections to drain before returning.
@@ -1009,6 +1068,7 @@ func (api *API) Close() error {
 	if api.updateChecker != nil {
 		api.updateChecker.Close()
 	}
+	_ = api.workspaceAppServer.Close()
 	coordinator := api.TailnetCoordinator.Load()
 	if coordinator != nil {
 		_ = (*coordinator).Close()
@@ -1044,7 +1104,7 @@ func compressHandler(h http.Handler) http.Handler {
 
 // CreateInMemoryProvisionerDaemon is an in-memory connection to a provisionerd.
 // Useful when starting coderd and provisionerd in the same process.
-func (api *API) CreateInMemoryProvisionerDaemon(ctx context.Context, debounce time.Duration) (client proto.DRPCProvisionerDaemonClient, err error) {
+func (api *API) CreateInMemoryProvisionerDaemon(ctx context.Context) (client proto.DRPCProvisionerDaemonClient, err error) {
 	tracer := api.TracerProvider.Tracer(tracing.TracerName)
 	clientSession, serverSession := provisionersdk.MemTransportPipe()
 	defer func() {
@@ -1054,47 +1114,42 @@ func (api *API) CreateInMemoryProvisionerDaemon(ctx context.Context, debounce ti
 		}
 	}()
 
-	name := namesgenerator.GetRandomName(1)
-	// nolint:gocritic // Inserting a provisioner daemon is a system function.
-	daemon, err := api.Database.InsertProvisionerDaemon(dbauthz.AsSystemRestricted(ctx), database.InsertProvisionerDaemonParams{
-		ID:           uuid.New(),
-		CreatedAt:    database.Now(),
-		Name:         name,
-		Provisioners: []database.ProvisionerType{database.ProvisionerTypeEcho, database.ProvisionerTypeTerraform},
-		Tags: database.StringMap{
-			provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
-		},
-	})
-	if err != nil {
-		return nil, xerrors.Errorf("insert provisioner daemon %q: %w", name, err)
+	tags := provisionerdserver.Tags{
+		provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
 	}
 
-	tags, err := json.Marshal(daemon.Tags)
+	mux := drpcmux.New()
+	name := namesgenerator.GetRandomName(1)
+	logger := api.Logger.Named(fmt.Sprintf("inmem-provisionerd-%s", name))
+	logger.Info(ctx, "starting in-memory provisioner daemon")
+	srv, err := provisionerdserver.NewServer(
+		api.ctx,
+		api.AccessURL,
+		uuid.New(),
+		logger,
+		[]database.ProvisionerType{
+			database.ProvisionerTypeEcho, database.ProvisionerTypeTerraform,
+		},
+		tags,
+		api.Database,
+		api.Pubsub,
+		api.Acquirer,
+		api.Telemetry,
+		tracer,
+		&api.QuotaCommitter,
+		&api.Auditor,
+		api.TemplateScheduleStore,
+		api.UserQuietHoursScheduleStore,
+		api.DeploymentValues,
+		provisionerdserver.Options{
+			OIDCConfig:          api.OIDCConfig,
+			ExternalAuthConfigs: api.ExternalAuthConfigs,
+		},
+	)
 	if err != nil {
-		return nil, xerrors.Errorf("marshal tags: %w", err)
+		return nil, err
 	}
-
-	mux := drpcmux.New()
-
-	err = proto.DRPCRegisterProvisionerDaemon(mux, &provisionerdserver.Server{
-		AccessURL:                   api.AccessURL,
-		ID:                          daemon.ID,
-		OIDCConfig:                  api.OIDCConfig,
-		Database:                    api.Database,
-		Pubsub:                      api.Pubsub,
-		Provisioners:                daemon.Provisioners,
-		GitAuthConfigs:              api.GitAuthConfigs,
-		Telemetry:                   api.Telemetry,
-		Tracer:                      tracer,
-		Tags:                        tags,
-		QuotaCommitter:              &api.QuotaCommitter,
-		Auditor:                     &api.Auditor,
-		TemplateScheduleStore:       api.TemplateScheduleStore,
-		UserQuietHoursScheduleStore: api.UserQuietHoursScheduleStore,
-		AcquireJobDebounce:          debounce,
-		Logger:                      api.Logger.Named(fmt.Sprintf("provisionerd-%s", daemon.Name)),
-		DeploymentValues:            api.DeploymentValues,
-	})
+	err = proto.DRPCRegisterProvisionerDaemon(mux, srv)
 	if err != nil {
 		return nil, err
 	}
@@ -1104,16 +1159,14 @@ func (api *API) CreateInMemoryProvisionerDaemon(ctx context.Context, debounce ti
 				if xerrors.Is(err, io.EOF) {
 					return
 				}
-				api.Logger.Debug(ctx, "drpc server error", slog.Error(err))
+				logger.Debug(ctx, "drpc server error", slog.Error(err))
 			},
 		},
 	)
 	go func() {
 		err := server.Serve(ctx, serverSession)
-		if err != nil && !xerrors.Is(err, io.EOF) {
-			api.Logger.Debug(ctx, "provisioner daemon disconnected", slog.Error(err))
-		}
-		// close the sessions so we don't leak goroutines serving them.
+		logger.Info(ctx, "provisioner daemon disconnected", slog.Error(err))
+		// close the sessions, so we don't leak goroutines serving them.
 		_ = clientSession.Close()
 		_ = serverSession.Close()
 	}()
diff --git a/coderd/coderd_test.go b/coderd/coderd_test.go
index 0cd69915d13dc..9823b2b62a123 100644
--- a/coderd/coderd_test.go
+++ b/coderd/coderd_test.go
@@ -2,13 +2,18 @@ package coderd_test
 
 import (
 	"context"
+	"flag"
 	"io"
 	"net/http"
 	"net/netip"
 	"strconv"
+	"strings"
 	"sync"
+	"sync/atomic"
 	"testing"
 
+	"github.com/davecgh/go-spew/spew"
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/goleak"
@@ -17,12 +22,19 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/tailnet"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/testutil"
 )
 
+// updateGoldenFiles is a flag that can be set to update golden files.
+var updateGoldenFiles = flag.Bool("update", false, "Update golden files")
+
 func TestMain(m *testing.M) {
 	goleak.VerifyTestMain(m)
 }
@@ -115,6 +127,84 @@ func TestDERP(t *testing.T) {
 	w2.Close()
 }
 
+func TestDERPForceWebSockets(t *testing.T) {
+	t.Parallel()
+
+	dv := coderdtest.DeploymentValues(t)
+	dv.DERP.Config.ForceWebSockets = true
+	dv.DERP.Config.BlockDirect = true // to ensure the test always uses DERP
+
+	// Manually create a server so we can influence the HTTP handler.
+	options := &coderdtest.Options{
+		DeploymentValues: dv,
+	}
+	setHandler, cancelFunc, serverURL, newOptions := coderdtest.NewOptions(t, options)
+	coderAPI := coderd.New(newOptions)
+	t.Cleanup(func() {
+		cancelFunc()
+		_ = coderAPI.Close()
+	})
+
+	// Set the HTTP handler to a custom one that ensures all /derp calls are
+	// WebSockets and not `Upgrade: derp`.
+	var upgradeCount int64
+	setHandler(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		if strings.HasPrefix(r.URL.Path, "/derp") {
+			up := r.Header.Get("Upgrade")
+			if up != "" && up != "websocket" {
+				t.Errorf("expected Upgrade: websocket, got %q", up)
+			} else {
+				atomic.AddInt64(&upgradeCount, 1)
+			}
+		}
+
+		coderAPI.RootHandler.ServeHTTP(rw, r)
+	}))
+
+	// Start a provisioner daemon.
+	provisionerCloser := coderdtest.NewProvisionerDaemon(t, coderAPI)
+	t.Cleanup(func() {
+		_ = provisionerCloser.Close()
+	})
+
+	client := codersdk.New(serverURL)
+	t.Cleanup(func() {
+		client.HTTPClient.CloseIdleConnections()
+	})
+	user := coderdtest.CreateFirstUser(t, client)
+
+	gen, err := client.WorkspaceAgentConnectionInfoGeneric(context.Background())
+	require.NoError(t, err)
+	t.Log(spew.Sdump(gen))
+
+	authToken := uuid.NewString()
+	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+		Parse:          echo.ParseComplete,
+		ProvisionPlan:  echo.PlanComplete,
+		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
+	})
+	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+	_ = agenttest.New(t, client.URL, authToken)
+	_ = coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+	conn, err := client.DialWorkspaceAgent(ctx, resources[0].Agents[0].ID, nil)
+	require.NoError(t, err)
+	defer func() {
+		_ = conn.Close()
+	}()
+	conn.AwaitReachable(ctx)
+
+	require.GreaterOrEqual(t, atomic.LoadInt64(&upgradeCount), int64(1), "expected at least one /derp call")
+}
+
 func TestDERPLatencyCheck(t *testing.T) {
 	t.Parallel()
 	client := coderdtest.New(t, nil)
diff --git a/coderd/coderdtest/authorize.go b/coderd/coderdtest/authorize.go
index 889e8f1ee485a..ce9faf1ace16f 100644
--- a/coderd/coderdtest/authorize.go
+++ b/coderd/coderdtest/authorize.go
@@ -15,12 +15,12 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/rbac/regosql"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac/regosql"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 // RBACAsserter is a helper for asserting that the correct RBAC checks are
diff --git a/coderd/coderdtest/authorize_test.go b/coderd/coderdtest/authorize_test.go
index 67bcf482def75..13a04200a9d2f 100644
--- a/coderd/coderdtest/authorize_test.go
+++ b/coderd/coderdtest/authorize_test.go
@@ -7,8 +7,8 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
 )
 
 func TestAuthzRecorder(t *testing.T) {
diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go
index 4d4fbb8c5e78e..85ceeba1be349 100644
--- a/coderd/coderdtest/coderdtest.go
+++ b/coderd/coderdtest/coderdtest.go
@@ -31,16 +31,13 @@ import (
 	"time"
 
 	"cloud.google.com/go/compute/metadata"
-	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/fullsailor/pkcs7"
-	"github.com/golang-jwt/jwt"
+	"github.com/golang-jwt/jwt/v4"
 	"github.com/google/uuid"
 	"github.com/moby/moby/pkg/namesgenerator"
 	"github.com/prometheus/client_golang/prometheus"
-	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/oauth2"
 	"golang.org/x/xerrors"
 	"google.golang.org/api/idtoken"
 	"google.golang.org/api/option"
@@ -51,37 +48,39 @@ import (
 	"tailscale.com/types/nettype"
 
 	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/sloghuman"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/autobuild"
-	"github.com/coder/coder/coderd/awsidentity"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/gitsshkey"
-	"github.com/coder/coder/coderd/healthcheck"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/coderd/unhanger"
-	"github.com/coder/coder/coderd/updatecheck"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionerd"
-	provisionerdproto "github.com/coder/coder/provisionerd/proto"
-	"github.com/coder/coder/provisionersdk"
-	sdkproto "github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/tailnet"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/autobuild"
+	"github.com/coder/coder/v2/coderd/awsidentity"
+	"github.com/coder/coder/v2/coderd/batchstats"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/coderd/gitsshkey"
+	"github.com/coder/coder/v2/coderd/healthcheck"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/coderd/unhanger"
+	"github.com/coder/coder/v2/coderd/updatecheck"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionerd"
+	provisionerdproto "github.com/coder/coder/v2/provisionerd/proto"
+	"github.com/coder/coder/v2/provisionersdk"
+	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // AppSecurityKey is a 96-byte key used to sign JWTs and encrypt JWEs for
@@ -106,7 +105,7 @@ type Options struct {
 	AutobuildStats        chan<- autobuild.Stats
 	Auditor               audit.Auditor
 	TLSCertificates       []tls.Certificate
-	GitAuthConfigs        []*gitauth.Config
+	ExternalAuthConfigs   []*externalauth.Config
 	TrialGenerator        func(context.Context, string) error
 	TemplateScheduleStore schedule.TemplateScheduleStore
 	Coordinator           tailnet.Coordinator
@@ -140,7 +139,10 @@ type Options struct {
 	SwaggerEndpoint bool
 	// Logger should only be overridden if you expect errors
 	// as part of your test.
-	Logger *slog.Logger
+	Logger       *slog.Logger
+	StatsBatcher *batchstats.Batcher
+
+	WorkspaceAppsStatsCollectorOptions workspaceapps.StatsCollectorOptions
 }
 
 // New constructs a codersdk client connected to an in-memory API instance.
@@ -153,7 +155,7 @@ func New(t testing.TB, options *Options) *codersdk.Client {
 // the provisioner. This is a temporary function while work is done to
 // standardize how provisioners are registered with coderd. The option
 // to include a provisioner is set to true for convenience.
-func NewWithProvisionerCloser(t *testing.T, options *Options) (*codersdk.Client, io.Closer) {
+func NewWithProvisionerCloser(t testing.TB, options *Options) (*codersdk.Client, io.Closer) {
 	if options == nil {
 		options = &Options{}
 	}
@@ -180,6 +182,10 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
 	if options == nil {
 		options = &Options{}
 	}
+	if options.Logger == nil {
+		logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+		options.Logger = &logger
+	}
 	if options.GoogleTokenValidator == nil {
 		ctx, cancelFunc := context.WithCancel(context.Background())
 		t.Cleanup(cancelFunc)
@@ -212,7 +218,6 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
 
 	if options.Database == nil {
 		options.Database, options.Pubsub = dbtestutil.NewDB(t)
-		options.Database = dbauthz.New(options.Database, options.Authorizer, slogtest.Make(t, nil).Leveled(slog.LevelDebug))
 	}
 
 	// Some routes expect a deployment ID, so just make sure one exists.
@@ -241,6 +246,22 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
 	if options.FilesRateLimit == 0 {
 		options.FilesRateLimit = -1
 	}
+	if options.StatsBatcher == nil {
+		ctx, cancel := context.WithCancel(context.Background())
+		t.Cleanup(cancel)
+		batcher, closeBatcher, err := batchstats.New(ctx,
+			batchstats.WithStore(options.Database),
+			// Avoid cluttering up test output.
+			batchstats.WithLogger(slog.Make(sloghuman.Sink(io.Discard))),
+		)
+		require.NoError(t, err, "create stats batcher")
+		options.StatsBatcher = batcher
+		t.Cleanup(closeBatcher)
+	}
+
+	accessControlStore := &atomic.Pointer[dbauthz.AccessControlStore]{}
+	var acs dbauthz.AccessControlStore = dbauthz.AGPLTemplateAccessControlStore{}
+	accessControlStore.Store(&acs)
 
 	var templateScheduleStore atomic.Pointer[schedule.TemplateScheduleStore]
 	if options.TemplateScheduleStore == nil {
@@ -248,19 +269,28 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
 	}
 	templateScheduleStore.Store(&options.TemplateScheduleStore)
 
+	var auditor atomic.Pointer[audit.Auditor]
+	if options.Auditor == nil {
+		options.Auditor = audit.NewNop()
+	}
+	auditor.Store(&options.Auditor)
+
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	lifecycleExecutor := autobuild.NewExecutor(
 		ctx,
 		options.Database,
+		options.Pubsub,
 		&templateScheduleStore,
-		slogtest.Make(t, nil).Named("autobuild.executor").Leveled(slog.LevelDebug),
+		&auditor,
+		accessControlStore,
+		*options.Logger,
 		options.AutobuildTicker,
 	).WithStatsChannel(options.AutobuildStats)
 	lifecycleExecutor.Run()
 
 	hangDetectorTicker := time.NewTicker(options.DeploymentValues.JobHangDetectorInterval.Value())
 	defer hangDetectorTicker.Stop()
-	hangDetector := unhanger.New(ctx, options.Database, options.Pubsub, slogtest.Make(t, nil).Named("unhanger.detector"), hangDetectorTicker.C)
+	hangDetector := unhanger.New(ctx, options.Database, options.Pubsub, options.Logger.Named("unhanger.detector"), hangDetectorTicker.C)
 	hangDetector.Start()
 	t.Cleanup(hangDetector.Close)
 
@@ -309,17 +339,17 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
 		stunAddresses   []string
 		dvStunAddresses = options.DeploymentValues.DERP.Server.STUNAddresses.Value()
 	)
-	if len(dvStunAddresses) == 0 || (len(dvStunAddresses) == 1 && dvStunAddresses[0] == "stun.l.google.com:19302") {
+	if len(dvStunAddresses) == 0 || dvStunAddresses[0] == "stun.l.google.com:19302" {
 		stunAddr, stunCleanup := stuntest.ServeWithPacketListener(t, nettype.Std{})
 		stunAddr.IP = net.ParseIP("127.0.0.1")
 		t.Cleanup(stunCleanup)
 		stunAddresses = []string{stunAddr.String()}
 		options.DeploymentValues.DERP.Server.STUNAddresses = stunAddresses
-	} else if dvStunAddresses[0] != "disable" {
+	} else if dvStunAddresses[0] != tailnet.DisableSTUN {
 		stunAddresses = options.DeploymentValues.DERP.Server.STUNAddresses.Value()
 	}
 
-	derpServer := derp.NewServer(key.NewNode(), tailnet.Logger(slogtest.Make(t, nil).Named("derp").Leveled(slog.LevelDebug)))
+	derpServer := derp.NewServer(key.NewNode(), tailnet.Logger(options.Logger.Named("derp").Leveled(slog.LevelDebug)))
 	derpServer.SetMeshKey("test-key")
 
 	// match default with cli default
@@ -334,10 +364,6 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
 		require.NoError(t, err)
 	}
 
-	if options.Logger == nil {
-		logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
-		options.Logger = &logger
-	}
 	region := &tailcfg.DERPRegion{
 		EmbeddedRelay: true,
 		RegionID:      int(options.DeploymentValues.DERP.Server.RegionID.Value()),
@@ -377,38 +403,42 @@ func NewOptions(t testing.TB, options *Options) (func(http.Handler), context.Can
 			CacheDir:                       t.TempDir(),
 			Database:                       options.Database,
 			Pubsub:                         options.Pubsub,
-			GitAuthConfigs:                 options.GitAuthConfigs,
-
-			Auditor:                     options.Auditor,
-			AWSCertificates:             options.AWSCertificates,
-			AzureCertificates:           options.AzureCertificates,
-			GithubOAuth2Config:          options.GithubOAuth2Config,
-			RealIPConfig:                options.RealIPConfig,
-			OIDCConfig:                  options.OIDCConfig,
-			GoogleTokenValidator:        options.GoogleTokenValidator,
-			SSHKeygenAlgorithm:          options.SSHKeygenAlgorithm,
-			DERPServer:                  derpServer,
-			APIRateLimit:                options.APIRateLimit,
-			LoginRateLimit:              options.LoginRateLimit,
-			FilesRateLimit:              options.FilesRateLimit,
-			Authorizer:                  options.Authorizer,
-			Telemetry:                   telemetry.NewNoop(),
-			TemplateScheduleStore:       &templateScheduleStore,
-			TLSCertificates:             options.TLSCertificates,
-			TrialGenerator:              options.TrialGenerator,
-			TailnetCoordinator:          options.Coordinator,
-			BaseDERPMap:                 derpMap,
-			DERPMapUpdateFrequency:      150 * time.Millisecond,
-			MetricsCacheRefreshInterval: options.MetricsCacheRefreshInterval,
-			AgentStatsRefreshInterval:   options.AgentStatsRefreshInterval,
-			DeploymentValues:            options.DeploymentValues,
-			UpdateCheckOptions:          options.UpdateCheckOptions,
-			SwaggerEndpoint:             options.SwaggerEndpoint,
-			AppSecurityKey:              AppSecurityKey,
-			SSHConfig:                   options.ConfigSSH,
-			HealthcheckFunc:             options.HealthcheckFunc,
-			HealthcheckTimeout:          options.HealthcheckTimeout,
-			HealthcheckRefresh:          options.HealthcheckRefresh,
+			ExternalAuthConfigs:            options.ExternalAuthConfigs,
+
+			Auditor:                            options.Auditor,
+			AWSCertificates:                    options.AWSCertificates,
+			AzureCertificates:                  options.AzureCertificates,
+			GithubOAuth2Config:                 options.GithubOAuth2Config,
+			RealIPConfig:                       options.RealIPConfig,
+			OIDCConfig:                         options.OIDCConfig,
+			GoogleTokenValidator:               options.GoogleTokenValidator,
+			SSHKeygenAlgorithm:                 options.SSHKeygenAlgorithm,
+			DERPServer:                         derpServer,
+			APIRateLimit:                       options.APIRateLimit,
+			LoginRateLimit:                     options.LoginRateLimit,
+			FilesRateLimit:                     options.FilesRateLimit,
+			Authorizer:                         options.Authorizer,
+			Telemetry:                          telemetry.NewNoop(),
+			TemplateScheduleStore:              &templateScheduleStore,
+			AccessControlStore:                 accessControlStore,
+			TLSCertificates:                    options.TLSCertificates,
+			TrialGenerator:                     options.TrialGenerator,
+			TailnetCoordinator:                 options.Coordinator,
+			BaseDERPMap:                        derpMap,
+			DERPMapUpdateFrequency:             150 * time.Millisecond,
+			MetricsCacheRefreshInterval:        options.MetricsCacheRefreshInterval,
+			AgentStatsRefreshInterval:          options.AgentStatsRefreshInterval,
+			DeploymentValues:                   options.DeploymentValues,
+			DeploymentOptions:                  codersdk.DeploymentOptionsWithoutSecrets(options.DeploymentValues.Options()),
+			UpdateCheckOptions:                 options.UpdateCheckOptions,
+			SwaggerEndpoint:                    options.SwaggerEndpoint,
+			AppSecurityKey:                     AppSecurityKey,
+			SSHConfig:                          options.ConfigSSH,
+			HealthcheckFunc:                    options.HealthcheckFunc,
+			HealthcheckTimeout:                 options.HealthcheckTimeout,
+			HealthcheckRefresh:                 options.HealthcheckRefresh,
+			StatsBatcher:                       options.StatsBatcher,
+			WorkspaceAppsStatsCollectorOptions: options.WorkspaceAppsStatsCollectorOptions,
 		}
 }
 
@@ -437,12 +467,42 @@ func NewWithAPI(t testing.TB, options *Options) (*codersdk.Client, io.Closer, *c
 	return client, provisionerCloser, coderAPI
 }
 
+// provisionerdCloser wraps a provisioner daemon as an io.Closer that can be called multiple times
+type provisionerdCloser struct {
+	mu     sync.Mutex
+	closed bool
+	d      *provisionerd.Server
+}
+
+func (c *provisionerdCloser) Close() error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.closed {
+		return nil
+	}
+	c.closed = true
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+	shutdownErr := c.d.Shutdown(ctx)
+	closeErr := c.d.Close()
+	if shutdownErr != nil {
+		return shutdownErr
+	}
+	return closeErr
+}
+
 // NewProvisionerDaemon launches a provisionerd instance configured to work
 // well with coderd testing. It registers the "echo" provisioner for
 // quick testing.
 func NewProvisionerDaemon(t testing.TB, coderAPI *coderd.API) io.Closer {
 	t.Helper()
 
+	// t.Cleanup runs in last added, first called order. t.TempDir() will delete
+	// the directory on cleanup, so we want to make sure the echoServer is closed
+	// before we go ahead an attempt to delete it's work directory.
+	// seems t.TempDir() is not safe to call from a different goroutine
+	workDir := t.TempDir()
+
 	echoClient, echoServer := provisionersdk.MemTransportPipe()
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	t.Cleanup(func() {
@@ -450,34 +510,34 @@ func NewProvisionerDaemon(t testing.TB, coderAPI *coderd.API) io.Closer {
 		_ = echoServer.Close()
 		cancelFunc()
 	})
-	fs := afero.NewMemMapFs()
+
 	go func() {
-		err := echo.Serve(ctx, fs, &provisionersdk.ServeOptions{
-			Listener: echoServer,
+		err := echo.Serve(ctx, &provisionersdk.ServeOptions{
+			Listener:      echoServer,
+			WorkDirectory: workDir,
+			Logger:        coderAPI.Logger.Named("echo").Leveled(slog.LevelDebug),
 		})
 		assert.NoError(t, err)
 	}()
 
-	closer := provisionerd.New(func(ctx context.Context) (provisionerdproto.DRPCProvisionerDaemonClient, error) {
-		return coderAPI.CreateInMemoryProvisionerDaemon(ctx, 0)
+	daemon := provisionerd.New(func(ctx context.Context) (provisionerdproto.DRPCProvisionerDaemonClient, error) {
+		return coderAPI.CreateInMemoryProvisionerDaemon(ctx)
 	}, &provisionerd.Options{
-		Filesystem:          fs,
 		Logger:              coderAPI.Logger.Named("provisionerd").Leveled(slog.LevelDebug),
-		JobPollInterval:     50 * time.Millisecond,
 		UpdateInterval:      250 * time.Millisecond,
-		ForceCancelInterval: time.Second,
-		Provisioners: provisionerd.Provisioners{
+		ForceCancelInterval: 5 * time.Second,
+		Connector: provisionerd.LocalProvisioners{
 			string(database.ProvisionerTypeEcho): sdkproto.NewDRPCProvisionerClient(echoClient),
 		},
-		WorkDirectory: t.TempDir(),
 	})
+	closer := &provisionerdCloser{d: daemon}
 	t.Cleanup(func() {
 		_ = closer.Close()
 	})
 	return closer
 }
 
-func NewExternalProvisionerDaemon(t *testing.T, client *codersdk.Client, org uuid.UUID, tags map[string]string) io.Closer {
+func NewExternalProvisionerDaemon(t testing.TB, client *codersdk.Client, org uuid.UUID, tags map[string]string) io.Closer {
 	echoClient, echoServer := provisionersdk.MemTransportPipe()
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	serveDone := make(chan struct{})
@@ -487,28 +547,30 @@ func NewExternalProvisionerDaemon(t *testing.T, client *codersdk.Client, org uui
 		cancelFunc()
 		<-serveDone
 	})
-	fs := afero.NewMemMapFs()
 	go func() {
 		defer close(serveDone)
-		err := echo.Serve(ctx, fs, &provisionersdk.ServeOptions{
-			Listener: echoServer,
+		err := echo.Serve(ctx, &provisionersdk.ServeOptions{
+			Listener:      echoServer,
+			WorkDirectory: t.TempDir(),
 		})
 		assert.NoError(t, err)
 	}()
 
-	closer := provisionerd.New(func(ctx context.Context) (provisionerdproto.DRPCProvisionerDaemonClient, error) {
-		return client.ServeProvisionerDaemon(ctx, org, []codersdk.ProvisionerType{codersdk.ProvisionerTypeEcho}, tags)
+	daemon := provisionerd.New(func(ctx context.Context) (provisionerdproto.DRPCProvisionerDaemonClient, error) {
+		return client.ServeProvisionerDaemon(ctx, codersdk.ServeProvisionerDaemonRequest{
+			Organization: org,
+			Provisioners: []codersdk.ProvisionerType{codersdk.ProvisionerTypeEcho},
+			Tags:         tags,
+		})
 	}, &provisionerd.Options{
-		Filesystem:          fs,
 		Logger:              slogtest.Make(t, nil).Named("provisionerd").Leveled(slog.LevelDebug),
-		JobPollInterval:     50 * time.Millisecond,
 		UpdateInterval:      250 * time.Millisecond,
-		ForceCancelInterval: time.Second,
-		Provisioners: provisionerd.Provisioners{
+		ForceCancelInterval: 5 * time.Second,
+		Connector: provisionerd.LocalProvisioners{
 			string(database.ProvisionerTypeEcho): sdkproto.NewDRPCProvisionerClient(echoClient),
 		},
-		WorkDirectory: t.TempDir(),
 	})
+	closer := &provisionerdCloser{d: daemon}
 	t.Cleanup(func() {
 		_ = closer.Close()
 	})
@@ -537,18 +599,18 @@ func CreateFirstUser(t testing.TB, client *codersdk.Client) codersdk.CreateFirst
 }
 
 // CreateAnotherUser creates and authenticates a new user.
-func CreateAnotherUser(t *testing.T, client *codersdk.Client, organizationID uuid.UUID, roles ...string) (*codersdk.Client, codersdk.User) {
+func CreateAnotherUser(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, roles ...string) (*codersdk.Client, codersdk.User) {
 	return createAnotherUserRetry(t, client, organizationID, 5, roles)
 }
 
-func CreateAnotherUserMutators(t *testing.T, client *codersdk.Client, organizationID uuid.UUID, roles []string, mutators ...func(r *codersdk.CreateUserRequest)) (*codersdk.Client, codersdk.User) {
+func CreateAnotherUserMutators(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, roles []string, mutators ...func(r *codersdk.CreateUserRequest)) (*codersdk.Client, codersdk.User) {
 	return createAnotherUserRetry(t, client, organizationID, 5, roles, mutators...)
 }
 
-func createAnotherUserRetry(t *testing.T, client *codersdk.Client, organizationID uuid.UUID, retries int, roles []string, mutators ...func(r *codersdk.CreateUserRequest)) (*codersdk.Client, codersdk.User) {
+func createAnotherUserRetry(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, retries int, roles []string, mutators ...func(r *codersdk.CreateUserRequest)) (*codersdk.Client, codersdk.User) {
 	req := codersdk.CreateUserRequest{
 		Email:          namesgenerator.GetRandomName(10) + "@coder.com",
-		Username:       randomUsername(t),
+		Username:       RandomUsername(t),
 		Password:       "SomeSecurePassword!",
 		OrganizationID: organizationID,
 	}
@@ -568,14 +630,7 @@ func createAnotherUserRetry(t *testing.T, client *codersdk.Client, organizationI
 	require.NoError(t, err)
 
 	var sessionToken string
-	if !req.DisableLogin {
-		login, err := client.LoginWithPassword(context.Background(), codersdk.LoginWithPasswordRequest{
-			Email:    req.Email,
-			Password: req.Password,
-		})
-		require.NoError(t, err)
-		sessionToken = login.SessionToken
-	} else {
+	if req.DisableLogin || req.UserLoginType == codersdk.LoginTypeNone {
 		// Cannot log in with a disabled login user. So make it an api key from
 		// the client making this user.
 		token, err := client.CreateToken(context.Background(), user.ID.String(), codersdk.CreateTokenRequest{
@@ -585,6 +640,13 @@ func createAnotherUserRetry(t *testing.T, client *codersdk.Client, organizationI
 		})
 		require.NoError(t, err)
 		sessionToken = token.Key
+	} else {
+		login, err := client.LoginWithPassword(context.Background(), codersdk.LoginWithPasswordRequest{
+			Email:    req.Email,
+			Password: req.Password,
+		})
+		require.NoError(t, err)
+		sessionToken = login.SessionToken
 	}
 
 	if user.Status == codersdk.UserStatusDormant {
@@ -638,7 +700,7 @@ func createAnotherUserRetry(t *testing.T, client *codersdk.Client, organizationI
 // CreateTemplateVersion creates a template import provisioner job
 // with the responses provided. It uses the "echo" provisioner for compatibility
 // with testing.
-func CreateTemplateVersion(t *testing.T, client *codersdk.Client, organizationID uuid.UUID, res *echo.Responses, mutators ...func(*codersdk.CreateTemplateVersionRequest)) codersdk.TemplateVersion {
+func CreateTemplateVersion(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, res *echo.Responses, mutators ...func(*codersdk.CreateTemplateVersionRequest)) codersdk.TemplateVersion {
 	t.Helper()
 	data, err := echo.Tar(res)
 	require.NoError(t, err)
@@ -680,9 +742,9 @@ func CreateWorkspaceBuild(
 
 // CreateTemplate creates a template with the "echo" provisioner for
 // compatibility with testing. The name assigned is randomly generated.
-func CreateTemplate(t *testing.T, client *codersdk.Client, organization uuid.UUID, version uuid.UUID, mutators ...func(*codersdk.CreateTemplateRequest)) codersdk.Template {
+func CreateTemplate(t testing.TB, client *codersdk.Client, organization uuid.UUID, version uuid.UUID, mutators ...func(*codersdk.CreateTemplateRequest)) codersdk.Template {
 	req := codersdk.CreateTemplateRequest{
-		Name:      randomUsername(t),
+		Name:      RandomUsername(t),
 		VersionID: version,
 	}
 	for _, mut := range mutators {
@@ -695,12 +757,13 @@ func CreateTemplate(t *testing.T, client *codersdk.Client, organization uuid.UUI
 
 // UpdateTemplateVersion creates a new template version with the "echo" provisioner
 // and associates it with the given templateID.
-func UpdateTemplateVersion(t *testing.T, client *codersdk.Client, organizationID uuid.UUID, res *echo.Responses, templateID uuid.UUID) codersdk.TemplateVersion {
+func UpdateTemplateVersion(t testing.TB, client *codersdk.Client, organizationID uuid.UUID, res *echo.Responses, templateID uuid.UUID) codersdk.TemplateVersion {
+	ctx := context.Background()
 	data, err := echo.Tar(res)
 	require.NoError(t, err)
-	file, err := client.Upload(context.Background(), codersdk.ContentTypeTar, bytes.NewReader(data))
+	file, err := client.Upload(ctx, codersdk.ContentTypeTar, bytes.NewReader(data))
 	require.NoError(t, err)
-	templateVersion, err := client.CreateTemplateVersion(context.Background(), organizationID, codersdk.CreateTemplateVersionRequest{
+	templateVersion, err := client.CreateTemplateVersion(ctx, organizationID, codersdk.CreateTemplateVersionRequest{
 		TemplateID:    templateID,
 		FileID:        file.ID,
 		StorageMethod: codersdk.ProvisionerStorageMethodFile,
@@ -710,26 +773,65 @@ func UpdateTemplateVersion(t *testing.T, client *codersdk.Client, organizationID
 	return templateVersion
 }
 
-// AwaitTemplateImportJob awaits for an import job to reach completed status.
-func AwaitTemplateVersionJob(t *testing.T, client *codersdk.Client, version uuid.UUID) codersdk.TemplateVersion {
+func UpdateActiveTemplateVersion(t testing.TB, client *codersdk.Client, templateID, versionID uuid.UUID) {
+	err := client.UpdateActiveTemplateVersion(context.Background(), templateID, codersdk.UpdateActiveTemplateVersion{
+		ID: versionID,
+	})
+	require.NoError(t, err)
+}
+
+// AwaitTemplateVersionJobRunning waits for the build to be picked up by a provisioner.
+func AwaitTemplateVersionJobRunning(t testing.TB, client *codersdk.Client, version uuid.UUID) codersdk.TemplateVersion {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+
+	t.Logf("waiting for template version %s build job to start", version)
+	var templateVersion codersdk.TemplateVersion
+	require.Eventually(t, func() bool {
+		var err error
+		templateVersion, err = client.TemplateVersion(ctx, version)
+		if err != nil {
+			return false
+		}
+		t.Logf("template version job status: %s", templateVersion.Job.Status)
+		switch templateVersion.Job.Status {
+		case codersdk.ProvisionerJobPending:
+			return false
+		case codersdk.ProvisionerJobRunning:
+			return true
+		default:
+			t.FailNow()
+			return false
+		}
+	}, testutil.WaitShort, testutil.IntervalFast, "make sure you set `IncludeProvisionerDaemon`!")
+	t.Logf("template version %s job has started", version)
+	return templateVersion
+}
+
+// AwaitTemplateVersionJobCompleted waits for the build to be completed. This may result
+// from cancelation, an error, or from completing successfully.
+func AwaitTemplateVersionJobCompleted(t testing.TB, client *codersdk.Client, version uuid.UUID) codersdk.TemplateVersion {
 	t.Helper()
 
-	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
 
-	t.Logf("waiting for template version job %s", version)
+	t.Logf("waiting for template version %s build job to complete", version)
 	var templateVersion codersdk.TemplateVersion
 	require.Eventually(t, func() bool {
 		var err error
 		templateVersion, err = client.TemplateVersion(ctx, version)
+		t.Logf("template version job status: %s", templateVersion.Job.Status)
 		return assert.NoError(t, err) && templateVersion.Job.CompletedAt != nil
-	}, testutil.WaitMedium, testutil.IntervalFast)
-	t.Logf("got template version job %s", version)
+	}, testutil.WaitLong, testutil.IntervalMedium, "make sure you set `IncludeProvisionerDaemon`!")
+	t.Logf("template version %s job has completed", version)
 	return templateVersion
 }
 
-// AwaitWorkspaceBuildJob waits for a workspace provision job to reach completed status.
-func AwaitWorkspaceBuildJob(t *testing.T, client *codersdk.Client, build uuid.UUID) codersdk.WorkspaceBuild {
+// AwaitWorkspaceBuildJobCompleted waits for a workspace provision job to reach completed status.
+func AwaitWorkspaceBuildJobCompleted(t testing.TB, client *codersdk.Client, build uuid.UUID) codersdk.WorkspaceBuild {
 	t.Helper()
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
@@ -741,7 +843,7 @@ func AwaitWorkspaceBuildJob(t *testing.T, client *codersdk.Client, build uuid.UU
 		var err error
 		workspaceBuild, err = client.WorkspaceBuild(ctx, build)
 		return assert.NoError(t, err) && workspaceBuild.Job.CompletedAt != nil
-	}, testutil.WaitShort, testutil.IntervalFast)
+	}, testutil.WaitMedium, testutil.IntervalMedium)
 	t.Logf("got workspace build job %s", build)
 	return workspaceBuild
 }
@@ -749,7 +851,7 @@ func AwaitWorkspaceBuildJob(t *testing.T, client *codersdk.Client, build uuid.UU
 // AwaitWorkspaceAgents waits for all resources with agents to be connected. If
 // specific agents are provided, it will wait for those agents to be connected
 // but will not fail if other agents are not connected.
-func AwaitWorkspaceAgents(t *testing.T, client *codersdk.Client, workspaceID uuid.UUID, agentNames ...string) []codersdk.WorkspaceResource {
+func AwaitWorkspaceAgents(t testing.TB, client *codersdk.Client, workspaceID uuid.UUID, agentNames ...string) []codersdk.WorkspaceResource {
 	t.Helper()
 
 	agentNamesMap := make(map[string]struct{}, len(agentNames))
@@ -768,6 +870,9 @@ func AwaitWorkspaceAgents(t *testing.T, client *codersdk.Client, workspaceID uui
 		if !assert.NoError(t, err) {
 			return false
 		}
+		if workspace.LatestBuild.Job.CompletedAt == nil {
+			return false
+		}
 		if workspace.LatestBuild.Job.CompletedAt.IsZero() {
 			return false
 		}
@@ -789,7 +894,7 @@ func AwaitWorkspaceAgents(t *testing.T, client *codersdk.Client, workspaceID uui
 		resources = workspace.LatestBuild.Resources
 
 		return true
-	}, testutil.WaitLong, testutil.IntervalFast)
+	}, testutil.WaitLong, testutil.IntervalMedium)
 	t.Logf("got workspace agents (workspace %s)", workspaceID)
 	return resources
 }
@@ -797,13 +902,14 @@ func AwaitWorkspaceAgents(t *testing.T, client *codersdk.Client, workspaceID uui
 // CreateWorkspace creates a workspace for the user and template provided.
 // A random name is generated for it.
 // To customize the defaults, pass a mutator func.
-func CreateWorkspace(t *testing.T, client *codersdk.Client, organization uuid.UUID, templateID uuid.UUID, mutators ...func(*codersdk.CreateWorkspaceRequest)) codersdk.Workspace {
+func CreateWorkspace(t testing.TB, client *codersdk.Client, organization uuid.UUID, templateID uuid.UUID, mutators ...func(*codersdk.CreateWorkspaceRequest)) codersdk.Workspace {
 	t.Helper()
 	req := codersdk.CreateWorkspaceRequest{
 		TemplateID:        templateID,
-		Name:              randomUsername(t),
+		Name:              RandomUsername(t),
 		AutostartSchedule: ptr.Ref("CRON_TZ=US/Central 30 9 * * 1-5"),
 		TTLMillis:         ptr.Ref((8 * time.Hour).Milliseconds()),
+		AutomaticUpdates:  codersdk.AutomaticUpdatesNever,
 	}
 	for _, mutator := range mutators {
 		mutator(&req)
@@ -814,7 +920,7 @@ func CreateWorkspace(t *testing.T, client *codersdk.Client, organization uuid.UU
 }
 
 // TransitionWorkspace is a convenience method for transitioning a workspace from one state to another.
-func MustTransitionWorkspace(t *testing.T, client *codersdk.Client, workspaceID uuid.UUID, from, to database.WorkspaceTransition) codersdk.Workspace {
+func MustTransitionWorkspace(t testing.TB, client *codersdk.Client, workspaceID uuid.UUID, from, to database.WorkspaceTransition, muts ...func(req *codersdk.CreateWorkspaceBuildRequest)) codersdk.Workspace {
 	t.Helper()
 	ctx := context.Background()
 	workspace, err := client.Workspace(ctx, workspaceID)
@@ -824,13 +930,19 @@ func MustTransitionWorkspace(t *testing.T, client *codersdk.Client, workspaceID
 	template, err := client.Template(ctx, workspace.TemplateID)
 	require.NoError(t, err, "fetch workspace template")
 
-	build, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+	req := codersdk.CreateWorkspaceBuildRequest{
 		TemplateVersionID: template.ActiveVersionID,
 		Transition:        codersdk.WorkspaceTransition(to),
-	})
+	}
+
+	for _, mut := range muts {
+		mut(&req)
+	}
+
+	build, err := client.CreateWorkspaceBuild(ctx, workspace.ID, req)
 	require.NoError(t, err, "unexpected error transitioning workspace to %s", to)
 
-	_ = AwaitWorkspaceBuildJob(t, client, build.ID)
+	_ = AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
 
 	updated := MustWorkspace(t, client, workspace.ID)
 	require.Equal(t, codersdk.WorkspaceTransition(to), updated.LatestBuild.Transition, "expected workspace to be in state %s but got %s", to, updated.LatestBuild.Transition)
@@ -838,7 +950,7 @@ func MustTransitionWorkspace(t *testing.T, client *codersdk.Client, workspaceID
 }
 
 // MustWorkspace is a convenience method for fetching a workspace that should exist.
-func MustWorkspace(t *testing.T, client *codersdk.Client, workspaceID uuid.UUID) codersdk.Workspace {
+func MustWorkspace(t testing.TB, client *codersdk.Client, workspaceID uuid.UUID) codersdk.Workspace {
 	t.Helper()
 	ctx := context.Background()
 	ws, err := client.Workspace(ctx, workspaceID)
@@ -849,14 +961,14 @@ func MustWorkspace(t *testing.T, client *codersdk.Client, workspaceID uuid.UUID)
 	return ws
 }
 
-// RequestGitAuthCallback makes a request with the proper OAuth2 state cookie
-// to the git auth callback endpoint.
-func RequestGitAuthCallback(t *testing.T, providerID string, client *codersdk.Client) *http.Response {
+// RequestExternalAuthCallback makes a request with the proper OAuth2 state cookie
+// to the external auth callback endpoint.
+func RequestExternalAuthCallback(t testing.TB, providerID string, client *codersdk.Client) *http.Response {
 	client.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
 		return http.ErrUseLastResponse
 	}
 	state := "somestate"
-	oauthURL, err := client.URL.Parse(fmt.Sprintf("/gitauth/%s/callback?code=asd&state=%s", providerID, state))
+	oauthURL, err := client.URL.Parse(fmt.Sprintf("/external-auth/%s/callback?code=asd&state=%s", providerID, state))
 	require.NoError(t, err)
 	req, err := http.NewRequestWithContext(context.Background(), "GET", oauthURL.String(), nil)
 	require.NoError(t, err)
@@ -879,7 +991,7 @@ func RequestGitAuthCallback(t *testing.T, providerID string, client *codersdk.Cl
 // NewGoogleInstanceIdentity returns a metadata client and ID token validator for faking
 // instance authentication for Google Cloud.
 // nolint:revive
-func NewGoogleInstanceIdentity(t *testing.T, instanceID string, expired bool) (*idtoken.Validator, *metadata.Client) {
+func NewGoogleInstanceIdentity(t testing.TB, instanceID string, expired bool) (*idtoken.Validator, *metadata.Client) {
 	keyID, err := cryptorand.String(12)
 	require.NoError(t, err)
 	claims := jwt.MapClaims{
@@ -941,7 +1053,7 @@ func NewGoogleInstanceIdentity(t *testing.T, instanceID string, expired bool) (*
 
 // NewAWSInstanceIdentity returns a metadata client and ID token validator for faking
 // instance authentication for AWS.
-func NewAWSInstanceIdentity(t *testing.T, instanceID string) (awsidentity.Certificates, *http.Client) {
+func NewAWSInstanceIdentity(t testing.TB, instanceID string) (awsidentity.Certificates, *http.Client) {
 	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
 	require.NoError(t, err)
 
@@ -999,108 +1111,9 @@ func NewAWSInstanceIdentity(t *testing.T, instanceID string) (awsidentity.Certif
 		}
 }
 
-type OIDCConfig struct {
-	key    *rsa.PrivateKey
-	issuer string
-}
-
-func NewOIDCConfig(t *testing.T, issuer string) *OIDCConfig {
-	t.Helper()
-
-	block, _ := pem.Decode([]byte(testRSAPrivateKey))
-	pkey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
-	require.NoError(t, err)
-
-	if issuer == "" {
-		issuer = "https://coder.com"
-	}
-
-	return &OIDCConfig{
-		key:    pkey,
-		issuer: issuer,
-	}
-}
-
-func (*OIDCConfig) AuthCodeURL(state string, _ ...oauth2.AuthCodeOption) string {
-	return "/?state=" + url.QueryEscape(state)
-}
-
-func (*OIDCConfig) TokenSource(context.Context, *oauth2.Token) oauth2.TokenSource {
-	return nil
-}
-
-func (*OIDCConfig) Exchange(_ context.Context, code string, _ ...oauth2.AuthCodeOption) (*oauth2.Token, error) {
-	token, err := base64.StdEncoding.DecodeString(code)
-	if err != nil {
-		return nil, xerrors.Errorf("decode code: %w", err)
-	}
-	return (&oauth2.Token{
-		AccessToken: "token",
-	}).WithExtra(map[string]interface{}{
-		"id_token": string(token),
-	}), nil
-}
-
-func (o *OIDCConfig) EncodeClaims(t *testing.T, claims jwt.MapClaims) string {
-	t.Helper()
-
-	if _, ok := claims["exp"]; !ok {
-		claims["exp"] = time.Now().Add(time.Hour).UnixMilli()
-	}
-
-	if _, ok := claims["iss"]; !ok {
-		claims["iss"] = o.issuer
-	}
-
-	if _, ok := claims["sub"]; !ok {
-		claims["sub"] = "testme"
-	}
-
-	signed, err := jwt.NewWithClaims(jwt.SigningMethodRS256, claims).SignedString(o.key)
-	require.NoError(t, err)
-
-	return base64.StdEncoding.EncodeToString([]byte(signed))
-}
-
-func (o *OIDCConfig) OIDCConfig(t *testing.T, userInfoClaims jwt.MapClaims, opts ...func(cfg *coderd.OIDCConfig)) *coderd.OIDCConfig {
-	// By default, the provider can be empty.
-	// This means it won't support any endpoints!
-	provider := &oidc.Provider{}
-	if userInfoClaims != nil {
-		resp, err := json.Marshal(userInfoClaims)
-		require.NoError(t, err)
-		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(http.StatusOK)
-			_, _ = w.Write(resp)
-		}))
-		t.Cleanup(srv.Close)
-		cfg := &oidc.ProviderConfig{
-			UserInfoURL: srv.URL,
-		}
-		provider = cfg.NewProvider(context.Background())
-	}
-	cfg := &coderd.OIDCConfig{
-		OAuth2Config: o,
-		Verifier: oidc.NewVerifier(o.issuer, &oidc.StaticKeySet{
-			PublicKeys: []crypto.PublicKey{o.key.Public()},
-		}, &oidc.Config{
-			SkipClientIDCheck: true,
-		}),
-		Provider:      provider,
-		UsernameField: "preferred_username",
-		EmailField:    "email",
-		AuthURLParams: map[string]string{"access_type": "offline"},
-		GroupField:    "groups",
-	}
-	for _, opt := range opts {
-		opt(cfg)
-	}
-	return cfg
-}
-
 // NewAzureInstanceIdentity returns a metadata client and ID token validator for faking
 // instance authentication for Azure.
-func NewAzureInstanceIdentity(t *testing.T, instanceID string) (x509.VerifyOptions, *http.Client) {
+func NewAzureInstanceIdentity(t testing.TB, instanceID string) (x509.VerifyOptions, *http.Client) {
 	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
 	require.NoError(t, err)
 
@@ -1157,7 +1170,7 @@ func NewAzureInstanceIdentity(t *testing.T, instanceID string) (x509.VerifyOptio
 		}
 }
 
-func randomUsername(t testing.TB) string {
+func RandomUsername(t testing.TB) string {
 	suffix, err := cryptorand.String(3)
 	require.NoError(t, err)
 	suffix = "-" + suffix
@@ -1180,28 +1193,12 @@ type nopcloser struct{}
 func (nopcloser) Close() error { return nil }
 
 // SDKError coerces err into an SDK error.
-func SDKError(t *testing.T, err error) *codersdk.Error {
+func SDKError(t testing.TB, err error) *codersdk.Error {
 	var cerr *codersdk.Error
 	require.True(t, errors.As(err, &cerr))
 	return cerr
 }
 
-const testRSAPrivateKey = `-----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDLets8+7M+iAQAqN/5BVyCIjhTQ4cmXulL+gm3v0oGMWzLupUS
-v8KPA+Tp7dgC/DZPfMLaNH1obBBhJ9DhS6RdS3AS3kzeFrdu8zFHLWF53DUBhS92
-5dCAEuJpDnNizdEhxTfoHrhuCmz8l2nt1pe5eUK2XWgd08Uc93h5ij098wIDAQAB
-AoGAHLaZeWGLSaen6O/rqxg2laZ+jEFbMO7zvOTruiIkL/uJfrY1kw+8RLIn+1q0
-wLcWcuEIHgKKL9IP/aXAtAoYh1FBvRPLkovF1NZB0Je/+CSGka6wvc3TGdvppZJe
-rKNcUvuOYLxkmLy4g9zuY5qrxFyhtIn2qZzXEtLaVOHzPQECQQDvN0mSajpU7dTB
-w4jwx7IRXGSSx65c+AsHSc1Rj++9qtPC6WsFgAfFN2CEmqhMbEUVGPv/aPjdyWk9
-pyLE9xR/AkEA2cGwyIunijE5v2rlZAD7C4vRgdcMyCf3uuPcgzFtsR6ZhyQSgLZ8
-YRPuvwm4cdPJMmO3YwBfxT6XGuSc2k8MjQJBAI0+b8prvpV2+DCQa8L/pjxp+VhR
-Xrq2GozrHrgR7NRokTB88hwFRJFF6U9iogy9wOx8HA7qxEbwLZuhm/4AhbECQC2a
-d8h4Ht09E+f3nhTEc87mODkl7WJZpHL6V2sORfeq/eIkds+H6CJ4hy5w/bSw8tjf
-sz9Di8sGIaUbLZI2rd0CQQCzlVwEtRtoNCyMJTTrkgUuNufLP19RZ5FpyXxBO5/u
-QastnN77KfUwdj3SJt44U/uh1jAIv4oSLBr8HYUkbnI8
------END RSA PRIVATE KEY-----`
-
 func DeploymentValues(t testing.TB) *codersdk.DeploymentValues {
 	var cfg codersdk.DeploymentValues
 	opts := cfg.Options()
diff --git a/coderd/coderdtest/coderdtest_test.go b/coderd/coderdtest/coderdtest_test.go
index c0187fc94d661..455a03dc119b7 100644
--- a/coderd/coderdtest/coderdtest_test.go
+++ b/coderd/coderdtest/coderdtest_test.go
@@ -5,7 +5,7 @@ import (
 
 	"go.uber.org/goleak"
 
-	"github.com/coder/coder/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
 )
 
 func TestMain(m *testing.M) {
@@ -19,10 +19,10 @@ func TestNew(t *testing.T) {
 	})
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-	_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 	_, _ = coderdtest.NewGoogleInstanceIdentity(t, "example", false)
 	_, _ = coderdtest.NewAWSInstanceIdentity(t, "an-instance")
diff --git a/coderd/coderdtest/oidctest/helper.go b/coderd/coderdtest/oidctest/helper.go
new file mode 100644
index 0000000000000..5f3fe27e2eec0
--- /dev/null
+++ b/coderd/coderdtest/oidctest/helper.go
@@ -0,0 +1,106 @@
+package oidctest
+
+import (
+	"database/sql"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
+)
+
+// LoginHelper helps with logging in a user and refreshing their oauth tokens.
+// It is mainly because refreshing oauth tokens is a bit tricky and requires
+// some database manipulation.
+type LoginHelper struct {
+	fake   *FakeIDP
+	client *codersdk.Client
+}
+
+func NewLoginHelper(client *codersdk.Client, fake *FakeIDP) *LoginHelper {
+	if client == nil {
+		panic("client must not be nil")
+	}
+	if fake == nil {
+		panic("fake must not be nil")
+	}
+	return &LoginHelper{
+		fake:   fake,
+		client: client,
+	}
+}
+
+// Login just helps by making an unauthenticated client and logging in with
+// the given claims. All Logins should be unauthenticated, so this is a
+// convenience method.
+func (h *LoginHelper) Login(t *testing.T, idTokenClaims jwt.MapClaims) (*codersdk.Client, *http.Response) {
+	t.Helper()
+	unauthenticatedClient := codersdk.New(h.client.URL)
+
+	return h.fake.Login(t, unauthenticatedClient, idTokenClaims)
+}
+
+// ExpireOauthToken expires the oauth token for the given user.
+func (*LoginHelper) ExpireOauthToken(t *testing.T, db database.Store, user *codersdk.Client) database.UserLink {
+	t.Helper()
+
+	//nolint:gocritic // Testing
+	ctx := dbauthz.AsSystemRestricted(testutil.Context(t, testutil.WaitMedium))
+
+	id, _, err := httpmw.SplitAPIToken(user.SessionToken())
+	require.NoError(t, err)
+
+	// We need to get the OIDC link and update it in the database to force
+	// it to be expired.
+	key, err := db.GetAPIKeyByID(ctx, id)
+	require.NoError(t, err, "get api key")
+
+	link, err := db.GetUserLinkByUserIDLoginType(ctx, database.GetUserLinkByUserIDLoginTypeParams{
+		UserID:    key.UserID,
+		LoginType: database.LoginTypeOIDC,
+	})
+	require.NoError(t, err, "get user link")
+
+	// Expire the oauth link for the given user.
+	updated, err := db.UpdateUserLink(ctx, database.UpdateUserLinkParams{
+		OAuthAccessToken:       link.OAuthAccessToken,
+		OAuthAccessTokenKeyID:  sql.NullString{}, // dbcrypt will update as required
+		OAuthRefreshToken:      link.OAuthRefreshToken,
+		OAuthRefreshTokenKeyID: sql.NullString{}, // dbcrypt will update as required
+		OAuthExpiry:            time.Now().Add(time.Hour * -1),
+		UserID:                 link.UserID,
+		LoginType:              link.LoginType,
+	})
+	require.NoError(t, err, "expire user link")
+
+	return updated
+}
+
+// ForceRefresh forces the client to refresh its oauth token. It does this by
+// expiring the oauth token, then doing an authenticated call. This will force
+// the API Key middleware to refresh the oauth token.
+//
+// A unit test assertion makes sure the refresh token is used.
+func (h *LoginHelper) ForceRefresh(t *testing.T, db database.Store, user *codersdk.Client, idToken jwt.MapClaims) {
+	t.Helper()
+
+	link := h.ExpireOauthToken(t, db, user)
+	// Updates the claims that the IDP will return. By default, it always
+	// uses the original claims for the original oauth token.
+	h.fake.UpdateRefreshClaims(link.OAuthRefreshToken, idToken)
+
+	t.Cleanup(func() {
+		require.True(t, h.fake.RefreshUsed(link.OAuthRefreshToken), "refresh token must be used, but has not. Did you forget to call the returned function from this call?")
+	})
+
+	// Do any authenticated call to force the refresh
+	_, err := user.User(testutil.Context(t, testutil.WaitShort), "me")
+	require.NoError(t, err, "user must be able to be fetched")
+}
diff --git a/coderd/coderdtest/oidctest/idp.go b/coderd/coderdtest/oidctest/idp.go
new file mode 100644
index 0000000000000..807257ff18df1
--- /dev/null
+++ b/coderd/coderdtest/oidctest/idp.go
@@ -0,0 +1,854 @@
+package oidctest
+
+import (
+	"context"
+	"crypto"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/cookiejar"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/coder/coder/v2/coderd/util/syncmap"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/go-chi/chi/v5"
+	"github.com/go-jose/go-jose/v3"
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+// FakeIDP is a functional OIDC provider.
+// It only supports 1 OIDC client.
+type FakeIDP struct {
+	issuer   string
+	key      *rsa.PrivateKey
+	provider ProviderJSON
+	handler  http.Handler
+	cfg      *oauth2.Config
+
+	// clientID to be used by coderd
+	clientID     string
+	clientSecret string
+	logger       slog.Logger
+
+	// These maps are used to control the state of the IDP.
+	// That is the various access tokens, refresh tokens, states, etc.
+	codeToStateMap *syncmap.Map[string, string]
+	// Token -> Email
+	accessTokens *syncmap.Map[string, string]
+	// Refresh Token -> Email
+	refreshTokensUsed    *syncmap.Map[string, bool]
+	refreshTokens        *syncmap.Map[string, string]
+	stateToIDTokenClaims *syncmap.Map[string, jwt.MapClaims]
+	refreshIDTokenClaims *syncmap.Map[string, jwt.MapClaims]
+
+	// hooks
+	// hookValidRedirectURL can be used to reject a redirect url from the
+	// IDP -> Application. Almost all IDPs have the concept of
+	// "Authorized Redirect URLs". This can be used to emulate that.
+	hookValidRedirectURL func(redirectURL string) error
+	hookUserInfo         func(email string) (jwt.MapClaims, error)
+	hookMutateToken      func(token map[string]interface{})
+	fakeCoderd           func(req *http.Request) (*http.Response, error)
+	hookOnRefresh        func(email string) error
+	// Custom authentication for the client. This is useful if you want
+	// to test something like PKI auth vs a client_secret.
+	hookAuthenticateClient func(t testing.TB, req *http.Request) (url.Values, error)
+	serve                  bool
+}
+
+func StatusError(code int, err error) error {
+	return statusHookError{
+		Err:            err,
+		HTTPStatusCode: code,
+	}
+}
+
+// statusHookError allows a hook to change the returned http status code.
+type statusHookError struct {
+	Err            error
+	HTTPStatusCode int
+}
+
+func (s statusHookError) Error() string {
+	if s.Err == nil {
+		return ""
+	}
+	return s.Err.Error()
+}
+
+type FakeIDPOpt func(idp *FakeIDP)
+
+func WithAuthorizedRedirectURL(hook func(redirectURL string) error) func(*FakeIDP) {
+	return func(f *FakeIDP) {
+		f.hookValidRedirectURL = hook
+	}
+}
+
+// WithRefresh is called when a refresh token is used. The email is
+// the email of the user that is being refreshed assuming the claims are correct.
+func WithRefresh(hook func(email string) error) func(*FakeIDP) {
+	return func(f *FakeIDP) {
+		f.hookOnRefresh = hook
+	}
+}
+
+// WithExtra returns extra fields that be accessed on the returned Oauth Token.
+// These extra fields can override the default fields (id_token, access_token, etc).
+func WithMutateToken(mutateToken func(token map[string]interface{})) func(*FakeIDP) {
+	return func(f *FakeIDP) {
+		f.hookMutateToken = mutateToken
+	}
+}
+
+func WithCustomClientAuth(hook func(t testing.TB, req *http.Request) (url.Values, error)) func(*FakeIDP) {
+	return func(f *FakeIDP) {
+		f.hookAuthenticateClient = hook
+	}
+}
+
+// WithLogging is optional, but will log some HTTP calls made to the IDP.
+func WithLogging(t testing.TB, options *slogtest.Options) func(*FakeIDP) {
+	return func(f *FakeIDP) {
+		f.logger = slogtest.Make(t, options)
+	}
+}
+
+// WithStaticUserInfo is optional, but will return the same user info for
+// every user on the /userinfo endpoint.
+func WithStaticUserInfo(info jwt.MapClaims) func(*FakeIDP) {
+	return func(f *FakeIDP) {
+		f.hookUserInfo = func(_ string) (jwt.MapClaims, error) {
+			return info, nil
+		}
+	}
+}
+
+func WithDynamicUserInfo(userInfoFunc func(email string) (jwt.MapClaims, error)) func(*FakeIDP) {
+	return func(f *FakeIDP) {
+		f.hookUserInfo = userInfoFunc
+	}
+}
+
+// WithServing makes the IDP run an actual http server.
+func WithServing() func(*FakeIDP) {
+	return func(f *FakeIDP) {
+		f.serve = true
+	}
+}
+
+func WithIssuer(issuer string) func(*FakeIDP) {
+	return func(f *FakeIDP) {
+		f.issuer = issuer
+	}
+}
+
+const (
+	// nolint:gosec // It thinks this is a secret lol
+	tokenPath     = "/oauth2/token"
+	authorizePath = "/oauth2/authorize"
+	keysPath      = "/oauth2/keys"
+	userInfoPath  = "/oauth2/userinfo"
+)
+
+func NewFakeIDP(t testing.TB, opts ...FakeIDPOpt) *FakeIDP {
+	t.Helper()
+
+	block, _ := pem.Decode([]byte(testRSAPrivateKey))
+	pkey, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+	require.NoError(t, err)
+
+	idp := &FakeIDP{
+		key:                  pkey,
+		clientID:             uuid.NewString(),
+		clientSecret:         uuid.NewString(),
+		logger:               slog.Make(),
+		codeToStateMap:       syncmap.New[string, string](),
+		accessTokens:         syncmap.New[string, string](),
+		refreshTokens:        syncmap.New[string, string](),
+		refreshTokensUsed:    syncmap.New[string, bool](),
+		stateToIDTokenClaims: syncmap.New[string, jwt.MapClaims](),
+		refreshIDTokenClaims: syncmap.New[string, jwt.MapClaims](),
+		hookOnRefresh:        func(_ string) error { return nil },
+		hookUserInfo:         func(email string) (jwt.MapClaims, error) { return jwt.MapClaims{}, nil },
+		hookValidRedirectURL: func(redirectURL string) error { return nil },
+	}
+
+	for _, opt := range opts {
+		opt(idp)
+	}
+
+	if idp.issuer == "" {
+		idp.issuer = "https://coder.com"
+	}
+
+	idp.handler = idp.httpHandler(t)
+	idp.updateIssuerURL(t, idp.issuer)
+	if idp.serve {
+		idp.realServer(t)
+	}
+
+	return idp
+}
+
+func (f *FakeIDP) WellknownConfig() ProviderJSON {
+	return f.provider
+}
+
+func (f *FakeIDP) updateIssuerURL(t testing.TB, issuer string) {
+	t.Helper()
+
+	u, err := url.Parse(issuer)
+	require.NoError(t, err, "invalid issuer URL")
+
+	f.issuer = issuer
+	// ProviderJSON is the JSON representation of the OpenID Connect provider
+	// These are all the urls that the IDP will respond to.
+	f.provider = ProviderJSON{
+		Issuer:      issuer,
+		AuthURL:     u.ResolveReference(&url.URL{Path: authorizePath}).String(),
+		TokenURL:    u.ResolveReference(&url.URL{Path: tokenPath}).String(),
+		JWKSURL:     u.ResolveReference(&url.URL{Path: keysPath}).String(),
+		UserInfoURL: u.ResolveReference(&url.URL{Path: userInfoPath}).String(),
+		Algorithms: []string{
+			"RS256",
+		},
+	}
+}
+
+// realServer turns the FakeIDP into a real http server.
+func (f *FakeIDP) realServer(t testing.TB) *httptest.Server {
+	t.Helper()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	srv := httptest.NewUnstartedServer(f.handler)
+	srv.Config.BaseContext = func(_ net.Listener) context.Context {
+		return ctx
+	}
+	srv.Start()
+	t.Cleanup(srv.CloseClientConnections)
+	t.Cleanup(srv.Close)
+	t.Cleanup(cancel)
+
+	f.updateIssuerURL(t, srv.URL)
+	return srv
+}
+
+// GenerateAuthenticatedToken skips all oauth2 flows, and just generates a
+// valid token for some given claims.
+func (f *FakeIDP) GenerateAuthenticatedToken(claims jwt.MapClaims) (*oauth2.Token, error) {
+	state := uuid.NewString()
+	f.stateToIDTokenClaims.Store(state, claims)
+	code := f.newCode(state)
+	return f.cfg.Exchange(oidc.ClientContext(context.Background(), f.HTTPClient(nil)), code)
+}
+
+// Login does the full OIDC flow starting at the "LoginButton".
+// The client argument is just to get the URL of the Coder instance.
+//
+// The client passed in is just to get the url of the Coder instance.
+// The actual client that is used is 100% unauthenticated and fresh.
+func (f *FakeIDP) Login(t testing.TB, client *codersdk.Client, idTokenClaims jwt.MapClaims, opts ...func(r *http.Request)) (*codersdk.Client, *http.Response) {
+	t.Helper()
+
+	client, resp := f.AttemptLogin(t, client, idTokenClaims, opts...)
+	require.Equal(t, http.StatusOK, resp.StatusCode, "client failed to login")
+	return client, resp
+}
+
+func (f *FakeIDP) AttemptLogin(t testing.TB, client *codersdk.Client, idTokenClaims jwt.MapClaims, opts ...func(r *http.Request)) (*codersdk.Client, *http.Response) {
+	t.Helper()
+	var err error
+
+	cli := f.HTTPClient(client.HTTPClient)
+	shallowCpyCli := *cli
+
+	if shallowCpyCli.Jar == nil {
+		shallowCpyCli.Jar, err = cookiejar.New(nil)
+		require.NoError(t, err, "failed to create cookie jar")
+	}
+
+	unauthenticated := codersdk.New(client.URL)
+	unauthenticated.HTTPClient = &shallowCpyCli
+
+	return f.LoginWithClient(t, unauthenticated, idTokenClaims, opts...)
+}
+
+// LoginWithClient reuses the context of the passed in client. This means the same
+// cookies will be used. This should be an unauthenticated client in most cases.
+//
+// This is a niche case, but it is needed for testing ConvertLoginType.
+func (f *FakeIDP) LoginWithClient(t testing.TB, client *codersdk.Client, idTokenClaims jwt.MapClaims, opts ...func(r *http.Request)) (*codersdk.Client, *http.Response) {
+	t.Helper()
+
+	coderOauthURL, err := client.URL.Parse("/api/v2/users/oidc/callback")
+	require.NoError(t, err)
+	f.SetRedirect(t, coderOauthURL.String())
+
+	cli := f.HTTPClient(client.HTTPClient)
+	cli.CheckRedirect = func(req *http.Request, via []*http.Request) error {
+		// Store the idTokenClaims to the specific state request. This ties
+		// the claims 1:1 with a given authentication flow.
+		state := req.URL.Query().Get("state")
+		f.stateToIDTokenClaims.Store(state, idTokenClaims)
+		return nil
+	}
+
+	req, err := http.NewRequestWithContext(context.Background(), "GET", coderOauthURL.String(), nil)
+	require.NoError(t, err)
+	if cli.Jar == nil {
+		cli.Jar, err = cookiejar.New(nil)
+		require.NoError(t, err, "failed to create cookie jar")
+	}
+
+	for _, opt := range opts {
+		opt(req)
+	}
+
+	res, err := cli.Do(req)
+	require.NoError(t, err)
+
+	// If the coder session token exists, return the new authed client!
+	var user *codersdk.Client
+	cookies := cli.Jar.Cookies(client.URL)
+	for _, cookie := range cookies {
+		if cookie.Name == codersdk.SessionTokenCookie {
+			user = codersdk.New(client.URL)
+			user.SetSessionToken(cookie.Value)
+		}
+	}
+
+	t.Cleanup(func() {
+		if res.Body != nil {
+			_ = res.Body.Close()
+		}
+	})
+
+	return user, res
+}
+
+// OIDCCallback will emulate the IDP redirecting back to the Coder callback.
+// This is helpful if no Coderd exists because the IDP needs to redirect to
+// something.
+// Essentially this is used to fake the Coderd side of the exchange.
+// The flow starts at the user hitting the OIDC login page.
+func (f *FakeIDP) OIDCCallback(t testing.TB, state string, idTokenClaims jwt.MapClaims) (*http.Response, error) {
+	t.Helper()
+	if f.serve {
+		panic("cannot use OIDCCallback with WithServing. This is only for the in memory usage")
+	}
+
+	f.stateToIDTokenClaims.Store(state, idTokenClaims)
+
+	cli := f.HTTPClient(nil)
+	u := f.cfg.AuthCodeURL(state)
+	req, err := http.NewRequest("GET", u, nil)
+	require.NoError(t, err)
+
+	resp, err := cli.Do(req.WithContext(context.Background()))
+	require.NoError(t, err)
+
+	t.Cleanup(func() {
+		if resp.Body != nil {
+			_ = resp.Body.Close()
+		}
+	})
+	return resp, nil
+}
+
+// ProviderJSON is the .well-known/configuration JSON
+type ProviderJSON struct {
+	Issuer      string   `json:"issuer"`
+	AuthURL     string   `json:"authorization_endpoint"`
+	TokenURL    string   `json:"token_endpoint"`
+	JWKSURL     string   `json:"jwks_uri"`
+	UserInfoURL string   `json:"userinfo_endpoint"`
+	Algorithms  []string `json:"id_token_signing_alg_values_supported"`
+}
+
+// newCode enforces the code exchanged is actually a valid code
+// created by the IDP.
+func (f *FakeIDP) newCode(state string) string {
+	code := uuid.NewString()
+	f.codeToStateMap.Store(code, state)
+	return code
+}
+
+// newToken enforces the access token exchanged is actually a valid access token
+// created by the IDP.
+func (f *FakeIDP) newToken(email string) string {
+	accessToken := uuid.NewString()
+	f.accessTokens.Store(accessToken, email)
+	return accessToken
+}
+
+func (f *FakeIDP) newRefreshTokens(email string) string {
+	refreshToken := uuid.NewString()
+	f.refreshTokens.Store(refreshToken, email)
+	return refreshToken
+}
+
+// authenticateBearerTokenRequest enforces the access token is valid.
+func (f *FakeIDP) authenticateBearerTokenRequest(t testing.TB, req *http.Request) (string, error) {
+	t.Helper()
+
+	auth := req.Header.Get("Authorization")
+	token := strings.TrimPrefix(auth, "Bearer ")
+	_, ok := f.accessTokens.Load(token)
+	if !ok {
+		return "", xerrors.New("invalid access token")
+	}
+	return token, nil
+}
+
+// authenticateOIDCClientRequest enforces the client_id and client_secret are valid.
+func (f *FakeIDP) authenticateOIDCClientRequest(t testing.TB, req *http.Request) (url.Values, error) {
+	t.Helper()
+
+	if f.hookAuthenticateClient != nil {
+		return f.hookAuthenticateClient(t, req)
+	}
+
+	data, err := io.ReadAll(req.Body)
+	if !assert.NoError(t, err, "read token request body") {
+		return nil, xerrors.Errorf("authenticate request, read body: %w", err)
+	}
+	values, err := url.ParseQuery(string(data))
+	if !assert.NoError(t, err, "parse token request values") {
+		return nil, xerrors.New("invalid token request")
+	}
+
+	if !assert.Equal(t, f.clientID, values.Get("client_id"), "client_id mismatch") {
+		return nil, xerrors.New("client_id mismatch")
+	}
+
+	if !assert.Equal(t, f.clientSecret, values.Get("client_secret"), "client_secret mismatch") {
+		return nil, xerrors.New("client_secret mismatch")
+	}
+
+	return values, nil
+}
+
+// encodeClaims is a helper func to convert claims to a valid JWT.
+func (f *FakeIDP) encodeClaims(t testing.TB, claims jwt.MapClaims) string {
+	t.Helper()
+
+	if _, ok := claims["exp"]; !ok {
+		claims["exp"] = time.Now().Add(time.Hour).UnixMilli()
+	}
+
+	if _, ok := claims["aud"]; !ok {
+		claims["aud"] = f.clientID
+	}
+
+	if _, ok := claims["iss"]; !ok {
+		claims["iss"] = f.issuer
+	}
+
+	signed, err := jwt.NewWithClaims(jwt.SigningMethodRS256, claims).SignedString(f.key)
+	require.NoError(t, err)
+
+	return signed
+}
+
+// httpHandler is the IDP http server.
+func (f *FakeIDP) httpHandler(t testing.TB) http.Handler {
+	t.Helper()
+
+	mux := chi.NewMux()
+	// This endpoint is required to initialize the OIDC provider.
+	// It is used to get the OIDC configuration.
+	mux.Get("/.well-known/openid-configuration", func(rw http.ResponseWriter, r *http.Request) {
+		f.logger.Info(r.Context(), "http OIDC config", slog.F("url", r.URL.String()))
+
+		_ = json.NewEncoder(rw).Encode(f.provider)
+	})
+
+	// Authorize is called when the user is redirected to the IDP to login.
+	// This is the browser hitting the IDP and the user logging into Google or
+	// w/e and clicking "Allow". They will be redirected back to the redirect
+	// when this is done.
+	mux.Handle(authorizePath, http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		f.logger.Info(r.Context(), "http call authorize", slog.F("url", r.URL.String()))
+
+		clientID := r.URL.Query().Get("client_id")
+		if !assert.Equal(t, f.clientID, clientID, "unexpected client_id") {
+			http.Error(rw, "invalid client_id", http.StatusBadRequest)
+			return
+		}
+
+		redirectURI := r.URL.Query().Get("redirect_uri")
+		state := r.URL.Query().Get("state")
+
+		scope := r.URL.Query().Get("scope")
+		assert.NotEmpty(t, scope, "scope is empty")
+
+		responseType := r.URL.Query().Get("response_type")
+		switch responseType {
+		case "code":
+		case "token":
+			t.Errorf("response_type %q not supported", responseType)
+			http.Error(rw, "invalid response_type", http.StatusBadRequest)
+			return
+		default:
+			t.Errorf("unexpected response_type %q", responseType)
+			http.Error(rw, "invalid response_type", http.StatusBadRequest)
+			return
+		}
+
+		err := f.hookValidRedirectURL(redirectURI)
+		if err != nil {
+			t.Errorf("not authorized redirect_uri by custom hook %q: %s", redirectURI, err.Error())
+			http.Error(rw, fmt.Sprintf("invalid redirect_uri: %s", err.Error()), httpErrorCode(http.StatusBadRequest, err))
+			return
+		}
+
+		ru, err := url.Parse(redirectURI)
+		if err != nil {
+			t.Errorf("invalid redirect_uri %q: %s", redirectURI, err.Error())
+			http.Error(rw, fmt.Sprintf("invalid redirect_uri: %s", err.Error()), http.StatusBadRequest)
+			return
+		}
+
+		q := ru.Query()
+		q.Set("state", state)
+		q.Set("code", f.newCode(state))
+		ru.RawQuery = q.Encode()
+
+		http.Redirect(rw, r, ru.String(), http.StatusTemporaryRedirect)
+	}))
+
+	mux.Handle(tokenPath, http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		values, err := f.authenticateOIDCClientRequest(t, r)
+		f.logger.Info(r.Context(), "http idp call token",
+			slog.Error(err),
+			slog.F("values", values.Encode()),
+		)
+		if err != nil {
+			http.Error(rw, fmt.Sprintf("invalid token request: %s", err.Error()), httpErrorCode(http.StatusBadRequest, err))
+			return
+		}
+		getEmail := func(claims jwt.MapClaims) string {
+			email, ok := claims["email"]
+			if !ok {
+				return "unknown"
+			}
+			emailStr, ok := email.(string)
+			if !ok {
+				return "wrong-type"
+			}
+			return emailStr
+		}
+
+		var claims jwt.MapClaims
+		switch values.Get("grant_type") {
+		case "authorization_code":
+			code := values.Get("code")
+			if !assert.NotEmpty(t, code, "code is empty") {
+				http.Error(rw, "invalid code", http.StatusBadRequest)
+				return
+			}
+			stateStr, ok := f.codeToStateMap.Load(code)
+			if !assert.True(t, ok, "invalid code") {
+				http.Error(rw, "invalid code", http.StatusBadRequest)
+				return
+			}
+			// Always invalidate the code after it is used.
+			f.codeToStateMap.Delete(code)
+
+			idTokenClaims, ok := f.stateToIDTokenClaims.Load(stateStr)
+			if !ok {
+				t.Errorf("missing id token claims")
+				http.Error(rw, "missing id token claims", http.StatusBadRequest)
+				return
+			}
+			claims = idTokenClaims
+		case "refresh_token":
+			refreshToken := values.Get("refresh_token")
+			if !assert.NotEmpty(t, refreshToken, "refresh_token is empty") {
+				http.Error(rw, "invalid refresh_token", http.StatusBadRequest)
+				return
+			}
+
+			_, ok := f.refreshTokens.Load(refreshToken)
+			if !assert.True(t, ok, "invalid refresh_token") {
+				http.Error(rw, "invalid refresh_token", http.StatusBadRequest)
+				return
+			}
+
+			idTokenClaims, ok := f.refreshIDTokenClaims.Load(refreshToken)
+			if !ok {
+				t.Errorf("missing id token claims in refresh")
+				http.Error(rw, "missing id token claims in refresh", http.StatusBadRequest)
+				return
+			}
+
+			claims = idTokenClaims
+			err := f.hookOnRefresh(getEmail(claims))
+			if err != nil {
+				http.Error(rw, fmt.Sprintf("refresh hook blocked refresh: %s", err.Error()), httpErrorCode(http.StatusBadRequest, err))
+				return
+			}
+
+			f.refreshTokensUsed.Store(refreshToken, true)
+			// Always invalidate the refresh token after it is used.
+			f.refreshTokens.Delete(refreshToken)
+		default:
+			t.Errorf("unexpected grant_type %q", values.Get("grant_type"))
+			http.Error(rw, "invalid grant_type", http.StatusBadRequest)
+			return
+		}
+
+		exp := time.Now().Add(time.Minute * 5)
+		claims["exp"] = exp.UnixMilli()
+		email := getEmail(claims)
+		refreshToken := f.newRefreshTokens(email)
+		token := map[string]interface{}{
+			"access_token":  f.newToken(email),
+			"refresh_token": refreshToken,
+			"token_type":    "Bearer",
+			"expires_in":    int64((time.Minute * 5).Seconds()),
+			"id_token":      f.encodeClaims(t, claims),
+		}
+		if f.hookMutateToken != nil {
+			f.hookMutateToken(token)
+		}
+		// Store the claims for the next refresh
+		f.refreshIDTokenClaims.Store(refreshToken, claims)
+
+		rw.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(rw).Encode(token)
+	}))
+
+	mux.Handle(userInfoPath, http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		token, err := f.authenticateBearerTokenRequest(t, r)
+		f.logger.Info(r.Context(), "http call idp user info",
+			slog.Error(err),
+			slog.F("url", r.URL.String()),
+		)
+		if err != nil {
+			http.Error(rw, fmt.Sprintf("invalid user info request: %s", err.Error()), http.StatusBadRequest)
+			return
+		}
+
+		email, ok := f.accessTokens.Load(token)
+		if !ok {
+			t.Errorf("access token user for user_info has no email to indicate which user")
+			http.Error(rw, "invalid access token, missing user info", http.StatusBadRequest)
+			return
+		}
+		claims, err := f.hookUserInfo(email)
+		if err != nil {
+			http.Error(rw, fmt.Sprintf("user info hook returned error: %s", err.Error()), httpErrorCode(http.StatusBadRequest, err))
+			return
+		}
+		_ = json.NewEncoder(rw).Encode(claims)
+	}))
+
+	mux.Handle(keysPath, http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		f.logger.Info(r.Context(), "http call idp /keys")
+		set := jose.JSONWebKeySet{
+			Keys: []jose.JSONWebKey{
+				{
+					Key:       f.key.Public(),
+					KeyID:     "test-key",
+					Algorithm: "RSA",
+				},
+			},
+		}
+		_ = json.NewEncoder(rw).Encode(set)
+	}))
+
+	mux.NotFound(func(rw http.ResponseWriter, r *http.Request) {
+		f.logger.Error(r.Context(), "http call not found", slog.F("path", r.URL.Path))
+		t.Errorf("unexpected request to IDP at path %q. Not supported", r.URL.Path)
+	})
+
+	return mux
+}
+
+// HTTPClient does nothing if IsServing is used.
+//
+// If IsServing is not used, then it will return a client that will make requests
+// to the IDP all in memory. If a request is not to the IDP, then the passed in
+// client will be used. If no client is passed in, then any regular network
+// requests will fail.
+func (f *FakeIDP) HTTPClient(rest *http.Client) *http.Client {
+	if f.serve {
+		if rest == nil || rest.Transport == nil {
+			return &http.Client{}
+		}
+		return rest
+	}
+
+	var jar http.CookieJar
+	if rest != nil {
+		jar = rest.Jar
+	}
+	return &http.Client{
+		Jar: jar,
+		Transport: fakeRoundTripper{
+			roundTrip: func(req *http.Request) (*http.Response, error) {
+				u, _ := url.Parse(f.issuer)
+				if req.URL.Host != u.Host {
+					if f.fakeCoderd != nil {
+						return f.fakeCoderd(req)
+					}
+					if rest == nil || rest.Transport == nil {
+						return nil, xerrors.Errorf("unexpected network request to %q", req.URL.Host)
+					}
+					return rest.Transport.RoundTrip(req)
+				}
+				resp := httptest.NewRecorder()
+				f.handler.ServeHTTP(resp, req)
+				return resp.Result(), nil
+			},
+		},
+	}
+}
+
+// RefreshUsed returns if the refresh token has been used. All refresh tokens
+// can only be used once, then they are deleted.
+func (f *FakeIDP) RefreshUsed(refreshToken string) bool {
+	used, _ := f.refreshTokensUsed.Load(refreshToken)
+	return used
+}
+
+// UpdateRefreshClaims allows the caller to change what claims are returned
+// for a given refresh token. By default, all refreshes use the same claims as
+// the original IDToken issuance.
+func (f *FakeIDP) UpdateRefreshClaims(refreshToken string, claims jwt.MapClaims) {
+	f.refreshIDTokenClaims.Store(refreshToken, claims)
+}
+
+// SetRedirect is required for the IDP to know where to redirect and call
+// Coderd.
+func (f *FakeIDP) SetRedirect(t testing.TB, u string) {
+	t.Helper()
+
+	f.cfg.RedirectURL = u
+}
+
+// SetCoderdCallback is optional and only works if not using the IsServing.
+// It will setup a fake "Coderd" for the IDP to call when the IDP redirects
+// back after authenticating.
+func (f *FakeIDP) SetCoderdCallback(callback func(req *http.Request) (*http.Response, error)) {
+	if f.serve {
+		panic("cannot set callback handler when using 'WithServing'. Must implement an actual 'Coderd'")
+	}
+	f.fakeCoderd = callback
+}
+
+func (f *FakeIDP) SetCoderdCallbackHandler(handler http.HandlerFunc) {
+	f.SetCoderdCallback(func(req *http.Request) (*http.Response, error) {
+		resp := httptest.NewRecorder()
+		handler.ServeHTTP(resp, req)
+		return resp.Result(), nil
+	})
+}
+
+// OIDCConfig returns the OIDC config to use for Coderd.
+func (f *FakeIDP) OIDCConfig(t testing.TB, scopes []string, opts ...func(cfg *coderd.OIDCConfig)) *coderd.OIDCConfig {
+	t.Helper()
+	if len(scopes) == 0 {
+		scopes = []string{"openid", "email", "profile"}
+	}
+
+	oauthCfg := &oauth2.Config{
+		ClientID:     f.clientID,
+		ClientSecret: f.clientSecret,
+		Endpoint: oauth2.Endpoint{
+			AuthURL:   f.provider.AuthURL,
+			TokenURL:  f.provider.TokenURL,
+			AuthStyle: oauth2.AuthStyleInParams,
+		},
+		// If the user is using a real network request, they will need to do
+		// 'fake.SetRedirect()'
+		RedirectURL: "https://redirect.com",
+		Scopes:      scopes,
+	}
+
+	ctx := oidc.ClientContext(context.Background(), f.HTTPClient(nil))
+	p, err := oidc.NewProvider(ctx, f.provider.Issuer)
+	require.NoError(t, err, "failed to create OIDC provider")
+	cfg := &coderd.OIDCConfig{
+		OAuth2Config: oauthCfg,
+		Provider:     p,
+		Verifier: oidc.NewVerifier(f.provider.Issuer, &oidc.StaticKeySet{
+			PublicKeys: []crypto.PublicKey{f.key.Public()},
+		}, &oidc.Config{
+			ClientID: oauthCfg.ClientID,
+			SupportedSigningAlgs: []string{
+				"RS256",
+			},
+			// Todo: add support for Now()
+		}),
+		UsernameField: "preferred_username",
+		EmailField:    "email",
+		AuthURLParams: map[string]string{"access_type": "offline"},
+	}
+
+	for _, opt := range opts {
+		if opt == nil {
+			continue
+		}
+		opt(cfg)
+	}
+
+	f.cfg = oauthCfg
+
+	return cfg
+}
+
+func httpErrorCode(defaultCode int, err error) int {
+	var stautsErr statusHookError
+	status := defaultCode
+	if errors.As(err, &stautsErr) {
+		status = stautsErr.HTTPStatusCode
+	}
+	return status
+}
+
+type fakeRoundTripper struct {
+	roundTrip func(req *http.Request) (*http.Response, error)
+}
+
+func (f fakeRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f.roundTrip(req)
+}
+
+const testRSAPrivateKey = `-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQDLets8+7M+iAQAqN/5BVyCIjhTQ4cmXulL+gm3v0oGMWzLupUS
+v8KPA+Tp7dgC/DZPfMLaNH1obBBhJ9DhS6RdS3AS3kzeFrdu8zFHLWF53DUBhS92
+5dCAEuJpDnNizdEhxTfoHrhuCmz8l2nt1pe5eUK2XWgd08Uc93h5ij098wIDAQAB
+AoGAHLaZeWGLSaen6O/rqxg2laZ+jEFbMO7zvOTruiIkL/uJfrY1kw+8RLIn+1q0
+wLcWcuEIHgKKL9IP/aXAtAoYh1FBvRPLkovF1NZB0Je/+CSGka6wvc3TGdvppZJe
+rKNcUvuOYLxkmLy4g9zuY5qrxFyhtIn2qZzXEtLaVOHzPQECQQDvN0mSajpU7dTB
+w4jwx7IRXGSSx65c+AsHSc1Rj++9qtPC6WsFgAfFN2CEmqhMbEUVGPv/aPjdyWk9
+pyLE9xR/AkEA2cGwyIunijE5v2rlZAD7C4vRgdcMyCf3uuPcgzFtsR6ZhyQSgLZ8
+YRPuvwm4cdPJMmO3YwBfxT6XGuSc2k8MjQJBAI0+b8prvpV2+DCQa8L/pjxp+VhR
+Xrq2GozrHrgR7NRokTB88hwFRJFF6U9iogy9wOx8HA7qxEbwLZuhm/4AhbECQC2a
+d8h4Ht09E+f3nhTEc87mODkl7WJZpHL6V2sORfeq/eIkds+H6CJ4hy5w/bSw8tjf
+sz9Di8sGIaUbLZI2rd0CQQCzlVwEtRtoNCyMJTTrkgUuNufLP19RZ5FpyXxBO5/u
+QastnN77KfUwdj3SJt44U/uh1jAIv4oSLBr8HYUkbnI8
+-----END RSA PRIVATE KEY-----`
diff --git a/coderd/coderdtest/oidctest/idp_test.go b/coderd/coderdtest/oidctest/idp_test.go
new file mode 100644
index 0000000000000..519635b067916
--- /dev/null
+++ b/coderd/coderdtest/oidctest/idp_test.go
@@ -0,0 +1,73 @@
+package oidctest_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+
+	"github.com/coder/coder/v2/coderd/coderdtest/oidctest"
+)
+
+// TestFakeIDPBasicFlow tests the basic flow of the fake IDP.
+// It is done all in memory with no actual network requests.
+// nolint:bodyclose
+func TestFakeIDPBasicFlow(t *testing.T) {
+	t.Parallel()
+
+	fake := oidctest.NewFakeIDP(t,
+		oidctest.WithLogging(t, nil),
+	)
+
+	var handler http.Handler
+	srv := httptest.NewServer(http.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		handler.ServeHTTP(w, r)
+	})))
+	defer srv.Close()
+
+	cfg := fake.OIDCConfig(t, nil)
+	cli := fake.HTTPClient(nil)
+	ctx := oidc.ClientContext(context.Background(), cli)
+
+	const expectedState = "random-state"
+	var token *oauth2.Token
+	// This is the Coder callback using an actual network request.
+	fake.SetCoderdCallbackHandler(func(w http.ResponseWriter, r *http.Request) {
+		// Emulate OIDC flow
+		code := r.URL.Query().Get("code")
+		state := r.URL.Query().Get("state")
+		assert.Equal(t, expectedState, state, "state mismatch")
+
+		oauthToken, err := cfg.Exchange(ctx, code)
+		if assert.NoError(t, err, "failed to exchange code") {
+			assert.NotEmpty(t, oauthToken.AccessToken, "access token is empty")
+			assert.NotEmpty(t, oauthToken.RefreshToken, "refresh token is empty")
+		}
+		token = oauthToken
+	})
+
+	resp, err := fake.OIDCCallback(t, expectedState, jwt.MapClaims{})
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	// Test the user info
+	_, err = cfg.Provider.UserInfo(ctx, oauth2.StaticTokenSource(token))
+	require.NoError(t, err)
+
+	// Now test it can refresh
+	refreshed, err := cfg.TokenSource(ctx, &oauth2.Token{
+		AccessToken:  token.AccessToken,
+		RefreshToken: token.RefreshToken,
+		Expiry:       time.Now().Add(time.Minute * -1),
+	}).Token()
+	require.NoError(t, err, "failed to refresh token")
+	require.NotEmpty(t, refreshed.AccessToken, "access token is empty on refresh")
+}
diff --git a/coderd/coderdtest/swagger_test.go b/coderd/coderdtest/swagger_test.go
index 07fb19ad64b85..7b50a27964631 100644
--- a/coderd/coderdtest/swagger_test.go
+++ b/coderd/coderdtest/swagger_test.go
@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
 )
 
 func TestEndpointsDocumented(t *testing.T) {
diff --git a/coderd/csp.go b/coderd/csp.go
index ba87adfc635e9..84e22daf9a127 100644
--- a/coderd/csp.go
+++ b/coderd/csp.go
@@ -4,8 +4,8 @@ import (
 	"encoding/json"
 	"net/http"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 
 	"cdr.dev/slog"
 )
diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go
index 263611d5b168b..a2b1d85ac89bb 100644
--- a/coderd/database/db2sdk/db2sdk.go
+++ b/coderd/database/db2sdk/db2sdk.go
@@ -3,14 +3,16 @@ package db2sdk
 
 import (
 	"encoding/json"
+	"strings"
 
 	"github.com/google/uuid"
+	"golang.org/x/exp/slices"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/parameter"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/parameter"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 func WorkspaceBuildParameters(params []database.WorkspaceBuildParameter) []codersdk.WorkspaceBuildParameter {
@@ -29,20 +31,10 @@ func WorkspaceBuildParameter(p database.WorkspaceBuildParameter) codersdk.Worksp
 }
 
 func TemplateVersionParameter(param database.TemplateVersionParameter) (codersdk.TemplateVersionParameter, error) {
-	var protoOptions []*proto.RichParameterOption
-	err := json.Unmarshal(param.Options, &protoOptions)
+	options, err := templateVersionParameterOptions(param.Options)
 	if err != nil {
 		return codersdk.TemplateVersionParameter{}, err
 	}
-	options := make([]codersdk.TemplateVersionParameterOption, 0)
-	for _, option := range protoOptions {
-		options = append(options, codersdk.TemplateVersionParameterOption{
-			Name:        option.Name,
-			Description: option.Description,
-			Value:       option.Value,
-			Icon:        option.Icon,
-		})
-	}
 
 	descriptionPlaintext, err := parameter.Plaintext(param.Description)
 	if err != nil {
@@ -79,31 +71,6 @@ func TemplateVersionParameter(param database.TemplateVersionParameter) (codersdk
 	}, nil
 }
 
-func ProvisionerJobStatus(provisionerJob database.ProvisionerJob) codersdk.ProvisionerJobStatus {
-	// The case where jobs are hung is handled by the unhang package. We can't
-	// just return Failed here when it's hung because that doesn't reflect in
-	// the database.
-	switch {
-	case provisionerJob.CanceledAt.Valid:
-		if !provisionerJob.CompletedAt.Valid {
-			return codersdk.ProvisionerJobCanceling
-		}
-		if provisionerJob.Error.String == "" {
-			return codersdk.ProvisionerJobCanceled
-		}
-		return codersdk.ProvisionerJobFailed
-	case !provisionerJob.StartedAt.Valid:
-		return codersdk.ProvisionerJobPending
-	case provisionerJob.CompletedAt.Valid:
-		if provisionerJob.Error.String == "" {
-			return codersdk.ProvisionerJobSucceeded
-		}
-		return codersdk.ProvisionerJobFailed
-	default:
-		return codersdk.ProvisionerJobRunning
-	}
-}
-
 func User(user database.User, organizationIDs []uuid.UUID) codersdk.User {
 	convertedUser := codersdk.User{
 		ID:              user.ID,
@@ -132,3 +99,82 @@ func Role(role rbac.Role) codersdk.Role {
 		Name:        role.Name,
 	}
 }
+
+func TemplateInsightsParameters(parameterRows []database.GetTemplateParameterInsightsRow) ([]codersdk.TemplateParameterUsage, error) {
+	// Use a stable sort, similarly to how we would sort in the query, note that
+	// we don't sort in the query because order varies depending on the table
+	// collation.
+	//
+	// ORDER BY utp.name, utp.type, utp.display_name, utp.description, utp.options, wbp.value
+	slices.SortFunc(parameterRows, func(a, b database.GetTemplateParameterInsightsRow) int {
+		if a.Name != b.Name {
+			return strings.Compare(a.Name, b.Name)
+		}
+		if a.Type != b.Type {
+			return strings.Compare(a.Type, b.Type)
+		}
+		if a.DisplayName != b.DisplayName {
+			return strings.Compare(a.DisplayName, b.DisplayName)
+		}
+		if a.Description != b.Description {
+			return strings.Compare(a.Description, b.Description)
+		}
+		if string(a.Options) != string(b.Options) {
+			return strings.Compare(string(a.Options), string(b.Options))
+		}
+		return strings.Compare(a.Value, b.Value)
+	})
+
+	parametersUsage := []codersdk.TemplateParameterUsage{}
+	indexByNum := make(map[int64]int)
+	for _, param := range parameterRows {
+		if _, ok := indexByNum[param.Num]; !ok {
+			var opts []codersdk.TemplateVersionParameterOption
+			err := json.Unmarshal(param.Options, &opts)
+			if err != nil {
+				return nil, err
+			}
+
+			plaintextDescription, err := parameter.Plaintext(param.Description)
+			if err != nil {
+				return nil, err
+			}
+
+			parametersUsage = append(parametersUsage, codersdk.TemplateParameterUsage{
+				TemplateIDs: param.TemplateIDs,
+				Name:        param.Name,
+				Type:        param.Type,
+				DisplayName: param.DisplayName,
+				Description: plaintextDescription,
+				Options:     opts,
+			})
+			indexByNum[param.Num] = len(parametersUsage) - 1
+		}
+
+		i := indexByNum[param.Num]
+		parametersUsage[i].Values = append(parametersUsage[i].Values, codersdk.TemplateParameterValue{
+			Value: param.Value,
+			Count: param.Count,
+		})
+	}
+
+	return parametersUsage, nil
+}
+
+func templateVersionParameterOptions(rawOptions json.RawMessage) ([]codersdk.TemplateVersionParameterOption, error) {
+	var protoOptions []*proto.RichParameterOption
+	err := json.Unmarshal(rawOptions, &protoOptions)
+	if err != nil {
+		return nil, err
+	}
+	var options []codersdk.TemplateVersionParameterOption
+	for _, option := range protoOptions {
+		options = append(options, codersdk.TemplateVersionParameterOption{
+			Name:        option.Name,
+			Description: option.Description,
+			Value:       option.Value,
+			Icon:        option.Icon,
+		})
+	}
+	return options, nil
+}
diff --git a/coderd/database/db2sdk/db2sdk_test.go b/coderd/database/db2sdk/db2sdk_test.go
index 39020e64e9828..bfee2f52cbbd9 100644
--- a/coderd/database/db2sdk/db2sdk_test.go
+++ b/coderd/database/db2sdk/db2sdk_test.go
@@ -4,15 +4,20 @@ import (
 	"crypto/rand"
 	"database/sql"
 	"encoding/json"
+	"fmt"
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 func TestProvisionerJobStatus(t *testing.T) {
@@ -27,7 +32,7 @@ func TestProvisionerJobStatus(t *testing.T) {
 			name: "canceling",
 			job: database.ProvisionerJob{
 				CanceledAt: sql.NullTime{
-					Time:  database.Now().Add(-time.Minute),
+					Time:  dbtime.Now().Add(-time.Minute),
 					Valid: true,
 				},
 			},
@@ -37,11 +42,11 @@ func TestProvisionerJobStatus(t *testing.T) {
 			name: "canceled",
 			job: database.ProvisionerJob{
 				CanceledAt: sql.NullTime{
-					Time:  database.Now().Add(-time.Minute),
+					Time:  dbtime.Now().Add(-time.Minute),
 					Valid: true,
 				},
 				CompletedAt: sql.NullTime{
-					Time:  database.Now().Add(-30 * time.Second),
+					Time:  dbtime.Now().Add(-30 * time.Second),
 					Valid: true,
 				},
 			},
@@ -51,11 +56,11 @@ func TestProvisionerJobStatus(t *testing.T) {
 			name: "canceled_failed",
 			job: database.ProvisionerJob{
 				CanceledAt: sql.NullTime{
-					Time:  database.Now().Add(-time.Minute),
+					Time:  dbtime.Now().Add(-time.Minute),
 					Valid: true,
 				},
 				CompletedAt: sql.NullTime{
-					Time:  database.Now().Add(-30 * time.Second),
+					Time:  dbtime.Now().Add(-30 * time.Second),
 					Valid: true,
 				},
 				Error: sql.NullString{String: "badness", Valid: true},
@@ -71,11 +76,11 @@ func TestProvisionerJobStatus(t *testing.T) {
 			name: "succeeded",
 			job: database.ProvisionerJob{
 				StartedAt: sql.NullTime{
-					Time:  database.Now().Add(-time.Minute),
+					Time:  dbtime.Now().Add(-time.Minute),
 					Valid: true,
 				},
 				CompletedAt: sql.NullTime{
-					Time:  database.Now().Add(-30 * time.Second),
+					Time:  dbtime.Now().Add(-30 * time.Second),
 					Valid: true,
 				},
 			},
@@ -85,11 +90,11 @@ func TestProvisionerJobStatus(t *testing.T) {
 			name: "completed_failed",
 			job: database.ProvisionerJob{
 				StartedAt: sql.NullTime{
-					Time:  database.Now().Add(-time.Minute),
+					Time:  dbtime.Now().Add(-time.Minute),
 					Valid: true,
 				},
 				CompletedAt: sql.NullTime{
-					Time:  database.Now().Add(-30 * time.Second),
+					Time:  dbtime.Now().Add(-30 * time.Second),
 					Valid: true,
 				},
 				Error: sql.NullString{String: "badness", Valid: true},
@@ -100,20 +105,45 @@ func TestProvisionerJobStatus(t *testing.T) {
 			name: "updated",
 			job: database.ProvisionerJob{
 				StartedAt: sql.NullTime{
-					Time:  database.Now().Add(-time.Minute),
+					Time:  dbtime.Now().Add(-time.Minute),
 					Valid: true,
 				},
-				UpdatedAt: database.Now(),
+				UpdatedAt: dbtime.Now(),
 			},
 			status: codersdk.ProvisionerJobRunning,
 		},
 	}
 
-	for _, tc := range cases {
+	// Share db for all job inserts.
+	db, _ := dbtestutil.NewDB(t)
+	org := dbgen.Organization(t, db, database.Organization{})
+
+	for i, tc := range cases {
 		tc := tc
+		i := i
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			actual := db2sdk.ProvisionerJobStatus(tc.job)
+			// Populate standard fields
+			now := dbtime.Now().Round(time.Minute)
+			tc.job.ID = uuid.New()
+			tc.job.CreatedAt = now
+			tc.job.UpdatedAt = now
+			tc.job.InitiatorID = org.ID
+			tc.job.OrganizationID = org.ID
+			tc.job.Input = []byte("{}")
+			tc.job.Provisioner = database.ProvisionerTypeEcho
+			// Unique tags for each job.
+			tc.job.Tags = map[string]string{fmt.Sprintf("%d", i): "true"}
+
+			inserted := dbgen.ProvisionerJob(t, db, nil, tc.job)
+			// Make sure the inserted job has the right values.
+			require.Equal(t, tc.job.StartedAt.Time.UTC(), inserted.StartedAt.Time.UTC(), "started at")
+			require.Equal(t, tc.job.CompletedAt.Time.UTC(), inserted.CompletedAt.Time.UTC(), "completed at")
+			require.Equal(t, tc.job.CanceledAt.Time.UTC(), inserted.CanceledAt.Time.UTC(), "canceled at")
+			require.Equal(t, tc.job.Error, inserted.Error, "error")
+			require.Equal(t, tc.job.ErrorCode, inserted.ErrorCode, "error code")
+
+			actual := codersdk.ProvisionerJobStatus(inserted.JobStatus)
 			require.Equal(t, tc.status, actual)
 		})
 	}
diff --git a/coderd/database/db_test.go b/coderd/database/db_test.go
index c922da979f506..35e8012ff3eec 100644
--- a/coderd/database/db_test.go
+++ b/coderd/database/db_test.go
@@ -11,9 +11,10 @@ import (
 	"github.com/lib/pq"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/migrations"
-	"github.com/coder/coder/coderd/database/postgres"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/migrations"
+	"github.com/coder/coder/v2/coderd/database/postgres"
 )
 
 func TestSerializedRetry(t *testing.T) {
@@ -68,8 +69,8 @@ func TestNestedInTx(t *testing.T) {
 				Email:          "coder@coder.com",
 				Username:       "coder",
 				HashedPassword: []byte{},
-				CreatedAt:      database.Now(),
-				UpdatedAt:      database.Now(),
+				CreatedAt:      dbtime.Now(),
+				UpdatedAt:      dbtime.Now(),
 				RBACRoles:      []string{},
 				LoginType:      database.LoginTypeGithub,
 			})
diff --git a/coderd/database/dbauthz/accesscontrol.go b/coderd/database/dbauthz/accesscontrol.go
new file mode 100644
index 0000000000000..92417ff4114ba
--- /dev/null
+++ b/coderd/database/dbauthz/accesscontrol.go
@@ -0,0 +1,37 @@
+package dbauthz
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+
+	"github.com/coder/coder/v2/coderd/database"
+)
+
+// AccessControlStore fetches access control-related configuration
+// that is used when determining whether an actor is authorized
+// to interact with an RBAC object.
+type AccessControlStore interface {
+	GetTemplateAccessControl(t database.Template) TemplateAccessControl
+	SetTemplateAccessControl(ctx context.Context, store database.Store, id uuid.UUID, opts TemplateAccessControl) error
+}
+
+type TemplateAccessControl struct {
+	RequireActiveVersion bool
+}
+
+// AGPLTemplateAccessControlStore always returns the defaults for access control
+// settings.
+type AGPLTemplateAccessControlStore struct{}
+
+var _ AccessControlStore = AGPLTemplateAccessControlStore{}
+
+func (AGPLTemplateAccessControlStore) GetTemplateAccessControl(database.Template) TemplateAccessControl {
+	return TemplateAccessControl{
+		RequireActiveVersion: false,
+	}
+}
+
+func (AGPLTemplateAccessControlStore) SetTemplateAccessControl(context.Context, database.Store, uuid.UUID, TemplateAccessControl) error {
+	return nil
+}
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index ab865e2cc0f70..e9f4acc0a763a 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"sync/atomic"
 	"time"
 
 	"github.com/google/uuid"
@@ -15,9 +16,11 @@ import (
 	"github.com/open-policy-agent/opa/topdown"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/util/slice"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi/httpapiconstraints"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/util/slice"
 )
 
 var _ database.Store = (*querier)(nil)
@@ -35,10 +38,18 @@ type NotAuthorizedError struct {
 	Err error
 }
 
+// Ensure we implement the IsUnauthorized interface.
+var _ httpapiconstraints.IsUnauthorizedError = (*NotAuthorizedError)(nil)
+
 func (e NotAuthorizedError) Error() string {
 	return fmt.Sprintf("unauthorized: %s", e.Err.Error())
 }
 
+// IsUnauthorized implements the IsUnauthorized interface.
+func (NotAuthorizedError) IsUnauthorized() bool {
+	return true
+}
+
 // Unwrap will always unwrap to a sql.ErrNoRows so the API returns a 404.
 // So 'errors.Is(err, sql.ErrNoRows)' will always be true.
 func (e NotAuthorizedError) Unwrap() error {
@@ -91,9 +102,10 @@ type querier struct {
 	db   database.Store
 	auth rbac.Authorizer
 	log  slog.Logger
+	acs  *atomic.Pointer[AccessControlStore]
 }
 
-func New(db database.Store, authorizer rbac.Authorizer, logger slog.Logger) database.Store {
+func New(db database.Store, authorizer rbac.Authorizer, logger slog.Logger, acs *atomic.Pointer[AccessControlStore]) database.Store {
 	// If the underlying db store is already a querier, return it.
 	// Do not double wrap.
 	if slices.Contains(db.Wrappers(), wrapname) {
@@ -103,6 +115,7 @@ func New(db database.Store, authorizer rbac.Authorizer, logger slog.Logger) data
 		db:   db,
 		auth: authorizer,
 		log:  logger,
+		acs:  acs,
 	}
 }
 
@@ -497,7 +510,7 @@ func (q *querier) Ping(ctx context.Context) (time.Duration, error) {
 func (q *querier) InTx(function func(querier database.Store) error, txOpts *sql.TxOptions) error {
 	return q.db.InTx(func(tx database.Store) error {
 		// Wrap the transaction store in a querier.
-		wrapped := New(tx, q.auth, q.log)
+		wrapped := New(tx, q.auth, q.log, q.acs)
 		return function(wrapped)
 	}, txOpts)
 }
@@ -580,7 +593,7 @@ func (q *querier) SoftDeleteTemplateByID(ctx context.Context, id uuid.UUID) erro
 		return q.db.UpdateTemplateDeletedByID(ctx, database.UpdateTemplateDeletedByIDParams{
 			ID:        id,
 			Deleted:   true,
-			UpdatedAt: database.Now(),
+			UpdatedAt: dbtime.Now(),
 		})
 	}
 	return deleteQ(q.log, q.auth, q.db.GetTemplateByID, deleteF)(ctx, id)
@@ -647,6 +660,33 @@ func (q *querier) AcquireProvisionerJob(ctx context.Context, arg database.Acquir
 	return q.db.AcquireProvisionerJob(ctx, arg)
 }
 
+func (q *querier) ActivityBumpWorkspace(ctx context.Context, arg uuid.UUID) error {
+	fetch := func(ctx context.Context, arg uuid.UUID) (database.Workspace, error) {
+		return q.db.GetWorkspaceByID(ctx, arg)
+	}
+	return update(q.log, q.auth, fetch, q.db.ActivityBumpWorkspace)(ctx, arg)
+}
+
+func (q *querier) AllUserIDs(ctx context.Context) ([]uuid.UUID, error) {
+	// Although this technically only reads users, only system-related functions should be
+	// allowed to call this.
+	if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
+		return nil, err
+	}
+	return q.db.AllUserIDs(ctx)
+}
+
+func (q *querier) ArchiveUnusedTemplateVersions(ctx context.Context, arg database.ArchiveUnusedTemplateVersionsParams) ([]uuid.UUID, error) {
+	tpl, err := q.db.GetTemplateByID(ctx, arg.TemplateID)
+	if err != nil {
+		return nil, err
+	}
+	if err := q.authorizeContext(ctx, rbac.ActionUpdate, tpl); err != nil {
+		return nil, err
+	}
+	return q.db.ArchiveUnusedTemplateVersions(ctx, arg)
+}
+
 func (q *querier) CleanTailnetCoordinators(ctx context.Context) error {
 	if err := q.authorizeContext(ctx, rbac.ActionDelete, rbac.ResourceTailnetCoordinator); err != nil {
 		return err
@@ -668,6 +708,13 @@ func (q *querier) DeleteAPIKeysByUserID(ctx context.Context, userID uuid.UUID) e
 	return q.db.DeleteAPIKeysByUserID(ctx, userID)
 }
 
+func (q *querier) DeleteAllTailnetClientSubscriptions(ctx context.Context, arg database.DeleteAllTailnetClientSubscriptionsParams) error {
+	if err := q.authorizeContext(ctx, rbac.ActionDelete, rbac.ResourceTailnetCoordinator); err != nil {
+		return err
+	}
+	return q.db.DeleteAllTailnetClientSubscriptions(ctx, arg)
+}
+
 func (q *querier) DeleteApplicationConnectAPIKeysByUserID(ctx context.Context, userID uuid.UUID) error {
 	// TODO: This is not 100% correct because it omits apikey IDs.
 	err := q.authorizeContext(ctx, rbac.ActionDelete,
@@ -757,6 +804,13 @@ func (q *querier) DeleteTailnetClient(ctx context.Context, arg database.DeleteTa
 	return q.db.DeleteTailnetClient(ctx, arg)
 }
 
+func (q *querier) DeleteTailnetClientSubscription(ctx context.Context, arg database.DeleteTailnetClientSubscriptionParams) error {
+	if err := q.authorizeContext(ctx, rbac.ActionDelete, rbac.ResourceTailnetCoordinator); err != nil {
+		return err
+	}
+	return q.db.DeleteTailnetClientSubscription(ctx, arg)
+}
+
 func (q *querier) GetAPIKeyByID(ctx context.Context, id string) (database.APIKey, error) {
 	return fetch(q.log, q.auth, q.db.GetAPIKeyByID)(ctx, id)
 }
@@ -784,6 +838,14 @@ func (q *querier) GetActiveUserCount(ctx context.Context) (int64, error) {
 	return q.db.GetActiveUserCount(ctx)
 }
 
+func (q *querier) GetActiveWorkspaceBuildsByTemplateID(ctx context.Context, templateID uuid.UUID) ([]database.WorkspaceBuild, error) {
+	// This is a system-only function.
+	if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
+		return []database.WorkspaceBuild{}, err
+	}
+	return q.db.GetActiveWorkspaceBuildsByTemplateID(ctx, templateID)
+}
+
 func (q *querier) GetAllTailnetAgents(ctx context.Context) ([]database.TailnetAgent, error) {
 	if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceTailnetCoordinator); err != nil {
 		return []database.TailnetAgent{}, err
@@ -791,9 +853,9 @@ func (q *querier) GetAllTailnetAgents(ctx context.Context) ([]database.TailnetAg
 	return q.db.GetAllTailnetAgents(ctx)
 }
 
-func (q *querier) GetAllTailnetClients(ctx context.Context) ([]database.TailnetClient, error) {
+func (q *querier) GetAllTailnetClients(ctx context.Context) ([]database.GetAllTailnetClientsRow, error) {
 	if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceTailnetCoordinator); err != nil {
-		return []database.TailnetClient{}, err
+		return []database.GetAllTailnetClientsRow{}, err
 	}
 	return q.db.GetAllTailnetClients(ctx)
 }
@@ -803,6 +865,11 @@ func (q *querier) GetAppSecurityKey(ctx context.Context) (string, error) {
 	return q.db.GetAppSecurityKey(ctx)
 }
 
+func (q *querier) GetApplicationName(ctx context.Context) (string, error) {
+	// No authz checks
+	return q.db.GetApplicationName(ctx)
+}
+
 func (q *querier) GetAuditLogsOffset(ctx context.Context, arg database.GetAuditLogsOffsetParams) ([]database.GetAuditLogsOffsetRow, error) {
 	// To optimize audit logs, we only check the global audit log permission once.
 	// This is because we expect a large unbounded set of audit logs, and applying a SQL
@@ -820,6 +887,13 @@ func (q *querier) GetAuthorizationUserRoles(ctx context.Context, userID uuid.UUI
 	return q.db.GetAuthorizationUserRoles(ctx, userID)
 }
 
+func (q *querier) GetDBCryptKeys(ctx context.Context) ([]database.DBCryptKey, error) {
+	if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
+		return nil, err
+	}
+	return q.db.GetDBCryptKeys(ctx)
+}
+
 func (q *querier) GetDERPMeshKey(ctx context.Context) (string, error) {
 	if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
 		return "", err
@@ -853,6 +927,17 @@ func (q *querier) GetDeploymentWorkspaceStats(ctx context.Context) (database.Get
 	return q.db.GetDeploymentWorkspaceStats(ctx)
 }
 
+func (q *querier) GetExternalAuthLink(ctx context.Context, arg database.GetExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+	return fetch(q.log, q.auth, q.db.GetExternalAuthLink)(ctx, arg)
+}
+
+func (q *querier) GetExternalAuthLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.ExternalAuthLink, error) {
+	if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
+		return nil, err
+	}
+	return q.db.GetExternalAuthLinksByUserID(ctx, userID)
+}
+
 func (q *querier) GetFileByHashAndCreator(ctx context.Context, arg database.GetFileByHashAndCreatorParams) (database.File, error) {
 	file, err := q.db.GetFileByHashAndCreator(ctx, arg)
 	if err != nil {
@@ -892,10 +977,6 @@ func (q *querier) GetFileTemplates(ctx context.Context, fileID uuid.UUID) ([]dat
 	return q.db.GetFileTemplates(ctx, fileID)
 }
 
-func (q *querier) GetGitAuthLink(ctx context.Context, arg database.GetGitAuthLinkParams) (database.GitAuthLink, error) {
-	return fetch(q.log, q.auth, q.db.GetGitAuthLink)(ctx, arg)
-}
-
 func (q *querier) GetGitSSHKey(ctx context.Context, userID uuid.UUID) (database.GitSSHKey, error) {
 	return fetch(q.log, q.auth, q.db.GetGitSSHKey)(ctx, userID)
 }
@@ -908,11 +989,11 @@ func (q *querier) GetGroupByOrgAndName(ctx context.Context, arg database.GetGrou
 	return fetch(q.log, q.auth, q.db.GetGroupByOrgAndName)(ctx, arg)
 }
 
-func (q *querier) GetGroupMembers(ctx context.Context, groupID uuid.UUID) ([]database.User, error) {
-	if _, err := q.GetGroupByID(ctx, groupID); err != nil { // AuthZ check
+func (q *querier) GetGroupMembers(ctx context.Context, id uuid.UUID) ([]database.User, error) {
+	if _, err := q.GetGroupByID(ctx, id); err != nil { // AuthZ check
 		return nil, err
 	}
-	return q.db.GetGroupMembers(ctx, groupID)
+	return q.db.GetGroupMembers(ctx, id)
 }
 
 func (q *querier) GetGroupsByOrganizationID(ctx context.Context, organizationID uuid.UUID) ([]database.Group, error) {
@@ -1165,6 +1246,25 @@ func (q *querier) GetTailnetClientsForAgent(ctx context.Context, agentID uuid.UU
 	return q.db.GetTailnetClientsForAgent(ctx, agentID)
 }
 
+func (q *querier) GetTemplateAppInsights(ctx context.Context, arg database.GetTemplateAppInsightsParams) ([]database.GetTemplateAppInsightsRow, error) {
+	for _, templateID := range arg.TemplateIDs {
+		template, err := q.db.GetTemplateByID(ctx, templateID)
+		if err != nil {
+			return nil, err
+		}
+
+		if err := q.authorizeContext(ctx, rbac.ActionUpdate, template); err != nil {
+			return nil, err
+		}
+	}
+	if len(arg.TemplateIDs) == 0 {
+		if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceTemplate.All()); err != nil {
+			return nil, err
+		}
+	}
+	return q.db.GetTemplateAppInsights(ctx, arg)
+}
+
 // Only used by metrics cache.
 func (q *querier) GetTemplateAverageBuildTime(ctx context.Context, arg database.GetTemplateAverageBuildTimeParams) (database.GetTemplateAverageBuildTimeRow, error) {
 	if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
@@ -1189,42 +1289,49 @@ func (q *querier) GetTemplateDAUs(ctx context.Context, arg database.GetTemplateD
 	return q.db.GetTemplateDAUs(ctx, arg)
 }
 
-func (q *querier) GetTemplateDailyInsights(ctx context.Context, arg database.GetTemplateDailyInsightsParams) ([]database.GetTemplateDailyInsightsRow, error) {
+func (q *querier) GetTemplateInsights(ctx context.Context, arg database.GetTemplateInsightsParams) (database.GetTemplateInsightsRow, error) {
 	for _, templateID := range arg.TemplateIDs {
 		template, err := q.db.GetTemplateByID(ctx, templateID)
 		if err != nil {
-			return nil, err
+			return database.GetTemplateInsightsRow{}, err
 		}
 
 		if err := q.authorizeContext(ctx, rbac.ActionUpdate, template); err != nil {
-			return nil, err
+			return database.GetTemplateInsightsRow{}, err
 		}
 	}
 	if len(arg.TemplateIDs) == 0 {
 		if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceTemplate.All()); err != nil {
-			return nil, err
+			return database.GetTemplateInsightsRow{}, err
 		}
 	}
-	return q.db.GetTemplateDailyInsights(ctx, arg)
+	return q.db.GetTemplateInsights(ctx, arg)
 }
 
-func (q *querier) GetTemplateInsights(ctx context.Context, arg database.GetTemplateInsightsParams) (database.GetTemplateInsightsRow, error) {
+func (q *querier) GetTemplateInsightsByInterval(ctx context.Context, arg database.GetTemplateInsightsByIntervalParams) ([]database.GetTemplateInsightsByIntervalRow, error) {
 	for _, templateID := range arg.TemplateIDs {
 		template, err := q.db.GetTemplateByID(ctx, templateID)
 		if err != nil {
-			return database.GetTemplateInsightsRow{}, err
+			return nil, err
 		}
 
 		if err := q.authorizeContext(ctx, rbac.ActionUpdate, template); err != nil {
-			return database.GetTemplateInsightsRow{}, err
+			return nil, err
 		}
 	}
 	if len(arg.TemplateIDs) == 0 {
 		if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceTemplate.All()); err != nil {
-			return database.GetTemplateInsightsRow{}, err
+			return nil, err
 		}
 	}
-	return q.db.GetTemplateInsights(ctx, arg)
+	return q.db.GetTemplateInsightsByInterval(ctx, arg)
+}
+
+func (q *querier) GetTemplateInsightsByTemplate(ctx context.Context, arg database.GetTemplateInsightsByTemplateParams) ([]database.GetTemplateInsightsByTemplateRow, error) {
+	if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceTemplate.All()); err != nil {
+		return nil, err
+	}
+	return q.db.GetTemplateInsightsByTemplate(ctx, arg)
 }
 
 func (q *querier) GetTemplateParameterInsights(ctx context.Context, arg database.GetTemplateParameterInsightsParams) ([]database.GetTemplateParameterInsightsRow, error) {
@@ -1397,6 +1504,25 @@ func (q *querier) GetUnexpiredLicenses(ctx context.Context) ([]database.License,
 	return q.db.GetUnexpiredLicenses(ctx)
 }
 
+func (q *querier) GetUserActivityInsights(ctx context.Context, arg database.GetUserActivityInsightsParams) ([]database.GetUserActivityInsightsRow, error) {
+	for _, templateID := range arg.TemplateIDs {
+		template, err := q.db.GetTemplateByID(ctx, templateID)
+		if err != nil {
+			return nil, err
+		}
+
+		if err := q.authorizeContext(ctx, rbac.ActionUpdate, template); err != nil {
+			return nil, err
+		}
+	}
+	if len(arg.TemplateIDs) == 0 {
+		if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceTemplate.All()); err != nil {
+			return nil, err
+		}
+	}
+	return q.db.GetUserActivityInsights(ctx, arg)
+}
+
 func (q *querier) GetUserByEmailOrUsername(ctx context.Context, arg database.GetUserByEmailOrUsernameParams) (database.User, error) {
 	return fetch(q.log, q.auth, q.db.GetUserByEmailOrUsername)(ctx, arg)
 }
@@ -1445,6 +1571,13 @@ func (q *querier) GetUserLinkByUserIDLoginType(ctx context.Context, arg database
 	return q.db.GetUserLinkByUserIDLoginType(ctx, arg)
 }
 
+func (q *querier) GetUserLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.UserLink, error) {
+	if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
+		return nil, err
+	}
+	return q.db.GetUserLinksByUserID(ctx, userID)
+}
+
 func (q *querier) GetUsers(ctx context.Context, arg database.GetUsersParams) ([]database.GetUsersRow, error) {
 	// This does the filtering in SQL.
 	prep, err := prepareSQLFilter(ctx, q.auth, rbac.ActionRead, rbac.ResourceUser.Type)
@@ -1466,13 +1599,12 @@ func (q *querier) GetUsersByIDs(ctx context.Context, ids []uuid.UUID) ([]databas
 	return q.db.GetUsersByIDs(ctx, ids)
 }
 
-// GetWorkspaceAgentByAuthToken is used in http middleware to get the workspace agent.
-// This should only be used by a system user in that middleware.
-func (q *querier) GetWorkspaceAgentByAuthToken(ctx context.Context, authToken uuid.UUID) (database.WorkspaceAgent, error) {
+func (q *querier) GetWorkspaceAgentAndOwnerByAuthToken(ctx context.Context, authToken uuid.UUID) (database.GetWorkspaceAgentAndOwnerByAuthTokenRow, error) {
+	// This is a system function
 	if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
-		return database.WorkspaceAgent{}, err
+		return database.GetWorkspaceAgentAndOwnerByAuthTokenRow{}, err
 	}
-	return q.db.GetWorkspaceAgentByAuthToken(ctx, authToken)
+	return q.db.GetWorkspaceAgentAndOwnerByAuthToken(ctx, authToken)
 }
 
 func (q *querier) GetWorkspaceAgentByID(ctx context.Context, id uuid.UUID) (database.WorkspaceAgent, error) {
@@ -1506,6 +1638,13 @@ func (q *querier) GetWorkspaceAgentLifecycleStateByID(ctx context.Context, id uu
 	return q.db.GetWorkspaceAgentLifecycleStateByID(ctx, id)
 }
 
+func (q *querier) GetWorkspaceAgentLogSourcesByAgentIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceAgentLogSource, error) {
+	if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
+		return nil, err
+	}
+	return q.db.GetWorkspaceAgentLogSourcesByAgentIDs(ctx, ids)
+}
+
 func (q *querier) GetWorkspaceAgentLogsAfter(ctx context.Context, arg database.GetWorkspaceAgentLogsAfterParams) ([]database.WorkspaceAgentLog, error) {
 	_, err := q.GetWorkspaceAgentByID(ctx, arg.AgentID)
 	if err != nil {
@@ -1514,8 +1653,8 @@ func (q *querier) GetWorkspaceAgentLogsAfter(ctx context.Context, arg database.G
 	return q.db.GetWorkspaceAgentLogsAfter(ctx, arg)
 }
 
-func (q *querier) GetWorkspaceAgentMetadata(ctx context.Context, workspaceAgentID uuid.UUID) ([]database.WorkspaceAgentMetadatum, error) {
-	workspace, err := q.db.GetWorkspaceByAgentID(ctx, workspaceAgentID)
+func (q *querier) GetWorkspaceAgentMetadata(ctx context.Context, arg database.GetWorkspaceAgentMetadataParams) ([]database.WorkspaceAgentMetadatum, error) {
+	workspace, err := q.db.GetWorkspaceByAgentID(ctx, arg.WorkspaceAgentID)
 	if err != nil {
 		return nil, err
 	}
@@ -1525,7 +1664,14 @@ func (q *querier) GetWorkspaceAgentMetadata(ctx context.Context, workspaceAgentI
 		return nil, err
 	}
 
-	return q.db.GetWorkspaceAgentMetadata(ctx, workspaceAgentID)
+	return q.db.GetWorkspaceAgentMetadata(ctx, arg)
+}
+
+func (q *querier) GetWorkspaceAgentScriptsByAgentIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceAgentScript, error) {
+	if err := q.authorizeContext(ctx, rbac.ActionRead, rbac.ResourceSystem); err != nil {
+		return nil, err
+	}
+	return q.db.GetWorkspaceAgentScriptsByAgentIDs(ctx, ids)
 }
 
 func (q *querier) GetWorkspaceAgentStats(ctx context.Context, createdAfter time.Time) ([]database.GetWorkspaceAgentStatsRow, error) {
@@ -1809,6 +1955,13 @@ func (q *querier) InsertAuditLog(ctx context.Context, arg database.InsertAuditLo
 	return insert(q.log, q.auth, rbac.ResourceAuditLog, q.db.InsertAuditLog)(ctx, arg)
 }
 
+func (q *querier) InsertDBCryptKey(ctx context.Context, arg database.InsertDBCryptKeyParams) error {
+	if err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceSystem); err != nil {
+		return err
+	}
+	return q.db.InsertDBCryptKey(ctx, arg)
+}
+
 func (q *querier) InsertDERPMeshKey(ctx context.Context, value string) error {
 	if err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceSystem); err != nil {
 		return err
@@ -1823,12 +1976,12 @@ func (q *querier) InsertDeploymentID(ctx context.Context, value string) error {
 	return q.db.InsertDeploymentID(ctx, value)
 }
 
-func (q *querier) InsertFile(ctx context.Context, arg database.InsertFileParams) (database.File, error) {
-	return insert(q.log, q.auth, rbac.ResourceFile.WithOwner(arg.CreatedBy.String()), q.db.InsertFile)(ctx, arg)
+func (q *querier) InsertExternalAuthLink(ctx context.Context, arg database.InsertExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+	return insert(q.log, q.auth, rbac.ResourceUserData.WithOwner(arg.UserID.String()).WithID(arg.UserID), q.db.InsertExternalAuthLink)(ctx, arg)
 }
 
-func (q *querier) InsertGitAuthLink(ctx context.Context, arg database.InsertGitAuthLinkParams) (database.GitAuthLink, error) {
-	return insert(q.log, q.auth, rbac.ResourceUserData.WithOwner(arg.UserID.String()).WithID(arg.UserID), q.db.InsertGitAuthLink)(ctx, arg)
+func (q *querier) InsertFile(ctx context.Context, arg database.InsertFileParams) (database.File, error) {
+	return insert(q.log, q.auth, rbac.ResourceFile.WithOwner(arg.CreatedBy.String()), q.db.InsertFile)(ctx, arg)
 }
 
 func (q *querier) InsertGitSSHKey(ctx context.Context, arg database.InsertGitSSHKeyParams) (database.GitSSHKey, error) {
@@ -1853,6 +2006,13 @@ func (q *querier) InsertLicense(ctx context.Context, arg database.InsertLicenseP
 	return q.db.InsertLicense(ctx, arg)
 }
 
+func (q *querier) InsertMissingGroups(ctx context.Context, arg database.InsertMissingGroupsParams) ([]database.Group, error) {
+	if err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceSystem); err != nil {
+		return nil, err
+	}
+	return q.db.InsertMissingGroups(ctx, arg)
+}
+
 func (q *querier) InsertOrganization(ctx context.Context, arg database.InsertOrganizationParams) (database.Organization, error) {
 	return insert(q.log, q.auth, rbac.ResourceOrganization, q.db.InsertOrganization)(ctx, arg)
 }
@@ -1979,8 +2139,6 @@ func (q *querier) InsertWorkspace(ctx context.Context, arg database.InsertWorksp
 	return insert(q.log, q.auth, obj, q.db.InsertWorkspace)(ctx, arg)
 }
 
-// Provisionerd server functions
-
 func (q *querier) InsertWorkspaceAgent(ctx context.Context, arg database.InsertWorkspaceAgentParams) (database.WorkspaceAgent, error) {
 	if err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceSystem); err != nil {
 		return database.WorkspaceAgent{}, err
@@ -1988,6 +2146,10 @@ func (q *querier) InsertWorkspaceAgent(ctx context.Context, arg database.InsertW
 	return q.db.InsertWorkspaceAgent(ctx, arg)
 }
 
+func (q *querier) InsertWorkspaceAgentLogSources(ctx context.Context, arg database.InsertWorkspaceAgentLogSourcesParams) ([]database.WorkspaceAgentLogSource, error) {
+	return q.db.InsertWorkspaceAgentLogSources(ctx, arg)
+}
+
 func (q *querier) InsertWorkspaceAgentLogs(ctx context.Context, arg database.InsertWorkspaceAgentLogsParams) ([]database.WorkspaceAgentLog, error) {
 	return q.db.InsertWorkspaceAgentLogs(ctx, arg)
 }
@@ -2002,6 +2164,13 @@ func (q *querier) InsertWorkspaceAgentMetadata(ctx context.Context, arg database
 	return q.db.InsertWorkspaceAgentMetadata(ctx, arg)
 }
 
+func (q *querier) InsertWorkspaceAgentScripts(ctx context.Context, arg database.InsertWorkspaceAgentScriptsParams) ([]database.WorkspaceAgentScript, error) {
+	if err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceSystem); err != nil {
+		return []database.WorkspaceAgentScript{}, err
+	}
+	return q.db.InsertWorkspaceAgentScripts(ctx, arg)
+}
+
 func (q *querier) InsertWorkspaceAgentStat(ctx context.Context, arg database.InsertWorkspaceAgentStatParams) (database.WorkspaceAgentStat, error) {
 	// TODO: This is a workspace agent operation. Should users be able to query this?
 	// Not really sure what this is for.
@@ -2016,6 +2185,14 @@ func (q *querier) InsertWorkspaceAgentStat(ctx context.Context, arg database.Ins
 	return q.db.InsertWorkspaceAgentStat(ctx, arg)
 }
 
+func (q *querier) InsertWorkspaceAgentStats(ctx context.Context, arg database.InsertWorkspaceAgentStatsParams) error {
+	if err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceSystem); err != nil {
+		return err
+	}
+
+	return q.db.InsertWorkspaceAgentStats(ctx, arg)
+}
+
 func (q *querier) InsertWorkspaceApp(ctx context.Context, arg database.InsertWorkspaceAppParams) (database.WorkspaceApp, error) {
 	if err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceSystem); err != nil {
 		return database.WorkspaceApp{}, err
@@ -2023,10 +2200,17 @@ func (q *querier) InsertWorkspaceApp(ctx context.Context, arg database.InsertWor
 	return q.db.InsertWorkspaceApp(ctx, arg)
 }
 
+func (q *querier) InsertWorkspaceAppStats(ctx context.Context, arg database.InsertWorkspaceAppStatsParams) error {
+	if err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceSystem); err != nil {
+		return err
+	}
+	return q.db.InsertWorkspaceAppStats(ctx, arg)
+}
+
 func (q *querier) InsertWorkspaceBuild(ctx context.Context, arg database.InsertWorkspaceBuildParams) error {
 	w, err := q.db.GetWorkspaceByID(ctx, arg.WorkspaceID)
 	if err != nil {
-		return err
+		return xerrors.Errorf("get workspace by id: %w", err)
 	}
 
 	var action rbac.Action = rbac.ActionUpdate
@@ -2035,7 +2219,28 @@ func (q *querier) InsertWorkspaceBuild(ctx context.Context, arg database.InsertW
 	}
 
 	if err = q.authorizeContext(ctx, action, w.WorkspaceBuildRBAC(arg.Transition)); err != nil {
-		return err
+		return xerrors.Errorf("authorize context: %w", err)
+	}
+
+	// If we're starting a workspace we need to check the template.
+	if arg.Transition == database.WorkspaceTransitionStart {
+		t, err := q.db.GetTemplateByID(ctx, w.TemplateID)
+		if err != nil {
+			return xerrors.Errorf("get template by id: %w", err)
+		}
+
+		accessControl := (*q.acs.Load()).GetTemplateAccessControl(t)
+
+		// If the template requires the active version we need to check if
+		// the user is a template admin. If they aren't and are attempting
+		// to use a non-active version then we must fail the request.
+		if accessControl.RequireActiveVersion {
+			if arg.TemplateVersionID != t.ActiveVersionID {
+				if err = q.authorizeContext(ctx, rbac.ActionUpdate, t); err != nil {
+					return xerrors.Errorf("cannot use non-active version: %w", err)
+				}
+			}
+		}
 	}
 
 	return q.db.InsertWorkspaceBuild(ctx, arg)
@@ -2086,10 +2291,33 @@ func (q *querier) RegisterWorkspaceProxy(ctx context.Context, arg database.Regis
 	return updateWithReturn(q.log, q.auth, fetch, q.db.RegisterWorkspaceProxy)(ctx, arg)
 }
 
+func (q *querier) RevokeDBCryptKey(ctx context.Context, activeKeyDigest string) error {
+	if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceSystem); err != nil {
+		return err
+	}
+	return q.db.RevokeDBCryptKey(ctx, activeKeyDigest)
+}
+
 func (q *querier) TryAcquireLock(ctx context.Context, id int64) (bool, error) {
 	return q.db.TryAcquireLock(ctx, id)
 }
 
+func (q *querier) UnarchiveTemplateVersion(ctx context.Context, arg database.UnarchiveTemplateVersionParams) error {
+	v, err := q.db.GetTemplateVersionByID(ctx, arg.TemplateVersionID)
+	if err != nil {
+		return err
+	}
+
+	tpl, err := q.db.GetTemplateByID(ctx, v.TemplateID.UUID)
+	if err != nil {
+		return err
+	}
+	if err := q.authorizeContext(ctx, rbac.ActionUpdate, tpl); err != nil {
+		return err
+	}
+	return q.db.UnarchiveTemplateVersion(ctx, arg)
+}
+
 func (q *querier) UpdateAPIKeyByID(ctx context.Context, arg database.UpdateAPIKeyByIDParams) error {
 	fetch := func(ctx context.Context, arg database.UpdateAPIKeyByIDParams) (database.APIKey, error) {
 		return q.db.GetAPIKeyByID(ctx, arg.ID)
@@ -2097,11 +2325,11 @@ func (q *querier) UpdateAPIKeyByID(ctx context.Context, arg database.UpdateAPIKe
 	return update(q.log, q.auth, fetch, q.db.UpdateAPIKeyByID)(ctx, arg)
 }
 
-func (q *querier) UpdateGitAuthLink(ctx context.Context, arg database.UpdateGitAuthLinkParams) (database.GitAuthLink, error) {
-	fetch := func(ctx context.Context, arg database.UpdateGitAuthLinkParams) (database.GitAuthLink, error) {
-		return q.db.GetGitAuthLink(ctx, database.GetGitAuthLinkParams{UserID: arg.UserID, ProviderID: arg.ProviderID})
+func (q *querier) UpdateExternalAuthLink(ctx context.Context, arg database.UpdateExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+	fetch := func(ctx context.Context, arg database.UpdateExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+		return q.db.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{UserID: arg.UserID, ProviderID: arg.ProviderID})
 	}
-	return updateWithReturn(q.log, q.auth, fetch, q.db.UpdateGitAuthLink)(ctx, arg)
+	return updateWithReturn(q.log, q.auth, fetch, q.db.UpdateExternalAuthLink)(ctx, arg)
 }
 
 func (q *querier) UpdateGitSSHKey(ctx context.Context, arg database.UpdateGitSSHKeyParams) (database.GitSSHKey, error) {
@@ -2245,6 +2473,13 @@ func (q *querier) UpdateTemplateACLByID(ctx context.Context, arg database.Update
 	return fetchAndExec(q.log, q.auth, rbac.ActionCreate, fetch, q.db.UpdateTemplateACLByID)(ctx, arg)
 }
 
+func (q *querier) UpdateTemplateAccessControlByID(ctx context.Context, arg database.UpdateTemplateAccessControlByIDParams) error {
+	fetch := func(ctx context.Context, arg database.UpdateTemplateAccessControlByIDParams) (database.Template, error) {
+		return q.db.GetTemplateByID(ctx, arg.ID)
+	}
+	return update(q.log, q.auth, fetch, q.db.UpdateTemplateAccessControlByID)(ctx, arg)
+}
+
 func (q *querier) UpdateTemplateActiveVersionByID(ctx context.Context, arg database.UpdateTemplateActiveVersionByIDParams) error {
 	fetch := func(ctx context.Context, arg database.UpdateTemplateActiveVersionByIDParams) (database.Template, error) {
 		return q.db.GetTemplateByID(ctx, arg.ID)
@@ -2315,8 +2550,8 @@ func (q *querier) UpdateTemplateVersionDescriptionByJobID(ctx context.Context, a
 	return q.db.UpdateTemplateVersionDescriptionByJobID(ctx, arg)
 }
 
-func (q *querier) UpdateTemplateVersionGitAuthProvidersByJobID(ctx context.Context, arg database.UpdateTemplateVersionGitAuthProvidersByJobIDParams) error {
-	// An actor is allowed to update the template version git auth providers if they are authorized to update the template.
+func (q *querier) UpdateTemplateVersionExternalAuthProvidersByJobID(ctx context.Context, arg database.UpdateTemplateVersionExternalAuthProvidersByJobIDParams) error {
+	// An actor is allowed to update the template version external auth providers if they are authorized to update the template.
 	tv, err := q.db.GetTemplateVersionByJobID(ctx, arg.JobID)
 	if err != nil {
 		return err
@@ -2334,7 +2569,15 @@ func (q *querier) UpdateTemplateVersionGitAuthProvidersByJobID(ctx context.Conte
 	if err := q.authorizeContext(ctx, rbac.ActionUpdate, obj); err != nil {
 		return err
 	}
-	return q.db.UpdateTemplateVersionGitAuthProvidersByJobID(ctx, arg)
+	return q.db.UpdateTemplateVersionExternalAuthProvidersByJobID(ctx, arg)
+}
+
+func (q *querier) UpdateTemplateWorkspacesLastUsedAt(ctx context.Context, arg database.UpdateTemplateWorkspacesLastUsedAtParams) error {
+	fetch := func(ctx context.Context, arg database.UpdateTemplateWorkspacesLastUsedAtParams) (database.Template, error) {
+		return q.db.GetTemplateByID(ctx, arg.TemplateID)
+	}
+
+	return fetchAndExec(q.log, q.auth, rbac.ActionUpdate, fetch, q.db.UpdateTemplateWorkspacesLastUsedAt)(ctx, arg)
 }
 
 // UpdateUserDeletedByID
@@ -2537,6 +2780,19 @@ func (q *querier) UpdateWorkspaceAppHealthByID(ctx context.Context, arg database
 	return q.db.UpdateWorkspaceAppHealthByID(ctx, arg)
 }
 
+func (q *querier) UpdateWorkspaceAutomaticUpdates(ctx context.Context, arg database.UpdateWorkspaceAutomaticUpdatesParams) error {
+	workspace, err := q.db.GetWorkspaceByID(ctx, arg.ID)
+	if err != nil {
+		return err
+	}
+
+	err = q.authorizeContext(ctx, rbac.ActionUpdate, workspace.RBACObject())
+	if err != nil {
+		return err
+	}
+	return q.db.UpdateWorkspaceAutomaticUpdates(ctx, arg)
+}
+
 func (q *querier) UpdateWorkspaceAutostart(ctx context.Context, arg database.UpdateWorkspaceAutostartParams) error {
 	fetch := func(ctx context.Context, arg database.UpdateWorkspaceAutostartParams) (database.Workspace, error) {
 		return q.db.GetWorkspaceByID(ctx, arg.ID)
@@ -2544,7 +2800,15 @@ func (q *querier) UpdateWorkspaceAutostart(ctx context.Context, arg database.Upd
 	return update(q.log, q.auth, fetch, q.db.UpdateWorkspaceAutostart)(ctx, arg)
 }
 
-func (q *querier) UpdateWorkspaceBuildByID(ctx context.Context, arg database.UpdateWorkspaceBuildByIDParams) error {
+// UpdateWorkspaceBuildCostByID is used by the provisioning system to update the cost of a workspace build.
+func (q *querier) UpdateWorkspaceBuildCostByID(ctx context.Context, arg database.UpdateWorkspaceBuildCostByIDParams) error {
+	if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceSystem); err != nil {
+		return err
+	}
+	return q.db.UpdateWorkspaceBuildCostByID(ctx, arg)
+}
+
+func (q *querier) UpdateWorkspaceBuildDeadlineByID(ctx context.Context, arg database.UpdateWorkspaceBuildDeadlineByIDParams) error {
 	build, err := q.db.GetWorkspaceBuildByID(ctx, arg.ID)
 	if err != nil {
 		return err
@@ -2554,20 +2818,19 @@ func (q *querier) UpdateWorkspaceBuildByID(ctx context.Context, arg database.Upd
 	if err != nil {
 		return err
 	}
+
 	err = q.authorizeContext(ctx, rbac.ActionUpdate, workspace.RBACObject())
 	if err != nil {
 		return err
 	}
-
-	return q.db.UpdateWorkspaceBuildByID(ctx, arg)
+	return q.db.UpdateWorkspaceBuildDeadlineByID(ctx, arg)
 }
 
-// UpdateWorkspaceBuildCostByID is used by the provisioning system to update the cost of a workspace build.
-func (q *querier) UpdateWorkspaceBuildCostByID(ctx context.Context, arg database.UpdateWorkspaceBuildCostByIDParams) error {
+func (q *querier) UpdateWorkspaceBuildProvisionerStateByID(ctx context.Context, arg database.UpdateWorkspaceBuildProvisionerStateByIDParams) error {
 	if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceSystem); err != nil {
 		return err
 	}
-	return q.db.UpdateWorkspaceBuildCostByID(ctx, arg)
+	return q.db.UpdateWorkspaceBuildProvisionerStateByID(ctx, arg)
 }
 
 // Deprecated: Use SoftDeleteWorkspaceByID
@@ -2580,18 +2843,18 @@ func (q *querier) UpdateWorkspaceDeletedByID(ctx context.Context, arg database.U
 	return deleteQ(q.log, q.auth, fetch, q.db.UpdateWorkspaceDeletedByID)(ctx, arg)
 }
 
-func (q *querier) UpdateWorkspaceLastUsedAt(ctx context.Context, arg database.UpdateWorkspaceLastUsedAtParams) error {
-	fetch := func(ctx context.Context, arg database.UpdateWorkspaceLastUsedAtParams) (database.Workspace, error) {
+func (q *querier) UpdateWorkspaceDormantDeletingAt(ctx context.Context, arg database.UpdateWorkspaceDormantDeletingAtParams) (database.Workspace, error) {
+	fetch := func(ctx context.Context, arg database.UpdateWorkspaceDormantDeletingAtParams) (database.Workspace, error) {
 		return q.db.GetWorkspaceByID(ctx, arg.ID)
 	}
-	return update(q.log, q.auth, fetch, q.db.UpdateWorkspaceLastUsedAt)(ctx, arg)
+	return updateWithReturn(q.log, q.auth, fetch, q.db.UpdateWorkspaceDormantDeletingAt)(ctx, arg)
 }
 
-func (q *querier) UpdateWorkspaceLockedDeletingAt(ctx context.Context, arg database.UpdateWorkspaceLockedDeletingAtParams) error {
-	fetch := func(ctx context.Context, arg database.UpdateWorkspaceLockedDeletingAtParams) (database.Workspace, error) {
+func (q *querier) UpdateWorkspaceLastUsedAt(ctx context.Context, arg database.UpdateWorkspaceLastUsedAtParams) error {
+	fetch := func(ctx context.Context, arg database.UpdateWorkspaceLastUsedAtParams) (database.Workspace, error) {
 		return q.db.GetWorkspaceByID(ctx, arg.ID)
 	}
-	return update(q.log, q.auth, fetch, q.db.UpdateWorkspaceLockedDeletingAt)(ctx, arg)
+	return update(q.log, q.auth, fetch, q.db.UpdateWorkspaceLastUsedAt)(ctx, arg)
 }
 
 func (q *querier) UpdateWorkspaceProxy(ctx context.Context, arg database.UpdateWorkspaceProxyParams) (database.WorkspaceProxy, error) {
@@ -2615,12 +2878,12 @@ func (q *querier) UpdateWorkspaceTTL(ctx context.Context, arg database.UpdateWor
 	return update(q.log, q.auth, fetch, q.db.UpdateWorkspaceTTL)(ctx, arg)
 }
 
-func (q *querier) UpdateWorkspacesDeletingAtByTemplateID(ctx context.Context, arg database.UpdateWorkspacesDeletingAtByTemplateIDParams) error {
-	fetch := func(ctx context.Context, arg database.UpdateWorkspacesDeletingAtByTemplateIDParams) (database.Template, error) {
+func (q *querier) UpdateWorkspacesDormantDeletingAtByTemplateID(ctx context.Context, arg database.UpdateWorkspacesDormantDeletingAtByTemplateIDParams) error {
+	fetch := func(ctx context.Context, arg database.UpdateWorkspacesDormantDeletingAtByTemplateIDParams) (database.Template, error) {
 		return q.db.GetTemplateByID(ctx, arg.TemplateID)
 	}
 
-	return fetchAndExec(q.log, q.auth, rbac.ActionUpdate, fetch, q.db.UpdateWorkspacesDeletingAtByTemplateID)(ctx, arg)
+	return fetchAndExec(q.log, q.auth, rbac.ActionUpdate, fetch, q.db.UpdateWorkspacesDormantDeletingAtByTemplateID)(ctx, arg)
 }
 
 func (q *querier) UpsertAppSecurityKey(ctx context.Context, data string) error {
@@ -2628,6 +2891,13 @@ func (q *querier) UpsertAppSecurityKey(ctx context.Context, data string) error {
 	return q.db.UpsertAppSecurityKey(ctx, data)
 }
 
+func (q *querier) UpsertApplicationName(ctx context.Context, value string) error {
+	if err := q.authorizeContext(ctx, rbac.ActionCreate, rbac.ResourceDeploymentValues); err != nil {
+		return err
+	}
+	return q.db.UpsertApplicationName(ctx, value)
+}
+
 func (q *querier) UpsertDefaultProxy(ctx context.Context, arg database.UpsertDefaultProxyParams) error {
 	if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceSystem); err != nil {
 		return err
@@ -2677,6 +2947,13 @@ func (q *querier) UpsertTailnetClient(ctx context.Context, arg database.UpsertTa
 	return q.db.UpsertTailnetClient(ctx, arg)
 }
 
+func (q *querier) UpsertTailnetClientSubscription(ctx context.Context, arg database.UpsertTailnetClientSubscriptionParams) error {
+	if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceTailnetCoordinator); err != nil {
+		return err
+	}
+	return q.db.UpsertTailnetClientSubscription(ctx, arg)
+}
+
 func (q *querier) UpsertTailnetCoordinator(ctx context.Context, id uuid.UUID) (database.TailnetCoordinator, error) {
 	if err := q.authorizeContext(ctx, rbac.ActionUpdate, rbac.ResourceTailnetCoordinator); err != nil {
 		return database.TailnetCoordinator{}, err
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index f3313c768053f..48239450ebe1a 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -13,13 +13,15 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/util/slice"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestAsNoActor(t *testing.T) {
@@ -60,7 +62,7 @@ func TestAsNoActor(t *testing.T) {
 func TestPing(t *testing.T) {
 	t.Parallel()
 
-	q := dbauthz.New(dbfake.New(), &coderdtest.RecordingAuthorizer{}, slog.Make())
+	q := dbauthz.New(dbmem.New(), &coderdtest.RecordingAuthorizer{}, slog.Make(), accessControlStorePointer())
 	_, err := q.Ping(context.Background())
 	require.NoError(t, err, "must not error")
 }
@@ -69,10 +71,10 @@ func TestPing(t *testing.T) {
 func TestInTX(t *testing.T) {
 	t.Parallel()
 
-	db := dbfake.New()
+	db := dbmem.New()
 	q := dbauthz.New(db, &coderdtest.RecordingAuthorizer{
 		Wrapped: &coderdtest.FakeAuthorizer{AlwaysReturn: xerrors.New("custom error")},
-	}, slog.Make())
+	}, slog.Make(), accessControlStorePointer())
 	actor := rbac.Subject{
 		ID:     uuid.NewString(),
 		Roles:  rbac.RoleNames{rbac.RoleOwner()},
@@ -97,7 +99,7 @@ func TestNew(t *testing.T) {
 	t.Parallel()
 
 	var (
-		db  = dbfake.New()
+		db  = dbmem.New()
 		exp = dbgen.Workspace(t, db, database.Workspace{})
 		rec = &coderdtest.RecordingAuthorizer{
 			Wrapped: &coderdtest.FakeAuthorizer{AlwaysReturn: nil},
@@ -108,8 +110,8 @@ func TestNew(t *testing.T) {
 
 	// Double wrap should not cause an actual double wrap. So only 1 rbac call
 	// should be made.
-	az := dbauthz.New(db, rec, slog.Make())
-	az = dbauthz.New(az, rec, slog.Make())
+	az := dbauthz.New(db, rec, slog.Make(), accessControlStorePointer())
+	az = dbauthz.New(az, rec, slog.Make(), accessControlStorePointer())
 
 	w, err := az.GetWorkspaceByID(ctx, exp.ID)
 	require.NoError(t, err, "must not error")
@@ -124,9 +126,9 @@ func TestNew(t *testing.T) {
 // as only the first db call will be made. But it is better than nothing.
 func TestDBAuthzRecursive(t *testing.T) {
 	t.Parallel()
-	q := dbauthz.New(dbfake.New(), &coderdtest.RecordingAuthorizer{
+	q := dbauthz.New(dbmem.New(), &coderdtest.RecordingAuthorizer{
 		Wrapped: &coderdtest.FakeAuthorizer{AlwaysReturn: nil},
-	}, slog.Make())
+	}, slog.Make(), accessControlStorePointer())
 	actor := rbac.Subject{
 		ID:     uuid.NewString(),
 		Roles:  rbac.RoleNames{rbac.RoleOwner()},
@@ -341,16 +343,51 @@ func (s *MethodTestSuite) TestGroup() {
 }
 
 func (s *MethodTestSuite) TestProvsionerJob() {
+	s.Run("ArchiveUnusedTemplateVersions", s.Subtest(func(db database.Store, check *expects) {
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
+			Type: database.ProvisionerJobTypeTemplateVersionImport,
+			Error: sql.NullString{
+				String: "failed",
+				Valid:  true,
+			},
+		})
+		tpl := dbgen.Template(s.T(), db, database.Template{})
+		v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
+			TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true},
+			JobID:      j.ID,
+		})
+		check.Args(database.ArchiveUnusedTemplateVersionsParams{
+			UpdatedAt:         dbtime.Now(),
+			TemplateID:        tpl.ID,
+			TemplateVersionID: uuid.Nil,
+			JobStatus:         database.NullProvisionerJobStatus{},
+		}).Asserts(v.RBACObject(tpl), rbac.ActionUpdate)
+	}))
+	s.Run("UnarchiveTemplateVersion", s.Subtest(func(db database.Store, check *expects) {
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
+			Type: database.ProvisionerJobTypeTemplateVersionImport,
+		})
+		tpl := dbgen.Template(s.T(), db, database.Template{})
+		v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
+			TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true},
+			JobID:      j.ID,
+			Archived:   true,
+		})
+		check.Args(database.UnarchiveTemplateVersionParams{
+			UpdatedAt:         dbtime.Now(),
+			TemplateVersionID: v.ID,
+		}).Asserts(v.RBACObject(tpl), rbac.ActionUpdate)
+	}))
 	s.Run("Build/GetProvisionerJobByID", s.Subtest(func(db database.Store, check *expects) {
 		w := dbgen.Workspace(s.T(), db, database.Workspace{})
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 			Type: database.ProvisionerJobTypeWorkspaceBuild,
 		})
 		_ = dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{JobID: j.ID, WorkspaceID: w.ID})
 		check.Args(j.ID).Asserts(w, rbac.ActionRead).Returns(j)
 	}))
 	s.Run("TemplateVersion/GetProvisionerJobByID", s.Subtest(func(db database.Store, check *expects) {
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 			Type: database.ProvisionerJobTypeTemplateVersionImport,
 		})
 		tpl := dbgen.Template(s.T(), db, database.Template{})
@@ -365,7 +402,7 @@ func (s *MethodTestSuite) TestProvsionerJob() {
 		v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
 			TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true},
 		})
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 			Type: database.ProvisionerJobTypeTemplateVersionDryRun,
 			Input: must(json.Marshal(struct {
 				TemplateVersionID uuid.UUID `json:"template_version_id"`
@@ -376,7 +413,7 @@ func (s *MethodTestSuite) TestProvsionerJob() {
 	s.Run("Build/UpdateProvisionerJobWithCancelByID", s.Subtest(func(db database.Store, check *expects) {
 		tpl := dbgen.Template(s.T(), db, database.Template{AllowUserCancelWorkspaceJobs: true})
 		w := dbgen.Workspace(s.T(), db, database.Workspace{TemplateID: tpl.ID})
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 			Type: database.ProvisionerJobTypeWorkspaceBuild,
 		})
 		_ = dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{JobID: j.ID, WorkspaceID: w.ID})
@@ -385,14 +422,14 @@ func (s *MethodTestSuite) TestProvsionerJob() {
 	s.Run("BuildFalseCancel/UpdateProvisionerJobWithCancelByID", s.Subtest(func(db database.Store, check *expects) {
 		tpl := dbgen.Template(s.T(), db, database.Template{AllowUserCancelWorkspaceJobs: false})
 		w := dbgen.Workspace(s.T(), db, database.Workspace{TemplateID: tpl.ID})
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 			Type: database.ProvisionerJobTypeWorkspaceBuild,
 		})
 		_ = dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{JobID: j.ID, WorkspaceID: w.ID})
 		check.Args(database.UpdateProvisionerJobWithCancelByIDParams{ID: j.ID}).Asserts(w, rbac.ActionUpdate).Returns()
 	}))
 	s.Run("TemplateVersion/UpdateProvisionerJobWithCancelByID", s.Subtest(func(db database.Store, check *expects) {
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 			Type: database.ProvisionerJobTypeTemplateVersionImport,
 		})
 		tpl := dbgen.Template(s.T(), db, database.Template{})
@@ -404,7 +441,7 @@ func (s *MethodTestSuite) TestProvsionerJob() {
 			Asserts(v.RBACObject(tpl), []rbac.Action{rbac.ActionRead, rbac.ActionUpdate}).Returns()
 	}))
 	s.Run("TemplateVersionNoTemplate/UpdateProvisionerJobWithCancelByID", s.Subtest(func(db database.Store, check *expects) {
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 			Type: database.ProvisionerJobTypeTemplateVersionImport,
 		})
 		v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
@@ -419,7 +456,7 @@ func (s *MethodTestSuite) TestProvsionerJob() {
 		v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
 			TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true},
 		})
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 			Type: database.ProvisionerJobTypeTemplateVersionDryRun,
 			Input: must(json.Marshal(struct {
 				TemplateVersionID uuid.UUID `json:"template_version_id"`
@@ -429,13 +466,13 @@ func (s *MethodTestSuite) TestProvsionerJob() {
 			Asserts(v.RBACObject(tpl), []rbac.Action{rbac.ActionRead, rbac.ActionUpdate}).Returns()
 	}))
 	s.Run("GetProvisionerJobsByIDs", s.Subtest(func(db database.Store, check *expects) {
-		a := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{})
-		b := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{})
+		a := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
+		b := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 		check.Args([]uuid.UUID{a.ID, b.ID}).Asserts().Returns(slice.New(a, b))
 	}))
 	s.Run("GetProvisionerLogsAfterID", s.Subtest(func(db database.Store, check *expects) {
 		w := dbgen.Workspace(s.T(), db, database.Workspace{})
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 			Type: database.ProvisionerJobTypeWorkspaceBuild,
 		})
 		_ = dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{JobID: j.ID, WorkspaceID: w.ID})
@@ -824,16 +861,16 @@ func (s *MethodTestSuite) TestTemplate() {
 			Readme: "foo",
 		}).Asserts(t1, rbac.ActionUpdate).Returns()
 	}))
-	s.Run("UpdateTemplateVersionGitAuthProvidersByJobID", s.Subtest(func(db database.Store, check *expects) {
+	s.Run("UpdateTemplateVersionExternalAuthProvidersByJobID", s.Subtest(func(db database.Store, check *expects) {
 		jobID := uuid.New()
 		t1 := dbgen.Template(s.T(), db, database.Template{})
 		_ = dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
 			TemplateID: uuid.NullUUID{UUID: t1.ID, Valid: true},
 			JobID:      jobID,
 		})
-		check.Args(database.UpdateTemplateVersionGitAuthProvidersByJobIDParams{
-			JobID:            jobID,
-			GitAuthProviders: []string{},
+		check.Args(database.UpdateTemplateVersionExternalAuthProvidersByJobIDParams{
+			JobID:                 jobID,
+			ExternalAuthProviders: []string{},
 		}).Asserts(t1, rbac.ActionUpdate).Returns()
 	}))
 }
@@ -863,8 +900,8 @@ func (s *MethodTestSuite) TestUser() {
 		check.Args(u.ID).Asserts(u, rbac.ActionRead).Returns(u)
 	}))
 	s.Run("GetUsersByIDs", s.Subtest(func(db database.Store, check *expects) {
-		a := dbgen.User(s.T(), db, database.User{CreatedAt: database.Now().Add(-time.Hour)})
-		b := dbgen.User(s.T(), db, database.User{CreatedAt: database.Now()})
+		a := dbgen.User(s.T(), db, database.User{CreatedAt: dbtime.Now().Add(-time.Hour)})
+		b := dbgen.User(s.T(), db, database.User{CreatedAt: dbtime.Now()})
 		check.Args([]uuid.UUID{a.ID, b.ID}).
 			Asserts(a, rbac.ActionRead, b, rbac.ActionRead).
 			Returns(slice.New(a, b))
@@ -952,23 +989,23 @@ func (s *MethodTestSuite) TestUser() {
 			UpdatedAt: key.UpdatedAt,
 		}).Asserts(key, rbac.ActionUpdate).Returns(key)
 	}))
-	s.Run("GetGitAuthLink", s.Subtest(func(db database.Store, check *expects) {
-		link := dbgen.GitAuthLink(s.T(), db, database.GitAuthLink{})
-		check.Args(database.GetGitAuthLinkParams{
+	s.Run("GetExternalAuthLink", s.Subtest(func(db database.Store, check *expects) {
+		link := dbgen.ExternalAuthLink(s.T(), db, database.ExternalAuthLink{})
+		check.Args(database.GetExternalAuthLinkParams{
 			ProviderID: link.ProviderID,
 			UserID:     link.UserID,
 		}).Asserts(link, rbac.ActionRead).Returns(link)
 	}))
-	s.Run("InsertGitAuthLink", s.Subtest(func(db database.Store, check *expects) {
+	s.Run("InsertExternalAuthLink", s.Subtest(func(db database.Store, check *expects) {
 		u := dbgen.User(s.T(), db, database.User{})
-		check.Args(database.InsertGitAuthLinkParams{
+		check.Args(database.InsertExternalAuthLinkParams{
 			ProviderID: uuid.NewString(),
 			UserID:     u.ID,
 		}).Asserts(rbac.ResourceUserData.WithOwner(u.ID.String()).WithID(u.ID), rbac.ActionCreate)
 	}))
-	s.Run("UpdateGitAuthLink", s.Subtest(func(db database.Store, check *expects) {
-		link := dbgen.GitAuthLink(s.T(), db, database.GitAuthLink{})
-		check.Args(database.UpdateGitAuthLinkParams{
+	s.Run("UpdateExternalAuthLink", s.Subtest(func(db database.Store, check *expects) {
+		link := dbgen.ExternalAuthLink(s.T(), db, database.ExternalAuthLink{})
+		check.Args(database.UpdateExternalAuthLinkParams{
 			ProviderID:        link.ProviderID,
 			UserID:            link.UserID,
 			OAuthAccessToken:  link.OAuthAccessToken,
@@ -1064,8 +1101,10 @@ func (s *MethodTestSuite) TestWorkspace() {
 		res := dbgen.WorkspaceResource(s.T(), db, database.WorkspaceResource{JobID: build.JobID})
 		agt := dbgen.WorkspaceAgent(s.T(), db, database.WorkspaceAgent{ResourceID: res.ID})
 		check.Args(database.UpdateWorkspaceAgentStartupByIDParams{
-			ID:        agt.ID,
-			Subsystem: database.WorkspaceAgentSubsystemNone,
+			ID: agt.ID,
+			Subsystems: []database.WorkspaceAgentSubsystem{
+				database.WorkspaceAgentSubsystemEnvbox,
+			},
 		}).Asserts(ws, rbac.ActionUpdate).Returns()
 	}))
 	s.Run("GetWorkspaceAgentLogsAfter", s.Subtest(func(db database.Store, check *expects) {
@@ -1148,39 +1187,94 @@ func (s *MethodTestSuite) TestWorkspace() {
 	s.Run("GetWorkspaceResourceByID", s.Subtest(func(db database.Store, check *expects) {
 		ws := dbgen.Workspace(s.T(), db, database.Workspace{})
 		build := dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{WorkspaceID: ws.ID, JobID: uuid.New()})
-		_ = dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{ID: build.JobID, Type: database.ProvisionerJobTypeWorkspaceBuild})
+		_ = dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{ID: build.JobID, Type: database.ProvisionerJobTypeWorkspaceBuild})
 		res := dbgen.WorkspaceResource(s.T(), db, database.WorkspaceResource{JobID: build.JobID})
 		check.Args(res.ID).Asserts(ws, rbac.ActionRead).Returns(res)
 	}))
 	s.Run("Build/GetWorkspaceResourcesByJobID", s.Subtest(func(db database.Store, check *expects) {
 		ws := dbgen.Workspace(s.T(), db, database.Workspace{})
 		build := dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{WorkspaceID: ws.ID, JobID: uuid.New()})
-		job := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{ID: build.JobID, Type: database.ProvisionerJobTypeWorkspaceBuild})
+		job := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{ID: build.JobID, Type: database.ProvisionerJobTypeWorkspaceBuild})
 		check.Args(job.ID).Asserts(ws, rbac.ActionRead).Returns([]database.WorkspaceResource{})
 	}))
 	s.Run("Template/GetWorkspaceResourcesByJobID", s.Subtest(func(db database.Store, check *expects) {
 		tpl := dbgen.Template(s.T(), db, database.Template{})
 		v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true}, JobID: uuid.New()})
-		job := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{ID: v.JobID, Type: database.ProvisionerJobTypeTemplateVersionImport})
+		job := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{ID: v.JobID, Type: database.ProvisionerJobTypeTemplateVersionImport})
 		check.Args(job.ID).Asserts(v.RBACObject(tpl), []rbac.Action{rbac.ActionRead, rbac.ActionRead}).Returns([]database.WorkspaceResource{})
 	}))
 	s.Run("InsertWorkspace", s.Subtest(func(db database.Store, check *expects) {
 		u := dbgen.User(s.T(), db, database.User{})
 		o := dbgen.Organization(s.T(), db, database.Organization{})
 		check.Args(database.InsertWorkspaceParams{
-			ID:             uuid.New(),
-			OwnerID:        u.ID,
-			OrganizationID: o.ID,
+			ID:               uuid.New(),
+			OwnerID:          u.ID,
+			OrganizationID:   o.ID,
+			AutomaticUpdates: database.AutomaticUpdatesNever,
 		}).Asserts(rbac.ResourceWorkspace.WithOwner(u.ID.String()).InOrg(o.ID), rbac.ActionCreate)
 	}))
 	s.Run("Start/InsertWorkspaceBuild", s.Subtest(func(db database.Store, check *expects) {
-		w := dbgen.Workspace(s.T(), db, database.Workspace{})
+		t := dbgen.Template(s.T(), db, database.Template{})
+		w := dbgen.Workspace(s.T(), db, database.Workspace{
+			TemplateID: t.ID,
+		})
 		check.Args(database.InsertWorkspaceBuildParams{
 			WorkspaceID: w.ID,
 			Transition:  database.WorkspaceTransitionStart,
 			Reason:      database.BuildReasonInitiator,
 		}).Asserts(w.WorkspaceBuildRBAC(database.WorkspaceTransitionStart), rbac.ActionUpdate)
 	}))
+	s.Run("Start/RequireActiveVersion/VersionMismatch/InsertWorkspaceBuild", s.Subtest(func(db database.Store, check *expects) {
+		t := dbgen.Template(s.T(), db, database.Template{})
+		ctx := testutil.Context(s.T(), testutil.WaitShort)
+		err := db.UpdateTemplateAccessControlByID(ctx, database.UpdateTemplateAccessControlByIDParams{
+			ID:                   t.ID,
+			RequireActiveVersion: true,
+		})
+		require.NoError(s.T(), err)
+		v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{
+			TemplateID: uuid.NullUUID{UUID: t.ID},
+		})
+		w := dbgen.Workspace(s.T(), db, database.Workspace{
+			TemplateID: t.ID,
+		})
+		check.Args(database.InsertWorkspaceBuildParams{
+			WorkspaceID:       w.ID,
+			Transition:        database.WorkspaceTransitionStart,
+			Reason:            database.BuildReasonInitiator,
+			TemplateVersionID: v.ID,
+		}).Asserts(
+			w.WorkspaceBuildRBAC(database.WorkspaceTransitionStart), rbac.ActionUpdate,
+			t, rbac.ActionUpdate,
+		)
+	}))
+	s.Run("Start/RequireActiveVersion/VersionsMatch/InsertWorkspaceBuild", s.Subtest(func(db database.Store, check *expects) {
+		v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{})
+		t := dbgen.Template(s.T(), db, database.Template{
+			ActiveVersionID: v.ID,
+		})
+
+		ctx := testutil.Context(s.T(), testutil.WaitShort)
+		err := db.UpdateTemplateAccessControlByID(ctx, database.UpdateTemplateAccessControlByIDParams{
+			ID:                   t.ID,
+			RequireActiveVersion: true,
+		})
+		require.NoError(s.T(), err)
+
+		w := dbgen.Workspace(s.T(), db, database.Workspace{
+			TemplateID: t.ID,
+		})
+		// Assert that we do not check for template update permissions
+		// if versions match.
+		check.Args(database.InsertWorkspaceBuildParams{
+			WorkspaceID:       w.ID,
+			Transition:        database.WorkspaceTransitionStart,
+			Reason:            database.BuildReasonInitiator,
+			TemplateVersionID: v.ID,
+		}).Asserts(
+			w.WorkspaceBuildRBAC(database.WorkspaceTransitionStart), rbac.ActionUpdate,
+		)
+	}))
 	s.Run("Delete/InsertWorkspaceBuild", s.Subtest(func(db database.Store, check *expects) {
 		w := dbgen.Workspace(s.T(), db, database.Workspace{})
 		check.Args(database.InsertWorkspaceBuildParams{
@@ -1229,14 +1323,13 @@ func (s *MethodTestSuite) TestWorkspace() {
 			ID: ws.ID,
 		}).Asserts(ws, rbac.ActionUpdate).Returns()
 	}))
-	s.Run("UpdateWorkspaceBuildByID", s.Subtest(func(db database.Store, check *expects) {
+	s.Run("UpdateWorkspaceBuildDeadlineByID", s.Subtest(func(db database.Store, check *expects) {
 		ws := dbgen.Workspace(s.T(), db, database.Workspace{})
 		build := dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{WorkspaceID: ws.ID, JobID: uuid.New()})
-		check.Args(database.UpdateWorkspaceBuildByIDParams{
-			ID:               build.ID,
-			UpdatedAt:        build.UpdatedAt,
-			Deadline:         build.Deadline,
-			ProvisionerState: []byte{},
+		check.Args(database.UpdateWorkspaceBuildDeadlineByIDParams{
+			ID:        build.ID,
+			UpdatedAt: build.UpdatedAt,
+			Deadline:  build.Deadline,
 		}).Asserts(ws, rbac.ActionUpdate)
 	}))
 	s.Run("SoftDeleteWorkspaceByID", s.Subtest(func(db database.Store, check *expects) {
@@ -1317,10 +1410,6 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 		dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{})
 		check.Args().Asserts(rbac.ResourceSystem, rbac.ActionRead)
 	}))
-	s.Run("GetWorkspaceAgentByAuthToken", s.Subtest(func(db database.Store, check *expects) {
-		agt := dbgen.WorkspaceAgent(s.T(), db, database.WorkspaceAgent{})
-		check.Args(agt.AuthToken).Asserts(rbac.ResourceSystem, rbac.ActionRead).Returns(agt)
-	}))
 	s.Run("GetActiveUserCount", s.Subtest(func(db database.Store, check *expects) {
 		check.Args().Asserts(rbac.ResourceSystem, rbac.ActionRead).Returns(int64(0))
 	}))
@@ -1379,6 +1468,14 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 			DailyCost: 10,
 		}).Asserts(rbac.ResourceSystem, rbac.ActionUpdate)
 	}))
+	s.Run("UpdateWorkspaceBuildProvisionerStateByID", s.Subtest(func(db database.Store, check *expects) {
+		ws := dbgen.Workspace(s.T(), db, database.Workspace{})
+		build := dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{WorkspaceID: ws.ID, JobID: uuid.New()})
+		check.Args(database.UpdateWorkspaceBuildProvisionerStateByIDParams{
+			ID:               build.ID,
+			ProvisionerState: []byte("testing"),
+		}).Asserts(rbac.ResourceSystem, rbac.ActionUpdate)
+	}))
 	s.Run("UpsertLastUpdateCheck", s.Subtest(func(db database.Store, check *expects) {
 		check.Args("value").Asserts(rbac.ResourceSystem, rbac.ActionUpdate)
 	}))
@@ -1412,7 +1509,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 	}))
 	s.Run("GetProvisionerJobsCreatedAfter", s.Subtest(func(db database.Store, check *expects) {
 		// TODO: add provisioner job resource type
-		_ = dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{CreatedAt: time.Now().Add(-time.Hour)})
+		_ = dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{CreatedAt: time.Now().Add(-time.Hour)})
 		check.Args(time.Now()).Asserts( /*rbac.ResourceSystem, rbac.ActionRead*/ )
 	}))
 	s.Run("GetTemplateVersionsByIDs", s.Subtest(func(db database.Store, check *expects) {
@@ -1451,11 +1548,11 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 	s.Run("GetWorkspaceResourcesByJobIDs", s.Subtest(func(db database.Store, check *expects) {
 		tpl := dbgen.Template(s.T(), db, database.Template{})
 		v := dbgen.TemplateVersion(s.T(), db, database.TemplateVersion{TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true}, JobID: uuid.New()})
-		tJob := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{ID: v.JobID, Type: database.ProvisionerJobTypeTemplateVersionImport})
+		tJob := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{ID: v.JobID, Type: database.ProvisionerJobTypeTemplateVersionImport})
 
 		ws := dbgen.Workspace(s.T(), db, database.Workspace{})
 		build := dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{WorkspaceID: ws.ID, JobID: uuid.New()})
-		wJob := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{ID: build.JobID, Type: database.ProvisionerJobTypeWorkspaceBuild})
+		wJob := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{ID: build.JobID, Type: database.ProvisionerJobTypeWorkspaceBuild})
 		check.Args([]uuid.UUID{tJob.ID, wJob.ID}).
 			Asserts(rbac.ResourceSystem, rbac.ActionRead).
 			Returns([]database.WorkspaceResource{})
@@ -1463,7 +1560,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 	s.Run("GetWorkspaceResourceMetadataByResourceIDs", s.Subtest(func(db database.Store, check *expects) {
 		ws := dbgen.Workspace(s.T(), db, database.Workspace{})
 		build := dbgen.WorkspaceBuild(s.T(), db, database.WorkspaceBuild{WorkspaceID: ws.ID, JobID: uuid.New()})
-		_ = dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{ID: build.JobID, Type: database.ProvisionerJobTypeWorkspaceBuild})
+		_ = dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{ID: build.JobID, Type: database.ProvisionerJobTypeWorkspaceBuild})
 		a := dbgen.WorkspaceResource(s.T(), db, database.WorkspaceResource{JobID: build.JobID})
 		b := dbgen.WorkspaceResource(s.T(), db, database.WorkspaceResource{JobID: build.JobID})
 		check.Args([]uuid.UUID{a.ID, b.ID}).
@@ -1480,16 +1577,15 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 	}))
 	s.Run("GetProvisionerJobsByIDs", s.Subtest(func(db database.Store, check *expects) {
 		// TODO: add a ProvisionerJob resource type
-		a := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{})
-		b := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{})
+		a := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
+		b := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 		check.Args([]uuid.UUID{a.ID, b.ID}).
 			Asserts( /*rbac.ResourceSystem, rbac.ActionRead*/ ).
 			Returns(slice.New(a, b))
 	}))
 	s.Run("InsertWorkspaceAgent", s.Subtest(func(db database.Store, check *expects) {
 		check.Args(database.InsertWorkspaceAgentParams{
-			ID:                    uuid.New(),
-			StartupScriptBehavior: database.StartupScriptBehaviorNonBlocking,
+			ID: uuid.New(),
 		}).Asserts(rbac.ResourceSystem, rbac.ActionCreate)
 	}))
 	s.Run("InsertWorkspaceApp", s.Subtest(func(db database.Store, check *expects) {
@@ -1515,7 +1611,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 	}))
 	s.Run("AcquireProvisionerJob", s.Subtest(func(db database.Store, check *expects) {
 		// TODO: we need to create a ProvisionerJob resource
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{
 			StartedAt: sql.NullTime{Valid: false},
 		})
 		check.Args(database.AcquireProvisionerJobParams{Types: []database.ProvisionerType{j.Provisioner}, Tags: must(json.Marshal(j.Tags))}).
@@ -1523,14 +1619,14 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 	}))
 	s.Run("UpdateProvisionerJobWithCompleteByID", s.Subtest(func(db database.Store, check *expects) {
 		// TODO: we need to create a ProvisionerJob resource
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{})
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 		check.Args(database.UpdateProvisionerJobWithCompleteByIDParams{
 			ID: j.ID,
 		}).Asserts( /*rbac.ResourceSystem, rbac.ActionUpdate*/ )
 	}))
 	s.Run("UpdateProvisionerJobByID", s.Subtest(func(db database.Store, check *expects) {
 		// TODO: we need to create a ProvisionerJob resource
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{})
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 		check.Args(database.UpdateProvisionerJobByIDParams{
 			ID:        j.ID,
 			UpdatedAt: time.Now(),
@@ -1547,7 +1643,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 	}))
 	s.Run("InsertProvisionerJobLogs", s.Subtest(func(db database.Store, check *expects) {
 		// TODO: we need to create a ProvisionerJob resource
-		j := dbgen.ProvisionerJob(s.T(), db, database.ProvisionerJob{})
+		j := dbgen.ProvisionerJob(s.T(), db, nil, database.ProvisionerJob{})
 		check.Args(database.InsertProvisionerJobLogsParams{
 			JobID: j.ID,
 		}).Asserts( /*rbac.ResourceSystem, rbac.ActionCreate*/ )
diff --git a/coderd/database/dbauthz/setup_test.go b/coderd/database/dbauthz/setup_test.go
index d333c87362cd0..304b8673a9f8d 100644
--- a/coderd/database/dbauthz/setup_test.go
+++ b/coderd/database/dbauthz/setup_test.go
@@ -6,6 +6,7 @@ import (
 	"reflect"
 	"sort"
 	"strings"
+	"sync/atomic"
 	"testing"
 
 	"github.com/golang/mock/gomock"
@@ -16,14 +17,14 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbmock"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/rbac/regosql"
-	"github.com/coder/coder/coderd/util/slice"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbmock"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac/regosql"
+	"github.com/coder/coder/v2/coderd/util/slice"
 )
 
 var skipMethods = map[string]string{
@@ -59,7 +60,7 @@ func (s *MethodTestSuite) SetupSuite() {
 	mockStore := dbmock.NewMockStore(ctrl)
 	// We intentionally set no expectations apart from this.
 	mockStore.EXPECT().Wrappers().Return([]string{}).AnyTimes()
-	az := dbauthz.New(mockStore, nil, slog.Make())
+	az := dbauthz.New(mockStore, nil, slog.Make(), accessControlStorePointer())
 	// Take the underlying type of the interface.
 	azt := reflect.TypeOf(az).Elem()
 	s.methodAccounting = make(map[string]int)
@@ -103,14 +104,14 @@ func (s *MethodTestSuite) Subtest(testCaseF func(db database.Store, check *expec
 		methodName := names[len(names)-1]
 		s.methodAccounting[methodName]++
 
-		db := dbfake.New()
+		db := dbmem.New()
 		fakeAuthorizer := &coderdtest.FakeAuthorizer{
 			AlwaysReturn: nil,
 		}
 		rec := &coderdtest.RecordingAuthorizer{
 			Wrapped: fakeAuthorizer,
 		}
-		az := dbauthz.New(db, rec, slog.Make())
+		az := dbauthz.New(db, rec, slog.Make(), accessControlStorePointer())
 		actor := rbac.Subject{
 			ID:     uuid.NewString(),
 			Roles:  rbac.RoleNames{rbac.RoleOwner()},
@@ -398,3 +399,22 @@ func (emptyPreparedAuthorized) Authorize(_ context.Context, _ rbac.Object) error
 func (emptyPreparedAuthorized) CompileToSQL(_ context.Context, _ regosql.ConvertConfig) (string, error) {
 	return "", nil
 }
+
+func accessControlStorePointer() *atomic.Pointer[dbauthz.AccessControlStore] {
+	acs := &atomic.Pointer[dbauthz.AccessControlStore]{}
+	var tacs dbauthz.AccessControlStore = fakeAccessControlStore{}
+	acs.Store(&tacs)
+	return acs
+}
+
+type fakeAccessControlStore struct{}
+
+func (fakeAccessControlStore) GetTemplateAccessControl(t database.Template) dbauthz.TemplateAccessControl {
+	return dbauthz.TemplateAccessControl{
+		RequireActiveVersion: t.RequireActiveVersion,
+	}
+}
+
+func (fakeAccessControlStore) SetTemplateAccessControl(context.Context, database.Store, uuid.UUID, dbauthz.TemplateAccessControl) error {
+	panic("not implemented")
+}
diff --git a/coderd/database/dbfake/dbfake.go b/coderd/database/dbfake/dbfake.go
deleted file mode 100644
index 0d5c19fa7656d..0000000000000
--- a/coderd/database/dbfake/dbfake.go
+++ /dev/null
@@ -1,5861 +0,0 @@
-package dbfake
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"reflect"
-	"regexp"
-	"sort"
-	"strings"
-	"sync"
-	"time"
-
-	"github.com/google/uuid"
-	"github.com/lib/pq"
-	"golang.org/x/exp/maps"
-	"golang.org/x/exp/slices"
-	"golang.org/x/xerrors"
-
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/rbac/regosql"
-	"github.com/coder/coder/coderd/util/slice"
-	"github.com/coder/coder/codersdk"
-)
-
-var validProxyByHostnameRegex = regexp.MustCompile(`^[a-zA-Z0-9._-]+$`)
-
-var errDuplicateKey = &pq.Error{
-	Code:    "23505",
-	Message: "duplicate key value violates unique constraint",
-}
-
-// New returns an in-memory fake of the database.
-func New() database.Store {
-	q := &FakeQuerier{
-		mutex: &sync.RWMutex{},
-		data: &data{
-			apiKeys:                   make([]database.APIKey, 0),
-			organizationMembers:       make([]database.OrganizationMember, 0),
-			organizations:             make([]database.Organization, 0),
-			users:                     make([]database.User, 0),
-			gitAuthLinks:              make([]database.GitAuthLink, 0),
-			groups:                    make([]database.Group, 0),
-			groupMembers:              make([]database.GroupMember, 0),
-			auditLogs:                 make([]database.AuditLog, 0),
-			files:                     make([]database.File, 0),
-			gitSSHKey:                 make([]database.GitSSHKey, 0),
-			parameterSchemas:          make([]database.ParameterSchema, 0),
-			provisionerDaemons:        make([]database.ProvisionerDaemon, 0),
-			workspaceAgents:           make([]database.WorkspaceAgent, 0),
-			provisionerJobLogs:        make([]database.ProvisionerJobLog, 0),
-			workspaceResources:        make([]database.WorkspaceResource, 0),
-			workspaceResourceMetadata: make([]database.WorkspaceResourceMetadatum, 0),
-			provisionerJobs:           make([]database.ProvisionerJob, 0),
-			templateVersions:          make([]database.TemplateVersionTable, 0),
-			templates:                 make([]database.TemplateTable, 0),
-			workspaceAgentStats:       make([]database.WorkspaceAgentStat, 0),
-			workspaceAgentLogs:        make([]database.WorkspaceAgentLog, 0),
-			workspaceBuilds:           make([]database.WorkspaceBuildTable, 0),
-			workspaceApps:             make([]database.WorkspaceApp, 0),
-			workspaces:                make([]database.Workspace, 0),
-			licenses:                  make([]database.License, 0),
-			workspaceProxies:          make([]database.WorkspaceProxy, 0),
-			locks:                     map[int64]struct{}{},
-		},
-	}
-	q.defaultProxyDisplayName = "Default"
-	q.defaultProxyIconURL = "/emojis/1f3e1.png"
-	return q
-}
-
-type rwMutex interface {
-	Lock()
-	RLock()
-	Unlock()
-	RUnlock()
-}
-
-// inTxMutex is a no op, since inside a transaction we are already locked.
-type inTxMutex struct{}
-
-func (inTxMutex) Lock()    {}
-func (inTxMutex) RLock()   {}
-func (inTxMutex) Unlock()  {}
-func (inTxMutex) RUnlock() {}
-
-// FakeQuerier replicates database functionality to enable quick testing.  It's an exported type so that our test code
-// can do type checks.
-type FakeQuerier struct {
-	mutex rwMutex
-	*data
-}
-
-func (*FakeQuerier) Wrappers() []string {
-	return []string{}
-}
-
-type fakeTx struct {
-	*FakeQuerier
-	locks map[int64]struct{}
-}
-
-type data struct {
-	// Legacy tables
-	apiKeys             []database.APIKey
-	organizations       []database.Organization
-	organizationMembers []database.OrganizationMember
-	users               []database.User
-	userLinks           []database.UserLink
-
-	// New tables
-	workspaceAgentStats       []database.WorkspaceAgentStat
-	auditLogs                 []database.AuditLog
-	files                     []database.File
-	gitAuthLinks              []database.GitAuthLink
-	gitSSHKey                 []database.GitSSHKey
-	groupMembers              []database.GroupMember
-	groups                    []database.Group
-	licenses                  []database.License
-	parameterSchemas          []database.ParameterSchema
-	provisionerDaemons        []database.ProvisionerDaemon
-	provisionerJobLogs        []database.ProvisionerJobLog
-	provisionerJobs           []database.ProvisionerJob
-	replicas                  []database.Replica
-	templateVersions          []database.TemplateVersionTable
-	templateVersionParameters []database.TemplateVersionParameter
-	templateVersionVariables  []database.TemplateVersionVariable
-	templates                 []database.TemplateTable
-	workspaceAgents           []database.WorkspaceAgent
-	workspaceAgentMetadata    []database.WorkspaceAgentMetadatum
-	workspaceAgentLogs        []database.WorkspaceAgentLog
-	workspaceApps             []database.WorkspaceApp
-	workspaceBuilds           []database.WorkspaceBuildTable
-	workspaceBuildParameters  []database.WorkspaceBuildParameter
-	workspaceResourceMetadata []database.WorkspaceResourceMetadatum
-	workspaceResources        []database.WorkspaceResource
-	workspaces                []database.Workspace
-	workspaceProxies          []database.WorkspaceProxy
-	// Locks is a map of lock names. Any keys within the map are currently
-	// locked.
-	locks                   map[int64]struct{}
-	deploymentID            string
-	derpMeshKey             string
-	lastUpdateCheck         []byte
-	serviceBanner           []byte
-	logoURL                 string
-	appSecurityKey          string
-	oauthSigningKey         string
-	lastLicenseID           int32
-	defaultProxyDisplayName string
-	defaultProxyIconURL     string
-}
-
-func validateDatabaseTypeWithValid(v reflect.Value) (handled bool, err error) {
-	if v.Kind() == reflect.Struct {
-		return false, nil
-	}
-
-	if v.CanInterface() {
-		if !strings.Contains(v.Type().PkgPath(), "coderd/database") {
-			return true, nil
-		}
-		if valid, ok := v.Interface().(interface{ Valid() bool }); ok {
-			if !valid.Valid() {
-				return true, xerrors.Errorf("invalid %s: %q", v.Type().Name(), v.Interface())
-			}
-		}
-		return true, nil
-	}
-	return false, nil
-}
-
-// validateDatabaseType uses reflect to check if struct properties are types
-// with a Valid() bool function set. If so, call it and return an error
-// if false.
-//
-// Note that we only check immediate values and struct fields. We do not
-// recurse into nested structs.
-func validateDatabaseType(args interface{}) error {
-	v := reflect.ValueOf(args)
-
-	// Note: database.Null* types don't have a Valid method, we skip them here
-	// because their embedded types may have a Valid method and we don't want
-	// to bother with checking both that the Valid field is true and that the
-	// type it embeds validates to true. We would need to check:
-	//
-	//	dbNullEnum.Valid && dbNullEnum.Enum.Valid()
-	if strings.HasPrefix(v.Type().Name(), "Null") {
-		return nil
-	}
-
-	if ok, err := validateDatabaseTypeWithValid(v); ok {
-		return err
-	}
-	switch v.Kind() {
-	case reflect.Struct:
-		var errs []string
-		for i := 0; i < v.NumField(); i++ {
-			field := v.Field(i)
-			if ok, err := validateDatabaseTypeWithValid(field); ok && err != nil {
-				errs = append(errs, fmt.Sprintf("%s.%s: %s", v.Type().Name(), v.Type().Field(i).Name, err.Error()))
-			}
-		}
-		if len(errs) > 0 {
-			return xerrors.Errorf("invalid database type fields:\n\t%s", strings.Join(errs, "\n\t"))
-		}
-	default:
-		panic(fmt.Sprintf("unhandled type: %s", v.Type().Name()))
-	}
-	return nil
-}
-
-func (*FakeQuerier) Ping(_ context.Context) (time.Duration, error) {
-	return 0, nil
-}
-
-func (tx *fakeTx) AcquireLock(_ context.Context, id int64) error {
-	if _, ok := tx.FakeQuerier.locks[id]; ok {
-		return xerrors.Errorf("cannot acquire lock %d: already held", id)
-	}
-	tx.FakeQuerier.locks[id] = struct{}{}
-	tx.locks[id] = struct{}{}
-	return nil
-}
-
-func (tx *fakeTx) TryAcquireLock(_ context.Context, id int64) (bool, error) {
-	if _, ok := tx.FakeQuerier.locks[id]; ok {
-		return false, nil
-	}
-	tx.FakeQuerier.locks[id] = struct{}{}
-	tx.locks[id] = struct{}{}
-	return true, nil
-}
-
-func (tx *fakeTx) releaseLocks() {
-	for id := range tx.locks {
-		delete(tx.FakeQuerier.locks, id)
-	}
-	tx.locks = map[int64]struct{}{}
-}
-
-// InTx doesn't rollback data properly for in-memory yet.
-func (q *FakeQuerier) InTx(fn func(database.Store) error, _ *sql.TxOptions) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-	tx := &fakeTx{
-		FakeQuerier: &FakeQuerier{mutex: inTxMutex{}, data: q.data},
-		locks:       map[int64]struct{}{},
-	}
-	defer tx.releaseLocks()
-
-	return fn(tx)
-}
-
-// getUserByIDNoLock is used by other functions in the database fake.
-func (q *FakeQuerier) getUserByIDNoLock(id uuid.UUID) (database.User, error) {
-	for _, user := range q.users {
-		if user.ID == id {
-			return user, nil
-		}
-	}
-	return database.User{}, sql.ErrNoRows
-}
-
-func convertUsers(users []database.User, count int64) []database.GetUsersRow {
-	rows := make([]database.GetUsersRow, len(users))
-	for i, u := range users {
-		rows[i] = database.GetUsersRow{
-			ID:             u.ID,
-			Email:          u.Email,
-			Username:       u.Username,
-			HashedPassword: u.HashedPassword,
-			CreatedAt:      u.CreatedAt,
-			UpdatedAt:      u.UpdatedAt,
-			Status:         u.Status,
-			RBACRoles:      u.RBACRoles,
-			LoginType:      u.LoginType,
-			AvatarURL:      u.AvatarURL,
-			Deleted:        u.Deleted,
-			LastSeenAt:     u.LastSeenAt,
-			Count:          count,
-		}
-	}
-
-	return rows
-}
-
-// mapAgentStatus determines the agent status based on different timestamps like created_at, last_connected_at, disconnected_at, etc.
-// The function must be in sync with: coderd/workspaceagents.go:convertWorkspaceAgent.
-func mapAgentStatus(dbAgent database.WorkspaceAgent, agentInactiveDisconnectTimeoutSeconds int64) string {
-	var status string
-	connectionTimeout := time.Duration(dbAgent.ConnectionTimeoutSeconds) * time.Second
-	switch {
-	case !dbAgent.FirstConnectedAt.Valid:
-		switch {
-		case connectionTimeout > 0 && database.Now().Sub(dbAgent.CreatedAt) > connectionTimeout:
-			// If the agent took too long to connect the first time,
-			// mark it as timed out.
-			status = "timeout"
-		default:
-			// If the agent never connected, it's waiting for the compute
-			// to start up.
-			status = "connecting"
-		}
-	case dbAgent.DisconnectedAt.Time.After(dbAgent.LastConnectedAt.Time):
-		// If we've disconnected after our last connection, we know the
-		// agent is no longer connected.
-		status = "disconnected"
-	case database.Now().Sub(dbAgent.LastConnectedAt.Time) > time.Duration(agentInactiveDisconnectTimeoutSeconds)*time.Second:
-		// The connection died without updating the last connected.
-		status = "disconnected"
-	case dbAgent.LastConnectedAt.Valid:
-		// The agent should be assumed connected if it's under inactivity timeouts
-		// and last connected at has been properly set.
-		status = "connected"
-	default:
-		panic("unknown agent status: " + status)
-	}
-	return status
-}
-
-func (q *FakeQuerier) convertToWorkspaceRowsNoLock(ctx context.Context, workspaces []database.Workspace, count int64) []database.GetWorkspacesRow {
-	rows := make([]database.GetWorkspacesRow, 0, len(workspaces))
-	for _, w := range workspaces {
-		wr := database.GetWorkspacesRow{
-			ID:                w.ID,
-			CreatedAt:         w.CreatedAt,
-			UpdatedAt:         w.UpdatedAt,
-			OwnerID:           w.OwnerID,
-			OrganizationID:    w.OrganizationID,
-			TemplateID:        w.TemplateID,
-			Deleted:           w.Deleted,
-			Name:              w.Name,
-			AutostartSchedule: w.AutostartSchedule,
-			Ttl:               w.Ttl,
-			LastUsedAt:        w.LastUsedAt,
-			LockedAt:          w.LockedAt,
-			DeletingAt:        w.DeletingAt,
-			Count:             count,
-		}
-
-		for _, t := range q.templates {
-			if t.ID == w.TemplateID {
-				wr.TemplateName = t.Name
-				break
-			}
-		}
-
-		if build, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, w.ID); err == nil {
-			for _, tv := range q.templateVersions {
-				if tv.ID == build.TemplateVersionID {
-					wr.TemplateVersionID = tv.ID
-					wr.TemplateVersionName = sql.NullString{
-						Valid:  true,
-						String: tv.Name,
-					}
-					break
-				}
-			}
-		}
-
-		rows = append(rows, wr)
-	}
-	return rows
-}
-
-func (q *FakeQuerier) getWorkspaceByIDNoLock(_ context.Context, id uuid.UUID) (database.Workspace, error) {
-	for _, workspace := range q.workspaces {
-		if workspace.ID == id {
-			return workspace, nil
-		}
-	}
-	return database.Workspace{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) getWorkspaceByAgentIDNoLock(_ context.Context, agentID uuid.UUID) (database.Workspace, error) {
-	var agent database.WorkspaceAgent
-	for _, _agent := range q.workspaceAgents {
-		if _agent.ID == agentID {
-			agent = _agent
-			break
-		}
-	}
-	if agent.ID == uuid.Nil {
-		return database.Workspace{}, sql.ErrNoRows
-	}
-
-	var resource database.WorkspaceResource
-	for _, _resource := range q.workspaceResources {
-		if _resource.ID == agent.ResourceID {
-			resource = _resource
-			break
-		}
-	}
-	if resource.ID == uuid.Nil {
-		return database.Workspace{}, sql.ErrNoRows
-	}
-
-	var build database.WorkspaceBuild
-	for _, _build := range q.workspaceBuilds {
-		if _build.JobID == resource.JobID {
-			build = q.workspaceBuildWithUserNoLock(_build)
-			break
-		}
-	}
-	if build.ID == uuid.Nil {
-		return database.Workspace{}, sql.ErrNoRows
-	}
-
-	for _, workspace := range q.workspaces {
-		if workspace.ID == build.WorkspaceID {
-			return workspace, nil
-		}
-	}
-
-	return database.Workspace{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) getWorkspaceBuildByIDNoLock(_ context.Context, id uuid.UUID) (database.WorkspaceBuild, error) {
-	for _, build := range q.workspaceBuilds {
-		if build.ID == id {
-			return q.workspaceBuildWithUserNoLock(build), nil
-		}
-	}
-	return database.WorkspaceBuild{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) getLatestWorkspaceBuildByWorkspaceIDNoLock(_ context.Context, workspaceID uuid.UUID) (database.WorkspaceBuild, error) {
-	var row database.WorkspaceBuild
-	var buildNum int32 = -1
-	for _, workspaceBuild := range q.workspaceBuilds {
-		if workspaceBuild.WorkspaceID == workspaceID && workspaceBuild.BuildNumber > buildNum {
-			row = q.workspaceBuildWithUserNoLock(workspaceBuild)
-			buildNum = workspaceBuild.BuildNumber
-		}
-	}
-	if buildNum == -1 {
-		return database.WorkspaceBuild{}, sql.ErrNoRows
-	}
-	return row, nil
-}
-
-func (q *FakeQuerier) getTemplateByIDNoLock(_ context.Context, id uuid.UUID) (database.Template, error) {
-	for _, template := range q.templates {
-		if template.ID == id {
-			return q.templateWithUserNoLock(template), nil
-		}
-	}
-	return database.Template{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) templatesWithUserNoLock(tpl []database.TemplateTable) []database.Template {
-	cpy := make([]database.Template, 0, len(tpl))
-	for _, t := range tpl {
-		cpy = append(cpy, q.templateWithUserNoLock(t))
-	}
-	return cpy
-}
-
-func (q *FakeQuerier) templateWithUserNoLock(tpl database.TemplateTable) database.Template {
-	var user database.User
-	for _, _user := range q.users {
-		if _user.ID == tpl.CreatedBy {
-			user = _user
-			break
-		}
-	}
-	var withUser database.Template
-	// This is a cheeky way to copy the fields over without explicitly listing them all.
-	d, _ := json.Marshal(tpl)
-	_ = json.Unmarshal(d, &withUser)
-	withUser.CreatedByUsername = user.Username
-	withUser.CreatedByAvatarURL = user.AvatarURL
-	return withUser
-}
-
-func (q *FakeQuerier) templateVersionWithUserNoLock(tpl database.TemplateVersionTable) database.TemplateVersion {
-	var user database.User
-	for _, _user := range q.users {
-		if _user.ID == tpl.CreatedBy {
-			user = _user
-			break
-		}
-	}
-	var withUser database.TemplateVersion
-	// This is a cheeky way to copy the fields over without explicitly listing them all.
-	d, _ := json.Marshal(tpl)
-	_ = json.Unmarshal(d, &withUser)
-	withUser.CreatedByUsername = user.Username
-	withUser.CreatedByAvatarURL = user.AvatarURL
-	return withUser
-}
-
-func (q *FakeQuerier) workspaceBuildWithUserNoLock(tpl database.WorkspaceBuildTable) database.WorkspaceBuild {
-	var user database.User
-	for _, _user := range q.users {
-		if _user.ID == tpl.InitiatorID {
-			user = _user
-			break
-		}
-	}
-	var withUser database.WorkspaceBuild
-	// This is a cheeky way to copy the fields over without explicitly listing them all.
-	d, _ := json.Marshal(tpl)
-	_ = json.Unmarshal(d, &withUser)
-	withUser.InitiatorByUsername = user.Username
-	withUser.InitiatorByAvatarUrl = user.AvatarURL
-	return withUser
-}
-
-func (q *FakeQuerier) getTemplateVersionByIDNoLock(_ context.Context, templateVersionID uuid.UUID) (database.TemplateVersion, error) {
-	for _, templateVersion := range q.templateVersions {
-		if templateVersion.ID != templateVersionID {
-			continue
-		}
-		return q.templateVersionWithUserNoLock(templateVersion), nil
-	}
-	return database.TemplateVersion{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) getWorkspaceAgentByIDNoLock(_ context.Context, id uuid.UUID) (database.WorkspaceAgent, error) {
-	// The schema sorts this by created at, so we iterate the array backwards.
-	for i := len(q.workspaceAgents) - 1; i >= 0; i-- {
-		agent := q.workspaceAgents[i]
-		if agent.ID == id {
-			return agent, nil
-		}
-	}
-	return database.WorkspaceAgent{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) getWorkspaceAgentsByResourceIDsNoLock(_ context.Context, resourceIDs []uuid.UUID) ([]database.WorkspaceAgent, error) {
-	workspaceAgents := make([]database.WorkspaceAgent, 0)
-	for _, agent := range q.workspaceAgents {
-		for _, resourceID := range resourceIDs {
-			if agent.ResourceID != resourceID {
-				continue
-			}
-			workspaceAgents = append(workspaceAgents, agent)
-		}
-	}
-	return workspaceAgents, nil
-}
-
-func (q *FakeQuerier) getProvisionerJobByIDNoLock(_ context.Context, id uuid.UUID) (database.ProvisionerJob, error) {
-	for _, provisionerJob := range q.provisionerJobs {
-		if provisionerJob.ID != id {
-			continue
-		}
-		return provisionerJob, nil
-	}
-	return database.ProvisionerJob{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) getWorkspaceResourcesByJobIDNoLock(_ context.Context, jobID uuid.UUID) ([]database.WorkspaceResource, error) {
-	resources := make([]database.WorkspaceResource, 0)
-	for _, resource := range q.workspaceResources {
-		if resource.JobID != jobID {
-			continue
-		}
-		resources = append(resources, resource)
-	}
-	return resources, nil
-}
-
-func (q *FakeQuerier) getGroupByIDNoLock(_ context.Context, id uuid.UUID) (database.Group, error) {
-	for _, group := range q.groups {
-		if group.ID == id {
-			return group, nil
-		}
-	}
-
-	return database.Group{}, sql.ErrNoRows
-}
-
-// isNull is only used in dbfake, so reflect is ok. Use this to make the logic
-// look more similar to the postgres.
-func isNull(v interface{}) bool {
-	return !isNotNull(v)
-}
-
-func isNotNull(v interface{}) bool {
-	return reflect.ValueOf(v).FieldByName("Valid").Bool()
-}
-
-// ErrUnimplemented is returned by methods only used by the enterprise/tailnet.pgCoord.  This coordinator explicitly
-// depends on  postgres triggers that announce changes on the pubsub.  Implementing support for this in the fake
-// database would  strongly couple the FakeQuerier to the pubsub, which is undesirable.  Furthermore, it makes little
-// sense to directly  test the pgCoord against anything other than postgres.  The FakeQuerier is designed to allow us to
-// test the Coderd  API, and for that kind of test, the in-memory, AGPL tailnet coordinator is sufficient.  Therefore,
-// these methods  remain unimplemented in the FakeQuerier.
-var ErrUnimplemented = xerrors.New("unimplemented")
-
-func uniqueSortedUUIDs(uuids []uuid.UUID) []uuid.UUID {
-	set := make(map[uuid.UUID]struct{})
-	for _, id := range uuids {
-		set[id] = struct{}{}
-	}
-	unique := make([]uuid.UUID, 0, len(set))
-	for id := range set {
-		unique = append(unique, id)
-	}
-	slices.SortFunc(unique, func(a, b uuid.UUID) bool {
-		return a.String() < b.String()
-	})
-	return unique
-}
-
-func (*FakeQuerier) AcquireLock(_ context.Context, _ int64) error {
-	return xerrors.New("AcquireLock must only be called within a transaction")
-}
-
-func (q *FakeQuerier) AcquireProvisionerJob(_ context.Context, arg database.AcquireProvisionerJobParams) (database.ProvisionerJob, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.ProvisionerJob{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, provisionerJob := range q.provisionerJobs {
-		if provisionerJob.StartedAt.Valid {
-			continue
-		}
-		found := false
-		for _, provisionerType := range arg.Types {
-			if provisionerJob.Provisioner != provisionerType {
-				continue
-			}
-			found = true
-			break
-		}
-		if !found {
-			continue
-		}
-		tags := map[string]string{}
-		if arg.Tags != nil {
-			err := json.Unmarshal(arg.Tags, &tags)
-			if err != nil {
-				return provisionerJob, xerrors.Errorf("unmarshal: %w", err)
-			}
-		}
-
-		missing := false
-		for key, value := range provisionerJob.Tags {
-			provided, found := tags[key]
-			if !found {
-				missing = true
-				break
-			}
-			if provided != value {
-				missing = true
-				break
-			}
-		}
-		if missing {
-			continue
-		}
-		provisionerJob.StartedAt = arg.StartedAt
-		provisionerJob.UpdatedAt = arg.StartedAt.Time
-		provisionerJob.WorkerID = arg.WorkerID
-		q.provisionerJobs[index] = provisionerJob
-		return provisionerJob, nil
-	}
-	return database.ProvisionerJob{}, sql.ErrNoRows
-}
-
-func (*FakeQuerier) CleanTailnetCoordinators(_ context.Context) error {
-	return ErrUnimplemented
-}
-
-func (q *FakeQuerier) DeleteAPIKeyByID(_ context.Context, id string) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, apiKey := range q.apiKeys {
-		if apiKey.ID != id {
-			continue
-		}
-		q.apiKeys[index] = q.apiKeys[len(q.apiKeys)-1]
-		q.apiKeys = q.apiKeys[:len(q.apiKeys)-1]
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) DeleteAPIKeysByUserID(_ context.Context, userID uuid.UUID) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i := len(q.apiKeys) - 1; i >= 0; i-- {
-		if q.apiKeys[i].UserID == userID {
-			q.apiKeys = append(q.apiKeys[:i], q.apiKeys[i+1:]...)
-		}
-	}
-
-	return nil
-}
-
-func (q *FakeQuerier) DeleteApplicationConnectAPIKeysByUserID(_ context.Context, userID uuid.UUID) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i := len(q.apiKeys) - 1; i >= 0; i-- {
-		if q.apiKeys[i].UserID == userID && q.apiKeys[i].Scope == database.APIKeyScopeApplicationConnect {
-			q.apiKeys = append(q.apiKeys[:i], q.apiKeys[i+1:]...)
-		}
-	}
-
-	return nil
-}
-
-func (*FakeQuerier) DeleteCoordinator(context.Context, uuid.UUID) error {
-	return ErrUnimplemented
-}
-
-func (q *FakeQuerier) DeleteGitSSHKey(_ context.Context, userID uuid.UUID) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, key := range q.gitSSHKey {
-		if key.UserID != userID {
-			continue
-		}
-		q.gitSSHKey[index] = q.gitSSHKey[len(q.gitSSHKey)-1]
-		q.gitSSHKey = q.gitSSHKey[:len(q.gitSSHKey)-1]
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) DeleteGroupByID(_ context.Context, id uuid.UUID) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, group := range q.groups {
-		if group.ID == id {
-			q.groups = append(q.groups[:i], q.groups[i+1:]...)
-			return nil
-		}
-	}
-
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) DeleteGroupMemberFromGroup(_ context.Context, arg database.DeleteGroupMemberFromGroupParams) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, member := range q.groupMembers {
-		if member.UserID == arg.UserID && member.GroupID == arg.GroupID {
-			q.groupMembers = append(q.groupMembers[:i], q.groupMembers[i+1:]...)
-		}
-	}
-	return nil
-}
-
-func (q *FakeQuerier) DeleteGroupMembersByOrgAndUser(_ context.Context, arg database.DeleteGroupMembersByOrgAndUserParams) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	newMembers := q.groupMembers[:0]
-	for _, member := range q.groupMembers {
-		if member.UserID != arg.UserID {
-			// Do not delete the other members
-			newMembers = append(newMembers, member)
-		} else if member.UserID == arg.UserID {
-			// We only want to delete from groups in the organization in the args.
-			for _, group := range q.groups {
-				// Find the group that the member is apartof.
-				if group.ID == member.GroupID {
-					// Only add back the member if the organization ID does not match
-					// the arg organization ID. Since the arg is saying which
-					// org to delete.
-					if group.OrganizationID != arg.OrganizationID {
-						newMembers = append(newMembers, member)
-					}
-					break
-				}
-			}
-		}
-	}
-	q.groupMembers = newMembers
-
-	return nil
-}
-
-func (q *FakeQuerier) DeleteLicense(_ context.Context, id int32) (int32, error) {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, l := range q.licenses {
-		if l.ID == id {
-			q.licenses[index] = q.licenses[len(q.licenses)-1]
-			q.licenses = q.licenses[:len(q.licenses)-1]
-			return id, nil
-		}
-	}
-	return 0, sql.ErrNoRows
-}
-
-func (*FakeQuerier) DeleteOldWorkspaceAgentLogs(_ context.Context) error {
-	// noop
-	return nil
-}
-
-func (*FakeQuerier) DeleteOldWorkspaceAgentStats(_ context.Context) error {
-	// no-op
-	return nil
-}
-
-func (q *FakeQuerier) DeleteReplicasUpdatedBefore(_ context.Context, before time.Time) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, replica := range q.replicas {
-		if replica.UpdatedAt.Before(before) {
-			q.replicas = append(q.replicas[:i], q.replicas[i+1:]...)
-		}
-	}
-
-	return nil
-}
-
-func (*FakeQuerier) DeleteTailnetAgent(context.Context, database.DeleteTailnetAgentParams) (database.DeleteTailnetAgentRow, error) {
-	return database.DeleteTailnetAgentRow{}, ErrUnimplemented
-}
-
-func (*FakeQuerier) DeleteTailnetClient(context.Context, database.DeleteTailnetClientParams) (database.DeleteTailnetClientRow, error) {
-	return database.DeleteTailnetClientRow{}, ErrUnimplemented
-}
-
-func (q *FakeQuerier) GetAPIKeyByID(_ context.Context, id string) (database.APIKey, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, apiKey := range q.apiKeys {
-		if apiKey.ID == id {
-			return apiKey, nil
-		}
-	}
-	return database.APIKey{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetAPIKeyByName(_ context.Context, params database.GetAPIKeyByNameParams) (database.APIKey, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	if params.TokenName == "" {
-		return database.APIKey{}, sql.ErrNoRows
-	}
-	for _, apiKey := range q.apiKeys {
-		if params.UserID == apiKey.UserID && params.TokenName == apiKey.TokenName {
-			return apiKey, nil
-		}
-	}
-	return database.APIKey{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetAPIKeysByLoginType(_ context.Context, t database.LoginType) ([]database.APIKey, error) {
-	if err := validateDatabaseType(t); err != nil {
-		return nil, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	apiKeys := make([]database.APIKey, 0)
-	for _, key := range q.apiKeys {
-		if key.LoginType == t {
-			apiKeys = append(apiKeys, key)
-		}
-	}
-	return apiKeys, nil
-}
-
-func (q *FakeQuerier) GetAPIKeysByUserID(_ context.Context, params database.GetAPIKeysByUserIDParams) ([]database.APIKey, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	apiKeys := make([]database.APIKey, 0)
-	for _, key := range q.apiKeys {
-		if key.UserID == params.UserID && key.LoginType == params.LoginType {
-			apiKeys = append(apiKeys, key)
-		}
-	}
-	return apiKeys, nil
-}
-
-func (q *FakeQuerier) GetAPIKeysLastUsedAfter(_ context.Context, after time.Time) ([]database.APIKey, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	apiKeys := make([]database.APIKey, 0)
-	for _, key := range q.apiKeys {
-		if key.LastUsed.After(after) {
-			apiKeys = append(apiKeys, key)
-		}
-	}
-	return apiKeys, nil
-}
-
-func (q *FakeQuerier) GetActiveUserCount(_ context.Context) (int64, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	active := int64(0)
-	for _, u := range q.users {
-		if u.Status == database.UserStatusActive && !u.Deleted {
-			active++
-		}
-	}
-	return active, nil
-}
-
-func (*FakeQuerier) GetAllTailnetAgents(_ context.Context) ([]database.TailnetAgent, error) {
-	return nil, ErrUnimplemented
-}
-
-func (*FakeQuerier) GetAllTailnetClients(_ context.Context) ([]database.TailnetClient, error) {
-	return nil, ErrUnimplemented
-}
-
-func (q *FakeQuerier) GetAppSecurityKey(_ context.Context) (string, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.appSecurityKey, nil
-}
-
-func (q *FakeQuerier) GetAuditLogsOffset(_ context.Context, arg database.GetAuditLogsOffsetParams) ([]database.GetAuditLogsOffsetRow, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return nil, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	logs := make([]database.GetAuditLogsOffsetRow, 0, arg.Limit)
-
-	// q.auditLogs are already sorted by time DESC, so no need to sort after the fact.
-	for _, alog := range q.auditLogs {
-		if arg.Offset > 0 {
-			arg.Offset--
-			continue
-		}
-		if arg.Action != "" && !strings.Contains(string(alog.Action), arg.Action) {
-			continue
-		}
-		if arg.ResourceType != "" && !strings.Contains(string(alog.ResourceType), arg.ResourceType) {
-			continue
-		}
-		if arg.ResourceID != uuid.Nil && alog.ResourceID != arg.ResourceID {
-			continue
-		}
-		if arg.Username != "" {
-			user, err := q.getUserByIDNoLock(alog.UserID)
-			if err == nil && !strings.EqualFold(arg.Username, user.Username) {
-				continue
-			}
-		}
-		if arg.Email != "" {
-			user, err := q.getUserByIDNoLock(alog.UserID)
-			if err == nil && !strings.EqualFold(arg.Email, user.Email) {
-				continue
-			}
-		}
-		if !arg.DateFrom.IsZero() {
-			if alog.Time.Before(arg.DateFrom) {
-				continue
-			}
-		}
-		if !arg.DateTo.IsZero() {
-			if alog.Time.After(arg.DateTo) {
-				continue
-			}
-		}
-		if arg.BuildReason != "" {
-			workspaceBuild, err := q.getWorkspaceBuildByIDNoLock(context.Background(), alog.ResourceID)
-			if err == nil && !strings.EqualFold(arg.BuildReason, string(workspaceBuild.Reason)) {
-				continue
-			}
-		}
-
-		user, err := q.getUserByIDNoLock(alog.UserID)
-		userValid := err == nil
-
-		logs = append(logs, database.GetAuditLogsOffsetRow{
-			ID:               alog.ID,
-			RequestID:        alog.RequestID,
-			OrganizationID:   alog.OrganizationID,
-			Ip:               alog.Ip,
-			UserAgent:        alog.UserAgent,
-			ResourceType:     alog.ResourceType,
-			ResourceID:       alog.ResourceID,
-			ResourceTarget:   alog.ResourceTarget,
-			ResourceIcon:     alog.ResourceIcon,
-			Action:           alog.Action,
-			Diff:             alog.Diff,
-			StatusCode:       alog.StatusCode,
-			AdditionalFields: alog.AdditionalFields,
-			UserID:           alog.UserID,
-			UserUsername:     sql.NullString{String: user.Username, Valid: userValid},
-			UserEmail:        sql.NullString{String: user.Email, Valid: userValid},
-			UserCreatedAt:    sql.NullTime{Time: user.CreatedAt, Valid: userValid},
-			UserStatus:       database.NullUserStatus{UserStatus: user.Status, Valid: userValid},
-			UserRoles:        user.RBACRoles,
-			Count:            0,
-		})
-
-		if len(logs) >= int(arg.Limit) {
-			break
-		}
-	}
-
-	count := int64(len(logs))
-	for i := range logs {
-		logs[i].Count = count
-	}
-
-	return logs, nil
-}
-
-func (q *FakeQuerier) GetAuthorizationUserRoles(_ context.Context, userID uuid.UUID) (database.GetAuthorizationUserRolesRow, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	var user *database.User
-	roles := make([]string, 0)
-	for _, u := range q.users {
-		if u.ID == userID {
-			u := u
-			roles = append(roles, u.RBACRoles...)
-			roles = append(roles, "member")
-			user = &u
-			break
-		}
-	}
-
-	for _, mem := range q.organizationMembers {
-		if mem.UserID == userID {
-			roles = append(roles, mem.Roles...)
-			roles = append(roles, "organization-member:"+mem.OrganizationID.String())
-		}
-	}
-
-	var groups []string
-	for _, member := range q.groupMembers {
-		if member.UserID == userID {
-			groups = append(groups, member.GroupID.String())
-		}
-	}
-
-	if user == nil {
-		return database.GetAuthorizationUserRolesRow{}, sql.ErrNoRows
-	}
-
-	return database.GetAuthorizationUserRolesRow{
-		ID:       userID,
-		Username: user.Username,
-		Status:   user.Status,
-		Roles:    roles,
-		Groups:   groups,
-	}, nil
-}
-
-func (q *FakeQuerier) GetDERPMeshKey(_ context.Context) (string, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.derpMeshKey, nil
-}
-
-func (q *FakeQuerier) GetDefaultProxyConfig(_ context.Context) (database.GetDefaultProxyConfigRow, error) {
-	return database.GetDefaultProxyConfigRow{
-		DisplayName: q.defaultProxyDisplayName,
-		IconUrl:     q.defaultProxyIconURL,
-	}, nil
-}
-
-func (q *FakeQuerier) GetDeploymentDAUs(_ context.Context, tzOffset int32) ([]database.GetDeploymentDAUsRow, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	seens := make(map[time.Time]map[uuid.UUID]struct{})
-
-	for _, as := range q.workspaceAgentStats {
-		if as.ConnectionCount == 0 {
-			continue
-		}
-		date := as.CreatedAt.UTC().Add(time.Duration(tzOffset) * -1 * time.Hour).Truncate(time.Hour * 24)
-
-		dateEntry := seens[date]
-		if dateEntry == nil {
-			dateEntry = make(map[uuid.UUID]struct{})
-		}
-		dateEntry[as.UserID] = struct{}{}
-		seens[date] = dateEntry
-	}
-
-	seenKeys := maps.Keys(seens)
-	sort.Slice(seenKeys, func(i, j int) bool {
-		return seenKeys[i].Before(seenKeys[j])
-	})
-
-	var rs []database.GetDeploymentDAUsRow
-	for _, key := range seenKeys {
-		ids := seens[key]
-		for id := range ids {
-			rs = append(rs, database.GetDeploymentDAUsRow{
-				Date:   key,
-				UserID: id,
-			})
-		}
-	}
-
-	return rs, nil
-}
-
-func (q *FakeQuerier) GetDeploymentID(_ context.Context) (string, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.deploymentID, nil
-}
-
-func (q *FakeQuerier) GetDeploymentWorkspaceAgentStats(_ context.Context, createdAfter time.Time) (database.GetDeploymentWorkspaceAgentStatsRow, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	agentStatsCreatedAfter := make([]database.WorkspaceAgentStat, 0)
-	for _, agentStat := range q.workspaceAgentStats {
-		if agentStat.CreatedAt.After(createdAfter) {
-			agentStatsCreatedAfter = append(agentStatsCreatedAfter, agentStat)
-		}
-	}
-
-	latestAgentStats := map[uuid.UUID]database.WorkspaceAgentStat{}
-	for _, agentStat := range q.workspaceAgentStats {
-		if agentStat.CreatedAt.After(createdAfter) {
-			latestAgentStats[agentStat.AgentID] = agentStat
-		}
-	}
-
-	stat := database.GetDeploymentWorkspaceAgentStatsRow{}
-	for _, agentStat := range latestAgentStats {
-		stat.SessionCountVSCode += agentStat.SessionCountVSCode
-		stat.SessionCountJetBrains += agentStat.SessionCountJetBrains
-		stat.SessionCountReconnectingPTY += agentStat.SessionCountReconnectingPTY
-		stat.SessionCountSSH += agentStat.SessionCountSSH
-	}
-
-	latencies := make([]float64, 0)
-	for _, agentStat := range agentStatsCreatedAfter {
-		if agentStat.ConnectionMedianLatencyMS <= 0 {
-			continue
-		}
-		stat.WorkspaceRxBytes += agentStat.RxBytes
-		stat.WorkspaceTxBytes += agentStat.TxBytes
-		latencies = append(latencies, agentStat.ConnectionMedianLatencyMS)
-	}
-
-	tryPercentile := func(fs []float64, p float64) float64 {
-		if len(fs) == 0 {
-			return -1
-		}
-		sort.Float64s(fs)
-		return fs[int(float64(len(fs))*p/100)]
-	}
-
-	stat.WorkspaceConnectionLatency50 = tryPercentile(latencies, 50)
-	stat.WorkspaceConnectionLatency95 = tryPercentile(latencies, 95)
-
-	return stat, nil
-}
-
-func (q *FakeQuerier) GetDeploymentWorkspaceStats(ctx context.Context) (database.GetDeploymentWorkspaceStatsRow, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	stat := database.GetDeploymentWorkspaceStatsRow{}
-	for _, workspace := range q.workspaces {
-		build, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspace.ID)
-		if err != nil {
-			return stat, err
-		}
-		job, err := q.getProvisionerJobByIDNoLock(ctx, build.JobID)
-		if err != nil {
-			return stat, err
-		}
-		if !job.StartedAt.Valid {
-			stat.PendingWorkspaces++
-			continue
-		}
-		if job.StartedAt.Valid &&
-			!job.CanceledAt.Valid &&
-			time.Since(job.UpdatedAt) <= 30*time.Second &&
-			!job.CompletedAt.Valid {
-			stat.BuildingWorkspaces++
-			continue
-		}
-		if job.CompletedAt.Valid &&
-			!job.CanceledAt.Valid &&
-			!job.Error.Valid {
-			if build.Transition == database.WorkspaceTransitionStart {
-				stat.RunningWorkspaces++
-			}
-			if build.Transition == database.WorkspaceTransitionStop {
-				stat.StoppedWorkspaces++
-			}
-			continue
-		}
-		if job.CanceledAt.Valid || job.Error.Valid {
-			stat.FailedWorkspaces++
-			continue
-		}
-	}
-	return stat, nil
-}
-
-func (q *FakeQuerier) GetFileByHashAndCreator(_ context.Context, arg database.GetFileByHashAndCreatorParams) (database.File, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.File{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, file := range q.files {
-		if file.Hash == arg.Hash && file.CreatedBy == arg.CreatedBy {
-			return file, nil
-		}
-	}
-	return database.File{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetFileByID(_ context.Context, id uuid.UUID) (database.File, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, file := range q.files {
-		if file.ID == id {
-			return file, nil
-		}
-	}
-	return database.File{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetFileTemplates(_ context.Context, id uuid.UUID) ([]database.GetFileTemplatesRow, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	rows := make([]database.GetFileTemplatesRow, 0)
-	var file database.File
-	for _, f := range q.files {
-		if f.ID == id {
-			file = f
-			break
-		}
-	}
-	if file.Hash == "" {
-		return rows, nil
-	}
-
-	for _, job := range q.provisionerJobs {
-		if job.FileID == id {
-			for _, version := range q.templateVersions {
-				if version.JobID == job.ID {
-					for _, template := range q.templates {
-						if template.ID == version.TemplateID.UUID {
-							rows = append(rows, database.GetFileTemplatesRow{
-								FileID:                 file.ID,
-								FileCreatedBy:          file.CreatedBy,
-								TemplateID:             template.ID,
-								TemplateOrganizationID: template.OrganizationID,
-								TemplateCreatedBy:      template.CreatedBy,
-								UserACL:                template.UserACL,
-								GroupACL:               template.GroupACL,
-							})
-						}
-					}
-				}
-			}
-		}
-	}
-
-	return rows, nil
-}
-
-func (q *FakeQuerier) GetGitAuthLink(_ context.Context, arg database.GetGitAuthLinkParams) (database.GitAuthLink, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.GitAuthLink{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-	for _, gitAuthLink := range q.gitAuthLinks {
-		if arg.UserID != gitAuthLink.UserID {
-			continue
-		}
-		if arg.ProviderID != gitAuthLink.ProviderID {
-			continue
-		}
-		return gitAuthLink, nil
-	}
-	return database.GitAuthLink{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetGitSSHKey(_ context.Context, userID uuid.UUID) (database.GitSSHKey, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, key := range q.gitSSHKey {
-		if key.UserID == userID {
-			return key, nil
-		}
-	}
-	return database.GitSSHKey{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetGroupByID(ctx context.Context, id uuid.UUID) (database.Group, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.getGroupByIDNoLock(ctx, id)
-}
-
-func (q *FakeQuerier) GetGroupByOrgAndName(_ context.Context, arg database.GetGroupByOrgAndNameParams) (database.Group, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.Group{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, group := range q.groups {
-		if group.OrganizationID == arg.OrganizationID &&
-			group.Name == arg.Name {
-			return group, nil
-		}
-	}
-
-	return database.Group{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetGroupMembers(_ context.Context, groupID uuid.UUID) ([]database.User, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	var members []database.GroupMember
-	for _, member := range q.groupMembers {
-		if member.GroupID == groupID {
-			members = append(members, member)
-		}
-	}
-
-	users := make([]database.User, 0, len(members))
-
-	for _, member := range members {
-		for _, user := range q.users {
-			if user.ID == member.UserID && user.Status == database.UserStatusActive && !user.Deleted {
-				users = append(users, user)
-				break
-			}
-		}
-	}
-
-	return users, nil
-}
-
-func (q *FakeQuerier) GetGroupsByOrganizationID(_ context.Context, organizationID uuid.UUID) ([]database.Group, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	var groups []database.Group
-	for _, group := range q.groups {
-		// Omit the allUsers group.
-		if group.OrganizationID == organizationID && group.ID != organizationID {
-			groups = append(groups, group)
-		}
-	}
-
-	return groups, nil
-}
-
-func (q *FakeQuerier) GetHungProvisionerJobs(_ context.Context, hungSince time.Time) ([]database.ProvisionerJob, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	hungJobs := []database.ProvisionerJob{}
-	for _, provisionerJob := range q.provisionerJobs {
-		if provisionerJob.StartedAt.Valid && !provisionerJob.CompletedAt.Valid && provisionerJob.UpdatedAt.Before(hungSince) {
-			hungJobs = append(hungJobs, provisionerJob)
-		}
-	}
-	return hungJobs, nil
-}
-
-func (q *FakeQuerier) GetLastUpdateCheck(_ context.Context) (string, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	if q.lastUpdateCheck == nil {
-		return "", sql.ErrNoRows
-	}
-	return string(q.lastUpdateCheck), nil
-}
-
-func (q *FakeQuerier) GetLatestWorkspaceBuildByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) (database.WorkspaceBuild, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspaceID)
-}
-
-func (q *FakeQuerier) GetLatestWorkspaceBuilds(_ context.Context) ([]database.WorkspaceBuild, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	builds := make(map[uuid.UUID]database.WorkspaceBuild)
-	buildNumbers := make(map[uuid.UUID]int32)
-	for _, workspaceBuild := range q.workspaceBuilds {
-		id := workspaceBuild.WorkspaceID
-		if workspaceBuild.BuildNumber > buildNumbers[id] {
-			builds[id] = q.workspaceBuildWithUserNoLock(workspaceBuild)
-			buildNumbers[id] = workspaceBuild.BuildNumber
-		}
-	}
-	var returnBuilds []database.WorkspaceBuild
-	for i, n := range buildNumbers {
-		if n > 0 {
-			b := builds[i]
-			returnBuilds = append(returnBuilds, b)
-		}
-	}
-	if len(returnBuilds) == 0 {
-		return nil, sql.ErrNoRows
-	}
-	return returnBuilds, nil
-}
-
-func (q *FakeQuerier) GetLatestWorkspaceBuildsByWorkspaceIDs(_ context.Context, ids []uuid.UUID) ([]database.WorkspaceBuild, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	builds := make(map[uuid.UUID]database.WorkspaceBuild)
-	buildNumbers := make(map[uuid.UUID]int32)
-	for _, workspaceBuild := range q.workspaceBuilds {
-		for _, id := range ids {
-			if id == workspaceBuild.WorkspaceID && workspaceBuild.BuildNumber > buildNumbers[id] {
-				builds[id] = q.workspaceBuildWithUserNoLock(workspaceBuild)
-				buildNumbers[id] = workspaceBuild.BuildNumber
-			}
-		}
-	}
-	var returnBuilds []database.WorkspaceBuild
-	for i, n := range buildNumbers {
-		if n > 0 {
-			b := builds[i]
-			returnBuilds = append(returnBuilds, b)
-		}
-	}
-	if len(returnBuilds) == 0 {
-		return nil, sql.ErrNoRows
-	}
-	return returnBuilds, nil
-}
-
-func (q *FakeQuerier) GetLicenseByID(_ context.Context, id int32) (database.License, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, license := range q.licenses {
-		if license.ID == id {
-			return license, nil
-		}
-	}
-	return database.License{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetLicenses(_ context.Context) ([]database.License, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	results := append([]database.License{}, q.licenses...)
-	sort.Slice(results, func(i, j int) bool { return results[i].ID < results[j].ID })
-	return results, nil
-}
-
-func (q *FakeQuerier) GetLogoURL(_ context.Context) (string, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	if q.logoURL == "" {
-		return "", sql.ErrNoRows
-	}
-
-	return q.logoURL, nil
-}
-
-func (q *FakeQuerier) GetOAuthSigningKey(_ context.Context) (string, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.oauthSigningKey, nil
-}
-
-func (q *FakeQuerier) GetOrganizationByID(_ context.Context, id uuid.UUID) (database.Organization, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, organization := range q.organizations {
-		if organization.ID == id {
-			return organization, nil
-		}
-	}
-	return database.Organization{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetOrganizationByName(_ context.Context, name string) (database.Organization, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, organization := range q.organizations {
-		if organization.Name == name {
-			return organization, nil
-		}
-	}
-	return database.Organization{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetOrganizationIDsByMemberIDs(_ context.Context, ids []uuid.UUID) ([]database.GetOrganizationIDsByMemberIDsRow, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	getOrganizationIDsByMemberIDRows := make([]database.GetOrganizationIDsByMemberIDsRow, 0, len(ids))
-	for _, userID := range ids {
-		userOrganizationIDs := make([]uuid.UUID, 0)
-		for _, membership := range q.organizationMembers {
-			if membership.UserID == userID {
-				userOrganizationIDs = append(userOrganizationIDs, membership.OrganizationID)
-			}
-		}
-		getOrganizationIDsByMemberIDRows = append(getOrganizationIDsByMemberIDRows, database.GetOrganizationIDsByMemberIDsRow{
-			UserID:          userID,
-			OrganizationIDs: userOrganizationIDs,
-		})
-	}
-	if len(getOrganizationIDsByMemberIDRows) == 0 {
-		return nil, sql.ErrNoRows
-	}
-	return getOrganizationIDsByMemberIDRows, nil
-}
-
-func (q *FakeQuerier) GetOrganizationMemberByUserID(_ context.Context, arg database.GetOrganizationMemberByUserIDParams) (database.OrganizationMember, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.OrganizationMember{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, organizationMember := range q.organizationMembers {
-		if organizationMember.OrganizationID != arg.OrganizationID {
-			continue
-		}
-		if organizationMember.UserID != arg.UserID {
-			continue
-		}
-		return organizationMember, nil
-	}
-	return database.OrganizationMember{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetOrganizationMembershipsByUserID(_ context.Context, userID uuid.UUID) ([]database.OrganizationMember, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	var memberships []database.OrganizationMember
-	for _, organizationMember := range q.organizationMembers {
-		mem := organizationMember
-		if mem.UserID != userID {
-			continue
-		}
-		memberships = append(memberships, mem)
-	}
-	return memberships, nil
-}
-
-func (q *FakeQuerier) GetOrganizations(_ context.Context) ([]database.Organization, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	if len(q.organizations) == 0 {
-		return nil, sql.ErrNoRows
-	}
-	return q.organizations, nil
-}
-
-func (q *FakeQuerier) GetOrganizationsByUserID(_ context.Context, userID uuid.UUID) ([]database.Organization, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	organizations := make([]database.Organization, 0)
-	for _, organizationMember := range q.organizationMembers {
-		if organizationMember.UserID != userID {
-			continue
-		}
-		for _, organization := range q.organizations {
-			if organization.ID != organizationMember.OrganizationID {
-				continue
-			}
-			organizations = append(organizations, organization)
-		}
-	}
-	if len(organizations) == 0 {
-		return nil, sql.ErrNoRows
-	}
-	return organizations, nil
-}
-
-func (q *FakeQuerier) GetParameterSchemasByJobID(_ context.Context, jobID uuid.UUID) ([]database.ParameterSchema, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	parameters := make([]database.ParameterSchema, 0)
-	for _, parameterSchema := range q.parameterSchemas {
-		if parameterSchema.JobID != jobID {
-			continue
-		}
-		parameters = append(parameters, parameterSchema)
-	}
-	if len(parameters) == 0 {
-		return nil, sql.ErrNoRows
-	}
-	sort.Slice(parameters, func(i, j int) bool {
-		return parameters[i].Index < parameters[j].Index
-	})
-	return parameters, nil
-}
-
-func (q *FakeQuerier) GetPreviousTemplateVersion(_ context.Context, arg database.GetPreviousTemplateVersionParams) (database.TemplateVersion, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.TemplateVersion{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	var currentTemplateVersion database.TemplateVersion
-	for _, templateVersion := range q.templateVersions {
-		if templateVersion.TemplateID != arg.TemplateID {
-			continue
-		}
-		if templateVersion.Name != arg.Name {
-			continue
-		}
-		if templateVersion.OrganizationID != arg.OrganizationID {
-			continue
-		}
-		currentTemplateVersion = q.templateVersionWithUserNoLock(templateVersion)
-		break
-	}
-
-	previousTemplateVersions := make([]database.TemplateVersion, 0)
-	for _, templateVersion := range q.templateVersions {
-		if templateVersion.ID == currentTemplateVersion.ID {
-			continue
-		}
-		if templateVersion.OrganizationID != arg.OrganizationID {
-			continue
-		}
-		if templateVersion.TemplateID != currentTemplateVersion.TemplateID {
-			continue
-		}
-
-		if templateVersion.CreatedAt.Before(currentTemplateVersion.CreatedAt) {
-			previousTemplateVersions = append(previousTemplateVersions, q.templateVersionWithUserNoLock(templateVersion))
-		}
-	}
-
-	if len(previousTemplateVersions) == 0 {
-		return database.TemplateVersion{}, sql.ErrNoRows
-	}
-
-	sort.Slice(previousTemplateVersions, func(i, j int) bool {
-		return previousTemplateVersions[i].CreatedAt.After(previousTemplateVersions[j].CreatedAt)
-	})
-
-	return previousTemplateVersions[0], nil
-}
-
-func (q *FakeQuerier) GetProvisionerDaemons(_ context.Context) ([]database.ProvisionerDaemon, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	if len(q.provisionerDaemons) == 0 {
-		return nil, sql.ErrNoRows
-	}
-	return q.provisionerDaemons, nil
-}
-
-func (q *FakeQuerier) GetProvisionerJobByID(ctx context.Context, id uuid.UUID) (database.ProvisionerJob, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.getProvisionerJobByIDNoLock(ctx, id)
-}
-
-func (q *FakeQuerier) GetProvisionerJobsByIDs(_ context.Context, ids []uuid.UUID) ([]database.ProvisionerJob, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	jobs := make([]database.ProvisionerJob, 0)
-	for _, job := range q.provisionerJobs {
-		for _, id := range ids {
-			if id == job.ID {
-				jobs = append(jobs, job)
-				break
-			}
-		}
-	}
-	if len(jobs) == 0 {
-		return nil, sql.ErrNoRows
-	}
-
-	return jobs, nil
-}
-
-func (q *FakeQuerier) GetProvisionerJobsByIDsWithQueuePosition(_ context.Context, ids []uuid.UUID) ([]database.GetProvisionerJobsByIDsWithQueuePositionRow, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	jobs := make([]database.GetProvisionerJobsByIDsWithQueuePositionRow, 0)
-	queuePosition := int64(1)
-	for _, job := range q.provisionerJobs {
-		for _, id := range ids {
-			if id == job.ID {
-				job := database.GetProvisionerJobsByIDsWithQueuePositionRow{
-					ProvisionerJob: job,
-				}
-				if !job.ProvisionerJob.StartedAt.Valid {
-					job.QueuePosition = queuePosition
-				}
-				jobs = append(jobs, job)
-				break
-			}
-		}
-		if !job.StartedAt.Valid {
-			queuePosition++
-		}
-	}
-	for _, job := range jobs {
-		if !job.ProvisionerJob.StartedAt.Valid {
-			// Set it to the max position!
-			job.QueueSize = queuePosition
-		}
-	}
-	return jobs, nil
-}
-
-func (q *FakeQuerier) GetProvisionerJobsCreatedAfter(_ context.Context, after time.Time) ([]database.ProvisionerJob, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	jobs := make([]database.ProvisionerJob, 0)
-	for _, job := range q.provisionerJobs {
-		if job.CreatedAt.After(after) {
-			jobs = append(jobs, job)
-		}
-	}
-	return jobs, nil
-}
-
-func (q *FakeQuerier) GetProvisionerLogsAfterID(_ context.Context, arg database.GetProvisionerLogsAfterIDParams) ([]database.ProvisionerJobLog, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return nil, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	logs := make([]database.ProvisionerJobLog, 0)
-	for _, jobLog := range q.provisionerJobLogs {
-		if jobLog.JobID != arg.JobID {
-			continue
-		}
-		if jobLog.ID <= arg.CreatedAfter {
-			continue
-		}
-		logs = append(logs, jobLog)
-	}
-	return logs, nil
-}
-
-func (q *FakeQuerier) GetQuotaAllowanceForUser(_ context.Context, userID uuid.UUID) (int64, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	var sum int64
-	for _, member := range q.groupMembers {
-		if member.UserID != userID {
-			continue
-		}
-		for _, group := range q.groups {
-			if group.ID == member.GroupID {
-				sum += int64(group.QuotaAllowance)
-			}
-		}
-	}
-	return sum, nil
-}
-
-func (q *FakeQuerier) GetQuotaConsumedForUser(_ context.Context, userID uuid.UUID) (int64, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	var sum int64
-	for _, workspace := range q.workspaces {
-		if workspace.OwnerID != userID {
-			continue
-		}
-		if workspace.Deleted {
-			continue
-		}
-
-		var lastBuild database.WorkspaceBuildTable
-		for _, build := range q.workspaceBuilds {
-			if build.WorkspaceID != workspace.ID {
-				continue
-			}
-			if build.CreatedAt.After(lastBuild.CreatedAt) {
-				lastBuild = build
-			}
-		}
-		sum += int64(lastBuild.DailyCost)
-	}
-	return sum, nil
-}
-
-func (q *FakeQuerier) GetReplicaByID(_ context.Context, id uuid.UUID) (database.Replica, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, replica := range q.replicas {
-		if replica.ID == id {
-			return replica, nil
-		}
-	}
-
-	return database.Replica{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetReplicasUpdatedAfter(_ context.Context, updatedAt time.Time) ([]database.Replica, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-	replicas := make([]database.Replica, 0)
-	for _, replica := range q.replicas {
-		if replica.UpdatedAt.After(updatedAt) && !replica.StoppedAt.Valid {
-			replicas = append(replicas, replica)
-		}
-	}
-	return replicas, nil
-}
-
-func (q *FakeQuerier) GetServiceBanner(_ context.Context) (string, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	if q.serviceBanner == nil {
-		return "", sql.ErrNoRows
-	}
-
-	return string(q.serviceBanner), nil
-}
-
-func (*FakeQuerier) GetTailnetAgents(context.Context, uuid.UUID) ([]database.TailnetAgent, error) {
-	return nil, ErrUnimplemented
-}
-
-func (*FakeQuerier) GetTailnetClientsForAgent(context.Context, uuid.UUID) ([]database.TailnetClient, error) {
-	return nil, ErrUnimplemented
-}
-
-func (q *FakeQuerier) GetTemplateAverageBuildTime(ctx context.Context, arg database.GetTemplateAverageBuildTimeParams) (database.GetTemplateAverageBuildTimeRow, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.GetTemplateAverageBuildTimeRow{}, err
-	}
-
-	var emptyRow database.GetTemplateAverageBuildTimeRow
-	var (
-		startTimes  []float64
-		stopTimes   []float64
-		deleteTimes []float64
-	)
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-	for _, wb := range q.workspaceBuilds {
-		version, err := q.getTemplateVersionByIDNoLock(ctx, wb.TemplateVersionID)
-		if err != nil {
-			return emptyRow, err
-		}
-		if version.TemplateID != arg.TemplateID {
-			continue
-		}
-
-		job, err := q.getProvisionerJobByIDNoLock(ctx, wb.JobID)
-		if err != nil {
-			return emptyRow, err
-		}
-		if job.CompletedAt.Valid {
-			took := job.CompletedAt.Time.Sub(job.StartedAt.Time).Seconds()
-			switch wb.Transition {
-			case database.WorkspaceTransitionStart:
-				startTimes = append(startTimes, took)
-			case database.WorkspaceTransitionStop:
-				stopTimes = append(stopTimes, took)
-			case database.WorkspaceTransitionDelete:
-				deleteTimes = append(deleteTimes, took)
-			}
-		}
-	}
-
-	tryPercentile := func(fs []float64, p float64) float64 {
-		if len(fs) == 0 {
-			return -1
-		}
-		sort.Float64s(fs)
-		return fs[int(float64(len(fs))*p/100)]
-	}
-
-	var row database.GetTemplateAverageBuildTimeRow
-	row.Delete50, row.Delete95 = tryPercentile(deleteTimes, 50), tryPercentile(deleteTimes, 95)
-	row.Stop50, row.Stop95 = tryPercentile(stopTimes, 50), tryPercentile(stopTimes, 95)
-	row.Start50, row.Start95 = tryPercentile(startTimes, 50), tryPercentile(startTimes, 95)
-	return row, nil
-}
-
-func (q *FakeQuerier) GetTemplateByID(ctx context.Context, id uuid.UUID) (database.Template, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.getTemplateByIDNoLock(ctx, id)
-}
-
-func (q *FakeQuerier) GetTemplateByOrganizationAndName(_ context.Context, arg database.GetTemplateByOrganizationAndNameParams) (database.Template, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.Template{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, template := range q.templates {
-		if template.OrganizationID != arg.OrganizationID {
-			continue
-		}
-		if !strings.EqualFold(template.Name, arg.Name) {
-			continue
-		}
-		if template.Deleted != arg.Deleted {
-			continue
-		}
-		return q.templateWithUserNoLock(template), nil
-	}
-	return database.Template{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetTemplateDAUs(_ context.Context, arg database.GetTemplateDAUsParams) ([]database.GetTemplateDAUsRow, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	seens := make(map[time.Time]map[uuid.UUID]struct{})
-
-	for _, as := range q.workspaceAgentStats {
-		if as.TemplateID != arg.TemplateID {
-			continue
-		}
-		if as.ConnectionCount == 0 {
-			continue
-		}
-
-		date := as.CreatedAt.UTC().Add(time.Duration(arg.TzOffset) * time.Hour * -1).Truncate(time.Hour * 24)
-
-		dateEntry := seens[date]
-		if dateEntry == nil {
-			dateEntry = make(map[uuid.UUID]struct{})
-		}
-		dateEntry[as.UserID] = struct{}{}
-		seens[date] = dateEntry
-	}
-
-	seenKeys := maps.Keys(seens)
-	sort.Slice(seenKeys, func(i, j int) bool {
-		return seenKeys[i].Before(seenKeys[j])
-	})
-
-	var rs []database.GetTemplateDAUsRow
-	for _, key := range seenKeys {
-		ids := seens[key]
-		for id := range ids {
-			rs = append(rs, database.GetTemplateDAUsRow{
-				Date:   key,
-				UserID: id,
-			})
-		}
-	}
-
-	return rs, nil
-}
-
-func (q *FakeQuerier) GetTemplateDailyInsights(_ context.Context, arg database.GetTemplateDailyInsightsParams) ([]database.GetTemplateDailyInsightsRow, error) {
-	err := validateDatabaseType(arg)
-	if err != nil {
-		return nil, err
-	}
-
-	type dailyStat struct {
-		startTime, endTime time.Time
-		userSet            map[uuid.UUID]struct{}
-		templateIDSet      map[uuid.UUID]struct{}
-	}
-	dailyStats := []dailyStat{{arg.StartTime, arg.StartTime.AddDate(0, 0, 1), make(map[uuid.UUID]struct{}), make(map[uuid.UUID]struct{})}}
-	for dailyStats[len(dailyStats)-1].endTime.Before(arg.EndTime) {
-		dailyStats = append(dailyStats, dailyStat{dailyStats[len(dailyStats)-1].endTime, dailyStats[len(dailyStats)-1].endTime.AddDate(0, 0, 1), make(map[uuid.UUID]struct{}), make(map[uuid.UUID]struct{})})
-	}
-	if dailyStats[len(dailyStats)-1].endTime.After(arg.EndTime) {
-		dailyStats[len(dailyStats)-1].endTime = arg.EndTime
-	}
-
-	for _, s := range q.workspaceAgentStats {
-		if s.CreatedAt.Before(arg.StartTime) || s.CreatedAt.Equal(arg.EndTime) || s.CreatedAt.After(arg.EndTime) {
-			continue
-		}
-		if len(arg.TemplateIDs) > 0 && !slices.Contains(arg.TemplateIDs, s.TemplateID) {
-			continue
-		}
-		if s.ConnectionCount == 0 {
-			continue
-		}
-
-		for _, ds := range dailyStats {
-			if s.CreatedAt.Before(ds.startTime) || s.CreatedAt.Equal(ds.endTime) || s.CreatedAt.After(ds.endTime) {
-				continue
-			}
-			ds.userSet[s.UserID] = struct{}{}
-			ds.templateIDSet[s.TemplateID] = struct{}{}
-			break
-		}
-	}
-
-	var result []database.GetTemplateDailyInsightsRow
-	for _, ds := range dailyStats {
-		templateIDs := make([]uuid.UUID, 0, len(ds.templateIDSet))
-		for templateID := range ds.templateIDSet {
-			templateIDs = append(templateIDs, templateID)
-		}
-		slices.SortFunc(templateIDs, func(a, b uuid.UUID) bool {
-			return a.String() < b.String()
-		})
-		result = append(result, database.GetTemplateDailyInsightsRow{
-			StartTime:   ds.startTime,
-			EndTime:     ds.endTime,
-			TemplateIDs: templateIDs,
-			ActiveUsers: int64(len(ds.userSet)),
-		})
-	}
-	return result, nil
-}
-
-func (q *FakeQuerier) GetTemplateInsights(_ context.Context, arg database.GetTemplateInsightsParams) (database.GetTemplateInsightsRow, error) {
-	err := validateDatabaseType(arg)
-	if err != nil {
-		return database.GetTemplateInsightsRow{}, err
-	}
-
-	templateIDSet := make(map[uuid.UUID]struct{})
-	appUsageIntervalsByUser := make(map[uuid.UUID]map[time.Time]*database.GetTemplateInsightsRow)
-	for _, s := range q.workspaceAgentStats {
-		if s.CreatedAt.Before(arg.StartTime) || s.CreatedAt.Equal(arg.EndTime) || s.CreatedAt.After(arg.EndTime) {
-			continue
-		}
-		if len(arg.TemplateIDs) > 0 && !slices.Contains(arg.TemplateIDs, s.TemplateID) {
-			continue
-		}
-		if s.ConnectionCount == 0 {
-			continue
-		}
-
-		templateIDSet[s.TemplateID] = struct{}{}
-		if appUsageIntervalsByUser[s.UserID] == nil {
-			appUsageIntervalsByUser[s.UserID] = make(map[time.Time]*database.GetTemplateInsightsRow)
-		}
-		t := s.CreatedAt.Truncate(5 * time.Minute)
-		if _, ok := appUsageIntervalsByUser[s.UserID][t]; !ok {
-			appUsageIntervalsByUser[s.UserID][t] = &database.GetTemplateInsightsRow{}
-		}
-
-		if s.SessionCountJetBrains > 0 {
-			appUsageIntervalsByUser[s.UserID][t].UsageJetbrainsSeconds = 300
-		}
-		if s.SessionCountVSCode > 0 {
-			appUsageIntervalsByUser[s.UserID][t].UsageVscodeSeconds = 300
-		}
-		if s.SessionCountReconnectingPTY > 0 {
-			appUsageIntervalsByUser[s.UserID][t].UsageReconnectingPtySeconds = 300
-		}
-		if s.SessionCountSSH > 0 {
-			appUsageIntervalsByUser[s.UserID][t].UsageSshSeconds = 300
-		}
-	}
-
-	templateIDs := make([]uuid.UUID, 0, len(templateIDSet))
-	for templateID := range templateIDSet {
-		templateIDs = append(templateIDs, templateID)
-	}
-	slices.SortFunc(templateIDs, func(a, b uuid.UUID) bool {
-		return a.String() < b.String()
-	})
-	result := database.GetTemplateInsightsRow{
-		TemplateIDs: templateIDs,
-		ActiveUsers: int64(len(appUsageIntervalsByUser)),
-	}
-	for _, intervals := range appUsageIntervalsByUser {
-		for _, interval := range intervals {
-			result.UsageJetbrainsSeconds += interval.UsageJetbrainsSeconds
-			result.UsageVscodeSeconds += interval.UsageVscodeSeconds
-			result.UsageReconnectingPtySeconds += interval.UsageReconnectingPtySeconds
-			result.UsageSshSeconds += interval.UsageSshSeconds
-		}
-	}
-	return result, nil
-}
-
-func (q *FakeQuerier) GetTemplateParameterInsights(ctx context.Context, arg database.GetTemplateParameterInsightsParams) ([]database.GetTemplateParameterInsightsRow, error) {
-	err := validateDatabaseType(arg)
-	if err != nil {
-		return nil, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	// WITH latest_workspace_builds ...
-	latestWorkspaceBuilds := make(map[uuid.UUID]database.WorkspaceBuildTable)
-	for _, wb := range q.workspaceBuilds {
-		if wb.CreatedAt.Before(arg.StartTime) || wb.CreatedAt.Equal(arg.EndTime) || wb.CreatedAt.After(arg.EndTime) {
-			continue
-		}
-		if latestWorkspaceBuilds[wb.WorkspaceID].BuildNumber < wb.BuildNumber {
-			latestWorkspaceBuilds[wb.WorkspaceID] = wb
-		}
-	}
-	if len(arg.TemplateIDs) > 0 {
-		for wsID := range latestWorkspaceBuilds {
-			ws, err := q.getWorkspaceByIDNoLock(ctx, wsID)
-			if err != nil {
-				return nil, err
-			}
-			if slices.Contains(arg.TemplateIDs, ws.TemplateID) {
-				delete(latestWorkspaceBuilds, wsID)
-			}
-		}
-	}
-	// WITH unique_template_params ...
-	num := int64(0)
-	uniqueTemplateParams := make(map[string]*database.GetTemplateParameterInsightsRow)
-	uniqueTemplateParamWorkspaceBuildIDs := make(map[string][]uuid.UUID)
-	for _, wb := range latestWorkspaceBuilds {
-		tv, err := q.getTemplateVersionByIDNoLock(ctx, wb.TemplateVersionID)
-		if err != nil {
-			return nil, err
-		}
-		for _, tvp := range q.templateVersionParameters {
-			if tvp.TemplateVersionID != tv.ID {
-				continue
-			}
-			key := fmt.Sprintf("%s:%s:%s:%s", tvp.Name, tvp.DisplayName, tvp.Description, tvp.Options)
-			if _, ok := uniqueTemplateParams[key]; !ok {
-				num++
-				uniqueTemplateParams[key] = &database.GetTemplateParameterInsightsRow{
-					Num:         num,
-					Name:        tvp.Name,
-					DisplayName: tvp.DisplayName,
-					Description: tvp.Description,
-					Options:     tvp.Options,
-				}
-			}
-			uniqueTemplateParams[key].TemplateIDs = append(uniqueTemplateParams[key].TemplateIDs, tv.TemplateID.UUID)
-			uniqueTemplateParamWorkspaceBuildIDs[key] = append(uniqueTemplateParamWorkspaceBuildIDs[key], wb.ID)
-		}
-	}
-	// SELECT ...
-	counts := make(map[string]map[string]int64)
-	for key, utp := range uniqueTemplateParams {
-		for _, wbp := range q.workspaceBuildParameters {
-			if !slices.Contains(uniqueTemplateParamWorkspaceBuildIDs[key], wbp.WorkspaceBuildID) {
-				continue
-			}
-			if wbp.Name != utp.Name {
-				continue
-			}
-			if counts[key] == nil {
-				counts[key] = make(map[string]int64)
-			}
-			counts[key][wbp.Value]++
-		}
-	}
-
-	var rows []database.GetTemplateParameterInsightsRow
-	for key, utp := range uniqueTemplateParams {
-		for value, count := range counts[key] {
-			rows = append(rows, database.GetTemplateParameterInsightsRow{
-				Num:         utp.Num,
-				TemplateIDs: uniqueSortedUUIDs(utp.TemplateIDs),
-				Name:        utp.Name,
-				DisplayName: utp.DisplayName,
-				Description: utp.Description,
-				Options:     utp.Options,
-				Value:       value,
-				Count:       count,
-			})
-		}
-	}
-
-	return rows, nil
-}
-
-func (q *FakeQuerier) GetTemplateVersionByID(ctx context.Context, templateVersionID uuid.UUID) (database.TemplateVersion, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.getTemplateVersionByIDNoLock(ctx, templateVersionID)
-}
-
-func (q *FakeQuerier) GetTemplateVersionByJobID(_ context.Context, jobID uuid.UUID) (database.TemplateVersion, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, templateVersion := range q.templateVersions {
-		if templateVersion.JobID != jobID {
-			continue
-		}
-		return q.templateVersionWithUserNoLock(templateVersion), nil
-	}
-	return database.TemplateVersion{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetTemplateVersionByTemplateIDAndName(_ context.Context, arg database.GetTemplateVersionByTemplateIDAndNameParams) (database.TemplateVersion, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.TemplateVersion{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, templateVersion := range q.templateVersions {
-		if templateVersion.TemplateID != arg.TemplateID {
-			continue
-		}
-		if !strings.EqualFold(templateVersion.Name, arg.Name) {
-			continue
-		}
-		return q.templateVersionWithUserNoLock(templateVersion), nil
-	}
-	return database.TemplateVersion{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetTemplateVersionParameters(_ context.Context, templateVersionID uuid.UUID) ([]database.TemplateVersionParameter, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	parameters := make([]database.TemplateVersionParameter, 0)
-	for _, param := range q.templateVersionParameters {
-		if param.TemplateVersionID != templateVersionID {
-			continue
-		}
-		parameters = append(parameters, param)
-	}
-	sort.Slice(parameters, func(i, j int) bool {
-		if parameters[i].DisplayOrder != parameters[j].DisplayOrder {
-			return parameters[i].DisplayOrder < parameters[j].DisplayOrder
-		}
-		return strings.ToLower(parameters[i].Name) < strings.ToLower(parameters[j].Name)
-	})
-	return parameters, nil
-}
-
-func (q *FakeQuerier) GetTemplateVersionVariables(_ context.Context, templateVersionID uuid.UUID) ([]database.TemplateVersionVariable, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	variables := make([]database.TemplateVersionVariable, 0)
-	for _, variable := range q.templateVersionVariables {
-		if variable.TemplateVersionID != templateVersionID {
-			continue
-		}
-		variables = append(variables, variable)
-	}
-	return variables, nil
-}
-
-func (q *FakeQuerier) GetTemplateVersionsByIDs(_ context.Context, ids []uuid.UUID) ([]database.TemplateVersion, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	versions := make([]database.TemplateVersion, 0)
-	for _, version := range q.templateVersions {
-		for _, id := range ids {
-			if id == version.ID {
-				versions = append(versions, q.templateVersionWithUserNoLock(version))
-				break
-			}
-		}
-	}
-	if len(versions) == 0 {
-		return nil, sql.ErrNoRows
-	}
-
-	return versions, nil
-}
-
-func (q *FakeQuerier) GetTemplateVersionsByTemplateID(_ context.Context, arg database.GetTemplateVersionsByTemplateIDParams) (version []database.TemplateVersion, err error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return version, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, templateVersion := range q.templateVersions {
-		if templateVersion.TemplateID.UUID != arg.TemplateID {
-			continue
-		}
-		version = append(version, q.templateVersionWithUserNoLock(templateVersion))
-	}
-
-	// Database orders by created_at
-	slices.SortFunc(version, func(a, b database.TemplateVersion) bool {
-		if a.CreatedAt.Equal(b.CreatedAt) {
-			// Technically the postgres database also orders by uuid. So match
-			// that behavior
-			return a.ID.String() < b.ID.String()
-		}
-		return a.CreatedAt.Before(b.CreatedAt)
-	})
-
-	if arg.AfterID != uuid.Nil {
-		found := false
-		for i, v := range version {
-			if v.ID == arg.AfterID {
-				// We want to return all users after index i.
-				version = version[i+1:]
-				found = true
-				break
-			}
-		}
-
-		// If no users after the time, then we return an empty list.
-		if !found {
-			return nil, sql.ErrNoRows
-		}
-	}
-
-	if arg.OffsetOpt > 0 {
-		if int(arg.OffsetOpt) > len(version)-1 {
-			return nil, sql.ErrNoRows
-		}
-		version = version[arg.OffsetOpt:]
-	}
-
-	if arg.LimitOpt > 0 {
-		if int(arg.LimitOpt) > len(version) {
-			arg.LimitOpt = int32(len(version))
-		}
-		version = version[:arg.LimitOpt]
-	}
-
-	if len(version) == 0 {
-		return nil, sql.ErrNoRows
-	}
-
-	return version, nil
-}
-
-func (q *FakeQuerier) GetTemplateVersionsCreatedAfter(_ context.Context, after time.Time) ([]database.TemplateVersion, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	versions := make([]database.TemplateVersion, 0)
-	for _, version := range q.templateVersions {
-		if version.CreatedAt.After(after) {
-			versions = append(versions, q.templateVersionWithUserNoLock(version))
-		}
-	}
-	return versions, nil
-}
-
-func (q *FakeQuerier) GetTemplates(_ context.Context) ([]database.Template, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	templates := slices.Clone(q.templates)
-	slices.SortFunc(templates, func(i, j database.TemplateTable) bool {
-		if i.Name != j.Name {
-			return i.Name < j.Name
-		}
-		return i.ID.String() < j.ID.String()
-	})
-
-	return q.templatesWithUserNoLock(templates), nil
-}
-
-func (q *FakeQuerier) GetTemplatesWithFilter(ctx context.Context, arg database.GetTemplatesWithFilterParams) ([]database.Template, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return nil, err
-	}
-
-	return q.GetAuthorizedTemplates(ctx, arg, nil)
-}
-
-func (q *FakeQuerier) GetUnexpiredLicenses(_ context.Context) ([]database.License, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	now := time.Now()
-	var results []database.License
-	for _, l := range q.licenses {
-		if l.Exp.After(now) {
-			results = append(results, l)
-		}
-	}
-	sort.Slice(results, func(i, j int) bool { return results[i].ID < results[j].ID })
-	return results, nil
-}
-
-func (q *FakeQuerier) GetUserByEmailOrUsername(_ context.Context, arg database.GetUserByEmailOrUsernameParams) (database.User, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.User{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, user := range q.users {
-		if !user.Deleted && (strings.EqualFold(user.Email, arg.Email) || strings.EqualFold(user.Username, arg.Username)) {
-			return user, nil
-		}
-	}
-	return database.User{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetUserByID(_ context.Context, id uuid.UUID) (database.User, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.getUserByIDNoLock(id)
-}
-
-func (q *FakeQuerier) GetUserCount(_ context.Context) (int64, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	existing := int64(0)
-	for _, u := range q.users {
-		if !u.Deleted {
-			existing++
-		}
-	}
-	return existing, nil
-}
-
-func (q *FakeQuerier) GetUserLatencyInsights(_ context.Context, arg database.GetUserLatencyInsightsParams) ([]database.GetUserLatencyInsightsRow, error) {
-	err := validateDatabaseType(arg)
-	if err != nil {
-		return nil, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	latenciesByUserID := make(map[uuid.UUID][]float64)
-	seenTemplatesByUserID := make(map[uuid.UUID]map[uuid.UUID]struct{})
-	for _, s := range q.workspaceAgentStats {
-		if len(arg.TemplateIDs) > 0 && !slices.Contains(arg.TemplateIDs, s.TemplateID) {
-			continue
-		}
-		if !arg.StartTime.Equal(s.CreatedAt) && (s.CreatedAt.Before(arg.StartTime) || s.CreatedAt.After(arg.EndTime)) {
-			continue
-		}
-		if s.ConnectionCount == 0 {
-			continue
-		}
-		if s.ConnectionMedianLatencyMS <= 0 {
-			continue
-		}
-
-		latenciesByUserID[s.UserID] = append(latenciesByUserID[s.UserID], s.ConnectionMedianLatencyMS)
-		if seenTemplatesByUserID[s.UserID] == nil {
-			seenTemplatesByUserID[s.UserID] = make(map[uuid.UUID]struct{})
-		}
-		seenTemplatesByUserID[s.UserID][s.TemplateID] = struct{}{}
-	}
-
-	tryPercentile := func(fs []float64, p float64) float64 {
-		if len(fs) == 0 {
-			return -1
-		}
-		sort.Float64s(fs)
-		return fs[int(float64(len(fs))*p/100)]
-	}
-
-	var rows []database.GetUserLatencyInsightsRow
-	for userID, latencies := range latenciesByUserID {
-		sort.Float64s(latencies)
-		templateIDSet := seenTemplatesByUserID[userID]
-		templateIDs := make([]uuid.UUID, 0, len(templateIDSet))
-		for templateID := range templateIDSet {
-			templateIDs = append(templateIDs, templateID)
-		}
-		slices.SortFunc(templateIDs, func(a, b uuid.UUID) bool {
-			return a.String() < b.String()
-		})
-		user, err := q.getUserByIDNoLock(userID)
-		if err != nil {
-			return nil, err
-		}
-		row := database.GetUserLatencyInsightsRow{
-			UserID:                       userID,
-			Username:                     user.Username,
-			AvatarURL:                    user.AvatarURL,
-			TemplateIDs:                  templateIDs,
-			WorkspaceConnectionLatency50: tryPercentile(latencies, 50),
-			WorkspaceConnectionLatency95: tryPercentile(latencies, 95),
-		}
-		rows = append(rows, row)
-	}
-	slices.SortFunc(rows, func(a, b database.GetUserLatencyInsightsRow) bool {
-		return a.UserID.String() < b.UserID.String()
-	})
-
-	return rows, nil
-}
-
-func (q *FakeQuerier) GetUserLinkByLinkedID(_ context.Context, id string) (database.UserLink, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, link := range q.userLinks {
-		if link.LinkedID == id {
-			return link, nil
-		}
-	}
-	return database.UserLink{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetUserLinkByUserIDLoginType(_ context.Context, params database.GetUserLinkByUserIDLoginTypeParams) (database.UserLink, error) {
-	if err := validateDatabaseType(params); err != nil {
-		return database.UserLink{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, link := range q.userLinks {
-		if link.UserID == params.UserID && link.LoginType == params.LoginType {
-			return link, nil
-		}
-	}
-	return database.UserLink{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetUsers(_ context.Context, params database.GetUsersParams) ([]database.GetUsersRow, error) {
-	if err := validateDatabaseType(params); err != nil {
-		return nil, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	// Avoid side-effect of sorting.
-	users := make([]database.User, len(q.users))
-	copy(users, q.users)
-
-	// Database orders by username
-	slices.SortFunc(users, func(a, b database.User) bool {
-		return strings.ToLower(a.Username) < strings.ToLower(b.Username)
-	})
-
-	// Filter out deleted since they should never be returned..
-	tmp := make([]database.User, 0, len(users))
-	for _, user := range users {
-		if !user.Deleted {
-			tmp = append(tmp, user)
-		}
-	}
-	users = tmp
-
-	if params.AfterID != uuid.Nil {
-		found := false
-		for i, v := range users {
-			if v.ID == params.AfterID {
-				// We want to return all users after index i.
-				users = users[i+1:]
-				found = true
-				break
-			}
-		}
-
-		// If no users after the time, then we return an empty list.
-		if !found {
-			return []database.GetUsersRow{}, nil
-		}
-	}
-
-	if params.Search != "" {
-		tmp := make([]database.User, 0, len(users))
-		for i, user := range users {
-			if strings.Contains(strings.ToLower(user.Email), strings.ToLower(params.Search)) {
-				tmp = append(tmp, users[i])
-			} else if strings.Contains(strings.ToLower(user.Username), strings.ToLower(params.Search)) {
-				tmp = append(tmp, users[i])
-			}
-		}
-		users = tmp
-	}
-
-	if len(params.Status) > 0 {
-		usersFilteredByStatus := make([]database.User, 0, len(users))
-		for i, user := range users {
-			if slice.ContainsCompare(params.Status, user.Status, func(a, b database.UserStatus) bool {
-				return strings.EqualFold(string(a), string(b))
-			}) {
-				usersFilteredByStatus = append(usersFilteredByStatus, users[i])
-			}
-		}
-		users = usersFilteredByStatus
-	}
-
-	if len(params.RbacRole) > 0 && !slice.Contains(params.RbacRole, rbac.RoleMember()) {
-		usersFilteredByRole := make([]database.User, 0, len(users))
-		for i, user := range users {
-			if slice.OverlapCompare(params.RbacRole, user.RBACRoles, strings.EqualFold) {
-				usersFilteredByRole = append(usersFilteredByRole, users[i])
-			}
-		}
-		users = usersFilteredByRole
-	}
-
-	if !params.LastSeenBefore.IsZero() {
-		usersFilteredByLastSeen := make([]database.User, 0, len(users))
-		for i, user := range users {
-			if user.LastSeenAt.Before(params.LastSeenBefore) {
-				usersFilteredByLastSeen = append(usersFilteredByLastSeen, users[i])
-			}
-		}
-		users = usersFilteredByLastSeen
-	}
-
-	if !params.LastSeenAfter.IsZero() {
-		usersFilteredByLastSeen := make([]database.User, 0, len(users))
-		for i, user := range users {
-			if user.LastSeenAt.After(params.LastSeenAfter) {
-				usersFilteredByLastSeen = append(usersFilteredByLastSeen, users[i])
-			}
-		}
-		users = usersFilteredByLastSeen
-	}
-
-	beforePageCount := len(users)
-
-	if params.OffsetOpt > 0 {
-		if int(params.OffsetOpt) > len(users)-1 {
-			return []database.GetUsersRow{}, nil
-		}
-		users = users[params.OffsetOpt:]
-	}
-
-	if params.LimitOpt > 0 {
-		if int(params.LimitOpt) > len(users) {
-			params.LimitOpt = int32(len(users))
-		}
-		users = users[:params.LimitOpt]
-	}
-
-	return convertUsers(users, int64(beforePageCount)), nil
-}
-
-func (q *FakeQuerier) GetUsersByIDs(_ context.Context, ids []uuid.UUID) ([]database.User, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	users := make([]database.User, 0)
-	for _, user := range q.users {
-		for _, id := range ids {
-			if user.ID != id {
-				continue
-			}
-			users = append(users, user)
-		}
-	}
-	return users, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceAgentByAuthToken(_ context.Context, authToken uuid.UUID) (database.WorkspaceAgent, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	// The schema sorts this by created at, so we iterate the array backwards.
-	for i := len(q.workspaceAgents) - 1; i >= 0; i-- {
-		agent := q.workspaceAgents[i]
-		if agent.AuthToken == authToken {
-			return agent, nil
-		}
-	}
-	return database.WorkspaceAgent{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetWorkspaceAgentByID(ctx context.Context, id uuid.UUID) (database.WorkspaceAgent, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.getWorkspaceAgentByIDNoLock(ctx, id)
-}
-
-func (q *FakeQuerier) GetWorkspaceAgentByInstanceID(_ context.Context, instanceID string) (database.WorkspaceAgent, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	// The schema sorts this by created at, so we iterate the array backwards.
-	for i := len(q.workspaceAgents) - 1; i >= 0; i-- {
-		agent := q.workspaceAgents[i]
-		if agent.AuthInstanceID.Valid && agent.AuthInstanceID.String == instanceID {
-			return agent, nil
-		}
-	}
-	return database.WorkspaceAgent{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetWorkspaceAgentLifecycleStateByID(ctx context.Context, id uuid.UUID) (database.GetWorkspaceAgentLifecycleStateByIDRow, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	agent, err := q.getWorkspaceAgentByIDNoLock(ctx, id)
-	if err != nil {
-		return database.GetWorkspaceAgentLifecycleStateByIDRow{}, err
-	}
-	return database.GetWorkspaceAgentLifecycleStateByIDRow{
-		LifecycleState: agent.LifecycleState,
-		StartedAt:      agent.StartedAt,
-		ReadyAt:        agent.ReadyAt,
-	}, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceAgentLogsAfter(_ context.Context, arg database.GetWorkspaceAgentLogsAfterParams) ([]database.WorkspaceAgentLog, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return nil, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	logs := []database.WorkspaceAgentLog{}
-	for _, log := range q.workspaceAgentLogs {
-		if log.AgentID != arg.AgentID {
-			continue
-		}
-		if arg.CreatedAfter != 0 && log.ID <= arg.CreatedAfter {
-			continue
-		}
-		logs = append(logs, log)
-	}
-	return logs, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceAgentMetadata(_ context.Context, workspaceAgentID uuid.UUID) ([]database.WorkspaceAgentMetadatum, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	metadata := make([]database.WorkspaceAgentMetadatum, 0)
-	for _, m := range q.workspaceAgentMetadata {
-		if m.WorkspaceAgentID == workspaceAgentID {
-			metadata = append(metadata, m)
-		}
-	}
-	return metadata, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceAgentStats(_ context.Context, createdAfter time.Time) ([]database.GetWorkspaceAgentStatsRow, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	agentStatsCreatedAfter := make([]database.WorkspaceAgentStat, 0)
-	for _, agentStat := range q.workspaceAgentStats {
-		if agentStat.CreatedAt.After(createdAfter) {
-			agentStatsCreatedAfter = append(agentStatsCreatedAfter, agentStat)
-		}
-	}
-
-	latestAgentStats := map[uuid.UUID]database.WorkspaceAgentStat{}
-	for _, agentStat := range q.workspaceAgentStats {
-		if agentStat.CreatedAt.After(createdAfter) {
-			latestAgentStats[agentStat.AgentID] = agentStat
-		}
-	}
-
-	statByAgent := map[uuid.UUID]database.GetWorkspaceAgentStatsRow{}
-	for _, agentStat := range latestAgentStats {
-		stat := statByAgent[agentStat.AgentID]
-		stat.SessionCountVSCode += agentStat.SessionCountVSCode
-		stat.SessionCountJetBrains += agentStat.SessionCountJetBrains
-		stat.SessionCountReconnectingPTY += agentStat.SessionCountReconnectingPTY
-		stat.SessionCountSSH += agentStat.SessionCountSSH
-		statByAgent[stat.AgentID] = stat
-	}
-
-	latenciesByAgent := map[uuid.UUID][]float64{}
-	minimumDateByAgent := map[uuid.UUID]time.Time{}
-	for _, agentStat := range agentStatsCreatedAfter {
-		if agentStat.ConnectionMedianLatencyMS <= 0 {
-			continue
-		}
-		stat := statByAgent[agentStat.AgentID]
-		minimumDate := minimumDateByAgent[agentStat.AgentID]
-		if agentStat.CreatedAt.Before(minimumDate) || minimumDate.IsZero() {
-			minimumDateByAgent[agentStat.AgentID] = agentStat.CreatedAt
-		}
-		stat.WorkspaceRxBytes += agentStat.RxBytes
-		stat.WorkspaceTxBytes += agentStat.TxBytes
-		statByAgent[agentStat.AgentID] = stat
-		latenciesByAgent[agentStat.AgentID] = append(latenciesByAgent[agentStat.AgentID], agentStat.ConnectionMedianLatencyMS)
-	}
-
-	tryPercentile := func(fs []float64, p float64) float64 {
-		if len(fs) == 0 {
-			return -1
-		}
-		sort.Float64s(fs)
-		return fs[int(float64(len(fs))*p/100)]
-	}
-
-	for _, stat := range statByAgent {
-		stat.AggregatedFrom = minimumDateByAgent[stat.AgentID]
-		statByAgent[stat.AgentID] = stat
-
-		latencies, ok := latenciesByAgent[stat.AgentID]
-		if !ok {
-			continue
-		}
-		stat.WorkspaceConnectionLatency50 = tryPercentile(latencies, 50)
-		stat.WorkspaceConnectionLatency95 = tryPercentile(latencies, 95)
-		statByAgent[stat.AgentID] = stat
-	}
-
-	stats := make([]database.GetWorkspaceAgentStatsRow, 0, len(statByAgent))
-	for _, agent := range statByAgent {
-		stats = append(stats, agent)
-	}
-	return stats, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceAgentStatsAndLabels(ctx context.Context, createdAfter time.Time) ([]database.GetWorkspaceAgentStatsAndLabelsRow, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	agentStatsCreatedAfter := make([]database.WorkspaceAgentStat, 0)
-	latestAgentStats := map[uuid.UUID]database.WorkspaceAgentStat{}
-
-	for _, agentStat := range q.workspaceAgentStats {
-		if agentStat.CreatedAt.After(createdAfter) {
-			agentStatsCreatedAfter = append(agentStatsCreatedAfter, agentStat)
-			latestAgentStats[agentStat.AgentID] = agentStat
-		}
-	}
-
-	statByAgent := map[uuid.UUID]database.GetWorkspaceAgentStatsAndLabelsRow{}
-
-	// Session and connection metrics
-	for _, agentStat := range latestAgentStats {
-		stat := statByAgent[agentStat.AgentID]
-		stat.SessionCountVSCode += agentStat.SessionCountVSCode
-		stat.SessionCountJetBrains += agentStat.SessionCountJetBrains
-		stat.SessionCountReconnectingPTY += agentStat.SessionCountReconnectingPTY
-		stat.SessionCountSSH += agentStat.SessionCountSSH
-		stat.ConnectionCount += agentStat.ConnectionCount
-		if agentStat.ConnectionMedianLatencyMS >= 0 && stat.ConnectionMedianLatencyMS < agentStat.ConnectionMedianLatencyMS {
-			stat.ConnectionMedianLatencyMS = agentStat.ConnectionMedianLatencyMS
-		}
-		statByAgent[agentStat.AgentID] = stat
-	}
-
-	// Tx, Rx metrics
-	for _, agentStat := range agentStatsCreatedAfter {
-		stat := statByAgent[agentStat.AgentID]
-		stat.RxBytes += agentStat.RxBytes
-		stat.TxBytes += agentStat.TxBytes
-		statByAgent[agentStat.AgentID] = stat
-	}
-
-	// Labels
-	for _, agentStat := range agentStatsCreatedAfter {
-		stat := statByAgent[agentStat.AgentID]
-
-		user, err := q.getUserByIDNoLock(agentStat.UserID)
-		if err != nil {
-			return nil, err
-		}
-
-		stat.Username = user.Username
-
-		workspace, err := q.getWorkspaceByIDNoLock(ctx, agentStat.WorkspaceID)
-		if err != nil {
-			return nil, err
-		}
-		stat.WorkspaceName = workspace.Name
-
-		agent, err := q.getWorkspaceAgentByIDNoLock(ctx, agentStat.AgentID)
-		if err != nil {
-			return nil, err
-		}
-		stat.AgentName = agent.Name
-
-		statByAgent[agentStat.AgentID] = stat
-	}
-
-	stats := make([]database.GetWorkspaceAgentStatsAndLabelsRow, 0, len(statByAgent))
-	for _, agent := range statByAgent {
-		stats = append(stats, agent)
-	}
-	return stats, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceAgentsByResourceIDs(ctx context.Context, resourceIDs []uuid.UUID) ([]database.WorkspaceAgent, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.getWorkspaceAgentsByResourceIDsNoLock(ctx, resourceIDs)
-}
-
-func (q *FakeQuerier) GetWorkspaceAgentsCreatedAfter(_ context.Context, after time.Time) ([]database.WorkspaceAgent, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	workspaceAgents := make([]database.WorkspaceAgent, 0)
-	for _, agent := range q.workspaceAgents {
-		if agent.CreatedAt.After(after) {
-			workspaceAgents = append(workspaceAgents, agent)
-		}
-	}
-	return workspaceAgents, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceAgentsInLatestBuildByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) ([]database.WorkspaceAgent, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	// Get latest build for workspace.
-	workspaceBuild, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspaceID)
-	if err != nil {
-		return nil, xerrors.Errorf("get latest workspace build: %w", err)
-	}
-
-	// Get resources for build.
-	resources, err := q.getWorkspaceResourcesByJobIDNoLock(ctx, workspaceBuild.JobID)
-	if err != nil {
-		return nil, xerrors.Errorf("get workspace resources: %w", err)
-	}
-	if len(resources) == 0 {
-		return []database.WorkspaceAgent{}, nil
-	}
-
-	resourceIDs := make([]uuid.UUID, len(resources))
-	for i, resource := range resources {
-		resourceIDs[i] = resource.ID
-	}
-
-	agents, err := q.getWorkspaceAgentsByResourceIDsNoLock(ctx, resourceIDs)
-	if err != nil {
-		return nil, xerrors.Errorf("get workspace agents: %w", err)
-	}
-
-	return agents, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceAppByAgentIDAndSlug(_ context.Context, arg database.GetWorkspaceAppByAgentIDAndSlugParams) (database.WorkspaceApp, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.WorkspaceApp{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, app := range q.workspaceApps {
-		if app.AgentID != arg.AgentID {
-			continue
-		}
-		if app.Slug != arg.Slug {
-			continue
-		}
-		return app, nil
-	}
-	return database.WorkspaceApp{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetWorkspaceAppsByAgentID(_ context.Context, id uuid.UUID) ([]database.WorkspaceApp, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	apps := make([]database.WorkspaceApp, 0)
-	for _, app := range q.workspaceApps {
-		if app.AgentID == id {
-			apps = append(apps, app)
-		}
-	}
-	if len(apps) == 0 {
-		return nil, sql.ErrNoRows
-	}
-	return apps, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceAppsByAgentIDs(_ context.Context, ids []uuid.UUID) ([]database.WorkspaceApp, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	apps := make([]database.WorkspaceApp, 0)
-	for _, app := range q.workspaceApps {
-		for _, id := range ids {
-			if app.AgentID == id {
-				apps = append(apps, app)
-				break
-			}
-		}
-	}
-	return apps, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceAppsCreatedAfter(_ context.Context, after time.Time) ([]database.WorkspaceApp, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	apps := make([]database.WorkspaceApp, 0)
-	for _, app := range q.workspaceApps {
-		if app.CreatedAt.After(after) {
-			apps = append(apps, app)
-		}
-	}
-	return apps, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceBuildByID(ctx context.Context, id uuid.UUID) (database.WorkspaceBuild, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.getWorkspaceBuildByIDNoLock(ctx, id)
-}
-
-func (q *FakeQuerier) GetWorkspaceBuildByJobID(_ context.Context, jobID uuid.UUID) (database.WorkspaceBuild, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, build := range q.workspaceBuilds {
-		if build.JobID == jobID {
-			return q.workspaceBuildWithUserNoLock(build), nil
-		}
-	}
-	return database.WorkspaceBuild{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetWorkspaceBuildByWorkspaceIDAndBuildNumber(_ context.Context, arg database.GetWorkspaceBuildByWorkspaceIDAndBuildNumberParams) (database.WorkspaceBuild, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.WorkspaceBuild{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, workspaceBuild := range q.workspaceBuilds {
-		if workspaceBuild.WorkspaceID != arg.WorkspaceID {
-			continue
-		}
-		if workspaceBuild.BuildNumber != arg.BuildNumber {
-			continue
-		}
-		return q.workspaceBuildWithUserNoLock(workspaceBuild), nil
-	}
-	return database.WorkspaceBuild{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetWorkspaceBuildParameters(_ context.Context, workspaceBuildID uuid.UUID) ([]database.WorkspaceBuildParameter, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	params := make([]database.WorkspaceBuildParameter, 0)
-	for _, param := range q.workspaceBuildParameters {
-		if param.WorkspaceBuildID != workspaceBuildID {
-			continue
-		}
-		params = append(params, param)
-	}
-	return params, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceBuildsByWorkspaceID(_ context.Context,
-	params database.GetWorkspaceBuildsByWorkspaceIDParams,
-) ([]database.WorkspaceBuild, error) {
-	if err := validateDatabaseType(params); err != nil {
-		return nil, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	history := make([]database.WorkspaceBuild, 0)
-	for _, workspaceBuild := range q.workspaceBuilds {
-		if workspaceBuild.CreatedAt.Before(params.Since) {
-			continue
-		}
-		if workspaceBuild.WorkspaceID == params.WorkspaceID {
-			history = append(history, q.workspaceBuildWithUserNoLock(workspaceBuild))
-		}
-	}
-
-	// Order by build_number
-	slices.SortFunc(history, func(a, b database.WorkspaceBuild) bool {
-		// use greater than since we want descending order
-		return a.BuildNumber > b.BuildNumber
-	})
-
-	if params.AfterID != uuid.Nil {
-		found := false
-		for i, v := range history {
-			if v.ID == params.AfterID {
-				// We want to return all builds after index i.
-				history = history[i+1:]
-				found = true
-				break
-			}
-		}
-
-		// If no builds after the time, then we return an empty list.
-		if !found {
-			return nil, sql.ErrNoRows
-		}
-	}
-
-	if params.OffsetOpt > 0 {
-		if int(params.OffsetOpt) > len(history)-1 {
-			return nil, sql.ErrNoRows
-		}
-		history = history[params.OffsetOpt:]
-	}
-
-	if params.LimitOpt > 0 {
-		if int(params.LimitOpt) > len(history) {
-			params.LimitOpt = int32(len(history))
-		}
-		history = history[:params.LimitOpt]
-	}
-
-	if len(history) == 0 {
-		return nil, sql.ErrNoRows
-	}
-	return history, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceBuildsCreatedAfter(_ context.Context, after time.Time) ([]database.WorkspaceBuild, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	workspaceBuilds := make([]database.WorkspaceBuild, 0)
-	for _, workspaceBuild := range q.workspaceBuilds {
-		if workspaceBuild.CreatedAt.After(after) {
-			workspaceBuilds = append(workspaceBuilds, q.workspaceBuildWithUserNoLock(workspaceBuild))
-		}
-	}
-	return workspaceBuilds, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceByAgentID(ctx context.Context, agentID uuid.UUID) (database.Workspace, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.getWorkspaceByAgentIDNoLock(ctx, agentID)
-}
-
-func (q *FakeQuerier) GetWorkspaceByID(ctx context.Context, id uuid.UUID) (database.Workspace, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.getWorkspaceByIDNoLock(ctx, id)
-}
-
-func (q *FakeQuerier) GetWorkspaceByOwnerIDAndName(_ context.Context, arg database.GetWorkspaceByOwnerIDAndNameParams) (database.Workspace, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.Workspace{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	var found *database.Workspace
-	for _, workspace := range q.workspaces {
-		workspace := workspace
-		if workspace.OwnerID != arg.OwnerID {
-			continue
-		}
-		if !strings.EqualFold(workspace.Name, arg.Name) {
-			continue
-		}
-		if workspace.Deleted != arg.Deleted {
-			continue
-		}
-
-		// Return the most recent workspace with the given name
-		if found == nil || workspace.CreatedAt.After(found.CreatedAt) {
-			found = &workspace
-		}
-	}
-	if found != nil {
-		return *found, nil
-	}
-	return database.Workspace{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetWorkspaceByWorkspaceAppID(_ context.Context, workspaceAppID uuid.UUID) (database.Workspace, error) {
-	if err := validateDatabaseType(workspaceAppID); err != nil {
-		return database.Workspace{}, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, workspaceApp := range q.workspaceApps {
-		workspaceApp := workspaceApp
-		if workspaceApp.ID == workspaceAppID {
-			return q.getWorkspaceByAgentIDNoLock(context.Background(), workspaceApp.AgentID)
-		}
-	}
-	return database.Workspace{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetWorkspaceProxies(_ context.Context) ([]database.WorkspaceProxy, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	cpy := make([]database.WorkspaceProxy, 0, len(q.workspaceProxies))
-
-	for _, p := range q.workspaceProxies {
-		if !p.Deleted {
-			cpy = append(cpy, p)
-		}
-	}
-	return cpy, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceProxyByHostname(_ context.Context, params database.GetWorkspaceProxyByHostnameParams) (database.WorkspaceProxy, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	// Return zero rows if this is called with a non-sanitized hostname. The SQL
-	// version of this query does the same thing.
-	if !validProxyByHostnameRegex.MatchString(params.Hostname) {
-		return database.WorkspaceProxy{}, sql.ErrNoRows
-	}
-
-	// This regex matches the SQL version.
-	accessURLRegex := regexp.MustCompile(`[^:]*://` + regexp.QuoteMeta(params.Hostname) + `([:/]?.)*`)
-
-	for _, proxy := range q.workspaceProxies {
-		if proxy.Deleted {
-			continue
-		}
-		if params.AllowAccessUrl && accessURLRegex.MatchString(proxy.Url) {
-			return proxy, nil
-		}
-
-		// Compile the app hostname regex. This is slow sadly.
-		if params.AllowWildcardHostname {
-			wildcardRegexp, err := httpapi.CompileHostnamePattern(proxy.WildcardHostname)
-			if err != nil {
-				return database.WorkspaceProxy{}, xerrors.Errorf("compile hostname pattern %q for proxy %q (%s): %w", proxy.WildcardHostname, proxy.Name, proxy.ID.String(), err)
-			}
-			if _, ok := httpapi.ExecuteHostnamePattern(wildcardRegexp, params.Hostname); ok {
-				return proxy, nil
-			}
-		}
-	}
-
-	return database.WorkspaceProxy{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetWorkspaceProxyByID(_ context.Context, id uuid.UUID) (database.WorkspaceProxy, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, proxy := range q.workspaceProxies {
-		if proxy.ID == id {
-			return proxy, nil
-		}
-	}
-	return database.WorkspaceProxy{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetWorkspaceProxyByName(_ context.Context, name string) (database.WorkspaceProxy, error) {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for _, proxy := range q.workspaceProxies {
-		if proxy.Deleted {
-			continue
-		}
-		if proxy.Name == name {
-			return proxy, nil
-		}
-	}
-	return database.WorkspaceProxy{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetWorkspaceResourceByID(_ context.Context, id uuid.UUID) (database.WorkspaceResource, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	for _, resource := range q.workspaceResources {
-		if resource.ID == id {
-			return resource, nil
-		}
-	}
-	return database.WorkspaceResource{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetWorkspaceResourceMetadataByResourceIDs(_ context.Context, ids []uuid.UUID) ([]database.WorkspaceResourceMetadatum, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	metadata := make([]database.WorkspaceResourceMetadatum, 0)
-	for _, metadatum := range q.workspaceResourceMetadata {
-		for _, id := range ids {
-			if metadatum.WorkspaceResourceID == id {
-				metadata = append(metadata, metadatum)
-			}
-		}
-	}
-	return metadata, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceResourceMetadataCreatedAfter(ctx context.Context, after time.Time) ([]database.WorkspaceResourceMetadatum, error) {
-	resources, err := q.GetWorkspaceResourcesCreatedAfter(ctx, after)
-	if err != nil {
-		return nil, err
-	}
-	resourceIDs := map[uuid.UUID]struct{}{}
-	for _, resource := range resources {
-		resourceIDs[resource.ID] = struct{}{}
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	metadata := make([]database.WorkspaceResourceMetadatum, 0)
-	for _, m := range q.workspaceResourceMetadata {
-		_, ok := resourceIDs[m.WorkspaceResourceID]
-		if !ok {
-			continue
-		}
-		metadata = append(metadata, m)
-	}
-	return metadata, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceResourcesByJobID(ctx context.Context, jobID uuid.UUID) ([]database.WorkspaceResource, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return q.getWorkspaceResourcesByJobIDNoLock(ctx, jobID)
-}
-
-func (q *FakeQuerier) GetWorkspaceResourcesByJobIDs(_ context.Context, jobIDs []uuid.UUID) ([]database.WorkspaceResource, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	resources := make([]database.WorkspaceResource, 0)
-	for _, resource := range q.workspaceResources {
-		for _, jobID := range jobIDs {
-			if resource.JobID != jobID {
-				continue
-			}
-			resources = append(resources, resource)
-		}
-	}
-	return resources, nil
-}
-
-func (q *FakeQuerier) GetWorkspaceResourcesCreatedAfter(_ context.Context, after time.Time) ([]database.WorkspaceResource, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	resources := make([]database.WorkspaceResource, 0)
-	for _, resource := range q.workspaceResources {
-		if resource.CreatedAt.After(after) {
-			resources = append(resources, resource)
-		}
-	}
-	return resources, nil
-}
-
-func (q *FakeQuerier) GetWorkspaces(ctx context.Context, arg database.GetWorkspacesParams) ([]database.GetWorkspacesRow, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return nil, err
-	}
-
-	// A nil auth filter means no auth filter.
-	workspaceRows, err := q.GetAuthorizedWorkspaces(ctx, arg, nil)
-	return workspaceRows, err
-}
-
-func (q *FakeQuerier) GetWorkspacesEligibleForTransition(ctx context.Context, now time.Time) ([]database.Workspace, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	workspaces := []database.Workspace{}
-	for _, workspace := range q.workspaces {
-		build, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspace.ID)
-		if err != nil {
-			return nil, err
-		}
-
-		if build.Transition == database.WorkspaceTransitionStart &&
-			!build.Deadline.IsZero() &&
-			build.Deadline.Before(now) &&
-			!workspace.LockedAt.Valid {
-			workspaces = append(workspaces, workspace)
-			continue
-		}
-
-		if build.Transition == database.WorkspaceTransitionStop &&
-			workspace.AutostartSchedule.Valid &&
-			!workspace.LockedAt.Valid {
-			workspaces = append(workspaces, workspace)
-			continue
-		}
-
-		job, err := q.getProvisionerJobByIDNoLock(ctx, build.JobID)
-		if err != nil {
-			return nil, xerrors.Errorf("get provisioner job by ID: %w", err)
-		}
-		if db2sdk.ProvisionerJobStatus(job) == codersdk.ProvisionerJobFailed {
-			workspaces = append(workspaces, workspace)
-			continue
-		}
-
-		template, err := q.GetTemplateByID(ctx, workspace.TemplateID)
-		if err != nil {
-			return nil, xerrors.Errorf("get template by ID: %w", err)
-		}
-		if !workspace.LockedAt.Valid && template.InactivityTTL > 0 {
-			workspaces = append(workspaces, workspace)
-			continue
-		}
-		if workspace.LockedAt.Valid && template.LockedTTL > 0 {
-			workspaces = append(workspaces, workspace)
-			continue
-		}
-	}
-
-	return workspaces, nil
-}
-
-func (q *FakeQuerier) InsertAPIKey(_ context.Context, arg database.InsertAPIKeyParams) (database.APIKey, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.APIKey{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	if arg.LifetimeSeconds == 0 {
-		arg.LifetimeSeconds = 86400
-	}
-
-	for _, u := range q.users {
-		if u.ID == arg.UserID && u.Deleted {
-			return database.APIKey{}, xerrors.Errorf("refusing to create APIKey for deleted user")
-		}
-	}
-
-	//nolint:gosimple
-	key := database.APIKey{
-		ID:              arg.ID,
-		LifetimeSeconds: arg.LifetimeSeconds,
-		HashedSecret:    arg.HashedSecret,
-		IPAddress:       arg.IPAddress,
-		UserID:          arg.UserID,
-		ExpiresAt:       arg.ExpiresAt,
-		CreatedAt:       arg.CreatedAt,
-		UpdatedAt:       arg.UpdatedAt,
-		LastUsed:        arg.LastUsed,
-		LoginType:       arg.LoginType,
-		Scope:           arg.Scope,
-		TokenName:       arg.TokenName,
-	}
-	q.apiKeys = append(q.apiKeys, key)
-	return key, nil
-}
-
-func (q *FakeQuerier) InsertAllUsersGroup(ctx context.Context, orgID uuid.UUID) (database.Group, error) {
-	return q.InsertGroup(ctx, database.InsertGroupParams{
-		ID:             orgID,
-		Name:           database.AllUsersGroup,
-		DisplayName:    "",
-		OrganizationID: orgID,
-	})
-}
-
-func (q *FakeQuerier) InsertAuditLog(_ context.Context, arg database.InsertAuditLogParams) (database.AuditLog, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.AuditLog{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	alog := database.AuditLog(arg)
-
-	q.auditLogs = append(q.auditLogs, alog)
-	slices.SortFunc(q.auditLogs, func(a, b database.AuditLog) bool {
-		return a.Time.Before(b.Time)
-	})
-
-	return alog, nil
-}
-
-func (q *FakeQuerier) InsertDERPMeshKey(_ context.Context, id string) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	q.derpMeshKey = id
-	return nil
-}
-
-func (q *FakeQuerier) InsertDeploymentID(_ context.Context, id string) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	q.deploymentID = id
-	return nil
-}
-
-func (q *FakeQuerier) InsertFile(_ context.Context, arg database.InsertFileParams) (database.File, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.File{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	//nolint:gosimple
-	file := database.File{
-		ID:        arg.ID,
-		Hash:      arg.Hash,
-		CreatedAt: arg.CreatedAt,
-		CreatedBy: arg.CreatedBy,
-		Mimetype:  arg.Mimetype,
-		Data:      arg.Data,
-	}
-	q.files = append(q.files, file)
-	return file, nil
-}
-
-func (q *FakeQuerier) InsertGitAuthLink(_ context.Context, arg database.InsertGitAuthLinkParams) (database.GitAuthLink, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.GitAuthLink{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-	// nolint:gosimple
-	gitAuthLink := database.GitAuthLink{
-		ProviderID:        arg.ProviderID,
-		UserID:            arg.UserID,
-		CreatedAt:         arg.CreatedAt,
-		UpdatedAt:         arg.UpdatedAt,
-		OAuthAccessToken:  arg.OAuthAccessToken,
-		OAuthRefreshToken: arg.OAuthRefreshToken,
-		OAuthExpiry:       arg.OAuthExpiry,
-	}
-	q.gitAuthLinks = append(q.gitAuthLinks, gitAuthLink)
-	return gitAuthLink, nil
-}
-
-func (q *FakeQuerier) InsertGitSSHKey(_ context.Context, arg database.InsertGitSSHKeyParams) (database.GitSSHKey, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.GitSSHKey{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	//nolint:gosimple
-	gitSSHKey := database.GitSSHKey{
-		UserID:     arg.UserID,
-		CreatedAt:  arg.CreatedAt,
-		UpdatedAt:  arg.UpdatedAt,
-		PrivateKey: arg.PrivateKey,
-		PublicKey:  arg.PublicKey,
-	}
-	q.gitSSHKey = append(q.gitSSHKey, gitSSHKey)
-	return gitSSHKey, nil
-}
-
-func (q *FakeQuerier) InsertGroup(_ context.Context, arg database.InsertGroupParams) (database.Group, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.Group{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for _, group := range q.groups {
-		if group.OrganizationID == arg.OrganizationID &&
-			group.Name == arg.Name {
-			return database.Group{}, errDuplicateKey
-		}
-	}
-
-	//nolint:gosimple
-	group := database.Group{
-		ID:             arg.ID,
-		Name:           arg.Name,
-		DisplayName:    arg.DisplayName,
-		OrganizationID: arg.OrganizationID,
-		AvatarURL:      arg.AvatarURL,
-		QuotaAllowance: arg.QuotaAllowance,
-	}
-
-	q.groups = append(q.groups, group)
-
-	return group, nil
-}
-
-func (q *FakeQuerier) InsertGroupMember(_ context.Context, arg database.InsertGroupMemberParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for _, member := range q.groupMembers {
-		if member.GroupID == arg.GroupID &&
-			member.UserID == arg.UserID {
-			return errDuplicateKey
-		}
-	}
-
-	//nolint:gosimple
-	q.groupMembers = append(q.groupMembers, database.GroupMember{
-		GroupID: arg.GroupID,
-		UserID:  arg.UserID,
-	})
-
-	return nil
-}
-
-func (q *FakeQuerier) InsertLicense(
-	_ context.Context, arg database.InsertLicenseParams,
-) (database.License, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.License{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	l := database.License{
-		ID:         q.lastLicenseID + 1,
-		UploadedAt: arg.UploadedAt,
-		JWT:        arg.JWT,
-		Exp:        arg.Exp,
-	}
-	q.lastLicenseID = l.ID
-	q.licenses = append(q.licenses, l)
-	return l, nil
-}
-
-func (q *FakeQuerier) InsertOrganization(_ context.Context, arg database.InsertOrganizationParams) (database.Organization, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.Organization{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	organization := database.Organization{
-		ID:        arg.ID,
-		Name:      arg.Name,
-		CreatedAt: arg.CreatedAt,
-		UpdatedAt: arg.UpdatedAt,
-	}
-	q.organizations = append(q.organizations, organization)
-	return organization, nil
-}
-
-func (q *FakeQuerier) InsertOrganizationMember(_ context.Context, arg database.InsertOrganizationMemberParams) (database.OrganizationMember, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.OrganizationMember{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	//nolint:gosimple
-	organizationMember := database.OrganizationMember{
-		OrganizationID: arg.OrganizationID,
-		UserID:         arg.UserID,
-		CreatedAt:      arg.CreatedAt,
-		UpdatedAt:      arg.UpdatedAt,
-		Roles:          arg.Roles,
-	}
-	q.organizationMembers = append(q.organizationMembers, organizationMember)
-	return organizationMember, nil
-}
-
-func (q *FakeQuerier) InsertProvisionerDaemon(_ context.Context, arg database.InsertProvisionerDaemonParams) (database.ProvisionerDaemon, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.ProvisionerDaemon{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	daemon := database.ProvisionerDaemon{
-		ID:           arg.ID,
-		CreatedAt:    arg.CreatedAt,
-		Name:         arg.Name,
-		Provisioners: arg.Provisioners,
-		Tags:         arg.Tags,
-	}
-	q.provisionerDaemons = append(q.provisionerDaemons, daemon)
-	return daemon, nil
-}
-
-func (q *FakeQuerier) InsertProvisionerJob(_ context.Context, arg database.InsertProvisionerJobParams) (database.ProvisionerJob, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.ProvisionerJob{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	job := database.ProvisionerJob{
-		ID:             arg.ID,
-		CreatedAt:      arg.CreatedAt,
-		UpdatedAt:      arg.UpdatedAt,
-		OrganizationID: arg.OrganizationID,
-		InitiatorID:    arg.InitiatorID,
-		Provisioner:    arg.Provisioner,
-		StorageMethod:  arg.StorageMethod,
-		FileID:         arg.FileID,
-		Type:           arg.Type,
-		Input:          arg.Input,
-		Tags:           arg.Tags,
-	}
-	q.provisionerJobs = append(q.provisionerJobs, job)
-	return job, nil
-}
-
-func (q *FakeQuerier) InsertProvisionerJobLogs(_ context.Context, arg database.InsertProvisionerJobLogsParams) ([]database.ProvisionerJobLog, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return nil, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	logs := make([]database.ProvisionerJobLog, 0)
-	id := int64(1)
-	if len(q.provisionerJobLogs) > 0 {
-		id = q.provisionerJobLogs[len(q.provisionerJobLogs)-1].ID
-	}
-	for index, output := range arg.Output {
-		id++
-		logs = append(logs, database.ProvisionerJobLog{
-			ID:        id,
-			JobID:     arg.JobID,
-			CreatedAt: arg.CreatedAt[index],
-			Source:    arg.Source[index],
-			Level:     arg.Level[index],
-			Stage:     arg.Stage[index],
-			Output:    output,
-		})
-	}
-	q.provisionerJobLogs = append(q.provisionerJobLogs, logs...)
-	return logs, nil
-}
-
-func (q *FakeQuerier) InsertReplica(_ context.Context, arg database.InsertReplicaParams) (database.Replica, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.Replica{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	replica := database.Replica{
-		ID:              arg.ID,
-		CreatedAt:       arg.CreatedAt,
-		StartedAt:       arg.StartedAt,
-		UpdatedAt:       arg.UpdatedAt,
-		Hostname:        arg.Hostname,
-		RegionID:        arg.RegionID,
-		RelayAddress:    arg.RelayAddress,
-		Version:         arg.Version,
-		DatabaseLatency: arg.DatabaseLatency,
-		Primary:         arg.Primary,
-	}
-	q.replicas = append(q.replicas, replica)
-	return replica, nil
-}
-
-func (q *FakeQuerier) InsertTemplate(_ context.Context, arg database.InsertTemplateParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	//nolint:gosimple
-	template := database.TemplateTable{
-		ID:                           arg.ID,
-		CreatedAt:                    arg.CreatedAt,
-		UpdatedAt:                    arg.UpdatedAt,
-		OrganizationID:               arg.OrganizationID,
-		Name:                         arg.Name,
-		Provisioner:                  arg.Provisioner,
-		ActiveVersionID:              arg.ActiveVersionID,
-		Description:                  arg.Description,
-		CreatedBy:                    arg.CreatedBy,
-		UserACL:                      arg.UserACL,
-		GroupACL:                     arg.GroupACL,
-		DisplayName:                  arg.DisplayName,
-		Icon:                         arg.Icon,
-		AllowUserCancelWorkspaceJobs: arg.AllowUserCancelWorkspaceJobs,
-		AllowUserAutostart:           true,
-		AllowUserAutostop:            true,
-	}
-	q.templates = append(q.templates, template)
-	return nil
-}
-
-func (q *FakeQuerier) InsertTemplateVersion(_ context.Context, arg database.InsertTemplateVersionParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	if len(arg.Message) > 1048576 {
-		return xerrors.New("message too long")
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	//nolint:gosimple
-	version := database.TemplateVersionTable{
-		ID:             arg.ID,
-		TemplateID:     arg.TemplateID,
-		OrganizationID: arg.OrganizationID,
-		CreatedAt:      arg.CreatedAt,
-		UpdatedAt:      arg.UpdatedAt,
-		Name:           arg.Name,
-		Message:        arg.Message,
-		Readme:         arg.Readme,
-		JobID:          arg.JobID,
-		CreatedBy:      arg.CreatedBy,
-	}
-	q.templateVersions = append(q.templateVersions, version)
-	return nil
-}
-
-func (q *FakeQuerier) InsertTemplateVersionParameter(_ context.Context, arg database.InsertTemplateVersionParameterParams) (database.TemplateVersionParameter, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.TemplateVersionParameter{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	//nolint:gosimple
-	param := database.TemplateVersionParameter{
-		TemplateVersionID:   arg.TemplateVersionID,
-		Name:                arg.Name,
-		DisplayName:         arg.DisplayName,
-		Description:         arg.Description,
-		Type:                arg.Type,
-		Mutable:             arg.Mutable,
-		DefaultValue:        arg.DefaultValue,
-		Icon:                arg.Icon,
-		Options:             arg.Options,
-		ValidationError:     arg.ValidationError,
-		ValidationRegex:     arg.ValidationRegex,
-		ValidationMin:       arg.ValidationMin,
-		ValidationMax:       arg.ValidationMax,
-		ValidationMonotonic: arg.ValidationMonotonic,
-		Required:            arg.Required,
-		DisplayOrder:        arg.DisplayOrder,
-		Ephemeral:           arg.Ephemeral,
-	}
-	q.templateVersionParameters = append(q.templateVersionParameters, param)
-	return param, nil
-}
-
-func (q *FakeQuerier) InsertTemplateVersionVariable(_ context.Context, arg database.InsertTemplateVersionVariableParams) (database.TemplateVersionVariable, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.TemplateVersionVariable{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	//nolint:gosimple
-	variable := database.TemplateVersionVariable{
-		TemplateVersionID: arg.TemplateVersionID,
-		Name:              arg.Name,
-		Description:       arg.Description,
-		Type:              arg.Type,
-		Value:             arg.Value,
-		DefaultValue:      arg.DefaultValue,
-		Required:          arg.Required,
-		Sensitive:         arg.Sensitive,
-	}
-	q.templateVersionVariables = append(q.templateVersionVariables, variable)
-	return variable, nil
-}
-
-func (q *FakeQuerier) InsertUser(_ context.Context, arg database.InsertUserParams) (database.User, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.User{}, err
-	}
-
-	// There is a common bug when using dbfake that 2 inserted users have the
-	// same created_at time. This causes user order to not be deterministic,
-	// which breaks some unit tests.
-	// To fix this, we make sure that the created_at time is always greater
-	// than the last user's created_at time.
-	allUsers, _ := q.GetUsers(context.Background(), database.GetUsersParams{})
-	if len(allUsers) > 0 {
-		lastUser := allUsers[len(allUsers)-1]
-		if arg.CreatedAt.Before(lastUser.CreatedAt) ||
-			arg.CreatedAt.Equal(lastUser.CreatedAt) {
-			// 1 ms is a good enough buffer.
-			arg.CreatedAt = lastUser.CreatedAt.Add(time.Millisecond)
-		}
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for _, user := range q.users {
-		if user.Username == arg.Username && !user.Deleted {
-			return database.User{}, errDuplicateKey
-		}
-	}
-
-	user := database.User{
-		ID:             arg.ID,
-		Email:          arg.Email,
-		HashedPassword: arg.HashedPassword,
-		CreatedAt:      arg.CreatedAt,
-		UpdatedAt:      arg.UpdatedAt,
-		Username:       arg.Username,
-		Status:         database.UserStatusDormant,
-		RBACRoles:      arg.RBACRoles,
-		LoginType:      arg.LoginType,
-	}
-	q.users = append(q.users, user)
-	return user, nil
-}
-
-func (q *FakeQuerier) InsertUserGroupsByName(_ context.Context, arg database.InsertUserGroupsByNameParams) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	var groupIDs []uuid.UUID
-	for _, group := range q.groups {
-		for _, groupName := range arg.GroupNames {
-			if group.Name == groupName {
-				groupIDs = append(groupIDs, group.ID)
-			}
-		}
-	}
-
-	for _, groupID := range groupIDs {
-		q.groupMembers = append(q.groupMembers, database.GroupMember{
-			UserID:  arg.UserID,
-			GroupID: groupID,
-		})
-	}
-
-	return nil
-}
-
-func (q *FakeQuerier) InsertUserLink(_ context.Context, args database.InsertUserLinkParams) (database.UserLink, error) {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	//nolint:gosimple
-	link := database.UserLink{
-		UserID:            args.UserID,
-		LoginType:         args.LoginType,
-		LinkedID:          args.LinkedID,
-		OAuthAccessToken:  args.OAuthAccessToken,
-		OAuthRefreshToken: args.OAuthRefreshToken,
-		OAuthExpiry:       args.OAuthExpiry,
-	}
-
-	q.userLinks = append(q.userLinks, link)
-
-	return link, nil
-}
-
-func (q *FakeQuerier) InsertWorkspace(_ context.Context, arg database.InsertWorkspaceParams) (database.Workspace, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.Workspace{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	//nolint:gosimple
-	workspace := database.Workspace{
-		ID:                arg.ID,
-		CreatedAt:         arg.CreatedAt,
-		UpdatedAt:         arg.UpdatedAt,
-		OwnerID:           arg.OwnerID,
-		OrganizationID:    arg.OrganizationID,
-		TemplateID:        arg.TemplateID,
-		Name:              arg.Name,
-		AutostartSchedule: arg.AutostartSchedule,
-		Ttl:               arg.Ttl,
-		LastUsedAt:        arg.LastUsedAt,
-	}
-	q.workspaces = append(q.workspaces, workspace)
-	return workspace, nil
-}
-
-func (q *FakeQuerier) InsertWorkspaceAgent(_ context.Context, arg database.InsertWorkspaceAgentParams) (database.WorkspaceAgent, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.WorkspaceAgent{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	agent := database.WorkspaceAgent{
-		ID:                       arg.ID,
-		CreatedAt:                arg.CreatedAt,
-		UpdatedAt:                arg.UpdatedAt,
-		ResourceID:               arg.ResourceID,
-		AuthToken:                arg.AuthToken,
-		AuthInstanceID:           arg.AuthInstanceID,
-		EnvironmentVariables:     arg.EnvironmentVariables,
-		Name:                     arg.Name,
-		Architecture:             arg.Architecture,
-		OperatingSystem:          arg.OperatingSystem,
-		Directory:                arg.Directory,
-		StartupScriptBehavior:    arg.StartupScriptBehavior,
-		StartupScript:            arg.StartupScript,
-		InstanceMetadata:         arg.InstanceMetadata,
-		ResourceMetadata:         arg.ResourceMetadata,
-		ConnectionTimeoutSeconds: arg.ConnectionTimeoutSeconds,
-		TroubleshootingURL:       arg.TroubleshootingURL,
-		MOTDFile:                 arg.MOTDFile,
-		LifecycleState:           database.WorkspaceAgentLifecycleStateCreated,
-		ShutdownScript:           arg.ShutdownScript,
-	}
-
-	q.workspaceAgents = append(q.workspaceAgents, agent)
-	return agent, nil
-}
-
-func (q *FakeQuerier) InsertWorkspaceAgentLogs(_ context.Context, arg database.InsertWorkspaceAgentLogsParams) ([]database.WorkspaceAgentLog, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return nil, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	logs := []database.WorkspaceAgentLog{}
-	id := int64(0)
-	if len(q.workspaceAgentLogs) > 0 {
-		id = q.workspaceAgentLogs[len(q.workspaceAgentLogs)-1].ID
-	}
-	outputLength := int32(0)
-	for index, output := range arg.Output {
-		id++
-		logs = append(logs, database.WorkspaceAgentLog{
-			ID:        id,
-			AgentID:   arg.AgentID,
-			CreatedAt: arg.CreatedAt[index],
-			Level:     arg.Level[index],
-			Source:    arg.Source[index],
-			Output:    output,
-		})
-		outputLength += int32(len(output))
-	}
-	for index, agent := range q.workspaceAgents {
-		if agent.ID != arg.AgentID {
-			continue
-		}
-		// Greater than 1MB, same as the PostgreSQL constraint!
-		if agent.LogsLength+outputLength > (1 << 20) {
-			return nil, &pq.Error{
-				Constraint: "max_logs_length",
-				Table:      "workspace_agents",
-			}
-		}
-		agent.LogsLength += outputLength
-		q.workspaceAgents[index] = agent
-		break
-	}
-	q.workspaceAgentLogs = append(q.workspaceAgentLogs, logs...)
-	return logs, nil
-}
-
-func (q *FakeQuerier) InsertWorkspaceAgentMetadata(_ context.Context, arg database.InsertWorkspaceAgentMetadataParams) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	//nolint:gosimple
-	metadatum := database.WorkspaceAgentMetadatum{
-		WorkspaceAgentID: arg.WorkspaceAgentID,
-		Script:           arg.Script,
-		DisplayName:      arg.DisplayName,
-		Key:              arg.Key,
-		Timeout:          arg.Timeout,
-		Interval:         arg.Interval,
-	}
-
-	q.workspaceAgentMetadata = append(q.workspaceAgentMetadata, metadatum)
-	return nil
-}
-
-func (q *FakeQuerier) InsertWorkspaceAgentStat(_ context.Context, p database.InsertWorkspaceAgentStatParams) (database.WorkspaceAgentStat, error) {
-	if err := validateDatabaseType(p); err != nil {
-		return database.WorkspaceAgentStat{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	stat := database.WorkspaceAgentStat{
-		ID:                          p.ID,
-		CreatedAt:                   p.CreatedAt,
-		WorkspaceID:                 p.WorkspaceID,
-		AgentID:                     p.AgentID,
-		UserID:                      p.UserID,
-		ConnectionsByProto:          p.ConnectionsByProto,
-		ConnectionCount:             p.ConnectionCount,
-		RxPackets:                   p.RxPackets,
-		RxBytes:                     p.RxBytes,
-		TxPackets:                   p.TxPackets,
-		TxBytes:                     p.TxBytes,
-		TemplateID:                  p.TemplateID,
-		SessionCountVSCode:          p.SessionCountVSCode,
-		SessionCountJetBrains:       p.SessionCountJetBrains,
-		SessionCountReconnectingPTY: p.SessionCountReconnectingPTY,
-		SessionCountSSH:             p.SessionCountSSH,
-		ConnectionMedianLatencyMS:   p.ConnectionMedianLatencyMS,
-	}
-	q.workspaceAgentStats = append(q.workspaceAgentStats, stat)
-	return stat, nil
-}
-
-func (q *FakeQuerier) InsertWorkspaceApp(_ context.Context, arg database.InsertWorkspaceAppParams) (database.WorkspaceApp, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.WorkspaceApp{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	if arg.SharingLevel == "" {
-		arg.SharingLevel = database.AppSharingLevelOwner
-	}
-
-	// nolint:gosimple
-	workspaceApp := database.WorkspaceApp{
-		ID:                   arg.ID,
-		AgentID:              arg.AgentID,
-		CreatedAt:            arg.CreatedAt,
-		Slug:                 arg.Slug,
-		DisplayName:          arg.DisplayName,
-		Icon:                 arg.Icon,
-		Command:              arg.Command,
-		Url:                  arg.Url,
-		External:             arg.External,
-		Subdomain:            arg.Subdomain,
-		SharingLevel:         arg.SharingLevel,
-		HealthcheckUrl:       arg.HealthcheckUrl,
-		HealthcheckInterval:  arg.HealthcheckInterval,
-		HealthcheckThreshold: arg.HealthcheckThreshold,
-		Health:               arg.Health,
-	}
-	q.workspaceApps = append(q.workspaceApps, workspaceApp)
-	return workspaceApp, nil
-}
-
-func (q *FakeQuerier) InsertWorkspaceBuild(_ context.Context, arg database.InsertWorkspaceBuildParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	workspaceBuild := database.WorkspaceBuildTable{
-		ID:                arg.ID,
-		CreatedAt:         arg.CreatedAt,
-		UpdatedAt:         arg.UpdatedAt,
-		WorkspaceID:       arg.WorkspaceID,
-		TemplateVersionID: arg.TemplateVersionID,
-		BuildNumber:       arg.BuildNumber,
-		Transition:        arg.Transition,
-		InitiatorID:       arg.InitiatorID,
-		JobID:             arg.JobID,
-		ProvisionerState:  arg.ProvisionerState,
-		Deadline:          arg.Deadline,
-		Reason:            arg.Reason,
-	}
-	q.workspaceBuilds = append(q.workspaceBuilds, workspaceBuild)
-	return nil
-}
-
-func (q *FakeQuerier) InsertWorkspaceBuildParameters(_ context.Context, arg database.InsertWorkspaceBuildParametersParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, name := range arg.Name {
-		q.workspaceBuildParameters = append(q.workspaceBuildParameters, database.WorkspaceBuildParameter{
-			WorkspaceBuildID: arg.WorkspaceBuildID,
-			Name:             name,
-			Value:            arg.Value[index],
-		})
-	}
-	return nil
-}
-
-func (q *FakeQuerier) InsertWorkspaceProxy(_ context.Context, arg database.InsertWorkspaceProxyParams) (database.WorkspaceProxy, error) {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	lastRegionID := int32(0)
-	for _, p := range q.workspaceProxies {
-		if !p.Deleted && p.Name == arg.Name {
-			return database.WorkspaceProxy{}, errDuplicateKey
-		}
-		if p.RegionID > lastRegionID {
-			lastRegionID = p.RegionID
-		}
-	}
-
-	p := database.WorkspaceProxy{
-		ID:                arg.ID,
-		Name:              arg.Name,
-		DisplayName:       arg.DisplayName,
-		Icon:              arg.Icon,
-		DerpEnabled:       arg.DerpEnabled,
-		DerpOnly:          arg.DerpOnly,
-		TokenHashedSecret: arg.TokenHashedSecret,
-		RegionID:          lastRegionID + 1,
-		CreatedAt:         arg.CreatedAt,
-		UpdatedAt:         arg.UpdatedAt,
-		Deleted:           false,
-	}
-	q.workspaceProxies = append(q.workspaceProxies, p)
-	return p, nil
-}
-
-func (q *FakeQuerier) InsertWorkspaceResource(_ context.Context, arg database.InsertWorkspaceResourceParams) (database.WorkspaceResource, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.WorkspaceResource{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	//nolint:gosimple
-	resource := database.WorkspaceResource{
-		ID:         arg.ID,
-		CreatedAt:  arg.CreatedAt,
-		JobID:      arg.JobID,
-		Transition: arg.Transition,
-		Type:       arg.Type,
-		Name:       arg.Name,
-		Hide:       arg.Hide,
-		Icon:       arg.Icon,
-		DailyCost:  arg.DailyCost,
-	}
-	q.workspaceResources = append(q.workspaceResources, resource)
-	return resource, nil
-}
-
-func (q *FakeQuerier) InsertWorkspaceResourceMetadata(_ context.Context, arg database.InsertWorkspaceResourceMetadataParams) ([]database.WorkspaceResourceMetadatum, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return nil, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	metadata := make([]database.WorkspaceResourceMetadatum, 0)
-	id := int64(1)
-	if len(q.workspaceResourceMetadata) > 0 {
-		id = q.workspaceResourceMetadata[len(q.workspaceResourceMetadata)-1].ID
-	}
-	for index, key := range arg.Key {
-		id++
-		value := arg.Value[index]
-		metadata = append(metadata, database.WorkspaceResourceMetadatum{
-			ID:                  id,
-			WorkspaceResourceID: arg.WorkspaceResourceID,
-			Key:                 key,
-			Value: sql.NullString{
-				String: value,
-				Valid:  value != "",
-			},
-			Sensitive: arg.Sensitive[index],
-		})
-	}
-	q.workspaceResourceMetadata = append(q.workspaceResourceMetadata, metadata...)
-	return metadata, nil
-}
-
-func (q *FakeQuerier) RegisterWorkspaceProxy(_ context.Context, arg database.RegisterWorkspaceProxyParams) (database.WorkspaceProxy, error) {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, p := range q.workspaceProxies {
-		if p.ID == arg.ID {
-			p.Url = arg.Url
-			p.WildcardHostname = arg.WildcardHostname
-			p.DerpEnabled = arg.DerpEnabled
-			p.DerpOnly = arg.DerpOnly
-			p.UpdatedAt = database.Now()
-			q.workspaceProxies[i] = p
-			return p, nil
-		}
-	}
-	return database.WorkspaceProxy{}, sql.ErrNoRows
-}
-
-func (*FakeQuerier) TryAcquireLock(_ context.Context, _ int64) (bool, error) {
-	return false, xerrors.New("TryAcquireLock must only be called within a transaction")
-}
-
-func (q *FakeQuerier) UpdateAPIKeyByID(_ context.Context, arg database.UpdateAPIKeyByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, apiKey := range q.apiKeys {
-		if apiKey.ID != arg.ID {
-			continue
-		}
-		apiKey.LastUsed = arg.LastUsed
-		apiKey.ExpiresAt = arg.ExpiresAt
-		apiKey.IPAddress = arg.IPAddress
-		q.apiKeys[index] = apiKey
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateGitAuthLink(_ context.Context, arg database.UpdateGitAuthLinkParams) (database.GitAuthLink, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.GitAuthLink{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-	for index, gitAuthLink := range q.gitAuthLinks {
-		if gitAuthLink.ProviderID != arg.ProviderID {
-			continue
-		}
-		if gitAuthLink.UserID != arg.UserID {
-			continue
-		}
-		gitAuthLink.UpdatedAt = arg.UpdatedAt
-		gitAuthLink.OAuthAccessToken = arg.OAuthAccessToken
-		gitAuthLink.OAuthRefreshToken = arg.OAuthRefreshToken
-		gitAuthLink.OAuthExpiry = arg.OAuthExpiry
-		q.gitAuthLinks[index] = gitAuthLink
-
-		return gitAuthLink, nil
-	}
-	return database.GitAuthLink{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateGitSSHKey(_ context.Context, arg database.UpdateGitSSHKeyParams) (database.GitSSHKey, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.GitSSHKey{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, key := range q.gitSSHKey {
-		if key.UserID != arg.UserID {
-			continue
-		}
-		key.UpdatedAt = arg.UpdatedAt
-		key.PrivateKey = arg.PrivateKey
-		key.PublicKey = arg.PublicKey
-		q.gitSSHKey[index] = key
-		return key, nil
-	}
-	return database.GitSSHKey{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateGroupByID(_ context.Context, arg database.UpdateGroupByIDParams) (database.Group, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.Group{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, group := range q.groups {
-		if group.ID == arg.ID {
-			group.DisplayName = arg.DisplayName
-			group.Name = arg.Name
-			group.AvatarURL = arg.AvatarURL
-			group.QuotaAllowance = arg.QuotaAllowance
-			q.groups[i] = group
-			return group, nil
-		}
-	}
-	return database.Group{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateInactiveUsersToDormant(_ context.Context, params database.UpdateInactiveUsersToDormantParams) ([]database.UpdateInactiveUsersToDormantRow, error) {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	var updated []database.UpdateInactiveUsersToDormantRow
-	for index, user := range q.users {
-		if user.Status == database.UserStatusActive && user.LastSeenAt.Before(params.LastSeenAfter) {
-			q.users[index].Status = database.UserStatusDormant
-			q.users[index].UpdatedAt = params.UpdatedAt
-			updated = append(updated, database.UpdateInactiveUsersToDormantRow{
-				ID:         user.ID,
-				Email:      user.Email,
-				LastSeenAt: user.LastSeenAt,
-			})
-		}
-	}
-
-	if len(updated) == 0 {
-		return nil, sql.ErrNoRows
-	}
-	return updated, nil
-}
-
-func (q *FakeQuerier) UpdateMemberRoles(_ context.Context, arg database.UpdateMemberRolesParams) (database.OrganizationMember, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.OrganizationMember{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, mem := range q.organizationMembers {
-		if mem.UserID == arg.UserID && mem.OrganizationID == arg.OrgID {
-			uniqueRoles := make([]string, 0, len(arg.GrantedRoles))
-			exist := make(map[string]struct{})
-			for _, r := range arg.GrantedRoles {
-				if _, ok := exist[r]; ok {
-					continue
-				}
-				exist[r] = struct{}{}
-				uniqueRoles = append(uniqueRoles, r)
-			}
-			sort.Strings(uniqueRoles)
-
-			mem.Roles = uniqueRoles
-			q.organizationMembers[i] = mem
-			return mem, nil
-		}
-	}
-
-	return database.OrganizationMember{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateProvisionerJobByID(_ context.Context, arg database.UpdateProvisionerJobByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, job := range q.provisionerJobs {
-		if arg.ID != job.ID {
-			continue
-		}
-		job.UpdatedAt = arg.UpdatedAt
-		q.provisionerJobs[index] = job
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateProvisionerJobWithCancelByID(_ context.Context, arg database.UpdateProvisionerJobWithCancelByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, job := range q.provisionerJobs {
-		if arg.ID != job.ID {
-			continue
-		}
-		job.CanceledAt = arg.CanceledAt
-		job.CompletedAt = arg.CompletedAt
-		q.provisionerJobs[index] = job
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateProvisionerJobWithCompleteByID(_ context.Context, arg database.UpdateProvisionerJobWithCompleteByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, job := range q.provisionerJobs {
-		if arg.ID != job.ID {
-			continue
-		}
-		job.UpdatedAt = arg.UpdatedAt
-		job.CompletedAt = arg.CompletedAt
-		job.Error = arg.Error
-		job.ErrorCode = arg.ErrorCode
-		q.provisionerJobs[index] = job
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateReplica(_ context.Context, arg database.UpdateReplicaParams) (database.Replica, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.Replica{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, replica := range q.replicas {
-		if replica.ID != arg.ID {
-			continue
-		}
-		replica.Hostname = arg.Hostname
-		replica.StartedAt = arg.StartedAt
-		replica.StoppedAt = arg.StoppedAt
-		replica.UpdatedAt = arg.UpdatedAt
-		replica.RelayAddress = arg.RelayAddress
-		replica.RegionID = arg.RegionID
-		replica.Version = arg.Version
-		replica.Error = arg.Error
-		replica.DatabaseLatency = arg.DatabaseLatency
-		replica.Primary = arg.Primary
-		q.replicas[index] = replica
-		return replica, nil
-	}
-	return database.Replica{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateTemplateACLByID(_ context.Context, arg database.UpdateTemplateACLByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, template := range q.templates {
-		if template.ID == arg.ID {
-			template.GroupACL = arg.GroupACL
-			template.UserACL = arg.UserACL
-
-			q.templates[i] = template
-			return nil
-		}
-	}
-
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateTemplateActiveVersionByID(_ context.Context, arg database.UpdateTemplateActiveVersionByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, template := range q.templates {
-		if template.ID != arg.ID {
-			continue
-		}
-		template.ActiveVersionID = arg.ActiveVersionID
-		template.UpdatedAt = arg.UpdatedAt
-		q.templates[index] = template
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateTemplateDeletedByID(_ context.Context, arg database.UpdateTemplateDeletedByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, template := range q.templates {
-		if template.ID != arg.ID {
-			continue
-		}
-		template.Deleted = arg.Deleted
-		template.UpdatedAt = arg.UpdatedAt
-		q.templates[index] = template
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateTemplateMetaByID(_ context.Context, arg database.UpdateTemplateMetaByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for idx, tpl := range q.templates {
-		if tpl.ID != arg.ID {
-			continue
-		}
-		tpl.UpdatedAt = database.Now()
-		tpl.Name = arg.Name
-		tpl.DisplayName = arg.DisplayName
-		tpl.Description = arg.Description
-		tpl.Icon = arg.Icon
-		q.templates[idx] = tpl
-		return nil
-	}
-
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateTemplateScheduleByID(_ context.Context, arg database.UpdateTemplateScheduleByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for idx, tpl := range q.templates {
-		if tpl.ID != arg.ID {
-			continue
-		}
-		tpl.AllowUserAutostart = arg.AllowUserAutostart
-		tpl.AllowUserAutostop = arg.AllowUserAutostop
-		tpl.UpdatedAt = database.Now()
-		tpl.DefaultTTL = arg.DefaultTTL
-		tpl.MaxTTL = arg.MaxTTL
-		tpl.RestartRequirementDaysOfWeek = arg.RestartRequirementDaysOfWeek
-		tpl.RestartRequirementWeeks = arg.RestartRequirementWeeks
-		tpl.FailureTTL = arg.FailureTTL
-		tpl.InactivityTTL = arg.InactivityTTL
-		tpl.LockedTTL = arg.LockedTTL
-		q.templates[idx] = tpl
-		return nil
-	}
-
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateTemplateVersionByID(_ context.Context, arg database.UpdateTemplateVersionByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, templateVersion := range q.templateVersions {
-		if templateVersion.ID != arg.ID {
-			continue
-		}
-		templateVersion.TemplateID = arg.TemplateID
-		templateVersion.UpdatedAt = arg.UpdatedAt
-		templateVersion.Name = arg.Name
-		templateVersion.Message = arg.Message
-		q.templateVersions[index] = templateVersion
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateTemplateVersionDescriptionByJobID(_ context.Context, arg database.UpdateTemplateVersionDescriptionByJobIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, templateVersion := range q.templateVersions {
-		if templateVersion.JobID != arg.JobID {
-			continue
-		}
-		templateVersion.Readme = arg.Readme
-		templateVersion.UpdatedAt = arg.UpdatedAt
-		q.templateVersions[index] = templateVersion
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateTemplateVersionGitAuthProvidersByJobID(_ context.Context, arg database.UpdateTemplateVersionGitAuthProvidersByJobIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, templateVersion := range q.templateVersions {
-		if templateVersion.JobID != arg.JobID {
-			continue
-		}
-		templateVersion.GitAuthProviders = arg.GitAuthProviders
-		templateVersion.UpdatedAt = arg.UpdatedAt
-		q.templateVersions[index] = templateVersion
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateUserDeletedByID(_ context.Context, params database.UpdateUserDeletedByIDParams) error {
-	if err := validateDatabaseType(params); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, u := range q.users {
-		if u.ID == params.ID {
-			u.Deleted = params.Deleted
-			q.users[i] = u
-			// NOTE: In the real world, this is done by a trigger.
-			i := 0
-			for {
-				if i >= len(q.apiKeys) {
-					break
-				}
-				k := q.apiKeys[i]
-				if k.UserID == u.ID {
-					q.apiKeys[i] = q.apiKeys[len(q.apiKeys)-1]
-					q.apiKeys = q.apiKeys[:len(q.apiKeys)-1]
-					// We removed an element, so decrement
-					i--
-				}
-				i++
-			}
-			return nil
-		}
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateUserHashedPassword(_ context.Context, arg database.UpdateUserHashedPasswordParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, user := range q.users {
-		if user.ID != arg.ID {
-			continue
-		}
-		user.HashedPassword = arg.HashedPassword
-		q.users[i] = user
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateUserLastSeenAt(_ context.Context, arg database.UpdateUserLastSeenAtParams) (database.User, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.User{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, user := range q.users {
-		if user.ID != arg.ID {
-			continue
-		}
-		user.LastSeenAt = arg.LastSeenAt
-		user.UpdatedAt = arg.UpdatedAt
-		q.users[index] = user
-		return user, nil
-	}
-	return database.User{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateUserLink(_ context.Context, params database.UpdateUserLinkParams) (database.UserLink, error) {
-	if err := validateDatabaseType(params); err != nil {
-		return database.UserLink{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, link := range q.userLinks {
-		if link.UserID == params.UserID && link.LoginType == params.LoginType {
-			link.OAuthAccessToken = params.OAuthAccessToken
-			link.OAuthRefreshToken = params.OAuthRefreshToken
-			link.OAuthExpiry = params.OAuthExpiry
-
-			q.userLinks[i] = link
-			return link, nil
-		}
-	}
-
-	return database.UserLink{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateUserLinkedID(_ context.Context, params database.UpdateUserLinkedIDParams) (database.UserLink, error) {
-	if err := validateDatabaseType(params); err != nil {
-		return database.UserLink{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, link := range q.userLinks {
-		if link.UserID == params.UserID && link.LoginType == params.LoginType {
-			link.LinkedID = params.LinkedID
-
-			q.userLinks[i] = link
-			return link, nil
-		}
-	}
-
-	return database.UserLink{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateUserLoginType(_ context.Context, arg database.UpdateUserLoginTypeParams) (database.User, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.User{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, u := range q.users {
-		if u.ID == arg.UserID {
-			u.LoginType = arg.NewLoginType
-			if arg.NewLoginType != database.LoginTypePassword {
-				u.HashedPassword = []byte{}
-			}
-			q.users[i] = u
-			return u, nil
-		}
-	}
-	return database.User{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateUserProfile(_ context.Context, arg database.UpdateUserProfileParams) (database.User, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.User{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, user := range q.users {
-		if user.ID != arg.ID {
-			continue
-		}
-		user.Email = arg.Email
-		user.Username = arg.Username
-		user.AvatarURL = arg.AvatarURL
-		q.users[index] = user
-		return user, nil
-	}
-	return database.User{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateUserQuietHoursSchedule(_ context.Context, arg database.UpdateUserQuietHoursScheduleParams) (database.User, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.User{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, user := range q.users {
-		if user.ID != arg.ID {
-			continue
-		}
-		user.QuietHoursSchedule = arg.QuietHoursSchedule
-		q.users[index] = user
-		return user, nil
-	}
-	return database.User{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateUserRoles(_ context.Context, arg database.UpdateUserRolesParams) (database.User, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.User{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, user := range q.users {
-		if user.ID != arg.ID {
-			continue
-		}
-
-		// Set new roles
-		user.RBACRoles = arg.GrantedRoles
-		// Remove duplicates and sort
-		uniqueRoles := make([]string, 0, len(user.RBACRoles))
-		exist := make(map[string]struct{})
-		for _, r := range user.RBACRoles {
-			if _, ok := exist[r]; ok {
-				continue
-			}
-			exist[r] = struct{}{}
-			uniqueRoles = append(uniqueRoles, r)
-		}
-		sort.Strings(uniqueRoles)
-		user.RBACRoles = uniqueRoles
-
-		q.users[index] = user
-		return user, nil
-	}
-	return database.User{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateUserStatus(_ context.Context, arg database.UpdateUserStatusParams) (database.User, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.User{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, user := range q.users {
-		if user.ID != arg.ID {
-			continue
-		}
-		user.Status = arg.Status
-		user.UpdatedAt = arg.UpdatedAt
-		q.users[index] = user
-		return user, nil
-	}
-	return database.User{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspace(_ context.Context, arg database.UpdateWorkspaceParams) (database.Workspace, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return database.Workspace{}, err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, workspace := range q.workspaces {
-		if workspace.Deleted || workspace.ID != arg.ID {
-			continue
-		}
-		for _, other := range q.workspaces {
-			if other.Deleted || other.ID == workspace.ID || workspace.OwnerID != other.OwnerID {
-				continue
-			}
-			if other.Name == arg.Name {
-				return database.Workspace{}, errDuplicateKey
-			}
-		}
-
-		workspace.Name = arg.Name
-		q.workspaces[i] = workspace
-
-		return workspace, nil
-	}
-
-	return database.Workspace{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceAgentConnectionByID(_ context.Context, arg database.UpdateWorkspaceAgentConnectionByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, agent := range q.workspaceAgents {
-		if agent.ID != arg.ID {
-			continue
-		}
-		agent.FirstConnectedAt = arg.FirstConnectedAt
-		agent.LastConnectedAt = arg.LastConnectedAt
-		agent.DisconnectedAt = arg.DisconnectedAt
-		agent.UpdatedAt = arg.UpdatedAt
-		q.workspaceAgents[index] = agent
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceAgentLifecycleStateByID(_ context.Context, arg database.UpdateWorkspaceAgentLifecycleStateByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-	for i, agent := range q.workspaceAgents {
-		if agent.ID == arg.ID {
-			agent.LifecycleState = arg.LifecycleState
-			agent.StartedAt = arg.StartedAt
-			agent.ReadyAt = arg.ReadyAt
-			q.workspaceAgents[i] = agent
-			return nil
-		}
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceAgentLogOverflowByID(_ context.Context, arg database.UpdateWorkspaceAgentLogOverflowByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-	for i, agent := range q.workspaceAgents {
-		if agent.ID == arg.ID {
-			agent.LogsOverflowed = arg.LogsOverflowed
-			q.workspaceAgents[i] = agent
-			return nil
-		}
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceAgentMetadata(_ context.Context, arg database.UpdateWorkspaceAgentMetadataParams) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	//nolint:gosimple
-	updated := database.WorkspaceAgentMetadatum{
-		WorkspaceAgentID: arg.WorkspaceAgentID,
-		Key:              arg.Key,
-		Value:            arg.Value,
-		Error:            arg.Error,
-		CollectedAt:      arg.CollectedAt,
-	}
-
-	for i, m := range q.workspaceAgentMetadata {
-		if m.WorkspaceAgentID == arg.WorkspaceAgentID && m.Key == arg.Key {
-			q.workspaceAgentMetadata[i] = updated
-			return nil
-		}
-	}
-
-	return nil
-}
-
-func (q *FakeQuerier) UpdateWorkspaceAgentStartupByID(_ context.Context, arg database.UpdateWorkspaceAgentStartupByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, agent := range q.workspaceAgents {
-		if agent.ID != arg.ID {
-			continue
-		}
-
-		agent.Version = arg.Version
-		agent.ExpandedDirectory = arg.ExpandedDirectory
-		agent.Subsystem = arg.Subsystem
-		q.workspaceAgents[index] = agent
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceAppHealthByID(_ context.Context, arg database.UpdateWorkspaceAppHealthByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, app := range q.workspaceApps {
-		if app.ID != arg.ID {
-			continue
-		}
-		app.Health = arg.Health
-		q.workspaceApps[index] = app
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceAutostart(_ context.Context, arg database.UpdateWorkspaceAutostartParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, workspace := range q.workspaces {
-		if workspace.ID != arg.ID {
-			continue
-		}
-		workspace.AutostartSchedule = arg.AutostartSchedule
-		q.workspaces[index] = workspace
-		return nil
-	}
-
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceBuildByID(_ context.Context, arg database.UpdateWorkspaceBuildByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, workspaceBuild := range q.workspaceBuilds {
-		if workspaceBuild.ID != arg.ID {
-			continue
-		}
-		workspaceBuild.UpdatedAt = arg.UpdatedAt
-		workspaceBuild.ProvisionerState = arg.ProvisionerState
-		workspaceBuild.Deadline = arg.Deadline
-		workspaceBuild.MaxDeadline = arg.MaxDeadline
-		q.workspaceBuilds[index] = workspaceBuild
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceBuildCostByID(_ context.Context, arg database.UpdateWorkspaceBuildCostByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, workspaceBuild := range q.workspaceBuilds {
-		if workspaceBuild.ID != arg.ID {
-			continue
-		}
-		workspaceBuild.DailyCost = arg.DailyCost
-		q.workspaceBuilds[index] = workspaceBuild
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceDeletedByID(_ context.Context, arg database.UpdateWorkspaceDeletedByIDParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, workspace := range q.workspaces {
-		if workspace.ID != arg.ID {
-			continue
-		}
-		workspace.Deleted = arg.Deleted
-		q.workspaces[index] = workspace
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceLastUsedAt(_ context.Context, arg database.UpdateWorkspaceLastUsedAtParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, workspace := range q.workspaces {
-		if workspace.ID != arg.ID {
-			continue
-		}
-		workspace.LastUsedAt = arg.LastUsedAt
-		q.workspaces[index] = workspace
-		return nil
-	}
-
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceLockedDeletingAt(_ context.Context, arg database.UpdateWorkspaceLockedDeletingAtParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-	for index, workspace := range q.workspaces {
-		if workspace.ID != arg.ID {
-			continue
-		}
-		workspace.LockedAt = arg.LockedAt
-		if workspace.LockedAt.Time.IsZero() {
-			workspace.LastUsedAt = database.Now()
-			workspace.DeletingAt = sql.NullTime{}
-		}
-		if !workspace.LockedAt.Time.IsZero() {
-			var template database.TemplateTable
-			for _, t := range q.templates {
-				if t.ID == workspace.TemplateID {
-					template = t
-					break
-				}
-			}
-			if template.ID == uuid.Nil {
-				return xerrors.Errorf("unable to find workspace template")
-			}
-			if template.LockedTTL > 0 {
-				workspace.DeletingAt = sql.NullTime{
-					Valid: true,
-					Time:  workspace.LockedAt.Time.Add(time.Duration(template.LockedTTL)),
-				}
-			}
-		}
-		q.workspaces[index] = workspace
-		return nil
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceProxy(_ context.Context, arg database.UpdateWorkspaceProxyParams) (database.WorkspaceProxy, error) {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for _, p := range q.workspaceProxies {
-		if p.Name == arg.Name && p.ID != arg.ID {
-			return database.WorkspaceProxy{}, errDuplicateKey
-		}
-	}
-
-	for i, p := range q.workspaceProxies {
-		if p.ID == arg.ID {
-			p.Name = arg.Name
-			p.DisplayName = arg.DisplayName
-			p.Icon = arg.Icon
-			if len(p.TokenHashedSecret) > 0 {
-				p.TokenHashedSecret = arg.TokenHashedSecret
-			}
-			q.workspaceProxies[i] = p
-			return p, nil
-		}
-	}
-	return database.WorkspaceProxy{}, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceProxyDeleted(_ context.Context, arg database.UpdateWorkspaceProxyDeletedParams) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for i, p := range q.workspaceProxies {
-		if p.ID == arg.ID {
-			p.Deleted = arg.Deleted
-			p.UpdatedAt = database.Now()
-			q.workspaceProxies[i] = p
-			return nil
-		}
-	}
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspaceTTL(_ context.Context, arg database.UpdateWorkspaceTTLParams) error {
-	if err := validateDatabaseType(arg); err != nil {
-		return err
-	}
-
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	for index, workspace := range q.workspaces {
-		if workspace.ID != arg.ID {
-			continue
-		}
-		workspace.Ttl = arg.Ttl
-		q.workspaces[index] = workspace
-		return nil
-	}
-
-	return sql.ErrNoRows
-}
-
-func (q *FakeQuerier) UpdateWorkspacesDeletingAtByTemplateID(_ context.Context, arg database.UpdateWorkspacesDeletingAtByTemplateIDParams) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	err := validateDatabaseType(arg)
-	if err != nil {
-		return err
-	}
-
-	for i, ws := range q.workspaces {
-		if ws.LockedAt.Time.IsZero() {
-			continue
-		}
-		deletingAt := sql.NullTime{
-			Valid: arg.LockedTtlMs > 0,
-		}
-		if arg.LockedTtlMs > 0 {
-			deletingAt.Time = ws.LockedAt.Time.Add(time.Duration(arg.LockedTtlMs) * time.Millisecond)
-		}
-		ws.DeletingAt = deletingAt
-		q.workspaces[i] = ws
-	}
-
-	return nil
-}
-
-func (q *FakeQuerier) UpsertAppSecurityKey(_ context.Context, data string) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	q.appSecurityKey = data
-	return nil
-}
-
-func (q *FakeQuerier) UpsertDefaultProxy(_ context.Context, arg database.UpsertDefaultProxyParams) error {
-	q.defaultProxyDisplayName = arg.DisplayName
-	q.defaultProxyIconURL = arg.IconUrl
-	return nil
-}
-
-func (q *FakeQuerier) UpsertLastUpdateCheck(_ context.Context, data string) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	q.lastUpdateCheck = []byte(data)
-	return nil
-}
-
-func (q *FakeQuerier) UpsertLogoURL(_ context.Context, data string) error {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	q.logoURL = data
-	return nil
-}
-
-func (q *FakeQuerier) UpsertOAuthSigningKey(_ context.Context, value string) error {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	q.oauthSigningKey = value
-	return nil
-}
-
-func (q *FakeQuerier) UpsertServiceBanner(_ context.Context, data string) error {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	q.serviceBanner = []byte(data)
-	return nil
-}
-
-func (*FakeQuerier) UpsertTailnetAgent(context.Context, database.UpsertTailnetAgentParams) (database.TailnetAgent, error) {
-	return database.TailnetAgent{}, ErrUnimplemented
-}
-
-func (*FakeQuerier) UpsertTailnetClient(context.Context, database.UpsertTailnetClientParams) (database.TailnetClient, error) {
-	return database.TailnetClient{}, ErrUnimplemented
-}
-
-func (*FakeQuerier) UpsertTailnetCoordinator(context.Context, uuid.UUID) (database.TailnetCoordinator, error) {
-	return database.TailnetCoordinator{}, ErrUnimplemented
-}
-
-func (q *FakeQuerier) GetAuthorizedTemplates(ctx context.Context, arg database.GetTemplatesWithFilterParams, prepared rbac.PreparedAuthorized) ([]database.Template, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return nil, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	// Call this to match the same function calls as the SQL implementation.
-	if prepared != nil {
-		_, err := prepared.CompileToSQL(ctx, rbac.ConfigWithACL())
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	var templates []database.Template
-	for _, templateTable := range q.templates {
-		template := q.templateWithUserNoLock(templateTable)
-		if prepared != nil && prepared.Authorize(ctx, template.RBACObject()) != nil {
-			continue
-		}
-
-		if template.Deleted != arg.Deleted {
-			continue
-		}
-		if arg.OrganizationID != uuid.Nil && template.OrganizationID != arg.OrganizationID {
-			continue
-		}
-
-		if arg.ExactName != "" && !strings.EqualFold(template.Name, arg.ExactName) {
-			continue
-		}
-
-		if len(arg.IDs) > 0 {
-			match := false
-			for _, id := range arg.IDs {
-				if template.ID == id {
-					match = true
-					break
-				}
-			}
-			if !match {
-				continue
-			}
-		}
-		templates = append(templates, template)
-	}
-	if len(templates) > 0 {
-		slices.SortFunc(templates, func(i, j database.Template) bool {
-			if i.Name != j.Name {
-				return i.Name < j.Name
-			}
-			return i.ID.String() < j.ID.String()
-		})
-		return templates, nil
-	}
-
-	return nil, sql.ErrNoRows
-}
-
-func (q *FakeQuerier) GetTemplateGroupRoles(_ context.Context, id uuid.UUID) ([]database.TemplateGroup, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	var template database.TemplateTable
-	for _, t := range q.templates {
-		if t.ID == id {
-			template = t
-			break
-		}
-	}
-
-	if template.ID == uuid.Nil {
-		return nil, sql.ErrNoRows
-	}
-
-	groups := make([]database.TemplateGroup, 0, len(template.GroupACL))
-	for k, v := range template.GroupACL {
-		group, err := q.getGroupByIDNoLock(context.Background(), uuid.MustParse(k))
-		if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
-			return nil, xerrors.Errorf("get group by ID: %w", err)
-		}
-		// We don't delete groups from the map if they
-		// get deleted so just skip.
-		if xerrors.Is(err, sql.ErrNoRows) {
-			continue
-		}
-
-		groups = append(groups, database.TemplateGroup{
-			Group:   group,
-			Actions: v,
-		})
-	}
-
-	return groups, nil
-}
-
-func (q *FakeQuerier) GetTemplateUserRoles(_ context.Context, id uuid.UUID) ([]database.TemplateUser, error) {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	var template database.TemplateTable
-	for _, t := range q.templates {
-		if t.ID == id {
-			template = t
-			break
-		}
-	}
-
-	if template.ID == uuid.Nil {
-		return nil, sql.ErrNoRows
-	}
-
-	users := make([]database.TemplateUser, 0, len(template.UserACL))
-	for k, v := range template.UserACL {
-		user, err := q.getUserByIDNoLock(uuid.MustParse(k))
-		if err != nil && xerrors.Is(err, sql.ErrNoRows) {
-			return nil, xerrors.Errorf("get user by ID: %w", err)
-		}
-		// We don't delete users from the map if they
-		// get deleted so just skip.
-		if xerrors.Is(err, sql.ErrNoRows) {
-			continue
-		}
-
-		if user.Deleted || user.Status == database.UserStatusSuspended {
-			continue
-		}
-
-		users = append(users, database.TemplateUser{
-			User:    user,
-			Actions: v,
-		})
-	}
-
-	return users, nil
-}
-
-//nolint:gocyclo
-func (q *FakeQuerier) GetAuthorizedWorkspaces(ctx context.Context, arg database.GetWorkspacesParams, prepared rbac.PreparedAuthorized) ([]database.GetWorkspacesRow, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return nil, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	if prepared != nil {
-		// Call this to match the same function calls as the SQL implementation.
-		_, err := prepared.CompileToSQL(ctx, rbac.ConfigWithoutACL())
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	workspaces := make([]database.Workspace, 0)
-	for _, workspace := range q.workspaces {
-		if arg.OwnerID != uuid.Nil && workspace.OwnerID != arg.OwnerID {
-			continue
-		}
-
-		if arg.OwnerUsername != "" {
-			owner, err := q.getUserByIDNoLock(workspace.OwnerID)
-			if err == nil && !strings.EqualFold(arg.OwnerUsername, owner.Username) {
-				continue
-			}
-		}
-
-		if arg.TemplateName != "" {
-			template, err := q.getTemplateByIDNoLock(ctx, workspace.TemplateID)
-			if err == nil && !strings.EqualFold(arg.TemplateName, template.Name) {
-				continue
-			}
-		}
-
-		if !arg.Deleted && workspace.Deleted {
-			continue
-		}
-
-		if arg.Name != "" && !strings.Contains(strings.ToLower(workspace.Name), strings.ToLower(arg.Name)) {
-			continue
-		}
-
-		if arg.Status != "" {
-			build, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspace.ID)
-			if err != nil {
-				return nil, xerrors.Errorf("get latest build: %w", err)
-			}
-
-			job, err := q.getProvisionerJobByIDNoLock(ctx, build.JobID)
-			if err != nil {
-				return nil, xerrors.Errorf("get provisioner job: %w", err)
-			}
-
-			// This logic should match the logic in the workspace.sql file.
-			var statusMatch bool
-			switch database.WorkspaceStatus(arg.Status) {
-			case database.WorkspaceStatusPending:
-				statusMatch = isNull(job.StartedAt)
-			case database.WorkspaceStatusStarting:
-				statusMatch = isNotNull(job.StartedAt) &&
-					isNull(job.CanceledAt) &&
-					isNull(job.CompletedAt) &&
-					time.Since(job.UpdatedAt) < 30*time.Second &&
-					build.Transition == database.WorkspaceTransitionStart
-
-			case database.WorkspaceStatusRunning:
-				statusMatch = isNotNull(job.CompletedAt) &&
-					isNull(job.CanceledAt) &&
-					isNull(job.Error) &&
-					build.Transition == database.WorkspaceTransitionStart
-
-			case database.WorkspaceStatusStopping:
-				statusMatch = isNotNull(job.StartedAt) &&
-					isNull(job.CanceledAt) &&
-					isNull(job.CompletedAt) &&
-					time.Since(job.UpdatedAt) < 30*time.Second &&
-					build.Transition == database.WorkspaceTransitionStop
-
-			case database.WorkspaceStatusStopped:
-				statusMatch = isNotNull(job.CompletedAt) &&
-					isNull(job.CanceledAt) &&
-					isNull(job.Error) &&
-					build.Transition == database.WorkspaceTransitionStop
-			case database.WorkspaceStatusFailed:
-				statusMatch = (isNotNull(job.CanceledAt) && isNotNull(job.Error)) ||
-					(isNotNull(job.CompletedAt) && isNotNull(job.Error))
-
-			case database.WorkspaceStatusCanceling:
-				statusMatch = isNotNull(job.CanceledAt) &&
-					isNull(job.CompletedAt)
-
-			case database.WorkspaceStatusCanceled:
-				statusMatch = isNotNull(job.CanceledAt) &&
-					isNotNull(job.CompletedAt)
-
-			case database.WorkspaceStatusDeleted:
-				statusMatch = isNotNull(job.StartedAt) &&
-					isNull(job.CanceledAt) &&
-					isNotNull(job.CompletedAt) &&
-					time.Since(job.UpdatedAt) < 30*time.Second &&
-					build.Transition == database.WorkspaceTransitionDelete &&
-					isNull(job.Error)
-
-			case database.WorkspaceStatusDeleting:
-				statusMatch = isNull(job.CompletedAt) &&
-					isNull(job.CanceledAt) &&
-					isNull(job.Error) &&
-					build.Transition == database.WorkspaceTransitionDelete
-
-			default:
-				return nil, xerrors.Errorf("unknown workspace status in filter: %q", arg.Status)
-			}
-			if !statusMatch {
-				continue
-			}
-		}
-
-		if arg.HasAgent != "" {
-			build, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspace.ID)
-			if err != nil {
-				return nil, xerrors.Errorf("get latest build: %w", err)
-			}
-
-			job, err := q.getProvisionerJobByIDNoLock(ctx, build.JobID)
-			if err != nil {
-				return nil, xerrors.Errorf("get provisioner job: %w", err)
-			}
-
-			workspaceResources, err := q.getWorkspaceResourcesByJobIDNoLock(ctx, job.ID)
-			if err != nil {
-				return nil, xerrors.Errorf("get workspace resources: %w", err)
-			}
-
-			var workspaceResourceIDs []uuid.UUID
-			for _, wr := range workspaceResources {
-				workspaceResourceIDs = append(workspaceResourceIDs, wr.ID)
-			}
-
-			workspaceAgents, err := q.getWorkspaceAgentsByResourceIDsNoLock(ctx, workspaceResourceIDs)
-			if err != nil {
-				return nil, xerrors.Errorf("get workspace agents: %w", err)
-			}
-
-			var hasAgentMatched bool
-			for _, wa := range workspaceAgents {
-				if mapAgentStatus(wa, arg.AgentInactiveDisconnectTimeoutSeconds) == arg.HasAgent {
-					hasAgentMatched = true
-				}
-			}
-
-			if !hasAgentMatched {
-				continue
-			}
-		}
-
-		if len(arg.TemplateIDs) > 0 {
-			match := false
-			for _, id := range arg.TemplateIDs {
-				if workspace.TemplateID == id {
-					match = true
-					break
-				}
-			}
-			if !match {
-				continue
-			}
-		}
-
-		// If the filter exists, ensure the object is authorized.
-		if prepared != nil && prepared.Authorize(ctx, workspace.RBACObject()) != nil {
-			continue
-		}
-		workspaces = append(workspaces, workspace)
-	}
-
-	// Sort workspaces (ORDER BY)
-	isRunning := func(build database.WorkspaceBuild, job database.ProvisionerJob) bool {
-		return job.CompletedAt.Valid && !job.CanceledAt.Valid && !job.Error.Valid && build.Transition == database.WorkspaceTransitionStart
-	}
-
-	preloadedWorkspaceBuilds := map[uuid.UUID]database.WorkspaceBuild{}
-	preloadedProvisionerJobs := map[uuid.UUID]database.ProvisionerJob{}
-	preloadedUsers := map[uuid.UUID]database.User{}
-
-	for _, w := range workspaces {
-		build, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, w.ID)
-		if err == nil {
-			preloadedWorkspaceBuilds[w.ID] = build
-		} else if !errors.Is(err, sql.ErrNoRows) {
-			return nil, xerrors.Errorf("get latest build: %w", err)
-		}
-
-		job, err := q.getProvisionerJobByIDNoLock(ctx, build.JobID)
-		if err == nil {
-			preloadedProvisionerJobs[w.ID] = job
-		} else if !errors.Is(err, sql.ErrNoRows) {
-			return nil, xerrors.Errorf("get provisioner job: %w", err)
-		}
-
-		user, err := q.getUserByIDNoLock(w.OwnerID)
-		if err == nil {
-			preloadedUsers[w.ID] = user
-		} else if !errors.Is(err, sql.ErrNoRows) {
-			return nil, xerrors.Errorf("get user: %w", err)
-		}
-	}
-
-	sort.Slice(workspaces, func(i, j int) bool {
-		w1 := workspaces[i]
-		w2 := workspaces[j]
-
-		// Order by: running first
-		w1IsRunning := isRunning(preloadedWorkspaceBuilds[w1.ID], preloadedProvisionerJobs[w1.ID])
-		w2IsRunning := isRunning(preloadedWorkspaceBuilds[w2.ID], preloadedProvisionerJobs[w2.ID])
-
-		if w1IsRunning && !w2IsRunning {
-			return true
-		}
-
-		if !w1IsRunning && w2IsRunning {
-			return false
-		}
-
-		// Order by: usernames
-		if w1.ID != w2.ID {
-			return sort.StringsAreSorted([]string{preloadedUsers[w1.ID].Username, preloadedUsers[w2.ID].Username})
-		}
-
-		// Order by: workspace names
-		return sort.StringsAreSorted([]string{w1.Name, w2.Name})
-	})
-
-	beforePageCount := len(workspaces)
-
-	if arg.Offset > 0 {
-		if int(arg.Offset) > len(workspaces) {
-			return []database.GetWorkspacesRow{}, nil
-		}
-		workspaces = workspaces[arg.Offset:]
-	}
-	if arg.Limit > 0 {
-		if int(arg.Limit) > len(workspaces) {
-			return q.convertToWorkspaceRowsNoLock(ctx, workspaces, int64(beforePageCount)), nil
-		}
-		workspaces = workspaces[:arg.Limit]
-	}
-
-	return q.convertToWorkspaceRowsNoLock(ctx, workspaces, int64(beforePageCount)), nil
-}
-
-func (q *FakeQuerier) GetAuthorizedUsers(ctx context.Context, arg database.GetUsersParams, prepared rbac.PreparedAuthorized) ([]database.GetUsersRow, error) {
-	if err := validateDatabaseType(arg); err != nil {
-		return nil, err
-	}
-
-	// Call this to match the same function calls as the SQL implementation.
-	if prepared != nil {
-		_, err := prepared.CompileToSQL(ctx, regosql.ConvertConfig{
-			VariableConverter: regosql.UserConverter(),
-		})
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	users, err := q.GetUsers(ctx, arg)
-	if err != nil {
-		return nil, err
-	}
-
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	filteredUsers := make([]database.GetUsersRow, 0, len(users))
-	for _, user := range users {
-		// If the filter exists, ensure the object is authorized.
-		if prepared != nil && prepared.Authorize(ctx, user.RBACObject()) != nil {
-			continue
-		}
-
-		filteredUsers = append(filteredUsers, user)
-	}
-	return filteredUsers, nil
-}
diff --git a/coderd/database/dbfake/dbfake_test.go b/coderd/database/dbfake/dbfake_test.go
deleted file mode 100644
index 445ba6be8ec49..0000000000000
--- a/coderd/database/dbfake/dbfake_test.go
+++ /dev/null
@@ -1,209 +0,0 @@
-package dbfake_test
-
-import (
-	"context"
-	"database/sql"
-	"sort"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-)
-
-// test that transactions don't deadlock, and that we don't see intermediate state.
-func TestInTx(t *testing.T) {
-	t.Parallel()
-
-	uut := dbfake.New()
-
-	inTx := make(chan any)
-	queriesDone := make(chan any)
-	queriesStarted := make(chan any)
-	go func() {
-		err := uut.InTx(func(tx database.Store) error {
-			close(inTx)
-			_, err := tx.InsertOrganization(context.Background(), database.InsertOrganizationParams{
-				Name: "1",
-			})
-			assert.NoError(t, err)
-			<-queriesStarted
-			time.Sleep(5 * time.Millisecond)
-			_, err = tx.InsertOrganization(context.Background(), database.InsertOrganizationParams{
-				Name: "2",
-			})
-			assert.NoError(t, err)
-			return nil
-		}, nil)
-		assert.NoError(t, err)
-	}()
-	var nums []int
-	go func() {
-		<-inTx
-		for i := 0; i < 20; i++ {
-			orgs, err := uut.GetOrganizations(context.Background())
-			if err != nil {
-				assert.ErrorIs(t, err, sql.ErrNoRows)
-			}
-			nums = append(nums, len(orgs))
-			time.Sleep(time.Millisecond)
-		}
-		close(queriesDone)
-	}()
-	close(queriesStarted)
-	<-queriesDone
-	// ensure we never saw 1 org, only 0 or 2.
-	for i := 0; i < 20; i++ {
-		assert.NotEqual(t, 1, nums[i])
-	}
-}
-
-// TestUserOrder ensures that the fake database returns users sorted by username.
-func TestUserOrder(t *testing.T) {
-	t.Parallel()
-
-	db := dbfake.New()
-	now := database.Now()
-
-	usernames := []string{"b-user", "d-user", "a-user", "c-user", "e-user"}
-	for _, username := range usernames {
-		dbgen.User(t, db, database.User{Username: username, CreatedAt: now})
-	}
-
-	users, err := db.GetUsers(context.Background(), database.GetUsersParams{})
-	require.NoError(t, err)
-	require.Lenf(t, users, len(usernames), "expected %d users", len(usernames))
-
-	sort.Strings(usernames)
-	for i, user := range users {
-		require.Equal(t, usernames[i], user.Username)
-	}
-}
-
-func TestProxyByHostname(t *testing.T) {
-	t.Parallel()
-
-	db := dbfake.New()
-
-	// Insert a bunch of different proxies.
-	proxies := []struct {
-		name             string
-		accessURL        string
-		wildcardHostname string
-	}{
-		{
-			name:             "one",
-			accessURL:        "https://one.coder.com",
-			wildcardHostname: "*.wildcard.one.coder.com",
-		},
-		{
-			name:             "two",
-			accessURL:        "https://two.coder.com",
-			wildcardHostname: "*--suffix.two.coder.com",
-		},
-	}
-	for _, p := range proxies {
-		dbgen.WorkspaceProxy(t, db, database.WorkspaceProxy{
-			Name:             p.name,
-			Url:              p.accessURL,
-			WildcardHostname: p.wildcardHostname,
-		})
-	}
-
-	cases := []struct {
-		name              string
-		testHostname      string
-		allowAccessURL    bool
-		allowWildcardHost bool
-		matchProxyName    string
-	}{
-		{
-			name:              "NoMatch",
-			testHostname:      "test.com",
-			allowAccessURL:    true,
-			allowWildcardHost: true,
-			matchProxyName:    "",
-		},
-		{
-			name:              "MatchAccessURL",
-			testHostname:      "one.coder.com",
-			allowAccessURL:    true,
-			allowWildcardHost: true,
-			matchProxyName:    "one",
-		},
-		{
-			name:              "MatchWildcard",
-			testHostname:      "something.wildcard.one.coder.com",
-			allowAccessURL:    true,
-			allowWildcardHost: true,
-			matchProxyName:    "one",
-		},
-		{
-			name:              "MatchSuffix",
-			testHostname:      "something--suffix.two.coder.com",
-			allowAccessURL:    true,
-			allowWildcardHost: true,
-			matchProxyName:    "two",
-		},
-		{
-			name:              "ValidateHostname/1",
-			testHostname:      ".*ne.coder.com",
-			allowAccessURL:    true,
-			allowWildcardHost: true,
-			matchProxyName:    "",
-		},
-		{
-			name:              "ValidateHostname/2",
-			testHostname:      "https://one.coder.com",
-			allowAccessURL:    true,
-			allowWildcardHost: true,
-			matchProxyName:    "",
-		},
-		{
-			name:              "ValidateHostname/3",
-			testHostname:      "one.coder.com:8080/hello",
-			allowAccessURL:    true,
-			allowWildcardHost: true,
-			matchProxyName:    "",
-		},
-		{
-			name:              "IgnoreAccessURLMatch",
-			testHostname:      "one.coder.com",
-			allowAccessURL:    false,
-			allowWildcardHost: true,
-			matchProxyName:    "",
-		},
-		{
-			name:              "IgnoreWildcardMatch",
-			testHostname:      "hi.wildcard.one.coder.com",
-			allowAccessURL:    true,
-			allowWildcardHost: false,
-			matchProxyName:    "",
-		},
-	}
-
-	for _, c := range cases {
-		c := c
-		t.Run(c.name, func(t *testing.T) {
-			t.Parallel()
-
-			proxy, err := db.GetWorkspaceProxyByHostname(context.Background(), database.GetWorkspaceProxyByHostnameParams{
-				Hostname:              c.testHostname,
-				AllowAccessUrl:        c.allowAccessURL,
-				AllowWildcardHostname: c.allowWildcardHost,
-			})
-			if c.matchProxyName == "" {
-				require.ErrorIs(t, err, sql.ErrNoRows)
-				require.Empty(t, proxy)
-			} else {
-				require.NoError(t, err)
-				require.NotEmpty(t, proxy)
-				require.Equal(t, c.matchProxyName, proxy.Name)
-			}
-		})
-	}
-}
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
index 3e38f5c4561c9..b1146b4f49d81 100644
--- a/coderd/database/dbgen/dbgen.go
+++ b/coderd/database/dbgen/dbgen.go
@@ -16,10 +16,13 @@ import (
 	"github.com/sqlc-dev/pqtype"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/provisionerjobs"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 // All methods take in a 'seed' object. Any provided fields in the seed will be
@@ -36,7 +39,7 @@ var genCtx = dbauthz.As(context.Background(), rbac.Subject{
 func AuditLog(t testing.TB, db database.Store, seed database.AuditLog) database.AuditLog {
 	log, err := db.InsertAuditLog(genCtx, database.InsertAuditLogParams{
 		ID:             takeFirst(seed.ID, uuid.New()),
-		Time:           takeFirst(seed.Time, database.Now()),
+		Time:           takeFirst(seed.Time, dbtime.Now()),
 		UserID:         takeFirst(seed.UserID, uuid.New()),
 		OrganizationID: takeFirst(seed.OrganizationID, uuid.New()),
 		Ip: pqtype.Inet{
@@ -65,8 +68,8 @@ func Template(t testing.TB, db database.Store, seed database.Template) database.
 	id := takeFirst(seed.ID, uuid.New())
 	err := db.InsertTemplate(genCtx, database.InsertTemplateParams{
 		ID:                           id,
-		CreatedAt:                    takeFirst(seed.CreatedAt, database.Now()),
-		UpdatedAt:                    takeFirst(seed.UpdatedAt, database.Now()),
+		CreatedAt:                    takeFirst(seed.CreatedAt, dbtime.Now()),
+		UpdatedAt:                    takeFirst(seed.UpdatedAt, dbtime.Now()),
 		OrganizationID:               takeFirst(seed.OrganizationID, uuid.New()),
 		Name:                         takeFirst(seed.Name, namesgenerator.GetRandomName(1)),
 		Provisioner:                  takeFirst(seed.Provisioner, database.ProvisionerTypeEcho),
@@ -109,10 +112,10 @@ func APIKey(t testing.TB, db database.Store, seed database.APIKey) (key database
 		HashedSecret:    takeFirstSlice(seed.HashedSecret, hashed[:]),
 		IPAddress:       ip,
 		UserID:          takeFirst(seed.UserID, uuid.New()),
-		LastUsed:        takeFirst(seed.LastUsed, database.Now()),
-		ExpiresAt:       takeFirst(seed.ExpiresAt, database.Now().Add(time.Hour)),
-		CreatedAt:       takeFirst(seed.CreatedAt, database.Now()),
-		UpdatedAt:       takeFirst(seed.UpdatedAt, database.Now()),
+		LastUsed:        takeFirst(seed.LastUsed, dbtime.Now()),
+		ExpiresAt:       takeFirst(seed.ExpiresAt, dbtime.Now().Add(time.Hour)),
+		CreatedAt:       takeFirst(seed.CreatedAt, dbtime.Now()),
+		UpdatedAt:       takeFirst(seed.UpdatedAt, dbtime.Now()),
 		LoginType:       takeFirst(seed.LoginType, database.LoginTypePassword),
 		Scope:           takeFirst(seed.Scope, database.APIKeyScopeAll),
 		TokenName:       takeFirst(seed.TokenName),
@@ -122,10 +125,10 @@ func APIKey(t testing.TB, db database.Store, seed database.APIKey) (key database
 }
 
 func WorkspaceAgent(t testing.TB, db database.Store, orig database.WorkspaceAgent) database.WorkspaceAgent {
-	workspace, err := db.InsertWorkspaceAgent(genCtx, database.InsertWorkspaceAgentParams{
+	agt, err := db.InsertWorkspaceAgent(genCtx, database.InsertWorkspaceAgentParams{
 		ID:         takeFirst(orig.ID, uuid.New()),
-		CreatedAt:  takeFirst(orig.CreatedAt, database.Now()),
-		UpdatedAt:  takeFirst(orig.UpdatedAt, database.Now()),
+		CreatedAt:  takeFirst(orig.CreatedAt, dbtime.Now()),
+		UpdatedAt:  takeFirst(orig.UpdatedAt, dbtime.Now()),
 		Name:       takeFirst(orig.Name, namesgenerator.GetRandomName(1)),
 		ResourceID: takeFirst(orig.ResourceID, uuid.New()),
 		AuthToken:  takeFirst(orig.AuthToken, uuid.New()),
@@ -139,11 +142,7 @@ func WorkspaceAgent(t testing.TB, db database.Store, orig database.WorkspaceAgen
 			Valid:      takeFirst(orig.EnvironmentVariables.Valid, false),
 		},
 		OperatingSystem: takeFirst(orig.OperatingSystem, "linux"),
-		StartupScript: sql.NullString{
-			String: takeFirst(orig.StartupScript.String, ""),
-			Valid:  takeFirst(orig.StartupScript.Valid, false),
-		},
-		Directory: takeFirst(orig.Directory, ""),
+		Directory:       takeFirst(orig.Directory, ""),
 		InstanceMetadata: pqtype.NullRawMessage{
 			RawMessage: takeFirstSlice(orig.ResourceMetadata.RawMessage, []byte("{}")),
 			Valid:      takeFirst(orig.ResourceMetadata.Valid, false),
@@ -152,41 +151,53 @@ func WorkspaceAgent(t testing.TB, db database.Store, orig database.WorkspaceAgen
 			RawMessage: takeFirstSlice(orig.ResourceMetadata.RawMessage, []byte("{}")),
 			Valid:      takeFirst(orig.ResourceMetadata.Valid, false),
 		},
-		ConnectionTimeoutSeconds:    takeFirst(orig.ConnectionTimeoutSeconds, 3600),
-		TroubleshootingURL:          takeFirst(orig.TroubleshootingURL, "https://example.com"),
-		MOTDFile:                    takeFirst(orig.TroubleshootingURL, ""),
-		StartupScriptBehavior:       takeFirst(orig.StartupScriptBehavior, "non-blocking"),
-		StartupScriptTimeoutSeconds: takeFirst(orig.StartupScriptTimeoutSeconds, 3600),
+		ConnectionTimeoutSeconds: takeFirst(orig.ConnectionTimeoutSeconds, 3600),
+		TroubleshootingURL:       takeFirst(orig.TroubleshootingURL, "https://example.com"),
+		MOTDFile:                 takeFirst(orig.TroubleshootingURL, ""),
+		DisplayApps:              append([]database.DisplayApp{}, orig.DisplayApps...),
 	})
 	require.NoError(t, err, "insert workspace agent")
-	return workspace
+	return agt
 }
 
 func Workspace(t testing.TB, db database.Store, orig database.Workspace) database.Workspace {
 	workspace, err := db.InsertWorkspace(genCtx, database.InsertWorkspaceParams{
 		ID:                takeFirst(orig.ID, uuid.New()),
 		OwnerID:           takeFirst(orig.OwnerID, uuid.New()),
-		CreatedAt:         takeFirst(orig.CreatedAt, database.Now()),
-		UpdatedAt:         takeFirst(orig.UpdatedAt, database.Now()),
+		CreatedAt:         takeFirst(orig.CreatedAt, dbtime.Now()),
+		UpdatedAt:         takeFirst(orig.UpdatedAt, dbtime.Now()),
 		OrganizationID:    takeFirst(orig.OrganizationID, uuid.New()),
 		TemplateID:        takeFirst(orig.TemplateID, uuid.New()),
-		LastUsedAt:        takeFirst(orig.LastUsedAt, database.Now()),
+		LastUsedAt:        takeFirst(orig.LastUsedAt, dbtime.Now()),
 		Name:              takeFirst(orig.Name, namesgenerator.GetRandomName(1)),
 		AutostartSchedule: orig.AutostartSchedule,
 		Ttl:               orig.Ttl,
+		AutomaticUpdates:  takeFirst(orig.AutomaticUpdates, database.AutomaticUpdatesNever),
 	})
 	require.NoError(t, err, "insert workspace")
 	return workspace
 }
 
+func WorkspaceAgentLogSource(t testing.TB, db database.Store, orig database.WorkspaceAgentLogSource) database.WorkspaceAgentLogSource {
+	sources, err := db.InsertWorkspaceAgentLogSources(genCtx, database.InsertWorkspaceAgentLogSourcesParams{
+		WorkspaceAgentID: takeFirst(orig.WorkspaceAgentID, uuid.New()),
+		ID:               []uuid.UUID{takeFirst(orig.ID, uuid.New())},
+		CreatedAt:        takeFirst(orig.CreatedAt, dbtime.Now()),
+		DisplayName:      []string{takeFirst(orig.DisplayName, namesgenerator.GetRandomName(1))},
+		Icon:             []string{takeFirst(orig.Icon, namesgenerator.GetRandomName(1))},
+	})
+	require.NoError(t, err, "insert workspace agent log source")
+	return sources[0]
+}
+
 func WorkspaceBuild(t testing.TB, db database.Store, orig database.WorkspaceBuild) database.WorkspaceBuild {
 	buildID := takeFirst(orig.ID, uuid.New())
 	var build database.WorkspaceBuild
 	err := db.InTx(func(db database.Store) error {
 		err := db.InsertWorkspaceBuild(genCtx, database.InsertWorkspaceBuildParams{
 			ID:                buildID,
-			CreatedAt:         takeFirst(orig.CreatedAt, database.Now()),
-			UpdatedAt:         takeFirst(orig.UpdatedAt, database.Now()),
+			CreatedAt:         takeFirst(orig.CreatedAt, dbtime.Now()),
+			UpdatedAt:         takeFirst(orig.UpdatedAt, dbtime.Now()),
 			WorkspaceID:       takeFirst(orig.WorkspaceID, uuid.New()),
 			TemplateVersionID: takeFirst(orig.TemplateVersionID, uuid.New()),
 			BuildNumber:       takeFirst(orig.BuildNumber, 1),
@@ -194,7 +205,8 @@ func WorkspaceBuild(t testing.TB, db database.Store, orig database.WorkspaceBuil
 			InitiatorID:       takeFirst(orig.InitiatorID, uuid.New()),
 			JobID:             takeFirst(orig.JobID, uuid.New()),
 			ProvisionerState:  takeFirstSlice(orig.ProvisionerState, []byte{}),
-			Deadline:          takeFirst(orig.Deadline, database.Now().Add(time.Hour)),
+			Deadline:          takeFirst(orig.Deadline, dbtime.Now().Add(time.Hour)),
+			MaxDeadline:       takeFirst(orig.MaxDeadline, time.Time{}),
 			Reason:            takeFirst(orig.Reason, database.BuildReasonInitiator),
 		})
 		if err != nil {
@@ -217,8 +229,8 @@ func User(t testing.TB, db database.Store, orig database.User) database.User {
 		Email:          takeFirst(orig.Email, namesgenerator.GetRandomName(1)),
 		Username:       takeFirst(orig.Username, namesgenerator.GetRandomName(1)),
 		HashedPassword: takeFirstSlice(orig.HashedPassword, []byte(must(cryptorand.String(32)))),
-		CreatedAt:      takeFirst(orig.CreatedAt, database.Now()),
-		UpdatedAt:      takeFirst(orig.UpdatedAt, database.Now()),
+		CreatedAt:      takeFirst(orig.CreatedAt, dbtime.Now()),
+		UpdatedAt:      takeFirst(orig.UpdatedAt, dbtime.Now()),
 		RBACRoles:      takeFirstSlice(orig.RBACRoles, []string{}),
 		LoginType:      takeFirst(orig.LoginType, database.LoginTypePassword),
 	})
@@ -226,8 +238,8 @@ func User(t testing.TB, db database.Store, orig database.User) database.User {
 
 	user, err = db.UpdateUserStatus(genCtx, database.UpdateUserStatusParams{
 		ID:        user.ID,
-		Status:    database.UserStatusActive,
-		UpdatedAt: database.Now(),
+		Status:    takeFirst(orig.Status, database.UserStatusActive),
+		UpdatedAt: dbtime.Now(),
 	})
 	require.NoError(t, err, "insert user")
 
@@ -239,14 +251,22 @@ func User(t testing.TB, db database.Store, orig database.User) database.User {
 		})
 		require.NoError(t, err, "user last seen")
 	}
+
+	if orig.Deleted {
+		err = db.UpdateUserDeletedByID(genCtx, database.UpdateUserDeletedByIDParams{
+			ID:      user.ID,
+			Deleted: orig.Deleted,
+		})
+		require.NoError(t, err, "set user as deleted")
+	}
 	return user
 }
 
 func GitSSHKey(t testing.TB, db database.Store, orig database.GitSSHKey) database.GitSSHKey {
 	key, err := db.InsertGitSSHKey(genCtx, database.InsertGitSSHKeyParams{
 		UserID:     takeFirst(orig.UserID, uuid.New()),
-		CreatedAt:  takeFirst(orig.CreatedAt, database.Now()),
-		UpdatedAt:  takeFirst(orig.UpdatedAt, database.Now()),
+		CreatedAt:  takeFirst(orig.CreatedAt, dbtime.Now()),
+		UpdatedAt:  takeFirst(orig.UpdatedAt, dbtime.Now()),
 		PrivateKey: takeFirst(orig.PrivateKey, ""),
 		PublicKey:  takeFirst(orig.PublicKey, ""),
 	})
@@ -259,8 +279,8 @@ func Organization(t testing.TB, db database.Store, orig database.Organization) d
 		ID:          takeFirst(orig.ID, uuid.New()),
 		Name:        takeFirst(orig.Name, namesgenerator.GetRandomName(1)),
 		Description: takeFirst(orig.Description, namesgenerator.GetRandomName(1)),
-		CreatedAt:   takeFirst(orig.CreatedAt, database.Now()),
-		UpdatedAt:   takeFirst(orig.UpdatedAt, database.Now()),
+		CreatedAt:   takeFirst(orig.CreatedAt, dbtime.Now()),
+		UpdatedAt:   takeFirst(orig.UpdatedAt, dbtime.Now()),
 	})
 	require.NoError(t, err, "insert organization")
 	return org
@@ -270,8 +290,8 @@ func OrganizationMember(t testing.TB, db database.Store, orig database.Organizat
 	mem, err := db.InsertOrganizationMember(genCtx, database.InsertOrganizationMemberParams{
 		OrganizationID: takeFirst(orig.OrganizationID, uuid.New()),
 		UserID:         takeFirst(orig.UserID, uuid.New()),
-		CreatedAt:      takeFirst(orig.CreatedAt, database.Now()),
-		UpdatedAt:      takeFirst(orig.UpdatedAt, database.Now()),
+		CreatedAt:      takeFirst(orig.CreatedAt, dbtime.Now()),
+		UpdatedAt:      takeFirst(orig.UpdatedAt, dbtime.Now()),
 		Roles:          takeFirstSlice(orig.Roles, []string{}),
 	})
 	require.NoError(t, err, "insert organization")
@@ -306,21 +326,23 @@ func GroupMember(t testing.TB, db database.Store, orig database.GroupMember) dat
 	return member
 }
 
-// ProvisionerJob is a bit more involved to get the values such as "completedAt", "startedAt", "cancelledAt" set.
-func ProvisionerJob(t testing.TB, db database.Store, orig database.ProvisionerJob) database.ProvisionerJob {
-	id := takeFirst(orig.ID, uuid.New())
+// ProvisionerJob is a bit more involved to get the values such as "completedAt", "startedAt", "cancelledAt" set.  ps
+// can be set to nil if you are SURE that you don't require a provisionerdaemon to acquire the job in your test.
+func ProvisionerJob(t testing.TB, db database.Store, ps pubsub.Pubsub, orig database.ProvisionerJob) database.ProvisionerJob {
+	jobID := takeFirst(orig.ID, uuid.New())
 	// Always set some tags to prevent Acquire from grabbing jobs it should not.
 	if !orig.StartedAt.Time.IsZero() {
 		if orig.Tags == nil {
 			orig.Tags = make(database.StringMap)
 		}
 		// Make sure when we acquire the job, we only get this one.
-		orig.Tags[id.String()] = "true"
+		orig.Tags[jobID.String()] = "true"
 	}
+
 	job, err := db.InsertProvisionerJob(genCtx, database.InsertProvisionerJobParams{
-		ID:             takeFirst(orig.ID, uuid.New()),
-		CreatedAt:      takeFirst(orig.CreatedAt, database.Now()),
-		UpdatedAt:      takeFirst(orig.UpdatedAt, database.Now()),
+		ID:             jobID,
+		CreatedAt:      takeFirst(orig.CreatedAt, dbtime.Now()),
+		UpdatedAt:      takeFirst(orig.UpdatedAt, dbtime.Now()),
 		OrganizationID: takeFirst(orig.OrganizationID, uuid.New()),
 		InitiatorID:    takeFirst(orig.InitiatorID, uuid.New()),
 		Provisioner:    takeFirst(orig.Provisioner, database.ProvisionerTypeEcho),
@@ -329,21 +351,28 @@ func ProvisionerJob(t testing.TB, db database.Store, orig database.ProvisionerJo
 		Type:           takeFirst(orig.Type, database.ProvisionerJobTypeWorkspaceBuild),
 		Input:          takeFirstSlice(orig.Input, []byte("{}")),
 		Tags:           orig.Tags,
+		TraceMetadata:  pqtype.NullRawMessage{},
 	})
 	require.NoError(t, err, "insert job")
-
+	if ps != nil {
+		err = provisionerjobs.PostJob(ps, job)
+		require.NoError(t, err, "post job to pubsub")
+	}
 	if !orig.StartedAt.Time.IsZero() {
 		job, err = db.AcquireProvisionerJob(genCtx, database.AcquireProvisionerJobParams{
 			StartedAt: orig.StartedAt,
 			Types:     []database.ProvisionerType{database.ProvisionerTypeEcho},
 			Tags:      must(json.Marshal(orig.Tags)),
+			WorkerID:  uuid.NullUUID{},
 		})
 		require.NoError(t, err)
+		// There is no easy way to make sure we acquire the correct job.
+		require.Equal(t, jobID, job.ID, "acquired incorrect job")
 	}
 
 	if !orig.CompletedAt.Time.IsZero() || orig.Error.String != "" {
 		err := db.UpdateProvisionerJobWithCompleteByID(genCtx, database.UpdateProvisionerJobWithCompleteByIDParams{
-			ID:          job.ID,
+			ID:          jobID,
 			UpdatedAt:   job.UpdatedAt,
 			CompletedAt: orig.CompletedAt,
 			Error:       orig.Error,
@@ -353,14 +382,14 @@ func ProvisionerJob(t testing.TB, db database.Store, orig database.ProvisionerJo
 	}
 	if !orig.CanceledAt.Time.IsZero() {
 		err := db.UpdateProvisionerJobWithCancelByID(genCtx, database.UpdateProvisionerJobWithCancelByIDParams{
-			ID:          job.ID,
+			ID:          jobID,
 			CanceledAt:  orig.CanceledAt,
 			CompletedAt: orig.CompletedAt,
 		})
 		require.NoError(t, err)
 	}
 
-	job, err = db.GetProvisionerJobByID(genCtx, job.ID)
+	job, err = db.GetProvisionerJobByID(genCtx, jobID)
 	require.NoError(t, err)
 
 	return job
@@ -369,7 +398,7 @@ func ProvisionerJob(t testing.TB, db database.Store, orig database.ProvisionerJo
 func WorkspaceApp(t testing.TB, db database.Store, orig database.WorkspaceApp) database.WorkspaceApp {
 	resource, err := db.InsertWorkspaceApp(genCtx, database.InsertWorkspaceAppParams{
 		ID:          takeFirst(orig.ID, uuid.New()),
-		CreatedAt:   takeFirst(orig.CreatedAt, database.Now()),
+		CreatedAt:   takeFirst(orig.CreatedAt, dbtime.Now()),
 		AgentID:     takeFirst(orig.AgentID, uuid.New()),
 		Slug:        takeFirst(orig.Slug, namesgenerator.GetRandomName(1)),
 		DisplayName: takeFirst(orig.DisplayName, namesgenerator.GetRandomName(1)),
@@ -397,7 +426,7 @@ func WorkspaceApp(t testing.TB, db database.Store, orig database.WorkspaceApp) d
 func WorkspaceResource(t testing.TB, db database.Store, orig database.WorkspaceResource) database.WorkspaceResource {
 	resource, err := db.InsertWorkspaceResource(genCtx, database.InsertWorkspaceResourceParams{
 		ID:         takeFirst(orig.ID, uuid.New()),
-		CreatedAt:  takeFirst(orig.CreatedAt, database.Now()),
+		CreatedAt:  takeFirst(orig.CreatedAt, dbtime.Now()),
 		JobID:      takeFirst(orig.JobID, uuid.New()),
 		Transition: takeFirst(orig.Transition, database.WorkspaceTransitionStart),
 		Type:       takeFirst(orig.Type, "fake_resource"),
@@ -436,8 +465,10 @@ func WorkspaceProxy(t testing.TB, db database.Store, orig database.WorkspaceProx
 		DisplayName:       takeFirst(orig.DisplayName, namesgenerator.GetRandomName(1)),
 		Icon:              takeFirst(orig.Icon, namesgenerator.GetRandomName(1)),
 		TokenHashedSecret: hashedSecret[:],
-		CreatedAt:         takeFirst(orig.CreatedAt, database.Now()),
-		UpdatedAt:         takeFirst(orig.UpdatedAt, database.Now()),
+		CreatedAt:         takeFirst(orig.CreatedAt, dbtime.Now()),
+		UpdatedAt:         takeFirst(orig.UpdatedAt, dbtime.Now()),
+		DerpEnabled:       takeFirst(orig.DerpEnabled, false),
+		DerpOnly:          takeFirst(orig.DerpEnabled, false),
 	})
 	require.NoError(t, err, "insert proxy")
 
@@ -457,7 +488,7 @@ func File(t testing.TB, db database.Store, orig database.File) database.File {
 	file, err := db.InsertFile(genCtx, database.InsertFileParams{
 		ID:        takeFirst(orig.ID, uuid.New()),
 		Hash:      takeFirst(orig.Hash, hex.EncodeToString(make([]byte, 32))),
-		CreatedAt: takeFirst(orig.CreatedAt, database.Now()),
+		CreatedAt: takeFirst(orig.CreatedAt, dbtime.Now()),
 		CreatedBy: takeFirst(orig.CreatedBy, uuid.New()),
 		Mimetype:  takeFirst(orig.Mimetype, "application/x-tar"),
 		Data:      takeFirstSlice(orig.Data, []byte{}),
@@ -468,30 +499,36 @@ func File(t testing.TB, db database.Store, orig database.File) database.File {
 
 func UserLink(t testing.TB, db database.Store, orig database.UserLink) database.UserLink {
 	link, err := db.InsertUserLink(genCtx, database.InsertUserLinkParams{
-		UserID:            takeFirst(orig.UserID, uuid.New()),
-		LoginType:         takeFirst(orig.LoginType, database.LoginTypeGithub),
-		LinkedID:          takeFirst(orig.LinkedID),
-		OAuthAccessToken:  takeFirst(orig.OAuthAccessToken, uuid.NewString()),
-		OAuthRefreshToken: takeFirst(orig.OAuthAccessToken, uuid.NewString()),
-		OAuthExpiry:       takeFirst(orig.OAuthExpiry, database.Now().Add(time.Hour*24)),
+		UserID:                 takeFirst(orig.UserID, uuid.New()),
+		LoginType:              takeFirst(orig.LoginType, database.LoginTypeGithub),
+		LinkedID:               takeFirst(orig.LinkedID),
+		OAuthAccessToken:       takeFirst(orig.OAuthAccessToken, uuid.NewString()),
+		OAuthAccessTokenKeyID:  takeFirst(orig.OAuthAccessTokenKeyID, sql.NullString{}),
+		OAuthRefreshToken:      takeFirst(orig.OAuthRefreshToken, uuid.NewString()),
+		OAuthRefreshTokenKeyID: takeFirst(orig.OAuthRefreshTokenKeyID, sql.NullString{}),
+		OAuthExpiry:            takeFirst(orig.OAuthExpiry, dbtime.Now().Add(time.Hour*24)),
 	})
 
 	require.NoError(t, err, "insert link")
 	return link
 }
 
-func GitAuthLink(t testing.TB, db database.Store, orig database.GitAuthLink) database.GitAuthLink {
-	link, err := db.InsertGitAuthLink(genCtx, database.InsertGitAuthLinkParams{
-		ProviderID:        takeFirst(orig.ProviderID, uuid.New().String()),
-		UserID:            takeFirst(orig.UserID, uuid.New()),
-		OAuthAccessToken:  takeFirst(orig.OAuthAccessToken, uuid.NewString()),
-		OAuthRefreshToken: takeFirst(orig.OAuthAccessToken, uuid.NewString()),
-		OAuthExpiry:       takeFirst(orig.OAuthExpiry, database.Now().Add(time.Hour*24)),
-		CreatedAt:         takeFirst(orig.CreatedAt, database.Now()),
-		UpdatedAt:         takeFirst(orig.UpdatedAt, database.Now()),
+func ExternalAuthLink(t testing.TB, db database.Store, orig database.ExternalAuthLink) database.ExternalAuthLink {
+	msg := takeFirst(&orig.OAuthExtra, &pqtype.NullRawMessage{})
+	link, err := db.InsertExternalAuthLink(genCtx, database.InsertExternalAuthLinkParams{
+		ProviderID:             takeFirst(orig.ProviderID, uuid.New().String()),
+		UserID:                 takeFirst(orig.UserID, uuid.New()),
+		OAuthAccessToken:       takeFirst(orig.OAuthAccessToken, uuid.NewString()),
+		OAuthAccessTokenKeyID:  takeFirst(orig.OAuthAccessTokenKeyID, sql.NullString{}),
+		OAuthRefreshToken:      takeFirst(orig.OAuthRefreshToken, uuid.NewString()),
+		OAuthRefreshTokenKeyID: takeFirst(orig.OAuthRefreshTokenKeyID, sql.NullString{}),
+		OAuthExpiry:            takeFirst(orig.OAuthExpiry, dbtime.Now().Add(time.Hour*24)),
+		CreatedAt:              takeFirst(orig.CreatedAt, dbtime.Now()),
+		UpdatedAt:              takeFirst(orig.UpdatedAt, dbtime.Now()),
+		OAuthExtra:             *msg,
 	})
 
-	require.NoError(t, err, "insert git auth link")
+	require.NoError(t, err, "insert external auth link")
 	return link
 }
 
@@ -503,8 +540,8 @@ func TemplateVersion(t testing.TB, db database.Store, orig database.TemplateVers
 			ID:             versionID,
 			TemplateID:     orig.TemplateID,
 			OrganizationID: takeFirst(orig.OrganizationID, uuid.New()),
-			CreatedAt:      takeFirst(orig.CreatedAt, database.Now()),
-			UpdatedAt:      takeFirst(orig.UpdatedAt, database.Now()),
+			CreatedAt:      takeFirst(orig.CreatedAt, dbtime.Now()),
+			UpdatedAt:      takeFirst(orig.UpdatedAt, dbtime.Now()),
 			Name:           takeFirst(orig.Name, namesgenerator.GetRandomName(1)),
 			Message:        orig.Message,
 			Readme:         takeFirst(orig.Readme, namesgenerator.GetRandomName(1)),
@@ -547,7 +584,7 @@ func WorkspaceAgentStat(t testing.TB, db database.Store, orig database.Workspace
 	}
 	scheme, err := db.InsertWorkspaceAgentStat(genCtx, database.InsertWorkspaceAgentStatParams{
 		ID:                          takeFirst(orig.ID, uuid.New()),
-		CreatedAt:                   takeFirst(orig.CreatedAt, database.Now()),
+		CreatedAt:                   takeFirst(orig.CreatedAt, dbtime.Now()),
 		UserID:                      takeFirst(orig.UserID, uuid.New()),
 		TemplateID:                  takeFirst(orig.TemplateID, uuid.New()),
 		WorkspaceID:                 takeFirst(orig.WorkspaceID, uuid.New()),
diff --git a/coderd/database/dbgen/dbgen_test.go b/coderd/database/dbgen/dbgen_test.go
index 5509455f7a586..531c8bb25cd53 100644
--- a/coderd/database/dbgen/dbgen_test.go
+++ b/coderd/database/dbgen/dbgen_test.go
@@ -7,9 +7,9 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
 )
 
 func TestGenerator(t *testing.T) {
@@ -17,7 +17,7 @@ func TestGenerator(t *testing.T) {
 
 	t.Run("AuditLog", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		_ = dbgen.AuditLog(t, db, database.AuditLog{})
 		logs := must(db.GetAuditLogsOffset(context.Background(), database.GetAuditLogsOffsetParams{Limit: 1}))
 		require.Len(t, logs, 1)
@@ -25,30 +25,30 @@ func TestGenerator(t *testing.T) {
 
 	t.Run("APIKey", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp, _ := dbgen.APIKey(t, db, database.APIKey{})
 		require.Equal(t, exp, must(db.GetAPIKeyByID(context.Background(), exp.ID)))
 	})
 
 	t.Run("File", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.File(t, db, database.File{})
 		require.Equal(t, exp, must(db.GetFileByID(context.Background(), exp.ID)))
 	})
 
 	t.Run("UserLink", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.UserLink(t, db, database.UserLink{})
 		require.Equal(t, exp, must(db.GetUserLinkByLinkedID(context.Background(), exp.LinkedID)))
 	})
 
 	t.Run("GitAuthLink", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
-		exp := dbgen.GitAuthLink(t, db, database.GitAuthLink{})
-		require.Equal(t, exp, must(db.GetGitAuthLink(context.Background(), database.GetGitAuthLinkParams{
+		db := dbmem.New()
+		exp := dbgen.ExternalAuthLink(t, db, database.ExternalAuthLink{})
+		require.Equal(t, exp, must(db.GetExternalAuthLink(context.Background(), database.GetExternalAuthLinkParams{
 			ProviderID: exp.ProviderID,
 			UserID:     exp.UserID,
 		})))
@@ -56,28 +56,28 @@ func TestGenerator(t *testing.T) {
 
 	t.Run("WorkspaceResource", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.WorkspaceResource(t, db, database.WorkspaceResource{})
 		require.Equal(t, exp, must(db.GetWorkspaceResourceByID(context.Background(), exp.ID)))
 	})
 
 	t.Run("WorkspaceApp", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.WorkspaceApp(t, db, database.WorkspaceApp{})
 		require.Equal(t, exp, must(db.GetWorkspaceAppsByAgentID(context.Background(), exp.AgentID))[0])
 	})
 
 	t.Run("WorkspaceResourceMetadata", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.WorkspaceResourceMetadatums(t, db, database.WorkspaceResourceMetadatum{})
 		require.Equal(t, exp, must(db.GetWorkspaceResourceMetadataByResourceIDs(context.Background(), []uuid.UUID{exp[0].WorkspaceResourceID})))
 	})
 
 	t.Run("WorkspaceProxy", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp, secret := dbgen.WorkspaceProxy(t, db, database.WorkspaceProxy{})
 		require.Len(t, secret, 64)
 		require.Equal(t, exp, must(db.GetWorkspaceProxyByID(context.Background(), exp.ID)))
@@ -85,21 +85,21 @@ func TestGenerator(t *testing.T) {
 
 	t.Run("Job", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
-		exp := dbgen.ProvisionerJob(t, db, database.ProvisionerJob{})
+		db := dbmem.New()
+		exp := dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{})
 		require.Equal(t, exp, must(db.GetProvisionerJobByID(context.Background(), exp.ID)))
 	})
 
 	t.Run("Group", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.Group(t, db, database.Group{})
 		require.Equal(t, exp, must(db.GetGroupByID(context.Background(), exp.ID)))
 	})
 
 	t.Run("GroupMember", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		g := dbgen.Group(t, db, database.Group{})
 		u := dbgen.User(t, db, database.User{})
 		exp := []database.User{u}
@@ -110,14 +110,14 @@ func TestGenerator(t *testing.T) {
 
 	t.Run("Organization", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.Organization(t, db, database.Organization{})
 		require.Equal(t, exp, must(db.GetOrganizationByID(context.Background(), exp.ID)))
 	})
 
 	t.Run("OrganizationMember", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.OrganizationMember(t, db, database.OrganizationMember{})
 		require.Equal(t, exp, must(db.GetOrganizationMemberByUserID(context.Background(), database.GetOrganizationMemberByUserIDParams{
 			OrganizationID: exp.OrganizationID,
@@ -127,49 +127,49 @@ func TestGenerator(t *testing.T) {
 
 	t.Run("Workspace", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.Workspace(t, db, database.Workspace{})
 		require.Equal(t, exp, must(db.GetWorkspaceByID(context.Background(), exp.ID)))
 	})
 
 	t.Run("WorkspaceAgent", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.WorkspaceAgent(t, db, database.WorkspaceAgent{})
 		require.Equal(t, exp, must(db.GetWorkspaceAgentByID(context.Background(), exp.ID)))
 	})
 
 	t.Run("Template", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.Template(t, db, database.Template{})
 		require.Equal(t, exp, must(db.GetTemplateByID(context.Background(), exp.ID)))
 	})
 
 	t.Run("TemplateVersion", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.TemplateVersion(t, db, database.TemplateVersion{})
 		require.Equal(t, exp, must(db.GetTemplateVersionByID(context.Background(), exp.ID)))
 	})
 
 	t.Run("WorkspaceBuild", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{})
 		require.Equal(t, exp, must(db.GetWorkspaceBuildByID(context.Background(), exp.ID)))
 	})
 
 	t.Run("User", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.User(t, db, database.User{})
 		require.Equal(t, exp, must(db.GetUserByID(context.Background(), exp.ID)))
 	})
 
 	t.Run("SSHKey", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		exp := dbgen.GitSSHKey(t, db, database.GitSSHKey{})
 		require.Equal(t, exp, must(db.GetGitSSHKey(context.Background(), exp.UserID)))
 	})
diff --git a/coderd/database/dbmem/dbmem.go b/coderd/database/dbmem/dbmem.go
new file mode 100644
index 0000000000000..a0e48473602ad
--- /dev/null
+++ b/coderd/database/dbmem/dbmem.go
@@ -0,0 +1,7102 @@
+package dbmem
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"reflect"
+	"regexp"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/lib/pq"
+	"golang.org/x/exp/maps"
+	"golang.org/x/exp/slices"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac/regosql"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+var validProxyByHostnameRegex = regexp.MustCompile(`^[a-zA-Z0-9._-]+$`)
+
+var errForeignKeyConstraint = &pq.Error{
+	Code:    "23503",
+	Message: "update or delete on table violates foreign key constraint",
+}
+
+var errDuplicateKey = &pq.Error{
+	Code:    "23505",
+	Message: "duplicate key value violates unique constraint",
+}
+
+// New returns an in-memory fake of the database.
+func New() database.Store {
+	q := &FakeQuerier{
+		mutex: &sync.RWMutex{},
+		data: &data{
+			apiKeys:                   make([]database.APIKey, 0),
+			organizationMembers:       make([]database.OrganizationMember, 0),
+			organizations:             make([]database.Organization, 0),
+			users:                     make([]database.User, 0),
+			dbcryptKeys:               make([]database.DBCryptKey, 0),
+			externalAuthLinks:         make([]database.ExternalAuthLink, 0),
+			groups:                    make([]database.Group, 0),
+			groupMembers:              make([]database.GroupMember, 0),
+			auditLogs:                 make([]database.AuditLog, 0),
+			files:                     make([]database.File, 0),
+			gitSSHKey:                 make([]database.GitSSHKey, 0),
+			parameterSchemas:          make([]database.ParameterSchema, 0),
+			provisionerDaemons:        make([]database.ProvisionerDaemon, 0),
+			workspaceAgents:           make([]database.WorkspaceAgent, 0),
+			provisionerJobLogs:        make([]database.ProvisionerJobLog, 0),
+			workspaceResources:        make([]database.WorkspaceResource, 0),
+			workspaceResourceMetadata: make([]database.WorkspaceResourceMetadatum, 0),
+			provisionerJobs:           make([]database.ProvisionerJob, 0),
+			templateVersions:          make([]database.TemplateVersionTable, 0),
+			templates:                 make([]database.TemplateTable, 0),
+			workspaceAgentStats:       make([]database.WorkspaceAgentStat, 0),
+			workspaceAgentLogs:        make([]database.WorkspaceAgentLog, 0),
+			workspaceBuilds:           make([]database.WorkspaceBuildTable, 0),
+			workspaceApps:             make([]database.WorkspaceApp, 0),
+			workspaces:                make([]database.Workspace, 0),
+			licenses:                  make([]database.License, 0),
+			workspaceProxies:          make([]database.WorkspaceProxy, 0),
+			locks:                     map[int64]struct{}{},
+		},
+	}
+	q.defaultProxyDisplayName = "Default"
+	q.defaultProxyIconURL = "/emojis/1f3e1.png"
+	return q
+}
+
+type rwMutex interface {
+	Lock()
+	RLock()
+	Unlock()
+	RUnlock()
+}
+
+// inTxMutex is a no op, since inside a transaction we are already locked.
+type inTxMutex struct{}
+
+func (inTxMutex) Lock()    {}
+func (inTxMutex) RLock()   {}
+func (inTxMutex) Unlock()  {}
+func (inTxMutex) RUnlock() {}
+
+// FakeQuerier replicates database functionality to enable quick testing.  It's an exported type so that our test code
+// can do type checks.
+type FakeQuerier struct {
+	mutex rwMutex
+	*data
+}
+
+func (*FakeQuerier) Wrappers() []string {
+	return []string{}
+}
+
+type fakeTx struct {
+	*FakeQuerier
+	locks map[int64]struct{}
+}
+
+type data struct {
+	// Legacy tables
+	apiKeys             []database.APIKey
+	organizations       []database.Organization
+	organizationMembers []database.OrganizationMember
+	users               []database.User
+	userLinks           []database.UserLink
+
+	// New tables
+	workspaceAgentStats           []database.WorkspaceAgentStat
+	auditLogs                     []database.AuditLog
+	dbcryptKeys                   []database.DBCryptKey
+	files                         []database.File
+	externalAuthLinks             []database.ExternalAuthLink
+	gitSSHKey                     []database.GitSSHKey
+	groupMembers                  []database.GroupMember
+	groups                        []database.Group
+	licenses                      []database.License
+	parameterSchemas              []database.ParameterSchema
+	provisionerDaemons            []database.ProvisionerDaemon
+	provisionerJobLogs            []database.ProvisionerJobLog
+	provisionerJobs               []database.ProvisionerJob
+	replicas                      []database.Replica
+	templateVersions              []database.TemplateVersionTable
+	templateVersionParameters     []database.TemplateVersionParameter
+	templateVersionVariables      []database.TemplateVersionVariable
+	templates                     []database.TemplateTable
+	workspaceAgents               []database.WorkspaceAgent
+	workspaceAgentMetadata        []database.WorkspaceAgentMetadatum
+	workspaceAgentLogs            []database.WorkspaceAgentLog
+	workspaceAgentLogSources      []database.WorkspaceAgentLogSource
+	workspaceAgentScripts         []database.WorkspaceAgentScript
+	workspaceApps                 []database.WorkspaceApp
+	workspaceAppStatsLastInsertID int64
+	workspaceAppStats             []database.WorkspaceAppStat
+	workspaceBuilds               []database.WorkspaceBuildTable
+	workspaceBuildParameters      []database.WorkspaceBuildParameter
+	workspaceResourceMetadata     []database.WorkspaceResourceMetadatum
+	workspaceResources            []database.WorkspaceResource
+	workspaces                    []database.Workspace
+	workspaceProxies              []database.WorkspaceProxy
+	// Locks is a map of lock names. Any keys within the map are currently
+	// locked.
+	locks                   map[int64]struct{}
+	deploymentID            string
+	derpMeshKey             string
+	lastUpdateCheck         []byte
+	serviceBanner           []byte
+	applicationName         string
+	logoURL                 string
+	appSecurityKey          string
+	oauthSigningKey         string
+	lastLicenseID           int32
+	defaultProxyDisplayName string
+	defaultProxyIconURL     string
+}
+
+func validateDatabaseTypeWithValid(v reflect.Value) (handled bool, err error) {
+	if v.Kind() == reflect.Struct {
+		return false, nil
+	}
+
+	if v.CanInterface() {
+		if !strings.Contains(v.Type().PkgPath(), "coderd/database") {
+			return true, nil
+		}
+		if valid, ok := v.Interface().(interface{ Valid() bool }); ok {
+			if !valid.Valid() {
+				return true, xerrors.Errorf("invalid %s: %q", v.Type().Name(), v.Interface())
+			}
+		}
+		return true, nil
+	}
+	return false, nil
+}
+
+// validateDatabaseType uses reflect to check if struct properties are types
+// with a Valid() bool function set. If so, call it and return an error
+// if false.
+//
+// Note that we only check immediate values and struct fields. We do not
+// recurse into nested structs.
+func validateDatabaseType(args interface{}) error {
+	v := reflect.ValueOf(args)
+
+	// Note: database.Null* types don't have a Valid method, we skip them here
+	// because their embedded types may have a Valid method and we don't want
+	// to bother with checking both that the Valid field is true and that the
+	// type it embeds validates to true. We would need to check:
+	//
+	//	dbNullEnum.Valid && dbNullEnum.Enum.Valid()
+	if strings.HasPrefix(v.Type().Name(), "Null") {
+		return nil
+	}
+
+	if ok, err := validateDatabaseTypeWithValid(v); ok {
+		return err
+	}
+	switch v.Kind() {
+	case reflect.Struct:
+		var errs []string
+		for i := 0; i < v.NumField(); i++ {
+			field := v.Field(i)
+			if ok, err := validateDatabaseTypeWithValid(field); ok && err != nil {
+				errs = append(errs, fmt.Sprintf("%s.%s: %s", v.Type().Name(), v.Type().Field(i).Name, err.Error()))
+			}
+		}
+		if len(errs) > 0 {
+			return xerrors.Errorf("invalid database type fields:\n\t%s", strings.Join(errs, "\n\t"))
+		}
+	default:
+		panic(fmt.Sprintf("unhandled type: %s", v.Type().Name()))
+	}
+	return nil
+}
+
+func (*FakeQuerier) Ping(_ context.Context) (time.Duration, error) {
+	return 0, nil
+}
+
+func (tx *fakeTx) AcquireLock(_ context.Context, id int64) error {
+	if _, ok := tx.FakeQuerier.locks[id]; ok {
+		return xerrors.Errorf("cannot acquire lock %d: already held", id)
+	}
+	tx.FakeQuerier.locks[id] = struct{}{}
+	tx.locks[id] = struct{}{}
+	return nil
+}
+
+func (tx *fakeTx) TryAcquireLock(_ context.Context, id int64) (bool, error) {
+	if _, ok := tx.FakeQuerier.locks[id]; ok {
+		return false, nil
+	}
+	tx.FakeQuerier.locks[id] = struct{}{}
+	tx.locks[id] = struct{}{}
+	return true, nil
+}
+
+func (tx *fakeTx) releaseLocks() {
+	for id := range tx.locks {
+		delete(tx.FakeQuerier.locks, id)
+	}
+	tx.locks = map[int64]struct{}{}
+}
+
+// InTx doesn't rollback data properly for in-memory yet.
+func (q *FakeQuerier) InTx(fn func(database.Store) error, _ *sql.TxOptions) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+	tx := &fakeTx{
+		FakeQuerier: &FakeQuerier{mutex: inTxMutex{}, data: q.data},
+		locks:       map[int64]struct{}{},
+	}
+	defer tx.releaseLocks()
+
+	return fn(tx)
+}
+
+// getUserByIDNoLock is used by other functions in the database fake.
+func (q *FakeQuerier) getUserByIDNoLock(id uuid.UUID) (database.User, error) {
+	for _, user := range q.users {
+		if user.ID == id {
+			return user, nil
+		}
+	}
+	return database.User{}, sql.ErrNoRows
+}
+
+func convertUsers(users []database.User, count int64) []database.GetUsersRow {
+	rows := make([]database.GetUsersRow, len(users))
+	for i, u := range users {
+		rows[i] = database.GetUsersRow{
+			ID:             u.ID,
+			Email:          u.Email,
+			Username:       u.Username,
+			HashedPassword: u.HashedPassword,
+			CreatedAt:      u.CreatedAt,
+			UpdatedAt:      u.UpdatedAt,
+			Status:         u.Status,
+			RBACRoles:      u.RBACRoles,
+			LoginType:      u.LoginType,
+			AvatarURL:      u.AvatarURL,
+			Deleted:        u.Deleted,
+			LastSeenAt:     u.LastSeenAt,
+			Count:          count,
+		}
+	}
+
+	return rows
+}
+
+// mapAgentStatus determines the agent status based on different timestamps like created_at, last_connected_at, disconnected_at, etc.
+// The function must be in sync with: coderd/workspaceagents.go:convertWorkspaceAgent.
+func mapAgentStatus(dbAgent database.WorkspaceAgent, agentInactiveDisconnectTimeoutSeconds int64) string {
+	var status string
+	connectionTimeout := time.Duration(dbAgent.ConnectionTimeoutSeconds) * time.Second
+	switch {
+	case !dbAgent.FirstConnectedAt.Valid:
+		switch {
+		case connectionTimeout > 0 && dbtime.Now().Sub(dbAgent.CreatedAt) > connectionTimeout:
+			// If the agent took too long to connect the first time,
+			// mark it as timed out.
+			status = "timeout"
+		default:
+			// If the agent never connected, it's waiting for the compute
+			// to start up.
+			status = "connecting"
+		}
+	case dbAgent.DisconnectedAt.Time.After(dbAgent.LastConnectedAt.Time):
+		// If we've disconnected after our last connection, we know the
+		// agent is no longer connected.
+		status = "disconnected"
+	case dbtime.Now().Sub(dbAgent.LastConnectedAt.Time) > time.Duration(agentInactiveDisconnectTimeoutSeconds)*time.Second:
+		// The connection died without updating the last connected.
+		status = "disconnected"
+	case dbAgent.LastConnectedAt.Valid:
+		// The agent should be assumed connected if it's under inactivity timeouts
+		// and last connected at has been properly set.
+		status = "connected"
+	default:
+		panic("unknown agent status: " + status)
+	}
+	return status
+}
+
+func (q *FakeQuerier) convertToWorkspaceRowsNoLock(ctx context.Context, workspaces []database.Workspace, count int64) []database.GetWorkspacesRow {
+	rows := make([]database.GetWorkspacesRow, 0, len(workspaces))
+	for _, w := range workspaces {
+		wr := database.GetWorkspacesRow{
+			ID:                w.ID,
+			CreatedAt:         w.CreatedAt,
+			UpdatedAt:         w.UpdatedAt,
+			OwnerID:           w.OwnerID,
+			OrganizationID:    w.OrganizationID,
+			TemplateID:        w.TemplateID,
+			Deleted:           w.Deleted,
+			Name:              w.Name,
+			AutostartSchedule: w.AutostartSchedule,
+			Ttl:               w.Ttl,
+			LastUsedAt:        w.LastUsedAt,
+			DormantAt:         w.DormantAt,
+			DeletingAt:        w.DeletingAt,
+			Count:             count,
+			AutomaticUpdates:  w.AutomaticUpdates,
+		}
+
+		for _, t := range q.templates {
+			if t.ID == w.TemplateID {
+				wr.TemplateName = t.Name
+				break
+			}
+		}
+
+		if build, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, w.ID); err == nil {
+			for _, tv := range q.templateVersions {
+				if tv.ID == build.TemplateVersionID {
+					wr.TemplateVersionID = tv.ID
+					wr.TemplateVersionName = sql.NullString{
+						Valid:  true,
+						String: tv.Name,
+					}
+					break
+				}
+			}
+		}
+
+		rows = append(rows, wr)
+	}
+	return rows
+}
+
+func (q *FakeQuerier) getWorkspaceByIDNoLock(_ context.Context, id uuid.UUID) (database.Workspace, error) {
+	for _, workspace := range q.workspaces {
+		if workspace.ID == id {
+			return workspace, nil
+		}
+	}
+	return database.Workspace{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) getWorkspaceByAgentIDNoLock(_ context.Context, agentID uuid.UUID) (database.Workspace, error) {
+	var agent database.WorkspaceAgent
+	for _, _agent := range q.workspaceAgents {
+		if _agent.ID == agentID {
+			agent = _agent
+			break
+		}
+	}
+	if agent.ID == uuid.Nil {
+		return database.Workspace{}, sql.ErrNoRows
+	}
+
+	var resource database.WorkspaceResource
+	for _, _resource := range q.workspaceResources {
+		if _resource.ID == agent.ResourceID {
+			resource = _resource
+			break
+		}
+	}
+	if resource.ID == uuid.Nil {
+		return database.Workspace{}, sql.ErrNoRows
+	}
+
+	var build database.WorkspaceBuild
+	for _, _build := range q.workspaceBuilds {
+		if _build.JobID == resource.JobID {
+			build = q.workspaceBuildWithUserNoLock(_build)
+			break
+		}
+	}
+	if build.ID == uuid.Nil {
+		return database.Workspace{}, sql.ErrNoRows
+	}
+
+	for _, workspace := range q.workspaces {
+		if workspace.ID == build.WorkspaceID {
+			return workspace, nil
+		}
+	}
+
+	return database.Workspace{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) getWorkspaceBuildByIDNoLock(_ context.Context, id uuid.UUID) (database.WorkspaceBuild, error) {
+	for _, build := range q.workspaceBuilds {
+		if build.ID == id {
+			return q.workspaceBuildWithUserNoLock(build), nil
+		}
+	}
+	return database.WorkspaceBuild{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) getLatestWorkspaceBuildByWorkspaceIDNoLock(_ context.Context, workspaceID uuid.UUID) (database.WorkspaceBuild, error) {
+	var row database.WorkspaceBuild
+	var buildNum int32 = -1
+	for _, workspaceBuild := range q.workspaceBuilds {
+		if workspaceBuild.WorkspaceID == workspaceID && workspaceBuild.BuildNumber > buildNum {
+			row = q.workspaceBuildWithUserNoLock(workspaceBuild)
+			buildNum = workspaceBuild.BuildNumber
+		}
+	}
+	if buildNum == -1 {
+		return database.WorkspaceBuild{}, sql.ErrNoRows
+	}
+	return row, nil
+}
+
+func (q *FakeQuerier) getTemplateByIDNoLock(_ context.Context, id uuid.UUID) (database.Template, error) {
+	for _, template := range q.templates {
+		if template.ID == id {
+			return q.templateWithUserNoLock(template), nil
+		}
+	}
+	return database.Template{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) templatesWithUserNoLock(tpl []database.TemplateTable) []database.Template {
+	cpy := make([]database.Template, 0, len(tpl))
+	for _, t := range tpl {
+		cpy = append(cpy, q.templateWithUserNoLock(t))
+	}
+	return cpy
+}
+
+func (q *FakeQuerier) templateWithUserNoLock(tpl database.TemplateTable) database.Template {
+	var user database.User
+	for _, _user := range q.users {
+		if _user.ID == tpl.CreatedBy {
+			user = _user
+			break
+		}
+	}
+	var withUser database.Template
+	// This is a cheeky way to copy the fields over without explicitly listing them all.
+	d, _ := json.Marshal(tpl)
+	_ = json.Unmarshal(d, &withUser)
+	withUser.CreatedByUsername = user.Username
+	withUser.CreatedByAvatarURL = user.AvatarURL
+	return withUser
+}
+
+func (q *FakeQuerier) templateVersionWithUserNoLock(tpl database.TemplateVersionTable) database.TemplateVersion {
+	var user database.User
+	for _, _user := range q.users {
+		if _user.ID == tpl.CreatedBy {
+			user = _user
+			break
+		}
+	}
+	var withUser database.TemplateVersion
+	// This is a cheeky way to copy the fields over without explicitly listing them all.
+	d, _ := json.Marshal(tpl)
+	_ = json.Unmarshal(d, &withUser)
+	withUser.CreatedByUsername = user.Username
+	withUser.CreatedByAvatarURL = user.AvatarURL
+	return withUser
+}
+
+func (q *FakeQuerier) workspaceBuildWithUserNoLock(tpl database.WorkspaceBuildTable) database.WorkspaceBuild {
+	var user database.User
+	for _, _user := range q.users {
+		if _user.ID == tpl.InitiatorID {
+			user = _user
+			break
+		}
+	}
+	var withUser database.WorkspaceBuild
+	// This is a cheeky way to copy the fields over without explicitly listing them all.
+	d, _ := json.Marshal(tpl)
+	_ = json.Unmarshal(d, &withUser)
+	withUser.InitiatorByUsername = user.Username
+	withUser.InitiatorByAvatarUrl = user.AvatarURL
+	return withUser
+}
+
+func (q *FakeQuerier) getTemplateVersionByIDNoLock(_ context.Context, templateVersionID uuid.UUID) (database.TemplateVersion, error) {
+	for _, templateVersion := range q.templateVersions {
+		if templateVersion.ID != templateVersionID {
+			continue
+		}
+		return q.templateVersionWithUserNoLock(templateVersion), nil
+	}
+	return database.TemplateVersion{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) getWorkspaceAgentByIDNoLock(_ context.Context, id uuid.UUID) (database.WorkspaceAgent, error) {
+	// The schema sorts this by created at, so we iterate the array backwards.
+	for i := len(q.workspaceAgents) - 1; i >= 0; i-- {
+		agent := q.workspaceAgents[i]
+		if agent.ID == id {
+			return agent, nil
+		}
+	}
+	return database.WorkspaceAgent{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) getWorkspaceAgentsByResourceIDsNoLock(_ context.Context, resourceIDs []uuid.UUID) ([]database.WorkspaceAgent, error) {
+	workspaceAgents := make([]database.WorkspaceAgent, 0)
+	for _, agent := range q.workspaceAgents {
+		for _, resourceID := range resourceIDs {
+			if agent.ResourceID != resourceID {
+				continue
+			}
+			workspaceAgents = append(workspaceAgents, agent)
+		}
+	}
+	return workspaceAgents, nil
+}
+
+func (q *FakeQuerier) getWorkspaceAppByAgentIDAndSlugNoLock(_ context.Context, arg database.GetWorkspaceAppByAgentIDAndSlugParams) (database.WorkspaceApp, error) {
+	for _, app := range q.workspaceApps {
+		if app.AgentID != arg.AgentID {
+			continue
+		}
+		if app.Slug != arg.Slug {
+			continue
+		}
+		return app, nil
+	}
+	return database.WorkspaceApp{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) getProvisionerJobByIDNoLock(_ context.Context, id uuid.UUID) (database.ProvisionerJob, error) {
+	for _, provisionerJob := range q.provisionerJobs {
+		if provisionerJob.ID != id {
+			continue
+		}
+		return provisionerJob, nil
+	}
+	return database.ProvisionerJob{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) getWorkspaceResourcesByJobIDNoLock(_ context.Context, jobID uuid.UUID) ([]database.WorkspaceResource, error) {
+	resources := make([]database.WorkspaceResource, 0)
+	for _, resource := range q.workspaceResources {
+		if resource.JobID != jobID {
+			continue
+		}
+		resources = append(resources, resource)
+	}
+	return resources, nil
+}
+
+func (q *FakeQuerier) getGroupByIDNoLock(_ context.Context, id uuid.UUID) (database.Group, error) {
+	for _, group := range q.groups {
+		if group.ID == id {
+			return group, nil
+		}
+	}
+
+	return database.Group{}, sql.ErrNoRows
+}
+
+// ErrUnimplemented is returned by methods only used by the enterprise/tailnet.pgCoord.  This coordinator explicitly
+// depends on  postgres triggers that announce changes on the pubsub.  Implementing support for this in the fake
+// database would  strongly couple the FakeQuerier to the pubsub, which is undesirable.  Furthermore, it makes little
+// sense to directly  test the pgCoord against anything other than postgres.  The FakeQuerier is designed to allow us to
+// test the Coderd  API, and for that kind of test, the in-memory, AGPL tailnet coordinator is sufficient.  Therefore,
+// these methods  remain unimplemented in the FakeQuerier.
+var ErrUnimplemented = xerrors.New("unimplemented")
+
+func uniqueSortedUUIDs(uuids []uuid.UUID) []uuid.UUID {
+	set := make(map[uuid.UUID]struct{})
+	for _, id := range uuids {
+		set[id] = struct{}{}
+	}
+	unique := make([]uuid.UUID, 0, len(set))
+	for id := range set {
+		unique = append(unique, id)
+	}
+	slices.SortFunc(unique, func(a, b uuid.UUID) int {
+		return slice.Ascending(a.String(), b.String())
+	})
+	return unique
+}
+
+func (q *FakeQuerier) getOrganizationMemberNoLock(orgID uuid.UUID) []database.OrganizationMember {
+	var members []database.OrganizationMember
+	for _, member := range q.organizationMembers {
+		if member.OrganizationID == orgID {
+			members = append(members, member)
+		}
+	}
+
+	return members
+}
+
+// getEveryoneGroupMembersNoLock fetches all the users in an organization.
+func (q *FakeQuerier) getEveryoneGroupMembersNoLock(orgID uuid.UUID) []database.User {
+	var (
+		everyone   []database.User
+		orgMembers = q.getOrganizationMemberNoLock(orgID)
+	)
+	for _, member := range orgMembers {
+		user, err := q.getUserByIDNoLock(member.UserID)
+		if err != nil {
+			return nil
+		}
+		everyone = append(everyone, user)
+	}
+	return everyone
+}
+
+// isEveryoneGroup returns true if the provided ID matches
+// an organization ID.
+func (q *FakeQuerier) isEveryoneGroup(id uuid.UUID) bool {
+	for _, org := range q.organizations {
+		if org.ID == id {
+			return true
+		}
+	}
+	return false
+}
+
+func (q *FakeQuerier) GetActiveDBCryptKeys(_ context.Context) ([]database.DBCryptKey, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+	ks := make([]database.DBCryptKey, 0, len(q.dbcryptKeys))
+	for _, k := range q.dbcryptKeys {
+		if !k.ActiveKeyDigest.Valid {
+			continue
+		}
+		ks = append([]database.DBCryptKey{}, k)
+	}
+	return ks, nil
+}
+
+func minTime(t, u time.Time) time.Time {
+	if t.Before(u) {
+		return t
+	}
+	return u
+}
+
+func provisonerJobStatus(j database.ProvisionerJob) database.ProvisionerJobStatus {
+	if isNotNull(j.CompletedAt) {
+		if j.Error.String != "" {
+			return database.ProvisionerJobStatusFailed
+		}
+		if isNotNull(j.CanceledAt) {
+			return database.ProvisionerJobStatusCanceled
+		}
+		return database.ProvisionerJobStatusSucceeded
+	}
+
+	if isNotNull(j.CanceledAt) {
+		return database.ProvisionerJobStatusCanceling
+	}
+	if isNull(j.StartedAt) {
+		return database.ProvisionerJobStatusPending
+	}
+	return database.ProvisionerJobStatusRunning
+}
+
+// isNull is only used in dbmem, so reflect is ok. Use this to make the logic
+// look more similar to the postgres.
+func isNull(v interface{}) bool {
+	return !isNotNull(v)
+}
+
+func isNotNull(v interface{}) bool {
+	return reflect.ValueOf(v).FieldByName("Valid").Bool()
+}
+
+func (*FakeQuerier) AcquireLock(_ context.Context, _ int64) error {
+	return xerrors.New("AcquireLock must only be called within a transaction")
+}
+
+func (q *FakeQuerier) AcquireProvisionerJob(_ context.Context, arg database.AcquireProvisionerJobParams) (database.ProvisionerJob, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.ProvisionerJob{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, provisionerJob := range q.provisionerJobs {
+		if provisionerJob.StartedAt.Valid {
+			continue
+		}
+		found := false
+		for _, provisionerType := range arg.Types {
+			if provisionerJob.Provisioner != provisionerType {
+				continue
+			}
+			found = true
+			break
+		}
+		if !found {
+			continue
+		}
+		tags := map[string]string{}
+		if arg.Tags != nil {
+			err := json.Unmarshal(arg.Tags, &tags)
+			if err != nil {
+				return provisionerJob, xerrors.Errorf("unmarshal: %w", err)
+			}
+		}
+
+		missing := false
+		for key, value := range provisionerJob.Tags {
+			provided, found := tags[key]
+			if !found {
+				missing = true
+				break
+			}
+			if provided != value {
+				missing = true
+				break
+			}
+		}
+		if missing {
+			continue
+		}
+		provisionerJob.StartedAt = arg.StartedAt
+		provisionerJob.UpdatedAt = arg.StartedAt.Time
+		provisionerJob.WorkerID = arg.WorkerID
+		provisionerJob.JobStatus = provisonerJobStatus(provisionerJob)
+		q.provisionerJobs[index] = provisionerJob
+		return provisionerJob, nil
+	}
+	return database.ProvisionerJob{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) ActivityBumpWorkspace(ctx context.Context, workspaceID uuid.UUID) error {
+	err := validateDatabaseType(workspaceID)
+	if err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	workspace, err := q.getWorkspaceByIDNoLock(ctx, workspaceID)
+	if err != nil {
+		return err
+	}
+	latestBuild, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspaceID)
+	if err != nil {
+		return err
+	}
+
+	now := dbtime.Now()
+	for i := range q.workspaceBuilds {
+		if q.workspaceBuilds[i].BuildNumber != latestBuild.BuildNumber {
+			continue
+		}
+		// If the build is not active, do not bump.
+		if q.workspaceBuilds[i].Transition != database.WorkspaceTransitionStart {
+			return nil
+		}
+		// If the provisioner job is not completed, do not bump.
+		pj, err := q.getProvisionerJobByIDNoLock(ctx, q.workspaceBuilds[i].JobID)
+		if err != nil {
+			return err
+		}
+		if !pj.CompletedAt.Valid {
+			return nil
+		}
+		// Do not bump if the deadline is not set.
+		if q.workspaceBuilds[i].Deadline.IsZero() {
+			return nil
+		}
+
+		// Check the template default TTL.
+		template, err := q.getTemplateByIDNoLock(ctx, workspace.TemplateID)
+		if err != nil {
+			return err
+		}
+
+		var ttlDur time.Duration
+		if workspace.Ttl.Valid {
+			ttlDur = time.Duration(workspace.Ttl.Int64)
+		}
+		if !template.AllowUserAutostop {
+			ttlDur = time.Duration(template.DefaultTTL)
+		}
+		if ttlDur <= 0 {
+			// There's no TTL set anymore, so we don't know the bump duration.
+			return nil
+		}
+
+		// Only bump if 5% of the deadline has passed.
+		ttlDur95 := ttlDur - (ttlDur / 20)
+		minBumpDeadline := q.workspaceBuilds[i].Deadline.Add(-ttlDur95)
+		if now.Before(minBumpDeadline) {
+			return nil
+		}
+
+		// Bump.
+		newDeadline := now.Add(ttlDur)
+		q.workspaceBuilds[i].UpdatedAt = now
+		if !q.workspaceBuilds[i].MaxDeadline.IsZero() {
+			q.workspaceBuilds[i].Deadline = minTime(newDeadline, q.workspaceBuilds[i].MaxDeadline)
+		} else {
+			q.workspaceBuilds[i].Deadline = newDeadline
+		}
+		return nil
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) AllUserIDs(_ context.Context) ([]uuid.UUID, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+	userIDs := make([]uuid.UUID, 0, len(q.users))
+	for idx := range q.users {
+		userIDs[idx] = q.users[idx].ID
+	}
+	return userIDs, nil
+}
+
+func (q *FakeQuerier) ArchiveUnusedTemplateVersions(_ context.Context, arg database.ArchiveUnusedTemplateVersionsParams) ([]uuid.UUID, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return nil, err
+	}
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+	type latestBuild struct {
+		Number  int32
+		Version uuid.UUID
+	}
+	latest := make(map[uuid.UUID]latestBuild)
+
+	for _, b := range q.workspaceBuilds {
+		v, ok := latest[b.WorkspaceID]
+		if ok || b.BuildNumber < v.Number {
+			// Not the latest
+			continue
+		}
+		// Ignore deleted workspaces.
+		if b.Transition == database.WorkspaceTransitionDelete {
+			continue
+		}
+		latest[b.WorkspaceID] = latestBuild{
+			Number:  b.BuildNumber,
+			Version: b.TemplateVersionID,
+		}
+	}
+
+	usedVersions := make(map[uuid.UUID]bool)
+	for _, l := range latest {
+		usedVersions[l.Version] = true
+	}
+	for _, tpl := range q.templates {
+		usedVersions[tpl.ActiveVersionID] = true
+	}
+
+	var archived []uuid.UUID
+	for i, v := range q.templateVersions {
+		if arg.TemplateVersionID != uuid.Nil {
+			if v.ID != arg.TemplateVersionID {
+				continue
+			}
+		}
+		if v.Archived {
+			continue
+		}
+
+		if _, ok := usedVersions[v.ID]; !ok {
+			var job *database.ProvisionerJob
+			for i, j := range q.provisionerJobs {
+				if v.JobID == j.ID {
+					job = &q.provisionerJobs[i]
+					break
+				}
+			}
+
+			if arg.JobStatus.Valid {
+				if job.JobStatus != arg.JobStatus.ProvisionerJobStatus {
+					continue
+				}
+			}
+
+			if job.JobStatus == database.ProvisionerJobStatusRunning || job.JobStatus == database.ProvisionerJobStatusPending {
+				continue
+			}
+
+			v.Archived = true
+			q.templateVersions[i] = v
+			archived = append(archived, v.ID)
+		}
+	}
+
+	return archived, nil
+}
+
+func (*FakeQuerier) CleanTailnetCoordinators(_ context.Context) error {
+	return ErrUnimplemented
+}
+
+func (q *FakeQuerier) DeleteAPIKeyByID(_ context.Context, id string) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, apiKey := range q.apiKeys {
+		if apiKey.ID != id {
+			continue
+		}
+		q.apiKeys[index] = q.apiKeys[len(q.apiKeys)-1]
+		q.apiKeys = q.apiKeys[:len(q.apiKeys)-1]
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) DeleteAPIKeysByUserID(_ context.Context, userID uuid.UUID) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i := len(q.apiKeys) - 1; i >= 0; i-- {
+		if q.apiKeys[i].UserID == userID {
+			q.apiKeys = append(q.apiKeys[:i], q.apiKeys[i+1:]...)
+		}
+	}
+
+	return nil
+}
+
+func (*FakeQuerier) DeleteAllTailnetClientSubscriptions(_ context.Context, arg database.DeleteAllTailnetClientSubscriptionsParams) error {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return err
+	}
+
+	return ErrUnimplemented
+}
+
+func (q *FakeQuerier) DeleteApplicationConnectAPIKeysByUserID(_ context.Context, userID uuid.UUID) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i := len(q.apiKeys) - 1; i >= 0; i-- {
+		if q.apiKeys[i].UserID == userID && q.apiKeys[i].Scope == database.APIKeyScopeApplicationConnect {
+			q.apiKeys = append(q.apiKeys[:i], q.apiKeys[i+1:]...)
+		}
+	}
+
+	return nil
+}
+
+func (*FakeQuerier) DeleteCoordinator(context.Context, uuid.UUID) error {
+	return ErrUnimplemented
+}
+
+func (q *FakeQuerier) DeleteGitSSHKey(_ context.Context, userID uuid.UUID) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, key := range q.gitSSHKey {
+		if key.UserID != userID {
+			continue
+		}
+		q.gitSSHKey[index] = q.gitSSHKey[len(q.gitSSHKey)-1]
+		q.gitSSHKey = q.gitSSHKey[:len(q.gitSSHKey)-1]
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) DeleteGroupByID(_ context.Context, id uuid.UUID) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, group := range q.groups {
+		if group.ID == id {
+			q.groups = append(q.groups[:i], q.groups[i+1:]...)
+			return nil
+		}
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) DeleteGroupMemberFromGroup(_ context.Context, arg database.DeleteGroupMemberFromGroupParams) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, member := range q.groupMembers {
+		if member.UserID == arg.UserID && member.GroupID == arg.GroupID {
+			q.groupMembers = append(q.groupMembers[:i], q.groupMembers[i+1:]...)
+		}
+	}
+	return nil
+}
+
+func (q *FakeQuerier) DeleteGroupMembersByOrgAndUser(_ context.Context, arg database.DeleteGroupMembersByOrgAndUserParams) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	newMembers := q.groupMembers[:0]
+	for _, member := range q.groupMembers {
+		if member.UserID != arg.UserID {
+			// Do not delete the other members
+			newMembers = append(newMembers, member)
+		} else if member.UserID == arg.UserID {
+			// We only want to delete from groups in the organization in the args.
+			for _, group := range q.groups {
+				// Find the group that the member is apartof.
+				if group.ID == member.GroupID {
+					// Only add back the member if the organization ID does not match
+					// the arg organization ID. Since the arg is saying which
+					// org to delete.
+					if group.OrganizationID != arg.OrganizationID {
+						newMembers = append(newMembers, member)
+					}
+					break
+				}
+			}
+		}
+	}
+	q.groupMembers = newMembers
+
+	return nil
+}
+
+func (q *FakeQuerier) DeleteLicense(_ context.Context, id int32) (int32, error) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, l := range q.licenses {
+		if l.ID == id {
+			q.licenses[index] = q.licenses[len(q.licenses)-1]
+			q.licenses = q.licenses[:len(q.licenses)-1]
+			return id, nil
+		}
+	}
+	return 0, sql.ErrNoRows
+}
+
+func (*FakeQuerier) DeleteOldWorkspaceAgentLogs(_ context.Context) error {
+	// noop
+	return nil
+}
+
+func (*FakeQuerier) DeleteOldWorkspaceAgentStats(_ context.Context) error {
+	// no-op
+	return nil
+}
+
+func (q *FakeQuerier) DeleteReplicasUpdatedBefore(_ context.Context, before time.Time) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, replica := range q.replicas {
+		if replica.UpdatedAt.Before(before) {
+			q.replicas = append(q.replicas[:i], q.replicas[i+1:]...)
+		}
+	}
+
+	return nil
+}
+
+func (*FakeQuerier) DeleteTailnetAgent(context.Context, database.DeleteTailnetAgentParams) (database.DeleteTailnetAgentRow, error) {
+	return database.DeleteTailnetAgentRow{}, ErrUnimplemented
+}
+
+func (*FakeQuerier) DeleteTailnetClient(context.Context, database.DeleteTailnetClientParams) (database.DeleteTailnetClientRow, error) {
+	return database.DeleteTailnetClientRow{}, ErrUnimplemented
+}
+
+func (*FakeQuerier) DeleteTailnetClientSubscription(context.Context, database.DeleteTailnetClientSubscriptionParams) error {
+	return ErrUnimplemented
+}
+
+func (q *FakeQuerier) GetAPIKeyByID(_ context.Context, id string) (database.APIKey, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, apiKey := range q.apiKeys {
+		if apiKey.ID == id {
+			return apiKey, nil
+		}
+	}
+	return database.APIKey{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetAPIKeyByName(_ context.Context, params database.GetAPIKeyByNameParams) (database.APIKey, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	if params.TokenName == "" {
+		return database.APIKey{}, sql.ErrNoRows
+	}
+	for _, apiKey := range q.apiKeys {
+		if params.UserID == apiKey.UserID && params.TokenName == apiKey.TokenName {
+			return apiKey, nil
+		}
+	}
+	return database.APIKey{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetAPIKeysByLoginType(_ context.Context, t database.LoginType) ([]database.APIKey, error) {
+	if err := validateDatabaseType(t); err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	apiKeys := make([]database.APIKey, 0)
+	for _, key := range q.apiKeys {
+		if key.LoginType == t {
+			apiKeys = append(apiKeys, key)
+		}
+	}
+	return apiKeys, nil
+}
+
+func (q *FakeQuerier) GetAPIKeysByUserID(_ context.Context, params database.GetAPIKeysByUserIDParams) ([]database.APIKey, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	apiKeys := make([]database.APIKey, 0)
+	for _, key := range q.apiKeys {
+		if key.UserID == params.UserID && key.LoginType == params.LoginType {
+			apiKeys = append(apiKeys, key)
+		}
+	}
+	return apiKeys, nil
+}
+
+func (q *FakeQuerier) GetAPIKeysLastUsedAfter(_ context.Context, after time.Time) ([]database.APIKey, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	apiKeys := make([]database.APIKey, 0)
+	for _, key := range q.apiKeys {
+		if key.LastUsed.After(after) {
+			apiKeys = append(apiKeys, key)
+		}
+	}
+	return apiKeys, nil
+}
+
+func (q *FakeQuerier) GetActiveUserCount(_ context.Context) (int64, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	active := int64(0)
+	for _, u := range q.users {
+		if u.Status == database.UserStatusActive && !u.Deleted {
+			active++
+		}
+	}
+	return active, nil
+}
+
+func (q *FakeQuerier) GetActiveWorkspaceBuildsByTemplateID(ctx context.Context, templateID uuid.UUID) ([]database.WorkspaceBuild, error) {
+	workspaceIDs := func() []uuid.UUID {
+		q.mutex.RLock()
+		defer q.mutex.RUnlock()
+
+		ids := []uuid.UUID{}
+		for _, workspace := range q.workspaces {
+			if workspace.TemplateID == templateID {
+				ids = append(ids, workspace.ID)
+			}
+		}
+		return ids
+	}()
+
+	builds, err := q.GetLatestWorkspaceBuildsByWorkspaceIDs(ctx, workspaceIDs)
+	if err != nil {
+		return nil, err
+	}
+
+	filteredBuilds := []database.WorkspaceBuild{}
+	for _, build := range builds {
+		if build.Transition == database.WorkspaceTransitionStart {
+			filteredBuilds = append(filteredBuilds, build)
+		}
+	}
+	return filteredBuilds, nil
+}
+
+func (*FakeQuerier) GetAllTailnetAgents(_ context.Context) ([]database.TailnetAgent, error) {
+	return nil, ErrUnimplemented
+}
+
+func (*FakeQuerier) GetAllTailnetClients(_ context.Context) ([]database.GetAllTailnetClientsRow, error) {
+	return nil, ErrUnimplemented
+}
+
+func (q *FakeQuerier) GetAppSecurityKey(_ context.Context) (string, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.appSecurityKey, nil
+}
+
+func (q *FakeQuerier) GetApplicationName(_ context.Context) (string, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	if q.applicationName == "" {
+		return "", sql.ErrNoRows
+	}
+
+	return q.applicationName, nil
+}
+
+func (q *FakeQuerier) GetAuditLogsOffset(_ context.Context, arg database.GetAuditLogsOffsetParams) ([]database.GetAuditLogsOffsetRow, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	logs := make([]database.GetAuditLogsOffsetRow, 0, arg.Limit)
+
+	// q.auditLogs are already sorted by time DESC, so no need to sort after the fact.
+	for _, alog := range q.auditLogs {
+		if arg.Offset > 0 {
+			arg.Offset--
+			continue
+		}
+		if arg.Action != "" && !strings.Contains(string(alog.Action), arg.Action) {
+			continue
+		}
+		if arg.ResourceType != "" && !strings.Contains(string(alog.ResourceType), arg.ResourceType) {
+			continue
+		}
+		if arg.ResourceID != uuid.Nil && alog.ResourceID != arg.ResourceID {
+			continue
+		}
+		if arg.Username != "" {
+			user, err := q.getUserByIDNoLock(alog.UserID)
+			if err == nil && !strings.EqualFold(arg.Username, user.Username) {
+				continue
+			}
+		}
+		if arg.Email != "" {
+			user, err := q.getUserByIDNoLock(alog.UserID)
+			if err == nil && !strings.EqualFold(arg.Email, user.Email) {
+				continue
+			}
+		}
+		if !arg.DateFrom.IsZero() {
+			if alog.Time.Before(arg.DateFrom) {
+				continue
+			}
+		}
+		if !arg.DateTo.IsZero() {
+			if alog.Time.After(arg.DateTo) {
+				continue
+			}
+		}
+		if arg.BuildReason != "" {
+			workspaceBuild, err := q.getWorkspaceBuildByIDNoLock(context.Background(), alog.ResourceID)
+			if err == nil && !strings.EqualFold(arg.BuildReason, string(workspaceBuild.Reason)) {
+				continue
+			}
+		}
+
+		user, err := q.getUserByIDNoLock(alog.UserID)
+		userValid := err == nil
+
+		logs = append(logs, database.GetAuditLogsOffsetRow{
+			ID:               alog.ID,
+			RequestID:        alog.RequestID,
+			OrganizationID:   alog.OrganizationID,
+			Ip:               alog.Ip,
+			UserAgent:        alog.UserAgent,
+			ResourceType:     alog.ResourceType,
+			ResourceID:       alog.ResourceID,
+			ResourceTarget:   alog.ResourceTarget,
+			ResourceIcon:     alog.ResourceIcon,
+			Action:           alog.Action,
+			Diff:             alog.Diff,
+			StatusCode:       alog.StatusCode,
+			AdditionalFields: alog.AdditionalFields,
+			UserID:           alog.UserID,
+			UserUsername:     sql.NullString{String: user.Username, Valid: userValid},
+			UserEmail:        sql.NullString{String: user.Email, Valid: userValid},
+			UserCreatedAt:    sql.NullTime{Time: user.CreatedAt, Valid: userValid},
+			UserStatus:       database.NullUserStatus{UserStatus: user.Status, Valid: userValid},
+			UserRoles:        user.RBACRoles,
+			Count:            0,
+		})
+
+		if len(logs) >= int(arg.Limit) {
+			break
+		}
+	}
+
+	count := int64(len(logs))
+	for i := range logs {
+		logs[i].Count = count
+	}
+
+	return logs, nil
+}
+
+func (q *FakeQuerier) GetAuthorizationUserRoles(_ context.Context, userID uuid.UUID) (database.GetAuthorizationUserRolesRow, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	var user *database.User
+	roles := make([]string, 0)
+	for _, u := range q.users {
+		if u.ID == userID {
+			u := u
+			roles = append(roles, u.RBACRoles...)
+			roles = append(roles, "member")
+			user = &u
+			break
+		}
+	}
+
+	for _, mem := range q.organizationMembers {
+		if mem.UserID == userID {
+			roles = append(roles, mem.Roles...)
+			roles = append(roles, "organization-member:"+mem.OrganizationID.String())
+		}
+	}
+
+	var groups []string
+	for _, member := range q.groupMembers {
+		if member.UserID == userID {
+			groups = append(groups, member.GroupID.String())
+		}
+	}
+
+	if user == nil {
+		return database.GetAuthorizationUserRolesRow{}, sql.ErrNoRows
+	}
+
+	return database.GetAuthorizationUserRolesRow{
+		ID:       userID,
+		Username: user.Username,
+		Status:   user.Status,
+		Roles:    roles,
+		Groups:   groups,
+	}, nil
+}
+
+func (q *FakeQuerier) GetDBCryptKeys(_ context.Context) ([]database.DBCryptKey, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+	ks := make([]database.DBCryptKey, 0)
+	ks = append(ks, q.dbcryptKeys...)
+	return ks, nil
+}
+
+func (q *FakeQuerier) GetDERPMeshKey(_ context.Context) (string, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.derpMeshKey, nil
+}
+
+func (q *FakeQuerier) GetDefaultProxyConfig(_ context.Context) (database.GetDefaultProxyConfigRow, error) {
+	return database.GetDefaultProxyConfigRow{
+		DisplayName: q.defaultProxyDisplayName,
+		IconUrl:     q.defaultProxyIconURL,
+	}, nil
+}
+
+func (q *FakeQuerier) GetDeploymentDAUs(_ context.Context, tzOffset int32) ([]database.GetDeploymentDAUsRow, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	seens := make(map[time.Time]map[uuid.UUID]struct{})
+
+	for _, as := range q.workspaceAgentStats {
+		if as.ConnectionCount == 0 {
+			continue
+		}
+		date := as.CreatedAt.UTC().Add(time.Duration(tzOffset) * -1 * time.Hour).Truncate(time.Hour * 24)
+
+		dateEntry := seens[date]
+		if dateEntry == nil {
+			dateEntry = make(map[uuid.UUID]struct{})
+		}
+		dateEntry[as.UserID] = struct{}{}
+		seens[date] = dateEntry
+	}
+
+	seenKeys := maps.Keys(seens)
+	sort.Slice(seenKeys, func(i, j int) bool {
+		return seenKeys[i].Before(seenKeys[j])
+	})
+
+	var rs []database.GetDeploymentDAUsRow
+	for _, key := range seenKeys {
+		ids := seens[key]
+		for id := range ids {
+			rs = append(rs, database.GetDeploymentDAUsRow{
+				Date:   key,
+				UserID: id,
+			})
+		}
+	}
+
+	return rs, nil
+}
+
+func (q *FakeQuerier) GetDeploymentID(_ context.Context) (string, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.deploymentID, nil
+}
+
+func (q *FakeQuerier) GetDeploymentWorkspaceAgentStats(_ context.Context, createdAfter time.Time) (database.GetDeploymentWorkspaceAgentStatsRow, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	agentStatsCreatedAfter := make([]database.WorkspaceAgentStat, 0)
+	for _, agentStat := range q.workspaceAgentStats {
+		if agentStat.CreatedAt.After(createdAfter) {
+			agentStatsCreatedAfter = append(agentStatsCreatedAfter, agentStat)
+		}
+	}
+
+	latestAgentStats := map[uuid.UUID]database.WorkspaceAgentStat{}
+	for _, agentStat := range q.workspaceAgentStats {
+		if agentStat.CreatedAt.After(createdAfter) {
+			latestAgentStats[agentStat.AgentID] = agentStat
+		}
+	}
+
+	stat := database.GetDeploymentWorkspaceAgentStatsRow{}
+	for _, agentStat := range latestAgentStats {
+		stat.SessionCountVSCode += agentStat.SessionCountVSCode
+		stat.SessionCountJetBrains += agentStat.SessionCountJetBrains
+		stat.SessionCountReconnectingPTY += agentStat.SessionCountReconnectingPTY
+		stat.SessionCountSSH += agentStat.SessionCountSSH
+	}
+
+	latencies := make([]float64, 0)
+	for _, agentStat := range agentStatsCreatedAfter {
+		if agentStat.ConnectionMedianLatencyMS <= 0 {
+			continue
+		}
+		stat.WorkspaceRxBytes += agentStat.RxBytes
+		stat.WorkspaceTxBytes += agentStat.TxBytes
+		latencies = append(latencies, agentStat.ConnectionMedianLatencyMS)
+	}
+
+	tryPercentile := func(fs []float64, p float64) float64 {
+		if len(fs) == 0 {
+			return -1
+		}
+		sort.Float64s(fs)
+		return fs[int(float64(len(fs))*p/100)]
+	}
+
+	stat.WorkspaceConnectionLatency50 = tryPercentile(latencies, 50)
+	stat.WorkspaceConnectionLatency95 = tryPercentile(latencies, 95)
+
+	return stat, nil
+}
+
+func (q *FakeQuerier) GetDeploymentWorkspaceStats(ctx context.Context) (database.GetDeploymentWorkspaceStatsRow, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	stat := database.GetDeploymentWorkspaceStatsRow{}
+	for _, workspace := range q.workspaces {
+		build, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspace.ID)
+		if err != nil {
+			return stat, err
+		}
+		job, err := q.getProvisionerJobByIDNoLock(ctx, build.JobID)
+		if err != nil {
+			return stat, err
+		}
+		if !job.StartedAt.Valid {
+			stat.PendingWorkspaces++
+			continue
+		}
+		if job.StartedAt.Valid &&
+			!job.CanceledAt.Valid &&
+			time.Since(job.UpdatedAt) <= 30*time.Second &&
+			!job.CompletedAt.Valid {
+			stat.BuildingWorkspaces++
+			continue
+		}
+		if job.CompletedAt.Valid &&
+			!job.CanceledAt.Valid &&
+			!job.Error.Valid {
+			if build.Transition == database.WorkspaceTransitionStart {
+				stat.RunningWorkspaces++
+			}
+			if build.Transition == database.WorkspaceTransitionStop {
+				stat.StoppedWorkspaces++
+			}
+			continue
+		}
+		if job.CanceledAt.Valid || job.Error.Valid {
+			stat.FailedWorkspaces++
+			continue
+		}
+	}
+	return stat, nil
+}
+
+func (q *FakeQuerier) GetExternalAuthLink(_ context.Context, arg database.GetExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+	for _, gitAuthLink := range q.externalAuthLinks {
+		if arg.UserID != gitAuthLink.UserID {
+			continue
+		}
+		if arg.ProviderID != gitAuthLink.ProviderID {
+			continue
+		}
+		return gitAuthLink, nil
+	}
+	return database.ExternalAuthLink{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetExternalAuthLinksByUserID(_ context.Context, userID uuid.UUID) ([]database.ExternalAuthLink, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+	gals := make([]database.ExternalAuthLink, 0)
+	for _, gal := range q.externalAuthLinks {
+		if gal.UserID == userID {
+			gals = append(gals, gal)
+		}
+	}
+	return gals, nil
+}
+
+func (q *FakeQuerier) GetFileByHashAndCreator(_ context.Context, arg database.GetFileByHashAndCreatorParams) (database.File, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.File{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, file := range q.files {
+		if file.Hash == arg.Hash && file.CreatedBy == arg.CreatedBy {
+			return file, nil
+		}
+	}
+	return database.File{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetFileByID(_ context.Context, id uuid.UUID) (database.File, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, file := range q.files {
+		if file.ID == id {
+			return file, nil
+		}
+	}
+	return database.File{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetFileTemplates(_ context.Context, id uuid.UUID) ([]database.GetFileTemplatesRow, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	rows := make([]database.GetFileTemplatesRow, 0)
+	var file database.File
+	for _, f := range q.files {
+		if f.ID == id {
+			file = f
+			break
+		}
+	}
+	if file.Hash == "" {
+		return rows, nil
+	}
+
+	for _, job := range q.provisionerJobs {
+		if job.FileID == id {
+			for _, version := range q.templateVersions {
+				if version.JobID == job.ID {
+					for _, template := range q.templates {
+						if template.ID == version.TemplateID.UUID {
+							rows = append(rows, database.GetFileTemplatesRow{
+								FileID:                 file.ID,
+								FileCreatedBy:          file.CreatedBy,
+								TemplateID:             template.ID,
+								TemplateOrganizationID: template.OrganizationID,
+								TemplateCreatedBy:      template.CreatedBy,
+								UserACL:                template.UserACL,
+								GroupACL:               template.GroupACL,
+							})
+						}
+					}
+				}
+			}
+		}
+	}
+
+	return rows, nil
+}
+
+func (q *FakeQuerier) GetGitSSHKey(_ context.Context, userID uuid.UUID) (database.GitSSHKey, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, key := range q.gitSSHKey {
+		if key.UserID == userID {
+			return key, nil
+		}
+	}
+	return database.GitSSHKey{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetGroupByID(ctx context.Context, id uuid.UUID) (database.Group, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getGroupByIDNoLock(ctx, id)
+}
+
+func (q *FakeQuerier) GetGroupByOrgAndName(_ context.Context, arg database.GetGroupByOrgAndNameParams) (database.Group, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.Group{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, group := range q.groups {
+		if group.OrganizationID == arg.OrganizationID &&
+			group.Name == arg.Name {
+			return group, nil
+		}
+	}
+
+	return database.Group{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetGroupMembers(_ context.Context, id uuid.UUID) ([]database.User, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	if q.isEveryoneGroup(id) {
+		return q.getEveryoneGroupMembersNoLock(id), nil
+	}
+
+	var members []database.GroupMember
+	for _, member := range q.groupMembers {
+		if member.GroupID == id {
+			members = append(members, member)
+		}
+	}
+
+	users := make([]database.User, 0, len(members))
+
+	for _, member := range members {
+		for _, user := range q.users {
+			if user.ID == member.UserID && !user.Deleted {
+				users = append(users, user)
+				break
+			}
+		}
+	}
+
+	return users, nil
+}
+
+func (q *FakeQuerier) GetGroupsByOrganizationID(_ context.Context, id uuid.UUID) ([]database.Group, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	groups := make([]database.Group, 0, len(q.groups))
+	for _, group := range q.groups {
+		if group.OrganizationID == id {
+			groups = append(groups, group)
+		}
+	}
+
+	return groups, nil
+}
+
+func (q *FakeQuerier) GetHungProvisionerJobs(_ context.Context, hungSince time.Time) ([]database.ProvisionerJob, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	hungJobs := []database.ProvisionerJob{}
+	for _, provisionerJob := range q.provisionerJobs {
+		if provisionerJob.StartedAt.Valid && !provisionerJob.CompletedAt.Valid && provisionerJob.UpdatedAt.Before(hungSince) {
+			hungJobs = append(hungJobs, provisionerJob)
+		}
+	}
+	return hungJobs, nil
+}
+
+func (q *FakeQuerier) GetLastUpdateCheck(_ context.Context) (string, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	if q.lastUpdateCheck == nil {
+		return "", sql.ErrNoRows
+	}
+	return string(q.lastUpdateCheck), nil
+}
+
+func (q *FakeQuerier) GetLatestWorkspaceBuildByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) (database.WorkspaceBuild, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspaceID)
+}
+
+func (q *FakeQuerier) GetLatestWorkspaceBuilds(_ context.Context) ([]database.WorkspaceBuild, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	builds := make(map[uuid.UUID]database.WorkspaceBuild)
+	buildNumbers := make(map[uuid.UUID]int32)
+	for _, workspaceBuild := range q.workspaceBuilds {
+		id := workspaceBuild.WorkspaceID
+		if workspaceBuild.BuildNumber > buildNumbers[id] {
+			builds[id] = q.workspaceBuildWithUserNoLock(workspaceBuild)
+			buildNumbers[id] = workspaceBuild.BuildNumber
+		}
+	}
+	var returnBuilds []database.WorkspaceBuild
+	for i, n := range buildNumbers {
+		if n > 0 {
+			b := builds[i]
+			returnBuilds = append(returnBuilds, b)
+		}
+	}
+	if len(returnBuilds) == 0 {
+		return nil, sql.ErrNoRows
+	}
+	return returnBuilds, nil
+}
+
+func (q *FakeQuerier) GetLatestWorkspaceBuildsByWorkspaceIDs(_ context.Context, ids []uuid.UUID) ([]database.WorkspaceBuild, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	builds := make(map[uuid.UUID]database.WorkspaceBuild)
+	buildNumbers := make(map[uuid.UUID]int32)
+	for _, workspaceBuild := range q.workspaceBuilds {
+		for _, id := range ids {
+			if id == workspaceBuild.WorkspaceID && workspaceBuild.BuildNumber > buildNumbers[id] {
+				builds[id] = q.workspaceBuildWithUserNoLock(workspaceBuild)
+				buildNumbers[id] = workspaceBuild.BuildNumber
+			}
+		}
+	}
+	var returnBuilds []database.WorkspaceBuild
+	for i, n := range buildNumbers {
+		if n > 0 {
+			b := builds[i]
+			returnBuilds = append(returnBuilds, b)
+		}
+	}
+	if len(returnBuilds) == 0 {
+		return nil, sql.ErrNoRows
+	}
+	return returnBuilds, nil
+}
+
+func (q *FakeQuerier) GetLicenseByID(_ context.Context, id int32) (database.License, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, license := range q.licenses {
+		if license.ID == id {
+			return license, nil
+		}
+	}
+	return database.License{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetLicenses(_ context.Context) ([]database.License, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	results := append([]database.License{}, q.licenses...)
+	sort.Slice(results, func(i, j int) bool { return results[i].ID < results[j].ID })
+	return results, nil
+}
+
+func (q *FakeQuerier) GetLogoURL(_ context.Context) (string, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	if q.logoURL == "" {
+		return "", sql.ErrNoRows
+	}
+
+	return q.logoURL, nil
+}
+
+func (q *FakeQuerier) GetOAuthSigningKey(_ context.Context) (string, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.oauthSigningKey, nil
+}
+
+func (q *FakeQuerier) GetOrganizationByID(_ context.Context, id uuid.UUID) (database.Organization, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, organization := range q.organizations {
+		if organization.ID == id {
+			return organization, nil
+		}
+	}
+	return database.Organization{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetOrganizationByName(_ context.Context, name string) (database.Organization, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, organization := range q.organizations {
+		if organization.Name == name {
+			return organization, nil
+		}
+	}
+	return database.Organization{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetOrganizationIDsByMemberIDs(_ context.Context, ids []uuid.UUID) ([]database.GetOrganizationIDsByMemberIDsRow, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	getOrganizationIDsByMemberIDRows := make([]database.GetOrganizationIDsByMemberIDsRow, 0, len(ids))
+	for _, userID := range ids {
+		userOrganizationIDs := make([]uuid.UUID, 0)
+		for _, membership := range q.organizationMembers {
+			if membership.UserID == userID {
+				userOrganizationIDs = append(userOrganizationIDs, membership.OrganizationID)
+			}
+		}
+		getOrganizationIDsByMemberIDRows = append(getOrganizationIDsByMemberIDRows, database.GetOrganizationIDsByMemberIDsRow{
+			UserID:          userID,
+			OrganizationIDs: userOrganizationIDs,
+		})
+	}
+	if len(getOrganizationIDsByMemberIDRows) == 0 {
+		return nil, sql.ErrNoRows
+	}
+	return getOrganizationIDsByMemberIDRows, nil
+}
+
+func (q *FakeQuerier) GetOrganizationMemberByUserID(_ context.Context, arg database.GetOrganizationMemberByUserIDParams) (database.OrganizationMember, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.OrganizationMember{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, organizationMember := range q.organizationMembers {
+		if organizationMember.OrganizationID != arg.OrganizationID {
+			continue
+		}
+		if organizationMember.UserID != arg.UserID {
+			continue
+		}
+		return organizationMember, nil
+	}
+	return database.OrganizationMember{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetOrganizationMembershipsByUserID(_ context.Context, userID uuid.UUID) ([]database.OrganizationMember, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	var memberships []database.OrganizationMember
+	for _, organizationMember := range q.organizationMembers {
+		mem := organizationMember
+		if mem.UserID != userID {
+			continue
+		}
+		memberships = append(memberships, mem)
+	}
+	return memberships, nil
+}
+
+func (q *FakeQuerier) GetOrganizations(_ context.Context) ([]database.Organization, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	if len(q.organizations) == 0 {
+		return nil, sql.ErrNoRows
+	}
+	return q.organizations, nil
+}
+
+func (q *FakeQuerier) GetOrganizationsByUserID(_ context.Context, userID uuid.UUID) ([]database.Organization, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	organizations := make([]database.Organization, 0)
+	for _, organizationMember := range q.organizationMembers {
+		if organizationMember.UserID != userID {
+			continue
+		}
+		for _, organization := range q.organizations {
+			if organization.ID != organizationMember.OrganizationID {
+				continue
+			}
+			organizations = append(organizations, organization)
+		}
+	}
+	if len(organizations) == 0 {
+		return nil, sql.ErrNoRows
+	}
+	return organizations, nil
+}
+
+func (q *FakeQuerier) GetParameterSchemasByJobID(_ context.Context, jobID uuid.UUID) ([]database.ParameterSchema, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	parameters := make([]database.ParameterSchema, 0)
+	for _, parameterSchema := range q.parameterSchemas {
+		if parameterSchema.JobID != jobID {
+			continue
+		}
+		parameters = append(parameters, parameterSchema)
+	}
+	if len(parameters) == 0 {
+		return nil, sql.ErrNoRows
+	}
+	sort.Slice(parameters, func(i, j int) bool {
+		return parameters[i].Index < parameters[j].Index
+	})
+	return parameters, nil
+}
+
+func (q *FakeQuerier) GetPreviousTemplateVersion(_ context.Context, arg database.GetPreviousTemplateVersionParams) (database.TemplateVersion, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.TemplateVersion{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	var currentTemplateVersion database.TemplateVersion
+	for _, templateVersion := range q.templateVersions {
+		if templateVersion.TemplateID != arg.TemplateID {
+			continue
+		}
+		if templateVersion.Name != arg.Name {
+			continue
+		}
+		if templateVersion.OrganizationID != arg.OrganizationID {
+			continue
+		}
+		currentTemplateVersion = q.templateVersionWithUserNoLock(templateVersion)
+		break
+	}
+
+	previousTemplateVersions := make([]database.TemplateVersion, 0)
+	for _, templateVersion := range q.templateVersions {
+		if templateVersion.ID == currentTemplateVersion.ID {
+			continue
+		}
+		if templateVersion.OrganizationID != arg.OrganizationID {
+			continue
+		}
+		if templateVersion.TemplateID != currentTemplateVersion.TemplateID {
+			continue
+		}
+
+		if templateVersion.CreatedAt.Before(currentTemplateVersion.CreatedAt) {
+			previousTemplateVersions = append(previousTemplateVersions, q.templateVersionWithUserNoLock(templateVersion))
+		}
+	}
+
+	if len(previousTemplateVersions) == 0 {
+		return database.TemplateVersion{}, sql.ErrNoRows
+	}
+
+	sort.Slice(previousTemplateVersions, func(i, j int) bool {
+		return previousTemplateVersions[i].CreatedAt.After(previousTemplateVersions[j].CreatedAt)
+	})
+
+	return previousTemplateVersions[0], nil
+}
+
+func (q *FakeQuerier) GetProvisionerDaemons(_ context.Context) ([]database.ProvisionerDaemon, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	if len(q.provisionerDaemons) == 0 {
+		return nil, sql.ErrNoRows
+	}
+	return q.provisionerDaemons, nil
+}
+
+func (q *FakeQuerier) GetProvisionerJobByID(ctx context.Context, id uuid.UUID) (database.ProvisionerJob, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getProvisionerJobByIDNoLock(ctx, id)
+}
+
+func (q *FakeQuerier) GetProvisionerJobsByIDs(_ context.Context, ids []uuid.UUID) ([]database.ProvisionerJob, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	jobs := make([]database.ProvisionerJob, 0)
+	for _, job := range q.provisionerJobs {
+		for _, id := range ids {
+			if id == job.ID {
+				jobs = append(jobs, job)
+				break
+			}
+		}
+	}
+	if len(jobs) == 0 {
+		return nil, sql.ErrNoRows
+	}
+
+	return jobs, nil
+}
+
+func (q *FakeQuerier) GetProvisionerJobsByIDsWithQueuePosition(_ context.Context, ids []uuid.UUID) ([]database.GetProvisionerJobsByIDsWithQueuePositionRow, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	jobs := make([]database.GetProvisionerJobsByIDsWithQueuePositionRow, 0)
+	queuePosition := int64(1)
+	for _, job := range q.provisionerJobs {
+		for _, id := range ids {
+			if id == job.ID {
+				job := database.GetProvisionerJobsByIDsWithQueuePositionRow{
+					ProvisionerJob: job,
+				}
+				if !job.ProvisionerJob.StartedAt.Valid {
+					job.QueuePosition = queuePosition
+				}
+				jobs = append(jobs, job)
+				break
+			}
+		}
+		if !job.StartedAt.Valid {
+			queuePosition++
+		}
+	}
+	for _, job := range jobs {
+		if !job.ProvisionerJob.StartedAt.Valid {
+			// Set it to the max position!
+			job.QueueSize = queuePosition
+		}
+	}
+	return jobs, nil
+}
+
+func (q *FakeQuerier) GetProvisionerJobsCreatedAfter(_ context.Context, after time.Time) ([]database.ProvisionerJob, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	jobs := make([]database.ProvisionerJob, 0)
+	for _, job := range q.provisionerJobs {
+		if job.CreatedAt.After(after) {
+			jobs = append(jobs, job)
+		}
+	}
+	return jobs, nil
+}
+
+func (q *FakeQuerier) GetProvisionerLogsAfterID(_ context.Context, arg database.GetProvisionerLogsAfterIDParams) ([]database.ProvisionerJobLog, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	logs := make([]database.ProvisionerJobLog, 0)
+	for _, jobLog := range q.provisionerJobLogs {
+		if jobLog.JobID != arg.JobID {
+			continue
+		}
+		if jobLog.ID <= arg.CreatedAfter {
+			continue
+		}
+		logs = append(logs, jobLog)
+	}
+	return logs, nil
+}
+
+func (q *FakeQuerier) GetQuotaAllowanceForUser(_ context.Context, userID uuid.UUID) (int64, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	var sum int64
+	for _, member := range q.groupMembers {
+		if member.UserID != userID {
+			continue
+		}
+		for _, group := range q.groups {
+			if group.ID == member.GroupID {
+				sum += int64(group.QuotaAllowance)
+				continue
+			}
+		}
+	}
+	// Grab the quota for the Everyone group.
+	for _, group := range q.groups {
+		if group.ID == group.OrganizationID {
+			sum += int64(group.QuotaAllowance)
+			break
+		}
+	}
+	return sum, nil
+}
+
+func (q *FakeQuerier) GetQuotaConsumedForUser(_ context.Context, userID uuid.UUID) (int64, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	var sum int64
+	for _, workspace := range q.workspaces {
+		if workspace.OwnerID != userID {
+			continue
+		}
+		if workspace.Deleted {
+			continue
+		}
+
+		var lastBuild database.WorkspaceBuildTable
+		for _, build := range q.workspaceBuilds {
+			if build.WorkspaceID != workspace.ID {
+				continue
+			}
+			if build.CreatedAt.After(lastBuild.CreatedAt) {
+				lastBuild = build
+			}
+		}
+		sum += int64(lastBuild.DailyCost)
+	}
+	return sum, nil
+}
+
+func (q *FakeQuerier) GetReplicaByID(_ context.Context, id uuid.UUID) (database.Replica, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, replica := range q.replicas {
+		if replica.ID == id {
+			return replica, nil
+		}
+	}
+
+	return database.Replica{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetReplicasUpdatedAfter(_ context.Context, updatedAt time.Time) ([]database.Replica, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+	replicas := make([]database.Replica, 0)
+	for _, replica := range q.replicas {
+		if replica.UpdatedAt.After(updatedAt) && !replica.StoppedAt.Valid {
+			replicas = append(replicas, replica)
+		}
+	}
+	return replicas, nil
+}
+
+func (q *FakeQuerier) GetServiceBanner(_ context.Context) (string, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	if q.serviceBanner == nil {
+		return "", sql.ErrNoRows
+	}
+
+	return string(q.serviceBanner), nil
+}
+
+func (*FakeQuerier) GetTailnetAgents(context.Context, uuid.UUID) ([]database.TailnetAgent, error) {
+	return nil, ErrUnimplemented
+}
+
+func (*FakeQuerier) GetTailnetClientsForAgent(context.Context, uuid.UUID) ([]database.TailnetClient, error) {
+	return nil, ErrUnimplemented
+}
+
+func (q *FakeQuerier) GetTemplateAppInsights(ctx context.Context, arg database.GetTemplateAppInsightsParams) ([]database.GetTemplateAppInsightsRow, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	type appKey struct {
+		AccessMethod string
+		SlugOrPort   string
+		Slug         string
+		DisplayName  string
+		Icon         string
+	}
+	type uniqueKey struct {
+		TemplateID uuid.UUID
+		UserID     uuid.UUID
+		AgentID    uuid.UUID
+		AppKey     appKey
+	}
+
+	appUsageIntervalsByUserAgentApp := make(map[uniqueKey]map[time.Time]int64)
+	for _, s := range q.workspaceAppStats {
+		// (was.session_started_at >= ts.from_ AND was.session_started_at < ts.to_)
+		// OR (was.session_ended_at > ts.from_ AND was.session_ended_at < ts.to_)
+		// OR (was.session_started_at < ts.from_ AND was.session_ended_at >= ts.to_)
+		if !(((s.SessionStartedAt.After(arg.StartTime) || s.SessionStartedAt.Equal(arg.StartTime)) && s.SessionStartedAt.Before(arg.EndTime)) ||
+			(s.SessionEndedAt.After(arg.StartTime) && s.SessionEndedAt.Before(arg.EndTime)) ||
+			(s.SessionStartedAt.Before(arg.StartTime) && (s.SessionEndedAt.After(arg.EndTime) || s.SessionEndedAt.Equal(arg.EndTime)))) {
+			continue
+		}
+
+		w, err := q.getWorkspaceByIDNoLock(ctx, s.WorkspaceID)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(arg.TemplateIDs) > 0 && !slices.Contains(arg.TemplateIDs, w.TemplateID) {
+			continue
+		}
+
+		app, _ := q.getWorkspaceAppByAgentIDAndSlugNoLock(ctx, database.GetWorkspaceAppByAgentIDAndSlugParams{
+			AgentID: s.AgentID,
+			Slug:    s.SlugOrPort,
+		})
+
+		key := uniqueKey{
+			TemplateID: w.TemplateID,
+			UserID:     s.UserID,
+			AgentID:    s.AgentID,
+			AppKey: appKey{
+				AccessMethod: s.AccessMethod,
+				SlugOrPort:   s.SlugOrPort,
+				Slug:         app.Slug,
+				DisplayName:  app.DisplayName,
+				Icon:         app.Icon,
+			},
+		}
+		if appUsageIntervalsByUserAgentApp[key] == nil {
+			appUsageIntervalsByUserAgentApp[key] = make(map[time.Time]int64)
+		}
+
+		t := s.SessionStartedAt.Truncate(5 * time.Minute)
+		if t.Before(arg.StartTime) {
+			t = arg.StartTime
+		}
+		for t.Before(s.SessionEndedAt) && t.Before(arg.EndTime) {
+			appUsageIntervalsByUserAgentApp[key][t] = 60 // 1 minute.
+			t = t.Add(1 * time.Minute)
+		}
+	}
+
+	appUsageTemplateIDs := make(map[appKey]map[uuid.UUID]struct{})
+	appUsageUserIDs := make(map[appKey]map[uuid.UUID]struct{})
+	appUsage := make(map[appKey]int64)
+	for uniqueKey, usage := range appUsageIntervalsByUserAgentApp {
+		for _, seconds := range usage {
+			if appUsageTemplateIDs[uniqueKey.AppKey] == nil {
+				appUsageTemplateIDs[uniqueKey.AppKey] = make(map[uuid.UUID]struct{})
+			}
+			appUsageTemplateIDs[uniqueKey.AppKey][uniqueKey.TemplateID] = struct{}{}
+			if appUsageUserIDs[uniqueKey.AppKey] == nil {
+				appUsageUserIDs[uniqueKey.AppKey] = make(map[uuid.UUID]struct{})
+			}
+			appUsageUserIDs[uniqueKey.AppKey][uniqueKey.UserID] = struct{}{}
+			appUsage[uniqueKey.AppKey] += seconds
+		}
+	}
+
+	var rows []database.GetTemplateAppInsightsRow
+	for appKey, usage := range appUsage {
+		templateIDs := make([]uuid.UUID, 0, len(appUsageTemplateIDs[appKey]))
+		for templateID := range appUsageTemplateIDs[appKey] {
+			templateIDs = append(templateIDs, templateID)
+		}
+		slices.SortFunc(templateIDs, func(a, b uuid.UUID) int {
+			return slice.Ascending(a.String(), b.String())
+		})
+		activeUserIDs := make([]uuid.UUID, 0, len(appUsageUserIDs[appKey]))
+		for userID := range appUsageUserIDs[appKey] {
+			activeUserIDs = append(activeUserIDs, userID)
+		}
+		slices.SortFunc(activeUserIDs, func(a, b uuid.UUID) int {
+			return slice.Ascending(a.String(), b.String())
+		})
+
+		rows = append(rows, database.GetTemplateAppInsightsRow{
+			TemplateIDs:   templateIDs,
+			ActiveUserIDs: activeUserIDs,
+			AccessMethod:  appKey.AccessMethod,
+			SlugOrPort:    appKey.SlugOrPort,
+			DisplayName:   sql.NullString{String: appKey.DisplayName, Valid: appKey.DisplayName != ""},
+			Icon:          sql.NullString{String: appKey.Icon, Valid: appKey.Icon != ""},
+			IsApp:         appKey.Slug != "",
+			UsageSeconds:  usage,
+		})
+	}
+
+	// NOTE(mafredri): Add sorting if we decide on how to handle PostgreSQL collations.
+	// ORDER BY access_method, slug_or_port, display_name, icon, is_app
+	return rows, nil
+}
+
+func (q *FakeQuerier) GetTemplateAverageBuildTime(ctx context.Context, arg database.GetTemplateAverageBuildTimeParams) (database.GetTemplateAverageBuildTimeRow, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.GetTemplateAverageBuildTimeRow{}, err
+	}
+
+	var emptyRow database.GetTemplateAverageBuildTimeRow
+	var (
+		startTimes  []float64
+		stopTimes   []float64
+		deleteTimes []float64
+	)
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+	for _, wb := range q.workspaceBuilds {
+		version, err := q.getTemplateVersionByIDNoLock(ctx, wb.TemplateVersionID)
+		if err != nil {
+			return emptyRow, err
+		}
+		if version.TemplateID != arg.TemplateID {
+			continue
+		}
+
+		job, err := q.getProvisionerJobByIDNoLock(ctx, wb.JobID)
+		if err != nil {
+			return emptyRow, err
+		}
+		if job.CompletedAt.Valid {
+			took := job.CompletedAt.Time.Sub(job.StartedAt.Time).Seconds()
+			switch wb.Transition {
+			case database.WorkspaceTransitionStart:
+				startTimes = append(startTimes, took)
+			case database.WorkspaceTransitionStop:
+				stopTimes = append(stopTimes, took)
+			case database.WorkspaceTransitionDelete:
+				deleteTimes = append(deleteTimes, took)
+			}
+		}
+	}
+
+	tryPercentile := func(fs []float64, p float64) float64 {
+		if len(fs) == 0 {
+			return -1
+		}
+		sort.Float64s(fs)
+		return fs[int(float64(len(fs))*p/100)]
+	}
+
+	var row database.GetTemplateAverageBuildTimeRow
+	row.Delete50, row.Delete95 = tryPercentile(deleteTimes, 50), tryPercentile(deleteTimes, 95)
+	row.Stop50, row.Stop95 = tryPercentile(stopTimes, 50), tryPercentile(stopTimes, 95)
+	row.Start50, row.Start95 = tryPercentile(startTimes, 50), tryPercentile(startTimes, 95)
+	return row, nil
+}
+
+func (q *FakeQuerier) GetTemplateByID(ctx context.Context, id uuid.UUID) (database.Template, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getTemplateByIDNoLock(ctx, id)
+}
+
+func (q *FakeQuerier) GetTemplateByOrganizationAndName(_ context.Context, arg database.GetTemplateByOrganizationAndNameParams) (database.Template, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.Template{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, template := range q.templates {
+		if template.OrganizationID != arg.OrganizationID {
+			continue
+		}
+		if !strings.EqualFold(template.Name, arg.Name) {
+			continue
+		}
+		if template.Deleted != arg.Deleted {
+			continue
+		}
+		return q.templateWithUserNoLock(template), nil
+	}
+	return database.Template{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetTemplateDAUs(_ context.Context, arg database.GetTemplateDAUsParams) ([]database.GetTemplateDAUsRow, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	seens := make(map[time.Time]map[uuid.UUID]struct{})
+
+	for _, as := range q.workspaceAgentStats {
+		if as.TemplateID != arg.TemplateID {
+			continue
+		}
+		if as.ConnectionCount == 0 {
+			continue
+		}
+
+		date := as.CreatedAt.UTC().Add(time.Duration(arg.TzOffset) * time.Hour * -1).Truncate(time.Hour * 24)
+
+		dateEntry := seens[date]
+		if dateEntry == nil {
+			dateEntry = make(map[uuid.UUID]struct{})
+		}
+		dateEntry[as.UserID] = struct{}{}
+		seens[date] = dateEntry
+	}
+
+	seenKeys := maps.Keys(seens)
+	sort.Slice(seenKeys, func(i, j int) bool {
+		return seenKeys[i].Before(seenKeys[j])
+	})
+
+	var rs []database.GetTemplateDAUsRow
+	for _, key := range seenKeys {
+		ids := seens[key]
+		for id := range ids {
+			rs = append(rs, database.GetTemplateDAUsRow{
+				Date:   key,
+				UserID: id,
+			})
+		}
+	}
+
+	return rs, nil
+}
+
+func (q *FakeQuerier) GetTemplateInsights(_ context.Context, arg database.GetTemplateInsightsParams) (database.GetTemplateInsightsRow, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return database.GetTemplateInsightsRow{}, err
+	}
+
+	templateIDSet := make(map[uuid.UUID]struct{})
+	appUsageIntervalsByUser := make(map[uuid.UUID]map[time.Time]*database.GetTemplateInsightsRow)
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, s := range q.workspaceAgentStats {
+		if s.CreatedAt.Before(arg.StartTime) || s.CreatedAt.Equal(arg.EndTime) || s.CreatedAt.After(arg.EndTime) {
+			continue
+		}
+		if len(arg.TemplateIDs) > 0 && !slices.Contains(arg.TemplateIDs, s.TemplateID) {
+			continue
+		}
+		if s.ConnectionCount == 0 {
+			continue
+		}
+
+		templateIDSet[s.TemplateID] = struct{}{}
+		if appUsageIntervalsByUser[s.UserID] == nil {
+			appUsageIntervalsByUser[s.UserID] = make(map[time.Time]*database.GetTemplateInsightsRow)
+		}
+		t := s.CreatedAt.Truncate(time.Minute)
+		if _, ok := appUsageIntervalsByUser[s.UserID][t]; !ok {
+			appUsageIntervalsByUser[s.UserID][t] = &database.GetTemplateInsightsRow{}
+		}
+
+		if s.SessionCountJetBrains > 0 {
+			appUsageIntervalsByUser[s.UserID][t].UsageJetbrainsSeconds = 60
+		}
+		if s.SessionCountVSCode > 0 {
+			appUsageIntervalsByUser[s.UserID][t].UsageVscodeSeconds = 60
+		}
+		if s.SessionCountReconnectingPTY > 0 {
+			appUsageIntervalsByUser[s.UserID][t].UsageReconnectingPtySeconds = 60
+		}
+		if s.SessionCountSSH > 0 {
+			appUsageIntervalsByUser[s.UserID][t].UsageSshSeconds = 60
+		}
+	}
+
+	templateIDs := make([]uuid.UUID, 0, len(templateIDSet))
+	for templateID := range templateIDSet {
+		templateIDs = append(templateIDs, templateID)
+	}
+	slices.SortFunc(templateIDs, func(a, b uuid.UUID) int {
+		return slice.Ascending(a.String(), b.String())
+	})
+	activeUserIDs := make([]uuid.UUID, 0, len(appUsageIntervalsByUser))
+	for userID := range appUsageIntervalsByUser {
+		activeUserIDs = append(activeUserIDs, userID)
+	}
+
+	result := database.GetTemplateInsightsRow{
+		TemplateIDs:   templateIDs,
+		ActiveUserIDs: activeUserIDs,
+	}
+	for _, intervals := range appUsageIntervalsByUser {
+		for _, interval := range intervals {
+			result.UsageJetbrainsSeconds += interval.UsageJetbrainsSeconds
+			result.UsageVscodeSeconds += interval.UsageVscodeSeconds
+			result.UsageReconnectingPtySeconds += interval.UsageReconnectingPtySeconds
+			result.UsageSshSeconds += interval.UsageSshSeconds
+		}
+	}
+	return result, nil
+}
+
+func (q *FakeQuerier) GetTemplateInsightsByInterval(ctx context.Context, arg database.GetTemplateInsightsByIntervalParams) ([]database.GetTemplateInsightsByIntervalRow, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	type statByInterval struct {
+		startTime, endTime time.Time
+		userSet            map[uuid.UUID]struct{}
+		templateIDSet      map[uuid.UUID]struct{}
+	}
+
+	statsByInterval := []statByInterval{{arg.StartTime, arg.StartTime.AddDate(0, 0, int(arg.IntervalDays)), make(map[uuid.UUID]struct{}), make(map[uuid.UUID]struct{})}}
+	for statsByInterval[len(statsByInterval)-1].endTime.Before(arg.EndTime) {
+		statsByInterval = append(statsByInterval, statByInterval{statsByInterval[len(statsByInterval)-1].endTime, statsByInterval[len(statsByInterval)-1].endTime.AddDate(0, 0, int(arg.IntervalDays)), make(map[uuid.UUID]struct{}), make(map[uuid.UUID]struct{})})
+	}
+	if statsByInterval[len(statsByInterval)-1].endTime.After(arg.EndTime) {
+		statsByInterval[len(statsByInterval)-1].endTime = arg.EndTime
+	}
+
+	for _, s := range q.workspaceAgentStats {
+		if s.CreatedAt.Before(arg.StartTime) || s.CreatedAt.Equal(arg.EndTime) || s.CreatedAt.After(arg.EndTime) {
+			continue
+		}
+		if len(arg.TemplateIDs) > 0 && !slices.Contains(arg.TemplateIDs, s.TemplateID) {
+			continue
+		}
+		if s.ConnectionCount == 0 {
+			continue
+		}
+
+		for _, ds := range statsByInterval {
+			if s.CreatedAt.Before(ds.startTime) || s.CreatedAt.Equal(ds.endTime) || s.CreatedAt.After(ds.endTime) {
+				continue
+			}
+			ds.userSet[s.UserID] = struct{}{}
+			ds.templateIDSet[s.TemplateID] = struct{}{}
+		}
+	}
+
+	for _, s := range q.workspaceAppStats {
+		w, err := q.getWorkspaceByIDNoLock(ctx, s.WorkspaceID)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(arg.TemplateIDs) > 0 && !slices.Contains(arg.TemplateIDs, w.TemplateID) {
+			continue
+		}
+
+		for _, ds := range statsByInterval {
+			// (was.session_started_at >= ts.from_ AND was.session_started_at < ts.to_)
+			// OR (was.session_ended_at > ts.from_ AND was.session_ended_at < ts.to_)
+			// OR (was.session_started_at < ts.from_ AND was.session_ended_at >= ts.to_)
+			if !(((s.SessionStartedAt.After(ds.startTime) || s.SessionStartedAt.Equal(ds.startTime)) && s.SessionStartedAt.Before(ds.endTime)) ||
+				(s.SessionEndedAt.After(ds.startTime) && s.SessionEndedAt.Before(ds.endTime)) ||
+				(s.SessionStartedAt.Before(ds.startTime) && (s.SessionEndedAt.After(ds.endTime) || s.SessionEndedAt.Equal(ds.endTime)))) {
+				continue
+			}
+
+			ds.userSet[s.UserID] = struct{}{}
+			ds.templateIDSet[w.TemplateID] = struct{}{}
+		}
+	}
+
+	var result []database.GetTemplateInsightsByIntervalRow
+	for _, ds := range statsByInterval {
+		templateIDs := make([]uuid.UUID, 0, len(ds.templateIDSet))
+		for templateID := range ds.templateIDSet {
+			templateIDs = append(templateIDs, templateID)
+		}
+		slices.SortFunc(templateIDs, func(a, b uuid.UUID) int {
+			return slice.Ascending(a.String(), b.String())
+		})
+		result = append(result, database.GetTemplateInsightsByIntervalRow{
+			StartTime:   ds.startTime,
+			EndTime:     ds.endTime,
+			TemplateIDs: templateIDs,
+			ActiveUsers: int64(len(ds.userSet)),
+		})
+	}
+	return result, nil
+}
+
+func (q *FakeQuerier) GetTemplateInsightsByTemplate(_ context.Context, arg database.GetTemplateInsightsByTemplateParams) ([]database.GetTemplateInsightsByTemplateRow, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	// map time.Time x TemplateID x UserID x <usage>
+	appUsageByTemplateAndUser := map[time.Time]map[uuid.UUID]map[uuid.UUID]database.GetTemplateInsightsByTemplateRow{}
+
+	// Review agent stats in terms of usage
+	templateIDSet := make(map[uuid.UUID]struct{})
+
+	for _, s := range q.workspaceAgentStats {
+		if s.CreatedAt.Before(arg.StartTime) || s.CreatedAt.Equal(arg.EndTime) || s.CreatedAt.After(arg.EndTime) {
+			continue
+		}
+		if s.ConnectionCount == 0 {
+			continue
+		}
+
+		t := s.CreatedAt.Truncate(time.Minute)
+		templateIDSet[s.TemplateID] = struct{}{}
+
+		if _, ok := appUsageByTemplateAndUser[t]; !ok {
+			appUsageByTemplateAndUser[t] = make(map[uuid.UUID]map[uuid.UUID]database.GetTemplateInsightsByTemplateRow)
+		}
+
+		if _, ok := appUsageByTemplateAndUser[t][s.TemplateID]; !ok {
+			appUsageByTemplateAndUser[t][s.TemplateID] = make(map[uuid.UUID]database.GetTemplateInsightsByTemplateRow)
+		}
+
+		if _, ok := appUsageByTemplateAndUser[t][s.TemplateID][s.UserID]; !ok {
+			appUsageByTemplateAndUser[t][s.TemplateID][s.UserID] = database.GetTemplateInsightsByTemplateRow{}
+		}
+
+		u := appUsageByTemplateAndUser[t][s.TemplateID][s.UserID]
+		if s.SessionCountJetBrains > 0 {
+			u.UsageJetbrainsSeconds = 60
+		}
+		if s.SessionCountVSCode > 0 {
+			u.UsageVscodeSeconds = 60
+		}
+		if s.SessionCountReconnectingPTY > 0 {
+			u.UsageReconnectingPtySeconds = 60
+		}
+		if s.SessionCountSSH > 0 {
+			u.UsageSshSeconds = 60
+		}
+		appUsageByTemplateAndUser[t][s.TemplateID][s.UserID] = u
+	}
+
+	// Sort used templates
+	templateIDs := make([]uuid.UUID, 0, len(templateIDSet))
+	for templateID := range templateIDSet {
+		templateIDs = append(templateIDs, templateID)
+	}
+	slices.SortFunc(templateIDs, func(a, b uuid.UUID) int {
+		return slice.Ascending(a.String(), b.String())
+	})
+
+	// Build result
+	var result []database.GetTemplateInsightsByTemplateRow
+	for _, templateID := range templateIDs {
+		r := database.GetTemplateInsightsByTemplateRow{
+			TemplateID: templateID,
+		}
+
+		uniqueUsers := map[uuid.UUID]struct{}{}
+
+		for _, mTemplateUserUsage := range appUsageByTemplateAndUser {
+			mUserUsage, ok := mTemplateUserUsage[templateID]
+			if !ok {
+				continue // template was not used in this time window
+			}
+
+			for userID, usage := range mUserUsage {
+				uniqueUsers[userID] = struct{}{}
+
+				r.UsageJetbrainsSeconds += usage.UsageJetbrainsSeconds
+				r.UsageVscodeSeconds += usage.UsageVscodeSeconds
+				r.UsageReconnectingPtySeconds += usage.UsageReconnectingPtySeconds
+				r.UsageSshSeconds += usage.UsageSshSeconds
+			}
+		}
+
+		r.ActiveUsers = int64(len(uniqueUsers))
+
+		result = append(result, r)
+	}
+	return result, nil
+}
+
+func (q *FakeQuerier) GetTemplateParameterInsights(ctx context.Context, arg database.GetTemplateParameterInsightsParams) ([]database.GetTemplateParameterInsightsRow, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	// WITH latest_workspace_builds ...
+	latestWorkspaceBuilds := make(map[uuid.UUID]database.WorkspaceBuildTable)
+	for _, wb := range q.workspaceBuilds {
+		if wb.CreatedAt.Before(arg.StartTime) || wb.CreatedAt.Equal(arg.EndTime) || wb.CreatedAt.After(arg.EndTime) {
+			continue
+		}
+		if latestWorkspaceBuilds[wb.WorkspaceID].BuildNumber < wb.BuildNumber {
+			latestWorkspaceBuilds[wb.WorkspaceID] = wb
+		}
+	}
+	if len(arg.TemplateIDs) > 0 {
+		for wsID := range latestWorkspaceBuilds {
+			ws, err := q.getWorkspaceByIDNoLock(ctx, wsID)
+			if err != nil {
+				return nil, err
+			}
+			if slices.Contains(arg.TemplateIDs, ws.TemplateID) {
+				delete(latestWorkspaceBuilds, wsID)
+			}
+		}
+	}
+	// WITH unique_template_params ...
+	num := int64(0)
+	uniqueTemplateParams := make(map[string]*database.GetTemplateParameterInsightsRow)
+	uniqueTemplateParamWorkspaceBuildIDs := make(map[string][]uuid.UUID)
+	for _, wb := range latestWorkspaceBuilds {
+		tv, err := q.getTemplateVersionByIDNoLock(ctx, wb.TemplateVersionID)
+		if err != nil {
+			return nil, err
+		}
+		for _, tvp := range q.templateVersionParameters {
+			if tvp.TemplateVersionID != tv.ID {
+				continue
+			}
+			// GROUP BY tvp.name, tvp.type, tvp.display_name, tvp.description, tvp.options
+			key := fmt.Sprintf("%s:%s:%s:%s:%s", tvp.Name, tvp.Type, tvp.DisplayName, tvp.Description, tvp.Options)
+			if _, ok := uniqueTemplateParams[key]; !ok {
+				num++
+				uniqueTemplateParams[key] = &database.GetTemplateParameterInsightsRow{
+					Num:         num,
+					Name:        tvp.Name,
+					Type:        tvp.Type,
+					DisplayName: tvp.DisplayName,
+					Description: tvp.Description,
+					Options:     tvp.Options,
+				}
+			}
+			uniqueTemplateParams[key].TemplateIDs = append(uniqueTemplateParams[key].TemplateIDs, tv.TemplateID.UUID)
+			uniqueTemplateParamWorkspaceBuildIDs[key] = append(uniqueTemplateParamWorkspaceBuildIDs[key], wb.ID)
+		}
+	}
+	// SELECT ...
+	counts := make(map[string]map[string]int64)
+	for key, utp := range uniqueTemplateParams {
+		for _, wbp := range q.workspaceBuildParameters {
+			if !slices.Contains(uniqueTemplateParamWorkspaceBuildIDs[key], wbp.WorkspaceBuildID) {
+				continue
+			}
+			if wbp.Name != utp.Name {
+				continue
+			}
+			if counts[key] == nil {
+				counts[key] = make(map[string]int64)
+			}
+			counts[key][wbp.Value]++
+		}
+	}
+
+	var rows []database.GetTemplateParameterInsightsRow
+	for key, utp := range uniqueTemplateParams {
+		for value, count := range counts[key] {
+			rows = append(rows, database.GetTemplateParameterInsightsRow{
+				Num:         utp.Num,
+				TemplateIDs: uniqueSortedUUIDs(utp.TemplateIDs),
+				Name:        utp.Name,
+				DisplayName: utp.DisplayName,
+				Type:        utp.Type,
+				Description: utp.Description,
+				Options:     utp.Options,
+				Value:       value,
+				Count:       count,
+			})
+		}
+	}
+
+	// NOTE(mafredri): Add sorting if we decide on how to handle PostgreSQL collations.
+	// ORDER BY utp.name, utp.type, utp.display_name, utp.description, utp.options, wbp.value
+	return rows, nil
+}
+
+func (q *FakeQuerier) GetTemplateVersionByID(ctx context.Context, templateVersionID uuid.UUID) (database.TemplateVersion, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getTemplateVersionByIDNoLock(ctx, templateVersionID)
+}
+
+func (q *FakeQuerier) GetTemplateVersionByJobID(_ context.Context, jobID uuid.UUID) (database.TemplateVersion, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, templateVersion := range q.templateVersions {
+		if templateVersion.JobID != jobID {
+			continue
+		}
+		return q.templateVersionWithUserNoLock(templateVersion), nil
+	}
+	return database.TemplateVersion{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetTemplateVersionByTemplateIDAndName(_ context.Context, arg database.GetTemplateVersionByTemplateIDAndNameParams) (database.TemplateVersion, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.TemplateVersion{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, templateVersion := range q.templateVersions {
+		if templateVersion.TemplateID != arg.TemplateID {
+			continue
+		}
+		if !strings.EqualFold(templateVersion.Name, arg.Name) {
+			continue
+		}
+		return q.templateVersionWithUserNoLock(templateVersion), nil
+	}
+	return database.TemplateVersion{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetTemplateVersionParameters(_ context.Context, templateVersionID uuid.UUID) ([]database.TemplateVersionParameter, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	parameters := make([]database.TemplateVersionParameter, 0)
+	for _, param := range q.templateVersionParameters {
+		if param.TemplateVersionID != templateVersionID {
+			continue
+		}
+		parameters = append(parameters, param)
+	}
+	sort.Slice(parameters, func(i, j int) bool {
+		if parameters[i].DisplayOrder != parameters[j].DisplayOrder {
+			return parameters[i].DisplayOrder < parameters[j].DisplayOrder
+		}
+		return strings.ToLower(parameters[i].Name) < strings.ToLower(parameters[j].Name)
+	})
+	return parameters, nil
+}
+
+func (q *FakeQuerier) GetTemplateVersionVariables(_ context.Context, templateVersionID uuid.UUID) ([]database.TemplateVersionVariable, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	variables := make([]database.TemplateVersionVariable, 0)
+	for _, variable := range q.templateVersionVariables {
+		if variable.TemplateVersionID != templateVersionID {
+			continue
+		}
+		variables = append(variables, variable)
+	}
+	return variables, nil
+}
+
+func (q *FakeQuerier) GetTemplateVersionsByIDs(_ context.Context, ids []uuid.UUID) ([]database.TemplateVersion, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	versions := make([]database.TemplateVersion, 0)
+	for _, version := range q.templateVersions {
+		for _, id := range ids {
+			if id == version.ID {
+				versions = append(versions, q.templateVersionWithUserNoLock(version))
+				break
+			}
+		}
+	}
+	if len(versions) == 0 {
+		return nil, sql.ErrNoRows
+	}
+
+	return versions, nil
+}
+
+func (q *FakeQuerier) GetTemplateVersionsByTemplateID(_ context.Context, arg database.GetTemplateVersionsByTemplateIDParams) (version []database.TemplateVersion, err error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return version, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, templateVersion := range q.templateVersions {
+		if templateVersion.TemplateID.UUID != arg.TemplateID {
+			continue
+		}
+		if arg.Archived.Valid && arg.Archived.Bool != templateVersion.Archived {
+			continue
+		}
+		version = append(version, q.templateVersionWithUserNoLock(templateVersion))
+	}
+
+	// Database orders by created_at
+	slices.SortFunc(version, func(a, b database.TemplateVersion) int {
+		if a.CreatedAt.Equal(b.CreatedAt) {
+			// Technically the postgres database also orders by uuid. So match
+			// that behavior
+			return slice.Ascending(a.ID.String(), b.ID.String())
+		}
+		if a.CreatedAt.Before(b.CreatedAt) {
+			return -1
+		}
+		return 1
+	})
+
+	if arg.AfterID != uuid.Nil {
+		found := false
+		for i, v := range version {
+			if v.ID == arg.AfterID {
+				// We want to return all users after index i.
+				version = version[i+1:]
+				found = true
+				break
+			}
+		}
+
+		// If no users after the time, then we return an empty list.
+		if !found {
+			return nil, sql.ErrNoRows
+		}
+	}
+
+	if arg.OffsetOpt > 0 {
+		if int(arg.OffsetOpt) > len(version)-1 {
+			return nil, sql.ErrNoRows
+		}
+		version = version[arg.OffsetOpt:]
+	}
+
+	if arg.LimitOpt > 0 {
+		if int(arg.LimitOpt) > len(version) {
+			arg.LimitOpt = int32(len(version))
+		}
+		version = version[:arg.LimitOpt]
+	}
+
+	if len(version) == 0 {
+		return nil, sql.ErrNoRows
+	}
+
+	return version, nil
+}
+
+func (q *FakeQuerier) GetTemplateVersionsCreatedAfter(_ context.Context, after time.Time) ([]database.TemplateVersion, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	versions := make([]database.TemplateVersion, 0)
+	for _, version := range q.templateVersions {
+		if version.CreatedAt.After(after) {
+			versions = append(versions, q.templateVersionWithUserNoLock(version))
+		}
+	}
+	return versions, nil
+}
+
+func (q *FakeQuerier) GetTemplates(_ context.Context) ([]database.Template, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	templates := slices.Clone(q.templates)
+	slices.SortFunc(templates, func(a, b database.TemplateTable) int {
+		if a.Name != b.Name {
+			return slice.Ascending(a.Name, b.Name)
+		}
+		return slice.Ascending(a.ID.String(), b.ID.String())
+	})
+
+	return q.templatesWithUserNoLock(templates), nil
+}
+
+func (q *FakeQuerier) GetTemplatesWithFilter(ctx context.Context, arg database.GetTemplatesWithFilterParams) ([]database.Template, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return nil, err
+	}
+
+	return q.GetAuthorizedTemplates(ctx, arg, nil)
+}
+
+func (q *FakeQuerier) GetUnexpiredLicenses(_ context.Context) ([]database.License, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	now := time.Now()
+	var results []database.License
+	for _, l := range q.licenses {
+		if l.Exp.After(now) {
+			results = append(results, l)
+		}
+	}
+	sort.Slice(results, func(i, j int) bool { return results[i].ID < results[j].ID })
+	return results, nil
+}
+
+func (q *FakeQuerier) GetUserActivityInsights(ctx context.Context, arg database.GetUserActivityInsightsParams) ([]database.GetUserActivityInsightsRow, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	type uniqueKey struct {
+		TemplateID uuid.UUID
+		UserID     uuid.UUID
+	}
+
+	combinedStats := make(map[uniqueKey]map[time.Time]int64)
+
+	// Get application stats
+	for _, s := range q.workspaceAppStats {
+		if !(((s.SessionStartedAt.After(arg.StartTime) || s.SessionStartedAt.Equal(arg.StartTime)) && s.SessionStartedAt.Before(arg.EndTime)) ||
+			(s.SessionEndedAt.After(arg.StartTime) && s.SessionEndedAt.Before(arg.EndTime)) ||
+			(s.SessionStartedAt.Before(arg.StartTime) && (s.SessionEndedAt.After(arg.EndTime) || s.SessionEndedAt.Equal(arg.EndTime)))) {
+			continue
+		}
+
+		w, err := q.getWorkspaceByIDNoLock(ctx, s.WorkspaceID)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(arg.TemplateIDs) > 0 && !slices.Contains(arg.TemplateIDs, w.TemplateID) {
+			continue
+		}
+
+		key := uniqueKey{
+			TemplateID: w.TemplateID,
+			UserID:     s.UserID,
+		}
+		if combinedStats[key] == nil {
+			combinedStats[key] = make(map[time.Time]int64)
+		}
+
+		t := s.SessionStartedAt.Truncate(time.Minute)
+		if t.Before(arg.StartTime) {
+			t = arg.StartTime
+		}
+		for t.Before(s.SessionEndedAt) && t.Before(arg.EndTime) {
+			combinedStats[key][t] = 60
+			t = t.Add(1 * time.Minute)
+		}
+	}
+
+	// Get session stats
+	for _, s := range q.workspaceAgentStats {
+		if s.CreatedAt.Before(arg.StartTime) || s.CreatedAt.Equal(arg.EndTime) || s.CreatedAt.After(arg.EndTime) {
+			continue
+		}
+		if len(arg.TemplateIDs) > 0 && !slices.Contains(arg.TemplateIDs, s.TemplateID) {
+			continue
+		}
+		if s.ConnectionCount == 0 {
+			continue
+		}
+
+		key := uniqueKey{
+			TemplateID: s.TemplateID,
+			UserID:     s.UserID,
+		}
+
+		if combinedStats[key] == nil {
+			combinedStats[key] = make(map[time.Time]int64)
+		}
+
+		if s.SessionCountJetBrains > 0 || s.SessionCountVSCode > 0 || s.SessionCountReconnectingPTY > 0 || s.SessionCountSSH > 0 {
+			t := s.CreatedAt.Truncate(time.Minute)
+			combinedStats[key][t] = 60
+		}
+	}
+
+	// Use temporary maps for aggregation purposes
+	mUserIDTemplateIDs := map[uuid.UUID]map[uuid.UUID]struct{}{}
+	mUserIDUsageSeconds := map[uuid.UUID]int64{}
+
+	for key, times := range combinedStats {
+		if mUserIDTemplateIDs[key.UserID] == nil {
+			mUserIDTemplateIDs[key.UserID] = make(map[uuid.UUID]struct{})
+			mUserIDUsageSeconds[key.UserID] = 0
+		}
+
+		if _, ok := mUserIDTemplateIDs[key.UserID][key.TemplateID]; !ok {
+			mUserIDTemplateIDs[key.UserID][key.TemplateID] = struct{}{}
+		}
+
+		for _, t := range times {
+			mUserIDUsageSeconds[key.UserID] += t
+		}
+	}
+
+	userIDs := make([]uuid.UUID, 0, len(mUserIDUsageSeconds))
+	for userID := range mUserIDUsageSeconds {
+		userIDs = append(userIDs, userID)
+	}
+	sort.Slice(userIDs, func(i, j int) bool {
+		return userIDs[i].String() < userIDs[j].String()
+	})
+
+	// Finally, select stats
+	var rows []database.GetUserActivityInsightsRow
+
+	for _, userID := range userIDs {
+		user, err := q.getUserByIDNoLock(userID)
+		if err != nil {
+			return nil, err
+		}
+
+		tids := mUserIDTemplateIDs[userID]
+		templateIDs := make([]uuid.UUID, 0, len(tids))
+		for key := range tids {
+			templateIDs = append(templateIDs, key)
+		}
+		sort.Slice(templateIDs, func(i, j int) bool {
+			return templateIDs[i].String() < templateIDs[j].String()
+		})
+
+		row := database.GetUserActivityInsightsRow{
+			UserID:       user.ID,
+			Username:     user.Username,
+			AvatarURL:    user.AvatarURL,
+			TemplateIDs:  templateIDs,
+			UsageSeconds: mUserIDUsageSeconds[userID],
+		}
+
+		rows = append(rows, row)
+	}
+	return rows, nil
+}
+
+func (q *FakeQuerier) GetUserByEmailOrUsername(_ context.Context, arg database.GetUserByEmailOrUsernameParams) (database.User, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.User{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, user := range q.users {
+		if !user.Deleted && (strings.EqualFold(user.Email, arg.Email) || strings.EqualFold(user.Username, arg.Username)) {
+			return user, nil
+		}
+	}
+	return database.User{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetUserByID(_ context.Context, id uuid.UUID) (database.User, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getUserByIDNoLock(id)
+}
+
+func (q *FakeQuerier) GetUserCount(_ context.Context) (int64, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	existing := int64(0)
+	for _, u := range q.users {
+		if !u.Deleted {
+			existing++
+		}
+	}
+	return existing, nil
+}
+
+func (q *FakeQuerier) GetUserLatencyInsights(_ context.Context, arg database.GetUserLatencyInsightsParams) ([]database.GetUserLatencyInsightsRow, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	latenciesByUserID := make(map[uuid.UUID][]float64)
+	seenTemplatesByUserID := make(map[uuid.UUID]map[uuid.UUID]struct{})
+	for _, s := range q.workspaceAgentStats {
+		if len(arg.TemplateIDs) > 0 && !slices.Contains(arg.TemplateIDs, s.TemplateID) {
+			continue
+		}
+		if !arg.StartTime.Equal(s.CreatedAt) && (s.CreatedAt.Before(arg.StartTime) || s.CreatedAt.After(arg.EndTime)) {
+			continue
+		}
+		if s.ConnectionCount == 0 {
+			continue
+		}
+		if s.ConnectionMedianLatencyMS <= 0 {
+			continue
+		}
+
+		latenciesByUserID[s.UserID] = append(latenciesByUserID[s.UserID], s.ConnectionMedianLatencyMS)
+		if seenTemplatesByUserID[s.UserID] == nil {
+			seenTemplatesByUserID[s.UserID] = make(map[uuid.UUID]struct{})
+		}
+		seenTemplatesByUserID[s.UserID][s.TemplateID] = struct{}{}
+	}
+
+	tryPercentile := func(fs []float64, p float64) float64 {
+		if len(fs) == 0 {
+			return -1
+		}
+		sort.Float64s(fs)
+		return fs[int(float64(len(fs))*p/100)]
+	}
+
+	var rows []database.GetUserLatencyInsightsRow
+	for userID, latencies := range latenciesByUserID {
+		sort.Float64s(latencies)
+		templateIDSet := seenTemplatesByUserID[userID]
+		templateIDs := make([]uuid.UUID, 0, len(templateIDSet))
+		for templateID := range templateIDSet {
+			templateIDs = append(templateIDs, templateID)
+		}
+		slices.SortFunc(templateIDs, func(a, b uuid.UUID) int {
+			return slice.Ascending(a.String(), b.String())
+		})
+		user, err := q.getUserByIDNoLock(userID)
+		if err != nil {
+			return nil, err
+		}
+		row := database.GetUserLatencyInsightsRow{
+			UserID:                       userID,
+			Username:                     user.Username,
+			AvatarURL:                    user.AvatarURL,
+			TemplateIDs:                  templateIDs,
+			WorkspaceConnectionLatency50: tryPercentile(latencies, 50),
+			WorkspaceConnectionLatency95: tryPercentile(latencies, 95),
+		}
+		rows = append(rows, row)
+	}
+	slices.SortFunc(rows, func(a, b database.GetUserLatencyInsightsRow) int {
+		return slice.Ascending(a.UserID.String(), b.UserID.String())
+	})
+
+	return rows, nil
+}
+
+func (q *FakeQuerier) GetUserLinkByLinkedID(_ context.Context, id string) (database.UserLink, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, link := range q.userLinks {
+		if link.LinkedID == id {
+			return link, nil
+		}
+	}
+	return database.UserLink{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetUserLinkByUserIDLoginType(_ context.Context, params database.GetUserLinkByUserIDLoginTypeParams) (database.UserLink, error) {
+	if err := validateDatabaseType(params); err != nil {
+		return database.UserLink{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, link := range q.userLinks {
+		if link.UserID == params.UserID && link.LoginType == params.LoginType {
+			return link, nil
+		}
+	}
+	return database.UserLink{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetUserLinksByUserID(_ context.Context, userID uuid.UUID) ([]database.UserLink, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+	uls := make([]database.UserLink, 0)
+	for _, ul := range q.userLinks {
+		if ul.UserID == userID {
+			uls = append(uls, ul)
+		}
+	}
+	return uls, nil
+}
+
+func (q *FakeQuerier) GetUsers(_ context.Context, params database.GetUsersParams) ([]database.GetUsersRow, error) {
+	if err := validateDatabaseType(params); err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	// Avoid side-effect of sorting.
+	users := make([]database.User, len(q.users))
+	copy(users, q.users)
+
+	// Database orders by username
+	slices.SortFunc(users, func(a, b database.User) int {
+		return slice.Ascending(strings.ToLower(a.Username), strings.ToLower(b.Username))
+	})
+
+	// Filter out deleted since they should never be returned..
+	tmp := make([]database.User, 0, len(users))
+	for _, user := range users {
+		if !user.Deleted {
+			tmp = append(tmp, user)
+		}
+	}
+	users = tmp
+
+	if params.AfterID != uuid.Nil {
+		found := false
+		for i, v := range users {
+			if v.ID == params.AfterID {
+				// We want to return all users after index i.
+				users = users[i+1:]
+				found = true
+				break
+			}
+		}
+
+		// If no users after the time, then we return an empty list.
+		if !found {
+			return []database.GetUsersRow{}, nil
+		}
+	}
+
+	if params.Search != "" {
+		tmp := make([]database.User, 0, len(users))
+		for i, user := range users {
+			if strings.Contains(strings.ToLower(user.Email), strings.ToLower(params.Search)) {
+				tmp = append(tmp, users[i])
+			} else if strings.Contains(strings.ToLower(user.Username), strings.ToLower(params.Search)) {
+				tmp = append(tmp, users[i])
+			}
+		}
+		users = tmp
+	}
+
+	if len(params.Status) > 0 {
+		usersFilteredByStatus := make([]database.User, 0, len(users))
+		for i, user := range users {
+			if slice.ContainsCompare(params.Status, user.Status, func(a, b database.UserStatus) bool {
+				return strings.EqualFold(string(a), string(b))
+			}) {
+				usersFilteredByStatus = append(usersFilteredByStatus, users[i])
+			}
+		}
+		users = usersFilteredByStatus
+	}
+
+	if len(params.RbacRole) > 0 && !slice.Contains(params.RbacRole, rbac.RoleMember()) {
+		usersFilteredByRole := make([]database.User, 0, len(users))
+		for i, user := range users {
+			if slice.OverlapCompare(params.RbacRole, user.RBACRoles, strings.EqualFold) {
+				usersFilteredByRole = append(usersFilteredByRole, users[i])
+			}
+		}
+		users = usersFilteredByRole
+	}
+
+	if !params.LastSeenBefore.IsZero() {
+		usersFilteredByLastSeen := make([]database.User, 0, len(users))
+		for i, user := range users {
+			if user.LastSeenAt.Before(params.LastSeenBefore) {
+				usersFilteredByLastSeen = append(usersFilteredByLastSeen, users[i])
+			}
+		}
+		users = usersFilteredByLastSeen
+	}
+
+	if !params.LastSeenAfter.IsZero() {
+		usersFilteredByLastSeen := make([]database.User, 0, len(users))
+		for i, user := range users {
+			if user.LastSeenAt.After(params.LastSeenAfter) {
+				usersFilteredByLastSeen = append(usersFilteredByLastSeen, users[i])
+			}
+		}
+		users = usersFilteredByLastSeen
+	}
+
+	beforePageCount := len(users)
+
+	if params.OffsetOpt > 0 {
+		if int(params.OffsetOpt) > len(users)-1 {
+			return []database.GetUsersRow{}, nil
+		}
+		users = users[params.OffsetOpt:]
+	}
+
+	if params.LimitOpt > 0 {
+		if int(params.LimitOpt) > len(users) {
+			params.LimitOpt = int32(len(users))
+		}
+		users = users[:params.LimitOpt]
+	}
+
+	return convertUsers(users, int64(beforePageCount)), nil
+}
+
+func (q *FakeQuerier) GetUsersByIDs(_ context.Context, ids []uuid.UUID) ([]database.User, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	users := make([]database.User, 0)
+	for _, user := range q.users {
+		for _, id := range ids {
+			if user.ID != id {
+				continue
+			}
+			users = append(users, user)
+		}
+	}
+	return users, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentAndOwnerByAuthToken(_ context.Context, authToken uuid.UUID) (database.GetWorkspaceAgentAndOwnerByAuthTokenRow, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	// map of build number -> row
+	rows := make(map[int32]database.GetWorkspaceAgentAndOwnerByAuthTokenRow)
+
+	// We want to return the latest build number
+	var latestBuildNumber int32
+
+	for _, agt := range q.workspaceAgents {
+		if agt.AuthToken != authToken {
+			continue
+		}
+		// get the related workspace and user
+		for _, res := range q.workspaceResources {
+			if agt.ResourceID != res.ID {
+				continue
+			}
+			for _, build := range q.workspaceBuilds {
+				if build.JobID != res.JobID {
+					continue
+				}
+				for _, ws := range q.workspaces {
+					if build.WorkspaceID != ws.ID {
+						continue
+					}
+					var row database.GetWorkspaceAgentAndOwnerByAuthTokenRow
+					row.WorkspaceID = ws.ID
+					usr, err := q.getUserByIDNoLock(ws.OwnerID)
+					if err != nil {
+						return database.GetWorkspaceAgentAndOwnerByAuthTokenRow{}, sql.ErrNoRows
+					}
+					row.OwnerID = usr.ID
+					row.OwnerRoles = append(usr.RBACRoles, "member")
+					// We also need to get org roles for the user
+					row.OwnerName = usr.Username
+					row.WorkspaceAgent = agt
+					for _, mem := range q.organizationMembers {
+						if mem.UserID == usr.ID {
+							row.OwnerRoles = append(row.OwnerRoles, fmt.Sprintf("organization-member:%s", mem.OrganizationID.String()))
+						}
+					}
+					// And group memberships
+					for _, groupMem := range q.groupMembers {
+						if groupMem.UserID == usr.ID {
+							row.OwnerGroups = append(row.OwnerGroups, groupMem.GroupID.String())
+						}
+					}
+
+					// Keep track of the latest build number
+					rows[build.BuildNumber] = row
+					if build.BuildNumber > latestBuildNumber {
+						latestBuildNumber = build.BuildNumber
+					}
+				}
+			}
+		}
+	}
+
+	if len(rows) == 0 {
+		return database.GetWorkspaceAgentAndOwnerByAuthTokenRow{}, sql.ErrNoRows
+	}
+
+	// Return the row related to the latest build
+	return rows[latestBuildNumber], nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentByID(ctx context.Context, id uuid.UUID) (database.WorkspaceAgent, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getWorkspaceAgentByIDNoLock(ctx, id)
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentByInstanceID(_ context.Context, instanceID string) (database.WorkspaceAgent, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	// The schema sorts this by created at, so we iterate the array backwards.
+	for i := len(q.workspaceAgents) - 1; i >= 0; i-- {
+		agent := q.workspaceAgents[i]
+		if agent.AuthInstanceID.Valid && agent.AuthInstanceID.String == instanceID {
+			return agent, nil
+		}
+	}
+	return database.WorkspaceAgent{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentLifecycleStateByID(ctx context.Context, id uuid.UUID) (database.GetWorkspaceAgentLifecycleStateByIDRow, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	agent, err := q.getWorkspaceAgentByIDNoLock(ctx, id)
+	if err != nil {
+		return database.GetWorkspaceAgentLifecycleStateByIDRow{}, err
+	}
+	return database.GetWorkspaceAgentLifecycleStateByIDRow{
+		LifecycleState: agent.LifecycleState,
+		StartedAt:      agent.StartedAt,
+		ReadyAt:        agent.ReadyAt,
+	}, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentLogSourcesByAgentIDs(_ context.Context, ids []uuid.UUID) ([]database.WorkspaceAgentLogSource, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	logSources := make([]database.WorkspaceAgentLogSource, 0)
+	for _, logSource := range q.workspaceAgentLogSources {
+		for _, id := range ids {
+			if logSource.WorkspaceAgentID == id {
+				logSources = append(logSources, logSource)
+				break
+			}
+		}
+	}
+	return logSources, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentLogsAfter(_ context.Context, arg database.GetWorkspaceAgentLogsAfterParams) ([]database.WorkspaceAgentLog, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	logs := []database.WorkspaceAgentLog{}
+	for _, log := range q.workspaceAgentLogs {
+		if log.AgentID != arg.AgentID {
+			continue
+		}
+		if arg.CreatedAfter != 0 && log.ID <= arg.CreatedAfter {
+			continue
+		}
+		logs = append(logs, log)
+	}
+	return logs, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentMetadata(_ context.Context, arg database.GetWorkspaceAgentMetadataParams) ([]database.WorkspaceAgentMetadatum, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	metadata := make([]database.WorkspaceAgentMetadatum, 0)
+	for _, m := range q.workspaceAgentMetadata {
+		if m.WorkspaceAgentID == arg.WorkspaceAgentID {
+			if len(arg.Keys) > 0 && !slices.Contains(arg.Keys, m.Key) {
+				continue
+			}
+			metadata = append(metadata, m)
+		}
+	}
+	return metadata, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentScriptsByAgentIDs(_ context.Context, ids []uuid.UUID) ([]database.WorkspaceAgentScript, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	scripts := make([]database.WorkspaceAgentScript, 0)
+	for _, script := range q.workspaceAgentScripts {
+		for _, id := range ids {
+			if script.WorkspaceAgentID == id {
+				scripts = append(scripts, script)
+				break
+			}
+		}
+	}
+	return scripts, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentStats(_ context.Context, createdAfter time.Time) ([]database.GetWorkspaceAgentStatsRow, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	agentStatsCreatedAfter := make([]database.WorkspaceAgentStat, 0)
+	for _, agentStat := range q.workspaceAgentStats {
+		if agentStat.CreatedAt.After(createdAfter) || agentStat.CreatedAt.Equal(createdAfter) {
+			agentStatsCreatedAfter = append(agentStatsCreatedAfter, agentStat)
+		}
+	}
+
+	latestAgentStats := map[uuid.UUID]database.WorkspaceAgentStat{}
+	for _, agentStat := range q.workspaceAgentStats {
+		if agentStat.CreatedAt.After(createdAfter) || agentStat.CreatedAt.Equal(createdAfter) {
+			latestAgentStats[agentStat.AgentID] = agentStat
+		}
+	}
+
+	statByAgent := map[uuid.UUID]database.GetWorkspaceAgentStatsRow{}
+	for agentID, agentStat := range latestAgentStats {
+		stat := statByAgent[agentID]
+		stat.AgentID = agentStat.AgentID
+		stat.TemplateID = agentStat.TemplateID
+		stat.UserID = agentStat.UserID
+		stat.WorkspaceID = agentStat.WorkspaceID
+		stat.SessionCountVSCode += agentStat.SessionCountVSCode
+		stat.SessionCountJetBrains += agentStat.SessionCountJetBrains
+		stat.SessionCountReconnectingPTY += agentStat.SessionCountReconnectingPTY
+		stat.SessionCountSSH += agentStat.SessionCountSSH
+		statByAgent[stat.AgentID] = stat
+	}
+
+	latenciesByAgent := map[uuid.UUID][]float64{}
+	minimumDateByAgent := map[uuid.UUID]time.Time{}
+	for _, agentStat := range agentStatsCreatedAfter {
+		if agentStat.ConnectionMedianLatencyMS <= 0 {
+			continue
+		}
+		stat := statByAgent[agentStat.AgentID]
+		minimumDate := minimumDateByAgent[agentStat.AgentID]
+		if agentStat.CreatedAt.Before(minimumDate) || minimumDate.IsZero() {
+			minimumDateByAgent[agentStat.AgentID] = agentStat.CreatedAt
+		}
+		stat.WorkspaceRxBytes += agentStat.RxBytes
+		stat.WorkspaceTxBytes += agentStat.TxBytes
+		statByAgent[agentStat.AgentID] = stat
+		latenciesByAgent[agentStat.AgentID] = append(latenciesByAgent[agentStat.AgentID], agentStat.ConnectionMedianLatencyMS)
+	}
+
+	tryPercentile := func(fs []float64, p float64) float64 {
+		if len(fs) == 0 {
+			return -1
+		}
+		sort.Float64s(fs)
+		return fs[int(float64(len(fs))*p/100)]
+	}
+
+	for _, stat := range statByAgent {
+		stat.AggregatedFrom = minimumDateByAgent[stat.AgentID]
+		statByAgent[stat.AgentID] = stat
+
+		latencies, ok := latenciesByAgent[stat.AgentID]
+		if !ok {
+			continue
+		}
+		stat.WorkspaceConnectionLatency50 = tryPercentile(latencies, 50)
+		stat.WorkspaceConnectionLatency95 = tryPercentile(latencies, 95)
+		statByAgent[stat.AgentID] = stat
+	}
+
+	stats := make([]database.GetWorkspaceAgentStatsRow, 0, len(statByAgent))
+	for _, agent := range statByAgent {
+		stats = append(stats, agent)
+	}
+	return stats, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentStatsAndLabels(ctx context.Context, createdAfter time.Time) ([]database.GetWorkspaceAgentStatsAndLabelsRow, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	agentStatsCreatedAfter := make([]database.WorkspaceAgentStat, 0)
+	latestAgentStats := map[uuid.UUID]database.WorkspaceAgentStat{}
+
+	for _, agentStat := range q.workspaceAgentStats {
+		if agentStat.CreatedAt.After(createdAfter) {
+			agentStatsCreatedAfter = append(agentStatsCreatedAfter, agentStat)
+			latestAgentStats[agentStat.AgentID] = agentStat
+		}
+	}
+
+	statByAgent := map[uuid.UUID]database.GetWorkspaceAgentStatsAndLabelsRow{}
+
+	// Session and connection metrics
+	for _, agentStat := range latestAgentStats {
+		stat := statByAgent[agentStat.AgentID]
+		stat.SessionCountVSCode += agentStat.SessionCountVSCode
+		stat.SessionCountJetBrains += agentStat.SessionCountJetBrains
+		stat.SessionCountReconnectingPTY += agentStat.SessionCountReconnectingPTY
+		stat.SessionCountSSH += agentStat.SessionCountSSH
+		stat.ConnectionCount += agentStat.ConnectionCount
+		if agentStat.ConnectionMedianLatencyMS >= 0 && stat.ConnectionMedianLatencyMS < agentStat.ConnectionMedianLatencyMS {
+			stat.ConnectionMedianLatencyMS = agentStat.ConnectionMedianLatencyMS
+		}
+		statByAgent[agentStat.AgentID] = stat
+	}
+
+	// Tx, Rx metrics
+	for _, agentStat := range agentStatsCreatedAfter {
+		stat := statByAgent[agentStat.AgentID]
+		stat.RxBytes += agentStat.RxBytes
+		stat.TxBytes += agentStat.TxBytes
+		statByAgent[agentStat.AgentID] = stat
+	}
+
+	// Labels
+	for _, agentStat := range agentStatsCreatedAfter {
+		stat := statByAgent[agentStat.AgentID]
+
+		user, err := q.getUserByIDNoLock(agentStat.UserID)
+		if err != nil {
+			return nil, err
+		}
+
+		stat.Username = user.Username
+
+		workspace, err := q.getWorkspaceByIDNoLock(ctx, agentStat.WorkspaceID)
+		if err != nil {
+			return nil, err
+		}
+		stat.WorkspaceName = workspace.Name
+
+		agent, err := q.getWorkspaceAgentByIDNoLock(ctx, agentStat.AgentID)
+		if err != nil {
+			return nil, err
+		}
+		stat.AgentName = agent.Name
+
+		statByAgent[agentStat.AgentID] = stat
+	}
+
+	stats := make([]database.GetWorkspaceAgentStatsAndLabelsRow, 0, len(statByAgent))
+	for _, agent := range statByAgent {
+		stats = append(stats, agent)
+	}
+	return stats, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentsByResourceIDs(ctx context.Context, resourceIDs []uuid.UUID) ([]database.WorkspaceAgent, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getWorkspaceAgentsByResourceIDsNoLock(ctx, resourceIDs)
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentsCreatedAfter(_ context.Context, after time.Time) ([]database.WorkspaceAgent, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	workspaceAgents := make([]database.WorkspaceAgent, 0)
+	for _, agent := range q.workspaceAgents {
+		if agent.CreatedAt.After(after) {
+			workspaceAgents = append(workspaceAgents, agent)
+		}
+	}
+	return workspaceAgents, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAgentsInLatestBuildByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) ([]database.WorkspaceAgent, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	// Get latest build for workspace.
+	workspaceBuild, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspaceID)
+	if err != nil {
+		return nil, xerrors.Errorf("get latest workspace build: %w", err)
+	}
+
+	// Get resources for build.
+	resources, err := q.getWorkspaceResourcesByJobIDNoLock(ctx, workspaceBuild.JobID)
+	if err != nil {
+		return nil, xerrors.Errorf("get workspace resources: %w", err)
+	}
+	if len(resources) == 0 {
+		return []database.WorkspaceAgent{}, nil
+	}
+
+	resourceIDs := make([]uuid.UUID, len(resources))
+	for i, resource := range resources {
+		resourceIDs[i] = resource.ID
+	}
+
+	agents, err := q.getWorkspaceAgentsByResourceIDsNoLock(ctx, resourceIDs)
+	if err != nil {
+		return nil, xerrors.Errorf("get workspace agents: %w", err)
+	}
+
+	return agents, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAppByAgentIDAndSlug(ctx context.Context, arg database.GetWorkspaceAppByAgentIDAndSlugParams) (database.WorkspaceApp, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.WorkspaceApp{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getWorkspaceAppByAgentIDAndSlugNoLock(ctx, arg)
+}
+
+func (q *FakeQuerier) GetWorkspaceAppsByAgentID(_ context.Context, id uuid.UUID) ([]database.WorkspaceApp, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	apps := make([]database.WorkspaceApp, 0)
+	for _, app := range q.workspaceApps {
+		if app.AgentID == id {
+			apps = append(apps, app)
+		}
+	}
+	return apps, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAppsByAgentIDs(_ context.Context, ids []uuid.UUID) ([]database.WorkspaceApp, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	apps := make([]database.WorkspaceApp, 0)
+	for _, app := range q.workspaceApps {
+		for _, id := range ids {
+			if app.AgentID == id {
+				apps = append(apps, app)
+				break
+			}
+		}
+	}
+	return apps, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceAppsCreatedAfter(_ context.Context, after time.Time) ([]database.WorkspaceApp, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	apps := make([]database.WorkspaceApp, 0)
+	for _, app := range q.workspaceApps {
+		if app.CreatedAt.After(after) {
+			apps = append(apps, app)
+		}
+	}
+	return apps, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceBuildByID(ctx context.Context, id uuid.UUID) (database.WorkspaceBuild, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getWorkspaceBuildByIDNoLock(ctx, id)
+}
+
+func (q *FakeQuerier) GetWorkspaceBuildByJobID(_ context.Context, jobID uuid.UUID) (database.WorkspaceBuild, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, build := range q.workspaceBuilds {
+		if build.JobID == jobID {
+			return q.workspaceBuildWithUserNoLock(build), nil
+		}
+	}
+	return database.WorkspaceBuild{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetWorkspaceBuildByWorkspaceIDAndBuildNumber(_ context.Context, arg database.GetWorkspaceBuildByWorkspaceIDAndBuildNumberParams) (database.WorkspaceBuild, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.WorkspaceBuild{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, workspaceBuild := range q.workspaceBuilds {
+		if workspaceBuild.WorkspaceID != arg.WorkspaceID {
+			continue
+		}
+		if workspaceBuild.BuildNumber != arg.BuildNumber {
+			continue
+		}
+		return q.workspaceBuildWithUserNoLock(workspaceBuild), nil
+	}
+	return database.WorkspaceBuild{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetWorkspaceBuildParameters(_ context.Context, workspaceBuildID uuid.UUID) ([]database.WorkspaceBuildParameter, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	params := make([]database.WorkspaceBuildParameter, 0)
+	for _, param := range q.workspaceBuildParameters {
+		if param.WorkspaceBuildID != workspaceBuildID {
+			continue
+		}
+		params = append(params, param)
+	}
+	return params, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceBuildsByWorkspaceID(_ context.Context,
+	params database.GetWorkspaceBuildsByWorkspaceIDParams,
+) ([]database.WorkspaceBuild, error) {
+	if err := validateDatabaseType(params); err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	history := make([]database.WorkspaceBuild, 0)
+	for _, workspaceBuild := range q.workspaceBuilds {
+		if workspaceBuild.CreatedAt.Before(params.Since) {
+			continue
+		}
+		if workspaceBuild.WorkspaceID == params.WorkspaceID {
+			history = append(history, q.workspaceBuildWithUserNoLock(workspaceBuild))
+		}
+	}
+
+	// Order by build_number
+	slices.SortFunc(history, func(a, b database.WorkspaceBuild) int {
+		return slice.Descending(a.BuildNumber, b.BuildNumber)
+	})
+
+	if params.AfterID != uuid.Nil {
+		found := false
+		for i, v := range history {
+			if v.ID == params.AfterID {
+				// We want to return all builds after index i.
+				history = history[i+1:]
+				found = true
+				break
+			}
+		}
+
+		// If no builds after the time, then we return an empty list.
+		if !found {
+			return nil, sql.ErrNoRows
+		}
+	}
+
+	if params.OffsetOpt > 0 {
+		if int(params.OffsetOpt) > len(history)-1 {
+			return nil, sql.ErrNoRows
+		}
+		history = history[params.OffsetOpt:]
+	}
+
+	if params.LimitOpt > 0 {
+		if int(params.LimitOpt) > len(history) {
+			params.LimitOpt = int32(len(history))
+		}
+		history = history[:params.LimitOpt]
+	}
+
+	if len(history) == 0 {
+		return nil, sql.ErrNoRows
+	}
+	return history, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceBuildsCreatedAfter(_ context.Context, after time.Time) ([]database.WorkspaceBuild, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	workspaceBuilds := make([]database.WorkspaceBuild, 0)
+	for _, workspaceBuild := range q.workspaceBuilds {
+		if workspaceBuild.CreatedAt.After(after) {
+			workspaceBuilds = append(workspaceBuilds, q.workspaceBuildWithUserNoLock(workspaceBuild))
+		}
+	}
+	return workspaceBuilds, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceByAgentID(ctx context.Context, agentID uuid.UUID) (database.Workspace, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getWorkspaceByAgentIDNoLock(ctx, agentID)
+}
+
+func (q *FakeQuerier) GetWorkspaceByID(ctx context.Context, id uuid.UUID) (database.Workspace, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getWorkspaceByIDNoLock(ctx, id)
+}
+
+func (q *FakeQuerier) GetWorkspaceByOwnerIDAndName(_ context.Context, arg database.GetWorkspaceByOwnerIDAndNameParams) (database.Workspace, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.Workspace{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	var found *database.Workspace
+	for _, workspace := range q.workspaces {
+		workspace := workspace
+		if workspace.OwnerID != arg.OwnerID {
+			continue
+		}
+		if !strings.EqualFold(workspace.Name, arg.Name) {
+			continue
+		}
+		if workspace.Deleted != arg.Deleted {
+			continue
+		}
+
+		// Return the most recent workspace with the given name
+		if found == nil || workspace.CreatedAt.After(found.CreatedAt) {
+			found = &workspace
+		}
+	}
+	if found != nil {
+		return *found, nil
+	}
+	return database.Workspace{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetWorkspaceByWorkspaceAppID(_ context.Context, workspaceAppID uuid.UUID) (database.Workspace, error) {
+	if err := validateDatabaseType(workspaceAppID); err != nil {
+		return database.Workspace{}, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, workspaceApp := range q.workspaceApps {
+		workspaceApp := workspaceApp
+		if workspaceApp.ID == workspaceAppID {
+			return q.getWorkspaceByAgentIDNoLock(context.Background(), workspaceApp.AgentID)
+		}
+	}
+	return database.Workspace{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetWorkspaceProxies(_ context.Context) ([]database.WorkspaceProxy, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	cpy := make([]database.WorkspaceProxy, 0, len(q.workspaceProxies))
+
+	for _, p := range q.workspaceProxies {
+		if !p.Deleted {
+			cpy = append(cpy, p)
+		}
+	}
+	return cpy, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceProxyByHostname(_ context.Context, params database.GetWorkspaceProxyByHostnameParams) (database.WorkspaceProxy, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	// Return zero rows if this is called with a non-sanitized hostname. The SQL
+	// version of this query does the same thing.
+	if !validProxyByHostnameRegex.MatchString(params.Hostname) {
+		return database.WorkspaceProxy{}, sql.ErrNoRows
+	}
+
+	// This regex matches the SQL version.
+	accessURLRegex := regexp.MustCompile(`[^:]*://` + regexp.QuoteMeta(params.Hostname) + `([:/]?.)*`)
+
+	for _, proxy := range q.workspaceProxies {
+		if proxy.Deleted {
+			continue
+		}
+		if params.AllowAccessUrl && accessURLRegex.MatchString(proxy.Url) {
+			return proxy, nil
+		}
+
+		// Compile the app hostname regex. This is slow sadly.
+		if params.AllowWildcardHostname {
+			wildcardRegexp, err := httpapi.CompileHostnamePattern(proxy.WildcardHostname)
+			if err != nil {
+				return database.WorkspaceProxy{}, xerrors.Errorf("compile hostname pattern %q for proxy %q (%s): %w", proxy.WildcardHostname, proxy.Name, proxy.ID.String(), err)
+			}
+			if _, ok := httpapi.ExecuteHostnamePattern(wildcardRegexp, params.Hostname); ok {
+				return proxy, nil
+			}
+		}
+	}
+
+	return database.WorkspaceProxy{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetWorkspaceProxyByID(_ context.Context, id uuid.UUID) (database.WorkspaceProxy, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, proxy := range q.workspaceProxies {
+		if proxy.ID == id {
+			return proxy, nil
+		}
+	}
+	return database.WorkspaceProxy{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetWorkspaceProxyByName(_ context.Context, name string) (database.WorkspaceProxy, error) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for _, proxy := range q.workspaceProxies {
+		if proxy.Deleted {
+			continue
+		}
+		if proxy.Name == name {
+			return proxy, nil
+		}
+	}
+	return database.WorkspaceProxy{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetWorkspaceResourceByID(_ context.Context, id uuid.UUID) (database.WorkspaceResource, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	for _, resource := range q.workspaceResources {
+		if resource.ID == id {
+			return resource, nil
+		}
+	}
+	return database.WorkspaceResource{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetWorkspaceResourceMetadataByResourceIDs(_ context.Context, ids []uuid.UUID) ([]database.WorkspaceResourceMetadatum, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	metadata := make([]database.WorkspaceResourceMetadatum, 0)
+	for _, metadatum := range q.workspaceResourceMetadata {
+		for _, id := range ids {
+			if metadatum.WorkspaceResourceID == id {
+				metadata = append(metadata, metadatum)
+			}
+		}
+	}
+	return metadata, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceResourceMetadataCreatedAfter(ctx context.Context, after time.Time) ([]database.WorkspaceResourceMetadatum, error) {
+	resources, err := q.GetWorkspaceResourcesCreatedAfter(ctx, after)
+	if err != nil {
+		return nil, err
+	}
+	resourceIDs := map[uuid.UUID]struct{}{}
+	for _, resource := range resources {
+		resourceIDs[resource.ID] = struct{}{}
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	metadata := make([]database.WorkspaceResourceMetadatum, 0)
+	for _, m := range q.workspaceResourceMetadata {
+		_, ok := resourceIDs[m.WorkspaceResourceID]
+		if !ok {
+			continue
+		}
+		metadata = append(metadata, m)
+	}
+	return metadata, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceResourcesByJobID(ctx context.Context, jobID uuid.UUID) ([]database.WorkspaceResource, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	return q.getWorkspaceResourcesByJobIDNoLock(ctx, jobID)
+}
+
+func (q *FakeQuerier) GetWorkspaceResourcesByJobIDs(_ context.Context, jobIDs []uuid.UUID) ([]database.WorkspaceResource, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	resources := make([]database.WorkspaceResource, 0)
+	for _, resource := range q.workspaceResources {
+		for _, jobID := range jobIDs {
+			if resource.JobID != jobID {
+				continue
+			}
+			resources = append(resources, resource)
+		}
+	}
+	return resources, nil
+}
+
+func (q *FakeQuerier) GetWorkspaceResourcesCreatedAfter(_ context.Context, after time.Time) ([]database.WorkspaceResource, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	resources := make([]database.WorkspaceResource, 0)
+	for _, resource := range q.workspaceResources {
+		if resource.CreatedAt.After(after) {
+			resources = append(resources, resource)
+		}
+	}
+	return resources, nil
+}
+
+func (q *FakeQuerier) GetWorkspaces(ctx context.Context, arg database.GetWorkspacesParams) ([]database.GetWorkspacesRow, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return nil, err
+	}
+
+	// A nil auth filter means no auth filter.
+	workspaceRows, err := q.GetAuthorizedWorkspaces(ctx, arg, nil)
+	return workspaceRows, err
+}
+
+func (q *FakeQuerier) GetWorkspacesEligibleForTransition(ctx context.Context, now time.Time) ([]database.Workspace, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	workspaces := []database.Workspace{}
+	for _, workspace := range q.workspaces {
+		build, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspace.ID)
+		if err != nil {
+			return nil, err
+		}
+
+		if build.Transition == database.WorkspaceTransitionStart &&
+			!build.Deadline.IsZero() &&
+			build.Deadline.Before(now) &&
+			!workspace.DormantAt.Valid {
+			workspaces = append(workspaces, workspace)
+			continue
+		}
+
+		if build.Transition == database.WorkspaceTransitionStop &&
+			workspace.AutostartSchedule.Valid &&
+			!workspace.DormantAt.Valid {
+			workspaces = append(workspaces, workspace)
+			continue
+		}
+
+		job, err := q.getProvisionerJobByIDNoLock(ctx, build.JobID)
+		if err != nil {
+			return nil, xerrors.Errorf("get provisioner job by ID: %w", err)
+		}
+		if codersdk.ProvisionerJobStatus(job.JobStatus) == codersdk.ProvisionerJobFailed {
+			workspaces = append(workspaces, workspace)
+			continue
+		}
+
+		template, err := q.getTemplateByIDNoLock(ctx, workspace.TemplateID)
+		if err != nil {
+			return nil, xerrors.Errorf("get template by ID: %w", err)
+		}
+		if !workspace.DormantAt.Valid && template.TimeTilDormant > 0 {
+			workspaces = append(workspaces, workspace)
+			continue
+		}
+		if workspace.DormantAt.Valid && template.TimeTilDormantAutoDelete > 0 {
+			workspaces = append(workspaces, workspace)
+			continue
+		}
+	}
+
+	return workspaces, nil
+}
+
+func (q *FakeQuerier) InsertAPIKey(_ context.Context, arg database.InsertAPIKeyParams) (database.APIKey, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.APIKey{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	if arg.LifetimeSeconds == 0 {
+		arg.LifetimeSeconds = 86400
+	}
+
+	for _, u := range q.users {
+		if u.ID == arg.UserID && u.Deleted {
+			return database.APIKey{}, xerrors.Errorf("refusing to create APIKey for deleted user")
+		}
+	}
+
+	//nolint:gosimple
+	key := database.APIKey{
+		ID:              arg.ID,
+		LifetimeSeconds: arg.LifetimeSeconds,
+		HashedSecret:    arg.HashedSecret,
+		IPAddress:       arg.IPAddress,
+		UserID:          arg.UserID,
+		ExpiresAt:       arg.ExpiresAt,
+		CreatedAt:       arg.CreatedAt,
+		UpdatedAt:       arg.UpdatedAt,
+		LastUsed:        arg.LastUsed,
+		LoginType:       arg.LoginType,
+		Scope:           arg.Scope,
+		TokenName:       arg.TokenName,
+	}
+	q.apiKeys = append(q.apiKeys, key)
+	return key, nil
+}
+
+func (q *FakeQuerier) InsertAllUsersGroup(ctx context.Context, orgID uuid.UUID) (database.Group, error) {
+	return q.InsertGroup(ctx, database.InsertGroupParams{
+		ID:             orgID,
+		Name:           database.EveryoneGroup,
+		DisplayName:    "",
+		OrganizationID: orgID,
+		AvatarURL:      "",
+		QuotaAllowance: 0,
+	})
+}
+
+func (q *FakeQuerier) InsertAuditLog(_ context.Context, arg database.InsertAuditLogParams) (database.AuditLog, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.AuditLog{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	alog := database.AuditLog(arg)
+
+	q.auditLogs = append(q.auditLogs, alog)
+	slices.SortFunc(q.auditLogs, func(a, b database.AuditLog) int {
+		if a.Time.Before(b.Time) {
+			return -1
+		} else if a.Time.Equal(b.Time) {
+			return 0
+		} else {
+			return 1
+		}
+	})
+
+	return alog, nil
+}
+
+func (q *FakeQuerier) InsertDBCryptKey(_ context.Context, arg database.InsertDBCryptKeyParams) error {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return err
+	}
+
+	for _, key := range q.dbcryptKeys {
+		if key.Number == arg.Number {
+			return errDuplicateKey
+		}
+	}
+
+	q.dbcryptKeys = append(q.dbcryptKeys, database.DBCryptKey{
+		Number:          arg.Number,
+		ActiveKeyDigest: sql.NullString{String: arg.ActiveKeyDigest, Valid: true},
+		Test:            arg.Test,
+	})
+	return nil
+}
+
+func (q *FakeQuerier) InsertDERPMeshKey(_ context.Context, id string) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	q.derpMeshKey = id
+	return nil
+}
+
+func (q *FakeQuerier) InsertDeploymentID(_ context.Context, id string) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	q.deploymentID = id
+	return nil
+}
+
+func (q *FakeQuerier) InsertExternalAuthLink(_ context.Context, arg database.InsertExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+	// nolint:gosimple
+	gitAuthLink := database.ExternalAuthLink{
+		ProviderID:             arg.ProviderID,
+		UserID:                 arg.UserID,
+		CreatedAt:              arg.CreatedAt,
+		UpdatedAt:              arg.UpdatedAt,
+		OAuthAccessToken:       arg.OAuthAccessToken,
+		OAuthAccessTokenKeyID:  arg.OAuthAccessTokenKeyID,
+		OAuthRefreshToken:      arg.OAuthRefreshToken,
+		OAuthRefreshTokenKeyID: arg.OAuthRefreshTokenKeyID,
+		OAuthExpiry:            arg.OAuthExpiry,
+		OAuthExtra:             arg.OAuthExtra,
+	}
+	q.externalAuthLinks = append(q.externalAuthLinks, gitAuthLink)
+	return gitAuthLink, nil
+}
+
+func (q *FakeQuerier) InsertFile(_ context.Context, arg database.InsertFileParams) (database.File, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.File{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	//nolint:gosimple
+	file := database.File{
+		ID:        arg.ID,
+		Hash:      arg.Hash,
+		CreatedAt: arg.CreatedAt,
+		CreatedBy: arg.CreatedBy,
+		Mimetype:  arg.Mimetype,
+		Data:      arg.Data,
+	}
+	q.files = append(q.files, file)
+	return file, nil
+}
+
+func (q *FakeQuerier) InsertGitSSHKey(_ context.Context, arg database.InsertGitSSHKeyParams) (database.GitSSHKey, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.GitSSHKey{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	//nolint:gosimple
+	gitSSHKey := database.GitSSHKey{
+		UserID:     arg.UserID,
+		CreatedAt:  arg.CreatedAt,
+		UpdatedAt:  arg.UpdatedAt,
+		PrivateKey: arg.PrivateKey,
+		PublicKey:  arg.PublicKey,
+	}
+	q.gitSSHKey = append(q.gitSSHKey, gitSSHKey)
+	return gitSSHKey, nil
+}
+
+func (q *FakeQuerier) InsertGroup(_ context.Context, arg database.InsertGroupParams) (database.Group, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.Group{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for _, group := range q.groups {
+		if group.OrganizationID == arg.OrganizationID &&
+			group.Name == arg.Name {
+			return database.Group{}, errDuplicateKey
+		}
+	}
+
+	//nolint:gosimple
+	group := database.Group{
+		ID:             arg.ID,
+		Name:           arg.Name,
+		DisplayName:    arg.DisplayName,
+		OrganizationID: arg.OrganizationID,
+		AvatarURL:      arg.AvatarURL,
+		QuotaAllowance: arg.QuotaAllowance,
+		Source:         database.GroupSourceUser,
+	}
+
+	q.groups = append(q.groups, group)
+
+	return group, nil
+}
+
+func (q *FakeQuerier) InsertGroupMember(_ context.Context, arg database.InsertGroupMemberParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for _, member := range q.groupMembers {
+		if member.GroupID == arg.GroupID &&
+			member.UserID == arg.UserID {
+			return errDuplicateKey
+		}
+	}
+
+	//nolint:gosimple
+	q.groupMembers = append(q.groupMembers, database.GroupMember{
+		GroupID: arg.GroupID,
+		UserID:  arg.UserID,
+	})
+
+	return nil
+}
+
+func (q *FakeQuerier) InsertLicense(
+	_ context.Context, arg database.InsertLicenseParams,
+) (database.License, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.License{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	l := database.License{
+		ID:         q.lastLicenseID + 1,
+		UploadedAt: arg.UploadedAt,
+		JWT:        arg.JWT,
+		Exp:        arg.Exp,
+	}
+	q.lastLicenseID = l.ID
+	q.licenses = append(q.licenses, l)
+	return l, nil
+}
+
+func (q *FakeQuerier) InsertMissingGroups(_ context.Context, arg database.InsertMissingGroupsParams) ([]database.Group, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return nil, err
+	}
+
+	groupNameMap := make(map[string]struct{})
+	for _, g := range arg.GroupNames {
+		groupNameMap[g] = struct{}{}
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for _, g := range q.groups {
+		if g.OrganizationID != arg.OrganizationID {
+			continue
+		}
+		delete(groupNameMap, g.Name)
+	}
+
+	newGroups := make([]database.Group, 0, len(groupNameMap))
+	for k := range groupNameMap {
+		g := database.Group{
+			ID:             uuid.New(),
+			Name:           k,
+			OrganizationID: arg.OrganizationID,
+			AvatarURL:      "",
+			QuotaAllowance: 0,
+			DisplayName:    "",
+			Source:         arg.Source,
+		}
+		q.groups = append(q.groups, g)
+		newGroups = append(newGroups, g)
+	}
+
+	return newGroups, nil
+}
+
+func (q *FakeQuerier) InsertOrganization(_ context.Context, arg database.InsertOrganizationParams) (database.Organization, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.Organization{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	organization := database.Organization{
+		ID:        arg.ID,
+		Name:      arg.Name,
+		CreatedAt: arg.CreatedAt,
+		UpdatedAt: arg.UpdatedAt,
+	}
+	q.organizations = append(q.organizations, organization)
+	return organization, nil
+}
+
+func (q *FakeQuerier) InsertOrganizationMember(_ context.Context, arg database.InsertOrganizationMemberParams) (database.OrganizationMember, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.OrganizationMember{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	//nolint:gosimple
+	organizationMember := database.OrganizationMember{
+		OrganizationID: arg.OrganizationID,
+		UserID:         arg.UserID,
+		CreatedAt:      arg.CreatedAt,
+		UpdatedAt:      arg.UpdatedAt,
+		Roles:          arg.Roles,
+	}
+	q.organizationMembers = append(q.organizationMembers, organizationMember)
+	return organizationMember, nil
+}
+
+func (q *FakeQuerier) InsertProvisionerDaemon(_ context.Context, arg database.InsertProvisionerDaemonParams) (database.ProvisionerDaemon, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.ProvisionerDaemon{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	daemon := database.ProvisionerDaemon{
+		ID:           arg.ID,
+		CreatedAt:    arg.CreatedAt,
+		Name:         arg.Name,
+		Provisioners: arg.Provisioners,
+		Tags:         arg.Tags,
+	}
+	q.provisionerDaemons = append(q.provisionerDaemons, daemon)
+	return daemon, nil
+}
+
+func (q *FakeQuerier) InsertProvisionerJob(_ context.Context, arg database.InsertProvisionerJobParams) (database.ProvisionerJob, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.ProvisionerJob{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	job := database.ProvisionerJob{
+		ID:             arg.ID,
+		CreatedAt:      arg.CreatedAt,
+		UpdatedAt:      arg.UpdatedAt,
+		OrganizationID: arg.OrganizationID,
+		InitiatorID:    arg.InitiatorID,
+		Provisioner:    arg.Provisioner,
+		StorageMethod:  arg.StorageMethod,
+		FileID:         arg.FileID,
+		Type:           arg.Type,
+		Input:          arg.Input,
+		Tags:           arg.Tags,
+		TraceMetadata:  arg.TraceMetadata,
+	}
+	job.JobStatus = provisonerJobStatus(job)
+	q.provisionerJobs = append(q.provisionerJobs, job)
+	return job, nil
+}
+
+func (q *FakeQuerier) InsertProvisionerJobLogs(_ context.Context, arg database.InsertProvisionerJobLogsParams) ([]database.ProvisionerJobLog, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return nil, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	logs := make([]database.ProvisionerJobLog, 0)
+	id := int64(1)
+	if len(q.provisionerJobLogs) > 0 {
+		id = q.provisionerJobLogs[len(q.provisionerJobLogs)-1].ID
+	}
+	for index, output := range arg.Output {
+		id++
+		logs = append(logs, database.ProvisionerJobLog{
+			ID:        id,
+			JobID:     arg.JobID,
+			CreatedAt: arg.CreatedAt[index],
+			Source:    arg.Source[index],
+			Level:     arg.Level[index],
+			Stage:     arg.Stage[index],
+			Output:    output,
+		})
+	}
+	q.provisionerJobLogs = append(q.provisionerJobLogs, logs...)
+	return logs, nil
+}
+
+func (q *FakeQuerier) InsertReplica(_ context.Context, arg database.InsertReplicaParams) (database.Replica, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.Replica{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	replica := database.Replica{
+		ID:              arg.ID,
+		CreatedAt:       arg.CreatedAt,
+		StartedAt:       arg.StartedAt,
+		UpdatedAt:       arg.UpdatedAt,
+		Hostname:        arg.Hostname,
+		RegionID:        arg.RegionID,
+		RelayAddress:    arg.RelayAddress,
+		Version:         arg.Version,
+		DatabaseLatency: arg.DatabaseLatency,
+		Primary:         arg.Primary,
+	}
+	q.replicas = append(q.replicas, replica)
+	return replica, nil
+}
+
+func (q *FakeQuerier) InsertTemplate(_ context.Context, arg database.InsertTemplateParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	//nolint:gosimple
+	template := database.TemplateTable{
+		ID:                           arg.ID,
+		CreatedAt:                    arg.CreatedAt,
+		UpdatedAt:                    arg.UpdatedAt,
+		OrganizationID:               arg.OrganizationID,
+		Name:                         arg.Name,
+		Provisioner:                  arg.Provisioner,
+		ActiveVersionID:              arg.ActiveVersionID,
+		Description:                  arg.Description,
+		CreatedBy:                    arg.CreatedBy,
+		UserACL:                      arg.UserACL,
+		GroupACL:                     arg.GroupACL,
+		DisplayName:                  arg.DisplayName,
+		Icon:                         arg.Icon,
+		AllowUserCancelWorkspaceJobs: arg.AllowUserCancelWorkspaceJobs,
+		AllowUserAutostart:           true,
+		AllowUserAutostop:            true,
+	}
+	q.templates = append(q.templates, template)
+	return nil
+}
+
+func (q *FakeQuerier) InsertTemplateVersion(_ context.Context, arg database.InsertTemplateVersionParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	if len(arg.Message) > 1048576 {
+		return xerrors.New("message too long")
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	//nolint:gosimple
+	version := database.TemplateVersionTable{
+		ID:             arg.ID,
+		TemplateID:     arg.TemplateID,
+		OrganizationID: arg.OrganizationID,
+		CreatedAt:      arg.CreatedAt,
+		UpdatedAt:      arg.UpdatedAt,
+		Name:           arg.Name,
+		Message:        arg.Message,
+		Readme:         arg.Readme,
+		JobID:          arg.JobID,
+		CreatedBy:      arg.CreatedBy,
+	}
+	q.templateVersions = append(q.templateVersions, version)
+	return nil
+}
+
+func (q *FakeQuerier) InsertTemplateVersionParameter(_ context.Context, arg database.InsertTemplateVersionParameterParams) (database.TemplateVersionParameter, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.TemplateVersionParameter{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	//nolint:gosimple
+	param := database.TemplateVersionParameter{
+		TemplateVersionID:   arg.TemplateVersionID,
+		Name:                arg.Name,
+		DisplayName:         arg.DisplayName,
+		Description:         arg.Description,
+		Type:                arg.Type,
+		Mutable:             arg.Mutable,
+		DefaultValue:        arg.DefaultValue,
+		Icon:                arg.Icon,
+		Options:             arg.Options,
+		ValidationError:     arg.ValidationError,
+		ValidationRegex:     arg.ValidationRegex,
+		ValidationMin:       arg.ValidationMin,
+		ValidationMax:       arg.ValidationMax,
+		ValidationMonotonic: arg.ValidationMonotonic,
+		Required:            arg.Required,
+		DisplayOrder:        arg.DisplayOrder,
+		Ephemeral:           arg.Ephemeral,
+	}
+	q.templateVersionParameters = append(q.templateVersionParameters, param)
+	return param, nil
+}
+
+func (q *FakeQuerier) InsertTemplateVersionVariable(_ context.Context, arg database.InsertTemplateVersionVariableParams) (database.TemplateVersionVariable, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.TemplateVersionVariable{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	//nolint:gosimple
+	variable := database.TemplateVersionVariable{
+		TemplateVersionID: arg.TemplateVersionID,
+		Name:              arg.Name,
+		Description:       arg.Description,
+		Type:              arg.Type,
+		Value:             arg.Value,
+		DefaultValue:      arg.DefaultValue,
+		Required:          arg.Required,
+		Sensitive:         arg.Sensitive,
+	}
+	q.templateVersionVariables = append(q.templateVersionVariables, variable)
+	return variable, nil
+}
+
+func (q *FakeQuerier) InsertUser(_ context.Context, arg database.InsertUserParams) (database.User, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.User{}, err
+	}
+
+	// There is a common bug when using dbmem that 2 inserted users have the
+	// same created_at time. This causes user order to not be deterministic,
+	// which breaks some unit tests.
+	// To fix this, we make sure that the created_at time is always greater
+	// than the last user's created_at time.
+	allUsers, _ := q.GetUsers(context.Background(), database.GetUsersParams{})
+	if len(allUsers) > 0 {
+		lastUser := allUsers[len(allUsers)-1]
+		if arg.CreatedAt.Before(lastUser.CreatedAt) ||
+			arg.CreatedAt.Equal(lastUser.CreatedAt) {
+			// 1 ms is a good enough buffer.
+			arg.CreatedAt = lastUser.CreatedAt.Add(time.Millisecond)
+		}
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for _, user := range q.users {
+		if user.Username == arg.Username && !user.Deleted {
+			return database.User{}, errDuplicateKey
+		}
+	}
+
+	user := database.User{
+		ID:             arg.ID,
+		Email:          arg.Email,
+		HashedPassword: arg.HashedPassword,
+		CreatedAt:      arg.CreatedAt,
+		UpdatedAt:      arg.UpdatedAt,
+		Username:       arg.Username,
+		Status:         database.UserStatusDormant,
+		RBACRoles:      arg.RBACRoles,
+		LoginType:      arg.LoginType,
+	}
+	q.users = append(q.users, user)
+	return user, nil
+}
+
+func (q *FakeQuerier) InsertUserGroupsByName(_ context.Context, arg database.InsertUserGroupsByNameParams) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	var groupIDs []uuid.UUID
+	for _, group := range q.groups {
+		for _, groupName := range arg.GroupNames {
+			if group.Name == groupName {
+				groupIDs = append(groupIDs, group.ID)
+			}
+		}
+	}
+
+	for _, groupID := range groupIDs {
+		q.groupMembers = append(q.groupMembers, database.GroupMember{
+			UserID:  arg.UserID,
+			GroupID: groupID,
+		})
+	}
+
+	return nil
+}
+
+func (q *FakeQuerier) InsertUserLink(_ context.Context, args database.InsertUserLinkParams) (database.UserLink, error) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	//nolint:gosimple
+	link := database.UserLink{
+		UserID:                 args.UserID,
+		LoginType:              args.LoginType,
+		LinkedID:               args.LinkedID,
+		OAuthAccessToken:       args.OAuthAccessToken,
+		OAuthAccessTokenKeyID:  args.OAuthAccessTokenKeyID,
+		OAuthRefreshToken:      args.OAuthRefreshToken,
+		OAuthRefreshTokenKeyID: args.OAuthRefreshTokenKeyID,
+		OAuthExpiry:            args.OAuthExpiry,
+	}
+
+	q.userLinks = append(q.userLinks, link)
+
+	return link, nil
+}
+
+func (q *FakeQuerier) InsertWorkspace(_ context.Context, arg database.InsertWorkspaceParams) (database.Workspace, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.Workspace{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	//nolint:gosimple
+	workspace := database.Workspace{
+		ID:                arg.ID,
+		CreatedAt:         arg.CreatedAt,
+		UpdatedAt:         arg.UpdatedAt,
+		OwnerID:           arg.OwnerID,
+		OrganizationID:    arg.OrganizationID,
+		TemplateID:        arg.TemplateID,
+		Name:              arg.Name,
+		AutostartSchedule: arg.AutostartSchedule,
+		Ttl:               arg.Ttl,
+		LastUsedAt:        arg.LastUsedAt,
+		AutomaticUpdates:  arg.AutomaticUpdates,
+	}
+	q.workspaces = append(q.workspaces, workspace)
+	return workspace, nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceAgent(_ context.Context, arg database.InsertWorkspaceAgentParams) (database.WorkspaceAgent, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.WorkspaceAgent{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	agent := database.WorkspaceAgent{
+		ID:                       arg.ID,
+		CreatedAt:                arg.CreatedAt,
+		UpdatedAt:                arg.UpdatedAt,
+		ResourceID:               arg.ResourceID,
+		AuthToken:                arg.AuthToken,
+		AuthInstanceID:           arg.AuthInstanceID,
+		EnvironmentVariables:     arg.EnvironmentVariables,
+		Name:                     arg.Name,
+		Architecture:             arg.Architecture,
+		OperatingSystem:          arg.OperatingSystem,
+		Directory:                arg.Directory,
+		InstanceMetadata:         arg.InstanceMetadata,
+		ResourceMetadata:         arg.ResourceMetadata,
+		ConnectionTimeoutSeconds: arg.ConnectionTimeoutSeconds,
+		TroubleshootingURL:       arg.TroubleshootingURL,
+		MOTDFile:                 arg.MOTDFile,
+		LifecycleState:           database.WorkspaceAgentLifecycleStateCreated,
+		DisplayApps:              arg.DisplayApps,
+	}
+
+	q.workspaceAgents = append(q.workspaceAgents, agent)
+	return agent, nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceAgentLogSources(_ context.Context, arg database.InsertWorkspaceAgentLogSourcesParams) ([]database.WorkspaceAgentLogSource, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return nil, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	logSources := make([]database.WorkspaceAgentLogSource, 0)
+	for index, source := range arg.ID {
+		logSource := database.WorkspaceAgentLogSource{
+			ID:               source,
+			WorkspaceAgentID: arg.WorkspaceAgentID,
+			CreatedAt:        arg.CreatedAt,
+			DisplayName:      arg.DisplayName[index],
+			Icon:             arg.Icon[index],
+		}
+		logSources = append(logSources, logSource)
+	}
+	q.workspaceAgentLogSources = append(q.workspaceAgentLogSources, logSources...)
+	return logSources, nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceAgentLogs(_ context.Context, arg database.InsertWorkspaceAgentLogsParams) ([]database.WorkspaceAgentLog, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return nil, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	logs := []database.WorkspaceAgentLog{}
+	id := int64(0)
+	if len(q.workspaceAgentLogs) > 0 {
+		id = q.workspaceAgentLogs[len(q.workspaceAgentLogs)-1].ID
+	}
+	outputLength := int32(0)
+	for index, output := range arg.Output {
+		id++
+		logs = append(logs, database.WorkspaceAgentLog{
+			ID:          id,
+			AgentID:     arg.AgentID,
+			CreatedAt:   arg.CreatedAt,
+			Level:       arg.Level[index],
+			LogSourceID: arg.LogSourceID,
+			Output:      output,
+		})
+		outputLength += int32(len(output))
+	}
+	for index, agent := range q.workspaceAgents {
+		if agent.ID != arg.AgentID {
+			continue
+		}
+		// Greater than 1MB, same as the PostgreSQL constraint!
+		if agent.LogsLength+outputLength > (1 << 20) {
+			return nil, &pq.Error{
+				Constraint: "max_logs_length",
+				Table:      "workspace_agents",
+			}
+		}
+		agent.LogsLength += outputLength
+		q.workspaceAgents[index] = agent
+		break
+	}
+	q.workspaceAgentLogs = append(q.workspaceAgentLogs, logs...)
+	return logs, nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceAgentMetadata(_ context.Context, arg database.InsertWorkspaceAgentMetadataParams) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	//nolint:gosimple
+	metadatum := database.WorkspaceAgentMetadatum{
+		WorkspaceAgentID: arg.WorkspaceAgentID,
+		Script:           arg.Script,
+		DisplayName:      arg.DisplayName,
+		Key:              arg.Key,
+		Timeout:          arg.Timeout,
+		Interval:         arg.Interval,
+	}
+
+	q.workspaceAgentMetadata = append(q.workspaceAgentMetadata, metadatum)
+	return nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceAgentScripts(_ context.Context, arg database.InsertWorkspaceAgentScriptsParams) ([]database.WorkspaceAgentScript, error) {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return nil, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	scripts := make([]database.WorkspaceAgentScript, 0)
+	for index, source := range arg.LogSourceID {
+		script := database.WorkspaceAgentScript{
+			LogSourceID:      source,
+			WorkspaceAgentID: arg.WorkspaceAgentID,
+			LogPath:          arg.LogPath[index],
+			Script:           arg.Script[index],
+			Cron:             arg.Cron[index],
+			StartBlocksLogin: arg.StartBlocksLogin[index],
+			RunOnStart:       arg.RunOnStart[index],
+			RunOnStop:        arg.RunOnStop[index],
+			TimeoutSeconds:   arg.TimeoutSeconds[index],
+			CreatedAt:        arg.CreatedAt,
+		}
+		scripts = append(scripts, script)
+	}
+	q.workspaceAgentScripts = append(q.workspaceAgentScripts, scripts...)
+	return scripts, nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceAgentStat(_ context.Context, p database.InsertWorkspaceAgentStatParams) (database.WorkspaceAgentStat, error) {
+	if err := validateDatabaseType(p); err != nil {
+		return database.WorkspaceAgentStat{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	stat := database.WorkspaceAgentStat{
+		ID:                          p.ID,
+		CreatedAt:                   p.CreatedAt,
+		WorkspaceID:                 p.WorkspaceID,
+		AgentID:                     p.AgentID,
+		UserID:                      p.UserID,
+		ConnectionsByProto:          p.ConnectionsByProto,
+		ConnectionCount:             p.ConnectionCount,
+		RxPackets:                   p.RxPackets,
+		RxBytes:                     p.RxBytes,
+		TxPackets:                   p.TxPackets,
+		TxBytes:                     p.TxBytes,
+		TemplateID:                  p.TemplateID,
+		SessionCountVSCode:          p.SessionCountVSCode,
+		SessionCountJetBrains:       p.SessionCountJetBrains,
+		SessionCountReconnectingPTY: p.SessionCountReconnectingPTY,
+		SessionCountSSH:             p.SessionCountSSH,
+		ConnectionMedianLatencyMS:   p.ConnectionMedianLatencyMS,
+	}
+	q.workspaceAgentStats = append(q.workspaceAgentStats, stat)
+	return stat, nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceAgentStats(_ context.Context, arg database.InsertWorkspaceAgentStatsParams) error {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	var connectionsByProto []map[string]int64
+	if err := json.Unmarshal(arg.ConnectionsByProto, &connectionsByProto); err != nil {
+		return err
+	}
+	for i := 0; i < len(arg.ID); i++ {
+		cbp, err := json.Marshal(connectionsByProto[i])
+		if err != nil {
+			return xerrors.Errorf("failed to marshal connections_by_proto: %w", err)
+		}
+		stat := database.WorkspaceAgentStat{
+			ID:                          arg.ID[i],
+			CreatedAt:                   arg.CreatedAt[i],
+			WorkspaceID:                 arg.WorkspaceID[i],
+			AgentID:                     arg.AgentID[i],
+			UserID:                      arg.UserID[i],
+			ConnectionsByProto:          cbp,
+			ConnectionCount:             arg.ConnectionCount[i],
+			RxPackets:                   arg.RxPackets[i],
+			RxBytes:                     arg.RxBytes[i],
+			TxPackets:                   arg.TxPackets[i],
+			TxBytes:                     arg.TxBytes[i],
+			TemplateID:                  arg.TemplateID[i],
+			SessionCountVSCode:          arg.SessionCountVSCode[i],
+			SessionCountJetBrains:       arg.SessionCountJetBrains[i],
+			SessionCountReconnectingPTY: arg.SessionCountReconnectingPTY[i],
+			SessionCountSSH:             arg.SessionCountSSH[i],
+			ConnectionMedianLatencyMS:   arg.ConnectionMedianLatencyMS[i],
+		}
+		q.workspaceAgentStats = append(q.workspaceAgentStats, stat)
+	}
+
+	return nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceApp(_ context.Context, arg database.InsertWorkspaceAppParams) (database.WorkspaceApp, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.WorkspaceApp{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	if arg.SharingLevel == "" {
+		arg.SharingLevel = database.AppSharingLevelOwner
+	}
+
+	// nolint:gosimple
+	workspaceApp := database.WorkspaceApp{
+		ID:                   arg.ID,
+		AgentID:              arg.AgentID,
+		CreatedAt:            arg.CreatedAt,
+		Slug:                 arg.Slug,
+		DisplayName:          arg.DisplayName,
+		Icon:                 arg.Icon,
+		Command:              arg.Command,
+		Url:                  arg.Url,
+		External:             arg.External,
+		Subdomain:            arg.Subdomain,
+		SharingLevel:         arg.SharingLevel,
+		HealthcheckUrl:       arg.HealthcheckUrl,
+		HealthcheckInterval:  arg.HealthcheckInterval,
+		HealthcheckThreshold: arg.HealthcheckThreshold,
+		Health:               arg.Health,
+	}
+	q.workspaceApps = append(q.workspaceApps, workspaceApp)
+	return workspaceApp, nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceAppStats(_ context.Context, arg database.InsertWorkspaceAppStatsParams) error {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+InsertWorkspaceAppStatsLoop:
+	for i := 0; i < len(arg.UserID); i++ {
+		stat := database.WorkspaceAppStat{
+			ID:               q.workspaceAppStatsLastInsertID + 1,
+			UserID:           arg.UserID[i],
+			WorkspaceID:      arg.WorkspaceID[i],
+			AgentID:          arg.AgentID[i],
+			AccessMethod:     arg.AccessMethod[i],
+			SlugOrPort:       arg.SlugOrPort[i],
+			SessionID:        arg.SessionID[i],
+			SessionStartedAt: arg.SessionStartedAt[i],
+			SessionEndedAt:   arg.SessionEndedAt[i],
+			Requests:         arg.Requests[i],
+		}
+		for j, s := range q.workspaceAppStats {
+			// Check unique constraint for upsert.
+			if s.UserID == stat.UserID && s.AgentID == stat.AgentID && s.SessionID == stat.SessionID {
+				q.workspaceAppStats[j].SessionEndedAt = stat.SessionEndedAt
+				q.workspaceAppStats[j].Requests = stat.Requests
+				continue InsertWorkspaceAppStatsLoop
+			}
+		}
+		q.workspaceAppStats = append(q.workspaceAppStats, stat)
+		q.workspaceAppStatsLastInsertID++
+	}
+
+	return nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceBuild(_ context.Context, arg database.InsertWorkspaceBuildParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	workspaceBuild := database.WorkspaceBuildTable{
+		ID:                arg.ID,
+		CreatedAt:         arg.CreatedAt,
+		UpdatedAt:         arg.UpdatedAt,
+		WorkspaceID:       arg.WorkspaceID,
+		TemplateVersionID: arg.TemplateVersionID,
+		BuildNumber:       arg.BuildNumber,
+		Transition:        arg.Transition,
+		InitiatorID:       arg.InitiatorID,
+		JobID:             arg.JobID,
+		ProvisionerState:  arg.ProvisionerState,
+		Deadline:          arg.Deadline,
+		MaxDeadline:       arg.MaxDeadline,
+		Reason:            arg.Reason,
+	}
+	q.workspaceBuilds = append(q.workspaceBuilds, workspaceBuild)
+	return nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceBuildParameters(_ context.Context, arg database.InsertWorkspaceBuildParametersParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, name := range arg.Name {
+		q.workspaceBuildParameters = append(q.workspaceBuildParameters, database.WorkspaceBuildParameter{
+			WorkspaceBuildID: arg.WorkspaceBuildID,
+			Name:             name,
+			Value:            arg.Value[index],
+		})
+	}
+	return nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceProxy(_ context.Context, arg database.InsertWorkspaceProxyParams) (database.WorkspaceProxy, error) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	lastRegionID := int32(0)
+	for _, p := range q.workspaceProxies {
+		if !p.Deleted && p.Name == arg.Name {
+			return database.WorkspaceProxy{}, errDuplicateKey
+		}
+		if p.RegionID > lastRegionID {
+			lastRegionID = p.RegionID
+		}
+	}
+
+	p := database.WorkspaceProxy{
+		ID:                arg.ID,
+		Name:              arg.Name,
+		DisplayName:       arg.DisplayName,
+		Icon:              arg.Icon,
+		DerpEnabled:       arg.DerpEnabled,
+		DerpOnly:          arg.DerpOnly,
+		TokenHashedSecret: arg.TokenHashedSecret,
+		RegionID:          lastRegionID + 1,
+		CreatedAt:         arg.CreatedAt,
+		UpdatedAt:         arg.UpdatedAt,
+		Deleted:           false,
+	}
+	q.workspaceProxies = append(q.workspaceProxies, p)
+	return p, nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceResource(_ context.Context, arg database.InsertWorkspaceResourceParams) (database.WorkspaceResource, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.WorkspaceResource{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	//nolint:gosimple
+	resource := database.WorkspaceResource{
+		ID:         arg.ID,
+		CreatedAt:  arg.CreatedAt,
+		JobID:      arg.JobID,
+		Transition: arg.Transition,
+		Type:       arg.Type,
+		Name:       arg.Name,
+		Hide:       arg.Hide,
+		Icon:       arg.Icon,
+		DailyCost:  arg.DailyCost,
+	}
+	q.workspaceResources = append(q.workspaceResources, resource)
+	return resource, nil
+}
+
+func (q *FakeQuerier) InsertWorkspaceResourceMetadata(_ context.Context, arg database.InsertWorkspaceResourceMetadataParams) ([]database.WorkspaceResourceMetadatum, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return nil, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	metadata := make([]database.WorkspaceResourceMetadatum, 0)
+	id := int64(1)
+	if len(q.workspaceResourceMetadata) > 0 {
+		id = q.workspaceResourceMetadata[len(q.workspaceResourceMetadata)-1].ID
+	}
+	for index, key := range arg.Key {
+		id++
+		value := arg.Value[index]
+		metadata = append(metadata, database.WorkspaceResourceMetadatum{
+			ID:                  id,
+			WorkspaceResourceID: arg.WorkspaceResourceID,
+			Key:                 key,
+			Value: sql.NullString{
+				String: value,
+				Valid:  value != "",
+			},
+			Sensitive: arg.Sensitive[index],
+		})
+	}
+	q.workspaceResourceMetadata = append(q.workspaceResourceMetadata, metadata...)
+	return metadata, nil
+}
+
+func (q *FakeQuerier) RegisterWorkspaceProxy(_ context.Context, arg database.RegisterWorkspaceProxyParams) (database.WorkspaceProxy, error) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, p := range q.workspaceProxies {
+		if p.ID == arg.ID {
+			p.Url = arg.Url
+			p.WildcardHostname = arg.WildcardHostname
+			p.DerpEnabled = arg.DerpEnabled
+			p.DerpOnly = arg.DerpOnly
+			p.UpdatedAt = dbtime.Now()
+			q.workspaceProxies[i] = p
+			return p, nil
+		}
+	}
+	return database.WorkspaceProxy{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) RevokeDBCryptKey(_ context.Context, activeKeyDigest string) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i := range q.dbcryptKeys {
+		key := q.dbcryptKeys[i]
+
+		// Is the key already revoked?
+		if !key.ActiveKeyDigest.Valid {
+			continue
+		}
+
+		if key.ActiveKeyDigest.String != activeKeyDigest {
+			continue
+		}
+
+		// Check for foreign key constraints.
+		for _, ul := range q.userLinks {
+			if (ul.OAuthAccessTokenKeyID.Valid && ul.OAuthAccessTokenKeyID.String == activeKeyDigest) ||
+				(ul.OAuthRefreshTokenKeyID.Valid && ul.OAuthRefreshTokenKeyID.String == activeKeyDigest) {
+				return errForeignKeyConstraint
+			}
+		}
+		for _, gal := range q.externalAuthLinks {
+			if (gal.OAuthAccessTokenKeyID.Valid && gal.OAuthAccessTokenKeyID.String == activeKeyDigest) ||
+				(gal.OAuthRefreshTokenKeyID.Valid && gal.OAuthRefreshTokenKeyID.String == activeKeyDigest) {
+				return errForeignKeyConstraint
+			}
+		}
+
+		// Revoke the key.
+		q.dbcryptKeys[i].RevokedAt = sql.NullTime{Time: dbtime.Now(), Valid: true}
+		q.dbcryptKeys[i].RevokedKeyDigest = sql.NullString{String: key.ActiveKeyDigest.String, Valid: true}
+		q.dbcryptKeys[i].ActiveKeyDigest = sql.NullString{}
+		return nil
+	}
+
+	return sql.ErrNoRows
+}
+
+func (*FakeQuerier) TryAcquireLock(_ context.Context, _ int64) (bool, error) {
+	return false, xerrors.New("TryAcquireLock must only be called within a transaction")
+}
+
+func (q *FakeQuerier) UnarchiveTemplateVersion(_ context.Context, arg database.UnarchiveTemplateVersionParams) error {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return err
+	}
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, v := range q.data.templateVersions {
+		if v.ID == arg.TemplateVersionID {
+			v.Archived = false
+			v.UpdatedAt = arg.UpdatedAt
+			q.data.templateVersions[i] = v
+			return nil
+		}
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateAPIKeyByID(_ context.Context, arg database.UpdateAPIKeyByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, apiKey := range q.apiKeys {
+		if apiKey.ID != arg.ID {
+			continue
+		}
+		apiKey.LastUsed = arg.LastUsed
+		apiKey.ExpiresAt = arg.ExpiresAt
+		apiKey.IPAddress = arg.IPAddress
+		q.apiKeys[index] = apiKey
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateExternalAuthLink(_ context.Context, arg database.UpdateExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+	for index, gitAuthLink := range q.externalAuthLinks {
+		if gitAuthLink.ProviderID != arg.ProviderID {
+			continue
+		}
+		if gitAuthLink.UserID != arg.UserID {
+			continue
+		}
+		gitAuthLink.UpdatedAt = arg.UpdatedAt
+		gitAuthLink.OAuthAccessToken = arg.OAuthAccessToken
+		gitAuthLink.OAuthAccessTokenKeyID = arg.OAuthAccessTokenKeyID
+		gitAuthLink.OAuthRefreshToken = arg.OAuthRefreshToken
+		gitAuthLink.OAuthRefreshTokenKeyID = arg.OAuthRefreshTokenKeyID
+		gitAuthLink.OAuthExpiry = arg.OAuthExpiry
+		gitAuthLink.OAuthExtra = arg.OAuthExtra
+		q.externalAuthLinks[index] = gitAuthLink
+
+		return gitAuthLink, nil
+	}
+	return database.ExternalAuthLink{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateGitSSHKey(_ context.Context, arg database.UpdateGitSSHKeyParams) (database.GitSSHKey, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.GitSSHKey{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, key := range q.gitSSHKey {
+		if key.UserID != arg.UserID {
+			continue
+		}
+		key.UpdatedAt = arg.UpdatedAt
+		key.PrivateKey = arg.PrivateKey
+		key.PublicKey = arg.PublicKey
+		q.gitSSHKey[index] = key
+		return key, nil
+	}
+	return database.GitSSHKey{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateGroupByID(_ context.Context, arg database.UpdateGroupByIDParams) (database.Group, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.Group{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, group := range q.groups {
+		if group.ID == arg.ID {
+			group.DisplayName = arg.DisplayName
+			group.Name = arg.Name
+			group.AvatarURL = arg.AvatarURL
+			group.QuotaAllowance = arg.QuotaAllowance
+			q.groups[i] = group
+			return group, nil
+		}
+	}
+	return database.Group{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateInactiveUsersToDormant(_ context.Context, params database.UpdateInactiveUsersToDormantParams) ([]database.UpdateInactiveUsersToDormantRow, error) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	var updated []database.UpdateInactiveUsersToDormantRow
+	for index, user := range q.users {
+		if user.Status == database.UserStatusActive && user.LastSeenAt.Before(params.LastSeenAfter) {
+			q.users[index].Status = database.UserStatusDormant
+			q.users[index].UpdatedAt = params.UpdatedAt
+			updated = append(updated, database.UpdateInactiveUsersToDormantRow{
+				ID:         user.ID,
+				Email:      user.Email,
+				LastSeenAt: user.LastSeenAt,
+			})
+		}
+	}
+
+	if len(updated) == 0 {
+		return nil, sql.ErrNoRows
+	}
+	return updated, nil
+}
+
+func (q *FakeQuerier) UpdateMemberRoles(_ context.Context, arg database.UpdateMemberRolesParams) (database.OrganizationMember, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.OrganizationMember{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, mem := range q.organizationMembers {
+		if mem.UserID == arg.UserID && mem.OrganizationID == arg.OrgID {
+			uniqueRoles := make([]string, 0, len(arg.GrantedRoles))
+			exist := make(map[string]struct{})
+			for _, r := range arg.GrantedRoles {
+				if _, ok := exist[r]; ok {
+					continue
+				}
+				exist[r] = struct{}{}
+				uniqueRoles = append(uniqueRoles, r)
+			}
+			sort.Strings(uniqueRoles)
+
+			mem.Roles = uniqueRoles
+			q.organizationMembers[i] = mem
+			return mem, nil
+		}
+	}
+
+	return database.OrganizationMember{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateProvisionerJobByID(_ context.Context, arg database.UpdateProvisionerJobByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, job := range q.provisionerJobs {
+		if arg.ID != job.ID {
+			continue
+		}
+		job.UpdatedAt = arg.UpdatedAt
+		job.JobStatus = provisonerJobStatus(job)
+		q.provisionerJobs[index] = job
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateProvisionerJobWithCancelByID(_ context.Context, arg database.UpdateProvisionerJobWithCancelByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, job := range q.provisionerJobs {
+		if arg.ID != job.ID {
+			continue
+		}
+		job.CanceledAt = arg.CanceledAt
+		job.CompletedAt = arg.CompletedAt
+		job.JobStatus = provisonerJobStatus(job)
+		q.provisionerJobs[index] = job
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateProvisionerJobWithCompleteByID(_ context.Context, arg database.UpdateProvisionerJobWithCompleteByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, job := range q.provisionerJobs {
+		if arg.ID != job.ID {
+			continue
+		}
+		job.UpdatedAt = arg.UpdatedAt
+		job.CompletedAt = arg.CompletedAt
+		job.Error = arg.Error
+		job.ErrorCode = arg.ErrorCode
+		job.JobStatus = provisonerJobStatus(job)
+		q.provisionerJobs[index] = job
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateReplica(_ context.Context, arg database.UpdateReplicaParams) (database.Replica, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.Replica{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, replica := range q.replicas {
+		if replica.ID != arg.ID {
+			continue
+		}
+		replica.Hostname = arg.Hostname
+		replica.StartedAt = arg.StartedAt
+		replica.StoppedAt = arg.StoppedAt
+		replica.UpdatedAt = arg.UpdatedAt
+		replica.RelayAddress = arg.RelayAddress
+		replica.RegionID = arg.RegionID
+		replica.Version = arg.Version
+		replica.Error = arg.Error
+		replica.DatabaseLatency = arg.DatabaseLatency
+		replica.Primary = arg.Primary
+		q.replicas[index] = replica
+		return replica, nil
+	}
+	return database.Replica{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateTemplateACLByID(_ context.Context, arg database.UpdateTemplateACLByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, template := range q.templates {
+		if template.ID == arg.ID {
+			template.GroupACL = arg.GroupACL
+			template.UserACL = arg.UserACL
+
+			q.templates[i] = template
+			return nil
+		}
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateTemplateAccessControlByID(_ context.Context, arg database.UpdateTemplateAccessControlByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for idx, tpl := range q.templates {
+		if tpl.ID != arg.ID {
+			continue
+		}
+		q.templates[idx].RequireActiveVersion = arg.RequireActiveVersion
+		return nil
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateTemplateActiveVersionByID(_ context.Context, arg database.UpdateTemplateActiveVersionByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, template := range q.templates {
+		if template.ID != arg.ID {
+			continue
+		}
+		template.ActiveVersionID = arg.ActiveVersionID
+		template.UpdatedAt = arg.UpdatedAt
+		q.templates[index] = template
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateTemplateDeletedByID(_ context.Context, arg database.UpdateTemplateDeletedByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, template := range q.templates {
+		if template.ID != arg.ID {
+			continue
+		}
+		template.Deleted = arg.Deleted
+		template.UpdatedAt = arg.UpdatedAt
+		q.templates[index] = template
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateTemplateMetaByID(_ context.Context, arg database.UpdateTemplateMetaByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for idx, tpl := range q.templates {
+		if tpl.ID != arg.ID {
+			continue
+		}
+		tpl.UpdatedAt = dbtime.Now()
+		tpl.Name = arg.Name
+		tpl.DisplayName = arg.DisplayName
+		tpl.Description = arg.Description
+		tpl.Icon = arg.Icon
+		q.templates[idx] = tpl
+		return nil
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateTemplateScheduleByID(_ context.Context, arg database.UpdateTemplateScheduleByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for idx, tpl := range q.templates {
+		if tpl.ID != arg.ID {
+			continue
+		}
+		tpl.AllowUserAutostart = arg.AllowUserAutostart
+		tpl.AllowUserAutostop = arg.AllowUserAutostop
+		tpl.UpdatedAt = dbtime.Now()
+		tpl.DefaultTTL = arg.DefaultTTL
+		tpl.MaxTTL = arg.MaxTTL
+		tpl.AutostopRequirementDaysOfWeek = arg.AutostopRequirementDaysOfWeek
+		tpl.AutostopRequirementWeeks = arg.AutostopRequirementWeeks
+		tpl.AutostartBlockDaysOfWeek = arg.AutostartBlockDaysOfWeek
+		tpl.FailureTTL = arg.FailureTTL
+		tpl.TimeTilDormant = arg.TimeTilDormant
+		tpl.TimeTilDormantAutoDelete = arg.TimeTilDormantAutoDelete
+		q.templates[idx] = tpl
+		return nil
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateTemplateVersionByID(_ context.Context, arg database.UpdateTemplateVersionByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, templateVersion := range q.templateVersions {
+		if templateVersion.ID != arg.ID {
+			continue
+		}
+		templateVersion.TemplateID = arg.TemplateID
+		templateVersion.UpdatedAt = arg.UpdatedAt
+		templateVersion.Name = arg.Name
+		templateVersion.Message = arg.Message
+		q.templateVersions[index] = templateVersion
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateTemplateVersionDescriptionByJobID(_ context.Context, arg database.UpdateTemplateVersionDescriptionByJobIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, templateVersion := range q.templateVersions {
+		if templateVersion.JobID != arg.JobID {
+			continue
+		}
+		templateVersion.Readme = arg.Readme
+		templateVersion.UpdatedAt = arg.UpdatedAt
+		q.templateVersions[index] = templateVersion
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateTemplateVersionExternalAuthProvidersByJobID(_ context.Context, arg database.UpdateTemplateVersionExternalAuthProvidersByJobIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, templateVersion := range q.templateVersions {
+		if templateVersion.JobID != arg.JobID {
+			continue
+		}
+		templateVersion.ExternalAuthProviders = arg.ExternalAuthProviders
+		templateVersion.UpdatedAt = arg.UpdatedAt
+		q.templateVersions[index] = templateVersion
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateTemplateWorkspacesLastUsedAt(_ context.Context, arg database.UpdateTemplateWorkspacesLastUsedAtParams) error {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, ws := range q.workspaces {
+		if ws.TemplateID != arg.TemplateID {
+			continue
+		}
+		ws.LastUsedAt = arg.LastUsedAt
+		q.workspaces[i] = ws
+	}
+
+	return nil
+}
+
+func (q *FakeQuerier) UpdateUserDeletedByID(_ context.Context, params database.UpdateUserDeletedByIDParams) error {
+	if err := validateDatabaseType(params); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, u := range q.users {
+		if u.ID == params.ID {
+			u.Deleted = params.Deleted
+			q.users[i] = u
+			// NOTE: In the real world, this is done by a trigger.
+			i := 0
+			for {
+				if i >= len(q.apiKeys) {
+					break
+				}
+				k := q.apiKeys[i]
+				if k.UserID == u.ID {
+					q.apiKeys[i] = q.apiKeys[len(q.apiKeys)-1]
+					q.apiKeys = q.apiKeys[:len(q.apiKeys)-1]
+					// We removed an element, so decrement
+					i--
+				}
+				i++
+			}
+			return nil
+		}
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateUserHashedPassword(_ context.Context, arg database.UpdateUserHashedPasswordParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, user := range q.users {
+		if user.ID != arg.ID {
+			continue
+		}
+		user.HashedPassword = arg.HashedPassword
+		q.users[i] = user
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateUserLastSeenAt(_ context.Context, arg database.UpdateUserLastSeenAtParams) (database.User, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.User{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, user := range q.users {
+		if user.ID != arg.ID {
+			continue
+		}
+		user.LastSeenAt = arg.LastSeenAt
+		user.UpdatedAt = arg.UpdatedAt
+		q.users[index] = user
+		return user, nil
+	}
+	return database.User{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateUserLink(_ context.Context, params database.UpdateUserLinkParams) (database.UserLink, error) {
+	if err := validateDatabaseType(params); err != nil {
+		return database.UserLink{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, link := range q.userLinks {
+		if link.UserID == params.UserID && link.LoginType == params.LoginType {
+			link.OAuthAccessToken = params.OAuthAccessToken
+			link.OAuthAccessTokenKeyID = params.OAuthAccessTokenKeyID
+			link.OAuthRefreshToken = params.OAuthRefreshToken
+			link.OAuthRefreshTokenKeyID = params.OAuthRefreshTokenKeyID
+			link.OAuthExpiry = params.OAuthExpiry
+
+			q.userLinks[i] = link
+			return link, nil
+		}
+	}
+
+	return database.UserLink{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateUserLinkedID(_ context.Context, params database.UpdateUserLinkedIDParams) (database.UserLink, error) {
+	if err := validateDatabaseType(params); err != nil {
+		return database.UserLink{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, link := range q.userLinks {
+		if link.UserID == params.UserID && link.LoginType == params.LoginType {
+			link.LinkedID = params.LinkedID
+
+			q.userLinks[i] = link
+			return link, nil
+		}
+	}
+
+	return database.UserLink{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateUserLoginType(_ context.Context, arg database.UpdateUserLoginTypeParams) (database.User, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.User{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, u := range q.users {
+		if u.ID == arg.UserID {
+			u.LoginType = arg.NewLoginType
+			if arg.NewLoginType != database.LoginTypePassword {
+				u.HashedPassword = []byte{}
+			}
+			q.users[i] = u
+			return u, nil
+		}
+	}
+	return database.User{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateUserProfile(_ context.Context, arg database.UpdateUserProfileParams) (database.User, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.User{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, user := range q.users {
+		if user.ID != arg.ID {
+			continue
+		}
+		user.Email = arg.Email
+		user.Username = arg.Username
+		user.AvatarURL = arg.AvatarURL
+		q.users[index] = user
+		return user, nil
+	}
+	return database.User{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateUserQuietHoursSchedule(_ context.Context, arg database.UpdateUserQuietHoursScheduleParams) (database.User, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.User{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, user := range q.users {
+		if user.ID != arg.ID {
+			continue
+		}
+		user.QuietHoursSchedule = arg.QuietHoursSchedule
+		q.users[index] = user
+		return user, nil
+	}
+	return database.User{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateUserRoles(_ context.Context, arg database.UpdateUserRolesParams) (database.User, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.User{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, user := range q.users {
+		if user.ID != arg.ID {
+			continue
+		}
+
+		// Set new roles
+		user.RBACRoles = arg.GrantedRoles
+		// Remove duplicates and sort
+		uniqueRoles := make([]string, 0, len(user.RBACRoles))
+		exist := make(map[string]struct{})
+		for _, r := range user.RBACRoles {
+			if _, ok := exist[r]; ok {
+				continue
+			}
+			exist[r] = struct{}{}
+			uniqueRoles = append(uniqueRoles, r)
+		}
+		sort.Strings(uniqueRoles)
+		user.RBACRoles = uniqueRoles
+
+		q.users[index] = user
+		return user, nil
+	}
+	return database.User{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateUserStatus(_ context.Context, arg database.UpdateUserStatusParams) (database.User, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.User{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, user := range q.users {
+		if user.ID != arg.ID {
+			continue
+		}
+		user.Status = arg.Status
+		user.UpdatedAt = arg.UpdatedAt
+		q.users[index] = user
+		return user, nil
+	}
+	return database.User{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspace(_ context.Context, arg database.UpdateWorkspaceParams) (database.Workspace, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.Workspace{}, err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, workspace := range q.workspaces {
+		if workspace.Deleted || workspace.ID != arg.ID {
+			continue
+		}
+		for _, other := range q.workspaces {
+			if other.Deleted || other.ID == workspace.ID || workspace.OwnerID != other.OwnerID {
+				continue
+			}
+			if other.Name == arg.Name {
+				return database.Workspace{}, errDuplicateKey
+			}
+		}
+
+		workspace.Name = arg.Name
+		q.workspaces[i] = workspace
+
+		return workspace, nil
+	}
+
+	return database.Workspace{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceAgentConnectionByID(_ context.Context, arg database.UpdateWorkspaceAgentConnectionByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, agent := range q.workspaceAgents {
+		if agent.ID != arg.ID {
+			continue
+		}
+		agent.FirstConnectedAt = arg.FirstConnectedAt
+		agent.LastConnectedAt = arg.LastConnectedAt
+		agent.DisconnectedAt = arg.DisconnectedAt
+		agent.UpdatedAt = arg.UpdatedAt
+		q.workspaceAgents[index] = agent
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceAgentLifecycleStateByID(_ context.Context, arg database.UpdateWorkspaceAgentLifecycleStateByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+	for i, agent := range q.workspaceAgents {
+		if agent.ID == arg.ID {
+			agent.LifecycleState = arg.LifecycleState
+			agent.StartedAt = arg.StartedAt
+			agent.ReadyAt = arg.ReadyAt
+			q.workspaceAgents[i] = agent
+			return nil
+		}
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceAgentLogOverflowByID(_ context.Context, arg database.UpdateWorkspaceAgentLogOverflowByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+	for i, agent := range q.workspaceAgents {
+		if agent.ID == arg.ID {
+			agent.LogsOverflowed = arg.LogsOverflowed
+			q.workspaceAgents[i] = agent
+			return nil
+		}
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceAgentMetadata(_ context.Context, arg database.UpdateWorkspaceAgentMetadataParams) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, m := range q.workspaceAgentMetadata {
+		if m.WorkspaceAgentID != arg.WorkspaceAgentID {
+			continue
+		}
+		for j := 0; j < len(arg.Key); j++ {
+			if m.Key == arg.Key[j] {
+				q.workspaceAgentMetadata[i].Value = arg.Value[j]
+				q.workspaceAgentMetadata[i].Error = arg.Error[j]
+				q.workspaceAgentMetadata[i].CollectedAt = arg.CollectedAt[j]
+				return nil
+			}
+		}
+	}
+
+	return nil
+}
+
+func (q *FakeQuerier) UpdateWorkspaceAgentStartupByID(_ context.Context, arg database.UpdateWorkspaceAgentStartupByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	if len(arg.Subsystems) > 0 {
+		seen := map[database.WorkspaceAgentSubsystem]struct{}{
+			arg.Subsystems[0]: {},
+		}
+		for i := 1; i < len(arg.Subsystems); i++ {
+			s := arg.Subsystems[i]
+			if _, ok := seen[s]; ok {
+				return xerrors.Errorf("duplicate subsystem %q", s)
+			}
+			seen[s] = struct{}{}
+
+			if arg.Subsystems[i-1] > arg.Subsystems[i] {
+				return xerrors.Errorf("subsystems not sorted: %q > %q", arg.Subsystems[i-1], arg.Subsystems[i])
+			}
+		}
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, agent := range q.workspaceAgents {
+		if agent.ID != arg.ID {
+			continue
+		}
+
+		agent.Version = arg.Version
+		agent.ExpandedDirectory = arg.ExpandedDirectory
+		agent.Subsystems = arg.Subsystems
+		q.workspaceAgents[index] = agent
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceAppHealthByID(_ context.Context, arg database.UpdateWorkspaceAppHealthByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, app := range q.workspaceApps {
+		if app.ID != arg.ID {
+			continue
+		}
+		app.Health = arg.Health
+		q.workspaceApps[index] = app
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceAutomaticUpdates(_ context.Context, arg database.UpdateWorkspaceAutomaticUpdatesParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, workspace := range q.workspaces {
+		if workspace.ID != arg.ID {
+			continue
+		}
+		workspace.AutomaticUpdates = arg.AutomaticUpdates
+		q.workspaces[index] = workspace
+		return nil
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceAutostart(_ context.Context, arg database.UpdateWorkspaceAutostartParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, workspace := range q.workspaces {
+		if workspace.ID != arg.ID {
+			continue
+		}
+		workspace.AutostartSchedule = arg.AutostartSchedule
+		q.workspaces[index] = workspace
+		return nil
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceBuildCostByID(_ context.Context, arg database.UpdateWorkspaceBuildCostByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, workspaceBuild := range q.workspaceBuilds {
+		if workspaceBuild.ID != arg.ID {
+			continue
+		}
+		workspaceBuild.DailyCost = arg.DailyCost
+		q.workspaceBuilds[index] = workspaceBuild
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceBuildDeadlineByID(_ context.Context, arg database.UpdateWorkspaceBuildDeadlineByIDParams) error {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for idx, build := range q.workspaceBuilds {
+		if build.ID != arg.ID {
+			continue
+		}
+		build.Deadline = arg.Deadline
+		build.MaxDeadline = arg.MaxDeadline
+		build.UpdatedAt = arg.UpdatedAt
+		q.workspaceBuilds[idx] = build
+		return nil
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceBuildProvisionerStateByID(_ context.Context, arg database.UpdateWorkspaceBuildProvisionerStateByIDParams) error {
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for idx, build := range q.workspaceBuilds {
+		if build.ID != arg.ID {
+			continue
+		}
+		build.ProvisionerState = arg.ProvisionerState
+		build.UpdatedAt = arg.UpdatedAt
+		q.workspaceBuilds[idx] = build
+		return nil
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceDeletedByID(_ context.Context, arg database.UpdateWorkspaceDeletedByIDParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, workspace := range q.workspaces {
+		if workspace.ID != arg.ID {
+			continue
+		}
+		workspace.Deleted = arg.Deleted
+		q.workspaces[index] = workspace
+		return nil
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceDormantDeletingAt(_ context.Context, arg database.UpdateWorkspaceDormantDeletingAtParams) (database.Workspace, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return database.Workspace{}, err
+	}
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+	for index, workspace := range q.workspaces {
+		if workspace.ID != arg.ID {
+			continue
+		}
+		workspace.DormantAt = arg.DormantAt
+		if workspace.DormantAt.Time.IsZero() {
+			workspace.LastUsedAt = dbtime.Now()
+			workspace.DeletingAt = sql.NullTime{}
+		}
+		if !workspace.DormantAt.Time.IsZero() {
+			var template database.TemplateTable
+			for _, t := range q.templates {
+				if t.ID == workspace.TemplateID {
+					template = t
+					break
+				}
+			}
+			if template.ID == uuid.Nil {
+				return database.Workspace{}, xerrors.Errorf("unable to find workspace template")
+			}
+			if template.TimeTilDormantAutoDelete > 0 {
+				workspace.DeletingAt = sql.NullTime{
+					Valid: true,
+					Time:  workspace.DormantAt.Time.Add(time.Duration(template.TimeTilDormantAutoDelete)),
+				}
+			}
+		}
+		q.workspaces[index] = workspace
+		return workspace, nil
+	}
+	return database.Workspace{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceLastUsedAt(_ context.Context, arg database.UpdateWorkspaceLastUsedAtParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, workspace := range q.workspaces {
+		if workspace.ID != arg.ID {
+			continue
+		}
+		workspace.LastUsedAt = arg.LastUsedAt
+		q.workspaces[index] = workspace
+		return nil
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceProxy(_ context.Context, arg database.UpdateWorkspaceProxyParams) (database.WorkspaceProxy, error) {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for _, p := range q.workspaceProxies {
+		if p.Name == arg.Name && p.ID != arg.ID {
+			return database.WorkspaceProxy{}, errDuplicateKey
+		}
+	}
+
+	for i, p := range q.workspaceProxies {
+		if p.ID == arg.ID {
+			p.Name = arg.Name
+			p.DisplayName = arg.DisplayName
+			p.Icon = arg.Icon
+			if len(p.TokenHashedSecret) > 0 {
+				p.TokenHashedSecret = arg.TokenHashedSecret
+			}
+			q.workspaceProxies[i] = p
+			return p, nil
+		}
+	}
+	return database.WorkspaceProxy{}, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceProxyDeleted(_ context.Context, arg database.UpdateWorkspaceProxyDeletedParams) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for i, p := range q.workspaceProxies {
+		if p.ID == arg.ID {
+			p.Deleted = arg.Deleted
+			p.UpdatedAt = dbtime.Now()
+			q.workspaceProxies[i] = p
+			return nil
+		}
+	}
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspaceTTL(_ context.Context, arg database.UpdateWorkspaceTTLParams) error {
+	if err := validateDatabaseType(arg); err != nil {
+		return err
+	}
+
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	for index, workspace := range q.workspaces {
+		if workspace.ID != arg.ID {
+			continue
+		}
+		workspace.Ttl = arg.Ttl
+		q.workspaces[index] = workspace
+		return nil
+	}
+
+	return sql.ErrNoRows
+}
+
+func (q *FakeQuerier) UpdateWorkspacesDormantDeletingAtByTemplateID(_ context.Context, arg database.UpdateWorkspacesDormantDeletingAtByTemplateIDParams) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	err := validateDatabaseType(arg)
+	if err != nil {
+		return err
+	}
+
+	for i, ws := range q.workspaces {
+		if ws.TemplateID != arg.TemplateID {
+			continue
+		}
+
+		if ws.DormantAt.Time.IsZero() {
+			continue
+		}
+
+		if !arg.DormantAt.IsZero() {
+			ws.DormantAt = sql.NullTime{
+				Valid: true,
+				Time:  arg.DormantAt,
+			}
+		}
+
+		deletingAt := sql.NullTime{
+			Valid: arg.TimeTilDormantAutodeleteMs > 0,
+		}
+		if arg.TimeTilDormantAutodeleteMs > 0 {
+			deletingAt.Time = ws.DormantAt.Time.Add(time.Duration(arg.TimeTilDormantAutodeleteMs) * time.Millisecond)
+		}
+		ws.DeletingAt = deletingAt
+		q.workspaces[i] = ws
+	}
+
+	return nil
+}
+
+func (q *FakeQuerier) UpsertAppSecurityKey(_ context.Context, data string) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	q.appSecurityKey = data
+	return nil
+}
+
+func (q *FakeQuerier) UpsertApplicationName(_ context.Context, data string) error {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	q.applicationName = data
+	return nil
+}
+
+func (q *FakeQuerier) UpsertDefaultProxy(_ context.Context, arg database.UpsertDefaultProxyParams) error {
+	q.defaultProxyDisplayName = arg.DisplayName
+	q.defaultProxyIconURL = arg.IconUrl
+	return nil
+}
+
+func (q *FakeQuerier) UpsertLastUpdateCheck(_ context.Context, data string) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	q.lastUpdateCheck = []byte(data)
+	return nil
+}
+
+func (q *FakeQuerier) UpsertLogoURL(_ context.Context, data string) error {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	q.logoURL = data
+	return nil
+}
+
+func (q *FakeQuerier) UpsertOAuthSigningKey(_ context.Context, value string) error {
+	q.mutex.Lock()
+	defer q.mutex.Unlock()
+
+	q.oauthSigningKey = value
+	return nil
+}
+
+func (q *FakeQuerier) UpsertServiceBanner(_ context.Context, data string) error {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	q.serviceBanner = []byte(data)
+	return nil
+}
+
+func (*FakeQuerier) UpsertTailnetAgent(context.Context, database.UpsertTailnetAgentParams) (database.TailnetAgent, error) {
+	return database.TailnetAgent{}, ErrUnimplemented
+}
+
+func (*FakeQuerier) UpsertTailnetClient(context.Context, database.UpsertTailnetClientParams) (database.TailnetClient, error) {
+	return database.TailnetClient{}, ErrUnimplemented
+}
+
+func (*FakeQuerier) UpsertTailnetClientSubscription(context.Context, database.UpsertTailnetClientSubscriptionParams) error {
+	return ErrUnimplemented
+}
+
+func (*FakeQuerier) UpsertTailnetCoordinator(context.Context, uuid.UUID) (database.TailnetCoordinator, error) {
+	return database.TailnetCoordinator{}, ErrUnimplemented
+}
+
+func (q *FakeQuerier) GetAuthorizedTemplates(ctx context.Context, arg database.GetTemplatesWithFilterParams, prepared rbac.PreparedAuthorized) ([]database.Template, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	// Call this to match the same function calls as the SQL implementation.
+	if prepared != nil {
+		_, err := prepared.CompileToSQL(ctx, rbac.ConfigWithACL())
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	var templates []database.Template
+	for _, templateTable := range q.templates {
+		template := q.templateWithUserNoLock(templateTable)
+		if prepared != nil && prepared.Authorize(ctx, template.RBACObject()) != nil {
+			continue
+		}
+
+		if template.Deleted != arg.Deleted {
+			continue
+		}
+		if arg.OrganizationID != uuid.Nil && template.OrganizationID != arg.OrganizationID {
+			continue
+		}
+
+		if arg.ExactName != "" && !strings.EqualFold(template.Name, arg.ExactName) {
+			continue
+		}
+
+		if len(arg.IDs) > 0 {
+			match := false
+			for _, id := range arg.IDs {
+				if template.ID == id {
+					match = true
+					break
+				}
+			}
+			if !match {
+				continue
+			}
+		}
+		templates = append(templates, template)
+	}
+	if len(templates) > 0 {
+		slices.SortFunc(templates, func(a, b database.Template) int {
+			if a.Name != b.Name {
+				return slice.Ascending(a.Name, b.Name)
+			}
+			return slice.Ascending(a.ID.String(), b.ID.String())
+		})
+		return templates, nil
+	}
+
+	return nil, sql.ErrNoRows
+}
+
+func (q *FakeQuerier) GetTemplateGroupRoles(_ context.Context, id uuid.UUID) ([]database.TemplateGroup, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	var template database.TemplateTable
+	for _, t := range q.templates {
+		if t.ID == id {
+			template = t
+			break
+		}
+	}
+
+	if template.ID == uuid.Nil {
+		return nil, sql.ErrNoRows
+	}
+
+	groups := make([]database.TemplateGroup, 0, len(template.GroupACL))
+	for k, v := range template.GroupACL {
+		group, err := q.getGroupByIDNoLock(context.Background(), uuid.MustParse(k))
+		if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
+			return nil, xerrors.Errorf("get group by ID: %w", err)
+		}
+		// We don't delete groups from the map if they
+		// get deleted so just skip.
+		if xerrors.Is(err, sql.ErrNoRows) {
+			continue
+		}
+
+		groups = append(groups, database.TemplateGroup{
+			Group:   group,
+			Actions: v,
+		})
+	}
+
+	return groups, nil
+}
+
+func (q *FakeQuerier) GetTemplateUserRoles(_ context.Context, id uuid.UUID) ([]database.TemplateUser, error) {
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	var template database.TemplateTable
+	for _, t := range q.templates {
+		if t.ID == id {
+			template = t
+			break
+		}
+	}
+
+	if template.ID == uuid.Nil {
+		return nil, sql.ErrNoRows
+	}
+
+	users := make([]database.TemplateUser, 0, len(template.UserACL))
+	for k, v := range template.UserACL {
+		user, err := q.getUserByIDNoLock(uuid.MustParse(k))
+		if err != nil && xerrors.Is(err, sql.ErrNoRows) {
+			return nil, xerrors.Errorf("get user by ID: %w", err)
+		}
+		// We don't delete users from the map if they
+		// get deleted so just skip.
+		if xerrors.Is(err, sql.ErrNoRows) {
+			continue
+		}
+
+		if user.Deleted || user.Status == database.UserStatusSuspended {
+			continue
+		}
+
+		users = append(users, database.TemplateUser{
+			User:    user,
+			Actions: v,
+		})
+	}
+
+	return users, nil
+}
+
+func (q *FakeQuerier) GetAuthorizedWorkspaces(ctx context.Context, arg database.GetWorkspacesParams, prepared rbac.PreparedAuthorized) ([]database.GetWorkspacesRow, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	if prepared != nil {
+		// Call this to match the same function calls as the SQL implementation.
+		_, err := prepared.CompileToSQL(ctx, rbac.ConfigWithoutACL())
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	workspaces := make([]database.Workspace, 0)
+	for _, workspace := range q.workspaces {
+		if arg.OwnerID != uuid.Nil && workspace.OwnerID != arg.OwnerID {
+			continue
+		}
+
+		if arg.OwnerUsername != "" {
+			owner, err := q.getUserByIDNoLock(workspace.OwnerID)
+			if err == nil && !strings.EqualFold(arg.OwnerUsername, owner.Username) {
+				continue
+			}
+		}
+
+		if arg.TemplateName != "" {
+			template, err := q.getTemplateByIDNoLock(ctx, workspace.TemplateID)
+			if err == nil && !strings.EqualFold(arg.TemplateName, template.Name) {
+				continue
+			}
+		}
+
+		if !arg.Deleted && workspace.Deleted {
+			continue
+		}
+
+		if arg.Name != "" && !strings.Contains(strings.ToLower(workspace.Name), strings.ToLower(arg.Name)) {
+			continue
+		}
+
+		if !arg.LastUsedBefore.IsZero() {
+			if workspace.LastUsedAt.After(arg.LastUsedBefore) {
+				continue
+			}
+		}
+
+		if !arg.LastUsedAfter.IsZero() {
+			if workspace.LastUsedAt.Before(arg.LastUsedAfter) {
+				continue
+			}
+		}
+
+		if arg.Status != "" {
+			build, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspace.ID)
+			if err != nil {
+				return nil, xerrors.Errorf("get latest build: %w", err)
+			}
+
+			job, err := q.getProvisionerJobByIDNoLock(ctx, build.JobID)
+			if err != nil {
+				return nil, xerrors.Errorf("get provisioner job: %w", err)
+			}
+
+			// This logic should match the logic in the workspace.sql file.
+			var statusMatch bool
+			switch database.WorkspaceStatus(arg.Status) {
+			case database.WorkspaceStatusStarting:
+				statusMatch = job.JobStatus == database.ProvisionerJobStatusRunning &&
+					build.Transition == database.WorkspaceTransitionStart
+			case database.WorkspaceStatusStopping:
+				statusMatch = job.JobStatus == database.ProvisionerJobStatusRunning &&
+					build.Transition == database.WorkspaceTransitionStop
+			case database.WorkspaceStatusDeleting:
+				statusMatch = job.JobStatus == database.ProvisionerJobStatusRunning &&
+					build.Transition == database.WorkspaceTransitionDelete
+
+			case "started":
+				statusMatch = job.JobStatus == database.ProvisionerJobStatusSucceeded &&
+					build.Transition == database.WorkspaceTransitionStart
+			case database.WorkspaceStatusDeleted:
+				statusMatch = job.JobStatus == database.ProvisionerJobStatusSucceeded &&
+					build.Transition == database.WorkspaceTransitionDelete
+			case database.WorkspaceStatusStopped:
+				statusMatch = job.JobStatus == database.ProvisionerJobStatusSucceeded &&
+					build.Transition == database.WorkspaceTransitionStop
+			case database.WorkspaceStatusRunning:
+				statusMatch = job.JobStatus == database.ProvisionerJobStatusSucceeded &&
+					build.Transition == database.WorkspaceTransitionStart
+			default:
+				statusMatch = job.JobStatus == database.ProvisionerJobStatus(arg.Status)
+			}
+			if !statusMatch {
+				continue
+			}
+		}
+
+		if arg.HasAgent != "" {
+			build, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, workspace.ID)
+			if err != nil {
+				return nil, xerrors.Errorf("get latest build: %w", err)
+			}
+
+			job, err := q.getProvisionerJobByIDNoLock(ctx, build.JobID)
+			if err != nil {
+				return nil, xerrors.Errorf("get provisioner job: %w", err)
+			}
+
+			workspaceResources, err := q.getWorkspaceResourcesByJobIDNoLock(ctx, job.ID)
+			if err != nil {
+				return nil, xerrors.Errorf("get workspace resources: %w", err)
+			}
+
+			var workspaceResourceIDs []uuid.UUID
+			for _, wr := range workspaceResources {
+				workspaceResourceIDs = append(workspaceResourceIDs, wr.ID)
+			}
+
+			workspaceAgents, err := q.getWorkspaceAgentsByResourceIDsNoLock(ctx, workspaceResourceIDs)
+			if err != nil {
+				return nil, xerrors.Errorf("get workspace agents: %w", err)
+			}
+
+			var hasAgentMatched bool
+			for _, wa := range workspaceAgents {
+				if mapAgentStatus(wa, arg.AgentInactiveDisconnectTimeoutSeconds) == arg.HasAgent {
+					hasAgentMatched = true
+				}
+			}
+
+			if !hasAgentMatched {
+				continue
+			}
+		}
+
+		// We omit locked workspaces by default.
+		if arg.IsDormant == "" && workspace.DormantAt.Valid {
+			continue
+		}
+
+		if arg.IsDormant != "" && !workspace.DormantAt.Valid {
+			continue
+		}
+
+		if len(arg.TemplateIDs) > 0 {
+			match := false
+			for _, id := range arg.TemplateIDs {
+				if workspace.TemplateID == id {
+					match = true
+					break
+				}
+			}
+			if !match {
+				continue
+			}
+		}
+
+		// If the filter exists, ensure the object is authorized.
+		if prepared != nil && prepared.Authorize(ctx, workspace.RBACObject()) != nil {
+			continue
+		}
+		workspaces = append(workspaces, workspace)
+	}
+
+	// Sort workspaces (ORDER BY)
+	isRunning := func(build database.WorkspaceBuild, job database.ProvisionerJob) bool {
+		return job.CompletedAt.Valid && !job.CanceledAt.Valid && !job.Error.Valid && build.Transition == database.WorkspaceTransitionStart
+	}
+
+	preloadedWorkspaceBuilds := map[uuid.UUID]database.WorkspaceBuild{}
+	preloadedProvisionerJobs := map[uuid.UUID]database.ProvisionerJob{}
+	preloadedUsers := map[uuid.UUID]database.User{}
+
+	for _, w := range workspaces {
+		build, err := q.getLatestWorkspaceBuildByWorkspaceIDNoLock(ctx, w.ID)
+		if err == nil {
+			preloadedWorkspaceBuilds[w.ID] = build
+		} else if !errors.Is(err, sql.ErrNoRows) {
+			return nil, xerrors.Errorf("get latest build: %w", err)
+		}
+
+		job, err := q.getProvisionerJobByIDNoLock(ctx, build.JobID)
+		if err == nil {
+			preloadedProvisionerJobs[w.ID] = job
+		} else if !errors.Is(err, sql.ErrNoRows) {
+			return nil, xerrors.Errorf("get provisioner job: %w", err)
+		}
+
+		user, err := q.getUserByIDNoLock(w.OwnerID)
+		if err == nil {
+			preloadedUsers[w.ID] = user
+		} else if !errors.Is(err, sql.ErrNoRows) {
+			return nil, xerrors.Errorf("get user: %w", err)
+		}
+	}
+
+	sort.Slice(workspaces, func(i, j int) bool {
+		w1 := workspaces[i]
+		w2 := workspaces[j]
+
+		// Order by: running first
+		w1IsRunning := isRunning(preloadedWorkspaceBuilds[w1.ID], preloadedProvisionerJobs[w1.ID])
+		w2IsRunning := isRunning(preloadedWorkspaceBuilds[w2.ID], preloadedProvisionerJobs[w2.ID])
+
+		if w1IsRunning && !w2IsRunning {
+			return true
+		}
+
+		if !w1IsRunning && w2IsRunning {
+			return false
+		}
+
+		// Order by: usernames
+		if w1.ID != w2.ID {
+			return sort.StringsAreSorted([]string{preloadedUsers[w1.ID].Username, preloadedUsers[w2.ID].Username})
+		}
+
+		// Order by: workspace names
+		return sort.StringsAreSorted([]string{w1.Name, w2.Name})
+	})
+
+	beforePageCount := len(workspaces)
+
+	if arg.Offset > 0 {
+		if int(arg.Offset) > len(workspaces) {
+			return []database.GetWorkspacesRow{}, nil
+		}
+		workspaces = workspaces[arg.Offset:]
+	}
+	if arg.Limit > 0 {
+		if int(arg.Limit) > len(workspaces) {
+			return q.convertToWorkspaceRowsNoLock(ctx, workspaces, int64(beforePageCount)), nil
+		}
+		workspaces = workspaces[:arg.Limit]
+	}
+
+	return q.convertToWorkspaceRowsNoLock(ctx, workspaces, int64(beforePageCount)), nil
+}
+
+func (q *FakeQuerier) GetAuthorizedUsers(ctx context.Context, arg database.GetUsersParams, prepared rbac.PreparedAuthorized) ([]database.GetUsersRow, error) {
+	if err := validateDatabaseType(arg); err != nil {
+		return nil, err
+	}
+
+	// Call this to match the same function calls as the SQL implementation.
+	if prepared != nil {
+		_, err := prepared.CompileToSQL(ctx, regosql.ConvertConfig{
+			VariableConverter: regosql.UserConverter(),
+		})
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	users, err := q.GetUsers(ctx, arg)
+	if err != nil {
+		return nil, err
+	}
+
+	q.mutex.RLock()
+	defer q.mutex.RUnlock()
+
+	filteredUsers := make([]database.GetUsersRow, 0, len(users))
+	for _, user := range users {
+		// If the filter exists, ensure the object is authorized.
+		if prepared != nil && prepared.Authorize(ctx, user.RBACObject()) != nil {
+			continue
+		}
+
+		filteredUsers = append(filteredUsers, user)
+	}
+	return filteredUsers, nil
+}
diff --git a/coderd/database/dbmem/dbmem_test.go b/coderd/database/dbmem/dbmem_test.go
new file mode 100644
index 0000000000000..e7d7bd76bd132
--- /dev/null
+++ b/coderd/database/dbmem/dbmem_test.go
@@ -0,0 +1,210 @@
+package dbmem_test
+
+import (
+	"context"
+	"database/sql"
+	"sort"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+)
+
+// test that transactions don't deadlock, and that we don't see intermediate state.
+func TestInTx(t *testing.T) {
+	t.Parallel()
+
+	uut := dbmem.New()
+
+	inTx := make(chan any)
+	queriesDone := make(chan any)
+	queriesStarted := make(chan any)
+	go func() {
+		err := uut.InTx(func(tx database.Store) error {
+			close(inTx)
+			_, err := tx.InsertOrganization(context.Background(), database.InsertOrganizationParams{
+				Name: "1",
+			})
+			assert.NoError(t, err)
+			<-queriesStarted
+			time.Sleep(5 * time.Millisecond)
+			_, err = tx.InsertOrganization(context.Background(), database.InsertOrganizationParams{
+				Name: "2",
+			})
+			assert.NoError(t, err)
+			return nil
+		}, nil)
+		assert.NoError(t, err)
+	}()
+	var nums []int
+	go func() {
+		<-inTx
+		for i := 0; i < 20; i++ {
+			orgs, err := uut.GetOrganizations(context.Background())
+			if err != nil {
+				assert.ErrorIs(t, err, sql.ErrNoRows)
+			}
+			nums = append(nums, len(orgs))
+			time.Sleep(time.Millisecond)
+		}
+		close(queriesDone)
+	}()
+	close(queriesStarted)
+	<-queriesDone
+	// ensure we never saw 1 org, only 0 or 2.
+	for i := 0; i < 20; i++ {
+		assert.NotEqual(t, 1, nums[i])
+	}
+}
+
+// TestUserOrder ensures that the fake database returns users sorted by username.
+func TestUserOrder(t *testing.T) {
+	t.Parallel()
+
+	db := dbmem.New()
+	now := dbtime.Now()
+
+	usernames := []string{"b-user", "d-user", "a-user", "c-user", "e-user"}
+	for _, username := range usernames {
+		dbgen.User(t, db, database.User{Username: username, CreatedAt: now})
+	}
+
+	users, err := db.GetUsers(context.Background(), database.GetUsersParams{})
+	require.NoError(t, err)
+	require.Lenf(t, users, len(usernames), "expected %d users", len(usernames))
+
+	sort.Strings(usernames)
+	for i, user := range users {
+		require.Equal(t, usernames[i], user.Username)
+	}
+}
+
+func TestProxyByHostname(t *testing.T) {
+	t.Parallel()
+
+	db := dbmem.New()
+
+	// Insert a bunch of different proxies.
+	proxies := []struct {
+		name             string
+		accessURL        string
+		wildcardHostname string
+	}{
+		{
+			name:             "one",
+			accessURL:        "https://one.coder.com",
+			wildcardHostname: "*.wildcard.one.coder.com",
+		},
+		{
+			name:             "two",
+			accessURL:        "https://two.coder.com",
+			wildcardHostname: "*--suffix.two.coder.com",
+		},
+	}
+	for _, p := range proxies {
+		dbgen.WorkspaceProxy(t, db, database.WorkspaceProxy{
+			Name:             p.name,
+			Url:              p.accessURL,
+			WildcardHostname: p.wildcardHostname,
+		})
+	}
+
+	cases := []struct {
+		name              string
+		testHostname      string
+		allowAccessURL    bool
+		allowWildcardHost bool
+		matchProxyName    string
+	}{
+		{
+			name:              "NoMatch",
+			testHostname:      "test.com",
+			allowAccessURL:    true,
+			allowWildcardHost: true,
+			matchProxyName:    "",
+		},
+		{
+			name:              "MatchAccessURL",
+			testHostname:      "one.coder.com",
+			allowAccessURL:    true,
+			allowWildcardHost: true,
+			matchProxyName:    "one",
+		},
+		{
+			name:              "MatchWildcard",
+			testHostname:      "something.wildcard.one.coder.com",
+			allowAccessURL:    true,
+			allowWildcardHost: true,
+			matchProxyName:    "one",
+		},
+		{
+			name:              "MatchSuffix",
+			testHostname:      "something--suffix.two.coder.com",
+			allowAccessURL:    true,
+			allowWildcardHost: true,
+			matchProxyName:    "two",
+		},
+		{
+			name:              "ValidateHostname/1",
+			testHostname:      ".*ne.coder.com",
+			allowAccessURL:    true,
+			allowWildcardHost: true,
+			matchProxyName:    "",
+		},
+		{
+			name:              "ValidateHostname/2",
+			testHostname:      "https://one.coder.com",
+			allowAccessURL:    true,
+			allowWildcardHost: true,
+			matchProxyName:    "",
+		},
+		{
+			name:              "ValidateHostname/3",
+			testHostname:      "one.coder.com:8080/hello",
+			allowAccessURL:    true,
+			allowWildcardHost: true,
+			matchProxyName:    "",
+		},
+		{
+			name:              "IgnoreAccessURLMatch",
+			testHostname:      "one.coder.com",
+			allowAccessURL:    false,
+			allowWildcardHost: true,
+			matchProxyName:    "",
+		},
+		{
+			name:              "IgnoreWildcardMatch",
+			testHostname:      "hi.wildcard.one.coder.com",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "",
+		},
+	}
+
+	for _, c := range cases {
+		c := c
+		t.Run(c.name, func(t *testing.T) {
+			t.Parallel()
+
+			proxy, err := db.GetWorkspaceProxyByHostname(context.Background(), database.GetWorkspaceProxyByHostnameParams{
+				Hostname:              c.testHostname,
+				AllowAccessUrl:        c.allowAccessURL,
+				AllowWildcardHostname: c.allowWildcardHost,
+			})
+			if c.matchProxyName == "" {
+				require.ErrorIs(t, err, sql.ErrNoRows)
+				require.Empty(t, proxy)
+			} else {
+				require.NoError(t, err)
+				require.NotEmpty(t, proxy)
+				require.Equal(t, c.matchProxyName, proxy.Name)
+			}
+		})
+	}
+}
diff --git a/coderd/database/dbmetrics/dbmetrics.go b/coderd/database/dbmetrics/dbmetrics.go
index f78d9b44a46c0..3a89ddd379790 100644
--- a/coderd/database/dbmetrics/dbmetrics.go
+++ b/coderd/database/dbmetrics/dbmetrics.go
@@ -12,8 +12,8 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"golang.org/x/exp/slices"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/rbac"
 )
 
 var (
@@ -93,6 +93,27 @@ func (m metricsStore) AcquireProvisionerJob(ctx context.Context, arg database.Ac
 	return provisionerJob, err
 }
 
+func (m metricsStore) ActivityBumpWorkspace(ctx context.Context, arg uuid.UUID) error {
+	start := time.Now()
+	r0 := m.s.ActivityBumpWorkspace(ctx, arg)
+	m.queryLatencies.WithLabelValues("ActivityBumpWorkspace").Observe(time.Since(start).Seconds())
+	return r0
+}
+
+func (m metricsStore) AllUserIDs(ctx context.Context) ([]uuid.UUID, error) {
+	start := time.Now()
+	r0, r1 := m.s.AllUserIDs(ctx)
+	m.queryLatencies.WithLabelValues("AllUserIDs").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
+func (m metricsStore) ArchiveUnusedTemplateVersions(ctx context.Context, arg database.ArchiveUnusedTemplateVersionsParams) ([]uuid.UUID, error) {
+	start := time.Now()
+	r0, r1 := m.s.ArchiveUnusedTemplateVersions(ctx, arg)
+	m.queryLatencies.WithLabelValues("ArchiveUnusedTemplateVersions").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) CleanTailnetCoordinators(ctx context.Context) error {
 	start := time.Now()
 	err := m.s.CleanTailnetCoordinators(ctx)
@@ -114,6 +135,13 @@ func (m metricsStore) DeleteAPIKeysByUserID(ctx context.Context, userID uuid.UUI
 	return err
 }
 
+func (m metricsStore) DeleteAllTailnetClientSubscriptions(ctx context.Context, arg database.DeleteAllTailnetClientSubscriptionsParams) error {
+	start := time.Now()
+	r0 := m.s.DeleteAllTailnetClientSubscriptions(ctx, arg)
+	m.queryLatencies.WithLabelValues("DeleteAllTailnetClientSubscriptions").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m metricsStore) DeleteApplicationConnectAPIKeysByUserID(ctx context.Context, userID uuid.UUID) error {
 	start := time.Now()
 	err := m.s.DeleteApplicationConnectAPIKeysByUserID(ctx, userID)
@@ -195,6 +223,13 @@ func (m metricsStore) DeleteTailnetClient(ctx context.Context, arg database.Dele
 	return m.s.DeleteTailnetClient(ctx, arg)
 }
 
+func (m metricsStore) DeleteTailnetClientSubscription(ctx context.Context, arg database.DeleteTailnetClientSubscriptionParams) error {
+	start := time.Now()
+	r0 := m.s.DeleteTailnetClientSubscription(ctx, arg)
+	m.queryLatencies.WithLabelValues("DeleteTailnetClientSubscription").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m metricsStore) GetAPIKeyByID(ctx context.Context, id string) (database.APIKey, error) {
 	start := time.Now()
 	apiKey, err := m.s.GetAPIKeyByID(ctx, id)
@@ -237,6 +272,13 @@ func (m metricsStore) GetActiveUserCount(ctx context.Context) (int64, error) {
 	return count, err
 }
 
+func (m metricsStore) GetActiveWorkspaceBuildsByTemplateID(ctx context.Context, templateID uuid.UUID) ([]database.WorkspaceBuild, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetActiveWorkspaceBuildsByTemplateID(ctx, templateID)
+	m.queryLatencies.WithLabelValues("GetActiveWorkspaceBuildsByTemplateID").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) GetAllTailnetAgents(ctx context.Context) ([]database.TailnetAgent, error) {
 	start := time.Now()
 	r0, r1 := m.s.GetAllTailnetAgents(ctx)
@@ -244,7 +286,7 @@ func (m metricsStore) GetAllTailnetAgents(ctx context.Context) ([]database.Tailn
 	return r0, r1
 }
 
-func (m metricsStore) GetAllTailnetClients(ctx context.Context) ([]database.TailnetClient, error) {
+func (m metricsStore) GetAllTailnetClients(ctx context.Context) ([]database.GetAllTailnetClientsRow, error) {
 	start := time.Now()
 	r0, r1 := m.s.GetAllTailnetClients(ctx)
 	m.queryLatencies.WithLabelValues("GetAllTailnetClients").Observe(time.Since(start).Seconds())
@@ -258,6 +300,13 @@ func (m metricsStore) GetAppSecurityKey(ctx context.Context) (string, error) {
 	return key, err
 }
 
+func (m metricsStore) GetApplicationName(ctx context.Context) (string, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetApplicationName(ctx)
+	m.queryLatencies.WithLabelValues("GetApplicationName").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) GetAuditLogsOffset(ctx context.Context, arg database.GetAuditLogsOffsetParams) ([]database.GetAuditLogsOffsetRow, error) {
 	start := time.Now()
 	rows, err := m.s.GetAuditLogsOffset(ctx, arg)
@@ -272,6 +321,13 @@ func (m metricsStore) GetAuthorizationUserRoles(ctx context.Context, userID uuid
 	return row, err
 }
 
+func (m metricsStore) GetDBCryptKeys(ctx context.Context) ([]database.DBCryptKey, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetDBCryptKeys(ctx)
+	m.queryLatencies.WithLabelValues("GetDBCryptKeys").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) GetDERPMeshKey(ctx context.Context) (string, error) {
 	start := time.Now()
 	key, err := m.s.GetDERPMeshKey(ctx)
@@ -314,6 +370,20 @@ func (m metricsStore) GetDeploymentWorkspaceStats(ctx context.Context) (database
 	return row, err
 }
 
+func (m metricsStore) GetExternalAuthLink(ctx context.Context, arg database.GetExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+	start := time.Now()
+	link, err := m.s.GetExternalAuthLink(ctx, arg)
+	m.queryLatencies.WithLabelValues("GetExternalAuthLink").Observe(time.Since(start).Seconds())
+	return link, err
+}
+
+func (m metricsStore) GetExternalAuthLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.ExternalAuthLink, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetExternalAuthLinksByUserID(ctx, userID)
+	m.queryLatencies.WithLabelValues("GetExternalAuthLinksByUserID").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) GetFileByHashAndCreator(ctx context.Context, arg database.GetFileByHashAndCreatorParams) (database.File, error) {
 	start := time.Now()
 	file, err := m.s.GetFileByHashAndCreator(ctx, arg)
@@ -335,13 +405,6 @@ func (m metricsStore) GetFileTemplates(ctx context.Context, fileID uuid.UUID) ([
 	return rows, err
 }
 
-func (m metricsStore) GetGitAuthLink(ctx context.Context, arg database.GetGitAuthLinkParams) (database.GitAuthLink, error) {
-	start := time.Now()
-	link, err := m.s.GetGitAuthLink(ctx, arg)
-	m.queryLatencies.WithLabelValues("GetGitAuthLink").Observe(time.Since(start).Seconds())
-	return link, err
-}
-
 func (m metricsStore) GetGitSSHKey(ctx context.Context, userID uuid.UUID) (database.GitSSHKey, error) {
 	start := time.Now()
 	key, err := m.s.GetGitSSHKey(ctx, userID)
@@ -592,6 +655,13 @@ func (m metricsStore) GetTailnetClientsForAgent(ctx context.Context, agentID uui
 	return m.s.GetTailnetClientsForAgent(ctx, agentID)
 }
 
+func (m metricsStore) GetTemplateAppInsights(ctx context.Context, arg database.GetTemplateAppInsightsParams) ([]database.GetTemplateAppInsightsRow, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetTemplateAppInsights(ctx, arg)
+	m.queryLatencies.WithLabelValues("GetTemplateAppInsights").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) GetTemplateAverageBuildTime(ctx context.Context, arg database.GetTemplateAverageBuildTimeParams) (database.GetTemplateAverageBuildTimeRow, error) {
 	start := time.Now()
 	buildTime, err := m.s.GetTemplateAverageBuildTime(ctx, arg)
@@ -620,17 +690,24 @@ func (m metricsStore) GetTemplateDAUs(ctx context.Context, arg database.GetTempl
 	return daus, err
 }
 
-func (m metricsStore) GetTemplateDailyInsights(ctx context.Context, arg database.GetTemplateDailyInsightsParams) ([]database.GetTemplateDailyInsightsRow, error) {
+func (m metricsStore) GetTemplateInsights(ctx context.Context, arg database.GetTemplateInsightsParams) (database.GetTemplateInsightsRow, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetTemplateInsights(ctx, arg)
+	m.queryLatencies.WithLabelValues("GetTemplateInsights").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
+func (m metricsStore) GetTemplateInsightsByInterval(ctx context.Context, arg database.GetTemplateInsightsByIntervalParams) ([]database.GetTemplateInsightsByIntervalRow, error) {
 	start := time.Now()
-	r0, r1 := m.s.GetTemplateDailyInsights(ctx, arg)
-	m.queryLatencies.WithLabelValues("GetTemplateDailyInsights").Observe(time.Since(start).Seconds())
+	r0, r1 := m.s.GetTemplateInsightsByInterval(ctx, arg)
+	m.queryLatencies.WithLabelValues("GetTemplateInsightsByInterval").Observe(time.Since(start).Seconds())
 	return r0, r1
 }
 
-func (m metricsStore) GetTemplateInsights(ctx context.Context, arg database.GetTemplateInsightsParams) (database.GetTemplateInsightsRow, error) {
+func (m metricsStore) GetTemplateInsightsByTemplate(ctx context.Context, arg database.GetTemplateInsightsByTemplateParams) ([]database.GetTemplateInsightsByTemplateRow, error) {
 	start := time.Now()
-	r0, r1 := m.s.GetTemplateInsights(ctx, arg)
-	m.queryLatencies.WithLabelValues("GetTemplateInsights").Observe(time.Since(start).Seconds())
+	r0, r1 := m.s.GetTemplateInsightsByTemplate(ctx, arg)
+	m.queryLatencies.WithLabelValues("GetTemplateInsightsByTemplate").Observe(time.Since(start).Seconds())
 	return r0, r1
 }
 
@@ -718,6 +795,13 @@ func (m metricsStore) GetUnexpiredLicenses(ctx context.Context) ([]database.Lice
 	return licenses, err
 }
 
+func (m metricsStore) GetUserActivityInsights(ctx context.Context, arg database.GetUserActivityInsightsParams) ([]database.GetUserActivityInsightsRow, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetUserActivityInsights(ctx, arg)
+	m.queryLatencies.WithLabelValues("GetUserActivityInsights").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) GetUserByEmailOrUsername(ctx context.Context, arg database.GetUserByEmailOrUsernameParams) (database.User, error) {
 	start := time.Now()
 	user, err := m.s.GetUserByEmailOrUsername(ctx, arg)
@@ -760,6 +844,13 @@ func (m metricsStore) GetUserLinkByUserIDLoginType(ctx context.Context, arg data
 	return link, err
 }
 
+func (m metricsStore) GetUserLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.UserLink, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetUserLinksByUserID(ctx, userID)
+	m.queryLatencies.WithLabelValues("GetUserLinksByUserID").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) GetUsers(ctx context.Context, arg database.GetUsersParams) ([]database.GetUsersRow, error) {
 	start := time.Now()
 	users, err := m.s.GetUsers(ctx, arg)
@@ -774,11 +865,11 @@ func (m metricsStore) GetUsersByIDs(ctx context.Context, ids []uuid.UUID) ([]dat
 	return users, err
 }
 
-func (m metricsStore) GetWorkspaceAgentByAuthToken(ctx context.Context, authToken uuid.UUID) (database.WorkspaceAgent, error) {
+func (m metricsStore) GetWorkspaceAgentAndOwnerByAuthToken(ctx context.Context, authToken uuid.UUID) (database.GetWorkspaceAgentAndOwnerByAuthTokenRow, error) {
 	start := time.Now()
-	agent, err := m.s.GetWorkspaceAgentByAuthToken(ctx, authToken)
-	m.queryLatencies.WithLabelValues("GetWorkspaceAgentByAuthToken").Observe(time.Since(start).Seconds())
-	return agent, err
+	r0, r1 := m.s.GetWorkspaceAgentAndOwnerByAuthToken(ctx, authToken)
+	m.queryLatencies.WithLabelValues("GetWorkspaceAgentAndOwnerByAuthToken").Observe(time.Since(start).Seconds())
+	return r0, r1
 }
 
 func (m metricsStore) GetWorkspaceAgentByID(ctx context.Context, id uuid.UUID) (database.WorkspaceAgent, error) {
@@ -802,6 +893,13 @@ func (m metricsStore) GetWorkspaceAgentLifecycleStateByID(ctx context.Context, i
 	return r0, r1
 }
 
+func (m metricsStore) GetWorkspaceAgentLogSourcesByAgentIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceAgentLogSource, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetWorkspaceAgentLogSourcesByAgentIDs(ctx, ids)
+	m.queryLatencies.WithLabelValues("GetWorkspaceAgentLogSourcesByAgentIDs").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) GetWorkspaceAgentLogsAfter(ctx context.Context, arg database.GetWorkspaceAgentLogsAfterParams) ([]database.WorkspaceAgentLog, error) {
 	start := time.Now()
 	r0, r1 := m.s.GetWorkspaceAgentLogsAfter(ctx, arg)
@@ -809,13 +907,20 @@ func (m metricsStore) GetWorkspaceAgentLogsAfter(ctx context.Context, arg databa
 	return r0, r1
 }
 
-func (m metricsStore) GetWorkspaceAgentMetadata(ctx context.Context, workspaceAgentID uuid.UUID) ([]database.WorkspaceAgentMetadatum, error) {
+func (m metricsStore) GetWorkspaceAgentMetadata(ctx context.Context, workspaceAgentID database.GetWorkspaceAgentMetadataParams) ([]database.WorkspaceAgentMetadatum, error) {
 	start := time.Now()
 	metadata, err := m.s.GetWorkspaceAgentMetadata(ctx, workspaceAgentID)
 	m.queryLatencies.WithLabelValues("GetWorkspaceAgentMetadata").Observe(time.Since(start).Seconds())
 	return metadata, err
 }
 
+func (m metricsStore) GetWorkspaceAgentScriptsByAgentIDs(ctx context.Context, ids []uuid.UUID) ([]database.WorkspaceAgentScript, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetWorkspaceAgentScriptsByAgentIDs(ctx, ids)
+	m.queryLatencies.WithLabelValues("GetWorkspaceAgentScriptsByAgentIDs").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) GetWorkspaceAgentStats(ctx context.Context, createdAt time.Time) ([]database.GetWorkspaceAgentStatsRow, error) {
 	start := time.Now()
 	stats, err := m.s.GetWorkspaceAgentStats(ctx, createdAt)
@@ -1054,6 +1159,13 @@ func (m metricsStore) InsertAuditLog(ctx context.Context, arg database.InsertAud
 	return log, err
 }
 
+func (m metricsStore) InsertDBCryptKey(ctx context.Context, arg database.InsertDBCryptKeyParams) error {
+	start := time.Now()
+	r0 := m.s.InsertDBCryptKey(ctx, arg)
+	m.queryLatencies.WithLabelValues("InsertDBCryptKey").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m metricsStore) InsertDERPMeshKey(ctx context.Context, value string) error {
 	start := time.Now()
 	err := m.s.InsertDERPMeshKey(ctx, value)
@@ -1068,6 +1180,13 @@ func (m metricsStore) InsertDeploymentID(ctx context.Context, value string) erro
 	return err
 }
 
+func (m metricsStore) InsertExternalAuthLink(ctx context.Context, arg database.InsertExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+	start := time.Now()
+	link, err := m.s.InsertExternalAuthLink(ctx, arg)
+	m.queryLatencies.WithLabelValues("InsertExternalAuthLink").Observe(time.Since(start).Seconds())
+	return link, err
+}
+
 func (m metricsStore) InsertFile(ctx context.Context, arg database.InsertFileParams) (database.File, error) {
 	start := time.Now()
 	file, err := m.s.InsertFile(ctx, arg)
@@ -1075,13 +1194,6 @@ func (m metricsStore) InsertFile(ctx context.Context, arg database.InsertFilePar
 	return file, err
 }
 
-func (m metricsStore) InsertGitAuthLink(ctx context.Context, arg database.InsertGitAuthLinkParams) (database.GitAuthLink, error) {
-	start := time.Now()
-	link, err := m.s.InsertGitAuthLink(ctx, arg)
-	m.queryLatencies.WithLabelValues("InsertGitAuthLink").Observe(time.Since(start).Seconds())
-	return link, err
-}
-
 func (m metricsStore) InsertGitSSHKey(ctx context.Context, arg database.InsertGitSSHKeyParams) (database.GitSSHKey, error) {
 	start := time.Now()
 	key, err := m.s.InsertGitSSHKey(ctx, arg)
@@ -1110,6 +1222,13 @@ func (m metricsStore) InsertLicense(ctx context.Context, arg database.InsertLice
 	return license, err
 }
 
+func (m metricsStore) InsertMissingGroups(ctx context.Context, arg database.InsertMissingGroupsParams) ([]database.Group, error) {
+	start := time.Now()
+	r0, r1 := m.s.InsertMissingGroups(ctx, arg)
+	m.queryLatencies.WithLabelValues("InsertMissingGroups").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) InsertOrganization(ctx context.Context, arg database.InsertOrganizationParams) (database.Organization, error) {
 	start := time.Now()
 	organization, err := m.s.InsertOrganization(ctx, arg)
@@ -1215,6 +1334,13 @@ func (m metricsStore) InsertWorkspaceAgent(ctx context.Context, arg database.Ins
 	return agent, err
 }
 
+func (m metricsStore) InsertWorkspaceAgentLogSources(ctx context.Context, arg database.InsertWorkspaceAgentLogSourcesParams) ([]database.WorkspaceAgentLogSource, error) {
+	start := time.Now()
+	r0, r1 := m.s.InsertWorkspaceAgentLogSources(ctx, arg)
+	m.queryLatencies.WithLabelValues("InsertWorkspaceAgentLogSources").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) InsertWorkspaceAgentLogs(ctx context.Context, arg database.InsertWorkspaceAgentLogsParams) ([]database.WorkspaceAgentLog, error) {
 	start := time.Now()
 	r0, r1 := m.s.InsertWorkspaceAgentLogs(ctx, arg)
@@ -1229,6 +1355,13 @@ func (m metricsStore) InsertWorkspaceAgentMetadata(ctx context.Context, arg data
 	return err
 }
 
+func (m metricsStore) InsertWorkspaceAgentScripts(ctx context.Context, arg database.InsertWorkspaceAgentScriptsParams) ([]database.WorkspaceAgentScript, error) {
+	start := time.Now()
+	r0, r1 := m.s.InsertWorkspaceAgentScripts(ctx, arg)
+	m.queryLatencies.WithLabelValues("InsertWorkspaceAgentScripts").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m metricsStore) InsertWorkspaceAgentStat(ctx context.Context, arg database.InsertWorkspaceAgentStatParams) (database.WorkspaceAgentStat, error) {
 	start := time.Now()
 	stat, err := m.s.InsertWorkspaceAgentStat(ctx, arg)
@@ -1236,6 +1369,13 @@ func (m metricsStore) InsertWorkspaceAgentStat(ctx context.Context, arg database
 	return stat, err
 }
 
+func (m metricsStore) InsertWorkspaceAgentStats(ctx context.Context, arg database.InsertWorkspaceAgentStatsParams) error {
+	start := time.Now()
+	r0 := m.s.InsertWorkspaceAgentStats(ctx, arg)
+	m.queryLatencies.WithLabelValues("InsertWorkspaceAgentStats").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m metricsStore) InsertWorkspaceApp(ctx context.Context, arg database.InsertWorkspaceAppParams) (database.WorkspaceApp, error) {
 	start := time.Now()
 	app, err := m.s.InsertWorkspaceApp(ctx, arg)
@@ -1243,6 +1383,13 @@ func (m metricsStore) InsertWorkspaceApp(ctx context.Context, arg database.Inser
 	return app, err
 }
 
+func (m metricsStore) InsertWorkspaceAppStats(ctx context.Context, arg database.InsertWorkspaceAppStatsParams) error {
+	start := time.Now()
+	r0 := m.s.InsertWorkspaceAppStats(ctx, arg)
+	m.queryLatencies.WithLabelValues("InsertWorkspaceAppStats").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m metricsStore) InsertWorkspaceBuild(ctx context.Context, arg database.InsertWorkspaceBuildParams) error {
 	start := time.Now()
 	err := m.s.InsertWorkspaceBuild(ctx, arg)
@@ -1285,6 +1432,13 @@ func (m metricsStore) RegisterWorkspaceProxy(ctx context.Context, arg database.R
 	return proxy, err
 }
 
+func (m metricsStore) RevokeDBCryptKey(ctx context.Context, activeKeyDigest string) error {
+	start := time.Now()
+	r0 := m.s.RevokeDBCryptKey(ctx, activeKeyDigest)
+	m.queryLatencies.WithLabelValues("RevokeDBCryptKey").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m metricsStore) TryAcquireLock(ctx context.Context, pgTryAdvisoryXactLock int64) (bool, error) {
 	start := time.Now()
 	ok, err := m.s.TryAcquireLock(ctx, pgTryAdvisoryXactLock)
@@ -1292,6 +1446,13 @@ func (m metricsStore) TryAcquireLock(ctx context.Context, pgTryAdvisoryXactLock
 	return ok, err
 }
 
+func (m metricsStore) UnarchiveTemplateVersion(ctx context.Context, arg database.UnarchiveTemplateVersionParams) error {
+	start := time.Now()
+	r0 := m.s.UnarchiveTemplateVersion(ctx, arg)
+	m.queryLatencies.WithLabelValues("UnarchiveTemplateVersion").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m metricsStore) UpdateAPIKeyByID(ctx context.Context, arg database.UpdateAPIKeyByIDParams) error {
 	start := time.Now()
 	err := m.s.UpdateAPIKeyByID(ctx, arg)
@@ -1299,10 +1460,10 @@ func (m metricsStore) UpdateAPIKeyByID(ctx context.Context, arg database.UpdateA
 	return err
 }
 
-func (m metricsStore) UpdateGitAuthLink(ctx context.Context, arg database.UpdateGitAuthLinkParams) (database.GitAuthLink, error) {
+func (m metricsStore) UpdateExternalAuthLink(ctx context.Context, arg database.UpdateExternalAuthLinkParams) (database.ExternalAuthLink, error) {
 	start := time.Now()
-	link, err := m.s.UpdateGitAuthLink(ctx, arg)
-	m.queryLatencies.WithLabelValues("UpdateGitAuthLink").Observe(time.Since(start).Seconds())
+	link, err := m.s.UpdateExternalAuthLink(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdateExternalAuthLink").Observe(time.Since(start).Seconds())
 	return link, err
 }
 
@@ -1369,6 +1530,13 @@ func (m metricsStore) UpdateTemplateACLByID(ctx context.Context, arg database.Up
 	return err
 }
 
+func (m metricsStore) UpdateTemplateAccessControlByID(ctx context.Context, arg database.UpdateTemplateAccessControlByIDParams) error {
+	start := time.Now()
+	r0 := m.s.UpdateTemplateAccessControlByID(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdateTemplateAccessControlByID").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m metricsStore) UpdateTemplateActiveVersionByID(ctx context.Context, arg database.UpdateTemplateActiveVersionByIDParams) error {
 	start := time.Now()
 	err := m.s.UpdateTemplateActiveVersionByID(ctx, arg)
@@ -1411,13 +1579,20 @@ func (m metricsStore) UpdateTemplateVersionDescriptionByJobID(ctx context.Contex
 	return err
 }
 
-func (m metricsStore) UpdateTemplateVersionGitAuthProvidersByJobID(ctx context.Context, arg database.UpdateTemplateVersionGitAuthProvidersByJobIDParams) error {
+func (m metricsStore) UpdateTemplateVersionExternalAuthProvidersByJobID(ctx context.Context, arg database.UpdateTemplateVersionExternalAuthProvidersByJobIDParams) error {
 	start := time.Now()
-	err := m.s.UpdateTemplateVersionGitAuthProvidersByJobID(ctx, arg)
-	m.queryLatencies.WithLabelValues("UpdateTemplateVersionGitAuthProvidersByJobID").Observe(time.Since(start).Seconds())
+	err := m.s.UpdateTemplateVersionExternalAuthProvidersByJobID(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdateTemplateVersionExternalAuthProvidersByJobID").Observe(time.Since(start).Seconds())
 	return err
 }
 
+func (m metricsStore) UpdateTemplateWorkspacesLastUsedAt(ctx context.Context, arg database.UpdateTemplateWorkspacesLastUsedAtParams) error {
+	start := time.Now()
+	r0 := m.s.UpdateTemplateWorkspacesLastUsedAt(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdateTemplateWorkspacesLastUsedAt").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m metricsStore) UpdateUserDeletedByID(ctx context.Context, arg database.UpdateUserDeletedByIDParams) error {
 	start := time.Now()
 	err := m.s.UpdateUserDeletedByID(ctx, arg)
@@ -1537,17 +1712,17 @@ func (m metricsStore) UpdateWorkspaceAppHealthByID(ctx context.Context, arg data
 	return err
 }
 
-func (m metricsStore) UpdateWorkspaceAutostart(ctx context.Context, arg database.UpdateWorkspaceAutostartParams) error {
+func (m metricsStore) UpdateWorkspaceAutomaticUpdates(ctx context.Context, arg database.UpdateWorkspaceAutomaticUpdatesParams) error {
 	start := time.Now()
-	err := m.s.UpdateWorkspaceAutostart(ctx, arg)
-	m.queryLatencies.WithLabelValues("UpdateWorkspaceAutostart").Observe(time.Since(start).Seconds())
-	return err
+	r0 := m.s.UpdateWorkspaceAutomaticUpdates(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdateWorkspaceAutomaticUpdates").Observe(time.Since(start).Seconds())
+	return r0
 }
 
-func (m metricsStore) UpdateWorkspaceBuildByID(ctx context.Context, arg database.UpdateWorkspaceBuildByIDParams) error {
+func (m metricsStore) UpdateWorkspaceAutostart(ctx context.Context, arg database.UpdateWorkspaceAutostartParams) error {
 	start := time.Now()
-	err := m.s.UpdateWorkspaceBuildByID(ctx, arg)
-	m.queryLatencies.WithLabelValues("UpdateWorkspaceBuildByID").Observe(time.Since(start).Seconds())
+	err := m.s.UpdateWorkspaceAutostart(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdateWorkspaceAutostart").Observe(time.Since(start).Seconds())
 	return err
 }
 
@@ -1558,6 +1733,20 @@ func (m metricsStore) UpdateWorkspaceBuildCostByID(ctx context.Context, arg data
 	return err
 }
 
+func (m metricsStore) UpdateWorkspaceBuildDeadlineByID(ctx context.Context, arg database.UpdateWorkspaceBuildDeadlineByIDParams) error {
+	start := time.Now()
+	r0 := m.s.UpdateWorkspaceBuildDeadlineByID(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdateWorkspaceBuildDeadlineByID").Observe(time.Since(start).Seconds())
+	return r0
+}
+
+func (m metricsStore) UpdateWorkspaceBuildProvisionerStateByID(ctx context.Context, arg database.UpdateWorkspaceBuildProvisionerStateByIDParams) error {
+	start := time.Now()
+	r0 := m.s.UpdateWorkspaceBuildProvisionerStateByID(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdateWorkspaceBuildProvisionerStateByID").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m metricsStore) UpdateWorkspaceDeletedByID(ctx context.Context, arg database.UpdateWorkspaceDeletedByIDParams) error {
 	start := time.Now()
 	err := m.s.UpdateWorkspaceDeletedByID(ctx, arg)
@@ -1565,6 +1754,13 @@ func (m metricsStore) UpdateWorkspaceDeletedByID(ctx context.Context, arg databa
 	return err
 }
 
+func (m metricsStore) UpdateWorkspaceDormantDeletingAt(ctx context.Context, arg database.UpdateWorkspaceDormantDeletingAtParams) (database.Workspace, error) {
+	start := time.Now()
+	ws, r0 := m.s.UpdateWorkspaceDormantDeletingAt(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdateWorkspaceDormantDeletingAt").Observe(time.Since(start).Seconds())
+	return ws, r0
+}
+
 func (m metricsStore) UpdateWorkspaceLastUsedAt(ctx context.Context, arg database.UpdateWorkspaceLastUsedAtParams) error {
 	start := time.Now()
 	err := m.s.UpdateWorkspaceLastUsedAt(ctx, arg)
@@ -1572,13 +1768,6 @@ func (m metricsStore) UpdateWorkspaceLastUsedAt(ctx context.Context, arg databas
 	return err
 }
 
-func (m metricsStore) UpdateWorkspaceLockedDeletingAt(ctx context.Context, arg database.UpdateWorkspaceLockedDeletingAtParams) error {
-	start := time.Now()
-	r0 := m.s.UpdateWorkspaceLockedDeletingAt(ctx, arg)
-	m.queryLatencies.WithLabelValues("UpdateWorkspaceLockedDeletingAt").Observe(time.Since(start).Seconds())
-	return r0
-}
-
 func (m metricsStore) UpdateWorkspaceProxy(ctx context.Context, arg database.UpdateWorkspaceProxyParams) (database.WorkspaceProxy, error) {
 	start := time.Now()
 	proxy, err := m.s.UpdateWorkspaceProxy(ctx, arg)
@@ -1600,10 +1789,10 @@ func (m metricsStore) UpdateWorkspaceTTL(ctx context.Context, arg database.Updat
 	return r0
 }
 
-func (m metricsStore) UpdateWorkspacesDeletingAtByTemplateID(ctx context.Context, arg database.UpdateWorkspacesDeletingAtByTemplateIDParams) error {
+func (m metricsStore) UpdateWorkspacesDormantDeletingAtByTemplateID(ctx context.Context, arg database.UpdateWorkspacesDormantDeletingAtByTemplateIDParams) error {
 	start := time.Now()
-	r0 := m.s.UpdateWorkspacesDeletingAtByTemplateID(ctx, arg)
-	m.queryLatencies.WithLabelValues("UpdateWorkspacesDeletingAtByTemplateID").Observe(time.Since(start).Seconds())
+	r0 := m.s.UpdateWorkspacesDormantDeletingAtByTemplateID(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdateWorkspacesDormantDeletingAtByTemplateID").Observe(time.Since(start).Seconds())
 	return r0
 }
 
@@ -1614,6 +1803,13 @@ func (m metricsStore) UpsertAppSecurityKey(ctx context.Context, value string) er
 	return r0
 }
 
+func (m metricsStore) UpsertApplicationName(ctx context.Context, value string) error {
+	start := time.Now()
+	r0 := m.s.UpsertApplicationName(ctx, value)
+	m.queryLatencies.WithLabelValues("UpsertApplicationName").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m metricsStore) UpsertDefaultProxy(ctx context.Context, arg database.UpsertDefaultProxyParams) error {
 	start := time.Now()
 	r0 := m.s.UpsertDefaultProxy(ctx, arg)
@@ -1661,6 +1857,13 @@ func (m metricsStore) UpsertTailnetClient(ctx context.Context, arg database.Upse
 	return m.s.UpsertTailnetClient(ctx, arg)
 }
 
+func (m metricsStore) UpsertTailnetClientSubscription(ctx context.Context, arg database.UpsertTailnetClientSubscriptionParams) error {
+	start := time.Now()
+	r0 := m.s.UpsertTailnetClientSubscription(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpsertTailnetClientSubscription").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m metricsStore) UpsertTailnetCoordinator(ctx context.Context, id uuid.UUID) (database.TailnetCoordinator, error) {
 	start := time.Now()
 	defer m.queryLatencies.WithLabelValues("UpsertTailnetCoordinator").Observe(time.Since(start).Seconds())
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index adf573cb99e82..080c9630e7bc4 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -1,5 +1,5 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/coder/coder/coderd/database (interfaces: Store)
+// Source: github.com/coder/coder/v2/coderd/database (interfaces: Store)
 
 // Package dbmock is a generated GoMock package.
 package dbmock
@@ -10,8 +10,8 @@ import (
 	reflect "reflect"
 	time "time"
 
-	database "github.com/coder/coder/coderd/database"
-	rbac "github.com/coder/coder/coderd/rbac"
+	database "github.com/coder/coder/v2/coderd/database"
+	rbac "github.com/coder/coder/v2/coderd/rbac"
 	gomock "github.com/golang/mock/gomock"
 	uuid "github.com/google/uuid"
 )
@@ -68,6 +68,50 @@ func (mr *MockStoreMockRecorder) AcquireProvisionerJob(arg0, arg1 interface{}) *
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AcquireProvisionerJob", reflect.TypeOf((*MockStore)(nil).AcquireProvisionerJob), arg0, arg1)
 }
 
+// ActivityBumpWorkspace mocks base method.
+func (m *MockStore) ActivityBumpWorkspace(arg0 context.Context, arg1 uuid.UUID) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ActivityBumpWorkspace", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// ActivityBumpWorkspace indicates an expected call of ActivityBumpWorkspace.
+func (mr *MockStoreMockRecorder) ActivityBumpWorkspace(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ActivityBumpWorkspace", reflect.TypeOf((*MockStore)(nil).ActivityBumpWorkspace), arg0, arg1)
+}
+
+// AllUserIDs mocks base method.
+func (m *MockStore) AllUserIDs(arg0 context.Context) ([]uuid.UUID, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "AllUserIDs", arg0)
+	ret0, _ := ret[0].([]uuid.UUID)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AllUserIDs indicates an expected call of AllUserIDs.
+func (mr *MockStoreMockRecorder) AllUserIDs(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AllUserIDs", reflect.TypeOf((*MockStore)(nil).AllUserIDs), arg0)
+}
+
+// ArchiveUnusedTemplateVersions mocks base method.
+func (m *MockStore) ArchiveUnusedTemplateVersions(arg0 context.Context, arg1 database.ArchiveUnusedTemplateVersionsParams) ([]uuid.UUID, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ArchiveUnusedTemplateVersions", arg0, arg1)
+	ret0, _ := ret[0].([]uuid.UUID)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ArchiveUnusedTemplateVersions indicates an expected call of ArchiveUnusedTemplateVersions.
+func (mr *MockStoreMockRecorder) ArchiveUnusedTemplateVersions(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ArchiveUnusedTemplateVersions", reflect.TypeOf((*MockStore)(nil).ArchiveUnusedTemplateVersions), arg0, arg1)
+}
+
 // CleanTailnetCoordinators mocks base method.
 func (m *MockStore) CleanTailnetCoordinators(arg0 context.Context) error {
 	m.ctrl.T.Helper()
@@ -110,6 +154,20 @@ func (mr *MockStoreMockRecorder) DeleteAPIKeysByUserID(arg0, arg1 interface{}) *
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAPIKeysByUserID", reflect.TypeOf((*MockStore)(nil).DeleteAPIKeysByUserID), arg0, arg1)
 }
 
+// DeleteAllTailnetClientSubscriptions mocks base method.
+func (m *MockStore) DeleteAllTailnetClientSubscriptions(arg0 context.Context, arg1 database.DeleteAllTailnetClientSubscriptionsParams) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAllTailnetClientSubscriptions", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAllTailnetClientSubscriptions indicates an expected call of DeleteAllTailnetClientSubscriptions.
+func (mr *MockStoreMockRecorder) DeleteAllTailnetClientSubscriptions(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAllTailnetClientSubscriptions", reflect.TypeOf((*MockStore)(nil).DeleteAllTailnetClientSubscriptions), arg0, arg1)
+}
+
 // DeleteApplicationConnectAPIKeysByUserID mocks base method.
 func (m *MockStore) DeleteApplicationConnectAPIKeysByUserID(arg0 context.Context, arg1 uuid.UUID) error {
 	m.ctrl.T.Helper()
@@ -281,6 +339,20 @@ func (mr *MockStoreMockRecorder) DeleteTailnetClient(arg0, arg1 interface{}) *go
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteTailnetClient", reflect.TypeOf((*MockStore)(nil).DeleteTailnetClient), arg0, arg1)
 }
 
+// DeleteTailnetClientSubscription mocks base method.
+func (m *MockStore) DeleteTailnetClientSubscription(arg0 context.Context, arg1 database.DeleteTailnetClientSubscriptionParams) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteTailnetClientSubscription", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteTailnetClientSubscription indicates an expected call of DeleteTailnetClientSubscription.
+func (mr *MockStoreMockRecorder) DeleteTailnetClientSubscription(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteTailnetClientSubscription", reflect.TypeOf((*MockStore)(nil).DeleteTailnetClientSubscription), arg0, arg1)
+}
+
 // GetAPIKeyByID mocks base method.
 func (m *MockStore) GetAPIKeyByID(arg0 context.Context, arg1 string) (database.APIKey, error) {
 	m.ctrl.T.Helper()
@@ -371,6 +443,21 @@ func (mr *MockStoreMockRecorder) GetActiveUserCount(arg0 interface{}) *gomock.Ca
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveUserCount", reflect.TypeOf((*MockStore)(nil).GetActiveUserCount), arg0)
 }
 
+// GetActiveWorkspaceBuildsByTemplateID mocks base method.
+func (m *MockStore) GetActiveWorkspaceBuildsByTemplateID(arg0 context.Context, arg1 uuid.UUID) ([]database.WorkspaceBuild, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetActiveWorkspaceBuildsByTemplateID", arg0, arg1)
+	ret0, _ := ret[0].([]database.WorkspaceBuild)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetActiveWorkspaceBuildsByTemplateID indicates an expected call of GetActiveWorkspaceBuildsByTemplateID.
+func (mr *MockStoreMockRecorder) GetActiveWorkspaceBuildsByTemplateID(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveWorkspaceBuildsByTemplateID", reflect.TypeOf((*MockStore)(nil).GetActiveWorkspaceBuildsByTemplateID), arg0, arg1)
+}
+
 // GetAllTailnetAgents mocks base method.
 func (m *MockStore) GetAllTailnetAgents(arg0 context.Context) ([]database.TailnetAgent, error) {
 	m.ctrl.T.Helper()
@@ -387,10 +474,10 @@ func (mr *MockStoreMockRecorder) GetAllTailnetAgents(arg0 interface{}) *gomock.C
 }
 
 // GetAllTailnetClients mocks base method.
-func (m *MockStore) GetAllTailnetClients(arg0 context.Context) ([]database.TailnetClient, error) {
+func (m *MockStore) GetAllTailnetClients(arg0 context.Context) ([]database.GetAllTailnetClientsRow, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetAllTailnetClients", arg0)
-	ret0, _ := ret[0].([]database.TailnetClient)
+	ret0, _ := ret[0].([]database.GetAllTailnetClientsRow)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
@@ -416,6 +503,21 @@ func (mr *MockStoreMockRecorder) GetAppSecurityKey(arg0 interface{}) *gomock.Cal
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAppSecurityKey", reflect.TypeOf((*MockStore)(nil).GetAppSecurityKey), arg0)
 }
 
+// GetApplicationName mocks base method.
+func (m *MockStore) GetApplicationName(arg0 context.Context) (string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetApplicationName", arg0)
+	ret0, _ := ret[0].(string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetApplicationName indicates an expected call of GetApplicationName.
+func (mr *MockStoreMockRecorder) GetApplicationName(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetApplicationName", reflect.TypeOf((*MockStore)(nil).GetApplicationName), arg0)
+}
+
 // GetAuditLogsOffset mocks base method.
 func (m *MockStore) GetAuditLogsOffset(arg0 context.Context, arg1 database.GetAuditLogsOffsetParams) ([]database.GetAuditLogsOffsetRow, error) {
 	m.ctrl.T.Helper()
@@ -491,6 +593,21 @@ func (mr *MockStoreMockRecorder) GetAuthorizedWorkspaces(arg0, arg1, arg2 interf
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAuthorizedWorkspaces", reflect.TypeOf((*MockStore)(nil).GetAuthorizedWorkspaces), arg0, arg1, arg2)
 }
 
+// GetDBCryptKeys mocks base method.
+func (m *MockStore) GetDBCryptKeys(arg0 context.Context) ([]database.DBCryptKey, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetDBCryptKeys", arg0)
+	ret0, _ := ret[0].([]database.DBCryptKey)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetDBCryptKeys indicates an expected call of GetDBCryptKeys.
+func (mr *MockStoreMockRecorder) GetDBCryptKeys(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetDBCryptKeys", reflect.TypeOf((*MockStore)(nil).GetDBCryptKeys), arg0)
+}
+
 // GetDERPMeshKey mocks base method.
 func (m *MockStore) GetDERPMeshKey(arg0 context.Context) (string, error) {
 	m.ctrl.T.Helper()
@@ -581,6 +698,36 @@ func (mr *MockStoreMockRecorder) GetDeploymentWorkspaceStats(arg0 interface{}) *
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetDeploymentWorkspaceStats", reflect.TypeOf((*MockStore)(nil).GetDeploymentWorkspaceStats), arg0)
 }
 
+// GetExternalAuthLink mocks base method.
+func (m *MockStore) GetExternalAuthLink(arg0 context.Context, arg1 database.GetExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetExternalAuthLink", arg0, arg1)
+	ret0, _ := ret[0].(database.ExternalAuthLink)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetExternalAuthLink indicates an expected call of GetExternalAuthLink.
+func (mr *MockStoreMockRecorder) GetExternalAuthLink(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetExternalAuthLink", reflect.TypeOf((*MockStore)(nil).GetExternalAuthLink), arg0, arg1)
+}
+
+// GetExternalAuthLinksByUserID mocks base method.
+func (m *MockStore) GetExternalAuthLinksByUserID(arg0 context.Context, arg1 uuid.UUID) ([]database.ExternalAuthLink, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetExternalAuthLinksByUserID", arg0, arg1)
+	ret0, _ := ret[0].([]database.ExternalAuthLink)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetExternalAuthLinksByUserID indicates an expected call of GetExternalAuthLinksByUserID.
+func (mr *MockStoreMockRecorder) GetExternalAuthLinksByUserID(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetExternalAuthLinksByUserID", reflect.TypeOf((*MockStore)(nil).GetExternalAuthLinksByUserID), arg0, arg1)
+}
+
 // GetFileByHashAndCreator mocks base method.
 func (m *MockStore) GetFileByHashAndCreator(arg0 context.Context, arg1 database.GetFileByHashAndCreatorParams) (database.File, error) {
 	m.ctrl.T.Helper()
@@ -626,21 +773,6 @@ func (mr *MockStoreMockRecorder) GetFileTemplates(arg0, arg1 interface{}) *gomoc
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetFileTemplates", reflect.TypeOf((*MockStore)(nil).GetFileTemplates), arg0, arg1)
 }
 
-// GetGitAuthLink mocks base method.
-func (m *MockStore) GetGitAuthLink(arg0 context.Context, arg1 database.GetGitAuthLinkParams) (database.GitAuthLink, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetGitAuthLink", arg0, arg1)
-	ret0, _ := ret[0].(database.GitAuthLink)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetGitAuthLink indicates an expected call of GetGitAuthLink.
-func (mr *MockStoreMockRecorder) GetGitAuthLink(arg0, arg1 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetGitAuthLink", reflect.TypeOf((*MockStore)(nil).GetGitAuthLink), arg0, arg1)
-}
-
 // GetGitSSHKey mocks base method.
 func (m *MockStore) GetGitSSHKey(arg0 context.Context, arg1 uuid.UUID) (database.GitSSHKey, error) {
 	m.ctrl.T.Helper()
@@ -1181,6 +1313,21 @@ func (mr *MockStoreMockRecorder) GetTailnetClientsForAgent(arg0, arg1 interface{
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTailnetClientsForAgent", reflect.TypeOf((*MockStore)(nil).GetTailnetClientsForAgent), arg0, arg1)
 }
 
+// GetTemplateAppInsights mocks base method.
+func (m *MockStore) GetTemplateAppInsights(arg0 context.Context, arg1 database.GetTemplateAppInsightsParams) ([]database.GetTemplateAppInsightsRow, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetTemplateAppInsights", arg0, arg1)
+	ret0, _ := ret[0].([]database.GetTemplateAppInsightsRow)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetTemplateAppInsights indicates an expected call of GetTemplateAppInsights.
+func (mr *MockStoreMockRecorder) GetTemplateAppInsights(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTemplateAppInsights", reflect.TypeOf((*MockStore)(nil).GetTemplateAppInsights), arg0, arg1)
+}
+
 // GetTemplateAverageBuildTime mocks base method.
 func (m *MockStore) GetTemplateAverageBuildTime(arg0 context.Context, arg1 database.GetTemplateAverageBuildTimeParams) (database.GetTemplateAverageBuildTimeRow, error) {
 	m.ctrl.T.Helper()
@@ -1241,21 +1388,6 @@ func (mr *MockStoreMockRecorder) GetTemplateDAUs(arg0, arg1 interface{}) *gomock
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTemplateDAUs", reflect.TypeOf((*MockStore)(nil).GetTemplateDAUs), arg0, arg1)
 }
 
-// GetTemplateDailyInsights mocks base method.
-func (m *MockStore) GetTemplateDailyInsights(arg0 context.Context, arg1 database.GetTemplateDailyInsightsParams) ([]database.GetTemplateDailyInsightsRow, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetTemplateDailyInsights", arg0, arg1)
-	ret0, _ := ret[0].([]database.GetTemplateDailyInsightsRow)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetTemplateDailyInsights indicates an expected call of GetTemplateDailyInsights.
-func (mr *MockStoreMockRecorder) GetTemplateDailyInsights(arg0, arg1 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTemplateDailyInsights", reflect.TypeOf((*MockStore)(nil).GetTemplateDailyInsights), arg0, arg1)
-}
-
 // GetTemplateGroupRoles mocks base method.
 func (m *MockStore) GetTemplateGroupRoles(arg0 context.Context, arg1 uuid.UUID) ([]database.TemplateGroup, error) {
 	m.ctrl.T.Helper()
@@ -1286,6 +1418,36 @@ func (mr *MockStoreMockRecorder) GetTemplateInsights(arg0, arg1 interface{}) *go
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTemplateInsights", reflect.TypeOf((*MockStore)(nil).GetTemplateInsights), arg0, arg1)
 }
 
+// GetTemplateInsightsByInterval mocks base method.
+func (m *MockStore) GetTemplateInsightsByInterval(arg0 context.Context, arg1 database.GetTemplateInsightsByIntervalParams) ([]database.GetTemplateInsightsByIntervalRow, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetTemplateInsightsByInterval", arg0, arg1)
+	ret0, _ := ret[0].([]database.GetTemplateInsightsByIntervalRow)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetTemplateInsightsByInterval indicates an expected call of GetTemplateInsightsByInterval.
+func (mr *MockStoreMockRecorder) GetTemplateInsightsByInterval(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTemplateInsightsByInterval", reflect.TypeOf((*MockStore)(nil).GetTemplateInsightsByInterval), arg0, arg1)
+}
+
+// GetTemplateInsightsByTemplate mocks base method.
+func (m *MockStore) GetTemplateInsightsByTemplate(arg0 context.Context, arg1 database.GetTemplateInsightsByTemplateParams) ([]database.GetTemplateInsightsByTemplateRow, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetTemplateInsightsByTemplate", arg0, arg1)
+	ret0, _ := ret[0].([]database.GetTemplateInsightsByTemplateRow)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetTemplateInsightsByTemplate indicates an expected call of GetTemplateInsightsByTemplate.
+func (mr *MockStoreMockRecorder) GetTemplateInsightsByTemplate(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTemplateInsightsByTemplate", reflect.TypeOf((*MockStore)(nil).GetTemplateInsightsByTemplate), arg0, arg1)
+}
+
 // GetTemplateParameterInsights mocks base method.
 func (m *MockStore) GetTemplateParameterInsights(arg0 context.Context, arg1 database.GetTemplateParameterInsightsParams) ([]database.GetTemplateParameterInsightsRow, error) {
 	m.ctrl.T.Helper()
@@ -1481,6 +1643,21 @@ func (mr *MockStoreMockRecorder) GetUnexpiredLicenses(arg0 interface{}) *gomock.
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUnexpiredLicenses", reflect.TypeOf((*MockStore)(nil).GetUnexpiredLicenses), arg0)
 }
 
+// GetUserActivityInsights mocks base method.
+func (m *MockStore) GetUserActivityInsights(arg0 context.Context, arg1 database.GetUserActivityInsightsParams) ([]database.GetUserActivityInsightsRow, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetUserActivityInsights", arg0, arg1)
+	ret0, _ := ret[0].([]database.GetUserActivityInsightsRow)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetUserActivityInsights indicates an expected call of GetUserActivityInsights.
+func (mr *MockStoreMockRecorder) GetUserActivityInsights(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserActivityInsights", reflect.TypeOf((*MockStore)(nil).GetUserActivityInsights), arg0, arg1)
+}
+
 // GetUserByEmailOrUsername mocks base method.
 func (m *MockStore) GetUserByEmailOrUsername(arg0 context.Context, arg1 database.GetUserByEmailOrUsernameParams) (database.User, error) {
 	m.ctrl.T.Helper()
@@ -1571,6 +1748,21 @@ func (mr *MockStoreMockRecorder) GetUserLinkByUserIDLoginType(arg0, arg1 interfa
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserLinkByUserIDLoginType", reflect.TypeOf((*MockStore)(nil).GetUserLinkByUserIDLoginType), arg0, arg1)
 }
 
+// GetUserLinksByUserID mocks base method.
+func (m *MockStore) GetUserLinksByUserID(arg0 context.Context, arg1 uuid.UUID) ([]database.UserLink, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetUserLinksByUserID", arg0, arg1)
+	ret0, _ := ret[0].([]database.UserLink)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetUserLinksByUserID indicates an expected call of GetUserLinksByUserID.
+func (mr *MockStoreMockRecorder) GetUserLinksByUserID(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUserLinksByUserID", reflect.TypeOf((*MockStore)(nil).GetUserLinksByUserID), arg0, arg1)
+}
+
 // GetUsers mocks base method.
 func (m *MockStore) GetUsers(arg0 context.Context, arg1 database.GetUsersParams) ([]database.GetUsersRow, error) {
 	m.ctrl.T.Helper()
@@ -1601,19 +1793,19 @@ func (mr *MockStoreMockRecorder) GetUsersByIDs(arg0, arg1 interface{}) *gomock.C
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetUsersByIDs", reflect.TypeOf((*MockStore)(nil).GetUsersByIDs), arg0, arg1)
 }
 
-// GetWorkspaceAgentByAuthToken mocks base method.
-func (m *MockStore) GetWorkspaceAgentByAuthToken(arg0 context.Context, arg1 uuid.UUID) (database.WorkspaceAgent, error) {
+// GetWorkspaceAgentAndOwnerByAuthToken mocks base method.
+func (m *MockStore) GetWorkspaceAgentAndOwnerByAuthToken(arg0 context.Context, arg1 uuid.UUID) (database.GetWorkspaceAgentAndOwnerByAuthTokenRow, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetWorkspaceAgentByAuthToken", arg0, arg1)
-	ret0, _ := ret[0].(database.WorkspaceAgent)
+	ret := m.ctrl.Call(m, "GetWorkspaceAgentAndOwnerByAuthToken", arg0, arg1)
+	ret0, _ := ret[0].(database.GetWorkspaceAgentAndOwnerByAuthTokenRow)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
-// GetWorkspaceAgentByAuthToken indicates an expected call of GetWorkspaceAgentByAuthToken.
-func (mr *MockStoreMockRecorder) GetWorkspaceAgentByAuthToken(arg0, arg1 interface{}) *gomock.Call {
+// GetWorkspaceAgentAndOwnerByAuthToken indicates an expected call of GetWorkspaceAgentAndOwnerByAuthToken.
+func (mr *MockStoreMockRecorder) GetWorkspaceAgentAndOwnerByAuthToken(arg0, arg1 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWorkspaceAgentByAuthToken", reflect.TypeOf((*MockStore)(nil).GetWorkspaceAgentByAuthToken), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWorkspaceAgentAndOwnerByAuthToken", reflect.TypeOf((*MockStore)(nil).GetWorkspaceAgentAndOwnerByAuthToken), arg0, arg1)
 }
 
 // GetWorkspaceAgentByID mocks base method.
@@ -1661,6 +1853,21 @@ func (mr *MockStoreMockRecorder) GetWorkspaceAgentLifecycleStateByID(arg0, arg1
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWorkspaceAgentLifecycleStateByID", reflect.TypeOf((*MockStore)(nil).GetWorkspaceAgentLifecycleStateByID), arg0, arg1)
 }
 
+// GetWorkspaceAgentLogSourcesByAgentIDs mocks base method.
+func (m *MockStore) GetWorkspaceAgentLogSourcesByAgentIDs(arg0 context.Context, arg1 []uuid.UUID) ([]database.WorkspaceAgentLogSource, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetWorkspaceAgentLogSourcesByAgentIDs", arg0, arg1)
+	ret0, _ := ret[0].([]database.WorkspaceAgentLogSource)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetWorkspaceAgentLogSourcesByAgentIDs indicates an expected call of GetWorkspaceAgentLogSourcesByAgentIDs.
+func (mr *MockStoreMockRecorder) GetWorkspaceAgentLogSourcesByAgentIDs(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWorkspaceAgentLogSourcesByAgentIDs", reflect.TypeOf((*MockStore)(nil).GetWorkspaceAgentLogSourcesByAgentIDs), arg0, arg1)
+}
+
 // GetWorkspaceAgentLogsAfter mocks base method.
 func (m *MockStore) GetWorkspaceAgentLogsAfter(arg0 context.Context, arg1 database.GetWorkspaceAgentLogsAfterParams) ([]database.WorkspaceAgentLog, error) {
 	m.ctrl.T.Helper()
@@ -1677,7 +1884,7 @@ func (mr *MockStoreMockRecorder) GetWorkspaceAgentLogsAfter(arg0, arg1 interface
 }
 
 // GetWorkspaceAgentMetadata mocks base method.
-func (m *MockStore) GetWorkspaceAgentMetadata(arg0 context.Context, arg1 uuid.UUID) ([]database.WorkspaceAgentMetadatum, error) {
+func (m *MockStore) GetWorkspaceAgentMetadata(arg0 context.Context, arg1 database.GetWorkspaceAgentMetadataParams) ([]database.WorkspaceAgentMetadatum, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetWorkspaceAgentMetadata", arg0, arg1)
 	ret0, _ := ret[0].([]database.WorkspaceAgentMetadatum)
@@ -1691,6 +1898,21 @@ func (mr *MockStoreMockRecorder) GetWorkspaceAgentMetadata(arg0, arg1 interface{
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWorkspaceAgentMetadata", reflect.TypeOf((*MockStore)(nil).GetWorkspaceAgentMetadata), arg0, arg1)
 }
 
+// GetWorkspaceAgentScriptsByAgentIDs mocks base method.
+func (m *MockStore) GetWorkspaceAgentScriptsByAgentIDs(arg0 context.Context, arg1 []uuid.UUID) ([]database.WorkspaceAgentScript, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetWorkspaceAgentScriptsByAgentIDs", arg0, arg1)
+	ret0, _ := ret[0].([]database.WorkspaceAgentScript)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetWorkspaceAgentScriptsByAgentIDs indicates an expected call of GetWorkspaceAgentScriptsByAgentIDs.
+func (mr *MockStoreMockRecorder) GetWorkspaceAgentScriptsByAgentIDs(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWorkspaceAgentScriptsByAgentIDs", reflect.TypeOf((*MockStore)(nil).GetWorkspaceAgentScriptsByAgentIDs), arg0, arg1)
+}
+
 // GetWorkspaceAgentStats mocks base method.
 func (m *MockStore) GetWorkspaceAgentStats(arg0 context.Context, arg1 time.Time) ([]database.GetWorkspaceAgentStatsRow, error) {
 	m.ctrl.T.Helper()
@@ -2215,6 +2437,20 @@ func (mr *MockStoreMockRecorder) InsertAuditLog(arg0, arg1 interface{}) *gomock.
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertAuditLog", reflect.TypeOf((*MockStore)(nil).InsertAuditLog), arg0, arg1)
 }
 
+// InsertDBCryptKey mocks base method.
+func (m *MockStore) InsertDBCryptKey(arg0 context.Context, arg1 database.InsertDBCryptKeyParams) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "InsertDBCryptKey", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// InsertDBCryptKey indicates an expected call of InsertDBCryptKey.
+func (mr *MockStoreMockRecorder) InsertDBCryptKey(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertDBCryptKey", reflect.TypeOf((*MockStore)(nil).InsertDBCryptKey), arg0, arg1)
+}
+
 // InsertDERPMeshKey mocks base method.
 func (m *MockStore) InsertDERPMeshKey(arg0 context.Context, arg1 string) error {
 	m.ctrl.T.Helper()
@@ -2243,34 +2479,34 @@ func (mr *MockStoreMockRecorder) InsertDeploymentID(arg0, arg1 interface{}) *gom
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertDeploymentID", reflect.TypeOf((*MockStore)(nil).InsertDeploymentID), arg0, arg1)
 }
 
-// InsertFile mocks base method.
-func (m *MockStore) InsertFile(arg0 context.Context, arg1 database.InsertFileParams) (database.File, error) {
+// InsertExternalAuthLink mocks base method.
+func (m *MockStore) InsertExternalAuthLink(arg0 context.Context, arg1 database.InsertExternalAuthLinkParams) (database.ExternalAuthLink, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "InsertFile", arg0, arg1)
-	ret0, _ := ret[0].(database.File)
+	ret := m.ctrl.Call(m, "InsertExternalAuthLink", arg0, arg1)
+	ret0, _ := ret[0].(database.ExternalAuthLink)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
-// InsertFile indicates an expected call of InsertFile.
-func (mr *MockStoreMockRecorder) InsertFile(arg0, arg1 interface{}) *gomock.Call {
+// InsertExternalAuthLink indicates an expected call of InsertExternalAuthLink.
+func (mr *MockStoreMockRecorder) InsertExternalAuthLink(arg0, arg1 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertFile", reflect.TypeOf((*MockStore)(nil).InsertFile), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertExternalAuthLink", reflect.TypeOf((*MockStore)(nil).InsertExternalAuthLink), arg0, arg1)
 }
 
-// InsertGitAuthLink mocks base method.
-func (m *MockStore) InsertGitAuthLink(arg0 context.Context, arg1 database.InsertGitAuthLinkParams) (database.GitAuthLink, error) {
+// InsertFile mocks base method.
+func (m *MockStore) InsertFile(arg0 context.Context, arg1 database.InsertFileParams) (database.File, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "InsertGitAuthLink", arg0, arg1)
-	ret0, _ := ret[0].(database.GitAuthLink)
+	ret := m.ctrl.Call(m, "InsertFile", arg0, arg1)
+	ret0, _ := ret[0].(database.File)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
-// InsertGitAuthLink indicates an expected call of InsertGitAuthLink.
-func (mr *MockStoreMockRecorder) InsertGitAuthLink(arg0, arg1 interface{}) *gomock.Call {
+// InsertFile indicates an expected call of InsertFile.
+func (mr *MockStoreMockRecorder) InsertFile(arg0, arg1 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertGitAuthLink", reflect.TypeOf((*MockStore)(nil).InsertGitAuthLink), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertFile", reflect.TypeOf((*MockStore)(nil).InsertFile), arg0, arg1)
 }
 
 // InsertGitSSHKey mocks base method.
@@ -2332,6 +2568,21 @@ func (mr *MockStoreMockRecorder) InsertLicense(arg0, arg1 interface{}) *gomock.C
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertLicense", reflect.TypeOf((*MockStore)(nil).InsertLicense), arg0, arg1)
 }
 
+// InsertMissingGroups mocks base method.
+func (m *MockStore) InsertMissingGroups(arg0 context.Context, arg1 database.InsertMissingGroupsParams) ([]database.Group, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "InsertMissingGroups", arg0, arg1)
+	ret0, _ := ret[0].([]database.Group)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// InsertMissingGroups indicates an expected call of InsertMissingGroups.
+func (mr *MockStoreMockRecorder) InsertMissingGroups(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertMissingGroups", reflect.TypeOf((*MockStore)(nil).InsertMissingGroups), arg0, arg1)
+}
+
 // InsertOrganization mocks base method.
 func (m *MockStore) InsertOrganization(arg0 context.Context, arg1 database.InsertOrganizationParams) (database.Organization, error) {
 	m.ctrl.T.Helper()
@@ -2554,6 +2805,21 @@ func (mr *MockStoreMockRecorder) InsertWorkspaceAgent(arg0, arg1 interface{}) *g
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertWorkspaceAgent", reflect.TypeOf((*MockStore)(nil).InsertWorkspaceAgent), arg0, arg1)
 }
 
+// InsertWorkspaceAgentLogSources mocks base method.
+func (m *MockStore) InsertWorkspaceAgentLogSources(arg0 context.Context, arg1 database.InsertWorkspaceAgentLogSourcesParams) ([]database.WorkspaceAgentLogSource, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "InsertWorkspaceAgentLogSources", arg0, arg1)
+	ret0, _ := ret[0].([]database.WorkspaceAgentLogSource)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// InsertWorkspaceAgentLogSources indicates an expected call of InsertWorkspaceAgentLogSources.
+func (mr *MockStoreMockRecorder) InsertWorkspaceAgentLogSources(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertWorkspaceAgentLogSources", reflect.TypeOf((*MockStore)(nil).InsertWorkspaceAgentLogSources), arg0, arg1)
+}
+
 // InsertWorkspaceAgentLogs mocks base method.
 func (m *MockStore) InsertWorkspaceAgentLogs(arg0 context.Context, arg1 database.InsertWorkspaceAgentLogsParams) ([]database.WorkspaceAgentLog, error) {
 	m.ctrl.T.Helper()
@@ -2583,6 +2849,21 @@ func (mr *MockStoreMockRecorder) InsertWorkspaceAgentMetadata(arg0, arg1 interfa
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertWorkspaceAgentMetadata", reflect.TypeOf((*MockStore)(nil).InsertWorkspaceAgentMetadata), arg0, arg1)
 }
 
+// InsertWorkspaceAgentScripts mocks base method.
+func (m *MockStore) InsertWorkspaceAgentScripts(arg0 context.Context, arg1 database.InsertWorkspaceAgentScriptsParams) ([]database.WorkspaceAgentScript, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "InsertWorkspaceAgentScripts", arg0, arg1)
+	ret0, _ := ret[0].([]database.WorkspaceAgentScript)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// InsertWorkspaceAgentScripts indicates an expected call of InsertWorkspaceAgentScripts.
+func (mr *MockStoreMockRecorder) InsertWorkspaceAgentScripts(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertWorkspaceAgentScripts", reflect.TypeOf((*MockStore)(nil).InsertWorkspaceAgentScripts), arg0, arg1)
+}
+
 // InsertWorkspaceAgentStat mocks base method.
 func (m *MockStore) InsertWorkspaceAgentStat(arg0 context.Context, arg1 database.InsertWorkspaceAgentStatParams) (database.WorkspaceAgentStat, error) {
 	m.ctrl.T.Helper()
@@ -2598,6 +2879,20 @@ func (mr *MockStoreMockRecorder) InsertWorkspaceAgentStat(arg0, arg1 interface{}
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertWorkspaceAgentStat", reflect.TypeOf((*MockStore)(nil).InsertWorkspaceAgentStat), arg0, arg1)
 }
 
+// InsertWorkspaceAgentStats mocks base method.
+func (m *MockStore) InsertWorkspaceAgentStats(arg0 context.Context, arg1 database.InsertWorkspaceAgentStatsParams) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "InsertWorkspaceAgentStats", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// InsertWorkspaceAgentStats indicates an expected call of InsertWorkspaceAgentStats.
+func (mr *MockStoreMockRecorder) InsertWorkspaceAgentStats(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertWorkspaceAgentStats", reflect.TypeOf((*MockStore)(nil).InsertWorkspaceAgentStats), arg0, arg1)
+}
+
 // InsertWorkspaceApp mocks base method.
 func (m *MockStore) InsertWorkspaceApp(arg0 context.Context, arg1 database.InsertWorkspaceAppParams) (database.WorkspaceApp, error) {
 	m.ctrl.T.Helper()
@@ -2613,6 +2908,20 @@ func (mr *MockStoreMockRecorder) InsertWorkspaceApp(arg0, arg1 interface{}) *gom
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertWorkspaceApp", reflect.TypeOf((*MockStore)(nil).InsertWorkspaceApp), arg0, arg1)
 }
 
+// InsertWorkspaceAppStats mocks base method.
+func (m *MockStore) InsertWorkspaceAppStats(arg0 context.Context, arg1 database.InsertWorkspaceAppStatsParams) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "InsertWorkspaceAppStats", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// InsertWorkspaceAppStats indicates an expected call of InsertWorkspaceAppStats.
+func (mr *MockStoreMockRecorder) InsertWorkspaceAppStats(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertWorkspaceAppStats", reflect.TypeOf((*MockStore)(nil).InsertWorkspaceAppStats), arg0, arg1)
+}
+
 // InsertWorkspaceBuild mocks base method.
 func (m *MockStore) InsertWorkspaceBuild(arg0 context.Context, arg1 database.InsertWorkspaceBuildParams) error {
 	m.ctrl.T.Helper()
@@ -2716,6 +3025,20 @@ func (mr *MockStoreMockRecorder) RegisterWorkspaceProxy(arg0, arg1 interface{})
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RegisterWorkspaceProxy", reflect.TypeOf((*MockStore)(nil).RegisterWorkspaceProxy), arg0, arg1)
 }
 
+// RevokeDBCryptKey mocks base method.
+func (m *MockStore) RevokeDBCryptKey(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RevokeDBCryptKey", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RevokeDBCryptKey indicates an expected call of RevokeDBCryptKey.
+func (mr *MockStoreMockRecorder) RevokeDBCryptKey(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RevokeDBCryptKey", reflect.TypeOf((*MockStore)(nil).RevokeDBCryptKey), arg0, arg1)
+}
+
 // TryAcquireLock mocks base method.
 func (m *MockStore) TryAcquireLock(arg0 context.Context, arg1 int64) (bool, error) {
 	m.ctrl.T.Helper()
@@ -2731,6 +3054,20 @@ func (mr *MockStoreMockRecorder) TryAcquireLock(arg0, arg1 interface{}) *gomock.
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "TryAcquireLock", reflect.TypeOf((*MockStore)(nil).TryAcquireLock), arg0, arg1)
 }
 
+// UnarchiveTemplateVersion mocks base method.
+func (m *MockStore) UnarchiveTemplateVersion(arg0 context.Context, arg1 database.UnarchiveTemplateVersionParams) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UnarchiveTemplateVersion", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// UnarchiveTemplateVersion indicates an expected call of UnarchiveTemplateVersion.
+func (mr *MockStoreMockRecorder) UnarchiveTemplateVersion(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UnarchiveTemplateVersion", reflect.TypeOf((*MockStore)(nil).UnarchiveTemplateVersion), arg0, arg1)
+}
+
 // UpdateAPIKeyByID mocks base method.
 func (m *MockStore) UpdateAPIKeyByID(arg0 context.Context, arg1 database.UpdateAPIKeyByIDParams) error {
 	m.ctrl.T.Helper()
@@ -2745,19 +3082,19 @@ func (mr *MockStoreMockRecorder) UpdateAPIKeyByID(arg0, arg1 interface{}) *gomoc
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateAPIKeyByID", reflect.TypeOf((*MockStore)(nil).UpdateAPIKeyByID), arg0, arg1)
 }
 
-// UpdateGitAuthLink mocks base method.
-func (m *MockStore) UpdateGitAuthLink(arg0 context.Context, arg1 database.UpdateGitAuthLinkParams) (database.GitAuthLink, error) {
+// UpdateExternalAuthLink mocks base method.
+func (m *MockStore) UpdateExternalAuthLink(arg0 context.Context, arg1 database.UpdateExternalAuthLinkParams) (database.ExternalAuthLink, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "UpdateGitAuthLink", arg0, arg1)
-	ret0, _ := ret[0].(database.GitAuthLink)
+	ret := m.ctrl.Call(m, "UpdateExternalAuthLink", arg0, arg1)
+	ret0, _ := ret[0].(database.ExternalAuthLink)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
-// UpdateGitAuthLink indicates an expected call of UpdateGitAuthLink.
-func (mr *MockStoreMockRecorder) UpdateGitAuthLink(arg0, arg1 interface{}) *gomock.Call {
+// UpdateExternalAuthLink indicates an expected call of UpdateExternalAuthLink.
+func (mr *MockStoreMockRecorder) UpdateExternalAuthLink(arg0, arg1 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateGitAuthLink", reflect.TypeOf((*MockStore)(nil).UpdateGitAuthLink), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateExternalAuthLink", reflect.TypeOf((*MockStore)(nil).UpdateExternalAuthLink), arg0, arg1)
 }
 
 // UpdateGitSSHKey mocks base method.
@@ -2891,6 +3228,20 @@ func (mr *MockStoreMockRecorder) UpdateTemplateACLByID(arg0, arg1 interface{}) *
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateTemplateACLByID", reflect.TypeOf((*MockStore)(nil).UpdateTemplateACLByID), arg0, arg1)
 }
 
+// UpdateTemplateAccessControlByID mocks base method.
+func (m *MockStore) UpdateTemplateAccessControlByID(arg0 context.Context, arg1 database.UpdateTemplateAccessControlByIDParams) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpdateTemplateAccessControlByID", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// UpdateTemplateAccessControlByID indicates an expected call of UpdateTemplateAccessControlByID.
+func (mr *MockStoreMockRecorder) UpdateTemplateAccessControlByID(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateTemplateAccessControlByID", reflect.TypeOf((*MockStore)(nil).UpdateTemplateAccessControlByID), arg0, arg1)
+}
+
 // UpdateTemplateActiveVersionByID mocks base method.
 func (m *MockStore) UpdateTemplateActiveVersionByID(arg0 context.Context, arg1 database.UpdateTemplateActiveVersionByIDParams) error {
 	m.ctrl.T.Helper()
@@ -2975,18 +3326,32 @@ func (mr *MockStoreMockRecorder) UpdateTemplateVersionDescriptionByJobID(arg0, a
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateTemplateVersionDescriptionByJobID", reflect.TypeOf((*MockStore)(nil).UpdateTemplateVersionDescriptionByJobID), arg0, arg1)
 }
 
-// UpdateTemplateVersionGitAuthProvidersByJobID mocks base method.
-func (m *MockStore) UpdateTemplateVersionGitAuthProvidersByJobID(arg0 context.Context, arg1 database.UpdateTemplateVersionGitAuthProvidersByJobIDParams) error {
+// UpdateTemplateVersionExternalAuthProvidersByJobID mocks base method.
+func (m *MockStore) UpdateTemplateVersionExternalAuthProvidersByJobID(arg0 context.Context, arg1 database.UpdateTemplateVersionExternalAuthProvidersByJobIDParams) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpdateTemplateVersionExternalAuthProvidersByJobID", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// UpdateTemplateVersionExternalAuthProvidersByJobID indicates an expected call of UpdateTemplateVersionExternalAuthProvidersByJobID.
+func (mr *MockStoreMockRecorder) UpdateTemplateVersionExternalAuthProvidersByJobID(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateTemplateVersionExternalAuthProvidersByJobID", reflect.TypeOf((*MockStore)(nil).UpdateTemplateVersionExternalAuthProvidersByJobID), arg0, arg1)
+}
+
+// UpdateTemplateWorkspacesLastUsedAt mocks base method.
+func (m *MockStore) UpdateTemplateWorkspacesLastUsedAt(arg0 context.Context, arg1 database.UpdateTemplateWorkspacesLastUsedAtParams) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "UpdateTemplateVersionGitAuthProvidersByJobID", arg0, arg1)
+	ret := m.ctrl.Call(m, "UpdateTemplateWorkspacesLastUsedAt", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
-// UpdateTemplateVersionGitAuthProvidersByJobID indicates an expected call of UpdateTemplateVersionGitAuthProvidersByJobID.
-func (mr *MockStoreMockRecorder) UpdateTemplateVersionGitAuthProvidersByJobID(arg0, arg1 interface{}) *gomock.Call {
+// UpdateTemplateWorkspacesLastUsedAt indicates an expected call of UpdateTemplateWorkspacesLastUsedAt.
+func (mr *MockStoreMockRecorder) UpdateTemplateWorkspacesLastUsedAt(arg0, arg1 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateTemplateVersionGitAuthProvidersByJobID", reflect.TypeOf((*MockStore)(nil).UpdateTemplateVersionGitAuthProvidersByJobID), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateTemplateWorkspacesLastUsedAt", reflect.TypeOf((*MockStore)(nil).UpdateTemplateWorkspacesLastUsedAt), arg0, arg1)
 }
 
 // UpdateUserDeletedByID mocks base method.
@@ -3236,32 +3601,32 @@ func (mr *MockStoreMockRecorder) UpdateWorkspaceAppHealthByID(arg0, arg1 interfa
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceAppHealthByID", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceAppHealthByID), arg0, arg1)
 }
 
-// UpdateWorkspaceAutostart mocks base method.
-func (m *MockStore) UpdateWorkspaceAutostart(arg0 context.Context, arg1 database.UpdateWorkspaceAutostartParams) error {
+// UpdateWorkspaceAutomaticUpdates mocks base method.
+func (m *MockStore) UpdateWorkspaceAutomaticUpdates(arg0 context.Context, arg1 database.UpdateWorkspaceAutomaticUpdatesParams) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "UpdateWorkspaceAutostart", arg0, arg1)
+	ret := m.ctrl.Call(m, "UpdateWorkspaceAutomaticUpdates", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
-// UpdateWorkspaceAutostart indicates an expected call of UpdateWorkspaceAutostart.
-func (mr *MockStoreMockRecorder) UpdateWorkspaceAutostart(arg0, arg1 interface{}) *gomock.Call {
+// UpdateWorkspaceAutomaticUpdates indicates an expected call of UpdateWorkspaceAutomaticUpdates.
+func (mr *MockStoreMockRecorder) UpdateWorkspaceAutomaticUpdates(arg0, arg1 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceAutostart", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceAutostart), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceAutomaticUpdates", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceAutomaticUpdates), arg0, arg1)
 }
 
-// UpdateWorkspaceBuildByID mocks base method.
-func (m *MockStore) UpdateWorkspaceBuildByID(arg0 context.Context, arg1 database.UpdateWorkspaceBuildByIDParams) error {
+// UpdateWorkspaceAutostart mocks base method.
+func (m *MockStore) UpdateWorkspaceAutostart(arg0 context.Context, arg1 database.UpdateWorkspaceAutostartParams) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "UpdateWorkspaceBuildByID", arg0, arg1)
+	ret := m.ctrl.Call(m, "UpdateWorkspaceAutostart", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
-// UpdateWorkspaceBuildByID indicates an expected call of UpdateWorkspaceBuildByID.
-func (mr *MockStoreMockRecorder) UpdateWorkspaceBuildByID(arg0, arg1 interface{}) *gomock.Call {
+// UpdateWorkspaceAutostart indicates an expected call of UpdateWorkspaceAutostart.
+func (mr *MockStoreMockRecorder) UpdateWorkspaceAutostart(arg0, arg1 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceBuildByID", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceBuildByID), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceAutostart", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceAutostart), arg0, arg1)
 }
 
 // UpdateWorkspaceBuildCostByID mocks base method.
@@ -3278,6 +3643,34 @@ func (mr *MockStoreMockRecorder) UpdateWorkspaceBuildCostByID(arg0, arg1 interfa
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceBuildCostByID", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceBuildCostByID), arg0, arg1)
 }
 
+// UpdateWorkspaceBuildDeadlineByID mocks base method.
+func (m *MockStore) UpdateWorkspaceBuildDeadlineByID(arg0 context.Context, arg1 database.UpdateWorkspaceBuildDeadlineByIDParams) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpdateWorkspaceBuildDeadlineByID", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// UpdateWorkspaceBuildDeadlineByID indicates an expected call of UpdateWorkspaceBuildDeadlineByID.
+func (mr *MockStoreMockRecorder) UpdateWorkspaceBuildDeadlineByID(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceBuildDeadlineByID", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceBuildDeadlineByID), arg0, arg1)
+}
+
+// UpdateWorkspaceBuildProvisionerStateByID mocks base method.
+func (m *MockStore) UpdateWorkspaceBuildProvisionerStateByID(arg0 context.Context, arg1 database.UpdateWorkspaceBuildProvisionerStateByIDParams) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpdateWorkspaceBuildProvisionerStateByID", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// UpdateWorkspaceBuildProvisionerStateByID indicates an expected call of UpdateWorkspaceBuildProvisionerStateByID.
+func (mr *MockStoreMockRecorder) UpdateWorkspaceBuildProvisionerStateByID(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceBuildProvisionerStateByID", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceBuildProvisionerStateByID), arg0, arg1)
+}
+
 // UpdateWorkspaceDeletedByID mocks base method.
 func (m *MockStore) UpdateWorkspaceDeletedByID(arg0 context.Context, arg1 database.UpdateWorkspaceDeletedByIDParams) error {
 	m.ctrl.T.Helper()
@@ -3292,32 +3685,33 @@ func (mr *MockStoreMockRecorder) UpdateWorkspaceDeletedByID(arg0, arg1 interface
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceDeletedByID", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceDeletedByID), arg0, arg1)
 }
 
-// UpdateWorkspaceLastUsedAt mocks base method.
-func (m *MockStore) UpdateWorkspaceLastUsedAt(arg0 context.Context, arg1 database.UpdateWorkspaceLastUsedAtParams) error {
+// UpdateWorkspaceDormantDeletingAt mocks base method.
+func (m *MockStore) UpdateWorkspaceDormantDeletingAt(arg0 context.Context, arg1 database.UpdateWorkspaceDormantDeletingAtParams) (database.Workspace, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "UpdateWorkspaceLastUsedAt", arg0, arg1)
-	ret0, _ := ret[0].(error)
-	return ret0
+	ret := m.ctrl.Call(m, "UpdateWorkspaceDormantDeletingAt", arg0, arg1)
+	ret0, _ := ret[0].(database.Workspace)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
 }
 
-// UpdateWorkspaceLastUsedAt indicates an expected call of UpdateWorkspaceLastUsedAt.
-func (mr *MockStoreMockRecorder) UpdateWorkspaceLastUsedAt(arg0, arg1 interface{}) *gomock.Call {
+// UpdateWorkspaceDormantDeletingAt indicates an expected call of UpdateWorkspaceDormantDeletingAt.
+func (mr *MockStoreMockRecorder) UpdateWorkspaceDormantDeletingAt(arg0, arg1 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceLastUsedAt", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceLastUsedAt), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceDormantDeletingAt", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceDormantDeletingAt), arg0, arg1)
 }
 
-// UpdateWorkspaceLockedDeletingAt mocks base method.
-func (m *MockStore) UpdateWorkspaceLockedDeletingAt(arg0 context.Context, arg1 database.UpdateWorkspaceLockedDeletingAtParams) error {
+// UpdateWorkspaceLastUsedAt mocks base method.
+func (m *MockStore) UpdateWorkspaceLastUsedAt(arg0 context.Context, arg1 database.UpdateWorkspaceLastUsedAtParams) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "UpdateWorkspaceLockedDeletingAt", arg0, arg1)
+	ret := m.ctrl.Call(m, "UpdateWorkspaceLastUsedAt", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
-// UpdateWorkspaceLockedDeletingAt indicates an expected call of UpdateWorkspaceLockedDeletingAt.
-func (mr *MockStoreMockRecorder) UpdateWorkspaceLockedDeletingAt(arg0, arg1 interface{}) *gomock.Call {
+// UpdateWorkspaceLastUsedAt indicates an expected call of UpdateWorkspaceLastUsedAt.
+func (mr *MockStoreMockRecorder) UpdateWorkspaceLastUsedAt(arg0, arg1 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceLockedDeletingAt", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceLockedDeletingAt), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceLastUsedAt", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceLastUsedAt), arg0, arg1)
 }
 
 // UpdateWorkspaceProxy mocks base method.
@@ -3363,18 +3757,18 @@ func (mr *MockStoreMockRecorder) UpdateWorkspaceTTL(arg0, arg1 interface{}) *gom
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspaceTTL", reflect.TypeOf((*MockStore)(nil).UpdateWorkspaceTTL), arg0, arg1)
 }
 
-// UpdateWorkspacesDeletingAtByTemplateID mocks base method.
-func (m *MockStore) UpdateWorkspacesDeletingAtByTemplateID(arg0 context.Context, arg1 database.UpdateWorkspacesDeletingAtByTemplateIDParams) error {
+// UpdateWorkspacesDormantDeletingAtByTemplateID mocks base method.
+func (m *MockStore) UpdateWorkspacesDormantDeletingAtByTemplateID(arg0 context.Context, arg1 database.UpdateWorkspacesDormantDeletingAtByTemplateIDParams) error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "UpdateWorkspacesDeletingAtByTemplateID", arg0, arg1)
+	ret := m.ctrl.Call(m, "UpdateWorkspacesDormantDeletingAtByTemplateID", arg0, arg1)
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
-// UpdateWorkspacesDeletingAtByTemplateID indicates an expected call of UpdateWorkspacesDeletingAtByTemplateID.
-func (mr *MockStoreMockRecorder) UpdateWorkspacesDeletingAtByTemplateID(arg0, arg1 interface{}) *gomock.Call {
+// UpdateWorkspacesDormantDeletingAtByTemplateID indicates an expected call of UpdateWorkspacesDormantDeletingAtByTemplateID.
+func (mr *MockStoreMockRecorder) UpdateWorkspacesDormantDeletingAtByTemplateID(arg0, arg1 interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspacesDeletingAtByTemplateID", reflect.TypeOf((*MockStore)(nil).UpdateWorkspacesDeletingAtByTemplateID), arg0, arg1)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateWorkspacesDormantDeletingAtByTemplateID", reflect.TypeOf((*MockStore)(nil).UpdateWorkspacesDormantDeletingAtByTemplateID), arg0, arg1)
 }
 
 // UpsertAppSecurityKey mocks base method.
@@ -3391,6 +3785,20 @@ func (mr *MockStoreMockRecorder) UpsertAppSecurityKey(arg0, arg1 interface{}) *g
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpsertAppSecurityKey", reflect.TypeOf((*MockStore)(nil).UpsertAppSecurityKey), arg0, arg1)
 }
 
+// UpsertApplicationName mocks base method.
+func (m *MockStore) UpsertApplicationName(arg0 context.Context, arg1 string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpsertApplicationName", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// UpsertApplicationName indicates an expected call of UpsertApplicationName.
+func (mr *MockStoreMockRecorder) UpsertApplicationName(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpsertApplicationName", reflect.TypeOf((*MockStore)(nil).UpsertApplicationName), arg0, arg1)
+}
+
 // UpsertDefaultProxy mocks base method.
 func (m *MockStore) UpsertDefaultProxy(arg0 context.Context, arg1 database.UpsertDefaultProxyParams) error {
 	m.ctrl.T.Helper()
@@ -3491,6 +3899,20 @@ func (mr *MockStoreMockRecorder) UpsertTailnetClient(arg0, arg1 interface{}) *go
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpsertTailnetClient", reflect.TypeOf((*MockStore)(nil).UpsertTailnetClient), arg0, arg1)
 }
 
+// UpsertTailnetClientSubscription mocks base method.
+func (m *MockStore) UpsertTailnetClientSubscription(arg0 context.Context, arg1 database.UpsertTailnetClientSubscriptionParams) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpsertTailnetClientSubscription", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// UpsertTailnetClientSubscription indicates an expected call of UpsertTailnetClientSubscription.
+func (mr *MockStoreMockRecorder) UpsertTailnetClientSubscription(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpsertTailnetClientSubscription", reflect.TypeOf((*MockStore)(nil).UpsertTailnetClientSubscription), arg0, arg1)
+}
+
 // UpsertTailnetCoordinator mocks base method.
 func (m *MockStore) UpsertTailnetCoordinator(arg0 context.Context, arg1 uuid.UUID) (database.TailnetCoordinator, error) {
 	m.ctrl.T.Helper()
diff --git a/coderd/database/dbmock/doc.go b/coderd/database/dbmock/doc.go
index 2199de635b86b..9d06ed8a0dbf1 100644
--- a/coderd/database/dbmock/doc.go
+++ b/coderd/database/dbmock/doc.go
@@ -1,4 +1,4 @@
 // package dbmock contains a mocked implementation of the database.Store interface for use in tests
 package dbmock
 
-//go:generate mockgen -destination ./dbmock.go -package dbmock github.com/coder/coder/coderd/database Store
+//go:generate mockgen -destination ./dbmock.go -package dbmock github.com/coder/coder/v2/coderd/database Store
diff --git a/coderd/database/dbpurge/dbpurge.go b/coderd/database/dbpurge/dbpurge.go
index de7c2db67ef4b..b1062eee312ed 100644
--- a/coderd/database/dbpurge/dbpurge.go
+++ b/coderd/database/dbpurge/dbpurge.go
@@ -9,8 +9,8 @@ import (
 	"golang.org/x/sync/errgroup"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
 )
 
 const (
diff --git a/coderd/database/dbpurge/dbpurge_test.go b/coderd/database/dbpurge/dbpurge_test.go
index bc51f15b451da..64fc74b4775ca 100644
--- a/coderd/database/dbpurge/dbpurge_test.go
+++ b/coderd/database/dbpurge/dbpurge_test.go
@@ -9,8 +9,8 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbpurge"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbpurge"
 )
 
 func TestMain(m *testing.M) {
@@ -20,7 +20,7 @@ func TestMain(m *testing.M) {
 // Ensures no goroutines leak.
 func TestPurge(t *testing.T) {
 	t.Parallel()
-	purger := dbpurge.New(context.Background(), slogtest.Make(t, nil), dbfake.New())
+	purger := dbpurge.New(context.Background(), slogtest.Make(t, nil), dbmem.New())
 	err := purger.Close()
 	require.NoError(t, err)
 }
diff --git a/coderd/database/dbtestutil/db.go b/coderd/database/dbtestutil/db.go
index ad8cecf143240..c179917c0594a 100644
--- a/coderd/database/dbtestutil/db.go
+++ b/coderd/database/dbtestutil/db.go
@@ -1,17 +1,26 @@
 package dbtestutil
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
+	"fmt"
+	"net/url"
 	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/postgres"
-	"github.com/coder/coder/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/postgres"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
 )
 
 // WillUsePostgres returns true if a call to NewDB() will return a real, postgres-backed Store and Pubsub.
@@ -19,10 +28,58 @@ func WillUsePostgres() bool {
 	return os.Getenv("DB") != ""
 }
 
-func NewDB(t testing.TB) (database.Store, pubsub.Pubsub) {
+type options struct {
+	fixedTimezone string
+	dumpOnFailure bool
+	returnSQLDB   func(*sql.DB)
+}
+
+type Option func(*options)
+
+// WithTimezone sets the database to the defined timezone.
+func WithTimezone(tz string) Option {
+	return func(o *options) {
+		o.fixedTimezone = tz
+	}
+}
+
+// WithDumpOnFailure will dump the entire database on test failure.
+func WithDumpOnFailure() Option {
+	return func(o *options) {
+		o.dumpOnFailure = true
+	}
+}
+
+func withReturnSQLDB(f func(*sql.DB)) Option {
+	return func(o *options) {
+		o.returnSQLDB = f
+	}
+}
+
+func NewDBWithSQLDB(t testing.TB, opts ...Option) (database.Store, pubsub.Pubsub, *sql.DB) {
 	t.Helper()
 
-	db := dbfake.New()
+	if !WillUsePostgres() {
+		t.Fatal("cannot use NewDBWithSQLDB without PostgreSQL, consider adding `if !dbtestutil.WillUsePostgres() { t.Skip() }` to this test")
+	}
+
+	var sqlDB *sql.DB
+	opts = append(opts, withReturnSQLDB(func(db *sql.DB) {
+		sqlDB = db
+	}))
+	db, ps := NewDB(t, opts...)
+	return db, ps, sqlDB
+}
+
+func NewDB(t testing.TB, opts ...Option) (database.Store, pubsub.Pubsub) {
+	t.Helper()
+
+	var o options
+	for _, opt := range opts {
+		opt(&o)
+	}
+
+	db := dbmem.New()
 	ps := pubsub.NewInMemory()
 	if WillUsePostgres() {
 		connectionURL := os.Getenv("CODER_PG_CONNECTION_URL")
@@ -35,11 +92,30 @@ func NewDB(t testing.TB) (database.Store, pubsub.Pubsub) {
 			require.NoError(t, err)
 			t.Cleanup(closePg)
 		}
+
+		if o.fixedTimezone == "" {
+			// To make sure we find timezone-related issues, we set the timezone
+			// of the database to a non-UTC one.
+			// The below was picked due to the following properties:
+			// - It has a non-UTC offset
+			// - It has a fractional hour UTC offset
+			// - It includes a daylight savings time component
+			o.fixedTimezone = "Canada/Newfoundland"
+		}
+		dbName := dbNameFromConnectionURL(t, connectionURL)
+		setDBTimezone(t, connectionURL, dbName, o.fixedTimezone)
+
 		sqlDB, err := sql.Open("postgres", connectionURL)
 		require.NoError(t, err)
 		t.Cleanup(func() {
 			_ = sqlDB.Close()
 		})
+		if o.returnSQLDB != nil {
+			o.returnSQLDB(sqlDB)
+		}
+		if o.dumpOnFailure {
+			t.Cleanup(func() { DumpOnFailure(t, connectionURL) })
+		}
 		db = database.New(sqlDB)
 
 		ps, err = pubsub.New(context.Background(), sqlDB, connectionURL)
@@ -51,3 +127,111 @@ func NewDB(t testing.TB) (database.Store, pubsub.Pubsub) {
 
 	return db, ps
 }
+
+// setRandDBTimezone sets the timezone of the database to the given timezone.
+// Note that the updated timezone only comes into effect on reconnect, so we
+// create our own connection for this and close the DB after we're done.
+func setDBTimezone(t testing.TB, dbURL, dbname, tz string) {
+	t.Helper()
+
+	sqlDB, err := sql.Open("postgres", dbURL)
+	require.NoError(t, err)
+	defer func() {
+		_ = sqlDB.Close()
+	}()
+
+	// nolint: gosec // This unfortunately does not work with placeholders.
+	_, err = sqlDB.Exec(fmt.Sprintf("ALTER DATABASE %s SET TIMEZONE TO %q", dbname, tz))
+	require.NoError(t, err, "failed to set timezone for database")
+}
+
+// dbNameFromConnectionURL returns the database name from the given connection URL,
+// where connectionURL is of the form postgres://user:pass@host:port/dbname
+func dbNameFromConnectionURL(t testing.TB, connectionURL string) string {
+	u, err := url.Parse(connectionURL)
+	require.NoError(t, err)
+	return strings.TrimPrefix(u.Path, "/")
+}
+
+// DumpOnFailure exports the database referenced by connectionURL to a file
+// corresponding to the current test, with a suffix indicating the time the
+// test was run.
+// To import this into a new database (assuming you have already run make test-postgres-docker):
+//   - Create a new test database:
+//     go run ./scripts/migrate-ci/main.go and note the database name it outputs
+//   - Import the file into the above database:
+//     psql 'postgres://postgres:postgres@127.0.0.1:5432/<dbname>?sslmode=disable' -f <path to file.test.sql>
+//   - Run a dev server against that database:
+//     ./scripts/coder-dev.sh server --postgres-url='postgres://postgres:postgres@127.0.0.1:5432/<dbname>?sslmode=disable'
+func DumpOnFailure(t testing.TB, connectionURL string) {
+	if !t.Failed() {
+		return
+	}
+	cwd, err := filepath.Abs(".")
+	if err != nil {
+		t.Errorf("dump on failure: cannot determine current working directory")
+		return
+	}
+	snakeCaseName := regexp.MustCompile("[^a-zA-Z0-9-_]+").ReplaceAllString(t.Name(), "_")
+	now := time.Now()
+	timeSuffix := fmt.Sprintf("%d%d%d%d%d%d", now.Year(), now.Month(), now.Day(), now.Hour(), now.Minute(), now.Second())
+	outPath := filepath.Join(cwd, snakeCaseName+"."+timeSuffix+".test.sql")
+	dump, err := pgDump(connectionURL)
+	if err != nil {
+		t.Errorf("dump on failure: failed to run pg_dump")
+		return
+	}
+	if err := os.WriteFile(outPath, filterDump(dump), 0o600); err != nil {
+		t.Errorf("dump on failure: failed to write: %s", err.Error())
+		return
+	}
+	t.Logf("Dumped database to %q due to failed test. I hope you find what you're looking for!", outPath)
+}
+
+// pgDump runs pg_dump against dbURL and returns the output.
+func pgDump(dbURL string) ([]byte, error) {
+	if _, err := exec.LookPath("pg_dump"); err != nil {
+		return nil, xerrors.Errorf("could not find pg_dump in path: %w", err)
+	}
+	cmdArgs := []string{
+		"pg_dump",
+		dbURL,
+		"--data-only",
+		"--column-inserts",
+		"--no-comments",
+		"--no-privileges",
+		"--no-publication",
+		"--no-security-labels",
+		"--no-subscriptions",
+		"--no-tablespaces",
+		// "--no-unlogged-table-data", // some tables are unlogged and may contain data of interest
+		"--no-owner",
+		"--exclude-table=schema_migrations",
+	}
+	cmd := exec.Command(cmdArgs[0], cmdArgs[1:]...) // nolint:gosec
+	cmd.Env = []string{
+		// "PGTZ=UTC", // This is probably not going to be useful if tz has been changed.
+		"PGCLIENTENCODING=UTF8",
+		"PGDATABASE=", // we should always specify the database name in the connection string
+	}
+	var stdout bytes.Buffer
+	cmd.Stdout = &stdout
+	if err := cmd.Run(); err != nil {
+		return nil, xerrors.Errorf("exec pg_dump: %w", err)
+	}
+	return stdout.Bytes(), nil
+}
+
+// Unfortunately, some insert expressions span multiple lines.
+// The below may be over-permissive but better that than truncating data.
+var insertExpr = regexp.MustCompile(`(?s)\bINSERT[^;]+;`)
+
+func filterDump(dump []byte) []byte {
+	var buf bytes.Buffer
+	matches := insertExpr.FindAll(dump, -1)
+	for _, m := range matches {
+		_, _ = buf.Write(m)
+		_, _ = buf.WriteRune('\n')
+	}
+	return buf.Bytes()
+}
diff --git a/coderd/database/dbtestutil/randtz/randtz.go b/coderd/database/dbtestutil/randtz/randtz.go
new file mode 100644
index 0000000000000..1a53bfaf725fd
--- /dev/null
+++ b/coderd/database/dbtestutil/randtz/randtz.go
@@ -0,0 +1,1034 @@
+package randtz
+
+import (
+	"math/rand"
+	"sync"
+	"testing"
+	"time"
+)
+
+var (
+	randTZName     string
+	randTZNameOnce sync.Once
+)
+
+// Name returns a random timezone name from the list of all
+// timezones known to PostgreSQL.
+func Name(t testing.TB) string {
+	t.Helper()
+
+	randTZNameOnce.Do(func() {
+		// nolint: gosec // not used for cryptography
+		rnd := rand.New(rand.NewSource(time.Now().Unix()))
+		idx := rnd.Intn(len(tznames))
+		randTZName = tznames[idx]
+		t.Logf("Random db timezone is %q\nIf you need a specific timezone, use dbtestutil.WithTimezone()", randTZName)
+	})
+
+	return randTZName
+}
+
+// tznames is a list of all timezone names known to postgresql.
+// The below list was generated with the query
+// select name from pg_timezone_names order by name asc;
+var tznames = []string{
+	"Africa/Abidjan",
+	"Africa/Accra",
+	"Africa/Addis_Ababa",
+	"Africa/Algiers",
+	"Africa/Asmara",
+	"Africa/Asmera",
+	"Africa/Bamako",
+	"Africa/Bangui",
+	"Africa/Banjul",
+	"Africa/Bissau",
+	"Africa/Blantyre",
+	"Africa/Brazzaville",
+	"Africa/Bujumbura",
+	"Africa/Cairo",
+	"Africa/Casablanca",
+	"Africa/Ceuta",
+	"Africa/Conakry",
+	"Africa/Dakar",
+	"Africa/Dar_es_Salaam",
+	"Africa/Djibouti",
+	"Africa/Douala",
+	"Africa/El_Aaiun",
+	"Africa/Freetown",
+	"Africa/Gaborone",
+	"Africa/Harare",
+	"Africa/Johannesburg",
+	"Africa/Juba",
+	"Africa/Kampala",
+	"Africa/Khartoum",
+	"Africa/Kigali",
+	"Africa/Kinshasa",
+	"Africa/Lagos",
+	"Africa/Libreville",
+	"Africa/Lome",
+	"Africa/Luanda",
+	"Africa/Lubumbashi",
+	"Africa/Lusaka",
+	"Africa/Malabo",
+	"Africa/Maputo",
+	"Africa/Maseru",
+	"Africa/Mbabane",
+	"Africa/Mogadishu",
+	"Africa/Monrovia",
+	"Africa/Nairobi",
+	"Africa/Ndjamena",
+	"Africa/Niamey",
+	"Africa/Nouakchott",
+	"Africa/Ouagadougou",
+	"Africa/Porto-Novo",
+	"Africa/Sao_Tome",
+	"Africa/Timbuktu",
+	"Africa/Tripoli",
+	"Africa/Tunis",
+	"Africa/Windhoek",
+	"America/Adak",
+	"America/Anchorage",
+	"America/Anguilla",
+	"America/Antigua",
+	"America/Araguaina",
+	"America/Argentina/Buenos_Aires",
+	"America/Argentina/Catamarca",
+	"America/Argentina/ComodRivadavia",
+	"America/Argentina/Cordoba",
+	"America/Argentina/Jujuy",
+	"America/Argentina/La_Rioja",
+	"America/Argentina/Mendoza",
+	"America/Argentina/Rio_Gallegos",
+	"America/Argentina/Salta",
+	"America/Argentina/San_Juan",
+	"America/Argentina/San_Luis",
+	"America/Argentina/Tucuman",
+	"America/Argentina/Ushuaia",
+	"America/Aruba",
+	"America/Asuncion",
+	"America/Atikokan",
+	"America/Atka",
+	"America/Bahia",
+	"America/Bahia_Banderas",
+	"America/Barbados",
+	"America/Belem",
+	"America/Belize",
+	"America/Blanc-Sablon",
+	"America/Boa_Vista",
+	"America/Bogota",
+	"America/Boise",
+	"America/Buenos_Aires",
+	"America/Cambridge_Bay",
+	"America/Campo_Grande",
+	"America/Cancun",
+	"America/Caracas",
+	"America/Catamarca",
+	"America/Cayenne",
+	"America/Cayman",
+	"America/Chicago",
+	"America/Chihuahua",
+	"America/Ciudad_Juarez",
+	"America/Coral_Harbor",
+	"America/Cordoba",
+	"America/Costa_Rica",
+	"America/Creston",
+	"America/Cuiaba",
+	"America/Curacao",
+	"America/Danmarkshavn",
+	"America/Dawson",
+	"America/Dawson_Creek",
+	"America/Denver",
+	"America/Detroit",
+	"America/Dominica",
+	"America/Edmonton",
+	"America/Eirunepe",
+	"America/El_Salvador",
+	"America/Ensenada",
+	"America/Fortaleza",
+	"America/Fort_Nelson",
+	"America/Fort_Wayne",
+	"America/Glace_Bay",
+	"America/Godthab",
+	"America/Goose_Bay",
+	"America/Grand_Turk",
+	"America/Grenada",
+	"America/Guadeloupe",
+	"America/Guatemala",
+	"America/Guayaquil",
+	"America/Guyana",
+	"America/Halifax",
+	"America/Havana",
+	"America/Hermosillo",
+	"America/Indiana/Indianapolis",
+	"America/Indiana/Knox",
+	"America/Indiana/Marengo",
+	"America/Indiana/Petersburg",
+	"America/Indianapolis",
+	"America/Indiana/Tell_City",
+	"America/Indiana/Vevay",
+	"America/Indiana/Vincennes",
+	"America/Indiana/Winamac",
+	"America/Inuvik",
+	"America/Iqaluit",
+	"America/Jamaica",
+	"America/Jujuy",
+	"America/Juneau",
+	"America/Kentucky/Louisville",
+	"America/Kentucky/Monticello",
+	"America/Knox_IN",
+	"America/Kralendijk",
+	"America/La_Paz",
+	"America/Lima",
+	"America/Los_Angeles",
+	"America/Louisville",
+	"America/Lower_Princes",
+	"America/Maceio",
+	"America/Managua",
+	"America/Manaus",
+	"America/Marigot",
+	"America/Martinique",
+	"America/Matamoros",
+	"America/Mazatlan",
+	"America/Mendoza",
+	"America/Menominee",
+	"America/Merida",
+	"America/Metlakatla",
+	"America/Mexico_City",
+	"America/Miquelon",
+	"America/Moncton",
+	"America/Monterrey",
+	"America/Montevideo",
+	"America/Montreal",
+	"America/Montserrat",
+	"America/Nassau",
+	"America/New_York",
+	"America/Nipigon",
+	"America/Nome",
+	"America/Noronha",
+	"America/North_Dakota/Beulah",
+	"America/North_Dakota/Center",
+	"America/North_Dakota/New_Salem",
+	"America/Nuuk",
+	"America/Ojinaga",
+	"America/Panama",
+	"America/Pangnirtung",
+	"America/Paramaribo",
+	"America/Phoenix",
+	"America/Port-au-Prince",
+	"America/Porto_Acre",
+	"America/Port_of_Spain",
+	"America/Porto_Velho",
+	"America/Puerto_Rico",
+	"America/Punta_Arenas",
+	"America/Rainy_River",
+	"America/Rankin_Inlet",
+	"America/Recife",
+	"America/Regina",
+	"America/Resolute",
+	"America/Rio_Branco",
+	"America/Rosario",
+	"America/Santa_Isabel",
+	"America/Santarem",
+	"America/Santiago",
+	"America/Santo_Domingo",
+	"America/Sao_Paulo",
+	"America/Scoresbysund",
+	"America/Shiprock",
+	"America/Sitka",
+	"America/St_Barthelemy",
+	"America/St_Johns",
+	"America/St_Kitts",
+	"America/St_Lucia",
+	"America/St_Thomas",
+	"America/St_Vincent",
+	"America/Swift_Current",
+	"America/Tegucigalpa",
+	"America/Thule",
+	"America/Thunder_Bay",
+	"America/Tijuana",
+	"America/Toronto",
+	"America/Tortola",
+	"America/Vancouver",
+	"America/Virgin",
+	"America/Whitehorse",
+	"America/Winnipeg",
+	"America/Yakutat",
+	"America/Yellowknife",
+	"Antarctica/Casey",
+	"Antarctica/Davis",
+	"Antarctica/DumontDUrville",
+	"Antarctica/Macquarie",
+	"Antarctica/Mawson",
+	"Antarctica/McMurdo",
+	"Antarctica/Palmer",
+	"Antarctica/Rothera",
+	"Antarctica/South_Pole",
+	"Antarctica/Syowa",
+	"Antarctica/Troll",
+	"Antarctica/Vostok",
+	"Arctic/Longyearbyen",
+	"Asia/Aden",
+	"Asia/Almaty",
+	"Asia/Amman",
+	"Asia/Anadyr",
+	"Asia/Aqtau",
+	"Asia/Aqtobe",
+	"Asia/Ashgabat",
+	"Asia/Ashkhabad",
+	"Asia/Atyrau",
+	"Asia/Baghdad",
+	"Asia/Bahrain",
+	"Asia/Baku",
+	"Asia/Bangkok",
+	"Asia/Barnaul",
+	"Asia/Beirut",
+	"Asia/Bishkek",
+	"Asia/Brunei",
+	"Asia/Calcutta",
+	"Asia/Chita",
+	"Asia/Choibalsan",
+	"Asia/Chongqing",
+	"Asia/Chungking",
+	"Asia/Colombo",
+	"Asia/Dacca",
+	"Asia/Damascus",
+	"Asia/Dhaka",
+	"Asia/Dili",
+	"Asia/Dubai",
+	"Asia/Dushanbe",
+	"Asia/Famagusta",
+	"Asia/Gaza",
+	"Asia/Harbin",
+	"Asia/Hebron",
+	"Asia/Ho_Chi_Minh",
+	"Asia/Hong_Kong",
+	"Asia/Hovd",
+	"Asia/Irkutsk",
+	"Asia/Istanbul",
+	"Asia/Jakarta",
+	"Asia/Jayapura",
+	"Asia/Jerusalem",
+	"Asia/Kabul",
+	"Asia/Kamchatka",
+	"Asia/Karachi",
+	"Asia/Kashgar",
+	"Asia/Kathmandu",
+	"Asia/Katmandu",
+	"Asia/Khandyga",
+	"Asia/Kolkata",
+	"Asia/Krasnoyarsk",
+	"Asia/Kuala_Lumpur",
+	"Asia/Kuching",
+	"Asia/Kuwait",
+	"Asia/Macao",
+	"Asia/Macau",
+	"Asia/Magadan",
+	"Asia/Makassar",
+	"Asia/Manila",
+	"Asia/Muscat",
+	"Asia/Nicosia",
+	"Asia/Novokuznetsk",
+	"Asia/Novosibirsk",
+	"Asia/Omsk",
+	"Asia/Oral",
+	"Asia/Phnom_Penh",
+	"Asia/Pontianak",
+	"Asia/Pyongyang",
+	"Asia/Qatar",
+	"Asia/Qostanay",
+	"Asia/Qyzylorda",
+	"Asia/Rangoon",
+	"Asia/Riyadh",
+	"Asia/Saigon",
+	"Asia/Sakhalin",
+	"Asia/Samarkand",
+	"Asia/Seoul",
+	"Asia/Shanghai",
+	"Asia/Singapore",
+	"Asia/Srednekolymsk",
+	"Asia/Taipei",
+	"Asia/Tashkent",
+	"Asia/Tbilisi",
+	"Asia/Tehran",
+	"Asia/Tel_Aviv",
+	"Asia/Thimbu",
+	"Asia/Thimphu",
+	"Asia/Tokyo",
+	"Asia/Tomsk",
+	"Asia/Ujung_Pandang",
+	"Asia/Ulaanbaatar",
+	"Asia/Ulan_Bator",
+	"Asia/Urumqi",
+	"Asia/Ust-Nera",
+	"Asia/Vientiane",
+	"Asia/Vladivostok",
+	"Asia/Yakutsk",
+	"Asia/Yangon",
+	"Asia/Yekaterinburg",
+	"Asia/Yerevan",
+	"Atlantic/Azores",
+	"Atlantic/Bermuda",
+	"Atlantic/Canary",
+	"Atlantic/Cape_Verde",
+	"Atlantic/Faeroe",
+	"Atlantic/Faroe",
+	"Atlantic/Jan_Mayen",
+	"Atlantic/Madeira",
+	"Atlantic/Reykjavik",
+	"Atlantic/South_Georgia",
+	"Atlantic/Stanley",
+	"Atlantic/St_Helena",
+	"Australia/ACT",
+	"Australia/Adelaide",
+	"Australia/Brisbane",
+	"Australia/Broken_Hill",
+	"Australia/Canberra",
+	"Australia/Currie",
+	"Australia/Darwin",
+	"Australia/Eucla",
+	"Australia/Hobart",
+	"Australia/LHI",
+	"Australia/Lindeman",
+	"Australia/Lord_Howe",
+	"Australia/Melbourne",
+	"Australia/North",
+	"Australia/NSW",
+	"Australia/Perth",
+	"Australia/Queensland",
+	"Australia/South",
+	"Australia/Sydney",
+	"Australia/Tasmania",
+	"Australia/Victoria",
+	"Australia/West",
+	"Australia/Yancowinna",
+	"Brazil/Acre",
+	"Brazil/DeNoronha",
+	"Brazil/East",
+	"Brazil/West",
+	"Canada/Atlantic",
+	"Canada/Central",
+	"Canada/Eastern",
+	"Canada/Mountain",
+	"Canada/Newfoundland",
+	"Canada/Pacific",
+	"Canada/Saskatchewan",
+	"Canada/Yukon",
+	"CET",
+	"Chile/Continental",
+	"Chile/EasterIsland",
+	"CST6CDT",
+	"Cuba",
+	"EET",
+	"Egypt",
+	"Eire",
+	"EST",
+	"EST5EDT",
+	"Etc/GMT",
+	"Etc/GMT+0",
+	"Etc/GMT-0",
+	"Etc/GMT0",
+	"Etc/GMT+1",
+	"Etc/GMT-1",
+	"Etc/GMT+10",
+	"Etc/GMT-10",
+	"Etc/GMT+11",
+	"Etc/GMT-11",
+	"Etc/GMT+12",
+	"Etc/GMT-12",
+	"Etc/GMT-13",
+	"Etc/GMT-14",
+	"Etc/GMT+2",
+	"Etc/GMT-2",
+	"Etc/GMT+3",
+	"Etc/GMT-3",
+	"Etc/GMT+4",
+	"Etc/GMT-4",
+	"Etc/GMT+5",
+	"Etc/GMT-5",
+	"Etc/GMT+6",
+	"Etc/GMT-6",
+	"Etc/GMT+7",
+	"Etc/GMT-7",
+	"Etc/GMT+8",
+	"Etc/GMT-8",
+	"Etc/GMT+9",
+	"Etc/GMT-9",
+	"Etc/Greenwich",
+	"Etc/UCT",
+	"Etc/Universal",
+	"Etc/UTC",
+	"Etc/Zulu",
+	"Europe/Amsterdam",
+	"Europe/Andorra",
+	"Europe/Astrakhan",
+	"Europe/Athens",
+	"Europe/Belfast",
+	"Europe/Belgrade",
+	"Europe/Berlin",
+	"Europe/Bratislava",
+	"Europe/Brussels",
+	"Europe/Bucharest",
+	"Europe/Budapest",
+	"Europe/Busingen",
+	"Europe/Chisinau",
+	"Europe/Copenhagen",
+	"Europe/Dublin",
+	"Europe/Gibraltar",
+	"Europe/Guernsey",
+	"Europe/Helsinki",
+	"Europe/Isle_of_Man",
+	"Europe/Istanbul",
+	"Europe/Jersey",
+	"Europe/Kaliningrad",
+	"Europe/Kiev",
+	"Europe/Kirov",
+	"Europe/Lisbon",
+	"Europe/Ljubljana",
+	"Europe/London",
+	"Europe/Luxembourg",
+	"Europe/Madrid",
+	"Europe/Malta",
+	"Europe/Mariehamn",
+	"Europe/Minsk",
+	"Europe/Monaco",
+	"Europe/Moscow",
+	"Europe/Nicosia",
+	"Europe/Oslo",
+	"Europe/Paris",
+	"Europe/Podgorica",
+	"Europe/Prague",
+	"Europe/Riga",
+	"Europe/Rome",
+	"Europe/Samara",
+	"Europe/San_Marino",
+	"Europe/Sarajevo",
+	"Europe/Saratov",
+	"Europe/Simferopol",
+	"Europe/Skopje",
+	"Europe/Sofia",
+	"Europe/Stockholm",
+	"Europe/Tallinn",
+	"Europe/Tirane",
+	"Europe/Tiraspol",
+	"Europe/Ulyanovsk",
+	"Europe/Uzhgorod",
+	"Europe/Vaduz",
+	"Europe/Vatican",
+	"Europe/Vienna",
+	"Europe/Vilnius",
+	"Europe/Volgograd",
+	"Europe/Warsaw",
+	"Europe/Zagreb",
+	"Europe/Zaporozhye",
+	"Europe/Zurich",
+	"Factory",
+	"GB",
+	"GB-Eire",
+	"GMT",
+	"GMT+0",
+	"GMT-0",
+	"GMT0",
+	"Greenwich",
+	"Hongkong",
+	"HST",
+	"Iceland",
+	"Indian/Antananarivo",
+	"Indian/Chagos",
+	"Indian/Christmas",
+	"Indian/Cocos",
+	"Indian/Comoro",
+	"Indian/Kerguelen",
+	"Indian/Mahe",
+	"Indian/Maldives",
+	"Indian/Mauritius",
+	"Indian/Mayotte",
+	"Indian/Reunion",
+	"Iran",
+	"Israel",
+	"Jamaica",
+	"Japan",
+	"Kwajalein",
+	"Libya",
+	"localtime",
+	"MET",
+	"Mexico/BajaNorte",
+	"Mexico/BajaSur",
+	"Mexico/General",
+	"MST",
+	"MST7MDT",
+	"Navajo",
+	"NZ",
+	"NZ-CHAT",
+	"Pacific/Apia",
+	"Pacific/Auckland",
+	"Pacific/Bougainville",
+	"Pacific/Chatham",
+	"Pacific/Chuuk",
+	"Pacific/Easter",
+	"Pacific/Efate",
+	"Pacific/Enderbury",
+	"Pacific/Fakaofo",
+	"Pacific/Fiji",
+	"Pacific/Funafuti",
+	"Pacific/Galapagos",
+	"Pacific/Gambier",
+	"Pacific/Guadalcanal",
+	"Pacific/Guam",
+	"Pacific/Honolulu",
+	"Pacific/Johnston",
+	"Pacific/Kiritimati",
+	"Pacific/Kosrae",
+	"Pacific/Kwajalein",
+	"Pacific/Majuro",
+	"Pacific/Marquesas",
+	"Pacific/Midway",
+	"Pacific/Nauru",
+	"Pacific/Niue",
+	"Pacific/Norfolk",
+	"Pacific/Noumea",
+	"Pacific/Pago_Pago",
+	"Pacific/Palau",
+	"Pacific/Pitcairn",
+	"Pacific/Pohnpei",
+	"Pacific/Ponape",
+	"Pacific/Port_Moresby",
+	"Pacific/Rarotonga",
+	"Pacific/Saipan",
+	"Pacific/Samoa",
+	"Pacific/Tahiti",
+	"Pacific/Tarawa",
+	"Pacific/Tongatapu",
+	"Pacific/Truk",
+	"Pacific/Wake",
+	"Pacific/Wallis",
+	"Pacific/Yap",
+	"Poland",
+	"Portugal",
+	"posix/Africa/Abidjan",
+	"posix/Africa/Accra",
+	"posix/Africa/Addis_Ababa",
+	"posix/Africa/Algiers",
+	"posix/Africa/Asmara",
+	"posix/Africa/Asmera",
+	"posix/Africa/Bamako",
+	"posix/Africa/Bangui",
+	"posix/Africa/Banjul",
+	"posix/Africa/Bissau",
+	"posix/Africa/Blantyre",
+	"posix/Africa/Brazzaville",
+	"posix/Africa/Bujumbura",
+	"posix/Africa/Cairo",
+	"posix/Africa/Casablanca",
+	"posix/Africa/Ceuta",
+	"posix/Africa/Conakry",
+	"posix/Africa/Dakar",
+	"posix/Africa/Dar_es_Salaam",
+	"posix/Africa/Djibouti",
+	"posix/Africa/Douala",
+	"posix/Africa/El_Aaiun",
+	"posix/Africa/Freetown",
+	"posix/Africa/Gaborone",
+	"posix/Africa/Harare",
+	"posix/Africa/Johannesburg",
+	"posix/Africa/Juba",
+	"posix/Africa/Kampala",
+	"posix/Africa/Khartoum",
+	"posix/Africa/Kigali",
+	"posix/Africa/Kinshasa",
+	"posix/Africa/Lagos",
+	"posix/Africa/Libreville",
+	"posix/Africa/Lome",
+	"posix/Africa/Luanda",
+	"posix/Africa/Lubumbashi",
+	"posix/Africa/Lusaka",
+	"posix/Africa/Malabo",
+	"posix/Africa/Maputo",
+	"posix/Africa/Maseru",
+	"posix/Africa/Mbabane",
+	"posix/Africa/Mogadishu",
+	"posix/Africa/Monrovia",
+	"posix/Africa/Nairobi",
+	"posix/Africa/Ndjamena",
+	"posix/Africa/Niamey",
+	"posix/Africa/Nouakchott",
+	"posix/Africa/Ouagadougou",
+	"posix/Africa/Porto-Novo",
+	"posix/Africa/Sao_Tome",
+	"posix/Africa/Timbuktu",
+	"posix/Africa/Tripoli",
+	"posix/Africa/Tunis",
+	"posix/Africa/Windhoek",
+	"posix/America/Adak",
+	"posix/America/Anchorage",
+	"posix/America/Anguilla",
+	"posix/America/Antigua",
+	"posix/America/Araguaina",
+	"posix/America/Argentina/Buenos_Aires",
+	"posix/America/Argentina/Catamarca",
+	"posix/America/Argentina/ComodRivadavia",
+	"posix/America/Argentina/Cordoba",
+	"posix/America/Argentina/Jujuy",
+	"posix/America/Argentina/La_Rioja",
+	"posix/America/Argentina/Mendoza",
+	"posix/America/Argentina/Rio_Gallegos",
+	"posix/America/Argentina/Salta",
+	"posix/America/Argentina/San_Juan",
+	"posix/America/Argentina/San_Luis",
+	"posix/America/Argentina/Tucuman",
+	"posix/America/Argentina/Ushuaia",
+	"posix/America/Aruba",
+	"posix/America/Asuncion",
+	"posix/America/Atikokan",
+	"posix/America/Atka",
+	"posix/America/Bahia",
+	"posix/America/Bahia_Banderas",
+	"posix/America/Barbados",
+	"posix/America/Belem",
+	"posix/America/Belize",
+	"posix/America/Blanc-Sablon",
+	"posix/America/Boa_Vista",
+	"posix/America/Bogota",
+	"posix/America/Boise",
+	"posix/America/Buenos_Aires",
+	"posix/America/Cambridge_Bay",
+	"posix/America/Campo_Grande",
+	"posix/America/Cancun",
+	"posix/America/Caracas",
+	"posix/America/Catamarca",
+	"posix/America/Cayenne",
+	"posix/America/Cayman",
+	"posix/America/Chicago",
+	"posix/America/Chihuahua",
+	"posix/America/Ciudad_Juarez",
+	"posix/America/Coral_Harbor",
+	"posix/America/Cordoba",
+	"posix/America/Costa_Rica",
+	"posix/America/Creston",
+	"posix/America/Cuiaba",
+	"posix/America/Curacao",
+	"posix/America/Danmarkshavn",
+	"posix/America/Dawson",
+	"posix/America/Dawson_Creek",
+	"posix/America/Denver",
+	"posix/America/Detroit",
+	"posix/America/Dominica",
+	"posix/America/Edmonton",
+	"posix/America/Eirunepe",
+	"posix/America/El_Salvador",
+	"posix/America/Ensenada",
+	"posix/America/Fortaleza",
+	"posix/America/Fort_Nelson",
+	"posix/America/Fort_Wayne",
+	"posix/America/Glace_Bay",
+	"posix/America/Godthab",
+	"posix/America/Goose_Bay",
+	"posix/America/Grand_Turk",
+	"posix/America/Grenada",
+	"posix/America/Guadeloupe",
+	"posix/America/Guatemala",
+	"posix/America/Guayaquil",
+	"posix/America/Guyana",
+	"posix/America/Halifax",
+	"posix/America/Havana",
+	"posix/America/Hermosillo",
+	"posix/America/Indiana/Indianapolis",
+	"posix/America/Indiana/Knox",
+	"posix/America/Indiana/Marengo",
+	"posix/America/Indiana/Petersburg",
+	"posix/America/Indianapolis",
+	"posix/America/Indiana/Tell_City",
+	"posix/America/Indiana/Vevay",
+	"posix/America/Indiana/Vincennes",
+	"posix/America/Indiana/Winamac",
+	"posix/America/Inuvik",
+	"posix/America/Iqaluit",
+	"posix/America/Jamaica",
+	"posix/America/Jujuy",
+	"posix/America/Juneau",
+	"posix/America/Kentucky/Louisville",
+	"posix/America/Kentucky/Monticello",
+	"posix/America/Knox_IN",
+	"posix/America/Kralendijk",
+	"posix/America/La_Paz",
+	"posix/America/Lima",
+	"posix/America/Los_Angeles",
+	"posix/America/Louisville",
+	"posix/America/Lower_Princes",
+	"posix/America/Maceio",
+	"posix/America/Managua",
+	"posix/America/Manaus",
+	"posix/America/Marigot",
+	"posix/America/Martinique",
+	"posix/America/Matamoros",
+	"posix/America/Mazatlan",
+	"posix/America/Mendoza",
+	"posix/America/Menominee",
+	"posix/America/Merida",
+	"posix/America/Metlakatla",
+	"posix/America/Mexico_City",
+	"posix/America/Miquelon",
+	"posix/America/Moncton",
+	"posix/America/Monterrey",
+	"posix/America/Montevideo",
+	"posix/America/Montreal",
+	"posix/America/Montserrat",
+	"posix/America/Nassau",
+	"posix/America/New_York",
+	"posix/America/Nipigon",
+	"posix/America/Nome",
+	"posix/America/Noronha",
+	"posix/America/North_Dakota/Beulah",
+	"posix/America/North_Dakota/Center",
+	"posix/America/North_Dakota/New_Salem",
+	"posix/America/Nuuk",
+	"posix/America/Ojinaga",
+	"posix/America/Panama",
+	"posix/America/Pangnirtung",
+	"posix/America/Paramaribo",
+	"posix/America/Phoenix",
+	"posix/America/Port-au-Prince",
+	"posix/America/Porto_Acre",
+	"posix/America/Port_of_Spain",
+	"posix/America/Porto_Velho",
+	"posix/America/Puerto_Rico",
+	"posix/America/Punta_Arenas",
+	"posix/America/Rainy_River",
+	"posix/America/Rankin_Inlet",
+	"posix/America/Recife",
+	"posix/America/Regina",
+	"posix/America/Resolute",
+	"posix/America/Rio_Branco",
+	"posix/America/Rosario",
+	"posix/America/Santa_Isabel",
+	"posix/America/Santarem",
+	"posix/America/Santiago",
+	"posix/America/Santo_Domingo",
+	"posix/America/Sao_Paulo",
+	"posix/America/Scoresbysund",
+	"posix/America/Shiprock",
+	"posix/America/Sitka",
+	"posix/America/St_Barthelemy",
+	"posix/America/St_Johns",
+	"posix/America/St_Kitts",
+	"posix/America/St_Lucia",
+	"posix/America/St_Thomas",
+	"posix/America/St_Vincent",
+	"posix/America/Swift_Current",
+	"posix/America/Tegucigalpa",
+	"posix/America/Thule",
+	"posix/America/Thunder_Bay",
+	"posix/America/Tijuana",
+	"posix/America/Toronto",
+	"posix/America/Tortola",
+	"posix/America/Vancouver",
+	"posix/America/Virgin",
+	"posix/America/Whitehorse",
+	"posix/America/Winnipeg",
+	"posix/America/Yakutat",
+	"posix/America/Yellowknife",
+	"posix/Antarctica/Casey",
+	"posix/Antarctica/Davis",
+	"posix/Antarctica/DumontDUrville",
+	"posix/Antarctica/Macquarie",
+	"posix/Antarctica/Mawson",
+	"posix/Antarctica/McMurdo",
+	"posix/Antarctica/Palmer",
+	"posix/Antarctica/Rothera",
+	"posix/Antarctica/South_Pole",
+	"posix/Antarctica/Syowa",
+	"posix/Antarctica/Troll",
+	"posix/Antarctica/Vostok",
+	"posix/Arctic/Longyearbyen",
+	"posix/Asia/Aden",
+	"posix/Asia/Almaty",
+	"posix/Asia/Amman",
+	"posix/Asia/Anadyr",
+	"posix/Asia/Aqtau",
+	"posix/Asia/Aqtobe",
+	"posix/Asia/Ashgabat",
+	"posix/Asia/Ashkhabad",
+	"posix/Asia/Atyrau",
+	"posix/Asia/Baghdad",
+	"posix/Asia/Bahrain",
+	"posix/Asia/Baku",
+	"posix/Asia/Bangkok",
+	"posix/Asia/Barnaul",
+	"posix/Asia/Beirut",
+	"posix/Asia/Bishkek",
+	"posix/Asia/Brunei",
+	"posix/Asia/Calcutta",
+	"posix/Asia/Chita",
+	"posix/Asia/Choibalsan",
+	"posix/Asia/Chongqing",
+	"posix/Asia/Chungking",
+	"posix/Asia/Colombo",
+	"posix/Asia/Dacca",
+	"posix/Asia/Damascus",
+	"posix/Asia/Dhaka",
+	"posix/Asia/Dili",
+	"posix/Asia/Dubai",
+	"posix/Asia/Dushanbe",
+	"posix/Asia/Famagusta",
+	"posix/Asia/Gaza",
+	"posix/Asia/Harbin",
+	"posix/Asia/Hebron",
+	"posix/Asia/Ho_Chi_Minh",
+	"posix/Asia/Hong_Kong",
+	"posix/Asia/Hovd",
+	"posix/Asia/Irkutsk",
+	"posix/Asia/Istanbul",
+	"posix/Asia/Jakarta",
+	"posix/Asia/Jayapura",
+	"posix/Asia/Jerusalem",
+	"posix/Asia/Kabul",
+	"posix/Asia/Kamchatka",
+	"posix/Asia/Karachi",
+	"posix/Asia/Kashgar",
+	"posix/Asia/Kathmandu",
+	"posix/Asia/Katmandu",
+	"posix/Asia/Khandyga",
+	"posix/Asia/Kolkata",
+	"posix/Asia/Krasnoyarsk",
+	"posix/Asia/Kuala_Lumpur",
+	"posix/Asia/Kuching",
+	"posix/Asia/Kuwait",
+	"posix/Asia/Macao",
+	"posix/Asia/Macau",
+	"posix/Asia/Magadan",
+	"posix/Asia/Makassar",
+	"posix/Asia/Manila",
+	"posix/Asia/Muscat",
+	"posix/Asia/Nicosia",
+	"posix/Asia/Novokuznetsk",
+	"posix/Asia/Novosibirsk",
+	"posix/Asia/Omsk",
+	"posix/Asia/Oral",
+	"posix/Asia/Phnom_Penh",
+	"posix/Asia/Pontianak",
+	"posix/Asia/Pyongyang",
+	"posix/Asia/Qatar",
+	"posix/Asia/Qostanay",
+	"posix/Asia/Qyzylorda",
+	"posix/Asia/Rangoon",
+	"posix/Asia/Riyadh",
+	"posix/Asia/Saigon",
+	"posix/Asia/Sakhalin",
+	"posix/Asia/Samarkand",
+	"posix/Asia/Seoul",
+	"posix/Asia/Shanghai",
+	"posix/Asia/Singapore",
+	"posix/Asia/Srednekolymsk",
+	"posix/Asia/Taipei",
+	"posix/Asia/Tashkent",
+	"posix/Asia/Tbilisi",
+	"posix/Asia/Tehran",
+	"posix/Asia/Tel_Aviv",
+	"posix/Asia/Thimbu",
+	"posix/Asia/Thimphu",
+	"posix/Asia/Tokyo",
+	"posix/Asia/Tomsk",
+	"posix/Asia/Ujung_Pandang",
+	"posix/Asia/Ulaanbaatar",
+	"posix/Asia/Ulan_Bator",
+	"posix/Asia/Urumqi",
+	"posix/Asia/Ust-Nera",
+	"posix/Asia/Vientiane",
+	"posix/Asia/Vladivostok",
+	"posix/Asia/Yakutsk",
+	"posix/Asia/Yangon",
+	"posix/Asia/Yekaterinburg",
+	"posix/Asia/Yerevan",
+	"posix/Atlantic/Azores",
+	"posix/Atlantic/Bermuda",
+	"posix/Atlantic/Canary",
+	"posix/Atlantic/Cape_Verde",
+	"posix/Atlantic/Faeroe",
+	"posix/Atlantic/Faroe",
+	"posix/Atlantic/Jan_Mayen",
+	"posix/Atlantic/Madeira",
+	"posix/Atlantic/Reykjavik",
+	"posix/Atlantic/South_Georgia",
+	"posix/Atlantic/Stanley",
+	"posix/Atlantic/St_Helena",
+	"posix/Australia/ACT",
+	"posix/Australia/Adelaide",
+	"posix/Australia/Brisbane",
+	"posix/Australia/Broken_Hill",
+	"posix/Australia/Canberra",
+	"posix/Australia/Currie",
+	"posix/Australia/Darwin",
+	"posix/Australia/Eucla",
+	"posix/Australia/Hobart",
+	"posix/Australia/LHI",
+	"posix/Australia/Lindeman",
+	"posix/Australia/Lord_Howe",
+	"posix/Australia/Melbourne",
+	"posix/Australia/North",
+	"posix/Australia/NSW",
+	"posix/Australia/Perth",
+	"posix/Australia/Queensland",
+	"posix/Australia/South",
+	"posix/Australia/Sydney",
+	"posix/Australia/Tasmania",
+	"posix/Australia/Victoria",
+	"posix/Australia/West",
+	"posix/Australia/Yancowinna",
+	"posix/Brazil/Acre",
+	"posix/Brazil/DeNoronha",
+	"posix/Brazil/East",
+	"posix/Brazil/West",
+	"posix/Canada/Atlantic",
+	"posix/Canada/Central",
+	"posix/Canada/Eastern",
+	"posix/Canada/Mountain",
+	"posix/Canada/Newfoundland",
+	"posix/Canada/Pacific",
+	"posix/Canada/Saskatchewan",
+	"posix/Canada/Yukon",
+	"posix/CET",
+	"posix/Chile/Continental",
+	"posix/Chile/EasterIsland",
+	"posix/CST6CDT",
+	"posix/Cuba",
+	"posix/EET",
+	"posix/Egypt",
+	"posix/Eire",
+	"posix/EST",
+	"posix/EST5EDT",
+	"posix/Etc/GMT",
+	"posix/Etc/GMT+0",
+	"posix/Etc/GMT-0",
+	"posix/Etc/GMT0",
+	"posix/Etc/GMT+1",
+	"posix/Etc/GMT-1",
+	"posix/Etc/GMT+10",
+	"posix/Etc/GMT-10",
+	"posix/Etc/GMT+11",
+	"posix/Etc/GMT-11",
+	"posix/Etc/GMT+12",
+	"posix/Etc/GMT-12",
+	"posix/Etc/GMT-13",
+	"posix/Etc/GMT-14",
+	"posix/Etc/GMT+2",
+	"posix/Etc/GMT-2",
+	"posix/Etc/GMT+3",
+	"posix/Etc/GMT-3",
+	"posix/Etc/GMT+4",
+	"posix/Etc/GMT-4",
+	"posix/Etc/GMT+5",
+	"posix/Etc/GMT-5",
+	"posix/Etc/GMT+6",
+	"posix/Etc/GMT-6",
+	"posix/Etc/GMT+7",
+	"posix/Etc/GMT-7",
+	"posix/Etc/GMT+8",
+	"posix/Etc/GMT-8",
+	"posix/Etc/GMT+9",
+	"posix/Etc/GMT-9",
+	"posix/Etc/Greenwich",
+	"posix/Etc/UCT",
+	"posix/Etc/Universal",
+	"posix/Etc/UTC",
+	"posix/Etc/Zulu",
+	"posix/Europe/Amsterdam",
+}
diff --git a/coderd/database/dbtime/dbtime.go b/coderd/database/dbtime/dbtime.go
new file mode 100644
index 0000000000000..f242ccff6e0fe
--- /dev/null
+++ b/coderd/database/dbtime/dbtime.go
@@ -0,0 +1,14 @@
+package dbtime
+
+import "time"
+
+// Now returns a standardized timezone used for database resources.
+func Now() time.Time {
+	return Time(time.Now().UTC())
+}
+
+// Time returns a time compatible with Postgres. Postgres only stores dates with
+// microsecond precision.
+func Time(t time.Time) time.Time {
+	return t.Round(time.Microsecond)
+}
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index f121fccf8cebb..dcf63c6f66f9e 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -22,6 +22,11 @@ CREATE TYPE audit_action AS ENUM (
     'register'
 );
 
+CREATE TYPE automatic_updates AS ENUM (
+    'always',
+    'never'
+);
+
 CREATE TYPE build_reason AS ENUM (
     'initiator',
     'autostart',
@@ -31,6 +36,19 @@ CREATE TYPE build_reason AS ENUM (
     'autodelete'
 );
 
+CREATE TYPE display_app AS ENUM (
+    'vscode',
+    'vscode_insiders',
+    'web_terminal',
+    'ssh_helper',
+    'port_forwarding_helper'
+);
+
+CREATE TYPE group_source AS ENUM (
+    'user',
+    'oidc'
+);
+
 CREATE TYPE log_level AS ENUM (
     'trace',
     'debug',
@@ -76,6 +94,18 @@ CREATE TYPE parameter_type_system AS ENUM (
     'hcl'
 );
 
+CREATE TYPE provisioner_job_status AS ENUM (
+    'pending',
+    'running',
+    'succeeded',
+    'canceling',
+    'canceled',
+    'failed',
+    'unknown'
+);
+
+COMMENT ON TYPE provisioner_job_status IS 'Computed status of a provisioner job. Jobs could be stuck in a hung state, these states do not guarantee any transition to another state.';
+
 CREATE TYPE provisioner_job_type AS ENUM (
     'template_version_import',
     'workspace_build',
@@ -131,19 +161,11 @@ CREATE TYPE workspace_agent_lifecycle_state AS ENUM (
     'off'
 );
 
-CREATE TYPE workspace_agent_log_source AS ENUM (
-    'startup_script',
-    'shutdown_script',
-    'kubernetes_logs',
-    'envbox',
-    'envbuilder',
-    'external'
-);
-
 CREATE TYPE workspace_agent_subsystem AS ENUM (
     'envbuilder',
     'envbox',
-    'none'
+    'none',
+    'exectrace'
 );
 
 CREATE TYPE workspace_app_health AS ENUM (
@@ -205,13 +227,57 @@ $$;
 CREATE FUNCTION tailnet_notify_client_change() RETURNS trigger
     LANGUAGE plpgsql
     AS $$
+DECLARE
+	var_client_id uuid;
+	var_coordinator_id uuid;
+	var_agent_ids uuid[];
+	var_agent_id uuid;
 BEGIN
-	IF (OLD IS NOT NULL) THEN
-		PERFORM pg_notify('tailnet_client_update', OLD.id || ',' || OLD.agent_id);
-		RETURN NULL;
+	IF (NEW.id IS NOT NULL) THEN
+		var_client_id = NEW.id;
+		var_coordinator_id = NEW.coordinator_id;
+	ELSIF (OLD.id IS NOT NULL) THEN
+		var_client_id = OLD.id;
+		var_coordinator_id = OLD.coordinator_id;
+	END IF;
+
+	-- Read all agents the client is subscribed to, so we can notify them.
+	SELECT
+		array_agg(agent_id)
+	INTO
+		var_agent_ids
+	FROM
+		tailnet_client_subscriptions subs
+	WHERE
+		subs.client_id = NEW.id AND
+		subs.coordinator_id = NEW.coordinator_id;
+
+	-- No agents to notify
+	if (var_agent_ids IS NULL) THEN
+		return NULL;
 	END IF;
+
+	-- pg_notify is limited to 8k bytes, which is approximately 221 UUIDs.
+	-- Instead of sending all agent ids in a single update, send one for each
+	-- agent id to prevent overflow.
+	FOREACH var_agent_id IN ARRAY var_agent_ids
+	LOOP
+		PERFORM pg_notify('tailnet_client_update', var_client_id || ',' || var_agent_id);
+	END LOOP;
+
+	return NULL;
+END;
+$$;
+
+CREATE FUNCTION tailnet_notify_client_subscription_change() RETURNS trigger
+    LANGUAGE plpgsql
+    AS $$
+BEGIN
 	IF (NEW IS NOT NULL) THEN
-		PERFORM pg_notify('tailnet_client_update', NEW.id || ',' || NEW.agent_id);
+		PERFORM pg_notify('tailnet_client_update', NEW.client_id || ',' || NEW.agent_id);
+		RETURN NULL;
+	ELSIF (OLD IS NOT NULL) THEN
+		PERFORM pg_notify('tailnet_client_update', OLD.client_id || ',' || OLD.agent_id);
 		RETURN NULL;
 	END IF;
 END;
@@ -261,23 +327,53 @@ CREATE TABLE audit_logs (
     resource_icon text NOT NULL
 );
 
-CREATE TABLE files (
-    hash character varying(64) NOT NULL,
-    created_at timestamp with time zone NOT NULL,
-    created_by uuid NOT NULL,
-    mimetype character varying(64) NOT NULL,
-    data bytea NOT NULL,
-    id uuid DEFAULT gen_random_uuid() NOT NULL
+CREATE TABLE dbcrypt_keys (
+    number integer NOT NULL,
+    active_key_digest text,
+    revoked_key_digest text,
+    created_at timestamp with time zone DEFAULT CURRENT_TIMESTAMP,
+    revoked_at timestamp with time zone,
+    test text NOT NULL
 );
 
-CREATE TABLE git_auth_links (
+COMMENT ON TABLE dbcrypt_keys IS 'A table used to store the keys used to encrypt the database.';
+
+COMMENT ON COLUMN dbcrypt_keys.number IS 'An integer used to identify the key.';
+
+COMMENT ON COLUMN dbcrypt_keys.active_key_digest IS 'If the key is active, the digest of the active key.';
+
+COMMENT ON COLUMN dbcrypt_keys.revoked_key_digest IS 'If the key has been revoked, the digest of the revoked key.';
+
+COMMENT ON COLUMN dbcrypt_keys.created_at IS 'The time at which the key was created.';
+
+COMMENT ON COLUMN dbcrypt_keys.revoked_at IS 'The time at which the key was revoked.';
+
+COMMENT ON COLUMN dbcrypt_keys.test IS 'A column used to test the encryption.';
+
+CREATE TABLE external_auth_links (
     provider_id text NOT NULL,
     user_id uuid NOT NULL,
     created_at timestamp with time zone NOT NULL,
     updated_at timestamp with time zone NOT NULL,
     oauth_access_token text NOT NULL,
     oauth_refresh_token text NOT NULL,
-    oauth_expiry timestamp with time zone NOT NULL
+    oauth_expiry timestamp with time zone NOT NULL,
+    oauth_access_token_key_id text,
+    oauth_refresh_token_key_id text,
+    oauth_extra jsonb
+);
+
+COMMENT ON COLUMN external_auth_links.oauth_access_token_key_id IS 'The ID of the key used to encrypt the OAuth access token. If this is NULL, the access token is not encrypted';
+
+COMMENT ON COLUMN external_auth_links.oauth_refresh_token_key_id IS 'The ID of the key used to encrypt the OAuth refresh token. If this is NULL, the refresh token is not encrypted';
+
+CREATE TABLE files (
+    hash character varying(64) NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    created_by uuid NOT NULL,
+    mimetype character varying(64) NOT NULL,
+    data bytea NOT NULL,
+    id uuid DEFAULT gen_random_uuid() NOT NULL
 );
 
 CREATE TABLE gitsshkeys (
@@ -299,11 +395,14 @@ CREATE TABLE groups (
     organization_id uuid NOT NULL,
     avatar_url text DEFAULT ''::text NOT NULL,
     quota_allowance integer DEFAULT 0 NOT NULL,
-    display_name text DEFAULT ''::text NOT NULL
+    display_name text DEFAULT ''::text NOT NULL,
+    source group_source DEFAULT 'user'::group_source NOT NULL
 );
 
 COMMENT ON COLUMN groups.display_name IS 'Display name is a custom, human-friendly group name that user can set. This is not required to be unique and can be the empty string.';
 
+COMMENT ON COLUMN groups.source IS 'Source indicates how the group was created. It can be created by a user manually, or through some system process like OIDC group sync.';
+
 CREATE TABLE licenses (
     id integer NOT NULL,
     uploaded_at timestamp with time zone NOT NULL,
@@ -419,9 +518,27 @@ CREATE TABLE provisioner_jobs (
     file_id uuid NOT NULL,
     tags jsonb DEFAULT '{"scope": "organization"}'::jsonb NOT NULL,
     error_code text,
-    trace_metadata jsonb
+    trace_metadata jsonb,
+    job_status provisioner_job_status GENERATED ALWAYS AS (
+CASE
+    WHEN (completed_at IS NOT NULL) THEN
+    CASE
+        WHEN (error <> ''::text) THEN 'failed'::provisioner_job_status
+        WHEN (canceled_at IS NOT NULL) THEN 'canceled'::provisioner_job_status
+        ELSE 'succeeded'::provisioner_job_status
+    END
+    ELSE
+    CASE
+        WHEN (error <> ''::text) THEN 'failed'::provisioner_job_status
+        WHEN (canceled_at IS NOT NULL) THEN 'canceling'::provisioner_job_status
+        WHEN (started_at IS NULL) THEN 'pending'::provisioner_job_status
+        ELSE 'running'::provisioner_job_status
+    END
+END) STORED NOT NULL
 );
 
+COMMENT ON COLUMN provisioner_jobs.job_status IS 'Computed column to track the status of the job.';
+
 CREATE TABLE replicas (
     id uuid NOT NULL,
     created_at timestamp with time zone NOT NULL,
@@ -449,10 +566,16 @@ CREATE TABLE tailnet_agents (
     node jsonb NOT NULL
 );
 
+CREATE TABLE tailnet_client_subscriptions (
+    client_id uuid NOT NULL,
+    coordinator_id uuid NOT NULL,
+    agent_id uuid NOT NULL,
+    updated_at timestamp with time zone NOT NULL
+);
+
 CREATE TABLE tailnet_clients (
     id uuid NOT NULL,
     coordinator_id uuid NOT NULL,
-    agent_id uuid NOT NULL,
     updated_at timestamp with time zone NOT NULL,
     node jsonb NOT NULL
 );
@@ -552,11 +675,12 @@ CREATE TABLE template_versions (
     readme character varying(1048576) NOT NULL,
     job_id uuid NOT NULL,
     created_by uuid NOT NULL,
-    git_auth_providers text[],
-    message character varying(1048576) DEFAULT ''::character varying NOT NULL
+    external_auth_providers text[],
+    message character varying(1048576) DEFAULT ''::character varying NOT NULL,
+    archived boolean DEFAULT false NOT NULL
 );
 
-COMMENT ON COLUMN template_versions.git_auth_providers IS 'IDs of Git auth providers for a specific template version';
+COMMENT ON COLUMN template_versions.external_auth_providers IS 'IDs of External auth providers for a specific template version';
 
 COMMENT ON COLUMN template_versions.message IS 'Message describing the changes in this version of the template, similar to a Git commit message. Like a commit message, this should be a short, high-level description of the changes in this version of the template. This message is immutable and should not be updated after the fact.';
 
@@ -596,8 +720,9 @@ CREATE VIEW template_version_with_user AS
     template_versions.readme,
     template_versions.job_id,
     template_versions.created_by,
-    template_versions.git_auth_providers,
+    template_versions.external_auth_providers,
     template_versions.message,
+    template_versions.archived,
     COALESCE(visible_users.avatar_url, ''::text) AS created_by_avatar_url,
     COALESCE(visible_users.username, ''::text) AS created_by_username
    FROM (public.template_versions
@@ -626,10 +751,12 @@ CREATE TABLE templates (
     allow_user_autostart boolean DEFAULT true NOT NULL,
     allow_user_autostop boolean DEFAULT true NOT NULL,
     failure_ttl bigint DEFAULT 0 NOT NULL,
-    inactivity_ttl bigint DEFAULT 0 NOT NULL,
-    locked_ttl bigint DEFAULT 0 NOT NULL,
-    restart_requirement_days_of_week smallint DEFAULT 0 NOT NULL,
-    restart_requirement_weeks bigint DEFAULT 0 NOT NULL
+    time_til_dormant bigint DEFAULT 0 NOT NULL,
+    time_til_dormant_autodelete bigint DEFAULT 0 NOT NULL,
+    autostop_requirement_days_of_week smallint DEFAULT 0 NOT NULL,
+    autostop_requirement_weeks bigint DEFAULT 0 NOT NULL,
+    autostart_block_days_of_week smallint DEFAULT 0 NOT NULL,
+    require_active_version boolean DEFAULT false NOT NULL
 );
 
 COMMENT ON COLUMN templates.default_ttl IS 'The default duration for autostop for workspaces created from this template.';
@@ -642,9 +769,11 @@ COMMENT ON COLUMN templates.allow_user_autostart IS 'Allow users to specify an a
 
 COMMENT ON COLUMN templates.allow_user_autostop IS 'Allow users to specify custom autostop values for workspaces (enterprise).';
 
-COMMENT ON COLUMN templates.restart_requirement_days_of_week IS 'A bitmap of days of week to restart the workspace on, starting with Monday as the 0th bit, and Sunday as the 6th bit. The 7th bit is unused.';
+COMMENT ON COLUMN templates.autostop_requirement_days_of_week IS 'A bitmap of days of week to restart the workspace on, starting with Monday as the 0th bit, and Sunday as the 6th bit. The 7th bit is unused.';
+
+COMMENT ON COLUMN templates.autostop_requirement_weeks IS 'The number of weeks between restarts. 0 or 1 weeks means "every week", 2 week means "every second week", etc. Weeks are counted from January 2, 2023, which is the first Monday of 2023. This is to ensure workspaces are started consistently for all customers on the same n-week cycles.';
 
-COMMENT ON COLUMN templates.restart_requirement_weeks IS 'The number of weeks between restarts. 0 or 1 weeks means "every week", 2 week means "every second week", etc. Weeks are counted from January 2, 2023, which is the first Monday of 2023. This is to ensure workspaces are started consistently for all customers on the same n-week cycles.';
+COMMENT ON COLUMN templates.autostart_block_days_of_week IS 'A bitmap of days of week that autostart of a workspace is not allowed. Default allows all days. This is intended as a cost savings measure to prevent auto start on weekends (for example).';
 
 CREATE VIEW template_with_users AS
  SELECT templates.id,
@@ -667,10 +796,12 @@ CREATE VIEW template_with_users AS
     templates.allow_user_autostart,
     templates.allow_user_autostop,
     templates.failure_ttl,
-    templates.inactivity_ttl,
-    templates.locked_ttl,
-    templates.restart_requirement_days_of_week,
-    templates.restart_requirement_weeks,
+    templates.time_til_dormant,
+    templates.time_til_dormant_autodelete,
+    templates.autostop_requirement_days_of_week,
+    templates.autostop_requirement_weeks,
+    templates.autostart_block_days_of_week,
+    templates.require_active_version,
     COALESCE(visible_users.avatar_url, ''::text) AS created_by_avatar_url,
     COALESCE(visible_users.username, ''::text) AS created_by_username
    FROM (public.templates
@@ -684,16 +815,30 @@ CREATE TABLE user_links (
     linked_id text DEFAULT ''::text NOT NULL,
     oauth_access_token text DEFAULT ''::text NOT NULL,
     oauth_refresh_token text DEFAULT ''::text NOT NULL,
-    oauth_expiry timestamp with time zone DEFAULT '0001-01-01 00:00:00+00'::timestamp with time zone NOT NULL
+    oauth_expiry timestamp with time zone DEFAULT '0001-01-01 00:00:00+00'::timestamp with time zone NOT NULL,
+    oauth_access_token_key_id text,
+    oauth_refresh_token_key_id text
 );
 
-CREATE TABLE workspace_agent_logs (
+COMMENT ON COLUMN user_links.oauth_access_token_key_id IS 'The ID of the key used to encrypt the OAuth access token. If this is NULL, the access token is not encrypted';
+
+COMMENT ON COLUMN user_links.oauth_refresh_token_key_id IS 'The ID of the key used to encrypt the OAuth refresh token. If this is NULL, the refresh token is not encrypted';
+
+CREATE TABLE workspace_agent_log_sources (
+    workspace_agent_id uuid NOT NULL,
+    id uuid NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    display_name character varying(127) NOT NULL,
+    icon text NOT NULL
+);
+
+CREATE UNLOGGED TABLE workspace_agent_logs (
     agent_id uuid NOT NULL,
     created_at timestamp with time zone NOT NULL,
     output character varying(1024) NOT NULL,
     id bigint NOT NULL,
     level log_level DEFAULT 'info'::log_level NOT NULL,
-    source workspace_agent_log_source DEFAULT 'startup_script'::workspace_agent_log_source NOT NULL
+    log_source_id uuid DEFAULT '00000000-0000-0000-0000-000000000000'::uuid NOT NULL
 );
 
 CREATE UNLOGGED TABLE workspace_agent_metadata (
@@ -708,6 +853,19 @@ CREATE UNLOGGED TABLE workspace_agent_metadata (
     collected_at timestamp with time zone DEFAULT '0001-01-01 00:00:00+00'::timestamp with time zone NOT NULL
 );
 
+CREATE TABLE workspace_agent_scripts (
+    workspace_agent_id uuid NOT NULL,
+    log_source_id uuid NOT NULL,
+    log_path text NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    script text NOT NULL,
+    cron text NOT NULL,
+    start_blocks_login boolean NOT NULL,
+    run_on_start boolean NOT NULL,
+    run_on_stop boolean NOT NULL,
+    timeout_seconds integer NOT NULL
+);
+
 CREATE SEQUENCE workspace_agent_startup_logs_id_seq
     START WITH 1
     INCREMENT BY 1
@@ -751,7 +909,6 @@ CREATE TABLE workspace_agents (
     architecture character varying(64) NOT NULL,
     environment_variables jsonb,
     operating_system character varying(64) NOT NULL,
-    startup_script character varying(65534),
     instance_metadata jsonb,
     resource_metadata jsonb,
     directory character varying(4096) DEFAULT ''::character varying NOT NULL,
@@ -761,17 +918,16 @@ CREATE TABLE workspace_agents (
     troubleshooting_url text DEFAULT ''::text NOT NULL,
     motd_file text DEFAULT ''::text NOT NULL,
     lifecycle_state workspace_agent_lifecycle_state DEFAULT 'created'::workspace_agent_lifecycle_state NOT NULL,
-    startup_script_timeout_seconds integer DEFAULT 0 NOT NULL,
     expanded_directory character varying(4096) DEFAULT ''::character varying NOT NULL,
-    shutdown_script character varying(65534),
-    shutdown_script_timeout_seconds integer DEFAULT 0 NOT NULL,
     logs_length integer DEFAULT 0 NOT NULL,
     logs_overflowed boolean DEFAULT false NOT NULL,
-    subsystem workspace_agent_subsystem DEFAULT 'none'::workspace_agent_subsystem NOT NULL,
-    startup_script_behavior startup_script_behavior DEFAULT 'non-blocking'::startup_script_behavior NOT NULL,
     started_at timestamp with time zone,
     ready_at timestamp with time zone,
-    CONSTRAINT max_logs_length CHECK ((logs_length <= 1048576))
+    subsystems workspace_agent_subsystem[] DEFAULT '{}'::workspace_agent_subsystem[],
+    display_apps display_app[] DEFAULT '{vscode,vscode_insiders,web_terminal,ssh_helper,port_forwarding_helper}'::display_app[],
+    api_version text DEFAULT ''::text NOT NULL,
+    CONSTRAINT max_logs_length CHECK ((logs_length <= 1048576)),
+    CONSTRAINT subsystems_not_none CHECK ((NOT ('none'::workspace_agent_subsystem = ANY (subsystems))))
 );
 
 COMMENT ON COLUMN workspace_agents.version IS 'Version tracks the version of the currently running workspace agent. Workspace agents register their version upon start.';
@@ -784,24 +940,60 @@ COMMENT ON COLUMN workspace_agents.motd_file IS 'Path to file inside workspace c
 
 COMMENT ON COLUMN workspace_agents.lifecycle_state IS 'The current lifecycle state reported by the workspace agent.';
 
-COMMENT ON COLUMN workspace_agents.startup_script_timeout_seconds IS 'The number of seconds to wait for the startup script to complete. If the script does not complete within this time, the agent lifecycle will be marked as start_timeout.';
-
 COMMENT ON COLUMN workspace_agents.expanded_directory IS 'The resolved path of a user-specified directory. e.g. ~/coder -> /home/coder/coder';
 
-COMMENT ON COLUMN workspace_agents.shutdown_script IS 'Script that is executed before the agent is stopped.';
-
-COMMENT ON COLUMN workspace_agents.shutdown_script_timeout_seconds IS 'The number of seconds to wait for the shutdown script to complete. If the script does not complete within this time, the agent lifecycle will be marked as shutdown_timeout.';
-
 COMMENT ON COLUMN workspace_agents.logs_length IS 'Total length of startup logs';
 
 COMMENT ON COLUMN workspace_agents.logs_overflowed IS 'Whether the startup logs overflowed in length';
 
-COMMENT ON COLUMN workspace_agents.startup_script_behavior IS 'When startup script behavior is non-blocking, the workspace will be ready and accessible upon agent connection, when it is blocking, workspace will wait for the startup script to complete before becoming ready and accessible.';
-
 COMMENT ON COLUMN workspace_agents.started_at IS 'The time the agent entered the starting lifecycle state';
 
 COMMENT ON COLUMN workspace_agents.ready_at IS 'The time the agent entered the ready or start_error lifecycle state';
 
+CREATE TABLE workspace_app_stats (
+    id bigint NOT NULL,
+    user_id uuid NOT NULL,
+    workspace_id uuid NOT NULL,
+    agent_id uuid NOT NULL,
+    access_method text NOT NULL,
+    slug_or_port text NOT NULL,
+    session_id uuid NOT NULL,
+    session_started_at timestamp with time zone NOT NULL,
+    session_ended_at timestamp with time zone NOT NULL,
+    requests integer NOT NULL
+);
+
+COMMENT ON TABLE workspace_app_stats IS 'A record of workspace app usage statistics';
+
+COMMENT ON COLUMN workspace_app_stats.id IS 'The ID of the record';
+
+COMMENT ON COLUMN workspace_app_stats.user_id IS 'The user who used the workspace app';
+
+COMMENT ON COLUMN workspace_app_stats.workspace_id IS 'The workspace that the workspace app was used in';
+
+COMMENT ON COLUMN workspace_app_stats.agent_id IS 'The workspace agent that was used';
+
+COMMENT ON COLUMN workspace_app_stats.access_method IS 'The method used to access the workspace app';
+
+COMMENT ON COLUMN workspace_app_stats.slug_or_port IS 'The slug or port used to to identify the app';
+
+COMMENT ON COLUMN workspace_app_stats.session_id IS 'The unique identifier for the session';
+
+COMMENT ON COLUMN workspace_app_stats.session_started_at IS 'The time the session started';
+
+COMMENT ON COLUMN workspace_app_stats.session_ended_at IS 'The time the session ended';
+
+COMMENT ON COLUMN workspace_app_stats.requests IS 'The number of requests made during the session, a number larger than 1 indicates that multiple sessions were rolled up into one';
+
+CREATE SEQUENCE workspace_app_stats_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE workspace_app_stats_id_seq OWNED BY workspace_app_stats.id;
+
 CREATE TABLE workspace_apps (
     id uuid NOT NULL,
     created_at timestamp with time zone NOT NULL,
@@ -948,9 +1140,10 @@ CREATE TABLE workspaces (
     name character varying(64) NOT NULL,
     autostart_schedule text,
     ttl bigint,
-    last_used_at timestamp without time zone DEFAULT '0001-01-01 00:00:00'::timestamp without time zone NOT NULL,
-    locked_at timestamp with time zone,
-    deleting_at timestamp with time zone
+    last_used_at timestamp with time zone DEFAULT '0001-01-01 00:00:00+00'::timestamp with time zone NOT NULL,
+    dormant_at timestamp with time zone,
+    deleting_at timestamp with time zone,
+    automatic_updates automatic_updates DEFAULT 'never'::automatic_updates NOT NULL
 );
 
 ALTER TABLE ONLY licenses ALTER COLUMN id SET DEFAULT nextval('licenses_id_seq'::regclass);
@@ -959,6 +1152,8 @@ ALTER TABLE ONLY provisioner_job_logs ALTER COLUMN id SET DEFAULT nextval('provi
 
 ALTER TABLE ONLY workspace_agent_logs ALTER COLUMN id SET DEFAULT nextval('workspace_agent_startup_logs_id_seq'::regclass);
 
+ALTER TABLE ONLY workspace_app_stats ALTER COLUMN id SET DEFAULT nextval('workspace_app_stats_id_seq'::regclass);
+
 ALTER TABLE ONLY workspace_proxies ALTER COLUMN region_id SET DEFAULT nextval('workspace_proxies_region_id_seq'::regclass);
 
 ALTER TABLE ONLY workspace_resource_metadata ALTER COLUMN id SET DEFAULT nextval('workspace_resource_metadata_id_seq'::regclass);
@@ -972,13 +1167,22 @@ ALTER TABLE ONLY api_keys
 ALTER TABLE ONLY audit_logs
     ADD CONSTRAINT audit_logs_pkey PRIMARY KEY (id);
 
+ALTER TABLE ONLY dbcrypt_keys
+    ADD CONSTRAINT dbcrypt_keys_active_key_digest_key UNIQUE (active_key_digest);
+
+ALTER TABLE ONLY dbcrypt_keys
+    ADD CONSTRAINT dbcrypt_keys_pkey PRIMARY KEY (number);
+
+ALTER TABLE ONLY dbcrypt_keys
+    ADD CONSTRAINT dbcrypt_keys_revoked_key_digest_key UNIQUE (revoked_key_digest);
+
 ALTER TABLE ONLY files
     ADD CONSTRAINT files_hash_created_by_key UNIQUE (hash, created_by);
 
 ALTER TABLE ONLY files
     ADD CONSTRAINT files_pkey PRIMARY KEY (id);
 
-ALTER TABLE ONLY git_auth_links
+ALTER TABLE ONLY external_auth_links
     ADD CONSTRAINT git_auth_links_provider_id_user_id_key UNIQUE (provider_id, user_id);
 
 ALTER TABLE ONLY gitsshkeys
@@ -1035,6 +1239,9 @@ ALTER TABLE ONLY site_configs
 ALTER TABLE ONLY tailnet_agents
     ADD CONSTRAINT tailnet_agents_pkey PRIMARY KEY (id, coordinator_id);
 
+ALTER TABLE ONLY tailnet_client_subscriptions
+    ADD CONSTRAINT tailnet_client_subscriptions_pkey PRIMARY KEY (client_id, coordinator_id, agent_id);
+
 ALTER TABLE ONLY tailnet_clients
     ADD CONSTRAINT tailnet_clients_pkey PRIMARY KEY (id, coordinator_id);
 
@@ -1062,6 +1269,9 @@ ALTER TABLE ONLY user_links
 ALTER TABLE ONLY users
     ADD CONSTRAINT users_pkey PRIMARY KEY (id);
 
+ALTER TABLE ONLY workspace_agent_log_sources
+    ADD CONSTRAINT workspace_agent_log_sources_pkey PRIMARY KEY (workspace_agent_id, id);
+
 ALTER TABLE ONLY workspace_agent_metadata
     ADD CONSTRAINT workspace_agent_metadata_pkey PRIMARY KEY (workspace_agent_id, key);
 
@@ -1071,6 +1281,12 @@ ALTER TABLE ONLY workspace_agent_logs
 ALTER TABLE ONLY workspace_agents
     ADD CONSTRAINT workspace_agents_pkey PRIMARY KEY (id);
 
+ALTER TABLE ONLY workspace_app_stats
+    ADD CONSTRAINT workspace_app_stats_pkey PRIMARY KEY (id);
+
+ALTER TABLE ONLY workspace_app_stats
+    ADD CONSTRAINT workspace_app_stats_user_id_agent_id_session_id_key UNIQUE (user_id, agent_id, session_id);
+
 ALTER TABLE ONLY workspace_apps
     ADD CONSTRAINT workspace_apps_agent_id_slug_idx UNIQUE (agent_id, slug);
 
@@ -1133,8 +1349,6 @@ CREATE UNIQUE INDEX idx_organization_name_lower ON organizations USING btree (lo
 
 CREATE INDEX idx_tailnet_agents_coordinator ON tailnet_agents USING btree (coordinator_id);
 
-CREATE INDEX idx_tailnet_clients_agent ON tailnet_clients USING btree (agent_id);
-
 CREATE INDEX idx_tailnet_clients_coordinator ON tailnet_clients USING btree (coordinator_id);
 
 CREATE UNIQUE INDEX idx_users_email ON users USING btree (email) WHERE (deleted = false);
@@ -1153,10 +1367,16 @@ CREATE UNIQUE INDEX users_username_lower_idx ON users USING btree (lower(usernam
 
 CREATE INDEX workspace_agent_startup_logs_id_agent_id_idx ON workspace_agent_logs USING btree (agent_id, id);
 
+CREATE INDEX workspace_agent_stats_template_id_created_at_user_id_idx ON workspace_agent_stats USING btree (template_id, created_at, user_id) INCLUDE (session_count_vscode, session_count_jetbrains, session_count_reconnecting_pty, session_count_ssh, connection_median_latency_ms) WHERE (connection_count > 0);
+
+COMMENT ON INDEX workspace_agent_stats_template_id_created_at_user_id_idx IS 'Support index for template insights endpoint to build interval reports faster.';
+
 CREATE INDEX workspace_agents_auth_token_idx ON workspace_agents USING btree (auth_token);
 
 CREATE INDEX workspace_agents_resource_id_idx ON workspace_agents USING btree (resource_id);
 
+CREATE INDEX workspace_app_stats_workspace_id_idx ON workspace_app_stats USING btree (workspace_id);
+
 CREATE UNIQUE INDEX workspace_proxies_lower_name_idx ON workspace_proxies USING btree (lower(name)) WHERE (deleted = false);
 
 CREATE INDEX workspace_resources_job_id_idx ON workspace_resources USING btree (job_id);
@@ -1167,6 +1387,8 @@ CREATE TRIGGER tailnet_notify_agent_change AFTER INSERT OR DELETE OR UPDATE ON t
 
 CREATE TRIGGER tailnet_notify_client_change AFTER INSERT OR DELETE OR UPDATE ON tailnet_clients FOR EACH ROW EXECUTE FUNCTION tailnet_notify_client_change();
 
+CREATE TRIGGER tailnet_notify_client_subscription_change AFTER INSERT OR DELETE OR UPDATE ON tailnet_client_subscriptions FOR EACH ROW EXECUTE FUNCTION tailnet_notify_client_subscription_change();
+
 CREATE TRIGGER tailnet_notify_coordinator_heartbeat AFTER INSERT OR UPDATE ON tailnet_coordinators FOR EACH ROW EXECUTE FUNCTION tailnet_notify_coordinator_heartbeat();
 
 CREATE TRIGGER trigger_insert_apikeys BEFORE INSERT ON api_keys FOR EACH ROW EXECUTE FUNCTION insert_apikey_fail_if_user_deleted();
@@ -1176,6 +1398,12 @@ CREATE TRIGGER trigger_update_users AFTER INSERT OR UPDATE ON users FOR EACH ROW
 ALTER TABLE ONLY api_keys
     ADD CONSTRAINT api_keys_user_id_uuid_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY external_auth_links
+    ADD CONSTRAINT git_auth_links_oauth_access_token_key_id_fkey FOREIGN KEY (oauth_access_token_key_id) REFERENCES dbcrypt_keys(active_key_digest);
+
+ALTER TABLE ONLY external_auth_links
+    ADD CONSTRAINT git_auth_links_oauth_refresh_token_key_id_fkey FOREIGN KEY (oauth_refresh_token_key_id) REFERENCES dbcrypt_keys(active_key_digest);
+
 ALTER TABLE ONLY gitsshkeys
     ADD CONSTRAINT gitsshkeys_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id);
 
@@ -1206,6 +1434,9 @@ ALTER TABLE ONLY provisioner_jobs
 ALTER TABLE ONLY tailnet_agents
     ADD CONSTRAINT tailnet_agents_coordinator_id_fkey FOREIGN KEY (coordinator_id) REFERENCES tailnet_coordinators(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY tailnet_client_subscriptions
+    ADD CONSTRAINT tailnet_client_subscriptions_coordinator_id_fkey FOREIGN KEY (coordinator_id) REFERENCES tailnet_coordinators(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY tailnet_clients
     ADD CONSTRAINT tailnet_clients_coordinator_id_fkey FOREIGN KEY (coordinator_id) REFERENCES tailnet_coordinators(id) ON DELETE CASCADE;
 
@@ -1230,18 +1461,39 @@ ALTER TABLE ONLY templates
 ALTER TABLE ONLY templates
     ADD CONSTRAINT templates_organization_id_fkey FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY user_links
+    ADD CONSTRAINT user_links_oauth_access_token_key_id_fkey FOREIGN KEY (oauth_access_token_key_id) REFERENCES dbcrypt_keys(active_key_digest);
+
+ALTER TABLE ONLY user_links
+    ADD CONSTRAINT user_links_oauth_refresh_token_key_id_fkey FOREIGN KEY (oauth_refresh_token_key_id) REFERENCES dbcrypt_keys(active_key_digest);
+
 ALTER TABLE ONLY user_links
     ADD CONSTRAINT user_links_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY workspace_agent_log_sources
+    ADD CONSTRAINT workspace_agent_log_sources_workspace_agent_id_fkey FOREIGN KEY (workspace_agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY workspace_agent_metadata
     ADD CONSTRAINT workspace_agent_metadata_workspace_agent_id_fkey FOREIGN KEY (workspace_agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY workspace_agent_scripts
+    ADD CONSTRAINT workspace_agent_scripts_workspace_agent_id_fkey FOREIGN KEY (workspace_agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY workspace_agent_logs
     ADD CONSTRAINT workspace_agent_startup_logs_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
 
 ALTER TABLE ONLY workspace_agents
     ADD CONSTRAINT workspace_agents_resource_id_fkey FOREIGN KEY (resource_id) REFERENCES workspace_resources(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY workspace_app_stats
+    ADD CONSTRAINT workspace_app_stats_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id);
+
+ALTER TABLE ONLY workspace_app_stats
+    ADD CONSTRAINT workspace_app_stats_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id);
+
+ALTER TABLE ONLY workspace_app_stats
+    ADD CONSTRAINT workspace_app_stats_workspace_id_fkey FOREIGN KEY (workspace_id) REFERENCES workspaces(id);
+
 ALTER TABLE ONLY workspace_apps
     ADD CONSTRAINT workspace_apps_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
 
diff --git a/coderd/database/errors.go b/coderd/database/errors.go
index af7365ffd916b..66c702de24445 100644
--- a/coderd/database/errors.go
+++ b/coderd/database/errors.go
@@ -37,6 +37,28 @@ func IsUniqueViolation(err error, uniqueConstraints ...UniqueConstraint) bool {
 	return false
 }
 
+// IsForeignKeyViolation checks if the error is due to a foreign key violation.
+// If one or more specific foreign key constraints are given as arguments,
+// the error must be caused by one of them. If no constraints are given,
+// this function returns true for any foreign key violation.
+func IsForeignKeyViolation(err error, foreignKeyConstraints ...ForeignKeyConstraint) bool {
+	var pqErr *pq.Error
+	if errors.As(err, &pqErr) {
+		if pqErr.Code.Name() == "foreign_key_violation" {
+			if len(foreignKeyConstraints) == 0 {
+				return true
+			}
+			for _, fc := range foreignKeyConstraints {
+				if pqErr.Constraint == string(fc) {
+					return true
+				}
+			}
+		}
+	}
+
+	return false
+}
+
 // IsQueryCanceledError checks if the error is due to a query being canceled.
 func IsQueryCanceledError(err error) bool {
 	var pqErr *pq.Error
diff --git a/coderd/database/foreign_key_constraint.go b/coderd/database/foreign_key_constraint.go
new file mode 100644
index 0000000000000..c2e81fd3bf817
--- /dev/null
+++ b/coderd/database/foreign_key_constraint.go
@@ -0,0 +1,52 @@
+// Code generated by scripts/dbgen/main.go. DO NOT EDIT.
+package database
+
+// ForeignKeyConstraint represents a named foreign key constraint on a table.
+type ForeignKeyConstraint string
+
+// ForeignKeyConstraint enums.
+const (
+	ForeignKeyAPIKeysUserIDUUID                            ForeignKeyConstraint = "api_keys_user_id_uuid_fkey"                             // ALTER TABLE ONLY api_keys ADD CONSTRAINT api_keys_user_id_uuid_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
+	ForeignKeyGitAuthLinksOauthAccessTokenKeyID            ForeignKeyConstraint = "git_auth_links_oauth_access_token_key_id_fkey"          // ALTER TABLE ONLY external_auth_links ADD CONSTRAINT git_auth_links_oauth_access_token_key_id_fkey FOREIGN KEY (oauth_access_token_key_id) REFERENCES dbcrypt_keys(active_key_digest);
+	ForeignKeyGitAuthLinksOauthRefreshTokenKeyID           ForeignKeyConstraint = "git_auth_links_oauth_refresh_token_key_id_fkey"         // ALTER TABLE ONLY external_auth_links ADD CONSTRAINT git_auth_links_oauth_refresh_token_key_id_fkey FOREIGN KEY (oauth_refresh_token_key_id) REFERENCES dbcrypt_keys(active_key_digest);
+	ForeignKeyGitSSHKeysUserID                             ForeignKeyConstraint = "gitsshkeys_user_id_fkey"                                // ALTER TABLE ONLY gitsshkeys ADD CONSTRAINT gitsshkeys_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id);
+	ForeignKeyGroupMembersGroupID                          ForeignKeyConstraint = "group_members_group_id_fkey"                            // ALTER TABLE ONLY group_members ADD CONSTRAINT group_members_group_id_fkey FOREIGN KEY (group_id) REFERENCES groups(id) ON DELETE CASCADE;
+	ForeignKeyGroupMembersUserID                           ForeignKeyConstraint = "group_members_user_id_fkey"                             // ALTER TABLE ONLY group_members ADD CONSTRAINT group_members_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
+	ForeignKeyGroupsOrganizationID                         ForeignKeyConstraint = "groups_organization_id_fkey"                            // ALTER TABLE ONLY groups ADD CONSTRAINT groups_organization_id_fkey FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE;
+	ForeignKeyOrganizationMembersOrganizationIDUUID        ForeignKeyConstraint = "organization_members_organization_id_uuid_fkey"         // ALTER TABLE ONLY organization_members ADD CONSTRAINT organization_members_organization_id_uuid_fkey FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE;
+	ForeignKeyOrganizationMembersUserIDUUID                ForeignKeyConstraint = "organization_members_user_id_uuid_fkey"                 // ALTER TABLE ONLY organization_members ADD CONSTRAINT organization_members_user_id_uuid_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
+	ForeignKeyParameterSchemasJobID                        ForeignKeyConstraint = "parameter_schemas_job_id_fkey"                          // ALTER TABLE ONLY parameter_schemas ADD CONSTRAINT parameter_schemas_job_id_fkey FOREIGN KEY (job_id) REFERENCES provisioner_jobs(id) ON DELETE CASCADE;
+	ForeignKeyProvisionerJobLogsJobID                      ForeignKeyConstraint = "provisioner_job_logs_job_id_fkey"                       // ALTER TABLE ONLY provisioner_job_logs ADD CONSTRAINT provisioner_job_logs_job_id_fkey FOREIGN KEY (job_id) REFERENCES provisioner_jobs(id) ON DELETE CASCADE;
+	ForeignKeyProvisionerJobsOrganizationID                ForeignKeyConstraint = "provisioner_jobs_organization_id_fkey"                  // ALTER TABLE ONLY provisioner_jobs ADD CONSTRAINT provisioner_jobs_organization_id_fkey FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE;
+	ForeignKeyTailnetAgentsCoordinatorID                   ForeignKeyConstraint = "tailnet_agents_coordinator_id_fkey"                     // ALTER TABLE ONLY tailnet_agents ADD CONSTRAINT tailnet_agents_coordinator_id_fkey FOREIGN KEY (coordinator_id) REFERENCES tailnet_coordinators(id) ON DELETE CASCADE;
+	ForeignKeyTailnetClientSubscriptionsCoordinatorID      ForeignKeyConstraint = "tailnet_client_subscriptions_coordinator_id_fkey"       // ALTER TABLE ONLY tailnet_client_subscriptions ADD CONSTRAINT tailnet_client_subscriptions_coordinator_id_fkey FOREIGN KEY (coordinator_id) REFERENCES tailnet_coordinators(id) ON DELETE CASCADE;
+	ForeignKeyTailnetClientsCoordinatorID                  ForeignKeyConstraint = "tailnet_clients_coordinator_id_fkey"                    // ALTER TABLE ONLY tailnet_clients ADD CONSTRAINT tailnet_clients_coordinator_id_fkey FOREIGN KEY (coordinator_id) REFERENCES tailnet_coordinators(id) ON DELETE CASCADE;
+	ForeignKeyTemplateVersionParametersTemplateVersionID   ForeignKeyConstraint = "template_version_parameters_template_version_id_fkey"   // ALTER TABLE ONLY template_version_parameters ADD CONSTRAINT template_version_parameters_template_version_id_fkey FOREIGN KEY (template_version_id) REFERENCES template_versions(id) ON DELETE CASCADE;
+	ForeignKeyTemplateVersionVariablesTemplateVersionID    ForeignKeyConstraint = "template_version_variables_template_version_id_fkey"    // ALTER TABLE ONLY template_version_variables ADD CONSTRAINT template_version_variables_template_version_id_fkey FOREIGN KEY (template_version_id) REFERENCES template_versions(id) ON DELETE CASCADE;
+	ForeignKeyTemplateVersionsCreatedBy                    ForeignKeyConstraint = "template_versions_created_by_fkey"                      // ALTER TABLE ONLY template_versions ADD CONSTRAINT template_versions_created_by_fkey FOREIGN KEY (created_by) REFERENCES users(id) ON DELETE RESTRICT;
+	ForeignKeyTemplateVersionsOrganizationID               ForeignKeyConstraint = "template_versions_organization_id_fkey"                 // ALTER TABLE ONLY template_versions ADD CONSTRAINT template_versions_organization_id_fkey FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE;
+	ForeignKeyTemplateVersionsTemplateID                   ForeignKeyConstraint = "template_versions_template_id_fkey"                     // ALTER TABLE ONLY template_versions ADD CONSTRAINT template_versions_template_id_fkey FOREIGN KEY (template_id) REFERENCES templates(id) ON DELETE CASCADE;
+	ForeignKeyTemplatesCreatedBy                           ForeignKeyConstraint = "templates_created_by_fkey"                              // ALTER TABLE ONLY templates ADD CONSTRAINT templates_created_by_fkey FOREIGN KEY (created_by) REFERENCES users(id) ON DELETE RESTRICT;
+	ForeignKeyTemplatesOrganizationID                      ForeignKeyConstraint = "templates_organization_id_fkey"                         // ALTER TABLE ONLY templates ADD CONSTRAINT templates_organization_id_fkey FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE;
+	ForeignKeyUserLinksOauthAccessTokenKeyID               ForeignKeyConstraint = "user_links_oauth_access_token_key_id_fkey"              // ALTER TABLE ONLY user_links ADD CONSTRAINT user_links_oauth_access_token_key_id_fkey FOREIGN KEY (oauth_access_token_key_id) REFERENCES dbcrypt_keys(active_key_digest);
+	ForeignKeyUserLinksOauthRefreshTokenKeyID              ForeignKeyConstraint = "user_links_oauth_refresh_token_key_id_fkey"             // ALTER TABLE ONLY user_links ADD CONSTRAINT user_links_oauth_refresh_token_key_id_fkey FOREIGN KEY (oauth_refresh_token_key_id) REFERENCES dbcrypt_keys(active_key_digest);
+	ForeignKeyUserLinksUserID                              ForeignKeyConstraint = "user_links_user_id_fkey"                                // ALTER TABLE ONLY user_links ADD CONSTRAINT user_links_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceAgentLogSourcesWorkspaceAgentID     ForeignKeyConstraint = "workspace_agent_log_sources_workspace_agent_id_fkey"    // ALTER TABLE ONLY workspace_agent_log_sources ADD CONSTRAINT workspace_agent_log_sources_workspace_agent_id_fkey FOREIGN KEY (workspace_agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceAgentMetadataWorkspaceAgentID       ForeignKeyConstraint = "workspace_agent_metadata_workspace_agent_id_fkey"       // ALTER TABLE ONLY workspace_agent_metadata ADD CONSTRAINT workspace_agent_metadata_workspace_agent_id_fkey FOREIGN KEY (workspace_agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceAgentScriptsWorkspaceAgentID        ForeignKeyConstraint = "workspace_agent_scripts_workspace_agent_id_fkey"        // ALTER TABLE ONLY workspace_agent_scripts ADD CONSTRAINT workspace_agent_scripts_workspace_agent_id_fkey FOREIGN KEY (workspace_agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceAgentStartupLogsAgentID             ForeignKeyConstraint = "workspace_agent_startup_logs_agent_id_fkey"             // ALTER TABLE ONLY workspace_agent_logs ADD CONSTRAINT workspace_agent_startup_logs_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceAgentsResourceID                    ForeignKeyConstraint = "workspace_agents_resource_id_fkey"                      // ALTER TABLE ONLY workspace_agents ADD CONSTRAINT workspace_agents_resource_id_fkey FOREIGN KEY (resource_id) REFERENCES workspace_resources(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceAppStatsAgentID                     ForeignKeyConstraint = "workspace_app_stats_agent_id_fkey"                      // ALTER TABLE ONLY workspace_app_stats ADD CONSTRAINT workspace_app_stats_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id);
+	ForeignKeyWorkspaceAppStatsUserID                      ForeignKeyConstraint = "workspace_app_stats_user_id_fkey"                       // ALTER TABLE ONLY workspace_app_stats ADD CONSTRAINT workspace_app_stats_user_id_fkey FOREIGN KEY (user_id) REFERENCES users(id);
+	ForeignKeyWorkspaceAppStatsWorkspaceID                 ForeignKeyConstraint = "workspace_app_stats_workspace_id_fkey"                  // ALTER TABLE ONLY workspace_app_stats ADD CONSTRAINT workspace_app_stats_workspace_id_fkey FOREIGN KEY (workspace_id) REFERENCES workspaces(id);
+	ForeignKeyWorkspaceAppsAgentID                         ForeignKeyConstraint = "workspace_apps_agent_id_fkey"                           // ALTER TABLE ONLY workspace_apps ADD CONSTRAINT workspace_apps_agent_id_fkey FOREIGN KEY (agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceBuildParametersWorkspaceBuildID     ForeignKeyConstraint = "workspace_build_parameters_workspace_build_id_fkey"     // ALTER TABLE ONLY workspace_build_parameters ADD CONSTRAINT workspace_build_parameters_workspace_build_id_fkey FOREIGN KEY (workspace_build_id) REFERENCES workspace_builds(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceBuildsJobID                         ForeignKeyConstraint = "workspace_builds_job_id_fkey"                           // ALTER TABLE ONLY workspace_builds ADD CONSTRAINT workspace_builds_job_id_fkey FOREIGN KEY (job_id) REFERENCES provisioner_jobs(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceBuildsTemplateVersionID             ForeignKeyConstraint = "workspace_builds_template_version_id_fkey"              // ALTER TABLE ONLY workspace_builds ADD CONSTRAINT workspace_builds_template_version_id_fkey FOREIGN KEY (template_version_id) REFERENCES template_versions(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceBuildsWorkspaceID                   ForeignKeyConstraint = "workspace_builds_workspace_id_fkey"                     // ALTER TABLE ONLY workspace_builds ADD CONSTRAINT workspace_builds_workspace_id_fkey FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceResourceMetadataWorkspaceResourceID ForeignKeyConstraint = "workspace_resource_metadata_workspace_resource_id_fkey" // ALTER TABLE ONLY workspace_resource_metadata ADD CONSTRAINT workspace_resource_metadata_workspace_resource_id_fkey FOREIGN KEY (workspace_resource_id) REFERENCES workspace_resources(id) ON DELETE CASCADE;
+	ForeignKeyWorkspaceResourcesJobID                      ForeignKeyConstraint = "workspace_resources_job_id_fkey"                        // ALTER TABLE ONLY workspace_resources ADD CONSTRAINT workspace_resources_job_id_fkey FOREIGN KEY (job_id) REFERENCES provisioner_jobs(id) ON DELETE CASCADE;
+	ForeignKeyWorkspacesOrganizationID                     ForeignKeyConstraint = "workspaces_organization_id_fkey"                        // ALTER TABLE ONLY workspaces ADD CONSTRAINT workspaces_organization_id_fkey FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE RESTRICT;
+	ForeignKeyWorkspacesOwnerID                            ForeignKeyConstraint = "workspaces_owner_id_fkey"                               // ALTER TABLE ONLY workspaces ADD CONSTRAINT workspaces_owner_id_fkey FOREIGN KEY (owner_id) REFERENCES users(id) ON DELETE RESTRICT;
+	ForeignKeyWorkspacesTemplateID                         ForeignKeyConstraint = "workspaces_template_id_fkey"                            // ALTER TABLE ONLY workspaces ADD CONSTRAINT workspaces_template_id_fkey FOREIGN KEY (template_id) REFERENCES templates(id) ON DELETE RESTRICT;
+)
diff --git a/coderd/database/gen/dump/main.go b/coderd/database/gen/dump/main.go
index 2c70c4294c35d..daa26923f9411 100644
--- a/coderd/database/gen/dump/main.go
+++ b/coderd/database/gen/dump/main.go
@@ -11,8 +11,8 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/coder/coder/coderd/database/migrations"
-	"github.com/coder/coder/coderd/database/postgres"
+	"github.com/coder/coder/v2/coderd/database/migrations"
+	"github.com/coder/coder/v2/coderd/database/postgres"
 )
 
 const minimumPostgreSQLVersion = 13
diff --git a/coderd/database/generate.sh b/coderd/database/generate.sh
index e8777a036a3cf..c5c9c0c12eb4b 100755
--- a/coderd/database/generate.sh
+++ b/coderd/database/generate.sh
@@ -21,7 +21,8 @@ SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
 	sqlc generate
 
 	first=true
-	for fi in queries/*.sql.go; do
+	files=$(find ./queries/ -type f -name "*.sql.go" | LC_ALL=C sort)
+	for fi in $files; do
 		# Find the last line from the imports section and add 1. We have to
 		# disable pipefail temporarily to avoid ERRPIPE errors when piping into
 		# `head -n1`.
@@ -56,7 +57,7 @@ SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
 	go mod download
 	go run golang.org/x/tools/cmd/goimports@latest -w queries.sql.go
 
-	go run ../../scripts/dbgen/main.go
+	go run ../../scripts/dbgen
 	# This will error if a view is broken.
 	go test -run=TestViewSubset
 )
diff --git a/coderd/database/migrations/000148_group_source.down.sql b/coderd/database/migrations/000148_group_source.down.sql
new file mode 100644
index 0000000000000..504c227d186bb
--- /dev/null
+++ b/coderd/database/migrations/000148_group_source.down.sql
@@ -0,0 +1,8 @@
+BEGIN;
+
+ALTER TABLE groups
+	DROP COLUMN source;
+
+DROP TYPE group_source;
+
+COMMIT;
diff --git a/coderd/database/migrations/000148_group_source.up.sql b/coderd/database/migrations/000148_group_source.up.sql
new file mode 100644
index 0000000000000..d06e89ca2b1d6
--- /dev/null
+++ b/coderd/database/migrations/000148_group_source.up.sql
@@ -0,0 +1,15 @@
+BEGIN;
+
+CREATE TYPE group_source AS ENUM (
+    -- User created groups
+	'user',
+    -- Groups created by the system through oidc sync
+	'oidc'
+);
+
+ALTER TABLE groups
+	ADD COLUMN source group_source NOT NULL DEFAULT 'user';
+
+COMMENT ON COLUMN groups.source IS 'Source indicates how the group was created. It can be created by a user manually, or through some system process like OIDC group sync.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000149_agent_multiple_subsystems.down.sql b/coderd/database/migrations/000149_agent_multiple_subsystems.down.sql
new file mode 100644
index 0000000000000..05bea6c620502
--- /dev/null
+++ b/coderd/database/migrations/000149_agent_multiple_subsystems.down.sql
@@ -0,0 +1,17 @@
+BEGIN;
+
+-- Bring back the subsystem column.
+ALTER TABLE workspace_agents ADD COLUMN subsystem workspace_agent_subsystem NOT NULL DEFAULT 'none';
+
+-- Update all existing workspace_agents to have subsystem = subsystems[0] unless
+-- subsystems is empty.
+UPDATE workspace_agents SET subsystem = subsystems[1] WHERE cardinality(subsystems) > 0;
+
+-- Drop the subsystems column from workspace_agents.
+ALTER TABLE workspace_agents DROP COLUMN subsystems;
+
+-- We cannot drop the "exectrace" value from the workspace_agent_subsystem type
+-- because you cannot drop values from an enum type.
+UPDATE workspace_agents SET subsystem = 'none' WHERE subsystem = 'exectrace';
+
+COMMIT;
diff --git a/coderd/database/migrations/000149_agent_multiple_subsystems.up.sql b/coderd/database/migrations/000149_agent_multiple_subsystems.up.sql
new file mode 100644
index 0000000000000..9ebb71d5bdf5e
--- /dev/null
+++ b/coderd/database/migrations/000149_agent_multiple_subsystems.up.sql
@@ -0,0 +1,21 @@
+BEGIN;
+
+-- Add "exectrace" to workspace_agent_subsystem type.
+ALTER TYPE workspace_agent_subsystem ADD VALUE 'exectrace';
+
+-- Create column subsystems in workspace_agents table, with default value being
+-- an empty array.
+ALTER TABLE workspace_agents ADD COLUMN subsystems workspace_agent_subsystem[] DEFAULT '{}';
+
+-- Add a constraint that the subsystems cannot contain the deprecated value
+-- 'none'.
+ALTER TABLE workspace_agents ADD CONSTRAINT subsystems_not_none CHECK (NOT ('none' = ANY (subsystems)));
+
+-- Update all existing workspace_agents to have subsystems = [subsystem] unless
+-- the subsystem is 'none'.
+UPDATE workspace_agents SET subsystems = ARRAY[subsystem] WHERE subsystem != 'none';
+
+-- Drop the subsystem column from workspace_agents.
+ALTER TABLE workspace_agents DROP COLUMN subsystem;
+
+COMMIT;
diff --git a/coderd/database/migrations/000150_workspace_app_stats.down.sql b/coderd/database/migrations/000150_workspace_app_stats.down.sql
new file mode 100644
index 0000000000000..983a13c180edc
--- /dev/null
+++ b/coderd/database/migrations/000150_workspace_app_stats.down.sql
@@ -0,0 +1 @@
+DROP TABLE workspace_app_stats;
diff --git a/coderd/database/migrations/000150_workspace_app_stats.up.sql b/coderd/database/migrations/000150_workspace_app_stats.up.sql
new file mode 100644
index 0000000000000..ace09e52760f6
--- /dev/null
+++ b/coderd/database/migrations/000150_workspace_app_stats.up.sql
@@ -0,0 +1,32 @@
+CREATE TABLE workspace_app_stats (
+	id BIGSERIAL PRIMARY KEY,
+	user_id uuid NOT NULL REFERENCES users (id),
+	workspace_id uuid NOT NULL REFERENCES workspaces (id),
+	agent_id uuid NOT NULL REFERENCES workspace_agents (id),
+	access_method text NOT NULL,
+	slug_or_port text NOT NULL,
+	session_id uuid NOT NULL,
+	session_started_at timestamptz NOT NULL,
+	session_ended_at timestamptz NOT NULL,
+	requests integer NOT NULL,
+
+	-- Set a unique constraint to allow upserting the session_ended_at
+	-- and requests fields without risk of collisions.
+	UNIQUE(user_id, agent_id, session_id)
+);
+
+COMMENT ON TABLE workspace_app_stats IS 'A record of workspace app usage statistics';
+
+COMMENT ON COLUMN workspace_app_stats.id IS 'The ID of the record';
+COMMENT ON COLUMN workspace_app_stats.user_id IS 'The user who used the workspace app';
+COMMENT ON COLUMN workspace_app_stats.workspace_id IS 'The workspace that the workspace app was used in';
+COMMENT ON COLUMN workspace_app_stats.agent_id IS 'The workspace agent that was used';
+COMMENT ON COLUMN workspace_app_stats.access_method IS 'The method used to access the workspace app';
+COMMENT ON COLUMN workspace_app_stats.slug_or_port IS 'The slug or port used to to identify the app';
+COMMENT ON COLUMN workspace_app_stats.session_id IS 'The unique identifier for the session';
+COMMENT ON COLUMN workspace_app_stats.session_started_at IS 'The time the session started';
+COMMENT ON COLUMN workspace_app_stats.session_ended_at IS 'The time the session ended';
+COMMENT ON COLUMN workspace_app_stats.requests IS 'The number of requests made during the session, a number larger than 1 indicates that multiple sessions were rolled up into one';
+
+-- Create index on workspace_id for joining/filtering by templates.
+CREATE INDEX workspace_app_stats_workspace_id_idx ON workspace_app_stats (workspace_id);
diff --git a/coderd/database/migrations/000151_rename_locked.down.sql b/coderd/database/migrations/000151_rename_locked.down.sql
new file mode 100644
index 0000000000000..4dfb254268fa2
--- /dev/null
+++ b/coderd/database/migrations/000151_rename_locked.down.sql
@@ -0,0 +1,26 @@
+BEGIN;
+
+ALTER TABLE templates RENAME COLUMN time_til_dormant TO inactivity_ttl;
+ALTER TABLE templates RENAME COLUMN time_til_dormant_autodelete TO locked_ttl;
+ALTER TABLE workspaces RENAME COLUMN dormant_at TO locked_at;
+
+-- Update the template_with_users view;
+DROP VIEW template_with_users;
+-- If you need to update this view, put 'DROP VIEW template_with_users;' before this.
+CREATE VIEW
+    template_with_users
+AS
+    SELECT
+        templates.*,
+		coalesce(visible_users.avatar_url, '') AS created_by_avatar_url,
+		coalesce(visible_users.username, '') AS created_by_username
+    FROM
+        templates
+    LEFT JOIN
+		visible_users
+	ON
+	    templates.created_by = visible_users.id;
+
+COMMENT ON VIEW template_with_users IS 'Joins in the username + avatar url of the created by user.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000151_rename_locked.up.sql b/coderd/database/migrations/000151_rename_locked.up.sql
new file mode 100644
index 0000000000000..ae72c7efa98cb
--- /dev/null
+++ b/coderd/database/migrations/000151_rename_locked.up.sql
@@ -0,0 +1,25 @@
+BEGIN;
+ALTER TABLE templates RENAME COLUMN inactivity_ttl TO time_til_dormant;
+ALTER TABLE templates RENAME COLUMN locked_ttl TO time_til_dormant_autodelete;
+ALTER TABLE workspaces RENAME COLUMN locked_at TO dormant_at;
+
+-- Update the template_with_users view;a
+DROP VIEW template_with_users;
+-- If you need to update this view, put 'DROP VIEW template_with_users;' before this.
+CREATE VIEW
+    template_with_users
+AS
+    SELECT
+        templates.*,
+		coalesce(visible_users.avatar_url, '') AS created_by_avatar_url,
+		coalesce(visible_users.username, '') AS created_by_username
+    FROM
+        templates
+    LEFT JOIN
+		visible_users
+	ON
+	    templates.created_by = visible_users.id;
+
+COMMENT ON VIEW template_with_users IS 'Joins in the username + avatar url of the created by user.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000152_rename_template_restart_requirement.down.sql b/coderd/database/migrations/000152_rename_template_restart_requirement.down.sql
new file mode 100644
index 0000000000000..1dc90e708db1a
--- /dev/null
+++ b/coderd/database/migrations/000152_rename_template_restart_requirement.down.sql
@@ -0,0 +1,25 @@
+BEGIN;
+
+DROP VIEW template_with_users;
+
+ALTER TABLE templates RENAME COLUMN autostop_requirement_days_of_week TO restart_requirement_days_of_week;
+
+ALTER TABLE templates RENAME COLUMN autostop_requirement_weeks TO restart_requirement_weeks;
+
+CREATE VIEW
+    template_with_users
+AS
+    SELECT
+        templates.*,
+		coalesce(visible_users.avatar_url, '') AS created_by_avatar_url,
+		coalesce(visible_users.username, '') AS created_by_username
+    FROM
+        templates
+    LEFT JOIN
+		visible_users
+	ON
+	    templates.created_by = visible_users.id;
+
+COMMENT ON VIEW template_with_users IS 'Joins in the username + avatar url of the created by user.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000152_rename_template_restart_requirement.up.sql b/coderd/database/migrations/000152_rename_template_restart_requirement.up.sql
new file mode 100644
index 0000000000000..67323287511b3
--- /dev/null
+++ b/coderd/database/migrations/000152_rename_template_restart_requirement.up.sql
@@ -0,0 +1,25 @@
+BEGIN;
+
+DROP VIEW template_with_users;
+
+ALTER TABLE templates RENAME COLUMN restart_requirement_days_of_week TO autostop_requirement_days_of_week;
+
+ALTER TABLE templates RENAME COLUMN restart_requirement_weeks TO autostop_requirement_weeks;
+
+CREATE VIEW
+    template_with_users
+AS
+    SELECT
+        templates.*,
+		coalesce(visible_users.avatar_url, '') AS created_by_avatar_url,
+		coalesce(visible_users.username, '') AS created_by_username
+    FROM
+        templates
+    LEFT JOIN
+		visible_users
+	ON
+	    templates.created_by = visible_users.id;
+
+COMMENT ON VIEW template_with_users IS 'Joins in the username + avatar url of the created by user.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000153_agent_default_apps.down.sql b/coderd/database/migrations/000153_agent_default_apps.down.sql
new file mode 100644
index 0000000000000..34c8f46551680
--- /dev/null
+++ b/coderd/database/migrations/000153_agent_default_apps.down.sql
@@ -0,0 +1,5 @@
+BEGIN;
+ALTER TABLE workspace_agents DROP COLUMN display_apps;
+DROP TYPE display_app; 
+COMMIT;
+
diff --git a/coderd/database/migrations/000153_agent_default_apps.up.sql b/coderd/database/migrations/000153_agent_default_apps.up.sql
new file mode 100644
index 0000000000000..7b51b77d8661e
--- /dev/null
+++ b/coderd/database/migrations/000153_agent_default_apps.up.sql
@@ -0,0 +1,4 @@
+BEGIN;
+CREATE TYPE display_app AS ENUM ('vscode', 'vscode_insiders', 'web_terminal', 'ssh_helper', 'port_forwarding_helper');
+ALTER TABLE workspace_agents ADD column display_apps display_app[] DEFAULT '{vscode, vscode_insiders, web_terminal, ssh_helper, port_forwarding_helper}';
+COMMIT;
diff --git a/coderd/database/migrations/000154_dbcrypt_key_ids.down.sql b/coderd/database/migrations/000154_dbcrypt_key_ids.down.sql
new file mode 100644
index 0000000000000..7dea0a1909227
--- /dev/null
+++ b/coderd/database/migrations/000154_dbcrypt_key_ids.down.sql
@@ -0,0 +1,43 @@
+BEGIN;
+
+-- Before dropping this table, we need to check if there exist any
+-- foreign key references to it. We do this by checking the following:
+-- user_links.oauth_access_token_key_id
+-- user_links.oauth_refresh_token_key_id
+-- git_auth_links.oauth_access_token_key_id
+-- git_auth_links.oauth_refresh_token_key_id
+DO $$
+BEGIN
+IF EXISTS (
+	SELECT *
+		FROM user_links
+		WHERE oauth_access_token_key_id IS NOT NULL
+		OR oauth_refresh_token_key_id IS NOT NULL
+	) THEN RAISE EXCEPTION 'Cannot drop dbcrypt_keys table as there are still foreign key references to it from user_links.';
+END IF;
+
+IF EXISTS (
+	SELECT *
+		FROM git_auth_links
+		WHERE oauth_access_token_key_id IS NOT NULL
+		OR oauth_refresh_token_key_id IS NOT NULL
+	) THEN RAISE EXCEPTION 'Cannot drop dbcrypt_keys table as there are still foreign key references to it from git_auth_links.';
+END IF;
+
+END
+$$;
+
+
+-- Drop the columns first.
+ALTER TABLE git_auth_links
+	DROP COLUMN IF EXISTS oauth_access_token_key_id,
+	DROP COLUMN IF EXISTS oauth_refresh_token_key_id;
+
+ALTER TABLE user_links
+	DROP COLUMN IF EXISTS oauth_access_token_key_id,
+	DROP COLUMN IF EXISTS oauth_refresh_token_key_id;
+
+-- Finally, drop the table.
+DROP TABLE IF EXISTS dbcrypt_keys;
+
+COMMIT;
diff --git a/coderd/database/migrations/000154_dbcrypt_key_ids.up.sql b/coderd/database/migrations/000154_dbcrypt_key_ids.up.sql
new file mode 100644
index 0000000000000..804c41b82b67f
--- /dev/null
+++ b/coderd/database/migrations/000154_dbcrypt_key_ids.up.sql
@@ -0,0 +1,30 @@
+CREATE TABLE IF NOT EXISTS dbcrypt_keys (
+	number int NOT NULL PRIMARY KEY,
+	active_key_digest text UNIQUE,
+	revoked_key_digest text UNIQUE,
+	created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,
+	revoked_at TIMESTAMP WITH TIME ZONE DEFAULT NULL,
+	test TEXT NOT NULL
+);
+
+COMMENT ON TABLE dbcrypt_keys IS 'A table used to store the keys used to encrypt the database.';
+COMMENT ON COLUMN dbcrypt_keys.number IS 'An integer used to identify the key.';
+COMMENT ON COLUMN dbcrypt_keys.active_key_digest IS 'If the key is active, the digest of the active key.';
+COMMENT ON COLUMN dbcrypt_keys.revoked_key_digest IS 'If the key has been revoked, the digest of the revoked key.';
+COMMENT ON COLUMN dbcrypt_keys.created_at IS 'The time at which the key was created.';
+COMMENT ON COLUMN dbcrypt_keys.revoked_at IS 'The time at which the key was revoked.';
+COMMENT ON COLUMN dbcrypt_keys.test IS 'A column used to test the encryption.';
+
+ALTER TABLE git_auth_links
+ADD COLUMN IF NOT EXISTS oauth_access_token_key_id text REFERENCES dbcrypt_keys(active_key_digest),
+ADD COLUMN IF NOT EXISTS oauth_refresh_token_key_id text REFERENCES dbcrypt_keys(active_key_digest);
+
+COMMENT ON COLUMN git_auth_links.oauth_access_token_key_id IS 'The ID of the key used to encrypt the OAuth access token. If this is NULL, the access token is not encrypted';
+COMMENT ON COLUMN git_auth_links.oauth_refresh_token_key_id IS 'The ID of the key used to encrypt the OAuth refresh token. If this is NULL, the refresh token is not encrypted';
+
+ALTER TABLE user_links
+ADD COLUMN IF NOT EXISTS oauth_access_token_key_id text REFERENCES dbcrypt_keys(active_key_digest),
+ADD COLUMN IF NOT EXISTS oauth_refresh_token_key_id text REFERENCES dbcrypt_keys(active_key_digest);
+
+COMMENT ON COLUMN user_links.oauth_access_token_key_id IS 'The ID of the key used to encrypt the OAuth access token. If this is NULL, the access token is not encrypted';
+COMMENT ON COLUMN user_links.oauth_refresh_token_key_id IS 'The ID of the key used to encrypt the OAuth refresh token. If this is NULL, the refresh token is not encrypted';
diff --git a/coderd/database/migrations/000155_workspaces_last_used_at_timestamptz.down.sql b/coderd/database/migrations/000155_workspaces_last_used_at_timestamptz.down.sql
new file mode 100644
index 0000000000000..b594014d4b387
--- /dev/null
+++ b/coderd/database/migrations/000155_workspaces_last_used_at_timestamptz.down.sql
@@ -0,0 +1,6 @@
+ALTER TABLE ONLY workspaces
+ALTER COLUMN last_used_at
+	SET DATA TYPE timestamp
+	USING last_used_at::timestamptz AT TIME ZONE 'UTC',
+ALTER COLUMN last_used_at
+	SET DEFAULT '0001-01-01 00:00:00'::timestamp;
diff --git a/coderd/database/migrations/000155_workspaces_last_used_at_timestamptz.up.sql b/coderd/database/migrations/000155_workspaces_last_used_at_timestamptz.up.sql
new file mode 100644
index 0000000000000..644ef947fda4c
--- /dev/null
+++ b/coderd/database/migrations/000155_workspaces_last_used_at_timestamptz.up.sql
@@ -0,0 +1,6 @@
+ALTER TABLE ONLY workspaces
+ALTER COLUMN last_used_at
+	SET DATA TYPE timestamptz
+	USING last_used_at::timestamp AT TIME ZONE 'UTC',
+ALTER COLUMN last_used_at
+	SET DEFAULT '0001-01-01 00:00:00+00:00'::timestamptz;
diff --git a/coderd/database/migrations/000156_pg_coordinator_single_tailnet.down.sql b/coderd/database/migrations/000156_pg_coordinator_single_tailnet.down.sql
new file mode 100644
index 0000000000000..7cc418489f59a
--- /dev/null
+++ b/coderd/database/migrations/000156_pg_coordinator_single_tailnet.down.sql
@@ -0,0 +1,39 @@
+BEGIN;
+
+ALTER TABLE
+	tailnet_clients
+ADD COLUMN
+	agent_id uuid;
+
+UPDATE
+	tailnet_clients
+SET
+	-- there's no reason for us to try and preserve data since coordinators will
+	-- have to restart anyways, which will create all of the client mappings.
+	agent_id = '00000000-0000-0000-0000-000000000000'::uuid;
+
+ALTER TABLE
+	tailnet_clients
+ALTER COLUMN
+	agent_id SET NOT NULL;
+
+DROP TABLE tailnet_client_subscriptions;
+DROP FUNCTION tailnet_notify_client_subscription_change;
+
+-- update the tailnet_clients trigger to the old version.
+CREATE OR REPLACE FUNCTION tailnet_notify_client_change() RETURNS trigger
+	LANGUAGE plpgsql
+	AS $$
+BEGIN
+	IF (OLD IS NOT NULL) THEN
+		PERFORM pg_notify('tailnet_client_update', OLD.id || ',' || OLD.agent_id);
+		RETURN NULL;
+	END IF;
+	IF (NEW IS NOT NULL) THEN
+		PERFORM pg_notify('tailnet_client_update', NEW.id || ',' || NEW.agent_id);
+		RETURN NULL;
+	END IF;
+END;
+$$;
+
+COMMIT;
diff --git a/coderd/database/migrations/000156_pg_coordinator_single_tailnet.up.sql b/coderd/database/migrations/000156_pg_coordinator_single_tailnet.up.sql
new file mode 100644
index 0000000000000..4ca218248ef4a
--- /dev/null
+++ b/coderd/database/migrations/000156_pg_coordinator_single_tailnet.up.sql
@@ -0,0 +1,88 @@
+BEGIN;
+
+CREATE TABLE tailnet_client_subscriptions (
+	client_id uuid NOT NULL,
+	coordinator_id uuid NOT NULL,
+	-- this isn't a foreign key since it's more of a list of agents the client
+	-- *wants* to connect to, and they don't necessarily have to currently
+	-- exist in the db.
+	agent_id uuid NOT NULL,
+	updated_at timestamp with time zone NOT NULL,
+	PRIMARY KEY (client_id, coordinator_id, agent_id),
+	FOREIGN KEY (coordinator_id)  REFERENCES tailnet_coordinators (id) ON DELETE CASCADE
+	-- we don't keep a foreign key to the tailnet_clients table since there's
+	-- not a great way to guarantee that a subscription is always added after
+	-- the client is inserted. clients are only created after the client sends
+	-- its first node update, which can take an undetermined amount of time.
+);
+
+CREATE FUNCTION tailnet_notify_client_subscription_change() RETURNS trigger
+	LANGUAGE plpgsql
+	AS $$
+BEGIN
+	IF (NEW IS NOT NULL) THEN
+		PERFORM pg_notify('tailnet_client_update', NEW.client_id || ',' || NEW.agent_id);
+		RETURN NULL;
+	ELSIF (OLD IS NOT NULL) THEN
+		PERFORM pg_notify('tailnet_client_update', OLD.client_id || ',' || OLD.agent_id);
+		RETURN NULL;
+	END IF;
+END;
+$$;
+
+CREATE TRIGGER tailnet_notify_client_subscription_change
+	AFTER INSERT OR UPDATE OR DELETE ON tailnet_client_subscriptions
+	FOR EACH ROW
+EXECUTE PROCEDURE tailnet_notify_client_subscription_change();
+
+CREATE OR REPLACE FUNCTION tailnet_notify_client_change() RETURNS trigger
+	LANGUAGE plpgsql
+	AS $$
+DECLARE
+	var_client_id uuid;
+	var_coordinator_id uuid;
+	var_agent_ids uuid[];
+	var_agent_id uuid;
+BEGIN
+	IF (NEW.id IS NOT NULL) THEN
+		var_client_id = NEW.id;
+		var_coordinator_id = NEW.coordinator_id;
+	ELSIF (OLD.id IS NOT NULL) THEN
+		var_client_id = OLD.id;
+		var_coordinator_id = OLD.coordinator_id;
+	END IF;
+
+	-- Read all agents the client is subscribed to, so we can notify them.
+	SELECT
+		array_agg(agent_id)
+	INTO
+		var_agent_ids
+	FROM
+		tailnet_client_subscriptions subs
+	WHERE
+		subs.client_id = NEW.id AND
+		subs.coordinator_id = NEW.coordinator_id;
+
+	-- No agents to notify
+	if (var_agent_ids IS NULL) THEN
+		return NULL;
+	END IF;
+
+	-- pg_notify is limited to 8k bytes, which is approximately 221 UUIDs.
+	-- Instead of sending all agent ids in a single update, send one for each
+	-- agent id to prevent overflow.
+	FOREACH var_agent_id IN ARRAY var_agent_ids
+	LOOP
+		PERFORM pg_notify('tailnet_client_update', var_client_id || ',' || var_agent_id);
+	END LOOP;
+
+	return NULL;
+END;
+$$;
+
+ALTER TABLE
+	tailnet_clients
+DROP COLUMN
+	agent_id;
+
+COMMIT;
diff --git a/coderd/database/migrations/000157_workspace_agent_script.down.sql b/coderd/database/migrations/000157_workspace_agent_script.down.sql
new file mode 100644
index 0000000000000..013c1097dda3e
--- /dev/null
+++ b/coderd/database/migrations/000157_workspace_agent_script.down.sql
@@ -0,0 +1,23 @@
+BEGIN;
+
+ALTER TABLE workspace_agent_logs SET LOGGED;
+
+-- Revert the workspace_agents table to its former state
+ALTER TABLE workspace_agents ADD COLUMN startup_script text;
+ALTER TABLE workspace_agents ADD COLUMN startup_script_behavior text;
+ALTER TABLE workspace_agents ADD COLUMN shutdown_script_timeout_seconds integer;
+ALTER TABLE workspace_agents ADD COLUMN shutdown_script text;
+ALTER TABLE workspace_agents ADD COLUMN startup_script_timeout_seconds integer;
+
+-- Reinstate the dropped type
+CREATE TYPE workspace_agent_log_source AS ENUM ('startup_script', 'shutdown_script', 'kubernetes_logs', 'envbox', 'envbuilder', 'external');
+
+-- Add old source column back with enum type and drop log_source_id
+ALTER TABLE workspace_agent_logs ADD COLUMN source workspace_agent_log_source;
+ALTER TABLE workspace_agent_logs DROP COLUMN log_source_id;
+
+-- Drop the newly created tables
+DROP TABLE workspace_agent_scripts;
+DROP TABLE workspace_agent_log_sources;
+
+COMMIT;
diff --git a/coderd/database/migrations/000157_workspace_agent_script.up.sql b/coderd/database/migrations/000157_workspace_agent_script.up.sql
new file mode 100644
index 0000000000000..c073318c5b804
--- /dev/null
+++ b/coderd/database/migrations/000157_workspace_agent_script.up.sql
@@ -0,0 +1,36 @@
+BEGIN;
+CREATE TABLE workspace_agent_log_sources (
+	workspace_agent_id uuid NOT NULL REFERENCES workspace_agents(id) ON DELETE CASCADE,
+	id uuid NOT NULL,
+	created_at timestamptz NOT NULL,
+	display_name varchar(127) NOT NULL,
+	icon text NOT NULL,
+	PRIMARY KEY (workspace_agent_id, id)
+);
+
+CREATE TABLE workspace_agent_scripts (
+	workspace_agent_id uuid NOT NULL REFERENCES workspace_agents(id) ON DELETE CASCADE,
+	log_source_id uuid NOT NULL,
+	log_path text NOT NULL,
+	created_at timestamptz NOT NULL,
+	script text NOT NULL,
+	cron text NOT NULL,
+	start_blocks_login boolean NOT NULL,
+	run_on_start boolean NOT NULL,
+	run_on_stop boolean NOT NULL,
+	timeout_seconds integer NOT NULL
+);
+
+ALTER TABLE workspace_agent_logs ADD COLUMN log_source_id uuid NOT NULL DEFAULT '00000000-0000-0000-0000-000000000000'::uuid;
+ALTER TABLE workspace_agent_logs DROP COLUMN source;
+DROP TYPE workspace_agent_log_source;
+
+ALTER TABLE workspace_agents DROP COLUMN startup_script_timeout_seconds;
+ALTER TABLE workspace_agents DROP COLUMN shutdown_script;
+ALTER TABLE workspace_agents DROP COLUMN shutdown_script_timeout_seconds;
+ALTER TABLE workspace_agents DROP COLUMN startup_script_behavior;
+ALTER TABLE workspace_agents DROP COLUMN startup_script;
+
+-- Set the table to unlogged to speed up the inserts
+ALTER TABLE workspace_agent_logs SET UNLOGGED;
+COMMIT;
diff --git a/coderd/database/migrations/000158_external_auth.down.sql b/coderd/database/migrations/000158_external_auth.down.sql
new file mode 100644
index 0000000000000..427de53c95fb2
--- /dev/null
+++ b/coderd/database/migrations/000158_external_auth.down.sql
@@ -0,0 +1,25 @@
+BEGIN;
+
+ALTER TABLE template_versions RENAME COLUMN external_auth_providers TO git_auth_providers;
+
+ALTER TABLE external_auth_links RENAME TO git_auth_links;
+
+DROP VIEW template_version_with_user;
+-- If you need to update this view, put 'DROP VIEW template_version_with_user;' before this.
+CREATE VIEW
+	template_version_with_user
+AS
+SELECT
+	template_versions.*,
+	coalesce(visible_users.avatar_url, '') AS created_by_avatar_url,
+	coalesce(visible_users.username, '') AS created_by_username
+FROM
+	template_versions
+	LEFT JOIN
+		visible_users
+	ON
+		template_versions.created_by = visible_users.id;
+
+COMMENT ON VIEW template_version_with_user IS 'Joins in the username + avatar url of the created by user.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000158_external_auth.up.sql b/coderd/database/migrations/000158_external_auth.up.sql
new file mode 100644
index 0000000000000..52fc1977e376c
--- /dev/null
+++ b/coderd/database/migrations/000158_external_auth.up.sql
@@ -0,0 +1,27 @@
+BEGIN;
+
+ALTER TABLE template_versions RENAME COLUMN git_auth_providers TO external_auth_providers;
+
+ALTER TABLE git_auth_links RENAME TO external_auth_links;
+
+DROP VIEW template_version_with_user;
+-- If you need to update this view, put 'DROP VIEW template_version_with_user;' before this.
+CREATE VIEW
+	template_version_with_user
+AS
+SELECT
+	template_versions.*,
+	coalesce(visible_users.avatar_url, '') AS created_by_avatar_url,
+	coalesce(visible_users.username, '') AS created_by_username
+FROM
+	template_versions
+	LEFT JOIN
+		visible_users
+	ON
+		template_versions.created_by = visible_users.id;
+
+COMMENT ON VIEW template_version_with_user IS 'Joins in the username + avatar url of the created by user.';
+
+COMMENT ON COLUMN template_versions.external_auth_providers IS 'IDs of External auth providers for a specific template version';
+
+COMMIT;
diff --git a/coderd/database/migrations/000159_workspace_agent_stats_template_id_created_at_user_id_idx.down.sql b/coderd/database/migrations/000159_workspace_agent_stats_template_id_created_at_user_id_idx.down.sql
new file mode 100644
index 0000000000000..979ca567dbcf9
--- /dev/null
+++ b/coderd/database/migrations/000159_workspace_agent_stats_template_id_created_at_user_id_idx.down.sql
@@ -0,0 +1 @@
+DROP INDEX workspace_agent_stats_template_id_created_at_user_id_idx;
diff --git a/coderd/database/migrations/000159_workspace_agent_stats_template_id_created_at_user_id_idx.up.sql b/coderd/database/migrations/000159_workspace_agent_stats_template_id_created_at_user_id_idx.up.sql
new file mode 100644
index 0000000000000..9c7060768f5b2
--- /dev/null
+++ b/coderd/database/migrations/000159_workspace_agent_stats_template_id_created_at_user_id_idx.up.sql
@@ -0,0 +1,3 @@
+CREATE INDEX workspace_agent_stats_template_id_created_at_user_id_idx ON workspace_agent_stats USING btree (template_id, created_at DESC, user_id) WHERE connection_count > 0;
+
+COMMENT ON INDEX workspace_agent_stats_template_id_created_at_user_id_idx IS 'Support index for template insights endpoint to build interval reports faster.';
diff --git a/coderd/database/migrations/000160_provisioner_job_status.down.sql b/coderd/database/migrations/000160_provisioner_job_status.down.sql
new file mode 100644
index 0000000000000..3f04c8dd11dfc
--- /dev/null
+++ b/coderd/database/migrations/000160_provisioner_job_status.down.sql
@@ -0,0 +1,6 @@
+BEGIN;
+
+ALTER TABLE provisioner_jobs DROP COLUMN job_status;
+DROP TYPE provisioner_job_status;
+
+COMMIT;
diff --git a/coderd/database/migrations/000160_provisioner_job_status.up.sql b/coderd/database/migrations/000160_provisioner_job_status.up.sql
new file mode 100644
index 0000000000000..9cfea7fbfb140
--- /dev/null
+++ b/coderd/database/migrations/000160_provisioner_job_status.up.sql
@@ -0,0 +1,38 @@
+BEGIN;
+
+CREATE TYPE provisioner_job_status AS ENUM ('pending', 'running', 'succeeded', 'canceling', 'canceled', 'failed', 'unknown');
+COMMENT ON TYPE provisioner_job_status IS 'Computed status of a provisioner job. Jobs could be stuck in a hung state, these states do not guarantee any transition to another state.';
+
+ALTER TABLE provisioner_jobs ADD COLUMN
+    job_status provisioner_job_status NOT NULL GENERATED ALWAYS AS (
+        CASE
+            -- Completed means it is not in an "-ing" state
+            WHEN completed_at IS NOT NULL THEN
+                CASE
+                    -- The order of these checks are important.
+                    -- Check the error first, then cancelled, then completed.
+                    WHEN error != '' THEN 'failed'::provisioner_job_status
+                    WHEN canceled_at IS NOT NULL THEN 'canceled'::provisioner_job_status
+                    ELSE 'succeeded'::provisioner_job_status
+                END
+            -- Not completed means it is in some "-ing" state
+            ELSE
+                CASE
+                    -- This should never happen because all errors set
+                    -- should also set a completed_at timestamp.
+                    -- But if there is an error, we should always return
+                    -- a failed state.
+                    WHEN error != '' THEN 'failed'::provisioner_job_status
+                    WHEN canceled_at IS NOT NULL THEN 'canceling'::provisioner_job_status
+                    -- Not done and not started means it is pending
+                    WHEN started_at IS NULL THEN 'pending'::provisioner_job_status
+                    ELSE 'running'::provisioner_job_status
+                END
+        END
+        -- Stored so we do not have to recompute it every time.
+        ) STORED;
+
+
+COMMENT ON COLUMN provisioner_jobs.job_status IS 'Computed column to track the status of the job.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000161_workspace_agent_stats_template_id_created_at_user_id_include_sessions.down.sql b/coderd/database/migrations/000161_workspace_agent_stats_template_id_created_at_user_id_include_sessions.down.sql
new file mode 100644
index 0000000000000..98299311d6f70
--- /dev/null
+++ b/coderd/database/migrations/000161_workspace_agent_stats_template_id_created_at_user_id_include_sessions.down.sql
@@ -0,0 +1,5 @@
+DROP INDEX workspace_agent_stats_template_id_created_at_user_id_idx;
+
+CREATE INDEX workspace_agent_stats_template_id_created_at_user_id_idx ON workspace_agent_stats USING btree (template_id, created_at DESC, user_id) WHERE connection_count > 0;
+
+COMMENT ON INDEX workspace_agent_stats_template_id_created_at_user_id_idx IS 'Support index for template insights endpoint to build interval reports faster.';
diff --git a/coderd/database/migrations/000161_workspace_agent_stats_template_id_created_at_user_id_include_sessions.up.sql b/coderd/database/migrations/000161_workspace_agent_stats_template_id_created_at_user_id_include_sessions.up.sql
new file mode 100644
index 0000000000000..5f20d7db01624
--- /dev/null
+++ b/coderd/database/migrations/000161_workspace_agent_stats_template_id_created_at_user_id_include_sessions.up.sql
@@ -0,0 +1,5 @@
+DROP INDEX workspace_agent_stats_template_id_created_at_user_id_idx;
+
+CREATE INDEX workspace_agent_stats_template_id_created_at_user_id_idx ON workspace_agent_stats (template_id, created_at, user_id) INCLUDE (session_count_vscode, session_count_jetbrains, session_count_reconnecting_pty, session_count_ssh, connection_median_latency_ms) WHERE connection_count > 0;
+
+COMMENT ON INDEX workspace_agent_stats_template_id_created_at_user_id_idx IS 'Support index for template insights endpoint to build interval reports faster.';
diff --git a/coderd/database/migrations/000162_workspace_automatic_updates.down.sql b/coderd/database/migrations/000162_workspace_automatic_updates.down.sql
new file mode 100644
index 0000000000000..d2f050b4afb75
--- /dev/null
+++ b/coderd/database/migrations/000162_workspace_automatic_updates.down.sql
@@ -0,0 +1,4 @@
+BEGIN;
+ALTER TABLE workspaces DROP COLUMN IF EXISTS automatic_updates;
+DROP TYPE IF EXISTS automatic_updates;
+COMMIT;
diff --git a/coderd/database/migrations/000162_workspace_automatic_updates.up.sql b/coderd/database/migrations/000162_workspace_automatic_updates.up.sql
new file mode 100644
index 0000000000000..b034437007b54
--- /dev/null
+++ b/coderd/database/migrations/000162_workspace_automatic_updates.up.sql
@@ -0,0 +1,8 @@
+BEGIN;
+-- making this an enum in case we want to later add other options, like 'if_compatible_vars'
+CREATE TYPE automatic_updates AS ENUM (
+    'always',
+    'never'
+);
+ALTER TABLE workspaces ADD COLUMN IF NOT EXISTS automatic_updates automatic_updates NOT NULL DEFAULT 'never'::automatic_updates;
+COMMIT;
diff --git a/coderd/database/migrations/000163_external_auth_extra.down.sql b/coderd/database/migrations/000163_external_auth_extra.down.sql
new file mode 100644
index 0000000000000..b926f31d81254
--- /dev/null
+++ b/coderd/database/migrations/000163_external_auth_extra.down.sql
@@ -0,0 +1 @@
+ALTER TABLE external_auth_links DROP COLUMN "oauth_extra";
diff --git a/coderd/database/migrations/000163_external_auth_extra.up.sql b/coderd/database/migrations/000163_external_auth_extra.up.sql
new file mode 100644
index 0000000000000..7c8d9ec6ae163
--- /dev/null
+++ b/coderd/database/migrations/000163_external_auth_extra.up.sql
@@ -0,0 +1 @@
+ALTER TABLE external_auth_links ADD COLUMN "oauth_extra" jsonb;
diff --git a/coderd/database/migrations/000164_archive_template_versions.down.sql b/coderd/database/migrations/000164_archive_template_versions.down.sql
new file mode 100644
index 0000000000000..2c89f985aa225
--- /dev/null
+++ b/coderd/database/migrations/000164_archive_template_versions.down.sql
@@ -0,0 +1,26 @@
+BEGIN;
+
+-- The view will be rebuilt with the new column
+DROP VIEW template_version_with_user;
+
+ALTER TABLE template_versions
+	DROP COLUMN archived;
+
+-- Restore the old version of the template_version_with_user view.
+CREATE VIEW
+	template_version_with_user
+AS
+SELECT
+	template_versions.*,
+	coalesce(visible_users.avatar_url, '') AS created_by_avatar_url,
+	coalesce(visible_users.username, '') AS created_by_username
+FROM
+	template_versions
+		LEFT JOIN
+	visible_users
+	ON
+			template_versions.created_by = visible_users.id;
+
+COMMENT ON VIEW template_version_with_user IS 'Joins in the username + avatar url of the created by user.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000164_archive_template_versions.up.sql b/coderd/database/migrations/000164_archive_template_versions.up.sql
new file mode 100644
index 0000000000000..d18d4cdfe47e4
--- /dev/null
+++ b/coderd/database/migrations/000164_archive_template_versions.up.sql
@@ -0,0 +1,27 @@
+BEGIN;
+
+-- The view will be rebuilt with the new column
+DROP VIEW template_version_with_user;
+
+-- Archived template versions are not visible or usable by default.
+ALTER TABLE template_versions
+	ADD COLUMN archived BOOLEAN NOT NULL DEFAULT FALSE;
+
+-- Restore the old version of the template_version_with_user view.
+CREATE VIEW
+	template_version_with_user
+AS
+SELECT
+	template_versions.*,
+	coalesce(visible_users.avatar_url, '') AS created_by_avatar_url,
+	coalesce(visible_users.username, '') AS created_by_username
+FROM
+	template_versions
+		LEFT JOIN
+	visible_users
+	ON
+			template_versions.created_by = visible_users.id;
+
+COMMENT ON VIEW template_version_with_user IS 'Joins in the username + avatar url of the created by user.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000165_prevent_autostart_days.down.sql b/coderd/database/migrations/000165_prevent_autostart_days.down.sql
new file mode 100644
index 0000000000000..c4f3351eeafa2
--- /dev/null
+++ b/coderd/database/migrations/000165_prevent_autostart_days.down.sql
@@ -0,0 +1,25 @@
+BEGIN;
+
+DROP VIEW template_with_users;
+
+ALTER TABLE templates
+	DROP COLUMN autostart_block_days_of_week;
+
+-- Recreate view
+CREATE VIEW
+	template_with_users
+AS
+SELECT
+	templates.*,
+	coalesce(visible_users.avatar_url, '') AS created_by_avatar_url,
+	coalesce(visible_users.username, '') AS created_by_username
+FROM
+	templates
+		LEFT JOIN
+	visible_users
+	ON
+			templates.created_by = visible_users.id;
+
+COMMENT ON VIEW template_with_users IS 'Joins in the username + avatar url of the created by user.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000165_prevent_autostart_days.up.sql b/coderd/database/migrations/000165_prevent_autostart_days.up.sql
new file mode 100644
index 0000000000000..79c2c2a5e5c22
--- /dev/null
+++ b/coderd/database/migrations/000165_prevent_autostart_days.up.sql
@@ -0,0 +1,27 @@
+BEGIN;
+
+DROP VIEW template_with_users;
+
+ALTER TABLE templates
+	ADD COLUMN autostart_block_days_of_week smallint NOT NULL DEFAULT 0;
+
+COMMENT ON COLUMN templates.autostart_block_days_of_week IS 'A bitmap of days of week that autostart of a workspace is not allowed. Default allows all days. This is intended as a cost savings measure to prevent auto start on weekends (for example).';
+
+-- Recreate view
+CREATE VIEW
+	template_with_users
+AS
+SELECT
+	templates.*,
+	coalesce(visible_users.avatar_url, '') AS created_by_avatar_url,
+	coalesce(visible_users.username, '') AS created_by_username
+FROM
+	templates
+		LEFT JOIN
+	visible_users
+	ON
+			templates.created_by = visible_users.id;
+
+COMMENT ON VIEW template_with_users IS 'Joins in the username + avatar url of the created by user.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000166_template_active_version.down.sql b/coderd/database/migrations/000166_template_active_version.down.sql
new file mode 100644
index 0000000000000..d3b4bba305e02
--- /dev/null
+++ b/coderd/database/migrations/000166_template_active_version.down.sql
@@ -0,0 +1,25 @@
+BEGIN;
+
+-- Update the template_with_users view;
+DROP VIEW template_with_users;
+
+ALTER TABLE templates DROP COLUMN require_active_version;
+
+-- If you need to update this view, put 'DROP VIEW template_with_users;' before this.
+CREATE VIEW
+    template_with_users
+AS
+    SELECT
+        templates.*,
+		coalesce(visible_users.avatar_url, '') AS created_by_avatar_url,
+		coalesce(visible_users.username, '') AS created_by_username
+    FROM
+        templates
+    LEFT JOIN
+		visible_users
+	ON
+	    templates.created_by = visible_users.id;
+
+COMMENT ON VIEW template_with_users IS 'Joins in the username + avatar url of the created by user.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000166_template_active_version.up.sql b/coderd/database/migrations/000166_template_active_version.up.sql
new file mode 100644
index 0000000000000..a9255505eede7
--- /dev/null
+++ b/coderd/database/migrations/000166_template_active_version.up.sql
@@ -0,0 +1,23 @@
+BEGIN;
+
+DROP VIEW template_with_users;
+
+ALTER TABLE templates ADD COLUMN require_active_version boolean NOT NULL DEFAULT 'f';
+
+CREATE VIEW
+    template_with_users
+AS
+    SELECT
+        templates.*,
+		coalesce(visible_users.avatar_url, '') AS created_by_avatar_url,
+		coalesce(visible_users.username, '') AS created_by_username
+    FROM
+        templates
+    LEFT JOIN
+		visible_users
+	ON
+	    templates.created_by = visible_users.id;
+
+COMMENT ON VIEW template_with_users IS 'Joins in the username + avatar url of the created by user.';
+
+COMMIT;
diff --git a/coderd/database/migrations/000167_workspace_agent_api_version.down.sql b/coderd/database/migrations/000167_workspace_agent_api_version.down.sql
new file mode 100644
index 0000000000000..53c2b3417a983
--- /dev/null
+++ b/coderd/database/migrations/000167_workspace_agent_api_version.down.sql
@@ -0,0 +1,3 @@
+BEGIN;
+ALTER TABLE workspace_agents DROP COLUMN api_version;
+COMMIT;
diff --git a/coderd/database/migrations/000167_workspace_agent_api_version.up.sql b/coderd/database/migrations/000167_workspace_agent_api_version.up.sql
new file mode 100644
index 0000000000000..b4187e51efa93
--- /dev/null
+++ b/coderd/database/migrations/000167_workspace_agent_api_version.up.sql
@@ -0,0 +1,3 @@
+BEGIN;
+ALTER TABLE workspace_agents ADD COLUMN api_version TEXT DEFAULT '' NOT NULL;
+COMMIT;
diff --git a/coderd/database/migrations/migrate_test.go b/coderd/database/migrations/migrate_test.go
index 5726b65609ac2..c475c1fa5f026 100644
--- a/coderd/database/migrations/migrate_test.go
+++ b/coderd/database/migrations/migrate_test.go
@@ -22,9 +22,9 @@ import (
 	"golang.org/x/exp/slices"
 	"golang.org/x/sync/errgroup"
 
-	"github.com/coder/coder/coderd/database/migrations"
-	"github.com/coder/coder/coderd/database/postgres"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database/migrations"
+	"github.com/coder/coder/v2/coderd/database/postgres"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
@@ -259,13 +259,14 @@ func TestMigrateUpWithFixtures(t *testing.T) {
 	// but we should eventually add fixtures for them.
 	ignoredTablesForStats := []string{
 		"audit_logs",
-		"git_auth_links",
+		"external_auth_links",
 		"group_members",
 		"licenses",
 		"replicas",
 		"template_version_parameters",
 		"workspace_build_parameters",
 		"template_version_variables",
+		"dbcrypt_keys", // having zero rows is a valid state for this table
 	}
 	s := &tableStats{s: make(map[string]int)}
 
diff --git a/coderd/database/migrations/testdata/fixtures/000130_ha_coordinator.up.sql b/coderd/database/migrations/testdata/fixtures/000130_ha_coordinator.up.sql
index 8af4fa4827997..dbebd6d5dd384 100644
--- a/coderd/database/migrations/testdata/fixtures/000130_ha_coordinator.up.sql
+++ b/coderd/database/migrations/testdata/fixtures/000130_ha_coordinator.up.sql
@@ -18,7 +18,7 @@ VALUES
 	);
 
 INSERT INTO tailnet_agents
-(id, coordinator_id, updated_at, node)
+	(id, coordinator_id, updated_at, node)
 VALUES
 	(
 		'c0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11',
diff --git a/coderd/database/migrations/testdata/fixtures/000150_workspace_app_usage_stats.up.sql b/coderd/database/migrations/testdata/fixtures/000150_workspace_app_usage_stats.up.sql
new file mode 100644
index 0000000000000..9a9a8f0fa72dc
--- /dev/null
+++ b/coderd/database/migrations/testdata/fixtures/000150_workspace_app_usage_stats.up.sql
@@ -0,0 +1,133 @@
+INSERT INTO public.workspace_app_stats (
+	id,
+	user_id,
+	workspace_id,
+	agent_id,
+	access_method,
+	slug_or_port,
+	session_id,
+	session_started_at,
+	session_ended_at,
+	requests
+)
+VALUES
+	(
+		1498,
+		'30095c71-380b-457a-8995-97b8ee6e5307',
+		'3a9a1feb-e89d-457c-9d53-ac751b198ebe',
+		'7a1ce5f8-8d00-431c-ad1b-97a846512804',
+		'path',
+		'code-server',
+		'562cbfb8-3d9a-4018-9c04-e8159d5aa43e',
+		'2023-08-14 20:15:00+00',
+		'2023-08-14 20:16:00+00',
+		1
+	),
+	(
+		59,
+		'30095c71-380b-457a-8995-97b8ee6e5307',
+		'3a9a1feb-e89d-457c-9d53-ac751b198ebe',
+		'7a1ce5f8-8d00-431c-ad1b-97a846512804',
+		'terminal',
+		'',
+		'281919d0-5d99-48fb-8a93-2c3019010387',
+		'2023-08-14 14:15:40.085827+00',
+		'2023-08-14 14:17:41.295989+00',
+		1
+	),
+	(
+		58,
+		'30095c71-380b-457a-8995-97b8ee6e5307',
+		'3a9a1feb-e89d-457c-9d53-ac751b198ebe',
+		'7a1ce5f8-8d00-431c-ad1b-97a846512804',
+		'path',
+		'code-server',
+		'5b7c9d43-19e6-4401-997b-c26de2c86c55',
+		'2023-08-14 14:15:34.620496+00',
+		'2023-08-14 23:58:37.158964+00',
+		1
+	),
+	(
+		57,
+		'30095c71-380b-457a-8995-97b8ee6e5307',
+		'3a9a1feb-e89d-457c-9d53-ac751b198ebe',
+		'7a1ce5f8-8d00-431c-ad1b-97a846512804',
+		'path',
+		'code-server',
+		'fe546a68-0921-4a2b-bced-5dc5c5635576',
+		'2023-08-14 14:15:34.129002+00',
+		'2023-08-14 23:58:37.158901+00',
+		1
+	),
+	(
+		56,
+		'30095c71-380b-457a-8995-97b8ee6e5307',
+		'3a9a1feb-e89d-457c-9d53-ac751b198ebe',
+		'7a1ce5f8-8d00-431c-ad1b-97a846512804',
+		'path',
+		'code-server',
+		'96e4e857-598c-4881-bc40-e13008b48bb0',
+		'2023-08-14 14:15:00+00',
+		'2023-08-14 14:16:00+00',
+		36
+	),
+	(
+		7,
+		'30095c71-380b-457a-8995-97b8ee6e5307',
+		'3a9a1feb-e89d-457c-9d53-ac751b198ebe',
+		'7a1ce5f8-8d00-431c-ad1b-97a846512804',
+		'terminal',
+		'',
+		'95d22d41-0fde-447b-9743-0b8583edb60a',
+		'2023-08-14 13:00:28.732837+00',
+		'2023-08-14 13:09:23.990797+00',
+		1
+	),
+	(
+		4,
+		'30095c71-380b-457a-8995-97b8ee6e5307',
+		'3a9a1feb-e89d-457c-9d53-ac751b198ebe',
+		'7a1ce5f8-8d00-431c-ad1b-97a846512804',
+		'path',
+		'code-server',
+		'442688ce-f9e7-46df-ba3d-623ef9a1d30d',
+		'2023-08-14 13:00:12.843977+00',
+		'2023-08-14 13:09:26.276696+00',
+		1
+	),
+	(
+		3,
+		'30095c71-380b-457a-8995-97b8ee6e5307',
+		'3a9a1feb-e89d-457c-9d53-ac751b198ebe',
+		'7a1ce5f8-8d00-431c-ad1b-97a846512804',
+		'path',
+		'code-server',
+		'f963c4f0-55b7-4813-8b61-ea58536754db',
+		'2023-08-14 13:00:12.323196+00',
+		'2023-08-14 13:09:26.277073+00',
+		1
+	),
+	(
+		2,
+		'30095c71-380b-457a-8995-97b8ee6e5307',
+		'3a9a1feb-e89d-457c-9d53-ac751b198ebe',
+		'7a1ce5f8-8d00-431c-ad1b-97a846512804',
+		'terminal',
+		'',
+		'5a034459-73e4-4642-91b8-80b0f718f29e',
+		'2023-08-14 13:00:00+00',
+		'2023-08-14 13:01:00+00',
+		4
+	),
+	(
+		1,
+		'30095c71-380b-457a-8995-97b8ee6e5307',
+		'3a9a1feb-e89d-457c-9d53-ac751b198ebe',
+		'7a1ce5f8-8d00-431c-ad1b-97a846512804',
+		'path',
+		'code-server',
+		'd7a0d8e1-069e-421d-b876-b5d0ddbcaf6d',
+		'2023-08-14 13:00:00+00',
+		'2023-08-14 13:01:00+00',
+		36
+	);
diff --git a/coderd/database/migrations/testdata/fixtures/000156_pg_coordinator_single_tailnet.up.sql b/coderd/database/migrations/testdata/fixtures/000156_pg_coordinator_single_tailnet.up.sql
new file mode 100644
index 0000000000000..b5b744d6d1dc8
--- /dev/null
+++ b/coderd/database/migrations/testdata/fixtures/000156_pg_coordinator_single_tailnet.up.sql
@@ -0,0 +1,9 @@
+INSERT INTO tailnet_client_subscriptions
+	(client_id, agent_id, coordinator_id, updated_at)
+VALUES
+	(
+		'b0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11',
+		'c0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11',
+		'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11',
+		'2023-06-15 10:23:54+00'
+	);
diff --git a/coderd/database/migrations/testdata/fixtures/000157_workspace_agent_script.up.sql b/coderd/database/migrations/testdata/fixtures/000157_workspace_agent_script.up.sql
new file mode 100644
index 0000000000000..7523cd4714285
--- /dev/null
+++ b/coderd/database/migrations/testdata/fixtures/000157_workspace_agent_script.up.sql
@@ -0,0 +1,39 @@
+-- INSERT INTO workspace_agents VALUES ('45e89705-e09d-4850-bcec-f9a937f5d78d', '2022-11-02 13:03:45.046432+02', '2022-11-02 13:03:45.046432+02', 'main', NULL, NULL, NULL, '0ff953c0-92a6-4fe6-a415-eb0139a36ad1', 'ffc107ef-7ded-4d80-b1a9-0c1d0bf7ccbf', NULL, 'amd64', '{"GIT_AUTHOR_NAME": "default", "GIT_AUTHOR_EMAIL": "", "GIT_COMMITTER_NAME": "default", "GIT_COMMITTER_EMAIL": ""}', 'linux', 'code-server --auth none', NULL, NULL, '', '') ON CONFLICT DO NOTHING;
+
+INSERT INTO workspace_agent_log_sources (
+	workspace_agent_id,
+	id,
+	created_at,
+	display_name,
+	icon
+) VALUES (
+	'45e89705-e09d-4850-bcec-f9a937f5d78d',
+	'0ff953c0-92a6-4fe6-a415-eb0139a36ad1',
+	'2022-11-02 13:03:45.046432+02',
+	'main',
+	'something.png'
+) ON CONFLICT DO NOTHING;
+
+INSERT INTO workspace_agent_scripts (
+	workspace_agent_id,
+	created_at,
+	log_source_id,
+	log_path,
+	script,
+	cron,
+	start_blocks_login,
+	run_on_start,
+	run_on_stop,
+	timeout_seconds
+) VALUES (
+	'45e89705-e09d-4850-bcec-f9a937f5d78d',
+	'2022-11-02 13:03:45.046432+02',
+	'0ff953c0-92a6-4fe6-a415-eb0139a36ad1',
+	'/tmp',
+	'echo "hello world"',
+	'@daily',
+	TRUE,
+	TRUE,
+	TRUE,
+	60
+) ON CONFLICT DO NOTHING;
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
index 3daaec35da595..ed5bf76b784d7 100644
--- a/coderd/database/modelmethods.go
+++ b/coderd/database/modelmethods.go
@@ -7,7 +7,8 @@ import (
 
 	"golang.org/x/exp/maps"
 
-	"github.com/coder/coder/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/rbac"
 )
 
 type WorkspaceStatus string
@@ -84,7 +85,7 @@ func (g Group) Auditable(users []User) AuditableGroup {
 	}
 }
 
-const AllUsersGroup = "Everyone"
+const EveryoneGroup = "Everyone"
 
 func (s APIKeyScope) ToRBAC() rbac.ScopeName {
 	switch s {
@@ -123,6 +124,15 @@ func (t Template) DeepCopy() Template {
 	return cpy
 }
 
+// AutostartAllowedDays returns the inverse of 'AutostartBlockDaysOfWeek'.
+// It is more useful to have the days that are allowed to autostart from a UX
+// POV. The database prefers the 0 value being 'all days allowed'.
+func (t Template) AutostartAllowedDays() uint8 {
+	// Just flip the binary 0s to 1s and vice versa.
+	// There is an extra day with the 8th bit that needs to be zeroed.
+	return ^uint8(t.AutostartBlockDaysOfWeek) & 0b01111111
+}
+
 func (TemplateVersion) RBACObject(template Template) rbac.Object {
 	// Just use the parent template resource for controlling versions
 	return template.RBACObject()
@@ -146,8 +156,8 @@ func (w Workspace) RBACObject() rbac.Object {
 
 func (w Workspace) ExecutionRBAC() rbac.Object {
 	// If a workspace is locked it cannot be accessed.
-	if w.LockedAt.Valid {
-		return w.LockedRBAC()
+	if w.DormantAt.Valid {
+		return w.DormantRBAC()
 	}
 
 	return rbac.ResourceWorkspaceExecution.
@@ -158,8 +168,8 @@ func (w Workspace) ExecutionRBAC() rbac.Object {
 
 func (w Workspace) ApplicationConnectRBAC() rbac.Object {
 	// If a workspace is locked it cannot be accessed.
-	if w.LockedAt.Valid {
-		return w.LockedRBAC()
+	if w.DormantAt.Valid {
+		return w.DormantRBAC()
 	}
 
 	return rbac.ResourceWorkspaceApplicationConnect.
@@ -169,13 +179,13 @@ func (w Workspace) ApplicationConnectRBAC() rbac.Object {
 }
 
 func (w Workspace) WorkspaceBuildRBAC(transition WorkspaceTransition) rbac.Object {
-	// If a workspace is locked it cannot be built.
+	// If a workspace is dormant it cannot be built.
 	// However we need to allow stopping a workspace by a caller once a workspace
 	// is locked (e.g. for autobuild). Additionally, if a user wants to delete
 	// a locked workspace, they shouldn't have to have it unlocked first.
-	if w.LockedAt.Valid && transition != WorkspaceTransitionStop &&
+	if w.DormantAt.Valid && transition != WorkspaceTransitionStop &&
 		transition != WorkspaceTransitionDelete {
-		return w.LockedRBAC()
+		return w.DormantRBAC()
 	}
 
 	return rbac.ResourceWorkspaceBuild.
@@ -184,8 +194,8 @@ func (w Workspace) WorkspaceBuildRBAC(transition WorkspaceTransition) rbac.Objec
 		WithOwner(w.OwnerID.String())
 }
 
-func (w Workspace) LockedRBAC() rbac.Object {
-	return rbac.ResourceWorkspaceLocked.
+func (w Workspace) DormantRBAC() rbac.Object {
+	return rbac.ResourceWorkspaceDormant.
 		WithID(w.ID).
 		InOrg(w.OrganizationID).
 		WithOwner(w.OwnerID.String())
@@ -249,7 +259,7 @@ func (u GitSSHKey) RBACObject() rbac.Object {
 	return rbac.ResourceUserData.WithID(u.UserID).WithOwner(u.UserID.String())
 }
 
-func (u GitAuthLink) RBACObject() rbac.Object {
+func (u ExternalAuthLink) RBACObject() rbac.Object {
 	// I assume UserData is ok?
 	return rbac.ResourceUserData.WithID(u.UserID).WithOwner(u.UserID.String())
 }
@@ -289,7 +299,7 @@ func (a WorkspaceAgent) Status(inactiveTimeout time.Duration) WorkspaceAgentConn
 	switch {
 	case !a.FirstConnectedAt.Valid:
 		switch {
-		case connectionTimeout > 0 && Now().Sub(a.CreatedAt) > connectionTimeout:
+		case connectionTimeout > 0 && dbtime.Now().Sub(a.CreatedAt) > connectionTimeout:
 			// If the agent took too long to connect the first time,
 			// mark it as timed out.
 			status.Status = WorkspaceAgentStatusTimeout
@@ -304,7 +314,7 @@ func (a WorkspaceAgent) Status(inactiveTimeout time.Duration) WorkspaceAgentConn
 		// If we've disconnected after our last connection, we know the
 		// agent is no longer connected.
 		status.Status = WorkspaceAgentStatusDisconnected
-	case Now().Sub(a.LastConnectedAt.Time) > inactiveTimeout:
+	case dbtime.Now().Sub(a.LastConnectedAt.Time) > inactiveTimeout:
 		// The connection died without updating the last connected.
 		status.Status = WorkspaceAgentStatusDisconnected
 		// Client code needs an accurate disconnected at if the agent has been inactive.
@@ -355,10 +365,31 @@ func ConvertWorkspaceRows(rows []GetWorkspacesRow) []Workspace {
 			AutostartSchedule: r.AutostartSchedule,
 			Ttl:               r.Ttl,
 			LastUsedAt:        r.LastUsedAt,
-			LockedAt:          r.LockedAt,
+			DormantAt:         r.DormantAt,
 			DeletingAt:        r.DeletingAt,
+			AutomaticUpdates:  r.AutomaticUpdates,
 		}
 	}
 
 	return workspaces
 }
+
+func (g Group) IsEveryone() bool {
+	return g.ID == g.OrganizationID
+}
+
+func (p ProvisionerJob) Finished() bool {
+	return p.CanceledAt.Valid || p.CompletedAt.Valid
+}
+
+func (p ProvisionerJob) FinishedAt() time.Time {
+	if p.CompletedAt.Valid {
+		return p.CompletedAt.Time
+	}
+
+	if p.CanceledAt.Valid {
+		return p.CanceledAt.Time
+	}
+
+	return time.Time{}
+}
diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go
index ffa346d04998c..5c78600237e1d 100644
--- a/coderd/database/modelqueries.go
+++ b/coderd/database/modelqueries.go
@@ -9,8 +9,8 @@ import (
 	"github.com/lib/pq"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/rbac/regosql"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac/regosql"
 )
 
 const (
@@ -81,10 +81,12 @@ func (q *sqlQuerier) GetAuthorizedTemplates(ctx context.Context, arg GetTemplate
 			&i.AllowUserAutostart,
 			&i.AllowUserAutostop,
 			&i.FailureTTL,
-			&i.InactivityTTL,
-			&i.LockedTTL,
-			&i.RestartRequirementDaysOfWeek,
-			&i.RestartRequirementWeeks,
+			&i.TimeTilDormant,
+			&i.TimeTilDormantAutoDelete,
+			&i.AutostopRequirementDaysOfWeek,
+			&i.AutostopRequirementWeeks,
+			&i.AutostartBlockDaysOfWeek,
+			&i.RequireActiveVersion,
 			&i.CreatedByAvatarURL,
 			&i.CreatedByUsername,
 		); err != nil {
@@ -217,11 +219,14 @@ func (q *sqlQuerier) GetAuthorizedWorkspaces(ctx context.Context, arg GetWorkspa
 		arg.Name,
 		arg.HasAgent,
 		arg.AgentInactiveDisconnectTimeoutSeconds,
+		arg.IsDormant,
+		arg.LastUsedBefore,
+		arg.LastUsedAfter,
 		arg.Offset,
 		arg.Limit,
 	)
 	if err != nil {
-		return nil, xerrors.Errorf("get authorized workspaces: %w", err)
+		return nil, err
 	}
 	defer rows.Close()
 	var items []GetWorkspacesRow
@@ -239,8 +244,9 @@ func (q *sqlQuerier) GetAuthorizedWorkspaces(ctx context.Context, arg GetWorkspa
 			&i.AutostartSchedule,
 			&i.Ttl,
 			&i.LastUsedAt,
-			&i.LockedAt,
+			&i.DormantAt,
 			&i.DeletingAt,
+			&i.AutomaticUpdates,
 			&i.TemplateName,
 			&i.TemplateVersionID,
 			&i.TemplateVersionName,
diff --git a/coderd/database/models.go b/coderd/database/models.go
index 4e34989b09ae9..4d5a0193ccc7c 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -1,6 +1,6 @@
 // Code generated by sqlc. DO NOT EDIT.
 // versions:
-//   sqlc v1.19.1
+//   sqlc v1.20.0
 
 package database
 
@@ -211,6 +211,64 @@ func AllAuditActionValues() []AuditAction {
 	}
 }
 
+type AutomaticUpdates string
+
+const (
+	AutomaticUpdatesAlways AutomaticUpdates = "always"
+	AutomaticUpdatesNever  AutomaticUpdates = "never"
+)
+
+func (e *AutomaticUpdates) Scan(src interface{}) error {
+	switch s := src.(type) {
+	case []byte:
+		*e = AutomaticUpdates(s)
+	case string:
+		*e = AutomaticUpdates(s)
+	default:
+		return fmt.Errorf("unsupported scan type for AutomaticUpdates: %T", src)
+	}
+	return nil
+}
+
+type NullAutomaticUpdates struct {
+	AutomaticUpdates AutomaticUpdates `json:"automatic_updates"`
+	Valid            bool             `json:"valid"` // Valid is true if AutomaticUpdates is not NULL
+}
+
+// Scan implements the Scanner interface.
+func (ns *NullAutomaticUpdates) Scan(value interface{}) error {
+	if value == nil {
+		ns.AutomaticUpdates, ns.Valid = "", false
+		return nil
+	}
+	ns.Valid = true
+	return ns.AutomaticUpdates.Scan(value)
+}
+
+// Value implements the driver Valuer interface.
+func (ns NullAutomaticUpdates) Value() (driver.Value, error) {
+	if !ns.Valid {
+		return nil, nil
+	}
+	return string(ns.AutomaticUpdates), nil
+}
+
+func (e AutomaticUpdates) Valid() bool {
+	switch e {
+	case AutomaticUpdatesAlways,
+		AutomaticUpdatesNever:
+		return true
+	}
+	return false
+}
+
+func AllAutomaticUpdatesValues() []AutomaticUpdates {
+	return []AutomaticUpdates{
+		AutomaticUpdatesAlways,
+		AutomaticUpdatesNever,
+	}
+}
+
 type BuildReason string
 
 const (
@@ -281,6 +339,131 @@ func AllBuildReasonValues() []BuildReason {
 	}
 }
 
+type DisplayApp string
+
+const (
+	DisplayAppVscode               DisplayApp = "vscode"
+	DisplayAppVscodeInsiders       DisplayApp = "vscode_insiders"
+	DisplayAppWebTerminal          DisplayApp = "web_terminal"
+	DisplayAppSSHHelper            DisplayApp = "ssh_helper"
+	DisplayAppPortForwardingHelper DisplayApp = "port_forwarding_helper"
+)
+
+func (e *DisplayApp) Scan(src interface{}) error {
+	switch s := src.(type) {
+	case []byte:
+		*e = DisplayApp(s)
+	case string:
+		*e = DisplayApp(s)
+	default:
+		return fmt.Errorf("unsupported scan type for DisplayApp: %T", src)
+	}
+	return nil
+}
+
+type NullDisplayApp struct {
+	DisplayApp DisplayApp `json:"display_app"`
+	Valid      bool       `json:"valid"` // Valid is true if DisplayApp is not NULL
+}
+
+// Scan implements the Scanner interface.
+func (ns *NullDisplayApp) Scan(value interface{}) error {
+	if value == nil {
+		ns.DisplayApp, ns.Valid = "", false
+		return nil
+	}
+	ns.Valid = true
+	return ns.DisplayApp.Scan(value)
+}
+
+// Value implements the driver Valuer interface.
+func (ns NullDisplayApp) Value() (driver.Value, error) {
+	if !ns.Valid {
+		return nil, nil
+	}
+	return string(ns.DisplayApp), nil
+}
+
+func (e DisplayApp) Valid() bool {
+	switch e {
+	case DisplayAppVscode,
+		DisplayAppVscodeInsiders,
+		DisplayAppWebTerminal,
+		DisplayAppSSHHelper,
+		DisplayAppPortForwardingHelper:
+		return true
+	}
+	return false
+}
+
+func AllDisplayAppValues() []DisplayApp {
+	return []DisplayApp{
+		DisplayAppVscode,
+		DisplayAppVscodeInsiders,
+		DisplayAppWebTerminal,
+		DisplayAppSSHHelper,
+		DisplayAppPortForwardingHelper,
+	}
+}
+
+type GroupSource string
+
+const (
+	GroupSourceUser GroupSource = "user"
+	GroupSourceOidc GroupSource = "oidc"
+)
+
+func (e *GroupSource) Scan(src interface{}) error {
+	switch s := src.(type) {
+	case []byte:
+		*e = GroupSource(s)
+	case string:
+		*e = GroupSource(s)
+	default:
+		return fmt.Errorf("unsupported scan type for GroupSource: %T", src)
+	}
+	return nil
+}
+
+type NullGroupSource struct {
+	GroupSource GroupSource `json:"group_source"`
+	Valid       bool        `json:"valid"` // Valid is true if GroupSource is not NULL
+}
+
+// Scan implements the Scanner interface.
+func (ns *NullGroupSource) Scan(value interface{}) error {
+	if value == nil {
+		ns.GroupSource, ns.Valid = "", false
+		return nil
+	}
+	ns.Valid = true
+	return ns.GroupSource.Scan(value)
+}
+
+// Value implements the driver Valuer interface.
+func (ns NullGroupSource) Value() (driver.Value, error) {
+	if !ns.Valid {
+		return nil, nil
+	}
+	return string(ns.GroupSource), nil
+}
+
+func (e GroupSource) Valid() bool {
+	switch e {
+	case GroupSourceUser,
+		GroupSourceOidc:
+		return true
+	}
+	return false
+}
+
+func AllGroupSourceValues() []GroupSource {
+	return []GroupSource{
+		GroupSourceUser,
+		GroupSourceOidc,
+	}
+}
+
 type LogLevel string
 
 const (
@@ -712,6 +895,80 @@ func AllParameterTypeSystemValues() []ParameterTypeSystem {
 	}
 }
 
+// Computed status of a provisioner job. Jobs could be stuck in a hung state, these states do not guarantee any transition to another state.
+type ProvisionerJobStatus string
+
+const (
+	ProvisionerJobStatusPending   ProvisionerJobStatus = "pending"
+	ProvisionerJobStatusRunning   ProvisionerJobStatus = "running"
+	ProvisionerJobStatusSucceeded ProvisionerJobStatus = "succeeded"
+	ProvisionerJobStatusCanceling ProvisionerJobStatus = "canceling"
+	ProvisionerJobStatusCanceled  ProvisionerJobStatus = "canceled"
+	ProvisionerJobStatusFailed    ProvisionerJobStatus = "failed"
+	ProvisionerJobStatusUnknown   ProvisionerJobStatus = "unknown"
+)
+
+func (e *ProvisionerJobStatus) Scan(src interface{}) error {
+	switch s := src.(type) {
+	case []byte:
+		*e = ProvisionerJobStatus(s)
+	case string:
+		*e = ProvisionerJobStatus(s)
+	default:
+		return fmt.Errorf("unsupported scan type for ProvisionerJobStatus: %T", src)
+	}
+	return nil
+}
+
+type NullProvisionerJobStatus struct {
+	ProvisionerJobStatus ProvisionerJobStatus `json:"provisioner_job_status"`
+	Valid                bool                 `json:"valid"` // Valid is true if ProvisionerJobStatus is not NULL
+}
+
+// Scan implements the Scanner interface.
+func (ns *NullProvisionerJobStatus) Scan(value interface{}) error {
+	if value == nil {
+		ns.ProvisionerJobStatus, ns.Valid = "", false
+		return nil
+	}
+	ns.Valid = true
+	return ns.ProvisionerJobStatus.Scan(value)
+}
+
+// Value implements the driver Valuer interface.
+func (ns NullProvisionerJobStatus) Value() (driver.Value, error) {
+	if !ns.Valid {
+		return nil, nil
+	}
+	return string(ns.ProvisionerJobStatus), nil
+}
+
+func (e ProvisionerJobStatus) Valid() bool {
+	switch e {
+	case ProvisionerJobStatusPending,
+		ProvisionerJobStatusRunning,
+		ProvisionerJobStatusSucceeded,
+		ProvisionerJobStatusCanceling,
+		ProvisionerJobStatusCanceled,
+		ProvisionerJobStatusFailed,
+		ProvisionerJobStatusUnknown:
+		return true
+	}
+	return false
+}
+
+func AllProvisionerJobStatusValues() []ProvisionerJobStatus {
+	return []ProvisionerJobStatus{
+		ProvisionerJobStatusPending,
+		ProvisionerJobStatusRunning,
+		ProvisionerJobStatusSucceeded,
+		ProvisionerJobStatusCanceling,
+		ProvisionerJobStatusCanceled,
+		ProvisionerJobStatusFailed,
+		ProvisionerJobStatusUnknown,
+	}
+}
+
 type ProvisionerJobType string
 
 const (
@@ -1173,82 +1430,13 @@ func AllWorkspaceAgentLifecycleStateValues() []WorkspaceAgentLifecycleState {
 	}
 }
 
-type WorkspaceAgentLogSource string
-
-const (
-	WorkspaceAgentLogSourceStartupScript  WorkspaceAgentLogSource = "startup_script"
-	WorkspaceAgentLogSourceShutdownScript WorkspaceAgentLogSource = "shutdown_script"
-	WorkspaceAgentLogSourceKubernetesLogs WorkspaceAgentLogSource = "kubernetes_logs"
-	WorkspaceAgentLogSourceEnvbox         WorkspaceAgentLogSource = "envbox"
-	WorkspaceAgentLogSourceEnvbuilder     WorkspaceAgentLogSource = "envbuilder"
-	WorkspaceAgentLogSourceExternal       WorkspaceAgentLogSource = "external"
-)
-
-func (e *WorkspaceAgentLogSource) Scan(src interface{}) error {
-	switch s := src.(type) {
-	case []byte:
-		*e = WorkspaceAgentLogSource(s)
-	case string:
-		*e = WorkspaceAgentLogSource(s)
-	default:
-		return fmt.Errorf("unsupported scan type for WorkspaceAgentLogSource: %T", src)
-	}
-	return nil
-}
-
-type NullWorkspaceAgentLogSource struct {
-	WorkspaceAgentLogSource WorkspaceAgentLogSource `json:"workspace_agent_log_source"`
-	Valid                   bool                    `json:"valid"` // Valid is true if WorkspaceAgentLogSource is not NULL
-}
-
-// Scan implements the Scanner interface.
-func (ns *NullWorkspaceAgentLogSource) Scan(value interface{}) error {
-	if value == nil {
-		ns.WorkspaceAgentLogSource, ns.Valid = "", false
-		return nil
-	}
-	ns.Valid = true
-	return ns.WorkspaceAgentLogSource.Scan(value)
-}
-
-// Value implements the driver Valuer interface.
-func (ns NullWorkspaceAgentLogSource) Value() (driver.Value, error) {
-	if !ns.Valid {
-		return nil, nil
-	}
-	return string(ns.WorkspaceAgentLogSource), nil
-}
-
-func (e WorkspaceAgentLogSource) Valid() bool {
-	switch e {
-	case WorkspaceAgentLogSourceStartupScript,
-		WorkspaceAgentLogSourceShutdownScript,
-		WorkspaceAgentLogSourceKubernetesLogs,
-		WorkspaceAgentLogSourceEnvbox,
-		WorkspaceAgentLogSourceEnvbuilder,
-		WorkspaceAgentLogSourceExternal:
-		return true
-	}
-	return false
-}
-
-func AllWorkspaceAgentLogSourceValues() []WorkspaceAgentLogSource {
-	return []WorkspaceAgentLogSource{
-		WorkspaceAgentLogSourceStartupScript,
-		WorkspaceAgentLogSourceShutdownScript,
-		WorkspaceAgentLogSourceKubernetesLogs,
-		WorkspaceAgentLogSourceEnvbox,
-		WorkspaceAgentLogSourceEnvbuilder,
-		WorkspaceAgentLogSourceExternal,
-	}
-}
-
 type WorkspaceAgentSubsystem string
 
 const (
 	WorkspaceAgentSubsystemEnvbuilder WorkspaceAgentSubsystem = "envbuilder"
 	WorkspaceAgentSubsystemEnvbox     WorkspaceAgentSubsystem = "envbox"
 	WorkspaceAgentSubsystemNone       WorkspaceAgentSubsystem = "none"
+	WorkspaceAgentSubsystemExectrace  WorkspaceAgentSubsystem = "exectrace"
 )
 
 func (e *WorkspaceAgentSubsystem) Scan(src interface{}) error {
@@ -1290,7 +1478,8 @@ func (e WorkspaceAgentSubsystem) Valid() bool {
 	switch e {
 	case WorkspaceAgentSubsystemEnvbuilder,
 		WorkspaceAgentSubsystemEnvbox,
-		WorkspaceAgentSubsystemNone:
+		WorkspaceAgentSubsystemNone,
+		WorkspaceAgentSubsystemExectrace:
 		return true
 	}
 	return false
@@ -1301,6 +1490,7 @@ func AllWorkspaceAgentSubsystemValues() []WorkspaceAgentSubsystem {
 		WorkspaceAgentSubsystemEnvbuilder,
 		WorkspaceAgentSubsystemEnvbox,
 		WorkspaceAgentSubsystemNone,
+		WorkspaceAgentSubsystemExectrace,
 	}
 }
 
@@ -1463,16 +1653,23 @@ type AuditLog struct {
 	ResourceIcon     string          `db:"resource_icon" json:"resource_icon"`
 }
 
-type File struct {
-	Hash      string    `db:"hash" json:"hash"`
-	CreatedAt time.Time `db:"created_at" json:"created_at"`
-	CreatedBy uuid.UUID `db:"created_by" json:"created_by"`
-	Mimetype  string    `db:"mimetype" json:"mimetype"`
-	Data      []byte    `db:"data" json:"data"`
-	ID        uuid.UUID `db:"id" json:"id"`
+// A table used to store the keys used to encrypt the database.
+type DBCryptKey struct {
+	// An integer used to identify the key.
+	Number int32 `db:"number" json:"number"`
+	// If the key is active, the digest of the active key.
+	ActiveKeyDigest sql.NullString `db:"active_key_digest" json:"active_key_digest"`
+	// If the key has been revoked, the digest of the revoked key.
+	RevokedKeyDigest sql.NullString `db:"revoked_key_digest" json:"revoked_key_digest"`
+	// The time at which the key was created.
+	CreatedAt sql.NullTime `db:"created_at" json:"created_at"`
+	// The time at which the key was revoked.
+	RevokedAt sql.NullTime `db:"revoked_at" json:"revoked_at"`
+	// A column used to test the encryption.
+	Test string `db:"test" json:"test"`
 }
 
-type GitAuthLink struct {
+type ExternalAuthLink struct {
 	ProviderID        string    `db:"provider_id" json:"provider_id"`
 	UserID            uuid.UUID `db:"user_id" json:"user_id"`
 	CreatedAt         time.Time `db:"created_at" json:"created_at"`
@@ -1480,6 +1677,20 @@ type GitAuthLink struct {
 	OAuthAccessToken  string    `db:"oauth_access_token" json:"oauth_access_token"`
 	OAuthRefreshToken string    `db:"oauth_refresh_token" json:"oauth_refresh_token"`
 	OAuthExpiry       time.Time `db:"oauth_expiry" json:"oauth_expiry"`
+	// The ID of the key used to encrypt the OAuth access token. If this is NULL, the access token is not encrypted
+	OAuthAccessTokenKeyID sql.NullString `db:"oauth_access_token_key_id" json:"oauth_access_token_key_id"`
+	// The ID of the key used to encrypt the OAuth refresh token. If this is NULL, the refresh token is not encrypted
+	OAuthRefreshTokenKeyID sql.NullString        `db:"oauth_refresh_token_key_id" json:"oauth_refresh_token_key_id"`
+	OAuthExtra             pqtype.NullRawMessage `db:"oauth_extra" json:"oauth_extra"`
+}
+
+type File struct {
+	Hash      string    `db:"hash" json:"hash"`
+	CreatedAt time.Time `db:"created_at" json:"created_at"`
+	CreatedBy uuid.UUID `db:"created_by" json:"created_by"`
+	Mimetype  string    `db:"mimetype" json:"mimetype"`
+	Data      []byte    `db:"data" json:"data"`
+	ID        uuid.UUID `db:"id" json:"id"`
 }
 
 type GitSSHKey struct {
@@ -1498,6 +1709,8 @@ type Group struct {
 	QuotaAllowance int32     `db:"quota_allowance" json:"quota_allowance"`
 	// Display name is a custom, human-friendly group name that user can set. This is not required to be unique and can be the empty string.
 	DisplayName string `db:"display_name" json:"display_name"`
+	// Source indicates how the group was created. It can be created by a user manually, or through some system process like OIDC group sync.
+	Source GroupSource `db:"source" json:"source"`
 }
 
 type GroupMember struct {
@@ -1591,6 +1804,8 @@ type ProvisionerJob struct {
 	Tags           StringMap                `db:"tags" json:"tags"`
 	ErrorCode      sql.NullString           `db:"error_code" json:"error_code"`
 	TraceMetadata  pqtype.NullRawMessage    `db:"trace_metadata" json:"trace_metadata"`
+	// Computed column to track the status of the job.
+	JobStatus ProvisionerJobStatus `db:"job_status" json:"job_status"`
 }
 
 type ProvisionerJobLog struct {
@@ -1633,11 +1848,17 @@ type TailnetAgent struct {
 type TailnetClient struct {
 	ID            uuid.UUID       `db:"id" json:"id"`
 	CoordinatorID uuid.UUID       `db:"coordinator_id" json:"coordinator_id"`
-	AgentID       uuid.UUID       `db:"agent_id" json:"agent_id"`
 	UpdatedAt     time.Time       `db:"updated_at" json:"updated_at"`
 	Node          json.RawMessage `db:"node" json:"node"`
 }
 
+type TailnetClientSubscription struct {
+	ClientID      uuid.UUID `db:"client_id" json:"client_id"`
+	CoordinatorID uuid.UUID `db:"coordinator_id" json:"coordinator_id"`
+	AgentID       uuid.UUID `db:"agent_id" json:"agent_id"`
+	UpdatedAt     time.Time `db:"updated_at" json:"updated_at"`
+}
+
 // We keep this separate from replicas in case we need to break the coordinator out into its own service
 type TailnetCoordinator struct {
 	ID          uuid.UUID `db:"id" json:"id"`
@@ -1646,32 +1867,34 @@ type TailnetCoordinator struct {
 
 // Joins in the username + avatar url of the created by user.
 type Template struct {
-	ID                           uuid.UUID       `db:"id" json:"id"`
-	CreatedAt                    time.Time       `db:"created_at" json:"created_at"`
-	UpdatedAt                    time.Time       `db:"updated_at" json:"updated_at"`
-	OrganizationID               uuid.UUID       `db:"organization_id" json:"organization_id"`
-	Deleted                      bool            `db:"deleted" json:"deleted"`
-	Name                         string          `db:"name" json:"name"`
-	Provisioner                  ProvisionerType `db:"provisioner" json:"provisioner"`
-	ActiveVersionID              uuid.UUID       `db:"active_version_id" json:"active_version_id"`
-	Description                  string          `db:"description" json:"description"`
-	DefaultTTL                   int64           `db:"default_ttl" json:"default_ttl"`
-	CreatedBy                    uuid.UUID       `db:"created_by" json:"created_by"`
-	Icon                         string          `db:"icon" json:"icon"`
-	UserACL                      TemplateACL     `db:"user_acl" json:"user_acl"`
-	GroupACL                     TemplateACL     `db:"group_acl" json:"group_acl"`
-	DisplayName                  string          `db:"display_name" json:"display_name"`
-	AllowUserCancelWorkspaceJobs bool            `db:"allow_user_cancel_workspace_jobs" json:"allow_user_cancel_workspace_jobs"`
-	MaxTTL                       int64           `db:"max_ttl" json:"max_ttl"`
-	AllowUserAutostart           bool            `db:"allow_user_autostart" json:"allow_user_autostart"`
-	AllowUserAutostop            bool            `db:"allow_user_autostop" json:"allow_user_autostop"`
-	FailureTTL                   int64           `db:"failure_ttl" json:"failure_ttl"`
-	InactivityTTL                int64           `db:"inactivity_ttl" json:"inactivity_ttl"`
-	LockedTTL                    int64           `db:"locked_ttl" json:"locked_ttl"`
-	RestartRequirementDaysOfWeek int16           `db:"restart_requirement_days_of_week" json:"restart_requirement_days_of_week"`
-	RestartRequirementWeeks      int64           `db:"restart_requirement_weeks" json:"restart_requirement_weeks"`
-	CreatedByAvatarURL           sql.NullString  `db:"created_by_avatar_url" json:"created_by_avatar_url"`
-	CreatedByUsername            string          `db:"created_by_username" json:"created_by_username"`
+	ID                            uuid.UUID       `db:"id" json:"id"`
+	CreatedAt                     time.Time       `db:"created_at" json:"created_at"`
+	UpdatedAt                     time.Time       `db:"updated_at" json:"updated_at"`
+	OrganizationID                uuid.UUID       `db:"organization_id" json:"organization_id"`
+	Deleted                       bool            `db:"deleted" json:"deleted"`
+	Name                          string          `db:"name" json:"name"`
+	Provisioner                   ProvisionerType `db:"provisioner" json:"provisioner"`
+	ActiveVersionID               uuid.UUID       `db:"active_version_id" json:"active_version_id"`
+	Description                   string          `db:"description" json:"description"`
+	DefaultTTL                    int64           `db:"default_ttl" json:"default_ttl"`
+	CreatedBy                     uuid.UUID       `db:"created_by" json:"created_by"`
+	Icon                          string          `db:"icon" json:"icon"`
+	UserACL                       TemplateACL     `db:"user_acl" json:"user_acl"`
+	GroupACL                      TemplateACL     `db:"group_acl" json:"group_acl"`
+	DisplayName                   string          `db:"display_name" json:"display_name"`
+	AllowUserCancelWorkspaceJobs  bool            `db:"allow_user_cancel_workspace_jobs" json:"allow_user_cancel_workspace_jobs"`
+	MaxTTL                        int64           `db:"max_ttl" json:"max_ttl"`
+	AllowUserAutostart            bool            `db:"allow_user_autostart" json:"allow_user_autostart"`
+	AllowUserAutostop             bool            `db:"allow_user_autostop" json:"allow_user_autostop"`
+	FailureTTL                    int64           `db:"failure_ttl" json:"failure_ttl"`
+	TimeTilDormant                int64           `db:"time_til_dormant" json:"time_til_dormant"`
+	TimeTilDormantAutoDelete      int64           `db:"time_til_dormant_autodelete" json:"time_til_dormant_autodelete"`
+	AutostopRequirementDaysOfWeek int16           `db:"autostop_requirement_days_of_week" json:"autostop_requirement_days_of_week"`
+	AutostopRequirementWeeks      int64           `db:"autostop_requirement_weeks" json:"autostop_requirement_weeks"`
+	AutostartBlockDaysOfWeek      int16           `db:"autostart_block_days_of_week" json:"autostart_block_days_of_week"`
+	RequireActiveVersion          bool            `db:"require_active_version" json:"require_active_version"`
+	CreatedByAvatarURL            sql.NullString  `db:"created_by_avatar_url" json:"created_by_avatar_url"`
+	CreatedByUsername             string          `db:"created_by_username" json:"created_by_username"`
 }
 
 type TemplateTable struct {
@@ -1698,31 +1921,35 @@ type TemplateTable struct {
 	// Allow users to specify an autostart schedule for workspaces (enterprise).
 	AllowUserAutostart bool `db:"allow_user_autostart" json:"allow_user_autostart"`
 	// Allow users to specify custom autostop values for workspaces (enterprise).
-	AllowUserAutostop bool  `db:"allow_user_autostop" json:"allow_user_autostop"`
-	FailureTTL        int64 `db:"failure_ttl" json:"failure_ttl"`
-	InactivityTTL     int64 `db:"inactivity_ttl" json:"inactivity_ttl"`
-	LockedTTL         int64 `db:"locked_ttl" json:"locked_ttl"`
+	AllowUserAutostop        bool  `db:"allow_user_autostop" json:"allow_user_autostop"`
+	FailureTTL               int64 `db:"failure_ttl" json:"failure_ttl"`
+	TimeTilDormant           int64 `db:"time_til_dormant" json:"time_til_dormant"`
+	TimeTilDormantAutoDelete int64 `db:"time_til_dormant_autodelete" json:"time_til_dormant_autodelete"`
 	// A bitmap of days of week to restart the workspace on, starting with Monday as the 0th bit, and Sunday as the 6th bit. The 7th bit is unused.
-	RestartRequirementDaysOfWeek int16 `db:"restart_requirement_days_of_week" json:"restart_requirement_days_of_week"`
+	AutostopRequirementDaysOfWeek int16 `db:"autostop_requirement_days_of_week" json:"autostop_requirement_days_of_week"`
 	// The number of weeks between restarts. 0 or 1 weeks means "every week", 2 week means "every second week", etc. Weeks are counted from January 2, 2023, which is the first Monday of 2023. This is to ensure workspaces are started consistently for all customers on the same n-week cycles.
-	RestartRequirementWeeks int64 `db:"restart_requirement_weeks" json:"restart_requirement_weeks"`
+	AutostopRequirementWeeks int64 `db:"autostop_requirement_weeks" json:"autostop_requirement_weeks"`
+	// A bitmap of days of week that autostart of a workspace is not allowed. Default allows all days. This is intended as a cost savings measure to prevent auto start on weekends (for example).
+	AutostartBlockDaysOfWeek int16 `db:"autostart_block_days_of_week" json:"autostart_block_days_of_week"`
+	RequireActiveVersion     bool  `db:"require_active_version" json:"require_active_version"`
 }
 
 // Joins in the username + avatar url of the created by user.
 type TemplateVersion struct {
-	ID                 uuid.UUID      `db:"id" json:"id"`
-	TemplateID         uuid.NullUUID  `db:"template_id" json:"template_id"`
-	OrganizationID     uuid.UUID      `db:"organization_id" json:"organization_id"`
-	CreatedAt          time.Time      `db:"created_at" json:"created_at"`
-	UpdatedAt          time.Time      `db:"updated_at" json:"updated_at"`
-	Name               string         `db:"name" json:"name"`
-	Readme             string         `db:"readme" json:"readme"`
-	JobID              uuid.UUID      `db:"job_id" json:"job_id"`
-	CreatedBy          uuid.UUID      `db:"created_by" json:"created_by"`
-	GitAuthProviders   []string       `db:"git_auth_providers" json:"git_auth_providers"`
-	Message            string         `db:"message" json:"message"`
-	CreatedByAvatarURL sql.NullString `db:"created_by_avatar_url" json:"created_by_avatar_url"`
-	CreatedByUsername  string         `db:"created_by_username" json:"created_by_username"`
+	ID                    uuid.UUID      `db:"id" json:"id"`
+	TemplateID            uuid.NullUUID  `db:"template_id" json:"template_id"`
+	OrganizationID        uuid.UUID      `db:"organization_id" json:"organization_id"`
+	CreatedAt             time.Time      `db:"created_at" json:"created_at"`
+	UpdatedAt             time.Time      `db:"updated_at" json:"updated_at"`
+	Name                  string         `db:"name" json:"name"`
+	Readme                string         `db:"readme" json:"readme"`
+	JobID                 uuid.UUID      `db:"job_id" json:"job_id"`
+	CreatedBy             uuid.UUID      `db:"created_by" json:"created_by"`
+	ExternalAuthProviders []string       `db:"external_auth_providers" json:"external_auth_providers"`
+	Message               string         `db:"message" json:"message"`
+	Archived              bool           `db:"archived" json:"archived"`
+	CreatedByAvatarURL    sql.NullString `db:"created_by_avatar_url" json:"created_by_avatar_url"`
+	CreatedByUsername     string         `db:"created_by_username" json:"created_by_username"`
 }
 
 type TemplateVersionParameter struct {
@@ -1771,10 +1998,11 @@ type TemplateVersionTable struct {
 	Readme         string        `db:"readme" json:"readme"`
 	JobID          uuid.UUID     `db:"job_id" json:"job_id"`
 	CreatedBy      uuid.UUID     `db:"created_by" json:"created_by"`
-	// IDs of Git auth providers for a specific template version
-	GitAuthProviders []string `db:"git_auth_providers" json:"git_auth_providers"`
+	// IDs of External auth providers for a specific template version
+	ExternalAuthProviders []string `db:"external_auth_providers" json:"external_auth_providers"`
 	// Message describing the changes in this version of the template, similar to a Git commit message. Like a commit message, this should be a short, high-level description of the changes in this version of the template. This message is immutable and should not be updated after the fact.
-	Message string `db:"message" json:"message"`
+	Message  string `db:"message" json:"message"`
+	Archived bool   `db:"archived" json:"archived"`
 }
 
 type TemplateVersionVariable struct {
@@ -1819,6 +2047,10 @@ type UserLink struct {
 	OAuthAccessToken  string    `db:"oauth_access_token" json:"oauth_access_token"`
 	OAuthRefreshToken string    `db:"oauth_refresh_token" json:"oauth_refresh_token"`
 	OAuthExpiry       time.Time `db:"oauth_expiry" json:"oauth_expiry"`
+	// The ID of the key used to encrypt the OAuth access token. If this is NULL, the access token is not encrypted
+	OAuthAccessTokenKeyID sql.NullString `db:"oauth_access_token_key_id" json:"oauth_access_token_key_id"`
+	// The ID of the key used to encrypt the OAuth refresh token. If this is NULL, the refresh token is not encrypted
+	OAuthRefreshTokenKeyID sql.NullString `db:"oauth_refresh_token_key_id" json:"oauth_refresh_token_key_id"`
 }
 
 // Visible fields of users are allowed to be joined with other tables for including context of other resources.
@@ -1829,19 +2061,20 @@ type VisibleUser struct {
 }
 
 type Workspace struct {
-	ID                uuid.UUID      `db:"id" json:"id"`
-	CreatedAt         time.Time      `db:"created_at" json:"created_at"`
-	UpdatedAt         time.Time      `db:"updated_at" json:"updated_at"`
-	OwnerID           uuid.UUID      `db:"owner_id" json:"owner_id"`
-	OrganizationID    uuid.UUID      `db:"organization_id" json:"organization_id"`
-	TemplateID        uuid.UUID      `db:"template_id" json:"template_id"`
-	Deleted           bool           `db:"deleted" json:"deleted"`
-	Name              string         `db:"name" json:"name"`
-	AutostartSchedule sql.NullString `db:"autostart_schedule" json:"autostart_schedule"`
-	Ttl               sql.NullInt64  `db:"ttl" json:"ttl"`
-	LastUsedAt        time.Time      `db:"last_used_at" json:"last_used_at"`
-	LockedAt          sql.NullTime   `db:"locked_at" json:"locked_at"`
-	DeletingAt        sql.NullTime   `db:"deleting_at" json:"deleting_at"`
+	ID                uuid.UUID        `db:"id" json:"id"`
+	CreatedAt         time.Time        `db:"created_at" json:"created_at"`
+	UpdatedAt         time.Time        `db:"updated_at" json:"updated_at"`
+	OwnerID           uuid.UUID        `db:"owner_id" json:"owner_id"`
+	OrganizationID    uuid.UUID        `db:"organization_id" json:"organization_id"`
+	TemplateID        uuid.UUID        `db:"template_id" json:"template_id"`
+	Deleted           bool             `db:"deleted" json:"deleted"`
+	Name              string           `db:"name" json:"name"`
+	AutostartSchedule sql.NullString   `db:"autostart_schedule" json:"autostart_schedule"`
+	Ttl               sql.NullInt64    `db:"ttl" json:"ttl"`
+	LastUsedAt        time.Time        `db:"last_used_at" json:"last_used_at"`
+	DormantAt         sql.NullTime     `db:"dormant_at" json:"dormant_at"`
+	DeletingAt        sql.NullTime     `db:"deleting_at" json:"deleting_at"`
+	AutomaticUpdates  AutomaticUpdates `db:"automatic_updates" json:"automatic_updates"`
 }
 
 type WorkspaceAgent struct {
@@ -1858,7 +2091,6 @@ type WorkspaceAgent struct {
 	Architecture         string                `db:"architecture" json:"architecture"`
 	EnvironmentVariables pqtype.NullRawMessage `db:"environment_variables" json:"environment_variables"`
 	OperatingSystem      string                `db:"operating_system" json:"operating_system"`
-	StartupScript        sql.NullString        `db:"startup_script" json:"startup_script"`
 	InstanceMetadata     pqtype.NullRawMessage `db:"instance_metadata" json:"instance_metadata"`
 	ResourceMetadata     pqtype.NullRawMessage `db:"resource_metadata" json:"resource_metadata"`
 	Directory            string                `db:"directory" json:"directory"`
@@ -1873,34 +2105,36 @@ type WorkspaceAgent struct {
 	MOTDFile string `db:"motd_file" json:"motd_file"`
 	// The current lifecycle state reported by the workspace agent.
 	LifecycleState WorkspaceAgentLifecycleState `db:"lifecycle_state" json:"lifecycle_state"`
-	// The number of seconds to wait for the startup script to complete. If the script does not complete within this time, the agent lifecycle will be marked as start_timeout.
-	StartupScriptTimeoutSeconds int32 `db:"startup_script_timeout_seconds" json:"startup_script_timeout_seconds"`
 	// The resolved path of a user-specified directory. e.g. ~/coder -> /home/coder/coder
 	ExpandedDirectory string `db:"expanded_directory" json:"expanded_directory"`
-	// Script that is executed before the agent is stopped.
-	ShutdownScript sql.NullString `db:"shutdown_script" json:"shutdown_script"`
-	// The number of seconds to wait for the shutdown script to complete. If the script does not complete within this time, the agent lifecycle will be marked as shutdown_timeout.
-	ShutdownScriptTimeoutSeconds int32 `db:"shutdown_script_timeout_seconds" json:"shutdown_script_timeout_seconds"`
 	// Total length of startup logs
 	LogsLength int32 `db:"logs_length" json:"logs_length"`
 	// Whether the startup logs overflowed in length
-	LogsOverflowed bool                    `db:"logs_overflowed" json:"logs_overflowed"`
-	Subsystem      WorkspaceAgentSubsystem `db:"subsystem" json:"subsystem"`
-	// When startup script behavior is non-blocking, the workspace will be ready and accessible upon agent connection, when it is blocking, workspace will wait for the startup script to complete before becoming ready and accessible.
-	StartupScriptBehavior StartupScriptBehavior `db:"startup_script_behavior" json:"startup_script_behavior"`
+	LogsOverflowed bool `db:"logs_overflowed" json:"logs_overflowed"`
 	// The time the agent entered the starting lifecycle state
 	StartedAt sql.NullTime `db:"started_at" json:"started_at"`
 	// The time the agent entered the ready or start_error lifecycle state
-	ReadyAt sql.NullTime `db:"ready_at" json:"ready_at"`
+	ReadyAt     sql.NullTime              `db:"ready_at" json:"ready_at"`
+	Subsystems  []WorkspaceAgentSubsystem `db:"subsystems" json:"subsystems"`
+	DisplayApps []DisplayApp              `db:"display_apps" json:"display_apps"`
+	APIVersion  string                    `db:"api_version" json:"api_version"`
 }
 
 type WorkspaceAgentLog struct {
-	AgentID   uuid.UUID               `db:"agent_id" json:"agent_id"`
-	CreatedAt time.Time               `db:"created_at" json:"created_at"`
-	Output    string                  `db:"output" json:"output"`
-	ID        int64                   `db:"id" json:"id"`
-	Level     LogLevel                `db:"level" json:"level"`
-	Source    WorkspaceAgentLogSource `db:"source" json:"source"`
+	AgentID     uuid.UUID `db:"agent_id" json:"agent_id"`
+	CreatedAt   time.Time `db:"created_at" json:"created_at"`
+	Output      string    `db:"output" json:"output"`
+	ID          int64     `db:"id" json:"id"`
+	Level       LogLevel  `db:"level" json:"level"`
+	LogSourceID uuid.UUID `db:"log_source_id" json:"log_source_id"`
+}
+
+type WorkspaceAgentLogSource struct {
+	WorkspaceAgentID uuid.UUID `db:"workspace_agent_id" json:"workspace_agent_id"`
+	ID               uuid.UUID `db:"id" json:"id"`
+	CreatedAt        time.Time `db:"created_at" json:"created_at"`
+	DisplayName      string    `db:"display_name" json:"display_name"`
+	Icon             string    `db:"icon" json:"icon"`
 }
 
 type WorkspaceAgentMetadatum struct {
@@ -1915,6 +2149,19 @@ type WorkspaceAgentMetadatum struct {
 	CollectedAt      time.Time `db:"collected_at" json:"collected_at"`
 }
 
+type WorkspaceAgentScript struct {
+	WorkspaceAgentID uuid.UUID `db:"workspace_agent_id" json:"workspace_agent_id"`
+	LogSourceID      uuid.UUID `db:"log_source_id" json:"log_source_id"`
+	LogPath          string    `db:"log_path" json:"log_path"`
+	CreatedAt        time.Time `db:"created_at" json:"created_at"`
+	Script           string    `db:"script" json:"script"`
+	Cron             string    `db:"cron" json:"cron"`
+	StartBlocksLogin bool      `db:"start_blocks_login" json:"start_blocks_login"`
+	RunOnStart       bool      `db:"run_on_start" json:"run_on_start"`
+	RunOnStop        bool      `db:"run_on_stop" json:"run_on_stop"`
+	TimeoutSeconds   int32     `db:"timeout_seconds" json:"timeout_seconds"`
+}
+
 type WorkspaceAgentStat struct {
 	ID                          uuid.UUID       `db:"id" json:"id"`
 	CreatedAt                   time.Time       `db:"created_at" json:"created_at"`
@@ -1953,6 +2200,30 @@ type WorkspaceApp struct {
 	External             bool               `db:"external" json:"external"`
 }
 
+// A record of workspace app usage statistics
+type WorkspaceAppStat struct {
+	// The ID of the record
+	ID int64 `db:"id" json:"id"`
+	// The user who used the workspace app
+	UserID uuid.UUID `db:"user_id" json:"user_id"`
+	// The workspace that the workspace app was used in
+	WorkspaceID uuid.UUID `db:"workspace_id" json:"workspace_id"`
+	// The workspace agent that was used
+	AgentID uuid.UUID `db:"agent_id" json:"agent_id"`
+	// The method used to access the workspace app
+	AccessMethod string `db:"access_method" json:"access_method"`
+	// The slug or port used to to identify the app
+	SlugOrPort string `db:"slug_or_port" json:"slug_or_port"`
+	// The unique identifier for the session
+	SessionID uuid.UUID `db:"session_id" json:"session_id"`
+	// The time the session started
+	SessionStartedAt time.Time `db:"session_started_at" json:"session_started_at"`
+	// The time the session ended
+	SessionEndedAt time.Time `db:"session_ended_at" json:"session_ended_at"`
+	// The number of requests made during the session, a number larger than 1 indicates that multiple sessions were rolled up into one
+	Requests int32 `db:"requests" json:"requests"`
+}
+
 // Joins in the username + avatar url of the initiated by user.
 type WorkspaceBuild struct {
 	ID                   uuid.UUID           `db:"id" json:"id"`
diff --git a/coderd/database/models_test.go b/coderd/database/models_test.go
index 1ebb40ae2ff26..a3c37683ac2c8 100644
--- a/coderd/database/models_test.go
+++ b/coderd/database/models_test.go
@@ -5,10 +5,24 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/codersdk"
 )
 
+// TestAuditDBEnumsCovered ensures that all enums in the database are covered by the codersdk enums
+// for audit log strings.
+func TestAuditDBEnumsCovered(t *testing.T) {
+	t.Parallel()
+
+	dbTypes := database.AllResourceTypeValues()
+	for _, ty := range dbTypes {
+		str := codersdk.ResourceType(ty).FriendlyString()
+		require.NotEqualf(t, "unknown", str, "ResourceType %q not covered by codersdk.ResourceType", ty)
+	}
+}
+
 // TestViewSubsetTemplate ensures TemplateTable is a subset of Template
 func TestViewSubsetTemplate(t *testing.T) {
 	t.Parallel()
diff --git a/coderd/database/no_slim.go b/coderd/database/no_slim.go
new file mode 100644
index 0000000000000..561466490f53e
--- /dev/null
+++ b/coderd/database/no_slim.go
@@ -0,0 +1,8 @@
+package database
+
+const (
+	// This declaration protects against imports in slim builds, see
+	// no_slim_slim.go.
+	//nolint:revive,unused
+	_DO_NOT_IMPORT_THIS_PACKAGE_IN_SLIM_BUILDS = "DO_NOT_IMPORT_THIS_PACKAGE_IN_SLIM_BUILDS"
+)
diff --git a/coderd/database/no_slim_slim.go b/coderd/database/no_slim_slim.go
new file mode 100644
index 0000000000000..845ac0df77942
--- /dev/null
+++ b/coderd/database/no_slim_slim.go
@@ -0,0 +1,14 @@
+//go:build slim
+
+package database
+
+const (
+	// This re-declaration will result in a compilation error and is present to
+	// prevent increasing the slim binary size by importing this package,
+	// directly or indirectly.
+	//
+	// no_slim_slim.go:7:2: _DO_NOT_IMPORT_THIS_PACKAGE_IN_SLIM_BUILDS redeclared in this block
+	// 	no_slim.go:4:2: other declaration of _DO_NOT_IMPORT_THIS_PACKAGE_IN_SLIM_BUILDS
+	//nolint:revive,unused
+	_DO_NOT_IMPORT_THIS_PACKAGE_IN_SLIM_BUILDS = "DO_NOT_IMPORT_THIS_PACKAGE_IN_SLIM_BUILDS"
+)
diff --git a/coderd/database/postgres/postgres.go b/coderd/database/postgres/postgres.go
index 85710d8bb0f7b..8a7d0209ba4e0 100644
--- a/coderd/database/postgres/postgres.go
+++ b/coderd/database/postgres/postgres.go
@@ -12,8 +12,8 @@ import (
 	"github.com/ory/dockertest/v3/docker"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database/migrations"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd/database/migrations"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 // Open creates a new PostgreSQL database instance.  With DB_FROM environment variable set, it clones a database
diff --git a/coderd/database/postgres/postgres_test.go b/coderd/database/postgres/postgres_test.go
index 88d9800a57644..4a217d072f4af 100644
--- a/coderd/database/postgres/postgres_test.go
+++ b/coderd/database/postgres/postgres_test.go
@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"go.uber.org/goleak"
 
-	"github.com/coder/coder/coderd/database/postgres"
+	"github.com/coder/coder/v2/coderd/database/postgres"
 )
 
 func TestMain(m *testing.M) {
diff --git a/coderd/database/provisionerjobs/provisionerjobs.go b/coderd/database/provisionerjobs/provisionerjobs.go
new file mode 100644
index 0000000000000..6ee5bee495421
--- /dev/null
+++ b/coderd/database/provisionerjobs/provisionerjobs.go
@@ -0,0 +1,29 @@
+package provisionerjobs
+
+import (
+	"encoding/json"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+)
+
+const EventJobPosted = "provisioner_job_posted"
+
+type JobPosting struct {
+	ProvisionerType database.ProvisionerType `json:"type"`
+	Tags            map[string]string        `json:"tags"`
+}
+
+func PostJob(ps pubsub.Pubsub, job database.ProvisionerJob) error {
+	msg, err := json.Marshal(JobPosting{
+		ProvisionerType: job.Provisioner,
+		Tags:            job.Tags,
+	})
+	if err != nil {
+		return xerrors.Errorf("marshal job posting: %w", err)
+	}
+	err = ps.Publish(EventJobPosted, msg)
+	return err
+}
diff --git a/coderd/database/pubsub/pubsub_internal_test.go b/coderd/database/pubsub/pubsub_internal_test.go
index adfa70286dbe0..47dd324fc09df 100644
--- a/coderd/database/pubsub/pubsub_internal_test.go
+++ b/coderd/database/pubsub/pubsub_internal_test.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func Test_msgQueue_ListenerWithError(t *testing.T) {
diff --git a/coderd/database/pubsub/pubsub_memory_test.go b/coderd/database/pubsub/pubsub_memory_test.go
index 80553c8fa73da..0f392ade742c4 100644
--- a/coderd/database/pubsub/pubsub_memory_test.go
+++ b/coderd/database/pubsub/pubsub_memory_test.go
@@ -7,7 +7,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
 )
 
 func TestPubsubMemory(t *testing.T) {
diff --git a/coderd/database/pubsub/pubsub_test.go b/coderd/database/pubsub/pubsub_test.go
index d1f80fa5a1aed..1d414d9edcd2c 100644
--- a/coderd/database/pubsub/pubsub_test.go
+++ b/coderd/database/pubsub/pubsub_test.go
@@ -15,9 +15,9 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database/postgres"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database/postgres"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // nolint:tparallel,paralleltest
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 5e9da77b66c0a..2d278ba933e67 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -1,6 +1,6 @@
 // Code generated by sqlc. DO NOT EDIT.
 // versions:
-//   sqlc v1.19.1
+//   sqlc v1.20.0
 
 package database
 
@@ -24,9 +24,26 @@ type sqlcQuerier interface {
 	// multiple provisioners from acquiring the same jobs. See:
 	// https://www.postgresql.org/docs/9.5/sql-select.html#SQL-FOR-UPDATE-SHARE
 	AcquireProvisionerJob(ctx context.Context, arg AcquireProvisionerJobParams) (ProvisionerJob, error)
+	// We bump by the original TTL to prevent counter-intuitive behavior
+	// as the TTL wraps. For example, if I set the TTL to 12 hours, sign off
+	// work at midnight, come back at 10am, I would want another full day
+	// of uptime.
+	// We only bump if the raw interval is positive and non-zero.
+	// We only bump if workspace shutdown is manual.
+	// We only bump when 5% of the deadline has elapsed.
+	ActivityBumpWorkspace(ctx context.Context, workspaceID uuid.UUID) error
+	// AllUserIDs returns all UserIDs regardless of user status or deletion.
+	AllUserIDs(ctx context.Context) ([]uuid.UUID, error)
+	// Archiving templates is a soft delete action, so is reversible.
+	// Archiving prevents the version from being used and discovered
+	// by listing.
+	// Only unused template versions will be archived, which are any versions not
+	// referenced by the latest build of a workspace.
+	ArchiveUnusedTemplateVersions(ctx context.Context, arg ArchiveUnusedTemplateVersionsParams) ([]uuid.UUID, error)
 	CleanTailnetCoordinators(ctx context.Context) error
 	DeleteAPIKeyByID(ctx context.Context, id string) error
 	DeleteAPIKeysByUserID(ctx context.Context, userID uuid.UUID) error
+	DeleteAllTailnetClientSubscriptions(ctx context.Context, arg DeleteAllTailnetClientSubscriptionsParams) error
 	DeleteApplicationConnectAPIKeysByUserID(ctx context.Context, userID uuid.UUID) error
 	DeleteCoordinator(ctx context.Context, id uuid.UUID) error
 	DeleteGitSSHKey(ctx context.Context, userID uuid.UUID) error
@@ -41,6 +58,7 @@ type sqlcQuerier interface {
 	DeleteReplicasUpdatedBefore(ctx context.Context, updatedAt time.Time) error
 	DeleteTailnetAgent(ctx context.Context, arg DeleteTailnetAgentParams) (DeleteTailnetAgentRow, error)
 	DeleteTailnetClient(ctx context.Context, arg DeleteTailnetClientParams) (DeleteTailnetClientRow, error)
+	DeleteTailnetClientSubscription(ctx context.Context, arg DeleteTailnetClientSubscriptionParams) error
 	GetAPIKeyByID(ctx context.Context, id string) (APIKey, error)
 	// there is no unique constraint on empty token names
 	GetAPIKeyByName(ctx context.Context, arg GetAPIKeyByNameParams) (APIKey, error)
@@ -48,29 +66,35 @@ type sqlcQuerier interface {
 	GetAPIKeysByUserID(ctx context.Context, arg GetAPIKeysByUserIDParams) ([]APIKey, error)
 	GetAPIKeysLastUsedAfter(ctx context.Context, lastUsed time.Time) ([]APIKey, error)
 	GetActiveUserCount(ctx context.Context) (int64, error)
+	GetActiveWorkspaceBuildsByTemplateID(ctx context.Context, templateID uuid.UUID) ([]WorkspaceBuild, error)
 	GetAllTailnetAgents(ctx context.Context) ([]TailnetAgent, error)
-	GetAllTailnetClients(ctx context.Context) ([]TailnetClient, error)
+	GetAllTailnetClients(ctx context.Context) ([]GetAllTailnetClientsRow, error)
 	GetAppSecurityKey(ctx context.Context) (string, error)
+	GetApplicationName(ctx context.Context) (string, error)
 	// GetAuditLogsBefore retrieves `row_limit` number of audit logs before the provided
 	// ID.
 	GetAuditLogsOffset(ctx context.Context, arg GetAuditLogsOffsetParams) ([]GetAuditLogsOffsetRow, error)
 	// This function returns roles for authorization purposes. Implied member roles
 	// are included.
 	GetAuthorizationUserRoles(ctx context.Context, userID uuid.UUID) (GetAuthorizationUserRolesRow, error)
+	GetDBCryptKeys(ctx context.Context) ([]DBCryptKey, error)
 	GetDERPMeshKey(ctx context.Context) (string, error)
 	GetDefaultProxyConfig(ctx context.Context) (GetDefaultProxyConfigRow, error)
 	GetDeploymentDAUs(ctx context.Context, tzOffset int32) ([]GetDeploymentDAUsRow, error)
 	GetDeploymentID(ctx context.Context) (string, error)
 	GetDeploymentWorkspaceAgentStats(ctx context.Context, createdAt time.Time) (GetDeploymentWorkspaceAgentStatsRow, error)
 	GetDeploymentWorkspaceStats(ctx context.Context) (GetDeploymentWorkspaceStatsRow, error)
+	GetExternalAuthLink(ctx context.Context, arg GetExternalAuthLinkParams) (ExternalAuthLink, error)
+	GetExternalAuthLinksByUserID(ctx context.Context, userID uuid.UUID) ([]ExternalAuthLink, error)
 	GetFileByHashAndCreator(ctx context.Context, arg GetFileByHashAndCreatorParams) (File, error)
 	GetFileByID(ctx context.Context, id uuid.UUID) (File, error)
 	// Get all templates that use a file.
 	GetFileTemplates(ctx context.Context, fileID uuid.UUID) ([]GetFileTemplatesRow, error)
-	GetGitAuthLink(ctx context.Context, arg GetGitAuthLinkParams) (GitAuthLink, error)
 	GetGitSSHKey(ctx context.Context, userID uuid.UUID) (GitSSHKey, error)
 	GetGroupByID(ctx context.Context, id uuid.UUID) (Group, error)
 	GetGroupByOrgAndName(ctx context.Context, arg GetGroupByOrgAndNameParams) (Group, error)
+	// If the group is a user made group, then we need to check the group_members table.
+	// If it is the "Everyone" group, then we need to check the organization_members table.
 	GetGroupMembers(ctx context.Context, groupID uuid.UUID) ([]User, error)
 	GetGroupsByOrganizationID(ctx context.Context, organizationID uuid.UUID) ([]Group, error)
 	GetHungProvisionerJobs(ctx context.Context, updatedAt time.Time) ([]ProvisionerJob, error)
@@ -104,18 +128,24 @@ type sqlcQuerier interface {
 	GetServiceBanner(ctx context.Context) (string, error)
 	GetTailnetAgents(ctx context.Context, id uuid.UUID) ([]TailnetAgent, error)
 	GetTailnetClientsForAgent(ctx context.Context, agentID uuid.UUID) ([]TailnetClient, error)
+	// GetTemplateAppInsights returns the aggregate usage of each app in a given
+	// timeframe. The result can be filtered on template_ids, meaning only user data
+	// from workspaces based on those templates will be included.
+	GetTemplateAppInsights(ctx context.Context, arg GetTemplateAppInsightsParams) ([]GetTemplateAppInsightsRow, error)
 	GetTemplateAverageBuildTime(ctx context.Context, arg GetTemplateAverageBuildTimeParams) (GetTemplateAverageBuildTimeRow, error)
 	GetTemplateByID(ctx context.Context, id uuid.UUID) (Template, error)
 	GetTemplateByOrganizationAndName(ctx context.Context, arg GetTemplateByOrganizationAndNameParams) (Template, error)
 	GetTemplateDAUs(ctx context.Context, arg GetTemplateDAUsParams) ([]GetTemplateDAUsRow, error)
-	// GetTemplateDailyInsights returns all daily intervals between start and end
-	// time, if end time is a partial day, it will be included in the results and
-	// that interval will be less than 24 hours. If there is no data for a selected
-	// interval/template, it will be included in the results with 0 active users.
-	GetTemplateDailyInsights(ctx context.Context, arg GetTemplateDailyInsightsParams) ([]GetTemplateDailyInsightsRow, error)
 	// GetTemplateInsights has a granularity of 5 minutes where if a session/app was
-	// in use, we will add 5 minutes to the total usage for that session (per user).
+	// in use during a minute, we will add 5 minutes to the total usage for that
+	// session/app (per user).
 	GetTemplateInsights(ctx context.Context, arg GetTemplateInsightsParams) (GetTemplateInsightsRow, error)
+	// GetTemplateInsightsByInterval returns all intervals between start and end
+	// time, if end time is a partial interval, it will be included in the results and
+	// that interval will be shorter than a full one. If there is no data for a selected
+	// interval/template, it will be included in the results with 0 active users.
+	GetTemplateInsightsByInterval(ctx context.Context, arg GetTemplateInsightsByIntervalParams) ([]GetTemplateInsightsByIntervalRow, error)
+	GetTemplateInsightsByTemplate(ctx context.Context, arg GetTemplateInsightsByTemplateParams) ([]GetTemplateInsightsByTemplateRow, error)
 	// GetTemplateParameterInsights does for each template in a given timeframe,
 	// look for the latest workspace build (for every workspace) that has been
 	// created in the timeframe and return the aggregate usage counts of parameter
@@ -132,6 +162,14 @@ type sqlcQuerier interface {
 	GetTemplates(ctx context.Context) ([]Template, error)
 	GetTemplatesWithFilter(ctx context.Context, arg GetTemplatesWithFilterParams) ([]Template, error)
 	GetUnexpiredLicenses(ctx context.Context) ([]License, error)
+	// GetUserActivityInsights returns the ranking with top active users.
+	// The result can be filtered on template_ids, meaning only user data from workspaces
+	// based on those templates will be included.
+	// Note: When selecting data from multiple templates or the entire deployment,
+	// be aware that it may lead to an increase in "usage" numbers (cumulative). In such cases,
+	// users may be counted multiple times for the same time interval if they have used multiple templates
+	// simultaneously.
+	GetUserActivityInsights(ctx context.Context, arg GetUserActivityInsightsParams) ([]GetUserActivityInsightsRow, error)
 	GetUserByEmailOrUsername(ctx context.Context, arg GetUserByEmailOrUsernameParams) (User, error)
 	GetUserByID(ctx context.Context, id uuid.UUID) (User, error)
 	GetUserCount(ctx context.Context) (int64, error)
@@ -142,18 +180,21 @@ type sqlcQuerier interface {
 	GetUserLatencyInsights(ctx context.Context, arg GetUserLatencyInsightsParams) ([]GetUserLatencyInsightsRow, error)
 	GetUserLinkByLinkedID(ctx context.Context, linkedID string) (UserLink, error)
 	GetUserLinkByUserIDLoginType(ctx context.Context, arg GetUserLinkByUserIDLoginTypeParams) (UserLink, error)
+	GetUserLinksByUserID(ctx context.Context, userID uuid.UUID) ([]UserLink, error)
 	// This will never return deleted users.
 	GetUsers(ctx context.Context, arg GetUsersParams) ([]GetUsersRow, error)
 	// This shouldn't check for deleted, because it's frequently used
 	// to look up references to actions. eg. a user could build a workspace
 	// for another user, then be deleted... we still want them to appear!
 	GetUsersByIDs(ctx context.Context, ids []uuid.UUID) ([]User, error)
-	GetWorkspaceAgentByAuthToken(ctx context.Context, authToken uuid.UUID) (WorkspaceAgent, error)
+	GetWorkspaceAgentAndOwnerByAuthToken(ctx context.Context, authToken uuid.UUID) (GetWorkspaceAgentAndOwnerByAuthTokenRow, error)
 	GetWorkspaceAgentByID(ctx context.Context, id uuid.UUID) (WorkspaceAgent, error)
 	GetWorkspaceAgentByInstanceID(ctx context.Context, authInstanceID string) (WorkspaceAgent, error)
 	GetWorkspaceAgentLifecycleStateByID(ctx context.Context, id uuid.UUID) (GetWorkspaceAgentLifecycleStateByIDRow, error)
+	GetWorkspaceAgentLogSourcesByAgentIDs(ctx context.Context, ids []uuid.UUID) ([]WorkspaceAgentLogSource, error)
 	GetWorkspaceAgentLogsAfter(ctx context.Context, arg GetWorkspaceAgentLogsAfterParams) ([]WorkspaceAgentLog, error)
-	GetWorkspaceAgentMetadata(ctx context.Context, workspaceAgentID uuid.UUID) ([]WorkspaceAgentMetadatum, error)
+	GetWorkspaceAgentMetadata(ctx context.Context, arg GetWorkspaceAgentMetadataParams) ([]WorkspaceAgentMetadatum, error)
+	GetWorkspaceAgentScriptsByAgentIDs(ctx context.Context, ids []uuid.UUID) ([]WorkspaceAgentScript, error)
 	GetWorkspaceAgentStats(ctx context.Context, createdAt time.Time) ([]GetWorkspaceAgentStatsRow, error)
 	GetWorkspaceAgentStatsAndLabels(ctx context.Context, createdAt time.Time) ([]GetWorkspaceAgentStatsAndLabelsRow, error)
 	GetWorkspaceAgentsByResourceIDs(ctx context.Context, ids []uuid.UUID) ([]WorkspaceAgent, error)
@@ -198,14 +239,20 @@ type sqlcQuerier interface {
 	// every member of the org.
 	InsertAllUsersGroup(ctx context.Context, organizationID uuid.UUID) (Group, error)
 	InsertAuditLog(ctx context.Context, arg InsertAuditLogParams) (AuditLog, error)
+	InsertDBCryptKey(ctx context.Context, arg InsertDBCryptKeyParams) error
 	InsertDERPMeshKey(ctx context.Context, value string) error
 	InsertDeploymentID(ctx context.Context, value string) error
+	InsertExternalAuthLink(ctx context.Context, arg InsertExternalAuthLinkParams) (ExternalAuthLink, error)
 	InsertFile(ctx context.Context, arg InsertFileParams) (File, error)
-	InsertGitAuthLink(ctx context.Context, arg InsertGitAuthLinkParams) (GitAuthLink, error)
 	InsertGitSSHKey(ctx context.Context, arg InsertGitSSHKeyParams) (GitSSHKey, error)
 	InsertGroup(ctx context.Context, arg InsertGroupParams) (Group, error)
 	InsertGroupMember(ctx context.Context, arg InsertGroupMemberParams) error
 	InsertLicense(ctx context.Context, arg InsertLicenseParams) (License, error)
+	// Inserts any group by name that does not exist. All new groups are given
+	// a random uuid, are inserted into the same organization. They have the default
+	// values for avatar, display name, and quota allowance (all zero values).
+	// If the name conflicts, do nothing.
+	InsertMissingGroups(ctx context.Context, arg InsertMissingGroupsParams) ([]Group, error)
 	InsertOrganization(ctx context.Context, arg InsertOrganizationParams) (Organization, error)
 	InsertOrganizationMember(ctx context.Context, arg InsertOrganizationMemberParams) (OrganizationMember, error)
 	InsertProvisionerDaemon(ctx context.Context, arg InsertProvisionerDaemonParams) (ProvisionerDaemon, error)
@@ -222,23 +269,30 @@ type sqlcQuerier interface {
 	InsertUserLink(ctx context.Context, arg InsertUserLinkParams) (UserLink, error)
 	InsertWorkspace(ctx context.Context, arg InsertWorkspaceParams) (Workspace, error)
 	InsertWorkspaceAgent(ctx context.Context, arg InsertWorkspaceAgentParams) (WorkspaceAgent, error)
+	InsertWorkspaceAgentLogSources(ctx context.Context, arg InsertWorkspaceAgentLogSourcesParams) ([]WorkspaceAgentLogSource, error)
 	InsertWorkspaceAgentLogs(ctx context.Context, arg InsertWorkspaceAgentLogsParams) ([]WorkspaceAgentLog, error)
 	InsertWorkspaceAgentMetadata(ctx context.Context, arg InsertWorkspaceAgentMetadataParams) error
+	InsertWorkspaceAgentScripts(ctx context.Context, arg InsertWorkspaceAgentScriptsParams) ([]WorkspaceAgentScript, error)
 	InsertWorkspaceAgentStat(ctx context.Context, arg InsertWorkspaceAgentStatParams) (WorkspaceAgentStat, error)
+	InsertWorkspaceAgentStats(ctx context.Context, arg InsertWorkspaceAgentStatsParams) error
 	InsertWorkspaceApp(ctx context.Context, arg InsertWorkspaceAppParams) (WorkspaceApp, error)
+	InsertWorkspaceAppStats(ctx context.Context, arg InsertWorkspaceAppStatsParams) error
 	InsertWorkspaceBuild(ctx context.Context, arg InsertWorkspaceBuildParams) error
 	InsertWorkspaceBuildParameters(ctx context.Context, arg InsertWorkspaceBuildParametersParams) error
 	InsertWorkspaceProxy(ctx context.Context, arg InsertWorkspaceProxyParams) (WorkspaceProxy, error)
 	InsertWorkspaceResource(ctx context.Context, arg InsertWorkspaceResourceParams) (WorkspaceResource, error)
 	InsertWorkspaceResourceMetadata(ctx context.Context, arg InsertWorkspaceResourceMetadataParams) ([]WorkspaceResourceMetadatum, error)
 	RegisterWorkspaceProxy(ctx context.Context, arg RegisterWorkspaceProxyParams) (WorkspaceProxy, error)
+	RevokeDBCryptKey(ctx context.Context, activeKeyDigest string) error
 	// Non blocking lock. Returns true if the lock was acquired, false otherwise.
 	//
 	// This must be called from within a transaction. The lock will be automatically
 	// released when the transaction ends.
 	TryAcquireLock(ctx context.Context, pgTryAdvisoryXactLock int64) (bool, error)
+	// This will always work regardless of the current state of the template version.
+	UnarchiveTemplateVersion(ctx context.Context, arg UnarchiveTemplateVersionParams) error
 	UpdateAPIKeyByID(ctx context.Context, arg UpdateAPIKeyByIDParams) error
-	UpdateGitAuthLink(ctx context.Context, arg UpdateGitAuthLinkParams) (GitAuthLink, error)
+	UpdateExternalAuthLink(ctx context.Context, arg UpdateExternalAuthLinkParams) (ExternalAuthLink, error)
 	UpdateGitSSHKey(ctx context.Context, arg UpdateGitSSHKeyParams) (GitSSHKey, error)
 	UpdateGroupByID(ctx context.Context, arg UpdateGroupByIDParams) (Group, error)
 	UpdateInactiveUsersToDormant(ctx context.Context, arg UpdateInactiveUsersToDormantParams) ([]UpdateInactiveUsersToDormantRow, error)
@@ -248,13 +302,15 @@ type sqlcQuerier interface {
 	UpdateProvisionerJobWithCompleteByID(ctx context.Context, arg UpdateProvisionerJobWithCompleteByIDParams) error
 	UpdateReplica(ctx context.Context, arg UpdateReplicaParams) (Replica, error)
 	UpdateTemplateACLByID(ctx context.Context, arg UpdateTemplateACLByIDParams) error
+	UpdateTemplateAccessControlByID(ctx context.Context, arg UpdateTemplateAccessControlByIDParams) error
 	UpdateTemplateActiveVersionByID(ctx context.Context, arg UpdateTemplateActiveVersionByIDParams) error
 	UpdateTemplateDeletedByID(ctx context.Context, arg UpdateTemplateDeletedByIDParams) error
 	UpdateTemplateMetaByID(ctx context.Context, arg UpdateTemplateMetaByIDParams) error
 	UpdateTemplateScheduleByID(ctx context.Context, arg UpdateTemplateScheduleByIDParams) error
 	UpdateTemplateVersionByID(ctx context.Context, arg UpdateTemplateVersionByIDParams) error
 	UpdateTemplateVersionDescriptionByJobID(ctx context.Context, arg UpdateTemplateVersionDescriptionByJobIDParams) error
-	UpdateTemplateVersionGitAuthProvidersByJobID(ctx context.Context, arg UpdateTemplateVersionGitAuthProvidersByJobIDParams) error
+	UpdateTemplateVersionExternalAuthProvidersByJobID(ctx context.Context, arg UpdateTemplateVersionExternalAuthProvidersByJobIDParams) error
+	UpdateTemplateWorkspacesLastUsedAt(ctx context.Context, arg UpdateTemplateWorkspacesLastUsedAtParams) error
 	UpdateUserDeletedByID(ctx context.Context, arg UpdateUserDeletedByIDParams) error
 	UpdateUserHashedPassword(ctx context.Context, arg UpdateUserHashedPasswordParams) error
 	UpdateUserLastSeenAt(ctx context.Context, arg UpdateUserLastSeenAtParams) (User, error)
@@ -272,18 +328,21 @@ type sqlcQuerier interface {
 	UpdateWorkspaceAgentMetadata(ctx context.Context, arg UpdateWorkspaceAgentMetadataParams) error
 	UpdateWorkspaceAgentStartupByID(ctx context.Context, arg UpdateWorkspaceAgentStartupByIDParams) error
 	UpdateWorkspaceAppHealthByID(ctx context.Context, arg UpdateWorkspaceAppHealthByIDParams) error
+	UpdateWorkspaceAutomaticUpdates(ctx context.Context, arg UpdateWorkspaceAutomaticUpdatesParams) error
 	UpdateWorkspaceAutostart(ctx context.Context, arg UpdateWorkspaceAutostartParams) error
-	UpdateWorkspaceBuildByID(ctx context.Context, arg UpdateWorkspaceBuildByIDParams) error
 	UpdateWorkspaceBuildCostByID(ctx context.Context, arg UpdateWorkspaceBuildCostByIDParams) error
+	UpdateWorkspaceBuildDeadlineByID(ctx context.Context, arg UpdateWorkspaceBuildDeadlineByIDParams) error
+	UpdateWorkspaceBuildProvisionerStateByID(ctx context.Context, arg UpdateWorkspaceBuildProvisionerStateByIDParams) error
 	UpdateWorkspaceDeletedByID(ctx context.Context, arg UpdateWorkspaceDeletedByIDParams) error
+	UpdateWorkspaceDormantDeletingAt(ctx context.Context, arg UpdateWorkspaceDormantDeletingAtParams) (Workspace, error)
 	UpdateWorkspaceLastUsedAt(ctx context.Context, arg UpdateWorkspaceLastUsedAtParams) error
-	UpdateWorkspaceLockedDeletingAt(ctx context.Context, arg UpdateWorkspaceLockedDeletingAtParams) error
 	// This allows editing the properties of a workspace proxy.
 	UpdateWorkspaceProxy(ctx context.Context, arg UpdateWorkspaceProxyParams) (WorkspaceProxy, error)
 	UpdateWorkspaceProxyDeleted(ctx context.Context, arg UpdateWorkspaceProxyDeletedParams) error
 	UpdateWorkspaceTTL(ctx context.Context, arg UpdateWorkspaceTTLParams) error
-	UpdateWorkspacesDeletingAtByTemplateID(ctx context.Context, arg UpdateWorkspacesDeletingAtByTemplateIDParams) error
+	UpdateWorkspacesDormantDeletingAtByTemplateID(ctx context.Context, arg UpdateWorkspacesDormantDeletingAtByTemplateIDParams) error
 	UpsertAppSecurityKey(ctx context.Context, value string) error
+	UpsertApplicationName(ctx context.Context, value string) error
 	// The default proxy is implied and not actually stored in the database.
 	// So we need to store it's configuration here for display purposes.
 	// The functional values are immutable and controlled implicitly.
@@ -294,6 +353,7 @@ type sqlcQuerier interface {
 	UpsertServiceBanner(ctx context.Context, value string) error
 	UpsertTailnetAgent(ctx context.Context, arg UpsertTailnetAgentParams) (TailnetAgent, error)
 	UpsertTailnetClient(ctx context.Context, arg UpsertTailnetClientParams) (TailnetClient, error)
+	UpsertTailnetClientSubscription(ctx context.Context, arg UpsertTailnetClientSubscriptionParams) error
 	UpsertTailnetCoordinator(ctx context.Context, id uuid.UUID) (TailnetCoordinator, error)
 }
 
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
index 07a81111d64c9..4fd0579aff242 100644
--- a/coderd/database/querier_test.go
+++ b/coderd/database/querier_test.go
@@ -13,10 +13,11 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/database/migrations"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/migrations"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestGetDeploymentWorkspaceAgentStats(t *testing.T) {
@@ -43,7 +44,7 @@ func TestGetDeploymentWorkspaceAgentStats(t *testing.T) {
 			ConnectionMedianLatencyMS: 2,
 			SessionCountVSCode:        1,
 		})
-		stats, err := db.GetDeploymentWorkspaceAgentStats(ctx, database.Now().Add(-time.Hour))
+		stats, err := db.GetDeploymentWorkspaceAgentStats(ctx, dbtime.Now().Add(-time.Hour))
 		require.NoError(t, err)
 
 		require.Equal(t, int64(2), stats.WorkspaceTxBytes)
@@ -62,7 +63,7 @@ func TestGetDeploymentWorkspaceAgentStats(t *testing.T) {
 		db := database.New(sqlDB)
 		ctx := context.Background()
 		agentID := uuid.New()
-		insertTime := database.Now()
+		insertTime := dbtime.Now()
 		dbgen.WorkspaceAgentStat(t, db, database.WorkspaceAgentStat{
 			CreatedAt:                 insertTime.Add(-time.Second),
 			AgentID:                   agentID,
@@ -80,7 +81,7 @@ func TestGetDeploymentWorkspaceAgentStats(t *testing.T) {
 			ConnectionMedianLatencyMS: 2,
 			SessionCountVSCode:        1,
 		})
-		stats, err := db.GetDeploymentWorkspaceAgentStats(ctx, database.Now().Add(-time.Hour))
+		stats, err := db.GetDeploymentWorkspaceAgentStats(ctx, dbtime.Now().Add(-time.Hour))
 		require.NoError(t, err)
 
 		require.Equal(t, int64(2), stats.WorkspaceTxBytes)
@@ -102,7 +103,7 @@ func TestInsertWorkspaceAgentLogs(t *testing.T) {
 	require.NoError(t, err)
 	db := database.New(sqlDB)
 	org := dbgen.Organization(t, db, database.Organization{})
-	job := dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+	job := dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
 		OrganizationID: org.ID,
 	})
 	resource := dbgen.WorkspaceResource(t, db, database.WorkspaceResource{
@@ -111,12 +112,15 @@ func TestInsertWorkspaceAgentLogs(t *testing.T) {
 	agent := dbgen.WorkspaceAgent(t, db, database.WorkspaceAgent{
 		ResourceID: resource.ID,
 	})
+	source := dbgen.WorkspaceAgentLogSource(t, db, database.WorkspaceAgentLogSource{
+		WorkspaceAgentID: agent.ID,
+	})
 	logs, err := db.InsertWorkspaceAgentLogs(ctx, database.InsertWorkspaceAgentLogsParams{
-		AgentID:   agent.ID,
-		CreatedAt: []time.Time{database.Now()},
-		Output:    []string{"first"},
-		Level:     []database.LogLevel{database.LogLevelInfo},
-		Source:    []database.WorkspaceAgentLogSource{database.WorkspaceAgentLogSourceExternal},
+		AgentID:     agent.ID,
+		CreatedAt:   dbtime.Now(),
+		Output:      []string{"first"},
+		Level:       []database.LogLevel{database.LogLevelInfo},
+		LogSourceID: source.ID,
 		// 1 MB is the max
 		OutputLength: 1 << 20,
 	})
@@ -125,10 +129,10 @@ func TestInsertWorkspaceAgentLogs(t *testing.T) {
 
 	_, err = db.InsertWorkspaceAgentLogs(ctx, database.InsertWorkspaceAgentLogsParams{
 		AgentID:      agent.ID,
-		CreatedAt:    []time.Time{database.Now()},
+		CreatedAt:    dbtime.Now(),
 		Output:       []string{"second"},
 		Level:        []database.LogLevel{database.LogLevelInfo},
-		Source:       []database.WorkspaceAgentLogSource{database.WorkspaceAgentLogSourceExternal},
+		LogSourceID:  source.ID,
 		OutputLength: 1,
 	})
 	require.True(t, database.IsWorkspaceAgentLogsLimitError(err))
@@ -334,7 +338,7 @@ func TestQueuePosition(t *testing.T) {
 	jobs := []database.ProvisionerJob{}
 	jobIDs := []uuid.UUID{}
 	for i := 0; i < jobCount; i++ {
-		job := dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		job := dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
 			OrganizationID: org.ID,
 			Tags:           database.StringMap{},
 		})
@@ -360,7 +364,7 @@ func TestQueuePosition(t *testing.T) {
 
 	job, err := db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
 		StartedAt: sql.NullTime{
-			Time:  database.Now(),
+			Time:  dbtime.Now(),
 			Valid: true,
 		},
 		Types: database.AllProvisionerTypeValues(),
@@ -402,7 +406,7 @@ func TestUserLastSeenFilter(t *testing.T) {
 		require.NoError(t, err)
 		db := database.New(sqlDB)
 		ctx := context.Background()
-		now := database.Now()
+		now := dbtime.Now()
 
 		yesterday := dbgen.User(t, db, database.User{
 			LastSeenAt: now.Add(time.Hour * -25),
@@ -490,6 +494,165 @@ func TestUserChangeLoginType(t *testing.T) {
 	require.Equal(t, bobExpPass, bob.HashedPassword, "hashed password should not change")
 }
 
+type tvArgs struct {
+	Status database.ProvisionerJobStatus
+	// CreateWorkspace is true if we should create a workspace for the template version
+	CreateWorkspace     bool
+	WorkspaceTransition database.WorkspaceTransition
+}
+
+// createTemplateVersion is a helper function to create a version with its dependencies.
+func createTemplateVersion(t testing.TB, db database.Store, tpl database.Template, args tvArgs) database.TemplateVersion {
+	t.Helper()
+	version := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+		TemplateID: uuid.NullUUID{
+			UUID:  tpl.ID,
+			Valid: true,
+		},
+		OrganizationID: tpl.OrganizationID,
+		CreatedAt:      dbtime.Now(),
+		UpdatedAt:      dbtime.Now(),
+		CreatedBy:      tpl.CreatedBy,
+	})
+
+	earlier := sql.NullTime{
+		Time:  dbtime.Now().Add(time.Second * -30),
+		Valid: true,
+	}
+	now := sql.NullTime{
+		Time:  dbtime.Now(),
+		Valid: true,
+	}
+	j := database.ProvisionerJob{
+		ID:             version.JobID,
+		CreatedAt:      earlier.Time,
+		UpdatedAt:      earlier.Time,
+		Error:          sql.NullString{},
+		OrganizationID: tpl.OrganizationID,
+		InitiatorID:    tpl.CreatedBy,
+		Type:           database.ProvisionerJobTypeTemplateVersionImport,
+	}
+
+	switch args.Status {
+	case database.ProvisionerJobStatusRunning:
+		j.StartedAt = earlier
+	case database.ProvisionerJobStatusPending:
+	case database.ProvisionerJobStatusFailed:
+		j.StartedAt = earlier
+		j.CompletedAt = now
+		j.Error = sql.NullString{
+			String: "failed",
+			Valid:  true,
+		}
+		j.ErrorCode = sql.NullString{
+			String: "failed",
+			Valid:  true,
+		}
+	case database.ProvisionerJobStatusSucceeded:
+		j.StartedAt = earlier
+		j.CompletedAt = now
+	default:
+		t.Fatalf("invalid status: %s", args.Status)
+	}
+
+	dbgen.ProvisionerJob(t, db, nil, j)
+	if args.CreateWorkspace {
+		wrk := dbgen.Workspace(t, db, database.Workspace{
+			CreatedAt:      time.Time{},
+			UpdatedAt:      time.Time{},
+			OwnerID:        tpl.CreatedBy,
+			OrganizationID: tpl.OrganizationID,
+			TemplateID:     tpl.ID,
+		})
+		trans := database.WorkspaceTransitionStart
+		if args.WorkspaceTransition != "" {
+			trans = args.WorkspaceTransition
+		}
+		buildJob := dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
+			Type:           database.ProvisionerJobTypeWorkspaceBuild,
+			CompletedAt:    now,
+			InitiatorID:    tpl.CreatedBy,
+			OrganizationID: tpl.OrganizationID,
+		})
+		dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
+			WorkspaceID:       wrk.ID,
+			TemplateVersionID: version.ID,
+			BuildNumber:       1,
+			Transition:        trans,
+			InitiatorID:       tpl.CreatedBy,
+			JobID:             buildJob.ID,
+		})
+	}
+	return version
+}
+
+func TestArchiveVersions(t *testing.T) {
+	t.Parallel()
+	if testing.Short() {
+		t.SkipNow()
+	}
+
+	t.Run("ArchiveFailedVersions", func(t *testing.T) {
+		t.Parallel()
+		sqlDB := testSQLDB(t)
+		err := migrations.Up(sqlDB)
+		require.NoError(t, err)
+		db := database.New(sqlDB)
+		ctx := context.Background()
+
+		org := dbgen.Organization(t, db, database.Organization{})
+		user := dbgen.User(t, db, database.User{})
+		tpl := dbgen.Template(t, db, database.Template{
+			OrganizationID: org.ID,
+			CreatedBy:      user.ID,
+		})
+		// Create some versions
+		failed := createTemplateVersion(t, db, tpl, tvArgs{
+			Status:          database.ProvisionerJobStatusFailed,
+			CreateWorkspace: false,
+		})
+		unused := createTemplateVersion(t, db, tpl, tvArgs{
+			Status:          database.ProvisionerJobStatusSucceeded,
+			CreateWorkspace: false,
+		})
+		createTemplateVersion(t, db, tpl, tvArgs{
+			Status:          database.ProvisionerJobStatusSucceeded,
+			CreateWorkspace: true,
+		})
+		deleted := createTemplateVersion(t, db, tpl, tvArgs{
+			Status:              database.ProvisionerJobStatusSucceeded,
+			CreateWorkspace:     true,
+			WorkspaceTransition: database.WorkspaceTransitionDelete,
+		})
+
+		// Now archive failed versions
+		archived, err := db.ArchiveUnusedTemplateVersions(ctx, database.ArchiveUnusedTemplateVersionsParams{
+			UpdatedAt:  dbtime.Now(),
+			TemplateID: tpl.ID,
+			// All versions
+			TemplateVersionID: uuid.Nil,
+			JobStatus: database.NullProvisionerJobStatus{
+				ProvisionerJobStatus: database.ProvisionerJobStatusFailed,
+				Valid:                true,
+			},
+		})
+		require.NoError(t, err, "archive failed versions")
+		require.Len(t, archived, 1, "should only archive one version")
+		require.Equal(t, failed.ID, archived[0], "should archive failed version")
+
+		// Archive all unused versions
+		archived, err = db.ArchiveUnusedTemplateVersions(ctx, database.ArchiveUnusedTemplateVersionsParams{
+			UpdatedAt:  dbtime.Now(),
+			TemplateID: tpl.ID,
+			// All versions
+			TemplateVersionID: uuid.Nil,
+		})
+		require.NoError(t, err, "archive failed versions")
+		require.Len(t, archived, 2)
+		require.ElementsMatch(t, []uuid.UUID{deleted.ID, unused.ID}, archived, "should archive unused versions")
+	})
+}
+
 func requireUsersMatch(t testing.TB, expected []database.User, found []database.GetUsersRow, msg string) {
 	t.Helper()
 	require.ElementsMatch(t, expected, database.ConvertUserRows(found), msg)
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index ff22cc3120193..b1eb3af14719e 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -1,6 +1,6 @@
 // Code generated by sqlc. DO NOT EDIT.
 // versions:
-//   sqlc v1.19.1
+//   sqlc v1.20.0
 
 package database
 
@@ -15,6 +15,62 @@ import (
 	"github.com/sqlc-dev/pqtype"
 )
 
+const activityBumpWorkspace = `-- name: ActivityBumpWorkspace :exec
+WITH latest AS (
+	SELECT
+		workspace_builds.id::uuid AS build_id,
+		workspace_builds.deadline::timestamp with time zone AS build_deadline,
+		workspace_builds.max_deadline::timestamp with time zone AS build_max_deadline,
+		workspace_builds.transition AS build_transition,
+		provisioner_jobs.completed_at::timestamp with time zone AS job_completed_at,
+		(
+			CASE
+				WHEN templates.allow_user_autostop
+				THEN (workspaces.ttl / 1000 / 1000 / 1000 || ' seconds')::interval
+				ELSE (templates.default_ttl / 1000 / 1000 / 1000 || ' seconds')::interval
+			END
+		) AS ttl_interval
+	FROM workspace_builds
+	JOIN provisioner_jobs
+		ON provisioner_jobs.id = workspace_builds.job_id
+	JOIN workspaces
+		ON workspaces.id = workspace_builds.workspace_id
+	JOIN templates
+		ON templates.id = workspaces.template_id
+	WHERE workspace_builds.workspace_id = $1::uuid
+	ORDER BY workspace_builds.build_number DESC
+	LIMIT 1
+)
+UPDATE
+	workspace_builds wb
+SET
+	updated_at = NOW(),
+	deadline = CASE
+		WHEN l.build_max_deadline = '0001-01-01 00:00:00+00'
+		THEN NOW() + l.ttl_interval
+		ELSE LEAST(NOW() + l.ttl_interval, l.build_max_deadline)
+	END
+FROM latest l
+WHERE wb.id = l.build_id
+AND l.job_completed_at IS NOT NULL
+AND l.build_transition = 'start'
+AND l.ttl_interval > '0 seconds'::interval
+AND l.build_deadline != '0001-01-01 00:00:00+00'
+AND l.build_deadline - (l.ttl_interval * 0.95) < NOW()
+`
+
+// We bump by the original TTL to prevent counter-intuitive behavior
+// as the TTL wraps. For example, if I set the TTL to 12 hours, sign off
+// work at midnight, come back at 10am, I would want another full day
+// of uptime.
+// We only bump if the raw interval is positive and non-zero.
+// We only bump if workspace shutdown is manual.
+// We only bump when 5% of the deadline has elapsed.
+func (q *sqlQuerier) ActivityBumpWorkspace(ctx context.Context, workspaceID uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, activityBumpWorkspace, workspaceID)
+	return err
+}
+
 const deleteAPIKeyByID = `-- name: DeleteAPIKeyByID :exec
 DELETE FROM
 	api_keys
@@ -636,6 +692,259 @@ func (q *sqlQuerier) InsertAuditLog(ctx context.Context, arg InsertAuditLogParam
 	return i, err
 }
 
+const getDBCryptKeys = `-- name: GetDBCryptKeys :many
+SELECT number, active_key_digest, revoked_key_digest, created_at, revoked_at, test FROM dbcrypt_keys ORDER BY number ASC
+`
+
+func (q *sqlQuerier) GetDBCryptKeys(ctx context.Context) ([]DBCryptKey, error) {
+	rows, err := q.db.QueryContext(ctx, getDBCryptKeys)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []DBCryptKey
+	for rows.Next() {
+		var i DBCryptKey
+		if err := rows.Scan(
+			&i.Number,
+			&i.ActiveKeyDigest,
+			&i.RevokedKeyDigest,
+			&i.CreatedAt,
+			&i.RevokedAt,
+			&i.Test,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const insertDBCryptKey = `-- name: InsertDBCryptKey :exec
+INSERT INTO dbcrypt_keys
+	(number, active_key_digest, created_at, test)
+VALUES ($1::int, $2::text, CURRENT_TIMESTAMP, $3::text)
+`
+
+type InsertDBCryptKeyParams struct {
+	Number          int32  `db:"number" json:"number"`
+	ActiveKeyDigest string `db:"active_key_digest" json:"active_key_digest"`
+	Test            string `db:"test" json:"test"`
+}
+
+func (q *sqlQuerier) InsertDBCryptKey(ctx context.Context, arg InsertDBCryptKeyParams) error {
+	_, err := q.db.ExecContext(ctx, insertDBCryptKey, arg.Number, arg.ActiveKeyDigest, arg.Test)
+	return err
+}
+
+const revokeDBCryptKey = `-- name: RevokeDBCryptKey :exec
+UPDATE dbcrypt_keys
+SET
+	revoked_key_digest = active_key_digest,
+	active_key_digest = revoked_key_digest,
+	revoked_at = CURRENT_TIMESTAMP
+WHERE
+	active_key_digest = $1::text
+AND
+	revoked_key_digest IS NULL
+`
+
+func (q *sqlQuerier) RevokeDBCryptKey(ctx context.Context, activeKeyDigest string) error {
+	_, err := q.db.ExecContext(ctx, revokeDBCryptKey, activeKeyDigest)
+	return err
+}
+
+const getExternalAuthLink = `-- name: GetExternalAuthLink :one
+SELECT provider_id, user_id, created_at, updated_at, oauth_access_token, oauth_refresh_token, oauth_expiry, oauth_access_token_key_id, oauth_refresh_token_key_id, oauth_extra FROM external_auth_links WHERE provider_id = $1 AND user_id = $2
+`
+
+type GetExternalAuthLinkParams struct {
+	ProviderID string    `db:"provider_id" json:"provider_id"`
+	UserID     uuid.UUID `db:"user_id" json:"user_id"`
+}
+
+func (q *sqlQuerier) GetExternalAuthLink(ctx context.Context, arg GetExternalAuthLinkParams) (ExternalAuthLink, error) {
+	row := q.db.QueryRowContext(ctx, getExternalAuthLink, arg.ProviderID, arg.UserID)
+	var i ExternalAuthLink
+	err := row.Scan(
+		&i.ProviderID,
+		&i.UserID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.OAuthAccessToken,
+		&i.OAuthRefreshToken,
+		&i.OAuthExpiry,
+		&i.OAuthAccessTokenKeyID,
+		&i.OAuthRefreshTokenKeyID,
+		&i.OAuthExtra,
+	)
+	return i, err
+}
+
+const getExternalAuthLinksByUserID = `-- name: GetExternalAuthLinksByUserID :many
+SELECT provider_id, user_id, created_at, updated_at, oauth_access_token, oauth_refresh_token, oauth_expiry, oauth_access_token_key_id, oauth_refresh_token_key_id, oauth_extra FROM external_auth_links WHERE user_id = $1
+`
+
+func (q *sqlQuerier) GetExternalAuthLinksByUserID(ctx context.Context, userID uuid.UUID) ([]ExternalAuthLink, error) {
+	rows, err := q.db.QueryContext(ctx, getExternalAuthLinksByUserID, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []ExternalAuthLink
+	for rows.Next() {
+		var i ExternalAuthLink
+		if err := rows.Scan(
+			&i.ProviderID,
+			&i.UserID,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.OAuthAccessToken,
+			&i.OAuthRefreshToken,
+			&i.OAuthExpiry,
+			&i.OAuthAccessTokenKeyID,
+			&i.OAuthRefreshTokenKeyID,
+			&i.OAuthExtra,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const insertExternalAuthLink = `-- name: InsertExternalAuthLink :one
+INSERT INTO external_auth_links (
+    provider_id,
+    user_id,
+    created_at,
+    updated_at,
+    oauth_access_token,
+    oauth_access_token_key_id,
+    oauth_refresh_token,
+    oauth_refresh_token_key_id,
+    oauth_expiry,
+	oauth_extra
+) VALUES (
+    $1,
+    $2,
+    $3,
+    $4,
+    $5,
+    $6,
+    $7,
+    $8,
+    $9,
+	$10
+) RETURNING provider_id, user_id, created_at, updated_at, oauth_access_token, oauth_refresh_token, oauth_expiry, oauth_access_token_key_id, oauth_refresh_token_key_id, oauth_extra
+`
+
+type InsertExternalAuthLinkParams struct {
+	ProviderID             string                `db:"provider_id" json:"provider_id"`
+	UserID                 uuid.UUID             `db:"user_id" json:"user_id"`
+	CreatedAt              time.Time             `db:"created_at" json:"created_at"`
+	UpdatedAt              time.Time             `db:"updated_at" json:"updated_at"`
+	OAuthAccessToken       string                `db:"oauth_access_token" json:"oauth_access_token"`
+	OAuthAccessTokenKeyID  sql.NullString        `db:"oauth_access_token_key_id" json:"oauth_access_token_key_id"`
+	OAuthRefreshToken      string                `db:"oauth_refresh_token" json:"oauth_refresh_token"`
+	OAuthRefreshTokenKeyID sql.NullString        `db:"oauth_refresh_token_key_id" json:"oauth_refresh_token_key_id"`
+	OAuthExpiry            time.Time             `db:"oauth_expiry" json:"oauth_expiry"`
+	OAuthExtra             pqtype.NullRawMessage `db:"oauth_extra" json:"oauth_extra"`
+}
+
+func (q *sqlQuerier) InsertExternalAuthLink(ctx context.Context, arg InsertExternalAuthLinkParams) (ExternalAuthLink, error) {
+	row := q.db.QueryRowContext(ctx, insertExternalAuthLink,
+		arg.ProviderID,
+		arg.UserID,
+		arg.CreatedAt,
+		arg.UpdatedAt,
+		arg.OAuthAccessToken,
+		arg.OAuthAccessTokenKeyID,
+		arg.OAuthRefreshToken,
+		arg.OAuthRefreshTokenKeyID,
+		arg.OAuthExpiry,
+		arg.OAuthExtra,
+	)
+	var i ExternalAuthLink
+	err := row.Scan(
+		&i.ProviderID,
+		&i.UserID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.OAuthAccessToken,
+		&i.OAuthRefreshToken,
+		&i.OAuthExpiry,
+		&i.OAuthAccessTokenKeyID,
+		&i.OAuthRefreshTokenKeyID,
+		&i.OAuthExtra,
+	)
+	return i, err
+}
+
+const updateExternalAuthLink = `-- name: UpdateExternalAuthLink :one
+UPDATE external_auth_links SET
+    updated_at = $3,
+    oauth_access_token = $4,
+    oauth_access_token_key_id = $5,
+    oauth_refresh_token = $6,
+    oauth_refresh_token_key_id = $7,
+    oauth_expiry = $8,
+	oauth_extra = $9
+WHERE provider_id = $1 AND user_id = $2 RETURNING provider_id, user_id, created_at, updated_at, oauth_access_token, oauth_refresh_token, oauth_expiry, oauth_access_token_key_id, oauth_refresh_token_key_id, oauth_extra
+`
+
+type UpdateExternalAuthLinkParams struct {
+	ProviderID             string                `db:"provider_id" json:"provider_id"`
+	UserID                 uuid.UUID             `db:"user_id" json:"user_id"`
+	UpdatedAt              time.Time             `db:"updated_at" json:"updated_at"`
+	OAuthAccessToken       string                `db:"oauth_access_token" json:"oauth_access_token"`
+	OAuthAccessTokenKeyID  sql.NullString        `db:"oauth_access_token_key_id" json:"oauth_access_token_key_id"`
+	OAuthRefreshToken      string                `db:"oauth_refresh_token" json:"oauth_refresh_token"`
+	OAuthRefreshTokenKeyID sql.NullString        `db:"oauth_refresh_token_key_id" json:"oauth_refresh_token_key_id"`
+	OAuthExpiry            time.Time             `db:"oauth_expiry" json:"oauth_expiry"`
+	OAuthExtra             pqtype.NullRawMessage `db:"oauth_extra" json:"oauth_extra"`
+}
+
+func (q *sqlQuerier) UpdateExternalAuthLink(ctx context.Context, arg UpdateExternalAuthLinkParams) (ExternalAuthLink, error) {
+	row := q.db.QueryRowContext(ctx, updateExternalAuthLink,
+		arg.ProviderID,
+		arg.UserID,
+		arg.UpdatedAt,
+		arg.OAuthAccessToken,
+		arg.OAuthAccessTokenKeyID,
+		arg.OAuthRefreshToken,
+		arg.OAuthRefreshTokenKeyID,
+		arg.OAuthExpiry,
+		arg.OAuthExtra,
+	)
+	var i ExternalAuthLink
+	err := row.Scan(
+		&i.ProviderID,
+		&i.UserID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.OAuthAccessToken,
+		&i.OAuthRefreshToken,
+		&i.OAuthExpiry,
+		&i.OAuthAccessTokenKeyID,
+		&i.OAuthRefreshTokenKeyID,
+		&i.OAuthExtra,
+	)
+	return i, err
+}
+
 const getFileByHashAndCreator = `-- name: GetFileByHashAndCreator :one
 SELECT
 	hash, created_at, created_by, mimetype, data, id
@@ -799,123 +1108,6 @@ func (q *sqlQuerier) InsertFile(ctx context.Context, arg InsertFileParams) (File
 	return i, err
 }
 
-const getGitAuthLink = `-- name: GetGitAuthLink :one
-SELECT provider_id, user_id, created_at, updated_at, oauth_access_token, oauth_refresh_token, oauth_expiry FROM git_auth_links WHERE provider_id = $1 AND user_id = $2
-`
-
-type GetGitAuthLinkParams struct {
-	ProviderID string    `db:"provider_id" json:"provider_id"`
-	UserID     uuid.UUID `db:"user_id" json:"user_id"`
-}
-
-func (q *sqlQuerier) GetGitAuthLink(ctx context.Context, arg GetGitAuthLinkParams) (GitAuthLink, error) {
-	row := q.db.QueryRowContext(ctx, getGitAuthLink, arg.ProviderID, arg.UserID)
-	var i GitAuthLink
-	err := row.Scan(
-		&i.ProviderID,
-		&i.UserID,
-		&i.CreatedAt,
-		&i.UpdatedAt,
-		&i.OAuthAccessToken,
-		&i.OAuthRefreshToken,
-		&i.OAuthExpiry,
-	)
-	return i, err
-}
-
-const insertGitAuthLink = `-- name: InsertGitAuthLink :one
-INSERT INTO git_auth_links (
-    provider_id,
-    user_id,
-    created_at,
-    updated_at,
-    oauth_access_token,
-    oauth_refresh_token,
-    oauth_expiry
-) VALUES (
-    $1,
-    $2,
-    $3,
-    $4,
-    $5,
-    $6,
-    $7
-) RETURNING provider_id, user_id, created_at, updated_at, oauth_access_token, oauth_refresh_token, oauth_expiry
-`
-
-type InsertGitAuthLinkParams struct {
-	ProviderID        string    `db:"provider_id" json:"provider_id"`
-	UserID            uuid.UUID `db:"user_id" json:"user_id"`
-	CreatedAt         time.Time `db:"created_at" json:"created_at"`
-	UpdatedAt         time.Time `db:"updated_at" json:"updated_at"`
-	OAuthAccessToken  string    `db:"oauth_access_token" json:"oauth_access_token"`
-	OAuthRefreshToken string    `db:"oauth_refresh_token" json:"oauth_refresh_token"`
-	OAuthExpiry       time.Time `db:"oauth_expiry" json:"oauth_expiry"`
-}
-
-func (q *sqlQuerier) InsertGitAuthLink(ctx context.Context, arg InsertGitAuthLinkParams) (GitAuthLink, error) {
-	row := q.db.QueryRowContext(ctx, insertGitAuthLink,
-		arg.ProviderID,
-		arg.UserID,
-		arg.CreatedAt,
-		arg.UpdatedAt,
-		arg.OAuthAccessToken,
-		arg.OAuthRefreshToken,
-		arg.OAuthExpiry,
-	)
-	var i GitAuthLink
-	err := row.Scan(
-		&i.ProviderID,
-		&i.UserID,
-		&i.CreatedAt,
-		&i.UpdatedAt,
-		&i.OAuthAccessToken,
-		&i.OAuthRefreshToken,
-		&i.OAuthExpiry,
-	)
-	return i, err
-}
-
-const updateGitAuthLink = `-- name: UpdateGitAuthLink :one
-UPDATE git_auth_links SET
-    updated_at = $3,
-    oauth_access_token = $4,
-    oauth_refresh_token = $5,
-    oauth_expiry = $6
-WHERE provider_id = $1 AND user_id = $2 RETURNING provider_id, user_id, created_at, updated_at, oauth_access_token, oauth_refresh_token, oauth_expiry
-`
-
-type UpdateGitAuthLinkParams struct {
-	ProviderID        string    `db:"provider_id" json:"provider_id"`
-	UserID            uuid.UUID `db:"user_id" json:"user_id"`
-	UpdatedAt         time.Time `db:"updated_at" json:"updated_at"`
-	OAuthAccessToken  string    `db:"oauth_access_token" json:"oauth_access_token"`
-	OAuthRefreshToken string    `db:"oauth_refresh_token" json:"oauth_refresh_token"`
-	OAuthExpiry       time.Time `db:"oauth_expiry" json:"oauth_expiry"`
-}
-
-func (q *sqlQuerier) UpdateGitAuthLink(ctx context.Context, arg UpdateGitAuthLinkParams) (GitAuthLink, error) {
-	row := q.db.QueryRowContext(ctx, updateGitAuthLink,
-		arg.ProviderID,
-		arg.UserID,
-		arg.UpdatedAt,
-		arg.OAuthAccessToken,
-		arg.OAuthRefreshToken,
-		arg.OAuthExpiry,
-	)
-	var i GitAuthLink
-	err := row.Scan(
-		&i.ProviderID,
-		&i.UserID,
-		&i.CreatedAt,
-		&i.UpdatedAt,
-		&i.OAuthAccessToken,
-		&i.OAuthRefreshToken,
-		&i.OAuthExpiry,
-	)
-	return i, err
-}
-
 const deleteGitSSHKey = `-- name: DeleteGitSSHKey :exec
 DELETE FROM
 	gitsshkeys
@@ -1069,18 +1261,27 @@ SELECT
 	users.id, users.email, users.username, users.hashed_password, users.created_at, users.updated_at, users.status, users.rbac_roles, users.login_type, users.avatar_url, users.deleted, users.last_seen_at, users.quiet_hours_schedule
 FROM
 	users
-JOIN
+LEFT JOIN
 	group_members
 ON
-	users.id = group_members.user_id
-WHERE
+	group_members.user_id = users.id AND
 	group_members.group_id = $1
-AND
-	users.status = 'active'
+LEFT JOIN
+	organization_members
+ON
+	organization_members.user_id = users.id AND
+	organization_members.organization_id = $1
+WHERE
+	-- In either case, the group_id will only match an org or a group.
+    (group_members.group_id = $1
+         OR
+     organization_members.organization_id = $1)
 AND
 	users.deleted = 'false'
 `
 
+// If the group is a user made group, then we need to check the group_members table.
+// If it is the "Everyone" group, then we need to check the organization_members table.
 func (q *sqlQuerier) GetGroupMembers(ctx context.Context, groupID uuid.UUID) ([]User, error) {
 	rows, err := q.db.QueryContext(ctx, getGroupMembers, groupID)
 	if err != nil {
@@ -1180,7 +1381,7 @@ func (q *sqlQuerier) DeleteGroupByID(ctx context.Context, id uuid.UUID) error {
 
 const getGroupByID = `-- name: GetGroupByID :one
 SELECT
-	id, name, organization_id, avatar_url, quota_allowance, display_name
+	id, name, organization_id, avatar_url, quota_allowance, display_name, source
 FROM
 	groups
 WHERE
@@ -1199,13 +1400,14 @@ func (q *sqlQuerier) GetGroupByID(ctx context.Context, id uuid.UUID) (Group, err
 		&i.AvatarURL,
 		&i.QuotaAllowance,
 		&i.DisplayName,
+		&i.Source,
 	)
 	return i, err
 }
 
 const getGroupByOrgAndName = `-- name: GetGroupByOrgAndName :one
 SELECT
-	id, name, organization_id, avatar_url, quota_allowance, display_name
+	id, name, organization_id, avatar_url, quota_allowance, display_name, source
 FROM
 	groups
 WHERE
@@ -1231,19 +1433,18 @@ func (q *sqlQuerier) GetGroupByOrgAndName(ctx context.Context, arg GetGroupByOrg
 		&i.AvatarURL,
 		&i.QuotaAllowance,
 		&i.DisplayName,
+		&i.Source,
 	)
 	return i, err
 }
 
 const getGroupsByOrganizationID = `-- name: GetGroupsByOrganizationID :many
 SELECT
-	id, name, organization_id, avatar_url, quota_allowance, display_name
+	id, name, organization_id, avatar_url, quota_allowance, display_name, source
 FROM
 	groups
 WHERE
 	organization_id = $1
-AND
-	id != $1
 `
 
 func (q *sqlQuerier) GetGroupsByOrganizationID(ctx context.Context, organizationID uuid.UUID) ([]Group, error) {
@@ -1262,6 +1463,7 @@ func (q *sqlQuerier) GetGroupsByOrganizationID(ctx context.Context, organization
 			&i.AvatarURL,
 			&i.QuotaAllowance,
 			&i.DisplayName,
+			&i.Source,
 		); err != nil {
 			return nil, err
 		}
@@ -1283,7 +1485,7 @@ INSERT INTO groups (
 	organization_id
 )
 VALUES
-	($1, 'Everyone', $1) RETURNING id, name, organization_id, avatar_url, quota_allowance, display_name
+	($1, 'Everyone', $1) RETURNING id, name, organization_id, avatar_url, quota_allowance, display_name, source
 `
 
 // We use the organization_id as the id
@@ -1299,6 +1501,7 @@ func (q *sqlQuerier) InsertAllUsersGroup(ctx context.Context, organizationID uui
 		&i.AvatarURL,
 		&i.QuotaAllowance,
 		&i.DisplayName,
+		&i.Source,
 	)
 	return i, err
 }
@@ -1313,7 +1516,7 @@ INSERT INTO groups (
 	quota_allowance
 )
 VALUES
-	($1, $2, $3, $4, $5, $6) RETURNING id, name, organization_id, avatar_url, quota_allowance, display_name
+	($1, $2, $3, $4, $5, $6) RETURNING id, name, organization_id, avatar_url, quota_allowance, display_name, source
 `
 
 type InsertGroupParams struct {
@@ -1342,10 +1545,70 @@ func (q *sqlQuerier) InsertGroup(ctx context.Context, arg InsertGroupParams) (Gr
 		&i.AvatarURL,
 		&i.QuotaAllowance,
 		&i.DisplayName,
+		&i.Source,
 	)
 	return i, err
 }
 
+const insertMissingGroups = `-- name: InsertMissingGroups :many
+INSERT INTO groups (
+	id,
+	name,
+	organization_id,
+    source
+)
+SELECT
+    gen_random_uuid(),
+    group_name,
+    $1,
+    $2
+FROM
+    UNNEST($3 :: text[]) AS group_name
+ON CONFLICT DO NOTHING
+RETURNING id, name, organization_id, avatar_url, quota_allowance, display_name, source
+`
+
+type InsertMissingGroupsParams struct {
+	OrganizationID uuid.UUID   `db:"organization_id" json:"organization_id"`
+	Source         GroupSource `db:"source" json:"source"`
+	GroupNames     []string    `db:"group_names" json:"group_names"`
+}
+
+// Inserts any group by name that does not exist. All new groups are given
+// a random uuid, are inserted into the same organization. They have the default
+// values for avatar, display name, and quota allowance (all zero values).
+// If the name conflicts, do nothing.
+func (q *sqlQuerier) InsertMissingGroups(ctx context.Context, arg InsertMissingGroupsParams) ([]Group, error) {
+	rows, err := q.db.QueryContext(ctx, insertMissingGroups, arg.OrganizationID, arg.Source, pq.Array(arg.GroupNames))
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []Group
+	for rows.Next() {
+		var i Group
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.OrganizationID,
+			&i.AvatarURL,
+			&i.QuotaAllowance,
+			&i.DisplayName,
+			&i.Source,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const updateGroupByID = `-- name: UpdateGroupByID :one
 UPDATE
 	groups
@@ -1356,7 +1619,7 @@ SET
 	quota_allowance = $4
 WHERE
 	id = $5
-RETURNING id, name, organization_id, avatar_url, quota_allowance, display_name
+RETURNING id, name, organization_id, avatar_url, quota_allowance, display_name, source
 `
 
 type UpdateGroupByIDParams struct {
@@ -1367,98 +1630,292 @@ type UpdateGroupByIDParams struct {
 	ID             uuid.UUID `db:"id" json:"id"`
 }
 
-func (q *sqlQuerier) UpdateGroupByID(ctx context.Context, arg UpdateGroupByIDParams) (Group, error) {
-	row := q.db.QueryRowContext(ctx, updateGroupByID,
-		arg.Name,
-		arg.DisplayName,
-		arg.AvatarURL,
-		arg.QuotaAllowance,
-		arg.ID,
-	)
-	var i Group
+func (q *sqlQuerier) UpdateGroupByID(ctx context.Context, arg UpdateGroupByIDParams) (Group, error) {
+	row := q.db.QueryRowContext(ctx, updateGroupByID,
+		arg.Name,
+		arg.DisplayName,
+		arg.AvatarURL,
+		arg.QuotaAllowance,
+		arg.ID,
+	)
+	var i Group
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.OrganizationID,
+		&i.AvatarURL,
+		&i.QuotaAllowance,
+		&i.DisplayName,
+		&i.Source,
+	)
+	return i, err
+}
+
+const getTemplateAppInsights = `-- name: GetTemplateAppInsights :many
+WITH app_stats_by_user_and_agent AS (
+	SELECT
+		s.start_time,
+		60 as seconds,
+		w.template_id,
+		was.user_id,
+		was.agent_id,
+		was.access_method,
+		was.slug_or_port,
+		wa.display_name,
+		wa.icon,
+		(wa.slug IS NOT NULL)::boolean AS is_app
+	FROM workspace_app_stats was
+	JOIN workspaces w ON (
+		w.id = was.workspace_id
+		AND CASE WHEN COALESCE(array_length($1::uuid[], 1), 0) > 0 THEN w.template_id = ANY($1::uuid[]) ELSE TRUE END
+	)
+	-- We do a left join here because we want to include user IDs that have used
+	-- e.g. ports when counting active users.
+	LEFT JOIN workspace_apps wa ON (
+		wa.agent_id = was.agent_id
+		AND wa.slug = was.slug_or_port
+	)
+	-- This table contains both 1 minute entries and >1 minute entries,
+	-- to calculate this with our uniqueness constraints, we generate series
+	-- for the longer intervals.
+	CROSS JOIN LATERAL generate_series(
+		date_trunc('minute', was.session_started_at),
+		-- Subtract 1 microsecond to avoid creating an extra series.
+		date_trunc('minute', was.session_ended_at - '1 microsecond'::interval),
+		'1 minute'::interval
+	) s(start_time)
+	WHERE
+		s.start_time >= $2::timestamptz
+		-- Subtract one minute because the series only contains the start time.
+		AND s.start_time < ($3::timestamptz) - '1 minute'::interval
+	GROUP BY s.start_time, w.template_id, was.user_id, was.agent_id, was.access_method, was.slug_or_port, wa.display_name, wa.icon, wa.slug
+)
+
+SELECT
+	array_agg(DISTINCT template_id)::uuid[] AS template_ids,
+	-- Return IDs so we can combine this with GetTemplateInsights.
+	array_agg(DISTINCT user_id)::uuid[] AS active_user_ids,
+	access_method,
+	slug_or_port,
+	display_name,
+	icon,
+	is_app,
+	SUM(seconds) AS usage_seconds
+FROM app_stats_by_user_and_agent
+GROUP BY access_method, slug_or_port, display_name, icon, is_app
+`
+
+type GetTemplateAppInsightsParams struct {
+	TemplateIDs []uuid.UUID `db:"template_ids" json:"template_ids"`
+	StartTime   time.Time   `db:"start_time" json:"start_time"`
+	EndTime     time.Time   `db:"end_time" json:"end_time"`
+}
+
+type GetTemplateAppInsightsRow struct {
+	TemplateIDs   []uuid.UUID    `db:"template_ids" json:"template_ids"`
+	ActiveUserIDs []uuid.UUID    `db:"active_user_ids" json:"active_user_ids"`
+	AccessMethod  string         `db:"access_method" json:"access_method"`
+	SlugOrPort    string         `db:"slug_or_port" json:"slug_or_port"`
+	DisplayName   sql.NullString `db:"display_name" json:"display_name"`
+	Icon          sql.NullString `db:"icon" json:"icon"`
+	IsApp         bool           `db:"is_app" json:"is_app"`
+	UsageSeconds  int64          `db:"usage_seconds" json:"usage_seconds"`
+}
+
+// GetTemplateAppInsights returns the aggregate usage of each app in a given
+// timeframe. The result can be filtered on template_ids, meaning only user data
+// from workspaces based on those templates will be included.
+func (q *sqlQuerier) GetTemplateAppInsights(ctx context.Context, arg GetTemplateAppInsightsParams) ([]GetTemplateAppInsightsRow, error) {
+	rows, err := q.db.QueryContext(ctx, getTemplateAppInsights, pq.Array(arg.TemplateIDs), arg.StartTime, arg.EndTime)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []GetTemplateAppInsightsRow
+	for rows.Next() {
+		var i GetTemplateAppInsightsRow
+		if err := rows.Scan(
+			pq.Array(&i.TemplateIDs),
+			pq.Array(&i.ActiveUserIDs),
+			&i.AccessMethod,
+			&i.SlugOrPort,
+			&i.DisplayName,
+			&i.Icon,
+			&i.IsApp,
+			&i.UsageSeconds,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getTemplateInsights = `-- name: GetTemplateInsights :one
+WITH agent_stats_by_interval_and_user AS (
+	SELECT
+		date_trunc('minute', was.created_at),
+		was.user_id,
+		array_agg(was.template_id) AS template_ids,
+		CASE WHEN SUM(was.session_count_vscode) > 0 THEN 60 ELSE 0 END AS usage_vscode_seconds,
+		CASE WHEN SUM(was.session_count_jetbrains) > 0 THEN 60 ELSE 0 END AS usage_jetbrains_seconds,
+		CASE WHEN SUM(was.session_count_reconnecting_pty) > 0 THEN 60 ELSE 0 END AS usage_reconnecting_pty_seconds,
+		CASE WHEN SUM(was.session_count_ssh) > 0 THEN 60 ELSE 0 END AS usage_ssh_seconds
+	FROM workspace_agent_stats was
+	WHERE
+		was.created_at >= $1::timestamptz
+		AND was.created_at < $2::timestamptz
+		AND was.connection_count > 0
+		AND CASE WHEN COALESCE(array_length($3::uuid[], 1), 0) > 0 THEN was.template_id = ANY($3::uuid[]) ELSE TRUE END
+	GROUP BY date_trunc('minute', was.created_at), was.user_id
+), template_ids AS (
+	SELECT array_agg(DISTINCT template_id) AS ids
+	FROM agent_stats_by_interval_and_user, unnest(template_ids) template_id
+	WHERE template_id IS NOT NULL
+)
+
+SELECT
+	COALESCE((SELECT ids FROM template_ids), '{}')::uuid[] AS template_ids,
+	-- Return IDs so we can combine this with GetTemplateAppInsights.
+	COALESCE(array_agg(DISTINCT user_id), '{}')::uuid[] AS active_user_ids,
+	COALESCE(SUM(usage_vscode_seconds), 0)::bigint AS usage_vscode_seconds,
+	COALESCE(SUM(usage_jetbrains_seconds), 0)::bigint AS usage_jetbrains_seconds,
+	COALESCE(SUM(usage_reconnecting_pty_seconds), 0)::bigint AS usage_reconnecting_pty_seconds,
+	COALESCE(SUM(usage_ssh_seconds), 0)::bigint AS usage_ssh_seconds
+FROM agent_stats_by_interval_and_user
+`
+
+type GetTemplateInsightsParams struct {
+	StartTime   time.Time   `db:"start_time" json:"start_time"`
+	EndTime     time.Time   `db:"end_time" json:"end_time"`
+	TemplateIDs []uuid.UUID `db:"template_ids" json:"template_ids"`
+}
+
+type GetTemplateInsightsRow struct {
+	TemplateIDs                 []uuid.UUID `db:"template_ids" json:"template_ids"`
+	ActiveUserIDs               []uuid.UUID `db:"active_user_ids" json:"active_user_ids"`
+	UsageVscodeSeconds          int64       `db:"usage_vscode_seconds" json:"usage_vscode_seconds"`
+	UsageJetbrainsSeconds       int64       `db:"usage_jetbrains_seconds" json:"usage_jetbrains_seconds"`
+	UsageReconnectingPtySeconds int64       `db:"usage_reconnecting_pty_seconds" json:"usage_reconnecting_pty_seconds"`
+	UsageSshSeconds             int64       `db:"usage_ssh_seconds" json:"usage_ssh_seconds"`
+}
+
+// GetTemplateInsights has a granularity of 5 minutes where if a session/app was
+// in use during a minute, we will add 5 minutes to the total usage for that
+// session/app (per user).
+func (q *sqlQuerier) GetTemplateInsights(ctx context.Context, arg GetTemplateInsightsParams) (GetTemplateInsightsRow, error) {
+	row := q.db.QueryRowContext(ctx, getTemplateInsights, arg.StartTime, arg.EndTime, pq.Array(arg.TemplateIDs))
+	var i GetTemplateInsightsRow
 	err := row.Scan(
-		&i.ID,
-		&i.Name,
-		&i.OrganizationID,
-		&i.AvatarURL,
-		&i.QuotaAllowance,
-		&i.DisplayName,
+		pq.Array(&i.TemplateIDs),
+		pq.Array(&i.ActiveUserIDs),
+		&i.UsageVscodeSeconds,
+		&i.UsageJetbrainsSeconds,
+		&i.UsageReconnectingPtySeconds,
+		&i.UsageSshSeconds,
 	)
 	return i, err
 }
 
-const getTemplateDailyInsights = `-- name: GetTemplateDailyInsights :many
-WITH d AS (
-	-- sqlc workaround, use SELECT generate_series instead of SELECT * FROM generate_series.
-	-- Subtract 1 second from end_time to avoid including the next interval in the results.
-	SELECT generate_series($1::timestamptz, ($2::timestamptz) - '1 second'::interval, '1 day'::interval) AS d
-), ts AS (
+const getTemplateInsightsByInterval = `-- name: GetTemplateInsightsByInterval :many
+WITH ts AS (
 	SELECT
 		d::timestamptz AS from_,
-		CASE WHEN (d + '1 day'::interval)::timestamptz <= $2::timestamptz THEN (d + '1 day'::interval)::timestamptz ELSE $2::timestamptz END AS to_
-	FROM d
-), usage_by_day AS (
+		CASE
+			WHEN (d::timestamptz + ($1::int || ' day')::interval) <= $2::timestamptz
+			THEN (d::timestamptz + ($1::int || ' day')::interval)
+			ELSE $2::timestamptz
+		END AS to_
+	FROM
+		-- Subtract 1 microsecond from end_time to avoid including the next interval in the results.
+		generate_series($3::timestamptz, ($2::timestamptz) - '1 microsecond'::interval, ($1::int || ' day')::interval) AS d
+), unflattened_usage_by_interval AS (
+	-- We select data from both workspace agent stats and workspace app stats to
+	-- get a complete picture of usage. This matches how usage is calculated by
+	-- the combination of GetTemplateInsights and GetTemplateAppInsights. We use
+	-- a union all to avoid a costly distinct operation.
+	--
+	-- Note that one query must perform a left join so that all intervals are
+	-- present at least once.
 	SELECT
 		ts.from_, ts.to_,
-		was.user_id,
-		array_agg(was.template_id) AS template_ids
+		was.template_id,
+		was.user_id
 	FROM ts
 	LEFT JOIN workspace_agent_stats was ON (
 		was.created_at >= ts.from_
 		AND was.created_at < ts.to_
 		AND was.connection_count > 0
-		AND CASE WHEN COALESCE(array_length($3::uuid[], 1), 0) > 0 THEN was.template_id = ANY($3::uuid[]) ELSE TRUE END
+		AND CASE WHEN COALESCE(array_length($4::uuid[], 1), 0) > 0 THEN was.template_id = ANY($4::uuid[]) ELSE TRUE END
 	)
-	GROUP BY ts.from_, ts.to_, was.user_id
-), template_ids AS (
+	GROUP BY ts.from_, ts.to_, was.template_id, was.user_id
+
+	UNION ALL
+
 	SELECT
-		template_usage_by_day.from_,
-		array_agg(template_id) AS ids
-	FROM (
-		SELECT DISTINCT
-			from_,
-			unnest(template_ids) AS template_id
-		FROM usage_by_day
-	) AS template_usage_by_day
-	WHERE template_id IS NOT NULL
-	GROUP BY template_usage_by_day.from_
+		ts.from_, ts.to_,
+		w.template_id,
+		was.user_id
+	FROM ts
+	JOIN workspace_app_stats was ON (
+		(was.session_started_at >= ts.from_ AND was.session_started_at < ts.to_)
+		OR (was.session_ended_at > ts.from_ AND was.session_ended_at < ts.to_)
+		OR (was.session_started_at < ts.from_ AND was.session_ended_at >= ts.to_)
+	)
+	JOIN workspaces w ON (
+		w.id = was.workspace_id
+		AND CASE WHEN COALESCE(array_length($4::uuid[], 1), 0) > 0 THEN w.template_id = ANY($4::uuid[]) ELSE TRUE END
+	)
+	GROUP BY ts.from_, ts.to_, w.template_id, was.user_id
 )
 
 SELECT
 	from_ AS start_time,
 	to_ AS end_time,
-	COALESCE((SELECT template_ids.ids FROM template_ids WHERE template_ids.from_ = usage_by_day.from_), '{}')::uuid[] AS template_ids,
+	array_remove(array_agg(DISTINCT template_id), NULL)::uuid[] AS template_ids,
 	COUNT(DISTINCT user_id) AS active_users
-FROM usage_by_day
+FROM unflattened_usage_by_interval
 GROUP BY from_, to_
 `
 
-type GetTemplateDailyInsightsParams struct {
-	StartTime   time.Time   `db:"start_time" json:"start_time"`
-	EndTime     time.Time   `db:"end_time" json:"end_time"`
-	TemplateIDs []uuid.UUID `db:"template_ids" json:"template_ids"`
+type GetTemplateInsightsByIntervalParams struct {
+	IntervalDays int32       `db:"interval_days" json:"interval_days"`
+	EndTime      time.Time   `db:"end_time" json:"end_time"`
+	StartTime    time.Time   `db:"start_time" json:"start_time"`
+	TemplateIDs  []uuid.UUID `db:"template_ids" json:"template_ids"`
 }
 
-type GetTemplateDailyInsightsRow struct {
+type GetTemplateInsightsByIntervalRow struct {
 	StartTime   time.Time   `db:"start_time" json:"start_time"`
 	EndTime     time.Time   `db:"end_time" json:"end_time"`
 	TemplateIDs []uuid.UUID `db:"template_ids" json:"template_ids"`
 	ActiveUsers int64       `db:"active_users" json:"active_users"`
 }
 
-// GetTemplateDailyInsights returns all daily intervals between start and end
-// time, if end time is a partial day, it will be included in the results and
-// that interval will be less than 24 hours. If there is no data for a selected
+// GetTemplateInsightsByInterval returns all intervals between start and end
+// time, if end time is a partial interval, it will be included in the results and
+// that interval will be shorter than a full one. If there is no data for a selected
 // interval/template, it will be included in the results with 0 active users.
-func (q *sqlQuerier) GetTemplateDailyInsights(ctx context.Context, arg GetTemplateDailyInsightsParams) ([]GetTemplateDailyInsightsRow, error) {
-	rows, err := q.db.QueryContext(ctx, getTemplateDailyInsights, arg.StartTime, arg.EndTime, pq.Array(arg.TemplateIDs))
+func (q *sqlQuerier) GetTemplateInsightsByInterval(ctx context.Context, arg GetTemplateInsightsByIntervalParams) ([]GetTemplateInsightsByIntervalRow, error) {
+	rows, err := q.db.QueryContext(ctx, getTemplateInsightsByInterval,
+		arg.IntervalDays,
+		arg.EndTime,
+		arg.StartTime,
+		pq.Array(arg.TemplateIDs),
+	)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
-	var items []GetTemplateDailyInsightsRow
+	var items []GetTemplateInsightsByIntervalRow
 	for rows.Next() {
-		var i GetTemplateDailyInsightsRow
+		var i GetTemplateInsightsByIntervalRow
 		if err := rows.Scan(
 			&i.StartTime,
 			&i.EndTime,
@@ -1478,79 +1935,77 @@ func (q *sqlQuerier) GetTemplateDailyInsights(ctx context.Context, arg GetTempla
 	return items, nil
 }
 
-const getTemplateInsights = `-- name: GetTemplateInsights :one
-WITH d AS (
-	-- Subtract 1 second from end_time to avoid including the next interval in the results.
-	SELECT generate_series($1::timestamptz, ($2::timestamptz) - '1 second'::interval, '5 minute'::interval) AS d
-), ts AS (
-	SELECT
-		d::timestamptz AS from_,
-		(d + '5 minute'::interval)::timestamptz AS to_,
-		EXTRACT(epoch FROM '5 minute'::interval) AS seconds
-	FROM d
-), usage_by_user AS (
+const getTemplateInsightsByTemplate = `-- name: GetTemplateInsightsByTemplate :many
+WITH agent_stats_by_interval_and_user AS (
 	SELECT
-		ts.from_,
-		ts.to_,
+		date_trunc('minute', was.created_at) AS created_at_trunc,
+		was.template_id,
 		was.user_id,
-		array_agg(was.template_id) AS template_ids,
-		CASE WHEN SUM(was.session_count_vscode) > 0 THEN ts.seconds ELSE 0 END AS usage_vscode_seconds,
-		CASE WHEN SUM(was.session_count_jetbrains) > 0 THEN ts.seconds ELSE 0 END AS usage_jetbrains_seconds,
-		CASE WHEN SUM(was.session_count_reconnecting_pty) > 0 THEN ts.seconds ELSE 0 END AS usage_reconnecting_pty_seconds,
-		CASE WHEN SUM(was.session_count_ssh) > 0 THEN ts.seconds ELSE 0 END AS usage_ssh_seconds
-	FROM ts
-	JOIN workspace_agent_stats was ON (
-		was.created_at >= ts.from_
-		AND was.created_at < ts.to_
+		CASE WHEN SUM(was.session_count_vscode) > 0 THEN 60 ELSE 0 END AS usage_vscode_seconds,
+		CASE WHEN SUM(was.session_count_jetbrains) > 0 THEN 60 ELSE 0 END AS usage_jetbrains_seconds,
+		CASE WHEN SUM(was.session_count_reconnecting_pty) > 0 THEN 60 ELSE 0 END AS usage_reconnecting_pty_seconds,
+		CASE WHEN SUM(was.session_count_ssh) > 0 THEN 60 ELSE 0 END AS usage_ssh_seconds
+	FROM workspace_agent_stats was
+	WHERE
+		was.created_at >= $1::timestamptz
+		AND was.created_at < $2::timestamptz
 		AND was.connection_count > 0
-		AND CASE WHEN COALESCE(array_length($3::uuid[], 1), 0) > 0 THEN was.template_id = ANY($3::uuid[]) ELSE TRUE END
-	)
-	GROUP BY ts.from_, ts.to_, ts.seconds, was.user_id
-), template_ids AS (
-	SELECT array_agg(DISTINCT template_id) AS ids
-	FROM usage_by_user, unnest(template_ids) template_id
-	WHERE template_id IS NOT NULL
+	GROUP BY created_at_trunc, was.template_id, was.user_id
 )
 
 SELECT
-	COALESCE((SELECT ids FROM template_ids), '{}')::uuid[] AS template_ids,
-	COUNT(DISTINCT user_id) AS active_users,
+	template_id,
+	COALESCE(COUNT(DISTINCT user_id))::bigint AS active_users,
 	COALESCE(SUM(usage_vscode_seconds), 0)::bigint AS usage_vscode_seconds,
 	COALESCE(SUM(usage_jetbrains_seconds), 0)::bigint AS usage_jetbrains_seconds,
 	COALESCE(SUM(usage_reconnecting_pty_seconds), 0)::bigint AS usage_reconnecting_pty_seconds,
 	COALESCE(SUM(usage_ssh_seconds), 0)::bigint AS usage_ssh_seconds
-FROM usage_by_user
+FROM agent_stats_by_interval_and_user
+GROUP BY template_id
 `
 
-type GetTemplateInsightsParams struct {
-	StartTime   time.Time   `db:"start_time" json:"start_time"`
-	EndTime     time.Time   `db:"end_time" json:"end_time"`
-	TemplateIDs []uuid.UUID `db:"template_ids" json:"template_ids"`
+type GetTemplateInsightsByTemplateParams struct {
+	StartTime time.Time `db:"start_time" json:"start_time"`
+	EndTime   time.Time `db:"end_time" json:"end_time"`
 }
 
-type GetTemplateInsightsRow struct {
-	TemplateIDs                 []uuid.UUID `db:"template_ids" json:"template_ids"`
-	ActiveUsers                 int64       `db:"active_users" json:"active_users"`
-	UsageVscodeSeconds          int64       `db:"usage_vscode_seconds" json:"usage_vscode_seconds"`
-	UsageJetbrainsSeconds       int64       `db:"usage_jetbrains_seconds" json:"usage_jetbrains_seconds"`
-	UsageReconnectingPtySeconds int64       `db:"usage_reconnecting_pty_seconds" json:"usage_reconnecting_pty_seconds"`
-	UsageSshSeconds             int64       `db:"usage_ssh_seconds" json:"usage_ssh_seconds"`
+type GetTemplateInsightsByTemplateRow struct {
+	TemplateID                  uuid.UUID `db:"template_id" json:"template_id"`
+	ActiveUsers                 int64     `db:"active_users" json:"active_users"`
+	UsageVscodeSeconds          int64     `db:"usage_vscode_seconds" json:"usage_vscode_seconds"`
+	UsageJetbrainsSeconds       int64     `db:"usage_jetbrains_seconds" json:"usage_jetbrains_seconds"`
+	UsageReconnectingPtySeconds int64     `db:"usage_reconnecting_pty_seconds" json:"usage_reconnecting_pty_seconds"`
+	UsageSshSeconds             int64     `db:"usage_ssh_seconds" json:"usage_ssh_seconds"`
 }
 
-// GetTemplateInsights has a granularity of 5 minutes where if a session/app was
-// in use, we will add 5 minutes to the total usage for that session (per user).
-func (q *sqlQuerier) GetTemplateInsights(ctx context.Context, arg GetTemplateInsightsParams) (GetTemplateInsightsRow, error) {
-	row := q.db.QueryRowContext(ctx, getTemplateInsights, arg.StartTime, arg.EndTime, pq.Array(arg.TemplateIDs))
-	var i GetTemplateInsightsRow
-	err := row.Scan(
-		pq.Array(&i.TemplateIDs),
-		&i.ActiveUsers,
-		&i.UsageVscodeSeconds,
-		&i.UsageJetbrainsSeconds,
-		&i.UsageReconnectingPtySeconds,
-		&i.UsageSshSeconds,
-	)
-	return i, err
+func (q *sqlQuerier) GetTemplateInsightsByTemplate(ctx context.Context, arg GetTemplateInsightsByTemplateParams) ([]GetTemplateInsightsByTemplateRow, error) {
+	rows, err := q.db.QueryContext(ctx, getTemplateInsightsByTemplate, arg.StartTime, arg.EndTime)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []GetTemplateInsightsByTemplateRow
+	for rows.Next() {
+		var i GetTemplateInsightsByTemplateRow
+		if err := rows.Scan(
+			&i.TemplateID,
+			&i.ActiveUsers,
+			&i.UsageVscodeSeconds,
+			&i.UsageJetbrainsSeconds,
+			&i.UsageReconnectingPtySeconds,
+			&i.UsageSshSeconds,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
 }
 
 const getTemplateParameterInsights = `-- name: GetTemplateParameterInsights :many
@@ -1560,15 +2015,15 @@ WITH latest_workspace_builds AS (
 		wbmax.template_id,
 		wb.template_version_id
 	FROM (
-	    SELECT
-	        tv.template_id, wbmax.workspace_id, MAX(wbmax.build_number) as max_build_number
+		SELECT
+			tv.template_id, wbmax.workspace_id, MAX(wbmax.build_number) as max_build_number
 		FROM workspace_builds wbmax
 		JOIN template_versions tv ON (tv.id = wbmax.template_version_id)
 		WHERE
 			wbmax.created_at >= $1::timestamptz
 			AND wbmax.created_at < $2::timestamptz
 			AND CASE WHEN COALESCE(array_length($3::uuid[], 1), 0) > 0 THEN tv.template_id = ANY($3::uuid[]) ELSE TRUE END
-	    GROUP BY tv.template_id, wbmax.workspace_id
+		GROUP BY tv.template_id, wbmax.workspace_id
 	) wbmax
 	JOIN workspace_builds wb ON (
 		wb.workspace_id = wbmax.workspace_id
@@ -1580,18 +2035,20 @@ WITH latest_workspace_builds AS (
 		array_agg(DISTINCT wb.template_id)::uuid[] AS template_ids,
 		array_agg(wb.id)::uuid[] AS workspace_build_ids,
 		tvp.name,
+		tvp.type,
 		tvp.display_name,
 		tvp.description,
 		tvp.options
 	FROM latest_workspace_builds wb
 	JOIN template_version_parameters tvp ON (tvp.template_version_id = wb.template_version_id)
-	GROUP BY tvp.name, tvp.display_name, tvp.description, tvp.options
+	GROUP BY tvp.name, tvp.type, tvp.display_name, tvp.description, tvp.options
 )
 
 SELECT
 	utp.num,
 	utp.template_ids,
 	utp.name,
+	utp.type,
 	utp.display_name,
 	utp.description,
 	utp.options,
@@ -1599,7 +2056,7 @@ SELECT
 	COUNT(wbp.value) AS count
 FROM unique_template_params utp
 JOIN workspace_build_parameters wbp ON (utp.workspace_build_ids @> ARRAY[wbp.workspace_build_id] AND utp.name = wbp.name)
-GROUP BY utp.num, utp.name, utp.display_name, utp.description, utp.options, utp.template_ids, wbp.value
+GROUP BY utp.num, utp.template_ids, utp.name, utp.type, utp.display_name, utp.description, utp.options, wbp.value
 `
 
 type GetTemplateParameterInsightsParams struct {
@@ -1612,6 +2069,7 @@ type GetTemplateParameterInsightsRow struct {
 	Num         int64           `db:"num" json:"num"`
 	TemplateIDs []uuid.UUID     `db:"template_ids" json:"template_ids"`
 	Name        string          `db:"name" json:"name"`
+	Type        string          `db:"type" json:"type"`
 	DisplayName string          `db:"display_name" json:"display_name"`
 	Description string          `db:"description" json:"description"`
 	Options     json.RawMessage `db:"options" json:"options"`
@@ -1636,6 +2094,7 @@ func (q *sqlQuerier) GetTemplateParameterInsights(ctx context.Context, arg GetTe
 			&i.Num,
 			pq.Array(&i.TemplateIDs),
 			&i.Name,
+			&i.Type,
 			&i.DisplayName,
 			&i.Description,
 			&i.Options,
@@ -1655,6 +2114,127 @@ func (q *sqlQuerier) GetTemplateParameterInsights(ctx context.Context, arg GetTe
 	return items, nil
 }
 
+const getUserActivityInsights = `-- name: GetUserActivityInsights :many
+WITH app_stats AS (
+	SELECT
+		s.start_time,
+		was.user_id,
+		w.template_id,
+		60 as seconds
+	FROM workspace_app_stats was
+	JOIN workspaces w ON (
+		w.id = was.workspace_id
+		AND CASE WHEN COALESCE(array_length($1::uuid[], 1), 0) > 0 THEN w.template_id = ANY($1::uuid[]) ELSE TRUE END
+	)
+	-- This table contains both 1 minute entries and >1 minute entries,
+	-- to calculate this with our uniqueness constraints, we generate series
+	-- for the longer intervals.
+	CROSS JOIN LATERAL generate_series(
+		date_trunc('minute', was.session_started_at),
+		-- Subtract 1 microsecond to avoid creating an extra series.
+		date_trunc('minute', was.session_ended_at - '1 microsecond'::interval),
+		'1 minute'::interval
+	) s(start_time)
+	WHERE
+		s.start_time >= $2::timestamptz
+		-- Subtract one minute because the series only contains the start time.
+		AND s.start_time < ($3::timestamptz) - '1 minute'::interval
+	GROUP BY s.start_time, w.template_id, was.user_id
+), session_stats AS (
+	SELECT
+		date_trunc('minute', was.created_at) as start_time,
+		was.user_id,
+		was.template_id,
+		CASE WHEN
+			SUM(was.session_count_vscode) > 0 OR
+			SUM(was.session_count_jetbrains) > 0 OR
+			SUM(was.session_count_reconnecting_pty) > 0 OR
+			SUM(was.session_count_ssh) > 0
+		THEN 60 ELSE 0 END as seconds
+	FROM workspace_agent_stats was
+	WHERE
+		was.created_at >= $2::timestamptz
+		AND was.created_at < $3::timestamptz
+		AND was.connection_count > 0
+		AND CASE WHEN COALESCE(array_length($1::uuid[], 1), 0) > 0 THEN was.template_id = ANY($1::uuid[]) ELSE TRUE END
+	GROUP BY date_trunc('minute', was.created_at), was.user_id, was.template_id
+), combined_stats AS (
+	SELECT
+		user_id,
+		template_id,
+		start_time,
+		seconds
+	FROM app_stats
+	UNION
+	SELECT
+		user_id,
+		template_id,
+		start_time,
+		seconds
+	FROM session_stats
+)
+SELECT
+	users.id as user_id,
+	users.username,
+	users.avatar_url,
+	array_agg(DISTINCT template_id)::uuid[] AS template_ids,
+	SUM(seconds) AS usage_seconds
+FROM combined_stats
+JOIN users ON (users.id = combined_stats.user_id)
+GROUP BY users.id, username, avatar_url
+ORDER BY user_id ASC
+`
+
+type GetUserActivityInsightsParams struct {
+	TemplateIDs []uuid.UUID `db:"template_ids" json:"template_ids"`
+	StartTime   time.Time   `db:"start_time" json:"start_time"`
+	EndTime     time.Time   `db:"end_time" json:"end_time"`
+}
+
+type GetUserActivityInsightsRow struct {
+	UserID       uuid.UUID      `db:"user_id" json:"user_id"`
+	Username     string         `db:"username" json:"username"`
+	AvatarURL    sql.NullString `db:"avatar_url" json:"avatar_url"`
+	TemplateIDs  []uuid.UUID    `db:"template_ids" json:"template_ids"`
+	UsageSeconds int64          `db:"usage_seconds" json:"usage_seconds"`
+}
+
+// GetUserActivityInsights returns the ranking with top active users.
+// The result can be filtered on template_ids, meaning only user data from workspaces
+// based on those templates will be included.
+// Note: When selecting data from multiple templates or the entire deployment,
+// be aware that it may lead to an increase in "usage" numbers (cumulative). In such cases,
+// users may be counted multiple times for the same time interval if they have used multiple templates
+// simultaneously.
+func (q *sqlQuerier) GetUserActivityInsights(ctx context.Context, arg GetUserActivityInsightsParams) ([]GetUserActivityInsightsRow, error) {
+	rows, err := q.db.QueryContext(ctx, getUserActivityInsights, pq.Array(arg.TemplateIDs), arg.StartTime, arg.EndTime)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []GetUserActivityInsightsRow
+	for rows.Next() {
+		var i GetUserActivityInsightsRow
+		if err := rows.Scan(
+			&i.UserID,
+			&i.Username,
+			&i.AvatarURL,
+			pq.Array(&i.TemplateIDs),
+			&i.UsageSeconds,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const getUserLatencyInsights = `-- name: GetUserLatencyInsights :many
 SELECT
 	workspace_agent_stats.user_id,
@@ -2500,7 +3080,7 @@ WHERE
 		SKIP LOCKED
 		LIMIT
 			1
-	) RETURNING id, created_at, updated_at, started_at, canceled_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, type, input, worker_id, file_id, tags, error_code, trace_metadata
+	) RETURNING id, created_at, updated_at, started_at, canceled_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, type, input, worker_id, file_id, tags, error_code, trace_metadata, job_status
 `
 
 type AcquireProvisionerJobParams struct {
@@ -2543,13 +3123,14 @@ func (q *sqlQuerier) AcquireProvisionerJob(ctx context.Context, arg AcquireProvi
 		&i.Tags,
 		&i.ErrorCode,
 		&i.TraceMetadata,
+		&i.JobStatus,
 	)
 	return i, err
 }
 
 const getHungProvisionerJobs = `-- name: GetHungProvisionerJobs :many
 SELECT
-	id, created_at, updated_at, started_at, canceled_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, type, input, worker_id, file_id, tags, error_code, trace_metadata
+	id, created_at, updated_at, started_at, canceled_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, type, input, worker_id, file_id, tags, error_code, trace_metadata, job_status
 FROM
 	provisioner_jobs
 WHERE
@@ -2586,6 +3167,7 @@ func (q *sqlQuerier) GetHungProvisionerJobs(ctx context.Context, updatedAt time.
 			&i.Tags,
 			&i.ErrorCode,
 			&i.TraceMetadata,
+			&i.JobStatus,
 		); err != nil {
 			return nil, err
 		}
@@ -2602,7 +3184,7 @@ func (q *sqlQuerier) GetHungProvisionerJobs(ctx context.Context, updatedAt time.
 
 const getProvisionerJobByID = `-- name: GetProvisionerJobByID :one
 SELECT
-	id, created_at, updated_at, started_at, canceled_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, type, input, worker_id, file_id, tags, error_code, trace_metadata
+	id, created_at, updated_at, started_at, canceled_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, type, input, worker_id, file_id, tags, error_code, trace_metadata, job_status
 FROM
 	provisioner_jobs
 WHERE
@@ -2631,13 +3213,14 @@ func (q *sqlQuerier) GetProvisionerJobByID(ctx context.Context, id uuid.UUID) (P
 		&i.Tags,
 		&i.ErrorCode,
 		&i.TraceMetadata,
+		&i.JobStatus,
 	)
 	return i, err
 }
 
 const getProvisionerJobsByIDs = `-- name: GetProvisionerJobsByIDs :many
 SELECT
-	id, created_at, updated_at, started_at, canceled_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, type, input, worker_id, file_id, tags, error_code, trace_metadata
+	id, created_at, updated_at, started_at, canceled_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, type, input, worker_id, file_id, tags, error_code, trace_metadata, job_status
 FROM
 	provisioner_jobs
 WHERE
@@ -2672,6 +3255,7 @@ func (q *sqlQuerier) GetProvisionerJobsByIDs(ctx context.Context, ids []uuid.UUI
 			&i.Tags,
 			&i.ErrorCode,
 			&i.TraceMetadata,
+			&i.JobStatus,
 		); err != nil {
 			return nil, err
 		}
@@ -2706,7 +3290,7 @@ queue_size AS (
 	SELECT COUNT(*) as count FROM unstarted_jobs
 )
 SELECT
-	pj.id, pj.created_at, pj.updated_at, pj.started_at, pj.canceled_at, pj.completed_at, pj.error, pj.organization_id, pj.initiator_id, pj.provisioner, pj.storage_method, pj.type, pj.input, pj.worker_id, pj.file_id, pj.tags, pj.error_code, pj.trace_metadata,
+	pj.id, pj.created_at, pj.updated_at, pj.started_at, pj.canceled_at, pj.completed_at, pj.error, pj.organization_id, pj.initiator_id, pj.provisioner, pj.storage_method, pj.type, pj.input, pj.worker_id, pj.file_id, pj.tags, pj.error_code, pj.trace_metadata, pj.job_status,
     COALESCE(qp.queue_position, 0) AS queue_position,
     COALESCE(qs.count, 0) AS queue_size
 FROM
@@ -2753,6 +3337,7 @@ func (q *sqlQuerier) GetProvisionerJobsByIDsWithQueuePosition(ctx context.Contex
 			&i.ProvisionerJob.Tags,
 			&i.ProvisionerJob.ErrorCode,
 			&i.ProvisionerJob.TraceMetadata,
+			&i.ProvisionerJob.JobStatus,
 			&i.QueuePosition,
 			&i.QueueSize,
 		); err != nil {
@@ -2770,7 +3355,7 @@ func (q *sqlQuerier) GetProvisionerJobsByIDsWithQueuePosition(ctx context.Contex
 }
 
 const getProvisionerJobsCreatedAfter = `-- name: GetProvisionerJobsCreatedAfter :many
-SELECT id, created_at, updated_at, started_at, canceled_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, type, input, worker_id, file_id, tags, error_code, trace_metadata FROM provisioner_jobs WHERE created_at > $1
+SELECT id, created_at, updated_at, started_at, canceled_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, type, input, worker_id, file_id, tags, error_code, trace_metadata, job_status FROM provisioner_jobs WHERE created_at > $1
 `
 
 func (q *sqlQuerier) GetProvisionerJobsCreatedAfter(ctx context.Context, createdAt time.Time) ([]ProvisionerJob, error) {
@@ -2801,6 +3386,7 @@ func (q *sqlQuerier) GetProvisionerJobsCreatedAfter(ctx context.Context, created
 			&i.Tags,
 			&i.ErrorCode,
 			&i.TraceMetadata,
+			&i.JobStatus,
 		); err != nil {
 			return nil, err
 		}
@@ -2832,7 +3418,7 @@ INSERT INTO
 		trace_metadata
 	)
 VALUES
-	($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12) RETURNING id, created_at, updated_at, started_at, canceled_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, type, input, worker_id, file_id, tags, error_code, trace_metadata
+	($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12) RETURNING id, created_at, updated_at, started_at, canceled_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, type, input, worker_id, file_id, tags, error_code, trace_metadata, job_status
 `
 
 type InsertProvisionerJobParams struct {
@@ -2885,6 +3471,7 @@ func (q *sqlQuerier) InsertProvisionerJob(ctx context.Context, arg InsertProvisi
 		&i.Tags,
 		&i.ErrorCode,
 		&i.TraceMetadata,
+		&i.JobStatus,
 	)
 	return i, err
 }
@@ -3329,11 +3916,13 @@ const getQuotaAllowanceForUser = `-- name: GetQuotaAllowanceForUser :one
 SELECT
 	coalesce(SUM(quota_allowance), 0)::BIGINT
 FROM
-	group_members gm
-JOIN groups g ON
+	groups g
+LEFT JOIN group_members gm ON
 	g.id = gm.group_id
 WHERE
 	user_id = $1
+OR
+    g.id = g.organization_id
 `
 
 func (q *sqlQuerier) GetQuotaAllowanceForUser(ctx context.Context, userID uuid.UUID) (int64, error) {
@@ -3576,6 +4165,17 @@ func (q *sqlQuerier) GetAppSecurityKey(ctx context.Context) (string, error) {
 	return value, err
 }
 
+const getApplicationName = `-- name: GetApplicationName :one
+SELECT value FROM site_configs WHERE key = 'application_name'
+`
+
+func (q *sqlQuerier) GetApplicationName(ctx context.Context) (string, error) {
+	row := q.db.QueryRowContext(ctx, getApplicationName)
+	var value string
+	err := row.Scan(&value)
+	return value, err
+}
+
 const getDERPMeshKey = `-- name: GetDERPMeshKey :one
 SELECT value FROM site_configs WHERE key = 'derp_mesh_key'
 `
@@ -3688,6 +4288,16 @@ func (q *sqlQuerier) UpsertAppSecurityKey(ctx context.Context, value string) err
 	return err
 }
 
+const upsertApplicationName = `-- name: UpsertApplicationName :exec
+INSERT INTO site_configs (key, value) VALUES ('application_name', $1)
+ON CONFLICT (key) DO UPDATE SET value = $1 WHERE site_configs.key = 'application_name'
+`
+
+func (q *sqlQuerier) UpsertApplicationName(ctx context.Context, value string) error {
+	_, err := q.db.ExecContext(ctx, upsertApplicationName, value)
+	return err
+}
+
 const upsertDefaultProxy = `-- name: UpsertDefaultProxy :exec
 INSERT INTO site_configs (key, value)
 VALUES
@@ -3762,6 +4372,22 @@ func (q *sqlQuerier) CleanTailnetCoordinators(ctx context.Context) error {
 	return err
 }
 
+const deleteAllTailnetClientSubscriptions = `-- name: DeleteAllTailnetClientSubscriptions :exec
+DELETE
+FROM tailnet_client_subscriptions
+WHERE client_id = $1 and coordinator_id = $2
+`
+
+type DeleteAllTailnetClientSubscriptionsParams struct {
+	ClientID      uuid.UUID `db:"client_id" json:"client_id"`
+	CoordinatorID uuid.UUID `db:"coordinator_id" json:"coordinator_id"`
+}
+
+func (q *sqlQuerier) DeleteAllTailnetClientSubscriptions(ctx context.Context, arg DeleteAllTailnetClientSubscriptionsParams) error {
+	_, err := q.db.ExecContext(ctx, deleteAllTailnetClientSubscriptions, arg.ClientID, arg.CoordinatorID)
+	return err
+}
+
 const deleteCoordinator = `-- name: DeleteCoordinator :exec
 DELETE
 FROM tailnet_coordinators
@@ -3821,6 +4447,23 @@ func (q *sqlQuerier) DeleteTailnetClient(ctx context.Context, arg DeleteTailnetC
 	return i, err
 }
 
+const deleteTailnetClientSubscription = `-- name: DeleteTailnetClientSubscription :exec
+DELETE
+FROM tailnet_client_subscriptions
+WHERE client_id = $1 and agent_id = $2 and coordinator_id = $3
+`
+
+type DeleteTailnetClientSubscriptionParams struct {
+	ClientID      uuid.UUID `db:"client_id" json:"client_id"`
+	AgentID       uuid.UUID `db:"agent_id" json:"agent_id"`
+	CoordinatorID uuid.UUID `db:"coordinator_id" json:"coordinator_id"`
+}
+
+func (q *sqlQuerier) DeleteTailnetClientSubscription(ctx context.Context, arg DeleteTailnetClientSubscriptionParams) error {
+	_, err := q.db.ExecContext(ctx, deleteTailnetClientSubscription, arg.ClientID, arg.AgentID, arg.CoordinatorID)
+	return err
+}
+
 const getAllTailnetAgents = `-- name: GetAllTailnetAgents :many
 SELECT id, coordinator_id, updated_at, node
 FROM tailnet_agents
@@ -3855,26 +4498,32 @@ func (q *sqlQuerier) GetAllTailnetAgents(ctx context.Context) ([]TailnetAgent, e
 }
 
 const getAllTailnetClients = `-- name: GetAllTailnetClients :many
-SELECT id, coordinator_id, agent_id, updated_at, node
+SELECT tailnet_clients.id, tailnet_clients.coordinator_id, tailnet_clients.updated_at, tailnet_clients.node, array_agg(tailnet_client_subscriptions.agent_id)::uuid[] as agent_ids
 FROM tailnet_clients
-ORDER BY agent_id
+LEFT JOIN tailnet_client_subscriptions
+ON tailnet_clients.id = tailnet_client_subscriptions.client_id
 `
 
-func (q *sqlQuerier) GetAllTailnetClients(ctx context.Context) ([]TailnetClient, error) {
+type GetAllTailnetClientsRow struct {
+	TailnetClient TailnetClient `db:"tailnet_client" json:"tailnet_client"`
+	AgentIds      []uuid.UUID   `db:"agent_ids" json:"agent_ids"`
+}
+
+func (q *sqlQuerier) GetAllTailnetClients(ctx context.Context) ([]GetAllTailnetClientsRow, error) {
 	rows, err := q.db.QueryContext(ctx, getAllTailnetClients)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
-	var items []TailnetClient
+	var items []GetAllTailnetClientsRow
 	for rows.Next() {
-		var i TailnetClient
+		var i GetAllTailnetClientsRow
 		if err := rows.Scan(
-			&i.ID,
-			&i.CoordinatorID,
-			&i.AgentID,
-			&i.UpdatedAt,
-			&i.Node,
+			&i.TailnetClient.ID,
+			&i.TailnetClient.CoordinatorID,
+			&i.TailnetClient.UpdatedAt,
+			&i.TailnetClient.Node,
+			pq.Array(&i.AgentIds),
 		); err != nil {
 			return nil, err
 		}
@@ -3924,9 +4573,13 @@ func (q *sqlQuerier) GetTailnetAgents(ctx context.Context, id uuid.UUID) ([]Tail
 }
 
 const getTailnetClientsForAgent = `-- name: GetTailnetClientsForAgent :many
-SELECT id, coordinator_id, agent_id, updated_at, node
+SELECT id, coordinator_id, updated_at, node
 FROM tailnet_clients
-WHERE agent_id = $1
+WHERE id IN (
+	SELECT tailnet_client_subscriptions.client_id
+	FROM tailnet_client_subscriptions
+	WHERE tailnet_client_subscriptions.agent_id = $1
+)
 `
 
 func (q *sqlQuerier) GetTailnetClientsForAgent(ctx context.Context, agentID uuid.UUID) ([]TailnetClient, error) {
@@ -3941,7 +4594,6 @@ func (q *sqlQuerier) GetTailnetClientsForAgent(ctx context.Context, agentID uuid
 		if err := rows.Scan(
 			&i.ID,
 			&i.CoordinatorID,
-			&i.AgentID,
 			&i.UpdatedAt,
 			&i.Node,
 		); err != nil {
@@ -4000,47 +4652,67 @@ INSERT INTO
 	tailnet_clients (
 	id,
 	coordinator_id,
-	agent_id,
 	node,
 	updated_at
 )
 VALUES
-	($1, $2, $3, $4, now() at time zone 'utc')
+	($1, $2, $3, now() at time zone 'utc')
 ON CONFLICT (id, coordinator_id)
 DO UPDATE SET
 	id = $1,
 	coordinator_id = $2,
-	agent_id = $3,
-	node = $4,
+	node = $3,
 	updated_at = now() at time zone 'utc'
-RETURNING id, coordinator_id, agent_id, updated_at, node
+RETURNING id, coordinator_id, updated_at, node
 `
 
 type UpsertTailnetClientParams struct {
 	ID            uuid.UUID       `db:"id" json:"id"`
 	CoordinatorID uuid.UUID       `db:"coordinator_id" json:"coordinator_id"`
-	AgentID       uuid.UUID       `db:"agent_id" json:"agent_id"`
 	Node          json.RawMessage `db:"node" json:"node"`
 }
 
 func (q *sqlQuerier) UpsertTailnetClient(ctx context.Context, arg UpsertTailnetClientParams) (TailnetClient, error) {
-	row := q.db.QueryRowContext(ctx, upsertTailnetClient,
-		arg.ID,
-		arg.CoordinatorID,
-		arg.AgentID,
-		arg.Node,
-	)
+	row := q.db.QueryRowContext(ctx, upsertTailnetClient, arg.ID, arg.CoordinatorID, arg.Node)
 	var i TailnetClient
 	err := row.Scan(
 		&i.ID,
 		&i.CoordinatorID,
-		&i.AgentID,
 		&i.UpdatedAt,
 		&i.Node,
 	)
 	return i, err
 }
 
+const upsertTailnetClientSubscription = `-- name: UpsertTailnetClientSubscription :exec
+INSERT INTO
+	tailnet_client_subscriptions (
+	client_id,
+	coordinator_id,
+	agent_id,
+	updated_at
+)
+VALUES
+	($1, $2, $3, now() at time zone 'utc')
+ON CONFLICT (client_id, coordinator_id, agent_id)
+DO UPDATE SET
+	client_id = $1,
+	coordinator_id = $2,
+	agent_id = $3,
+	updated_at = now() at time zone 'utc'
+`
+
+type UpsertTailnetClientSubscriptionParams struct {
+	ClientID      uuid.UUID `db:"client_id" json:"client_id"`
+	CoordinatorID uuid.UUID `db:"coordinator_id" json:"coordinator_id"`
+	AgentID       uuid.UUID `db:"agent_id" json:"agent_id"`
+}
+
+func (q *sqlQuerier) UpsertTailnetClientSubscription(ctx context.Context, arg UpsertTailnetClientSubscriptionParams) error {
+	_, err := q.db.ExecContext(ctx, upsertTailnetClientSubscription, arg.ClientID, arg.CoordinatorID, arg.AgentID)
+	return err
+}
+
 const upsertTailnetCoordinator = `-- name: UpsertTailnetCoordinator :one
 INSERT INTO
 	tailnet_coordinators (
@@ -4125,7 +4797,7 @@ func (q *sqlQuerier) GetTemplateAverageBuildTime(ctx context.Context, arg GetTem
 
 const getTemplateByID = `-- name: GetTemplateByID :one
 SELECT
-	id, created_at, updated_at, organization_id, deleted, name, provisioner, active_version_id, description, default_ttl, created_by, icon, user_acl, group_acl, display_name, allow_user_cancel_workspace_jobs, max_ttl, allow_user_autostart, allow_user_autostop, failure_ttl, inactivity_ttl, locked_ttl, restart_requirement_days_of_week, restart_requirement_weeks, created_by_avatar_url, created_by_username
+	id, created_at, updated_at, organization_id, deleted, name, provisioner, active_version_id, description, default_ttl, created_by, icon, user_acl, group_acl, display_name, allow_user_cancel_workspace_jobs, max_ttl, allow_user_autostart, allow_user_autostop, failure_ttl, time_til_dormant, time_til_dormant_autodelete, autostop_requirement_days_of_week, autostop_requirement_weeks, autostart_block_days_of_week, require_active_version, created_by_avatar_url, created_by_username
 FROM
 	template_with_users
 WHERE
@@ -4158,10 +4830,12 @@ func (q *sqlQuerier) GetTemplateByID(ctx context.Context, id uuid.UUID) (Templat
 		&i.AllowUserAutostart,
 		&i.AllowUserAutostop,
 		&i.FailureTTL,
-		&i.InactivityTTL,
-		&i.LockedTTL,
-		&i.RestartRequirementDaysOfWeek,
-		&i.RestartRequirementWeeks,
+		&i.TimeTilDormant,
+		&i.TimeTilDormantAutoDelete,
+		&i.AutostopRequirementDaysOfWeek,
+		&i.AutostopRequirementWeeks,
+		&i.AutostartBlockDaysOfWeek,
+		&i.RequireActiveVersion,
 		&i.CreatedByAvatarURL,
 		&i.CreatedByUsername,
 	)
@@ -4170,7 +4844,7 @@ func (q *sqlQuerier) GetTemplateByID(ctx context.Context, id uuid.UUID) (Templat
 
 const getTemplateByOrganizationAndName = `-- name: GetTemplateByOrganizationAndName :one
 SELECT
-	id, created_at, updated_at, organization_id, deleted, name, provisioner, active_version_id, description, default_ttl, created_by, icon, user_acl, group_acl, display_name, allow_user_cancel_workspace_jobs, max_ttl, allow_user_autostart, allow_user_autostop, failure_ttl, inactivity_ttl, locked_ttl, restart_requirement_days_of_week, restart_requirement_weeks, created_by_avatar_url, created_by_username
+	id, created_at, updated_at, organization_id, deleted, name, provisioner, active_version_id, description, default_ttl, created_by, icon, user_acl, group_acl, display_name, allow_user_cancel_workspace_jobs, max_ttl, allow_user_autostart, allow_user_autostop, failure_ttl, time_til_dormant, time_til_dormant_autodelete, autostop_requirement_days_of_week, autostop_requirement_weeks, autostart_block_days_of_week, require_active_version, created_by_avatar_url, created_by_username
 FROM
 	template_with_users AS templates
 WHERE
@@ -4211,10 +4885,12 @@ func (q *sqlQuerier) GetTemplateByOrganizationAndName(ctx context.Context, arg G
 		&i.AllowUserAutostart,
 		&i.AllowUserAutostop,
 		&i.FailureTTL,
-		&i.InactivityTTL,
-		&i.LockedTTL,
-		&i.RestartRequirementDaysOfWeek,
-		&i.RestartRequirementWeeks,
+		&i.TimeTilDormant,
+		&i.TimeTilDormantAutoDelete,
+		&i.AutostopRequirementDaysOfWeek,
+		&i.AutostopRequirementWeeks,
+		&i.AutostartBlockDaysOfWeek,
+		&i.RequireActiveVersion,
 		&i.CreatedByAvatarURL,
 		&i.CreatedByUsername,
 	)
@@ -4222,7 +4898,7 @@ func (q *sqlQuerier) GetTemplateByOrganizationAndName(ctx context.Context, arg G
 }
 
 const getTemplates = `-- name: GetTemplates :many
-SELECT id, created_at, updated_at, organization_id, deleted, name, provisioner, active_version_id, description, default_ttl, created_by, icon, user_acl, group_acl, display_name, allow_user_cancel_workspace_jobs, max_ttl, allow_user_autostart, allow_user_autostop, failure_ttl, inactivity_ttl, locked_ttl, restart_requirement_days_of_week, restart_requirement_weeks, created_by_avatar_url, created_by_username FROM template_with_users AS templates
+SELECT id, created_at, updated_at, organization_id, deleted, name, provisioner, active_version_id, description, default_ttl, created_by, icon, user_acl, group_acl, display_name, allow_user_cancel_workspace_jobs, max_ttl, allow_user_autostart, allow_user_autostop, failure_ttl, time_til_dormant, time_til_dormant_autodelete, autostop_requirement_days_of_week, autostop_requirement_weeks, autostart_block_days_of_week, require_active_version, created_by_avatar_url, created_by_username FROM template_with_users AS templates
 ORDER BY (name, id) ASC
 `
 
@@ -4256,10 +4932,12 @@ func (q *sqlQuerier) GetTemplates(ctx context.Context) ([]Template, error) {
 			&i.AllowUserAutostart,
 			&i.AllowUserAutostop,
 			&i.FailureTTL,
-			&i.InactivityTTL,
-			&i.LockedTTL,
-			&i.RestartRequirementDaysOfWeek,
-			&i.RestartRequirementWeeks,
+			&i.TimeTilDormant,
+			&i.TimeTilDormantAutoDelete,
+			&i.AutostopRequirementDaysOfWeek,
+			&i.AutostopRequirementWeeks,
+			&i.AutostartBlockDaysOfWeek,
+			&i.RequireActiveVersion,
 			&i.CreatedByAvatarURL,
 			&i.CreatedByUsername,
 		); err != nil {
@@ -4278,7 +4956,7 @@ func (q *sqlQuerier) GetTemplates(ctx context.Context) ([]Template, error) {
 
 const getTemplatesWithFilter = `-- name: GetTemplatesWithFilter :many
 SELECT
-	id, created_at, updated_at, organization_id, deleted, name, provisioner, active_version_id, description, default_ttl, created_by, icon, user_acl, group_acl, display_name, allow_user_cancel_workspace_jobs, max_ttl, allow_user_autostart, allow_user_autostop, failure_ttl, inactivity_ttl, locked_ttl, restart_requirement_days_of_week, restart_requirement_weeks, created_by_avatar_url, created_by_username
+	id, created_at, updated_at, organization_id, deleted, name, provisioner, active_version_id, description, default_ttl, created_by, icon, user_acl, group_acl, display_name, allow_user_cancel_workspace_jobs, max_ttl, allow_user_autostart, allow_user_autostop, failure_ttl, time_til_dormant, time_til_dormant_autodelete, autostop_requirement_days_of_week, autostop_requirement_weeks, autostart_block_days_of_week, require_active_version, created_by_avatar_url, created_by_username
 FROM
 	template_with_users AS templates
 WHERE
@@ -4349,10 +5027,12 @@ func (q *sqlQuerier) GetTemplatesWithFilter(ctx context.Context, arg GetTemplate
 			&i.AllowUserAutostart,
 			&i.AllowUserAutostop,
 			&i.FailureTTL,
-			&i.InactivityTTL,
-			&i.LockedTTL,
-			&i.RestartRequirementDaysOfWeek,
-			&i.RestartRequirementWeeks,
+			&i.TimeTilDormant,
+			&i.TimeTilDormantAutoDelete,
+			&i.AutostopRequirementDaysOfWeek,
+			&i.AutostopRequirementWeeks,
+			&i.AutostartBlockDaysOfWeek,
+			&i.RequireActiveVersion,
 			&i.CreatedByAvatarURL,
 			&i.CreatedByUsername,
 		); err != nil {
@@ -4449,6 +5129,25 @@ func (q *sqlQuerier) UpdateTemplateACLByID(ctx context.Context, arg UpdateTempla
 	return err
 }
 
+const updateTemplateAccessControlByID = `-- name: UpdateTemplateAccessControlByID :exec
+UPDATE
+	templates
+SET
+	require_active_version = $2
+WHERE
+	id = $1
+`
+
+type UpdateTemplateAccessControlByIDParams struct {
+	ID                   uuid.UUID `db:"id" json:"id"`
+	RequireActiveVersion bool      `db:"require_active_version" json:"require_active_version"`
+}
+
+func (q *sqlQuerier) UpdateTemplateAccessControlByID(ctx context.Context, arg UpdateTemplateAccessControlByIDParams) error {
+	_, err := q.db.ExecContext(ctx, updateTemplateAccessControlByID, arg.ID, arg.RequireActiveVersion)
+	return err
+}
+
 const updateTemplateActiveVersionByID = `-- name: UpdateTemplateActiveVersionByID :exec
 UPDATE
 	templates
@@ -4537,27 +5236,29 @@ SET
 	allow_user_autostop = $4,
 	default_ttl = $5,
 	max_ttl = $6,
-	restart_requirement_days_of_week = $7,
-	restart_requirement_weeks = $8,
-	failure_ttl = $9,
-	inactivity_ttl = $10,
-	locked_ttl = $11
+	autostop_requirement_days_of_week = $7,
+	autostop_requirement_weeks = $8,
+	autostart_block_days_of_week = $9,
+	failure_ttl = $10,
+	time_til_dormant = $11,
+	time_til_dormant_autodelete = $12
 WHERE
 	id = $1
 `
 
 type UpdateTemplateScheduleByIDParams struct {
-	ID                           uuid.UUID `db:"id" json:"id"`
-	UpdatedAt                    time.Time `db:"updated_at" json:"updated_at"`
-	AllowUserAutostart           bool      `db:"allow_user_autostart" json:"allow_user_autostart"`
-	AllowUserAutostop            bool      `db:"allow_user_autostop" json:"allow_user_autostop"`
-	DefaultTTL                   int64     `db:"default_ttl" json:"default_ttl"`
-	MaxTTL                       int64     `db:"max_ttl" json:"max_ttl"`
-	RestartRequirementDaysOfWeek int16     `db:"restart_requirement_days_of_week" json:"restart_requirement_days_of_week"`
-	RestartRequirementWeeks      int64     `db:"restart_requirement_weeks" json:"restart_requirement_weeks"`
-	FailureTTL                   int64     `db:"failure_ttl" json:"failure_ttl"`
-	InactivityTTL                int64     `db:"inactivity_ttl" json:"inactivity_ttl"`
-	LockedTTL                    int64     `db:"locked_ttl" json:"locked_ttl"`
+	ID                            uuid.UUID `db:"id" json:"id"`
+	UpdatedAt                     time.Time `db:"updated_at" json:"updated_at"`
+	AllowUserAutostart            bool      `db:"allow_user_autostart" json:"allow_user_autostart"`
+	AllowUserAutostop             bool      `db:"allow_user_autostop" json:"allow_user_autostop"`
+	DefaultTTL                    int64     `db:"default_ttl" json:"default_ttl"`
+	MaxTTL                        int64     `db:"max_ttl" json:"max_ttl"`
+	AutostopRequirementDaysOfWeek int16     `db:"autostop_requirement_days_of_week" json:"autostop_requirement_days_of_week"`
+	AutostopRequirementWeeks      int64     `db:"autostop_requirement_weeks" json:"autostop_requirement_weeks"`
+	AutostartBlockDaysOfWeek      int16     `db:"autostart_block_days_of_week" json:"autostart_block_days_of_week"`
+	FailureTTL                    int64     `db:"failure_ttl" json:"failure_ttl"`
+	TimeTilDormant                int64     `db:"time_til_dormant" json:"time_til_dormant"`
+	TimeTilDormantAutoDelete      int64     `db:"time_til_dormant_autodelete" json:"time_til_dormant_autodelete"`
 }
 
 func (q *sqlQuerier) UpdateTemplateScheduleByID(ctx context.Context, arg UpdateTemplateScheduleByIDParams) error {
@@ -4568,11 +5269,12 @@ func (q *sqlQuerier) UpdateTemplateScheduleByID(ctx context.Context, arg UpdateT
 		arg.AllowUserAutostop,
 		arg.DefaultTTL,
 		arg.MaxTTL,
-		arg.RestartRequirementDaysOfWeek,
-		arg.RestartRequirementWeeks,
+		arg.AutostopRequirementDaysOfWeek,
+		arg.AutostopRequirementWeeks,
+		arg.AutostartBlockDaysOfWeek,
 		arg.FailureTTL,
-		arg.InactivityTTL,
-		arg.LockedTTL,
+		arg.TimeTilDormant,
+		arg.TimeTilDormantAutoDelete,
 	)
 	return err
 }
@@ -4725,12 +5427,126 @@ func (q *sqlQuerier) InsertTemplateVersionParameter(ctx context.Context, arg Ins
 		&i.DisplayOrder,
 		&i.Ephemeral,
 	)
-	return i, err
+	return i, err
+}
+
+const archiveUnusedTemplateVersions = `-- name: ArchiveUnusedTemplateVersions :many
+UPDATE
+	template_versions
+SET
+	archived = true,
+	updated_at = $1
+FROM
+	-- Archive all versions that are returned from this query.
+	(
+		SELECT
+			scoped_template_versions.id
+		FROM
+			-- Scope an archive to a single template and ignore already archived template versions
+			(
+				SELECT
+					id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, external_auth_providers, message, archived
+				FROM
+					template_versions
+				WHERE
+					template_versions.template_id = $2 :: uuid
+					AND
+					archived = false
+					AND
+					-- This allows archiving a specific template version.
+					CASE
+						WHEN $3::uuid  != '00000000-0000-0000-0000-000000000000'::uuid THEN
+							template_versions.id = $3 :: uuid
+						ELSE
+							true
+						END
+			) AS scoped_template_versions
+			LEFT JOIN
+				provisioner_jobs ON scoped_template_versions.job_id = provisioner_jobs.id
+			LEFT JOIN
+				templates ON scoped_template_versions.template_id = templates.id
+		WHERE
+		  -- Actively used template versions (meaning the latest build is using
+		  -- the version) are never archived. A "restart" command on the workspace,
+		  -- even if failed, would use the version. So it cannot be archived until
+		  -- the build is outdated.
+		NOT EXISTS (
+			-- Return all "used" versions, where "used" is defined as being
+			-- used by a latest workspace build.
+			SELECT template_version_id FROM (
+				SELECT
+					DISTINCT ON (workspace_id) template_version_id, transition
+				FROM
+					workspace_builds
+				ORDER BY workspace_id, build_number DESC
+				) AS used_versions
+			WHERE
+				used_versions.transition != 'delete'
+				AND
+				scoped_template_versions.id = used_versions.template_version_id
+		)
+		-- Also never archive the active template version
+		AND active_version_id != scoped_template_versions.id
+		AND CASE
+			-- Optionally, only archive versions that match a given
+			-- job status like 'failed'.
+			WHEN $4 :: provisioner_job_status IS NOT NULL THEN
+				provisioner_jobs.job_status = $4 :: provisioner_job_status
+			ELSE
+				true
+		END
+		-- Pending or running jobs should not be archived, as they are "in progress"
+		AND provisioner_jobs.job_status != 'running'
+		AND provisioner_jobs.job_status != 'pending'
+	) AS archived_versions
+WHERE
+	template_versions.id IN (archived_versions.id)
+RETURNING template_versions.id
+`
+
+type ArchiveUnusedTemplateVersionsParams struct {
+	UpdatedAt         time.Time                `db:"updated_at" json:"updated_at"`
+	TemplateID        uuid.UUID                `db:"template_id" json:"template_id"`
+	TemplateVersionID uuid.UUID                `db:"template_version_id" json:"template_version_id"`
+	JobStatus         NullProvisionerJobStatus `db:"job_status" json:"job_status"`
+}
+
+// Archiving templates is a soft delete action, so is reversible.
+// Archiving prevents the version from being used and discovered
+// by listing.
+// Only unused template versions will be archived, which are any versions not
+// referenced by the latest build of a workspace.
+func (q *sqlQuerier) ArchiveUnusedTemplateVersions(ctx context.Context, arg ArchiveUnusedTemplateVersionsParams) ([]uuid.UUID, error) {
+	rows, err := q.db.QueryContext(ctx, archiveUnusedTemplateVersions,
+		arg.UpdatedAt,
+		arg.TemplateID,
+		arg.TemplateVersionID,
+		arg.JobStatus,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []uuid.UUID
+	for rows.Next() {
+		var id uuid.UUID
+		if err := rows.Scan(&id); err != nil {
+			return nil, err
+		}
+		items = append(items, id)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
 }
 
 const getPreviousTemplateVersion = `-- name: GetPreviousTemplateVersion :one
 SELECT
-	id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, git_auth_providers, message, created_by_avatar_url, created_by_username
+	id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, external_auth_providers, message, archived, created_by_avatar_url, created_by_username
 FROM
 	template_version_with_user AS template_versions
 WHERE
@@ -4764,8 +5580,9 @@ func (q *sqlQuerier) GetPreviousTemplateVersion(ctx context.Context, arg GetPrev
 		&i.Readme,
 		&i.JobID,
 		&i.CreatedBy,
-		pq.Array(&i.GitAuthProviders),
+		pq.Array(&i.ExternalAuthProviders),
 		&i.Message,
+		&i.Archived,
 		&i.CreatedByAvatarURL,
 		&i.CreatedByUsername,
 	)
@@ -4774,7 +5591,7 @@ func (q *sqlQuerier) GetPreviousTemplateVersion(ctx context.Context, arg GetPrev
 
 const getTemplateVersionByID = `-- name: GetTemplateVersionByID :one
 SELECT
-	id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, git_auth_providers, message, created_by_avatar_url, created_by_username
+	id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, external_auth_providers, message, archived, created_by_avatar_url, created_by_username
 FROM
 	template_version_with_user AS template_versions
 WHERE
@@ -4794,8 +5611,9 @@ func (q *sqlQuerier) GetTemplateVersionByID(ctx context.Context, id uuid.UUID) (
 		&i.Readme,
 		&i.JobID,
 		&i.CreatedBy,
-		pq.Array(&i.GitAuthProviders),
+		pq.Array(&i.ExternalAuthProviders),
 		&i.Message,
+		&i.Archived,
 		&i.CreatedByAvatarURL,
 		&i.CreatedByUsername,
 	)
@@ -4804,7 +5622,7 @@ func (q *sqlQuerier) GetTemplateVersionByID(ctx context.Context, id uuid.UUID) (
 
 const getTemplateVersionByJobID = `-- name: GetTemplateVersionByJobID :one
 SELECT
-	id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, git_auth_providers, message, created_by_avatar_url, created_by_username
+	id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, external_auth_providers, message, archived, created_by_avatar_url, created_by_username
 FROM
 	template_version_with_user AS template_versions
 WHERE
@@ -4824,8 +5642,9 @@ func (q *sqlQuerier) GetTemplateVersionByJobID(ctx context.Context, jobID uuid.U
 		&i.Readme,
 		&i.JobID,
 		&i.CreatedBy,
-		pq.Array(&i.GitAuthProviders),
+		pq.Array(&i.ExternalAuthProviders),
 		&i.Message,
+		&i.Archived,
 		&i.CreatedByAvatarURL,
 		&i.CreatedByUsername,
 	)
@@ -4834,7 +5653,7 @@ func (q *sqlQuerier) GetTemplateVersionByJobID(ctx context.Context, jobID uuid.U
 
 const getTemplateVersionByTemplateIDAndName = `-- name: GetTemplateVersionByTemplateIDAndName :one
 SELECT
-	id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, git_auth_providers, message, created_by_avatar_url, created_by_username
+	id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, external_auth_providers, message, archived, created_by_avatar_url, created_by_username
 FROM
 	template_version_with_user AS template_versions
 WHERE
@@ -4860,8 +5679,9 @@ func (q *sqlQuerier) GetTemplateVersionByTemplateIDAndName(ctx context.Context,
 		&i.Readme,
 		&i.JobID,
 		&i.CreatedBy,
-		pq.Array(&i.GitAuthProviders),
+		pq.Array(&i.ExternalAuthProviders),
 		&i.Message,
+		&i.Archived,
 		&i.CreatedByAvatarURL,
 		&i.CreatedByUsername,
 	)
@@ -4870,7 +5690,7 @@ func (q *sqlQuerier) GetTemplateVersionByTemplateIDAndName(ctx context.Context,
 
 const getTemplateVersionsByIDs = `-- name: GetTemplateVersionsByIDs :many
 SELECT
-	id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, git_auth_providers, message, created_by_avatar_url, created_by_username
+	id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, external_auth_providers, message, archived, created_by_avatar_url, created_by_username
 FROM
 	template_version_with_user AS template_versions
 WHERE
@@ -4896,8 +5716,9 @@ func (q *sqlQuerier) GetTemplateVersionsByIDs(ctx context.Context, ids []uuid.UU
 			&i.Readme,
 			&i.JobID,
 			&i.CreatedBy,
-			pq.Array(&i.GitAuthProviders),
+			pq.Array(&i.ExternalAuthProviders),
 			&i.Message,
+			&i.Archived,
 			&i.CreatedByAvatarURL,
 			&i.CreatedByUsername,
 		); err != nil {
@@ -4916,16 +5737,23 @@ func (q *sqlQuerier) GetTemplateVersionsByIDs(ctx context.Context, ids []uuid.UU
 
 const getTemplateVersionsByTemplateID = `-- name: GetTemplateVersionsByTemplateID :many
 SELECT
-	id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, git_auth_providers, message, created_by_avatar_url, created_by_username
+	id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, external_auth_providers, message, archived, created_by_avatar_url, created_by_username
 FROM
 	template_version_with_user AS template_versions
 WHERE
 	template_id = $1 :: uuid
+	  AND CASE
+		-- If no filter is provided, default to returning ALL template versions.
+		-- The called should always provide a filter if they want to omit
+		-- archived versions.
+		WHEN $2 :: boolean IS NULL THEN true
+		ELSE template_versions.archived = $2 :: boolean
+	END
 	AND CASE
 		-- This allows using the last element on a page as effectively a cursor.
 		-- This is an important option for scripts that need to paginate without
 		-- duplicating or missing data.
-		WHEN $2 :: uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN (
+		WHEN $3 :: uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN (
 			-- The pagination cursor is the last ID of the previous page.
 			-- The query is ordered by the created_at field, so select all
 			-- rows after the cursor.
@@ -4935,7 +5763,7 @@ WHERE
 				FROM
 					template_versions
 				WHERE
-					id = $2
+					id = $3
 			)
 		)
 		ELSE true
@@ -4943,22 +5771,24 @@ WHERE
 ORDER BY
     -- Deterministic and consistent ordering of all rows, even if they share
     -- a timestamp. This is to ensure consistent pagination.
-	(created_at, id) ASC OFFSET $3
+	(created_at, id) ASC OFFSET $4
 LIMIT
 	-- A null limit means "no limit", so 0 means return all
-	NULLIF($4 :: int, 0)
+	NULLIF($5 :: int, 0)
 `
 
 type GetTemplateVersionsByTemplateIDParams struct {
-	TemplateID uuid.UUID `db:"template_id" json:"template_id"`
-	AfterID    uuid.UUID `db:"after_id" json:"after_id"`
-	OffsetOpt  int32     `db:"offset_opt" json:"offset_opt"`
-	LimitOpt   int32     `db:"limit_opt" json:"limit_opt"`
+	TemplateID uuid.UUID    `db:"template_id" json:"template_id"`
+	Archived   sql.NullBool `db:"archived" json:"archived"`
+	AfterID    uuid.UUID    `db:"after_id" json:"after_id"`
+	OffsetOpt  int32        `db:"offset_opt" json:"offset_opt"`
+	LimitOpt   int32        `db:"limit_opt" json:"limit_opt"`
 }
 
 func (q *sqlQuerier) GetTemplateVersionsByTemplateID(ctx context.Context, arg GetTemplateVersionsByTemplateIDParams) ([]TemplateVersion, error) {
 	rows, err := q.db.QueryContext(ctx, getTemplateVersionsByTemplateID,
 		arg.TemplateID,
+		arg.Archived,
 		arg.AfterID,
 		arg.OffsetOpt,
 		arg.LimitOpt,
@@ -4980,8 +5810,9 @@ func (q *sqlQuerier) GetTemplateVersionsByTemplateID(ctx context.Context, arg Ge
 			&i.Readme,
 			&i.JobID,
 			&i.CreatedBy,
-			pq.Array(&i.GitAuthProviders),
+			pq.Array(&i.ExternalAuthProviders),
 			&i.Message,
+			&i.Archived,
 			&i.CreatedByAvatarURL,
 			&i.CreatedByUsername,
 		); err != nil {
@@ -4999,7 +5830,7 @@ func (q *sqlQuerier) GetTemplateVersionsByTemplateID(ctx context.Context, arg Ge
 }
 
 const getTemplateVersionsCreatedAfter = `-- name: GetTemplateVersionsCreatedAfter :many
-SELECT id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, git_auth_providers, message, created_by_avatar_url, created_by_username FROM template_version_with_user AS template_versions WHERE created_at > $1
+SELECT id, template_id, organization_id, created_at, updated_at, name, readme, job_id, created_by, external_auth_providers, message, archived, created_by_avatar_url, created_by_username FROM template_version_with_user AS template_versions WHERE created_at > $1
 `
 
 func (q *sqlQuerier) GetTemplateVersionsCreatedAfter(ctx context.Context, createdAt time.Time) ([]TemplateVersion, error) {
@@ -5021,8 +5852,9 @@ func (q *sqlQuerier) GetTemplateVersionsCreatedAfter(ctx context.Context, create
 			&i.Readme,
 			&i.JobID,
 			&i.CreatedBy,
-			pq.Array(&i.GitAuthProviders),
+			pq.Array(&i.ExternalAuthProviders),
 			&i.Message,
+			&i.Archived,
 			&i.CreatedByAvatarURL,
 			&i.CreatedByUsername,
 		); err != nil {
@@ -5086,6 +5918,27 @@ func (q *sqlQuerier) InsertTemplateVersion(ctx context.Context, arg InsertTempla
 	return err
 }
 
+const unarchiveTemplateVersion = `-- name: UnarchiveTemplateVersion :exec
+UPDATE
+	template_versions
+SET
+	archived = false,
+	updated_at = $1
+WHERE
+		id = $2
+`
+
+type UnarchiveTemplateVersionParams struct {
+	UpdatedAt         time.Time `db:"updated_at" json:"updated_at"`
+	TemplateVersionID uuid.UUID `db:"template_version_id" json:"template_version_id"`
+}
+
+// This will always work regardless of the current state of the template version.
+func (q *sqlQuerier) UnarchiveTemplateVersion(ctx context.Context, arg UnarchiveTemplateVersionParams) error {
+	_, err := q.db.ExecContext(ctx, unarchiveTemplateVersion, arg.UpdatedAt, arg.TemplateVersionID)
+	return err
+}
+
 const updateTemplateVersionByID = `-- name: UpdateTemplateVersionByID :exec
 UPDATE
 	template_versions
@@ -5138,24 +5991,24 @@ func (q *sqlQuerier) UpdateTemplateVersionDescriptionByJobID(ctx context.Context
 	return err
 }
 
-const updateTemplateVersionGitAuthProvidersByJobID = `-- name: UpdateTemplateVersionGitAuthProvidersByJobID :exec
+const updateTemplateVersionExternalAuthProvidersByJobID = `-- name: UpdateTemplateVersionExternalAuthProvidersByJobID :exec
 UPDATE
 	template_versions
 SET
-	git_auth_providers = $2,
+	external_auth_providers = $2,
 	updated_at = $3
 WHERE
 	job_id = $1
 `
 
-type UpdateTemplateVersionGitAuthProvidersByJobIDParams struct {
-	JobID            uuid.UUID `db:"job_id" json:"job_id"`
-	GitAuthProviders []string  `db:"git_auth_providers" json:"git_auth_providers"`
-	UpdatedAt        time.Time `db:"updated_at" json:"updated_at"`
+type UpdateTemplateVersionExternalAuthProvidersByJobIDParams struct {
+	JobID                 uuid.UUID `db:"job_id" json:"job_id"`
+	ExternalAuthProviders []string  `db:"external_auth_providers" json:"external_auth_providers"`
+	UpdatedAt             time.Time `db:"updated_at" json:"updated_at"`
 }
 
-func (q *sqlQuerier) UpdateTemplateVersionGitAuthProvidersByJobID(ctx context.Context, arg UpdateTemplateVersionGitAuthProvidersByJobIDParams) error {
-	_, err := q.db.ExecContext(ctx, updateTemplateVersionGitAuthProvidersByJobID, arg.JobID, pq.Array(arg.GitAuthProviders), arg.UpdatedAt)
+func (q *sqlQuerier) UpdateTemplateVersionExternalAuthProvidersByJobID(ctx context.Context, arg UpdateTemplateVersionExternalAuthProvidersByJobIDParams) error {
+	_, err := q.db.ExecContext(ctx, updateTemplateVersionExternalAuthProvidersByJobID, arg.JobID, pq.Array(arg.ExternalAuthProviders), arg.UpdatedAt)
 	return err
 }
 
@@ -5258,7 +6111,7 @@ func (q *sqlQuerier) InsertTemplateVersionVariable(ctx context.Context, arg Inse
 
 const getUserLinkByLinkedID = `-- name: GetUserLinkByLinkedID :one
 SELECT
-	user_id, login_type, linked_id, oauth_access_token, oauth_refresh_token, oauth_expiry
+	user_id, login_type, linked_id, oauth_access_token, oauth_refresh_token, oauth_expiry, oauth_access_token_key_id, oauth_refresh_token_key_id
 FROM
 	user_links
 WHERE
@@ -5275,13 +6128,15 @@ func (q *sqlQuerier) GetUserLinkByLinkedID(ctx context.Context, linkedID string)
 		&i.OAuthAccessToken,
 		&i.OAuthRefreshToken,
 		&i.OAuthExpiry,
+		&i.OAuthAccessTokenKeyID,
+		&i.OAuthRefreshTokenKeyID,
 	)
 	return i, err
 }
 
 const getUserLinkByUserIDLoginType = `-- name: GetUserLinkByUserIDLoginType :one
 SELECT
-	user_id, login_type, linked_id, oauth_access_token, oauth_refresh_token, oauth_expiry
+	user_id, login_type, linked_id, oauth_access_token, oauth_refresh_token, oauth_expiry, oauth_access_token_key_id, oauth_refresh_token_key_id
 FROM
 	user_links
 WHERE
@@ -5303,10 +6158,48 @@ func (q *sqlQuerier) GetUserLinkByUserIDLoginType(ctx context.Context, arg GetUs
 		&i.OAuthAccessToken,
 		&i.OAuthRefreshToken,
 		&i.OAuthExpiry,
+		&i.OAuthAccessTokenKeyID,
+		&i.OAuthRefreshTokenKeyID,
 	)
 	return i, err
 }
 
+const getUserLinksByUserID = `-- name: GetUserLinksByUserID :many
+SELECT user_id, login_type, linked_id, oauth_access_token, oauth_refresh_token, oauth_expiry, oauth_access_token_key_id, oauth_refresh_token_key_id FROM user_links WHERE user_id = $1
+`
+
+func (q *sqlQuerier) GetUserLinksByUserID(ctx context.Context, userID uuid.UUID) ([]UserLink, error) {
+	rows, err := q.db.QueryContext(ctx, getUserLinksByUserID, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []UserLink
+	for rows.Next() {
+		var i UserLink
+		if err := rows.Scan(
+			&i.UserID,
+			&i.LoginType,
+			&i.LinkedID,
+			&i.OAuthAccessToken,
+			&i.OAuthRefreshToken,
+			&i.OAuthExpiry,
+			&i.OAuthAccessTokenKeyID,
+			&i.OAuthRefreshTokenKeyID,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const insertUserLink = `-- name: InsertUserLink :one
 INSERT INTO
 	user_links (
@@ -5314,20 +6207,24 @@ INSERT INTO
 		login_type,
 		linked_id,
 		oauth_access_token,
+		oauth_access_token_key_id,
 		oauth_refresh_token,
+		oauth_refresh_token_key_id,
 		oauth_expiry
 	)
 VALUES
-	( $1, $2, $3, $4, $5, $6 ) RETURNING user_id, login_type, linked_id, oauth_access_token, oauth_refresh_token, oauth_expiry
+	( $1, $2, $3, $4, $5, $6, $7, $8 ) RETURNING user_id, login_type, linked_id, oauth_access_token, oauth_refresh_token, oauth_expiry, oauth_access_token_key_id, oauth_refresh_token_key_id
 `
 
 type InsertUserLinkParams struct {
-	UserID            uuid.UUID `db:"user_id" json:"user_id"`
-	LoginType         LoginType `db:"login_type" json:"login_type"`
-	LinkedID          string    `db:"linked_id" json:"linked_id"`
-	OAuthAccessToken  string    `db:"oauth_access_token" json:"oauth_access_token"`
-	OAuthRefreshToken string    `db:"oauth_refresh_token" json:"oauth_refresh_token"`
-	OAuthExpiry       time.Time `db:"oauth_expiry" json:"oauth_expiry"`
+	UserID                 uuid.UUID      `db:"user_id" json:"user_id"`
+	LoginType              LoginType      `db:"login_type" json:"login_type"`
+	LinkedID               string         `db:"linked_id" json:"linked_id"`
+	OAuthAccessToken       string         `db:"oauth_access_token" json:"oauth_access_token"`
+	OAuthAccessTokenKeyID  sql.NullString `db:"oauth_access_token_key_id" json:"oauth_access_token_key_id"`
+	OAuthRefreshToken      string         `db:"oauth_refresh_token" json:"oauth_refresh_token"`
+	OAuthRefreshTokenKeyID sql.NullString `db:"oauth_refresh_token_key_id" json:"oauth_refresh_token_key_id"`
+	OAuthExpiry            time.Time      `db:"oauth_expiry" json:"oauth_expiry"`
 }
 
 func (q *sqlQuerier) InsertUserLink(ctx context.Context, arg InsertUserLinkParams) (UserLink, error) {
@@ -5336,7 +6233,9 @@ func (q *sqlQuerier) InsertUserLink(ctx context.Context, arg InsertUserLinkParam
 		arg.LoginType,
 		arg.LinkedID,
 		arg.OAuthAccessToken,
+		arg.OAuthAccessTokenKeyID,
 		arg.OAuthRefreshToken,
+		arg.OAuthRefreshTokenKeyID,
 		arg.OAuthExpiry,
 	)
 	var i UserLink
@@ -5347,6 +6246,8 @@ func (q *sqlQuerier) InsertUserLink(ctx context.Context, arg InsertUserLinkParam
 		&i.OAuthAccessToken,
 		&i.OAuthRefreshToken,
 		&i.OAuthExpiry,
+		&i.OAuthAccessTokenKeyID,
+		&i.OAuthRefreshTokenKeyID,
 	)
 	return i, err
 }
@@ -5356,24 +6257,30 @@ UPDATE
 	user_links
 SET
 	oauth_access_token = $1,
-	oauth_refresh_token = $2,
-	oauth_expiry = $3
+	oauth_access_token_key_id = $2,
+	oauth_refresh_token = $3,
+	oauth_refresh_token_key_id = $4,
+	oauth_expiry = $5
 WHERE
-	user_id = $4 AND login_type = $5 RETURNING user_id, login_type, linked_id, oauth_access_token, oauth_refresh_token, oauth_expiry
+	user_id = $6 AND login_type = $7 RETURNING user_id, login_type, linked_id, oauth_access_token, oauth_refresh_token, oauth_expiry, oauth_access_token_key_id, oauth_refresh_token_key_id
 `
 
 type UpdateUserLinkParams struct {
-	OAuthAccessToken  string    `db:"oauth_access_token" json:"oauth_access_token"`
-	OAuthRefreshToken string    `db:"oauth_refresh_token" json:"oauth_refresh_token"`
-	OAuthExpiry       time.Time `db:"oauth_expiry" json:"oauth_expiry"`
-	UserID            uuid.UUID `db:"user_id" json:"user_id"`
-	LoginType         LoginType `db:"login_type" json:"login_type"`
+	OAuthAccessToken       string         `db:"oauth_access_token" json:"oauth_access_token"`
+	OAuthAccessTokenKeyID  sql.NullString `db:"oauth_access_token_key_id" json:"oauth_access_token_key_id"`
+	OAuthRefreshToken      string         `db:"oauth_refresh_token" json:"oauth_refresh_token"`
+	OAuthRefreshTokenKeyID sql.NullString `db:"oauth_refresh_token_key_id" json:"oauth_refresh_token_key_id"`
+	OAuthExpiry            time.Time      `db:"oauth_expiry" json:"oauth_expiry"`
+	UserID                 uuid.UUID      `db:"user_id" json:"user_id"`
+	LoginType              LoginType      `db:"login_type" json:"login_type"`
 }
 
 func (q *sqlQuerier) UpdateUserLink(ctx context.Context, arg UpdateUserLinkParams) (UserLink, error) {
 	row := q.db.QueryRowContext(ctx, updateUserLink,
 		arg.OAuthAccessToken,
+		arg.OAuthAccessTokenKeyID,
 		arg.OAuthRefreshToken,
+		arg.OAuthRefreshTokenKeyID,
 		arg.OAuthExpiry,
 		arg.UserID,
 		arg.LoginType,
@@ -5386,6 +6293,8 @@ func (q *sqlQuerier) UpdateUserLink(ctx context.Context, arg UpdateUserLinkParam
 		&i.OAuthAccessToken,
 		&i.OAuthRefreshToken,
 		&i.OAuthExpiry,
+		&i.OAuthAccessTokenKeyID,
+		&i.OAuthRefreshTokenKeyID,
 	)
 	return i, err
 }
@@ -5396,7 +6305,7 @@ UPDATE
 SET
 	linked_id = $1
 WHERE
-	user_id = $2 AND login_type = $3 RETURNING user_id, login_type, linked_id, oauth_access_token, oauth_refresh_token, oauth_expiry
+	user_id = $2 AND login_type = $3 RETURNING user_id, login_type, linked_id, oauth_access_token, oauth_refresh_token, oauth_expiry, oauth_access_token_key_id, oauth_refresh_token_key_id
 `
 
 type UpdateUserLinkedIDParams struct {
@@ -5415,10 +6324,40 @@ func (q *sqlQuerier) UpdateUserLinkedID(ctx context.Context, arg UpdateUserLinke
 		&i.OAuthAccessToken,
 		&i.OAuthRefreshToken,
 		&i.OAuthExpiry,
+		&i.OAuthAccessTokenKeyID,
+		&i.OAuthRefreshTokenKeyID,
 	)
 	return i, err
 }
 
+const allUserIDs = `-- name: AllUserIDs :many
+SELECT DISTINCT id FROM USERS
+`
+
+// AllUserIDs returns all UserIDs regardless of user status or deletion.
+func (q *sqlQuerier) AllUserIDs(ctx context.Context) ([]uuid.UUID, error) {
+	rows, err := q.db.QueryContext(ctx, allUserIDs)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []uuid.UUID
+	for rows.Next() {
+		var id uuid.UUID
+		if err := rows.Scan(&id); err != nil {
+			return nil, err
+		}
+		items = append(items, id)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const getActiveUserCount = `-- name: GetActiveUserCount :one
 SELECT
 	COUNT(*)
@@ -6168,61 +7107,117 @@ func (q *sqlQuerier) DeleteOldWorkspaceAgentLogs(ctx context.Context) error {
 	return err
 }
 
-const getWorkspaceAgentByAuthToken = `-- name: GetWorkspaceAgentByAuthToken :one
+const getWorkspaceAgentAndOwnerByAuthToken = `-- name: GetWorkspaceAgentAndOwnerByAuthToken :one
 SELECT
-	id, created_at, updated_at, name, first_connected_at, last_connected_at, disconnected_at, resource_id, auth_token, auth_instance_id, architecture, environment_variables, operating_system, startup_script, instance_metadata, resource_metadata, directory, version, last_connected_replica_id, connection_timeout_seconds, troubleshooting_url, motd_file, lifecycle_state, startup_script_timeout_seconds, expanded_directory, shutdown_script, shutdown_script_timeout_seconds, logs_length, logs_overflowed, subsystem, startup_script_behavior, started_at, ready_at
-FROM
-	workspace_agents
+	workspace_agents.id, workspace_agents.created_at, workspace_agents.updated_at, workspace_agents.name, workspace_agents.first_connected_at, workspace_agents.last_connected_at, workspace_agents.disconnected_at, workspace_agents.resource_id, workspace_agents.auth_token, workspace_agents.auth_instance_id, workspace_agents.architecture, workspace_agents.environment_variables, workspace_agents.operating_system, workspace_agents.instance_metadata, workspace_agents.resource_metadata, workspace_agents.directory, workspace_agents.version, workspace_agents.last_connected_replica_id, workspace_agents.connection_timeout_seconds, workspace_agents.troubleshooting_url, workspace_agents.motd_file, workspace_agents.lifecycle_state, workspace_agents.expanded_directory, workspace_agents.logs_length, workspace_agents.logs_overflowed, workspace_agents.started_at, workspace_agents.ready_at, workspace_agents.subsystems, workspace_agents.display_apps, workspace_agents.api_version,
+	workspaces.id AS workspace_id,
+	users.id AS owner_id,
+	users.username AS owner_name,
+	users.status AS owner_status,
+	array_cat(
+		array_append(users.rbac_roles, 'member'),
+		array_append(ARRAY[]::text[], 'organization-member:' || organization_members.organization_id::text)
+	)::text[] as owner_roles,
+	array_agg(COALESCE(group_members.group_id::text, ''))::text[] AS owner_groups
+FROM users
+	INNER JOIN
+		workspaces
+	ON
+		workspaces.owner_id = users.id
+	INNER JOIN
+		workspace_builds
+	ON
+		workspace_builds.workspace_id = workspaces.id
+	INNER JOIN
+		workspace_resources
+	ON
+		workspace_resources.job_id = workspace_builds.job_id
+	INNER JOIN
+		workspace_agents
+	ON
+		workspace_agents.resource_id = workspace_resources.id
+	INNER JOIN -- every user is a member of some org
+		organization_members
+	ON
+		organization_members.user_id = users.id
+	LEFT JOIN -- as they may not be a member of any groups
+		group_members
+	ON
+		group_members.user_id = users.id
 WHERE
-	auth_token = $1
+	-- TODO: we can add more conditions here, such as:
+	-- 1) The user must be active
+	-- 2) The user must not be deleted
+	-- 3) The workspace must be running
+	workspace_agents.auth_token = $1
+GROUP BY
+	workspace_agents.id,
+	workspaces.id,
+	users.id,
+	organization_members.organization_id,
+	workspace_builds.build_number
 ORDER BY
-	created_at DESC
+	workspace_builds.build_number DESC
+LIMIT 1
 `
 
-func (q *sqlQuerier) GetWorkspaceAgentByAuthToken(ctx context.Context, authToken uuid.UUID) (WorkspaceAgent, error) {
-	row := q.db.QueryRowContext(ctx, getWorkspaceAgentByAuthToken, authToken)
-	var i WorkspaceAgent
+type GetWorkspaceAgentAndOwnerByAuthTokenRow struct {
+	WorkspaceAgent WorkspaceAgent `db:"workspace_agent" json:"workspace_agent"`
+	WorkspaceID    uuid.UUID      `db:"workspace_id" json:"workspace_id"`
+	OwnerID        uuid.UUID      `db:"owner_id" json:"owner_id"`
+	OwnerName      string         `db:"owner_name" json:"owner_name"`
+	OwnerStatus    UserStatus     `db:"owner_status" json:"owner_status"`
+	OwnerRoles     []string       `db:"owner_roles" json:"owner_roles"`
+	OwnerGroups    []string       `db:"owner_groups" json:"owner_groups"`
+}
+
+func (q *sqlQuerier) GetWorkspaceAgentAndOwnerByAuthToken(ctx context.Context, authToken uuid.UUID) (GetWorkspaceAgentAndOwnerByAuthTokenRow, error) {
+	row := q.db.QueryRowContext(ctx, getWorkspaceAgentAndOwnerByAuthToken, authToken)
+	var i GetWorkspaceAgentAndOwnerByAuthTokenRow
 	err := row.Scan(
-		&i.ID,
-		&i.CreatedAt,
-		&i.UpdatedAt,
-		&i.Name,
-		&i.FirstConnectedAt,
-		&i.LastConnectedAt,
-		&i.DisconnectedAt,
-		&i.ResourceID,
-		&i.AuthToken,
-		&i.AuthInstanceID,
-		&i.Architecture,
-		&i.EnvironmentVariables,
-		&i.OperatingSystem,
-		&i.StartupScript,
-		&i.InstanceMetadata,
-		&i.ResourceMetadata,
-		&i.Directory,
-		&i.Version,
-		&i.LastConnectedReplicaID,
-		&i.ConnectionTimeoutSeconds,
-		&i.TroubleshootingURL,
-		&i.MOTDFile,
-		&i.LifecycleState,
-		&i.StartupScriptTimeoutSeconds,
-		&i.ExpandedDirectory,
-		&i.ShutdownScript,
-		&i.ShutdownScriptTimeoutSeconds,
-		&i.LogsLength,
-		&i.LogsOverflowed,
-		&i.Subsystem,
-		&i.StartupScriptBehavior,
-		&i.StartedAt,
-		&i.ReadyAt,
+		&i.WorkspaceAgent.ID,
+		&i.WorkspaceAgent.CreatedAt,
+		&i.WorkspaceAgent.UpdatedAt,
+		&i.WorkspaceAgent.Name,
+		&i.WorkspaceAgent.FirstConnectedAt,
+		&i.WorkspaceAgent.LastConnectedAt,
+		&i.WorkspaceAgent.DisconnectedAt,
+		&i.WorkspaceAgent.ResourceID,
+		&i.WorkspaceAgent.AuthToken,
+		&i.WorkspaceAgent.AuthInstanceID,
+		&i.WorkspaceAgent.Architecture,
+		&i.WorkspaceAgent.EnvironmentVariables,
+		&i.WorkspaceAgent.OperatingSystem,
+		&i.WorkspaceAgent.InstanceMetadata,
+		&i.WorkspaceAgent.ResourceMetadata,
+		&i.WorkspaceAgent.Directory,
+		&i.WorkspaceAgent.Version,
+		&i.WorkspaceAgent.LastConnectedReplicaID,
+		&i.WorkspaceAgent.ConnectionTimeoutSeconds,
+		&i.WorkspaceAgent.TroubleshootingURL,
+		&i.WorkspaceAgent.MOTDFile,
+		&i.WorkspaceAgent.LifecycleState,
+		&i.WorkspaceAgent.ExpandedDirectory,
+		&i.WorkspaceAgent.LogsLength,
+		&i.WorkspaceAgent.LogsOverflowed,
+		&i.WorkspaceAgent.StartedAt,
+		&i.WorkspaceAgent.ReadyAt,
+		pq.Array(&i.WorkspaceAgent.Subsystems),
+		pq.Array(&i.WorkspaceAgent.DisplayApps),
+		&i.WorkspaceAgent.APIVersion,
+		&i.WorkspaceID,
+		&i.OwnerID,
+		&i.OwnerName,
+		&i.OwnerStatus,
+		pq.Array(&i.OwnerRoles),
+		pq.Array(&i.OwnerGroups),
 	)
 	return i, err
 }
 
 const getWorkspaceAgentByID = `-- name: GetWorkspaceAgentByID :one
 SELECT
-	id, created_at, updated_at, name, first_connected_at, last_connected_at, disconnected_at, resource_id, auth_token, auth_instance_id, architecture, environment_variables, operating_system, startup_script, instance_metadata, resource_metadata, directory, version, last_connected_replica_id, connection_timeout_seconds, troubleshooting_url, motd_file, lifecycle_state, startup_script_timeout_seconds, expanded_directory, shutdown_script, shutdown_script_timeout_seconds, logs_length, logs_overflowed, subsystem, startup_script_behavior, started_at, ready_at
+	id, created_at, updated_at, name, first_connected_at, last_connected_at, disconnected_at, resource_id, auth_token, auth_instance_id, architecture, environment_variables, operating_system, instance_metadata, resource_metadata, directory, version, last_connected_replica_id, connection_timeout_seconds, troubleshooting_url, motd_file, lifecycle_state, expanded_directory, logs_length, logs_overflowed, started_at, ready_at, subsystems, display_apps, api_version
 FROM
 	workspace_agents
 WHERE
@@ -6246,7 +7241,6 @@ func (q *sqlQuerier) GetWorkspaceAgentByID(ctx context.Context, id uuid.UUID) (W
 		&i.Architecture,
 		&i.EnvironmentVariables,
 		&i.OperatingSystem,
-		&i.StartupScript,
 		&i.InstanceMetadata,
 		&i.ResourceMetadata,
 		&i.Directory,
@@ -6256,23 +7250,21 @@ func (q *sqlQuerier) GetWorkspaceAgentByID(ctx context.Context, id uuid.UUID) (W
 		&i.TroubleshootingURL,
 		&i.MOTDFile,
 		&i.LifecycleState,
-		&i.StartupScriptTimeoutSeconds,
 		&i.ExpandedDirectory,
-		&i.ShutdownScript,
-		&i.ShutdownScriptTimeoutSeconds,
 		&i.LogsLength,
 		&i.LogsOverflowed,
-		&i.Subsystem,
-		&i.StartupScriptBehavior,
 		&i.StartedAt,
 		&i.ReadyAt,
+		pq.Array(&i.Subsystems),
+		pq.Array(&i.DisplayApps),
+		&i.APIVersion,
 	)
 	return i, err
 }
 
 const getWorkspaceAgentByInstanceID = `-- name: GetWorkspaceAgentByInstanceID :one
 SELECT
-	id, created_at, updated_at, name, first_connected_at, last_connected_at, disconnected_at, resource_id, auth_token, auth_instance_id, architecture, environment_variables, operating_system, startup_script, instance_metadata, resource_metadata, directory, version, last_connected_replica_id, connection_timeout_seconds, troubleshooting_url, motd_file, lifecycle_state, startup_script_timeout_seconds, expanded_directory, shutdown_script, shutdown_script_timeout_seconds, logs_length, logs_overflowed, subsystem, startup_script_behavior, started_at, ready_at
+	id, created_at, updated_at, name, first_connected_at, last_connected_at, disconnected_at, resource_id, auth_token, auth_instance_id, architecture, environment_variables, operating_system, instance_metadata, resource_metadata, directory, version, last_connected_replica_id, connection_timeout_seconds, troubleshooting_url, motd_file, lifecycle_state, expanded_directory, logs_length, logs_overflowed, started_at, ready_at, subsystems, display_apps, api_version
 FROM
 	workspace_agents
 WHERE
@@ -6298,7 +7290,6 @@ func (q *sqlQuerier) GetWorkspaceAgentByInstanceID(ctx context.Context, authInst
 		&i.Architecture,
 		&i.EnvironmentVariables,
 		&i.OperatingSystem,
-		&i.StartupScript,
 		&i.InstanceMetadata,
 		&i.ResourceMetadata,
 		&i.Directory,
@@ -6308,16 +7299,14 @@ func (q *sqlQuerier) GetWorkspaceAgentByInstanceID(ctx context.Context, authInst
 		&i.TroubleshootingURL,
 		&i.MOTDFile,
 		&i.LifecycleState,
-		&i.StartupScriptTimeoutSeconds,
 		&i.ExpandedDirectory,
-		&i.ShutdownScript,
-		&i.ShutdownScriptTimeoutSeconds,
 		&i.LogsLength,
 		&i.LogsOverflowed,
-		&i.Subsystem,
-		&i.StartupScriptBehavior,
 		&i.StartedAt,
 		&i.ReadyAt,
+		pq.Array(&i.Subsystems),
+		pq.Array(&i.DisplayApps),
+		&i.APIVersion,
 	)
 	return i, err
 }
@@ -6346,9 +7335,42 @@ func (q *sqlQuerier) GetWorkspaceAgentLifecycleStateByID(ctx context.Context, id
 	return i, err
 }
 
+const getWorkspaceAgentLogSourcesByAgentIDs = `-- name: GetWorkspaceAgentLogSourcesByAgentIDs :many
+SELECT workspace_agent_id, id, created_at, display_name, icon FROM workspace_agent_log_sources WHERE workspace_agent_id = ANY($1 :: uuid [ ])
+`
+
+func (q *sqlQuerier) GetWorkspaceAgentLogSourcesByAgentIDs(ctx context.Context, ids []uuid.UUID) ([]WorkspaceAgentLogSource, error) {
+	rows, err := q.db.QueryContext(ctx, getWorkspaceAgentLogSourcesByAgentIDs, pq.Array(ids))
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []WorkspaceAgentLogSource
+	for rows.Next() {
+		var i WorkspaceAgentLogSource
+		if err := rows.Scan(
+			&i.WorkspaceAgentID,
+			&i.ID,
+			&i.CreatedAt,
+			&i.DisplayName,
+			&i.Icon,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const getWorkspaceAgentLogsAfter = `-- name: GetWorkspaceAgentLogsAfter :many
 SELECT
-	agent_id, created_at, output, id, level, source
+	agent_id, created_at, output, id, level, log_source_id
 FROM
 	workspace_agent_logs
 WHERE
@@ -6378,7 +7400,7 @@ func (q *sqlQuerier) GetWorkspaceAgentLogsAfter(ctx context.Context, arg GetWork
 			&i.Output,
 			&i.ID,
 			&i.Level,
-			&i.Source,
+			&i.LogSourceID,
 		); err != nil {
 			return nil, err
 		}
@@ -6400,10 +7422,16 @@ FROM
 	workspace_agent_metadata
 WHERE
 	workspace_agent_id = $1
+	AND CASE WHEN COALESCE(array_length($2::text[], 1), 0) > 0 THEN key = ANY($2::text[]) ELSE TRUE END
 `
 
-func (q *sqlQuerier) GetWorkspaceAgentMetadata(ctx context.Context, workspaceAgentID uuid.UUID) ([]WorkspaceAgentMetadatum, error) {
-	rows, err := q.db.QueryContext(ctx, getWorkspaceAgentMetadata, workspaceAgentID)
+type GetWorkspaceAgentMetadataParams struct {
+	WorkspaceAgentID uuid.UUID `db:"workspace_agent_id" json:"workspace_agent_id"`
+	Keys             []string  `db:"keys" json:"keys"`
+}
+
+func (q *sqlQuerier) GetWorkspaceAgentMetadata(ctx context.Context, arg GetWorkspaceAgentMetadataParams) ([]WorkspaceAgentMetadatum, error) {
+	rows, err := q.db.QueryContext(ctx, getWorkspaceAgentMetadata, arg.WorkspaceAgentID, pq.Array(arg.Keys))
 	if err != nil {
 		return nil, err
 	}
@@ -6437,7 +7465,7 @@ func (q *sqlQuerier) GetWorkspaceAgentMetadata(ctx context.Context, workspaceAge
 
 const getWorkspaceAgentsByResourceIDs = `-- name: GetWorkspaceAgentsByResourceIDs :many
 SELECT
-	id, created_at, updated_at, name, first_connected_at, last_connected_at, disconnected_at, resource_id, auth_token, auth_instance_id, architecture, environment_variables, operating_system, startup_script, instance_metadata, resource_metadata, directory, version, last_connected_replica_id, connection_timeout_seconds, troubleshooting_url, motd_file, lifecycle_state, startup_script_timeout_seconds, expanded_directory, shutdown_script, shutdown_script_timeout_seconds, logs_length, logs_overflowed, subsystem, startup_script_behavior, started_at, ready_at
+	id, created_at, updated_at, name, first_connected_at, last_connected_at, disconnected_at, resource_id, auth_token, auth_instance_id, architecture, environment_variables, operating_system, instance_metadata, resource_metadata, directory, version, last_connected_replica_id, connection_timeout_seconds, troubleshooting_url, motd_file, lifecycle_state, expanded_directory, logs_length, logs_overflowed, started_at, ready_at, subsystems, display_apps, api_version
 FROM
 	workspace_agents
 WHERE
@@ -6467,7 +7495,6 @@ func (q *sqlQuerier) GetWorkspaceAgentsByResourceIDs(ctx context.Context, ids []
 			&i.Architecture,
 			&i.EnvironmentVariables,
 			&i.OperatingSystem,
-			&i.StartupScript,
 			&i.InstanceMetadata,
 			&i.ResourceMetadata,
 			&i.Directory,
@@ -6477,16 +7504,14 @@ func (q *sqlQuerier) GetWorkspaceAgentsByResourceIDs(ctx context.Context, ids []
 			&i.TroubleshootingURL,
 			&i.MOTDFile,
 			&i.LifecycleState,
-			&i.StartupScriptTimeoutSeconds,
 			&i.ExpandedDirectory,
-			&i.ShutdownScript,
-			&i.ShutdownScriptTimeoutSeconds,
 			&i.LogsLength,
 			&i.LogsOverflowed,
-			&i.Subsystem,
-			&i.StartupScriptBehavior,
 			&i.StartedAt,
 			&i.ReadyAt,
+			pq.Array(&i.Subsystems),
+			pq.Array(&i.DisplayApps),
+			&i.APIVersion,
 		); err != nil {
 			return nil, err
 		}
@@ -6502,7 +7527,7 @@ func (q *sqlQuerier) GetWorkspaceAgentsByResourceIDs(ctx context.Context, ids []
 }
 
 const getWorkspaceAgentsCreatedAfter = `-- name: GetWorkspaceAgentsCreatedAfter :many
-SELECT id, created_at, updated_at, name, first_connected_at, last_connected_at, disconnected_at, resource_id, auth_token, auth_instance_id, architecture, environment_variables, operating_system, startup_script, instance_metadata, resource_metadata, directory, version, last_connected_replica_id, connection_timeout_seconds, troubleshooting_url, motd_file, lifecycle_state, startup_script_timeout_seconds, expanded_directory, shutdown_script, shutdown_script_timeout_seconds, logs_length, logs_overflowed, subsystem, startup_script_behavior, started_at, ready_at FROM workspace_agents WHERE created_at > $1
+SELECT id, created_at, updated_at, name, first_connected_at, last_connected_at, disconnected_at, resource_id, auth_token, auth_instance_id, architecture, environment_variables, operating_system, instance_metadata, resource_metadata, directory, version, last_connected_replica_id, connection_timeout_seconds, troubleshooting_url, motd_file, lifecycle_state, expanded_directory, logs_length, logs_overflowed, started_at, ready_at, subsystems, display_apps, api_version FROM workspace_agents WHERE created_at > $1
 `
 
 func (q *sqlQuerier) GetWorkspaceAgentsCreatedAfter(ctx context.Context, createdAt time.Time) ([]WorkspaceAgent, error) {
@@ -6528,7 +7553,6 @@ func (q *sqlQuerier) GetWorkspaceAgentsCreatedAfter(ctx context.Context, created
 			&i.Architecture,
 			&i.EnvironmentVariables,
 			&i.OperatingSystem,
-			&i.StartupScript,
 			&i.InstanceMetadata,
 			&i.ResourceMetadata,
 			&i.Directory,
@@ -6538,16 +7562,14 @@ func (q *sqlQuerier) GetWorkspaceAgentsCreatedAfter(ctx context.Context, created
 			&i.TroubleshootingURL,
 			&i.MOTDFile,
 			&i.LifecycleState,
-			&i.StartupScriptTimeoutSeconds,
 			&i.ExpandedDirectory,
-			&i.ShutdownScript,
-			&i.ShutdownScriptTimeoutSeconds,
 			&i.LogsLength,
 			&i.LogsOverflowed,
-			&i.Subsystem,
-			&i.StartupScriptBehavior,
 			&i.StartedAt,
 			&i.ReadyAt,
+			pq.Array(&i.Subsystems),
+			pq.Array(&i.DisplayApps),
+			&i.APIVersion,
 		); err != nil {
 			return nil, err
 		}
@@ -6564,7 +7586,7 @@ func (q *sqlQuerier) GetWorkspaceAgentsCreatedAfter(ctx context.Context, created
 
 const getWorkspaceAgentsInLatestBuildByWorkspaceID = `-- name: GetWorkspaceAgentsInLatestBuildByWorkspaceID :many
 SELECT
-	workspace_agents.id, workspace_agents.created_at, workspace_agents.updated_at, workspace_agents.name, workspace_agents.first_connected_at, workspace_agents.last_connected_at, workspace_agents.disconnected_at, workspace_agents.resource_id, workspace_agents.auth_token, workspace_agents.auth_instance_id, workspace_agents.architecture, workspace_agents.environment_variables, workspace_agents.operating_system, workspace_agents.startup_script, workspace_agents.instance_metadata, workspace_agents.resource_metadata, workspace_agents.directory, workspace_agents.version, workspace_agents.last_connected_replica_id, workspace_agents.connection_timeout_seconds, workspace_agents.troubleshooting_url, workspace_agents.motd_file, workspace_agents.lifecycle_state, workspace_agents.startup_script_timeout_seconds, workspace_agents.expanded_directory, workspace_agents.shutdown_script, workspace_agents.shutdown_script_timeout_seconds, workspace_agents.logs_length, workspace_agents.logs_overflowed, workspace_agents.subsystem, workspace_agents.startup_script_behavior, workspace_agents.started_at, workspace_agents.ready_at
+	workspace_agents.id, workspace_agents.created_at, workspace_agents.updated_at, workspace_agents.name, workspace_agents.first_connected_at, workspace_agents.last_connected_at, workspace_agents.disconnected_at, workspace_agents.resource_id, workspace_agents.auth_token, workspace_agents.auth_instance_id, workspace_agents.architecture, workspace_agents.environment_variables, workspace_agents.operating_system, workspace_agents.instance_metadata, workspace_agents.resource_metadata, workspace_agents.directory, workspace_agents.version, workspace_agents.last_connected_replica_id, workspace_agents.connection_timeout_seconds, workspace_agents.troubleshooting_url, workspace_agents.motd_file, workspace_agents.lifecycle_state, workspace_agents.expanded_directory, workspace_agents.logs_length, workspace_agents.logs_overflowed, workspace_agents.started_at, workspace_agents.ready_at, workspace_agents.subsystems, workspace_agents.display_apps, workspace_agents.api_version
 FROM
 	workspace_agents
 JOIN
@@ -6606,7 +7628,6 @@ func (q *sqlQuerier) GetWorkspaceAgentsInLatestBuildByWorkspaceID(ctx context.Co
 			&i.Architecture,
 			&i.EnvironmentVariables,
 			&i.OperatingSystem,
-			&i.StartupScript,
 			&i.InstanceMetadata,
 			&i.ResourceMetadata,
 			&i.Directory,
@@ -6616,16 +7637,14 @@ func (q *sqlQuerier) GetWorkspaceAgentsInLatestBuildByWorkspaceID(ctx context.Co
 			&i.TroubleshootingURL,
 			&i.MOTDFile,
 			&i.LifecycleState,
-			&i.StartupScriptTimeoutSeconds,
 			&i.ExpandedDirectory,
-			&i.ShutdownScript,
-			&i.ShutdownScriptTimeoutSeconds,
 			&i.LogsLength,
 			&i.LogsOverflowed,
-			&i.Subsystem,
-			&i.StartupScriptBehavior,
 			&i.StartedAt,
 			&i.ReadyAt,
+			pq.Array(&i.Subsystems),
+			pq.Array(&i.DisplayApps),
+			&i.APIVersion,
 		); err != nil {
 			return nil, err
 		}
@@ -6653,44 +7672,36 @@ INSERT INTO
 		architecture,
 		environment_variables,
 		operating_system,
-		startup_script,
 		directory,
 		instance_metadata,
 		resource_metadata,
 		connection_timeout_seconds,
 		troubleshooting_url,
 		motd_file,
-		startup_script_behavior,
-		startup_script_timeout_seconds,
-		shutdown_script,
-		shutdown_script_timeout_seconds
+		display_apps
 	)
 VALUES
-	($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21) RETURNING id, created_at, updated_at, name, first_connected_at, last_connected_at, disconnected_at, resource_id, auth_token, auth_instance_id, architecture, environment_variables, operating_system, startup_script, instance_metadata, resource_metadata, directory, version, last_connected_replica_id, connection_timeout_seconds, troubleshooting_url, motd_file, lifecycle_state, startup_script_timeout_seconds, expanded_directory, shutdown_script, shutdown_script_timeout_seconds, logs_length, logs_overflowed, subsystem, startup_script_behavior, started_at, ready_at
+	($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17) RETURNING id, created_at, updated_at, name, first_connected_at, last_connected_at, disconnected_at, resource_id, auth_token, auth_instance_id, architecture, environment_variables, operating_system, instance_metadata, resource_metadata, directory, version, last_connected_replica_id, connection_timeout_seconds, troubleshooting_url, motd_file, lifecycle_state, expanded_directory, logs_length, logs_overflowed, started_at, ready_at, subsystems, display_apps, api_version
 `
 
 type InsertWorkspaceAgentParams struct {
-	ID                           uuid.UUID             `db:"id" json:"id"`
-	CreatedAt                    time.Time             `db:"created_at" json:"created_at"`
-	UpdatedAt                    time.Time             `db:"updated_at" json:"updated_at"`
-	Name                         string                `db:"name" json:"name"`
-	ResourceID                   uuid.UUID             `db:"resource_id" json:"resource_id"`
-	AuthToken                    uuid.UUID             `db:"auth_token" json:"auth_token"`
-	AuthInstanceID               sql.NullString        `db:"auth_instance_id" json:"auth_instance_id"`
-	Architecture                 string                `db:"architecture" json:"architecture"`
-	EnvironmentVariables         pqtype.NullRawMessage `db:"environment_variables" json:"environment_variables"`
-	OperatingSystem              string                `db:"operating_system" json:"operating_system"`
-	StartupScript                sql.NullString        `db:"startup_script" json:"startup_script"`
-	Directory                    string                `db:"directory" json:"directory"`
-	InstanceMetadata             pqtype.NullRawMessage `db:"instance_metadata" json:"instance_metadata"`
-	ResourceMetadata             pqtype.NullRawMessage `db:"resource_metadata" json:"resource_metadata"`
-	ConnectionTimeoutSeconds     int32                 `db:"connection_timeout_seconds" json:"connection_timeout_seconds"`
-	TroubleshootingURL           string                `db:"troubleshooting_url" json:"troubleshooting_url"`
-	MOTDFile                     string                `db:"motd_file" json:"motd_file"`
-	StartupScriptBehavior        StartupScriptBehavior `db:"startup_script_behavior" json:"startup_script_behavior"`
-	StartupScriptTimeoutSeconds  int32                 `db:"startup_script_timeout_seconds" json:"startup_script_timeout_seconds"`
-	ShutdownScript               sql.NullString        `db:"shutdown_script" json:"shutdown_script"`
-	ShutdownScriptTimeoutSeconds int32                 `db:"shutdown_script_timeout_seconds" json:"shutdown_script_timeout_seconds"`
+	ID                       uuid.UUID             `db:"id" json:"id"`
+	CreatedAt                time.Time             `db:"created_at" json:"created_at"`
+	UpdatedAt                time.Time             `db:"updated_at" json:"updated_at"`
+	Name                     string                `db:"name" json:"name"`
+	ResourceID               uuid.UUID             `db:"resource_id" json:"resource_id"`
+	AuthToken                uuid.UUID             `db:"auth_token" json:"auth_token"`
+	AuthInstanceID           sql.NullString        `db:"auth_instance_id" json:"auth_instance_id"`
+	Architecture             string                `db:"architecture" json:"architecture"`
+	EnvironmentVariables     pqtype.NullRawMessage `db:"environment_variables" json:"environment_variables"`
+	OperatingSystem          string                `db:"operating_system" json:"operating_system"`
+	Directory                string                `db:"directory" json:"directory"`
+	InstanceMetadata         pqtype.NullRawMessage `db:"instance_metadata" json:"instance_metadata"`
+	ResourceMetadata         pqtype.NullRawMessage `db:"resource_metadata" json:"resource_metadata"`
+	ConnectionTimeoutSeconds int32                 `db:"connection_timeout_seconds" json:"connection_timeout_seconds"`
+	TroubleshootingURL       string                `db:"troubleshooting_url" json:"troubleshooting_url"`
+	MOTDFile                 string                `db:"motd_file" json:"motd_file"`
+	DisplayApps              []DisplayApp          `db:"display_apps" json:"display_apps"`
 }
 
 func (q *sqlQuerier) InsertWorkspaceAgent(ctx context.Context, arg InsertWorkspaceAgentParams) (WorkspaceAgent, error) {
@@ -6705,17 +7716,13 @@ func (q *sqlQuerier) InsertWorkspaceAgent(ctx context.Context, arg InsertWorkspa
 		arg.Architecture,
 		arg.EnvironmentVariables,
 		arg.OperatingSystem,
-		arg.StartupScript,
 		arg.Directory,
 		arg.InstanceMetadata,
 		arg.ResourceMetadata,
 		arg.ConnectionTimeoutSeconds,
 		arg.TroubleshootingURL,
 		arg.MOTDFile,
-		arg.StartupScriptBehavior,
-		arg.StartupScriptTimeoutSeconds,
-		arg.ShutdownScript,
-		arg.ShutdownScriptTimeoutSeconds,
+		pq.Array(arg.DisplayApps),
 	)
 	var i WorkspaceAgent
 	err := row.Scan(
@@ -6732,7 +7739,6 @@ func (q *sqlQuerier) InsertWorkspaceAgent(ctx context.Context, arg InsertWorkspa
 		&i.Architecture,
 		&i.EnvironmentVariables,
 		&i.OperatingSystem,
-		&i.StartupScript,
 		&i.InstanceMetadata,
 		&i.ResourceMetadata,
 		&i.Directory,
@@ -6742,52 +7748,105 @@ func (q *sqlQuerier) InsertWorkspaceAgent(ctx context.Context, arg InsertWorkspa
 		&i.TroubleshootingURL,
 		&i.MOTDFile,
 		&i.LifecycleState,
-		&i.StartupScriptTimeoutSeconds,
 		&i.ExpandedDirectory,
-		&i.ShutdownScript,
-		&i.ShutdownScriptTimeoutSeconds,
 		&i.LogsLength,
 		&i.LogsOverflowed,
-		&i.Subsystem,
-		&i.StartupScriptBehavior,
 		&i.StartedAt,
 		&i.ReadyAt,
+		pq.Array(&i.Subsystems),
+		pq.Array(&i.DisplayApps),
+		&i.APIVersion,
 	)
 	return i, err
 }
 
+const insertWorkspaceAgentLogSources = `-- name: InsertWorkspaceAgentLogSources :many
+INSERT INTO
+		workspace_agent_log_sources (workspace_agent_id, created_at, id, display_name, icon)
+	SELECT
+		$1 :: uuid AS workspace_agent_id,
+		$2 :: timestamptz AS created_at,
+		unnest($3 :: uuid [ ]) AS id,
+		unnest($4 :: VARCHAR(127) [ ]) AS display_name,
+		unnest($5 :: text [ ]) AS icon
+	RETURNING workspace_agent_log_sources.workspace_agent_id, workspace_agent_log_sources.id, workspace_agent_log_sources.created_at, workspace_agent_log_sources.display_name, workspace_agent_log_sources.icon
+`
+
+type InsertWorkspaceAgentLogSourcesParams struct {
+	WorkspaceAgentID uuid.UUID   `db:"workspace_agent_id" json:"workspace_agent_id"`
+	CreatedAt        time.Time   `db:"created_at" json:"created_at"`
+	ID               []uuid.UUID `db:"id" json:"id"`
+	DisplayName      []string    `db:"display_name" json:"display_name"`
+	Icon             []string    `db:"icon" json:"icon"`
+}
+
+func (q *sqlQuerier) InsertWorkspaceAgentLogSources(ctx context.Context, arg InsertWorkspaceAgentLogSourcesParams) ([]WorkspaceAgentLogSource, error) {
+	rows, err := q.db.QueryContext(ctx, insertWorkspaceAgentLogSources,
+		arg.WorkspaceAgentID,
+		arg.CreatedAt,
+		pq.Array(arg.ID),
+		pq.Array(arg.DisplayName),
+		pq.Array(arg.Icon),
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []WorkspaceAgentLogSource
+	for rows.Next() {
+		var i WorkspaceAgentLogSource
+		if err := rows.Scan(
+			&i.WorkspaceAgentID,
+			&i.ID,
+			&i.CreatedAt,
+			&i.DisplayName,
+			&i.Icon,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const insertWorkspaceAgentLogs = `-- name: InsertWorkspaceAgentLogs :many
 WITH new_length AS (
 	UPDATE workspace_agents SET
 	logs_length = logs_length + $6 WHERE workspace_agents.id = $1
 )
 INSERT INTO
-		workspace_agent_logs (agent_id, created_at, output, level, source)
+		workspace_agent_logs (agent_id, created_at, output, level, log_source_id)
 	SELECT
 		$1 :: uuid AS agent_id,
-		unnest($2 :: timestamptz [ ]) AS created_at,
+		$2 :: timestamptz AS created_at,
 		unnest($3 :: VARCHAR(1024) [ ]) AS output,
 		unnest($4 :: log_level [ ]) AS level,
-		unnest($5 :: workspace_agent_log_source [ ]) AS source
-	RETURNING workspace_agent_logs.agent_id, workspace_agent_logs.created_at, workspace_agent_logs.output, workspace_agent_logs.id, workspace_agent_logs.level, workspace_agent_logs.source
+		$5 :: uuid AS log_source_id
+	RETURNING workspace_agent_logs.agent_id, workspace_agent_logs.created_at, workspace_agent_logs.output, workspace_agent_logs.id, workspace_agent_logs.level, workspace_agent_logs.log_source_id
 `
 
 type InsertWorkspaceAgentLogsParams struct {
-	AgentID      uuid.UUID                 `db:"agent_id" json:"agent_id"`
-	CreatedAt    []time.Time               `db:"created_at" json:"created_at"`
-	Output       []string                  `db:"output" json:"output"`
-	Level        []LogLevel                `db:"level" json:"level"`
-	Source       []WorkspaceAgentLogSource `db:"source" json:"source"`
-	OutputLength int32                     `db:"output_length" json:"output_length"`
+	AgentID      uuid.UUID  `db:"agent_id" json:"agent_id"`
+	CreatedAt    time.Time  `db:"created_at" json:"created_at"`
+	Output       []string   `db:"output" json:"output"`
+	Level        []LogLevel `db:"level" json:"level"`
+	LogSourceID  uuid.UUID  `db:"log_source_id" json:"log_source_id"`
+	OutputLength int32      `db:"output_length" json:"output_length"`
 }
 
 func (q *sqlQuerier) InsertWorkspaceAgentLogs(ctx context.Context, arg InsertWorkspaceAgentLogsParams) ([]WorkspaceAgentLog, error) {
 	rows, err := q.db.QueryContext(ctx, insertWorkspaceAgentLogs,
 		arg.AgentID,
-		pq.Array(arg.CreatedAt),
+		arg.CreatedAt,
 		pq.Array(arg.Output),
 		pq.Array(arg.Level),
-		pq.Array(arg.Source),
+		arg.LogSourceID,
 		arg.OutputLength,
 	)
 	if err != nil {
@@ -6803,7 +7862,7 @@ func (q *sqlQuerier) InsertWorkspaceAgentLogs(ctx context.Context, arg InsertWor
 			&i.Output,
 			&i.ID,
 			&i.Level,
-			&i.Source,
+			&i.LogSourceID,
 		); err != nil {
 			return nil, err
 		}
@@ -6935,32 +7994,41 @@ func (q *sqlQuerier) UpdateWorkspaceAgentLogOverflowByID(ctx context.Context, ar
 }
 
 const updateWorkspaceAgentMetadata = `-- name: UpdateWorkspaceAgentMetadata :exec
+WITH metadata AS (
+	SELECT
+		unnest($2::text[]) AS key,
+		unnest($3::text[]) AS value,
+		unnest($4::text[]) AS error,
+		unnest($5::timestamptz[]) AS collected_at
+)
 UPDATE
-	workspace_agent_metadata
+	workspace_agent_metadata wam
 SET
-	value = $3,
-	error = $4,
-	collected_at = $5
+	value = m.value,
+	error = m.error,
+	collected_at = m.collected_at
+FROM
+	metadata m
 WHERE
-	workspace_agent_id = $1
-	AND key = $2
+	wam.workspace_agent_id = $1
+	AND wam.key = m.key
 `
 
 type UpdateWorkspaceAgentMetadataParams struct {
-	WorkspaceAgentID uuid.UUID `db:"workspace_agent_id" json:"workspace_agent_id"`
-	Key              string    `db:"key" json:"key"`
-	Value            string    `db:"value" json:"value"`
-	Error            string    `db:"error" json:"error"`
-	CollectedAt      time.Time `db:"collected_at" json:"collected_at"`
+	WorkspaceAgentID uuid.UUID   `db:"workspace_agent_id" json:"workspace_agent_id"`
+	Key              []string    `db:"key" json:"key"`
+	Value            []string    `db:"value" json:"value"`
+	Error            []string    `db:"error" json:"error"`
+	CollectedAt      []time.Time `db:"collected_at" json:"collected_at"`
 }
 
 func (q *sqlQuerier) UpdateWorkspaceAgentMetadata(ctx context.Context, arg UpdateWorkspaceAgentMetadataParams) error {
 	_, err := q.db.ExecContext(ctx, updateWorkspaceAgentMetadata,
 		arg.WorkspaceAgentID,
-		arg.Key,
-		arg.Value,
-		arg.Error,
-		arg.CollectedAt,
+		pq.Array(arg.Key),
+		pq.Array(arg.Value),
+		pq.Array(arg.Error),
+		pq.Array(arg.CollectedAt),
 	)
 	return err
 }
@@ -6971,16 +8039,16 @@ UPDATE
 SET
 	version = $2,
 	expanded_directory = $3,
-	subsystem = $4
+	subsystems = $4
 WHERE
 	id = $1
 `
 
 type UpdateWorkspaceAgentStartupByIDParams struct {
-	ID                uuid.UUID               `db:"id" json:"id"`
-	Version           string                  `db:"version" json:"version"`
-	ExpandedDirectory string                  `db:"expanded_directory" json:"expanded_directory"`
-	Subsystem         WorkspaceAgentSubsystem `db:"subsystem" json:"subsystem"`
+	ID                uuid.UUID                 `db:"id" json:"id"`
+	Version           string                    `db:"version" json:"version"`
+	ExpandedDirectory string                    `db:"expanded_directory" json:"expanded_directory"`
+	Subsystems        []WorkspaceAgentSubsystem `db:"subsystems" json:"subsystems"`
 }
 
 func (q *sqlQuerier) UpdateWorkspaceAgentStartupByID(ctx context.Context, arg UpdateWorkspaceAgentStartupByIDParams) error {
@@ -6988,13 +8056,13 @@ func (q *sqlQuerier) UpdateWorkspaceAgentStartupByID(ctx context.Context, arg Up
 		arg.ID,
 		arg.Version,
 		arg.ExpandedDirectory,
-		arg.Subsystem,
+		pq.Array(arg.Subsystems),
 	)
 	return err
 }
 
 const deleteOldWorkspaceAgentStats = `-- name: DeleteOldWorkspaceAgentStats :exec
-DELETE FROM workspace_agent_stats WHERE created_at < NOW() - INTERVAL '30 days'
+DELETE FROM workspace_agent_stats WHERE created_at < NOW() - INTERVAL '6 months'
 `
 
 func (q *sqlQuerier) DeleteOldWorkspaceAgentStats(ctx context.Context) error {
@@ -7415,7 +8483,91 @@ func (q *sqlQuerier) InsertWorkspaceAgentStat(ctx context.Context, arg InsertWor
 		&i.SessionCountReconnectingPTY,
 		&i.SessionCountSSH,
 	)
-	return i, err
+	return i, err
+}
+
+const insertWorkspaceAgentStats = `-- name: InsertWorkspaceAgentStats :exec
+INSERT INTO
+	workspace_agent_stats (
+		id,
+		created_at,
+		user_id,
+		workspace_id,
+		template_id,
+		agent_id,
+		connections_by_proto,
+		connection_count,
+		rx_packets,
+		rx_bytes,
+		tx_packets,
+		tx_bytes,
+		session_count_vscode,
+		session_count_jetbrains,
+		session_count_reconnecting_pty,
+		session_count_ssh,
+		connection_median_latency_ms
+	)
+SELECT
+	unnest($1 :: uuid[]) AS id,
+	unnest($2 :: timestamptz[]) AS created_at,
+	unnest($3 :: uuid[]) AS user_id,
+	unnest($4 :: uuid[]) AS workspace_id,
+	unnest($5 :: uuid[]) AS template_id,
+	unnest($6 :: uuid[]) AS agent_id,
+	jsonb_array_elements($7 :: jsonb) AS connections_by_proto,
+	unnest($8 :: bigint[]) AS connection_count,
+	unnest($9 :: bigint[]) AS rx_packets,
+	unnest($10 :: bigint[]) AS rx_bytes,
+	unnest($11 :: bigint[]) AS tx_packets,
+	unnest($12 :: bigint[]) AS tx_bytes,
+	unnest($13 :: bigint[]) AS session_count_vscode,
+	unnest($14 :: bigint[]) AS session_count_jetbrains,
+	unnest($15 :: bigint[]) AS session_count_reconnecting_pty,
+	unnest($16 :: bigint[]) AS session_count_ssh,
+	unnest($17 :: double precision[]) AS connection_median_latency_ms
+`
+
+type InsertWorkspaceAgentStatsParams struct {
+	ID                          []uuid.UUID     `db:"id" json:"id"`
+	CreatedAt                   []time.Time     `db:"created_at" json:"created_at"`
+	UserID                      []uuid.UUID     `db:"user_id" json:"user_id"`
+	WorkspaceID                 []uuid.UUID     `db:"workspace_id" json:"workspace_id"`
+	TemplateID                  []uuid.UUID     `db:"template_id" json:"template_id"`
+	AgentID                     []uuid.UUID     `db:"agent_id" json:"agent_id"`
+	ConnectionsByProto          json.RawMessage `db:"connections_by_proto" json:"connections_by_proto"`
+	ConnectionCount             []int64         `db:"connection_count" json:"connection_count"`
+	RxPackets                   []int64         `db:"rx_packets" json:"rx_packets"`
+	RxBytes                     []int64         `db:"rx_bytes" json:"rx_bytes"`
+	TxPackets                   []int64         `db:"tx_packets" json:"tx_packets"`
+	TxBytes                     []int64         `db:"tx_bytes" json:"tx_bytes"`
+	SessionCountVSCode          []int64         `db:"session_count_vscode" json:"session_count_vscode"`
+	SessionCountJetBrains       []int64         `db:"session_count_jetbrains" json:"session_count_jetbrains"`
+	SessionCountReconnectingPTY []int64         `db:"session_count_reconnecting_pty" json:"session_count_reconnecting_pty"`
+	SessionCountSSH             []int64         `db:"session_count_ssh" json:"session_count_ssh"`
+	ConnectionMedianLatencyMS   []float64       `db:"connection_median_latency_ms" json:"connection_median_latency_ms"`
+}
+
+func (q *sqlQuerier) InsertWorkspaceAgentStats(ctx context.Context, arg InsertWorkspaceAgentStatsParams) error {
+	_, err := q.db.ExecContext(ctx, insertWorkspaceAgentStats,
+		pq.Array(arg.ID),
+		pq.Array(arg.CreatedAt),
+		pq.Array(arg.UserID),
+		pq.Array(arg.WorkspaceID),
+		pq.Array(arg.TemplateID),
+		pq.Array(arg.AgentID),
+		arg.ConnectionsByProto,
+		pq.Array(arg.ConnectionCount),
+		pq.Array(arg.RxPackets),
+		pq.Array(arg.RxBytes),
+		pq.Array(arg.TxPackets),
+		pq.Array(arg.TxBytes),
+		pq.Array(arg.SessionCountVSCode),
+		pq.Array(arg.SessionCountJetBrains),
+		pq.Array(arg.SessionCountReconnectingPTY),
+		pq.Array(arg.SessionCountSSH),
+		pq.Array(arg.ConnectionMedianLatencyMS),
+	)
+	return err
 }
 
 const getWorkspaceAppByAgentIDAndSlug = `-- name: GetWorkspaceAppByAgentIDAndSlug :one
@@ -7678,6 +8830,72 @@ func (q *sqlQuerier) UpdateWorkspaceAppHealthByID(ctx context.Context, arg Updat
 	return err
 }
 
+const insertWorkspaceAppStats = `-- name: InsertWorkspaceAppStats :exec
+INSERT INTO
+	workspace_app_stats (
+		user_id,
+		workspace_id,
+		agent_id,
+		access_method,
+		slug_or_port,
+		session_id,
+		session_started_at,
+		session_ended_at,
+		requests
+	)
+SELECT
+	unnest($1::uuid[]) AS user_id,
+	unnest($2::uuid[]) AS workspace_id,
+	unnest($3::uuid[]) AS agent_id,
+	unnest($4::text[]) AS access_method,
+	unnest($5::text[]) AS slug_or_port,
+	unnest($6::uuid[]) AS session_id,
+	unnest($7::timestamptz[]) AS session_started_at,
+	unnest($8::timestamptz[]) AS session_ended_at,
+	unnest($9::int[]) AS requests
+ON CONFLICT
+	(user_id, agent_id, session_id)
+DO
+	UPDATE SET
+		session_ended_at = EXCLUDED.session_ended_at,
+		requests = EXCLUDED.requests
+	WHERE
+		workspace_app_stats.user_id = EXCLUDED.user_id
+		AND workspace_app_stats.agent_id = EXCLUDED.agent_id
+		AND workspace_app_stats.session_id = EXCLUDED.session_id
+		-- Since stats are updated in place as time progresses, we only
+		-- want to update this row if it's fresh.
+		AND workspace_app_stats.session_ended_at <= EXCLUDED.session_ended_at
+		AND workspace_app_stats.requests <= EXCLUDED.requests
+`
+
+type InsertWorkspaceAppStatsParams struct {
+	UserID           []uuid.UUID `db:"user_id" json:"user_id"`
+	WorkspaceID      []uuid.UUID `db:"workspace_id" json:"workspace_id"`
+	AgentID          []uuid.UUID `db:"agent_id" json:"agent_id"`
+	AccessMethod     []string    `db:"access_method" json:"access_method"`
+	SlugOrPort       []string    `db:"slug_or_port" json:"slug_or_port"`
+	SessionID        []uuid.UUID `db:"session_id" json:"session_id"`
+	SessionStartedAt []time.Time `db:"session_started_at" json:"session_started_at"`
+	SessionEndedAt   []time.Time `db:"session_ended_at" json:"session_ended_at"`
+	Requests         []int32     `db:"requests" json:"requests"`
+}
+
+func (q *sqlQuerier) InsertWorkspaceAppStats(ctx context.Context, arg InsertWorkspaceAppStatsParams) error {
+	_, err := q.db.ExecContext(ctx, insertWorkspaceAppStats,
+		pq.Array(arg.UserID),
+		pq.Array(arg.WorkspaceID),
+		pq.Array(arg.AgentID),
+		pq.Array(arg.AccessMethod),
+		pq.Array(arg.SlugOrPort),
+		pq.Array(arg.SessionID),
+		pq.Array(arg.SessionStartedAt),
+		pq.Array(arg.SessionEndedAt),
+		pq.Array(arg.Requests),
+	)
+	return err
+}
+
 const getWorkspaceBuildParameters = `-- name: GetWorkspaceBuildParameters :many
 SELECT
     workspace_build_id, name, value
@@ -7731,6 +8949,77 @@ func (q *sqlQuerier) InsertWorkspaceBuildParameters(ctx context.Context, arg Ins
 	return err
 }
 
+const getActiveWorkspaceBuildsByTemplateID = `-- name: GetActiveWorkspaceBuildsByTemplateID :many
+SELECT wb.id, wb.created_at, wb.updated_at, wb.workspace_id, wb.template_version_id, wb.build_number, wb.transition, wb.initiator_id, wb.provisioner_state, wb.job_id, wb.deadline, wb.reason, wb.daily_cost, wb.max_deadline, wb.initiator_by_avatar_url, wb.initiator_by_username
+FROM (
+    SELECT
+        workspace_id, MAX(build_number) as max_build_number
+    FROM
+		workspace_build_with_user AS workspace_builds
+    WHERE
+        workspace_id IN (
+			SELECT
+				id
+			FROM
+				workspaces
+			WHERE
+				template_id = $1
+		)
+    GROUP BY
+        workspace_id
+) m
+JOIN
+	workspace_build_with_user AS wb
+	ON m.workspace_id = wb.workspace_id AND m.max_build_number = wb.build_number
+JOIN
+	provisioner_jobs AS pj
+	ON wb.job_id = pj.id
+WHERE
+	wb.transition = 'start'::workspace_transition
+AND
+	pj.completed_at IS NOT NULL
+`
+
+func (q *sqlQuerier) GetActiveWorkspaceBuildsByTemplateID(ctx context.Context, templateID uuid.UUID) ([]WorkspaceBuild, error) {
+	rows, err := q.db.QueryContext(ctx, getActiveWorkspaceBuildsByTemplateID, templateID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []WorkspaceBuild
+	for rows.Next() {
+		var i WorkspaceBuild
+		if err := rows.Scan(
+			&i.ID,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.WorkspaceID,
+			&i.TemplateVersionID,
+			&i.BuildNumber,
+			&i.Transition,
+			&i.InitiatorID,
+			&i.ProvisionerState,
+			&i.JobID,
+			&i.Deadline,
+			&i.Reason,
+			&i.DailyCost,
+			&i.MaxDeadline,
+			&i.InitiatorByAvatarUrl,
+			&i.InitiatorByUsername,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const getLatestWorkspaceBuildByWorkspaceID = `-- name: GetLatestWorkspaceBuildByWorkspaceID :one
 SELECT
 	id, created_at, updated_at, workspace_id, template_version_id, build_number, transition, initiator_id, provisioner_state, job_id, deadline, reason, daily_cost, max_deadline, initiator_by_avatar_url, initiator_by_username
@@ -8177,53 +9466,69 @@ func (q *sqlQuerier) InsertWorkspaceBuild(ctx context.Context, arg InsertWorkspa
 	return err
 }
 
-const updateWorkspaceBuildByID = `-- name: UpdateWorkspaceBuildByID :exec
+const updateWorkspaceBuildCostByID = `-- name: UpdateWorkspaceBuildCostByID :exec
 UPDATE
 	workspace_builds
 SET
-	updated_at = $2,
-	provisioner_state = $3,
-	deadline = $4,
-	max_deadline = $5
+	daily_cost = $2
 WHERE
 	id = $1
 `
 
-type UpdateWorkspaceBuildByIDParams struct {
-	ID               uuid.UUID `db:"id" json:"id"`
-	UpdatedAt        time.Time `db:"updated_at" json:"updated_at"`
-	ProvisionerState []byte    `db:"provisioner_state" json:"provisioner_state"`
-	Deadline         time.Time `db:"deadline" json:"deadline"`
-	MaxDeadline      time.Time `db:"max_deadline" json:"max_deadline"`
+type UpdateWorkspaceBuildCostByIDParams struct {
+	ID        uuid.UUID `db:"id" json:"id"`
+	DailyCost int32     `db:"daily_cost" json:"daily_cost"`
 }
 
-func (q *sqlQuerier) UpdateWorkspaceBuildByID(ctx context.Context, arg UpdateWorkspaceBuildByIDParams) error {
-	_, err := q.db.ExecContext(ctx, updateWorkspaceBuildByID,
-		arg.ID,
-		arg.UpdatedAt,
-		arg.ProvisionerState,
+func (q *sqlQuerier) UpdateWorkspaceBuildCostByID(ctx context.Context, arg UpdateWorkspaceBuildCostByIDParams) error {
+	_, err := q.db.ExecContext(ctx, updateWorkspaceBuildCostByID, arg.ID, arg.DailyCost)
+	return err
+}
+
+const updateWorkspaceBuildDeadlineByID = `-- name: UpdateWorkspaceBuildDeadlineByID :exec
+UPDATE
+	workspace_builds
+SET
+	deadline = $1::timestamptz,
+	max_deadline = $2::timestamptz,
+	updated_at = $3::timestamptz
+WHERE id = $4::uuid
+`
+
+type UpdateWorkspaceBuildDeadlineByIDParams struct {
+	Deadline    time.Time `db:"deadline" json:"deadline"`
+	MaxDeadline time.Time `db:"max_deadline" json:"max_deadline"`
+	UpdatedAt   time.Time `db:"updated_at" json:"updated_at"`
+	ID          uuid.UUID `db:"id" json:"id"`
+}
+
+func (q *sqlQuerier) UpdateWorkspaceBuildDeadlineByID(ctx context.Context, arg UpdateWorkspaceBuildDeadlineByIDParams) error {
+	_, err := q.db.ExecContext(ctx, updateWorkspaceBuildDeadlineByID,
 		arg.Deadline,
 		arg.MaxDeadline,
+		arg.UpdatedAt,
+		arg.ID,
 	)
 	return err
 }
 
-const updateWorkspaceBuildCostByID = `-- name: UpdateWorkspaceBuildCostByID :exec
+const updateWorkspaceBuildProvisionerStateByID = `-- name: UpdateWorkspaceBuildProvisionerStateByID :exec
 UPDATE
 	workspace_builds
 SET
-	daily_cost = $2
-WHERE
-	id = $1
+	provisioner_state = $1::bytea,
+	updated_at = $2::timestamptz
+WHERE id = $3::uuid
 `
 
-type UpdateWorkspaceBuildCostByIDParams struct {
-	ID        uuid.UUID `db:"id" json:"id"`
-	DailyCost int32     `db:"daily_cost" json:"daily_cost"`
+type UpdateWorkspaceBuildProvisionerStateByIDParams struct {
+	ProvisionerState []byte    `db:"provisioner_state" json:"provisioner_state"`
+	UpdatedAt        time.Time `db:"updated_at" json:"updated_at"`
+	ID               uuid.UUID `db:"id" json:"id"`
 }
 
-func (q *sqlQuerier) UpdateWorkspaceBuildCostByID(ctx context.Context, arg UpdateWorkspaceBuildCostByIDParams) error {
-	_, err := q.db.ExecContext(ctx, updateWorkspaceBuildCostByID, arg.ID, arg.DailyCost)
+func (q *sqlQuerier) UpdateWorkspaceBuildProvisionerStateByID(ctx context.Context, arg UpdateWorkspaceBuildProvisionerStateByIDParams) error {
+	_, err := q.db.ExecContext(ctx, updateWorkspaceBuildProvisionerStateByID, arg.ProvisionerState, arg.UpdatedAt, arg.ID)
 	return err
 }
 
@@ -8637,7 +9942,7 @@ func (q *sqlQuerier) GetDeploymentWorkspaceStats(ctx context.Context) (GetDeploy
 
 const getWorkspaceByAgentID = `-- name: GetWorkspaceByAgentID :one
 SELECT
-	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, locked_at, deleting_at
+	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates
 FROM
 	workspaces
 WHERE
@@ -8680,15 +9985,16 @@ func (q *sqlQuerier) GetWorkspaceByAgentID(ctx context.Context, agentID uuid.UUI
 		&i.AutostartSchedule,
 		&i.Ttl,
 		&i.LastUsedAt,
-		&i.LockedAt,
+		&i.DormantAt,
 		&i.DeletingAt,
+		&i.AutomaticUpdates,
 	)
 	return i, err
 }
 
 const getWorkspaceByID = `-- name: GetWorkspaceByID :one
 SELECT
-	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, locked_at, deleting_at
+	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates
 FROM
 	workspaces
 WHERE
@@ -8712,15 +10018,16 @@ func (q *sqlQuerier) GetWorkspaceByID(ctx context.Context, id uuid.UUID) (Worksp
 		&i.AutostartSchedule,
 		&i.Ttl,
 		&i.LastUsedAt,
-		&i.LockedAt,
+		&i.DormantAt,
 		&i.DeletingAt,
+		&i.AutomaticUpdates,
 	)
 	return i, err
 }
 
 const getWorkspaceByOwnerIDAndName = `-- name: GetWorkspaceByOwnerIDAndName :one
 SELECT
-	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, locked_at, deleting_at
+	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates
 FROM
 	workspaces
 WHERE
@@ -8751,15 +10058,16 @@ func (q *sqlQuerier) GetWorkspaceByOwnerIDAndName(ctx context.Context, arg GetWo
 		&i.AutostartSchedule,
 		&i.Ttl,
 		&i.LastUsedAt,
-		&i.LockedAt,
+		&i.DormantAt,
 		&i.DeletingAt,
+		&i.AutomaticUpdates,
 	)
 	return i, err
 }
 
 const getWorkspaceByWorkspaceAppID = `-- name: GetWorkspaceByWorkspaceAppID :one
 SELECT
-	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, locked_at, deleting_at
+	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates
 FROM
 	workspaces
 WHERE
@@ -8809,15 +10117,16 @@ func (q *sqlQuerier) GetWorkspaceByWorkspaceAppID(ctx context.Context, workspace
 		&i.AutostartSchedule,
 		&i.Ttl,
 		&i.LastUsedAt,
-		&i.LockedAt,
+		&i.DormantAt,
 		&i.DeletingAt,
+		&i.AutomaticUpdates,
 	)
 	return i, err
 }
 
 const getWorkspaces = `-- name: GetWorkspaces :many
 SELECT
-	workspaces.id, workspaces.created_at, workspaces.updated_at, workspaces.owner_id, workspaces.organization_id, workspaces.template_id, workspaces.deleted, workspaces.name, workspaces.autostart_schedule, workspaces.ttl, workspaces.last_used_at, workspaces.locked_at, workspaces.deleting_at,
+	workspaces.id, workspaces.created_at, workspaces.updated_at, workspaces.owner_id, workspaces.organization_id, workspaces.template_id, workspaces.deleted, workspaces.name, workspaces.autostart_schedule, workspaces.ttl, workspaces.last_used_at, workspaces.dormant_at, workspaces.deleting_at, workspaces.automatic_updates,
 	COALESCE(template_name.template_name, 'unknown') as template_name,
 	latest_build.template_version_id,
 	latest_build.template_version_name,
@@ -8838,7 +10147,8 @@ LEFT JOIN LATERAL (
 		provisioner_jobs.updated_at,
 		provisioner_jobs.canceled_at,
 		provisioner_jobs.completed_at,
-		provisioner_jobs.error
+		provisioner_jobs.error,
+		provisioner_jobs.job_status
 	FROM
 		workspace_builds
 	LEFT JOIN
@@ -8870,63 +10180,42 @@ WHERE
 	AND CASE
 		WHEN $2 :: text != '' THEN
 			CASE
-				WHEN $2 = 'pending' THEN
-					latest_build.started_at IS NULL
+			    -- Some workspace specific status refer to the transition
+			    -- type. By default, the standard provisioner job status
+			    -- search strings are supported.
+			    -- 'running' states
 				WHEN $2 = 'starting' THEN
-					latest_build.started_at IS NOT NULL AND
-					latest_build.canceled_at IS NULL AND
-					latest_build.completed_at IS NULL AND
-					latest_build.updated_at - INTERVAL '30 seconds' < NOW() AND
-					latest_build.transition = 'start'::workspace_transition
-
-				WHEN $2 = 'running' THEN
-					latest_build.completed_at IS NOT NULL AND
-					latest_build.canceled_at IS NULL AND
-					latest_build.error IS NULL AND
+				    latest_build.job_status = 'running'::provisioner_job_status AND
 					latest_build.transition = 'start'::workspace_transition
-
 				WHEN $2 = 'stopping' THEN
-					latest_build.started_at IS NOT NULL AND
-					latest_build.canceled_at IS NULL AND
-					latest_build.completed_at IS NULL AND
-					latest_build.updated_at - INTERVAL '30 seconds' < NOW() AND
+					latest_build.job_status = 'running'::provisioner_job_status AND
 					latest_build.transition = 'stop'::workspace_transition
+				WHEN $2 = 'deleting' THEN
+					latest_build.job_status = 'running' AND
+					latest_build.transition = 'delete'::workspace_transition
 
+			    -- 'succeeded' states
+			    WHEN $2 = 'deleted' THEN
+			    	latest_build.job_status = 'succeeded'::provisioner_job_status AND
+			    	latest_build.transition = 'delete'::workspace_transition
 				WHEN $2 = 'stopped' THEN
-					latest_build.completed_at IS NOT NULL AND
-					latest_build.canceled_at IS NULL AND
-					latest_build.error IS NULL AND
+					latest_build.job_status = 'succeeded'::provisioner_job_status AND
 					latest_build.transition = 'stop'::workspace_transition
+				WHEN $2 = 'started' THEN
+					latest_build.job_status = 'succeeded'::provisioner_job_status AND
+					latest_build.transition = 'start'::workspace_transition
 
-				WHEN $2 = 'failed' THEN
-					(latest_build.canceled_at IS NOT NULL AND
-						latest_build.error IS NOT NULL) OR
-					(latest_build.completed_at IS NOT NULL AND
-						latest_build.error IS NOT NULL)
-
-				WHEN $2 = 'canceling' THEN
-					latest_build.canceled_at IS NOT NULL AND
-					latest_build.completed_at IS NULL
-
-				WHEN $2 = 'canceled' THEN
-					latest_build.canceled_at IS NOT NULL AND
-					latest_build.completed_at IS NOT NULL
-
-				WHEN $2 = 'deleted' THEN
-					latest_build.started_at IS NOT NULL AND
-					latest_build.canceled_at IS NULL AND
-					latest_build.completed_at IS NOT NULL AND
-					latest_build.updated_at - INTERVAL '30 seconds' < NOW() AND
-					latest_build.transition = 'delete'::workspace_transition AND
-					-- If the error field is not null, the status is 'failed'
-					latest_build.error IS NULL
-
-				WHEN $2 = 'deleting' THEN
-					latest_build.completed_at IS NULL AND
-					latest_build.canceled_at IS NULL AND
-					latest_build.error IS NULL AND
-					latest_build.transition = 'delete'::workspace_transition
+			    -- Special case where the provisioner status and workspace status
+			    -- differ. A workspace is "running" if the job is "succeeded" and
+			    -- the transition is "start". This is because a workspace starts
+			    -- running when a job is complete.
+			    WHEN $2 = 'running' THEN
+					latest_build.job_status = 'succeeded'::provisioner_job_status AND
+					latest_build.transition = 'start'::workspace_transition
 
+				WHEN $2 != '' THEN
+				    -- By default just match the job status exactly
+			    	latest_build.job_status = $2::provisioner_job_status
 				ELSE
 					true
 			END
@@ -9001,6 +10290,25 @@ WHERE
 			) > 0
 		ELSE true
 	END
+	-- Filter by dormant workspaces. By default we do not return dormant
+	-- workspaces since they are considered soft-deleted.
+	AND CASE
+		WHEN $10 :: text != '' THEN
+			dormant_at IS NOT NULL 
+		ELSE
+			dormant_at IS NULL
+	END
+	-- Filter by last_used
+	AND CASE
+		  WHEN $11 :: timestamp with time zone > '0001-01-01 00:00:00Z' THEN
+				  workspaces.last_used_at <= $11
+		  ELSE true
+	END
+	AND CASE
+		  WHEN $12 :: timestamp with time zone > '0001-01-01 00:00:00Z' THEN
+				  workspaces.last_used_at >= $12
+		  ELSE true
+	END
 	-- Authorize Filter clause will be injected below in GetAuthorizedWorkspaces
 	-- @authorize_filter
 ORDER BY
@@ -9012,11 +10320,11 @@ ORDER BY
 	LOWER(workspaces.name) ASC
 LIMIT
 	CASE
-		WHEN $11 :: integer > 0 THEN
-			$11
+		WHEN $14 :: integer > 0 THEN
+			$14
 	END
 OFFSET
-	$10
+	$13
 `
 
 type GetWorkspacesParams struct {
@@ -9029,28 +10337,32 @@ type GetWorkspacesParams struct {
 	Name                                  string      `db:"name" json:"name"`
 	HasAgent                              string      `db:"has_agent" json:"has_agent"`
 	AgentInactiveDisconnectTimeoutSeconds int64       `db:"agent_inactive_disconnect_timeout_seconds" json:"agent_inactive_disconnect_timeout_seconds"`
+	IsDormant                             string      `db:"is_dormant" json:"is_dormant"`
+	LastUsedBefore                        time.Time   `db:"last_used_before" json:"last_used_before"`
+	LastUsedAfter                         time.Time   `db:"last_used_after" json:"last_used_after"`
 	Offset                                int32       `db:"offset_" json:"offset_"`
 	Limit                                 int32       `db:"limit_" json:"limit_"`
 }
 
 type GetWorkspacesRow struct {
-	ID                  uuid.UUID      `db:"id" json:"id"`
-	CreatedAt           time.Time      `db:"created_at" json:"created_at"`
-	UpdatedAt           time.Time      `db:"updated_at" json:"updated_at"`
-	OwnerID             uuid.UUID      `db:"owner_id" json:"owner_id"`
-	OrganizationID      uuid.UUID      `db:"organization_id" json:"organization_id"`
-	TemplateID          uuid.UUID      `db:"template_id" json:"template_id"`
-	Deleted             bool           `db:"deleted" json:"deleted"`
-	Name                string         `db:"name" json:"name"`
-	AutostartSchedule   sql.NullString `db:"autostart_schedule" json:"autostart_schedule"`
-	Ttl                 sql.NullInt64  `db:"ttl" json:"ttl"`
-	LastUsedAt          time.Time      `db:"last_used_at" json:"last_used_at"`
-	LockedAt            sql.NullTime   `db:"locked_at" json:"locked_at"`
-	DeletingAt          sql.NullTime   `db:"deleting_at" json:"deleting_at"`
-	TemplateName        string         `db:"template_name" json:"template_name"`
-	TemplateVersionID   uuid.UUID      `db:"template_version_id" json:"template_version_id"`
-	TemplateVersionName sql.NullString `db:"template_version_name" json:"template_version_name"`
-	Count               int64          `db:"count" json:"count"`
+	ID                  uuid.UUID        `db:"id" json:"id"`
+	CreatedAt           time.Time        `db:"created_at" json:"created_at"`
+	UpdatedAt           time.Time        `db:"updated_at" json:"updated_at"`
+	OwnerID             uuid.UUID        `db:"owner_id" json:"owner_id"`
+	OrganizationID      uuid.UUID        `db:"organization_id" json:"organization_id"`
+	TemplateID          uuid.UUID        `db:"template_id" json:"template_id"`
+	Deleted             bool             `db:"deleted" json:"deleted"`
+	Name                string           `db:"name" json:"name"`
+	AutostartSchedule   sql.NullString   `db:"autostart_schedule" json:"autostart_schedule"`
+	Ttl                 sql.NullInt64    `db:"ttl" json:"ttl"`
+	LastUsedAt          time.Time        `db:"last_used_at" json:"last_used_at"`
+	DormantAt           sql.NullTime     `db:"dormant_at" json:"dormant_at"`
+	DeletingAt          sql.NullTime     `db:"deleting_at" json:"deleting_at"`
+	AutomaticUpdates    AutomaticUpdates `db:"automatic_updates" json:"automatic_updates"`
+	TemplateName        string           `db:"template_name" json:"template_name"`
+	TemplateVersionID   uuid.UUID        `db:"template_version_id" json:"template_version_id"`
+	TemplateVersionName sql.NullString   `db:"template_version_name" json:"template_version_name"`
+	Count               int64            `db:"count" json:"count"`
 }
 
 func (q *sqlQuerier) GetWorkspaces(ctx context.Context, arg GetWorkspacesParams) ([]GetWorkspacesRow, error) {
@@ -9064,6 +10376,9 @@ func (q *sqlQuerier) GetWorkspaces(ctx context.Context, arg GetWorkspacesParams)
 		arg.Name,
 		arg.HasAgent,
 		arg.AgentInactiveDisconnectTimeoutSeconds,
+		arg.IsDormant,
+		arg.LastUsedBefore,
+		arg.LastUsedAfter,
 		arg.Offset,
 		arg.Limit,
 	)
@@ -9086,8 +10401,9 @@ func (q *sqlQuerier) GetWorkspaces(ctx context.Context, arg GetWorkspacesParams)
 			&i.AutostartSchedule,
 			&i.Ttl,
 			&i.LastUsedAt,
-			&i.LockedAt,
+			&i.DormantAt,
 			&i.DeletingAt,
+			&i.AutomaticUpdates,
 			&i.TemplateName,
 			&i.TemplateVersionID,
 			&i.TemplateVersionName,
@@ -9108,7 +10424,7 @@ func (q *sqlQuerier) GetWorkspaces(ctx context.Context, arg GetWorkspacesParams)
 
 const getWorkspacesEligibleForTransition = `-- name: GetWorkspacesEligibleForTransition :many
 SELECT
-	workspaces.id, workspaces.created_at, workspaces.updated_at, workspaces.owner_id, workspaces.organization_id, workspaces.template_id, workspaces.deleted, workspaces.name, workspaces.autostart_schedule, workspaces.ttl, workspaces.last_used_at, workspaces.locked_at, workspaces.deleting_at
+	workspaces.id, workspaces.created_at, workspaces.updated_at, workspaces.owner_id, workspaces.organization_id, workspaces.template_id, workspaces.deleted, workspaces.name, workspaces.autostart_schedule, workspaces.ttl, workspaces.last_used_at, workspaces.dormant_at, workspaces.deleting_at, workspaces.automatic_updates
 FROM
 	workspaces
 LEFT JOIN
@@ -9157,17 +10473,17 @@ WHERE
 		) OR
 
 		-- If the workspace's template has an inactivity_ttl set
-		-- it may be eligible for locking.
+		-- it may be eligible for dormancy.
 		(
-			templates.inactivity_ttl > 0 AND
-			workspaces.locked_at IS NULL
+			templates.time_til_dormant > 0 AND
+			workspaces.dormant_at IS NULL
 		) OR
 
-		-- If the workspace's template has a locked_ttl set
-		-- and the workspace is already locked
+		-- If the workspace's template has a time_til_dormant_autodelete set
+		-- and the workspace is already dormant.
 		(
-			templates.locked_ttl > 0 AND
-			workspaces.locked_at IS NOT NULL
+			templates.time_til_dormant_autodelete > 0 AND
+			workspaces.dormant_at IS NOT NULL
 		)
 	) AND workspaces.deleted = 'false'
 `
@@ -9193,8 +10509,9 @@ func (q *sqlQuerier) GetWorkspacesEligibleForTransition(ctx context.Context, now
 			&i.AutostartSchedule,
 			&i.Ttl,
 			&i.LastUsedAt,
-			&i.LockedAt,
+			&i.DormantAt,
 			&i.DeletingAt,
+			&i.AutomaticUpdates,
 		); err != nil {
 			return nil, err
 		}
@@ -9221,23 +10538,25 @@ INSERT INTO
 		name,
 		autostart_schedule,
 		ttl,
-		last_used_at
+		last_used_at,
+		automatic_updates
 	)
 VALUES
-	($1, $2, $3, $4, $5, $6, $7, $8, $9, $10) RETURNING id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, locked_at, deleting_at
+	($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11) RETURNING id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates
 `
 
 type InsertWorkspaceParams struct {
-	ID                uuid.UUID      `db:"id" json:"id"`
-	CreatedAt         time.Time      `db:"created_at" json:"created_at"`
-	UpdatedAt         time.Time      `db:"updated_at" json:"updated_at"`
-	OwnerID           uuid.UUID      `db:"owner_id" json:"owner_id"`
-	OrganizationID    uuid.UUID      `db:"organization_id" json:"organization_id"`
-	TemplateID        uuid.UUID      `db:"template_id" json:"template_id"`
-	Name              string         `db:"name" json:"name"`
-	AutostartSchedule sql.NullString `db:"autostart_schedule" json:"autostart_schedule"`
-	Ttl               sql.NullInt64  `db:"ttl" json:"ttl"`
-	LastUsedAt        time.Time      `db:"last_used_at" json:"last_used_at"`
+	ID                uuid.UUID        `db:"id" json:"id"`
+	CreatedAt         time.Time        `db:"created_at" json:"created_at"`
+	UpdatedAt         time.Time        `db:"updated_at" json:"updated_at"`
+	OwnerID           uuid.UUID        `db:"owner_id" json:"owner_id"`
+	OrganizationID    uuid.UUID        `db:"organization_id" json:"organization_id"`
+	TemplateID        uuid.UUID        `db:"template_id" json:"template_id"`
+	Name              string           `db:"name" json:"name"`
+	AutostartSchedule sql.NullString   `db:"autostart_schedule" json:"autostart_schedule"`
+	Ttl               sql.NullInt64    `db:"ttl" json:"ttl"`
+	LastUsedAt        time.Time        `db:"last_used_at" json:"last_used_at"`
+	AutomaticUpdates  AutomaticUpdates `db:"automatic_updates" json:"automatic_updates"`
 }
 
 func (q *sqlQuerier) InsertWorkspace(ctx context.Context, arg InsertWorkspaceParams) (Workspace, error) {
@@ -9252,6 +10571,7 @@ func (q *sqlQuerier) InsertWorkspace(ctx context.Context, arg InsertWorkspacePar
 		arg.AutostartSchedule,
 		arg.Ttl,
 		arg.LastUsedAt,
+		arg.AutomaticUpdates,
 	)
 	var i Workspace
 	err := row.Scan(
@@ -9266,12 +10586,31 @@ func (q *sqlQuerier) InsertWorkspace(ctx context.Context, arg InsertWorkspacePar
 		&i.AutostartSchedule,
 		&i.Ttl,
 		&i.LastUsedAt,
-		&i.LockedAt,
+		&i.DormantAt,
 		&i.DeletingAt,
+		&i.AutomaticUpdates,
 	)
 	return i, err
 }
 
+const updateTemplateWorkspacesLastUsedAt = `-- name: UpdateTemplateWorkspacesLastUsedAt :exec
+UPDATE workspaces
+SET
+	last_used_at = $1::timestamptz
+WHERE
+	template_id = $2
+`
+
+type UpdateTemplateWorkspacesLastUsedAtParams struct {
+	LastUsedAt time.Time `db:"last_used_at" json:"last_used_at"`
+	TemplateID uuid.UUID `db:"template_id" json:"template_id"`
+}
+
+func (q *sqlQuerier) UpdateTemplateWorkspacesLastUsedAt(ctx context.Context, arg UpdateTemplateWorkspacesLastUsedAtParams) error {
+	_, err := q.db.ExecContext(ctx, updateTemplateWorkspacesLastUsedAt, arg.LastUsedAt, arg.TemplateID)
+	return err
+}
+
 const updateWorkspace = `-- name: UpdateWorkspace :one
 UPDATE
 	workspaces
@@ -9280,7 +10619,7 @@ SET
 WHERE
 	id = $1
 	AND deleted = false
-RETURNING id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, locked_at, deleting_at
+RETURNING id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates
 `
 
 type UpdateWorkspaceParams struct {
@@ -9303,12 +10642,32 @@ func (q *sqlQuerier) UpdateWorkspace(ctx context.Context, arg UpdateWorkspacePar
 		&i.AutostartSchedule,
 		&i.Ttl,
 		&i.LastUsedAt,
-		&i.LockedAt,
+		&i.DormantAt,
 		&i.DeletingAt,
+		&i.AutomaticUpdates,
 	)
 	return i, err
 }
 
+const updateWorkspaceAutomaticUpdates = `-- name: UpdateWorkspaceAutomaticUpdates :exec
+UPDATE
+	workspaces
+SET
+	automatic_updates = $2
+WHERE
+		id = $1
+`
+
+type UpdateWorkspaceAutomaticUpdatesParams struct {
+	ID               uuid.UUID        `db:"id" json:"id"`
+	AutomaticUpdates AutomaticUpdates `db:"automatic_updates" json:"automatic_updates"`
+}
+
+func (q *sqlQuerier) UpdateWorkspaceAutomaticUpdates(ctx context.Context, arg UpdateWorkspaceAutomaticUpdatesParams) error {
+	_, err := q.db.ExecContext(ctx, updateWorkspaceAutomaticUpdates, arg.ID, arg.AutomaticUpdates)
+	return err
+}
+
 const updateWorkspaceAutostart = `-- name: UpdateWorkspaceAutostart :exec
 UPDATE
 	workspaces
@@ -9347,51 +10706,69 @@ func (q *sqlQuerier) UpdateWorkspaceDeletedByID(ctx context.Context, arg UpdateW
 	return err
 }
 
-const updateWorkspaceLastUsedAt = `-- name: UpdateWorkspaceLastUsedAt :exec
+const updateWorkspaceDormantDeletingAt = `-- name: UpdateWorkspaceDormantDeletingAt :one
 UPDATE
 	workspaces
 SET
-	last_used_at = $2
+	dormant_at = $2,
+	-- When a workspace is active we want to update the last_used_at to avoid the workspace going
+    -- immediately dormant. If we're transition the workspace to dormant then we leave it alone.
+	last_used_at = CASE WHEN $2::timestamptz IS NULL THEN now() at time zone 'utc' ELSE last_used_at END,
+	-- If dormant_at is null (meaning active) or the template-defined time_til_dormant_autodelete is 0 we should set
+	-- deleting_at to NULL else set it to the dormant_at + time_til_dormant_autodelete duration.
+	deleting_at = CASE WHEN $2::timestamptz IS NULL OR templates.time_til_dormant_autodelete = 0 THEN NULL ELSE $2::timestamptz + INTERVAL '1 milliseconds' * templates.time_til_dormant_autodelete / 1000000 END
+FROM
+	templates
 WHERE
-	id = $1
+	workspaces.template_id = templates.id
+AND
+	workspaces.id = $1
+RETURNING workspaces.id, workspaces.created_at, workspaces.updated_at, workspaces.owner_id, workspaces.organization_id, workspaces.template_id, workspaces.deleted, workspaces.name, workspaces.autostart_schedule, workspaces.ttl, workspaces.last_used_at, workspaces.dormant_at, workspaces.deleting_at, workspaces.automatic_updates
 `
 
-type UpdateWorkspaceLastUsedAtParams struct {
-	ID         uuid.UUID `db:"id" json:"id"`
-	LastUsedAt time.Time `db:"last_used_at" json:"last_used_at"`
+type UpdateWorkspaceDormantDeletingAtParams struct {
+	ID        uuid.UUID    `db:"id" json:"id"`
+	DormantAt sql.NullTime `db:"dormant_at" json:"dormant_at"`
 }
 
-func (q *sqlQuerier) UpdateWorkspaceLastUsedAt(ctx context.Context, arg UpdateWorkspaceLastUsedAtParams) error {
-	_, err := q.db.ExecContext(ctx, updateWorkspaceLastUsedAt, arg.ID, arg.LastUsedAt)
-	return err
+func (q *sqlQuerier) UpdateWorkspaceDormantDeletingAt(ctx context.Context, arg UpdateWorkspaceDormantDeletingAtParams) (Workspace, error) {
+	row := q.db.QueryRowContext(ctx, updateWorkspaceDormantDeletingAt, arg.ID, arg.DormantAt)
+	var i Workspace
+	err := row.Scan(
+		&i.ID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.OwnerID,
+		&i.OrganizationID,
+		&i.TemplateID,
+		&i.Deleted,
+		&i.Name,
+		&i.AutostartSchedule,
+		&i.Ttl,
+		&i.LastUsedAt,
+		&i.DormantAt,
+		&i.DeletingAt,
+		&i.AutomaticUpdates,
+	)
+	return i, err
 }
 
-const updateWorkspaceLockedDeletingAt = `-- name: UpdateWorkspaceLockedDeletingAt :exec
+const updateWorkspaceLastUsedAt = `-- name: UpdateWorkspaceLastUsedAt :exec
 UPDATE
 	workspaces
 SET
-	locked_at = $2,
-	-- When a workspace is unlocked we want to update the last_used_at to avoid the workspace getting re-locked.
-	-- if we're locking the workspace then we leave it alone.
-	last_used_at = CASE WHEN $2::timestamptz IS NULL THEN now() at time zone 'utc' ELSE last_used_at END,
-	-- If locked_at is null (meaning unlocked) or the template-defined locked_ttl is 0 we should set
-	-- deleting_at to NULL else set it to the locked_at + locked_ttl duration.
-	deleting_at = CASE WHEN $2::timestamptz IS NULL OR templates.locked_ttl = 0 THEN NULL ELSE $2::timestamptz + INTERVAL '1 milliseconds' * templates.locked_ttl / 1000000 END
-FROM
-	templates
+	last_used_at = $2
 WHERE
-	workspaces.template_id = templates.id
-AND
-	workspaces.id = $1
+	id = $1
 `
 
-type UpdateWorkspaceLockedDeletingAtParams struct {
-	ID       uuid.UUID    `db:"id" json:"id"`
-	LockedAt sql.NullTime `db:"locked_at" json:"locked_at"`
+type UpdateWorkspaceLastUsedAtParams struct {
+	ID         uuid.UUID `db:"id" json:"id"`
+	LastUsedAt time.Time `db:"last_used_at" json:"last_used_at"`
 }
 
-func (q *sqlQuerier) UpdateWorkspaceLockedDeletingAt(ctx context.Context, arg UpdateWorkspaceLockedDeletingAtParams) error {
-	_, err := q.db.ExecContext(ctx, updateWorkspaceLockedDeletingAt, arg.ID, arg.LockedAt)
+func (q *sqlQuerier) UpdateWorkspaceLastUsedAt(ctx context.Context, arg UpdateWorkspaceLastUsedAtParams) error {
+	_, err := q.db.ExecContext(ctx, updateWorkspaceLastUsedAt, arg.ID, arg.LastUsedAt)
 	return err
 }
 
@@ -9414,23 +10791,141 @@ func (q *sqlQuerier) UpdateWorkspaceTTL(ctx context.Context, arg UpdateWorkspace
 	return err
 }
 
-const updateWorkspacesDeletingAtByTemplateID = `-- name: UpdateWorkspacesDeletingAtByTemplateID :exec
-UPDATE
-	workspaces
+const updateWorkspacesDormantDeletingAtByTemplateID = `-- name: UpdateWorkspacesDormantDeletingAtByTemplateID :exec
+UPDATE workspaces
 SET
-	deleting_at = CASE WHEN $1::bigint = 0 THEN NULL ELSE locked_at + interval '1 milliseconds' * $1::bigint END
+    deleting_at = CASE
+        WHEN $1::bigint = 0 THEN NULL
+        WHEN $2::timestamptz > '0001-01-01 00:00:00+00'::timestamptz THEN  ($2::timestamptz) + interval '1 milliseconds' * $1::bigint
+        ELSE dormant_at + interval '1 milliseconds' * $1::bigint
+    END,
+    dormant_at = CASE WHEN $2::timestamptz > '0001-01-01 00:00:00+00'::timestamptz THEN $2::timestamptz ELSE dormant_at END
 WHERE
-	template_id = $2
+    template_id = $3
 AND
-	locked_at IS NOT NULL
+    dormant_at IS NOT NULL
 `
 
-type UpdateWorkspacesDeletingAtByTemplateIDParams struct {
-	LockedTtlMs int64     `db:"locked_ttl_ms" json:"locked_ttl_ms"`
-	TemplateID  uuid.UUID `db:"template_id" json:"template_id"`
+type UpdateWorkspacesDormantDeletingAtByTemplateIDParams struct {
+	TimeTilDormantAutodeleteMs int64     `db:"time_til_dormant_autodelete_ms" json:"time_til_dormant_autodelete_ms"`
+	DormantAt                  time.Time `db:"dormant_at" json:"dormant_at"`
+	TemplateID                 uuid.UUID `db:"template_id" json:"template_id"`
 }
 
-func (q *sqlQuerier) UpdateWorkspacesDeletingAtByTemplateID(ctx context.Context, arg UpdateWorkspacesDeletingAtByTemplateIDParams) error {
-	_, err := q.db.ExecContext(ctx, updateWorkspacesDeletingAtByTemplateID, arg.LockedTtlMs, arg.TemplateID)
+func (q *sqlQuerier) UpdateWorkspacesDormantDeletingAtByTemplateID(ctx context.Context, arg UpdateWorkspacesDormantDeletingAtByTemplateIDParams) error {
+	_, err := q.db.ExecContext(ctx, updateWorkspacesDormantDeletingAtByTemplateID, arg.TimeTilDormantAutodeleteMs, arg.DormantAt, arg.TemplateID)
 	return err
 }
+
+const getWorkspaceAgentScriptsByAgentIDs = `-- name: GetWorkspaceAgentScriptsByAgentIDs :many
+SELECT workspace_agent_id, log_source_id, log_path, created_at, script, cron, start_blocks_login, run_on_start, run_on_stop, timeout_seconds FROM workspace_agent_scripts WHERE workspace_agent_id = ANY($1 :: uuid [ ])
+`
+
+func (q *sqlQuerier) GetWorkspaceAgentScriptsByAgentIDs(ctx context.Context, ids []uuid.UUID) ([]WorkspaceAgentScript, error) {
+	rows, err := q.db.QueryContext(ctx, getWorkspaceAgentScriptsByAgentIDs, pq.Array(ids))
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []WorkspaceAgentScript
+	for rows.Next() {
+		var i WorkspaceAgentScript
+		if err := rows.Scan(
+			&i.WorkspaceAgentID,
+			&i.LogSourceID,
+			&i.LogPath,
+			&i.CreatedAt,
+			&i.Script,
+			&i.Cron,
+			&i.StartBlocksLogin,
+			&i.RunOnStart,
+			&i.RunOnStop,
+			&i.TimeoutSeconds,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const insertWorkspaceAgentScripts = `-- name: InsertWorkspaceAgentScripts :many
+INSERT INTO
+	workspace_agent_scripts (workspace_agent_id, created_at, log_source_id, log_path, script, cron, start_blocks_login, run_on_start, run_on_stop, timeout_seconds)
+SELECT
+	$1 :: uuid AS workspace_agent_id,
+	$2 :: timestamptz AS created_at,
+	unnest($3 :: uuid [ ]) AS log_source_id,
+	unnest($4 :: text [ ]) AS log_path,
+	unnest($5 :: text [ ]) AS script,
+	unnest($6 :: text [ ]) AS cron,
+	unnest($7 :: boolean [ ]) AS start_blocks_login,
+	unnest($8 :: boolean [ ]) AS run_on_start,
+	unnest($9 :: boolean [ ]) AS run_on_stop,
+	unnest($10 :: integer [ ]) AS timeout_seconds
+RETURNING workspace_agent_scripts.workspace_agent_id, workspace_agent_scripts.log_source_id, workspace_agent_scripts.log_path, workspace_agent_scripts.created_at, workspace_agent_scripts.script, workspace_agent_scripts.cron, workspace_agent_scripts.start_blocks_login, workspace_agent_scripts.run_on_start, workspace_agent_scripts.run_on_stop, workspace_agent_scripts.timeout_seconds
+`
+
+type InsertWorkspaceAgentScriptsParams struct {
+	WorkspaceAgentID uuid.UUID   `db:"workspace_agent_id" json:"workspace_agent_id"`
+	CreatedAt        time.Time   `db:"created_at" json:"created_at"`
+	LogSourceID      []uuid.UUID `db:"log_source_id" json:"log_source_id"`
+	LogPath          []string    `db:"log_path" json:"log_path"`
+	Script           []string    `db:"script" json:"script"`
+	Cron             []string    `db:"cron" json:"cron"`
+	StartBlocksLogin []bool      `db:"start_blocks_login" json:"start_blocks_login"`
+	RunOnStart       []bool      `db:"run_on_start" json:"run_on_start"`
+	RunOnStop        []bool      `db:"run_on_stop" json:"run_on_stop"`
+	TimeoutSeconds   []int32     `db:"timeout_seconds" json:"timeout_seconds"`
+}
+
+func (q *sqlQuerier) InsertWorkspaceAgentScripts(ctx context.Context, arg InsertWorkspaceAgentScriptsParams) ([]WorkspaceAgentScript, error) {
+	rows, err := q.db.QueryContext(ctx, insertWorkspaceAgentScripts,
+		arg.WorkspaceAgentID,
+		arg.CreatedAt,
+		pq.Array(arg.LogSourceID),
+		pq.Array(arg.LogPath),
+		pq.Array(arg.Script),
+		pq.Array(arg.Cron),
+		pq.Array(arg.StartBlocksLogin),
+		pq.Array(arg.RunOnStart),
+		pq.Array(arg.RunOnStop),
+		pq.Array(arg.TimeoutSeconds),
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []WorkspaceAgentScript
+	for rows.Next() {
+		var i WorkspaceAgentScript
+		if err := rows.Scan(
+			&i.WorkspaceAgentID,
+			&i.LogSourceID,
+			&i.LogPath,
+			&i.CreatedAt,
+			&i.Script,
+			&i.Cron,
+			&i.StartBlocksLogin,
+			&i.RunOnStart,
+			&i.RunOnStop,
+			&i.TimeoutSeconds,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
diff --git a/coderd/database/queries/activitybump.sql b/coderd/database/queries/activitybump.sql
new file mode 100644
index 0000000000000..fb9ae456501e1
--- /dev/null
+++ b/coderd/database/queries/activitybump.sql
@@ -0,0 +1,50 @@
+-- We bump by the original TTL to prevent counter-intuitive behavior
+-- as the TTL wraps. For example, if I set the TTL to 12 hours, sign off
+-- work at midnight, come back at 10am, I would want another full day
+-- of uptime.
+-- name: ActivityBumpWorkspace :exec
+WITH latest AS (
+	SELECT
+		workspace_builds.id::uuid AS build_id,
+		workspace_builds.deadline::timestamp with time zone AS build_deadline,
+		workspace_builds.max_deadline::timestamp with time zone AS build_max_deadline,
+		workspace_builds.transition AS build_transition,
+		provisioner_jobs.completed_at::timestamp with time zone AS job_completed_at,
+		(
+			CASE
+				WHEN templates.allow_user_autostop
+				THEN (workspaces.ttl / 1000 / 1000 / 1000 || ' seconds')::interval
+				ELSE (templates.default_ttl / 1000 / 1000 / 1000 || ' seconds')::interval
+			END
+		) AS ttl_interval
+	FROM workspace_builds
+	JOIN provisioner_jobs
+		ON provisioner_jobs.id = workspace_builds.job_id
+	JOIN workspaces
+		ON workspaces.id = workspace_builds.workspace_id
+	JOIN templates
+		ON templates.id = workspaces.template_id
+	WHERE workspace_builds.workspace_id = @workspace_id::uuid
+	ORDER BY workspace_builds.build_number DESC
+	LIMIT 1
+)
+UPDATE
+	workspace_builds wb
+SET
+	updated_at = NOW(),
+	deadline = CASE
+		WHEN l.build_max_deadline = '0001-01-01 00:00:00+00'
+		THEN NOW() + l.ttl_interval
+		ELSE LEAST(NOW() + l.ttl_interval, l.build_max_deadline)
+	END
+FROM latest l
+WHERE wb.id = l.build_id
+AND l.job_completed_at IS NOT NULL
+AND l.build_transition = 'start'
+-- We only bump if the raw interval is positive and non-zero.
+AND l.ttl_interval > '0 seconds'::interval
+-- We only bump if workspace shutdown is manual.
+AND l.build_deadline != '0001-01-01 00:00:00+00'
+-- We only bump when 5% of the deadline has elapsed.
+AND l.build_deadline - (l.ttl_interval * 0.95) < NOW()
+;
diff --git a/coderd/database/queries/dbcrypt.sql b/coderd/database/queries/dbcrypt.sql
new file mode 100644
index 0000000000000..41dc051c8331d
--- /dev/null
+++ b/coderd/database/queries/dbcrypt.sql
@@ -0,0 +1,19 @@
+-- name: GetDBCryptKeys :many
+SELECT * FROM dbcrypt_keys ORDER BY number ASC;
+
+-- name: RevokeDBCryptKey :exec
+UPDATE dbcrypt_keys
+SET
+	revoked_key_digest = active_key_digest,
+	active_key_digest = revoked_key_digest,
+	revoked_at = CURRENT_TIMESTAMP
+WHERE
+	active_key_digest = @active_key_digest::text
+AND
+	revoked_key_digest IS NULL;
+
+-- name: InsertDBCryptKey :exec
+INSERT INTO dbcrypt_keys
+	(number, active_key_digest, created_at, test)
+VALUES (@number::int, @active_key_digest::text, CURRENT_TIMESTAMP, @test::text);
+
diff --git a/coderd/database/queries/externalauth.sql b/coderd/database/queries/externalauth.sql
new file mode 100644
index 0000000000000..dfc195b9ea886
--- /dev/null
+++ b/coderd/database/queries/externalauth.sql
@@ -0,0 +1,41 @@
+-- name: GetExternalAuthLink :one
+SELECT * FROM external_auth_links WHERE provider_id = $1 AND user_id = $2;
+
+-- name: GetExternalAuthLinksByUserID :many
+SELECT * FROM external_auth_links WHERE user_id = $1;
+
+-- name: InsertExternalAuthLink :one
+INSERT INTO external_auth_links (
+    provider_id,
+    user_id,
+    created_at,
+    updated_at,
+    oauth_access_token,
+    oauth_access_token_key_id,
+    oauth_refresh_token,
+    oauth_refresh_token_key_id,
+    oauth_expiry,
+	oauth_extra
+) VALUES (
+    $1,
+    $2,
+    $3,
+    $4,
+    $5,
+    $6,
+    $7,
+    $8,
+    $9,
+	$10
+) RETURNING *;
+
+-- name: UpdateExternalAuthLink :one
+UPDATE external_auth_links SET
+    updated_at = $3,
+    oauth_access_token = $4,
+    oauth_access_token_key_id = $5,
+    oauth_refresh_token = $6,
+    oauth_refresh_token_key_id = $7,
+    oauth_expiry = $8,
+	oauth_extra = $9
+WHERE provider_id = $1 AND user_id = $2 RETURNING *;
diff --git a/coderd/database/queries/gitauth.sql b/coderd/database/queries/gitauth.sql
deleted file mode 100644
index a35de98a08908..0000000000000
--- a/coderd/database/queries/gitauth.sql
+++ /dev/null
@@ -1,29 +0,0 @@
--- name: GetGitAuthLink :one
-SELECT * FROM git_auth_links WHERE provider_id = $1 AND user_id = $2;
-
--- name: InsertGitAuthLink :one
-INSERT INTO git_auth_links (
-    provider_id,
-    user_id,
-    created_at,
-    updated_at,
-    oauth_access_token,
-    oauth_refresh_token,
-    oauth_expiry
-) VALUES (
-    $1,
-    $2,
-    $3,
-    $4,
-    $5,
-    $6,
-    $7
-) RETURNING *;
-
--- name: UpdateGitAuthLink :one
-UPDATE git_auth_links SET
-    updated_at = $3,
-    oauth_access_token = $4,
-    oauth_refresh_token = $5,
-    oauth_expiry = $6
-WHERE provider_id = $1 AND user_id = $2 RETURNING *;
diff --git a/coderd/database/queries/groupmembers.sql b/coderd/database/queries/groupmembers.sql
index a7c04d85f20a8..4999df7930044 100644
--- a/coderd/database/queries/groupmembers.sql
+++ b/coderd/database/queries/groupmembers.sql
@@ -3,14 +3,23 @@ SELECT
 	users.*
 FROM
 	users
-JOIN
+-- If the group is a user made group, then we need to check the group_members table.
+LEFT JOIN
 	group_members
 ON
-	users.id = group_members.user_id
+	group_members.user_id = users.id AND
+	group_members.group_id = @group_id
+-- If it is the "Everyone" group, then we need to check the organization_members table.
+LEFT JOIN
+	organization_members
+ON
+	organization_members.user_id = users.id AND
+	organization_members.organization_id = @group_id
 WHERE
-	group_members.group_id = $1
-AND
-	users.status = 'active'
+	-- In either case, the group_id will only match an org or a group.
+    (group_members.group_id = @group_id
+         OR
+     organization_members.organization_id = @group_id)
 AND
 	users.deleted = 'false';
 
diff --git a/coderd/database/queries/groups.sql b/coderd/database/queries/groups.sql
index e1ee6635a5fe0..e772d21a5840f 100644
--- a/coderd/database/queries/groups.sql
+++ b/coderd/database/queries/groups.sql
@@ -26,9 +26,7 @@ SELECT
 FROM
 	groups
 WHERE
-	organization_id = $1
-AND
-	id != $1;
+	organization_id = $1;
 
 -- name: InsertGroup :one
 INSERT INTO groups (
@@ -42,6 +40,28 @@ INSERT INTO groups (
 VALUES
 	($1, $2, $3, $4, $5, $6) RETURNING *;
 
+-- name: InsertMissingGroups :many
+-- Inserts any group by name that does not exist. All new groups are given
+-- a random uuid, are inserted into the same organization. They have the default
+-- values for avatar, display name, and quota allowance (all zero values).
+INSERT INTO groups (
+	id,
+	name,
+	organization_id,
+    source
+)
+SELECT
+    gen_random_uuid(),
+    group_name,
+    @organization_id,
+    @source
+FROM
+    UNNEST(@group_names :: text[]) AS group_name
+-- If the name conflicts, do nothing.
+ON CONFLICT DO NOTHING
+RETURNING *;
+
+
 -- We use the organization_id as the id
 -- for simplicity since all users is
 -- every member of the org.
diff --git a/coderd/database/queries/insights.sql b/coderd/database/queries/insights.sql
index 94a80117dcc1d..01863fede1aed 100644
--- a/coderd/database/queries/insights.sql
+++ b/coderd/database/queries/insights.sql
@@ -21,70 +21,231 @@ WHERE
 GROUP BY workspace_agent_stats.user_id, users.username, users.avatar_url
 ORDER BY user_id ASC;
 
+-- name: GetUserActivityInsights :many
+-- GetUserActivityInsights returns the ranking with top active users.
+-- The result can be filtered on template_ids, meaning only user data from workspaces
+-- based on those templates will be included.
+-- Note: When selecting data from multiple templates or the entire deployment,
+-- be aware that it may lead to an increase in "usage" numbers (cumulative). In such cases,
+-- users may be counted multiple times for the same time interval if they have used multiple templates
+-- simultaneously.
+WITH app_stats AS (
+	SELECT
+		s.start_time,
+		was.user_id,
+		w.template_id,
+		60 as seconds
+	FROM workspace_app_stats was
+	JOIN workspaces w ON (
+		w.id = was.workspace_id
+		AND CASE WHEN COALESCE(array_length(@template_ids::uuid[], 1), 0) > 0 THEN w.template_id = ANY(@template_ids::uuid[]) ELSE TRUE END
+	)
+	-- This table contains both 1 minute entries and >1 minute entries,
+	-- to calculate this with our uniqueness constraints, we generate series
+	-- for the longer intervals.
+	CROSS JOIN LATERAL generate_series(
+		date_trunc('minute', was.session_started_at),
+		-- Subtract 1 microsecond to avoid creating an extra series.
+		date_trunc('minute', was.session_ended_at - '1 microsecond'::interval),
+		'1 minute'::interval
+	) s(start_time)
+	WHERE
+		s.start_time >= @start_time::timestamptz
+		-- Subtract one minute because the series only contains the start time.
+		AND s.start_time < (@end_time::timestamptz) - '1 minute'::interval
+	GROUP BY s.start_time, w.template_id, was.user_id
+), session_stats AS (
+	SELECT
+		date_trunc('minute', was.created_at) as start_time,
+		was.user_id,
+		was.template_id,
+		CASE WHEN
+			SUM(was.session_count_vscode) > 0 OR
+			SUM(was.session_count_jetbrains) > 0 OR
+			SUM(was.session_count_reconnecting_pty) > 0 OR
+			SUM(was.session_count_ssh) > 0
+		THEN 60 ELSE 0 END as seconds
+	FROM workspace_agent_stats was
+	WHERE
+		was.created_at >= @start_time::timestamptz
+		AND was.created_at < @end_time::timestamptz
+		AND was.connection_count > 0
+		AND CASE WHEN COALESCE(array_length(@template_ids::uuid[], 1), 0) > 0 THEN was.template_id = ANY(@template_ids::uuid[]) ELSE TRUE END
+	GROUP BY date_trunc('minute', was.created_at), was.user_id, was.template_id
+), combined_stats AS (
+	SELECT
+		user_id,
+		template_id,
+		start_time,
+		seconds
+	FROM app_stats
+	UNION
+	SELECT
+		user_id,
+		template_id,
+		start_time,
+		seconds
+	FROM session_stats
+)
+SELECT
+	users.id as user_id,
+	users.username,
+	users.avatar_url,
+	array_agg(DISTINCT template_id)::uuid[] AS template_ids,
+	SUM(seconds) AS usage_seconds
+FROM combined_stats
+JOIN users ON (users.id = combined_stats.user_id)
+GROUP BY users.id, username, avatar_url
+ORDER BY user_id ASC;
+
 -- name: GetTemplateInsights :one
 -- GetTemplateInsights has a granularity of 5 minutes where if a session/app was
--- in use, we will add 5 minutes to the total usage for that session (per user).
-WITH d AS (
-	-- Subtract 1 second from end_time to avoid including the next interval in the results.
-	SELECT generate_series(@start_time::timestamptz, (@end_time::timestamptz) - '1 second'::interval, '5 minute'::interval) AS d
-), ts AS (
-	SELECT
-		d::timestamptz AS from_,
-		(d + '5 minute'::interval)::timestamptz AS to_,
-		EXTRACT(epoch FROM '5 minute'::interval) AS seconds
-	FROM d
-), usage_by_user AS (
+-- in use during a minute, we will add 5 minutes to the total usage for that
+-- session/app (per user).
+WITH agent_stats_by_interval_and_user AS (
 	SELECT
-		ts.from_,
-		ts.to_,
+		date_trunc('minute', was.created_at),
 		was.user_id,
 		array_agg(was.template_id) AS template_ids,
-		CASE WHEN SUM(was.session_count_vscode) > 0 THEN ts.seconds ELSE 0 END AS usage_vscode_seconds,
-		CASE WHEN SUM(was.session_count_jetbrains) > 0 THEN ts.seconds ELSE 0 END AS usage_jetbrains_seconds,
-		CASE WHEN SUM(was.session_count_reconnecting_pty) > 0 THEN ts.seconds ELSE 0 END AS usage_reconnecting_pty_seconds,
-		CASE WHEN SUM(was.session_count_ssh) > 0 THEN ts.seconds ELSE 0 END AS usage_ssh_seconds
-	FROM ts
-	JOIN workspace_agent_stats was ON (
-		was.created_at >= ts.from_
-		AND was.created_at < ts.to_
+		CASE WHEN SUM(was.session_count_vscode) > 0 THEN 60 ELSE 0 END AS usage_vscode_seconds,
+		CASE WHEN SUM(was.session_count_jetbrains) > 0 THEN 60 ELSE 0 END AS usage_jetbrains_seconds,
+		CASE WHEN SUM(was.session_count_reconnecting_pty) > 0 THEN 60 ELSE 0 END AS usage_reconnecting_pty_seconds,
+		CASE WHEN SUM(was.session_count_ssh) > 0 THEN 60 ELSE 0 END AS usage_ssh_seconds
+	FROM workspace_agent_stats was
+	WHERE
+		was.created_at >= @start_time::timestamptz
+		AND was.created_at < @end_time::timestamptz
 		AND was.connection_count > 0
 		AND CASE WHEN COALESCE(array_length(@template_ids::uuid[], 1), 0) > 0 THEN was.template_id = ANY(@template_ids::uuid[]) ELSE TRUE END
-	)
-	GROUP BY ts.from_, ts.to_, ts.seconds, was.user_id
+	GROUP BY date_trunc('minute', was.created_at), was.user_id
 ), template_ids AS (
 	SELECT array_agg(DISTINCT template_id) AS ids
-	FROM usage_by_user, unnest(template_ids) template_id
+	FROM agent_stats_by_interval_and_user, unnest(template_ids) template_id
 	WHERE template_id IS NOT NULL
 )
 
 SELECT
 	COALESCE((SELECT ids FROM template_ids), '{}')::uuid[] AS template_ids,
-	COUNT(DISTINCT user_id) AS active_users,
+	-- Return IDs so we can combine this with GetTemplateAppInsights.
+	COALESCE(array_agg(DISTINCT user_id), '{}')::uuid[] AS active_user_ids,
 	COALESCE(SUM(usage_vscode_seconds), 0)::bigint AS usage_vscode_seconds,
 	COALESCE(SUM(usage_jetbrains_seconds), 0)::bigint AS usage_jetbrains_seconds,
 	COALESCE(SUM(usage_reconnecting_pty_seconds), 0)::bigint AS usage_reconnecting_pty_seconds,
 	COALESCE(SUM(usage_ssh_seconds), 0)::bigint AS usage_ssh_seconds
-FROM usage_by_user;
+FROM agent_stats_by_interval_and_user;
+
+-- name: GetTemplateInsightsByTemplate :many
+WITH agent_stats_by_interval_and_user AS (
+	SELECT
+		date_trunc('minute', was.created_at) AS created_at_trunc,
+		was.template_id,
+		was.user_id,
+		CASE WHEN SUM(was.session_count_vscode) > 0 THEN 60 ELSE 0 END AS usage_vscode_seconds,
+		CASE WHEN SUM(was.session_count_jetbrains) > 0 THEN 60 ELSE 0 END AS usage_jetbrains_seconds,
+		CASE WHEN SUM(was.session_count_reconnecting_pty) > 0 THEN 60 ELSE 0 END AS usage_reconnecting_pty_seconds,
+		CASE WHEN SUM(was.session_count_ssh) > 0 THEN 60 ELSE 0 END AS usage_ssh_seconds
+	FROM workspace_agent_stats was
+	WHERE
+		was.created_at >= @start_time::timestamptz
+		AND was.created_at < @end_time::timestamptz
+		AND was.connection_count > 0
+	GROUP BY created_at_trunc, was.template_id, was.user_id
+)
 
--- name: GetTemplateDailyInsights :many
--- GetTemplateDailyInsights returns all daily intervals between start and end
--- time, if end time is a partial day, it will be included in the results and
--- that interval will be less than 24 hours. If there is no data for a selected
+SELECT
+	template_id,
+	COALESCE(COUNT(DISTINCT user_id))::bigint AS active_users,
+	COALESCE(SUM(usage_vscode_seconds), 0)::bigint AS usage_vscode_seconds,
+	COALESCE(SUM(usage_jetbrains_seconds), 0)::bigint AS usage_jetbrains_seconds,
+	COALESCE(SUM(usage_reconnecting_pty_seconds), 0)::bigint AS usage_reconnecting_pty_seconds,
+	COALESCE(SUM(usage_ssh_seconds), 0)::bigint AS usage_ssh_seconds
+FROM agent_stats_by_interval_and_user
+GROUP BY template_id;
+
+-- name: GetTemplateAppInsights :many
+-- GetTemplateAppInsights returns the aggregate usage of each app in a given
+-- timeframe. The result can be filtered on template_ids, meaning only user data
+-- from workspaces based on those templates will be included.
+WITH app_stats_by_user_and_agent AS (
+	SELECT
+		s.start_time,
+		60 as seconds,
+		w.template_id,
+		was.user_id,
+		was.agent_id,
+		was.access_method,
+		was.slug_or_port,
+		wa.display_name,
+		wa.icon,
+		(wa.slug IS NOT NULL)::boolean AS is_app
+	FROM workspace_app_stats was
+	JOIN workspaces w ON (
+		w.id = was.workspace_id
+		AND CASE WHEN COALESCE(array_length(@template_ids::uuid[], 1), 0) > 0 THEN w.template_id = ANY(@template_ids::uuid[]) ELSE TRUE END
+	)
+	-- We do a left join here because we want to include user IDs that have used
+	-- e.g. ports when counting active users.
+	LEFT JOIN workspace_apps wa ON (
+		wa.agent_id = was.agent_id
+		AND wa.slug = was.slug_or_port
+	)
+	-- This table contains both 1 minute entries and >1 minute entries,
+	-- to calculate this with our uniqueness constraints, we generate series
+	-- for the longer intervals.
+	CROSS JOIN LATERAL generate_series(
+		date_trunc('minute', was.session_started_at),
+		-- Subtract 1 microsecond to avoid creating an extra series.
+		date_trunc('minute', was.session_ended_at - '1 microsecond'::interval),
+		'1 minute'::interval
+	) s(start_time)
+	WHERE
+		s.start_time >= @start_time::timestamptz
+		-- Subtract one minute because the series only contains the start time.
+		AND s.start_time < (@end_time::timestamptz) - '1 minute'::interval
+	GROUP BY s.start_time, w.template_id, was.user_id, was.agent_id, was.access_method, was.slug_or_port, wa.display_name, wa.icon, wa.slug
+)
+
+SELECT
+	array_agg(DISTINCT template_id)::uuid[] AS template_ids,
+	-- Return IDs so we can combine this with GetTemplateInsights.
+	array_agg(DISTINCT user_id)::uuid[] AS active_user_ids,
+	access_method,
+	slug_or_port,
+	display_name,
+	icon,
+	is_app,
+	SUM(seconds) AS usage_seconds
+FROM app_stats_by_user_and_agent
+GROUP BY access_method, slug_or_port, display_name, icon, is_app;
+
+-- name: GetTemplateInsightsByInterval :many
+-- GetTemplateInsightsByInterval returns all intervals between start and end
+-- time, if end time is a partial interval, it will be included in the results and
+-- that interval will be shorter than a full one. If there is no data for a selected
 -- interval/template, it will be included in the results with 0 active users.
-WITH d AS (
-	-- sqlc workaround, use SELECT generate_series instead of SELECT * FROM generate_series.
-	-- Subtract 1 second from end_time to avoid including the next interval in the results.
-	SELECT generate_series(@start_time::timestamptz, (@end_time::timestamptz) - '1 second'::interval, '1 day'::interval) AS d
-), ts AS (
+WITH ts AS (
 	SELECT
 		d::timestamptz AS from_,
-		CASE WHEN (d + '1 day'::interval)::timestamptz <= @end_time::timestamptz THEN (d + '1 day'::interval)::timestamptz ELSE @end_time::timestamptz END AS to_
-	FROM d
-), usage_by_day AS (
+		CASE
+			WHEN (d::timestamptz + (@interval_days::int || ' day')::interval) <= @end_time::timestamptz
+			THEN (d::timestamptz + (@interval_days::int || ' day')::interval)
+			ELSE @end_time::timestamptz
+		END AS to_
+	FROM
+		-- Subtract 1 microsecond from end_time to avoid including the next interval in the results.
+		generate_series(@start_time::timestamptz, (@end_time::timestamptz) - '1 microsecond'::interval, (@interval_days::int || ' day')::interval) AS d
+), unflattened_usage_by_interval AS (
+	-- We select data from both workspace agent stats and workspace app stats to
+	-- get a complete picture of usage. This matches how usage is calculated by
+	-- the combination of GetTemplateInsights and GetTemplateAppInsights. We use
+	-- a union all to avoid a costly distinct operation.
+	--
+	-- Note that one query must perform a left join so that all intervals are
+	-- present at least once.
 	SELECT
 		ts.*,
-		was.user_id,
-		array_agg(was.template_id) AS template_ids
+		was.template_id,
+		was.user_id
 	FROM ts
 	LEFT JOIN workspace_agent_stats was ON (
 		was.created_at >= ts.from_
@@ -92,30 +253,35 @@ WITH d AS (
 		AND was.connection_count > 0
 		AND CASE WHEN COALESCE(array_length(@template_ids::uuid[], 1), 0) > 0 THEN was.template_id = ANY(@template_ids::uuid[]) ELSE TRUE END
 	)
-	GROUP BY ts.from_, ts.to_, was.user_id
-), template_ids AS (
+	GROUP BY ts.from_, ts.to_, was.template_id, was.user_id
+
+	UNION ALL
+
 	SELECT
-		template_usage_by_day.from_,
-		array_agg(template_id) AS ids
-	FROM (
-		SELECT DISTINCT
-			from_,
-			unnest(template_ids) AS template_id
-		FROM usage_by_day
-	) AS template_usage_by_day
-	WHERE template_id IS NOT NULL
-	GROUP BY template_usage_by_day.from_
+		ts.*,
+		w.template_id,
+		was.user_id
+	FROM ts
+	JOIN workspace_app_stats was ON (
+		(was.session_started_at >= ts.from_ AND was.session_started_at < ts.to_)
+		OR (was.session_ended_at > ts.from_ AND was.session_ended_at < ts.to_)
+		OR (was.session_started_at < ts.from_ AND was.session_ended_at >= ts.to_)
+	)
+	JOIN workspaces w ON (
+		w.id = was.workspace_id
+		AND CASE WHEN COALESCE(array_length(@template_ids::uuid[], 1), 0) > 0 THEN w.template_id = ANY(@template_ids::uuid[]) ELSE TRUE END
+	)
+	GROUP BY ts.from_, ts.to_, w.template_id, was.user_id
 )
 
 SELECT
 	from_ AS start_time,
 	to_ AS end_time,
-	COALESCE((SELECT template_ids.ids FROM template_ids WHERE template_ids.from_ = usage_by_day.from_), '{}')::uuid[] AS template_ids,
+	array_remove(array_agg(DISTINCT template_id), NULL)::uuid[] AS template_ids,
 	COUNT(DISTINCT user_id) AS active_users
-FROM usage_by_day
+FROM unflattened_usage_by_interval
 GROUP BY from_, to_;
 
-
 -- name: GetTemplateParameterInsights :many
 -- GetTemplateParameterInsights does for each template in a given timeframe,
 -- look for the latest workspace build (for every workspace) that has been
@@ -127,15 +293,15 @@ WITH latest_workspace_builds AS (
 		wbmax.template_id,
 		wb.template_version_id
 	FROM (
-	    SELECT
-	        tv.template_id, wbmax.workspace_id, MAX(wbmax.build_number) as max_build_number
+		SELECT
+			tv.template_id, wbmax.workspace_id, MAX(wbmax.build_number) as max_build_number
 		FROM workspace_builds wbmax
 		JOIN template_versions tv ON (tv.id = wbmax.template_version_id)
 		WHERE
 			wbmax.created_at >= @start_time::timestamptz
 			AND wbmax.created_at < @end_time::timestamptz
 			AND CASE WHEN COALESCE(array_length(@template_ids::uuid[], 1), 0) > 0 THEN tv.template_id = ANY(@template_ids::uuid[]) ELSE TRUE END
-	    GROUP BY tv.template_id, wbmax.workspace_id
+		GROUP BY tv.template_id, wbmax.workspace_id
 	) wbmax
 	JOIN workspace_builds wb ON (
 		wb.workspace_id = wbmax.workspace_id
@@ -147,18 +313,20 @@ WITH latest_workspace_builds AS (
 		array_agg(DISTINCT wb.template_id)::uuid[] AS template_ids,
 		array_agg(wb.id)::uuid[] AS workspace_build_ids,
 		tvp.name,
+		tvp.type,
 		tvp.display_name,
 		tvp.description,
 		tvp.options
 	FROM latest_workspace_builds wb
 	JOIN template_version_parameters tvp ON (tvp.template_version_id = wb.template_version_id)
-	GROUP BY tvp.name, tvp.display_name, tvp.description, tvp.options
+	GROUP BY tvp.name, tvp.type, tvp.display_name, tvp.description, tvp.options
 )
 
 SELECT
 	utp.num,
 	utp.template_ids,
 	utp.name,
+	utp.type,
 	utp.display_name,
 	utp.description,
 	utp.options,
@@ -166,4 +334,4 @@ SELECT
 	COUNT(wbp.value) AS count
 FROM unique_template_params utp
 JOIN workspace_build_parameters wbp ON (utp.workspace_build_ids @> ARRAY[wbp.workspace_build_id] AND utp.name = wbp.name)
-GROUP BY utp.num, utp.name, utp.display_name, utp.description, utp.options, utp.template_ids, wbp.value;
+GROUP BY utp.num, utp.template_ids, utp.name, utp.type, utp.display_name, utp.description, utp.options, wbp.value;
diff --git a/coderd/database/queries/quotas.sql b/coderd/database/queries/quotas.sql
index c640ba02ce982..48b9a673c7f03 100644
--- a/coderd/database/queries/quotas.sql
+++ b/coderd/database/queries/quotas.sql
@@ -2,11 +2,13 @@
 SELECT
 	coalesce(SUM(quota_allowance), 0)::BIGINT
 FROM
-	group_members gm
-JOIN groups g ON
+	groups g
+LEFT JOIN group_members gm ON
 	g.id = gm.group_id
 WHERE
-	user_id = $1;
+	user_id = $1
+OR
+    g.id = g.organization_id;
 
 -- name: GetQuotaConsumedForUser :one
 WITH latest_builds AS (
diff --git a/coderd/database/queries/siteconfig.sql b/coderd/database/queries/siteconfig.sql
index b165e0dd7d0f1..602b82d984180 100644
--- a/coderd/database/queries/siteconfig.sql
+++ b/coderd/database/queries/siteconfig.sql
@@ -50,6 +50,13 @@ ON CONFLICT (key) DO UPDATE SET value = $1 WHERE site_configs.key = 'logo_url';
 -- name: GetLogoURL :one
 SELECT value FROM site_configs WHERE key = 'logo_url';
 
+-- name: UpsertApplicationName :exec
+INSERT INTO site_configs (key, value) VALUES ('application_name', $1)
+ON CONFLICT (key) DO UPDATE SET value = $1 WHERE site_configs.key = 'application_name';
+
+-- name: GetApplicationName :one
+SELECT value FROM site_configs WHERE key = 'application_name';
+
 -- name: GetAppSecurityKey :one
 SELECT value FROM site_configs WHERE key = 'app_signing_key';
 
diff --git a/coderd/database/queries/tailnet.sql b/coderd/database/queries/tailnet.sql
index fd2db296dfa54..16f8708f3210a 100644
--- a/coderd/database/queries/tailnet.sql
+++ b/coderd/database/queries/tailnet.sql
@@ -3,21 +3,36 @@ INSERT INTO
 	tailnet_clients (
 	id,
 	coordinator_id,
-	agent_id,
 	node,
 	updated_at
 )
 VALUES
-	($1, $2, $3, $4, now() at time zone 'utc')
+	($1, $2, $3, now() at time zone 'utc')
 ON CONFLICT (id, coordinator_id)
 DO UPDATE SET
 	id = $1,
 	coordinator_id = $2,
-	agent_id = $3,
-	node = $4,
+	node = $3,
 	updated_at = now() at time zone 'utc'
 RETURNING *;
 
+-- name: UpsertTailnetClientSubscription :exec
+INSERT INTO
+	tailnet_client_subscriptions (
+	client_id,
+	coordinator_id,
+	agent_id,
+	updated_at
+)
+VALUES
+	($1, $2, $3, now() at time zone 'utc')
+ON CONFLICT (client_id, coordinator_id, agent_id)
+DO UPDATE SET
+	client_id = $1,
+	coordinator_id = $2,
+	agent_id = $3,
+	updated_at = now() at time zone 'utc';
+
 -- name: UpsertTailnetAgent :one
 INSERT INTO
 	tailnet_agents (
@@ -43,6 +58,16 @@ FROM tailnet_clients
 WHERE id = $1 and coordinator_id = $2
 RETURNING id, coordinator_id;
 
+-- name: DeleteTailnetClientSubscription :exec
+DELETE
+FROM tailnet_client_subscriptions
+WHERE client_id = $1 and agent_id = $2 and coordinator_id = $3;
+
+-- name: DeleteAllTailnetClientSubscriptions :exec
+DELETE
+FROM tailnet_client_subscriptions
+WHERE client_id = $1 and coordinator_id = $2;
+
 -- name: DeleteTailnetAgent :one
 DELETE
 FROM tailnet_agents
@@ -66,12 +91,17 @@ FROM tailnet_agents;
 -- name: GetTailnetClientsForAgent :many
 SELECT *
 FROM tailnet_clients
-WHERE agent_id = $1;
+WHERE id IN (
+	SELECT tailnet_client_subscriptions.client_id
+	FROM tailnet_client_subscriptions
+	WHERE tailnet_client_subscriptions.agent_id = $1
+);
 
 -- name: GetAllTailnetClients :many
-SELECT *
+SELECT sqlc.embed(tailnet_clients), array_agg(tailnet_client_subscriptions.agent_id)::uuid[] as agent_ids
 FROM tailnet_clients
-ORDER BY agent_id;
+LEFT JOIN tailnet_client_subscriptions
+ON tailnet_clients.id = tailnet_client_subscriptions.client_id;
 
 -- name: UpsertTailnetCoordinator :one
 INSERT INTO
diff --git a/coderd/database/queries/templates.sql b/coderd/database/queries/templates.sql
index 7f4c9ce5de4ab..c5bc72d7911d6 100644
--- a/coderd/database/queries/templates.sql
+++ b/coderd/database/queries/templates.sql
@@ -118,11 +118,12 @@ SET
 	allow_user_autostop = $4,
 	default_ttl = $5,
 	max_ttl = $6,
-	restart_requirement_days_of_week = $7,
-	restart_requirement_weeks = $8,
-	failure_ttl = $9,
-	inactivity_ttl = $10,
-	locked_ttl = $11
+	autostop_requirement_days_of_week = $7,
+	autostop_requirement_weeks = $8,
+	autostart_block_days_of_week = $9,
+	failure_ttl = $10,
+	time_til_dormant = $11,
+	time_til_dormant_autodelete = $12
 WHERE
 	id = $1
 ;
@@ -168,3 +169,12 @@ SELECT
 	coalesce((PERCENTILE_DISC(0.95) WITHIN GROUP(ORDER BY exec_time_sec) FILTER (WHERE transition = 'delete')), -1)::FLOAT AS delete_95
 FROM build_times
 ;
+
+-- name: UpdateTemplateAccessControlByID :exec
+UPDATE
+	templates
+SET
+	require_active_version = $2
+WHERE
+	id = $1
+;
diff --git a/coderd/database/queries/templateversions.sql b/coderd/database/queries/templateversions.sql
index b1f83d8e91c8b..094c1b6014de7 100644
--- a/coderd/database/queries/templateversions.sql
+++ b/coderd/database/queries/templateversions.sql
@@ -5,6 +5,13 @@ FROM
 	template_version_with_user AS template_versions
 WHERE
 	template_id = @template_id :: uuid
+	  AND CASE
+		-- If no filter is provided, default to returning ALL template versions.
+		-- The called should always provide a filter if they want to omit
+		-- archived versions.
+		WHEN sqlc.narg('archived') :: boolean IS NULL THEN true
+		ELSE template_versions.archived = sqlc.narg('archived') :: boolean
+	END
 	AND CASE
 		-- This allows using the last element on a page as effectively a cursor.
 		-- This is an important option for scripts that need to paginate without
@@ -105,11 +112,11 @@ SET
 WHERE
 	job_id = $1;
 
--- name: UpdateTemplateVersionGitAuthProvidersByJobID :exec
+-- name: UpdateTemplateVersionExternalAuthProvidersByJobID :exec
 UPDATE
 	template_versions
 SET
-	git_auth_providers = $2,
+	external_auth_providers = $2,
 	updated_at = $3
 WHERE
 	job_id = $1;
@@ -129,3 +136,91 @@ WHERE
 	AND template_id = $3
 ORDER BY created_at DESC
 LIMIT 1;
+
+-- name: UnarchiveTemplateVersion :exec
+-- This will always work regardless of the current state of the template version.
+UPDATE
+	template_versions
+SET
+	archived = false,
+	updated_at = sqlc.arg('updated_at')
+WHERE
+		id = sqlc.arg('template_version_id');
+
+-- name: ArchiveUnusedTemplateVersions :many
+-- Archiving templates is a soft delete action, so is reversible.
+-- Archiving prevents the version from being used and discovered
+-- by listing.
+-- Only unused template versions will be archived, which are any versions not
+-- referenced by the latest build of a workspace.
+UPDATE
+	template_versions
+SET
+	archived = true,
+	updated_at = sqlc.arg('updated_at')
+FROM
+	-- Archive all versions that are returned from this query.
+	(
+		SELECT
+			scoped_template_versions.id
+		FROM
+			-- Scope an archive to a single template and ignore already archived template versions
+			(
+				SELECT
+					*
+				FROM
+					template_versions
+				WHERE
+					template_versions.template_id = sqlc.arg('template_id') :: uuid
+					AND
+					archived = false
+					AND
+					-- This allows archiving a specific template version.
+					CASE
+						WHEN sqlc.arg('template_version_id')::uuid  != '00000000-0000-0000-0000-000000000000'::uuid THEN
+							template_versions.id = sqlc.arg('template_version_id') :: uuid
+						ELSE
+							true
+						END
+			) AS scoped_template_versions
+			LEFT JOIN
+				provisioner_jobs ON scoped_template_versions.job_id = provisioner_jobs.id
+			LEFT JOIN
+				templates ON scoped_template_versions.template_id = templates.id
+		WHERE
+		  -- Actively used template versions (meaning the latest build is using
+		  -- the version) are never archived. A "restart" command on the workspace,
+		  -- even if failed, would use the version. So it cannot be archived until
+		  -- the build is outdated.
+		NOT EXISTS (
+			-- Return all "used" versions, where "used" is defined as being
+			-- used by a latest workspace build.
+			SELECT template_version_id FROM (
+				SELECT
+					DISTINCT ON (workspace_id) template_version_id, transition
+				FROM
+					workspace_builds
+				ORDER BY workspace_id, build_number DESC
+				) AS used_versions
+			WHERE
+				used_versions.transition != 'delete'
+				AND
+				scoped_template_versions.id = used_versions.template_version_id
+		)
+		-- Also never archive the active template version
+		AND active_version_id != scoped_template_versions.id
+		AND CASE
+			-- Optionally, only archive versions that match a given
+			-- job status like 'failed'.
+			WHEN sqlc.narg('job_status') :: provisioner_job_status IS NOT NULL THEN
+				provisioner_jobs.job_status = sqlc.narg('job_status') :: provisioner_job_status
+			ELSE
+				true
+		END
+		-- Pending or running jobs should not be archived, as they are "in progress"
+		AND provisioner_jobs.job_status != 'running'
+		AND provisioner_jobs.job_status != 'pending'
+	) AS archived_versions
+WHERE
+	template_versions.id IN (archived_versions.id)
+RETURNING template_versions.id;
diff --git a/coderd/database/queries/user_links.sql b/coderd/database/queries/user_links.sql
index 2390cb9782b30..5db3324c676a2 100644
--- a/coderd/database/queries/user_links.sql
+++ b/coderd/database/queries/user_links.sql
@@ -14,6 +14,9 @@ FROM
 WHERE
 	user_id = $1 AND login_type = $2;
 
+-- name: GetUserLinksByUserID :many
+SELECT * FROM user_links WHERE user_id = $1;
+
 -- name: InsertUserLink :one
 INSERT INTO
 	user_links (
@@ -21,11 +24,13 @@ INSERT INTO
 		login_type,
 		linked_id,
 		oauth_access_token,
+		oauth_access_token_key_id,
 		oauth_refresh_token,
+		oauth_refresh_token_key_id,
 		oauth_expiry
 	)
 VALUES
-	( $1, $2, $3, $4, $5, $6 ) RETURNING *;
+	( $1, $2, $3, $4, $5, $6, $7, $8 ) RETURNING *;
 
 -- name: UpdateUserLinkedID :one
 UPDATE
@@ -40,7 +45,9 @@ UPDATE
 	user_links
 SET
 	oauth_access_token = $1,
-	oauth_refresh_token = $2,
-	oauth_expiry = $3
+	oauth_access_token_key_id = $2,
+	oauth_refresh_token = $3,
+	oauth_refresh_token_key_id = $4,
+	oauth_expiry = $5
 WHERE
-	user_id = $4 AND login_type = $5 RETURNING *;
+	user_id = $6 AND login_type = $7 RETURNING *;
diff --git a/coderd/database/queries/users.sql b/coderd/database/queries/users.sql
index 8560bf0abf696..8caa74a92e588 100644
--- a/coderd/database/queries/users.sql
+++ b/coderd/database/queries/users.sql
@@ -262,3 +262,8 @@ WHERE
     last_seen_at < @last_seen_after :: timestamp
     AND status = 'active'::user_status
 RETURNING id, email, last_seen_at;
+
+-- AllUserIDs returns all UserIDs regardless of user status or deletion.
+-- name: AllUserIDs :many
+SELECT DISTINCT id FROM USERS;
+
diff --git a/coderd/database/queries/workspaceagents.sql b/coderd/database/queries/workspaceagents.sql
index 4025ac7e59a1b..9ecede976c372 100644
--- a/coderd/database/queries/workspaceagents.sql
+++ b/coderd/database/queries/workspaceagents.sql
@@ -1,13 +1,3 @@
--- name: GetWorkspaceAgentByAuthToken :one
-SELECT
-	*
-FROM
-	workspace_agents
-WHERE
-	auth_token = $1
-ORDER BY
-	created_at DESC;
-
 -- name: GetWorkspaceAgentByID :one
 SELECT
 	*
@@ -50,20 +40,16 @@ INSERT INTO
 		architecture,
 		environment_variables,
 		operating_system,
-		startup_script,
 		directory,
 		instance_metadata,
 		resource_metadata,
 		connection_timeout_seconds,
 		troubleshooting_url,
 		motd_file,
-		startup_script_behavior,
-		startup_script_timeout_seconds,
-		shutdown_script,
-		shutdown_script_timeout_seconds
+		display_apps
 	)
 VALUES
-	($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21) RETURNING *;
+	($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17) RETURNING *;
 
 -- name: UpdateWorkspaceAgentConnectionByID :exec
 UPDATE
@@ -83,7 +69,7 @@ UPDATE
 SET
 	version = $2,
 	expanded_directory = $3,
-	subsystem = $4
+	subsystems = $4
 WHERE
 	id = $1;
 
@@ -122,15 +108,24 @@ VALUES
 	($1, $2, $3, $4, $5, $6);
 
 -- name: UpdateWorkspaceAgentMetadata :exec
+WITH metadata AS (
+	SELECT
+		unnest(sqlc.arg('key')::text[]) AS key,
+		unnest(sqlc.arg('value')::text[]) AS value,
+		unnest(sqlc.arg('error')::text[]) AS error,
+		unnest(sqlc.arg('collected_at')::timestamptz[]) AS collected_at
+)
 UPDATE
-	workspace_agent_metadata
+	workspace_agent_metadata wam
 SET
-	value = $3,
-	error = $4,
-	collected_at = $5
+	value = m.value,
+	error = m.error,
+	collected_at = m.collected_at
+FROM
+	metadata m
 WHERE
-	workspace_agent_id = $1
-	AND key = $2;
+	wam.workspace_agent_id = $1
+	AND wam.key = m.key;
 
 -- name: GetWorkspaceAgentMetadata :many
 SELECT
@@ -138,7 +133,8 @@ SELECT
 FROM
 	workspace_agent_metadata
 WHERE
-	workspace_agent_id = $1;
+	workspace_agent_id = $1
+	AND CASE WHEN COALESCE(array_length(sqlc.arg('keys')::text[], 1), 0) > 0 THEN key = ANY(sqlc.arg('keys')::text[]) ELSE TRUE END;
 
 -- name: UpdateWorkspaceAgentLogOverflowByID :exec
 UPDATE
@@ -165,15 +161,29 @@ WITH new_length AS (
 	logs_length = logs_length + @output_length WHERE workspace_agents.id = @agent_id
 )
 INSERT INTO
-		workspace_agent_logs (agent_id, created_at, output, level, source)
+		workspace_agent_logs (agent_id, created_at, output, level, log_source_id)
 	SELECT
 		@agent_id :: uuid AS agent_id,
-		unnest(@created_at :: timestamptz [ ]) AS created_at,
+		@created_at :: timestamptz AS created_at,
 		unnest(@output :: VARCHAR(1024) [ ]) AS output,
 		unnest(@level :: log_level [ ]) AS level,
-		unnest(@source :: workspace_agent_log_source [ ]) AS source
+		@log_source_id :: uuid AS log_source_id
 	RETURNING workspace_agent_logs.*;
 
+-- name: InsertWorkspaceAgentLogSources :many
+INSERT INTO
+		workspace_agent_log_sources (workspace_agent_id, created_at, id, display_name, icon)
+	SELECT
+		@workspace_agent_id :: uuid AS workspace_agent_id,
+		@created_at :: timestamptz AS created_at,
+		unnest(@id :: uuid [ ]) AS id,
+		unnest(@display_name :: VARCHAR(127) [ ]) AS display_name,
+		unnest(@icon :: text [ ]) AS icon
+	RETURNING workspace_agent_log_sources.*;
+
+-- name: GetWorkspaceAgentLogSourcesByAgentIDs :many
+SELECT * FROM workspace_agent_log_sources WHERE workspace_agent_id = ANY(@ids :: uuid [ ]);
+
 -- If an agent hasn't connected in the last 7 days, we purge it's logs.
 -- Logs can take up a lot of space, so it's important we clean up frequently.
 -- name: DeleteOldWorkspaceAgentLogs :exec
@@ -200,3 +210,56 @@ WHERE
     	WHERE
 			wb.workspace_id = @workspace_id :: uuid
 	);
+
+-- name: GetWorkspaceAgentAndOwnerByAuthToken :one
+SELECT
+	sqlc.embed(workspace_agents),
+	workspaces.id AS workspace_id,
+	users.id AS owner_id,
+	users.username AS owner_name,
+	users.status AS owner_status,
+	array_cat(
+		array_append(users.rbac_roles, 'member'),
+		array_append(ARRAY[]::text[], 'organization-member:' || organization_members.organization_id::text)
+	)::text[] as owner_roles,
+	array_agg(COALESCE(group_members.group_id::text, ''))::text[] AS owner_groups
+FROM users
+	INNER JOIN
+		workspaces
+	ON
+		workspaces.owner_id = users.id
+	INNER JOIN
+		workspace_builds
+	ON
+		workspace_builds.workspace_id = workspaces.id
+	INNER JOIN
+		workspace_resources
+	ON
+		workspace_resources.job_id = workspace_builds.job_id
+	INNER JOIN
+		workspace_agents
+	ON
+		workspace_agents.resource_id = workspace_resources.id
+	INNER JOIN -- every user is a member of some org
+		organization_members
+	ON
+		organization_members.user_id = users.id
+	LEFT JOIN -- as they may not be a member of any groups
+		group_members
+	ON
+		group_members.user_id = users.id
+WHERE
+	-- TODO: we can add more conditions here, such as:
+	-- 1) The user must be active
+	-- 2) The user must not be deleted
+	-- 3) The workspace must be running
+	workspace_agents.auth_token = @auth_token
+GROUP BY
+	workspace_agents.id,
+	workspaces.id,
+	users.id,
+	organization_members.organization_id,
+	workspace_builds.build_number
+ORDER BY
+	workspace_builds.build_number DESC
+LIMIT 1;
diff --git a/coderd/database/queries/workspaceagentstats.sql b/coderd/database/queries/workspaceagentstats.sql
index 1a598bd6a6263..d199f3617acbf 100644
--- a/coderd/database/queries/workspaceagentstats.sql
+++ b/coderd/database/queries/workspaceagentstats.sql
@@ -22,6 +22,46 @@ INSERT INTO
 VALUES
 	($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17) RETURNING *;
 
+-- name: InsertWorkspaceAgentStats :exec
+INSERT INTO
+	workspace_agent_stats (
+		id,
+		created_at,
+		user_id,
+		workspace_id,
+		template_id,
+		agent_id,
+		connections_by_proto,
+		connection_count,
+		rx_packets,
+		rx_bytes,
+		tx_packets,
+		tx_bytes,
+		session_count_vscode,
+		session_count_jetbrains,
+		session_count_reconnecting_pty,
+		session_count_ssh,
+		connection_median_latency_ms
+	)
+SELECT
+	unnest(@id :: uuid[]) AS id,
+	unnest(@created_at :: timestamptz[]) AS created_at,
+	unnest(@user_id :: uuid[]) AS user_id,
+	unnest(@workspace_id :: uuid[]) AS workspace_id,
+	unnest(@template_id :: uuid[]) AS template_id,
+	unnest(@agent_id :: uuid[]) AS agent_id,
+	jsonb_array_elements(@connections_by_proto :: jsonb) AS connections_by_proto,
+	unnest(@connection_count :: bigint[]) AS connection_count,
+	unnest(@rx_packets :: bigint[]) AS rx_packets,
+	unnest(@rx_bytes :: bigint[]) AS rx_bytes,
+	unnest(@tx_packets :: bigint[]) AS tx_packets,
+	unnest(@tx_bytes :: bigint[]) AS tx_bytes,
+	unnest(@session_count_vscode :: bigint[]) AS session_count_vscode,
+	unnest(@session_count_jetbrains :: bigint[]) AS session_count_jetbrains,
+	unnest(@session_count_reconnecting_pty :: bigint[]) AS session_count_reconnecting_pty,
+	unnest(@session_count_ssh :: bigint[]) AS session_count_ssh,
+	unnest(@connection_median_latency_ms :: double precision[]) AS connection_median_latency_ms;
+
 -- name: GetTemplateDAUs :many
 SELECT
 	(created_at at TIME ZONE cast(@tz_offset::integer as text))::date as date,
@@ -50,7 +90,7 @@ ORDER BY
 	date ASC;
 
 -- name: DeleteOldWorkspaceAgentStats :exec
-DELETE FROM workspace_agent_stats WHERE created_at < NOW() - INTERVAL '30 days';
+DELETE FROM workspace_agent_stats WHERE created_at < NOW() - INTERVAL '6 months';
 
 -- name: GetDeploymentWorkspaceAgentStats :one
 WITH agent_stats AS (
diff --git a/coderd/database/queries/workspaceappstats.sql b/coderd/database/queries/workspaceappstats.sql
new file mode 100644
index 0000000000000..98da75e6972c7
--- /dev/null
+++ b/coderd/database/queries/workspaceappstats.sql
@@ -0,0 +1,37 @@
+-- name: InsertWorkspaceAppStats :exec
+INSERT INTO
+	workspace_app_stats (
+		user_id,
+		workspace_id,
+		agent_id,
+		access_method,
+		slug_or_port,
+		session_id,
+		session_started_at,
+		session_ended_at,
+		requests
+	)
+SELECT
+	unnest(@user_id::uuid[]) AS user_id,
+	unnest(@workspace_id::uuid[]) AS workspace_id,
+	unnest(@agent_id::uuid[]) AS agent_id,
+	unnest(@access_method::text[]) AS access_method,
+	unnest(@slug_or_port::text[]) AS slug_or_port,
+	unnest(@session_id::uuid[]) AS session_id,
+	unnest(@session_started_at::timestamptz[]) AS session_started_at,
+	unnest(@session_ended_at::timestamptz[]) AS session_ended_at,
+	unnest(@requests::int[]) AS requests
+ON CONFLICT
+	(user_id, agent_id, session_id)
+DO
+	UPDATE SET
+		session_ended_at = EXCLUDED.session_ended_at,
+		requests = EXCLUDED.requests
+	WHERE
+		workspace_app_stats.user_id = EXCLUDED.user_id
+		AND workspace_app_stats.agent_id = EXCLUDED.agent_id
+		AND workspace_app_stats.session_id = EXCLUDED.session_id
+		-- Since stats are updated in place as time progresses, we only
+		-- want to update this row if it's fresh.
+		AND workspace_app_stats.session_ended_at <= EXCLUDED.session_ended_at
+		AND workspace_app_stats.requests <= EXCLUDED.requests;
diff --git a/coderd/database/queries/workspacebuilds.sql b/coderd/database/queries/workspacebuilds.sql
index ea2ccdb8d08ce..2a1107ef75c5c 100644
--- a/coderd/database/queries/workspacebuilds.sql
+++ b/coderd/database/queries/workspacebuilds.sql
@@ -125,22 +125,57 @@ INSERT INTO
 VALUES
 	($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13);
 
--- name: UpdateWorkspaceBuildByID :exec
+-- name: UpdateWorkspaceBuildCostByID :exec
 UPDATE
 	workspace_builds
 SET
-	updated_at = $2,
-	provisioner_state = $3,
-	deadline = $4,
-	max_deadline = $5
+	daily_cost = $2
 WHERE
 	id = $1;
 
--- name: UpdateWorkspaceBuildCostByID :exec
+-- name: UpdateWorkspaceBuildDeadlineByID :exec
 UPDATE
 	workspace_builds
 SET
-	daily_cost = $2
-WHERE
-	id = $1;
+	deadline = @deadline::timestamptz,
+	max_deadline = @max_deadline::timestamptz,
+	updated_at = @updated_at::timestamptz
+WHERE id = @id::uuid;
 
+-- name: UpdateWorkspaceBuildProvisionerStateByID :exec
+UPDATE
+	workspace_builds
+SET
+	provisioner_state = @provisioner_state::bytea,
+	updated_at = @updated_at::timestamptz
+WHERE id = @id::uuid;
+
+-- name: GetActiveWorkspaceBuildsByTemplateID :many
+SELECT wb.*
+FROM (
+    SELECT
+        workspace_id, MAX(build_number) as max_build_number
+    FROM
+		workspace_build_with_user AS workspace_builds
+    WHERE
+        workspace_id IN (
+			SELECT
+				id
+			FROM
+				workspaces
+			WHERE
+				template_id = $1
+		)
+    GROUP BY
+        workspace_id
+) m
+JOIN
+	workspace_build_with_user AS wb
+	ON m.workspace_id = wb.workspace_id AND m.max_build_number = wb.build_number
+JOIN
+	provisioner_jobs AS pj
+	ON wb.job_id = pj.id
+WHERE
+	wb.transition = 'start'::workspace_transition
+AND
+	pj.completed_at IS NOT NULL;
diff --git a/coderd/database/queries/workspaces.sql b/coderd/database/queries/workspaces.sql
index 5e540a0e5c90a..805f64d70b927 100644
--- a/coderd/database/queries/workspaces.sql
+++ b/coderd/database/queries/workspaces.sql
@@ -96,7 +96,8 @@ LEFT JOIN LATERAL (
 		provisioner_jobs.updated_at,
 		provisioner_jobs.canceled_at,
 		provisioner_jobs.completed_at,
-		provisioner_jobs.error
+		provisioner_jobs.error,
+		provisioner_jobs.job_status
 	FROM
 		workspace_builds
 	LEFT JOIN
@@ -128,63 +129,42 @@ WHERE
 	AND CASE
 		WHEN @status :: text != '' THEN
 			CASE
-				WHEN @status = 'pending' THEN
-					latest_build.started_at IS NULL
+			    -- Some workspace specific status refer to the transition
+			    -- type. By default, the standard provisioner job status
+			    -- search strings are supported.
+			    -- 'running' states
 				WHEN @status = 'starting' THEN
-					latest_build.started_at IS NOT NULL AND
-					latest_build.canceled_at IS NULL AND
-					latest_build.completed_at IS NULL AND
-					latest_build.updated_at - INTERVAL '30 seconds' < NOW() AND
+				    latest_build.job_status = 'running'::provisioner_job_status AND
 					latest_build.transition = 'start'::workspace_transition
-
-				WHEN @status = 'running' THEN
-					latest_build.completed_at IS NOT NULL AND
-					latest_build.canceled_at IS NULL AND
-					latest_build.error IS NULL AND
-					latest_build.transition = 'start'::workspace_transition
-
 				WHEN @status = 'stopping' THEN
-					latest_build.started_at IS NOT NULL AND
-					latest_build.canceled_at IS NULL AND
-					latest_build.completed_at IS NULL AND
-					latest_build.updated_at - INTERVAL '30 seconds' < NOW() AND
+					latest_build.job_status = 'running'::provisioner_job_status AND
 					latest_build.transition = 'stop'::workspace_transition
+				WHEN @status = 'deleting' THEN
+					latest_build.job_status = 'running' AND
+					latest_build.transition = 'delete'::workspace_transition
 
+			    -- 'succeeded' states
+			    WHEN @status = 'deleted' THEN
+			    	latest_build.job_status = 'succeeded'::provisioner_job_status AND
+			    	latest_build.transition = 'delete'::workspace_transition
 				WHEN @status = 'stopped' THEN
-					latest_build.completed_at IS NOT NULL AND
-					latest_build.canceled_at IS NULL AND
-					latest_build.error IS NULL AND
+					latest_build.job_status = 'succeeded'::provisioner_job_status AND
 					latest_build.transition = 'stop'::workspace_transition
+				WHEN @status = 'started' THEN
+					latest_build.job_status = 'succeeded'::provisioner_job_status AND
+					latest_build.transition = 'start'::workspace_transition
 
-				WHEN @status = 'failed' THEN
-					(latest_build.canceled_at IS NOT NULL AND
-						latest_build.error IS NOT NULL) OR
-					(latest_build.completed_at IS NOT NULL AND
-						latest_build.error IS NOT NULL)
-
-				WHEN @status = 'canceling' THEN
-					latest_build.canceled_at IS NOT NULL AND
-					latest_build.completed_at IS NULL
-
-				WHEN @status = 'canceled' THEN
-					latest_build.canceled_at IS NOT NULL AND
-					latest_build.completed_at IS NOT NULL
-
-				WHEN @status = 'deleted' THEN
-					latest_build.started_at IS NOT NULL AND
-					latest_build.canceled_at IS NULL AND
-					latest_build.completed_at IS NOT NULL AND
-					latest_build.updated_at - INTERVAL '30 seconds' < NOW() AND
-					latest_build.transition = 'delete'::workspace_transition AND
-					-- If the error field is not null, the status is 'failed'
-					latest_build.error IS NULL
-
-				WHEN @status = 'deleting' THEN
-					latest_build.completed_at IS NULL AND
-					latest_build.canceled_at IS NULL AND
-					latest_build.error IS NULL AND
-					latest_build.transition = 'delete'::workspace_transition
+			    -- Special case where the provisioner status and workspace status
+			    -- differ. A workspace is "running" if the job is "succeeded" and
+			    -- the transition is "start". This is because a workspace starts
+			    -- running when a job is complete.
+			    WHEN @status = 'running' THEN
+					latest_build.job_status = 'succeeded'::provisioner_job_status AND
+					latest_build.transition = 'start'::workspace_transition
 
+				WHEN @status != '' THEN
+				    -- By default just match the job status exactly
+			    	latest_build.job_status = @status::provisioner_job_status
 				ELSE
 					true
 			END
@@ -259,6 +239,25 @@ WHERE
 			) > 0
 		ELSE true
 	END
+	-- Filter by dormant workspaces. By default we do not return dormant
+	-- workspaces since they are considered soft-deleted.
+	AND CASE
+		WHEN @is_dormant :: text != '' THEN
+			dormant_at IS NOT NULL 
+		ELSE
+			dormant_at IS NULL
+	END
+	-- Filter by last_used
+	AND CASE
+		  WHEN @last_used_before :: timestamp with time zone > '0001-01-01 00:00:00Z' THEN
+				  workspaces.last_used_at <= @last_used_before
+		  ELSE true
+	END
+	AND CASE
+		  WHEN @last_used_after :: timestamp with time zone > '0001-01-01 00:00:00Z' THEN
+				  workspaces.last_used_at >= @last_used_after
+		  ELSE true
+	END
 	-- Authorize Filter clause will be injected below in GetAuthorizedWorkspaces
 	-- @authorize_filter
 ORDER BY
@@ -300,10 +299,11 @@ INSERT INTO
 		name,
 		autostart_schedule,
 		ttl,
-		last_used_at
+		last_used_at,
+		automatic_updates
 	)
 VALUES
-	($1, $2, $3, $4, $5, $6, $7, $8, $9, $10) RETURNING *;
+	($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11) RETURNING *;
 
 -- name: UpdateWorkspaceDeletedByID :exec
 UPDATE
@@ -460,44 +460,64 @@ WHERE
 		) OR
 
 		-- If the workspace's template has an inactivity_ttl set
-		-- it may be eligible for locking.
+		-- it may be eligible for dormancy.
 		(
-			templates.inactivity_ttl > 0 AND
-			workspaces.locked_at IS NULL
+			templates.time_til_dormant > 0 AND
+			workspaces.dormant_at IS NULL
 		) OR
 
-		-- If the workspace's template has a locked_ttl set
-		-- and the workspace is already locked
+		-- If the workspace's template has a time_til_dormant_autodelete set
+		-- and the workspace is already dormant.
 		(
-			templates.locked_ttl > 0 AND
-			workspaces.locked_at IS NOT NULL
+			templates.time_til_dormant_autodelete > 0 AND
+			workspaces.dormant_at IS NOT NULL
 		)
 	) AND workspaces.deleted = 'false';
 
--- name: UpdateWorkspaceLockedDeletingAt :exec
+-- name: UpdateWorkspaceDormantDeletingAt :one
 UPDATE
 	workspaces
 SET
-	locked_at = $2,
-	-- When a workspace is unlocked we want to update the last_used_at to avoid the workspace getting re-locked.
-	-- if we're locking the workspace then we leave it alone.
+	dormant_at = $2,
+	-- When a workspace is active we want to update the last_used_at to avoid the workspace going
+    -- immediately dormant. If we're transition the workspace to dormant then we leave it alone.
 	last_used_at = CASE WHEN $2::timestamptz IS NULL THEN now() at time zone 'utc' ELSE last_used_at END,
-	-- If locked_at is null (meaning unlocked) or the template-defined locked_ttl is 0 we should set
-	-- deleting_at to NULL else set it to the locked_at + locked_ttl duration.
-	deleting_at = CASE WHEN $2::timestamptz IS NULL OR templates.locked_ttl = 0 THEN NULL ELSE $2::timestamptz + INTERVAL '1 milliseconds' * templates.locked_ttl / 1000000 END
+	-- If dormant_at is null (meaning active) or the template-defined time_til_dormant_autodelete is 0 we should set
+	-- deleting_at to NULL else set it to the dormant_at + time_til_dormant_autodelete duration.
+	deleting_at = CASE WHEN $2::timestamptz IS NULL OR templates.time_til_dormant_autodelete = 0 THEN NULL ELSE $2::timestamptz + INTERVAL '1 milliseconds' * templates.time_til_dormant_autodelete / 1000000 END
 FROM
 	templates
 WHERE
 	workspaces.template_id = templates.id
 AND
-	workspaces.id = $1;
+	workspaces.id = $1
+RETURNING workspaces.*;
 
--- name: UpdateWorkspacesDeletingAtByTemplateID :exec
+-- name: UpdateWorkspacesDormantDeletingAtByTemplateID :exec
+UPDATE workspaces
+SET
+    deleting_at = CASE
+        WHEN @time_til_dormant_autodelete_ms::bigint = 0 THEN NULL
+        WHEN @dormant_at::timestamptz > '0001-01-01 00:00:00+00'::timestamptz THEN  (@dormant_at::timestamptz) + interval '1 milliseconds' * @time_til_dormant_autodelete_ms::bigint
+        ELSE dormant_at + interval '1 milliseconds' * @time_til_dormant_autodelete_ms::bigint
+    END,
+    dormant_at = CASE WHEN @dormant_at::timestamptz > '0001-01-01 00:00:00+00'::timestamptz THEN @dormant_at::timestamptz ELSE dormant_at END
+WHERE
+    template_id = @template_id
+AND
+    dormant_at IS NOT NULL;
+
+-- name: UpdateTemplateWorkspacesLastUsedAt :exec
+UPDATE workspaces
+SET
+	last_used_at = @last_used_at::timestamptz
+WHERE
+	template_id = @template_id;
+
+-- name: UpdateWorkspaceAutomaticUpdates :exec
 UPDATE
 	workspaces
 SET
-	deleting_at = CASE WHEN @locked_ttl_ms::bigint = 0 THEN NULL ELSE locked_at + interval '1 milliseconds' * @locked_ttl_ms::bigint END
+	automatic_updates = $2
 WHERE
-	template_id = @template_id
-AND
-	locked_at IS NOT NULL;
+		id = $1;
diff --git a/coderd/database/queries/workspacescripts.sql b/coderd/database/queries/workspacescripts.sql
new file mode 100644
index 0000000000000..8dc234afd37d3
--- /dev/null
+++ b/coderd/database/queries/workspacescripts.sql
@@ -0,0 +1,18 @@
+-- name: InsertWorkspaceAgentScripts :many
+INSERT INTO
+	workspace_agent_scripts (workspace_agent_id, created_at, log_source_id, log_path, script, cron, start_blocks_login, run_on_start, run_on_stop, timeout_seconds)
+SELECT
+	@workspace_agent_id :: uuid AS workspace_agent_id,
+	@created_at :: timestamptz AS created_at,
+	unnest(@log_source_id :: uuid [ ]) AS log_source_id,
+	unnest(@log_path :: text [ ]) AS log_path,
+	unnest(@script :: text [ ]) AS script,
+	unnest(@cron :: text [ ]) AS cron,
+	unnest(@start_blocks_login :: boolean [ ]) AS start_blocks_login,
+	unnest(@run_on_start :: boolean [ ]) AS run_on_start,
+	unnest(@run_on_stop :: boolean [ ]) AS run_on_stop,
+	unnest(@timeout_seconds :: integer [ ]) AS timeout_seconds
+RETURNING workspace_agent_scripts.*;
+
+-- name: GetWorkspaceAgentScriptsByAgentIDs :many
+SELECT * FROM workspace_agent_scripts WHERE workspace_agent_id = ANY(@ids :: uuid [ ]);
diff --git a/coderd/database/sqlc.yaml b/coderd/database/sqlc.yaml
index 526f62d3a5ca5..956485311e4a1 100644
--- a/coderd/database/sqlc.yaml
+++ b/coderd/database/sqlc.yaml
@@ -38,8 +38,10 @@ overrides:
       api_key_scope: APIKeyScope
       api_key_scope_all: APIKeyScopeAll
       api_key_scope_application_connect: APIKeyScopeApplicationConnect
+      api_version: APIVersion
       avatar_url: AvatarURL
       created_by_avatar_url: CreatedByAvatarURL
+      dbcrypt_key: DBCryptKey
       session_count_vscode: SessionCountVSCode
       session_count_jetbrains: SessionCountJetBrains
       session_count_reconnecting_pty: SessionCountReconnectingPTY
@@ -47,9 +49,12 @@ overrides:
       connection_median_latency_ms: ConnectionMedianLatencyMS
       login_type_oidc: LoginTypeOIDC
       oauth_access_token: OAuthAccessToken
+      oauth_access_token_key_id: OAuthAccessTokenKeyID
       oauth_expiry: OAuthExpiry
       oauth_id_token: OAuthIDToken
       oauth_refresh_token: OAuthRefreshToken
+      oauth_refresh_token_key_id: OAuthRefreshTokenKeyID
+      oauth_extra: OAuthExtra
       parameter_type_system_hcl: ParameterTypeSystemHCL
       userstatus: UserStatus
       gitsshkey: GitSSHKey
@@ -67,10 +72,11 @@ overrides:
       motd_file: MOTDFile
       uuid: UUID
       failure_ttl: FailureTTL
-      inactivity_ttl: InactivityTTL
+      time_til_dormant_autodelete: TimeTilDormantAutoDelete
       eof: EOF
-      locked_ttl: LockedTTL
       template_ids: TemplateIDs
+      active_user_ids: ActiveUserIDs
+      display_app_ssh_helper: DisplayAppSSHHelper
 
 sql:
   - schema: "./dump.sql"
diff --git a/coderd/database/tx.go b/coderd/database/tx.go
new file mode 100644
index 0000000000000..43da15f3f058c
--- /dev/null
+++ b/coderd/database/tx.go
@@ -0,0 +1,49 @@
+package database
+
+import (
+	"database/sql"
+
+	"github.com/lib/pq"
+	"golang.org/x/xerrors"
+)
+
+const maxRetries = 5
+
+// ReadModifyUpdate is a helper function to run a db transaction that reads some
+// object(s), modifies some of the data, and writes the modified object(s) back
+// to the database.  It is run in a transaction at RepeatableRead isolation so
+// that if another database client also modifies the data we are writing and
+// commits, then the transaction is rolled back and restarted.
+//
+// This is needed because we typically read all object columns, modify some
+// subset, and then write all columns.  Consider an object with columns A, B and
+// initial values A=1, B=1.  Two database clients work simultaneously, with one
+// client attempting to set A=2, and another attempting to set B=2.  They both
+// initially read A=1, B=1, and then one writes A=2, B=1, and the other writes
+// A=1, B=2.  With default PostgreSQL isolation of ReadCommitted, both of these
+// transactions would succeed and we end up with either A=2, B=1 or A=1, B=2.
+// One or other client gets their transaction wiped out even though the data
+// they wanted to change didn't conflict.
+//
+// If we run at RepeatableRead isolation, then one or other transaction will
+// fail.  Let's say the transaction that sets A=2 succeeds.  Then the first B=2
+// transaction fails, but here we retry.  The second attempt we read A=2, B=1,
+// then write A=2, B=2 as desired, and this succeeds.
+func ReadModifyUpdate(db Store, f func(tx Store) error,
+) error {
+	var err error
+	for retries := 0; retries < maxRetries; retries++ {
+		err = db.InTx(f, &sql.TxOptions{
+			Isolation: sql.LevelRepeatableRead,
+		})
+		var pqe *pq.Error
+		if xerrors.As(err, &pqe) {
+			if pqe.Code == "40001" {
+				// serialization error, retry
+				continue
+			}
+		}
+		return err
+	}
+	return xerrors.Errorf("too many errors; last error: %w", err)
+}
diff --git a/coderd/database/tx_test.go b/coderd/database/tx_test.go
new file mode 100644
index 0000000000000..ff7569ef562df
--- /dev/null
+++ b/coderd/database/tx_test.go
@@ -0,0 +1,81 @@
+package database_test
+
+import (
+	"database/sql"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/lib/pq"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbmock"
+)
+
+func TestReadModifyUpdate_OK(t *testing.T) {
+	t.Parallel()
+
+	mDB := dbmock.NewMockStore(gomock.NewController(t))
+
+	mDB.EXPECT().
+		InTx(gomock.Any(), &sql.TxOptions{Isolation: sql.LevelRepeatableRead}).
+		Times(1).
+		Return(nil)
+	err := database.ReadModifyUpdate(mDB, func(tx database.Store) error {
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestReadModifyUpdate_RetryOK(t *testing.T) {
+	t.Parallel()
+
+	mDB := dbmock.NewMockStore(gomock.NewController(t))
+
+	firstUpdate := mDB.EXPECT().
+		InTx(gomock.Any(), &sql.TxOptions{Isolation: sql.LevelRepeatableRead}).
+		Times(1).
+		Return(&pq.Error{Code: pq.ErrorCode("40001")})
+	mDB.EXPECT().
+		InTx(gomock.Any(), &sql.TxOptions{Isolation: sql.LevelRepeatableRead}).
+		After(firstUpdate).
+		Times(1).
+		Return(nil)
+
+	err := database.ReadModifyUpdate(mDB, func(tx database.Store) error {
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func TestReadModifyUpdate_HardError(t *testing.T) {
+	t.Parallel()
+
+	mDB := dbmock.NewMockStore(gomock.NewController(t))
+
+	mDB.EXPECT().
+		InTx(gomock.Any(), &sql.TxOptions{Isolation: sql.LevelRepeatableRead}).
+		Times(1).
+		Return(xerrors.New("a bad thing happened"))
+
+	err := database.ReadModifyUpdate(mDB, func(tx database.Store) error {
+		return nil
+	})
+	require.ErrorContains(t, err, "a bad thing happened")
+}
+
+func TestReadModifyUpdate_TooManyRetries(t *testing.T) {
+	t.Parallel()
+
+	mDB := dbmock.NewMockStore(gomock.NewController(t))
+
+	mDB.EXPECT().
+		InTx(gomock.Any(), &sql.TxOptions{Isolation: sql.LevelRepeatableRead}).
+		Times(5).
+		Return(&pq.Error{Code: pq.ErrorCode("40001")})
+	err := database.ReadModifyUpdate(mDB, func(tx database.Store) error {
+		return nil
+	})
+	require.ErrorContains(t, err, "too many errors")
+}
diff --git a/coderd/database/types.go b/coderd/database/types.go
index 629138de2cfda..5099733601f65 100644
--- a/coderd/database/types.go
+++ b/coderd/database/types.go
@@ -8,7 +8,7 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac"
 )
 
 // AuditOAuthConvertState is never stored in the database. It is stored in a cookie
@@ -79,14 +79,3 @@ func (m *StringMap) Scan(src interface{}) error {
 func (m StringMap) Value() (driver.Value, error) {
 	return json.Marshal(m)
 }
-
-// Now returns a standardized timezone used for database resources.
-func Now() time.Time {
-	return Time(time.Now().UTC())
-}
-
-// Time returns a time compatible with Postgres. Postgres only stores dates with
-// microsecond precision.
-func Time(t time.Time) time.Time {
-	return t.Round(time.Microsecond)
-}
diff --git a/coderd/database/unique_constraint.go b/coderd/database/unique_constraint.go
index c8dbc831e8651..0087da609aa2c 100644
--- a/coderd/database/unique_constraint.go
+++ b/coderd/database/unique_constraint.go
@@ -1,4 +1,4 @@
-// Code generated by gen/enum. DO NOT EDIT.
+// Code generated by scripts/dbgen/main.go. DO NOT EDIT.
 package database
 
 // UniqueConstraint represents a named unique constraint on a table.
@@ -6,25 +6,62 @@ type UniqueConstraint string
 
 // UniqueConstraint enums.
 const (
+	UniqueAgentStatsPkey                                    UniqueConstraint = "agent_stats_pkey"                                         // ALTER TABLE ONLY workspace_agent_stats ADD CONSTRAINT agent_stats_pkey PRIMARY KEY (id);
+	UniqueAPIKeysPkey                                       UniqueConstraint = "api_keys_pkey"                                            // ALTER TABLE ONLY api_keys ADD CONSTRAINT api_keys_pkey PRIMARY KEY (id);
+	UniqueAuditLogsPkey                                     UniqueConstraint = "audit_logs_pkey"                                          // ALTER TABLE ONLY audit_logs ADD CONSTRAINT audit_logs_pkey PRIMARY KEY (id);
+	UniqueDbcryptKeysActiveKeyDigestKey                     UniqueConstraint = "dbcrypt_keys_active_key_digest_key"                       // ALTER TABLE ONLY dbcrypt_keys ADD CONSTRAINT dbcrypt_keys_active_key_digest_key UNIQUE (active_key_digest);
+	UniqueDbcryptKeysPkey                                   UniqueConstraint = "dbcrypt_keys_pkey"                                        // ALTER TABLE ONLY dbcrypt_keys ADD CONSTRAINT dbcrypt_keys_pkey PRIMARY KEY (number);
+	UniqueDbcryptKeysRevokedKeyDigestKey                    UniqueConstraint = "dbcrypt_keys_revoked_key_digest_key"                      // ALTER TABLE ONLY dbcrypt_keys ADD CONSTRAINT dbcrypt_keys_revoked_key_digest_key UNIQUE (revoked_key_digest);
 	UniqueFilesHashCreatedByKey                             UniqueConstraint = "files_hash_created_by_key"                                // ALTER TABLE ONLY files ADD CONSTRAINT files_hash_created_by_key UNIQUE (hash, created_by);
-	UniqueGitAuthLinksProviderIDUserIDKey                   UniqueConstraint = "git_auth_links_provider_id_user_id_key"                   // ALTER TABLE ONLY git_auth_links ADD CONSTRAINT git_auth_links_provider_id_user_id_key UNIQUE (provider_id, user_id);
+	UniqueFilesPkey                                         UniqueConstraint = "files_pkey"                                               // ALTER TABLE ONLY files ADD CONSTRAINT files_pkey PRIMARY KEY (id);
+	UniqueGitAuthLinksProviderIDUserIDKey                   UniqueConstraint = "git_auth_links_provider_id_user_id_key"                   // ALTER TABLE ONLY external_auth_links ADD CONSTRAINT git_auth_links_provider_id_user_id_key UNIQUE (provider_id, user_id);
+	UniqueGitSSHKeysPkey                                    UniqueConstraint = "gitsshkeys_pkey"                                          // ALTER TABLE ONLY gitsshkeys ADD CONSTRAINT gitsshkeys_pkey PRIMARY KEY (user_id);
 	UniqueGroupMembersUserIDGroupIDKey                      UniqueConstraint = "group_members_user_id_group_id_key"                       // ALTER TABLE ONLY group_members ADD CONSTRAINT group_members_user_id_group_id_key UNIQUE (user_id, group_id);
 	UniqueGroupsNameOrganizationIDKey                       UniqueConstraint = "groups_name_organization_id_key"                          // ALTER TABLE ONLY groups ADD CONSTRAINT groups_name_organization_id_key UNIQUE (name, organization_id);
+	UniqueGroupsPkey                                        UniqueConstraint = "groups_pkey"                                              // ALTER TABLE ONLY groups ADD CONSTRAINT groups_pkey PRIMARY KEY (id);
 	UniqueLicensesJWTKey                                    UniqueConstraint = "licenses_jwt_key"                                         // ALTER TABLE ONLY licenses ADD CONSTRAINT licenses_jwt_key UNIQUE (jwt);
+	UniqueLicensesPkey                                      UniqueConstraint = "licenses_pkey"                                            // ALTER TABLE ONLY licenses ADD CONSTRAINT licenses_pkey PRIMARY KEY (id);
+	UniqueOrganizationMembersPkey                           UniqueConstraint = "organization_members_pkey"                                // ALTER TABLE ONLY organization_members ADD CONSTRAINT organization_members_pkey PRIMARY KEY (organization_id, user_id);
+	UniqueOrganizationsPkey                                 UniqueConstraint = "organizations_pkey"                                       // ALTER TABLE ONLY organizations ADD CONSTRAINT organizations_pkey PRIMARY KEY (id);
 	UniqueParameterSchemasJobIDNameKey                      UniqueConstraint = "parameter_schemas_job_id_name_key"                        // ALTER TABLE ONLY parameter_schemas ADD CONSTRAINT parameter_schemas_job_id_name_key UNIQUE (job_id, name);
+	UniqueParameterSchemasPkey                              UniqueConstraint = "parameter_schemas_pkey"                                   // ALTER TABLE ONLY parameter_schemas ADD CONSTRAINT parameter_schemas_pkey PRIMARY KEY (id);
+	UniqueParameterValuesPkey                               UniqueConstraint = "parameter_values_pkey"                                    // ALTER TABLE ONLY parameter_values ADD CONSTRAINT parameter_values_pkey PRIMARY KEY (id);
 	UniqueParameterValuesScopeIDNameKey                     UniqueConstraint = "parameter_values_scope_id_name_key"                       // ALTER TABLE ONLY parameter_values ADD CONSTRAINT parameter_values_scope_id_name_key UNIQUE (scope_id, name);
 	UniqueProvisionerDaemonsNameKey                         UniqueConstraint = "provisioner_daemons_name_key"                             // ALTER TABLE ONLY provisioner_daemons ADD CONSTRAINT provisioner_daemons_name_key UNIQUE (name);
+	UniqueProvisionerDaemonsPkey                            UniqueConstraint = "provisioner_daemons_pkey"                                 // ALTER TABLE ONLY provisioner_daemons ADD CONSTRAINT provisioner_daemons_pkey PRIMARY KEY (id);
+	UniqueProvisionerJobLogsPkey                            UniqueConstraint = "provisioner_job_logs_pkey"                                // ALTER TABLE ONLY provisioner_job_logs ADD CONSTRAINT provisioner_job_logs_pkey PRIMARY KEY (id);
+	UniqueProvisionerJobsPkey                               UniqueConstraint = "provisioner_jobs_pkey"                                    // ALTER TABLE ONLY provisioner_jobs ADD CONSTRAINT provisioner_jobs_pkey PRIMARY KEY (id);
 	UniqueSiteConfigsKeyKey                                 UniqueConstraint = "site_configs_key_key"                                     // ALTER TABLE ONLY site_configs ADD CONSTRAINT site_configs_key_key UNIQUE (key);
+	UniqueTailnetAgentsPkey                                 UniqueConstraint = "tailnet_agents_pkey"                                      // ALTER TABLE ONLY tailnet_agents ADD CONSTRAINT tailnet_agents_pkey PRIMARY KEY (id, coordinator_id);
+	UniqueTailnetClientSubscriptionsPkey                    UniqueConstraint = "tailnet_client_subscriptions_pkey"                        // ALTER TABLE ONLY tailnet_client_subscriptions ADD CONSTRAINT tailnet_client_subscriptions_pkey PRIMARY KEY (client_id, coordinator_id, agent_id);
+	UniqueTailnetClientsPkey                                UniqueConstraint = "tailnet_clients_pkey"                                     // ALTER TABLE ONLY tailnet_clients ADD CONSTRAINT tailnet_clients_pkey PRIMARY KEY (id, coordinator_id);
+	UniqueTailnetCoordinatorsPkey                           UniqueConstraint = "tailnet_coordinators_pkey"                                // ALTER TABLE ONLY tailnet_coordinators ADD CONSTRAINT tailnet_coordinators_pkey PRIMARY KEY (id);
 	UniqueTemplateVersionParametersTemplateVersionIDNameKey UniqueConstraint = "template_version_parameters_template_version_id_name_key" // ALTER TABLE ONLY template_version_parameters ADD CONSTRAINT template_version_parameters_template_version_id_name_key UNIQUE (template_version_id, name);
 	UniqueTemplateVersionVariablesTemplateVersionIDNameKey  UniqueConstraint = "template_version_variables_template_version_id_name_key"  // ALTER TABLE ONLY template_version_variables ADD CONSTRAINT template_version_variables_template_version_id_name_key UNIQUE (template_version_id, name);
+	UniqueTemplateVersionsPkey                              UniqueConstraint = "template_versions_pkey"                                   // ALTER TABLE ONLY template_versions ADD CONSTRAINT template_versions_pkey PRIMARY KEY (id);
 	UniqueTemplateVersionsTemplateIDNameKey                 UniqueConstraint = "template_versions_template_id_name_key"                   // ALTER TABLE ONLY template_versions ADD CONSTRAINT template_versions_template_id_name_key UNIQUE (template_id, name);
+	UniqueTemplatesPkey                                     UniqueConstraint = "templates_pkey"                                           // ALTER TABLE ONLY templates ADD CONSTRAINT templates_pkey PRIMARY KEY (id);
+	UniqueUserLinksPkey                                     UniqueConstraint = "user_links_pkey"                                          // ALTER TABLE ONLY user_links ADD CONSTRAINT user_links_pkey PRIMARY KEY (user_id, login_type);
+	UniqueUsersPkey                                         UniqueConstraint = "users_pkey"                                               // ALTER TABLE ONLY users ADD CONSTRAINT users_pkey PRIMARY KEY (id);
+	UniqueWorkspaceAgentLogSourcesPkey                      UniqueConstraint = "workspace_agent_log_sources_pkey"                         // ALTER TABLE ONLY workspace_agent_log_sources ADD CONSTRAINT workspace_agent_log_sources_pkey PRIMARY KEY (workspace_agent_id, id);
+	UniqueWorkspaceAgentMetadataPkey                        UniqueConstraint = "workspace_agent_metadata_pkey"                            // ALTER TABLE ONLY workspace_agent_metadata ADD CONSTRAINT workspace_agent_metadata_pkey PRIMARY KEY (workspace_agent_id, key);
+	UniqueWorkspaceAgentStartupLogsPkey                     UniqueConstraint = "workspace_agent_startup_logs_pkey"                        // ALTER TABLE ONLY workspace_agent_logs ADD CONSTRAINT workspace_agent_startup_logs_pkey PRIMARY KEY (id);
+	UniqueWorkspaceAgentsPkey                               UniqueConstraint = "workspace_agents_pkey"                                    // ALTER TABLE ONLY workspace_agents ADD CONSTRAINT workspace_agents_pkey PRIMARY KEY (id);
+	UniqueWorkspaceAppStatsPkey                             UniqueConstraint = "workspace_app_stats_pkey"                                 // ALTER TABLE ONLY workspace_app_stats ADD CONSTRAINT workspace_app_stats_pkey PRIMARY KEY (id);
+	UniqueWorkspaceAppStatsUserIDAgentIDSessionIDKey        UniqueConstraint = "workspace_app_stats_user_id_agent_id_session_id_key"      // ALTER TABLE ONLY workspace_app_stats ADD CONSTRAINT workspace_app_stats_user_id_agent_id_session_id_key UNIQUE (user_id, agent_id, session_id);
 	UniqueWorkspaceAppsAgentIDSlugIndex                     UniqueConstraint = "workspace_apps_agent_id_slug_idx"                         // ALTER TABLE ONLY workspace_apps ADD CONSTRAINT workspace_apps_agent_id_slug_idx UNIQUE (agent_id, slug);
+	UniqueWorkspaceAppsPkey                                 UniqueConstraint = "workspace_apps_pkey"                                      // ALTER TABLE ONLY workspace_apps ADD CONSTRAINT workspace_apps_pkey PRIMARY KEY (id);
 	UniqueWorkspaceBuildParametersWorkspaceBuildIDNameKey   UniqueConstraint = "workspace_build_parameters_workspace_build_id_name_key"   // ALTER TABLE ONLY workspace_build_parameters ADD CONSTRAINT workspace_build_parameters_workspace_build_id_name_key UNIQUE (workspace_build_id, name);
 	UniqueWorkspaceBuildsJobIDKey                           UniqueConstraint = "workspace_builds_job_id_key"                              // ALTER TABLE ONLY workspace_builds ADD CONSTRAINT workspace_builds_job_id_key UNIQUE (job_id);
+	UniqueWorkspaceBuildsPkey                               UniqueConstraint = "workspace_builds_pkey"                                    // ALTER TABLE ONLY workspace_builds ADD CONSTRAINT workspace_builds_pkey PRIMARY KEY (id);
 	UniqueWorkspaceBuildsWorkspaceIDBuildNumberKey          UniqueConstraint = "workspace_builds_workspace_id_build_number_key"           // ALTER TABLE ONLY workspace_builds ADD CONSTRAINT workspace_builds_workspace_id_build_number_key UNIQUE (workspace_id, build_number);
+	UniqueWorkspaceProxiesPkey                              UniqueConstraint = "workspace_proxies_pkey"                                   // ALTER TABLE ONLY workspace_proxies ADD CONSTRAINT workspace_proxies_pkey PRIMARY KEY (id);
 	UniqueWorkspaceProxiesRegionIDUnique                    UniqueConstraint = "workspace_proxies_region_id_unique"                       // ALTER TABLE ONLY workspace_proxies ADD CONSTRAINT workspace_proxies_region_id_unique UNIQUE (region_id);
 	UniqueWorkspaceResourceMetadataName                     UniqueConstraint = "workspace_resource_metadata_name"                         // ALTER TABLE ONLY workspace_resource_metadata ADD CONSTRAINT workspace_resource_metadata_name UNIQUE (workspace_resource_id, key);
-	UniqueIndexApiKeyName                                   UniqueConstraint = "idx_api_key_name"                                         // CREATE UNIQUE INDEX idx_api_key_name ON api_keys USING btree (user_id, token_name) WHERE (login_type = 'token'::login_type);
+	UniqueWorkspaceResourceMetadataPkey                     UniqueConstraint = "workspace_resource_metadata_pkey"                         // ALTER TABLE ONLY workspace_resource_metadata ADD CONSTRAINT workspace_resource_metadata_pkey PRIMARY KEY (id);
+	UniqueWorkspaceResourcesPkey                            UniqueConstraint = "workspace_resources_pkey"                                 // ALTER TABLE ONLY workspace_resources ADD CONSTRAINT workspace_resources_pkey PRIMARY KEY (id);
+	UniqueWorkspacesPkey                                    UniqueConstraint = "workspaces_pkey"                                          // ALTER TABLE ONLY workspaces ADD CONSTRAINT workspaces_pkey PRIMARY KEY (id);
+	UniqueIndexAPIKeyName                                   UniqueConstraint = "idx_api_key_name"                                         // CREATE UNIQUE INDEX idx_api_key_name ON api_keys USING btree (user_id, token_name) WHERE (login_type = 'token'::login_type);
 	UniqueIndexOrganizationName                             UniqueConstraint = "idx_organization_name"                                    // CREATE UNIQUE INDEX idx_organization_name ON organizations USING btree (name);
 	UniqueIndexOrganizationNameLower                        UniqueConstraint = "idx_organization_name_lower"                              // CREATE UNIQUE INDEX idx_organization_name_lower ON organizations USING btree (lower(name));
 	UniqueIndexUsersEmail                                   UniqueConstraint = "idx_users_email"                                          // CREATE UNIQUE INDEX idx_users_email ON users USING btree (email) WHERE (deleted = false);
diff --git a/coderd/debug.go b/coderd/debug.go
index 045cb0076c953..1e50b91ba69d3 100644
--- a/coderd/debug.go
+++ b/coderd/debug.go
@@ -2,13 +2,14 @@ package coderd
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 	"time"
 
-	"github.com/coder/coder/coderd/healthcheck"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/healthcheck"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // @Summary Debug Info Wireguard Coordinator
@@ -37,7 +38,7 @@ func (api *API) debugDeploymentHealth(rw http.ResponseWriter, r *http.Request) {
 	// Get cached report if it exists.
 	if report := api.healthCheckCache.Load(); report != nil {
 		if time.Since(report.Time) < api.HealthcheckRefresh {
-			httpapi.WriteIndent(ctx, rw, http.StatusOK, report)
+			formatHealthcheck(ctx, rw, r, report)
 			return
 		}
 	}
@@ -59,11 +60,36 @@ func (api *API) debugDeploymentHealth(rw http.ResponseWriter, r *http.Request) {
 		})
 		return
 	case res := <-resChan:
-		httpapi.WriteIndent(ctx, rw, http.StatusOK, res.Val)
+		formatHealthcheck(ctx, rw, r, res.Val)
 		return
 	}
 }
 
+func formatHealthcheck(ctx context.Context, rw http.ResponseWriter, r *http.Request, hc *healthcheck.Report) {
+	format := r.URL.Query().Get("format")
+	switch format {
+	case "text":
+		rw.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		rw.WriteHeader(http.StatusOK)
+
+		_, _ = fmt.Fprintln(rw, "time:", hc.Time.Format(time.RFC3339))
+		_, _ = fmt.Fprintln(rw, "healthy:", hc.Healthy)
+		_, _ = fmt.Fprintln(rw, "derp:", hc.DERP.Healthy)
+		_, _ = fmt.Fprintln(rw, "access_url:", hc.AccessURL.Healthy)
+		_, _ = fmt.Fprintln(rw, "websocket:", hc.Websocket.Healthy)
+		_, _ = fmt.Fprintln(rw, "database:", hc.Database.Healthy)
+
+	case "", "json":
+		httpapi.WriteIndent(ctx, rw, http.StatusOK, hc)
+
+	default:
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: fmt.Sprintf("Invalid format option %q.", format),
+			Detail:  "Allowed values are: \"json\", \"simple\".",
+		})
+	}
+}
+
 // For some reason the swagger docs need to be attached to a function.
 //
 // @Summary Debug Info Websocket Test
diff --git a/coderd/debug_test.go b/coderd/debug_test.go
index 2cff8f176c4c3..f9241a303bcd4 100644
--- a/coderd/debug_test.go
+++ b/coderd/debug_test.go
@@ -10,9 +10,10 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/healthcheck"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/healthcheck"
+	"github.com/coder/coder/v2/coderd/healthcheck/derphealth"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestDebugHealth(t *testing.T) {
@@ -34,7 +35,7 @@ func TestDebugHealth(t *testing.T) {
 		defer cancel()
 
 		sessionToken = client.SessionToken()
-		res, err := client.Request(ctx, "GET", "/debug/health", nil)
+		res, err := client.Request(ctx, "GET", "/api/v2/debug/health", nil)
 		require.NoError(t, err)
 		defer res.Body.Close()
 		_, _ = io.ReadAll(res.Body)
@@ -106,6 +107,41 @@ func TestDebugHealth(t *testing.T) {
 		require.Equal(t, http.StatusOK, res.StatusCode)
 		require.Equal(t, 1, calls)
 	})
+
+	t.Run("Text", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			ctx, cancel  = context.WithTimeout(context.Background(), testutil.WaitShort)
+			sessionToken string
+			client       = coderdtest.New(t, &coderdtest.Options{
+				HealthcheckFunc: func(_ context.Context, apiKey string) *healthcheck.Report {
+					assert.Equal(t, sessionToken, apiKey)
+					return &healthcheck.Report{
+						Time:    time.Now(),
+						Healthy: true,
+						DERP:    derphealth.Report{Healthy: true},
+					}
+				},
+			})
+			_ = coderdtest.CreateFirstUser(t, client)
+		)
+		defer cancel()
+
+		sessionToken = client.SessionToken()
+		res, err := client.Request(ctx, "GET", "/api/v2/debug/health?format=text", nil)
+		require.NoError(t, err)
+		defer res.Body.Close()
+		resB, _ := io.ReadAll(res.Body)
+		require.Equal(t, http.StatusOK, res.StatusCode)
+
+		resStr := string(resB)
+		assert.Contains(t, resStr, "healthy: true")
+		assert.Contains(t, resStr, "derp: true")
+		assert.Contains(t, resStr, "access_url: false")
+		assert.Contains(t, resStr, "websocket: false")
+		assert.Contains(t, resStr, "database: false")
+	})
 }
 
 func TestDebugWebsocket(t *testing.T) {
diff --git a/coderd/deployment.go b/coderd/deployment.go
index 5f12f39cc3461..ebea5625583cd 100644
--- a/coderd/deployment.go
+++ b/coderd/deployment.go
@@ -4,10 +4,10 @@ import (
 	"net/http"
 	"net/url"
 
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // @Summary Get deployment config
@@ -33,7 +33,7 @@ func (api *API) deploymentValues(rw http.ResponseWriter, r *http.Request) {
 		r.Context(), rw, http.StatusOK,
 		codersdk.DeploymentConfig{
 			Values:  values,
-			Options: values.Options(),
+			Options: api.DeploymentOptions,
 		},
 	)
 }
diff --git a/coderd/deployment_test.go b/coderd/deployment_test.go
index d525166993aac..66e3990e25ff3 100644
--- a/coderd/deployment_test.go
+++ b/coderd/deployment_test.go
@@ -7,8 +7,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestDeploymentValues(t *testing.T) {
@@ -26,6 +26,7 @@ func TestDeploymentValues(t *testing.T) {
 	cfg.OIDC.EmailField.Set("some_random_field_you_never_expected")
 	cfg.PostgresURL.Set(hi)
 	cfg.SCIMAPIKey.Set(hi)
+	cfg.ExternalTokenEncryptionKeys.Set("the_random_key_we_never_expected,an_other_key_we_never_unexpected")
 
 	client := coderdtest.New(t, &coderdtest.Options{
 		DeploymentValues: cfg,
@@ -44,6 +45,7 @@ func TestDeploymentValues(t *testing.T) {
 	require.Empty(t, scrubbed.Values.OIDC.ClientSecret.Value())
 	require.Empty(t, scrubbed.Values.PostgresURL.Value())
 	require.Empty(t, scrubbed.Values.SCIMAPIKey.Value())
+	require.Empty(t, scrubbed.Values.ExternalTokenEncryptionKeys.Value())
 }
 
 func TestDeploymentStats(t *testing.T) {
diff --git a/coderd/deprecated.go b/coderd/deprecated.go
index 59e23b8d48136..3d37351efa3a9 100644
--- a/coderd/deprecated.go
+++ b/coderd/deprecated.go
@@ -3,7 +3,12 @@ package coderd
 import (
 	"net/http"
 
-	"github.com/coder/coder/coderd/httpapi"
+	"github.com/go-chi/chi/v5"
+
+	"cdr.dev/slog"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
 )
 
 // @Summary Removed: Get parameters by template version
@@ -56,3 +61,56 @@ func (api *API) patchWorkspaceAgentLogsDeprecated(rw http.ResponseWriter, r *htt
 func (api *API) workspaceAgentLogsDeprecated(rw http.ResponseWriter, r *http.Request) {
 	api.workspaceAgentLogs(rw, r)
 }
+
+// @Summary Removed: Get workspace agent git auth
+// @ID removed-get-workspace-agent-git-auth
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Agents
+// @Param match query string true "Match"
+// @Param id query string true "Provider ID"
+// @Param listen query bool false "Wait for a new token to be issued"
+// @Success 200 {object} agentsdk.ExternalAuthResponse
+// @Router /workspaceagents/me/gitauth [get]
+func (api *API) workspaceAgentsGitAuth(rw http.ResponseWriter, r *http.Request) {
+	api.workspaceAgentsExternalAuth(rw, r)
+}
+
+// @Summary Removed: Submit workspace agent metadata
+// @ID removed-submit-workspace-agent-metadata
+// @Security CoderSessionToken
+// @Accept json
+// @Tags Agents
+// @Param request body agentsdk.PostMetadataRequestDeprecated true "Workspace agent metadata request"
+// @Param key path string true "metadata key" format(string)
+// @Success 204 "Success"
+// @Router /workspaceagents/me/metadata/{key} [post]
+// @x-apidocgen {"skip": true}
+func (api *API) workspaceAgentPostMetadataDeprecated(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	var req agentsdk.PostMetadataRequestDeprecated
+	if !httpapi.Read(ctx, rw, r, &req) {
+		return
+	}
+
+	workspaceAgent := httpmw.WorkspaceAgent(r)
+
+	key := chi.URLParam(r, "key")
+
+	err := api.workspaceAgentUpdateMetadata(ctx, workspaceAgent, agentsdk.PostMetadataRequest{
+		Metadata: []agentsdk.Metadata{
+			{
+				Key:                          key,
+				WorkspaceAgentMetadataResult: req,
+			},
+		},
+	})
+	if err != nil {
+		api.Logger.Error(ctx, "failed to handle metadata request", slog.Error(err))
+		httpapi.InternalServerError(rw, err)
+		return
+	}
+
+	httpapi.Write(ctx, rw, http.StatusNoContent, nil)
+}
diff --git a/coderd/devtunnel/servers.go b/coderd/devtunnel/servers.go
index 1ac1b6ce26a7c..db909d2e1db0e 100644
--- a/coderd/devtunnel/servers.go
+++ b/coderd/devtunnel/servers.go
@@ -10,7 +10,8 @@ import (
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 type Region struct {
@@ -115,8 +116,8 @@ func FindClosestNode(nodes []Node) (Node, error) {
 		return Node{}, err
 	}
 
-	slices.SortFunc(nodes, func(i, j Node) bool {
-		return i.AvgLatency < j.AvgLatency
+	slices.SortFunc(nodes, func(a, b Node) int {
+		return slice.Ascending(a.AvgLatency, b.AvgLatency)
 	})
 	return nodes[0], nil
 }
diff --git a/coderd/devtunnel/tunnel.go b/coderd/devtunnel/tunnel.go
index 11bbc7dad6bee..89ceace6e4849 100644
--- a/coderd/devtunnel/tunnel.go
+++ b/coderd/devtunnel/tunnel.go
@@ -15,8 +15,9 @@ import (
 	"golang.zx2c4.com/wireguard/device"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/pretty"
 	"github.com/coder/wgtunnel/tunnelsdk"
 )
 
@@ -114,8 +115,8 @@ func readOrGenerateConfig(customTunnelHost string) (Config, error) {
 
 	if cfg.Version == 0 {
 		_, _ = fmt.Println()
-		_, _ = fmt.Println(cliui.DefaultStyles.Error.Render("You're running a deprecated tunnel version!"))
-		_, _ = fmt.Println(cliui.DefaultStyles.Error.Render("Upgrading you to the new version now. You will need to rebuild running workspaces."))
+		pretty.Printf(cliui.DefaultStyles.Error, "You're running a deprecated tunnel version.\n")
+		pretty.Printf(cliui.DefaultStyles.Error, "Upgrading you to the new version now. You will need to rebuild running workspaces.")
 		_, _ = fmt.Println()
 
 		cfg, err := GenerateConfig(customTunnelHost)
@@ -172,8 +173,8 @@ func GenerateConfig(customTunnelHost string) (Config, error) {
 
 	spin.Stop()
 	_, _ = fmt.Printf("Using tunnel in %s with latency %s.\n",
-		cliui.DefaultStyles.Keyword.Render(locationName),
-		cliui.DefaultStyles.Code.Render(node.AvgLatency.String()),
+		cliui.Keyword(locationName),
+		cliui.Code(node.AvgLatency.String()),
 	)
 
 	return Config{
diff --git a/coderd/devtunnel/tunnel_test.go b/coderd/devtunnel/tunnel_test.go
index a389001523375..a1a7c3b7642fb 100644
--- a/coderd/devtunnel/tunnel_test.go
+++ b/coderd/devtunnel/tunnel_test.go
@@ -22,8 +22,8 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/devtunnel"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/devtunnel"
+	"github.com/coder/coder/v2/testutil"
 	"github.com/coder/wgtunnel/tunneld"
 	"github.com/coder/wgtunnel/tunnelsdk"
 )
@@ -189,23 +189,34 @@ func newTunnelServer(t *testing.T) *tunnelServer {
 	require.Equal(t, "https", baseURLParsed.Scheme)
 	baseURLParsed.Host = net.JoinHostPort("tunnel.coder.com", baseURLParsed.Port())
 
-	wireguardPort := freeUDPPort(t)
-
 	key, err := tunnelsdk.GeneratePrivateKey()
 	require.NoError(t, err)
 
-	options := &tunneld.Options{
-		BaseURL:                baseURLParsed,
-		WireguardEndpoint:      fmt.Sprintf("127.0.0.1:%d", wireguardPort),
-		WireguardPort:          wireguardPort,
-		WireguardKey:           key,
-		WireguardMTU:           tunneld.DefaultWireguardMTU,
-		WireguardServerIP:      tunneld.DefaultWireguardServerIP,
-		WireguardNetworkPrefix: tunneld.DefaultWireguardNetworkPrefix,
-	}
+	// Sadly the tunnel server needs to be passed a port number and can't be
+	// passed an active listener (because wireguard needs to make the listener),
+	// so we may need to try a few times to get a free port.
+	var td *tunneld.API
+	for i := 0; i < 10; i++ {
+		wireguardPort := freeUDPPort(t)
+		options := &tunneld.Options{
+			BaseURL:                baseURLParsed,
+			WireguardEndpoint:      fmt.Sprintf("127.0.0.1:%d", wireguardPort),
+			WireguardPort:          wireguardPort,
+			WireguardKey:           key,
+			WireguardMTU:           tunneld.DefaultWireguardMTU,
+			WireguardServerIP:      tunneld.DefaultWireguardServerIP,
+			WireguardNetworkPrefix: tunneld.DefaultWireguardNetworkPrefix,
+		}
 
-	td, err := tunneld.New(options)
-	require.NoError(t, err)
+		td, err = tunneld.New(options)
+		if err == nil {
+			break
+		}
+		t.Logf("failed to create tunnel server on port %d: %s", wireguardPort, err)
+	}
+	if td == nil {
+		t.Fatal("failed to create tunnel server in 10 attempts")
+	}
 	handler = td.Router()
 	t.Cleanup(func() {
 		_ = td.Close()
diff --git a/coderd/experiments.go b/coderd/experiments.go
index 651ae3155c369..f7debd8c68bbb 100644
--- a/coderd/experiments.go
+++ b/coderd/experiments.go
@@ -3,11 +3,12 @@ package coderd
 import (
 	"net/http"
 
-	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
-// @Summary Get experiments
-// @ID get-experiments
+// @Summary Get enabled experiments
+// @ID get-enabled-experiments
 // @Security CoderSessionToken
 // @Produce json
 // @Tags General
@@ -17,3 +18,17 @@ func (api *API) handleExperimentsGet(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	httpapi.Write(ctx, rw, http.StatusOK, api.Experiments)
 }
+
+// @Summary Get safe experiments
+// @ID get-safe-experiments
+// @Security CoderSessionToken
+// @Produce json
+// @Tags General
+// @Success 200 {array} codersdk.Experiment
+// @Router /experiments/available [get]
+func handleExperimentsSafe(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	httpapi.Write(ctx, rw, http.StatusOK, codersdk.AvailableExperiments{
+		Safe: codersdk.ExperimentsAll,
+	})
+}
diff --git a/coderd/experiments_test.go b/coderd/experiments_test.go
index 5526d8324d7e3..4288b9953fec6 100644
--- a/coderd/experiments_test.go
+++ b/coderd/experiments_test.go
@@ -6,10 +6,10 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func Test_Experiments(t *testing.T) {
@@ -116,4 +116,21 @@ func Test_Experiments(t *testing.T) {
 		require.Error(t, err)
 		require.ErrorContains(t, err, httpmw.SignedOutErrorMessage)
 	})
+
+	t.Run("available experiments", func(t *testing.T) {
+		t.Parallel()
+		cfg := coderdtest.DeploymentValues(t)
+		client := coderdtest.New(t, &coderdtest.Options{
+			DeploymentValues: cfg,
+		})
+		_ = coderdtest.CreateFirstUser(t, client)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		experiments, err := client.SafeExperiments(ctx)
+		require.NoError(t, err)
+		require.NotNil(t, experiments)
+		require.ElementsMatch(t, codersdk.ExperimentsAll, experiments.Safe)
+	})
 }
diff --git a/coderd/externalauth.go b/coderd/externalauth.go
new file mode 100644
index 0000000000000..b1b7acc8bc449
--- /dev/null
+++ b/coderd/externalauth.go
@@ -0,0 +1,277 @@
+package coderd
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/sqlc-dev/pqtype"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+// @Summary Get external auth by ID
+// @ID get-external-auth-by-id
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Git
+// @Param externalauth path string true "Git Provider ID" format(string)
+// @Success 200 {object} codersdk.ExternalAuth
+// @Router /external-auth/{externalauth} [get]
+func (api *API) externalAuthByID(w http.ResponseWriter, r *http.Request) {
+	config := httpmw.ExternalAuthParam(r)
+	apiKey := httpmw.APIKey(r)
+	ctx := r.Context()
+
+	res := codersdk.ExternalAuth{
+		Authenticated:    false,
+		Device:           config.DeviceAuth != nil,
+		AppInstallURL:    config.AppInstallURL,
+		DisplayName:      config.DisplayName,
+		AppInstallations: []codersdk.ExternalAuthAppInstallation{},
+	}
+
+	link, err := api.Database.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
+		ProviderID: config.ID,
+		UserID:     apiKey.UserID,
+	})
+	if err != nil {
+		if !errors.Is(err, sql.ErrNoRows) {
+			httpapi.Write(ctx, w, http.StatusInternalServerError, codersdk.Response{
+				Message: "Failed to get external auth link.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+
+		httpapi.Write(ctx, w, http.StatusOK, res)
+		return
+	}
+	var eg errgroup.Group
+	eg.Go(func() (err error) {
+		res.Authenticated, res.User, err = config.ValidateToken(ctx, link.OAuthAccessToken)
+		return err
+	})
+	eg.Go(func() (err error) {
+		res.AppInstallations, res.AppInstallable, err = config.AppInstallations(ctx, link.OAuthAccessToken)
+		return err
+	})
+	err = eg.Wait()
+	if err != nil {
+		httpapi.Write(ctx, w, http.StatusInternalServerError, codersdk.Response{
+			Message: "Failed to validate token.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+	if res.AppInstallations == nil {
+		res.AppInstallations = []codersdk.ExternalAuthAppInstallation{}
+	}
+	httpapi.Write(ctx, w, http.StatusOK, res)
+}
+
+// @Summary Post external auth device by ID
+// @ID post-external-auth-device-by-id
+// @Security CoderSessionToken
+// @Tags Git
+// @Param externalauth path string true "External Provider ID" format(string)
+// @Success 204
+// @Router /external-auth/{externalauth}/device [post]
+func (api *API) postExternalAuthDeviceByID(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	apiKey := httpmw.APIKey(r)
+	config := httpmw.ExternalAuthParam(r)
+
+	var req codersdk.ExternalAuthDeviceExchange
+	if !httpapi.Read(ctx, rw, r, &req) {
+		return
+	}
+
+	if config.DeviceAuth == nil {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "Git auth provider does not support device flow.",
+		})
+		return
+	}
+
+	token, err := config.DeviceAuth.ExchangeDeviceCode(ctx, req.DeviceCode)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "Failed to exchange device code.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	_, err = api.Database.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
+		ProviderID: config.ID,
+		UserID:     apiKey.UserID,
+	})
+	if err != nil {
+		if !errors.Is(err, sql.ErrNoRows) {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Failed to get external auth link.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+
+		_, err = api.Database.InsertExternalAuthLink(ctx, database.InsertExternalAuthLinkParams{
+			ProviderID:             config.ID,
+			UserID:                 apiKey.UserID,
+			CreatedAt:              dbtime.Now(),
+			UpdatedAt:              dbtime.Now(),
+			OAuthAccessToken:       token.AccessToken,
+			OAuthAccessTokenKeyID:  sql.NullString{}, // dbcrypt will set as required
+			OAuthRefreshToken:      token.RefreshToken,
+			OAuthRefreshTokenKeyID: sql.NullString{}, // dbcrypt will set as required
+			OAuthExpiry:            token.Expiry,
+			// No extra data from device auth!
+			OAuthExtra: pqtype.NullRawMessage{},
+		})
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Failed to insert external auth link.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+	} else {
+		_, err = api.Database.UpdateExternalAuthLink(ctx, database.UpdateExternalAuthLinkParams{
+			ProviderID:             config.ID,
+			UserID:                 apiKey.UserID,
+			UpdatedAt:              dbtime.Now(),
+			OAuthAccessToken:       token.AccessToken,
+			OAuthAccessTokenKeyID:  sql.NullString{}, // dbcrypt will update as required
+			OAuthRefreshToken:      token.RefreshToken,
+			OAuthRefreshTokenKeyID: sql.NullString{}, // dbcrypt will update as required
+			OAuthExpiry:            token.Expiry,
+			OAuthExtra:             pqtype.NullRawMessage{},
+		})
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Failed to update external auth link.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+	}
+	httpapi.Write(ctx, rw, http.StatusNoContent, nil)
+}
+
+// @Summary Get external auth device by ID.
+// @ID get-external-auth-device-by-id
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Git
+// @Param externalauth path string true "Git Provider ID" format(string)
+// @Success 200 {object} codersdk.ExternalAuthDevice
+// @Router /external-auth/{externalauth}/device [get]
+func (*API) externalAuthDeviceByID(rw http.ResponseWriter, r *http.Request) {
+	config := httpmw.ExternalAuthParam(r)
+	ctx := r.Context()
+
+	if config.DeviceAuth == nil {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "Git auth device flow not supported.",
+		})
+		return
+	}
+
+	deviceAuth, err := config.DeviceAuth.AuthorizeDevice(r.Context())
+	if err != nil {
+		httpapi.Write(r.Context(), rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Failed to authorize device.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	httpapi.Write(ctx, rw, http.StatusOK, deviceAuth)
+}
+
+func (api *API) externalAuthCallback(externalAuthConfig *externalauth.Config) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		var (
+			ctx    = r.Context()
+			state  = httpmw.OAuth2(r)
+			apiKey = httpmw.APIKey(r)
+		)
+
+		extra, err := externalAuthConfig.GenerateTokenExtra(state.Token)
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Failed to generate token extra.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+		_, err = api.Database.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
+			ProviderID: externalAuthConfig.ID,
+			UserID:     apiKey.UserID,
+		})
+		if err != nil {
+			if !errors.Is(err, sql.ErrNoRows) {
+				httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+					Message: "Failed to get external auth link.",
+					Detail:  err.Error(),
+				})
+				return
+			}
+
+			_, err = api.Database.InsertExternalAuthLink(ctx, database.InsertExternalAuthLinkParams{
+				ProviderID:             externalAuthConfig.ID,
+				UserID:                 apiKey.UserID,
+				CreatedAt:              dbtime.Now(),
+				UpdatedAt:              dbtime.Now(),
+				OAuthAccessToken:       state.Token.AccessToken,
+				OAuthAccessTokenKeyID:  sql.NullString{}, // dbcrypt will set as required
+				OAuthRefreshToken:      state.Token.RefreshToken,
+				OAuthRefreshTokenKeyID: sql.NullString{}, // dbcrypt will set as required
+				OAuthExpiry:            state.Token.Expiry,
+				OAuthExtra:             extra,
+			})
+			if err != nil {
+				httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+					Message: "Failed to insert external auth link.",
+					Detail:  err.Error(),
+				})
+				return
+			}
+		} else {
+			_, err = api.Database.UpdateExternalAuthLink(ctx, database.UpdateExternalAuthLinkParams{
+				ProviderID:             externalAuthConfig.ID,
+				UserID:                 apiKey.UserID,
+				UpdatedAt:              dbtime.Now(),
+				OAuthAccessToken:       state.Token.AccessToken,
+				OAuthAccessTokenKeyID:  sql.NullString{}, // dbcrypt will update as required
+				OAuthRefreshToken:      state.Token.RefreshToken,
+				OAuthRefreshTokenKeyID: sql.NullString{}, // dbcrypt will update as required
+				OAuthExpiry:            state.Token.Expiry,
+				OAuthExtra:             extra,
+			})
+			if err != nil {
+				httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+					Message: "Failed to update external auth link.",
+					Detail:  err.Error(),
+				})
+				return
+			}
+		}
+
+		redirect := state.Redirect
+		if redirect == "" {
+			// This is a nicely rendered screen on the frontend. Passing the query param lets the
+			// FE know not to enter the authentication loop again, and instead display an error.
+			redirect = fmt.Sprintf("/external-auth/%s?redirected=true", externalAuthConfig.ID)
+		}
+		http.Redirect(rw, r, redirect, http.StatusTemporaryRedirect)
+	}
+}
diff --git a/coderd/externalauth/externalauth.go b/coderd/externalauth/externalauth.go
new file mode 100644
index 0000000000000..8802b5d5f6108
--- /dev/null
+++ b/coderd/externalauth/externalauth.go
@@ -0,0 +1,621 @@
+package externalauth
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"time"
+
+	"golang.org/x/oauth2"
+	"golang.org/x/xerrors"
+
+	"github.com/google/go-github/v43/github"
+	"github.com/sqlc-dev/pqtype"
+	xgithub "golang.org/x/oauth2/github"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/retry"
+)
+
+type OAuth2Config interface {
+	AuthCodeURL(state string, opts ...oauth2.AuthCodeOption) string
+	Exchange(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error)
+	TokenSource(context.Context, *oauth2.Token) oauth2.TokenSource
+}
+
+// Config is used for authentication for Git operations.
+type Config struct {
+	OAuth2Config
+	// ID is a unique identifier for the authenticator.
+	ID string
+	// Type is the type of provider.
+	Type string
+	// DeviceAuth is set if the provider uses the device flow.
+	DeviceAuth *DeviceAuth
+	// DisplayName is the name of the provider to display to the user.
+	DisplayName string
+	// DisplayIcon is the path to an image that will be displayed to the user.
+	DisplayIcon string
+
+	// ExtraTokenKeys is a list of extra properties to
+	// store in the database returned from the token endpoint.
+	//
+	// e.g. Slack returns `authed_user` in the token which is
+	// a payload that contains information about the authenticated
+	// user.
+	ExtraTokenKeys []string
+
+	// NoRefresh stops Coder from using the refresh token
+	// to renew the access token.
+	//
+	// Some organizations have security policies that require
+	// re-authentication for every token.
+	NoRefresh bool
+	// ValidateURL ensures an access token is valid before
+	// returning it to the user. If omitted, tokens will
+	// not be validated before being returned.
+	ValidateURL string
+
+	// Regex is a Regexp matched against URLs for
+	// a Git clone. e.g. "Username for 'https://github.com':"
+	// The regex would be `github\.com`..
+	Regex *regexp.Regexp
+	// AppInstallURL is for GitHub App's (and hopefully others eventually)
+	// to provide a link to install the app. There's installation
+	// of the application, and user authentication. It's possible
+	// for the user to authenticate but the application to not.
+	AppInstallURL string
+	// AppInstallationsURL is an API endpoint that returns a list of
+	// installations for the user. This is used for GitHub Apps.
+	AppInstallationsURL string
+}
+
+// GenerateTokenExtra generates the extra token data to store in the database.
+func (c *Config) GenerateTokenExtra(token *oauth2.Token) (pqtype.NullRawMessage, error) {
+	if len(c.ExtraTokenKeys) == 0 {
+		return pqtype.NullRawMessage{}, nil
+	}
+	extraMap := map[string]interface{}{}
+	for _, key := range c.ExtraTokenKeys {
+		extraMap[key] = token.Extra(key)
+	}
+	data, err := json.Marshal(extraMap)
+	if err != nil {
+		return pqtype.NullRawMessage{}, err
+	}
+	return pqtype.NullRawMessage{
+		RawMessage: data,
+		Valid:      true,
+	}, nil
+}
+
+// RefreshToken automatically refreshes the token if expired and permitted.
+// It returns the token and a bool indicating if the token is valid.
+func (c *Config) RefreshToken(ctx context.Context, db database.Store, externalAuthLink database.ExternalAuthLink) (database.ExternalAuthLink, bool, error) {
+	// If the token is expired and refresh is disabled, we prompt
+	// the user to authenticate again.
+	if c.NoRefresh &&
+		// If the time is set to 0, then it should never expire.
+		// This is true for github, which has no expiry.
+		!externalAuthLink.OAuthExpiry.IsZero() &&
+		externalAuthLink.OAuthExpiry.Before(dbtime.Now()) {
+		return externalAuthLink, false, nil
+	}
+
+	// This is additional defensive programming. Because TokenSource is an interface,
+	// we cannot be sure that the implementation will treat an 'IsZero' time
+	// as "not-expired". The default implementation does, but a custom implementation
+	// might not. Removing the refreshToken will guarantee a refresh will fail.
+	refreshToken := externalAuthLink.OAuthRefreshToken
+	if c.NoRefresh {
+		refreshToken = ""
+	}
+
+	token, err := c.TokenSource(ctx, &oauth2.Token{
+		AccessToken:  externalAuthLink.OAuthAccessToken,
+		RefreshToken: refreshToken,
+		Expiry:       externalAuthLink.OAuthExpiry,
+	}).Token()
+	if err != nil {
+		// Even if the token fails to be obtained, we still return false because
+		// we aren't trying to surface an error, we're just trying to obtain a valid token.
+		return externalAuthLink, false, nil
+	}
+
+	extra, err := c.GenerateTokenExtra(token)
+	if err != nil {
+		return externalAuthLink, false, xerrors.Errorf("generate token extra: %w", err)
+	}
+
+	r := retry.New(50*time.Millisecond, 200*time.Millisecond)
+	// See the comment below why the retry and cancel is required.
+	retryCtx, retryCtxCancel := context.WithTimeout(ctx, time.Second)
+	defer retryCtxCancel()
+validate:
+	valid, _, err := c.ValidateToken(ctx, token.AccessToken)
+	if err != nil {
+		return externalAuthLink, false, xerrors.Errorf("validate external auth token: %w", err)
+	}
+	if !valid {
+		// A customer using GitHub in Australia reported that validating immediately
+		// after refreshing the token would intermittently fail with a 401. Waiting
+		// a few milliseconds with the exact same token on the exact same request
+		// would resolve the issue. It seems likely that the write is not propagating
+		// to the read replica in time.
+		//
+		// We do an exponential backoff here to give the write time to propagate.
+		if c.Type == string(codersdk.EnhancedExternalAuthProviderGitHub) && r.Wait(retryCtx) {
+			goto validate
+		}
+		// The token is no longer valid!
+		return externalAuthLink, false, nil
+	}
+
+	if token.AccessToken != externalAuthLink.OAuthAccessToken {
+		updatedAuthLink, err := db.UpdateExternalAuthLink(ctx, database.UpdateExternalAuthLinkParams{
+			ProviderID:             c.ID,
+			UserID:                 externalAuthLink.UserID,
+			UpdatedAt:              dbtime.Now(),
+			OAuthAccessToken:       token.AccessToken,
+			OAuthAccessTokenKeyID:  sql.NullString{}, // dbcrypt will update as required
+			OAuthRefreshToken:      token.RefreshToken,
+			OAuthRefreshTokenKeyID: sql.NullString{}, // dbcrypt will update as required
+			OAuthExpiry:            token.Expiry,
+			OAuthExtra:             extra,
+		})
+		if err != nil {
+			return updatedAuthLink, false, xerrors.Errorf("update external auth link: %w", err)
+		}
+		externalAuthLink = updatedAuthLink
+	}
+	return externalAuthLink, true, nil
+}
+
+// ValidateToken ensures the Git token provided is valid!
+// The user is optionally returned if the provider supports it.
+func (c *Config) ValidateToken(ctx context.Context, token string) (bool, *codersdk.ExternalAuthUser, error) {
+	if c.ValidateURL == "" {
+		// Default that the token is valid if no validation URL is provided.
+		return true, nil, nil
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.ValidateURL, nil)
+	if err != nil {
+		return false, nil, err
+	}
+
+	cli := http.DefaultClient
+	if v, ok := ctx.Value(oauth2.HTTPClient).(*http.Client); ok {
+		cli = v
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
+	res, err := cli.Do(req)
+	if err != nil {
+		return false, nil, err
+	}
+	defer res.Body.Close()
+	if res.StatusCode == http.StatusUnauthorized {
+		// The token is no longer valid!
+		return false, nil, nil
+	}
+	if res.StatusCode != http.StatusOK {
+		data, _ := io.ReadAll(res.Body)
+		return false, nil, xerrors.Errorf("status %d: body: %s", res.StatusCode, data)
+	}
+
+	var user *codersdk.ExternalAuthUser
+	if c.Type == string(codersdk.EnhancedExternalAuthProviderGitHub) {
+		var ghUser github.User
+		err = json.NewDecoder(res.Body).Decode(&ghUser)
+		if err == nil {
+			user = &codersdk.ExternalAuthUser{
+				Login:      ghUser.GetLogin(),
+				AvatarURL:  ghUser.GetAvatarURL(),
+				ProfileURL: ghUser.GetHTMLURL(),
+				Name:       ghUser.GetName(),
+			}
+		}
+	}
+
+	return true, user, nil
+}
+
+type AppInstallation struct {
+	ID int
+	// Login is the username of the installation.
+	Login string
+	// URL is a link to configure the app install.
+	URL string
+}
+
+// AppInstallations returns a list of app installations for the given token.
+// If the provider does not support app installations, it returns nil.
+func (c *Config) AppInstallations(ctx context.Context, token string) ([]codersdk.ExternalAuthAppInstallation, bool, error) {
+	if c.AppInstallationsURL == "" {
+		return nil, false, nil
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.AppInstallationsURL, nil)
+	if err != nil {
+		return nil, false, err
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
+	res, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, false, err
+	}
+	defer res.Body.Close()
+	// It's possible the installation URL is misconfigured, so we don't
+	// want to return an error here.
+	if res.StatusCode != http.StatusOK {
+		return nil, false, nil
+	}
+	installs := []codersdk.ExternalAuthAppInstallation{}
+	if c.Type == string(codersdk.EnhancedExternalAuthProviderGitHub) {
+		var ghInstalls struct {
+			Installations []*github.Installation `json:"installations"`
+		}
+		err = json.NewDecoder(res.Body).Decode(&ghInstalls)
+		if err != nil {
+			return nil, false, err
+		}
+		for _, installation := range ghInstalls.Installations {
+			account := installation.GetAccount()
+			if account == nil {
+				continue
+			}
+			installs = append(installs, codersdk.ExternalAuthAppInstallation{
+				ID:           int(installation.GetID()),
+				ConfigureURL: installation.GetHTMLURL(),
+				Account: codersdk.ExternalAuthUser{
+					Login:      account.GetLogin(),
+					AvatarURL:  account.GetAvatarURL(),
+					ProfileURL: account.GetHTMLURL(),
+					Name:       account.GetName(),
+				},
+			})
+		}
+	}
+	return installs, true, nil
+}
+
+type DeviceAuth struct {
+	ClientID string
+	TokenURL string
+	Scopes   []string
+	CodeURL  string
+}
+
+// AuthorizeDevice begins the device authorization flow.
+// See: https://tools.ietf.org/html/rfc8628#section-3.1
+func (c *DeviceAuth) AuthorizeDevice(ctx context.Context) (*codersdk.ExternalAuthDevice, error) {
+	if c.CodeURL == "" {
+		return nil, xerrors.New("oauth2: device code URL not set")
+	}
+	codeURL, err := c.formatDeviceCodeURL()
+	if err != nil {
+		return nil, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, codeURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Accept", "application/json")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	var r struct {
+		codersdk.ExternalAuthDevice
+		ErrorDescription string `json:"error_description"`
+	}
+	err = json.NewDecoder(resp.Body).Decode(&r)
+	if err != nil {
+		return nil, err
+	}
+	if r.ErrorDescription != "" {
+		return nil, xerrors.New(r.ErrorDescription)
+	}
+	return &r.ExternalAuthDevice, nil
+}
+
+type ExchangeDeviceCodeResponse struct {
+	AccessToken      string `json:"access_token"`
+	RefreshToken     string `json:"refresh_token"`
+	ExpiresIn        int    `json:"expires_in"`
+	Error            string `json:"error"`
+	ErrorDescription string `json:"error_description"`
+}
+
+// ExchangeDeviceCode exchanges a device code for an access token.
+// The boolean returned indicates whether the device code is still pending
+// and the caller should try again.
+func (c *DeviceAuth) ExchangeDeviceCode(ctx context.Context, deviceCode string) (*oauth2.Token, error) {
+	if c.TokenURL == "" {
+		return nil, xerrors.New("oauth2: token URL not set")
+	}
+	tokenURL, err := c.formatDeviceTokenURL(deviceCode)
+	if err != nil {
+		return nil, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, tokenURL, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Accept", "application/json")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, codersdk.ReadBodyAsError(resp)
+	}
+	var body ExchangeDeviceCodeResponse
+	err = json.NewDecoder(resp.Body).Decode(&body)
+	if err != nil {
+		return nil, err
+	}
+	if body.Error != "" {
+		return nil, xerrors.New(body.Error)
+	}
+	return &oauth2.Token{
+		AccessToken:  body.AccessToken,
+		RefreshToken: body.RefreshToken,
+		Expiry:       dbtime.Now().Add(time.Duration(body.ExpiresIn) * time.Second),
+	}, nil
+}
+
+func (c *DeviceAuth) formatDeviceTokenURL(deviceCode string) (string, error) {
+	tok, err := url.Parse(c.TokenURL)
+	if err != nil {
+		return "", err
+	}
+	tok.RawQuery = url.Values{
+		"client_id":   {c.ClientID},
+		"device_code": {deviceCode},
+		"grant_type":  {"urn:ietf:params:oauth:grant-type:device_code"},
+	}.Encode()
+	return tok.String(), nil
+}
+
+func (c *DeviceAuth) formatDeviceCodeURL() (string, error) {
+	cod, err := url.Parse(c.CodeURL)
+	if err != nil {
+		return "", err
+	}
+	cod.RawQuery = url.Values{
+		"client_id": {c.ClientID},
+		"scope":     c.Scopes,
+	}.Encode()
+	return cod.String(), nil
+}
+
+// ConvertConfig converts the SDK configuration entry format
+// to the parsed and ready-to-consume in coderd provider type.
+func ConvertConfig(entries []codersdk.ExternalAuthConfig, accessURL *url.URL) ([]*Config, error) {
+	ids := map[string]struct{}{}
+	configs := []*Config{}
+	for _, entry := range entries {
+		entry := entry
+
+		// Applies defaults to the config entry.
+		// This allows users to very simply state that they type is "GitHub",
+		// apply their client secret and ID, and have the UI appear nicely.
+		applyDefaultsToConfig(&entry)
+
+		valid := httpapi.NameValid(entry.ID)
+		if valid != nil {
+			return nil, xerrors.Errorf("external auth provider %q doesn't have a valid id: %w", entry.ID, valid)
+		}
+		if entry.ClientID == "" {
+			return nil, xerrors.Errorf("%q external auth provider: client_id must be provided", entry.ID)
+		}
+
+		_, exists := ids[entry.ID]
+		if exists {
+			if entry.ID == entry.Type {
+				return nil, xerrors.Errorf("multiple %s external auth providers provided. you must specify a unique id for each", entry.Type)
+			}
+			return nil, xerrors.Errorf("multiple external auth providers exist with the id %q. specify a unique id for each", entry.ID)
+		}
+		ids[entry.ID] = struct{}{}
+
+		authRedirect, err := accessURL.Parse(fmt.Sprintf("/external-auth/%s/callback", entry.ID))
+		if err != nil {
+			return nil, xerrors.Errorf("parse external auth callback url: %w", err)
+		}
+
+		var regex *regexp.Regexp
+		if entry.Regex != "" {
+			regex, err = regexp.Compile(entry.Regex)
+			if err != nil {
+				return nil, xerrors.Errorf("compile regex for external auth provider %q: %w", entry.ID, entry.Regex)
+			}
+		}
+
+		oc := &oauth2.Config{
+			ClientID:     entry.ClientID,
+			ClientSecret: entry.ClientSecret,
+			Endpoint: oauth2.Endpoint{
+				AuthURL:  entry.AuthURL,
+				TokenURL: entry.TokenURL,
+			},
+			RedirectURL: authRedirect.String(),
+			Scopes:      entry.Scopes,
+		}
+
+		var oauthConfig OAuth2Config = oc
+		// Azure DevOps uses JWT token authentication!
+		if entry.Type == string(codersdk.EnhancedExternalAuthProviderAzureDevops) {
+			oauthConfig = &jwtConfig{oc}
+		}
+
+		cfg := &Config{
+			OAuth2Config:        oauthConfig,
+			ID:                  entry.ID,
+			Regex:               regex,
+			Type:                entry.Type,
+			NoRefresh:           entry.NoRefresh,
+			ValidateURL:         entry.ValidateURL,
+			AppInstallationsURL: entry.AppInstallationsURL,
+			AppInstallURL:       entry.AppInstallURL,
+			DisplayName:         entry.DisplayName,
+			DisplayIcon:         entry.DisplayIcon,
+			ExtraTokenKeys:      entry.ExtraTokenKeys,
+		}
+
+		if entry.DeviceFlow {
+			if entry.DeviceCodeURL == "" {
+				return nil, xerrors.Errorf("external auth provider %q: device auth url must be provided", entry.ID)
+			}
+			cfg.DeviceAuth = &DeviceAuth{
+				ClientID: entry.ClientID,
+				TokenURL: oc.Endpoint.TokenURL,
+				Scopes:   entry.Scopes,
+				CodeURL:  entry.DeviceCodeURL,
+			}
+		}
+
+		configs = append(configs, cfg)
+	}
+	return configs, nil
+}
+
+// applyDefaultsToConfig applies defaults to the config entry.
+func applyDefaultsToConfig(config *codersdk.ExternalAuthConfig) {
+	defaults := defaults[codersdk.EnhancedExternalAuthProvider(config.Type)]
+	if config.AuthURL == "" {
+		config.AuthURL = defaults.AuthURL
+	}
+	if config.TokenURL == "" {
+		config.TokenURL = defaults.TokenURL
+	}
+	if config.ValidateURL == "" {
+		config.ValidateURL = defaults.ValidateURL
+	}
+	if config.AppInstallURL == "" {
+		config.AppInstallURL = defaults.AppInstallURL
+	}
+	if config.AppInstallationsURL == "" {
+		config.AppInstallationsURL = defaults.AppInstallationsURL
+	}
+	if config.Regex == "" {
+		config.Regex = defaults.Regex
+	}
+	if config.Scopes == nil || len(config.Scopes) == 0 {
+		config.Scopes = defaults.Scopes
+	}
+	if config.DeviceCodeURL == "" {
+		config.DeviceCodeURL = defaults.DeviceCodeURL
+	}
+	if config.DisplayName == "" {
+		config.DisplayName = defaults.DisplayName
+	}
+	if config.DisplayIcon == "" {
+		config.DisplayIcon = defaults.DisplayIcon
+	}
+	if config.ExtraTokenKeys == nil || len(config.ExtraTokenKeys) == 0 {
+		config.ExtraTokenKeys = defaults.ExtraTokenKeys
+	}
+
+	// Apply defaults if it's still empty...
+	if config.ID == "" {
+		config.ID = config.Type
+	}
+	if config.DisplayName == "" {
+		config.DisplayName = config.Type
+	}
+	if config.DisplayIcon == "" {
+		// This is a key emoji.
+		config.DisplayIcon = "/emojis/1f511.png"
+	}
+}
+
+var defaults = map[codersdk.EnhancedExternalAuthProvider]codersdk.ExternalAuthConfig{
+	codersdk.EnhancedExternalAuthProviderAzureDevops: {
+		AuthURL:     "https://app.vssps.visualstudio.com/oauth2/authorize",
+		TokenURL:    "https://app.vssps.visualstudio.com/oauth2/token",
+		DisplayName: "Azure DevOps",
+		DisplayIcon: "/icon/azure-devops.svg",
+		Regex:       `^(https?://)?dev\.azure\.com(/.*)?$`,
+		Scopes:      []string{"vso.code_write"},
+	},
+	codersdk.EnhancedExternalAuthProviderBitBucket: {
+		AuthURL:     "https://bitbucket.org/site/oauth2/authorize",
+		TokenURL:    "https://bitbucket.org/site/oauth2/access_token",
+		ValidateURL: "https://api.bitbucket.org/2.0/user",
+		DisplayName: "BitBucket",
+		DisplayIcon: "/icon/bitbucket.svg",
+		Regex:       `^(https?://)?bitbucket\.org(/.*)?$`,
+		Scopes:      []string{"account", "repository:write"},
+	},
+	codersdk.EnhancedExternalAuthProviderGitLab: {
+		AuthURL:     "https://gitlab.com/oauth/authorize",
+		TokenURL:    "https://gitlab.com/oauth/token",
+		ValidateURL: "https://gitlab.com/oauth/token/info",
+		DisplayName: "GitLab",
+		DisplayIcon: "/icon/gitlab.svg",
+		Regex:       `^(https?://)?gitlab\.com(/.*)?$`,
+		Scopes:      []string{"write_repository"},
+	},
+	codersdk.EnhancedExternalAuthProviderGitHub: {
+		AuthURL:     xgithub.Endpoint.AuthURL,
+		TokenURL:    xgithub.Endpoint.TokenURL,
+		ValidateURL: "https://api.github.com/user",
+		DisplayName: "GitHub",
+		DisplayIcon: "/icon/github.svg",
+		Regex:       `^(https?://)?github\.com(/.*)?$`,
+		// "workflow" is required for managing GitHub Actions in a repository.
+		Scopes:              []string{"repo", "workflow"},
+		DeviceCodeURL:       "https://github.com/login/device/code",
+		AppInstallationsURL: "https://api.github.com/user/installations",
+	},
+	codersdk.EnhancedExternalAuthProviderSlack: {
+		AuthURL:     "https://slack.com/oauth/v2/authorize",
+		TokenURL:    "https://slack.com/api/oauth.v2.access",
+		DisplayName: "Slack",
+		DisplayIcon: "/icon/slack.svg",
+		// See: https://api.slack.com/authentication/oauth-v2#exchanging
+		ExtraTokenKeys: []string{"authed_user"},
+	},
+}
+
+// jwtConfig is a new OAuth2 config that uses a custom
+// assertion method that works with Azure Devops. See:
+// https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops
+type jwtConfig struct {
+	*oauth2.Config
+}
+
+func (c *jwtConfig) AuthCodeURL(state string, opts ...oauth2.AuthCodeOption) string {
+	return c.Config.AuthCodeURL(state, append(opts, oauth2.SetAuthURLParam("response_type", "Assertion"))...)
+}
+
+func (c *jwtConfig) Exchange(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error) {
+	v := url.Values{
+		"client_assertion_type": {},
+		"client_assertion":      {c.ClientSecret},
+		"assertion":             {code},
+		"grant_type":            {},
+	}
+	if c.RedirectURL != "" {
+		v.Set("redirect_uri", c.RedirectURL)
+	}
+	return c.Config.Exchange(ctx, code,
+		append(opts,
+			oauth2.SetAuthURLParam("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),
+			oauth2.SetAuthURLParam("client_assertion", c.ClientSecret),
+			oauth2.SetAuthURLParam("assertion", code),
+			oauth2.SetAuthURLParam("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer"),
+			oauth2.SetAuthURLParam("code", ""),
+		)...,
+	)
+}
diff --git a/coderd/externalauth/externalauth_test.go b/coderd/externalauth/externalauth_test.go
new file mode 100644
index 0000000000000..2108063b91f46
--- /dev/null
+++ b/coderd/externalauth/externalauth_test.go
@@ -0,0 +1,440 @@
+package externalauth_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/coderdtest/oidctest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestRefreshToken(t *testing.T) {
+	t.Parallel()
+	expired := time.Now().Add(time.Hour * -1)
+
+	t.Run("NoRefreshExpired", func(t *testing.T) {
+		t.Parallel()
+		fake, config, link := setupOauth2Test(t, testConfig{
+			FakeIDPOpts: []oidctest.FakeIDPOpt{
+				oidctest.WithRefresh(func(_ string) error {
+					t.Error("refresh on the IDP was called, but NoRefresh was set")
+					return xerrors.New("should not be called")
+				}),
+				// The IDP should not be contacted since the token is expired. An expired
+				// token with 'NoRefresh' should early abort.
+				oidctest.WithDynamicUserInfo(func(_ string) (jwt.MapClaims, error) {
+					t.Error("token was validated, but it was expired and this should never have happened.")
+					return nil, xerrors.New("should not be called")
+				}),
+			},
+			ExternalAuthOpt: func(cfg *externalauth.Config) {
+				cfg.NoRefresh = true
+			},
+		})
+
+		ctx := oidc.ClientContext(context.Background(), fake.HTTPClient(nil))
+		// Expire the link
+		link.OAuthExpiry = expired
+
+		_, refreshed, err := config.RefreshToken(ctx, nil, link)
+		require.NoError(t, err)
+		require.False(t, refreshed)
+	})
+
+	// NoRefreshNoExpiry tests that an oauth token without an expiry is always valid.
+	// The "validate url" should be hit, but the refresh endpoint should not.
+	t.Run("NoRefreshNoExpiry", func(t *testing.T) {
+		t.Parallel()
+
+		validated := false
+		fake, config, link := setupOauth2Test(t, testConfig{
+			FakeIDPOpts: []oidctest.FakeIDPOpt{
+				oidctest.WithRefresh(func(_ string) error {
+					t.Error("refresh on the IDP was called, but NoRefresh was set")
+					return xerrors.New("should not be called")
+				}),
+				oidctest.WithDynamicUserInfo(func(_ string) (jwt.MapClaims, error) {
+					validated = true
+					return jwt.MapClaims{}, nil
+				}),
+			},
+			ExternalAuthOpt: func(cfg *externalauth.Config) {
+				cfg.NoRefresh = true
+			},
+		})
+
+		ctx := oidc.ClientContext(context.Background(), fake.HTTPClient(nil))
+
+		// Zero time used
+		link.OAuthExpiry = time.Time{}
+		_, refreshed, err := config.RefreshToken(ctx, nil, link)
+		require.NoError(t, err)
+		require.True(t, refreshed, "token without expiry is always valid")
+		require.True(t, validated, "token should have been validated")
+	})
+
+	t.Run("FalseIfTokenSourceFails", func(t *testing.T) {
+		t.Parallel()
+		config := &externalauth.Config{
+			OAuth2Config: &testutil.OAuth2Config{
+				TokenSourceFunc: func() (*oauth2.Token, error) {
+					return nil, xerrors.New("failure")
+				},
+			},
+		}
+		_, refreshed, err := config.RefreshToken(context.Background(), nil, database.ExternalAuthLink{
+			OAuthExpiry: expired,
+		})
+		require.NoError(t, err)
+		require.False(t, refreshed)
+	})
+
+	t.Run("ValidateServerError", func(t *testing.T) {
+		t.Parallel()
+
+		const staticError = "static error"
+		validated := false
+		fake, config, link := setupOauth2Test(t, testConfig{
+			FakeIDPOpts: []oidctest.FakeIDPOpt{
+				oidctest.WithDynamicUserInfo(func(_ string) (jwt.MapClaims, error) {
+					validated = true
+					return jwt.MapClaims{}, xerrors.New(staticError)
+				}),
+			},
+			ExternalAuthOpt: func(cfg *externalauth.Config) {
+			},
+		})
+
+		ctx := oidc.ClientContext(context.Background(), fake.HTTPClient(nil))
+		link.OAuthExpiry = expired
+
+		_, _, err := config.RefreshToken(ctx, nil, link)
+		require.ErrorContains(t, err, staticError)
+		require.True(t, validated, "token should have been attempted to be validated")
+	})
+
+	// ValidateFailure tests if the token is no longer valid with a 401 response.
+	t.Run("ValidateFailure", func(t *testing.T) {
+		t.Parallel()
+
+		const staticError = "static error"
+		validated := false
+		fake, config, link := setupOauth2Test(t, testConfig{
+			FakeIDPOpts: []oidctest.FakeIDPOpt{
+				oidctest.WithDynamicUserInfo(func(_ string) (jwt.MapClaims, error) {
+					validated = true
+					return jwt.MapClaims{}, oidctest.StatusError(http.StatusUnauthorized, xerrors.New(staticError))
+				}),
+			},
+			ExternalAuthOpt: func(cfg *externalauth.Config) {
+			},
+		})
+
+		ctx := oidc.ClientContext(context.Background(), fake.HTTPClient(nil))
+		link.OAuthExpiry = expired
+
+		_, refreshed, err := config.RefreshToken(ctx, nil, link)
+		require.NoError(t, err, staticError)
+		require.False(t, refreshed)
+		require.True(t, validated, "token should have been attempted to be validated")
+	})
+
+	t.Run("ValidateRetryGitHub", func(t *testing.T) {
+		t.Parallel()
+
+		const staticError = "static error"
+		validateCalls := 0
+		fake, config, link := setupOauth2Test(t, testConfig{
+			FakeIDPOpts: []oidctest.FakeIDPOpt{
+				oidctest.WithRefresh(func(_ string) error {
+					t.Error("refresh on the IDP was called, but the token is not expired")
+					return xerrors.New("should not be called")
+				}),
+				oidctest.WithDynamicUserInfo(func(_ string) (jwt.MapClaims, error) {
+					validateCalls++
+					// Make the first call return a 401, subsequent calls should return a 200.
+					if validateCalls > 1 {
+						return jwt.MapClaims{}, nil
+					}
+					return jwt.MapClaims{}, oidctest.StatusError(http.StatusUnauthorized, xerrors.New(staticError))
+				}),
+			},
+			ExternalAuthOpt: func(cfg *externalauth.Config) {
+				cfg.Type = codersdk.EnhancedExternalAuthProviderGitHub.String()
+			},
+		})
+
+		ctx := oidc.ClientContext(context.Background(), fake.HTTPClient(nil))
+		// Unlimited lifetime, this is what GitHub returns tokens as
+		link.OAuthExpiry = time.Time{}
+
+		_, ok, err := config.RefreshToken(ctx, nil, link)
+		require.NoError(t, err)
+		require.True(t, ok)
+		require.Equal(t, 2, validateCalls, "token should have been attempted to be validated more than once")
+	})
+
+	t.Run("ValidateNoUpdate", func(t *testing.T) {
+		t.Parallel()
+
+		validateCalls := 0
+		fake, config, link := setupOauth2Test(t, testConfig{
+			FakeIDPOpts: []oidctest.FakeIDPOpt{
+				oidctest.WithRefresh(func(_ string) error {
+					t.Error("refresh on the IDP was called, but the token is not expired")
+					return xerrors.New("should not be called")
+				}),
+				oidctest.WithDynamicUserInfo(func(_ string) (jwt.MapClaims, error) {
+					validateCalls++
+					return jwt.MapClaims{}, nil
+				}),
+			},
+			ExternalAuthOpt: func(cfg *externalauth.Config) {
+				cfg.Type = codersdk.EnhancedExternalAuthProviderGitHub.String()
+			},
+		})
+
+		ctx := oidc.ClientContext(context.Background(), fake.HTTPClient(nil))
+
+		_, ok, err := config.RefreshToken(ctx, nil, link)
+		require.NoError(t, err)
+		require.True(t, ok)
+		require.Equal(t, 1, validateCalls, "token is validated")
+	})
+
+	// A token update comes from a refresh.
+	t.Run("Updates", func(t *testing.T) {
+		t.Parallel()
+
+		db := dbmem.New()
+		validateCalls := 0
+		refreshCalls := 0
+		fake, config, link := setupOauth2Test(t, testConfig{
+			FakeIDPOpts: []oidctest.FakeIDPOpt{
+				oidctest.WithRefresh(func(_ string) error {
+					refreshCalls++
+					return nil
+				}),
+				oidctest.WithDynamicUserInfo(func(_ string) (jwt.MapClaims, error) {
+					validateCalls++
+					return jwt.MapClaims{}, nil
+				}),
+			},
+			ExternalAuthOpt: func(cfg *externalauth.Config) {
+				cfg.Type = codersdk.EnhancedExternalAuthProviderGitHub.String()
+			},
+			DB: db,
+		})
+
+		ctx := oidc.ClientContext(context.Background(), fake.HTTPClient(nil))
+		// Force a refresh
+		link.OAuthExpiry = expired
+
+		updated, ok, err := config.RefreshToken(ctx, db, link)
+		require.NoError(t, err)
+		require.True(t, ok)
+		require.Equal(t, 1, validateCalls, "token is validated")
+		require.Equal(t, 1, refreshCalls, "token is refreshed")
+		require.NotEqualf(t, link.OAuthAccessToken, updated.OAuthAccessToken, "token is updated")
+		//nolint:gocritic // testing
+		dbLink, err := db.GetExternalAuthLink(dbauthz.AsSystemRestricted(context.Background()), database.GetExternalAuthLinkParams{
+			ProviderID: link.ProviderID,
+			UserID:     link.UserID,
+		})
+		require.NoError(t, err)
+		require.Equal(t, updated.OAuthAccessToken, dbLink.OAuthAccessToken, "token is updated in the DB")
+	})
+
+	t.Run("WithExtra", func(t *testing.T) {
+		t.Parallel()
+
+		db := dbmem.New()
+		fake, config, link := setupOauth2Test(t, testConfig{
+			FakeIDPOpts: []oidctest.FakeIDPOpt{
+				oidctest.WithMutateToken(func(token map[string]interface{}) {
+					token["authed_user"] = map[string]interface{}{
+						"access_token": token["access_token"],
+					}
+				}),
+			},
+			ExternalAuthOpt: func(cfg *externalauth.Config) {
+				cfg.Type = codersdk.EnhancedExternalAuthProviderSlack.String()
+				cfg.ExtraTokenKeys = []string{"authed_user"}
+				cfg.ValidateURL = ""
+			},
+			DB: db,
+		})
+
+		ctx := oidc.ClientContext(context.Background(), fake.HTTPClient(nil))
+		// Force a refresh
+		link.OAuthExpiry = expired
+
+		updated, ok, err := config.RefreshToken(ctx, db, link)
+		require.NoError(t, err)
+		require.True(t, ok)
+		require.True(t, updated.OAuthExtra.Valid)
+		extra := map[string]interface{}{}
+		require.NoError(t, json.Unmarshal(updated.OAuthExtra.RawMessage, &extra))
+		mapping, ok := extra["authed_user"].(map[string]interface{})
+		require.True(t, ok)
+		require.Equal(t, updated.OAuthAccessToken, mapping["access_token"])
+	})
+}
+
+func TestConvertYAML(t *testing.T) {
+	t.Parallel()
+	for _, tc := range []struct {
+		Name   string
+		Input  []codersdk.ExternalAuthConfig
+		Output []*externalauth.Config
+		Error  string
+	}{{
+		Name: "InvalidID",
+		Input: []codersdk.ExternalAuthConfig{{
+			Type: string(codersdk.EnhancedExternalAuthProviderGitHub),
+			ID:   "$hi$",
+		}},
+		Error: "doesn't have a valid id",
+	}, {
+		Name: "NoClientID",
+		Input: []codersdk.ExternalAuthConfig{{
+			Type: string(codersdk.EnhancedExternalAuthProviderGitHub),
+		}},
+		Error: "client_id must be provided",
+	}, {
+		Name: "DuplicateType",
+		Input: []codersdk.ExternalAuthConfig{{
+			Type:         string(codersdk.EnhancedExternalAuthProviderGitHub),
+			ClientID:     "example",
+			ClientSecret: "example",
+		}, {
+			Type:         string(codersdk.EnhancedExternalAuthProviderGitHub),
+			ClientID:     "example-2",
+			ClientSecret: "example-2",
+		}},
+		Error: "multiple github external auth providers provided",
+	}, {
+		Name: "InvalidRegex",
+		Input: []codersdk.ExternalAuthConfig{{
+			Type:         string(codersdk.EnhancedExternalAuthProviderGitHub),
+			ClientID:     "example",
+			ClientSecret: "example",
+			Regex:        `\K`,
+		}},
+		Error: "compile regex for external auth provider",
+	}, {
+		Name: "NoDeviceURL",
+		Input: []codersdk.ExternalAuthConfig{{
+			Type:         string(codersdk.EnhancedExternalAuthProviderGitLab),
+			ClientID:     "example",
+			ClientSecret: "example",
+			DeviceFlow:   true,
+		}},
+		Error: "device auth url must be provided",
+	}} {
+		tc := tc
+		t.Run(tc.Name, func(t *testing.T) {
+			t.Parallel()
+			output, err := externalauth.ConvertConfig(tc.Input, &url.URL{})
+			if tc.Error != "" {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tc.Error)
+				return
+			}
+			require.Equal(t, tc.Output, output)
+		})
+	}
+
+	t.Run("CustomScopesAndEndpoint", func(t *testing.T) {
+		t.Parallel()
+		config, err := externalauth.ConvertConfig([]codersdk.ExternalAuthConfig{{
+			Type:         string(codersdk.EnhancedExternalAuthProviderGitLab),
+			ClientID:     "id",
+			ClientSecret: "secret",
+			AuthURL:      "https://auth.com",
+			TokenURL:     "https://token.com",
+			Scopes:       []string{"read"},
+		}}, &url.URL{})
+		require.NoError(t, err)
+		require.Equal(t, "https://auth.com?client_id=id&redirect_uri=%2Fexternal-auth%2Fgitlab%2Fcallback&response_type=code&scope=read", config[0].AuthCodeURL(""))
+	})
+}
+
+type testConfig struct {
+	FakeIDPOpts         []oidctest.FakeIDPOpt
+	CoderOIDCConfigOpts []func(cfg *coderd.OIDCConfig)
+	ExternalAuthOpt     func(cfg *externalauth.Config)
+	// If DB is passed in, the link will be inserted into the DB.
+	DB database.Store
+}
+
+// setupTest will configure a fake IDP and a externalauth.Config for testing.
+// The Fake's userinfo endpoint is used for validating tokens.
+// No http servers are started so use the fake IDP's HTTPClient to make requests.
+// The returned token is a fully valid token for the IDP. Feel free to manipulate it
+// to test different scenarios.
+func setupOauth2Test(t *testing.T, settings testConfig) (*oidctest.FakeIDP, *externalauth.Config, database.ExternalAuthLink) {
+	t.Helper()
+
+	const providerID = "test-idp"
+	fake := oidctest.NewFakeIDP(t,
+		append([]oidctest.FakeIDPOpt{}, settings.FakeIDPOpts...)...,
+	)
+
+	config := &externalauth.Config{
+		OAuth2Config: fake.OIDCConfig(t, nil, settings.CoderOIDCConfigOpts...),
+		ID:           providerID,
+		ValidateURL:  fake.WellknownConfig().UserInfoURL,
+	}
+	settings.ExternalAuthOpt(config)
+
+	oauthToken, err := fake.GenerateAuthenticatedToken(jwt.MapClaims{
+		"email": "test@coder.com",
+	})
+	require.NoError(t, err)
+
+	now := time.Now()
+	link := database.ExternalAuthLink{
+		ProviderID:        providerID,
+		UserID:            uuid.New(),
+		CreatedAt:         now,
+		UpdatedAt:         now,
+		OAuthAccessToken:  oauthToken.AccessToken,
+		OAuthRefreshToken: oauthToken.RefreshToken,
+		// The caller can manually expire this if they want.
+		OAuthExpiry: now.Add(time.Hour),
+	}
+
+	if settings.DB != nil {
+		// Feel free to insert additional things like the user, etc if required.
+		link, err = settings.DB.InsertExternalAuthLink(context.Background(), database.InsertExternalAuthLinkParams{
+			ProviderID:        link.ProviderID,
+			UserID:            link.UserID,
+			CreatedAt:         link.CreatedAt,
+			UpdatedAt:         link.UpdatedAt,
+			OAuthAccessToken:  link.OAuthAccessToken,
+			OAuthRefreshToken: link.OAuthRefreshToken,
+			OAuthExpiry:       link.OAuthExpiry,
+		})
+		require.NoError(t, err, "failed to insert link into DB")
+	}
+
+	return fake, config, link
+}
diff --git a/coderd/externalauth_test.go b/coderd/externalauth_test.go
new file mode 100644
index 0000000000000..9ba18b2c0f3a8
--- /dev/null
+++ b/coderd/externalauth_test.go
@@ -0,0 +1,482 @@
+package coderd_test
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/go-github/v43/github"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestExternalAuthByID(t *testing.T) {
+	t.Parallel()
+	t.Run("Unauthenticated", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{
+			ExternalAuthConfigs: []*externalauth.Config{{
+				ID:           "test",
+				OAuth2Config: &testutil.OAuth2Config{},
+				Type:         codersdk.EnhancedExternalAuthProviderGitHub.String(),
+			}},
+		})
+		coderdtest.CreateFirstUser(t, client)
+		auth, err := client.ExternalAuthByID(context.Background(), "test")
+		require.NoError(t, err)
+		require.False(t, auth.Authenticated)
+	})
+	t.Run("AuthenticatedNoUser", func(t *testing.T) {
+		// Ensures that a provider that can't obtain a user can
+		// still return that the provider is authenticated.
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{
+			ExternalAuthConfigs: []*externalauth.Config{{
+				ID:           "test",
+				OAuth2Config: &testutil.OAuth2Config{},
+				// AzureDevops doesn't have a user endpoint!
+				Type: codersdk.EnhancedExternalAuthProviderAzureDevops.String(),
+			}},
+		})
+		coderdtest.CreateFirstUser(t, client)
+		resp := coderdtest.RequestExternalAuthCallback(t, "test", client)
+		_ = resp.Body.Close()
+		auth, err := client.ExternalAuthByID(context.Background(), "test")
+		require.NoError(t, err)
+		require.True(t, auth.Authenticated)
+	})
+	t.Run("AuthenticatedWithUser", func(t *testing.T) {
+		t.Parallel()
+		validateSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			httpapi.Write(r.Context(), w, http.StatusOK, github.User{
+				Login:     github.String("kyle"),
+				AvatarURL: github.String("https://avatars.githubusercontent.com/u/12345678?v=4"),
+			})
+		}))
+		defer validateSrv.Close()
+		client := coderdtest.New(t, &coderdtest.Options{
+			ExternalAuthConfigs: []*externalauth.Config{{
+				ID:           "test",
+				ValidateURL:  validateSrv.URL,
+				OAuth2Config: &testutil.OAuth2Config{},
+				Type:         codersdk.EnhancedExternalAuthProviderGitHub.String(),
+			}},
+		})
+		coderdtest.CreateFirstUser(t, client)
+		resp := coderdtest.RequestExternalAuthCallback(t, "test", client)
+		_ = resp.Body.Close()
+		auth, err := client.ExternalAuthByID(context.Background(), "test")
+		require.NoError(t, err)
+		require.True(t, auth.Authenticated)
+		require.NotNil(t, auth.User)
+		require.Equal(t, "kyle", auth.User.Login)
+	})
+	t.Run("AuthenticatedWithInstalls", func(t *testing.T) {
+		t.Parallel()
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			switch r.URL.Path {
+			case "/user":
+				httpapi.Write(r.Context(), w, http.StatusOK, github.User{
+					Login:     github.String("kyle"),
+					AvatarURL: github.String("https://avatars.githubusercontent.com/u/12345678?v=4"),
+				})
+			case "/installs":
+				httpapi.Write(r.Context(), w, http.StatusOK, struct {
+					Installations []github.Installation `json:"installations"`
+				}{
+					Installations: []github.Installation{{
+						ID: github.Int64(12345678),
+						Account: &github.User{
+							Login: github.String("coder"),
+						},
+					}},
+				})
+			}
+		}))
+		defer srv.Close()
+		client := coderdtest.New(t, &coderdtest.Options{
+			ExternalAuthConfigs: []*externalauth.Config{{
+				ID:                  "test",
+				ValidateURL:         srv.URL + "/user",
+				AppInstallationsURL: srv.URL + "/installs",
+				OAuth2Config:        &testutil.OAuth2Config{},
+				Type:                codersdk.EnhancedExternalAuthProviderGitHub.String(),
+			}},
+		})
+		coderdtest.CreateFirstUser(t, client)
+		resp := coderdtest.RequestExternalAuthCallback(t, "test", client)
+		_ = resp.Body.Close()
+		auth, err := client.ExternalAuthByID(context.Background(), "test")
+		require.NoError(t, err)
+		require.True(t, auth.Authenticated)
+		require.NotNil(t, auth.User)
+		require.Equal(t, "kyle", auth.User.Login)
+		require.NotNil(t, auth.AppInstallations)
+		require.Len(t, auth.AppInstallations, 1)
+	})
+}
+
+func TestExternalAuthDevice(t *testing.T) {
+	t.Parallel()
+	t.Run("NotSupported", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{
+			ExternalAuthConfigs: []*externalauth.Config{{
+				ID: "test",
+			}},
+		})
+		coderdtest.CreateFirstUser(t, client)
+		_, err := client.ExternalAuthDeviceByID(context.Background(), "test")
+		var sdkErr *codersdk.Error
+		require.ErrorAs(t, err, &sdkErr)
+		require.Equal(t, http.StatusBadRequest, sdkErr.StatusCode())
+	})
+	t.Run("FetchCode", func(t *testing.T) {
+		t.Parallel()
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			httpapi.Write(r.Context(), w, http.StatusOK, codersdk.ExternalAuthDevice{
+				UserCode: "hey",
+			})
+		}))
+		defer srv.Close()
+		client := coderdtest.New(t, &coderdtest.Options{
+			ExternalAuthConfigs: []*externalauth.Config{{
+				ID: "test",
+				DeviceAuth: &externalauth.DeviceAuth{
+					ClientID: "test",
+					CodeURL:  srv.URL,
+					Scopes:   []string{"repo"},
+				},
+			}},
+		})
+		coderdtest.CreateFirstUser(t, client)
+		device, err := client.ExternalAuthDeviceByID(context.Background(), "test")
+		require.NoError(t, err)
+		require.Equal(t, "hey", device.UserCode)
+	})
+	t.Run("ExchangeCode", func(t *testing.T) {
+		t.Parallel()
+		resp := externalauth.ExchangeDeviceCodeResponse{
+			Error: "authorization_pending",
+		}
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			httpapi.Write(r.Context(), w, http.StatusOK, resp)
+		}))
+		defer srv.Close()
+		client := coderdtest.New(t, &coderdtest.Options{
+			ExternalAuthConfigs: []*externalauth.Config{{
+				ID: "test",
+				DeviceAuth: &externalauth.DeviceAuth{
+					ClientID: "test",
+					TokenURL: srv.URL,
+					Scopes:   []string{"repo"},
+				},
+			}},
+		})
+		coderdtest.CreateFirstUser(t, client)
+		err := client.ExternalAuthDeviceExchange(context.Background(), "test", codersdk.ExternalAuthDeviceExchange{
+			DeviceCode: "hey",
+		})
+		var sdkErr *codersdk.Error
+		require.ErrorAs(t, err, &sdkErr)
+		require.Equal(t, http.StatusBadRequest, sdkErr.StatusCode())
+		require.Equal(t, "authorization_pending", sdkErr.Detail)
+
+		resp = externalauth.ExchangeDeviceCodeResponse{
+			AccessToken: "hey",
+		}
+
+		err = client.ExternalAuthDeviceExchange(context.Background(), "test", codersdk.ExternalAuthDeviceExchange{
+			DeviceCode: "hey",
+		})
+		require.NoError(t, err)
+
+		auth, err := client.ExternalAuthByID(context.Background(), "test")
+		require.NoError(t, err)
+		require.True(t, auth.Authenticated)
+	})
+}
+
+// nolint:bodyclose
+func TestExternalAuthCallback(t *testing.T) {
+	t.Parallel()
+	t.Run("NoMatchingConfig", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+			ExternalAuthConfigs:      []*externalauth.Config{},
+		})
+		user := coderdtest.CreateFirstUser(t, client)
+		authToken := uuid.NewString()
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
+		})
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		agentClient := agentsdk.New(client.URL)
+		agentClient.SetSessionToken(authToken)
+		_, err := agentClient.ExternalAuth(context.Background(), agentsdk.ExternalAuthRequest{
+			Match: "github.com",
+		})
+		var apiError *codersdk.Error
+		require.ErrorAs(t, err, &apiError)
+		require.Equal(t, http.StatusNotFound, apiError.StatusCode())
+	})
+	t.Run("ReturnsURL", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+			ExternalAuthConfigs: []*externalauth.Config{{
+				OAuth2Config: &testutil.OAuth2Config{},
+				ID:           "github",
+				Regex:        regexp.MustCompile(`github\.com`),
+				Type:         codersdk.EnhancedExternalAuthProviderGitHub.String(),
+			}},
+		})
+		user := coderdtest.CreateFirstUser(t, client)
+		authToken := uuid.NewString()
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
+		})
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		agentClient := agentsdk.New(client.URL)
+		agentClient.SetSessionToken(authToken)
+		token, err := agentClient.ExternalAuth(context.Background(), agentsdk.ExternalAuthRequest{
+			Match: "github.com/asd/asd",
+		})
+		require.NoError(t, err)
+		require.True(t, strings.HasSuffix(token.URL, fmt.Sprintf("/external-auth/%s", "github")), token.URL)
+	})
+	t.Run("UnauthorizedCallback", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+			ExternalAuthConfigs: []*externalauth.Config{{
+				OAuth2Config: &testutil.OAuth2Config{},
+				ID:           "github",
+				Regex:        regexp.MustCompile(`github\.com`),
+				Type:         codersdk.EnhancedExternalAuthProviderGitHub.String(),
+			}},
+		})
+		resp := coderdtest.RequestExternalAuthCallback(t, "github", client)
+		require.Equal(t, http.StatusSeeOther, resp.StatusCode)
+	})
+	t.Run("AuthorizedCallback", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+			ExternalAuthConfigs: []*externalauth.Config{{
+				OAuth2Config: &testutil.OAuth2Config{},
+				ID:           "github",
+				Regex:        regexp.MustCompile(`github\.com`),
+				Type:         codersdk.EnhancedExternalAuthProviderGitHub.String(),
+			}},
+		})
+		_ = coderdtest.CreateFirstUser(t, client)
+		resp := coderdtest.RequestExternalAuthCallback(t, "github", client)
+		require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
+		location, err := resp.Location()
+		require.NoError(t, err)
+		require.Equal(t, "/external-auth/github", location.Path)
+
+		// Callback again to simulate updating the token.
+		resp = coderdtest.RequestExternalAuthCallback(t, "github", client)
+		require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
+	})
+	t.Run("ValidateURL", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		srv := httptest.NewServer(nil)
+		defer srv.Close()
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+			ExternalAuthConfigs: []*externalauth.Config{{
+				ValidateURL:  srv.URL,
+				OAuth2Config: &testutil.OAuth2Config{},
+				ID:           "github",
+				Regex:        regexp.MustCompile(`github\.com`),
+				Type:         codersdk.EnhancedExternalAuthProviderGitHub.String(),
+			}},
+		})
+		user := coderdtest.CreateFirstUser(t, client)
+		authToken := uuid.NewString()
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
+		})
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		agentClient := agentsdk.New(client.URL)
+		agentClient.SetSessionToken(authToken)
+
+		resp := coderdtest.RequestExternalAuthCallback(t, "github", client)
+		require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
+
+		// If the validation URL says unauthorized, the callback
+		// URL to re-authenticate should be returned.
+		srv.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusUnauthorized)
+		})
+		res, err := agentClient.ExternalAuth(ctx, agentsdk.ExternalAuthRequest{
+			Match: "github.com/asd/asd",
+		})
+		require.NoError(t, err)
+		require.NotEmpty(t, res.URL)
+
+		// If the validation URL gives a non-OK status code, this
+		// should be treated as an internal server error.
+		srv.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusForbidden)
+			w.Write([]byte("Something went wrong!"))
+		})
+		_, err = agentClient.ExternalAuth(ctx, agentsdk.ExternalAuthRequest{
+			Match: "github.com/asd/asd",
+		})
+		var apiError *codersdk.Error
+		require.ErrorAs(t, err, &apiError)
+		require.Equal(t, http.StatusInternalServerError, apiError.StatusCode())
+		require.Equal(t, "validate external auth token: status 403: body: Something went wrong!", apiError.Detail)
+	})
+
+	t.Run("ExpiredNoRefresh", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+			ExternalAuthConfigs: []*externalauth.Config{{
+				OAuth2Config: &testutil.OAuth2Config{
+					Token: &oauth2.Token{
+						AccessToken:  "token",
+						RefreshToken: "something",
+						Expiry:       dbtime.Now().Add(-time.Hour),
+					},
+				},
+				ID:        "github",
+				Regex:     regexp.MustCompile(`github\.com`),
+				Type:      codersdk.EnhancedExternalAuthProviderGitHub.String(),
+				NoRefresh: true,
+			}},
+		})
+		user := coderdtest.CreateFirstUser(t, client)
+		authToken := uuid.NewString()
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
+		})
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		agentClient := agentsdk.New(client.URL)
+		agentClient.SetSessionToken(authToken)
+
+		token, err := agentClient.ExternalAuth(context.Background(), agentsdk.ExternalAuthRequest{
+			Match: "github.com/asd/asd",
+		})
+		require.NoError(t, err)
+		require.NotEmpty(t, token.URL)
+
+		// In the configuration, we set our OAuth provider
+		// to return an expired token. Coder consumes this
+		// and stores it.
+		resp := coderdtest.RequestExternalAuthCallback(t, "github", client)
+		require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
+
+		// Because the token is expired and `NoRefresh` is specified,
+		// a redirect URL should be returned again.
+		token, err = agentClient.ExternalAuth(context.Background(), agentsdk.ExternalAuthRequest{
+			Match: "github.com/asd/asd",
+		})
+		require.NoError(t, err)
+		require.NotEmpty(t, token.URL)
+	})
+
+	t.Run("FullFlow", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+			ExternalAuthConfigs: []*externalauth.Config{{
+				OAuth2Config: &testutil.OAuth2Config{},
+				ID:           "github",
+				Regex:        regexp.MustCompile(`github\.com`),
+				Type:         codersdk.EnhancedExternalAuthProviderGitHub.String(),
+			}},
+		})
+		user := coderdtest.CreateFirstUser(t, client)
+		authToken := uuid.NewString()
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
+		})
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		agentClient := agentsdk.New(client.URL)
+		agentClient.SetSessionToken(authToken)
+
+		token, err := agentClient.ExternalAuth(context.Background(), agentsdk.ExternalAuthRequest{
+			Match: "github.com/asd/asd",
+		})
+		require.NoError(t, err)
+		require.NotEmpty(t, token.URL)
+
+		// Start waiting for the token callback...
+		tokenChan := make(chan agentsdk.ExternalAuthResponse, 1)
+		go func() {
+			token, err := agentClient.ExternalAuth(context.Background(), agentsdk.ExternalAuthRequest{
+				Match:  "github.com/asd/asd",
+				Listen: true,
+			})
+			assert.NoError(t, err)
+			tokenChan <- token
+		}()
+
+		time.Sleep(250 * time.Millisecond)
+
+		resp := coderdtest.RequestExternalAuthCallback(t, "github", client)
+		require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
+		token = <-tokenChan
+		require.Equal(t, "access_token", token.Username)
+
+		token, err = agentClient.ExternalAuth(context.Background(), agentsdk.ExternalAuthRequest{
+			Match: "github.com/asd/asd",
+		})
+		require.NoError(t, err)
+	})
+}
diff --git a/coderd/files.go b/coderd/files.go
index 486ef26b90c90..a04ba1eacedc3 100644
--- a/coderd/files.go
+++ b/coderd/files.go
@@ -12,10 +12,11 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 const (
@@ -82,7 +83,7 @@ func (api *API) postFile(rw http.ResponseWriter, r *http.Request) {
 		ID:        id,
 		Hash:      hash,
 		CreatedBy: apiKey.UserID,
-		CreatedAt: database.Now(),
+		CreatedAt: dbtime.Now(),
 		Mimetype:  contentType,
 		Data:      data,
 	})
diff --git a/coderd/files_test.go b/coderd/files_test.go
index 0841785c8c660..1a3f407a6e1f6 100644
--- a/coderd/files_test.go
+++ b/coderd/files_test.go
@@ -9,9 +9,9 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestPostFiles(t *testing.T) {
diff --git a/coderd/gitauth.go b/coderd/gitauth.go
deleted file mode 100644
index 537f0b8794e32..0000000000000
--- a/coderd/gitauth.go
+++ /dev/null
@@ -1,253 +0,0 @@
-package coderd
-
-import (
-	"database/sql"
-	"errors"
-	"fmt"
-	"net/http"
-
-	"golang.org/x/sync/errgroup"
-
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
-)
-
-// @Summary Get git auth by ID
-// @ID get-git-auth-by-id
-// @Security CoderSessionToken
-// @Produce json
-// @Tags Git
-// @Param gitauth path string true "Git Provider ID" format(string)
-// @Success 200 {object} codersdk.GitAuth
-// @Router /gitauth/{gitauth} [get]
-func (api *API) gitAuthByID(w http.ResponseWriter, r *http.Request) {
-	config := httpmw.GitAuthParam(r)
-	apiKey := httpmw.APIKey(r)
-	ctx := r.Context()
-
-	res := codersdk.GitAuth{
-		Authenticated:    false,
-		Device:           config.DeviceAuth != nil,
-		AppInstallURL:    config.AppInstallURL,
-		Type:             config.Type.Pretty(),
-		AppInstallations: []codersdk.GitAuthAppInstallation{},
-	}
-
-	link, err := api.Database.GetGitAuthLink(ctx, database.GetGitAuthLinkParams{
-		ProviderID: config.ID,
-		UserID:     apiKey.UserID,
-	})
-	if err != nil {
-		if !errors.Is(err, sql.ErrNoRows) {
-			httpapi.Write(ctx, w, http.StatusInternalServerError, codersdk.Response{
-				Message: "Failed to get git auth link.",
-				Detail:  err.Error(),
-			})
-			return
-		}
-
-		httpapi.Write(ctx, w, http.StatusOK, res)
-		return
-	}
-	var eg errgroup.Group
-	eg.Go(func() (err error) {
-		res.Authenticated, res.User, err = config.ValidateToken(ctx, link.OAuthAccessToken)
-		return err
-	})
-	eg.Go(func() (err error) {
-		res.AppInstallations, res.AppInstallable, err = config.AppInstallations(ctx, link.OAuthAccessToken)
-		return err
-	})
-	err = eg.Wait()
-	if err != nil {
-		httpapi.Write(ctx, w, http.StatusInternalServerError, codersdk.Response{
-			Message: "Failed to validate token.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-	if res.AppInstallations == nil {
-		res.AppInstallations = []codersdk.GitAuthAppInstallation{}
-	}
-	httpapi.Write(ctx, w, http.StatusOK, res)
-}
-
-// @Summary Post git auth device by ID
-// @ID post-git-auth-device-by-id
-// @Security CoderSessionToken
-// @Tags Git
-// @Param gitauth path string true "Git Provider ID" format(string)
-// @Success 204
-// @Router /gitauth/{gitauth}/device [post]
-func (api *API) postGitAuthDeviceByID(rw http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	apiKey := httpmw.APIKey(r)
-	config := httpmw.GitAuthParam(r)
-
-	var req codersdk.GitAuthDeviceExchange
-	if !httpapi.Read(ctx, rw, r, &req) {
-		return
-	}
-
-	if config.DeviceAuth == nil {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "Git auth provider does not support device flow.",
-		})
-		return
-	}
-
-	token, err := config.DeviceAuth.ExchangeDeviceCode(ctx, req.DeviceCode)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "Failed to exchange device code.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-
-	_, err = api.Database.GetGitAuthLink(ctx, database.GetGitAuthLinkParams{
-		ProviderID: config.ID,
-		UserID:     apiKey.UserID,
-	})
-	if err != nil {
-		if !errors.Is(err, sql.ErrNoRows) {
-			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-				Message: "Failed to get git auth link.",
-				Detail:  err.Error(),
-			})
-			return
-		}
-
-		_, err = api.Database.InsertGitAuthLink(ctx, database.InsertGitAuthLinkParams{
-			ProviderID:        config.ID,
-			UserID:            apiKey.UserID,
-			CreatedAt:         database.Now(),
-			UpdatedAt:         database.Now(),
-			OAuthAccessToken:  token.AccessToken,
-			OAuthRefreshToken: token.RefreshToken,
-			OAuthExpiry:       token.Expiry,
-		})
-		if err != nil {
-			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-				Message: "Failed to insert git auth link.",
-				Detail:  err.Error(),
-			})
-			return
-		}
-	} else {
-		_, err = api.Database.UpdateGitAuthLink(ctx, database.UpdateGitAuthLinkParams{
-			ProviderID:        config.ID,
-			UserID:            apiKey.UserID,
-			UpdatedAt:         database.Now(),
-			OAuthAccessToken:  token.AccessToken,
-			OAuthRefreshToken: token.RefreshToken,
-			OAuthExpiry:       token.Expiry,
-		})
-		if err != nil {
-			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-				Message: "Failed to update git auth link.",
-				Detail:  err.Error(),
-			})
-			return
-		}
-	}
-	httpapi.Write(ctx, rw, http.StatusNoContent, nil)
-}
-
-// @Summary Get git auth device by ID.
-// @ID get-git-auth-device-by-id
-// @Security CoderSessionToken
-// @Produce json
-// @Tags Git
-// @Param gitauth path string true "Git Provider ID" format(string)
-// @Success 200 {object} codersdk.GitAuthDevice
-// @Router /gitauth/{gitauth}/device [get]
-func (*API) gitAuthDeviceByID(rw http.ResponseWriter, r *http.Request) {
-	config := httpmw.GitAuthParam(r)
-	ctx := r.Context()
-
-	if config.DeviceAuth == nil {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "Git auth device flow not supported.",
-		})
-		return
-	}
-
-	deviceAuth, err := config.DeviceAuth.AuthorizeDevice(r.Context())
-	if err != nil {
-		httpapi.Write(r.Context(), rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Failed to authorize device.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-
-	httpapi.Write(ctx, rw, http.StatusOK, deviceAuth)
-}
-
-func (api *API) gitAuthCallback(gitAuthConfig *gitauth.Config) http.HandlerFunc {
-	return func(rw http.ResponseWriter, r *http.Request) {
-		var (
-			ctx    = r.Context()
-			state  = httpmw.OAuth2(r)
-			apiKey = httpmw.APIKey(r)
-		)
-
-		_, err := api.Database.GetGitAuthLink(ctx, database.GetGitAuthLinkParams{
-			ProviderID: gitAuthConfig.ID,
-			UserID:     apiKey.UserID,
-		})
-		if err != nil {
-			if !errors.Is(err, sql.ErrNoRows) {
-				httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-					Message: "Failed to get git auth link.",
-					Detail:  err.Error(),
-				})
-				return
-			}
-
-			_, err = api.Database.InsertGitAuthLink(ctx, database.InsertGitAuthLinkParams{
-				ProviderID:        gitAuthConfig.ID,
-				UserID:            apiKey.UserID,
-				CreatedAt:         database.Now(),
-				UpdatedAt:         database.Now(),
-				OAuthAccessToken:  state.Token.AccessToken,
-				OAuthRefreshToken: state.Token.RefreshToken,
-				OAuthExpiry:       state.Token.Expiry,
-			})
-			if err != nil {
-				httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-					Message: "Failed to insert git auth link.",
-					Detail:  err.Error(),
-				})
-				return
-			}
-		} else {
-			_, err = api.Database.UpdateGitAuthLink(ctx, database.UpdateGitAuthLinkParams{
-				ProviderID:        gitAuthConfig.ID,
-				UserID:            apiKey.UserID,
-				UpdatedAt:         database.Now(),
-				OAuthAccessToken:  state.Token.AccessToken,
-				OAuthRefreshToken: state.Token.RefreshToken,
-				OAuthExpiry:       state.Token.Expiry,
-			})
-			if err != nil {
-				httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-					Message: "Failed to update git auth link.",
-					Detail:  err.Error(),
-				})
-				return
-			}
-		}
-
-		redirect := state.Redirect
-		if redirect == "" {
-			// This is a nicely rendered screen on the frontend
-			redirect = fmt.Sprintf("/gitauth/%s", gitAuthConfig.ID)
-		}
-		http.Redirect(rw, r, redirect, http.StatusTemporaryRedirect)
-	}
-}
diff --git a/coderd/gitauth/config.go b/coderd/gitauth/config.go
deleted file mode 100644
index 29d4804dcd538..0000000000000
--- a/coderd/gitauth/config.go
+++ /dev/null
@@ -1,316 +0,0 @@
-package gitauth
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"regexp"
-
-	"golang.org/x/oauth2"
-	"golang.org/x/xerrors"
-
-	"github.com/google/go-github/v43/github"
-
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-)
-
-type OAuth2Config interface {
-	AuthCodeURL(state string, opts ...oauth2.AuthCodeOption) string
-	Exchange(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error)
-	TokenSource(context.Context, *oauth2.Token) oauth2.TokenSource
-}
-
-// Config is used for authentication for Git operations.
-type Config struct {
-	OAuth2Config
-	// ID is a unique identifier for the authenticator.
-	ID string
-	// Regex is a regexp that URLs will match against.
-	Regex *regexp.Regexp
-	// Type is the type of provider.
-	Type codersdk.GitProvider
-	// NoRefresh stops Coder from using the refresh token
-	// to renew the access token.
-	//
-	// Some organizations have security policies that require
-	// re-authentication for every token.
-	NoRefresh bool
-	// ValidateURL ensures an access token is valid before
-	// returning it to the user. If omitted, tokens will
-	// not be validated before being returned.
-	ValidateURL string
-	// AppInstallURL is for GitHub App's (and hopefully others eventually)
-	// to provide a link to install the app. There's installation
-	// of the application, and user authentication. It's possible
-	// for the user to authenticate but the application to not.
-	AppInstallURL string
-	// InstallationsURL is an API endpoint that returns a list of
-	// installations for the user. This is used for GitHub Apps.
-	AppInstallationsURL string
-	// DeviceAuth is set if the provider uses the device flow.
-	DeviceAuth *DeviceAuth
-}
-
-// RefreshToken automatically refreshes the token if expired and permitted.
-// It returns the token and a bool indicating if the token was refreshed.
-func (c *Config) RefreshToken(ctx context.Context, db database.Store, gitAuthLink database.GitAuthLink) (database.GitAuthLink, bool, error) {
-	// If the token is expired and refresh is disabled, we prompt
-	// the user to authenticate again.
-	if c.NoRefresh && gitAuthLink.OAuthExpiry.Before(database.Now()) {
-		return gitAuthLink, false, nil
-	}
-
-	token, err := c.TokenSource(ctx, &oauth2.Token{
-		AccessToken:  gitAuthLink.OAuthAccessToken,
-		RefreshToken: gitAuthLink.OAuthRefreshToken,
-		Expiry:       gitAuthLink.OAuthExpiry,
-	}).Token()
-	if err != nil {
-		// Even if the token fails to be obtained, we still return false because
-		// we aren't trying to surface an error, we're just trying to obtain a valid token.
-		return gitAuthLink, false, nil
-	}
-
-	valid, _, err := c.ValidateToken(ctx, token.AccessToken)
-	if err != nil {
-		return gitAuthLink, false, xerrors.Errorf("validate git auth token: %w", err)
-	}
-	if !valid {
-		// The token is no longer valid!
-		return gitAuthLink, false, nil
-	}
-
-	if token.AccessToken != gitAuthLink.OAuthAccessToken {
-		// Update it
-		gitAuthLink, err = db.UpdateGitAuthLink(ctx, database.UpdateGitAuthLinkParams{
-			ProviderID:        c.ID,
-			UserID:            gitAuthLink.UserID,
-			UpdatedAt:         database.Now(),
-			OAuthAccessToken:  token.AccessToken,
-			OAuthRefreshToken: token.RefreshToken,
-			OAuthExpiry:       token.Expiry,
-		})
-		if err != nil {
-			return gitAuthLink, false, xerrors.Errorf("update git auth link: %w", err)
-		}
-	}
-	return gitAuthLink, true, nil
-}
-
-// ValidateToken ensures the Git token provided is valid!
-// The user is optionally returned if the provider supports it.
-func (c *Config) ValidateToken(ctx context.Context, token string) (bool, *codersdk.GitAuthUser, error) {
-	if c.ValidateURL == "" {
-		// Default that the token is valid if no validation URL is provided.
-		return true, nil, nil
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.ValidateURL, nil)
-	if err != nil {
-		return false, nil, err
-	}
-	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
-	res, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return false, nil, err
-	}
-	defer res.Body.Close()
-	if res.StatusCode == http.StatusUnauthorized {
-		// The token is no longer valid!
-		return false, nil, nil
-	}
-	if res.StatusCode != http.StatusOK {
-		data, _ := io.ReadAll(res.Body)
-		return false, nil, xerrors.Errorf("status %d: body: %s", res.StatusCode, data)
-	}
-
-	var user *codersdk.GitAuthUser
-	if c.Type == codersdk.GitProviderGitHub {
-		var ghUser github.User
-		err = json.NewDecoder(res.Body).Decode(&ghUser)
-		if err == nil {
-			user = &codersdk.GitAuthUser{
-				Login:      ghUser.GetLogin(),
-				AvatarURL:  ghUser.GetAvatarURL(),
-				ProfileURL: ghUser.GetHTMLURL(),
-				Name:       ghUser.GetName(),
-			}
-		}
-	}
-
-	return true, user, nil
-}
-
-type AppInstallation struct {
-	ID int
-	// Login is the username of the installation.
-	Login string
-	// URL is a link to configure the app install.
-	URL string
-}
-
-// AppInstallations returns a list of app installations for the given token.
-// If the provider does not support app installations, it returns nil.
-func (c *Config) AppInstallations(ctx context.Context, token string) ([]codersdk.GitAuthAppInstallation, bool, error) {
-	if c.AppInstallationsURL == "" {
-		return nil, false, nil
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.AppInstallationsURL, nil)
-	if err != nil {
-		return nil, false, err
-	}
-	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
-	res, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return nil, false, err
-	}
-	defer res.Body.Close()
-	// It's possible the installation URL is misconfigured, so we don't
-	// want to return an error here.
-	if res.StatusCode != http.StatusOK {
-		return nil, false, nil
-	}
-	installs := []codersdk.GitAuthAppInstallation{}
-	if c.Type == codersdk.GitProviderGitHub {
-		var ghInstalls struct {
-			Installations []*github.Installation `json:"installations"`
-		}
-		err = json.NewDecoder(res.Body).Decode(&ghInstalls)
-		if err != nil {
-			return nil, false, err
-		}
-		for _, installation := range ghInstalls.Installations {
-			account := installation.GetAccount()
-			if account == nil {
-				continue
-			}
-			installs = append(installs, codersdk.GitAuthAppInstallation{
-				ID:           int(installation.GetID()),
-				ConfigureURL: installation.GetHTMLURL(),
-				Account: codersdk.GitAuthUser{
-					Login:      account.GetLogin(),
-					AvatarURL:  account.GetAvatarURL(),
-					ProfileURL: account.GetHTMLURL(),
-					Name:       account.GetName(),
-				},
-			})
-		}
-	}
-	return installs, true, nil
-}
-
-// ConvertConfig converts the SDK configuration entry format
-// to the parsed and ready-to-consume in coderd provider type.
-func ConvertConfig(entries []codersdk.GitAuthConfig, accessURL *url.URL) ([]*Config, error) {
-	ids := map[string]struct{}{}
-	configs := []*Config{}
-	for _, entry := range entries {
-		var typ codersdk.GitProvider
-		switch codersdk.GitProvider(entry.Type) {
-		case codersdk.GitProviderAzureDevops:
-			typ = codersdk.GitProviderAzureDevops
-		case codersdk.GitProviderBitBucket:
-			typ = codersdk.GitProviderBitBucket
-		case codersdk.GitProviderGitHub:
-			typ = codersdk.GitProviderGitHub
-		case codersdk.GitProviderGitLab:
-			typ = codersdk.GitProviderGitLab
-		default:
-			return nil, xerrors.Errorf("unknown git provider type: %q", entry.Type)
-		}
-		if entry.ID == "" {
-			// Default to the type.
-			entry.ID = string(typ)
-		}
-		if valid := httpapi.NameValid(entry.ID); valid != nil {
-			return nil, xerrors.Errorf("git auth provider %q doesn't have a valid id: %w", entry.ID, valid)
-		}
-
-		_, exists := ids[entry.ID]
-		if exists {
-			if entry.ID == string(typ) {
-				return nil, xerrors.Errorf("multiple %s git auth providers provided. you must specify a unique id for each", typ)
-			}
-			return nil, xerrors.Errorf("multiple git providers exist with the id %q. specify a unique id for each", entry.ID)
-		}
-		ids[entry.ID] = struct{}{}
-
-		if entry.ClientID == "" {
-			return nil, xerrors.Errorf("%q git auth provider: client_id must be provided", entry.ID)
-		}
-		authRedirect, err := accessURL.Parse(fmt.Sprintf("/gitauth/%s/callback", entry.ID))
-		if err != nil {
-			return nil, xerrors.Errorf("parse gitauth callback url: %w", err)
-		}
-		regex := regex[typ]
-		if entry.Regex != "" {
-			regex, err = regexp.Compile(entry.Regex)
-			if err != nil {
-				return nil, xerrors.Errorf("compile regex for git auth provider %q: %w", entry.ID, entry.Regex)
-			}
-		}
-
-		oc := &oauth2.Config{
-			ClientID:     entry.ClientID,
-			ClientSecret: entry.ClientSecret,
-			Endpoint:     endpoint[typ],
-			RedirectURL:  authRedirect.String(),
-			Scopes:       scope[typ],
-		}
-
-		if entry.AuthURL != "" {
-			oc.Endpoint.AuthURL = entry.AuthURL
-		}
-		if entry.TokenURL != "" {
-			oc.Endpoint.TokenURL = entry.TokenURL
-		}
-		if entry.Scopes != nil && len(entry.Scopes) > 0 {
-			oc.Scopes = entry.Scopes
-		}
-		if entry.ValidateURL == "" {
-			entry.ValidateURL = validateURL[typ]
-		}
-		if entry.AppInstallationsURL == "" {
-			entry.AppInstallationsURL = appInstallationsURL[typ]
-		}
-
-		var oauthConfig OAuth2Config = oc
-		// Azure DevOps uses JWT token authentication!
-		if typ == codersdk.GitProviderAzureDevops {
-			oauthConfig = &jwtConfig{oc}
-		}
-
-		cfg := &Config{
-			OAuth2Config:        oauthConfig,
-			ID:                  entry.ID,
-			Regex:               regex,
-			Type:                typ,
-			NoRefresh:           entry.NoRefresh,
-			ValidateURL:         entry.ValidateURL,
-			AppInstallationsURL: entry.AppInstallationsURL,
-			AppInstallURL:       entry.AppInstallURL,
-		}
-
-		if entry.DeviceFlow {
-			if entry.DeviceCodeURL == "" {
-				entry.DeviceCodeURL = deviceAuthURL[typ]
-			}
-			if entry.DeviceCodeURL == "" {
-				return nil, xerrors.Errorf("git auth provider %q: device auth url must be provided", entry.ID)
-			}
-			cfg.DeviceAuth = &DeviceAuth{
-				ClientID: entry.ClientID,
-				TokenURL: oc.Endpoint.TokenURL,
-				Scopes:   entry.Scopes,
-				CodeURL:  entry.DeviceCodeURL,
-			}
-		}
-
-		configs = append(configs, cfg)
-	}
-	return configs, nil
-}
diff --git a/coderd/gitauth/config_test.go b/coderd/gitauth/config_test.go
deleted file mode 100644
index 31d6392341426..0000000000000
--- a/coderd/gitauth/config_test.go
+++ /dev/null
@@ -1,201 +0,0 @@
-package gitauth_test
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"golang.org/x/oauth2"
-	"golang.org/x/xerrors"
-
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
-)
-
-func TestRefreshToken(t *testing.T) {
-	t.Parallel()
-	t.Run("FalseIfNoRefresh", func(t *testing.T) {
-		t.Parallel()
-		config := &gitauth.Config{
-			NoRefresh: true,
-		}
-		_, refreshed, err := config.RefreshToken(context.Background(), nil, database.GitAuthLink{
-			OAuthExpiry: time.Time{},
-		})
-		require.NoError(t, err)
-		require.False(t, refreshed)
-	})
-	t.Run("FalseIfTokenSourceFails", func(t *testing.T) {
-		t.Parallel()
-		config := &gitauth.Config{
-			OAuth2Config: &testutil.OAuth2Config{
-				TokenSourceFunc: func() (*oauth2.Token, error) {
-					return nil, xerrors.New("failure")
-				},
-			},
-		}
-		_, refreshed, err := config.RefreshToken(context.Background(), nil, database.GitAuthLink{})
-		require.NoError(t, err)
-		require.False(t, refreshed)
-	})
-	t.Run("ValidateServerError", func(t *testing.T) {
-		t.Parallel()
-		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(http.StatusInternalServerError)
-			w.Write([]byte("Failure"))
-		}))
-		config := &gitauth.Config{
-			OAuth2Config: &testutil.OAuth2Config{},
-			ValidateURL:  srv.URL,
-		}
-		_, _, err := config.RefreshToken(context.Background(), nil, database.GitAuthLink{})
-		require.ErrorContains(t, err, "Failure")
-	})
-	t.Run("ValidateFailure", func(t *testing.T) {
-		t.Parallel()
-		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(http.StatusUnauthorized)
-			w.Write([]byte("Not permitted"))
-		}))
-		config := &gitauth.Config{
-			OAuth2Config: &testutil.OAuth2Config{},
-			ValidateURL:  srv.URL,
-		}
-		_, refreshed, err := config.RefreshToken(context.Background(), nil, database.GitAuthLink{})
-		require.NoError(t, err)
-		require.False(t, refreshed)
-	})
-	t.Run("ValidateNoUpdate", func(t *testing.T) {
-		t.Parallel()
-		validated := make(chan struct{})
-		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(http.StatusOK)
-			close(validated)
-		}))
-		accessToken := "testing"
-		config := &gitauth.Config{
-			OAuth2Config: &testutil.OAuth2Config{
-				Token: &oauth2.Token{
-					AccessToken: accessToken,
-				},
-			},
-			ValidateURL: srv.URL,
-		}
-		_, valid, err := config.RefreshToken(context.Background(), nil, database.GitAuthLink{
-			OAuthAccessToken: accessToken,
-		})
-		require.NoError(t, err)
-		require.True(t, valid)
-		<-validated
-	})
-	t.Run("Updates", func(t *testing.T) {
-		t.Parallel()
-		config := &gitauth.Config{
-			ID: "test",
-			OAuth2Config: &testutil.OAuth2Config{
-				Token: &oauth2.Token{
-					AccessToken: "updated",
-				},
-			},
-		}
-		db := dbfake.New()
-		link := dbgen.GitAuthLink(t, db, database.GitAuthLink{
-			ProviderID:       config.ID,
-			OAuthAccessToken: "initial",
-		})
-		_, valid, err := config.RefreshToken(context.Background(), db, link)
-		require.NoError(t, err)
-		require.True(t, valid)
-	})
-}
-
-func TestConvertYAML(t *testing.T) {
-	t.Parallel()
-	for _, tc := range []struct {
-		Name   string
-		Input  []codersdk.GitAuthConfig
-		Output []*gitauth.Config
-		Error  string
-	}{{
-		Name: "InvalidType",
-		Input: []codersdk.GitAuthConfig{{
-			Type: "moo",
-		}},
-		Error: "unknown git provider type",
-	}, {
-		Name: "InvalidID",
-		Input: []codersdk.GitAuthConfig{{
-			Type: string(codersdk.GitProviderGitHub),
-			ID:   "$hi$",
-		}},
-		Error: "doesn't have a valid id",
-	}, {
-		Name: "NoClientID",
-		Input: []codersdk.GitAuthConfig{{
-			Type: string(codersdk.GitProviderGitHub),
-		}},
-		Error: "client_id must be provided",
-	}, {
-		Name: "DuplicateType",
-		Input: []codersdk.GitAuthConfig{{
-			Type:         string(codersdk.GitProviderGitHub),
-			ClientID:     "example",
-			ClientSecret: "example",
-		}, {
-			Type: string(codersdk.GitProviderGitHub),
-		}},
-		Error: "multiple github git auth providers provided",
-	}, {
-		Name: "InvalidRegex",
-		Input: []codersdk.GitAuthConfig{{
-			Type:         string(codersdk.GitProviderGitHub),
-			ClientID:     "example",
-			ClientSecret: "example",
-			Regex:        `\K`,
-		}},
-		Error: "compile regex for git auth provider",
-	}, {
-		Name: "NoDeviceURL",
-		Input: []codersdk.GitAuthConfig{{
-			Type:         string(codersdk.GitProviderGitLab),
-			ClientID:     "example",
-			ClientSecret: "example",
-			DeviceFlow:   true,
-		}},
-		Error: "device auth url must be provided",
-	}} {
-		tc := tc
-		t.Run(tc.Name, func(t *testing.T) {
-			t.Parallel()
-			output, err := gitauth.ConvertConfig(tc.Input, &url.URL{})
-			if tc.Error != "" {
-				require.Error(t, err)
-				require.Contains(t, err.Error(), tc.Error)
-				return
-			}
-			require.Equal(t, tc.Output, output)
-		})
-	}
-
-	t.Run("CustomScopesAndEndpoint", func(t *testing.T) {
-		t.Parallel()
-		config, err := gitauth.ConvertConfig([]codersdk.GitAuthConfig{{
-			Type:         string(codersdk.GitProviderGitLab),
-			ClientID:     "id",
-			ClientSecret: "secret",
-			AuthURL:      "https://auth.com",
-			TokenURL:     "https://token.com",
-			Scopes:       []string{"read"},
-		}}, &url.URL{})
-		require.NoError(t, err)
-		require.Equal(t, "https://auth.com?client_id=id&redirect_uri=%2Fgitauth%2Fgitlab%2Fcallback&response_type=code&scope=read", config[0].AuthCodeURL(""))
-	})
-}
diff --git a/coderd/gitauth/oauth.go b/coderd/gitauth/oauth.go
deleted file mode 100644
index daba6a8faf075..0000000000000
--- a/coderd/gitauth/oauth.go
+++ /dev/null
@@ -1,212 +0,0 @@
-package gitauth
-
-import (
-	"context"
-	"encoding/json"
-	"net/http"
-	"net/url"
-	"regexp"
-	"time"
-
-	"golang.org/x/oauth2"
-	"golang.org/x/oauth2/github"
-	"golang.org/x/xerrors"
-
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
-)
-
-// endpoint contains default SaaS URLs for each Git provider.
-var endpoint = map[codersdk.GitProvider]oauth2.Endpoint{
-	codersdk.GitProviderAzureDevops: {
-		AuthURL:  "https://app.vssps.visualstudio.com/oauth2/authorize",
-		TokenURL: "https://app.vssps.visualstudio.com/oauth2/token",
-	},
-	codersdk.GitProviderBitBucket: {
-		AuthURL:  "https://bitbucket.org/site/oauth2/authorize",
-		TokenURL: "https://bitbucket.org/site/oauth2/access_token",
-	},
-	codersdk.GitProviderGitLab: {
-		AuthURL:  "https://gitlab.com/oauth/authorize",
-		TokenURL: "https://gitlab.com/oauth/token",
-	},
-	codersdk.GitProviderGitHub: github.Endpoint,
-}
-
-// validateURL contains defaults for each provider.
-var validateURL = map[codersdk.GitProvider]string{
-	codersdk.GitProviderGitHub:    "https://api.github.com/user",
-	codersdk.GitProviderGitLab:    "https://gitlab.com/oauth/token/info",
-	codersdk.GitProviderBitBucket: "https://api.bitbucket.org/2.0/user",
-}
-
-var deviceAuthURL = map[codersdk.GitProvider]string{
-	codersdk.GitProviderGitHub: "https://github.com/login/device/code",
-}
-
-var appInstallationsURL = map[codersdk.GitProvider]string{
-	codersdk.GitProviderGitHub: "https://api.github.com/user/installations",
-}
-
-// scope contains defaults for each Git provider.
-var scope = map[codersdk.GitProvider][]string{
-	codersdk.GitProviderAzureDevops: {"vso.code_write"},
-	codersdk.GitProviderBitBucket:   {"account", "repository:write"},
-	codersdk.GitProviderGitLab:      {"write_repository"},
-	// "workflow" is required for managing GitHub Actions in a repository.
-	codersdk.GitProviderGitHub: {"repo", "workflow"},
-}
-
-// regex provides defaults for each Git provider to match their SaaS host URL.
-// This is configurable by each provider.
-var regex = map[codersdk.GitProvider]*regexp.Regexp{
-	codersdk.GitProviderAzureDevops: regexp.MustCompile(`^(https?://)?dev\.azure\.com(/.*)?$`),
-	codersdk.GitProviderBitBucket:   regexp.MustCompile(`^(https?://)?bitbucket\.org(/.*)?$`),
-	codersdk.GitProviderGitLab:      regexp.MustCompile(`^(https?://)?gitlab\.com(/.*)?$`),
-	codersdk.GitProviderGitHub:      regexp.MustCompile(`^(https?://)?github\.com(/.*)?$`),
-}
-
-// jwtConfig is a new OAuth2 config that uses a custom
-// assertion method that works with Azure Devops. See:
-// https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops
-type jwtConfig struct {
-	*oauth2.Config
-}
-
-func (c *jwtConfig) AuthCodeURL(state string, opts ...oauth2.AuthCodeOption) string {
-	return c.Config.AuthCodeURL(state, append(opts, oauth2.SetAuthURLParam("response_type", "Assertion"))...)
-}
-
-func (c *jwtConfig) Exchange(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error) {
-	v := url.Values{
-		"client_assertion_type": {},
-		"client_assertion":      {c.ClientSecret},
-		"assertion":             {code},
-		"grant_type":            {},
-	}
-	if c.RedirectURL != "" {
-		v.Set("redirect_uri", c.RedirectURL)
-	}
-	return c.Config.Exchange(ctx, code,
-		append(opts,
-			oauth2.SetAuthURLParam("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),
-			oauth2.SetAuthURLParam("client_assertion", c.ClientSecret),
-			oauth2.SetAuthURLParam("assertion", code),
-			oauth2.SetAuthURLParam("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer"),
-			oauth2.SetAuthURLParam("code", ""),
-		)...,
-	)
-}
-
-type DeviceAuth struct {
-	ClientID string
-	TokenURL string
-	Scopes   []string
-	CodeURL  string
-}
-
-// AuthorizeDevice begins the device authorization flow.
-// See: https://tools.ietf.org/html/rfc8628#section-3.1
-func (c *DeviceAuth) AuthorizeDevice(ctx context.Context) (*codersdk.GitAuthDevice, error) {
-	if c.CodeURL == "" {
-		return nil, xerrors.New("oauth2: device code URL not set")
-	}
-	codeURL, err := c.formatDeviceCodeURL()
-	if err != nil {
-		return nil, err
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, codeURL, nil)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Accept", "application/json")
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-	var r struct {
-		codersdk.GitAuthDevice
-		ErrorDescription string `json:"error_description"`
-	}
-	err = json.NewDecoder(resp.Body).Decode(&r)
-	if err != nil {
-		return nil, err
-	}
-	if r.ErrorDescription != "" {
-		return nil, xerrors.New(r.ErrorDescription)
-	}
-	return &r.GitAuthDevice, nil
-}
-
-type ExchangeDeviceCodeResponse struct {
-	AccessToken      string `json:"access_token"`
-	RefreshToken     string `json:"refresh_token"`
-	ExpiresIn        int    `json:"expires_in"`
-	Error            string `json:"error"`
-	ErrorDescription string `json:"error_description"`
-}
-
-// ExchangeDeviceCode exchanges a device code for an access token.
-// The boolean returned indicates whether the device code is still pending
-// and the caller should try again.
-func (c *DeviceAuth) ExchangeDeviceCode(ctx context.Context, deviceCode string) (*oauth2.Token, error) {
-	if c.TokenURL == "" {
-		return nil, xerrors.New("oauth2: token URL not set")
-	}
-	tokenURL, err := c.formatDeviceTokenURL(deviceCode)
-	if err != nil {
-		return nil, err
-	}
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, tokenURL, nil)
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Accept", "application/json")
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return nil, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return nil, codersdk.ReadBodyAsError(resp)
-	}
-	var body ExchangeDeviceCodeResponse
-	err = json.NewDecoder(resp.Body).Decode(&body)
-	if err != nil {
-		return nil, err
-	}
-	if body.Error != "" {
-		return nil, xerrors.New(body.Error)
-	}
-	return &oauth2.Token{
-		AccessToken:  body.AccessToken,
-		RefreshToken: body.RefreshToken,
-		Expiry:       database.Now().Add(time.Duration(body.ExpiresIn) * time.Second),
-	}, nil
-}
-
-func (c *DeviceAuth) formatDeviceTokenURL(deviceCode string) (string, error) {
-	tok, err := url.Parse(c.TokenURL)
-	if err != nil {
-		return "", err
-	}
-	tok.RawQuery = url.Values{
-		"client_id":   {c.ClientID},
-		"device_code": {deviceCode},
-		"grant_type":  {"urn:ietf:params:oauth:grant-type:device_code"},
-	}.Encode()
-	return tok.String(), nil
-}
-
-func (c *DeviceAuth) formatDeviceCodeURL() (string, error) {
-	cod, err := url.Parse(c.CodeURL)
-	if err != nil {
-		return "", err
-	}
-	cod.RawQuery = url.Values{
-		"client_id": {c.ClientID},
-		"scope":     c.Scopes,
-	}.Encode()
-	return cod.String(), nil
-}
diff --git a/coderd/gitauth/oauth_test.go b/coderd/gitauth/oauth_test.go
deleted file mode 100644
index b85baeb935ed5..0000000000000
--- a/coderd/gitauth/oauth_test.go
+++ /dev/null
@@ -1,9 +0,0 @@
-package gitauth_test
-
-import (
-	"testing"
-)
-
-func TestOAuthJWTConfig(t *testing.T) {
-	t.Parallel()
-}
diff --git a/coderd/gitauth_test.go b/coderd/gitauth_test.go
deleted file mode 100644
index 578f7bea145c5..0000000000000
--- a/coderd/gitauth_test.go
+++ /dev/null
@@ -1,479 +0,0 @@
-package coderd_test
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"regexp"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/google/go-github/v43/github"
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/oauth2"
-
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
-)
-
-func TestGitAuthByID(t *testing.T) {
-	t.Parallel()
-	t.Run("Unauthenticated", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{
-			GitAuthConfigs: []*gitauth.Config{{
-				ID:           "test",
-				OAuth2Config: &testutil.OAuth2Config{},
-				Type:         codersdk.GitProviderGitHub,
-			}},
-		})
-		coderdtest.CreateFirstUser(t, client)
-		auth, err := client.GitAuthByID(context.Background(), "test")
-		require.NoError(t, err)
-		require.False(t, auth.Authenticated)
-	})
-	t.Run("AuthenticatedNoUser", func(t *testing.T) {
-		// Ensures that a provider that can't obtain a user can
-		// still return that the provider is authenticated.
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{
-			GitAuthConfigs: []*gitauth.Config{{
-				ID:           "test",
-				OAuth2Config: &testutil.OAuth2Config{},
-				// AzureDevops doesn't have a user endpoint!
-				Type: codersdk.GitProviderAzureDevops,
-			}},
-		})
-		coderdtest.CreateFirstUser(t, client)
-		resp := coderdtest.RequestGitAuthCallback(t, "test", client)
-		_ = resp.Body.Close()
-		auth, err := client.GitAuthByID(context.Background(), "test")
-		require.NoError(t, err)
-		require.True(t, auth.Authenticated)
-	})
-	t.Run("AuthenticatedWithUser", func(t *testing.T) {
-		t.Parallel()
-		validateSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			httpapi.Write(r.Context(), w, http.StatusOK, github.User{
-				Login:     github.String("kyle"),
-				AvatarURL: github.String("https://avatars.githubusercontent.com/u/12345678?v=4"),
-			})
-		}))
-		defer validateSrv.Close()
-		client := coderdtest.New(t, &coderdtest.Options{
-			GitAuthConfigs: []*gitauth.Config{{
-				ID:           "test",
-				ValidateURL:  validateSrv.URL,
-				OAuth2Config: &testutil.OAuth2Config{},
-				Type:         codersdk.GitProviderGitHub,
-			}},
-		})
-		coderdtest.CreateFirstUser(t, client)
-		resp := coderdtest.RequestGitAuthCallback(t, "test", client)
-		_ = resp.Body.Close()
-		auth, err := client.GitAuthByID(context.Background(), "test")
-		require.NoError(t, err)
-		require.True(t, auth.Authenticated)
-		require.NotNil(t, auth.User)
-		require.Equal(t, "kyle", auth.User.Login)
-	})
-	t.Run("AuthenticatedWithInstalls", func(t *testing.T) {
-		t.Parallel()
-		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			switch r.URL.Path {
-			case "/user":
-				httpapi.Write(r.Context(), w, http.StatusOK, github.User{
-					Login:     github.String("kyle"),
-					AvatarURL: github.String("https://avatars.githubusercontent.com/u/12345678?v=4"),
-				})
-			case "/installs":
-				httpapi.Write(r.Context(), w, http.StatusOK, struct {
-					Installations []github.Installation `json:"installations"`
-				}{
-					Installations: []github.Installation{{
-						ID: github.Int64(12345678),
-						Account: &github.User{
-							Login: github.String("coder"),
-						},
-					}},
-				})
-			}
-		}))
-		defer srv.Close()
-		client := coderdtest.New(t, &coderdtest.Options{
-			GitAuthConfigs: []*gitauth.Config{{
-				ID:                  "test",
-				ValidateURL:         srv.URL + "/user",
-				AppInstallationsURL: srv.URL + "/installs",
-				OAuth2Config:        &testutil.OAuth2Config{},
-				Type:                codersdk.GitProviderGitHub,
-			}},
-		})
-		coderdtest.CreateFirstUser(t, client)
-		resp := coderdtest.RequestGitAuthCallback(t, "test", client)
-		_ = resp.Body.Close()
-		auth, err := client.GitAuthByID(context.Background(), "test")
-		require.NoError(t, err)
-		require.True(t, auth.Authenticated)
-		require.NotNil(t, auth.User)
-		require.Equal(t, "kyle", auth.User.Login)
-		require.NotNil(t, auth.AppInstallations)
-		require.Len(t, auth.AppInstallations, 1)
-	})
-}
-
-func TestGitAuthDevice(t *testing.T) {
-	t.Parallel()
-	t.Run("NotSupported", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{
-			GitAuthConfigs: []*gitauth.Config{{
-				ID: "test",
-			}},
-		})
-		coderdtest.CreateFirstUser(t, client)
-		_, err := client.GitAuthDeviceByID(context.Background(), "test")
-		var sdkErr *codersdk.Error
-		require.ErrorAs(t, err, &sdkErr)
-		require.Equal(t, http.StatusBadRequest, sdkErr.StatusCode())
-	})
-	t.Run("FetchCode", func(t *testing.T) {
-		t.Parallel()
-		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			httpapi.Write(r.Context(), w, http.StatusOK, codersdk.GitAuthDevice{
-				UserCode: "hey",
-			})
-		}))
-		defer srv.Close()
-		client := coderdtest.New(t, &coderdtest.Options{
-			GitAuthConfigs: []*gitauth.Config{{
-				ID: "test",
-				DeviceAuth: &gitauth.DeviceAuth{
-					ClientID: "test",
-					CodeURL:  srv.URL,
-					Scopes:   []string{"repo"},
-				},
-			}},
-		})
-		coderdtest.CreateFirstUser(t, client)
-		device, err := client.GitAuthDeviceByID(context.Background(), "test")
-		require.NoError(t, err)
-		require.Equal(t, "hey", device.UserCode)
-	})
-	t.Run("ExchangeCode", func(t *testing.T) {
-		t.Parallel()
-		resp := gitauth.ExchangeDeviceCodeResponse{
-			Error: "authorization_pending",
-		}
-		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			httpapi.Write(r.Context(), w, http.StatusOK, resp)
-		}))
-		defer srv.Close()
-		client := coderdtest.New(t, &coderdtest.Options{
-			GitAuthConfigs: []*gitauth.Config{{
-				ID: "test",
-				DeviceAuth: &gitauth.DeviceAuth{
-					ClientID: "test",
-					TokenURL: srv.URL,
-					Scopes:   []string{"repo"},
-				},
-			}},
-		})
-		coderdtest.CreateFirstUser(t, client)
-		err := client.GitAuthDeviceExchange(context.Background(), "test", codersdk.GitAuthDeviceExchange{
-			DeviceCode: "hey",
-		})
-		var sdkErr *codersdk.Error
-		require.ErrorAs(t, err, &sdkErr)
-		require.Equal(t, http.StatusBadRequest, sdkErr.StatusCode())
-		require.Equal(t, "authorization_pending", sdkErr.Detail)
-
-		resp = gitauth.ExchangeDeviceCodeResponse{
-			AccessToken: "hey",
-		}
-
-		err = client.GitAuthDeviceExchange(context.Background(), "test", codersdk.GitAuthDeviceExchange{
-			DeviceCode: "hey",
-		})
-		require.NoError(t, err)
-
-		auth, err := client.GitAuthByID(context.Background(), "test")
-		require.NoError(t, err)
-		require.True(t, auth.Authenticated)
-	})
-}
-
-// nolint:bodyclose
-func TestGitAuthCallback(t *testing.T) {
-	t.Parallel()
-	t.Run("NoMatchingConfig", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{
-			IncludeProvisionerDaemon: true,
-			GitAuthConfigs:           []*gitauth.Config{},
-		})
-		user := coderdtest.CreateFirstUser(t, client)
-		authToken := uuid.NewString()
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
-		})
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(authToken)
-		_, err := agentClient.GitAuth(context.Background(), "github.com", false)
-		var apiError *codersdk.Error
-		require.ErrorAs(t, err, &apiError)
-		require.Equal(t, http.StatusNotFound, apiError.StatusCode())
-	})
-	t.Run("ReturnsURL", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{
-			IncludeProvisionerDaemon: true,
-			GitAuthConfigs: []*gitauth.Config{{
-				OAuth2Config: &testutil.OAuth2Config{},
-				ID:           "github",
-				Regex:        regexp.MustCompile(`github\.com`),
-				Type:         codersdk.GitProviderGitHub,
-			}},
-		})
-		user := coderdtest.CreateFirstUser(t, client)
-		authToken := uuid.NewString()
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Resources: []*proto.Resource{{
-							Name: "example",
-							Type: "aws_instance",
-							Agents: []*proto.Agent{{
-								Id: uuid.NewString(),
-								Auth: &proto.Agent_Token{
-									Token: authToken,
-								},
-							}},
-						}},
-					},
-				},
-			}},
-		})
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(authToken)
-		token, err := agentClient.GitAuth(context.Background(), "github.com/asd/asd", false)
-		require.NoError(t, err)
-		require.True(t, strings.HasSuffix(token.URL, fmt.Sprintf("/gitauth/%s", "github")))
-	})
-	t.Run("UnauthorizedCallback", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{
-			IncludeProvisionerDaemon: true,
-			GitAuthConfigs: []*gitauth.Config{{
-				OAuth2Config: &testutil.OAuth2Config{},
-				ID:           "github",
-				Regex:        regexp.MustCompile(`github\.com`),
-				Type:         codersdk.GitProviderGitHub,
-			}},
-		})
-		resp := coderdtest.RequestGitAuthCallback(t, "github", client)
-		require.Equal(t, http.StatusSeeOther, resp.StatusCode)
-	})
-	t.Run("AuthorizedCallback", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{
-			IncludeProvisionerDaemon: true,
-			GitAuthConfigs: []*gitauth.Config{{
-				OAuth2Config: &testutil.OAuth2Config{},
-				ID:           "github",
-				Regex:        regexp.MustCompile(`github\.com`),
-				Type:         codersdk.GitProviderGitHub,
-			}},
-		})
-		_ = coderdtest.CreateFirstUser(t, client)
-		resp := coderdtest.RequestGitAuthCallback(t, "github", client)
-		require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
-		location, err := resp.Location()
-		require.NoError(t, err)
-		require.Equal(t, "/gitauth/github", location.Path)
-
-		// Callback again to simulate updating the token.
-		resp = coderdtest.RequestGitAuthCallback(t, "github", client)
-		require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
-	})
-	t.Run("ValidateURL", func(t *testing.T) {
-		t.Parallel()
-		ctx := testutil.Context(t, testutil.WaitLong)
-
-		srv := httptest.NewServer(nil)
-		defer srv.Close()
-		client := coderdtest.New(t, &coderdtest.Options{
-			IncludeProvisionerDaemon: true,
-			GitAuthConfigs: []*gitauth.Config{{
-				ValidateURL:  srv.URL,
-				OAuth2Config: &testutil.OAuth2Config{},
-				ID:           "github",
-				Regex:        regexp.MustCompile(`github\.com`),
-				Type:         codersdk.GitProviderGitHub,
-			}},
-		})
-		user := coderdtest.CreateFirstUser(t, client)
-		authToken := uuid.NewString()
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
-		})
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(authToken)
-
-		resp := coderdtest.RequestGitAuthCallback(t, "github", client)
-		require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
-
-		// If the validation URL says unauthorized, the callback
-		// URL to re-authenticate should be returned.
-		srv.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(http.StatusUnauthorized)
-		})
-		res, err := agentClient.GitAuth(ctx, "github.com/asd/asd", false)
-		require.NoError(t, err)
-		require.NotEmpty(t, res.URL)
-
-		// If the validation URL gives a non-OK status code, this
-		// should be treated as an internal server error.
-		srv.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(http.StatusForbidden)
-			w.Write([]byte("Something went wrong!"))
-		})
-		_, err = agentClient.GitAuth(ctx, "github.com/asd/asd", false)
-		var apiError *codersdk.Error
-		require.ErrorAs(t, err, &apiError)
-		require.Equal(t, http.StatusInternalServerError, apiError.StatusCode())
-		require.Equal(t, "validate git auth token: status 403: body: Something went wrong!", apiError.Detail)
-	})
-
-	t.Run("ExpiredNoRefresh", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{
-			IncludeProvisionerDaemon: true,
-			GitAuthConfigs: []*gitauth.Config{{
-				OAuth2Config: &testutil.OAuth2Config{
-					Token: &oauth2.Token{
-						AccessToken:  "token",
-						RefreshToken: "something",
-						Expiry:       database.Now().Add(-time.Hour),
-					},
-				},
-				ID:        "github",
-				Regex:     regexp.MustCompile(`github\.com`),
-				Type:      codersdk.GitProviderGitHub,
-				NoRefresh: true,
-			}},
-		})
-		user := coderdtest.CreateFirstUser(t, client)
-		authToken := uuid.NewString()
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
-		})
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(authToken)
-
-		token, err := agentClient.GitAuth(context.Background(), "github.com/asd/asd", false)
-		require.NoError(t, err)
-		require.NotEmpty(t, token.URL)
-
-		// In the configuration, we set our OAuth provider
-		// to return an expired token. Coder consumes this
-		// and stores it.
-		resp := coderdtest.RequestGitAuthCallback(t, "github", client)
-		require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
-
-		// Because the token is expired and `NoRefresh` is specified,
-		// a redirect URL should be returned again.
-		token, err = agentClient.GitAuth(context.Background(), "github.com/asd/asd", false)
-		require.NoError(t, err)
-		require.NotEmpty(t, token.URL)
-	})
-
-	t.Run("FullFlow", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{
-			IncludeProvisionerDaemon: true,
-			GitAuthConfigs: []*gitauth.Config{{
-				OAuth2Config: &testutil.OAuth2Config{},
-				ID:           "github",
-				Regex:        regexp.MustCompile(`github\.com`),
-				Type:         codersdk.GitProviderGitHub,
-			}},
-		})
-		user := coderdtest.CreateFirstUser(t, client)
-		authToken := uuid.NewString()
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
-		})
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(authToken)
-
-		token, err := agentClient.GitAuth(context.Background(), "github.com/asd/asd", false)
-		require.NoError(t, err)
-		require.NotEmpty(t, token.URL)
-
-		// Start waiting for the token callback...
-		tokenChan := make(chan agentsdk.GitAuthResponse, 1)
-		go func() {
-			token, err := agentClient.GitAuth(context.Background(), "github.com/asd/asd", true)
-			assert.NoError(t, err)
-			tokenChan <- token
-		}()
-
-		time.Sleep(250 * time.Millisecond)
-
-		resp := coderdtest.RequestGitAuthCallback(t, "github", client)
-		require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
-		token = <-tokenChan
-		require.Equal(t, "access_token", token.Username)
-
-		token, err = agentClient.GitAuth(context.Background(), "github.com/asd/asd", false)
-		require.NoError(t, err)
-	})
-}
diff --git a/coderd/gitsshkey.go b/coderd/gitsshkey.go
index 096844caa0a28..110c16c7409d2 100644
--- a/coderd/gitsshkey.go
+++ b/coderd/gitsshkey.go
@@ -3,13 +3,14 @@ package coderd
 import (
 	"net/http"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/gitsshkey"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/gitsshkey"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
 )
 
 // @Summary Regenerate user SSH key
@@ -53,7 +54,7 @@ func (api *API) regenerateGitSSHKey(rw http.ResponseWriter, r *http.Request) {
 
 	newKey, err := api.Database.UpdateGitSSHKey(ctx, database.UpdateGitSSHKeyParams{
 		UserID:     user.ID,
-		UpdatedAt:  database.Now(),
+		UpdatedAt:  dbtime.Now(),
 		PrivateKey: privateKey,
 		PublicKey:  publicKey,
 	})
diff --git a/coderd/gitsshkey/gitsshkey_test.go b/coderd/gitsshkey/gitsshkey_test.go
index e5dc9b9c6faf8..88ddbfc598930 100644
--- a/coderd/gitsshkey/gitsshkey_test.go
+++ b/coderd/gitsshkey/gitsshkey_test.go
@@ -6,8 +6,8 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
 
-	"github.com/coder/coder/coderd/gitsshkey"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd/gitsshkey"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 func TestGitSSHKeys(t *testing.T) {
diff --git a/coderd/gitsshkey_test.go b/coderd/gitsshkey_test.go
index 42b227869c7a7..6637a20ef7a92 100644
--- a/coderd/gitsshkey_test.go
+++ b/coderd/gitsshkey_test.go
@@ -8,13 +8,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/gitsshkey"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/gitsshkey"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestGitSSHKey(t *testing.T) {
@@ -108,13 +108,13 @@ func TestAgentGitSSHKey(t *testing.T) {
 	authToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:          echo.ParseComplete,
-		ProvisionPlan:  echo.ProvisionComplete,
+		ProvisionPlan:  echo.PlanComplete,
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
 	project := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	agentClient := agentsdk.New(client.URL)
 	agentClient.SetSessionToken(authToken)
diff --git a/coderd/healthcheck/accessurl.go b/coderd/healthcheck/accessurl.go
index b91889b2842a2..6f86944b7ca4e 100644
--- a/coderd/healthcheck/accessurl.go
+++ b/coderd/healthcheck/accessurl.go
@@ -9,7 +9,7 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/util/ptr"
+	"github.com/coder/coder/v2/coderd/util/ptr"
 )
 
 // @typescript-generate AccessURLReport
diff --git a/coderd/healthcheck/accessurl_test.go b/coderd/healthcheck/accessurl_test.go
index 6097d6cb50810..3464030b61eb1 100644
--- a/coderd/healthcheck/accessurl_test.go
+++ b/coderd/healthcheck/accessurl_test.go
@@ -11,8 +11,8 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/healthcheck"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/healthcheck"
 )
 
 func TestAccessURL(t *testing.T) {
diff --git a/coderd/healthcheck/database.go b/coderd/healthcheck/database.go
index c92ef3c447d56..70005dc5b3d9f 100644
--- a/coderd/healthcheck/database.go
+++ b/coderd/healthcheck/database.go
@@ -7,7 +7,7 @@ import (
 	"golang.org/x/exp/slices"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/database"
 )
 
 // @typescript-generate DatabaseReport
diff --git a/coderd/healthcheck/database_test.go b/coderd/healthcheck/database_test.go
index 615728a8b573b..f6c2782aacacd 100644
--- a/coderd/healthcheck/database_test.go
+++ b/coderd/healthcheck/database_test.go
@@ -10,9 +10,9 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database/dbmock"
-	"github.com/coder/coder/coderd/healthcheck"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database/dbmock"
+	"github.com/coder/coder/v2/coderd/healthcheck"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestDatabase(t *testing.T) {
diff --git a/coderd/healthcheck/derp.go b/coderd/healthcheck/derphealth/derp.go
similarity index 86%
rename from coderd/healthcheck/derp.go
rename to coderd/healthcheck/derphealth/derp.go
index 9fc88a37e40db..2570b9fcb10f0 100644
--- a/coderd/healthcheck/derp.go
+++ b/coderd/healthcheck/derphealth/derp.go
@@ -1,4 +1,4 @@
-package healthcheck
+package derphealth
 
 import (
 	"context"
@@ -21,14 +21,14 @@ import (
 	"tailscale.com/types/key"
 	tslogger "tailscale.com/types/logger"
 
-	"github.com/coder/coder/coderd/util/ptr"
+	"github.com/coder/coder/v2/coderd/util/ptr"
 )
 
-// @typescript-generate DERPReport
-type DERPReport struct {
+// @typescript-generate Report
+type Report struct {
 	Healthy bool `json:"healthy"`
 
-	Regions map[int]*DERPRegionReport `json:"regions"`
+	Regions map[int]*RegionReport `json:"regions"`
 
 	Netcheck     *netcheck.Report `json:"netcheck"`
 	NetcheckErr  *string          `json:"netcheck_err"`
@@ -37,18 +37,18 @@ type DERPReport struct {
 	Error *string `json:"error"`
 }
 
-// @typescript-generate DERPRegionReport
-type DERPRegionReport struct {
+// @typescript-generate RegionReport
+type RegionReport struct {
 	mu      sync.Mutex
 	Healthy bool `json:"healthy"`
 
 	Region      *tailcfg.DERPRegion `json:"region"`
-	NodeReports []*DERPNodeReport   `json:"node_reports"`
+	NodeReports []*NodeReport       `json:"node_reports"`
 	Error       *string             `json:"error"`
 }
 
-// @typescript-generate DERPNodeReport
-type DERPNodeReport struct {
+// @typescript-generate NodeReport
+type NodeReport struct {
 	mu            sync.Mutex
 	clientCounter int
 
@@ -64,23 +64,23 @@ type DERPNodeReport struct {
 	ClientErrs          [][]string             `json:"client_errs"`
 	Error               *string                `json:"error"`
 
-	STUN DERPStunReport `json:"stun"`
+	STUN StunReport `json:"stun"`
 }
 
-// @typescript-generate DERPStunReport
-type DERPStunReport struct {
+// @typescript-generate StunReport
+type StunReport struct {
 	Enabled bool
 	CanSTUN bool
 	Error   *string
 }
 
-type DERPReportOptions struct {
+type ReportOptions struct {
 	DERPMap *tailcfg.DERPMap
 }
 
-func (r *DERPReport) Run(ctx context.Context, opts *DERPReportOptions) {
+func (r *Report) Run(ctx context.Context, opts *ReportOptions) {
 	r.Healthy = true
-	r.Regions = map[int]*DERPRegionReport{}
+	r.Regions = map[int]*RegionReport{}
 
 	wg := &sync.WaitGroup{}
 	mu := sync.Mutex{}
@@ -89,7 +89,7 @@ func (r *DERPReport) Run(ctx context.Context, opts *DERPReportOptions) {
 	for _, region := range opts.DERPMap.Regions {
 		var (
 			region       = region
-			regionReport = DERPRegionReport{
+			regionReport = RegionReport{
 				Region: region,
 			}
 		)
@@ -118,7 +118,7 @@ func (r *DERPReport) Run(ctx context.Context, opts *DERPReportOptions) {
 		mu.Unlock()
 	}
 	nc := &netcheck.Client{
-		PortMapper: portmapper.NewClient(tslogger.WithPrefix(ncLogf, "portmap: "), nil),
+		PortMapper: portmapper.NewClient(tslogger.WithPrefix(ncLogf, "portmap: "), nil, nil, nil),
 		Logf:       tslogger.WithPrefix(ncLogf, "netcheck: "),
 	}
 	ncReport, netcheckErr := nc.GetReport(ctx, opts.DERPMap)
@@ -128,9 +128,9 @@ func (r *DERPReport) Run(ctx context.Context, opts *DERPReportOptions) {
 	wg.Wait()
 }
 
-func (r *DERPRegionReport) Run(ctx context.Context) {
+func (r *RegionReport) Run(ctx context.Context) {
 	r.Healthy = true
-	r.NodeReports = []*DERPNodeReport{}
+	r.NodeReports = []*NodeReport{}
 
 	wg := &sync.WaitGroup{}
 
@@ -138,7 +138,7 @@ func (r *DERPRegionReport) Run(ctx context.Context) {
 	for _, node := range r.Region.Nodes {
 		var (
 			node       = node
-			nodeReport = DERPNodeReport{
+			nodeReport = NodeReport{
 				Node:    node,
 				Healthy: true,
 			}
@@ -166,7 +166,7 @@ func (r *DERPRegionReport) Run(ctx context.Context) {
 	wg.Wait()
 }
 
-func (r *DERPNodeReport) derpURL() *url.URL {
+func (r *NodeReport) derpURL() *url.URL {
 	derpURL := &url.URL{
 		Scheme: "https",
 		Host:   r.Node.HostName,
@@ -185,7 +185,7 @@ func (r *DERPNodeReport) derpURL() *url.URL {
 	return derpURL
 }
 
-func (r *DERPNodeReport) Run(ctx context.Context) {
+func (r *NodeReport) Run(ctx context.Context) {
 	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
 
@@ -218,7 +218,7 @@ func (r *DERPNodeReport) Run(ctx context.Context) {
 	}
 }
 
-func (r *DERPNodeReport) doExchangeMessage(ctx context.Context) {
+func (r *NodeReport) doExchangeMessage(ctx context.Context) {
 	if r.Node.STUNOnly {
 		return
 	}
@@ -299,7 +299,7 @@ func (r *DERPNodeReport) doExchangeMessage(ctx context.Context) {
 	wg.Wait()
 }
 
-func (r *DERPNodeReport) doSTUNTest(ctx context.Context) {
+func (r *NodeReport) doSTUNTest(ctx context.Context) {
 	if r.Node.STUNPort == -1 {
 		return
 	}
@@ -331,7 +331,7 @@ func (r *DERPNodeReport) doSTUNTest(ctx context.Context) {
 	r.mu.Unlock()
 }
 
-func (r *DERPNodeReport) stunAddr(ctx context.Context) (string, int, error) {
+func (r *NodeReport) stunAddr(ctx context.Context) (string, int, error) {
 	port := r.Node.STUNPort
 	if port == 0 {
 		port = 3478
@@ -387,13 +387,13 @@ func (r *DERPNodeReport) stunAddr(ctx context.Context) (string, int, error) {
 	return "", 0, xerrors.New("no stun ips provided")
 }
 
-func (r *DERPNodeReport) writeClientErr(clientID int, err error) {
+func (r *NodeReport) writeClientErr(clientID int, err error) {
 	r.mu.Lock()
 	r.ClientErrs[clientID] = append(r.ClientErrs[clientID], err.Error())
 	r.mu.Unlock()
 }
 
-func (r *DERPNodeReport) derpClient(ctx context.Context, derpURL *url.URL) (*derphttp.Client, int, error) {
+func (r *NodeReport) derpClient(ctx context.Context, derpURL *url.URL) (*derphttp.Client, int, error) {
 	r.mu.Lock()
 	id := r.clientCounter
 	r.clientCounter++
@@ -440,7 +440,7 @@ func (r *DERPNodeReport) derpClient(ctx context.Context, derpURL *url.URL) (*der
 	return client, id, nil
 }
 
-func (r *DERPNodeReport) recvData(client *derphttp.Client) (derp.ReceivedPacket, error) {
+func (r *NodeReport) recvData(client *derphttp.Client) (derp.ReceivedPacket, error) {
 	for {
 		msg, err := client.Recv()
 		if err != nil {
@@ -459,3 +459,11 @@ func (r *DERPNodeReport) recvData(client *derphttp.Client) (derp.ReceivedPacket,
 		}
 	}
 }
+
+func convertError(err error) *string {
+	if err != nil {
+		return ptr.Ref(err.Error())
+	}
+
+	return nil
+}
diff --git a/coderd/healthcheck/derp_test.go b/coderd/healthcheck/derphealth/derp_test.go
similarity index 92%
rename from coderd/healthcheck/derp_test.go
rename to coderd/healthcheck/derphealth/derp_test.go
index d27cdc182ec31..c526e2c512c47 100644
--- a/coderd/healthcheck/derp_test.go
+++ b/coderd/healthcheck/derphealth/derp_test.go
@@ -1,4 +1,4 @@
-package healthcheck_test
+package derphealth_test
 
 import (
 	"context"
@@ -17,9 +17,9 @@ import (
 	"tailscale.com/tailcfg"
 	"tailscale.com/types/key"
 
-	"github.com/coder/coder/coderd/healthcheck"
-	"github.com/coder/coder/tailnet"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/healthcheck/derphealth"
+	"github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/testutil"
 )
 
 //nolint:tparallel
@@ -38,9 +38,9 @@ func TestDERP(t *testing.T) {
 
 		var (
 			ctx        = context.Background()
-			report     = healthcheck.DERPReport{}
+			report     = derphealth.Report{}
 			derpURL, _ = url.Parse(srv.URL)
-			opts       = &healthcheck.DERPReportOptions{
+			opts       = &derphealth.ReportOptions{
 				DERPMap: &tailcfg.DERPMap{Regions: map[int]*tailcfg.DERPRegion{
 					1: {
 						EmbeddedRelay: true,
@@ -95,8 +95,8 @@ func TestDERP(t *testing.T) {
 
 		var (
 			ctx    = context.Background()
-			report = healthcheck.DERPReport{}
-			opts   = &healthcheck.DERPReportOptions{
+			report = derphealth.Report{}
+			opts   = &derphealth.ReportOptions{
 				DERPMap: tsDERPMap(ctx, t),
 			}
 		)
@@ -145,9 +145,9 @@ func TestDERP(t *testing.T) {
 
 		var (
 			ctx        = context.Background()
-			report     = healthcheck.DERPReport{}
+			report     = derphealth.Report{}
 			derpURL, _ = url.Parse(srv.URL)
-			opts       = &healthcheck.DERPReportOptions{
+			opts       = &derphealth.ReportOptions{
 				DERPMap: &tailcfg.DERPMap{Regions: map[int]*tailcfg.DERPRegion{
 					1: {
 						EmbeddedRelay: true,
@@ -195,8 +195,8 @@ func TestDERP(t *testing.T) {
 
 		var (
 			ctx    = context.Background()
-			report = healthcheck.DERPReport{}
-			opts   = &healthcheck.DERPReportOptions{
+			report = derphealth.Report{}
+			opts   = &derphealth.ReportOptions{
 				DERPMap: &tailcfg.DERPMap{Regions: map[int]*tailcfg.DERPRegion{
 					1: {
 						EmbeddedRelay: true,
diff --git a/coderd/healthcheck/healthcheck.go b/coderd/healthcheck/healthcheck.go
index 29a4398b8391c..61c6e40c1e1be 100644
--- a/coderd/healthcheck/healthcheck.go
+++ b/coderd/healthcheck/healthcheck.go
@@ -10,9 +10,10 @@ import (
 
 	"tailscale.com/tailcfg"
 
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/util/ptr"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/healthcheck/derphealth"
+	"github.com/coder/coder/v2/coderd/util/ptr"
 )
 
 const (
@@ -23,7 +24,7 @@ const (
 )
 
 type Checker interface {
-	DERP(ctx context.Context, opts *DERPReportOptions) DERPReport
+	DERP(ctx context.Context, opts *derphealth.ReportOptions) derphealth.Report
 	AccessURL(ctx context.Context, opts *AccessURLReportOptions) AccessURLReport
 	Websocket(ctx context.Context, opts *WebsocketReportOptions) WebsocketReport
 	Database(ctx context.Context, opts *DatabaseReportOptions) DatabaseReport
@@ -38,10 +39,10 @@ type Report struct {
 	// FailingSections is a list of sections that have failed their healthcheck.
 	FailingSections []string `json:"failing_sections"`
 
-	DERP      DERPReport      `json:"derp"`
-	AccessURL AccessURLReport `json:"access_url"`
-	Websocket WebsocketReport `json:"websocket"`
-	Database  DatabaseReport  `json:"database"`
+	DERP      derphealth.Report `json:"derp"`
+	AccessURL AccessURLReport   `json:"access_url"`
+	Websocket WebsocketReport   `json:"websocket"`
+	Database  DatabaseReport    `json:"database"`
 
 	// The Coder version of the server that the report was generated on.
 	CoderVersion string `json:"coder_version"`
@@ -60,7 +61,7 @@ type ReportOptions struct {
 
 type defaultChecker struct{}
 
-func (defaultChecker) DERP(ctx context.Context, opts *DERPReportOptions) (report DERPReport) {
+func (defaultChecker) DERP(ctx context.Context, opts *derphealth.ReportOptions) (report derphealth.Report) {
 	report.Run(ctx, opts)
 	return report
 }
@@ -99,7 +100,7 @@ func Run(ctx context.Context, opts *ReportOptions) *Report {
 			}
 		}()
 
-		report.DERP = opts.Checker.DERP(ctx, &DERPReportOptions{
+		report.DERP = opts.Checker.DERP(ctx, &derphealth.ReportOptions{
 			DERPMap: opts.DERPMap,
 		})
 	}()
diff --git a/coderd/healthcheck/healthcheck_test.go b/coderd/healthcheck/healthcheck_test.go
index 26be9021eaf46..f89f12116dc88 100644
--- a/coderd/healthcheck/healthcheck_test.go
+++ b/coderd/healthcheck/healthcheck_test.go
@@ -6,17 +6,18 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/coder/coder/coderd/healthcheck"
+	"github.com/coder/coder/v2/coderd/healthcheck"
+	"github.com/coder/coder/v2/coderd/healthcheck/derphealth"
 )
 
 type testChecker struct {
-	DERPReport      healthcheck.DERPReport
+	DERPReport      derphealth.Report
 	AccessURLReport healthcheck.AccessURLReport
 	WebsocketReport healthcheck.WebsocketReport
 	DatabaseReport  healthcheck.DatabaseReport
 }
 
-func (c *testChecker) DERP(context.Context, *healthcheck.DERPReportOptions) healthcheck.DERPReport {
+func (c *testChecker) DERP(context.Context, *derphealth.ReportOptions) derphealth.Report {
 	return c.DERPReport
 }
 
@@ -43,7 +44,7 @@ func TestHealthcheck(t *testing.T) {
 	}{{
 		name: "OK",
 		checker: &testChecker{
-			DERPReport: healthcheck.DERPReport{
+			DERPReport: derphealth.Report{
 				Healthy: true,
 			},
 			AccessURLReport: healthcheck.AccessURLReport{
@@ -61,7 +62,7 @@ func TestHealthcheck(t *testing.T) {
 	}, {
 		name: "DERPFail",
 		checker: &testChecker{
-			DERPReport: healthcheck.DERPReport{
+			DERPReport: derphealth.Report{
 				Healthy: false,
 			},
 			AccessURLReport: healthcheck.AccessURLReport{
@@ -79,7 +80,7 @@ func TestHealthcheck(t *testing.T) {
 	}, {
 		name: "AccessURLFail",
 		checker: &testChecker{
-			DERPReport: healthcheck.DERPReport{
+			DERPReport: derphealth.Report{
 				Healthy: true,
 			},
 			AccessURLReport: healthcheck.AccessURLReport{
@@ -97,7 +98,7 @@ func TestHealthcheck(t *testing.T) {
 	}, {
 		name: "WebsocketFail",
 		checker: &testChecker{
-			DERPReport: healthcheck.DERPReport{
+			DERPReport: derphealth.Report{
 				Healthy: true,
 			},
 			AccessURLReport: healthcheck.AccessURLReport{
@@ -115,7 +116,7 @@ func TestHealthcheck(t *testing.T) {
 	}, {
 		name: "DatabaseFail",
 		checker: &testChecker{
-			DERPReport: healthcheck.DERPReport{
+			DERPReport: derphealth.Report{
 				Healthy: true,
 			},
 			AccessURLReport: healthcheck.AccessURLReport{
diff --git a/coderd/healthcheck/websocket_test.go b/coderd/healthcheck/websocket_test.go
index cb56081197577..44df237a49cbb 100644
--- a/coderd/healthcheck/websocket_test.go
+++ b/coderd/healthcheck/websocket_test.go
@@ -11,8 +11,8 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/healthcheck"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/healthcheck"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestWebsocket(t *testing.T) {
diff --git a/coderd/httpapi/cookie.go b/coderd/httpapi/cookie.go
index 289ee2188cf06..526dfb8207fe7 100644
--- a/coderd/httpapi/cookie.go
+++ b/coderd/httpapi/cookie.go
@@ -4,7 +4,7 @@ import (
 	"net/textproto"
 	"strings"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // StripCoderCookies removes the session token from the cookie header provided.
@@ -23,8 +23,9 @@ func StripCoderCookies(header string) string {
 		if name == codersdk.SessionTokenCookie ||
 			name == codersdk.OAuth2StateCookie ||
 			name == codersdk.OAuth2RedirectCookie ||
-			name == codersdk.DevURLSessionTokenCookie ||
-			name == codersdk.DevURLSignedAppTokenCookie {
+			name == codersdk.PathAppSessionTokenCookie ||
+			name == codersdk.SubdomainAppSessionTokenCookie ||
+			name == codersdk.SignedAppTokenCookie {
 			continue
 		}
 		cookies = append(cookies, part)
diff --git a/coderd/httpapi/cookie_test.go b/coderd/httpapi/cookie_test.go
index 48c66abc439f0..4d44cd8f7d130 100644
--- a/coderd/httpapi/cookie_test.go
+++ b/coderd/httpapi/cookie_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpapi"
 )
 
 func TestStripCoderCookies(t *testing.T) {
diff --git a/coderd/httpapi/httpapi.go b/coderd/httpapi/httpapi.go
index b7559d5feeabe..cf89f6e509682 100644
--- a/coderd/httpapi/httpapi.go
+++ b/coderd/httpapi/httpapi.go
@@ -16,10 +16,9 @@ import (
 	"github.com/go-playground/validator/v10"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpapi/httpapiconstraints"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 var Validate *validator.Validate
@@ -90,7 +89,13 @@ func Is404Error(err error) bool {
 	if err == nil {
 		return false
 	}
-	return xerrors.Is(err, sql.ErrNoRows) || dbauthz.IsNotAuthorizedError(err) || rbac.IsUnauthorizedError(err)
+
+	// This tests for dbauthz.IsNotAuthorizedError and rbac.IsUnauthorizedError.
+	var unauthorized httpapiconstraints.IsUnauthorizedError
+	if errors.As(err, &unauthorized) && unauthorized.IsUnauthorized() {
+		return true
+	}
+	return xerrors.Is(err, sql.ErrNoRows)
 }
 
 // Convenience error functions don't take contexts since their responses are
diff --git a/coderd/httpapi/httpapi_test.go b/coderd/httpapi/httpapi_test.go
index ea6d5a92ea5be..635ed2bdc1e29 100644
--- a/coderd/httpapi/httpapi_test.go
+++ b/coderd/httpapi/httpapi_test.go
@@ -14,8 +14,8 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestInternalServerError(t *testing.T) {
diff --git a/coderd/httpapi/httpapiconstraints/httpapiconstraints.go b/coderd/httpapi/httpapiconstraints/httpapiconstraints.go
new file mode 100644
index 0000000000000..e4aeed1f113dc
--- /dev/null
+++ b/coderd/httpapi/httpapiconstraints/httpapiconstraints.go
@@ -0,0 +1,10 @@
+// Package httpapiconstraints contain types that can be used and implemented
+// across the application to return specific HTTP status codes without pulling
+// in large dependency trees.
+package httpapiconstraints
+
+// IsUnauthorizedError is an interface that can be implemented in other packages
+// in order to return 404.
+type IsUnauthorizedError interface {
+	IsUnauthorized() bool
+}
diff --git a/coderd/httpapi/json_test.go b/coderd/httpapi/json_test.go
index 62e5c546a0b4b..a0a93e884d44f 100644
--- a/coderd/httpapi/json_test.go
+++ b/coderd/httpapi/json_test.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpapi"
 )
 
 func TestDuration(t *testing.T) {
diff --git a/coderd/httpapi/name_test.go b/coderd/httpapi/name_test.go
index b78a15867ca53..e28115eecbbd7 100644
--- a/coderd/httpapi/name_test.go
+++ b/coderd/httpapi/name_test.go
@@ -6,7 +6,7 @@ import (
 	"github.com/moby/moby/pkg/namesgenerator"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpapi"
 )
 
 func TestUsernameValid(t *testing.T) {
diff --git a/coderd/httpapi/queryparams.go b/coderd/httpapi/queryparams.go
index 3f16565e1dd20..9b7daf2310900 100644
--- a/coderd/httpapi/queryparams.go
+++ b/coderd/httpapi/queryparams.go
@@ -10,8 +10,7 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // QueryParamParser is a helper for parsing all query params and gathering all
@@ -45,7 +44,7 @@ func (p *QueryParamParser) ErrorExcessParams(values url.Values) {
 		if _, ok := p.Parsed[k]; !ok {
 			p.Errors = append(p.Errors, codersdk.ValidationError{
 				Field:  k,
-				Detail: fmt.Sprintf("Query param %q is not a valid query param", k),
+				Detail: fmt.Sprintf("%q is not a valid query param", k),
 			})
 		}
 	}
@@ -80,6 +79,17 @@ func (p *QueryParamParser) Int(vals url.Values, def int, queryParam string) int
 	return v
 }
 
+func (p *QueryParamParser) Boolean(vals url.Values, def bool, queryParam string) bool {
+	v, err := parseQueryParam(p, vals, strconv.ParseBool, def, queryParam)
+	if err != nil {
+		p.Errors = append(p.Errors, codersdk.ValidationError{
+			Field:  queryParam,
+			Detail: fmt.Sprintf("Query param %q must be a valid boolean (%s)", queryParam, err.Error()),
+		})
+	}
+	return v
+}
+
 func (p *QueryParamParser) Required(queryParam string) *QueryParamParser {
 	p.RequiredParams[queryParam] = true
 	return p
@@ -158,10 +168,10 @@ func (p *QueryParamParser) Strings(vals url.Values, def []string, queryParam str
 	})
 }
 
-// ValidEnum parses enum query params. Add more to the list as needed.
+// ValidEnum represents an enum that can be parsed and validated.
 type ValidEnum interface {
-	database.ResourceType | database.AuditAction | database.BuildReason | database.UserStatus |
-		database.WorkspaceStatus
+	// Add more types as needed (avoid importing large dependency trees).
+	~string
 
 	// Valid is required on the enum type to be used with ParseEnum.
 	Valid() bool
diff --git a/coderd/httpapi/queryparams_test.go b/coderd/httpapi/queryparams_test.go
index ecf7b3a99cf40..f919b478dfd78 100644
--- a/coderd/httpapi/queryparams_test.go
+++ b/coderd/httpapi/queryparams_test.go
@@ -10,8 +10,8 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
 )
 
 type queryParamTestCase[T any] struct {
@@ -157,6 +157,48 @@ func TestParseQueryParams(t *testing.T) {
 		testQueryParams(t, expParams, parser, parser.String)
 	})
 
+	t.Run("Boolean", func(t *testing.T) {
+		t.Parallel()
+		expParams := []queryParamTestCase[bool]{
+			{
+				QueryParam: "valid_true",
+				Value:      "true",
+				Expected:   true,
+			},
+			{
+				QueryParam: "casing",
+				Value:      "True",
+				Expected:   true,
+			},
+			{
+				QueryParam: "all_caps",
+				Value:      "TRUE",
+				Expected:   true,
+			},
+			{
+				QueryParam: "no_value_true_def",
+				NoSet:      true,
+				Default:    true,
+				Expected:   true,
+			},
+			{
+				QueryParam: "no_value",
+				NoSet:      true,
+				Expected:   false,
+			},
+
+			{
+				QueryParam:            "invalid_boolean",
+				Value:                 "yes",
+				Expected:              false,
+				ExpectedErrorContains: "must be a valid boolean",
+			},
+		}
+
+		parser := httpapi.NewQueryParamParser()
+		testQueryParams(t, expParams, parser, parser.Boolean)
+	})
+
 	t.Run("Int", func(t *testing.T) {
 		t.Parallel()
 		expParams := []queryParamTestCase[int]{
diff --git a/coderd/httpapi/url.go b/coderd/httpapi/url.go
index d27abca5deaea..bbdb9af1802d8 100644
--- a/coderd/httpapi/url.go
+++ b/coderd/httpapi/url.go
@@ -22,6 +22,7 @@ var (
 
 // ApplicationURL is a parsed application URL hostname.
 type ApplicationURL struct {
+	Prefix        string
 	AppSlugOrPort string
 	AgentName     string
 	WorkspaceName string
@@ -31,7 +32,16 @@ type ApplicationURL struct {
 // String returns the application URL hostname without scheme. You will likely
 // want to append a period and the base hostname.
 func (a ApplicationURL) String() string {
-	return fmt.Sprintf("%s--%s--%s--%s", a.AppSlugOrPort, a.AgentName, a.WorkspaceName, a.Username)
+	var appURL strings.Builder
+	_, _ = appURL.WriteString(a.Prefix)
+	_, _ = appURL.WriteString(a.AppSlugOrPort)
+	_, _ = appURL.WriteString("--")
+	_, _ = appURL.WriteString(a.AgentName)
+	_, _ = appURL.WriteString("--")
+	_, _ = appURL.WriteString(a.WorkspaceName)
+	_, _ = appURL.WriteString("--")
+	_, _ = appURL.WriteString(a.Username)
+	return appURL.String()
 }
 
 // ParseSubdomainAppURL parses an ApplicationURL from the given subdomain. If
@@ -39,13 +49,34 @@ func (a ApplicationURL) String() string {
 // error. If the hostname is not a subdomain of the given base hostname, returns
 // a non-nil error.
 //
-// The base hostname should not include a scheme, leading asterisk or dot.
-//
 // Subdomains should be in the form:
 //
-//	{PORT/APP_SLUG}--{AGENT_NAME}--{WORKSPACE_NAME}--{USERNAME}
-//	(eg. https://8080--main--dev--dean.hi.c8s.io)
+//		({PREFIX}---)?{PORT/APP_SLUG}--{AGENT_NAME}--{WORKSPACE_NAME}--{USERNAME}
+//		e.g.
+//	     https://8080--main--dev--dean.hi.c8s.io
+//	     https://app--main--dev--dean.hi.c8s.io
+//	     https://prefix---8080--main--dev--dean.hi.c8s.io
+//	     https://prefix---app--main--dev--dean.hi.c8s.io
+//
+// The optional prefix is permitted to allow customers to put additional URL at
+// the beginning of their application URL (i.e. if they want to simulate
+// different subdomains on the same app/port).
+//
+// Prefix requires three hyphens at the end to separate it from the rest of the
+// URL so we can add/remove segments in the future from the parsing logic.
+//
+// TODO(dean): make the agent name optional when using the app slug. This will
+// reduce the character count for app URLs.
 func ParseSubdomainAppURL(subdomain string) (ApplicationURL, error) {
+	var (
+		prefixSegments = strings.Split(subdomain, "---")
+		prefix         = ""
+	)
+	if len(prefixSegments) > 1 {
+		prefix = strings.Join(prefixSegments[:len(prefixSegments)-1], "---") + "---"
+		subdomain = prefixSegments[len(prefixSegments)-1]
+	}
+
 	matches := appURL.FindAllStringSubmatch(subdomain, -1)
 	if len(matches) == 0 {
 		return ApplicationURL{}, xerrors.Errorf("invalid application url format: %q", subdomain)
@@ -53,6 +84,7 @@ func ParseSubdomainAppURL(subdomain string) (ApplicationURL, error) {
 	matchGroup := matches[0]
 
 	return ApplicationURL{
+		Prefix:        prefix,
 		AppSlugOrPort: matchGroup[appURL.SubexpIndex("AppSlug")],
 		AgentName:     matchGroup[appURL.SubexpIndex("AgentName")],
 		WorkspaceName: matchGroup[appURL.SubexpIndex("WorkspaceName")],
@@ -117,8 +149,12 @@ func CompileHostnamePattern(pattern string) (*regexp.Regexp, error) {
 	}
 	for i, label := range strings.Split(pattern, ".") {
 		if i == 0 {
-			// We have to allow the asterisk to be a valid hostname label.
+			// We have to allow the asterisk to be a valid hostname label, so
+			// we strip the asterisk (which is only on the first one).
 			label = strings.TrimPrefix(label, "*")
+			// Put an "a" at the start to stand in for the asterisk in the regex
+			// test below. This makes `*.coder.com` become `a.coder.com` and
+			// `*--prod.coder.com` become `a--prod.coder.com`.
 			label = "a" + label
 		}
 		if !validHostnameLabelRegex.MatchString(label) {
diff --git a/coderd/httpapi/url_test.go b/coderd/httpapi/url_test.go
index 3beee451f7391..e4ce87ebedc34 100644
--- a/coderd/httpapi/url_test.go
+++ b/coderd/httpapi/url_test.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpapi"
 )
 
 func TestApplicationURLString(t *testing.T) {
@@ -42,6 +42,17 @@ func TestApplicationURLString(t *testing.T) {
 			},
 			Expected: "8080--agent--workspace--user",
 		},
+		{
+			Name: "Prefix",
+			URL: httpapi.ApplicationURL{
+				Prefix:        "yolo---",
+				AppSlugOrPort: "app",
+				AgentName:     "agent",
+				WorkspaceName: "workspace",
+				Username:      "user",
+			},
+			Expected: "yolo---app--agent--workspace--user",
+		},
 	}
 
 	for _, c := range testCases {
@@ -123,6 +134,17 @@ func TestParseSubdomainAppURL(t *testing.T) {
 				Username:      "user-name",
 			},
 		},
+		{
+			Name:      "Prefix",
+			Subdomain: "dean---was---here---app--agent--workspace--user",
+			Expected: httpapi.ApplicationURL{
+				Prefix:        "dean---was---here---",
+				AppSlugOrPort: "app",
+				AgentName:     "agent",
+				WorkspaceName: "workspace",
+				Username:      "user",
+			},
+		},
 	}
 
 	for _, c := range testCases {
diff --git a/coderd/httpmw/actor.go b/coderd/httpmw/actor.go
index 7df5294b17c49..af3142aed2de8 100644
--- a/coderd/httpmw/actor.go
+++ b/coderd/httpmw/actor.go
@@ -3,8 +3,8 @@ package httpmw
 import (
 	"net/http"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // RequireAPIKeyOrWorkspaceProxyAuth is middleware that should be inserted after
diff --git a/coderd/httpmw/actor_test.go b/coderd/httpmw/actor_test.go
index 5d30f5c072eda..ef05a8cb3a3d2 100644
--- a/coderd/httpmw/actor_test.go
+++ b/coderd/httpmw/actor_test.go
@@ -10,11 +10,12 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestRequireAPIKeyOrWorkspaceProxyAuth(t *testing.T) {
@@ -37,11 +38,11 @@ func TestRequireAPIKeyOrWorkspaceProxyAuth(t *testing.T) {
 		t.Parallel()
 
 		var (
-			db       = dbfake.New()
+			db       = dbmem.New()
 			user     = dbgen.User(t, db, database.User{})
 			_, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				ExpiresAt: database.Now().AddDate(0, 0, 1),
+				ExpiresAt: dbtime.Now().AddDate(0, 0, 1),
 			})
 
 			r  = httptest.NewRequest("GET", "/", nil)
@@ -74,11 +75,11 @@ func TestRequireAPIKeyOrWorkspaceProxyAuth(t *testing.T) {
 		t.Parallel()
 
 		var (
-			db           = dbfake.New()
+			db           = dbmem.New()
 			user         = dbgen.User(t, db, database.User{})
 			_, userToken = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				ExpiresAt: database.Now().AddDate(0, 0, 1),
+				ExpiresAt: dbtime.Now().AddDate(0, 0, 1),
 			})
 			proxy, proxyToken = dbgen.WorkspaceProxy(t, db, database.WorkspaceProxy{})
 
@@ -113,7 +114,7 @@ func TestRequireAPIKeyOrWorkspaceProxyAuth(t *testing.T) {
 		t.Parallel()
 
 		var (
-			db           = dbfake.New()
+			db           = dbmem.New()
 			proxy, token = dbgen.WorkspaceProxy(t, db, database.WorkspaceProxy{})
 
 			r  = httptest.NewRequest("GET", "/", nil)
diff --git a/coderd/httpmw/apikey.go b/coderd/httpmw/apikey.go
index 5f0ec0dc263c7..9f6ea6fa1f4c4 100644
--- a/coderd/httpmw/apikey.go
+++ b/coderd/httpmw/apikey.go
@@ -18,11 +18,12 @@ import (
 	"golang.org/x/oauth2"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type apiKeyContextKey struct{}
@@ -142,6 +143,56 @@ func ExtractAPIKeyMW(cfg ExtractAPIKeyConfig) func(http.Handler) http.Handler {
 	}
 }
 
+func APIKeyFromRequest(ctx context.Context, db database.Store, sessionTokenFunc func(r *http.Request) string, r *http.Request) (*database.APIKey, codersdk.Response, bool) {
+	tokenFunc := APITokenFromRequest
+	if sessionTokenFunc != nil {
+		tokenFunc = sessionTokenFunc
+	}
+
+	token := tokenFunc(r)
+	if token == "" {
+		return nil, codersdk.Response{
+			Message: SignedOutErrorMessage,
+			Detail:  fmt.Sprintf("Cookie %q or query parameter must be provided.", codersdk.SessionTokenCookie),
+		}, false
+	}
+
+	keyID, keySecret, err := SplitAPIToken(token)
+	if err != nil {
+		return nil, codersdk.Response{
+			Message: SignedOutErrorMessage,
+			Detail:  "Invalid API key format: " + err.Error(),
+		}, false
+	}
+
+	//nolint:gocritic // System needs to fetch API key to check if it's valid.
+	key, err := db.GetAPIKeyByID(dbauthz.AsSystemRestricted(ctx), keyID)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, codersdk.Response{
+				Message: SignedOutErrorMessage,
+				Detail:  "API key is invalid.",
+			}, false
+		}
+
+		return nil, codersdk.Response{
+			Message: internalErrorMessage,
+			Detail:  fmt.Sprintf("Internal error fetching API key by id. %s", err.Error()),
+		}, false
+	}
+
+	// Checking to see if the secret is valid.
+	hashedSecret := sha256.Sum256([]byte(keySecret))
+	if subtle.ConstantTimeCompare(key.HashedSecret, hashedSecret[:]) != 1 {
+		return nil, codersdk.Response{
+			Message: SignedOutErrorMessage,
+			Detail:  "API key secret is invalid.",
+		}, false
+	}
+
+	return &key, codersdk.Response{}, true
+}
+
 // ExtractAPIKey requires authentication using a valid API key. It handles
 // extending an API key if it comes close to expiry, updating the last used time
 // in the database.
@@ -179,63 +230,30 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon
 		return nil, nil, false
 	}
 
-	tokenFunc := APITokenFromRequest
-	if cfg.SessionTokenFunc != nil {
-		tokenFunc = cfg.SessionTokenFunc
-	}
-	token := tokenFunc(r)
-	if token == "" {
-		return optionalWrite(http.StatusUnauthorized, codersdk.Response{
-			Message: SignedOutErrorMessage,
-			Detail:  fmt.Sprintf("Cookie %q or query parameter must be provided.", codersdk.SessionTokenCookie),
-		})
-	}
-
-	keyID, keySecret, err := SplitAPIToken(token)
-	if err != nil {
-		return optionalWrite(http.StatusUnauthorized, codersdk.Response{
-			Message: SignedOutErrorMessage,
-			Detail:  "Invalid API key format: " + err.Error(),
-		})
-	}
-
-	//nolint:gocritic // System needs to fetch API key to check if it's valid.
-	key, err := cfg.DB.GetAPIKeyByID(dbauthz.AsSystemRestricted(ctx), keyID)
-	if err != nil {
-		if errors.Is(err, sql.ErrNoRows) {
-			return optionalWrite(http.StatusUnauthorized, codersdk.Response{
-				Message: SignedOutErrorMessage,
-				Detail:  "API key is invalid.",
-			})
-		}
-
-		return write(http.StatusInternalServerError, codersdk.Response{
-			Message: internalErrorMessage,
-			Detail:  fmt.Sprintf("Internal error fetching API key by id. %s", err.Error()),
-		})
-	}
-
-	// Checking to see if the secret is valid.
-	hashedSecret := sha256.Sum256([]byte(keySecret))
-	if subtle.ConstantTimeCompare(key.HashedSecret, hashedSecret[:]) != 1 {
-		return optionalWrite(http.StatusUnauthorized, codersdk.Response{
-			Message: SignedOutErrorMessage,
-			Detail:  "API key secret is invalid.",
-		})
+	key, resp, ok := APIKeyFromRequest(ctx, cfg.DB, cfg.SessionTokenFunc, r)
+	if !ok {
+		return optionalWrite(http.StatusUnauthorized, resp)
 	}
 
 	var (
 		link database.UserLink
-		now  = database.Now()
+		now  = dbtime.Now()
 		// Tracks if the API key has properties updated
 		changed = false
 	)
 	if key.LoginType == database.LoginTypeGithub || key.LoginType == database.LoginTypeOIDC {
+		var err error
 		//nolint:gocritic // System needs to fetch UserLink to check if it's valid.
 		link, err = cfg.DB.GetUserLinkByUserIDLoginType(dbauthz.AsSystemRestricted(ctx), database.GetUserLinkByUserIDLoginTypeParams{
 			UserID:    key.UserID,
 			LoginType: key.LoginType,
 		})
+		if errors.Is(err, sql.ErrNoRows) {
+			return optionalWrite(http.StatusUnauthorized, codersdk.Response{
+				Message: SignedOutErrorMessage,
+				Detail:  "You must re-authenticate with the login provider.",
+			})
+		}
 		if err != nil {
 			return write(http.StatusInternalServerError, codersdk.Response{
 				Message: "A database error occurred",
@@ -285,7 +303,7 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon
 			}).Token()
 			if err != nil {
 				return write(http.StatusUnauthorized, codersdk.Response{
-					Message: "Could not refresh expired Oauth token.",
+					Message: "Could not refresh expired Oauth token. Try re-authenticating to resolve this issue.",
 					Detail:  err.Error(),
 				})
 			}
@@ -298,6 +316,9 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon
 	}
 
 	// Checking if the key is expired.
+	// NOTE: The `RequireAuth` React component depends on this `Detail` to detect when
+	// the users token has expired. If you change the text here, make sure to update it
+	// in site/src/components/RequireAuth/RequireAuth.tsx as well.
 	if key.ExpiresAt.Before(now) {
 		return optionalWrite(http.StatusUnauthorized, codersdk.Response{
 			Message: SignedOutErrorMessage,
@@ -348,13 +369,15 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon
 		// If the API Key is associated with a user_link (e.g. Github/OIDC)
 		// then we want to update the relevant oauth fields.
 		if link.UserID != uuid.Nil {
-			// nolint:gocritic
+			//nolint:gocritic // system needs to update user link
 			link, err = cfg.DB.UpdateUserLink(dbauthz.AsSystemRestricted(ctx), database.UpdateUserLinkParams{
-				UserID:            link.UserID,
-				LoginType:         link.LoginType,
-				OAuthAccessToken:  link.OAuthAccessToken,
-				OAuthRefreshToken: link.OAuthRefreshToken,
-				OAuthExpiry:       link.OAuthExpiry,
+				UserID:                 link.UserID,
+				LoginType:              link.LoginType,
+				OAuthAccessToken:       link.OAuthAccessToken,
+				OAuthAccessTokenKeyID:  sql.NullString{}, // dbcrypt will update as required
+				OAuthRefreshToken:      link.OAuthRefreshToken,
+				OAuthRefreshTokenKeyID: sql.NullString{}, // dbcrypt will update as required
+				OAuthExpiry:            link.OAuthExpiry,
 			})
 			if err != nil {
 				return write(http.StatusInternalServerError, codersdk.Response{
@@ -367,11 +390,11 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon
 		// We only want to update this occasionally to reduce DB write
 		// load. We update alongside the UserLink and APIKey since it's
 		// easier on the DB to colocate writes.
-		// nolint:gocritic
+		//nolint:gocritic // system needs to update user last seen at
 		_, err = cfg.DB.UpdateUserLastSeenAt(dbauthz.AsSystemRestricted(ctx), database.UpdateUserLastSeenAtParams{
 			ID:         key.UserID,
-			LastSeenAt: database.Now(),
-			UpdatedAt:  database.Now(),
+			LastSeenAt: dbtime.Now(),
+			UpdatedAt:  dbtime.Now(),
 		})
 		if err != nil {
 			return write(http.StatusInternalServerError, codersdk.Response{
@@ -384,7 +407,7 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon
 	// If the key is valid, we also fetch the user roles and status.
 	// The roles are used for RBAC authorize checks, and the status
 	// is to block 'suspended' users from accessing the platform.
-	// nolint:gocritic
+	//nolint:gocritic // system needs to update user roles
 	roles, err := cfg.DB.GetAuthorizationUserRoles(dbauthz.AsSystemRestricted(ctx), key.UserID)
 	if err != nil {
 		return write(http.StatusUnauthorized, codersdk.Response{
@@ -399,7 +422,7 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon
 		u, err := cfg.DB.UpdateUserStatus(dbauthz.AsSystemRestricted(ctx), database.UpdateUserStatusParams{
 			ID:        key.UserID,
 			Status:    database.UserStatusActive,
-			UpdatedAt: database.Now(),
+			UpdatedAt: dbtime.Now(),
 		})
 		if err != nil {
 			return write(http.StatusInternalServerError, codersdk.Response{
@@ -427,16 +450,16 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon
 		}.WithCachedASTValue(),
 	}
 
-	return &key, &authz, true
+	return key, &authz, true
 }
 
 // APITokenFromRequest returns the api token from the request.
 // Find the session token from:
 // 1: The cookie
-// 1: The devurl cookie
-// 3: The old cookie
-// 4. The coder_session_token query parameter
-// 5. The custom auth header
+// 2. The coder_session_token query parameter
+// 3. The custom auth header
+//
+// API tokens for apps are read from workspaceapps/cookies.go.
 func APITokenFromRequest(r *http.Request) string {
 	cookie, err := r.Cookie(codersdk.SessionTokenCookie)
 	if err == nil && cookie.Value != "" {
@@ -453,11 +476,6 @@ func APITokenFromRequest(r *http.Request) string {
 		return headerValue
 	}
 
-	cookie, err = r.Cookie(codersdk.DevURLSessionTokenCookie)
-	if err == nil && cookie.Value != "" {
-		return cookie.Value
-	}
-
 	return ""
 }
 
diff --git a/coderd/httpmw/apikey_test.go b/coderd/httpmw/apikey_test.go
index b4b7bb01f8eeb..33ba90a4d728c 100644
--- a/coderd/httpmw/apikey_test.go
+++ b/coderd/httpmw/apikey_test.go
@@ -3,11 +3,13 @@ package httpmw_test
 import (
 	"context"
 	"crypto/sha256"
+	"encoding/json"
 	"fmt"
 	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -16,14 +18,15 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func randomAPIKeyParts() (id string, secret string) {
@@ -45,7 +48,7 @@ func TestAPIKey(t *testing.T) {
 	t.Run("NoCookie", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -61,7 +64,7 @@ func TestAPIKey(t *testing.T) {
 	t.Run("NoCookieRedirects", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -80,7 +83,7 @@ func TestAPIKey(t *testing.T) {
 	t.Run("InvalidFormat", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -98,7 +101,7 @@ func TestAPIKey(t *testing.T) {
 	t.Run("InvalidIDLength", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -116,7 +119,7 @@ func TestAPIKey(t *testing.T) {
 	t.Run("InvalidSecretLength", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -134,7 +137,7 @@ func TestAPIKey(t *testing.T) {
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db         = dbfake.New()
+			db         = dbmem.New()
 			id, secret = randomAPIKeyParts()
 			r          = httptest.NewRequest("GET", "/", nil)
 			rw         = httptest.NewRecorder()
@@ -150,10 +153,38 @@ func TestAPIKey(t *testing.T) {
 		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
 	})
 
+	t.Run("UserLinkNotFound", func(t *testing.T) {
+		t.Parallel()
+		var (
+			db   = dbmem.New()
+			r    = httptest.NewRequest("GET", "/", nil)
+			rw   = httptest.NewRecorder()
+			user = dbgen.User(t, db, database.User{
+				LoginType: database.LoginTypeGithub,
+			})
+			// Intentionally not inserting any user link
+			_, token = dbgen.APIKey(t, db, database.APIKey{
+				UserID:    user.ID,
+				LoginType: user.LoginType,
+			})
+		)
+		r.Header.Set(codersdk.SessionTokenHeader, token)
+		httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
+			DB:              db,
+			RedirectToLogin: false,
+		})(successHandler).ServeHTTP(rw, r)
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+		var resp codersdk.Response
+		require.NoError(t, json.NewDecoder(res.Body).Decode(&resp))
+		require.Equal(t, resp.Message, httpmw.SignedOutErrorMessage)
+	})
+
 	t.Run("InvalidSecret", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db   = dbfake.New()
+			db   = dbmem.New()
 			r    = httptest.NewRequest("GET", "/", nil)
 			rw   = httptest.NewRecorder()
 			user = dbgen.User(t, db, database.User{})
@@ -178,7 +209,7 @@ func TestAPIKey(t *testing.T) {
 	t.Run("Expired", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db       = dbfake.New()
+			db       = dbmem.New()
 			user     = dbgen.User(t, db, database.User{})
 			_, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
@@ -197,16 +228,21 @@ func TestAPIKey(t *testing.T) {
 		res := rw.Result()
 		defer res.Body.Close()
 		require.Equal(t, http.StatusUnauthorized, res.StatusCode)
+
+		var apiRes codersdk.Response
+		dec := json.NewDecoder(res.Body)
+		_ = dec.Decode(&apiRes)
+		require.True(t, strings.HasPrefix(apiRes.Detail, "API key expired"))
 	})
 
 	t.Run("Valid", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db                = dbfake.New()
+			db                = dbmem.New()
 			user              = dbgen.User(t, db, database.User{})
 			sentAPIKey, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				ExpiresAt: database.Now().AddDate(0, 0, 1),
+				ExpiresAt: dbtime.Now().AddDate(0, 0, 1),
 			})
 
 			r  = httptest.NewRequest("GET", "/", nil)
@@ -237,11 +273,11 @@ func TestAPIKey(t *testing.T) {
 	t.Run("ValidWithScope", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db       = dbfake.New()
+			db       = dbmem.New()
 			user     = dbgen.User(t, db, database.User{})
 			_, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				ExpiresAt: database.Now().AddDate(0, 0, 1),
+				ExpiresAt: dbtime.Now().AddDate(0, 0, 1),
 				Scope:     database.APIKeyScopeApplicationConnect,
 			})
 
@@ -274,11 +310,11 @@ func TestAPIKey(t *testing.T) {
 	t.Run("QueryParameter", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db       = dbfake.New()
+			db       = dbmem.New()
 			user     = dbgen.User(t, db, database.User{})
 			_, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				ExpiresAt: database.Now().AddDate(0, 0, 1),
+				ExpiresAt: dbtime.Now().AddDate(0, 0, 1),
 			})
 
 			r  = httptest.NewRequest("GET", "/", nil)
@@ -306,12 +342,12 @@ func TestAPIKey(t *testing.T) {
 	t.Run("ValidUpdateLastUsed", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db                = dbfake.New()
+			db                = dbmem.New()
 			user              = dbgen.User(t, db, database.User{})
 			sentAPIKey, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				LastUsed:  database.Now().AddDate(0, 0, -1),
-				ExpiresAt: database.Now().AddDate(0, 0, 1),
+				LastUsed:  dbtime.Now().AddDate(0, 0, -1),
+				ExpiresAt: dbtime.Now().AddDate(0, 0, 1),
 			})
 
 			r  = httptest.NewRequest("GET", "/", nil)
@@ -337,12 +373,12 @@ func TestAPIKey(t *testing.T) {
 	t.Run("ValidUpdateExpiry", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db                = dbfake.New()
+			db                = dbmem.New()
 			user              = dbgen.User(t, db, database.User{})
 			sentAPIKey, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				LastUsed:  database.Now(),
-				ExpiresAt: database.Now().Add(time.Minute),
+				LastUsed:  dbtime.Now(),
+				ExpiresAt: dbtime.Now().Add(time.Minute),
 			})
 
 			r  = httptest.NewRequest("GET", "/", nil)
@@ -368,12 +404,12 @@ func TestAPIKey(t *testing.T) {
 	t.Run("NoRefresh", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db                = dbfake.New()
+			db                = dbmem.New()
 			user              = dbgen.User(t, db, database.User{})
 			sentAPIKey, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				LastUsed:  database.Now().AddDate(0, 0, -1),
-				ExpiresAt: database.Now().AddDate(0, 0, 1),
+				LastUsed:  dbtime.Now().AddDate(0, 0, -1),
+				ExpiresAt: dbtime.Now().AddDate(0, 0, 1),
 			})
 
 			r  = httptest.NewRequest("GET", "/", nil)
@@ -400,12 +436,12 @@ func TestAPIKey(t *testing.T) {
 	t.Run("OAuthNotExpired", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db                = dbfake.New()
+			db                = dbmem.New()
 			user              = dbgen.User(t, db, database.User{})
 			sentAPIKey, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				LastUsed:  database.Now(),
-				ExpiresAt: database.Now().AddDate(0, 0, 1),
+				LastUsed:  dbtime.Now(),
+				ExpiresAt: dbtime.Now().AddDate(0, 0, 1),
 				LoginType: database.LoginTypeGithub,
 			})
 			_ = dbgen.UserLink(t, db, database.UserLink{
@@ -436,19 +472,19 @@ func TestAPIKey(t *testing.T) {
 	t.Run("OAuthRefresh", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db                = dbfake.New()
+			db                = dbmem.New()
 			user              = dbgen.User(t, db, database.User{})
 			sentAPIKey, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				LastUsed:  database.Now(),
-				ExpiresAt: database.Now().AddDate(0, 0, 1),
+				LastUsed:  dbtime.Now(),
+				ExpiresAt: dbtime.Now().AddDate(0, 0, 1),
 				LoginType: database.LoginTypeGithub,
 			})
 			_ = dbgen.UserLink(t, db, database.UserLink{
 				UserID:            user.ID,
 				LoginType:         database.LoginTypeGithub,
 				OAuthRefreshToken: "hello",
-				OAuthExpiry:       database.Now().AddDate(0, 0, -1),
+				OAuthExpiry:       dbtime.Now().AddDate(0, 0, -1),
 			})
 
 			r  = httptest.NewRequest("GET", "/", nil)
@@ -459,7 +495,7 @@ func TestAPIKey(t *testing.T) {
 		oauthToken := &oauth2.Token{
 			AccessToken:  "wow",
 			RefreshToken: "moo",
-			Expiry:       database.Now().AddDate(0, 0, 1),
+			Expiry:       dbtime.Now().AddDate(0, 0, 1),
 		}
 		httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
 			DB: db,
@@ -484,12 +520,12 @@ func TestAPIKey(t *testing.T) {
 	t.Run("RemoteIPUpdates", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db                = dbfake.New()
+			db                = dbmem.New()
 			user              = dbgen.User(t, db, database.User{})
 			sentAPIKey, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				LastUsed:  database.Now().AddDate(0, 0, -1),
-				ExpiresAt: database.Now().AddDate(0, 0, 1),
+				LastUsed:  dbtime.Now().AddDate(0, 0, -1),
+				ExpiresAt: dbtime.Now().AddDate(0, 0, 1),
 			})
 
 			r  = httptest.NewRequest("GET", "/", nil)
@@ -515,7 +551,7 @@ func TestAPIKey(t *testing.T) {
 	t.Run("RedirectToLogin", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -536,7 +572,7 @@ func TestAPIKey(t *testing.T) {
 	t.Run("Optional", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 
@@ -567,12 +603,12 @@ func TestAPIKey(t *testing.T) {
 	t.Run("Tokens", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db                = dbfake.New()
+			db                = dbmem.New()
 			user              = dbgen.User(t, db, database.User{})
 			sentAPIKey, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				LastUsed:  database.Now(),
-				ExpiresAt: database.Now().AddDate(0, 0, 1),
+				LastUsed:  dbtime.Now(),
+				ExpiresAt: dbtime.Now().AddDate(0, 0, 1),
 				LoginType: database.LoginTypeToken,
 			})
 
@@ -600,12 +636,12 @@ func TestAPIKey(t *testing.T) {
 	t.Run("MissongConfig", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db       = dbfake.New()
+			db       = dbmem.New()
 			user     = dbgen.User(t, db, database.User{})
 			_, token = dbgen.APIKey(t, db, database.APIKey{
 				UserID:    user.ID,
-				LastUsed:  database.Now(),
-				ExpiresAt: database.Now().AddDate(0, 0, 1),
+				LastUsed:  dbtime.Now(),
+				ExpiresAt: dbtime.Now().AddDate(0, 0, 1),
 				LoginType: database.LoginTypeOIDC,
 			})
 			_ = dbgen.UserLink(t, db, database.UserLink{
diff --git a/coderd/httpmw/authorize_test.go b/coderd/httpmw/authorize_test.go
index b2491d3de4707..42be7f4a9a801 100644
--- a/coderd/httpmw/authorize_test.go
+++ b/coderd/httpmw/authorize_test.go
@@ -15,11 +15,12 @@ import (
 	"github.com/sqlc-dev/pqtype"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestExtractUserRoles(t *testing.T) {
@@ -159,7 +160,7 @@ func addUser(t *testing.T, db database.Store, roles ...string) (database.User, s
 	user, err = db.UpdateUserStatus(context.Background(), database.UpdateUserStatusParams{
 		ID:        user.ID,
 		Status:    database.UserStatusActive,
-		UpdatedAt: database.Now(),
+		UpdatedAt: dbtime.Now(),
 	})
 	require.NoError(t, err)
 
@@ -167,8 +168,8 @@ func addUser(t *testing.T, db database.Store, roles ...string) (database.User, s
 		ID:           id,
 		UserID:       user.ID,
 		HashedSecret: hashed[:],
-		LastUsed:     database.Now(),
-		ExpiresAt:    database.Now().Add(time.Minute),
+		LastUsed:     dbtime.Now(),
+		ExpiresAt:    dbtime.Now().Add(time.Minute),
 		LoginType:    database.LoginTypePassword,
 		Scope:        database.APIKeyScopeAll,
 		IPAddress: pqtype.Inet{
diff --git a/coderd/httpmw/authz.go b/coderd/httpmw/authz.go
index 6fc5c396a101f..4c94ce362be2a 100644
--- a/coderd/httpmw/authz.go
+++ b/coderd/httpmw/authz.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/coder/coder/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
 )
 
 // AsAuthzSystem is a chained handler that temporarily sets the dbauthz context
diff --git a/coderd/httpmw/authz_test.go b/coderd/httpmw/authz_test.go
index 29474aa264bd9..b469a8f23a5ed 100644
--- a/coderd/httpmw/authz_test.go
+++ b/coderd/httpmw/authz_test.go
@@ -8,9 +8,9 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/assert"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/httpmw"
 )
 
 func TestAsAuthzSystem(t *testing.T) {
diff --git a/coderd/httpmw/clitelemetry.go b/coderd/httpmw/clitelemetry.go
index 2262862beba49..8e9a472b4cc8a 100644
--- a/coderd/httpmw/clitelemetry.go
+++ b/coderd/httpmw/clitelemetry.go
@@ -11,8 +11,9 @@ import (
 	"tailscale.com/tstime/rate"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/codersdk"
+	clitelemetry "github.com/coder/coder/v2/cli/telemetry"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func ReportCLITelemetry(log slog.Logger, rep telemetry.Reporter) func(http.Handler) http.Handler {
@@ -30,7 +31,7 @@ func ReportCLITelemetry(log slog.Logger, rep telemetry.Reporter) func(http.Handl
 		//
 		// This approach just helps us reduce storage and ingest fees, and doesn't
 		// change the correctness.
-		queue = make(map[string]telemetry.CLIInvocation)
+		queue = make(map[string]clitelemetry.Invocation)
 	)
 
 	log = log.Named("cli-telemetry")
@@ -55,7 +56,7 @@ func ReportCLITelemetry(log slog.Logger, rep telemetry.Reporter) func(http.Handl
 				return
 			}
 
-			var inv telemetry.CLIInvocation
+			var inv clitelemetry.Invocation
 			err = json.Unmarshal(byt, &inv)
 			if err != nil {
 				log.Error(
diff --git a/coderd/httpmw/cors.go b/coderd/httpmw/cors.go
index 7206881d24f85..b00810fbf9322 100644
--- a/coderd/httpmw/cors.go
+++ b/coderd/httpmw/cors.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/go-chi/cors"
 
-	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpapi"
 )
 
 const (
diff --git a/coderd/httpmw/cors_test.go b/coderd/httpmw/cors_test.go
index 7668771b1e6db..ae63073b237ed 100644
--- a/coderd/httpmw/cors_test.go
+++ b/coderd/httpmw/cors_test.go
@@ -7,8 +7,8 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
 )
 
 func TestWorkspaceAppCors(t *testing.T) {
diff --git a/coderd/httpmw/csp_test.go b/coderd/httpmw/csp_test.go
index bb352537b10cd..2dca209faa5c3 100644
--- a/coderd/httpmw/csp_test.go
+++ b/coderd/httpmw/csp_test.go
@@ -8,7 +8,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/httpmw"
 )
 
 func TestCSPConnect(t *testing.T) {
diff --git a/coderd/httpmw/csrf.go b/coderd/httpmw/csrf.go
index ce25c600940b5..2a1f383a7490a 100644
--- a/coderd/httpmw/csrf.go
+++ b/coderd/httpmw/csrf.go
@@ -7,7 +7,7 @@ import (
 	"github.com/justinas/nosurf"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // CSRF is a middleware that verifies that a CSRF token is present in the request
diff --git a/coderd/httpmw/externalauthparam.go b/coderd/httpmw/externalauthparam.go
new file mode 100644
index 0000000000000..91c3e22f22cef
--- /dev/null
+++ b/coderd/httpmw/externalauthparam.go
@@ -0,0 +1,40 @@
+package httpmw
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/coderd/httpapi"
+)
+
+type externalAuthParamContextKey struct{}
+
+func ExternalAuthParam(r *http.Request) *externalauth.Config {
+	config, ok := r.Context().Value(externalAuthParamContextKey{}).(*externalauth.Config)
+	if !ok {
+		panic("developer error: external auth param middleware not provided")
+	}
+	return config
+}
+
+func ExtractExternalAuthParam(configs []*externalauth.Config) func(next http.Handler) http.Handler {
+	configByID := make(map[string]*externalauth.Config)
+	for _, c := range configs {
+		configByID[c.ID] = c
+	}
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			config, ok := configByID[chi.URLParam(r, "externalauth")]
+			if !ok {
+				httpapi.ResourceNotFound(w)
+				return
+			}
+
+			r = r.WithContext(context.WithValue(r.Context(), externalAuthParamContextKey{}, config))
+			next.ServeHTTP(w, r)
+		})
+	}
+}
diff --git a/coderd/httpmw/externalauthparam_test.go b/coderd/httpmw/externalauthparam_test.go
new file mode 100644
index 0000000000000..4081e9f42627b
--- /dev/null
+++ b/coderd/httpmw/externalauthparam_test.go
@@ -0,0 +1,49 @@
+package httpmw_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/coderd/httpmw"
+)
+
+//nolint:bodyclose
+func TestExternalAuthParam(t *testing.T) {
+	t.Parallel()
+	t.Run("Found", func(t *testing.T) {
+		t.Parallel()
+		routeCtx := chi.NewRouteContext()
+		routeCtx.URLParams.Add("externalauth", "my-id")
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, routeCtx))
+		res := httptest.NewRecorder()
+
+		httpmw.ExtractExternalAuthParam([]*externalauth.Config{{
+			ID: "my-id",
+		}})(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			require.Equal(t, "my-id", httpmw.ExternalAuthParam(r).ID)
+			w.WriteHeader(http.StatusOK)
+		})).ServeHTTP(res, r)
+
+		require.Equal(t, http.StatusOK, res.Result().StatusCode)
+	})
+
+	t.Run("NotFound", func(t *testing.T) {
+		t.Parallel()
+		routeCtx := chi.NewRouteContext()
+		routeCtx.URLParams.Add("externalauth", "my-id")
+		r := httptest.NewRequest(http.MethodGet, "/", nil)
+		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, routeCtx))
+		res := httptest.NewRecorder()
+
+		httpmw.ExtractExternalAuthParam([]*externalauth.Config{})(nil).ServeHTTP(res, r)
+
+		require.Equal(t, http.StatusNotFound, res.Result().StatusCode)
+	})
+}
diff --git a/coderd/httpmw/gitauthparam.go b/coderd/httpmw/gitauthparam.go
deleted file mode 100644
index 2ce592d54f98a..0000000000000
--- a/coderd/httpmw/gitauthparam.go
+++ /dev/null
@@ -1,40 +0,0 @@
-package httpmw
-
-import (
-	"context"
-	"net/http"
-
-	"github.com/go-chi/chi/v5"
-
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/httpapi"
-)
-
-type gitAuthParamContextKey struct{}
-
-func GitAuthParam(r *http.Request) *gitauth.Config {
-	config, ok := r.Context().Value(gitAuthParamContextKey{}).(*gitauth.Config)
-	if !ok {
-		panic("developer error: gitauth param middleware not provided")
-	}
-	return config
-}
-
-func ExtractGitAuthParam(configs []*gitauth.Config) func(next http.Handler) http.Handler {
-	configByID := make(map[string]*gitauth.Config)
-	for _, c := range configs {
-		configByID[c.ID] = c
-	}
-	return func(next http.Handler) http.Handler {
-		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			config, ok := configByID[chi.URLParam(r, "gitauth")]
-			if !ok {
-				httpapi.ResourceNotFound(w)
-				return
-			}
-
-			r = r.WithContext(context.WithValue(r.Context(), gitAuthParamContextKey{}, config))
-			next.ServeHTTP(w, r)
-		})
-	}
-}
diff --git a/coderd/httpmw/gitauthparam_test.go b/coderd/httpmw/gitauthparam_test.go
deleted file mode 100644
index 01ea35470f025..0000000000000
--- a/coderd/httpmw/gitauthparam_test.go
+++ /dev/null
@@ -1,49 +0,0 @@
-package httpmw_test
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/go-chi/chi/v5"
-	"github.com/stretchr/testify/require"
-
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/httpmw"
-)
-
-//nolint:bodyclose
-func TestGitAuthParam(t *testing.T) {
-	t.Parallel()
-	t.Run("Found", func(t *testing.T) {
-		t.Parallel()
-		routeCtx := chi.NewRouteContext()
-		routeCtx.URLParams.Add("gitauth", "my-id")
-		r := httptest.NewRequest(http.MethodGet, "/", nil)
-		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, routeCtx))
-		res := httptest.NewRecorder()
-
-		httpmw.ExtractGitAuthParam([]*gitauth.Config{{
-			ID: "my-id",
-		}})(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			require.Equal(t, "my-id", httpmw.GitAuthParam(r).ID)
-			w.WriteHeader(http.StatusOK)
-		})).ServeHTTP(res, r)
-
-		require.Equal(t, http.StatusOK, res.Result().StatusCode)
-	})
-
-	t.Run("NotFound", func(t *testing.T) {
-		t.Parallel()
-		routeCtx := chi.NewRouteContext()
-		routeCtx.URLParams.Add("gitauth", "my-id")
-		r := httptest.NewRequest(http.MethodGet, "/", nil)
-		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, routeCtx))
-		res := httptest.NewRecorder()
-
-		httpmw.ExtractGitAuthParam([]*gitauth.Config{})(nil).ServeHTTP(res, r)
-
-		require.Equal(t, http.StatusNotFound, res.Result().StatusCode)
-	})
-}
diff --git a/coderd/httpmw/groupparam.go b/coderd/httpmw/groupparam.go
index 5b6d3bfe2dd15..9cf2a113020dd 100644
--- a/coderd/httpmw/groupparam.go
+++ b/coderd/httpmw/groupparam.go
@@ -6,9 +6,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type groupParamContextKey struct{}
diff --git a/coderd/httpmw/groupparam_test.go b/coderd/httpmw/groupparam_test.go
index b7f59528e7b34..a44fbc52df38b 100644
--- a/coderd/httpmw/groupparam_test.go
+++ b/coderd/httpmw/groupparam_test.go
@@ -10,10 +10,10 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/httpmw"
 )
 
 func TestGroupParam(t *testing.T) {
@@ -23,7 +23,7 @@ func TestGroupParam(t *testing.T) {
 		t.Parallel()
 
 		var (
-			db    = dbfake.New()
+			db    = dbmem.New()
 			group = dbgen.Group(t, db, database.Group{})
 			r     = httptest.NewRequest("GET", "/", nil)
 			w     = httptest.NewRecorder()
@@ -52,7 +52,7 @@ func TestGroupParam(t *testing.T) {
 		t.Parallel()
 
 		var (
-			db    = dbfake.New()
+			db    = dbmem.New()
 			group = dbgen.Group(t, db, database.Group{})
 			r     = httptest.NewRequest("GET", "/", nil)
 			w     = httptest.NewRecorder()
diff --git a/coderd/httpmw/hsts_test.go b/coderd/httpmw/hsts_test.go
index 16dcee78cbf61..3bc3463e69e65 100644
--- a/coderd/httpmw/hsts_test.go
+++ b/coderd/httpmw/hsts_test.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/httpmw"
 )
 
 func TestHSTS(t *testing.T) {
diff --git a/coderd/httpmw/httpmw.go b/coderd/httpmw/httpmw.go
index f6a0dac8b0b65..552469bf044b0 100644
--- a/coderd/httpmw/httpmw.go
+++ b/coderd/httpmw/httpmw.go
@@ -7,8 +7,8 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // ParseUUIDParam consumes a url parameter and parses it as a UUID.
diff --git a/coderd/httpmw/httpmw_internal_test.go b/coderd/httpmw/httpmw_internal_test.go
index 87aa3a6960822..5a6578cf3799f 100644
--- a/coderd/httpmw/httpmw_internal_test.go
+++ b/coderd/httpmw/httpmw_internal_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 const (
diff --git a/coderd/httpmw/logger.go b/coderd/httpmw/logger.go
index e9ee400c5c581..79e95cf859d8e 100644
--- a/coderd/httpmw/logger.go
+++ b/coderd/httpmw/logger.go
@@ -7,8 +7,8 @@ import (
 	"time"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 func Logger(log slog.Logger) func(next http.Handler) http.Handler {
@@ -26,19 +26,28 @@ func Logger(log slog.Logger) func(next http.Handler) http.Handler {
 				slog.F("path", r.URL.Path),
 				slog.F("proto", r.Proto),
 				slog.F("remote_addr", r.RemoteAddr),
+				// Include the start timestamp in the log so that we have the
+				// source of truth. There is at least a theoretical chance that
+				// there can be a delay between `next.ServeHTTP` ending and us
+				// actually logging the request. This can also be useful when
+				// filtering logs that started at a certain time (compared to
+				// trying to compute the value).
+				slog.F("start", start),
 			)
 
 			next.ServeHTTP(sw, r)
 
+			end := time.Now()
+
 			// Don't log successful health check requests.
 			if r.URL.Path == "/api/v2" && sw.Status == http.StatusOK {
 				return
 			}
 
 			httplog = httplog.With(
-				slog.F("took", time.Since(start)),
+				slog.F("took", end.Sub(start)),
 				slog.F("status_code", sw.Status),
-				slog.F("latency_ms", float64(time.Since(start)/time.Millisecond)),
+				slog.F("latency_ms", float64(end.Sub(start)/time.Millisecond)),
 			)
 
 			// For status codes 400 and higher we
diff --git a/coderd/httpmw/oauth2.go b/coderd/httpmw/oauth2.go
index ceb5c25250ed6..e51a17a5a8394 100644
--- a/coderd/httpmw/oauth2.go
+++ b/coderd/httpmw/oauth2.go
@@ -8,9 +8,9 @@ import (
 
 	"golang.org/x/oauth2"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 type oauth2StateKey struct{}
diff --git a/coderd/httpmw/oauth2_test.go b/coderd/httpmw/oauth2_test.go
index 3ed3f7f354113..b0bc3f75e4f27 100644
--- a/coderd/httpmw/oauth2_test.go
+++ b/coderd/httpmw/oauth2_test.go
@@ -12,8 +12,8 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
 
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type testOAuth2Provider struct {
diff --git a/coderd/httpmw/organizationparam.go b/coderd/httpmw/organizationparam.go
index 55ceec57387ff..76b085f019aee 100644
--- a/coderd/httpmw/organizationparam.go
+++ b/coderd/httpmw/organizationparam.go
@@ -4,9 +4,10 @@ import (
 	"context"
 	"net/http"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type (
@@ -25,8 +26,8 @@ func OrganizationParam(r *http.Request) database.Organization {
 
 // OrganizationMemberParam returns the organization membership that allowed the query
 // from the ExtractOrganizationParam handler.
-func OrganizationMemberParam(r *http.Request) database.OrganizationMember {
-	organizationMember, ok := r.Context().Value(organizationMemberParamContextKey{}).(database.OrganizationMember)
+func OrganizationMemberParam(r *http.Request) OrganizationMember {
+	organizationMember, ok := r.Context().Value(organizationMemberParamContextKey{}).(OrganizationMember)
 	if !ok {
 		panic("developer error: organization member param middleware not provided")
 	}
@@ -62,14 +63,31 @@ func ExtractOrganizationParam(db database.Store) func(http.Handler) http.Handler
 	}
 }
 
+// OrganizationMember is the database object plus the Username. Including the Username in this
+// middleware is preferable to a join at the SQL layer so that we can keep the autogenerated
+// database types as they are.
+type OrganizationMember struct {
+	database.OrganizationMember
+	Username string
+}
+
 // ExtractOrganizationMemberParam grabs a user membership from the "organization" and "user" URL parameter.
 // This middleware requires the ExtractUser and ExtractOrganization middleware higher in the stack
 func ExtractOrganizationMemberParam(db database.Store) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			ctx := r.Context()
+			// We need to resolve the `{user}` URL parameter so that we can get the userID and
+			// username.  We do this as SystemRestricted since the caller might have permission
+			// to access the OrganizationMember object, but *not* the User object.  So, it is
+			// very important that we do not add the User object to the request context or otherwise
+			// leak it to the API handler.
+			// nolint:gocritic
+			user, ok := extractUserContext(dbauthz.AsSystemRestricted(ctx), db, rw, r)
+			if !ok {
+				return
+			}
 			organization := OrganizationParam(r)
-			user := UserParam(r)
 
 			organizationMember, err := db.GetOrganizationMemberByUserID(ctx, database.GetOrganizationMemberByUserIDParams{
 				OrganizationID: organization.ID,
@@ -87,7 +105,17 @@ func ExtractOrganizationMemberParam(db database.Store) func(http.Handler) http.H
 				return
 			}
 
-			ctx = context.WithValue(ctx, organizationMemberParamContextKey{}, organizationMember)
+			ctx = context.WithValue(ctx, organizationMemberParamContextKey{}, OrganizationMember{
+				OrganizationMember: organizationMember,
+				// Here we're making one exception to the rule about not leaking data about the user
+				// to the API handler, which is to include the username.  If the caller has permission
+				// to read the OrganizationMember, then we're explicitly saying here that they also
+				// have permission to see the member's username, which is itself uncontroversial.
+				//
+				// API handlers need this information for audit logging and returning the owner's
+				// username in response to creating a workspace.
+				Username: user.Username,
+			})
 			next.ServeHTTP(rw, r.WithContext(ctx))
 		})
 	}
diff --git a/coderd/httpmw/organizationparam_test.go b/coderd/httpmw/organizationparam_test.go
index b566b0675822e..d492353e6815d 100644
--- a/coderd/httpmw/organizationparam_test.go
+++ b/coderd/httpmw/organizationparam_test.go
@@ -10,11 +10,12 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestOrganizationParam(t *testing.T) {
@@ -37,7 +38,7 @@ func TestOrganizationParam(t *testing.T) {
 	t.Run("None", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db   = dbfake.New()
+			db   = dbmem.New()
 			rw   = httptest.NewRecorder()
 			r, _ = setupAuthentication(db)
 			rtr  = chi.NewRouter()
@@ -59,7 +60,7 @@ func TestOrganizationParam(t *testing.T) {
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db   = dbfake.New()
+			db   = dbmem.New()
 			rw   = httptest.NewRecorder()
 			r, _ = setupAuthentication(db)
 			rtr  = chi.NewRouter()
@@ -82,7 +83,7 @@ func TestOrganizationParam(t *testing.T) {
 	t.Run("InvalidUUID", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db   = dbfake.New()
+			db   = dbmem.New()
 			rw   = httptest.NewRecorder()
 			r, _ = setupAuthentication(db)
 			rtr  = chi.NewRouter()
@@ -105,7 +106,7 @@ func TestOrganizationParam(t *testing.T) {
 	t.Run("NotInOrganization", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db   = dbfake.New()
+			db   = dbmem.New()
 			rw   = httptest.NewRecorder()
 			r, u = setupAuthentication(db)
 			rtr  = chi.NewRouter()
@@ -113,8 +114,8 @@ func TestOrganizationParam(t *testing.T) {
 		organization, err := db.InsertOrganization(r.Context(), database.InsertOrganizationParams{
 			ID:        uuid.New(),
 			Name:      "test",
-			CreatedAt: database.Now(),
-			UpdatedAt: database.Now(),
+			CreatedAt: dbtime.Now(),
+			UpdatedAt: dbtime.Now(),
 		})
 		require.NoError(t, err)
 		chi.RouteContext(r.Context()).URLParams.Add("organization", organization.ID.String())
@@ -124,7 +125,7 @@ func TestOrganizationParam(t *testing.T) {
 				DB:              db,
 				RedirectToLogin: false,
 			}),
-			httpmw.ExtractUserParam(db, false),
+			httpmw.ExtractUserParam(db),
 			httpmw.ExtractOrganizationParam(db),
 			httpmw.ExtractOrganizationMemberParam(db),
 		)
@@ -138,7 +139,7 @@ func TestOrganizationParam(t *testing.T) {
 	t.Run("Success", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db      = dbfake.New()
+			db      = dbmem.New()
 			rw      = httptest.NewRecorder()
 			r, user = setupAuthentication(db)
 			rtr     = chi.NewRouter()
@@ -156,7 +157,7 @@ func TestOrganizationParam(t *testing.T) {
 				RedirectToLogin: false,
 			}),
 			httpmw.ExtractOrganizationParam(db),
-			httpmw.ExtractUserParam(db, false),
+			httpmw.ExtractUserParam(db),
 			httpmw.ExtractOrganizationMemberParam(db),
 		)
 		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
diff --git a/coderd/httpmw/patternmatcher/routepatterns_test.go b/coderd/httpmw/patternmatcher/routepatterns_test.go
index 972e22727ad32..58d914d231e90 100644
--- a/coderd/httpmw/patternmatcher/routepatterns_test.go
+++ b/coderd/httpmw/patternmatcher/routepatterns_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpmw/patternmatcher"
+	"github.com/coder/coder/v2/coderd/httpmw/patternmatcher"
 )
 
 func Test_RoutePatterns(t *testing.T) {
@@ -65,9 +65,9 @@ func Test_RoutePatterns(t *testing.T) {
 				"/api/**",
 				"/@*/*/apps/**",
 				"/%40*/*/apps/**",
-				"/gitauth/*/callback",
+				"/external-auth/*/callback",
 			},
-			output: "^(/api/?|/api/.+/?|/@[^/]+/[^/]+/apps/.+/?|/%40[^/]+/[^/]+/apps/.+/?|/gitauth/[^/]+/callback/?)$",
+			output: "^(/api/?|/api/.+/?|/@[^/]+/[^/]+/apps/.+/?|/%40[^/]+/[^/]+/apps/.+/?|/external-auth/[^/]+/callback/?)$",
 		},
 		{
 			name: "Slash",
diff --git a/coderd/httpmw/prometheus.go b/coderd/httpmw/prometheus.go
index 5012b0023c8dd..b96be84e879e3 100644
--- a/coderd/httpmw/prometheus.go
+++ b/coderd/httpmw/prometheus.go
@@ -7,8 +7,8 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/tracing"
 
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promauto"
diff --git a/coderd/httpmw/prometheus_test.go b/coderd/httpmw/prometheus_test.go
index dce55c26bc134..a51eea5d00312 100644
--- a/coderd/httpmw/prometheus_test.go
+++ b/coderd/httpmw/prometheus_test.go
@@ -10,8 +10,8 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 func TestPrometheus(t *testing.T) {
diff --git a/coderd/httpmw/ratelimit.go b/coderd/httpmw/ratelimit.go
index ff4e888232411..bd1d1d6423fbf 100644
--- a/coderd/httpmw/ratelimit.go
+++ b/coderd/httpmw/ratelimit.go
@@ -9,11 +9,11 @@ import (
 	"github.com/go-chi/httprate"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 // RateLimit returns a handler that limits requests per-minute based
diff --git a/coderd/httpmw/ratelimit_test.go b/coderd/httpmw/ratelimit_test.go
index a201634edbcc5..a320e05af7ffe 100644
--- a/coderd/httpmw/ratelimit_test.go
+++ b/coderd/httpmw/ratelimit_test.go
@@ -12,12 +12,12 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func randRemoteAddr() string {
@@ -71,7 +71,7 @@ func TestRateLimit(t *testing.T) {
 	t.Run("RegularUser", func(t *testing.T) {
 		t.Parallel()
 
-		db := dbfake.New()
+		db := dbmem.New()
 		u := dbgen.User(t, db, database.User{})
 		_, key := dbgen.APIKey(t, db, database.APIKey{UserID: u.ID})
 
@@ -114,7 +114,7 @@ func TestRateLimit(t *testing.T) {
 	t.Run("OwnerBypass", func(t *testing.T) {
 		t.Parallel()
 
-		db := dbfake.New()
+		db := dbmem.New()
 
 		u := dbgen.User(t, db, database.User{
 			RBACRoles: []string{rbac.RoleOwner()},
diff --git a/coderd/httpmw/realip.go b/coderd/httpmw/realip.go
index e7cc679ba95c0..6f0f318b83224 100644
--- a/coderd/httpmw/realip.go
+++ b/coderd/httpmw/realip.go
@@ -8,7 +8,7 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpapi"
 )
 
 const (
diff --git a/coderd/httpmw/realip_test.go b/coderd/httpmw/realip_test.go
index 85036a3c63197..3070070bd90d8 100644
--- a/coderd/httpmw/realip_test.go
+++ b/coderd/httpmw/realip_test.go
@@ -11,7 +11,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/httpmw"
 )
 
 // TestExtractAddress checks the ExtractAddress function.
diff --git a/coderd/httpmw/recover.go b/coderd/httpmw/recover.go
index 3d19918f8d505..a8d6020561e09 100644
--- a/coderd/httpmw/recover.go
+++ b/coderd/httpmw/recover.go
@@ -6,8 +6,8 @@ import (
 	"runtime/debug"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 func Recover(log slog.Logger) func(h http.Handler) http.Handler {
diff --git a/coderd/httpmw/recover_test.go b/coderd/httpmw/recover_test.go
index 8e2746166903e..35306e0b50f57 100644
--- a/coderd/httpmw/recover_test.go
+++ b/coderd/httpmw/recover_test.go
@@ -8,8 +8,8 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 func TestRecover(t *testing.T) {
diff --git a/coderd/httpmw/requestid.go b/coderd/httpmw/requestid.go
index bd232c75a4948..e1014a089c5c0 100644
--- a/coderd/httpmw/requestid.go
+++ b/coderd/httpmw/requestid.go
@@ -5,6 +5,8 @@ import (
 	"net/http"
 
 	"github.com/google/uuid"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 
 	"cdr.dev/slog"
 )
@@ -29,6 +31,9 @@ func AttachRequestID(next http.Handler) http.Handler {
 		ctx := context.WithValue(r.Context(), requestIDContextKey{}, rid)
 		ctx = slog.With(ctx, slog.F("request_id", rid))
 
+		trace.SpanFromContext(ctx).
+			SetAttributes(attribute.String("request_id", rid.String()))
+
 		rw.Header().Set("X-Coder-Request-Id", ridString)
 		next.ServeHTTP(rw, r.WithContext(ctx))
 	})
diff --git a/coderd/httpmw/requestid_test.go b/coderd/httpmw/requestid_test.go
index c632dbbde8c4e..7dc21a8f23a43 100644
--- a/coderd/httpmw/requestid_test.go
+++ b/coderd/httpmw/requestid_test.go
@@ -8,7 +8,7 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/httpmw"
 )
 
 func TestRequestID(t *testing.T) {
diff --git a/coderd/httpmw/templateparam.go b/coderd/httpmw/templateparam.go
index eadb072d50131..8fe6f2a452199 100644
--- a/coderd/httpmw/templateparam.go
+++ b/coderd/httpmw/templateparam.go
@@ -6,9 +6,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type templateParamContextKey struct{}
diff --git a/coderd/httpmw/templateparam_test.go b/coderd/httpmw/templateparam_test.go
index c630d5570b25d..18b0b2f584e5f 100644
--- a/coderd/httpmw/templateparam_test.go
+++ b/coderd/httpmw/templateparam_test.go
@@ -10,11 +10,11 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestTemplateParam(t *testing.T) {
@@ -43,7 +43,7 @@ func TestTemplateParam(t *testing.T) {
 
 	t.Run("None", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractTemplateParam(db))
 		rtr.Get("/", nil)
@@ -58,7 +58,7 @@ func TestTemplateParam(t *testing.T) {
 
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractTemplateParam(db))
 		rtr.Get("/", nil)
@@ -75,7 +75,7 @@ func TestTemplateParam(t *testing.T) {
 
 	t.Run("BadUUID", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractTemplateParam(db))
 		rtr.Get("/", nil)
@@ -92,7 +92,7 @@ func TestTemplateParam(t *testing.T) {
 
 	t.Run("Template", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(
 			httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
diff --git a/coderd/httpmw/templateversionparam.go b/coderd/httpmw/templateversionparam.go
index 9f8f1c58561c6..702357b3d14fa 100644
--- a/coderd/httpmw/templateversionparam.go
+++ b/coderd/httpmw/templateversionparam.go
@@ -8,9 +8,9 @@ import (
 	"github.com/go-chi/chi/v5"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type templateVersionParamContextKey struct{}
diff --git a/coderd/httpmw/templateversionparam_test.go b/coderd/httpmw/templateversionparam_test.go
index febaa8f50bcdc..3f67aafbcf191 100644
--- a/coderd/httpmw/templateversionparam_test.go
+++ b/coderd/httpmw/templateversionparam_test.go
@@ -10,11 +10,11 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestTemplateVersionParam(t *testing.T) {
@@ -47,7 +47,7 @@ func TestTemplateVersionParam(t *testing.T) {
 
 	t.Run("None", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractTemplateVersionParam(db))
 		rtr.Get("/", nil)
@@ -62,7 +62,7 @@ func TestTemplateVersionParam(t *testing.T) {
 
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractTemplateVersionParam(db))
 		rtr.Get("/", nil)
@@ -79,7 +79,7 @@ func TestTemplateVersionParam(t *testing.T) {
 
 	t.Run("TemplateVersion", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(
 			httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
diff --git a/coderd/httpmw/userparam.go b/coderd/httpmw/userparam.go
index f565687e00bdd..03bff9bbb5596 100644
--- a/coderd/httpmw/userparam.go
+++ b/coderd/httpmw/userparam.go
@@ -2,15 +2,15 @@ package httpmw
 
 import (
 	"context"
+	"fmt"
 	"net/http"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type userParamContextKey struct{}
@@ -33,76 +33,77 @@ func UserParam(r *http.Request) database.User {
 
 // ExtractUserParam extracts a user from an ID/username in the {user} URL
 // parameter.
-//
-//nolint:revive
-func ExtractUserParam(db database.Store, redirectToLoginOnMe bool) func(http.Handler) http.Handler {
+func ExtractUserParam(db database.Store) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
-			var (
-				ctx  = r.Context()
-				user database.User
-				err  error
-			)
-
-			// userQuery is either a uuid, a username, or 'me'
-			userQuery := chi.URLParam(r, "user")
-			if userQuery == "" {
-				httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-					Message: "\"user\" must be provided.",
-				})
+			ctx := r.Context()
+			user, ok := extractUserContext(ctx, db, rw, r)
+			if !ok {
+				// response already handled
 				return
 			}
+			ctx = context.WithValue(ctx, userParamContextKey{}, user)
+			next.ServeHTTP(rw, r.WithContext(ctx))
+		})
+	}
+}
+
+// extractUserContext queries the database for the parameterized `{user}` from the request URL.
+func extractUserContext(ctx context.Context, db database.Store, rw http.ResponseWriter, r *http.Request) (user database.User, ok bool) {
+	// userQuery is either a uuid, a username, or 'me'
+	userQuery := chi.URLParam(r, "user")
+	if userQuery == "" {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "\"user\" must be provided.",
+		})
+		return database.User{}, true
+	}
 
-			if userQuery == "me" {
-				apiKey, ok := APIKeyOptional(r)
-				if !ok {
-					if redirectToLoginOnMe {
-						RedirectToLogin(rw, r, nil, SignedOutErrorMessage)
-						return
-					}
+	if userQuery == "me" {
+		apiKey, ok := APIKeyOptional(r)
+		if !ok {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Cannot use \"me\" without a valid session.",
+			})
+			return database.User{}, false
+		}
+		user, err := db.GetUserByID(ctx, apiKey.UserID)
+		if httpapi.Is404Error(err) {
+			httpapi.ResourceNotFound(rw)
+			return database.User{}, false
+		}
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error fetching user.",
+				Detail:  err.Error(),
+			})
+			return database.User{}, false
+		}
+		return user, true
+	}
 
-					httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-						Message: "Cannot use \"me\" without a valid session.",
-					})
-					return
-				}
-				//nolint:gocritic // System needs to be able to get user from param.
-				user, err = db.GetUserByID(dbauthz.AsSystemRestricted(ctx), apiKey.UserID)
-				if httpapi.Is404Error(err) {
-					httpapi.ResourceNotFound(rw)
-					return
-				}
-				if err != nil {
-					httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-						Message: "Internal error fetching user.",
-						Detail:  err.Error(),
-					})
-					return
-				}
-			} else if userID, err := uuid.Parse(userQuery); err == nil {
-				//nolint:gocritic // If the userQuery is a valid uuid
-				user, err = db.GetUserByID(dbauthz.AsSystemRestricted(ctx), userID)
-				if err != nil {
-					httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-						Message: userErrorMessage,
-					})
-					return
-				}
-			} else {
-				// nolint:gocritic // Try as a username last
-				user, err = db.GetUserByEmailOrUsername(dbauthz.AsSystemRestricted(ctx), database.GetUserByEmailOrUsernameParams{
-					Username: userQuery,
-				})
-				if err != nil {
-					httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-						Message: userErrorMessage,
-					})
-					return
-				}
-			}
+	if userID, err := uuid.Parse(userQuery); err == nil {
+		user, err = db.GetUserByID(ctx, userID)
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: userErrorMessage,
+				Detail:  fmt.Sprintf("queried user=%q", userQuery),
+			})
+			return database.User{}, false
+		}
+		return user, true
+	}
 
-			ctx = context.WithValue(ctx, userParamContextKey{}, user)
-			next.ServeHTTP(rw, r.WithContext(ctx))
+	// Try as a username last
+	user, err := db.GetUserByEmailOrUsername(ctx, database.GetUserByEmailOrUsernameParams{
+		Username: userQuery,
+	})
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: userErrorMessage,
+			Detail:  fmt.Sprintf("queried user=%q", userQuery),
 		})
+		return database.User{}, false
 	}
+	return user, true
 }
diff --git a/coderd/httpmw/userparam_test.go b/coderd/httpmw/userparam_test.go
index 4ce4e317f9f15..bda00193e9a24 100644
--- a/coderd/httpmw/userparam_test.go
+++ b/coderd/httpmw/userparam_test.go
@@ -9,18 +9,18 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestUserParam(t *testing.T) {
 	t.Parallel()
 	setup := func(t *testing.T) (database.Store, *httptest.ResponseRecorder, *http.Request) {
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -44,7 +44,7 @@ func TestUserParam(t *testing.T) {
 			r = returnedRequest
 		})).ServeHTTP(rw, r)
 
-		httpmw.ExtractUserParam(db, false)(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		httpmw.ExtractUserParam(db)(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			rw.WriteHeader(http.StatusOK)
 		})).ServeHTTP(rw, r)
 		res := rw.Result()
@@ -66,7 +66,7 @@ func TestUserParam(t *testing.T) {
 		routeContext := chi.NewRouteContext()
 		routeContext.URLParams.Add("user", "ben")
 		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, routeContext))
-		httpmw.ExtractUserParam(db, false)(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		httpmw.ExtractUserParam(db)(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			rw.WriteHeader(http.StatusOK)
 		})).ServeHTTP(rw, r)
 		res := rw.Result()
@@ -88,7 +88,7 @@ func TestUserParam(t *testing.T) {
 		routeContext := chi.NewRouteContext()
 		routeContext.URLParams.Add("user", "me")
 		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, routeContext))
-		httpmw.ExtractUserParam(db, false)(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		httpmw.ExtractUserParam(db)(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			_ = httpmw.UserParam(r)
 			rw.WriteHeader(http.StatusOK)
 		})).ServeHTTP(rw, r)
diff --git a/coderd/httpmw/workspaceagent.go b/coderd/httpmw/workspaceagent.go
index f039c6bbf7afb..883a54e404c4e 100644
--- a/coderd/httpmw/workspaceagent.go
+++ b/coderd/httpmw/workspaceagent.go
@@ -9,11 +9,11 @@ import (
 
 	"github.com/google/uuid"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type workspaceAgentContextKey struct{}
@@ -74,8 +74,9 @@ func ExtractWorkspaceAgent(opts ExtractWorkspaceAgentConfig) func(http.Handler)
 				})
 				return
 			}
+
 			//nolint:gocritic // System needs to be able to get workspace agents.
-			agent, err := opts.DB.GetWorkspaceAgentByAuthToken(dbauthz.AsSystemRestricted(ctx), token)
+			row, err := opts.DB.GetWorkspaceAgentAndOwnerByAuthToken(dbauthz.AsSystemRestricted(ctx), token)
 			if err != nil {
 				if errors.Is(err, sql.ErrNoRows) {
 					optionalWrite(http.StatusUnauthorized, codersdk.Response{
@@ -86,56 +87,23 @@ func ExtractWorkspaceAgent(opts ExtractWorkspaceAgentConfig) func(http.Handler)
 				}
 
 				httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-					Message: "Internal error fetching workspace agent.",
+					Message: "Internal error checking workspace agent authorization.",
 					Detail:  err.Error(),
 				})
 				return
 			}
 
-			//nolint:gocritic // System needs to be able to get workspace agents.
-			subject, err := getAgentSubject(dbauthz.AsSystemRestricted(ctx), opts.DB, agent)
-			if err != nil {
-				httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-					Message: "Internal error fetching workspace agent.",
-					Detail:  err.Error(),
-				})
-				return
-			}
+			subject := rbac.Subject{
+				ID:     row.OwnerID.String(),
+				Roles:  rbac.RoleNames(row.OwnerRoles),
+				Groups: row.OwnerGroups,
+				Scope:  rbac.WorkspaceAgentScope(row.WorkspaceID, row.OwnerID),
+			}.WithCachedASTValue()
 
-			ctx = context.WithValue(ctx, workspaceAgentContextKey{}, agent)
+			ctx = context.WithValue(ctx, workspaceAgentContextKey{}, row.WorkspaceAgent)
 			// Also set the dbauthz actor for the request.
 			ctx = dbauthz.As(ctx, subject)
 			next.ServeHTTP(rw, r.WithContext(ctx))
 		})
 	}
 }
-
-func getAgentSubject(ctx context.Context, db database.Store, agent database.WorkspaceAgent) (rbac.Subject, error) {
-	// TODO: make a different query that gets the workspace owner and roles along with the agent.
-	workspace, err := db.GetWorkspaceByAgentID(ctx, agent.ID)
-	if err != nil {
-		return rbac.Subject{}, err
-	}
-
-	user, err := db.GetUserByID(ctx, workspace.OwnerID)
-	if err != nil {
-		return rbac.Subject{}, err
-	}
-
-	roles, err := db.GetAuthorizationUserRoles(ctx, user.ID)
-	if err != nil {
-		return rbac.Subject{}, err
-	}
-
-	// A user that creates a workspace can use this agent auth token and
-	// impersonate the workspace. So to prevent privilege escalation, the
-	// subject inherits the roles of the user that owns the workspace.
-	// We then add a workspace-agent scope to limit the permissions
-	// to only what the workspace agent needs.
-	return rbac.Subject{
-		ID:     user.ID.String(),
-		Roles:  rbac.RoleNames(roles.Roles),
-		Groups: roles.Groups,
-		Scope:  rbac.WorkspaceAgentScope(workspace.ID, user.ID),
-	}.WithCachedASTValue(), nil
-}
diff --git a/coderd/httpmw/workspaceagent_test.go b/coderd/httpmw/workspaceagent_test.go
index 5b50aa14b4802..57885406289ae 100644
--- a/coderd/httpmw/workspaceagent_test.go
+++ b/coderd/httpmw/workspaceagent_test.go
@@ -9,36 +9,29 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestWorkspaceAgent(t *testing.T) {
 	t.Parallel()
 
-	setup := func(db database.Store, token uuid.UUID) *http.Request {
-		r := httptest.NewRequest("GET", "/", nil)
-		r.Header.Set(codersdk.SessionTokenHeader, token.String())
-		return r
-	}
-
 	t.Run("None", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
-		rtr := chi.NewRouter()
-		rtr.Use(
-			httpmw.ExtractWorkspaceAgent(httpmw.ExtractWorkspaceAgentConfig{
+		db, _ := dbtestutil.NewDB(t)
+
+		req, rtr := setup(t, db, uuid.New(), httpmw.ExtractWorkspaceAgent(
+			httpmw.ExtractWorkspaceAgentConfig{
 				DB:       db,
 				Optional: false,
-			}),
-		)
-		rtr.Get("/", nil)
-		r := setup(db, uuid.New())
+			}))
+
 		rw := httptest.NewRecorder()
-		rtr.ServeHTTP(rw, r)
+		req.Header.Set(codersdk.SessionTokenHeader, uuid.New().String())
+		rtr.ServeHTTP(rw, req)
 
 		res := rw.Result()
 		defer res.Body.Close()
@@ -47,42 +40,72 @@ func TestWorkspaceAgent(t *testing.T) {
 
 	t.Run("Found", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
-		var (
-			user      = dbgen.User(t, db, database.User{})
-			workspace = dbgen.Workspace(t, db, database.Workspace{
-				OwnerID: user.ID,
-			})
-			job      = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{})
-			resource = dbgen.WorkspaceResource(t, db, database.WorkspaceResource{
-				JobID: job.ID,
-			})
-			_ = dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
-				WorkspaceID: workspace.ID,
-				JobID:       job.ID,
-			})
-			agent = dbgen.WorkspaceAgent(t, db, database.WorkspaceAgent{
-				ResourceID: resource.ID,
-			})
-		)
-
-		rtr := chi.NewRouter()
-		rtr.Use(
-			httpmw.ExtractWorkspaceAgent(httpmw.ExtractWorkspaceAgentConfig{
+		db, _ := dbtestutil.NewDB(t)
+		authToken := uuid.New()
+		req, rtr := setup(t, db, authToken, httpmw.ExtractWorkspaceAgent(
+			httpmw.ExtractWorkspaceAgentConfig{
 				DB:       db,
 				Optional: false,
-			}),
-		)
-		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
-			_ = httpmw.WorkspaceAgent(r)
-			rw.WriteHeader(http.StatusOK)
-		})
-		r := setup(db, agent.AuthToken)
+			}))
+
 		rw := httptest.NewRecorder()
-		rtr.ServeHTTP(rw, r)
+		req.Header.Set(codersdk.SessionTokenHeader, authToken.String())
+		rtr.ServeHTTP(rw, req)
 
+		//nolint:bodyclose // Closed in `t.Cleanup`
 		res := rw.Result()
-		defer res.Body.Close()
+		t.Cleanup(func() { _ = res.Body.Close() })
 		require.Equal(t, http.StatusOK, res.StatusCode)
 	})
 }
+
+func setup(t testing.TB, db database.Store, authToken uuid.UUID, mw func(http.Handler) http.Handler) (*http.Request, http.Handler) {
+	t.Helper()
+	org := dbgen.Organization(t, db, database.Organization{})
+	user := dbgen.User(t, db, database.User{
+		Status: database.UserStatusActive,
+	})
+	_ = dbgen.OrganizationMember(t, db, database.OrganizationMember{
+		UserID:         user.ID,
+		OrganizationID: org.ID,
+	})
+	templateVersion := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+		OrganizationID: org.ID,
+		CreatedBy:      user.ID,
+	})
+	template := dbgen.Template(t, db, database.Template{
+		OrganizationID:  org.ID,
+		ActiveVersionID: templateVersion.ID,
+		CreatedBy:       user.ID,
+	})
+	workspace := dbgen.Workspace(t, db, database.Workspace{
+		OwnerID:        user.ID,
+		OrganizationID: org.ID,
+		TemplateID:     template.ID,
+	})
+	job := dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
+		OrganizationID: org.ID,
+	})
+	resource := dbgen.WorkspaceResource(t, db, database.WorkspaceResource{
+		JobID: job.ID,
+	})
+	_ = dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
+		WorkspaceID:       workspace.ID,
+		JobID:             job.ID,
+		TemplateVersionID: templateVersion.ID,
+	})
+	_ = dbgen.WorkspaceAgent(t, db, database.WorkspaceAgent{
+		ResourceID: resource.ID,
+		AuthToken:  authToken,
+	})
+
+	req := httptest.NewRequest("GET", "/", nil)
+	rtr := chi.NewRouter()
+	rtr.Use(mw)
+	rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
+		_ = httpmw.WorkspaceAgent(r)
+		rw.WriteHeader(http.StatusOK)
+	})
+
+	return req, rtr
+}
diff --git a/coderd/httpmw/workspaceagentparam.go b/coderd/httpmw/workspaceagentparam.go
index 7e31c9e15be31..67f6db0a5de4d 100644
--- a/coderd/httpmw/workspaceagentparam.go
+++ b/coderd/httpmw/workspaceagentparam.go
@@ -8,9 +8,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type workspaceAgentParamContextKey struct{}
diff --git a/coderd/httpmw/workspaceagentparam_test.go b/coderd/httpmw/workspaceagentparam_test.go
index f6a4c3fe1eaa7..16f81124d12d7 100644
--- a/coderd/httpmw/workspaceagentparam_test.go
+++ b/coderd/httpmw/workspaceagentparam_test.go
@@ -10,11 +10,11 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestWorkspaceAgentParam(t *testing.T) {
@@ -34,7 +34,7 @@ func TestWorkspaceAgentParam(t *testing.T) {
 				Transition:  database.WorkspaceTransitionStart,
 				Reason:      database.BuildReasonInitiator,
 			})
-			job = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+			job = dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
 				ID:            build.JobID,
 				Type:          database.ProvisionerJobTypeWorkspaceBuild,
 				Provisioner:   database.ProvisionerTypeEcho,
@@ -61,7 +61,7 @@ func TestWorkspaceAgentParam(t *testing.T) {
 
 	t.Run("None", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractWorkspaceBuildParam(db))
 		rtr.Get("/", nil)
@@ -76,7 +76,7 @@ func TestWorkspaceAgentParam(t *testing.T) {
 
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractWorkspaceAgentParam(db))
 		rtr.Get("/", nil)
@@ -93,7 +93,7 @@ func TestWorkspaceAgentParam(t *testing.T) {
 
 	t.Run("WorkspaceAgent", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(
 			httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
diff --git a/coderd/httpmw/workspacebuildparam.go b/coderd/httpmw/workspacebuildparam.go
index 518029465eb12..895f73ac0a9ff 100644
--- a/coderd/httpmw/workspacebuildparam.go
+++ b/coderd/httpmw/workspacebuildparam.go
@@ -6,9 +6,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type workspaceBuildParamContextKey struct{}
diff --git a/coderd/httpmw/workspacebuildparam_test.go b/coderd/httpmw/workspacebuildparam_test.go
index ac495537a1de3..fb2d2f044f77f 100644
--- a/coderd/httpmw/workspacebuildparam_test.go
+++ b/coderd/httpmw/workspacebuildparam_test.go
@@ -10,11 +10,11 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestWorkspaceBuildParam(t *testing.T) {
@@ -43,7 +43,7 @@ func TestWorkspaceBuildParam(t *testing.T) {
 
 	t.Run("None", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractWorkspaceBuildParam(db))
 		rtr.Get("/", nil)
@@ -58,7 +58,7 @@ func TestWorkspaceBuildParam(t *testing.T) {
 
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractWorkspaceBuildParam(db))
 		rtr.Get("/", nil)
@@ -75,7 +75,7 @@ func TestWorkspaceBuildParam(t *testing.T) {
 
 	t.Run("WorkspaceBuild", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(
 			httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
diff --git a/coderd/httpmw/workspaceparam.go b/coderd/httpmw/workspaceparam.go
index b0f264abe3619..21e8dcfd62863 100644
--- a/coderd/httpmw/workspaceparam.go
+++ b/coderd/httpmw/workspaceparam.go
@@ -9,9 +9,9 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type workspaceParamContextKey struct{}
diff --git a/coderd/httpmw/workspaceparam_test.go b/coderd/httpmw/workspaceparam_test.go
index 1c7504b793f64..54daf661c39c8 100644
--- a/coderd/httpmw/workspaceparam_test.go
+++ b/coderd/httpmw/workspaceparam_test.go
@@ -15,12 +15,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 func TestWorkspaceParam(t *testing.T) {
@@ -42,8 +43,8 @@ func TestWorkspaceParam(t *testing.T) {
 			Email:          "testaccount@coder.com",
 			HashedPassword: hashed[:],
 			Username:       username,
-			CreatedAt:      database.Now(),
-			UpdatedAt:      database.Now(),
+			CreatedAt:      dbtime.Now(),
+			UpdatedAt:      dbtime.Now(),
 			LoginType:      database.LoginTypePassword,
 		})
 		require.NoError(t, err)
@@ -51,7 +52,7 @@ func TestWorkspaceParam(t *testing.T) {
 		user, err = db.UpdateUserStatus(context.Background(), database.UpdateUserStatusParams{
 			ID:        user.ID,
 			Status:    database.UserStatusActive,
-			UpdatedAt: database.Now(),
+			UpdatedAt: dbtime.Now(),
 		})
 		require.NoError(t, err)
 
@@ -59,8 +60,8 @@ func TestWorkspaceParam(t *testing.T) {
 			ID:           id,
 			UserID:       user.ID,
 			HashedSecret: hashed[:],
-			LastUsed:     database.Now(),
-			ExpiresAt:    database.Now().Add(time.Minute),
+			LastUsed:     dbtime.Now(),
+			ExpiresAt:    dbtime.Now().Add(time.Minute),
 			LoginType:    database.LoginTypePassword,
 			Scope:        database.APIKeyScopeAll,
 		})
@@ -74,7 +75,7 @@ func TestWorkspaceParam(t *testing.T) {
 
 	t.Run("None", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractWorkspaceParam(db))
 		rtr.Get("/", nil)
@@ -89,7 +90,7 @@ func TestWorkspaceParam(t *testing.T) {
 
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractWorkspaceParam(db))
 		rtr.Get("/", nil)
@@ -105,7 +106,7 @@ func TestWorkspaceParam(t *testing.T) {
 
 	t.Run("Found", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(
 			httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
@@ -120,9 +121,10 @@ func TestWorkspaceParam(t *testing.T) {
 		})
 		r, user := setup(db)
 		workspace, err := db.InsertWorkspace(context.Background(), database.InsertWorkspaceParams{
-			ID:      uuid.New(),
-			OwnerID: user.ID,
-			Name:    "hello",
+			ID:               uuid.New(),
+			OwnerID:          user.ID,
+			Name:             "hello",
+			AutomaticUpdates: database.AutomaticUpdatesNever,
 		})
 		require.NoError(t, err)
 		chi.RouteContext(r.Context()).URLParams.Add("workspace", workspace.ID.String())
@@ -313,7 +315,7 @@ func TestWorkspaceAgentByNameParam(t *testing.T) {
 					DB:              db,
 					RedirectToLogin: true,
 				}),
-				httpmw.ExtractUserParam(db, false),
+				httpmw.ExtractUserParam(db),
 				httpmw.ExtractWorkspaceAndAgentParam(db),
 			)
 			rtr.Get("/", func(w http.ResponseWriter, r *http.Request) {
@@ -346,7 +348,7 @@ type setupConfig struct {
 
 func setupWorkspaceWithAgents(t testing.TB, cfg setupConfig) (database.Store, *http.Request) {
 	t.Helper()
-	db := dbfake.New()
+	db := dbmem.New()
 
 	var (
 		user     = dbgen.User(t, db, database.User{})
@@ -362,7 +364,7 @@ func setupWorkspaceWithAgents(t testing.TB, cfg setupConfig) (database.Store, *h
 			Transition:  database.WorkspaceTransitionStart,
 			Reason:      database.BuildReasonInitiator,
 		})
-		job = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		job = dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
 			ID:            build.JobID,
 			Type:          database.ProvisionerJobTypeWorkspaceBuild,
 			Provisioner:   database.ProvisionerTypeEcho,
diff --git a/coderd/httpmw/workspaceproxy.go b/coderd/httpmw/workspaceproxy.go
index 5df5e64a0cc07..d3a93962aaf6e 100644
--- a/coderd/httpmw/workspaceproxy.go
+++ b/coderd/httpmw/workspaceproxy.go
@@ -12,10 +12,10 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 const (
diff --git a/coderd/httpmw/workspaceproxy_test.go b/coderd/httpmw/workspaceproxy_test.go
index 818acf85c4442..b0a028f3caee8 100644
--- a/coderd/httpmw/workspaceproxy_test.go
+++ b/coderd/httpmw/workspaceproxy_test.go
@@ -11,13 +11,13 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 func TestExtractWorkspaceProxy(t *testing.T) {
@@ -33,7 +33,7 @@ func TestExtractWorkspaceProxy(t *testing.T) {
 	t.Run("NoHeader", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -48,7 +48,7 @@ func TestExtractWorkspaceProxy(t *testing.T) {
 	t.Run("InvalidFormat", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -65,7 +65,7 @@ func TestExtractWorkspaceProxy(t *testing.T) {
 	t.Run("InvalidID", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -82,7 +82,7 @@ func TestExtractWorkspaceProxy(t *testing.T) {
 	t.Run("InvalidSecretLength", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -99,7 +99,7 @@ func TestExtractWorkspaceProxy(t *testing.T) {
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -119,7 +119,7 @@ func TestExtractWorkspaceProxy(t *testing.T) {
 	t.Run("InvalidSecret", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 
@@ -142,7 +142,7 @@ func TestExtractWorkspaceProxy(t *testing.T) {
 	t.Run("Valid", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 
@@ -165,7 +165,7 @@ func TestExtractWorkspaceProxy(t *testing.T) {
 	t.Run("Deleted", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 
@@ -201,7 +201,7 @@ func TestExtractWorkspaceProxyParam(t *testing.T) {
 	t.Run("OKName", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 
@@ -225,7 +225,7 @@ func TestExtractWorkspaceProxyParam(t *testing.T) {
 	t.Run("OKID", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 
@@ -249,7 +249,7 @@ func TestExtractWorkspaceProxyParam(t *testing.T) {
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db = dbfake.New()
+			db = dbmem.New()
 			r  = httptest.NewRequest("GET", "/", nil)
 			rw = httptest.NewRecorder()
 		)
@@ -267,7 +267,7 @@ func TestExtractWorkspaceProxyParam(t *testing.T) {
 	t.Run("FetchPrimary", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db           = dbfake.New()
+			db           = dbmem.New()
 			r            = httptest.NewRequest("GET", "/", nil)
 			rw           = httptest.NewRecorder()
 			deploymentID = uuid.New()
diff --git a/coderd/httpmw/workspaceresourceparam.go b/coderd/httpmw/workspaceresourceparam.go
index 41d19a4ea0519..f2a9661b5c6c7 100644
--- a/coderd/httpmw/workspaceresourceparam.go
+++ b/coderd/httpmw/workspaceresourceparam.go
@@ -8,9 +8,9 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type workspaceResourceParamContextKey struct{}
diff --git a/coderd/httpmw/workspaceresourceparam_test.go b/coderd/httpmw/workspaceresourceparam_test.go
index bee32b0d304c3..9549e8e6d3ecf 100644
--- a/coderd/httpmw/workspaceresourceparam_test.go
+++ b/coderd/httpmw/workspaceresourceparam_test.go
@@ -10,10 +10,10 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/httpmw"
 )
 
 func TestWorkspaceResourceParam(t *testing.T) {
@@ -21,7 +21,7 @@ func TestWorkspaceResourceParam(t *testing.T) {
 
 	setup := func(t *testing.T, db database.Store, jobType database.ProvisionerJobType) (*http.Request, database.WorkspaceResource) {
 		r := httptest.NewRequest("GET", "/", nil)
-		job := dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		job := dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
 			Type:          jobType,
 			Provisioner:   database.ProvisionerTypeEcho,
 			StorageMethod: database.ProvisionerStorageMethodFile,
@@ -46,7 +46,7 @@ func TestWorkspaceResourceParam(t *testing.T) {
 
 	t.Run("None", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(httpmw.ExtractWorkspaceResourceParam(db))
 		rtr.Get("/", nil)
@@ -61,7 +61,7 @@ func TestWorkspaceResourceParam(t *testing.T) {
 
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(
 			httpmw.ExtractWorkspaceResourceParam(db),
@@ -80,7 +80,7 @@ func TestWorkspaceResourceParam(t *testing.T) {
 
 	t.Run("FoundBadJobType", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(
 			httpmw.ExtractWorkspaceResourceParam(db),
@@ -102,7 +102,7 @@ func TestWorkspaceResourceParam(t *testing.T) {
 
 	t.Run("Found", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		rtr := chi.NewRouter()
 		rtr.Use(
 			httpmw.ExtractWorkspaceResourceParam(db),
diff --git a/coderd/insights.go b/coderd/insights.go
index b643303dd0df2..714835db43dc3 100644
--- a/coderd/insights.go
+++ b/coderd/insights.go
@@ -2,20 +2,22 @@ package coderd
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"net/http"
-	"sort"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
 	"golang.org/x/exp/slices"
+	"golang.org/x/sync/errgroup"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // Duplicated in codersdk.
@@ -57,6 +59,93 @@ func (api *API) deploymentDAUs(rw http.ResponseWriter, r *http.Request) {
 	httpapi.Write(ctx, rw, http.StatusOK, resp)
 }
 
+// @Summary Get insights about user activity
+// @ID get-insights-about-user-activity
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Insights
+// @Success 200 {object} codersdk.UserActivityInsightsResponse
+// @Router /insights/user-activity [get]
+func (api *API) insightsUserActivity(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	p := httpapi.NewQueryParamParser().
+		Required("start_time").
+		Required("end_time")
+	vals := r.URL.Query()
+	var (
+		// The QueryParamParser does not preserve timezone, so we need
+		// to parse the time ourselves.
+		startTimeString = p.String(vals, "", "start_time")
+		endTimeString   = p.String(vals, "", "end_time")
+		templateIDs     = p.UUIDs(vals, []uuid.UUID{}, "template_ids")
+	)
+	p.ErrorExcessParams(vals)
+	if len(p.Errors) > 0 {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message:     "Query parameters have invalid values.",
+			Validations: p.Errors,
+		})
+		return
+	}
+
+	startTime, endTime, ok := parseInsightsStartAndEndTime(ctx, rw, startTimeString, endTimeString)
+	if !ok {
+		return
+	}
+
+	rows, err := api.Database.GetUserActivityInsights(ctx, database.GetUserActivityInsightsParams{
+		StartTime:   startTime,
+		EndTime:     endTime,
+		TemplateIDs: templateIDs,
+	})
+	if err != nil {
+		if httpapi.Is404Error(err) {
+			httpapi.ResourceNotFound(rw)
+			return
+		}
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error fetching user activity.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	templateIDSet := make(map[uuid.UUID]struct{})
+	userActivities := make([]codersdk.UserActivity, 0, len(rows))
+	for _, row := range rows {
+		for _, templateID := range row.TemplateIDs {
+			templateIDSet[templateID] = struct{}{}
+		}
+		userActivities = append(userActivities, codersdk.UserActivity{
+			TemplateIDs: row.TemplateIDs,
+			UserID:      row.UserID,
+			Username:    row.Username,
+			AvatarURL:   row.AvatarURL.String,
+			Seconds:     row.UsageSeconds,
+		})
+	}
+
+	// TemplateIDs that contributed to the data.
+	seenTemplateIDs := make([]uuid.UUID, 0, len(templateIDSet))
+	for templateID := range templateIDSet {
+		seenTemplateIDs = append(seenTemplateIDs, templateID)
+	}
+	slices.SortFunc(seenTemplateIDs, func(a, b uuid.UUID) int {
+		return slice.Ascending(a.String(), b.String())
+	})
+
+	resp := codersdk.UserActivityInsightsResponse{
+		Report: codersdk.UserActivityInsightsReport{
+			StartTime:   startTime,
+			EndTime:     endTime,
+			TemplateIDs: seenTemplateIDs,
+			Users:       userActivities,
+		},
+	}
+	httpapi.Write(ctx, rw, http.StatusOK, resp)
+}
+
 // @Summary Get insights about user latency
 // @ID get-insights-about-user-latency
 // @Security CoderSessionToken
@@ -132,8 +221,8 @@ func (api *API) insightsUserLatency(rw http.ResponseWriter, r *http.Request) {
 	for templateID := range templateIDSet {
 		seenTemplateIDs = append(seenTemplateIDs, templateID)
 	}
-	slices.SortFunc(seenTemplateIDs, func(a, b uuid.UUID) bool {
-		return a.String() < b.String()
+	slices.SortFunc(seenTemplateIDs, func(a, b uuid.UUID) int {
+		return slice.Ascending(a.String(), b.String())
 	})
 
 	resp := codersdk.UserLatencyInsightsResponse{
@@ -168,6 +257,7 @@ func (api *API) insightsTemplates(rw http.ResponseWriter, r *http.Request) {
 		endTimeString   = p.String(vals, "", "end_time")
 		intervalString  = p.String(vals, "", "interval")
 		templateIDs     = p.UUIDs(vals, []uuid.UUID{}, "template_ids")
+		sectionStrings  = p.Strings(vals, templateInsightsSectionAsStrings(codersdk.TemplateInsightsSectionIntervalReports, codersdk.TemplateInsightsSectionReport), "sections")
 	)
 	p.ErrorExcessParams(vals)
 	if len(p.Errors) > 0 {
@@ -182,31 +272,48 @@ func (api *API) insightsTemplates(rw http.ResponseWriter, r *http.Request) {
 	if !ok {
 		return
 	}
-	interval, ok := verifyInsightsInterval(ctx, rw, intervalString)
+	interval, ok := parseInsightsInterval(ctx, rw, intervalString, startTime, endTime)
+	if !ok {
+		return
+	}
+	sections, ok := parseTemplateInsightsSections(ctx, rw, sectionStrings)
 	if !ok {
 		return
 	}
 
 	var usage database.GetTemplateInsightsRow
-	var dailyUsage []database.GetTemplateDailyInsightsRow
+	var appUsage []database.GetTemplateAppInsightsRow
+	var dailyUsage []database.GetTemplateInsightsByIntervalRow
+	var parameterRows []database.GetTemplateParameterInsightsRow
 
-	// Use a transaction to ensure that we get consistent data between
-	// the full and interval report.
-	err := api.Database.InTx(func(tx database.Store) error {
-		var err error
+	eg, egCtx := errgroup.WithContext(ctx)
+	eg.SetLimit(4)
 
-		if interval != "" {
-			dailyUsage, err = tx.GetTemplateDailyInsights(ctx, database.GetTemplateDailyInsightsParams{
-				StartTime:   startTime,
-				EndTime:     endTime,
-				TemplateIDs: templateIDs,
+	// The following insights data queries have a theoretical chance to be
+	// inconsistent between each other when looking at "today", however, the
+	// overhead from a transaction is not worth it.
+	eg.Go(func() error {
+		var err error
+		if interval != "" && slices.Contains(sections, codersdk.TemplateInsightsSectionIntervalReports) {
+			dailyUsage, err = api.Database.GetTemplateInsightsByInterval(egCtx, database.GetTemplateInsightsByIntervalParams{
+				StartTime:    startTime,
+				EndTime:      endTime,
+				TemplateIDs:  templateIDs,
+				IntervalDays: interval.Days(),
 			})
 			if err != nil {
 				return xerrors.Errorf("get template daily insights: %w", err)
 			}
 		}
+		return nil
+	})
+	eg.Go(func() error {
+		if !slices.Contains(sections, codersdk.TemplateInsightsSectionReport) {
+			return nil
+		}
 
-		usage, err = tx.GetTemplateInsights(ctx, database.GetTemplateInsightsParams{
+		var err error
+		usage, err = api.Database.GetTemplateInsights(egCtx, database.GetTemplateInsightsParams{
 			StartTime:   startTime,
 			EndTime:     endTime,
 			TemplateIDs: templateIDs,
@@ -214,9 +321,45 @@ func (api *API) insightsTemplates(rw http.ResponseWriter, r *http.Request) {
 		if err != nil {
 			return xerrors.Errorf("get template insights: %w", err)
 		}
+		return nil
+	})
+	eg.Go(func() error {
+		if !slices.Contains(sections, codersdk.TemplateInsightsSectionReport) {
+			return nil
+		}
+
+		var err error
+		appUsage, err = api.Database.GetTemplateAppInsights(egCtx, database.GetTemplateAppInsightsParams{
+			StartTime:   startTime,
+			EndTime:     endTime,
+			TemplateIDs: templateIDs,
+		})
+		if err != nil {
+			return xerrors.Errorf("get template app insights: %w", err)
+		}
+		return nil
+	})
 
+	// Template parameter insights have no risk of inconsistency with the other
+	// insights.
+	eg.Go(func() error {
+		if !slices.Contains(sections, codersdk.TemplateInsightsSectionReport) {
+			return nil
+		}
+
+		var err error
+		parameterRows, err = api.Database.GetTemplateParameterInsights(ctx, database.GetTemplateParameterInsightsParams{
+			StartTime:   startTime,
+			EndTime:     endTime,
+			TemplateIDs: templateIDs,
+		})
+		if err != nil {
+			return xerrors.Errorf("get template parameter insights: %w", err)
+		}
 		return nil
-	}, nil)
+	})
+
+	err := eg.Wait()
 	if httpapi.Is404Error(err) {
 		httpapi.ResourceNotFound(rw)
 		return
@@ -229,22 +372,7 @@ func (api *API) insightsTemplates(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Template parameter insights have no risk of inconsistency with the other
-	// insights, so we don't need to perform this in a transaction.
-	parameterRows, err := api.Database.GetTemplateParameterInsights(ctx, database.GetTemplateParameterInsightsParams{
-		StartTime:   startTime,
-		EndTime:     endTime,
-		TemplateIDs: templateIDs,
-	})
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching template parameter insights.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-
-	parametersUsage, err := convertTemplateInsightsParameters(parameterRows)
+	parametersUsage, err := db2sdk.TemplateInsightsParameters(parameterRows)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 			Message: "Internal error converting template parameter insights.",
@@ -254,20 +382,26 @@ func (api *API) insightsTemplates(rw http.ResponseWriter, r *http.Request) {
 	}
 
 	resp := codersdk.TemplateInsightsResponse{
-		Report: codersdk.TemplateInsightsReport{
+		IntervalReports: []codersdk.TemplateInsightsIntervalReport{},
+	}
+
+	if slices.Contains(sections, codersdk.TemplateInsightsSectionReport) {
+		resp.Report = &codersdk.TemplateInsightsReport{
 			StartTime:       startTime,
 			EndTime:         endTime,
-			TemplateIDs:     usage.TemplateIDs,
-			ActiveUsers:     usage.ActiveUsers,
-			AppsUsage:       convertTemplateInsightsBuiltinApps(usage),
+			TemplateIDs:     convertTemplateInsightsTemplateIDs(usage, appUsage),
+			ActiveUsers:     convertTemplateInsightsActiveUsers(usage, appUsage),
+			AppsUsage:       convertTemplateInsightsApps(usage, appUsage),
 			ParametersUsage: parametersUsage,
-		},
-		IntervalReports: []codersdk.TemplateInsightsIntervalReport{},
+		}
 	}
+
 	for _, row := range dailyUsage {
 		resp.IntervalReports = append(resp.IntervalReports, codersdk.TemplateInsightsIntervalReport{
-			StartTime:   row.StartTime,
-			EndTime:     row.EndTime,
+			// NOTE(mafredri): This might not be accurate over DST since the
+			// parsed location only contains the offset.
+			StartTime:   row.StartTime.In(startTime.Location()),
+			EndTime:     row.EndTime.In(startTime.Location()),
 			Interval:    interval,
 			TemplateIDs: row.TemplateIDs,
 			ActiveUsers: row.ActiveUsers,
@@ -276,10 +410,45 @@ func (api *API) insightsTemplates(rw http.ResponseWriter, r *http.Request) {
 	httpapi.Write(ctx, rw, http.StatusOK, resp)
 }
 
-// convertTemplateInsightsBuiltinApps builds the list of builtin apps from the
-// database row, these are apps that are implicitly a part of all templates.
-func convertTemplateInsightsBuiltinApps(usage database.GetTemplateInsightsRow) []codersdk.TemplateAppUsage {
-	return []codersdk.TemplateAppUsage{
+func convertTemplateInsightsTemplateIDs(usage database.GetTemplateInsightsRow, appUsage []database.GetTemplateAppInsightsRow) []uuid.UUID {
+	templateIDSet := make(map[uuid.UUID]struct{})
+	for _, id := range usage.TemplateIDs {
+		templateIDSet[id] = struct{}{}
+	}
+	for _, app := range appUsage {
+		for _, id := range app.TemplateIDs {
+			templateIDSet[id] = struct{}{}
+		}
+	}
+	templateIDs := make([]uuid.UUID, 0, len(templateIDSet))
+	for id := range templateIDSet {
+		templateIDs = append(templateIDs, id)
+	}
+	slices.SortFunc(templateIDs, func(a, b uuid.UUID) int {
+		return slice.Ascending(a.String(), b.String())
+	})
+	return templateIDs
+}
+
+func convertTemplateInsightsActiveUsers(usage database.GetTemplateInsightsRow, appUsage []database.GetTemplateAppInsightsRow) int64 {
+	activeUserIDSet := make(map[uuid.UUID]struct{})
+	for _, id := range usage.ActiveUserIDs {
+		activeUserIDSet[id] = struct{}{}
+	}
+	for _, app := range appUsage {
+		for _, id := range app.ActiveUserIDs {
+			activeUserIDSet[id] = struct{}{}
+		}
+	}
+	return int64(len(activeUserIDSet))
+}
+
+// convertTemplateInsightsApps builds the list of builtin apps and template apps
+// from the provided database rows, builtin apps are implicitly a part of all
+// templates.
+func convertTemplateInsightsApps(usage database.GetTemplateInsightsRow, appUsage []database.GetTemplateAppInsightsRow) []codersdk.TemplateAppUsage {
+	// Builtin apps.
+	apps := []codersdk.TemplateAppUsage{
 		{
 			TemplateIDs: usage.TemplateIDs,
 			Type:        codersdk.TemplateAppsTypeBuiltin,
@@ -296,6 +465,12 @@ func convertTemplateInsightsBuiltinApps(usage database.GetTemplateInsightsRow) [
 			Icon:        "/icon/intellij.svg",
 			Seconds:     usage.UsageJetbrainsSeconds,
 		},
+		// TODO(mafredri): We could take Web Terminal usage from appUsage since
+		// that should be more accurate. The difference is that this reflects
+		// the rpty session as seen by the agent (can live past the connection),
+		// whereas appUsage reflects the lifetime of the client connection. The
+		// condition finding the corresponding app entry in appUsage is:
+		// !app.IsApp && app.AccessMethod == "terminal" && app.SlugOrPort == ""
 		{
 			TemplateIDs: usage.TemplateIDs,
 			Type:        codersdk.TemplateAppsTypeBuiltin,
@@ -313,39 +488,49 @@ func convertTemplateInsightsBuiltinApps(usage database.GetTemplateInsightsRow) [
 			Seconds:     usage.UsageSshSeconds,
 		},
 	}
-}
 
-func convertTemplateInsightsParameters(parameterRows []database.GetTemplateParameterInsightsRow) ([]codersdk.TemplateParameterUsage, error) {
-	parametersByNum := make(map[int64]*codersdk.TemplateParameterUsage)
-	for _, param := range parameterRows {
-		if _, ok := parametersByNum[param.Num]; !ok {
-			var opts []codersdk.TemplateVersionParameterOption
-			err := json.Unmarshal(param.Options, &opts)
-			if err != nil {
-				return nil, xerrors.Errorf("unmarshal template parameter options: %w", err)
-			}
-			parametersByNum[param.Num] = &codersdk.TemplateParameterUsage{
-				TemplateIDs: param.TemplateIDs,
-				Name:        param.Name,
-				DisplayName: param.DisplayName,
-				Options:     opts,
-			}
+	// Use a stable sort, similarly to how we would sort in the query, note that
+	// we don't sort in the query because order varies depending on the table
+	// collation.
+	//
+	// ORDER BY access_method, slug_or_port, display_name, icon, is_app
+	slices.SortFunc(appUsage, func(a, b database.GetTemplateAppInsightsRow) int {
+		if a.AccessMethod != b.AccessMethod {
+			return strings.Compare(a.AccessMethod, b.AccessMethod)
 		}
-		parametersByNum[param.Num].Values = append(parametersByNum[param.Num].Values, codersdk.TemplateParameterValue{
-			Value: param.Value,
-			Count: param.Count,
+		if a.SlugOrPort != b.SlugOrPort {
+			return strings.Compare(a.SlugOrPort, b.SlugOrPort)
+		}
+		if a.DisplayName.String != b.DisplayName.String {
+			return strings.Compare(a.DisplayName.String, b.DisplayName.String)
+		}
+		if a.Icon.String != b.Icon.String {
+			return strings.Compare(a.Icon.String, b.Icon.String)
+		}
+		if !a.IsApp && b.IsApp {
+			return -1
+		} else if a.IsApp && !b.IsApp {
+			return 1
+		}
+		return 0
+	})
+
+	// Template apps.
+	for _, app := range appUsage {
+		if !app.IsApp {
+			continue
+		}
+		apps = append(apps, codersdk.TemplateAppUsage{
+			TemplateIDs: app.TemplateIDs,
+			Type:        codersdk.TemplateAppsTypeApp,
+			DisplayName: app.DisplayName.String,
+			Slug:        app.SlugOrPort,
+			Icon:        app.Icon.String,
+			Seconds:     app.UsageSeconds,
 		})
 	}
-	parametersUsage := []codersdk.TemplateParameterUsage{}
-	for _, param := range parametersByNum {
-		parametersUsage = append(parametersUsage, *param)
-	}
 
-	sort.Slice(parametersUsage, func(i, j int) bool {
-		return parametersUsage[i].Name < parametersUsage[j].Name
-	})
-
-	return parametersUsage, nil
+	return apps
 }
 
 // parseInsightsStartAndEndTime parses the start and end time query parameters
@@ -454,20 +639,69 @@ func parseInsightsStartAndEndTime(ctx context.Context, rw http.ResponseWriter, s
 	return startTime, endTime, true
 }
 
-func verifyInsightsInterval(ctx context.Context, rw http.ResponseWriter, intervalString string) (codersdk.InsightsReportInterval, bool) {
+func parseInsightsInterval(ctx context.Context, rw http.ResponseWriter, intervalString string, startTime, endTime time.Time) (codersdk.InsightsReportInterval, bool) {
 	switch v := codersdk.InsightsReportInterval(intervalString); v {
 	case codersdk.InsightsReportIntervalDay, "":
 		return v, true
+	case codersdk.InsightsReportIntervalWeek:
+		if !lastReportIntervalHasAtLeastSixDays(startTime, endTime) {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Query parameter has invalid value.",
+				Detail:  "Last report interval should have at least 6 days.",
+			})
+			return "", false
+		}
+		return v, true
 	default:
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 			Message: "Query parameter has invalid value.",
 			Validations: []codersdk.ValidationError{
 				{
 					Field:  "interval",
-					Detail: fmt.Sprintf("must be one of %v", []codersdk.InsightsReportInterval{codersdk.InsightsReportIntervalDay}),
+					Detail: fmt.Sprintf("must be one of %v", []codersdk.InsightsReportInterval{codersdk.InsightsReportIntervalDay, codersdk.InsightsReportIntervalWeek}),
 				},
 			},
 		})
 		return "", false
 	}
 }
+
+func lastReportIntervalHasAtLeastSixDays(startTime, endTime time.Time) bool {
+	lastReportIntervalDays := endTime.Sub(startTime) % (7 * 24 * time.Hour)
+	if lastReportIntervalDays == 0 {
+		return true // this is a perfectly full week!
+	}
+	// Ensure that the last interval has at least 6 days, or check the special case, forward DST change,
+	// when the duration can be shorter than 6 days: 5 days 23 hours.
+	return lastReportIntervalDays >= 6*24*time.Hour || startTime.AddDate(0, 0, 6).Equal(endTime)
+}
+
+func templateInsightsSectionAsStrings(sections ...codersdk.TemplateInsightsSection) []string {
+	t := make([]string, len(sections))
+	for i, s := range sections {
+		t[i] = string(s)
+	}
+	return t
+}
+
+func parseTemplateInsightsSections(ctx context.Context, rw http.ResponseWriter, sections []string) ([]codersdk.TemplateInsightsSection, bool) {
+	t := make([]codersdk.TemplateInsightsSection, len(sections))
+	for i, s := range sections {
+		switch v := codersdk.TemplateInsightsSection(s); v {
+		case codersdk.TemplateInsightsSectionIntervalReports, codersdk.TemplateInsightsSectionReport:
+			t[i] = v
+		default:
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Query parameter has invalid value.",
+				Validations: []codersdk.ValidationError{
+					{
+						Field:  "sections",
+						Detail: fmt.Sprintf("must be one of %v", []codersdk.TemplateInsightsSection{codersdk.TemplateInsightsSectionIntervalReports, codersdk.TemplateInsightsSectionReport}),
+					},
+				},
+			})
+			return nil, false
+		}
+	}
+	return t, true
+}
diff --git a/coderd/insights_internal_test.go b/coderd/insights_internal_test.go
index e4569b33db9b8..c5fcbfbe88916 100644
--- a/coderd/insights_internal_test.go
+++ b/coderd/insights_internal_test.go
@@ -8,6 +8,8 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func Test_parseInsightsStartAndEndTime(t *testing.T) {
@@ -148,3 +150,156 @@ func Test_parseInsightsStartAndEndTime(t *testing.T) {
 		})
 	}
 }
+
+func Test_parseInsightsInterval_week(t *testing.T) {
+	t.Parallel()
+
+	layout := insightsTimeLayout
+	sydneyLoc, err := time.LoadLocation("Australia/Sydney") // Random location
+	require.NoError(t, err)
+
+	now := time.Now()
+	t.Logf("now: %s", now)
+
+	y, m, d := now.Date()
+	today := time.Date(y, m, d, 0, 0, 0, 0, sydneyLoc)
+	t.Logf("today: %s", today)
+
+	thisHour := time.Date(y, m, d, now.Hour(), 0, 0, 0, sydneyLoc)
+	t.Logf("thisHour: %s", thisHour)
+	twoHoursAgo := thisHour.Add(-2 * time.Hour)
+	t.Logf("twoHoursAgo: %s", twoHoursAgo)
+	thirteenDaysAgo := today.AddDate(0, 0, -13)
+	t.Logf("thirteenDaysAgo: %s", thirteenDaysAgo)
+
+	sixDaysAgo := today.AddDate(0, 0, -6)
+	t.Logf("sixDaysAgo: %s", sixDaysAgo)
+	nineDaysAgo := today.AddDate(0, 0, -9)
+	t.Logf("nineDaysAgo: %s", nineDaysAgo)
+
+	type args struct {
+		startTime string
+		endTime   string
+	}
+	tests := []struct {
+		name   string
+		args   args
+		wantOk bool
+	}{
+		{
+			name: "Two full weeks",
+			args: args{
+				startTime: "2023-08-10T00:00:00+02:00",
+				endTime:   "2023-08-24T00:00:00+02:00",
+			},
+			wantOk: true,
+		},
+		{
+			name: "One full week",
+			args: args{
+				startTime: "2023-09-06T00:00:00+02:00",
+				endTime:   "2023-09-13T00:00:00+02:00",
+			},
+			wantOk: true,
+		},
+		{
+			name: "6 days are acceptable",
+			args: args{
+				startTime: sixDaysAgo.Format(layout),
+				endTime:   thisHour.Format(layout),
+			},
+			wantOk: true,
+		},
+		{
+			name: "Shorter than a full week",
+			args: args{
+				startTime: "2023-09-08T00:00:00+02:00",
+				endTime:   "2023-09-13T00:00:00+02:00",
+			},
+			wantOk: false,
+		},
+		{
+			name: "9 days (7 + 2) are not acceptable",
+			args: args{
+				startTime: nineDaysAgo.Format(layout),
+				endTime:   thisHour.Format(layout),
+			},
+			wantOk: false,
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			rw := httptest.NewRecorder()
+			startTime, endTime, ok := parseInsightsStartAndEndTime(context.Background(), rw, tt.args.startTime, tt.args.endTime)
+			if !ok {
+				//nolint:bodyclose
+				t.Log("Status: ", rw.Result().StatusCode)
+				t.Log("Body: ", rw.Body.String())
+			}
+			require.True(t, ok, "start_time and end_time must be valid")
+
+			parsedInterval, gotOk := parseInsightsInterval(context.Background(), rw, "week", startTime, endTime)
+			if !assert.Equal(t, tt.wantOk, gotOk) {
+				//nolint:bodyclose
+				t.Log("Status: ", rw.Result().StatusCode)
+				t.Log("Body: ", rw.Body.String())
+			}
+			if tt.wantOk {
+				assert.Equal(t, codersdk.InsightsReportIntervalWeek, parsedInterval)
+			}
+		})
+	}
+}
+
+func TestLastReportIntervalHasAtLeastSixDays(t *testing.T) {
+	t.Parallel()
+
+	loc, err := time.LoadLocation("Europe/Warsaw")
+	require.NoError(t, err)
+
+	testCases := []struct {
+		name      string
+		startTime time.Time
+		endTime   time.Time
+		expected  bool
+	}{
+		{
+			name:      "perfectly full week",
+			startTime: time.Date(2023, time.September, 11, 12, 0, 0, 0, loc),
+			endTime:   time.Date(2023, time.September, 18, 12, 0, 0, 0, loc),
+			expected:  true,
+		},
+		{
+			name:      "exactly 6 days apart",
+			startTime: time.Date(2023, time.September, 11, 12, 0, 0, 0, loc),
+			endTime:   time.Date(2023, time.September, 17, 12, 0, 0, 0, loc),
+			expected:  true,
+		},
+		{
+			name:      "less than 6 days apart",
+			startTime: time.Date(2023, time.September, 11, 12, 0, 0, 0, time.UTC),
+			endTime:   time.Date(2023, time.September, 17, 11, 0, 0, 0, time.UTC),
+			expected:  false,
+		},
+		{
+			name:      "forward DST change, 5 days and 23 hours apart",
+			startTime: time.Date(2023, time.March, 22, 12, 0, 0, 0, loc), // A day before DST starts
+			endTime:   time.Date(2023, time.March, 28, 12, 0, 0, 0, loc), // Exactly 6 "days" apart
+			expected:  true,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			result := lastReportIntervalHasAtLeastSixDays(tc.startTime, tc.endTime)
+			if result != tc.expected {
+				t.Errorf("Expected %v, but got %v for start time %v and end time %v", tc.expected, result, tc.startTime, tc.endTime)
+			}
+		})
+	}
+}
diff --git a/coderd/insights_test.go b/coderd/insights_test.go
index 2469cc0f4b362..b154bb114c135 100644
--- a/coderd/insights_test.go
+++ b/coderd/insights_test.go
@@ -2,26 +2,37 @@ package coderd_test
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/google/go-cmp/cmp"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/exp/slices"
 
+	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/coderd/batchstats"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestDeploymentInsights(t *testing.T) {
@@ -37,27 +48,18 @@ func TestDeploymentInsights(t *testing.T) {
 	authToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:          echo.ParseComplete,
-		ProvisionPlan:  echo.ProvisionComplete,
+		ProvisionPlan:  echo.PlanComplete,
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	require.Empty(t, template.BuildTimeStats[codersdk.WorkspaceTransitionStart])
 
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Logger: slogtest.Make(t, nil),
-		Client: agentClient,
-	})
-	defer func() {
-		_ = agentCloser.Close()
-	}()
+	_ = agenttest.New(t, client.URL, authToken)
 	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
-
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
 
@@ -107,7 +109,7 @@ func TestDeploymentInsights(t *testing.T) {
 	require.NoError(t, err)
 }
 
-func TestUserLatencyInsights(t *testing.T) {
+func TestUserActivityInsights_SanityCheck(t *testing.T) {
 	t.Parallel()
 
 	logger := slogtest.Make(t, nil)
@@ -123,26 +125,18 @@ func TestUserLatencyInsights(t *testing.T) {
 	authToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:          echo.ParseComplete,
-		ProvisionPlan:  echo.ProvisionComplete,
+		ProvisionPlan:  echo.PlanComplete,
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	require.Empty(t, template.BuildTimeStats[codersdk.WorkspaceTransitionStart])
 
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	// Start an agent so that we can generate stats.
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Logger: logger.Named("agent"),
-		Client: agentClient,
-	})
-	defer func() {
-		_ = agentCloser.Close()
-	}()
+	_ = agenttest.New(t, client.URL, authToken)
 	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 	// Start must be at the beginning of the day, initialize it early in case
@@ -176,14 +170,14 @@ func TestUserLatencyInsights(t *testing.T) {
 	err = sess.Start("cat")
 	require.NoError(t, err)
 
-	var userLatencies codersdk.UserLatencyInsightsResponse
+	var userActivities codersdk.UserActivityInsightsResponse
 	require.Eventuallyf(t, func() bool {
 		// Keep connection active.
 		_, err := w.Write([]byte("hello world\n"))
 		if !assert.NoError(t, err) {
 			return false
 		}
-		userLatencies, err = client.UserLatencyInsights(ctx, codersdk.UserLatencyInsightsRequest{
+		userActivities, err = client.UserActivityInsights(ctx, codersdk.UserActivityInsightsRequest{
 			StartTime:   today,
 			EndTime:     time.Now().UTC().Truncate(time.Hour).Add(time.Hour), // Round up to include the current hour.
 			TemplateIDs: []uuid.UUID{template.ID},
@@ -191,128 +185,46 @@ func TestUserLatencyInsights(t *testing.T) {
 		if !assert.NoError(t, err) {
 			return false
 		}
-		return len(userLatencies.Report.Users) > 0 && userLatencies.Report.Users[0].LatencyMS.P50 > 0
-	}, testutil.WaitMedium, testutil.IntervalFast, "user latency is missing")
+		return len(userActivities.Report.Users) > 0 && userActivities.Report.Users[0].Seconds > 0
+	}, testutil.WaitMedium, testutil.IntervalFast, "user activity is missing")
 
 	// We got our latency data, close the connection.
 	_ = sess.Close()
 	_ = sshConn.Close()
 
-	require.Len(t, userLatencies.Report.Users, 1, "want only 1 user")
-	require.Equal(t, userLatencies.Report.Users[0].UserID, user.UserID, "want user id to match")
-	assert.Greater(t, userLatencies.Report.Users[0].LatencyMS.P50, float64(0), "want p50 to be greater than 0")
-	assert.Greater(t, userLatencies.Report.Users[0].LatencyMS.P95, float64(0), "want p95 to be greater than 0")
-}
-
-func TestUserLatencyInsights_BadRequest(t *testing.T) {
-	t.Parallel()
-
-	client := coderdtest.New(t, &coderdtest.Options{})
-	_ = coderdtest.CreateFirstUser(t, client)
-
-	y, m, d := time.Now().UTC().Date()
-	today := time.Date(y, m, d, 0, 0, 0, 0, time.UTC)
-
-	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-	defer cancel()
-
-	_, err := client.UserLatencyInsights(ctx, codersdk.UserLatencyInsightsRequest{
-		StartTime: today,
-		EndTime:   today.AddDate(0, 0, -1),
-	})
-	assert.Error(t, err, "want error for end time before start time")
-
-	_, err = client.UserLatencyInsights(ctx, codersdk.UserLatencyInsightsRequest{
-		StartTime: today.AddDate(0, 0, -7),
-		EndTime:   today.Add(-time.Hour),
-	})
-	assert.Error(t, err, "want error for end time partial day when not today")
+	require.Len(t, userActivities.Report.Users, 1, "want only 1 user")
+	require.Equal(t, userActivities.Report.Users[0].UserID, user.UserID, "want user id to match")
+	assert.Greater(t, userActivities.Report.Users[0].Seconds, int64(0), "want usage in seconds to be greater than 0")
 }
 
-func TestTemplateInsights(t *testing.T) {
+func TestUserLatencyInsights(t *testing.T) {
 	t.Parallel()
 
-	const (
-		firstParameterName        = "first_parameter"
-		firstParameterDisplayName = "First PARAMETER"
-		firstParameterType        = "string"
-		firstParameterDescription = "This is first parameter"
-		firstParameterValue       = "abc"
-
-		secondParameterName        = "second_parameter"
-		secondParameterDisplayName = "Second PARAMETER"
-		secondParameterType        = "number"
-		secondParameterDescription = "This is second parameter"
-		secondParameterValue       = "123"
-
-		thirdParameterName         = "third_parameter"
-		thirdParameterDisplayName  = "Third PARAMETER"
-		thirdParameterType         = "string"
-		thirdParameterDescription  = "This is third parameter"
-		thirdParameterValue        = "bbb"
-		thirdParameterOptionName1  = "This is AAA"
-		thirdParameterOptionValue1 = "aaa"
-		thirdParameterOptionName2  = "This is BBB"
-		thirdParameterOptionValue2 = "bbb"
-		thirdParameterOptionName3  = "This is CCC"
-		thirdParameterOptionValue3 = "ccc"
-	)
-
 	logger := slogtest.Make(t, nil)
-	opts := &coderdtest.Options{
+	client := coderdtest.New(t, &coderdtest.Options{
 		IncludeProvisionerDaemon:  true,
 		AgentStatsRefreshInterval: time.Millisecond * 100,
-	}
-	client := coderdtest.New(t, opts)
+	})
 
+	// Create two users, one that will appear in the report and another that
+	// won't (due to not having/using a workspace).
 	user := coderdtest.CreateFirstUser(t, client)
+	_, _ = coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
 	authToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-		Parse: echo.ParseComplete,
-		ProvisionPlan: []*proto.Provision_Response{
-			{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Parameters: []*proto.RichParameter{
-							{Name: firstParameterName, DisplayName: firstParameterDisplayName, Type: firstParameterType, Description: firstParameterDescription, Required: true},
-							{Name: secondParameterName, DisplayName: secondParameterDisplayName, Type: secondParameterType, Description: secondParameterDescription, Required: true},
-							{Name: thirdParameterName, DisplayName: thirdParameterDisplayName, Type: thirdParameterType, Description: thirdParameterDescription, Required: true, Options: []*proto.RichParameterOption{
-								{Name: thirdParameterOptionName1, Value: thirdParameterOptionValue1},
-								{Name: thirdParameterOptionName2, Value: thirdParameterOptionValue2},
-								{Name: thirdParameterOptionName3, Value: thirdParameterOptionValue3},
-							}},
-						},
-					},
-				},
-			},
-		},
+		Parse:          echo.ParseComplete,
+		ProvisionPlan:  echo.PlanComplete,
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	require.Empty(t, template.BuildTimeStats[codersdk.WorkspaceTransitionStart])
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-
-	buildParameters := []codersdk.WorkspaceBuildParameter{
-		{Name: firstParameterName, Value: firstParameterValue},
-		{Name: secondParameterName, Value: secondParameterValue},
-		{Name: thirdParameterName, Value: thirdParameterValue},
-	}
 
-	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
-		cwr.RichParameterValues = buildParameters
-	})
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	// Start an agent so that we can generate stats.
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Logger: logger.Named("agent"),
-		Client: agentClient,
-	})
-	defer func() {
-		_ = agentCloser.Close()
-	}()
+	_ = agenttest.New(t, client.URL, authToken)
 	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 	// Start must be at the beginning of the day, initialize it early in case
@@ -334,7 +246,6 @@ func TestTemplateInsights(t *testing.T) {
 	require.NoError(t, err)
 	defer sshConn.Close()
 
-	// Start an SSH session to generate SSH usage stats.
 	sess, err := sshConn.NewSession()
 	require.NoError(t, err)
 	defer sess.Close()
@@ -343,100 +254,39 @@ func TestTemplateInsights(t *testing.T) {
 	defer r.Close()
 	defer w.Close()
 	sess.Stdin = r
+	sess.Stdout = io.Discard
 	err = sess.Start("cat")
 	require.NoError(t, err)
 
-	// Start an rpty session to generate rpty usage stats.
-	rpty, err := client.WorkspaceAgentReconnectingPTY(ctx, codersdk.WorkspaceAgentReconnectingPTYOpts{
-		AgentID:   resources[0].Agents[0].ID,
-		Reconnect: uuid.New(),
-		Width:     80,
-		Height:    24,
-	})
-	require.NoError(t, err)
-	defer rpty.Close()
-
-	var resp codersdk.TemplateInsightsResponse
-	var req codersdk.TemplateInsightsRequest
-	waitForAppSeconds := func(slug string) func() bool {
-		return func() bool {
-			req = codersdk.TemplateInsightsRequest{
-				StartTime: today,
-				EndTime:   time.Now().UTC().Truncate(time.Hour).Add(time.Hour),
-				Interval:  codersdk.InsightsReportIntervalDay,
-			}
-			resp, err = client.TemplateInsights(ctx, req)
-			if !assert.NoError(t, err) {
-				return false
-			}
-
-			if slices.IndexFunc(resp.Report.AppsUsage, func(au codersdk.TemplateAppUsage) bool {
-				return au.Slug == slug && au.Seconds > 0
-			}) != -1 {
-				return true
-			}
+	var userLatencies codersdk.UserLatencyInsightsResponse
+	require.Eventuallyf(t, func() bool {
+		// Keep connection active.
+		_, err := w.Write([]byte("hello world\n"))
+		if !assert.NoError(t, err) {
 			return false
 		}
-	}
-	require.Eventually(t, waitForAppSeconds("reconnecting-pty"), testutil.WaitMedium, testutil.IntervalFast, "reconnecting-pty seconds missing")
-	require.Eventually(t, waitForAppSeconds("ssh"), testutil.WaitMedium, testutil.IntervalFast, "ssh seconds missing")
+		userLatencies, err = client.UserLatencyInsights(ctx, codersdk.UserLatencyInsightsRequest{
+			StartTime:   today,
+			EndTime:     time.Now().UTC().Truncate(time.Hour).Add(time.Hour), // Round up to include the current hour.
+			TemplateIDs: []uuid.UUID{template.ID},
+		})
+		if !assert.NoError(t, err) {
+			return false
+		}
+		return len(userLatencies.Report.Users) > 0 && userLatencies.Report.Users[0].LatencyMS.P50 > 0
+	}, testutil.WaitMedium, testutil.IntervalFast, "user latency is missing")
 
-	// We got our data, close down sessions and connections.
-	_ = rpty.Close()
+	// We got our latency data, close the connection.
 	_ = sess.Close()
 	_ = sshConn.Close()
 
-	assert.WithinDuration(t, req.StartTime, resp.Report.StartTime, 0)
-	assert.WithinDuration(t, req.EndTime, resp.Report.EndTime, 0)
-	assert.Equal(t, resp.Report.ActiveUsers, int64(1), "want one active user")
-	for _, app := range resp.Report.AppsUsage {
-		if slices.Contains([]string{"reconnecting-pty", "ssh"}, app.Slug) {
-			assert.Equal(t, app.Seconds, int64(300), "want app %q to have 5 minutes of usage", app.Slug)
-		} else {
-			assert.Equal(t, app.Seconds, int64(0), "want app %q to have 0 minutes of usage", app.Slug)
-		}
-	}
-	// The full timeframe is <= 24h, so the interval matches exactly.
-	require.Len(t, resp.IntervalReports, 1, "want one interval report")
-	assert.WithinDuration(t, req.StartTime, resp.IntervalReports[0].StartTime, 0)
-	assert.WithinDuration(t, req.EndTime, resp.IntervalReports[0].EndTime, 0)
-	assert.Equal(t, resp.IntervalReports[0].ActiveUsers, int64(1), "want one active user in the interval report")
-
-	// The workspace uses 3 parameters
-	require.Len(t, resp.Report.ParametersUsage, 3)
-	assert.Equal(t, firstParameterName, resp.Report.ParametersUsage[0].Name)
-	assert.Equal(t, firstParameterDisplayName, resp.Report.ParametersUsage[0].DisplayName)
-	assert.Contains(t, resp.Report.ParametersUsage[0].Values, codersdk.TemplateParameterValue{
-		Value: firstParameterValue,
-		Count: 1,
-	})
-	assert.Contains(t, resp.Report.ParametersUsage[0].TemplateIDs, template.ID)
-	assert.Empty(t, resp.Report.ParametersUsage[0].Options)
-
-	assert.Equal(t, secondParameterName, resp.Report.ParametersUsage[1].Name)
-	assert.Equal(t, secondParameterDisplayName, resp.Report.ParametersUsage[1].DisplayName)
-	assert.Contains(t, resp.Report.ParametersUsage[1].Values, codersdk.TemplateParameterValue{
-		Value: secondParameterValue,
-		Count: 1,
-	})
-	assert.Contains(t, resp.Report.ParametersUsage[1].TemplateIDs, template.ID)
-	assert.Empty(t, resp.Report.ParametersUsage[1].Options)
-
-	assert.Equal(t, thirdParameterName, resp.Report.ParametersUsage[2].Name)
-	assert.Equal(t, thirdParameterDisplayName, resp.Report.ParametersUsage[2].DisplayName)
-	assert.Contains(t, resp.Report.ParametersUsage[2].Values, codersdk.TemplateParameterValue{
-		Value: thirdParameterValue,
-		Count: 1,
-	})
-	assert.Contains(t, resp.Report.ParametersUsage[2].TemplateIDs, template.ID)
-	assert.Equal(t, []codersdk.TemplateVersionParameterOption{
-		{Name: thirdParameterOptionName1, Value: thirdParameterOptionValue1},
-		{Name: thirdParameterOptionName2, Value: thirdParameterOptionValue2},
-		{Name: thirdParameterOptionName3, Value: thirdParameterOptionValue3},
-	}, resp.Report.ParametersUsage[2].Options)
+	require.Len(t, userLatencies.Report.Users, 1, "want only 1 user")
+	require.Equal(t, userLatencies.Report.Users[0].UserID, user.UserID, "want user id to match")
+	assert.Greater(t, userLatencies.Report.Users[0].LatencyMS.P50, float64(0), "want p50 to be greater than 0")
+	assert.Greater(t, userLatencies.Report.Users[0].LatencyMS.P95, float64(0), "want p95 to be greater than 0")
 }
 
-func TestTemplateInsights_BadRequest(t *testing.T) {
+func TestUserLatencyInsights_BadRequest(t *testing.T) {
 	t.Parallel()
 
 	client := coderdtest.New(t, &coderdtest.Options{})
@@ -448,175 +298,1835 @@ func TestTemplateInsights_BadRequest(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
 
-	_, err := client.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
+	_, err := client.UserLatencyInsights(ctx, codersdk.UserLatencyInsightsRequest{
 		StartTime: today,
 		EndTime:   today.AddDate(0, 0, -1),
 	})
 	assert.Error(t, err, "want error for end time before start time")
 
-	_, err = client.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
+	_, err = client.UserLatencyInsights(ctx, codersdk.UserLatencyInsightsRequest{
 		StartTime: today.AddDate(0, 0, -7),
 		EndTime:   today.Add(-time.Hour),
 	})
 	assert.Error(t, err, "want error for end time partial day when not today")
-
-	_, err = client.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
-		StartTime: today.AddDate(0, 0, -1),
-		EndTime:   today,
-		Interval:  "invalid",
-	})
-	assert.Error(t, err, "want error for bad interval")
 }
 
-func TestTemplateInsights_RBAC(t *testing.T) {
+func TestUserActivityInsights_BadRequest(t *testing.T) {
 	t.Parallel()
 
+	saoPaulo, err := time.LoadLocation("America/Sao_Paulo")
+	require.NoError(t, err)
 	y, m, d := time.Now().UTC().Date()
-	today := time.Date(y, m, d, 0, 0, 0, 0, time.UTC)
+	today := time.Date(y, m, d, 0, 0, 0, 0, saoPaulo)
 
-	type test struct {
-		interval     codersdk.InsightsReportInterval
-		withTemplate bool
-	}
+	// Prepare
+	client := coderdtest.New(t, &coderdtest.Options{})
+	_ = coderdtest.CreateFirstUser(t, client)
 
-	tests := []test{
-		{codersdk.InsightsReportIntervalDay, true},
-		{codersdk.InsightsReportIntervalDay, false},
-		{"", true},
-		{"", false},
-	}
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
 
-	for _, tt := range tests {
-		tt := tt
+	// Send insights request
+	_, err = client.UserActivityInsights(ctx, codersdk.UserActivityInsightsRequest{
+		StartTime: today,
+		EndTime:   today.AddDate(0, 0, -1),
+	})
+	assert.Error(t, err, "want error for end time before start time")
 
-		t.Run(fmt.Sprintf("with interval=%q", tt.interval), func(t *testing.T) {
-			t.Parallel()
+	// Send insights request
+	_, err = client.UserActivityInsights(ctx, codersdk.UserActivityInsightsRequest{
+		StartTime: today.AddDate(0, 0, -7),
+		EndTime:   today.Add(-time.Hour),
+	})
+	assert.Error(t, err, "want error for end time partial day when not today")
+}
 
-			t.Run("AsOwner", func(t *testing.T) {
-				t.Parallel()
+func TestTemplateInsights_Golden(t *testing.T) {
+	t.Parallel()
 
-				client := coderdtest.New(t, &coderdtest.Options{})
-				admin := coderdtest.CreateFirstUser(t, client)
+	// Prepare test data types.
+	type templateParameterOption struct {
+		name  string
+		value string
+	}
+	type templateParameter struct {
+		name        string
+		description string
+		options     []templateParameterOption
+	}
+	type templateApp struct {
+		name string
+		icon string
+	}
+	type testTemplate struct {
+		name       string
+		parameters []*templateParameter
+		apps       []templateApp
 
-				ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
-				defer cancel()
+		// Filled later.
+		id uuid.UUID
+	}
+	type buildParameter struct {
+		templateParameter *templateParameter
+		value             string
+	}
+	type workspaceApp templateApp
+	type testWorkspace struct {
+		name            string
+		template        *testTemplate
+		buildParameters []buildParameter
+
+		// Filled later.
+		id          uuid.UUID
+		user        any // *testUser, but it's not available yet, defined below.
+		agentID     uuid.UUID
+		apps        []*workspaceApp
+		agentClient *agentsdk.Client
+	}
+	type testUser struct {
+		name       string
+		workspaces []*testWorkspace
 
-				var templateIDs []uuid.UUID
-				if tt.withTemplate {
-					version := coderdtest.CreateTemplateVersion(t, client, admin.OrganizationID, nil)
-					template := coderdtest.CreateTemplate(t, client, admin.OrganizationID, version.ID)
-					templateIDs = append(templateIDs, template.ID)
-				}
+		client *codersdk.Client
+		sdk    codersdk.User
+	}
 
-				_, err := client.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
-					StartTime:   today.AddDate(0, 0, -1),
-					EndTime:     today,
-					Interval:    tt.interval,
-					TemplateIDs: templateIDs,
-				})
-				require.NoError(t, err)
-			})
-			t.Run("AsTemplateAdmin", func(t *testing.T) {
-				t.Parallel()
+	// Represent agent stats, to be inserted via stats batcher.
+	type agentStat struct {
+		// Set a range via start/end, multiple stats will be generated
+		// within the range.
+		startedAt time.Time
+		endedAt   time.Time
+
+		sessionCountVSCode          int64
+		sessionCountJetBrains       int64
+		sessionCountReconnectingPTY int64
+		sessionCountSSH             int64
+		noConnections               bool
+	}
+	// Represent app usage stats, to be inserted via stats reporter.
+	type appUsage struct {
+		app       *workspaceApp
+		startedAt time.Time
+		endedAt   time.Time
+		requests  int
+	}
 
-				client := coderdtest.New(t, &coderdtest.Options{})
-				admin := coderdtest.CreateFirstUser(t, client)
+	// Represent actual data being generated on a per-workspace basis.
+	type testDataGen struct {
+		agentStats []agentStat
+		appUsage   []appUsage
+	}
 
-				templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID, rbac.RoleTemplateAdmin())
+	prepareFixtureAndTestData := func(t *testing.T, makeFixture func() ([]*testTemplate, []*testUser), makeData func([]*testTemplate, []*testUser) map[*testWorkspace]testDataGen) ([]*testTemplate, []*testUser, map[*testWorkspace]testDataGen) {
+		var stableIDs []uuid.UUID
+		newStableUUID := func() uuid.UUID {
+			stableIDs = append(stableIDs, uuid.MustParse(fmt.Sprintf("00000000-0000-0000-0000-%012d", len(stableIDs)+1)))
+			stableID := stableIDs[len(stableIDs)-1]
+			return stableID
+		}
 
-				ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
-				defer cancel()
+		templates, users := makeFixture()
+		for _, template := range templates {
+			template.id = newStableUUID()
+		}
+		for _, user := range users {
+			for _, workspace := range user.workspaces {
+				workspace.user = user
+				for _, app := range workspace.template.apps {
+					app := workspaceApp(app)
+					workspace.apps = append(workspace.apps, &app)
+				}
+				for _, bp := range workspace.buildParameters {
+					foundBuildParam := false
+					for _, param := range workspace.template.parameters {
+						if bp.templateParameter == param {
+							foundBuildParam = true
+							break
+						}
+					}
+					require.True(t, foundBuildParam, "test bug: parameter not in workspace %s template %q", workspace.name, workspace.template.name)
+				}
+			}
+		}
 
-				var templateIDs []uuid.UUID
-				if tt.withTemplate {
-					version := coderdtest.CreateTemplateVersion(t, client, admin.OrganizationID, nil)
-					template := coderdtest.CreateTemplate(t, client, admin.OrganizationID, version.ID)
-					templateIDs = append(templateIDs, template.ID)
+		testData := makeData(templates, users)
+		// Sanity check.
+		for ws, data := range testData {
+			for _, usage := range data.appUsage {
+				found := false
+				for _, app := range ws.apps {
+					if usage.app == app { // Pointer equality
+						found = true
+						break
+					}
 				}
+				if !found {
+					for _, user := range users {
+						for _, workspace := range user.workspaces {
+							for _, app := range workspace.apps {
+								if usage.app == app { // Pointer equality
+									require.True(t, found, "test bug: app %q not in workspace %q: want user=%s workspace=%s; got user=%s workspace=%s ", usage.app.name, ws.name, ws.user.(*testUser).name, ws.name, user.name, workspace.name)
+									break
+								}
+							}
+						}
+					}
+					require.True(t, found, "test bug: app %q not in workspace %q", usage.app.name, ws.name)
+				}
+			}
+		}
 
-				_, err := templateAdmin.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
-					StartTime:   today.AddDate(0, 0, -1),
-					EndTime:     today,
-					Interval:    tt.interval,
-					TemplateIDs: templateIDs,
-				})
-				require.NoError(t, err)
-			})
-			t.Run("AsRegularUser", func(t *testing.T) {
-				t.Parallel()
+		return templates, users, testData
+	}
 
-				client := coderdtest.New(t, &coderdtest.Options{})
-				admin := coderdtest.CreateFirstUser(t, client)
+	prepare := func(t *testing.T, templates []*testTemplate, users []*testUser, testData map[*testWorkspace]testDataGen) *codersdk.Client {
+		logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: false}).Leveled(slog.LevelDebug)
+		db, pubsub := dbtestutil.NewDB(t)
+		client := coderdtest.New(t, &coderdtest.Options{
+			Database:                  db,
+			Pubsub:                    pubsub,
+			Logger:                    &logger,
+			IncludeProvisionerDaemon:  true,
+			AgentStatsRefreshInterval: time.Hour, // Not relevant for this test.
+		})
+		firstUser := coderdtest.CreateFirstUser(t, client)
 
-				regular, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+		// Prepare all test users.
+		for _, user := range users {
+			user.client, user.sdk = coderdtest.CreateAnotherUserMutators(t, client, firstUser.OrganizationID, nil, func(r *codersdk.CreateUserRequest) {
+				r.Username = user.name
+			})
+			user.client.SetLogger(logger.Named("user").With(slog.Field{Name: "name", Value: user.name}))
+		}
 
-				ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
-				defer cancel()
+		// Prepare all the templates.
+		for _, template := range templates {
+			template := template
+
+			var parameters []*proto.RichParameter
+			for _, parameter := range template.parameters {
+				var options []*proto.RichParameterOption
+				var defaultValue string
+				for _, option := range parameter.options {
+					if defaultValue == "" {
+						defaultValue = option.value
+					}
+					options = append(options, &proto.RichParameterOption{
+						Name:  option.name,
+						Value: option.value,
+					})
+				}
+				parameters = append(parameters, &proto.RichParameter{
+					Name:         parameter.name,
+					DisplayName:  parameter.name,
+					Type:         "string",
+					Description:  parameter.description,
+					Options:      options,
+					DefaultValue: defaultValue,
+				})
+			}
 
-				var templateIDs []uuid.UUID
-				if tt.withTemplate {
-					version := coderdtest.CreateTemplateVersion(t, client, admin.OrganizationID, nil)
-					template := coderdtest.CreateTemplate(t, client, admin.OrganizationID, version.ID)
-					templateIDs = append(templateIDs, template.ID)
+			// Prepare all workspace resources (agents and apps).
+			var (
+				createWorkspaces []func(uuid.UUID)
+				waitWorkspaces   []func()
+			)
+			var resources []*proto.Resource
+			for _, user := range users {
+				user := user
+				for _, workspace := range user.workspaces {
+					workspace := workspace
+
+					if workspace.template != template {
+						continue
+					}
+					authToken := uuid.New()
+					agentClient := agentsdk.New(client.URL)
+					agentClient.SetSessionToken(authToken.String())
+					workspace.agentClient = agentClient
+
+					var apps []*proto.App
+					for _, app := range workspace.apps {
+						apps = append(apps, &proto.App{
+							Slug:         app.name,
+							DisplayName:  app.name,
+							Icon:         app.icon,
+							SharingLevel: proto.AppSharingLevel_OWNER,
+							Url:          "http://",
+						})
+					}
+
+					resources = append(resources, &proto.Resource{
+						Name: "example",
+						Type: "aws_instance",
+						Agents: []*proto.Agent{{
+							Id:   uuid.NewString(), // Doesn't matter, not used in DB.
+							Name: "dev",
+							Auth: &proto.Agent_Token{
+								Token: authToken.String(),
+							},
+							Apps: apps,
+						}},
+					})
+
+					var buildParameters []codersdk.WorkspaceBuildParameter
+					for _, buildParameter := range workspace.buildParameters {
+						buildParameters = append(buildParameters, codersdk.WorkspaceBuildParameter{
+							Name:  buildParameter.templateParameter.name,
+							Value: buildParameter.value,
+						})
+					}
+
+					createWorkspaces = append(createWorkspaces, func(templateID uuid.UUID) {
+						// Create workspace using the users client.
+						createdWorkspace := coderdtest.CreateWorkspace(t, user.client, firstUser.OrganizationID, templateID, func(cwr *codersdk.CreateWorkspaceRequest) {
+							cwr.RichParameterValues = buildParameters
+						})
+						workspace.id = createdWorkspace.ID
+						waitWorkspaces = append(waitWorkspaces, func() {
+							coderdtest.AwaitWorkspaceBuildJobCompleted(t, user.client, createdWorkspace.LatestBuild.ID)
+							ctx := testutil.Context(t, testutil.WaitShort)
+							ws, err := user.client.Workspace(ctx, workspace.id)
+							require.NoError(t, err, "want no error getting workspace")
+
+							workspace.agentID = ws.LatestBuild.Resources[0].Agents[0].ID
+						})
+					})
 				}
+			}
 
-				_, err := regular.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
-					StartTime:   today.AddDate(0, 0, -1),
-					EndTime:     today,
-					Interval:    tt.interval,
-					TemplateIDs: templateIDs,
-				})
-				require.Error(t, err)
-				var apiErr *codersdk.Error
-				require.ErrorAs(t, err, &apiErr)
-				require.Equal(t, http.StatusNotFound, apiErr.StatusCode())
+			// Create the template version and template.
+			version := coderdtest.CreateTemplateVersion(t, client, firstUser.OrganizationID, &echo.Responses{
+				Parse: echo.ParseComplete,
+				ProvisionPlan: []*proto.Response{
+					{
+						Type: &proto.Response_Plan{
+							Plan: &proto.PlanComplete{
+								Parameters: parameters,
+							},
+						},
+					},
+				},
+				ProvisionApply: []*proto.Response{{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
+							Resources: resources,
+						},
+					},
+				}},
 			})
-		})
-	}
-}
+			coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+
+			// Create template, essentially a modified version of CreateTemplate
+			// where we can control the template ID.
+			// 	createdTemplate := coderdtest.CreateTemplate(t, client, firstUser.OrganizationID, version.ID)
+			createdTemplate := dbgen.Template(t, db, database.Template{
+				ID:              template.id,
+				ActiveVersionID: version.ID,
+				OrganizationID:  firstUser.OrganizationID,
+				CreatedBy:       firstUser.UserID,
+				GroupACL: database.TemplateACL{
+					firstUser.OrganizationID.String(): []rbac.Action{rbac.ActionRead},
+				},
+			})
+			err := db.UpdateTemplateVersionByID(context.Background(), database.UpdateTemplateVersionByIDParams{
+				ID: version.ID,
+				TemplateID: uuid.NullUUID{
+					UUID:  createdTemplate.ID,
+					Valid: true,
+				},
+			})
+			require.NoError(t, err, "want no error updating template version")
 
-func TestUserLatencyInsights_RBAC(t *testing.T) {
-	t.Parallel()
+			// Create all workspaces and wait for them.
+			for _, createWorkspace := range createWorkspaces {
+				createWorkspace(template.id)
+			}
+			for _, waitWorkspace := range waitWorkspaces {
+				waitWorkspace()
+			}
+		}
 
-	y, m, d := time.Now().UTC().Date()
-	today := time.Date(y, m, d, 0, 0, 0, 0, time.UTC)
+		ctx := testutil.Context(t, testutil.WaitSuperLong)
+
+		// Use agent stats batcher to insert agent stats, similar to live system.
+		// NOTE(mafredri): Ideally we would pass batcher as a coderd option and
+		// insert using the agentClient, but we have a circular dependency on
+		// the database.
+		batcher, batcherCloser, err := batchstats.New(
+			ctx,
+			batchstats.WithStore(db),
+			batchstats.WithLogger(logger.Named("batchstats")),
+			batchstats.WithInterval(time.Hour),
+		)
+		require.NoError(t, err)
+		defer batcherCloser() // Flushes the stats, this is to ensure they're written.
+
+		for workspace, data := range testData {
+			for _, stat := range data.agentStats {
+				createdAt := stat.startedAt
+				connectionCount := int64(1)
+				if stat.noConnections {
+					connectionCount = 0
+				}
+				for createdAt.Before(stat.endedAt) {
+					err = batcher.Add(createdAt, workspace.agentID, workspace.template.id, workspace.user.(*testUser).sdk.ID, workspace.id, agentsdk.Stats{
+						ConnectionCount:             connectionCount,
+						SessionCountVSCode:          stat.sessionCountVSCode,
+						SessionCountJetBrains:       stat.sessionCountJetBrains,
+						SessionCountReconnectingPTY: stat.sessionCountReconnectingPTY,
+						SessionCountSSH:             stat.sessionCountSSH,
+					})
+					require.NoError(t, err, "want no error inserting agent stats")
+					createdAt = createdAt.Add(30 * time.Second)
+				}
+			}
+		}
 
-	type test struct {
-		interval     codersdk.InsightsReportInterval
-		withTemplate bool
-	}
+		// Insert app usage.
+		var stats []workspaceapps.StatsReport
+		for workspace, data := range testData {
+			for _, usage := range data.appUsage {
+				appName := usage.app.name
+				accessMethod := workspaceapps.AccessMethodPath
+				if usage.app.name == "terminal" {
+					appName = ""
+					accessMethod = workspaceapps.AccessMethodTerminal
+				}
+				stats = append(stats, workspaceapps.StatsReport{
+					UserID:           workspace.user.(*testUser).sdk.ID,
+					WorkspaceID:      workspace.id,
+					AgentID:          workspace.agentID,
+					AccessMethod:     accessMethod,
+					SlugOrPort:       appName,
+					SessionID:        uuid.New(),
+					SessionStartedAt: usage.startedAt,
+					SessionEndedAt:   usage.endedAt,
+					Requests:         usage.requests,
+				})
+			}
+		}
+		reporter := workspaceapps.NewStatsDBReporter(db, workspaceapps.DefaultStatsDBReporterBatchSize)
+		//nolint:gocritic // This is a test.
+		err = reporter.Report(dbauthz.AsSystemRestricted(ctx), stats)
+		require.NoError(t, err, "want no error inserting app stats")
 
-	tests := []test{
-		{codersdk.InsightsReportIntervalDay, true},
-		{codersdk.InsightsReportIntervalDay, false},
-		{"", true},
-		{"", false},
+		return client
 	}
 
-	for _, tt := range tests {
-		tt := tt
-		t.Run(fmt.Sprintf("with interval=%q", tt.interval), func(t *testing.T) {
-			t.Parallel()
+	baseTemplateAndUserFixture := func() ([]*testTemplate, []*testUser) {
+		// Test templates and configuration to generate.
+		templates := []*testTemplate{
+			// Create two templates with near-identical apps and parameters
+			// to allow testing for grouping similar data.
+			{
+				name: "template1",
+				parameters: []*templateParameter{
+					{name: "param1", description: "This is first parameter"},
+					{name: "param2", description: "This is second parameter"},
+					{name: "param3", description: "This is third parameter"},
+					{
+						name:        "param4",
+						description: "This is fourth parameter",
+						options: []templateParameterOption{
+							{name: "option1", value: "option1"},
+							{name: "option2", value: "option2"},
+						},
+					},
+				},
+				apps: []templateApp{
+					{name: "app1", icon: "/icon1.png"},
+					{name: "app2", icon: "/icon2.png"},
+					{name: "app3", icon: "/icon2.png"},
+				},
+			},
+			{
+				name: "template2",
+				parameters: []*templateParameter{
+					{name: "param1", description: "This is first parameter"},
+					{name: "param2", description: "This is second parameter"},
+					{name: "param3", description: "This is third parameter"},
+				},
+				apps: []templateApp{
+					{name: "app1", icon: "/icon1.png"},
+					{name: "app2", icon: "/icon2.png"},
+					{name: "app3", icon: "/icon2.png"},
+				},
+			},
+			// Create another template with different parameters and apps.
+			{
+				name: "othertemplate",
+				parameters: []*templateParameter{
+					{name: "otherparam1", description: "This is another parameter"},
+				},
+				apps: []templateApp{
+					{name: "otherapp1", icon: "/icon1.png"},
+
+					// This "special test app" will be converted into web
+					// terminal usage, this is not included in stats since we
+					// currently rely on agent stats for this data.
+					{name: "terminal", icon: "/terminal.png"},
+				},
+			},
+		}
+
+		// Users and workspaces to generate.
+		users := []*testUser{
+			{
+				name: "user1",
+				workspaces: []*testWorkspace{
+					{
+						name:     "workspace1",
+						template: templates[0],
+						buildParameters: []buildParameter{
+							{templateParameter: templates[0].parameters[0], value: "abc"},
+							{templateParameter: templates[0].parameters[1], value: "123"},
+							{templateParameter: templates[0].parameters[2], value: "bbb"},
+							{templateParameter: templates[0].parameters[3], value: "option1"},
+						},
+					},
+					{
+						name:     "workspace2",
+						template: templates[1],
+						buildParameters: []buildParameter{
+							{templateParameter: templates[1].parameters[0], value: "ABC"},
+							{templateParameter: templates[1].parameters[1], value: "123"},
+							{templateParameter: templates[1].parameters[2], value: "BBB"},
+						},
+					},
+					{
+						name:     "otherworkspace3",
+						template: templates[2],
+					},
+				},
+			},
+			{
+				name: "user2",
+				workspaces: []*testWorkspace{
+					{
+						name:     "workspace1",
+						template: templates[0],
+						buildParameters: []buildParameter{
+							{templateParameter: templates[0].parameters[0], value: "abc"},
+							{templateParameter: templates[0].parameters[1], value: "123"},
+							{templateParameter: templates[0].parameters[2], value: "BBB"},
+							{templateParameter: templates[0].parameters[3], value: "option1"},
+						},
+					},
+				},
+			},
+			{
+				name: "user3",
+				workspaces: []*testWorkspace{
+					{
+						name:     "otherworkspace1",
+						template: templates[2],
+						buildParameters: []buildParameter{
+							{templateParameter: templates[2].parameters[0], value: "xyz"},
+						},
+					},
+					{
+						name:     "workspace2",
+						template: templates[0],
+						buildParameters: []buildParameter{
+							{templateParameter: templates[0].parameters[3], value: "option2"},
+						},
+					},
+				},
+			},
+		}
+
+		return templates, users
+	}
+
+	// Time range for report, test data will be generated within and
+	// outside this range, but only data within the range should be
+	// included in the report.
+	frozenLastNight := time.Date(2023, 8, 22, 0, 0, 0, 0, time.UTC)
+	frozenWeekAgo := frozenLastNight.AddDate(0, 0, -7)
+
+	saoPaulo, err := time.LoadLocation("America/Sao_Paulo")
+	require.NoError(t, err)
+	frozenWeekAgoSaoPaulo, err := time.ParseInLocation(time.DateTime, frozenWeekAgo.Format(time.DateTime), saoPaulo)
+	require.NoError(t, err)
+
+	//nolint:dupl // For testing purposes
+	makeBaseTestData := func(templates []*testTemplate, users []*testUser) map[*testWorkspace]testDataGen {
+		return map[*testWorkspace]testDataGen{
+			users[0].workspaces[0]: {
+				agentStats: []agentStat{
+					{ // One hour of usage.
+						startedAt:          frozenWeekAgo,
+						endedAt:            frozenWeekAgo.Add(time.Hour),
+						sessionCountVSCode: 1,
+						sessionCountSSH:    1,
+					},
+					{ // 12 minutes of usage.
+						startedAt:       frozenWeekAgo.AddDate(0, 0, 1),
+						endedAt:         frozenWeekAgo.AddDate(0, 0, 1).Add(12 * time.Minute),
+						sessionCountSSH: 1,
+					},
+					{ // 1m30s of usage -> 2m rounded.
+						startedAt:             frozenWeekAgo.AddDate(0, 0, 2).Add(4*time.Minute + 30*time.Second),
+						endedAt:               frozenWeekAgo.AddDate(0, 0, 2).Add(6 * time.Minute),
+						sessionCountJetBrains: 1,
+					},
+				},
+				appUsage: []appUsage{
+					{ // One hour of usage.
+						app:       users[0].workspaces[0].apps[0],
+						startedAt: frozenWeekAgo,
+						endedAt:   frozenWeekAgo.Add(time.Hour),
+						requests:  1,
+					},
+					{ // 30s of app usage -> 1m rounded.
+						app:       users[0].workspaces[0].apps[0],
+						startedAt: frozenWeekAgo.Add(2*time.Hour + 10*time.Second),
+						endedAt:   frozenWeekAgo.Add(2*time.Hour + 40*time.Second),
+						requests:  1,
+					},
+					{ // 1m30s of app usage -> 2m rounded (included in São Paulo).
+						app:       users[0].workspaces[0].apps[0],
+						startedAt: frozenWeekAgo.Add(3*time.Hour + 30*time.Second),
+						endedAt:   frozenWeekAgo.Add(3*time.Hour + 90*time.Second),
+						requests:  1,
+					},
+					{ // used an app on the last day, counts as active user, 12m.
+						app:       users[0].workspaces[0].apps[2],
+						startedAt: frozenWeekAgo.AddDate(0, 0, 6),
+						endedAt:   frozenWeekAgo.AddDate(0, 0, 6).Add(12 * time.Minute),
+						requests:  1,
+					},
+				},
+			},
+			users[0].workspaces[1]: {
+				agentStats: []agentStat{
+					{
+						// One hour of usage in second template at the same time
+						// as in first template. When selecting both templates
+						// this user and their app usage will only be counted
+						// once but the template ID will show up in the data.
+						startedAt:          frozenWeekAgo,
+						endedAt:            frozenWeekAgo.Add(time.Hour),
+						sessionCountVSCode: 1,
+						sessionCountSSH:    1,
+					},
+					{ // One hour of usage.
+						startedAt:                   frozenWeekAgo.AddDate(0, 0, -12),
+						endedAt:                     frozenWeekAgo.AddDate(0, 0, -12).Add(time.Hour),
+						sessionCountSSH:             1,
+						sessionCountReconnectingPTY: 1,
+					},
+					{ // Another one hour of usage, but "active users" shouldn't be increased twice.
+						startedAt:                   frozenWeekAgo.AddDate(0, 0, -10),
+						endedAt:                     frozenWeekAgo.AddDate(0, 0, -10).Add(time.Hour),
+						sessionCountSSH:             1,
+						sessionCountReconnectingPTY: 1,
+					},
+				},
+				appUsage: []appUsage{
+					// TODO(mafredri): This doesn't behave correctly right now
+					// and will add more usage to the app. This could be
+					// considered both correct and incorrect behavior.
+					// { // One hour of usage, but same user and same template app, only count once.
+					// 	app:       users[0].workspaces[1].apps[0],
+					// 	startedAt: frozenWeekAgo,
+					// 	endedAt:   frozenWeekAgo.Add(time.Hour),
+					// 	requests:  1,
+					// },
+					{
+						// Different templates but identical apps, apps will be
+						// combined and usage will be summed.
+						app:       users[0].workspaces[1].apps[0],
+						startedAt: frozenWeekAgo.AddDate(0, 0, 2),
+						endedAt:   frozenWeekAgo.AddDate(0, 0, 2).Add(6 * time.Hour),
+						requests:  1,
+					},
+				},
+			},
+			users[0].workspaces[2]: {
+				agentStats: []agentStat{},
+				appUsage:   []appUsage{},
+			},
+			users[1].workspaces[0]: {
+				agentStats: []agentStat{
+					{ // One hour of agent usage before timeframe (exclude).
+						startedAt:          frozenWeekAgo.Add(-time.Hour),
+						endedAt:            frozenWeekAgo,
+						sessionCountVSCode: 1,
+						sessionCountSSH:    1,
+					},
+					{ // One hour of usage.
+						startedAt:       frozenWeekAgo,
+						endedAt:         frozenWeekAgo.Add(time.Hour),
+						sessionCountSSH: 1,
+					},
+					{ // One hour of agent usage after timeframe (exclude in UTC, include in São Paulo).
+						startedAt:          frozenWeekAgo.AddDate(0, 0, 7),
+						endedAt:            frozenWeekAgo.AddDate(0, 0, 7).Add(time.Hour),
+						sessionCountVSCode: 1,
+						sessionCountSSH:    1,
+					},
+				},
+				appUsage: []appUsage{
+					{ // One hour of app usage before timeframe (exclude).
+						app:       users[1].workspaces[0].apps[2],
+						startedAt: frozenWeekAgo.Add(-time.Hour),
+						endedAt:   frozenWeekAgo,
+						requests:  1,
+					},
+					{ // One hour of app usage after timeframe (exclude in UTC, include in São Paulo).
+						app:       users[1].workspaces[0].apps[2],
+						startedAt: frozenWeekAgo.AddDate(0, 0, 7),
+						endedAt:   frozenWeekAgo.AddDate(0, 0, 7).Add(time.Hour),
+						requests:  1,
+					},
+				},
+			},
+			users[2].workspaces[0]: {
+				agentStats: []agentStat{
+					{ // One hour of usage.
+						startedAt:                   frozenWeekAgo,
+						endedAt:                     frozenWeekAgo.Add(time.Hour),
+						sessionCountSSH:             1,
+						sessionCountReconnectingPTY: 1,
+					},
+				},
+				appUsage: []appUsage{
+					{
+						app:       users[2].workspaces[0].apps[0],
+						startedAt: frozenWeekAgo.AddDate(0, 0, 2),
+						endedAt:   frozenWeekAgo.AddDate(0, 0, 2).Add(5 * time.Minute),
+						requests:  1,
+					},
+					{ // Special app; excluded from apps, but counted as active during the day.
+						app:       users[2].workspaces[0].apps[1],
+						startedAt: frozenWeekAgo.AddDate(0, 0, 3),
+						endedAt:   frozenWeekAgo.AddDate(0, 0, 3).Add(5 * time.Minute),
+						requests:  1,
+					},
+				},
+			},
+		}
+	}
+	type testRequest struct {
+		name        string
+		makeRequest func([]*testTemplate) codersdk.TemplateInsightsRequest
+		ignoreTimes bool
+	}
+	tests := []struct {
+		name         string
+		makeFixture  func() ([]*testTemplate, []*testUser)
+		makeTestData func([]*testTemplate, []*testUser) map[*testWorkspace]testDataGen
+		requests     []testRequest
+	}{
+		{
+			name:         "multiple users and workspaces",
+			makeFixture:  baseTemplateAndUserFixture,
+			makeTestData: makeBaseTestData,
+			requests: []testRequest{
+				{
+					name: "week deployment wide",
+					makeRequest: func(templates []*testTemplate) codersdk.TemplateInsightsRequest {
+						return codersdk.TemplateInsightsRequest{
+							StartTime: frozenWeekAgo,
+							EndTime:   frozenWeekAgo.AddDate(0, 0, 7),
+							Interval:  codersdk.InsightsReportIntervalDay,
+						}
+					},
+				},
+				{
+					name: "weekly aggregated deployment wide",
+					makeRequest: func(templates []*testTemplate) codersdk.TemplateInsightsRequest {
+						return codersdk.TemplateInsightsRequest{
+							StartTime: frozenWeekAgo.AddDate(0, 0, -3),
+							EndTime:   frozenWeekAgo.AddDate(0, 0, 4),
+							Interval:  codersdk.InsightsReportIntervalWeek,
+						}
+					},
+				},
+				{
+					name: "week all templates",
+					makeRequest: func(templates []*testTemplate) codersdk.TemplateInsightsRequest {
+						return codersdk.TemplateInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[0].id, templates[1].id, templates[2].id},
+							StartTime:   frozenWeekAgo,
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+							Interval:    codersdk.InsightsReportIntervalDay,
+						}
+					},
+				},
+				{
+					name: "weekly aggregated templates",
+					makeRequest: func(templates []*testTemplate) codersdk.TemplateInsightsRequest {
+						return codersdk.TemplateInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[0].id, templates[1].id, templates[2].id},
+							StartTime:   frozenWeekAgo.AddDate(0, 0, -1),
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 6),
+							Interval:    codersdk.InsightsReportIntervalWeek,
+						}
+					},
+				},
+				{
+					name: "week first template",
+					makeRequest: func(templates []*testTemplate) codersdk.TemplateInsightsRequest {
+						return codersdk.TemplateInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[0].id},
+							StartTime:   frozenWeekAgo,
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+							Interval:    codersdk.InsightsReportIntervalDay,
+						}
+					},
+				},
+				{
+					name: "weekly aggregated first template",
+					makeRequest: func(templates []*testTemplate) codersdk.TemplateInsightsRequest {
+						return codersdk.TemplateInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[0].id},
+							StartTime:   frozenWeekAgo,
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+							Interval:    codersdk.InsightsReportIntervalWeek,
+						}
+					},
+				},
+				{
+					name: "week second template",
+					makeRequest: func(templates []*testTemplate) codersdk.TemplateInsightsRequest {
+						return codersdk.TemplateInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[1].id},
+							StartTime:   frozenWeekAgo,
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+							Interval:    codersdk.InsightsReportIntervalDay,
+						}
+					},
+				},
+				{
+					name: "three weeks second template",
+					makeRequest: func(templates []*testTemplate) codersdk.TemplateInsightsRequest {
+						return codersdk.TemplateInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[1].id},
+							StartTime:   frozenWeekAgo.AddDate(0, 0, -14),
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+							Interval:    codersdk.InsightsReportIntervalWeek,
+						}
+					},
+				},
+				{
+					name: "week third template",
+					makeRequest: func(templates []*testTemplate) codersdk.TemplateInsightsRequest {
+						return codersdk.TemplateInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[2].id},
+							StartTime:   frozenWeekAgo,
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+							Interval:    codersdk.InsightsReportIntervalDay,
+						}
+					},
+				},
+				{
+					// São Paulo is three hours behind UTC, so we should not see
+					// any data between weekAgo and weekAgo.Add(3 * time.Hour).
+					name: "week other timezone (São Paulo)",
+					makeRequest: func(templates []*testTemplate) codersdk.TemplateInsightsRequest {
+						return codersdk.TemplateInsightsRequest{
+							StartTime: frozenWeekAgoSaoPaulo,
+							EndTime:   frozenWeekAgoSaoPaulo.AddDate(0, 0, 7),
+							Interval:  codersdk.InsightsReportIntervalDay,
+						}
+					},
+				},
+				{
+					name: "three weeks second template only report",
+					makeRequest: func(templates []*testTemplate) codersdk.TemplateInsightsRequest {
+						return codersdk.TemplateInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[1].id},
+							StartTime:   frozenWeekAgo.AddDate(0, 0, -14),
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+							Interval:    codersdk.InsightsReportIntervalWeek,
+							Sections:    []codersdk.TemplateInsightsSection{codersdk.TemplateInsightsSectionReport},
+						}
+					},
+				},
+				{
+					name: "three weeks second template only interval reports",
+					makeRequest: func(templates []*testTemplate) codersdk.TemplateInsightsRequest {
+						return codersdk.TemplateInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[1].id},
+							StartTime:   frozenWeekAgo.AddDate(0, 0, -14),
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+							Interval:    codersdk.InsightsReportIntervalWeek,
+							Sections:    []codersdk.TemplateInsightsSection{codersdk.TemplateInsightsSectionIntervalReports},
+						}
+					},
+				},
+			},
+		},
+		{
+			name:        "parameters",
+			makeFixture: baseTemplateAndUserFixture,
+			makeTestData: func(templates []*testTemplate, users []*testUser) map[*testWorkspace]testDataGen {
+				return map[*testWorkspace]testDataGen{}
+			},
+			requests: []testRequest{
+				{
+					// Since workspaces are created "now", we can only get
+					// parameters using a time range that includes "now".
+					// We check yesterday and today for stability just in case
+					// the test runs at UTC midnight.
+					name:        "yesterday and today deployment wide",
+					ignoreTimes: true,
+					makeRequest: func(_ []*testTemplate) codersdk.TemplateInsightsRequest {
+						now := time.Now().UTC()
+						return codersdk.TemplateInsightsRequest{
+							StartTime: now.Truncate(24*time.Hour).AddDate(0, 0, -1),
+							EndTime:   now.Truncate(time.Hour).Add(time.Hour),
+						}
+					},
+				},
+				{
+					name:        "two days ago, no data",
+					ignoreTimes: true,
+					makeRequest: func(_ []*testTemplate) codersdk.TemplateInsightsRequest {
+						twoDaysAgo := time.Now().UTC().Truncate(24*time.Hour).AddDate(0, 0, -2)
+						return codersdk.TemplateInsightsRequest{
+							StartTime: twoDaysAgo,
+							EndTime:   twoDaysAgo.AddDate(0, 0, 1),
+						}
+					},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			require.NotNil(t, tt.makeFixture, "test bug: makeFixture must be set")
+			require.NotNil(t, tt.makeTestData, "test bug: makeTestData must be set")
+			templates, users, testData := prepareFixtureAndTestData(t, tt.makeFixture, tt.makeTestData)
+			client := prepare(t, templates, users, testData)
+
+			for _, req := range tt.requests {
+				req := req
+				t.Run(req.name, func(t *testing.T) {
+					t.Parallel()
+
+					ctx := testutil.Context(t, testutil.WaitMedium)
+
+					report, err := client.TemplateInsights(ctx, req.makeRequest(templates))
+					require.NoError(t, err, "want no error getting template insights")
+
+					if req.ignoreTimes {
+						// Ignore times, we're only interested in the data.
+						report.Report.StartTime = time.Time{}
+						report.Report.EndTime = time.Time{}
+						for i := range report.IntervalReports {
+							report.IntervalReports[i].StartTime = time.Time{}
+							report.IntervalReports[i].EndTime = time.Time{}
+						}
+					}
+
+					partialName := strings.Join(strings.Split(t.Name(), "/")[1:], "_")
+					goldenFile := filepath.Join("testdata", "insights", "template", partialName+".json.golden")
+					if *updateGoldenFiles {
+						err = os.MkdirAll(filepath.Dir(goldenFile), 0o755)
+						require.NoError(t, err, "want no error creating golden file directory")
+						f, err := os.Create(goldenFile)
+						require.NoError(t, err, "want no error creating golden file")
+						defer f.Close()
+						enc := json.NewEncoder(f)
+						enc.SetIndent("", "  ")
+						enc.Encode(report)
+						return
+					}
+
+					f, err := os.Open(goldenFile)
+					require.NoError(t, err, "open golden file, run \"make update-golden-files\" and commit the changes")
+					defer f.Close()
+					var want codersdk.TemplateInsightsResponse
+					err = json.NewDecoder(f).Decode(&want)
+					require.NoError(t, err, "want no error decoding golden file")
+
+					cmpOpts := []cmp.Option{
+						// Ensure readable UUIDs in diff.
+						cmp.Transformer("UUIDs", func(in []uuid.UUID) (s []string) {
+							for _, id := range in {
+								s = append(s, id.String())
+							}
+							return s
+						}),
+					}
+					// Use cmp.Diff here because it produces more readable diffs.
+					assert.Empty(t, cmp.Diff(want, report, cmpOpts...), "golden file mismatch (-want +got): %s, run \"make update-golden-files\", verify and commit the changes", goldenFile)
+				})
+			}
+		})
+	}
+}
+
+func TestUserActivityInsights_Golden(t *testing.T) {
+	t.Parallel()
+
+	// Prepare test data types.
+	type templateApp struct {
+		name string
+		icon string
+	}
+	type testTemplate struct {
+		name string
+		apps []templateApp
+
+		// Filled later.
+		id uuid.UUID
+	}
+	type workspaceApp templateApp
+	type testWorkspace struct {
+		name     string
+		template *testTemplate
+
+		// Filled later.
+		id          uuid.UUID
+		user        any // *testUser, but it's not available yet, defined below.
+		agentID     uuid.UUID
+		apps        []*workspaceApp
+		agentClient *agentsdk.Client
+	}
+	type testUser struct {
+		name       string
+		workspaces []*testWorkspace
+
+		client *codersdk.Client
+		sdk    codersdk.User
+
+		// Filled later.
+		id uuid.UUID
+	}
+
+	// Represent agent stats, to be inserted via stats batcher.
+	type agentStat struct {
+		// Set a range via start/end, multiple stats will be generated
+		// within the range.
+		startedAt time.Time
+		endedAt   time.Time
+
+		sessionCountVSCode          int64
+		sessionCountJetBrains       int64
+		sessionCountReconnectingPTY int64
+		sessionCountSSH             int64
+		noConnections               bool
+	}
+	// Represent app usage stats, to be inserted via stats reporter.
+	type appUsage struct {
+		app       *workspaceApp
+		startedAt time.Time
+		endedAt   time.Time
+		requests  int
+	}
+
+	// Represent actual data being generated on a per-workspace basis.
+	type testDataGen struct {
+		agentStats []agentStat
+		appUsage   []appUsage
+	}
+
+	prepareFixtureAndTestData := func(t *testing.T, makeFixture func() ([]*testTemplate, []*testUser), makeData func([]*testTemplate, []*testUser) map[*testWorkspace]testDataGen) ([]*testTemplate, []*testUser, map[*testWorkspace]testDataGen) {
+		var stableIDs []uuid.UUID
+		newStableUUID := func() uuid.UUID {
+			stableIDs = append(stableIDs, uuid.MustParse(fmt.Sprintf("00000000-0000-0000-0000-%012d", len(stableIDs)+1)))
+			stableID := stableIDs[len(stableIDs)-1]
+			return stableID
+		}
+
+		templates, users := makeFixture()
+		for _, template := range templates {
+			template.id = newStableUUID()
+		}
+		for _, user := range users {
+			user.id = newStableUUID()
+		}
+
+		for _, user := range users {
+			for _, workspace := range user.workspaces {
+				workspace.user = user
+				for _, app := range workspace.template.apps {
+					app := workspaceApp(app)
+					workspace.apps = append(workspace.apps, &app)
+				}
+			}
+		}
+
+		testData := makeData(templates, users)
+		// Sanity check.
+		for ws, data := range testData {
+			for _, usage := range data.appUsage {
+				found := false
+				for _, app := range ws.apps {
+					if usage.app == app { // Pointer equality
+						found = true
+						break
+					}
+				}
+				if !found {
+					for _, user := range users {
+						for _, workspace := range user.workspaces {
+							for _, app := range workspace.apps {
+								if usage.app == app { // Pointer equality
+									require.True(t, found, "test bug: app %q not in workspace %q: want user=%s workspace=%s; got user=%s workspace=%s ", usage.app.name, ws.name, ws.user.(*testUser).name, ws.name, user.name, workspace.name)
+									break
+								}
+							}
+						}
+					}
+					require.True(t, found, "test bug: app %q not in workspace %q", usage.app.name, ws.name)
+				}
+			}
+		}
+
+		return templates, users, testData
+	}
+
+	prepare := func(t *testing.T, templates []*testTemplate, users []*testUser, testData map[*testWorkspace]testDataGen) *codersdk.Client {
+		logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: false}).Leveled(slog.LevelDebug)
+		db, pubsub := dbtestutil.NewDB(t)
+		client := coderdtest.New(t, &coderdtest.Options{
+			Database:                  db,
+			Pubsub:                    pubsub,
+			Logger:                    &logger,
+			IncludeProvisionerDaemon:  true,
+			AgentStatsRefreshInterval: time.Hour, // Not relevant for this test.
+		})
+		firstUser := coderdtest.CreateFirstUser(t, client)
+
+		// Prepare all test users.
+		for _, user := range users {
+			_ = dbgen.User(t, db, database.User{
+				ID:       user.id,
+				Username: user.name,
+				Status:   database.UserStatusActive,
+			})
+			_ = dbgen.OrganizationMember(t, db, database.OrganizationMember{
+				UserID:         user.id,
+				OrganizationID: firstUser.OrganizationID,
+			})
+			token, err := client.CreateToken(context.Background(), user.id.String(), codersdk.CreateTokenRequest{
+				Lifetime:  time.Hour * 24,
+				Scope:     codersdk.APIKeyScopeAll,
+				TokenName: "no-password-user-token",
+			})
+			require.NoError(t, err)
+			userClient := codersdk.New(client.URL)
+			userClient.SetSessionToken(token.Key)
+
+			coderUser, err := userClient.User(context.Background(), user.id.String())
+			require.NoError(t, err)
+
+			user.client = userClient
+			user.sdk = coderUser
+
+			user.client.SetLogger(logger.Named("user").With(slog.Field{Name: "name", Value: user.name}))
+		}
+
+		// Prepare all the templates.
+		for _, template := range templates {
+			template := template
+
+			// Prepare all workspace resources (agents and apps).
+			var (
+				createWorkspaces []func(uuid.UUID)
+				waitWorkspaces   []func()
+			)
+			var resources []*proto.Resource
+			for _, user := range users {
+				user := user
+				for _, workspace := range user.workspaces {
+					workspace := workspace
+
+					if workspace.template != template {
+						continue
+					}
+					authToken := uuid.New()
+					agentClient := agentsdk.New(client.URL)
+					agentClient.SetSessionToken(authToken.String())
+					workspace.agentClient = agentClient
+
+					var apps []*proto.App
+					for _, app := range workspace.apps {
+						apps = append(apps, &proto.App{
+							Slug:         app.name,
+							DisplayName:  app.name,
+							Icon:         app.icon,
+							SharingLevel: proto.AppSharingLevel_OWNER,
+							Url:          "http://",
+						})
+					}
+
+					resources = append(resources, &proto.Resource{
+						Name: "example",
+						Type: "aws_instance",
+						Agents: []*proto.Agent{{
+							Id:   uuid.NewString(), // Doesn't matter, not used in DB.
+							Name: "dev",
+							Auth: &proto.Agent_Token{
+								Token: authToken.String(),
+							},
+							Apps: apps,
+						}},
+					})
+
+					createWorkspaces = append(createWorkspaces, func(templateID uuid.UUID) {
+						// Create workspace using the users client.
+						createdWorkspace := coderdtest.CreateWorkspace(t, user.client, firstUser.OrganizationID, templateID)
+						workspace.id = createdWorkspace.ID
+						waitWorkspaces = append(waitWorkspaces, func() {
+							coderdtest.AwaitWorkspaceBuildJobCompleted(t, user.client, createdWorkspace.LatestBuild.ID)
+							ctx := testutil.Context(t, testutil.WaitShort)
+							ws, err := user.client.Workspace(ctx, workspace.id)
+							require.NoError(t, err, "want no error getting workspace")
+
+							workspace.agentID = ws.LatestBuild.Resources[0].Agents[0].ID
+						})
+					})
+				}
+			}
+
+			// Create the template version and template.
+			version := coderdtest.CreateTemplateVersion(t, client, firstUser.OrganizationID, &echo.Responses{
+				Parse:         echo.ParseComplete,
+				ProvisionPlan: echo.PlanComplete,
+				ProvisionApply: []*proto.Response{{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
+							Resources: resources,
+						},
+					},
+				}},
+			})
+			coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+
+			// Create template, essentially a modified version of CreateTemplate
+			// where we can control the template ID.
+			// 	createdTemplate := coderdtest.CreateTemplate(t, client, firstUser.OrganizationID, version.ID)
+			createdTemplate := dbgen.Template(t, db, database.Template{
+				ID:              template.id,
+				ActiveVersionID: version.ID,
+				OrganizationID:  firstUser.OrganizationID,
+				CreatedBy:       firstUser.UserID,
+				GroupACL: database.TemplateACL{
+					firstUser.OrganizationID.String(): []rbac.Action{rbac.ActionRead},
+				},
+			})
+			err := db.UpdateTemplateVersionByID(context.Background(), database.UpdateTemplateVersionByIDParams{
+				ID: version.ID,
+				TemplateID: uuid.NullUUID{
+					UUID:  createdTemplate.ID,
+					Valid: true,
+				},
+			})
+			require.NoError(t, err, "want no error updating template version")
+
+			// Create all workspaces and wait for them.
+			for _, createWorkspace := range createWorkspaces {
+				createWorkspace(template.id)
+			}
+			for _, waitWorkspace := range waitWorkspaces {
+				waitWorkspace()
+			}
+		}
+
+		ctx := testutil.Context(t, testutil.WaitSuperLong)
+
+		// Use agent stats batcher to insert agent stats, similar to live system.
+		// NOTE(mafredri): Ideally we would pass batcher as a coderd option and
+		// insert using the agentClient, but we have a circular dependency on
+		// the database.
+		batcher, batcherCloser, err := batchstats.New(
+			ctx,
+			batchstats.WithStore(db),
+			batchstats.WithLogger(logger.Named("batchstats")),
+			batchstats.WithInterval(time.Hour),
+		)
+		require.NoError(t, err)
+		defer batcherCloser() // Flushes the stats, this is to ensure they're written.
+
+		for workspace, data := range testData {
+			for _, stat := range data.agentStats {
+				createdAt := stat.startedAt
+				connectionCount := int64(1)
+				if stat.noConnections {
+					connectionCount = 0
+				}
+				for createdAt.Before(stat.endedAt) {
+					err = batcher.Add(createdAt, workspace.agentID, workspace.template.id, workspace.user.(*testUser).sdk.ID, workspace.id, agentsdk.Stats{
+						ConnectionCount:             connectionCount,
+						SessionCountVSCode:          stat.sessionCountVSCode,
+						SessionCountJetBrains:       stat.sessionCountJetBrains,
+						SessionCountReconnectingPTY: stat.sessionCountReconnectingPTY,
+						SessionCountSSH:             stat.sessionCountSSH,
+					})
+					require.NoError(t, err, "want no error inserting agent stats")
+					createdAt = createdAt.Add(30 * time.Second)
+				}
+			}
+		}
+
+		// Insert app usage.
+		var stats []workspaceapps.StatsReport
+		for workspace, data := range testData {
+			for _, usage := range data.appUsage {
+				appName := usage.app.name
+				accessMethod := workspaceapps.AccessMethodPath
+				if usage.app.name == "terminal" {
+					appName = ""
+					accessMethod = workspaceapps.AccessMethodTerminal
+				}
+				stats = append(stats, workspaceapps.StatsReport{
+					UserID:           workspace.user.(*testUser).sdk.ID,
+					WorkspaceID:      workspace.id,
+					AgentID:          workspace.agentID,
+					AccessMethod:     accessMethod,
+					SlugOrPort:       appName,
+					SessionID:        uuid.New(),
+					SessionStartedAt: usage.startedAt,
+					SessionEndedAt:   usage.endedAt,
+					Requests:         usage.requests,
+				})
+			}
+		}
+		reporter := workspaceapps.NewStatsDBReporter(db, workspaceapps.DefaultStatsDBReporterBatchSize)
+		//nolint:gocritic // This is a test.
+		err = reporter.Report(dbauthz.AsSystemRestricted(ctx), stats)
+		require.NoError(t, err, "want no error inserting app stats")
+
+		return client
+	}
+
+	baseTemplateAndUserFixture := func() ([]*testTemplate, []*testUser) {
+		// Test templates and configuration to generate.
+		templates := []*testTemplate{
+			// Create two templates with near-identical apps and parameters
+			// to allow testing for grouping similar data.
+			{
+				name: "template1",
+				apps: []templateApp{
+					{name: "app1", icon: "/icon1.png"},
+					{name: "app2", icon: "/icon2.png"},
+					{name: "app3", icon: "/icon2.png"},
+				},
+			},
+			{
+				name: "template2",
+				apps: []templateApp{
+					{name: "app1", icon: "/icon1.png"},
+					{name: "app2", icon: "/icon2.png"},
+					{name: "app3", icon: "/icon2.png"},
+				},
+			},
+			// Create another template with different parameters and apps.
+			{
+				name: "othertemplate",
+				apps: []templateApp{
+					{name: "otherapp1", icon: "/icon1.png"},
+
+					// This "special test app" will be converted into web
+					// terminal usage, this is not included in stats since we
+					// currently rely on agent stats for this data.
+					{name: "terminal", icon: "/terminal.png"},
+				},
+			},
+		}
+
+		// Users and workspaces to generate.
+		users := []*testUser{
+			{
+				name: "user1",
+				workspaces: []*testWorkspace{
+					{
+						name:     "workspace1",
+						template: templates[0],
+					},
+					{
+						name:     "workspace2",
+						template: templates[1],
+					},
+					{
+						name:     "otherworkspace3",
+						template: templates[2],
+					},
+				},
+			},
+			{
+				name: "user2",
+				workspaces: []*testWorkspace{
+					{
+						name:     "workspace1",
+						template: templates[0],
+					},
+				},
+			},
+			{
+				name: "user3",
+				workspaces: []*testWorkspace{
+					{
+						name:     "otherworkspace1",
+						template: templates[2],
+					},
+					{
+						name:     "workspace2",
+						template: templates[0],
+					},
+				},
+			},
+		}
+
+		return templates, users
+	}
+
+	// Time range for report, test data will be generated within and
+	// outside this range, but only data within the range should be
+	// included in the report.
+	frozenLastNight := time.Date(2023, 8, 22, 0, 0, 0, 0, time.UTC)
+	frozenWeekAgo := frozenLastNight.AddDate(0, 0, -7)
+
+	saoPaulo, err := time.LoadLocation("America/Sao_Paulo")
+	require.NoError(t, err)
+	frozenWeekAgoSaoPaulo, err := time.ParseInLocation(time.DateTime, frozenWeekAgo.Format(time.DateTime), saoPaulo)
+	require.NoError(t, err)
+
+	//nolint:dupl // For testing purposes
+	makeBaseTestData := func(templates []*testTemplate, users []*testUser) map[*testWorkspace]testDataGen {
+		return map[*testWorkspace]testDataGen{
+			users[0].workspaces[0]: {
+				agentStats: []agentStat{
+					{ // One hour of usage.
+						startedAt:          frozenWeekAgo,
+						endedAt:            frozenWeekAgo.Add(time.Hour),
+						sessionCountVSCode: 1,
+						sessionCountSSH:    1,
+					},
+					{ // 12 minutes of usage.
+						startedAt:       frozenWeekAgo.AddDate(0, 0, 1),
+						endedAt:         frozenWeekAgo.AddDate(0, 0, 1).Add(12 * time.Minute),
+						sessionCountSSH: 1,
+					},
+					{ // 1m30s of usage -> 2m rounded.
+						startedAt:             frozenWeekAgo.AddDate(0, 0, 2).Add(4*time.Minute + 30*time.Second),
+						endedAt:               frozenWeekAgo.AddDate(0, 0, 2).Add(6 * time.Minute),
+						sessionCountJetBrains: 1,
+					},
+				},
+				appUsage: []appUsage{
+					{ // One hour of usage.
+						app:       users[0].workspaces[0].apps[0],
+						startedAt: frozenWeekAgo,
+						endedAt:   frozenWeekAgo.Add(time.Hour),
+						requests:  1,
+					},
+					{ // 30s of app usage -> 1m rounded.
+						app:       users[0].workspaces[0].apps[0],
+						startedAt: frozenWeekAgo.Add(2*time.Hour + 10*time.Second),
+						endedAt:   frozenWeekAgo.Add(2*time.Hour + 40*time.Second),
+						requests:  1,
+					},
+					{ // 1m30s of app usage -> 2m rounded (included in São Paulo).
+						app:       users[0].workspaces[0].apps[0],
+						startedAt: frozenWeekAgo.Add(3*time.Hour + 30*time.Second),
+						endedAt:   frozenWeekAgo.Add(3*time.Hour + 90*time.Second),
+						requests:  1,
+					},
+					{ // used an app on the last day, counts as active user, 12m.
+						app:       users[0].workspaces[0].apps[2],
+						startedAt: frozenWeekAgo.AddDate(0, 0, 6),
+						endedAt:   frozenWeekAgo.AddDate(0, 0, 6).Add(12 * time.Minute),
+						requests:  1,
+					},
+				},
+			},
+			users[0].workspaces[1]: {
+				agentStats: []agentStat{
+					{
+						// One hour of usage in second template at the same time
+						// as in first template. When selecting both templates
+						// this user and their app usage will only be counted
+						// once but the template ID will show up in the data.
+						startedAt:          frozenWeekAgo,
+						endedAt:            frozenWeekAgo.Add(time.Hour),
+						sessionCountVSCode: 1,
+						sessionCountSSH:    1,
+					},
+					{ // One hour of usage.
+						startedAt:                   frozenWeekAgo.AddDate(0, 0, -12),
+						endedAt:                     frozenWeekAgo.AddDate(0, 0, -12).Add(time.Hour),
+						sessionCountSSH:             1,
+						sessionCountReconnectingPTY: 1,
+					},
+					{ // Another one hour of usage, but "active users" shouldn't be increased twice.
+						startedAt:                   frozenWeekAgo.AddDate(0, 0, -10),
+						endedAt:                     frozenWeekAgo.AddDate(0, 0, -10).Add(time.Hour),
+						sessionCountSSH:             1,
+						sessionCountReconnectingPTY: 1,
+					},
+				},
+				appUsage: []appUsage{
+					// TODO(mafredri): This doesn't behave correctly right now
+					// and will add more usage to the app. This could be
+					// considered both correct and incorrect behavior.
+					// { // One hour of usage, but same user and same template app, only count once.
+					// 	app:       users[0].workspaces[1].apps[0],
+					// 	startedAt: frozenWeekAgo,
+					// 	endedAt:   frozenWeekAgo.Add(time.Hour),
+					// 	requests:  1,
+					// },
+					{
+						// Different templates but identical apps, apps will be
+						// combined and usage will be summed.
+						app:       users[0].workspaces[1].apps[0],
+						startedAt: frozenWeekAgo.AddDate(0, 0, 2),
+						endedAt:   frozenWeekAgo.AddDate(0, 0, 2).Add(6 * time.Hour),
+						requests:  1,
+					},
+				},
+			},
+			users[0].workspaces[2]: {
+				agentStats: []agentStat{},
+				appUsage:   []appUsage{},
+			},
+			users[1].workspaces[0]: {
+				agentStats: []agentStat{
+					{ // One hour of agent usage before timeframe (exclude).
+						startedAt:          frozenWeekAgo.Add(-time.Hour),
+						endedAt:            frozenWeekAgo,
+						sessionCountVSCode: 1,
+						sessionCountSSH:    1,
+					},
+					{ // One hour of usage.
+						startedAt:       frozenWeekAgo,
+						endedAt:         frozenWeekAgo.Add(time.Hour),
+						sessionCountSSH: 1,
+					},
+					{ // One hour of agent usage after timeframe (exclude in UTC, include in São Paulo).
+						startedAt:          frozenWeekAgo.AddDate(0, 0, 7),
+						endedAt:            frozenWeekAgo.AddDate(0, 0, 7).Add(time.Hour),
+						sessionCountVSCode: 1,
+						sessionCountSSH:    1,
+					},
+				},
+				appUsage: []appUsage{
+					{ // One hour of app usage before timeframe (exclude).
+						app:       users[1].workspaces[0].apps[2],
+						startedAt: frozenWeekAgo.Add(-time.Hour),
+						endedAt:   frozenWeekAgo,
+						requests:  1,
+					},
+					{ // One hour of app usage after timeframe (exclude in UTC, include in São Paulo).
+						app:       users[1].workspaces[0].apps[2],
+						startedAt: frozenWeekAgo.AddDate(0, 0, 7),
+						endedAt:   frozenWeekAgo.AddDate(0, 0, 7).Add(time.Hour),
+						requests:  1,
+					},
+				},
+			},
+			users[2].workspaces[0]: {
+				agentStats: []agentStat{
+					{ // One hour of usage.
+						startedAt:                   frozenWeekAgo,
+						endedAt:                     frozenWeekAgo.Add(time.Hour),
+						sessionCountSSH:             1,
+						sessionCountReconnectingPTY: 1,
+					},
+				},
+				appUsage: []appUsage{
+					{
+						app:       users[2].workspaces[0].apps[0],
+						startedAt: frozenWeekAgo.AddDate(0, 0, 2),
+						endedAt:   frozenWeekAgo.AddDate(0, 0, 2).Add(5 * time.Minute),
+						requests:  1,
+					},
+					{ // Special app; excluded from apps, but counted as active during the day.
+						app:       users[2].workspaces[0].apps[1],
+						startedAt: frozenWeekAgo.AddDate(0, 0, 3),
+						endedAt:   frozenWeekAgo.AddDate(0, 0, 3).Add(5 * time.Minute),
+						requests:  1,
+					},
+				},
+			},
+		}
+	}
+	type testRequest struct {
+		name        string
+		makeRequest func([]*testTemplate) codersdk.UserActivityInsightsRequest
+		ignoreTimes bool
+	}
+	tests := []struct {
+		name         string
+		makeFixture  func() ([]*testTemplate, []*testUser)
+		makeTestData func([]*testTemplate, []*testUser) map[*testWorkspace]testDataGen
+		requests     []testRequest
+	}{
+		{
+			name:         "multiple users and workspaces",
+			makeFixture:  baseTemplateAndUserFixture,
+			makeTestData: makeBaseTestData,
+			requests: []testRequest{
+				{
+					name: "week deployment wide",
+					makeRequest: func(templates []*testTemplate) codersdk.UserActivityInsightsRequest {
+						return codersdk.UserActivityInsightsRequest{
+							StartTime: frozenWeekAgo,
+							EndTime:   frozenWeekAgo.AddDate(0, 0, 7),
+						}
+					},
+				},
+				{
+					name: "weekly aggregated deployment wide",
+					makeRequest: func(templates []*testTemplate) codersdk.UserActivityInsightsRequest {
+						return codersdk.UserActivityInsightsRequest{
+							StartTime: frozenWeekAgo.AddDate(0, 0, -3),
+							EndTime:   frozenWeekAgo.AddDate(0, 0, 4),
+						}
+					},
+				},
+				{
+					name: "week all templates",
+					makeRequest: func(templates []*testTemplate) codersdk.UserActivityInsightsRequest {
+						return codersdk.UserActivityInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[0].id, templates[1].id, templates[2].id},
+							StartTime:   frozenWeekAgo,
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+						}
+					},
+				},
+				{
+					name: "weekly aggregated templates",
+					makeRequest: func(templates []*testTemplate) codersdk.UserActivityInsightsRequest {
+						return codersdk.UserActivityInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[0].id, templates[1].id, templates[2].id},
+							StartTime:   frozenWeekAgo.AddDate(0, 0, -1),
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 6),
+						}
+					},
+				},
+				{
+					name: "week first template",
+					makeRequest: func(templates []*testTemplate) codersdk.UserActivityInsightsRequest {
+						return codersdk.UserActivityInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[0].id},
+							StartTime:   frozenWeekAgo,
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+						}
+					},
+				},
+				{
+					name: "weekly aggregated first template",
+					makeRequest: func(templates []*testTemplate) codersdk.UserActivityInsightsRequest {
+						return codersdk.UserActivityInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[0].id},
+							StartTime:   frozenWeekAgo,
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+						}
+					},
+				},
+				{
+					name: "week second template",
+					makeRequest: func(templates []*testTemplate) codersdk.UserActivityInsightsRequest {
+						return codersdk.UserActivityInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[1].id},
+							StartTime:   frozenWeekAgo,
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+						}
+					},
+				},
+				{
+					name: "three weeks second template",
+					makeRequest: func(templates []*testTemplate) codersdk.UserActivityInsightsRequest {
+						return codersdk.UserActivityInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[1].id},
+							StartTime:   frozenWeekAgo.AddDate(0, 0, -14),
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+						}
+					},
+				},
+				{
+					name: "week third template",
+					makeRequest: func(templates []*testTemplate) codersdk.UserActivityInsightsRequest {
+						return codersdk.UserActivityInsightsRequest{
+							TemplateIDs: []uuid.UUID{templates[2].id},
+							StartTime:   frozenWeekAgo,
+							EndTime:     frozenWeekAgo.AddDate(0, 0, 7),
+						}
+					},
+				},
+				{
+					// São Paulo is three hours behind UTC, so we should not see
+					// any data between weekAgo and weekAgo.Add(3 * time.Hour).
+					name: "week other timezone (São Paulo)",
+					makeRequest: func(templates []*testTemplate) codersdk.UserActivityInsightsRequest {
+						return codersdk.UserActivityInsightsRequest{
+							StartTime: frozenWeekAgoSaoPaulo,
+							EndTime:   frozenWeekAgoSaoPaulo.AddDate(0, 0, 7),
+						}
+					},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			require.NotNil(t, tt.makeFixture, "test bug: makeFixture must be set")
+			require.NotNil(t, tt.makeTestData, "test bug: makeTestData must be set")
+			templates, users, testData := prepareFixtureAndTestData(t, tt.makeFixture, tt.makeTestData)
+			client := prepare(t, templates, users, testData)
+
+			for _, req := range tt.requests {
+				req := req
+				t.Run(req.name, func(t *testing.T) {
+					t.Parallel()
+
+					ctx := testutil.Context(t, testutil.WaitMedium)
+
+					report, err := client.UserActivityInsights(ctx, req.makeRequest(templates))
+					require.NoError(t, err, "want no error getting template insights")
+
+					if req.ignoreTimes {
+						// Ignore times, we're only interested in the data.
+						report.Report.StartTime = time.Time{}
+						report.Report.EndTime = time.Time{}
+					}
+
+					partialName := strings.Join(strings.Split(t.Name(), "/")[1:], "_")
+					goldenFile := filepath.Join("testdata", "insights", "user-activity", partialName+".json.golden")
+					if *updateGoldenFiles {
+						err = os.MkdirAll(filepath.Dir(goldenFile), 0o755)
+						require.NoError(t, err, "want no error creating golden file directory")
+						f, err := os.Create(goldenFile)
+						require.NoError(t, err, "want no error creating golden file")
+						defer f.Close()
+						enc := json.NewEncoder(f)
+						enc.SetIndent("", "  ")
+						enc.Encode(report)
+						return
+					}
+
+					f, err := os.Open(goldenFile)
+					require.NoError(t, err, "open golden file, run \"make update-golden-files\" and commit the changes")
+					defer f.Close()
+					var want codersdk.UserActivityInsightsResponse
+					err = json.NewDecoder(f).Decode(&want)
+					require.NoError(t, err, "want no error decoding golden file")
+
+					cmpOpts := []cmp.Option{
+						// Ensure readable UUIDs in diff.
+						cmp.Transformer("UUIDs", func(in []uuid.UUID) (s []string) {
+							for _, id := range in {
+								s = append(s, id.String())
+							}
+							return s
+						}),
+					}
+					// Use cmp.Diff here because it produces more readable diffs.
+					assert.Empty(t, cmp.Diff(want, report, cmpOpts...), "golden file mismatch (-want +got): %s, run \"make update-golden-files\", verify and commit the changes", goldenFile)
+				})
+			}
+		})
+	}
+}
+
+func TestTemplateInsights_BadRequest(t *testing.T) {
+	t.Parallel()
+
+	client := coderdtest.New(t, &coderdtest.Options{})
+	_ = coderdtest.CreateFirstUser(t, client)
+
+	y, m, d := time.Now().UTC().Date()
+	today := time.Date(y, m, d, 0, 0, 0, 0, time.UTC)
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	_, err := client.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
+		StartTime: today,
+		EndTime:   today.AddDate(0, 0, -1),
+	})
+	assert.Error(t, err, "want error for end time before start time")
+
+	_, err = client.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
+		StartTime: today.AddDate(0, 0, -7),
+		EndTime:   today.Add(-time.Hour),
+	})
+	assert.Error(t, err, "want error for end time partial day when not today")
+
+	_, err = client.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
+		StartTime: today.AddDate(0, 0, -1),
+		EndTime:   today,
+		Interval:  "invalid",
+	})
+	assert.Error(t, err, "want error for bad interval")
+
+	_, err = client.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
+		StartTime: today.AddDate(0, 0, -5),
+		EndTime:   today,
+		Interval:  codersdk.InsightsReportIntervalWeek,
+	})
+	assert.Error(t, err, "last report interval must have at least 6 days")
+
+	_, err = client.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
+		StartTime: today.AddDate(0, 0, -1),
+		EndTime:   today,
+		Interval:  codersdk.InsightsReportIntervalWeek,
+		Sections:  []codersdk.TemplateInsightsSection{"invalid"},
+	})
+	assert.Error(t, err, "want error for bad section")
+}
+
+func TestTemplateInsights_RBAC(t *testing.T) {
+	t.Parallel()
+
+	y, m, d := time.Now().UTC().Date()
+	today := time.Date(y, m, d, 0, 0, 0, 0, time.UTC)
+
+	type test struct {
+		interval     codersdk.InsightsReportInterval
+		withTemplate bool
+	}
+
+	tests := []test{
+		{codersdk.InsightsReportIntervalDay, true},
+		{codersdk.InsightsReportIntervalDay, false},
+		{"", true},
+		{"", false},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+
+		t.Run(fmt.Sprintf("with interval=%q", tt.interval), func(t *testing.T) {
+			t.Parallel()
 
 			t.Run("AsOwner", func(t *testing.T) {
 				t.Parallel()
 
-				client := coderdtest.New(t, &coderdtest.Options{})
-				admin := coderdtest.CreateFirstUser(t, client)
+				client := coderdtest.New(t, nil)
+				owner := coderdtest.CreateFirstUser(t, client)
 
 				ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
 				defer cancel()
 
 				var templateIDs []uuid.UUID
 				if tt.withTemplate {
-					version := coderdtest.CreateTemplateVersion(t, client, admin.OrganizationID, nil)
-					template := coderdtest.CreateTemplate(t, client, admin.OrganizationID, version.ID)
+					version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+					template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 					templateIDs = append(templateIDs, template.ID)
 				}
 
-				_, err := client.UserLatencyInsights(ctx, codersdk.UserLatencyInsightsRequest{
-					StartTime:   today,
-					EndTime:     time.Now().UTC().Truncate(time.Hour).Add(time.Hour), // Round up to include the current hour.
+				_, err := client.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
+					StartTime:   today.AddDate(0, 0, -1),
+					EndTime:     today,
+					Interval:    tt.interval,
 					TemplateIDs: templateIDs,
 				})
 				require.NoError(t, err)
@@ -624,24 +2134,25 @@ func TestUserLatencyInsights_RBAC(t *testing.T) {
 			t.Run("AsTemplateAdmin", func(t *testing.T) {
 				t.Parallel()
 
-				client := coderdtest.New(t, &coderdtest.Options{})
-				admin := coderdtest.CreateFirstUser(t, client)
+				client := coderdtest.New(t, nil)
+				owner := coderdtest.CreateFirstUser(t, client)
 
-				templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID, rbac.RoleTemplateAdmin())
+				templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
 				ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
 				defer cancel()
 
 				var templateIDs []uuid.UUID
 				if tt.withTemplate {
-					version := coderdtest.CreateTemplateVersion(t, client, admin.OrganizationID, nil)
-					template := coderdtest.CreateTemplate(t, client, admin.OrganizationID, version.ID)
+					version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+					template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 					templateIDs = append(templateIDs, template.ID)
 				}
 
-				_, err := templateAdmin.UserLatencyInsights(ctx, codersdk.UserLatencyInsightsRequest{
-					StartTime:   today,
-					EndTime:     time.Now().UTC().Truncate(time.Hour).Add(time.Hour), // Round up to include the current hour.
+				_, err := templateAdmin.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
+					StartTime:   today.AddDate(0, 0, -1),
+					EndTime:     today,
+					Interval:    tt.interval,
 					TemplateIDs: templateIDs,
 				})
 				require.NoError(t, err)
@@ -649,24 +2160,25 @@ func TestUserLatencyInsights_RBAC(t *testing.T) {
 			t.Run("AsRegularUser", func(t *testing.T) {
 				t.Parallel()
 
-				client := coderdtest.New(t, &coderdtest.Options{})
-				admin := coderdtest.CreateFirstUser(t, client)
+				client := coderdtest.New(t, nil)
+				owner := coderdtest.CreateFirstUser(t, client)
 
-				regular, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+				regular, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
 				ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
 				defer cancel()
 
 				var templateIDs []uuid.UUID
 				if tt.withTemplate {
-					version := coderdtest.CreateTemplateVersion(t, client, admin.OrganizationID, nil)
-					template := coderdtest.CreateTemplate(t, client, admin.OrganizationID, version.ID)
+					version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+					template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 					templateIDs = append(templateIDs, template.ID)
 				}
 
-				_, err := regular.UserLatencyInsights(ctx, codersdk.UserLatencyInsightsRequest{
-					StartTime:   today,
-					EndTime:     time.Now().UTC().Truncate(time.Hour).Add(time.Hour), // Round up to include the current hour.
+				_, err := regular.TemplateInsights(ctx, codersdk.TemplateInsightsRequest{
+					StartTime:   today.AddDate(0, 0, -1),
+					EndTime:     today,
+					Interval:    tt.interval,
 					TemplateIDs: templateIDs,
 				})
 				require.Error(t, err)
@@ -677,3 +2189,127 @@ func TestUserLatencyInsights_RBAC(t *testing.T) {
 		})
 	}
 }
+
+func TestGenericInsights_RBAC(t *testing.T) {
+	t.Parallel()
+
+	y, m, d := time.Now().UTC().Date()
+	today := time.Date(y, m, d, 0, 0, 0, 0, time.UTC)
+
+	type fetchInsightsFunc func(ctx context.Context, client *codersdk.Client, startTime, endTime time.Time, templateIDs ...uuid.UUID) error
+
+	type test struct {
+		withTemplate bool
+	}
+
+	endpoints := map[string]fetchInsightsFunc{
+		"UserLatency": func(ctx context.Context, client *codersdk.Client, startTime, endTime time.Time, templateIDs ...uuid.UUID) error {
+			_, err := client.UserLatencyInsights(ctx, codersdk.UserLatencyInsightsRequest{
+				StartTime:   startTime,
+				EndTime:     endTime,
+				TemplateIDs: templateIDs,
+			})
+			return err
+		},
+		"UserActivity": func(ctx context.Context, client *codersdk.Client, startTime, endTime time.Time, templateIDs ...uuid.UUID) error {
+			_, err := client.UserActivityInsights(ctx, codersdk.UserActivityInsightsRequest{
+				StartTime:   startTime,
+				EndTime:     endTime,
+				TemplateIDs: templateIDs,
+			})
+			return err
+		},
+	}
+
+	for endpointName, endpoint := range endpoints {
+		endpointName := endpointName
+		endpoint := endpoint
+
+		t.Run(fmt.Sprintf("With%sEndpoint", endpointName), func(t *testing.T) {
+			t.Parallel()
+
+			tests := []test{
+				{true},
+				{false},
+			}
+
+			for _, tt := range tests {
+				tt := tt
+
+				t.Run("AsOwner", func(t *testing.T) {
+					t.Parallel()
+
+					client := coderdtest.New(t, nil)
+					owner := coderdtest.CreateFirstUser(t, client)
+
+					ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+					defer cancel()
+
+					var templateIDs []uuid.UUID
+					if tt.withTemplate {
+						version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+						template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+						templateIDs = append(templateIDs, template.ID)
+					}
+
+					err := endpoint(ctx, client,
+						today,
+						time.Now().UTC().Truncate(time.Hour).Add(time.Hour), // Round up to include the current hour.
+						templateIDs...)
+					require.NoError(t, err)
+				})
+				t.Run("AsTemplateAdmin", func(t *testing.T) {
+					t.Parallel()
+
+					client := coderdtest.New(t, nil)
+					owner := coderdtest.CreateFirstUser(t, client)
+
+					templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+
+					ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+					defer cancel()
+
+					var templateIDs []uuid.UUID
+					if tt.withTemplate {
+						version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+						template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+						templateIDs = append(templateIDs, template.ID)
+					}
+
+					err := endpoint(ctx, templateAdmin,
+						today,
+						time.Now().UTC().Truncate(time.Hour).Add(time.Hour), // Round up to include the current hour.
+						templateIDs...)
+					require.NoError(t, err)
+				})
+				t.Run("AsRegularUser", func(t *testing.T) {
+					t.Parallel()
+
+					client := coderdtest.New(t, nil)
+					owner := coderdtest.CreateFirstUser(t, client)
+
+					regular, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+					ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+					defer cancel()
+
+					var templateIDs []uuid.UUID
+					if tt.withTemplate {
+						version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+						template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+						templateIDs = append(templateIDs, template.ID)
+					}
+
+					err := endpoint(ctx, regular,
+						today,
+						time.Now().UTC().Truncate(time.Hour).Add(time.Hour), // Round up to include the current hour.
+						templateIDs...)
+					require.Error(t, err)
+					var apiErr *codersdk.Error
+					require.ErrorAs(t, err, &apiErr)
+					require.Equal(t, http.StatusNotFound, apiErr.StatusCode())
+				})
+			}
+		})
+	}
+}
diff --git a/coderd/members.go b/coderd/members.go
index 67ab19cf45687..038851870cf8d 100644
--- a/coderd/members.go
+++ b/coderd/members.go
@@ -8,13 +8,13 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/coderd/rbac"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // @Summary Assign role to organization member
@@ -31,7 +31,6 @@ import (
 func (api *API) putMemberRoles(rw http.ResponseWriter, r *http.Request) {
 	var (
 		ctx          = r.Context()
-		user         = httpmw.UserParam(r)
 		organization = httpmw.OrganizationParam(r)
 		member       = httpmw.OrganizationMemberParam(r)
 		apiKey       = httpmw.APIKey(r)
@@ -51,7 +50,7 @@ func (api *API) putMemberRoles(rw http.ResponseWriter, r *http.Request) {
 
 	updatedUser, err := api.updateOrganizationMemberRoles(ctx, database.UpdateMemberRolesParams{
 		GrantedRoles: params.Roles,
-		UserID:       user.ID,
+		UserID:       member.UserID,
 		OrgID:        organization.ID,
 	})
 	if err != nil {
diff --git a/coderd/metricscache/metricscache.go b/coderd/metricscache/metricscache.go
index d25b716f2df15..dc5f7dbb8c45b 100644
--- a/coderd/metricscache/metricscache.go
+++ b/coderd/metricscache/metricscache.go
@@ -15,9 +15,10 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/retry"
 )
 
@@ -146,8 +147,14 @@ func convertDAUResponse[T dauRow](rows []T, tzOffset int) codersdk.DAUsResponse
 	}
 
 	dates := maps.Keys(respMap)
-	slices.SortFunc(dates, func(a, b time.Time) bool {
-		return a.Before(b)
+	slices.SortFunc(dates, func(a, b time.Time) int {
+		if a.Before(b) {
+			return -1
+		} else if a.Equal(b) {
+			return 0
+		} else {
+			return 1
+		}
 	})
 
 	var resp codersdk.DAUsResponse
@@ -233,7 +240,7 @@ func (c *Cache) refreshTemplateDAUs(ctx context.Context) error {
 				Valid: true,
 			},
 			StartTime: sql.NullTime{
-				Time:  database.Time(time.Now().AddDate(0, -30, 0)),
+				Time:  dbtime.Time(time.Now().AddDate(0, -30, 0)),
 				Valid: true,
 			},
 		})
@@ -250,7 +257,7 @@ func (c *Cache) refreshTemplateDAUs(ctx context.Context) error {
 }
 
 func (c *Cache) refreshDeploymentStats(ctx context.Context) error {
-	from := database.Now().Add(-15 * time.Minute)
+	from := dbtime.Now().Add(-15 * time.Minute)
 	agentStats, err := c.database.GetDeploymentWorkspaceAgentStats(ctx, from)
 	if err != nil {
 		return err
@@ -261,8 +268,8 @@ func (c *Cache) refreshDeploymentStats(ctx context.Context) error {
 	}
 	c.deploymentStatsResponse.Store(&codersdk.DeploymentStats{
 		AggregatedFrom: from,
-		CollectedAt:    database.Now(),
-		NextUpdateAt:   database.Now().Add(c.intervals.DeploymentStats),
+		CollectedAt:    dbtime.Now(),
+		NextUpdateAt:   dbtime.Now().Add(c.intervals.DeploymentStats),
 		Workspaces: codersdk.WorkspaceDeploymentStats{
 			Pending:  workspaceStats.PendingWorkspaces,
 			Building: workspaceStats.BuildingWorkspaces,
diff --git a/coderd/metricscache/metricscache_test.go b/coderd/metricscache/metricscache_test.go
index 52c0df8a3ebd8..996b9940d0056 100644
--- a/coderd/metricscache/metricscache_test.go
+++ b/coderd/metricscache/metricscache_test.go
@@ -10,12 +10,13 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/metricscache"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/metricscache"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func dateH(year, month, day, hour int) time.Time {
@@ -209,7 +210,7 @@ func TestCache_TemplateUsers(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			var (
-				db    = dbfake.New()
+				db    = dbmem.New()
 				cache = metricscache.New(db, slogtest.Make(t, nil), metricscache.Intervals{
 					TemplateDAUs: testutil.IntervalFast,
 				})
@@ -341,7 +342,7 @@ func TestCache_BuildTime(t *testing.T) {
 			ctx := context.Background()
 
 			var (
-				db    = dbfake.New()
+				db    = dbmem.New()
 				cache = metricscache.New(db, slogtest.Make(t, nil), metricscache.Intervals{
 					TemplateDAUs: testutil.IntervalFast,
 				})
@@ -435,7 +436,7 @@ func TestCache_BuildTime(t *testing.T) {
 
 func TestCache_DeploymentStats(t *testing.T) {
 	t.Parallel()
-	db := dbfake.New()
+	db := dbmem.New()
 	cache := metricscache.New(db, slogtest.Make(t, nil), metricscache.Intervals{
 		DeploymentStats: testutil.IntervalFast,
 	})
@@ -444,7 +445,7 @@ func TestCache_DeploymentStats(t *testing.T) {
 	_, err := db.InsertWorkspaceAgentStat(context.Background(), database.InsertWorkspaceAgentStatParams{
 		ID:                 uuid.New(),
 		AgentID:            uuid.New(),
-		CreatedAt:          database.Now(),
+		CreatedAt:          dbtime.Now(),
 		ConnectionCount:    1,
 		RxBytes:            1,
 		TxBytes:            1,
diff --git a/coderd/oauthpki/oidcpki.go b/coderd/oauthpki/oidcpki.go
new file mode 100644
index 0000000000000..c44d130e5be9f
--- /dev/null
+++ b/coderd/oauthpki/oidcpki.go
@@ -0,0 +1,275 @@
+package oauthpki
+
+import (
+	"context"
+	"crypto/rsa"
+	"crypto/sha1" //#nosec // Not used for cryptography.
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/google/uuid"
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/jws"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/httpmw"
+)
+
+// Config uses jwt assertions over client_secret for oauth2 authentication of
+// the application. This implementation was made specifically for Azure AD.
+//
+//	https://learn.microsoft.com/en-us/azure/active-directory/develop/certificate-credentials
+//
+// However this does mostly follow the standard. We can generalize this as we
+// include support for more IDPs.
+//
+//	https://datatracker.ietf.org/doc/html/rfc7523
+type Config struct {
+	cfg httpmw.OAuth2Config
+
+	// These values should match those provided in the oauth2.Config.
+	// Because the inner config is an interface, we need to duplicate these
+	// values here.
+	scopes   []string
+	clientID string
+	tokenURL string
+
+	// ClientSecret is the private key of the PKI cert.
+	// Azure AD only supports RS256 signing algorithm.
+	clientKey *rsa.PrivateKey
+	// Base64url-encoded SHA-1 thumbprint of the X.509 certificate's DER encoding.
+	// This is specific to Azure AD
+	x5t string
+}
+
+type ConfigParams struct {
+	ClientID       string
+	TokenURL       string
+	Scopes         []string
+	PemEncodedKey  []byte
+	PemEncodedCert []byte
+
+	Config httpmw.OAuth2Config
+}
+
+// NewOauth2PKIConfig creates the oauth2 config for PKI based auth. It requires the certificate and it's private key.
+// The values should be passed in as PEM encoded values, which is the standard encoding for x509 certs saved to disk.
+// It should look like:
+//
+// -----BEGIN RSA PRIVATE KEY----
+// ...
+// -----END RSA PRIVATE KEY-----
+//
+// -----BEGIN CERTIFICATE-----
+// ...
+// -----END CERTIFICATE-----
+func NewOauth2PKIConfig(params ConfigParams) (*Config, error) {
+	if params.ClientID == "" {
+		return nil, xerrors.Errorf("")
+	}
+	if len(params.Scopes) == 0 {
+		return nil, xerrors.Errorf("scopes are required")
+	}
+
+	rsaKey, err := decodeClientKey(params.PemEncodedKey)
+	if err != nil {
+		return nil, err
+	}
+
+	// Azure AD requires a certificate. The sha1 of the cert is used to identify the signer.
+	// This is not required in the general specification.
+	if strings.Contains(strings.ToLower(params.TokenURL), "microsoftonline") && len(params.PemEncodedCert) == 0 {
+		return nil, xerrors.Errorf("oidc client certificate is required and missing")
+	}
+
+	block, _ := pem.Decode(params.PemEncodedCert)
+	// Used as an identifier, not an actual cryptographic hash.
+	//nolint:gosec
+	hashed := sha1.Sum(block.Bytes)
+
+	return &Config{
+		clientID:  params.ClientID,
+		tokenURL:  params.TokenURL,
+		scopes:    params.Scopes,
+		cfg:       params.Config,
+		clientKey: rsaKey,
+		x5t:       base64.StdEncoding.EncodeToString(hashed[:]),
+	}, nil
+}
+
+// decodeClientKey decodes a PEM encoded rsa secret.
+func decodeClientKey(pemEncoded []byte) (*rsa.PrivateKey, error) {
+	block, _ := pem.Decode(pemEncoded)
+	key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+	if err != nil {
+		return nil, xerrors.Errorf("failed to parse private key: %w", err)
+	}
+
+	return key, nil
+}
+
+func (ja *Config) AuthCodeURL(state string, opts ...oauth2.AuthCodeOption) string {
+	return ja.cfg.AuthCodeURL(state, opts...)
+}
+
+// Exchange includes the client_assertion signed JWT.
+func (ja *Config) Exchange(ctx context.Context, code string, opts ...oauth2.AuthCodeOption) (*oauth2.Token, error) {
+	signed, err := ja.jwtToken()
+	if err != nil {
+		return nil, xerrors.Errorf("failed jwt assertion: %w", err)
+	}
+	opts = append(opts,
+		oauth2.SetAuthURLParam("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),
+		oauth2.SetAuthURLParam("client_assertion", signed),
+	)
+	return ja.cfg.Exchange(ctx, code, opts...)
+}
+
+func (ja *Config) jwtToken() (string, error) {
+	now := time.Now()
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{
+		"iss": ja.clientID,
+		"sub": ja.clientID,
+		"aud": ja.tokenURL,
+		// 5-10 minutes is recommended in the Azure docs.
+		// So we'll use 5 minutes.
+		"exp": now.Add(time.Minute * 5).Unix(),
+		"jti": uuid.New().String(),
+		"nbf": now.Unix(),
+		"iat": now.Unix(),
+	})
+	token.Header["x5t"] = ja.x5t
+
+	signed, err := token.SignedString(ja.clientKey)
+	if err != nil {
+		return "", xerrors.Errorf("sign jwt assertion: %w", err)
+	}
+	return signed, nil
+}
+
+func (ja *Config) TokenSource(ctx context.Context, token *oauth2.Token) oauth2.TokenSource {
+	return oauth2.ReuseTokenSource(token, &jwtTokenSource{
+		cfg:          ja,
+		ctx:          ctx,
+		refreshToken: token.RefreshToken,
+	})
+}
+
+type jwtTokenSource struct {
+	cfg          *Config
+	ctx          context.Context
+	refreshToken string
+}
+
+// Token must be safe for concurrent use by multiple go routines
+// Very similar to the RetrieveToken implementation by the oauth2 package.
+// https://github.com/golang/oauth2/blob/master/internal/token.go#L212
+// Oauth2 package keeps this code unexported or in an /internal package,
+// so we have to copy the implementation :(
+func (src *jwtTokenSource) Token() (*oauth2.Token, error) {
+	if src.refreshToken == "" {
+		return nil, xerrors.New("oauth2: token expired and refresh token is not set")
+	}
+	cli := http.DefaultClient
+	if v, ok := src.ctx.Value(oauth2.HTTPClient).(*http.Client); ok {
+		cli = v
+	}
+
+	token, err := src.cfg.jwtToken()
+	if err != nil {
+		return nil, xerrors.Errorf("failed jwt assertion: %w", err)
+	}
+
+	v := url.Values{
+		"client_assertion":      {token},
+		"client_assertion_type": {"urn:ietf:params:oauth:client-assertion-type:jwt-bearer"},
+		"client_id":             {src.cfg.clientID},
+		"grant_type":            {"refresh_token"},
+		"scope":                 {strings.Join(src.cfg.scopes, " ")},
+		"refresh_token":         {src.refreshToken},
+	}
+	// Using params based auth
+	req, err := http.NewRequest("POST", src.cfg.tokenURL, strings.NewReader(v.Encode()))
+	if err != nil {
+		return nil, xerrors.Errorf("oauth2: make token refresh request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req = req.WithContext(src.ctx)
+	resp, err := cli.Do(req)
+	if err != nil {
+		return nil, xerrors.Errorf("oauth2: cannot get token: %w", err)
+	}
+
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, xerrors.Errorf("oauth2: cannot fetch token reading response body: %w", err)
+	}
+
+	var tokenRes struct {
+		AccessToken  string `json:"access_token"`
+		TokenType    string `json:"token_type,omitempty"`
+		RefreshToken string `json:"refresh_token,omitempty"`
+
+		// Extra fields returned by the refresh that are needed
+		IDToken   string `json:"id_token"`
+		ExpiresIn int64  `json:"expires_in"` // relative seconds from now
+		// error fields
+		// https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
+		ErrorCode        string `json:"error"`
+		ErrorDescription string `json:"error_description"`
+		ErrorURI         string `json:"error_uri"`
+	}
+
+	unmarshalError := json.Unmarshal(body, &tokenRes)
+
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		// Return a standard oauth2 error. Attempt to read some error fields. The error fields
+		// can be encoded in a few places, so this does not catch all of them.
+		return nil, &oauth2.RetrieveError{
+			Response: resp,
+			Body:     body,
+			// Best effort for error fields
+			ErrorCode:        tokenRes.ErrorCode,
+			ErrorDescription: tokenRes.ErrorDescription,
+			ErrorURI:         tokenRes.ErrorURI,
+		}
+	}
+
+	if unmarshalError != nil {
+		return nil, xerrors.Errorf("oauth2: cannot unmarshal token: %w", err)
+	}
+
+	newToken := &oauth2.Token{
+		AccessToken:  tokenRes.AccessToken,
+		TokenType:    tokenRes.TokenType,
+		RefreshToken: tokenRes.RefreshToken,
+	}
+
+	if secs := tokenRes.ExpiresIn; secs > 0 {
+		newToken.Expiry = time.Now().Add(time.Duration(secs) * time.Second)
+	}
+
+	// ID token is a JWT token. We can decode it to get the expiry.
+	// Not really sure what to do if the ExpiresIn and JWT expiry differ,
+	// but this one is attached in the JWT and guaranteed to be right for local
+	// validation. So use this one if found.
+	if v := tokenRes.IDToken; v != "" {
+		// decode returned id token to get expiry
+		claimSet, err := jws.Decode(v)
+		if err != nil {
+			return nil, xerrors.Errorf("oauth2: error decoding JWT token: %w", err)
+		}
+		newToken.Expiry = time.Unix(claimSet.Exp, 0)
+	}
+
+	return newToken, nil
+}
diff --git a/coderd/oauthpki/okidcpki_test.go b/coderd/oauthpki/okidcpki_test.go
new file mode 100644
index 0000000000000..ab6e3e3a08179
--- /dev/null
+++ b/coderd/oauthpki/okidcpki_test.go
@@ -0,0 +1,351 @@
+package oauthpki_test
+
+import (
+	"context"
+	"encoding/base64"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/oauth2"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/coderdtest/oidctest"
+	"github.com/coder/coder/v2/coderd/oauthpki"
+	"github.com/coder/coder/v2/testutil"
+)
+
+const (
+	testClientKey = `-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAnUryZEfn5kA8wuk9a7ogFuWbk3uPHEhioYuAg9m3/tIdqSqu
+ASpRzw8+1nORTf3ykWRRlhxZWnKimmkB0Ux5Yrz9TDVWDQbzEH3B8ibMlmaNcoN8
+wYVzeEpqCe3fJagnV0lh0sHB1Z+vhcJ/M2nEAdyfhIgQEbG6Xtl2+WcGqyMWUJpV
+g8+ebK+JkXELAGN1hg3DdV52gjodEjoe1/ibHz8y3NR7j2tOKix7iKOhccyFkD35
+xqSnfyZJK5yxIfmGiWdVOIGqc2rYpgvrXJLTOjLoeyDSNi+Q604T64ZxsqfuM4LX
+BakVG3EwHFXPBfsBKjUE9HYvXEXw3fJP9K6mIwIDAQABAoIBAQCb+aH7x0IylSir
+r1Z06RDBI9bunOwBA9aqkwdRuCg4zGsVQXljNnABgACz7837JQPRIUW2MU553otX
+yyE+RzNnsjkLxSgbqvSFOe+FDOx7iB5jm/euf4NNmZ0lU3iggurgJ6iVsgVgrQUF
+AyXX+d2gawLUDYjBwxgozkSodH2sXYSX+SWfSOXHsFzSa3tLtUMbAIflM0rlRXf7
+Z57M8mMomZUvmmojH+TnBQljJlU8lhrvOaDD4DT8qAtVHE3VluDBQ9/3E8OIjz+E
+EqUgWLgrdq1rIMhJbHN90NwLwWs+2PcRfdB6hqKPktLne2KZFOgVKlxPKOYByBq1
+PX/vJ/HBAoGBAMFmJ6nYqyUVl26ajlXmnXBjQ+iBLHo9lcUu84+rpqRf90Bsm5bd
+jMmYr3Yo3yXNiit3rvZzBfPElo+IVa1HpPtgOaa2AU5B3QzxWCNT0FNRQqMG2LcA
+CvB10pOdJEABQxr7d4eFRg2/KbF1fr0r0vqMEelwa5ejTg6ROD3DtadpAoGBANA0
+4EClniCwvd1IECy2oTuTDosXgmRKwRAcwgE34YXy1Y/L4X/ghFeCHi3ybrep0uwL
+ptJNK+0sqvPu6UhC356GfMqfuzOKNMkXybnPUbHrz5KTkN+QQMfPc73Veel2gpD3
+xNataEmHtxcOx0X1OnjwyZZpmMbrUY3Cackn+durAoGBAKYR5nU+jJfnloVvSlIR
+GZhsZN++LEc7ouQTkSoJp6r2jQZRPLmrvT1PUzwPlK6NdNwmhaMy2iWc5fySgZ+u
+KcmBs3+oQi7E9+ApThnn2rfwy1vagTWDX+FkC1KeWYZsjwcYcGd61dDwGgk8b3xZ
+qW1j4e2mj31CycBQiw7eg5ohAoGADvkOe3etlHpBXS12hFCp7afYruYE6YN6uNbo
+mL/VBxX8h7fIwrJ5sfVYiENb9PdQhMsdtxf3pbnFnX875Ydxn2vag5PTGZTB0QhV
+6HfhTyM/LTJRg9JS5kuj7i3w83ojT5uR20JjMo6A+zaD3CMTjmj6hkeXxg5cMg6e
+HuoyDLsCgYBcbboYMFT1cUSxBeMtPGt3CxxZUYnUQaRUeOcjqYYlFL+DCWhY7pxH
+EnLhwW/KzkDzOmwRmmNOMqD7UhR/ayxR+avRt6v5d5l8fVCuNexgs7kR9L5IQp9l
+YV2wsCoXBCcuPmio/te44U//BlzprEu0w1iHpb3ibmQg4y291R0TvQ==
+-----END RSA PRIVATE KEY-----`
+
+	testClientCert = `
+-----BEGIN CERTIFICATE-----
+MIIEOjCCAiKgAwIBAgIQMO50KnWsRbmrrthPQgyubjANBgkqhkiG9w0BAQsFADAY
+MRYwFAYDVQQDEw1Mb2NhbGhvc3RDZXJ0MB4XDTIzMDgxMDE2MjYxOFoXDTI1MDIx
+MDE2MjU0M1owFDESMBAGA1UEAxMJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAnUryZEfn5kA8wuk9a7ogFuWbk3uPHEhioYuAg9m3/tId
+qSquASpRzw8+1nORTf3ykWRRlhxZWnKimmkB0Ux5Yrz9TDVWDQbzEH3B8ibMlmaN
+coN8wYVzeEpqCe3fJagnV0lh0sHB1Z+vhcJ/M2nEAdyfhIgQEbG6Xtl2+WcGqyMW
+UJpVg8+ebK+JkXELAGN1hg3DdV52gjodEjoe1/ibHz8y3NR7j2tOKix7iKOhccyF
+kD35xqSnfyZJK5yxIfmGiWdVOIGqc2rYpgvrXJLTOjLoeyDSNi+Q604T64Zxsqfu
+M4LXBakVG3EwHFXPBfsBKjUE9HYvXEXw3fJP9K6mIwIDAQABo4GDMIGAMA4GA1Ud
+DwEB/wQEAwIDuDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0O
+BBYEFAYCdgydG3h2SNWF+BfAyJtNliJtMB8GA1UdIwQYMBaAFHR/aptP0RUNNFyf
+5uky527SECt1MA8GA1UdEQQIMAaHBH8AAAEwDQYJKoZIhvcNAQELBQADggIBAI6P
+ymG7l06JvJ3p6xgaMyOxgkpQl6WkY4LJHVEhfeDSoO3qsJc4PxUdSExJsT84weXb
+lF+tK6D/CPlvjmG720IlB5cSKJ71rWjwmaMWKxWKXyoZdDrHAp55+FNdXegUZF2o
+EF/ZM5CHaO8iHMkuWEv1OASHBQWC/o4spUN5HGQ9HepwLVvO/aX++LYfvfL9faKA
+IT+w9i8pJbfItFmfA8x2OEVZk8aEA0WtKdfsMwzGmZ1GSGa4UYcynxQGCMiB5h4L
+C/dpoJRbEzdGLuTZgV2SCaN3k5BrH4aaILI9tqZaq0gamN9Rd2yji3cGiduCeAAo
+RmVcl9fBliMLxylWEP5+B2JmCZEc8Lfm0TBNnjaG17KY40gzbfBYixBxBTYgsPua
+bfprtfksSG++zcsDbkC8CtPamtlNWtDAiFp4yQRkP79PlJO6qCdTrFWPukTMCMso
+25hjLvxj1fLy/jSMDEZu/oQ14TMCZSGHRjz4CPiaCfXqgqOtVOD+5+yWInwUGp/i
+Nb1vIq4ruEAbyCbdWKHbE0yT5AP7hm5ZNybpZ4/311AEBD2HKip/OqB05p99XcLw
+BIC4ODNvwCn6x00KZoqWz/MX2dEQ/HqWiWaDB/OSemfTVE3I94mzEWnqpF2cQpcT
+B1B7CpkMU55hPP+7nsofCszNrMDXT8Z5w2a3zLKM
+-----END CERTIFICATE-----
+`
+)
+
+// TestAzureADPKIOIDC ensures we do not break Azure AD compatibility.
+// It runs an oauth2.Exchange method and hijacks the request to only check the
+// request side of the transaction.
+func TestAzureADPKIOIDC(t *testing.T) {
+	t.Parallel()
+
+	oauthCfg := &oauth2.Config{
+		ClientID: "random-client-id",
+		Endpoint: oauth2.Endpoint{
+			TokenURL: "https://login.microsoftonline.com/6a1e9139-13f2-4afb-8f46-036feac8bd79/v2.0/token",
+		},
+	}
+
+	pkiConfig, err := oauthpki.NewOauth2PKIConfig(oauthpki.ConfigParams{
+		ClientID:       oauthCfg.ClientID,
+		TokenURL:       oauthCfg.Endpoint.TokenURL,
+		PemEncodedKey:  []byte(testClientKey),
+		PemEncodedCert: []byte(testClientCert),
+		Config:         oauthCfg,
+		Scopes:         []string{"openid", "email", "profile"},
+	})
+	require.NoError(t, err, "failed to create pki config")
+
+	ctx := testutil.Context(t, testutil.WaitMedium)
+	ctx = oidc.ClientContext(ctx, &http.Client{
+		Transport: &fakeRoundTripper{
+			roundTrip: func(req *http.Request) (*http.Response, error) {
+				resp := &http.Response{
+					Status: "500 Internal Service Error",
+				}
+				// This is the easiest way to hijack the request and check
+				// the params. The oauth2 package uses unexported types and
+				// options, so we need to view the actual request created.
+				assertJWTAuth(t, req)
+				return resp, nil
+			},
+		},
+	})
+	_, err = pkiConfig.Exchange(ctx, base64.StdEncoding.EncodeToString([]byte("random-code")))
+	// We hijack the request and return an error intentionally
+	require.Error(t, err, "error expected")
+}
+
+// TestAzureAKPKIWithCoderd uses a fake IDP and a real Coderd to test PKI auth.
+// nolint:bodyclose
+func TestAzureAKPKIWithCoderd(t *testing.T) {
+	t.Parallel()
+
+	scopes := []string{"openid", "email", "profile", "offline_access"}
+	fake := oidctest.NewFakeIDP(t,
+		oidctest.WithIssuer("https://login.microsoftonline.com/fake_app"),
+		oidctest.WithCustomClientAuth(func(t testing.TB, req *http.Request) (url.Values, error) {
+			values := assertJWTAuth(t, req)
+			if values == nil {
+				return nil, xerrors.New("authorizatin failed in request")
+			}
+			return values, nil
+		}),
+		oidctest.WithServing(),
+	)
+	cfg := fake.OIDCConfig(t, scopes, func(cfg *coderd.OIDCConfig) {
+		cfg.AllowSignups = true
+	})
+
+	oauthCfg := cfg.OAuth2Config.(*oauth2.Config)
+	// Create the oauthpki config
+	pki, err := oauthpki.NewOauth2PKIConfig(oauthpki.ConfigParams{
+		ClientID:       oauthCfg.ClientID,
+		TokenURL:       oauthCfg.Endpoint.TokenURL,
+		Scopes:         scopes,
+		PemEncodedKey:  []byte(testClientKey),
+		PemEncodedCert: []byte(testClientCert),
+		Config:         oauthCfg,
+	})
+	require.NoError(t, err)
+	cfg.OAuth2Config = pki
+
+	owner, _, api := coderdtest.NewWithAPI(t, &coderdtest.Options{
+		OIDCConfig: cfg,
+	})
+
+	// Create a user and login
+	const email = "alice@coder.com"
+	claims := jwt.MapClaims{
+		"email": email,
+	}
+	helper := oidctest.NewLoginHelper(owner, fake)
+	user, _ := helper.Login(t, claims)
+
+	// Try refreshing the token more than once.
+	for i := 0; i < 2; i++ {
+		helper.ForceRefresh(t, api.Database, user, claims)
+	}
+}
+
+// TestSavedAzureADPKIOIDC was created by capturing actual responses from an Azure
+// AD instance and saving them to replay, removing some details.
+// The reason this is done is that this is the only way to assert values
+// passed to the oauth2 provider via http requests.
+// It is not feasible to run against an actual Azure AD instance, so this attempts
+// to prevent some regressions by running a full "e2e" oauth and asserting some
+// of the request values.
+func TestSavedAzureADPKIOIDC(t *testing.T) {
+	t.Parallel()
+
+	var (
+		stateString = "random-state"
+		oauth2Code  = base64.StdEncoding.EncodeToString([]byte("random-code"))
+	)
+
+	// Real oauth config. We will hijack all http requests so some of these values
+	// are fake.
+	cfg := &oauth2.Config{
+		ClientID:     "fake_app",
+		ClientSecret: "",
+		Endpoint: oauth2.Endpoint{
+			AuthURL:   "https://login.microsoftonline.com/fake_app/oauth2/v2.0/authorize",
+			TokenURL:  "https://login.microsoftonline.com/fake_app/oauth2/v2.0/token",
+			AuthStyle: 0,
+		},
+		RedirectURL: "http://localhost/api/v2/users/oidc/callback",
+		Scopes:      []string{"openid", "profile", "email", "offline_access"},
+	}
+
+	initialExchange := false
+	tokenRefreshed := false
+
+	// Create the oauthpki config
+	pki, err := oauthpki.NewOauth2PKIConfig(oauthpki.ConfigParams{
+		ClientID:       cfg.ClientID,
+		TokenURL:       cfg.Endpoint.TokenURL,
+		Scopes:         []string{"openid", "email", "profile", "offline_access"},
+		PemEncodedKey:  []byte(testClientKey),
+		PemEncodedCert: []byte(testClientCert),
+		Config:         cfg,
+	})
+	require.NoError(t, err)
+
+	var fakeCtx context.Context
+	fakeClient := &http.Client{
+		Transport: fakeRoundTripper{
+			roundTrip: func(req *http.Request) (*http.Response, error) {
+				if strings.Contains(req.URL.String(), "authorize") {
+					// This is the user hitting the browser endpoint to begin the OIDC
+					// auth flow.
+
+					// Authorize should redirect the user back to the app after authentication on
+					// the IDP.
+					resp := httptest.NewRecorder()
+					v := url.Values{
+						"code":          {oauth2Code},
+						"state":         {stateString},
+						"session_state": {"a18cf797-1e2b-4bc3-baf9-66b41a4997cf"},
+					}
+
+					// This url doesn't really matter since the fake client will hiject this actual request.
+					http.Redirect(resp, req, "http://localhost:3000/api/v2/users/oidc/callback?"+v.Encode(), http.StatusTemporaryRedirect)
+					return resp.Result(), nil
+				}
+				if strings.Contains(req.URL.String(), "v2.0/token") {
+					vals := assertJWTAuth(t, req)
+					switch vals.Get("grant_type") {
+					case "authorization_code":
+						// Initial token
+						initialExchange = true
+						assert.Equal(t, oauth2Code, vals.Get("code"), "initial exchange code mismatch")
+					case "refresh_token":
+						// refreshed token
+						tokenRefreshed = true
+						assert.Equal(t, "<refresh_token_JWT>", vals.Get("refresh_token"), "refresh token required")
+					}
+
+					resp := httptest.NewRecorder()
+					// Taken from an actual response
+					// Just always return a token no matter what.
+					resp.Header().Set("Content-Type", "application/json")
+					_, _ = resp.Write([]byte(`{
+					   "token_type":"Bearer",
+					   "scope":"email openid profile AccessReview.ReadWrite.Membership Group.Read.All Group.ReadWrite.All User.Read",
+					   "expires_in":4009,
+					   "ext_expires_in":4009,
+					   "access_token":"<access_token_JWT>",
+					   "refresh_token":"<refresh_token_JWT>",
+					   "id_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ii1LSTNROW5OUjdiUm9meG1lWm9YcWJIWkdldyJ9.eyJhdWQiOiIxZjAxODMyYS1mZWViLTQyZGMtODFkOS01ZjBhYjZhMDQxZTAiLCJpc3MiOiJodHRwczovL2xvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20vMTEwZjBjMGYtY2Q3Ni00NzE3LWE2ZjgtNGVlYTNkMGY4MTA5L3YyLjAiLCJpYXQiOjE2OTE3OTI2MzQsIm5iZiI6MTY5MTc5MjYzNCwiZXhwIjoxNjkxNzk2NTM0LCJhaW8iOiJBWVFBZS84VUFBQUE1eEtqMmVTdWFXVmZsRlhCeGJJTnMvSkVyVHFvUGlaQW5ENmJIZWF3a2RRcisyRVRwM3RGNGY3akxicnh3ODhhVm9QOThrY0xMNjhON1hVV3FCN1I1N2JQRU9EclRlSUI1S0lyUHBjbCtIeXR0a1ljOVdWQklVVEErSllQbzl1a0ZjbGNWZ1krWUc3eHlmdi90K3Q1ZEczblNuZEdEQ1FYRVIxbDlTNko1T2c9IiwiZW1haWwiOiJzdGV2ZW5AY29kZXIuY29tIiwiZ3JvdXBzIjpbImM4MDQ4ZTkxLWY1YzMtNDdlNS05NjkzLTgzNGRlODQwMzRhZCIsIjcwYjQ4MTc1LTEwN2ItNGFkOC1iNDA1LTRkODg4YTFjNDY2ZiJdLCJpZHAiOiJtYWlsIiwibmFtZSI6IlN0ZXZlbiBNIiwib2lkIjoiN2JhNDYzNjAtZTAyNy00OTVhLTlhZTUtM2FlYWZlMzY3MGEyIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic3RldmVuQGNvZGVyLmNvbSIsInByb3ZfZGF0YSI6W3siQXQiOnRydWUsIlByb3YiOiJnaXRodWIuY29tIiwiQWx0c2VjaWQiOiI1NDQ2Mjk4IiwiQWNjZXNzVG9rZW4iOm51bGx9XSwicmgiOiIwLkFUZ0FEd3dQRVhiTkYwZW0tRTdxUFEtQkNTcURBUl9yX3R4Q2dkbGZDcmFnUWVBNEFPRS4iLCJyb2xlcyI6WyJUZW1wbGF0ZUF1dGhvcnMiXSwic3ViIjoib0JTN3FjUERKdWlDMEYyQ19XdDJycVlvanhpT0o3S3JFWjlkQ1RkTGVYNCIsInRpZCI6IjExMGYwYzBmLWNkNzYtNDcxNy1hNmY4LTRlZWEzZDBmODEwOSIsInV0aSI6IktReGlIWGtaZUVxcC1tQWlVdTlyQUEiLCJ2ZXIiOiIyLjAiLCJyb2xlczIiOiJUZW1wbGF0ZUF1dGhvcnMifQ.JevFI4Xm9dW7kQq4xEgZnUaU0SqbeOAFtT0YIKQNefR9Db4sjxCaKRmX0pPt-CM9j45d6fAiAkLFDAqjlSbi4Zi0GbEomT3yegmuxKgEgjPpJlGjF2TBUpsNNyn5gJ9Wkct9BfwALJhX2ePJFzIlkvx9opNNbNK1qHKMMjOSRFG6AGExKRDiQAME0a4hVgCwrAdUs4JrCcj4LqB84dODN-eoh-jx2-1wDvf6fovfwLHDQwjY4lfBxaYdNavKM369hrhU-U067rSnCzvDD26f4VLhPF52hiQIbTVN5t7p_1XmcduUiaNnmr9AZiZxZ-94mctSRRR8xG0pNwO2yv84iA"
+					}`))
+					return resp.Result(), nil
+				}
+				// This is the "Coder" half of things. We can keep this in the fake
+				// client, essentially being the fake client on both sides of the OIDC
+				// flow.
+				if strings.Contains(req.URL.String(), "v2/users/oidc/callback") {
+					// This is the callback from the IDP.
+					code := req.URL.Query().Get("code")
+					require.Equal(t, oauth2Code, code, "code mismatch")
+					state := req.URL.Query().Get("state")
+					require.Equal(t, stateString, state, "state mismatch")
+
+					// Exchange for token should work
+					token, err := pki.Exchange(fakeCtx, code)
+					if !assert.NoError(t, err) {
+						return httptest.NewRecorder().Result(), nil
+					}
+
+					// Also try a refresh
+					cpy := token
+					cpy.Expiry = time.Now().Add(time.Minute * -1)
+					src := pki.TokenSource(fakeCtx, cpy)
+					_, err = src.Token()
+					tokenRefreshed = true
+					assert.NoError(t, err, "token refreshed")
+					return httptest.NewRecorder().Result(), nil
+				}
+
+				return nil, xerrors.Errorf("not implemented")
+			},
+		},
+	}
+	fakeCtx = oidc.ClientContext(context.Background(), fakeClient)
+	_ = fakeCtx
+
+	// This simulates a client logging into the browser. The 307 redirect will
+	// make sure this goes through the full flow.
+	// nolint: noctx
+	resp, err := fakeClient.Get(pki.AuthCodeURL("state", oauth2.AccessTypeOffline))
+	require.NoError(t, err)
+	_ = resp.Body.Close()
+
+	require.True(t, initialExchange, "initial token exchange complete")
+	require.True(t, tokenRefreshed, "token was refreshed")
+}
+
+type fakeRoundTripper struct {
+	roundTrip func(req *http.Request) (*http.Response, error)
+}
+
+func (f fakeRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f.roundTrip(req)
+}
+
+// assertJWTAuth will assert the basic JWT auth assertions. It will return the
+// url.Values from the request body for any additional assertions to be made.
+func assertJWTAuth(t testing.TB, r *http.Request) url.Values {
+	body, err := io.ReadAll(r.Body)
+	if !assert.NoError(t, err) {
+		return nil
+	}
+	vals, err := url.ParseQuery(string(body))
+	if !assert.NoError(t, err) {
+		return nil
+	}
+
+	assert.Equal(t, "urn:ietf:params:oauth:client-assertion-type:jwt-bearer", vals.Get("client_assertion_type"))
+	jwtToken := vals.Get("client_assertion")
+	// No need to actually verify the jwt is signed right.
+	parsedToken, _, err := (&jwt.Parser{}).ParseUnverified(jwtToken, jwt.MapClaims{})
+	if !assert.NoError(t, err, "failed to parse jwt token") {
+		return nil
+	}
+
+	// Azure requirements
+	assert.NotEmpty(t, parsedToken.Header["x5t"], "hashed cert missing")
+	assert.Equal(t, "RS256", parsedToken.Header["alg"], "azure only accepts RS256")
+	assert.Equal(t, "JWT", parsedToken.Header["typ"], "azure only accepts JWT")
+
+	return vals
+}
diff --git a/coderd/organizations.go b/coderd/organizations.go
index 13906baef63b3..ae24edea01597 100644
--- a/coderd/organizations.go
+++ b/coderd/organizations.go
@@ -9,11 +9,12 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // @Summary Get organization by ID
@@ -67,10 +68,11 @@ func (api *API) postOrganizations(rw http.ResponseWriter, r *http.Request) {
 	var organization database.Organization
 	err = api.Database.InTx(func(tx database.Store) error {
 		organization, err = tx.InsertOrganization(ctx, database.InsertOrganizationParams{
-			ID:        uuid.New(),
-			Name:      req.Name,
-			CreatedAt: database.Now(),
-			UpdatedAt: database.Now(),
+			ID:          uuid.New(),
+			Name:        req.Name,
+			CreatedAt:   dbtime.Now(),
+			UpdatedAt:   dbtime.Now(),
+			Description: "",
 		})
 		if err != nil {
 			return xerrors.Errorf("create organization: %w", err)
@@ -78,8 +80,8 @@ func (api *API) postOrganizations(rw http.ResponseWriter, r *http.Request) {
 		_, err = tx.InsertOrganizationMember(ctx, database.InsertOrganizationMemberParams{
 			OrganizationID: organization.ID,
 			UserID:         apiKey.UserID,
-			CreatedAt:      database.Now(),
-			UpdatedAt:      database.Now(),
+			CreatedAt:      dbtime.Now(),
+			UpdatedAt:      dbtime.Now(),
 			Roles: []string{
 				// TODO: When organizations are allowed to be created, we should
 				// come back to determining the default role of the person who
@@ -94,7 +96,7 @@ func (api *API) postOrganizations(rw http.ResponseWriter, r *http.Request) {
 
 		_, err = tx.InsertAllUsersGroup(ctx, organization.ID)
 		if err != nil {
-			return xerrors.Errorf("create %q group: %w", database.AllUsersGroup, err)
+			return xerrors.Errorf("create %q group: %w", database.EveryoneGroup, err)
 		}
 		return nil
 	}, nil)
diff --git a/coderd/organizations_test.go b/coderd/organizations_test.go
index 87d69fc508c61..c8cde696e22a2 100644
--- a/coderd/organizations_test.go
+++ b/coderd/organizations_test.go
@@ -7,9 +7,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestOrganizationsByUser(t *testing.T) {
diff --git a/coderd/pagination.go b/coderd/pagination.go
index 8bc4228b3bcea..b50358e1f57f5 100644
--- a/coderd/pagination.go
+++ b/coderd/pagination.go
@@ -5,8 +5,8 @@ import (
 
 	"github.com/google/uuid"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // parsePagination extracts pagination query params from the http request.
diff --git a/coderd/pagination_internal_test.go b/coderd/pagination_internal_test.go
index d1e6bd107cfd8..94077b1083f4f 100644
--- a/coderd/pagination_internal_test.go
+++ b/coderd/pagination_internal_test.go
@@ -10,7 +10,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestPagination(t *testing.T) {
diff --git a/coderd/parameter/plaintext_test.go b/coderd/parameter/plaintext_test.go
index bb11f376d31b5..78945d9984e10 100644
--- a/coderd/parameter/plaintext_test.go
+++ b/coderd/parameter/plaintext_test.go
@@ -3,7 +3,7 @@ package parameter_test
 import (
 	"testing"
 
-	"github.com/coder/coder/coderd/parameter"
+	"github.com/coder/coder/v2/coderd/parameter"
 
 	"github.com/stretchr/testify/require"
 )
diff --git a/coderd/prometheusmetrics/aggregator.go b/coderd/prometheusmetrics/aggregator.go
index 7704f5cfae7ec..b1091b2451405 100644
--- a/coderd/prometheusmetrics/aggregator.go
+++ b/coderd/prometheusmetrics/aggregator.go
@@ -10,7 +10,7 @@ import (
 
 	"cdr.dev/slog"
 
-	"github.com/coder/coder/codersdk/agentsdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
 )
 
 const (
diff --git a/coderd/prometheusmetrics/aggregator_test.go b/coderd/prometheusmetrics/aggregator_test.go
index a5e5b0f11eaef..45f0de14851c3 100644
--- a/coderd/prometheusmetrics/aggregator_test.go
+++ b/coderd/prometheusmetrics/aggregator_test.go
@@ -12,10 +12,10 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/prometheusmetrics"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/prometheusmetrics"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/testutil"
 )
 
 const (
diff --git a/coderd/prometheusmetrics/collector_test.go b/coderd/prometheusmetrics/collector_test.go
index 9d63f6669113d..651be04477c7c 100644
--- a/coderd/prometheusmetrics/collector_test.go
+++ b/coderd/prometheusmetrics/collector_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/prometheusmetrics"
+	"github.com/coder/coder/v2/coderd/prometheusmetrics"
 )
 
 func TestCollector_Add(t *testing.T) {
@@ -115,11 +115,11 @@ func TestCollector_Set_Add(t *testing.T) {
 	assert.Equal(t, 6, int(metrics[1].Gauge.GetValue()))              // Metric value
 }
 
-func collectAndSortMetrics(t *testing.T, collector prometheus.Collector, count int) []dto.Metric {
+func collectAndSortMetrics(t *testing.T, collector prometheus.Collector, count int) []*dto.Metric {
 	ch := make(chan prometheus.Metric, count)
 	defer close(ch)
 
-	var metrics []dto.Metric
+	var metrics []*dto.Metric
 
 	collector.Collect(ch)
 	for i := 0; i < count; i++ {
@@ -129,7 +129,7 @@ func collectAndSortMetrics(t *testing.T, collector prometheus.Collector, count i
 		err := m.Write(&metric)
 		require.NoError(t, err)
 
-		metrics = append(metrics, metric)
+		metrics = append(metrics, &metric)
 	}
 
 	// Ensure always the same order of metrics
diff --git a/coderd/prometheusmetrics/insights/metricscollector.go b/coderd/prometheusmetrics/insights/metricscollector.go
new file mode 100644
index 0000000000000..d19785e8e6131
--- /dev/null
+++ b/coderd/prometheusmetrics/insights/metricscollector.go
@@ -0,0 +1,174 @@
+package insights
+
+import (
+	"context"
+	"sync/atomic"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/prometheus/client_golang/prometheus"
+	"golang.org/x/sync/errgroup"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/coderd/database"
+)
+
+var templatesActiveUsersDesc = prometheus.NewDesc("coderd_insights_templates_active_users", "The number of active users of the template.", []string{"template_name"}, nil)
+
+type MetricsCollector struct {
+	database     database.Store
+	logger       slog.Logger
+	timeWindow   time.Duration
+	tickInterval time.Duration
+
+	data atomic.Pointer[insightsData]
+}
+
+type insightsData struct {
+	templates []database.GetTemplateInsightsByTemplateRow
+
+	templateNames map[uuid.UUID]string
+}
+
+var _ prometheus.Collector = new(MetricsCollector)
+
+func NewMetricsCollector(db database.Store, logger slog.Logger, timeWindow time.Duration, tickInterval time.Duration) (*MetricsCollector, error) {
+	if timeWindow == 0 {
+		timeWindow = 5 * time.Minute
+	}
+	if timeWindow < 5*time.Minute {
+		return nil, xerrors.Errorf("time window must be at least 5 mins")
+	}
+	if tickInterval == 0 {
+		tickInterval = timeWindow
+	}
+
+	return &MetricsCollector{
+		database:     db,
+		logger:       logger.Named("insights_metrics_collector"),
+		timeWindow:   timeWindow,
+		tickInterval: tickInterval,
+	}, nil
+}
+
+func (mc *MetricsCollector) Run(ctx context.Context) (func(), error) {
+	ctx, closeFunc := context.WithCancel(ctx)
+	done := make(chan struct{})
+
+	// Use time.Nanosecond to force an initial tick. It will be reset to the
+	// correct duration after executing once.
+	ticker := time.NewTicker(time.Nanosecond)
+	doTick := func() {
+		defer ticker.Reset(mc.tickInterval)
+
+		now := time.Now()
+		startTime := now.Add(-mc.timeWindow)
+		endTime := now
+
+		// Phase 1: Fetch insights from database
+		// FIXME errorGroup will be used to fetch insights for apps and parameters
+		eg, egCtx := errgroup.WithContext(ctx)
+		eg.SetLimit(1)
+
+		var templateInsights []database.GetTemplateInsightsByTemplateRow
+
+		eg.Go(func() error {
+			var err error
+			templateInsights, err = mc.database.GetTemplateInsightsByTemplate(egCtx, database.GetTemplateInsightsByTemplateParams{
+				StartTime: startTime,
+				EndTime:   endTime,
+			})
+			if err != nil {
+				mc.logger.Error(ctx, "unable to fetch template insights from database", slog.Error(err))
+			}
+			return err
+		})
+		err := eg.Wait()
+		if err != nil {
+			return
+		}
+
+		// Phase 2: Collect template IDs, and fetch relevant details
+		templateIDs := uniqueTemplateIDs(templateInsights)
+
+		templateNames := make(map[uuid.UUID]string, len(templateIDs))
+		if len(templateIDs) > 0 {
+			templates, err := mc.database.GetTemplatesWithFilter(ctx, database.GetTemplatesWithFilterParams{
+				IDs: templateIDs,
+			})
+			if err != nil {
+				mc.logger.Error(ctx, "unable to fetch template details from database", slog.Error(err))
+				return
+			}
+			templateNames = onlyTemplateNames(templates)
+		}
+
+		// Refresh the collector state
+		mc.data.Store(&insightsData{
+			templates:     templateInsights,
+			templateNames: templateNames,
+		})
+	}
+
+	go func() {
+		defer close(done)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				ticker.Stop()
+				doTick()
+			}
+		}
+	}()
+	return func() {
+		closeFunc()
+		<-done
+	}, nil
+}
+
+func (*MetricsCollector) Describe(descCh chan<- *prometheus.Desc) {
+	descCh <- templatesActiveUsersDesc
+}
+
+func (mc *MetricsCollector) Collect(metricsCh chan<- prometheus.Metric) {
+	// Phase 3: Collect metrics
+
+	data := mc.data.Load()
+	if data == nil {
+		return // insights data not loaded yet
+	}
+
+	for _, templateRow := range data.templates {
+		metricsCh <- prometheus.MustNewConstMetric(templatesActiveUsersDesc, prometheus.GaugeValue, float64(templateRow.ActiveUsers), data.templateNames[templateRow.TemplateID])
+	}
+}
+
+// Helper functions below.
+
+func uniqueTemplateIDs(templateInsights []database.GetTemplateInsightsByTemplateRow) []uuid.UUID {
+	tids := map[uuid.UUID]bool{}
+	for _, t := range templateInsights {
+		tids[t.TemplateID] = true
+	}
+
+	uniqueUUIDs := make([]uuid.UUID, len(tids))
+	var i int
+	for t := range tids {
+		uniqueUUIDs[i] = t
+		i++
+	}
+	return uniqueUUIDs
+}
+
+func onlyTemplateNames(templates []database.Template) map[uuid.UUID]string {
+	m := map[uuid.UUID]string{}
+	for _, t := range templates {
+		m[t.ID] = t.Name
+	}
+	return m
+}
diff --git a/coderd/prometheusmetrics/insights/metricscollector_test.go b/coderd/prometheusmetrics/insights/metricscollector_test.go
new file mode 100644
index 0000000000000..0c1726a910e96
--- /dev/null
+++ b/coderd/prometheusmetrics/insights/metricscollector_test.go
@@ -0,0 +1,132 @@
+package insights_test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/prometheusmetrics/insights"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestCollect_TemplateInsights(t *testing.T) {
+	t.Parallel()
+
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
+	db, ps := dbtestutil.NewDB(t)
+
+	options := &coderdtest.Options{
+		IncludeProvisionerDaemon:  true,
+		AgentStatsRefreshInterval: time.Millisecond * 100,
+		Database:                  db,
+		Pubsub:                    ps,
+	}
+	client := coderdtest.New(t, options)
+
+	// Given
+	// Initialize metrics collector
+	mc, err := insights.NewMetricsCollector(db, logger, 0, time.Second)
+	require.NoError(t, err)
+
+	registry := prometheus.NewRegistry()
+	registry.Register(mc)
+
+	// Create two users, one that will appear in the report and another that
+	// won't (due to not having/using a workspace).
+	user := coderdtest.CreateFirstUser(t, client)
+	_, _ = coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
+	authToken := uuid.NewString()
+	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+		Parse:          echo.ParseComplete,
+		ProvisionPlan:  echo.PlanComplete,
+		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
+	})
+	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+	require.Empty(t, template.BuildTimeStats[codersdk.WorkspaceTransitionStart])
+
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+	// Start an agent so that we can generate stats.
+	_ = agenttest.New(t, client.URL, authToken)
+	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	// Run metrics collector
+	closeFunc, err := mc.Run(ctx)
+	require.NoError(t, err)
+	defer closeFunc()
+
+	// Connect to the agent to generate usage/latency stats.
+	conn, err := client.DialWorkspaceAgent(ctx, resources[0].Agents[0].ID, &codersdk.DialWorkspaceAgentOptions{
+		Logger: logger.Named("client"),
+	})
+	require.NoError(t, err)
+	defer conn.Close()
+
+	sshConn, err := conn.SSHClient(ctx)
+	require.NoError(t, err)
+	defer sshConn.Close()
+
+	sess, err := sshConn.NewSession()
+	require.NoError(t, err)
+	defer sess.Close()
+
+	r, w := io.Pipe()
+	defer r.Close()
+	defer w.Close()
+	sess.Stdin = r
+	sess.Stdout = io.Discard
+	err = sess.Start("cat")
+	require.NoError(t, err)
+
+	goldenFile, err := os.ReadFile("testdata/insights-metrics.json")
+	require.NoError(t, err)
+	golden := map[string]int{}
+	err = json.Unmarshal(goldenFile, &golden)
+	require.NoError(t, err)
+
+	collected := map[string]int{}
+	assert.Eventuallyf(t, func() bool {
+		// When
+		metrics, err := registry.Gather()
+		require.NoError(t, err)
+
+		// Then
+		for _, metric := range metrics {
+			switch metric.GetName() {
+			case "coderd_insights_templates_active_users":
+				for _, m := range metric.Metric {
+					collected[metric.GetName()] = int(m.Gauge.GetValue())
+				}
+			default:
+				require.FailNowf(t, "unexpected metric collected", "metric: %s", metric.GetName())
+			}
+		}
+
+		return assert.ObjectsAreEqualValues(golden, collected)
+	}, testutil.WaitMedium, testutil.IntervalFast, "template insights are missing")
+
+	// We got our latency metrics, close the connection.
+	_ = sess.Close()
+	_ = sshConn.Close()
+
+	require.EqualValues(t, golden, collected)
+}
diff --git a/coderd/prometheusmetrics/insights/testdata/insights-metrics.json b/coderd/prometheusmetrics/insights/testdata/insights-metrics.json
new file mode 100644
index 0000000000000..01c96a78b64a4
--- /dev/null
+++ b/coderd/prometheusmetrics/insights/testdata/insights-metrics.json
@@ -0,0 +1,3 @@
+{
+  "coderd_insights_templates_active_users": 1
+}
diff --git a/coderd/prometheusmetrics/prometheusmetrics.go b/coderd/prometheusmetrics/prometheusmetrics.go
index c1f749622accc..7145c2afa3b39 100644
--- a/coderd/prometheusmetrics/prometheusmetrics.go
+++ b/coderd/prometheusmetrics/prometheusmetrics.go
@@ -10,15 +10,17 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/coder/coder/v2/codersdk"
+
 	"github.com/google/uuid"
 	"github.com/prometheus/client_golang/prometheus"
 	"tailscale.com/tailcfg"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/tailnet"
 )
 
 const (
@@ -57,7 +59,7 @@ func ActiveUsers(ctx context.Context, registerer prometheus.Registerer, db datab
 			case <-ticker.C:
 			}
 
-			apiKeys, err := db.GetAPIKeysLastUsedAfter(ctx, database.Now().Add(-1*time.Hour))
+			apiKeys, err := db.GetAPIKeysLastUsedAfter(ctx, dbtime.Now().Add(-1*time.Hour))
 			if err != nil {
 				continue
 			}
@@ -118,7 +120,7 @@ func Workspaces(ctx context.Context, registerer prometheus.Registerer, db databa
 
 		gauge.Reset()
 		for _, job := range jobs {
-			status := db2sdk.ProvisionerJobStatus(job)
+			status := codersdk.ProvisionerJobStatus(job.JobStatus)
 			gauge.WithLabelValues(string(status)).Add(1)
 		}
 	}
diff --git a/coderd/prometheusmetrics/prometheusmetrics_test.go b/coderd/prometheusmetrics/prometheusmetrics_test.go
index 3ea774df1186d..8256c2f7e2e90 100644
--- a/coderd/prometheusmetrics/prometheusmetrics_test.go
+++ b/coderd/prometheusmetrics/prometheusmetrics_test.go
@@ -11,6 +11,10 @@ import (
 	"testing"
 	"time"
 
+	"github.com/coder/coder/v2/coderd/batchstats"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+
 	"github.com/google/uuid"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/assert"
@@ -20,18 +24,18 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/prometheusmetrics"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/tailnet"
-	"github.com/coder/coder/tailnet/tailnettest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/prometheusmetrics"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/tailnet/tailnettest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestActiveUsers(t *testing.T) {
@@ -44,15 +48,15 @@ func TestActiveUsers(t *testing.T) {
 	}{{
 		Name: "None",
 		Database: func(t *testing.T) database.Store {
-			return dbfake.New()
+			return dbmem.New()
 		},
 		Count: 0,
 	}, {
 		Name: "One",
 		Database: func(t *testing.T) database.Store {
-			db := dbfake.New()
+			db := dbmem.New()
 			dbgen.APIKey(t, db, database.APIKey{
-				LastUsed: database.Now(),
+				LastUsed: dbtime.Now(),
 			})
 			return db
 		},
@@ -60,16 +64,16 @@ func TestActiveUsers(t *testing.T) {
 	}, {
 		Name: "OneWithExpired",
 		Database: func(t *testing.T) database.Store {
-			db := dbfake.New()
+			db := dbmem.New()
 
 			dbgen.APIKey(t, db, database.APIKey{
-				LastUsed: database.Now(),
+				LastUsed: dbtime.Now(),
 			})
 
 			// Because this API key hasn't been used in the past hour, this shouldn't
 			// add to the user count.
 			dbgen.APIKey(t, db, database.APIKey{
-				LastUsed: database.Now().Add(-2 * time.Hour),
+				LastUsed: dbtime.Now().Add(-2 * time.Hour),
 			})
 			return db
 		},
@@ -77,12 +81,12 @@ func TestActiveUsers(t *testing.T) {
 	}, {
 		Name: "Multiple",
 		Database: func(t *testing.T) database.Store {
-			db := dbfake.New()
+			db := dbmem.New()
 			dbgen.APIKey(t, db, database.APIKey{
-				LastUsed: database.Now(),
+				LastUsed: dbtime.Now(),
 			})
 			dbgen.APIKey(t, db, database.APIKey{
-				LastUsed: database.Now(),
+				LastUsed: dbtime.Now(),
 			})
 			return db
 		},
@@ -112,8 +116,8 @@ func TestWorkspaces(t *testing.T) {
 	insertRunning := func(db database.Store) database.ProvisionerJob {
 		job, err := db.InsertProvisionerJob(context.Background(), database.InsertProvisionerJobParams{
 			ID:            uuid.New(),
-			CreatedAt:     database.Now(),
-			UpdatedAt:     database.Now(),
+			CreatedAt:     dbtime.Now(),
+			UpdatedAt:     dbtime.Now(),
 			Provisioner:   database.ProvisionerTypeEcho,
 			StorageMethod: database.ProvisionerStorageMethodFile,
 			Type:          database.ProvisionerJobTypeWorkspaceBuild,
@@ -131,7 +135,7 @@ func TestWorkspaces(t *testing.T) {
 		// This marks the job as started.
 		_, err = db.AcquireProvisionerJob(context.Background(), database.AcquireProvisionerJobParams{
 			StartedAt: sql.NullTime{
-				Time:  database.Now(),
+				Time:  dbtime.Now(),
 				Valid: true,
 			},
 			Types: []database.ProvisionerType{database.ProvisionerTypeEcho},
@@ -145,7 +149,7 @@ func TestWorkspaces(t *testing.T) {
 		err := db.UpdateProvisionerJobWithCancelByID(context.Background(), database.UpdateProvisionerJobWithCancelByIDParams{
 			ID: job.ID,
 			CanceledAt: sql.NullTime{
-				Time:  database.Now(),
+				Time:  dbtime.Now(),
 				Valid: true,
 			},
 		})
@@ -153,7 +157,7 @@ func TestWorkspaces(t *testing.T) {
 		err = db.UpdateProvisionerJobWithCompleteByID(context.Background(), database.UpdateProvisionerJobWithCompleteByIDParams{
 			ID: job.ID,
 			CompletedAt: sql.NullTime{
-				Time:  database.Now(),
+				Time:  dbtime.Now(),
 				Valid: true,
 			},
 		})
@@ -165,7 +169,7 @@ func TestWorkspaces(t *testing.T) {
 		err := db.UpdateProvisionerJobWithCompleteByID(context.Background(), database.UpdateProvisionerJobWithCompleteByIDParams{
 			ID: job.ID,
 			CompletedAt: sql.NullTime{
-				Time:  database.Now(),
+				Time:  dbtime.Now(),
 				Valid: true,
 			},
 			Error: sql.NullString{
@@ -181,7 +185,7 @@ func TestWorkspaces(t *testing.T) {
 		err := db.UpdateProvisionerJobWithCompleteByID(context.Background(), database.UpdateProvisionerJobWithCompleteByIDParams{
 			ID: job.ID,
 			CompletedAt: sql.NullTime{
-				Time:  database.Now(),
+				Time:  dbtime.Now(),
 				Valid: true,
 			},
 		})
@@ -196,13 +200,13 @@ func TestWorkspaces(t *testing.T) {
 	}{{
 		Name: "None",
 		Database: func() database.Store {
-			return dbfake.New()
+			return dbmem.New()
 		},
 		Total: 0,
 	}, {
 		Name: "Multiple",
 		Database: func() database.Store {
-			db := dbfake.New()
+			db := dbmem.New()
 			insertCanceled(db)
 			insertFailed(db)
 			insertFailed(db)
@@ -265,10 +269,10 @@ func TestAgents(t *testing.T) {
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:         echo.ParseComplete,
-		ProvisionPlan: echo.ProvisionComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionPlan: echo.PlanComplete,
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "example",
 						Type: "aws_instance",
@@ -295,9 +299,9 @@ func TestAgents(t *testing.T) {
 		}},
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	// given
 	derpMap, _ := tailnettest.RunDERPAndSTUN(t)
@@ -372,9 +376,31 @@ func TestAgents(t *testing.T) {
 func TestAgentStats(t *testing.T) {
 	t.Parallel()
 
+	ctx, cancelFunc := context.WithCancel(context.Background())
+	t.Cleanup(cancelFunc)
+
+	db, pubsub := dbtestutil.NewDB(t)
+	log := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+
+	batcher, closeBatcher, err := batchstats.New(ctx,
+		// We had previously set the batch size to 1 here, but that caused
+		// intermittent test flakes due to a race between the batcher completing
+		// its flush and the test asserting that the metrics were collected.
+		// Instead, we close the batcher after all stats have been posted, which
+		// forces a flush.
+		batchstats.WithStore(db),
+		batchstats.WithLogger(log),
+	)
+	require.NoError(t, err, "create stats batcher failed")
+	t.Cleanup(closeBatcher)
+
 	// Build sample workspaces with test agents and fake agent client
-	client, _, api := coderdtest.NewWithAPI(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-	db := api.Database
+	client, _, _ := coderdtest.NewWithAPI(t, &coderdtest.Options{
+		Database:                 db,
+		IncludeProvisionerDaemon: true,
+		Pubsub:                   pubsub,
+		StatsBatcher:             batcher,
+	})
 
 	user := coderdtest.CreateFirstUser(t, client)
 
@@ -384,11 +410,7 @@ func TestAgentStats(t *testing.T) {
 
 	registry := prometheus.NewRegistry()
 
-	ctx, cancelFunc := context.WithCancel(context.Background())
-	defer cancelFunc()
-
 	// given
-	var err error
 	var i int64
 	for i = 0; i < 3; i++ {
 		_, err = agent1.PostStats(ctx, &agentsdk.Stats{
@@ -416,6 +438,11 @@ func TestAgentStats(t *testing.T) {
 		require.NoError(t, err)
 	}
 
+	// Ensure that all stats are flushed to the database
+	// before we query them. We do not expect any more stats
+	// to be posted after this.
+	closeBatcher()
+
 	// when
 	//
 	// Set initialCreateAfter to some time in the past, so that AgentStats would include all above PostStats,
@@ -475,15 +502,15 @@ func prepareWorkspaceAndAgent(t *testing.T, client *codersdk.Client, user coders
 
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:          echo.ParseComplete,
-		ProvisionPlan:  echo.ProvisionComplete,
+		ProvisionPlan:  echo.PlanComplete,
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 		cwr.Name = fmt.Sprintf("workspace-%d", workspaceNum)
 	})
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	agentClient := agentsdk.New(client.URL)
 	agentClient.SetSessionToken(authToken)
diff --git a/coderd/provisionerdserver/acquirer.go b/coderd/provisionerdserver/acquirer.go
new file mode 100644
index 0000000000000..c9a43d660b671
--- /dev/null
+++ b/coderd/provisionerdserver/acquirer.go
@@ -0,0 +1,484 @@
+package provisionerdserver
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"github.com/google/uuid"
+	"golang.org/x/exp/slices"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/provisionerjobs"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+)
+
+const (
+	dbMaxBackoff = 10 * time.Second
+	// backPollDuration is the period for the backup polling described in Acquirer comment
+	backupPollDuration = 30 * time.Second
+)
+
+// Acquirer is shared among multiple routines that need to call
+// database.Store.AcquireProvisionerJob. The callers that acquire jobs are called "acquirees".  The
+// goal is to minimize polling the database (i.e. lower our average query rate) and simplify the
+// acquiree's logic by handling retrying the database if a job is not available at the time of the
+// call.
+//
+// When multiple acquirees share a set of provisioner types and tags, we define them as part of the
+// same "domain".  Only one acquiree from each domain may query the database at a time.  If the
+// database returns no jobs for that acquiree, the entire domain waits until the Acquirer is
+// notified over the pubsub of a new job acceptable to the domain.
+//
+// As a backup to pubsub notifications, each domain is allowed to query periodically once every 30s.
+// This ensures jobs are not stuck permanently if the service that created them fails to publish
+// (e.g. a crash).
+type Acquirer struct {
+	ctx    context.Context
+	logger slog.Logger
+	store  AcquirerStore
+	ps     pubsub.Pubsub
+
+	mu sync.Mutex
+	q  map[dKey]domain
+
+	// testing only
+	backupPollDuration time.Duration
+}
+
+type AcquirerOption func(*Acquirer)
+
+func TestingBackupPollDuration(dur time.Duration) AcquirerOption {
+	return func(a *Acquirer) {
+		a.backupPollDuration = dur
+	}
+}
+
+// AcquirerStore is the subset of database.Store that the Acquirer needs
+type AcquirerStore interface {
+	AcquireProvisionerJob(context.Context, database.AcquireProvisionerJobParams) (database.ProvisionerJob, error)
+}
+
+func NewAcquirer(ctx context.Context, logger slog.Logger, store AcquirerStore, ps pubsub.Pubsub,
+	opts ...AcquirerOption,
+) *Acquirer {
+	a := &Acquirer{
+		ctx:                ctx,
+		logger:             logger,
+		store:              store,
+		ps:                 ps,
+		q:                  make(map[dKey]domain),
+		backupPollDuration: backupPollDuration,
+	}
+	for _, opt := range opts {
+		opt(a)
+	}
+	a.subscribe()
+	return a
+}
+
+// AcquireJob acquires a job with one of the given provisioner types and compatible
+// tags from the database.  The call blocks until a job is acquired, the context is
+// done, or the database returns an error _other_ than that no jobs are available.
+// If no jobs are available, this method handles retrying as appropriate.
+func (a *Acquirer) AcquireJob(
+	ctx context.Context, worker uuid.UUID, pt []database.ProvisionerType, tags Tags,
+) (
+	retJob database.ProvisionerJob, retErr error,
+) {
+	logger := a.logger.With(
+		slog.F("worker_id", worker),
+		slog.F("provisioner_types", pt),
+		slog.F("tags", tags))
+	logger.Debug(ctx, "acquiring job")
+	dk := domainKey(pt, tags)
+	dbTags, err := tags.ToJSON()
+	if err != nil {
+		return database.ProvisionerJob{}, err
+	}
+	// buffer of 1 so that cancel doesn't deadlock while writing to the channel
+	clearance := make(chan struct{}, 1)
+	for {
+		a.want(pt, tags, clearance)
+		select {
+		case <-ctx.Done():
+			err := ctx.Err()
+			logger.Debug(ctx, "acquiring job canceled", slog.Error(err))
+			internalError := a.cancel(dk, clearance)
+			if internalError != nil {
+				// internalError takes precedence
+				return database.ProvisionerJob{}, internalError
+			}
+			return database.ProvisionerJob{}, err
+		case <-clearance:
+			logger.Debug(ctx, "got clearance to call database")
+			job, err := a.store.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+				StartedAt: sql.NullTime{
+					Time:  dbtime.Now(),
+					Valid: true,
+				},
+				WorkerID: uuid.NullUUID{
+					UUID:  worker,
+					Valid: true,
+				},
+				Types: pt,
+				Tags:  dbTags,
+			})
+			if xerrors.Is(err, sql.ErrNoRows) {
+				logger.Debug(ctx, "no job available")
+				continue
+			}
+			// we are not going to retry, so signal we are done
+			internalError := a.done(dk, clearance)
+			if internalError != nil {
+				// internal error takes precedence
+				return database.ProvisionerJob{}, internalError
+			}
+			if err != nil {
+				logger.Warn(ctx, "error attempting to acquire job", slog.Error(err))
+				return database.ProvisionerJob{}, xerrors.Errorf("failed to acquire job: %w", err)
+			}
+			logger.Debug(ctx, "successfully acquired job")
+			return job, nil
+		}
+	}
+}
+
+// want signals that an acquiree wants clearance to query for a job with the given dKey.
+func (a *Acquirer) want(pt []database.ProvisionerType, tags Tags, clearance chan<- struct{}) {
+	dk := domainKey(pt, tags)
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	cleared := false
+	d, ok := a.q[dk]
+	if !ok {
+		ctx, cancel := context.WithCancel(a.ctx)
+		d = domain{
+			ctx:       ctx,
+			cancel:    cancel,
+			a:         a,
+			key:       dk,
+			pt:        pt,
+			tags:      tags,
+			acquirees: make(map[chan<- struct{}]*acquiree),
+		}
+		a.q[dk] = d
+		go d.poll(a.backupPollDuration)
+		// this is a new request for this dKey, so is cleared.
+		cleared = true
+	}
+	w, ok := d.acquirees[clearance]
+	if !ok {
+		w = &acquiree{clearance: clearance}
+		d.acquirees[clearance] = w
+	}
+	// pending means that we got a job posting for this dKey while we were
+	// querying, so we should clear this acquiree to retry another time.
+	if w.pending {
+		cleared = true
+		w.pending = false
+	}
+	w.inProgress = cleared
+	if cleared {
+		// this won't block because clearance is buffered.
+		clearance <- struct{}{}
+	}
+}
+
+// cancel signals that an acquiree no longer wants clearance to query.  Any error returned is a serious internal error
+// indicating that integrity of the internal state is corrupted by a code bug.
+func (a *Acquirer) cancel(dk dKey, clearance chan<- struct{}) error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	d, ok := a.q[dk]
+	if !ok {
+		// this is a code error, as something removed the domain early, or cancel
+		// was called twice.
+		err := xerrors.New("cancel for domain that doesn't exist")
+		a.logger.Critical(a.ctx, "internal error", slog.Error(err))
+		return err
+	}
+	w, ok := d.acquirees[clearance]
+	if !ok {
+		// this is a code error, as something removed the acquiree early, or cancel
+		// was called twice.
+		err := xerrors.New("cancel for an acquiree that doesn't exist")
+		a.logger.Critical(a.ctx, "internal error", slog.Error(err))
+		return err
+	}
+	delete(d.acquirees, clearance)
+	if w.inProgress && len(d.acquirees) > 0 {
+		// this one canceled before querying, so give another acquiree a chance
+		// instead
+		for _, other := range d.acquirees {
+			if other.inProgress {
+				err := xerrors.New("more than one acquiree in progress for same key")
+				a.logger.Critical(a.ctx, "internal error", slog.Error(err))
+				return err
+			}
+			other.inProgress = true
+			other.clearance <- struct{}{}
+			break // just one
+		}
+	}
+	if len(d.acquirees) == 0 {
+		d.cancel()
+		delete(a.q, dk)
+	}
+	return nil
+}
+
+// done signals that the acquiree has completed acquiring a job (usually successfully, but we also get this call if
+// there is a database error other than ErrNoRows).  Any error returned is a serious internal error indicating that
+// integrity of the internal state is corrupted by a code bug.
+func (a *Acquirer) done(dk dKey, clearance chan struct{}) error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	d, ok := a.q[dk]
+	if !ok {
+		// this is a code error, as something removed the domain early, or done
+		// was called twice.
+		err := xerrors.New("done for a domain that doesn't exist")
+		a.logger.Critical(a.ctx, "internal error", slog.Error(err))
+		return err
+	}
+	w, ok := d.acquirees[clearance]
+	if !ok {
+		// this is a code error, as something removed the dKey early, or done
+		// was called twice.
+		err := xerrors.New("done for an acquiree that doesn't exist")
+		a.logger.Critical(a.ctx, "internal error", slog.Error(err))
+		return err
+	}
+	if !w.inProgress {
+		err := xerrors.New("done acquiree was not in progress")
+		a.logger.Critical(a.ctx, "internal error", slog.Error(err))
+		return err
+	}
+	delete(d.acquirees, clearance)
+	if len(d.acquirees) == 0 {
+		d.cancel()
+		delete(a.q, dk)
+		return nil
+	}
+	// in the mainline, this means that the acquiree successfully got a job.
+	// if any others are waiting, clear one of them to try to get a job next so
+	// that we process the jobs until there are no more acquirees or the database
+	// is empty of jobs meeting our criteria
+	for _, other := range d.acquirees {
+		if other.inProgress {
+			err := xerrors.New("more than one acquiree in progress for same key")
+			a.logger.Critical(a.ctx, "internal error", slog.Error(err))
+			return err
+		}
+		other.inProgress = true
+		other.clearance <- struct{}{}
+		break // just one
+	}
+	return nil
+}
+
+func (a *Acquirer) subscribe() {
+	subscribed := make(chan struct{})
+	go func() {
+		defer close(subscribed)
+		eb := backoff.NewExponentialBackOff()
+		eb.MaxElapsedTime = 0 // retry indefinitely
+		eb.MaxInterval = dbMaxBackoff
+		bkoff := backoff.WithContext(eb, a.ctx)
+		var cancel context.CancelFunc
+		err := backoff.Retry(func() error {
+			cancelFn, err := a.ps.SubscribeWithErr(provisionerjobs.EventJobPosted, a.jobPosted)
+			if err != nil {
+				a.logger.Warn(a.ctx, "failed to subscribe to job postings", slog.Error(err))
+				return err
+			}
+			cancel = cancelFn
+			return nil
+		}, bkoff)
+		if err != nil {
+			if a.ctx.Err() == nil {
+				a.logger.Error(a.ctx, "code bug: retry failed before context canceled", slog.Error(err))
+			}
+			return
+		}
+		defer cancel()
+		bkoff.Reset()
+		a.logger.Debug(a.ctx, "subscribed to job postings")
+
+		// unblock the outer function from returning
+		subscribed <- struct{}{}
+
+		// hold subscriptions open until context is canceled
+		<-a.ctx.Done()
+	}()
+	<-subscribed
+}
+
+func (a *Acquirer) jobPosted(ctx context.Context, message []byte, err error) {
+	if xerrors.Is(err, pubsub.ErrDroppedMessages) {
+		a.logger.Warn(a.ctx, "pubsub may have dropped job postings")
+		a.clearOrPendAll()
+		return
+	}
+	if err != nil {
+		a.logger.Warn(a.ctx, "unhandled pubsub error", slog.Error(err))
+		return
+	}
+	posting := provisionerjobs.JobPosting{}
+	err = json.Unmarshal(message, &posting)
+	if err != nil {
+		a.logger.Error(a.ctx, "unable to parse job posting",
+			slog.F("message", string(message)),
+			slog.Error(err),
+		)
+		return
+	}
+	a.logger.Debug(ctx, "got job posting", slog.F("posting", posting))
+
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	for _, d := range a.q {
+		if d.contains(posting) {
+			a.clearOrPendLocked(d)
+			// we only need to wake up a single domain since there is only one
+			// new job available
+			return
+		}
+	}
+}
+
+func (a *Acquirer) clearOrPendAll() {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	for _, d := range a.q {
+		a.clearOrPendLocked(d)
+	}
+}
+
+func (a *Acquirer) clearOrPend(d domain) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if len(d.acquirees) == 0 {
+		// this can happen if the domain is removed right around the time the
+		// backup poll (which calls this function) triggers.  Nothing to do
+		// since there are no acquirees.
+		return
+	}
+	a.clearOrPendLocked(d)
+}
+
+func (*Acquirer) clearOrPendLocked(d domain) {
+	// MUST BE CALLED HOLDING THE a.mu LOCK
+	var nominee *acquiree
+	for _, w := range d.acquirees {
+		if nominee == nil {
+			nominee = w
+		}
+		// acquiree in progress always takes precedence, since we don't want to
+		// wake up more than one acquiree per dKey at a time.
+		if w.inProgress {
+			nominee = w
+			break
+		}
+	}
+	if nominee.inProgress {
+		nominee.pending = true
+		return
+	}
+	nominee.inProgress = true
+	nominee.clearance <- struct{}{}
+}
+
+type dKey string
+
+// domainKey generates a canonical map key for the given provisioner types and
+// tags.  It uses the null byte (0x00) as a delimiter because it is an
+// unprintable control character and won't show up in any "reasonable" set of
+// string tags, even in non-Latin scripts.  It is important that Tags are
+// validated not to contain this control character prior to use.
+func domainKey(pt []database.ProvisionerType, tags Tags) dKey {
+	// make a copy of pt before sorting, so that we don't mutate the original
+	// slice or underlying array.
+	pts := make([]database.ProvisionerType, len(pt))
+	copy(pts, pt)
+	slices.Sort(pts)
+	sb := strings.Builder{}
+	for _, t := range pts {
+		_, _ = sb.WriteString(string(t))
+		_ = sb.WriteByte(0x00)
+	}
+	_ = sb.WriteByte(0x00)
+	var keys []string
+	for k := range tags {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+	for _, k := range keys {
+		_, _ = sb.WriteString(k)
+		_ = sb.WriteByte(0x00)
+		_, _ = sb.WriteString(tags[k])
+		_ = sb.WriteByte(0x00)
+	}
+	return dKey(sb.String())
+}
+
+// acquiree represents a specific client of Acquirer that wants to acquire a job
+type acquiree struct {
+	clearance chan<- struct{}
+	// inProgress is true when the acquiree was granted clearance and a query
+	// is possibly in progress.
+	inProgress bool
+	// pending is true if we get a job posting while a query is in progress, so
+	// that we know to try again, even if we didn't get a job on the query.
+	pending bool
+}
+
+// domain represents a set of acquirees with the same provisioner types and
+// tags.  Acquirees in the same domain are restricted such that only one queries
+// the database at a time.
+type domain struct {
+	ctx       context.Context
+	cancel    context.CancelFunc
+	a         *Acquirer
+	key       dKey
+	pt        []database.ProvisionerType
+	tags      Tags
+	acquirees map[chan<- struct{}]*acquiree
+}
+
+func (d domain) contains(p provisionerjobs.JobPosting) bool {
+	if !slices.Contains(d.pt, p.ProvisionerType) {
+		return false
+	}
+	for k, v := range p.Tags {
+		dv, ok := d.tags[k]
+		if !ok {
+			return false
+		}
+		if v != dv {
+			return false
+		}
+	}
+	return true
+}
+
+func (d domain) poll(dur time.Duration) {
+	tkr := time.NewTicker(dur)
+	defer tkr.Stop()
+	for {
+		select {
+		case <-d.ctx.Done():
+			return
+		case <-tkr.C:
+			d.a.clearOrPend(d)
+		}
+	}
+}
diff --git a/coderd/provisionerdserver/acquirer_test.go b/coderd/provisionerdserver/acquirer_test.go
new file mode 100644
index 0000000000000..bed8eccb68aca
--- /dev/null
+++ b/coderd/provisionerdserver/acquirer_test.go
@@ -0,0 +1,513 @@
+package provisionerdserver_test
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/goleak"
+	"golang.org/x/exp/slices"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/provisionerjobs"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/provisionerdserver"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestMain(m *testing.M) {
+	goleak.VerifyTestMain(m)
+}
+
+// TestAcquirer_Store tests that a database.Store is accepted as a provisionerdserver.AcquirerStore
+func TestAcquirer_Store(t *testing.T) {
+	t.Parallel()
+	db := dbmem.New()
+	ps := pubsub.NewInMemory()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+	_ = provisionerdserver.NewAcquirer(ctx, logger.Named("acquirer"), db, ps)
+}
+
+func TestAcquirer_Single(t *testing.T) {
+	t.Parallel()
+	fs := newFakeOrderedStore()
+	ps := pubsub.NewInMemory()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+	uut := provisionerdserver.NewAcquirer(ctx, logger.Named("acquirer"), fs, ps)
+
+	workerID := uuid.New()
+	pt := []database.ProvisionerType{database.ProvisionerTypeEcho}
+	tags := provisionerdserver.Tags{
+		"foo": "bar",
+	}
+	acquiree := newTestAcquiree(t, workerID, pt, tags)
+	jobID := uuid.New()
+	err := fs.sendCtx(ctx, database.ProvisionerJob{ID: jobID}, nil)
+	require.NoError(t, err)
+	acquiree.startAcquire(ctx, uut)
+	job := acquiree.success(ctx)
+	require.Equal(t, jobID, job.ID)
+	require.Len(t, fs.params, 1)
+	require.Equal(t, workerID, fs.params[0].WorkerID.UUID)
+}
+
+// TestAcquirer_MultipleSameDomain tests multiple acquirees with the same provisioners and tags
+func TestAcquirer_MultipleSameDomain(t *testing.T) {
+	t.Parallel()
+	fs := newFakeOrderedStore()
+	ps := pubsub.NewInMemory()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+	uut := provisionerdserver.NewAcquirer(ctx, logger.Named("acquirer"), fs, ps)
+
+	acquirees := make([]*testAcquiree, 0, 10)
+	jobIDs := make(map[uuid.UUID]bool)
+	workerIDs := make(map[uuid.UUID]bool)
+	pt := []database.ProvisionerType{database.ProvisionerTypeEcho}
+	tags := provisionerdserver.Tags{
+		"foo": "bar",
+	}
+	for i := 0; i < 10; i++ {
+		wID := uuid.New()
+		workerIDs[wID] = true
+		a := newTestAcquiree(t, wID, pt, tags)
+		acquirees = append(acquirees, a)
+		a.startAcquire(ctx, uut)
+	}
+	for i := 0; i < 10; i++ {
+		jobID := uuid.New()
+		jobIDs[jobID] = true
+		err := fs.sendCtx(ctx, database.ProvisionerJob{ID: jobID}, nil)
+		require.NoError(t, err)
+	}
+	gotJobIDs := make(map[uuid.UUID]bool)
+	for i := 0; i < 10; i++ {
+		j := acquirees[i].success(ctx)
+		gotJobIDs[j.ID] = true
+	}
+	require.Equal(t, jobIDs, gotJobIDs)
+	require.Len(t, fs.overlaps, 0)
+	gotWorkerCalls := make(map[uuid.UUID]bool)
+	for _, params := range fs.params {
+		gotWorkerCalls[params.WorkerID.UUID] = true
+	}
+	require.Equal(t, workerIDs, gotWorkerCalls)
+}
+
+// TestAcquirer_WaitsOnNoJobs tests that after a call that returns no jobs, Acquirer waits for a new
+// job posting before retrying
+func TestAcquirer_WaitsOnNoJobs(t *testing.T) {
+	t.Parallel()
+	fs := newFakeOrderedStore()
+	ps := pubsub.NewInMemory()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+	uut := provisionerdserver.NewAcquirer(ctx, logger.Named("acquirer"), fs, ps)
+
+	workerID := uuid.New()
+	pt := []database.ProvisionerType{database.ProvisionerTypeEcho}
+	tags := provisionerdserver.Tags{
+		"foo": "bar",
+	}
+	acquiree := newTestAcquiree(t, workerID, pt, tags)
+	jobID := uuid.New()
+	err := fs.sendCtx(ctx, database.ProvisionerJob{}, sql.ErrNoRows)
+	require.NoError(t, err)
+	err = fs.sendCtx(ctx, database.ProvisionerJob{ID: jobID}, nil)
+	require.NoError(t, err)
+	acquiree.startAcquire(ctx, uut)
+	require.Eventually(t, func() bool {
+		fs.mu.Lock()
+		defer fs.mu.Unlock()
+		return len(fs.params) == 1
+	}, testutil.WaitShort, testutil.IntervalFast)
+	acquiree.requireBlocked()
+
+	// First send in some with incompatible tags & types
+	postJob(t, ps, database.ProvisionerTypeEcho, provisionerdserver.Tags{
+		"cool":   "tapes",
+		"strong": "bad",
+	})
+	postJob(t, ps, database.ProvisionerTypeEcho, provisionerdserver.Tags{
+		"foo": "fighters",
+	})
+	postJob(t, ps, database.ProvisionerTypeTerraform, provisionerdserver.Tags{
+		"foo": "bar",
+	})
+	acquiree.requireBlocked()
+
+	// compatible tags
+	postJob(t, ps, database.ProvisionerTypeEcho, provisionerdserver.Tags{})
+	job := acquiree.success(ctx)
+	require.Equal(t, jobID, job.ID)
+}
+
+// TestAcquirer_RetriesPending tests that if we get a job posting while a db call is in progress
+// we retry to acquire a job immediately, even if the first call returned no jobs.  We want this
+// behavior since the query that found no jobs could have resolved before the job was posted, but
+// the query result could reach us later than the posting over the pubsub.
+func TestAcquirer_RetriesPending(t *testing.T) {
+	t.Parallel()
+	fs := newFakeOrderedStore()
+	ps := pubsub.NewInMemory()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+	uut := provisionerdserver.NewAcquirer(ctx, logger.Named("acquirer"), fs, ps)
+
+	workerID := uuid.New()
+	pt := []database.ProvisionerType{database.ProvisionerTypeEcho}
+	tags := provisionerdserver.Tags{
+		"foo": "bar",
+	}
+	acquiree := newTestAcquiree(t, workerID, pt, tags)
+	jobID := uuid.New()
+
+	acquiree.startAcquire(ctx, uut)
+	require.Eventually(t, func() bool {
+		fs.mu.Lock()
+		defer fs.mu.Unlock()
+		return len(fs.params) == 1
+	}, testutil.WaitShort, testutil.IntervalFast)
+
+	// First call to DB is in progress.  Send in posting
+	postJob(t, ps, database.ProvisionerTypeEcho, provisionerdserver.Tags{})
+	// there is a race between the posting being processed and the DB call
+	// returning.  In either case we should retry, but we're trying to hit the
+	// case where the posting is processed first, so sleep a little bit to give
+	// it a chance.
+	time.Sleep(testutil.IntervalMedium)
+
+	// Now, when first DB call returns ErrNoRows we retry.
+	err := fs.sendCtx(ctx, database.ProvisionerJob{}, sql.ErrNoRows)
+	require.NoError(t, err)
+	err = fs.sendCtx(ctx, database.ProvisionerJob{ID: jobID}, nil)
+	require.NoError(t, err)
+
+	job := acquiree.success(ctx)
+	require.Equal(t, jobID, job.ID)
+}
+
+// TestAcquirer_DifferentDomains tests that acquirees with different tags don't block each other
+func TestAcquirer_DifferentDomains(t *testing.T) {
+	t.Parallel()
+	fs := newFakeTaggedStore(t)
+	ps := pubsub.NewInMemory()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+
+	pt := []database.ProvisionerType{database.ProvisionerTypeEcho}
+	worker0 := uuid.New()
+	tags0 := provisionerdserver.Tags{
+		"worker": "0",
+	}
+	acquiree0 := newTestAcquiree(t, worker0, pt, tags0)
+	worker1 := uuid.New()
+	tags1 := provisionerdserver.Tags{
+		"worker": "1",
+	}
+	acquiree1 := newTestAcquiree(t, worker1, pt, tags1)
+	jobID := uuid.New()
+	fs.jobs = []database.ProvisionerJob{
+		{ID: jobID, Provisioner: database.ProvisionerTypeEcho, Tags: database.StringMap{"worker": "1"}},
+	}
+
+	uut := provisionerdserver.NewAcquirer(ctx, logger.Named("acquirer"), fs, ps)
+
+	ctx0, cancel0 := context.WithCancel(ctx)
+	defer cancel0()
+	acquiree0.startAcquire(ctx0, uut)
+	select {
+	case params := <-fs.params:
+		require.Equal(t, worker0, params.WorkerID.UUID)
+	case <-ctx.Done():
+		t.Fatal("timed out waiting for call to database from worker0")
+	}
+	acquiree0.requireBlocked()
+
+	// worker1 should not be blocked by worker0, as they are different tags
+	acquiree1.startAcquire(ctx, uut)
+	job := acquiree1.success(ctx)
+	require.Equal(t, jobID, job.ID)
+
+	cancel0()
+	acquiree0.requireCanceled(ctx)
+}
+
+func TestAcquirer_BackupPoll(t *testing.T) {
+	t.Parallel()
+	fs := newFakeOrderedStore()
+	ps := pubsub.NewInMemory()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+	uut := provisionerdserver.NewAcquirer(
+		ctx, logger.Named("acquirer"), fs, ps,
+		provisionerdserver.TestingBackupPollDuration(testutil.IntervalMedium),
+	)
+
+	workerID := uuid.New()
+	pt := []database.ProvisionerType{database.ProvisionerTypeEcho}
+	tags := provisionerdserver.Tags{
+		"foo": "bar",
+	}
+	acquiree := newTestAcquiree(t, workerID, pt, tags)
+	jobID := uuid.New()
+	err := fs.sendCtx(ctx, database.ProvisionerJob{}, sql.ErrNoRows)
+	require.NoError(t, err)
+	err = fs.sendCtx(ctx, database.ProvisionerJob{ID: jobID}, nil)
+	require.NoError(t, err)
+	acquiree.startAcquire(ctx, uut)
+	job := acquiree.success(ctx)
+	require.Equal(t, jobID, job.ID)
+}
+
+// TestAcquirer_UnblockOnCancel tests that a canceled call doesn't block a call
+// from the same domain.
+func TestAcquirer_UnblockOnCancel(t *testing.T) {
+	t.Parallel()
+	fs := newFakeOrderedStore()
+	ps := pubsub.NewInMemory()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+
+	pt := []database.ProvisionerType{database.ProvisionerTypeEcho}
+	worker0 := uuid.New()
+	tags := provisionerdserver.Tags{
+		"foo": "bar",
+	}
+	acquiree0 := newTestAcquiree(t, worker0, pt, tags)
+	worker1 := uuid.New()
+	acquiree1 := newTestAcquiree(t, worker1, pt, tags)
+	jobID := uuid.New()
+
+	uut := provisionerdserver.NewAcquirer(ctx, logger.Named("acquirer"), fs, ps)
+
+	// queue up 2 responses --- we may not need both, since acquiree0 will
+	// usually cancel before calling, but cancel is async, so it might call.
+	for i := 0; i < 2; i++ {
+		err := fs.sendCtx(ctx, database.ProvisionerJob{ID: jobID}, nil)
+		require.NoError(t, err)
+	}
+
+	ctx0, cancel0 := context.WithCancel(ctx)
+	cancel0()
+	acquiree0.startAcquire(ctx0, uut)
+	acquiree1.startAcquire(ctx, uut)
+	job := acquiree1.success(ctx)
+	require.Equal(t, jobID, job.ID)
+}
+
+func postJob(t *testing.T, ps pubsub.Pubsub, pt database.ProvisionerType, tags provisionerdserver.Tags) {
+	t.Helper()
+	msg, err := json.Marshal(provisionerjobs.JobPosting{
+		ProvisionerType: pt,
+		Tags:            tags,
+	})
+	require.NoError(t, err)
+	err = ps.Publish(provisionerjobs.EventJobPosted, msg)
+	require.NoError(t, err)
+}
+
+// fakeOrderedStore is a fake store that lets tests send AcquireProvisionerJob
+// results in order over a channel, and tests for overlapped calls.
+type fakeOrderedStore struct {
+	jobs   chan database.ProvisionerJob
+	errors chan error
+
+	mu     sync.Mutex
+	params []database.AcquireProvisionerJobParams
+
+	// inflight and overlaps track whether any calls from workers overlap with
+	// one another
+	inflight map[uuid.UUID]bool
+	overlaps [][]uuid.UUID
+}
+
+func newFakeOrderedStore() *fakeOrderedStore {
+	return &fakeOrderedStore{
+		// buffer the channels so that we can queue up lots of responses to
+		// occur nearly simultaneously
+		jobs:     make(chan database.ProvisionerJob, 100),
+		errors:   make(chan error, 100),
+		inflight: make(map[uuid.UUID]bool),
+	}
+}
+
+func (s *fakeOrderedStore) AcquireProvisionerJob(
+	_ context.Context, params database.AcquireProvisionerJobParams,
+) (
+	database.ProvisionerJob, error,
+) {
+	s.mu.Lock()
+	s.params = append(s.params, params)
+	for workerID := range s.inflight {
+		s.overlaps = append(s.overlaps, []uuid.UUID{workerID, params.WorkerID.UUID})
+	}
+	s.inflight[params.WorkerID.UUID] = true
+	s.mu.Unlock()
+
+	job := <-s.jobs
+	err := <-s.errors
+
+	s.mu.Lock()
+	delete(s.inflight, params.WorkerID.UUID)
+	s.mu.Unlock()
+
+	return job, err
+}
+
+func (s *fakeOrderedStore) sendCtx(ctx context.Context, job database.ProvisionerJob, err error) error {
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case s.jobs <- job:
+		// OK
+	}
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case s.errors <- err:
+		// OK
+	}
+	return nil
+}
+
+// fakeTaggedStore is a test store that allows tests to specify which jobs are
+// available, and returns them to callers with the appropriate provisioner type
+// and tags. It doesn't care about the order.
+type fakeTaggedStore struct {
+	t      *testing.T
+	mu     sync.Mutex
+	jobs   []database.ProvisionerJob
+	params chan database.AcquireProvisionerJobParams
+}
+
+func newFakeTaggedStore(t *testing.T) *fakeTaggedStore {
+	return &fakeTaggedStore{
+		t:      t,
+		params: make(chan database.AcquireProvisionerJobParams, 100),
+	}
+}
+
+func (s *fakeTaggedStore) AcquireProvisionerJob(
+	_ context.Context, params database.AcquireProvisionerJobParams,
+) (
+	database.ProvisionerJob, error,
+) {
+	defer func() { s.params <- params }()
+	var tags provisionerdserver.Tags
+	err := json.Unmarshal(params.Tags, &tags)
+	if !assert.NoError(s.t, err) {
+		return database.ProvisionerJob{}, err
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+jobLoop:
+	for i, job := range s.jobs {
+		if !slices.Contains(params.Types, job.Provisioner) {
+			continue
+		}
+		for k, v := range job.Tags {
+			pv, ok := tags[k]
+			if !ok {
+				continue jobLoop
+			}
+			if v != pv {
+				continue jobLoop
+			}
+		}
+		// found a job!
+		s.jobs = append(s.jobs[:i], s.jobs[i+1:]...)
+		return job, nil
+	}
+	return database.ProvisionerJob{}, sql.ErrNoRows
+}
+
+// testAcquiree is a helper type that handles asynchronously calling AcquireJob
+// and asserting whether or not it returns, blocks, or is canceled.
+type testAcquiree struct {
+	t        *testing.T
+	workerID uuid.UUID
+	pt       []database.ProvisionerType
+	tags     provisionerdserver.Tags
+	ec       chan error
+	jc       chan database.ProvisionerJob
+}
+
+func newTestAcquiree(t *testing.T, workerID uuid.UUID, pt []database.ProvisionerType, tags provisionerdserver.Tags) *testAcquiree {
+	return &testAcquiree{
+		t:        t,
+		workerID: workerID,
+		pt:       pt,
+		tags:     tags,
+		ec:       make(chan error, 1),
+		jc:       make(chan database.ProvisionerJob, 1),
+	}
+}
+
+func (a *testAcquiree) startAcquire(ctx context.Context, uut *provisionerdserver.Acquirer) {
+	go func() {
+		j, e := uut.AcquireJob(ctx, a.workerID, a.pt, a.tags)
+		a.ec <- e
+		a.jc <- j
+	}()
+}
+
+func (a *testAcquiree) success(ctx context.Context) database.ProvisionerJob {
+	select {
+	case <-ctx.Done():
+		a.t.Fatal("timeout waiting for AcquireJob error")
+	case err := <-a.ec:
+		require.NoError(a.t, err)
+	}
+	select {
+	case <-ctx.Done():
+		a.t.Fatal("timeout waiting for AcquireJob job")
+	case job := <-a.jc:
+		return job
+	}
+	// unhittable
+	return database.ProvisionerJob{}
+}
+
+func (a *testAcquiree) requireBlocked() {
+	select {
+	case <-a.ec:
+		a.t.Fatal("AcquireJob should block")
+	default:
+		// OK
+	}
+}
+
+func (a *testAcquiree) requireCanceled(ctx context.Context) {
+	select {
+	case err := <-a.ec:
+		require.ErrorIs(a.t, err, context.Canceled)
+	case <-ctx.Done():
+		a.t.Fatal("timed out waiting for AcquireJob")
+	}
+	select {
+	case job := <-a.jc:
+		require.Equal(a.t, uuid.Nil, job.ID)
+	case <-ctx.Done():
+		a.t.Fatal("timed out waiting for AcquireJob")
+	}
+}
diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
index ad0d5b6b4c86f..6465eab1d9fe9 100644
--- a/coderd/provisionerdserver/provisionerdserver.go
+++ b/coderd/provisionerdserver/provisionerdserver.go
@@ -11,7 +11,6 @@ import (
 	"reflect"
 	"strconv"
 	"strings"
-	"sync"
 	"sync/atomic"
 	"time"
 
@@ -26,37 +25,52 @@ import (
 	protobuf "google.golang.org/protobuf/proto"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/apikey"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner"
-	"github.com/coder/coder/provisionerd/proto"
-	"github.com/coder/coder/provisionersdk"
-	sdkproto "github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/coderd/apikey"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner"
+	"github.com/coder/coder/v2/provisionerd/proto"
+	"github.com/coder/coder/v2/provisionersdk"
+	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
 )
 
-var (
-	lastAcquire      time.Time
-	lastAcquireMutex sync.RWMutex
-)
+// DefaultAcquireJobLongPollDur is the time the (deprecated) AcquireJob rpc waits to try to obtain a job before
+// canceling and returning an empty job.
+const DefaultAcquireJobLongPollDur = time.Second * 5
+
+type Options struct {
+	OIDCConfig          httpmw.OAuth2Config
+	ExternalAuthConfigs []*externalauth.Config
+	// TimeNowFn is only used in tests
+	TimeNowFn func() time.Time
 
-type Server struct {
+	// AcquireJobLongPollDur is used in tests
+	AcquireJobLongPollDur time.Duration
+}
+
+type server struct {
+	// lifecycleCtx must be tied to the API server's lifecycle
+	// as when the API server shuts down, we want to cancel any
+	// long-running operations.
+	lifecycleCtx                context.Context
 	AccessURL                   *url.URL
 	ID                          uuid.UUID
 	Logger                      slog.Logger
 	Provisioners                []database.ProvisionerType
-	GitAuthConfigs              []*gitauth.Config
-	Tags                        json.RawMessage
+	ExternalAuthConfigs         []*externalauth.Config
+	Tags                        Tags
 	Database                    database.Store
 	Pubsub                      pubsub.Pubsub
+	Acquirer                    *Acquirer
 	Telemetry                   telemetry.Reporter
 	Tracer                      trace.Tracer
 	QuotaCommitter              *atomic.Pointer[proto.QuotaCommitter]
@@ -65,68 +79,240 @@ type Server struct {
 	UserQuietHoursScheduleStore *atomic.Pointer[schedule.UserQuietHoursScheduleStore]
 	DeploymentValues            *codersdk.DeploymentValues
 
-	AcquireJobDebounce time.Duration
-	OIDCConfig         httpmw.OAuth2Config
+	OIDCConfig httpmw.OAuth2Config
 
 	TimeNowFn func() time.Time
+
+	acquireJobLongPollDur time.Duration
+}
+
+// We use the null byte (0x00) in generating a canonical map key for tags, so
+// it cannot be used in the tag keys or values.
+
+var ErrorTagsContainNullByte = xerrors.New("tags cannot contain the null byte (0x00)")
+
+type Tags map[string]string
+
+func (t Tags) ToJSON() (json.RawMessage, error) {
+	r, err := json.Marshal(t)
+	if err != nil {
+		return nil, err
+	}
+	return r, err
+}
+
+func (t Tags) Valid() error {
+	for k, v := range t {
+		if slices.Contains([]byte(k), 0x00) || slices.Contains([]byte(v), 0x00) {
+			return ErrorTagsContainNullByte
+		}
+	}
+	return nil
+}
+
+func NewServer(
+	lifecycleCtx context.Context,
+	accessURL *url.URL,
+	id uuid.UUID,
+	logger slog.Logger,
+	provisioners []database.ProvisionerType,
+	tags Tags,
+	db database.Store,
+	ps pubsub.Pubsub,
+	acquirer *Acquirer,
+	tel telemetry.Reporter,
+	tracer trace.Tracer,
+	quotaCommitter *atomic.Pointer[proto.QuotaCommitter],
+	auditor *atomic.Pointer[audit.Auditor],
+	templateScheduleStore *atomic.Pointer[schedule.TemplateScheduleStore],
+	userQuietHoursScheduleStore *atomic.Pointer[schedule.UserQuietHoursScheduleStore],
+	deploymentValues *codersdk.DeploymentValues,
+	options Options,
+) (proto.DRPCProvisionerDaemonServer, error) {
+	// Fail-fast if pointers are nil
+	if lifecycleCtx == nil {
+		return nil, xerrors.New("ctx is nil")
+	}
+	if quotaCommitter == nil {
+		return nil, xerrors.New("quotaCommitter is nil")
+	}
+	if auditor == nil {
+		return nil, xerrors.New("auditor is nil")
+	}
+	if templateScheduleStore == nil {
+		return nil, xerrors.New("templateScheduleStore is nil")
+	}
+	if userQuietHoursScheduleStore == nil {
+		return nil, xerrors.New("userQuietHoursScheduleStore is nil")
+	}
+	if deploymentValues == nil {
+		return nil, xerrors.New("deploymentValues is nil")
+	}
+	if acquirer == nil {
+		return nil, xerrors.New("acquirer is nil")
+	}
+	if tags == nil {
+		return nil, xerrors.Errorf("tags is nil")
+	}
+	if err := tags.Valid(); err != nil {
+		return nil, xerrors.Errorf("invalid tags: %w", err)
+	}
+	if options.AcquireJobLongPollDur == 0 {
+		options.AcquireJobLongPollDur = DefaultAcquireJobLongPollDur
+	}
+	return &server{
+		lifecycleCtx:                lifecycleCtx,
+		AccessURL:                   accessURL,
+		ID:                          id,
+		Logger:                      logger,
+		Provisioners:                provisioners,
+		ExternalAuthConfigs:         options.ExternalAuthConfigs,
+		Tags:                        tags,
+		Database:                    db,
+		Pubsub:                      ps,
+		Acquirer:                    acquirer,
+		Telemetry:                   tel,
+		Tracer:                      tracer,
+		QuotaCommitter:              quotaCommitter,
+		Auditor:                     auditor,
+		TemplateScheduleStore:       templateScheduleStore,
+		UserQuietHoursScheduleStore: userQuietHoursScheduleStore,
+		DeploymentValues:            deploymentValues,
+		OIDCConfig:                  options.OIDCConfig,
+		TimeNowFn:                   options.TimeNowFn,
+		acquireJobLongPollDur:       options.AcquireJobLongPollDur,
+	}, nil
 }
 
 // timeNow should be used when trying to get the current time for math
 // calculations regarding workspace start and stop time.
-func (server *Server) timeNow() time.Time {
-	if server.TimeNowFn != nil {
-		return database.Time(server.TimeNowFn())
+func (s *server) timeNow() time.Time {
+	if s.TimeNowFn != nil {
+		return dbtime.Time(s.TimeNowFn())
 	}
-	return database.Now()
+	return dbtime.Now()
 }
 
 // AcquireJob queries the database to lock a job.
-func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
+//
+// Deprecated: This method is only available for back-level provisioner daemons.
+func (s *server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
 	//nolint:gocritic // Provisionerd has specific authz rules.
 	ctx = dbauthz.AsProvisionerd(ctx)
-	// This prevents loads of provisioner daemons from consistently
-	// querying the database when no jobs are available.
-	//
-	// The debounce only occurs when no job is returned, so if loads of
-	// jobs are added at once, they will start after at most this duration.
-	lastAcquireMutex.RLock()
-	if !lastAcquire.IsZero() && time.Since(lastAcquire) < server.AcquireJobDebounce {
-		lastAcquireMutex.RUnlock()
-		return &proto.AcquiredJob{}, nil
-	}
-	lastAcquireMutex.RUnlock()
-	// This marks the job as locked in the database.
-	job, err := server.Database.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
-		StartedAt: sql.NullTime{
-			Time:  database.Now(),
-			Valid: true,
-		},
-		WorkerID: uuid.NullUUID{
-			UUID:  server.ID,
-			Valid: true,
-		},
-		Types: server.Provisioners,
-		Tags:  server.Tags,
-	})
-	if errors.Is(err, sql.ErrNoRows) {
-		// The provisioner daemon assumes no jobs are available if
-		// an empty struct is returned.
-		lastAcquireMutex.Lock()
-		lastAcquire = database.Now()
-		lastAcquireMutex.Unlock()
+	// Since AcquireJob blocks until a job is available, we set a long (5s by default) timeout.  This allows back-level
+	// provisioner daemons to gracefully shut down within a few seconds, but keeps them from rapidly polling the
+	// database.
+	acqCtx, acqCancel := context.WithTimeout(ctx, s.acquireJobLongPollDur)
+	defer acqCancel()
+	job, err := s.Acquirer.AcquireJob(acqCtx, s.ID, s.Provisioners, s.Tags)
+	if xerrors.Is(err, context.DeadlineExceeded) {
+		s.Logger.Debug(ctx, "successful cancel")
 		return &proto.AcquiredJob{}, nil
 	}
 	if err != nil {
 		return nil, xerrors.Errorf("acquire job: %w", err)
 	}
-	server.Logger.Debug(ctx, "locked job from database", slog.F("job_id", job.ID))
+	s.Logger.Debug(ctx, "locked job from database", slog.F("job_id", job.ID))
+	return s.acquireProtoJob(ctx, job)
+}
+
+type jobAndErr struct {
+	job database.ProvisionerJob
+	err error
+}
+
+// AcquireJobWithCancel queries the database to lock a job.
+func (s *server) AcquireJobWithCancel(stream proto.DRPCProvisionerDaemon_AcquireJobWithCancelStream) (retErr error) {
+	//nolint:gocritic // Provisionerd has specific authz rules.
+	streamCtx := dbauthz.AsProvisionerd(stream.Context())
+	defer func() {
+		closeErr := stream.Close()
+		s.Logger.Debug(streamCtx, "closed stream", slog.Error(closeErr))
+		if retErr == nil {
+			retErr = closeErr
+		}
+	}()
+	acqCtx, acqCancel := context.WithCancel(streamCtx)
+	defer acqCancel()
+	recvCh := make(chan error, 1)
+	go func() {
+		_, err := stream.Recv() // cancel is the only message
+		recvCh <- err
+	}()
+	jec := make(chan jobAndErr, 1)
+	go func() {
+		job, err := s.Acquirer.AcquireJob(acqCtx, s.ID, s.Provisioners, s.Tags)
+		jec <- jobAndErr{job: job, err: err}
+	}()
+	var recvErr error
+	var je jobAndErr
+	select {
+	case recvErr = <-recvCh:
+		acqCancel()
+		je = <-jec
+	case je = <-jec:
+	}
+	if xerrors.Is(je.err, context.Canceled) {
+		s.Logger.Debug(streamCtx, "successful cancel")
+		err := stream.Send(&proto.AcquiredJob{})
+		if err != nil {
+			// often this is just because the other side hangs up and doesn't wait for the cancel, so log at INFO
+			s.Logger.Info(streamCtx, "failed to send empty job", slog.Error(err))
+			return err
+		}
+		return nil
+	}
+	if je.err != nil {
+		return xerrors.Errorf("acquire job: %w", je.err)
+	}
+	logger := s.Logger.With(slog.F("job_id", je.job.ID))
+	logger.Debug(streamCtx, "locked job from database")
+
+	if recvErr != nil {
+		logger.Error(streamCtx, "recv error and failed to cancel acquire job", slog.Error(recvErr))
+		// Well, this is awkward.  We hit an error receiving from the stream, but didn't cancel before we locked a job
+		// in the database.  We need to mark this job as failed so the end user can retry if they want to.
+		now := dbtime.Now()
+		err := s.Database.UpdateProvisionerJobWithCompleteByID(
+			context.Background(),
+			database.UpdateProvisionerJobWithCompleteByIDParams{
+				ID: je.job.ID,
+				CompletedAt: sql.NullTime{
+					Time:  now,
+					Valid: true,
+				},
+				UpdatedAt: now,
+				Error: sql.NullString{
+					String: "connection to provisioner daemon broken",
+					Valid:  true,
+				},
+				ErrorCode: sql.NullString{},
+			})
+		if err != nil {
+			logger.Error(streamCtx, "error updating failed job", slog.Error(err))
+		}
+		return recvErr
+	}
 
+	pj, err := s.acquireProtoJob(streamCtx, je.job)
+	if err != nil {
+		return err
+	}
+	err = stream.Send(pj)
+	if err != nil {
+		s.Logger.Error(streamCtx, "failed to send job", slog.Error(err))
+		return err
+	}
+	return nil
+}
+
+func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJob) (*proto.AcquiredJob, error) {
 	// Marks the acquired job as failed with the error message provided.
 	failJob := func(errorMessage string) error {
-		err = server.Database.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
+		err := s.Database.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
 			ID: job.ID,
 			CompletedAt: sql.NullTime{
-				Time:  database.Now(),
+				Time:  dbtime.Now(),
 				Valid: true,
 			},
 			Error: sql.NullString{
@@ -134,6 +320,7 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 				Valid:  true,
 			},
 			ErrorCode: job.ErrorCode,
+			UpdatedAt: dbtime.Now(),
 		})
 		if err != nil {
 			return xerrors.Errorf("update provisioner job: %w", err)
@@ -141,7 +328,7 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 		return xerrors.Errorf("request job was invalidated: %s", errorMessage)
 	}
 
-	user, err := server.Database.GetUserByID(ctx, job.InitiatorID)
+	user, err := s.Database.GetUserByID(ctx, job.InitiatorID)
 	if err != nil {
 		return nil, failJob(fmt.Sprintf("get user: %s", err))
 	}
@@ -169,38 +356,38 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 		if err != nil {
 			return nil, failJob(fmt.Sprintf("unmarshal job input %q: %s", job.Input, err))
 		}
-		workspaceBuild, err := server.Database.GetWorkspaceBuildByID(ctx, input.WorkspaceBuildID)
+		workspaceBuild, err := s.Database.GetWorkspaceBuildByID(ctx, input.WorkspaceBuildID)
 		if err != nil {
 			return nil, failJob(fmt.Sprintf("get workspace build: %s", err))
 		}
-		workspace, err := server.Database.GetWorkspaceByID(ctx, workspaceBuild.WorkspaceID)
+		workspace, err := s.Database.GetWorkspaceByID(ctx, workspaceBuild.WorkspaceID)
 		if err != nil {
 			return nil, failJob(fmt.Sprintf("get workspace: %s", err))
 		}
-		templateVersion, err := server.Database.GetTemplateVersionByID(ctx, workspaceBuild.TemplateVersionID)
+		templateVersion, err := s.Database.GetTemplateVersionByID(ctx, workspaceBuild.TemplateVersionID)
 		if err != nil {
 			return nil, failJob(fmt.Sprintf("get template version: %s", err))
 		}
-		templateVariables, err := server.Database.GetTemplateVersionVariables(ctx, templateVersion.ID)
+		templateVariables, err := s.Database.GetTemplateVersionVariables(ctx, templateVersion.ID)
 		if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
 			return nil, failJob(fmt.Sprintf("get template version variables: %s", err))
 		}
-		template, err := server.Database.GetTemplateByID(ctx, templateVersion.TemplateID.UUID)
+		template, err := s.Database.GetTemplateByID(ctx, templateVersion.TemplateID.UUID)
 		if err != nil {
 			return nil, failJob(fmt.Sprintf("get template: %s", err))
 		}
-		owner, err := server.Database.GetUserByID(ctx, workspace.OwnerID)
+		owner, err := s.Database.GetUserByID(ctx, workspace.OwnerID)
 		if err != nil {
 			return nil, failJob(fmt.Sprintf("get owner: %s", err))
 		}
-		err = server.Pubsub.Publish(codersdk.WorkspaceNotifyChannel(workspace.ID), []byte{})
+		err = s.Pubsub.Publish(codersdk.WorkspaceNotifyChannel(workspace.ID), []byte{})
 		if err != nil {
 			return nil, failJob(fmt.Sprintf("publish workspace update: %s", err))
 		}
 
 		var workspaceOwnerOIDCAccessToken string
-		if server.OIDCConfig != nil {
-			workspaceOwnerOIDCAccessToken, err = obtainOIDCAccessToken(ctx, server.Database, server.OIDCConfig, owner.ID)
+		if s.OIDCConfig != nil {
+			workspaceOwnerOIDCAccessToken, err = obtainOIDCAccessToken(ctx, s.Database, s.OIDCConfig, owner.ID)
 			if err != nil {
 				return nil, failJob(fmt.Sprintf("obtain OIDC access token: %s", err))
 			}
@@ -209,12 +396,12 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 		var sessionToken string
 		switch workspaceBuild.Transition {
 		case database.WorkspaceTransitionStart:
-			sessionToken, err = server.regenerateSessionToken(ctx, owner, workspace)
+			sessionToken, err = s.regenerateSessionToken(ctx, owner, workspace)
 			if err != nil {
 				return nil, failJob(fmt.Sprintf("regenerate session token: %s", err))
 			}
 		case database.WorkspaceTransitionStop, database.WorkspaceTransitionDelete:
-			err = deleteSessionToken(ctx, server.Database, workspace)
+			err = deleteSessionToken(ctx, s.Database, workspace)
 			if err != nil {
 				return nil, failJob(fmt.Sprintf("delete session token: %s", err))
 			}
@@ -225,14 +412,14 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 			return nil, failJob(fmt.Sprintf("convert workspace transition: %s", err))
 		}
 
-		workspaceBuildParameters, err := server.Database.GetWorkspaceBuildParameters(ctx, workspaceBuild.ID)
+		workspaceBuildParameters, err := s.Database.GetWorkspaceBuildParameters(ctx, workspaceBuild.ID)
 		if err != nil {
 			return nil, failJob(fmt.Sprintf("get workspace build parameters: %s", err))
 		}
 
-		gitAuthProviders := []*sdkproto.GitAuthProvider{}
-		for _, p := range templateVersion.GitAuthProviders {
-			link, err := server.Database.GetGitAuthLink(ctx, database.GetGitAuthLinkParams{
+		externalAuthProviders := []*sdkproto.ExternalAuthProvider{}
+		for _, p := range templateVersion.ExternalAuthProviders {
+			link, err := s.Database.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
 				ProviderID: p,
 				UserID:     owner.ID,
 			})
@@ -240,10 +427,10 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 				continue
 			}
 			if err != nil {
-				return nil, failJob(fmt.Sprintf("acquire git auth link: %s", err))
+				return nil, failJob(fmt.Sprintf("acquire external auth link: %s", err))
 			}
-			var config *gitauth.Config
-			for _, c := range server.GitAuthConfigs {
+			var config *externalauth.Config
+			for _, c := range s.ExternalAuthConfigs {
 				if c.ID != p {
 					continue
 				}
@@ -252,21 +439,21 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 			}
 			// We weren't able to find a matching config for the ID!
 			if config == nil {
-				server.Logger.Warn(ctx, "workspace build job is missing git provider",
-					slog.F("git_provider_id", p),
+				s.Logger.Warn(ctx, "workspace build job is missing external auth provider",
+					slog.F("provider_id", p),
 					slog.F("template_version_id", templateVersion.ID),
 					slog.F("workspace_id", workspaceBuild.WorkspaceID))
 				continue
 			}
 
-			link, valid, err := config.RefreshToken(ctx, server.Database, link)
+			link, valid, err := config.RefreshToken(ctx, s.Database, link)
 			if err != nil {
-				return nil, failJob(fmt.Sprintf("refresh git auth link %q: %s", p, err))
+				return nil, failJob(fmt.Sprintf("refresh external auth link %q: %s", p, err))
 			}
 			if !valid {
 				continue
 			}
-			gitAuthProviders = append(gitAuthProviders, &sdkproto.GitAuthProvider{
+			externalAuthProviders = append(externalAuthProviders, &sdkproto.ExternalAuthProvider{
 				Id:          p,
 				AccessToken: link.OAuthAccessToken,
 			})
@@ -274,14 +461,14 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 
 		protoJob.Type = &proto.AcquiredJob_WorkspaceBuild_{
 			WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
-				WorkspaceBuildId:    workspaceBuild.ID.String(),
-				WorkspaceName:       workspace.Name,
-				State:               workspaceBuild.ProvisionerState,
-				RichParameterValues: convertRichParameterValues(workspaceBuildParameters),
-				VariableValues:      asVariableValues(templateVariables),
-				GitAuthProviders:    gitAuthProviders,
-				Metadata: &sdkproto.Provision_Metadata{
-					CoderUrl:                      server.AccessURL.String(),
+				WorkspaceBuildId:      workspaceBuild.ID.String(),
+				WorkspaceName:         workspace.Name,
+				State:                 workspaceBuild.ProvisionerState,
+				RichParameterValues:   convertRichParameterValues(workspaceBuildParameters),
+				VariableValues:        asVariableValues(templateVariables),
+				ExternalAuthProviders: externalAuthProviders,
+				Metadata: &sdkproto.Metadata{
+					CoderUrl:                      s.AccessURL.String(),
 					WorkspaceTransition:           transition,
 					WorkspaceName:                 workspace.Name,
 					WorkspaceOwner:                owner.Username,
@@ -289,6 +476,7 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 					WorkspaceOwnerOidcAccessToken: workspaceOwnerOIDCAccessToken,
 					WorkspaceId:                   workspace.ID.String(),
 					WorkspaceOwnerId:              owner.ID.String(),
+					TemplateId:                    template.ID.String(),
 					TemplateName:                  template.Name,
 					TemplateVersion:               templateVersion.Name,
 					WorkspaceOwnerSessionToken:    sessionToken,
@@ -303,11 +491,11 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 			return nil, failJob(fmt.Sprintf("unmarshal job input %q: %s", job.Input, err))
 		}
 
-		templateVersion, err := server.Database.GetTemplateVersionByID(ctx, input.TemplateVersionID)
+		templateVersion, err := s.Database.GetTemplateVersionByID(ctx, input.TemplateVersionID)
 		if err != nil {
 			return nil, failJob(fmt.Sprintf("get template version: %s", err))
 		}
-		templateVariables, err := server.Database.GetTemplateVersionVariables(ctx, templateVersion.ID)
+		templateVariables, err := s.Database.GetTemplateVersionVariables(ctx, templateVersion.ID)
 		if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
 			return nil, failJob(fmt.Sprintf("get template version variables: %s", err))
 		}
@@ -316,8 +504,8 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 			TemplateDryRun: &proto.AcquiredJob_TemplateDryRun{
 				RichParameterValues: convertRichParameterValues(input.RichParameterValues),
 				VariableValues:      asVariableValues(templateVariables),
-				Metadata: &sdkproto.Provision_Metadata{
-					CoderUrl:      server.AccessURL.String(),
+				Metadata: &sdkproto.Metadata{
+					CoderUrl:      s.AccessURL.String(),
 					WorkspaceName: input.WorkspaceName,
 				},
 			},
@@ -329,7 +517,7 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 			return nil, failJob(fmt.Sprintf("unmarshal job input %q: %s", job.Input, err))
 		}
 
-		userVariableValues, err := server.includeLastVariableValues(ctx, input.TemplateVersionID, input.UserVariableValues)
+		userVariableValues, err := s.includeLastVariableValues(ctx, input.TemplateVersionID, input.UserVariableValues)
 		if err != nil {
 			return nil, failJob(err.Error())
 		}
@@ -337,15 +525,15 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 		protoJob.Type = &proto.AcquiredJob_TemplateImport_{
 			TemplateImport: &proto.AcquiredJob_TemplateImport{
 				UserVariableValues: convertVariableValues(userVariableValues),
-				Metadata: &sdkproto.Provision_Metadata{
-					CoderUrl: server.AccessURL.String(),
+				Metadata: &sdkproto.Metadata{
+					CoderUrl: s.AccessURL.String(),
 				},
 			},
 		}
 	}
 	switch job.StorageMethod {
 	case database.ProvisionerStorageMethodFile:
-		file, err := server.Database.GetFileByID(ctx, job.FileID)
+		file, err := s.Database.GetFileByID(ctx, job.FileID)
 		if err != nil {
 			return nil, failJob(fmt.Sprintf("get file by hash: %s", err))
 		}
@@ -360,7 +548,7 @@ func (server *Server) AcquireJob(ctx context.Context, _ *proto.Empty) (*proto.Ac
 	return protoJob, err
 }
 
-func (server *Server) includeLastVariableValues(ctx context.Context, templateVersionID uuid.UUID, userVariableValues []codersdk.VariableValue) ([]codersdk.VariableValue, error) {
+func (s *server) includeLastVariableValues(ctx context.Context, templateVersionID uuid.UUID, userVariableValues []codersdk.VariableValue) ([]codersdk.VariableValue, error) {
 	var values []codersdk.VariableValue
 	values = append(values, userVariableValues...)
 
@@ -368,7 +556,7 @@ func (server *Server) includeLastVariableValues(ctx context.Context, templateVer
 		return values, nil
 	}
 
-	templateVersion, err := server.Database.GetTemplateVersionByID(ctx, templateVersionID)
+	templateVersion, err := s.Database.GetTemplateVersionByID(ctx, templateVersionID)
 	if err != nil {
 		return nil, xerrors.Errorf("get template version: %w", err)
 	}
@@ -377,7 +565,7 @@ func (server *Server) includeLastVariableValues(ctx context.Context, templateVer
 		return values, nil
 	}
 
-	template, err := server.Database.GetTemplateByID(ctx, templateVersion.TemplateID.UUID)
+	template, err := s.Database.GetTemplateByID(ctx, templateVersion.TemplateID.UUID)
 	if err != nil {
 		return nil, xerrors.Errorf("get template: %w", err)
 	}
@@ -386,7 +574,7 @@ func (server *Server) includeLastVariableValues(ctx context.Context, templateVer
 		return values, nil
 	}
 
-	templateVariables, err := server.Database.GetTemplateVersionVariables(ctx, template.ActiveVersionID)
+	templateVariables, err := s.Database.GetTemplateVersionVariables(ctx, template.ActiveVersionID)
 	if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
 		return nil, xerrors.Errorf("get template version variables: %w", err)
 	}
@@ -412,8 +600,8 @@ func (server *Server) includeLastVariableValues(ctx context.Context, templateVer
 	return values, nil
 }
 
-func (server *Server) CommitQuota(ctx context.Context, request *proto.CommitQuotaRequest) (*proto.CommitQuotaResponse, error) {
-	ctx, span := server.startTrace(ctx, tracing.FuncName())
+func (s *server) CommitQuota(ctx context.Context, request *proto.CommitQuotaRequest) (*proto.CommitQuotaResponse, error) {
+	ctx, span := s.startTrace(ctx, tracing.FuncName())
 	defer span.End()
 
 	//nolint:gocritic // Provisionerd has specific authz rules.
@@ -423,7 +611,7 @@ func (server *Server) CommitQuota(ctx context.Context, request *proto.CommitQuot
 		return nil, xerrors.Errorf("parse job id: %w", err)
 	}
 
-	job, err := server.Database.GetProvisionerJobByID(ctx, jobID)
+	job, err := s.Database.GetProvisionerJobByID(ctx, jobID)
 	if err != nil {
 		return nil, xerrors.Errorf("get job: %w", err)
 	}
@@ -431,11 +619,11 @@ func (server *Server) CommitQuota(ctx context.Context, request *proto.CommitQuot
 		return nil, xerrors.New("job isn't running yet")
 	}
 
-	if job.WorkerID.UUID.String() != server.ID.String() {
+	if job.WorkerID.UUID.String() != s.ID.String() {
 		return nil, xerrors.New("you don't own this job")
 	}
 
-	q := server.QuotaCommitter.Load()
+	q := s.QuotaCommitter.Load()
 	if q == nil {
 		// We're probably in community edition or a test.
 		return &proto.CommitQuotaResponse{
@@ -446,8 +634,8 @@ func (server *Server) CommitQuota(ctx context.Context, request *proto.CommitQuot
 	return (*q).CommitQuota(ctx, request)
 }
 
-func (server *Server) UpdateJob(ctx context.Context, request *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error) {
-	ctx, span := server.startTrace(ctx, tracing.FuncName())
+func (s *server) UpdateJob(ctx context.Context, request *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error) {
+	ctx, span := s.startTrace(ctx, tracing.FuncName())
 	defer span.End()
 
 	//nolint:gocritic // Provisionerd has specific authz rules.
@@ -456,26 +644,27 @@ func (server *Server) UpdateJob(ctx context.Context, request *proto.UpdateJobReq
 	if err != nil {
 		return nil, xerrors.Errorf("parse job id: %w", err)
 	}
-	server.Logger.Debug(ctx, "stage UpdateJob starting", slog.F("job_id", parsedID))
-	job, err := server.Database.GetProvisionerJobByID(ctx, parsedID)
+	s.Logger.Debug(ctx, "stage UpdateJob starting", slog.F("job_id", parsedID))
+	job, err := s.Database.GetProvisionerJobByID(ctx, parsedID)
 	if err != nil {
 		return nil, xerrors.Errorf("get job: %w", err)
 	}
 	if !job.WorkerID.Valid {
 		return nil, xerrors.New("job isn't running yet")
 	}
-	if job.WorkerID.UUID.String() != server.ID.String() {
+	if job.WorkerID.UUID.String() != s.ID.String() {
 		return nil, xerrors.New("you don't own this job")
 	}
-	err = server.Database.UpdateProvisionerJobByID(ctx, database.UpdateProvisionerJobByIDParams{
+	err = s.Database.UpdateProvisionerJobByID(ctx, database.UpdateProvisionerJobByIDParams{
 		ID:        parsedID,
-		UpdatedAt: database.Now(),
+		UpdatedAt: dbtime.Now(),
 	})
 	if err != nil {
 		return nil, xerrors.Errorf("update job: %w", err)
 	}
 
 	if len(request.Logs) > 0 {
+		//nolint:exhaustruct // We append to the additional fields below.
 		insertParams := database.InsertProvisionerJobLogsParams{
 			JobID: parsedID,
 		}
@@ -493,40 +682,40 @@ func (server *Server) UpdateJob(ctx context.Context, request *proto.UpdateJobReq
 			insertParams.Stage = append(insertParams.Stage, log.Stage)
 			insertParams.Source = append(insertParams.Source, logSource)
 			insertParams.Output = append(insertParams.Output, log.Output)
-			server.Logger.Debug(ctx, "job log",
+			s.Logger.Debug(ctx, "job log",
 				slog.F("job_id", parsedID),
 				slog.F("stage", log.Stage),
 				slog.F("output", log.Output))
 		}
 
-		logs, err := server.Database.InsertProvisionerJobLogs(ctx, insertParams)
+		logs, err := s.Database.InsertProvisionerJobLogs(ctx, insertParams)
 		if err != nil {
-			server.Logger.Error(ctx, "failed to insert job logs", slog.F("job_id", parsedID), slog.Error(err))
+			s.Logger.Error(ctx, "failed to insert job logs", slog.F("job_id", parsedID), slog.Error(err))
 			return nil, xerrors.Errorf("insert job logs: %w", err)
 		}
 		// Publish by the lowest log ID inserted so the log stream will fetch
 		// everything from that point.
 		lowestID := logs[0].ID
-		server.Logger.Debug(ctx, "inserted job logs", slog.F("job_id", parsedID))
+		s.Logger.Debug(ctx, "inserted job logs", slog.F("job_id", parsedID))
 		data, err := json.Marshal(provisionersdk.ProvisionerJobLogsNotifyMessage{
 			CreatedAfter: lowestID - 1,
 		})
 		if err != nil {
 			return nil, xerrors.Errorf("marshal: %w", err)
 		}
-		err = server.Pubsub.Publish(provisionersdk.ProvisionerJobLogsNotifyChannel(parsedID), data)
+		err = s.Pubsub.Publish(provisionersdk.ProvisionerJobLogsNotifyChannel(parsedID), data)
 		if err != nil {
-			server.Logger.Error(ctx, "failed to publish job logs", slog.F("job_id", parsedID), slog.Error(err))
+			s.Logger.Error(ctx, "failed to publish job logs", slog.F("job_id", parsedID), slog.Error(err))
 			return nil, xerrors.Errorf("publish job logs: %w", err)
 		}
-		server.Logger.Debug(ctx, "published job logs", slog.F("job_id", parsedID))
+		s.Logger.Debug(ctx, "published job logs", slog.F("job_id", parsedID))
 	}
 
 	if len(request.Readme) > 0 {
-		err := server.Database.UpdateTemplateVersionDescriptionByJobID(ctx, database.UpdateTemplateVersionDescriptionByJobIDParams{
+		err := s.Database.UpdateTemplateVersionDescriptionByJobID(ctx, database.UpdateTemplateVersionDescriptionByJobIDParams{
 			JobID:     job.ID,
 			Readme:    string(request.Readme),
-			UpdatedAt: database.Now(),
+			UpdatedAt: dbtime.Now(),
 		})
 		if err != nil {
 			return nil, xerrors.Errorf("update template version description: %w", err)
@@ -534,16 +723,16 @@ func (server *Server) UpdateJob(ctx context.Context, request *proto.UpdateJobReq
 	}
 
 	if len(request.TemplateVariables) > 0 {
-		templateVersion, err := server.Database.GetTemplateVersionByJobID(ctx, job.ID)
+		templateVersion, err := s.Database.GetTemplateVersionByJobID(ctx, job.ID)
 		if err != nil {
-			server.Logger.Error(ctx, "failed to get the template version", slog.F("job_id", parsedID), slog.Error(err))
+			s.Logger.Error(ctx, "failed to get the template version", slog.F("job_id", parsedID), slog.Error(err))
 			return nil, xerrors.Errorf("get template version by job id: %w", err)
 		}
 
 		var variableValues []*sdkproto.VariableValue
 		var variablesWithMissingValues []string
 		for _, templateVariable := range request.TemplateVariables {
-			server.Logger.Debug(ctx, "insert template variable", slog.F("template_version_id", templateVersion.ID), slog.F("template_variable", redactTemplateVariable(templateVariable)))
+			s.Logger.Debug(ctx, "insert template variable", slog.F("template_version_id", templateVersion.ID), slog.F("template_variable", redactTemplateVariable(templateVariable)))
 
 			value := templateVariable.DefaultValue
 			for _, v := range request.UserVariableValues {
@@ -563,7 +752,7 @@ func (server *Server) UpdateJob(ctx context.Context, request *proto.UpdateJobReq
 				Sensitive: templateVariable.Sensitive,
 			})
 
-			_, err = server.Database.InsertTemplateVersionVariable(ctx, database.InsertTemplateVersionVariableParams{
+			_, err = s.Database.InsertTemplateVersionVariable(ctx, database.InsertTemplateVersionVariableParams{
 				TemplateVersionID: templateVersion.ID,
 				Name:              templateVariable.Name,
 				Description:       templateVariable.Description,
@@ -593,8 +782,8 @@ func (server *Server) UpdateJob(ctx context.Context, request *proto.UpdateJobReq
 	}, nil
 }
 
-func (server *Server) FailJob(ctx context.Context, failJob *proto.FailedJob) (*proto.Empty, error) {
-	ctx, span := server.startTrace(ctx, tracing.FuncName())
+func (s *server) FailJob(ctx context.Context, failJob *proto.FailedJob) (*proto.Empty, error) {
+	ctx, span := s.startTrace(ctx, tracing.FuncName())
 	defer span.End()
 
 	//nolint:gocritic // Provisionerd has specific authz rules.
@@ -603,19 +792,19 @@ func (server *Server) FailJob(ctx context.Context, failJob *proto.FailedJob) (*p
 	if err != nil {
 		return nil, xerrors.Errorf("parse job id: %w", err)
 	}
-	server.Logger.Debug(ctx, "stage FailJob starting", slog.F("job_id", jobID))
-	job, err := server.Database.GetProvisionerJobByID(ctx, jobID)
+	s.Logger.Debug(ctx, "stage FailJob starting", slog.F("job_id", jobID))
+	job, err := s.Database.GetProvisionerJobByID(ctx, jobID)
 	if err != nil {
 		return nil, xerrors.Errorf("get provisioner job: %w", err)
 	}
-	if job.WorkerID.UUID.String() != server.ID.String() {
+	if job.WorkerID.UUID.String() != s.ID.String() {
 		return nil, xerrors.New("you don't own this job")
 	}
 	if job.CompletedAt.Valid {
 		return nil, xerrors.Errorf("job already completed")
 	}
 	job.CompletedAt = sql.NullTime{
-		Time:  database.Now(),
+		Time:  dbtime.Now(),
 		Valid: true,
 	}
 	job.Error = sql.NullString{
@@ -627,17 +816,17 @@ func (server *Server) FailJob(ctx context.Context, failJob *proto.FailedJob) (*p
 		Valid:  failJob.ErrorCode != "",
 	}
 
-	err = server.Database.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
+	err = s.Database.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
 		ID:          jobID,
 		CompletedAt: job.CompletedAt,
-		UpdatedAt:   database.Now(),
+		UpdatedAt:   dbtime.Now(),
 		Error:       job.Error,
 		ErrorCode:   job.ErrorCode,
 	})
 	if err != nil {
 		return nil, xerrors.Errorf("update provisioner job: %w", err)
 	}
-	server.Telemetry.Report(&telemetry.Snapshot{
+	s.Telemetry.Report(&telemetry.Snapshot{
 		ProvisionerJobs: []telemetry.ProvisionerJob{telemetry.ConvertProvisionerJob(job)},
 	})
 
@@ -650,23 +839,30 @@ func (server *Server) FailJob(ctx context.Context, failJob *proto.FailedJob) (*p
 		}
 
 		var build database.WorkspaceBuild
-		err = server.Database.InTx(func(db database.Store) error {
+		err = s.Database.InTx(func(db database.Store) error {
 			build, err = db.GetWorkspaceBuildByID(ctx, input.WorkspaceBuildID)
 			if err != nil {
 				return xerrors.Errorf("get workspace build: %w", err)
 			}
 
 			if jobType.WorkspaceBuild.State != nil {
-				err = db.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
+				err = db.UpdateWorkspaceBuildProvisionerStateByID(ctx, database.UpdateWorkspaceBuildProvisionerStateByIDParams{
 					ID:               input.WorkspaceBuildID,
-					UpdatedAt:        database.Now(),
+					UpdatedAt:        dbtime.Now(),
 					ProvisionerState: jobType.WorkspaceBuild.State,
-					Deadline:         build.Deadline,
-					MaxDeadline:      build.MaxDeadline,
 				})
 				if err != nil {
 					return xerrors.Errorf("update workspace build state: %w", err)
 				}
+				err = db.UpdateWorkspaceBuildDeadlineByID(ctx, database.UpdateWorkspaceBuildDeadlineByIDParams{
+					ID:          input.WorkspaceBuildID,
+					UpdatedAt:   dbtime.Now(),
+					Deadline:    build.Deadline,
+					MaxDeadline: build.MaxDeadline,
+				})
+				if err != nil {
+					return xerrors.Errorf("update workspace build deadline: %w", err)
+				}
 			}
 
 			return nil
@@ -675,7 +871,7 @@ func (server *Server) FailJob(ctx context.Context, failJob *proto.FailedJob) (*p
 			return nil, err
 		}
 
-		err = server.Pubsub.Publish(codersdk.WorkspaceNotifyChannel(build.WorkspaceID), []byte{})
+		err = s.Pubsub.Publish(codersdk.WorkspaceNotifyChannel(build.WorkspaceID), []byte{})
 		if err != nil {
 			return nil, xerrors.Errorf("update workspace: %w", err)
 		}
@@ -684,18 +880,18 @@ func (server *Server) FailJob(ctx context.Context, failJob *proto.FailedJob) (*p
 
 	// if failed job is a workspace build, audit the outcome
 	if job.Type == database.ProvisionerJobTypeWorkspaceBuild {
-		auditor := server.Auditor.Load()
-		build, err := server.Database.GetWorkspaceBuildByJobID(ctx, job.ID)
+		auditor := s.Auditor.Load()
+		build, err := s.Database.GetWorkspaceBuildByJobID(ctx, job.ID)
 		if err != nil {
-			server.Logger.Error(ctx, "audit log - get build", slog.Error(err))
+			s.Logger.Error(ctx, "audit log - get build", slog.Error(err))
 		} else {
 			auditAction := auditActionFromTransition(build.Transition)
-			workspace, err := server.Database.GetWorkspaceByID(ctx, build.WorkspaceID)
+			workspace, err := s.Database.GetWorkspaceByID(ctx, build.WorkspaceID)
 			if err != nil {
-				server.Logger.Error(ctx, "audit log - get workspace", slog.Error(err))
+				s.Logger.Error(ctx, "audit log - get workspace", slog.Error(err))
 			} else {
 				previousBuildNumber := build.BuildNumber - 1
-				previousBuild, prevBuildErr := server.Database.GetWorkspaceBuildByWorkspaceIDAndBuildNumber(ctx, database.GetWorkspaceBuildByWorkspaceIDAndBuildNumberParams{
+				previousBuild, prevBuildErr := s.Database.GetWorkspaceBuildByWorkspaceIDAndBuildNumber(ctx, database.GetWorkspaceBuildByWorkspaceIDAndBuildNumberParams{
 					WorkspaceID: workspace.ID,
 					BuildNumber: previousBuildNumber,
 				})
@@ -713,14 +909,18 @@ func (server *Server) FailJob(ctx context.Context, failJob *proto.FailedJob) (*p
 
 				wriBytes, err := json.Marshal(buildResourceInfo)
 				if err != nil {
-					server.Logger.Error(ctx, "marshal workspace resource info for failed job", slog.Error(err))
+					s.Logger.Error(ctx, "marshal workspace resource info for failed job", slog.Error(err))
 				}
 
-				audit.BuildAudit(ctx, &audit.BuildAuditParams[database.WorkspaceBuild]{
+				bag := audit.BaggageFromContext(ctx)
+
+				audit.WorkspaceBuildAudit(ctx, &audit.BuildAuditParams[database.WorkspaceBuild]{
 					Audit:            *auditor,
-					Log:              server.Logger,
+					Log:              s.Logger,
 					UserID:           job.InitiatorID,
+					OrganizationID:   workspace.OrganizationID,
 					JobID:            job.ID,
+					IP:               bag.IP,
 					Action:           auditAction,
 					Old:              previousBuild,
 					New:              build,
@@ -735,19 +935,17 @@ func (server *Server) FailJob(ctx context.Context, failJob *proto.FailedJob) (*p
 	if err != nil {
 		return nil, xerrors.Errorf("marshal job log: %w", err)
 	}
-	err = server.Pubsub.Publish(provisionersdk.ProvisionerJobLogsNotifyChannel(jobID), data)
+	err = s.Pubsub.Publish(provisionersdk.ProvisionerJobLogsNotifyChannel(jobID), data)
 	if err != nil {
-		server.Logger.Error(ctx, "failed to publish end of job logs", slog.F("job_id", jobID), slog.Error(err))
+		s.Logger.Error(ctx, "failed to publish end of job logs", slog.F("job_id", jobID), slog.Error(err))
 		return nil, xerrors.Errorf("publish end of job logs: %w", err)
 	}
 	return &proto.Empty{}, nil
 }
 
 // CompleteJob is triggered by a provision daemon to mark a provisioner job as completed.
-//
-//nolint:gocyclo
-func (server *Server) CompleteJob(ctx context.Context, completed *proto.CompletedJob) (*proto.Empty, error) {
-	ctx, span := server.startTrace(ctx, tracing.FuncName())
+func (s *server) CompleteJob(ctx context.Context, completed *proto.CompletedJob) (*proto.Empty, error) {
+	ctx, span := s.startTrace(ctx, tracing.FuncName())
 	defer span.End()
 
 	//nolint:gocritic // Provisionerd has specific authz rules.
@@ -756,18 +954,18 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 	if err != nil {
 		return nil, xerrors.Errorf("parse job id: %w", err)
 	}
-	server.Logger.Debug(ctx, "stage CompleteJob starting", slog.F("job_id", jobID))
-	job, err := server.Database.GetProvisionerJobByID(ctx, jobID)
+	s.Logger.Debug(ctx, "stage CompleteJob starting", slog.F("job_id", jobID))
+	job, err := s.Database.GetProvisionerJobByID(ctx, jobID)
 	if err != nil {
 		return nil, xerrors.Errorf("get job by id: %w", err)
 	}
-	if job.WorkerID.UUID.String() != server.ID.String() {
+	if job.WorkerID.UUID.String() != s.ID.String() {
 		return nil, xerrors.Errorf("you don't own this job")
 	}
 
 	telemetrySnapshot := &telemetry.Snapshot{}
 	// Items are added to this snapshot as they complete!
-	defer server.Telemetry.Report(telemetrySnapshot)
+	defer s.Telemetry.Report(telemetrySnapshot)
 
 	switch jobType := completed.Type.(type) {
 	case *proto.CompletedJob_TemplateImport_:
@@ -782,13 +980,13 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 			database.WorkspaceTransitionStop:  jobType.TemplateImport.StopResources,
 		} {
 			for _, resource := range resources {
-				server.Logger.Info(ctx, "inserting template import job resource",
+				s.Logger.Info(ctx, "inserting template import job resource",
 					slog.F("job_id", job.ID.String()),
 					slog.F("resource_name", resource.Name),
 					slog.F("resource_type", resource.Type),
 					slog.F("transition", transition))
 
-				err = InsertWorkspaceResource(ctx, server.Database, jobID, transition, resource, telemetrySnapshot)
+				err = InsertWorkspaceResource(ctx, s.Database, jobID, transition, resource, telemetrySnapshot)
 				if err != nil {
 					return nil, xerrors.Errorf("insert resource: %w", err)
 				}
@@ -796,7 +994,7 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 		}
 
 		for _, richParameter := range jobType.TemplateImport.RichParameters {
-			server.Logger.Info(ctx, "inserting template import job parameter",
+			s.Logger.Info(ctx, "inserting template import job parameter",
 				slog.F("job_id", job.ID.String()),
 				slog.F("parameter_name", richParameter.Name),
 				slog.F("type", richParameter.Type),
@@ -821,7 +1019,7 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 				}
 			}
 
-			_, err = server.Database.InsertTemplateVersionParameter(ctx, database.InsertTemplateVersionParameterParams{
+			_, err = s.Database.InsertTemplateVersionParameter(ctx, database.InsertTemplateVersionParameterParams{
 				TemplateVersionID:   input.TemplateVersionID,
 				Name:                richParameter.Name,
 				DisplayName:         richParameter.DisplayName,
@@ -847,45 +1045,46 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 
 		var completedError sql.NullString
 
-		for _, gitAuthProvider := range jobType.TemplateImport.GitAuthProviders {
+		for _, externalAuthProvider := range jobType.TemplateImport.ExternalAuthProviders {
 			contains := false
-			for _, configuredProvider := range server.GitAuthConfigs {
-				if configuredProvider.ID == gitAuthProvider {
+			for _, configuredProvider := range s.ExternalAuthConfigs {
+				if configuredProvider.ID == externalAuthProvider {
 					contains = true
 					break
 				}
 			}
 			if !contains {
 				completedError = sql.NullString{
-					String: fmt.Sprintf("git auth provider %q is not configured", gitAuthProvider),
+					String: fmt.Sprintf("external auth provider %q is not configured", externalAuthProvider),
 					Valid:  true,
 				}
 				break
 			}
 		}
 
-		err = server.Database.UpdateTemplateVersionGitAuthProvidersByJobID(ctx, database.UpdateTemplateVersionGitAuthProvidersByJobIDParams{
-			JobID:            jobID,
-			GitAuthProviders: jobType.TemplateImport.GitAuthProviders,
-			UpdatedAt:        database.Now(),
+		err = s.Database.UpdateTemplateVersionExternalAuthProvidersByJobID(ctx, database.UpdateTemplateVersionExternalAuthProvidersByJobIDParams{
+			JobID:                 jobID,
+			ExternalAuthProviders: jobType.TemplateImport.ExternalAuthProviders,
+			UpdatedAt:             dbtime.Now(),
 		})
 		if err != nil {
-			return nil, xerrors.Errorf("update template version git auth providers: %w", err)
+			return nil, xerrors.Errorf("update template version external auth providers: %w", err)
 		}
 
-		err = server.Database.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
+		err = s.Database.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
 			ID:        jobID,
-			UpdatedAt: database.Now(),
+			UpdatedAt: dbtime.Now(),
 			CompletedAt: sql.NullTime{
-				Time:  database.Now(),
+				Time:  dbtime.Now(),
 				Valid: true,
 			},
-			Error: completedError,
+			Error:     completedError,
+			ErrorCode: sql.NullString{},
 		})
 		if err != nil {
 			return nil, xerrors.Errorf("update provisioner job: %w", err)
 		}
-		server.Logger.Debug(ctx, "marked import job as completed", slog.F("job_id", jobID))
+		s.Logger.Debug(ctx, "marked import job as completed", slog.F("job_id", jobID))
 		if err != nil {
 			return nil, xerrors.Errorf("complete job: %w", err)
 		}
@@ -896,7 +1095,7 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 			return nil, xerrors.Errorf("unmarshal job data: %w", err)
 		}
 
-		workspaceBuild, err := server.Database.GetWorkspaceBuildByID(ctx, input.WorkspaceBuildID)
+		workspaceBuild, err := s.Database.GetWorkspaceBuildByID(ctx, input.WorkspaceBuildID)
 		if err != nil {
 			return nil, xerrors.Errorf("get workspace build: %w", err)
 		}
@@ -904,14 +1103,14 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 		var workspace database.Workspace
 		var getWorkspaceError error
 
-		err = server.Database.InTx(func(db database.Store) error {
-			// It's important we use server.timeNow() here because we want to be
+		err = s.Database.InTx(func(db database.Store) error {
+			// It's important we use s.timeNow() here because we want to be
 			// able to customize the current time from within tests.
-			now := server.timeNow()
+			now := s.timeNow()
 
 			workspace, getWorkspaceError = db.GetWorkspaceByID(ctx, workspaceBuild.WorkspaceID)
 			if getWorkspaceError != nil {
-				server.Logger.Error(ctx,
+				s.Logger.Error(ctx,
 					"fetch workspace for build",
 					slog.F("workspace_build_id", workspaceBuild.ID),
 					slog.F("workspace_id", workspaceBuild.WorkspaceID),
@@ -921,8 +1120,8 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 
 			autoStop, err := schedule.CalculateAutostop(ctx, schedule.CalculateAutostopParams{
 				Database:                    db,
-				TemplateScheduleStore:       *server.TemplateScheduleStore.Load(),
-				UserQuietHoursScheduleStore: *server.UserQuietHoursScheduleStore.Load(),
+				TemplateScheduleStore:       *s.TemplateScheduleStore.Load(),
+				UserQuietHoursScheduleStore: *s.UserQuietHoursScheduleStore.Load(),
 				Now:                         now,
 				Workspace:                   workspace,
 			})
@@ -932,24 +1131,33 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 
 			err = db.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
 				ID:        jobID,
-				UpdatedAt: database.Now(),
+				UpdatedAt: dbtime.Now(),
 				CompletedAt: sql.NullTime{
-					Time:  database.Now(),
+					Time:  dbtime.Now(),
 					Valid: true,
 				},
+				Error:     sql.NullString{},
+				ErrorCode: sql.NullString{},
 			})
 			if err != nil {
 				return xerrors.Errorf("update provisioner job: %w", err)
 			}
-			err = db.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
+			err = db.UpdateWorkspaceBuildProvisionerStateByID(ctx, database.UpdateWorkspaceBuildProvisionerStateByIDParams{
 				ID:               workspaceBuild.ID,
-				Deadline:         autoStop.Deadline,
-				MaxDeadline:      autoStop.MaxDeadline,
 				ProvisionerState: jobType.WorkspaceBuild.State,
 				UpdatedAt:        now,
 			})
 			if err != nil {
-				return xerrors.Errorf("update workspace build: %w", err)
+				return xerrors.Errorf("update workspace build provisioner state: %w", err)
+			}
+			err = db.UpdateWorkspaceBuildDeadlineByID(ctx, database.UpdateWorkspaceBuildDeadlineByIDParams{
+				ID:          workspaceBuild.ID,
+				Deadline:    autoStop.Deadline,
+				MaxDeadline: autoStop.MaxDeadline,
+				UpdatedAt:   now,
+			})
+			if err != nil {
+				return xerrors.Errorf("update workspace build deadline: %w", err)
 			}
 
 			agentTimeouts := make(map[time.Duration]bool) // A set of agent timeouts.
@@ -978,26 +1186,38 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 
 				var updates []<-chan time.Time
 				for _, d := range timeouts {
-					server.Logger.Debug(ctx, "triggering workspace notification after agent timeout",
+					s.Logger.Debug(ctx, "triggering workspace notification after agent timeout",
 						slog.F("workspace_build_id", workspaceBuild.ID),
 						slog.F("timeout", d),
 					)
-					// Agents are inserted with `database.Now()`, this triggers a
+					// Agents are inserted with `dbtime.Now()`, this triggers a
 					// workspace event approximately after created + timeout seconds.
 					updates = append(updates, time.After(d))
 				}
 				go func() {
 					for _, wait := range updates {
-						// Wait for the next potential timeout to occur. Note that we
-						// can't listen on the context here because we will hang around
-						// after this function has returned. The server also doesn't
-						// have a shutdown signal we can listen to.
-						<-wait
-						if err := server.Pubsub.Publish(codersdk.WorkspaceNotifyChannel(workspaceBuild.WorkspaceID), []byte{}); err != nil {
-							server.Logger.Error(ctx, "workspace notification after agent timeout failed",
+						select {
+						case <-s.lifecycleCtx.Done():
+							// If the server is shutting down, we don't want to wait around.
+							s.Logger.Debug(ctx, "stopping notifications due to server shutdown",
 								slog.F("workspace_build_id", workspaceBuild.ID),
-								slog.Error(err),
 							)
+							return
+						case <-wait:
+							// Wait for the next potential timeout to occur.
+							if err := s.Pubsub.Publish(codersdk.WorkspaceNotifyChannel(workspaceBuild.WorkspaceID), []byte{}); err != nil {
+								if s.lifecycleCtx.Err() != nil {
+									// If the server is shutting down, we don't want to log this error, nor wait around.
+									s.Logger.Debug(ctx, "stopping notifications due to server shutdown",
+										slog.F("workspace_build_id", workspaceBuild.ID),
+									)
+									return
+								}
+								s.Logger.Error(ctx, "workspace notification after agent timeout failed",
+									slog.F("workspace_build_id", workspaceBuild.ID),
+									slog.Error(err),
+								)
+							}
 						}
 					}
 				}()
@@ -1024,11 +1244,11 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 
 		// audit the outcome of the workspace build
 		if getWorkspaceError == nil {
-			auditor := server.Auditor.Load()
+			auditor := s.Auditor.Load()
 			auditAction := auditActionFromTransition(workspaceBuild.Transition)
 
 			previousBuildNumber := workspaceBuild.BuildNumber - 1
-			previousBuild, prevBuildErr := server.Database.GetWorkspaceBuildByWorkspaceIDAndBuildNumber(ctx, database.GetWorkspaceBuildByWorkspaceIDAndBuildNumberParams{
+			previousBuild, prevBuildErr := s.Database.GetWorkspaceBuildByWorkspaceIDAndBuildNumber(ctx, database.GetWorkspaceBuildByWorkspaceIDAndBuildNumberParams{
 				WorkspaceID: workspace.ID,
 				BuildNumber: previousBuildNumber,
 			})
@@ -1046,14 +1266,18 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 
 			wriBytes, err := json.Marshal(buildResourceInfo)
 			if err != nil {
-				server.Logger.Error(ctx, "marshal resource info for successful job", slog.Error(err))
+				s.Logger.Error(ctx, "marshal resource info for successful job", slog.Error(err))
 			}
 
-			audit.BuildAudit(ctx, &audit.BuildAuditParams[database.WorkspaceBuild]{
+			bag := audit.BaggageFromContext(ctx)
+
+			audit.WorkspaceBuildAudit(ctx, &audit.BuildAuditParams[database.WorkspaceBuild]{
 				Audit:            *auditor,
-				Log:              server.Logger,
+				Log:              s.Logger,
 				UserID:           job.InitiatorID,
+				OrganizationID:   workspace.OrganizationID,
 				JobID:            job.ID,
+				IP:               bag.IP,
 				Action:           auditAction,
 				Old:              previousBuild,
 				New:              workspaceBuild,
@@ -1062,35 +1286,37 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 			})
 		}
 
-		err = server.Pubsub.Publish(codersdk.WorkspaceNotifyChannel(workspaceBuild.WorkspaceID), []byte{})
+		err = s.Pubsub.Publish(codersdk.WorkspaceNotifyChannel(workspaceBuild.WorkspaceID), []byte{})
 		if err != nil {
 			return nil, xerrors.Errorf("update workspace: %w", err)
 		}
 	case *proto.CompletedJob_TemplateDryRun_:
 		for _, resource := range jobType.TemplateDryRun.Resources {
-			server.Logger.Info(ctx, "inserting template dry-run job resource",
+			s.Logger.Info(ctx, "inserting template dry-run job resource",
 				slog.F("job_id", job.ID.String()),
 				slog.F("resource_name", resource.Name),
 				slog.F("resource_type", resource.Type))
 
-			err = InsertWorkspaceResource(ctx, server.Database, jobID, database.WorkspaceTransitionStart, resource, telemetrySnapshot)
+			err = InsertWorkspaceResource(ctx, s.Database, jobID, database.WorkspaceTransitionStart, resource, telemetrySnapshot)
 			if err != nil {
 				return nil, xerrors.Errorf("insert resource: %w", err)
 			}
 		}
 
-		err = server.Database.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
+		err = s.Database.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
 			ID:        jobID,
-			UpdatedAt: database.Now(),
+			UpdatedAt: dbtime.Now(),
 			CompletedAt: sql.NullTime{
-				Time:  database.Now(),
+				Time:  dbtime.Now(),
 				Valid: true,
 			},
+			Error:     sql.NullString{},
+			ErrorCode: sql.NullString{},
 		})
 		if err != nil {
 			return nil, xerrors.Errorf("update provisioner job: %w", err)
 		}
-		server.Logger.Debug(ctx, "marked template dry-run job as completed", slog.F("job_id", jobID))
+		s.Logger.Debug(ctx, "marked template dry-run job as completed", slog.F("job_id", jobID))
 		if err != nil {
 			return nil, xerrors.Errorf("complete job: %w", err)
 		}
@@ -1107,18 +1333,18 @@ func (server *Server) CompleteJob(ctx context.Context, completed *proto.Complete
 	if err != nil {
 		return nil, xerrors.Errorf("marshal job log: %w", err)
 	}
-	err = server.Pubsub.Publish(provisionersdk.ProvisionerJobLogsNotifyChannel(jobID), data)
+	err = s.Pubsub.Publish(provisionersdk.ProvisionerJobLogsNotifyChannel(jobID), data)
 	if err != nil {
-		server.Logger.Error(ctx, "failed to publish end of job logs", slog.F("job_id", jobID), slog.Error(err))
+		s.Logger.Error(ctx, "failed to publish end of job logs", slog.F("job_id", jobID), slog.Error(err))
 		return nil, xerrors.Errorf("publish end of job logs: %w", err)
 	}
 
-	server.Logger.Debug(ctx, "stage CompleteJob done", slog.F("job_id", jobID))
+	s.Logger.Debug(ctx, "stage CompleteJob done", slog.F("job_id", jobID))
 	return &proto.Empty{}, nil
 }
 
-func (server *Server) startTrace(ctx context.Context, name string, opts ...trace.SpanStartOption) (context.Context, trace.Span) {
-	return server.Tracer.Start(ctx, name, append(opts, trace.WithAttributes(
+func (s *server) startTrace(ctx context.Context, name string, opts ...trace.SpanStartOption) (context.Context, trace.Span) {
+	return s.Tracer.Start(ctx, name, append(opts, trace.WithAttributes(
 		semconv.ServiceNameKey.String("coderd.provisionerd"),
 	))...)
 }
@@ -1126,7 +1352,7 @@ func (server *Server) startTrace(ctx context.Context, name string, opts ...trace
 func InsertWorkspaceResource(ctx context.Context, db database.Store, jobID uuid.UUID, transition database.WorkspaceTransition, protoResource *sdkproto.Resource, snapshot *telemetry.Snapshot) error {
 	resource, err := db.InsertWorkspaceResource(ctx, database.InsertWorkspaceResourceParams{
 		ID:         uuid.New(),
-		CreatedAt:  database.Now(),
+		CreatedAt:  dbtime.Now(),
 		JobID:      jobID,
 		Transition: transition,
 		Type:       protoResource.Type,
@@ -1180,38 +1406,25 @@ func InsertWorkspaceResource(ctx context.Context, db database.Store, jobID uuid.
 			}
 		}
 
-		// Set the default in case it was not provided (e.g. echo provider).
-		if prAgent.GetStartupScriptBehavior() == "" {
-			prAgent.StartupScriptBehavior = string(codersdk.WorkspaceAgentStartupScriptBehaviorNonBlocking)
-		}
-
 		agentID := uuid.New()
 		dbAgent, err := db.InsertWorkspaceAgent(ctx, database.InsertWorkspaceAgentParams{
-			ID:                   agentID,
-			CreatedAt:            database.Now(),
-			UpdatedAt:            database.Now(),
-			ResourceID:           resource.ID,
-			Name:                 prAgent.Name,
-			AuthToken:            authToken,
-			AuthInstanceID:       instanceID,
-			Architecture:         prAgent.Architecture,
-			EnvironmentVariables: env,
-			Directory:            prAgent.Directory,
-			OperatingSystem:      prAgent.OperatingSystem,
-			StartupScript: sql.NullString{
-				String: prAgent.StartupScript,
-				Valid:  prAgent.StartupScript != "",
-			},
-			ConnectionTimeoutSeconds:    prAgent.GetConnectionTimeoutSeconds(),
-			TroubleshootingURL:          prAgent.GetTroubleshootingUrl(),
-			MOTDFile:                    prAgent.GetMotdFile(),
-			StartupScriptBehavior:       database.StartupScriptBehavior(prAgent.GetStartupScriptBehavior()),
-			StartupScriptTimeoutSeconds: prAgent.GetStartupScriptTimeoutSeconds(),
-			ShutdownScript: sql.NullString{
-				String: prAgent.ShutdownScript,
-				Valid:  prAgent.ShutdownScript != "",
-			},
-			ShutdownScriptTimeoutSeconds: prAgent.GetShutdownScriptTimeoutSeconds(),
+			ID:                       agentID,
+			CreatedAt:                dbtime.Now(),
+			UpdatedAt:                dbtime.Now(),
+			ResourceID:               resource.ID,
+			Name:                     prAgent.Name,
+			AuthToken:                authToken,
+			AuthInstanceID:           instanceID,
+			Architecture:             prAgent.Architecture,
+			EnvironmentVariables:     env,
+			Directory:                prAgent.Directory,
+			OperatingSystem:          prAgent.OperatingSystem,
+			ConnectionTimeoutSeconds: prAgent.GetConnectionTimeoutSeconds(),
+			TroubleshootingURL:       prAgent.GetTroubleshootingUrl(),
+			MOTDFile:                 prAgent.GetMotdFile(),
+			DisplayApps:              convertDisplayApps(prAgent.GetDisplayApps()),
+			InstanceMetadata:         pqtype.NullRawMessage{},
+			ResourceMetadata:         pqtype.NullRawMessage{},
 		})
 		if err != nil {
 			return xerrors.Errorf("insert agent: %w", err)
@@ -1233,6 +1446,57 @@ func InsertWorkspaceResource(ctx context.Context, db database.Store, jobID uuid.
 			}
 		}
 
+		logSourceIDs := make([]uuid.UUID, 0, len(prAgent.Scripts))
+		logSourceDisplayNames := make([]string, 0, len(prAgent.Scripts))
+		logSourceIcons := make([]string, 0, len(prAgent.Scripts))
+		scriptLogPaths := make([]string, 0, len(prAgent.Scripts))
+		scriptSources := make([]string, 0, len(prAgent.Scripts))
+		scriptCron := make([]string, 0, len(prAgent.Scripts))
+		scriptTimeout := make([]int32, 0, len(prAgent.Scripts))
+		scriptStartBlocksLogin := make([]bool, 0, len(prAgent.Scripts))
+		scriptRunOnStart := make([]bool, 0, len(prAgent.Scripts))
+		scriptRunOnStop := make([]bool, 0, len(prAgent.Scripts))
+
+		for _, script := range prAgent.Scripts {
+			logSourceIDs = append(logSourceIDs, uuid.New())
+			logSourceDisplayNames = append(logSourceDisplayNames, script.DisplayName)
+			logSourceIcons = append(logSourceIcons, script.Icon)
+			scriptLogPaths = append(scriptLogPaths, script.LogPath)
+			scriptSources = append(scriptSources, script.Script)
+			scriptCron = append(scriptCron, script.Cron)
+			scriptTimeout = append(scriptTimeout, script.TimeoutSeconds)
+			scriptStartBlocksLogin = append(scriptStartBlocksLogin, script.StartBlocksLogin)
+			scriptRunOnStart = append(scriptRunOnStart, script.RunOnStart)
+			scriptRunOnStop = append(scriptRunOnStop, script.RunOnStop)
+		}
+
+		_, err = db.InsertWorkspaceAgentLogSources(ctx, database.InsertWorkspaceAgentLogSourcesParams{
+			WorkspaceAgentID: agentID,
+			ID:               logSourceIDs,
+			CreatedAt:        dbtime.Now(),
+			DisplayName:      logSourceDisplayNames,
+			Icon:             logSourceIcons,
+		})
+		if err != nil {
+			return xerrors.Errorf("insert agent log sources: %w", err)
+		}
+
+		_, err = db.InsertWorkspaceAgentScripts(ctx, database.InsertWorkspaceAgentScriptsParams{
+			WorkspaceAgentID: agentID,
+			LogSourceID:      logSourceIDs,
+			LogPath:          scriptLogPaths,
+			CreatedAt:        dbtime.Now(),
+			Script:           scriptSources,
+			Cron:             scriptCron,
+			TimeoutSeconds:   scriptTimeout,
+			StartBlocksLogin: scriptStartBlocksLogin,
+			RunOnStart:       scriptRunOnStart,
+			RunOnStop:        scriptRunOnStop,
+		})
+		if err != nil {
+			return xerrors.Errorf("insert agent scripts: %w", err)
+		}
+
 		for _, app := range prAgent.Apps {
 			slug := app.Slug
 			if slug == "" {
@@ -1264,7 +1528,7 @@ func InsertWorkspaceResource(ctx context.Context, db database.Store, jobID uuid.
 
 			dbApp, err := db.InsertWorkspaceApp(ctx, database.InsertWorkspaceAppParams{
 				ID:          uuid.New(),
-				CreatedAt:   database.Now(),
+				CreatedAt:   dbtime.Now(),
 				AgentID:     dbAgent.ID,
 				Slug:        slug,
 				DisplayName: app.DisplayName,
@@ -1318,19 +1582,19 @@ func workspaceSessionTokenName(workspace database.Workspace) string {
 	return fmt.Sprintf("%s_%s_session_token", workspace.OwnerID, workspace.ID)
 }
 
-func (server *Server) regenerateSessionToken(ctx context.Context, user database.User, workspace database.Workspace) (string, error) {
+func (s *server) regenerateSessionToken(ctx context.Context, user database.User, workspace database.Workspace) (string, error) {
 	newkey, sessionToken, err := apikey.Generate(apikey.CreateParams{
 		UserID:           user.ID,
 		LoginType:        user.LoginType,
-		DeploymentValues: server.DeploymentValues,
+		DeploymentValues: s.DeploymentValues,
 		TokenName:        workspaceSessionTokenName(workspace),
-		LifetimeSeconds:  int64(server.DeploymentValues.MaxTokenLifetime.Value().Seconds()),
+		LifetimeSeconds:  int64(s.DeploymentValues.MaxTokenLifetime.Value().Seconds()),
 	})
 	if err != nil {
 		return "", xerrors.Errorf("generate API key: %w", err)
 	}
 
-	err = server.Database.InTx(func(tx database.Store) error {
+	err = s.Database.InTx(func(tx database.Store) error {
 		err := deleteSessionToken(ctx, tx, workspace)
 		if err != nil {
 			return xerrors.Errorf("delete session token: %w", err)
@@ -1386,7 +1650,7 @@ func obtainOIDCAccessToken(ctx context.Context, db database.Store, oidcConfig ht
 		return "", xerrors.Errorf("get owner oidc link: %w", err)
 	}
 
-	if link.OAuthExpiry.Before(database.Now()) && !link.OAuthExpiry.IsZero() && link.OAuthRefreshToken != "" {
+	if link.OAuthExpiry.Before(dbtime.Now()) && !link.OAuthExpiry.IsZero() && link.OAuthRefreshToken != "" {
 		token, err := oidcConfig.TokenSource(ctx, &oauth2.Token{
 			AccessToken:  link.OAuthAccessToken,
 			RefreshToken: link.OAuthRefreshToken,
@@ -1403,11 +1667,13 @@ func obtainOIDCAccessToken(ctx context.Context, db database.Store, oidcConfig ht
 		link.OAuthExpiry = token.Expiry
 
 		link, err = db.UpdateUserLink(ctx, database.UpdateUserLinkParams{
-			UserID:            userID,
-			LoginType:         database.LoginTypeOIDC,
-			OAuthAccessToken:  link.OAuthAccessToken,
-			OAuthRefreshToken: link.OAuthRefreshToken,
-			OAuthExpiry:       link.OAuthExpiry,
+			UserID:                 userID,
+			LoginType:              database.LoginTypeOIDC,
+			OAuthAccessToken:       link.OAuthAccessToken,
+			OAuthAccessTokenKeyID:  sql.NullString{}, // set by dbcrypt if required
+			OAuthRefreshToken:      link.OAuthRefreshToken,
+			OAuthRefreshTokenKeyID: sql.NullString{}, // set by dbcrypt if required
+			OAuthExpiry:            link.OAuthExpiry,
 		})
 		if err != nil {
 			return "", xerrors.Errorf("update user link: %w", err)
@@ -1549,3 +1815,28 @@ func redactTemplateVariable(templateVariable *sdkproto.TemplateVariable) *sdkpro
 	}
 	return maybeRedacted
 }
+
+func convertDisplayApps(apps *sdkproto.DisplayApps) []database.DisplayApp {
+	// This shouldn't happen but let's avoid panicking. It also makes
+	// writing tests a bit easier.
+	if apps == nil {
+		return nil
+	}
+	dapps := make([]database.DisplayApp, 0, 5)
+	if apps.Vscode {
+		dapps = append(dapps, database.DisplayAppVscode)
+	}
+	if apps.VscodeInsiders {
+		dapps = append(dapps, database.DisplayAppVscodeInsiders)
+	}
+	if apps.SshHelper {
+		dapps = append(dapps, database.DisplayAppSSHHelper)
+	}
+	if apps.PortForwardingHelper {
+		dapps = append(dapps, database.DisplayAppPortForwardingHelper)
+	}
+	if apps.WebTerminal {
+		dapps = append(dapps, database.DisplayAppWebTerminal)
+	}
+	return dapps
+}
diff --git a/coderd/provisionerdserver/provisionerdserver_internal_test.go b/coderd/provisionerdserver/provisionerdserver_internal_test.go
index 9652f8e7c7f82..acf9508307070 100644
--- a/coderd/provisionerdserver/provisionerdserver_internal_test.go
+++ b/coderd/provisionerdserver/provisionerdserver_internal_test.go
@@ -9,10 +9,11 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/oauth2"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestObtainOIDCAccessToken(t *testing.T) {
@@ -20,31 +21,31 @@ func TestObtainOIDCAccessToken(t *testing.T) {
 	ctx := context.Background()
 	t.Run("NoToken", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		_, err := obtainOIDCAccessToken(ctx, db, nil, uuid.Nil)
 		require.NoError(t, err)
 	})
 	t.Run("InvalidConfig", func(t *testing.T) {
 		// We still want OIDC to succeed even if exchanging the token fails.
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		user := dbgen.User(t, db, database.User{})
 		dbgen.UserLink(t, db, database.UserLink{
 			UserID:      user.ID,
 			LoginType:   database.LoginTypeOIDC,
-			OAuthExpiry: database.Now().Add(-time.Hour),
+			OAuthExpiry: dbtime.Now().Add(-time.Hour),
 		})
 		_, err := obtainOIDCAccessToken(ctx, db, &oauth2.Config{}, user.ID)
 		require.NoError(t, err)
 	})
 	t.Run("Exchange", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		user := dbgen.User(t, db, database.User{})
 		dbgen.UserLink(t, db, database.UserLink{
 			UserID:      user.ID,
 			LoginType:   database.LoginTypeOIDC,
-			OAuthExpiry: database.Now().Add(-time.Hour),
+			OAuthExpiry: dbtime.Now().Add(-time.Hour),
 		})
 		_, err := obtainOIDCAccessToken(ctx, db, &testutil.OAuth2Config{
 			Token: &oauth2.Token{
diff --git a/coderd/provisionerdserver/provisionerdserver_test.go b/coderd/provisionerdserver/provisionerdserver_test.go
index ee0faca6d2e84..bc16b01c1e8cf 100644
--- a/coderd/provisionerdserver/provisionerdserver_test.go
+++ b/coderd/provisionerdserver/provisionerdserver_test.go
@@ -4,12 +4,19 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
+	"io"
 	"net/url"
 	"strings"
+	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
 
+	"golang.org/x/xerrors"
+	"storj.io/drpc"
+
+	"cdr.dev/slog"
+
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -17,21 +24,23 @@ import (
 	"golang.org/x/oauth2"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/provisionerdserver"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisionerd/proto"
-	"github.com/coder/coder/provisionersdk"
-	sdkproto "github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/coderd/provisionerdserver"
+	"github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisionerd/proto"
+	"github.com/coder/coder/v2/provisionersdk"
+	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func mockAuditor() *atomic.Pointer[audit.Auditor] {
@@ -55,393 +64,411 @@ func testUserQuietHoursScheduleStore() *atomic.Pointer[schedule.UserQuietHoursSc
 	return ptr
 }
 
-func TestAcquireJob(t *testing.T) {
+func TestAcquireJob_LongPoll(t *testing.T) {
 	t.Parallel()
-	t.Run("Debounce", func(t *testing.T) {
-		t.Parallel()
-		db := dbfake.New()
-		ps := pubsub.NewInMemory()
-		srv := &provisionerdserver.Server{
-			ID:                          uuid.New(),
-			Logger:                      slogtest.Make(t, nil),
-			AccessURL:                   &url.URL{},
-			Provisioners:                []database.ProvisionerType{database.ProvisionerTypeEcho},
-			Database:                    db,
-			Pubsub:                      ps,
-			Telemetry:                   telemetry.NewNoop(),
-			AcquireJobDebounce:          time.Hour,
-			Auditor:                     mockAuditor(),
-			TemplateScheduleStore:       testTemplateScheduleStore(),
-			UserQuietHoursScheduleStore: testUserQuietHoursScheduleStore(),
-			Tracer:                      trace.NewNoopTracerProvider().Tracer("noop"),
-			DeploymentValues:            &codersdk.DeploymentValues{},
-		}
-		job, err := srv.AcquireJob(context.Background(), nil)
-		require.NoError(t, err)
-		require.Equal(t, &proto.AcquiredJob{}, job)
-		_, err = srv.Database.InsertProvisionerJob(context.Background(), database.InsertProvisionerJobParams{
-			ID:            uuid.New(),
-			InitiatorID:   uuid.New(),
-			Provisioner:   database.ProvisionerTypeEcho,
-			StorageMethod: database.ProvisionerStorageMethodFile,
-			Type:          database.ProvisionerJobTypeTemplateVersionDryRun,
-		})
-		require.NoError(t, err)
-		job, err = srv.AcquireJob(context.Background(), nil)
-		require.NoError(t, err)
-		require.Equal(t, &proto.AcquiredJob{}, job)
-	})
-	t.Run("NoJobs", func(t *testing.T) {
-		t.Parallel()
-		srv := setup(t, false)
-		job, err := srv.AcquireJob(context.Background(), nil)
-		require.NoError(t, err)
-		require.Equal(t, &proto.AcquiredJob{}, job)
-	})
-	t.Run("InitiatorNotFound", func(t *testing.T) {
-		t.Parallel()
-		srv := setup(t, false)
-		_, err := srv.Database.InsertProvisionerJob(context.Background(), database.InsertProvisionerJobParams{
-			ID:            uuid.New(),
-			InitiatorID:   uuid.New(),
-			Provisioner:   database.ProvisionerTypeEcho,
-			StorageMethod: database.ProvisionerStorageMethodFile,
-			Type:          database.ProvisionerJobTypeTemplateVersionDryRun,
-		})
-		require.NoError(t, err)
-		_, err = srv.AcquireJob(context.Background(), nil)
-		require.ErrorContains(t, err, "sql: no rows in result set")
-	})
-	t.Run("WorkspaceBuildJob", func(t *testing.T) {
-		t.Parallel()
-		srv := setup(t, false)
-		gitAuthProvider := "github"
-		// Set the max session token lifetime so we can assert we
-		// create an API key with an expiration within the bounds of the
-		// deployment config.
-		srv.DeploymentValues.MaxTokenLifetime = clibase.Duration(time.Hour)
-		srv.GitAuthConfigs = []*gitauth.Config{{
-			ID:           gitAuthProvider,
-			OAuth2Config: &testutil.OAuth2Config{},
-		}}
-		ctx := context.Background()
-
-		user := dbgen.User(t, srv.Database, database.User{})
-		link := dbgen.UserLink(t, srv.Database, database.UserLink{
-			LoginType:        database.LoginTypeOIDC,
-			UserID:           user.ID,
-			OAuthExpiry:      database.Now().Add(time.Hour),
-			OAuthAccessToken: "access-token",
-		})
-		dbgen.GitAuthLink(t, srv.Database, database.GitAuthLink{
-			ProviderID: gitAuthProvider,
-			UserID:     user.ID,
-		})
-		template := dbgen.Template(t, srv.Database, database.Template{
-			Name:        "template",
-			Provisioner: database.ProvisionerTypeEcho,
-		})
-		file := dbgen.File(t, srv.Database, database.File{CreatedBy: user.ID})
-		versionFile := dbgen.File(t, srv.Database, database.File{CreatedBy: user.ID})
-		version := dbgen.TemplateVersion(t, srv.Database, database.TemplateVersion{
-			TemplateID: uuid.NullUUID{
-				UUID:  template.ID,
-				Valid: true,
-			},
-			JobID: uuid.New(),
-		})
-		err := srv.Database.UpdateTemplateVersionGitAuthProvidersByJobID(ctx, database.UpdateTemplateVersionGitAuthProvidersByJobIDParams{
-			JobID:            version.JobID,
-			GitAuthProviders: []string{gitAuthProvider},
-			UpdatedAt:        database.Now(),
-		})
+	srv, _, _ := setup(t, false, &overrides{acquireJobLongPollDuration: time.Microsecond})
+	job, err := srv.AcquireJob(context.Background(), nil)
+	require.NoError(t, err)
+	require.Equal(t, &proto.AcquiredJob{}, job)
+}
+
+func TestAcquireJobWithCancel_Cancel(t *testing.T) {
+	t.Parallel()
+	srv, _, _ := setup(t, false, nil)
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+	fs := newFakeStream(ctx)
+	errCh := make(chan error)
+	go func() {
+		errCh <- srv.AcquireJobWithCancel(fs)
+	}()
+	fs.cancel()
+	select {
+	case <-ctx.Done():
+		t.Fatal("timed out waiting for AcquireJobWithCancel")
+	case err := <-errCh:
 		require.NoError(t, err)
-		// Import version job
-		_ = dbgen.ProvisionerJob(t, srv.Database, database.ProvisionerJob{
-			ID:            version.JobID,
-			InitiatorID:   user.ID,
-			FileID:        versionFile.ID,
-			Provisioner:   database.ProvisionerTypeEcho,
-			StorageMethod: database.ProvisionerStorageMethodFile,
-			Type:          database.ProvisionerJobTypeTemplateVersionImport,
-			Input: must(json.Marshal(provisionerdserver.TemplateVersionImportJob{
-				TemplateVersionID: version.ID,
-				UserVariableValues: []codersdk.VariableValue{
-					{Name: "second", Value: "bah"},
-				},
-			})),
-		})
-		_ = dbgen.TemplateVersionVariable(t, srv.Database, database.TemplateVersionVariable{
-			TemplateVersionID: version.ID,
-			Name:              "first",
-			Value:             "first_value",
-			DefaultValue:      "default_value",
-			Sensitive:         true,
-		})
-		_ = dbgen.TemplateVersionVariable(t, srv.Database, database.TemplateVersionVariable{
-			TemplateVersionID: version.ID,
-			Name:              "second",
-			Value:             "second_value",
-			DefaultValue:      "default_value",
-			Required:          true,
-			Sensitive:         false,
-		})
-		workspace := dbgen.Workspace(t, srv.Database, database.Workspace{
-			TemplateID: template.ID,
-			OwnerID:    user.ID,
-		})
-		build := dbgen.WorkspaceBuild(t, srv.Database, database.WorkspaceBuild{
-			WorkspaceID:       workspace.ID,
-			BuildNumber:       1,
-			JobID:             uuid.New(),
-			TemplateVersionID: version.ID,
-			Transition:        database.WorkspaceTransitionStart,
-			Reason:            database.BuildReasonInitiator,
-		})
-		_ = dbgen.ProvisionerJob(t, srv.Database, database.ProvisionerJob{
-			ID:            build.ID,
-			InitiatorID:   user.ID,
-			Provisioner:   database.ProvisionerTypeEcho,
-			StorageMethod: database.ProvisionerStorageMethodFile,
-			FileID:        file.ID,
-			Type:          database.ProvisionerJobTypeWorkspaceBuild,
-			Input: must(json.Marshal(provisionerdserver.WorkspaceProvisionJob{
-				WorkspaceBuildID: build.ID,
-			})),
-		})
+	}
+	job, err := fs.waitForJob()
+	require.NoError(t, err)
+	require.NotNil(t, job)
+	require.Equal(t, "", job.JobId)
+}
+
+func TestAcquireJob(t *testing.T) {
+	t.Parallel()
 
-		startPublished := make(chan struct{})
-		var closed bool
-		closeStartSubscribe, err := srv.Pubsub.Subscribe(codersdk.WorkspaceNotifyChannel(workspace.ID), func(_ context.Context, _ []byte) {
-			if !closed {
-				close(startPublished)
-				closed = true
+	// These test acquiring a single job without canceling, and tests both AcquireJob (deprecated) and
+	// AcquireJobWithCancel as the way to get the job.
+	cases := []struct {
+		name    string
+		acquire func(context.Context, proto.DRPCProvisionerDaemonServer) (*proto.AcquiredJob, error)
+	}{
+		{name: "Deprecated", acquire: func(ctx context.Context, srv proto.DRPCProvisionerDaemonServer) (*proto.AcquiredJob, error) {
+			return srv.AcquireJob(ctx, nil)
+		}},
+		{name: "WithCancel", acquire: func(ctx context.Context, srv proto.DRPCProvisionerDaemonServer) (*proto.AcquiredJob, error) {
+			fs := newFakeStream(ctx)
+			err := srv.AcquireJobWithCancel(fs)
+			if err != nil {
+				return nil, err
 			}
-		})
-		require.NoError(t, err)
-		defer closeStartSubscribe()
+			return fs.waitForJob()
+		}},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name+"_InitiatorNotFound", func(t *testing.T) {
+			t.Parallel()
+			srv, db, _ := setup(t, false, nil)
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+			defer cancel()
+			_, err := db.InsertProvisionerJob(context.Background(), database.InsertProvisionerJobParams{
+				ID:            uuid.New(),
+				InitiatorID:   uuid.New(),
+				Provisioner:   database.ProvisionerTypeEcho,
+				StorageMethod: database.ProvisionerStorageMethodFile,
+				Type:          database.ProvisionerJobTypeTemplateVersionDryRun,
+			})
+			require.NoError(t, err)
+			_, err = tc.acquire(ctx, srv)
+			require.ErrorContains(t, err, "sql: no rows in result set")
+		})
+		t.Run(tc.name+"_WorkspaceBuildJob", func(t *testing.T) {
+			t.Parallel()
+			// Set the max session token lifetime so we can assert we
+			// create an API key with an expiration within the bounds of the
+			// deployment config.
+			dv := &codersdk.DeploymentValues{MaxTokenLifetime: clibase.Duration(time.Hour)}
+			gitAuthProvider := "github"
+			srv, db, ps := setup(t, false, &overrides{
+				deploymentValues: dv,
+				externalAuthConfigs: []*externalauth.Config{{
+					ID:           gitAuthProvider,
+					OAuth2Config: &testutil.OAuth2Config{},
+				}},
+			})
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+			defer cancel()
 
-		var job *proto.AcquiredJob
+			user := dbgen.User(t, db, database.User{})
+			link := dbgen.UserLink(t, db, database.UserLink{
+				LoginType:        database.LoginTypeOIDC,
+				UserID:           user.ID,
+				OAuthExpiry:      dbtime.Now().Add(time.Hour),
+				OAuthAccessToken: "access-token",
+			})
+			dbgen.ExternalAuthLink(t, db, database.ExternalAuthLink{
+				ProviderID: gitAuthProvider,
+				UserID:     user.ID,
+			})
+			template := dbgen.Template(t, db, database.Template{
+				Name:        "template",
+				Provisioner: database.ProvisionerTypeEcho,
+			})
+			file := dbgen.File(t, db, database.File{CreatedBy: user.ID})
+			versionFile := dbgen.File(t, db, database.File{CreatedBy: user.ID})
+			version := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+				TemplateID: uuid.NullUUID{
+					UUID:  template.ID,
+					Valid: true,
+				},
+				JobID: uuid.New(),
+			})
+			err := db.UpdateTemplateVersionExternalAuthProvidersByJobID(ctx, database.UpdateTemplateVersionExternalAuthProvidersByJobIDParams{
+				JobID:                 version.JobID,
+				ExternalAuthProviders: []string{gitAuthProvider},
+				UpdatedAt:             dbtime.Now(),
+			})
+			require.NoError(t, err)
+			// Import version job
+			_ = dbgen.ProvisionerJob(t, db, ps, database.ProvisionerJob{
+				ID:            version.JobID,
+				InitiatorID:   user.ID,
+				FileID:        versionFile.ID,
+				Provisioner:   database.ProvisionerTypeEcho,
+				StorageMethod: database.ProvisionerStorageMethodFile,
+				Type:          database.ProvisionerJobTypeTemplateVersionImport,
+				Input: must(json.Marshal(provisionerdserver.TemplateVersionImportJob{
+					TemplateVersionID: version.ID,
+					UserVariableValues: []codersdk.VariableValue{
+						{Name: "second", Value: "bah"},
+					},
+				})),
+			})
+			_ = dbgen.TemplateVersionVariable(t, db, database.TemplateVersionVariable{
+				TemplateVersionID: version.ID,
+				Name:              "first",
+				Value:             "first_value",
+				DefaultValue:      "default_value",
+				Sensitive:         true,
+			})
+			_ = dbgen.TemplateVersionVariable(t, db, database.TemplateVersionVariable{
+				TemplateVersionID: version.ID,
+				Name:              "second",
+				Value:             "second_value",
+				DefaultValue:      "default_value",
+				Required:          true,
+				Sensitive:         false,
+			})
+			workspace := dbgen.Workspace(t, db, database.Workspace{
+				TemplateID: template.ID,
+				OwnerID:    user.ID,
+			})
+			build := dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
+				WorkspaceID:       workspace.ID,
+				BuildNumber:       1,
+				JobID:             uuid.New(),
+				TemplateVersionID: version.ID,
+				Transition:        database.WorkspaceTransitionStart,
+				Reason:            database.BuildReasonInitiator,
+			})
+			_ = dbgen.ProvisionerJob(t, db, ps, database.ProvisionerJob{
+				ID:            build.ID,
+				InitiatorID:   user.ID,
+				Provisioner:   database.ProvisionerTypeEcho,
+				StorageMethod: database.ProvisionerStorageMethodFile,
+				FileID:        file.ID,
+				Type:          database.ProvisionerJobTypeWorkspaceBuild,
+				Input: must(json.Marshal(provisionerdserver.WorkspaceProvisionJob{
+					WorkspaceBuildID: build.ID,
+				})),
+			})
 
-		for {
-			// Grab jobs until we find the workspace build job. There is also
-			// an import version job that we need to ignore.
-			job, err = srv.AcquireJob(ctx, nil)
+			startPublished := make(chan struct{})
+			var closed bool
+			closeStartSubscribe, err := ps.Subscribe(codersdk.WorkspaceNotifyChannel(workspace.ID), func(_ context.Context, _ []byte) {
+				if !closed {
+					close(startPublished)
+					closed = true
+				}
+			})
 			require.NoError(t, err)
-			if _, ok := job.Type.(*proto.AcquiredJob_WorkspaceBuild_); ok {
-				break
+			defer closeStartSubscribe()
+
+			var job *proto.AcquiredJob
+
+			for {
+				// Grab jobs until we find the workspace build job. There is also
+				// an import version job that we need to ignore.
+				job, err = tc.acquire(ctx, srv)
+				require.NoError(t, err)
+				if _, ok := job.Type.(*proto.AcquiredJob_WorkspaceBuild_); ok {
+					break
+				}
 			}
-		}
 
-		<-startPublished
+			<-startPublished
 
-		got, err := json.Marshal(job.Type)
-		require.NoError(t, err)
+			got, err := json.Marshal(job.Type)
+			require.NoError(t, err)
 
-		// Validate that a session token is generated during the job.
-		sessionToken := job.Type.(*proto.AcquiredJob_WorkspaceBuild_).WorkspaceBuild.Metadata.WorkspaceOwnerSessionToken
-		require.NotEmpty(t, sessionToken)
-		toks := strings.Split(sessionToken, "-")
-		require.Len(t, toks, 2, "invalid api key")
-		key, err := srv.Database.GetAPIKeyByID(ctx, toks[0])
-		require.NoError(t, err)
-		require.Equal(t, int64(srv.DeploymentValues.MaxTokenLifetime.Value().Seconds()), key.LifetimeSeconds)
-		require.WithinDuration(t, time.Now().Add(srv.DeploymentValues.MaxTokenLifetime.Value()), key.ExpiresAt, time.Minute)
-
-		want, err := json.Marshal(&proto.AcquiredJob_WorkspaceBuild_{
-			WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
-				WorkspaceBuildId: build.ID.String(),
-				WorkspaceName:    workspace.Name,
-				VariableValues: []*sdkproto.VariableValue{
-					{
-						Name:      "first",
-						Value:     "first_value",
-						Sensitive: true,
+			// Validate that a session token is generated during the job.
+			sessionToken := job.Type.(*proto.AcquiredJob_WorkspaceBuild_).WorkspaceBuild.Metadata.WorkspaceOwnerSessionToken
+			require.NotEmpty(t, sessionToken)
+			toks := strings.Split(sessionToken, "-")
+			require.Len(t, toks, 2, "invalid api key")
+			key, err := db.GetAPIKeyByID(ctx, toks[0])
+			require.NoError(t, err)
+			require.Equal(t, int64(dv.MaxTokenLifetime.Value().Seconds()), key.LifetimeSeconds)
+			require.WithinDuration(t, time.Now().Add(dv.MaxTokenLifetime.Value()), key.ExpiresAt, time.Minute)
+
+			want, err := json.Marshal(&proto.AcquiredJob_WorkspaceBuild_{
+				WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
+					WorkspaceBuildId: build.ID.String(),
+					WorkspaceName:    workspace.Name,
+					VariableValues: []*sdkproto.VariableValue{
+						{
+							Name:      "first",
+							Value:     "first_value",
+							Sensitive: true,
+						},
+						{
+							Name:  "second",
+							Value: "second_value",
+						},
 					},
-					{
-						Name:  "second",
-						Value: "second_value",
+					ExternalAuthProviders: []*sdkproto.ExternalAuthProvider{{
+						Id:          gitAuthProvider,
+						AccessToken: "access_token",
+					}},
+					Metadata: &sdkproto.Metadata{
+						CoderUrl:                      (&url.URL{}).String(),
+						WorkspaceTransition:           sdkproto.WorkspaceTransition_START,
+						WorkspaceName:                 workspace.Name,
+						WorkspaceOwner:                user.Username,
+						WorkspaceOwnerEmail:           user.Email,
+						WorkspaceOwnerOidcAccessToken: link.OAuthAccessToken,
+						WorkspaceId:                   workspace.ID.String(),
+						WorkspaceOwnerId:              user.ID.String(),
+						TemplateId:                    template.ID.String(),
+						TemplateName:                  template.Name,
+						TemplateVersion:               version.Name,
+						WorkspaceOwnerSessionToken:    sessionToken,
 					},
 				},
-				GitAuthProviders: []*sdkproto.GitAuthProvider{{
-					Id:          gitAuthProvider,
-					AccessToken: "access_token",
-				}},
-				Metadata: &sdkproto.Provision_Metadata{
-					CoderUrl:                      srv.AccessURL.String(),
-					WorkspaceTransition:           sdkproto.WorkspaceTransition_START,
-					WorkspaceName:                 workspace.Name,
-					WorkspaceOwner:                user.Username,
-					WorkspaceOwnerEmail:           user.Email,
-					WorkspaceOwnerOidcAccessToken: link.OAuthAccessToken,
-					WorkspaceId:                   workspace.ID.String(),
-					WorkspaceOwnerId:              user.ID.String(),
-					TemplateName:                  template.Name,
-					TemplateVersion:               version.Name,
-					WorkspaceOwnerSessionToken:    sessionToken,
-				},
-			},
-		})
-		require.NoError(t, err)
-
-		require.JSONEq(t, string(want), string(got))
-
-		// Assert that we delete the session token whenever
-		// a stop is issued.
-		stopbuild := dbgen.WorkspaceBuild(t, srv.Database, database.WorkspaceBuild{
-			WorkspaceID:       workspace.ID,
-			BuildNumber:       2,
-			JobID:             uuid.New(),
-			TemplateVersionID: version.ID,
-			Transition:        database.WorkspaceTransitionStop,
-			Reason:            database.BuildReasonInitiator,
-		})
-		_ = dbgen.ProvisionerJob(t, srv.Database, database.ProvisionerJob{
-			ID:            stopbuild.ID,
-			InitiatorID:   user.ID,
-			Provisioner:   database.ProvisionerTypeEcho,
-			StorageMethod: database.ProvisionerStorageMethodFile,
-			FileID:        file.ID,
-			Type:          database.ProvisionerJobTypeWorkspaceBuild,
-			Input: must(json.Marshal(provisionerdserver.WorkspaceProvisionJob{
-				WorkspaceBuildID: stopbuild.ID,
-			})),
-		})
-
-		stopPublished := make(chan struct{})
-		closeStopSubscribe, err := srv.Pubsub.Subscribe(codersdk.WorkspaceNotifyChannel(workspace.ID), func(_ context.Context, _ []byte) {
-			close(stopPublished)
-		})
-		require.NoError(t, err)
-		defer closeStopSubscribe()
+			})
+			require.NoError(t, err)
 
-		// Grab jobs until we find the workspace build job. There is also
-		// an import version job that we need to ignore.
-		job, err = srv.AcquireJob(ctx, nil)
-		require.NoError(t, err)
-		_, ok := job.Type.(*proto.AcquiredJob_WorkspaceBuild_)
-		require.True(t, ok, "acquired job not a workspace build?")
+			require.JSONEq(t, string(want), string(got))
 
-		<-stopPublished
+			// Assert that we delete the session token whenever
+			// a stop is issued.
+			stopbuild := dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
+				WorkspaceID:       workspace.ID,
+				BuildNumber:       2,
+				JobID:             uuid.New(),
+				TemplateVersionID: version.ID,
+				Transition:        database.WorkspaceTransitionStop,
+				Reason:            database.BuildReasonInitiator,
+			})
+			_ = dbgen.ProvisionerJob(t, db, ps, database.ProvisionerJob{
+				ID:            stopbuild.ID,
+				InitiatorID:   user.ID,
+				Provisioner:   database.ProvisionerTypeEcho,
+				StorageMethod: database.ProvisionerStorageMethodFile,
+				FileID:        file.ID,
+				Type:          database.ProvisionerJobTypeWorkspaceBuild,
+				Input: must(json.Marshal(provisionerdserver.WorkspaceProvisionJob{
+					WorkspaceBuildID: stopbuild.ID,
+				})),
+			})
 
-		// Validate that a session token is deleted during a stop job.
-		sessionToken = job.Type.(*proto.AcquiredJob_WorkspaceBuild_).WorkspaceBuild.Metadata.WorkspaceOwnerSessionToken
-		require.Empty(t, sessionToken)
-		_, err = srv.Database.GetAPIKeyByID(ctx, key.ID)
-		require.ErrorIs(t, err, sql.ErrNoRows)
-	})
+			stopPublished := make(chan struct{})
+			closeStopSubscribe, err := ps.Subscribe(codersdk.WorkspaceNotifyChannel(workspace.ID), func(_ context.Context, _ []byte) {
+				close(stopPublished)
+			})
+			require.NoError(t, err)
+			defer closeStopSubscribe()
 
-	t.Run("TemplateVersionDryRun", func(t *testing.T) {
-		t.Parallel()
-		srv := setup(t, false)
-		ctx := context.Background()
-
-		user := dbgen.User(t, srv.Database, database.User{})
-		version := dbgen.TemplateVersion(t, srv.Database, database.TemplateVersion{})
-		file := dbgen.File(t, srv.Database, database.File{CreatedBy: user.ID})
-		_ = dbgen.ProvisionerJob(t, srv.Database, database.ProvisionerJob{
-			InitiatorID:   user.ID,
-			Provisioner:   database.ProvisionerTypeEcho,
-			StorageMethod: database.ProvisionerStorageMethodFile,
-			FileID:        file.ID,
-			Type:          database.ProvisionerJobTypeTemplateVersionDryRun,
-			Input: must(json.Marshal(provisionerdserver.TemplateVersionDryRunJob{
-				TemplateVersionID: version.ID,
-				WorkspaceName:     "testing",
-			})),
-		})
+			// Grab jobs until we find the workspace build job. There is also
+			// an import version job that we need to ignore.
+			job, err = tc.acquire(ctx, srv)
+			require.NoError(t, err)
+			_, ok := job.Type.(*proto.AcquiredJob_WorkspaceBuild_)
+			require.True(t, ok, "acquired job not a workspace build?")
+
+			<-stopPublished
+
+			// Validate that a session token is deleted during a stop job.
+			sessionToken = job.Type.(*proto.AcquiredJob_WorkspaceBuild_).WorkspaceBuild.Metadata.WorkspaceOwnerSessionToken
+			require.Empty(t, sessionToken)
+			_, err = db.GetAPIKeyByID(ctx, key.ID)
+			require.ErrorIs(t, err, sql.ErrNoRows)
+		})
+
+		t.Run(tc.name+"_TemplateVersionDryRun", func(t *testing.T) {
+			t.Parallel()
+			srv, db, ps := setup(t, false, nil)
+			ctx := context.Background()
+
+			user := dbgen.User(t, db, database.User{})
+			version := dbgen.TemplateVersion(t, db, database.TemplateVersion{})
+			file := dbgen.File(t, db, database.File{CreatedBy: user.ID})
+			_ = dbgen.ProvisionerJob(t, db, ps, database.ProvisionerJob{
+				InitiatorID:   user.ID,
+				Provisioner:   database.ProvisionerTypeEcho,
+				StorageMethod: database.ProvisionerStorageMethodFile,
+				FileID:        file.ID,
+				Type:          database.ProvisionerJobTypeTemplateVersionDryRun,
+				Input: must(json.Marshal(provisionerdserver.TemplateVersionDryRunJob{
+					TemplateVersionID: version.ID,
+					WorkspaceName:     "testing",
+				})),
+			})
 
-		job, err := srv.AcquireJob(ctx, nil)
-		require.NoError(t, err)
+			job, err := tc.acquire(ctx, srv)
+			require.NoError(t, err)
 
-		got, err := json.Marshal(job.Type)
-		require.NoError(t, err)
+			got, err := json.Marshal(job.Type)
+			require.NoError(t, err)
 
-		want, err := json.Marshal(&proto.AcquiredJob_TemplateDryRun_{
-			TemplateDryRun: &proto.AcquiredJob_TemplateDryRun{
-				Metadata: &sdkproto.Provision_Metadata{
-					CoderUrl:      srv.AccessURL.String(),
-					WorkspaceName: "testing",
+			want, err := json.Marshal(&proto.AcquiredJob_TemplateDryRun_{
+				TemplateDryRun: &proto.AcquiredJob_TemplateDryRun{
+					Metadata: &sdkproto.Metadata{
+						CoderUrl:      (&url.URL{}).String(),
+						WorkspaceName: "testing",
+					},
 				},
-			},
-		})
-		require.NoError(t, err)
-		require.JSONEq(t, string(want), string(got))
-	})
-	t.Run("TemplateVersionImport", func(t *testing.T) {
-		t.Parallel()
-		srv := setup(t, false)
-		ctx := context.Background()
-
-		user := dbgen.User(t, srv.Database, database.User{})
-		file := dbgen.File(t, srv.Database, database.File{CreatedBy: user.ID})
-		_ = dbgen.ProvisionerJob(t, srv.Database, database.ProvisionerJob{
-			FileID:        file.ID,
-			InitiatorID:   user.ID,
-			Provisioner:   database.ProvisionerTypeEcho,
-			StorageMethod: database.ProvisionerStorageMethodFile,
-			Type:          database.ProvisionerJobTypeTemplateVersionImport,
-		})
+			})
+			require.NoError(t, err)
+			require.JSONEq(t, string(want), string(got))
+		})
+		t.Run(tc.name+"_TemplateVersionImport", func(t *testing.T) {
+			t.Parallel()
+			srv, db, ps := setup(t, false, nil)
+			ctx := context.Background()
+
+			user := dbgen.User(t, db, database.User{})
+			file := dbgen.File(t, db, database.File{CreatedBy: user.ID})
+			_ = dbgen.ProvisionerJob(t, db, ps, database.ProvisionerJob{
+				FileID:        file.ID,
+				InitiatorID:   user.ID,
+				Provisioner:   database.ProvisionerTypeEcho,
+				StorageMethod: database.ProvisionerStorageMethodFile,
+				Type:          database.ProvisionerJobTypeTemplateVersionImport,
+			})
 
-		job, err := srv.AcquireJob(ctx, nil)
-		require.NoError(t, err)
+			job, err := tc.acquire(ctx, srv)
+			require.NoError(t, err)
 
-		got, err := json.Marshal(job.Type)
-		require.NoError(t, err)
+			got, err := json.Marshal(job.Type)
+			require.NoError(t, err)
 
-		want, err := json.Marshal(&proto.AcquiredJob_TemplateImport_{
-			TemplateImport: &proto.AcquiredJob_TemplateImport{
-				Metadata: &sdkproto.Provision_Metadata{
-					CoderUrl: srv.AccessURL.String(),
-				},
-			},
-		})
-		require.NoError(t, err)
-		require.JSONEq(t, string(want), string(got))
-	})
-	t.Run("TemplateVersionImportWithUserVariable", func(t *testing.T) {
-		t.Parallel()
-		srv := setup(t, false)
-
-		user := dbgen.User(t, srv.Database, database.User{})
-		version := dbgen.TemplateVersion(t, srv.Database, database.TemplateVersion{})
-		file := dbgen.File(t, srv.Database, database.File{CreatedBy: user.ID})
-		_ = dbgen.ProvisionerJob(t, srv.Database, database.ProvisionerJob{
-			FileID:        file.ID,
-			InitiatorID:   user.ID,
-			Provisioner:   database.ProvisionerTypeEcho,
-			StorageMethod: database.ProvisionerStorageMethodFile,
-			Type:          database.ProvisionerJobTypeTemplateVersionImport,
-			Input: must(json.Marshal(provisionerdserver.TemplateVersionImportJob{
-				TemplateVersionID: version.ID,
-				UserVariableValues: []codersdk.VariableValue{
-					{Name: "first", Value: "first_value"},
+			want, err := json.Marshal(&proto.AcquiredJob_TemplateImport_{
+				TemplateImport: &proto.AcquiredJob_TemplateImport{
+					Metadata: &sdkproto.Metadata{
+						CoderUrl: (&url.URL{}).String(),
+					},
 				},
-			})),
-		})
+			})
+			require.NoError(t, err)
+			require.JSONEq(t, string(want), string(got))
+		})
+		t.Run(tc.name+"_TemplateVersionImportWithUserVariable", func(t *testing.T) {
+			t.Parallel()
+			srv, db, ps := setup(t, false, nil)
+
+			user := dbgen.User(t, db, database.User{})
+			version := dbgen.TemplateVersion(t, db, database.TemplateVersion{})
+			file := dbgen.File(t, db, database.File{CreatedBy: user.ID})
+			_ = dbgen.ProvisionerJob(t, db, ps, database.ProvisionerJob{
+				FileID:        file.ID,
+				InitiatorID:   user.ID,
+				Provisioner:   database.ProvisionerTypeEcho,
+				StorageMethod: database.ProvisionerStorageMethodFile,
+				Type:          database.ProvisionerJobTypeTemplateVersionImport,
+				Input: must(json.Marshal(provisionerdserver.TemplateVersionImportJob{
+					TemplateVersionID: version.ID,
+					UserVariableValues: []codersdk.VariableValue{
+						{Name: "first", Value: "first_value"},
+					},
+				})),
+			})
 
-		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
-		defer cancel()
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+			defer cancel()
 
-		job, err := srv.AcquireJob(ctx, nil)
-		require.NoError(t, err)
+			job, err := tc.acquire(ctx, srv)
+			require.NoError(t, err)
 
-		got, err := json.Marshal(job.Type)
-		require.NoError(t, err)
+			got, err := json.Marshal(job.Type)
+			require.NoError(t, err)
 
-		want, err := json.Marshal(&proto.AcquiredJob_TemplateImport_{
-			TemplateImport: &proto.AcquiredJob_TemplateImport{
-				UserVariableValues: []*sdkproto.VariableValue{
-					{Name: "first", Sensitive: true, Value: "first_value"},
-				},
-				Metadata: &sdkproto.Provision_Metadata{
-					CoderUrl: srv.AccessURL.String(),
+			want, err := json.Marshal(&proto.AcquiredJob_TemplateImport_{
+				TemplateImport: &proto.AcquiredJob_TemplateImport{
+					UserVariableValues: []*sdkproto.VariableValue{
+						{Name: "first", Sensitive: true, Value: "first_value"},
+					},
+					Metadata: &sdkproto.Metadata{
+						CoderUrl: (&url.URL{}).String(),
+					},
 				},
-			},
+			})
+			require.NoError(t, err)
+			require.JSONEq(t, string(want), string(got))
 		})
-		require.NoError(t, err)
-		require.JSONEq(t, string(want), string(got))
-	})
+	}
 }
 
 func TestUpdateJob(t *testing.T) {
@@ -449,7 +476,7 @@ func TestUpdateJob(t *testing.T) {
 	ctx := context.Background()
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
+		srv, _, _ := setup(t, false, nil)
 		_, err := srv.UpdateJob(ctx, &proto.UpdateJobRequest{
 			JobId: "hello",
 		})
@@ -462,8 +489,8 @@ func TestUpdateJob(t *testing.T) {
 	})
 	t.Run("NotRunning", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
-		job, err := srv.Database.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
+		srv, db, _ := setup(t, false, nil)
+		job, err := db.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
 			ID:            uuid.New(),
 			Provisioner:   database.ProvisionerTypeEcho,
 			StorageMethod: database.ProvisionerStorageMethodFile,
@@ -478,15 +505,15 @@ func TestUpdateJob(t *testing.T) {
 	// This test prevents runners from updating jobs they don't own!
 	t.Run("NotOwner", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
-		job, err := srv.Database.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
+		srv, db, _ := setup(t, false, nil)
+		job, err := db.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
 			ID:            uuid.New(),
 			Provisioner:   database.ProvisionerTypeEcho,
 			StorageMethod: database.ProvisionerStorageMethodFile,
 			Type:          database.ProvisionerJobTypeTemplateVersionDryRun,
 		})
 		require.NoError(t, err)
-		_, err = srv.Database.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+		_, err = db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
 			WorkerID: uuid.NullUUID{
 				UUID:  uuid.New(),
 				Valid: true,
@@ -500,17 +527,17 @@ func TestUpdateJob(t *testing.T) {
 		require.ErrorContains(t, err, "you don't own this job")
 	})
 
-	setupJob := func(t *testing.T, srv *provisionerdserver.Server) uuid.UUID {
-		job, err := srv.Database.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
+	setupJob := func(t *testing.T, db database.Store, srvID uuid.UUID) uuid.UUID {
+		job, err := db.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
 			ID:            uuid.New(),
 			Provisioner:   database.ProvisionerTypeEcho,
 			Type:          database.ProvisionerJobTypeTemplateVersionImport,
 			StorageMethod: database.ProvisionerStorageMethodFile,
 		})
 		require.NoError(t, err)
-		_, err = srv.Database.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+		_, err = db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
 			WorkerID: uuid.NullUUID{
-				UUID:  srv.ID,
+				UUID:  srvID,
 				Valid: true,
 			},
 			Types: []database.ProvisionerType{database.ProvisionerTypeEcho},
@@ -521,8 +548,9 @@ func TestUpdateJob(t *testing.T) {
 
 	t.Run("Success", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
-		job := setupJob(t, srv)
+		srvID := uuid.New()
+		srv, db, _ := setup(t, false, &overrides{id: &srvID})
+		job := setupJob(t, db, srvID)
 		_, err := srv.UpdateJob(ctx, &proto.UpdateJobRequest{
 			JobId: job.String(),
 		})
@@ -531,12 +559,13 @@ func TestUpdateJob(t *testing.T) {
 
 	t.Run("Logs", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
-		job := setupJob(t, srv)
+		srvID := uuid.New()
+		srv, db, ps := setup(t, false, &overrides{id: &srvID})
+		job := setupJob(t, db, srvID)
 
 		published := make(chan struct{})
 
-		closeListener, err := srv.Pubsub.Subscribe(provisionersdk.ProvisionerJobLogsNotifyChannel(job), func(_ context.Context, _ []byte) {
+		closeListener, err := ps.Subscribe(provisionersdk.ProvisionerJobLogsNotifyChannel(job), func(_ context.Context, _ []byte) {
 			close(published)
 		})
 		require.NoError(t, err)
@@ -556,10 +585,11 @@ func TestUpdateJob(t *testing.T) {
 	})
 	t.Run("Readme", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
-		job := setupJob(t, srv)
+		srvID := uuid.New()
+		srv, db, _ := setup(t, false, &overrides{id: &srvID})
+		job := setupJob(t, db, srvID)
 		versionID := uuid.New()
-		err := srv.Database.InsertTemplateVersion(ctx, database.InsertTemplateVersionParams{
+		err := db.InsertTemplateVersion(ctx, database.InsertTemplateVersionParams{
 			ID:    versionID,
 			JobID: job,
 		})
@@ -570,7 +600,7 @@ func TestUpdateJob(t *testing.T) {
 		})
 		require.NoError(t, err)
 
-		version, err := srv.Database.GetTemplateVersionByID(ctx, versionID)
+		version, err := db.GetTemplateVersionByID(ctx, versionID)
 		require.NoError(t, err)
 		require.Equal(t, "# hello world", version.Readme)
 	})
@@ -582,10 +612,11 @@ func TestUpdateJob(t *testing.T) {
 			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 			defer cancel()
 
-			srv := setup(t, false)
-			job := setupJob(t, srv)
+			srvID := uuid.New()
+			srv, db, _ := setup(t, false, &overrides{id: &srvID})
+			job := setupJob(t, db, srvID)
 			versionID := uuid.New()
-			err := srv.Database.InsertTemplateVersion(ctx, database.InsertTemplateVersionParams{
+			err := db.InsertTemplateVersion(ctx, database.InsertTemplateVersionParams{
 				ID:    versionID,
 				JobID: job,
 			})
@@ -618,7 +649,7 @@ func TestUpdateJob(t *testing.T) {
 			require.NoError(t, err)
 			require.Len(t, response.VariableValues, 2)
 
-			templateVariables, err := srv.Database.GetTemplateVersionVariables(ctx, versionID)
+			templateVariables, err := db.GetTemplateVersionVariables(ctx, versionID)
 			require.NoError(t, err)
 			require.Len(t, templateVariables, 2)
 			require.Equal(t, templateVariables[0].Value, firstTemplateVariable.DefaultValue)
@@ -629,10 +660,11 @@ func TestUpdateJob(t *testing.T) {
 			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 			defer cancel()
 
-			srv := setup(t, false)
-			job := setupJob(t, srv)
+			srvID := uuid.New()
+			srv, db, _ := setup(t, false, &overrides{id: &srvID})
+			job := setupJob(t, db, srvID)
 			versionID := uuid.New()
-			err := srv.Database.InsertTemplateVersion(ctx, database.InsertTemplateVersionParams{
+			err := db.InsertTemplateVersion(ctx, database.InsertTemplateVersionParams{
 				ID:    versionID,
 				JobID: job,
 			})
@@ -661,7 +693,7 @@ func TestUpdateJob(t *testing.T) {
 
 			// Even though there is an error returned, variables are stored in the database
 			// to show the schema in the site UI.
-			templateVariables, err := srv.Database.GetTemplateVersionVariables(ctx, versionID)
+			templateVariables, err := db.GetTemplateVersionVariables(ctx, versionID)
 			require.NoError(t, err)
 			require.Len(t, templateVariables, 2)
 			require.Equal(t, templateVariables[0].Value, firstTemplateVariable.DefaultValue)
@@ -675,7 +707,7 @@ func TestFailJob(t *testing.T) {
 	ctx := context.Background()
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
+		srv, _, _ := setup(t, false, nil)
 		_, err := srv.FailJob(ctx, &proto.FailedJob{
 			JobId: "hello",
 		})
@@ -689,15 +721,15 @@ func TestFailJob(t *testing.T) {
 	// This test prevents runners from updating jobs they don't own!
 	t.Run("NotOwner", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
-		job, err := srv.Database.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
+		srv, db, _ := setup(t, false, nil)
+		job, err := db.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
 			ID:            uuid.New(),
 			Provisioner:   database.ProvisionerTypeEcho,
 			StorageMethod: database.ProvisionerStorageMethodFile,
 			Type:          database.ProvisionerJobTypeTemplateVersionImport,
 		})
 		require.NoError(t, err)
-		_, err = srv.Database.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+		_, err = db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
 			WorkerID: uuid.NullUUID{
 				UUID:  uuid.New(),
 				Valid: true,
@@ -712,26 +744,27 @@ func TestFailJob(t *testing.T) {
 	})
 	t.Run("AlreadyCompleted", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
-		job, err := srv.Database.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
+		srvID := uuid.New()
+		srv, db, _ := setup(t, false, &overrides{id: &srvID})
+		job, err := db.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
 			ID:            uuid.New(),
 			Provisioner:   database.ProvisionerTypeEcho,
 			Type:          database.ProvisionerJobTypeTemplateVersionImport,
 			StorageMethod: database.ProvisionerStorageMethodFile,
 		})
 		require.NoError(t, err)
-		_, err = srv.Database.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+		_, err = db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
 			WorkerID: uuid.NullUUID{
-				UUID:  srv.ID,
+				UUID:  srvID,
 				Valid: true,
 			},
 			Types: []database.ProvisionerType{database.ProvisionerTypeEcho},
 		})
 		require.NoError(t, err)
-		err = srv.Database.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
+		err = db.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
 			ID: job.ID,
 			CompletedAt: sql.NullTime{
-				Time:  database.Now(),
+				Time:  dbtime.Now(),
 				Valid: true,
 			},
 		})
@@ -747,13 +780,15 @@ func TestFailJob(t *testing.T) {
 		//
 		//	(*Server).FailJob       audit log - get build {"error": "sql: no rows in result set"}
 		ignoreLogErrors := true
-		srv := setup(t, ignoreLogErrors)
-		workspace, err := srv.Database.InsertWorkspace(ctx, database.InsertWorkspaceParams{
-			ID: uuid.New(),
+		srvID := uuid.New()
+		srv, db, ps := setup(t, ignoreLogErrors, &overrides{id: &srvID})
+		workspace, err := db.InsertWorkspace(ctx, database.InsertWorkspaceParams{
+			ID:               uuid.New(),
+			AutomaticUpdates: database.AutomaticUpdatesNever,
 		})
 		require.NoError(t, err)
 		buildID := uuid.New()
-		err = srv.Database.InsertWorkspaceBuild(ctx, database.InsertWorkspaceBuildParams{
+		err = db.InsertWorkspaceBuild(ctx, database.InsertWorkspaceBuildParams{
 			ID:          buildID,
 			WorkspaceID: workspace.ID,
 			Transition:  database.WorkspaceTransitionStart,
@@ -765,7 +800,7 @@ func TestFailJob(t *testing.T) {
 		})
 		require.NoError(t, err)
 
-		job, err := srv.Database.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
+		job, err := db.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
 			ID:            uuid.New(),
 			Input:         input,
 			Provisioner:   database.ProvisionerTypeEcho,
@@ -773,9 +808,9 @@ func TestFailJob(t *testing.T) {
 			StorageMethod: database.ProvisionerStorageMethodFile,
 		})
 		require.NoError(t, err)
-		_, err = srv.Database.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+		_, err = db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
 			WorkerID: uuid.NullUUID{
-				UUID:  srv.ID,
+				UUID:  srvID,
 				Valid: true,
 			},
 			Types: []database.ProvisionerType{database.ProvisionerTypeEcho},
@@ -783,13 +818,13 @@ func TestFailJob(t *testing.T) {
 		require.NoError(t, err)
 
 		publishedWorkspace := make(chan struct{})
-		closeWorkspaceSubscribe, err := srv.Pubsub.Subscribe(codersdk.WorkspaceNotifyChannel(workspace.ID), func(_ context.Context, _ []byte) {
+		closeWorkspaceSubscribe, err := ps.Subscribe(codersdk.WorkspaceNotifyChannel(workspace.ID), func(_ context.Context, _ []byte) {
 			close(publishedWorkspace)
 		})
 		require.NoError(t, err)
 		defer closeWorkspaceSubscribe()
 		publishedLogs := make(chan struct{})
-		closeLogsSubscribe, err := srv.Pubsub.Subscribe(provisionersdk.ProvisionerJobLogsNotifyChannel(job.ID), func(_ context.Context, _ []byte) {
+		closeLogsSubscribe, err := ps.Subscribe(provisionersdk.ProvisionerJobLogsNotifyChannel(job.ID), func(_ context.Context, _ []byte) {
 			close(publishedLogs)
 		})
 		require.NoError(t, err)
@@ -806,7 +841,7 @@ func TestFailJob(t *testing.T) {
 		require.NoError(t, err)
 		<-publishedWorkspace
 		<-publishedLogs
-		build, err := srv.Database.GetWorkspaceBuildByID(ctx, buildID)
+		build, err := db.GetWorkspaceBuildByID(ctx, buildID)
 		require.NoError(t, err)
 		require.Equal(t, "some state", string(build.ProvisionerState))
 	})
@@ -817,7 +852,7 @@ func TestCompleteJob(t *testing.T) {
 	ctx := context.Background()
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
+		srv, _, _ := setup(t, false, nil)
 		_, err := srv.CompleteJob(ctx, &proto.CompletedJob{
 			JobId: "hello",
 		})
@@ -831,15 +866,15 @@ func TestCompleteJob(t *testing.T) {
 	// This test prevents runners from updating jobs they don't own!
 	t.Run("NotOwner", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
-		job, err := srv.Database.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
+		srv, db, _ := setup(t, false, nil)
+		job, err := db.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
 			ID:            uuid.New(),
 			Provisioner:   database.ProvisionerTypeEcho,
 			StorageMethod: database.ProvisionerStorageMethodFile,
 			Type:          database.ProvisionerJobTypeWorkspaceBuild,
 		})
 		require.NoError(t, err)
-		_, err = srv.Database.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+		_, err = db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
 			WorkerID: uuid.NullUUID{
 				UUID:  uuid.New(),
 				Valid: true,
@@ -852,17 +887,19 @@ func TestCompleteJob(t *testing.T) {
 		})
 		require.ErrorContains(t, err, "you don't own this job")
 	})
-	t.Run("TemplateImport", func(t *testing.T) {
+
+	t.Run("TemplateImport_MissingGitAuth", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
+		srvID := uuid.New()
+		srv, db, _ := setup(t, false, &overrides{id: &srvID})
 		jobID := uuid.New()
 		versionID := uuid.New()
-		err := srv.Database.InsertTemplateVersion(ctx, database.InsertTemplateVersionParams{
+		err := db.InsertTemplateVersion(ctx, database.InsertTemplateVersionParams{
 			ID:    versionID,
 			JobID: jobID,
 		})
 		require.NoError(t, err)
-		job, err := srv.Database.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
+		job, err := db.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
 			ID:            jobID,
 			Provisioner:   database.ProvisionerTypeEcho,
 			Input:         []byte(`{"template_version_id": "` + versionID.String() + `"}`),
@@ -870,9 +907,9 @@ func TestCompleteJob(t *testing.T) {
 			Type:          database.ProvisionerJobTypeWorkspaceBuild,
 		})
 		require.NoError(t, err)
-		_, err = srv.Database.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+		_, err = db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
 			WorkerID: uuid.NullUUID{
-				UUID:  srv.ID,
+				UUID:  srvID,
 				Valid: true,
 			},
 			Types: []database.ProvisionerType{database.ProvisionerTypeEcho},
@@ -887,22 +924,69 @@ func TestCompleteJob(t *testing.T) {
 							Name: "hello",
 							Type: "aws_instance",
 						}},
-						StopResources:    []*sdkproto.Resource{},
-						GitAuthProviders: []string{"github"},
+						StopResources:         []*sdkproto.Resource{},
+						ExternalAuthProviders: []string{"github"},
 					},
 				},
 			})
 			require.NoError(t, err)
 		}
 		completeJob()
-		job, err = srv.Database.GetProvisionerJobByID(ctx, job.ID)
+		job, err = db.GetProvisionerJobByID(ctx, job.ID)
+		require.NoError(t, err)
+		require.Contains(t, job.Error.String, `external auth provider "github" is not configured`)
+	})
+
+	t.Run("TemplateImport_WithGitAuth", func(t *testing.T) {
+		t.Parallel()
+		srvID := uuid.New()
+		srv, db, _ := setup(t, false, &overrides{
+			id: &srvID,
+			externalAuthConfigs: []*externalauth.Config{{
+				ID: "github",
+			}},
+		})
+		jobID := uuid.New()
+		versionID := uuid.New()
+		err := db.InsertTemplateVersion(ctx, database.InsertTemplateVersionParams{
+			ID:    versionID,
+			JobID: jobID,
+		})
+		require.NoError(t, err)
+		job, err := db.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
+			ID:            jobID,
+			Provisioner:   database.ProvisionerTypeEcho,
+			Input:         []byte(`{"template_version_id": "` + versionID.String() + `"}`),
+			StorageMethod: database.ProvisionerStorageMethodFile,
+			Type:          database.ProvisionerJobTypeWorkspaceBuild,
+		})
+		require.NoError(t, err)
+		_, err = db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+			WorkerID: uuid.NullUUID{
+				UUID:  srvID,
+				Valid: true,
+			},
+			Types: []database.ProvisionerType{database.ProvisionerTypeEcho},
+		})
 		require.NoError(t, err)
-		require.Contains(t, job.Error.String, `git auth provider "github" is not configured`)
-		srv.GitAuthConfigs = []*gitauth.Config{{
-			ID: "github",
-		}}
+		completeJob := func() {
+			_, err = srv.CompleteJob(ctx, &proto.CompletedJob{
+				JobId: job.ID.String(),
+				Type: &proto.CompletedJob_TemplateImport_{
+					TemplateImport: &proto.CompletedJob_TemplateImport{
+						StartResources: []*sdkproto.Resource{{
+							Name: "hello",
+							Type: "aws_instance",
+						}},
+						StopResources:         []*sdkproto.Resource{},
+						ExternalAuthProviders: []string{"github"},
+					},
+				},
+			})
+			require.NoError(t, err)
+		}
 		completeJob()
-		job, err = srv.Database.GetProvisionerJobByID(ctx, job.ID)
+		job, err = db.GetProvisionerJobByID(ctx, job.ID)
 		require.NoError(t, err)
 		require.False(t, job.Error.Valid)
 	})
@@ -1022,35 +1106,37 @@ func TestCompleteJob(t *testing.T) {
 			t.Run(c.name, func(t *testing.T) {
 				t.Parallel()
 
-				srv := setup(t, false)
+				srvID := uuid.New()
+				tss := &atomic.Pointer[schedule.TemplateScheduleStore]{}
+				srv, db, ps := setup(t, false, &overrides{id: &srvID, templateScheduleStore: tss})
 
 				var store schedule.TemplateScheduleStore = schedule.MockTemplateScheduleStore{
 					GetFn: func(_ context.Context, _ database.Store, _ uuid.UUID) (schedule.TemplateScheduleOptions, error) {
 						return schedule.TemplateScheduleOptions{
-							UserAutostartEnabled:  false,
-							UserAutostopEnabled:   c.templateAllowAutostop,
-							DefaultTTL:            c.templateDefaultTTL,
-							MaxTTL:                c.templateMaxTTL,
-							UseRestartRequirement: false,
+							UserAutostartEnabled:   false,
+							UserAutostopEnabled:    c.templateAllowAutostop,
+							DefaultTTL:             c.templateDefaultTTL,
+							MaxTTL:                 c.templateMaxTTL,
+							UseAutostopRequirement: false,
 						}, nil
 					},
 				}
-				srv.TemplateScheduleStore.Store(&store)
+				tss.Store(&store)
 
-				user := dbgen.User(t, srv.Database, database.User{})
-				template := dbgen.Template(t, srv.Database, database.Template{
+				user := dbgen.User(t, db, database.User{})
+				template := dbgen.Template(t, db, database.Template{
 					Name:        "template",
 					Provisioner: database.ProvisionerTypeEcho,
 				})
-				err := srv.Database.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
+				err := db.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
 					ID:                 template.ID,
-					UpdatedAt:          database.Now(),
+					UpdatedAt:          dbtime.Now(),
 					AllowUserAutostart: c.templateAllowAutostop,
 					DefaultTTL:         int64(c.templateDefaultTTL),
 					MaxTTL:             int64(c.templateMaxTTL),
 				})
 				require.NoError(t, err)
-				file := dbgen.File(t, srv.Database, database.File{CreatedBy: user.ID})
+				file := dbgen.File(t, db, database.File{CreatedBy: user.ID})
 				workspaceTTL := sql.NullInt64{}
 				if c.workspaceTTL != 0 {
 					workspaceTTL = sql.NullInt64{
@@ -1058,33 +1144,33 @@ func TestCompleteJob(t *testing.T) {
 						Valid: true,
 					}
 				}
-				workspace := dbgen.Workspace(t, srv.Database, database.Workspace{
+				workspace := dbgen.Workspace(t, db, database.Workspace{
 					TemplateID: template.ID,
 					Ttl:        workspaceTTL,
 				})
-				version := dbgen.TemplateVersion(t, srv.Database, database.TemplateVersion{
+				version := dbgen.TemplateVersion(t, db, database.TemplateVersion{
 					TemplateID: uuid.NullUUID{
 						UUID:  template.ID,
 						Valid: true,
 					},
 					JobID: uuid.New(),
 				})
-				build := dbgen.WorkspaceBuild(t, srv.Database, database.WorkspaceBuild{
+				build := dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
 					WorkspaceID:       workspace.ID,
 					TemplateVersionID: version.ID,
 					Transition:        c.transition,
 					Reason:            database.BuildReasonInitiator,
 				})
-				job := dbgen.ProvisionerJob(t, srv.Database, database.ProvisionerJob{
+				job := dbgen.ProvisionerJob(t, db, ps, database.ProvisionerJob{
 					FileID: file.ID,
 					Type:   database.ProvisionerJobTypeWorkspaceBuild,
 					Input: must(json.Marshal(provisionerdserver.WorkspaceProvisionJob{
 						WorkspaceBuildID: build.ID,
 					})),
 				})
-				_, err = srv.Database.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+				_, err = db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
 					WorkerID: uuid.NullUUID{
-						UUID:  srv.ID,
+						UUID:  srvID,
 						Valid: true,
 					},
 					Types: []database.ProvisionerType{database.ProvisionerTypeEcho},
@@ -1092,13 +1178,13 @@ func TestCompleteJob(t *testing.T) {
 				require.NoError(t, err)
 
 				publishedWorkspace := make(chan struct{})
-				closeWorkspaceSubscribe, err := srv.Pubsub.Subscribe(codersdk.WorkspaceNotifyChannel(build.WorkspaceID), func(_ context.Context, _ []byte) {
+				closeWorkspaceSubscribe, err := ps.Subscribe(codersdk.WorkspaceNotifyChannel(build.WorkspaceID), func(_ context.Context, _ []byte) {
 					close(publishedWorkspace)
 				})
 				require.NoError(t, err)
 				defer closeWorkspaceSubscribe()
 				publishedLogs := make(chan struct{})
-				closeLogsSubscribe, err := srv.Pubsub.Subscribe(provisionersdk.ProvisionerJobLogsNotifyChannel(job.ID), func(_ context.Context, _ []byte) {
+				closeLogsSubscribe, err := ps.Subscribe(provisionersdk.ProvisionerJobLogsNotifyChannel(job.ID), func(_ context.Context, _ []byte) {
 					close(publishedLogs)
 				})
 				require.NoError(t, err)
@@ -1121,11 +1207,11 @@ func TestCompleteJob(t *testing.T) {
 				<-publishedWorkspace
 				<-publishedLogs
 
-				workspace, err = srv.Database.GetWorkspaceByID(ctx, workspace.ID)
+				workspace, err = db.GetWorkspaceByID(ctx, workspace.ID)
 				require.NoError(t, err)
 				require.Equal(t, c.transition == database.WorkspaceTransitionDelete, workspace.Deleted)
 
-				workspaceBuild, err := srv.Database.GetWorkspaceBuildByID(ctx, build.ID)
+				workspaceBuild, err := db.GetWorkspaceBuildByID(ctx, build.ID)
 				require.NoError(t, err)
 
 				if c.expectedTTL == 0 {
@@ -1155,7 +1241,7 @@ func TestCompleteJob(t *testing.T) {
 
 		// Wednesday the 8th of February 2023 at midnight. This date was
 		// specifically chosen as it doesn't fall on a applicable week for both
-		// fortnightly and triweekly restart requirements.
+		// fortnightly and triweekly autostop requirements.
 		wednesdayMidnightUTC := time.Date(2023, 2, 8, 0, 0, 0, 0, time.UTC)
 
 		sydneyQuietHours := "CRON_TZ=Australia/Sydney 0 0 * * *"
@@ -1175,44 +1261,44 @@ func TestCompleteJob(t *testing.T) {
 			transition   database.WorkspaceTransition
 
 			// These fields are only used when testing max deadline.
-			userQuietHoursSchedule     string
-			templateRestartRequirement schedule.TemplateRestartRequirement
+			userQuietHoursSchedule      string
+			templateAutostopRequirement schedule.TemplateAutostopRequirement
 
 			expectedDeadline    time.Time
 			expectedMaxDeadline time.Time
 		}{
 			{
-				name:                       "OK",
-				now:                        now,
-				templateRestartRequirement: schedule.TemplateRestartRequirement{},
-				workspaceTTL:               0,
-				transition:                 database.WorkspaceTransitionStart,
-				expectedDeadline:           time.Time{},
-				expectedMaxDeadline:        time.Time{},
+				name:                        "OK",
+				now:                         now,
+				templateAutostopRequirement: schedule.TemplateAutostopRequirement{},
+				workspaceTTL:                0,
+				transition:                  database.WorkspaceTransitionStart,
+				expectedDeadline:            time.Time{},
+				expectedMaxDeadline:         time.Time{},
 			},
 			{
-				name:                       "Delete",
-				now:                        now,
-				templateRestartRequirement: schedule.TemplateRestartRequirement{},
-				workspaceTTL:               0,
-				transition:                 database.WorkspaceTransitionDelete,
-				expectedDeadline:           time.Time{},
-				expectedMaxDeadline:        time.Time{},
+				name:                        "Delete",
+				now:                         now,
+				templateAutostopRequirement: schedule.TemplateAutostopRequirement{},
+				workspaceTTL:                0,
+				transition:                  database.WorkspaceTransitionDelete,
+				expectedDeadline:            time.Time{},
+				expectedMaxDeadline:         time.Time{},
 			},
 			{
-				name:                       "WorkspaceTTL",
-				now:                        now,
-				templateRestartRequirement: schedule.TemplateRestartRequirement{},
-				workspaceTTL:               time.Hour,
-				transition:                 database.WorkspaceTransitionStart,
-				expectedDeadline:           now.Add(time.Hour),
-				expectedMaxDeadline:        time.Time{},
+				name:                        "WorkspaceTTL",
+				now:                         now,
+				templateAutostopRequirement: schedule.TemplateAutostopRequirement{},
+				workspaceTTL:                time.Hour,
+				transition:                  database.WorkspaceTransitionStart,
+				expectedDeadline:            now.Add(time.Hour),
+				expectedMaxDeadline:         time.Time{},
 			},
 			{
-				name:                   "TemplateRestartRequirement",
+				name:                   "TemplateAutostopRequirement",
 				now:                    wednesdayMidnightUTC,
 				userQuietHoursSchedule: sydneyQuietHours,
-				templateRestartRequirement: schedule.TemplateRestartRequirement{
+				templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 					DaysOfWeek: 0b00100000, // Saturday
 					Weeks:      0,          // weekly
 				},
@@ -1229,27 +1315,33 @@ func TestCompleteJob(t *testing.T) {
 			t.Run(c.name, func(t *testing.T) {
 				t.Parallel()
 
-				srv := setup(t, false)
-
+				srvID := uuid.New()
 				// Simulate the given time starting from now.
 				require.False(t, c.now.IsZero())
 				start := time.Now()
-				srv.TimeNowFn = func() time.Time {
-					return c.now.Add(time.Since(start))
-				}
+				tss := &atomic.Pointer[schedule.TemplateScheduleStore]{}
+				uqhss := &atomic.Pointer[schedule.UserQuietHoursScheduleStore]{}
+				srv, db, ps := setup(t, false, &overrides{
+					timeNowFn: func() time.Time {
+						return c.now.Add(time.Since(start))
+					},
+					templateScheduleStore:       tss,
+					userQuietHoursScheduleStore: uqhss,
+					id:                          &srvID,
+				})
 
 				var templateScheduleStore schedule.TemplateScheduleStore = schedule.MockTemplateScheduleStore{
 					GetFn: func(_ context.Context, _ database.Store, _ uuid.UUID) (schedule.TemplateScheduleOptions, error) {
 						return schedule.TemplateScheduleOptions{
-							UserAutostartEnabled:  false,
-							UserAutostopEnabled:   true,
-							DefaultTTL:            0,
-							UseRestartRequirement: true,
-							RestartRequirement:    c.templateRestartRequirement,
+							UserAutostartEnabled:   false,
+							UserAutostopEnabled:    true,
+							DefaultTTL:             0,
+							UseAutostopRequirement: true,
+							AutostopRequirement:    c.templateAutostopRequirement,
 						}, nil
 					},
 				}
-				srv.TemplateScheduleStore.Store(&templateScheduleStore)
+				tss.Store(&templateScheduleStore)
 
 				var userQuietHoursScheduleStore schedule.UserQuietHoursScheduleStore = schedule.MockUserQuietHoursScheduleStore{
 					GetFn: func(_ context.Context, _ database.Store, _ uuid.UUID) (schedule.UserQuietHoursScheduleOptions, error) {
@@ -1259,7 +1351,7 @@ func TestCompleteJob(t *testing.T) {
 							}, nil
 						}
 
-						sched, err := schedule.Daily(c.userQuietHoursSchedule)
+						sched, err := cron.Daily(c.userQuietHoursSchedule)
 						if !assert.NoError(t, err) {
 							return schedule.UserQuietHoursScheduleOptions{}, err
 						}
@@ -1270,28 +1362,28 @@ func TestCompleteJob(t *testing.T) {
 						}, nil
 					},
 				}
-				srv.UserQuietHoursScheduleStore.Store(&userQuietHoursScheduleStore)
+				uqhss.Store(&userQuietHoursScheduleStore)
 
-				user := dbgen.User(t, srv.Database, database.User{
+				user := dbgen.User(t, db, database.User{
 					QuietHoursSchedule: c.userQuietHoursSchedule,
 				})
-				template := dbgen.Template(t, srv.Database, database.Template{
+				template := dbgen.Template(t, db, database.Template{
 					Name:        "template",
 					Provisioner: database.ProvisionerTypeEcho,
 				})
-				err := srv.Database.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
-					ID:                           template.ID,
-					UpdatedAt:                    database.Now(),
-					AllowUserAutostart:           false,
-					AllowUserAutostop:            true,
-					DefaultTTL:                   0,
-					RestartRequirementDaysOfWeek: int16(c.templateRestartRequirement.DaysOfWeek),
-					RestartRequirementWeeks:      c.templateRestartRequirement.Weeks,
+				err := db.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
+					ID:                            template.ID,
+					UpdatedAt:                     dbtime.Now(),
+					AllowUserAutostart:            false,
+					AllowUserAutostop:             true,
+					DefaultTTL:                    0,
+					AutostopRequirementDaysOfWeek: int16(c.templateAutostopRequirement.DaysOfWeek),
+					AutostopRequirementWeeks:      c.templateAutostopRequirement.Weeks,
 				})
 				require.NoError(t, err)
-				template, err = srv.Database.GetTemplateByID(ctx, template.ID)
+				template, err = db.GetTemplateByID(ctx, template.ID)
 				require.NoError(t, err)
-				file := dbgen.File(t, srv.Database, database.File{CreatedBy: user.ID})
+				file := dbgen.File(t, db, database.File{CreatedBy: user.ID})
 				workspaceTTL := sql.NullInt64{}
 				if c.workspaceTTL != 0 {
 					workspaceTTL = sql.NullInt64{
@@ -1299,34 +1391,34 @@ func TestCompleteJob(t *testing.T) {
 						Valid: true,
 					}
 				}
-				workspace := dbgen.Workspace(t, srv.Database, database.Workspace{
+				workspace := dbgen.Workspace(t, db, database.Workspace{
 					TemplateID: template.ID,
 					Ttl:        workspaceTTL,
 					OwnerID:    user.ID,
 				})
-				version := dbgen.TemplateVersion(t, srv.Database, database.TemplateVersion{
+				version := dbgen.TemplateVersion(t, db, database.TemplateVersion{
 					TemplateID: uuid.NullUUID{
 						UUID:  template.ID,
 						Valid: true,
 					},
 					JobID: uuid.New(),
 				})
-				build := dbgen.WorkspaceBuild(t, srv.Database, database.WorkspaceBuild{
+				build := dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
 					WorkspaceID:       workspace.ID,
 					TemplateVersionID: version.ID,
 					Transition:        c.transition,
 					Reason:            database.BuildReasonInitiator,
 				})
-				job := dbgen.ProvisionerJob(t, srv.Database, database.ProvisionerJob{
+				job := dbgen.ProvisionerJob(t, db, ps, database.ProvisionerJob{
 					FileID: file.ID,
 					Type:   database.ProvisionerJobTypeWorkspaceBuild,
 					Input: must(json.Marshal(provisionerdserver.WorkspaceProvisionJob{
 						WorkspaceBuildID: build.ID,
 					})),
 				})
-				_, err = srv.Database.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+				_, err = db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
 					WorkerID: uuid.NullUUID{
-						UUID:  srv.ID,
+						UUID:  srvID,
 						Valid: true,
 					},
 					Types: []database.ProvisionerType{database.ProvisionerTypeEcho},
@@ -1334,13 +1426,13 @@ func TestCompleteJob(t *testing.T) {
 				require.NoError(t, err)
 
 				publishedWorkspace := make(chan struct{})
-				closeWorkspaceSubscribe, err := srv.Pubsub.Subscribe(codersdk.WorkspaceNotifyChannel(build.WorkspaceID), func(_ context.Context, _ []byte) {
+				closeWorkspaceSubscribe, err := ps.Subscribe(codersdk.WorkspaceNotifyChannel(build.WorkspaceID), func(_ context.Context, _ []byte) {
 					close(publishedWorkspace)
 				})
 				require.NoError(t, err)
 				defer closeWorkspaceSubscribe()
 				publishedLogs := make(chan struct{})
-				closeLogsSubscribe, err := srv.Pubsub.Subscribe(provisionersdk.ProvisionerJobLogsNotifyChannel(job.ID), func(_ context.Context, _ []byte) {
+				closeLogsSubscribe, err := ps.Subscribe(provisionersdk.ProvisionerJobLogsNotifyChannel(job.ID), func(_ context.Context, _ []byte) {
 					close(publishedLogs)
 				})
 				require.NoError(t, err)
@@ -1363,11 +1455,11 @@ func TestCompleteJob(t *testing.T) {
 				<-publishedWorkspace
 				<-publishedLogs
 
-				workspace, err = srv.Database.GetWorkspaceByID(ctx, workspace.ID)
+				workspace, err = db.GetWorkspaceByID(ctx, workspace.ID)
 				require.NoError(t, err)
 				require.Equal(t, c.transition == database.WorkspaceTransitionDelete, workspace.Deleted)
 
-				workspaceBuild, err := srv.Database.GetWorkspaceBuildByID(ctx, build.ID)
+				workspaceBuild, err := db.GetWorkspaceBuildByID(ctx, build.ID)
 				require.NoError(t, err)
 
 				// If the max deadline is set, the deadline should also be set.
@@ -1392,17 +1484,18 @@ func TestCompleteJob(t *testing.T) {
 	})
 	t.Run("TemplateDryRun", func(t *testing.T) {
 		t.Parallel()
-		srv := setup(t, false)
-		job, err := srv.Database.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
+		srvID := uuid.New()
+		srv, db, _ := setup(t, false, &overrides{id: &srvID})
+		job, err := db.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
 			ID:            uuid.New(),
 			Provisioner:   database.ProvisionerTypeEcho,
 			Type:          database.ProvisionerJobTypeTemplateVersionDryRun,
 			StorageMethod: database.ProvisionerStorageMethodFile,
 		})
 		require.NoError(t, err)
-		_, err = srv.Database.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+		_, err = db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
 			WorkerID: uuid.NullUUID{
-				UUID:  srv.ID,
+				UUID:  srvID,
 				Valid: true,
 			},
 			Types: []database.ProvisionerType{database.ProvisionerTypeEcho},
@@ -1432,7 +1525,7 @@ func TestInsertWorkspaceResource(t *testing.T) {
 	}
 	t.Run("NoAgents", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		job := uuid.New()
 		err := insert(db, job, &sdkproto.Resource{
 			Name: "something",
@@ -1445,7 +1538,7 @@ func TestInsertWorkspaceResource(t *testing.T) {
 	})
 	t.Run("InvalidAgentToken", func(t *testing.T) {
 		t.Parallel()
-		err := insert(dbfake.New(), uuid.New(), &sdkproto.Resource{
+		err := insert(dbmem.New(), uuid.New(), &sdkproto.Resource{
 			Name: "something",
 			Type: "aws_instance",
 			Agents: []*sdkproto.Agent{{
@@ -1458,7 +1551,7 @@ func TestInsertWorkspaceResource(t *testing.T) {
 	})
 	t.Run("DuplicateApps", func(t *testing.T) {
 		t.Parallel()
-		err := insert(dbfake.New(), uuid.New(), &sdkproto.Resource{
+		err := insert(dbmem.New(), uuid.New(), &sdkproto.Resource{
 			Name: "something",
 			Type: "aws_instance",
 			Agents: []*sdkproto.Agent{{
@@ -1473,7 +1566,7 @@ func TestInsertWorkspaceResource(t *testing.T) {
 	})
 	t.Run("Success", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		job := uuid.New()
 		err := insert(db, job, &sdkproto.Resource{
 			Name:      "something",
@@ -1484,7 +1577,6 @@ func TestInsertWorkspaceResource(t *testing.T) {
 				Env: map[string]string{
 					"something": "test",
 				},
-				StartupScript:   "value",
 				OperatingSystem: "linux",
 				Architecture:    "amd64",
 				Auth: &sdkproto.Agent_Token{
@@ -1493,7 +1585,15 @@ func TestInsertWorkspaceResource(t *testing.T) {
 				Apps: []*sdkproto.App{{
 					Slug: "a",
 				}},
-				ShutdownScript: "shutdown",
+				Scripts: []*sdkproto.Script{{
+					DisplayName: "Startup",
+					Icon:        "/test.png",
+				}},
+				DisplayApps: &sdkproto.DisplayApps{
+					Vscode:               true,
+					PortForwardingHelper: true,
+					SshHelper:            true,
+				},
 			}},
 		})
 		require.NoError(t, err)
@@ -1507,8 +1607,6 @@ func TestInsertWorkspaceResource(t *testing.T) {
 		agent := agents[0]
 		require.Equal(t, "amd64", agent.Architecture)
 		require.Equal(t, "linux", agent.OperatingSystem)
-		require.Equal(t, "value", agent.StartupScript.String)
-		require.Equal(t, "shutdown", agent.ShutdownScript.String)
 		want, err := json.Marshal(map[string]string{
 			"something": "test",
 		})
@@ -1516,33 +1614,150 @@ func TestInsertWorkspaceResource(t *testing.T) {
 		got, err := agent.EnvironmentVariables.RawMessage.MarshalJSON()
 		require.NoError(t, err)
 		require.Equal(t, want, got)
+		require.ElementsMatch(t, []database.DisplayApp{
+			database.DisplayAppPortForwardingHelper,
+			database.DisplayAppSSHHelper,
+			database.DisplayAppVscode,
+		}, agent.DisplayApps)
 	})
+
+	t.Run("AllDisplayApps", func(t *testing.T) {
+		t.Parallel()
+		db := dbmem.New()
+		job := uuid.New()
+		err := insert(db, job, &sdkproto.Resource{
+			Name: "something",
+			Type: "aws_instance",
+			Agents: []*sdkproto.Agent{{
+				DisplayApps: &sdkproto.DisplayApps{
+					Vscode:               true,
+					VscodeInsiders:       true,
+					SshHelper:            true,
+					PortForwardingHelper: true,
+					WebTerminal:          true,
+				},
+			}},
+		})
+		require.NoError(t, err)
+		resources, err := db.GetWorkspaceResourcesByJobID(ctx, job)
+		require.NoError(t, err)
+		require.Len(t, resources, 1)
+		agents, err := db.GetWorkspaceAgentsByResourceIDs(ctx, []uuid.UUID{resources[0].ID})
+		require.NoError(t, err)
+		require.Len(t, agents, 1)
+		agent := agents[0]
+		require.ElementsMatch(t, database.AllDisplayAppValues(), agent.DisplayApps)
+	})
+
+	t.Run("DisableDefaultApps", func(t *testing.T) {
+		t.Parallel()
+		db := dbmem.New()
+		job := uuid.New()
+		err := insert(db, job, &sdkproto.Resource{
+			Name: "something",
+			Type: "aws_instance",
+			Agents: []*sdkproto.Agent{{
+				DisplayApps: &sdkproto.DisplayApps{},
+			}},
+		})
+		require.NoError(t, err)
+		resources, err := db.GetWorkspaceResourcesByJobID(ctx, job)
+		require.NoError(t, err)
+		require.Len(t, resources, 1)
+		agents, err := db.GetWorkspaceAgentsByResourceIDs(ctx, []uuid.UUID{resources[0].ID})
+		require.NoError(t, err)
+		require.Len(t, agents, 1)
+		agent := agents[0]
+		// An empty array (as opposed to nil) should be returned to indicate
+		// that all apps are disabled.
+		require.Equal(t, []database.DisplayApp{}, agent.DisplayApps)
+	})
+}
+
+type overrides struct {
+	deploymentValues            *codersdk.DeploymentValues
+	externalAuthConfigs         []*externalauth.Config
+	id                          *uuid.UUID
+	templateScheduleStore       *atomic.Pointer[schedule.TemplateScheduleStore]
+	userQuietHoursScheduleStore *atomic.Pointer[schedule.UserQuietHoursScheduleStore]
+	timeNowFn                   func() time.Time
+	acquireJobLongPollDuration  time.Duration
 }
 
-func setup(t *testing.T, ignoreLogErrors bool) *provisionerdserver.Server {
+func setup(t *testing.T, ignoreLogErrors bool, ov *overrides) (proto.DRPCProvisionerDaemonServer, database.Store, pubsub.Pubsub) {
 	t.Helper()
-	db := dbfake.New()
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+	db := dbmem.New()
 	ps := pubsub.NewInMemory()
-
-	return &provisionerdserver.Server{
-		ID:                          uuid.New(),
-		Logger:                      slogtest.Make(t, &slogtest.Options{IgnoreErrors: ignoreLogErrors}),
-		OIDCConfig:                  &oauth2.Config{},
-		AccessURL:                   &url.URL{},
-		Provisioners:                []database.ProvisionerType{database.ProvisionerTypeEcho},
-		Database:                    db,
-		Pubsub:                      ps,
-		Telemetry:                   telemetry.NewNoop(),
-		Auditor:                     mockAuditor(),
-		TemplateScheduleStore:       testTemplateScheduleStore(),
-		UserQuietHoursScheduleStore: testUserQuietHoursScheduleStore(),
-		Tracer:                      trace.NewNoopTracerProvider().Tracer("noop"),
-		DeploymentValues:            &codersdk.DeploymentValues{},
-
-		// Negative values cause the debounce to never kick in. Tests that want
-		// to test debounce can override this value.
-		AcquireJobDebounce: -time.Minute,
+	deploymentValues := &codersdk.DeploymentValues{}
+	var externalAuthConfigs []*externalauth.Config
+	srvID := uuid.New()
+	tss := testTemplateScheduleStore()
+	uqhss := testUserQuietHoursScheduleStore()
+	var timeNowFn func() time.Time
+	pollDur := time.Duration(0)
+	if ov != nil {
+		if ov.deploymentValues != nil {
+			deploymentValues = ov.deploymentValues
+		}
+		if ov.externalAuthConfigs != nil {
+			externalAuthConfigs = ov.externalAuthConfigs
+		}
+		if ov.id != nil {
+			srvID = *ov.id
+		}
+		if ov.templateScheduleStore != nil {
+			ttss := tss.Load()
+			// keep the initial test value if the override hasn't set the atomic pointer.
+			tss = ov.templateScheduleStore
+			if tss.Load() == nil {
+				swapped := tss.CompareAndSwap(nil, ttss)
+				require.True(t, swapped)
+			}
+		}
+		if ov.userQuietHoursScheduleStore != nil {
+			tuqhss := uqhss.Load()
+			// keep the initial test value if the override hasn't set the atomic pointer.
+			uqhss = ov.userQuietHoursScheduleStore
+			if uqhss.Load() == nil {
+				swapped := uqhss.CompareAndSwap(nil, tuqhss)
+				require.True(t, swapped)
+			}
+		}
+		if ov.timeNowFn != nil {
+			timeNowFn = ov.timeNowFn
+		}
+		pollDur = ov.acquireJobLongPollDuration
 	}
+
+	srv, err := provisionerdserver.NewServer(
+		ctx,
+		&url.URL{},
+		srvID,
+		slogtest.Make(t, &slogtest.Options{IgnoreErrors: ignoreLogErrors}),
+		[]database.ProvisionerType{database.ProvisionerTypeEcho},
+		provisionerdserver.Tags{},
+		db,
+		ps,
+		provisionerdserver.NewAcquirer(ctx, logger.Named("acquirer"), db, ps),
+		telemetry.NewNoop(),
+		trace.NewNoopTracerProvider().Tracer("noop"),
+		&atomic.Pointer[proto.QuotaCommitter]{},
+		mockAuditor(),
+		tss,
+		uqhss,
+		deploymentValues,
+		provisionerdserver.Options{
+			ExternalAuthConfigs:   externalAuthConfigs,
+			TimeNowFn:             timeNowFn,
+			OIDCConfig:            &oauth2.Config{},
+			AcquireJobLongPollDur: pollDur,
+		},
+	)
+	require.NoError(t, err)
+	return srv, db, ps
 }
 
 func must[T any](value T, err error) T {
@@ -1551,3 +1766,95 @@ func must[T any](value T, err error) T {
 	}
 	return value
 }
+
+var (
+	errUnimplemented = xerrors.New("unimplemented")
+	errClosed        = xerrors.New("closed")
+)
+
+type fakeStream struct {
+	ctx        context.Context
+	c          *sync.Cond
+	closed     bool
+	canceled   bool
+	sendCalled bool
+	job        *proto.AcquiredJob
+}
+
+func newFakeStream(ctx context.Context) *fakeStream {
+	return &fakeStream{
+		ctx: ctx,
+		c:   sync.NewCond(&sync.Mutex{}),
+	}
+}
+
+func (s *fakeStream) Send(j *proto.AcquiredJob) error {
+	s.c.L.Lock()
+	defer s.c.L.Unlock()
+	s.sendCalled = true
+	s.job = j
+	s.c.Broadcast()
+	return nil
+}
+
+func (s *fakeStream) Recv() (*proto.CancelAcquire, error) {
+	s.c.L.Lock()
+	defer s.c.L.Unlock()
+	for !(s.canceled || s.closed) {
+		s.c.Wait()
+	}
+	if s.canceled {
+		return &proto.CancelAcquire{}, nil
+	}
+	return nil, io.EOF
+}
+
+// Context returns the context associated with the stream. It is canceled
+// when the Stream is closed and no more messages will ever be sent or
+// received on it.
+func (s *fakeStream) Context() context.Context {
+	return s.ctx
+}
+
+// MsgSend sends the Message to the remote.
+func (*fakeStream) MsgSend(drpc.Message, drpc.Encoding) error {
+	return errUnimplemented
+}
+
+// MsgRecv receives a Message from the remote.
+func (*fakeStream) MsgRecv(drpc.Message, drpc.Encoding) error {
+	return errUnimplemented
+}
+
+// CloseSend signals to the remote that we will no longer send any messages.
+func (*fakeStream) CloseSend() error {
+	return errUnimplemented
+}
+
+// Close closes the stream.
+func (s *fakeStream) Close() error {
+	s.c.L.Lock()
+	defer s.c.L.Unlock()
+	s.closed = true
+	s.c.Broadcast()
+	return nil
+}
+
+func (s *fakeStream) waitForJob() (*proto.AcquiredJob, error) {
+	s.c.L.Lock()
+	defer s.c.L.Unlock()
+	for !(s.sendCalled || s.closed) {
+		s.c.Wait()
+	}
+	if s.sendCalled {
+		return s.job, nil
+	}
+	return nil, errClosed
+}
+
+func (s *fakeStream) cancel() {
+	s.c.L.Lock()
+	defer s.c.L.Unlock()
+	s.canceled = true
+	s.c.Broadcast()
+}
diff --git a/coderd/provisionerdserver/provisionertags_test.go b/coderd/provisionerdserver/provisionertags_test.go
new file mode 100644
index 0000000000000..464695307060c
--- /dev/null
+++ b/coderd/provisionerdserver/provisionertags_test.go
@@ -0,0 +1,80 @@
+package provisionerdserver_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/provisionerdserver"
+)
+
+func TestMutateTags(t *testing.T) {
+	t.Parallel()
+
+	testUserID := uuid.New()
+
+	for _, tt := range []struct {
+		name   string
+		userID uuid.UUID
+		tags   map[string]string
+		want   map[string]string
+	}{
+		{
+			name:   "nil tags",
+			userID: uuid.Nil,
+			tags:   nil,
+			want: map[string]string{
+				provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+			},
+		},
+		{
+			name:   "empty tags",
+			userID: uuid.Nil,
+			tags:   map[string]string{},
+			want: map[string]string{
+				provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+			},
+		},
+		{
+			name:   "user scope",
+			tags:   map[string]string{provisionerdserver.TagScope: provisionerdserver.ScopeUser},
+			userID: testUserID,
+			want: map[string]string{
+				provisionerdserver.TagScope: provisionerdserver.ScopeUser,
+				provisionerdserver.TagOwner: testUserID.String(),
+			},
+		},
+		{
+			name:   "organization scope",
+			tags:   map[string]string{provisionerdserver.TagScope: provisionerdserver.ScopeOrganization},
+			userID: testUserID,
+			want: map[string]string{
+				provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+			},
+		},
+		{
+			name:   "invalid scope",
+			tags:   map[string]string{provisionerdserver.TagScope: "360noscope"},
+			userID: testUserID,
+			want: map[string]string{
+				provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+			},
+		},
+	} {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			// make a copy of the map because the function under test
+			// mutates the map
+			bytes, err := json.Marshal(tt.tags)
+			require.NoError(t, err)
+			var tags map[string]string
+			err = json.Unmarshal(bytes, &tags)
+			require.NoError(t, err)
+			got := provisionerdserver.MutateTags(tt.userID, tags)
+			require.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/coderd/provisionerjobs.go b/coderd/provisionerjobs.go
index 1be1a56518d28..315fe38593e6d 100644
--- a/coderd/provisionerjobs.go
+++ b/coderd/provisionerjobs.go
@@ -16,13 +16,12 @@ import (
 
 	"cdr.dev/slog"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisionersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisionersdk"
 )
 
 // Returns provisioner logs based on query parameters.
@@ -124,6 +123,32 @@ func (api *API) provisionerJobResources(rw http.ResponseWriter, r *http.Request,
 		return
 	}
 
+	// nolint:gocritic // GetWorkspaceAgentScriptsByAgentIDs is a system function.
+	scripts, err := api.Database.GetWorkspaceAgentScriptsByAgentIDs(dbauthz.AsSystemRestricted(ctx), resourceAgentIDs)
+	if errors.Is(err, sql.ErrNoRows) {
+		err = nil
+	}
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error fetching workspace agent scripts.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	// nolint:gocritic // GetWorkspaceAgentLogSourcesByAgentIDs is a system function.
+	logSources, err := api.Database.GetWorkspaceAgentLogSourcesByAgentIDs(dbauthz.AsSystemRestricted(ctx), resourceAgentIDs)
+	if errors.Is(err, sql.ErrNoRows) {
+		err = nil
+	}
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error fetching workspace agent log sources.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
 	// nolint:gocritic // GetWorkspaceResourceMetadataByResourceIDs is a system function.
 	resourceMetadata, err := api.Database.GetWorkspaceResourceMetadataByResourceIDs(dbauthz.AsSystemRestricted(ctx), resourceIDs)
 	if err != nil {
@@ -147,9 +172,21 @@ func (api *API) provisionerJobResources(rw http.ResponseWriter, r *http.Request,
 					dbApps = append(dbApps, app)
 				}
 			}
+			dbScripts := make([]database.WorkspaceAgentScript, 0)
+			for _, script := range scripts {
+				if script.WorkspaceAgentID == agent.ID {
+					dbScripts = append(dbScripts, script)
+				}
+			}
+			dbLogSources := make([]database.WorkspaceAgentLogSource, 0)
+			for _, logSource := range logSources {
+				if logSource.WorkspaceAgentID == agent.ID {
+					dbLogSources = append(dbLogSources, logSource)
+				}
+			}
 
 			apiAgent, err := convertWorkspaceAgent(
-				api.DERPMap(), *api.TailnetCoordinator.Load(), agent, convertApps(dbApps), api.AgentInactiveDisconnectTimeout,
+				api.DERPMap(), *api.TailnetCoordinator.Load(), agent, convertProvisionedApps(dbApps), convertScripts(dbScripts), convertLogSources(dbLogSources), api.AgentInactiveDisconnectTimeout,
 				api.DeploymentValues.AgentFallbackTroubleshootingURL.String(),
 			)
 			if err != nil {
@@ -220,7 +257,7 @@ func convertProvisionerJob(pj database.GetProvisionerJobsByIDsWithQueuePositionR
 	if provisionerJob.WorkerID.Valid {
 		job.WorkerID = &provisionerJob.WorkerID.UUID
 	}
-	job.Status = db2sdk.ProvisionerJobStatus(provisionerJob)
+	job.Status = codersdk.ProvisionerJobStatus(pj.ProvisionerJob.JobStatus)
 
 	return job
 }
@@ -244,7 +281,7 @@ func fetchAndWriteLogs(ctx context.Context, db database.Store, jobID uuid.UUID,
 }
 
 func jobIsComplete(logger slog.Logger, job database.ProvisionerJob) bool {
-	status := db2sdk.ProvisionerJobStatus(job)
+	status := codersdk.ProvisionerJobStatus(job.JobStatus)
 	switch status {
 	case codersdk.ProvisionerJobCanceled:
 		return true
@@ -402,7 +439,7 @@ func (f *logFollower) follow() {
 				if f.ctx.Err() == nil && !xerrors.Is(err, io.EOF) {
 					// neither context expiry, nor EOF, close and log
 					f.logger.Error(f.ctx, "failed to query logs", slog.Error(err))
-					err = f.conn.Close(websocket.StatusInternalError, err.Error())
+					err = f.conn.Close(websocket.StatusInternalError, httpapi.WebsocketCloseSprintf("%s", err.Error()))
 					if err != nil {
 						f.logger.Warn(f.ctx, "failed to close webscoket", slog.Error(err))
 					}
diff --git a/coderd/provisionerjobs_internal_test.go b/coderd/provisionerjobs_internal_test.go
index fd05eb3e62219..05fddb722b4b1 100644
--- a/coderd/provisionerjobs_internal_test.go
+++ b/coderd/provisionerjobs_internal_test.go
@@ -18,18 +18,19 @@ import (
 
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbmock"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisionersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbmock"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestConvertProvisionerJob_Unit(t *testing.T) {
 	t.Parallel()
 	validNullTimeMock := sql.NullTime{
-		Time:  database.Now(),
+		Time:  dbtime.Now(),
 		Valid: true,
 	}
 	invalidNullTimeMock := sql.NullTime{}
@@ -43,8 +44,10 @@ func TestConvertProvisionerJob_Unit(t *testing.T) {
 		expected codersdk.ProvisionerJob
 	}{
 		{
-			name:  "empty",
-			input: database.ProvisionerJob{},
+			name: "empty",
+			input: database.ProvisionerJob{
+				JobStatus: database.ProvisionerJobStatusPending,
+			},
 			expected: codersdk.ProvisionerJob{
 				Status: codersdk.ProvisionerJobPending,
 			},
@@ -54,6 +57,7 @@ func TestConvertProvisionerJob_Unit(t *testing.T) {
 			input: database.ProvisionerJob{
 				CanceledAt:  validNullTimeMock,
 				CompletedAt: invalidNullTimeMock,
+				JobStatus:   database.ProvisionerJobStatusCanceling,
 			},
 			expected: codersdk.ProvisionerJob{
 				CanceledAt: &validNullTimeMock.Time,
@@ -66,6 +70,7 @@ func TestConvertProvisionerJob_Unit(t *testing.T) {
 				CanceledAt:  validNullTimeMock,
 				CompletedAt: validNullTimeMock,
 				Error:       errorMock,
+				JobStatus:   database.ProvisionerJobStatusFailed,
 			},
 			expected: codersdk.ProvisionerJob{
 				CanceledAt:  &validNullTimeMock.Time,
@@ -79,6 +84,7 @@ func TestConvertProvisionerJob_Unit(t *testing.T) {
 			input: database.ProvisionerJob{
 				CanceledAt:  validNullTimeMock,
 				CompletedAt: validNullTimeMock,
+				JobStatus:   database.ProvisionerJobStatusCanceled,
 			},
 			expected: codersdk.ProvisionerJob{
 				CanceledAt:  &validNullTimeMock.Time,
@@ -90,6 +96,7 @@ func TestConvertProvisionerJob_Unit(t *testing.T) {
 			name: "job pending",
 			input: database.ProvisionerJob{
 				StartedAt: invalidNullTimeMock,
+				JobStatus: database.ProvisionerJobStatusPending,
 			},
 			expected: codersdk.ProvisionerJob{
 				Status: codersdk.ProvisionerJobPending,
@@ -101,6 +108,7 @@ func TestConvertProvisionerJob_Unit(t *testing.T) {
 				CompletedAt: validNullTimeMock,
 				StartedAt:   validNullTimeMock,
 				Error:       errorMock,
+				JobStatus:   database.ProvisionerJobStatusFailed,
 			},
 			expected: codersdk.ProvisionerJob{
 				CompletedAt: &validNullTimeMock.Time,
@@ -114,6 +122,7 @@ func TestConvertProvisionerJob_Unit(t *testing.T) {
 			input: database.ProvisionerJob{
 				CompletedAt: validNullTimeMock,
 				StartedAt:   validNullTimeMock,
+				JobStatus:   database.ProvisionerJobStatusSucceeded,
 			},
 			expected: codersdk.ProvisionerJob{
 				CompletedAt: &validNullTimeMock.Time,
@@ -142,7 +151,7 @@ func Test_logFollower_completeBeforeFollow(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	mDB := dbmock.NewMockStore(ctrl)
 	ps := pubsub.NewInMemory()
-	now := database.Now()
+	now := dbtime.Now()
 	job := database.ProvisionerJob{
 		ID:        uuid.New(),
 		CreatedAt: now.Add(-10 * time.Second),
@@ -155,7 +164,8 @@ func Test_logFollower_completeBeforeFollow(t *testing.T) {
 			Time:  now.Add(-time.Second),
 			Valid: true,
 		},
-		Error: sql.NullString{},
+		Error:     sql.NullString{},
+		JobStatus: database.ProvisionerJobStatusSucceeded,
 	}
 
 	// we need an HTTP server to get a websocket
@@ -204,7 +214,7 @@ func Test_logFollower_completeBeforeSubscribe(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	mDB := dbmock.NewMockStore(ctrl)
 	ps := pubsub.NewInMemory()
-	now := database.Now()
+	now := dbtime.Now()
 	job := database.ProvisionerJob{
 		ID:        uuid.New(),
 		CreatedAt: now.Add(-10 * time.Second),
@@ -216,6 +226,7 @@ func Test_logFollower_completeBeforeSubscribe(t *testing.T) {
 		CanceledAt:  sql.NullTime{},
 		CompletedAt: sql.NullTime{},
 		Error:       sql.NullString{},
+		JobStatus:   database.ProvisionerJobStatusRunning,
 	}
 
 	// we need an HTTP server to get a websocket
@@ -237,6 +248,7 @@ func Test_logFollower_completeBeforeSubscribe(t *testing.T) {
 				Time:  now.Add(-time.Millisecond),
 				Valid: true,
 			},
+			JobStatus: database.ProvisionerJobStatusSucceeded,
 		},
 		nil,
 	)
@@ -280,7 +292,7 @@ func Test_logFollower_EndOfLogs(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	mDB := dbmock.NewMockStore(ctrl)
 	ps := pubsub.NewInMemory()
-	now := database.Now()
+	now := dbtime.Now()
 	job := database.ProvisionerJob{
 		ID:        uuid.New(),
 		CreatedAt: now.Add(-10 * time.Second),
@@ -292,6 +304,7 @@ func Test_logFollower_EndOfLogs(t *testing.T) {
 		CanceledAt:  sql.NullTime{},
 		CompletedAt: sql.NullTime{},
 		Error:       sql.NullString{},
+		JobStatus:   database.ProvisionerJobStatusRunning,
 	}
 
 	// we need an HTTP server to get a websocket
diff --git a/coderd/provisionerjobs_test.go b/coderd/provisionerjobs_test.go
index 505031d50c949..2dc5db3bf8efb 100644
--- a/coderd/provisionerjobs_test.go
+++ b/coderd/provisionerjobs_test.go
@@ -6,10 +6,10 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestProvisionerJobLogs(t *testing.T) {
@@ -20,23 +20,23 @@ func TestProvisionerJobLogs(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Log{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Log{
 					Log: &proto.Log{
 						Level:  proto.LogLevel_INFO,
 						Output: "log-output",
 					},
 				},
 			}, {
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{},
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{},
 				},
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -59,21 +59,21 @@ func TestProvisionerJobLogs(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Log{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Log{
 					Log: &proto.Log{
 						Level:  proto.LogLevel_INFO,
 						Output: "log-output",
 					},
 				},
 			}, {
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{},
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{},
 				},
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
diff --git a/coderd/rbac/authz.go b/coderd/rbac/authz.go
index 51b71302525e7..42625b07c3e0a 100644
--- a/coderd/rbac/authz.go
+++ b/coderd/rbac/authz.go
@@ -18,10 +18,10 @@ import (
 	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/rbac/regosql"
-	"github.com/coder/coder/coderd/rbac/regosql/sqltypes"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/coderd/util/slice"
+	"github.com/coder/coder/v2/coderd/rbac/regosql"
+	"github.com/coder/coder/v2/coderd/rbac/regosql/sqltypes"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/util/slice"
 )
 
 // Action represents the allowed actions to be done on an object.
diff --git a/coderd/rbac/authz_internal_test.go b/coderd/rbac/authz_internal_test.go
index 6211aafd44677..e264e31c73a8c 100644
--- a/coderd/rbac/authz_internal_test.go
+++ b/coderd/rbac/authz_internal_test.go
@@ -13,8 +13,8 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/rbac/regosql"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/rbac/regosql"
+	"github.com/coder/coder/v2/testutil"
 )
 
 type fakeObject struct {
diff --git a/coderd/rbac/authz_test.go b/coderd/rbac/authz_test.go
index e13df4176abcd..05f402abe4507 100644
--- a/coderd/rbac/authz_test.go
+++ b/coderd/rbac/authz_test.go
@@ -9,8 +9,8 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
 )
 
 type benchmarkCase struct {
diff --git a/coderd/rbac/error.go b/coderd/rbac/error.go
index 36ff664d67145..37c83f759efa3 100644
--- a/coderd/rbac/error.go
+++ b/coderd/rbac/error.go
@@ -9,6 +9,8 @@ import (
 	"github.com/open-policy-agent/opa/rego"
 	"github.com/open-policy-agent/opa/topdown"
 	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/httpapi/httpapiconstraints"
 )
 
 const (
@@ -33,6 +35,14 @@ type UnauthorizedError struct {
 	output rego.ResultSet
 }
 
+// Ensure we implement the IsUnauthorized interface.
+var _ httpapiconstraints.IsUnauthorizedError = (*UnauthorizedError)(nil)
+
+// IsUnauthorized implements the IsUnauthorized interface.
+func (UnauthorizedError) IsUnauthorized() bool {
+	return true
+}
+
 // IsUnauthorizedError is a convenience function to check if err is UnauthorizedError.
 // It is equivalent to errors.As(err, &UnauthorizedError{}).
 func IsUnauthorizedError(err error) bool {
diff --git a/coderd/rbac/error_test.go b/coderd/rbac/error_test.go
index 23bbc7b3bc54c..cd9d319dabba8 100644
--- a/coderd/rbac/error_test.go
+++ b/coderd/rbac/error_test.go
@@ -3,7 +3,7 @@ package rbac_test
 import (
 	"testing"
 
-	"github.com/coder/coder/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac"
 
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
diff --git a/coderd/rbac/object.go b/coderd/rbac/object.go
index 39f57c7fcc6da..1e3f1f45e59ea 100644
--- a/coderd/rbac/object.go
+++ b/coderd/rbac/object.go
@@ -37,10 +37,10 @@ var (
 		Type: "workspace_build",
 	}
 
-	// ResourceWorkspaceLocked is returned if a workspace is locked.
+	// ResourceWorkspaceDormant is returned if a workspace is dormant.
 	// It grants restricted permissions on workspace builds.
-	ResourceWorkspaceLocked = Object{
-		Type: "workspace_locked",
+	ResourceWorkspaceDormant = Object{
+		Type: "workspace_dormant",
 	}
 
 	// ResourceWorkspaceProxy CRUD. Org
diff --git a/coderd/rbac/object_gen.go b/coderd/rbac/object_gen.go
index 10506b3f719c2..86a03d4552d45 100644
--- a/coderd/rbac/object_gen.go
+++ b/coderd/rbac/object_gen.go
@@ -26,8 +26,8 @@ func AllResources() []Object {
 		ResourceWorkspace,
 		ResourceWorkspaceApplicationConnect,
 		ResourceWorkspaceBuild,
+		ResourceWorkspaceDormant,
 		ResourceWorkspaceExecution,
-		ResourceWorkspaceLocked,
 		ResourceWorkspaceProxy,
 	}
 }
diff --git a/coderd/rbac/object_test.go b/coderd/rbac/object_test.go
index cbd043c753983..505f12b8cc7b0 100644
--- a/coderd/rbac/object_test.go
+++ b/coderd/rbac/object_test.go
@@ -3,8 +3,8 @@ package rbac_test
 import (
 	"testing"
 
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/util/slice"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/util/slice"
 )
 
 func TestObjectEqual(t *testing.T) {
diff --git a/coderd/rbac/regosql/acl_group_var.go b/coderd/rbac/regosql/acl_group_var.go
index d695683a72d61..328dfbcd48d0a 100644
--- a/coderd/rbac/regosql/acl_group_var.go
+++ b/coderd/rbac/regosql/acl_group_var.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/open-policy-agent/opa/ast"
 
-	"github.com/coder/coder/coderd/rbac/regosql/sqltypes"
+	"github.com/coder/coder/v2/coderd/rbac/regosql/sqltypes"
 )
 
 var (
diff --git a/coderd/rbac/regosql/compile.go b/coderd/rbac/regosql/compile.go
index 398cbbf54c08b..69ef2a018f36c 100644
--- a/coderd/rbac/regosql/compile.go
+++ b/coderd/rbac/regosql/compile.go
@@ -8,7 +8,7 @@ import (
 	"github.com/open-policy-agent/opa/rego"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/rbac/regosql/sqltypes"
+	"github.com/coder/coder/v2/coderd/rbac/regosql/sqltypes"
 )
 
 // ConvertConfig is required to generate SQL from the rego queries.
diff --git a/coderd/rbac/regosql/compile_test.go b/coderd/rbac/regosql/compile_test.go
index 5673b8621c2c7..be0385bf83699 100644
--- a/coderd/rbac/regosql/compile_test.go
+++ b/coderd/rbac/regosql/compile_test.go
@@ -7,8 +7,8 @@ import (
 	"github.com/open-policy-agent/opa/rego"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/rbac/regosql"
-	"github.com/coder/coder/coderd/rbac/regosql/sqltypes"
+	"github.com/coder/coder/v2/coderd/rbac/regosql"
+	"github.com/coder/coder/v2/coderd/rbac/regosql/sqltypes"
 )
 
 // TestRegoQueriesNoVariables handles cases without variables. These should be
diff --git a/coderd/rbac/regosql/configs.go b/coderd/rbac/regosql/configs.go
index b683a11af3123..68d3b6264cb3b 100644
--- a/coderd/rbac/regosql/configs.go
+++ b/coderd/rbac/regosql/configs.go
@@ -1,6 +1,6 @@
 package regosql
 
-import "github.com/coder/coder/coderd/rbac/regosql/sqltypes"
+import "github.com/coder/coder/v2/coderd/rbac/regosql/sqltypes"
 
 func resourceIDMatcher() sqltypes.VariableMatcher {
 	return sqltypes.StringVarMatcher("id :: text", []string{"input", "object", "id"})
diff --git a/coderd/rbac/regosql/sqltypes/equality_test.go b/coderd/rbac/regosql/sqltypes/equality_test.go
index 8764508ad858a..17a3d7f45eed1 100644
--- a/coderd/rbac/regosql/sqltypes/equality_test.go
+++ b/coderd/rbac/regosql/sqltypes/equality_test.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/rbac/regosql/sqltypes"
+	"github.com/coder/coder/v2/coderd/rbac/regosql/sqltypes"
 )
 
 func TestEquality(t *testing.T) {
diff --git a/coderd/rbac/regosql/sqltypes/member_test.go b/coderd/rbac/regosql/sqltypes/member_test.go
index 91259e286ee1c..0fedcc176c49f 100644
--- a/coderd/rbac/regosql/sqltypes/member_test.go
+++ b/coderd/rbac/regosql/sqltypes/member_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/rbac/regosql/sqltypes"
+	"github.com/coder/coder/v2/coderd/rbac/regosql/sqltypes"
 )
 
 func TestMembership(t *testing.T) {
diff --git a/coderd/rbac/roles.go b/coderd/rbac/roles.go
index 93aeaca017592..b94c90059a2c3 100644
--- a/coderd/rbac/roles.go
+++ b/coderd/rbac/roles.go
@@ -121,7 +121,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 		opts = &RoleOptions{}
 	}
 
-	ownerAndAdminExceptions := []Object{ResourceWorkspaceLocked}
+	ownerAndAdminExceptions := []Object{ResourceWorkspaceDormant}
 	if opts.NoOwnerWorkspaceExec {
 		ownerAndAdminExceptions = append(ownerAndAdminExceptions,
 			ResourceWorkspaceExecution,
@@ -143,14 +143,14 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 
 	memberRole := Role{
 		Name:        member,
-		DisplayName: "",
+		DisplayName: "Member",
 		Site: Permissions(map[string][]Action{
 			ResourceRoleAssignment.Type: {ActionRead},
 			// All users can see the provisioner daemons.
 			ResourceProvisionerDaemon.Type: {ActionRead},
 		}),
 		Org: map[string][]Permission{},
-		User: append(allPermsExcept(ResourceWorkspaceLocked, ResourceUser, ResourceOrganizationMember),
+		User: append(allPermsExcept(ResourceWorkspaceDormant, ResourceUser, ResourceOrganizationMember),
 			Permissions(map[string][]Action{
 				// Users cannot do create/update/delete on themselves, but they
 				// can read their own details.
@@ -169,6 +169,9 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			ResourceAuditLog.Type: {ActionRead},
 			ResourceUser.Type:     {ActionRead},
 			ResourceGroup.Type:    {ActionRead},
+			// Allow auditors to query deployment stats and insights.
+			ResourceDeploymentStats.Type:  {ActionRead},
+			ResourceDeploymentValues.Type: {ActionRead},
 			// Org roles are not really used yet, so grant the perm at the site level.
 			ResourceOrganizationMember.Type: {ActionRead},
 		}),
@@ -246,7 +249,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 				Site:        []Permission{},
 				Org: map[string][]Permission{
 					// Org admins should not have workspace exec perms.
-					organizationID: allPermsExcept(ResourceWorkspaceExecution, ResourceWorkspaceLocked),
+					organizationID: allPermsExcept(ResourceWorkspaceExecution, ResourceWorkspaceDormant),
 				},
 				User: []Permission{},
 			}
diff --git a/coderd/rbac/roles_test.go b/coderd/rbac/roles_test.go
index 4ecb53e1832d2..fc47413fd19f2 100644
--- a/coderd/rbac/roles_test.go
+++ b/coderd/rbac/roles_test.go
@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac"
 )
 
 type authSubject struct {
@@ -319,9 +319,9 @@ func TestRolePermissions(t *testing.T) {
 			},
 		},
 		{
-			Name:     "WorkspaceLocked",
+			Name:     "WorkspaceDormant",
 			Actions:  rbac.AllActions(),
-			Resource: rbac.ResourceWorkspaceLocked.WithID(uuid.New()).InOrg(orgID).WithOwner(memberMe.Actor.ID),
+			Resource: rbac.ResourceWorkspaceDormant.WithID(uuid.New()).InOrg(orgID).WithOwner(memberMe.Actor.ID),
 			AuthorizeMap: map[bool][]authSubject{
 				true:  {},
 				false: {memberMe, orgAdmin, userAdmin, otherOrgAdmin, otherOrgMember, orgMemberMe, owner, templateAdmin},
diff --git a/coderd/rbac/subject_test.go b/coderd/rbac/subject_test.go
index 294200aff8f8c..330ad7403797b 100644
--- a/coderd/rbac/subject_test.go
+++ b/coderd/rbac/subject_test.go
@@ -3,7 +3,7 @@ package rbac_test
 import (
 	"testing"
 
-	"github.com/coder/coder/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac"
 )
 
 func TestSubjectEqual(t *testing.T) {
diff --git a/coderd/roles.go b/coderd/roles.go
index 177a5301eae00..d985d7dca173d 100644
--- a/coderd/roles.go
+++ b/coderd/roles.go
@@ -3,11 +3,11 @@ package coderd
 import (
 	"net/http"
 
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/rbac"
 )
 
 // assignableSiteRoles returns all site wide roles that can be assigned.
@@ -58,7 +58,10 @@ func (api *API) assignableOrgRoles(rw http.ResponseWriter, r *http.Request) {
 func assignableRoles(actorRoles rbac.ExpandableRoles, roles []rbac.Role) []codersdk.AssignableRoles {
 	assignable := make([]codersdk.AssignableRoles, 0)
 	for _, role := range roles {
-		if role.DisplayName == "" {
+		// The member role is implied, and not assignable.
+		// If there is no display name, then the role is also unassigned.
+		// This is not the ideal logic, but works for now.
+		if role.Name == rbac.RoleMember() || (role.DisplayName == "") {
 			continue
 		}
 		assignable = append(assignable, codersdk.AssignableRoles{
diff --git a/coderd/roles_test.go b/coderd/roles_test.go
index 2b9eb35f34e15..c50f24eb467a0 100644
--- a/coderd/roles_test.go
+++ b/coderd/roles_test.go
@@ -7,20 +7,20 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestListRoles(t *testing.T) {
 	t.Parallel()
 
 	client := coderdtest.New(t, nil)
-	// Create admin, member, and org admin
-	admin := coderdtest.CreateFirstUser(t, client)
-	member, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
-	orgAdmin, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID, rbac.RoleOrgAdmin(admin.OrganizationID))
+	// Create owner, member, and org admin
+	owner := coderdtest.CreateFirstUser(t, client)
+	member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+	orgAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleOrgAdmin(owner.OrganizationID))
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	t.Cleanup(cancel)
@@ -55,10 +55,10 @@ func TestListRoles(t *testing.T) {
 		{
 			Name: "OrgMemberListOrg",
 			APICall: func(ctx context.Context) ([]codersdk.AssignableRoles, error) {
-				return member.ListOrganizationRoles(ctx, admin.OrganizationID)
+				return member.ListOrganizationRoles(ctx, owner.OrganizationID)
 			},
 			ExpectedRoles: convertRoles(map[string]bool{
-				rbac.RoleOrgAdmin(admin.OrganizationID): false,
+				rbac.RoleOrgAdmin(owner.OrganizationID): false,
 			}),
 		},
 		{
@@ -84,10 +84,10 @@ func TestListRoles(t *testing.T) {
 		{
 			Name: "OrgAdminListOrg",
 			APICall: func(ctx context.Context) ([]codersdk.AssignableRoles, error) {
-				return orgAdmin.ListOrganizationRoles(ctx, admin.OrganizationID)
+				return orgAdmin.ListOrganizationRoles(ctx, owner.OrganizationID)
 			},
 			ExpectedRoles: convertRoles(map[string]bool{
-				rbac.RoleOrgAdmin(admin.OrganizationID): true,
+				rbac.RoleOrgAdmin(owner.OrganizationID): true,
 			}),
 		},
 		{
@@ -113,10 +113,10 @@ func TestListRoles(t *testing.T) {
 		{
 			Name: "AdminListOrg",
 			APICall: func(ctx context.Context) ([]codersdk.AssignableRoles, error) {
-				return client.ListOrganizationRoles(ctx, admin.OrganizationID)
+				return client.ListOrganizationRoles(ctx, owner.OrganizationID)
 			},
 			ExpectedRoles: convertRoles(map[string]bool{
-				rbac.RoleOrgAdmin(admin.OrganizationID): true,
+				rbac.RoleOrgAdmin(owner.OrganizationID): true,
 			}),
 		},
 	}
diff --git a/coderd/schedule/autostop.go b/coderd/schedule/autostop.go
index 6934640045506..8cf645b52f5de 100644
--- a/coderd/schedule/autostop.go
+++ b/coderd/schedule/autostop.go
@@ -4,23 +4,26 @@ import (
 	"context"
 	"time"
 
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 const (
-	// restartRequirementLeeway is the duration of time before a restart
+	// autostopRequirementLeeway is the duration of time before a autostop
 	// requirement where we skip the requirement and fall back to the next
-	// scheduled restart. This avoids workspaces being restarted too soon.
+	// scheduled stop. This avoids workspaces being stopped too soon.
 	//
 	// E.g. If the workspace is started within an hour of the quiet hours, we
-	//      will skip the restart requirement and use the next scheduled restart
-	//      requirement.
-	restartRequirementLeeway = 1 * time.Hour
+	//      will skip the autostop requirement and use the next scheduled
+	//      stop time instead.
+	autostopRequirementLeeway = 1 * time.Hour
 
-	// restartRequirementBuffer is the duration of time we subtract from the
-	// time when calculating the next scheduled restart time. This avoids issues
+	// autostopRequirementBuffer is the duration of time we subtract from the
+	// time when calculating the next scheduled stop time. This avoids issues
 	// where autostart happens on the hour and the scheduled quiet hours are
 	// also on the hour.
 	//
@@ -34,7 +37,7 @@ const (
 	//
 	//      This resolves that problem by subtracting 15 minutes from midnight
 	//      when we check the next cron time.
-	restartRequirementBuffer = -15 * time.Minute
+	autostopRequirementBuffer = -15 * time.Minute
 )
 
 type CalculateAutostopParams struct {
@@ -65,13 +68,20 @@ type AutostopTime struct {
 //
 // MaxDeadline is the maximum value for deadline. The deadline cannot be bumped
 // past this value, so it denotes the absolute deadline that the workspace build
-// must be stopped by. MaxDeadline is calculated using the template's "restart
+// must be stopped by. MaxDeadline is calculated using the template's "autostop
 // requirement" settings and the user's "quiet hours" settings to pick a time
 // outside of working hours.
 //
 // Deadline is a cost saving measure, while max deadline is a
 // compliance/updating measure.
 func CalculateAutostop(ctx context.Context, params CalculateAutostopParams) (AutostopTime, error) {
+	ctx, span := tracing.StartSpan(ctx,
+		trace.WithAttributes(attribute.String("coder.workspace_id", params.Workspace.ID.String())),
+		trace.WithAttributes(attribute.String("coder.template_id", params.Workspace.TemplateID.String())),
+	)
+	defer span.End()
+	defer span.End()
+
 	var (
 		db        = params.Database
 		workspace = params.Workspace
@@ -103,13 +113,13 @@ func CalculateAutostop(ctx context.Context, params CalculateAutostopParams) (Aut
 	// Use the old algorithm for calculating max_deadline if the instance isn't
 	// configured or entitled to use the new feature flag yet.
 	// TODO(@dean): remove this once the feature flag is enabled for all
-	if !templateSchedule.UseRestartRequirement && templateSchedule.MaxTTL > 0 {
+	if !templateSchedule.UseAutostopRequirement && templateSchedule.MaxTTL > 0 {
 		autostop.MaxDeadline = now.Add(templateSchedule.MaxTTL)
 	}
 
 	// TODO(@dean): remove extra conditional
-	if templateSchedule.UseRestartRequirement && templateSchedule.RestartRequirement.DaysOfWeek != 0 {
-		// The template has a restart requirement, so determine the max deadline
+	if templateSchedule.UseAutostopRequirement && templateSchedule.AutostopRequirement.DaysOfWeek != 0 {
+		// The template has a autostop requirement, so determine the max deadline
 		// of this workspace build.
 
 		// First, get the user's quiet hours schedule (this will return the
@@ -127,13 +137,13 @@ func CalculateAutostop(ctx context.Context, params CalculateAutostopParams) (Aut
 			now := now.In(loc)
 			// Add the leeway here so we avoid checking today's quiet hours if
 			// the workspace was started <1h before midnight.
-			startOfStopDay := truncateMidnight(now.Add(restartRequirementLeeway))
+			startOfStopDay := truncateMidnight(now.Add(autostopRequirementLeeway))
 
-			// If the template schedule wants to only restart on n-th weeks then
-			// change the startOfDay to be the Monday of the next applicable
-			// week.
-			if templateSchedule.RestartRequirement.Weeks > 1 {
-				startOfStopDay, err = GetNextApplicableMondayOfNWeeks(startOfStopDay, templateSchedule.RestartRequirement.Weeks)
+			// If the template schedule wants to only autostop on n-th weeks
+			// then change the startOfDay to be the Monday of the next
+			// applicable week.
+			if templateSchedule.AutostopRequirement.Weeks > 1 {
+				startOfStopDay, err = GetNextApplicableMondayOfNWeeks(startOfStopDay, templateSchedule.AutostopRequirement.Weeks)
 				if err != nil {
 					return autostop, xerrors.Errorf("determine start of stop week: %w", err)
 				}
@@ -145,30 +155,30 @@ func CalculateAutostop(ctx context.Context, params CalculateAutostopParams) (Aut
 			// Allow an hour of leeway (i.e. any workspaces started within an
 			// hour of the scheduled stop time will always bounce to the next
 			// stop window).
-			checkSchedule := userQuietHoursSchedule.Schedule.Next(startOfStopDay.Add(restartRequirementBuffer))
-			if checkSchedule.Before(now.Add(restartRequirementLeeway)) {
+			checkSchedule := userQuietHoursSchedule.Schedule.Next(startOfStopDay.Add(autostopRequirementBuffer))
+			if checkSchedule.Before(now.Add(autostopRequirementLeeway)) {
 				// Set the first stop day we try to tomorrow because today's
 				// schedule is too close to now or has already passed.
 				startOfStopDay = nextDayMidnight(startOfStopDay)
 			}
 
 			// Iterate from 0 to 7, check if the current startOfDay is in the
-			// restart requirement. If it isn't then add a day and try again.
-			requirementDays := templateSchedule.RestartRequirement.DaysMap()
+			// autostop requirement. If it isn't then add a day and try again.
+			requirementDays := templateSchedule.AutostopRequirement.DaysMap()
 			for i := 0; i < len(DaysOfWeek)+1; i++ {
 				if i == len(DaysOfWeek) {
 					// We've wrapped, so somehow we couldn't find a day in the
-					// restart requirement in the next week.
+					// autostop requirement in the next week.
 					//
 					// This shouldn't be able to happen, as we've already
-					// checked that there is a day in the restart requirement
+					// checked that there is a day in the autostop requirement
 					// above with the
-					// `if templateSchedule.RestartRequirement.DaysOfWeek != 0`
+					// `if templateSchedule.AutoStopRequirement.DaysOfWeek != 0`
 					// check.
 					//
 					// The eighth bit shouldn't be set, as we validate the
 					// bitmap in the enterprise TemplateScheduleStore.
-					return autostop, xerrors.New("could not find suitable day for template restart requirement in the next 7 days")
+					return autostop, xerrors.New("could not find suitable day for template autostop requirement in the next 7 days")
 				}
 				if requirementDays[startOfStopDay.Weekday()] {
 					break
@@ -184,13 +194,13 @@ func CalculateAutostop(ctx context.Context, params CalculateAutostopParams) (Aut
 				// If it's not within an hour of now, subtract 15 minutes to
 				// give a little leeway. This prevents skipped stop events
 				// because autostart perfectly lines up with autostop.
-				checkTime = checkTime.Add(restartRequirementBuffer)
+				checkTime = checkTime.Add(autostopRequirementBuffer)
 			}
 
-			// Get the next occurrence of the restart schedule.
+			// Get the next occurrence of the schedule.
 			autostop.MaxDeadline = userQuietHoursSchedule.Schedule.Next(checkTime)
 			if autostop.MaxDeadline.IsZero() {
-				return autostop, xerrors.New("could not find next occurrence of template restart requirement in user quiet hours schedule")
+				return autostop, xerrors.Errorf("could not find next occurrence of template autostop requirement in user quiet hours schedule, checked from time %q", checkTime)
 			}
 		}
 	}
@@ -234,9 +244,9 @@ func nextDayMidnight(t time.Time) time.Time {
 //
 // The timezone embedded in the time object is used to determine the epoch.
 func WeeksSinceEpoch(now time.Time) (int64, error) {
-	epoch := TemplateRestartRequirementEpoch(now.Location())
+	epoch := TemplateAutostopRequirementEpoch(now.Location())
 	if now.Before(epoch) {
-		return 0, xerrors.New("coder server system clock is incorrect, cannot calculate template restart requirement")
+		return 0, xerrors.New("coder server system clock is incorrect, cannot calculate template autostop requirement")
 	}
 
 	// This calculation needs to be done using YearDay, as dividing by the
@@ -280,7 +290,7 @@ func GetMondayOfWeek(loc *time.Location, n int64) (time.Time, error) {
 	if n < 0 {
 		return time.Time{}, xerrors.New("weeks since epoch must be positive")
 	}
-	epoch := TemplateRestartRequirementEpoch(loc)
+	epoch := TemplateAutostopRequirementEpoch(loc)
 	monday := epoch.AddDate(0, 0, int(n*7))
 
 	y, m, d := monday.Date()
diff --git a/coderd/schedule/autostop_test.go b/coderd/schedule/autostop_test.go
index 6be5c5eaf81d4..cafe2b413eaed 100644
--- a/coderd/schedule/autostop_test.go
+++ b/coderd/schedule/autostop_test.go
@@ -11,11 +11,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestCalculateAutoStop(t *testing.T) {
@@ -25,7 +27,7 @@ func TestCalculateAutoStop(t *testing.T) {
 
 	// Wednesday the 8th of February 2023 at midnight. This date was
 	// specifically chosen as it doesn't fall on a applicable week for both
-	// fortnightly and triweekly restart requirements.
+	// fortnightly and triweekly autostop requirements.
 	wednesdayMidnightUTC := time.Date(2023, 2, 8, 0, 0, 0, 0, time.UTC)
 
 	sydneyQuietHours := "CRON_TZ=Australia/Sydney 0 0 * * *"
@@ -73,10 +75,10 @@ func TestCalculateAutoStop(t *testing.T) {
 		templateAllowAutostop bool
 		templateDefaultTTL    time.Duration
 		// TODO(@dean): remove max_ttl tests
-		useMaxTTL                  bool
-		templateMaxTTL             time.Duration
-		templateRestartRequirement schedule.TemplateRestartRequirement
-		userQuietHoursSchedule     string
+		useMaxTTL                   bool
+		templateMaxTTL              time.Duration
+		templateAutostopRequirement schedule.TemplateAutostopRequirement
+		userQuietHoursSchedule      string
 		// workspaceTTL is usually copied from the template's TTL when the
 		// workspace is made, so it takes precedence unless
 		// templateAllowAutostop is false.
@@ -88,72 +90,72 @@ func TestCalculateAutoStop(t *testing.T) {
 		errContains         string
 	}{
 		{
-			name:                       "OK",
-			now:                        now,
-			templateAllowAutostop:      true,
-			templateDefaultTTL:         0,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{},
-			workspaceTTL:               0,
-			expectedDeadline:           time.Time{},
-			expectedMaxDeadline:        time.Time{},
+			name:                        "OK",
+			now:                         now,
+			templateAllowAutostop:       true,
+			templateDefaultTTL:          0,
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{},
+			workspaceTTL:                0,
+			expectedDeadline:            time.Time{},
+			expectedMaxDeadline:         time.Time{},
 		},
 		{
-			name:                       "Delete",
-			now:                        now,
-			templateAllowAutostop:      true,
-			templateDefaultTTL:         0,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{},
-			workspaceTTL:               0,
-			expectedDeadline:           time.Time{},
-			expectedMaxDeadline:        time.Time{},
+			name:                        "Delete",
+			now:                         now,
+			templateAllowAutostop:       true,
+			templateDefaultTTL:          0,
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{},
+			workspaceTTL:                0,
+			expectedDeadline:            time.Time{},
+			expectedMaxDeadline:         time.Time{},
 		},
 		{
-			name:                       "WorkspaceTTL",
-			now:                        now,
-			templateAllowAutostop:      true,
-			templateDefaultTTL:         0,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{},
-			workspaceTTL:               time.Hour,
-			expectedDeadline:           now.Add(time.Hour),
-			expectedMaxDeadline:        time.Time{},
+			name:                        "WorkspaceTTL",
+			now:                         now,
+			templateAllowAutostop:       true,
+			templateDefaultTTL:          0,
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{},
+			workspaceTTL:                time.Hour,
+			expectedDeadline:            now.Add(time.Hour),
+			expectedMaxDeadline:         time.Time{},
 		},
 		{
-			name:                       "TemplateDefaultTTLIgnored",
-			now:                        now,
-			templateAllowAutostop:      true,
-			templateDefaultTTL:         time.Hour,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{},
-			workspaceTTL:               0,
-			expectedDeadline:           time.Time{},
-			expectedMaxDeadline:        time.Time{},
+			name:                        "TemplateDefaultTTLIgnored",
+			now:                         now,
+			templateAllowAutostop:       true,
+			templateDefaultTTL:          time.Hour,
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{},
+			workspaceTTL:                0,
+			expectedDeadline:            time.Time{},
+			expectedMaxDeadline:         time.Time{},
 		},
 		{
-			name:                       "WorkspaceTTLOverridesTemplateDefaultTTL",
-			now:                        now,
-			templateAllowAutostop:      true,
-			templateDefaultTTL:         2 * time.Hour,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{},
-			workspaceTTL:               time.Hour,
-			expectedDeadline:           now.Add(time.Hour),
-			expectedMaxDeadline:        time.Time{},
+			name:                        "WorkspaceTTLOverridesTemplateDefaultTTL",
+			now:                         now,
+			templateAllowAutostop:       true,
+			templateDefaultTTL:          2 * time.Hour,
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{},
+			workspaceTTL:                time.Hour,
+			expectedDeadline:            now.Add(time.Hour),
+			expectedMaxDeadline:         time.Time{},
 		},
 		{
-			name:                       "TemplateBlockWorkspaceTTL",
-			now:                        now,
-			templateAllowAutostop:      false,
-			templateDefaultTTL:         3 * time.Hour,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{},
-			workspaceTTL:               4 * time.Hour,
-			expectedDeadline:           now.Add(3 * time.Hour),
-			expectedMaxDeadline:        time.Time{},
+			name:                        "TemplateBlockWorkspaceTTL",
+			now:                         now,
+			templateAllowAutostop:       false,
+			templateDefaultTTL:          3 * time.Hour,
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{},
+			workspaceTTL:                4 * time.Hour,
+			expectedDeadline:            now.Add(3 * time.Hour),
+			expectedMaxDeadline:         time.Time{},
 		},
 		{
-			name:                   "TemplateRestartRequirement",
+			name:                   "TemplateAutostopRequirement",
 			now:                    wednesdayMidnightUTC,
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      0,          // weekly
 			},
@@ -162,12 +164,12 @@ func TestCalculateAutoStop(t *testing.T) {
 			expectedMaxDeadline: saturdayMidnightSydney.In(time.UTC),
 		},
 		{
-			name:                   "TemplateRestartRequirement1HourSkip",
+			name:                   "TemplateAutostopRequirement1HourSkip",
 			now:                    saturdayMidnightSydney.Add(-59 * time.Minute),
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      1,          // 1 also means weekly
 			},
@@ -176,14 +178,14 @@ func TestCalculateAutoStop(t *testing.T) {
 			expectedMaxDeadline: saturdayMidnightSydney.Add(7 * 24 * time.Hour).In(time.UTC),
 		},
 		{
-			// The next restart requirement should be skipped if the
+			// The next autostop requirement should be skipped if the
 			// workspace is started within 1 hour of it.
-			name:                   "TemplateRestartRequirementDaily",
+			name:                   "TemplateAutostopRequirementDaily",
 			now:                    fridayEveningSydney,
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b01111111, // daily
 				Weeks:      0,          // all weeks
 			},
@@ -192,12 +194,12 @@ func TestCalculateAutoStop(t *testing.T) {
 			expectedMaxDeadline: saturdayMidnightSydney.In(time.UTC),
 		},
 		{
-			name:                   "TemplateRestartRequirementFortnightly/Skip",
+			name:                   "TemplateAutostopRequirementFortnightly/Skip",
 			now:                    wednesdayMidnightUTC,
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      2,          // every 2 weeks
 			},
@@ -206,12 +208,12 @@ func TestCalculateAutoStop(t *testing.T) {
 			expectedMaxDeadline: saturdayMidnightSydney.AddDate(0, 0, 7).In(time.UTC),
 		},
 		{
-			name:                   "TemplateRestartRequirementFortnightly/NoSkip",
+			name:                   "TemplateAutostopRequirementFortnightly/NoSkip",
 			now:                    wednesdayMidnightUTC.AddDate(0, 0, 7),
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      2,          // every 2 weeks
 			},
@@ -220,28 +222,28 @@ func TestCalculateAutoStop(t *testing.T) {
 			expectedMaxDeadline: saturdayMidnightSydney.AddDate(0, 0, 7).In(time.UTC),
 		},
 		{
-			name:                   "TemplateRestartRequirementTriweekly/Skip",
+			name:                   "TemplateAutostopRequirementTriweekly/Skip",
 			now:                    wednesdayMidnightUTC,
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      3,          // every 3 weeks
 			},
 			workspaceTTL: 0,
 			// expectedDeadline is copied from expectedMaxDeadline.
-			// The next triweekly restart requirement happens next week
+			// The next triweekly autostop requirement happens next week
 			// according to the epoch.
 			expectedMaxDeadline: saturdayMidnightSydney.AddDate(0, 0, 7).In(time.UTC),
 		},
 		{
-			name:                   "TemplateRestartRequirementTriweekly/NoSkip",
+			name:                   "TemplateAutostopRequirementTriweekly/NoSkip",
 			now:                    wednesdayMidnightUTC.AddDate(0, 0, 7),
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      3,          // every 3 weeks
 			},
@@ -250,14 +252,14 @@ func TestCalculateAutoStop(t *testing.T) {
 			expectedMaxDeadline: saturdayMidnightSydney.AddDate(0, 0, 7).In(time.UTC),
 		},
 		{
-			name: "TemplateRestartRequirementOverridesWorkspaceTTL",
+			name: "TemplateAutostopRequirementOverridesWorkspaceTTL",
 			// now doesn't have to be UTC, but it helps us ensure that
 			// timezones are compared correctly in this test.
 			now:                    fridayEveningSydney.In(time.UTC),
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      0,          // weekly
 			},
@@ -266,12 +268,12 @@ func TestCalculateAutoStop(t *testing.T) {
 			expectedMaxDeadline: saturdayMidnightSydney.In(time.UTC),
 		},
 		{
-			name:                   "TemplateRestartRequirementOverridesTemplateDefaultTTL",
+			name:                   "TemplateAutostopRequirementOverridesTemplateDefaultTTL",
 			now:                    fridayEveningSydney.In(time.UTC),
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     3 * time.Hour,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      0,          // weekly
 			},
@@ -288,7 +290,7 @@ func TestCalculateAutoStop(t *testing.T) {
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      2,          // every fortnight
 			},
@@ -301,7 +303,7 @@ func TestCalculateAutoStop(t *testing.T) {
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      1,          // weekly
 			},
@@ -315,7 +317,7 @@ func TestCalculateAutoStop(t *testing.T) {
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      1,          // weekly
 			},
@@ -329,7 +331,7 @@ func TestCalculateAutoStop(t *testing.T) {
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      1,          // weekly
 			},
@@ -343,7 +345,7 @@ func TestCalculateAutoStop(t *testing.T) {
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: dstInQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b01000000, // Sunday
 				Weeks:      1,          // weekly
 			},
@@ -357,7 +359,7 @@ func TestCalculateAutoStop(t *testing.T) {
 			templateAllowAutostop:  true,
 			templateDefaultTTL:     0,
 			userQuietHoursSchedule: dstOutQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b01000000, // Sunday
 				Weeks:      1,          // weekly
 			},
@@ -368,14 +370,14 @@ func TestCalculateAutoStop(t *testing.T) {
 
 		// TODO(@dean): remove max_ttl tests
 		{
-			name:                   "RestartRequirementIgnoresMaxTTL",
+			name:                   "AutostopRequirementIgnoresMaxTTL",
 			now:                    fridayEveningSydney.In(time.UTC),
 			templateAllowAutostop:  false,
 			templateDefaultTTL:     0,
 			useMaxTTL:              false,
 			templateMaxTTL:         time.Hour, // should be ignored
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      0,          // weekly
 			},
@@ -384,14 +386,14 @@ func TestCalculateAutoStop(t *testing.T) {
 			expectedMaxDeadline: saturdayMidnightSydney.In(time.UTC),
 		},
 		{
-			name:                   "MaxTTLIgnoresRestartRequirement",
+			name:                   "MaxTTLIgnoresAutostopRequirement",
 			now:                    fridayEveningSydney.In(time.UTC),
 			templateAllowAutostop:  false,
 			templateDefaultTTL:     0,
 			useMaxTTL:              true,
 			templateMaxTTL:         time.Hour, // should NOT be ignored
 			userQuietHoursSchedule: sydneyQuietHours,
-			templateRestartRequirement: schedule.TemplateRestartRequirement{
+			templateAutostopRequirement: schedule.TemplateAutostopRequirement{
 				DaysOfWeek: 0b00100000, // Saturday
 				Weeks:      0,          // weekly
 			},
@@ -413,12 +415,12 @@ func TestCalculateAutoStop(t *testing.T) {
 			templateScheduleStore := schedule.MockTemplateScheduleStore{
 				GetFn: func(_ context.Context, _ database.Store, _ uuid.UUID) (schedule.TemplateScheduleOptions, error) {
 					return schedule.TemplateScheduleOptions{
-						UserAutostartEnabled:  false,
-						UserAutostopEnabled:   c.templateAllowAutostop,
-						DefaultTTL:            c.templateDefaultTTL,
-						MaxTTL:                c.templateMaxTTL,
-						UseRestartRequirement: !c.useMaxTTL,
-						RestartRequirement:    c.templateRestartRequirement,
+						UserAutostartEnabled:   false,
+						UserAutostopEnabled:    c.templateAllowAutostop,
+						DefaultTTL:             c.templateDefaultTTL,
+						MaxTTL:                 c.templateMaxTTL,
+						UseAutostopRequirement: !c.useMaxTTL,
+						AutostopRequirement:    c.templateAutostopRequirement,
 					}, nil
 				},
 			}
@@ -431,7 +433,7 @@ func TestCalculateAutoStop(t *testing.T) {
 						}, nil
 					}
 
-					sched, err := schedule.Daily(c.userQuietHoursSchedule)
+					sched, err := cron.Daily(c.userQuietHoursSchedule)
 					if !assert.NoError(t, err) {
 						return schedule.UserQuietHoursScheduleOptions{}, err
 					}
@@ -454,11 +456,11 @@ func TestCalculateAutoStop(t *testing.T) {
 				CreatedBy:      user.ID,
 			})
 			err := db.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
-				ID:                           template.ID,
-				UpdatedAt:                    database.Now(),
-				AllowUserAutostart:           c.templateAllowAutostop,
-				RestartRequirementDaysOfWeek: int16(c.templateRestartRequirement.DaysOfWeek),
-				RestartRequirementWeeks:      c.templateRestartRequirement.Weeks,
+				ID:                            template.ID,
+				UpdatedAt:                     dbtime.Now(),
+				AllowUserAutostart:            c.templateAllowAutostop,
+				AutostopRequirementDaysOfWeek: int16(c.templateAutostopRequirement.DaysOfWeek),
+				AutostopRequirementWeeks:      c.templateAutostopRequirement.Weeks,
 			})
 			require.NoError(t, err)
 			template, err = db.GetTemplateByID(ctx, template.ID)
diff --git a/coderd/schedule/cron.go b/coderd/schedule/cron/cron.go
similarity index 87%
rename from coderd/schedule/cron.go
rename to coderd/schedule/cron/cron.go
index 7a86b130d24bc..35102d66af34a 100644
--- a/coderd/schedule/cron.go
+++ b/coderd/schedule/cron/cron.go
@@ -1,23 +1,23 @@
 // package schedule provides utilities for managing template and workspace
 // autostart and autostop schedules. This includes utilities for parsing and
 // deserializing cron-style expressions.
-package schedule
+package cron
 
 import (
 	"fmt"
 	"strings"
 	"time"
 
-	"github.com/robfig/cron/v3"
+	rbcron "github.com/robfig/cron/v3"
 	"golang.org/x/xerrors"
 )
 
 // For the purposes of this library, we only need minute, hour, and
 // day-of-week. However to ensure interoperability we will use the standard
 // five-valued cron format. Descriptors are not supported.
-const parserFormat = cron.Minute | cron.Hour | cron.Dom | cron.Month | cron.Dow
+const parserFormat = rbcron.Minute | rbcron.Hour | rbcron.Dom | rbcron.Month | rbcron.Dow
 
-var defaultParser = cron.NewParser(parserFormat)
+var defaultParser = rbcron.NewParser(parserFormat)
 
 // Weekly parses a Schedule from spec scoped to a recurring weekly event.
 // Spec consists of the following space-delimited fields, in the following order:
@@ -30,11 +30,11 @@ var defaultParser = cron.NewParser(parserFormat)
 //
 // Example Usage:
 //
-//	local_sched, _ := schedule.Weekly("59 23 *")
+//	local_sched, _ := cron.Weekly("59 23 *")
 //	fmt.Println(sched.Next(time.Now().Format(time.RFC3339)))
 //	// Output: 2022-04-04T23:59:00Z
 //
-//	us_sched, _ := schedule.Weekly("CRON_TZ=US/Central 30 9 1-5")
+//	us_sched, _ := cron.Weekly("CRON_TZ=US/Central 30 9 1-5")
 //	fmt.Println(sched.Next(time.Now()).Format(time.RFC3339))
 //	// Output: 2022-04-04T14:30:00Z
 func Weekly(raw string) (*Schedule, error) {
@@ -56,11 +56,11 @@ func Weekly(raw string) (*Schedule, error) {
 //
 // Example Usage:
 //
-//	local_sched, _ := schedule.Weekly("59 23 * * *")
+//	local_sched, _ := cron.Weekly("59 23 * * *")
 //	fmt.Println(sched.Next(time.Now().Format(time.RFC3339)))
 //	// Output: 2022-04-04T23:59:00Z
 //
-//	us_sched, _ := schedule.Weekly("CRON_TZ=US/Central 30 9 * * *")
+//	us_sched, _ := cron.Weekly("CRON_TZ=US/Central 30 9 * * *")
 //	fmt.Println(sched.Next(time.Now()).Format(time.RFC3339))
 //	// Output: 2022-04-04T14:30:00Z
 func Daily(raw string) (*Schedule, error) {
@@ -83,7 +83,7 @@ func parse(raw string) (*Schedule, error) {
 		return nil, xerrors.Errorf("parse schedule: %w", err)
 	}
 
-	schedule, ok := specSched.(*cron.SpecSchedule)
+	schedule, ok := specSched.(*rbcron.SpecSchedule)
 	if !ok {
 		return nil, xerrors.Errorf("expected *cron.SpecSchedule but got %T", specSched)
 	}
@@ -110,7 +110,7 @@ func parse(raw string) (*Schedule, error) {
 // It's essentially a wrapper for robfig/cron/v3 that has additional
 // convenience methods.
 type Schedule struct {
-	sched *cron.SpecSchedule
+	sched *rbcron.SpecSchedule
 	// XXX: there isn't any nice way for robfig/cron to serialize
 	cronStr string
 }
@@ -173,6 +173,19 @@ func (s Schedule) Min() time.Duration {
 	return durMin
 }
 
+// TimeParsed returns the parsed time.Time of the minute and hour fields. If the
+// time cannot be represented in a valid time.Time, a zero time is returned.
+func (s Schedule) TimeParsed() time.Time {
+	minute := strings.Fields(s.cronStr)[0]
+	hour := strings.Fields(s.cronStr)[1]
+	maybeTime := fmt.Sprintf("%s:%s", hour, minute)
+	t, err := time.ParseInLocation("15:4", maybeTime, s.sched.Location)
+	if err != nil {
+		return time.Time{}
+	}
+	return t
+}
+
 // Time returns a humanized form of the minute and hour fields.
 func (s Schedule) Time() string {
 	minute := strings.Fields(s.cronStr)[0]
diff --git a/coderd/schedule/cron_test.go b/coderd/schedule/cron/cron_test.go
similarity index 98%
rename from coderd/schedule/cron_test.go
rename to coderd/schedule/cron/cron_test.go
index d09feb5578b20..7cf146767fab3 100644
--- a/coderd/schedule/cron_test.go
+++ b/coderd/schedule/cron/cron_test.go
@@ -1,4 +1,4 @@
-package schedule_test
+package cron_test
 
 import (
 	"testing"
@@ -6,7 +6,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
 )
 
 func Test_Weekly(t *testing.T) {
@@ -144,7 +144,7 @@ func Test_Weekly(t *testing.T) {
 		testCase := testCase
 		t.Run(testCase.name, func(t *testing.T) {
 			t.Parallel()
-			actual, err := schedule.Weekly(testCase.spec)
+			actual, err := cron.Weekly(testCase.spec)
 			if testCase.expectedError == "" {
 				nextTime := actual.Next(testCase.at)
 				require.NoError(t, err)
diff --git a/coderd/schedule/mock.go b/coderd/schedule/mock.go
index 4a22197b57dc4..1fe33bb549e81 100644
--- a/coderd/schedule/mock.go
+++ b/coderd/schedule/mock.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/google/uuid"
 
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/database"
 )
 
 type MockTemplateScheduleStore struct {
diff --git a/coderd/schedule/template.go b/coderd/schedule/template.go
index de97dffc9ac2a..fc274d9a7d8ba 100644
--- a/coderd/schedule/template.go
+++ b/coderd/schedule/template.go
@@ -7,12 +7,14 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
-const MaxTemplateRestartRequirementWeeks = 16
+const MaxTemplateAutostopRequirementWeeks = 16
 
-func TemplateRestartRequirementEpoch(loc *time.Location) time.Time {
+func TemplateAutostopRequirementEpoch(loc *time.Location) time.Time {
 	// The "first week" starts on January 2nd, 2023, which is the first Monday
 	// of 2023. All other weeks are counted using modulo arithmetic from that
 	// date.
@@ -33,7 +35,19 @@ var DaysOfWeek = []time.Weekday{
 	time.Sunday,
 }
 
-type TemplateRestartRequirement struct {
+type TemplateAutostartRequirement struct {
+	// DaysOfWeek is a bitmap of which days of the week the workspace is allowed
+	// to be auto started. If fully zero, the workspace is not allowed to be auto started.
+	//
+	// First bit is Monday, ..., seventh bit is Sunday, eighth bit is unused.
+	DaysOfWeek uint8
+}
+
+func (r TemplateAutostartRequirement) DaysMap() map[time.Weekday]bool {
+	return daysMap(r.DaysOfWeek)
+}
+
+type TemplateAutostopRequirement struct {
 	// DaysOfWeek is a bitmap of which days of the week the workspace must be
 	// restarted. If fully zero, the workspace is not required to be restarted
 	// ever.
@@ -54,29 +68,48 @@ type TemplateRestartRequirement struct {
 
 // DaysMap returns a map of the days of the week that the workspace must be
 // restarted.
-func (r TemplateRestartRequirement) DaysMap() map[time.Weekday]bool {
+func (r TemplateAutostopRequirement) DaysMap() map[time.Weekday]bool {
+	return daysMap(r.DaysOfWeek)
+}
+
+// daysMap returns a map of the days of the week that are specified in the
+// bitmap.
+func daysMap(daysOfWeek uint8) map[time.Weekday]bool {
 	days := make(map[time.Weekday]bool)
 	for i, day := range DaysOfWeek {
-		days[day] = r.DaysOfWeek&(1<<uint(i)) != 0
+		days[day] = daysOfWeek&(1<<uint(i)) != 0
 	}
 	return days
 }
 
-// VerifyTemplateRestartRequirement returns an error if the restart requirement
-// is invalid.
-func VerifyTemplateRestartRequirement(days uint8, weeks int64) error {
+// VerifyTemplateAutostopRequirement returns an error if the autostop
+// requirement is invalid.
+func VerifyTemplateAutostopRequirement(days uint8, weeks int64) error {
 	if days&0b10000000 != 0 {
-		return xerrors.New("invalid restart requirement days, last bit is set")
+		return xerrors.New("invalid autostop requirement days, last bit is set")
 	}
 	if days > 0b11111111 {
-		return xerrors.New("invalid restart requirement days, too large")
+		return xerrors.New("invalid autostop requirement days, too large")
+	}
+	if weeks < 1 {
+		return xerrors.New("invalid autostop requirement weeks, less than 1")
 	}
-	if weeks < 0 {
-		return xerrors.New("invalid restart requirement weeks, negative")
+	if weeks > MaxTemplateAutostopRequirementWeeks {
+		return xerrors.New("invalid autostop requirement weeks, too large")
 	}
-	if weeks > MaxTemplateRestartRequirementWeeks {
-		return xerrors.New("invalid restart requirement weeks, too large")
+	return nil
+}
+
+// VerifyTemplateAutostartRequirement returns an error if the autostart
+// requirement is invalid.
+func VerifyTemplateAutostartRequirement(days uint8) error {
+	if days&0b10000000 != 0 {
+		return xerrors.New("invalid autostart requirement days, last bit is set")
+	}
+	if days > 0b11111111 {
+		return xerrors.New("invalid autostart requirement days, too large")
 	}
+
 	return nil
 }
 
@@ -84,26 +117,40 @@ type TemplateScheduleOptions struct {
 	UserAutostartEnabled bool          `json:"user_autostart_enabled"`
 	UserAutostopEnabled  bool          `json:"user_autostop_enabled"`
 	DefaultTTL           time.Duration `json:"default_ttl"`
-	// TODO(@dean): remove MaxTTL once restart_requirement is matured and the
+	// TODO(@dean): remove MaxTTL once autostop_requirement is matured and the
 	// default
 	MaxTTL time.Duration `json:"max_ttl"`
-	// UseRestartRequirement dictates whether the restart requirement should be
-	// used instead of MaxTTL. This is governed by the feature flag and
+	// UseAutostopRequirement dictates whether the autostop requirement should
+	// be used instead of MaxTTL. This is governed by the feature flag and
 	// licensing.
 	// TODO(@dean): remove this when we remove max_tll
-	UseRestartRequirement bool
-	// RestartRequirement dictates when the workspace must be restarted. This
+	UseAutostopRequirement bool
+	// AutostopRequirement dictates when the workspace must be restarted. This
 	// used to be handled by MaxTTL.
-	RestartRequirement TemplateRestartRequirement `json:"restart_requirement"`
+	AutostopRequirement TemplateAutostopRequirement `json:"autostop_requirement"`
+	// AutostartRequirement dictates when the workspace can be auto started.
+	AutostartRequirement TemplateAutostartRequirement `json:"autostart_requirement"`
 	// FailureTTL dictates the duration after which failed workspaces will be
 	// stopped automatically.
 	FailureTTL time.Duration `json:"failure_ttl"`
-	// InactivityTTL dictates the duration after which inactive workspaces will
-	// be locked.
-	InactivityTTL time.Duration `json:"inactivity_ttl"`
-	// LockedTTL dictates the duration after which locked workspaces will be
+	// TimeTilDormant dictates the duration after which inactive workspaces will
+	// go dormant.
+	TimeTilDormant time.Duration `json:"time_til_dormant"`
+	// TimeTilDormantAutoDelete dictates the duration after which dormant workspaces will be
 	// permanently deleted.
-	LockedTTL time.Duration `json:"locked_ttl"`
+	TimeTilDormantAutoDelete time.Duration `json:"time_til_dormant_autodelete"`
+	// UpdateWorkspaceLastUsedAt updates the template's workspaces'
+	// last_used_at field. This is useful for preventing updates to the
+	// templates inactivity_ttl immediately triggering a dormant action against
+	// workspaces whose last_used_at field violates the new template
+	// inactivity_ttl threshold.
+	UpdateWorkspaceLastUsedAt bool `json:"update_workspace_last_used_at"`
+	// UpdateWorkspaceDormantAt updates the template's workspaces'
+	// dormant_at field. This is useful for preventing updates to the
+	// templates locked_ttl immediately triggering a delete action against
+	// workspaces whose dormant_at field violates the new template time_til_dormant_autodelete
+	// threshold.
+	UpdateWorkspaceDormantAt bool `json:"update_workspace_dormant_at"`
 }
 
 // TemplateScheduleStore provides an interface for retrieving template
@@ -122,6 +169,9 @@ func NewAGPLTemplateScheduleStore() TemplateScheduleStore {
 }
 
 func (*agplTemplateScheduleStore) Get(ctx context.Context, db database.Store, templateID uuid.UUID) (TemplateScheduleOptions, error) {
+	ctx, span := tracing.StartSpan(ctx)
+	defer span.End()
+
 	tpl, err := db.GetTemplateByID(ctx, templateID)
 	if err != nil {
 		return TemplateScheduleOptions{}, err
@@ -133,21 +183,30 @@ func (*agplTemplateScheduleStore) Get(ctx context.Context, db database.Store, te
 		UserAutostartEnabled: true,
 		UserAutostopEnabled:  true,
 		DefaultTTL:           time.Duration(tpl.DefaultTTL),
-		// Disregard the values in the database, since RestartRequirement,
-		// FailureTTL, InactivityTTL, and LockedTTL are enterprise features.
-		UseRestartRequirement: false,
-		MaxTTL:                0,
-		RestartRequirement: TemplateRestartRequirement{
+		// Disregard the values in the database, since AutostopRequirement,
+		// FailureTTL, TimeTilDormant, and TimeTilDormantAutoDelete are enterprise features.
+		UseAutostopRequirement: false,
+		MaxTTL:                 0,
+		AutostartRequirement: TemplateAutostartRequirement{
+			// Default to allowing all days for AGPL
+			DaysOfWeek: 0b01111111,
+		},
+		AutostopRequirement: TemplateAutostopRequirement{
+			// No days means never. The weeks value should always be greater
+			// than zero though.
 			DaysOfWeek: 0,
-			Weeks:      0,
+			Weeks:      1,
 		},
-		FailureTTL:    0,
-		InactivityTTL: 0,
-		LockedTTL:     0,
+		FailureTTL:               0,
+		TimeTilDormant:           0,
+		TimeTilDormantAutoDelete: 0,
 	}, nil
 }
 
 func (*agplTemplateScheduleStore) Set(ctx context.Context, db database.Store, tpl database.Template, opts TemplateScheduleOptions) (database.Template, error) {
+	ctx, span := tracing.StartSpan(ctx)
+	defer span.End()
+
 	if int64(opts.DefaultTTL) == tpl.DefaultTTL {
 		// Avoid updating the UpdatedAt timestamp if nothing will be changed.
 		return tpl, nil
@@ -157,18 +216,19 @@ func (*agplTemplateScheduleStore) Set(ctx context.Context, db database.Store, tp
 	err := db.InTx(func(db database.Store) error {
 		err := db.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
 			ID:         tpl.ID,
-			UpdatedAt:  database.Now(),
+			UpdatedAt:  dbtime.Now(),
 			DefaultTTL: int64(opts.DefaultTTL),
 			// Don't allow changing these settings, but keep the value in the DB (to
 			// avoid clearing settings if the license has an issue).
-			MaxTTL:                       tpl.MaxTTL,
-			RestartRequirementDaysOfWeek: tpl.RestartRequirementDaysOfWeek,
-			RestartRequirementWeeks:      tpl.RestartRequirementWeeks,
-			AllowUserAutostart:           tpl.AllowUserAutostart,
-			AllowUserAutostop:            tpl.AllowUserAutostop,
-			FailureTTL:                   tpl.FailureTTL,
-			InactivityTTL:                tpl.InactivityTTL,
-			LockedTTL:                    tpl.LockedTTL,
+			MaxTTL:                        tpl.MaxTTL,
+			AutostopRequirementDaysOfWeek: tpl.AutostopRequirementDaysOfWeek,
+			AutostopRequirementWeeks:      tpl.AutostopRequirementWeeks,
+			AutostartBlockDaysOfWeek:      tpl.AutostartBlockDaysOfWeek,
+			AllowUserAutostart:            tpl.AllowUserAutostart,
+			AllowUserAutostop:             tpl.AllowUserAutostop,
+			FailureTTL:                    tpl.FailureTTL,
+			TimeTilDormant:                tpl.TimeTilDormant,
+			TimeTilDormantAutoDelete:      tpl.TimeTilDormantAutoDelete,
 		})
 		if err != nil {
 			return xerrors.Errorf("update template schedule: %w", err)
diff --git a/coderd/schedule/user.go b/coderd/schedule/user.go
index 967a430fcccd2..2ba9ce1621e37 100644
--- a/coderd/schedule/user.go
+++ b/coderd/schedule/user.go
@@ -5,7 +5,8 @@ import (
 
 	"github.com/google/uuid"
 
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
 )
 
 type UserQuietHoursScheduleOptions struct {
@@ -17,7 +18,7 @@ type UserQuietHoursScheduleOptions struct {
 	// schedule (and UserSet will be false). If quiet hours schedules are not
 	// entitled or disabled instance-wide, this value will be nil to denote that
 	// quiet hours windows should not be used.
-	Schedule *Schedule
+	Schedule *cron.Schedule
 	UserSet  bool
 }
 
diff --git a/coderd/searchquery/search.go b/coderd/searchquery/search.go
index 9b216d0180e15..66f947dbaa313 100644
--- a/coderd/searchquery/search.go
+++ b/coderd/searchquery/search.go
@@ -10,10 +10,9 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func AuditLogs(query string) (database.GetAuditLogsOffsetParams, []codersdk.ValidationError) {
@@ -70,11 +69,7 @@ func Users(query string) (database.GetUsersParams, []codersdk.ValidationError) {
 	return filter, parser.Errors
 }
 
-type PostFilter struct {
-	DeletingBy *time.Time `json:"deleting_by" format:"date-time"`
-}
-
-func Workspaces(query string, page codersdk.Pagination, agentInactiveDisconnectTimeout time.Duration) (database.GetWorkspacesParams, PostFilter, []codersdk.ValidationError) {
+func Workspaces(query string, page codersdk.Pagination, agentInactiveDisconnectTimeout time.Duration) (database.GetWorkspacesParams, []codersdk.ValidationError) {
 	filter := database.GetWorkspacesParams{
 		AgentInactiveDisconnectTimeoutSeconds: int64(agentInactiveDisconnectTimeout.Seconds()),
 
@@ -82,10 +77,8 @@ func Workspaces(query string, page codersdk.Pagination, agentInactiveDisconnectT
 		Limit:  int32(page.Limit),
 	}
 
-	var postFilter PostFilter
-
 	if query == "" {
-		return filter, postFilter, nil
+		return filter, nil
 	}
 
 	// Always lowercase for all searches.
@@ -105,7 +98,7 @@ func Workspaces(query string, page codersdk.Pagination, agentInactiveDisconnectT
 		return nil
 	})
 	if len(errors) > 0 {
-		return filter, postFilter, errors
+		return filter, errors
 	}
 
 	parser := httpapi.NewQueryParamParser()
@@ -114,13 +107,12 @@ func Workspaces(query string, page codersdk.Pagination, agentInactiveDisconnectT
 	filter.Name = parser.String(values, "", "name")
 	filter.Status = string(httpapi.ParseCustom(parser, values, "", "status", httpapi.ParseEnum[database.WorkspaceStatus]))
 	filter.HasAgent = parser.String(values, "", "has-agent")
-
-	if _, ok := values["deleting_by"]; ok {
-		postFilter.DeletingBy = ptr.Ref(parser.Time(values, time.Time{}, "deleting_by", "2006-01-02"))
-	}
+	filter.IsDormant = parser.String(values, "", "is-dormant")
+	filter.LastUsedAfter = parser.Time3339Nano(values, time.Time{}, "last_used_after")
+	filter.LastUsedBefore = parser.Time3339Nano(values, time.Time{}, "last_used_before")
 
 	parser.ErrorExcessParams(values)
-	return filter, postFilter, parser.Errors
+	return filter, parser.Errors
 }
 
 func searchTerms(query string, defaultKey func(term string, values url.Values) error) (url.Values, []codersdk.ValidationError) {
diff --git a/coderd/searchquery/search_test.go b/coderd/searchquery/search_test.go
index 4a7f61331a5f2..9a2f1f0ed0b28 100644
--- a/coderd/searchquery/search_test.go
+++ b/coderd/searchquery/search_test.go
@@ -9,11 +9,10 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/searchquery"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/searchquery"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestSearchWorkspace(t *testing.T) {
@@ -142,7 +141,7 @@ func TestSearchWorkspace(t *testing.T) {
 		{
 			Name:                  "ExtraKeys",
 			Query:                 `foo:bar`,
-			ExpectedErrorContains: `Query param "foo" is not a valid query param`,
+			ExpectedErrorContains: `"foo" is not a valid query param`,
 		},
 	}
 
@@ -150,7 +149,7 @@ func TestSearchWorkspace(t *testing.T) {
 		c := c
 		t.Run(c.Name, func(t *testing.T) {
 			t.Parallel()
-			values, postFilter, errs := searchquery.Workspaces(c.Query, codersdk.Pagination{}, 0)
+			values, errs := searchquery.Workspaces(c.Query, codersdk.Pagination{}, 0)
 			if c.ExpectedErrorContains != "" {
 				assert.True(t, len(errs) > 0, "expect some errors")
 				var s strings.Builder
@@ -159,7 +158,6 @@ func TestSearchWorkspace(t *testing.T) {
 				}
 				assert.Contains(t, s.String(), c.ExpectedErrorContains)
 			} else {
-				assert.Empty(t, postFilter)
 				assert.Len(t, errs, 0, "expected no error")
 				assert.Equal(t, c.Expected, values, "expected values")
 			}
@@ -170,51 +168,10 @@ func TestSearchWorkspace(t *testing.T) {
 
 		query := ``
 		timeout := 1337 * time.Second
-		values, _, errs := searchquery.Workspaces(query, codersdk.Pagination{}, timeout)
+		values, errs := searchquery.Workspaces(query, codersdk.Pagination{}, timeout)
 		require.Empty(t, errs)
 		require.Equal(t, int64(timeout.Seconds()), values.AgentInactiveDisconnectTimeoutSeconds)
 	})
-
-	t.Run("TestSearchWorkspacePostFilter", func(t *testing.T) {
-		t.Parallel()
-		testCases := []struct {
-			Name     string
-			Query    string
-			Expected searchquery.PostFilter
-		}{
-			{
-				Name:     "Empty",
-				Query:    "",
-				Expected: searchquery.PostFilter{},
-			},
-			{
-				Name:  "DeletingBy",
-				Query: "deleting_by:2023-06-09",
-				Expected: searchquery.PostFilter{
-					DeletingBy: ptr.Ref(time.Date(
-						2023, 6, 9, 0, 0, 0, 0, time.UTC)),
-				},
-			},
-			{
-				Name:  "MultipleParams",
-				Query: "deleting_by:2023-06-09 name:workspace-name",
-				Expected: searchquery.PostFilter{
-					DeletingBy: ptr.Ref(time.Date(
-						2023, 6, 9, 0, 0, 0, 0, time.UTC)),
-				},
-			},
-		}
-
-		for _, c := range testCases {
-			c := c
-			t.Run(c.Name, func(t *testing.T) {
-				t.Parallel()
-				_, postFilter, errs := searchquery.Workspaces(c.Query, codersdk.Pagination{}, 0)
-				assert.Len(t, errs, 0, "expected no error")
-				assert.Equal(t, c.Expected, postFilter, "expected values")
-			})
-		}
-	})
 }
 
 func TestSearchAudit(t *testing.T) {
@@ -239,7 +196,7 @@ func TestSearchAudit(t *testing.T) {
 		{
 			Name:                  "ExtraKeys",
 			Query:                 `foo:bar`,
-			ExpectedErrorContains: `Query param "foo" is not a valid query param`,
+			ExpectedErrorContains: `"foo" is not a valid query param`,
 		},
 		{
 			Name:                  "Dates",
@@ -370,7 +327,7 @@ func TestSearchUsers(t *testing.T) {
 		{
 			Name:                  "ExtraKeys",
 			Query:                 `foo:bar`,
-			ExpectedErrorContains: `Query param "foo" is not a valid query param`,
+			ExpectedErrorContains: `"foo" is not a valid query param`,
 		},
 	}
 
diff --git a/coderd/tailnet.go b/coderd/tailnet.go
index c37f583da252e..c5b2345728606 100644
--- a/coderd/tailnet.go
+++ b/coderd/tailnet.go
@@ -14,15 +14,17 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/xerrors"
 	"tailscale.com/derp"
 	"tailscale.com/tailcfg"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/wsconncache"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/site"
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/wsconncache"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/site"
+	"github.com/coder/coder/v2/tailnet"
 	"github.com/coder/retry"
 )
 
@@ -42,31 +44,59 @@ func NewServerTailnet(
 	ctx context.Context,
 	logger slog.Logger,
 	derpServer *derp.Server,
-	derpMap *tailcfg.DERPMap,
+	derpMapFn func() *tailcfg.DERPMap,
+	derpForceWebSockets bool,
 	getMultiAgent func(context.Context) (tailnet.MultiAgentConn, error),
 	cache *wsconncache.Cache,
+	traceProvider trace.TracerProvider,
 ) (*ServerTailnet, error) {
 	logger = logger.Named("servertailnet")
+	originalDerpMap := derpMapFn()
 	conn, err := tailnet.NewConn(&tailnet.Options{
-		Addresses: []netip.Prefix{netip.PrefixFrom(tailnet.IP(), 128)},
-		DERPMap:   derpMap,
-		Logger:    logger,
+		Addresses:           []netip.Prefix{netip.PrefixFrom(tailnet.IP(), 128)},
+		DERPMap:             originalDerpMap,
+		DERPForceWebSockets: derpForceWebSockets,
+		Logger:              logger,
 	})
 	if err != nil {
 		return nil, xerrors.Errorf("create tailnet conn: %w", err)
 	}
 
 	serverCtx, cancel := context.WithCancel(ctx)
+	derpMapUpdaterClosed := make(chan struct{})
+	go func() {
+		defer close(derpMapUpdaterClosed)
+
+		ticker := time.NewTicker(5 * time.Second)
+		defer ticker.Stop()
+
+		for {
+			select {
+			case <-serverCtx.Done():
+				return
+			case <-ticker.C:
+			}
+
+			newDerpMap := derpMapFn()
+			if !tailnet.CompareDERPMaps(originalDerpMap, newDerpMap) {
+				conn.SetDERPMap(newDerpMap)
+				originalDerpMap = newDerpMap
+			}
+		}
+	}()
+
 	tn := &ServerTailnet{
-		ctx:           serverCtx,
-		cancel:        cancel,
-		logger:        logger,
-		conn:          conn,
-		getMultiAgent: getMultiAgent,
-		cache:         cache,
-		agentNodes:    map[uuid.UUID]time.Time{},
-		agentTickets:  map[uuid.UUID]map[uuid.UUID]struct{}{},
-		transport:     tailnetTransport.Clone(),
+		ctx:                  serverCtx,
+		cancel:               cancel,
+		derpMapUpdaterClosed: derpMapUpdaterClosed,
+		logger:               logger,
+		tracer:               traceProvider.Tracer(tracing.TracerName),
+		conn:                 conn,
+		getMultiAgent:        getMultiAgent,
+		cache:                cache,
+		agentConnectionTimes: map[uuid.UUID]time.Time{},
+		agentTickets:         map[uuid.UUID]map[uuid.UUID]struct{}{},
+		transport:            tailnetTransport.Clone(),
 	}
 	tn.transport.DialContext = tn.dialContext
 	tn.transport.MaxIdleConnsPerHost = 10
@@ -139,25 +169,50 @@ func (s *ServerTailnet) expireOldAgents() {
 		case <-ticker.C:
 		}
 
-		s.nodesMu.Lock()
-		agentConn := s.getAgentConn()
-		for agentID, lastConnection := range s.agentNodes {
-			// If no one has connected since the cutoff and there are no active
-			// connections, remove the agent.
-			if time.Since(lastConnection) > cutoff && len(s.agentTickets[agentID]) == 0 {
-				_ = agentConn
-				// err := agentConn.UnsubscribeAgent(agentID)
-				// if err != nil {
-				// 	s.logger.Error(s.ctx, "unsubscribe expired agent", slog.Error(err), slog.F("agent_id", agentID))
-				// }
-				// delete(s.agentNodes, agentID)
-
-				// TODO(coadler): actually remove from the netmap, then reenable
-				// the above
+		s.doExpireOldAgents(cutoff)
+	}
+}
+
+func (s *ServerTailnet) doExpireOldAgents(cutoff time.Duration) {
+	// TODO: add some attrs to this.
+	ctx, span := s.tracer.Start(s.ctx, tracing.FuncName())
+	defer span.End()
+
+	start := time.Now()
+	deletedCount := 0
+
+	s.nodesMu.Lock()
+	s.logger.Debug(ctx, "pruning inactive agents", slog.F("agent_count", len(s.agentConnectionTimes)))
+	agentConn := s.getAgentConn()
+	for agentID, lastConnection := range s.agentConnectionTimes {
+		// If no one has connected since the cutoff and there are no active
+		// connections, remove the agent.
+		if time.Since(lastConnection) > cutoff && len(s.agentTickets[agentID]) == 0 {
+			deleted, err := s.conn.RemovePeer(tailnet.PeerSelector{
+				ID: tailnet.NodeID(agentID),
+				IP: netip.PrefixFrom(tailnet.IPFromUUID(agentID), 128),
+			})
+			if err != nil {
+				s.logger.Warn(ctx, "failed to remove peer from server tailnet", slog.Error(err))
+				continue
+			}
+			if !deleted {
+				s.logger.Warn(ctx, "peer didn't exist in tailnet", slog.Error(err))
+			}
+
+			deletedCount++
+			delete(s.agentConnectionTimes, agentID)
+			err = agentConn.UnsubscribeAgent(agentID)
+			if err != nil {
+				s.logger.Error(ctx, "unsubscribe expired agent", slog.Error(err), slog.F("agent_id", agentID))
 			}
 		}
-		s.nodesMu.Unlock()
 	}
+	s.nodesMu.Unlock()
+	s.logger.Debug(s.ctx, "successfully pruned inactive agents",
+		slog.F("deleted", deletedCount),
+		slog.F("took", time.Since(start)),
+	)
 }
 
 func (s *ServerTailnet) watchAgentUpdates() {
@@ -174,6 +229,10 @@ func (s *ServerTailnet) watchAgentUpdates() {
 
 		err := s.conn.UpdateNodes(nodes, false)
 		if err != nil {
+			if xerrors.Is(err, tailnet.ErrConnClosed) {
+				s.logger.Warn(context.Background(), "tailnet conn closed, exiting watchAgentUpdates", slog.Error(err))
+				return
+			}
 			s.logger.Error(context.Background(), "update node in server tailnet", slog.Error(err))
 			return
 		}
@@ -196,7 +255,7 @@ func (s *ServerTailnet) reinitCoordinator() {
 		s.agentConn.Store(&agentConn)
 
 		// Resubscribe to all of the agents we're tracking.
-		for agentID := range s.agentNodes {
+		for agentID := range s.agentConnectionTimes {
 			err := agentConn.SubscribeAgent(agentID)
 			if err != nil {
 				s.logger.Warn(s.ctx, "resubscribe to agent", slog.Error(err), slog.F("agent_id", agentID))
@@ -208,18 +267,21 @@ func (s *ServerTailnet) reinitCoordinator() {
 }
 
 type ServerTailnet struct {
-	ctx    context.Context
-	cancel func()
+	ctx                  context.Context
+	cancel               func()
+	derpMapUpdaterClosed chan struct{}
 
 	logger        slog.Logger
+	tracer        trace.Tracer
 	conn          *tailnet.Conn
 	getMultiAgent func(context.Context) (tailnet.MultiAgentConn, error)
 	agentConn     atomic.Pointer[tailnet.MultiAgentConn]
 	cache         *wsconncache.Cache
 	nodesMu       sync.Mutex
-	// agentNodes is a map of agent tailnetNodes the server wants to keep a
-	// connection to. It contains the last time the agent was connected to.
-	agentNodes map[uuid.UUID]time.Time
+	// agentConnectionTimes is a map of agent tailnetNodes the server wants to
+	// keep a connection to. It contains the last time the agent was connected
+	// to.
+	agentConnectionTimes map[uuid.UUID]time.Time
 	// agentTockets holds a map of all open connections to an agent.
 	agentTickets map[uuid.UUID]map[uuid.UUID]struct{}
 
@@ -268,7 +330,7 @@ func (s *ServerTailnet) ensureAgent(agentID uuid.UUID) error {
 	s.nodesMu.Lock()
 	defer s.nodesMu.Unlock()
 
-	_, ok := s.agentNodes[agentID]
+	_, ok := s.agentConnectionTimes[agentID]
 	// If we don't have the node, subscribe.
 	if !ok {
 		s.logger.Debug(s.ctx, "subscribing to agent", slog.F("agent_id", agentID))
@@ -279,14 +341,27 @@ func (s *ServerTailnet) ensureAgent(agentID uuid.UUID) error {
 		s.agentTickets[agentID] = map[uuid.UUID]struct{}{}
 	}
 
-	s.agentNodes[agentID] = time.Now()
+	s.agentConnectionTimes[agentID] = time.Now()
 	return nil
 }
 
+func (s *ServerTailnet) acquireTicket(agentID uuid.UUID) (release func()) {
+	id := uuid.New()
+	s.nodesMu.Lock()
+	s.agentTickets[agentID][id] = struct{}{}
+	s.nodesMu.Unlock()
+
+	return func() {
+		s.nodesMu.Lock()
+		delete(s.agentTickets[agentID], id)
+		s.nodesMu.Unlock()
+	}
+}
+
 func (s *ServerTailnet) AgentConn(ctx context.Context, agentID uuid.UUID) (*codersdk.WorkspaceAgentConn, func(), error) {
 	var (
 		conn *codersdk.WorkspaceAgentConn
-		ret  = func() {}
+		ret  func()
 	)
 
 	if s.getAgentConn().AgentIsLegacy(agentID) {
@@ -299,12 +374,13 @@ func (s *ServerTailnet) AgentConn(ctx context.Context, agentID uuid.UUID) (*code
 		conn = cconn.WorkspaceAgentConn
 		ret = release
 	} else {
+		s.logger.Debug(s.ctx, "acquiring agent", slog.F("agent_id", agentID))
 		err := s.ensureAgent(agentID)
 		if err != nil {
 			return nil, nil, xerrors.Errorf("ensure agent: %w", err)
 		}
+		ret = s.acquireTicket(agentID)
 
-		s.logger.Debug(s.ctx, "acquiring agent", slog.F("agent_id", agentID))
 		conn = codersdk.NewWorkspaceAgentConn(s.conn, codersdk.WorkspaceAgentConnOptions{
 			AgentID:   agentID,
 			CloseFunc: func() error { return codersdk.ErrSkipClose },
@@ -317,7 +393,6 @@ func (s *ServerTailnet) AgentConn(ctx context.Context, agentID uuid.UUID) (*code
 	reachable := conn.AwaitReachable(ctx)
 	if !reachable {
 		ret()
-		conn.Close()
 		return nil, nil, xerrors.New("agent is unreachable")
 	}
 
@@ -336,13 +411,11 @@ func (s *ServerTailnet) DialAgentNetConn(ctx context.Context, agentID uuid.UUID,
 	nc, err := conn.DialContext(ctx, network, addr)
 	if err != nil {
 		release()
-		conn.Close()
 		return nil, xerrors.Errorf("dial context: %w", err)
 	}
 
 	return &netConnCloser{Conn: nc, close: func() {
 		release()
-		conn.Close()
 	}}, err
 }
 
@@ -361,5 +434,6 @@ func (s *ServerTailnet) Close() error {
 	_ = s.cache.Close()
 	_ = s.conn.Close()
 	s.transport.CloseIdleConnections()
+	<-s.derpMapUpdaterClosed
 	return nil
 }
diff --git a/coderd/tailnet_test.go b/coderd/tailnet_test.go
index 05adbcc4fb597..2a0b0dfdbae70 100644
--- a/coderd/tailnet_test.go
+++ b/coderd/tailnet_test.go
@@ -14,18 +14,20 @@ import (
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel/trace"
+	"tailscale.com/tailcfg"
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/agent/agenttest"
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/wsconncache"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/tailnet"
-	"github.com/coder/coder/tailnet/tailnettest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/wsconncache"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/tailnet/tailnettest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestServerTailnet_AgentConn_OK(t *testing.T) {
@@ -229,9 +231,11 @@ func setupAgent(t *testing.T, agentAddresses []netip.Prefix) (uuid.UUID, agent.A
 		context.Background(),
 		logger,
 		derpServer,
-		manifest.DERPMap,
+		func() *tailcfg.DERPMap { return manifest.DERPMap },
+		false,
 		func(context.Context) (tailnet.MultiAgentConn, error) { return coord.ServeMultiAgent(uuid.New()), nil },
 		cache,
+		trace.NewNoopTracerProvider(),
 	)
 	require.NoError(t, err)
 
diff --git a/coderd/telemetry/telemetry.go b/coderd/telemetry/telemetry.go
index ced52a58fd273..39f3b892c2150 100644
--- a/coderd/telemetry/telemetry.go
+++ b/coderd/telemetry/telemetry.go
@@ -22,9 +22,10 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/buildinfo"
+	clitelemetry "github.com/coder/coder/v2/cli/telemetry"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
 )
 
 const (
@@ -78,7 +79,7 @@ func New(options Options) (Reporter, error) {
 		options:       options,
 		deploymentURL: deploymentURL,
 		snapshotURL:   snapshotURL,
-		startedAt:     database.Now(),
+		startedAt:     dbtime.Now(),
 	}
 	go reporter.runSnapshotter()
 	return reporter, nil
@@ -151,7 +152,7 @@ func (r *remoteReporter) Close() {
 		return
 	}
 	close(r.closed)
-	now := database.Now()
+	now := dbtime.Now()
 	r.shutdownAt = &now
 	// Report a final collection of telemetry prior to close!
 	// This could indicate final actions a user has taken, and
@@ -290,7 +291,7 @@ func (r *remoteReporter) createSnapshot() (*Snapshot, error) {
 		ctx = r.ctx
 		// For resources that grow in size very quickly (like workspace builds),
 		// we only report events that occurred within the past hour.
-		createdAfter = database.Now().Add(-1 * time.Hour)
+		createdAfter = dbtime.Now().Add(-1 * time.Hour)
 		eg           errgroup.Group
 		snapshot     = &Snapshot{
 			DeploymentID: r.options.DeploymentID,
@@ -460,6 +461,17 @@ func (r *remoteReporter) createSnapshot() (*Snapshot, error) {
 		}
 		return nil
 	})
+	eg.Go(func() error {
+		proxies, err := r.options.Database.GetWorkspaceProxies(ctx)
+		if err != nil {
+			return xerrors.Errorf("get workspace proxies: %w", err)
+		}
+		snapshot.WorkspaceProxies = make([]WorkspaceProxy, 0, len(proxies))
+		for _, proxy := range proxies {
+			snapshot.WorkspaceProxies = append(snapshot.WorkspaceProxies, ConvertWorkspaceProxy(proxy))
+		}
+		return nil
+	})
 
 	err := eg.Wait()
 	if err != nil {
@@ -494,6 +506,7 @@ func ConvertWorkspace(workspace database.Workspace) Workspace {
 		Deleted:           workspace.Deleted,
 		Name:              workspace.Name,
 		AutostartSchedule: workspace.AutostartSchedule.String,
+		AutomaticUpdates:  string(workspace.AutomaticUpdates),
 	}
 }
 
@@ -534,6 +547,11 @@ func ConvertProvisionerJob(job database.ProvisionerJob) ProvisionerJob {
 
 // ConvertWorkspaceAgent anonymizes a workspace agent.
 func ConvertWorkspaceAgent(agent database.WorkspaceAgent) WorkspaceAgent {
+	subsystems := []string{}
+	for _, subsystem := range agent.Subsystems {
+		subsystems = append(subsystems, string(subsystem))
+	}
+
 	snapAgent := WorkspaceAgent{
 		ID:                       agent.ID,
 		CreatedAt:                agent.CreatedAt,
@@ -542,11 +560,9 @@ func ConvertWorkspaceAgent(agent database.WorkspaceAgent) WorkspaceAgent {
 		Architecture:             agent.Architecture,
 		OperatingSystem:          agent.OperatingSystem,
 		EnvironmentVariables:     agent.EnvironmentVariables.Valid,
-		StartupScript:            agent.StartupScript.Valid,
 		Directory:                agent.Directory != "",
 		ConnectionTimeoutSeconds: agent.ConnectionTimeoutSeconds,
-		ShutdownScript:           agent.ShutdownScript.Valid,
-		Subsystem:                string(agent.Subsystem),
+		Subsystems:               subsystems,
 	}
 	if agent.FirstConnectedAt.Valid {
 		snapAgent.FirstConnectedAt = &agent.FirstConnectedAt.Time
@@ -657,14 +673,48 @@ func ConvertTemplateVersion(version database.TemplateVersion) TemplateVersion {
 	return snapVersion
 }
 
-// ConvertLicense anonymizes a license.
 func ConvertLicense(license database.License) License {
+	// License is intentionally not anonymized because it's
+	// deployment-wide, and we already have an index of all issued
+	// licenses.
 	return License{
+		JWT:        license.JWT,
+		Exp:        license.Exp,
 		UploadedAt: license.UploadedAt,
 		UUID:       license.UUID,
 	}
 }
 
+// ConvertWorkspaceProxy anonymizes a workspace proxy.
+func ConvertWorkspaceProxy(proxy database.WorkspaceProxy) WorkspaceProxy {
+	return WorkspaceProxy{
+		ID:          proxy.ID,
+		Name:        proxy.Name,
+		DisplayName: proxy.DisplayName,
+		DerpEnabled: proxy.DerpEnabled,
+		DerpOnly:    proxy.DerpOnly,
+		CreatedAt:   proxy.CreatedAt,
+		UpdatedAt:   proxy.UpdatedAt,
+	}
+}
+
+func ConvertExternalProvisioner(id uuid.UUID, tags map[string]string, provisioners []database.ProvisionerType) ExternalProvisioner {
+	tagsCopy := make(map[string]string, len(tags))
+	for k, v := range tags {
+		tagsCopy[k] = v
+	}
+	strProvisioners := make([]string, 0, len(provisioners))
+	for _, prov := range provisioners {
+		strProvisioners = append(strProvisioners, string(prov))
+	}
+	return ExternalProvisioner{
+		ID:           id.String(),
+		Tags:         tagsCopy,
+		Provisioners: strProvisioners,
+		StartedAt:    time.Now(),
+	}
+}
+
 // Snapshot represents a point-in-time anonymized database dump.
 // Data is aggregated by latest on the server-side, so partial data
 // can be sent without issue.
@@ -672,19 +722,21 @@ type Snapshot struct {
 	DeploymentID string `json:"deployment_id"`
 
 	APIKeys                   []APIKey                    `json:"api_keys"`
-	ProvisionerJobs           []ProvisionerJob            `json:"provisioner_jobs"`
+	CLIInvocations            []clitelemetry.Invocation   `json:"cli_invocations"`
+	ExternalProvisioners      []ExternalProvisioner       `json:"external_provisioners"`
 	Licenses                  []License                   `json:"licenses"`
-	Templates                 []Template                  `json:"templates"`
+	ProvisionerJobs           []ProvisionerJob            `json:"provisioner_jobs"`
 	TemplateVersions          []TemplateVersion           `json:"template_versions"`
+	Templates                 []Template                  `json:"templates"`
 	Users                     []User                      `json:"users"`
-	Workspaces                []Workspace                 `json:"workspaces"`
-	WorkspaceApps             []WorkspaceApp              `json:"workspace_apps"`
-	WorkspaceAgents           []WorkspaceAgent            `json:"workspace_agents"`
 	WorkspaceAgentStats       []WorkspaceAgentStat        `json:"workspace_agent_stats"`
+	WorkspaceAgents           []WorkspaceAgent            `json:"workspace_agents"`
+	WorkspaceApps             []WorkspaceApp              `json:"workspace_apps"`
 	WorkspaceBuilds           []WorkspaceBuild            `json:"workspace_build"`
-	WorkspaceResources        []WorkspaceResource         `json:"workspace_resources"`
+	WorkspaceProxies          []WorkspaceProxy            `json:"workspace_proxies"`
 	WorkspaceResourceMetadata []WorkspaceResourceMetadata `json:"workspace_resource_metadata"`
-	CLIInvocations            []CLIInvocation             `json:"cli_invocations"`
+	WorkspaceResources        []WorkspaceResource         `json:"workspace_resources"`
+	Workspaces                []Workspace                 `json:"workspaces"`
 }
 
 // Deployment contains information about the host running Coder.
@@ -761,14 +813,12 @@ type WorkspaceAgent struct {
 	Architecture             string     `json:"architecture"`
 	OperatingSystem          string     `json:"operating_system"`
 	EnvironmentVariables     bool       `json:"environment_variables"`
-	StartupScript            bool       `json:"startup_script"`
 	Directory                bool       `json:"directory"`
 	FirstConnectedAt         *time.Time `json:"first_connected_at"`
 	LastConnectedAt          *time.Time `json:"last_connected_at"`
 	DisconnectedAt           *time.Time `json:"disconnected_at"`
 	ConnectionTimeoutSeconds int32      `json:"connection_timeout_seconds"`
-	ShutdownScript           bool       `json:"shutdown_script"`
-	Subsystem                string     `json:"subsystem"`
+	Subsystems               []string   `json:"subsystems"`
 }
 
 type WorkspaceAgentStat struct {
@@ -813,6 +863,7 @@ type Workspace struct {
 	Deleted           bool      `json:"deleted"`
 	Name              string    `json:"name"`
 	AutostartSchedule string    `json:"autostart_schedule"`
+	AutomaticUpdates  string    `json:"automatic_updates"`
 }
 
 type Template struct {
@@ -848,28 +899,31 @@ type ProvisionerJob struct {
 	Type           database.ProvisionerJobType `json:"type"`
 }
 
-type ParameterSchema struct {
-	ID                  uuid.UUID `json:"id"`
-	JobID               uuid.UUID `json:"job_id"`
-	Name                string    `json:"name"`
-	ValidationCondition string    `json:"validation_condition"`
-}
-
 type License struct {
+	JWT        string    `json:"jwt"`
 	UploadedAt time.Time `json:"uploaded_at"`
+	Exp        time.Time `json:"exp"`
 	UUID       uuid.UUID `json:"uuid"`
 }
 
-type CLIOption struct {
-	Name        string `json:"name"`
-	ValueSource string `json:"value_source"`
+type WorkspaceProxy struct {
+	ID          uuid.UUID `json:"id"`
+	Name        string    `json:"name"`
+	DisplayName string    `json:"display_name"`
+	// No URLs since we don't send deployment URL.
+	DerpEnabled bool `json:"derp_enabled"`
+	DerpOnly    bool `json:"derp_only"`
+	// No Status since it may contain sensitive information.
+	CreatedAt time.Time `json:"created_at"`
+	UpdatedAt time.Time `json:"updated_at"`
 }
 
-type CLIInvocation struct {
-	Command string      `json:"command"`
-	Options []CLIOption `json:"options"`
-	// InvokedAt is provided for deduplication purposes.
-	InvokedAt time.Time `json:"invoked_at"`
+type ExternalProvisioner struct {
+	ID           string            `json:"id"`
+	Tags         map[string]string `json:"tags"`
+	Provisioners []string          `json:"provisioners"`
+	StartedAt    time.Time         `json:"started_at"`
+	ShutdownAt   *time.Time        `json:"shutdown_at"`
 }
 
 type noopReporter struct{}
diff --git a/coderd/telemetry/telemetry_test.go b/coderd/telemetry/telemetry_test.go
index 93e1a5295475b..5df6be77f763e 100644
--- a/coderd/telemetry/telemetry_test.go
+++ b/coderd/telemetry/telemetry_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/go-chi/chi"
+	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -16,12 +16,13 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
@@ -35,11 +36,11 @@ func TestTelemetry(t *testing.T) {
 
 		var err error
 
-		db := dbfake.New()
+		db := dbmem.New()
 
 		ctx := testutil.Context(t, testutil.WaitMedium)
 		_, _ = dbgen.APIKey(t, db, database.APIKey{})
-		_ = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		_ = dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
 			Provisioner:   database.ProvisionerTypeTerraform,
 			StorageMethod: database.ProvisionerStorageMethodFile,
 			Type:          database.ProvisionerJobTypeTemplateVersionDryRun,
@@ -54,15 +55,16 @@ func TestTelemetry(t *testing.T) {
 			SharingLevel: database.AppSharingLevelOwner,
 			Health:       database.WorkspaceAppHealthDisabled,
 		})
-		wsagent := dbgen.WorkspaceAgent(t, db, database.WorkspaceAgent{
-			Subsystem: database.WorkspaceAgentSubsystemEnvbox,
-		})
+		wsagent := dbgen.WorkspaceAgent(t, db, database.WorkspaceAgent{})
 		// Update the workspace agent to have a valid subsystem.
 		err = db.UpdateWorkspaceAgentStartupByID(ctx, database.UpdateWorkspaceAgentStartupByIDParams{
 			ID:                wsagent.ID,
 			Version:           wsagent.Version,
 			ExpandedDirectory: wsagent.ExpandedDirectory,
-			Subsystem:         database.WorkspaceAgentSubsystemEnvbox,
+			Subsystems: []database.WorkspaceAgentSubsystem{
+				database.WorkspaceAgentSubsystemEnvbox,
+				database.WorkspaceAgentSubsystemExectrace,
+			},
 		})
 		require.NoError(t, err)
 
@@ -75,12 +77,14 @@ func TestTelemetry(t *testing.T) {
 		})
 		_ = dbgen.WorkspaceAgentStat(t, db, database.WorkspaceAgentStat{})
 		_, err = db.InsertLicense(ctx, database.InsertLicenseParams{
-			UploadedAt: database.Now(),
+			UploadedAt: dbtime.Now(),
 			JWT:        "",
-			Exp:        database.Now().Add(time.Hour),
+			Exp:        dbtime.Now().Add(time.Hour),
 			UUID:       uuid.New(),
 		})
 		assert.NoError(t, err)
+		_, _ = dbgen.WorkspaceProxy(t, db, database.WorkspaceProxy{})
+
 		_, snapshot := collectSnapshot(t, db)
 		require.Len(t, snapshot.ProvisionerJobs, 1)
 		require.Len(t, snapshot.Licenses, 1)
@@ -93,13 +97,16 @@ func TestTelemetry(t *testing.T) {
 		require.Len(t, snapshot.WorkspaceBuilds, 1)
 		require.Len(t, snapshot.WorkspaceResources, 1)
 		require.Len(t, snapshot.WorkspaceAgentStats, 1)
+		require.Len(t, snapshot.WorkspaceProxies, 1)
 
 		wsa := snapshot.WorkspaceAgents[0]
-		require.Equal(t, string(database.WorkspaceAgentSubsystemEnvbox), wsa.Subsystem)
+		require.Len(t, wsa.Subsystems, 2)
+		require.Equal(t, string(database.WorkspaceAgentSubsystemEnvbox), wsa.Subsystems[0])
+		require.Equal(t, string(database.WorkspaceAgentSubsystemExectrace), wsa.Subsystems[1])
 	})
 	t.Run("HashedEmail", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		_ = dbgen.User(t, db, database.User{
 			Email: "kyle@coder.com",
 		})
@@ -112,7 +119,7 @@ func TestTelemetry(t *testing.T) {
 // nolint:paralleltest
 func TestTelemetryInstallSource(t *testing.T) {
 	t.Setenv("CODER_TELEMETRY_INSTALL_SOURCE", "aws_marketplace")
-	db := dbfake.New()
+	db := dbmem.New()
 	deployment, _ := collectSnapshot(t, db)
 	require.Equal(t, "aws_marketplace", deployment.InstallSource)
 }
diff --git a/coderd/templates.go b/coderd/templates.go
index 95fa9032d28ff..c1f3bc97a01c3 100644
--- a/coderd/templates.go
+++ b/coderd/templates.go
@@ -12,17 +12,18 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/examples"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/examples"
 )
 
 // Returns a single template.
@@ -87,7 +88,7 @@ func (api *API) deleteTemplate(rw http.ResponseWriter, r *http.Request) {
 	err = api.Database.UpdateTemplateDeletedByID(ctx, database.UpdateTemplateDeletedByIDParams{
 		ID:        template.ID,
 		Deleted:   true,
-		UpdatedAt: database.Now(),
+		UpdatedAt: dbtime.Now(),
 	})
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
@@ -192,6 +193,15 @@ func (api *API) postTemplateByOrganization(rw http.ResponseWriter, r *http.Reque
 		})
 		return
 	}
+	if templateVersion.Archived {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: fmt.Sprintf("Template version %s is archived.", createTemplate.VersionID),
+			Validations: []codersdk.ValidationError{
+				{Field: "template_version_id", Detail: "Template version is archived"},
+			},
+		})
+		return
+	}
 	templateVersionAudit.Old = templateVersion
 	if templateVersion.TemplateID.Valid {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
@@ -214,34 +224,42 @@ func (api *API) postTemplateByOrganization(rw http.ResponseWriter, r *http.Reque
 
 	var (
 		defaultTTL time.Duration
-		// TODO(@dean): remove max_ttl once restart_requirement is ready
-		maxTTL                       time.Duration
-		restartRequirementDaysOfWeek []string
-		restartRequirementWeeks      int64
-		failureTTL                   time.Duration
-		inactivityTTL                time.Duration
-		lockedTTL                    time.Duration
+		// TODO(@dean): remove max_ttl once autostop_requirement is ready
+		maxTTL                         time.Duration
+		autostopRequirementDaysOfWeek  []string
+		autostartRequirementDaysOfWeek []string
+		autostopRequirementWeeks       int64
+		failureTTL                     time.Duration
+		dormantTTL                     time.Duration
+		dormantAutoDeletionTTL         time.Duration
 	)
 	if createTemplate.DefaultTTLMillis != nil {
 		defaultTTL = time.Duration(*createTemplate.DefaultTTLMillis) * time.Millisecond
 	}
-	if createTemplate.RestartRequirement != nil {
-		restartRequirementDaysOfWeek = createTemplate.RestartRequirement.DaysOfWeek
-		restartRequirementWeeks = createTemplate.RestartRequirement.Weeks
+	if createTemplate.AutostopRequirement != nil {
+		autostopRequirementDaysOfWeek = createTemplate.AutostopRequirement.DaysOfWeek
+		autostopRequirementWeeks = createTemplate.AutostopRequirement.Weeks
+	}
+	if createTemplate.AutostartRequirement != nil {
+		autostartRequirementDaysOfWeek = createTemplate.AutostartRequirement.DaysOfWeek
+	} else {
+		// By default, we want to allow all days of the week to be autostarted.
+		autostartRequirementDaysOfWeek = codersdk.BitmapToWeekdays(0b01111111)
 	}
 	if createTemplate.FailureTTLMillis != nil {
 		failureTTL = time.Duration(*createTemplate.FailureTTLMillis) * time.Millisecond
 	}
-	if createTemplate.InactivityTTLMillis != nil {
-		inactivityTTL = time.Duration(*createTemplate.InactivityTTLMillis) * time.Millisecond
+	if createTemplate.TimeTilDormantMillis != nil {
+		dormantTTL = time.Duration(*createTemplate.TimeTilDormantMillis) * time.Millisecond
 	}
-	if createTemplate.LockedTTLMillis != nil {
-		lockedTTL = time.Duration(*createTemplate.LockedTTLMillis) * time.Millisecond
+	if createTemplate.TimeTilDormantAutoDeleteMillis != nil {
+		dormantAutoDeletionTTL = time.Duration(*createTemplate.TimeTilDormantAutoDeleteMillis) * time.Millisecond
 	}
 
 	var (
-		validErrs                          []codersdk.ValidationError
-		restartRequirementDaysOfWeekParsed uint8
+		validErrs                            []codersdk.ValidationError
+		autostopRequirementDaysOfWeekParsed  uint8
+		autostartRequirementDaysOfWeekParsed uint8
 	)
 	if defaultTTL < 0 {
 		validErrs = append(validErrs, codersdk.ValidationError{Field: "default_ttl_ms", Detail: "Must be a positive integer."})
@@ -252,29 +270,35 @@ func (api *API) postTemplateByOrganization(rw http.ResponseWriter, r *http.Reque
 	if maxTTL != 0 && defaultTTL > maxTTL {
 		validErrs = append(validErrs, codersdk.ValidationError{Field: "default_ttl_ms", Detail: "Must be less than or equal to max_ttl_ms if max_ttl_ms is set."})
 	}
-	if len(restartRequirementDaysOfWeek) > 0 {
-		restartRequirementDaysOfWeekParsed, err = codersdk.WeekdaysToBitmap(restartRequirementDaysOfWeek)
+	if len(autostopRequirementDaysOfWeek) > 0 {
+		autostopRequirementDaysOfWeekParsed, err = codersdk.WeekdaysToBitmap(autostopRequirementDaysOfWeek)
 		if err != nil {
-			validErrs = append(validErrs, codersdk.ValidationError{Field: "restart_requirement.days_of_week", Detail: err.Error()})
+			validErrs = append(validErrs, codersdk.ValidationError{Field: "autostop_requirement.days_of_week", Detail: err.Error()})
+		}
+	}
+	if len(autostartRequirementDaysOfWeek) > 0 {
+		autostartRequirementDaysOfWeekParsed, err = codersdk.WeekdaysToBitmap(autostartRequirementDaysOfWeek)
+		if err != nil {
+			validErrs = append(validErrs, codersdk.ValidationError{Field: "autostart_requirement.days_of_week", Detail: err.Error()})
 		}
 	}
 	if createTemplate.MaxTTLMillis != nil {
 		maxTTL = time.Duration(*createTemplate.MaxTTLMillis) * time.Millisecond
 	}
-	if restartRequirementWeeks < 0 {
-		validErrs = append(validErrs, codersdk.ValidationError{Field: "restart_requirement.weeks", Detail: "Must be a positive integer."})
+	if autostopRequirementWeeks < 0 {
+		validErrs = append(validErrs, codersdk.ValidationError{Field: "autostop_requirement.weeks", Detail: "Must be a positive integer."})
 	}
-	if restartRequirementWeeks > schedule.MaxTemplateRestartRequirementWeeks {
-		validErrs = append(validErrs, codersdk.ValidationError{Field: "restart_requirement.weeks", Detail: fmt.Sprintf("Must be less than %d.", schedule.MaxTemplateRestartRequirementWeeks)})
+	if autostopRequirementWeeks > schedule.MaxTemplateAutostopRequirementWeeks {
+		validErrs = append(validErrs, codersdk.ValidationError{Field: "autostop_requirement.weeks", Detail: fmt.Sprintf("Must be less than %d.", schedule.MaxTemplateAutostopRequirementWeeks)})
 	}
 	if failureTTL < 0 {
 		validErrs = append(validErrs, codersdk.ValidationError{Field: "failure_ttl_ms", Detail: "Must be a positive integer."})
 	}
-	if inactivityTTL < 0 {
-		validErrs = append(validErrs, codersdk.ValidationError{Field: "inactivity_ttl_ms", Detail: "Must be a positive integer."})
+	if dormantTTL < 0 {
+		validErrs = append(validErrs, codersdk.ValidationError{Field: "time_til_dormant_autodeletion_ms", Detail: "Must be a positive integer."})
 	}
-	if lockedTTL < 0 {
-		validErrs = append(validErrs, codersdk.ValidationError{Field: "locked_ttl_ms", Detail: "Must be a positive integer."})
+	if dormantAutoDeletionTTL < 0 {
+		validErrs = append(validErrs, codersdk.ValidationError{Field: "time_til_dormant_autodeletion_ms", Detail: "Must be a positive integer."})
 	}
 
 	if len(validErrs) > 0 {
@@ -301,7 +325,7 @@ func (api *API) postTemplateByOrganization(rw http.ResponseWriter, r *http.Reque
 		defaultsGroups[organization.ID.String()] = []rbac.Action{rbac.ActionRead}
 	}
 	err = api.Database.InTx(func(tx database.Store) error {
-		now := database.Now()
+		now := dbtime.Now()
 		id := uuid.New()
 		err = tx.InsertTemplate(ctx, database.InsertTemplateParams{
 			ID:                           id,
@@ -323,6 +347,15 @@ func (api *API) postTemplateByOrganization(rw http.ResponseWriter, r *http.Reque
 			return xerrors.Errorf("insert template: %s", err)
 		}
 
+		if createTemplate.RequireActiveVersion {
+			err = (*api.AccessControlStore.Load()).SetTemplateAccessControl(ctx, tx, id, dbauthz.TemplateAccessControl{
+				RequireActiveVersion: createTemplate.RequireActiveVersion,
+			})
+			if err != nil {
+				return xerrors.Errorf("set template access control: %w", err)
+			}
+		}
+
 		dbTemplate, err = tx.GetTemplateByID(ctx, id)
 		if err != nil {
 			return xerrors.Errorf("get template by id: %s", err)
@@ -336,13 +369,16 @@ func (api *API) postTemplateByOrganization(rw http.ResponseWriter, r *http.Reque
 			// Some of these values are enterprise-only, but the
 			// TemplateScheduleStore will handle avoiding setting them if
 			// unlicensed.
-			RestartRequirement: schedule.TemplateRestartRequirement{
-				DaysOfWeek: restartRequirementDaysOfWeekParsed,
-				Weeks:      restartRequirementWeeks,
+			AutostopRequirement: schedule.TemplateAutostopRequirement{
+				DaysOfWeek: autostopRequirementDaysOfWeekParsed,
+				Weeks:      autostopRequirementWeeks,
 			},
-			FailureTTL:    failureTTL,
-			InactivityTTL: inactivityTTL,
-			LockedTTL:     lockedTTL,
+			AutostartRequirement: schedule.TemplateAutostartRequirement{
+				DaysOfWeek: autostartRequirementDaysOfWeekParsed,
+			},
+			FailureTTL:               failureTTL,
+			TimeTilDormant:           dormantTTL,
+			TimeTilDormantAutoDelete: dormantAutoDeletionTTL,
 		})
 		if err != nil {
 			return xerrors.Errorf("set template schedule options: %s", err)
@@ -356,7 +392,7 @@ func (api *API) postTemplateByOrganization(rw http.ResponseWriter, r *http.Reque
 				UUID:  dbTemplate.ID,
 				Valid: true,
 			},
-			UpdatedAt: database.Now(),
+			UpdatedAt: dbtime.Now(),
 			Name:      templateVersion.Name,
 			Message:   templateVersion.Message,
 		})
@@ -500,8 +536,9 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 	}
 
 	var (
-		validErrs                          []codersdk.ValidationError
-		restartRequirementDaysOfWeekParsed uint8
+		validErrs                            []codersdk.ValidationError
+		autostopRequirementDaysOfWeekParsed  uint8
+		autostartRequirementDaysOfWeekParsed uint8
 	)
 	if req.DefaultTTLMillis < 0 {
 		validErrs = append(validErrs, codersdk.ValidationError{Field: "default_ttl_ms", Detail: "Must be a positive integer."})
@@ -512,35 +549,54 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 	if req.MaxTTLMillis != 0 && req.DefaultTTLMillis > req.MaxTTLMillis {
 		validErrs = append(validErrs, codersdk.ValidationError{Field: "default_ttl_ms", Detail: "Must be less than or equal to max_ttl_ms if max_ttl_ms is set."})
 	}
-	if req.RestartRequirement == nil {
-		req.RestartRequirement = &codersdk.TemplateRestartRequirement{
-			DaysOfWeek: codersdk.BitmapToWeekdays(scheduleOpts.RestartRequirement.DaysOfWeek),
-			Weeks:      scheduleOpts.RestartRequirement.Weeks,
+	if req.AutostopRequirement == nil {
+		req.AutostopRequirement = &codersdk.TemplateAutostopRequirement{
+			DaysOfWeek: codersdk.BitmapToWeekdays(scheduleOpts.AutostopRequirement.DaysOfWeek),
+			Weeks:      scheduleOpts.AutostopRequirement.Weeks,
 		}
 	}
-	if len(req.RestartRequirement.DaysOfWeek) > 0 {
-		restartRequirementDaysOfWeekParsed, err = codersdk.WeekdaysToBitmap(req.RestartRequirement.DaysOfWeek)
+	if len(req.AutostopRequirement.DaysOfWeek) > 0 {
+		autostopRequirementDaysOfWeekParsed, err = codersdk.WeekdaysToBitmap(req.AutostopRequirement.DaysOfWeek)
 		if err != nil {
-			validErrs = append(validErrs, codersdk.ValidationError{Field: "restart_requirement.days_of_week", Detail: err.Error()})
+			validErrs = append(validErrs, codersdk.ValidationError{Field: "autostop_requirement.days_of_week", Detail: err.Error()})
 		}
 	}
-	if req.RestartRequirement.Weeks < 0 {
-		validErrs = append(validErrs, codersdk.ValidationError{Field: "restart_requirement.weeks", Detail: "Must be a positive integer."})
+	if req.AutostartRequirement == nil {
+		req.AutostartRequirement = &codersdk.TemplateAutostartRequirement{
+			DaysOfWeek: codersdk.BitmapToWeekdays(scheduleOpts.AutostartRequirement.DaysOfWeek),
+		}
 	}
-	if req.RestartRequirement.Weeks > schedule.MaxTemplateRestartRequirementWeeks {
-		validErrs = append(validErrs, codersdk.ValidationError{Field: "restart_requirement.weeks", Detail: fmt.Sprintf("Must be less than %d.", schedule.MaxTemplateRestartRequirementWeeks)})
+	if len(req.AutostartRequirement.DaysOfWeek) > 0 {
+		autostartRequirementDaysOfWeekParsed, err = codersdk.WeekdaysToBitmap(req.AutostartRequirement.DaysOfWeek)
+		if err != nil {
+			validErrs = append(validErrs, codersdk.ValidationError{Field: "autostart_requirement.days_of_week", Detail: err.Error()})
+		}
 	}
-	if req.FailureTTLMillis < 0 {
-		validErrs = append(validErrs, codersdk.ValidationError{Field: "failure_ttl_ms", Detail: "Must be a positive integer."})
+	if req.AutostopRequirement.Weeks < 0 {
+		validErrs = append(validErrs, codersdk.ValidationError{Field: "autostop_requirement.weeks", Detail: "Must be a positive integer."})
+	}
+	if req.AutostopRequirement.Weeks == 0 {
+		req.AutostopRequirement.Weeks = 1
 	}
-	if req.InactivityTTLMillis < 0 {
-		validErrs = append(validErrs, codersdk.ValidationError{Field: "inactivity_ttl_ms", Detail: "Must be a positive integer."})
+	if template.AutostopRequirementWeeks <= 0 {
+		template.AutostopRequirementWeeks = 1
 	}
-	if req.InactivityTTLMillis < 0 {
-		validErrs = append(validErrs, codersdk.ValidationError{Field: "inactivity_ttl_ms", Detail: "Must be a positive integer."})
+	if req.AutostopRequirement.Weeks > schedule.MaxTemplateAutostopRequirementWeeks {
+		validErrs = append(validErrs, codersdk.ValidationError{Field: "autostop_requirement.weeks", Detail: fmt.Sprintf("Must be less than %d.", schedule.MaxTemplateAutostopRequirementWeeks)})
 	}
-	if req.LockedTTLMillis < 0 {
-		validErrs = append(validErrs, codersdk.ValidationError{Field: "locked_ttl_ms", Detail: "Must be a positive integer."})
+
+	// The minimum valid value for a dormant TTL is 1 minute. This is
+	// to ensure an uninformed user does not send an unintentionally
+	// small number resulting in potentially catastrophic consequences.
+	const minTTL = 1000 * 60
+	if req.FailureTTLMillis < 0 || (req.FailureTTLMillis > 0 && req.FailureTTLMillis < minTTL) {
+		validErrs = append(validErrs, codersdk.ValidationError{Field: "failure_ttl_ms", Detail: "Value must be at least one minute."})
+	}
+	if req.TimeTilDormantMillis < 0 || (req.TimeTilDormantMillis > 0 && req.TimeTilDormantMillis < minTTL) {
+		validErrs = append(validErrs, codersdk.ValidationError{Field: "time_til_dormant_ms", Detail: "Value must be at least one minute."})
+	}
+	if req.TimeTilDormantAutoDeleteMillis < 0 || (req.TimeTilDormantAutoDeleteMillis > 0 && req.TimeTilDormantAutoDeleteMillis < minTTL) {
+		validErrs = append(validErrs, codersdk.ValidationError{Field: "time_til_dormant_autodelete_ms", Detail: "Value must be at least one minute."})
 	}
 
 	if len(validErrs) > 0 {
@@ -562,11 +618,13 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 			req.AllowUserCancelWorkspaceJobs == template.AllowUserCancelWorkspaceJobs &&
 			req.DefaultTTLMillis == time.Duration(template.DefaultTTL).Milliseconds() &&
 			req.MaxTTLMillis == time.Duration(template.MaxTTL).Milliseconds() &&
-			restartRequirementDaysOfWeekParsed == scheduleOpts.RestartRequirement.DaysOfWeek &&
-			req.RestartRequirement.Weeks == scheduleOpts.RestartRequirement.Weeks &&
+			autostopRequirementDaysOfWeekParsed == scheduleOpts.AutostopRequirement.DaysOfWeek &&
+			autostartRequirementDaysOfWeekParsed == scheduleOpts.AutostartRequirement.DaysOfWeek &&
+			req.AutostopRequirement.Weeks == scheduleOpts.AutostopRequirement.Weeks &&
 			req.FailureTTLMillis == time.Duration(template.FailureTTL).Milliseconds() &&
-			req.InactivityTTLMillis == time.Duration(template.InactivityTTL).Milliseconds() &&
-			req.LockedTTLMillis == time.Duration(template.LockedTTL).Milliseconds() {
+			req.TimeTilDormantMillis == time.Duration(template.TimeTilDormant).Milliseconds() &&
+			req.TimeTilDormantAutoDeleteMillis == time.Duration(template.TimeTilDormantAutoDelete).Milliseconds() &&
+			req.RequireActiveVersion == template.RequireActiveVersion {
 			return nil
 		}
 
@@ -579,7 +637,7 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 		var err error
 		err = tx.UpdateTemplateMetaByID(ctx, database.UpdateTemplateMetaByIDParams{
 			ID:                           template.ID,
-			UpdatedAt:                    database.Now(),
+			UpdatedAt:                    dbtime.Now(),
 			Name:                         name,
 			DisplayName:                  req.DisplayName,
 			Description:                  req.Description,
@@ -590,6 +648,15 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 			return xerrors.Errorf("update template metadata: %w", err)
 		}
 
+		if template.RequireActiveVersion != req.RequireActiveVersion {
+			err = (*api.AccessControlStore.Load()).SetTemplateAccessControl(ctx, tx, template.ID, dbauthz.TemplateAccessControl{
+				RequireActiveVersion: req.RequireActiveVersion,
+			})
+			if err != nil {
+				return xerrors.Errorf("set template access control: %w", err)
+			}
+		}
+
 		updated, err = tx.GetTemplateByID(ctx, template.ID)
 		if err != nil {
 			return xerrors.Errorf("fetch updated template metadata: %w", err)
@@ -598,16 +665,17 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 		defaultTTL := time.Duration(req.DefaultTTLMillis) * time.Millisecond
 		maxTTL := time.Duration(req.MaxTTLMillis) * time.Millisecond
 		failureTTL := time.Duration(req.FailureTTLMillis) * time.Millisecond
-		inactivityTTL := time.Duration(req.InactivityTTLMillis) * time.Millisecond
-		lockedTTL := time.Duration(req.LockedTTLMillis) * time.Millisecond
+		inactivityTTL := time.Duration(req.TimeTilDormantMillis) * time.Millisecond
+		timeTilDormantAutoDelete := time.Duration(req.TimeTilDormantAutoDeleteMillis) * time.Millisecond
 
 		if defaultTTL != time.Duration(template.DefaultTTL) ||
 			maxTTL != time.Duration(template.MaxTTL) ||
-			restartRequirementDaysOfWeekParsed != scheduleOpts.RestartRequirement.DaysOfWeek ||
-			req.RestartRequirement.Weeks != scheduleOpts.RestartRequirement.Weeks ||
+			autostopRequirementDaysOfWeekParsed != scheduleOpts.AutostopRequirement.DaysOfWeek ||
+			autostartRequirementDaysOfWeekParsed != scheduleOpts.AutostartRequirement.DaysOfWeek ||
+			req.AutostopRequirement.Weeks != scheduleOpts.AutostopRequirement.Weeks ||
 			failureTTL != time.Duration(template.FailureTTL) ||
-			inactivityTTL != time.Duration(template.InactivityTTL) ||
-			lockedTTL != time.Duration(template.LockedTTL) ||
+			inactivityTTL != time.Duration(template.TimeTilDormant) ||
+			timeTilDormantAutoDelete != time.Duration(template.TimeTilDormantAutoDelete) ||
 			req.AllowUserAutostart != template.AllowUserAutostart ||
 			req.AllowUserAutostop != template.AllowUserAutostop {
 			updated, err = (*api.TemplateScheduleStore.Load()).Set(ctx, tx, updated, schedule.TemplateScheduleOptions{
@@ -618,13 +686,18 @@ func (api *API) patchTemplateMeta(rw http.ResponseWriter, r *http.Request) {
 				UserAutostopEnabled:  req.AllowUserAutostop,
 				DefaultTTL:           defaultTTL,
 				MaxTTL:               maxTTL,
-				RestartRequirement: schedule.TemplateRestartRequirement{
-					DaysOfWeek: restartRequirementDaysOfWeekParsed,
-					Weeks:      req.RestartRequirement.Weeks,
+				AutostopRequirement: schedule.TemplateAutostopRequirement{
+					DaysOfWeek: autostopRequirementDaysOfWeekParsed,
+					Weeks:      req.AutostopRequirement.Weeks,
 				},
-				FailureTTL:    failureTTL,
-				InactivityTTL: inactivityTTL,
-				LockedTTL:     lockedTTL,
+				AutostartRequirement: schedule.TemplateAutostartRequirement{
+					DaysOfWeek: autostartRequirementDaysOfWeekParsed,
+				},
+				FailureTTL:                failureTTL,
+				TimeTilDormant:            inactivityTTL,
+				TimeTilDormantAutoDelete:  timeTilDormantAutoDelete,
+				UpdateWorkspaceLastUsedAt: req.UpdateWorkspaceLastUsedAt,
+				UpdateWorkspaceDormantAt:  req.UpdateWorkspaceDormantAt,
 			})
 			if err != nil {
 				return xerrors.Errorf("set template schedule options: %w", err)
@@ -735,32 +808,41 @@ func (api *API) convertTemplate(
 
 	buildTimeStats := api.metricsCache.TemplateBuildTimeStats(template.ID)
 
+	autostopRequirementWeeks := template.AutostopRequirementWeeks
+	if autostopRequirementWeeks < 1 {
+		autostopRequirementWeeks = 1
+	}
+
 	return codersdk.Template{
-		ID:                           template.ID,
-		CreatedAt:                    template.CreatedAt,
-		UpdatedAt:                    template.UpdatedAt,
-		OrganizationID:               template.OrganizationID,
-		Name:                         template.Name,
-		DisplayName:                  template.DisplayName,
-		Provisioner:                  codersdk.ProvisionerType(template.Provisioner),
-		ActiveVersionID:              template.ActiveVersionID,
-		ActiveUserCount:              activeCount,
-		BuildTimeStats:               buildTimeStats,
-		Description:                  template.Description,
-		Icon:                         template.Icon,
-		DefaultTTLMillis:             time.Duration(template.DefaultTTL).Milliseconds(),
-		MaxTTLMillis:                 time.Duration(template.MaxTTL).Milliseconds(),
-		CreatedByID:                  template.CreatedBy,
-		CreatedByName:                template.CreatedByUsername,
-		AllowUserAutostart:           template.AllowUserAutostart,
-		AllowUserAutostop:            template.AllowUserAutostop,
-		AllowUserCancelWorkspaceJobs: template.AllowUserCancelWorkspaceJobs,
-		FailureTTLMillis:             time.Duration(template.FailureTTL).Milliseconds(),
-		InactivityTTLMillis:          time.Duration(template.InactivityTTL).Milliseconds(),
-		LockedTTLMillis:              time.Duration(template.LockedTTL).Milliseconds(),
-		RestartRequirement: codersdk.TemplateRestartRequirement{
-			DaysOfWeek: codersdk.BitmapToWeekdays(uint8(template.RestartRequirementDaysOfWeek)),
-			Weeks:      template.RestartRequirementWeeks,
+		ID:                             template.ID,
+		CreatedAt:                      template.CreatedAt,
+		UpdatedAt:                      template.UpdatedAt,
+		OrganizationID:                 template.OrganizationID,
+		Name:                           template.Name,
+		DisplayName:                    template.DisplayName,
+		Provisioner:                    codersdk.ProvisionerType(template.Provisioner),
+		ActiveVersionID:                template.ActiveVersionID,
+		ActiveUserCount:                activeCount,
+		BuildTimeStats:                 buildTimeStats,
+		Description:                    template.Description,
+		Icon:                           template.Icon,
+		DefaultTTLMillis:               time.Duration(template.DefaultTTL).Milliseconds(),
+		MaxTTLMillis:                   time.Duration(template.MaxTTL).Milliseconds(),
+		CreatedByID:                    template.CreatedBy,
+		CreatedByName:                  template.CreatedByUsername,
+		AllowUserAutostart:             template.AllowUserAutostart,
+		AllowUserAutostop:              template.AllowUserAutostop,
+		AllowUserCancelWorkspaceJobs:   template.AllowUserCancelWorkspaceJobs,
+		FailureTTLMillis:               time.Duration(template.FailureTTL).Milliseconds(),
+		TimeTilDormantMillis:           time.Duration(template.TimeTilDormant).Milliseconds(),
+		TimeTilDormantAutoDeleteMillis: time.Duration(template.TimeTilDormantAutoDelete).Milliseconds(),
+		AutostopRequirement: codersdk.TemplateAutostopRequirement{
+			DaysOfWeek: codersdk.BitmapToWeekdays(uint8(template.AutostopRequirementDaysOfWeek)),
+			Weeks:      autostopRequirementWeeks,
+		},
+		AutostartRequirement: codersdk.TemplateAutostartRequirement{
+			DaysOfWeek: codersdk.BitmapToWeekdays(template.AutostartAllowedDays()),
 		},
+		RequireActiveVersion: template.RequireActiveVersion,
 	}
 }
diff --git a/coderd/templates_test.go b/coderd/templates_test.go
index 2b7c41c9ad8f8..a218119e266e4 100644
--- a/coderd/templates_test.go
+++ b/coderd/templates_test.go
@@ -12,16 +12,16 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestTemplate(t *testing.T) {
@@ -246,7 +246,7 @@ func TestPostTemplateByOrganization(t *testing.T) {
 		require.Equal(t, http.StatusNotFound, apiErr.StatusCode())
 	})
 
-	t.Run("RestartRequirement", func(t *testing.T) {
+	t.Run("AutostopRequirement", func(t *testing.T) {
 		t.Parallel()
 
 		t.Run("None", func(t *testing.T) {
@@ -257,21 +257,21 @@ func TestPostTemplateByOrganization(t *testing.T) {
 				TemplateScheduleStore: schedule.MockTemplateScheduleStore{
 					SetFn: func(ctx context.Context, db database.Store, template database.Template, options schedule.TemplateScheduleOptions) (database.Template, error) {
 						atomic.AddInt64(&setCalled, 1)
-						assert.Zero(t, options.RestartRequirement.DaysOfWeek)
-						assert.Zero(t, options.RestartRequirement.Weeks)
+						assert.Zero(t, options.AutostopRequirement.DaysOfWeek)
+						assert.Zero(t, options.AutostopRequirement.Weeks)
 
 						err := db.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
-							ID:                           template.ID,
-							UpdatedAt:                    database.Now(),
-							AllowUserAutostart:           options.UserAutostartEnabled,
-							AllowUserAutostop:            options.UserAutostopEnabled,
-							DefaultTTL:                   int64(options.DefaultTTL),
-							MaxTTL:                       int64(options.MaxTTL),
-							RestartRequirementDaysOfWeek: int16(options.RestartRequirement.DaysOfWeek),
-							RestartRequirementWeeks:      options.RestartRequirement.Weeks,
-							FailureTTL:                   int64(options.FailureTTL),
-							InactivityTTL:                int64(options.InactivityTTL),
-							LockedTTL:                    int64(options.LockedTTL),
+							ID:                            template.ID,
+							UpdatedAt:                     dbtime.Now(),
+							AllowUserAutostart:            options.UserAutostartEnabled,
+							AllowUserAutostop:             options.UserAutostopEnabled,
+							DefaultTTL:                    int64(options.DefaultTTL),
+							MaxTTL:                        int64(options.MaxTTL),
+							AutostopRequirementDaysOfWeek: int16(options.AutostopRequirement.DaysOfWeek),
+							AutostopRequirementWeeks:      options.AutostopRequirement.Weeks,
+							FailureTTL:                    int64(options.FailureTTL),
+							TimeTilDormant:                int64(options.TimeTilDormant),
+							TimeTilDormantAutoDelete:      int64(options.TimeTilDormantAutoDelete),
 						})
 						if !assert.NoError(t, err) {
 							return database.Template{}, err
@@ -288,15 +288,15 @@ func TestPostTemplateByOrganization(t *testing.T) {
 			defer cancel()
 
 			got, err := client.CreateTemplate(ctx, user.OrganizationID, codersdk.CreateTemplateRequest{
-				Name:               "testing",
-				VersionID:          version.ID,
-				RestartRequirement: nil,
+				Name:                "testing",
+				VersionID:           version.ID,
+				AutostopRequirement: nil,
 			})
 			require.NoError(t, err)
 
 			require.EqualValues(t, 1, atomic.LoadInt64(&setCalled))
-			require.Empty(t, got.RestartRequirement.DaysOfWeek)
-			require.Zero(t, got.RestartRequirement.Weeks)
+			require.Empty(t, got.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 1, got.AutostopRequirement.Weeks)
 		})
 
 		t.Run("OK", func(t *testing.T) {
@@ -307,21 +307,21 @@ func TestPostTemplateByOrganization(t *testing.T) {
 				TemplateScheduleStore: schedule.MockTemplateScheduleStore{
 					SetFn: func(ctx context.Context, db database.Store, template database.Template, options schedule.TemplateScheduleOptions) (database.Template, error) {
 						atomic.AddInt64(&setCalled, 1)
-						assert.EqualValues(t, 0b00110000, options.RestartRequirement.DaysOfWeek)
-						assert.EqualValues(t, 2, options.RestartRequirement.Weeks)
+						assert.EqualValues(t, 0b00110000, options.AutostopRequirement.DaysOfWeek)
+						assert.EqualValues(t, 2, options.AutostopRequirement.Weeks)
 
 						err := db.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
-							ID:                           template.ID,
-							UpdatedAt:                    database.Now(),
-							AllowUserAutostart:           options.UserAutostartEnabled,
-							AllowUserAutostop:            options.UserAutostopEnabled,
-							DefaultTTL:                   int64(options.DefaultTTL),
-							MaxTTL:                       int64(options.MaxTTL),
-							RestartRequirementDaysOfWeek: int16(options.RestartRequirement.DaysOfWeek),
-							RestartRequirementWeeks:      options.RestartRequirement.Weeks,
-							FailureTTL:                   int64(options.FailureTTL),
-							InactivityTTL:                int64(options.InactivityTTL),
-							LockedTTL:                    int64(options.LockedTTL),
+							ID:                            template.ID,
+							UpdatedAt:                     dbtime.Now(),
+							AllowUserAutostart:            options.UserAutostartEnabled,
+							AllowUserAutostop:             options.UserAutostopEnabled,
+							DefaultTTL:                    int64(options.DefaultTTL),
+							MaxTTL:                        int64(options.MaxTTL),
+							AutostopRequirementDaysOfWeek: int16(options.AutostopRequirement.DaysOfWeek),
+							AutostopRequirementWeeks:      options.AutostopRequirement.Weeks,
+							FailureTTL:                    int64(options.FailureTTL),
+							TimeTilDormant:                int64(options.TimeTilDormant),
+							TimeTilDormantAutoDelete:      int64(options.TimeTilDormantAutoDelete),
 						})
 						if !assert.NoError(t, err) {
 							return database.Template{}, err
@@ -340,7 +340,7 @@ func TestPostTemplateByOrganization(t *testing.T) {
 			got, err := client.CreateTemplate(ctx, user.OrganizationID, codersdk.CreateTemplateRequest{
 				Name:      "testing",
 				VersionID: version.ID,
-				RestartRequirement: &codersdk.TemplateRestartRequirement{
+				AutostopRequirement: &codersdk.TemplateAutostopRequirement{
 					// wrong order
 					DaysOfWeek: []string{"saturday", "friday"},
 					Weeks:      2,
@@ -349,13 +349,13 @@ func TestPostTemplateByOrganization(t *testing.T) {
 			require.NoError(t, err)
 
 			require.EqualValues(t, 1, atomic.LoadInt64(&setCalled))
-			require.Equal(t, []string{"friday", "saturday"}, got.RestartRequirement.DaysOfWeek)
-			require.EqualValues(t, 2, got.RestartRequirement.Weeks)
+			require.Equal(t, []string{"friday", "saturday"}, got.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 2, got.AutostopRequirement.Weeks)
 
 			got, err = client.Template(ctx, got.ID)
 			require.NoError(t, err)
-			require.Equal(t, []string{"friday", "saturday"}, got.RestartRequirement.DaysOfWeek)
-			require.EqualValues(t, 2, got.RestartRequirement.Weeks)
+			require.Equal(t, []string{"friday", "saturday"}, got.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 2, got.AutostopRequirement.Weeks)
 		})
 
 		t.Run("IgnoredUnlicensed", func(t *testing.T) {
@@ -371,15 +371,15 @@ func TestPostTemplateByOrganization(t *testing.T) {
 			got, err := client.CreateTemplate(ctx, user.OrganizationID, codersdk.CreateTemplateRequest{
 				Name:      "testing",
 				VersionID: version.ID,
-				RestartRequirement: &codersdk.TemplateRestartRequirement{
+				AutostopRequirement: &codersdk.TemplateAutostopRequirement{
 					DaysOfWeek: []string{"friday", "saturday"},
 					Weeks:      2,
 				},
 			})
 			require.NoError(t, err)
 			// ignored and use AGPL defaults
-			require.Empty(t, got.RestartRequirement.DaysOfWeek)
-			require.Zero(t, got.RestartRequirement.Weeks)
+			require.Empty(t, got.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 1, got.AutostopRequirement.Weeks)
 		})
 	})
 }
@@ -474,6 +474,8 @@ func TestPatchTemplateMeta(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+
 		req := codersdk.UpdateTemplateMeta{
 			Name:                         "new-template-name",
 			DisplayName:                  "Displayed Name 456",
@@ -589,17 +591,17 @@ func TestPatchTemplateMeta(t *testing.T) {
 						}
 
 						err := db.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
-							ID:                           template.ID,
-							UpdatedAt:                    database.Now(),
-							AllowUserAutostart:           options.UserAutostartEnabled,
-							AllowUserAutostop:            options.UserAutostopEnabled,
-							DefaultTTL:                   int64(options.DefaultTTL),
-							MaxTTL:                       int64(options.MaxTTL),
-							RestartRequirementDaysOfWeek: int16(options.RestartRequirement.DaysOfWeek),
-							RestartRequirementWeeks:      options.RestartRequirement.Weeks,
-							FailureTTL:                   int64(options.FailureTTL),
-							InactivityTTL:                int64(options.InactivityTTL),
-							LockedTTL:                    int64(options.LockedTTL),
+							ID:                            template.ID,
+							UpdatedAt:                     dbtime.Now(),
+							AllowUserAutostart:            options.UserAutostartEnabled,
+							AllowUserAutostop:             options.UserAutostopEnabled,
+							DefaultTTL:                    int64(options.DefaultTTL),
+							MaxTTL:                        int64(options.MaxTTL),
+							AutostopRequirementDaysOfWeek: int16(options.AutostopRequirement.DaysOfWeek),
+							AutostopRequirementWeeks:      options.AutostopRequirement.Weeks,
+							FailureTTL:                    int64(options.FailureTTL),
+							TimeTilDormant:                int64(options.TimeTilDormant),
+							TimeTilDormantAutoDelete:      int64(options.TimeTilDormantAutoDelete),
 						})
 						if !assert.NoError(t, err) {
 							return database.Template{}, err
@@ -697,9 +699,9 @@ func TestPatchTemplateMeta(t *testing.T) {
 		t.Parallel()
 
 		const (
-			failureTTL    = 7 * 24 * time.Hour
-			inactivityTTL = 180 * 24 * time.Hour
-			lockedTTL     = 360 * 24 * time.Hour
+			failureTTL               = 7 * 24 * time.Hour
+			inactivityTTL            = 180 * 24 * time.Hour
+			timeTilDormantAutoDelete = 360 * 24 * time.Hour
 		)
 
 		t.Run("OK", func(t *testing.T) {
@@ -711,12 +713,12 @@ func TestPatchTemplateMeta(t *testing.T) {
 					SetFn: func(ctx context.Context, db database.Store, template database.Template, options schedule.TemplateScheduleOptions) (database.Template, error) {
 						if atomic.AddInt64(&setCalled, 1) == 2 {
 							require.Equal(t, failureTTL, options.FailureTTL)
-							require.Equal(t, inactivityTTL, options.InactivityTTL)
-							require.Equal(t, lockedTTL, options.LockedTTL)
+							require.Equal(t, inactivityTTL, options.TimeTilDormant)
+							require.Equal(t, timeTilDormantAutoDelete, options.TimeTilDormantAutoDelete)
 						}
 						template.FailureTTL = int64(options.FailureTTL)
-						template.InactivityTTL = int64(options.InactivityTTL)
-						template.LockedTTL = int64(options.LockedTTL)
+						template.TimeTilDormant = int64(options.TimeTilDormant)
+						template.TimeTilDormantAutoDelete = int64(options.TimeTilDormantAutoDelete)
 						return template, nil
 					},
 				},
@@ -725,31 +727,31 @@ func TestPatchTemplateMeta(t *testing.T) {
 			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 				ctr.FailureTTLMillis = ptr.Ref(0 * time.Hour.Milliseconds())
-				ctr.InactivityTTLMillis = ptr.Ref(0 * time.Hour.Milliseconds())
-				ctr.LockedTTLMillis = ptr.Ref(0 * time.Hour.Milliseconds())
+				ctr.TimeTilDormantMillis = ptr.Ref(0 * time.Hour.Milliseconds())
+				ctr.TimeTilDormantAutoDeleteMillis = ptr.Ref(0 * time.Hour.Milliseconds())
 			})
 
 			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 			defer cancel()
 
 			got, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
-				Name:                         template.Name,
-				DisplayName:                  template.DisplayName,
-				Description:                  template.Description,
-				Icon:                         template.Icon,
-				DefaultTTLMillis:             0,
-				RestartRequirement:           &template.RestartRequirement,
-				AllowUserCancelWorkspaceJobs: template.AllowUserCancelWorkspaceJobs,
-				FailureTTLMillis:             failureTTL.Milliseconds(),
-				InactivityTTLMillis:          inactivityTTL.Milliseconds(),
-				LockedTTLMillis:              lockedTTL.Milliseconds(),
+				Name:                           template.Name,
+				DisplayName:                    template.DisplayName,
+				Description:                    template.Description,
+				Icon:                           template.Icon,
+				DefaultTTLMillis:               0,
+				AutostopRequirement:            &template.AutostopRequirement,
+				AllowUserCancelWorkspaceJobs:   template.AllowUserCancelWorkspaceJobs,
+				FailureTTLMillis:               failureTTL.Milliseconds(),
+				TimeTilDormantMillis:           inactivityTTL.Milliseconds(),
+				TimeTilDormantAutoDeleteMillis: timeTilDormantAutoDelete.Milliseconds(),
 			})
 			require.NoError(t, err)
 
 			require.EqualValues(t, 2, atomic.LoadInt64(&setCalled))
 			require.Equal(t, failureTTL.Milliseconds(), got.FailureTTLMillis)
-			require.Equal(t, inactivityTTL.Milliseconds(), got.InactivityTTLMillis)
-			require.Equal(t, lockedTTL.Milliseconds(), got.LockedTTLMillis)
+			require.Equal(t, inactivityTTL.Milliseconds(), got.TimeTilDormantMillis)
+			require.Equal(t, timeTilDormantAutoDelete.Milliseconds(), got.TimeTilDormantAutoDeleteMillis)
 		})
 
 		t.Run("IgnoredUnlicensed", func(t *testing.T) {
@@ -760,29 +762,29 @@ func TestPatchTemplateMeta(t *testing.T) {
 			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 				ctr.FailureTTLMillis = ptr.Ref(0 * time.Hour.Milliseconds())
-				ctr.InactivityTTLMillis = ptr.Ref(0 * time.Hour.Milliseconds())
-				ctr.LockedTTLMillis = ptr.Ref(0 * time.Hour.Milliseconds())
+				ctr.TimeTilDormantMillis = ptr.Ref(0 * time.Hour.Milliseconds())
+				ctr.TimeTilDormantAutoDeleteMillis = ptr.Ref(0 * time.Hour.Milliseconds())
 			})
 
 			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 			defer cancel()
 
 			got, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
-				Name:                         template.Name,
-				DisplayName:                  template.DisplayName,
-				Description:                  template.Description,
-				Icon:                         template.Icon,
-				DefaultTTLMillis:             template.DefaultTTLMillis,
-				RestartRequirement:           &template.RestartRequirement,
-				AllowUserCancelWorkspaceJobs: template.AllowUserCancelWorkspaceJobs,
-				FailureTTLMillis:             failureTTL.Milliseconds(),
-				InactivityTTLMillis:          inactivityTTL.Milliseconds(),
-				LockedTTLMillis:              lockedTTL.Milliseconds(),
+				Name:                           template.Name,
+				DisplayName:                    template.DisplayName,
+				Description:                    template.Description,
+				Icon:                           template.Icon,
+				DefaultTTLMillis:               template.DefaultTTLMillis,
+				AutostopRequirement:            &template.AutostopRequirement,
+				AllowUserCancelWorkspaceJobs:   template.AllowUserCancelWorkspaceJobs,
+				FailureTTLMillis:               failureTTL.Milliseconds(),
+				TimeTilDormantMillis:           inactivityTTL.Milliseconds(),
+				TimeTilDormantAutoDeleteMillis: timeTilDormantAutoDelete.Milliseconds(),
 			})
 			require.NoError(t, err)
 			require.Zero(t, got.FailureTTLMillis)
-			require.Zero(t, got.InactivityTTLMillis)
-			require.Zero(t, got.LockedTTLMillis)
+			require.Zero(t, got.TimeTilDormantMillis)
+			require.Zero(t, got.TimeTilDormantAutoDeleteMillis)
 		})
 	})
 
@@ -832,7 +834,7 @@ func TestPatchTemplateMeta(t *testing.T) {
 				Description:                  template.Description,
 				Icon:                         template.Icon,
 				DefaultTTLMillis:             template.DefaultTTLMillis,
-				RestartRequirement:           &template.RestartRequirement,
+				AutostopRequirement:          &template.AutostopRequirement,
 				AllowUserCancelWorkspaceJobs: template.AllowUserCancelWorkspaceJobs,
 				AllowUserAutostart:           allowAutostart.Load(),
 				AllowUserAutostop:            allowAutostop.Load(),
@@ -864,7 +866,7 @@ func TestPatchTemplateMeta(t *testing.T) {
 				Icon:        template.Icon,
 				// Increase the default TTL to avoid error "not modified".
 				DefaultTTLMillis:             template.DefaultTTLMillis + 1,
-				RestartRequirement:           &template.RestartRequirement,
+				AutostopRequirement:          &template.AutostopRequirement,
 				AllowUserCancelWorkspaceJobs: template.AllowUserCancelWorkspaceJobs,
 				AllowUserAutostart:           false,
 				AllowUserAutostop:            false,
@@ -891,13 +893,13 @@ func TestPatchTemplateMeta(t *testing.T) {
 		defer cancel()
 
 		req := codersdk.UpdateTemplateMeta{
-			Name:               template.Name,
-			Description:        template.Description,
-			Icon:               template.Icon,
-			DefaultTTLMillis:   template.DefaultTTLMillis,
-			RestartRequirement: nil,
-			AllowUserAutostart: template.AllowUserAutostart,
-			AllowUserAutostop:  template.AllowUserAutostop,
+			Name:                template.Name,
+			Description:         template.Description,
+			Icon:                template.Icon,
+			DefaultTTLMillis:    template.DefaultTTLMillis,
+			AutostopRequirement: nil,
+			AllowUserAutostart:  template.AllowUserAutostart,
+			AllowUserAutostop:   template.AllowUserAutostop,
 		}
 		_, err := client.UpdateTemplateMeta(ctx, template.ID, req)
 		require.ErrorContains(t, err, "not modified")
@@ -964,7 +966,7 @@ func TestPatchTemplateMeta(t *testing.T) {
 		assert.Equal(t, updated.Icon, "")
 	})
 
-	t.Run("RestartRequirement", func(t *testing.T) {
+	t.Run("AutostopRequirement", func(t *testing.T) {
 		t.Parallel()
 
 		t.Run("OK", func(t *testing.T) {
@@ -975,22 +977,22 @@ func TestPatchTemplateMeta(t *testing.T) {
 				TemplateScheduleStore: schedule.MockTemplateScheduleStore{
 					SetFn: func(ctx context.Context, db database.Store, template database.Template, options schedule.TemplateScheduleOptions) (database.Template, error) {
 						if atomic.AddInt64(&setCalled, 1) == 2 {
-							assert.EqualValues(t, 0b0110000, options.RestartRequirement.DaysOfWeek)
-							assert.EqualValues(t, 2, options.RestartRequirement.Weeks)
+							assert.EqualValues(t, 0b0110000, options.AutostopRequirement.DaysOfWeek)
+							assert.EqualValues(t, 2, options.AutostopRequirement.Weeks)
 						}
 
 						err := db.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
-							ID:                           template.ID,
-							UpdatedAt:                    database.Now(),
-							AllowUserAutostart:           options.UserAutostartEnabled,
-							AllowUserAutostop:            options.UserAutostopEnabled,
-							DefaultTTL:                   int64(options.DefaultTTL),
-							MaxTTL:                       int64(options.MaxTTL),
-							RestartRequirementDaysOfWeek: int16(options.RestartRequirement.DaysOfWeek),
-							RestartRequirementWeeks:      options.RestartRequirement.Weeks,
-							FailureTTL:                   int64(options.FailureTTL),
-							InactivityTTL:                int64(options.InactivityTTL),
-							LockedTTL:                    int64(options.LockedTTL),
+							ID:                            template.ID,
+							UpdatedAt:                     dbtime.Now(),
+							AllowUserAutostart:            options.UserAutostartEnabled,
+							AllowUserAutostop:             options.UserAutostopEnabled,
+							DefaultTTL:                    int64(options.DefaultTTL),
+							MaxTTL:                        int64(options.MaxTTL),
+							AutostopRequirementDaysOfWeek: int16(options.AutostopRequirement.DaysOfWeek),
+							AutostopRequirementWeeks:      options.AutostopRequirement.Weeks,
+							FailureTTL:                    int64(options.FailureTTL),
+							TimeTilDormant:                int64(options.TimeTilDormant),
+							TimeTilDormantAutoDelete:      int64(options.TimeTilDormantAutoDelete),
 						})
 						if !assert.NoError(t, err) {
 							return database.Template{}, err
@@ -1005,8 +1007,8 @@ func TestPatchTemplateMeta(t *testing.T) {
 			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			require.EqualValues(t, 1, atomic.LoadInt64(&setCalled))
-			require.Empty(t, template.RestartRequirement.DaysOfWeek)
-			require.Zero(t, template.RestartRequirement.Weeks)
+			require.Empty(t, template.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 1, template.AutostopRequirement.Weeks)
 			req := codersdk.UpdateTemplateMeta{
 				Name:                         template.Name,
 				DisplayName:                  template.DisplayName,
@@ -1014,7 +1016,7 @@ func TestPatchTemplateMeta(t *testing.T) {
 				Icon:                         template.Icon,
 				AllowUserCancelWorkspaceJobs: template.AllowUserCancelWorkspaceJobs,
 				DefaultTTLMillis:             time.Hour.Milliseconds(),
-				RestartRequirement: &codersdk.TemplateRestartRequirement{
+				AutostopRequirement: &codersdk.TemplateAutostopRequirement{
 					// wrong order
 					DaysOfWeek: []string{"saturday", "friday"},
 					Weeks:      2,
@@ -1027,13 +1029,13 @@ func TestPatchTemplateMeta(t *testing.T) {
 			updated, err := client.UpdateTemplateMeta(ctx, template.ID, req)
 			require.NoError(t, err)
 			require.EqualValues(t, 2, atomic.LoadInt64(&setCalled))
-			require.Equal(t, []string{"friday", "saturday"}, updated.RestartRequirement.DaysOfWeek)
-			require.EqualValues(t, 2, updated.RestartRequirement.Weeks)
+			require.Equal(t, []string{"friday", "saturday"}, updated.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 2, updated.AutostopRequirement.Weeks)
 
 			template, err = client.Template(ctx, template.ID)
 			require.NoError(t, err)
-			require.Equal(t, []string{"friday", "saturday"}, template.RestartRequirement.DaysOfWeek)
-			require.EqualValues(t, 2, template.RestartRequirement.Weeks)
+			require.Equal(t, []string{"friday", "saturday"}, template.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 2, template.AutostopRequirement.Weeks)
 		})
 
 		t.Run("Unset", func(t *testing.T) {
@@ -1044,22 +1046,22 @@ func TestPatchTemplateMeta(t *testing.T) {
 				TemplateScheduleStore: schedule.MockTemplateScheduleStore{
 					SetFn: func(ctx context.Context, db database.Store, template database.Template, options schedule.TemplateScheduleOptions) (database.Template, error) {
 						if atomic.AddInt64(&setCalled, 1) == 2 {
-							assert.EqualValues(t, 0, options.RestartRequirement.DaysOfWeek)
-							assert.EqualValues(t, 0, options.RestartRequirement.Weeks)
+							assert.EqualValues(t, 0, options.AutostopRequirement.DaysOfWeek)
+							assert.EqualValues(t, 1, options.AutostopRequirement.Weeks)
 						}
 
 						err := db.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
-							ID:                           template.ID,
-							UpdatedAt:                    database.Now(),
-							AllowUserAutostart:           options.UserAutostartEnabled,
-							AllowUserAutostop:            options.UserAutostopEnabled,
-							DefaultTTL:                   int64(options.DefaultTTL),
-							MaxTTL:                       int64(options.MaxTTL),
-							RestartRequirementDaysOfWeek: int16(options.RestartRequirement.DaysOfWeek),
-							RestartRequirementWeeks:      options.RestartRequirement.Weeks,
-							FailureTTL:                   int64(options.FailureTTL),
-							InactivityTTL:                int64(options.InactivityTTL),
-							LockedTTL:                    int64(options.LockedTTL),
+							ID:                            template.ID,
+							UpdatedAt:                     dbtime.Now(),
+							AllowUserAutostart:            options.UserAutostartEnabled,
+							AllowUserAutostop:             options.UserAutostopEnabled,
+							DefaultTTL:                    int64(options.DefaultTTL),
+							MaxTTL:                        int64(options.MaxTTL),
+							AutostopRequirementDaysOfWeek: int16(options.AutostopRequirement.DaysOfWeek),
+							AutostopRequirementWeeks:      options.AutostopRequirement.Weeks,
+							FailureTTL:                    int64(options.FailureTTL),
+							TimeTilDormant:                int64(options.TimeTilDormant),
+							TimeTilDormantAutoDelete:      int64(options.TimeTilDormantAutoDelete),
 						})
 						if !assert.NoError(t, err) {
 							return database.Template{}, err
@@ -1073,15 +1075,15 @@ func TestPatchTemplateMeta(t *testing.T) {
 
 			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
-				ctr.RestartRequirement = &codersdk.TemplateRestartRequirement{
+				ctr.AutostopRequirement = &codersdk.TemplateAutostopRequirement{
 					// wrong order
 					DaysOfWeek: []string{"sunday", "saturday", "friday", "thursday", "wednesday", "tuesday", "monday"},
 					Weeks:      2,
 				}
 			})
 			require.EqualValues(t, 1, atomic.LoadInt64(&setCalled))
-			require.Equal(t, []string{"monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday"}, template.RestartRequirement.DaysOfWeek)
-			require.EqualValues(t, 2, template.RestartRequirement.Weeks)
+			require.Equal(t, []string{"monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday"}, template.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 2, template.AutostopRequirement.Weeks)
 			req := codersdk.UpdateTemplateMeta{
 				Name:                         template.Name,
 				DisplayName:                  template.DisplayName,
@@ -1089,7 +1091,7 @@ func TestPatchTemplateMeta(t *testing.T) {
 				Icon:                         template.Icon,
 				AllowUserCancelWorkspaceJobs: template.AllowUserCancelWorkspaceJobs,
 				DefaultTTLMillis:             time.Hour.Milliseconds(),
-				RestartRequirement: &codersdk.TemplateRestartRequirement{
+				AutostopRequirement: &codersdk.TemplateAutostopRequirement{
 					DaysOfWeek: []string{},
 					Weeks:      0,
 				},
@@ -1101,13 +1103,13 @@ func TestPatchTemplateMeta(t *testing.T) {
 			updated, err := client.UpdateTemplateMeta(ctx, template.ID, req)
 			require.NoError(t, err)
 			require.EqualValues(t, 2, atomic.LoadInt64(&setCalled))
-			require.Empty(t, updated.RestartRequirement.DaysOfWeek)
-			require.EqualValues(t, 0, updated.RestartRequirement.Weeks)
+			require.Empty(t, updated.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 1, updated.AutostopRequirement.Weeks)
 
 			template, err = client.Template(ctx, template.ID)
 			require.NoError(t, err)
-			require.Empty(t, template.RestartRequirement.DaysOfWeek)
-			require.EqualValues(t, 0, template.RestartRequirement.Weeks)
+			require.Empty(t, template.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 1, template.AutostopRequirement.Weeks)
 		})
 
 		t.Run("EnterpriseOnly", func(t *testing.T) {
@@ -1117,8 +1119,8 @@ func TestPatchTemplateMeta(t *testing.T) {
 			user := coderdtest.CreateFirstUser(t, client)
 			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-			require.Empty(t, template.RestartRequirement.DaysOfWeek)
-			require.Zero(t, template.RestartRequirement.Weeks)
+			require.Empty(t, template.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 1, template.AutostopRequirement.Weeks)
 			req := codersdk.UpdateTemplateMeta{
 				Name:                         template.Name,
 				DisplayName:                  template.DisplayName,
@@ -1126,7 +1128,7 @@ func TestPatchTemplateMeta(t *testing.T) {
 				Icon:                         template.Icon,
 				AllowUserCancelWorkspaceJobs: template.AllowUserCancelWorkspaceJobs,
 				DefaultTTLMillis:             time.Hour.Milliseconds(),
-				RestartRequirement: &codersdk.TemplateRestartRequirement{
+				AutostopRequirement: &codersdk.TemplateAutostopRequirement{
 					DaysOfWeek: []string{"monday"},
 					Weeks:      2,
 				},
@@ -1137,13 +1139,13 @@ func TestPatchTemplateMeta(t *testing.T) {
 
 			updated, err := client.UpdateTemplateMeta(ctx, template.ID, req)
 			require.NoError(t, err)
-			require.Empty(t, updated.RestartRequirement.DaysOfWeek)
-			require.Zero(t, updated.RestartRequirement.Weeks)
+			require.Empty(t, updated.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 1, updated.AutostopRequirement.Weeks)
 
 			template, err = client.Template(ctx, template.ID)
 			require.NoError(t, err)
-			require.Empty(t, template.RestartRequirement.DaysOfWeek)
-			require.Zero(t, template.RestartRequirement.Weeks)
+			require.Empty(t, template.AutostopRequirement.DaysOfWeek)
+			require.EqualValues(t, 1, template.AutostopRequirement.Weeks)
 		})
 	})
 }
@@ -1158,6 +1160,7 @@ func TestDeleteTemplate(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -1175,7 +1178,7 @@ func TestDeleteTemplate(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -1203,26 +1206,18 @@ func TestTemplateMetrics(t *testing.T) {
 	authToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:          echo.ParseComplete,
-		ProvisionPlan:  echo.ProvisionComplete,
+		ProvisionPlan:  echo.PlanComplete,
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	require.Equal(t, -1, template.ActiveUserCount)
 	require.Empty(t, template.BuildTimeStats[codersdk.WorkspaceTransitionStart])
 
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Logger: slogtest.Make(t, nil),
-		Client: agentClient,
-	})
-	defer func() {
-		_ = agentCloser.Close()
-	}()
+	_ = agenttest.New(t, client.URL, authToken)
 	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -1288,6 +1283,6 @@ func TestTemplateMetrics(t *testing.T) {
 	res, err = client.Workspaces(ctx, codersdk.WorkspaceFilter{})
 	require.NoError(t, err)
 	assert.WithinDuration(t,
-		database.Now(), res.Workspaces[0].LastUsedAt, time.Minute,
+		dbtime.Now(), res.Workspaces[0].LastUsedAt, time.Minute,
 	)
 }
diff --git a/coderd/templateversions.go b/coderd/templateversions.go
index 80ad85a3ecc12..314570f9dbe95 100644
--- a/coderd/templateversions.go
+++ b/coderd/templateversions.go
@@ -18,18 +18,20 @@ import (
 
 	"cdr.dev/slog"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/parameter"
-	"github.com/coder/coder/coderd/provisionerdserver"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/examples"
-	sdkproto "github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/provisionerjobs"
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/parameter"
+	"github.com/coder/coder/v2/coderd/provisionerdserver"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/examples"
+	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 // @Summary Get template version by ID
@@ -95,7 +97,7 @@ func (api *API) patchTemplateVersion(rw http.ResponseWriter, r *http.Request) {
 	updateParams := database.UpdateTemplateVersionByIDParams{
 		ID:         templateVersion.ID,
 		TemplateID: templateVersion.TemplateID,
-		UpdatedAt:  database.Now(),
+		UpdatedAt:  dbtime.Now(),
 		Name:       templateVersion.Name,
 		Message:    templateVersion.Message,
 	}
@@ -204,11 +206,11 @@ func (api *API) patchCancelTemplateVersion(rw http.ResponseWriter, r *http.Reque
 	err = api.Database.UpdateProvisionerJobWithCancelByID(ctx, database.UpdateProvisionerJobWithCancelByIDParams{
 		ID: job.ID,
 		CanceledAt: sql.NullTime{
-			Time:  database.Now(),
+			Time:  dbtime.Now(),
 			Valid: true,
 		},
 		CompletedAt: sql.NullTime{
-			Time: database.Now(),
+			Time: dbtime.Now(),
 			// If the job is running, don't mark it completed!
 			Valid: !job.WorkerID.Valid,
 		},
@@ -246,7 +248,7 @@ func (api *API) templateVersionRichParameters(rw http.ResponseWriter, r *http.Re
 		return
 	}
 	if !job.CompletedAt.Valid {
-		httpapi.Write(ctx, rw, http.StatusPreconditionFailed, codersdk.Response{
+		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
 			Message: "Job hasn't completed!",
 		})
 		return
@@ -271,26 +273,26 @@ func (api *API) templateVersionRichParameters(rw http.ResponseWriter, r *http.Re
 	httpapi.Write(ctx, rw, http.StatusOK, templateVersionParameters)
 }
 
-// @Summary Get git auth by template version
-// @ID get-git-auth-by-template-version
+// @Summary Get external auth by template version
+// @ID get-external-auth-by-template-version
 // @Security CoderSessionToken
 // @Produce json
 // @Tags Templates
 // @Param templateversion path string true "Template version ID" format(uuid)
-// @Success 200 {array} codersdk.TemplateVersionGitAuth
-// @Router /templateversions/{templateversion}/gitauth [get]
-func (api *API) templateVersionGitAuth(rw http.ResponseWriter, r *http.Request) {
+// @Success 200 {array} codersdk.TemplateVersionExternalAuth
+// @Router /templateversions/{templateversion}/external-auth [get]
+func (api *API) templateVersionExternalAuth(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	var (
 		apiKey          = httpmw.APIKey(r)
 		templateVersion = httpmw.TemplateVersionParam(r)
 	)
 
-	rawProviders := templateVersion.GitAuthProviders
-	providers := make([]codersdk.TemplateVersionGitAuth, 0)
+	rawProviders := templateVersion.ExternalAuthProviders
+	providers := make([]codersdk.TemplateVersionExternalAuth, 0)
 	for _, rawProvider := range rawProviders {
-		var config *gitauth.Config
-		for _, provider := range api.GitAuthConfigs {
+		var config *externalauth.Config
+		for _, provider := range api.ExternalAuthConfigs {
 			if provider.ID == rawProvider {
 				config = provider
 				break
@@ -305,7 +307,7 @@ func (api *API) templateVersionGitAuth(rw http.ResponseWriter, r *http.Request)
 		}
 
 		// This is the URL that will redirect the user with a state token.
-		redirectURL, err := api.AccessURL.Parse(fmt.Sprintf("/gitauth/%s", config.ID))
+		redirectURL, err := api.AccessURL.Parse(fmt.Sprintf("/external-auth/%s", config.ID))
 		if err != nil {
 			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 				Message: "Failed to parse access URL.",
@@ -314,13 +316,15 @@ func (api *API) templateVersionGitAuth(rw http.ResponseWriter, r *http.Request)
 			return
 		}
 
-		provider := codersdk.TemplateVersionGitAuth{
+		provider := codersdk.TemplateVersionExternalAuth{
 			ID:              config.ID,
 			Type:            config.Type,
 			AuthenticateURL: redirectURL.String(),
+			DisplayName:     config.DisplayName,
+			DisplayIcon:     config.DisplayIcon,
 		}
 
-		authLink, err := api.Database.GetGitAuthLink(ctx, database.GetGitAuthLinkParams{
+		authLink, err := api.Database.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
 			ProviderID: config.ID,
 			UserID:     apiKey.UserID,
 		})
@@ -331,7 +335,7 @@ func (api *API) templateVersionGitAuth(rw http.ResponseWriter, r *http.Request)
 		}
 		if err != nil {
 			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-				Message: "Internal error fetching git auth link.",
+				Message: "Internal error fetching external auth link.",
 				Detail:  err.Error(),
 			})
 			return
@@ -340,7 +344,7 @@ func (api *API) templateVersionGitAuth(rw http.ResponseWriter, r *http.Request)
 		_, updated, err := config.RefreshToken(ctx, api.Database, authLink)
 		if err != nil {
 			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-				Message: "Failed to refresh git auth token.",
+				Message: "Failed to refresh external auth token.",
 				Detail:  err.Error(),
 			})
 			return
@@ -379,7 +383,7 @@ func (api *API) templateVersionVariables(rw http.ResponseWriter, r *http.Request
 		return
 	}
 	if !job.CompletedAt.Valid {
-		httpapi.Write(ctx, rw, http.StatusPreconditionFailed, codersdk.Response{
+		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
 			Message: "Job hasn't completed!",
 		})
 		return
@@ -478,8 +482,8 @@ func (api *API) postTemplateVersionDryRun(rw http.ResponseWriter, r *http.Reques
 	jobID := uuid.New()
 	provisionerJob, err := api.Database.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
 		ID:             jobID,
-		CreatedAt:      database.Now(),
-		UpdatedAt:      database.Now(),
+		CreatedAt:      dbtime.Now(),
+		UpdatedAt:      dbtime.Now(),
 		OrganizationID: templateVersion.OrganizationID,
 		InitiatorID:    apiKey.UserID,
 		Provisioner:    job.Provisioner,
@@ -501,6 +505,11 @@ func (api *API) postTemplateVersionDryRun(rw http.ResponseWriter, r *http.Reques
 		})
 		return
 	}
+	err = provisionerjobs.PostJob(api.Pubsub, provisionerJob)
+	if err != nil {
+		// Client probably doesn't care about this error, so just log it.
+		api.Logger.Error(ctx, "failed to post provisioner job to pubsub", slog.Error(err))
+	}
 
 	httpapi.Write(ctx, rw, http.StatusCreated, convertProvisionerJob(database.GetProvisionerJobsByIDsWithQueuePositionRow{
 		ProvisionerJob: provisionerJob,
@@ -605,11 +614,11 @@ func (api *API) patchTemplateVersionDryRunCancel(rw http.ResponseWriter, r *http
 	err := api.Database.UpdateProvisionerJobWithCancelByID(ctx, database.UpdateProvisionerJobWithCancelByIDParams{
 		ID: job.ProvisionerJob.ID,
 		CanceledAt: sql.NullTime{
-			Time:  database.Now(),
+			Time:  dbtime.Now(),
 			Valid: true,
 		},
 		CompletedAt: sql.NullTime{
-			Time: database.Now(),
+			Time: dbtime.Now(),
 			// If the job is running, don't mark it completed!
 			Valid: !job.ProvisionerJob.WorkerID.Valid,
 		},
@@ -695,6 +704,7 @@ func (api *API) fetchTemplateVersionDryRunJob(rw http.ResponseWriter, r *http.Re
 // @Tags Templates
 // @Param template path string true "Template ID" format(uuid)
 // @Param after_id query string false "After ID" format(uuid)
+// @Param include_archived query bool false "Include archived versions in the list"
 // @Param limit query int false "Page limit"
 // @Param offset query int false "Page offset"
 // @Success 200 {array} codersdk.TemplateVersion
@@ -708,6 +718,17 @@ func (api *API) templateVersionsByTemplate(rw http.ResponseWriter, r *http.Reque
 		return
 	}
 
+	// If this throws an error, the boolean is false. Which is the default we want.
+	parser := httpapi.NewQueryParamParser()
+	includeArchived := parser.Boolean(r.URL.Query(), false, "include_archived")
+	if len(parser.Errors) > 0 {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message:     "Invalid query parameters.",
+			Validations: parser.Errors,
+		})
+		return
+	}
+
 	var err error
 	apiVersions := []codersdk.TemplateVersion{}
 	err = api.Database.InTx(func(store database.Store) error {
@@ -729,11 +750,21 @@ func (api *API) templateVersionsByTemplate(rw http.ResponseWriter, r *http.Reque
 			}
 		}
 
+		// Exclude archived templates versions
+		archiveFilter := sql.NullBool{
+			Bool:  false,
+			Valid: true,
+		}
+		if includeArchived {
+			archiveFilter = sql.NullBool{Valid: false}
+		}
+
 		versions, err := store.GetTemplateVersionsByTemplateID(ctx, database.GetTemplateVersionsByTemplateIDParams{
 			TemplateID: template.ID,
 			AfterID:    paginationParams.AfterID,
 			LimitOpt:   int32(paginationParams.Limit),
 			OffsetOpt:  int32(paginationParams.Offset),
+			Archived:   archiveFilter,
 		})
 		if errors.Is(err, sql.ErrNoRows) {
 			httpapi.Write(ctx, rw, http.StatusOK, apiVersions)
@@ -982,6 +1013,173 @@ func (api *API) previousTemplateVersionByOrganizationTemplateAndName(rw http.Res
 	httpapi.Write(ctx, rw, http.StatusOK, convertTemplateVersion(previousTemplateVersion, convertProvisionerJob(jobs[0]), nil))
 }
 
+// @Summary Archive template unused versions by template id
+// @ID archive-template-unused-versions-by-template-id
+// @Security CoderSessionToken
+// @Accept json
+// @Produce json
+// @Tags Templates
+// @Param template path string true "Template ID" format(uuid)
+// @Param request body codersdk.ArchiveTemplateVersionsRequest true "Archive request"
+// @Success 200 {object} codersdk.Response
+// @Router /templates/{template}/versions/archive [post]
+func (api *API) postArchiveTemplateVersions(rw http.ResponseWriter, r *http.Request) {
+	var (
+		ctx               = r.Context()
+		template          = httpmw.TemplateParam(r)
+		auditor           = *api.Auditor.Load()
+		aReq, commitAudit = audit.InitRequest[database.Template](rw, &audit.RequestParams{
+			Audit:   auditor,
+			Log:     api.Logger,
+			Request: r,
+			Action:  database.AuditActionWrite,
+		})
+	)
+	defer commitAudit()
+	aReq.Old = template
+
+	var req codersdk.ArchiveTemplateVersionsRequest
+	if !httpapi.Read(ctx, rw, r, &req) {
+		return
+	}
+
+	status := database.NullProvisionerJobStatus{
+		ProvisionerJobStatus: database.ProvisionerJobStatusFailed,
+		Valid:                true,
+	}
+	if req.All {
+		status = database.NullProvisionerJobStatus{}
+	}
+
+	archived, err := api.Database.ArchiveUnusedTemplateVersions(ctx, database.ArchiveUnusedTemplateVersionsParams{
+		UpdatedAt:  dbtime.Now(),
+		TemplateID: template.ID,
+		JobStatus:  status,
+		// Archive all versions that match
+		TemplateVersionID: uuid.Nil,
+	})
+
+	if httpapi.Is404Error(err) {
+		httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{
+			Message: "Template or template versions not found.",
+		})
+		return
+	}
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error fetching template version.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	httpapi.Write(ctx, rw, http.StatusOK, codersdk.ArchiveTemplateVersionsResponse{
+		TemplateID:  template.ID,
+		ArchivedIDs: archived,
+	})
+}
+
+// @Summary Archive template version
+// @ID archive-template-version
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Templates
+// @Param templateversion path string true "Template version ID" format(uuid)
+// @Success 200 {object} codersdk.Response
+// @Router /templateversions/{templateversion}/archive [post]
+func (api *API) postArchiveTemplateVersion() func(rw http.ResponseWriter, r *http.Request) {
+	return api.setArchiveTemplateVersion(true)
+}
+
+// @Summary Unarchive template version
+// @ID unarchive-template-version
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Templates
+// @Param templateversion path string true "Template version ID" format(uuid)
+// @Success 200 {object} codersdk.Response
+// @Router /templateversions/{templateversion}/unarchive [post]
+func (api *API) postUnarchiveTemplateVersion() func(rw http.ResponseWriter, r *http.Request) {
+	return api.setArchiveTemplateVersion(false)
+}
+
+//nolint:revive
+func (api *API) setArchiveTemplateVersion(archive bool) func(rw http.ResponseWriter, r *http.Request) {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		var (
+			ctx               = r.Context()
+			templateVersion   = httpmw.TemplateVersionParam(r)
+			auditor           = *api.Auditor.Load()
+			aReq, commitAudit = audit.InitRequest[database.TemplateVersion](rw, &audit.RequestParams{
+				Audit:   auditor,
+				Log:     api.Logger,
+				Request: r,
+				Action:  database.AuditActionWrite,
+			})
+		)
+		defer commitAudit()
+		aReq.Old = templateVersion
+
+		verb := "archived"
+		if !archive {
+			verb = "unarchived"
+		}
+		if templateVersion.Archived == archive {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: fmt.Sprintf("Template version already %s", verb),
+			})
+			return
+		}
+
+		if !templateVersion.TemplateID.Valid {
+			// Maybe we should allow this?
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Cannot archive template versions not associate with a template.",
+			})
+			return
+		}
+
+		var err error
+		if archive {
+			archived, archiveError := api.Database.ArchiveUnusedTemplateVersions(ctx, database.ArchiveUnusedTemplateVersionsParams{
+				UpdatedAt:         dbtime.Now(),
+				TemplateID:        templateVersion.TemplateID.UUID,
+				TemplateVersionID: templateVersion.ID,
+				JobStatus:         database.NullProvisionerJobStatus{},
+			})
+
+			if archiveError != nil {
+				err = archiveError
+			} else {
+				if len(archived) == 0 {
+					err = xerrors.New("Unable to archive specified version, the version is likely in use by a workspace or currently set to the active version")
+				}
+			}
+		} else {
+			err = api.Database.UnarchiveTemplateVersion(ctx, database.UnarchiveTemplateVersionParams{
+				UpdatedAt:         dbtime.Now(),
+				TemplateVersionID: templateVersion.ID,
+			})
+		}
+
+		if httpapi.Is404Error(err) {
+			httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{
+				Message: "Template or template versions not found.",
+			})
+			return
+		}
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error fetching template version.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+
+		httpapi.Write(ctx, rw, http.StatusOK, fmt.Sprintf("template version %q %s", templateVersion.ID.String(), verb))
+	}
+}
+
 // @Summary Update active template version by template ID
 // @ID update-active-template-version-by-template-id
 // @Security CoderSessionToken
@@ -1031,12 +1229,33 @@ func (api *API) patchActiveTemplateVersion(rw http.ResponseWriter, r *http.Reque
 		})
 		return
 	}
+	job, err := api.Database.GetProvisionerJobByID(ctx, version.JobID)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error fetching template version job status.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+	if job.JobStatus != database.ProvisionerJobStatusSucceeded {
+		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
+			Message: "Only versions that have been built successfully can be promoted.",
+			Detail:  fmt.Sprintf("Attempted to promote a version with a %s build", job.JobStatus),
+		})
+		return
+	}
+	if version.Archived {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "The provided template version is archived.",
+		})
+		return
+	}
 
 	err = api.Database.InTx(func(store database.Store) error {
 		err = store.UpdateTemplateActiveVersionByID(ctx, database.UpdateTemplateActiveVersionByIDParams{
 			ID:              template.ID,
 			ActiveVersionID: req.ID,
-			UpdatedAt:       database.Now(),
+			UpdatedAt:       dbtime.Now(),
 		})
 		if err != nil {
 			return xerrors.Errorf("update active version: %w", err)
@@ -1174,7 +1393,7 @@ func (api *API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r *ht
 				ID:        uuid.New(),
 				Hash:      hash,
 				CreatedBy: apiKey.UserID,
-				CreatedAt: database.Now(),
+				CreatedAt: dbtime.Now(),
 				Mimetype:  tarMimeType,
 				Data:      tar,
 			})
@@ -1227,8 +1446,8 @@ func (api *API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r *ht
 
 		provisionerJob, err = tx.InsertProvisionerJob(ctx, database.InsertProvisionerJobParams{
 			ID:             jobID,
-			CreatedAt:      database.Now(),
-			UpdatedAt:      database.Now(),
+			CreatedAt:      dbtime.Now(),
+			UpdatedAt:      dbtime.Now(),
 			OrganizationID: organization.ID,
 			InitiatorID:    apiKey.UserID,
 			Provisioner:    database.ProvisionerType(req.Provisioner),
@@ -1262,8 +1481,8 @@ func (api *API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r *ht
 			ID:             templateVersionID,
 			TemplateID:     templateID,
 			OrganizationID: organization.ID,
-			CreatedAt:      database.Now(),
-			UpdatedAt:      database.Now(),
+			CreatedAt:      dbtime.Now(),
+			UpdatedAt:      dbtime.Now(),
 			Name:           req.Name,
 			Message:        req.Message,
 			Readme:         "",
@@ -1288,6 +1507,11 @@ func (api *API) postTemplateVersionsByOrganization(rw http.ResponseWriter, r *ht
 		return
 	}
 	aReq.New = templateVersion
+	err = provisionerjobs.PostJob(api.Pubsub, provisionerJob)
+	if err != nil {
+		// Client probably doesn't care about this error, so just log it.
+		api.Logger.Error(ctx, "failed to post provisioner job to pubsub", slog.Error(err))
+	}
 
 	httpapi.Write(ctx, rw, http.StatusCreated, convertTemplateVersion(templateVersion, convertProvisionerJob(database.GetProvisionerJobsByIDsWithQueuePositionRow{
 		ProvisionerJob: provisionerJob,
@@ -1375,6 +1599,7 @@ func convertTemplateVersion(version database.TemplateVersion, job codersdk.Provi
 			Username:  version.CreatedByUsername,
 			AvatarURL: version.CreatedByAvatarURL.String,
 		},
+		Archived: version.Archived,
 		Warnings: warnings,
 	}
 }
diff --git a/coderd/templateversions_test.go b/coderd/templateversions_test.go
index 5826d31b06286..fe63ce3a5a78f 100644
--- a/coderd/templateversions_test.go
+++ b/coderd/templateversions_test.go
@@ -13,17 +13,17 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/sync/errgroup"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/provisionerdserver"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/examples"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/coderd/provisionerdserver"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/examples"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestTemplateVersion(t *testing.T) {
@@ -136,8 +136,8 @@ func TestPostTemplateVersionsByOrganization(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		data, err := echo.Tar(&echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionApply: echo.ProvisionComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
+			ProvisionApply: echo.ApplyComplete,
+			ProvisionPlan:  echo.PlanComplete,
 		})
 		require.NoError(t, err)
 
@@ -229,7 +229,7 @@ func TestPatchCancelTemplateVersion(t *testing.T) {
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -241,12 +241,14 @@ func TestPatchCancelTemplateVersion(t *testing.T) {
 	})
 	t.Run("AlreadyCanceled", func(t *testing.T) {
 		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+		})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Log{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Log{
 					Log: &proto.Log{},
 				},
 			}},
@@ -255,15 +257,7 @@ func TestPatchCancelTemplateVersion(t *testing.T) {
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
-		require.Eventually(t, func() bool {
-			var err error
-			version, err = client.TemplateVersion(ctx, version.ID)
-			if !assert.NoError(t, err) {
-				return false
-			}
-			t.Logf("Status: %s", version.Job.Status)
-			return version.Job.Status == codersdk.ProvisionerJobRunning
-		}, testutil.WaitShort, testutil.IntervalFast)
+		coderdtest.AwaitTemplateVersionJobRunning(t, client, version.ID)
 		err := client.CancelTemplateVersion(ctx, version.ID)
 		require.NoError(t, err)
 		err = client.CancelTemplateVersion(ctx, version.ID)
@@ -280,12 +274,14 @@ func TestPatchCancelTemplateVersion(t *testing.T) {
 	// Running -> Canceling is the best we can do for now.
 	t.Run("Canceling", func(t *testing.T) {
 		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+		})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Log{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Log{
 					Log: &proto.Log{},
 				},
 			}},
@@ -308,70 +304,72 @@ func TestPatchCancelTemplateVersion(t *testing.T) {
 		require.Eventually(t, func() bool {
 			var err error
 			version, err = client.TemplateVersion(ctx, version.ID)
+			// job gets marked Failed when there is an Error; in practice we never get to Status = Canceled
+			// because provisioners report an Error when canceled. We check the Error string to ensure we don't mask
+			// other errors in this test.
+			t.Logf("got version %s | %s", version.Job.Error, version.Job.Status)
 			return assert.NoError(t, err) &&
-				// The job will never actually cancel successfully because it will never send a
-				// provision complete response.
-				assert.Empty(t, version.Job.Error) &&
-				version.Job.Status == codersdk.ProvisionerJobCanceling
+				strings.HasSuffix(version.Job.Error, "canceled") &&
+				version.Job.Status == codersdk.ProvisionerJobFailed
 		}, testutil.WaitShort, testutil.IntervalFast)
 	})
 }
 
-func TestTemplateVersionsGitAuth(t *testing.T) {
+func TestTemplateVersionsExternalAuth(t *testing.T) {
 	t.Parallel()
 	t.Run("Empty", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
-		_, err := client.TemplateVersionGitAuth(ctx, version.ID)
+		_, err := client.TemplateVersionExternalAuth(ctx, version.ID)
 		require.NoError(t, err)
 	})
 	t.Run("Authenticated", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, &coderdtest.Options{
 			IncludeProvisionerDaemon: true,
-			GitAuthConfigs: []*gitauth.Config{{
+			ExternalAuthConfigs: []*externalauth.Config{{
 				OAuth2Config: &testutil.OAuth2Config{},
 				ID:           "github",
 				Regex:        regexp.MustCompile(`github\.com`),
-				Type:         codersdk.GitProviderGitHub,
+				Type:         codersdk.EnhancedExternalAuthProviderGitHub.String(),
 			}},
 		})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionPlan: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						GitAuthProviders: []string{"github"},
+			ProvisionPlan: []*proto.Response{{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
+						ExternalAuthProviders: []string{"github"},
 					},
 				},
 			}},
 		})
-		version = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		version = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		require.Empty(t, version.Job.Error)
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
 		// Not authenticated to start!
-		providers, err := client.TemplateVersionGitAuth(ctx, version.ID)
+		providers, err := client.TemplateVersionExternalAuth(ctx, version.ID)
 		require.NoError(t, err)
 		require.Len(t, providers, 1)
 		require.False(t, providers[0].Authenticated)
 
 		// Perform the Git auth callback to authenticate the user...
-		resp := coderdtest.RequestGitAuthCallback(t, "github", client)
+		resp := coderdtest.RequestExternalAuthCallback(t, "github", client)
 		_ = resp.Body.Close()
 		require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
 
 		// Ensure that the returned Git auth for the template is authenticated!
-		providers, err = client.TemplateVersionGitAuth(ctx, version.ID)
+		providers, err = client.TemplateVersionExternalAuth(ctx, version.ID)
 		require.NoError(t, err)
 		require.Len(t, providers, 1)
 		require.True(t, providers[0].Authenticated)
@@ -400,9 +398,9 @@ func TestTemplateVersionResources(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "some",
 							Type: "example",
@@ -418,7 +416,7 @@ func TestTemplateVersionResources(t *testing.T) {
 				},
 			}},
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -439,17 +437,17 @@ func TestTemplateVersionLogs(t *testing.T) {
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:         echo.ParseComplete,
-		ProvisionPlan: echo.ProvisionComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Log{
+		ProvisionPlan: echo.PlanComplete,
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Log{
 				Log: &proto.Log{
 					Level:  proto.LogLevel_INFO,
 					Output: "example",
 				},
 			},
 		}, {
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "some",
 						Type: "example",
@@ -555,13 +553,60 @@ func TestPatchActiveTemplateVersion(t *testing.T) {
 		require.Equal(t, http.StatusNotFound, apiErr.StatusCode())
 	})
 
-	t.Run("DoesNotBelong", func(t *testing.T) {
+	t.Run("CanceledBuild", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		version = coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, nil, template.ID)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		err := client.CancelTemplateVersion(ctx, version.ID)
+		require.NoError(t, err)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		err = client.UpdateActiveTemplateVersion(ctx, template.ID, codersdk.UpdateActiveTemplateVersion{
+			ID: version.ID,
+		})
+		var apiErr *codersdk.Error
+		require.ErrorAs(t, err, &apiErr)
+		require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
+		require.Contains(t, apiErr.Detail, "canceled")
+	})
+
+	t.Run("PendingBuild", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, nil)
+		user := coderdtest.CreateFirstUser(t, client)
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		version = coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, nil, template.ID)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		err := client.UpdateActiveTemplateVersion(ctx, template.ID, codersdk.UpdateActiveTemplateVersion{
+			ID: version.ID,
+		})
+		var apiErr *codersdk.Error
+		require.ErrorAs(t, err, &apiErr)
+		require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
+		require.Contains(t, apiErr.Detail, "pending")
+	})
+
+	t.Run("DoesNotBelong", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+		})
+		user := coderdtest.CreateFirstUser(t, client)
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		version = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		_ = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -574,13 +619,46 @@ func TestPatchActiveTemplateVersion(t *testing.T) {
 		require.Equal(t, http.StatusBadRequest, apiErr.StatusCode())
 	})
 
-	t.Run("Found", func(t *testing.T) {
+	t.Run("Archived", func(t *testing.T) {
 		t.Parallel()
 		auditor := audit.NewMock()
-		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true, Auditor: auditor})
+		ownerClient := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+			Auditor:                  auditor,
+		})
+		owner := coderdtest.CreateFirstUser(t, ownerClient)
+		client, _ := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID, rbac.RoleTemplateAdmin())
+
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		version = coderdtest.UpdateTemplateVersion(t, client, owner.OrganizationID, nil, template.ID)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		err := client.SetArchiveTemplateVersion(ctx, version.ID, true)
+		require.NoError(t, err)
+
+		err = client.UpdateActiveTemplateVersion(ctx, template.ID, codersdk.UpdateActiveTemplateVersion{
+			ID: version.ID,
+		})
+		require.Error(t, err)
+		require.ErrorContains(t, err, "The provided template version is archived")
+	})
+
+	t.Run("SuccessfulBuild", func(t *testing.T) {
+		t.Parallel()
+		auditor := audit.NewMock()
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+			Auditor:                  auditor,
+		})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		version = coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, nil, template.ID)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -590,8 +668,8 @@ func TestPatchActiveTemplateVersion(t *testing.T) {
 		})
 		require.NoError(t, err)
 
-		require.Len(t, auditor.AuditLogs(), 5)
-		assert.Equal(t, database.AuditActionWrite, auditor.AuditLogs()[4].Action)
+		require.Len(t, auditor.AuditLogs(), 6)
+		assert.Equal(t, database.AuditActionWrite, auditor.AuditLogs()[5].Action)
 	})
 }
 
@@ -610,22 +688,22 @@ func TestTemplateVersionDryRun(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{
+			ProvisionApply: []*proto.Response{
 				{
-					Type: &proto.Provision_Response_Log{
+					Type: &proto.Response_Log{
 						Log: &proto.Log{},
 					},
 				},
 				{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
 							Resources: []*proto.Resource{resource},
 						},
 					},
 				},
 			},
 		})
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -677,8 +755,8 @@ func TestTemplateVersionDryRun(t *testing.T) {
 		// This import job will never finish
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Log{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Log{
 					Log: &proto.Log{},
 				},
 			}},
@@ -705,21 +783,21 @@ func TestTemplateVersionDryRun(t *testing.T) {
 
 			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 				Parse: echo.ParseComplete,
-				ProvisionApply: []*proto.Provision_Response{
+				ProvisionApply: []*proto.Response{
 					{
-						Type: &proto.Provision_Response_Log{
+						Type: &proto.Response_Log{
 							Log: &proto.Log{},
 						},
 					},
 					{
-						Type: &proto.Provision_Response_Complete{
-							Complete: &proto.Provision_Complete{},
+						Type: &proto.Response_Apply{
+							Apply: &proto.ApplyComplete{},
 						},
 					},
 				},
 			})
 
-			version = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			version = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			require.Equal(t, codersdk.ProvisionerJobSucceeded, version.Job.Status)
 
 			closer.Close()
@@ -743,7 +821,7 @@ func TestTemplateVersionDryRun(t *testing.T) {
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 			user := coderdtest.CreateFirstUser(t, client)
 			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 			defer cancel()
@@ -776,21 +854,21 @@ func TestTemplateVersionDryRun(t *testing.T) {
 			user := coderdtest.CreateFirstUser(t, client)
 			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 				Parse: echo.ParseComplete,
-				ProvisionApply: []*proto.Provision_Response{
+				ProvisionApply: []*proto.Response{
 					{
-						Type: &proto.Provision_Response_Log{
+						Type: &proto.Response_Log{
 							Log: &proto.Log{},
 						},
 					},
 					{
-						Type: &proto.Provision_Response_Complete{
-							Complete: &proto.Provision_Complete{},
+						Type: &proto.Response_Apply{
+							Apply: &proto.ApplyComplete{},
 						},
 					},
 				},
 			})
 
-			version = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			version = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			require.Equal(t, codersdk.ProvisionerJobSucceeded, version.Job.Status)
 
 			closer.Close()
@@ -972,14 +1050,14 @@ func TestPreviousTemplateVersion(t *testing.T) {
 		// from another template
 		templateAVersion1 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		coderdtest.CreateTemplate(t, client, user.OrganizationID, templateAVersion1.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, templateAVersion1.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateAVersion1.ID)
 		// Create two versions for the template B to be sure if we try to get the
 		// previous version of the first version it will returns a 404
 		templateBVersion1 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		templateB := coderdtest.CreateTemplate(t, client, user.OrganizationID, templateBVersion1.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, templateBVersion1.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateBVersion1.ID)
 		templateBVersion2 := coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, nil, templateB.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, templateBVersion2.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateBVersion2.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -999,14 +1077,14 @@ func TestPreviousTemplateVersion(t *testing.T) {
 		// from another template
 		templateAVersion1 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		coderdtest.CreateTemplate(t, client, user.OrganizationID, templateAVersion1.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, templateAVersion1.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateAVersion1.ID)
 		// Create two versions for the template B so we can try to get the previous
 		// version of version 2
 		templateBVersion1 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		templateB := coderdtest.CreateTemplate(t, client, user.OrganizationID, templateBVersion1.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, templateBVersion1.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateBVersion1.ID)
 		templateBVersion2 := coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, nil, templateB.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, templateBVersion2.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateBVersion2.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -1040,21 +1118,17 @@ func TestTemplateVersionVariables(t *testing.T) {
 
 	createEchoResponses := func(templateVariables []*proto.TemplateVariable) *echo.Responses {
 		return &echo.Responses{
-			Parse: []*proto.Parse_Response{
+			Parse: []*proto.Response{
 				{
-					Type: &proto.Parse_Response_Complete{
-						Complete: &proto.Parse_Complete{
+					Type: &proto.Response_Parse{
+						Parse: &proto.ParseComplete{
 							TemplateVariables: templateVariables,
 						},
 					},
 				},
 			},
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{},
-				},
-			}},
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
 		}
 	}
 
@@ -1084,7 +1158,7 @@ func TestTemplateVersionVariables(t *testing.T) {
 				}
 			},
 		)
-		templateVersion := coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		templateVersion := coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		// As user passed the value for the first parameter, the job will succeed.
 		require.Empty(t, templateVersion.Job.Error)
@@ -1126,7 +1200,7 @@ func TestTemplateVersionVariables(t *testing.T) {
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, createEchoResponses(templateVariables))
-		templateVersion := coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		templateVersion := coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		// As the first variable is marked as required and misses the default value,
 		// the job will fail, but will populate the template_version_variables table with existing variables.
@@ -1179,7 +1253,7 @@ func TestTemplateVersionVariables(t *testing.T) {
 				}
 			},
 		)
-		templateVersion := coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		templateVersion := coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		// As user passed the value for the first parameter, the job will succeed.
 		require.Empty(t, templateVersion.Job.Error)
@@ -1418,10 +1492,10 @@ func TestTemplateVersionParameters_Order(t *testing.T) {
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse: echo.ParseComplete,
-		ProvisionPlan: []*proto.Provision_Response{
+		ProvisionPlan: []*proto.Response{
 			{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
 						Parameters: []*proto.RichParameter{
 							{
 								Name: firstParameterName,
@@ -1453,13 +1527,9 @@ func TestTemplateVersionParameters_Order(t *testing.T) {
 				},
 			},
 		},
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{},
-			},
-		}},
+		ProvisionApply: echo.ApplyComplete,
 	})
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
@@ -1473,3 +1543,118 @@ func TestTemplateVersionParameters_Order(t *testing.T) {
 	require.Equal(t, secondParameterName, templateRichParameters[3].Name)
 	require.Equal(t, thirdParameterName, templateRichParameters[4].Name)
 }
+
+func TestTemplateArchiveVersions(t *testing.T) {
+	t.Parallel()
+
+	ownerClient := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+	owner := coderdtest.CreateFirstUser(t, ownerClient)
+	client, _ := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID, rbac.RoleTemplateAdmin())
+
+	var totalVersions int
+	// Create a template to archive
+	initialVersion := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+	totalVersions++
+	template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, initialVersion.ID)
+
+	allFailed := make([]uuid.UUID, 0)
+	expArchived := make([]uuid.UUID, 0)
+	// create some failed versions
+	for i := 0; i < 2; i++ {
+		failed := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanFailed,
+			ProvisionApply: echo.ApplyFailed,
+		}, func(req *codersdk.CreateTemplateVersionRequest) {
+			req.TemplateID = template.ID
+		})
+		allFailed = append(allFailed, failed.ID)
+		totalVersions++
+	}
+
+	// Create some unused versions
+	for i := 0; i < 2; i++ {
+		unused := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
+		}, func(req *codersdk.CreateTemplateVersionRequest) {
+			req.TemplateID = template.ID
+		})
+		expArchived = append(expArchived, unused.ID)
+		totalVersions++
+	}
+
+	// Create some used template versions
+	for i := 0; i < 2; i++ {
+		used := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
+		}, func(req *codersdk.CreateTemplateVersionRequest) {
+			req.TemplateID = template.ID
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, used.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, owner.OrganizationID, uuid.Nil, func(request *codersdk.CreateWorkspaceRequest) {
+			request.TemplateVersionID = used.ID
+		})
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+		totalVersions++
+	}
+
+	ctx := testutil.Context(t, testutil.WaitMedium)
+	versions, err := client.TemplateVersionsByTemplate(ctx, codersdk.TemplateVersionsByTemplateRequest{
+		TemplateID: template.ID,
+		Pagination: codersdk.Pagination{
+			Limit: 100,
+		},
+	})
+	require.NoError(t, err, "fetch all versions")
+	require.Len(t, versions, totalVersions, "total versions")
+
+	// Archive failed versions
+	archiveFailed, err := client.ArchiveTemplateVersions(ctx, template.ID, false)
+	require.NoError(t, err, "archive failed versions")
+	require.ElementsMatch(t, archiveFailed.ArchivedIDs, allFailed, "all failed versions archived")
+
+	remaining, err := client.TemplateVersionsByTemplate(ctx, codersdk.TemplateVersionsByTemplateRequest{
+		TemplateID: template.ID,
+		Pagination: codersdk.Pagination{
+			Limit: 100,
+		},
+	})
+	require.NoError(t, err, "fetch all non-failed versions")
+	require.Len(t, remaining, totalVersions-len(allFailed), "remaining non-failed versions")
+
+	// Try archiving "All" unused templates
+	archived, err := client.ArchiveTemplateVersions(ctx, template.ID, true)
+	require.NoError(t, err, "archive versions")
+	require.ElementsMatch(t, archived.ArchivedIDs, expArchived, "all expected versions archived")
+
+	remaining, err = client.TemplateVersionsByTemplate(ctx, codersdk.TemplateVersionsByTemplateRequest{
+		TemplateID: template.ID,
+		Pagination: codersdk.Pagination{
+			Limit: 100,
+		},
+	})
+	require.NoError(t, err, "fetch all versions")
+	require.Len(t, remaining, totalVersions-len(expArchived)-len(allFailed), "remaining versions")
+
+	// Unarchive a version
+	err = client.SetArchiveTemplateVersion(ctx, expArchived[0], false)
+	require.NoError(t, err, "unarchive a version")
+
+	tv, err := client.TemplateVersion(ctx, expArchived[0])
+	require.NoError(t, err, "fetch version")
+	require.False(t, tv.Archived, "expect unarchived")
+
+	// Check the remaining again
+	remaining, err = client.TemplateVersionsByTemplate(ctx, codersdk.TemplateVersionsByTemplateRequest{
+		TemplateID: template.ID,
+		Pagination: codersdk.Pagination{
+			Limit: 100,
+		},
+	})
+	require.NoError(t, err, "fetch all versions")
+	require.Len(t, remaining, totalVersions-len(expArchived)-len(allFailed)+1, "remaining versions")
+}
diff --git a/coderd/testdata/insights/template/multiple_users_and_workspaces_three_weeks_second_template.json.golden b/coderd/testdata/insights/template/multiple_users_and_workspaces_three_weeks_second_template.json.golden
new file mode 100644
index 0000000000000..07c3f52607334
--- /dev/null
+++ b/coderd/testdata/insights/template/multiple_users_and_workspaces_three_weeks_second_template.json.golden
@@ -0,0 +1,90 @@
+{
+  "report": {
+    "start_time": "2023-08-01T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000002"
+    ],
+    "active_users": 1,
+    "apps_usage": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 7200
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 10800
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "app",
+        "display_name": "app1",
+        "slug": "app1",
+        "icon": "/icon1.png",
+        "seconds": 21600
+      }
+    ],
+    "parameters_usage": []
+  },
+  "interval_reports": [
+    {
+      "start_time": "2023-08-01T00:00:00Z",
+      "end_time": "2023-08-08T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000002"
+      ],
+      "interval": "week",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-08T00:00:00Z",
+      "end_time": "2023-08-15T00:00:00Z",
+      "template_ids": [],
+      "interval": "week",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-15T00:00:00Z",
+      "end_time": "2023-08-22T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000002"
+      ],
+      "interval": "week",
+      "active_users": 1
+    }
+  ]
+}
diff --git a/coderd/testdata/insights/template/multiple_users_and_workspaces_three_weeks_second_template_only_interval_reports.json.golden b/coderd/testdata/insights/template/multiple_users_and_workspaces_three_weeks_second_template_only_interval_reports.json.golden
new file mode 100644
index 0000000000000..34ffaeccf628a
--- /dev/null
+++ b/coderd/testdata/insights/template/multiple_users_and_workspaces_three_weeks_second_template_only_interval_reports.json.golden
@@ -0,0 +1,29 @@
+{
+  "interval_reports": [
+    {
+      "start_time": "2023-08-01T00:00:00Z",
+      "end_time": "2023-08-08T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000002"
+      ],
+      "interval": "week",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-08T00:00:00Z",
+      "end_time": "2023-08-15T00:00:00Z",
+      "template_ids": [],
+      "interval": "week",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-15T00:00:00Z",
+      "end_time": "2023-08-22T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000002"
+      ],
+      "interval": "week",
+      "active_users": 1
+    }
+  ]
+}
diff --git a/coderd/testdata/insights/template/multiple_users_and_workspaces_three_weeks_second_template_only_report.json.golden b/coderd/testdata/insights/template/multiple_users_and_workspaces_three_weeks_second_template_only_report.json.golden
new file mode 100644
index 0000000000000..e3a1a2cd3974f
--- /dev/null
+++ b/coderd/testdata/insights/template/multiple_users_and_workspaces_three_weeks_second_template_only_report.json.golden
@@ -0,0 +1,63 @@
+{
+  "report": {
+    "start_time": "2023-08-01T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000002"
+    ],
+    "active_users": 1,
+    "apps_usage": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 7200
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 10800
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "app",
+        "display_name": "app1",
+        "slug": "app1",
+        "icon": "/icon1.png",
+        "seconds": 21600
+      }
+    ],
+    "parameters_usage": []
+  }
+}
diff --git a/coderd/testdata/insights/template/multiple_users_and_workspaces_week_all_templates.json.golden b/coderd/testdata/insights/template/multiple_users_and_workspaces_week_all_templates.json.golden
new file mode 100644
index 0000000000000..664e2fed8f250
--- /dev/null
+++ b/coderd/testdata/insights/template/multiple_users_and_workspaces_week_all_templates.json.golden
@@ -0,0 +1,159 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001",
+      "00000000-0000-0000-0000-000000000002",
+      "00000000-0000-0000-0000-000000000003"
+    ],
+    "active_users": 3,
+    "apps_usage": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 120
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 11520
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "app",
+        "display_name": "app1",
+        "slug": "app1",
+        "icon": "/icon1.png",
+        "seconds": 25380
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "app",
+        "display_name": "app3",
+        "slug": "app3",
+        "icon": "/icon2.png",
+        "seconds": 720
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "app",
+        "display_name": "otherapp1",
+        "slug": "otherapp1",
+        "icon": "/icon1.png",
+        "seconds": 300
+      }
+    ],
+    "parameters_usage": []
+  },
+  "interval_reports": [
+    {
+      "start_time": "2023-08-15T00:00:00Z",
+      "end_time": "2023-08-16T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001",
+        "00000000-0000-0000-0000-000000000002",
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "day",
+      "active_users": 3
+    },
+    {
+      "start_time": "2023-08-16T00:00:00Z",
+      "end_time": "2023-08-17T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-17T00:00:00Z",
+      "end_time": "2023-08-18T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001",
+        "00000000-0000-0000-0000-000000000002",
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "day",
+      "active_users": 2
+    },
+    {
+      "start_time": "2023-08-18T00:00:00Z",
+      "end_time": "2023-08-19T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-19T00:00:00Z",
+      "end_time": "2023-08-20T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-20T00:00:00Z",
+      "end_time": "2023-08-21T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-21T00:00:00Z",
+      "end_time": "2023-08-22T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001"
+      ],
+      "interval": "day",
+      "active_users": 1
+    }
+  ]
+}
diff --git a/coderd/testdata/insights/template/multiple_users_and_workspaces_week_deployment_wide.json.golden b/coderd/testdata/insights/template/multiple_users_and_workspaces_week_deployment_wide.json.golden
new file mode 100644
index 0000000000000..664e2fed8f250
--- /dev/null
+++ b/coderd/testdata/insights/template/multiple_users_and_workspaces_week_deployment_wide.json.golden
@@ -0,0 +1,159 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001",
+      "00000000-0000-0000-0000-000000000002",
+      "00000000-0000-0000-0000-000000000003"
+    ],
+    "active_users": 3,
+    "apps_usage": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 120
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 11520
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "app",
+        "display_name": "app1",
+        "slug": "app1",
+        "icon": "/icon1.png",
+        "seconds": 25380
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "app",
+        "display_name": "app3",
+        "slug": "app3",
+        "icon": "/icon2.png",
+        "seconds": 720
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "app",
+        "display_name": "otherapp1",
+        "slug": "otherapp1",
+        "icon": "/icon1.png",
+        "seconds": 300
+      }
+    ],
+    "parameters_usage": []
+  },
+  "interval_reports": [
+    {
+      "start_time": "2023-08-15T00:00:00Z",
+      "end_time": "2023-08-16T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001",
+        "00000000-0000-0000-0000-000000000002",
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "day",
+      "active_users": 3
+    },
+    {
+      "start_time": "2023-08-16T00:00:00Z",
+      "end_time": "2023-08-17T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-17T00:00:00Z",
+      "end_time": "2023-08-18T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001",
+        "00000000-0000-0000-0000-000000000002",
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "day",
+      "active_users": 2
+    },
+    {
+      "start_time": "2023-08-18T00:00:00Z",
+      "end_time": "2023-08-19T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-19T00:00:00Z",
+      "end_time": "2023-08-20T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-20T00:00:00Z",
+      "end_time": "2023-08-21T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-21T00:00:00Z",
+      "end_time": "2023-08-22T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001"
+      ],
+      "interval": "day",
+      "active_users": 1
+    }
+  ]
+}
diff --git a/coderd/testdata/insights/template/multiple_users_and_workspaces_week_first_template.json.golden b/coderd/testdata/insights/template/multiple_users_and_workspaces_week_first_template.json.golden
new file mode 100644
index 0000000000000..d96469dc5c724
--- /dev/null
+++ b/coderd/testdata/insights/template/multiple_users_and_workspaces_week_first_template.json.golden
@@ -0,0 +1,132 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001"
+    ],
+    "active_users": 2,
+    "apps_usage": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 120
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 7920
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "app",
+        "display_name": "app1",
+        "slug": "app1",
+        "icon": "/icon1.png",
+        "seconds": 3780
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "app",
+        "display_name": "app3",
+        "slug": "app3",
+        "icon": "/icon2.png",
+        "seconds": 720
+      }
+    ],
+    "parameters_usage": []
+  },
+  "interval_reports": [
+    {
+      "start_time": "2023-08-15T00:00:00Z",
+      "end_time": "2023-08-16T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001"
+      ],
+      "interval": "day",
+      "active_users": 2
+    },
+    {
+      "start_time": "2023-08-16T00:00:00Z",
+      "end_time": "2023-08-17T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-17T00:00:00Z",
+      "end_time": "2023-08-18T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-18T00:00:00Z",
+      "end_time": "2023-08-19T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-19T00:00:00Z",
+      "end_time": "2023-08-20T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-20T00:00:00Z",
+      "end_time": "2023-08-21T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-21T00:00:00Z",
+      "end_time": "2023-08-22T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001"
+      ],
+      "interval": "day",
+      "active_users": 1
+    }
+  ]
+}
diff --git "a/coderd/testdata/insights/template/multiple_users_and_workspaces_week_other_timezone_(S\303\243o_Paulo).json.golden" "b/coderd/testdata/insights/template/multiple_users_and_workspaces_week_other_timezone_(S\303\243o_Paulo).json.golden"
new file mode 100644
index 0000000000000..8f447e4112dd0
--- /dev/null
+++ "b/coderd/testdata/insights/template/multiple_users_and_workspaces_week_other_timezone_(S\303\243o_Paulo).json.golden"
@@ -0,0 +1,150 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00-03:00",
+    "end_time": "2023-08-22T00:00:00-03:00",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001",
+      "00000000-0000-0000-0000-000000000002",
+      "00000000-0000-0000-0000-000000000003"
+    ],
+    "active_users": 3,
+    "apps_usage": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 120
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 4320
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "app",
+        "display_name": "app1",
+        "slug": "app1",
+        "icon": "/icon1.png",
+        "seconds": 21720
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "app",
+        "display_name": "app3",
+        "slug": "app3",
+        "icon": "/icon2.png",
+        "seconds": 4320
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "app",
+        "display_name": "otherapp1",
+        "slug": "otherapp1",
+        "icon": "/icon1.png",
+        "seconds": 300
+      }
+    ],
+    "parameters_usage": []
+  },
+  "interval_reports": [
+    {
+      "start_time": "2023-08-15T00:00:00-03:00",
+      "end_time": "2023-08-16T00:00:00-03:00",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-16T00:00:00-03:00",
+      "end_time": "2023-08-17T00:00:00-03:00",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001",
+        "00000000-0000-0000-0000-000000000002",
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "day",
+      "active_users": 2
+    },
+    {
+      "start_time": "2023-08-17T00:00:00-03:00",
+      "end_time": "2023-08-18T00:00:00-03:00",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000002",
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "day",
+      "active_users": 2
+    },
+    {
+      "start_time": "2023-08-18T00:00:00-03:00",
+      "end_time": "2023-08-19T00:00:00-03:00",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-19T00:00:00-03:00",
+      "end_time": "2023-08-20T00:00:00-03:00",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-20T00:00:00-03:00",
+      "end_time": "2023-08-21T00:00:00-03:00",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-21T00:00:00-03:00",
+      "end_time": "2023-08-22T00:00:00-03:00",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001"
+      ],
+      "interval": "day",
+      "active_users": 1
+    }
+  ]
+}
diff --git a/coderd/testdata/insights/template/multiple_users_and_workspaces_week_second_template.json.golden b/coderd/testdata/insights/template/multiple_users_and_workspaces_week_second_template.json.golden
new file mode 100644
index 0000000000000..b15cba10a8520
--- /dev/null
+++ b/coderd/testdata/insights/template/multiple_users_and_workspaces_week_second_template.json.golden
@@ -0,0 +1,118 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000002"
+    ],
+    "active_users": 1,
+    "apps_usage": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "app",
+        "display_name": "app1",
+        "slug": "app1",
+        "icon": "/icon1.png",
+        "seconds": 21600
+      }
+    ],
+    "parameters_usage": []
+  },
+  "interval_reports": [
+    {
+      "start_time": "2023-08-15T00:00:00Z",
+      "end_time": "2023-08-16T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000002"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-16T00:00:00Z",
+      "end_time": "2023-08-17T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-17T00:00:00Z",
+      "end_time": "2023-08-18T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000002"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-18T00:00:00Z",
+      "end_time": "2023-08-19T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-19T00:00:00Z",
+      "end_time": "2023-08-20T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-20T00:00:00Z",
+      "end_time": "2023-08-21T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-21T00:00:00Z",
+      "end_time": "2023-08-22T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    }
+  ]
+}
diff --git a/coderd/testdata/insights/template/multiple_users_and_workspaces_week_third_template.json.golden b/coderd/testdata/insights/template/multiple_users_and_workspaces_week_third_template.json.golden
new file mode 100644
index 0000000000000..ea4002e09f152
--- /dev/null
+++ b/coderd/testdata/insights/template/multiple_users_and_workspaces_week_third_template.json.golden
@@ -0,0 +1,120 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000003"
+    ],
+    "active_users": 1,
+    "apps_usage": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "app",
+        "display_name": "otherapp1",
+        "slug": "otherapp1",
+        "icon": "/icon1.png",
+        "seconds": 300
+      }
+    ],
+    "parameters_usage": []
+  },
+  "interval_reports": [
+    {
+      "start_time": "2023-08-15T00:00:00Z",
+      "end_time": "2023-08-16T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-16T00:00:00Z",
+      "end_time": "2023-08-17T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-17T00:00:00Z",
+      "end_time": "2023-08-18T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-18T00:00:00Z",
+      "end_time": "2023-08-19T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "day",
+      "active_users": 1
+    },
+    {
+      "start_time": "2023-08-19T00:00:00Z",
+      "end_time": "2023-08-20T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-20T00:00:00Z",
+      "end_time": "2023-08-21T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    },
+    {
+      "start_time": "2023-08-21T00:00:00Z",
+      "end_time": "2023-08-22T00:00:00Z",
+      "template_ids": [],
+      "interval": "day",
+      "active_users": 0
+    }
+  ]
+}
diff --git a/coderd/testdata/insights/template/multiple_users_and_workspaces_weekly_aggregated_deployment_wide.json.golden b/coderd/testdata/insights/template/multiple_users_and_workspaces_weekly_aggregated_deployment_wide.json.golden
new file mode 100644
index 0000000000000..e6f3425f27aa5
--- /dev/null
+++ b/coderd/testdata/insights/template/multiple_users_and_workspaces_weekly_aggregated_deployment_wide.json.golden
@@ -0,0 +1,107 @@
+{
+  "report": {
+    "start_time": "2023-08-12T00:00:00Z",
+    "end_time": "2023-08-19T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001",
+      "00000000-0000-0000-0000-000000000002",
+      "00000000-0000-0000-0000-000000000003"
+    ],
+    "active_users": 3,
+    "apps_usage": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 7200
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 120
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 15120
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "app",
+        "display_name": "app1",
+        "slug": "app1",
+        "icon": "/icon1.png",
+        "seconds": 25380
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "app",
+        "display_name": "app3",
+        "slug": "app3",
+        "icon": "/icon2.png",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "app",
+        "display_name": "otherapp1",
+        "slug": "otherapp1",
+        "icon": "/icon1.png",
+        "seconds": 300
+      }
+    ],
+    "parameters_usage": []
+  },
+  "interval_reports": [
+    {
+      "start_time": "2023-08-12T00:00:00Z",
+      "end_time": "2023-08-19T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001",
+        "00000000-0000-0000-0000-000000000002",
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "week",
+      "active_users": 3
+    }
+  ]
+}
diff --git a/coderd/testdata/insights/template/multiple_users_and_workspaces_weekly_aggregated_first_template.json.golden b/coderd/testdata/insights/template/multiple_users_and_workspaces_weekly_aggregated_first_template.json.golden
new file mode 100644
index 0000000000000..3c0483f7feb48
--- /dev/null
+++ b/coderd/testdata/insights/template/multiple_users_and_workspaces_weekly_aggregated_first_template.json.golden
@@ -0,0 +1,84 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001"
+    ],
+    "active_users": 2,
+    "apps_usage": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 120
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 7920
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "app",
+        "display_name": "app1",
+        "slug": "app1",
+        "icon": "/icon1.png",
+        "seconds": 3780
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "app",
+        "display_name": "app3",
+        "slug": "app3",
+        "icon": "/icon2.png",
+        "seconds": 720
+      }
+    ],
+    "parameters_usage": []
+  },
+  "interval_reports": [
+    {
+      "start_time": "2023-08-15T00:00:00Z",
+      "end_time": "2023-08-22T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001"
+      ],
+      "interval": "week",
+      "active_users": 2
+    }
+  ]
+}
diff --git a/coderd/testdata/insights/template/multiple_users_and_workspaces_weekly_aggregated_templates.json.golden b/coderd/testdata/insights/template/multiple_users_and_workspaces_weekly_aggregated_templates.json.golden
new file mode 100644
index 0000000000000..185a7fe143a2b
--- /dev/null
+++ b/coderd/testdata/insights/template/multiple_users_and_workspaces_weekly_aggregated_templates.json.golden
@@ -0,0 +1,107 @@
+{
+  "report": {
+    "start_time": "2023-08-14T00:00:00Z",
+    "end_time": "2023-08-21T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001",
+      "00000000-0000-0000-0000-000000000002",
+      "00000000-0000-0000-0000-000000000003"
+    ],
+    "active_users": 3,
+    "apps_usage": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 7200
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 120
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002",
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 15120
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "type": "app",
+        "display_name": "app1",
+        "slug": "app1",
+        "icon": "/icon1.png",
+        "seconds": 25380
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "type": "app",
+        "display_name": "app3",
+        "slug": "app3",
+        "icon": "/icon2.png",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "type": "app",
+        "display_name": "otherapp1",
+        "slug": "otherapp1",
+        "icon": "/icon1.png",
+        "seconds": 300
+      }
+    ],
+    "parameters_usage": []
+  },
+  "interval_reports": [
+    {
+      "start_time": "2023-08-14T00:00:00Z",
+      "end_time": "2023-08-21T00:00:00Z",
+      "template_ids": [
+        "00000000-0000-0000-0000-000000000001",
+        "00000000-0000-0000-0000-000000000002",
+        "00000000-0000-0000-0000-000000000003"
+      ],
+      "interval": "week",
+      "active_users": 3
+    }
+  ]
+}
diff --git a/coderd/testdata/insights/template/parameters_two_days_ago,_no_data.json.golden b/coderd/testdata/insights/template/parameters_two_days_ago,_no_data.json.golden
new file mode 100644
index 0000000000000..f735c19be42f8
--- /dev/null
+++ b/coderd/testdata/insights/template/parameters_two_days_ago,_no_data.json.golden
@@ -0,0 +1,43 @@
+{
+  "report": {
+    "start_time": "0001-01-01T00:00:00Z",
+    "end_time": "0001-01-01T00:00:00Z",
+    "template_ids": [],
+    "active_users": 0,
+    "apps_usage": [
+      {
+        "template_ids": [],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 0
+      }
+    ],
+    "parameters_usage": []
+  }
+}
diff --git a/coderd/testdata/insights/template/parameters_yesterday_and_today_deployment_wide.json.golden b/coderd/testdata/insights/template/parameters_yesterday_and_today_deployment_wide.json.golden
new file mode 100644
index 0000000000000..f2609418939d6
--- /dev/null
+++ b/coderd/testdata/insights/template/parameters_yesterday_and_today_deployment_wide.json.golden
@@ -0,0 +1,164 @@
+{
+  "report": {
+    "start_time": "0001-01-01T00:00:00Z",
+    "end_time": "0001-01-01T00:00:00Z",
+    "template_ids": [],
+    "active_users": 0,
+    "apps_usage": [
+      {
+        "template_ids": [],
+        "type": "builtin",
+        "display_name": "Visual Studio Code",
+        "slug": "vscode",
+        "icon": "/icon/code.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [],
+        "type": "builtin",
+        "display_name": "JetBrains",
+        "slug": "jetbrains",
+        "icon": "/icon/intellij.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [],
+        "type": "builtin",
+        "display_name": "Web Terminal",
+        "slug": "reconnecting-pty",
+        "icon": "/icon/terminal.svg",
+        "seconds": 0
+      },
+      {
+        "template_ids": [],
+        "type": "builtin",
+        "display_name": "SSH",
+        "slug": "ssh",
+        "icon": "/icon/terminal.svg",
+        "seconds": 0
+      }
+    ],
+    "parameters_usage": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "display_name": "otherparam1",
+        "name": "otherparam1",
+        "type": "string",
+        "description": "This is another parameter",
+        "values": [
+          {
+            "value": "",
+            "count": 1
+          },
+          {
+            "value": "xyz",
+            "count": 1
+          }
+        ]
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "display_name": "param1",
+        "name": "param1",
+        "type": "string",
+        "description": "This is first parameter",
+        "values": [
+          {
+            "value": "",
+            "count": 1
+          },
+          {
+            "value": "ABC",
+            "count": 1
+          },
+          {
+            "value": "abc",
+            "count": 2
+          }
+        ]
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "display_name": "param2",
+        "name": "param2",
+        "type": "string",
+        "description": "This is second parameter",
+        "values": [
+          {
+            "value": "",
+            "count": 1
+          },
+          {
+            "value": "123",
+            "count": 3
+          }
+        ]
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "display_name": "param3",
+        "name": "param3",
+        "type": "string",
+        "description": "This is third parameter",
+        "values": [
+          {
+            "value": "",
+            "count": 1
+          },
+          {
+            "value": "BBB",
+            "count": 2
+          },
+          {
+            "value": "bbb",
+            "count": 1
+          }
+        ]
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "display_name": "param4",
+        "name": "param4",
+        "type": "string",
+        "description": "This is fourth parameter",
+        "options": [
+          {
+            "name": "option1",
+            "description": "",
+            "value": "option1",
+            "icon": ""
+          },
+          {
+            "name": "option2",
+            "description": "",
+            "value": "option2",
+            "icon": ""
+          }
+        ],
+        "values": [
+          {
+            "value": "option1",
+            "count": 2
+          },
+          {
+            "value": "option2",
+            "count": 1
+          }
+        ]
+      }
+    ]
+  }
+}
diff --git a/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_three_weeks_second_template.json.golden b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_three_weeks_second_template.json.golden
new file mode 100644
index 0000000000000..d0656f9e9abda
--- /dev/null
+++ b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_three_weeks_second_template.json.golden
@@ -0,0 +1,20 @@
+{
+  "report": {
+    "start_time": "2023-08-01T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000002"
+    ],
+    "users": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000004",
+        "username": "user1",
+        "avatar_url": "",
+        "seconds": 32400
+      }
+    ]
+  }
+}
diff --git a/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_all_templates.json.golden b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_all_templates.json.golden
new file mode 100644
index 0000000000000..90177a0d6dc4a
--- /dev/null
+++ b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_all_templates.json.golden
@@ -0,0 +1,41 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001",
+      "00000000-0000-0000-0000-000000000002",
+      "00000000-0000-0000-0000-000000000003"
+    ],
+    "users": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000004",
+        "username": "user1",
+        "avatar_url": "",
+        "seconds": 30540
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000005",
+        "username": "user2",
+        "avatar_url": "",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000006",
+        "username": "user3",
+        "avatar_url": "",
+        "seconds": 4200
+      }
+    ]
+  }
+}
diff --git a/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_deployment_wide.json.golden b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_deployment_wide.json.golden
new file mode 100644
index 0000000000000..90177a0d6dc4a
--- /dev/null
+++ b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_deployment_wide.json.golden
@@ -0,0 +1,41 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001",
+      "00000000-0000-0000-0000-000000000002",
+      "00000000-0000-0000-0000-000000000003"
+    ],
+    "users": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000004",
+        "username": "user1",
+        "avatar_url": "",
+        "seconds": 30540
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000005",
+        "username": "user2",
+        "avatar_url": "",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000006",
+        "username": "user3",
+        "avatar_url": "",
+        "seconds": 4200
+      }
+    ]
+  }
+}
diff --git a/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_first_template.json.golden b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_first_template.json.golden
new file mode 100644
index 0000000000000..d3e9363babadb
--- /dev/null
+++ b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_first_template.json.golden
@@ -0,0 +1,29 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001"
+    ],
+    "users": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000004",
+        "username": "user1",
+        "avatar_url": "",
+        "seconds": 5340
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000005",
+        "username": "user2",
+        "avatar_url": "",
+        "seconds": 3600
+      }
+    ]
+  }
+}
diff --git "a/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_other_timezone_(S\303\243o_Paulo).json.golden" "b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_other_timezone_(S\303\243o_Paulo).json.golden"
new file mode 100644
index 0000000000000..9c4c934feef18
--- /dev/null
+++ "b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_other_timezone_(S\303\243o_Paulo).json.golden"
@@ -0,0 +1,41 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00-03:00",
+    "end_time": "2023-08-22T00:00:00-03:00",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001",
+      "00000000-0000-0000-0000-000000000002",
+      "00000000-0000-0000-0000-000000000003"
+    ],
+    "users": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000004",
+        "username": "user1",
+        "avatar_url": "",
+        "seconds": 23280
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000005",
+        "username": "user2",
+        "avatar_url": "",
+        "seconds": 3600
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000006",
+        "username": "user3",
+        "avatar_url": "",
+        "seconds": 600
+      }
+    ]
+  }
+}
diff --git a/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_second_template.json.golden b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_second_template.json.golden
new file mode 100644
index 0000000000000..f7e8c0d09eca5
--- /dev/null
+++ b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_second_template.json.golden
@@ -0,0 +1,20 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000002"
+    ],
+    "users": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000004",
+        "username": "user1",
+        "avatar_url": "",
+        "seconds": 25200
+      }
+    ]
+  }
+}
diff --git a/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_third_template.json.golden b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_third_template.json.golden
new file mode 100644
index 0000000000000..065e837723fd3
--- /dev/null
+++ b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_week_third_template.json.golden
@@ -0,0 +1,20 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000003"
+    ],
+    "users": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000006",
+        "username": "user3",
+        "avatar_url": "",
+        "seconds": 4200
+      }
+    ]
+  }
+}
diff --git a/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_weekly_aggregated_deployment_wide.json.golden b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_weekly_aggregated_deployment_wide.json.golden
new file mode 100644
index 0000000000000..458b327c3c392
--- /dev/null
+++ b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_weekly_aggregated_deployment_wide.json.golden
@@ -0,0 +1,41 @@
+{
+  "report": {
+    "start_time": "2023-08-12T00:00:00Z",
+    "end_time": "2023-08-19T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001",
+      "00000000-0000-0000-0000-000000000002",
+      "00000000-0000-0000-0000-000000000003"
+    ],
+    "users": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000004",
+        "username": "user1",
+        "avatar_url": "",
+        "seconds": 29820
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000005",
+        "username": "user2",
+        "avatar_url": "",
+        "seconds": 7200
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000006",
+        "username": "user3",
+        "avatar_url": "",
+        "seconds": 4200
+      }
+    ]
+  }
+}
diff --git a/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_weekly_aggregated_first_template.json.golden b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_weekly_aggregated_first_template.json.golden
new file mode 100644
index 0000000000000..d3e9363babadb
--- /dev/null
+++ b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_weekly_aggregated_first_template.json.golden
@@ -0,0 +1,29 @@
+{
+  "report": {
+    "start_time": "2023-08-15T00:00:00Z",
+    "end_time": "2023-08-22T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001"
+    ],
+    "users": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000004",
+        "username": "user1",
+        "avatar_url": "",
+        "seconds": 5340
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000005",
+        "username": "user2",
+        "avatar_url": "",
+        "seconds": 3600
+      }
+    ]
+  }
+}
diff --git a/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_weekly_aggregated_templates.json.golden b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_weekly_aggregated_templates.json.golden
new file mode 100644
index 0000000000000..b91414092f581
--- /dev/null
+++ b/coderd/testdata/insights/user-activity/multiple_users_and_workspaces_weekly_aggregated_templates.json.golden
@@ -0,0 +1,41 @@
+{
+  "report": {
+    "start_time": "2023-08-14T00:00:00Z",
+    "end_time": "2023-08-21T00:00:00Z",
+    "template_ids": [
+      "00000000-0000-0000-0000-000000000001",
+      "00000000-0000-0000-0000-000000000002",
+      "00000000-0000-0000-0000-000000000003"
+    ],
+    "users": [
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001",
+          "00000000-0000-0000-0000-000000000002"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000004",
+        "username": "user1",
+        "avatar_url": "",
+        "seconds": 29820
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000001"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000005",
+        "username": "user2",
+        "avatar_url": "",
+        "seconds": 7200
+      },
+      {
+        "template_ids": [
+          "00000000-0000-0000-0000-000000000003"
+        ],
+        "user_id": "00000000-0000-0000-0000-000000000006",
+        "username": "user3",
+        "avatar_url": "",
+        "seconds": 4200
+      }
+    ]
+  }
+}
diff --git a/coderd/tracing/exporter.go b/coderd/tracing/exporter.go
index d29de3dea54ef..37b50f09cfa7b 100644
--- a/coderd/tracing/exporter.go
+++ b/coderd/tracing/exporter.go
@@ -8,11 +8,14 @@ import (
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
-	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
 	"go.opentelemetry.io/otel/propagation"
 	"go.opentelemetry.io/otel/sdk/resource"
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
 	semconv "go.opentelemetry.io/otel/semconv/v1.14.0"
+	ddotel "gopkg.in/DataDog/dd-trace-go.v1/ddtrace/opentelemetry"
+	ddtracer "gopkg.in/DataDog/dd-trace-go.v1/ddtrace/tracer"
+	ddprofiler "gopkg.in/DataDog/dd-trace-go.v1/profiler"
+
 	"golang.org/x/xerrors"
 	"google.golang.org/grpc/credentials"
 )
@@ -22,9 +25,8 @@ type TracerOpts struct {
 	// Default exports to a backend configured by environment variables. See:
 	// https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md
 	Default bool
-	// Coder exports traces to Coder's public tracing ingest service and is used
-	// to improve the product. It is disabled when opting out of telemetry.
-	Coder bool
+	// DataDog exports traces and profiles to the local DataDog daemon.
+	DataDog bool
 	// Exports traces to Honeycomb.io with the provided API key.
 	Honeycomb string
 }
@@ -45,6 +47,35 @@ func TracerProvider(ctx context.Context, service string, opts TracerOpts) (*sdkt
 		closers = []func(context.Context) error{}
 	)
 
+	if opts.DataDog {
+		// See more:
+		// https://docs.datadoghq.com/tracing/metrics/runtime_metrics/go/
+		dd := ddotel.NewTracerProvider(ddtracer.WithRuntimeMetrics())
+		closers = append(closers, func(_ context.Context) error {
+			// For some reason, this doesn't appear to actually wind down
+			// the goroutines.
+			return dd.Shutdown()
+		})
+
+		// See https://docs.datadoghq.com/profiler/enabling/go/
+		_ = ddprofiler.Start(
+			ddprofiler.WithService("coderd"),
+			ddprofiler.WithProfileTypes(
+				ddprofiler.CPUProfile,
+				ddprofiler.HeapProfile,
+				ddprofiler.GoroutineProfile,
+
+				// In the future, we may want to enable:
+				// ddprofiler.BlockProfile,
+				// ddprofiler.MutexProfile,
+			),
+		)
+		closers = append(closers, func(_ context.Context) error {
+			ddprofiler.Stop()
+			return nil
+		})
+	}
+
 	if opts.Default {
 		exporter, err := DefaultExporter(ctx)
 		if err != nil {
@@ -53,14 +84,6 @@ func TracerProvider(ctx context.Context, service string, opts TracerOpts) (*sdkt
 		closers = append(closers, exporter.Shutdown)
 		tracerOpts = append(tracerOpts, sdktrace.WithBatcher(exporter))
 	}
-	if opts.Coder {
-		exporter, err := CoderExporter(ctx)
-		if err != nil {
-			return nil, nil, xerrors.Errorf("coder exporter: %w", err)
-		}
-		closers = append(closers, exporter.Shutdown)
-		tracerOpts = append(tracerOpts, sdktrace.WithBatcher(exporter))
-	}
 	if opts.Honeycomb != "" {
 		exporter, err := HoneycombExporter(ctx, opts.Honeycomb)
 		if err != nil {
@@ -112,20 +135,6 @@ func DefaultExporter(ctx context.Context) (*otlptrace.Exporter, error) {
 	return exporter, nil
 }
 
-func CoderExporter(ctx context.Context) (*otlptrace.Exporter, error) {
-	opts := []otlptracehttp.Option{
-		otlptracehttp.WithEndpoint("oss-otel-ingest-http.coder.app:443"),
-		otlptracehttp.WithCompression(otlptracehttp.GzipCompression),
-	}
-
-	exporter, err := otlptrace.New(ctx, otlptracehttp.NewClient(opts...))
-	if err != nil {
-		return nil, xerrors.Errorf("create otlp exporter: %w", err)
-	}
-
-	return exporter, nil
-}
-
 func HoneycombExporter(ctx context.Context, apiKey string) (*otlptrace.Exporter, error) {
 	opts := []otlptracegrpc.Option{
 		otlptracegrpc.WithEndpoint("api.honeycomb.io:443"),
diff --git a/coderd/tracing/httpmw.go b/coderd/tracing/httpmw.go
index 308fbd88a4c26..26b57a1d2213a 100644
--- a/coderd/tracing/httpmw.go
+++ b/coderd/tracing/httpmw.go
@@ -13,7 +13,7 @@ import (
 	"go.opentelemetry.io/otel/semconv/v1.14.0/netconv"
 	"go.opentelemetry.io/otel/trace"
 
-	"github.com/coder/coder/coderd/httpmw/patternmatcher"
+	"github.com/coder/coder/v2/coderd/httpmw/patternmatcher"
 )
 
 // Middleware adds tracing to http routes.
@@ -26,7 +26,7 @@ func Middleware(tracerProvider trace.TracerProvider) func(http.Handler) http.Han
 		"/api/**",
 		"/@*/*/apps/**",
 		"/%40*/*/apps/**",
-		"/gitauth/*/callback",
+		"/external-auth/*/callback",
 	}.MustCompile()
 
 	var tracer trace.Tracer
diff --git a/coderd/tracing/httpmw_test.go b/coderd/tracing/httpmw_test.go
index 052544fdc7ed9..1ee46ddf2e291 100644
--- a/coderd/tracing/httpmw_test.go
+++ b/coderd/tracing/httpmw_test.go
@@ -13,8 +13,8 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/testutil"
 )
 
 type fakeTracer struct {
@@ -59,7 +59,7 @@ func Test_Middleware(t *testing.T) {
 			{"/%40hi/hi/apps/hi", true},
 			{"/%40hi/hi/apps/hi/hi", true},
 			{"/%40hi/hi/apps/hi/hi", true},
-			{"/gitauth/hi/callback", true},
+			{"/external-auth/hi/callback", true},
 
 			// Other routes that should not be collected.
 			{"/index.html", false},
diff --git a/coderd/tracing/slog_test.go b/coderd/tracing/slog_test.go
index 2db0013d20792..5dae380e07c42 100644
--- a/coderd/tracing/slog_test.go
+++ b/coderd/tracing/slog_test.go
@@ -13,7 +13,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 type stringer string
diff --git a/coderd/tracing/status_writer.go b/coderd/tracing/status_writer.go
index 9409c3adf5e69..e9337c20e022f 100644
--- a/coderd/tracing/status_writer.go
+++ b/coderd/tracing/status_writer.go
@@ -12,7 +12,7 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/buildinfo"
+	"github.com/coder/coder/v2/buildinfo"
 )
 
 var (
diff --git a/coderd/tracing/status_writer_test.go b/coderd/tracing/status_writer_test.go
index 4cc3e5507d600..ba19cd29a915c 100644
--- a/coderd/tracing/status_writer_test.go
+++ b/coderd/tracing/status_writer_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 func TestStatusWriter(t *testing.T) {
diff --git a/coderd/tracing/util_test.go b/coderd/tracing/util_test.go
index 1835d5325c415..708218328f01f 100644
--- a/coderd/tracing/util_test.go
+++ b/coderd/tracing/util_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 // t.Parallel affects the result of these tests.
diff --git a/coderd/unhanger/detector.go b/coderd/unhanger/detector.go
index a2dcb56689fb3..9a3440f705ed7 100644
--- a/coderd/unhanger/detector.go
+++ b/coderd/unhanger/detector.go
@@ -13,11 +13,11 @@ import (
 	"github.com/google/uuid"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/provisionersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/provisionersdk"
 )
 
 const (
@@ -239,7 +239,7 @@ func unhangJob(ctx context.Context, log slog.Logger, db database.Store, pub pubs
 		}
 		if job.CompletedAt.Valid {
 			return jobInelligibleError{
-				Err: xerrors.Errorf("job is completed (status %s)", db2sdk.ProvisionerJobStatus(job)),
+				Err: xerrors.Errorf("job is completed (status %s)", job.JobStatus),
 			}
 		}
 		if job.UpdatedAt.After(time.Now().Add(-HungJobDuration)) {
@@ -272,9 +272,14 @@ func unhangJob(ctx context.Context, log slog.Logger, db database.Store, pub pubs
 
 		// Insert the messages into the build log.
 		insertParams := database.InsertProvisionerJobLogsParams{
-			JobID: job.ID,
+			JobID:     job.ID,
+			CreatedAt: nil,
+			Source:    nil,
+			Level:     nil,
+			Stage:     nil,
+			Output:    nil,
 		}
-		now := database.Now()
+		now := dbtime.Now()
 		for i, msg := range HungJobLogMessages {
 			// Set the created at in a way that ensures each message has
 			// a unique timestamp so they will be sorted correctly.
@@ -291,7 +296,7 @@ func unhangJob(ctx context.Context, log slog.Logger, db database.Store, pub pubs
 		lowestLogID = newLogs[0].ID
 
 		// Mark the job as failed.
-		now = database.Now()
+		now = dbtime.Now()
 		err = db.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
 			ID:        job.ID,
 			UpdatedAt: now,
@@ -332,12 +337,10 @@ func unhangJob(ctx context.Context, log slog.Logger, db database.Store, pub pubs
 					return xerrors.Errorf("get previous workspace build: %w", err)
 				}
 				if err == nil {
-					err = db.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
+					err = db.UpdateWorkspaceBuildProvisionerStateByID(ctx, database.UpdateWorkspaceBuildProvisionerStateByIDParams{
 						ID:               build.ID,
-						UpdatedAt:        database.Now(),
+						UpdatedAt:        dbtime.Now(),
 						ProvisionerState: prevBuild.ProvisionerState,
-						Deadline:         time.Time{},
-						MaxDeadline:      time.Time{},
 					})
 					if err != nil {
 						return xerrors.Errorf("update workspace build by id: %w", err)
diff --git a/coderd/unhanger/detector_test.go b/coderd/unhanger/detector_test.go
index 41d2dd26f2a90..99705fb159211 100644
--- a/coderd/unhanger/detector_test.go
+++ b/coderd/unhanger/detector_test.go
@@ -14,12 +14,12 @@ import (
 	"go.uber.org/goleak"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/coderd/unhanger"
-	"github.com/coder/coder/provisionersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/unhanger"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
@@ -67,7 +67,7 @@ func TestDetectorNoHungJobs(t *testing.T) {
 	user := dbgen.User(t, db, database.User{})
 	file := dbgen.File(t, db, database.File{})
 	for i := 0; i < 5; i++ {
-		dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
 			CreatedAt: now.Add(-time.Minute * 5),
 			UpdatedAt: now.Add(-time.Minute * time.Duration(i)),
 			StartedAt: sql.NullTime{
@@ -135,7 +135,7 @@ func TestDetectorHungWorkspaceBuild(t *testing.T) {
 
 		// Previous build.
 		expectedWorkspaceBuildState = []byte(`{"dean":"cool","colin":"also cool"}`)
-		previousWorkspaceBuildJob   = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		previousWorkspaceBuildJob   = dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
 			CreatedAt: twentyMinAgo,
 			UpdatedAt: twentyMinAgo,
 			StartedAt: sql.NullTime{
@@ -163,7 +163,7 @@ func TestDetectorHungWorkspaceBuild(t *testing.T) {
 		})
 
 		// Current build.
-		currentWorkspaceBuildJob = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		currentWorkspaceBuildJob = dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
 			CreatedAt: tenMinAgo,
 			UpdatedAt: sixMinAgo,
 			StartedAt: sql.NullTime{
@@ -256,7 +256,7 @@ func TestDetectorHungWorkspaceBuildNoOverrideState(t *testing.T) {
 		})
 
 		// Previous build.
-		previousWorkspaceBuildJob = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		previousWorkspaceBuildJob = dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
 			CreatedAt: twentyMinAgo,
 			UpdatedAt: twentyMinAgo,
 			StartedAt: sql.NullTime{
@@ -285,7 +285,7 @@ func TestDetectorHungWorkspaceBuildNoOverrideState(t *testing.T) {
 
 		// Current build.
 		expectedWorkspaceBuildState = []byte(`{"dean":"cool","colin":"also cool"}`)
-		currentWorkspaceBuildJob    = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		currentWorkspaceBuildJob    = dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
 			CreatedAt: tenMinAgo,
 			UpdatedAt: sixMinAgo,
 			StartedAt: sql.NullTime{
@@ -379,7 +379,7 @@ func TestDetectorHungWorkspaceBuildNoOverrideStateIfNoExistingBuild(t *testing.T
 
 		// First build.
 		expectedWorkspaceBuildState = []byte(`{"dean":"cool","colin":"also cool"}`)
-		currentWorkspaceBuildJob    = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		currentWorkspaceBuildJob    = dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
 			CreatedAt: tenMinAgo,
 			UpdatedAt: sixMinAgo,
 			StartedAt: sql.NullTime{
@@ -454,7 +454,7 @@ func TestDetectorHungOtherJobTypes(t *testing.T) {
 		file      = dbgen.File(t, db, database.File{})
 
 		// Template import job.
-		templateImportJob = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		templateImportJob = dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
 			CreatedAt: tenMinAgo,
 			UpdatedAt: sixMinAgo,
 			StartedAt: sql.NullTime{
@@ -471,7 +471,7 @@ func TestDetectorHungOtherJobTypes(t *testing.T) {
 		})
 
 		// Template dry-run job.
-		templateDryRunJob = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		templateDryRunJob = dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
 			CreatedAt: tenMinAgo,
 			UpdatedAt: sixMinAgo,
 			StartedAt: sql.NullTime{
@@ -545,7 +545,7 @@ func TestDetectorHungCanceledJob(t *testing.T) {
 		file      = dbgen.File(t, db, database.File{})
 
 		// Template import job.
-		templateImportJob = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		templateImportJob = dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
 			CreatedAt: tenMinAgo,
 			CanceledAt: sql.NullTime{
 				Time:  tenMinAgo,
@@ -642,7 +642,7 @@ func TestDetectorPushesLogs(t *testing.T) {
 				file      = dbgen.File(t, db, database.File{})
 
 				// Template import job.
-				templateImportJob = dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+				templateImportJob = dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
 					CreatedAt: tenMinAgo,
 					UpdatedAt: sixMinAgo,
 					StartedAt: sql.NullTime{
@@ -752,7 +752,7 @@ func TestDetectorMaxJobsPerRun(t *testing.T) {
 	// Create unhanger.MaxJobsPerRun + 1 hung jobs.
 	now := time.Now()
 	for i := 0; i < unhanger.MaxJobsPerRun+1; i++ {
-		dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+		dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
 			CreatedAt: now.Add(-time.Hour),
 			UpdatedAt: now.Add(-time.Hour),
 			StartedAt: sql.NullTime{
diff --git a/coderd/updatecheck.go b/coderd/updatecheck.go
index 882a5e6f4b5a2..4e4b07683ecf1 100644
--- a/coderd/updatecheck.go
+++ b/coderd/updatecheck.go
@@ -8,9 +8,9 @@ import (
 	"golang.org/x/mod/semver"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // @Summary Update check
diff --git a/coderd/updatecheck/updatecheck.go b/coderd/updatecheck/updatecheck.go
index 5f180dd196de9..de14071a903b6 100644
--- a/coderd/updatecheck/updatecheck.go
+++ b/coderd/updatecheck/updatecheck.go
@@ -19,8 +19,8 @@ import (
 
 	"cdr.dev/slog"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
 )
 
 const (
diff --git a/coderd/updatecheck/updatecheck_test.go b/coderd/updatecheck/updatecheck_test.go
index d414d8c72af10..afc0f57cbdd41 100644
--- a/coderd/updatecheck/updatecheck_test.go
+++ b/coderd/updatecheck/updatecheck_test.go
@@ -14,9 +14,9 @@ import (
 
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/updatecheck"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/updatecheck"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestChecker_Notify(t *testing.T) {
@@ -49,7 +49,7 @@ func TestChecker_Notify(t *testing.T) {
 	}))
 	defer srv.Close()
 
-	db := dbfake.New()
+	db := dbmem.New()
 	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Named(t.Name())
 	notify := make(chan updatecheck.Result, len(wantVersion))
 	c := updatecheck.New(db, logger, updatecheck.Options{
@@ -131,7 +131,7 @@ func TestChecker_Latest(t *testing.T) {
 			}))
 			defer srv.Close()
 
-			db := dbfake.New()
+			db := dbmem.New()
 			logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Named(t.Name())
 			c := updatecheck.New(db, logger, updatecheck.Options{
 				URL: srv.URL,
diff --git a/coderd/updatecheck_test.go b/coderd/updatecheck_test.go
index 24dd8eba59ab3..c81dc0821a152 100644
--- a/coderd/updatecheck_test.go
+++ b/coderd/updatecheck_test.go
@@ -10,11 +10,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/updatecheck"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/updatecheck"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestUpdateCheck_NewVersion(t *testing.T) {
diff --git a/coderd/userauth.go b/coderd/userauth.go
index 9b6ba7992bad5..419a88b1b1f71 100644
--- a/coderd/userauth.go
+++ b/coderd/userauth.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/mail"
+	"regexp"
 	"sort"
 	"strconv"
 	"strings"
@@ -22,17 +23,18 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/apikey"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/userpassword"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/site"
+	"github.com/coder/coder/v2/coderd/apikey"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/userpassword"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/site"
 )
 
 const (
@@ -183,7 +185,9 @@ func (api *API) postConvertLoginType(rw http.ResponseWriter, r *http.Request) {
 		Expires:  claims.ExpiresAt.Time,
 		Secure:   api.SecureAuthCookie,
 		HttpOnly: true,
-		SameSite: http.SameSiteStrictMode,
+		// Must be SameSite to work on the redirected auth flow from the
+		// oauth provider.
+		SameSite: http.SameSiteLaxMode,
 	})
 	httpapi.Write(ctx, rw, http.StatusCreated, codersdk.OAuthConversionResponse{
 		StateString: stateString,
@@ -325,7 +329,7 @@ func (api *API) loginRequest(ctx context.Context, rw http.ResponseWriter, req co
 		user, err = api.Database.UpdateUserStatus(dbauthz.AsSystemRestricted(ctx), database.UpdateUserStatusParams{
 			ID:        user.ID,
 			Status:    database.UserStatusActive,
-			UpdatedAt: database.Now(),
+			UpdatedAt: dbtime.Now(),
 		})
 		if err != nil {
 			logger.Error(ctx, "unable to update user status to active", slog.Error(err))
@@ -688,6 +692,13 @@ type OIDCConfig struct {
 	// groups. If the group field is the empty string, then no group updates
 	// will ever come from the OIDC provider.
 	GroupField string
+	// CreateMissingGroups controls whether groups returned by the OIDC provider
+	// are automatically created in Coder if they are missing.
+	CreateMissingGroups bool
+	// GroupFilter is a regular expression that filters the groups returned by
+	// the OIDC provider. Any group not matched by this regex will be ignored.
+	// If the group filter is nil, then no group filtering will occur.
+	GroupFilter *regexp.Regexp
 	// GroupMapping controls how groups returned by the OIDC provider get mapped
 	// to groups within Coder.
 	// map[oidcGroupName]coderGroupName
@@ -1029,19 +1040,21 @@ func (api *API) userOIDC(rw http.ResponseWriter, r *http.Request) {
 	}
 
 	params := (&oauthLoginParams{
-		User:         user,
-		Link:         link,
-		State:        state,
-		LinkedID:     oidcLinkedID(idToken),
-		LoginType:    database.LoginTypeOIDC,
-		AllowSignups: api.OIDCConfig.AllowSignups,
-		Email:        email,
-		Username:     username,
-		AvatarURL:    picture,
-		UsingGroups:  usingGroups,
-		UsingRoles:   api.OIDCConfig.RoleSyncEnabled(),
-		Roles:        roles,
-		Groups:       groups,
+		User:                user,
+		Link:                link,
+		State:               state,
+		LinkedID:            oidcLinkedID(idToken),
+		LoginType:           database.LoginTypeOIDC,
+		AllowSignups:        api.OIDCConfig.AllowSignups,
+		Email:               email,
+		Username:            username,
+		AvatarURL:           picture,
+		UsingGroups:         usingGroups,
+		UsingRoles:          api.OIDCConfig.RoleSyncEnabled(),
+		Roles:               roles,
+		Groups:              groups,
+		CreateMissingGroups: api.OIDCConfig.CreateMissingGroups,
+		GroupFilter:         api.OIDCConfig.GroupFilter,
 	}).SetInitAuditRequest(func(params *audit.RequestParams) (*audit.Request[database.User], func()) {
 		return audit.InitRequest[database.User](rw, params)
 	})
@@ -1125,8 +1138,10 @@ type oauthLoginParams struct {
 	AvatarURL    string
 	// Is UsingGroups is true, then the user will be assigned
 	// to the Groups provided.
-	UsingGroups bool
-	Groups      []string
+	UsingGroups         bool
+	CreateMissingGroups bool
+	Groups              []string
+	GroupFilter         *regexp.Regexp
 	// Is UsingRoles is true, then the user will be assigned
 	// the roles provided.
 	UsingRoles bool
@@ -1303,7 +1318,7 @@ func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.C
 			user, err = tx.UpdateUserStatus(dbauthz.AsSystemRestricted(ctx), database.UpdateUserStatusParams{
 				ID:        user.ID,
 				Status:    database.UserStatusActive,
-				UpdatedAt: database.Now(),
+				UpdatedAt: dbtime.Now(),
 			})
 			if err != nil {
 				logger.Error(ctx, "unable to update user status to active", slog.Error(err))
@@ -1312,14 +1327,16 @@ func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.C
 		}
 
 		if link.UserID == uuid.Nil {
-			//nolint:gocritic
+			//nolint:gocritic // System needs to insert the user link (linked_id, oauth_token, oauth_expiry).
 			link, err = tx.InsertUserLink(dbauthz.AsSystemRestricted(ctx), database.InsertUserLinkParams{
-				UserID:            user.ID,
-				LoginType:         params.LoginType,
-				LinkedID:          params.LinkedID,
-				OAuthAccessToken:  params.State.Token.AccessToken,
-				OAuthRefreshToken: params.State.Token.RefreshToken,
-				OAuthExpiry:       params.State.Token.Expiry,
+				UserID:                 user.ID,
+				LoginType:              params.LoginType,
+				LinkedID:               params.LinkedID,
+				OAuthAccessToken:       params.State.Token.AccessToken,
+				OAuthAccessTokenKeyID:  sql.NullString{}, // set by dbcrypt if required
+				OAuthRefreshToken:      params.State.Token.RefreshToken,
+				OAuthRefreshTokenKeyID: sql.NullString{}, // set by dbcrypt if required
+				OAuthExpiry:            params.State.Token.Expiry,
 			})
 			if err != nil {
 				return xerrors.Errorf("insert user link: %w", err)
@@ -1327,13 +1344,15 @@ func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.C
 		}
 
 		if link.UserID != uuid.Nil {
-			//nolint:gocritic
+			//nolint:gocritic // System needs to update the user link (linked_id, oauth_token, oauth_expiry).
 			link, err = tx.UpdateUserLink(dbauthz.AsSystemRestricted(ctx), database.UpdateUserLinkParams{
-				UserID:            user.ID,
-				LoginType:         params.LoginType,
-				OAuthAccessToken:  params.State.Token.AccessToken,
-				OAuthRefreshToken: params.State.Token.RefreshToken,
-				OAuthExpiry:       params.State.Token.Expiry,
+				UserID:                 user.ID,
+				LoginType:              params.LoginType,
+				OAuthAccessToken:       params.State.Token.AccessToken,
+				OAuthAccessTokenKeyID:  sql.NullString{}, // set by dbcrypt if required
+				OAuthRefreshToken:      params.State.Token.RefreshToken,
+				OAuthRefreshTokenKeyID: sql.NullString{}, // set by dbcrypt if required
+				OAuthExpiry:            params.State.Token.Expiry,
 			})
 			if err != nil {
 				return xerrors.Errorf("update user link: %w", err)
@@ -1342,8 +1361,18 @@ func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.C
 
 		// Ensure groups are correct.
 		if params.UsingGroups {
+			filtered := params.Groups
+			if params.GroupFilter != nil {
+				filtered = make([]string, 0, len(params.Groups))
+				for _, group := range params.Groups {
+					if params.GroupFilter.MatchString(group) {
+						filtered = append(filtered, group)
+					}
+				}
+			}
+
 			//nolint:gocritic
-			err := api.Options.SetUserGroups(dbauthz.AsSystemRestricted(ctx), tx, user.ID, params.Groups)
+			err := api.Options.SetUserGroups(dbauthz.AsSystemRestricted(ctx), logger, tx, user.ID, filtered, params.CreateMissingGroups)
 			if err != nil {
 				return xerrors.Errorf("set user groups: %w", err)
 			}
@@ -1362,7 +1391,7 @@ func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.C
 			}
 
 			//nolint:gocritic
-			err := api.Options.SetUserSiteRoles(dbauthz.AsSystemRestricted(ctx), tx, user.ID, filtered)
+			err := api.Options.SetUserSiteRoles(dbauthz.AsSystemRestricted(ctx), logger, tx, user.ID, filtered)
 			if err != nil {
 				return httpError{
 					code:             http.StatusBadRequest,
@@ -1412,7 +1441,7 @@ func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.C
 				ID:        user.ID,
 				Email:     user.Email,
 				Username:  user.Username,
-				UpdatedAt: database.Now(),
+				UpdatedAt: dbtime.Now(),
 				AvatarURL: user.AvatarURL,
 			})
 			if err != nil {
@@ -1427,7 +1456,8 @@ func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.C
 	}
 
 	var key database.APIKey
-	if oldKey, ok := httpmw.APIKeyOptional(r); ok && isConvertLoginType {
+	oldKey, _, ok := httpmw.APIKeyFromRequest(ctx, api.Database, nil, r)
+	if ok && oldKey != nil && isConvertLoginType {
 		// If this is a convert login type, and it succeeds, then delete the old
 		// session. Force the user to log back in.
 		err := api.Database.DeleteAPIKeyByID(r.Context(), oldKey.ID)
@@ -1447,7 +1477,9 @@ func (api *API) oauthLogin(r *http.Request, params *oauthLoginParams) ([]*http.C
 			Secure:   api.SecureAuthCookie,
 			HttpOnly: true,
 		})
-		key = oldKey
+		// This is intentional setting the key to the deleted old key,
+		// as the user needs to be forced to log back in.
+		key = *oldKey
 	} else {
 		//nolint:gocritic
 		cookie, newKey, err := api.createAPIKey(dbauthz.AsSystemRestricted(ctx), apikey.CreateParams{
@@ -1648,7 +1680,7 @@ func clearOAuthConvertCookie() *http.Cookie {
 func wrongLoginTypeHTTPError(user database.LoginType, params database.LoginType) httpError {
 	addedMsg := ""
 	if user == database.LoginTypePassword {
-		addedMsg = " Try logging in with your password."
+		addedMsg = " You can convert your account to use this login type by visiting your account settings."
 	}
 	return httpError{
 		code:             http.StatusForbidden,
diff --git a/coderd/userauth_test.go b/coderd/userauth_test.go
index 6f49222ff8764..fe6ded1e901b1 100644
--- a/coderd/userauth_test.go
+++ b/coderd/userauth_test.go
@@ -4,32 +4,72 @@ import (
 	"context"
 	"crypto"
 	"fmt"
-	"io"
 	"net/http"
 	"net/http/cookiejar"
+	"net/url"
 	"strings"
 	"testing"
 
 	"github.com/coreos/go-oidc/v3/oidc"
-	"github.com/golang-jwt/jwt"
+	"github.com/golang-jwt/jwt/v4"
 	"github.com/google/go-github/v43/github"
 	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/oauth2"
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/coderdtest/oidctest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
+// This test specifically tests logging in with OIDC when an expired
+// OIDC session token exists.
+// The token refreshing should not happen since we are reauthenticating.
+// nolint:bodyclose
+func TestOIDCOauthLoginWithExisting(t *testing.T) {
+	t.Parallel()
+
+	fake := oidctest.NewFakeIDP(t,
+		oidctest.WithRefresh(func(_ string) error {
+			return xerrors.New("refreshing token should never occur")
+		}),
+		oidctest.WithServing(),
+	)
+
+	cfg := fake.OIDCConfig(t, nil, func(cfg *coderd.OIDCConfig) {
+		cfg.AllowSignups = true
+		cfg.IgnoreUserInfo = true
+	})
+
+	client, _, api := coderdtest.NewWithAPI(t, &coderdtest.Options{
+		OIDCConfig: cfg,
+	})
+
+	const username = "alice"
+	claims := jwt.MapClaims{
+		"email":              "alice@coder.com",
+		"email_verified":     true,
+		"preferred_username": username,
+	}
+
+	helper := oidctest.NewLoginHelper(client, fake)
+	// Signup alice
+	userClient, _ := helper.Login(t, claims)
+
+	// Expire the link. This will force the client to refresh the token.
+	helper.ExpireOauthToken(t, api.Database, userClient)
+
+	// Instead of refreshing, just log in again.
+	helper.Login(t, claims)
+}
+
 func TestUserLogin(t *testing.T) {
 	t.Parallel()
 	t.Run("OK", func(t *testing.T) {
@@ -59,7 +99,7 @@ func TestUserLogin(t *testing.T) {
 		require.Equal(t, http.StatusUnauthorized, apiErr.StatusCode())
 	})
 	// Password auth should fail if the user is made without password login.
-	t.Run("LoginTypeNone", func(t *testing.T) {
+	t.Run("DisableLoginDeprecatedField", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
 		user := coderdtest.CreateFirstUser(t, client)
@@ -74,6 +114,22 @@ func TestUserLogin(t *testing.T) {
 		})
 		require.Error(t, err)
 	})
+
+	t.Run("LoginTypeNone", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, nil)
+		user := coderdtest.CreateFirstUser(t, client)
+		anotherClient, anotherUser := coderdtest.CreateAnotherUserMutators(t, client, user.OrganizationID, nil, func(r *codersdk.CreateUserRequest) {
+			r.Password = ""
+			r.UserLoginType = codersdk.LoginTypeNone
+		})
+
+		_, err := anotherClient.LoginWithPassword(context.Background(), codersdk.LoginWithPasswordRequest{
+			Email:    anotherUser.Email,
+			Password: "SomeSecurePassword!",
+		})
+		require.Error(t, err)
+	})
 }
 
 func TestUserAuthMethods(t *testing.T) {
@@ -558,7 +614,7 @@ func TestUserOIDC(t *testing.T) {
 			"email": "kyle@kwc.io",
 		},
 		AllowSignups: true,
-		StatusCode:   http.StatusTemporaryRedirect,
+		StatusCode:   http.StatusOK,
 		Username:     "kyle",
 	}, {
 		Name: "EmailNotVerified",
@@ -583,7 +639,7 @@ func TestUserOIDC(t *testing.T) {
 			"email_verified": false,
 		},
 		AllowSignups:        true,
-		StatusCode:          http.StatusTemporaryRedirect,
+		StatusCode:          http.StatusOK,
 		Username:            "kyle",
 		IgnoreEmailVerified: true,
 	}, {
@@ -607,7 +663,7 @@ func TestUserOIDC(t *testing.T) {
 		EmailDomain: []string{
 			"kwc.io",
 		},
-		StatusCode: http.StatusTemporaryRedirect,
+		StatusCode: http.StatusOK,
 	}, {
 		Name:          "EmptyClaims",
 		IDTokenClaims: jwt.MapClaims{},
@@ -628,7 +684,7 @@ func TestUserOIDC(t *testing.T) {
 		},
 		Username:     "kyle",
 		AllowSignups: true,
-		StatusCode:   http.StatusTemporaryRedirect,
+		StatusCode:   http.StatusOK,
 	}, {
 		Name: "UsernameFromClaims",
 		IDTokenClaims: jwt.MapClaims{
@@ -638,7 +694,7 @@ func TestUserOIDC(t *testing.T) {
 		},
 		Username:     "hotdog",
 		AllowSignups: true,
-		StatusCode:   http.StatusTemporaryRedirect,
+		StatusCode:   http.StatusOK,
 	}, {
 		// Services like Okta return the email as the username:
 		// https://developer.okta.com/docs/reference/api/oidc/#base-claims-always-present
@@ -650,7 +706,7 @@ func TestUserOIDC(t *testing.T) {
 		},
 		Username:     "kyle",
 		AllowSignups: true,
-		StatusCode:   http.StatusTemporaryRedirect,
+		StatusCode:   http.StatusOK,
 	}, {
 		// See: https://github.com/coder/coder/issues/4472
 		Name: "UsernameIsEmail",
@@ -659,7 +715,7 @@ func TestUserOIDC(t *testing.T) {
 		},
 		Username:     "kyle",
 		AllowSignups: true,
-		StatusCode:   http.StatusTemporaryRedirect,
+		StatusCode:   http.StatusOK,
 	}, {
 		Name: "WithPicture",
 		IDTokenClaims: jwt.MapClaims{
@@ -671,7 +727,7 @@ func TestUserOIDC(t *testing.T) {
 		Username:     "kyle",
 		AllowSignups: true,
 		AvatarURL:    "/example.png",
-		StatusCode:   http.StatusTemporaryRedirect,
+		StatusCode:   http.StatusOK,
 	}, {
 		Name: "WithUserInfoClaims",
 		IDTokenClaims: jwt.MapClaims{
@@ -685,7 +741,7 @@ func TestUserOIDC(t *testing.T) {
 		Username:     "potato",
 		AllowSignups: true,
 		AvatarURL:    "/example.png",
-		StatusCode:   http.StatusTemporaryRedirect,
+		StatusCode:   http.StatusOK,
 	}, {
 		Name: "GroupsDoesNothing",
 		IDTokenClaims: jwt.MapClaims{
@@ -693,7 +749,7 @@ func TestUserOIDC(t *testing.T) {
 			"groups": []string{"pingpong"},
 		},
 		AllowSignups: true,
-		StatusCode:   http.StatusTemporaryRedirect,
+		StatusCode:   http.StatusOK,
 	}, {
 		Name: "UserInfoOverridesIDTokenClaims",
 		IDTokenClaims: jwt.MapClaims{
@@ -708,7 +764,7 @@ func TestUserOIDC(t *testing.T) {
 		Username:            "user",
 		AllowSignups:        true,
 		IgnoreEmailVerified: false,
-		StatusCode:          http.StatusTemporaryRedirect,
+		StatusCode:          http.StatusOK,
 	}, {
 		Name: "InvalidUserInfo",
 		IDTokenClaims: jwt.MapClaims{
@@ -735,36 +791,41 @@ func TestUserOIDC(t *testing.T) {
 		Username:       "user",
 		IgnoreUserInfo: true,
 		AllowSignups:   true,
-		StatusCode:     http.StatusTemporaryRedirect,
+		StatusCode:     http.StatusOK,
 	}} {
 		tc := tc
 		t.Run(tc.Name, func(t *testing.T) {
 			t.Parallel()
-			auditor := audit.NewMock()
-			conf := coderdtest.NewOIDCConfig(t, "")
-
-			config := conf.OIDCConfig(t, tc.UserInfoClaims)
-			config.AllowSignups = tc.AllowSignups
-			config.EmailDomain = tc.EmailDomain
-			config.IgnoreEmailVerified = tc.IgnoreEmailVerified
-			config.IgnoreUserInfo = tc.IgnoreUserInfo
+			fake := oidctest.NewFakeIDP(t,
+				oidctest.WithRefresh(func(_ string) error {
+					return xerrors.New("refreshing token should never occur")
+				}),
+				oidctest.WithServing(),
+				oidctest.WithStaticUserInfo(tc.UserInfoClaims),
+			)
+			cfg := fake.OIDCConfig(t, nil, func(cfg *coderd.OIDCConfig) {
+				cfg.AllowSignups = tc.AllowSignups
+				cfg.EmailDomain = tc.EmailDomain
+				cfg.IgnoreEmailVerified = tc.IgnoreEmailVerified
+				cfg.IgnoreUserInfo = tc.IgnoreUserInfo
+			})
 
+			auditor := audit.NewMock()
 			logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
-			client := coderdtest.New(t, &coderdtest.Options{
+			owner := coderdtest.New(t, &coderdtest.Options{
 				Auditor:    auditor,
-				OIDCConfig: config,
+				OIDCConfig: cfg,
 				Logger:     &logger,
 			})
 			numLogs := len(auditor.AuditLogs())
 
-			resp := oidcCallback(t, client, conf.EncodeClaims(t, tc.IDTokenClaims))
+			client, resp := fake.AttemptLogin(t, owner, tc.IDTokenClaims)
 			numLogs++ // add an audit log for login
-			assert.Equal(t, tc.StatusCode, resp.StatusCode)
+			require.Equal(t, tc.StatusCode, resp.StatusCode)
 
 			ctx := testutil.Context(t, testutil.WaitLong)
 
 			if tc.Username != "" {
-				client.SetSessionToken(authCookieValue(resp.Cookies()))
 				user, err := client.User(ctx, "me")
 				require.NoError(t, err)
 				require.Equal(t, tc.Username, user.Username)
@@ -775,7 +836,6 @@ func TestUserOIDC(t *testing.T) {
 			}
 
 			if tc.AvatarURL != "" {
-				client.SetSessionToken(authCookieValue(resp.Cookies()))
 				user, err := client.User(ctx, "me")
 				require.NoError(t, err)
 				require.Equal(t, tc.AvatarURL, user.AvatarURL)
@@ -788,26 +848,29 @@ func TestUserOIDC(t *testing.T) {
 
 	t.Run("OIDCConvert", func(t *testing.T) {
 		t.Parallel()
-		auditor := audit.NewMock()
-		conf := coderdtest.NewOIDCConfig(t, "")
 
-		config := conf.OIDCConfig(t, nil)
-		config.AllowSignups = true
+		auditor := audit.NewMock()
+		fake := oidctest.NewFakeIDP(t,
+			oidctest.WithRefresh(func(_ string) error {
+				return xerrors.New("refreshing token should never occur")
+			}),
+			oidctest.WithServing(),
+		)
+		cfg := fake.OIDCConfig(t, nil, func(cfg *coderd.OIDCConfig) {
+			cfg.AllowSignups = true
+		})
 
-		cfg := coderdtest.DeploymentValues(t)
 		client := coderdtest.New(t, &coderdtest.Options{
-			Auditor:          auditor,
-			OIDCConfig:       config,
-			DeploymentValues: cfg,
+			Auditor:    auditor,
+			OIDCConfig: cfg,
 		})
-		owner := coderdtest.CreateFirstUser(t, client)
 
+		owner := coderdtest.CreateFirstUser(t, client)
 		user, userData := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
-		code := conf.EncodeClaims(t, jwt.MapClaims{
+		claims := jwt.MapClaims{
 			"email": userData.Email,
-		})
-
+		}
 		var err error
 		user.HTTPClient.Jar, err = cookiejar.New(nil)
 		require.NoError(t, err)
@@ -819,52 +882,58 @@ func TestUserOIDC(t *testing.T) {
 		})
 		require.NoError(t, err)
 
-		resp := oidcCallbackWithState(t, user, code, convertResponse.StateString)
-		require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
+		fake.LoginWithClient(t, user, claims, func(r *http.Request) {
+			r.URL.RawQuery = url.Values{
+				"oidc_merge_state": {convertResponse.StateString},
+			}.Encode()
+			r.Header.Set(codersdk.SessionTokenHeader, user.SessionToken())
+			cookies := user.HTTPClient.Jar.Cookies(r.URL)
+			for _, cookie := range cookies {
+				r.AddCookie(cookie)
+			}
+		})
 	})
 
 	t.Run("AlternateUsername", func(t *testing.T) {
 		t.Parallel()
 		auditor := audit.NewMock()
-		conf := coderdtest.NewOIDCConfig(t, "")
-
-		config := conf.OIDCConfig(t, nil)
-		config.AllowSignups = true
+		fake := oidctest.NewFakeIDP(t,
+			oidctest.WithRefresh(func(_ string) error {
+				return xerrors.New("refreshing token should never occur")
+			}),
+			oidctest.WithServing(),
+		)
+		cfg := fake.OIDCConfig(t, nil, func(cfg *coderd.OIDCConfig) {
+			cfg.AllowSignups = true
+		})
 
 		client := coderdtest.New(t, &coderdtest.Options{
 			Auditor:    auditor,
-			OIDCConfig: config,
+			OIDCConfig: cfg,
 		})
-		numLogs := len(auditor.AuditLogs())
 
-		code := conf.EncodeClaims(t, jwt.MapClaims{
+		numLogs := len(auditor.AuditLogs())
+		claims := jwt.MapClaims{
 			"email": "jon@coder.com",
-		})
-		resp := oidcCallback(t, client, code)
-		numLogs++ // add an audit log for login
+		}
 
-		assert.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
+		userClient, _ := fake.Login(t, client, claims)
+		numLogs++ // add an audit log for login
 
 		ctx := testutil.Context(t, testutil.WaitLong)
-
-		client.SetSessionToken(authCookieValue(resp.Cookies()))
-		user, err := client.User(ctx, "me")
+		user, err := userClient.User(ctx, "me")
 		require.NoError(t, err)
 		require.Equal(t, "jon", user.Username)
 
 		// Pass a different subject field so that we prompt creating a
-		// new user.
-		code = conf.EncodeClaims(t, jwt.MapClaims{
+		// new user
+		userClient, _ = fake.Login(t, client, jwt.MapClaims{
 			"email": "jon@example2.com",
 			"sub":   "diff",
 		})
-		resp = oidcCallback(t, client, code)
 		numLogs++ // add an audit log for login
 
-		assert.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
-
-		client.SetSessionToken(authCookieValue(resp.Cookies()))
-		user, err = client.User(ctx, "me")
+		user, err = userClient.User(ctx, "me")
 		require.NoError(t, err)
 		require.True(t, strings.HasPrefix(user.Username, "jon-"), "username %q should have prefix %q", user.Username, "jon-")
 
@@ -875,45 +944,62 @@ func TestUserOIDC(t *testing.T) {
 	t.Run("Disabled", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
-		resp := oidcCallback(t, client, "asdf")
+		oauthURL, err := client.URL.Parse("/api/v2/users/oidc/callback")
+		require.NoError(t, err)
+
+		req, err := http.NewRequestWithContext(context.Background(), "GET", oauthURL.String(), nil)
+		require.NoError(t, err)
+		resp, err := client.HTTPClient.Do(req)
+		require.NoError(t, err)
+		resp.Body.Close()
+
 		require.Equal(t, http.StatusBadRequest, resp.StatusCode)
 	})
 
 	t.Run("NoIDToken", func(t *testing.T) {
 		t.Parallel()
+		fake := oidctest.NewFakeIDP(t,
+			oidctest.WithRefresh(func(_ string) error {
+				return xerrors.New("refreshing token should never occur")
+			}),
+			oidctest.WithServing(),
+		)
+		cfg := fake.OIDCConfig(t, nil, func(cfg *coderd.OIDCConfig) {
+			cfg.AllowSignups = true
+		})
+
 		client := coderdtest.New(t, &coderdtest.Options{
-			OIDCConfig: &coderd.OIDCConfig{
-				OAuth2Config: &testutil.OAuth2Config{},
-			},
+			OIDCConfig: cfg,
 		})
 
-		resp := oidcCallback(t, client, "asdf")
+		_, resp := fake.AttemptLogin(t, client, jwt.MapClaims{})
 		require.Equal(t, http.StatusBadRequest, resp.StatusCode)
 	})
 
 	t.Run("BadVerify", func(t *testing.T) {
 		t.Parallel()
-		verifier := oidc.NewVerifier("", &oidc.StaticKeySet{
+		badVerifier := oidc.NewVerifier("", &oidc.StaticKeySet{
 			PublicKeys: []crypto.PublicKey{},
 		}, &oidc.Config{})
-		provider := &oidc.Provider{}
+		badProvider := &oidc.Provider{}
+
+		fake := oidctest.NewFakeIDP(t,
+			oidctest.WithRefresh(func(_ string) error {
+				return xerrors.New("refreshing token should never occur")
+			}),
+			oidctest.WithServing(),
+		)
+		cfg := fake.OIDCConfig(t, nil, func(cfg *coderd.OIDCConfig) {
+			cfg.AllowSignups = true
+			cfg.Provider = badProvider
+			cfg.Verifier = badVerifier
+		})
 
 		client := coderdtest.New(t, &coderdtest.Options{
-			OIDCConfig: &coderd.OIDCConfig{
-				OAuth2Config: &testutil.OAuth2Config{
-					Token: (&oauth2.Token{
-						AccessToken: "token",
-					}).WithExtra(map[string]interface{}{
-						"id_token": "invalid",
-					}),
-				},
-				Provider: provider,
-				Verifier: verifier,
-			},
+			OIDCConfig: cfg,
 		})
 
-		resp := oidcCallback(t, client, "asdf")
-
+		_, resp := fake.AttemptLogin(t, client, jwt.MapClaims{})
 		require.Equal(t, http.StatusBadRequest, resp.StatusCode)
 	})
 }
@@ -1044,33 +1130,6 @@ func oauth2Callback(t *testing.T, client *codersdk.Client) *http.Response {
 	return res
 }
 
-func oidcCallback(t *testing.T, client *codersdk.Client, code string) *http.Response {
-	return oidcCallbackWithState(t, client, code, "somestate")
-}
-
-func oidcCallbackWithState(t *testing.T, client *codersdk.Client, code, state string) *http.Response {
-	t.Helper()
-
-	client.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
-		return http.ErrUseLastResponse
-	}
-	oauthURL, err := client.URL.Parse(fmt.Sprintf("/api/v2/users/oidc/callback?code=%s&state=%s", code, state))
-	require.NoError(t, err)
-	req, err := http.NewRequestWithContext(context.Background(), "GET", oauthURL.String(), nil)
-	require.NoError(t, err)
-	req.AddCookie(&http.Cookie{
-		Name:  codersdk.OAuth2StateCookie,
-		Value: state,
-	})
-	res, err := client.HTTPClient.Do(req)
-	require.NoError(t, err)
-	defer res.Body.Close()
-	data, err := io.ReadAll(res.Body)
-	require.NoError(t, err)
-	t.Log(string(data))
-	return res
-}
-
 func i64ptr(i int64) *int64 {
 	return &i
 }
diff --git a/coderd/userpassword/hashing_bench_test.go b/coderd/userpassword/hashing_bench_test.go
index 109a1724cbf06..7b1d8cb7e9449 100644
--- a/coderd/userpassword/hashing_bench_test.go
+++ b/coderd/userpassword/hashing_bench_test.go
@@ -7,7 +7,7 @@ import (
 	"golang.org/x/crypto/bcrypt"
 	"golang.org/x/crypto/pbkdf2"
 
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 var (
diff --git a/coderd/userpassword/userpassword_test.go b/coderd/userpassword/userpassword_test.go
index 6976a94e1c0a6..1617748d5ada1 100644
--- a/coderd/userpassword/userpassword_test.go
+++ b/coderd/userpassword/userpassword_test.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/userpassword"
+	"github.com/coder/coder/v2/coderd/userpassword"
 )
 
 func TestUserPassword(t *testing.T) {
diff --git a/coderd/users.go b/coderd/users.go
index 017e20d408586..9fa71c05633ea 100644
--- a/coderd/users.go
+++ b/coderd/users.go
@@ -12,19 +12,20 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/gitsshkey"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/searchquery"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/coderd/userpassword"
-	"github.com/coder/coder/coderd/util/slice"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/gitsshkey"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/searchquery"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/coderd/userpassword"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // Returns whether the initial user has been created or not.
@@ -287,11 +288,27 @@ func (api *API) postUser(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if req.UserLoginType == "" && req.DisableLogin {
+		// Handle the deprecated field
+		req.UserLoginType = codersdk.LoginTypeNone
+	}
+	if req.UserLoginType == "" {
+		// Default to password auth
+		req.UserLoginType = codersdk.LoginTypePassword
+	}
+
+	if req.UserLoginType != codersdk.LoginTypePassword && req.Password != "" {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: fmt.Sprintf("Password cannot be set for non-password (%q) authentication.", req.UserLoginType),
+		})
+		return
+	}
+
 	// If password auth is disabled, don't allow new users to be
 	// created with a password!
-	if api.DeploymentValues.DisablePasswordAuth {
+	if api.DeploymentValues.DisablePasswordAuth && req.UserLoginType == codersdk.LoginTypePassword {
 		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
-			Message: "You cannot manually provision new users with password authentication disabled!",
+			Message: "Password based authentication is disabled! Unable to provision new users with password authentication.",
 		})
 		return
 	}
@@ -353,17 +370,11 @@ func (api *API) postUser(rw http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	if req.DisableLogin && req.Password != "" {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "Cannot set password when disabling login.",
-		})
-		return
-	}
-
 	var loginType database.LoginType
-	if req.DisableLogin {
+	switch req.UserLoginType {
+	case codersdk.LoginTypeNone:
 		loginType = database.LoginTypeNone
-	} else {
+	case codersdk.LoginTypePassword:
 		err = userpassword.Validate(req.Password)
 		if err != nil {
 			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
@@ -376,6 +387,14 @@ func (api *API) postUser(rw http.ResponseWriter, r *http.Request) {
 			return
 		}
 		loginType = database.LoginTypePassword
+	case codersdk.LoginTypeOIDC:
+		loginType = database.LoginTypeOIDC
+	case codersdk.LoginTypeGithub:
+		loginType = database.LoginTypeGithub
+	default:
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: fmt.Sprintf("Unsupported login type %q for manually creating new users.", req.UserLoginType),
+		})
 	}
 
 	user, _, err := api.CreateUser(ctx, api.Database, CreateUserRequest{
@@ -482,7 +501,7 @@ func (api *API) deleteUser(rw http.ResponseWriter, r *http.Request) {
 // @Security CoderSessionToken
 // @Produce json
 // @Tags Users
-// @Param user path string true "User ID, name, or me"
+// @Param user path string true "User ID, username, or me"
 // @Success 200 {object} codersdk.User
 // @Router /users/{user} [get]
 func (api *API) userByName(rw http.ResponseWriter, r *http.Request) {
@@ -592,7 +611,7 @@ func (api *API) putUserProfile(rw http.ResponseWriter, r *http.Request) {
 		Email:     user.Email,
 		AvatarURL: user.AvatarURL,
 		Username:  params.Username,
-		UpdatedAt: database.Now(),
+		UpdatedAt: dbtime.Now(),
 	})
 	aReq.New = updatedUserProfile
 
@@ -680,7 +699,7 @@ func (api *API) putUserStatus(status database.UserStatus) func(rw http.ResponseW
 		suspendedUser, err := api.Database.UpdateUserStatus(ctx, database.UpdateUserStatusParams{
 			ID:        user.ID,
 			Status:    status,
-			UpdatedAt: database.Now(),
+			UpdatedAt: dbtime.Now(),
 		})
 		if err != nil {
 			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
@@ -733,6 +752,13 @@ func (api *API) putUserPassword(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if user.LoginType != database.LoginTypePassword {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "Users without password login type cannot change their password.",
+		})
+		return
+	}
+
 	err := userpassword.Validate(params.Password)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
@@ -1053,10 +1079,11 @@ func (api *API) CreateUser(ctx context.Context, store database.Store, req Create
 			}
 
 			organization, err := tx.InsertOrganization(ctx, database.InsertOrganizationParams{
-				ID:        uuid.New(),
-				Name:      req.Username,
-				CreatedAt: database.Now(),
-				UpdatedAt: database.Now(),
+				ID:          uuid.New(),
+				Name:        req.Username,
+				CreatedAt:   dbtime.Now(),
+				UpdatedAt:   dbtime.Now(),
+				Description: "",
 			})
 			if err != nil {
 				return xerrors.Errorf("create organization: %w", err)
@@ -1070,16 +1097,17 @@ func (api *API) CreateUser(ctx context.Context, store database.Store, req Create
 
 			_, err = tx.InsertAllUsersGroup(ctx, organization.ID)
 			if err != nil {
-				return xerrors.Errorf("create %q group: %w", database.AllUsersGroup, err)
+				return xerrors.Errorf("create %q group: %w", database.EveryoneGroup, err)
 			}
 		}
 
 		params := database.InsertUserParams{
-			ID:        uuid.New(),
-			Email:     req.Email,
-			Username:  req.Username,
-			CreatedAt: database.Now(),
-			UpdatedAt: database.Now(),
+			ID:             uuid.New(),
+			Email:          req.Email,
+			Username:       req.Username,
+			CreatedAt:      dbtime.Now(),
+			UpdatedAt:      dbtime.Now(),
+			HashedPassword: []byte{},
 			// All new users are defaulted to members of the site.
 			RBACRoles: []string{},
 			LoginType: req.LoginType,
@@ -1105,8 +1133,8 @@ func (api *API) CreateUser(ctx context.Context, store database.Store, req Create
 		}
 		_, err = tx.InsertGitSSHKey(ctx, database.InsertGitSSHKeyParams{
 			UserID:     user.ID,
-			CreatedAt:  database.Now(),
-			UpdatedAt:  database.Now(),
+			CreatedAt:  dbtime.Now(),
+			UpdatedAt:  dbtime.Now(),
 			PrivateKey: privateKey,
 			PublicKey:  publicKey,
 		})
@@ -1116,8 +1144,8 @@ func (api *API) CreateUser(ctx context.Context, store database.Store, req Create
 		_, err = tx.InsertOrganizationMember(ctx, database.InsertOrganizationMemberParams{
 			OrganizationID: req.OrganizationID,
 			UserID:         user.ID,
-			CreatedAt:      database.Now(),
-			UpdatedAt:      database.Now(),
+			CreatedAt:      dbtime.Now(),
+			UpdatedAt:      dbtime.Now(),
 			// By default give them membership to the organization.
 			Roles: orgRoles,
 		})
@@ -1139,23 +1167,23 @@ func convertUsers(users []database.User, organizationIDsByUserID map[uuid.UUID][
 
 func userOrganizationIDs(ctx context.Context, api *API, user database.User) ([]uuid.UUID, error) {
 	organizationIDsByMemberIDsRows, err := api.Database.GetOrganizationIDsByMemberIDs(ctx, []uuid.UUID{user.ID})
-	if errors.Is(err, sql.ErrNoRows) || len(organizationIDsByMemberIDsRows) == 0 {
-		return []uuid.UUID{}, nil
-	}
 	if err != nil {
 		return []uuid.UUID{}, err
 	}
+	if len(organizationIDsByMemberIDsRows) == 0 {
+		return []uuid.UUID{}, xerrors.Errorf("user %q must be a member of at least one organization", user.Email)
+	}
 	member := organizationIDsByMemberIDsRows[0]
 	return member.OrganizationIDs, nil
 }
 
-func findUser(id uuid.UUID, users []database.User) *database.User {
-	for _, u := range users {
-		if u.ID == id {
-			return &u
+func usernameWithID(id uuid.UUID, users []database.User) (string, bool) {
+	for _, user := range users {
+		if id == user.ID {
+			return user.Username, true
 		}
 	}
-	return nil
+	return "", false
 }
 
 func convertAPIKey(k database.APIKey) codersdk.APIKey {
diff --git a/coderd/users_test.go b/coderd/users_test.go
index eff3174ad83a2..2755a7491a28e 100644
--- a/coderd/users_test.go
+++ b/coderd/users_test.go
@@ -4,24 +4,30 @@ import (
 	"context"
 	"fmt"
 	"net/http"
-	"sort"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/coderdtest/oidctest"
+
+	"github.com/golang-jwt/jwt/v4"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/exp/slices"
 	"golang.org/x/sync/errgroup"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestFirstUser(t *testing.T) {
@@ -256,13 +262,13 @@ func TestPostLogin(t *testing.T) {
 		t.Parallel()
 
 		client := coderdtest.New(t, nil)
-		admin := coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
 		split := strings.Split(client.SessionToken(), "-")
-		key, err := client.APIKeyByID(ctx, admin.UserID.String(), split[0])
+		key, err := client.APIKeyByID(ctx, owner.UserID.String(), split[0])
 		require.NoError(t, err, "fetch login key")
 		require.Equal(t, int64(86400), key.LifetimeSeconds, "default should be 86400")
 
@@ -270,7 +276,7 @@ func TestPostLogin(t *testing.T) {
 		token, err := client.CreateToken(ctx, codersdk.Me, codersdk.CreateTokenRequest{})
 		require.NoError(t, err, "make new token api key")
 		split = strings.Split(token.Key, "-")
-		apiKey, err := client.APIKeyByID(ctx, admin.UserID.String(), split[0])
+		apiKey, err := client.APIKeyByID(ctx, owner.UserID.String(), split[0])
 		require.NoError(t, err, "fetch api key")
 
 		require.True(t, apiKey.ExpiresAt.After(time.Now().Add(time.Hour*24*29)), "default tokens lasts more than 29 days")
@@ -320,7 +326,7 @@ func TestDeleteUser(t *testing.T) {
 		err := client.DeleteUser(context.Background(), firstUser.UserID)
 		var apiErr *codersdk.Error
 		require.ErrorAs(t, err, &apiErr)
-		require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
+		require.Equal(t, http.StatusBadRequest, apiErr.StatusCode())
 	})
 	t.Run("HasWorkspaces", func(t *testing.T) {
 		t.Parallel()
@@ -328,7 +334,7 @@ func TestDeleteUser(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		anotherClient, another := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		coderdtest.CreateWorkspace(t, anotherClient, user.OrganizationID, template.ID)
 		err := client.DeleteUser(context.Background(), another.ID)
@@ -358,14 +364,14 @@ func TestPostLogout(t *testing.T) {
 		client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})
 		numLogs := len(auditor.AuditLogs())
 
-		admin := coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
 		numLogs++ // add an audit log for login
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
 		keyID := strings.Split(client.SessionToken(), "-")[0]
-		apiKey, err := client.APIKeyByID(ctx, admin.UserID.String(), keyID)
+		apiKey, err := client.APIKeyByID(ctx, owner.UserID.String(), keyID)
 		require.NoError(t, err)
 		require.Equal(t, keyID, apiKey.ID, "API key should exist in the database")
 
@@ -394,13 +400,14 @@ func TestPostLogout(t *testing.T) {
 		}
 		require.True(t, found, "auth cookie should be returned")
 
-		_, err = client.APIKeyByID(ctx, admin.UserID.String(), keyID)
+		_, err = client.APIKeyByID(ctx, owner.UserID.String(), keyID)
 		sdkErr := &codersdk.Error{}
 		require.ErrorAs(t, err, &sdkErr)
 		require.Equal(t, http.StatusUnauthorized, sdkErr.StatusCode(), "Expecting 401")
 	})
 }
 
+// nolint:bodyclose
 func TestPostUsers(t *testing.T) {
 	t.Parallel()
 	t.Run("NoAuth", func(t *testing.T) {
@@ -559,12 +566,71 @@ func TestPostUsers(t *testing.T) {
 		// should be Never since they haven't performed a request.
 		for _, user := range allUsersRes.Users {
 			if user.ID == firstUser.ID {
-				require.WithinDuration(t, firstUser.LastSeenAt, database.Now(), testutil.WaitShort)
+				require.WithinDuration(t, firstUser.LastSeenAt, dbtime.Now(), testutil.WaitShort)
 			} else {
 				require.Zero(t, user.LastSeenAt)
 			}
 		}
 	})
+
+	t.Run("CreateNoneLoginType", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, nil)
+		first := coderdtest.CreateFirstUser(t, client)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		user, err := client.CreateUser(ctx, codersdk.CreateUserRequest{
+			OrganizationID: first.OrganizationID,
+			Email:          "another@user.org",
+			Username:       "someone-else",
+			Password:       "",
+			UserLoginType:  codersdk.LoginTypeNone,
+		})
+		require.NoError(t, err)
+
+		found, err := client.User(ctx, user.ID.String())
+		require.NoError(t, err)
+		require.Equal(t, found.LoginType, codersdk.LoginTypeNone)
+	})
+
+	t.Run("CreateOIDCLoginType", func(t *testing.T) {
+		t.Parallel()
+		email := "another@user.org"
+		fake := oidctest.NewFakeIDP(t,
+			oidctest.WithServing(),
+		)
+		cfg := fake.OIDCConfig(t, nil, func(cfg *coderd.OIDCConfig) {
+			cfg.AllowSignups = true
+		})
+
+		client := coderdtest.New(t, &coderdtest.Options{
+			OIDCConfig: cfg,
+		})
+		first := coderdtest.CreateFirstUser(t, client)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		_, err := client.CreateUser(ctx, codersdk.CreateUserRequest{
+			OrganizationID: first.OrganizationID,
+			Email:          email,
+			Username:       "someone-else",
+			Password:       "",
+			UserLoginType:  codersdk.LoginTypeOIDC,
+		})
+		require.NoError(t, err)
+
+		// Try to log in with OIDC.
+		userClient, _ := fake.Login(t, client, jwt.MapClaims{
+			"email": email,
+		})
+
+		found, err := userClient.User(ctx, "me")
+		require.NoError(t, err)
+		require.Equal(t, found.LoginType, codersdk.LoginTypeOIDC)
+	})
 }
 
 func TestUpdateUserProfile(t *testing.T) {
@@ -641,13 +707,13 @@ func TestUpdateUserPassword(t *testing.T) {
 	t.Run("MemberCantUpdateAdminPassword", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
-		admin := coderdtest.CreateFirstUser(t, client)
-		member, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
-		err := member.UpdateUserPassword(ctx, admin.UserID.String(), codersdk.UpdateUserPasswordRequest{
+		err := member.UpdateUserPassword(ctx, owner.UserID.String(), codersdk.UpdateUserPasswordRequest{
 			Password: "newpassword",
 		})
 		require.Error(t, err, "member should not be able to update admin password")
@@ -656,7 +722,7 @@ func TestUpdateUserPassword(t *testing.T) {
 	t.Run("AdminCanUpdateMemberPassword", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
-		admin := coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -665,7 +731,7 @@ func TestUpdateUserPassword(t *testing.T) {
 			Email:          "coder@coder.com",
 			Username:       "coder",
 			Password:       "SomeStrongPassword!",
-			OrganizationID: admin.OrganizationID,
+			OrganizationID: owner.OrganizationID,
 		})
 		require.NoError(t, err, "create member")
 		err = client.UpdateUserPassword(ctx, member.ID.String(), codersdk.UpdateUserPasswordRequest{
@@ -685,11 +751,11 @@ func TestUpdateUserPassword(t *testing.T) {
 		client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})
 		numLogs := len(auditor.AuditLogs())
 
-		admin := coderdtest.CreateFirstUser(t, client)
+		owner := coderdtest.CreateFirstUser(t, client)
 		numLogs++ // add an audit log for user create
 		numLogs++ // add an audit log for login
 
-		member, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 		numLogs++ // add an audit log for user create
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -709,8 +775,8 @@ func TestUpdateUserPassword(t *testing.T) {
 	t.Run("MemberCantUpdateOwnPasswordWithoutOldPassword", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
-		admin := coderdtest.CreateFirstUser(t, client)
-		member, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)
+		owner := coderdtest.CreateFirstUser(t, client)
+		member, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -864,7 +930,7 @@ func TestGrantSiteRoles(t *testing.T) {
 			AssignToUser: first.UserID.String(),
 			Roles:        []string{},
 			Error:        true,
-			StatusCode:   http.StatusForbidden,
+			StatusCode:   http.StatusBadRequest,
 		},
 		{
 			// Cannot update your own roles
@@ -1529,7 +1595,7 @@ func TestWorkspacesByUser(t *testing.T) {
 		newUserClient := codersdk.New(client.URL)
 		newUserClient.SetSessionToken(auth.SessionToken)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 
@@ -1804,8 +1870,8 @@ func assertPagination(ctx context.Context, t *testing.T, client *codersdk.Client
 
 // sortUsers sorts by (created_at, id)
 func sortUsers(users []codersdk.User) {
-	sort.Slice(users, func(i, j int) bool {
-		return strings.ToLower(users[i].Username) < strings.ToLower(users[j].Username)
+	slices.SortFunc(users, func(a, b codersdk.User) int {
+		return slice.Ascending(strings.ToLower(a.Username), strings.ToLower(b.Username))
 	})
 }
 
diff --git a/coderd/util/ptr/ptr_test.go b/coderd/util/ptr/ptr_test.go
index 2dee346c8f5e4..355b32fc5cd68 100644
--- a/coderd/util/ptr/ptr_test.go
+++ b/coderd/util/ptr/ptr_test.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"github.com/coder/coder/coderd/util/ptr"
+	"github.com/coder/coder/v2/coderd/util/ptr"
 )
 
 func Test_Ref_Deref(t *testing.T) {
diff --git a/coderd/util/slice/slice.go b/coderd/util/slice/slice.go
index 9909fe2b72c21..c366b04f91d8d 100644
--- a/coderd/util/slice/slice.go
+++ b/coderd/util/slice/slice.go
@@ -1,5 +1,9 @@
 package slice
 
+import (
+	"golang.org/x/exp/constraints"
+)
+
 // SameElements returns true if the 2 lists have the same elements in any
 // order.
 func SameElements[T comparable](a []T, b []T) bool {
@@ -38,17 +42,19 @@ func Overlap[T comparable](a []T, b []T) bool {
 }
 
 // Unique returns a new slice with all duplicate elements removed.
-// This is a slow function on large lists.
-// TODO: Sort elements and implement a faster search algorithm if we
-// really start to use this.
 func Unique[T comparable](a []T) []T {
 	cpy := make([]T, 0, len(a))
+	seen := make(map[T]struct{}, len(a))
+
 	for _, v := range a {
-		v := v
-		if !Contains(cpy, v) {
-			cpy = append(cpy, v)
+		if _, ok := seen[v]; ok {
+			continue
 		}
+
+		seen[v] = struct{}{}
+		cpy = append(cpy, v)
 	}
+
 	return cpy
 }
 
@@ -67,3 +73,17 @@ func OverlapCompare[T any](a []T, b []T, equal func(a, b T) bool) bool {
 func New[T any](items ...T) []T {
 	return items
 }
+
+func Ascending[T constraints.Ordered](a, b T) int {
+	if a < b {
+		return -1
+	} else if a == b {
+		return 0
+	} else {
+		return 1
+	}
+}
+
+func Descending[T constraints.Ordered](a, b T) int {
+	return -Ascending[T](a, b)
+}
diff --git a/coderd/util/slice/slice_test.go b/coderd/util/slice/slice_test.go
index b21e0cc0b52a5..cf686f3de4a48 100644
--- a/coderd/util/slice/slice_test.go
+++ b/coderd/util/slice/slice_test.go
@@ -8,7 +8,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/util/slice"
+	"github.com/coder/coder/v2/coderd/util/slice"
 )
 
 func TestSameElements(t *testing.T) {
@@ -107,3 +107,19 @@ func assertSetContains[T comparable](t *testing.T, set []T, in []T, out []T) {
 		require.False(t, slice.Contains(set, e), "expect element in set")
 	}
 }
+
+func TestAscending(t *testing.T) {
+	t.Parallel()
+
+	assert.Equal(t, -1, slice.Ascending(1, 2))
+	assert.Equal(t, 0, slice.Ascending(1, 1))
+	assert.Equal(t, 1, slice.Ascending(2, 1))
+}
+
+func TestDescending(t *testing.T) {
+	t.Parallel()
+
+	assert.Equal(t, 1, slice.Descending(1, 2))
+	assert.Equal(t, 0, slice.Descending(1, 1))
+	assert.Equal(t, -1, slice.Descending(2, 1))
+}
diff --git a/coderd/util/strings/strings_test.go b/coderd/util/strings/strings_test.go
index a5db8ebbf8734..a107a7754fc7f 100644
--- a/coderd/util/strings/strings_test.go
+++ b/coderd/util/strings/strings_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/util/strings"
+	"github.com/coder/coder/v2/coderd/util/strings"
 )
 
 func TestJoinWithConjunction(t *testing.T) {
diff --git a/coderd/util/syncmap/map.go b/coderd/util/syncmap/map.go
new file mode 100644
index 0000000000000..d245973efa844
--- /dev/null
+++ b/coderd/util/syncmap/map.go
@@ -0,0 +1,77 @@
+package syncmap
+
+import "sync"
+
+// Map is a type safe sync.Map
+type Map[K, V any] struct {
+	m sync.Map
+}
+
+func New[K, V any]() *Map[K, V] {
+	return &Map[K, V]{
+		m: sync.Map{},
+	}
+}
+
+func (m *Map[K, V]) Store(k K, v V) {
+	m.m.Store(k, v)
+}
+
+//nolint:forcetypeassert
+func (m *Map[K, V]) Load(key K) (value V, ok bool) {
+	v, ok := m.m.Load(key)
+	if !ok {
+		var empty V
+		return empty, false
+	}
+	return v.(V), ok
+}
+
+func (m *Map[K, V]) Delete(key K) {
+	m.m.Delete(key)
+}
+
+//nolint:forcetypeassert
+func (m *Map[K, V]) LoadAndDelete(key K) (actual V, loaded bool) {
+	act, loaded := m.m.LoadAndDelete(key)
+	if !loaded {
+		var empty V
+		return empty, loaded
+	}
+	return act.(V), loaded
+}
+
+//nolint:forcetypeassert
+func (m *Map[K, V]) LoadOrStore(key K, value V) (actual V, loaded bool) {
+	act, loaded := m.m.LoadOrStore(key, value)
+	if !loaded {
+		var empty V
+		return empty, loaded
+	}
+	return act.(V), loaded
+}
+
+func (m *Map[K, V]) CompareAndSwap(key K, old V, new V) bool {
+	return m.m.CompareAndSwap(key, old, new)
+}
+
+func (m *Map[K, V]) CompareAndDelete(key K, old V) (deleted bool) {
+	return m.m.CompareAndDelete(key, old)
+}
+
+//nolint:forcetypeassert
+func (m *Map[K, V]) Swap(key K, value V) (previous any, loaded bool) {
+	previous, loaded = m.m.Swap(key, value)
+	if !loaded {
+		var empty V
+		return empty, loaded
+	}
+	return previous.(V), loaded
+}
+
+//nolint:forcetypeassert
+func (m *Map[K, V]) Range(f func(key K, value V) bool) {
+	m.m.Range(func(key, value interface{}) bool {
+		return f(key.(K), value.(V))
+	})
+}
diff --git a/coderd/util/tz/tz_test.go b/coderd/util/tz/tz_test.go
index f70046837064f..a0e7971bd7492 100644
--- a/coderd/util/tz/tz_test.go
+++ b/coderd/util/tz/tz_test.go
@@ -8,7 +8,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/util/tz"
+	"github.com/coder/coder/v2/coderd/util/tz"
 )
 
 //nolint:paralleltest // Environment variables
diff --git a/coderd/util/xio/limitwriter_test.go b/coderd/util/xio/limitwriter_test.go
index 52d6075fbb7f3..f14c873e96422 100644
--- a/coderd/util/xio/limitwriter_test.go
+++ b/coderd/util/xio/limitwriter_test.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/util/xio"
+	"github.com/coder/coder/v2/coderd/util/xio"
 )
 
 func TestLimitWriter(t *testing.T) {
diff --git a/coderd/workspaceagents.go b/coderd/workspaceagents.go
index 8567ff1d895b3..d6f3a44371e1a 100644
--- a/coderd/workspaceagents.go
+++ b/coderd/workspaceagents.go
@@ -6,7 +6,6 @@ import (
 	"database/sql"
 	"encoding/json"
 	"errors"
-	"flag"
 	"fmt"
 	"io"
 	"net"
@@ -14,15 +13,15 @@ import (
 	"net/netip"
 	"net/url"
 	"runtime/pprof"
+	"sort"
 	"strconv"
 	"strings"
-	"sync"
 	"sync/atomic"
 	"time"
 
-	"github.com/bep/debounce"
-	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
+	"github.com/sqlc-dev/pqtype"
+	"golang.org/x/exp/maps"
 	"golang.org/x/exp/slices"
 	"golang.org/x/mod/semver"
 	"golang.org/x/sync/errgroup"
@@ -31,16 +30,17 @@ import (
 	"tailscale.com/tailcfg"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/gitauth"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/externalauth"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/tailnet"
 )
 
 // @Summary Get workspace agent by ID
@@ -55,125 +55,196 @@ func (api *API) workspaceAgent(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	workspaceAgent := httpmw.WorkspaceAgentParam(r)
 
-	dbApps, err := api.Database.GetWorkspaceAppsByAgentID(ctx, workspaceAgent.ID)
-	if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching workspace agent applications.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-	apiAgent, err := convertWorkspaceAgent(
-		api.DERPMap(), *api.TailnetCoordinator.Load(), workspaceAgent, convertApps(dbApps), api.AgentInactiveDisconnectTimeout,
-		api.DeploymentValues.AgentFallbackTroubleshootingURL.String(),
+	var (
+		dbApps     []database.WorkspaceApp
+		scripts    []database.WorkspaceAgentScript
+		logSources []database.WorkspaceAgentLogSource
 	)
+
+	var eg errgroup.Group
+	eg.Go(func() (err error) {
+		dbApps, err = api.Database.GetWorkspaceAppsByAgentID(ctx, workspaceAgent.ID)
+		return err
+	})
+	eg.Go(func() (err error) {
+		//nolint:gocritic // TODO: can we make this not require system restricted?
+		scripts, err = api.Database.GetWorkspaceAgentScriptsByAgentIDs(dbauthz.AsSystemRestricted(ctx), []uuid.UUID{workspaceAgent.ID})
+		return err
+	})
+	eg.Go(func() (err error) {
+		//nolint:gocritic // TODO: can we make this not require system restricted?
+		logSources, err = api.Database.GetWorkspaceAgentLogSourcesByAgentIDs(dbauthz.AsSystemRestricted(ctx), []uuid.UUID{workspaceAgent.ID})
+		return err
+	})
+	err := eg.Wait()
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error reading workspace agent.",
+			Message: "Internal error fetching workspace agent.",
 			Detail:  err.Error(),
 		})
 		return
 	}
 
-	httpapi.Write(ctx, rw, http.StatusOK, apiAgent)
-}
-
-// @Summary Get authorized workspace agent manifest
-// @ID get-authorized-workspace-agent-manifest
-// @Security CoderSessionToken
-// @Produce json
-// @Tags Agents
-// @Success 200 {object} agentsdk.Manifest
-// @Router /workspaceagents/me/manifest [get]
-func (api *API) workspaceAgentManifest(rw http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	workspaceAgent := httpmw.WorkspaceAgent(r)
-	apiAgent, err := convertWorkspaceAgent(
-		api.DERPMap(), *api.TailnetCoordinator.Load(), workspaceAgent, nil, api.AgentInactiveDisconnectTimeout,
-		api.DeploymentValues.AgentFallbackTroubleshootingURL.String(),
-	)
+	resource, err := api.Database.GetWorkspaceResourceByID(ctx, workspaceAgent.ResourceID)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error reading workspace agent.",
+			Message: "Internal error fetching workspace resource.",
 			Detail:  err.Error(),
 		})
 		return
 	}
-	dbApps, err := api.Database.GetWorkspaceAppsByAgentID(ctx, workspaceAgent.ID)
-	if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
+	build, err := api.Database.GetWorkspaceBuildByJobID(ctx, resource.JobID)
+	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching workspace agent applications.",
+			Message: "Internal error fetching workspace build.",
 			Detail:  err.Error(),
 		})
 		return
 	}
-
-	metadata, err := api.Database.GetWorkspaceAgentMetadata(ctx, workspaceAgent.ID)
+	workspace, err := api.Database.GetWorkspaceByID(ctx, build.WorkspaceID)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching workspace agent metadata.",
+			Message: "Internal error fetching workspace.",
 			Detail:  err.Error(),
 		})
 		return
 	}
-
-	resource, err := api.Database.GetWorkspaceResourceByID(ctx, workspaceAgent.ResourceID)
+	owner, err := api.Database.GetUserByID(ctx, workspace.OwnerID)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching workspace resource.",
+			Message: "Internal error fetching workspace owner.",
 			Detail:  err.Error(),
 		})
 		return
 	}
-	build, err := api.Database.GetWorkspaceBuildByJobID(ctx, resource.JobID)
+
+	apiAgent, err := convertWorkspaceAgent(
+		api.DERPMap(), *api.TailnetCoordinator.Load(), workspaceAgent, convertApps(dbApps, workspaceAgent, owner.Username, workspace), convertScripts(scripts), convertLogSources(logSources), api.AgentInactiveDisconnectTimeout,
+		api.DeploymentValues.AgentFallbackTroubleshootingURL.String(),
+	)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching workspace build.",
+			Message: "Internal error reading workspace agent.",
 			Detail:  err.Error(),
 		})
 		return
 	}
-	workspace, err := api.Database.GetWorkspaceByID(ctx, build.WorkspaceID)
+
+	httpapi.Write(ctx, rw, http.StatusOK, apiAgent)
+}
+
+// @Summary Get authorized workspace agent manifest
+// @ID get-authorized-workspace-agent-manifest
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Agents
+// @Success 200 {object} agentsdk.Manifest
+// @Router /workspaceagents/me/manifest [get]
+func (api *API) workspaceAgentManifest(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	workspaceAgent := httpmw.WorkspaceAgent(r)
+	apiAgent, err := convertWorkspaceAgent(
+		api.DERPMap(), *api.TailnetCoordinator.Load(), workspaceAgent, nil, nil, nil, api.AgentInactiveDisconnectTimeout,
+		api.DeploymentValues.AgentFallbackTroubleshootingURL.String(),
+	)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching workspace.",
+			Message: "Internal error reading workspace agent.",
 			Detail:  err.Error(),
 		})
 		return
 	}
-	owner, err := api.Database.GetUserByID(ctx, workspace.OwnerID)
+
+	var (
+		dbApps    []database.WorkspaceApp
+		scripts   []database.WorkspaceAgentScript
+		metadata  []database.WorkspaceAgentMetadatum
+		resource  database.WorkspaceResource
+		build     database.WorkspaceBuild
+		workspace database.Workspace
+		owner     database.User
+	)
+
+	var eg errgroup.Group
+	eg.Go(func() (err error) {
+		dbApps, err = api.Database.GetWorkspaceAppsByAgentID(ctx, workspaceAgent.ID)
+		if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
+			return err
+		}
+		return nil
+	})
+	eg.Go(func() (err error) {
+		// nolint:gocritic // This is necessary to fetch agent scripts!
+		scripts, err = api.Database.GetWorkspaceAgentScriptsByAgentIDs(dbauthz.AsSystemRestricted(ctx), []uuid.UUID{workspaceAgent.ID})
+		return err
+	})
+	eg.Go(func() (err error) {
+		metadata, err = api.Database.GetWorkspaceAgentMetadata(ctx, database.GetWorkspaceAgentMetadataParams{
+			WorkspaceAgentID: workspaceAgent.ID,
+			Keys:             nil,
+		})
+		return err
+	})
+	eg.Go(func() (err error) {
+		resource, err = api.Database.GetWorkspaceResourceByID(ctx, workspaceAgent.ResourceID)
+		if err != nil {
+			return xerrors.Errorf("getting resource by id: %w", err)
+		}
+		build, err = api.Database.GetWorkspaceBuildByJobID(ctx, resource.JobID)
+		if err != nil {
+			return xerrors.Errorf("getting workspace build by job id: %w", err)
+		}
+		workspace, err = api.Database.GetWorkspaceByID(ctx, build.WorkspaceID)
+		if err != nil {
+			return xerrors.Errorf("getting workspace by id: %w", err)
+		}
+		owner, err = api.Database.GetUserByID(ctx, workspace.OwnerID)
+		if err != nil {
+			return xerrors.Errorf("getting workspace owner by id: %w", err)
+		}
+		return err
+	})
+	err = eg.Wait()
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching workspace owner.",
+			Message: "Internal error fetching workspace agent manifest.",
 			Detail:  err.Error(),
 		})
 		return
 	}
 
-	vscodeProxyURI := strings.ReplaceAll(api.AppHostname, "*",
-		fmt.Sprintf("%s://{{port}}--%s--%s--%s",
-			api.AccessURL.Scheme,
-			workspaceAgent.Name,
-			workspace.Name,
-			owner.Username,
-		))
+	appHost := httpapi.ApplicationURL{
+		AppSlugOrPort: "{{port}}",
+		AgentName:     workspaceAgent.Name,
+		WorkspaceName: workspace.Name,
+		Username:      owner.Username,
+	}
+	vscodeProxyURI := api.AccessURL.Scheme + "://" + strings.ReplaceAll(api.AppHostname, "*", appHost.String())
+	if api.AppHostname == "" {
+		vscodeProxyURI += api.AccessURL.Hostname()
+	}
 	if api.AccessURL.Port() != "" {
 		vscodeProxyURI += fmt.Sprintf(":%s", api.AccessURL.Port())
 	}
 
+	gitAuthConfigs := 0
+	for _, cfg := range api.ExternalAuthConfigs {
+		if codersdk.EnhancedExternalAuthProvider(cfg.Type).Git() {
+			gitAuthConfigs++
+		}
+	}
+
 	httpapi.Write(ctx, rw, http.StatusOK, agentsdk.Manifest{
 		AgentID:                  apiAgent.ID,
-		Apps:                     convertApps(dbApps),
+		Apps:                     convertApps(dbApps, workspaceAgent, owner.Username, workspace),
+		Scripts:                  convertScripts(scripts),
 		DERPMap:                  api.DERPMap(),
-		GitAuthConfigs:           len(api.GitAuthConfigs),
+		DERPForceWebSockets:      api.DeploymentValues.DERP.Config.ForceWebSockets.Value(),
+		GitAuthConfigs:           gitAuthConfigs,
 		EnvironmentVariables:     apiAgent.EnvironmentVariables,
-		StartupScript:            apiAgent.StartupScript,
 		Directory:                apiAgent.Directory,
 		VSCodePortProxyURI:       vscodeProxyURI,
 		MOTDFile:                 workspaceAgent.MOTDFile,
-		StartupScriptTimeout:     time.Duration(apiAgent.StartupScriptTimeoutSeconds) * time.Second,
-		ShutdownScript:           apiAgent.ShutdownScript,
-		ShutdownScriptTimeout:    time.Duration(apiAgent.ShutdownScriptTimeoutSeconds) * time.Second,
 		DisableDirectConnections: api.DeploymentValues.DERP.Config.BlockDirect.Value(),
 		Metadata:                 convertWorkspaceAgentMetadataDesc(metadata),
 	})
@@ -193,7 +264,7 @@ func (api *API) postWorkspaceAgentStartup(rw http.ResponseWriter, r *http.Reques
 	ctx := r.Context()
 	workspaceAgent := httpmw.WorkspaceAgent(r)
 	apiAgent, err := convertWorkspaceAgent(
-		api.DERPMap(), *api.TailnetCoordinator.Load(), workspaceAgent, nil, api.AgentInactiveDisconnectTimeout,
+		api.DERPMap(), *api.TailnetCoordinator.Load(), workspaceAgent, nil, nil, nil, api.AgentInactiveDisconnectTimeout,
 		api.DeploymentValues.AgentFallbackTroubleshootingURL.String(),
 	)
 	if err != nil {
@@ -209,7 +280,13 @@ func (api *API) postWorkspaceAgentStartup(rw http.ResponseWriter, r *http.Reques
 		return
 	}
 
-	api.Logger.Info(ctx, "post workspace agent version", slog.F("agent_id", apiAgent.ID), slog.F("agent_version", req.Version))
+	api.Logger.Debug(
+		ctx,
+		"post workspace agent version",
+		slog.F("agent_id", apiAgent.ID),
+		slog.F("agent_version", req.Version),
+		slog.F("remote_addr", r.RemoteAddr),
+	)
 
 	if !semver.IsValid(req.Version) {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
@@ -219,11 +296,31 @@ func (api *API) postWorkspaceAgentStartup(rw http.ResponseWriter, r *http.Reques
 		return
 	}
 
+	// Validate subsystems.
+	seen := make(map[codersdk.AgentSubsystem]bool)
+	for _, s := range req.Subsystems {
+		if !s.Valid() {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Invalid workspace agent subsystem provided.",
+				Detail:  fmt.Sprintf("invalid subsystem: %q", s),
+			})
+			return
+		}
+		if seen[s] {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Invalid workspace agent subsystem provided.",
+				Detail:  fmt.Sprintf("duplicate subsystem: %q", s),
+			})
+			return
+		}
+		seen[s] = true
+	}
+
 	if err := api.Database.UpdateWorkspaceAgentStartupByID(ctx, database.UpdateWorkspaceAgentStartupByIDParams{
 		ID:                apiAgent.ID,
 		Version:           req.Version,
 		ExpandedDirectory: req.ExpandedDirectory,
-		Subsystem:         convertWorkspaceAgentSubsystem(req.Subsystem),
+		Subsystems:        convertWorkspaceAgentSubsystems(req.Subsystems),
 	}); err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 			Message: "Error setting agent version",
@@ -258,13 +355,37 @@ func (api *API) patchWorkspaceAgentLogs(rw http.ResponseWriter, r *http.Request)
 		})
 		return
 	}
-	createdAt := make([]time.Time, 0)
+	// This is to support the legacy API where the log source ID was
+	// not provided in the request body. We default to the external
+	// log source in this case.
+	if req.LogSourceID == uuid.Nil {
+		// Use the external log source
+		externalSources, err := api.Database.InsertWorkspaceAgentLogSources(ctx, database.InsertWorkspaceAgentLogSourcesParams{
+			WorkspaceAgentID: workspaceAgent.ID,
+			CreatedAt:        dbtime.Now(),
+			ID:               []uuid.UUID{agentsdk.ExternalLogSourceID},
+			DisplayName:      []string{"External"},
+			Icon:             []string{"/emojis/1f310.png"},
+		})
+		if database.IsUniqueViolation(err, database.UniqueWorkspaceAgentLogSourcesPkey) {
+			err = nil
+			req.LogSourceID = agentsdk.ExternalLogSourceID
+		}
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Failed to create external log source.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+		if len(externalSources) == 1 {
+			req.LogSourceID = externalSources[0].ID
+		}
+	}
 	output := make([]string, 0)
 	level := make([]database.LogLevel, 0)
-	source := make([]database.WorkspaceAgentLogSource, 0)
 	outputLength := 0
 	for _, logEntry := range req.Logs {
-		createdAt = append(createdAt, logEntry.CreatedAt)
 		output = append(output, logEntry.Output)
 		outputLength += len(logEntry.Output)
 		if logEntry.Level == "" {
@@ -280,28 +401,14 @@ func (api *API) patchWorkspaceAgentLogs(rw http.ResponseWriter, r *http.Request)
 			return
 		}
 		level = append(level, parsedLevel)
-
-		if logEntry.Source == "" {
-			// Default to "startup_script" to support older agents that didn't have the source field.
-			logEntry.Source = codersdk.WorkspaceAgentLogSourceStartupScript
-		}
-		parsedSource := database.WorkspaceAgentLogSource(logEntry.Source)
-		if !parsedSource.Valid() {
-			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-				Message: "Invalid log source provided.",
-				Detail:  fmt.Sprintf("invalid log source: %q", logEntry.Source),
-			})
-			return
-		}
-		source = append(source, parsedSource)
 	}
 
 	logs, err := api.Database.InsertWorkspaceAgentLogs(ctx, database.InsertWorkspaceAgentLogsParams{
 		AgentID:      workspaceAgent.ID,
-		CreatedAt:    createdAt,
+		CreatedAt:    dbtime.Now(),
 		Output:       output,
 		Level:        level,
-		Source:       source,
+		LogSourceID:  req.LogSourceID,
 		OutputLength: int32(outputLength),
 	})
 	if err != nil {
@@ -455,6 +562,15 @@ func (api *API) workspaceAgentLogs(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	workspace, err := api.Database.GetWorkspaceByAgentID(ctx, workspaceAgent.ID)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error fetching workspace by agent id.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
 	api.WebsocketWaitMutex.Lock()
 	api.WebsocketWaitGroup.Add(1)
 	api.WebsocketWaitMutex.Unlock()
@@ -498,11 +614,27 @@ func (api *API) workspaceAgentLogs(rw http.ResponseWriter, r *http.Request) {
 		lastSentLogID = logs[len(logs)-1].ID
 	}
 
+	workspaceNotifyCh := make(chan struct{}, 1)
 	notifyCh := make(chan struct{}, 1)
 	// Allow us to immediately check if we missed any logs
 	// between initial fetch and subscribe.
 	notifyCh <- struct{}{}
 
+	// Subscribe to workspace to detect new builds.
+	closeSubscribeWorkspace, err := api.Pubsub.Subscribe(codersdk.WorkspaceNotifyChannel(workspace.ID), func(_ context.Context, _ []byte) {
+		select {
+		case workspaceNotifyCh <- struct{}{}:
+		default:
+		}
+	})
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Failed to subscribe to workspace for log streaming.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+	defer closeSubscribeWorkspace()
 	// Subscribe early to prevent missing log events.
 	closeSubscribe, err := api.Pubsub.Subscribe(agentsdk.LogsNotifyChannel(workspaceAgent.ID), func(_ context.Context, _ []byte) {
 		// The message is not important, we're tracking lastSentLogID manually.
@@ -513,7 +645,7 @@ func (api *API) workspaceAgentLogs(rw http.ResponseWriter, r *http.Request) {
 	})
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Failed to subscribe to logs.",
+			Message: "Failed to subscribe to agent for log streaming.",
 			Detail:  err.Error(),
 		})
 		return
@@ -528,17 +660,57 @@ func (api *API) workspaceAgentLogs(rw http.ResponseWriter, r *http.Request) {
 	defer t.Stop()
 
 	go func() {
-		defer close(bufferedLogs)
-
-		for {
+		defer func() {
+			logger.Debug(ctx, "end log streaming loop")
+			close(bufferedLogs)
+		}()
+		logger.Debug(ctx, "start log streaming loop", slog.F("last_sent_log_id", lastSentLogID))
+
+		keepGoing := true
+		for keepGoing {
+			var (
+				debugTriggeredBy     string
+				onlyCheckLatestBuild bool
+			)
 			select {
 			case <-ctx.Done():
 				return
 			case <-t.C:
+				debugTriggeredBy = "timer"
+			case <-workspaceNotifyCh:
+				debugTriggeredBy = "workspace"
+				onlyCheckLatestBuild = true
 			case <-notifyCh:
+				debugTriggeredBy = "log"
 				t.Reset(recheckInterval)
 			}
 
+			agents, err := api.Database.GetWorkspaceAgentsInLatestBuildByWorkspaceID(ctx, workspace.ID)
+			if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
+				if xerrors.Is(err, context.Canceled) {
+					return
+				}
+				logger.Warn(ctx, "failed to get workspace agents in latest build", slog.Error(err))
+				continue
+			}
+			// If the agent is no longer in the latest build, we can stop after
+			// checking once.
+			keepGoing = slices.ContainsFunc(agents, func(agent database.WorkspaceAgent) bool { return agent.ID == workspaceAgent.ID })
+
+			logger.Debug(
+				ctx,
+				"checking for new logs",
+				slog.F("triggered_by", debugTriggeredBy),
+				slog.F("only_check_latest_build", onlyCheckLatestBuild),
+				slog.F("keep_going", keepGoing),
+				slog.F("last_sent_log_id", lastSentLogID),
+				slog.F("workspace_has_agents", len(agents) > 0),
+			)
+
+			if onlyCheckLatestBuild && keepGoing {
+				continue
+			}
+
 			logs, err := api.Database.GetWorkspaceAgentLogsAfter(ctx, database.GetWorkspaceAgentLogsAfterParams{
 				AgentID:      workspaceAgent.ID,
 				CreatedAfter: lastSentLogID,
@@ -606,7 +778,7 @@ func (api *API) workspaceAgentListeningPorts(rw http.ResponseWriter, r *http.Req
 	workspaceAgent := httpmw.WorkspaceAgentParam(r)
 
 	apiAgent, err := convertWorkspaceAgent(
-		api.DERPMap(), *api.TailnetCoordinator.Load(), workspaceAgent, nil, api.AgentInactiveDisconnectTimeout,
+		api.DERPMap(), *api.TailnetCoordinator.Load(), workspaceAgent, nil, nil, nil, api.AgentInactiveDisconnectTimeout,
 		api.DeploymentValues.AgentFallbackTroubleshootingURL.String(),
 	)
 	if err != nil {
@@ -705,10 +877,11 @@ func (api *API) _dialWorkspaceAgentTailnet(agentID uuid.UUID) (*codersdk.Workspa
 
 	derpMap := api.DERPMap()
 	conn, err := tailnet.NewConn(&tailnet.Options{
-		Addresses:      []netip.Prefix{netip.PrefixFrom(tailnet.IP(), 128)},
-		DERPMap:        api.DERPMap(),
-		Logger:         api.Logger.Named("net.tailnet"),
-		BlockEndpoints: api.DeploymentValues.DERP.Config.BlockDirect.Value(),
+		Addresses:           []netip.Prefix{netip.PrefixFrom(tailnet.IP(), 128)},
+		DERPMap:             api.DERPMap(),
+		DERPForceWebSockets: api.DeploymentValues.DERP.Config.ForceWebSockets.Value(),
+		Logger:              api.Logger.Named("net.tailnet"),
+		BlockEndpoints:      api.DeploymentValues.DERP.Config.BlockDirect.Value(),
 	})
 	if err != nil {
 		_ = clientConn.Close()
@@ -803,6 +976,7 @@ func (api *API) workspaceAgentConnection(rw http.ResponseWriter, r *http.Request
 
 	httpapi.Write(ctx, rw, http.StatusOK, codersdk.WorkspaceAgentConnectionInfo{
 		DERPMap:                  api.DERPMap(),
+		DERPForceWebSockets:      api.DeploymentValues.DERP.Config.ForceWebSockets.Value(),
 		DisableDirectConnections: api.DeploymentValues.DERP.Config.BlockDirect.Value(),
 	})
 }
@@ -823,6 +997,7 @@ func (api *API) workspaceAgentConnectionGeneric(rw http.ResponseWriter, r *http.
 
 	httpapi.Write(ctx, rw, http.StatusOK, codersdk.WorkspaceAgentConnectionInfo{
 		DERPMap:                  api.DERPMap(),
+		DERPForceWebSockets:      api.DeploymentValues.DERP.Config.ForceWebSockets.Value(),
 		DisableDirectConnections: api.DeploymentValues.DERP.Config.BlockDirect.Value(),
 	})
 }
@@ -849,13 +1024,15 @@ func (api *API) derpMapUpdates(rw http.ResponseWriter, r *http.Request) {
 		})
 		return
 	}
-	nconn := websocket.NetConn(ctx, ws, websocket.MessageBinary)
+	ctx, nconn := websocketNetConn(ctx, ws, websocket.MessageBinary)
 	defer nconn.Close()
 
 	// Slurp all packets from the connection into io.Discard so pongs get sent
-	// by the websocket package.
+	// by the websocket package. We don't do any reads ourselves so this is
+	// necessary.
 	go func() {
 		_, _ = io.Copy(io.Discard, nconn)
+		_ = nconn.Close()
 	}()
 
 	go func(ctx context.Context) {
@@ -870,13 +1047,11 @@ func (api *API) derpMapUpdates(rw http.ResponseWriter, r *http.Request) {
 				return
 			}
 
-			// We don't need a context that times out here because the ping will
-			// eventually go through. If the context times out, then other
-			// websocket read operations will receive an error, obfuscating the
-			// actual problem.
+			ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
 			err := ws.Ping(ctx)
+			cancel()
 			if err != nil {
-				_ = ws.Close(websocket.StatusInternalError, err.Error())
+				_ = nconn.Close()
 				return
 			}
 		}
@@ -891,7 +1066,7 @@ func (api *API) derpMapUpdates(rw http.ResponseWriter, r *http.Request) {
 		if lastDERPMap == nil || !tailnet.CompareDERPMaps(lastDERPMap, derpMap) {
 			err := json.NewEncoder(nconn).Encode(derpMap)
 			if err != nil {
-				_ = ws.Close(websocket.StatusInternalError, err.Error())
+				_ = nconn.Close()
 				return
 			}
 			lastDERPMap = derpMap
@@ -1030,12 +1205,12 @@ func (api *API) workspaceAgentCoordinate(rw http.ResponseWriter, r *http.Request
 	firstConnectedAt := workspaceAgent.FirstConnectedAt
 	if !firstConnectedAt.Valid {
 		firstConnectedAt = sql.NullTime{
-			Time:  database.Now(),
+			Time:  dbtime.Now(),
 			Valid: true,
 		}
 	}
 	lastConnectedAt := sql.NullTime{
-		Time:  database.Now(),
+		Time:  dbtime.Now(),
 		Valid: true,
 	}
 	disconnectedAt := workspaceAgent.DisconnectedAt
@@ -1046,7 +1221,7 @@ func (api *API) workspaceAgentCoordinate(rw http.ResponseWriter, r *http.Request
 			FirstConnectedAt: firstConnectedAt,
 			LastConnectedAt:  lastConnectedAt,
 			DisconnectedAt:   disconnectedAt,
-			UpdatedAt:        database.Now(),
+			UpdatedAt:        dbtime.Now(),
 			LastConnectedReplicaID: uuid.NullUUID{
 				UUID:  api.ID,
 				Valid: true,
@@ -1074,7 +1249,7 @@ func (api *API) workspaceAgentCoordinate(rw http.ResponseWriter, r *http.Request
 		// Only update timestamp if the disconnect is new.
 		if !disconnectedAt.Valid {
 			disconnectedAt = sql.NullTime{
-				Time:  database.Now(),
+				Time:  dbtime.Now(),
 				Valid: true,
 			}
 		}
@@ -1139,7 +1314,7 @@ func (api *API) workspaceAgentCoordinate(rw http.ResponseWriter, r *http.Request
 			if !disconnectedAt.Valid {
 				connectionStatusChanged = true
 				disconnectedAt = sql.NullTime{
-					Time:  database.Now(),
+					Time:  dbtime.Now(),
 					Valid: true,
 				}
 			}
@@ -1148,7 +1323,7 @@ func (api *API) workspaceAgentCoordinate(rw http.ResponseWriter, r *http.Request
 			// TODO(mafredri): Should we update it here or allow lastConnectedAt to shadow it?
 			disconnectedAt = sql.NullTime{}
 			lastConnectedAt = sql.NullTime{
-				Time:  database.Now(),
+				Time:  dbtime.Now(),
 				Valid: true,
 			}
 		}
@@ -1227,19 +1402,44 @@ func (api *API) workspaceAgentClientCoordinate(rw http.ResponseWriter, r *http.R
 	}
 }
 
-func convertApps(dbApps []database.WorkspaceApp) []codersdk.WorkspaceApp {
+// convertProvisionedApps converts applications that are in the middle of provisioning process.
+// It means that they may not have an agent or workspace assigned (dry-run job).
+func convertProvisionedApps(dbApps []database.WorkspaceApp) []codersdk.WorkspaceApp {
+	return convertApps(dbApps, database.WorkspaceAgent{}, "", database.Workspace{})
+}
+
+func convertApps(dbApps []database.WorkspaceApp, agent database.WorkspaceAgent, ownerName string, workspace database.Workspace) []codersdk.WorkspaceApp {
 	apps := make([]codersdk.WorkspaceApp, 0)
 	for _, dbApp := range dbApps {
+		var subdomainName string
+		if dbApp.Subdomain && agent.Name != "" && ownerName != "" && workspace.Name != "" {
+			appSlug := dbApp.Slug
+			if appSlug == "" {
+				appSlug = dbApp.DisplayName
+			}
+			subdomainName = httpapi.ApplicationURL{
+				// We never generate URLs with a prefix. We only allow prefixes
+				// when parsing URLs from the hostname. Users that want this
+				// feature can write out their own URLs.
+				Prefix:        "",
+				AppSlugOrPort: appSlug,
+				AgentName:     agent.Name,
+				WorkspaceName: workspace.Name,
+				Username:      ownerName,
+			}.String()
+		}
+
 		apps = append(apps, codersdk.WorkspaceApp{
-			ID:           dbApp.ID,
-			URL:          dbApp.Url.String,
-			External:     dbApp.External,
-			Slug:         dbApp.Slug,
-			DisplayName:  dbApp.DisplayName,
-			Command:      dbApp.Command.String,
-			Icon:         dbApp.Icon,
-			Subdomain:    dbApp.Subdomain,
-			SharingLevel: codersdk.WorkspaceAppSharingLevel(dbApp.SharingLevel),
+			ID:            dbApp.ID,
+			URL:           dbApp.Url.String,
+			External:      dbApp.External,
+			Slug:          dbApp.Slug,
+			DisplayName:   dbApp.DisplayName,
+			Command:       dbApp.Command.String,
+			Icon:          dbApp.Icon,
+			Subdomain:     dbApp.Subdomain,
+			SubdomainName: subdomainName,
+			SharingLevel:  codersdk.WorkspaceAppSharingLevel(dbApp.SharingLevel),
 			Healthcheck: codersdk.Healthcheck{
 				URL:       dbApp.HealthcheckUrl,
 				Interval:  dbApp.HealthcheckInterval,
@@ -1251,6 +1451,37 @@ func convertApps(dbApps []database.WorkspaceApp) []codersdk.WorkspaceApp {
 	return apps
 }
 
+func convertLogSources(dbLogSources []database.WorkspaceAgentLogSource) []codersdk.WorkspaceAgentLogSource {
+	logSources := make([]codersdk.WorkspaceAgentLogSource, 0)
+	for _, dbLogSource := range dbLogSources {
+		logSources = append(logSources, codersdk.WorkspaceAgentLogSource{
+			ID:               dbLogSource.ID,
+			DisplayName:      dbLogSource.DisplayName,
+			WorkspaceAgentID: dbLogSource.WorkspaceAgentID,
+			CreatedAt:        dbLogSource.CreatedAt,
+			Icon:             dbLogSource.Icon,
+		})
+	}
+	return logSources
+}
+
+func convertScripts(dbScripts []database.WorkspaceAgentScript) []codersdk.WorkspaceAgentScript {
+	scripts := make([]codersdk.WorkspaceAgentScript, 0)
+	for _, dbScript := range dbScripts {
+		scripts = append(scripts, codersdk.WorkspaceAgentScript{
+			LogPath:          dbScript.LogPath,
+			LogSourceID:      dbScript.LogSourceID,
+			Script:           dbScript.Script,
+			Cron:             dbScript.Cron,
+			RunOnStart:       dbScript.RunOnStart,
+			RunOnStop:        dbScript.RunOnStop,
+			StartBlocksLogin: dbScript.StartBlocksLogin,
+			Timeout:          time.Duration(dbScript.TimeoutSeconds) * time.Second,
+		})
+	}
+	return scripts
+}
+
 func convertWorkspaceAgentMetadataDesc(mds []database.WorkspaceAgentMetadatum) []codersdk.WorkspaceAgentMetadataDescription {
 	metadata := make([]codersdk.WorkspaceAgentMetadataDescription, 0)
 	for _, datum := range mds {
@@ -1265,7 +1496,10 @@ func convertWorkspaceAgentMetadataDesc(mds []database.WorkspaceAgentMetadatum) [
 	return metadata
 }
 
-func convertWorkspaceAgent(derpMap *tailcfg.DERPMap, coordinator tailnet.Coordinator, dbAgent database.WorkspaceAgent, apps []codersdk.WorkspaceApp, agentInactiveDisconnectTimeout time.Duration, agentFallbackTroubleshootingURL string) (codersdk.WorkspaceAgent, error) {
+func convertWorkspaceAgent(derpMap *tailcfg.DERPMap, coordinator tailnet.Coordinator,
+	dbAgent database.WorkspaceAgent, apps []codersdk.WorkspaceApp, scripts []codersdk.WorkspaceAgentScript, logSources []codersdk.WorkspaceAgentLogSource,
+	agentInactiveDisconnectTimeout time.Duration, agentFallbackTroubleshootingURL string,
+) (codersdk.WorkspaceAgent, error) {
 	var envs map[string]string
 	if dbAgent.EnvironmentVariables.Valid {
 		err := json.Unmarshal(dbAgent.EnvironmentVariables.RawMessage, &envs)
@@ -1277,32 +1511,46 @@ func convertWorkspaceAgent(derpMap *tailcfg.DERPMap, coordinator tailnet.Coordin
 	if dbAgent.TroubleshootingURL != "" {
 		troubleshootingURL = dbAgent.TroubleshootingURL
 	}
+	subsystems := make([]codersdk.AgentSubsystem, len(dbAgent.Subsystems))
+	for i, subsystem := range dbAgent.Subsystems {
+		subsystems[i] = codersdk.AgentSubsystem(subsystem)
+	}
+
+	legacyStartupScriptBehavior := codersdk.WorkspaceAgentStartupScriptBehaviorNonBlocking
+	for _, script := range scripts {
+		if !script.RunOnStart {
+			continue
+		}
+		if !script.StartBlocksLogin {
+			continue
+		}
+		legacyStartupScriptBehavior = codersdk.WorkspaceAgentStartupScriptBehaviorBlocking
+	}
+
 	workspaceAgent := codersdk.WorkspaceAgent{
-		ID:                           dbAgent.ID,
-		CreatedAt:                    dbAgent.CreatedAt,
-		UpdatedAt:                    dbAgent.UpdatedAt,
-		ResourceID:                   dbAgent.ResourceID,
-		InstanceID:                   dbAgent.AuthInstanceID.String,
-		Name:                         dbAgent.Name,
-		Architecture:                 dbAgent.Architecture,
-		OperatingSystem:              dbAgent.OperatingSystem,
-		StartupScript:                dbAgent.StartupScript.String,
-		StartupScriptBehavior:        codersdk.WorkspaceAgentStartupScriptBehavior(dbAgent.StartupScriptBehavior),
-		StartupScriptTimeoutSeconds:  dbAgent.StartupScriptTimeoutSeconds,
-		LogsLength:                   dbAgent.LogsLength,
-		LogsOverflowed:               dbAgent.LogsOverflowed,
-		Version:                      dbAgent.Version,
-		EnvironmentVariables:         envs,
-		Directory:                    dbAgent.Directory,
-		ExpandedDirectory:            dbAgent.ExpandedDirectory,
-		Apps:                         apps,
-		ConnectionTimeoutSeconds:     dbAgent.ConnectionTimeoutSeconds,
-		TroubleshootingURL:           troubleshootingURL,
-		LifecycleState:               codersdk.WorkspaceAgentLifecycle(dbAgent.LifecycleState),
-		LoginBeforeReady:             dbAgent.StartupScriptBehavior != database.StartupScriptBehaviorBlocking,
-		ShutdownScript:               dbAgent.ShutdownScript.String,
-		ShutdownScriptTimeoutSeconds: dbAgent.ShutdownScriptTimeoutSeconds,
-		Subsystem:                    codersdk.AgentSubsystem(dbAgent.Subsystem),
+		ID:                       dbAgent.ID,
+		CreatedAt:                dbAgent.CreatedAt,
+		UpdatedAt:                dbAgent.UpdatedAt,
+		ResourceID:               dbAgent.ResourceID,
+		InstanceID:               dbAgent.AuthInstanceID.String,
+		Name:                     dbAgent.Name,
+		Architecture:             dbAgent.Architecture,
+		OperatingSystem:          dbAgent.OperatingSystem,
+		Scripts:                  scripts,
+		StartupScriptBehavior:    legacyStartupScriptBehavior,
+		LogsLength:               dbAgent.LogsLength,
+		LogsOverflowed:           dbAgent.LogsOverflowed,
+		LogSources:               logSources,
+		Version:                  dbAgent.Version,
+		EnvironmentVariables:     envs,
+		Directory:                dbAgent.Directory,
+		ExpandedDirectory:        dbAgent.ExpandedDirectory,
+		Apps:                     apps,
+		ConnectionTimeoutSeconds: dbAgent.ConnectionTimeoutSeconds,
+		TroubleshootingURL:       troubleshootingURL,
+		LifecycleState:           codersdk.WorkspaceAgentLifecycle(dbAgent.LifecycleState),
+		Subsystems:               subsystems,
+		DisplayApps:              convertDisplayApps(dbAgent.DisplayApps),
 	}
 	node := coordinator.Node(dbAgent.ID)
 	if node != nil {
@@ -1364,6 +1612,18 @@ func convertWorkspaceAgent(derpMap *tailcfg.DERPMap, coordinator tailnet.Coordin
 	return workspaceAgent, nil
 }
 
+func convertDisplayApps(apps []database.DisplayApp) []codersdk.DisplayApp {
+	dapps := make([]codersdk.DisplayApp, 0, len(apps))
+	for _, app := range apps {
+		switch codersdk.DisplayApp(app) {
+		case codersdk.DisplayAppVSCodeDesktop, codersdk.DisplayAppVSCodeInsiders, codersdk.DisplayAppPortForward, codersdk.DisplayAppWebTerminal, codersdk.DisplayAppSSH:
+			dapps = append(dapps, codersdk.DisplayApp(app))
+		}
+	}
+
+	return dapps
+}
+
 // @Summary Submit workspace agent stats
 // @ID submit-workspace-agent-stats
 // @Security CoderSessionToken
@@ -1410,36 +1670,12 @@ func (api *API) workspaceAgentReportStats(rw http.ResponseWriter, r *http.Reques
 		activityBumpWorkspace(ctx, api.Logger.Named("activity_bump"), api.Database, workspace.ID)
 	}
 
-	payload, err := json.Marshal(req.ConnectionsByProto)
-	if err != nil {
-		api.Logger.Error(ctx, "marshal agent connections by proto", slog.F("workspace_agent_id", workspaceAgent.ID), slog.Error(err))
-		payload = json.RawMessage("{}")
-	}
-
-	now := database.Now()
+	now := dbtime.Now()
 
 	var errGroup errgroup.Group
 	errGroup.Go(func() error {
-		_, err = api.Database.InsertWorkspaceAgentStat(ctx, database.InsertWorkspaceAgentStatParams{
-			ID:                          uuid.New(),
-			CreatedAt:                   now,
-			AgentID:                     workspaceAgent.ID,
-			WorkspaceID:                 workspace.ID,
-			UserID:                      workspace.OwnerID,
-			TemplateID:                  workspace.TemplateID,
-			ConnectionsByProto:          payload,
-			ConnectionCount:             req.ConnectionCount,
-			RxPackets:                   req.RxPackets,
-			RxBytes:                     req.RxBytes,
-			TxPackets:                   req.TxPackets,
-			TxBytes:                     req.TxBytes,
-			SessionCountVSCode:          req.SessionCountVSCode,
-			SessionCountJetBrains:       req.SessionCountJetBrains,
-			SessionCountReconnectingPTY: req.SessionCountReconnectingPTY,
-			SessionCountSSH:             req.SessionCountSSH,
-			ConnectionMedianLatencyMS:   req.ConnectionMedianLatencyMS,
-		})
-		if err != nil {
+		if err := api.statsBatcher.Add(time.Now(), workspaceAgent.ID, workspace.TemplateID, workspace.OwnerID, workspace.ID, req); err != nil {
+			api.Logger.Error(ctx, "failed to add stats to batcher", slog.Error(err))
 			return xerrors.Errorf("can't insert workspace agent stat: %w", err)
 		}
 		return nil
@@ -1476,15 +1712,21 @@ func (api *API) workspaceAgentReportStats(rw http.ResponseWriter, r *http.Reques
 	})
 }
 
+func ellipse(v string, n int) string {
+	if len(v) > n {
+		return v[:n] + "..."
+	}
+	return v
+}
+
 // @Summary Submit workspace agent metadata
 // @ID submit-workspace-agent-metadata
 // @Security CoderSessionToken
 // @Accept json
 // @Tags Agents
-// @Param request body agentsdk.PostMetadataRequest true "Workspace agent metadata request"
-// @Param key path string true "metadata key" format(string)
+// @Param request body []agentsdk.PostMetadataRequest true "Workspace agent metadata request"
 // @Success 204 "Success"
-// @Router /workspaceagents/me/metadata/{key} [post]
+// @Router /workspaceagents/me/metadata [post]
 // @x-apidocgen {"skip": true}
 func (api *API) workspaceAgentPostMetadata(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
@@ -1496,67 +1738,88 @@ func (api *API) workspaceAgentPostMetadata(rw http.ResponseWriter, r *http.Reque
 
 	workspaceAgent := httpmw.WorkspaceAgent(r)
 
-	workspace, err := api.Database.GetWorkspaceByAgentID(ctx, workspaceAgent.ID)
+	// Split into function to allow call by deprecated handler.
+	err := api.workspaceAgentUpdateMetadata(ctx, workspaceAgent, req)
 	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "Failed to get workspace.",
-			Detail:  err.Error(),
-		})
+		api.Logger.Error(ctx, "failed to handle metadata request", slog.Error(err))
+		httpapi.InternalServerError(rw, err)
 		return
 	}
 
-	key := chi.URLParam(r, "key")
+	httpapi.Write(ctx, rw, http.StatusNoContent, nil)
+}
 
+func (api *API) workspaceAgentUpdateMetadata(ctx context.Context, workspaceAgent database.WorkspaceAgent, req agentsdk.PostMetadataRequest) error {
 	const (
-		maxValueLen = 32 << 10
+		// maxValueLen is set to 2048 to stay under the 8000 byte Postgres
+		// NOTIFY limit. Since both value and error can be set, the real
+		// payload limit is 2 * 2048 * 4/3 <base64 expansion> = 5461 bytes + a few hundred bytes for JSON
+		// syntax, key names, and metadata.
+		maxValueLen = 2048
 		maxErrorLen = maxValueLen
 	)
 
-	metadataError := req.Error
+	collectedAt := time.Now()
 
-	// We overwrite the error if the provided payload is too long.
-	if len(req.Value) > maxValueLen {
-		metadataError = fmt.Sprintf("value of %d bytes exceeded %d bytes", len(req.Value), maxValueLen)
-		req.Value = req.Value[:maxValueLen]
+	datum := database.UpdateWorkspaceAgentMetadataParams{
+		WorkspaceAgentID: workspaceAgent.ID,
+		Key:              []string{},
+		Value:            []string{},
+		Error:            []string{},
+		CollectedAt:      []time.Time{},
 	}
 
-	if len(req.Error) > maxErrorLen {
-		metadataError = fmt.Sprintf("error of %d bytes exceeded %d bytes", len(req.Error), maxErrorLen)
-		req.Error = req.Error[:maxErrorLen]
-	}
+	for _, md := range req.Metadata {
+		metadataError := md.Error
+
+		// We overwrite the error if the provided payload is too long.
+		if len(md.Value) > maxValueLen {
+			metadataError = fmt.Sprintf("value of %d bytes exceeded %d bytes", len(md.Value), maxValueLen)
+			md.Value = md.Value[:maxValueLen]
+		}
+
+		if len(md.Error) > maxErrorLen {
+			metadataError = fmt.Sprintf("error of %d bytes exceeded %d bytes", len(md.Error), maxErrorLen)
+			md.Error = md.Error[:maxErrorLen]
+		}
 
-	datum := database.UpdateWorkspaceAgentMetadataParams{
-		WorkspaceAgentID: workspaceAgent.ID,
 		// We don't want a misconfigured agent to fill the database.
-		Key:   key,
-		Value: req.Value,
-		Error: metadataError,
+		datum.Key = append(datum.Key, md.Key)
+		datum.Value = append(datum.Value, md.Value)
+		datum.Error = append(datum.Error, metadataError)
 		// We ignore the CollectedAt from the agent to avoid bugs caused by
 		// clock skew.
-		CollectedAt: time.Now(),
+		datum.CollectedAt = append(datum.CollectedAt, collectedAt)
+
+		api.Logger.Debug(
+			ctx, "accepted metadata report",
+			slog.F("workspace_agent_id", workspaceAgent.ID),
+			slog.F("collected_at", collectedAt),
+			slog.F("original_collected_at", md.CollectedAt),
+			slog.F("key", md.Key),
+			slog.F("value", ellipse(md.Value, 16)),
+		)
 	}
 
-	err = api.Database.UpdateWorkspaceAgentMetadata(ctx, datum)
+	payload, err := json.Marshal(workspaceAgentMetadataChannelPayload{
+		CollectedAt: collectedAt,
+		Keys:        datum.Key,
+	})
 	if err != nil {
-		httpapi.InternalServerError(rw, err)
-		return
+		return err
 	}
 
-	api.Logger.Debug(
-		ctx, "accepted metadata report",
-		slog.F("workspace_agent_id", workspaceAgent.ID),
-		slog.F("workspace_id", workspace.ID),
-		slog.F("collected_at", datum.CollectedAt),
-		slog.F("key", datum.Key),
-	)
+	err = api.Database.UpdateWorkspaceAgentMetadata(ctx, datum)
+	if err != nil {
+		return err
+	}
 
-	err = api.Pubsub.Publish(watchWorkspaceAgentMetadataChannel(workspaceAgent.ID), []byte(datum.Key))
+	err = api.Pubsub.Publish(watchWorkspaceAgentMetadataChannel(workspaceAgent.ID), payload)
 	if err != nil {
-		httpapi.InternalServerError(rw, err)
-		return
+		return err
 	}
 
-	httpapi.Write(ctx, rw, http.StatusNoContent, nil)
+	return nil
 }
 
 // @Summary Watch for workspace agent metadata updates
@@ -1571,9 +1834,50 @@ func (api *API) watchWorkspaceAgentMetadata(rw http.ResponseWriter, r *http.Requ
 	var (
 		ctx            = r.Context()
 		workspaceAgent = httpmw.WorkspaceAgentParam(r)
+		log            = api.Logger.Named("workspace_metadata_watcher").With(
+			slog.F("workspace_agent_id", workspaceAgent.ID),
+		)
 	)
 
-	sendEvent, senderClosed, err := httpapi.ServerSentEventSender(rw, r)
+	// Send metadata on updates, we must ensure subscription before sending
+	// initial metadata to guarantee that events in-between are not missed.
+	update := make(chan workspaceAgentMetadataChannelPayload, 1)
+	cancelSub, err := api.Pubsub.Subscribe(watchWorkspaceAgentMetadataChannel(workspaceAgent.ID), func(_ context.Context, byt []byte) {
+		var payload workspaceAgentMetadataChannelPayload
+		err := json.Unmarshal(byt, &payload)
+		if err != nil {
+			api.Logger.Error(ctx, "failed to unmarshal pubsub message", slog.Error(err))
+			return
+		}
+
+		log.Debug(ctx, "received metadata update", "payload", payload)
+
+		select {
+		case prev := <-update:
+			// This update wasn't consumed yet, merge the keys.
+			newKeysSet := make(map[string]struct{})
+			for _, key := range payload.Keys {
+				newKeysSet[key] = struct{}{}
+			}
+			keys := prev.Keys
+			for _, key := range prev.Keys {
+				if _, ok := newKeysSet[key]; !ok {
+					keys = append(keys, key)
+				}
+			}
+			payload.Keys = keys
+		default:
+		}
+		// This can never block since we pop and merge beforehand.
+		update <- payload
+	})
+	if err != nil {
+		httpapi.InternalServerError(rw, err)
+		return
+	}
+	defer cancelSub()
+
+	sseSendEvent, sseSenderClosed, err := httpapi.ServerSentEventSender(rw, r)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 			Message: "Internal error setting up server-sent events.",
@@ -1583,87 +1887,101 @@ func (api *API) watchWorkspaceAgentMetadata(rw http.ResponseWriter, r *http.Requ
 	}
 	// Prevent handler from returning until the sender is closed.
 	defer func() {
-		<-senderClosed
+		<-sseSenderClosed
 	}()
 
-	const refreshInterval = time.Second * 5
-	refreshTicker := time.NewTicker(refreshInterval)
-	defer refreshTicker.Stop()
-
-	var (
-		lastDBMetaMu sync.Mutex
-		lastDBMeta   []database.WorkspaceAgentMetadatum
-	)
-
-	sendMetadata := func(pull bool) {
-		lastDBMetaMu.Lock()
-		defer lastDBMetaMu.Unlock()
-
-		var err error
-		if pull {
-			// We always use the original Request context because it contains
-			// the RBAC actor.
-			lastDBMeta, err = api.Database.GetWorkspaceAgentMetadata(ctx, workspaceAgent.ID)
-			if err != nil {
-				_ = sendEvent(ctx, codersdk.ServerSentEvent{
-					Type: codersdk.ServerSentEventTypeError,
-					Data: codersdk.Response{
-						Message: "Internal error getting metadata.",
-						Detail:  err.Error(),
-					},
-				})
-				return
-			}
-			slices.SortFunc(lastDBMeta, func(i, j database.WorkspaceAgentMetadatum) bool {
-				return i.Key < j.Key
-			})
-
-			// Avoid sending refresh if the client is about to get a
-			// fresh update.
-			refreshTicker.Reset(refreshInterval)
-		}
-
-		_ = sendEvent(ctx, codersdk.ServerSentEvent{
-			Type: codersdk.ServerSentEventTypeData,
-			Data: convertWorkspaceAgentMetadata(lastDBMeta),
-		})
+	// We always use the original Request context because it contains
+	// the RBAC actor.
+	md, err := api.Database.GetWorkspaceAgentMetadata(ctx, database.GetWorkspaceAgentMetadataParams{
+		WorkspaceAgentID: workspaceAgent.ID,
+		Keys:             nil,
+	})
+	if err != nil {
+		// If we can't successfully pull the initial metadata, pubsub
+		// updates will be no-op so we may as well terminate the
+		// connection early.
+		httpapi.InternalServerError(rw, err)
+		return
 	}
 
-	// We debounce metadata updates to avoid overloading the frontend when
-	// an agent is sending a lot of updates.
-	pubsubDebounce := debounce.New(time.Second)
-	if flag.Lookup("test.v") != nil {
-		pubsubDebounce = debounce.New(time.Millisecond * 100)
+	metadataMap := make(map[string]database.WorkspaceAgentMetadatum)
+	for _, datum := range md {
+		metadataMap[datum.Key] = datum
 	}
 
-	// Send metadata on updates, we must ensure subscription before sending
-	// initial metadata to guarantee that events in-between are not missed.
-	cancelSub, err := api.Pubsub.Subscribe(watchWorkspaceAgentMetadataChannel(workspaceAgent.ID), func(_ context.Context, _ []byte) {
-		pubsubDebounce(func() {
-			sendMetadata(true)
+	var lastSend time.Time
+	sendMetadata := func() {
+		lastSend = time.Now()
+		values := maps.Values(metadataMap)
+		_ = sseSendEvent(ctx, codersdk.ServerSentEvent{
+			Type: codersdk.ServerSentEventTypeData,
+			Data: convertWorkspaceAgentMetadata(values),
 		})
-	})
-	if err != nil {
-		httpapi.InternalServerError(rw, err)
-		return
 	}
-	defer cancelSub()
+
+	// We send updates exactly every second.
+	const sendInterval = time.Second * 1
+	sendTicker := time.NewTicker(sendInterval)
+	defer sendTicker.Stop()
 
 	// Send initial metadata.
-	sendMetadata(true)
+	sendMetadata()
+
+	// Fetch updated metadata keys as they come in.
+	fetchedMetadata := make(chan []database.WorkspaceAgentMetadatum)
+	go func() {
+		defer close(fetchedMetadata)
 
+		for {
+			select {
+			case <-sseSenderClosed:
+				return
+			case payload := <-update:
+				md, err := api.Database.GetWorkspaceAgentMetadata(ctx, database.GetWorkspaceAgentMetadataParams{
+					WorkspaceAgentID: workspaceAgent.ID,
+					Keys:             payload.Keys,
+				})
+				if err != nil {
+					if !errors.Is(err, context.Canceled) {
+						log.Error(ctx, "failed to get metadata", slog.Error(err))
+					}
+					return
+				}
+				select {
+				case <-sseSenderClosed:
+					return
+				// We want to block here to avoid constantly pinging the
+				// database when the metadata isn't being processed.
+				case fetchedMetadata <- md:
+				}
+			}
+		}
+	}()
+
+	pendingChanges := true
 	for {
 		select {
-		case <-senderClosed:
+		case <-sseSenderClosed:
 			return
-		case <-refreshTicker.C:
+		case md, ok := <-fetchedMetadata:
+			if !ok {
+				return
+			}
+			for _, datum := range md {
+				metadataMap[datum.Key] = datum
+			}
+			pendingChanges = true
+			continue
+		case <-sendTicker.C:
+			// We send an update even if there's no change every 5 seconds
+			// to ensure that the frontend always has an accurate "Result.Age".
+			if !pendingChanges && time.Since(lastSend) < 5*time.Second {
+				continue
+			}
+			pendingChanges = false
 		}
 
-		// Avoid spamming the DB with reads we know there are no updates. We want
-		// to continue sending updates to the frontend so that "Result.Age"
-		// is always accurate. This way, the frontend doesn't need to
-		// sync its own clock with the backend.
-		sendMetadata(false)
+		sendMetadata()
 	}
 }
 
@@ -1675,7 +1993,7 @@ func convertWorkspaceAgentMetadata(db []database.WorkspaceAgentMetadatum) []code
 			Result: codersdk.WorkspaceAgentMetadataResult{
 				Value:       datum.Value,
 				Error:       datum.Error,
-				CollectedAt: datum.CollectedAt,
+				CollectedAt: datum.CollectedAt.UTC(),
 				Age:         int64(time.Since(datum.CollectedAt).Seconds()),
 			},
 			Description: codersdk.WorkspaceAgentMetadataDescription{
@@ -1687,9 +2005,18 @@ func convertWorkspaceAgentMetadata(db []database.WorkspaceAgentMetadatum) []code
 			},
 		})
 	}
+	// Sorting prevents the metadata from jumping around in the frontend.
+	sort.Slice(result, func(i, j int) bool {
+		return result[i].Description.Key < result[j].Description.Key
+	})
 	return result
 }
 
+type workspaceAgentMetadataChannelPayload struct {
+	CollectedAt time.Time `json:"collected_at"`
+	Keys        []string  `json:"keys"`
+}
+
 func watchWorkspaceAgentMetadataChannel(id uuid.UUID) string {
 	return "workspace_agent_metadata:" + id.String()
 }
@@ -1740,7 +2067,7 @@ func (api *API) workspaceAgentReportLifecycle(rw http.ResponseWriter, r *http.Re
 
 	if req.ChangedAt.IsZero() {
 		// Backwards compatibility with older agents.
-		req.ChangedAt = database.Now()
+		req.ChangedAt = dbtime.Now()
 	}
 	changedAt := sql.NullTime{Time: req.ChangedAt, Valid: true}
 
@@ -1761,7 +2088,10 @@ func (api *API) workspaceAgentReportLifecycle(rw http.ResponseWriter, r *http.Re
 		ReadyAt:        readyAt,
 	})
 	if err != nil {
-		logger.Error(ctx, "failed to update lifecycle state", slog.Error(err))
+		if !xerrors.Is(err, context.Canceled) {
+			// not an error if we are canceled
+			logger.Error(ctx, "failed to update lifecycle state", slog.Error(err))
+		}
 		httpapi.InternalServerError(rw, err)
 		return
 	}
@@ -1895,42 +2225,76 @@ func (api *API) postWorkspaceAppHealth(rw http.ResponseWriter, r *http.Request)
 	httpapi.Write(ctx, rw, http.StatusOK, nil)
 }
 
-// workspaceAgentsGitAuth returns a username and password for use
-// with GIT_ASKPASS.
+// workspaceAgentsExternalAuth returns an access token for a given URL
+// or finds a provider by ID.
 //
-// @Summary Get workspace agent Git auth
-// @ID get-workspace-agent-git-auth
+// @Summary Get workspace agent external auth
+// @ID get-workspace-agent-external-auth
 // @Security CoderSessionToken
 // @Produce json
 // @Tags Agents
-// @Param url query string true "Git URL" format(uri)
+// @Param match query string true "Match"
+// @Param id query string true "Provider ID"
 // @Param listen query bool false "Wait for a new token to be issued"
-// @Success 200 {object} agentsdk.GitAuthResponse
-// @Router /workspaceagents/me/gitauth [get]
-func (api *API) workspaceAgentsGitAuth(rw http.ResponseWriter, r *http.Request) {
+// @Success 200 {object} agentsdk.ExternalAuthResponse
+// @Router /workspaceagents/me/external-auth [get]
+func (api *API) workspaceAgentsExternalAuth(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
-	gitURL := r.URL.Query().Get("url")
-	if gitURL == "" {
+	query := r.URL.Query()
+	// Either match or configID must be provided!
+	match := query.Get("match")
+	if match == "" {
+		// Support legacy agents!
+		match = query.Get("url")
+	}
+	id := query.Get("id")
+	if match == "" && id == "" {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "Missing 'url' query parameter!",
+			Message: "'url' or 'id' must be provided!",
 		})
 		return
 	}
+	if match != "" && id != "" {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "'url' and 'id' cannot be provided together!",
+		})
+		return
+	}
+
 	// listen determines if the request will wait for a
 	// new token to be issued!
 	listen := r.URL.Query().Has("listen")
 
-	var gitAuthConfig *gitauth.Config
-	for _, gitAuth := range api.GitAuthConfigs {
-		matches := gitAuth.Regex.MatchString(gitURL)
+	var externalAuthConfig *externalauth.Config
+	for _, extAuth := range api.ExternalAuthConfigs {
+		if extAuth.ID == id {
+			externalAuthConfig = extAuth
+			break
+		}
+		if match == "" || extAuth.Regex == nil {
+			continue
+		}
+		matches := extAuth.Regex.MatchString(match)
 		if !matches {
 			continue
 		}
-		gitAuthConfig = gitAuth
-	}
-	if gitAuthConfig == nil {
+		externalAuthConfig = extAuth
+	}
+	if externalAuthConfig == nil {
+		detail := "External auth provider not found."
+		if len(api.ExternalAuthConfigs) > 0 {
+			regexURLs := make([]string, 0, len(api.ExternalAuthConfigs))
+			for _, extAuth := range api.ExternalAuthConfigs {
+				if extAuth.Regex == nil {
+					continue
+				}
+				regexURLs = append(regexURLs, fmt.Sprintf("%s=%q", extAuth.ID, extAuth.Regex.String()))
+			}
+			detail = fmt.Sprintf("The configured external auth provider have regex filters that do not match the url. Provider url regex: %s", strings.Join(regexURLs, ","))
+		}
 		httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{
-			Message: fmt.Sprintf("No git provider found for URL %q", gitURL),
+			Message: fmt.Sprintf("No matching external auth provider found in Coder for the url %q.", match),
+			Detail:  detail,
 		})
 		return
 	}
@@ -1972,8 +2336,8 @@ func (api *API) workspaceAgentsGitAuth(rw http.ResponseWriter, r *http.Request)
 				return
 			case <-ticker.C:
 			}
-			gitAuthLink, err := api.Database.GetGitAuthLink(ctx, database.GetGitAuthLinkParams{
-				ProviderID: gitAuthConfig.ID,
+			externalAuthLink, err := api.Database.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
+				ProviderID: externalAuthConfig.ID,
 				UserID:     workspace.OwnerID,
 			})
 			if err != nil {
@@ -1981,7 +2345,7 @@ func (api *API) workspaceAgentsGitAuth(rw http.ResponseWriter, r *http.Request)
 					continue
 				}
 				httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-					Message: "Failed to get git auth link.",
+					Message: "Failed to get external auth link.",
 					Detail:  err.Error(),
 				})
 				return
@@ -1991,27 +2355,35 @@ func (api *API) workspaceAgentsGitAuth(rw http.ResponseWriter, r *http.Request)
 			// to expire.
 			// See
 			// https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-user-access-token-for-a-github-app.
-			if gitAuthLink.OAuthExpiry.Before(database.Now()) && !gitAuthLink.OAuthExpiry.IsZero() {
+			if externalAuthLink.OAuthExpiry.Before(dbtime.Now()) && !externalAuthLink.OAuthExpiry.IsZero() {
 				continue
 			}
-			valid, _, err := gitAuthConfig.ValidateToken(ctx, gitAuthLink.OAuthAccessToken)
+			valid, _, err := externalAuthConfig.ValidateToken(ctx, externalAuthLink.OAuthAccessToken)
 			if err != nil {
-				api.Logger.Warn(ctx, "failed to validate git auth token",
+				api.Logger.Warn(ctx, "failed to validate external auth token",
 					slog.F("workspace_owner_id", workspace.OwnerID.String()),
-					slog.F("validate_url", gitAuthConfig.ValidateURL),
+					slog.F("validate_url", externalAuthConfig.ValidateURL),
 					slog.Error(err),
 				)
 			}
 			if !valid {
 				continue
 			}
-			httpapi.Write(ctx, rw, http.StatusOK, formatGitAuthAccessToken(gitAuthConfig.Type, gitAuthLink.OAuthAccessToken))
+			resp, err := createExternalAuthResponse(externalAuthConfig.Type, externalAuthLink.OAuthAccessToken, externalAuthLink.OAuthExtra)
+			if err != nil {
+				httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+					Message: "Failed to create external auth response.",
+					Detail:  err.Error(),
+				})
+				return
+			}
+			httpapi.Write(ctx, rw, http.StatusOK, resp)
 			return
 		}
 	}
 
 	// This is the URL that will redirect the user with a state token.
-	redirectURL, err := api.AccessURL.Parse(fmt.Sprintf("/gitauth/%s", gitAuthConfig.ID))
+	redirectURL, err := api.AccessURL.Parse(fmt.Sprintf("/external-auth/%s", externalAuthConfig.ID))
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 			Message: "Failed to parse access URL.",
@@ -2020,64 +2392,81 @@ func (api *API) workspaceAgentsGitAuth(rw http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	gitAuthLink, err := api.Database.GetGitAuthLink(ctx, database.GetGitAuthLinkParams{
-		ProviderID: gitAuthConfig.ID,
+	externalAuthLink, err := api.Database.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
+		ProviderID: externalAuthConfig.ID,
 		UserID:     workspace.OwnerID,
 	})
 	if err != nil {
 		if !errors.Is(err, sql.ErrNoRows) {
 			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-				Message: "Failed to get git auth link.",
+				Message: "Failed to get external auth link.",
 				Detail:  err.Error(),
 			})
 			return
 		}
 
-		httpapi.Write(ctx, rw, http.StatusOK, agentsdk.GitAuthResponse{
+		httpapi.Write(ctx, rw, http.StatusOK, agentsdk.ExternalAuthResponse{
 			URL: redirectURL.String(),
 		})
 		return
 	}
 
-	gitAuthLink, updated, err := gitAuthConfig.RefreshToken(ctx, api.Database, gitAuthLink)
+	externalAuthLink, updated, err := externalAuthConfig.RefreshToken(ctx, api.Database, externalAuthLink)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Failed to refresh git auth token.",
+			Message: "Failed to refresh external auth token.",
 			Detail:  err.Error(),
 		})
 		return
 	}
 	if !updated {
-		httpapi.Write(ctx, rw, http.StatusOK, agentsdk.GitAuthResponse{
+		httpapi.Write(ctx, rw, http.StatusOK, agentsdk.ExternalAuthResponse{
 			URL: redirectURL.String(),
 		})
 		return
 	}
-	httpapi.Write(ctx, rw, http.StatusOK, formatGitAuthAccessToken(gitAuthConfig.Type, gitAuthLink.OAuthAccessToken))
+	resp, err := createExternalAuthResponse(externalAuthConfig.Type, externalAuthLink.OAuthAccessToken, externalAuthLink.OAuthExtra)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Failed to create external auth response.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+	httpapi.Write(ctx, rw, http.StatusOK, resp)
 }
 
-// Provider types have different username/password formats.
-func formatGitAuthAccessToken(typ codersdk.GitProvider, token string) agentsdk.GitAuthResponse {
-	var resp agentsdk.GitAuthResponse
+// createExternalAuthResponse creates an ExternalAuthResponse based on the
+// provider type. This is to support legacy `/workspaceagents/me/gitauth`
+// which uses `Username` and `Password`.
+func createExternalAuthResponse(typ, token string, extra pqtype.NullRawMessage) (agentsdk.ExternalAuthResponse, error) {
+	var resp agentsdk.ExternalAuthResponse
 	switch typ {
-	case codersdk.GitProviderGitLab:
+	case string(codersdk.EnhancedExternalAuthProviderGitLab):
 		// https://stackoverflow.com/questions/25409700/using-gitlab-token-to-clone-without-authentication
-		resp = agentsdk.GitAuthResponse{
+		resp = agentsdk.ExternalAuthResponse{
 			Username: "oauth2",
 			Password: token,
 		}
-	case codersdk.GitProviderBitBucket:
+	case string(codersdk.EnhancedExternalAuthProviderBitBucket):
 		// https://support.atlassian.com/bitbucket-cloud/docs/use-oauth-on-bitbucket-cloud/#Cloning-a-repository-with-an-access-token
-		resp = agentsdk.GitAuthResponse{
+		resp = agentsdk.ExternalAuthResponse{
 			Username: "x-token-auth",
 			Password: token,
 		}
 	default:
-		resp = agentsdk.GitAuthResponse{
+		resp = agentsdk.ExternalAuthResponse{
 			Username: token,
 		}
 	}
-	return resp
+	resp.AccessToken = token
+	resp.Type = typ
+
+	var err error
+	if extra.Valid {
+		err = json.Unmarshal(extra.RawMessage, &resp.TokenExtra)
+	}
+	return resp, err
 }
 
 // wsNetConn wraps net.Conn created by websocket.NetConn(). Cancel func
@@ -2135,14 +2524,27 @@ func convertWorkspaceAgentLog(logEntry database.WorkspaceAgentLog) codersdk.Work
 		CreatedAt: logEntry.CreatedAt,
 		Output:    logEntry.Output,
 		Level:     codersdk.LogLevel(logEntry.Level),
+		SourceID:  logEntry.LogSourceID,
 	}
 }
 
-func convertWorkspaceAgentSubsystem(ss codersdk.AgentSubsystem) database.WorkspaceAgentSubsystem {
-	switch ss {
-	case codersdk.AgentSubsystemEnvbox:
-		return database.WorkspaceAgentSubsystemEnvbox
-	default:
-		return database.WorkspaceAgentSubsystemNone
+func convertWorkspaceAgentSubsystems(ss []codersdk.AgentSubsystem) []database.WorkspaceAgentSubsystem {
+	out := make([]database.WorkspaceAgentSubsystem, 0, len(ss))
+	for _, s := range ss {
+		switch s {
+		case codersdk.AgentSubsystemEnvbox:
+			out = append(out, database.WorkspaceAgentSubsystemEnvbox)
+		case codersdk.AgentSubsystemEnvbuilder:
+			out = append(out, database.WorkspaceAgentSubsystemEnvbuilder)
+		case codersdk.AgentSubsystemExectrace:
+			out = append(out, database.WorkspaceAgentSubsystemExectrace)
+		default:
+			// Invalid, drop it.
+		}
 	}
+
+	sort.Slice(out, func(i, j int) bool {
+		return out[i] < out[j]
+	})
+	return out
 }
diff --git a/coderd/workspaceagents_test.go b/coderd/workspaceagents_test.go
index 12cb19efac012..10028f91fa3f3 100644
--- a/coderd/workspaceagents_test.go
+++ b/coderd/workspaceagents_test.go
@@ -20,15 +20,16 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/tailnet/tailnettest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/tailnet/tailnettest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestWorkspaceAgent(t *testing.T) {
@@ -43,10 +44,10 @@ func TestWorkspaceAgent(t *testing.T) {
 		tmpDir := t.TempDir()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "example",
 							Type: "aws_instance",
@@ -63,17 +64,19 @@ func TestWorkspaceAgent(t *testing.T) {
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+
+		anotherClient, _ := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
+		workspace := coderdtest.CreateWorkspace(t, anotherClient, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, anotherClient, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
-		workspace, err := client.Workspace(ctx, workspace.ID)
+		workspace, err := anotherClient.Workspace(ctx, workspace.ID)
 		require.NoError(t, err)
 		require.Equal(t, tmpDir, workspace.LatestBuild.Resources[0].Agents[0].Directory)
-		_, err = client.WorkspaceAgent(ctx, workspace.LatestBuild.Resources[0].Agents[0].ID)
+		_, err = anotherClient.WorkspaceAgent(ctx, workspace.LatestBuild.Resources[0].Agents[0].ID)
 		require.NoError(t, err)
 		require.True(t, workspace.LatestBuild.Resources[0].Agents[0].Health.Healthy)
 	})
@@ -87,10 +90,10 @@ func TestWorkspaceAgent(t *testing.T) {
 		tmpDir := t.TempDir()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "example",
 							Type: "aws_instance",
@@ -107,9 +110,9 @@ func TestWorkspaceAgent(t *testing.T) {
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
 		defer cancel()
@@ -121,8 +124,11 @@ func TestWorkspaceAgent(t *testing.T) {
 	})
 	t.Run("Timeout", func(t *testing.T) {
 		t.Parallel()
+		// timeouts can cause error logs to be dropped on shutdown
+		logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
 		client := coderdtest.New(t, &coderdtest.Options{
 			IncludeProvisionerDaemon: true,
+			Logger:                   &logger,
 		})
 		user := coderdtest.CreateFirstUser(t, client)
 		authToken := uuid.NewString()
@@ -132,10 +138,10 @@ func TestWorkspaceAgent(t *testing.T) {
 
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "example",
 							Type: "aws_instance",
@@ -154,9 +160,9 @@ func TestWorkspaceAgent(t *testing.T) {
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
 		defer cancel()
@@ -174,9 +180,100 @@ func TestWorkspaceAgent(t *testing.T) {
 		require.False(t, workspace.LatestBuild.Resources[0].Agents[0].Health.Healthy)
 		require.NotEmpty(t, workspace.LatestBuild.Resources[0].Agents[0].Health.Reason)
 	})
+
+	t.Run("DisplayApps", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+		})
+		user := coderdtest.CreateFirstUser(t, client)
+		authToken := uuid.NewString()
+		tmpDir := t.TempDir()
+		apps := &proto.DisplayApps{
+			Vscode:               true,
+			VscodeInsiders:       true,
+			WebTerminal:          true,
+			PortForwardingHelper: true,
+			SshHelper:            true,
+		}
+
+		echoResp := &echo.Responses{
+			Parse:         echo.ParseComplete,
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
+						Resources: []*proto.Resource{
+							{
+								Name: "example",
+								Type: "aws_instance",
+								Agents: []*proto.Agent{
+									{
+										Id:        uuid.NewString(),
+										Directory: tmpDir,
+										Auth: &proto.Agent_Token{
+											Token: authToken,
+										},
+										DisplayApps: apps,
+									},
+								},
+							},
+						},
+					},
+				},
+			}},
+		}
+
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, echoResp)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		workspace, err := client.Workspace(ctx, workspace.ID)
+		require.NoError(t, err)
+		agent, err := client.WorkspaceAgent(ctx, workspace.LatestBuild.Resources[0].Agents[0].ID)
+		require.NoError(t, err)
+		expectedApps := []codersdk.DisplayApp{
+			codersdk.DisplayAppPortForward,
+			codersdk.DisplayAppSSH,
+			codersdk.DisplayAppVSCodeDesktop,
+			codersdk.DisplayAppVSCodeInsiders,
+			codersdk.DisplayAppWebTerminal,
+		}
+		require.ElementsMatch(t, expectedApps, agent.DisplayApps)
+
+		// Flips all the apps to false.
+		apps.PortForwardingHelper = false
+		apps.Vscode = false
+		apps.VscodeInsiders = false
+		apps.SshHelper = false
+		apps.WebTerminal = false
+
+		version = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, echoResp,
+			func(req *codersdk.CreateTemplateVersionRequest) {
+				req.TemplateID = template.ID
+			})
+
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		err = client.UpdateActiveTemplateVersion(ctx, template.ID, codersdk.UpdateActiveTemplateVersion{
+			ID: version.ID,
+		})
+		require.NoError(t, err)
+		// Creating another workspace is just easier.
+		workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+		require.NoError(t, err)
+		agent, err = client.WorkspaceAgent(ctx, build.Resources[0].Agents[0].ID)
+		require.NoError(t, err)
+		require.Len(t, agent.DisplayApps, 0)
+	})
 }
 
-func TestWorkspaceAgentStartupLogs(t *testing.T) {
+func TestWorkspaceAgentLogs(t *testing.T) {
 	t.Parallel()
 	t.Run("Success", func(t *testing.T) {
 		t.Parallel()
@@ -188,10 +285,10 @@ func TestWorkspaceAgentStartupLogs(t *testing.T) {
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "example",
 							Type: "aws_instance",
@@ -207,20 +304,20 @@ func TestWorkspaceAgentStartupLogs(t *testing.T) {
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		agentClient := agentsdk.New(client.URL)
 		agentClient.SetSessionToken(authToken)
 		err := agentClient.PatchLogs(ctx, agentsdk.PatchLogs{
 			Logs: []agentsdk.Log{
 				{
-					CreatedAt: database.Now(),
+					CreatedAt: dbtime.Now(),
 					Output:    "testing",
 				},
 				{
-					CreatedAt: database.Now(),
+					CreatedAt: dbtime.Now(),
 					Output:    "testing2",
 				},
 			},
@@ -242,6 +339,71 @@ func TestWorkspaceAgentStartupLogs(t *testing.T) {
 		require.Equal(t, "testing", logChunk[0].Output)
 		require.Equal(t, "testing2", logChunk[1].Output)
 	})
+	t.Run("Close logs on outdated build", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitMedium)
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+		})
+		user := coderdtest.CreateFirstUser(t, client)
+		authToken := uuid.NewString()
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:         echo.ParseComplete,
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
+						Resources: []*proto.Resource{{
+							Name: "example",
+							Type: "aws_instance",
+							Agents: []*proto.Agent{{
+								Id: uuid.NewString(),
+								Auth: &proto.Agent_Token{
+									Token: authToken,
+								},
+							}},
+						}},
+					},
+				},
+			}},
+		})
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		agentClient := agentsdk.New(client.URL)
+		agentClient.SetSessionToken(authToken)
+		err := agentClient.PatchLogs(ctx, agentsdk.PatchLogs{
+			Logs: []agentsdk.Log{
+				{
+					CreatedAt: dbtime.Now(),
+					Output:    "testing",
+				},
+			},
+		})
+		require.NoError(t, err)
+
+		logs, closer, err := client.WorkspaceAgentLogsAfter(ctx, build.Resources[0].Agents[0].ID, 0, true)
+		require.NoError(t, err)
+		defer func() {
+			_ = closer.Close()
+		}()
+
+		select {
+		case <-ctx.Done():
+			require.FailNow(t, "context done while waiting for first log")
+		case <-logs:
+		}
+
+		_ = coderdtest.CreateWorkspaceBuild(t, client, workspace, database.WorkspaceTransitionStart)
+
+		select {
+		case <-ctx.Done():
+			require.FailNow(t, "context done while waiting for logs close")
+		case <-logs:
+		}
+	})
 	t.Run("PublishesOnOverflow", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitMedium)
@@ -252,10 +414,10 @@ func TestWorkspaceAgentStartupLogs(t *testing.T) {
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "example",
 							Type: "aws_instance",
@@ -271,9 +433,9 @@ func TestWorkspaceAgentStartupLogs(t *testing.T) {
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		updates, err := client.WatchWorkspace(ctx, workspace.ID)
 		require.NoError(t, err)
@@ -282,7 +444,7 @@ func TestWorkspaceAgentStartupLogs(t *testing.T) {
 		agentClient.SetSessionToken(authToken)
 		err = agentClient.PatchLogs(ctx, agentsdk.PatchLogs{
 			Logs: []agentsdk.Log{{
-				CreatedAt: database.Now(),
+				CreatedAt: dbtime.Now(),
 				Output:    strings.Repeat("a", (1<<20)+1),
 			}},
 		})
@@ -319,28 +481,20 @@ func TestWorkspaceAgentListen(t *testing.T) {
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
 			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(authToken)
-		agentCloser := agent.New(agent.Options{
-			Client: agentClient,
-			Logger: slogtest.Make(t, nil).Named("agent").Leveled(slog.LevelDebug),
-		})
-		defer func() {
-			_ = agentCloser.Close()
-		}()
+		_ = agenttest.New(t, client.URL, authToken)
+		resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
-		resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 		conn, err := client.DialWorkspaceAgent(ctx, resources[0].Agents[0].ID, nil)
 		require.NoError(t, err)
 		defer func() {
@@ -360,21 +514,21 @@ func TestWorkspaceAgentListen(t *testing.T) {
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
 			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 		})
 
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		version = coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "example",
 							Type: "aws_instance",
@@ -389,7 +543,7 @@ func TestWorkspaceAgentListen(t *testing.T) {
 				},
 			}},
 		}, template.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -399,14 +553,16 @@ func TestWorkspaceAgentListen(t *testing.T) {
 			Transition:        codersdk.WorkspaceTransitionStop,
 		})
 		require.NoError(t, err)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, stopBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, stopBuild.ID)
 
 		agentClient := agentsdk.New(client.URL)
 		agentClient.SetSessionToken(authToken)
 
 		_, err = agentClient.Listen(ctx)
 		require.Error(t, err)
-		require.ErrorContains(t, err, "build is outdated")
+		var sdkErr *codersdk.Error
+		require.ErrorAs(t, err, &sdkErr)
+		require.Equal(t, http.StatusForbidden, sdkErr.StatusCode())
 	})
 }
 
@@ -417,22 +573,16 @@ func TestWorkspaceAgentTailnet(t *testing.T) {
 	authToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:          echo.ParseComplete,
-		ProvisionPlan:  echo.ProvisionComplete,
+		ProvisionPlan:  echo.PlanComplete,
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	daemonCloser.Close()
 
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: slogtest.Make(t, nil).Named("agent").Leveled(slog.LevelDebug),
-	})
-	defer agentCloser.Close()
+	_ = agenttest.New(t, client.URL, authToken)
 	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 	ctx, cancelFunc := context.WithCancel(context.Background())
@@ -469,13 +619,13 @@ func TestWorkspaceAgentTailnetDirectDisabled(t *testing.T) {
 	authToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:          echo.ParseComplete,
-		ProvisionPlan:  echo.ProvisionComplete,
+		ProvisionPlan:  echo.PlanComplete,
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	daemonCloser.Close()
 
 	ctx := testutil.Context(t, testutil.WaitLong)
@@ -487,11 +637,7 @@ func TestWorkspaceAgentTailnetDirectDisabled(t *testing.T) {
 	require.NoError(t, err)
 	require.True(t, manifest.DisableDirectConnections)
 
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: slogtest.Make(t, nil).Named("agent").Leveled(slog.LevelDebug),
-	})
-	defer agentCloser.Close()
+	_ = agenttest.New(t, client.URL, authToken)
 	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 	agentID := resources[0].Agents[0].ID
 
@@ -546,10 +692,10 @@ func TestWorkspaceAgentListeningPorts(t *testing.T) {
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "example",
 							Type: "aws_instance",
@@ -566,21 +712,12 @@ func TestWorkspaceAgentListeningPorts(t *testing.T) {
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(authToken)
-		agentCloser := agent.New(agent.Options{
-			Client: agentClient,
-			Logger: slogtest.Make(t, nil).Named("agent").Leveled(slog.LevelDebug),
-		})
-		t.Cleanup(func() {
-			_ = agentCloser.Close()
-		})
+		_ = agenttest.New(t, client.URL, authToken)
 		resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
-
 		return client, uint16(coderdPort), resources[0].Agents[0].ID
 	}
 
@@ -804,9 +941,9 @@ func TestWorkspaceAgentAppHealth(t *testing.T) {
 	}
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse: echo.ParseComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "example",
 						Type: "aws_instance",
@@ -822,10 +959,10 @@ func TestWorkspaceAgentAppHealth(t *testing.T) {
 			},
 		}},
 	})
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
@@ -891,13 +1028,13 @@ func TestWorkspaceAgentReportStats(t *testing.T) {
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
 			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		agentClient := agentsdk.New(client.URL)
 		agentClient.SetSessionToken(authToken)
@@ -940,13 +1077,13 @@ func TestWorkspaceAgent_LifecycleState(t *testing.T) {
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
 			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		for _, res := range workspace.LatestBuild.Resources {
 			for _, a := range res.Agents {
@@ -1012,10 +1149,10 @@ func TestWorkspaceAgent_Metadata(t *testing.T) {
 	authToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:         echo.ParseComplete,
-		ProvisionPlan: echo.ProvisionComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionPlan: echo.PlanComplete,
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "example",
 						Type: "aws_instance",
@@ -1054,9 +1191,9 @@ func TestWorkspaceAgent_Metadata(t *testing.T) {
 		}},
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	for _, res := range workspace.LatestBuild.Resources {
 		for _, a := range res.Agents {
@@ -1080,8 +1217,15 @@ func TestWorkspaceAgent_Metadata(t *testing.T) {
 	require.EqualValues(t, 3, manifest.Metadata[0].Timeout)
 
 	post := func(key string, mr codersdk.WorkspaceAgentMetadataResult) {
-		err := agentClient.PostMetadata(ctx, key, mr)
-		require.NoError(t, err, "post metadata", t)
+		err := agentClient.PostMetadata(ctx, agentsdk.PostMetadataRequest{
+			Metadata: []agentsdk.Metadata{
+				{
+					Key:                          key,
+					WorkspaceAgentMetadataResult: mr,
+				},
+			},
+		})
+		require.NoError(t, err, "post metadata: %s, %#v", key, mr)
 	}
 
 	workspace, err = client.Workspace(ctx, workspace.ID)
@@ -1151,7 +1295,7 @@ func TestWorkspaceAgent_Metadata(t *testing.T) {
 	require.Len(t, update, 3)
 	check(wantMetadata1, update[0], true)
 
-	const maxValueLen = 32 << 10
+	const maxValueLen = 2048
 	tooLongValueMetadata := wantMetadata1
 	tooLongValueMetadata.Value = strings.Repeat("a", maxValueLen*2)
 	tooLongValueMetadata.Error = ""
@@ -1165,8 +1309,7 @@ func TestWorkspaceAgent_Metadata(t *testing.T) {
 	require.NotEmpty(t, got.Result.Error)
 
 	unknownKeyMetadata := wantMetadata1
-	err = agentClient.PostMetadata(ctx, "unknown", unknownKeyMetadata)
-	require.NoError(t, err)
+	post("unknown", unknownKeyMetadata)
 }
 
 func TestWorkspaceAgent_Startup(t *testing.T) {
@@ -1182,29 +1325,36 @@ func TestWorkspaceAgent_Startup(t *testing.T) {
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
 			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		agentClient := agentsdk.New(client.URL)
 		agentClient.SetSessionToken(authToken)
 
 		ctx := testutil.Context(t, testutil.WaitMedium)
 
-		const (
-			expectedVersion   = "v1.2.3"
-			expectedDir       = "/home/coder"
-			expectedSubsystem = codersdk.AgentSubsystemEnvbox
+		var (
+			expectedVersion    = "v1.2.3"
+			expectedDir        = "/home/coder"
+			expectedSubsystems = []codersdk.AgentSubsystem{
+				codersdk.AgentSubsystemEnvbox,
+				codersdk.AgentSubsystemExectrace,
+			}
 		)
 
 		err := agentClient.PostStartup(ctx, agentsdk.PostStartupRequest{
 			Version:           expectedVersion,
 			ExpandedDirectory: expectedDir,
-			Subsystem:         expectedSubsystem,
+			Subsystems: []codersdk.AgentSubsystem{
+				// Not sorted.
+				expectedSubsystems[1],
+				expectedSubsystems[0],
+			},
 		})
 		require.NoError(t, err)
 
@@ -1215,7 +1365,8 @@ func TestWorkspaceAgent_Startup(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, expectedVersion, wsagent.Version)
 		require.Equal(t, expectedDir, wsagent.ExpandedDirectory)
-		require.Equal(t, expectedSubsystem, wsagent.Subsystem)
+		// Sorted
+		require.Equal(t, expectedSubsystems, wsagent.Subsystems)
 	})
 
 	t.Run("InvalidSemver", func(t *testing.T) {
@@ -1228,13 +1379,13 @@ func TestWorkspaceAgent_Startup(t *testing.T) {
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
 			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		agentClient := agentsdk.New(client.URL)
 		agentClient.SetSessionToken(authToken)
@@ -1283,22 +1434,15 @@ func TestWorkspaceAgent_UpdatedDERP(t *testing.T) {
 	agentToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:          echo.ParseComplete,
-		ProvisionPlan:  echo.ProvisionComplete,
+		ProvisionPlan:  echo.PlanComplete,
 		ProvisionApply: echo.ProvisionApplyWithAgent(agentToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(agentToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: logger.Named("agent"),
-	})
-	defer func() {
-		_ = agentCloser.Close()
-	}()
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+	agentCloser := agenttest.New(t, client.URL, agentToken)
 	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 	agentID := resources[0].Agents[0].ID
 
diff --git a/coderd/workspaceapps.go b/coderd/workspaceapps.go
index df33889467b80..a523c586faa4c 100644
--- a/coderd/workspaceapps.go
+++ b/coderd/workspaceapps.go
@@ -11,14 +11,15 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/apikey"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/apikey"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // @Summary Get applications host
@@ -107,7 +108,7 @@ func (api *API) workspaceApplicationAuth(rw http.ResponseWriter, r *http.Request
 	exp := apiKey.ExpiresAt
 	lifetimeSeconds := apiKey.LifetimeSeconds
 	if exp.IsZero() || time.Until(exp) > api.DeploymentValues.SessionDuration.Value() {
-		exp = database.Now().Add(api.DeploymentValues.SessionDuration.Value())
+		exp = dbtime.Now().Add(api.DeploymentValues.SessionDuration.Value())
 		lifetimeSeconds = int64(api.DeploymentValues.SessionDuration.Value().Seconds())
 	}
 	cookie, _, err := api.createAPIKey(ctx, apikey.CreateParams{
diff --git a/coderd/workspaceapps/apptest/apptest.go b/coderd/workspaceapps/apptest/apptest.go
index f64ba7c30bf31..166f3ba137fe3 100644
--- a/coderd/workspaceapps/apptest/apptest.go
+++ b/coderd/workspaceapps/apptest/apptest.go
@@ -15,19 +15,21 @@ import (
 	"runtime"
 	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
+	"github.com/go-jose/go-jose/v3"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // Run runs the entire workspace app test suite against deployments minted
@@ -51,23 +53,8 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
 			t.Skip("ConPTY appears to be inconsistent on Windows.")
 		}
 
-		expectLine := func(t *testing.T, r *bufio.Reader, matcher func(string) bool) {
-			for {
-				line, err := r.ReadString('\n')
-				require.NoError(t, err)
-				if matcher(line) {
-					break
-				}
-			}
-		}
-		matchEchoCommand := func(line string) bool {
-			return strings.Contains(line, "echo test")
-		}
-		matchEchoOutput := func(line string) bool {
-			return strings.Contains(line, "test") && !strings.Contains(line, "echo")
-		}
-
 		t.Run("OK", func(t *testing.T) {
+			t.Parallel()
 			appDetails := setupProxyTest(t, nil)
 
 			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -76,40 +63,7 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
 			// Run the test against the path app hostname since that's where the
 			// reconnecting-pty proxy server we want to test is mounted.
 			client := appDetails.AppClient(t)
-			conn, err := client.WorkspaceAgentReconnectingPTY(ctx, codersdk.WorkspaceAgentReconnectingPTYOpts{
-				AgentID:   appDetails.Agent.ID,
-				Reconnect: uuid.New(),
-				Height:    80,
-				Width:     80,
-				Command:   "/bin/bash",
-			})
-			require.NoError(t, err)
-			defer conn.Close()
-
-			// First attempt to resize the TTY.
-			// The websocket will close if it fails!
-			data, err := json.Marshal(codersdk.ReconnectingPTYRequest{
-				Height: 250,
-				Width:  250,
-			})
-			require.NoError(t, err)
-			_, err = conn.Write(data)
-			require.NoError(t, err)
-			bufRead := bufio.NewReader(conn)
-
-			// Brief pause to reduce the likelihood that we send keystrokes while
-			// the shell is simultaneously sending a prompt.
-			time.Sleep(100 * time.Millisecond)
-
-			data, err = json.Marshal(codersdk.ReconnectingPTYRequest{
-				Data: "echo test\r\n",
-			})
-			require.NoError(t, err)
-			_, err = conn.Write(data)
-			require.NoError(t, err)
-
-			expectLine(t, bufRead, matchEchoCommand)
-			expectLine(t, bufRead, matchEchoOutput)
+			testReconnectingPTY(ctx, t, client, appDetails.Agent.ID, "")
 		})
 
 		t.Run("SignedTokenQueryParameter", func(t *testing.T) {
@@ -137,41 +91,7 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
 
 			// Make an unauthenticated client.
 			unauthedAppClient := codersdk.New(appDetails.AppClient(t).URL)
-			conn, err := unauthedAppClient.WorkspaceAgentReconnectingPTY(ctx, codersdk.WorkspaceAgentReconnectingPTYOpts{
-				AgentID:     appDetails.Agent.ID,
-				Reconnect:   uuid.New(),
-				Height:      80,
-				Width:       80,
-				Command:     "/bin/bash",
-				SignedToken: issueRes.SignedToken,
-			})
-			require.NoError(t, err)
-			defer conn.Close()
-
-			// First attempt to resize the TTY.
-			// The websocket will close if it fails!
-			data, err := json.Marshal(codersdk.ReconnectingPTYRequest{
-				Height: 250,
-				Width:  250,
-			})
-			require.NoError(t, err)
-			_, err = conn.Write(data)
-			require.NoError(t, err)
-			bufRead := bufio.NewReader(conn)
-
-			// Brief pause to reduce the likelihood that we send keystrokes while
-			// the shell is simultaneously sending a prompt.
-			time.Sleep(100 * time.Millisecond)
-
-			data, err = json.Marshal(codersdk.ReconnectingPTYRequest{
-				Data: "echo test\r\n",
-			})
-			require.NoError(t, err)
-			_, err = conn.Write(data)
-			require.NoError(t, err)
-
-			expectLine(t, bufRead, matchEchoCommand)
-			expectLine(t, bufRead, matchEchoOutput)
+			testReconnectingPTY(ctx, t, unauthedAppClient, appDetails.Agent.ID, issueRes.SignedToken)
 		})
 	})
 
@@ -193,7 +113,7 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
 			resp, err := requestWithRetries(ctx, t, appDetails.AppClient(t), http.MethodGet, appDetails.PathAppURL(appDetails.Apps.Owner).String(), nil)
 			require.NoError(t, err)
 			defer resp.Body.Close()
-			require.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+			require.Equal(t, http.StatusForbidden, resp.StatusCode)
 			body, err := io.ReadAll(resp.Body)
 			require.NoError(t, err)
 			require.Contains(t, string(body), "Path-based applications are disabled")
@@ -325,7 +245,7 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
 
 			var appTokenCookie *http.Cookie
 			for _, c := range resp.Cookies() {
-				if c.Name == codersdk.DevURLSignedAppTokenCookie {
+				if c.Name == codersdk.SignedAppTokenCookie {
 					appTokenCookie = c
 					break
 				}
@@ -370,7 +290,7 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
 
 			var appTokenCookie *http.Cookie
 			for _, c := range resp.Cookies() {
-				if c.Name == codersdk.DevURLSignedAppTokenCookie {
+				if c.Name == codersdk.SignedAppTokenCookie {
 					appTokenCookie = c
 					break
 				}
@@ -468,30 +388,19 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
 			appDetails := setupProxyTest(t, nil)
 
 			cases := []struct {
-				name         string
-				appURL       *url.URL
-				verifyCookie func(t *testing.T, c *http.Cookie)
+				name                   string
+				appURL                 *url.URL
+				sessionTokenCookieName string
 			}{
 				{
-					name:   "Subdomain",
-					appURL: appDetails.SubdomainAppURL(appDetails.Apps.Owner),
-					verifyCookie: func(t *testing.T, c *http.Cookie) {
-						// TODO(@dean): fix these asserts, they don't seem to
-						// work. I wonder if Go strips the domain from the
-						// cookie object if it's invalid or something.
-						// domain := strings.SplitN(appDetails.Options.AppHost, ".", 2)
-						// require.Equal(t, "."+domain[1], c.Domain, "incorrect domain on app token cookie")
-					},
+					name:                   "Subdomain",
+					appURL:                 appDetails.SubdomainAppURL(appDetails.Apps.Owner),
+					sessionTokenCookieName: codersdk.SubdomainAppSessionTokenCookie,
 				},
 				{
-					name:   "Path",
-					appURL: appDetails.PathAppURL(appDetails.Apps.Owner),
-					verifyCookie: func(t *testing.T, c *http.Cookie) {
-						// TODO(@dean): fix these asserts, they don't seem to
-						// work. I wonder if Go strips the domain from the
-						// cookie object if it's invalid or something.
-						// require.Equal(t, "", c.Domain, "incorrect domain on app token cookie")
-					},
+					name:                   "Path",
+					appURL:                 appDetails.PathAppURL(appDetails.Apps.Owner),
+					sessionTokenCookieName: codersdk.PathAppSessionTokenCookie,
 				},
 			}
 
@@ -576,14 +485,13 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
 
 					cookies := resp.Cookies()
 					var cookie *http.Cookie
-					for _, c := range cookies {
-						if c.Name == codersdk.DevURLSessionTokenCookie {
-							cookie = c
+					for _, co := range cookies {
+						if co.Name == c.sessionTokenCookieName {
+							cookie = co
 							break
 						}
 					}
 					require.NotNil(t, cookie, "no app session token cookie was set")
-					c.verifyCookie(t, cookie)
 					apiKey := cookie.Value
 
 					// Fetch the API key from the API.
@@ -645,6 +553,118 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
 		})
 	})
 
+	t.Run("WorkspaceAppsProxySubdomainHostnamePrefix/OK", func(t *testing.T) {
+		t.Parallel()
+
+		appDetails := setupProxyTest(t, nil)
+
+		// Try to load the owner app with a prefix.
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		prefixedOwnerApp := appDetails.Apps.Owner
+		prefixedOwnerApp.Prefix = "some---prefix---"
+
+		u := appDetails.SubdomainAppURL(prefixedOwnerApp)
+		require.Contains(t, u.Host, prefixedOwnerApp.Prefix)
+
+		resp, err := requestWithRetries(ctx, t, appDetails.AppClient(t), http.MethodGet, u.String(), nil)
+		require.NoError(t, err)
+		_ = resp.Body.Close()
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		require.Equal(t, resp.Header.Get("X-Got-Host"), u.Host)
+
+		// Parse the returned signed token to verify that it contains the
+		// prefix.
+		var appTokenCookie *http.Cookie
+		for _, c := range resp.Cookies() {
+			if c.Name == codersdk.SignedAppTokenCookie {
+				appTokenCookie = c
+				break
+			}
+		}
+		require.NotNil(t, appTokenCookie, "no signed app token cookie in response")
+
+		// Parse the JWT without verifying it (since we can't access the key
+		// from this test).
+		object, err := jose.ParseSigned(appTokenCookie.Value)
+		require.NoError(t, err)
+		require.Len(t, object.Signatures, 1)
+
+		// Parse the payload.
+		var tok workspaceapps.SignedToken
+		//nolint:gosec
+		err = json.Unmarshal(object.UnsafePayloadWithoutVerification(), &tok)
+		require.NoError(t, err)
+
+		// Verify the prefix is in the token.
+		require.Equal(t, prefixedOwnerApp.Prefix, tok.Request.Prefix)
+
+		// Ensure the signed app token cookie is valid by making a request with
+		// it with no session token.
+		appTokenClient := appDetails.AppClient(t)
+		appTokenClient.SetSessionToken("")
+		appTokenClient.HTTPClient.Jar, err = cookiejar.New(nil)
+		require.NoError(t, err)
+		appTokenClient.HTTPClient.Jar.SetCookies(u, []*http.Cookie{appTokenCookie})
+
+		resp, err = requestWithRetries(ctx, t, appTokenClient, http.MethodGet, u.String(), nil)
+		require.NoError(t, err)
+		_ = resp.Body.Close()
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+		require.Equal(t, resp.Header.Get("X-Got-Host"), u.Host)
+	})
+
+	t.Run("WorkspaceAppsProxySubdomainHostnamePrefix/Different", func(t *testing.T) {
+		t.Parallel()
+
+		appDetails := setupProxyTest(t, nil)
+
+		// Try to load the owner app with a prefix.
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		prefixedOwnerApp := appDetails.Apps.Owner
+		t.Log(appDetails.SubdomainAppURL(prefixedOwnerApp))
+		prefixedOwnerApp.Prefix = "some---prefix---"
+		t.Log(appDetails.SubdomainAppURL(prefixedOwnerApp))
+
+		u := appDetails.SubdomainAppURL(prefixedOwnerApp)
+		require.Contains(t, u.Host, prefixedOwnerApp.Prefix)
+
+		resp, err := requestWithRetries(ctx, t, appDetails.AppClient(t), http.MethodGet, u.String(), nil)
+		require.NoError(t, err)
+		_ = resp.Body.Close()
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+
+		// Find the cookie.
+		var appTokenCookie *http.Cookie
+		for _, c := range resp.Cookies() {
+			if c.Name == codersdk.SignedAppTokenCookie {
+				appTokenCookie = c
+				break
+			}
+		}
+		require.NotNil(t, appTokenCookie, "no signed app token cookie in response")
+
+		// Ensure the signed app token cookie is valid only for the given prefix
+		// by making a request with it with no session token.
+		appTokenClient := appDetails.AppClient(t)
+		appTokenClient.SetSessionToken("")
+		appTokenClient.HTTPClient.Jar, err = cookiejar.New(nil)
+		require.NoError(t, err)
+		appTokenClient.HTTPClient.Jar.SetCookies(u, []*http.Cookie{appTokenCookie})
+
+		prefixedOwnerApp.Prefix = "different---"
+		u = appDetails.SubdomainAppURL(prefixedOwnerApp)
+		require.Contains(t, u.Host, prefixedOwnerApp.Prefix)
+
+		resp, err = requestWithRetries(ctx, t, appTokenClient, http.MethodGet, u.String(), nil)
+		require.NoError(t, err)
+		_ = resp.Body.Close()
+		require.NotEqual(t, http.StatusOK, resp.StatusCode)
+	})
+
 	// This test ensures that the subdomain handler does nothing if
 	// --app-hostname is not set by the admin.
 	t.Run("WorkspaceAppsProxySubdomainPassthrough", func(t *testing.T) {
@@ -783,7 +803,7 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
 
 			var appTokenCookie *http.Cookie
 			for _, c := range resp.Cookies() {
-				if c.Name == codersdk.DevURLSignedAppTokenCookie {
+				if c.Name == codersdk.SignedAppTokenCookie {
 					appTokenCookie = c
 					break
 				}
@@ -827,7 +847,7 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
 
 			var appTokenCookie *http.Cookie
 			for _, c := range resp.Cookies() {
-				if c.Name == codersdk.DevURLSignedAppTokenCookie {
+				if c.Name == codersdk.SignedAppTokenCookie {
 					appTokenCookie = c
 					break
 				}
@@ -1406,4 +1426,126 @@ func Run(t *testing.T, appHostIsPrimary bool, factory DeploymentFactory) {
 		require.Equal(t, []string{"Origin", "X-Foobar"}, deduped)
 		require.Equal(t, []string{"baz"}, resp.Header.Values("X-Foobar"))
 	})
+
+	t.Run("ReportStats", func(t *testing.T) {
+		t.Parallel()
+
+		flush := make(chan chan<- struct{}, 1)
+
+		reporter := &fakeStatsReporter{}
+		appDetails := setupProxyTest(t, &DeploymentOptions{
+			StatsCollectorOptions: workspaceapps.StatsCollectorOptions{
+				Reporter:       reporter,
+				ReportInterval: time.Hour,
+				RollupWindow:   time.Minute,
+
+				Flush: flush,
+			},
+		})
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		u := appDetails.PathAppURL(appDetails.Apps.Owner)
+		resp, err := requestWithRetries(ctx, t, appDetails.AppClient(t), http.MethodGet, u.String(), nil)
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		_, err = io.Copy(io.Discard, resp.Body)
+		require.NoError(t, err)
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+
+		var stats []workspaceapps.StatsReport
+		require.Eventually(t, func() bool {
+			// Keep flushing until we get a non-empty stats report.
+			flushDone := make(chan struct{}, 1)
+			flush <- flushDone
+			<-flushDone
+
+			stats = reporter.stats()
+			return len(stats) > 0
+		}, testutil.WaitLong, testutil.IntervalFast, "stats not reported")
+
+		assert.Equal(t, workspaceapps.AccessMethodPath, stats[0].AccessMethod)
+		assert.Equal(t, "test-app-owner", stats[0].SlugOrPort)
+		assert.Equal(t, 1, stats[0].Requests)
+	})
+}
+
+type fakeStatsReporter struct {
+	mu sync.Mutex
+	s  []workspaceapps.StatsReport
+}
+
+func (r *fakeStatsReporter) stats() []workspaceapps.StatsReport {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.s
+}
+
+func (r *fakeStatsReporter) Report(_ context.Context, stats []workspaceapps.StatsReport) error {
+	r.mu.Lock()
+	r.s = append(r.s, stats...)
+	r.mu.Unlock()
+	return nil
+}
+
+func testReconnectingPTY(ctx context.Context, t *testing.T, client *codersdk.Client, agentID uuid.UUID, signedToken string) {
+	opts := codersdk.WorkspaceAgentReconnectingPTYOpts{
+		AgentID:   agentID,
+		Reconnect: uuid.New(),
+		Width:     80,
+		Height:    80,
+		// --norc disables executing .bashrc, which is often used to customize the bash prompt
+		Command:     "bash --norc",
+		SignedToken: signedToken,
+	}
+	matchPrompt := func(line string) bool {
+		return strings.Contains(line, "$ ") || strings.Contains(line, "# ")
+	}
+	matchEchoCommand := func(line string) bool {
+		return strings.Contains(line, "echo test")
+	}
+	matchEchoOutput := func(line string) bool {
+		return strings.Contains(line, "test") && !strings.Contains(line, "echo")
+	}
+	matchExitCommand := func(line string) bool {
+		return strings.Contains(line, "exit")
+	}
+	matchExitOutput := func(line string) bool {
+		return strings.Contains(line, "exit") || strings.Contains(line, "logout")
+	}
+
+	conn, err := client.WorkspaceAgentReconnectingPTY(ctx, opts)
+	require.NoError(t, err)
+	defer conn.Close()
+
+	tr := testutil.NewTerminalReader(t, conn)
+	// Wait for the prompt before writing commands.  If the command arrives before the prompt is written, screen
+	// will sometimes put the command output on the same line as the command and the test will flake
+	require.NoError(t, tr.ReadUntil(ctx, matchPrompt), "find prompt")
+
+	data, err := json.Marshal(codersdk.ReconnectingPTYRequest{
+		Data: "echo test\r",
+	})
+	require.NoError(t, err)
+	_, err = conn.Write(data)
+	require.NoError(t, err)
+
+	require.NoError(t, tr.ReadUntil(ctx, matchEchoCommand), "find echo command")
+	require.NoError(t, tr.ReadUntil(ctx, matchEchoOutput), "find echo output")
+
+	// Exit should cause the connection to close.
+	data, err = json.Marshal(codersdk.ReconnectingPTYRequest{
+		Data: "exit\r",
+	})
+	require.NoError(t, err)
+	_, err = conn.Write(data)
+	require.NoError(t, err)
+
+	// Once for the input and again for the output.
+	require.NoError(t, tr.ReadUntil(ctx, matchExitCommand), "find exit command")
+	require.NoError(t, tr.ReadUntil(ctx, matchExitOutput), "find exit output")
+
+	// Ensure the connection closes.
+	require.ErrorIs(t, tr.ReadUntil(ctx, nil), io.EOF)
 }
diff --git a/coderd/workspaceapps/apptest/setup.go b/coderd/workspaceapps/apptest/setup.go
index 4245204268391..534a35398f653 100644
--- a/coderd/workspaceapps/apptest/setup.go
+++ b/coderd/workspaceapps/apptest/setup.go
@@ -19,13 +19,16 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 const (
@@ -51,6 +54,8 @@ type DeploymentOptions struct {
 	DangerousAllowPathAppSiteOwnerAccess bool
 	ServeHTTPS                           bool
 
+	StatsCollectorOptions workspaceapps.StatsCollectorOptions
+
 	// The following fields are only used by setupProxyTestWithFactory.
 	noWorkspace bool
 	port        uint16
@@ -84,7 +89,9 @@ type App struct {
 	AgentName     string
 	AppSlugOrPort string
 
-	Query string
+	// Prefix should have ---.
+	Prefix string
+	Query  string
 }
 
 // Details are the full test details returned from setupProxyTestWithFactory.
@@ -138,10 +145,15 @@ func (d *Details) PathAppURL(app App) *url.URL {
 
 // SubdomainAppURL returns the URL for the given subdomain app.
 func (d *Details) SubdomainAppURL(app App) *url.URL {
-	host := fmt.Sprintf("%s--%s--%s--%s", app.AppSlugOrPort, app.AgentName, app.WorkspaceName, app.Username)
-
+	appHost := httpapi.ApplicationURL{
+		Prefix:        app.Prefix,
+		AppSlugOrPort: app.AppSlugOrPort,
+		AgentName:     app.AgentName,
+		WorkspaceName: app.WorkspaceName,
+		Username:      app.Username,
+	}
 	u := *d.PathAppBaseURL
-	u.Host = strings.Replace(d.Options.AppHost, "*", host, 1)
+	u.Host = strings.Replace(d.Options.AppHost, "*", appHost.String(), 1)
 	u.Path = "/"
 	u.RawQuery = app.Query
 	return &u
@@ -244,6 +256,7 @@ func appServer(t *testing.T, headers http.Header, isHTTPS bool) uint16 {
 				_, err := r.Cookie(codersdk.SessionTokenCookie)
 				assert.ErrorIs(t, err, http.ErrNoCookie)
 				w.Header().Set("X-Forwarded-For", r.Header.Get("X-Forwarded-For"))
+				w.Header().Set("X-Got-Host", r.Host)
 				for name, values := range headers {
 					for _, value := range values {
 						w.Header().Add(name, value)
@@ -282,13 +295,55 @@ func createWorkspaceWithApps(t *testing.T, client *codersdk.Client, orgID uuid.U
 		scheme = "https"
 	}
 
+	// Workspace name needs to be short to avoid hitting 62 char hostname
+	// segment limit.
+	workspaceName, err := cryptorand.String(6)
+	require.NoError(t, err)
+	workspaceName = "ws-" + workspaceName
+	workspaceMutators = append([]func(*codersdk.CreateWorkspaceRequest){
+		func(req *codersdk.CreateWorkspaceRequest) {
+			req.Name = workspaceName
+		},
+	}, workspaceMutators...)
+
 	appURL := fmt.Sprintf("%s://127.0.0.1:%d?%s", scheme, port, proxyTestAppQuery)
+	protoApps := []*proto.App{
+		{
+			Slug:         proxyTestAppNameFake,
+			DisplayName:  proxyTestAppNameFake,
+			SharingLevel: proto.AppSharingLevel_OWNER,
+			// Hopefully this IP and port doesn't exist.
+			Url:       "http://127.1.0.1:65535",
+			Subdomain: true,
+		},
+		{
+			Slug:         proxyTestAppNameOwner,
+			DisplayName:  proxyTestAppNameOwner,
+			SharingLevel: proto.AppSharingLevel_OWNER,
+			Url:          appURL,
+			Subdomain:    true,
+		},
+		{
+			Slug:         proxyTestAppNameAuthenticated,
+			DisplayName:  proxyTestAppNameAuthenticated,
+			SharingLevel: proto.AppSharingLevel_AUTHENTICATED,
+			Url:          appURL,
+			Subdomain:    true,
+		},
+		{
+			Slug:         proxyTestAppNamePublic,
+			DisplayName:  proxyTestAppNamePublic,
+			SharingLevel: proto.AppSharingLevel_PUBLIC,
+			Url:          appURL,
+			Subdomain:    true,
+		},
+	}
 	version := coderdtest.CreateTemplateVersion(t, client, orgID, &echo.Responses{
 		Parse:         echo.ParseComplete,
-		ProvisionPlan: echo.ProvisionComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionPlan: echo.PlanComplete,
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "example",
 						Type: "aws_instance",
@@ -298,33 +353,7 @@ func createWorkspaceWithApps(t *testing.T, client *codersdk.Client, orgID uuid.U
 							Auth: &proto.Agent_Token{
 								Token: authToken,
 							},
-							Apps: []*proto.App{
-								{
-									Slug:         proxyTestAppNameFake,
-									DisplayName:  proxyTestAppNameFake,
-									SharingLevel: proto.AppSharingLevel_OWNER,
-									// Hopefully this IP and port doesn't exist.
-									Url: "http://127.1.0.1:65535",
-								},
-								{
-									Slug:         proxyTestAppNameOwner,
-									DisplayName:  proxyTestAppNameOwner,
-									SharingLevel: proto.AppSharingLevel_OWNER,
-									Url:          appURL,
-								},
-								{
-									Slug:         proxyTestAppNameAuthenticated,
-									DisplayName:  proxyTestAppNameAuthenticated,
-									SharingLevel: proto.AppSharingLevel_AUTHENTICATED,
-									Url:          appURL,
-								},
-								{
-									Slug:         proxyTestAppNamePublic,
-									DisplayName:  proxyTestAppNamePublic,
-									SharingLevel: proto.AppSharingLevel_PUBLIC,
-									Url:          appURL,
-								},
-							},
+							Apps: protoApps,
 						}},
 					}},
 				},
@@ -332,9 +361,25 @@ func createWorkspaceWithApps(t *testing.T, client *codersdk.Client, orgID uuid.U
 		}},
 	})
 	template := coderdtest.CreateTemplate(t, client, orgID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, orgID, template.ID, workspaceMutators...)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	workspaceBuild := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+	// Verify app subdomains
+	for _, app := range workspaceBuild.Resources[0].Agents[0].Apps {
+		require.True(t, app.Subdomain)
+
+		appURL := httpapi.ApplicationURL{
+			Prefix: "",
+			// findProtoApp is needed as the order of apps returned from PG database
+			// is not guaranteed.
+			AppSlugOrPort: findProtoApp(t, protoApps, app.Slug).Slug,
+			AgentName:     proxyTestAgentName,
+			WorkspaceName: workspace.Name,
+			Username:      me.Username,
+		}
+		require.Equal(t, appURL.String(), app.SubdomainName)
+	}
 
 	agentClient := agentsdk.New(client.URL)
 	agentClient.SetSessionToken(authToken)
@@ -352,13 +397,15 @@ func createWorkspaceWithApps(t *testing.T, client *codersdk.Client, orgID uuid.U
 	if primaryAppHost.Host != "" {
 		manifest, err := agentClient.Manifest(appHostCtx)
 		require.NoError(t, err)
-		proxyURL := fmt.Sprintf(
-			"http://{{port}}--%s--%s--%s%s",
-			proxyTestAgentName,
-			workspace.Name,
-			me.Username,
-			strings.ReplaceAll(primaryAppHost.Host, "*", ""),
-		)
+
+		appHost := httpapi.ApplicationURL{
+			Prefix:        "",
+			AppSlugOrPort: "{{port}}",
+			AgentName:     proxyTestAgentName,
+			WorkspaceName: workspace.Name,
+			Username:      me.Username,
+		}
+		proxyURL := "http://" + appHost.String() + strings.ReplaceAll(primaryAppHost.Host, "*", "")
 		require.Equal(t, proxyURL, manifest.VSCodePortProxyURI)
 	}
 	agentCloser := agent.New(agent.Options{
@@ -379,6 +426,16 @@ func createWorkspaceWithApps(t *testing.T, client *codersdk.Client, orgID uuid.U
 	return workspace, agents[0]
 }
 
+func findProtoApp(t *testing.T, protoApps []*proto.App, slug string) *proto.App {
+	for _, protoApp := range protoApps {
+		if protoApp.Slug == slug {
+			return protoApp
+		}
+	}
+	require.FailNowf(t, "proto app not found (slug: %q)", slug)
+	return nil
+}
+
 func doWithRetries(t require.TestingT, client *codersdk.Client, req *http.Request) (*http.Response, error) {
 	var resp *http.Response
 	var err error
diff --git a/coderd/workspaceapps/cookies.go b/coderd/workspaceapps/cookies.go
new file mode 100644
index 0000000000000..7eee7fb9dad15
--- /dev/null
+++ b/coderd/workspaceapps/cookies.go
@@ -0,0 +1,51 @@
+package workspaceapps
+
+import (
+	"net/http"
+
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+// AppConnectSessionTokenCookieName returns the cookie name for the session
+// token for the given access method.
+func AppConnectSessionTokenCookieName(accessMethod AccessMethod) string {
+	if accessMethod == AccessMethodSubdomain {
+		return codersdk.SubdomainAppSessionTokenCookie
+	}
+	return codersdk.PathAppSessionTokenCookie
+}
+
+// AppConnectSessionTokenFromRequest returns the session token from the request
+// if it exists. The access method is used to determine which cookie name to
+// use.
+//
+// We use different cookie names for path apps and for subdomain apps to avoid
+// both being set and sent to the server at the same time and the server using
+// the wrong value.
+//
+// We use different cookie names for:
+// - path apps on primary access URL: coder_session_token
+// - path apps on proxies: coder_path_app_session_token
+// - subdomain apps: coder_subdomain_app_session_token
+//
+// First we try the default function to get a token from request, which supports
+// query parameters, the Coder-Session-Token header and the coder_session_token
+// cookie.
+//
+// Then we try the specific cookie name for the access method.
+func AppConnectSessionTokenFromRequest(r *http.Request, accessMethod AccessMethod) string {
+	// Try the default function first.
+	token := httpmw.APITokenFromRequest(r)
+	if token != "" {
+		return token
+	}
+
+	// Then try the specific cookie name for the access method.
+	cookie, err := r.Cookie(AppConnectSessionTokenCookieName(accessMethod))
+	if err == nil && cookie.Value != "" {
+		return cookie.Value
+	}
+
+	return ""
+}
diff --git a/coderd/workspaceapps/db.go b/coderd/workspaceapps/db.go
index 34851fb1559e1..9b196a4b7480e 100644
--- a/coderd/workspaceapps/db.go
+++ b/coderd/workspaceapps/db.go
@@ -10,15 +10,16 @@ import (
 	"strings"
 	"time"
 
+	"golang.org/x/exp/slices"
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // DBTokenProvider provides authentication and authorization for workspace apps
@@ -100,7 +101,7 @@ func (p *DBTokenProvider) Issue(ctx context.Context, rw http.ResponseWriter, r *
 	// Lookup workspace app details from DB.
 	dbReq, err := appReq.getDatabase(dangerousSystemCtx, p.Database)
 	if xerrors.Is(err, sql.ErrNoRows) {
-		WriteWorkspaceApp404(p.Logger, p.DashboardURL, rw, r, &appReq, err.Error())
+		WriteWorkspaceApp404(p.Logger, p.DashboardURL, rw, r, &appReq, nil, err.Error())
 		return nil, "", false
 	} else if err != nil {
 		WriteWorkspaceApp500(p.Logger, p.DashboardURL, rw, r, &appReq, err, "get app details from database")
@@ -114,7 +115,7 @@ func (p *DBTokenProvider) Issue(ctx context.Context, rw http.ResponseWriter, r *
 	}
 
 	// Verify the user has access to the app.
-	authed, err := p.authorizeRequest(r.Context(), authz, dbReq)
+	authed, warnings, err := p.authorizeRequest(r.Context(), authz, dbReq)
 	if err != nil {
 		WriteWorkspaceApp500(p.Logger, p.DashboardURL, rw, r, &appReq, err, "verify authz")
 		return nil, "", false
@@ -122,7 +123,7 @@ func (p *DBTokenProvider) Issue(ctx context.Context, rw http.ResponseWriter, r *
 	if !authed {
 		if apiKey != nil {
 			// The request has a valid API key but insufficient permissions.
-			WriteWorkspaceApp404(p.Logger, p.DashboardURL, rw, r, &appReq, "insufficient permissions")
+			WriteWorkspaceApp404(p.Logger, p.DashboardURL, rw, r, &appReq, warnings, "insufficient permissions")
 			return nil, "", false
 		}
 
@@ -218,7 +219,12 @@ func (p *DBTokenProvider) Issue(ctx context.Context, rw http.ResponseWriter, r *
 	return &token, tokenStr, true
 }
 
-func (p *DBTokenProvider) authorizeRequest(ctx context.Context, roles *httpmw.Authorization, dbReq *databaseRequest) (bool, error) {
+// authorizeRequest returns true/false if the request is authorized. The returned []string
+// are warnings that aid in debugging. These messages do not prevent authorization,
+// but may indicate that the request is not configured correctly.
+// If an error is returned, the request should be aborted with a 500 error.
+func (p *DBTokenProvider) authorizeRequest(ctx context.Context, roles *httpmw.Authorization, dbReq *databaseRequest) (bool, []string, error) {
+	var warnings []string
 	accessMethod := dbReq.AccessMethod
 	if accessMethod == "" {
 		accessMethod = AccessMethodPath
@@ -233,6 +239,14 @@ func (p *DBTokenProvider) authorizeRequest(ctx context.Context, roles *httpmw.Au
 	// Dangerous.AllowPathAppSiteOwnerAccess flag is enabled in the check below.
 	sharingLevel := dbReq.AppSharingLevel
 	if isPathApp && !p.DeploymentValues.Dangerous.AllowPathAppSharing.Value() {
+		if dbReq.AppSharingLevel != database.AppSharingLevelOwner {
+			// This is helpful for debugging, and ok to leak to the user.
+			// This is because the app has the sharing level set to something that
+			// should be shared, but we are disabling it from a deployment wide
+			// flag. So the template should be fixed to set the sharing level to
+			// "owner" instead and this will not appear.
+			warnings = append(warnings, fmt.Sprintf("unable to use configured sharing level %q because path-based app sharing is disabled (see --dangerous-allow-path-app-sharing), using sharing level \"owner\" instead", sharingLevel))
+		}
 		sharingLevel = database.AppSharingLevelOwner
 	}
 
@@ -240,7 +254,7 @@ func (p *DBTokenProvider) authorizeRequest(ctx context.Context, roles *httpmw.Au
 	if roles == nil {
 		// The user is not authenticated, so they can only access the app if it
 		// is public.
-		return sharingLevel == database.AppSharingLevelPublic, nil
+		return sharingLevel == database.AppSharingLevelPublic, warnings, nil
 	}
 
 	// Block anyone from accessing workspaces they don't own in path-based apps
@@ -254,7 +268,13 @@ func (p *DBTokenProvider) authorizeRequest(ctx context.Context, roles *httpmw.Au
 		sharingLevel == database.AppSharingLevelOwner &&
 		dbReq.Workspace.OwnerID.String() != roles.Actor.ID &&
 		!p.DeploymentValues.Dangerous.AllowPathAppSiteOwnerAccess.Value() {
-		return false, nil
+		// This is not ideal to check for the 'owner' role, but we are only checking
+		// to determine whether to show a warning for debugging reasons. This does
+		// not do any authz checks, so it is ok.
+		if roles != nil && slices.Contains(roles.Actor.Roles.Names(), rbac.RoleOwner()) {
+			warnings = append(warnings, "path-based apps with \"owner\" share level are only accessible by the workspace owner (see --dangerous-allow-path-app-site-owner-access)")
+		}
+		return false, warnings, nil
 	}
 
 	// Figure out which RBAC resource to check. For terminals we use execution
@@ -280,7 +300,7 @@ func (p *DBTokenProvider) authorizeRequest(ctx context.Context, roles *httpmw.Au
 	// scope allows it).
 	err := p.Authorizer.Authorize(ctx, roles.Actor, rbacAction, rbacResource)
 	if err == nil {
-		return true, nil
+		return true, []string{}, nil
 	}
 
 	switch sharingLevel {
@@ -293,15 +313,15 @@ func (p *DBTokenProvider) authorizeRequest(ctx context.Context, roles *httpmw.Au
 		// to connect to the actor's own workspace. This enforces scopes.
 		err := p.Authorizer.Authorize(ctx, roles.Actor, rbacAction, rbacResourceOwned)
 		if err == nil {
-			return true, nil
+			return true, []string{}, nil
 		}
 	case database.AppSharingLevelPublic:
 		// We don't really care about scopes and stuff if it's public anyways.
 		// Someone with a restricted-scope API key could just not submit the API
 		// key cookie in the request and access the page.
-		return true, nil
+		return true, []string{}, nil
 	}
 
 	// No checks were successful.
-	return false, nil
+	return false, warnings, nil
 }
diff --git a/coderd/workspaceapps/db_test.go b/coderd/workspaceapps/db_test.go
index bab2d8ae3b9dd..07a9dfc029491 100644
--- a/coderd/workspaceapps/db_test.go
+++ b/coderd/workspaceapps/db_test.go
@@ -17,16 +17,15 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func Test_ResolveRequest(t *testing.T) {
@@ -94,10 +93,10 @@ func Test_ResolveRequest(t *testing.T) {
 	agentAuthToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, firstUser.OrganizationID, &echo.Responses{
 		Parse:         echo.ParseComplete,
-		ProvisionPlan: echo.ProvisionComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionPlan: echo.PlanComplete,
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "example",
 						Type: "aws_instance",
@@ -168,19 +167,11 @@ func Test_ResolveRequest(t *testing.T) {
 		}},
 	})
 	template := coderdtest.CreateTemplate(t, client, firstUser.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, firstUser.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(agentAuthToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: slogtest.Make(t, nil).Named("agent"),
-	})
-	t.Cleanup(func() {
-		_ = agentCloser.Close()
-	})
+	_ = agenttest.New(t, client.URL, agentAuthToken)
 	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID, agentName)
 
 	agentID := uuid.Nil
@@ -222,14 +213,14 @@ func Test_ResolveRequest(t *testing.T) {
 				// Try resolving a request for each app as the owner, without a
 				// token, then use the token to resolve each app.
 				for _, app := range allApps {
-					req := workspaceapps.Request{
+					req := (workspaceapps.Request{
 						AccessMethod:      workspaceapps.AccessMethodPath,
 						BasePath:          "/app",
 						UsernameOrID:      me.Username,
 						WorkspaceNameOrID: c.workspaceNameOrID,
 						AgentNameOrID:     c.agentNameOrID,
 						AppSlugOrPort:     app,
-					}
+					}).Normalize()
 
 					t.Log("app", app)
 					rw := httptest.NewRecorder()
@@ -268,7 +259,7 @@ func Test_ResolveRequest(t *testing.T) {
 					// Check that the token was set in the response and is valid.
 					require.Len(t, w.Cookies(), 1)
 					cookie := w.Cookies()[0]
-					require.Equal(t, codersdk.DevURLSignedAppTokenCookie, cookie.Name)
+					require.Equal(t, codersdk.SignedAppTokenCookie, cookie.Name)
 					require.Equal(t, req.BasePath, cookie.Path)
 
 					parsedToken, err := api.AppSecurityKey.VerifySignedToken(cookie.Value)
@@ -305,14 +296,14 @@ func Test_ResolveRequest(t *testing.T) {
 		t.Parallel()
 
 		for _, app := range allApps {
-			req := workspaceapps.Request{
+			req := (workspaceapps.Request{
 				AccessMethod:      workspaceapps.AccessMethodPath,
 				BasePath:          "/app",
 				UsernameOrID:      me.Username,
 				WorkspaceNameOrID: workspace.Name,
 				AgentNameOrID:     agentName,
 				AppSlugOrPort:     app,
-			}
+			}).Normalize()
 
 			t.Log("app", app)
 			rw := httptest.NewRecorder()
@@ -346,14 +337,14 @@ func Test_ResolveRequest(t *testing.T) {
 		t.Parallel()
 
 		for _, app := range allApps {
-			req := workspaceapps.Request{
+			req := (workspaceapps.Request{
 				AccessMethod:      workspaceapps.AccessMethodPath,
 				BasePath:          "/app",
 				UsernameOrID:      me.Username,
 				WorkspaceNameOrID: workspace.Name,
 				AgentNameOrID:     agentName,
 				AppSlugOrPort:     app,
-			}
+			}).Normalize()
 
 			t.Log("app", app)
 			rw := httptest.NewRecorder()
@@ -391,9 +382,9 @@ func Test_ResolveRequest(t *testing.T) {
 	t.Run("Invalid", func(t *testing.T) {
 		t.Parallel()
 
-		req := workspaceapps.Request{
+		req := (workspaceapps.Request{
 			AccessMethod: "invalid",
-		}
+		}).Normalize()
 		rw := httptest.NewRecorder()
 		r := httptest.NewRequest("GET", "/app", nil)
 		token, ok := workspaceapps.ResolveRequest(rw, r, workspaceapps.ResolveRequestOptions{
@@ -465,13 +456,13 @@ func Test_ResolveRequest(t *testing.T) {
 
 		for _, c := range cases {
 			t.Run(c.name, func(t *testing.T) {
-				req := workspaceapps.Request{
+				req := (workspaceapps.Request{
 					AccessMethod:      workspaceapps.AccessMethodPath,
 					BasePath:          "/app",
 					UsernameOrID:      me.Username,
 					WorkspaceAndAgent: c.workspaceAndAgent,
 					AppSlugOrPort:     appNamePublic,
-				}
+				}).Normalize()
 
 				rw := httptest.NewRecorder()
 				r := httptest.NewRequest("GET", "/app", nil)
@@ -510,7 +501,7 @@ func Test_ResolveRequest(t *testing.T) {
 		t.Parallel()
 
 		badToken := workspaceapps.SignedToken{
-			Request: workspaceapps.Request{
+			Request: (workspaceapps.Request{
 				AccessMethod:      workspaceapps.AccessMethodPath,
 				BasePath:          "/app",
 				UsernameOrID:      me.Username,
@@ -518,7 +509,7 @@ func Test_ResolveRequest(t *testing.T) {
 				AgentNameOrID:     agentName,
 				// App name differs
 				AppSlugOrPort: appNamePublic,
-			},
+			}).Normalize(),
 			Expiry:      time.Now().Add(time.Minute),
 			UserID:      me.ID,
 			WorkspaceID: workspace.ID,
@@ -528,7 +519,7 @@ func Test_ResolveRequest(t *testing.T) {
 		badTokenStr, err := api.AppSecurityKey.SignToken(badToken)
 		require.NoError(t, err)
 
-		req := workspaceapps.Request{
+		req := (workspaceapps.Request{
 			AccessMethod:      workspaceapps.AccessMethodPath,
 			BasePath:          "/app",
 			UsernameOrID:      me.Username,
@@ -536,13 +527,13 @@ func Test_ResolveRequest(t *testing.T) {
 			AgentNameOrID:     agentName,
 			// App name differs
 			AppSlugOrPort: appNameOwner,
-		}
+		}).Normalize()
 
 		rw := httptest.NewRecorder()
 		r := httptest.NewRequest("GET", "/app", nil)
 		r.Header.Set(codersdk.SessionTokenHeader, client.SessionToken())
 		r.AddCookie(&http.Cookie{
-			Name:  codersdk.DevURLSignedAppTokenCookie,
+			Name:  codersdk.SignedAppTokenCookie,
 			Value: badTokenStr,
 		})
 
@@ -566,7 +557,7 @@ func Test_ResolveRequest(t *testing.T) {
 		_ = w.Body.Close()
 		cookies := w.Cookies()
 		require.Len(t, cookies, 1)
-		require.Equal(t, cookies[0].Name, codersdk.DevURLSignedAppTokenCookie)
+		require.Equal(t, cookies[0].Name, codersdk.SignedAppTokenCookie)
 		require.NotEqual(t, cookies[0].Value, badTokenStr)
 		parsedToken, err := api.AppSecurityKey.VerifySignedToken(cookies[0].Value)
 		require.NoError(t, err)
@@ -576,14 +567,14 @@ func Test_ResolveRequest(t *testing.T) {
 	t.Run("PortPathBlocked", func(t *testing.T) {
 		t.Parallel()
 
-		req := workspaceapps.Request{
+		req := (workspaceapps.Request{
 			AccessMethod:      workspaceapps.AccessMethodPath,
 			BasePath:          "/app",
 			UsernameOrID:      me.Username,
 			WorkspaceNameOrID: workspace.Name,
 			AgentNameOrID:     agentName,
 			AppSlugOrPort:     "8080",
-		}
+		}).Normalize()
 
 		rw := httptest.NewRecorder()
 		r := httptest.NewRequest("GET", "/app", nil)
@@ -604,14 +595,14 @@ func Test_ResolveRequest(t *testing.T) {
 	t.Run("PortSubdomain", func(t *testing.T) {
 		t.Parallel()
 
-		req := workspaceapps.Request{
+		req := (workspaceapps.Request{
 			AccessMethod:      workspaceapps.AccessMethodSubdomain,
 			BasePath:          "/",
 			UsernameOrID:      me.Username,
 			WorkspaceNameOrID: workspace.Name,
 			AgentNameOrID:     agentName,
 			AppSlugOrPort:     "9090",
-		}
+		}).Normalize()
 
 		rw := httptest.NewRecorder()
 		r := httptest.NewRequest("GET", "/", nil)
@@ -633,11 +624,11 @@ func Test_ResolveRequest(t *testing.T) {
 	t.Run("Terminal", func(t *testing.T) {
 		t.Parallel()
 
-		req := workspaceapps.Request{
+		req := (workspaceapps.Request{
 			AccessMethod:  workspaceapps.AccessMethodTerminal,
 			BasePath:      "/app",
 			AgentNameOrID: agentID.String(),
-		}
+		}).Normalize()
 
 		rw := httptest.NewRecorder()
 		r := httptest.NewRequest("GET", "/app", nil)
@@ -664,14 +655,14 @@ func Test_ResolveRequest(t *testing.T) {
 	t.Run("InsufficientPermissions", func(t *testing.T) {
 		t.Parallel()
 
-		req := workspaceapps.Request{
+		req := (workspaceapps.Request{
 			AccessMethod:      workspaceapps.AccessMethodPath,
 			BasePath:          "/app",
 			UsernameOrID:      me.Username,
 			WorkspaceNameOrID: workspace.Name,
 			AgentNameOrID:     agentName,
 			AppSlugOrPort:     appNameOwner,
-		}
+		}).Normalize()
 
 		rw := httptest.NewRecorder()
 		r := httptest.NewRequest("GET", "/app", nil)
@@ -691,14 +682,14 @@ func Test_ResolveRequest(t *testing.T) {
 
 	t.Run("UserNotFound", func(t *testing.T) {
 		t.Parallel()
-		req := workspaceapps.Request{
+		req := (workspaceapps.Request{
 			AccessMethod:      workspaceapps.AccessMethodPath,
 			BasePath:          "/app",
 			UsernameOrID:      "thisuserdoesnotexist",
 			WorkspaceNameOrID: workspace.Name,
 			AgentNameOrID:     agentName,
 			AppSlugOrPort:     appNameOwner,
-		}
+		}).Normalize()
 
 		rw := httptest.NewRecorder()
 		r := httptest.NewRequest("GET", "/app", nil)
@@ -719,14 +710,14 @@ func Test_ResolveRequest(t *testing.T) {
 	t.Run("RedirectSubdomainAuth", func(t *testing.T) {
 		t.Parallel()
 
-		req := workspaceapps.Request{
+		req := (workspaceapps.Request{
 			AccessMethod:      workspaceapps.AccessMethodSubdomain,
 			BasePath:          "/",
 			UsernameOrID:      me.Username,
 			WorkspaceNameOrID: workspace.Name,
 			AgentNameOrID:     agentName,
 			AppSlugOrPort:     appNameOwner,
-		}
+		}).Normalize()
 
 		rw := httptest.NewRecorder()
 		r := httptest.NewRequest("GET", "/some-path", nil)
@@ -760,8 +751,14 @@ func Test_ResolveRequest(t *testing.T) {
 		redirectURI, err := url.Parse(redirectURIStr)
 		require.NoError(t, err)
 
-		appHost := fmt.Sprintf("%s--%s--%s--%s", req.AppSlugOrPort, req.AgentNameOrID, req.WorkspaceNameOrID, req.UsernameOrID)
-		host := strings.Replace(api.AppHostname, "*", appHost, 1)
+		appHost := httpapi.ApplicationURL{
+			Prefix:        "",
+			AppSlugOrPort: req.AppSlugOrPort,
+			AgentName:     req.AgentNameOrID,
+			WorkspaceName: req.WorkspaceNameOrID,
+			Username:      req.UsernameOrID,
+		}
+		host := strings.Replace(api.AppHostname, "*", appHost.String(), 1)
 
 		require.Equal(t, "http", redirectURI.Scheme)
 		require.Equal(t, host, redirectURI.Host)
@@ -771,14 +768,14 @@ func Test_ResolveRequest(t *testing.T) {
 	t.Run("UnhealthyAgent", func(t *testing.T) {
 		t.Parallel()
 
-		req := workspaceapps.Request{
+		req := (workspaceapps.Request{
 			AccessMethod:      workspaceapps.AccessMethodPath,
 			BasePath:          "/app",
 			UsernameOrID:      me.Username,
 			WorkspaceNameOrID: workspace.Name,
 			AgentNameOrID:     agentNameUnhealthy,
 			AppSlugOrPort:     appNameAgentUnhealthy,
-		}
+		}).Normalize()
 
 		rw := httptest.NewRecorder()
 		r := httptest.NewRequest("GET", "/app", nil)
@@ -832,14 +829,14 @@ func Test_ResolveRequest(t *testing.T) {
 			return false
 		}, testutil.WaitLong, testutil.IntervalFast, "wait for app to become unhealthy")
 
-		req := workspaceapps.Request{
+		req := (workspaceapps.Request{
 			AccessMethod:      workspaceapps.AccessMethodPath,
 			BasePath:          "/app",
 			UsernameOrID:      me.Username,
 			WorkspaceNameOrID: workspace.Name,
 			AgentNameOrID:     agentName,
 			AppSlugOrPort:     appNameUnhealthy,
-		}
+		}).Normalize()
 
 		rw := httptest.NewRecorder()
 		r := httptest.NewRequest("GET", "/app", nil)
diff --git a/coderd/workspaceapps/errors.go b/coderd/workspaceapps/errors.go
index b9724c6f79f69..bcc890c81e89a 100644
--- a/coderd/workspaceapps/errors.go
+++ b/coderd/workspaceapps/errors.go
@@ -5,21 +5,25 @@ import (
 	"net/url"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/site"
+	"github.com/coder/coder/v2/site"
 )
 
 // WriteWorkspaceApp404 writes a HTML 404 error page for a workspace app. If
 // appReq is not nil, it will be used to log the request details at debug level.
-func WriteWorkspaceApp404(log slog.Logger, accessURL *url.URL, rw http.ResponseWriter, r *http.Request, appReq *Request, msg string) {
+//
+// The 'warnings' parameter is sent to the user, 'details' is only shown in the logs.
+func WriteWorkspaceApp404(log slog.Logger, accessURL *url.URL, rw http.ResponseWriter, r *http.Request, appReq *Request, warnings []string, details string) {
 	if appReq != nil {
 		slog.Helper()
 		log.Debug(r.Context(),
-			"workspace app 404: "+msg,
+			"workspace app 404: "+details,
 			slog.F("username_or_id", appReq.UsernameOrID),
 			slog.F("workspace_and_agent", appReq.WorkspaceAndAgent),
 			slog.F("workspace_name_or_id", appReq.WorkspaceNameOrID),
 			slog.F("agent_name_or_id", appReq.AgentNameOrID),
 			slog.F("app_slug_or_port", appReq.AppSlugOrPort),
+			slog.F("hostname_prefix", appReq.Prefix),
+			slog.F("warnings", warnings),
 		)
 	}
 
@@ -29,6 +33,7 @@ func WriteWorkspaceApp404(log slog.Logger, accessURL *url.URL, rw http.ResponseW
 		Description:  "The application or workspace you are trying to access does not exist or you do not have permission to access it.",
 		RetryEnabled: false,
 		DashboardURL: accessURL.String(),
+		Warnings:     warnings,
 	})
 }
 
@@ -44,6 +49,7 @@ func WriteWorkspaceApp500(log slog.Logger, accessURL *url.URL, rw http.ResponseW
 			slog.F("workspace_name_or_id", appReq.WorkspaceNameOrID),
 			slog.F("agent_name_or_id", appReq.AgentNameOrID),
 			slog.F("app_name_or_port", appReq.AppSlugOrPort),
+			slog.F("hostname_prefix", appReq.Prefix),
 		)
 	}
 	log.Warn(ctx,
@@ -72,6 +78,7 @@ func WriteWorkspaceAppOffline(log slog.Logger, accessURL *url.URL, rw http.Respo
 			slog.F("workspace_name_or_id", appReq.WorkspaceNameOrID),
 			slog.F("agent_name_or_id", appReq.AgentNameOrID),
 			slog.F("app_slug_or_port", appReq.AppSlugOrPort),
+			slog.F("hostname_prefix", appReq.Prefix),
 		)
 	}
 
diff --git a/coderd/workspaceapps/provider.go b/coderd/workspaceapps/provider.go
index 62b6da02a6050..8d4b7fd149800 100644
--- a/coderd/workspaceapps/provider.go
+++ b/coderd/workspaceapps/provider.go
@@ -7,8 +7,7 @@ import (
 	"time"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 const (
@@ -58,7 +57,7 @@ func ResolveRequest(rw http.ResponseWriter, r *http.Request, opts ResolveRequest
 		AppRequest:     appReq,
 		PathAppBaseURL: opts.PathAppBaseURL.String(),
 		AppHostname:    opts.AppHostname,
-		SessionToken:   httpmw.APITokenFromRequest(r),
+		SessionToken:   AppConnectSessionTokenFromRequest(r, appReq.AccessMethod),
 		AppPath:        opts.AppPath,
 		AppQuery:       opts.AppQuery,
 	}
@@ -68,11 +67,16 @@ func ResolveRequest(rw http.ResponseWriter, r *http.Request, opts ResolveRequest
 		return nil, false
 	}
 
-	// Write the signed app token cookie. We always want this to apply to the
-	// current hostname (even for subdomain apps, without any wildcard
-	// shenanigans, because the token is only valid for a single app).
+	// Write the signed app token cookie.
+	//
+	// For path apps, this applies to only the path app base URL on the current
+	// domain, e.g.
+	//   /@user/workspace[.agent]/apps/path-app/
+	//
+	// For subdomain apps, this applies to the entire subdomain, e.g.
+	//   app--agent--workspace--user.apps.example.com
 	http.SetCookie(rw, &http.Cookie{
-		Name:    codersdk.DevURLSignedAppTokenCookie,
+		Name:    codersdk.SignedAppTokenCookie,
 		Value:   tokenStr,
 		Path:    appReq.BasePath,
 		Expires: token.Expiry,
diff --git a/coderd/workspaceapps/proxy.go b/coderd/workspaceapps/proxy.go
index 9b2d9c4bfa297..c883194faf372 100644
--- a/coderd/workspaceapps/proxy.go
+++ b/coderd/workspaceapps/proxy.go
@@ -18,13 +18,14 @@ import (
 	"nhooyr.io/websocket"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/agent/agentssh"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/coderd/util/slice"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/site"
+	"github.com/coder/coder/v2/agent/agentssh"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/site"
 )
 
 const (
@@ -109,7 +110,8 @@ type Server struct {
 	DisablePathApps  bool
 	SecureAuthCookie bool
 
-	AgentProvider AgentProvider
+	AgentProvider  AgentProvider
+	StatsCollector *StatsCollector
 
 	websocketWaitMutex sync.Mutex
 	websocketWaitGroup sync.WaitGroup
@@ -122,6 +124,10 @@ func (s *Server) Close() error {
 	s.websocketWaitGroup.Wait()
 	s.websocketWaitMutex.Unlock()
 
+	if s.StatsCollector != nil {
+		_ = s.StatsCollector.Close()
+	}
+
 	// The caller must close the SignedTokenProvider and the AgentProvider (if
 	// necessary).
 
@@ -214,8 +220,12 @@ func (s *Server) handleAPIKeySmuggling(rw http.ResponseWriter, r *http.Request,
 	// We don't set an expiration because the key in the database already has an
 	// expiration, and expired tokens don't affect the user experience (they get
 	// auto-redirected to re-smuggle the API key).
+	//
+	// We use different cookie names for path apps and for subdomain apps to
+	// avoid both being set and sent to the server at the same time and the
+	// server using the wrong value.
 	http.SetCookie(rw, &http.Cookie{
-		Name:     codersdk.DevURLSessionTokenCookie,
+		Name:     AppConnectSessionTokenCookieName(accessMethod),
 		Value:    token,
 		Domain:   domain,
 		Path:     "/",
@@ -246,8 +256,8 @@ func (s *Server) handleAPIKeySmuggling(rw http.ResponseWriter, r *http.Request,
 func (s *Server) workspaceAppsProxyPath(rw http.ResponseWriter, r *http.Request) {
 	if s.DisablePathApps {
 		site.RenderStaticErrorPage(rw, r, site.ErrorPageData{
-			Status:       http.StatusUnauthorized,
-			Title:        "Unauthorized",
+			Status:       http.StatusForbidden,
+			Title:        "Forbidden",
 			Description:  "Path-based applications are disabled on this Coder deployment by the administrator.",
 			RetryEnabled: false,
 			DashboardURL: s.DashboardURL.String(),
@@ -291,6 +301,7 @@ func (s *Server) workspaceAppsProxyPath(rw http.ResponseWriter, r *http.Request)
 		AppRequest: Request{
 			AccessMethod:      AccessMethodPath,
 			BasePath:          basePath,
+			Prefix:            "", // Prefix doesn't exist for path apps
 			UsernameOrID:      chi.URLParam(r, "user"),
 			WorkspaceAndAgent: chi.URLParam(r, "workspace_and_agent"),
 			// We don't support port proxying on paths. The ResolveRequest method
@@ -395,6 +406,7 @@ func (s *Server) HandleSubdomain(middlewares ...func(http.Handler) http.Handler)
 					AppRequest: Request{
 						AccessMethod:      AccessMethodSubdomain,
 						BasePath:          "/",
+						Prefix:            app.Prefix,
 						UsernameOrID:      app.Username,
 						WorkspaceNameOrID: app.WorkspaceName,
 						AgentNameOrID:     app.AgentName,
@@ -586,6 +598,14 @@ func (s *Server) proxyWorkspaceApp(rw http.ResponseWriter, r *http.Request, appT
 	// end span so we don't get long lived trace data
 	tracing.EndHTTPSpan(r, http.StatusOK, trace.SpanFromContext(ctx))
 
+	report := newStatsReportFromSignedToken(appToken)
+	s.collectStats(report)
+	defer func() {
+		// We must use defer here because ServeHTTP may panic.
+		report.SessionEndedAt = dbtime.Now()
+		s.collectStats(report)
+	}()
+
 	proxy.ServeHTTP(rw, r)
 }
 
@@ -669,7 +689,6 @@ func (s *Server) workspaceAgentPTY(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 	defer release()
-	defer agentConn.Close()
 	log.Debug(ctx, "dialed workspace agent")
 	ptNetConn, err := agentConn.ReconnectingPTY(ctx, reconnect, uint16(height), uint16(width), r.URL.Query().Get("command"))
 	if err != nil {
@@ -679,10 +698,24 @@ func (s *Server) workspaceAgentPTY(rw http.ResponseWriter, r *http.Request) {
 	}
 	defer ptNetConn.Close()
 	log.Debug(ctx, "obtained PTY")
+
+	report := newStatsReportFromSignedToken(*appToken)
+	s.collectStats(report)
+	defer func() {
+		report.SessionEndedAt = dbtime.Now()
+		s.collectStats(report)
+	}()
+
 	agentssh.Bicopy(ctx, wsNetConn, ptNetConn)
 	log.Debug(ctx, "pty Bicopy finished")
 }
 
+func (s *Server) collectStats(stats StatsReport) {
+	if s.StatsCollector != nil {
+		s.StatsCollector.Collect(stats)
+	}
+}
+
 // wsNetConn wraps net.Conn created by websocket.NetConn(). Cancel func
 // is called if a read or write error is encountered.
 type wsNetConn struct {
diff --git a/coderd/workspaceapps/request.go b/coderd/workspaceapps/request.go
index e9d0ff9ffcc3a..c46413d22961f 100644
--- a/coderd/workspaceapps/request.go
+++ b/coderd/workspaceapps/request.go
@@ -12,8 +12,9 @@ import (
 
 	"github.com/google/uuid"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type AccessMethod string
@@ -61,8 +62,15 @@ func (r IssueTokenRequest) AppBaseURL() (*url.URL, error) {
 		if r.AppHostname == "" {
 			return nil, xerrors.New("subdomain app hostname is required to generate subdomain app URL")
 		}
-		appHost := fmt.Sprintf("%s--%s--%s--%s", r.AppRequest.AppSlugOrPort, r.AppRequest.AgentNameOrID, r.AppRequest.WorkspaceNameOrID, r.AppRequest.UsernameOrID)
-		u.Host = strings.Replace(r.AppHostname, "*", appHost, 1)
+
+		appHost := httpapi.ApplicationURL{
+			Prefix:        r.AppRequest.Prefix,
+			AppSlugOrPort: r.AppRequest.AppSlugOrPort,
+			AgentName:     r.AppRequest.AgentNameOrID,
+			WorkspaceName: r.AppRequest.WorkspaceNameOrID,
+			Username:      r.AppRequest.UsernameOrID,
+		}
+		u.Host = strings.Replace(r.AppHostname, "*", appHost.String(), 1)
 		u.Path = r.AppRequest.BasePath
 		return u, nil
 	default:
@@ -76,6 +84,9 @@ type Request struct {
 	// for this particular app. For subdomain apps, this should be "/". This is
 	// used for setting the cookie path.
 	BasePath string `json:"base_path"`
+	// Prefix is the prefix of the subdomain app URL. Prefix should have a
+	// trailing "---" if set.
+	Prefix string `json:"app_prefix"`
 
 	// For the following fields, if the AccessMethod is AccessMethodTerminal,
 	// then only AgentNameOrID may be set and it must be a UUID. The other
@@ -103,6 +114,10 @@ func (r Request) Normalize() Request {
 		}
 	}
 
+	if !strings.HasSuffix(req.BasePath, "/") {
+		req.BasePath += "/"
+	}
+
 	return req
 }
 
@@ -159,6 +174,13 @@ func (r Request) Validate() error {
 		return xerrors.New("app slug or port is required")
 	}
 
+	if r.Prefix != "" && r.AccessMethod != AccessMethodSubdomain {
+		return xerrors.New("prefix is only valid for subdomain apps")
+	}
+	if r.Prefix != "" && !strings.HasSuffix(r.Prefix, "---") {
+		return xerrors.New("prefix must have a trailing '---'")
+	}
+
 	return nil
 }
 
diff --git a/coderd/workspaceapps/request_test.go b/coderd/workspaceapps/request_test.go
index e6fb0279d3ecd..eebda105f01b6 100644
--- a/coderd/workspaceapps/request_test.go
+++ b/coderd/workspaceapps/request_test.go
@@ -6,7 +6,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/workspaceapps"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
 )
 
 func Test_RequestValidate(t *testing.T) {
@@ -15,6 +15,7 @@ func Test_RequestValidate(t *testing.T) {
 	cases := []struct {
 		name        string
 		req         workspaceapps.Request
+		noNormalize bool
 		errContains string
 	}{
 		{
@@ -90,6 +91,7 @@ func Test_RequestValidate(t *testing.T) {
 				AgentNameOrID:     "baz",
 				AppSlugOrPort:     "qux",
 			},
+			noNormalize: true,
 			errContains: "base path is required",
 		},
 		{
@@ -151,6 +153,44 @@ func Test_RequestValidate(t *testing.T) {
 			},
 			errContains: "app slug or port is required",
 		},
+		{
+			name: "Prefix/OK",
+			req: workspaceapps.Request{
+				AccessMethod:      workspaceapps.AccessMethodSubdomain,
+				Prefix:            "blah---",
+				BasePath:          "/",
+				UsernameOrID:      "foo",
+				WorkspaceNameOrID: "bar",
+				AgentNameOrID:     "baz",
+				AppSlugOrPort:     "qux",
+			},
+		},
+		{
+			name: "Prefix/Invalid",
+			req: workspaceapps.Request{
+				AccessMethod:      workspaceapps.AccessMethodSubdomain,
+				Prefix:            "blah", // no trailing ---
+				BasePath:          "/",
+				UsernameOrID:      "foo",
+				WorkspaceNameOrID: "bar",
+				AgentNameOrID:     "baz",
+				AppSlugOrPort:     "qux",
+			},
+			errContains: "prefix must have a trailing '---'",
+		},
+		{
+			name: "Prefix/NotAllowedPath",
+			req: workspaceapps.Request{
+				AccessMethod:      workspaceapps.AccessMethodPath,
+				Prefix:            "blah---",
+				BasePath:          "/",
+				UsernameOrID:      "foo",
+				WorkspaceNameOrID: "bar",
+				AgentNameOrID:     "baz",
+				AppSlugOrPort:     "qux",
+			},
+			errContains: "prefix is only valid for subdomain apps",
+		},
 		{
 			name: "Terminal/OtherFields/UsernameOrID",
 			req: workspaceapps.Request{
@@ -215,7 +255,10 @@ func Test_RequestValidate(t *testing.T) {
 		c := c
 		t.Run(c.name, func(t *testing.T) {
 			t.Parallel()
-			req := c.req.Normalize()
+			req := c.req
+			if !c.noNormalize {
+				req = c.req.Normalize()
+			}
 			err := req.Validate()
 			if c.errContains == "" {
 				require.NoError(t, err)
diff --git a/coderd/workspaceapps/stats.go b/coderd/workspaceapps/stats.go
new file mode 100644
index 0000000000000..bb00b1c27ab12
--- /dev/null
+++ b/coderd/workspaceapps/stats.go
@@ -0,0 +1,404 @@
+package workspaceapps
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+)
+
+const (
+	DefaultStatsCollectorReportInterval = 30 * time.Second
+	DefaultStatsCollectorRollupWindow   = 1 * time.Minute
+	DefaultStatsDBReporterBatchSize     = 1024
+)
+
+// StatsReport is a report of a workspace app session.
+type StatsReport struct {
+	UserID           uuid.UUID    `json:"user_id"`
+	WorkspaceID      uuid.UUID    `json:"workspace_id"`
+	AgentID          uuid.UUID    `json:"agent_id"`
+	AccessMethod     AccessMethod `json:"access_method"`
+	SlugOrPort       string       `json:"slug_or_port"`
+	SessionID        uuid.UUID    `json:"session_id"`
+	SessionStartedAt time.Time    `json:"session_started_at"`
+	SessionEndedAt   time.Time    `json:"session_ended_at"` // Updated periodically while app is in use active and when the last connection is closed.
+	Requests         int          `json:"requests"`
+
+	rolledUp bool // Indicates if this report has been rolled up.
+}
+
+func newStatsReportFromSignedToken(token SignedToken) StatsReport {
+	return StatsReport{
+		UserID:           token.UserID,
+		WorkspaceID:      token.WorkspaceID,
+		AgentID:          token.AgentID,
+		AccessMethod:     token.AccessMethod,
+		SlugOrPort:       token.AppSlugOrPort,
+		SessionID:        uuid.New(),
+		SessionStartedAt: dbtime.Now(),
+		Requests:         1,
+	}
+}
+
+// StatsReporter reports workspace app StatsReports.
+type StatsReporter interface {
+	Report(context.Context, []StatsReport) error
+}
+
+var _ StatsReporter = (*StatsDBReporter)(nil)
+
+// StatsDBReporter writes workspace app StatsReports to the database.
+type StatsDBReporter struct {
+	db        database.Store
+	batchSize int
+}
+
+// NewStatsDBReporter returns a new StatsDBReporter.
+func NewStatsDBReporter(db database.Store, batchSize int) *StatsDBReporter {
+	return &StatsDBReporter{
+		db:        db,
+		batchSize: batchSize,
+	}
+}
+
+// Report writes the given StatsReports to the database.
+func (r *StatsDBReporter) Report(ctx context.Context, stats []StatsReport) error {
+	err := r.db.InTx(func(tx database.Store) error {
+		maxBatchSize := r.batchSize
+		if len(stats) < maxBatchSize {
+			maxBatchSize = len(stats)
+		}
+		batch := database.InsertWorkspaceAppStatsParams{
+			UserID:           make([]uuid.UUID, 0, maxBatchSize),
+			WorkspaceID:      make([]uuid.UUID, 0, maxBatchSize),
+			AgentID:          make([]uuid.UUID, 0, maxBatchSize),
+			AccessMethod:     make([]string, 0, maxBatchSize),
+			SlugOrPort:       make([]string, 0, maxBatchSize),
+			SessionID:        make([]uuid.UUID, 0, maxBatchSize),
+			SessionStartedAt: make([]time.Time, 0, maxBatchSize),
+			SessionEndedAt:   make([]time.Time, 0, maxBatchSize),
+			Requests:         make([]int32, 0, maxBatchSize),
+		}
+		for _, stat := range stats {
+			batch.UserID = append(batch.UserID, stat.UserID)
+			batch.WorkspaceID = append(batch.WorkspaceID, stat.WorkspaceID)
+			batch.AgentID = append(batch.AgentID, stat.AgentID)
+			batch.AccessMethod = append(batch.AccessMethod, string(stat.AccessMethod))
+			batch.SlugOrPort = append(batch.SlugOrPort, stat.SlugOrPort)
+			batch.SessionID = append(batch.SessionID, stat.SessionID)
+			batch.SessionStartedAt = append(batch.SessionStartedAt, stat.SessionStartedAt)
+			batch.SessionEndedAt = append(batch.SessionEndedAt, stat.SessionEndedAt)
+			batch.Requests = append(batch.Requests, int32(stat.Requests))
+
+			if len(batch.UserID) >= r.batchSize {
+				err := tx.InsertWorkspaceAppStats(ctx, batch)
+				if err != nil {
+					return err
+				}
+
+				// Reset batch.
+				batch.UserID = batch.UserID[:0]
+				batch.WorkspaceID = batch.WorkspaceID[:0]
+				batch.AgentID = batch.AgentID[:0]
+				batch.AccessMethod = batch.AccessMethod[:0]
+				batch.SlugOrPort = batch.SlugOrPort[:0]
+				batch.SessionID = batch.SessionID[:0]
+				batch.SessionStartedAt = batch.SessionStartedAt[:0]
+				batch.SessionEndedAt = batch.SessionEndedAt[:0]
+				batch.Requests = batch.Requests[:0]
+			}
+		}
+		if len(batch.UserID) > 0 {
+			err := tx.InsertWorkspaceAppStats(ctx, batch)
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}, nil)
+	if err != nil {
+		return xerrors.Errorf("insert workspace app stats failed: %w", err)
+	}
+
+	return nil
+}
+
+// This should match the database unique constraint.
+type statsGroupKey struct {
+	StartTimeTrunc time.Time
+	UserID         uuid.UUID
+	WorkspaceID    uuid.UUID
+	AgentID        uuid.UUID
+	AccessMethod   AccessMethod
+	SlugOrPort     string
+}
+
+func (s StatsReport) groupKey(windowSize time.Duration) statsGroupKey {
+	return statsGroupKey{
+		StartTimeTrunc: s.SessionStartedAt.Truncate(windowSize),
+		UserID:         s.UserID,
+		WorkspaceID:    s.WorkspaceID,
+		AgentID:        s.AgentID,
+		AccessMethod:   s.AccessMethod,
+		SlugOrPort:     s.SlugOrPort,
+	}
+}
+
+// StatsCollector collects workspace app StatsReports and reports them
+// in batches, stats compaction is performed for short-lived sessions.
+type StatsCollector struct {
+	opts StatsCollectorOptions
+
+	ctx    context.Context
+	cancel context.CancelFunc
+	done   chan struct{}
+
+	mu               sync.Mutex                       // Protects following.
+	statsBySessionID map[uuid.UUID]*StatsReport       // Track unique sessions.
+	groupedStats     map[statsGroupKey][]*StatsReport // Rolled up stats for sessions in close proximity.
+	backlog          []StatsReport                    // Stats that have not been reported yet (due to error).
+}
+
+type StatsCollectorOptions struct {
+	Logger   *slog.Logger
+	Reporter StatsReporter
+	// ReportInterval is the interval at which stats are reported, both partial
+	// and fully formed stats.
+	ReportInterval time.Duration
+	// RollupWindow is the window size for rolling up stats, session shorter
+	// than this will be rolled up and longer than this will be tracked
+	// individually.
+	RollupWindow time.Duration
+
+	// Options for tests.
+	Flush <-chan chan<- struct{}
+	Now   func() time.Time
+}
+
+func NewStatsCollector(opts StatsCollectorOptions) *StatsCollector {
+	if opts.Logger == nil {
+		opts.Logger = &slog.Logger{}
+	}
+	if opts.ReportInterval == 0 {
+		opts.ReportInterval = DefaultStatsCollectorReportInterval
+	}
+	if opts.RollupWindow == 0 {
+		opts.RollupWindow = DefaultStatsCollectorRollupWindow
+	}
+	if opts.Now == nil {
+		opts.Now = time.Now
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	sc := &StatsCollector{
+		ctx:    ctx,
+		cancel: cancel,
+		done:   make(chan struct{}),
+		opts:   opts,
+
+		statsBySessionID: make(map[uuid.UUID]*StatsReport),
+		groupedStats:     make(map[statsGroupKey][]*StatsReport),
+	}
+
+	go sc.start()
+	return sc
+}
+
+// Collect the given StatsReport for later reporting (non-blocking).
+func (sc *StatsCollector) Collect(report StatsReport) {
+	sc.mu.Lock()
+	defer sc.mu.Unlock()
+
+	r := &report
+	if _, ok := sc.statsBySessionID[report.SessionID]; !ok {
+		groupKey := r.groupKey(sc.opts.RollupWindow)
+		sc.groupedStats[groupKey] = append(sc.groupedStats[groupKey], r)
+	}
+
+	if r.SessionEndedAt.IsZero() {
+		sc.statsBySessionID[report.SessionID] = r
+	} else {
+		if stat, ok := sc.statsBySessionID[report.SessionID]; ok {
+			// Update in-place.
+			*stat = *r
+		}
+		delete(sc.statsBySessionID, report.SessionID)
+	}
+}
+
+// rollup performs stats rollup for sessions that fall within the
+// configured rollup window. For sessions longer than the window,
+// we report them individually.
+func (sc *StatsCollector) rollup(now time.Time) []StatsReport {
+	sc.mu.Lock()
+	defer sc.mu.Unlock()
+
+	var report []StatsReport
+
+	for g, group := range sc.groupedStats {
+		if len(group) == 0 {
+			// Safety check, this should not happen.
+			sc.opts.Logger.Error(sc.ctx, "empty stats group", "group", g)
+			delete(sc.groupedStats, g)
+			continue
+		}
+
+		var rolledUp *StatsReport
+		if group[0].rolledUp {
+			rolledUp = group[0]
+			group = group[1:]
+		} else {
+			rolledUp = &StatsReport{
+				UserID:           g.UserID,
+				WorkspaceID:      g.WorkspaceID,
+				AgentID:          g.AgentID,
+				AccessMethod:     g.AccessMethod,
+				SlugOrPort:       g.SlugOrPort,
+				SessionStartedAt: g.StartTimeTrunc,
+				SessionEndedAt:   g.StartTimeTrunc.Add(sc.opts.RollupWindow),
+				Requests:         0,
+				rolledUp:         true,
+			}
+		}
+		rollupChanged := false
+		newGroup := []*StatsReport{rolledUp} // Must be first in slice for future iterations (see group[0] above).
+		for _, stat := range group {
+			if !stat.SessionEndedAt.IsZero() && stat.SessionEndedAt.Sub(stat.SessionStartedAt) <= sc.opts.RollupWindow {
+				// This is a short-lived session, roll it up.
+				if rolledUp.SessionID == uuid.Nil {
+					rolledUp.SessionID = stat.SessionID // Borrow the first session ID, useful in tests.
+				}
+				rolledUp.Requests += stat.Requests
+				rollupChanged = true
+				continue
+			}
+			if stat.SessionEndedAt.IsZero() && now.Sub(stat.SessionStartedAt) <= sc.opts.RollupWindow {
+				// This is an incomplete session, wait and see if it'll be rolled up or not.
+				newGroup = append(newGroup, stat)
+				continue
+			}
+
+			// This is a long-lived session, report it individually.
+			// Make a copy of stat for reporting.
+			r := *stat
+			if r.SessionEndedAt.IsZero() {
+				// Report an end time for incomplete sessions, it will
+				// be updated later. This ensures that data in the DB
+				// will have an end time even if the service is stopped.
+				r.SessionEndedAt = now.UTC() // Use UTC like dbtime.Now().
+			}
+			report = append(report, r) // Report it (ended or incomplete).
+			if stat.SessionEndedAt.IsZero() {
+				newGroup = append(newGroup, stat) // Keep it for future updates.
+			}
+		}
+		if rollupChanged {
+			report = append(report, *rolledUp)
+		}
+
+		// Future rollups should only consider the compacted group.
+		sc.groupedStats[g] = newGroup
+
+		// Keep the group around until the next rollup window has passed
+		// in case data was collected late.
+		if len(newGroup) == 1 && rolledUp.SessionEndedAt.Add(sc.opts.RollupWindow).Before(now) {
+			delete(sc.groupedStats, g)
+		}
+	}
+
+	return report
+}
+
+func (sc *StatsCollector) flush(ctx context.Context) (err error) {
+	sc.opts.Logger.Debug(ctx, "flushing workspace app stats")
+	defer func() {
+		if err != nil {
+			sc.opts.Logger.Error(ctx, "failed to flush workspace app stats", "error", err)
+		} else {
+			sc.opts.Logger.Debug(ctx, "flushed workspace app stats")
+		}
+	}()
+
+	// We keep the backlog as a simple slice so that we don't need to
+	// attempt to merge it with the stats we're about to report. This
+	// is because the rollup is a one-way operation and the backlog may
+	// contain stats that are still in the statsBySessionID map and will
+	// be reported again in the future. It is possible to merge the
+	// backlog and the stats we're about to report, but it's not worth
+	// the complexity.
+	if len(sc.backlog) > 0 {
+		err = sc.opts.Reporter.Report(ctx, sc.backlog)
+		if err != nil {
+			return xerrors.Errorf("report workspace app stats from backlog failed: %w", err)
+		}
+		sc.backlog = nil
+	}
+
+	now := sc.opts.Now()
+	stats := sc.rollup(now)
+	if len(stats) == 0 {
+		return nil
+	}
+
+	err = sc.opts.Reporter.Report(ctx, stats)
+	if err != nil {
+		sc.backlog = stats
+		return xerrors.Errorf("report workspace app stats failed: %w", err)
+	}
+
+	return nil
+}
+
+func (sc *StatsCollector) Close() error {
+	sc.cancel()
+	<-sc.done
+	return nil
+}
+
+func (sc *StatsCollector) start() {
+	defer func() {
+		close(sc.done)
+		sc.opts.Logger.Debug(sc.ctx, "workspace app stats collector stopped")
+	}()
+	sc.opts.Logger.Debug(sc.ctx, "workspace app stats collector started")
+
+	t := time.NewTimer(sc.opts.ReportInterval)
+	defer t.Stop()
+
+	var reportFlushDone chan<- struct{}
+	done := false
+	for !done {
+		select {
+		case <-sc.ctx.Done():
+			t.Stop()
+			done = true
+		case <-t.C:
+		case reportFlushDone = <-sc.opts.Flush:
+		}
+
+		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+		//nolint:gocritic // Inserting app stats is a system function.
+		_ = sc.flush(dbauthz.AsSystemRestricted(ctx))
+		cancel()
+
+		if !done {
+			t.Reset(sc.opts.ReportInterval)
+		}
+
+		// For tests.
+		if reportFlushDone != nil {
+			reportFlushDone <- struct{}{}
+			reportFlushDone = nil
+		}
+	}
+}
diff --git a/coderd/workspaceapps/stats_test.go b/coderd/workspaceapps/stats_test.go
new file mode 100644
index 0000000000000..b1c4686197743
--- /dev/null
+++ b/coderd/workspaceapps/stats_test.go
@@ -0,0 +1,426 @@
+package workspaceapps_test
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/exp/slices"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/testutil"
+)
+
+type fakeReporter struct {
+	mu   sync.Mutex
+	s    []workspaceapps.StatsReport
+	err  error
+	errN int
+}
+
+func (r *fakeReporter) stats() []workspaceapps.StatsReport {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.s
+}
+
+func (r *fakeReporter) errors() int {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.errN
+}
+
+func (r *fakeReporter) setError(err error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.err = err
+}
+
+func (r *fakeReporter) Report(_ context.Context, stats []workspaceapps.StatsReport) error {
+	r.mu.Lock()
+	if r.err != nil {
+		r.errN++
+		r.mu.Unlock()
+		return r.err
+	}
+	r.s = append(r.s, stats...)
+	r.mu.Unlock()
+	return nil
+}
+
+func TestStatsCollector(t *testing.T) {
+	t.Parallel()
+
+	rollupUUID := uuid.New()
+	rollupUUID2 := uuid.New()
+	someUUID := uuid.New()
+
+	rollupWindow := time.Minute
+	start := dbtime.Now().Truncate(time.Minute).UTC()
+	end := start.Add(10 * time.Second)
+
+	tests := []struct {
+		name           string
+		flushIncrement time.Duration
+		flushCount     int
+		stats          []workspaceapps.StatsReport
+		want           []workspaceapps.StatsReport
+	}{
+		{
+			name:           "Single stat rolled up and reported once",
+			flushIncrement: 2*rollupWindow + time.Second,
+			flushCount:     10, // Only reported once.
+			stats: []workspaceapps.StatsReport{
+				{
+					SessionID:        rollupUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   end,
+					Requests:         1,
+				},
+			},
+			want: []workspaceapps.StatsReport{
+				{
+					SessionID:        rollupUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(rollupWindow),
+					Requests:         1,
+				},
+			},
+		},
+		{
+			name:           "Two unique stat rolled up",
+			flushIncrement: 2*rollupWindow + time.Second,
+			flushCount:     10, // Only reported once.
+			stats: []workspaceapps.StatsReport{
+				{
+					AccessMethod:     workspaceapps.AccessMethodPath,
+					SlugOrPort:       "code-server",
+					SessionID:        rollupUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   end,
+					Requests:         1,
+				},
+				{
+					AccessMethod:     workspaceapps.AccessMethodTerminal,
+					SessionID:        rollupUUID2,
+					SessionStartedAt: start,
+					SessionEndedAt:   end,
+					Requests:         1,
+				},
+			},
+			want: []workspaceapps.StatsReport{
+				{
+					AccessMethod:     workspaceapps.AccessMethodPath,
+					SlugOrPort:       "code-server",
+					SessionID:        rollupUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(rollupWindow),
+					Requests:         1,
+				},
+				{
+					AccessMethod:     workspaceapps.AccessMethodTerminal,
+					SessionID:        rollupUUID2,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(rollupWindow),
+					Requests:         1,
+				},
+			},
+		},
+		{
+			name:           "Multiple stats rolled up",
+			flushIncrement: 2*rollupWindow + time.Second,
+			flushCount:     2,
+			stats: []workspaceapps.StatsReport{
+				{
+					SessionID:        rollupUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   end,
+					Requests:         1,
+				},
+				{
+					SessionID:        uuid.New(),
+					SessionStartedAt: start,
+					SessionEndedAt:   end,
+					Requests:         1,
+				},
+			},
+			want: []workspaceapps.StatsReport{
+				{
+					SessionID:        rollupUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(rollupWindow),
+					Requests:         2,
+				},
+			},
+		},
+		{
+			name:           "Long sessions not rolled up but reported multiple times",
+			flushIncrement: rollupWindow + time.Second,
+			flushCount:     4,
+			stats: []workspaceapps.StatsReport{
+				{
+					SessionID:        rollupUUID,
+					SessionStartedAt: start,
+					Requests:         1,
+				},
+			},
+			want: []workspaceapps.StatsReport{
+				{
+					SessionID:        rollupUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(rollupWindow + time.Second),
+					Requests:         1,
+				},
+				{
+					SessionID:        rollupUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(2 * (rollupWindow + time.Second)),
+					Requests:         1,
+				},
+				{
+					SessionID:        rollupUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(3 * (rollupWindow + time.Second)),
+					Requests:         1,
+				},
+				{
+					SessionID:        rollupUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(4 * (rollupWindow + time.Second)),
+					Requests:         1,
+				},
+			},
+		},
+		{
+			name:           "Incomplete stats not reported until it exceeds rollup window",
+			flushIncrement: rollupWindow / 4,
+			flushCount:     6,
+			stats: []workspaceapps.StatsReport{
+				{
+					SessionID:        someUUID,
+					SessionStartedAt: start,
+					Requests:         1,
+				},
+			},
+			want: []workspaceapps.StatsReport{
+				{
+					SessionID:        someUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(rollupWindow / 4 * 5),
+					Requests:         1,
+				},
+				{
+					SessionID:        someUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(rollupWindow / 4 * 6),
+					Requests:         1,
+				},
+			},
+		},
+		{
+			name:           "Same stat reported without and with end time and rolled up",
+			flushIncrement: rollupWindow + time.Second,
+			flushCount:     1,
+			stats: []workspaceapps.StatsReport{
+				{
+					SessionID:        someUUID,
+					SessionStartedAt: start,
+					Requests:         1,
+				},
+				{
+					SessionID:        someUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(10 * time.Second),
+					Requests:         1,
+				},
+			},
+			want: []workspaceapps.StatsReport{
+				{
+					SessionID:        someUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(rollupWindow),
+					Requests:         1,
+				},
+			},
+		},
+		{
+			name:           "Same non-rolled up stat reported without and with end time",
+			flushIncrement: rollupWindow * 2,
+			flushCount:     1,
+			stats: []workspaceapps.StatsReport{
+				{
+					SessionID:        someUUID,
+					SessionStartedAt: start,
+					Requests:         1,
+				},
+				{
+					SessionID:        someUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(rollupWindow * 2),
+					Requests:         1,
+				},
+			},
+			want: []workspaceapps.StatsReport{
+				{
+					SessionID:        someUUID,
+					SessionStartedAt: start,
+					SessionEndedAt:   start.Add(rollupWindow * 2),
+					Requests:         1,
+				},
+			},
+		},
+	}
+
+	// Run tests.
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			flush := make(chan chan<- struct{}, 1)
+			var now atomic.Pointer[time.Time]
+			now.Store(&start)
+
+			reporter := &fakeReporter{}
+			collector := workspaceapps.NewStatsCollector(workspaceapps.StatsCollectorOptions{
+				Reporter:       reporter,
+				ReportInterval: time.Hour,
+				RollupWindow:   rollupWindow,
+
+				Flush: flush,
+				Now:   func() time.Time { return *now.Load() },
+			})
+
+			// Collect reports.
+			for _, report := range tt.stats {
+				collector.Collect(report)
+			}
+
+			// Advance time.
+			flushTime := start.Add(tt.flushIncrement)
+			for i := 0; i < tt.flushCount; i++ {
+				now.Store(&flushTime)
+				flushDone := make(chan struct{}, 1)
+				flush <- flushDone
+				<-flushDone
+				flushTime = flushTime.Add(tt.flushIncrement)
+			}
+
+			var gotStats []workspaceapps.StatsReport
+			require.Eventually(t, func() bool {
+				gotStats = reporter.stats()
+				return len(gotStats) == len(tt.want)
+			}, testutil.WaitMedium, testutil.IntervalFast)
+
+			// Order is not guaranteed.
+			sortBySessionID := func(a, b workspaceapps.StatsReport) int {
+				if a.SessionID == b.SessionID {
+					return int(a.SessionEndedAt.Sub(b.SessionEndedAt))
+				}
+				if a.SessionID.String() < b.SessionID.String() {
+					return -1
+				}
+				return 1
+			}
+			slices.SortFunc(tt.want, sortBySessionID)
+			slices.SortFunc(gotStats, sortBySessionID)
+
+			// Verify reported stats.
+			for i, got := range gotStats {
+				want := tt.want[i]
+
+				assert.Equal(t, want.SessionID, got.SessionID, "session ID; i = %d", i)
+				assert.Equal(t, want.SessionStartedAt, got.SessionStartedAt, "session started at; i = %d", i)
+				assert.Equal(t, want.SessionEndedAt, got.SessionEndedAt, "session ended at; i = %d", i)
+				assert.Equal(t, want.Requests, got.Requests, "requests; i = %d", i)
+			}
+		})
+	}
+}
+
+func TestStatsCollector_backlog(t *testing.T) {
+	t.Parallel()
+
+	rollupWindow := time.Minute
+	flush := make(chan chan<- struct{}, 1)
+
+	start := dbtime.Now().Truncate(time.Minute).UTC()
+	var now atomic.Pointer[time.Time]
+	now.Store(&start)
+
+	reporter := &fakeReporter{}
+	collector := workspaceapps.NewStatsCollector(workspaceapps.StatsCollectorOptions{
+		Reporter:       reporter,
+		ReportInterval: time.Hour,
+		RollupWindow:   rollupWindow,
+
+		Flush: flush,
+		Now:   func() time.Time { return *now.Load() },
+	})
+
+	reporter.setError(xerrors.New("some error"))
+
+	// The first collected stat is "rolled up" and moved into the
+	// backlog during the first flush. On the second flush nothing is
+	// rolled up due to being unable to report the backlog.
+	for i := 0; i < 2; i++ {
+		collector.Collect(workspaceapps.StatsReport{
+			SessionID:        uuid.New(),
+			SessionStartedAt: start,
+			SessionEndedAt:   start.Add(10 * time.Second),
+			Requests:         1,
+		})
+		start = start.Add(time.Minute)
+		now.Store(&start)
+
+		flushDone := make(chan struct{}, 1)
+		flush <- flushDone
+		<-flushDone
+	}
+
+	// Flush was performed 2 times, 2 reports should have failed.
+	wantErrors := 2
+	assert.Equal(t, wantErrors, reporter.errors())
+	assert.Empty(t, reporter.stats())
+
+	reporter.setError(nil)
+
+	// Flush again, this time the backlog should be reported in addition
+	// to the second collected stat being rolled up and reported.
+	flushDone := make(chan struct{}, 1)
+	flush <- flushDone
+	<-flushDone
+
+	assert.Equal(t, wantErrors, reporter.errors())
+	assert.Len(t, reporter.stats(), 2)
+}
+
+func TestStatsCollector_Close(t *testing.T) {
+	t.Parallel()
+
+	reporter := &fakeReporter{}
+	collector := workspaceapps.NewStatsCollector(workspaceapps.StatsCollectorOptions{
+		Reporter:       reporter,
+		ReportInterval: time.Hour,
+		RollupWindow:   time.Minute,
+	})
+
+	collector.Collect(workspaceapps.StatsReport{
+		SessionID:        uuid.New(),
+		SessionStartedAt: dbtime.Now(),
+		SessionEndedAt:   dbtime.Now(),
+		Requests:         1,
+	})
+
+	collector.Close()
+
+	// Verify that stats are reported after close.
+	assert.NotEmpty(t, reporter.stats())
+}
diff --git a/coderd/workspaceapps/token.go b/coderd/workspaceapps/token.go
index 3811602a2314c..80423beab14d7 100644
--- a/coderd/workspaceapps/token.go
+++ b/coderd/workspaceapps/token.go
@@ -5,14 +5,15 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/go-jose/go-jose/v3"
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 const (
@@ -38,8 +39,18 @@ type SignedToken struct {
 // MatchesRequest returns true if the token matches the request. Any token that
 // does not match the request should be considered invalid.
 func (t SignedToken) MatchesRequest(req Request) bool {
+	tokenBasePath := t.Request.BasePath
+	if !strings.HasSuffix(tokenBasePath, "/") {
+		tokenBasePath += "/"
+	}
+	reqBasePath := req.BasePath
+	if !strings.HasSuffix(reqBasePath, "/") {
+		reqBasePath += "/"
+	}
+
 	return t.AccessMethod == req.AccessMethod &&
-		t.BasePath == req.BasePath &&
+		tokenBasePath == reqBasePath &&
+		t.Prefix == req.Prefix &&
 		t.UsernameOrID == req.UsernameOrID &&
 		t.WorkspaceNameOrID == req.WorkspaceNameOrID &&
 		t.AgentNameOrID == req.AgentNameOrID &&
@@ -158,7 +169,7 @@ func (k SecurityKey) EncryptAPIKey(payload EncryptedAPIKeyPayload) (string, erro
 	if payload.ExpiresAt.IsZero() {
 		// Very short expiry as these keys are only used once as part of an
 		// automatic redirection flow.
-		payload.ExpiresAt = database.Now().Add(time.Minute)
+		payload.ExpiresAt = dbtime.Now().Add(time.Minute)
 	}
 
 	payloadBytes, err := json.Marshal(payload)
@@ -217,7 +228,7 @@ func (k SecurityKey) DecryptAPIKey(encryptedAPIKey string) (string, error) {
 	}
 
 	// Validate expiry.
-	if payload.ExpiresAt.Before(database.Now()) {
+	if payload.ExpiresAt.Before(dbtime.Now()) {
 		return "", xerrors.New("encrypted API key expired")
 	}
 
@@ -227,22 +238,39 @@ func (k SecurityKey) DecryptAPIKey(encryptedAPIKey string) (string, error) {
 // FromRequest returns the signed token from the request, if it exists and is
 // valid. The caller must check that the token matches the request.
 func FromRequest(r *http.Request, key SecurityKey) (*SignedToken, bool) {
-	// Get the token string from the request. We usually use a cookie for this,
-	// but for web terminal we also support a query parameter to support
-	// cross-domain terminal access.
-	tokenStr := ""
-	tokenCookie, cookieErr := r.Cookie(codersdk.DevURLSignedAppTokenCookie)
-	if cookieErr == nil {
-		tokenStr = tokenCookie.Value
-	} else {
-		tokenStr = r.URL.Query().Get(codersdk.SignedAppTokenQueryParameter)
+	// Get all signed app tokens from the request. This includes the query
+	// parameter and all matching cookies sent with the request. If there are
+	// somehow multiple signed app token cookies, we want to try all of them
+	// (up to 4). The first one that is valid is used.
+	//
+	// Browsers will send all cookies in the request, even if there are multiple
+	// with the same name on different paths.
+	//
+	// If using a query parameter the request MUST be a terminal request. We use
+	// this to support cross-domain terminal access for the web terminal.
+	var (
+		tokens        = []string{}
+		hasQueryParam = false
+	)
+	if q := r.URL.Query().Get(codersdk.SignedAppTokenQueryParameter); q != "" {
+		hasQueryParam = true
+		tokens = append(tokens, q)
+	}
+	for _, cookie := range r.Cookies() {
+		if cookie.Name == codersdk.SignedAppTokenCookie {
+			tokens = append(tokens, cookie.Value)
+		}
+	}
+
+	if len(tokens) > 4 {
+		tokens = tokens[:4]
 	}
 
-	if tokenStr != "" {
+	for _, tokenStr := range tokens {
 		token, err := key.VerifySignedToken(tokenStr)
 		if err == nil {
 			req := token.Request.Normalize()
-			if cookieErr != nil && req.AccessMethod != AccessMethodTerminal {
+			if hasQueryParam && req.AccessMethod != AccessMethodTerminal {
 				// The request must be a terminal request if we're using a
 				// query parameter.
 				return nil, false
diff --git a/coderd/workspaceapps/token_test.go b/coderd/workspaceapps/token_test.go
index 8b20180cabaf0..06ab8a2acd4b2 100644
--- a/coderd/workspaceapps/token_test.go
+++ b/coderd/workspaceapps/token_test.go
@@ -2,17 +2,21 @@ package workspaceapps_test
 
 import (
 	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"testing"
 	"time"
 
+	"github.com/coder/coder/v2/codersdk"
+
 	"github.com/go-jose/go-jose/v3"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 func Test_TokenMatchesRequest(t *testing.T) {
@@ -46,6 +50,29 @@ func Test_TokenMatchesRequest(t *testing.T) {
 			},
 			want: true,
 		},
+		{
+			name: "NormalizePath",
+			req: workspaceapps.Request{
+				AccessMethod:      workspaceapps.AccessMethodPath,
+				BasePath:          "/app",
+				UsernameOrID:      "foo",
+				WorkspaceNameOrID: "bar",
+				AgentNameOrID:     "baz",
+				AppSlugOrPort:     "qux",
+			},
+			token: workspaceapps.SignedToken{
+				Request: workspaceapps.Request{
+					AccessMethod: workspaceapps.AccessMethodPath,
+					// With trailing slash
+					BasePath:          "/app/",
+					UsernameOrID:      "foo",
+					WorkspaceNameOrID: "bar",
+					AgentNameOrID:     "baz",
+					AppSlugOrPort:     "qux",
+				},
+			},
+			want: true,
+		},
 		{
 			name: "DifferentAccessMethod",
 			req: workspaceapps.Request{
@@ -147,6 +174,54 @@ func Test_TokenMatchesRequest(t *testing.T) {
 			},
 			want: false,
 		},
+		{
+			name: "SamePrefix",
+			req: workspaceapps.Request{
+				AccessMethod:      workspaceapps.AccessMethodSubdomain,
+				Prefix:            "dean-was--here---",
+				BasePath:          "/",
+				UsernameOrID:      "foo",
+				WorkspaceNameOrID: "bar",
+				AgentNameOrID:     "baz",
+				AppSlugOrPort:     "qux",
+			},
+			token: workspaceapps.SignedToken{
+				Request: workspaceapps.Request{
+					AccessMethod:      workspaceapps.AccessMethodSubdomain,
+					Prefix:            "dean--was--here---",
+					BasePath:          "/",
+					UsernameOrID:      "foo",
+					WorkspaceNameOrID: "bar",
+					AgentNameOrID:     "baz",
+					AppSlugOrPort:     "quux",
+				},
+			},
+			want: false,
+		},
+		{
+			name: "DifferentPrefix",
+			req: workspaceapps.Request{
+				AccessMethod:      workspaceapps.AccessMethodSubdomain,
+				Prefix:            "yolo--",
+				BasePath:          "/",
+				UsernameOrID:      "foo",
+				WorkspaceNameOrID: "bar",
+				AgentNameOrID:     "baz",
+				AppSlugOrPort:     "qux",
+			},
+			token: workspaceapps.SignedToken{
+				Request: workspaceapps.Request{
+					AccessMethod:      workspaceapps.AccessMethodSubdomain,
+					Prefix:            "swag--",
+					BasePath:          "/",
+					UsernameOrID:      "foo",
+					WorkspaceNameOrID: "bar",
+					AgentNameOrID:     "baz",
+					AppSlugOrPort:     "quux",
+				},
+			},
+			want: false,
+		},
 	}
 
 	for _, c := range cases {
@@ -283,6 +358,62 @@ func Test_GenerateToken(t *testing.T) {
 	}
 }
 
+func Test_FromRequest(t *testing.T) {
+	t.Parallel()
+
+	t.Run("MultipleTokens", func(t *testing.T) {
+		t.Parallel()
+		r := httptest.NewRequest("GET", "/", nil)
+
+		// Add an invalid token
+		r.AddCookie(&http.Cookie{
+			Name:  codersdk.SignedAppTokenCookie,
+			Value: "invalid",
+		})
+
+		token := workspaceapps.SignedToken{
+			Request: workspaceapps.Request{
+				AccessMethod:      workspaceapps.AccessMethodSubdomain,
+				BasePath:          "/",
+				UsernameOrID:      "user",
+				WorkspaceAndAgent: "workspace/agent",
+				WorkspaceNameOrID: "workspace",
+				AgentNameOrID:     "agent",
+				AppSlugOrPort:     "app",
+			},
+			Expiry:      time.Now().Add(time.Hour),
+			UserID:      uuid.New(),
+			WorkspaceID: uuid.New(),
+			AgentID:     uuid.New(),
+			AppURL:      "/",
+		}
+
+		// Add an expired cookie
+		expired := token
+		expired.Expiry = time.Now().Add(time.Hour * -1)
+		expiredStr, err := coderdtest.AppSecurityKey.SignToken(token)
+		require.NoError(t, err)
+		r.AddCookie(&http.Cookie{
+			Name:  codersdk.SignedAppTokenCookie,
+			Value: expiredStr,
+		})
+
+		// Add a valid token
+		validStr, err := coderdtest.AppSecurityKey.SignToken(token)
+		require.NoError(t, err)
+
+		r.AddCookie(&http.Cookie{
+			Name:  codersdk.SignedAppTokenCookie,
+			Value: validStr,
+		})
+
+		signed, ok := workspaceapps.FromRequest(r, coderdtest.AppSecurityKey)
+		require.True(t, ok, "expected a token to be found")
+		// Confirm it is the correct token.
+		require.Equal(t, signed.UserID, token.UserID)
+	})
+}
+
 // The ParseToken fn is tested quite thoroughly in the GenerateToken test as
 // well.
 func Test_ParseToken(t *testing.T) {
@@ -384,7 +515,7 @@ func TestAPIKeyEncryption(t *testing.T) {
 			key := genAPIKey(t)
 			encrypted, err := coderdtest.AppSecurityKey.EncryptAPIKey(workspaceapps.EncryptedAPIKeyPayload{
 				APIKey:    key,
-				ExpiresAt: database.Now().Add(-1 * time.Hour),
+				ExpiresAt: dbtime.Now().Add(-1 * time.Hour),
 			})
 			require.NoError(t, err)
 
diff --git a/coderd/workspaceapps_test.go b/coderd/workspaceapps_test.go
index 8f31bed4d27d2..2018e1d8dde4e 100644
--- a/coderd/workspaceapps_test.go
+++ b/coderd/workspaceapps_test.go
@@ -9,16 +9,16 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/coderd/workspaceapps/apptest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/coderd/workspaceapps/apptest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestGetAppHost(t *testing.T) {
@@ -275,6 +275,7 @@ func TestWorkspaceApps(t *testing.T) {
 					"CF-Connecting-IP",
 				},
 			},
+			WorkspaceAppsStatsCollectorOptions: opts.StatsCollectorOptions,
 		})
 
 		user := coderdtest.CreateFirstUser(t, client)
diff --git a/coderd/workspacebuilds.go b/coderd/workspacebuilds.go
index c9156506b30c1..5025d778d83ad 100644
--- a/coderd/workspacebuilds.go
+++ b/coderd/workspacebuilds.go
@@ -12,18 +12,22 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 	"golang.org/x/exp/slices"
+	"golang.org/x/sync/errgroup"
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/wsbuilder"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/provisionerjobs"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/wsbuilder"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // @Summary Get workspace build
@@ -65,16 +69,26 @@ func (api *API) workspaceBuild(rw http.ResponseWriter, r *http.Request) {
 		})
 		return
 	}
+	ownerName, ok := usernameWithID(workspace.OwnerID, data.users)
+	if !ok {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error converting workspace build.",
+			Detail:  "owner not found for workspace",
+		})
+		return
+	}
 
 	apiBuild, err := api.convertWorkspaceBuild(
 		workspaceBuild,
 		workspace,
 		data.jobs[0],
-		data.users,
+		ownerName,
 		data.resources,
 		data.metadata,
 		data.agents,
 		data.apps,
+		data.scripts,
+		data.logSources,
 		data.templateVersions[0],
 	)
 	if err != nil {
@@ -151,7 +165,7 @@ func (api *API) workspaceBuilds(rw http.ResponseWriter, r *http.Request) {
 			AfterID:     paginationParams.AfterID,
 			OffsetOpt:   int32(paginationParams.Offset),
 			LimitOpt:    int32(paginationParams.Limit),
-			Since:       database.Time(since),
+			Since:       dbtime.Time(since),
 		}
 		workspaceBuilds, err = store.GetWorkspaceBuildsByWorkspaceID(ctx, req)
 		if xerrors.Is(err, sql.ErrNoRows) {
@@ -189,6 +203,8 @@ func (api *API) workspaceBuilds(rw http.ResponseWriter, r *http.Request) {
 		data.metadata,
 		data.agents,
 		data.apps,
+		data.scripts,
+		data.logSources,
 		data.templateVersions,
 	)
 	if err != nil {
@@ -267,16 +283,26 @@ func (api *API) workspaceBuildByBuildNumber(rw http.ResponseWriter, r *http.Requ
 		})
 		return
 	}
+	ownerName, ok := usernameWithID(workspace.OwnerID, data.users)
+	if !ok {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error converting workspace build.",
+			Detail:  "owner not found for workspace",
+		})
+		return
+	}
 
 	apiBuild, err := api.convertWorkspaceBuild(
 		workspaceBuild,
 		workspace,
 		data.jobs[0],
-		data.users,
+		ownerName,
 		data.resources,
 		data.metadata,
 		data.agents,
 		data.apps,
+		data.scripts,
+		data.logSources,
 		data.templateVersions[0],
 	)
 	if err != nil {
@@ -303,7 +329,6 @@ func (api *API) workspaceBuildByBuildNumber(rw http.ResponseWriter, r *http.Requ
 // @Param request body codersdk.CreateWorkspaceBuildRequest true "Create workspace build request"
 // @Success 200 {object} codersdk.WorkspaceBuild
 // @Router /workspaces/{workspace}/builds [post]
-// nolint:gocyclo
 func (api *API) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	apiKey := httpmw.APIKey(r)
@@ -348,6 +373,7 @@ func (api *API) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
 		func(action rbac.Action, object rbac.Objecter) bool {
 			return api.Authorize(r, action, object)
 		},
+		audit.WorkspaceBuildBaggageFromRequest(r),
 	)
 	var buildErr wsbuilder.BuildError
 	if xerrors.As(err, &buildErr) {
@@ -373,6 +399,11 @@ func (api *API) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
 		})
 		return
 	}
+	err = provisionerjobs.PostJob(api.Pubsub, *provisionerJob)
+	if err != nil {
+		// Client probably doesn't care about this error, so just log it.
+		api.Logger.Error(ctx, "failed to post provisioner job to pubsub", slog.Error(err))
+	}
 
 	users, err := api.Database.GetUsersByIDs(ctx, []uuid.UUID{
 		workspace.OwnerID,
@@ -385,6 +416,14 @@ func (api *API) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
 		})
 		return
 	}
+	ownerName, exists := usernameWithID(workspace.OwnerID, users)
+	if !exists {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error converting workspace build.",
+			Detail:  "owner not found for workspace",
+		})
+		return
+	}
 
 	apiBuild, err := api.convertWorkspaceBuild(
 		*workspaceBuild,
@@ -393,11 +432,13 @@ func (api *API) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
 			ProvisionerJob: *provisionerJob,
 			QueuePosition:  0,
 		},
-		users,
+		ownerName,
 		[]database.WorkspaceResource{},
 		[]database.WorkspaceResourceMetadatum{},
 		[]database.WorkspaceAgent{},
 		[]database.WorkspaceApp{},
+		[]database.WorkspaceAgentScript{},
+		[]database.WorkspaceAgentLogSource{},
 		database.TemplateVersion{},
 	)
 	if err != nil {
@@ -470,11 +511,11 @@ func (api *API) patchCancelWorkspaceBuild(rw http.ResponseWriter, r *http.Reques
 	err = api.Database.UpdateProvisionerJobWithCancelByID(ctx, database.UpdateProvisionerJobWithCancelByIDParams{
 		ID: job.ID,
 		CanceledAt: sql.NullTime{
-			Time:  database.Now(),
+			Time:  dbtime.Now(),
 			Valid: true,
 		},
 		CompletedAt: sql.NullTime{
-			Time: database.Now(),
+			Time: dbtime.Now(),
 			// If the job is running, don't mark it completed!
 			Valid: !job.WorkerID.Valid,
 		},
@@ -631,6 +672,8 @@ type workspaceBuildsData struct {
 	metadata         []database.WorkspaceResourceMetadatum
 	agents           []database.WorkspaceAgent
 	apps             []database.WorkspaceApp
+	scripts          []database.WorkspaceAgentScript
+	logSources       []database.WorkspaceAgentLogSource
 }
 
 func (api *API) workspaceBuildsData(ctx context.Context, workspaces []database.Workspace, workspaceBuilds []database.WorkspaceBuild) (workspaceBuildsData, error) {
@@ -709,10 +752,31 @@ func (api *API) workspaceBuildsData(ctx context.Context, workspaces []database.W
 		agentIDs = append(agentIDs, agent.ID)
 	}
 
-	// nolint:gocritic // Getting workspace apps by agent IDs is a system function.
-	apps, err := api.Database.GetWorkspaceAppsByAgentIDs(dbauthz.AsSystemRestricted(ctx), agentIDs)
-	if err != nil && !errors.Is(err, sql.ErrNoRows) {
-		return workspaceBuildsData{}, xerrors.Errorf("fetching workspace apps: %w", err)
+	var (
+		apps       []database.WorkspaceApp
+		scripts    []database.WorkspaceAgentScript
+		logSources []database.WorkspaceAgentLogSource
+	)
+
+	var eg errgroup.Group
+	eg.Go(func() (err error) {
+		// nolint:gocritic // Getting workspace apps by agent IDs is a system function.
+		apps, err = api.Database.GetWorkspaceAppsByAgentIDs(dbauthz.AsSystemRestricted(ctx), agentIDs)
+		return err
+	})
+	eg.Go(func() (err error) {
+		// nolint:gocritic // Getting workspace scripts by agent IDs is a system function.
+		scripts, err = api.Database.GetWorkspaceAgentScriptsByAgentIDs(dbauthz.AsSystemRestricted(ctx), agentIDs)
+		return err
+	})
+	eg.Go(func() error {
+		// nolint:gocritic // Getting workspace agent log sources by agent IDs is a system function.
+		logSources, err = api.Database.GetWorkspaceAgentLogSourcesByAgentIDs(dbauthz.AsSystemRestricted(ctx), agentIDs)
+		return err
+	})
+	err = eg.Wait()
+	if err != nil {
+		return workspaceBuildsData{}, err
 	}
 
 	return workspaceBuildsData{
@@ -723,6 +787,8 @@ func (api *API) workspaceBuildsData(ctx context.Context, workspaces []database.W
 		metadata:         metadata,
 		agents:           agents,
 		apps:             apps,
+		scripts:          scripts,
+		logSources:       logSources,
 	}, nil
 }
 
@@ -735,6 +801,8 @@ func (api *API) convertWorkspaceBuilds(
 	resourceMetadata []database.WorkspaceResourceMetadatum,
 	resourceAgents []database.WorkspaceAgent,
 	agentApps []database.WorkspaceApp,
+	agentScripts []database.WorkspaceAgentScript,
+	agentLogSources []database.WorkspaceAgentLogSource,
 	templateVersions []database.TemplateVersion,
 ) ([]codersdk.WorkspaceBuild, error) {
 	workspaceByID := map[uuid.UUID]database.Workspace{}
@@ -765,16 +833,22 @@ func (api *API) convertWorkspaceBuilds(
 		if !exists {
 			return nil, xerrors.New("template version not found")
 		}
+		ownerName, exists := usernameWithID(workspace.OwnerID, users)
+		if !exists {
+			return nil, xerrors.Errorf("owner not found for workspace: %q", workspace.Name)
+		}
 
 		apiBuild, err := api.convertWorkspaceBuild(
 			build,
 			workspace,
 			job,
-			users,
+			ownerName,
 			workspaceResources,
 			resourceMetadata,
 			resourceAgents,
 			agentApps,
+			agentScripts,
+			agentLogSources,
 			templateVersion,
 		)
 		if err != nil {
@@ -791,17 +865,15 @@ func (api *API) convertWorkspaceBuild(
 	build database.WorkspaceBuild,
 	workspace database.Workspace,
 	job database.GetProvisionerJobsByIDsWithQueuePositionRow,
-	users []database.User,
+	ownerName string,
 	workspaceResources []database.WorkspaceResource,
 	resourceMetadata []database.WorkspaceResourceMetadatum,
 	resourceAgents []database.WorkspaceAgent,
 	agentApps []database.WorkspaceApp,
+	agentScripts []database.WorkspaceAgentScript,
+	agentLogSources []database.WorkspaceAgentLogSource,
 	templateVersion database.TemplateVersion,
 ) (codersdk.WorkspaceBuild, error) {
-	userByID := map[uuid.UUID]database.User{}
-	for _, user := range users {
-		userByID[user.ID] = user
-	}
 	resourcesByJobID := map[uuid.UUID][]database.WorkspaceResource{}
 	for _, resource := range workspaceResources {
 		resourcesByJobID[resource.JobID] = append(resourcesByJobID[resource.JobID], resource)
@@ -818,10 +890,13 @@ func (api *API) convertWorkspaceBuild(
 	for _, app := range agentApps {
 		appsByAgentID[app.AgentID] = append(appsByAgentID[app.AgentID], app)
 	}
-
-	owner, exists := userByID[workspace.OwnerID]
-	if !exists {
-		return codersdk.WorkspaceBuild{}, xerrors.Errorf("owner not found for workspace: %q", workspace.Name)
+	scriptsByAgentID := map[uuid.UUID][]database.WorkspaceAgentScript{}
+	for _, script := range agentScripts {
+		scriptsByAgentID[script.WorkspaceAgentID] = append(scriptsByAgentID[script.WorkspaceAgentID], script)
+	}
+	logSourcesByAgentID := map[uuid.UUID][]database.WorkspaceAgentLogSource{}
+	for _, logSource := range agentLogSources {
+		logSourcesByAgentID[logSource.WorkspaceAgentID] = append(logSourcesByAgentID[logSource.WorkspaceAgentID], logSource)
 	}
 
 	resources := resourcesByJobID[job.ProvisionerJob.ID]
@@ -831,8 +906,10 @@ func (api *API) convertWorkspaceBuild(
 		apiAgents := make([]codersdk.WorkspaceAgent, 0)
 		for _, agent := range agents {
 			apps := appsByAgentID[agent.ID]
+			scripts := scriptsByAgentID[agent.ID]
+			logSources := logSourcesByAgentID[agent.ID]
 			apiAgent, err := convertWorkspaceAgent(
-				api.DERPMap(), *api.TailnetCoordinator.Load(), agent, convertApps(apps), api.AgentInactiveDisconnectTimeout,
+				api.DERPMap(), *api.TailnetCoordinator.Load(), agent, convertApps(apps, agent, ownerName, workspace), convertScripts(scripts), convertLogSources(logSources), api.AgentInactiveDisconnectTimeout,
 				api.DeploymentValues.AgentFallbackTroubleshootingURL.String(),
 			)
 			if err != nil {
@@ -850,7 +927,7 @@ func (api *API) convertWorkspaceBuild(
 		CreatedAt:           build.CreatedAt,
 		UpdatedAt:           build.UpdatedAt,
 		WorkspaceOwnerID:    workspace.OwnerID,
-		WorkspaceOwnerName:  owner.Username,
+		WorkspaceOwnerName:  ownerName,
 		WorkspaceID:         build.WorkspaceID,
 		WorkspaceName:       workspace.Name,
 		TemplateVersionID:   build.TemplateVersionID,
diff --git a/coderd/workspacebuilds_test.go b/coderd/workspacebuilds_test.go
index b838e39e3b251..0978a1743affd 100644
--- a/coderd/workspacebuilds_test.go
+++ b/coderd/workspacebuilds_test.go
@@ -12,32 +12,48 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/propagation"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestWorkspaceBuild(t *testing.T) {
 	t.Parallel()
-	client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+	otel.SetTextMapPropagator(
+		propagation.NewCompositeTextMapPropagator(
+			propagation.TraceContext{},
+			propagation.Baggage{},
+		),
+	)
+	auditor := audit.NewMock()
+	client := coderdtest.New(t, &coderdtest.Options{
+		IncludeProvisionerDaemon: true,
+		Auditor:                  auditor,
+	})
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+	auditor.ResetLogs()
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-
-	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-	defer cancel()
-
-	_, err := client.WorkspaceBuild(ctx, workspace.LatestBuild.ID)
-	require.NoError(t, err)
+	_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+	// Create workspace will also start a build, so we need to wait for
+	// it to ensure all events are recorded.
+	require.Len(t, auditor.AuditLogs(), 2)
+	require.Equal(t, auditor.AuditLogs()[0].Ip.IPNet.IP.String(), "127.0.0.1")
+	require.Equal(t, auditor.AuditLogs()[1].Ip.IPNet.IP.String(), "127.0.0.1")
 }
 
 func TestWorkspaceBuildByBuildNumber(t *testing.T) {
@@ -54,7 +70,7 @@ func TestWorkspaceBuildByBuildNumber(t *testing.T) {
 		require.NoError(t, err, "fetch me")
 		version := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, first.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, first.OrganizationID, template.ID)
 		_, err = client.WorkspaceBuildByUsernameAndWorkspaceNameAndBuildNumber(
 			ctx,
@@ -77,7 +93,7 @@ func TestWorkspaceBuildByBuildNumber(t *testing.T) {
 		require.NoError(t, err, "fetch me")
 		version := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, first.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, first.OrganizationID, template.ID)
 		_, err = client.WorkspaceBuildByUsernameAndWorkspaceNameAndBuildNumber(
 			ctx,
@@ -103,7 +119,7 @@ func TestWorkspaceBuildByBuildNumber(t *testing.T) {
 		require.NoError(t, err, "fetch me")
 		version := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, first.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, first.OrganizationID, template.ID)
 		_, err = client.WorkspaceBuildByUsernameAndWorkspaceNameAndBuildNumber(
 			ctx,
@@ -129,7 +145,7 @@ func TestWorkspaceBuildByBuildNumber(t *testing.T) {
 		require.NoError(t, err, "fetch me")
 		version := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, first.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, first.OrganizationID, template.ID)
 		_, err = client.WorkspaceBuildByUsernameAndWorkspaceNameAndBuildNumber(
 			ctx,
@@ -158,7 +174,7 @@ func TestWorkspaceBuilds(t *testing.T) {
 		require.NoError(t, err, "fetch me")
 		version := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, first.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, first.OrganizationID, template.ID)
 		builds, err := client.WorkspaceBuilds(ctx,
 			codersdk.WorkspaceBuildsRequest{WorkspaceID: workspace.ID})
@@ -169,7 +185,7 @@ func TestWorkspaceBuilds(t *testing.T) {
 
 		// Test since
 		builds, err = client.WorkspaceBuilds(ctx,
-			codersdk.WorkspaceBuildsRequest{WorkspaceID: workspace.ID, Since: database.Now().Add(time.Minute)},
+			codersdk.WorkspaceBuildsRequest{WorkspaceID: workspace.ID, Since: dbtime.Now().Add(time.Minute)},
 		)
 		require.NoError(t, err)
 		require.Len(t, builds, 0)
@@ -177,7 +193,7 @@ func TestWorkspaceBuilds(t *testing.T) {
 		require.NotNil(t, builds)
 
 		builds, err = client.WorkspaceBuilds(ctx,
-			codersdk.WorkspaceBuildsRequest{WorkspaceID: workspace.ID, Since: database.Now().Add(-time.Hour)},
+			codersdk.WorkspaceBuildsRequest{WorkspaceID: workspace.ID, Since: dbtime.Now().Add(-time.Hour)},
 		)
 		require.NoError(t, err)
 		require.Len(t, builds, 1)
@@ -194,13 +210,13 @@ func TestWorkspaceBuilds(t *testing.T) {
 
 		version := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, first.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace, err := second.CreateWorkspace(ctx, first.OrganizationID, first.UserID.String(), codersdk.CreateWorkspaceRequest{
 			TemplateID: template.ID,
 			Name:       "example",
 		})
 		require.NoError(t, err)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		err = client.DeleteUser(ctx, secondUser.ID)
 		require.NoError(t, err)
@@ -218,9 +234,9 @@ func TestWorkspaceBuilds(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -243,15 +259,15 @@ func TestWorkspaceBuilds(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		var expectedBuilds []codersdk.WorkspaceBuild
 		extraBuilds := 4
 		for i := 0; i < extraBuilds; i++ {
 			b := coderdtest.CreateWorkspaceBuild(t, client, workspace, database.WorkspaceTransitionStart)
 			expectedBuilds = append(expectedBuilds, b)
-			coderdtest.AwaitWorkspaceBuildJob(t, client, b.ID)
+			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, b.ID)
 		}
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -291,10 +307,10 @@ func TestWorkspaceBuildsProvisionerState(t *testing.T) {
 
 		version := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, first.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		workspace := coderdtest.CreateWorkspace(t, client, first.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		build, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
 			TemplateVersionID: workspace.LatestBuild.TemplateVersionID,
@@ -303,14 +319,14 @@ func TestWorkspaceBuildsProvisionerState(t *testing.T) {
 		})
 		require.Nil(t, err)
 
-		coderdtest.AwaitWorkspaceBuildJob(t, client, build.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
 
 		// A regular user on the very same template must not be able to modify the
 		// state.
 		regularUser, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)
 
 		workspace = coderdtest.CreateWorkspace(t, regularUser, first.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, regularUser, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, regularUser, workspace.LatestBuild.ID)
 
 		_, err = regularUser.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
 			TemplateVersionID: workspace.LatestBuild.TemplateVersionID,
@@ -336,10 +352,10 @@ func TestWorkspaceBuildsProvisionerState(t *testing.T) {
 
 		version := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, first.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		workspace := coderdtest.CreateWorkspace(t, client, first.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		// Providing both state and orphan fails.
 		_, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
@@ -359,7 +375,7 @@ func TestWorkspaceBuildsProvisionerState(t *testing.T) {
 			Orphan:            true,
 		})
 		require.NoError(t, err)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, build.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
 
 		_, err = client.Workspace(ctx, workspace.ID)
 		require.Error(t, err)
@@ -376,14 +392,14 @@ func TestPatchCancelWorkspaceBuild(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Log{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Log{
 					Log: &proto.Log{},
 				},
 			}},
-			ProvisionPlan: echo.ProvisionComplete,
+			ProvisionPlan: echo.PlanComplete,
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 		var build codersdk.WorkspaceBuild
@@ -401,28 +417,32 @@ func TestPatchCancelWorkspaceBuild(t *testing.T) {
 		require.Eventually(t, func() bool {
 			var err error
 			build, err = client.WorkspaceBuild(ctx, build.ID)
+			// job gets marked Failed when there is an Error; in practice we never get to Status = Canceled
+			// because provisioners report an Error when canceled. We check the Error string to ensure we don't mask
+			// other errors in this test.
 			return assert.NoError(t, err) &&
-				// The job will never actually cancel successfully because it will never send a
-				// provision complete response.
-				assert.Empty(t, build.Job.Error) &&
-				build.Job.Status == codersdk.ProvisionerJobCanceling
+				build.Job.Error == "canceled" &&
+				build.Job.Status == codersdk.ProvisionerJobFailed
 		}, testutil.WaitShort, testutil.IntervalFast)
 	})
 	t.Run("User is not allowed to cancel", func(t *testing.T) {
 		t.Parallel()
 
-		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		// need to include our own logger because the provisioner (rightly) drops error logs when we shut down the
+		// test with a build in progress.
+		logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true, Logger: &logger})
 		owner := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Log{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Log{
 					Log: &proto.Log{},
 				},
 			}},
-			ProvisionPlan: echo.ProvisionComplete,
+			ProvisionPlan: echo.PlanComplete,
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
 
 		userClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
@@ -452,9 +472,9 @@ func TestWorkspaceBuildResources(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "some",
 							Type: "example",
@@ -470,10 +490,10 @@ func TestWorkspaceBuildResources(t *testing.T) {
 				},
 			}},
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -494,16 +514,16 @@ func TestWorkspaceBuildLogs(t *testing.T) {
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse: echo.ParseComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Log{
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Log{
 				Log: &proto.Log{
 					Level:  proto.LogLevel_INFO,
 					Output: "example",
 				},
 			},
 		}, {
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "some",
 						Type: "example",
@@ -519,7 +539,7 @@ func TestWorkspaceBuildLogs(t *testing.T) {
 			},
 		}},
 	})
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 
@@ -548,19 +568,19 @@ func TestWorkspaceBuildState(t *testing.T) {
 	wantState := []byte("some kinda state")
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:         echo.ParseComplete,
-		ProvisionPlan: echo.ProvisionComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionPlan: echo.PlanComplete,
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					State: wantState,
 				},
 			},
 		}},
 	})
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
@@ -582,7 +602,7 @@ func TestWorkspaceBuildStatus(t *testing.T) {
 	numLogs++ // add an audit log for template version creation
 	numLogs++ // add an audit log for template version update
 
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	closeDaemon.Close()
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	numLogs++ // add an audit log for template creation
@@ -595,7 +615,7 @@ func TestWorkspaceBuildStatus(t *testing.T) {
 
 	closeDaemon = coderdtest.NewProvisionerDaemon(t, api)
 	// after successful build is "running"
-	_ = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
@@ -608,7 +628,7 @@ func TestWorkspaceBuildStatus(t *testing.T) {
 
 	// after successful stop is "stopped"
 	build := coderdtest.CreateWorkspaceBuild(t, client, workspace, database.WorkspaceTransitionStop)
-	_ = coderdtest.AwaitWorkspaceBuildJob(t, client, build.ID)
+	_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
 	workspace, err = client.Workspace(ctx, workspace.ID)
 	require.NoError(t, err)
 	require.EqualValues(t, codersdk.WorkspaceStatusStopped, workspace.LatestBuild.Status)
@@ -631,7 +651,7 @@ func TestWorkspaceBuildStatus(t *testing.T) {
 	_ = coderdtest.NewProvisionerDaemon(t, api)
 	// after successful delete is "deleted"
 	build = coderdtest.CreateWorkspaceBuild(t, client, workspace, database.WorkspaceTransitionDelete)
-	_ = coderdtest.AwaitWorkspaceBuildJob(t, client, build.ID)
+	_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
 	workspace, err = client.DeletedWorkspace(ctx, workspace.ID)
 	require.NoError(t, err)
 	require.EqualValues(t, codersdk.WorkspaceStatusDeleted, workspace.LatestBuild.Status)
@@ -654,11 +674,11 @@ func TestWorkspaceBuildDebugMode(t *testing.T) {
 		// Template author: create a template
 		version := coderdtest.CreateTemplateVersion(t, adminClient, owner.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, adminClient, owner.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, adminClient, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, adminClient, version.ID)
 
 		// Template author: create a workspace
 		workspace := coderdtest.CreateWorkspace(t, adminClient, owner.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, adminClient, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, adminClient, workspace.LatestBuild.ID)
 
 		// Template author: try to start a workspace build in debug mode
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -691,11 +711,11 @@ func TestWorkspaceBuildDebugMode(t *testing.T) {
 		// Template owner: create a template
 		version := coderdtest.CreateTemplateVersion(t, templateAuthorClient, templateAuthor.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, templateAuthorClient, templateAuthor.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, templateAuthorClient, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, templateAuthorClient, version.ID)
 
 		// Regular user: create a workspace
 		workspace := coderdtest.CreateWorkspace(t, regularUserClient, templateAuthor.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, regularUserClient, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, regularUserClient, workspace.LatestBuild.ID)
 
 		// Regular user: try to start a workspace build in debug mode
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -722,17 +742,17 @@ func TestWorkspaceBuildDebugMode(t *testing.T) {
 		deploymentValues.EnableTerraformDebugMode = true
 
 		adminClient := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true, DeploymentValues: deploymentValues})
-		admin := coderdtest.CreateFirstUser(t, adminClient)
-		templateAuthorClient, _ := coderdtest.CreateAnotherUser(t, adminClient, admin.OrganizationID, rbac.RoleTemplateAdmin())
+		owner := coderdtest.CreateFirstUser(t, adminClient)
+		templateAuthorClient, _ := coderdtest.CreateAnotherUser(t, adminClient, owner.OrganizationID, rbac.RoleTemplateAdmin())
 
 		// Template author: create a template
-		version := coderdtest.CreateTemplateVersion(t, templateAuthorClient, admin.OrganizationID, nil)
-		template := coderdtest.CreateTemplate(t, templateAuthorClient, admin.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, templateAuthorClient, version.ID)
+		version := coderdtest.CreateTemplateVersion(t, templateAuthorClient, owner.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, templateAuthorClient, owner.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, templateAuthorClient, version.ID)
 
 		// Template author: create a workspace
-		workspace := coderdtest.CreateWorkspace(t, templateAuthorClient, admin.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, templateAuthorClient, workspace.LatestBuild.ID)
+		workspace := coderdtest.CreateWorkspace(t, templateAuthorClient, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, templateAuthorClient, workspace.LatestBuild.ID)
 
 		// Template author: try to start a workspace build in debug mode
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -759,46 +779,46 @@ func TestWorkspaceBuildDebugMode(t *testing.T) {
 		deploymentValues.EnableTerraformDebugMode = true
 
 		adminClient := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true, DeploymentValues: deploymentValues})
-		admin := coderdtest.CreateFirstUser(t, adminClient)
+		owner := coderdtest.CreateFirstUser(t, adminClient)
 
 		// Interact as template admin
 		echoResponses := &echo.Responses{
 			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Log{
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Log{
 					Log: &proto.Log{
 						Level:  proto.LogLevel_DEBUG,
 						Output: "want-it",
 					},
 				},
 			}, {
-				Type: &proto.Provision_Response_Log{
+				Type: &proto.Response_Log{
 					Log: &proto.Log{
 						Level:  proto.LogLevel_TRACE,
 						Output: "dont-want-it",
 					},
 				},
 			}, {
-				Type: &proto.Provision_Response_Log{
+				Type: &proto.Response_Log{
 					Log: &proto.Log{
 						Level:  proto.LogLevel_DEBUG,
 						Output: "done",
 					},
 				},
 			}, {
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{},
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{},
 				},
 			}},
 		}
-		version := coderdtest.CreateTemplateVersion(t, adminClient, admin.OrganizationID, echoResponses)
-		template := coderdtest.CreateTemplate(t, adminClient, admin.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, adminClient, version.ID)
+		version := coderdtest.CreateTemplateVersion(t, adminClient, owner.OrganizationID, echoResponses)
+		template := coderdtest.CreateTemplate(t, adminClient, owner.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, adminClient, version.ID)
 
 		// Create workspace
-		workspace := coderdtest.CreateWorkspace(t, adminClient, admin.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, adminClient, workspace.LatestBuild.ID)
+		workspace := coderdtest.CreateWorkspace(t, adminClient, owner.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, adminClient, workspace.LatestBuild.ID)
 
 		// Create workspace build
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -812,7 +832,7 @@ func TestWorkspaceBuildDebugMode(t *testing.T) {
 		})
 		require.Nil(t, err)
 
-		build = coderdtest.AwaitWorkspaceBuildJob(t, adminClient, build.ID)
+		build = coderdtest.AwaitWorkspaceBuildJobCompleted(t, adminClient, build.ID)
 
 		// Watch for incoming logs
 		logs, closer, err := adminClient.WorkspaceBuildLogsAfter(ctx, build.ID, 0)
@@ -831,7 +851,10 @@ func TestWorkspaceBuildDebugMode(t *testing.T) {
 				if !ok {
 					break processingLogs
 				}
-
+				t.Logf("got log: %s -- %s | %s | %s", log.Level, log.Stage, log.Source, log.Output)
+				if log.Source != "provisioner" {
+					continue
+				}
 				logsProcessed++
 
 				require.NotEqual(t, "dont-want-it", log.Output, "unexpected log message", "%s log message shouldn't be logged: %s")
@@ -841,7 +864,188 @@ func TestWorkspaceBuildDebugMode(t *testing.T) {
 				}
 			}
 		}
+		require.Equal(t, 2, logsProcessed)
+	})
+}
+
+func TestPostWorkspaceBuild(t *testing.T) {
+	t.Parallel()
+	t.Run("NoTemplateVersion", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		user := coderdtest.CreateFirstUser(t, client)
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		_, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+			TemplateVersionID: uuid.New(),
+			Transition:        codersdk.WorkspaceTransitionStart,
+		})
+		require.Error(t, err)
+		var apiErr *codersdk.Error
+		require.ErrorAs(t, err, &apiErr)
+		require.Equal(t, http.StatusBadRequest, apiErr.StatusCode())
+	})
+
+	t.Run("TemplateVersionFailedImport", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		user := coderdtest.CreateFirstUser(t, client)
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			ProvisionApply: []*proto.Response{{}},
+		})
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		_, err := client.CreateWorkspace(ctx, user.OrganizationID, codersdk.Me, codersdk.CreateWorkspaceRequest{
+			TemplateID: template.ID,
+			Name:       "workspace",
+		})
+		var apiErr *codersdk.Error
+		require.ErrorAs(t, err, &apiErr)
+		require.Equal(t, http.StatusBadRequest, apiErr.StatusCode())
+	})
+
+	t.Run("AlreadyActive", func(t *testing.T) {
+		t.Parallel()
+		client, closer := coderdtest.NewWithProvisionerCloser(t, nil)
+		defer closer.Close()
+
+		user := coderdtest.CreateFirstUser(t, client)
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		closer.Close()
+		// Close here so workspace build doesn't process!
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		_, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Transition:        codersdk.WorkspaceTransitionStart,
+		})
+		require.Error(t, err)
+		var apiErr *codersdk.Error
+		require.ErrorAs(t, err, &apiErr)
+		require.Equal(t, http.StatusConflict, apiErr.StatusCode())
+	})
+
+	t.Run("Audit", func(t *testing.T) {
+		t.Parallel()
+
+		otel.SetTextMapPropagator(
+			propagation.NewCompositeTextMapPropagator(
+				propagation.TraceContext{},
+				propagation.Baggage{},
+			),
+		)
+		auditor := audit.NewMock()
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true, Auditor: auditor})
+		user := coderdtest.CreateFirstUser(t, client)
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		auditor.ResetLogs()
+		build, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Transition:        codersdk.WorkspaceTransitionStart,
+		})
+		require.NoError(t, err)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
 
-		require.Len(t, echoResponses.ProvisionApply, logsProcessed)
+		require.Len(t, auditor.AuditLogs(), 1)
+		require.Equal(t, auditor.AuditLogs()[0].Ip.IPNet.IP.String(), "127.0.0.1")
+	})
+
+	t.Run("IncrementBuildNumber", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		user := coderdtest.CreateFirstUser(t, client)
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		build, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Transition:        codersdk.WorkspaceTransitionStart,
+		})
+		require.NoError(t, err)
+		require.Equal(t, workspace.LatestBuild.BuildNumber+1, build.BuildNumber)
+	})
+
+	t.Run("WithState", func(t *testing.T) {
+		t.Parallel()
+		client, closeDaemon := coderdtest.NewWithProvisionerCloser(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+		})
+		user := coderdtest.CreateFirstUser(t, client)
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+		wantState := []byte("something")
+		_ = closeDaemon.Close()
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		build, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Transition:        codersdk.WorkspaceTransitionStart,
+			ProvisionerState:  wantState,
+		})
+		require.NoError(t, err)
+		gotState, err := client.WorkspaceBuildState(ctx, build.ID)
+		require.NoError(t, err)
+		require.Equal(t, wantState, gotState)
+	})
+
+	t.Run("Delete", func(t *testing.T) {
+		t.Parallel()
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		user := coderdtest.CreateFirstUser(t, client)
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		build, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+			Transition: codersdk.WorkspaceTransitionDelete,
+		})
+		require.NoError(t, err)
+		require.Equal(t, workspace.LatestBuild.BuildNumber+1, build.BuildNumber)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
+
+		res, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{
+			Owner: user.UserID.String(),
+		})
+		require.NoError(t, err)
+		require.Len(t, res.Workspaces, 0)
 	})
 }
diff --git a/coderd/workspaceproxies.go b/coderd/workspaceproxies.go
index f861233507cf6..fca096819575f 100644
--- a/coderd/workspaceproxies.go
+++ b/coderd/workspaceproxies.go
@@ -8,10 +8,10 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // PrimaryRegion exposes the user facing values of a workspace proxy to
diff --git a/coderd/workspaceproxies_test.go b/coderd/workspaceproxies_test.go
index d11ab8fbdd975..60718f8a22277 100644
--- a/coderd/workspaceproxies_test.go
+++ b/coderd/workspaceproxies_test.go
@@ -6,10 +6,10 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestRegions(t *testing.T) {
diff --git a/coderd/workspaceresourceauth.go b/coderd/workspaceresourceauth.go
index b43434c1d6c0f..3642822b18d77 100644
--- a/coderd/workspaceresourceauth.go
+++ b/coderd/workspaceresourceauth.go
@@ -5,14 +5,14 @@ import (
 	"fmt"
 	"net/http"
 
-	"github.com/coder/coder/coderd/awsidentity"
-	"github.com/coder/coder/coderd/azureidentity"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/provisionerdserver"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
+	"github.com/coder/coder/v2/coderd/awsidentity"
+	"github.com/coder/coder/v2/coderd/azureidentity"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/provisionerdserver"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
 
 	"github.com/mitchellh/mapstructure"
 )
diff --git a/coderd/workspaceresourceauth_test.go b/coderd/workspaceresourceauth_test.go
index d6c088de58507..99a8d558f54f2 100644
--- a/coderd/workspaceresourceauth_test.go
+++ b/coderd/workspaceresourceauth_test.go
@@ -7,12 +7,12 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestPostWorkspaceAuthAzureInstanceIdentity(t *testing.T) {
@@ -26,9 +26,9 @@ func TestPostWorkspaceAuthAzureInstanceIdentity(t *testing.T) {
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse: echo.ParseComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "somename",
 						Type: "someinstance",
@@ -43,9 +43,9 @@ func TestPostWorkspaceAuthAzureInstanceIdentity(t *testing.T) {
 		}},
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
@@ -71,9 +71,9 @@ func TestPostWorkspaceAuthAWSInstanceIdentity(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "somename",
 							Type: "someinstance",
@@ -88,9 +88,9 @@ func TestPostWorkspaceAuthAWSInstanceIdentity(t *testing.T) {
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -157,9 +157,9 @@ func TestPostWorkspaceAuthGoogleInstanceIdentity(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "somename",
 							Type: "someinstance",
@@ -174,9 +174,9 @@ func TestPostWorkspaceAuthGoogleInstanceIdentity(t *testing.T) {
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
diff --git a/coderd/workspaces.go b/coderd/workspaces.go
index 0aa1cb0675155..bea87fb2f427a 100644
--- a/coderd/workspaces.go
+++ b/coderd/workspaces.go
@@ -15,19 +15,21 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/searchquery"
-	"github.com/coder/coder/coderd/telemetry"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/coderd/wsbuilder"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/provisionerjobs"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
+	"github.com/coder/coder/v2/coderd/searchquery"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/coderd/wsbuilder"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
 )
 
 var (
@@ -86,11 +88,23 @@ func (api *API) workspace(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if len(data.templates) == 0 {
+		httpapi.Forbidden(rw)
+		return
+	}
+	ownerName, ok := usernameWithID(workspace.OwnerID, data.users)
+	if !ok {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error fetching workspace resources.",
+			Detail:  "unable to find workspace owner's username",
+		})
+		return
+	}
 	httpapi.Write(ctx, rw, http.StatusOK, convertWorkspace(
 		workspace,
 		data.builds[0],
 		data.templates[0],
-		findUser(workspace.OwnerID, data.users),
+		ownerName,
 	))
 }
 
@@ -117,7 +131,7 @@ func (api *API) workspaces(rw http.ResponseWriter, r *http.Request) {
 	}
 
 	queryStr := r.URL.Query().Get("q")
-	filter, postFilter, errs := searchquery.Workspaces(queryStr, page, api.AgentInactiveDisconnectTimeout)
+	filter, errs := searchquery.Workspaces(queryStr, page, api.AgentInactiveDisconnectTimeout)
 	if len(errs) > 0 {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 			Message:     "Invalid workspace search query.",
@@ -177,26 +191,8 @@ func (api *API) workspaces(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	var filteredWorkspaces []codersdk.Workspace
-	// apply post filters, if they exist
-	if postFilter.DeletingBy == nil {
-		filteredWorkspaces = append(filteredWorkspaces, wss...)
-	} else {
-		for _, v := range wss {
-			if v.DeletingAt == nil {
-				continue
-			}
-			// get the beginning of the day on which deletion is scheduled
-			truncatedDeletionAt := time.Date(v.DeletingAt.Year(), v.DeletingAt.Month(), v.DeletingAt.Day(), 0, 0, 0, 0, v.DeletingAt.Location())
-			if truncatedDeletionAt.After(*postFilter.DeletingBy) {
-				continue
-			}
-			filteredWorkspaces = append(filteredWorkspaces, v)
-		}
-	}
-
 	httpapi.Write(ctx, rw, http.StatusOK, codersdk.WorkspacesResponse{
-		Workspaces: filteredWorkspaces,
+		Workspaces: wss,
 		Count:      int(workspaceRows[0].Count),
 	})
 }
@@ -267,12 +263,19 @@ func (api *API) workspaceByOwnerAndName(rw http.ResponseWriter, r *http.Request)
 		httpapi.ResourceNotFound(rw)
 		return
 	}
-
+	ownerName, ok := usernameWithID(workspace.OwnerID, data.users)
+	if !ok {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error fetching workspace resources.",
+			Detail:  "unable to find workspace owner's username",
+		})
+		return
+	}
 	httpapi.Write(ctx, rw, http.StatusOK, convertWorkspace(
 		workspace,
 		data.builds[0],
 		data.templates[0],
-		findUser(workspace.OwnerID, data.users),
+		ownerName,
 	))
 }
 
@@ -295,9 +298,9 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 		organization          = httpmw.OrganizationParam(r)
 		apiKey                = httpmw.APIKey(r)
 		auditor               = api.Auditor.Load()
-		user                  = httpmw.UserParam(r)
+		member                = httpmw.OrganizationMemberParam(r)
 		workspaceResourceInfo = audit.AdditionalFields{
-			WorkspaceOwner: user.Username,
+			WorkspaceOwner: member.Username,
 		}
 	)
 
@@ -318,7 +321,7 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 
 	// Do this upfront to save work.
 	if !api.Authorize(r, rbac.ActionCreate,
-		rbac.ResourceWorkspace.InOrg(organization.ID).WithOwner(user.ID.String())) {
+		rbac.ResourceWorkspace.InOrg(organization.ID).WithOwner(member.UserID.String())) {
 		httpapi.ResourceNotFound(rw)
 		return
 	}
@@ -328,10 +331,47 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 		return
 	}
 
-	template, err := api.Database.GetTemplateByID(ctx, createWorkspace.TemplateID)
+	// If we were given a `TemplateVersionID`, we need to determine the `TemplateID` from it.
+	templateID := createWorkspace.TemplateID
+	if templateID == uuid.Nil {
+		templateVersion, err := api.Database.GetTemplateVersionByID(ctx, createWorkspace.TemplateVersionID)
+		if errors.Is(err, sql.ErrNoRows) {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: fmt.Sprintf("Template version %q doesn't exist.", templateID.String()),
+				Validations: []codersdk.ValidationError{{
+					Field:  "template_version_id",
+					Detail: "template not found",
+				}},
+			})
+			return
+		}
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error fetching template version.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+		if templateVersion.Archived {
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Archived template versions cannot be used to make a workspace.",
+				Validations: []codersdk.ValidationError{
+					{
+						Field:  "template_version_id",
+						Detail: "template version archived",
+					},
+				},
+			})
+			return
+		}
+
+		templateID = templateVersion.TemplateID.UUID
+	}
+
+	template, err := api.Database.GetTemplateByID(ctx, templateID)
 	if errors.Is(err, sql.ErrNoRows) {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: fmt.Sprintf("Template %q doesn't exist.", createWorkspace.TemplateID.String()),
+			Message: fmt.Sprintf("Template %q doesn't exist.", templateID.String()),
 			Validations: []codersdk.ValidationError{{
 				Field:  "template_id",
 				Detail: "template not found",
@@ -354,7 +394,7 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 	}
 
 	if organization.ID != template.OrganizationID {
-		httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
+		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
 			Message: fmt.Sprintf("Template is not in organization %q.", organization.Name),
 		})
 		return
@@ -379,8 +419,8 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 	}
 
 	maxTTL := templateSchedule.MaxTTL
-	if templateSchedule.UseRestartRequirement {
-		// If we're using restart requirements, there isn't a max TTL.
+	if templateSchedule.UseAutostopRequirement {
+		// If we're using autostop requirements, there isn't a max TTL.
 		maxTTL = 0
 	}
 
@@ -393,11 +433,24 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 		return
 	}
 
+	// back-compatibility: default to "never" if not included.
+	dbAU := database.AutomaticUpdatesNever
+	if createWorkspace.AutomaticUpdates != "" {
+		dbAU, err = validWorkspaceAutomaticUpdates(createWorkspace.AutomaticUpdates)
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message:     "Invalid Workspace Automatic Updates setting.",
+				Validations: []codersdk.ValidationError{{Field: "automatic_updates", Detail: err.Error()}},
+			})
+			return
+		}
+	}
+
 	// TODO: This should be a system call as the actor might not be able to
 	// read other workspaces. Ideally we check the error on create and look for
 	// a postgres conflict error.
 	workspace, err := api.Database.GetWorkspaceByOwnerIDAndName(ctx, database.GetWorkspaceByOwnerIDAndNameParams{
-		OwnerID: user.ID,
+		OwnerID: member.UserID,
 		Name:    createWorkspace.Name,
 	})
 	if err == nil {
@@ -424,13 +477,13 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 		workspaceBuild *database.WorkspaceBuild
 	)
 	err = api.Database.InTx(func(db database.Store) error {
-		now := database.Now()
+		now := dbtime.Now()
 		// Workspaces are created without any versions.
 		workspace, err = db.InsertWorkspace(ctx, database.InsertWorkspaceParams{
 			ID:                uuid.New(),
 			CreatedAt:         now,
 			UpdatedAt:         now,
-			OwnerID:           user.ID,
+			OwnerID:           member.UserID,
 			OrganizationID:    template.OrganizationID,
 			TemplateID:        template.ID,
 			Name:              createWorkspace.Name,
@@ -438,7 +491,8 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 			Ttl:               dbTTL,
 			// The workspaces page will sort by last used at, and it's useful to
 			// have the newly created workspace at the top of the list!
-			LastUsedAt: database.Now(),
+			LastUsedAt:       dbtime.Now(),
+			AutomaticUpdates: dbAU,
 		})
 		if err != nil {
 			return xerrors.Errorf("insert workspace: %w", err)
@@ -449,10 +503,18 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 			Initiator(apiKey.UserID).
 			ActiveVersion().
 			RichParameterValues(createWorkspace.RichParameterValues)
+		if createWorkspace.TemplateVersionID != uuid.Nil {
+			builder = builder.VersionID(createWorkspace.TemplateVersionID)
+		}
+
 		workspaceBuild, provisionerJob, err = builder.Build(
-			ctx, db, func(action rbac.Action, object rbac.Objecter) bool {
+			ctx,
+			db,
+			func(action rbac.Action, object rbac.Objecter) bool {
 				return api.Authorize(r, action, object)
-			})
+			},
+			audit.WorkspaceBuildBaggageFromRequest(r),
+		)
 		return err
 	}, nil)
 	var bldErr wsbuilder.BuildError
@@ -470,23 +532,18 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 		})
 		return
 	}
-	aReq.New = workspace
-
-	initiator, err := api.Database.GetUserByID(ctx, workspaceBuild.InitiatorID)
+	err = provisionerjobs.PostJob(api.Pubsub, *provisionerJob)
 	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching user.",
-			Detail:  err.Error(),
-		})
-		return
+		// Client probably doesn't care about this error, so just log it.
+		api.Logger.Error(ctx, "failed to post provisioner job to pubsub", slog.Error(err))
 	}
+	aReq.New = workspace
 
 	api.Telemetry.Report(&telemetry.Snapshot{
 		Workspaces:      []telemetry.Workspace{telemetry.ConvertWorkspace(workspace)},
 		WorkspaceBuilds: []telemetry.WorkspaceBuild{telemetry.ConvertWorkspaceBuild(*workspaceBuild)},
 	})
 
-	users := []database.User{user, initiator}
 	apiBuild, err := api.convertWorkspaceBuild(
 		*workspaceBuild,
 		workspace,
@@ -494,11 +551,13 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 			ProvisionerJob: *provisionerJob,
 			QueuePosition:  0,
 		},
-		users,
+		member.Username,
 		[]database.WorkspaceResource{},
 		[]database.WorkspaceResourceMetadatum{},
 		[]database.WorkspaceAgent{},
 		[]database.WorkspaceApp{},
+		[]database.WorkspaceAgentScript{},
+		[]database.WorkspaceAgentLogSource{},
 		database.TemplateVersion{},
 	)
 	if err != nil {
@@ -513,7 +572,7 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 		workspace,
 		apiBuild,
 		template,
-		findUser(user.ID, users),
+		member.Username,
 	))
 }
 
@@ -716,8 +775,8 @@ func (api *API) putWorkspaceTTL(rw http.ResponseWriter, r *http.Request) {
 		}
 
 		maxTTL := templateSchedule.MaxTTL
-		if templateSchedule.UseRestartRequirement {
-			// If we're using restart requirements, there isn't a max TTL.
+		if templateSchedule.UseAutostopRequirement {
+			// If we're using autostop requirements, there isn't a max TTL.
 			maxTTL = 0
 		}
 
@@ -760,46 +819,55 @@ func (api *API) putWorkspaceTTL(rw http.ResponseWriter, r *http.Request) {
 	rw.WriteHeader(http.StatusNoContent)
 }
 
-// @Summary Update workspace lock by id.
-// @ID update-workspace-lock-by-id
+// @Summary Update workspace dormancy status by id.
+// @ID update-workspace-dormancy-status-by-id
 // @Security CoderSessionToken
 // @Accept json
 // @Produce json
 // @Tags Workspaces
 // @Param workspace path string true "Workspace ID" format(uuid)
-// @Param request body codersdk.UpdateWorkspaceLock true "Lock or unlock a workspace"
-// @Success 200 {object} codersdk.Response
-// @Router /workspaces/{workspace}/lock [put]
-func (api *API) putWorkspaceLock(rw http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	workspace := httpmw.WorkspaceParam(r)
+// @Param request body codersdk.UpdateWorkspaceDormancy true "Make a workspace dormant or active"
+// @Success 200 {object} codersdk.Workspace
+// @Router /workspaces/{workspace}/dormant [put]
+func (api *API) putWorkspaceDormant(rw http.ResponseWriter, r *http.Request) {
+	var (
+		ctx               = r.Context()
+		workspace         = httpmw.WorkspaceParam(r)
+		oldWorkspace      = workspace
+		auditor           = api.Auditor.Load()
+		aReq, commitAudit = audit.InitRequest[database.Workspace](rw, &audit.RequestParams{
+			Audit:   *auditor,
+			Log:     api.Logger,
+			Request: r,
+			Action:  database.AuditActionWrite,
+		})
+	)
+	aReq.Old = oldWorkspace
+	defer commitAudit()
 
-	var req codersdk.UpdateWorkspaceLock
+	var req codersdk.UpdateWorkspaceDormancy
 	if !httpapi.Read(ctx, rw, r, &req) {
 		return
 	}
 
-	code := http.StatusOK
-	resp := codersdk.Response{}
-
 	// If the workspace is already in the desired state do nothing!
-	if workspace.LockedAt.Valid == req.Lock {
+	if workspace.DormantAt.Valid == req.Dormant {
 		httpapi.Write(ctx, rw, http.StatusNotModified, codersdk.Response{
 			Message: "Nothing to do!",
 		})
 		return
 	}
 
-	lockedAt := sql.NullTime{
-		Valid: req.Lock,
+	dormantAt := sql.NullTime{
+		Valid: req.Dormant,
 	}
-	if req.Lock {
-		lockedAt.Time = database.Now()
+	if req.Dormant {
+		dormantAt.Time = dbtime.Now()
 	}
 
-	err := api.Database.UpdateWorkspaceLockedDeletingAt(ctx, database.UpdateWorkspaceLockedDeletingAtParams{
-		ID:       workspace.ID,
-		LockedAt: lockedAt,
+	workspace, err := api.Database.UpdateWorkspaceDormantDeletingAt(ctx, database.UpdateWorkspaceDormantDeletingAtParams{
+		ID:        workspace.ID,
+		DormantAt: dormantAt,
 	})
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
@@ -809,10 +877,35 @@ func (api *API) putWorkspaceLock(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// TODO should we kick off a build to stop the workspace if it's started
-	// from this endpoint? I'm leaning no to keep things simple and kick
-	// the responsibility back to the client.
-	httpapi.Write(ctx, rw, code, resp)
+	data, err := api.workspaceData(ctx, []database.Workspace{workspace})
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error fetching workspace resources.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+	ownerName, ok := usernameWithID(workspace.OwnerID, data.users)
+	if !ok {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error fetching workspace resources.",
+			Detail:  "unable to find workspace owner's username",
+		})
+		return
+	}
+
+	if len(data.templates) == 0 {
+		httpapi.Forbidden(rw)
+		return
+	}
+
+	aReq.New = workspace
+	httpapi.Write(ctx, rw, http.StatusOK, convertWorkspace(
+		workspace,
+		data.builds[0],
+		data.templates[0],
+		ownerName,
+	))
 }
 
 // @Summary Extend workspace deadline by ID
@@ -885,12 +978,11 @@ func (api *API) putExtendWorkspace(rw http.ResponseWriter, r *http.Request) {
 			return xerrors.New("Cannot extend workspace: deadline is beyond max deadline imposed by template")
 		}
 
-		if err := s.UpdateWorkspaceBuildByID(ctx, database.UpdateWorkspaceBuildByIDParams{
-			ID:               build.ID,
-			UpdatedAt:        build.UpdatedAt,
-			ProvisionerState: build.ProvisionerState,
-			Deadline:         newDeadline,
-			MaxDeadline:      build.MaxDeadline,
+		if err := s.UpdateWorkspaceBuildDeadlineByID(ctx, database.UpdateWorkspaceBuildDeadlineByIDParams{
+			ID:          build.ID,
+			UpdatedAt:   dbtime.Now(),
+			Deadline:    newDeadline,
+			MaxDeadline: build.MaxDeadline,
 		}); err != nil {
 			code = http.StatusInternalServerError
 			resp.Message = "Failed to extend workspace deadline."
@@ -907,6 +999,66 @@ func (api *API) putExtendWorkspace(rw http.ResponseWriter, r *http.Request) {
 	httpapi.Write(ctx, rw, code, resp)
 }
 
+// @Summary Update workspace automatic updates by ID
+// @ID update-workspace-automatic-updates-by-id
+// @Security CoderSessionToken
+// @Accept json
+// @Tags Workspaces
+// @Param workspace path string true "Workspace ID" format(uuid)
+// @Param request body codersdk.UpdateWorkspaceAutomaticUpdatesRequest true "Automatic updates request"
+// @Success 204
+// @Router /workspaces/{workspace}/autoupdates [put]
+func (api *API) putWorkspaceAutoupdates(rw http.ResponseWriter, r *http.Request) {
+	var (
+		ctx               = r.Context()
+		workspace         = httpmw.WorkspaceParam(r)
+		auditor           = api.Auditor.Load()
+		aReq, commitAudit = audit.InitRequest[database.Workspace](rw, &audit.RequestParams{
+			Audit:   *auditor,
+			Log:     api.Logger,
+			Request: r,
+			Action:  database.AuditActionWrite,
+		})
+	)
+	defer commitAudit()
+	aReq.Old = workspace
+
+	var req codersdk.UpdateWorkspaceAutomaticUpdatesRequest
+	if !httpapi.Read(ctx, rw, r, &req) {
+		return
+	}
+
+	if !database.AutomaticUpdates(req.AutomaticUpdates).Valid() {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message:     "Invalid request",
+			Validations: []codersdk.ValidationError{{Field: "automatic_updates", Detail: "must be always or never"}},
+		})
+		return
+	}
+
+	err := api.Database.UpdateWorkspaceAutomaticUpdates(ctx, database.UpdateWorkspaceAutomaticUpdatesParams{
+		ID:               workspace.ID,
+		AutomaticUpdates: database.AutomaticUpdates(req.AutomaticUpdates),
+	})
+	if httpapi.Is404Error(err) {
+		httpapi.ResourceNotFound(rw)
+		return
+	}
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error updating workspace automatic updates setting",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	newWorkspace := workspace
+	newWorkspace.AutomaticUpdates = database.AutomaticUpdates(req.AutomaticUpdates)
+	aReq.New = newWorkspace
+
+	rw.WriteHeader(http.StatusNoContent)
+}
+
 // @Summary Watch workspace by ID
 // @ID watch-workspace-by-id
 // @Security CoderSessionToken
@@ -956,14 +1108,35 @@ func (api *API) watchWorkspace(rw http.ResponseWriter, r *http.Request) {
 			})
 			return
 		}
+		if len(data.templates) == 0 {
+			_ = sendEvent(ctx, codersdk.ServerSentEvent{
+				Type: codersdk.ServerSentEventTypeError,
+				Data: codersdk.Response{
+					Message: "Forbidden reading template of selected workspace.",
+					Detail:  err.Error(),
+				},
+			})
+			return
+		}
 
+		ownerName, ok := usernameWithID(workspace.OwnerID, data.users)
+		if !ok {
+			_ = sendEvent(ctx, codersdk.ServerSentEvent{
+				Type: codersdk.ServerSentEventTypeError,
+				Data: codersdk.Response{
+					Message: "Internal error fetching workspace resources.",
+					Detail:  "unable to find workspace owner's username",
+				},
+			})
+			return
+		}
 		_ = sendEvent(ctx, codersdk.ServerSentEvent{
 			Type: codersdk.ServerSentEventTypeData,
 			Data: convertWorkspace(
 				workspace,
 				data.builds[0],
 				data.templates[0],
-				findUser(workspace.OwnerID, data.users),
+				ownerName,
 			),
 		})
 	}
@@ -1000,6 +1173,9 @@ func (api *API) watchWorkspace(rw http.ResponseWriter, r *http.Request) {
 	_ = sendEvent(ctx, codersdk.ServerSentEvent{
 		Type: codersdk.ServerSentEventTypePing,
 	})
+	// Send updated workspace info after connection is established. This avoids
+	// missing updates if the client connects after an update.
+	sendUpdate(ctx, nil)
 
 	for {
 		select {
@@ -1017,6 +1193,10 @@ type workspaceData struct {
 	users     []database.User
 }
 
+// workspacesData only returns the data the caller can access. If the caller
+// does not have the correct perms to read a given template, the template will
+// not be returned.
+// So the caller must check the templates & users exist before using them.
 func (api *API) workspaceData(ctx context.Context, workspaces []database.Workspace) (workspaceData, error) {
 	workspaceIDs := make([]uuid.UUID, 0, len(workspaces))
 	templateIDs := make([]uuid.UUID, 0, len(workspaces))
@@ -1053,6 +1233,8 @@ func (api *API) workspaceData(ctx context.Context, workspaces []database.Workspa
 		data.metadata,
 		data.agents,
 		data.apps,
+		data.scripts,
+		data.logSources,
 		data.templateVersions,
 	)
 	if err != nil {
@@ -1082,24 +1264,29 @@ func convertWorkspaces(workspaces []database.Workspace, data workspaceData) ([]c
 
 	apiWorkspaces := make([]codersdk.Workspace, 0, len(workspaces))
 	for _, workspace := range workspaces {
+		// If any data is missing from the workspace, just skip returning
+		// this workspace. This is not ideal, but the user cannot read
+		// all the workspace's data, so do not show them.
+		// Ideally we could just return some sort of "unknown" for the missing
+		// fields?
 		build, exists := buildByWorkspaceID[workspace.ID]
 		if !exists {
-			return nil, xerrors.Errorf("build not found for workspace %q", workspace.Name)
+			continue
 		}
 		template, exists := templateByID[workspace.TemplateID]
 		if !exists {
-			return nil, xerrors.Errorf("template not found for workspace %q", workspace.Name)
+			continue
 		}
 		owner, exists := userByID[workspace.OwnerID]
 		if !exists {
-			return nil, xerrors.Errorf("owner not found for workspace: %q", workspace.Name)
+			continue
 		}
 
 		apiWorkspaces = append(apiWorkspaces, convertWorkspace(
 			workspace,
 			build,
 			template,
-			&owner,
+			owner.Username,
 		))
 	}
 	return apiWorkspaces, nil
@@ -1109,21 +1296,21 @@ func convertWorkspace(
 	workspace database.Workspace,
 	workspaceBuild codersdk.WorkspaceBuild,
 	template database.Template,
-	owner *database.User,
+	ownerName string,
 ) codersdk.Workspace {
 	var autostartSchedule *string
 	if workspace.AutostartSchedule.Valid {
 		autostartSchedule = &workspace.AutostartSchedule.String
 	}
 
-	var lockedAt *time.Time
-	if workspace.LockedAt.Valid {
-		lockedAt = &workspace.LockedAt.Time
+	var dormantAt *time.Time
+	if workspace.DormantAt.Valid {
+		dormantAt = &workspace.DormantAt.Time
 	}
 
-	var deletedAt *time.Time
+	var deletingAt *time.Time
 	if workspace.DeletingAt.Valid {
-		deletedAt = &workspace.DeletingAt.Time
+		deletingAt = &workspace.DeletingAt.Time
 	}
 
 	failingAgents := []uuid.UUID{}
@@ -1142,7 +1329,7 @@ func convertWorkspace(
 		CreatedAt:                            workspace.CreatedAt,
 		UpdatedAt:                            workspace.UpdatedAt,
 		OwnerID:                              workspace.OwnerID,
-		OwnerName:                            owner.Username,
+		OwnerName:                            ownerName,
 		OrganizationID:                       workspace.OrganizationID,
 		TemplateID:                           workspace.TemplateID,
 		LatestBuild:                          workspaceBuild,
@@ -1150,17 +1337,20 @@ func convertWorkspace(
 		TemplateIcon:                         template.Icon,
 		TemplateDisplayName:                  template.DisplayName,
 		TemplateAllowUserCancelWorkspaceJobs: template.AllowUserCancelWorkspaceJobs,
+		TemplateActiveVersionID:              template.ActiveVersionID,
+		TemplateRequireActiveVersion:         template.RequireActiveVersion,
 		Outdated:                             workspaceBuild.TemplateVersionID.String() != template.ActiveVersionID.String(),
 		Name:                                 workspace.Name,
 		AutostartSchedule:                    autostartSchedule,
 		TTLMillis:                            ttlMillis,
 		LastUsedAt:                           workspace.LastUsedAt,
-		DeletingAt:                           deletedAt,
-		LockedAt:                             lockedAt,
+		DeletingAt:                           deletingAt,
+		DormantAt:                            dormantAt,
 		Health: codersdk.WorkspaceHealth{
 			Healthy:       len(failingAgents) == 0,
 			FailingAgents: failingAgents,
 		},
+		AutomaticUpdates: codersdk.AutomaticUpdates(workspace.AutomaticUpdates),
 	}
 }
 
@@ -1216,6 +1406,17 @@ func validWorkspaceTTLMillis(millis *int64, templateDefault, templateMax time.Du
 	}, nil
 }
 
+func validWorkspaceAutomaticUpdates(updates codersdk.AutomaticUpdates) (database.AutomaticUpdates, error) {
+	if updates == "" {
+		return database.AutomaticUpdatesNever, nil
+	}
+	dbAU := database.AutomaticUpdates(updates)
+	if !dbAU.Valid() {
+		return "", xerrors.New("Automatic updates must be always or never")
+	}
+	return dbAU, nil
+}
+
 func validWorkspaceDeadline(startedAt, newDeadline time.Time) error {
 	soon := time.Now().Add(29 * time.Minute)
 	if newDeadline.Before(soon) {
@@ -1235,7 +1436,7 @@ func validWorkspaceSchedule(s *string) (sql.NullString, error) {
 		return sql.NullString{}, nil
 	}
 
-	_, err := schedule.Weekly(*s)
+	_, err := cron.Weekly(*s)
 	if err != nil {
 		return sql.NullString{}, err
 	}
diff --git a/coderd/workspaces_test.go b/coderd/workspaces_test.go
index db5db020488b7..a12c262cb14f5 100644
--- a/coderd/workspaces_test.go
+++ b/coderd/workspaces_test.go
@@ -9,7 +9,6 @@ import (
 	"net/http"
 	"os"
 	"strings"
-	"sync/atomic"
 	"testing"
 	"time"
 
@@ -19,23 +18,24 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/coderd/parameter"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/parameter"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestWorkspace(t *testing.T) {
@@ -47,7 +47,7 @@ func TestWorkspace(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		authz := coderdtest.AssertRBAC(t, api, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 
@@ -67,10 +67,10 @@ func TestWorkspace(t *testing.T) {
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -84,7 +84,7 @@ func TestWorkspace(t *testing.T) {
 			Transition: codersdk.WorkspaceTransitionDelete,
 		})
 		require.NoError(t, err, "delete the workspace")
-		coderdtest.AwaitWorkspaceBuildJob(t, client, build.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
 
 		// Getting with deleted=true should work.
 		workspaceNew, err := client.DeletedWorkspace(ctx, workspace.ID)
@@ -102,12 +102,12 @@ func TestWorkspace(t *testing.T) {
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		ws1 := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 		ws2 := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, ws1.LatestBuild.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, ws2.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws1.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws2.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
 		defer cancel()
@@ -116,6 +116,8 @@ func TestWorkspace(t *testing.T) {
 		if len(want) > 32 {
 			want = want[:32-5] + "-test"
 		}
+		// Sometimes truncated names result in `--test` which is not an allowed name.
+		want = strings.Replace(want, "--", "-", -1)
 		err := client.UpdateWorkspace(ctx, ws1.ID, codersdk.UpdateWorkspaceRequest{
 			Name: want,
 		})
@@ -136,7 +138,7 @@ func TestWorkspace(t *testing.T) {
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		const templateIcon = "/img/icon.svg"
 		const templateDisplayName = "This is template"
@@ -174,9 +176,9 @@ func TestWorkspace(t *testing.T) {
 			user := coderdtest.CreateFirstUser(t, client)
 			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 				Parse: echo.ParseComplete,
-				ProvisionApply: []*proto.Provision_Response{{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
+				ProvisionApply: []*proto.Response{{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
 							Resources: []*proto.Resource{{
 								Name: "some",
 								Type: "example",
@@ -189,10 +191,10 @@ func TestWorkspace(t *testing.T) {
 					},
 				}},
 			})
-			coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-			coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 			defer cancel()
@@ -214,9 +216,9 @@ func TestWorkspace(t *testing.T) {
 			user := coderdtest.CreateFirstUser(t, client)
 			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 				Parse: echo.ParseComplete,
-				ProvisionApply: []*proto.Provision_Response{{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
+				ProvisionApply: []*proto.Response{{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
 							Resources: []*proto.Resource{{
 								Name: "some",
 								Type: "example",
@@ -230,10 +232,10 @@ func TestWorkspace(t *testing.T) {
 					},
 				}},
 			})
-			coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-			coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 			defer cancel()
@@ -258,9 +260,9 @@ func TestWorkspace(t *testing.T) {
 			user := coderdtest.CreateFirstUser(t, client)
 			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 				Parse: echo.ParseComplete,
-				ProvisionApply: []*proto.Provision_Response{{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
+				ProvisionApply: []*proto.Response{{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
 							Resources: []*proto.Resource{{
 								Name: "some",
 								Type: "example",
@@ -279,10 +281,10 @@ func TestWorkspace(t *testing.T) {
 					},
 				}},
 			})
-			coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-			coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 			defer cancel()
@@ -306,6 +308,36 @@ func TestWorkspace(t *testing.T) {
 			assert.NotEmpty(t, agent2.Health.Reason)
 		})
 	})
+
+	t.Run("Archived", func(t *testing.T) {
+		t.Parallel()
+		ownerClient := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, ownerClient)
+
+		client, _ := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID, rbac.RoleTemplateAdmin())
+
+		active := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, active.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, active.ID)
+		// We need another version because the active template version cannot be
+		// archived.
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil, func(request *codersdk.CreateTemplateVersionRequest) {
+			request.TemplateID = template.ID
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+
+		err := client.SetArchiveTemplateVersion(ctx, version.ID, true)
+		require.NoError(t, err, "archive version")
+
+		_, err = client.CreateWorkspace(ctx, owner.OrganizationID, codersdk.Me, codersdk.CreateWorkspaceRequest{
+			TemplateVersionID: version.ID,
+			Name:              "testworkspace",
+		})
+		require.Error(t, err, "create workspace with archived version")
+		require.ErrorContains(t, err, "Archived template versions cannot")
+	})
 }
 
 func TestAdminViewAllWorkspaces(t *testing.T) {
@@ -313,10 +345,10 @@ func TestAdminViewAllWorkspaces(t *testing.T) {
 	client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
@@ -353,29 +385,29 @@ func TestWorkspacesSortOrder(t *testing.T) {
 	client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 	firstUser := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, firstUser.OrganizationID, nil)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	template := coderdtest.CreateTemplate(t, client, firstUser.OrganizationID, version.ID)
 
 	// c-workspace should be running
 	workspace1 := coderdtest.CreateWorkspace(t, client, firstUser.OrganizationID, template.ID, func(ctr *codersdk.CreateWorkspaceRequest) {
 		ctr.Name = "c-workspace"
 	})
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace1.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace1.LatestBuild.ID)
 
 	// b-workspace should be stopped
 	workspace2 := coderdtest.CreateWorkspace(t, client, firstUser.OrganizationID, template.ID, func(ctr *codersdk.CreateWorkspaceRequest) {
 		ctr.Name = "b-workspace"
 	})
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace2.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace2.LatestBuild.ID)
 
 	build2 := coderdtest.CreateWorkspaceBuild(t, client, workspace2, database.WorkspaceTransitionStop)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, build2.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build2.ID)
 
 	// a-workspace should be running
 	workspace3 := coderdtest.CreateWorkspace(t, client, firstUser.OrganizationID, template.ID, func(ctr *codersdk.CreateWorkspaceRequest) {
 		ctr.Name = "a-workspace"
 	})
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace3.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace3.LatestBuild.ID)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
@@ -425,7 +457,6 @@ func TestPostWorkspacesByOrganization(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)
 		first := coderdtest.CreateFirstUser(t, client)
-
 		other, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID, rbac.RoleMember(), rbac.RoleOwner())
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -445,7 +476,7 @@ func TestPostWorkspacesByOrganization(t *testing.T) {
 		require.Error(t, err)
 		var apiErr *codersdk.Error
 		require.ErrorAs(t, err, &apiErr)
-		require.Equal(t, http.StatusUnauthorized, apiErr.StatusCode())
+		require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
 	})
 
 	t.Run("AlreadyExists", func(t *testing.T) {
@@ -454,7 +485,7 @@ func TestPostWorkspacesByOrganization(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -470,23 +501,68 @@ func TestPostWorkspacesByOrganization(t *testing.T) {
 		require.Equal(t, http.StatusConflict, apiErr.StatusCode())
 	})
 
-	t.Run("Create", func(t *testing.T) {
+	t.Run("CreateWithAuditLogs", func(t *testing.T) {
 		t.Parallel()
 		auditor := audit.NewMock()
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true, Auditor: auditor})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+		verifyAuditWorkspaceCreated(t, auditor, workspace.Name)
+	})
 
-		require.Eventually(t, func() bool {
-			if len(auditor.AuditLogs()) < 6 {
-				return false
-			}
-			return auditor.AuditLogs()[4].Action == database.AuditActionCreate
-		}, testutil.WaitMedium, testutil.IntervalFast)
+	t.Run("CreateFromVersionWithAuditLogs", func(t *testing.T) {
+		t.Parallel()
+		auditor := audit.NewMock()
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true, Auditor: auditor})
+		user := coderdtest.CreateFirstUser(t, client)
+		versionDefault := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, versionDefault.ID)
+		versionTest := coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, nil, template.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, versionDefault.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, versionTest.ID)
+		defaultWorkspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, uuid.Nil,
+			func(c *codersdk.CreateWorkspaceRequest) { c.TemplateVersionID = versionDefault.ID },
+		)
+		testWorkspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, uuid.Nil,
+			func(c *codersdk.CreateWorkspaceRequest) { c.TemplateVersionID = versionTest.ID },
+		)
+		defaultWorkspaceBuild := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, defaultWorkspace.LatestBuild.ID)
+		testWorkspaceBuild := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, testWorkspace.LatestBuild.ID)
+
+		require.Equal(t, testWorkspaceBuild.TemplateVersionID, versionTest.ID)
+		require.Equal(t, defaultWorkspaceBuild.TemplateVersionID, versionDefault.ID)
+		verifyAuditWorkspaceCreated(t, auditor, defaultWorkspace.Name)
+	})
+
+	t.Run("InvalidCombinationOfTemplateAndTemplateVersion", func(t *testing.T) {
+		t.Parallel()
+		auditor := audit.NewMock()
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true, Auditor: auditor})
+		user := coderdtest.CreateFirstUser(t, client)
+		versionTest := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		versionDefault := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, versionDefault.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, versionTest.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, versionDefault.ID)
+
+		name, se := cryptorand.String(8)
+		require.NoError(t, se)
+		req := codersdk.CreateWorkspaceRequest{
+			// Deny setting both of these ID fields, even if they might correlate.
+			// Allowing both to be set would just create extra work for everyone involved.
+			TemplateID:        template.ID,
+			TemplateVersionID: versionTest.ID,
+			Name:              name,
+			AutostartSchedule: ptr.Ref("CRON_TZ=US/Central 30 9 * * 1-5"),
+			TTLMillis:         ptr.Ref((8 * time.Hour).Milliseconds()),
+		}
+		_, err := client.CreateWorkspace(context.Background(), user.OrganizationID, codersdk.Me, req)
+
+		require.Error(t, err)
 	})
 
 	t.Run("CreateWithDeletedTemplate", func(t *testing.T) {
@@ -495,7 +571,7 @@ func TestPostWorkspacesByOrganization(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 		err := client.DeleteTemplate(ctx, template.ID)
@@ -520,12 +596,14 @@ func TestPostWorkspacesByOrganization(t *testing.T) {
 		})
 		// Given: the template has no default TTL set
 		require.Zero(t, template.DefaultTTLMillis)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		// When: we create a workspace with autostop not enabled
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 			cwr.TTLMillis = ptr.Ref(int64(0))
 		})
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
 		// Then: No TTL should be set by the template
 		require.Nil(t, workspace.TTLMillis)
 	})
@@ -539,10 +617,12 @@ func TestPostWorkspacesByOrganization(t *testing.T) {
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 			ctr.DefaultTTLMillis = ptr.Ref(templateTTL)
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 			cwr.TTLMillis = nil // ensure that no default TTL is set
 		})
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
 		// TTL should be set by the template
 		require.Equal(t, template.DefaultTTLMillis, templateTTL)
 		require.Equal(t, template.DefaultTTLMillis, *workspace.TTLMillis)
@@ -556,7 +636,7 @@ func TestPostWorkspacesByOrganization(t *testing.T) {
 			user := coderdtest.CreateFirstUser(t, client)
 			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-			coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 			defer cancel()
@@ -586,7 +666,7 @@ func TestPostWorkspacesByOrganization(t *testing.T) {
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 			ctr.DefaultTTLMillis = &exp
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -629,7 +709,7 @@ func TestWorkspaceByOwnerAndName(t *testing.T) {
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 
@@ -644,10 +724,10 @@ func TestWorkspaceByOwnerAndName(t *testing.T) {
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -658,7 +738,7 @@ func TestWorkspaceByOwnerAndName(t *testing.T) {
 			Transition: codersdk.WorkspaceTransitionDelete,
 		})
 		require.NoError(t, err, "delete the workspace")
-		coderdtest.AwaitWorkspaceBuildJob(t, client, build.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
 
 		// Then:
 		// When we call without includes_deleted, we don't expect to get the workspace back
@@ -678,9 +758,10 @@ func TestWorkspaceByOwnerAndName(t *testing.T) {
 			Name:              workspace.Name,
 			AutostartSchedule: workspace.AutostartSchedule,
 			TTLMillis:         workspace.TTLMillis,
+			AutomaticUpdates:  workspace.AutomaticUpdates,
 		})
 		require.NoError(t, err)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		// Then:
 		// We can fetch the most recent workspace
@@ -694,7 +775,7 @@ func TestWorkspaceByOwnerAndName(t *testing.T) {
 			Transition: codersdk.WorkspaceTransitionDelete,
 		})
 		require.NoError(t, err, "delete the workspace")
-		coderdtest.AwaitWorkspaceBuildJob(t, client, build.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
 
 		// Then:
 		// When we fetch the deleted workspace, we get the most recently deleted one
@@ -725,7 +806,7 @@ func TestWorkspaceFilterAllStatus(t *testing.T) {
 	file := dbgen.File(t, db, database.File{
 		CreatedBy: owner.UserID,
 	})
-	versionJob := dbgen.ProvisionerJob(t, db, database.ProvisionerJob{
+	versionJob := dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
 		OrganizationID: owner.OrganizationID,
 		InitiatorID:    owner.UserID,
 		WorkerID:       uuid.NullUUID{},
@@ -761,7 +842,7 @@ func TestWorkspaceFilterAllStatus(t *testing.T) {
 		job.Tags = database.StringMap{
 			jobID.String(): "true",
 		}
-		job = dbgen.ProvisionerJob(t, db, job)
+		job = dbgen.ProvisionerJob(t, db, pubsub, job)
 
 		build := dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
 			WorkspaceID:       workspace.ID,
@@ -958,7 +1039,7 @@ func TestWorkspaceFilter(t *testing.T) {
 		version := coderdtest.CreateTemplateVersion(t, client, user.Org.ID, nil)
 
 		// Create a template & workspace in the user's org
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		var template codersdk.Template
 		if i%3 == 0 {
@@ -995,7 +1076,7 @@ func TestWorkspaceFilter(t *testing.T) {
 
 	// Make sure all workspaces are done. Do it after all are made
 	for i, w := range allWorkspaces {
-		latest := coderdtest.AwaitWorkspaceBuildJob(t, client, w.Workspace.LatestBuild.ID)
+		latest := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, w.Workspace.LatestBuild.ID)
 		allWorkspaces[i].Workspace.LatestBuild = latest
 	}
 
@@ -1109,7 +1190,7 @@ func TestWorkspaceFilterManual(t *testing.T) {
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 
@@ -1145,8 +1226,8 @@ func TestWorkspaceFilterManual(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		version2 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version2.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version2.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		template2 := coderdtest.CreateTemplate(t, client, user.OrganizationID, version2.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
@@ -1174,14 +1255,14 @@ func TestWorkspaceFilterManual(t *testing.T) {
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace1 := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 		workspace2 := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 
 		// wait for workspaces to be "running"
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace1.LatestBuild.ID)
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace2.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace1.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace2.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -1193,7 +1274,7 @@ func TestWorkspaceFilterManual(t *testing.T) {
 
 		// stop workspace1
 		build1 := coderdtest.CreateWorkspaceBuild(t, client, workspace1, database.WorkspaceTransitionStop)
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, build1.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build1.ID)
 
 		// filter finds one running workspace
 		ws2, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{
@@ -1205,7 +1286,7 @@ func TestWorkspaceFilterManual(t *testing.T) {
 
 		// stop workspace2
 		build2 := coderdtest.CreateWorkspaceBuild(t, client, workspace2, database.WorkspaceTransitionStop)
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, build2.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build2.ID)
 
 		// filter finds no running workspaces
 		ws3, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{
@@ -1220,8 +1301,8 @@ func TestWorkspaceFilterManual(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
 		version2 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version2.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version2.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		template2 := coderdtest.CreateTemplate(t, client, user.OrganizationID, version2.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
@@ -1248,13 +1329,13 @@ func TestWorkspaceFilterManual(t *testing.T) {
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
 			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -1276,25 +1357,16 @@ func TestWorkspaceFilterManual(t *testing.T) {
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
 			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(authToken)
-		agentCloser := agent.New(agent.Options{
-			Client: agentClient,
-			Logger: slogtest.Make(t, nil).Named("agent").Leveled(slog.LevelDebug),
-		})
-		defer func() {
-			_ = agentCloser.Close()
-		}()
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
-		coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+		_ = agenttest.New(t, client.URL, authToken)
+		_ = coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -1316,10 +1388,10 @@ func TestWorkspaceFilterManual(t *testing.T) {
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "example",
 							Type: "aws_instance",
@@ -1336,9 +1408,9 @@ func TestWorkspaceFilterManual(t *testing.T) {
 			}},
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
 		defer cancel()
@@ -1352,60 +1424,101 @@ func TestWorkspaceFilterManual(t *testing.T) {
 		}, testutil.IntervalMedium, "agent status timeout")
 	})
 
-	t.Run("FilterQueryHasDeletingByAndUnlicensed", func(t *testing.T) {
+	t.Run("IsDormant", func(t *testing.T) {
 		// this test has a licensed counterpart in enterprise/coderd/workspaces_test.go: FilterQueryHasDeletingByAndLicensed
 		t.Parallel()
-		inactivityTTL := 1 * 24 * time.Hour
-		var setCalled int64
-
 		client := coderdtest.New(t, &coderdtest.Options{
 			IncludeProvisionerDaemon: true,
-			TemplateScheduleStore: schedule.MockTemplateScheduleStore{
-				SetFn: func(ctx context.Context, db database.Store, template database.Template, options schedule.TemplateScheduleOptions) (database.Template, error) {
-					if atomic.AddInt64(&setCalled, 1) == 2 {
-						assert.Equal(t, inactivityTTL, options.InactivityTTL)
-					}
-					template.InactivityTTL = int64(options.InactivityTTL)
-					return template, nil
-				},
-			},
 		})
 		user := coderdtest.CreateFirstUser(t, client)
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
 			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		// update template with inactivity ttl
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
-		template, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
-			InactivityTTLMillis: inactivityTTL.Milliseconds(),
+		dormantWorkspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, dormantWorkspace.LatestBuild.ID)
+
+		// Create another workspace to validate that we do not return active workspaces.
+		_ = coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, dormantWorkspace.LatestBuild.ID)
+
+		err := client.UpdateWorkspaceDormancy(ctx, dormantWorkspace.ID, codersdk.UpdateWorkspaceDormancy{
+			Dormant: true,
 		})
+		require.NoError(t, err)
 
-		assert.NoError(t, err)
-		assert.Equal(t, inactivityTTL.Milliseconds(), template.InactivityTTLMillis)
+		res, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{
+			FilterQuery: "is-dormant:true",
+		})
+		require.NoError(t, err)
+		require.Len(t, res.Workspaces, 1)
+		require.NotNil(t, res.Workspaces[0].DormantAt)
+	})
 
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	t.Run("LastUsed", func(t *testing.T) {
+		t.Parallel()
 
-		// stop build so workspace is inactive
-		stopBuild := coderdtest.CreateWorkspaceBuild(t, client, workspace, database.WorkspaceTransitionStop)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, stopBuild.ID)
+		client, _, api := coderdtest.NewWithAPI(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+		})
+		user := coderdtest.CreateFirstUser(t, client)
+		authToken := uuid.NewString()
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
+		})
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		res, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{
-			FilterQuery: fmt.Sprintf("deleting_by:%s", time.Now().Add(inactivityTTL).Format("2006-01-02")),
+		// update template with inactivity ttl
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		now := dbtime.Now()
+		before := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, before.LatestBuild.ID)
+
+		after := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, after.LatestBuild.ID)
+
+		//nolint:gocritic // Unit testing context
+		err := api.Database.UpdateWorkspaceLastUsedAt(dbauthz.AsSystemRestricted(ctx), database.UpdateWorkspaceLastUsedAtParams{
+			ID:         before.ID,
+			LastUsedAt: now.UTC().Add(time.Hour * -1),
 		})
+		require.NoError(t, err)
 
-		assert.NoError(t, err)
-		// we are expecting that no workspaces are returned as user is unlicensed
-		// and template.InactivityTTL should be 0
-		assert.Len(t, res.Workspaces, 0)
+		// Unit testing context
+		//nolint:gocritic // Unit testing context
+		err = api.Database.UpdateWorkspaceLastUsedAt(dbauthz.AsSystemRestricted(ctx), database.UpdateWorkspaceLastUsedAtParams{
+			ID:         after.ID,
+			LastUsedAt: now.UTC().Add(time.Hour * 1),
+		})
+		require.NoError(t, err)
+
+		beforeRes, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{
+			FilterQuery: fmt.Sprintf("last_used_before:%q", now.Format(time.RFC3339)),
+		})
+		require.NoError(t, err)
+		require.Len(t, beforeRes.Workspaces, 1)
+		require.Equal(t, before.ID, beforeRes.Workspaces[0].ID)
+
+		afterRes, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{
+			FilterQuery: fmt.Sprintf("last_used_after:%q", now.Format(time.RFC3339)),
+		})
+		require.NoError(t, err)
+		require.Len(t, afterRes.Workspaces, 1)
+		require.Equal(t, after.ID, afterRes.Workspaces[0].ID)
 	})
 }
 
@@ -1416,7 +1529,7 @@ func TestOffsetLimit(t *testing.T) {
 	client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	_ = coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
 	_ = coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
@@ -1450,155 +1563,6 @@ func TestOffsetLimit(t *testing.T) {
 	require.Len(t, ws.Workspaces, 0)
 }
 
-func TestPostWorkspaceBuild(t *testing.T) {
-	t.Parallel()
-	t.Run("NoTemplateVersion", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-
-		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-		defer cancel()
-
-		_, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
-			TemplateVersionID: uuid.New(),
-			Transition:        codersdk.WorkspaceTransitionStart,
-		})
-		require.Error(t, err)
-		var apiErr *codersdk.Error
-		require.ErrorAs(t, err, &apiErr)
-		require.Equal(t, http.StatusBadRequest, apiErr.StatusCode())
-	})
-
-	t.Run("TemplateVersionFailedImport", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			ProvisionApply: []*proto.Provision_Response{{}},
-		})
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-
-		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-		defer cancel()
-
-		_, err := client.CreateWorkspace(ctx, user.OrganizationID, codersdk.Me, codersdk.CreateWorkspaceRequest{
-			TemplateID: template.ID,
-			Name:       "workspace",
-		})
-		var apiErr *codersdk.Error
-		require.ErrorAs(t, err, &apiErr)
-		require.Equal(t, http.StatusBadRequest, apiErr.StatusCode())
-	})
-
-	t.Run("AlreadyActive", func(t *testing.T) {
-		t.Parallel()
-		client, closer := coderdtest.NewWithProvisionerCloser(t, nil)
-		defer closer.Close()
-
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		closer.Close()
-		// Close here so workspace build doesn't process!
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-
-		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-		defer cancel()
-
-		_, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
-			TemplateVersionID: template.ActiveVersionID,
-			Transition:        codersdk.WorkspaceTransitionStart,
-		})
-		require.Error(t, err)
-		var apiErr *codersdk.Error
-		require.ErrorAs(t, err, &apiErr)
-		require.Equal(t, http.StatusConflict, apiErr.StatusCode())
-	})
-
-	t.Run("IncrementBuildNumber", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-
-		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-		defer cancel()
-
-		build, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
-			TemplateVersionID: template.ActiveVersionID,
-			Transition:        codersdk.WorkspaceTransitionStart,
-		})
-		require.NoError(t, err)
-		require.Equal(t, workspace.LatestBuild.BuildNumber+1, build.BuildNumber)
-	})
-
-	t.Run("WithState", func(t *testing.T) {
-		t.Parallel()
-		client, closeDaemon := coderdtest.NewWithProvisionerCloser(t, &coderdtest.Options{
-			IncludeProvisionerDaemon: true,
-		})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-		wantState := []byte("something")
-		_ = closeDaemon.Close()
-
-		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-		defer cancel()
-
-		build, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
-			TemplateVersionID: template.ActiveVersionID,
-			Transition:        codersdk.WorkspaceTransitionStart,
-			ProvisionerState:  wantState,
-		})
-		require.NoError(t, err)
-		gotState, err := client.WorkspaceBuildState(ctx, build.ID)
-		require.NoError(t, err)
-		require.Equal(t, wantState, gotState)
-	})
-
-	t.Run("Delete", func(t *testing.T) {
-		t.Parallel()
-		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-		user := coderdtest.CreateFirstUser(t, client)
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-
-		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-		defer cancel()
-
-		build, err := client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
-			Transition: codersdk.WorkspaceTransitionDelete,
-		})
-		require.NoError(t, err)
-		require.Equal(t, workspace.LatestBuild.BuildNumber+1, build.BuildNumber)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, build.ID)
-
-		res, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{
-			Owner: user.UserID.String(),
-		})
-		require.NoError(t, err)
-		require.Len(t, res.Workspaces, 0)
-	})
-}
-
 func TestWorkspaceUpdateAutostart(t *testing.T) {
 	t.Parallel()
 	dublinLoc := mustLocation(t, "Europe/Dublin")
@@ -1676,7 +1640,7 @@ func TestWorkspaceUpdateAutostart(t *testing.T) {
 				client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true, Auditor: auditor})
 				user      = coderdtest.CreateFirstUser(t, client)
 				version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-				_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+				_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 				project   = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 				workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 					cwr.AutostartSchedule = nil
@@ -1685,7 +1649,7 @@ func TestWorkspaceUpdateAutostart(t *testing.T) {
 			)
 
 			// await job to ensure audit logs for workspace_build start are created
-			_ = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+			_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 			// ensure test invariant: new workspaces have no autostart schedule.
 			require.Empty(t, workspace.AutostartSchedule, "expected newly-minted workspace to have no autostart schedule")
@@ -1714,7 +1678,7 @@ func TestWorkspaceUpdateAutostart(t *testing.T) {
 
 			require.EqualValues(t, *testCase.schedule, *updated.AutostartSchedule, "expected autostart schedule to equal requested")
 
-			sched, err := schedule.Weekly(*updated.AutostartSchedule)
+			sched, err := cron.Weekly(*updated.AutostartSchedule)
 			require.NoError(t, err, "parse returned schedule")
 
 			next := sched.Next(testCase.at)
@@ -1741,7 +1705,7 @@ func TestWorkspaceUpdateAutostart(t *testing.T) {
 						UserAutostartEnabled: false,
 						UserAutostopEnabled:  false,
 						DefaultTTL:           0,
-						RestartRequirement:   schedule.TemplateRestartRequirement{},
+						AutostopRequirement:  schedule.TemplateAutostopRequirement{},
 					}, nil
 				},
 				SetFn: func(_ context.Context, _ database.Store, tpl database.Template, _ schedule.TemplateScheduleOptions) (database.Template, error) {
@@ -1755,7 +1719,7 @@ func TestWorkspaceUpdateAutostart(t *testing.T) {
 			})
 			user      = coderdtest.CreateFirstUser(t, client)
 			version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			project   = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 				cwr.AutostartSchedule = nil
@@ -1764,7 +1728,7 @@ func TestWorkspaceUpdateAutostart(t *testing.T) {
 		)
 
 		// await job to ensure audit logs for workspace_build start are created
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		// ensure test invariant: new workspaces have no autostart schedule.
 		require.Empty(t, workspace.AutostartSchedule, "expected newly-minted workspace to have no autostart schedule")
@@ -1861,13 +1825,13 @@ func TestWorkspaceUpdateTTL(t *testing.T) {
 				client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true, Auditor: auditor})
 				user      = coderdtest.CreateFirstUser(t, client)
 				version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-				_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+				_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 				project   = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, mutators...)
 				workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 					cwr.AutostartSchedule = nil
 					cwr.TTLMillis = nil
 				})
-				_ = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+				_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 			)
 
 			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -1908,7 +1872,7 @@ func TestWorkspaceUpdateTTL(t *testing.T) {
 						UserAutostartEnabled: false,
 						UserAutostopEnabled:  false,
 						DefaultTTL:           0,
-						RestartRequirement:   schedule.TemplateRestartRequirement{},
+						AutostopRequirement:  schedule.TemplateAutostopRequirement{},
 					}, nil
 				},
 				SetFn: func(_ context.Context, _ database.Store, tpl database.Template, _ schedule.TemplateScheduleOptions) (database.Template, error) {
@@ -1922,7 +1886,7 @@ func TestWorkspaceUpdateTTL(t *testing.T) {
 			})
 			user      = coderdtest.CreateFirstUser(t, client)
 			version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			project   = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, project.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 				cwr.AutostartSchedule = nil
@@ -1931,7 +1895,7 @@ func TestWorkspaceUpdateTTL(t *testing.T) {
 		)
 
 		// await job to ensure audit logs for workspace_build start are created
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		// ensure test invariant: new workspaces have no autostart schedule.
 		require.Empty(t, workspace.AutostartSchedule, "expected newly-minted workspace to have no autostart schedule")
@@ -1975,12 +1939,12 @@ func TestWorkspaceExtend(t *testing.T) {
 		client      = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user        = coderdtest.CreateFirstUser(t, client)
 		version     = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_           = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		_           = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template    = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace   = coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 			cwr.TTLMillis = ptr.Ref(ttl.Milliseconds())
 		})
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
@@ -2034,6 +1998,72 @@ func TestWorkspaceExtend(t *testing.T) {
 	require.WithinDuration(t, oldDeadline.Add(-time.Hour), updated.LatestBuild.Deadline.Time, time.Minute)
 }
 
+func TestWorkspaceUpdateAutomaticUpdates_OK(t *testing.T) {
+	t.Parallel()
+
+	var (
+		auditor      = audit.NewMock()
+		adminClient  = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true, Auditor: auditor})
+		admin        = coderdtest.CreateFirstUser(t, adminClient)
+		client, user = coderdtest.CreateAnotherUser(t, adminClient, admin.OrganizationID)
+		version      = coderdtest.CreateTemplateVersion(t, adminClient, admin.OrganizationID, nil)
+		_            = coderdtest.AwaitTemplateVersionJobCompleted(t, adminClient, version.ID)
+		project      = coderdtest.CreateTemplate(t, adminClient, admin.OrganizationID, version.ID)
+		workspace    = coderdtest.CreateWorkspace(t, client, admin.OrganizationID, project.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
+			cwr.AutostartSchedule = nil
+			cwr.TTLMillis = nil
+			cwr.AutomaticUpdates = codersdk.AutomaticUpdatesNever
+		})
+	)
+
+	// await job to ensure audit logs for workspace_build start are created
+	_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+	// ensure test invariant: new workspaces have automatic updates set to never
+	require.Equal(t, codersdk.AutomaticUpdatesNever, workspace.AutomaticUpdates, "expected newly-minted workspace to automatic updates set to never")
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	err := client.UpdateWorkspaceAutomaticUpdates(ctx, workspace.ID, codersdk.UpdateWorkspaceAutomaticUpdatesRequest{
+		AutomaticUpdates: codersdk.AutomaticUpdatesAlways,
+	})
+	require.NoError(t, err)
+
+	updated, err := client.Workspace(ctx, workspace.ID)
+	require.NoError(t, err)
+	require.Equal(t, codersdk.AutomaticUpdatesAlways, updated.AutomaticUpdates)
+
+	require.Eventually(t, func() bool {
+		return len(auditor.AuditLogs()) >= 9
+	}, testutil.WaitShort, testutil.IntervalFast)
+	l := auditor.AuditLogs()[8]
+	require.Equal(t, database.AuditActionWrite, l.Action)
+	require.Equal(t, user.ID, l.UserID)
+	require.Equal(t, workspace.ID, l.ResourceID)
+}
+
+func TestUpdateWorkspaceAutomaticUpdates_NotFound(t *testing.T) {
+	t.Parallel()
+	var (
+		client = coderdtest.New(t, nil)
+		_      = coderdtest.CreateFirstUser(t, client)
+		wsid   = uuid.New()
+		req    = codersdk.UpdateWorkspaceAutomaticUpdatesRequest{
+			AutomaticUpdates: codersdk.AutomaticUpdatesNever,
+		}
+	)
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	err := client.UpdateWorkspaceAutomaticUpdates(ctx, wsid, req)
+	require.IsType(t, err, &codersdk.Error{}, "expected codersdk.Error")
+	coderSDKErr, _ := err.(*codersdk.Error) //nolint:errorlint
+	require.Equal(t, coderSDKErr.StatusCode(), 404, "expected status code 404")
+	require.Contains(t, coderSDKErr.Message, "Resource not found", "unexpected response code")
+}
+
 func TestWorkspaceWatcher(t *testing.T) {
 	t.Parallel()
 	client, closeFunc := coderdtest.NewWithProvisionerCloser(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
@@ -2042,10 +2072,10 @@ func TestWorkspaceWatcher(t *testing.T) {
 	authToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:         echo.ParseComplete,
-		ProvisionPlan: echo.ProvisionComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionPlan: echo.PlanComplete,
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "example",
 						Type: "aws_instance",
@@ -2061,10 +2091,10 @@ func TestWorkspaceWatcher(t *testing.T) {
 			},
 		}},
 	})
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
 
@@ -2081,9 +2111,14 @@ func TestWorkspaceWatcher(t *testing.T) {
 			case w, ok := <-wc:
 				require.True(t, ok, "watch channel closed: %s", event)
 				if ready == nil || ready(w) {
-					logger.Info(ctx, "done waiting for event", slog.F("event", event))
+					logger.Info(ctx, "done waiting for event",
+						slog.F("event", event),
+						slog.F("workspace", w))
 					return
 				}
+				logger.Info(ctx, "skipped update for event",
+					slog.F("event", event),
+					slog.F("workspace", w))
 			}
 		}
 	}
@@ -2102,21 +2137,14 @@ func TestWorkspaceWatcher(t *testing.T) {
 	wait("agent timeout after create", nil)
 	wait("agent timeout after start", nil)
 
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: logger.Named("agent"),
-	})
-	defer func() {
-		_ = agentCloser.Close()
-	}()
+	agt := agenttest.New(t, client.URL, authToken)
+	_ = coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 	wait("agent connected/ready", func(w codersdk.Workspace) bool {
 		return w.LatestBuild.Resources[0].Agents[0].Status == codersdk.WorkspaceAgentConnected &&
 			w.LatestBuild.Resources[0].Agents[0].LifecycleState == codersdk.WorkspaceAgentLifecycleReady
 	})
-	agentCloser.Close()
+	agt.Close()
 	wait("agent disconnected", func(w codersdk.Workspace) bool {
 		return w.LatestBuild.Resources[0].Agents[0].Status == codersdk.WorkspaceAgentDisconnected
 	})
@@ -2130,10 +2158,10 @@ func TestWorkspaceWatcher(t *testing.T) {
 	// Add a new version that will fail.
 	badVersion := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:         echo.ParseComplete,
-		ProvisionPlan: echo.ProvisionComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionPlan: echo.PlanComplete,
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Error: "test error",
 				},
 			},
@@ -2141,7 +2169,7 @@ func TestWorkspaceWatcher(t *testing.T) {
 	}, func(req *codersdk.CreateTemplateVersionRequest) {
 		req.TemplateID = template.ID
 	})
-	coderdtest.AwaitTemplateVersionJob(t, client, badVersion.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, badVersion.ID)
 	err = client.UpdateActiveTemplateVersion(ctx, template.ID, codersdk.UpdateActiveTemplateVersion{
 		ID: badVersion.ID,
 	})
@@ -2154,12 +2182,23 @@ func TestWorkspaceWatcher(t *testing.T) {
 	})
 	// We want to verify pending state here, but it's possible that we reach
 	// failed state fast enough that we never see pending.
+	sawFailed := false
 	wait("workspace build pending or failed", func(w codersdk.Workspace) bool {
-		return w.LatestBuild.Status == codersdk.WorkspaceStatusPending || w.LatestBuild.Status == codersdk.WorkspaceStatusFailed
-	})
-	wait("workspace build failed", func(w codersdk.Workspace) bool {
-		return w.LatestBuild.Status == codersdk.WorkspaceStatusFailed
+		switch w.LatestBuild.Status {
+		case codersdk.WorkspaceStatusPending:
+			return true
+		case codersdk.WorkspaceStatusFailed:
+			sawFailed = true
+			return true
+		default:
+			return false
+		}
 	})
+	if !sawFailed {
+		wait("workspace build failed", func(w codersdk.Workspace) bool {
+			return w.LatestBuild.Status == codersdk.WorkspaceStatusFailed
+		})
+	}
 
 	closeFunc.Close()
 	build := coderdtest.CreateWorkspaceBuild(t, client, workspace, database.WorkspaceTransitionStart)
@@ -2187,9 +2226,9 @@ func TestWorkspaceResource(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "beta",
 							Type: "example",
@@ -2211,10 +2250,10 @@ func TestWorkspaceResource(t *testing.T) {
 				},
 			}},
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -2255,9 +2294,9 @@ func TestWorkspaceResource(t *testing.T) {
 		}
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "some",
 							Type: "example",
@@ -2271,10 +2310,10 @@ func TestWorkspaceResource(t *testing.T) {
 				},
 			}},
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -2312,9 +2351,9 @@ func TestWorkspaceResource(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name: "some",
 							Type: "example",
@@ -2340,10 +2379,10 @@ func TestWorkspaceResource(t *testing.T) {
 				},
 			}},
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -2385,10 +2424,10 @@ func TestWorkspaceWithRichParameters(t *testing.T) {
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse: echo.ParseComplete,
-		ProvisionPlan: []*proto.Provision_Response{
+		ProvisionPlan: []*proto.Response{
 			{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
 						Parameters: []*proto.RichParameter{
 							{
 								Name:        firstParameterName,
@@ -2409,13 +2448,13 @@ func TestWorkspaceWithRichParameters(t *testing.T) {
 				},
 			},
 		},
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{},
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{},
 			},
 		}},
 	})
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
@@ -2450,7 +2489,7 @@ func TestWorkspaceWithRichParameters(t *testing.T) {
 		cwr.RichParameterValues = expectedBuildParameters
 	})
 
-	workspaceBuild := coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	workspaceBuild := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	require.Equal(t, codersdk.WorkspaceStatusRunning, workspaceBuild.Status)
 
 	workspaceBuildParameters, err := client.WorkspaceBuildParameters(ctx, workspaceBuild.ID)
@@ -2478,10 +2517,10 @@ func TestWorkspaceWithOptionalRichParameters(t *testing.T) {
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse: echo.ParseComplete,
-		ProvisionPlan: []*proto.Provision_Response{
+		ProvisionPlan: []*proto.Response{
 			{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
 						Parameters: []*proto.RichParameter{
 							{
 								Name:         firstParameterName,
@@ -2500,13 +2539,13 @@ func TestWorkspaceWithOptionalRichParameters(t *testing.T) {
 				},
 			},
 		},
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{},
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{},
 			},
 		}},
 	})
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
@@ -2531,7 +2570,7 @@ func TestWorkspaceWithOptionalRichParameters(t *testing.T) {
 		}
 	})
 
-	workspaceBuild := coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	workspaceBuild := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	require.Equal(t, codersdk.WorkspaceStatusRunning, workspaceBuild.Status)
 
 	workspaceBuildParameters, err := client.WorkspaceBuildParameters(ctx, workspaceBuild.ID)
@@ -2569,10 +2608,10 @@ func TestWorkspaceWithEphemeralRichParameters(t *testing.T) {
 	user := coderdtest.CreateFirstUser(t, client)
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse: echo.ParseComplete,
-		ProvisionPlan: []*proto.Provision_Response{
+		ProvisionPlan: []*proto.Response{
 			{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
 						Parameters: []*proto.RichParameter{
 							{
 								Name:         firstParameterName,
@@ -2594,18 +2633,18 @@ func TestWorkspaceWithEphemeralRichParameters(t *testing.T) {
 				},
 			},
 		},
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{},
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{},
 			},
 		}},
 	})
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 
 	// Create workspace with default values
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	workspaceBuild := coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	workspaceBuild := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	require.Equal(t, codersdk.WorkspaceStatusRunning, workspaceBuild.Status)
 
 	// Verify workspace build parameters (default values)
@@ -2632,7 +2671,7 @@ func TestWorkspaceWithEphemeralRichParameters(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	workspaceBuild = coderdtest.AwaitWorkspaceBuildJob(t, client, workspaceBuild.ID)
+	workspaceBuild = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspaceBuild.ID)
 	require.Equal(t, codersdk.WorkspaceStatusRunning, workspaceBuild.Status)
 
 	// Verify workspace build parameters (including ephemeral)
@@ -2656,7 +2695,7 @@ func TestWorkspaceWithEphemeralRichParameters(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
-	workspaceBuild = coderdtest.AwaitWorkspaceBuildJob(t, client, workspaceBuild.ID)
+	workspaceBuild = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspaceBuild.ID)
 	require.Equal(t, codersdk.WorkspaceStatusRunning, workspaceBuild.Status)
 
 	// Verify workspace build parameters (ephemeral should be back to default)
@@ -2670,55 +2709,61 @@ func TestWorkspaceWithEphemeralRichParameters(t *testing.T) {
 	require.ElementsMatch(t, expectedBuildParameters, workspaceBuildParameters)
 }
 
-func TestWorkspaceLock(t *testing.T) {
+func TestWorkspaceDormant(t *testing.T) {
 	t.Parallel()
 
 	t.Run("OK", func(t *testing.T) {
 		t.Parallel()
 		var (
-			client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user      = coderdtest.CreateFirstUser(t, client)
-			version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			lockedTTL = time.Minute
+			auditRecorder = audit.NewMock()
+			client        = coderdtest.New(t, &coderdtest.Options{
+				IncludeProvisionerDaemon: true,
+				Auditor:                  auditRecorder,
+			})
+			user                     = coderdtest.CreateFirstUser(t, client)
+			version                  = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+			_                        = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			timeTilDormantAutoDelete = time.Minute
 		)
 
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
-			ctr.LockedTTLMillis = ptr.Ref[int64](lockedTTL.Milliseconds())
+			ctr.TimeTilDormantAutoDeleteMillis = ptr.Ref[int64](timeTilDormantAutoDelete.Milliseconds())
 		})
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
 		lastUsedAt := workspace.LastUsedAt
-		err := client.UpdateWorkspaceLock(ctx, workspace.ID, codersdk.UpdateWorkspaceLock{
-			Lock: true,
+		auditRecorder.ResetLogs()
+		err := client.UpdateWorkspaceDormancy(ctx, workspace.ID, codersdk.UpdateWorkspaceDormancy{
+			Dormant: true,
 		})
 		require.NoError(t, err)
+		require.Len(t, auditRecorder.AuditLogs(), 1)
 
 		workspace = coderdtest.MustWorkspace(t, client, workspace.ID)
 		require.NoError(t, err, "fetch provisioned workspace")
-		// The template doesn't have a locked_ttl set so this should be nil.
+		// The template doesn't have a time_til_dormant_autodelete set so this should be nil.
 		require.Nil(t, workspace.DeletingAt)
-		require.NotNil(t, workspace.LockedAt)
-		require.WithinRange(t, *workspace.LockedAt, time.Now().Add(-time.Second*10), time.Now())
+		require.NotNil(t, workspace.DormantAt)
+		require.WithinRange(t, *workspace.DormantAt, time.Now().Add(-time.Second*10), time.Now())
 		require.Equal(t, lastUsedAt, workspace.LastUsedAt)
 
 		workspace = coderdtest.MustWorkspace(t, client, workspace.ID)
 		lastUsedAt = workspace.LastUsedAt
-		err = client.UpdateWorkspaceLock(ctx, workspace.ID, codersdk.UpdateWorkspaceLock{
-			Lock: false,
+		err = client.UpdateWorkspaceDormancy(ctx, workspace.ID, codersdk.UpdateWorkspaceDormancy{
+			Dormant: false,
 		})
 		require.NoError(t, err)
 
 		workspace, err = client.Workspace(ctx, workspace.ID)
 		require.NoError(t, err, "fetch provisioned workspace")
-		require.Nil(t, workspace.LockedAt)
-		// The template doesn't have a locked_ttl set so this should be nil.
+		require.Nil(t, workspace.DormantAt)
+		// The template doesn't have a time_til_dormant_autodelete  set so this should be nil.
 		require.Nil(t, workspace.DeletingAt)
-		// The last_used_at should get updated when we unlock the workspace.
+		// The last_used_at should get updated when we activate the workspace.
 		require.True(t, workspace.LastUsedAt.After(lastUsedAt))
 	})
 
@@ -2728,34 +2773,56 @@ func TestWorkspaceLock(t *testing.T) {
 			client    = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 			user      = coderdtest.CreateFirstUser(t, client)
 			version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			template  = coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-			_         = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+			_         = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 		)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
-		err := client.UpdateWorkspaceLock(ctx, workspace.ID, codersdk.UpdateWorkspaceLock{
-			Lock: true,
+		err := client.UpdateWorkspaceDormancy(ctx, workspace.ID, codersdk.UpdateWorkspaceDormancy{
+			Dormant: true,
 		})
 		require.NoError(t, err)
 
-		// Should be able to stop a workspace while it is locked.
+		// Should be able to stop a workspace while it is dormant.
 		coderdtest.MustTransitionWorkspace(t, client, workspace.ID, database.WorkspaceTransitionStart, database.WorkspaceTransitionStop)
 
-		// Should not be able to start a workspace while it is locked.
+		// Should not be able to start a workspace while it is dormant.
 		_, err = client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
 			TemplateVersionID: template.ActiveVersionID,
 			Transition:        codersdk.WorkspaceTransition(database.WorkspaceTransitionStart),
 		})
 		require.Error(t, err)
 
-		err = client.UpdateWorkspaceLock(ctx, workspace.ID, codersdk.UpdateWorkspaceLock{
-			Lock: false,
+		err = client.UpdateWorkspaceDormancy(ctx, workspace.ID, codersdk.UpdateWorkspaceDormancy{
+			Dormant: false,
 		})
 		require.NoError(t, err)
 		coderdtest.MustTransitionWorkspace(t, client, workspace.ID, database.WorkspaceTransitionStop, database.WorkspaceTransitionStart)
 	})
 }
+
+func verifyAuditWorkspaceCreated(t *testing.T, auditor *audit.MockAuditor, workspaceName string) {
+	var auditLogs []database.AuditLog
+	ok := assert.Eventually(t, func() bool {
+		auditLogs = auditor.AuditLogs()
+
+		for _, auditLog := range auditLogs {
+			if auditLog.Action == database.AuditActionCreate &&
+				auditLog.ResourceType == database.ResourceTypeWorkspace &&
+				auditLog.ResourceTarget == workspaceName {
+				return true
+			}
+		}
+		return false
+	}, testutil.WaitMedium, testutil.IntervalFast)
+
+	if !ok {
+		for i, auditLog := range auditLogs {
+			t.Logf("%d. Audit: ID=%s action=%s resourceID=%s resourceType=%s resourceTarget=%s", i+1, auditLog.ID, auditLog.Action, auditLog.ResourceID, auditLog.ResourceType, auditLog.ResourceTarget)
+		}
+	}
+}
diff --git a/coderd/wsbuilder/wsbuilder.go b/coderd/wsbuilder/wsbuilder.go
index 06b4d8c167cf9..80d5cca80f313 100644
--- a/coderd/wsbuilder/wsbuilder.go
+++ b/coderd/wsbuilder/wsbuilder.go
@@ -8,19 +8,21 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"time"
 
 	"github.com/google/uuid"
-	"github.com/lib/pq"
 	"github.com/sqlc-dev/pqtype"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/provisionerdserver"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/provisionerdserver"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // Builder encapsulates the business logic of inserting a new workspace build into the database.
@@ -199,38 +201,32 @@ func (b *Builder) Build(
 	ctx context.Context,
 	store database.Store,
 	authFunc func(action rbac.Action, object rbac.Objecter) bool,
+	auditBaggage audit.WorkspaceBuildBaggage,
 ) (
 	*database.WorkspaceBuild, *database.ProvisionerJob, error,
 ) {
-	b.ctx = ctx
+	var err error
+	b.ctx, err = audit.BaggageToContext(ctx, auditBaggage)
+	if err != nil {
+		return nil, nil, xerrors.Errorf("create audit baggage: %w", err)
+	}
 
 	// Run the build in a transaction with RepeatableRead isolation, and retries.
 	// RepeatableRead isolation ensures that we get a consistent view of the database while
 	// computing the new build.  This simplifies the logic so that we do not need to worry if
 	// later reads are consistent with earlier ones.
-	var err error
-	for retries := 0; retries < 5; retries++ {
-		var workspaceBuild *database.WorkspaceBuild
-		var provisionerJob *database.ProvisionerJob
-		err := store.InTx(func(store database.Store) error {
-			b.store = store
-			workspaceBuild, provisionerJob, err = b.buildTx(authFunc)
-			return err
-		}, &sql.TxOptions{Isolation: sql.LevelRepeatableRead})
-		var pqe *pq.Error
-		if xerrors.As(err, &pqe) {
-			if pqe.Code == "40001" {
-				// serialization error, retry
-				continue
-			}
-		}
-		if err != nil {
-			// Other (hard) error
-			return nil, nil, err
-		}
-		return workspaceBuild, provisionerJob, nil
+	var workspaceBuild *database.WorkspaceBuild
+	var provisionerJob *database.ProvisionerJob
+	err = database.ReadModifyUpdate(store, func(tx database.Store) error {
+		var err error
+		b.store = tx
+		workspaceBuild, provisionerJob, err = b.buildTx(authFunc)
+		return err
+	})
+	if err != nil {
+		return nil, nil, xerrors.Errorf("build tx: %w", err)
 	}
-	return nil, nil, xerrors.Errorf("too many errors; last error: %w", err)
+	return workspaceBuild, provisionerJob, nil
 }
 
 // buildTx contains the business logic of computing a new build.  Attributes of the new database objects are computed
@@ -300,7 +296,7 @@ func (b *Builder) buildTx(authFunc func(action rbac.Action, object rbac.Objecter
 	}
 	tags := provisionerdserver.MutateTags(b.workspace.OwnerID, templateVersionJob.Tags)
 
-	now := database.Now()
+	now := dbtime.Now()
 	provisionerJob, err := b.store.InsertProvisionerJob(b.ctx, database.InsertProvisionerJobParams{
 		ID:             uuid.New(),
 		CreatedAt:      now,
@@ -349,9 +345,15 @@ func (b *Builder) buildTx(authFunc func(action rbac.Action, object rbac.Objecter
 			Transition:        b.trans,
 			JobID:             provisionerJob.ID,
 			Reason:            b.reason,
+			Deadline:          time.Time{}, // set by provisioner upon completion
+			MaxDeadline:       time.Time{}, // set by provisioner upon completion
 		})
 		if err != nil {
-			return BuildError{http.StatusInternalServerError, "insert workspace build", err}
+			code := http.StatusInternalServerError
+			if rbac.IsUnauthorizedError(err) {
+				code = http.StatusUnauthorized
+			}
+			return BuildError{code, "insert workspace build", err}
 		}
 
 		names, values, err := b.getParameters()
@@ -525,7 +527,7 @@ func (b *Builder) getParameters() (names, values []string, err error) {
 			// At this point, we've queried all the data we need from the database,
 			// so the only errors are problems with the request (missing data, failed
 			// validation, immutable parameters, etc.)
-			return nil, nil, BuildError{http.StatusBadRequest, err.Error(), err}
+			return nil, nil, BuildError{http.StatusBadRequest, fmt.Sprintf("Unable to validate parameter %q", templateVersionParameter.Name), err}
 		}
 		names = append(names, templateVersionParameter.Name)
 		values = append(values, value)
@@ -714,7 +716,7 @@ func (b *Builder) checkTemplateJobStatus() error {
 		}
 	}
 
-	templateVersionJobStatus := db2sdk.ProvisionerJobStatus(*templateVersionJob)
+	templateVersionJobStatus := codersdk.ProvisionerJobStatus(templateVersionJob.JobStatus)
 	switch templateVersionJobStatus {
 	case codersdk.ProvisionerJobPending, codersdk.ProvisionerJobRunning:
 		msg := fmt.Sprintf("The provided template version is %s. Wait for it to complete importing!", templateVersionJobStatus)
@@ -751,7 +753,7 @@ func (b *Builder) checkRunningBuild() error {
 	if err != nil {
 		return BuildError{http.StatusInternalServerError, "failed to fetch prior build", err}
 	}
-	if db2sdk.ProvisionerJobStatus(*job).Active() {
+	if codersdk.ProvisionerJobStatus(job.JobStatus).Active() {
 		msg := "A workspace build is already active."
 		return BuildError{
 			http.StatusConflict,
diff --git a/coderd/wsbuilder/wsbuilder_test.go b/coderd/wsbuilder/wsbuilder_test.go
index afb7c5af75579..c55d440ac2c28 100644
--- a/coderd/wsbuilder/wsbuilder_test.go
+++ b/coderd/wsbuilder/wsbuilder_test.go
@@ -12,12 +12,16 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbmock"
-	"github.com/coder/coder/coderd/provisionerdserver"
-	"github.com/coder/coder/coderd/wsbuilder"
-	"github.com/coder/coder/codersdk"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/propagation"
+
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbmock"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/provisionerdserver"
+	"github.com/coder/coder/v2/coderd/wsbuilder"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 var (
@@ -87,7 +91,7 @@ func TestBuilder_NoOptions(t *testing.T) {
 
 	ws := database.Workspace{ID: workspaceID, TemplateID: templateID, OwnerID: userID}
 	uut := wsbuilder.New(ws, database.WorkspaceTransitionStart)
-	_, _, err := uut.Build(ctx, mDB, nil)
+	_, _, err := uut.Build(ctx, mDB, nil, audit.WorkspaceBuildBaggage{})
 	req.NoError(err)
 }
 
@@ -122,7 +126,48 @@ func TestBuilder_Initiator(t *testing.T) {
 
 	ws := database.Workspace{ID: workspaceID, TemplateID: templateID, OwnerID: userID}
 	uut := wsbuilder.New(ws, database.WorkspaceTransitionStart).Initiator(otherUserID)
-	_, _, err := uut.Build(ctx, mDB, nil)
+	_, _, err := uut.Build(ctx, mDB, nil, audit.WorkspaceBuildBaggage{})
+	req.NoError(err)
+}
+
+func TestBuilder_Baggage(t *testing.T) {
+	t.Parallel()
+	req := require.New(t)
+	asrt := assert.New(t)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	otel.SetTextMapPropagator(
+		propagation.NewCompositeTextMapPropagator(
+			propagation.TraceContext{},
+			propagation.Baggage{},
+		),
+	)
+
+	mDB := expectDB(t,
+		// Inputs
+		withTemplate,
+		withInactiveVersion(nil),
+		withLastBuildFound,
+		withRichParameters(nil),
+		withParameterSchemas(inactiveJobID, nil),
+
+		// Outputs
+		expectProvisionerJob(func(job database.InsertProvisionerJobParams) {
+			asrt.Contains(string(job.TraceMetadata.RawMessage), "ip=127.0.0.1")
+		}),
+		withInTx,
+		expectBuild(func(bld database.InsertWorkspaceBuildParams) {
+		}),
+		expectBuildParameters(func(params database.InsertWorkspaceBuildParametersParams) {
+		}),
+		withBuild,
+	)
+
+	ws := database.Workspace{ID: workspaceID, TemplateID: templateID, OwnerID: userID}
+	uut := wsbuilder.New(ws, database.WorkspaceTransitionStart).Initiator(otherUserID)
+	_, _, err := uut.Build(ctx, mDB, nil, audit.WorkspaceBuildBaggage{IP: "127.0.0.1"})
 	req.NoError(err)
 }
 
@@ -156,7 +201,7 @@ func TestBuilder_Reason(t *testing.T) {
 
 	ws := database.Workspace{ID: workspaceID, TemplateID: templateID, OwnerID: userID}
 	uut := wsbuilder.New(ws, database.WorkspaceTransitionStart).Reason(database.BuildReasonAutostart)
-	_, _, err := uut.Build(ctx, mDB, nil)
+	_, _, err := uut.Build(ctx, mDB, nil, audit.WorkspaceBuildBaggage{})
 	req.NoError(err)
 }
 
@@ -195,7 +240,7 @@ func TestBuilder_ActiveVersion(t *testing.T) {
 
 	ws := database.Workspace{ID: workspaceID, TemplateID: templateID, OwnerID: userID}
 	uut := wsbuilder.New(ws, database.WorkspaceTransitionStart).ActiveVersion()
-	_, _, err := uut.Build(ctx, mDB, nil)
+	_, _, err := uut.Build(ctx, mDB, nil, audit.WorkspaceBuildBaggage{})
 	req.NoError(err)
 }
 
@@ -273,7 +318,7 @@ func TestWorkspaceBuildWithRichParameters(t *testing.T) {
 
 		ws := database.Workspace{ID: workspaceID, TemplateID: templateID, OwnerID: userID}
 		uut := wsbuilder.New(ws, database.WorkspaceTransitionStart).RichParameterValues(nextBuildParameters)
-		_, _, err := uut.Build(ctx, mDB, nil)
+		_, _, err := uut.Build(ctx, mDB, nil, audit.WorkspaceBuildBaggage{})
 		req.NoError(err)
 	})
 	t.Run("UsePreviousParameterValues", func(t *testing.T) {
@@ -316,7 +361,7 @@ func TestWorkspaceBuildWithRichParameters(t *testing.T) {
 
 		ws := database.Workspace{ID: workspaceID, TemplateID: templateID, OwnerID: userID}
 		uut := wsbuilder.New(ws, database.WorkspaceTransitionStart).RichParameterValues(nextBuildParameters)
-		_, _, err := uut.Build(ctx, mDB, nil)
+		_, _, err := uut.Build(ctx, mDB, nil, audit.WorkspaceBuildBaggage{})
 		req.NoError(err)
 	})
 
@@ -356,7 +401,7 @@ func TestWorkspaceBuildWithRichParameters(t *testing.T) {
 
 		ws := database.Workspace{ID: workspaceID, TemplateID: templateID, OwnerID: userID}
 		uut := wsbuilder.New(ws, database.WorkspaceTransitionStart)
-		_, _, err := uut.Build(ctx, mDB, nil)
+		_, _, err := uut.Build(ctx, mDB, nil, audit.WorkspaceBuildBaggage{})
 		bldErr := wsbuilder.BuildError{}
 		req.ErrorAs(err, &bldErr)
 		asrt.Equal(http.StatusBadRequest, bldErr.Status)
@@ -393,7 +438,7 @@ func TestWorkspaceBuildWithRichParameters(t *testing.T) {
 
 		ws := database.Workspace{ID: workspaceID, TemplateID: templateID, OwnerID: userID}
 		uut := wsbuilder.New(ws, database.WorkspaceTransitionStart).RichParameterValues(nextBuildParameters)
-		_, _, err := uut.Build(ctx, mDB, nil)
+		_, _, err := uut.Build(ctx, mDB, nil, audit.WorkspaceBuildBaggage{})
 		bldErr := wsbuilder.BuildError{}
 		req.ErrorAs(err, &bldErr)
 		asrt.Equal(http.StatusBadRequest, bldErr.Status)
@@ -455,7 +500,7 @@ func TestWorkspaceBuildWithRichParameters(t *testing.T) {
 		uut := wsbuilder.New(ws, database.WorkspaceTransitionStart).
 			RichParameterValues(nextBuildParameters).
 			VersionID(activeVersionID)
-		_, _, err := uut.Build(ctx, mDB, nil)
+		_, _, err := uut.Build(ctx, mDB, nil, audit.WorkspaceBuildBaggage{})
 		req.NoError(err)
 	})
 
@@ -515,7 +560,7 @@ func TestWorkspaceBuildWithRichParameters(t *testing.T) {
 		uut := wsbuilder.New(ws, database.WorkspaceTransitionStart).
 			RichParameterValues(nextBuildParameters).
 			VersionID(activeVersionID)
-		_, _, err := uut.Build(ctx, mDB, nil)
+		_, _, err := uut.Build(ctx, mDB, nil, audit.WorkspaceBuildBaggage{})
 		req.NoError(err)
 	})
 
@@ -573,7 +618,7 @@ func TestWorkspaceBuildWithRichParameters(t *testing.T) {
 		uut := wsbuilder.New(ws, database.WorkspaceTransitionStart).
 			RichParameterValues(nextBuildParameters).
 			VersionID(activeVersionID)
-		_, _, err := uut.Build(ctx, mDB, nil)
+		_, _, err := uut.Build(ctx, mDB, nil, audit.WorkspaceBuildBaggage{})
 		req.NoError(err)
 	})
 }
@@ -649,9 +694,9 @@ func withActiveVersion(params []database.TemplateVersionParameter) func(mTx *dbm
 				provisionerdserver.TagScope: provisionerdserver.ScopeUser,
 			},
 			FileID:      activeFileID,
-			StartedAt:   sql.NullTime{Time: database.Now(), Valid: true},
+			StartedAt:   sql.NullTime{Time: dbtime.Now(), Valid: true},
 			UpdatedAt:   time.Now(),
-			CompletedAt: sql.NullTime{Time: database.Now(), Valid: true},
+			CompletedAt: sql.NullTime{Time: dbtime.Now(), Valid: true},
 		}, nil)
 		paramsCall := mTx.EXPECT().GetTemplateVersionParameters(gomock.Any(), activeVersionID).
 			Times(1)
@@ -689,9 +734,9 @@ func withInactiveVersion(params []database.TemplateVersionParameter) func(mTx *d
 				provisionerdserver.TagScope: provisionerdserver.ScopeUser,
 			},
 			FileID:      inactiveFileID,
-			StartedAt:   sql.NullTime{Time: database.Now(), Valid: true},
+			StartedAt:   sql.NullTime{Time: dbtime.Now(), Valid: true},
 			UpdatedAt:   time.Now(),
-			CompletedAt: sql.NullTime{Time: database.Now(), Valid: true},
+			CompletedAt: sql.NullTime{Time: dbtime.Now(), Valid: true},
 		}, nil)
 		paramsCall := mTx.EXPECT().GetTemplateVersionParameters(gomock.Any(), inactiveVersionID).
 			Times(1)
@@ -728,9 +773,9 @@ func withLastBuildFound(mTx *dbmock.MockStore) {
 			StorageMethod:  database.ProvisionerStorageMethodFile,
 			FileID:         inactiveFileID,
 			Type:           database.ProvisionerJobTypeWorkspaceBuild,
-			StartedAt:      sql.NullTime{Time: database.Now(), Valid: true},
+			StartedAt:      sql.NullTime{Time: dbtime.Now(), Valid: true},
 			UpdatedAt:      time.Now(),
-			CompletedAt:    sql.NullTime{Time: database.Now(), Valid: true},
+			CompletedAt:    sql.NullTime{Time: dbtime.Now(), Valid: true},
 		}, nil)
 }
 
diff --git a/coderd/wsconncache/wsconncache.go b/coderd/wsconncache/wsconncache.go
index 4ff7f30e049eb..b9d362eac3163 100644
--- a/coderd/wsconncache/wsconncache.go
+++ b/coderd/wsconncache/wsconncache.go
@@ -16,8 +16,8 @@ import (
 	"golang.org/x/sync/singleflight"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/site"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/site"
 )
 
 type AgentProvider struct {
diff --git a/coderd/wsconncache/wsconncache_test.go b/coderd/wsconncache/wsconncache_test.go
index d0769cf057316..e37809ba61f6e 100644
--- a/coderd/wsconncache/wsconncache_test.go
+++ b/coderd/wsconncache/wsconncache_test.go
@@ -23,13 +23,13 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/wsconncache"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/tailnet"
-	"github.com/coder/coder/tailnet/tailnettest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/coderd/wsconncache"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/tailnet/tailnettest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
@@ -179,9 +179,10 @@ func setupAgent(t *testing.T, manifest agentsdk.Manifest, ptyTimeout time.Durati
 		_ = closer.Close()
 	})
 	conn, err := tailnet.NewConn(&tailnet.Options{
-		Addresses: []netip.Prefix{netip.PrefixFrom(tailnet.IP(), 128)},
-		DERPMap:   manifest.DERPMap,
-		Logger:    slogtest.Make(t, nil).Named("tailnet").Leveled(slog.LevelDebug),
+		Addresses:           []netip.Prefix{netip.PrefixFrom(tailnet.IP(), 128)},
+		DERPMap:             manifest.DERPMap,
+		DERPForceWebSockets: manifest.DERPForceWebSockets,
+		Logger:              slogtest.Make(t, nil).Named("tailnet").Leveled(slog.LevelDebug),
 	})
 	require.NoError(t, err)
 	clientConn, serverConn := net.Pipe()
@@ -266,7 +267,7 @@ func (*client) PostAppHealth(_ context.Context, _ agentsdk.PostAppHealthsRequest
 	return nil
 }
 
-func (*client) PostMetadata(_ context.Context, _ string, _ agentsdk.PostMetadataRequest) error {
+func (*client) PostMetadata(_ context.Context, _ agentsdk.PostMetadataRequest) error {
 	return nil
 }
 
diff --git a/codersdk/agentsdk/agentsdk.go b/codersdk/agentsdk/agentsdk.go
index e2189e1cc53d2..59e4bc9d785b1 100644
--- a/codersdk/agentsdk/agentsdk.go
+++ b/codersdk/agentsdk/agentsdk.go
@@ -19,10 +19,17 @@ import (
 	"tailscale.com/tailcfg"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/retry"
 )
 
+// ExternalLogSourceID is the statically-defined ID of a log-source that
+// appears as "External" in the dashboard.
+//
+// This is to support legacy API-consumers that do not create their own
+// log-source. This should be removed in the future.
+var ExternalLogSourceID = uuid.MustParse("3b579bf4-1ed8-4b99-87a8-e9a1e3410410")
+
 // New returns a client that is used to interact with the
 // Coder API from a workspace agent.
 func New(serverURL *url.URL) *Client {
@@ -62,12 +69,21 @@ func (c *Client) GitSSHKey(ctx context.Context) (GitSSHKey, error) {
 	return gitSSHKey, json.NewDecoder(res.Body).Decode(&gitSSHKey)
 }
 
+type Metadata struct {
+	Key string `json:"key"`
+	codersdk.WorkspaceAgentMetadataResult
+}
+
+type PostMetadataRequest struct {
+	Metadata []Metadata `json:"metadata"`
+}
+
 // In the future, we may want to support sending back multiple values for
 // performance.
-type PostMetadataRequest = codersdk.WorkspaceAgentMetadataResult
+type PostMetadataRequestDeprecated = codersdk.WorkspaceAgentMetadataResult
 
-func (c *Client) PostMetadata(ctx context.Context, key string, req PostMetadataRequest) error {
-	res, err := c.SDK.Request(ctx, http.MethodPost, "/api/v2/workspaceagents/me/metadata/"+key, req)
+func (c *Client) PostMetadata(ctx context.Context, req PostMetadataRequest) error {
+	res, err := c.SDK.Request(ctx, http.MethodPost, "/api/v2/workspaceagents/me/metadata", req)
 	if err != nil {
 		return xerrors.Errorf("execute request: %w", err)
 	}
@@ -89,15 +105,23 @@ type Manifest struct {
 	VSCodePortProxyURI       string                                       `json:"vscode_port_proxy_uri"`
 	Apps                     []codersdk.WorkspaceApp                      `json:"apps"`
 	DERPMap                  *tailcfg.DERPMap                             `json:"derpmap"`
+	DERPForceWebSockets      bool                                         `json:"derp_force_websockets"`
 	EnvironmentVariables     map[string]string                            `json:"environment_variables"`
-	StartupScript            string                                       `json:"startup_script"`
-	StartupScriptTimeout     time.Duration                                `json:"startup_script_timeout"`
 	Directory                string                                       `json:"directory"`
 	MOTDFile                 string                                       `json:"motd_file"`
-	ShutdownScript           string                                       `json:"shutdown_script"`
-	ShutdownScriptTimeout    time.Duration                                `json:"shutdown_script_timeout"`
 	DisableDirectConnections bool                                         `json:"disable_direct_connections"`
 	Metadata                 []codersdk.WorkspaceAgentMetadataDescription `json:"metadata"`
+	Scripts                  []codersdk.WorkspaceAgentScript              `json:"scripts"`
+}
+
+type LogSource struct {
+	ID          uuid.UUID `json:"id"`
+	DisplayName string    `json:"display_name"`
+	Icon        string    `json:"icon"`
+}
+
+type Script struct {
+	Script string `json:"script"`
 }
 
 // Manifest fetches manifest for the currently authenticated workspace agent.
@@ -612,9 +636,9 @@ func (c *Client) PostLifecycle(ctx context.Context, req PostLifecycleRequest) er
 }
 
 type PostStartupRequest struct {
-	Version           string                  `json:"version"`
-	ExpandedDirectory string                  `json:"expanded_directory"`
-	Subsystem         codersdk.AgentSubsystem `json:"subsystem"`
+	Version           string                    `json:"version"`
+	ExpandedDirectory string                    `json:"expanded_directory"`
+	Subsystems        []codersdk.AgentSubsystem `json:"subsystems"`
 }
 
 func (c *Client) PostStartup(ctx context.Context, req PostStartupRequest) error {
@@ -630,14 +654,14 @@ func (c *Client) PostStartup(ctx context.Context, req PostStartupRequest) error
 }
 
 type Log struct {
-	CreatedAt time.Time                        `json:"created_at"`
-	Output    string                           `json:"output"`
-	Level     codersdk.LogLevel                `json:"level"`
-	Source    codersdk.WorkspaceAgentLogSource `json:"source"`
+	CreatedAt time.Time         `json:"created_at"`
+	Output    string            `json:"output"`
+	Level     codersdk.LogLevel `json:"level"`
 }
 
 type PatchLogs struct {
-	Logs []Log `json:"logs"`
+	LogSourceID uuid.UUID `json:"log_source_id"`
+	Logs        []Log     `json:"logs"`
 }
 
 // PatchLogs writes log messages to the agent startup script.
@@ -654,6 +678,29 @@ func (c *Client) PatchLogs(ctx context.Context, req PatchLogs) error {
 	return nil
 }
 
+type PostLogSource struct {
+	// ID is a unique identifier for the log source.
+	// It is scoped to a workspace agent, and can be statically
+	// defined inside code to prevent duplicate sources from being
+	// created for the same agent.
+	ID          uuid.UUID `json:"id"`
+	DisplayName string    `json:"display_name"`
+	Icon        string    `json:"icon"`
+}
+
+func (c *Client) PostLogSource(ctx context.Context, req PostLogSource) (codersdk.WorkspaceAgentLogSource, error) {
+	res, err := c.SDK.Request(ctx, http.MethodPost, "/api/v2/workspaceagents/me/log-source", req)
+	if err != nil {
+		return codersdk.WorkspaceAgentLogSource{}, err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusCreated {
+		return codersdk.WorkspaceAgentLogSource{}, codersdk.ReadBodyAsError(res)
+	}
+	var logSource codersdk.WorkspaceAgentLogSource
+	return logSource, json.NewDecoder(res.Body).Decode(&logSource)
+}
+
 // GetServiceBanner relays the service banner config.
 func (c *Client) GetServiceBanner(ctx context.Context) (codersdk.ServiceBannerConfig, error) {
 	res, err := c.SDK.Request(ctx, http.MethodGet, "/api/v2/appearance", nil)
@@ -672,30 +719,52 @@ func (c *Client) GetServiceBanner(ctx context.Context) (codersdk.ServiceBannerCo
 	return cfg.ServiceBanner, json.NewDecoder(res.Body).Decode(&cfg)
 }
 
-type GitAuthResponse struct {
+type ExternalAuthResponse struct {
+	AccessToken string                 `json:"access_token"`
+	TokenExtra  map[string]interface{} `json:"token_extra"`
+	URL         string                 `json:"url"`
+	Type        string                 `json:"type"`
+
+	// Deprecated: Only supported on `/workspaceagents/me/gitauth`
+	// for backwards compatibility.
 	Username string `json:"username"`
 	Password string `json:"password"`
-	URL      string `json:"url"`
 }
 
-// GitAuth submits a URL to fetch a GIT_ASKPASS username and password for.
+// ExternalAuthRequest is used to request an access token for a provider.
+// Either ID or Match must be specified, but not both.
+type ExternalAuthRequest struct {
+	// ID is the ID of a provider to request authentication for.
+	ID string
+	// Match is an arbitrary string matched against the regex of the provider.
+	Match string
+	// Listen indicates that the request should be long-lived and listen for
+	// a new token to be requested.
+	Listen bool
+}
+
+// ExternalAuth submits a URL or provider ID to fetch an access token for.
 // nolint:revive
-func (c *Client) GitAuth(ctx context.Context, gitURL string, listen bool) (GitAuthResponse, error) {
-	reqURL := "/api/v2/workspaceagents/me/gitauth?url=" + url.QueryEscape(gitURL)
-	if listen {
-		reqURL += "&listen"
+func (c *Client) ExternalAuth(ctx context.Context, req ExternalAuthRequest) (ExternalAuthResponse, error) {
+	q := url.Values{
+		"id":    []string{req.ID},
+		"match": []string{req.Match},
+	}
+	if req.Listen {
+		q.Set("listen", "true")
 	}
+	reqURL := "/api/v2/workspaceagents/me/external-auth?" + q.Encode()
 	res, err := c.SDK.Request(ctx, http.MethodGet, reqURL, nil)
 	if err != nil {
-		return GitAuthResponse{}, xerrors.Errorf("execute request: %w", err)
+		return ExternalAuthResponse{}, xerrors.Errorf("execute request: %w", err)
 	}
 	defer res.Body.Close()
 
 	if res.StatusCode != http.StatusOK {
-		return GitAuthResponse{}, codersdk.ReadBodyAsError(res)
+		return ExternalAuthResponse{}, codersdk.ReadBodyAsError(res)
 	}
 
-	var authResp GitAuthResponse
+	var authResp ExternalAuthResponse
 	return authResp, json.NewDecoder(res.Body).Decode(&authResp)
 }
 
diff --git a/codersdk/agentsdk/logs.go b/codersdk/agentsdk/logs.go
index 2eb7d4856f27e..e7b86194cd1cb 100644
--- a/codersdk/agentsdk/logs.go
+++ b/codersdk/agentsdk/logs.go
@@ -10,8 +10,10 @@ import (
 
 	"golang.org/x/xerrors"
 
+	"github.com/google/uuid"
+
 	"cdr.dev/slog"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/retry"
 )
 
@@ -20,7 +22,7 @@ type startupLogsWriter struct {
 	ctx    context.Context
 	send   func(ctx context.Context, log ...Log) error
 	level  codersdk.LogLevel
-	source codersdk.WorkspaceAgentLogSource
+	source uuid.UUID
 }
 
 func (w *startupLogsWriter) Write(p []byte) (int, error) {
@@ -41,10 +43,9 @@ func (w *startupLogsWriter) Write(p []byte) (int, error) {
 			w.buf.Reset()
 		}
 		err := w.send(w.ctx, Log{
-			CreatedAt: time.Now().UTC(), // UTC, like database.Now().
+			CreatedAt: time.Now().UTC(), // UTC, like dbtime.Now().
 			Level:     w.level,
 			Output:    string(partial) + string(p[:nl-cr]),
-			Source:    w.source,
 		})
 		if err != nil {
 			return n - len(p), err
@@ -64,27 +65,23 @@ func (w *startupLogsWriter) Close() error {
 	if w.buf.Len() > 0 {
 		defer w.buf.Reset()
 		return w.send(w.ctx, Log{
-			CreatedAt: time.Now().UTC(), // UTC, like database.Now().
+			CreatedAt: time.Now().UTC(), // UTC, like dbtime.Now().
 			Level:     w.level,
 			Output:    w.buf.String(),
-			Source:    w.source,
 		})
 	}
 	return nil
 }
 
-// StartupLogsWriter returns an io.WriteCloser that sends logs via the
+// LogsWriter returns an io.WriteCloser that sends logs via the
 // provided sender. The sender is expected to be non-blocking. Calling
 // Close flushes any remaining partially written log lines but is
-// otherwise no-op. If the context passed to StartupLogsWriter is
+// otherwise no-op. If the context passed to LogsWriter is
 // canceled, any remaining logs will be discarded.
 //
 // Neither Write nor Close is safe for concurrent use and must be used
 // by a single goroutine.
-func StartupLogsWriter(ctx context.Context, sender func(ctx context.Context, log ...Log) error, source codersdk.WorkspaceAgentLogSource, level codersdk.LogLevel) io.WriteCloser {
-	if source == "" {
-		source = codersdk.WorkspaceAgentLogSourceExternal
-	}
+func LogsWriter(ctx context.Context, sender func(ctx context.Context, log ...Log) error, source uuid.UUID, level codersdk.LogLevel) io.WriteCloser {
 	return &startupLogsWriter{
 		ctx:    ctx,
 		send:   sender,
@@ -93,12 +90,31 @@ func StartupLogsWriter(ctx context.Context, sender func(ctx context.Context, log
 	}
 }
 
+// LogsSenderFlushTimeout changes the default flush timeout (250ms),
+// this is mostly useful for tests.
+func LogsSenderFlushTimeout(timeout time.Duration) func(*logsSenderOptions) {
+	return func(o *logsSenderOptions) {
+		o.flushTimeout = timeout
+	}
+}
+
+type logsSenderOptions struct {
+	flushTimeout time.Duration
+}
+
 // LogsSender will send agent startup logs to the server. Calls to
 // sendLog are non-blocking and will return an error if flushAndClose
 // has been called. Calling sendLog concurrently is not supported. If
 // the context passed to flushAndClose is canceled, any remaining logs
 // will be discarded.
-func LogsSender(patchLogs func(ctx context.Context, req PatchLogs) error, logger slog.Logger) (sendLog func(ctx context.Context, log ...Log) error, flushAndClose func(context.Context) error) {
+func LogsSender(sourceID uuid.UUID, patchLogs func(ctx context.Context, req PatchLogs) error, logger slog.Logger, opts ...func(*logsSenderOptions)) (sendLog func(ctx context.Context, log ...Log) error, flushAndClose func(context.Context) error) {
+	o := logsSenderOptions{
+		flushTimeout: 250 * time.Millisecond,
+	}
+	for _, opt := range opts {
+		opt(&o)
+	}
+
 	// The main context is used to close the sender goroutine and cancel
 	// any outbound requests to the API. The shutdown context is used to
 	// signal the sender goroutine to flush logs and then exit.
@@ -112,10 +128,9 @@ func LogsSender(patchLogs func(ctx context.Context, req PatchLogs) error, logger
 		// Set flushTimeout and backlogLimit so that logs are uploaded
 		// once every 250ms or when 100 logs have been added to the
 		// backlog, whichever comes first.
-		flushTimeout := 250 * time.Millisecond
 		backlogLimit := 100
 
-		flush := time.NewTicker(flushTimeout)
+		flush := time.NewTicker(o.flushTimeout)
 
 		var backlog []Log
 		defer func() {
@@ -156,16 +171,18 @@ func LogsSender(patchLogs func(ctx context.Context, req PatchLogs) error, logger
 				// error occurs. Note that we use the main context here,
 				// meaning these requests won't be interrupted by
 				// shutdown.
+				var err error
 				for r := retry.New(time.Second, 5*time.Second); r.Wait(ctx); {
-					err := patchLogs(ctx, PatchLogs{
-						Logs: backlog,
+					err = patchLogs(ctx, PatchLogs{
+						Logs:        backlog,
+						LogSourceID: sourceID,
 					})
 					if err == nil {
 						break
 					}
 
 					if errors.Is(err, context.Canceled) {
-						return
+						break
 					}
 					// This error is expected to be codersdk.Error, but it has
 					// private fields so we can't fake it in tests.
@@ -173,18 +190,19 @@ func LogsSender(patchLogs func(ctx context.Context, req PatchLogs) error, logger
 					if errors.As(err, &statusErr) {
 						if statusErr.StatusCode() == http.StatusRequestEntityTooLarge {
 							logger.Warn(ctx, "startup logs too large, discarding logs", slog.F("discarded_logs_count", len(backlog)), slog.Error(err))
+							err = nil
 							break
 						}
 					}
 					logger.Error(ctx, "startup logs sender failed to upload logs, retrying later", slog.F("logs_count", len(backlog)), slog.Error(err))
 				}
-				if ctx.Err() != nil {
+				if err != nil {
 					return
 				}
 				backlog = nil
 
 				// Anchor flush to the last log upload.
-				flush.Reset(flushTimeout)
+				flush.Reset(o.flushTimeout)
 			}
 			if done {
 				return
diff --git a/codersdk/agentsdk/logs_test.go b/codersdk/agentsdk/logs_test.go
index 1cca86242e065..e411e6e7213e4 100644
--- a/codersdk/agentsdk/logs_test.go
+++ b/codersdk/agentsdk/logs_test.go
@@ -7,15 +7,16 @@ import (
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/exp/slices"
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestStartupLogsWriter_Write(t *testing.T) {
@@ -39,12 +40,10 @@ func TestStartupLogsWriter_Write(t *testing.T) {
 			ctx:    context.Background(),
 			level:  codersdk.LogLevelInfo,
 			writes: []string{"hello world\n"},
-			source: codersdk.WorkspaceAgentLogSourceShutdownScript,
 			want: []agentsdk.Log{
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "hello world",
-					Source: codersdk.WorkspaceAgentLogSourceShutdownScript,
 				},
 			},
 		},
@@ -57,12 +56,10 @@ func TestStartupLogsWriter_Write(t *testing.T) {
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "hello world",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "goodbye world",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 			},
 		},
@@ -75,32 +72,26 @@ func TestStartupLogsWriter_Write(t *testing.T) {
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "hello world",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "goodbye world",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 			},
 		},
@@ -113,7 +104,6 @@ func TestStartupLogsWriter_Write(t *testing.T) {
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "hello world",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 			},
 		},
@@ -127,12 +117,10 @@ func TestStartupLogsWriter_Write(t *testing.T) {
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "hello world",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "goodbye world",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 			},
 		},
@@ -145,12 +133,10 @@ func TestStartupLogsWriter_Write(t *testing.T) {
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "hello world",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "goodbye world",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 			},
 		},
@@ -163,17 +149,14 @@ func TestStartupLogsWriter_Write(t *testing.T) {
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "hello world",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "\r",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 				{
 					Level:  codersdk.LogLevelInfo,
 					Output: "goodbye world",
-					Source: codersdk.WorkspaceAgentLogSourceExternal,
 				},
 			},
 		},
@@ -201,7 +184,7 @@ func TestStartupLogsWriter_Write(t *testing.T) {
 				got = append(got, log...)
 				return nil
 			}
-			w := agentsdk.StartupLogsWriter(tt.ctx, send, tt.source, tt.level)
+			w := agentsdk.LogsWriter(tt.ctx, send, uuid.New(), tt.level)
 			for _, s := range tt.writes {
 				_, err := w.Write([]byte(s))
 				if err != nil {
@@ -291,7 +274,7 @@ func TestStartupLogsSender(t *testing.T) {
 				return nil
 			}
 
-			sendLog, flushAndClose := agentsdk.LogsSender(patchLogs, slogtest.Make(t, nil).Leveled(slog.LevelDebug))
+			sendLog, flushAndClose := agentsdk.LogsSender(uuid.New(), patchLogs, slogtest.Make(t, nil).Leveled(slog.LevelDebug))
 			defer func() {
 				err := flushAndClose(ctx)
 				require.NoError(t, err)
@@ -330,7 +313,7 @@ func TestStartupLogsSender(t *testing.T) {
 			return nil
 		}
 
-		sendLog, flushAndClose := agentsdk.LogsSender(patchLogs, slogtest.Make(t, nil).Leveled(slog.LevelDebug))
+		sendLog, flushAndClose := agentsdk.LogsSender(uuid.New(), patchLogs, slogtest.Make(t, nil).Leveled(slog.LevelDebug))
 		defer func() {
 			_ = flushAndClose(ctx)
 		}()
@@ -361,7 +344,9 @@ func TestStartupLogsSender(t *testing.T) {
 			return nil
 		}
 
-		sendLog, flushAndClose := agentsdk.LogsSender(patchLogs, slogtest.Make(t, nil).Leveled(slog.LevelDebug))
+		// Prevent race between auto-flush and context cancellation with
+		// a really long timeout.
+		sendLog, flushAndClose := agentsdk.LogsSender(uuid.New(), patchLogs, slogtest.Make(t, nil).Leveled(slog.LevelDebug), agentsdk.LogsSenderFlushTimeout(time.Hour))
 		defer func() {
 			_ = flushAndClose(ctx)
 		}()
diff --git a/codersdk/apikey.go b/codersdk/apikey.go
index 514b519f5ffda..32c97cf538417 100644
--- a/codersdk/apikey.go
+++ b/codersdk/apikey.go
@@ -28,6 +28,7 @@ type APIKey struct {
 type LoginType string
 
 const (
+	LoginTypeUnknown  LoginType = ""
 	LoginTypePassword LoginType = "password"
 	LoginTypeGithub   LoginType = "github"
 	LoginTypeOIDC     LoginType = "oidc"
diff --git a/codersdk/audit.go b/codersdk/audit.go
index 1ff2fb8ac97a1..5ceae81a21c42 100644
--- a/codersdk/audit.go
+++ b/codersdk/audit.go
@@ -24,6 +24,8 @@ const (
 	ResourceTypeGroup           ResourceType = "group"
 	ResourceTypeLicense         ResourceType = "license"
 	ResourceTypeConvertLogin    ResourceType = "convert_login"
+	ResourceTypeWorkspaceProxy  ResourceType = "workspace_proxy"
+	ResourceTypeOrganization    ResourceType = "organization"
 )
 
 func (r ResourceType) FriendlyString() string {
@@ -50,6 +52,10 @@ func (r ResourceType) FriendlyString() string {
 		return "license"
 	case ResourceTypeConvertLogin:
 		return "login type conversion"
+	case ResourceTypeWorkspaceProxy:
+		return "workspace proxy"
+	case ResourceTypeOrganization:
+		return "organization"
 	default:
 		return "unknown"
 	}
diff --git a/codersdk/client.go b/codersdk/client.go
index ad9e46ccf7f4a..965f2653d9e12 100644
--- a/codersdk/client.go
+++ b/codersdk/client.go
@@ -20,7 +20,7 @@ import (
 	"go.opentelemetry.io/otel/semconv/v1.14.0/httpconv"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/tracing"
 
 	"cdr.dev/slog"
 )
@@ -38,15 +38,19 @@ const (
 	// OAuth2RedirectCookie is the name of the cookie that stores the oauth2 redirect.
 	OAuth2RedirectCookie = "oauth_redirect"
 
-	// DevURLSessionTokenCookie is the name of the cookie that stores a devurl
-	// token on app domains.
+	// PathAppSessionTokenCookie is the name of the cookie that stores an
+	// application-scoped API token on workspace proxy path app domains.
 	//nolint:gosec
-	DevURLSessionTokenCookie = "coder_devurl_session_token"
-	// DevURLSignedAppTokenCookie is the name of the cookie that stores a
-	// temporary JWT that can be used to authenticate instead of the session
-	// token.
+	PathAppSessionTokenCookie = "coder_path_app_session_token"
+	// SubdomainAppSessionTokenCookie is the name of the cookie that stores an
+	// application-scoped API token on subdomain app domains (both the primary
+	// and proxies).
 	//nolint:gosec
-	DevURLSignedAppTokenCookie = "coder_devurl_signed_app_token"
+	SubdomainAppSessionTokenCookie = "coder_subdomain_app_session_token"
+	// SignedAppTokenCookie is the name of the cookie that stores a temporary
+	// JWT that can be used to authenticate instead of the app session token.
+	//nolint:gosec
+	SignedAppTokenCookie = "coder_signed_app_token"
 	// SignedAppTokenQueryParameter is the name of the query parameter that
 	// stores a temporary JWT that can be used to authenticate instead of the
 	// session token. This is only acceptable on reconnecting-pty requests, not
@@ -71,6 +75,9 @@ const (
 	// command that was invoked to produce the request. It is for internal use
 	// only.
 	CLITelemetryHeader = "Coder-CLI-Telemetry"
+
+	// ProvisionerDaemonPSK contains the authentication pre-shared key for an external provisioner daemon
+	ProvisionerDaemonPSK = "Coder-Provisioner-Daemon-PSK"
 )
 
 // loggableMimeTypes is a list of MIME types that are safe to log
@@ -352,6 +359,8 @@ func ReadBodyAsError(res *http.Response) error {
 		}
 		return &Error{
 			statusCode: res.StatusCode,
+			method:     requestMethod,
+			url:        requestURL,
 			Response: Response{
 				Message: fmt.Sprintf("unexpected non-JSON response %q", contentType),
 				Detail:  string(resp),
@@ -407,6 +416,14 @@ func (e *Error) StatusCode() int {
 	return e.statusCode
 }
 
+func (e *Error) Method() string {
+	return e.method
+}
+
+func (e *Error) URL() string {
+	return e.url
+}
+
 func (e *Error) Friendly() string {
 	var sb strings.Builder
 	_, _ = fmt.Fprintf(&sb, "%s. %s", strings.TrimSuffix(e.Message, "."), e.Helper)
diff --git a/codersdk/client_internal_test.go b/codersdk/client_internal_test.go
index 60e61c9309afb..ae86ce81ef3b7 100644
--- a/codersdk/client_internal_test.go
+++ b/codersdk/client_internal_test.go
@@ -27,7 +27,7 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/testutil"
 )
 
 const jsonCT = "application/json"
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
index af861138e6d7d..c53ba8d055194 100644
--- a/codersdk/deployment.go
+++ b/codersdk/deployment.go
@@ -16,8 +16,8 @@ import (
 
 	"github.com/coreos/go-oidc/v3/oidc"
 
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/cli/clibase"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/cli/clibase"
 )
 
 // Entitlement represents whether a feature is licensed.
@@ -35,19 +35,22 @@ const (
 type FeatureName string
 
 const (
-	FeatureUserLimit                  FeatureName = "user_limit"
-	FeatureAuditLog                   FeatureName = "audit_log"
-	FeatureBrowserOnly                FeatureName = "browser_only"
-	FeatureSCIM                       FeatureName = "scim"
-	FeatureTemplateRBAC               FeatureName = "template_rbac"
-	FeatureUserRoleManagement         FeatureName = "user_role_management"
-	FeatureHighAvailability           FeatureName = "high_availability"
-	FeatureMultipleGitAuth            FeatureName = "multiple_git_auth"
-	FeatureExternalProvisionerDaemons FeatureName = "external_provisioner_daemons"
-	FeatureAppearance                 FeatureName = "appearance"
-	FeatureAdvancedTemplateScheduling FeatureName = "advanced_template_scheduling"
-	FeatureTemplateRestartRequirement FeatureName = "template_restart_requirement"
-	FeatureWorkspaceProxy             FeatureName = "workspace_proxy"
+	FeatureUserLimit                   FeatureName = "user_limit"
+	FeatureAuditLog                    FeatureName = "audit_log"
+	FeatureBrowserOnly                 FeatureName = "browser_only"
+	FeatureSCIM                        FeatureName = "scim"
+	FeatureTemplateRBAC                FeatureName = "template_rbac"
+	FeatureUserRoleManagement          FeatureName = "user_role_management"
+	FeatureHighAvailability            FeatureName = "high_availability"
+	FeatureMultipleExternalAuth        FeatureName = "multiple_external_auth"
+	FeatureExternalProvisionerDaemons  FeatureName = "external_provisioner_daemons"
+	FeatureAppearance                  FeatureName = "appearance"
+	FeatureAdvancedTemplateScheduling  FeatureName = "advanced_template_scheduling"
+	FeatureWorkspaceProxy              FeatureName = "workspace_proxy"
+	FeatureExternalTokenEncryption     FeatureName = "external_token_encryption"
+	FeatureTemplateAutostopRequirement FeatureName = "template_autostop_requirement"
+	FeatureWorkspaceBatchActions       FeatureName = "workspace_batch_actions"
+	FeatureAccessControl               FeatureName = "access_control"
 )
 
 // FeatureNames must be kept in-sync with the Feature enum above.
@@ -58,12 +61,17 @@ var FeatureNames = []FeatureName{
 	FeatureSCIM,
 	FeatureTemplateRBAC,
 	FeatureHighAvailability,
-	FeatureMultipleGitAuth,
+	FeatureMultipleExternalAuth,
 	FeatureExternalProvisionerDaemons,
 	FeatureAppearance,
 	FeatureAdvancedTemplateScheduling,
+	FeatureTemplateAutostopRequirement,
 	FeatureWorkspaceProxy,
 	FeatureUserRoleManagement,
+	FeatureExternalTokenEncryption,
+	FeatureTemplateAutostopRequirement,
+	FeatureWorkspaceBatchActions,
+	FeatureAccessControl,
 }
 
 // Humanize returns the feature name in a human-readable format.
@@ -83,9 +91,10 @@ func (n FeatureName) Humanize() string {
 // This method may disappear at any time.
 func (n FeatureName) AlwaysEnable() bool {
 	return map[FeatureName]bool{
-		FeatureMultipleGitAuth:            true,
+		FeatureMultipleExternalAuth:       true,
 		FeatureExternalProvisionerDaemons: true,
 		FeatureAppearance:                 true,
+		FeatureWorkspaceBatchActions:      true,
 	}[n]
 }
 
@@ -103,6 +112,7 @@ type Entitlements struct {
 	HasLicense       bool                    `json:"has_license"`
 	Trial            bool                    `json:"trial"`
 	RequireTelemetry bool                    `json:"require_telemetry"`
+	RefreshedAt      time.Time               `json:"refreshed_at" format:"date-time"`
 }
 
 func (c *Client) Entitlements(ctx context.Context) (Entitlements, error) {
@@ -126,51 +136,53 @@ type DeploymentValues struct {
 	DocsURL             clibase.URL  `json:"docs_url,omitempty"`
 	RedirectToAccessURL clibase.Bool `json:"redirect_to_access_url,omitempty"`
 	// HTTPAddress is a string because it may be set to zero to disable.
-	HTTPAddress                     clibase.String                  `json:"http_address,omitempty" typescript:",notnull"`
-	AutobuildPollInterval           clibase.Duration                `json:"autobuild_poll_interval,omitempty"`
-	JobHangDetectorInterval         clibase.Duration                `json:"job_hang_detector_interval,omitempty"`
-	DERP                            DERP                            `json:"derp,omitempty" typescript:",notnull"`
-	Prometheus                      PrometheusConfig                `json:"prometheus,omitempty" typescript:",notnull"`
-	Pprof                           PprofConfig                     `json:"pprof,omitempty" typescript:",notnull"`
-	ProxyTrustedHeaders             clibase.StringArray             `json:"proxy_trusted_headers,omitempty" typescript:",notnull"`
-	ProxyTrustedOrigins             clibase.StringArray             `json:"proxy_trusted_origins,omitempty" typescript:",notnull"`
-	CacheDir                        clibase.String                  `json:"cache_directory,omitempty" typescript:",notnull"`
-	InMemoryDatabase                clibase.Bool                    `json:"in_memory_database,omitempty" typescript:",notnull"`
-	PostgresURL                     clibase.String                  `json:"pg_connection_url,omitempty" typescript:",notnull"`
-	OAuth2                          OAuth2Config                    `json:"oauth2,omitempty" typescript:",notnull"`
-	OIDC                            OIDCConfig                      `json:"oidc,omitempty" typescript:",notnull"`
-	Telemetry                       TelemetryConfig                 `json:"telemetry,omitempty" typescript:",notnull"`
-	TLS                             TLSConfig                       `json:"tls,omitempty" typescript:",notnull"`
-	Trace                           TraceConfig                     `json:"trace,omitempty" typescript:",notnull"`
-	SecureAuthCookie                clibase.Bool                    `json:"secure_auth_cookie,omitempty" typescript:",notnull"`
-	StrictTransportSecurity         clibase.Int64                   `json:"strict_transport_security,omitempty" typescript:",notnull"`
-	StrictTransportSecurityOptions  clibase.StringArray             `json:"strict_transport_security_options,omitempty" typescript:",notnull"`
-	SSHKeygenAlgorithm              clibase.String                  `json:"ssh_keygen_algorithm,omitempty" typescript:",notnull"`
-	MetricsCacheRefreshInterval     clibase.Duration                `json:"metrics_cache_refresh_interval,omitempty" typescript:",notnull"`
-	AgentStatRefreshInterval        clibase.Duration                `json:"agent_stat_refresh_interval,omitempty" typescript:",notnull"`
-	AgentFallbackTroubleshootingURL clibase.URL                     `json:"agent_fallback_troubleshooting_url,omitempty" typescript:",notnull"`
-	BrowserOnly                     clibase.Bool                    `json:"browser_only,omitempty" typescript:",notnull"`
-	SCIMAPIKey                      clibase.String                  `json:"scim_api_key,omitempty" typescript:",notnull"`
-	Provisioner                     ProvisionerConfig               `json:"provisioner,omitempty" typescript:",notnull"`
-	RateLimit                       RateLimitConfig                 `json:"rate_limit,omitempty" typescript:",notnull"`
-	Experiments                     clibase.StringArray             `json:"experiments,omitempty" typescript:",notnull"`
-	UpdateCheck                     clibase.Bool                    `json:"update_check,omitempty" typescript:",notnull"`
-	MaxTokenLifetime                clibase.Duration                `json:"max_token_lifetime,omitempty" typescript:",notnull"`
-	Swagger                         SwaggerConfig                   `json:"swagger,omitempty" typescript:",notnull"`
-	Logging                         LoggingConfig                   `json:"logging,omitempty" typescript:",notnull"`
-	Dangerous                       DangerousConfig                 `json:"dangerous,omitempty" typescript:",notnull"`
-	DisablePathApps                 clibase.Bool                    `json:"disable_path_apps,omitempty" typescript:",notnull"`
-	SessionDuration                 clibase.Duration                `json:"max_session_expiry,omitempty" typescript:",notnull"`
-	DisableSessionExpiryRefresh     clibase.Bool                    `json:"disable_session_expiry_refresh,omitempty" typescript:",notnull"`
-	DisablePasswordAuth             clibase.Bool                    `json:"disable_password_auth,omitempty" typescript:",notnull"`
-	Support                         SupportConfig                   `json:"support,omitempty" typescript:",notnull"`
-	GitAuthProviders                clibase.Struct[[]GitAuthConfig] `json:"git_auth,omitempty" typescript:",notnull"`
-	SSHConfig                       SSHConfig                       `json:"config_ssh,omitempty" typescript:",notnull"`
-	WgtunnelHost                    clibase.String                  `json:"wgtunnel_host,omitempty" typescript:",notnull"`
-	DisableOwnerWorkspaceExec       clibase.Bool                    `json:"disable_owner_workspace_exec,omitempty" typescript:",notnull"`
-	ProxyHealthStatusInterval       clibase.Duration                `json:"proxy_health_status_interval,omitempty" typescript:",notnull"`
-	EnableTerraformDebugMode        clibase.Bool                    `json:"enable_terraform_debug_mode,omitempty" typescript:",notnull"`
-	UserQuietHoursSchedule          UserQuietHoursScheduleConfig    `json:"user_quiet_hours_schedule,omitempty" typescript:",notnull"`
+	HTTPAddress                     clibase.String                       `json:"http_address,omitempty" typescript:",notnull"`
+	AutobuildPollInterval           clibase.Duration                     `json:"autobuild_poll_interval,omitempty"`
+	JobHangDetectorInterval         clibase.Duration                     `json:"job_hang_detector_interval,omitempty"`
+	DERP                            DERP                                 `json:"derp,omitempty" typescript:",notnull"`
+	Prometheus                      PrometheusConfig                     `json:"prometheus,omitempty" typescript:",notnull"`
+	Pprof                           PprofConfig                          `json:"pprof,omitempty" typescript:",notnull"`
+	ProxyTrustedHeaders             clibase.StringArray                  `json:"proxy_trusted_headers,omitempty" typescript:",notnull"`
+	ProxyTrustedOrigins             clibase.StringArray                  `json:"proxy_trusted_origins,omitempty" typescript:",notnull"`
+	CacheDir                        clibase.String                       `json:"cache_directory,omitempty" typescript:",notnull"`
+	InMemoryDatabase                clibase.Bool                         `json:"in_memory_database,omitempty" typescript:",notnull"`
+	PostgresURL                     clibase.String                       `json:"pg_connection_url,omitempty" typescript:",notnull"`
+	OAuth2                          OAuth2Config                         `json:"oauth2,omitempty" typescript:",notnull"`
+	OIDC                            OIDCConfig                           `json:"oidc,omitempty" typescript:",notnull"`
+	Telemetry                       TelemetryConfig                      `json:"telemetry,omitempty" typescript:",notnull"`
+	TLS                             TLSConfig                            `json:"tls,omitempty" typescript:",notnull"`
+	Trace                           TraceConfig                          `json:"trace,omitempty" typescript:",notnull"`
+	SecureAuthCookie                clibase.Bool                         `json:"secure_auth_cookie,omitempty" typescript:",notnull"`
+	StrictTransportSecurity         clibase.Int64                        `json:"strict_transport_security,omitempty" typescript:",notnull"`
+	StrictTransportSecurityOptions  clibase.StringArray                  `json:"strict_transport_security_options,omitempty" typescript:",notnull"`
+	SSHKeygenAlgorithm              clibase.String                       `json:"ssh_keygen_algorithm,omitempty" typescript:",notnull"`
+	MetricsCacheRefreshInterval     clibase.Duration                     `json:"metrics_cache_refresh_interval,omitempty" typescript:",notnull"`
+	AgentStatRefreshInterval        clibase.Duration                     `json:"agent_stat_refresh_interval,omitempty" typescript:",notnull"`
+	AgentFallbackTroubleshootingURL clibase.URL                          `json:"agent_fallback_troubleshooting_url,omitempty" typescript:",notnull"`
+	BrowserOnly                     clibase.Bool                         `json:"browser_only,omitempty" typescript:",notnull"`
+	SCIMAPIKey                      clibase.String                       `json:"scim_api_key,omitempty" typescript:",notnull"`
+	ExternalTokenEncryptionKeys     clibase.StringArray                  `json:"external_token_encryption_keys,omitempty" typescript:",notnull"`
+	Provisioner                     ProvisionerConfig                    `json:"provisioner,omitempty" typescript:",notnull"`
+	RateLimit                       RateLimitConfig                      `json:"rate_limit,omitempty" typescript:",notnull"`
+	Experiments                     clibase.StringArray                  `json:"experiments,omitempty" typescript:",notnull"`
+	UpdateCheck                     clibase.Bool                         `json:"update_check,omitempty" typescript:",notnull"`
+	MaxTokenLifetime                clibase.Duration                     `json:"max_token_lifetime,omitempty" typescript:",notnull"`
+	Swagger                         SwaggerConfig                        `json:"swagger,omitempty" typescript:",notnull"`
+	Logging                         LoggingConfig                        `json:"logging,omitempty" typescript:",notnull"`
+	Dangerous                       DangerousConfig                      `json:"dangerous,omitempty" typescript:",notnull"`
+	DisablePathApps                 clibase.Bool                         `json:"disable_path_apps,omitempty" typescript:",notnull"`
+	SessionDuration                 clibase.Duration                     `json:"max_session_expiry,omitempty" typescript:",notnull"`
+	DisableSessionExpiryRefresh     clibase.Bool                         `json:"disable_session_expiry_refresh,omitempty" typescript:",notnull"`
+	DisablePasswordAuth             clibase.Bool                         `json:"disable_password_auth,omitempty" typescript:",notnull"`
+	Support                         SupportConfig                        `json:"support,omitempty" typescript:",notnull"`
+	ExternalAuthConfigs             clibase.Struct[[]ExternalAuthConfig] `json:"external_auth,omitempty" typescript:",notnull"`
+	SSHConfig                       SSHConfig                            `json:"config_ssh,omitempty" typescript:",notnull"`
+	WgtunnelHost                    clibase.String                       `json:"wgtunnel_host,omitempty" typescript:",notnull"`
+	DisableOwnerWorkspaceExec       clibase.Bool                         `json:"disable_owner_workspace_exec,omitempty" typescript:",notnull"`
+	ProxyHealthStatusInterval       clibase.Duration                     `json:"proxy_health_status_interval,omitempty" typescript:",notnull"`
+	EnableTerraformDebugMode        clibase.Bool                         `json:"enable_terraform_debug_mode,omitempty" typescript:",notnull"`
+	UserQuietHoursSchedule          UserQuietHoursScheduleConfig         `json:"user_quiet_hours_schedule,omitempty" typescript:",notnull"`
+	WebTerminalRenderer             clibase.String                       `json:"web_terminal_renderer,omitempty" typescript:",notnull"`
 
 	Config      clibase.YAMLConfigPath `json:"config,omitempty" typescript:",notnull"`
 	WriteConfig clibase.Bool           `json:"write_config,omitempty" typescript:",notnull"`
@@ -228,9 +240,10 @@ type DERPServerConfig struct {
 }
 
 type DERPConfig struct {
-	BlockDirect clibase.Bool   `json:"block_direct" typescript:",notnull"`
-	URL         clibase.String `json:"url" typescript:",notnull"`
-	Path        clibase.String `json:"path" typescript:",notnull"`
+	BlockDirect     clibase.Bool   `json:"block_direct" typescript:",notnull"`
+	ForceWebSockets clibase.Bool   `json:"force_websockets" typescript:",notnull"`
+	URL             clibase.String `json:"url" typescript:",notnull"`
+	Path            clibase.String `json:"path" typescript:",notnull"`
 }
 
 type PrometheusConfig struct {
@@ -260,9 +273,12 @@ type OAuth2GithubConfig struct {
 }
 
 type OIDCConfig struct {
-	AllowSignups        clibase.Bool                        `json:"allow_signups" typescript:",notnull"`
-	ClientID            clibase.String                      `json:"client_id" typescript:",notnull"`
-	ClientSecret        clibase.String                      `json:"client_secret" typescript:",notnull"`
+	AllowSignups clibase.Bool   `json:"allow_signups" typescript:",notnull"`
+	ClientID     clibase.String `json:"client_id" typescript:",notnull"`
+	ClientSecret clibase.String `json:"client_secret" typescript:",notnull"`
+	// ClientKeyFile & ClientCertFile are used in place of ClientSecret for PKI auth.
+	ClientKeyFile       clibase.String                      `json:"client_key_file" typescript:",notnull"`
+	ClientCertFile      clibase.String                      `json:"client_cert_file" typescript:",notnull"`
 	EmailDomain         clibase.StringArray                 `json:"email_domain" typescript:",notnull"`
 	IssuerURL           clibase.String                      `json:"issuer_url" typescript:",notnull"`
 	Scopes              clibase.StringArray                 `json:"scopes" typescript:",notnull"`
@@ -271,6 +287,8 @@ type OIDCConfig struct {
 	EmailField          clibase.String                      `json:"email_field" typescript:",notnull"`
 	AuthURLParams       clibase.Struct[map[string]string]   `json:"auth_url_params" typescript:",notnull"`
 	IgnoreUserInfo      clibase.Bool                        `json:"ignore_user_info" typescript:",notnull"`
+	GroupAutoCreate     clibase.Bool                        `json:"group_auto_create" typescript:",notnull"`
+	GroupRegexFilter    clibase.Regexp                      `json:"group_regex_filter" typescript:",notnull"`
 	GroupField          clibase.String                      `json:"groups_field" typescript:",notnull"`
 	GroupMapping        clibase.Struct[map[string]string]   `json:"group_mapping" typescript:",notnull"`
 	UserRoleField       clibase.String                      `json:"user_role_field" typescript:",notnull"`
@@ -303,23 +321,38 @@ type TraceConfig struct {
 	Enable          clibase.Bool   `json:"enable" typescript:",notnull"`
 	HoneycombAPIKey clibase.String `json:"honeycomb_api_key" typescript:",notnull"`
 	CaptureLogs     clibase.Bool   `json:"capture_logs" typescript:",notnull"`
+	DataDog         clibase.Bool   `json:"data_dog" typescript:",notnull"`
 }
 
-type GitAuthConfig struct {
+type ExternalAuthConfig struct {
+	// Type is the type of external auth config.
+	Type         string `json:"type"`
+	ClientID     string `json:"client_id"`
+	ClientSecret string `json:"-" yaml:"client_secret"`
+	// ID is a unique identifier for the auth config.
+	// It defaults to `type` when not provided.
 	ID                  string   `json:"id"`
-	Type                string   `json:"type"`
-	ClientID            string   `json:"client_id"`
-	ClientSecret        string   `json:"-" yaml:"client_secret"`
 	AuthURL             string   `json:"auth_url"`
 	TokenURL            string   `json:"token_url"`
 	ValidateURL         string   `json:"validate_url"`
 	AppInstallURL       string   `json:"app_install_url"`
 	AppInstallationsURL string   `json:"app_installations_url"`
-	Regex               string   `json:"regex"`
 	NoRefresh           bool     `json:"no_refresh"`
 	Scopes              []string `json:"scopes"`
+	ExtraTokenKeys      []string `json:"extra_token_keys"`
 	DeviceFlow          bool     `json:"device_flow"`
 	DeviceCodeURL       string   `json:"device_code_url"`
+	// Regex allows API requesters to match an auth config by
+	// a string (e.g. coder.com) instead of by it's type.
+	//
+	// Git clone makes use of this by parsing the URL from:
+	// 'Username for "https://github.com":'
+	// And sending it to the Coder server to match against the Regex.
+	Regex string `json:"regex"`
+	// DisplayName is shown in the UI to identify the auth config.
+	DisplayName string `json:"display_name"`
+	// DisplayIcon is a URL to an icon to display in the UI.
+	DisplayIcon string `json:"display_icon"`
 }
 
 type ProvisionerConfig struct {
@@ -328,6 +361,7 @@ type ProvisionerConfig struct {
 	DaemonPollInterval  clibase.Duration `json:"daemon_poll_interval" typescript:",notnull"`
 	DaemonPollJitter    clibase.Duration `json:"daemon_poll_jitter" typescript:",notnull"`
 	ForceCancelInterval clibase.Duration `json:"force_cancel_interval" typescript:",notnull"`
+	DaemonPSK           clibase.String   `json:"daemon_psk" typescript:",notnull"`
 }
 
 type RateLimitConfig struct {
@@ -394,9 +428,6 @@ func DefaultCacheDir() string {
 }
 
 // DeploymentConfig contains both the deployment values and how they're set.
-//
-// @typescript-ignore DeploymentConfig
-// apitypings doesn't know how to generate the OptionSet... yet.
 type DeploymentConfig struct {
 	Values  *DeploymentValues `json:"config,omitempty"`
 	Options clibase.OptionSet `json:"options,omitempty"`
@@ -730,6 +761,7 @@ when required by your organization's security policy.`,
 			Value:       &c.DERP.Server.RegionID,
 			Group:       &deploymentGroupNetworkingDERP,
 			YAML:        "regionID",
+			Hidden:      true,
 			// Does not apply to external proxies as this value is generated.
 		},
 		{
@@ -741,6 +773,7 @@ when required by your organization's security policy.`,
 			Value:       &c.DERP.Server.RegionCode,
 			Group:       &deploymentGroupNetworkingDERP,
 			YAML:        "regionCode",
+			Hidden:      true,
 			// Does not apply to external proxies as we use the proxy name.
 		},
 		{
@@ -756,10 +789,10 @@ when required by your organization's security policy.`,
 		},
 		{
 			Name:        "DERP Server STUN Addresses",
-			Description: "Addresses for STUN servers to establish P2P connections. Use special value 'disable' to turn off STUN.",
+			Description: "Addresses for STUN servers to establish P2P connections. It's recommended to have at least two STUN servers to give users the best chance of connecting P2P to workspaces. Each STUN server will get it's own DERP region, with region IDs starting at `--derp-server-region-id + 1`. Use special value 'disable' to turn off STUN completely.",
 			Flag:        "derp-server-stun-addresses",
 			Env:         "CODER_DERP_SERVER_STUN_ADDRESSES",
-			Default:     "stun.l.google.com:19302",
+			Default:     "stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302,stun3.l.google.com:19302,stun4.l.google.com:19302",
 			Value:       &c.DERP.Server.STUNAddresses,
 			Group:       &deploymentGroupNetworkingDERP,
 			YAML:        "stunAddresses",
@@ -788,6 +821,15 @@ when required by your organization's security policy.`,
 			Group: &deploymentGroupNetworkingDERP,
 			YAML:  "blockDirect",
 		},
+		{
+			Name:        "DERP Force WebSockets",
+			Description: "Force clients and agents to always use WebSocket to connect to DERP relay servers. By default, DERP uses `Upgrade: derp`, which may cause issues with some reverse proxies. Clients may automatically fallback to WebSocket if they detect an issue with `Upgrade: derp`, but this does not work in all situations.",
+			Flag:        "derp-force-websockets",
+			Env:         "CODER_DERP_FORCE_WEBSOCKETS",
+			Value:       &c.DERP.Config.ForceWebSockets,
+			Group:       &deploymentGroupNetworkingDERP,
+			YAML:        "forceWebSockets",
+		},
 		{
 			Name:        "DERP Config URL",
 			Description: "URL to fetch a DERP mapping on startup. See: https://tailscale.com/kb/1118/custom-derp-servers/.",
@@ -963,6 +1005,26 @@ when required by your organization's security policy.`,
 			Value:       &c.OIDC.ClientSecret,
 			Group:       &deploymentGroupOIDC,
 		},
+		{
+			Name: "OIDC Client Key File",
+			Description: "Pem encoded RSA private key to use for oauth2 PKI/JWT authorization. " +
+				"This can be used instead of oidc-client-secret if your IDP supports it.",
+			Flag:  "oidc-client-key-file",
+			Env:   "CODER_OIDC_CLIENT_KEY_FILE",
+			YAML:  "oidcClientKeyFile",
+			Value: &c.OIDC.ClientKeyFile,
+			Group: &deploymentGroupOIDC,
+		},
+		{
+			Name: "OIDC Client Cert File",
+			Description: "Pem encoded certificate file to use for oauth2 PKI/JWT authorization. " +
+				"The public certificate that accompanies oidc-client-key-file. A standard x509 certificate is expected.",
+			Flag:  "oidc-client-cert-file",
+			Env:   "CODER_OIDC_CLIENT_CERT_FILE",
+			YAML:  "oidcClientCertFile",
+			Value: &c.OIDC.ClientCertFile,
+			Group: &deploymentGroupOIDC,
+		},
 		{
 			Name:        "OIDC Email Domain",
 			Description: "Email domains that clients logging in with OIDC must match.",
@@ -1065,6 +1127,26 @@ when required by your organization's security policy.`,
 			Group:       &deploymentGroupOIDC,
 			YAML:        "groupMapping",
 		},
+		{
+			Name:        "Enable OIDC Group Auto Create",
+			Description: "Automatically creates missing groups from a user's groups claim.",
+			Flag:        "oidc-group-auto-create",
+			Env:         "CODER_OIDC_GROUP_AUTO_CREATE",
+			Default:     "false",
+			Value:       &c.OIDC.GroupAutoCreate,
+			Group:       &deploymentGroupOIDC,
+			YAML:        "enableGroupAutoCreate",
+		},
+		{
+			Name:        "OIDC Regex Group Filter",
+			Description: "If provided any group name not matching the regex is ignored. This allows for filtering out groups that are not needed. This filter is applied after the group mapping.",
+			Flag:        "oidc-group-regex-filter",
+			Env:         "CODER_OIDC_GROUP_REGEX_FILTER",
+			Default:     ".*",
+			Value:       &c.OIDC.GroupRegexFilter,
+			Group:       &deploymentGroupOIDC,
+			YAML:        "groupRegexFilter",
+		},
 		{
 			Name:        "OIDC User Role Field",
 			Description: "This field must be set if using the user roles sync feature. Set this to the name of the claim used to store the user's role. The roles should be sent as an array of strings.",
@@ -1109,7 +1191,7 @@ when required by your organization's security policy.`,
 		},
 		{
 			Name:        "OpenID connect icon URL",
-			Description: "URL pointing to the icon to use on the OepnID Connect login button.",
+			Description: "URL pointing to the icon to use on the OpenID Connect login button.",
 			Flag:        "oidc-icon-url",
 			Env:         "CODER_OIDC_ICON_URL",
 			Value:       &c.OIDC.IconURL,
@@ -1127,16 +1209,6 @@ when required by your organization's security policy.`,
 			Group:       &deploymentGroupTelemetry,
 			YAML:        "enable",
 		},
-		{
-			Name:        "Telemetry Trace",
-			Description: "Whether Opentelemetry traces are sent to Coder. Coder collects anonymized application tracing to help improve our product. Disabling telemetry also disables this option.",
-			Flag:        "telemetry-trace",
-			Env:         "CODER_TELEMETRY_TRACE",
-			Default:     strconv.FormatBool(flag.Lookup("test.v") == nil),
-			Value:       &c.Telemetry.Trace,
-			Group:       &deploymentGroupTelemetry,
-			YAML:        "trace",
-		},
 		{
 			Name:        "Telemetry URL",
 			Description: "URL to send telemetry.",
@@ -1178,6 +1250,22 @@ when required by your organization's security policy.`,
 			YAML:        "captureLogs",
 			Annotations: clibase.Annotations{}.Mark(annotationExternalProxies, "true"),
 		},
+		{
+			Name:        "Send Go runtime traces to DataDog",
+			Description: "Enables sending Go runtime traces to the local DataDog agent.",
+			Flag:        "trace-datadog",
+			Env:         "CODER_TRACE_DATADOG",
+			Value:       &c.Trace.DataDog,
+			Group:       &deploymentGroupIntrospectionTracing,
+			YAML:        "dataDog",
+			// Hidden until an external user asks for it. For the time being,
+			// it's used to detect leaks in dogfood.
+			Hidden: true,
+			// Default is false because datadog creates a bunch of goroutines that
+			// don't get cleaned up and trip the leak detector.
+			Default:     "false",
+			Annotations: clibase.Annotations{}.Mark(annotationExternalProxies, "true"),
+		},
 		// Provisioner settings
 		{
 			Name:        "Provisioner Daemons",
@@ -1202,7 +1290,7 @@ when required by your organization's security policy.`,
 		},
 		{
 			Name:        "Poll Interval",
-			Description: "Time to wait before polling for a new job.",
+			Description: "Deprecated and ignored.",
 			Flag:        "provisioner-daemon-poll-interval",
 			Env:         "CODER_PROVISIONER_DAEMON_POLL_INTERVAL",
 			Default:     time.Second.String(),
@@ -1212,7 +1300,7 @@ when required by your organization's security policy.`,
 		},
 		{
 			Name:        "Poll Jitter",
-			Description: "Random jitter added to the poll interval.",
+			Description: "Deprecated and ignored.",
 			Flag:        "provisioner-daemon-poll-jitter",
 			Env:         "CODER_PROVISIONER_DAEMON_POLL_JITTER",
 			Default:     (100 * time.Millisecond).String(),
@@ -1230,6 +1318,15 @@ when required by your organization's security policy.`,
 			Group:       &deploymentGroupProvisioning,
 			YAML:        "forceCancelInterval",
 		},
+		{
+			Name:        "Provisioner Daemon Pre-shared Key (PSK)",
+			Description: "Pre-shared key to authenticate external provisioner daemons to Coder server.",
+			Flag:        "provisioner-daemon-psk",
+			Env:         "CODER_PROVISIONER_DAEMON_PSK",
+			Value:       &c.Provisioner.DaemonPSK,
+			Group:       &deploymentGroupProvisioning,
+			YAML:        "daemonPSK",
+		},
 		// RateLimit settings
 		{
 			Name:        "Disable All Rate Limits",
@@ -1518,7 +1615,14 @@ when required by your organization's security policy.`,
 			Annotations: clibase.Annotations{}.Mark(annotationEnterpriseKey, "true").Mark(annotationSecretKey, "true"),
 			Value:       &c.SCIMAPIKey,
 		},
-
+		{
+			Name:        "External Token Encryption Keys",
+			Description: "Encrypt OIDC and Git authentication tokens with AES-256-GCM in the database. The value must be a comma-separated list of base64-encoded keys. Each key, when base64-decoded, must be exactly 32 bytes in length. The first key will be used to encrypt new values. Subsequent keys will be used as a fallback when decrypting. During normal operation it is recommended to only set one key unless you are in the process of rotating keys with the `coder server dbcrypt rotate` command.",
+			Flag:        "external-token-encryption-keys",
+			Env:         "CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS",
+			Annotations: clibase.Annotations{}.Mark(annotationEnterpriseKey, "true").Mark(annotationSecretKey, "true"),
+			Value:       &c.ExternalTokenEncryptionKeys,
+		},
 		{
 			Name:        "Disable Path Apps",
 			Description: "Disable workspace apps that are not served from subdomains. Path-based apps can make requests to the Coder API and pose a security risk when the workspace serves malicious JavaScript. This is recommended for security purposes if a --wildcard-access-url is configured.",
@@ -1623,12 +1727,12 @@ Write out the current server config as YAML to stdout.`,
 		},
 		{
 			// Env handling is done in cli.ReadGitAuthFromEnvironment
-			Name:        "Git Auth Providers",
-			Description: "Git Authentication providers.",
+			Name:        "External Auth Providers",
+			Description: "External Authentication providers.",
 			// We need extra scrutiny to ensure this works, is documented, and
 			// tested before enabling.
 			// YAML:        "gitAuthProviders",
-			Value:  &c.GitAuthProviders,
+			Value:  &c.ExternalAuthConfigs,
 			Hidden: true,
 		},
 		{
@@ -1661,7 +1765,18 @@ Write out the current server config as YAML to stdout.`,
 			Group:       &deploymentGroupUserQuietHoursSchedule,
 			YAML:        "defaultQuietHoursSchedule",
 		},
+		{
+			Name:        "Web Terminal Renderer",
+			Description: "The renderer to use when opening a web terminal. Valid values are 'canvas', 'webgl', or 'dom'.",
+			Flag:        "web-terminal-renderer",
+			Env:         "CODER_WEB_TERMINAL_RENDERER",
+			Default:     "canvas",
+			Value:       &c.WebTerminalRenderer,
+			Group:       &deploymentGroupClient,
+			YAML:        "webTerminalRenderer",
+		},
 	}
+
 	return opts
 }
 
@@ -1675,6 +1790,19 @@ type LinkConfig struct {
 	Icon   string `json:"icon" yaml:"icon"`
 }
 
+// DeploymentOptionsWithoutSecrets returns a copy of the OptionSet with secret values omitted.
+func DeploymentOptionsWithoutSecrets(set clibase.OptionSet) clibase.OptionSet {
+	cpy := make(clibase.OptionSet, 0, len(set))
+	for _, opt := range set {
+		cpyOpt := opt
+		if IsSecretDeploymentOption(cpyOpt) {
+			cpyOpt.Value = nil
+		}
+		cpy = append(cpy, cpyOpt)
+	}
+	return cpy
+}
+
 // WithoutSecrets returns a copy of the config without secret values.
 func (c *DeploymentValues) WithoutSecrets() (*DeploymentValues, error) {
 	var ff DeploymentValues
@@ -1696,7 +1824,7 @@ func (c *DeploymentValues) WithoutSecrets() (*DeploymentValues, error) {
 
 		// This only works with string values for now.
 		switch v := opt.Value.(type) {
-		case *clibase.String:
+		case *clibase.String, *clibase.StringArray:
 			err := v.Set("")
 			if err != nil {
 				panic(err)
@@ -1745,14 +1873,16 @@ func (c *Client) DeploymentStats(ctx context.Context) (DeploymentStats, error) {
 }
 
 type AppearanceConfig struct {
-	LogoURL       string              `json:"logo_url"`
-	ServiceBanner ServiceBannerConfig `json:"service_banner"`
-	SupportLinks  []LinkConfig        `json:"support_links,omitempty"`
+	ApplicationName string              `json:"application_name"`
+	LogoURL         string              `json:"logo_url"`
+	ServiceBanner   ServiceBannerConfig `json:"service_banner"`
+	SupportLinks    []LinkConfig        `json:"support_links,omitempty"`
 }
 
 type UpdateAppearanceConfig struct {
-	LogoURL       string              `json:"logo_url"`
-	ServiceBanner ServiceBannerConfig `json:"service_banner"`
+	ApplicationName string              `json:"application_name"`
+	LogoURL         string              `json:"logo_url"`
+	ServiceBanner   ServiceBannerConfig `json:"service_banner"`
 }
 
 type ServiceBannerConfig struct {
@@ -1853,24 +1983,29 @@ const (
 	// ExperimentSingleTailnet replaces workspace connections inside coderd to
 	// all use a single tailnet, instead of the previous behavior of creating a
 	// single tailnet for each agent.
-	// WARNING: This cannot be enabled when using HA.
 	ExperimentSingleTailnet Experiment = "single_tailnet"
 
-	// ExperimentTemplateRestartRequirement allows template admins to have more
+	// ExperimentTemplateAutostopRequirement allows template admins to have more
 	// control over when workspaces created on a template are required to
-	// restart, and allows users to ensure these restarts never happen during
-	// their business hours.
+	// stop, and allows users to ensure these restarts never happen during their
+	// business hours.
+	//
+	// This will replace the MaxTTL setting on templates.
 	//
 	// Enables:
 	// - User quiet hours schedule settings
-	// - Template restart requirement settings
-	// - Changes the max_deadline algorithm to use restart requirement and user
+	// - Template autostop requirement settings
+	// - Changes the max_deadline algorithm to use autostop requirement and user
 	//   quiet hours instead of max_ttl.
-	ExperimentTemplateRestartRequirement Experiment = "template_restart_requirement"
+	ExperimentTemplateAutostopRequirement Experiment = "template_autostop_requirement"
 
 	// Deployment health page
 	ExperimentDeploymentHealthPage Experiment = "deployment_health_page"
 
+	// ExperimentDashboardTheme mutates the dashboard to use a new, dark color scheme.
+	ExperimentDashboardTheme Experiment = "dashboard_theme"
+
+	ExperimentTemplateUpdatePolicies Experiment = "template_update_policies"
 	// Add new experiments here!
 	// ExperimentExample Experiment = "example"
 )
@@ -1881,14 +2016,16 @@ const (
 // not be included here and will be essentially hidden.
 var ExperimentsAll = Experiments{
 	ExperimentDeploymentHealthPage,
+	ExperimentSingleTailnet,
 }
 
-// Experiments is a list of experiments that are enabled for the deployment.
+// Experiments is a list of experiments.
 // Multiple experiments may be enabled at the same time.
 // Experiments are not safe for production use, and are not guaranteed to
 // be backwards compatible. They may be removed or renamed at any time.
 type Experiments []Experiment
 
+// Returns a list of experiments that are enabled for the deployment.
 func (e Experiments) Enabled(ex Experiment) bool {
 	for _, v := range e {
 		if v == ex {
@@ -1911,6 +2048,25 @@ func (c *Client) Experiments(ctx context.Context) (Experiments, error) {
 	return exp, json.NewDecoder(res.Body).Decode(&exp)
 }
 
+// AvailableExperiments is an expandable type that returns all safe experiments
+// available to be used with a deployment.
+type AvailableExperiments struct {
+	Safe []Experiment `json:"safe"`
+}
+
+func (c *Client) SafeExperiments(ctx context.Context) (AvailableExperiments, error) {
+	res, err := c.Request(ctx, http.MethodGet, "/api/v2/experiments/available", nil)
+	if err != nil {
+		return AvailableExperiments{}, err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return AvailableExperiments{}, ReadBodyAsError(res)
+	}
+	var exp AvailableExperiments
+	return exp, json.NewDecoder(res.Body).Decode(&exp)
+}
+
 type DAUsResponse struct {
 	Entries      []DAUEntry `json:"entries"`
 	TZHourOffset int        `json:"tz_hour_offset"`
diff --git a/codersdk/deployment_test.go b/codersdk/deployment_test.go
index eb4e267364c98..d6846557cd9cc 100644
--- a/codersdk/deployment_test.go
+++ b/codersdk/deployment_test.go
@@ -7,8 +7,8 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type exclusion struct {
@@ -57,14 +57,17 @@ func TestDeploymentValues_HighlyConfigurable(t *testing.T) {
 		"SCIM API Key": {
 			yaml: true,
 		},
+		"External Token Encryption Keys": {
+			yaml: true,
+		},
 		// These complex objects should be configured through YAML.
 		"Support Links": {
 			flag: true,
 			env:  true,
 		},
-		"Git Auth Providers": {
-			// Technically Git Auth Providers can be provided through the env,
-			// but bypassing clibase. See cli.ReadGitAuthProvidersFromEnv.
+		"External Auth Providers": {
+			// Technically External Auth Providers can be provided through the env,
+			// but bypassing clibase. See cli.ReadExternalAuthProvidersFromEnv.
 			flag: true,
 			env:  true,
 		},
@@ -206,25 +209,26 @@ func TestTimezoneOffsets(t *testing.T) {
 		ExpectedOffset int
 	}{
 		{
-			Name:           "UTX",
+			Name:           "UTC",
 			Loc:            time.UTC,
 			ExpectedOffset: 0,
 		},
-		{
-			Name:           "Eastern",
-			Loc:            must(time.LoadLocation("America/New_York")),
-			ExpectedOffset: -4,
-		},
-		{
-			Name:           "Central",
-			Loc:            must(time.LoadLocation("America/Chicago")),
-			ExpectedOffset: -5,
-		},
-		{
-			Name:           "Ireland",
-			Loc:            must(time.LoadLocation("Europe/Dublin")),
-			ExpectedOffset: 1,
-		},
+		// The following test cases are broken re: daylight savings
+		//{
+		//	Name:           "Eastern",
+		//	Loc:            must(time.LoadLocation("America/New_York")),
+		//	ExpectedOffset: -4,
+		//},
+		//{
+		//	Name:           "Central",
+		//	Loc:            must(time.LoadLocation("America/Chicago")),
+		//	ExpectedOffset: -5,
+		//},
+		//{
+		//	Name:           "Ireland",
+		//	Loc:            must(time.LoadLocation("Europe/Dublin")),
+		//	ExpectedOffset: 1,
+		//},
 		{
 			Name: "HalfHourTz",
 			// This timezone is +6:30, but the function rounds to the nearest hour.
diff --git a/codersdk/externalauth.go b/codersdk/externalauth.go
new file mode 100644
index 0000000000000..0167ca8156259
--- /dev/null
+++ b/codersdk/externalauth.go
@@ -0,0 +1,120 @@
+package codersdk
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+)
+
+// EnhancedExternalAuthProvider is a constant that represents enhanced
+// support for a type of external authentication. All of the Git providers
+// are examples of enhanced, because they support intercepting "git clone".
+type EnhancedExternalAuthProvider string
+
+func (e EnhancedExternalAuthProvider) String() string {
+	return string(e)
+}
+
+// Git returns whether the provider is a Git provider.
+func (e EnhancedExternalAuthProvider) Git() bool {
+	switch e {
+	case EnhancedExternalAuthProviderGitHub,
+		EnhancedExternalAuthProviderGitLab,
+		EnhancedExternalAuthProviderBitBucket,
+		EnhancedExternalAuthProviderAzureDevops:
+		return true
+	default:
+		return false
+	}
+}
+
+const (
+	EnhancedExternalAuthProviderAzureDevops EnhancedExternalAuthProvider = "azure-devops"
+	EnhancedExternalAuthProviderGitHub      EnhancedExternalAuthProvider = "github"
+	EnhancedExternalAuthProviderGitLab      EnhancedExternalAuthProvider = "gitlab"
+	EnhancedExternalAuthProviderBitBucket   EnhancedExternalAuthProvider = "bitbucket"
+	EnhancedExternalAuthProviderSlack       EnhancedExternalAuthProvider = "slack"
+)
+
+type ExternalAuth struct {
+	Authenticated bool   `json:"authenticated"`
+	Device        bool   `json:"device"`
+	DisplayName   string `json:"display_name"`
+
+	// User is the user that authenticated with the provider.
+	User *ExternalAuthUser `json:"user"`
+	// AppInstallable is true if the request for app installs was successful.
+	AppInstallable bool `json:"app_installable"`
+	// AppInstallations are the installations that the user has access to.
+	AppInstallations []ExternalAuthAppInstallation `json:"installations"`
+	// AppInstallURL is the URL to install the app.
+	AppInstallURL string `json:"app_install_url"`
+}
+
+type ExternalAuthAppInstallation struct {
+	ID           int              `json:"id"`
+	Account      ExternalAuthUser `json:"account"`
+	ConfigureURL string           `json:"configure_url"`
+}
+
+type ExternalAuthUser struct {
+	Login      string `json:"login"`
+	AvatarURL  string `json:"avatar_url"`
+	ProfileURL string `json:"profile_url"`
+	Name       string `json:"name"`
+}
+
+// ExternalAuthDevice is the response from the device authorization endpoint.
+// See: https://tools.ietf.org/html/rfc8628#section-3.2
+type ExternalAuthDevice struct {
+	DeviceCode      string `json:"device_code"`
+	UserCode        string `json:"user_code"`
+	VerificationURI string `json:"verification_uri"`
+	ExpiresIn       int    `json:"expires_in"`
+	Interval        int    `json:"interval"`
+}
+
+type ExternalAuthDeviceExchange struct {
+	DeviceCode string `json:"device_code"`
+}
+
+func (c *Client) ExternalAuthDeviceByID(ctx context.Context, provider string) (ExternalAuthDevice, error) {
+	res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/api/v2/external-auth/%s/device", provider), nil)
+	if err != nil {
+		return ExternalAuthDevice{}, err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return ExternalAuthDevice{}, ReadBodyAsError(res)
+	}
+	var extAuth ExternalAuthDevice
+	return extAuth, json.NewDecoder(res.Body).Decode(&extAuth)
+}
+
+// ExchangeGitAuth exchanges a device code for an external auth token.
+func (c *Client) ExternalAuthDeviceExchange(ctx context.Context, provider string, req ExternalAuthDeviceExchange) error {
+	res, err := c.Request(ctx, http.MethodPost, fmt.Sprintf("/api/v2/external-auth/%s/device", provider), req)
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusNoContent {
+		return ReadBodyAsError(res)
+	}
+	return nil
+}
+
+// ExternalAuthByID returns the external auth for the given provider by ID.
+func (c *Client) ExternalAuthByID(ctx context.Context, provider string) (ExternalAuth, error) {
+	res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/api/v2/external-auth/%s", provider), nil)
+	if err != nil {
+		return ExternalAuth{}, err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return ExternalAuth{}, ReadBodyAsError(res)
+	}
+	var extAuth ExternalAuth
+	return extAuth, json.NewDecoder(res.Body).Decode(&extAuth)
+}
diff --git a/codersdk/gitauth.go b/codersdk/gitauth.go
deleted file mode 100644
index c8259771207b8..0000000000000
--- a/codersdk/gitauth.go
+++ /dev/null
@@ -1,90 +0,0 @@
-package codersdk
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-)
-
-type GitAuth struct {
-	Authenticated bool   `json:"authenticated"`
-	Device        bool   `json:"device"`
-	Type          string `json:"type"`
-
-	// User is the user that authenticated with the provider.
-	User *GitAuthUser `json:"user"`
-	// AppInstallable is true if the request for app installs was successful.
-	AppInstallable bool `json:"app_installable"`
-	// AppInstallations are the installations that the user has access to.
-	AppInstallations []GitAuthAppInstallation `json:"installations"`
-	// AppInstallURL is the URL to install the app.
-	AppInstallURL string `json:"app_install_url"`
-}
-
-type GitAuthAppInstallation struct {
-	ID           int         `json:"id"`
-	Account      GitAuthUser `json:"account"`
-	ConfigureURL string      `json:"configure_url"`
-}
-
-type GitAuthUser struct {
-	Login      string `json:"login"`
-	AvatarURL  string `json:"avatar_url"`
-	ProfileURL string `json:"profile_url"`
-	Name       string `json:"name"`
-}
-
-// GitAuthDevice is the response from the device authorization endpoint.
-// See: https://tools.ietf.org/html/rfc8628#section-3.2
-type GitAuthDevice struct {
-	DeviceCode      string `json:"device_code"`
-	UserCode        string `json:"user_code"`
-	VerificationURI string `json:"verification_uri"`
-	ExpiresIn       int    `json:"expires_in"`
-	Interval        int    `json:"interval"`
-}
-
-type GitAuthDeviceExchange struct {
-	DeviceCode string `json:"device_code"`
-}
-
-func (c *Client) GitAuthDeviceByID(ctx context.Context, provider string) (GitAuthDevice, error) {
-	res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/api/v2/gitauth/%s/device", provider), nil)
-	if err != nil {
-		return GitAuthDevice{}, err
-	}
-	defer res.Body.Close()
-	if res.StatusCode != http.StatusOK {
-		return GitAuthDevice{}, ReadBodyAsError(res)
-	}
-	var gitauth GitAuthDevice
-	return gitauth, json.NewDecoder(res.Body).Decode(&gitauth)
-}
-
-// ExchangeGitAuth exchanges a device code for a git auth token.
-func (c *Client) GitAuthDeviceExchange(ctx context.Context, provider string, req GitAuthDeviceExchange) error {
-	res, err := c.Request(ctx, http.MethodPost, fmt.Sprintf("/api/v2/gitauth/%s/device", provider), req)
-	if err != nil {
-		return err
-	}
-	defer res.Body.Close()
-	if res.StatusCode != http.StatusNoContent {
-		return ReadBodyAsError(res)
-	}
-	return nil
-}
-
-// GitAuthByID returns the git auth for the given provider by ID.
-func (c *Client) GitAuthByID(ctx context.Context, provider string) (GitAuth, error) {
-	res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/api/v2/gitauth/%s", provider), nil)
-	if err != nil {
-		return GitAuth{}, err
-	}
-	defer res.Body.Close()
-	if res.StatusCode != http.StatusOK {
-		return GitAuth{}, ReadBodyAsError(res)
-	}
-	var gitauth GitAuth
-	return gitauth, json.NewDecoder(res.Body).Decode(&gitauth)
-}
diff --git a/codersdk/groups.go b/codersdk/groups.go
index c04267e4e0eb2..2796a776a960a 100644
--- a/codersdk/groups.go
+++ b/codersdk/groups.go
@@ -10,6 +10,13 @@ import (
 	"golang.org/x/xerrors"
 )
 
+type GroupSource string
+
+const (
+	GroupSourceUser GroupSource = "user"
+	GroupSourceOIDC GroupSource = "oidc"
+)
+
 type CreateGroupRequest struct {
 	Name           string `json:"name"`
 	DisplayName    string `json:"display_name"`
@@ -18,13 +25,18 @@ type CreateGroupRequest struct {
 }
 
 type Group struct {
-	ID             uuid.UUID `json:"id" format:"uuid"`
-	Name           string    `json:"name"`
-	DisplayName    string    `json:"display_name"`
-	OrganizationID uuid.UUID `json:"organization_id" format:"uuid"`
-	Members        []User    `json:"members"`
-	AvatarURL      string    `json:"avatar_url"`
-	QuotaAllowance int       `json:"quota_allowance"`
+	ID             uuid.UUID   `json:"id" format:"uuid"`
+	Name           string      `json:"name"`
+	DisplayName    string      `json:"display_name"`
+	OrganizationID uuid.UUID   `json:"organization_id" format:"uuid"`
+	Members        []User      `json:"members"`
+	AvatarURL      string      `json:"avatar_url"`
+	QuotaAllowance int         `json:"quota_allowance"`
+	Source         GroupSource `json:"source"`
+}
+
+func (g Group) IsEveryone() bool {
+	return g.ID == g.OrganizationID
 }
 
 func (c *Client) CreateGroup(ctx context.Context, orgID uuid.UUID, req CreateGroupRequest) (Group, error) {
diff --git a/codersdk/insights.go b/codersdk/insights.go
index bfc51bd208dd6..047f35a4da879 100644
--- a/codersdk/insights.go
+++ b/codersdk/insights.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
 
@@ -19,9 +20,31 @@ const insightsTimeLayout = time.RFC3339
 // smaller insights report within a time range.
 type InsightsReportInterval string
 
+// Days returns the duration of the interval in days.
+func (interval InsightsReportInterval) Days() int32 {
+	switch interval {
+	case InsightsReportIntervalDay:
+		return 1
+	case InsightsReportIntervalWeek:
+		return 7
+	default:
+		panic("developer error: unsupported report interval")
+	}
+}
+
 // InsightsReportInterval enums.
 const (
-	InsightsReportIntervalDay InsightsReportInterval = "day"
+	InsightsReportIntervalDay  InsightsReportInterval = "day"
+	InsightsReportIntervalWeek InsightsReportInterval = "week"
+)
+
+// TemplateInsightsSection defines the section to be included in the template insights response.
+type TemplateInsightsSection string
+
+// TemplateInsightsSection enums.
+const (
+	TemplateInsightsSectionIntervalReports TemplateInsightsSection = "interval_reports"
+	TemplateInsightsSectionReport          TemplateInsightsSection = "report"
 )
 
 // UserLatencyInsightsResponse is the response from the user latency insights
@@ -48,6 +71,30 @@ type UserLatency struct {
 	LatencyMS   ConnectionLatency `json:"latency_ms"`
 }
 
+// UserActivityInsightsResponse is the response from the user activity insights
+// endpoint.
+type UserActivityInsightsResponse struct {
+	Report UserActivityInsightsReport `json:"report"`
+}
+
+// UserActivityInsightsReport is the report from the user activity insights
+// endpoint.
+type UserActivityInsightsReport struct {
+	StartTime   time.Time      `json:"start_time" format:"date-time"`
+	EndTime     time.Time      `json:"end_time" format:"date-time"`
+	TemplateIDs []uuid.UUID    `json:"template_ids" format:"uuid"`
+	Users       []UserActivity `json:"users"`
+}
+
+// UserActivity shows the session time for a user.
+type UserActivity struct {
+	TemplateIDs []uuid.UUID `json:"template_ids" format:"uuid"`
+	UserID      uuid.UUID   `json:"user_id" format:"uuid"`
+	Username    string      `json:"username"`
+	AvatarURL   string      `json:"avatar_url" format:"uri"`
+	Seconds     int64       `json:"seconds" example:"80500"`
+}
+
 // ConnectionLatency shows the latency for a connection.
 type ConnectionLatency struct {
 	P50 float64 `json:"p50" example:"31.312"`
@@ -61,18 +108,18 @@ type UserLatencyInsightsRequest struct {
 }
 
 func (c *Client) UserLatencyInsights(ctx context.Context, req UserLatencyInsightsRequest) (UserLatencyInsightsResponse, error) {
-	var qp []string
-	qp = append(qp, fmt.Sprintf("start_time=%s", req.StartTime.Format(insightsTimeLayout)))
-	qp = append(qp, fmt.Sprintf("end_time=%s", req.EndTime.Format(insightsTimeLayout)))
+	qp := url.Values{}
+	qp.Add("start_time", req.StartTime.Format(insightsTimeLayout))
+	qp.Add("end_time", req.EndTime.Format(insightsTimeLayout))
 	if len(req.TemplateIDs) > 0 {
 		var templateIDs []string
 		for _, id := range req.TemplateIDs {
 			templateIDs = append(templateIDs, id.String())
 		}
-		qp = append(qp, fmt.Sprintf("template_ids=%s", strings.Join(templateIDs, ",")))
+		qp.Add("template_ids", strings.Join(templateIDs, ","))
 	}
 
-	reqURL := fmt.Sprintf("/api/v2/insights/user-latency?%s", strings.Join(qp, "&"))
+	reqURL := fmt.Sprintf("/api/v2/insights/user-latency?%s", qp.Encode())
 	resp, err := c.Request(ctx, http.MethodGet, reqURL, nil)
 	if err != nil {
 		return UserLatencyInsightsResponse{}, xerrors.Errorf("make request: %w", err)
@@ -86,10 +133,42 @@ func (c *Client) UserLatencyInsights(ctx context.Context, req UserLatencyInsight
 	return result, json.NewDecoder(resp.Body).Decode(&result)
 }
 
+type UserActivityInsightsRequest struct {
+	StartTime   time.Time   `json:"start_time" format:"date-time"`
+	EndTime     time.Time   `json:"end_time" format:"date-time"`
+	TemplateIDs []uuid.UUID `json:"template_ids" format:"uuid"`
+}
+
+func (c *Client) UserActivityInsights(ctx context.Context, req UserActivityInsightsRequest) (UserActivityInsightsResponse, error) {
+	qp := url.Values{}
+	qp.Add("start_time", req.StartTime.Format(insightsTimeLayout))
+	qp.Add("end_time", req.EndTime.Format(insightsTimeLayout))
+	if len(req.TemplateIDs) > 0 {
+		var templateIDs []string
+		for _, id := range req.TemplateIDs {
+			templateIDs = append(templateIDs, id.String())
+		}
+		qp.Add("template_ids", strings.Join(templateIDs, ","))
+	}
+
+	reqURL := fmt.Sprintf("/api/v2/insights/user-activity?%s", qp.Encode())
+	resp, err := c.Request(ctx, http.MethodGet, reqURL, nil)
+	if err != nil {
+		return UserActivityInsightsResponse{}, xerrors.Errorf("make request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return UserActivityInsightsResponse{}, ReadBodyAsError(resp)
+	}
+	var result UserActivityInsightsResponse
+	return result, json.NewDecoder(resp.Body).Decode(&result)
+}
+
 // TemplateInsightsResponse is the response from the template insights endpoint.
 type TemplateInsightsResponse struct {
-	Report          TemplateInsightsReport           `json:"report"`
-	IntervalReports []TemplateInsightsIntervalReport `json:"interval_reports"`
+	Report          *TemplateInsightsReport          `json:"report,omitempty"`
+	IntervalReports []TemplateInsightsIntervalReport `json:"interval_reports,omitempty"`
 }
 
 // TemplateInsightsReport is the report from the template insights endpoint.
@@ -108,7 +187,7 @@ type TemplateInsightsIntervalReport struct {
 	StartTime   time.Time              `json:"start_time" format:"date-time"`
 	EndTime     time.Time              `json:"end_time" format:"date-time"`
 	TemplateIDs []uuid.UUID            `json:"template_ids" format:"uuid"`
-	Interval    InsightsReportInterval `json:"interval"`
+	Interval    InsightsReportInterval `json:"interval" example:"week"`
 	ActiveUsers int64                  `json:"active_users" example:"14"`
 }
 
@@ -118,8 +197,7 @@ type TemplateAppsType string
 // TemplateAppsType enums.
 const (
 	TemplateAppsTypeBuiltin TemplateAppsType = "builtin"
-	// TODO(mafredri): To be introduced in a future pull request.
-	// TemplateAppsTypeApp     TemplateAppsType = "app"
+	TemplateAppsTypeApp     TemplateAppsType = "app"
 )
 
 // TemplateAppUsage shows the usage of an app for one or more templates.
@@ -138,6 +216,8 @@ type TemplateParameterUsage struct {
 	TemplateIDs []uuid.UUID                      `json:"template_ids" format:"uuid"`
 	DisplayName string                           `json:"display_name"`
 	Name        string                           `json:"name"`
+	Type        string                           `json:"type"`
+	Description string                           `json:"description"`
 	Options     []TemplateVersionParameterOption `json:"options,omitempty"`
 	Values      []TemplateParameterValue         `json:"values"`
 }
@@ -150,28 +230,36 @@ type TemplateParameterValue struct {
 }
 
 type TemplateInsightsRequest struct {
-	StartTime   time.Time              `json:"start_time" format:"date-time"`
-	EndTime     time.Time              `json:"end_time" format:"date-time"`
-	TemplateIDs []uuid.UUID            `json:"template_ids" format:"uuid"`
-	Interval    InsightsReportInterval `json:"interval"`
+	StartTime   time.Time                 `json:"start_time" format:"date-time"`
+	EndTime     time.Time                 `json:"end_time" format:"date-time"`
+	TemplateIDs []uuid.UUID               `json:"template_ids" format:"uuid"`
+	Interval    InsightsReportInterval    `json:"interval" example:"day"`
+	Sections    []TemplateInsightsSection `json:"sections" example:"report"`
 }
 
 func (c *Client) TemplateInsights(ctx context.Context, req TemplateInsightsRequest) (TemplateInsightsResponse, error) {
-	var qp []string
-	qp = append(qp, fmt.Sprintf("start_time=%s", req.StartTime.Format(insightsTimeLayout)))
-	qp = append(qp, fmt.Sprintf("end_time=%s", req.EndTime.Format(insightsTimeLayout)))
+	qp := url.Values{}
+	qp.Add("start_time", req.StartTime.Format(insightsTimeLayout))
+	qp.Add("end_time", req.EndTime.Format(insightsTimeLayout))
 	if len(req.TemplateIDs) > 0 {
 		var templateIDs []string
 		for _, id := range req.TemplateIDs {
 			templateIDs = append(templateIDs, id.String())
 		}
-		qp = append(qp, fmt.Sprintf("template_ids=%s", strings.Join(templateIDs, ",")))
+		qp.Add("template_ids", strings.Join(templateIDs, ","))
 	}
 	if req.Interval != "" {
-		qp = append(qp, fmt.Sprintf("interval=%s", req.Interval))
+		qp.Add("interval", string(req.Interval))
+	}
+	if len(req.Sections) > 0 {
+		var sections []string
+		for _, sec := range req.Sections {
+			sections = append(sections, string(sec))
+		}
+		qp.Add("sections", strings.Join(sections, ","))
 	}
 
-	reqURL := fmt.Sprintf("/api/v2/insights/templates?%s", strings.Join(qp, "&"))
+	reqURL := fmt.Sprintf("/api/v2/insights/templates?%s", qp.Encode())
 	resp, err := c.Request(ctx, http.MethodGet, reqURL, nil)
 	if err != nil {
 		return TemplateInsightsResponse{}, xerrors.Errorf("make request: %w", err)
diff --git a/codersdk/organizations.go b/codersdk/organizations.go
index 26290fd4f4761..cc206180f81ae 100644
--- a/codersdk/organizations.go
+++ b/codersdk/organizations.go
@@ -84,11 +84,14 @@ type CreateTemplateRequest struct {
 	// DefaultTTLMillis allows optionally specifying the default TTL
 	// for all workspaces created from this template.
 	DefaultTTLMillis *int64 `json:"default_ttl_ms,omitempty"`
-	// TODO(@dean): remove max_ttl once restart_requirement is matured
+	// TODO(@dean): remove max_ttl once autostop_requirement is matured
 	MaxTTLMillis *int64 `json:"max_ttl_ms,omitempty"`
-	// RestartRequirement allows optionally specifying the restart requirement
+	// AutostopRequirement allows optionally specifying the autostop requirement
 	// for workspaces created from this template. This is an enterprise feature.
-	RestartRequirement *TemplateRestartRequirement `json:"restart_requirement,omitempty"`
+	AutostopRequirement *TemplateAutostopRequirement `json:"autostop_requirement,omitempty"`
+	// AutostartRequirement allows optionally specifying the autostart allowed days
+	// for workspaces created from this template. This is an enterprise feature.
+	AutostartRequirement *TemplateAutostartRequirement `json:"autostart_requirement,omitempty"`
 
 	// Allow users to cancel in-progress workspace jobs.
 	// *bool as the default value is "true".
@@ -108,12 +111,12 @@ type CreateTemplateRequest struct {
 	// FailureTTLMillis allows optionally specifying the max lifetime before Coder
 	// stops all resources for failed workspaces created from this template.
 	FailureTTLMillis *int64 `json:"failure_ttl_ms,omitempty"`
-	// InactivityTTLMillis allows optionally specifying the max lifetime before Coder
+	// TimeTilDormantMillis allows optionally specifying the max lifetime before Coder
 	// locks inactive workspaces created from this template.
-	InactivityTTLMillis *int64 `json:"inactivity_ttl_ms,omitempty"`
-	// LockedTTLMillis allows optionally specifying the max lifetime before Coder
-	// permanently deletes locked workspaces created from this template.
-	LockedTTLMillis *int64 `json:"locked_ttl_ms,omitempty"`
+	TimeTilDormantMillis *int64 `json:"dormant_ttl_ms,omitempty"`
+	// TimeTilDormantAutoDeleteMillis allows optionally specifying the max lifetime before Coder
+	// permanently deletes dormant workspaces created from this template.
+	TimeTilDormantAutoDeleteMillis *int64 `json:"delete_ttl_ms,omitempty"`
 
 	// DisableEveryoneGroupAccess allows optionally disabling the default
 	// behavior of granting the 'everyone' group access to use the template.
@@ -121,17 +124,26 @@ type CreateTemplateRequest struct {
 	// and must be explicitly granted to users or groups in the permissions settings
 	// of the template.
 	DisableEveryoneGroupAccess bool `json:"disable_everyone_group_access"`
+
+	// RequireActiveVersion mandates that workspaces are built with the active
+	// template version.
+	RequireActiveVersion bool `json:"require_active_version"`
 }
 
 // CreateWorkspaceRequest provides options for creating a new workspace.
+// Either TemplateID or TemplateVersionID must be specified. They cannot both be present.
 type CreateWorkspaceRequest struct {
-	TemplateID        uuid.UUID `json:"template_id" validate:"required" format:"uuid"`
+	// TemplateID specifies which template should be used for creating the workspace.
+	TemplateID uuid.UUID `json:"template_id,omitempty" validate:"required_without=TemplateVersionID,excluded_with=TemplateVersionID" format:"uuid"`
+	// TemplateVersionID can be used to specify a specific version of a template for creating the workspace.
+	TemplateVersionID uuid.UUID `json:"template_version_id,omitempty" validate:"required_without=TemplateID,excluded_with=TemplateID" format:"uuid"`
 	Name              string    `json:"name" validate:"workspace_name,required"`
 	AutostartSchedule *string   `json:"autostart_schedule"`
 	TTLMillis         *int64    `json:"ttl_ms,omitempty"`
-	// ParameterValues allows for additional parameters to be provided
+	// RichParameterValues allows for additional parameters to be provided
 	// during the initial provision.
 	RichParameterValues []WorkspaceBuildParameter `json:"rich_parameter_values,omitempty"`
+	AutomaticUpdates    AutomaticUpdates          `json:"automatic_updates,omitempty"`
 }
 
 func (c *Client) Organization(ctx context.Context, id uuid.UUID) (Organization, error) {
@@ -149,10 +161,14 @@ func (c *Client) Organization(ctx context.Context, id uuid.UUID) (Organization,
 	return organization, json.NewDecoder(res.Body).Decode(&organization)
 }
 
-// ProvisionerDaemonsByOrganization returns provisioner daemons available for an organization.
+// ProvisionerDaemons returns provisioner daemons available.
+//
+// Deprecated: We no longer track provisioner daemons as they connect.  This function may return historical data
+// but new provisioner daemons will not appear.
 func (c *Client) ProvisionerDaemons(ctx context.Context) ([]ProvisionerDaemon, error) {
 	res, err := c.Request(ctx, http.MethodGet,
-		"/api/v2/provisionerdaemons",
+		// TODO: the organization path parameter is currently ignored.
+		"/api/v2/organizations/default/provisionerdaemons",
 		nil,
 	)
 	if err != nil {
diff --git a/codersdk/provisionerdaemons.go b/codersdk/provisionerdaemons.go
index 1c9378f718b3a..0b321e51662ab 100644
--- a/codersdk/provisionerdaemons.go
+++ b/codersdk/provisionerdaemons.go
@@ -16,8 +16,9 @@ import (
 	"golang.org/x/xerrors"
 	"nhooyr.io/websocket"
 
-	"github.com/coder/coder/provisionerd/proto"
-	"github.com/coder/coder/provisionersdk"
+	"github.com/coder/coder/v2/provisionerd/proto"
+	"github.com/coder/coder/v2/provisionerd/runner"
+	"github.com/coder/coder/v2/provisionersdk"
 )
 
 type LogSource string
@@ -63,16 +64,22 @@ const (
 	ProvisionerJobCanceling ProvisionerJobStatus = "canceling"
 	ProvisionerJobCanceled  ProvisionerJobStatus = "canceled"
 	ProvisionerJobFailed    ProvisionerJobStatus = "failed"
+	ProvisionerJobUnknown   ProvisionerJobStatus = "unknown"
 )
 
 // JobErrorCode defines the error code returned by job runner.
 type JobErrorCode string
 
 const (
-	MissingTemplateParameter  JobErrorCode = "MISSING_TEMPLATE_PARAMETER"
 	RequiredTemplateVariables JobErrorCode = "REQUIRED_TEMPLATE_VARIABLES"
 )
 
+// JobIsMissingParameterErrorCode returns whether the error is a missing parameter error.
+// This can indicate to consumers that they should check parameters.
+func JobIsMissingParameterErrorCode(code JobErrorCode) bool {
+	return string(code) == runner.MissingParameterErrorCode
+}
+
 // ProvisionerJob describes the job executed by the provisioning daemon.
 type ProvisionerJob struct {
 	ID            uuid.UUID            `json:"id" format:"uuid"`
@@ -81,7 +88,7 @@ type ProvisionerJob struct {
 	CompletedAt   *time.Time           `json:"completed_at,omitempty" format:"date-time"`
 	CanceledAt    *time.Time           `json:"canceled_at,omitempty" format:"date-time"`
 	Error         string               `json:"error,omitempty"`
-	ErrorCode     JobErrorCode         `json:"error_code,omitempty" enums:"MISSING_TEMPLATE_PARAMETER,REQUIRED_TEMPLATE_VARIABLES"`
+	ErrorCode     JobErrorCode         `json:"error_code,omitempty" enums:"REQUIRED_TEMPLATE_VARIABLES"`
 	Status        ProvisionerJobStatus `json:"status" enums:"pending,running,succeeded,canceling,canceled,failed"`
 	WorkerID      *uuid.UUID           `json:"worker_id,omitempty" format:"uuid"`
 	FileID        uuid.UUID            `json:"file_id" format:"uuid"`
@@ -164,38 +171,64 @@ func (c *Client) provisionerJobLogsAfter(ctx context.Context, path string, after
 	}), nil
 }
 
-// ListenProvisionerDaemon returns the gRPC service for a provisioner daemon
+// ServeProvisionerDaemonRequest are the parameters to call ServeProvisionerDaemon with
+// @typescript-ignore ServeProvisionerDaemonRequest
+type ServeProvisionerDaemonRequest struct {
+	// ID is a unique ID for a provisioner daemon.
+	ID uuid.UUID `json:"id" format:"uuid"`
+	// Organization is the organization for the URL.  At present provisioner daemons ARE NOT scoped to organizations
+	// and so the organization ID is optional.
+	Organization uuid.UUID `json:"organization" format:"uuid"`
+	// Provisioners is a list of provisioner types hosted by the provisioner daemon
+	Provisioners []ProvisionerType `json:"provisioners"`
+	// Tags is a map of key-value pairs that tag the jobs this provisioner daemon can handle
+	Tags map[string]string `json:"tags"`
+	// PreSharedKey is an authentication key to use on the API instead of the normal session token from the client.
+	PreSharedKey string `json:"pre_shared_key"`
+}
+
+// ServeProvisionerDaemon returns the gRPC service for a provisioner daemon
 // implementation. The context is during dial, not during the lifetime of the
 // client. Client should be closed after use.
-func (c *Client) ServeProvisionerDaemon(ctx context.Context, organization uuid.UUID, provisioners []ProvisionerType, tags map[string]string) (proto.DRPCProvisionerDaemonClient, error) {
-	serverURL, err := c.URL.Parse(fmt.Sprintf("/api/v2/organizations/%s/provisionerdaemons/serve", organization))
+func (c *Client) ServeProvisionerDaemon(ctx context.Context, req ServeProvisionerDaemonRequest) (proto.DRPCProvisionerDaemonClient, error) {
+	serverURL, err := c.URL.Parse(fmt.Sprintf("/api/v2/organizations/%s/provisionerdaemons/serve", req.Organization))
 	if err != nil {
 		return nil, xerrors.Errorf("parse url: %w", err)
 	}
 	query := serverURL.Query()
-	for _, provisioner := range provisioners {
+	query.Add("id", req.ID.String())
+	for _, provisioner := range req.Provisioners {
 		query.Add("provisioner", string(provisioner))
 	}
-	for key, value := range tags {
+	for key, value := range req.Tags {
 		query.Add("tag", fmt.Sprintf("%s=%s", key, value))
 	}
 	serverURL.RawQuery = query.Encode()
-	jar, err := cookiejar.New(nil)
-	if err != nil {
-		return nil, xerrors.Errorf("create cookie jar: %w", err)
-	}
-	jar.SetCookies(serverURL, []*http.Cookie{{
-		Name:  SessionTokenCookie,
-		Value: c.SessionToken(),
-	}})
 	httpClient := &http.Client{
-		Jar:       jar,
 		Transport: c.HTTPClient.Transport,
 	}
+	headers := http.Header{}
+
+	if req.PreSharedKey == "" {
+		// use session token if we don't have a PSK.
+		jar, err := cookiejar.New(nil)
+		if err != nil {
+			return nil, xerrors.Errorf("create cookie jar: %w", err)
+		}
+		jar.SetCookies(serverURL, []*http.Cookie{{
+			Name:  SessionTokenCookie,
+			Value: c.SessionToken(),
+		}})
+		httpClient.Jar = jar
+	} else {
+		headers.Set(ProvisionerDaemonPSK, req.PreSharedKey)
+	}
+
 	conn, res, err := websocket.Dial(ctx, serverURL.String(), &websocket.DialOptions{
 		HTTPClient: httpClient,
 		// Need to disable compression to avoid a data-race.
 		CompressionMode: websocket.CompressionDisabled,
+		HTTPHeader:      headers,
 	})
 	if err != nil {
 		if res == nil {
diff --git a/codersdk/richparameters_test.go b/codersdk/richparameters_test.go
index df70c9c10e164..a7ab416b98bff 100644
--- a/codersdk/richparameters_test.go
+++ b/codersdk/richparameters_test.go
@@ -5,8 +5,8 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestParameterResolver_ValidateResolve_New(t *testing.T) {
diff --git a/codersdk/serversentevents.go b/codersdk/serversentevents.go
index 56457a0c9224e..8c026524c7d92 100644
--- a/codersdk/serversentevents.go
+++ b/codersdk/serversentevents.go
@@ -9,7 +9,7 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 type ServerSentEvent struct {
diff --git a/codersdk/templates.go b/codersdk/templates.go
index 2022c876db360..3a3240ca711b2 100644
--- a/codersdk/templates.go
+++ b/codersdk/templates.go
@@ -29,13 +29,15 @@ type Template struct {
 	Description      string                 `json:"description"`
 	Icon             string                 `json:"icon"`
 	DefaultTTLMillis int64                  `json:"default_ttl_ms"`
-	// TODO(@dean): remove max_ttl once restart_requirement is matured
+	// TODO(@dean): remove max_ttl once autostop_requirement is matured
 	MaxTTLMillis int64 `json:"max_ttl_ms"`
-	// RestartRequirement is an enterprise feature. Its value is only used if
-	// your license is entitled to use the advanced template scheduling feature.
-	RestartRequirement TemplateRestartRequirement `json:"restart_requirement"`
-	CreatedByID        uuid.UUID                  `json:"created_by_id" format:"uuid"`
-	CreatedByName      string                     `json:"created_by_name"`
+	// AutostopRequirement and AutostartRequirement are enterprise features. Its
+	// value is only used if your license is entitled to use the advanced template
+	// scheduling feature.
+	AutostopRequirement  TemplateAutostopRequirement  `json:"autostop_requirement"`
+	AutostartRequirement TemplateAutostartRequirement `json:"autostart_requirement"`
+	CreatedByID          uuid.UUID                    `json:"created_by_id" format:"uuid"`
+	CreatedByName        string                       `json:"created_by_name"`
 
 	// AllowUserAutostart and AllowUserAutostop are enterprise-only. Their
 	// values are only used if your license is entitled to use the advanced
@@ -44,12 +46,16 @@ type Template struct {
 	AllowUserAutostop            bool `json:"allow_user_autostop"`
 	AllowUserCancelWorkspaceJobs bool `json:"allow_user_cancel_workspace_jobs"`
 
-	// FailureTTLMillis, InactivityTTLMillis, and LockedTTLMillis are enterprise-only. Their
+	// FailureTTLMillis, TimeTilDormantMillis, and TimeTilDormantAutoDeleteMillis are enterprise-only. Their
 	// values are used if your license is entitled to use the advanced
 	// template scheduling feature.
-	FailureTTLMillis    int64 `json:"failure_ttl_ms"`
-	InactivityTTLMillis int64 `json:"inactivity_ttl_ms"`
-	LockedTTLMillis     int64 `json:"locked_ttl_ms"`
+	FailureTTLMillis               int64 `json:"failure_ttl_ms"`
+	TimeTilDormantMillis           int64 `json:"time_til_dormant_ms"`
+	TimeTilDormantAutoDeleteMillis int64 `json:"time_til_dormant_autodelete_ms"`
+
+	// RequireActiveVersion mandates that workspaces are built with the active
+	// template version.
+	RequireActiveVersion bool `json:"require_active_version"`
 }
 
 // WeekdaysToBitmap converts a list of weekdays to a bitmap in accordance with
@@ -83,7 +89,7 @@ func WeekdaysToBitmap(days []string) (uint8, error) {
 // BitmapToWeekdays converts a bitmap to a list of weekdays in accordance with
 // the schedule package's rules (see above).
 func BitmapToWeekdays(bitmap uint8) []string {
-	var days []string
+	days := []string{}
 	for i := 0; i < 7; i++ {
 		if bitmap&(1<<i) != 0 {
 			switch i {
@@ -107,7 +113,13 @@ func BitmapToWeekdays(bitmap uint8) []string {
 	return days
 }
 
-type TemplateRestartRequirement struct {
+type TemplateAutostartRequirement struct {
+	// DaysOfWeek is a list of days of the week in which autostart is allowed
+	// to happen. If no days are specified, autostart is not allowed.
+	DaysOfWeek []string `json:"days_of_week" enums:"monday,tuesday,wednesday,thursday,friday,saturday,sunday"`
+}
+
+type TemplateAutostopRequirement struct {
 	// DaysOfWeek is a list of days of the week on which restarts are required.
 	// Restarts happen within the user's quiet hours (in their configured
 	// timezone). If no days are specified, restarts are not required. Weekdays
@@ -136,6 +148,17 @@ type (
 	}
 )
 
+type ArchiveTemplateVersionsRequest struct {
+	// By default, only failed versions are archived. Set this to true
+	// to archive all unused versions regardless of job status.
+	All bool `json:"all"`
+}
+
+type ArchiveTemplateVersionsResponse struct {
+	TemplateID  uuid.UUID   `json:"template_id" format:"uuid"`
+	ArchivedIDs []uuid.UUID `json:"archived_ids"`
+}
+
 type TemplateRole string
 
 const (
@@ -180,18 +203,32 @@ type UpdateTemplateMeta struct {
 	Description      string `json:"description,omitempty"`
 	Icon             string `json:"icon,omitempty"`
 	DefaultTTLMillis int64  `json:"default_ttl_ms,omitempty"`
-	// TODO(@dean): remove max_ttl once restart_requirement is matured
+	// TODO(@dean): remove max_ttl once autostop_requirement is matured
 	MaxTTLMillis int64 `json:"max_ttl_ms,omitempty"`
-	// RestartRequirement can only be set if your license includes the advanced
-	// template scheduling feature. If you attempt to set this value while
-	// unlicensed, it will be ignored.
-	RestartRequirement           *TemplateRestartRequirement `json:"restart_requirement,omitempty"`
-	AllowUserAutostart           bool                        `json:"allow_user_autostart,omitempty"`
-	AllowUserAutostop            bool                        `json:"allow_user_autostop,omitempty"`
-	AllowUserCancelWorkspaceJobs bool                        `json:"allow_user_cancel_workspace_jobs,omitempty"`
-	FailureTTLMillis             int64                       `json:"failure_ttl_ms,omitempty"`
-	InactivityTTLMillis          int64                       `json:"inactivity_ttl_ms,omitempty"`
-	LockedTTLMillis              int64                       `json:"locked_ttl_ms,omitempty"`
+	// AutostopRequirement and AutostartRequirement can only be set if your license
+	// includes the advanced template scheduling feature. If you attempt to set this
+	// value while unlicensed, it will be ignored.
+	AutostopRequirement            *TemplateAutostopRequirement  `json:"autostop_requirement,omitempty"`
+	AutostartRequirement           *TemplateAutostartRequirement `json:"autostart_requirement,omitempty"`
+	AllowUserAutostart             bool                          `json:"allow_user_autostart,omitempty"`
+	AllowUserAutostop              bool                          `json:"allow_user_autostop,omitempty"`
+	AllowUserCancelWorkspaceJobs   bool                          `json:"allow_user_cancel_workspace_jobs,omitempty"`
+	FailureTTLMillis               int64                         `json:"failure_ttl_ms,omitempty"`
+	TimeTilDormantMillis           int64                         `json:"time_til_dormant_ms,omitempty"`
+	TimeTilDormantAutoDeleteMillis int64                         `json:"time_til_dormant_autodelete_ms,omitempty"`
+	// UpdateWorkspaceLastUsedAt updates the last_used_at field of workspaces
+	// spawned from the template. This is useful for preventing workspaces being
+	// immediately locked when updating the inactivity_ttl field to a new, shorter
+	// value.
+	UpdateWorkspaceLastUsedAt bool `json:"update_workspace_last_used_at"`
+	// UpdateWorkspaceDormant updates the dormant_at field of workspaces spawned
+	// from the template. This is useful for preventing dormant workspaces being immediately
+	// deleted when updating the dormant_ttl field to a new, shorter value.
+	UpdateWorkspaceDormantAt bool `json:"update_workspace_dormant_at"`
+	// RequireActiveVersion mandates workspaces built using this template
+	// use the active version of the template. This option has no
+	// effect on template admins.
+	RequireActiveVersion bool `json:"require_active_version"`
 }
 
 type TemplateExample struct {
@@ -218,6 +255,44 @@ func (c *Client) Template(ctx context.Context, template uuid.UUID) (Template, er
 	return resp, json.NewDecoder(res.Body).Decode(&resp)
 }
 
+func (c *Client) ArchiveTemplateVersions(ctx context.Context, template uuid.UUID, all bool) (ArchiveTemplateVersionsResponse, error) {
+	res, err := c.Request(ctx, http.MethodPost,
+		fmt.Sprintf("/api/v2/templates/%s/versions/archive", template),
+		ArchiveTemplateVersionsRequest{
+			All: all,
+		},
+	)
+	if err != nil {
+		return ArchiveTemplateVersionsResponse{}, err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return ArchiveTemplateVersionsResponse{}, ReadBodyAsError(res)
+	}
+	var resp ArchiveTemplateVersionsResponse
+	return resp, json.NewDecoder(res.Body).Decode(&resp)
+}
+
+//nolint:revive
+func (c *Client) SetArchiveTemplateVersion(ctx context.Context, templateVersion uuid.UUID, archive bool) error {
+	u := fmt.Sprintf("/api/v2/templateversions/%s", templateVersion.String())
+	if archive {
+		u += "/archive"
+	} else {
+		u += "/unarchive"
+	}
+	res, err := c.Request(ctx, http.MethodPost, u, nil)
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return ReadBodyAsError(res)
+	}
+
+	return nil
+}
+
 func (c *Client) DeleteTemplate(ctx context.Context, template uuid.UUID) error {
 	res, err := c.Request(ctx, http.MethodDelete, fmt.Sprintf("/api/v2/templates/%s", template), nil)
 	if err != nil {
@@ -302,13 +377,18 @@ func (c *Client) UpdateActiveTemplateVersion(ctx context.Context, template uuid.
 // TemplateVersionsByTemplateRequest defines the request parameters for
 // TemplateVersionsByTemplate.
 type TemplateVersionsByTemplateRequest struct {
-	TemplateID uuid.UUID `json:"template_id" validate:"required" format:"uuid"`
+	TemplateID      uuid.UUID `json:"template_id" validate:"required" format:"uuid"`
+	IncludeArchived bool      `json:"include_archived"`
 	Pagination
 }
 
 // TemplateVersionsByTemplate lists versions associated with a template.
 func (c *Client) TemplateVersionsByTemplate(ctx context.Context, req TemplateVersionsByTemplateRequest) ([]TemplateVersion, error) {
-	res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/api/v2/templates/%s/versions", req.TemplateID), nil, req.Pagination.asRequestOption())
+	u := fmt.Sprintf("/api/v2/templates/%s/versions", req.TemplateID)
+	if req.IncludeArchived {
+		u += "?include_archived=true"
+	}
+	res, err := c.Request(ctx, http.MethodGet, u, nil, req.Pagination.asRequestOption())
 	if err != nil {
 		return nil, err
 	}
diff --git a/codersdk/templateversions.go b/codersdk/templateversions.go
index 18f81731aa03a..4263fbaf06975 100644
--- a/codersdk/templateversions.go
+++ b/codersdk/templateversions.go
@@ -29,15 +29,18 @@ type TemplateVersion struct {
 	Job            ProvisionerJob `json:"job"`
 	Readme         string         `json:"readme"`
 	CreatedBy      MinimalUser    `json:"created_by"`
+	Archived       bool           `json:"archived"`
 
 	Warnings []TemplateVersionWarning `json:"warnings,omitempty" enums:"DEPRECATED_PARAMETERS"`
 }
 
-type TemplateVersionGitAuth struct {
-	ID              string      `json:"id"`
-	Type            GitProvider `json:"type"`
-	AuthenticateURL string      `json:"authenticate_url"`
-	Authenticated   bool        `json:"authenticated"`
+type TemplateVersionExternalAuth struct {
+	ID              string `json:"id"`
+	Type            string `json:"type"`
+	DisplayName     string `json:"display_name"`
+	DisplayIcon     string `json:"display_icon"`
+	AuthenticateURL string `json:"authenticate_url"`
+	Authenticated   bool   `json:"authenticated"`
 }
 
 type ValidationMonotonicOrder string
@@ -132,9 +135,9 @@ func (c *Client) TemplateVersionRichParameters(ctx context.Context, version uuid
 	return params, json.NewDecoder(res.Body).Decode(&params)
 }
 
-// TemplateVersionGitAuth returns git authentication for the requested template version.
-func (c *Client) TemplateVersionGitAuth(ctx context.Context, version uuid.UUID) ([]TemplateVersionGitAuth, error) {
-	res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/api/v2/templateversions/%s/gitauth", version), nil)
+// TemplateVersionExternalAuth returns authentication providers for the requested template version.
+func (c *Client) TemplateVersionExternalAuth(ctx context.Context, version uuid.UUID) ([]TemplateVersionExternalAuth, error) {
+	res, err := c.Request(ctx, http.MethodGet, fmt.Sprintf("/api/v2/templateversions/%s/external-auth", version), nil)
 	if err != nil {
 		return nil, err
 	}
@@ -142,8 +145,8 @@ func (c *Client) TemplateVersionGitAuth(ctx context.Context, version uuid.UUID)
 	if res.StatusCode != http.StatusOK {
 		return nil, ReadBodyAsError(res)
 	}
-	var gitAuth []TemplateVersionGitAuth
-	return gitAuth, json.NewDecoder(res.Body).Decode(&gitAuth)
+	var extAuth []TemplateVersionExternalAuth
+	return extAuth, json.NewDecoder(res.Body).Decode(&extAuth)
 }
 
 // TemplateVersionResources returns resources a template version declares.
diff --git a/codersdk/time_test.go b/codersdk/time_test.go
index c9f5ca05839f3..a2d3b20622ba7 100644
--- a/codersdk/time_test.go
+++ b/codersdk/time_test.go
@@ -9,7 +9,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func TestNullTime_MarshalJSON(t *testing.T) {
diff --git a/codersdk/users.go b/codersdk/users.go
index daeefee5f12bf..c11846ebdac2b 100644
--- a/codersdk/users.go
+++ b/codersdk/users.go
@@ -78,9 +78,12 @@ type CreateFirstUserResponse struct {
 type CreateUserRequest struct {
 	Email    string `json:"email" validate:"required,email" format:"email"`
 	Username string `json:"username" validate:"required,username"`
-	Password string `json:"password" validate:"required_if=DisableLogin false"`
+	Password string `json:"password"`
+	// UserLoginType defaults to LoginTypePassword.
+	UserLoginType LoginType `json:"login_type"`
 	// DisableLogin sets the user's login type to 'none'. This prevents the user
 	// from being able to use a password or any other authentication method to login.
+	// Deprecated: Set UserLoginType=LoginTypeDisabled instead.
 	DisableLogin   bool      `json:"disable_login"`
 	OrganizationID uuid.UUID `json:"organization_id" validate:"" format:"uuid"`
 }
diff --git a/codersdk/workspaceagentconn.go b/codersdk/workspaceagentconn.go
index 6b9b6f0d33f44..e38b4f2a47f06 100644
--- a/codersdk/workspaceagentconn.go
+++ b/codersdk/workspaceagentconn.go
@@ -21,8 +21,8 @@ import (
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/net/speedtest"
 
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/tailnet"
 )
 
 // WorkspaceAgentIP is a static IPv6 address with the Tailscale prefix that is used to route
diff --git a/codersdk/workspaceagents.go b/codersdk/workspaceagents.go
index e9aad8421e36a..c59321d607e14 100644
--- a/codersdk/workspaceagents.go
+++ b/codersdk/workspaceagents.go
@@ -20,8 +20,8 @@ import (
 	"tailscale.com/tailcfg"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/tailnet"
 	"github.com/coder/retry"
 )
 
@@ -58,7 +58,7 @@ const (
 // Starting returns true if the agent is in the process of starting.
 func (l WorkspaceAgentLifecycle) Starting() bool {
 	switch l {
-	case WorkspaceAgentLifecycleCreated, WorkspaceAgentLifecycleStarting, WorkspaceAgentLifecycleStartTimeout:
+	case WorkspaceAgentLifecycleCreated, WorkspaceAgentLifecycleStarting:
 		return true
 	default:
 		return false
@@ -101,6 +101,7 @@ var WorkspaceAgentLifecycleOrder = []WorkspaceAgentLifecycle{
 // ready (can be overridden).
 //
 // Presently, non-blocking is the default, but this may change in the future.
+// Deprecated: `coder_script` allows configuration on a per-script basis.
 type WorkspaceAgentStartupScriptBehavior string
 
 const (
@@ -133,42 +134,72 @@ type WorkspaceAgentMetadata struct {
 	Description WorkspaceAgentMetadataDescription `json:"description"`
 }
 
+type DisplayApp string
+
+const (
+	DisplayAppVSCodeDesktop  DisplayApp = "vscode"
+	DisplayAppVSCodeInsiders DisplayApp = "vscode_insiders"
+	DisplayAppWebTerminal    DisplayApp = "web_terminal"
+	DisplayAppPortForward    DisplayApp = "port_forwarding_helper"
+	DisplayAppSSH            DisplayApp = "ssh_helper"
+)
+
 type WorkspaceAgent struct {
-	ID                          uuid.UUID                           `json:"id" format:"uuid"`
-	CreatedAt                   time.Time                           `json:"created_at" format:"date-time"`
-	UpdatedAt                   time.Time                           `json:"updated_at" format:"date-time"`
-	FirstConnectedAt            *time.Time                          `json:"first_connected_at,omitempty" format:"date-time"`
-	LastConnectedAt             *time.Time                          `json:"last_connected_at,omitempty" format:"date-time"`
-	DisconnectedAt              *time.Time                          `json:"disconnected_at,omitempty" format:"date-time"`
-	StartedAt                   *time.Time                          `json:"started_at,omitempty" format:"date-time"`
-	ReadyAt                     *time.Time                          `json:"ready_at,omitempty" format:"date-time"`
-	Status                      WorkspaceAgentStatus                `json:"status"`
-	LifecycleState              WorkspaceAgentLifecycle             `json:"lifecycle_state"`
-	Name                        string                              `json:"name"`
-	ResourceID                  uuid.UUID                           `json:"resource_id" format:"uuid"`
-	InstanceID                  string                              `json:"instance_id,omitempty"`
-	Architecture                string                              `json:"architecture"`
-	EnvironmentVariables        map[string]string                   `json:"environment_variables"`
-	OperatingSystem             string                              `json:"operating_system"`
-	StartupScript               string                              `json:"startup_script,omitempty"`
-	StartupScriptBehavior       WorkspaceAgentStartupScriptBehavior `json:"startup_script_behavior"`
-	StartupScriptTimeoutSeconds int32                               `json:"startup_script_timeout_seconds"` // StartupScriptTimeoutSeconds is the number of seconds to wait for the startup script to complete. If the script does not complete within this time, the agent lifecycle will be marked as start_timeout.
-	LogsLength                  int32                               `json:"logs_length"`
-	LogsOverflowed              bool                                `json:"logs_overflowed"`
-	Directory                   string                              `json:"directory,omitempty"`
-	ExpandedDirectory           string                              `json:"expanded_directory,omitempty"`
-	Version                     string                              `json:"version"`
-	Apps                        []WorkspaceApp                      `json:"apps"`
+	ID                   uuid.UUID               `json:"id" format:"uuid"`
+	CreatedAt            time.Time               `json:"created_at" format:"date-time"`
+	UpdatedAt            time.Time               `json:"updated_at" format:"date-time"`
+	FirstConnectedAt     *time.Time              `json:"first_connected_at,omitempty" format:"date-time"`
+	LastConnectedAt      *time.Time              `json:"last_connected_at,omitempty" format:"date-time"`
+	DisconnectedAt       *time.Time              `json:"disconnected_at,omitempty" format:"date-time"`
+	StartedAt            *time.Time              `json:"started_at,omitempty" format:"date-time"`
+	ReadyAt              *time.Time              `json:"ready_at,omitempty" format:"date-time"`
+	Status               WorkspaceAgentStatus    `json:"status"`
+	LifecycleState       WorkspaceAgentLifecycle `json:"lifecycle_state"`
+	Name                 string                  `json:"name"`
+	ResourceID           uuid.UUID               `json:"resource_id" format:"uuid"`
+	InstanceID           string                  `json:"instance_id,omitempty"`
+	Architecture         string                  `json:"architecture"`
+	EnvironmentVariables map[string]string       `json:"environment_variables"`
+	OperatingSystem      string                  `json:"operating_system"`
+	LogsLength           int32                   `json:"logs_length"`
+	LogsOverflowed       bool                    `json:"logs_overflowed"`
+	Directory            string                  `json:"directory,omitempty"`
+	ExpandedDirectory    string                  `json:"expanded_directory,omitempty"`
+	Version              string                  `json:"version"`
+	Apps                 []WorkspaceApp          `json:"apps"`
 	// DERPLatency is mapped by region name (e.g. "New York City", "Seattle").
-	DERPLatency              map[string]DERPRegion `json:"latency,omitempty"`
-	ConnectionTimeoutSeconds int32                 `json:"connection_timeout_seconds"`
-	TroubleshootingURL       string                `json:"troubleshooting_url"`
-	// Deprecated: Use StartupScriptBehavior instead.
-	LoginBeforeReady             bool                 `json:"login_before_ready"`
-	ShutdownScript               string               `json:"shutdown_script,omitempty"`
-	ShutdownScriptTimeoutSeconds int32                `json:"shutdown_script_timeout_seconds"`
-	Subsystem                    AgentSubsystem       `json:"subsystem"`
-	Health                       WorkspaceAgentHealth `json:"health"` // Health reports the health of the agent.
+	DERPLatency              map[string]DERPRegion     `json:"latency,omitempty"`
+	ConnectionTimeoutSeconds int32                     `json:"connection_timeout_seconds"`
+	TroubleshootingURL       string                    `json:"troubleshooting_url"`
+	Subsystems               []AgentSubsystem          `json:"subsystems"`
+	Health                   WorkspaceAgentHealth      `json:"health"` // Health reports the health of the agent.
+	DisplayApps              []DisplayApp              `json:"display_apps"`
+	LogSources               []WorkspaceAgentLogSource `json:"log_sources"`
+	Scripts                  []WorkspaceAgentScript    `json:"scripts"`
+
+	// StartupScriptBehavior is a legacy field that is deprecated in favor
+	// of the `coder_script` resource. It's only referenced by old clients.
+	// Deprecated: Remove in the future!
+	StartupScriptBehavior WorkspaceAgentStartupScriptBehavior `json:"startup_script_behavior"`
+}
+
+type WorkspaceAgentLogSource struct {
+	WorkspaceAgentID uuid.UUID `json:"workspace_agent_id" format:"uuid"`
+	ID               uuid.UUID `json:"id" format:"uuid"`
+	CreatedAt        time.Time `json:"created_at" format:"date-time"`
+	DisplayName      string    `json:"display_name"`
+	Icon             string    `json:"icon"`
+}
+
+type WorkspaceAgentScript struct {
+	LogSourceID      uuid.UUID     `json:"log_source_id" format:"uuid"`
+	LogPath          string        `json:"log_path"`
+	Script           string        `json:"script"`
+	Cron             string        `json:"cron"`
+	RunOnStart       bool          `json:"run_on_start"`
+	RunOnStop        bool          `json:"run_on_stop"`
+	StartBlocksLogin bool          `json:"start_blocks_login"`
+	Timeout          time.Duration `json:"timeout"`
 }
 
 type WorkspaceAgentHealth struct {
@@ -186,6 +217,7 @@ type DERPRegion struct {
 // @typescript-ignore WorkspaceAgentConnectionInfo
 type WorkspaceAgentConnectionInfo struct {
 	DERPMap                  *tailcfg.DERPMap `json:"derp_map"`
+	DERPForceWebSockets      bool             `json:"derp_force_websockets"`
 	DisableDirectConnections bool             `json:"disable_direct_connections"`
 }
 
@@ -247,11 +279,12 @@ func (c *Client) DialWorkspaceAgent(ctx context.Context, agentID uuid.UUID, opti
 		header = headerTransport.Header()
 	}
 	conn, err := tailnet.NewConn(&tailnet.Options{
-		Addresses:      []netip.Prefix{netip.PrefixFrom(ip, 128)},
-		DERPMap:        connInfo.DERPMap,
-		DERPHeader:     &header,
-		Logger:         options.Logger,
-		BlockEndpoints: c.DisableDirectConnections || options.BlockEndpoints,
+		Addresses:           []netip.Prefix{netip.PrefixFrom(ip, 128)},
+		DERPMap:             connInfo.DERPMap,
+		DERPHeader:          &header,
+		DERPForceWebSockets: connInfo.DERPForceWebSockets,
+		Logger:              options.Logger,
+		BlockEndpoints:      c.DisableDirectConnections || options.BlockEndpoints,
 	})
 	if err != nil {
 		return nil, xerrors.Errorf("create tailnet: %w", err)
@@ -517,13 +550,6 @@ func (c *Client) WorkspaceAgent(ctx context.Context, id uuid.UUID) (WorkspaceAge
 	if err != nil {
 		return WorkspaceAgent{}, err
 	}
-	// Backwards compatibility for cases where the API is older then the client.
-	if workspaceAgent.StartupScriptBehavior == "" {
-		workspaceAgent.StartupScriptBehavior = WorkspaceAgentStartupScriptBehaviorNonBlocking
-		if !workspaceAgent.LoginBeforeReady {
-			workspaceAgent.StartupScriptBehavior = WorkspaceAgentStartupScriptBehaviorBlocking
-		}
-	}
 	return workspaceAgent, nil
 }
 
@@ -690,7 +716,7 @@ func (c *Client) WorkspaceAgentLogsAfter(ctx context.Context, agentID uuid.UUID,
 		}
 		return nil, nil, ReadBodyAsError(res)
 	}
-	logChunks := make(chan []WorkspaceAgentLog)
+	logChunks := make(chan []WorkspaceAgentLog, 1)
 	closed := make(chan struct{})
 	ctx, wsNetConn := websocketNetConn(ctx, conn, websocket.MessageText)
 	decoder := json.NewDecoder(wsNetConn)
@@ -718,52 +744,27 @@ func (c *Client) WorkspaceAgentLogsAfter(ctx context.Context, agentID uuid.UUID,
 	}), nil
 }
 
-// GitProvider is a constant that represents the
-// type of providers that are supported within Coder.
-type GitProvider string
-
-func (g GitProvider) Pretty() string {
-	switch g {
-	case GitProviderAzureDevops:
-		return "Azure DevOps"
-	case GitProviderGitHub:
-		return "GitHub"
-	case GitProviderGitLab:
-		return "GitLab"
-	case GitProviderBitBucket:
-		return "Bitbucket"
-	default:
-		return string(g)
-	}
-}
-
-const (
-	GitProviderAzureDevops GitProvider = "azure-devops"
-	GitProviderGitHub      GitProvider = "github"
-	GitProviderGitLab      GitProvider = "gitlab"
-	GitProviderBitBucket   GitProvider = "bitbucket"
-)
-
 type WorkspaceAgentLog struct {
 	ID        int64     `json:"id"`
 	CreatedAt time.Time `json:"created_at" format:"date-time"`
 	Output    string    `json:"output"`
 	Level     LogLevel  `json:"level"`
+	SourceID  uuid.UUID `json:"source_id" format:"uuid"`
 }
 
 type AgentSubsystem string
 
 const (
-	AgentSubsystemEnvbox AgentSubsystem = "envbox"
+	AgentSubsystemEnvbox     AgentSubsystem = "envbox"
+	AgentSubsystemEnvbuilder AgentSubsystem = "envbuilder"
+	AgentSubsystemExectrace  AgentSubsystem = "exectrace"
 )
 
-type WorkspaceAgentLogSource string
-
-const (
-	WorkspaceAgentLogSourceStartupScript  WorkspaceAgentLogSource = "startup_script"
-	WorkspaceAgentLogSourceShutdownScript WorkspaceAgentLogSource = "shutdown_script"
-	WorkspaceAgentLogSourceKubernetes     WorkspaceAgentLogSource = "kubernetes"
-	WorkspaceAgentLogSourceEnvbox         WorkspaceAgentLogSource = "envbox"
-	WorkspaceAgentLogSourceEnvbuilder     WorkspaceAgentLogSource = "envbuilder"
-	WorkspaceAgentLogSourceExternal       WorkspaceAgentLogSource = "external"
-)
+func (s AgentSubsystem) Valid() bool {
+	switch s {
+	case AgentSubsystemEnvbox, AgentSubsystemEnvbuilder, AgentSubsystemExectrace:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/codersdk/workspaceagents_test.go b/codersdk/workspaceagents_test.go
index 6373160c299e1..766203268c20a 100644
--- a/codersdk/workspaceagents_test.go
+++ b/codersdk/workspaceagents_test.go
@@ -15,9 +15,9 @@ import (
 	"tailscale.com/tailcfg"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestWorkspaceAgentMetadata(t *testing.T) {
diff --git a/codersdk/workspaceapps.go b/codersdk/workspaceapps.go
index ba2e7255888cc..9c8d89b42f65a 100644
--- a/codersdk/workspaceapps.go
+++ b/codersdk/workspaceapps.go
@@ -41,8 +41,10 @@ type WorkspaceApp struct {
 	// `coder server` or via a hostname-based dev URL. If this is set to true
 	// and there is no app wildcard configured on the server, the app will not
 	// be accessible in the UI.
-	Subdomain    bool                     `json:"subdomain"`
-	SharingLevel WorkspaceAppSharingLevel `json:"sharing_level" enums:"owner,authenticated,public"`
+	Subdomain bool `json:"subdomain"`
+	// SubdomainName is the application domain exposed on the `coder server`.
+	SubdomainName string                   `json:"subdomain_name,omitempty"`
+	SharingLevel  WorkspaceAppSharingLevel `json:"sharing_level" enums:"owner,authenticated,public"`
 	// Healthcheck specifies the configuration for checking app health.
 	Healthcheck Healthcheck        `json:"healthcheck"`
 	Health      WorkspaceAppHealth `json:"health"`
diff --git a/codersdk/workspaces.go b/codersdk/workspaces.go
index a2ef823fcb87e..54f79aa58725d 100644
--- a/codersdk/workspaces.go
+++ b/codersdk/workspaces.go
@@ -11,7 +11,14 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/tracing"
+)
+
+type AutomaticUpdates string
+
+const (
+	AutomaticUpdatesAlways AutomaticUpdates = "always"
+	AutomaticUpdatesNever  AutomaticUpdates = "never"
 )
 
 // Workspace is a deployment of a template. It references a specific
@@ -28,6 +35,8 @@ type Workspace struct {
 	TemplateDisplayName                  string         `json:"template_display_name"`
 	TemplateIcon                         string         `json:"template_icon"`
 	TemplateAllowUserCancelWorkspaceJobs bool           `json:"template_allow_user_cancel_workspace_jobs"`
+	TemplateActiveVersionID              uuid.UUID      `json:"template_active_version_id" format:"uuid"`
+	TemplateRequireActiveVersion         bool           `json:"template_require_active_version"`
 	LatestBuild                          WorkspaceBuild `json:"latest_build"`
 	Outdated                             bool           `json:"outdated"`
 	Name                                 string         `json:"name"`
@@ -35,17 +44,23 @@ type Workspace struct {
 	TTLMillis                            *int64         `json:"ttl_ms,omitempty"`
 	LastUsedAt                           time.Time      `json:"last_used_at" format:"date-time"`
 
-	// DeletingAt indicates the time of the upcoming workspace deletion, if applicable; otherwise it is nil.
-	// Workspaces may have impending deletions if Template.InactivityTTL feature is turned on and the workspace is inactive.
+	// DeletingAt indicates the time at which the workspace will be permanently deleted.
+	// A workspace is eligible for deletion if it is dormant (a non-nil dormant_at value)
+	// and a value has been specified for time_til_dormant_autodelete on its template.
 	DeletingAt *time.Time `json:"deleting_at" format:"date-time"`
-	// LockedAt being non-nil indicates a workspace that has been locked.
-	// A locked workspace is no longer accessible by a user and must be
-	// unlocked by an admin. It is subject to deletion if it breaches
-	// the duration of the locked_ttl field on its template.
-	LockedAt *time.Time `json:"locked_at" format:"date-time"`
+	// DormantAt being non-nil indicates a workspace that is dormant.
+	// A dormant workspace is no longer accessible must be activated.
+	// It is subject to deletion if it breaches
+	// the duration of the time_til_ field on its template.
+	DormantAt *time.Time `json:"dormant_at" format:"date-time"`
 	// Health shows the health of the workspace and information about
 	// what is causing an unhealthy status.
-	Health WorkspaceHealth `json:"health"`
+	Health           WorkspaceHealth  `json:"health"`
+	AutomaticUpdates AutomaticUpdates `json:"automatic_updates" enums:"always,never"`
+}
+
+func (w Workspace) FullName() string {
+	return fmt.Sprintf("%s/%s", w.OwnerName, w.Name)
 }
 
 type WorkspaceHealth struct {
@@ -129,9 +144,9 @@ func (c *Client) getWorkspace(ctx context.Context, id uuid.UUID, opts ...Request
 }
 
 type WorkspaceBuildsRequest struct {
-	WorkspaceID uuid.UUID
+	WorkspaceID uuid.UUID `json:"workspace_id" format:"uuid" typescript:"-"`
 	Pagination
-	Since time.Time
+	Since time.Time `json:"since,omitempty" format:"date-time"`
 }
 
 func (c *Client) WorkspaceBuilds(ctx context.Context, req WorkspaceBuildsRequest) ([]WorkspaceBuild, error) {
@@ -289,14 +304,16 @@ func (c *Client) PutExtendWorkspace(ctx context.Context, id uuid.UUID, req PutEx
 	return nil
 }
 
-// UpdateWorkspaceLock is a request to lock or unlock a workspace.
-type UpdateWorkspaceLock struct {
-	Lock bool `json:"lock"`
+// UpdateWorkspaceDormancy is a request to activate or make a workspace dormant.
+// A value of false will activate a dormant workspace.
+type UpdateWorkspaceDormancy struct {
+	Dormant bool `json:"dormant"`
 }
 
-// UpdateWorkspaceLock locks or unlocks a workspace.
-func (c *Client) UpdateWorkspaceLock(ctx context.Context, id uuid.UUID, req UpdateWorkspaceLock) error {
-	path := fmt.Sprintf("/api/v2/workspaces/%s/lock", id.String())
+// UpdateWorkspaceDormancy sets a workspace as dormant if dormant=true and activates a dormant workspace
+// if dormant=false.
+func (c *Client) UpdateWorkspaceDormancy(ctx context.Context, id uuid.UUID, req UpdateWorkspaceDormancy) error {
+	path := fmt.Sprintf("/api/v2/workspaces/%s/dormant", id.String())
 	res, err := c.Request(ctx, http.MethodPut, path, req)
 	if err != nil {
 		return xerrors.Errorf("update workspace lock: %w", err)
@@ -308,6 +325,25 @@ func (c *Client) UpdateWorkspaceLock(ctx context.Context, id uuid.UUID, req Upda
 	return nil
 }
 
+// UpdateWorkspaceAutomaticUpdatesRequest is a request to updates a workspace's automatic updates setting.
+type UpdateWorkspaceAutomaticUpdatesRequest struct {
+	AutomaticUpdates AutomaticUpdates `json:"automatic_updates"`
+}
+
+// UpdateWorkspaceAutomaticUpdates sets the automatic updates setting for workspace by id.
+func (c *Client) UpdateWorkspaceAutomaticUpdates(ctx context.Context, id uuid.UUID, req UpdateWorkspaceAutomaticUpdatesRequest) error {
+	path := fmt.Sprintf("/api/v2/workspaces/%s/autoupdates", id.String())
+	res, err := c.Request(ctx, http.MethodPut, path, req)
+	if err != nil {
+		return xerrors.Errorf("update workspace automatic updates: %w", err)
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusNoContent {
+		return ReadBodyAsError(res)
+	}
+	return nil
+}
+
 type WorkspaceFilter struct {
 	// Owner can be "me" or a username
 	Owner string `json:"owner,omitempty" typescript:"-"`
diff --git a/cryptorand/errors_test.go b/cryptorand/errors_test.go
index 36ce2faf6beab..6abc2143875e2 100644
--- a/cryptorand/errors_test.go
+++ b/cryptorand/errors_test.go
@@ -8,7 +8,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 // TestRandError checks that the code handles errors when reading from
diff --git a/cryptorand/numbers_test.go b/cryptorand/numbers_test.go
index 0ffedf78b9d9e..aec9c89a7476c 100644
--- a/cryptorand/numbers_test.go
+++ b/cryptorand/numbers_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 func TestInt63(t *testing.T) {
diff --git a/cryptorand/slices_test.go b/cryptorand/slices_test.go
index f4c7be248c0cc..1838bcf6119da 100644
--- a/cryptorand/slices_test.go
+++ b/cryptorand/slices_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 func TestRandomElement(t *testing.T) {
diff --git a/cryptorand/strings_test.go b/cryptorand/strings_test.go
index 3f6025e0f9588..60be57ce0f400 100644
--- a/cryptorand/strings_test.go
+++ b/cryptorand/strings_test.go
@@ -10,7 +10,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 func TestString(t *testing.T) {
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index e794828520e81..1a7fe4db75e8b 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -2,13 +2,17 @@
 
 ## Requirements
 
-We recommend using the [Nix](https://nix.dev/) package manager as it makes any pain related to maintaining dependency versions [just disappear](https://twitter.com/mitchellh/status/1491102567296040961). Once nix [has been installed](https://nixos.org/download.html) the development environment can be _manually instantiated_ through the `nix-shell` command:
+We recommend using the [Nix](https://nix.dev/) package manager as it makes any
+pain related to maintaining dependency versions
+[just disappear](https://twitter.com/mitchellh/status/1491102567296040961). Once
+nix [has been installed](https://nixos.org/download.html) the development
+environment can be _manually instantiated_ through the `nix-shell` command:
 
-```
-$ cd ~/code/coder
+```shell
+cd ~/code/coder
 
 # https://nix.dev/tutorials/declarative-and-reproducible-developer-environments
-$ nix-shell
+nix-shell
 
 ...
 copying path '/nix/store/3ms6cs5210n8vfb5a7jkdvzrzdagqzbp-iana-etc-20210225' from 'https://cache.nixos.org'...
@@ -17,20 +21,24 @@ copying path '/nix/store/v2gvj8whv241nj4lzha3flq8pnllcmvv-ignore-5.2.0.tgz' from
 ...
 ```
 
-If [direnv](https://direnv.net/) is installed and the [hooks are configured](https://direnv.net/docs/hook.html) then the development environment can be _automatically instantiated_ by creating the following `.envrc`, thus removing the need to run `nix-shell` by hand!
+If [direnv](https://direnv.net/) is installed and the
+[hooks are configured](https://direnv.net/docs/hook.html) then the development
+environment can be _automatically instantiated_ by creating the following
+`.envrc`, thus removing the need to run `nix-shell` by hand!
 
-```
-$ cd ~/code/coder
-$ echo "use nix" >.envrc
-$ direnv allow
+```shell
+cd ~/code/coder
+echo "use nix" >.envrc
+direnv allow
 ```
 
-Now, whenever you enter the project folder, `direnv` will prepare the environment for you:
+Now, whenever you enter the project folder,
+[`direnv`](https://direnv.net/docs/hook.html) will prepare the environment for
+you:
 
-```
-$ cd ~/code/coder
+```shell
+cd ~/code/coder
 
-# https://direnv.net/docs/hook.html
 direnv: loading ~/code/coder/.envrc
 direnv: using nix
 direnv: export +AR +AS +CC +CONFIG_SHELL +CXX +HOST_PATH +IN_NIX_SHELL +LD +NIX_BINTOOLS +NIX_BINTOOLS_WRAPPER_TARGET_HOST_x86_64_unknown_linux_gnu +NIX_BUILD_CORES +NIX_BUILD_TOP +NIX_CC +NIX_CC_WRAPPER_TARGET_HOST_x86_64_unknown_linux_gnu +NIX_CFLAGS_COMPILE +NIX_ENFORCE_NO_NATIVE +NIX_HARDENING_ENABLE +NIX_INDENT_MAKE +NIX_LDFLAGS +NIX_STORE +NM +NODE_PATH +OBJCOPY +OBJDUMP +RANLIB +READELF +SIZE +SOURCE_DATE_EPOCH +STRINGS +STRIP +TEMP +TEMPDIR +TMP +TMPDIR +XDG_DATA_DIRS +buildInputs +buildPhase +builder +cmakeFlags +configureFlags +depsBuildBuild +depsBuildBuildPropagated +depsBuildTarget +depsBuildTargetPropagated +depsHostHost +depsHostHostPropagated +depsTargetTarget +depsTargetTargetPropagated +doCheck +doInstallCheck +mesonFlags +name +nativeBuildInputs +out +outputs +patches +phases +propagatedBuildInputs +propagatedNativeBuildInputs +shell +shellHook +stdenv +strictDeps +system ~PATH
@@ -38,7 +46,8 @@ direnv: export +AR +AS +CC +CONFIG_SHELL +CXX +HOST_PATH +IN_NIX_SHELL +LD +NIX_
 🎉
 ```
 
-Alternatively if you do not want to use nix then you'll need to install the need the following tools by hand:
+Alternatively if you do not want to use nix then you'll need to install the need
+the following tools by hand:
 
 - Go 1.18+
   - on macOS, run `brew install go`
@@ -53,15 +62,15 @@ Alternatively if you do not want to use nix then you'll need to install the need
 - [`pg_dump`](https://stackoverflow.com/a/49689589)
   - on macOS, run `brew install libpq zstd`
   - on Linux, install [`zstd`](https://github.com/horta/zstd.install)
-- [`pkg-config`]()
+- `pkg-config`
   - on macOS, run `brew install pkg-config`
-- [`pixman`]()
+- `pixman`
   - on macOS, run `brew install pixman`
-- [`cairo`]()
+- `cairo`
   - on macOS, run `brew install cairo`
-- [`pango`]()
+- `pango`
   - on macOS, run `brew install pango`
-- [`pandoc`]()
+- `pandoc`
   - on macOS, run `brew install pandocomatic`
 
 ### Development workflow
@@ -77,44 +86,58 @@ Use the following `make` commands and scripts in development:
 
 - Run `./scripts/develop.sh`
 - Access `http://localhost:8080`
-- The default user is `admin@coder.com` and the default password is `SomeSecurePassword!`
+- The default user is `admin@coder.com` and the default password is
+  `SomeSecurePassword!`
 
 ### Deploying a PR
 
-You can test your changes by creating a PR deployment. There are two ways to do this:
+You can test your changes by creating a PR deployment. There are two ways to do
+this:
 
 1. By running `./scripts/deploy-pr.sh`
-2. By manually triggering the [`pr-deploy.yaml`](https://github.com/coder/coder/actions/workflows/pr-deploy.yaml) GitHub Action workflow
-   ![Deploy PR manually](./images/pr-deploy-manual.png)
+2. By manually triggering the
+   [`pr-deploy.yaml`](https://github.com/coder/coder/actions/workflows/pr-deploy.yaml)
+   GitHub Action workflow ![Deploy PR manually](./images/deploy-pr-manually.png)
 
 #### Available options
 
-- `-s` or `--skip-build`, force prevents the build of the Docker image.(generally not needed as we are intelligently checking if the image needs to be built)
-- `-e EXPERIMENT1,EXPERIMENT2` or `--experiments EXPERIMENT1,EXPERIMENT2`, will enable the specified experiments. (defaults to `*`)
-- `-n` or `--dry-run` will display the context without deployment. e.g., branch name and PR number, etc.
+- `-d` or `--deploy`, force deploys the PR by deleting the existing deployment.
+- `-b` or `--build`, force builds the Docker image. (generally not needed as we
+  are intelligently checking if the image needs to be built)
+- `-e EXPERIMENT1,EXPERIMENT2` or `--experiments EXPERIMENT1,EXPERIMENT2`, will
+  enable the specified experiments. (defaults to `*`)
+- `-n` or `--dry-run` will display the context without deployment. e.g., branch
+  name and PR number, etc.
 - `-y` or `--yes`, will skip the CLI confirmation prompt.
 
-> Note: PR deployment will be re-deployed automatically when the PR is updated. It will use the last values automatically for redeployment.
+> Note: PR deployment will be re-deployed automatically when the PR is updated.
+> It will use the last values automatically for redeployment.
 
-> You need to be a member or collaborator of the of [coder](github.com/coder) GitHub organization to be able to deploy a PR.
+> You need to be a member or collaborator of the of
+> [coder](https://github.com/coder) GitHub organization to be able to deploy a
+> PR.
 
-Once the deployment is finished, a unique link and credentials will be posted in the [#pr-deployments](https://codercom.slack.com/archives/C05DNE982E8) Slack channel.
+Once the deployment is finished, a unique link and credentials will be posted in
+the [#pr-deployments](https://codercom.slack.com/archives/C05DNE982E8) Slack
+channel.
 
 ### Adding database migrations and fixtures
 
 #### Database migrations
 
-Database migrations are managed with [`migrate`](https://github.com/golang-migrate/migrate).
+Database migrations are managed with
+[`migrate`](https://github.com/golang-migrate/migrate).
 
 To add new migrations, use the following command:
 
-```
-$ ./coderd/database/migrations/create_fixture.sh my name
+```shell
+./coderd/database/migrations/create_fixture.sh my name
 /home/coder/src/coder/coderd/database/migrations/000070_my_name.up.sql
 /home/coder/src/coder/coderd/database/migrations/000070_my_name.down.sql
-Run "make gen" to generate models.
 ```
 
+Run "make gen" to generate models.
+
 Then write queries into the generated `.up.sql` and `.down.sql` files and commit
 them into the repository. The down script should make a best-effort to retain as
 much data as possible.
@@ -124,11 +147,15 @@ much data as possible.
 There are two types of fixtures that are used to test that migrations don't
 break existing Coder deployments:
 
-- Partial fixtures [`migrations/testdata/fixtures`](../coderd/database/migrations/testdata/fixtures)
-- Full database dumps [`migrations/testdata/full_dumps`](../coderd/database/migrations/testdata/full_dumps)
+- Partial fixtures
+  [`migrations/testdata/fixtures`](../coderd/database/migrations/testdata/fixtures)
+- Full database dumps
+  [`migrations/testdata/full_dumps`](../coderd/database/migrations/testdata/full_dumps)
 
-Both types behave like database migrations (they also [`migrate`](https://github.com/golang-migrate/migrate)). Their behavior mirrors Coder migrations such that when migration
-number `000022` is applied, fixture `000022` is applied afterwards.
+Both types behave like database migrations (they also
+[`migrate`](https://github.com/golang-migrate/migrate)). Their behavior mirrors
+Coder migrations such that when migration number `000022` is applied, fixture
+`000022` is applied afterwards.
 
 Partial fixtures are used to conveniently add data to newly created tables so
 that we can ensure that this data is migrated without issue.
@@ -140,8 +167,8 @@ migration of multiple features or complex configurations.
 
 To add a new partial fixture, run the following command:
 
-```
-$ ./coderd/database/migrations/create_fixture.sh my fixture
+```shell
+./coderd/database/migrations/create_fixture.sh my fixture
 /home/coder/src/coder/coderd/database/migrations/testdata/fixtures/000070_my_fixture.up.sql
 ```
 
@@ -153,9 +180,9 @@ To create a full dump, run a fully fledged Coder deployment and use it to
 generate data in the database. Then shut down the deployment and take a snapshot
 of the database.
 
-```
-$ mkdir -p coderd/database/migrations/testdata/full_dumps/v0.12.2 && cd $_
-$ pg_dump "postgres://coder@localhost:..." -a --inserts >000069_dump_v0.12.2.up.sql
+```shell
+mkdir -p coderd/database/migrations/testdata/full_dumps/v0.12.2 && cd $_
+pg_dump "postgres://coder@localhost:..." -a --inserts >000069_dump_v0.12.2.up.sql
 ```
 
 Make sure sensitive data in the dump is desensitized, for instance names,
@@ -164,8 +191,8 @@ emails, OAuth tokens and other secrets. Then commit the dump to the project.
 To find out what the latest migration for a version of Coder is, use the
 following command:
 
-```
-$ git ls-files v0.12.2 -- coderd/database/migrations/*.up.sql
+```shell
+git ls-files v0.12.2 -- coderd/database/migrations/*.up.sql
 ```
 
 This helps in naming the dump (e.g. `000069` above).
@@ -174,19 +201,20 @@ This helps in naming the dump (e.g. `000069` above).
 
 ### Documentation
 
-Our style guide for authoring documentation can be found [here](./contributing/documentation.md).
+Our style guide for authoring documentation can be found
+[here](./contributing/documentation.md).
 
 ### Backend
 
 #### Use Go style
 
-Contributions must adhere to the guidelines outlined in [Effective
-Go](https://go.dev/doc/effective_go). We prefer linting rules over documenting
-styles (run ours with `make lint`); humans are error-prone!
+Contributions must adhere to the guidelines outlined in
+[Effective Go](https://go.dev/doc/effective_go). We prefer linting rules over
+documenting styles (run ours with `make lint`); humans are error-prone!
 
-Read [Go's Code Review Comments
-Wiki](https://github.com/golang/go/wiki/CodeReviewComments) for information on
-common comments made during reviews of Go code.
+Read
+[Go's Code Review Comments Wiki](https://github.com/golang/go/wiki/CodeReviewComments)
+for information on common comments made during reviews of Go code.
 
 #### Avoid unused packages
 
@@ -201,8 +229,8 @@ Our frontend guide can be found [here](./contributing/frontend.md).
 
 ## Reviews
 
-> The following information has been borrowed from [Go's review
-> philosophy](https://go.dev/doc/contribute#reviews).
+> The following information has been borrowed from
+> [Go's review philosophy](https://go.dev/doc/contribute#reviews).
 
 Coder values thorough reviews. For each review comment that you receive, please
 "close" it by implementing the suggestion or providing an explanation on why the
@@ -219,27 +247,45 @@ be applied selectively or to discourage anyone from contributing.
 
 ## Releases
 
-Coder releases are initiated via [`./scripts/release.sh`](../scripts/release.sh) and automated via GitHub Actions. Specifically, the [`release.yaml`](../.github/workflows/release.yaml) workflow. They are created based on the current [`main`](https://github.com/coder/coder/tree/main) branch.
+Coder releases are initiated via [`./scripts/release.sh`](../scripts/release.sh)
+and automated via GitHub Actions. Specifically, the
+[`release.yaml`](../.github/workflows/release.yaml) workflow. They are created
+based on the current [`main`](https://github.com/coder/coder/tree/main) branch.
 
-The release notes for a release are automatically generated from commit titles and metadata from PRs that are merged into `main`.
+The release notes for a release are automatically generated from commit titles
+and metadata from PRs that are merged into `main`.
 
 ### Creating a release
 
-The creation of a release is initiated via [`./scripts/release.sh`](../scripts/release.sh). This script will show a preview of the release that will be created, and if you choose to continue, create and push the tag which will trigger the creation of the release via GitHub Actions.
+The creation of a release is initiated via
+[`./scripts/release.sh`](../scripts/release.sh). This script will show a preview
+of the release that will be created, and if you choose to continue, create and
+push the tag which will trigger the creation of the release via GitHub Actions.
 
 See `./scripts/release.sh --help` for more information.
 
 ### Creating a release (via workflow dispatch)
 
-Typically the workflow dispatch is only used to test (dry-run) a release, meaning no actual release will take place. The workflow can be dispatched manually from [Actions: Release](https://github.com/coder/coder/actions/workflows/release.yaml). Simply press "Run workflow" and choose dry-run.
+Typically the workflow dispatch is only used to test (dry-run) a release,
+meaning no actual release will take place. The workflow can be dispatched
+manually from
+[Actions: Release](https://github.com/coder/coder/actions/workflows/release.yaml).
+Simply press "Run workflow" and choose dry-run.
 
-If a release has failed after the tag has been created and pushed, it can be retried by again, pressing "Run workflow", changing "Use workflow from" from "Branch: main" to "Tag: vX.X.X" and not selecting dry-run.
+If a release has failed after the tag has been created and pushed, it can be
+retried by again, pressing "Run workflow", changing "Use workflow from" from
+"Branch: main" to "Tag: vX.X.X" and not selecting dry-run.
 
 ### Commit messages
 
-Commit messages should follow the [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) specification.
+Commit messages should follow the
+[Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/)
+specification.
 
-Allowed commit types (`feat`, `fix`, etc.) are listed in [conventional-commit-types](https://github.com/commitizen/conventional-commit-types/blob/c3a9be4c73e47f2e8197de775f41d981701407fb/index.json). Note that these types are also used to automatically sort and organize the release notes.
+Allowed commit types (`feat`, `fix`, etc.) are listed in
+[conventional-commit-types](https://github.com/commitizen/conventional-commit-types/blob/c3a9be4c73e47f2e8197de775f41d981701407fb/index.json).
+Note that these types are also used to automatically sort and organize the
+release notes.
 
 A good commit message title uses the imperative, present tense and is ~50
 characters long (no more than 72).
@@ -249,21 +295,34 @@ Examples:
 - Good: `feat(api): add feature X`
 - Bad: `feat(api): added feature X` (past tense)
 
-A good rule of thumb for writing good commit messages is to recite: [If applied, this commit will ...](https://reflectoring.io/meaningful-commit-messages/).
+A good rule of thumb for writing good commit messages is to recite:
+[If applied, this commit will ...](https://reflectoring.io/meaningful-commit-messages/).
 
-**Note:** We lint PR titles to ensure they follow the Conventional Commits specification, however, it's still possible to merge PRs on GitHub with a badly formatted title. Take care when merging single-commit PRs as GitHub may prefer to use the original commit title instead of the PR title.
+**Note:** We lint PR titles to ensure they follow the Conventional Commits
+specification, however, it's still possible to merge PRs on GitHub with a badly
+formatted title. Take care when merging single-commit PRs as GitHub may prefer
+to use the original commit title instead of the PR title.
 
 ### Breaking changes
 
 Breaking changes can be triggered in two ways:
 
-- Add `!` to the commit message title, e.g. `feat(api)!: remove deprecated endpoint /test`
-- Add the [`release/breaking`](https://github.com/coder/coder/issues?q=sort%3Aupdated-desc+label%3Arelease%2Fbreaking) label to a PR that has, or will be, merged into `main`.
+- Add `!` to the commit message title, e.g.
+  `feat(api)!: remove deprecated endpoint /test`
+- Add the
+  [`release/breaking`](https://github.com/coder/coder/issues?q=sort%3Aupdated-desc+label%3Arelease%2Fbreaking)
+  label to a PR that has, or will be, merged into `main`.
 
 ### Security
 
-The [`security`](https://github.com/coder/coder/issues?q=sort%3Aupdated-desc+label%3Asecurity) label can be added to PRs that have, or will be, merged into `main`. Doing so will make sure the change stands out in the release notes.
+The
+[`security`](https://github.com/coder/coder/issues?q=sort%3Aupdated-desc+label%3Asecurity)
+label can be added to PRs that have, or will be, merged into `main`. Doing so
+will make sure the change stands out in the release notes.
 
 ### Experimental
 
-The [`release/experimental`](https://github.com/coder/coder/issues?q=sort%3Aupdated-desc+label%3Arelease%2Fexperimental) label can be used to move the note to the bottom of the release notes under a separate title.
+The
+[`release/experimental`](https://github.com/coder/coder/issues?q=sort%3Aupdated-desc+label%3Arelease%2Fexperimental)
+label can be used to move the note to the bottom of the release notes under a
+separate title.
diff --git a/docs/about/architecture.md b/docs/about/architecture.md
index 45ef36b99b891..9489ee7fc8e16 100644
--- a/docs/about/architecture.md
+++ b/docs/about/architecture.md
@@ -8,9 +8,9 @@ This document provides a high level overview of Coder's architecture.
 
 ## coderd
 
-coderd is the service created by running `coder server`. It is a thin
-API that connects workspaces, provisioners and users. coderd stores its state in
-Postgres and is the only service that communicates with Postgres.
+coderd is the service created by running `coder server`. It is a thin API that
+connects workspaces, provisioners and users. coderd stores its state in Postgres
+and is the only service that communicates with Postgres.
 
 It offers:
 
@@ -22,16 +22,18 @@ It offers:
 
 ## provisionerd
 
-provisionerd is the execution context for infrastructure modifying providers.
-At the moment, the only provider is Terraform (running `terraform`).
+provisionerd is the execution context for infrastructure modifying providers. At
+the moment, the only provider is Terraform (running `terraform`).
 
-By default, the Coder server runs multiple provisioner daemons. [External provisioners](../admin/provisioners.md) can be added for security or scalability purposes.
+By default, the Coder server runs multiple provisioner daemons.
+[External provisioners](../admin/provisioners.md) can be added for security or
+scalability purposes.
 
 ## Agents
 
-An agent is the Coder service that runs within a user's remote workspace.
-It provides a consistent interface for coderd and clients to communicate
-with workspaces regardless of operating system, architecture, or cloud.
+An agent is the Coder service that runs within a user's remote workspace. It
+provides a consistent interface for coderd and clients to communicate with
+workspaces regardless of operating system, architecture, or cloud.
 
 It offers the following services along with much more:
 
@@ -40,15 +42,20 @@ It offers the following services along with much more:
 - Liveness checks
 - `startup_script` automation
 
-Templates are responsible for [creating and running agents](../templates/index.md#coder-agent) within workspaces.
+Templates are responsible for
+[creating and running agents](../templates/index.md#coder-agent) within
+workspaces.
 
 ## Service Bundling
 
-While coderd and Postgres can be orchestrated independently,our default installation
-paths bundle them all together into one system service. It's perfectly fine to run a production deployment this way, but there are certain situations that necessitate decomposition:
+While coderd and Postgres can be orchestrated independently,our default
+installation paths bundle them all together into one system service. It's
+perfectly fine to run a production deployment this way, but there are certain
+situations that necessitate decomposition:
 
 - Reducing global client latency (distribute coderd and centralize database)
-- Achieving greater availability and efficiency (horizontally scale individual services)
+- Achieving greater availability and efficiency (horizontally scale individual
+  services)
 
 ## Workspaces
 
diff --git a/docs/admin/app-logs.md b/docs/admin/app-logs.md
index 87efe05ae6061..8235fda06eda8 100644
--- a/docs/admin/app-logs.md
+++ b/docs/admin/app-logs.md
@@ -1,21 +1,28 @@
 # Application Logs
 
-In Coderd, application logs refer to the records of events, messages, and activities generated by the application during its execution.
-These logs provide valuable information about the application's behavior, performance, and any issues that may have occurred.
+In Coderd, application logs refer to the records of events, messages, and
+activities generated by the application during its execution. These logs provide
+valuable information about the application's behavior, performance, and any
+issues that may have occurred.
 
-Application logs include entries that capture events on different levels of severity:
+Application logs include entries that capture events on different levels of
+severity:
 
 - Informational messages
 - Warnings
 - Errors
 - Debugging information
 
-By analyzing application logs, system administrators can gain insights into the application's behavior, identify and diagnose problems, track performance metrics, and make informed decisions to improve the application's stability and efficiency.
+By analyzing application logs, system administrators can gain insights into the
+application's behavior, identify and diagnose problems, track performance
+metrics, and make informed decisions to improve the application's stability and
+efficiency.
 
 ## Error logs
 
-To ensure effective monitoring and timely response to critical events in the Coder application, it is recommended to configure log alerts
-that specifically watch for the following log entries:
+To ensure effective monitoring and timely response to critical events in the
+Coder application, it is recommended to configure log alerts that specifically
+watch for the following log entries:
 
 | Log Level | Module                       | Log message             | Potential issues                                                                                  |
 | --------- | ---------------------------- | ----------------------- | ------------------------------------------------------------------------------------------------- |
diff --git a/docs/admin/appearance.md b/docs/admin/appearance.md
index 5d061b3bb1f6d..f80ffc8c1bcfe 100644
--- a/docs/admin/appearance.md
+++ b/docs/admin/appearance.md
@@ -2,12 +2,15 @@
 
 ## Support Links
 
-Support links let admins adjust the user dropdown menu to include links referring to internal company resources. The menu section replaces the original menu positions: documentation, report a bug to GitHub, or join the Discord server.
+Support links let admins adjust the user dropdown menu to include links
+referring to internal company resources. The menu section replaces the original
+menu positions: documentation, report a bug to GitHub, or join the Discord
+server.
 
 ![support links](../images/admin/support-links.png)
 
-Custom links can be set in the deployment configuration using the `-c <yamlFile>`
-flag to `coder server`.
+Custom links can be set in the deployment configuration using the
+`-c <yamlFile>` flag to `coder server`.
 
 ```yaml
 supportLinks:
@@ -27,7 +30,8 @@ The link icons are optional, and limited to: `bug`, `chat`, and `docs`.
 
 ## Service Banners (enterprise)
 
-Service Banners let admins post important messages to all site users. Only Site Owners may set the service banner.
+Service Banners let admins post important messages to all site users. Only Site
+Owners may set the service banner.
 
 ![service banners](../images/admin/service-banners.png)
 
diff --git a/docs/admin/audit-logs.md b/docs/admin/audit-logs.md
index 882a7274c737f..af7a5724458d7 100644
--- a/docs/admin/audit-logs.md
+++ b/docs/admin/audit-logs.md
@@ -1,7 +1,6 @@
 # Audit Logs
 
-Audit Logs allows **Auditors** to monitor user operations in
-their deployment.
+Audit Logs allows **Auditors** to monitor user operations in their deployment.
 
 ## Tracked Events
 
@@ -9,52 +8,66 @@ We track the following resources:
 
 <!-- Code generated by 'make docs/admin/audit-logs.md'. DO NOT EDIT -->
 
-| <b>Resource<b>                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| APIKey<br><i>login, logout, register, create, delete</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>true</td></tr><tr><td>expires_at</td><td>true</td></tr><tr><td>hashed_secret</td><td>false</td></tr><tr><td>id</td><td>false</td></tr><tr><td>ip_address</td><td>false</td></tr><tr><td>last_used</td><td>true</td></tr><tr><td>lifetime_seconds</td><td>false</td></tr><tr><td>login_type</td><td>false</td></tr><tr><td>scope</td><td>false</td></tr><tr><td>token_name</td><td>false</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>user_id</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| AuditOAuthConvertState<br><i></i>                        | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>true</td></tr><tr><td>expires_at</td><td>true</td></tr><tr><td>from_login_type</td><td>true</td></tr><tr><td>to_login_type</td><td>true</td></tr><tr><td>user_id</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| Group<br><i>create, write, delete</i>                    | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>avatar_url</td><td>true</td></tr><tr><td>display_name</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>members</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>quota_allowance</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| GitSSHKey<br><i>create</i>                               | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>false</td></tr><tr><td>private_key</td><td>true</td></tr><tr><td>public_key</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>user_id</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| License<br><i>create, delete</i>                         | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>exp</td><td>true</td></tr><tr><td>id</td><td>false</td></tr><tr><td>jwt</td><td>false</td></tr><tr><td>uploaded_at</td><td>true</td></tr><tr><td>uuid</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| Template<br><i>write, delete</i>                         | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>active_version_id</td><td>true</td></tr><tr><td>allow_user_autostart</td><td>true</td></tr><tr><td>allow_user_autostop</td><td>true</td></tr><tr><td>allow_user_cancel_workspace_jobs</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>created_by</td><td>true</td></tr><tr><td>created_by_avatar_url</td><td>false</td></tr><tr><td>created_by_username</td><td>false</td></tr><tr><td>default_ttl</td><td>true</td></tr><tr><td>deleted</td><td>false</td></tr><tr><td>description</td><td>true</td></tr><tr><td>display_name</td><td>true</td></tr><tr><td>failure_ttl</td><td>true</td></tr><tr><td>group_acl</td><td>true</td></tr><tr><td>icon</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>inactivity_ttl</td><td>true</td></tr><tr><td>locked_ttl</td><td>true</td></tr><tr><td>max_ttl</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>provisioner</td><td>true</td></tr><tr><td>restart_requirement_days_of_week</td><td>true</td></tr><tr><td>restart_requirement_weeks</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>user_acl</td><td>true</td></tr></tbody></table> |
-| TemplateVersion<br><i>create, write</i>                  | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>false</td></tr><tr><td>created_by</td><td>true</td></tr><tr><td>created_by_avatar_url</td><td>false</td></tr><tr><td>created_by_username</td><td>false</td></tr><tr><td>git_auth_providers</td><td>false</td></tr><tr><td>id</td><td>true</td></tr><tr><td>job_id</td><td>false</td></tr><tr><td>message</td><td>false</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>readme</td><td>true</td></tr><tr><td>template_id</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| User<br><i>create, write, delete</i>                     | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>avatar_url</td><td>false</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>deleted</td><td>true</td></tr><tr><td>email</td><td>true</td></tr><tr><td>hashed_password</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>last_seen_at</td><td>false</td></tr><tr><td>login_type</td><td>true</td></tr><tr><td>quiet_hours_schedule</td><td>true</td></tr><tr><td>rbac_roles</td><td>true</td></tr><tr><td>status</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>username</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| Workspace<br><i>create, write, delete</i>                | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>autostart_schedule</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>deleted</td><td>false</td></tr><tr><td>deleting_at</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>last_used_at</td><td>false</td></tr><tr><td>locked_at</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>owner_id</td><td>true</td></tr><tr><td>template_id</td><td>true</td></tr><tr><td>ttl</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| WorkspaceBuild<br><i>start, stop</i>                     | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>build_number</td><td>false</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>daily_cost</td><td>false</td></tr><tr><td>deadline</td><td>false</td></tr><tr><td>id</td><td>false</td></tr><tr><td>initiator_by_avatar_url</td><td>false</td></tr><tr><td>initiator_by_username</td><td>false</td></tr><tr><td>initiator_id</td><td>false</td></tr><tr><td>job_id</td><td>false</td></tr><tr><td>max_deadline</td><td>false</td></tr><tr><td>provisioner_state</td><td>false</td></tr><tr><td>reason</td><td>false</td></tr><tr><td>template_version_id</td><td>true</td></tr><tr><td>transition</td><td>false</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>workspace_id</td><td>false</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| WorkspaceProxy<br><i></i>                                | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>true</td></tr><tr><td>deleted</td><td>false</td></tr><tr><td>derp_enabled</td><td>true</td></tr><tr><td>derp_only</td><td>true</td></tr><tr><td>display_name</td><td>true</td></tr><tr><td>icon</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>region_id</td><td>true</td></tr><tr><td>token_hashed_secret</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>url</td><td>true</td></tr><tr><td>wildcard_hostname</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| <b>Resource<b>                                           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| APIKey<br><i>login, logout, register, create, delete</i> | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>true</td></tr><tr><td>expires_at</td><td>true</td></tr><tr><td>hashed_secret</td><td>false</td></tr><tr><td>id</td><td>false</td></tr><tr><td>ip_address</td><td>false</td></tr><tr><td>last_used</td><td>true</td></tr><tr><td>lifetime_seconds</td><td>false</td></tr><tr><td>login_type</td><td>false</td></tr><tr><td>scope</td><td>false</td></tr><tr><td>token_name</td><td>false</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>user_id</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| AuditOAuthConvertState<br><i></i>                        | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>true</td></tr><tr><td>expires_at</td><td>true</td></tr><tr><td>from_login_type</td><td>true</td></tr><tr><td>to_login_type</td><td>true</td></tr><tr><td>user_id</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| Group<br><i>create, write, delete</i>                    | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>avatar_url</td><td>true</td></tr><tr><td>display_name</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>members</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>quota_allowance</td><td>true</td></tr><tr><td>source</td><td>false</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| GitSSHKey<br><i>create</i>                               | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>false</td></tr><tr><td>private_key</td><td>true</td></tr><tr><td>public_key</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>user_id</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| License<br><i>create, delete</i>                         | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>exp</td><td>true</td></tr><tr><td>id</td><td>false</td></tr><tr><td>jwt</td><td>false</td></tr><tr><td>uploaded_at</td><td>true</td></tr><tr><td>uuid</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Template<br><i>write, delete</i>                         | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>active_version_id</td><td>true</td></tr><tr><td>allow_user_autostart</td><td>true</td></tr><tr><td>allow_user_autostop</td><td>true</td></tr><tr><td>allow_user_cancel_workspace_jobs</td><td>true</td></tr><tr><td>autostart_block_days_of_week</td><td>true</td></tr><tr><td>autostop_requirement_days_of_week</td><td>true</td></tr><tr><td>autostop_requirement_weeks</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>created_by</td><td>true</td></tr><tr><td>created_by_avatar_url</td><td>false</td></tr><tr><td>created_by_username</td><td>false</td></tr><tr><td>default_ttl</td><td>true</td></tr><tr><td>deleted</td><td>false</td></tr><tr><td>description</td><td>true</td></tr><tr><td>display_name</td><td>true</td></tr><tr><td>failure_ttl</td><td>true</td></tr><tr><td>group_acl</td><td>true</td></tr><tr><td>icon</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>max_ttl</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>provisioner</td><td>true</td></tr><tr><td>require_active_version</td><td>true</td></tr><tr><td>time_til_dormant</td><td>true</td></tr><tr><td>time_til_dormant_autodelete</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>user_acl</td><td>true</td></tr></tbody></table> |
+| TemplateVersion<br><i>create, write</i>                  | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>archived</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>created_by</td><td>true</td></tr><tr><td>created_by_avatar_url</td><td>false</td></tr><tr><td>created_by_username</td><td>false</td></tr><tr><td>external_auth_providers</td><td>false</td></tr><tr><td>id</td><td>true</td></tr><tr><td>job_id</td><td>false</td></tr><tr><td>message</td><td>false</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>readme</td><td>true</td></tr><tr><td>template_id</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| User<br><i>create, write, delete</i>                     | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>avatar_url</td><td>false</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>deleted</td><td>true</td></tr><tr><td>email</td><td>true</td></tr><tr><td>hashed_password</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>last_seen_at</td><td>false</td></tr><tr><td>login_type</td><td>true</td></tr><tr><td>quiet_hours_schedule</td><td>true</td></tr><tr><td>rbac_roles</td><td>true</td></tr><tr><td>status</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>username</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| Workspace<br><i>create, write, delete</i>                | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>automatic_updates</td><td>true</td></tr><tr><td>autostart_schedule</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>deleted</td><td>false</td></tr><tr><td>deleting_at</td><td>true</td></tr><tr><td>dormant_at</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>last_used_at</td><td>false</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>owner_id</td><td>true</td></tr><tr><td>template_id</td><td>true</td></tr><tr><td>ttl</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| WorkspaceBuild<br><i>start, stop</i>                     | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>build_number</td><td>false</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>daily_cost</td><td>false</td></tr><tr><td>deadline</td><td>false</td></tr><tr><td>id</td><td>false</td></tr><tr><td>initiator_by_avatar_url</td><td>false</td></tr><tr><td>initiator_by_username</td><td>false</td></tr><tr><td>initiator_id</td><td>false</td></tr><tr><td>job_id</td><td>false</td></tr><tr><td>max_deadline</td><td>false</td></tr><tr><td>provisioner_state</td><td>false</td></tr><tr><td>reason</td><td>false</td></tr><tr><td>template_version_id</td><td>true</td></tr><tr><td>transition</td><td>false</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>workspace_id</td><td>false</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| WorkspaceProxy<br><i></i>                                | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody><tr><td>created_at</td><td>true</td></tr><tr><td>deleted</td><td>false</td></tr><tr><td>derp_enabled</td><td>true</td></tr><tr><td>derp_only</td><td>true</td></tr><tr><td>display_name</td><td>true</td></tr><tr><td>icon</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>region_id</td><td>true</td></tr><tr><td>token_hashed_secret</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>url</td><td>true</td></tr><tr><td>wildcard_hostname</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 
 <!-- End generated by 'make docs/admin/audit-logs.md'. -->
 
 ## Filtering logs
 
-In the Coder UI you can filter your audit logs using the pre-defined filter or by using the Coder's filter query like the examples below:
+In the Coder UI you can filter your audit logs using the pre-defined filter or
+by using the Coder's filter query like the examples below:
 
 - `resource_type:workspace action:delete` to find deleted workspaces
 - `resource_type:template action:create` to find created templates
 
 The supported filters are:
 
-- `resource_type` - The type of the resource. It can be a workspace, template, user, etc. You can [find here](https://pkg.go.dev/github.com/coder/coder/codersdk#ResourceType) all the resource types that are supported.
+- `resource_type` - The type of the resource. It can be a workspace, template,
+  user, etc. You can
+  [find here](https://pkg.go.dev/github.com/coder/coder/v2/codersdk#ResourceType)
+  all the resource types that are supported.
 - `resource_id` - The ID of the resource.
-- `resource_target` - The name of the resource. Can be used instead of `resource_id`.
-- `action`- The action applied to a resource. You can [find here](https://pkg.go.dev/github.com/coder/coder/codersdk#AuditAction) all the actions that are supported.
-- `username` - The username of the user who triggered the action. You can also use `me` as a convenient alias for the logged-in user.
+- `resource_target` - The name of the resource. Can be used instead of
+  `resource_id`.
+- `action`- The action applied to a resource. You can
+  [find here](https://pkg.go.dev/github.com/coder/coder/v2/codersdk#AuditAction)
+  all the actions that are supported.
+- `username` - The username of the user who triggered the action. You can also
+  use `me` as a convenient alias for the logged-in user.
 - `email` - The email of the user who triggered the action.
 - `date_from` - The inclusive start date with format `YYYY-MM-DD`.
 - `date_to` - The inclusive end date with format `YYYY-MM-DD`.
-- `build_reason` - To be used with `resource_type:workspace_build`, the [initiator](https://pkg.go.dev/github.com/coder/coder/codersdk#BuildReason) behind the build start or stop.
+- `build_reason` - To be used with `resource_type:workspace_build`, the
+  [initiator](https://pkg.go.dev/github.com/coder/coder/v2/codersdk#BuildReason)
+  behind the build start or stop.
 
 ## Capturing/Exporting Audit Logs
 
-In addition to the user interface, there are multiple ways to consume or query audit trails.
+In addition to the user interface, there are multiple ways to consume or query
+audit trails.
 
 ## REST API
 
-Audit logs can be accessed through our REST API. You can find detailed information about this in our [endpoint documentation](../api/audit.md#get-audit-logs).
+Audit logs can be accessed through our REST API. You can find detailed
+information about this in our
+[endpoint documentation](../api/audit.md#get-audit-logs).
 
 ## Service Logs
 
-Audit trails are also dispatched as service logs and can be captured and categorized using any log management tool such as [Splunk](https://splunk.com).
+Audit trails are also dispatched as service logs and can be captured and
+categorized using any log management tool such as [Splunk](https://splunk.com).
 
 Example of a [JSON formatted](../cli/server.md#--log-json) audit log entry:
 
@@ -93,10 +106,11 @@ Example of a [JSON formatted](../cli/server.md#--log-json) audit log entry:
 
 Example of a [human readable](../cli/server.md#--log-human) audit log entry:
 
-```sh
+```console
 2023-06-13 03:43:29.233 [info]  coderd: audit_log  ID=95f7c392-da3e-480c-a579-8909f145fbe2  Time="2023-06-13T03:43:29.230422Z"  UserID=6c405053-27e3-484a-9ad7-bcb64e7bfde6  OrganizationID=00000000-0000-0000-0000-000000000000  Ip=<nil>  UserAgent=<nil>  ResourceType=workspace_build  ResourceID=988ae133-5b73-41e3-a55e-e1e9d3ef0b66  ResourceTarget=""  Action=start  Diff="{}"  StatusCode=200  AdditionalFields="{\"workspace_name\":\"linux-container\",\"build_number\":\"7\",\"build_reason\":\"initiator\",\"workspace_owner\":\"\"}"  RequestID=9682b1b5-7b9f-4bf2-9a39-9463f8e41cd6  ResourceIcon=""
 ```
 
 ## Enabling this feature
 
-This feature is only available with an enterprise license. [Learn more](../enterprise.md)
+This feature is only available with an enterprise license.
+[Learn more](../enterprise.md)
diff --git a/docs/admin/auth.md b/docs/admin/auth.md
index 16807c159fc37..4c846573cd8ac 100644
--- a/docs/admin/auth.md
+++ b/docs/admin/auth.md
@@ -1,5 +1,7 @@
 # Authentication
 
+[OIDC with Coder Sequence Diagram](https://raw.githubusercontent.com/coder/coder/138ee55abb3635cb2f3d12661f8caef2ca9d0961/docs/images/oidc-sequence-diagram.svg).
+
 By default, Coder is accessible via password authentication. Coder does not
 recommend using password authentication in production, and recommends using an
 authentication provider with properly configured multi-factor authentication
@@ -12,32 +14,43 @@ The following steps explain how to set up GitHub OAuth or OpenID Connect.
 
 ### Step 1: Configure the OAuth application in GitHub
 
-First, [register a GitHub OAuth app](https://developer.github.com/apps/building-oauth-apps/creating-an-oauth-app/). GitHub will ask you for the following Coder parameters:
+First,
+[register a GitHub OAuth app](https://developer.github.com/apps/building-oauth-apps/creating-an-oauth-app/).
+GitHub will ask you for the following Coder parameters:
 
-- **Homepage URL**: Set to your Coder deployments [`CODER_ACCESS_URL`](https://coder.com/docs/v2/latest/cli/server#--access-url) (e.g. `https://coder.domain.com`)
+- **Homepage URL**: Set to your Coder deployments
+  [`CODER_ACCESS_URL`](../cli/server.md#--access-url) (e.g.
+  `https://coder.domain.com`)
 - **User Authorization Callback URL**: Set to `https://coder.domain.com`
 
-> Note: If you want to allow multiple coder deployments hosted on subdomains e.g. coder1.domain.com, coder2.domain.com, to be able to authenticate with the same GitHub OAuth app, then you can set **User Authorization Callback URL** to the `https://domain.com`
+> Note: If you want to allow multiple coder deployments hosted on subdomains
+> e.g. coder1.domain.com, coder2.domain.com, to be able to authenticate with the
+> same GitHub OAuth app, then you can set **User Authorization Callback URL** to
+> the `https://domain.com`
 
 Note the Client ID and Client Secret generated by GitHub. You will use these
 values in the next step.
 
+Coder will need permission to access user email addresses. Find the "Account
+Permissions" settings for your app and select "read-only" for "Email addresses".
+
 ### Step 2: Configure Coder with the OAuth credentials
 
 Navigate to your Coder host and run the following command to start up the Coder
 server:
 
-```console
+```shell
 coder server --oauth2-github-allow-signups=true --oauth2-github-allowed-orgs="your-org" --oauth2-github-client-id="8d1...e05" --oauth2-github-client-secret="57ebc9...02c24c"
 ```
 
-> For GitHub Enterprise support, specify the `--oauth2-github-enterprise-base-url` flag.
+> For GitHub Enterprise support, specify the
+> `--oauth2-github-enterprise-base-url` flag.
 
 Alternatively, if you are running Coder as a system service, you can achieve the
 same result as the command above by adding the following environment variables
 to the `/etc/coder.d/coder.env` file:
 
-```console
+```env
 CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS=true
 CODER_OAUTH2_GITHUB_ALLOWED_ORGS="your-org"
 CODER_OAUTH2_GITHUB_CLIENT_ID="8d1...e05"
@@ -46,7 +59,7 @@ CODER_OAUTH2_GITHUB_CLIENT_SECRET="57ebc9...02c24c"
 
 **Note:** To allow everyone to signup using GitHub, set:
 
-```console
+```env
 CODER_OAUTH2_GITHUB_ALLOW_EVERYONE=true
 ```
 
@@ -59,20 +72,22 @@ If deploying Coder via Helm, you can set the above environment variables in the
 coder:
   env:
     - name: CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS
-      value: true
-    - name: CODER_OAUTH2_GITHUB_ALLOWED_ORGS
-      value: "your-org"
+      value: "true"
     - name: CODER_OAUTH2_GITHUB_CLIENT_ID
       value: "533...des"
     - name: CODER_OAUTH2_GITHUB_CLIENT_SECRET
       value: "G0CSP...7qSM"
-    - name: CODER_OAUTH2_GITHUB_ALLOW_EVERYONE
-      value: true
+    # If setting allowed orgs, comment out CODER_OAUTH2_GITHUB_ALLOW_EVERYONE and its value
+    - name: CODER_OAUTH2_GITHUB_ALLOWED_ORGS
+      value: "your-org"
+    # If allowing everyone, comment out CODER_OAUTH2_GITHUB_ALLOWED_ORGS and it's value
+    #- name: CODER_OAUTH2_GITHUB_ALLOW_EVERYONE
+    #  value: "true"
 ```
 
 To upgrade Coder, run:
 
-```console
+```shell
 helm upgrade <release-name> coder-v2/coder -n <namespace> -f values.yaml
 ```
 
@@ -82,7 +97,8 @@ helm upgrade <release-name> coder-v2/coder -n <namespace> -f values.yaml
 
 ## OpenID Connect
 
-The following steps through how to integrate any OpenID Connect provider (Okta, Active Directory, etc.) to Coder.
+The following steps through how to integrate any OpenID Connect provider (Okta,
+Active Directory, etc.) to Coder.
 
 ### Step 1: Set Redirect URI with your OIDC provider
 
@@ -95,15 +111,15 @@ Your OIDC provider will ask you for the following parameter:
 Navigate to your Coder host and run the following command to start up the Coder
 server:
 
-```console
+```shell
 coder server --oidc-issuer-url="https://issuer.corp.com" --oidc-email-domain="your-domain-1,your-domain-2" --oidc-client-id="533...des" --oidc-client-secret="G0CSP...7qSM"
 ```
 
-If you are running Coder as a system service, you can achieve the
-same result as the command above by adding the following environment variables
-to the `/etc/coder.d/coder.env` file:
+If you are running Coder as a system service, you can achieve the same result as
+the command above by adding the following environment variables to the
+`/etc/coder.d/coder.env` file:
 
-```console
+```env
 CODER_OIDC_ISSUER_URL="https://issuer.corp.com"
 CODER_OIDC_EMAIL_DOMAIN="your-domain-1,your-domain-2"
 CODER_OIDC_CLIENT_ID="533...des"
@@ -130,46 +146,46 @@ coder:
 
 To upgrade Coder, run:
 
-```console
+```shell
 helm upgrade <release-name> coder-v2/coder -n <namespace> -f values.yaml
 ```
 
 ## OIDC Claims
 
-When a user logs in for the first time via OIDC, Coder will merge both
-the claims from the ID token and the claims obtained from hitting the
-upstream provider's `userinfo` endpoint, and use the resulting data
-as a basis for creating a new user or looking up an existing user.
+When a user logs in for the first time via OIDC, Coder will merge both the
+claims from the ID token and the claims obtained from hitting the upstream
+provider's `userinfo` endpoint, and use the resulting data as a basis for
+creating a new user or looking up an existing user.
 
-To troubleshoot claims, set `CODER_VERBOSE=true` and follow the logs
-while signing in via OIDC as a new user. Coder will log the claim fields
-returned by the upstream identity provider in a message containing the
-string `got oidc claims`, as well as the user info returned.
+To troubleshoot claims, set `CODER_VERBOSE=true` and follow the logs while
+signing in via OIDC as a new user. Coder will log the claim fields returned by
+the upstream identity provider in a message containing the string
+`got oidc claims`, as well as the user info returned.
 
-> **Note:** If you need to ensure that Coder only uses information from
-> the ID token and does not hit the UserInfo endpoint, you can set the
-> configuration option `CODER_OIDC_IGNORE_USERINFO=true`.
+> **Note:** If you need to ensure that Coder only uses information from the ID
+> token and does not hit the UserInfo endpoint, you can set the configuration
+> option `CODER_OIDC_IGNORE_USERINFO=true`.
 
 ### Email Addresses
 
-By default, Coder will look for the OIDC claim named `email` and use that
-value for the newly created user's email address.
+By default, Coder will look for the OIDC claim named `email` and use that value
+for the newly created user's email address.
 
 If your upstream identity provider users a different claim, you can set
 `CODER_OIDC_EMAIL_FIELD` to the desired claim.
 
-> **Note:** If this field is not present, Coder will attempt to use the
-> claim field configured for `username` as an email address. If this field
-> is not a valid email address, OIDC logins will fail.
+> **Note** If this field is not present, Coder will attempt to use the claim
+> field configured for `username` as an email address. If this field is not a
+> valid email address, OIDC logins will fail.
 
 ### Email Address Verification
 
-Coder requires all OIDC email addresses to be verified by default. If
-the `email_verified` claim is present in the token response from the identity
+Coder requires all OIDC email addresses to be verified by default. If the
+`email_verified` claim is present in the token response from the identity
 provider, Coder will validate that its value is `true`. If needed, you can
 disable this behavior with the following setting:
 
-```console
+```env
 CODER_OIDC_IGNORE_EMAIL_VERIFIED=true
 ```
 
@@ -178,14 +194,14 @@ CODER_OIDC_IGNORE_EMAIL_VERIFIED=true
 
 ### Usernames
 
-When a new user logs in via OIDC, Coder will by default use the value
-of the claim field named `preferred_username` as the the username.
+When a new user logs in via OIDC, Coder will by default use the value of the
+claim field named `preferred_username` as the the username.
 
-If your upstream identity provider uses a different claim, you can
-set `CODER_OIDC_USERNAME_FIELD` to the desired claim.
+If your upstream identity provider uses a different claim, you can set
+`CODER_OIDC_USERNAME_FIELD` to the desired claim.
 
-> **Note:** If this claim is empty, the email address will be stripped of
-> the domain, and become the username (e.g. `example@coder.com` becomes `example`).
+> **Note:** If this claim is empty, the email address will be stripped of the
+> domain, and become the username (e.g. `example@coder.com` becomes `example`).
 > To avoid conflicts, Coder may also append a random word to the resulting
 > username.
 
@@ -194,36 +210,38 @@ set `CODER_OIDC_USERNAME_FIELD` to the desired claim.
 If you'd like to change the OpenID Connect button text and/or icon, you can
 configure them like so:
 
-```console
+```env
 CODER_OIDC_SIGN_IN_TEXT="Sign in with Gitea"
 CODER_OIDC_ICON_URL=https://gitea.io/images/gitea.png
 ```
 
 ## Disable Built-in Authentication
 
-To remove email and password login, set the following environment variable on your
-Coder deployment:
+To remove email and password login, set the following environment variable on
+your Coder deployment:
 
-```console
+```env
 CODER_DISABLE_PASSWORD_AUTH=true
 ```
 
 ## SCIM (enterprise)
 
 Coder supports user provisioning and deprovisioning via SCIM 2.0 with header
-authentication. Upon deactivation, users are [suspended](./users.md#suspend-a-user)
-and are not deleted. [Configure](./configure.md) your SCIM application with an
-auth key and supply it the Coder server.
+authentication. Upon deactivation, users are
+[suspended](./users.md#suspend-a-user) and are not deleted.
+[Configure](./configure.md) your SCIM application with an auth key and supply it
+the Coder server.
 
-```console
+```env
 CODER_SCIM_API_KEY="your-api-key"
 ```
 
 ## TLS
 
-If your OpenID Connect provider requires client TLS certificates for authentication, you can configure them like so:
+If your OpenID Connect provider requires client TLS certificates for
+authentication, you can configure them like so:
 
-```console
+```env
 CODER_TLS_CLIENT_CERT_FILE=/path/to/cert.pem
 CODER_TLS_CLIENT_KEY_FILE=/path/to/key.pem
 ```
@@ -233,22 +251,31 @@ CODER_TLS_CLIENT_KEY_FILE=/path/to/key.pem
 If your OpenID Connect provider supports group claims, you can configure Coder
 to synchronize groups in your auth provider to groups within Coder.
 
-To enable group sync, ensure that the `groups` claim is set by adding the correct scope to request. If group sync is
-enabled, the user's groups will be controlled by the OIDC provider. This means
-manual group additions/removals will be overwritten on the next login.
+To enable group sync, ensure that the `groups` claim is set by adding the
+correct scope to request. If group sync is enabled, the user's groups will be
+controlled by the OIDC provider. This means manual group additions/removals will
+be overwritten on the next login.
 
-```console
+```env
 # as an environment variable
 CODER_OIDC_SCOPES=openid,profile,email,groups
+```
+
+```shell
 # as a flag
 --oidc-scopes openid,profile,email,groups
 ```
 
-With the `groups` scope requested, we also need to map the `groups` claim name. Coder recommends using `groups` for the claim name. This step is necessary if your **scope's name** is something other than `groups`.
+With the `groups` scope requested, we also need to map the `groups` claim name.
+Coder recommends using `groups` for the claim name. This step is necessary if
+your **scope's name** is something other than `groups`.
 
-```console
+```env
 # as an environment variable
 CODER_OIDC_GROUP_FIELD=groups
+```
+
+```shell
 # as a flag
 --oidc-group-field groups
 ```
@@ -260,9 +287,12 @@ For cases when an OIDC provider only returns group IDs ([Azure AD][azure-gids])
 or you want to have different group names in Coder than in your OIDC provider,
 you can configure mapping between the two.
 
-```console
+```env
 # as an environment variable
 CODER_OIDC_GROUP_MAPPING='{"myOIDCGroupID": "myCoderGroupName"}'
+```
+
+```shell
 # as a flag
 --oidc-group-mapping '{"myOIDCGroupID": "myCoderGroupName"}'
 ```
@@ -282,12 +312,47 @@ OIDC provider will be added to the `myCoderGroupName` group in Coder.
 
 > **Note:** Groups are only updated on login.
 
-[azure-gids]: https://github.com/MicrosoftDocs/azure-docs/issues/59766#issuecomment-664387195
+[azure-gids]:
+  https://github.com/MicrosoftDocs/azure-docs/issues/59766#issuecomment-664387195
 
 ### Troubleshooting
 
 Some common issues when enabling group sync.
 
+#### User not being assigned / Group does not exist
+
+If you want Coder to create groups that do not exist, you can set the following
+environment variable. If you enable this, your OIDC provider might be sending
+over many unnecessary groups. Use filtering options on the OIDC provider to
+limit the groups sent over to prevent creating excess groups.
+
+```env
+# as an environment variable
+CODER_OIDC_GROUP_AUTO_CREATE=true
+```
+
+```shell
+# as a flag
+--oidc-group-auto-create=true
+```
+
+A basic regex filtering option on the Coder side is available. This is applied
+**after** the group mapping (`CODER_OIDC_GROUP_MAPPING`), meaning if the group
+is remapped, the remapped value is tested in the regex. This is useful if you
+want to filter out groups that do not match a certain pattern. For example, if
+you want to only allow groups that start with `my-group-` to be created, you can
+set the following environment variable.
+
+```env
+# as an environment variable
+CODER_OIDC_GROUP_REGEX_FILTER="^my-group-.*$"
+```
+
+```shell
+# as a flag
+--oidc-group-regex-filter="^my-group-.*$"
+```
+
 #### Invalid Scope
 
 If you see an error like the following, you may have an invalid scope.
@@ -296,28 +361,39 @@ If you see an error like the following, you may have an invalid scope.
 The application '<oidc_application>' asked for scope 'groups' that doesn't exist on the resource...
 ```
 
-This can happen because the identity provider has a different name for the scope. For example, Azure AD uses `GroupMember.Read.All` instead of `groups`. You can find the correct scope name in the IDP's documentation. Some IDP's allow configuring the name of this scope.
+This can happen because the identity provider has a different name for the
+scope. For example, Azure AD uses `GroupMember.Read.All` instead of `groups`.
+You can find the correct scope name in the IDP's documentation. Some IDP's allow
+configuring the name of this scope.
 
-The solution is to update the value of `CODER_OIDC_SCOPES` to the correct value for the identity provider.
+The solution is to update the value of `CODER_OIDC_SCOPES` to the correct value
+for the identity provider.
 
 #### No `group` claim in the `got oidc claims` log
 
 Steps to troubleshoot.
 
-1. Ensure the user is a part of a group in the IDP. If the user has 0 groups, no `groups` claim will be sent.
-2. Check if another claim appears to be the correct claim with a different name. A common name is `memberOf` instead of `groups`. If this is present, update `CODER_OIDC_GROUP_FIELD=memberOf`.
-3. Make sure the number of groups being sent is under the limit of the IDP. Some IDPs will return an error, while others will just omit the `groups` claim. A common solution is to create a filter on the identity provider that returns less than the limit for your IDP.
+1. Ensure the user is a part of a group in the IDP. If the user has 0 groups, no
+   `groups` claim will be sent.
+2. Check if another claim appears to be the correct claim with a different name.
+   A common name is `memberOf` instead of `groups`. If this is present, update
+   `CODER_OIDC_GROUP_FIELD=memberOf`.
+3. Make sure the number of groups being sent is under the limit of the IDP. Some
+   IDPs will return an error, while others will just omit the `groups` claim. A
+   common solution is to create a filter on the identity provider that returns
+   less than the limit for your IDP.
    - [Azure AD limit is 200, and omits groups if exceeded.](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-fed-group-claims#options-for-applications-to-consume-group-information)
    - [Okta limit is 100, and returns an error if exceeded.](https://developer.okta.com/docs/reference/api/oidc/#scope-dependent-claims-not-always-returned)
 
 ## Role sync (enterprise)
 
 If your OpenID Connect provider supports roles claims, you can configure Coder
-to synchronize roles in your auth provider to deployment-wide roles within Coder.
+to synchronize roles in your auth provider to deployment-wide roles within
+Coder.
 
 Set the following in your Coder server [configuration](./configure.md).
 
-```console
+```env
  # Depending on your identity provider configuration, you may need to explicitly request a "roles" scope
 CODER_OIDC_SCOPES=openid,profile,email,roles
 
@@ -326,7 +402,8 @@ CODER_OIDC_USER_ROLE_FIELD=roles
 CODER_OIDC_USER_ROLE_MAPPING='{"TemplateAuthor":["template-admin","user-admin"]}'
 ```
 
-> One role from your identity provider can be mapped to many roles in Coder (e.g. the example above maps to 2 roles in Coder.)
+> One role from your identity provider can be mapped to many roles in Coder
+> (e.g. the example above maps to 2 roles in Coder.)
 
 ## Provider-Specific Guides
 
@@ -336,17 +413,20 @@ Below are some details specific to individual OIDC providers.
 
 > **Note:** Tested on ADFS 4.0, Windows Server 2019
 
-1. In your Federation Server, create a new application group for Coder. Follow the
-   steps as described [here.](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/development/msal/adfs-msal-web-app-web-api#app-registration-in-ad-fs)
+1. In your Federation Server, create a new application group for Coder. Follow
+   the steps as described
+   [here.](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/development/msal/adfs-msal-web-app-web-api#app-registration-in-ad-fs)
    - **Server Application**: Note the Client ID.
    - **Configure Application Credentials**: Note the Client Secret.
    - **Configure Web API**: Set the Client ID as the relying party identifier.
-   - **Application Permissions**: Allow access to the claims `openid`, `email`, `profile`, and `allatclaims`.
-1. Visit your ADFS server's `/.well-known/openid-configuration` URL and note
-   the value for `issuer`.
-   > **Note:** This is usually of the form `https://adfs.corp/adfs/.well-known/openid-configuration`
-1. In Coder's configuration file (or Helm values as appropriate), set the following
-   environment variables or their corresponding CLI arguments:
+   - **Application Permissions**: Allow access to the claims `openid`, `email`,
+     `profile`, and `allatclaims`.
+1. Visit your ADFS server's `/.well-known/openid-configuration` URL and note the
+   value for `issuer`.
+   > **Note:** This is usually of the form
+   > `https://adfs.corp/adfs/.well-known/openid-configuration`
+1. In Coder's configuration file (or Helm values as appropriate), set the
+   following environment variables or their corresponding CLI arguments:
 
    - `CODER_OIDC_ISSUER_URL`: the `issuer` value from the previous step.
    - `CODER_OIDC_CLIENT_ID`: the Client ID from step 1.
@@ -357,28 +437,44 @@ Below are some details specific to individual OIDC providers.
      {"resource":"$CLIENT_ID"}
      ```
 
-     where `$CLIENT_ID` is the Client ID from step 1 ([see here](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/overview/ad-fs-openid-connect-oauth-flows-scenarios#:~:text=scope%E2%80%AFopenid.-,resource,-optional)).
-     This is required for the upstream OIDC provider to return the requested claims.
+     where `$CLIENT_ID` is the Client ID from step 1
+     ([see here](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/overview/ad-fs-openid-connect-oauth-flows-scenarios#:~:text=scope%E2%80%AFopenid.-,resource,-optional)).
+     This is required for the upstream OIDC provider to return the requested
+     claims.
 
    - `CODER_OIDC_IGNORE_USERINFO`: Set to `true`.
 
-1. Configure [Issuance Transform Rules](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-rule-to-send-ldap-attributes-as-claims)
+1. Configure
+   [Issuance Transform Rules](https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-rule-to-send-ldap-attributes-as-claims)
    on your federation server to send the following claims:
 
    - `preferred_username`: You can use e.g. "Display Name" as required.
-   - `email`: You can use e.g. the LDAP attribute "E-Mail-Addresses" as required.
+   - `email`: You can use e.g. the LDAP attribute "E-Mail-Addresses" as
+     required.
    - `email_verified`: Create a custom claim rule:
 
      ```console
      => issue(Type = "email_verified", Value = "true")
      ```
 
-   - (Optional) If using Group Sync, send the required groups in the configured groups claim field. See [here](https://stackoverflow.com/a/55570286) for an example.
+   - (Optional) If using Group Sync, send the required groups in the configured
+     groups claim field. See [here](https://stackoverflow.com/a/55570286) for an
+     example.
 
 ### Keycloak
 
-The access_type parameter has two possible values: "online" and "offline." By default, the value is set to "offline". This means that when a user authenticates using OIDC, the application requests offline access to the user's resources, including the ability to refresh access tokens without requiring the user to reauthenticate.
-
-To enable the `offline_access` scope, which allows for the refresh token functionality, you need to add it to the list of requested scopes during the authentication flow. Including the `offline_access` scope in the requested scopes ensures that the user is granted the necessary permissions to obtain refresh tokens.
-
-By combining the `{"access_type":"offline"}` parameter in the OIDC Auth URL with the `offline_access` scope, you can achieve the desired behavior of obtaining refresh tokens for offline access to the user's resources.
+The access_type parameter has two possible values: "online" and "offline." By
+default, the value is set to "offline". This means that when a user
+authenticates using OIDC, the application requests offline access to the user's
+resources, including the ability to refresh access tokens without requiring the
+user to reauthenticate.
+
+To enable the `offline_access` scope, which allows for the refresh token
+functionality, you need to add it to the list of requested scopes during the
+authentication flow. Including the `offline_access` scope in the requested
+scopes ensures that the user is granted the necessary permissions to obtain
+refresh tokens.
+
+By combining the `{"access_type":"offline"}` parameter in the OIDC Auth URL with
+the `offline_access` scope, you can achieve the desired behavior of obtaining
+refresh tokens for offline access to the user's resources.
diff --git a/docs/admin/automation.md b/docs/admin/automation.md
index c564903d55361..c9fc78833033b 100644
--- a/docs/admin/automation.md
+++ b/docs/admin/automation.md
@@ -1,22 +1,24 @@
 # Automation
 
-All actions possible through the Coder dashboard can also be automated as it utilizes the same public REST API. There are several ways to extend/automate Coder:
+All actions possible through the Coder dashboard can also be automated as it
+utilizes the same public REST API. There are several ways to extend/automate
+Coder:
 
 - [CLI](../cli.md)
 - [REST API](../api/)
-- [Coder SDK](https://pkg.go.dev/github.com/coder/coder/codersdk)
+- [Coder SDK](https://pkg.go.dev/github.com/coder/coder/v2/codersdk)
 
 ## Quickstart
 
 Generate a token on your Coder deployment by visiting:
 
-```sh
+```shell
 https://coder.example.com/settings/tokens
 ```
 
 List your workspaces
 
-```sh
+```shell
 # CLI
 coder ls \
   --url https://coder.example.com \
@@ -30,23 +32,34 @@ curl https://coder.example.com/api/v2/workspaces?q=owner:me \
 
 ## Documentation
 
-We publish an [API reference](../api/index.md) in our documentation. You can also enable a [Swagger endpoint](../cli/server.md#--swagger-enable) on your Coder deployment.
+We publish an [API reference](../api/index.md) in our documentation. You can
+also enable a [Swagger endpoint](../cli/server.md#--swagger-enable) on your
+Coder deployment.
 
 ## Use cases
 
-We strive to keep the following use cases up to date, but please note that changes to API queries and routes can occur. For the most recent queries and payloads, we recommend checking the CLI and API documentation.
+We strive to keep the following use cases up to date, but please note that
+changes to API queries and routes can occur. For the most recent queries and
+payloads, we recommend checking the CLI and API documentation.
 
 ### Templates
 
-- [Update templates in CI](../templates/change-management.md): Store all templates and git and update templates in CI/CD pipelines.
+- [Update templates in CI](../templates/change-management.md): Store all
+  templates and git and update templates in CI/CD pipelines.
 
 ### Workspace agents
 
-Workspace agents have a special token that can send logs, metrics, and workspace activity.
+Workspace agents have a special token that can send logs, metrics, and workspace
+activity.
 
-- [Custom workspace logs](../api/agents.md#patch-workspace-agent-logs): Expose messages prior to the Coder init script running (e.g. pulling image, VM starting, restoring snapshot). [coder-logstream-kube](https://github.com/coder/coder-logstream-kube) uses this to show Kubernetes events, such as image pulls or ResourceQuota restrictions.
+- [Custom workspace logs](../api/agents.md#patch-workspace-agent-logs): Expose
+  messages prior to the Coder init script running (e.g. pulling image, VM
+  starting, restoring snapshot).
+  [coder-logstream-kube](https://github.com/coder/coder-logstream-kube) uses
+  this to show Kubernetes events, such as image pulls or ResourceQuota
+  restrictions.
 
-  ```sh
+  ```shell
   curl -X PATCH https://coder.example.com/api/v2/workspaceagents/me/logs \
   -H "Coder-Session-Token: $CODER_AGENT_TOKEN" \
   -d "{
@@ -60,9 +73,11 @@ Workspace agents have a special token that can send logs, metrics, and workspace
   }"
   ```
 
-- [Manually send workspace activity](../api/agents.md#submit-workspace-agent-stats): Keep a workspace "active," even if there is not an open connection (e.g. for a long-running machine learning job).
+- [Manually send workspace activity](../api/agents.md#submit-workspace-agent-stats):
+  Keep a workspace "active," even if there is not an open connection (e.g. for a
+  long-running machine learning job).
 
-  ```sh
+  ```shell
   #!/bin/bash
   # Send workspace activity as long as the job is still running
 
diff --git a/docs/admin/configure.md b/docs/admin/configure.md
index e74d447c0b4e1..7ec7faff7761d 100644
--- a/docs/admin/configure.md
+++ b/docs/admin/configure.md
@@ -1,23 +1,26 @@
-Coder server's primary configuration is done via environment variables. For a full list of the options, run `coder server --help` or see our [CLI documentation](../cli/server.md).
+Coder server's primary configuration is done via environment variables. For a
+full list of the options, run `coder server --help` or see our
+[CLI documentation](../cli/server.md).
 
 ## Access URL
 
-`CODER_ACCESS_URL` is required if you are not using the tunnel. Set this to the external URL
-that users and workspaces use to connect to Coder (e.g. <https://coder.example.com>). This
-should not be localhost.
+`CODER_ACCESS_URL` is required if you are not using the tunnel. Set this to the
+external URL that users and workspaces use to connect to Coder (e.g.
+<https://coder.example.com>). This should not be localhost.
 
-> Access URL should be a external IP address or domain with DNS records pointing to Coder.
+> Access URL should be a external IP address or domain with DNS records pointing
+> to Coder.
 
 ### Tunnel
 
-If an access URL is not specified, Coder will create
-a publicly accessible URL to reverse proxy your deployment for simple setup.
+If an access URL is not specified, Coder will create a publicly accessible URL
+to reverse proxy your deployment for simple setup.
 
 ## Address
 
 You can change which port(s) Coder listens on.
 
-```sh
+```shell
 # Listen on port 80
 export CODER_HTTP_ADDRESS=0.0.0.0:80
 
@@ -34,37 +37,76 @@ coder server
 
 ## Wildcard access URL
 
-`CODER_WILDCARD_ACCESS_URL` is necessary for [port forwarding](../networking/port-forwarding.md#dashboard)
-via the dashboard or running [coder_apps](../templates/index.md#coder-apps) on an absolute path. Set this to a wildcard
-subdomain that resolves to Coder (e.g. `*.coder.example.com`).
+`CODER_WILDCARD_ACCESS_URL` is necessary for
+[port forwarding](../networking/port-forwarding.md#dashboard) via the dashboard
+or running [coder_apps](../templates/index.md#coder-apps) on an absolute path.
+Set this to a wildcard subdomain that resolves to Coder (e.g.
+`*.coder.example.com`).
 
 If you are providing TLS certificates directly to the Coder server, either
 
 1. Use a single certificate and key for both the root and wildcard domains.
 2. Configure multiple certificates and keys via
-   [`coder.tls.secretNames`](https://github.com/coder/coder/blob/main/helm/values.yaml) in the Helm Chart, or
-   [`--tls-cert-file`](../cli/server.md#--tls-cert-file) and [`--tls-key-file`](../cli/server.md#--tls-key-file) command
-   line options (these both take a comma separated list of files; list certificates and their respective keys in the
-   same order).
+   [`coder.tls.secretNames`](https://github.com/coder/coder/blob/main/helm/coder/values.yaml)
+   in the Helm Chart, or [`--tls-cert-file`](../cli/server.md#--tls-cert-file)
+   and [`--tls-key-file`](../cli/server.md#--tls-key-file) command line options
+   (these both take a comma separated list of files; list certificates and their
+   respective keys in the same order).
 
 ## TLS & Reverse Proxy
 
-The Coder server can directly use TLS certificates with `CODER_TLS_ENABLE` and accompanying configuration flags. However, Coder can also run behind a reverse-proxy to terminate TLS certificates from LetsEncrypt, for example.
+The Coder server can directly use TLS certificates with `CODER_TLS_ENABLE` and
+accompanying configuration flags. However, Coder can also run behind a
+reverse-proxy to terminate TLS certificates from LetsEncrypt, for example.
 
 - [Apache](https://github.com/coder/coder/tree/main/examples/web-server/apache)
 - [Caddy](https://github.com/coder/coder/tree/main/examples/web-server/caddy)
 - [NGINX](https://github.com/coder/coder/tree/main/examples/web-server/nginx)
 
+### Kubernetes TLS configuration
+
+Below are the steps to configure Coder to terminate TLS when running on
+Kubernetes. You must have the certificate `.key` and `.crt` files in your
+working directory prior to step 1.
+
+1. Create the TLS secret in your Kubernetes cluster
+
+```shell
+kubectl create secret tls coder-tls -n <coder-namespace> --key="tls.key" --cert="tls.crt"
+```
+
+> You can use a single certificate for the both the access URL and wildcard
+> access URL. The certificate CN must match the wildcard domain, such as
+> `*.example.coder.com`.
+
+1. Reference the TLS secret in your Coder Helm chart values
+
+```yaml
+coder:
+  tls:
+    secretName:
+      - coder-tls
+
+  # Alternatively, if you use an Ingress controller to terminate TLS,
+  # set the following values:
+  ingress:
+    enable: true
+    secretName: coder-tls
+    wildcardSecretName: coder-tls
+```
+
 ## PostgreSQL Database
 
-Coder uses a PostgreSQL database to store users, workspace metadata, and other deployment information.
-Use `CODER_PG_CONNECTION_URL` to set the database that Coder connects to. If unset, PostgreSQL binaries will be
-downloaded from Maven (<https://repo1.maven.org/maven2>) and store all data in the config root.
+Coder uses a PostgreSQL database to store users, workspace metadata, and other
+deployment information. Use `CODER_PG_CONNECTION_URL` to set the database that
+Coder connects to. If unset, PostgreSQL binaries will be downloaded from Maven
+(<https://repo1.maven.org/maven2>) and store all data in the config root.
 
 > Postgres 13 is the minimum supported version.
 
 If you are using the built-in PostgreSQL deployment and need to use `psql` (aka
-the PostgreSQL interactive terminal), output the connection URL with the following command:
+the PostgreSQL interactive terminal), output the connection URL with the
+following command:
 
 ```console
 coder server postgres-builtin-url
@@ -73,26 +115,31 @@ psql "postgres://coder@localhost:49627/coder?sslmode=disable&password=feU...yI1"
 
 ### Migrating from the built-in database to an external database
 
-To migrate from the built-in database to an external database, follow these steps:
+To migrate from the built-in database to an external database, follow these
+steps:
 
 1. Stop your Coder deployment.
 2. Run `coder server postgres-builtin-serve` in a background terminal.
 3. Run `coder server postgres-builtin-url` and copy its output command.
-4. Run `pg_dump <built-in-connection-string> > coder.sql` to dump the internal database to a file.
-5. Restore that content to an external database with `psql <external-connection-string> < coder.sql`.
-6. Start your Coder deployment with `CODER_PG_CONNECTION_URL=<external-connection-string>`.
+4. Run `pg_dump <built-in-connection-string> > coder.sql` to dump the internal
+   database to a file.
+5. Restore that content to an external database with
+   `psql <external-connection-string> < coder.sql`.
+6. Start your Coder deployment with
+   `CODER_PG_CONNECTION_URL=<external-connection-string>`.
 
 ## System packages
 
-If you've installed Coder via a [system package](../install/packages.md) Coder, you can
-configure the server by setting the following variables in `/etc/coder.d/coder.env`:
+If you've installed Coder via a [system package](../install/packages.md) Coder,
+you can configure the server by setting the following variables in
+`/etc/coder.d/coder.env`:
 
-```console
+```env
 # String. Specifies the external URL (HTTP/S) to access Coder.
 CODER_ACCESS_URL=https://coder.example.com
 
 # String. Address to serve the API and dashboard.
-CODER_HTTP_ADDRESS=127.0.0.1:3000
+CODER_HTTP_ADDRESS=0.0.0.0:3000
 
 # String. The URL of a PostgreSQL database to connect to. If empty, PostgreSQL binaries
 # will be downloaded from Maven (https://repo1.maven.org/maven2) and store all
@@ -102,6 +149,9 @@ CODER_PG_CONNECTION_URL=
 # Boolean. Specifies if TLS will be enabled.
 CODER_TLS_ENABLE=
 
+# If CODER_TLS_ENABLE=true, also set:
+CODER_TLS_ADDRESS=0.0.0.0:3443
+
 # String. Specifies the path to the certificate for TLS. It requires a PEM-encoded file.
 # To configure the listener to use a CA certificate, concatenate the primary
 # certificate and the CA certificate together. The primary certificate should
@@ -115,7 +165,7 @@ CODER_TLS_KEY_FILE=
 
 To run Coder as a system service on the host:
 
-```console
+```shell
 # Use systemd to start Coder now and on reboot
 sudo systemctl enable --now coder
 
@@ -125,15 +175,15 @@ journalctl -u coder.service -b
 
 To restart Coder after applying system changes:
 
-```console
+```shell
 sudo systemctl restart coder
 ```
 
 ## Configuring Coder behind a proxy
 
-To configure Coder behind a corporate proxy, set the environment variables `HTTP_PROXY` and
-`HTTPS_PROXY`. Be sure to restart the server. Lowercase values (e.g. `http_proxy`) are also
-respected in this case.
+To configure Coder behind a corporate proxy, set the environment variables
+`HTTP_PROXY` and `HTTPS_PROXY`. Be sure to restart the server. Lowercase values
+(e.g. `http_proxy`) are also respected in this case.
 
 ## Up Next
 
diff --git a/docs/admin/encryption.md b/docs/admin/encryption.md
new file mode 100644
index 0000000000000..38c321120e00e
--- /dev/null
+++ b/docs/admin/encryption.md
@@ -0,0 +1,184 @@
+# Database Encryption
+
+By default, Coder stores external user tokens in plaintext in the database.
+Database Encryption allows Coder administrators to encrypt these tokens at-rest,
+preventing attackers with database access from using them to impersonate users.
+
+## How it works
+
+Coder allows administrators to specify
+[external token encryption keys](../cli/server.md#external-token-encryption-keys).
+If configured, Coder will use these keys to encrypt external user tokens before
+storing them in the database. The encryption algorithm used is AES-256-GCM with
+a 32-byte key length.
+
+Coder will use the first key provided for both encryption and decryption. If
+additional keys are provided, Coder will use it for decryption only. This allows
+administrators to rotate encryption keys without invalidating existing tokens.
+
+The following database fields are currently encrypted:
+
+- `user_links.oauth_access_token`
+- `user_links.oauth_refresh_token`
+- `external_auth_links.oauth_access_token`
+- `external_auth_links.oauth_refresh_token`
+
+Additional database fields may be encrypted in the future.
+
+> Implementation notes: each encrypted database column `$C` has a corresponding
+> `$C_key_id` column. This column is used to determine which encryption key was
+> used to encrypt the data. This allows Coder to rotate encryption keys without
+> invalidating existing tokens, and provides referential integrity for encrypted
+> data.
+>
+> The `$C_key_id` column stores the first 7 bytes of the SHA-256 hash of the
+> encryption key used to encrypt the data.
+>
+> Encryption keys in use are stored in `dbcrypt_keys`. This table stores a
+> record of all encryption keys that have been used to encrypt data. Active keys
+> have a null `revoked_key_id` column, and revoked keys have a non-null
+> `revoked_key_id` column. You cannot revoke a key until you have rotated all
+> values using that key to a new key.
+
+## Enabling encryption
+
+> NOTE: Enabling encryption does not encrypt all existing data. To encrypt
+> existing data, see [rotating keys](#rotating-keys) below.
+
+- Ensure you have a valid backup of your database. **Do not skip this step.** If
+  you are using the built-in PostgreSQL database, you can run
+  [`coder server postgres-builtin-url`](../cli/server_postgres-builtin-url.md)
+  to get the connection URL.
+
+- Generate a 32-byte random key and base64-encode it. For example:
+
+```shell
+dd if=/dev/urandom bs=32 count=1 | base64
+```
+
+- Store this key in a secure location (for example, a Kubernetes secret):
+
+```shell
+kubectl create secret generic coder-external-token-encryption-keys --from-literal=keys=<key>
+```
+
+- In your Coder configuration set `CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS` to a
+  comma-separated list of base64-encoded keys. For example, in your Helm
+  `values.yaml`:
+
+```yaml
+coder:
+  env:
+    [...]
+    - name: CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS
+      valueFrom:
+        secretKeyRef:
+          name: coder-external-token-encryption-keys
+          key: keys
+```
+
+- Restart the Coder server. The server will now encrypt all new data with the
+  provided key.
+
+## Rotating keys
+
+We recommend only having one active encryption key at a time normally. However,
+if you need to rotate keys, you can perform the following procedure:
+
+- Ensure you have a valid backup of your database. **Do not skip this step.**
+
+- Generate a new encryption key following the same procedure as above.
+
+- Add the above key to the list of
+  [external token encryption keys](../cli/server.md#--external-token-encryption-keys).
+  **The new key must appear first in the list**. For example, in the Kubernetes
+  secret created above:
+
+```yaml
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: coder-external-token-encryption-keys
+  namespace: coder-namespace
+data:
+  keys: <new-key>,<old-key1>,<old-key2>,...
+```
+
+- After updating the configuration, restart the Coder server. The server will
+  now encrypt all new data with the new key, but will be able to decrypt tokens
+  encrypted with the old key(s).
+
+- To re-encrypt all encrypted database fields with the new key, run
+  [`coder server dbcrypt rotate`](../cli/server_dbcrypt_rotate.md). This command
+  will re-encrypt all tokens with the specified new encryption key. We recommend
+  performing this action during a maintenance window.
+
+  > Note: this command requires direct access to the database. If you are using
+  > the built-in PostgreSQL database, you can run
+  > [`coder server postgres-builtin-url`](../cli/server_postgres-builtin-url.md)
+  > to get the connection URL.
+
+- Once the above command completes successfully, remove the old encryption key
+  from Coder's configuration and restart Coder once more. You can now safely
+  delete the old key from your secret store.
+
+## Disabling encryption
+
+To disable encryption, perform the following actions:
+
+- Ensure you have a valid backup of your database. **Do not skip this step.**
+
+- Stop all active coderd instances. This will prevent new encrypted data from
+  being written, which may cause the next step to fail.
+
+- Run [`coder server dbcrypt decrypt`](../cli/server_dbcrypt_decrypt.md). This
+  command will decrypt all encrypted user tokens and revoke all active
+  encryption keys.
+
+  > Note: for `decrypt` command, the equivalent environment variable for
+  > `--keys` is `CODER_EXTERNAL_TOKEN_ENCRYPTION_DECRYPT_KEYS` and not
+  > `CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS`. This is explicitly named differently
+  > to help prevent accidentally decrypting data.
+
+- Remove all
+  [external token encryption keys](../cli/server.md#--external-token-encryption-keys)
+  from Coder's configuration.
+
+- Start coderd. You can now safely delete the encryption keys from your secret
+  store.
+
+## Deleting Encrypted Data
+
+> NOTE: This is a destructive operation.
+
+To delete all encrypted data from your database, perform the following actions:
+
+- Ensure you have a valid backup of your database. **Do not skip this step.**
+
+- Stop all active coderd instances. This will prevent new encrypted data from
+  being written.
+
+- Run [`coder server dbcrypt delete`](../cli/server_dbcrypt_delete.md). This
+  command will delete all encrypted user tokens and revoke all active encryption
+  keys.
+
+- Remove all
+  [external token encryption keys](../cli/server.md#--external-token-encryption-keys)
+  from Coder's configuration.
+
+- Start coderd. You can now safely delete the encryption keys from your secret
+  store.
+
+## Troubleshooting
+
+- If Coder detects that the data stored in the database was not encrypted with
+  any known keys, it will refuse to start. If you are seeing this behaviour,
+  ensure that the encryption keys provided are correct.
+- If Coder detects that the data stored in the database was encrypted with a key
+  that is no longer active, it will refuse to start. If you are seeing this
+  behaviour, ensure that the encryption keys provided are correct and that you
+  have not revoked any keys that are still in use.
+- Decryption may fail if newly encrypted data is written while decryption is in
+  progress. If this happens, ensure that all active coder instances are stopped,
+  and retry.
diff --git a/docs/admin/external-auth.md b/docs/admin/external-auth.md
new file mode 100644
index 0000000000000..73852a052201a
--- /dev/null
+++ b/docs/admin/external-auth.md
@@ -0,0 +1,183 @@
+# External Authentication
+
+Coder integrates with Git and OpenID Connect to automate away the need for
+developers to authenticate with external services within their workspace.
+
+## Git Providers
+
+When developers use `git` inside their workspace, they are prompted to
+authenticate. After that, Coder will store and refresh tokens for future
+operations.
+
+<video autoplay playsinline loop>
+  <source src="https://github.com/coder/coder/blob/main/site/static/external-auth.mp4?raw=true" type="video/mp4">
+Your browser does not support the video tag.
+</video>
+
+## Configuration
+
+To add an external authentication provider, you'll need to create an OAuth
+application. The following providers are supported:
+
+- [GitHub](#github)
+- [GitLab](https://docs.gitlab.com/ee/integration/oauth_provider.html)
+- [BitBucket](https://support.atlassian.com/bitbucket-cloud/docs/use-oauth-on-bitbucket-cloud/)
+- [Azure DevOps](https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops)
+
+Example callback URL:
+`https://coder.example.com/external-auth/primary-github/callback`. Use an
+arbitrary ID for your provider (e.g. `primary-github`).
+
+Set the following environment variables to
+[configure the Coder server](./configure.md):
+
+```env
+CODER_EXTERNAL_AUTH_0_ID="primary-github"
+CODER_EXTERNAL_AUTH_0_TYPE=github|gitlab|azure-devops|bitbucket|<name of service e.g. jfrog>
+CODER_EXTERNAL_AUTH_0_CLIENT_ID=xxxxxx
+CODER_EXTERNAL_AUTH_0_CLIENT_SECRET=xxxxxxx
+
+# Optionally, configure a custom display name and icon
+CODER_EXTERNAL_AUTH_0_DISPLAY_NAME="Google Calendar"
+CODER_EXTERNAL_AUTH_0_DISPLAY_ICON="https://mycustomicon.com/google.svg"
+```
+
+### GitHub
+
+1. [Create a GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app)
+   to enable fine-grained access to specific repositories, or a subset of
+   permissions for security.
+
+   ![Register GitHub App](../images/admin/github-app-register.png)
+
+2. Adjust the GitHub App permissions. You can use more or less permissions than
+   are listed here, this is merely a suggestion that allows users to clone
+   repositories:
+
+   ![Adjust GitHub App Permissions](../images/admin/github-app-permissions.png)
+
+   | Name          | Permission   | Description                                            |
+   | ------------- | ------------ | ------------------------------------------------------ |
+   | Contents      | Read & Write | Grants access to code and commit statuses.             |
+   | Pull requests | Read & Write | Grants access to create and update pull requests.      |
+   | Workflows     | Read & Write | Grants access to update files in `.github/workflows/`. |
+   | Metadata      | Read-only    | Grants access to metadata written by GitHub Apps.      |
+
+3. Install the App for your organization. You may select a subset of
+   repositories to grant access to.
+
+   ![Install GitHub App](../images/admin/github-app-install.png)
+
+### GitHub Enterprise
+
+GitHub Enterprise requires the following authentication and token URLs:
+
+```env
+CODER_EXTERNAL_AUTH_0_VALIDATE_URL="https://github.example.com/api/v3/user"
+CODER_EXTERNAL_AUTH_0_AUTH_URL="https://github.example.com/login/oauth/authorize"
+CODER_EXTERNAL_AUTH_0_TOKEN_URL="https://github.example.com/login/oauth/access_token"
+```
+
+### Azure DevOps
+
+Azure DevOps requires the following environment variables:
+
+```env
+CODER_EXTERNAL_AUTH_0_ID="primary-azure-devops"
+CODER_EXTERNAL_AUTH_0_TYPE=azure-devops
+CODER_EXTERNAL_AUTH_0_CLIENT_ID=xxxxxx
+# Ensure this value is your "Client Secret", not "App Secret"
+CODER_EXTERNAL_AUTH_0_CLIENT_SECRET=xxxxxxx
+CODER_EXTERNAL_AUTH_0_AUTH_URL="https://app.vssps.visualstudio.com/oauth2/authorize"
+CODER_EXTERNAL_AUTH_0_TOKEN_URL="https://app.vssps.visualstudio.com/oauth2/token"
+```
+
+### Self-managed git providers
+
+Custom authentication and token URLs should be used for self-managed Git
+provider deployments.
+
+```env
+CODER_EXTERNAL_AUTH_0_AUTH_URL="https://github.example.com/oauth/authorize"
+CODER_EXTERNAL_AUTH_0_TOKEN_URL="https://github.example.com/oauth/token"
+CODER_EXTERNAL_AUTH_0_VALIDATE_URL="https://your-domain.com/oauth/token/info"
+CODER_EXTERNAL_AUTH_0_REGEX=github\.company\.org
+```
+
+> Note: The `REGEX` variable must be set if using a custom git domain.
+
+### Custom scopes
+
+Optionally, you can request custom scopes:
+
+```env
+CODER_EXTERNAL_AUTH_0_SCOPES="repo:read repo:write write:gpg_key"
+```
+
+### Multiple External Providers (enterprise)
+
+Multiple providers are an Enterprise feature. [Learn more](../enterprise.md).
+Below is an example configuration with multiple providers.
+
+```env
+# Provider 1) github.com
+CODER_EXTERNAL_AUTH_0_ID=primary-github
+CODER_EXTERNAL_AUTH_0_TYPE=github
+CODER_EXTERNAL_AUTH_0_CLIENT_ID=xxxxxx
+CODER_EXTERNAL_AUTH_0_CLIENT_SECRET=xxxxxxx
+CODER_EXTERNAL_AUTH_0_REGEX=github.com/orgname
+
+# Provider 2) github.example.com
+CODER_EXTERNAL_AUTH_1_ID=secondary-github
+CODER_EXTERNAL_AUTH_1_TYPE=github
+CODER_EXTERNAL_AUTH_1_CLIENT_ID=xxxxxx
+CODER_EXTERNAL_AUTH_1_CLIENT_SECRET=xxxxxxx
+CODER_EXTERNAL_AUTH_1_REGEX=github.example.com
+CODER_EXTERNAL_AUTH_1_AUTH_URL="https://github.example.com/login/oauth/authorize"
+CODER_EXTERNAL_AUTH_1_TOKEN_URL="https://github.example.com/login/oauth/access_token"
+CODER_EXTERNAL_AUTH_1_VALIDATE_URL="https://github.example.com/api/v3/user"
+```
+
+To support regex matching for paths (e.g. github.com/orgname), you'll need to
+add this to the
+[Coder agent startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script):
+
+```shell
+git config --global credential.useHttpPath true
+```
+
+## Require git authentication in templates
+
+If your template requires git authentication (e.g. running `git clone` in the
+[startup_script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script)),
+you can require users authenticate via git prior to creating a workspace:
+
+![Git authentication in template](../images/admin/git-auth-template.png)
+
+The following example will require users authenticate via GitHub and auto-clone
+a repo into the `~/coder` directory.
+
+```hcl
+data "coder_external_auth" "github" {
+  # Matches the ID of the external auth provider in Coder.
+  id = "github"
+}
+
+resource "coder_agent" "dev" {
+  os   = "linux"
+  arch = "amd64"
+  dir  = "~/coder"
+  env = {
+    GITHUB_TOKEN : data.coder_external_auth.github.access_token
+  }
+  startup_script = <<EOF
+if [ ! -d ~/coder ]; then
+    git clone https://github.com/coder/coder
+fi
+EOF
+}
+```
+
+See the
+[Terraform provider documentation](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/git_auth)
+for all available options.
diff --git a/docs/admin/git-providers.md b/docs/admin/git-providers.md
deleted file mode 100644
index 293c88ab3cabb..0000000000000
--- a/docs/admin/git-providers.md
+++ /dev/null
@@ -1,159 +0,0 @@
-# Git Providers
-
-Coder integrates with git providers to automate away the need for developers to authenticate with repositories within their workspace.
-
-## How it works
-
-When developers use `git` inside their workspace, they are prompted to authenticate. After that, Coder will store and refresh tokens for future operations.
-
-<video autoplay playsinline loop>
-  <source src="https://github.com/coder/coder/blob/main/site/static/gitauth.mp4?raw=true" type="video/mp4">
-Your browser does not support the video tag.
-</video>
-
-## Configuration
-
-To add a git provider, you'll need to create an OAuth application. The following providers are supported:
-
-- [GitHub](#github-app)
-- [GitLab](https://docs.gitlab.com/ee/integration/oauth_provider.html)
-- [BitBucket](https://support.atlassian.com/bitbucket-cloud/docs/use-oauth-on-bitbucket-cloud/)
-- [Azure DevOps](https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/oauth?view=azure-devops)
-
-Example callback URL: `https://coder.example.com/gitauth/primary-github/callback`. Use an arbitrary ID for your provider (e.g. `primary-github`).
-
-Set the following environment variables to [configure the Coder server](./configure.md):
-
-```console
-CODER_GITAUTH_0_ID="primary-github"
-CODER_GITAUTH_0_TYPE=github|gitlab|azure-devops|bitbucket
-CODER_GITAUTH_0_CLIENT_ID=xxxxxx
-CODER_GITAUTH_0_CLIENT_SECRET=xxxxxxx
-```
-
-### GitHub
-
-1. [Create a GitHub App](https://docs.github.com/en/apps/creating-github-apps/registering-a-github-app/registering-a-github-app) to enable fine-grained access to specific repositories, or a subset of permissions for security.
-
-   ![Register GitHub App](../images/admin/github-app-register.png)
-
-2. Adjust the GitHub App permissions. You can use more or less permissions than are listed here, this is merely a suggestion that allows users to clone repositories:
-
-   ![Adjust GitHub App Permissions](../images/admin/github-app-permissions.png)
-
-   | Name          | Permission   | Description                                            |
-   | ------------- | ------------ | ------------------------------------------------------ |
-   | Contents      | Read & Write | Grants access to code and commit statuses.             |
-   | Pull requests | Read & Write | Grants access to create and update pull requests.      |
-   | Workflows     | Read & Write | Grants access to update files in `.github/workflows/`. |
-   | Metadata      | Read-only    | Grants access to metadata written by GitHub Apps.      |
-
-3. Install the App for your organization. You may select a subset of repositories to grant access to.
-
-   ![Install GitHub App](../images/admin/github-app-install.png)
-
-### GitHub Enterprise
-
-GitHub Enterprise requires the following authentication and token URLs:
-
-```console
-CODER_GITAUTH_0_VALIDATE_URL="https://github.example.com/login/oauth/access_token/info"
-CODER_GITAUTH_0_AUTH_URL="https://github.example.com/login/oauth/authorize"
-CODER_GITAUTH_0_TOKEN_URL="https://github.example.com/login/oauth/access_token"
-```
-
-### Azure DevOps
-
-Azure DevOps requires the following environment variables:
-
-```console
-CODER_GITAUTH_0_ID="primary-azure-devops"
-CODER_GITAUTH_0_TYPE=azure-devops
-CODER_GITAUTH_0_CLIENT_ID=xxxxxx
-# Ensure this value is your "Client Secret", not "App Secret"
-CODER_GITAUTH_0_CLIENT_SECRET=xxxxxxx
-CODER_GITAUTH_0_AUTH_URL="https://app.vssps.visualstudio.com/oauth2/authorize"
-CODER_GITAUTH_0_TOKEN_URL="https://app.vssps.visualstudio.com/oauth2/token"
-```
-
-### Self-managed git providers
-
-Custom authentication and token URLs should be
-used for self-managed Git provider deployments.
-
-```console
-CODER_GITAUTH_0_AUTH_URL="https://github.example.com/oauth/authorize"
-CODER_GITAUTH_0_TOKEN_URL="https://github.example.com/oauth/token"
-CODER_GITAUTH_0_VALIDATE_URL="https://your-domain.com/oauth/token/info"
-```
-
-### Custom scopes
-
-Optionally, you can request custom scopes:
-
-```console
-CODER_GITAUTH_0_SCOPES="repo:read repo:write write:gpg_key"
-```
-
-### Multiple git providers (enterprise)
-
-Multiple providers are an Enterprise feature. [Learn more](../enterprise.md).
-
-A custom regex can be used to match a specific repository or organization to limit auth scope. Here's a sample config:
-
-```console
-# Provider 1) github.com
-CODER_GITAUTH_0_ID=primary-github
-CODER_GITAUTH_0_TYPE=github
-CODER_GITAUTH_0_CLIENT_ID=xxxxxx
-CODER_GITAUTH_0_CLIENT_SECRET=xxxxxxx
-CODER_GITAUTH_0_REGEX=github.com/orgname
-
-# Provider 2) github.example.com
-CODER_GITAUTH_1_ID=secondary-github
-CODER_GITAUTH_1_TYPE=github
-CODER_GITAUTH_1_CLIENT_ID=xxxxxx
-CODER_GITAUTH_1_CLIENT_SECRET=xxxxxxx
-CODER_GITAUTH_1_REGEX=github.example.com
-CODER_GITAUTH_1_AUTH_URL="https://github.example.com/login/oauth/authorize"
-CODER_GITAUTH_1_TOKEN_URL="https://github.example.com/login/oauth/access_token"
-CODER_GITAUTH_1_VALIDATE_URL="https://github.example.com/login/oauth/access_token/info"
-```
-
-To support regex matching for paths (e.g. github.com/orgname), you'll need to add this to the [Coder agent startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script):
-
-```console
-git config --global credential.useHttpPath true
-```
-
-## Require git authentication in templates
-
-If your template requires git authentication (e.g. running `git clone` in the [startup_script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script)), you can require users authenticate via git prior to creating a workspace:
-
-![Git authentication in template](../images/admin/git-auth-template.png)
-
-The following example will require users authenticate via GitHub and auto-clone a repo
-into the `~/coder` directory.
-
-```hcl
-data "coder_git_auth" "github" {
-  # Matches the ID of the git auth provider in Coder.
-  id = "github"
-}
-
-resource "coder_agent" "dev" {
-  os   = "linux"
-  arch = "amd64"
-  dir  = "~/coder"
-  env = {
-    GITHUB_TOKEN : data.coder_git_auth.github.access_token
-  }
-  startup_script = <<EOF
-if [ ! -d ~/coder ]; then
-    git clone https://github.com/coder/coder
-fi
-EOF
-}
-```
-
-See the [Terraform provider documentation](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/git_auth) for all available options.
diff --git a/docs/admin/groups.md b/docs/admin/groups.md
index 47ecf9e11ffe5..6d0c3ca765843 100644
--- a/docs/admin/groups.md
+++ b/docs/admin/groups.md
@@ -1,9 +1,12 @@
 # Groups
 
-Groups can be used with [template RBAC](./rbac.md) to give groups of users access to specific templates. They can be defined in Coder or [synced from your identity provider](./auth.md#group-sync-enterprise).
+Groups can be used with [template RBAC](./rbac.md) to give groups of users
+access to specific templates. They can be defined in Coder or
+[synced from your identity provider](./auth.md#group-sync-enterprise).
 
 ![Groups](../images/groups.png)
 
 ## Enabling this feature
 
-This feature is only available with an enterprise license. [Learn more](../enterprise.md)
+This feature is only available with an enterprise license.
+[Learn more](../enterprise.md)
diff --git a/docs/admin/high-availability.md b/docs/admin/high-availability.md
index 430c0c8dbb4c4..5423c9597b4ed 100644
--- a/docs/admin/high-availability.md
+++ b/docs/admin/high-availability.md
@@ -1,27 +1,41 @@
 # High Availability
 
-High Availability (HA) mode solves for horizontal scalability and automatic failover
-within a single region. When in HA mode, Coder continues using a single Postgres
-endpoint. [GCP](https://cloud.google.com/sql/docs/postgres/high-availability), [AWS](https://docs.aws.amazon.com/prescriptive-guidance/latest/saas-multitenant-managed-postgresql/availability.html),
+High Availability (HA) mode solves for horizontal scalability and automatic
+failover within a single region. When in HA mode, Coder continues using a single
+Postgres endpoint.
+[GCP](https://cloud.google.com/sql/docs/postgres/high-availability),
+[AWS](https://docs.aws.amazon.com/prescriptive-guidance/latest/saas-multitenant-managed-postgresql/availability.html),
 and other cloud vendors offer fully-managed HA Postgres services that pair
 nicely with Coder.
 
-For Coder to operate correctly, every node must be within 10ms of each other
-and Postgres. We make a best-effort attempt to warn the user when inter-Coder
-latency is too high, but if requests start dropping, this is one metric to investigate.
+For Coder to operate correctly, Coderd instances should have low-latency
+connections to each other so that they can effectively relay traffic between
+users and workspaces no matter which Coderd instance users or workspaces connect
+to. We make a best-effort attempt to warn the user when inter-Coderd latency is
+too high, but if requests start dropping, this is one metric to investigate.
+
+We also recommend that you deploy all Coderd instances such that they have
+low-latency connections to Postgres. Coderd often makes several database
+round-trips while processing a single API request, so prioritizing low-latency
+between Coderd and Postgres is more important than low-latency between users and
+Coderd.
+
 Note that this latency requirement applies _only_ to Coder services. Coder will
-operate correctly even with few seconds of latency on
-workspace <-> Coder and user <-> Coder connections.
+operate correctly even with few seconds of latency on workspace <-> Coder and
+user <-> Coder connections.
 
 ## Setup
 
-Coder automatically enters HA mode when multiple instances simultaneously connect
-to the same Postgres endpoint.
+Coder automatically enters HA mode when multiple instances simultaneously
+connect to the same Postgres endpoint.
 
-HA brings one configuration variable to set in each Coder
-node: `CODER_DERP_SERVER_RELAY_URL`. The HA nodes use these URLs to communicate
-with each other. Inter-node communication is only required while using the
-embedded relay (default). If you're using [custom relays](../networking/index.md#custom-relays), Coder ignores `CODER_DERP_SERVER_RELAY_URL` since Postgres is the sole rendezvous for the Coder nodes.
+HA brings one configuration variable to set in each Coderd node:
+`CODER_DERP_SERVER_RELAY_URL`. The HA nodes use these URLs to communicate with
+each other. Inter-node communication is only required while using the embedded
+relay (default). If you're using
+[custom relays](../networking/index.md#custom-relays), Coder ignores
+`CODER_DERP_SERVER_RELAY_URL` since Postgres is the sole rendezvous for the
+Coder nodes.
 
 `CODER_DERP_SERVER_RELAY_URL` will never be `CODER_ACCESS_URL` because
 `CODER_ACCESS_URL` is a load balancer to all Coder nodes.
diff --git a/docs/admin/prometheus.md b/docs/admin/prometheus.md
index af8928bed6ba0..3af6a08466edb 100644
--- a/docs/admin/prometheus.md
+++ b/docs/admin/prometheus.md
@@ -1,16 +1,25 @@
 # Prometheus
 
-Coder exposes many metrics which can be consumed by a Prometheus server, and give insight into the current state of a live Coder deployment.
+Coder exposes many metrics which can be consumed by a Prometheus server, and
+give insight into the current state of a live Coder deployment.
 
-If you don't have an Prometheus server installed, you can follow the Prometheus [Getting started](https://prometheus.io/docs/prometheus/latest/getting_started/) guide.
+If you don't have an Prometheus server installed, you can follow the Prometheus
+[Getting started](https://prometheus.io/docs/prometheus/latest/getting_started/)
+guide.
 
 ## Enable Prometheus metrics
 
-Coder server exports metrics via the HTTP endpoint, which can be enabled using either the environment variable `CODER_PROMETHEUS_ENABLE` or the flag `--prometheus-enable`.
+Coder server exports metrics via the HTTP endpoint, which can be enabled using
+either the environment variable `CODER_PROMETHEUS_ENABLE` or the flag
+`--prometheus-enable`.
 
-The Prometheus endpoint address is `http://localhost:2112/` by default. You can use either the environment variable `CODER_PROMETHEUS_ADDRESS` or the flag ` --prometheus-address <network-interface>:<port>` to select a different listen address.
+The Prometheus endpoint address is `http://localhost:2112/` by default. You can
+use either the environment variable `CODER_PROMETHEUS_ADDRESS` or the flag
+`--prometheus-address <network-interface>:<port>` to select a different listen
+address.
 
-If `coder server --prometheus-enable` is started locally, you can preview the metrics endpoint in your browser or by using curl: <!-- markdown-link-check-disable -->http://localhost:2112/<!-- markdown-link-check-enable -->.
+If `coder server --prometheus-enable` is started locally, you can preview the
+metrics endpoint in your browser or by using curl:
 
 ```console
 $ curl http://localhost:2112/
@@ -22,14 +31,17 @@ coderd_api_active_users_duration_hour 0
 
 ### Kubernetes deployment
 
-The Prometheus endpoint can be enabled in the [Helm chart's](https://github.com/coder/coder/tree/main/helm) `values.yml` by setting the environment variable `CODER_PROMETHEUS_ADDRESS` to `0.0.0.0:2112`.
-The environment variable `CODER_PROMETHEUS_ENABLE` will be enabled automatically.
+The Prometheus endpoint can be enabled in the
+[Helm chart's](https://github.com/coder/coder/tree/main/helm) `values.yml` by
+setting the environment variable `CODER_PROMETHEUS_ADDRESS` to `0.0.0.0:2112`.
+The environment variable `CODER_PROMETHEUS_ENABLE` will be enabled
+automatically.
 
 ### Prometheus configuration
 
-To allow Prometheus to scrape the Coder metrics, you will need to create a `scape_config`
-in your `prometheus.yml` file, or in the Prometheus Helm chart values. Below is an
-example `scrape_config`:
+To allow Prometheus to scrape the Coder metrics, you will need to create a
+`scape_config` in your `prometheus.yml` file, or in the Prometheus Helm chart
+values. Below is an example `scrape_config`:
 
 ```yaml
 scrape_configs:
diff --git a/docs/admin/provisioners.md b/docs/admin/provisioners.md
index 8f733fdccaa7d..62a35c1ede1ad 100644
--- a/docs/admin/provisioners.md
+++ b/docs/admin/provisioners.md
@@ -1,37 +1,63 @@
-# Provisioners
+# External provisioners
 
-By default, the Coder server runs [built-in provisioner daemons](../cli/server.md#provisioner-daemons), which execute `terraform` during workspace and template builds. However, there are sometimes benefits to running external provisioner daemons:
+By default, the Coder server runs
+[built-in provisioner daemons](../cli/server.md#provisioner-daemons), which
+execute `terraform` during workspace and template builds. However, there are
+sometimes benefits to running external provisioner daemons:
 
-- **Secure build environments:** Run build jobs in isolated containers, preventing malicious templates from gaining shell access to the Coder host.
+- **Secure build environments:** Run build jobs in isolated containers,
+  preventing malicious templates from gaining shell access to the Coder host.
 
-- **Isolate APIs:** Deploy provisioners in isolated environments (on-prem, AWS, Azure) instead of exposing APIs (Docker, Kubernetes, VMware) to the Coder server. See [Provider Authentication](../templates/authentication.md) for more details.
+- **Isolate APIs:** Deploy provisioners in isolated environments (on-prem, AWS,
+  Azure) instead of exposing APIs (Docker, Kubernetes, VMware) to the Coder
+  server. See [Provider Authentication](../templates/authentication.md) for more
+  details.
 
-- **Isolate secrets**: Keep Coder unaware of cloud secrets, manage/rotate secrets on provisoner servers.
+- **Isolate secrets**: Keep Coder unaware of cloud secrets, manage/rotate
+  secrets on provisoner servers.
 
-- **Reduce server load**: External provisioners reduce load and build queue times from the Coder server. See [Scaling Coder](./scale.md#concurrent-workspace-builds) for more details.
+- **Reduce server load**: External provisioners reduce load and build queue
+  times from the Coder server. See
+  [Scaling Coder](./scale.md#concurrent-workspace-builds) for more details.
 
-> External provisioners are in an [alpha state](../contributing/feature-stages.md#alpha-features) and the behavior is subject to change. Use [GitHub issues](https://github.com/coder/coder) to leave feedback.
+Each provisioner can run a single
+[concurrent workspace build](./scale.md#concurrent-workspace-builds). For
+example, running 30 provisioner containers will allow 30 users to start
+workspaces at the same time.
 
-## Running external provisioners
+Provisioners are started with the
+[coder provisionerd start](../cli/provisionerd_start.md) command.
 
-Each provisioner can run a single [concurrent workspace build](./scale.md#concurrent-workspace-builds). For example, running 30 provisioner containers will allow 30 users to start workspaces at the same time.
+## Authentication
 
-### Requirements
+The provisioner daemon must authenticate with your Coder deployment.
 
-- The [Coder CLI](../cli.md) must installed on and authenticated as a user with the Owner or Template Admin role.
-- Your environment must be [authenticated](../templates/authentication.md) against the cloud environments templates need to provision against.
+Set a
+[provisioner daemon pre-shared key (PSK)](../cli/server.md#--provisioner-daemon-psk)
+on the Coder server and start the provisioner with
+`coder provisionerd start --psk <your-psk>`. If you are
+[installing with Helm](../install/kubernetes.md#install-coder-with-helm), see
+the [Helm example](#example-running-an-external-provisioner-with-helm) below.
 
-### Types of provisioners
+> Coder still supports authenticating the provisioner daemon with a
+> [token](../cli.md#--token) from a user with the Template Admin or Owner role.
+> This method is deprecated in favor of the PSK, which only has permission to
+> access provisioner daemon APIs. We recommend migrating to the PSK as soon as
+> practical.
 
-- **Generic provisioners** can pick up any build job from templates without provisioner tags.
+## Types of provisioners
 
-  ```sh
+- **Generic provisioners** can pick up any build job from templates without
+  provisioner tags.
+
+  ```shell
   coder provisionerd start
   ```
 
-- **Tagged provisioners** can be used to pick up build jobs from templates (and corresponding workspaces) with matching tags.
+- **Tagged provisioners** can be used to pick up build jobs from templates (and
+  corresponding workspaces) with matching tags.
 
-  ```sh
+  ```shell
   coder provisionerd start \
     --tag environment=on_prem \
     --tag data_center=chicago
@@ -47,11 +73,16 @@ Each provisioner can run a single [concurrent workspace build](./scale.md#concur
     --provisioner-tag data_center=chicago
   ```
 
-  > At this time, tagged provisioners can also pick jobs from untagged templates. This behavior is [subject to change](https://github.com/coder/coder/issues/6442).
+  > At this time, tagged provisioners can also pick jobs from untagged
+  > templates. This behavior is
+  > [subject to change](https://github.com/coder/coder/issues/6442).
 
-- **User provisioners** can only pick up jobs from user-tagged templates. Unlike the other provisioner types, any Coder can run user provisioners, but they have no impact unless there is at least one template with the `scope=user` provisioner tag.
+- **User provisioners** can only pick up jobs from user-tagged templates. Unlike
+  the other provisioner types, any Coder user can run user provisioners, but
+  they have no impact unless there is at least one template with the
+  `scope=user` provisioner tag.
 
-  ```sh
+  ```shell
   coder provisionerd start \
     --tag scope=user
 
@@ -61,18 +92,85 @@ Each provisioner can run a single [concurrent workspace build](./scale.md#concur
     --provisioner-tag scope=user
   ```
 
-### Example: Running an external provisioner on a VM
+## Example: Running an external provisioner with Helm
+
+Coder provides a Helm chart for running external provisioner daemons, which you
+will use in concert with the Helm chart for deploying the Coder server.
+
+1. Create a long, random pre-shared key (PSK) and store it in a Kubernetes
+   secret
+
+   ```shell
+   kubectl create secret generic coder-provisioner-psk --from-literal=psk=`head /dev/urandom | base64 | tr -dc A-Za-z0-9 | head -c 26`
+   ```
+
+1. Modify your Coder `values.yaml` to include
+
+   ```yaml
+   provisionerDaemon:
+     pskSecretName: "coder-provisioner-psk"
+   ```
+
+1. Redeploy Coder with the new `values.yaml` to roll out the PSK. You can omit
+   `--version <your version>` to also upgrade Coder to the latest version.
+
+   ```shell
+   helm upgrade coder coder-v2/coder \
+       --namespace coder \
+       --version <your version> \
+       --values values.yaml
+   ```
+
+1. Create a `provisioner-values.yaml` file for the provisioner daemons Helm
+   chart. For example
+
+   ```yaml
+   coder:
+     env:
+       - name: CODER_URL
+         value: "https://coder.example.com"
+     replicaCount: 10
+   provisionerDaemon:
+     pskSecretName: "coder-provisioner-psk"
+     tags:
+       location: auh
+       kind: k8s
+   ```
+
+   This example creates a deployment of 10 provisioner daemons (for 10
+   concurrent builds) with the listed tags. For generic provisioners, remove the
+   tags.
+
+   > Refer to the
+   > [values.yaml](https://github.com/coder/coder/blob/main/helm/provisioner/values.yaml)
+   > file for the coder-provisioner chart for information on what values can be
+   > specified.
+
+1. Install the provisioner daemon chart
+
+   ```shell
+   helm install coder-provisioner coder-v2/coder-provisioner \
+       --namespace coder \
+       --version <your version> \
+       --values provisioner-values.yaml
+   ```
+
+   You can verify that your provisioner daemons have successfully connected to
+   Coderd by looking for a debug log message that says
+   `provisionerd: successfully connected to coderd` from each Pod.
+
+## Example: Running an external provisioner on a VM
 
-```sh
+```shell
 curl -L https://coder.com/install.sh | sh
 export CODER_URL=https://coder.example.com
 export CODER_SESSION_TOKEN=your_token
 coder provisionerd start
 ```
 
-### Example: Running an external provisioner via Docker
+## Example: Running an external provisioner via Docker
 
-```sh
+```shell
 docker run --rm -it \
   -e CODER_URL=https://coder.example.com/ \
   -e CODER_SESSION_TOKEN=your_token \
@@ -83,8 +181,10 @@ docker run --rm -it \
 
 ## Disable built-in provisioners
 
-As mentioned above, the Coder server will run built-in provisioners by default. This can be disabled with a server-wide [flag or environment variable](../cli/server.md#provisioner-daemons).
+As mentioned above, the Coder server will run built-in provisioners by default.
+This can be disabled with a server-wide
+[flag or environment variable](../cli/server.md#provisioner-daemons).
 
-```sh
+```shell
 coder server --provisioner-daemons=0
 ```
diff --git a/docs/admin/quotas.md b/docs/admin/quotas.md
index bd52fd668c32a..aa12cf328c4d1 100644
--- a/docs/admin/quotas.md
+++ b/docs/admin/quotas.md
@@ -2,19 +2,19 @@
 
 Quotas are a mechanism for controlling spend by associating costs with workspace
 templates and assigning budgets to users. Users that exceed their budget will be
-blocked from launching more workspaces until they either delete their other workspaces
-or get their budget extended.
+blocked from launching more workspaces until they either delete their other
+workspaces or get their budget extended.
 
-For example: A template is configured with a cost of 5 credits per day,
-and the user is granted 15 credits, which can be consumed by both started and
-stopped workspaces. This budget limits the user to 3 concurrent workspaces.
+For example: A template is configured with a cost of 5 credits per day, and the
+user is granted 15 credits, which can be consumed by both started and stopped
+workspaces. This budget limits the user to 3 concurrent workspaces.
 
 Quotas are licensed with [Groups](./groups.md).
 
 ## Definitions
 
-- **Credits** is the fundamental unit representing cost in the quota system. This integer
-  can be arbitrary, or it can map to your preferred currency.
+- **Credits** is the fundamental unit representing cost in the quota system.
+  This integer can be arbitrary, or it can map to your preferred currency.
 - **Budget** is the per-user, enforced, upper limit to credit spend.
 - **Allowance** is a grant of credits to the budget.
 
@@ -22,10 +22,11 @@ Quotas are licensed with [Groups](./groups.md).
 
 Templates describe their cost through the `daily_cost` attribute in
 [`resource_metadata`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/metadata).
-Since costs are associated with resources, an offline workspace may consume
-less quota than an online workspace.
+Since costs are associated with resources, an offline workspace may consume less
+quota than an online workspace.
 
-A common use case is separating costs for a persistent volume and ephemeral compute:
+A common use case is separating costs for a persistent volume and ephemeral
+compute:
 
 ```hcl
 resource "docker_volume" "home_volume" {
@@ -56,11 +57,11 @@ resource "coder_metadata" "workspace" {
 ```
 
 When the workspace above is shut down, the `docker_container` and
-`coder_metadata` both get deleted. This reduces the cost from 30 credits to
-10 credits.
+`coder_metadata` both get deleted. This reduces the cost from 30 credits to 10
+credits.
 
-Resources without a `daily_cost` value are considered to cost 0. If the cost
-was removed on the `docker_volume` above, the template would consume 0 credits when
+Resources without a `daily_cost` value are considered to cost 0. If the cost was
+removed on the `docker_volume` above, the template would consume 0 credits when
 it's offline. This technique is good for incentivizing users to shut down their
 unused workspaces and freeing up compute in the cluster.
 
@@ -92,10 +93,10 @@ By default, groups are assumed to have a default allowance of 0.
 
 ## Quota Enforcement
 
-Coder enforces Quota on workspace start and stop operations. The workspace
-build process dynamically calculates costs, so quota violation fails builds
-as opposed to failing the build-triggering operation. For example, the Workspace
-Create Form will never get held up by quota enforcement.
+Coder enforces Quota on workspace start and stop operations. The workspace build
+process dynamically calculates costs, so quota violation fails builds as opposed
+to failing the build-triggering operation. For example, the Workspace Create
+Form will never get held up by quota enforcement.
 
 ![build-log](../images/admin/quota-buildlog.png)
 
diff --git a/docs/admin/rbac.md b/docs/admin/rbac.md
index 211f134443889..554650ea675b8 100644
--- a/docs/admin/rbac.md
+++ b/docs/admin/rbac.md
@@ -1,10 +1,13 @@
 # Role Based Access Control (RBAC)
 
-Use RBAC to define which users and [groups](./groups.md) can use specific templates in Coder. These can be defined in Coder or [synced from your identity provider](./auth.md)
+Use RBAC to define which users and [groups](./groups.md) can use specific
+templates in Coder. These can be defined in Coder or
+[synced from your identity provider](./auth.md)
 
 ![rbac](../images/template-rbac.png)
 
-The "Everyone" group makes a template accessible to all users. This can be removed to make a template private.
+The "Everyone" group makes a template accessible to all users. This can be
+removed to make a template private.
 
 ## Permissions
 
@@ -15,4 +18,5 @@ You can set the following permissions:
 
 ## Enabling this feature
 
-This feature is only available with an enterprise license. [Learn more](../enterprise.md)
+This feature is only available with an enterprise license.
+[Learn more](../enterprise.md)
diff --git a/docs/admin/scale.md b/docs/admin/scale.md
index 999a30aeae44a..ae12561bafa36 100644
--- a/docs/admin/scale.md
+++ b/docs/admin/scale.md
@@ -1,14 +1,22 @@
-We scale-test Coder with [a built-in utility](#scaletest-utility) that can be used in your environment for insights into how Coder scales with your infrastructure.
+We scale-test Coder with [a built-in utility](#scaletest-utility) that can be
+used in your environment for insights into how Coder scales with your
+infrastructure.
 
 ## General concepts
 
-Coder runs workspace operations in a queue. The number of concurrent builds will be limited to the number of provisioner daemons across all coderd replicas.
-
-- **coderd**: Coder’s primary service. Learn more about [Coder’s architecture](../about/architecture.md)
-- **coderd replicas**: Replicas (often via Kubernetes) for high availability, this is an [enterprise feature](../enterprise.md)
-- **concurrent workspace builds**: Workspace operations (e.g. create/stop/delete/apply) across all users
-- **concurrent connections**: Any connection to a workspace (e.g. SSH, web terminal, `coder_app`)
-- **provisioner daemons**: Coder runs one workspace build per provisioner daemon. One coderd replica can host many daemons
+Coder runs workspace operations in a queue. The number of concurrent builds will
+be limited to the number of provisioner daemons across all coderd replicas.
+
+- **coderd**: Coder’s primary service. Learn more about
+  [Coder’s architecture](../about/architecture.md)
+- **coderd replicas**: Replicas (often via Kubernetes) for high availability,
+  this is an [enterprise feature](../enterprise.md)
+- **concurrent workspace builds**: Workspace operations (e.g.
+  create/stop/delete/apply) across all users
+- **concurrent connections**: Any connection to a workspace (e.g. SSH, web
+  terminal, `coder_app`)
+- **provisioner daemons**: Coder runs one workspace build per provisioner
+  daemon. One coderd replica can host many daemons
 - **scaletest**: Our scale-testing utility, built into the `coder` command line.
 
 ```text
@@ -17,69 +25,115 @@ Coder runs workspace operations in a queue. The number of concurrent builds will
 
 ## Infrastructure recommendations
 
-> Note: The below are guidelines for planning your infrastructure. Your mileage may vary depending on your templates, workflows, and users.
+> Note: The below are guidelines for planning your infrastructure. Your mileage
+> may vary depending on your templates, workflows, and users.
 
 When planning your infrastructure, we recommend you consider the following:
 
-1. CPU and memory requirements for `coderd`. We recommend allocating 1 CPU core and 2 GB RAM per `coderd` replica at minimum. See [Concurrent users](#concurrent-users) for more details.
-1. CPU and memory requirements for [external provisioners](../admin/provisioners.md#running-external-provisioners), if required. We recommend allocating 1 CPU core and 1 GB RAM per 5 concurrent workspace builds to external provisioners. Note that this may vary depending on the template used. See [Concurrent workspace builds](#concurrent-workspace-builds) for more details. By default, `coderd` runs 3 integrated provisioners.
-1. CPU and memory requirements for the database used by `coderd`. We recommend allocating an additional 1 CPU core to the database used by Coder for every 1000 active users.
-1. CPU and memory requirements for workspaces created by Coder. This will vary depending on users' needs. However, the Coder agent itself requires at minimum 0.1 CPU cores and 256 MB to run inside a workspace.
+1. CPU and memory requirements for `coderd`. We recommend allocating 1 CPU core
+   and 2 GB RAM per `coderd` replica at minimum. See
+   [Concurrent users](#concurrent-users) for more details.
+1. CPU and memory requirements for
+   [external provisioners](../admin/provisioners.md#running-external-provisioners),
+   if required. We recommend allocating 1 CPU core and 1 GB RAM per 5 concurrent
+   workspace builds to external provisioners. Note that this may vary depending
+   on the template used. See
+   [Concurrent workspace builds](#concurrent-workspace-builds) for more details.
+   By default, `coderd` runs 3 integrated provisioners.
+1. CPU and memory requirements for the database used by `coderd`. We recommend
+   allocating an additional 1 CPU core to the database used by Coder for every
+   1000 active users.
+1. CPU and memory requirements for workspaces created by Coder. This will vary
+   depending on users' needs. However, the Coder agent itself requires at
+   minimum 0.1 CPU cores and 256 MB to run inside a workspace.
 
 ### Concurrent users
 
-We recommend allocating 2 CPU cores and 4 GB RAM per `coderd` replica per 1000 active users.
-We also recommend allocating an additional 1 CPU core to the database used by Coder for every 1000 active users.
-Inactive users do not consume Coder resources, although workspaces configured to auto-start will consume resources when they are built.
+We recommend allocating 2 CPU cores and 4 GB RAM per `coderd` replica per 1000
+active users. We also recommend allocating an additional 1 CPU core to the
+database used by Coder for every 1000 active users. Inactive users do not
+consume Coder resources, although workspaces configured to auto-start will
+consume resources when they are built.
 
 Users' primary mode of accessing Coder will also affect resource requirements.
-If users will be accessing workspaces primarily via Coder's HTTP interface, we recommend doubling the number of cores and RAM allocated per user.
-For example, if you expect 1000 users accessing workspaces via the web, we recommend allocating 4 CPU cores and 8 GB RAM.
+If users will be accessing workspaces primarily via Coder's HTTP interface, we
+recommend doubling the number of cores and RAM allocated per user. For example,
+if you expect 1000 users accessing workspaces via the web, we recommend
+allocating 4 CPU cores and 8 GB RAM.
 
-Users accessing workspaces via SSH will consume fewer resources, as SSH connections are not proxied through Coder.
+Users accessing workspaces via SSH will consume fewer resources, as SSH
+connections are not proxied through Coder.
 
 ### Concurrent workspace builds
 
-Workspace builds are CPU-intensive, as it relies on Terraform. Various [Terraform providers](https://registry.terraform.io/browse/providers) have different resource requirements.
-When tested with our [kubernetes](https://github.com/coder/coder/tree/main/examples/templates/kubernetes) template, `coderd` will consume roughly 0.25 cores per concurrent workspace build.
-For effective provisioning, our helm chart prefers to schedule [one coderd replica per-node](https://github.com/coder/coder/blob/main/helm/values.yaml#L110-L121).
+Workspace builds are CPU-intensive, as it relies on Terraform. Various
+[Terraform providers](https://registry.terraform.io/browse/providers) have
+different resource requirements. When tested with our
+[kubernetes](https://github.com/coder/coder/tree/main/examples/templates/kubernetes)
+template, `coderd` will consume roughly 0.25 cores per concurrent workspace
+build. For effective provisioning, our helm chart prefers to schedule
+[one coderd replica per-node](https://github.com/coder/coder/blob/main/helm/coder/values.yaml#L188-L202).
 
 We recommend:
 
-- Running `coderd` on a dedicated set of nodes. This will prevent other workloads from interfering with workspace builds. You can use [node selectors](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector), or [taints and tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) to achieve this.
-- Disabling autoscaling for `coderd` nodes. Autoscaling can cause interruptions for users, see [Autoscaling](#autoscaling) for more details.
-- (Enterprise-only) Running external provisioners instead of Coder's built-in provisioners (`CODER_PROVISIONER_DAEMONS=0`) will separate the load caused by workspace provisioning on the `coderd` nodes. For more details, see [External provisioners](../admin/provisioners.md#running-external-provisioners).
-- Alternatively, if increasing the number of integrated provisioner daemons in `coderd` (`CODER_PROVISIONER_DAEMONS>3`), allocate additional resources to `coderd` to compensate (approx. 0.25 cores and 256 MB per provisioner daemon).
+- Running `coderd` on a dedicated set of nodes. This will prevent other
+  workloads from interfering with workspace builds. You can use
+  [node selectors](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector),
+  or
+  [taints and tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/)
+  to achieve this.
+- Disabling autoscaling for `coderd` nodes. Autoscaling can cause interruptions
+  for users, see [Autoscaling](#autoscaling) for more details.
+- (Enterprise-only) Running external provisioners instead of Coder's built-in
+  provisioners (`CODER_PROVISIONER_DAEMONS=0`) will separate the load caused by
+  workspace provisioning on the `coderd` nodes. For more details, see
+  [External provisioners](../admin/provisioners.md#running-external-provisioners).
+- Alternatively, if increasing the number of integrated provisioner daemons in
+  `coderd` (`CODER_PROVISIONER_DAEMONS>3`), allocate additional resources to
+  `coderd` to compensate (approx. 0.25 cores and 256 MB per provisioner daemon).
 
 For example, to support 120 concurrent workspace builds:
 
-- Create a cluster/nodepool with 4 nodes, 8-core each (AWS: `t3.2xlarge` GCP: `e2-highcpu-8`)
-- Run coderd with 4 replicas, 30 provisioner daemons each. (`CODER_PROVISIONER_DAEMONS=30`)
-- Ensure Coder's [PostgreSQL server](./configure.md#postgresql-database) can use up to 2 cores and 4 GB RAM
+- Create a cluster/nodepool with 4 nodes, 8-core each (AWS: `t3.2xlarge` GCP:
+  `e2-highcpu-8`)
+- Run coderd with 4 replicas, 30 provisioner daemons each.
+  (`CODER_PROVISIONER_DAEMONS=30`)
+- Ensure Coder's [PostgreSQL server](./configure.md#postgresql-database) can use
+  up to 2 cores and 4 GB RAM
 
 ## Recent scale tests
 
-> Note: the below information is for reference purposes only, and are not intended to be used as guidelines for infrastructure sizing.
+> Note: the below information is for reference purposes only, and are not
+> intended to be used as guidelines for infrastructure sizing.
+
+| Environment      | Coder CPU | Coder RAM | Coder Replicas | Database         | Users | Concurrent builds | Concurrent connections (Terminal/SSH) | Coder Version | Last tested  |
+| ---------------- | --------- | --------- | -------------- | ---------------- | ----- | ----------------- | ------------------------------------- | ------------- | ------------ |
+| Kubernetes (GKE) | 3 cores   | 12 GB     | 1              | db-f1-micro      | 200   | 3                 | 200 simulated                         | `v0.24.1`     | Jun 26, 2023 |
+| Kubernetes (GKE) | 4 cores   | 8 GB      | 1              | db-custom-1-3840 | 1500  | 20                | 1,500 simulated                       | `v0.24.1`     | Jun 27, 2023 |
+| Kubernetes (GKE) | 2 cores   | 4 GB      | 1              | db-custom-1-3840 | 500   | 20                | 500 simulated                         | `v0.27.2`     | Jul 27, 2023 |
+| Kubernetes (GKE) | 2 cores   | 4 GB      | 2              | db-custom-2-7680 | 1000  | 20                | 1000 simulated                        | `v2.2.1`      | Oct 9, 2023  |
 
-| Environment      | Coder CPU | Coder RAM | Database         | Users | Concurrent builds | Concurrent connections (Terminal/SSH) | Coder Version | Last tested  |
-| ---------------- | --------- | --------- | ---------------- | ----- | ----------------- | ------------------------------------- | ------------- | ------------ |
-| Kubernetes (GKE) | 3 cores   | 12 GB     | db-f1-micro      | 200   | 3                 | 200 (40KB/s web terminal each)        | `v0.24.1`     | Jun 26, 2023 |
-| Kubernetes (GKE) | 4 cores   | 8 GB      | db-custom-1-3840 | 1500  | 20                | 1,500                                 | `v0.24.1`     | Jun 27, 2023 |
-| Kubernetes (GKE) | 2 cores   | 4 GB      | db-custom-1-3840 | 500   | 20                | 500 (640KB/s SSH each)                | `v0.27.2`     | Jul 27, 2023 |
+> Note: a simulated connection reads and writes random data at 40KB/s per
+> connection.
 
 ## Scale testing utility
 
-Since Coder's performance is highly dependent on the templates and workflows you support, you may wish to use our internal scale testing utility against your own environments.
+Since Coder's performance is highly dependent on the templates and workflows you
+support, you may wish to use our internal scale testing utility against your own
+environments.
 
-> Note: This utility is intended for internal use only. It is not subject to any compatibility guarantees, and may cause interruptions for your users.
-> To avoid potential outages and orphaned resources, we recommend running scale tests on a secondary "staging" environment.
-> Run it against a production environment at your own risk.
+> Note: This utility is intended for internal use only. It is not subject to any
+> compatibility guarantees, and may cause interruptions for your users. To avoid
+> potential outages and orphaned resources, we recommend running scale tests on
+> a secondary "staging" environment. Run it against a production environment at
+> your own risk.
 
 ### Workspace Creation
 
-The following command will run our scale test against your own Coder deployment. You can also specify a template name and any parameter values.
+The following command will run our scale test against your own Coder deployment.
+You can also specify a template name and any parameter values.
 
-```sh
+```shell
 coder exp scaletest create-workspaces \
     --count 1000 \
     --template "kubernetes" \
@@ -99,16 +153,20 @@ The test does the following:
 1. close connections, attempt to delete all workspaces
 1. return results (e.g. `998 succeeded, 2 failed to connect`)
 
-Concurrency is configurable. `concurrency 0` means the scaletest test will attempt to create & connect to all workspaces immediately.
+Concurrency is configurable. `concurrency 0` means the scaletest test will
+attempt to create & connect to all workspaces immediately.
 
-If you wish to leave the workspaces running for a period of time, you can specify `--no-cleanup` to skip the cleanup step.
-You are responsible for deleting these resources later.
+If you wish to leave the workspaces running for a period of time, you can
+specify `--no-cleanup` to skip the cleanup step. You are responsible for
+deleting these resources later.
 
 ### Traffic Generation
 
-Given an existing set of workspaces created previously with `create-workspaces`, the following command will generate traffic similar to that of Coder's web terminal against those workspaces.
+Given an existing set of workspaces created previously with `create-workspaces`,
+the following command will generate traffic similar to that of Coder's web
+terminal against those workspaces.
 
-```sh
+```shell
 coder exp scaletest workspace-traffic \
     --byes-per-tick 128 \
     --tick-interval 100ms \
@@ -119,9 +177,10 @@ To generate SSH traffic, add the `--ssh` flag.
 
 ### Cleanup
 
-The scaletest utility will attempt to clean up all workspaces it creates. If you wish to clean up all workspaces, you can run the following command:
+The scaletest utility will attempt to clean up all workspaces it creates. If you
+wish to clean up all workspaces, you can run the following command:
 
-```sh
+```shell
 coder exp scaletest cleanup
 ```
 
@@ -129,33 +188,45 @@ This will delete all workspaces and users with the prefix `scaletest-`.
 
 ## Autoscaling
 
-We generally do not recommend using an autoscaler that modifies the number of coderd replicas. In particular, scale
-down events can cause interruptions for a large number of users.
-
-Coderd is different from a simple request-response HTTP service in that it services long-lived connections whenever it
-proxies HTTP applications like IDEs or terminals that rely on websockets, or when it relays tunneled connections to
-workspaces. Loss of a coderd replica will drop these long-lived connections and interrupt users. For example, if you
-have 4 coderd replicas behind a load balancer, and an autoscaler decides to reduce it to 3, roughly 25% of the
-connections will drop. An even larger proportion of users could be affected if they use applications that use more
-than one websocket.
-
-The severity of the interruption varies by application. Coder's web terminal, for example, will reconnect to the same
-session and continue. So, this should not be interpreted as saying coderd replicas should never be taken down for any
+We generally do not recommend using an autoscaler that modifies the number of
+coderd replicas. In particular, scale down events can cause interruptions for a
+large number of users.
+
+Coderd is different from a simple request-response HTTP service in that it
+services long-lived connections whenever it proxies HTTP applications like IDEs
+or terminals that rely on websockets, or when it relays tunneled connections to
+workspaces. Loss of a coderd replica will drop these long-lived connections and
+interrupt users. For example, if you have 4 coderd replicas behind a load
+balancer, and an autoscaler decides to reduce it to 3, roughly 25% of the
+connections will drop. An even larger proportion of users could be affected if
+they use applications that use more than one websocket.
+
+The severity of the interruption varies by application. Coder's web terminal,
+for example, will reconnect to the same session and continue. So, this should
+not be interpreted as saying coderd replicas should never be taken down for any
 reason.
 
-We recommend you plan to run enough coderd replicas to comfortably meet your weekly high-water-mark load, and monitor
-coderd peak CPU & memory utilization over the long term, reevaluating periodically. When scaling down (or performing
-upgrades), schedule these outside normal working hours to minimize user interruptions.
+We recommend you plan to run enough coderd replicas to comfortably meet your
+weekly high-water-mark load, and monitor coderd peak CPU & memory utilization
+over the long term, reevaluating periodically. When scaling down (or performing
+upgrades), schedule these outside normal working hours to minimize user
+interruptions.
 
 ### A note for Kubernetes users
 
-When running on Kubernetes on cloud infrastructure (i.e. not bare metal), many operators choose to employ a _cluster_
-autoscaler that adds and removes Kubernetes _nodes_ according to load. Coder can coexist with such cluster autoscalers,
-but we recommend you take steps to prevent the autoscaler from evicting coderd pods, as an eviction will cause the same
-interruptions as described above. For example, if you are using the [Kubernetes cluster
-autoscaler](https://kubernetes.io/docs/reference/labels-annotations-taints/#cluster-autoscaler-kubernetes-io-safe-to-evict),
-you may wish to set `cluster-autoscaler.kubernetes.io/safe-to-evict: "false"` as an annotation on the coderd deployment.
+When running on Kubernetes on cloud infrastructure (i.e. not bare metal), many
+operators choose to employ a _cluster_ autoscaler that adds and removes
+Kubernetes _nodes_ according to load. Coder can coexist with such cluster
+autoscalers, but we recommend you take steps to prevent the autoscaler from
+evicting coderd pods, as an eviction will cause the same interruptions as
+described above. For example, if you are using the
+[Kubernetes cluster autoscaler](https://kubernetes.io/docs/reference/labels-annotations-taints/#cluster-autoscaler-kubernetes-io-safe-to-evict),
+you may wish to set `cluster-autoscaler.kubernetes.io/safe-to-evict: "false"` as
+an annotation on the coderd deployment.
 
 ## Troubleshooting
 
-If a load test fails or if you are experiencing performance issues during day-to-day use, you can leverage Coder's [prometheus metrics](./prometheus.md) to identify bottlenecks during scale tests. Additionally, you can use your existing cloud monitoring stack to measure load, view server logs, etc.
+If a load test fails or if you are experiencing performance issues during
+day-to-day use, you can leverage Coder's [prometheus metrics](./prometheus.md)
+to identify bottlenecks during scale tests. Additionally, you can use your
+existing cloud monitoring stack to measure load, view server logs, etc.
diff --git a/docs/admin/telemetry.md b/docs/admin/telemetry.md
index f7d586b690bd1..29ea709f31b11 100644
--- a/docs/admin/telemetry.md
+++ b/docs/admin/telemetry.md
@@ -1,25 +1,44 @@
 # Telemetry
 
-Coder collects telemetry data from all free installations. Our users have the right to know what we collect, why we collect it, and how we use the data.
+<blockquote class="info">
+TL;DR: disable telemetry by setting <code>CODER_TELEMETRY=false</code>.
+</blockquote>
+
+Coder collects telemetry from all installations by default. We believe our users
+should have the right to know what we collect, why we collect it, and how we use
+the data.
 
 ## What we collect
 
-First of all, we do not collect any information that could threaten the security of your installation. For example, we do not collect parameters, environment variables, or passwords.
+You can find a full list of the data we collect in our source code
+[here](https://github.com/coder/coder/blob/main/coderd/telemetry/telemetry.go).
+In particular, look at the struct types such as `Template` or `Workspace`.
+
+As a rule, we **do not collect** the following types of information:
 
-You can find a full list of the data we collect in the source code [here](https://github.com/coder/coder/blob/main/coderd/telemetry/telemetry.go).
+- Any data that could make your installation less secure
+- Any data that could identify individual users
 
-Telemetry can be configured with the `CODER_TELEMETRY=x` environment variable.
+For example, we do not collect parameters, environment variables, or user email
+addresses.
 
-For example, telemetry can be disabled with `CODER_TELEMETRY=false`.
+## Why we collect
 
-`CODER_TELEMETRY=true` is our default level. It includes user email and IP addresses. This information is used in aggregate to understand where our users are and general demographic information. We may reach out to the deployment admin, but will never use these emails for outbound marketing.
+Telemetry helps us understand which features are most valuable, what use cases
+to focus on, and which bugs to fix first.
 
-`CODER_TELEMETRY=false` disables telemetry altogether.
+Most cloud-based software products collect far more data than we do. They often
+offer little transparency and configurability. It's hard to imagine our favorite
+SaaS products existing without their creators having a detailed understanding of
+user interactions. We want to wield some of that product development power to
+build self-hosted, open-source software.
 
-## How we use telemetry
+## Security
 
-We use telemetry to build product better and faster. Without telemetry, we don't know which features are most useful, we don't know where users are dropping off in our funnel, and we don't know if our roadmap is aligned with the demographics that really use Coder.
+In the event we discover a critical security issue with Coder, we will use
+telemetry to identify affected installations and notify their administrators.
 
-Typical SaaS companies collect far more than what we do with little transparency and configurability. It's hard to imagine our favorite products today existing without their backers having good intelligence.
+## Toggling
 
-We've decided the only way we can make our product open-source _and_ build at a fast pace is by collecting usage data as well.
+You can turn telemetry on or off using either the `CODER_TELEMETRY=[true|false]`
+environment variable or the `--telemetry=[true|false]` command-line flag.
diff --git a/docs/admin/upgrade.md b/docs/admin/upgrade.md
index 72bcdbf27512a..eb24e0f5d5e4f 100644
--- a/docs/admin/upgrade.md
+++ b/docs/admin/upgrade.md
@@ -14,18 +14,18 @@ of [install](../install).
 
 ## Via install.sh
 
-If you installed Coder using the `install.sh` script, re-run the below
-command on the host:
+If you installed Coder using the `install.sh` script, re-run the below command
+on the host:
 
-```console
+```shell
 curl -L https://coder.com/install.sh | sh
 ```
 
-The script will unpack the new `coder` binary version over the one currently installed.
-Next, you can restart Coder with the following commands (if running it as a system
-service):
+The script will unpack the new `coder` binary version over the one currently
+installed. Next, you can restart Coder with the following commands (if running
+it as a system service):
 
-```console
+```shell
 systemctl daemon-reload
 systemctl restart coder
 ```
@@ -35,19 +35,22 @@ systemctl restart coder
 If you installed using `docker-compose`, run the below command to upgrade the
 Coder container:
 
-```console
-docker-compose pull coder && docker-compose up coder -d
+```shell
+docker-compose pull coder && docker-compose up -d coder
 ```
 
 ## Via Kubernetes
 
-See [Upgrading Coder via Helm](../install/kubernetes.md#upgrading-coder-via-helm).
+See
+[Upgrading Coder via Helm](../install/kubernetes.md#upgrading-coder-via-helm).
 
 ## Via Windows
 
-Download the latest Windows installer or binary from [GitHub releases](https://github.com/coder/coder/releases/latest), or upgrade from Winget.
+Download the latest Windows installer or binary from
+[GitHub releases](https://github.com/coder/coder/releases/latest), or upgrade
+from Winget.
 
-```sh
+```pwsh
 winget install Coder.Coder
 ```
 
diff --git a/docs/admin/users.md b/docs/admin/users.md
index b8edeb1619f91..4ef6ce1af949c 100644
--- a/docs/admin/users.md
+++ b/docs/admin/users.md
@@ -1,6 +1,7 @@
 # Users
 
-This article walks you through the user roles available in Coder and creating and managing users.
+This article walks you through the user roles available in Coder and creating
+and managing users.
 
 ## Roles
 
@@ -12,41 +13,60 @@ Coder offers these user roles in the community edition:
 | Manage groups (enterprise)                            |         | ✅         |                | ✅    |
 | Change User roles                                     |         |            |                | ✅    |
 | Manage **ALL** Templates                              |         |            | ✅             | ✅    |
-| View, update and delete **ALL** Workspaces            |         |            | ✅             | ✅    |
+| View **ALL** Workspaces                               |         |            | ✅             | ✅    |
+| Update and delete **ALL** Workspaces                  |         |            |                | ✅    |
 | Run [external provisioners](./provisioners.md)        |         |            | ✅             | ✅    |
 | Execute and use **ALL** Workspaces                    |         |            |                | ✅    |
 | View all user operation [Audit Logs](./audit-logs.md) | ✅      |            |                | ✅    |
 
-A user may have one or more roles. All users have an implicit Member role
-that may use personal workspaces.
+A user may have one or more roles. All users have an implicit Member role that
+may use personal workspaces.
 
 ## Security notes
 
-A malicious Template Admin could write a template that executes commands on the host (or `coder server` container), which potentially escalates their privileges or shuts down the Coder server. To avoid this, run [external provisioners](./provisioners.md).
+A malicious Template Admin could write a template that executes commands on the
+host (or `coder server` container), which potentially escalates their privileges
+or shuts down the Coder server. To avoid this, run
+[external provisioners](./provisioners.md).
 
-In low-trust environments, we do not recommend giving users direct access to edit templates. Instead, use [CI/CD pipelines to update templates](../templates/change-management.md) with proper security scans and code reviews in place.
+In low-trust environments, we do not recommend giving users direct access to
+edit templates. Instead, use
+[CI/CD pipelines to update templates](../templates/change-management.md) with
+proper security scans and code reviews in place.
 
 ## User status
 
-Coder user accounts can have different status types: active, dormant, and suspended.
+Coder user accounts can have different status types: active, dormant, and
+suspended.
 
 ### Active user
 
-An _active_ user account in Coder is the default and desired state for all users. When a user's account is marked as _active_, they have complete access to the Coder platform
-and can utilize all of its features and functionalities without any limitations. Active users can access workspaces, templates, and interact with Coder using CLI.
+An _active_ user account in Coder is the default and desired state for all
+users. When a user's account is marked as _active_, they have complete access to
+the Coder platform and can utilize all of its features and functionalities
+without any limitations. Active users can access workspaces, templates, and
+interact with Coder using CLI.
 
 ### Dormant user
 
-A user account is set to _dormant_ status when they have not yet logged in, or have not logged into the Coder platform for the past 90 days. Once the user logs in to the platform, the account status will switch to _active_.
+A user account is set to _dormant_ status when they have not yet logged in, or
+have not logged into the Coder platform for the past 90 days. Once the user logs
+in to the platform, the account status will switch to _active_.
 
-Dormant accounts do not count towards the total number of licensed seats in a Coder subscription, allowing organizations to optimize their license usage.
+Dormant accounts do not count towards the total number of licensed seats in a
+Coder subscription, allowing organizations to optimize their license usage.
 
 ### Suspended user
 
-When a user's account is marked as _suspended_ in Coder, it means that the account has been temporarily deactivated, and the user is unable to access the platform.
+When a user's account is marked as _suspended_ in Coder, it means that the
+account has been temporarily deactivated, and the user is unable to access the
+platform.
 
-Only user administrators or owners have the necessary permissions to manage suspended accounts and decide whether to lift the suspension and allow the user back into the Coder environment.
-This level of control ensures that administrators can enforce security measures and handle any compliance-related issues promptly.
+Only user administrators or owners have the necessary permissions to manage
+suspended accounts and decide whether to lift the suspension and allow the user
+back into the Coder environment. This level of control ensures that
+administrators can enforce security measures and handle any compliance-related
+issues promptly.
 
 ## Create a user
 
@@ -64,7 +84,7 @@ The new user will appear in the **Users** list. Use the toggle to change their
 
 To create a user via the Coder CLI, run:
 
-```console
+```shell
 coder users create
 ```
 
@@ -98,7 +118,7 @@ To suspend a user via the web UI:
 
 To suspend a user via the CLI, run:
 
-```console
+```shell
 coder users suspend <username|user_id>
 ```
 
@@ -117,7 +137,7 @@ To activate a user via the web UI:
 
 To activate a user via the CLI, run:
 
-```console
+```shell
 coder users activate <username|user_id>
 ```
 
@@ -128,25 +148,27 @@ Confirm the user activation by typing **yes** and pressing **enter**.
 To reset a user's via the web UI:
 
 1. Go to **Users**.
-2. Find the user whose password you want to reset, click the vertical ellipsis to the right,
-   and select **Reset password**.
+2. Find the user whose password you want to reset, click the vertical ellipsis
+   to the right, and select **Reset password**.
 3. Coder displays a temporary password that you can send to the user; copy the
    password and click **Reset password**.
 
-Coder will prompt the user to change their temporary password immediately after logging in.
+Coder will prompt the user to change their temporary password immediately after
+logging in.
 
 You can also reset a password via the CLI:
 
-```console
+```shell
 # run `coder reset-password <username> --help` for usage instructions
 coder reset-password <username>
 ```
 
-> Resetting a user's password, e.g., the initial `owner` role-based user, only works when run on the host running the Coder control plane.
+> Resetting a user's password, e.g., the initial `owner` role-based user, only
+> works when run on the host running the Coder control plane.
 
 ### Resetting a password on Kubernetes
 
-```sh
+```shell
 kubectl exec -it deployment/coder /bin/bash -n coder
 
 coder reset-password <username>
@@ -154,12 +176,22 @@ coder reset-password <username>
 
 ## User filtering
 
-In the Coder UI, you can filter your users using pre-defined filters or by utilizing the Coder's filter query. The examples provided below demonstrate how to use the Coder's filter query:
+In the Coder UI, you can filter your users using pre-defined filters or by
+utilizing the Coder's filter query. The examples provided below demonstrate how
+to use the Coder's filter query:
 
 - To find active users, use the filter `status:active`.
 - To find admin users, use the filter `role:admin`.
+- To find users have not been active since July 2023:
+  `status:active last_seen_before:"2023-07-01T00:00:00Z"`
 
 The following filters are supported:
 
-- `status` - Indicates the status of the user. It can be either `active`, `dormant` or `suspended`.
-- `role` - Represents the role of the user. You can refer to the [TemplateRole documentation](https://pkg.go.dev/github.com/coder/coder/codersdk#TemplateRole) for a list of supported user roles.
+- `status` - Indicates the status of the user. It can be either `active`,
+  `dormant` or `suspended`.
+- `role` - Represents the role of the user. You can refer to the
+  [TemplateRole documentation](https://pkg.go.dev/github.com/coder/coder/v2/codersdk#TemplateRole)
+  for a list of supported user roles.
+- `last_seen_before` and `last_seen_after` - The last time a used has used the
+  platform (e.g. logging in, any API requests, connecting to workspaces). Uses
+  the RFC3339Nano format.
diff --git a/docs/admin/workspace-proxies.md b/docs/admin/workspace-proxies.md
index 4cabf0b2bf570..e88c40831e59f 100644
--- a/docs/admin/workspace-proxies.md
+++ b/docs/admin/workspace-proxies.md
@@ -1,28 +1,47 @@
 # Workspace Proxies
 
-> Workspace proxies are in an [experimental state](../contributing/feature-stages.md#experimental-features) and the behavior is subject to change. Use [GitHub issues](https://github.com/coder/coder) to leave feedback. This experiment must be specifically enabled with the `--experiments="moons"` option on both coderd and the workspace proxy. If you have all experiements enabled, you have to add moons as well. `--experiments="*,moons"`
+> Workspace proxies are in an
+> [experimental state](../contributing/feature-stages.md#experimental-features)
+> and the behavior is subject to change. Use
+> [GitHub issues](https://github.com/coder/coder) to leave feedback. This
+> experiment must be specifically enabled with the `--experiments="moons"`
+> option on both coderd and the workspace proxy. If you have all experiements
+> enabled, you have to add moons as well. `--experiments="*,moons"`
 
 Workspace proxies provide low-latency experiences for geo-distributed teams.
 
-Coder's networking does a best effort to make direct connections to a workspace. In situations where this is not possible, such as connections via the web terminal and [web IDEs](../ides/web-ides.md), workspace proxies are able to reduce the amount of distance the network traffic needs to travel.
+Coder's networking does a best effort to make direct connections to a workspace.
+In situations where this is not possible, such as connections via the web
+terminal and [web IDEs](../ides/web-ides.md), workspace proxies are able to
+reduce the amount of distance the network traffic needs to travel.
 
-A workspace proxy is a relay connection a developer can choose to use when connecting with their workspace over SSH, a workspace app, port forwarding, etc. Dashboard connections and API calls (e.g. the workspaces list) are not served over workspace proxies.
+A workspace proxy is a relay connection a developer can choose to use when
+connecting with their workspace over SSH, a workspace app, port forwarding, etc.
+Dashboard connections and API calls (e.g. the workspaces list) are not served
+over workspace proxies.
 
 ![ProxyDiagram](../images/workspaceproxy/proxydiagram.png)
 
 # Deploy a workspace proxy
 
-Each workspace proxy should be a unique instance. At no point should 2 workspace proxy instances share the same authentication token. They only require port 443 to be open and are expected to have network connectivity to the coderd dashboard. Workspace proxies **do not** make any database connections.
+Each workspace proxy should be a unique instance. At no point should 2 workspace
+proxy instances share the same authentication token. They only require port 443
+to be open and are expected to have network connectivity to the coderd
+dashboard. Workspace proxies **do not** make any database connections.
 
-Workspace proxies can be used in the browser by navigating to the user `Account -> Workspace Proxy`
+Workspace proxies can be used in the browser by navigating to the user
+`Account -> Workspace Proxy`
 
 ## Requirements
 
-- The [Coder CLI](../cli.md) must be installed and authenticated as a user with the Owner role.
+- The [Coder CLI](../cli.md) must be installed and authenticated as a user with
+  the Owner role.
 
 ## Step 1: Create the proxy
 
-Create the workspace proxy and make sure to save the returned authentication token for said proxy. This is the token the workspace proxy will use to authenticate back to primary coderd.
+Create the workspace proxy and make sure to save the returned authentication
+token for said proxy. This is the token the workspace proxy will use to
+authenticate back to primary coderd.
 
 ```bash
 $ coder wsproxy create --name=newyork --display-name="USA East" --icon="/emojis/2194.png"
@@ -40,7 +59,9 @@ newyork                             unregistered
 
 ## Step 2: Deploy the proxy
 
-Deploying the workspace proxy will also register the proxy with coderd and make the workspace proxy usable. If the proxy deployment is successful, `coder wsproxy ls` will show an `ok` status code:
+Deploying the workspace proxy will also register the proxy with coderd and make
+the workspace proxy usable. If the proxy deployment is successful,
+`coder wsproxy ls` will show an `ok` status code:
 
 ```
 $ coder wsproxy ls
@@ -53,13 +74,18 @@ sydney            https://sydney.example.com  ok
 Other Status codes:
 
 - `unregistered` : The workspace proxy was created, and not yet deployed
-- `unreachable` : The workspace proxy was registered, but is not responding. Likely the proxy went offline.
-- `unhealthy` : The workspace proxy is reachable, but has some issue that is preventing the proxy from being used. `coder wsproxy ls` should show the error message.
+- `unreachable` : The workspace proxy was registered, but is not responding.
+  Likely the proxy went offline.
+- `unhealthy` : The workspace proxy is reachable, but has some issue that is
+  preventing the proxy from being used. `coder wsproxy ls` should show the error
+  message.
 - `ok` : The workspace proxy is healthy and working properly!
 
 ### Configuration
 
-Workspace proxy configuration overlaps with a subset of the coderd configuration. To see the full list of configuration options: `coder wsproxy server --help`
+Workspace proxy configuration overlaps with a subset of the coderd
+configuration. To see the full list of configuration options:
+`coder wsproxy server --help`
 
 ```bash
 # Proxy specific configuration. These are REQUIRED
@@ -87,7 +113,8 @@ CODER_TLS_KEY_FILE="<key_file_location>"
 
 Make a `values-wsproxy.yaml` with the workspace proxy configuration:
 
-> Notice the `workspaceProxy` configuration which is `false` by default in the coder Helm chart.
+> Notice the `workspaceProxy` configuration which is `false` by default in the
+> coder Helm chart.
 
 ```yaml
 coder:
@@ -121,7 +148,9 @@ Using Helm, install the workspace proxy chart
 helm install coder coder-v2/coder --namespace <your workspace proxy namespace> -f ./values-wsproxy.yaml
 ```
 
-Test that the workspace proxy is reachable with `curl -vvv`. If for some reason, the Coder dashboard still shows the workspace proxy is `UNHEALTHY`, scale down and up the deployment's replicas.
+Test that the workspace proxy is reachable with `curl -vvv`. If for some reason,
+the Coder dashboard still shows the workspace proxy is `UNHEALTHY`, scale down
+and up the deployment's replicas.
 
 ### Running on a VM
 
@@ -132,11 +161,14 @@ coder wsproxy server
 
 ### Running in Docker
 
-Modify the default entrypoint to run a workspace proxy server instead of a regular Coder server.
+Modify the default entrypoint to run a workspace proxy server instead of a
+regular Coder server.
 
 #### Docker Compose
 
-Change the provided [`docker-compose.yml`](https://github.com/coder/coder/blob/main/docker-compose.yaml) file to include a custom entrypoint:
+Change the provided
+[`docker-compose.yml`](https://github.com/coder/coder/blob/main/docker-compose.yaml)
+file to include a custom entrypoint:
 
 ```diff
   image: ghcr.io/coder/coder:${CODER_VERSION:-latest}
@@ -158,6 +190,9 @@ ENTRYPOINT ["/opt/coder", "wsproxy", "server"]
 
 ### Selecting a proxy
 
-Users can select a workspace proxy at the top-right of the browser-based Coder dashboard. Workspace proxy preferences are cached by the web browser. If a proxy goes offline, the session will fall back to the primary proxy. This could take up to 60 seconds.
+Users can select a workspace proxy at the top-right of the browser-based Coder
+dashboard. Workspace proxy preferences are cached by the web browser. If a proxy
+goes offline, the session will fall back to the primary proxy. This could take
+up to 60 seconds.
 
 ![Workspace proxy picker](../images/admin/workspace-proxy-picker.png)
diff --git a/docs/api/agents.md b/docs/api/agents.md
index 2316fdaafde51..0c620f2f95ee5 100644
--- a/docs/api/agents.md
+++ b/docs/api/agents.md
@@ -221,13 +221,57 @@ incoming connections and publishes node updates.
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
-## Get workspace agent Git auth
+## Get workspace agent external auth
 
 ### Code samples
 
 ```shell
 # Example request using curl
-curl -X GET http://coder-server:8080/api/v2/workspaceagents/me/gitauth?url=http%3A%2F%2Fexample.com \
+curl -X GET http://coder-server:8080/api/v2/workspaceagents/me/external-auth?match=string&id=string \
+  -H 'Accept: application/json' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`GET /workspaceagents/me/external-auth`
+
+### Parameters
+
+| Name     | In    | Type    | Required | Description                       |
+| -------- | ----- | ------- | -------- | --------------------------------- |
+| `match`  | query | string  | true     | Match                             |
+| `id`     | query | string  | true     | Provider ID                       |
+| `listen` | query | boolean | false    | Wait for a new token to be issued |
+
+### Example responses
+
+> 200 Response
+
+```json
+{
+  "access_token": "string",
+  "password": "string",
+  "token_extra": {},
+  "type": "string",
+  "url": "string",
+  "username": "string"
+}
+```
+
+### Responses
+
+| Status | Meaning                                                 | Description | Schema                                                                   |
+| ------ | ------------------------------------------------------- | ----------- | ------------------------------------------------------------------------ |
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [agentsdk.ExternalAuthResponse](schemas.md#agentsdkexternalauthresponse) |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
+## Removed: Get workspace agent git auth
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X GET http://coder-server:8080/api/v2/workspaceagents/me/gitauth?match=string&id=string \
   -H 'Accept: application/json' \
   -H 'Coder-Session-Token: API_KEY'
 ```
@@ -236,10 +280,11 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/me/gitauth?url=http%
 
 ### Parameters
 
-| Name     | In    | Type        | Required | Description                       |
-| -------- | ----- | ----------- | -------- | --------------------------------- |
-| `url`    | query | string(uri) | true     | Git URL                           |
-| `listen` | query | boolean     | false    | Wait for a new token to be issued |
+| Name     | In    | Type    | Required | Description                       |
+| -------- | ----- | ------- | -------- | --------------------------------- |
+| `match`  | query | string  | true     | Match                             |
+| `id`     | query | string  | true     | Provider ID                       |
+| `listen` | query | boolean | false    | Wait for a new token to be issued |
 
 ### Example responses
 
@@ -247,7 +292,10 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/me/gitauth?url=http%
 
 ```json
 {
+  "access_token": "string",
   "password": "string",
+  "token_extra": {},
+  "type": "string",
   "url": "string",
   "username": "string"
 }
@@ -255,9 +303,9 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/me/gitauth?url=http%
 
 ### Responses
 
-| Status | Meaning                                                 | Description | Schema                                                         |
-| ------ | ------------------------------------------------------- | ----------- | -------------------------------------------------------------- |
-| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [agentsdk.GitAuthResponse](schemas.md#agentsdkgitauthresponse) |
+| Status | Meaning                                                 | Description | Schema                                                                   |
+| ------ | ------------------------------------------------------- | ----------- | ------------------------------------------------------------------------ |
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [agentsdk.ExternalAuthResponse](schemas.md#agentsdkexternalauthresponse) |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
@@ -311,12 +359,12 @@ curl -X PATCH http://coder-server:8080/api/v2/workspaceagents/me/logs \
 
 ```json
 {
+  "log_source_id": "string",
   "logs": [
     {
       "created_at": "string",
       "level": "trace",
-      "output": "string",
-      "source": "startup_script"
+      "output": "string"
     }
   ]
 }
@@ -389,10 +437,18 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/me/manifest \
       "sharing_level": "owner",
       "slug": "string",
       "subdomain": true,
+      "subdomain_name": "string",
       "url": "string"
     }
   ],
+  "derp_force_websockets": true,
   "derpmap": {
+    "homeParams": {
+      "regionScore": {
+        "property1": 0,
+        "property2": 0
+      }
+    },
     "omitDefaultRegions": true,
     "regions": {
       "property1": {
@@ -400,6 +456,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/me/manifest \
         "embeddedRelay": true,
         "nodes": [
           {
+            "canPort80": true,
             "certName": "string",
             "derpport": 0,
             "forceHTTP": true,
@@ -423,6 +480,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/me/manifest \
         "embeddedRelay": true,
         "nodes": [
           {
+            "canPort80": true,
             "certName": "string",
             "derpport": 0,
             "forceHTTP": true,
@@ -460,10 +518,18 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/me/manifest \
     }
   ],
   "motd_file": "string",
-  "shutdown_script": "string",
-  "shutdown_script_timeout": 0,
-  "startup_script": "string",
-  "startup_script_timeout": 0,
+  "scripts": [
+    {
+      "cron": "string",
+      "log_path": "string",
+      "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+      "run_on_start": true,
+      "run_on_stop": true,
+      "script": "string",
+      "start_blocks_login": true,
+      "timeout": 0
+    }
+  ],
   "vscode_port_proxy_uri": "string"
 }
 ```
@@ -566,12 +632,12 @@ curl -X PATCH http://coder-server:8080/api/v2/workspaceagents/me/startup-logs \
 
 ```json
 {
+  "log_source_id": "string",
   "logs": [
     {
       "created_at": "string",
       "level": "trace",
-      "output": "string",
-      "source": "startup_script"
+      "output": "string"
     }
   ]
 }
@@ -649,6 +715,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/{workspaceagent} \
       "sharing_level": "owner",
       "slug": "string",
       "subdomain": true,
+      "subdomain_name": "string",
       "url": "string"
     }
   ],
@@ -657,6 +724,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/{workspaceagent} \
   "created_at": "2019-08-24T14:15:22Z",
   "directory": "string",
   "disconnected_at": "2019-08-24T14:15:22Z",
+  "display_apps": ["vscode"],
   "environment_variables": {
     "property1": "string",
     "property2": "string"
@@ -681,21 +749,37 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/{workspaceagent} \
     }
   },
   "lifecycle_state": "created",
-  "login_before_ready": true,
+  "log_sources": [
+    {
+      "created_at": "2019-08-24T14:15:22Z",
+      "display_name": "string",
+      "icon": "string",
+      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+    }
+  ],
   "logs_length": 0,
   "logs_overflowed": true,
   "name": "string",
   "operating_system": "string",
   "ready_at": "2019-08-24T14:15:22Z",
   "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-  "shutdown_script": "string",
-  "shutdown_script_timeout_seconds": 0,
+  "scripts": [
+    {
+      "cron": "string",
+      "log_path": "string",
+      "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+      "run_on_start": true,
+      "run_on_stop": true,
+      "script": "string",
+      "start_blocks_login": true,
+      "timeout": 0
+    }
+  ],
   "started_at": "2019-08-24T14:15:22Z",
-  "startup_script": "string",
   "startup_script_behavior": "blocking",
-  "startup_script_timeout_seconds": 0,
   "status": "connecting",
-  "subsystem": "envbox",
+  "subsystems": ["envbox"],
   "troubleshooting_url": "string",
   "updated_at": "2019-08-24T14:15:22Z",
   "version": "string"
@@ -735,7 +819,14 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/{workspaceagent}/con
 
 ```json
 {
+  "derp_force_websockets": true,
   "derp_map": {
+    "homeParams": {
+      "regionScore": {
+        "property1": 0,
+        "property2": 0
+      }
+    },
     "omitDefaultRegions": true,
     "regions": {
       "property1": {
@@ -743,6 +834,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/{workspaceagent}/con
         "embeddedRelay": true,
         "nodes": [
           {
+            "canPort80": true,
             "certName": "string",
             "derpport": 0,
             "forceHTTP": true,
@@ -766,6 +858,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/{workspaceagent}/con
         "embeddedRelay": true,
         "nodes": [
           {
+            "canPort80": true,
             "certName": "string",
             "derpport": 0,
             "forceHTTP": true,
@@ -900,7 +993,8 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/{workspaceagent}/log
     "created_at": "2019-08-24T14:15:22Z",
     "id": 0,
     "level": "trace",
-    "output": "string"
+    "output": "string",
+    "source_id": "ae50a35c-df42-4eff-ba26-f8bc28d2af81"
   }
 ]
 ```
@@ -922,6 +1016,7 @@ Status Code **200**
 | `» id`         | integer                                          | false    |              |             |
 | `» level`      | [codersdk.LogLevel](schemas.md#codersdkloglevel) | false    |              |             |
 | `» output`     | string                                           | false    |              |             |
+| `» source_id`  | string(uuid)                                     | false    |              |             |
 
 #### Enumerated Values
 
@@ -994,7 +1089,8 @@ curl -X GET http://coder-server:8080/api/v2/workspaceagents/{workspaceagent}/sta
     "created_at": "2019-08-24T14:15:22Z",
     "id": 0,
     "level": "trace",
-    "output": "string"
+    "output": "string",
+    "source_id": "ae50a35c-df42-4eff-ba26-f8bc28d2af81"
   }
 ]
 ```
@@ -1016,6 +1112,7 @@ Status Code **200**
 | `» id`         | integer                                          | false    |              |             |
 | `» level`      | [codersdk.LogLevel](schemas.md#codersdkloglevel) | false    |              |             |
 | `» output`     | string                                           | false    |              |             |
+| `» source_id`  | string(uuid)                                     | false    |              |             |
 
 #### Enumerated Values
 
diff --git a/docs/api/audit.md b/docs/api/audit.md
index d5aeb78665d31..5efe1f3410809 100644
--- a/docs/api/audit.md
+++ b/docs/api/audit.md
@@ -63,7 +63,7 @@ curl -X GET http://coder-server:8080/api/v2/audit?q=string \
         "email": "user@example.com",
         "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
         "last_seen_at": "2019-08-24T14:15:22Z",
-        "login_type": "password",
+        "login_type": "",
         "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
         "roles": [
           {
diff --git a/docs/api/authentication.md b/docs/api/authentication.md
index e0bdb045ee139..77668fe030781 100644
--- a/docs/api/authentication.md
+++ b/docs/api/authentication.md
@@ -2,7 +2,7 @@
 
 Long-lived tokens can be generated to perform actions on behalf of your user account:
 
-```console
+```shell
 coder tokens create
 ```
 
diff --git a/docs/api/authorization.md b/docs/api/authorization.md
index d57a5e7542c35..17fc2e81d2299 100644
--- a/docs/api/authorization.md
+++ b/docs/api/authorization.md
@@ -129,7 +129,7 @@ curl -X POST http://coder-server:8080/api/v2/users/{user}/convert-login \
 ```json
 {
   "password": "string",
-  "to_type": "password"
+  "to_type": ""
 }
 ```
 
@@ -148,7 +148,7 @@ curl -X POST http://coder-server:8080/api/v2/users/{user}/convert-login \
 {
   "expires_at": "2019-08-24T14:15:22Z",
   "state_string": "string",
-  "to_type": "password",
+  "to_type": "",
   "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5"
 }
 ```
diff --git a/docs/api/builds.md b/docs/api/builds.md
index daf7958de387f..a1e8f25a6e69d 100644
--- a/docs/api/builds.md
+++ b/docs/api/builds.md
@@ -39,7 +39,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
     "completed_at": "2019-08-24T14:15:22Z",
     "created_at": "2019-08-24T14:15:22Z",
     "error": "string",
-    "error_code": "MISSING_TEMPLATE_PARAMETER",
+    "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "queue_position": 0,
@@ -74,6 +74,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
               "sharing_level": "owner",
               "slug": "string",
               "subdomain": true,
+              "subdomain_name": "string",
               "url": "string"
             }
           ],
@@ -82,6 +83,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
           "created_at": "2019-08-24T14:15:22Z",
           "directory": "string",
           "disconnected_at": "2019-08-24T14:15:22Z",
+          "display_apps": ["vscode"],
           "environment_variables": {
             "property1": "string",
             "property2": "string"
@@ -106,21 +108,37 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
             }
           },
           "lifecycle_state": "created",
-          "login_before_ready": true,
+          "log_sources": [
+            {
+              "created_at": "2019-08-24T14:15:22Z",
+              "display_name": "string",
+              "icon": "string",
+              "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+              "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+            }
+          ],
           "logs_length": 0,
           "logs_overflowed": true,
           "name": "string",
           "operating_system": "string",
           "ready_at": "2019-08-24T14:15:22Z",
           "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-          "shutdown_script": "string",
-          "shutdown_script_timeout_seconds": 0,
+          "scripts": [
+            {
+              "cron": "string",
+              "log_path": "string",
+              "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+              "run_on_start": true,
+              "run_on_stop": true,
+              "script": "string",
+              "start_blocks_login": true,
+              "timeout": 0
+            }
+          ],
           "started_at": "2019-08-24T14:15:22Z",
-          "startup_script": "string",
           "startup_script_behavior": "blocking",
-          "startup_script_timeout_seconds": 0,
           "status": "connecting",
-          "subsystem": "envbox",
+          "subsystems": ["envbox"],
           "troubleshooting_url": "string",
           "updated_at": "2019-08-24T14:15:22Z",
           "version": "string"
@@ -201,7 +219,7 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild} \
     "completed_at": "2019-08-24T14:15:22Z",
     "created_at": "2019-08-24T14:15:22Z",
     "error": "string",
-    "error_code": "MISSING_TEMPLATE_PARAMETER",
+    "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "queue_position": 0,
@@ -236,6 +254,7 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild} \
               "sharing_level": "owner",
               "slug": "string",
               "subdomain": true,
+              "subdomain_name": "string",
               "url": "string"
             }
           ],
@@ -244,6 +263,7 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild} \
           "created_at": "2019-08-24T14:15:22Z",
           "directory": "string",
           "disconnected_at": "2019-08-24T14:15:22Z",
+          "display_apps": ["vscode"],
           "environment_variables": {
             "property1": "string",
             "property2": "string"
@@ -268,21 +288,37 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild} \
             }
           },
           "lifecycle_state": "created",
-          "login_before_ready": true,
+          "log_sources": [
+            {
+              "created_at": "2019-08-24T14:15:22Z",
+              "display_name": "string",
+              "icon": "string",
+              "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+              "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+            }
+          ],
           "logs_length": 0,
           "logs_overflowed": true,
           "name": "string",
           "operating_system": "string",
           "ready_at": "2019-08-24T14:15:22Z",
           "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-          "shutdown_script": "string",
-          "shutdown_script_timeout_seconds": 0,
+          "scripts": [
+            {
+              "cron": "string",
+              "log_path": "string",
+              "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+              "run_on_start": true,
+              "run_on_stop": true,
+              "script": "string",
+              "start_blocks_login": true,
+              "timeout": 0
+            }
+          ],
           "started_at": "2019-08-24T14:15:22Z",
-          "startup_script": "string",
           "startup_script_behavior": "blocking",
-          "startup_script_timeout_seconds": 0,
           "status": "connecting",
-          "subsystem": "envbox",
+          "subsystems": ["envbox"],
           "troubleshooting_url": "string",
           "updated_at": "2019-08-24T14:15:22Z",
           "version": "string"
@@ -537,6 +573,7 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild}/res
             "sharing_level": "owner",
             "slug": "string",
             "subdomain": true,
+            "subdomain_name": "string",
             "url": "string"
           }
         ],
@@ -545,6 +582,7 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild}/res
         "created_at": "2019-08-24T14:15:22Z",
         "directory": "string",
         "disconnected_at": "2019-08-24T14:15:22Z",
+        "display_apps": ["vscode"],
         "environment_variables": {
           "property1": "string",
           "property2": "string"
@@ -569,21 +607,37 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild}/res
           }
         },
         "lifecycle_state": "created",
-        "login_before_ready": true,
+        "log_sources": [
+          {
+            "created_at": "2019-08-24T14:15:22Z",
+            "display_name": "string",
+            "icon": "string",
+            "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+            "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+          }
+        ],
         "logs_length": 0,
         "logs_overflowed": true,
         "name": "string",
         "operating_system": "string",
         "ready_at": "2019-08-24T14:15:22Z",
         "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-        "shutdown_script": "string",
-        "shutdown_script_timeout_seconds": 0,
+        "scripts": [
+          {
+            "cron": "string",
+            "log_path": "string",
+            "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+            "run_on_start": true,
+            "run_on_stop": true,
+            "script": "string",
+            "start_blocks_login": true,
+            "timeout": 0
+          }
+        ],
         "started_at": "2019-08-24T14:15:22Z",
-        "startup_script": "string",
         "startup_script_behavior": "blocking",
-        "startup_script_timeout_seconds": 0,
         "status": "connecting",
-        "subsystem": "envbox",
+        "subsystems": ["envbox"],
         "troubleshooting_url": "string",
         "updated_at": "2019-08-24T14:15:22Z",
         "version": "string"
@@ -619,76 +673,88 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild}/res
 
 Status Code **200**
 
-| Name                                 | Type                                                                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                    |
-| ------------------------------------ | ------------------------------------------------------------------------------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `[array item]`                       | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `» agents`                           | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»» apps`                            | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»»» command`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» display_name`                   | string                                                                                                 | false    |              | »»display name is a friendly name for the app.                                                                                                                                                                                                 |
-| `»»» external`                       | boolean                                                                                                | false    |              | External specifies whether the URL should be opened externally on the client or not.                                                                                                                                                           |
-| `»»» health`                         | [codersdk.WorkspaceAppHealth](schemas.md#codersdkworkspaceapphealth)                                   | false    |              |                                                                                                                                                                                                                                                |
-| `»»» healthcheck`                    | [codersdk.Healthcheck](schemas.md#codersdkhealthcheck)                                                 | false    |              | Healthcheck specifies the configuration for checking app health.                                                                                                                                                                               |
-| `»»»» interval`                      | integer                                                                                                | false    |              | Interval specifies the seconds between each health check.                                                                                                                                                                                      |
-| `»»»» threshold`                     | integer                                                                                                | false    |              | Threshold specifies the number of consecutive failed health checks before returning "unhealthy".                                                                                                                                               |
-| `»»»» url`                           | string                                                                                                 | false    |              | »»»url specifies the endpoint to check for the app health.                                                                                                                                                                                     |
-| `»»» icon`                           | string                                                                                                 | false    |              | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard.                                                                                                                                               |
-| `»»» id`                             | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»»» sharing_level`                  | [codersdk.WorkspaceAppSharingLevel](schemas.md#codersdkworkspaceappsharinglevel)                       | false    |              |                                                                                                                                                                                                                                                |
-| `»»» slug`                           | string                                                                                                 | false    |              | Slug is a unique identifier within the agent.                                                                                                                                                                                                  |
-| `»»» subdomain`                      | boolean                                                                                                | false    |              | Subdomain denotes whether the app should be accessed via a path on the `coder server` or via a hostname-based dev URL. If this is set to true and there is no app wildcard configured on the server, the app will not be accessible in the UI. |
-| `»»» url`                            | string                                                                                                 | false    |              | »»url is the address being proxied to inside the workspace. If external is specified, this will be opened on the client.                                                                                                                       |
-| `»» architecture`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» connection_timeout_seconds`      | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» created_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» directory`                       | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» disconnected_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» environment_variables`           | object                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» [any property]`                 | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» expanded_directory`              | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» first_connected_at`              | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» health`                          | [codersdk.WorkspaceAgentHealth](schemas.md#codersdkworkspaceagenthealth)                               | false    |              | Health reports the health of the agent.                                                                                                                                                                                                        |
-| `»»» healthy`                        | boolean                                                                                                | false    |              | Healthy is true if the agent is healthy.                                                                                                                                                                                                       |
-| `»»» reason`                         | string                                                                                                 | false    |              | Reason is a human-readable explanation of the agent's health. It is empty if Healthy is true.                                                                                                                                                  |
-| `»» id`                              | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» instance_id`                     | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» last_connected_at`               | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» latency`                         | object                                                                                                 | false    |              | »latency is mapped by region name (e.g. "New York City", "Seattle").                                                                                                                                                                           |
-| `»»» [any property]`                 | [codersdk.DERPRegion](schemas.md#codersdkderpregion)                                                   | false    |              |                                                                                                                                                                                                                                                |
-| `»»»» latency_ms`                    | number                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»»» preferred`                     | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» lifecycle_state`                 | [codersdk.WorkspaceAgentLifecycle](schemas.md#codersdkworkspaceagentlifecycle)                         | false    |              |                                                                                                                                                                                                                                                |
-| `»» login_before_ready`              | boolean                                                                                                | false    |              | Deprecated: Use StartupScriptBehavior instead.                                                                                                                                                                                                 |
-| `»» logs_length`                     | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» logs_overflowed`                 | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» name`                            | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» operating_system`                | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» ready_at`                        | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» resource_id`                     | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» shutdown_script`                 | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» shutdown_script_timeout_seconds` | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» started_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» startup_script`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» startup_script_behavior`         | [codersdk.WorkspaceAgentStartupScriptBehavior](schemas.md#codersdkworkspaceagentstartupscriptbehavior) | false    |              |                                                                                                                                                                                                                                                |
-| `»» startup_script_timeout_seconds`  | integer                                                                                                | false    |              | »startup script timeout seconds is the number of seconds to wait for the startup script to complete. If the script does not complete within this time, the agent lifecycle will be marked as start_timeout.                                    |
-| `»» status`                          | [codersdk.WorkspaceAgentStatus](schemas.md#codersdkworkspaceagentstatus)                               | false    |              |                                                                                                                                                                                                                                                |
-| `»» subsystem`                       | [codersdk.AgentSubsystem](schemas.md#codersdkagentsubsystem)                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» troubleshooting_url`             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» updated_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» version`                         | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» created_at`                       | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `» daily_cost`                       | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `» hide`                             | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `» icon`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» id`                               | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `» job_id`                           | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `» metadata`                         | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»» key`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» sensitive`                       | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» value`                           | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» name`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» type`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» workspace_transition`             | [codersdk.WorkspaceTransition](schemas.md#codersdkworkspacetransition)                                 | false    |              |                                                                                                                                                                                                                                                |
+| Name                            | Type                                                                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                    |
+| ------------------------------- | ------------------------------------------------------------------------------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `[array item]`                  | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `» agents`                      | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» apps`                       | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» command`                   | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» display_name`              | string                                                                                                 | false    |              | Display name is a friendly name for the app.                                                                                                                                                                                                   |
+| `»»» external`                  | boolean                                                                                                | false    |              | External specifies whether the URL should be opened externally on the client or not.                                                                                                                                                           |
+| `»»» health`                    | [codersdk.WorkspaceAppHealth](schemas.md#codersdkworkspaceapphealth)                                   | false    |              |                                                                                                                                                                                                                                                |
+| `»»» healthcheck`               | [codersdk.Healthcheck](schemas.md#codersdkhealthcheck)                                                 | false    |              | Healthcheck specifies the configuration for checking app health.                                                                                                                                                                               |
+| `»»»» interval`                 | integer                                                                                                | false    |              | Interval specifies the seconds between each health check.                                                                                                                                                                                      |
+| `»»»» threshold`                | integer                                                                                                | false    |              | Threshold specifies the number of consecutive failed health checks before returning "unhealthy".                                                                                                                                               |
+| `»»»» url`                      | string                                                                                                 | false    |              | URL specifies the endpoint to check for the app health.                                                                                                                                                                                        |
+| `»»» icon`                      | string                                                                                                 | false    |              | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard.                                                                                                                                               |
+| `»»» id`                        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»» sharing_level`             | [codersdk.WorkspaceAppSharingLevel](schemas.md#codersdkworkspaceappsharinglevel)                       | false    |              |                                                                                                                                                                                                                                                |
+| `»»» slug`                      | string                                                                                                 | false    |              | Slug is a unique identifier within the agent.                                                                                                                                                                                                  |
+| `»»» subdomain`                 | boolean                                                                                                | false    |              | Subdomain denotes whether the app should be accessed via a path on the `coder server` or via a hostname-based dev URL. If this is set to true and there is no app wildcard configured on the server, the app will not be accessible in the UI. |
+| `»»» subdomain_name`            | string                                                                                                 | false    |              | Subdomain name is the application domain exposed on the `coder server`.                                                                                                                                                                        |
+| `»»» url`                       | string                                                                                                 | false    |              | URL is the address being proxied to inside the workspace. If external is specified, this will be opened on the client.                                                                                                                         |
+| `»» architecture`               | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» connection_timeout_seconds` | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» created_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» directory`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» disconnected_at`            | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» display_apps`               | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» environment_variables`      | object                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» [any property]`            | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» expanded_directory`         | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» first_connected_at`         | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» health`                     | [codersdk.WorkspaceAgentHealth](schemas.md#codersdkworkspaceagenthealth)                               | false    |              | Health reports the health of the agent.                                                                                                                                                                                                        |
+| `»»» healthy`                   | boolean                                                                                                | false    |              | Healthy is true if the agent is healthy.                                                                                                                                                                                                       |
+| `»»» reason`                    | string                                                                                                 | false    |              | Reason is a human-readable explanation of the agent's health. It is empty if Healthy is true.                                                                                                                                                  |
+| `»» id`                         | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» instance_id`                | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» last_connected_at`          | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» latency`                    | object                                                                                                 | false    |              | Latency is mapped by region name (e.g. "New York City", "Seattle").                                                                                                                                                                            |
+| `»»» [any property]`            | [codersdk.DERPRegion](schemas.md#codersdkderpregion)                                                   | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» latency_ms`               | number                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» preferred`                | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» lifecycle_state`            | [codersdk.WorkspaceAgentLifecycle](schemas.md#codersdkworkspaceagentlifecycle)                         | false    |              |                                                                                                                                                                                                                                                |
+| `»» log_sources`                | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» created_at`                | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»»» display_name`              | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» icon`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» id`                        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»» workspace_agent_id`        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» logs_length`                | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» logs_overflowed`            | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» name`                       | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» operating_system`           | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» ready_at`                   | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» resource_id`                | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» scripts`                    | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» cron`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» log_path`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» log_source_id`             | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»» run_on_start`              | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» run_on_stop`               | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» script`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» start_blocks_login`        | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» timeout`                   | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» started_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» startup_script_behavior`    | [codersdk.WorkspaceAgentStartupScriptBehavior](schemas.md#codersdkworkspaceagentstartupscriptbehavior) | false    |              | Startup script behavior is a legacy field that is deprecated in favor of the `coder_script` resource. It's only referenced by old clients. Deprecated: Remove in the future!                                                                   |
+| `»» status`                     | [codersdk.WorkspaceAgentStatus](schemas.md#codersdkworkspaceagentstatus)                               | false    |              |                                                                                                                                                                                                                                                |
+| `»» subsystems`                 | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» troubleshooting_url`        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» updated_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» version`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» created_at`                  | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `» daily_cost`                  | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `» hide`                        | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `» icon`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» id`                          | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» job_id`                      | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» metadata`                    | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» key`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» sensitive`                  | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» value`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» name`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» type`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» workspace_transition`        | [codersdk.WorkspaceTransition](schemas.md#codersdkworkspacetransition)                                 | false    |              |                                                                                                                                                                                                                                                |
 
 #### Enumerated Values
 
@@ -716,7 +782,6 @@ Status Code **200**
 | `status`                  | `connected`        |
 | `status`                  | `disconnected`     |
 | `status`                  | `timeout`          |
-| `subsystem`               | `envbox`           |
 | `workspace_transition`    | `start`            |
 | `workspace_transition`    | `stop`             |
 | `workspace_transition`    | `delete`           |
@@ -760,7 +825,7 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild}/sta
     "completed_at": "2019-08-24T14:15:22Z",
     "created_at": "2019-08-24T14:15:22Z",
     "error": "string",
-    "error_code": "MISSING_TEMPLATE_PARAMETER",
+    "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "queue_position": 0,
@@ -795,6 +860,7 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild}/sta
               "sharing_level": "owner",
               "slug": "string",
               "subdomain": true,
+              "subdomain_name": "string",
               "url": "string"
             }
           ],
@@ -803,6 +869,7 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild}/sta
           "created_at": "2019-08-24T14:15:22Z",
           "directory": "string",
           "disconnected_at": "2019-08-24T14:15:22Z",
+          "display_apps": ["vscode"],
           "environment_variables": {
             "property1": "string",
             "property2": "string"
@@ -827,21 +894,37 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild}/sta
             }
           },
           "lifecycle_state": "created",
-          "login_before_ready": true,
+          "log_sources": [
+            {
+              "created_at": "2019-08-24T14:15:22Z",
+              "display_name": "string",
+              "icon": "string",
+              "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+              "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+            }
+          ],
           "logs_length": 0,
           "logs_overflowed": true,
           "name": "string",
           "operating_system": "string",
           "ready_at": "2019-08-24T14:15:22Z",
           "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-          "shutdown_script": "string",
-          "shutdown_script_timeout_seconds": 0,
+          "scripts": [
+            {
+              "cron": "string",
+              "log_path": "string",
+              "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+              "run_on_start": true,
+              "run_on_stop": true,
+              "script": "string",
+              "start_blocks_login": true,
+              "timeout": 0
+            }
+          ],
           "started_at": "2019-08-24T14:15:22Z",
-          "startup_script": "string",
           "startup_script_behavior": "blocking",
-          "startup_script_timeout_seconds": 0,
           "status": "connecting",
-          "subsystem": "envbox",
+          "subsystems": ["envbox"],
           "troubleshooting_url": "string",
           "updated_at": "2019-08-24T14:15:22Z",
           "version": "string"
@@ -927,7 +1010,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
       "completed_at": "2019-08-24T14:15:22Z",
       "created_at": "2019-08-24T14:15:22Z",
       "error": "string",
-      "error_code": "MISSING_TEMPLATE_PARAMETER",
+      "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "queue_position": 0,
@@ -962,6 +1045,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
                 "sharing_level": "owner",
                 "slug": "string",
                 "subdomain": true,
+                "subdomain_name": "string",
                 "url": "string"
               }
             ],
@@ -970,6 +1054,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
             "created_at": "2019-08-24T14:15:22Z",
             "directory": "string",
             "disconnected_at": "2019-08-24T14:15:22Z",
+            "display_apps": ["vscode"],
             "environment_variables": {
               "property1": "string",
               "property2": "string"
@@ -994,21 +1079,37 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
               }
             },
             "lifecycle_state": "created",
-            "login_before_ready": true,
+            "log_sources": [
+              {
+                "created_at": "2019-08-24T14:15:22Z",
+                "display_name": "string",
+                "icon": "string",
+                "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+                "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+              }
+            ],
             "logs_length": 0,
             "logs_overflowed": true,
             "name": "string",
             "operating_system": "string",
             "ready_at": "2019-08-24T14:15:22Z",
             "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-            "shutdown_script": "string",
-            "shutdown_script_timeout_seconds": 0,
+            "scripts": [
+              {
+                "cron": "string",
+                "log_path": "string",
+                "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+                "run_on_start": true,
+                "run_on_stop": true,
+                "script": "string",
+                "start_blocks_login": true,
+                "timeout": 0
+              }
+            ],
             "started_at": "2019-08-24T14:15:22Z",
-            "startup_script": "string",
             "startup_script_behavior": "blocking",
-            "startup_script_timeout_seconds": 0,
             "status": "connecting",
-            "subsystem": "envbox",
+            "subsystems": ["envbox"],
             "troubleshooting_url": "string",
             "updated_at": "2019-08-24T14:15:22Z",
             "version": "string"
@@ -1055,116 +1156,127 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
 
 Status Code **200**
 
-| Name                                  | Type                                                                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                    |
-| ------------------------------------- | ------------------------------------------------------------------------------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `[array item]`                        | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `» build_number`                      | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `» created_at`                        | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `» daily_cost`                        | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `» deadline`                          | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `» id`                                | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `» initiator_id`                      | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `» initiator_name`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» job`                               | [codersdk.ProvisionerJob](schemas.md#codersdkprovisionerjob)                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» canceled_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» completed_at`                     | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» created_at`                       | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» error`                            | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» error_code`                       | [codersdk.JobErrorCode](schemas.md#codersdkjoberrorcode)                                               | false    |              |                                                                                                                                                                                                                                                |
-| `»» file_id`                          | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» id`                               | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» queue_position`                   | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» queue_size`                       | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» started_at`                       | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» status`                           | [codersdk.ProvisionerJobStatus](schemas.md#codersdkprovisionerjobstatus)                               | false    |              |                                                                                                                                                                                                                                                |
-| `»» tags`                             | object                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» [any property]`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» worker_id`                        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `» max_deadline`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `» reason`                            | [codersdk.BuildReason](schemas.md#codersdkbuildreason)                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» resources`                         | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»» agents`                           | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»»» apps`                            | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»»»» command`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»»» display_name`                   | string                                                                                                 | false    |              | »»»display name is a friendly name for the app.                                                                                                                                                                                                |
-| `»»»» external`                       | boolean                                                                                                | false    |              | External specifies whether the URL should be opened externally on the client or not.                                                                                                                                                           |
-| `»»»» health`                         | [codersdk.WorkspaceAppHealth](schemas.md#codersdkworkspaceapphealth)                                   | false    |              |                                                                                                                                                                                                                                                |
-| `»»»» healthcheck`                    | [codersdk.Healthcheck](schemas.md#codersdkhealthcheck)                                                 | false    |              | Healthcheck specifies the configuration for checking app health.                                                                                                                                                                               |
-| `»»»»» interval`                      | integer                                                                                                | false    |              | Interval specifies the seconds between each health check.                                                                                                                                                                                      |
-| `»»»»» threshold`                     | integer                                                                                                | false    |              | Threshold specifies the number of consecutive failed health checks before returning "unhealthy".                                                                                                                                               |
-| `»»»»» url`                           | string                                                                                                 | false    |              | »»»»url specifies the endpoint to check for the app health.                                                                                                                                                                                    |
-| `»»»» icon`                           | string                                                                                                 | false    |              | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard.                                                                                                                                               |
-| `»»»» id`                             | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»»»» sharing_level`                  | [codersdk.WorkspaceAppSharingLevel](schemas.md#codersdkworkspaceappsharinglevel)                       | false    |              |                                                                                                                                                                                                                                                |
-| `»»»» slug`                           | string                                                                                                 | false    |              | Slug is a unique identifier within the agent.                                                                                                                                                                                                  |
-| `»»»» subdomain`                      | boolean                                                                                                | false    |              | Subdomain denotes whether the app should be accessed via a path on the `coder server` or via a hostname-based dev URL. If this is set to true and there is no app wildcard configured on the server, the app will not be accessible in the UI. |
-| `»»»» url`                            | string                                                                                                 | false    |              | »»»url is the address being proxied to inside the workspace. If external is specified, this will be opened on the client.                                                                                                                      |
-| `»»» architecture`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» connection_timeout_seconds`      | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»»» created_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»»» directory`                       | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» disconnected_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»»» environment_variables`           | object                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»»» [any property]`                 | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» expanded_directory`              | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» first_connected_at`              | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»»» health`                          | [codersdk.WorkspaceAgentHealth](schemas.md#codersdkworkspaceagenthealth)                               | false    |              | Health reports the health of the agent.                                                                                                                                                                                                        |
-| `»»»» healthy`                        | boolean                                                                                                | false    |              | Healthy is true if the agent is healthy.                                                                                                                                                                                                       |
-| `»»»» reason`                         | string                                                                                                 | false    |              | Reason is a human-readable explanation of the agent's health. It is empty if Healthy is true.                                                                                                                                                  |
-| `»»» id`                              | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»»» instance_id`                     | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» last_connected_at`               | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»»» latency`                         | object                                                                                                 | false    |              | »»latency is mapped by region name (e.g. "New York City", "Seattle").                                                                                                                                                                          |
-| `»»»» [any property]`                 | [codersdk.DERPRegion](schemas.md#codersdkderpregion)                                                   | false    |              |                                                                                                                                                                                                                                                |
-| `»»»»» latency_ms`                    | number                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»»»» preferred`                     | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»»» lifecycle_state`                 | [codersdk.WorkspaceAgentLifecycle](schemas.md#codersdkworkspaceagentlifecycle)                         | false    |              |                                                                                                                                                                                                                                                |
-| `»»» login_before_ready`              | boolean                                                                                                | false    |              | Deprecated: Use StartupScriptBehavior instead.                                                                                                                                                                                                 |
-| `»»» logs_length`                     | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»»» logs_overflowed`                 | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»»» name`                            | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» operating_system`                | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» ready_at`                        | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»»» resource_id`                     | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»»» shutdown_script`                 | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» shutdown_script_timeout_seconds` | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»»» started_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»»» startup_script`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» startup_script_behavior`         | [codersdk.WorkspaceAgentStartupScriptBehavior](schemas.md#codersdkworkspaceagentstartupscriptbehavior) | false    |              |                                                                                                                                                                                                                                                |
-| `»»» startup_script_timeout_seconds`  | integer                                                                                                | false    |              | »»startup script timeout seconds is the number of seconds to wait for the startup script to complete. If the script does not complete within this time, the agent lifecycle will be marked as start_timeout.                                   |
-| `»»» status`                          | [codersdk.WorkspaceAgentStatus](schemas.md#codersdkworkspaceagentstatus)                               | false    |              |                                                                                                                                                                                                                                                |
-| `»»» subsystem`                       | [codersdk.AgentSubsystem](schemas.md#codersdkagentsubsystem)                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»»» troubleshooting_url`             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» updated_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»»» version`                         | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» created_at`                       | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» daily_cost`                       | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» hide`                             | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» icon`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» id`                               | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» job_id`                           | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» metadata`                         | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»»» key`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» sensitive`                       | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»»» value`                           | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» name`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» type`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» workspace_transition`             | [codersdk.WorkspaceTransition](schemas.md#codersdkworkspacetransition)                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» status`                            | [codersdk.WorkspaceStatus](schemas.md#codersdkworkspacestatus)                                         | false    |              |                                                                                                                                                                                                                                                |
-| `» template_version_id`               | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `» template_version_name`             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» transition`                        | [codersdk.WorkspaceTransition](schemas.md#codersdkworkspacetransition)                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» updated_at`                        | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `» workspace_id`                      | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `» workspace_name`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» workspace_owner_id`                | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `» workspace_owner_name`              | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| Name                             | Type                                                                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                    |
+| -------------------------------- | ------------------------------------------------------------------------------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `[array item]`                   | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `» build_number`                 | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `» created_at`                   | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `» daily_cost`                   | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `» deadline`                     | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `» id`                           | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» initiator_id`                 | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» initiator_name`               | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» job`                          | [codersdk.ProvisionerJob](schemas.md#codersdkprovisionerjob)                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» canceled_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» completed_at`                | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» created_at`                  | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» error`                       | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» error_code`                  | [codersdk.JobErrorCode](schemas.md#codersdkjoberrorcode)                                               | false    |              |                                                                                                                                                                                                                                                |
+| `»» file_id`                     | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» id`                          | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» queue_position`              | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» queue_size`                  | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» started_at`                  | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» status`                      | [codersdk.ProvisionerJobStatus](schemas.md#codersdkprovisionerjobstatus)                               | false    |              |                                                                                                                                                                                                                                                |
+| `»» tags`                        | object                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» [any property]`             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» worker_id`                   | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» max_deadline`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `» reason`                       | [codersdk.BuildReason](schemas.md#codersdkbuildreason)                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» resources`                    | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» agents`                      | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» apps`                       | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» command`                   | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» display_name`              | string                                                                                                 | false    |              | Display name is a friendly name for the app.                                                                                                                                                                                                   |
+| `»»»» external`                  | boolean                                                                                                | false    |              | External specifies whether the URL should be opened externally on the client or not.                                                                                                                                                           |
+| `»»»» health`                    | [codersdk.WorkspaceAppHealth](schemas.md#codersdkworkspaceapphealth)                                   | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» healthcheck`               | [codersdk.Healthcheck](schemas.md#codersdkhealthcheck)                                                 | false    |              | Healthcheck specifies the configuration for checking app health.                                                                                                                                                                               |
+| `»»»»» interval`                 | integer                                                                                                | false    |              | Interval specifies the seconds between each health check.                                                                                                                                                                                      |
+| `»»»»» threshold`                | integer                                                                                                | false    |              | Threshold specifies the number of consecutive failed health checks before returning "unhealthy".                                                                                                                                               |
+| `»»»»» url`                      | string                                                                                                 | false    |              | URL specifies the endpoint to check for the app health.                                                                                                                                                                                        |
+| `»»»» icon`                      | string                                                                                                 | false    |              | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard.                                                                                                                                               |
+| `»»»» id`                        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» sharing_level`             | [codersdk.WorkspaceAppSharingLevel](schemas.md#codersdkworkspaceappsharinglevel)                       | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» slug`                      | string                                                                                                 | false    |              | Slug is a unique identifier within the agent.                                                                                                                                                                                                  |
+| `»»»» subdomain`                 | boolean                                                                                                | false    |              | Subdomain denotes whether the app should be accessed via a path on the `coder server` or via a hostname-based dev URL. If this is set to true and there is no app wildcard configured on the server, the app will not be accessible in the UI. |
+| `»»»» subdomain_name`            | string                                                                                                 | false    |              | Subdomain name is the application domain exposed on the `coder server`.                                                                                                                                                                        |
+| `»»»» url`                       | string                                                                                                 | false    |              | URL is the address being proxied to inside the workspace. If external is specified, this will be opened on the client.                                                                                                                         |
+| `»»» architecture`               | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» connection_timeout_seconds` | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» created_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»»» directory`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» disconnected_at`            | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»»» display_apps`               | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» environment_variables`      | object                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» [any property]`            | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» expanded_directory`         | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» first_connected_at`         | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»»» health`                     | [codersdk.WorkspaceAgentHealth](schemas.md#codersdkworkspaceagenthealth)                               | false    |              | Health reports the health of the agent.                                                                                                                                                                                                        |
+| `»»»» healthy`                   | boolean                                                                                                | false    |              | Healthy is true if the agent is healthy.                                                                                                                                                                                                       |
+| `»»»» reason`                    | string                                                                                                 | false    |              | Reason is a human-readable explanation of the agent's health. It is empty if Healthy is true.                                                                                                                                                  |
+| `»»» id`                         | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»» instance_id`                | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» last_connected_at`          | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»»» latency`                    | object                                                                                                 | false    |              | Latency is mapped by region name (e.g. "New York City", "Seattle").                                                                                                                                                                            |
+| `»»»» [any property]`            | [codersdk.DERPRegion](schemas.md#codersdkderpregion)                                                   | false    |              |                                                                                                                                                                                                                                                |
+| `»»»»» latency_ms`               | number                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»»»» preferred`                | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» lifecycle_state`            | [codersdk.WorkspaceAgentLifecycle](schemas.md#codersdkworkspaceagentlifecycle)                         | false    |              |                                                                                                                                                                                                                                                |
+| `»»» log_sources`                | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» created_at`                | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» display_name`              | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» icon`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» id`                        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» workspace_agent_id`        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»» logs_length`                | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» logs_overflowed`            | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» name`                       | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» operating_system`           | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» ready_at`                   | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»»» resource_id`                | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»» scripts`                    | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» cron`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» log_path`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» log_source_id`             | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» run_on_start`              | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» run_on_stop`               | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» script`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» start_blocks_login`        | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» timeout`                   | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» started_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»»» startup_script_behavior`    | [codersdk.WorkspaceAgentStartupScriptBehavior](schemas.md#codersdkworkspaceagentstartupscriptbehavior) | false    |              | Startup script behavior is a legacy field that is deprecated in favor of the `coder_script` resource. It's only referenced by old clients. Deprecated: Remove in the future!                                                                   |
+| `»»» status`                     | [codersdk.WorkspaceAgentStatus](schemas.md#codersdkworkspaceagentstatus)                               | false    |              |                                                                                                                                                                                                                                                |
+| `»»» subsystems`                 | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» troubleshooting_url`        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» updated_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»»» version`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» created_at`                  | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» daily_cost`                  | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» hide`                        | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» icon`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» id`                          | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» job_id`                      | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» metadata`                    | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» key`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» sensitive`                  | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» value`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» name`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» type`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» workspace_transition`        | [codersdk.WorkspaceTransition](schemas.md#codersdkworkspacetransition)                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» status`                       | [codersdk.WorkspaceStatus](schemas.md#codersdkworkspacestatus)                                         | false    |              |                                                                                                                                                                                                                                                |
+| `» template_version_id`          | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» template_version_name`        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» transition`                   | [codersdk.WorkspaceTransition](schemas.md#codersdkworkspacetransition)                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» updated_at`                   | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `» workspace_id`                 | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» workspace_name`               | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» workspace_owner_id`           | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» workspace_owner_name`         | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
 
 #### Enumerated Values
 
 | Property                  | Value                         |
 | ------------------------- | ----------------------------- |
-| `error_code`              | `MISSING_TEMPLATE_PARAMETER`  |
 | `error_code`              | `REQUIRED_TEMPLATE_VARIABLES` |
 | `status`                  | `pending`                     |
 | `status`                  | `running`                     |
@@ -1197,7 +1309,6 @@ Status Code **200**
 | `status`                  | `connected`                   |
 | `status`                  | `disconnected`                |
 | `status`                  | `timeout`                     |
-| `subsystem`               | `envbox`                      |
 | `workspace_transition`    | `start`                       |
 | `workspace_transition`    | `stop`                        |
 | `workspace_transition`    | `delete`                      |
@@ -1275,7 +1386,7 @@ curl -X POST http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
     "completed_at": "2019-08-24T14:15:22Z",
     "created_at": "2019-08-24T14:15:22Z",
     "error": "string",
-    "error_code": "MISSING_TEMPLATE_PARAMETER",
+    "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "queue_position": 0,
@@ -1310,6 +1421,7 @@ curl -X POST http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
               "sharing_level": "owner",
               "slug": "string",
               "subdomain": true,
+              "subdomain_name": "string",
               "url": "string"
             }
           ],
@@ -1318,6 +1430,7 @@ curl -X POST http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
           "created_at": "2019-08-24T14:15:22Z",
           "directory": "string",
           "disconnected_at": "2019-08-24T14:15:22Z",
+          "display_apps": ["vscode"],
           "environment_variables": {
             "property1": "string",
             "property2": "string"
@@ -1342,21 +1455,37 @@ curl -X POST http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
             }
           },
           "lifecycle_state": "created",
-          "login_before_ready": true,
+          "log_sources": [
+            {
+              "created_at": "2019-08-24T14:15:22Z",
+              "display_name": "string",
+              "icon": "string",
+              "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+              "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+            }
+          ],
           "logs_length": 0,
           "logs_overflowed": true,
           "name": "string",
           "operating_system": "string",
           "ready_at": "2019-08-24T14:15:22Z",
           "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-          "shutdown_script": "string",
-          "shutdown_script_timeout_seconds": 0,
+          "scripts": [
+            {
+              "cron": "string",
+              "log_path": "string",
+              "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+              "run_on_start": true,
+              "run_on_stop": true,
+              "script": "string",
+              "start_blocks_login": true,
+              "timeout": 0
+            }
+          ],
           "started_at": "2019-08-24T14:15:22Z",
-          "startup_script": "string",
           "startup_script_behavior": "blocking",
-          "startup_script_timeout_seconds": 0,
           "status": "connecting",
-          "subsystem": "envbox",
+          "subsystems": ["envbox"],
           "troubleshooting_url": "string",
           "updated_at": "2019-08-24T14:15:22Z",
           "version": "string"
diff --git a/docs/api/debug.md b/docs/api/debug.md
index e3382c6586504..5016f6a87b256 100644
--- a/docs/api/debug.md
+++ b/docs/api/debug.md
@@ -102,6 +102,7 @@ curl -X GET http://coder-server:8080/api/v2/debug/health \
             "error": "string",
             "healthy": true,
             "node": {
+              "canPort80": true,
               "certName": "string",
               "derpport": 0,
               "forceHTTP": true,
@@ -134,6 +135,7 @@ curl -X GET http://coder-server:8080/api/v2/debug/health \
           "embeddedRelay": true,
           "nodes": [
             {
+              "canPort80": true,
               "certName": "string",
               "derpport": 0,
               "forceHTTP": true,
@@ -164,6 +166,7 @@ curl -X GET http://coder-server:8080/api/v2/debug/health \
             "error": "string",
             "healthy": true,
             "node": {
+              "canPort80": true,
               "certName": "string",
               "derpport": 0,
               "forceHTTP": true,
@@ -196,6 +199,7 @@ curl -X GET http://coder-server:8080/api/v2/debug/health \
           "embeddedRelay": true,
           "nodes": [
             {
+              "canPort80": true,
               "certName": "string",
               "derpport": 0,
               "forceHTTP": true,
diff --git a/docs/api/enterprise.md b/docs/api/enterprise.md
index d859ac59ad09b..743fbc19fd532 100644
--- a/docs/api/enterprise.md
+++ b/docs/api/enterprise.md
@@ -19,6 +19,7 @@ curl -X GET http://coder-server:8080/api/v2/appearance \
 
 ```json
 {
+  "application_name": "string",
   "logo_url": "string",
   "service_banner": {
     "background_color": "string",
@@ -61,6 +62,7 @@ curl -X PUT http://coder-server:8080/api/v2/appearance \
 
 ```json
 {
+  "application_name": "string",
   "logo_url": "string",
   "service_banner": {
     "background_color": "string",
@@ -82,6 +84,7 @@ curl -X PUT http://coder-server:8080/api/v2/appearance \
 
 ```json
 {
+  "application_name": "string",
   "logo_url": "string",
   "service_banner": {
     "background_color": "string",
@@ -134,6 +137,7 @@ curl -X GET http://coder-server:8080/api/v2/entitlements \
     }
   },
   "has_license": true,
+  "refreshed_at": "2019-08-24T14:15:22Z",
   "require_telemetry": true,
   "trial": true,
   "warnings": ["string"]
@@ -148,7 +152,7 @@ curl -X GET http://coder-server:8080/api/v2/entitlements \
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
-## Get group by name
+## Get group by ID
 
 ### Code samples
 
@@ -165,7 +169,7 @@ curl -X GET http://coder-server:8080/api/v2/groups/{group} \
 
 | Name    | In   | Type   | Required | Description |
 | ------- | ---- | ------ | -------- | ----------- |
-| `group` | path | string | true     | Group name  |
+| `group` | path | string | true     | Group id    |
 
 ### Example responses
 
@@ -183,7 +187,7 @@ curl -X GET http://coder-server:8080/api/v2/groups/{group} \
       "email": "user@example.com",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "last_seen_at": "2019-08-24T14:15:22Z",
-      "login_type": "password",
+      "login_type": "",
       "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
       "roles": [
         {
@@ -197,7 +201,8 @@ curl -X GET http://coder-server:8080/api/v2/groups/{group} \
   ],
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
-  "quota_allowance": 0
+  "quota_allowance": 0,
+  "source": "user"
 }
 ```
 
@@ -244,7 +249,7 @@ curl -X DELETE http://coder-server:8080/api/v2/groups/{group} \
       "email": "user@example.com",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "last_seen_at": "2019-08-24T14:15:22Z",
-      "login_type": "password",
+      "login_type": "",
       "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
       "roles": [
         {
@@ -258,7 +263,8 @@ curl -X DELETE http://coder-server:8080/api/v2/groups/{group} \
   ],
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
-  "quota_allowance": 0
+  "quota_allowance": 0,
+  "source": "user"
 }
 ```
 
@@ -277,17 +283,32 @@ To perform this operation, you must be authenticated. [Learn more](authenticatio
 ```shell
 # Example request using curl
 curl -X PATCH http://coder-server:8080/api/v2/groups/{group} \
+  -H 'Content-Type: application/json' \
   -H 'Accept: application/json' \
   -H 'Coder-Session-Token: API_KEY'
 ```
 
 `PATCH /groups/{group}`
 
+> Body parameter
+
+```json
+{
+  "add_users": ["string"],
+  "avatar_url": "string",
+  "display_name": "string",
+  "name": "string",
+  "quota_allowance": 0,
+  "remove_users": ["string"]
+}
+```
+
 ### Parameters
 
-| Name    | In   | Type   | Required | Description |
-| ------- | ---- | ------ | -------- | ----------- |
-| `group` | path | string | true     | Group name  |
+| Name    | In   | Type                                                               | Required | Description         |
+| ------- | ---- | ------------------------------------------------------------------ | -------- | ------------------- |
+| `group` | path | string                                                             | true     | Group name          |
+| `body`  | body | [codersdk.PatchGroupRequest](schemas.md#codersdkpatchgrouprequest) | true     | Patch group request |
 
 ### Example responses
 
@@ -305,7 +326,7 @@ curl -X PATCH http://coder-server:8080/api/v2/groups/{group} \
       "email": "user@example.com",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "last_seen_at": "2019-08-24T14:15:22Z",
-      "login_type": "password",
+      "login_type": "",
       "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
       "roles": [
         {
@@ -319,7 +340,8 @@ curl -X PATCH http://coder-server:8080/api/v2/groups/{group} \
   ],
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
-  "quota_allowance": 0
+  "quota_allowance": 0,
+  "source": "user"
 }
 ```
 
@@ -441,7 +463,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/groups
         "email": "user@example.com",
         "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
         "last_seen_at": "2019-08-24T14:15:22Z",
-        "login_type": "password",
+        "login_type": "",
         "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
         "roles": [
           {
@@ -455,7 +477,8 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/groups
     ],
     "name": "string",
     "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
-    "quota_allowance": 0
+    "quota_allowance": 0,
+    "source": "user"
   }
 ]
 ```
@@ -470,33 +493,35 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/groups
 
 Status Code **200**
 
-| Name                  | Type                                                 | Required | Restrictions | Description |
-| --------------------- | ---------------------------------------------------- | -------- | ------------ | ----------- |
-| `[array item]`        | array                                                | false    |              |             |
-| `» avatar_url`        | string                                               | false    |              |             |
-| `» display_name`      | string                                               | false    |              |             |
-| `» id`                | string(uuid)                                         | false    |              |             |
-| `» members`           | array                                                | false    |              |             |
-| `»» avatar_url`       | string(uri)                                          | false    |              |             |
-| `»» created_at`       | string(date-time)                                    | true     |              |             |
-| `»» email`            | string(email)                                        | true     |              |             |
-| `»» id`               | string(uuid)                                         | true     |              |             |
-| `»» last_seen_at`     | string(date-time)                                    | false    |              |             |
-| `»» login_type`       | [codersdk.LoginType](schemas.md#codersdklogintype)   | false    |              |             |
-| `»» organization_ids` | array                                                | false    |              |             |
-| `»» roles`            | array                                                | false    |              |             |
-| `»»» display_name`    | string                                               | false    |              |             |
-| `»»» name`            | string                                               | false    |              |             |
-| `»» status`           | [codersdk.UserStatus](schemas.md#codersdkuserstatus) | false    |              |             |
-| `»» username`         | string                                               | true     |              |             |
-| `» name`              | string                                               | false    |              |             |
-| `» organization_id`   | string(uuid)                                         | false    |              |             |
-| `» quota_allowance`   | integer                                              | false    |              |             |
+| Name                  | Type                                                   | Required | Restrictions | Description |
+| --------------------- | ------------------------------------------------------ | -------- | ------------ | ----------- |
+| `[array item]`        | array                                                  | false    |              |             |
+| `» avatar_url`        | string                                                 | false    |              |             |
+| `» display_name`      | string                                                 | false    |              |             |
+| `» id`                | string(uuid)                                           | false    |              |             |
+| `» members`           | array                                                  | false    |              |             |
+| `»» avatar_url`       | string(uri)                                            | false    |              |             |
+| `»» created_at`       | string(date-time)                                      | true     |              |             |
+| `»» email`            | string(email)                                          | true     |              |             |
+| `»» id`               | string(uuid)                                           | true     |              |             |
+| `»» last_seen_at`     | string(date-time)                                      | false    |              |             |
+| `»» login_type`       | [codersdk.LoginType](schemas.md#codersdklogintype)     | false    |              |             |
+| `»» organization_ids` | array                                                  | false    |              |             |
+| `»» roles`            | array                                                  | false    |              |             |
+| `»»» display_name`    | string                                                 | false    |              |             |
+| `»»» name`            | string                                                 | false    |              |             |
+| `»» status`           | [codersdk.UserStatus](schemas.md#codersdkuserstatus)   | false    |              |             |
+| `»» username`         | string                                                 | true     |              |             |
+| `» name`              | string                                                 | false    |              |             |
+| `» organization_id`   | string(uuid)                                           | false    |              |             |
+| `» quota_allowance`   | integer                                                | false    |              |             |
+| `» source`            | [codersdk.GroupSource](schemas.md#codersdkgroupsource) | false    |              |             |
 
 #### Enumerated Values
 
 | Property     | Value       |
 | ------------ | ----------- |
+| `login_type` | ``          |
 | `login_type` | `password`  |
 | `login_type` | `github`    |
 | `login_type` | `oidc`      |
@@ -504,6 +529,8 @@ Status Code **200**
 | `login_type` | `none`      |
 | `status`     | `active`    |
 | `status`     | `suspended` |
+| `source`     | `user`      |
+| `source`     | `oidc`      |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
@@ -555,7 +582,7 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/groups
       "email": "user@example.com",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "last_seen_at": "2019-08-24T14:15:22Z",
-      "login_type": "password",
+      "login_type": "",
       "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
       "roles": [
         {
@@ -569,7 +596,8 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/groups
   ],
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
-  "quota_allowance": 0
+  "quota_allowance": 0,
+  "source": "user"
 }
 ```
 
@@ -617,7 +645,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/groups/
       "email": "user@example.com",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "last_seen_at": "2019-08-24T14:15:22Z",
-      "login_type": "password",
+      "login_type": "",
       "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
       "roles": [
         {
@@ -631,7 +659,8 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/groups/
   ],
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
-  "quota_allowance": 0
+  "quota_allowance": 0,
+  "source": "user"
 }
 ```
 
@@ -979,7 +1008,7 @@ curl -X PATCH http://coder-server:8080/api/v2/scim/v2/Users/{id} \
   "email": "user@example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "last_seen_at": "2019-08-24T14:15:22Z",
-  "login_type": "password",
+  "login_type": "",
   "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
   "roles": [
     {
@@ -1031,7 +1060,7 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/acl \
     "email": "user@example.com",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "last_seen_at": "2019-08-24T14:15:22Z",
-    "login_type": "password",
+    "login_type": "",
     "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
     "role": "admin",
     "roles": [
@@ -1077,6 +1106,7 @@ Status Code **200**
 
 | Property     | Value       |
 | ------------ | ----------- |
+| `login_type` | ``          |
 | `login_type` | `password`  |
 | `login_type` | `github`    |
 | `login_type` | `oidc`      |
@@ -1188,7 +1218,7 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/acl/available \
             "email": "user@example.com",
             "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
             "last_seen_at": "2019-08-24T14:15:22Z",
-            "login_type": "password",
+            "login_type": "",
             "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
             "roles": [
               {
@@ -1202,7 +1232,8 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/acl/available \
         ],
         "name": "string",
         "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
-        "quota_allowance": 0
+        "quota_allowance": 0,
+        "source": "user"
       }
     ],
     "users": [
@@ -1212,7 +1243,7 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/acl/available \
         "email": "user@example.com",
         "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
         "last_seen_at": "2019-08-24T14:15:22Z",
-        "login_type": "password",
+        "login_type": "",
         "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
         "roles": [
           {
@@ -1238,35 +1269,37 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/acl/available \
 
 Status Code **200**
 
-| Name                   | Type                                                 | Required | Restrictions | Description |
-| ---------------------- | ---------------------------------------------------- | -------- | ------------ | ----------- |
-| `[array item]`         | array                                                | false    |              |             |
-| `» groups`             | array                                                | false    |              |             |
-| `»» avatar_url`        | string                                               | false    |              |             |
-| `»» display_name`      | string                                               | false    |              |             |
-| `»» id`                | string(uuid)                                         | false    |              |             |
-| `»» members`           | array                                                | false    |              |             |
-| `»»» avatar_url`       | string(uri)                                          | false    |              |             |
-| `»»» created_at`       | string(date-time)                                    | true     |              |             |
-| `»»» email`            | string(email)                                        | true     |              |             |
-| `»»» id`               | string(uuid)                                         | true     |              |             |
-| `»»» last_seen_at`     | string(date-time)                                    | false    |              |             |
-| `»»» login_type`       | [codersdk.LoginType](schemas.md#codersdklogintype)   | false    |              |             |
-| `»»» organization_ids` | array                                                | false    |              |             |
-| `»»» roles`            | array                                                | false    |              |             |
-| `»»»» display_name`    | string                                               | false    |              |             |
-| `»»»» name`            | string                                               | false    |              |             |
-| `»»» status`           | [codersdk.UserStatus](schemas.md#codersdkuserstatus) | false    |              |             |
-| `»»» username`         | string                                               | true     |              |             |
-| `»» name`              | string                                               | false    |              |             |
-| `»» organization_id`   | string(uuid)                                         | false    |              |             |
-| `»» quota_allowance`   | integer                                              | false    |              |             |
-| `» users`              | array                                                | false    |              |             |
+| Name                   | Type                                                   | Required | Restrictions | Description |
+| ---------------------- | ------------------------------------------------------ | -------- | ------------ | ----------- |
+| `[array item]`         | array                                                  | false    |              |             |
+| `» groups`             | array                                                  | false    |              |             |
+| `»» avatar_url`        | string                                                 | false    |              |             |
+| `»» display_name`      | string                                                 | false    |              |             |
+| `»» id`                | string(uuid)                                           | false    |              |             |
+| `»» members`           | array                                                  | false    |              |             |
+| `»»» avatar_url`       | string(uri)                                            | false    |              |             |
+| `»»» created_at`       | string(date-time)                                      | true     |              |             |
+| `»»» email`            | string(email)                                          | true     |              |             |
+| `»»» id`               | string(uuid)                                           | true     |              |             |
+| `»»» last_seen_at`     | string(date-time)                                      | false    |              |             |
+| `»»» login_type`       | [codersdk.LoginType](schemas.md#codersdklogintype)     | false    |              |             |
+| `»»» organization_ids` | array                                                  | false    |              |             |
+| `»»» roles`            | array                                                  | false    |              |             |
+| `»»»» display_name`    | string                                                 | false    |              |             |
+| `»»»» name`            | string                                                 | false    |              |             |
+| `»»» status`           | [codersdk.UserStatus](schemas.md#codersdkuserstatus)   | false    |              |             |
+| `»»» username`         | string                                                 | true     |              |             |
+| `»» name`              | string                                                 | false    |              |             |
+| `»» organization_id`   | string(uuid)                                           | false    |              |             |
+| `»» quota_allowance`   | integer                                                | false    |              |             |
+| `»» source`            | [codersdk.GroupSource](schemas.md#codersdkgroupsource) | false    |              |             |
+| `» users`              | array                                                  | false    |              |             |
 
 #### Enumerated Values
 
 | Property     | Value       |
 | ------------ | ----------- |
+| `login_type` | ``          |
 | `login_type` | `password`  |
 | `login_type` | `github`    |
 | `login_type` | `oidc`      |
@@ -1274,6 +1307,8 @@ Status Code **200**
 | `login_type` | `none`      |
 | `status`     | `active`    |
 | `status`     | `suspended` |
+| `source`     | `user`      |
+| `source`     | `oidc`      |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
@@ -1495,28 +1530,28 @@ curl -X GET http://coder-server:8080/api/v2/workspaceproxies \
 
 Status Code **200**
 
-| Name                   | Type                                                                     | Required | Restrictions | Description                                                                                                                                                                         |
-| ---------------------- | ------------------------------------------------------------------------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `[array item]`         | array                                                                    | false    |              |                                                                                                                                                                                     |
-| `» regions`            | array                                                                    | false    |              |                                                                                                                                                                                     |
-| `»» created_at`        | string(date-time)                                                        | false    |              |                                                                                                                                                                                     |
-| `»» deleted`           | boolean                                                                  | false    |              |                                                                                                                                                                                     |
-| `»» derp_enabled`      | boolean                                                                  | false    |              |                                                                                                                                                                                     |
-| `»» derp_only`         | boolean                                                                  | false    |              |                                                                                                                                                                                     |
-| `»» display_name`      | string                                                                   | false    |              |                                                                                                                                                                                     |
-| `»» healthy`           | boolean                                                                  | false    |              |                                                                                                                                                                                     |
-| `»» icon_url`          | string                                                                   | false    |              |                                                                                                                                                                                     |
-| `»» id`                | string(uuid)                                                             | false    |              |                                                                                                                                                                                     |
-| `»» name`              | string                                                                   | false    |              |                                                                                                                                                                                     |
-| `»» path_app_url`      | string                                                                   | false    |              | »path app URL is the URL to the base path for path apps. Optional unless wildcard_hostname is set. E.g. https://us.example.com                                                      |
-| `»» status`            | [codersdk.WorkspaceProxyStatus](schemas.md#codersdkworkspaceproxystatus) | false    |              | Status is the latest status check of the proxy. This will be empty for deleted proxies. This value can be used to determine if a workspace proxy is healthy and ready to use.       |
-| `»»» checked_at`       | string(date-time)                                                        | false    |              |                                                                                                                                                                                     |
-| `»»» report`           | [codersdk.ProxyHealthReport](schemas.md#codersdkproxyhealthreport)       | false    |              | Report provides more information about the health of the workspace proxy.                                                                                                           |
-| `»»»» errors`          | array                                                                    | false    |              | Errors are problems that prevent the workspace proxy from being healthy                                                                                                             |
-| `»»»» warnings`        | array                                                                    | false    |              | Warnings do not prevent the workspace proxy from being healthy, but should be addressed.                                                                                            |
-| `»»» status`           | [codersdk.ProxyHealthStatus](schemas.md#codersdkproxyhealthstatus)       | false    |              |                                                                                                                                                                                     |
-| `»» updated_at`        | string(date-time)                                                        | false    |              |                                                                                                                                                                                     |
-| `»» wildcard_hostname` | string                                                                   | false    |              | »wildcard hostname is the wildcard hostname for subdomain apps. E.g. _.us.example.com E.g. _--suffix.au.example.com Optional. Does not need to be on the same domain as PathAppURL. |
+| Name                   | Type                                                                     | Required | Restrictions | Description                                                                                                                                                                        |
+| ---------------------- | ------------------------------------------------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `[array item]`         | array                                                                    | false    |              |                                                                                                                                                                                    |
+| `» regions`            | array                                                                    | false    |              |                                                                                                                                                                                    |
+| `»» created_at`        | string(date-time)                                                        | false    |              |                                                                                                                                                                                    |
+| `»» deleted`           | boolean                                                                  | false    |              |                                                                                                                                                                                    |
+| `»» derp_enabled`      | boolean                                                                  | false    |              |                                                                                                                                                                                    |
+| `»» derp_only`         | boolean                                                                  | false    |              |                                                                                                                                                                                    |
+| `»» display_name`      | string                                                                   | false    |              |                                                                                                                                                                                    |
+| `»» healthy`           | boolean                                                                  | false    |              |                                                                                                                                                                                    |
+| `»» icon_url`          | string                                                                   | false    |              |                                                                                                                                                                                    |
+| `»» id`                | string(uuid)                                                             | false    |              |                                                                                                                                                                                    |
+| `»» name`              | string                                                                   | false    |              |                                                                                                                                                                                    |
+| `»» path_app_url`      | string                                                                   | false    |              | Path app URL is the URL to the base path for path apps. Optional unless wildcard_hostname is set. E.g. https://us.example.com                                                      |
+| `»» status`            | [codersdk.WorkspaceProxyStatus](schemas.md#codersdkworkspaceproxystatus) | false    |              | Status is the latest status check of the proxy. This will be empty for deleted proxies. This value can be used to determine if a workspace proxy is healthy and ready to use.      |
+| `»»» checked_at`       | string(date-time)                                                        | false    |              |                                                                                                                                                                                    |
+| `»»» report`           | [codersdk.ProxyHealthReport](schemas.md#codersdkproxyhealthreport)       | false    |              | Report provides more information about the health of the workspace proxy.                                                                                                          |
+| `»»»» errors`          | array                                                                    | false    |              | Errors are problems that prevent the workspace proxy from being healthy                                                                                                            |
+| `»»»» warnings`        | array                                                                    | false    |              | Warnings do not prevent the workspace proxy from being healthy, but should be addressed.                                                                                           |
+| `»»» status`           | [codersdk.ProxyHealthStatus](schemas.md#codersdkproxyhealthstatus)       | false    |              |                                                                                                                                                                                    |
+| `»» updated_at`        | string(date-time)                                                        | false    |              |                                                                                                                                                                                    |
+| `»» wildcard_hostname` | string                                                                   | false    |              | Wildcard hostname is the wildcard hostname for subdomain apps. E.g. _.us.example.com E.g. _--suffix.au.example.com Optional. Does not need to be on the same domain as PathAppURL. |
 
 #### Enumerated Values
 
diff --git a/docs/api/general.md b/docs/api/general.md
index bb64823bd86c9..577781136ef61 100644
--- a/docs/api/general.md
+++ b/docs/api/general.md
@@ -168,6 +168,7 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
     "derp": {
       "config": {
         "block_direct": true,
+        "force_websockets": true,
         "path": "string",
         "url": "string"
       },
@@ -211,7 +212,7 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
     },
     "enable_terraform_debug_mode": true,
     "experiments": ["string"],
-    "git_auth": {
+    "external_auth": {
       "value": [
         {
           "app_install_url": "string",
@@ -220,6 +221,9 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
           "client_id": "string",
           "device_code_url": "string",
           "device_flow": true,
+          "display_icon": "string",
+          "display_name": "string",
+          "extra_token_keys": ["string"],
           "id": "string",
           "no_refresh": true,
           "regex": "string",
@@ -230,6 +234,7 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
         }
       ]
     },
+    "external_token_encryption_keys": ["string"],
     "http_address": "string",
     "in_memory_database": true,
     "job_hang_detector_interval": 0,
@@ -256,11 +261,15 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
     "oidc": {
       "allow_signups": true,
       "auth_url_params": {},
+      "client_cert_file": "string",
       "client_id": "string",
+      "client_key_file": "string",
       "client_secret": "string",
       "email_domain": ["string"],
       "email_field": "string",
+      "group_auto_create": true,
       "group_mapping": {},
+      "group_regex_filter": {},
       "groups_field": "string",
       "icon_url": {
         "forceQuery": true,
@@ -305,6 +314,7 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
     "provisioner": {
       "daemon_poll_interval": 0,
       "daemon_poll_jitter": 0,
+      "daemon_psk": "string",
       "daemons": 0,
       "daemons_echo": true,
       "force_cancel_interval": 0
@@ -370,6 +380,7 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
     },
     "trace": {
       "capture_logs": true,
+      "data_dog": true,
       "enable": true,
       "honeycomb_api_key": "string"
     },
@@ -378,6 +389,7 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
       "default_schedule": "string"
     },
     "verbose": true,
+    "web_terminal_renderer": "string",
     "wgtunnel_host": "string",
     "wildcard_access_url": {
       "forceQuery": true,
@@ -523,7 +535,7 @@ curl -X GET http://coder-server:8080/api/v2/deployment/stats \
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
-## Get experiments
+## Get enabled experiments
 
 ### Code samples
 
@@ -550,7 +562,44 @@ curl -X GET http://coder-server:8080/api/v2/experiments \
 | ------ | ------------------------------------------------------- | ----------- | ------------------------------------------------------------- |
 | 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | array of [codersdk.Experiment](schemas.md#codersdkexperiment) |
 
-<h3 id="get-experiments-responseschema">Response Schema</h3>
+<h3 id="get-enabled-experiments-responseschema">Response Schema</h3>
+
+Status Code **200**
+
+| Name           | Type  | Required | Restrictions | Description |
+| -------------- | ----- | -------- | ------------ | ----------- |
+| `[array item]` | array | false    |              |             |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
+## Get safe experiments
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X GET http://coder-server:8080/api/v2/experiments/available \
+  -H 'Accept: application/json' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`GET /experiments/available`
+
+### Example responses
+
+> 200 Response
+
+```json
+["moons"]
+```
+
+### Responses
+
+| Status | Meaning                                                 | Description | Schema                                                        |
+| ------ | ------------------------------------------------------- | ----------- | ------------------------------------------------------------- |
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | array of [codersdk.Experiment](schemas.md#codersdkexperiment) |
+
+<h3 id="get-safe-experiments-responseschema">Response Schema</h3>
 
 Status Code **200**
 
diff --git a/docs/api/git.md b/docs/api/git.md
index 0f55fdfba909a..9f2014705da7f 100644
--- a/docs/api/git.md
+++ b/docs/api/git.md
@@ -1,23 +1,23 @@
 # Git
 
-## Get git auth by ID
+## Get external auth by ID
 
 ### Code samples
 
 ```shell
 # Example request using curl
-curl -X GET http://coder-server:8080/api/v2/gitauth/{gitauth} \
+curl -X GET http://coder-server:8080/api/v2/external-auth/{externalauth} \
   -H 'Accept: application/json' \
   -H 'Coder-Session-Token: API_KEY'
 ```
 
-`GET /gitauth/{gitauth}`
+`GET /external-auth/{externalauth}`
 
 ### Parameters
 
-| Name      | In   | Type           | Required | Description     |
-| --------- | ---- | -------------- | -------- | --------------- |
-| `gitauth` | path | string(string) | true     | Git Provider ID |
+| Name           | In   | Type           | Required | Description     |
+| -------------- | ---- | -------------- | -------- | --------------- |
+| `externalauth` | path | string(string) | true     | Git Provider ID |
 
 ### Example responses
 
@@ -29,6 +29,7 @@ curl -X GET http://coder-server:8080/api/v2/gitauth/{gitauth} \
   "app_installable": true,
   "authenticated": true,
   "device": true,
+  "display_name": "string",
   "installations": [
     {
       "account": {
@@ -41,7 +42,6 @@ curl -X GET http://coder-server:8080/api/v2/gitauth/{gitauth} \
       "id": 0
     }
   ],
-  "type": "string",
   "user": {
     "avatar_url": "string",
     "login": "string",
@@ -53,30 +53,30 @@ curl -X GET http://coder-server:8080/api/v2/gitauth/{gitauth} \
 
 ### Responses
 
-| Status | Meaning                                                 | Description | Schema                                         |
-| ------ | ------------------------------------------------------- | ----------- | ---------------------------------------------- |
-| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.GitAuth](schemas.md#codersdkgitauth) |
+| Status | Meaning                                                 | Description | Schema                                                   |
+| ------ | ------------------------------------------------------- | ----------- | -------------------------------------------------------- |
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.ExternalAuth](schemas.md#codersdkexternalauth) |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
-## Get git auth device by ID.
+## Get external auth device by ID.
 
 ### Code samples
 
 ```shell
 # Example request using curl
-curl -X GET http://coder-server:8080/api/v2/gitauth/{gitauth}/device \
+curl -X GET http://coder-server:8080/api/v2/external-auth/{externalauth}/device \
   -H 'Accept: application/json' \
   -H 'Coder-Session-Token: API_KEY'
 ```
 
-`GET /gitauth/{gitauth}/device`
+`GET /external-auth/{externalauth}/device`
 
 ### Parameters
 
-| Name      | In   | Type           | Required | Description     |
-| --------- | ---- | -------------- | -------- | --------------- |
-| `gitauth` | path | string(string) | true     | Git Provider ID |
+| Name           | In   | Type           | Required | Description     |
+| -------------- | ---- | -------------- | -------- | --------------- |
+| `externalauth` | path | string(string) | true     | Git Provider ID |
 
 ### Example responses
 
@@ -94,29 +94,29 @@ curl -X GET http://coder-server:8080/api/v2/gitauth/{gitauth}/device \
 
 ### Responses
 
-| Status | Meaning                                                 | Description | Schema                                                     |
-| ------ | ------------------------------------------------------- | ----------- | ---------------------------------------------------------- |
-| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.GitAuthDevice](schemas.md#codersdkgitauthdevice) |
+| Status | Meaning                                                 | Description | Schema                                                               |
+| ------ | ------------------------------------------------------- | ----------- | -------------------------------------------------------------------- |
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.ExternalAuthDevice](schemas.md#codersdkexternalauthdevice) |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
-## Post git auth device by ID
+## Post external auth device by ID
 
 ### Code samples
 
 ```shell
 # Example request using curl
-curl -X POST http://coder-server:8080/api/v2/gitauth/{gitauth}/device \
+curl -X POST http://coder-server:8080/api/v2/external-auth/{externalauth}/device \
   -H 'Coder-Session-Token: API_KEY'
 ```
 
-`POST /gitauth/{gitauth}/device`
+`POST /external-auth/{externalauth}/device`
 
 ### Parameters
 
-| Name      | In   | Type           | Required | Description     |
-| --------- | ---- | -------------- | -------- | --------------- |
-| `gitauth` | path | string(string) | true     | Git Provider ID |
+| Name           | In   | Type           | Required | Description          |
+| -------------- | ---- | -------------- | -------- | -------------------- |
+| `externalauth` | path | string(string) | true     | External Provider ID |
 
 ### Responses
 
diff --git a/docs/api/index.md b/docs/api/index.md
index 8a93a4439efbc..a13df98156a77 100644
--- a/docs/api/index.md
+++ b/docs/api/index.md
@@ -4,13 +4,13 @@ Get started with the Coder API:
 
 Generate a token on your Coder deployment by visiting:
 
-```sh
+```shell
 https://coder.example.com/settings/tokens
 ```
 
 List your workspaces
 
-```sh
+```shell
 # CLI
 curl https://coder.example.com/api/v2/workspaces?q=owner:me \
 -H "Coder-Session-Token: <your-token>"
diff --git a/docs/api/insights.md b/docs/api/insights.md
index 11843e63f0316..bfa1fcd380d5d 100644
--- a/docs/api/insights.md
+++ b/docs/api/insights.md
@@ -60,7 +60,7 @@ curl -X GET http://coder-server:8080/api/v2/insights/templates \
     {
       "active_users": 14,
       "end_time": "2019-08-24T14:15:22Z",
-      "interval": "day",
+      "interval": "week",
       "start_time": "2019-08-24T14:15:22Z",
       "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"]
     }
@@ -80,6 +80,7 @@ curl -X GET http://coder-server:8080/api/v2/insights/templates \
     "end_time": "2019-08-24T14:15:22Z",
     "parameters_usage": [
       {
+        "description": "string",
         "display_name": "string",
         "name": "string",
         "options": [
@@ -91,6 +92,7 @@ curl -X GET http://coder-server:8080/api/v2/insights/templates \
           }
         ],
         "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+        "type": "string",
         "values": [
           {
             "count": 0,
@@ -113,6 +115,50 @@ curl -X GET http://coder-server:8080/api/v2/insights/templates \
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
+## Get insights about user activity
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X GET http://coder-server:8080/api/v2/insights/user-activity \
+  -H 'Accept: application/json' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`GET /insights/user-activity`
+
+### Example responses
+
+> 200 Response
+
+```json
+{
+  "report": {
+    "end_time": "2019-08-24T14:15:22Z",
+    "start_time": "2019-08-24T14:15:22Z",
+    "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+    "users": [
+      {
+        "avatar_url": "http://example.com",
+        "seconds": 80500,
+        "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+        "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5",
+        "username": "string"
+      }
+    ]
+  }
+}
+```
+
+### Responses
+
+| Status | Meaning                                                 | Description | Schema                                                                                   |
+| ------ | ------------------------------------------------------- | ----------- | ---------------------------------------------------------------------------------------- |
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.UserActivityInsightsResponse](schemas.md#codersdkuseractivityinsightsresponse) |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
 ## Get insights about user latency
 
 ### Code samples
diff --git a/docs/api/organizations.md b/docs/api/organizations.md
index 4b5b15c5dca16..011d3cac5eb2e 100644
--- a/docs/api/organizations.md
+++ b/docs/api/organizations.md
@@ -49,6 +49,44 @@ curl -X POST http://coder-server:8080/api/v2/licenses \
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
+## Update license entitlements
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X POST http://coder-server:8080/api/v2/licenses/refresh-entitlements \
+  -H 'Accept: application/json' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`POST /licenses/refresh-entitlements`
+
+### Example responses
+
+> 201 Response
+
+```json
+{
+  "detail": "string",
+  "message": "string",
+  "validations": [
+    {
+      "detail": "string",
+      "field": "string"
+    }
+  ]
+}
+```
+
+### Responses
+
+| Status | Meaning                                                      | Description | Schema                                           |
+| ------ | ------------------------------------------------------------ | ----------- | ------------------------------------------------ |
+| 201    | [Created](https://tools.ietf.org/html/rfc7231#section-6.3.2) | Created     | [codersdk.Response](schemas.md#codersdkresponse) |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
 ## Create organization
 
 ### Code samples
diff --git a/docs/api/schemas.md b/docs/api/schemas.md
index 39bc8d16b6e6f..61e227b2b3f4d 100644
--- a/docs/api/schemas.md
+++ b/docs/api/schemas.md
@@ -109,11 +109,14 @@
 | `encoding`  | string | true     |              |             |
 | `signature` | string | true     |              |             |
 
-## agentsdk.GitAuthResponse
+## agentsdk.ExternalAuthResponse
 
 ```json
 {
+  "access_token": "string",
   "password": "string",
+  "token_extra": {},
+  "type": "string",
   "url": "string",
   "username": "string"
 }
@@ -121,11 +124,14 @@
 
 ### Properties
 
-| Name       | Type   | Required | Restrictions | Description |
-| ---------- | ------ | -------- | ------------ | ----------- |
-| `password` | string | false    |              |             |
-| `url`      | string | false    |              |             |
-| `username` | string | false    |              |             |
+| Name           | Type   | Required | Restrictions | Description                                                                              |
+| -------------- | ------ | -------- | ------------ | ---------------------------------------------------------------------------------------- |
+| `access_token` | string | false    |              |                                                                                          |
+| `password`     | string | false    |              |                                                                                          |
+| `token_extra`  | object | false    |              |                                                                                          |
+| `type`         | string | false    |              |                                                                                          |
+| `url`          | string | false    |              |                                                                                          |
+| `username`     | string | false    |              | Deprecated: Only supported on `/workspaceagents/me/gitauth` for backwards compatibility. |
 
 ## agentsdk.GitSSHKey
 
@@ -163,19 +169,17 @@
 {
   "created_at": "string",
   "level": "trace",
-  "output": "string",
-  "source": "startup_script"
+  "output": "string"
 }
 ```
 
 ### Properties
 
-| Name         | Type                                                                 | Required | Restrictions | Description |
-| ------------ | -------------------------------------------------------------------- | -------- | ------------ | ----------- |
-| `created_at` | string                                                               | false    |              |             |
-| `level`      | [codersdk.LogLevel](#codersdkloglevel)                               | false    |              |             |
-| `output`     | string                                                               | false    |              |             |
-| `source`     | [codersdk.WorkspaceAgentLogSource](#codersdkworkspaceagentlogsource) | false    |              |             |
+| Name         | Type                                   | Required | Restrictions | Description |
+| ------------ | -------------------------------------- | -------- | ------------ | ----------- |
+| `created_at` | string                                 | false    |              |             |
+| `level`      | [codersdk.LogLevel](#codersdkloglevel) | false    |              |             |
+| `output`     | string                                 | false    |              |             |
 
 ## agentsdk.Manifest
 
@@ -198,10 +202,18 @@
       "sharing_level": "owner",
       "slug": "string",
       "subdomain": true,
+      "subdomain_name": "string",
       "url": "string"
     }
   ],
+  "derp_force_websockets": true,
   "derpmap": {
+    "homeParams": {
+      "regionScore": {
+        "property1": 0,
+        "property2": 0
+      }
+    },
     "omitDefaultRegions": true,
     "regions": {
       "property1": {
@@ -209,6 +221,7 @@
         "embeddedRelay": true,
         "nodes": [
           {
+            "canPort80": true,
             "certName": "string",
             "derpport": 0,
             "forceHTTP": true,
@@ -232,6 +245,7 @@
         "embeddedRelay": true,
         "nodes": [
           {
+            "canPort80": true,
             "certName": "string",
             "derpport": 0,
             "forceHTTP": true,
@@ -269,10 +283,18 @@
     }
   ],
   "motd_file": "string",
-  "shutdown_script": "string",
-  "shutdown_script_timeout": 0,
-  "startup_script": "string",
-  "startup_script_timeout": 0,
+  "scripts": [
+    {
+      "cron": "string",
+      "log_path": "string",
+      "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+      "run_on_start": true,
+      "run_on_stop": true,
+      "script": "string",
+      "start_blocks_login": true,
+      "timeout": 0
+    }
+  ],
   "vscode_port_proxy_uri": "string"
 }
 ```
@@ -283,6 +305,7 @@
 | ---------------------------- | ------------------------------------------------------------------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `agent_id`                   | string                                                                                            | false    |              |                                                                                                                                                            |
 | `apps`                       | array of [codersdk.WorkspaceApp](#codersdkworkspaceapp)                                           | false    |              |                                                                                                                                                            |
+| `derp_force_websockets`      | boolean                                                                                           | false    |              |                                                                                                                                                            |
 | `derpmap`                    | [tailcfg.DERPMap](#tailcfgderpmap)                                                                | false    |              |                                                                                                                                                            |
 | `directory`                  | string                                                                                            | false    |              |                                                                                                                                                            |
 | `disable_direct_connections` | boolean                                                                                           | false    |              |                                                                                                                                                            |
@@ -291,22 +314,41 @@
 | `git_auth_configs`           | integer                                                                                           | false    |              | Git auth configs stores the number of Git configurations the Coder deployment has. If this number is >0, we set up special configuration in the workspace. |
 | `metadata`                   | array of [codersdk.WorkspaceAgentMetadataDescription](#codersdkworkspaceagentmetadatadescription) | false    |              |                                                                                                                                                            |
 | `motd_file`                  | string                                                                                            | false    |              |                                                                                                                                                            |
-| `shutdown_script`            | string                                                                                            | false    |              |                                                                                                                                                            |
-| `shutdown_script_timeout`    | integer                                                                                           | false    |              |                                                                                                                                                            |
-| `startup_script`             | string                                                                                            | false    |              |                                                                                                                                                            |
-| `startup_script_timeout`     | integer                                                                                           | false    |              |                                                                                                                                                            |
+| `scripts`                    | array of [codersdk.WorkspaceAgentScript](#codersdkworkspaceagentscript)                           | false    |              |                                                                                                                                                            |
 | `vscode_port_proxy_uri`      | string                                                                                            | false    |              |                                                                                                                                                            |
 
+## agentsdk.Metadata
+
+```json
+{
+  "age": 0,
+  "collected_at": "2019-08-24T14:15:22Z",
+  "error": "string",
+  "key": "string",
+  "value": "string"
+}
+```
+
+### Properties
+
+| Name           | Type    | Required | Restrictions | Description                                                                                                                             |
+| -------------- | ------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------- |
+| `age`          | integer | false    |              | Age is the number of seconds since the metadata was collected. It is provided in addition to CollectedAt to protect against clock skew. |
+| `collected_at` | string  | false    |              |                                                                                                                                         |
+| `error`        | string  | false    |              |                                                                                                                                         |
+| `key`          | string  | false    |              |                                                                                                                                         |
+| `value`        | string  | false    |              |                                                                                                                                         |
+
 ## agentsdk.PatchLogs
 
 ```json
 {
+  "log_source_id": "string",
   "logs": [
     {
       "created_at": "string",
       "level": "trace",
-      "output": "string",
-      "source": "startup_script"
+      "output": "string"
     }
   ]
 }
@@ -314,9 +356,10 @@
 
 ### Properties
 
-| Name   | Type                                  | Required | Restrictions | Description |
-| ------ | ------------------------------------- | -------- | ------------ | ----------- |
-| `logs` | array of [agentsdk.Log](#agentsdklog) | false    |              |             |
+| Name            | Type                                  | Required | Restrictions | Description |
+| --------------- | ------------------------------------- | -------- | ------------ | ----------- |
+| `log_source_id` | string                                | false    |              |             |
+| `logs`          | array of [agentsdk.Log](#agentsdklog) | false    |              |             |
 
 ## agentsdk.PostAppHealthsRequest
 
@@ -354,6 +397,28 @@
 
 ## agentsdk.PostMetadataRequest
 
+```json
+{
+  "metadata": [
+    {
+      "age": 0,
+      "collected_at": "2019-08-24T14:15:22Z",
+      "error": "string",
+      "key": "string",
+      "value": "string"
+    }
+  ]
+}
+```
+
+### Properties
+
+| Name       | Type                                            | Required | Restrictions | Description |
+| ---------- | ----------------------------------------------- | -------- | ------------ | ----------- |
+| `metadata` | array of [agentsdk.Metadata](#agentsdkmetadata) | false    |              |             |
+
+## agentsdk.PostMetadataRequestDeprecated
+
 ```json
 {
   "age": 0,
@@ -377,18 +442,18 @@
 ```json
 {
   "expanded_directory": "string",
-  "subsystem": "envbox",
+  "subsystems": ["envbox"],
   "version": "string"
 }
 ```
 
 ### Properties
 
-| Name                 | Type                                               | Required | Restrictions | Description |
-| -------------------- | -------------------------------------------------- | -------- | ------------ | ----------- |
-| `expanded_directory` | string                                             | false    |              |             |
-| `subsystem`          | [codersdk.AgentSubsystem](#codersdkagentsubsystem) | false    |              |             |
-| `version`            | string                                             | false    |              |             |
+| Name                 | Type                                                        | Required | Restrictions | Description |
+| -------------------- | ----------------------------------------------------------- | -------- | ------------ | ----------- |
+| `expanded_directory` | string                                                      | false    |              |             |
+| `subsystems`         | array of [codersdk.AgentSubsystem](#codersdkagentsubsystem) | false    |              |             |
+| `version`            | string                                                      | false    |              |             |
 
 ## agentsdk.Stats
 
@@ -595,7 +660,17 @@
 | `value_source`   | [clibase.ValueSource](#clibasevaluesource) | false    |              |                                                                                                                                                    |
 | `yaml`           | string                                     | false    |              | Yaml is the YAML key used to configure this option. If unset, YAML configuring is disabled.                                                        |
 
-## clibase.Struct-array_codersdk_GitAuthConfig
+## clibase.Regexp
+
+```json
+{}
+```
+
+### Properties
+
+_None_
+
+## clibase.Struct-array_codersdk_ExternalAuthConfig
 
 ```json
 {
@@ -607,6 +682,9 @@
       "client_id": "string",
       "device_code_url": "string",
       "device_flow": true,
+      "display_icon": "string",
+      "display_name": "string",
+      "extra_token_keys": ["string"],
       "id": "string",
       "no_refresh": true,
       "regex": "string",
@@ -621,9 +699,9 @@
 
 ### Properties
 
-| Name    | Type                                                      | Required | Restrictions | Description |
-| ------- | --------------------------------------------------------- | -------- | ------------ | ----------- |
-| `value` | array of [codersdk.GitAuthConfig](#codersdkgitauthconfig) | false    |              |             |
+| Name    | Type                                                                | Required | Restrictions | Description |
+| ------- | ------------------------------------------------------------------- | -------- | ------------ | ----------- |
+| `value` | array of [codersdk.ExternalAuthConfig](#codersdkexternalauthconfig) | false    |              |             |
 
 ## clibase.Struct-array_codersdk_LinkConfig
 
@@ -774,7 +852,7 @@
           "email": "user@example.com",
           "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
           "last_seen_at": "2019-08-24T14:15:22Z",
-          "login_type": "password",
+          "login_type": "",
           "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
           "roles": [
             {
@@ -788,7 +866,8 @@
       ],
       "name": "string",
       "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
-      "quota_allowance": 0
+      "quota_allowance": 0,
+      "source": "user"
     }
   ],
   "users": [
@@ -798,7 +877,7 @@
       "email": "user@example.com",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "last_seen_at": "2019-08-24T14:15:22Z",
-      "login_type": "password",
+      "login_type": "",
       "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
       "roles": [
         {
@@ -902,9 +981,11 @@
 
 #### Enumerated Values
 
-| Value    |
-| -------- |
-| `envbox` |
+| Value        |
+| ------------ |
+| `envbox`     |
+| `envbuilder` |
+| `exectrace`  |
 
 ## codersdk.AppHostResponse
 
@@ -924,6 +1005,7 @@
 
 ```json
 {
+  "application_name": "string",
   "logo_url": "string",
   "service_banner": {
     "background_color": "string",
@@ -942,11 +1024,26 @@
 
 ### Properties
 
-| Name             | Type                                                         | Required | Restrictions | Description |
-| ---------------- | ------------------------------------------------------------ | -------- | ------------ | ----------- |
-| `logo_url`       | string                                                       | false    |              |             |
-| `service_banner` | [codersdk.ServiceBannerConfig](#codersdkservicebannerconfig) | false    |              |             |
-| `support_links`  | array of [codersdk.LinkConfig](#codersdklinkconfig)          | false    |              |             |
+| Name               | Type                                                         | Required | Restrictions | Description |
+| ------------------ | ------------------------------------------------------------ | -------- | ------------ | ----------- |
+| `application_name` | string                                                       | false    |              |             |
+| `logo_url`         | string                                                       | false    |              |             |
+| `service_banner`   | [codersdk.ServiceBannerConfig](#codersdkservicebannerconfig) | false    |              |             |
+| `support_links`    | array of [codersdk.LinkConfig](#codersdklinkconfig)          | false    |              |             |
+
+## codersdk.ArchiveTemplateVersionsRequest
+
+```json
+{
+  "all": true
+}
+```
+
+### Properties
+
+| Name  | Type    | Required | Restrictions | Description                                                                                                              |
+| ----- | ------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------ |
+| `all` | boolean | false    |              | By default, only failed versions are archived. Set this to true to archive all unused versions regardless of job status. |
 
 ## codersdk.AssignableRoles
 
@@ -1065,7 +1162,7 @@
     "email": "user@example.com",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "last_seen_at": "2019-08-24T14:15:22Z",
-    "login_type": "password",
+    "login_type": "",
     "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
     "roles": [
       {
@@ -1142,7 +1239,7 @@
         "email": "user@example.com",
         "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
         "last_seen_at": "2019-08-24T14:15:22Z",
-        "login_type": "password",
+        "login_type": "",
         "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
         "roles": [
           {
@@ -1310,6 +1407,21 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | ---------------- | ------- | -------- | ------------ | ----------- |
 | `[any property]` | boolean | false    |              |             |
 
+## codersdk.AutomaticUpdates
+
+```json
+"always"
+```
+
+### Properties
+
+#### Enumerated Values
+
+| Value    |
+| -------- |
+| `always` |
+| `never`  |
+
 ## codersdk.BuildInfoResponse
 
 ```json
@@ -1367,7 +1479,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 ```json
 {
   "password": "string",
-  "to_type": "password"
+  "to_type": ""
 }
 ```
 
@@ -1455,43 +1567,49 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   "allow_user_autostart": true,
   "allow_user_autostop": true,
   "allow_user_cancel_workspace_jobs": true,
+  "autostart_requirement": {
+    "days_of_week": ["monday"]
+  },
+  "autostop_requirement": {
+    "days_of_week": ["monday"],
+    "weeks": 0
+  },
   "default_ttl_ms": 0,
+  "delete_ttl_ms": 0,
   "description": "string",
   "disable_everyone_group_access": true,
   "display_name": "string",
+  "dormant_ttl_ms": 0,
   "failure_ttl_ms": 0,
   "icon": "string",
-  "inactivity_ttl_ms": 0,
-  "locked_ttl_ms": 0,
   "max_ttl_ms": 0,
   "name": "string",
-  "restart_requirement": {
-    "days_of_week": ["monday"],
-    "weeks": 0
-  },
+  "require_active_version": true,
   "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1"
 }
 ```
 
 ### Properties
 
-| Name                                                                                                                                                                                      | Type                                                                       | Required | Restrictions | Description                                                                                                                                                                                                                                                                                                         |
-| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `allow_user_autostart`                                                                                                                                                                    | boolean                                                                    | false    |              | Allow user autostart allows users to set a schedule for autostarting their workspace. By default this is true. This can only be disabled when using an enterprise license.                                                                                                                                          |
-| `allow_user_autostop`                                                                                                                                                                     | boolean                                                                    | false    |              | Allow user autostop allows users to set a custom workspace TTL to use in place of the template's DefaultTTL field. By default this is true. If false, the DefaultTTL will always be used. This can only be disabled when using an enterprise license.                                                               |
-| `allow_user_cancel_workspace_jobs`                                                                                                                                                        | boolean                                                                    | false    |              | Allow users to cancel in-progress workspace jobs. \*bool as the default value is "true".                                                                                                                                                                                                                            |
-| `default_ttl_ms`                                                                                                                                                                          | integer                                                                    | false    |              | Default ttl ms allows optionally specifying the default TTL for all workspaces created from this template.                                                                                                                                                                                                          |
-| `description`                                                                                                                                                                             | string                                                                     | false    |              | Description is a description of what the template contains. It must be less than 128 bytes.                                                                                                                                                                                                                         |
-| `disable_everyone_group_access`                                                                                                                                                           | boolean                                                                    | false    |              | Disable everyone group access allows optionally disabling the default behavior of granting the 'everyone' group access to use the template. If this is set to true, the template will not be available to all users, and must be explicitly granted to users or groups in the permissions settings of the template. |
-| `display_name`                                                                                                                                                                            | string                                                                     | false    |              | Display name is the displayed name of the template.                                                                                                                                                                                                                                                                 |
-| `failure_ttl_ms`                                                                                                                                                                          | integer                                                                    | false    |              | Failure ttl ms allows optionally specifying the max lifetime before Coder stops all resources for failed workspaces created from this template.                                                                                                                                                                     |
-| `icon`                                                                                                                                                                                    | string                                                                     | false    |              | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard.                                                                                                                                                                                                                    |
-| `inactivity_ttl_ms`                                                                                                                                                                       | integer                                                                    | false    |              | Inactivity ttl ms allows optionally specifying the max lifetime before Coder locks inactive workspaces created from this template.                                                                                                                                                                                  |
-| `locked_ttl_ms`                                                                                                                                                                           | integer                                                                    | false    |              | Locked ttl ms allows optionally specifying the max lifetime before Coder permanently deletes locked workspaces created from this template.                                                                                                                                                                          |
-| `max_ttl_ms`                                                                                                                                                                              | integer                                                                    | false    |              | Max ttl ms remove max_ttl once restart_requirement is matured                                                                                                                                                                                                                                                       |
-| `name`                                                                                                                                                                                    | string                                                                     | true     |              | Name is the name of the template.                                                                                                                                                                                                                                                                                   |
-| `restart_requirement`                                                                                                                                                                     | [codersdk.TemplateRestartRequirement](#codersdktemplaterestartrequirement) | false    |              | Restart requirement allows optionally specifying the restart requirement for workspaces created from this template. This is an enterprise feature.                                                                                                                                                                  |
-| `template_version_id`                                                                                                                                                                     | string                                                                     | true     |              | Template version ID is an in-progress or completed job to use as an initial version of the template.                                                                                                                                                                                                                |
+| Name                                                                                                                                                                                      | Type                                                                           | Required | Restrictions | Description                                                                                                                                                                                                                                                                                                         |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `allow_user_autostart`                                                                                                                                                                    | boolean                                                                        | false    |              | Allow user autostart allows users to set a schedule for autostarting their workspace. By default this is true. This can only be disabled when using an enterprise license.                                                                                                                                          |
+| `allow_user_autostop`                                                                                                                                                                     | boolean                                                                        | false    |              | Allow user autostop allows users to set a custom workspace TTL to use in place of the template's DefaultTTL field. By default this is true. If false, the DefaultTTL will always be used. This can only be disabled when using an enterprise license.                                                               |
+| `allow_user_cancel_workspace_jobs`                                                                                                                                                        | boolean                                                                        | false    |              | Allow users to cancel in-progress workspace jobs. \*bool as the default value is "true".                                                                                                                                                                                                                            |
+| `autostart_requirement`                                                                                                                                                                   | [codersdk.TemplateAutostartRequirement](#codersdktemplateautostartrequirement) | false    |              | Autostart requirement allows optionally specifying the autostart allowed days for workspaces created from this template. This is an enterprise feature.                                                                                                                                                             |
+| `autostop_requirement`                                                                                                                                                                    | [codersdk.TemplateAutostopRequirement](#codersdktemplateautostoprequirement)   | false    |              | Autostop requirement allows optionally specifying the autostop requirement for workspaces created from this template. This is an enterprise feature.                                                                                                                                                                |
+| `default_ttl_ms`                                                                                                                                                                          | integer                                                                        | false    |              | Default ttl ms allows optionally specifying the default TTL for all workspaces created from this template.                                                                                                                                                                                                          |
+| `delete_ttl_ms`                                                                                                                                                                           | integer                                                                        | false    |              | Delete ttl ms allows optionally specifying the max lifetime before Coder permanently deletes dormant workspaces created from this template.                                                                                                                                                                         |
+| `description`                                                                                                                                                                             | string                                                                         | false    |              | Description is a description of what the template contains. It must be less than 128 bytes.                                                                                                                                                                                                                         |
+| `disable_everyone_group_access`                                                                                                                                                           | boolean                                                                        | false    |              | Disable everyone group access allows optionally disabling the default behavior of granting the 'everyone' group access to use the template. If this is set to true, the template will not be available to all users, and must be explicitly granted to users or groups in the permissions settings of the template. |
+| `display_name`                                                                                                                                                                            | string                                                                         | false    |              | Display name is the displayed name of the template.                                                                                                                                                                                                                                                                 |
+| `dormant_ttl_ms`                                                                                                                                                                          | integer                                                                        | false    |              | Dormant ttl ms allows optionally specifying the max lifetime before Coder locks inactive workspaces created from this template.                                                                                                                                                                                     |
+| `failure_ttl_ms`                                                                                                                                                                          | integer                                                                        | false    |              | Failure ttl ms allows optionally specifying the max lifetime before Coder stops all resources for failed workspaces created from this template.                                                                                                                                                                     |
+| `icon`                                                                                                                                                                                    | string                                                                         | false    |              | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard.                                                                                                                                                                                                                    |
+| `max_ttl_ms`                                                                                                                                                                              | integer                                                                        | false    |              | Max ttl ms remove max_ttl once autostop_requirement is matured                                                                                                                                                                                                                                                      |
+| `name`                                                                                                                                                                                    | string                                                                         | true     |              | Name is the name of the template.                                                                                                                                                                                                                                                                                   |
+| `require_active_version`                                                                                                                                                                  | boolean                                                                        | false    |              | Require active version mandates that workspaces are built with the active template version.                                                                                                                                                                                                                         |
+| `template_version_id`                                                                                                                                                                     | string                                                                         | true     |              | Template version ID is an in-progress or completed job to use as an initial version of the template.                                                                                                                                                                                                                |
 | This is required on creation to enable a user-flow of validating a template works. There is no reason the data-model cannot support empty templates, but it doesn't make sense for users. |
 
 ## codersdk.CreateTemplateVersionDryRunRequest
@@ -1644,6 +1762,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 {
   "disable_login": true,
   "email": "user@example.com",
+  "login_type": "",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
   "password": "string",
   "username": "string"
@@ -1652,13 +1771,14 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 ### Properties
 
-| Name              | Type    | Required | Restrictions | Description                                                                                                                                               |
-| ----------------- | ------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `disable_login`   | boolean | false    |              | Disable login sets the user's login type to 'none'. This prevents the user from being able to use a password or any other authentication method to login. |
-| `email`           | string  | true     |              |                                                                                                                                                           |
-| `organization_id` | string  | false    |              |                                                                                                                                                           |
-| `password`        | string  | false    |              |                                                                                                                                                           |
-| `username`        | string  | true     |              |                                                                                                                                                           |
+| Name              | Type                                     | Required | Restrictions | Description                                                                                                                                                                                                        |
+| ----------------- | ---------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `disable_login`   | boolean                                  | false    |              | Disable login sets the user's login type to 'none'. This prevents the user from being able to use a password or any other authentication method to login. Deprecated: Set UserLoginType=LoginTypeDisabled instead. |
+| `email`           | string                                   | true     |              |                                                                                                                                                                                                                    |
+| `login_type`      | [codersdk.LoginType](#codersdklogintype) | false    |              | Login type defaults to LoginTypePassword.                                                                                                                                                                          |
+| `organization_id` | string                                   | false    |              |                                                                                                                                                                                                                    |
+| `password`        | string                                   | false    |              |                                                                                                                                                                                                                    |
+| `username`        | string                                   | true     |              |                                                                                                                                                                                                                    |
 
 ## codersdk.CreateWorkspaceBuildRequest
 
@@ -1723,6 +1843,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 ```json
 {
+  "automatic_updates": "always",
   "autostart_schedule": "string",
   "name": "string",
   "rich_parameter_values": [
@@ -1732,19 +1853,22 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
     }
   ],
   "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
+  "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "ttl_ms": 0
 }
 ```
 
 ### Properties
 
-| Name                    | Type                                                                          | Required | Restrictions | Description                                                                                         |
-| ----------------------- | ----------------------------------------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------- |
-| `autostart_schedule`    | string                                                                        | false    |              |                                                                                                     |
-| `name`                  | string                                                                        | true     |              |                                                                                                     |
-| `rich_parameter_values` | array of [codersdk.WorkspaceBuildParameter](#codersdkworkspacebuildparameter) | false    |              | Rich parameter values allows for additional parameters to be provided during the initial provision. |
-| `template_id`           | string                                                                        | true     |              |                                                                                                     |
-| `ttl_ms`                | integer                                                                       | false    |              |                                                                                                     |
+| Name                    | Type                                                                          | Required | Restrictions | Description                                                                                             |
+| ----------------------- | ----------------------------------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------- |
+| `automatic_updates`     | [codersdk.AutomaticUpdates](#codersdkautomaticupdates)                        | false    |              |                                                                                                         |
+| `autostart_schedule`    | string                                                                        | false    |              |                                                                                                         |
+| `name`                  | string                                                                        | true     |              |                                                                                                         |
+| `rich_parameter_values` | array of [codersdk.WorkspaceBuildParameter](#codersdkworkspacebuildparameter) | false    |              | Rich parameter values allows for additional parameters to be provided during the initial provision.     |
+| `template_id`           | string                                                                        | false    |              | Template ID specifies which template should be used for creating the workspace.                         |
+| `template_version_id`   | string                                                                        | false    |              | Template version ID can be used to specify a specific version of a template for creating the workspace. |
+| `ttl_ms`                | integer                                                                       | false    |              |                                                                                                         |
 
 ## codersdk.DAUEntry
 
@@ -1789,6 +1913,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 {
   "config": {
     "block_direct": true,
+    "force_websockets": true,
     "path": "string",
     "url": "string"
   },
@@ -1827,6 +1952,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 ```json
 {
   "block_direct": true,
+  "force_websockets": true,
   "path": "string",
   "url": "string"
 }
@@ -1834,11 +1960,12 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 ### Properties
 
-| Name           | Type    | Required | Restrictions | Description |
-| -------------- | ------- | -------- | ------------ | ----------- |
-| `block_direct` | boolean | false    |              |             |
-| `path`         | string  | false    |              |             |
-| `url`          | string  | false    |              |             |
+| Name               | Type    | Required | Restrictions | Description |
+| ------------------ | ------- | -------- | ------------ | ----------- |
+| `block_direct`     | boolean | false    |              |             |
+| `force_websockets` | boolean | false    |              |             |
+| `path`             | string  | false    |              |             |
+| `url`              | string  | false    |              |             |
 
 ## codersdk.DERPRegion
 
@@ -1962,6 +2089,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
     "derp": {
       "config": {
         "block_direct": true,
+        "force_websockets": true,
         "path": "string",
         "url": "string"
       },
@@ -2005,7 +2133,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
     },
     "enable_terraform_debug_mode": true,
     "experiments": ["string"],
-    "git_auth": {
+    "external_auth": {
       "value": [
         {
           "app_install_url": "string",
@@ -2014,6 +2142,9 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
           "client_id": "string",
           "device_code_url": "string",
           "device_flow": true,
+          "display_icon": "string",
+          "display_name": "string",
+          "extra_token_keys": ["string"],
           "id": "string",
           "no_refresh": true,
           "regex": "string",
@@ -2024,6 +2155,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
         }
       ]
     },
+    "external_token_encryption_keys": ["string"],
     "http_address": "string",
     "in_memory_database": true,
     "job_hang_detector_interval": 0,
@@ -2050,11 +2182,15 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
     "oidc": {
       "allow_signups": true,
       "auth_url_params": {},
+      "client_cert_file": "string",
       "client_id": "string",
+      "client_key_file": "string",
       "client_secret": "string",
       "email_domain": ["string"],
       "email_field": "string",
+      "group_auto_create": true,
       "group_mapping": {},
+      "group_regex_filter": {},
       "groups_field": "string",
       "icon_url": {
         "forceQuery": true,
@@ -2099,6 +2235,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
     "provisioner": {
       "daemon_poll_interval": 0,
       "daemon_poll_jitter": 0,
+      "daemon_psk": "string",
       "daemons": 0,
       "daemons_echo": true,
       "force_cancel_interval": 0
@@ -2164,6 +2301,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
     },
     "trace": {
       "capture_logs": true,
+      "data_dog": true,
       "enable": true,
       "honeycomb_api_key": "string"
     },
@@ -2172,6 +2310,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
       "default_schedule": "string"
     },
     "verbose": true,
+    "web_terminal_renderer": "string",
     "wgtunnel_host": "string",
     "wildcard_access_url": {
       "forceQuery": true,
@@ -2319,6 +2458,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   "derp": {
     "config": {
       "block_direct": true,
+      "force_websockets": true,
       "path": "string",
       "url": "string"
     },
@@ -2362,7 +2502,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   },
   "enable_terraform_debug_mode": true,
   "experiments": ["string"],
-  "git_auth": {
+  "external_auth": {
     "value": [
       {
         "app_install_url": "string",
@@ -2371,6 +2511,9 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
         "client_id": "string",
         "device_code_url": "string",
         "device_flow": true,
+        "display_icon": "string",
+        "display_name": "string",
+        "extra_token_keys": ["string"],
         "id": "string",
         "no_refresh": true,
         "regex": "string",
@@ -2381,6 +2524,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
       }
     ]
   },
+  "external_token_encryption_keys": ["string"],
   "http_address": "string",
   "in_memory_database": true,
   "job_hang_detector_interval": 0,
@@ -2407,11 +2551,15 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   "oidc": {
     "allow_signups": true,
     "auth_url_params": {},
+    "client_cert_file": "string",
     "client_id": "string",
+    "client_key_file": "string",
     "client_secret": "string",
     "email_domain": ["string"],
     "email_field": "string",
+    "group_auto_create": true,
     "group_mapping": {},
+    "group_regex_filter": {},
     "groups_field": "string",
     "icon_url": {
       "forceQuery": true,
@@ -2456,6 +2604,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   "provisioner": {
     "daemon_poll_interval": 0,
     "daemon_poll_jitter": 0,
+    "daemon_psk": "string",
     "daemons": 0,
     "daemons_echo": true,
     "force_cancel_interval": 0
@@ -2521,6 +2670,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   },
   "trace": {
     "capture_logs": true,
+    "data_dog": true,
     "enable": true,
     "honeycomb_api_key": "string"
   },
@@ -2529,6 +2679,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
     "default_schedule": "string"
   },
   "verbose": true,
+  "web_terminal_renderer": "string",
   "wgtunnel_host": "string",
   "wildcard_access_url": {
     "forceQuery": true,
@@ -2549,61 +2700,81 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 ### Properties
 
-| Name                                 | Type                                                                                       | Required | Restrictions | Description                                                        |
-| ------------------------------------ | ------------------------------------------------------------------------------------------ | -------- | ------------ | ------------------------------------------------------------------ |
-| `access_url`                         | [clibase.URL](#clibaseurl)                                                                 | false    |              |                                                                    |
-| `address`                            | [clibase.HostPort](#clibasehostport)                                                       | false    |              | Address Use HTTPAddress or TLS.Address instead.                    |
-| `agent_fallback_troubleshooting_url` | [clibase.URL](#clibaseurl)                                                                 | false    |              |                                                                    |
-| `agent_stat_refresh_interval`        | integer                                                                                    | false    |              |                                                                    |
-| `autobuild_poll_interval`            | integer                                                                                    | false    |              |                                                                    |
-| `browser_only`                       | boolean                                                                                    | false    |              |                                                                    |
-| `cache_directory`                    | string                                                                                     | false    |              |                                                                    |
-| `config`                             | string                                                                                     | false    |              |                                                                    |
-| `config_ssh`                         | [codersdk.SSHConfig](#codersdksshconfig)                                                   | false    |              |                                                                    |
-| `dangerous`                          | [codersdk.DangerousConfig](#codersdkdangerousconfig)                                       | false    |              |                                                                    |
-| `derp`                               | [codersdk.DERP](#codersdkderp)                                                             | false    |              |                                                                    |
-| `disable_owner_workspace_exec`       | boolean                                                                                    | false    |              |                                                                    |
-| `disable_password_auth`              | boolean                                                                                    | false    |              |                                                                    |
-| `disable_path_apps`                  | boolean                                                                                    | false    |              |                                                                    |
-| `disable_session_expiry_refresh`     | boolean                                                                                    | false    |              |                                                                    |
-| `docs_url`                           | [clibase.URL](#clibaseurl)                                                                 | false    |              |                                                                    |
-| `enable_terraform_debug_mode`        | boolean                                                                                    | false    |              |                                                                    |
-| `experiments`                        | array of string                                                                            | false    |              |                                                                    |
-| `git_auth`                           | [clibase.Struct-array_codersdk_GitAuthConfig](#clibasestruct-array_codersdk_gitauthconfig) | false    |              |                                                                    |
-| `http_address`                       | string                                                                                     | false    |              | Http address is a string because it may be set to zero to disable. |
-| `in_memory_database`                 | boolean                                                                                    | false    |              |                                                                    |
-| `job_hang_detector_interval`         | integer                                                                                    | false    |              |                                                                    |
-| `logging`                            | [codersdk.LoggingConfig](#codersdkloggingconfig)                                           | false    |              |                                                                    |
-| `max_session_expiry`                 | integer                                                                                    | false    |              |                                                                    |
-| `max_token_lifetime`                 | integer                                                                                    | false    |              |                                                                    |
-| `metrics_cache_refresh_interval`     | integer                                                                                    | false    |              |                                                                    |
-| `oauth2`                             | [codersdk.OAuth2Config](#codersdkoauth2config)                                             | false    |              |                                                                    |
-| `oidc`                               | [codersdk.OIDCConfig](#codersdkoidcconfig)                                                 | false    |              |                                                                    |
-| `pg_connection_url`                  | string                                                                                     | false    |              |                                                                    |
-| `pprof`                              | [codersdk.PprofConfig](#codersdkpprofconfig)                                               | false    |              |                                                                    |
-| `prometheus`                         | [codersdk.PrometheusConfig](#codersdkprometheusconfig)                                     | false    |              |                                                                    |
-| `provisioner`                        | [codersdk.ProvisionerConfig](#codersdkprovisionerconfig)                                   | false    |              |                                                                    |
-| `proxy_health_status_interval`       | integer                                                                                    | false    |              |                                                                    |
-| `proxy_trusted_headers`              | array of string                                                                            | false    |              |                                                                    |
-| `proxy_trusted_origins`              | array of string                                                                            | false    |              |                                                                    |
-| `rate_limit`                         | [codersdk.RateLimitConfig](#codersdkratelimitconfig)                                       | false    |              |                                                                    |
-| `redirect_to_access_url`             | boolean                                                                                    | false    |              |                                                                    |
-| `scim_api_key`                       | string                                                                                     | false    |              |                                                                    |
-| `secure_auth_cookie`                 | boolean                                                                                    | false    |              |                                                                    |
-| `ssh_keygen_algorithm`               | string                                                                                     | false    |              |                                                                    |
-| `strict_transport_security`          | integer                                                                                    | false    |              |                                                                    |
-| `strict_transport_security_options`  | array of string                                                                            | false    |              |                                                                    |
-| `support`                            | [codersdk.SupportConfig](#codersdksupportconfig)                                           | false    |              |                                                                    |
-| `swagger`                            | [codersdk.SwaggerConfig](#codersdkswaggerconfig)                                           | false    |              |                                                                    |
-| `telemetry`                          | [codersdk.TelemetryConfig](#codersdktelemetryconfig)                                       | false    |              |                                                                    |
-| `tls`                                | [codersdk.TLSConfig](#codersdktlsconfig)                                                   | false    |              |                                                                    |
-| `trace`                              | [codersdk.TraceConfig](#codersdktraceconfig)                                               | false    |              |                                                                    |
-| `update_check`                       | boolean                                                                                    | false    |              |                                                                    |
-| `user_quiet_hours_schedule`          | [codersdk.UserQuietHoursScheduleConfig](#codersdkuserquiethoursscheduleconfig)             | false    |              |                                                                    |
-| `verbose`                            | boolean                                                                                    | false    |              |                                                                    |
-| `wgtunnel_host`                      | string                                                                                     | false    |              |                                                                    |
-| `wildcard_access_url`                | [clibase.URL](#clibaseurl)                                                                 | false    |              |                                                                    |
-| `write_config`                       | boolean                                                                                    | false    |              |                                                                    |
+| Name                                 | Type                                                                                                 | Required | Restrictions | Description                                                        |
+| ------------------------------------ | ---------------------------------------------------------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------ |
+| `access_url`                         | [clibase.URL](#clibaseurl)                                                                           | false    |              |                                                                    |
+| `address`                            | [clibase.HostPort](#clibasehostport)                                                                 | false    |              | Address Use HTTPAddress or TLS.Address instead.                    |
+| `agent_fallback_troubleshooting_url` | [clibase.URL](#clibaseurl)                                                                           | false    |              |                                                                    |
+| `agent_stat_refresh_interval`        | integer                                                                                              | false    |              |                                                                    |
+| `autobuild_poll_interval`            | integer                                                                                              | false    |              |                                                                    |
+| `browser_only`                       | boolean                                                                                              | false    |              |                                                                    |
+| `cache_directory`                    | string                                                                                               | false    |              |                                                                    |
+| `config`                             | string                                                                                               | false    |              |                                                                    |
+| `config_ssh`                         | [codersdk.SSHConfig](#codersdksshconfig)                                                             | false    |              |                                                                    |
+| `dangerous`                          | [codersdk.DangerousConfig](#codersdkdangerousconfig)                                                 | false    |              |                                                                    |
+| `derp`                               | [codersdk.DERP](#codersdkderp)                                                                       | false    |              |                                                                    |
+| `disable_owner_workspace_exec`       | boolean                                                                                              | false    |              |                                                                    |
+| `disable_password_auth`              | boolean                                                                                              | false    |              |                                                                    |
+| `disable_path_apps`                  | boolean                                                                                              | false    |              |                                                                    |
+| `disable_session_expiry_refresh`     | boolean                                                                                              | false    |              |                                                                    |
+| `docs_url`                           | [clibase.URL](#clibaseurl)                                                                           | false    |              |                                                                    |
+| `enable_terraform_debug_mode`        | boolean                                                                                              | false    |              |                                                                    |
+| `experiments`                        | array of string                                                                                      | false    |              |                                                                    |
+| `external_auth`                      | [clibase.Struct-array_codersdk_ExternalAuthConfig](#clibasestruct-array_codersdk_externalauthconfig) | false    |              |                                                                    |
+| `external_token_encryption_keys`     | array of string                                                                                      | false    |              |                                                                    |
+| `http_address`                       | string                                                                                               | false    |              | Http address is a string because it may be set to zero to disable. |
+| `in_memory_database`                 | boolean                                                                                              | false    |              |                                                                    |
+| `job_hang_detector_interval`         | integer                                                                                              | false    |              |                                                                    |
+| `logging`                            | [codersdk.LoggingConfig](#codersdkloggingconfig)                                                     | false    |              |                                                                    |
+| `max_session_expiry`                 | integer                                                                                              | false    |              |                                                                    |
+| `max_token_lifetime`                 | integer                                                                                              | false    |              |                                                                    |
+| `metrics_cache_refresh_interval`     | integer                                                                                              | false    |              |                                                                    |
+| `oauth2`                             | [codersdk.OAuth2Config](#codersdkoauth2config)                                                       | false    |              |                                                                    |
+| `oidc`                               | [codersdk.OIDCConfig](#codersdkoidcconfig)                                                           | false    |              |                                                                    |
+| `pg_connection_url`                  | string                                                                                               | false    |              |                                                                    |
+| `pprof`                              | [codersdk.PprofConfig](#codersdkpprofconfig)                                                         | false    |              |                                                                    |
+| `prometheus`                         | [codersdk.PrometheusConfig](#codersdkprometheusconfig)                                               | false    |              |                                                                    |
+| `provisioner`                        | [codersdk.ProvisionerConfig](#codersdkprovisionerconfig)                                             | false    |              |                                                                    |
+| `proxy_health_status_interval`       | integer                                                                                              | false    |              |                                                                    |
+| `proxy_trusted_headers`              | array of string                                                                                      | false    |              |                                                                    |
+| `proxy_trusted_origins`              | array of string                                                                                      | false    |              |                                                                    |
+| `rate_limit`                         | [codersdk.RateLimitConfig](#codersdkratelimitconfig)                                                 | false    |              |                                                                    |
+| `redirect_to_access_url`             | boolean                                                                                              | false    |              |                                                                    |
+| `scim_api_key`                       | string                                                                                               | false    |              |                                                                    |
+| `secure_auth_cookie`                 | boolean                                                                                              | false    |              |                                                                    |
+| `ssh_keygen_algorithm`               | string                                                                                               | false    |              |                                                                    |
+| `strict_transport_security`          | integer                                                                                              | false    |              |                                                                    |
+| `strict_transport_security_options`  | array of string                                                                                      | false    |              |                                                                    |
+| `support`                            | [codersdk.SupportConfig](#codersdksupportconfig)                                                     | false    |              |                                                                    |
+| `swagger`                            | [codersdk.SwaggerConfig](#codersdkswaggerconfig)                                                     | false    |              |                                                                    |
+| `telemetry`                          | [codersdk.TelemetryConfig](#codersdktelemetryconfig)                                                 | false    |              |                                                                    |
+| `tls`                                | [codersdk.TLSConfig](#codersdktlsconfig)                                                             | false    |              |                                                                    |
+| `trace`                              | [codersdk.TraceConfig](#codersdktraceconfig)                                                         | false    |              |                                                                    |
+| `update_check`                       | boolean                                                                                              | false    |              |                                                                    |
+| `user_quiet_hours_schedule`          | [codersdk.UserQuietHoursScheduleConfig](#codersdkuserquiethoursscheduleconfig)                       | false    |              |                                                                    |
+| `verbose`                            | boolean                                                                                              | false    |              |                                                                    |
+| `web_terminal_renderer`              | string                                                                                               | false    |              |                                                                    |
+| `wgtunnel_host`                      | string                                                                                               | false    |              |                                                                    |
+| `wildcard_access_url`                | [clibase.URL](#clibaseurl)                                                                           | false    |              |                                                                    |
+| `write_config`                       | boolean                                                                                              | false    |              |                                                                    |
+
+## codersdk.DisplayApp
+
+```json
+"vscode"
+```
+
+### Properties
+
+#### Enumerated Values
+
+| Value                    |
+| ------------------------ |
+| `vscode`                 |
+| `vscode_insiders`        |
+| `web_terminal`           |
+| `port_forwarding_helper` |
+| `ssh_helper`             |
 
 ## codersdk.Entitlement
 
@@ -2641,6 +2812,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
     }
   },
   "has_license": true,
+  "refreshed_at": "2019-08-24T14:15:22Z",
   "require_telemetry": true,
   "trial": true,
   "warnings": ["string"]
@@ -2655,6 +2827,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | `features`          | object                               | false    |              |             |
 | » `[any property]`  | [codersdk.Feature](#codersdkfeature) | false    |              |             |
 | `has_license`       | boolean                              | false    |              |             |
+| `refreshed_at`      | string                               | false    |              |             |
 | `require_telemetry` | boolean                              | false    |              |             |
 | `trial`             | boolean                              | false    |              |             |
 | `warnings`          | array of string                      | false    |              |             |
@@ -2669,84 +2842,18 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 #### Enumerated Values
 
-| Value                          |
-| ------------------------------ |
-| `moons`                        |
-| `workspace_actions`            |
-| `tailnet_pg_coordinator`       |
-| `single_tailnet`               |
-| `template_restart_requirement` |
-| `deployment_health_page`       |
-
-## codersdk.Feature
-
-```json
-{
-  "actual": 0,
-  "enabled": true,
-  "entitlement": "entitled",
-  "limit": 0
-}
-```
-
-### Properties
-
-| Name          | Type                                         | Required | Restrictions | Description |
-| ------------- | -------------------------------------------- | -------- | ------------ | ----------- |
-| `actual`      | integer                                      | false    |              |             |
-| `enabled`     | boolean                                      | false    |              |             |
-| `entitlement` | [codersdk.Entitlement](#codersdkentitlement) | false    |              |             |
-| `limit`       | integer                                      | false    |              |             |
-
-## codersdk.GenerateAPIKeyResponse
-
-```json
-{
-  "key": "string"
-}
-```
-
-### Properties
-
-| Name  | Type   | Required | Restrictions | Description |
-| ----- | ------ | -------- | ------------ | ----------- |
-| `key` | string | false    |              |             |
-
-## codersdk.GetUsersResponse
-
-```json
-{
-  "count": 0,
-  "users": [
-    {
-      "avatar_url": "http://example.com",
-      "created_at": "2019-08-24T14:15:22Z",
-      "email": "user@example.com",
-      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
-      "last_seen_at": "2019-08-24T14:15:22Z",
-      "login_type": "password",
-      "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
-      "roles": [
-        {
-          "display_name": "string",
-          "name": "string"
-        }
-      ],
-      "status": "active",
-      "username": "string"
-    }
-  ]
-}
-```
-
-### Properties
-
-| Name    | Type                                    | Required | Restrictions | Description |
-| ------- | --------------------------------------- | -------- | ------------ | ----------- |
-| `count` | integer                                 | false    |              |             |
-| `users` | array of [codersdk.User](#codersdkuser) | false    |              |             |
+| Value                           |
+| ------------------------------- |
+| `moons`                         |
+| `workspace_actions`             |
+| `tailnet_pg_coordinator`        |
+| `single_tailnet`                |
+| `template_autostop_requirement` |
+| `deployment_health_page`        |
+| `dashboard_theme`               |
+| `template_update_policies`      |
 
-## codersdk.GitAuth
+## codersdk.ExternalAuth
 
 ```json
 {
@@ -2754,6 +2861,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   "app_installable": true,
   "authenticated": true,
   "device": true,
+  "display_name": "string",
   "installations": [
     {
       "account": {
@@ -2766,7 +2874,6 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
       "id": 0
     }
   ],
-  "type": "string",
   "user": {
     "avatar_url": "string",
     "login": "string",
@@ -2778,17 +2885,17 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 ### Properties
 
-| Name              | Type                                                                        | Required | Restrictions | Description                                                             |
-| ----------------- | --------------------------------------------------------------------------- | -------- | ------------ | ----------------------------------------------------------------------- |
-| `app_install_url` | string                                                                      | false    |              | App install URL is the URL to install the app.                          |
-| `app_installable` | boolean                                                                     | false    |              | App installable is true if the request for app installs was successful. |
-| `authenticated`   | boolean                                                                     | false    |              |                                                                         |
-| `device`          | boolean                                                                     | false    |              |                                                                         |
-| `installations`   | array of [codersdk.GitAuthAppInstallation](#codersdkgitauthappinstallation) | false    |              | Installations are the installations that the user has access to.        |
-| `type`            | string                                                                      | false    |              |                                                                         |
-| `user`            | [codersdk.GitAuthUser](#codersdkgitauthuser)                                | false    |              | User is the user that authenticated with the provider.                  |
+| Name              | Type                                                                                  | Required | Restrictions | Description                                                             |
+| ----------------- | ------------------------------------------------------------------------------------- | -------- | ------------ | ----------------------------------------------------------------------- |
+| `app_install_url` | string                                                                                | false    |              | App install URL is the URL to install the app.                          |
+| `app_installable` | boolean                                                                               | false    |              | App installable is true if the request for app installs was successful. |
+| `authenticated`   | boolean                                                                               | false    |              |                                                                         |
+| `device`          | boolean                                                                               | false    |              |                                                                         |
+| `display_name`    | string                                                                                | false    |              |                                                                         |
+| `installations`   | array of [codersdk.ExternalAuthAppInstallation](#codersdkexternalauthappinstallation) | false    |              | Installations are the installations that the user has access to.        |
+| `user`            | [codersdk.ExternalAuthUser](#codersdkexternalauthuser)                                | false    |              | User is the user that authenticated with the provider.                  |
 
-## codersdk.GitAuthAppInstallation
+## codersdk.ExternalAuthAppInstallation
 
 ```json
 {
@@ -2805,13 +2912,13 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 ### Properties
 
-| Name            | Type                                         | Required | Restrictions | Description |
-| --------------- | -------------------------------------------- | -------- | ------------ | ----------- |
-| `account`       | [codersdk.GitAuthUser](#codersdkgitauthuser) | false    |              |             |
-| `configure_url` | string                                       | false    |              |             |
-| `id`            | integer                                      | false    |              |             |
+| Name            | Type                                                   | Required | Restrictions | Description |
+| --------------- | ------------------------------------------------------ | -------- | ------------ | ----------- |
+| `account`       | [codersdk.ExternalAuthUser](#codersdkexternalauthuser) | false    |              |             |
+| `configure_url` | string                                                 | false    |              |             |
+| `id`            | integer                                                | false    |              |             |
 
-## codersdk.GitAuthConfig
+## codersdk.ExternalAuthConfig
 
 ```json
 {
@@ -2821,6 +2928,9 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   "client_id": "string",
   "device_code_url": "string",
   "device_flow": true,
+  "display_icon": "string",
+  "display_name": "string",
+  "extra_token_keys": ["string"],
   "id": "string",
   "no_refresh": true,
   "regex": "string",
@@ -2833,23 +2943,27 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 ### Properties
 
-| Name                    | Type            | Required | Restrictions | Description |
-| ----------------------- | --------------- | -------- | ------------ | ----------- |
-| `app_install_url`       | string          | false    |              |             |
-| `app_installations_url` | string          | false    |              |             |
-| `auth_url`              | string          | false    |              |             |
-| `client_id`             | string          | false    |              |             |
-| `device_code_url`       | string          | false    |              |             |
-| `device_flow`           | boolean         | false    |              |             |
-| `id`                    | string          | false    |              |             |
-| `no_refresh`            | boolean         | false    |              |             |
-| `regex`                 | string          | false    |              |             |
-| `scopes`                | array of string | false    |              |             |
-| `token_url`             | string          | false    |              |             |
-| `type`                  | string          | false    |              |             |
-| `validate_url`          | string          | false    |              |             |
+| Name                                                                                                                                                     | Type            | Required | Restrictions | Description                                                                                               |
+| -------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------- |
+| `app_install_url`                                                                                                                                        | string          | false    |              |                                                                                                           |
+| `app_installations_url`                                                                                                                                  | string          | false    |              |                                                                                                           |
+| `auth_url`                                                                                                                                               | string          | false    |              |                                                                                                           |
+| `client_id`                                                                                                                                              | string          | false    |              |                                                                                                           |
+| `device_code_url`                                                                                                                                        | string          | false    |              |                                                                                                           |
+| `device_flow`                                                                                                                                            | boolean         | false    |              |                                                                                                           |
+| `display_icon`                                                                                                                                           | string          | false    |              | Display icon is a URL to an icon to display in the UI.                                                    |
+| `display_name`                                                                                                                                           | string          | false    |              | Display name is shown in the UI to identify the auth config.                                              |
+| `extra_token_keys`                                                                                                                                       | array of string | false    |              |                                                                                                           |
+| `id`                                                                                                                                                     | string          | false    |              | ID is a unique identifier for the auth config. It defaults to `type` when not provided.                   |
+| `no_refresh`                                                                                                                                             | boolean         | false    |              |                                                                                                           |
+| `regex`                                                                                                                                                  | string          | false    |              | Regex allows API requesters to match an auth config by a string (e.g. coder.com) instead of by it's type. |
+| Git clone makes use of this by parsing the URL from: 'Username for "https://github.com":' And sending it to the Coder server to match against the Regex. |
+| `scopes`                                                                                                                                                 | array of string | false    |              |                                                                                                           |
+| `token_url`                                                                                                                                              | string          | false    |              |                                                                                                           |
+| `type`                                                                                                                                                   | string          | false    |              | Type is the type of external auth config.                                                                 |
+| `validate_url`                                                                                                                                           | string          | false    |              |                                                                                                           |
 
-## codersdk.GitAuthDevice
+## codersdk.ExternalAuthDevice
 
 ```json
 {
@@ -2871,7 +2985,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | `user_code`        | string  | false    |              |             |
 | `verification_uri` | string  | false    |              |             |
 
-## codersdk.GitAuthUser
+## codersdk.ExternalAuthUser
 
 ```json
 {
@@ -2891,22 +3005,73 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | `name`        | string | false    |              |             |
 | `profile_url` | string | false    |              |             |
 
-## codersdk.GitProvider
+## codersdk.Feature
+
+```json
+{
+  "actual": 0,
+  "enabled": true,
+  "entitlement": "entitled",
+  "limit": 0
+}
+```
+
+### Properties
+
+| Name          | Type                                         | Required | Restrictions | Description |
+| ------------- | -------------------------------------------- | -------- | ------------ | ----------- |
+| `actual`      | integer                                      | false    |              |             |
+| `enabled`     | boolean                                      | false    |              |             |
+| `entitlement` | [codersdk.Entitlement](#codersdkentitlement) | false    |              |             |
+| `limit`       | integer                                      | false    |              |             |
+
+## codersdk.GenerateAPIKeyResponse
 
 ```json
-"azure-devops"
+{
+  "key": "string"
+}
 ```
 
 ### Properties
 
-#### Enumerated Values
+| Name  | Type   | Required | Restrictions | Description |
+| ----- | ------ | -------- | ------------ | ----------- |
+| `key` | string | false    |              |             |
 
-| Value          |
-| -------------- |
-| `azure-devops` |
-| `github`       |
-| `gitlab`       |
-| `bitbucket`    |
+## codersdk.GetUsersResponse
+
+```json
+{
+  "count": 0,
+  "users": [
+    {
+      "avatar_url": "http://example.com",
+      "created_at": "2019-08-24T14:15:22Z",
+      "email": "user@example.com",
+      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "last_seen_at": "2019-08-24T14:15:22Z",
+      "login_type": "",
+      "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+      "roles": [
+        {
+          "display_name": "string",
+          "name": "string"
+        }
+      ],
+      "status": "active",
+      "username": "string"
+    }
+  ]
+}
+```
+
+### Properties
+
+| Name    | Type                                    | Required | Restrictions | Description |
+| ------- | --------------------------------------- | -------- | ------------ | ----------- |
+| `count` | integer                                 | false    |              |             |
+| `users` | array of [codersdk.User](#codersdkuser) | false    |              |             |
 
 ## codersdk.GitSSHKey
 
@@ -2942,7 +3107,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
       "email": "user@example.com",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "last_seen_at": "2019-08-24T14:15:22Z",
-      "login_type": "password",
+      "login_type": "",
       "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
       "roles": [
         {
@@ -2956,23 +3121,40 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   ],
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
-  "quota_allowance": 0
+  "quota_allowance": 0,
+  "source": "user"
 }
 ```
 
 ### Properties
 
-| Name              | Type                                    | Required | Restrictions | Description |
-| ----------------- | --------------------------------------- | -------- | ------------ | ----------- |
-| `avatar_url`      | string                                  | false    |              |             |
-| `display_name`    | string                                  | false    |              |             |
-| `id`              | string                                  | false    |              |             |
-| `members`         | array of [codersdk.User](#codersdkuser) | false    |              |             |
-| `name`            | string                                  | false    |              |             |
-| `organization_id` | string                                  | false    |              |             |
-| `quota_allowance` | integer                                 | false    |              |             |
+| Name              | Type                                         | Required | Restrictions | Description |
+| ----------------- | -------------------------------------------- | -------- | ------------ | ----------- |
+| `avatar_url`      | string                                       | false    |              |             |
+| `display_name`    | string                                       | false    |              |             |
+| `id`              | string                                       | false    |              |             |
+| `members`         | array of [codersdk.User](#codersdkuser)      | false    |              |             |
+| `name`            | string                                       | false    |              |             |
+| `organization_id` | string                                       | false    |              |             |
+| `quota_allowance` | integer                                      | false    |              |             |
+| `source`          | [codersdk.GroupSource](#codersdkgroupsource) | false    |              |             |
 
-## codersdk.Healthcheck
+## codersdk.GroupSource
+
+```json
+"user"
+```
+
+### Properties
+
+#### Enumerated Values
+
+| Value  |
+| ------ |
+| `user` |
+| `oidc` |
+
+## codersdk.Healthcheck
 
 ```json
 {
@@ -3000,9 +3182,10 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 #### Enumerated Values
 
-| Value |
-| ----- |
-| `day` |
+| Value  |
+| ------ |
+| `day`  |
+| `week` |
 
 ## codersdk.IssueReconnectingPTYSignedTokenRequest
 
@@ -3037,7 +3220,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 ## codersdk.JobErrorCode
 
 ```json
-"MISSING_TEMPLATE_PARAMETER"
+"REQUIRED_TEMPLATE_VARIABLES"
 ```
 
 ### Properties
@@ -3046,7 +3229,6 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 | Value                         |
 | ----------------------------- |
-| `MISSING_TEMPLATE_PARAMETER`  |
 | `REQUIRED_TEMPLATE_VARIABLES` |
 
 ## codersdk.License
@@ -3143,7 +3325,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 ## codersdk.LoginType
 
 ```json
-"password"
+""
 ```
 
 ### Properties
@@ -3152,6 +3334,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 | Value      |
 | ---------- |
+| ``         |
 | `password` |
 | `github`   |
 | `oidc`     |
@@ -3260,7 +3443,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 {
   "expires_at": "2019-08-24T14:15:22Z",
   "state_string": "string",
-  "to_type": "password",
+  "to_type": "",
   "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5"
 }
 ```
@@ -3298,11 +3481,15 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 {
   "allow_signups": true,
   "auth_url_params": {},
+  "client_cert_file": "string",
   "client_id": "string",
+  "client_key_file": "string",
   "client_secret": "string",
   "email_domain": ["string"],
   "email_field": "string",
+  "group_auto_create": true,
   "group_mapping": {},
+  "group_regex_filter": {},
   "groups_field": "string",
   "icon_url": {
     "forceQuery": true,
@@ -3331,26 +3518,30 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 ### Properties
 
-| Name                    | Type                       | Required | Restrictions | Description |
-| ----------------------- | -------------------------- | -------- | ------------ | ----------- |
-| `allow_signups`         | boolean                    | false    |              |             |
-| `auth_url_params`       | object                     | false    |              |             |
-| `client_id`             | string                     | false    |              |             |
-| `client_secret`         | string                     | false    |              |             |
-| `email_domain`          | array of string            | false    |              |             |
-| `email_field`           | string                     | false    |              |             |
-| `group_mapping`         | object                     | false    |              |             |
-| `groups_field`          | string                     | false    |              |             |
-| `icon_url`              | [clibase.URL](#clibaseurl) | false    |              |             |
-| `ignore_email_verified` | boolean                    | false    |              |             |
-| `ignore_user_info`      | boolean                    | false    |              |             |
-| `issuer_url`            | string                     | false    |              |             |
-| `scopes`                | array of string            | false    |              |             |
-| `sign_in_text`          | string                     | false    |              |             |
-| `user_role_field`       | string                     | false    |              |             |
-| `user_role_mapping`     | object                     | false    |              |             |
-| `user_roles_default`    | array of string            | false    |              |             |
-| `username_field`        | string                     | false    |              |             |
+| Name                    | Type                             | Required | Restrictions | Description                                                                      |
+| ----------------------- | -------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------- |
+| `allow_signups`         | boolean                          | false    |              |                                                                                  |
+| `auth_url_params`       | object                           | false    |              |                                                                                  |
+| `client_cert_file`      | string                           | false    |              |                                                                                  |
+| `client_id`             | string                           | false    |              |                                                                                  |
+| `client_key_file`       | string                           | false    |              | Client key file & ClientCertFile are used in place of ClientSecret for PKI auth. |
+| `client_secret`         | string                           | false    |              |                                                                                  |
+| `email_domain`          | array of string                  | false    |              |                                                                                  |
+| `email_field`           | string                           | false    |              |                                                                                  |
+| `group_auto_create`     | boolean                          | false    |              |                                                                                  |
+| `group_mapping`         | object                           | false    |              |                                                                                  |
+| `group_regex_filter`    | [clibase.Regexp](#clibaseregexp) | false    |              |                                                                                  |
+| `groups_field`          | string                           | false    |              |                                                                                  |
+| `icon_url`              | [clibase.URL](#clibaseurl)       | false    |              |                                                                                  |
+| `ignore_email_verified` | boolean                          | false    |              |                                                                                  |
+| `ignore_user_info`      | boolean                          | false    |              |                                                                                  |
+| `issuer_url`            | string                           | false    |              |                                                                                  |
+| `scopes`                | array of string                  | false    |              |                                                                                  |
+| `sign_in_text`          | string                           | false    |              |                                                                                  |
+| `user_role_field`       | string                           | false    |              |                                                                                  |
+| `user_role_mapping`     | object                           | false    |              |                                                                                  |
+| `user_roles_default`    | array of string                  | false    |              |                                                                                  |
+| `username_field`        | string                           | false    |              |                                                                                  |
 
 ## codersdk.Organization
 
@@ -3399,6 +3590,30 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | `updated_at`      | string                                  | false    |              |             |
 | `user_id`         | string                                  | false    |              |             |
 
+## codersdk.PatchGroupRequest
+
+```json
+{
+  "add_users": ["string"],
+  "avatar_url": "string",
+  "display_name": "string",
+  "name": "string",
+  "quota_allowance": 0,
+  "remove_users": ["string"]
+}
+```
+
+### Properties
+
+| Name              | Type            | Required | Restrictions | Description |
+| ----------------- | --------------- | -------- | ------------ | ----------- |
+| `add_users`       | array of string | false    |              |             |
+| `avatar_url`      | string          | false    |              |             |
+| `display_name`    | string          | false    |              |             |
+| `name`            | string          | false    |              |             |
+| `quota_allowance` | integer         | false    |              |             |
+| `remove_users`    | array of string | false    |              |             |
+
 ## codersdk.PatchTemplateVersionRequest
 
 ```json
@@ -3485,6 +3700,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 {
   "daemon_poll_interval": 0,
   "daemon_poll_jitter": 0,
+  "daemon_psk": "string",
   "daemons": 0,
   "daemons_echo": true,
   "force_cancel_interval": 0
@@ -3497,6 +3713,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | ----------------------- | ------- | -------- | ------------ | ----------- |
 | `daemon_poll_interval`  | integer | false    |              |             |
 | `daemon_poll_jitter`    | integer | false    |              |             |
+| `daemon_psk`            | string  | false    |              |             |
 | `daemons`               | integer | false    |              |             |
 | `daemons_echo`          | boolean | false    |              |             |
 | `force_cancel_interval` | integer | false    |              |             |
@@ -3540,7 +3757,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   "completed_at": "2019-08-24T14:15:22Z",
   "created_at": "2019-08-24T14:15:22Z",
   "error": "string",
-  "error_code": "MISSING_TEMPLATE_PARAMETER",
+  "error_code": "REQUIRED_TEMPLATE_VARIABLES",
   "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "queue_position": 0,
@@ -3578,7 +3795,6 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 | Property     | Value                         |
 | ------------ | ----------------------------- |
-| `error_code` | `MISSING_TEMPLATE_PARAMETER`  |
 | `error_code` | `REQUIRED_TEMPLATE_VARIABLES` |
 | `status`     | `pending`                     |
 | `status`     | `running`                     |
@@ -3639,6 +3855,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | `canceling` |
 | `canceled`  |
 | `failed`    |
+| `unknown`   |
 
 ## codersdk.ProvisionerLogLevel
 
@@ -3901,6 +4118,8 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | `group`            |
 | `license`          |
 | `convert_login`    |
+| `workspace_proxy`  |
+| `organization`     |
 
 ## codersdk.Response
 
@@ -4125,6 +4344,13 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   "allow_user_autostart": true,
   "allow_user_autostop": true,
   "allow_user_cancel_workspace_jobs": true,
+  "autostart_requirement": {
+    "days_of_week": ["monday"]
+  },
+  "autostop_requirement": {
+    "days_of_week": ["monday"],
+    "weeks": 0
+  },
   "build_time_stats": {
     "property1": {
       "p50": 123,
@@ -4144,47 +4370,46 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   "failure_ttl_ms": 0,
   "icon": "string",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
-  "inactivity_ttl_ms": 0,
-  "locked_ttl_ms": 0,
   "max_ttl_ms": 0,
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
   "provisioner": "terraform",
-  "restart_requirement": {
-    "days_of_week": ["monday"],
-    "weeks": 0
-  },
+  "require_active_version": true,
+  "time_til_dormant_autodelete_ms": 0,
+  "time_til_dormant_ms": 0,
   "updated_at": "2019-08-24T14:15:22Z"
 }
 ```
 
 ### Properties
 
-| Name                               | Type                                                                       | Required | Restrictions | Description                                                                                                                                                                     |
-| ---------------------------------- | -------------------------------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `active_user_count`                | integer                                                                    | false    |              | Active user count is set to -1 when loading.                                                                                                                                    |
-| `active_version_id`                | string                                                                     | false    |              |                                                                                                                                                                                 |
-| `allow_user_autostart`             | boolean                                                                    | false    |              | Allow user autostart and AllowUserAutostop are enterprise-only. Their values are only used if your license is entitled to use the advanced template scheduling feature.         |
-| `allow_user_autostop`              | boolean                                                                    | false    |              |                                                                                                                                                                                 |
-| `allow_user_cancel_workspace_jobs` | boolean                                                                    | false    |              |                                                                                                                                                                                 |
-| `build_time_stats`                 | [codersdk.TemplateBuildTimeStats](#codersdktemplatebuildtimestats)         | false    |              |                                                                                                                                                                                 |
-| `created_at`                       | string                                                                     | false    |              |                                                                                                                                                                                 |
-| `created_by_id`                    | string                                                                     | false    |              |                                                                                                                                                                                 |
-| `created_by_name`                  | string                                                                     | false    |              |                                                                                                                                                                                 |
-| `default_ttl_ms`                   | integer                                                                    | false    |              |                                                                                                                                                                                 |
-| `description`                      | string                                                                     | false    |              |                                                                                                                                                                                 |
-| `display_name`                     | string                                                                     | false    |              |                                                                                                                                                                                 |
-| `failure_ttl_ms`                   | integer                                                                    | false    |              | Failure ttl ms InactivityTTLMillis, and LockedTTLMillis are enterprise-only. Their values are used if your license is entitled to use the advanced template scheduling feature. |
-| `icon`                             | string                                                                     | false    |              |                                                                                                                                                                                 |
-| `id`                               | string                                                                     | false    |              |                                                                                                                                                                                 |
-| `inactivity_ttl_ms`                | integer                                                                    | false    |              |                                                                                                                                                                                 |
-| `locked_ttl_ms`                    | integer                                                                    | false    |              |                                                                                                                                                                                 |
-| `max_ttl_ms`                       | integer                                                                    | false    |              | Max ttl ms remove max_ttl once restart_requirement is matured                                                                                                                   |
-| `name`                             | string                                                                     | false    |              |                                                                                                                                                                                 |
-| `organization_id`                  | string                                                                     | false    |              |                                                                                                                                                                                 |
-| `provisioner`                      | string                                                                     | false    |              |                                                                                                                                                                                 |
-| `restart_requirement`              | [codersdk.TemplateRestartRequirement](#codersdktemplaterestartrequirement) | false    |              | Restart requirement is an enterprise feature. Its value is only used if your license is entitled to use the advanced template scheduling feature.                               |
-| `updated_at`                       | string                                                                     | false    |              |                                                                                                                                                                                 |
+| Name                               | Type                                                                           | Required | Restrictions | Description                                                                                                                                                                                     |
+| ---------------------------------- | ------------------------------------------------------------------------------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `active_user_count`                | integer                                                                        | false    |              | Active user count is set to -1 when loading.                                                                                                                                                    |
+| `active_version_id`                | string                                                                         | false    |              |                                                                                                                                                                                                 |
+| `allow_user_autostart`             | boolean                                                                        | false    |              | Allow user autostart and AllowUserAutostop are enterprise-only. Their values are only used if your license is entitled to use the advanced template scheduling feature.                         |
+| `allow_user_autostop`              | boolean                                                                        | false    |              |                                                                                                                                                                                                 |
+| `allow_user_cancel_workspace_jobs` | boolean                                                                        | false    |              |                                                                                                                                                                                                 |
+| `autostart_requirement`            | [codersdk.TemplateAutostartRequirement](#codersdktemplateautostartrequirement) | false    |              |                                                                                                                                                                                                 |
+| `autostop_requirement`             | [codersdk.TemplateAutostopRequirement](#codersdktemplateautostoprequirement)   | false    |              | Autostop requirement and AutostartRequirement are enterprise features. Its value is only used if your license is entitled to use the advanced template scheduling feature.                      |
+| `build_time_stats`                 | [codersdk.TemplateBuildTimeStats](#codersdktemplatebuildtimestats)             | false    |              |                                                                                                                                                                                                 |
+| `created_at`                       | string                                                                         | false    |              |                                                                                                                                                                                                 |
+| `created_by_id`                    | string                                                                         | false    |              |                                                                                                                                                                                                 |
+| `created_by_name`                  | string                                                                         | false    |              |                                                                                                                                                                                                 |
+| `default_ttl_ms`                   | integer                                                                        | false    |              |                                                                                                                                                                                                 |
+| `description`                      | string                                                                         | false    |              |                                                                                                                                                                                                 |
+| `display_name`                     | string                                                                         | false    |              |                                                                                                                                                                                                 |
+| `failure_ttl_ms`                   | integer                                                                        | false    |              | Failure ttl ms TimeTilDormantMillis, and TimeTilDormantAutoDeleteMillis are enterprise-only. Their values are used if your license is entitled to use the advanced template scheduling feature. |
+| `icon`                             | string                                                                         | false    |              |                                                                                                                                                                                                 |
+| `id`                               | string                                                                         | false    |              |                                                                                                                                                                                                 |
+| `max_ttl_ms`                       | integer                                                                        | false    |              | Max ttl ms remove max_ttl once autostop_requirement is matured                                                                                                                                  |
+| `name`                             | string                                                                         | false    |              |                                                                                                                                                                                                 |
+| `organization_id`                  | string                                                                         | false    |              |                                                                                                                                                                                                 |
+| `provisioner`                      | string                                                                         | false    |              |                                                                                                                                                                                                 |
+| `require_active_version`           | boolean                                                                        | false    |              | Require active version mandates that workspaces are built with the active template version.                                                                                                     |
+| `time_til_dormant_autodelete_ms`   | integer                                                                        | false    |              |                                                                                                                                                                                                 |
+| `time_til_dormant_ms`              | integer                                                                        | false    |              |                                                                                                                                                                                                 |
+| `updated_at`                       | string                                                                         | false    |              |                                                                                                                                                                                                 |
 
 #### Enumerated Values
 
@@ -4229,6 +4454,38 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | Value     |
 | --------- |
 | `builtin` |
+| `app`     |
+
+## codersdk.TemplateAutostartRequirement
+
+```json
+{
+  "days_of_week": ["monday"]
+}
+```
+
+### Properties
+
+| Name           | Type            | Required | Restrictions | Description                                                                                                                             |
+| -------------- | --------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------- |
+| `days_of_week` | array of string | false    |              | Days of week is a list of days of the week in which autostart is allowed to happen. If no days are specified, autostart is not allowed. |
+
+## codersdk.TemplateAutostopRequirement
+
+```json
+{
+  "days_of_week": ["monday"],
+  "weeks": 0
+}
+```
+
+### Properties
+
+| Name                                                                                  | Type            | Required | Restrictions | Description                                                                                                                                                                                                                                                                                                    |
+| ------------------------------------------------------------------------------------- | --------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `days_of_week`                                                                        | array of string | false    |              | Days of week is a list of days of the week on which restarts are required. Restarts happen within the user's quiet hours (in their configured timezone). If no days are specified, restarts are not required. Weekdays cannot be specified twice.                                                              |
+| Restarts will only happen on weekdays in this list on weeks which line up with Weeks. |
+| `weeks`                                                                               | integer         | false    |              | Weeks is the number of weeks between required restarts. Weeks are synced across all workspaces (and Coder deployments) using modulo math on a hardcoded epoch week of January 2nd, 2023 (the first Monday of 2023). Values of 0 or 1 indicate weekly restarts. Values of 2 indicate fortnightly restarts, etc. |
 
 ## codersdk.TemplateBuildTimeStats
 
@@ -4283,7 +4540,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 {
   "active_users": 14,
   "end_time": "2019-08-24T14:15:22Z",
-  "interval": "day",
+  "interval": "week",
   "start_time": "2019-08-24T14:15:22Z",
   "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"]
 }
@@ -4317,6 +4574,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   "end_time": "2019-08-24T14:15:22Z",
   "parameters_usage": [
     {
+      "description": "string",
       "display_name": "string",
       "name": "string",
       "options": [
@@ -4328,6 +4586,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
         }
       ],
       "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+      "type": "string",
       "values": [
         {
           "count": 0,
@@ -4360,7 +4619,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
     {
       "active_users": 14,
       "end_time": "2019-08-24T14:15:22Z",
-      "interval": "day",
+      "interval": "week",
       "start_time": "2019-08-24T14:15:22Z",
       "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"]
     }
@@ -4380,6 +4639,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
     "end_time": "2019-08-24T14:15:22Z",
     "parameters_usage": [
       {
+        "description": "string",
         "display_name": "string",
         "name": "string",
         "options": [
@@ -4391,6 +4651,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
           }
         ],
         "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+        "type": "string",
         "values": [
           {
             "count": 0,
@@ -4416,6 +4677,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 ```json
 {
+  "description": "string",
   "display_name": "string",
   "name": "string",
   "options": [
@@ -4427,6 +4689,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
     }
   ],
   "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+  "type": "string",
   "values": [
     {
       "count": 0,
@@ -4440,10 +4703,12 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 | Name           | Type                                                                                        | Required | Restrictions | Description |
 | -------------- | ------------------------------------------------------------------------------------------- | -------- | ------------ | ----------- |
+| `description`  | string                                                                                      | false    |              |             |
 | `display_name` | string                                                                                      | false    |              |             |
 | `name`         | string                                                                                      | false    |              |             |
 | `options`      | array of [codersdk.TemplateVersionParameterOption](#codersdktemplateversionparameteroption) | false    |              |             |
 | `template_ids` | array of string                                                                             | false    |              |             |
+| `type`         | string                                                                                      | false    |              |             |
 | `values`       | array of [codersdk.TemplateParameterValue](#codersdktemplateparametervalue)                 | false    |              |             |
 
 ## codersdk.TemplateParameterValue
@@ -4462,23 +4727,6 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | `count` | integer | false    |              |             |
 | `value` | string  | false    |              |             |
 
-## codersdk.TemplateRestartRequirement
-
-```json
-{
-  "days_of_week": ["monday"],
-  "weeks": 0
-}
-```
-
-### Properties
-
-| Name                                                                                  | Type            | Required | Restrictions | Description                                                                                                                                                                                                                                                                                                    |
-| ------------------------------------------------------------------------------------- | --------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `days_of_week`                                                                        | array of string | false    |              | Days of week is a list of days of the week on which restarts are required. Restarts happen within the user's quiet hours (in their configured timezone). If no days are specified, restarts are not required. Weekdays cannot be specified twice.                                                              |
-| Restarts will only happen on weekdays in this list on weeks which line up with Weeks. |
-| `weeks`                                                                               | integer         | false    |              | Weeks is the number of weeks between required restarts. Weeks are synced across all workspaces (and Coder deployments) using modulo math on a hardcoded epoch week of January 2nd, 2023 (the first Monday of 2023). Values of 0 or 1 indicate weekly restarts. Values of 2 indicate fortnightly restarts, etc. |
-
 ## codersdk.TemplateRole
 
 ```json
@@ -4504,7 +4752,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
   "email": "user@example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "last_seen_at": "2019-08-24T14:15:22Z",
-  "login_type": "password",
+  "login_type": "",
   "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
   "role": "admin",
   "roles": [
@@ -4547,6 +4795,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 ```json
 {
+  "archived": true,
   "created_at": "2019-08-24T14:15:22Z",
   "created_by": {
     "avatar_url": "http://example.com",
@@ -4559,7 +4808,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
     "completed_at": "2019-08-24T14:15:22Z",
     "created_at": "2019-08-24T14:15:22Z",
     "error": "string",
-    "error_code": "MISSING_TEMPLATE_PARAMETER",
+    "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "queue_position": 0,
@@ -4586,6 +4835,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 | Name              | Type                                                                        | Required | Restrictions | Description |
 | ----------------- | --------------------------------------------------------------------------- | -------- | ------------ | ----------- |
+| `archived`        | boolean                                                                     | false    |              |             |
 | `created_at`      | string                                                                      | false    |              |             |
 | `created_by`      | [codersdk.MinimalUser](#codersdkminimaluser)                                | false    |              |             |
 | `id`              | string                                                                      | false    |              |             |
@@ -4598,25 +4848,29 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | `updated_at`      | string                                                                      | false    |              |             |
 | `warnings`        | array of [codersdk.TemplateVersionWarning](#codersdktemplateversionwarning) | false    |              |             |
 
-## codersdk.TemplateVersionGitAuth
+## codersdk.TemplateVersionExternalAuth
 
 ```json
 {
   "authenticate_url": "string",
   "authenticated": true,
+  "display_icon": "string",
+  "display_name": "string",
   "id": "string",
-  "type": "azure-devops"
+  "type": "string"
 }
 ```
 
 ### Properties
 
-| Name               | Type                                         | Required | Restrictions | Description |
-| ------------------ | -------------------------------------------- | -------- | ------------ | ----------- |
-| `authenticate_url` | string                                       | false    |              |             |
-| `authenticated`    | boolean                                      | false    |              |             |
-| `id`               | string                                       | false    |              |             |
-| `type`             | [codersdk.GitProvider](#codersdkgitprovider) | false    |              |             |
+| Name               | Type    | Required | Restrictions | Description |
+| ------------------ | ------- | -------- | ------------ | ----------- |
+| `authenticate_url` | string  | false    |              |             |
+| `authenticated`    | boolean | false    |              |             |
+| `display_icon`     | string  | false    |              |             |
+| `display_name`     | string  | false    |              |             |
+| `id`               | string  | false    |              |             |
+| `type`             | string  | false    |              |             |
 
 ## codersdk.TemplateVersionParameter
 
@@ -4767,6 +5021,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 ```json
 {
   "capture_logs": true,
+  "data_dog": true,
   "enable": true,
   "honeycomb_api_key": "string"
 }
@@ -4777,6 +5032,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 | Name                | Type    | Required | Restrictions | Description |
 | ------------------- | ------- | -------- | ------------ | ----------- |
 | `capture_logs`      | boolean | false    |              |             |
+| `data_dog`          | boolean | false    |              |             |
 | `enable`            | boolean | false    |              |             |
 | `honeycomb_api_key` | string  | false    |              |             |
 
@@ -4814,6 +5070,7 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 ```json
 {
+  "application_name": "string",
   "logo_url": "string",
   "service_banner": {
     "background_color": "string",
@@ -4825,10 +5082,11 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 
 ### Properties
 
-| Name             | Type                                                         | Required | Restrictions | Description |
-| ---------------- | ------------------------------------------------------------ | -------- | ------------ | ----------- |
-| `logo_url`       | string                                                       | false    |              |             |
-| `service_banner` | [codersdk.ServiceBannerConfig](#codersdkservicebannerconfig) | false    |              |             |
+| Name               | Type                                                         | Required | Restrictions | Description |
+| ------------------ | ------------------------------------------------------------ | -------- | ------------ | ----------- |
+| `application_name` | string                                                       | false    |              |             |
+| `logo_url`         | string                                                       | false    |              |             |
+| `service_banner`   | [codersdk.ServiceBannerConfig](#codersdkservicebannerconfig) | false    |              |             |
 
 ## codersdk.UpdateCheckResponse
 
@@ -4933,6 +5191,20 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 The schedule must be daily with a single time, and should have a timezone specified via a CRON_TZ prefix (otherwise UTC will be used).
 If the schedule is empty, the user will be updated to use the default schedule.|
 
+## codersdk.UpdateWorkspaceAutomaticUpdatesRequest
+
+```json
+{
+  "automatic_updates": "always"
+}
+```
+
+### Properties
+
+| Name                | Type                                                   | Required | Restrictions | Description |
+| ------------------- | ------------------------------------------------------ | -------- | ------------ | ----------- |
+| `automatic_updates` | [codersdk.AutomaticUpdates](#codersdkautomaticupdates) | false    |              |             |
+
 ## codersdk.UpdateWorkspaceAutostartRequest
 
 ```json
@@ -4947,19 +5219,19 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 | ---------- | ------ | -------- | ------------ | ----------- |
 | `schedule` | string | false    |              |             |
 
-## codersdk.UpdateWorkspaceLock
+## codersdk.UpdateWorkspaceDormancy
 
 ```json
 {
-  "lock": true
+  "dormant": true
 }
 ```
 
 ### Properties
 
-| Name   | Type    | Required | Restrictions | Description |
-| ------ | ------- | -------- | ------------ | ----------- |
-| `lock` | boolean | false    |              |             |
+| Name      | Type    | Required | Restrictions | Description |
+| --------- | ------- | -------- | ------------ | ----------- |
+| `dormant` | boolean | false    |              |             |
 
 ## codersdk.UpdateWorkspaceRequest
 
@@ -5012,7 +5284,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
   "email": "user@example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "last_seen_at": "2019-08-24T14:15:22Z",
-  "login_type": "password",
+  "login_type": "",
   "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
   "roles": [
     {
@@ -5047,6 +5319,83 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 | `status` | `active`    |
 | `status` | `suspended` |
 
+## codersdk.UserActivity
+
+```json
+{
+  "avatar_url": "http://example.com",
+  "seconds": 80500,
+  "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+  "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5",
+  "username": "string"
+}
+```
+
+### Properties
+
+| Name           | Type            | Required | Restrictions | Description |
+| -------------- | --------------- | -------- | ------------ | ----------- |
+| `avatar_url`   | string          | false    |              |             |
+| `seconds`      | integer         | false    |              |             |
+| `template_ids` | array of string | false    |              |             |
+| `user_id`      | string          | false    |              |             |
+| `username`     | string          | false    |              |             |
+
+## codersdk.UserActivityInsightsReport
+
+```json
+{
+  "end_time": "2019-08-24T14:15:22Z",
+  "start_time": "2019-08-24T14:15:22Z",
+  "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+  "users": [
+    {
+      "avatar_url": "http://example.com",
+      "seconds": 80500,
+      "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+      "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5",
+      "username": "string"
+    }
+  ]
+}
+```
+
+### Properties
+
+| Name           | Type                                                    | Required | Restrictions | Description |
+| -------------- | ------------------------------------------------------- | -------- | ------------ | ----------- |
+| `end_time`     | string                                                  | false    |              |             |
+| `start_time`   | string                                                  | false    |              |             |
+| `template_ids` | array of string                                         | false    |              |             |
+| `users`        | array of [codersdk.UserActivity](#codersdkuseractivity) | false    |              |             |
+
+## codersdk.UserActivityInsightsResponse
+
+```json
+{
+  "report": {
+    "end_time": "2019-08-24T14:15:22Z",
+    "start_time": "2019-08-24T14:15:22Z",
+    "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+    "users": [
+      {
+        "avatar_url": "http://example.com",
+        "seconds": 80500,
+        "template_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+        "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5",
+        "username": "string"
+      }
+    ]
+  }
+}
+```
+
+### Properties
+
+| Name     | Type                                                                       | Required | Restrictions | Description |
+| -------- | -------------------------------------------------------------------------- | -------- | ------------ | ----------- |
+| `report` | [codersdk.UserActivityInsightsReport](#codersdkuseractivityinsightsreport) | false    |              |             |
+
 ## codersdk.UserLatency
 
 ```json
@@ -5137,7 +5486,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 
 ```json
 {
-  "login_type": "password"
+  "login_type": ""
 }
 ```
 
@@ -5250,9 +5599,11 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 
 ```json
 {
+  "automatic_updates": "always",
   "autostart_schedule": "string",
   "created_at": "2019-08-24T14:15:22Z",
   "deleting_at": "2019-08-24T14:15:22Z",
+  "dormant_at": "2019-08-24T14:15:22Z",
   "health": {
     "failing_agents": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
     "healthy": false
@@ -5272,7 +5623,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
       "completed_at": "2019-08-24T14:15:22Z",
       "created_at": "2019-08-24T14:15:22Z",
       "error": "string",
-      "error_code": "MISSING_TEMPLATE_PARAMETER",
+      "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "queue_position": 0,
@@ -5307,6 +5658,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
                 "sharing_level": "owner",
                 "slug": "string",
                 "subdomain": true,
+                "subdomain_name": "string",
                 "url": "string"
               }
             ],
@@ -5315,6 +5667,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
             "created_at": "2019-08-24T14:15:22Z",
             "directory": "string",
             "disconnected_at": "2019-08-24T14:15:22Z",
+            "display_apps": ["vscode"],
             "environment_variables": {
               "property1": "string",
               "property2": "string"
@@ -5339,21 +5692,37 @@ If the schedule is empty, the user will be updated to use the default schedule.|
               }
             },
             "lifecycle_state": "created",
-            "login_before_ready": true,
+            "log_sources": [
+              {
+                "created_at": "2019-08-24T14:15:22Z",
+                "display_name": "string",
+                "icon": "string",
+                "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+                "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+              }
+            ],
             "logs_length": 0,
             "logs_overflowed": true,
             "name": "string",
             "operating_system": "string",
             "ready_at": "2019-08-24T14:15:22Z",
             "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-            "shutdown_script": "string",
-            "shutdown_script_timeout_seconds": 0,
+            "scripts": [
+              {
+                "cron": "string",
+                "log_path": "string",
+                "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+                "run_on_start": true,
+                "run_on_stop": true,
+                "script": "string",
+                "start_blocks_login": true,
+                "timeout": 0
+              }
+            ],
             "started_at": "2019-08-24T14:15:22Z",
-            "startup_script": "string",
             "startup_script_behavior": "blocking",
-            "startup_script_timeout_seconds": 0,
             "status": "connecting",
-            "subsystem": "envbox",
+            "subsystems": ["envbox"],
             "troubleshooting_url": "string",
             "updated_at": "2019-08-24T14:15:22Z",
             "version": "string"
@@ -5387,17 +5756,18 @@ If the schedule is empty, the user will be updated to use the default schedule.|
     "workspace_owner_id": "e7078695-5279-4c86-8774-3ac2367a2fc7",
     "workspace_owner_name": "string"
   },
-  "locked_at": "2019-08-24T14:15:22Z",
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
   "outdated": true,
   "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
   "owner_name": "string",
+  "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
   "template_allow_user_cancel_workspace_jobs": true,
   "template_display_name": "string",
   "template_icon": "string",
   "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
   "template_name": "string",
+  "template_require_active_version": true,
   "ttl_ms": 0,
   "updated_at": "2019-08-24T14:15:22Z"
 }
@@ -5405,28 +5775,38 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 
 ### Properties
 
-| Name                                        | Type                                                 | Required | Restrictions | Description                                                                                                                                                                                                                                               |
-| ------------------------------------------- | ---------------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `autostart_schedule`                        | string                                               | false    |              |                                                                                                                                                                                                                                                           |
-| `created_at`                                | string                                               | false    |              |                                                                                                                                                                                                                                                           |
-| `deleting_at`                               | string                                               | false    |              | Deleting at indicates the time of the upcoming workspace deletion, if applicable; otherwise it is nil. Workspaces may have impending deletions if Template.InactivityTTL feature is turned on and the workspace is inactive.                              |
-| `health`                                    | [codersdk.WorkspaceHealth](#codersdkworkspacehealth) | false    |              | Health shows the health of the workspace and information about what is causing an unhealthy status.                                                                                                                                                       |
-| `id`                                        | string                                               | false    |              |                                                                                                                                                                                                                                                           |
-| `last_used_at`                              | string                                               | false    |              |                                                                                                                                                                                                                                                           |
-| `latest_build`                              | [codersdk.WorkspaceBuild](#codersdkworkspacebuild)   | false    |              |                                                                                                                                                                                                                                                           |
-| `locked_at`                                 | string                                               | false    |              | Locked at being non-nil indicates a workspace that has been locked. A locked workspace is no longer accessible by a user and must be unlocked by an admin. It is subject to deletion if it breaches the duration of the locked_ttl field on its template. |
-| `name`                                      | string                                               | false    |              |                                                                                                                                                                                                                                                           |
-| `organization_id`                           | string                                               | false    |              |                                                                                                                                                                                                                                                           |
-| `outdated`                                  | boolean                                              | false    |              |                                                                                                                                                                                                                                                           |
-| `owner_id`                                  | string                                               | false    |              |                                                                                                                                                                                                                                                           |
-| `owner_name`                                | string                                               | false    |              |                                                                                                                                                                                                                                                           |
-| `template_allow_user_cancel_workspace_jobs` | boolean                                              | false    |              |                                                                                                                                                                                                                                                           |
-| `template_display_name`                     | string                                               | false    |              |                                                                                                                                                                                                                                                           |
-| `template_icon`                             | string                                               | false    |              |                                                                                                                                                                                                                                                           |
-| `template_id`                               | string                                               | false    |              |                                                                                                                                                                                                                                                           |
-| `template_name`                             | string                                               | false    |              |                                                                                                                                                                                                                                                           |
-| `ttl_ms`                                    | integer                                              | false    |              |                                                                                                                                                                                                                                                           |
-| `updated_at`                                | string                                               | false    |              |                                                                                                                                                                                                                                                           |
+| Name                                        | Type                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                           |
+| ------------------------------------------- | ------------------------------------------------------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `automatic_updates`                         | [codersdk.AutomaticUpdates](#codersdkautomaticupdates) | false    |              |                                                                                                                                                                                                                                                       |
+| `autostart_schedule`                        | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `created_at`                                | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `deleting_at`                               | string                                                 | false    |              | Deleting at indicates the time at which the workspace will be permanently deleted. A workspace is eligible for deletion if it is dormant (a non-nil dormant_at value) and a value has been specified for time_til_dormant_autodelete on its template. |
+| `dormant_at`                                | string                                                 | false    |              | Dormant at being non-nil indicates a workspace that is dormant. A dormant workspace is no longer accessible must be activated. It is subject to deletion if it breaches the duration of the time*til* field on its template.                          |
+| `health`                                    | [codersdk.WorkspaceHealth](#codersdkworkspacehealth)   | false    |              | Health shows the health of the workspace and information about what is causing an unhealthy status.                                                                                                                                                   |
+| `id`                                        | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `last_used_at`                              | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `latest_build`                              | [codersdk.WorkspaceBuild](#codersdkworkspacebuild)     | false    |              |                                                                                                                                                                                                                                                       |
+| `name`                                      | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `organization_id`                           | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `outdated`                                  | boolean                                                | false    |              |                                                                                                                                                                                                                                                       |
+| `owner_id`                                  | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `owner_name`                                | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `template_active_version_id`                | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `template_allow_user_cancel_workspace_jobs` | boolean                                                | false    |              |                                                                                                                                                                                                                                                       |
+| `template_display_name`                     | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `template_icon`                             | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `template_id`                               | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `template_name`                             | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+| `template_require_active_version`           | boolean                                                | false    |              |                                                                                                                                                                                                                                                       |
+| `ttl_ms`                                    | integer                                                | false    |              |                                                                                                                                                                                                                                                       |
+| `updated_at`                                | string                                                 | false    |              |                                                                                                                                                                                                                                                       |
+
+#### Enumerated Values
+
+| Property            | Value    |
+| ------------------- | -------- |
+| `automatic_updates` | `always` |
+| `automatic_updates` | `never`  |
 
 ## codersdk.WorkspaceAgent
 
@@ -5448,6 +5828,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
       "sharing_level": "owner",
       "slug": "string",
       "subdomain": true,
+      "subdomain_name": "string",
       "url": "string"
     }
   ],
@@ -5456,6 +5837,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
   "created_at": "2019-08-24T14:15:22Z",
   "directory": "string",
   "disconnected_at": "2019-08-24T14:15:22Z",
+  "display_apps": ["vscode"],
   "environment_variables": {
     "property1": "string",
     "property2": "string"
@@ -5480,21 +5862,37 @@ If the schedule is empty, the user will be updated to use the default schedule.|
     }
   },
   "lifecycle_state": "created",
-  "login_before_ready": true,
+  "log_sources": [
+    {
+      "created_at": "2019-08-24T14:15:22Z",
+      "display_name": "string",
+      "icon": "string",
+      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+    }
+  ],
   "logs_length": 0,
   "logs_overflowed": true,
   "name": "string",
   "operating_system": "string",
   "ready_at": "2019-08-24T14:15:22Z",
   "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-  "shutdown_script": "string",
-  "shutdown_script_timeout_seconds": 0,
+  "scripts": [
+    {
+      "cron": "string",
+      "log_path": "string",
+      "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+      "run_on_start": true,
+      "run_on_stop": true,
+      "script": "string",
+      "start_blocks_login": true,
+      "timeout": 0
+    }
+  ],
   "started_at": "2019-08-24T14:15:22Z",
-  "startup_script": "string",
   "startup_script_behavior": "blocking",
-  "startup_script_timeout_seconds": 0,
   "status": "connecting",
-  "subsystem": "envbox",
+  "subsystems": ["envbox"],
   "troubleshooting_url": "string",
   "updated_at": "2019-08-24T14:15:22Z",
   "version": "string"
@@ -5503,49 +5901,54 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 
 ### Properties
 
-| Name                              | Type                                                                                         | Required | Restrictions | Description                                                                                                                                                                                                |
-| --------------------------------- | -------------------------------------------------------------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `apps`                            | array of [codersdk.WorkspaceApp](#codersdkworkspaceapp)                                      | false    |              |                                                                                                                                                                                                            |
-| `architecture`                    | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `connection_timeout_seconds`      | integer                                                                                      | false    |              |                                                                                                                                                                                                            |
-| `created_at`                      | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `directory`                       | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `disconnected_at`                 | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `environment_variables`           | object                                                                                       | false    |              |                                                                                                                                                                                                            |
-| » `[any property]`                | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `expanded_directory`              | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `first_connected_at`              | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `health`                          | [codersdk.WorkspaceAgentHealth](#codersdkworkspaceagenthealth)                               | false    |              | Health reports the health of the agent.                                                                                                                                                                    |
-| `id`                              | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `instance_id`                     | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `last_connected_at`               | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `latency`                         | object                                                                                       | false    |              | Latency is mapped by region name (e.g. "New York City", "Seattle").                                                                                                                                        |
-| » `[any property]`                | [codersdk.DERPRegion](#codersdkderpregion)                                                   | false    |              |                                                                                                                                                                                                            |
-| `lifecycle_state`                 | [codersdk.WorkspaceAgentLifecycle](#codersdkworkspaceagentlifecycle)                         | false    |              |                                                                                                                                                                                                            |
-| `login_before_ready`              | boolean                                                                                      | false    |              | Deprecated: Use StartupScriptBehavior instead.                                                                                                                                                             |
-| `logs_length`                     | integer                                                                                      | false    |              |                                                                                                                                                                                                            |
-| `logs_overflowed`                 | boolean                                                                                      | false    |              |                                                                                                                                                                                                            |
-| `name`                            | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `operating_system`                | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `ready_at`                        | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `resource_id`                     | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `shutdown_script`                 | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `shutdown_script_timeout_seconds` | integer                                                                                      | false    |              |                                                                                                                                                                                                            |
-| `started_at`                      | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `startup_script`                  | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `startup_script_behavior`         | [codersdk.WorkspaceAgentStartupScriptBehavior](#codersdkworkspaceagentstartupscriptbehavior) | false    |              |                                                                                                                                                                                                            |
-| `startup_script_timeout_seconds`  | integer                                                                                      | false    |              | Startup script timeout seconds is the number of seconds to wait for the startup script to complete. If the script does not complete within this time, the agent lifecycle will be marked as start_timeout. |
-| `status`                          | [codersdk.WorkspaceAgentStatus](#codersdkworkspaceagentstatus)                               | false    |              |                                                                                                                                                                                                            |
-| `subsystem`                       | [codersdk.AgentSubsystem](#codersdkagentsubsystem)                                           | false    |              |                                                                                                                                                                                                            |
-| `troubleshooting_url`             | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `updated_at`                      | string                                                                                       | false    |              |                                                                                                                                                                                                            |
-| `version`                         | string                                                                                       | false    |              |                                                                                                                                                                                                            |
+| Name                         | Type                                                                                         | Required | Restrictions | Description                                                                                                                                                                  |
+| ---------------------------- | -------------------------------------------------------------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `apps`                       | array of [codersdk.WorkspaceApp](#codersdkworkspaceapp)                                      | false    |              |                                                                                                                                                                              |
+| `architecture`               | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `connection_timeout_seconds` | integer                                                                                      | false    |              |                                                                                                                                                                              |
+| `created_at`                 | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `directory`                  | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `disconnected_at`            | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `display_apps`               | array of [codersdk.DisplayApp](#codersdkdisplayapp)                                          | false    |              |                                                                                                                                                                              |
+| `environment_variables`      | object                                                                                       | false    |              |                                                                                                                                                                              |
+| » `[any property]`           | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `expanded_directory`         | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `first_connected_at`         | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `health`                     | [codersdk.WorkspaceAgentHealth](#codersdkworkspaceagenthealth)                               | false    |              | Health reports the health of the agent.                                                                                                                                      |
+| `id`                         | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `instance_id`                | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `last_connected_at`          | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `latency`                    | object                                                                                       | false    |              | Latency is mapped by region name (e.g. "New York City", "Seattle").                                                                                                          |
+| » `[any property]`           | [codersdk.DERPRegion](#codersdkderpregion)                                                   | false    |              |                                                                                                                                                                              |
+| `lifecycle_state`            | [codersdk.WorkspaceAgentLifecycle](#codersdkworkspaceagentlifecycle)                         | false    |              |                                                                                                                                                                              |
+| `log_sources`                | array of [codersdk.WorkspaceAgentLogSource](#codersdkworkspaceagentlogsource)                | false    |              |                                                                                                                                                                              |
+| `logs_length`                | integer                                                                                      | false    |              |                                                                                                                                                                              |
+| `logs_overflowed`            | boolean                                                                                      | false    |              |                                                                                                                                                                              |
+| `name`                       | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `operating_system`           | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `ready_at`                   | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `resource_id`                | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `scripts`                    | array of [codersdk.WorkspaceAgentScript](#codersdkworkspaceagentscript)                      | false    |              |                                                                                                                                                                              |
+| `started_at`                 | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `startup_script_behavior`    | [codersdk.WorkspaceAgentStartupScriptBehavior](#codersdkworkspaceagentstartupscriptbehavior) | false    |              | Startup script behavior is a legacy field that is deprecated in favor of the `coder_script` resource. It's only referenced by old clients. Deprecated: Remove in the future! |
+| `status`                     | [codersdk.WorkspaceAgentStatus](#codersdkworkspaceagentstatus)                               | false    |              |                                                                                                                                                                              |
+| `subsystems`                 | array of [codersdk.AgentSubsystem](#codersdkagentsubsystem)                                  | false    |              |                                                                                                                                                                              |
+| `troubleshooting_url`        | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `updated_at`                 | string                                                                                       | false    |              |                                                                                                                                                                              |
+| `version`                    | string                                                                                       | false    |              |                                                                                                                                                                              |
 
 ## codersdk.WorkspaceAgentConnectionInfo
 
 ```json
 {
+  "derp_force_websockets": true,
   "derp_map": {
+    "homeParams": {
+      "regionScore": {
+        "property1": 0,
+        "property2": 0
+      }
+    },
     "omitDefaultRegions": true,
     "regions": {
       "property1": {
@@ -5553,6 +5956,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
         "embeddedRelay": true,
         "nodes": [
           {
+            "canPort80": true,
             "certName": "string",
             "derpport": 0,
             "forceHTTP": true,
@@ -5576,6 +5980,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
         "embeddedRelay": true,
         "nodes": [
           {
+            "canPort80": true,
             "certName": "string",
             "derpport": 0,
             "forceHTTP": true,
@@ -5604,6 +6009,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 
 | Name                         | Type                               | Required | Restrictions | Description |
 | ---------------------------- | ---------------------------------- | -------- | ------------ | ----------- |
+| `derp_force_websockets`      | boolean                            | false    |              |             |
 | `derp_map`                   | [tailcfg.DERPMap](#tailcfgderpmap) | false    |              |             |
 | `disable_direct_connections` | boolean                            | false    |              |             |
 
@@ -5690,7 +6096,8 @@ If the schedule is empty, the user will be updated to use the default schedule.|
   "created_at": "2019-08-24T14:15:22Z",
   "id": 0,
   "level": "trace",
-  "output": "string"
+  "output": "string",
+  "source_id": "ae50a35c-df42-4eff-ba26-f8bc28d2af81"
 }
 ```
 
@@ -5702,25 +6109,29 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 | `id`         | integer                                | false    |              |             |
 | `level`      | [codersdk.LogLevel](#codersdkloglevel) | false    |              |             |
 | `output`     | string                                 | false    |              |             |
+| `source_id`  | string                                 | false    |              |             |
 
 ## codersdk.WorkspaceAgentLogSource
 
 ```json
-"startup_script"
+{
+  "created_at": "2019-08-24T14:15:22Z",
+  "display_name": "string",
+  "icon": "string",
+  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+  "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+}
 ```
 
 ### Properties
 
-#### Enumerated Values
-
-| Value             |
-| ----------------- |
-| `startup_script`  |
-| `shutdown_script` |
-| `kubernetes`      |
-| `envbox`          |
-| `envbuilder`      |
-| `external`        |
+| Name                 | Type   | Required | Restrictions | Description |
+| -------------------- | ------ | -------- | ------------ | ----------- |
+| `created_at`         | string | false    |              |             |
+| `display_name`       | string | false    |              |             |
+| `icon`               | string | false    |              |             |
+| `id`                 | string | false    |              |             |
+| `workspace_agent_id` | string | false    |              |             |
 
 ## codersdk.WorkspaceAgentMetadataDescription
 
@@ -5744,6 +6155,34 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 | `script`       | string  | false    |              |             |
 | `timeout`      | integer | false    |              |             |
 
+## codersdk.WorkspaceAgentScript
+
+```json
+{
+  "cron": "string",
+  "log_path": "string",
+  "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+  "run_on_start": true,
+  "run_on_stop": true,
+  "script": "string",
+  "start_blocks_login": true,
+  "timeout": 0
+}
+```
+
+### Properties
+
+| Name                 | Type    | Required | Restrictions | Description |
+| -------------------- | ------- | -------- | ------------ | ----------- |
+| `cron`               | string  | false    |              |             |
+| `log_path`           | string  | false    |              |             |
+| `log_source_id`      | string  | false    |              |             |
+| `run_on_start`       | boolean | false    |              |             |
+| `run_on_stop`        | boolean | false    |              |             |
+| `script`             | string  | false    |              |             |
+| `start_blocks_login` | boolean | false    |              |             |
+| `timeout`            | integer | false    |              |             |
+
 ## codersdk.WorkspaceAgentStartupScriptBehavior
 
 ```json
@@ -5794,25 +6233,27 @@ If the schedule is empty, the user will be updated to use the default schedule.|
   "sharing_level": "owner",
   "slug": "string",
   "subdomain": true,
+  "subdomain_name": "string",
   "url": "string"
 }
 ```
 
 ### Properties
 
-| Name            | Type                                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                    |
-| --------------- | ---------------------------------------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `command`       | string                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `display_name`  | string                                                                 | false    |              | Display name is a friendly name for the app.                                                                                                                                                                                                   |
-| `external`      | boolean                                                                | false    |              | External specifies whether the URL should be opened externally on the client or not.                                                                                                                                                           |
-| `health`        | [codersdk.WorkspaceAppHealth](#codersdkworkspaceapphealth)             | false    |              |                                                                                                                                                                                                                                                |
-| `healthcheck`   | [codersdk.Healthcheck](#codersdkhealthcheck)                           | false    |              | Healthcheck specifies the configuration for checking app health.                                                                                                                                                                               |
-| `icon`          | string                                                                 | false    |              | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard.                                                                                                                                               |
-| `id`            | string                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `sharing_level` | [codersdk.WorkspaceAppSharingLevel](#codersdkworkspaceappsharinglevel) | false    |              |                                                                                                                                                                                                                                                |
-| `slug`          | string                                                                 | false    |              | Slug is a unique identifier within the agent.                                                                                                                                                                                                  |
-| `subdomain`     | boolean                                                                | false    |              | Subdomain denotes whether the app should be accessed via a path on the `coder server` or via a hostname-based dev URL. If this is set to true and there is no app wildcard configured on the server, the app will not be accessible in the UI. |
-| `url`           | string                                                                 | false    |              | URL is the address being proxied to inside the workspace. If external is specified, this will be opened on the client.                                                                                                                         |
+| Name             | Type                                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                    |
+| ---------------- | ---------------------------------------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `command`        | string                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `display_name`   | string                                                                 | false    |              | Display name is a friendly name for the app.                                                                                                                                                                                                   |
+| `external`       | boolean                                                                | false    |              | External specifies whether the URL should be opened externally on the client or not.                                                                                                                                                           |
+| `health`         | [codersdk.WorkspaceAppHealth](#codersdkworkspaceapphealth)             | false    |              |                                                                                                                                                                                                                                                |
+| `healthcheck`    | [codersdk.Healthcheck](#codersdkhealthcheck)                           | false    |              | Healthcheck specifies the configuration for checking app health.                                                                                                                                                                               |
+| `icon`           | string                                                                 | false    |              | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard.                                                                                                                                               |
+| `id`             | string                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `sharing_level`  | [codersdk.WorkspaceAppSharingLevel](#codersdkworkspaceappsharinglevel) | false    |              |                                                                                                                                                                                                                                                |
+| `slug`           | string                                                                 | false    |              | Slug is a unique identifier within the agent.                                                                                                                                                                                                  |
+| `subdomain`      | boolean                                                                | false    |              | Subdomain denotes whether the app should be accessed via a path on the `coder server` or via a hostname-based dev URL. If this is set to true and there is no app wildcard configured on the server, the app will not be accessible in the UI. |
+| `subdomain_name` | string                                                                 | false    |              | Subdomain name is the application domain exposed on the `coder server`.                                                                                                                                                                        |
+| `url`            | string                                                                 | false    |              | URL is the address being proxied to inside the workspace. If external is specified, this will be opened on the client.                                                                                                                         |
 
 #### Enumerated Values
 
@@ -5871,7 +6312,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
     "completed_at": "2019-08-24T14:15:22Z",
     "created_at": "2019-08-24T14:15:22Z",
     "error": "string",
-    "error_code": "MISSING_TEMPLATE_PARAMETER",
+    "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "queue_position": 0,
@@ -5906,6 +6347,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
               "sharing_level": "owner",
               "slug": "string",
               "subdomain": true,
+              "subdomain_name": "string",
               "url": "string"
             }
           ],
@@ -5914,6 +6356,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
           "created_at": "2019-08-24T14:15:22Z",
           "directory": "string",
           "disconnected_at": "2019-08-24T14:15:22Z",
+          "display_apps": ["vscode"],
           "environment_variables": {
             "property1": "string",
             "property2": "string"
@@ -5938,21 +6381,37 @@ If the schedule is empty, the user will be updated to use the default schedule.|
             }
           },
           "lifecycle_state": "created",
-          "login_before_ready": true,
+          "log_sources": [
+            {
+              "created_at": "2019-08-24T14:15:22Z",
+              "display_name": "string",
+              "icon": "string",
+              "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+              "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+            }
+          ],
           "logs_length": 0,
           "logs_overflowed": true,
           "name": "string",
           "operating_system": "string",
           "ready_at": "2019-08-24T14:15:22Z",
           "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-          "shutdown_script": "string",
-          "shutdown_script_timeout_seconds": 0,
+          "scripts": [
+            {
+              "cron": "string",
+              "log_path": "string",
+              "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+              "run_on_start": true,
+              "run_on_stop": true,
+              "script": "string",
+              "start_blocks_login": true,
+              "timeout": 0
+            }
+          ],
           "started_at": "2019-08-24T14:15:22Z",
-          "startup_script": "string",
           "startup_script_behavior": "blocking",
-          "startup_script_timeout_seconds": 0,
           "status": "connecting",
-          "subsystem": "envbox",
+          "subsystems": ["envbox"],
           "troubleshooting_url": "string",
           "updated_at": "2019-08-24T14:15:22Z",
           "version": "string"
@@ -6217,6 +6676,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
           "sharing_level": "owner",
           "slug": "string",
           "subdomain": true,
+          "subdomain_name": "string",
           "url": "string"
         }
       ],
@@ -6225,6 +6685,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
       "created_at": "2019-08-24T14:15:22Z",
       "directory": "string",
       "disconnected_at": "2019-08-24T14:15:22Z",
+      "display_apps": ["vscode"],
       "environment_variables": {
         "property1": "string",
         "property2": "string"
@@ -6249,21 +6710,37 @@ If the schedule is empty, the user will be updated to use the default schedule.|
         }
       },
       "lifecycle_state": "created",
-      "login_before_ready": true,
+      "log_sources": [
+        {
+          "created_at": "2019-08-24T14:15:22Z",
+          "display_name": "string",
+          "icon": "string",
+          "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+          "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+        }
+      ],
       "logs_length": 0,
       "logs_overflowed": true,
       "name": "string",
       "operating_system": "string",
       "ready_at": "2019-08-24T14:15:22Z",
       "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-      "shutdown_script": "string",
-      "shutdown_script_timeout_seconds": 0,
+      "scripts": [
+        {
+          "cron": "string",
+          "log_path": "string",
+          "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+          "run_on_start": true,
+          "run_on_stop": true,
+          "script": "string",
+          "start_blocks_login": true,
+          "timeout": 0
+        }
+      ],
       "started_at": "2019-08-24T14:15:22Z",
-      "startup_script": "string",
       "startup_script_behavior": "blocking",
-      "startup_script_timeout_seconds": 0,
       "status": "connecting",
-      "subsystem": "envbox",
+      "subsystems": ["envbox"],
       "troubleshooting_url": "string",
       "updated_at": "2019-08-24T14:15:22Z",
       "version": "string"
@@ -6376,9 +6853,11 @@ If the schedule is empty, the user will be updated to use the default schedule.|
   "count": 0,
   "workspaces": [
     {
+      "automatic_updates": "always",
       "autostart_schedule": "string",
       "created_at": "2019-08-24T14:15:22Z",
       "deleting_at": "2019-08-24T14:15:22Z",
+      "dormant_at": "2019-08-24T14:15:22Z",
       "health": {
         "failing_agents": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
         "healthy": false
@@ -6398,7 +6877,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
           "completed_at": "2019-08-24T14:15:22Z",
           "created_at": "2019-08-24T14:15:22Z",
           "error": "string",
-          "error_code": "MISSING_TEMPLATE_PARAMETER",
+          "error_code": "REQUIRED_TEMPLATE_VARIABLES",
           "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
           "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
           "queue_position": 0,
@@ -6429,6 +6908,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
                     "sharing_level": "owner",
                     "slug": "string",
                     "subdomain": true,
+                    "subdomain_name": "string",
                     "url": "string"
                   }
                 ],
@@ -6437,6 +6917,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
                 "created_at": "2019-08-24T14:15:22Z",
                 "directory": "string",
                 "disconnected_at": "2019-08-24T14:15:22Z",
+                "display_apps": ["vscode"],
                 "environment_variables": {
                   "property1": "string",
                   "property2": "string"
@@ -6461,21 +6942,37 @@ If the schedule is empty, the user will be updated to use the default schedule.|
                   }
                 },
                 "lifecycle_state": "created",
-                "login_before_ready": true,
+                "log_sources": [
+                  {
+                    "created_at": "2019-08-24T14:15:22Z",
+                    "display_name": "string",
+                    "icon": "string",
+                    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+                    "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+                  }
+                ],
                 "logs_length": 0,
                 "logs_overflowed": true,
                 "name": "string",
                 "operating_system": "string",
                 "ready_at": "2019-08-24T14:15:22Z",
                 "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-                "shutdown_script": "string",
-                "shutdown_script_timeout_seconds": 0,
+                "scripts": [
+                  {
+                    "cron": "string",
+                    "log_path": "string",
+                    "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+                    "run_on_start": true,
+                    "run_on_stop": true,
+                    "script": "string",
+                    "start_blocks_login": true,
+                    "timeout": 0
+                  }
+                ],
                 "started_at": "2019-08-24T14:15:22Z",
-                "startup_script": "string",
                 "startup_script_behavior": "blocking",
-                "startup_script_timeout_seconds": 0,
                 "status": "connecting",
-                "subsystem": "envbox",
+                "subsystems": ["envbox"],
                 "troubleshooting_url": "string",
                 "updated_at": "2019-08-24T14:15:22Z",
                 "version": "string"
@@ -6509,17 +7006,18 @@ If the schedule is empty, the user will be updated to use the default schedule.|
         "workspace_owner_id": "e7078695-5279-4c86-8774-3ac2367a2fc7",
         "workspace_owner_name": "string"
       },
-      "locked_at": "2019-08-24T14:15:22Z",
       "name": "string",
       "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
       "outdated": true,
       "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
       "owner_name": "string",
+      "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
       "template_allow_user_cancel_workspace_jobs": true,
       "template_display_name": "string",
       "template_icon": "string",
       "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
       "template_name": "string",
+      "template_require_active_version": true,
       "ttl_ms": 0,
       "updated_at": "2019-08-24T14:15:22Z"
     }
@@ -6552,31 +7050,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 | `tokenBucketBytesPerSecond`                                                                | integer | false    |              | Tokenbucketbytespersecond is how many bytes per second the server says it will accept, including all framing bytes.      |
 | Zero means unspecified. There might be a limit, but the client need not try to respect it. |
 
-## healthcheck.AccessURLReport
-
-```json
-{
-  "access_url": "string",
-  "error": "string",
-  "healthy": true,
-  "healthz_response": "string",
-  "reachable": true,
-  "status_code": 0
-}
-```
-
-### Properties
-
-| Name               | Type    | Required | Restrictions | Description |
-| ------------------ | ------- | -------- | ------------ | ----------- |
-| `access_url`       | string  | false    |              |             |
-| `error`            | string  | false    |              |             |
-| `healthy`          | boolean | false    |              |             |
-| `healthz_response` | string  | false    |              |             |
-| `reachable`        | boolean | false    |              |             |
-| `status_code`      | integer | false    |              |             |
-
-## healthcheck.DERPNodeReport
+## derphealth.NodeReport
 
 ```json
 {
@@ -6586,6 +7060,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
   "error": "string",
   "healthy": true,
   "node": {
+    "canPort80": true,
     "certName": "string",
     "derpport": 0,
     "forceHTTP": true,
@@ -6616,21 +7091,21 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 
 ### Properties
 
-| Name                    | Type                                                     | Required | Restrictions | Description |
-| ----------------------- | -------------------------------------------------------- | -------- | ------------ | ----------- |
-| `can_exchange_messages` | boolean                                                  | false    |              |             |
-| `client_errs`           | array of array                                           | false    |              |             |
-| `client_logs`           | array of array                                           | false    |              |             |
-| `error`                 | string                                                   | false    |              |             |
-| `healthy`               | boolean                                                  | false    |              |             |
-| `node`                  | [tailcfg.DERPNode](#tailcfgderpnode)                     | false    |              |             |
-| `node_info`             | [derp.ServerInfoMessage](#derpserverinfomessage)         | false    |              |             |
-| `round_trip_ping`       | string                                                   | false    |              |             |
-| `round_trip_ping_ms`    | integer                                                  | false    |              |             |
-| `stun`                  | [healthcheck.DERPStunReport](#healthcheckderpstunreport) | false    |              |             |
-| `uses_websocket`        | boolean                                                  | false    |              |             |
+| Name                    | Type                                             | Required | Restrictions | Description |
+| ----------------------- | ------------------------------------------------ | -------- | ------------ | ----------- |
+| `can_exchange_messages` | boolean                                          | false    |              |             |
+| `client_errs`           | array of array                                   | false    |              |             |
+| `client_logs`           | array of array                                   | false    |              |             |
+| `error`                 | string                                           | false    |              |             |
+| `healthy`               | boolean                                          | false    |              |             |
+| `node`                  | [tailcfg.DERPNode](#tailcfgderpnode)             | false    |              |             |
+| `node_info`             | [derp.ServerInfoMessage](#derpserverinfomessage) | false    |              |             |
+| `round_trip_ping`       | string                                           | false    |              |             |
+| `round_trip_ping_ms`    | integer                                          | false    |              |             |
+| `stun`                  | [derphealth.StunReport](#derphealthstunreport)   | false    |              |             |
+| `uses_websocket`        | boolean                                          | false    |              |             |
 
-## healthcheck.DERPRegionReport
+## derphealth.RegionReport
 
 ```json
 {
@@ -6644,6 +7119,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
       "error": "string",
       "healthy": true,
       "node": {
+        "canPort80": true,
         "certName": "string",
         "derpport": 0,
         "forceHTTP": true,
@@ -6676,6 +7152,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
     "embeddedRelay": true,
     "nodes": [
       {
+        "canPort80": true,
         "certName": "string",
         "derpport": 0,
         "forceHTTP": true,
@@ -6699,14 +7176,14 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 
 ### Properties
 
-| Name           | Type                                                              | Required | Restrictions | Description |
-| -------------- | ----------------------------------------------------------------- | -------- | ------------ | ----------- |
-| `error`        | string                                                            | false    |              |             |
-| `healthy`      | boolean                                                           | false    |              |             |
-| `node_reports` | array of [healthcheck.DERPNodeReport](#healthcheckderpnodereport) | false    |              |             |
-| `region`       | [tailcfg.DERPRegion](#tailcfgderpregion)                          | false    |              |             |
+| Name           | Type                                                    | Required | Restrictions | Description |
+| -------------- | ------------------------------------------------------- | -------- | ------------ | ----------- |
+| `error`        | string                                                  | false    |              |             |
+| `healthy`      | boolean                                                 | false    |              |             |
+| `node_reports` | array of [derphealth.NodeReport](#derphealthnodereport) | false    |              |             |
+| `region`       | [tailcfg.DERPRegion](#tailcfgderpregion)                | false    |              |             |
 
-## healthcheck.DERPReport
+## derphealth.Report
 
 ```json
 {
@@ -6756,6 +7233,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
           "error": "string",
           "healthy": true,
           "node": {
+            "canPort80": true,
             "certName": "string",
             "derpport": 0,
             "forceHTTP": true,
@@ -6788,6 +7266,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
         "embeddedRelay": true,
         "nodes": [
           {
+            "canPort80": true,
             "certName": "string",
             "derpport": 0,
             "forceHTTP": true,
@@ -6818,6 +7297,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
           "error": "string",
           "healthy": true,
           "node": {
+            "canPort80": true,
             "certName": "string",
             "derpport": 0,
             "forceHTTP": true,
@@ -6850,6 +7330,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
         "embeddedRelay": true,
         "nodes": [
           {
+            "canPort80": true,
             "certName": "string",
             "derpport": 0,
             "forceHTTP": true,
@@ -6875,17 +7356,17 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 
 ### Properties
 
-| Name               | Type                                                         | Required | Restrictions | Description |
-| ------------------ | ------------------------------------------------------------ | -------- | ------------ | ----------- |
-| `error`            | string                                                       | false    |              |             |
-| `healthy`          | boolean                                                      | false    |              |             |
-| `netcheck`         | [netcheck.Report](#netcheckreport)                           | false    |              |             |
-| `netcheck_err`     | string                                                       | false    |              |             |
-| `netcheck_logs`    | array of string                                              | false    |              |             |
-| `regions`          | object                                                       | false    |              |             |
-| » `[any property]` | [healthcheck.DERPRegionReport](#healthcheckderpregionreport) | false    |              |             |
+| Name               | Type                                               | Required | Restrictions | Description |
+| ------------------ | -------------------------------------------------- | -------- | ------------ | ----------- |
+| `error`            | string                                             | false    |              |             |
+| `healthy`          | boolean                                            | false    |              |             |
+| `netcheck`         | [netcheck.Report](#netcheckreport)                 | false    |              |             |
+| `netcheck_err`     | string                                             | false    |              |             |
+| `netcheck_logs`    | array of string                                    | false    |              |             |
+| `regions`          | object                                             | false    |              |             |
+| » `[any property]` | [derphealth.RegionReport](#derphealthregionreport) | false    |              |             |
 
-## healthcheck.DERPStunReport
+## derphealth.StunReport
 
 ```json
 {
@@ -6903,6 +7384,30 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 | `enabled` | boolean | false    |              |             |
 | `error`   | string  | false    |              |             |
 
+## healthcheck.AccessURLReport
+
+```json
+{
+  "access_url": "string",
+  "error": "string",
+  "healthy": true,
+  "healthz_response": "string",
+  "reachable": true,
+  "status_code": 0
+}
+```
+
+### Properties
+
+| Name               | Type    | Required | Restrictions | Description |
+| ------------------ | ------- | -------- | ------------ | ----------- |
+| `access_url`       | string  | false    |              |             |
+| `error`            | string  | false    |              |             |
+| `healthy`          | boolean | false    |              |             |
+| `healthz_response` | string  | false    |              |             |
+| `reachable`        | boolean | false    |              |             |
+| `status_code`      | integer | false    |              |             |
+
 ## healthcheck.DatabaseReport
 
 ```json
@@ -6992,6 +7497,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
             "error": "string",
             "healthy": true,
             "node": {
+              "canPort80": true,
               "certName": "string",
               "derpport": 0,
               "forceHTTP": true,
@@ -7024,6 +7530,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
           "embeddedRelay": true,
           "nodes": [
             {
+              "canPort80": true,
               "certName": "string",
               "derpport": 0,
               "forceHTTP": true,
@@ -7054,6 +7561,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
             "error": "string",
             "healthy": true,
             "node": {
+              "canPort80": true,
               "certName": "string",
               "derpport": 0,
               "forceHTTP": true,
@@ -7086,6 +7594,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
           "embeddedRelay": true,
           "nodes": [
             {
+              "canPort80": true,
               "certName": "string",
               "derpport": 0,
               "forceHTTP": true,
@@ -7126,7 +7635,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 | `access_url`       | [healthcheck.AccessURLReport](#healthcheckaccessurlreport) | false    |              |                                                                            |
 | `coder_version`    | string                                                     | false    |              | The Coder version of the server that the report was generated on.          |
 | `database`         | [healthcheck.DatabaseReport](#healthcheckdatabasereport)   | false    |              |                                                                            |
-| `derp`             | [healthcheck.DERPReport](#healthcheckderpreport)           | false    |              |                                                                            |
+| `derp`             | [derphealth.Report](#derphealthreport)                     | false    |              |                                                                            |
 | `failing_sections` | array of string                                            | false    |              | Failing sections is a list of sections that have failed their healthcheck. |
 | `healthy`          | boolean                                                    | false    |              | Healthy is true if the report returns no errors.                           |
 | `time`             | string                                                     | false    |              | Time is the time the report was generated at.                              |
@@ -7230,10 +7739,38 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 | `time`  | string  | false    |              |                                   |
 | `valid` | boolean | false    |              | Valid is true if Time is not NULL |
 
+## tailcfg.DERPHomeParams
+
+```json
+{
+  "regionScore": {
+    "property1": 0,
+    "property2": 0
+  }
+}
+```
+
+### Properties
+
+| Name          | Type   | Required | Restrictions | Description                                                                                                                                                                                                                                                                               |
+| ------------- | ------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `regionScore` | object | false    |              | Regionscore scales latencies of DERP regions by a given scaling factor when determining which region to use as the home ("preferred") DERP. Scores in the range (0, 1) will cause this region to be proportionally more preferred, and scores in the range (1, ∞) will penalize a region. |
+
+If a region is not present in this map, it is treated as having a score of 1.0.
+Scores should not be 0 or negative; such scores will be ignored.
+A nil map means no change from the previous value (if any); an empty non-nil map can be sent to reset all scores back to 1.0.|
+|» `[any property]`|number|false|||
+
 ## tailcfg.DERPMap
 
 ```json
 {
+  "homeParams": {
+    "regionScore": {
+      "property1": 0,
+      "property2": 0
+    }
+  },
   "omitDefaultRegions": true,
   "regions": {
     "property1": {
@@ -7241,6 +7778,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
       "embeddedRelay": true,
       "nodes": [
         {
+          "canPort80": true,
           "certName": "string",
           "derpport": 0,
           "forceHTTP": true,
@@ -7264,6 +7802,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
       "embeddedRelay": true,
       "nodes": [
         {
+          "canPort80": true,
           "certName": "string",
           "derpport": 0,
           "forceHTTP": true,
@@ -7288,10 +7827,13 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 
 ### Properties
 
-| Name                 | Type    | Required | Restrictions | Description                                                                                                                                                                    |
-| -------------------- | ------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `omitDefaultRegions` | boolean | false    |              | Omitdefaultregions specifies to not use Tailscale's DERP servers, and only use those specified in this DERPMap. If there are none set outside of the defaults, this is a noop. |
-| `regions`            | object  | false    |              | Regions is the set of geographic regions running DERP node(s).                                                                                                                 |
+| Name                                                                               | Type                                             | Required | Restrictions | Description                                                                                                                                                                    |
+| ---------------------------------------------------------------------------------- | ------------------------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `homeParams`                                                                       | [tailcfg.DERPHomeParams](#tailcfgderphomeparams) | false    |              | Homeparams if non-nil, is a change in home parameters.                                                                                                                         |
+| The rest of the DEPRMap fields, if zero, means unchanged.                          |
+| `omitDefaultRegions`                                                               | boolean                                          | false    |              | Omitdefaultregions specifies to not use Tailscale's DERP servers, and only use those specified in this DERPMap. If there are none set outside of the defaults, this is a noop. |
+| This field is only meaningful if the Regions map is non-nil (indicating a change). |
+| `regions`                                                                          | object                                           | false    |              | Regions is the set of geographic regions running DERP node(s).                                                                                                                 |
 
 It's keyed by the DERPRegion.RegionID.
 The numbers are not necessarily contiguous.|
@@ -7301,6 +7843,7 @@ The numbers are not necessarily contiguous.|
 
 ```json
 {
+  "canPort80": true,
   "certName": "string",
   "derpport": 0,
   "forceHTTP": true,
@@ -7320,6 +7863,7 @@ The numbers are not necessarily contiguous.|
 
 | Name                                                                                                                  | Type    | Required | Restrictions | Description                                                                                                                                                                                                                                                       |
 | --------------------------------------------------------------------------------------------------------------------- | ------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `canPort80`                                                                                                           | boolean | false    |              | Canport80 specifies whether this DERP node is accessible over HTTP on port 80 specifically. This is used for captive portal checks.                                                                                                                               |
 | `certName`                                                                                                            | string  | false    |              | Certname optionally specifies the expected TLS cert common name. If empty, HostName is used. If CertName is non-empty, HostName is only used for the TCP dial (if IPv4/IPv6 are not present) + TLS ClientHello.                                                   |
 | `derpport`                                                                                                            | integer | false    |              | Derpport optionally provides an alternate TLS port number for the DERP HTTPS server.                                                                                                                                                                              |
 | If zero, 443 is used.                                                                                                 |
@@ -7343,6 +7887,7 @@ The numbers are not necessarily contiguous.|
   "embeddedRelay": true,
   "nodes": [
     {
+      "canPort80": true,
       "certName": "string",
       "derpport": 0,
       "forceHTTP": true,
@@ -7415,6 +7960,7 @@ _None_
   "app_request": {
     "access_method": "path",
     "agent_name_or_id": "string",
+    "app_prefix": "string",
     "app_slug_or_port": "string",
     "base_path": "string",
     "username_or_id": "string",
@@ -7442,6 +7988,7 @@ _None_
 {
   "access_method": "path",
   "agent_name_or_id": "string",
+  "app_prefix": "string",
   "app_slug_or_port": "string",
   "base_path": "string",
   "username_or_id": "string",
@@ -7455,11 +8002,42 @@ _None_
 | ---------------------- | -------------------------------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `access_method`        | [workspaceapps.AccessMethod](#workspaceappsaccessmethod) | false    |              |                                                                                                                                                                                       |
 | `agent_name_or_id`     | string                                                   | false    |              | Agent name or ID is not required if the workspace has only one agent.                                                                                                                 |
+| `app_prefix`           | string                                                   | false    |              | Prefix is the prefix of the subdomain app URL. Prefix should have a trailing "---" if set.                                                                                            |
 | `app_slug_or_port`     | string                                                   | false    |              |                                                                                                                                                                                       |
 | `base_path`            | string                                                   | false    |              | Base path of the app. For path apps, this is the path prefix in the router for this particular app. For subdomain apps, this should be "/". This is used for setting the cookie path. |
 | `username_or_id`       | string                                                   | false    |              | For the following fields, if the AccessMethod is AccessMethodTerminal, then only AgentNameOrID may be set and it must be a UUID. The other fields must be left blank.                 |
 | `workspace_name_or_id` | string                                                   | false    |              |                                                                                                                                                                                       |
 
+## workspaceapps.StatsReport
+
+```json
+{
+  "access_method": "path",
+  "agent_id": "string",
+  "requests": 0,
+  "session_ended_at": "string",
+  "session_id": "string",
+  "session_started_at": "string",
+  "slug_or_port": "string",
+  "user_id": "string",
+  "workspace_id": "string"
+}
+```
+
+### Properties
+
+| Name                 | Type                                                     | Required | Restrictions | Description                                                                             |
+| -------------------- | -------------------------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------- |
+| `access_method`      | [workspaceapps.AccessMethod](#workspaceappsaccessmethod) | false    |              |                                                                                         |
+| `agent_id`           | string                                                   | false    |              |                                                                                         |
+| `requests`           | integer                                                  | false    |              |                                                                                         |
+| `session_ended_at`   | string                                                   | false    |              | Updated periodically while app is in use active and when the last connection is closed. |
+| `session_id`         | string                                                   | false    |              |                                                                                         |
+| `session_started_at` | string                                                   | false    |              |                                                                                         |
+| `slug_or_port`       | string                                                   | false    |              |                                                                                         |
+| `user_id`            | string                                                   | false    |              |                                                                                         |
+| `workspace_id`       | string                                                   | false    |              |                                                                                         |
+
 ## wsproxysdk.AgentIsLegacyResponse
 
 ```json
@@ -7540,6 +8118,66 @@ _None_
 ```json
 {
   "app_security_key": "string",
+  "derp_force_websockets": true,
+  "derp_map": {
+    "homeParams": {
+      "regionScore": {
+        "property1": 0,
+        "property2": 0
+      }
+    },
+    "omitDefaultRegions": true,
+    "regions": {
+      "property1": {
+        "avoid": true,
+        "embeddedRelay": true,
+        "nodes": [
+          {
+            "canPort80": true,
+            "certName": "string",
+            "derpport": 0,
+            "forceHTTP": true,
+            "hostName": "string",
+            "insecureForTests": true,
+            "ipv4": "string",
+            "ipv6": "string",
+            "name": "string",
+            "regionID": 0,
+            "stunonly": true,
+            "stunport": 0,
+            "stuntestIP": "string"
+          }
+        ],
+        "regionCode": "string",
+        "regionID": 0,
+        "regionName": "string"
+      },
+      "property2": {
+        "avoid": true,
+        "embeddedRelay": true,
+        "nodes": [
+          {
+            "canPort80": true,
+            "certName": "string",
+            "derpport": 0,
+            "forceHTTP": true,
+            "hostName": "string",
+            "insecureForTests": true,
+            "ipv4": "string",
+            "ipv6": "string",
+            "name": "string",
+            "regionID": 0,
+            "stunonly": true,
+            "stunport": 0,
+            "stuntestIP": "string"
+          }
+        ],
+        "regionCode": "string",
+        "regionID": 0,
+        "regionName": "string"
+      }
+    }
+  },
   "derp_mesh_key": "string",
   "derp_region_id": 0,
   "sibling_replicas": [
@@ -7558,9 +8196,37 @@ _None_
 
 ### Properties
 
-| Name               | Type                                          | Required | Restrictions | Description                                                                            |
-| ------------------ | --------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------- |
-| `app_security_key` | string                                        | false    |              |                                                                                        |
-| `derp_mesh_key`    | string                                        | false    |              |                                                                                        |
-| `derp_region_id`   | integer                                       | false    |              |                                                                                        |
-| `sibling_replicas` | array of [codersdk.Replica](#codersdkreplica) | false    |              | Sibling replicas is a list of all other replicas of the proxy that have not timed out. |
+| Name                    | Type                                          | Required | Restrictions | Description                                                                            |
+| ----------------------- | --------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------- |
+| `app_security_key`      | string                                        | false    |              |                                                                                        |
+| `derp_force_websockets` | boolean                                       | false    |              |                                                                                        |
+| `derp_map`              | [tailcfg.DERPMap](#tailcfgderpmap)            | false    |              |                                                                                        |
+| `derp_mesh_key`         | string                                        | false    |              |                                                                                        |
+| `derp_region_id`        | integer                                       | false    |              |                                                                                        |
+| `sibling_replicas`      | array of [codersdk.Replica](#codersdkreplica) | false    |              | Sibling replicas is a list of all other replicas of the proxy that have not timed out. |
+
+## wsproxysdk.ReportAppStatsRequest
+
+```json
+{
+  "stats": [
+    {
+      "access_method": "path",
+      "agent_id": "string",
+      "requests": 0,
+      "session_ended_at": "string",
+      "session_id": "string",
+      "session_started_at": "string",
+      "slug_or_port": "string",
+      "user_id": "string",
+      "workspace_id": "string"
+    }
+  ]
+}
+```
+
+### Properties
+
+| Name    | Type                                                            | Required | Restrictions | Description |
+| ------- | --------------------------------------------------------------- | -------- | ------------ | ----------- |
+| `stats` | array of [workspaceapps.StatsReport](#workspaceappsstatsreport) | false    |              |             |
diff --git a/docs/api/templates.md b/docs/api/templates.md
index f8a1612161f81..08de540e2a7f2 100644
--- a/docs/api/templates.md
+++ b/docs/api/templates.md
@@ -31,6 +31,13 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
     "allow_user_autostart": true,
     "allow_user_autostop": true,
     "allow_user_cancel_workspace_jobs": true,
+    "autostart_requirement": {
+      "days_of_week": ["monday"]
+    },
+    "autostop_requirement": {
+      "days_of_week": ["monday"],
+      "weeks": 0
+    },
     "build_time_stats": {
       "property1": {
         "p50": 123,
@@ -50,16 +57,13 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
     "failure_ttl_ms": 0,
     "icon": "string",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
-    "inactivity_ttl_ms": 0,
-    "locked_ttl_ms": 0,
     "max_ttl_ms": 0,
     "name": "string",
     "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
     "provisioner": "terraform",
-    "restart_requirement": {
-      "days_of_week": ["monday"],
-      "weeks": 0
-    },
+    "require_active_version": true,
+    "time_til_dormant_autodelete_ms": 0,
+    "time_til_dormant_ms": 0,
     "updated_at": "2019-08-24T14:15:22Z"
   }
 ]
@@ -75,38 +79,41 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
 
 Status Code **200**
 
-| Name                                                                                  | Type                                                                                 | Required | Restrictions | Description                                                                                                                                                                                                                                                                                                    |
-| ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `[array item]`                                                                        | array                                                                                | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» active_user_count`                                                                 | integer                                                                              | false    |              | Active user count is set to -1 when loading.                                                                                                                                                                                                                                                                   |
-| `» active_version_id`                                                                 | string(uuid)                                                                         | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» allow_user_autostart`                                                              | boolean                                                                              | false    |              | Allow user autostart and AllowUserAutostop are enterprise-only. Their values are only used if your license is entitled to use the advanced template scheduling feature.                                                                                                                                        |
-| `» allow_user_autostop`                                                               | boolean                                                                              | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» allow_user_cancel_workspace_jobs`                                                  | boolean                                                                              | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» build_time_stats`                                                                  | [codersdk.TemplateBuildTimeStats](schemas.md#codersdktemplatebuildtimestats)         | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `»» [any property]`                                                                   | [codersdk.TransitionStats](schemas.md#codersdktransitionstats)                       | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `»»» p50`                                                                             | integer                                                                              | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `»»» p95`                                                                             | integer                                                                              | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» created_at`                                                                        | string(date-time)                                                                    | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» created_by_id`                                                                     | string(uuid)                                                                         | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» created_by_name`                                                                   | string                                                                               | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» default_ttl_ms`                                                                    | integer                                                                              | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» description`                                                                       | string                                                                               | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» display_name`                                                                      | string                                                                               | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» failure_ttl_ms`                                                                    | integer                                                                              | false    |              | Failure ttl ms InactivityTTLMillis, and LockedTTLMillis are enterprise-only. Their values are used if your license is entitled to use the advanced template scheduling feature.                                                                                                                                |
-| `» icon`                                                                              | string                                                                               | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» id`                                                                                | string(uuid)                                                                         | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» inactivity_ttl_ms`                                                                 | integer                                                                              | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» locked_ttl_ms`                                                                     | integer                                                                              | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» max_ttl_ms`                                                                        | integer                                                                              | false    |              | Max ttl ms remove max_ttl once restart_requirement is matured                                                                                                                                                                                                                                                  |
-| `» name`                                                                              | string                                                                               | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» organization_id`                                                                   | string(uuid)                                                                         | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» provisioner`                                                                       | string                                                                               | false    |              |                                                                                                                                                                                                                                                                                                                |
-| `» restart_requirement`                                                               | [codersdk.TemplateRestartRequirement](schemas.md#codersdktemplaterestartrequirement) | false    |              | Restart requirement is an enterprise feature. Its value is only used if your license is entitled to use the advanced template scheduling feature.                                                                                                                                                              |
-| `»» days_of_week`                                                                     | array                                                                                | false    |              | »days of week is a list of days of the week on which restarts are required. Restarts happen within the user's quiet hours (in their configured timezone). If no days are specified, restarts are not required. Weekdays cannot be specified twice.                                                             |
+| Name                                                                                  | Type                                                                                     | Required | Restrictions | Description                                                                                                                                                                                                                                                                                                    |
+| ------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `[array item]`                                                                        | array                                                                                    | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» active_user_count`                                                                 | integer                                                                                  | false    |              | Active user count is set to -1 when loading.                                                                                                                                                                                                                                                                   |
+| `» active_version_id`                                                                 | string(uuid)                                                                             | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» allow_user_autostart`                                                              | boolean                                                                                  | false    |              | Allow user autostart and AllowUserAutostop are enterprise-only. Their values are only used if your license is entitled to use the advanced template scheduling feature.                                                                                                                                        |
+| `» allow_user_autostop`                                                               | boolean                                                                                  | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» allow_user_cancel_workspace_jobs`                                                  | boolean                                                                                  | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» autostart_requirement`                                                             | [codersdk.TemplateAutostartRequirement](schemas.md#codersdktemplateautostartrequirement) | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `»» days_of_week`                                                                     | array                                                                                    | false    |              | Days of week is a list of days of the week in which autostart is allowed to happen. If no days are specified, autostart is not allowed.                                                                                                                                                                        |
+| `» autostop_requirement`                                                              | [codersdk.TemplateAutostopRequirement](schemas.md#codersdktemplateautostoprequirement)   | false    |              | Autostop requirement and AutostartRequirement are enterprise features. Its value is only used if your license is entitled to use the advanced template scheduling feature.                                                                                                                                     |
+| `»» days_of_week`                                                                     | array                                                                                    | false    |              | Days of week is a list of days of the week on which restarts are required. Restarts happen within the user's quiet hours (in their configured timezone). If no days are specified, restarts are not required. Weekdays cannot be specified twice.                                                              |
 | Restarts will only happen on weekdays in this list on weeks which line up with Weeks. |
-| `»» weeks`                                                                            | integer                                                                              | false    |              | Weeks is the number of weeks between required restarts. Weeks are synced across all workspaces (and Coder deployments) using modulo math on a hardcoded epoch week of January 2nd, 2023 (the first Monday of 2023). Values of 0 or 1 indicate weekly restarts. Values of 2 indicate fortnightly restarts, etc. |
-| `» updated_at`                                                                        | string(date-time)                                                                    | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `»» weeks`                                                                            | integer                                                                                  | false    |              | Weeks is the number of weeks between required restarts. Weeks are synced across all workspaces (and Coder deployments) using modulo math on a hardcoded epoch week of January 2nd, 2023 (the first Monday of 2023). Values of 0 or 1 indicate weekly restarts. Values of 2 indicate fortnightly restarts, etc. |
+| `» build_time_stats`                                                                  | [codersdk.TemplateBuildTimeStats](schemas.md#codersdktemplatebuildtimestats)             | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `»» [any property]`                                                                   | [codersdk.TransitionStats](schemas.md#codersdktransitionstats)                           | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `»»» p50`                                                                             | integer                                                                                  | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `»»» p95`                                                                             | integer                                                                                  | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» created_at`                                                                        | string(date-time)                                                                        | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» created_by_id`                                                                     | string(uuid)                                                                             | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» created_by_name`                                                                   | string                                                                                   | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» default_ttl_ms`                                                                    | integer                                                                                  | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» description`                                                                       | string                                                                                   | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» display_name`                                                                      | string                                                                                   | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» failure_ttl_ms`                                                                    | integer                                                                                  | false    |              | Failure ttl ms TimeTilDormantMillis, and TimeTilDormantAutoDeleteMillis are enterprise-only. Their values are used if your license is entitled to use the advanced template scheduling feature.                                                                                                                |
+| `» icon`                                                                              | string                                                                                   | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» id`                                                                                | string(uuid)                                                                             | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» max_ttl_ms`                                                                        | integer                                                                                  | false    |              | Max ttl ms remove max_ttl once autostop_requirement is matured                                                                                                                                                                                                                                                 |
+| `» name`                                                                              | string                                                                                   | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» organization_id`                                                                   | string(uuid)                                                                             | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» provisioner`                                                                       | string                                                                                   | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» require_active_version`                                                            | boolean                                                                                  | false    |              | Require active version mandates that workspaces are built with the active template version.                                                                                                                                                                                                                    |
+| `» time_til_dormant_autodelete_ms`                                                    | integer                                                                                  | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» time_til_dormant_ms`                                                               | integer                                                                                  | false    |              |                                                                                                                                                                                                                                                                                                                |
+| `» updated_at`                                                                        | string(date-time)                                                                        | false    |              |                                                                                                                                                                                                                                                                                                                |
 
 #### Enumerated Values
 
@@ -137,20 +144,24 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/templa
   "allow_user_autostart": true,
   "allow_user_autostop": true,
   "allow_user_cancel_workspace_jobs": true,
+  "autostart_requirement": {
+    "days_of_week": ["monday"]
+  },
+  "autostop_requirement": {
+    "days_of_week": ["monday"],
+    "weeks": 0
+  },
   "default_ttl_ms": 0,
+  "delete_ttl_ms": 0,
   "description": "string",
   "disable_everyone_group_access": true,
   "display_name": "string",
+  "dormant_ttl_ms": 0,
   "failure_ttl_ms": 0,
   "icon": "string",
-  "inactivity_ttl_ms": 0,
-  "locked_ttl_ms": 0,
   "max_ttl_ms": 0,
   "name": "string",
-  "restart_requirement": {
-    "days_of_week": ["monday"],
-    "weeks": 0
-  },
+  "require_active_version": true,
   "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1"
 }
 ```
@@ -173,6 +184,13 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/templa
   "allow_user_autostart": true,
   "allow_user_autostop": true,
   "allow_user_cancel_workspace_jobs": true,
+  "autostart_requirement": {
+    "days_of_week": ["monday"]
+  },
+  "autostop_requirement": {
+    "days_of_week": ["monday"],
+    "weeks": 0
+  },
   "build_time_stats": {
     "property1": {
       "p50": 123,
@@ -192,16 +210,13 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/templa
   "failure_ttl_ms": 0,
   "icon": "string",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
-  "inactivity_ttl_ms": 0,
-  "locked_ttl_ms": 0,
   "max_ttl_ms": 0,
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
   "provisioner": "terraform",
-  "restart_requirement": {
-    "days_of_week": ["monday"],
-    "weeks": 0
-  },
+  "require_active_version": true,
+  "time_til_dormant_autodelete_ms": 0,
+  "time_til_dormant_ms": 0,
   "updated_at": "2019-08-24T14:15:22Z"
 }
 ```
@@ -305,6 +320,13 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
   "allow_user_autostart": true,
   "allow_user_autostop": true,
   "allow_user_cancel_workspace_jobs": true,
+  "autostart_requirement": {
+    "days_of_week": ["monday"]
+  },
+  "autostop_requirement": {
+    "days_of_week": ["monday"],
+    "weeks": 0
+  },
   "build_time_stats": {
     "property1": {
       "p50": 123,
@@ -324,16 +346,13 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
   "failure_ttl_ms": 0,
   "icon": "string",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
-  "inactivity_ttl_ms": 0,
-  "locked_ttl_ms": 0,
   "max_ttl_ms": 0,
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
   "provisioner": "terraform",
-  "restart_requirement": {
-    "days_of_week": ["monday"],
-    "weeks": 0
-  },
+  "require_active_version": true,
+  "time_til_dormant_autodelete_ms": 0,
+  "time_til_dormant_ms": 0,
   "updated_at": "2019-08-24T14:15:22Z"
 }
 ```
@@ -373,6 +392,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
 
 ```json
 {
+  "archived": true,
   "created_at": "2019-08-24T14:15:22Z",
   "created_by": {
     "avatar_url": "http://example.com",
@@ -385,7 +405,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
     "completed_at": "2019-08-24T14:15:22Z",
     "created_at": "2019-08-24T14:15:22Z",
     "error": "string",
-    "error_code": "MISSING_TEMPLATE_PARAMETER",
+    "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "queue_position": 0,
@@ -443,6 +463,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
 
 ```json
 {
+  "archived": true,
   "created_at": "2019-08-24T14:15:22Z",
   "created_by": {
     "avatar_url": "http://example.com",
@@ -455,7 +476,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
     "completed_at": "2019-08-24T14:15:22Z",
     "created_at": "2019-08-24T14:15:22Z",
     "error": "string",
-    "error_code": "MISSING_TEMPLATE_PARAMETER",
+    "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "queue_position": 0,
@@ -537,6 +558,7 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/templa
 
 ```json
 {
+  "archived": true,
   "created_at": "2019-08-24T14:15:22Z",
   "created_by": {
     "avatar_url": "http://example.com",
@@ -549,7 +571,7 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/templa
     "completed_at": "2019-08-24T14:15:22Z",
     "created_at": "2019-08-24T14:15:22Z",
     "error": "string",
-    "error_code": "MISSING_TEMPLATE_PARAMETER",
+    "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "queue_position": 0,
@@ -610,6 +632,13 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template} \
   "allow_user_autostart": true,
   "allow_user_autostop": true,
   "allow_user_cancel_workspace_jobs": true,
+  "autostart_requirement": {
+    "days_of_week": ["monday"]
+  },
+  "autostop_requirement": {
+    "days_of_week": ["monday"],
+    "weeks": 0
+  },
   "build_time_stats": {
     "property1": {
       "p50": 123,
@@ -629,16 +658,13 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template} \
   "failure_ttl_ms": 0,
   "icon": "string",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
-  "inactivity_ttl_ms": 0,
-  "locked_ttl_ms": 0,
   "max_ttl_ms": 0,
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
   "provisioner": "terraform",
-  "restart_requirement": {
-    "days_of_week": ["monday"],
-    "weeks": 0
-  },
+  "require_active_version": true,
+  "time_til_dormant_autodelete_ms": 0,
+  "time_til_dormant_ms": 0,
   "updated_at": "2019-08-24T14:15:22Z"
 }
 ```
@@ -725,6 +751,13 @@ curl -X PATCH http://coder-server:8080/api/v2/templates/{template} \
   "allow_user_autostart": true,
   "allow_user_autostop": true,
   "allow_user_cancel_workspace_jobs": true,
+  "autostart_requirement": {
+    "days_of_week": ["monday"]
+  },
+  "autostop_requirement": {
+    "days_of_week": ["monday"],
+    "weeks": 0
+  },
   "build_time_stats": {
     "property1": {
       "p50": 123,
@@ -744,16 +777,13 @@ curl -X PATCH http://coder-server:8080/api/v2/templates/{template} \
   "failure_ttl_ms": 0,
   "icon": "string",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
-  "inactivity_ttl_ms": 0,
-  "locked_ttl_ms": 0,
   "max_ttl_ms": 0,
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
   "provisioner": "terraform",
-  "restart_requirement": {
-    "days_of_week": ["monday"],
-    "weeks": 0
-  },
+  "require_active_version": true,
+  "time_til_dormant_autodelete_ms": 0,
+  "time_til_dormant_ms": 0,
   "updated_at": "2019-08-24T14:15:22Z"
 }
 ```
@@ -824,12 +854,13 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/versions \
 
 ### Parameters
 
-| Name       | In    | Type         | Required | Description |
-| ---------- | ----- | ------------ | -------- | ----------- |
-| `template` | path  | string(uuid) | true     | Template ID |
-| `after_id` | query | string(uuid) | false    | After ID    |
-| `limit`    | query | integer      | false    | Page limit  |
-| `offset`   | query | integer      | false    | Page offset |
+| Name               | In    | Type         | Required | Description                           |
+| ------------------ | ----- | ------------ | -------- | ------------------------------------- |
+| `template`         | path  | string(uuid) | true     | Template ID                           |
+| `after_id`         | query | string(uuid) | false    | After ID                              |
+| `include_archived` | query | boolean      | false    | Include archived versions in the list |
+| `limit`            | query | integer      | false    | Page limit                            |
+| `offset`           | query | integer      | false    | Page offset                           |
 
 ### Example responses
 
@@ -838,6 +869,7 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/versions \
 ```json
 [
   {
+    "archived": true,
     "created_at": "2019-08-24T14:15:22Z",
     "created_by": {
       "avatar_url": "http://example.com",
@@ -850,7 +882,7 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/versions \
       "completed_at": "2019-08-24T14:15:22Z",
       "created_at": "2019-08-24T14:15:22Z",
       "error": "string",
-      "error_code": "MISSING_TEMPLATE_PARAMETER",
+      "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "queue_position": 0,
@@ -887,6 +919,7 @@ Status Code **200**
 | Name                 | Type                                                                     | Required | Restrictions | Description |
 | -------------------- | ------------------------------------------------------------------------ | -------- | ------------ | ----------- |
 | `[array item]`       | array                                                                    | false    |              |             |
+| `» archived`         | boolean                                                                  | false    |              |             |
 | `» created_at`       | string(date-time)                                                        | false    |              |             |
 | `» created_by`       | [codersdk.MinimalUser](schemas.md#codersdkminimaluser)                   | false    |              |             |
 | `»» avatar_url`      | string(uri)                                                              | false    |              |             |
@@ -920,7 +953,6 @@ Status Code **200**
 
 | Property     | Value                         |
 | ------------ | ----------------------------- |
-| `error_code` | `MISSING_TEMPLATE_PARAMETER`  |
 | `error_code` | `REQUIRED_TEMPLATE_VARIABLES` |
 | `status`     | `pending`                     |
 | `status`     | `running`                     |
@@ -985,6 +1017,60 @@ curl -X PATCH http://coder-server:8080/api/v2/templates/{template}/versions \
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
+## Archive template unused versions by template id
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X POST http://coder-server:8080/api/v2/templates/{template}/versions/archive \
+  -H 'Content-Type: application/json' \
+  -H 'Accept: application/json' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`POST /templates/{template}/versions/archive`
+
+> Body parameter
+
+```json
+{
+  "all": true
+}
+```
+
+### Parameters
+
+| Name       | In   | Type                                                                                         | Required | Description     |
+| ---------- | ---- | -------------------------------------------------------------------------------------------- | -------- | --------------- |
+| `template` | path | string(uuid)                                                                                 | true     | Template ID     |
+| `body`     | body | [codersdk.ArchiveTemplateVersionsRequest](schemas.md#codersdkarchivetemplateversionsrequest) | true     | Archive request |
+
+### Example responses
+
+> 200 Response
+
+```json
+{
+  "detail": "string",
+  "message": "string",
+  "validations": [
+    {
+      "detail": "string",
+      "field": "string"
+    }
+  ]
+}
+```
+
+### Responses
+
+| Status | Meaning                                                 | Description | Schema                                           |
+| ------ | ------------------------------------------------------- | ----------- | ------------------------------------------------ |
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.Response](schemas.md#codersdkresponse) |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
 ## Get template version by template ID and name
 
 ### Code samples
@@ -1012,6 +1098,7 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/versions/{templ
 ```json
 [
   {
+    "archived": true,
     "created_at": "2019-08-24T14:15:22Z",
     "created_by": {
       "avatar_url": "http://example.com",
@@ -1024,7 +1111,7 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/versions/{templ
       "completed_at": "2019-08-24T14:15:22Z",
       "created_at": "2019-08-24T14:15:22Z",
       "error": "string",
-      "error_code": "MISSING_TEMPLATE_PARAMETER",
+      "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "queue_position": 0,
@@ -1061,6 +1148,7 @@ Status Code **200**
 | Name                 | Type                                                                     | Required | Restrictions | Description |
 | -------------------- | ------------------------------------------------------------------------ | -------- | ------------ | ----------- |
 | `[array item]`       | array                                                                    | false    |              |             |
+| `» archived`         | boolean                                                                  | false    |              |             |
 | `» created_at`       | string(date-time)                                                        | false    |              |             |
 | `» created_by`       | [codersdk.MinimalUser](schemas.md#codersdkminimaluser)                   | false    |              |             |
 | `»» avatar_url`      | string(uri)                                                              | false    |              |             |
@@ -1094,7 +1182,6 @@ Status Code **200**
 
 | Property     | Value                         |
 | ------------ | ----------------------------- |
-| `error_code` | `MISSING_TEMPLATE_PARAMETER`  |
 | `error_code` | `REQUIRED_TEMPLATE_VARIABLES` |
 | `status`     | `pending`                     |
 | `status`     | `running`                     |
@@ -1130,6 +1217,7 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion} \
 
 ```json
 {
+  "archived": true,
   "created_at": "2019-08-24T14:15:22Z",
   "created_by": {
     "avatar_url": "http://example.com",
@@ -1142,7 +1230,7 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion} \
     "completed_at": "2019-08-24T14:15:22Z",
     "created_at": "2019-08-24T14:15:22Z",
     "error": "string",
-    "error_code": "MISSING_TEMPLATE_PARAMETER",
+    "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "queue_position": 0,
@@ -1209,6 +1297,7 @@ curl -X PATCH http://coder-server:8080/api/v2/templateversions/{templateversion}
 
 ```json
 {
+  "archived": true,
   "created_at": "2019-08-24T14:15:22Z",
   "created_by": {
     "avatar_url": "http://example.com",
@@ -1221,7 +1310,7 @@ curl -X PATCH http://coder-server:8080/api/v2/templateversions/{templateversion}
     "completed_at": "2019-08-24T14:15:22Z",
     "created_at": "2019-08-24T14:15:22Z",
     "error": "string",
-    "error_code": "MISSING_TEMPLATE_PARAMETER",
+    "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
     "queue_position": 0,
@@ -1252,6 +1341,50 @@ curl -X PATCH http://coder-server:8080/api/v2/templateversions/{templateversion}
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
+## Archive template version
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X POST http://coder-server:8080/api/v2/templateversions/{templateversion}/archive \
+  -H 'Accept: application/json' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`POST /templateversions/{templateversion}/archive`
+
+### Parameters
+
+| Name              | In   | Type         | Required | Description         |
+| ----------------- | ---- | ------------ | -------- | ------------------- |
+| `templateversion` | path | string(uuid) | true     | Template version ID |
+
+### Example responses
+
+> 200 Response
+
+```json
+{
+  "detail": "string",
+  "message": "string",
+  "validations": [
+    {
+      "detail": "string",
+      "field": "string"
+    }
+  ]
+}
+```
+
+### Responses
+
+| Status | Meaning                                                 | Description | Schema                                           |
+| ------ | ------------------------------------------------------- | ----------- | ------------------------------------------------ |
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.Response](schemas.md#codersdkresponse) |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
 ## Cancel template version by ID
 
 ### Code samples
@@ -1347,7 +1480,7 @@ curl -X POST http://coder-server:8080/api/v2/templateversions/{templateversion}/
   "completed_at": "2019-08-24T14:15:22Z",
   "created_at": "2019-08-24T14:15:22Z",
   "error": "string",
-  "error_code": "MISSING_TEMPLATE_PARAMETER",
+  "error_code": "REQUIRED_TEMPLATE_VARIABLES",
   "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "queue_position": 0,
@@ -1400,7 +1533,7 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/d
   "completed_at": "2019-08-24T14:15:22Z",
   "created_at": "2019-08-24T14:15:22Z",
   "error": "string",
-  "error_code": "MISSING_TEMPLATE_PARAMETER",
+  "error_code": "REQUIRED_TEMPLATE_VARIABLES",
   "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "queue_position": 0,
@@ -1587,6 +1720,7 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/d
             "sharing_level": "owner",
             "slug": "string",
             "subdomain": true,
+            "subdomain_name": "string",
             "url": "string"
           }
         ],
@@ -1595,6 +1729,7 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/d
         "created_at": "2019-08-24T14:15:22Z",
         "directory": "string",
         "disconnected_at": "2019-08-24T14:15:22Z",
+        "display_apps": ["vscode"],
         "environment_variables": {
           "property1": "string",
           "property2": "string"
@@ -1619,21 +1754,37 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/d
           }
         },
         "lifecycle_state": "created",
-        "login_before_ready": true,
+        "log_sources": [
+          {
+            "created_at": "2019-08-24T14:15:22Z",
+            "display_name": "string",
+            "icon": "string",
+            "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+            "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+          }
+        ],
         "logs_length": 0,
         "logs_overflowed": true,
         "name": "string",
         "operating_system": "string",
         "ready_at": "2019-08-24T14:15:22Z",
         "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-        "shutdown_script": "string",
-        "shutdown_script_timeout_seconds": 0,
+        "scripts": [
+          {
+            "cron": "string",
+            "log_path": "string",
+            "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+            "run_on_start": true,
+            "run_on_stop": true,
+            "script": "string",
+            "start_blocks_login": true,
+            "timeout": 0
+          }
+        ],
         "started_at": "2019-08-24T14:15:22Z",
-        "startup_script": "string",
         "startup_script_behavior": "blocking",
-        "startup_script_timeout_seconds": 0,
         "status": "connecting",
-        "subsystem": "envbox",
+        "subsystems": ["envbox"],
         "troubleshooting_url": "string",
         "updated_at": "2019-08-24T14:15:22Z",
         "version": "string"
@@ -1669,76 +1820,88 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/d
 
 Status Code **200**
 
-| Name                                 | Type                                                                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                    |
-| ------------------------------------ | ------------------------------------------------------------------------------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `[array item]`                       | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `» agents`                           | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»» apps`                            | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»»» command`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» display_name`                   | string                                                                                                 | false    |              | »»display name is a friendly name for the app.                                                                                                                                                                                                 |
-| `»»» external`                       | boolean                                                                                                | false    |              | External specifies whether the URL should be opened externally on the client or not.                                                                                                                                                           |
-| `»»» health`                         | [codersdk.WorkspaceAppHealth](schemas.md#codersdkworkspaceapphealth)                                   | false    |              |                                                                                                                                                                                                                                                |
-| `»»» healthcheck`                    | [codersdk.Healthcheck](schemas.md#codersdkhealthcheck)                                                 | false    |              | Healthcheck specifies the configuration for checking app health.                                                                                                                                                                               |
-| `»»»» interval`                      | integer                                                                                                | false    |              | Interval specifies the seconds between each health check.                                                                                                                                                                                      |
-| `»»»» threshold`                     | integer                                                                                                | false    |              | Threshold specifies the number of consecutive failed health checks before returning "unhealthy".                                                                                                                                               |
-| `»»»» url`                           | string                                                                                                 | false    |              | »»»url specifies the endpoint to check for the app health.                                                                                                                                                                                     |
-| `»»» icon`                           | string                                                                                                 | false    |              | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard.                                                                                                                                               |
-| `»»» id`                             | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»»» sharing_level`                  | [codersdk.WorkspaceAppSharingLevel](schemas.md#codersdkworkspaceappsharinglevel)                       | false    |              |                                                                                                                                                                                                                                                |
-| `»»» slug`                           | string                                                                                                 | false    |              | Slug is a unique identifier within the agent.                                                                                                                                                                                                  |
-| `»»» subdomain`                      | boolean                                                                                                | false    |              | Subdomain denotes whether the app should be accessed via a path on the `coder server` or via a hostname-based dev URL. If this is set to true and there is no app wildcard configured on the server, the app will not be accessible in the UI. |
-| `»»» url`                            | string                                                                                                 | false    |              | »»url is the address being proxied to inside the workspace. If external is specified, this will be opened on the client.                                                                                                                       |
-| `»» architecture`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» connection_timeout_seconds`      | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» created_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» directory`                       | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» disconnected_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» environment_variables`           | object                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» [any property]`                 | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» expanded_directory`              | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» first_connected_at`              | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» health`                          | [codersdk.WorkspaceAgentHealth](schemas.md#codersdkworkspaceagenthealth)                               | false    |              | Health reports the health of the agent.                                                                                                                                                                                                        |
-| `»»» healthy`                        | boolean                                                                                                | false    |              | Healthy is true if the agent is healthy.                                                                                                                                                                                                       |
-| `»»» reason`                         | string                                                                                                 | false    |              | Reason is a human-readable explanation of the agent's health. It is empty if Healthy is true.                                                                                                                                                  |
-| `»» id`                              | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» instance_id`                     | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» last_connected_at`               | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» latency`                         | object                                                                                                 | false    |              | »latency is mapped by region name (e.g. "New York City", "Seattle").                                                                                                                                                                           |
-| `»»» [any property]`                 | [codersdk.DERPRegion](schemas.md#codersdkderpregion)                                                   | false    |              |                                                                                                                                                                                                                                                |
-| `»»»» latency_ms`                    | number                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»»» preferred`                     | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» lifecycle_state`                 | [codersdk.WorkspaceAgentLifecycle](schemas.md#codersdkworkspaceagentlifecycle)                         | false    |              |                                                                                                                                                                                                                                                |
-| `»» login_before_ready`              | boolean                                                                                                | false    |              | Deprecated: Use StartupScriptBehavior instead.                                                                                                                                                                                                 |
-| `»» logs_length`                     | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» logs_overflowed`                 | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» name`                            | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» operating_system`                | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» ready_at`                        | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» resource_id`                     | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» shutdown_script`                 | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» shutdown_script_timeout_seconds` | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» started_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» startup_script`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» startup_script_behavior`         | [codersdk.WorkspaceAgentStartupScriptBehavior](schemas.md#codersdkworkspaceagentstartupscriptbehavior) | false    |              |                                                                                                                                                                                                                                                |
-| `»» startup_script_timeout_seconds`  | integer                                                                                                | false    |              | »startup script timeout seconds is the number of seconds to wait for the startup script to complete. If the script does not complete within this time, the agent lifecycle will be marked as start_timeout.                                    |
-| `»» status`                          | [codersdk.WorkspaceAgentStatus](schemas.md#codersdkworkspaceagentstatus)                               | false    |              |                                                                                                                                                                                                                                                |
-| `»» subsystem`                       | [codersdk.AgentSubsystem](schemas.md#codersdkagentsubsystem)                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» troubleshooting_url`             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» updated_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» version`                         | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» created_at`                       | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `» daily_cost`                       | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `» hide`                             | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `» icon`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» id`                               | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `» job_id`                           | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `» metadata`                         | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»» key`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» sensitive`                       | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» value`                           | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» name`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» type`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» workspace_transition`             | [codersdk.WorkspaceTransition](schemas.md#codersdkworkspacetransition)                                 | false    |              |                                                                                                                                                                                                                                                |
+| Name                            | Type                                                                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                    |
+| ------------------------------- | ------------------------------------------------------------------------------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `[array item]`                  | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `» agents`                      | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» apps`                       | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» command`                   | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» display_name`              | string                                                                                                 | false    |              | Display name is a friendly name for the app.                                                                                                                                                                                                   |
+| `»»» external`                  | boolean                                                                                                | false    |              | External specifies whether the URL should be opened externally on the client or not.                                                                                                                                                           |
+| `»»» health`                    | [codersdk.WorkspaceAppHealth](schemas.md#codersdkworkspaceapphealth)                                   | false    |              |                                                                                                                                                                                                                                                |
+| `»»» healthcheck`               | [codersdk.Healthcheck](schemas.md#codersdkhealthcheck)                                                 | false    |              | Healthcheck specifies the configuration for checking app health.                                                                                                                                                                               |
+| `»»»» interval`                 | integer                                                                                                | false    |              | Interval specifies the seconds between each health check.                                                                                                                                                                                      |
+| `»»»» threshold`                | integer                                                                                                | false    |              | Threshold specifies the number of consecutive failed health checks before returning "unhealthy".                                                                                                                                               |
+| `»»»» url`                      | string                                                                                                 | false    |              | URL specifies the endpoint to check for the app health.                                                                                                                                                                                        |
+| `»»» icon`                      | string                                                                                                 | false    |              | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard.                                                                                                                                               |
+| `»»» id`                        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»» sharing_level`             | [codersdk.WorkspaceAppSharingLevel](schemas.md#codersdkworkspaceappsharinglevel)                       | false    |              |                                                                                                                                                                                                                                                |
+| `»»» slug`                      | string                                                                                                 | false    |              | Slug is a unique identifier within the agent.                                                                                                                                                                                                  |
+| `»»» subdomain`                 | boolean                                                                                                | false    |              | Subdomain denotes whether the app should be accessed via a path on the `coder server` or via a hostname-based dev URL. If this is set to true and there is no app wildcard configured on the server, the app will not be accessible in the UI. |
+| `»»» subdomain_name`            | string                                                                                                 | false    |              | Subdomain name is the application domain exposed on the `coder server`.                                                                                                                                                                        |
+| `»»» url`                       | string                                                                                                 | false    |              | URL is the address being proxied to inside the workspace. If external is specified, this will be opened on the client.                                                                                                                         |
+| `»» architecture`               | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» connection_timeout_seconds` | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» created_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» directory`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» disconnected_at`            | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» display_apps`               | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» environment_variables`      | object                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» [any property]`            | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» expanded_directory`         | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» first_connected_at`         | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» health`                     | [codersdk.WorkspaceAgentHealth](schemas.md#codersdkworkspaceagenthealth)                               | false    |              | Health reports the health of the agent.                                                                                                                                                                                                        |
+| `»»» healthy`                   | boolean                                                                                                | false    |              | Healthy is true if the agent is healthy.                                                                                                                                                                                                       |
+| `»»» reason`                    | string                                                                                                 | false    |              | Reason is a human-readable explanation of the agent's health. It is empty if Healthy is true.                                                                                                                                                  |
+| `»» id`                         | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» instance_id`                | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» last_connected_at`          | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» latency`                    | object                                                                                                 | false    |              | Latency is mapped by region name (e.g. "New York City", "Seattle").                                                                                                                                                                            |
+| `»»» [any property]`            | [codersdk.DERPRegion](schemas.md#codersdkderpregion)                                                   | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» latency_ms`               | number                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» preferred`                | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» lifecycle_state`            | [codersdk.WorkspaceAgentLifecycle](schemas.md#codersdkworkspaceagentlifecycle)                         | false    |              |                                                                                                                                                                                                                                                |
+| `»» log_sources`                | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» created_at`                | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»»» display_name`              | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» icon`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» id`                        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»» workspace_agent_id`        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» logs_length`                | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» logs_overflowed`            | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» name`                       | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» operating_system`           | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» ready_at`                   | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» resource_id`                | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» scripts`                    | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» cron`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» log_path`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» log_source_id`             | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»» run_on_start`              | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» run_on_stop`               | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» script`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» start_blocks_login`        | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» timeout`                   | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» started_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» startup_script_behavior`    | [codersdk.WorkspaceAgentStartupScriptBehavior](schemas.md#codersdkworkspaceagentstartupscriptbehavior) | false    |              | Startup script behavior is a legacy field that is deprecated in favor of the `coder_script` resource. It's only referenced by old clients. Deprecated: Remove in the future!                                                                   |
+| `»» status`                     | [codersdk.WorkspaceAgentStatus](schemas.md#codersdkworkspaceagentstatus)                               | false    |              |                                                                                                                                                                                                                                                |
+| `»» subsystems`                 | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» troubleshooting_url`        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» updated_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» version`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» created_at`                  | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `» daily_cost`                  | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `» hide`                        | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `» icon`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» id`                          | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» job_id`                      | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» metadata`                    | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» key`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» sensitive`                  | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» value`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» name`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» type`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» workspace_transition`        | [codersdk.WorkspaceTransition](schemas.md#codersdkworkspacetransition)                                 | false    |              |                                                                                                                                                                                                                                                |
 
 #### Enumerated Values
 
@@ -1766,25 +1929,24 @@ Status Code **200**
 | `status`                  | `connected`        |
 | `status`                  | `disconnected`     |
 | `status`                  | `timeout`          |
-| `subsystem`               | `envbox`           |
 | `workspace_transition`    | `start`            |
 | `workspace_transition`    | `stop`             |
 | `workspace_transition`    | `delete`           |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
-## Get git auth by template version
+## Get external auth by template version
 
 ### Code samples
 
 ```shell
 # Example request using curl
-curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/gitauth \
+curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/external-auth \
   -H 'Accept: application/json' \
   -H 'Coder-Session-Token: API_KEY'
 ```
 
-`GET /templateversions/{templateversion}/gitauth`
+`GET /templateversions/{templateversion}/external-auth`
 
 ### Parameters
 
@@ -1801,38 +1963,33 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/g
   {
     "authenticate_url": "string",
     "authenticated": true,
+    "display_icon": "string",
+    "display_name": "string",
     "id": "string",
-    "type": "azure-devops"
+    "type": "string"
   }
 ]
 ```
 
 ### Responses
 
-| Status | Meaning                                                 | Description | Schema                                                                                |
-| ------ | ------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------- |
-| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | array of [codersdk.TemplateVersionGitAuth](schemas.md#codersdktemplateversiongitauth) |
+| Status | Meaning                                                 | Description | Schema                                                                                          |
+| ------ | ------------------------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------- |
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | array of [codersdk.TemplateVersionExternalAuth](schemas.md#codersdktemplateversionexternalauth) |
 
-<h3 id="get-git-auth-by-template-version-responseschema">Response Schema</h3>
+<h3 id="get-external-auth-by-template-version-responseschema">Response Schema</h3>
 
 Status Code **200**
 
-| Name                 | Type                                                   | Required | Restrictions | Description |
-| -------------------- | ------------------------------------------------------ | -------- | ------------ | ----------- |
-| `[array item]`       | array                                                  | false    |              |             |
-| `» authenticate_url` | string                                                 | false    |              |             |
-| `» authenticated`    | boolean                                                | false    |              |             |
-| `» id`               | string                                                 | false    |              |             |
-| `» type`             | [codersdk.GitProvider](schemas.md#codersdkgitprovider) | false    |              |             |
-
-#### Enumerated Values
-
-| Property | Value          |
-| -------- | -------------- |
-| `type`   | `azure-devops` |
-| `type`   | `github`       |
-| `type`   | `gitlab`       |
-| `type`   | `bitbucket`    |
+| Name                 | Type    | Required | Restrictions | Description |
+| -------------------- | ------- | -------- | ------------ | ----------- |
+| `[array item]`       | array   | false    |              |             |
+| `» authenticate_url` | string  | false    |              |             |
+| `» authenticated`    | boolean | false    |              |             |
+| `» display_icon`     | string  | false    |              |             |
+| `» display_name`     | string  | false    |              |             |
+| `» id`               | string  | false    |              |             |
+| `» type`             | string  | false    |              |             |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
@@ -1979,6 +2136,7 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/r
             "sharing_level": "owner",
             "slug": "string",
             "subdomain": true,
+            "subdomain_name": "string",
             "url": "string"
           }
         ],
@@ -1987,6 +2145,7 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/r
         "created_at": "2019-08-24T14:15:22Z",
         "directory": "string",
         "disconnected_at": "2019-08-24T14:15:22Z",
+        "display_apps": ["vscode"],
         "environment_variables": {
           "property1": "string",
           "property2": "string"
@@ -2011,21 +2170,37 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/r
           }
         },
         "lifecycle_state": "created",
-        "login_before_ready": true,
+        "log_sources": [
+          {
+            "created_at": "2019-08-24T14:15:22Z",
+            "display_name": "string",
+            "icon": "string",
+            "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+            "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+          }
+        ],
         "logs_length": 0,
         "logs_overflowed": true,
         "name": "string",
         "operating_system": "string",
         "ready_at": "2019-08-24T14:15:22Z",
         "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-        "shutdown_script": "string",
-        "shutdown_script_timeout_seconds": 0,
+        "scripts": [
+          {
+            "cron": "string",
+            "log_path": "string",
+            "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+            "run_on_start": true,
+            "run_on_stop": true,
+            "script": "string",
+            "start_blocks_login": true,
+            "timeout": 0
+          }
+        ],
         "started_at": "2019-08-24T14:15:22Z",
-        "startup_script": "string",
         "startup_script_behavior": "blocking",
-        "startup_script_timeout_seconds": 0,
         "status": "connecting",
-        "subsystem": "envbox",
+        "subsystems": ["envbox"],
         "troubleshooting_url": "string",
         "updated_at": "2019-08-24T14:15:22Z",
         "version": "string"
@@ -2061,76 +2236,88 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/r
 
 Status Code **200**
 
-| Name                                 | Type                                                                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                    |
-| ------------------------------------ | ------------------------------------------------------------------------------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `[array item]`                       | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `» agents`                           | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»» apps`                            | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»»» command`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» display_name`                   | string                                                                                                 | false    |              | »»display name is a friendly name for the app.                                                                                                                                                                                                 |
-| `»»» external`                       | boolean                                                                                                | false    |              | External specifies whether the URL should be opened externally on the client or not.                                                                                                                                                           |
-| `»»» health`                         | [codersdk.WorkspaceAppHealth](schemas.md#codersdkworkspaceapphealth)                                   | false    |              |                                                                                                                                                                                                                                                |
-| `»»» healthcheck`                    | [codersdk.Healthcheck](schemas.md#codersdkhealthcheck)                                                 | false    |              | Healthcheck specifies the configuration for checking app health.                                                                                                                                                                               |
-| `»»»» interval`                      | integer                                                                                                | false    |              | Interval specifies the seconds between each health check.                                                                                                                                                                                      |
-| `»»»» threshold`                     | integer                                                                                                | false    |              | Threshold specifies the number of consecutive failed health checks before returning "unhealthy".                                                                                                                                               |
-| `»»»» url`                           | string                                                                                                 | false    |              | »»»url specifies the endpoint to check for the app health.                                                                                                                                                                                     |
-| `»»» icon`                           | string                                                                                                 | false    |              | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard.                                                                                                                                               |
-| `»»» id`                             | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»»» sharing_level`                  | [codersdk.WorkspaceAppSharingLevel](schemas.md#codersdkworkspaceappsharinglevel)                       | false    |              |                                                                                                                                                                                                                                                |
-| `»»» slug`                           | string                                                                                                 | false    |              | Slug is a unique identifier within the agent.                                                                                                                                                                                                  |
-| `»»» subdomain`                      | boolean                                                                                                | false    |              | Subdomain denotes whether the app should be accessed via a path on the `coder server` or via a hostname-based dev URL. If this is set to true and there is no app wildcard configured on the server, the app will not be accessible in the UI. |
-| `»»» url`                            | string                                                                                                 | false    |              | »»url is the address being proxied to inside the workspace. If external is specified, this will be opened on the client.                                                                                                                       |
-| `»» architecture`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» connection_timeout_seconds`      | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» created_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» directory`                       | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» disconnected_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» environment_variables`           | object                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»» [any property]`                 | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» expanded_directory`              | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» first_connected_at`              | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» health`                          | [codersdk.WorkspaceAgentHealth](schemas.md#codersdkworkspaceagenthealth)                               | false    |              | Health reports the health of the agent.                                                                                                                                                                                                        |
-| `»»» healthy`                        | boolean                                                                                                | false    |              | Healthy is true if the agent is healthy.                                                                                                                                                                                                       |
-| `»»» reason`                         | string                                                                                                 | false    |              | Reason is a human-readable explanation of the agent's health. It is empty if Healthy is true.                                                                                                                                                  |
-| `»» id`                              | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» instance_id`                     | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» last_connected_at`               | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» latency`                         | object                                                                                                 | false    |              | »latency is mapped by region name (e.g. "New York City", "Seattle").                                                                                                                                                                           |
-| `»»» [any property]`                 | [codersdk.DERPRegion](schemas.md#codersdkderpregion)                                                   | false    |              |                                                                                                                                                                                                                                                |
-| `»»»» latency_ms`                    | number                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»»»» preferred`                     | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» lifecycle_state`                 | [codersdk.WorkspaceAgentLifecycle](schemas.md#codersdkworkspaceagentlifecycle)                         | false    |              |                                                                                                                                                                                                                                                |
-| `»» login_before_ready`              | boolean                                                                                                | false    |              | Deprecated: Use StartupScriptBehavior instead.                                                                                                                                                                                                 |
-| `»» logs_length`                     | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» logs_overflowed`                 | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» name`                            | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» operating_system`                | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» ready_at`                        | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» resource_id`                     | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» shutdown_script`                 | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» shutdown_script_timeout_seconds` | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» started_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» startup_script`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» startup_script_behavior`         | [codersdk.WorkspaceAgentStartupScriptBehavior](schemas.md#codersdkworkspaceagentstartupscriptbehavior) | false    |              |                                                                                                                                                                                                                                                |
-| `»» startup_script_timeout_seconds`  | integer                                                                                                | false    |              | »startup script timeout seconds is the number of seconds to wait for the startup script to complete. If the script does not complete within this time, the agent lifecycle will be marked as start_timeout.                                    |
-| `»» status`                          | [codersdk.WorkspaceAgentStatus](schemas.md#codersdkworkspaceagentstatus)                               | false    |              |                                                                                                                                                                                                                                                |
-| `»» subsystem`                       | [codersdk.AgentSubsystem](schemas.md#codersdkagentsubsystem)                                           | false    |              |                                                                                                                                                                                                                                                |
-| `»» troubleshooting_url`             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» updated_at`                      | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `»» version`                         | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» created_at`                       | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
-| `» daily_cost`                       | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `» hide`                             | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `» icon`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» id`                               | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `» job_id`                           | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
-| `» metadata`                         | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `»» key`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `»» sensitive`                       | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
-| `»» value`                           | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» name`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» type`                             | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
-| `» workspace_transition`             | [codersdk.WorkspaceTransition](schemas.md#codersdkworkspacetransition)                                 | false    |              |                                                                                                                                                                                                                                                |
+| Name                            | Type                                                                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                    |
+| ------------------------------- | ------------------------------------------------------------------------------------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `[array item]`                  | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `» agents`                      | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» apps`                       | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» command`                   | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» display_name`              | string                                                                                                 | false    |              | Display name is a friendly name for the app.                                                                                                                                                                                                   |
+| `»»» external`                  | boolean                                                                                                | false    |              | External specifies whether the URL should be opened externally on the client or not.                                                                                                                                                           |
+| `»»» health`                    | [codersdk.WorkspaceAppHealth](schemas.md#codersdkworkspaceapphealth)                                   | false    |              |                                                                                                                                                                                                                                                |
+| `»»» healthcheck`               | [codersdk.Healthcheck](schemas.md#codersdkhealthcheck)                                                 | false    |              | Healthcheck specifies the configuration for checking app health.                                                                                                                                                                               |
+| `»»»» interval`                 | integer                                                                                                | false    |              | Interval specifies the seconds between each health check.                                                                                                                                                                                      |
+| `»»»» threshold`                | integer                                                                                                | false    |              | Threshold specifies the number of consecutive failed health checks before returning "unhealthy".                                                                                                                                               |
+| `»»»» url`                      | string                                                                                                 | false    |              | URL specifies the endpoint to check for the app health.                                                                                                                                                                                        |
+| `»»» icon`                      | string                                                                                                 | false    |              | Icon is a relative path or external URL that specifies an icon to be displayed in the dashboard.                                                                                                                                               |
+| `»»» id`                        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»» sharing_level`             | [codersdk.WorkspaceAppSharingLevel](schemas.md#codersdkworkspaceappsharinglevel)                       | false    |              |                                                                                                                                                                                                                                                |
+| `»»» slug`                      | string                                                                                                 | false    |              | Slug is a unique identifier within the agent.                                                                                                                                                                                                  |
+| `»»» subdomain`                 | boolean                                                                                                | false    |              | Subdomain denotes whether the app should be accessed via a path on the `coder server` or via a hostname-based dev URL. If this is set to true and there is no app wildcard configured on the server, the app will not be accessible in the UI. |
+| `»»» subdomain_name`            | string                                                                                                 | false    |              | Subdomain name is the application domain exposed on the `coder server`.                                                                                                                                                                        |
+| `»»» url`                       | string                                                                                                 | false    |              | URL is the address being proxied to inside the workspace. If external is specified, this will be opened on the client.                                                                                                                         |
+| `»» architecture`               | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» connection_timeout_seconds` | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» created_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» directory`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» disconnected_at`            | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» display_apps`               | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» environment_variables`      | object                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» [any property]`            | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» expanded_directory`         | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» first_connected_at`         | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» health`                     | [codersdk.WorkspaceAgentHealth](schemas.md#codersdkworkspaceagenthealth)                               | false    |              | Health reports the health of the agent.                                                                                                                                                                                                        |
+| `»»» healthy`                   | boolean                                                                                                | false    |              | Healthy is true if the agent is healthy.                                                                                                                                                                                                       |
+| `»»» reason`                    | string                                                                                                 | false    |              | Reason is a human-readable explanation of the agent's health. It is empty if Healthy is true.                                                                                                                                                  |
+| `»» id`                         | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» instance_id`                | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» last_connected_at`          | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» latency`                    | object                                                                                                 | false    |              | Latency is mapped by region name (e.g. "New York City", "Seattle").                                                                                                                                                                            |
+| `»»» [any property]`            | [codersdk.DERPRegion](schemas.md#codersdkderpregion)                                                   | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» latency_ms`               | number                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»»» preferred`                | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» lifecycle_state`            | [codersdk.WorkspaceAgentLifecycle](schemas.md#codersdkworkspaceagentlifecycle)                         | false    |              |                                                                                                                                                                                                                                                |
+| `»» log_sources`                | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» created_at`                | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»»» display_name`              | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» icon`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» id`                        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»» workspace_agent_id`        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» logs_length`                | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» logs_overflowed`            | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» name`                       | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» operating_system`           | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» ready_at`                   | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» resource_id`                | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» scripts`                    | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»»» cron`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» log_path`                  | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» log_source_id`             | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»»» run_on_start`              | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» run_on_stop`               | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» script`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»»» start_blocks_login`        | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»»» timeout`                   | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» started_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» startup_script_behavior`    | [codersdk.WorkspaceAgentStartupScriptBehavior](schemas.md#codersdkworkspaceagentstartupscriptbehavior) | false    |              | Startup script behavior is a legacy field that is deprecated in favor of the `coder_script` resource. It's only referenced by old clients. Deprecated: Remove in the future!                                                                   |
+| `»» status`                     | [codersdk.WorkspaceAgentStatus](schemas.md#codersdkworkspaceagentstatus)                               | false    |              |                                                                                                                                                                                                                                                |
+| `»» subsystems`                 | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» troubleshooting_url`        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» updated_at`                 | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `»» version`                    | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» created_at`                  | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
+| `» daily_cost`                  | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `» hide`                        | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `» icon`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» id`                          | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» job_id`                      | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» metadata`                    | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
+| `»» key`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `»» sensitive`                  | boolean                                                                                                | false    |              |                                                                                                                                                                                                                                                |
+| `»» value`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» name`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» type`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
+| `» workspace_transition`        | [codersdk.WorkspaceTransition](schemas.md#codersdkworkspacetransition)                                 | false    |              |                                                                                                                                                                                                                                                |
 
 #### Enumerated Values
 
@@ -2158,7 +2345,6 @@ Status Code **200**
 | `status`                  | `connected`        |
 | `status`                  | `disconnected`     |
 | `status`                  | `timeout`          |
-| `subsystem`               | `envbox`           |
 | `workspace_transition`    | `start`            |
 | `workspace_transition`    | `stop`             |
 | `workspace_transition`    | `delete`           |
@@ -2291,6 +2477,50 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/s
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
+## Unarchive template version
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X POST http://coder-server:8080/api/v2/templateversions/{templateversion}/unarchive \
+  -H 'Accept: application/json' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`POST /templateversions/{templateversion}/unarchive`
+
+### Parameters
+
+| Name              | In   | Type         | Required | Description         |
+| ----------------- | ---- | ------------ | -------- | ------------------- |
+| `templateversion` | path | string(uuid) | true     | Template version ID |
+
+### Example responses
+
+> 200 Response
+
+```json
+{
+  "detail": "string",
+  "message": "string",
+  "validations": [
+    {
+      "detail": "string",
+      "field": "string"
+    }
+  ]
+}
+```
+
+### Responses
+
+| Status | Meaning                                                 | Description | Schema                                           |
+| ------ | ------------------------------------------------------- | ----------- | ------------------------------------------------ |
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.Response](schemas.md#codersdkresponse) |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
 ## Get template variables by template version
 
 ### Code samples
diff --git a/docs/api/users.md b/docs/api/users.md
index 3c583e15787db..1ea652b3ab2ef 100644
--- a/docs/api/users.md
+++ b/docs/api/users.md
@@ -36,7 +36,7 @@ curl -X GET http://coder-server:8080/api/v2/users \
       "email": "user@example.com",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "last_seen_at": "2019-08-24T14:15:22Z",
-      "login_type": "password",
+      "login_type": "",
       "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
       "roles": [
         {
@@ -79,6 +79,7 @@ curl -X POST http://coder-server:8080/api/v2/users \
 {
   "disable_login": true,
   "email": "user@example.com",
+  "login_type": "",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
   "password": "string",
   "username": "string"
@@ -102,7 +103,7 @@ curl -X POST http://coder-server:8080/api/v2/users \
   "email": "user@example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "last_seen_at": "2019-08-24T14:15:22Z",
-  "login_type": "password",
+  "login_type": "",
   "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
   "roles": [
     {
@@ -345,9 +346,9 @@ curl -X GET http://coder-server:8080/api/v2/users/{user} \
 
 ### Parameters
 
-| Name   | In   | Type   | Required | Description          |
-| ------ | ---- | ------ | -------- | -------------------- |
-| `user` | path | string | true     | User ID, name, or me |
+| Name   | In   | Type   | Required | Description              |
+| ------ | ---- | ------ | -------- | ------------------------ |
+| `user` | path | string | true     | User ID, username, or me |
 
 ### Example responses
 
@@ -360,7 +361,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user} \
   "email": "user@example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "last_seen_at": "2019-08-24T14:15:22Z",
-  "login_type": "password",
+  "login_type": "",
   "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
   "roles": [
     {
@@ -411,7 +412,7 @@ curl -X DELETE http://coder-server:8080/api/v2/users/{user} \
   "email": "user@example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "last_seen_at": "2019-08-24T14:15:22Z",
-  "login_type": "password",
+  "login_type": "",
   "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
   "roles": [
     {
@@ -821,7 +822,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/login-type \
 
 ```json
 {
-  "login_type": "password"
+  "login_type": ""
 }
 ```
 
@@ -1005,7 +1006,7 @@ curl -X PUT http://coder-server:8080/api/v2/users/{user}/profile \
   "email": "user@example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "last_seen_at": "2019-08-24T14:15:22Z",
-  "login_type": "password",
+  "login_type": "",
   "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
   "roles": [
     {
@@ -1056,7 +1057,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/roles \
   "email": "user@example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "last_seen_at": "2019-08-24T14:15:22Z",
-  "login_type": "password",
+  "login_type": "",
   "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
   "roles": [
     {
@@ -1117,7 +1118,7 @@ curl -X PUT http://coder-server:8080/api/v2/users/{user}/roles \
   "email": "user@example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "last_seen_at": "2019-08-24T14:15:22Z",
-  "login_type": "password",
+  "login_type": "",
   "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
   "roles": [
     {
@@ -1168,7 +1169,7 @@ curl -X PUT http://coder-server:8080/api/v2/users/{user}/status/activate \
   "email": "user@example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "last_seen_at": "2019-08-24T14:15:22Z",
-  "login_type": "password",
+  "login_type": "",
   "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
   "roles": [
     {
@@ -1219,7 +1220,7 @@ curl -X PUT http://coder-server:8080/api/v2/users/{user}/status/suspend \
   "email": "user@example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "last_seen_at": "2019-08-24T14:15:22Z",
-  "login_type": "password",
+  "login_type": "",
   "organization_ids": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
   "roles": [
     {
diff --git a/docs/api/workspaces.md b/docs/api/workspaces.md
index 390a82448886c..3ade42b54e9c9 100644
--- a/docs/api/workspaces.md
+++ b/docs/api/workspaces.md
@@ -18,6 +18,7 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/member
 
 ```json
 {
+  "automatic_updates": "always",
   "autostart_schedule": "string",
   "name": "string",
   "rich_parameter_values": [
@@ -27,6 +28,7 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/member
     }
   ],
   "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
+  "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "ttl_ms": 0
 }
 ```
@@ -45,9 +47,11 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/member
 
 ```json
 {
+  "automatic_updates": "always",
   "autostart_schedule": "string",
   "created_at": "2019-08-24T14:15:22Z",
   "deleting_at": "2019-08-24T14:15:22Z",
+  "dormant_at": "2019-08-24T14:15:22Z",
   "health": {
     "failing_agents": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
     "healthy": false
@@ -67,7 +71,7 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/member
       "completed_at": "2019-08-24T14:15:22Z",
       "created_at": "2019-08-24T14:15:22Z",
       "error": "string",
-      "error_code": "MISSING_TEMPLATE_PARAMETER",
+      "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "queue_position": 0,
@@ -102,6 +106,7 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/member
                 "sharing_level": "owner",
                 "slug": "string",
                 "subdomain": true,
+                "subdomain_name": "string",
                 "url": "string"
               }
             ],
@@ -110,6 +115,7 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/member
             "created_at": "2019-08-24T14:15:22Z",
             "directory": "string",
             "disconnected_at": "2019-08-24T14:15:22Z",
+            "display_apps": ["vscode"],
             "environment_variables": {
               "property1": "string",
               "property2": "string"
@@ -134,21 +140,37 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/member
               }
             },
             "lifecycle_state": "created",
-            "login_before_ready": true,
+            "log_sources": [
+              {
+                "created_at": "2019-08-24T14:15:22Z",
+                "display_name": "string",
+                "icon": "string",
+                "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+                "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+              }
+            ],
             "logs_length": 0,
             "logs_overflowed": true,
             "name": "string",
             "operating_system": "string",
             "ready_at": "2019-08-24T14:15:22Z",
             "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-            "shutdown_script": "string",
-            "shutdown_script_timeout_seconds": 0,
+            "scripts": [
+              {
+                "cron": "string",
+                "log_path": "string",
+                "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+                "run_on_start": true,
+                "run_on_stop": true,
+                "script": "string",
+                "start_blocks_login": true,
+                "timeout": 0
+              }
+            ],
             "started_at": "2019-08-24T14:15:22Z",
-            "startup_script": "string",
             "startup_script_behavior": "blocking",
-            "startup_script_timeout_seconds": 0,
             "status": "connecting",
-            "subsystem": "envbox",
+            "subsystems": ["envbox"],
             "troubleshooting_url": "string",
             "updated_at": "2019-08-24T14:15:22Z",
             "version": "string"
@@ -182,17 +204,18 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/member
     "workspace_owner_id": "e7078695-5279-4c86-8774-3ac2367a2fc7",
     "workspace_owner_name": "string"
   },
-  "locked_at": "2019-08-24T14:15:22Z",
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
   "outdated": true,
   "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
   "owner_name": "string",
+  "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
   "template_allow_user_cancel_workspace_jobs": true,
   "template_display_name": "string",
   "template_icon": "string",
   "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
   "template_name": "string",
+  "template_require_active_version": true,
   "ttl_ms": 0,
   "updated_at": "2019-08-24T14:15:22Z"
 }
@@ -233,9 +256,11 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
 
 ```json
 {
+  "automatic_updates": "always",
   "autostart_schedule": "string",
   "created_at": "2019-08-24T14:15:22Z",
   "deleting_at": "2019-08-24T14:15:22Z",
+  "dormant_at": "2019-08-24T14:15:22Z",
   "health": {
     "failing_agents": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
     "healthy": false
@@ -255,7 +280,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
       "completed_at": "2019-08-24T14:15:22Z",
       "created_at": "2019-08-24T14:15:22Z",
       "error": "string",
-      "error_code": "MISSING_TEMPLATE_PARAMETER",
+      "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "queue_position": 0,
@@ -290,6 +315,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
                 "sharing_level": "owner",
                 "slug": "string",
                 "subdomain": true,
+                "subdomain_name": "string",
                 "url": "string"
               }
             ],
@@ -298,6 +324,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
             "created_at": "2019-08-24T14:15:22Z",
             "directory": "string",
             "disconnected_at": "2019-08-24T14:15:22Z",
+            "display_apps": ["vscode"],
             "environment_variables": {
               "property1": "string",
               "property2": "string"
@@ -322,21 +349,37 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
               }
             },
             "lifecycle_state": "created",
-            "login_before_ready": true,
+            "log_sources": [
+              {
+                "created_at": "2019-08-24T14:15:22Z",
+                "display_name": "string",
+                "icon": "string",
+                "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+                "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+              }
+            ],
             "logs_length": 0,
             "logs_overflowed": true,
             "name": "string",
             "operating_system": "string",
             "ready_at": "2019-08-24T14:15:22Z",
             "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-            "shutdown_script": "string",
-            "shutdown_script_timeout_seconds": 0,
+            "scripts": [
+              {
+                "cron": "string",
+                "log_path": "string",
+                "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+                "run_on_start": true,
+                "run_on_stop": true,
+                "script": "string",
+                "start_blocks_login": true,
+                "timeout": 0
+              }
+            ],
             "started_at": "2019-08-24T14:15:22Z",
-            "startup_script": "string",
             "startup_script_behavior": "blocking",
-            "startup_script_timeout_seconds": 0,
             "status": "connecting",
-            "subsystem": "envbox",
+            "subsystems": ["envbox"],
             "troubleshooting_url": "string",
             "updated_at": "2019-08-24T14:15:22Z",
             "version": "string"
@@ -370,17 +413,18 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
     "workspace_owner_id": "e7078695-5279-4c86-8774-3ac2367a2fc7",
     "workspace_owner_name": "string"
   },
-  "locked_at": "2019-08-24T14:15:22Z",
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
   "outdated": true,
   "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
   "owner_name": "string",
+  "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
   "template_allow_user_cancel_workspace_jobs": true,
   "template_display_name": "string",
   "template_icon": "string",
   "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
   "template_name": "string",
+  "template_require_active_version": true,
   "ttl_ms": 0,
   "updated_at": "2019-08-24T14:15:22Z"
 }
@@ -424,9 +468,11 @@ curl -X GET http://coder-server:8080/api/v2/workspaces \
   "count": 0,
   "workspaces": [
     {
+      "automatic_updates": "always",
       "autostart_schedule": "string",
       "created_at": "2019-08-24T14:15:22Z",
       "deleting_at": "2019-08-24T14:15:22Z",
+      "dormant_at": "2019-08-24T14:15:22Z",
       "health": {
         "failing_agents": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
         "healthy": false
@@ -446,7 +492,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces \
           "completed_at": "2019-08-24T14:15:22Z",
           "created_at": "2019-08-24T14:15:22Z",
           "error": "string",
-          "error_code": "MISSING_TEMPLATE_PARAMETER",
+          "error_code": "REQUIRED_TEMPLATE_VARIABLES",
           "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
           "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
           "queue_position": 0,
@@ -477,6 +523,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces \
                     "sharing_level": "owner",
                     "slug": "string",
                     "subdomain": true,
+                    "subdomain_name": "string",
                     "url": "string"
                   }
                 ],
@@ -485,6 +532,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces \
                 "created_at": "2019-08-24T14:15:22Z",
                 "directory": "string",
                 "disconnected_at": "2019-08-24T14:15:22Z",
+                "display_apps": ["vscode"],
                 "environment_variables": {
                   "property1": "string",
                   "property2": "string"
@@ -509,21 +557,37 @@ curl -X GET http://coder-server:8080/api/v2/workspaces \
                   }
                 },
                 "lifecycle_state": "created",
-                "login_before_ready": true,
+                "log_sources": [
+                  {
+                    "created_at": "2019-08-24T14:15:22Z",
+                    "display_name": "string",
+                    "icon": "string",
+                    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+                    "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+                  }
+                ],
                 "logs_length": 0,
                 "logs_overflowed": true,
                 "name": "string",
                 "operating_system": "string",
                 "ready_at": "2019-08-24T14:15:22Z",
                 "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-                "shutdown_script": "string",
-                "shutdown_script_timeout_seconds": 0,
+                "scripts": [
+                  {
+                    "cron": "string",
+                    "log_path": "string",
+                    "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+                    "run_on_start": true,
+                    "run_on_stop": true,
+                    "script": "string",
+                    "start_blocks_login": true,
+                    "timeout": 0
+                  }
+                ],
                 "started_at": "2019-08-24T14:15:22Z",
-                "startup_script": "string",
                 "startup_script_behavior": "blocking",
-                "startup_script_timeout_seconds": 0,
                 "status": "connecting",
-                "subsystem": "envbox",
+                "subsystems": ["envbox"],
                 "troubleshooting_url": "string",
                 "updated_at": "2019-08-24T14:15:22Z",
                 "version": "string"
@@ -557,17 +621,18 @@ curl -X GET http://coder-server:8080/api/v2/workspaces \
         "workspace_owner_id": "e7078695-5279-4c86-8774-3ac2367a2fc7",
         "workspace_owner_name": "string"
       },
-      "locked_at": "2019-08-24T14:15:22Z",
       "name": "string",
       "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
       "outdated": true,
       "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
       "owner_name": "string",
+      "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
       "template_allow_user_cancel_workspace_jobs": true,
       "template_display_name": "string",
       "template_icon": "string",
       "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
       "template_name": "string",
+      "template_require_active_version": true,
       "ttl_ms": 0,
       "updated_at": "2019-08-24T14:15:22Z"
     }
@@ -609,9 +674,11 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace} \
 
 ```json
 {
+  "automatic_updates": "always",
   "autostart_schedule": "string",
   "created_at": "2019-08-24T14:15:22Z",
   "deleting_at": "2019-08-24T14:15:22Z",
+  "dormant_at": "2019-08-24T14:15:22Z",
   "health": {
     "failing_agents": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
     "healthy": false
@@ -631,7 +698,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace} \
       "completed_at": "2019-08-24T14:15:22Z",
       "created_at": "2019-08-24T14:15:22Z",
       "error": "string",
-      "error_code": "MISSING_TEMPLATE_PARAMETER",
+      "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "queue_position": 0,
@@ -666,6 +733,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace} \
                 "sharing_level": "owner",
                 "slug": "string",
                 "subdomain": true,
+                "subdomain_name": "string",
                 "url": "string"
               }
             ],
@@ -674,6 +742,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace} \
             "created_at": "2019-08-24T14:15:22Z",
             "directory": "string",
             "disconnected_at": "2019-08-24T14:15:22Z",
+            "display_apps": ["vscode"],
             "environment_variables": {
               "property1": "string",
               "property2": "string"
@@ -698,21 +767,37 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace} \
               }
             },
             "lifecycle_state": "created",
-            "login_before_ready": true,
+            "log_sources": [
+              {
+                "created_at": "2019-08-24T14:15:22Z",
+                "display_name": "string",
+                "icon": "string",
+                "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+                "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+              }
+            ],
             "logs_length": 0,
             "logs_overflowed": true,
             "name": "string",
             "operating_system": "string",
             "ready_at": "2019-08-24T14:15:22Z",
             "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
-            "shutdown_script": "string",
-            "shutdown_script_timeout_seconds": 0,
+            "scripts": [
+              {
+                "cron": "string",
+                "log_path": "string",
+                "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+                "run_on_start": true,
+                "run_on_stop": true,
+                "script": "string",
+                "start_blocks_login": true,
+                "timeout": 0
+              }
+            ],
             "started_at": "2019-08-24T14:15:22Z",
-            "startup_script": "string",
             "startup_script_behavior": "blocking",
-            "startup_script_timeout_seconds": 0,
             "status": "connecting",
-            "subsystem": "envbox",
+            "subsystems": ["envbox"],
             "troubleshooting_url": "string",
             "updated_at": "2019-08-24T14:15:22Z",
             "version": "string"
@@ -746,17 +831,18 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace} \
     "workspace_owner_id": "e7078695-5279-4c86-8774-3ac2367a2fc7",
     "workspace_owner_name": "string"
   },
-  "locked_at": "2019-08-24T14:15:22Z",
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
   "outdated": true,
   "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
   "owner_name": "string",
+  "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
   "template_allow_user_cancel_workspace_jobs": true,
   "template_display_name": "string",
   "template_icon": "string",
   "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
   "template_name": "string",
+  "template_require_active_version": true,
   "ttl_ms": 0,
   "updated_at": "2019-08-24T14:15:22Z"
 }
@@ -842,34 +928,70 @@ curl -X PUT http://coder-server:8080/api/v2/workspaces/{workspace}/autostart \
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
-## Extend workspace deadline by ID
+## Update workspace automatic updates by ID
 
 ### Code samples
 
 ```shell
 # Example request using curl
-curl -X PUT http://coder-server:8080/api/v2/workspaces/{workspace}/extend \
+curl -X PUT http://coder-server:8080/api/v2/workspaces/{workspace}/autoupdates \
+  -H 'Content-Type: application/json' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`PUT /workspaces/{workspace}/autoupdates`
+
+> Body parameter
+
+```json
+{
+  "automatic_updates": "always"
+}
+```
+
+### Parameters
+
+| Name        | In   | Type                                                                                                         | Required | Description               |
+| ----------- | ---- | ------------------------------------------------------------------------------------------------------------ | -------- | ------------------------- |
+| `workspace` | path | string(uuid)                                                                                                 | true     | Workspace ID              |
+| `body`      | body | [codersdk.UpdateWorkspaceAutomaticUpdatesRequest](schemas.md#codersdkupdateworkspaceautomaticupdatesrequest) | true     | Automatic updates request |
+
+### Responses
+
+| Status | Meaning                                                         | Description | Schema |
+| ------ | --------------------------------------------------------------- | ----------- | ------ |
+| 204    | [No Content](https://tools.ietf.org/html/rfc7231#section-6.3.5) | No Content  |        |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
+## Update workspace dormancy status by id.
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X PUT http://coder-server:8080/api/v2/workspaces/{workspace}/dormant \
   -H 'Content-Type: application/json' \
   -H 'Accept: application/json' \
   -H 'Coder-Session-Token: API_KEY'
 ```
 
-`PUT /workspaces/{workspace}/extend`
+`PUT /workspaces/{workspace}/dormant`
 
 > Body parameter
 
 ```json
 {
-  "deadline": "2019-08-24T14:15:22Z"
+  "dormant": true
 }
 ```
 
 ### Parameters
 
-| Name        | In   | Type                                                                               | Required | Description                    |
-| ----------- | ---- | ---------------------------------------------------------------------------------- | -------- | ------------------------------ |
-| `workspace` | path | string(uuid)                                                                       | true     | Workspace ID                   |
-| `body`      | body | [codersdk.PutExtendWorkspaceRequest](schemas.md#codersdkputextendworkspacerequest) | true     | Extend deadline update request |
+| Name        | In   | Type                                                                           | Required | Description                        |
+| ----------- | ---- | ------------------------------------------------------------------------------ | -------- | ---------------------------------- |
+| `workspace` | path | string(uuid)                                                                   | true     | Workspace ID                       |
+| `body`      | body | [codersdk.UpdateWorkspaceDormancy](schemas.md#codersdkupdateworkspacedormancy) | true     | Make a workspace dormant or active |
 
 ### Example responses
 
@@ -877,53 +999,216 @@ curl -X PUT http://coder-server:8080/api/v2/workspaces/{workspace}/extend \
 
 ```json
 {
-  "detail": "string",
-  "message": "string",
-  "validations": [
-    {
-      "detail": "string",
-      "field": "string"
-    }
-  ]
+  "automatic_updates": "always",
+  "autostart_schedule": "string",
+  "created_at": "2019-08-24T14:15:22Z",
+  "deleting_at": "2019-08-24T14:15:22Z",
+  "dormant_at": "2019-08-24T14:15:22Z",
+  "health": {
+    "failing_agents": ["497f6eca-6276-4993-bfeb-53cbbbba6f08"],
+    "healthy": false
+  },
+  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+  "last_used_at": "2019-08-24T14:15:22Z",
+  "latest_build": {
+    "build_number": 0,
+    "created_at": "2019-08-24T14:15:22Z",
+    "daily_cost": 0,
+    "deadline": "2019-08-24T14:15:22Z",
+    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
+    "initiator_name": "string",
+    "job": {
+      "canceled_at": "2019-08-24T14:15:22Z",
+      "completed_at": "2019-08-24T14:15:22Z",
+      "created_at": "2019-08-24T14:15:22Z",
+      "error": "string",
+      "error_code": "REQUIRED_TEMPLATE_VARIABLES",
+      "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
+      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "queue_position": 0,
+      "queue_size": 0,
+      "started_at": "2019-08-24T14:15:22Z",
+      "status": "pending",
+      "tags": {
+        "property1": "string",
+        "property2": "string"
+      },
+      "worker_id": "ae5fa6f7-c55b-40c1-b40a-b36ac467652b"
+    },
+    "max_deadline": "2019-08-24T14:15:22Z",
+    "reason": "initiator",
+    "resources": [
+      {
+        "agents": [
+          {
+            "apps": [
+              {
+                "command": "string",
+                "display_name": "string",
+                "external": true,
+                "health": "disabled",
+                "healthcheck": {
+                  "interval": 0,
+                  "threshold": 0,
+                  "url": "string"
+                },
+                "icon": "string",
+                "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+                "sharing_level": "owner",
+                "slug": "string",
+                "subdomain": true,
+                "subdomain_name": "string",
+                "url": "string"
+              }
+            ],
+            "architecture": "string",
+            "connection_timeout_seconds": 0,
+            "created_at": "2019-08-24T14:15:22Z",
+            "directory": "string",
+            "disconnected_at": "2019-08-24T14:15:22Z",
+            "display_apps": ["vscode"],
+            "environment_variables": {
+              "property1": "string",
+              "property2": "string"
+            },
+            "expanded_directory": "string",
+            "first_connected_at": "2019-08-24T14:15:22Z",
+            "health": {
+              "healthy": false,
+              "reason": "agent has lost connection"
+            },
+            "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+            "instance_id": "string",
+            "last_connected_at": "2019-08-24T14:15:22Z",
+            "latency": {
+              "property1": {
+                "latency_ms": 0,
+                "preferred": true
+              },
+              "property2": {
+                "latency_ms": 0,
+                "preferred": true
+              }
+            },
+            "lifecycle_state": "created",
+            "log_sources": [
+              {
+                "created_at": "2019-08-24T14:15:22Z",
+                "display_name": "string",
+                "icon": "string",
+                "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+                "workspace_agent_id": "7ad2e618-fea7-4c1a-b70a-f501566a72f1"
+              }
+            ],
+            "logs_length": 0,
+            "logs_overflowed": true,
+            "name": "string",
+            "operating_system": "string",
+            "ready_at": "2019-08-24T14:15:22Z",
+            "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
+            "scripts": [
+              {
+                "cron": "string",
+                "log_path": "string",
+                "log_source_id": "4197ab25-95cf-4b91-9c78-f7f2af5d353a",
+                "run_on_start": true,
+                "run_on_stop": true,
+                "script": "string",
+                "start_blocks_login": true,
+                "timeout": 0
+              }
+            ],
+            "started_at": "2019-08-24T14:15:22Z",
+            "startup_script_behavior": "blocking",
+            "status": "connecting",
+            "subsystems": ["envbox"],
+            "troubleshooting_url": "string",
+            "updated_at": "2019-08-24T14:15:22Z",
+            "version": "string"
+          }
+        ],
+        "created_at": "2019-08-24T14:15:22Z",
+        "daily_cost": 0,
+        "hide": true,
+        "icon": "string",
+        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+        "job_id": "453bd7d7-5355-4d6d-a38e-d9e7eb218c3f",
+        "metadata": [
+          {
+            "key": "string",
+            "sensitive": true,
+            "value": "string"
+          }
+        ],
+        "name": "string",
+        "type": "string",
+        "workspace_transition": "start"
+      }
+    ],
+    "status": "pending",
+    "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
+    "template_version_name": "string",
+    "transition": "start",
+    "updated_at": "2019-08-24T14:15:22Z",
+    "workspace_id": "0967198e-ec7b-4c6b-b4d3-f71244cadbe9",
+    "workspace_name": "string",
+    "workspace_owner_id": "e7078695-5279-4c86-8774-3ac2367a2fc7",
+    "workspace_owner_name": "string"
+  },
+  "name": "string",
+  "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+  "outdated": true,
+  "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
+  "owner_name": "string",
+  "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
+  "template_allow_user_cancel_workspace_jobs": true,
+  "template_display_name": "string",
+  "template_icon": "string",
+  "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
+  "template_name": "string",
+  "template_require_active_version": true,
+  "ttl_ms": 0,
+  "updated_at": "2019-08-24T14:15:22Z"
 }
 ```
 
 ### Responses
 
-| Status | Meaning                                                 | Description | Schema                                           |
-| ------ | ------------------------------------------------------- | ----------- | ------------------------------------------------ |
-| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.Response](schemas.md#codersdkresponse) |
+| Status | Meaning                                                 | Description | Schema                                             |
+| ------ | ------------------------------------------------------- | ----------- | -------------------------------------------------- |
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.Workspace](schemas.md#codersdkworkspace) |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
-## Update workspace lock by id.
+## Extend workspace deadline by ID
 
 ### Code samples
 
 ```shell
 # Example request using curl
-curl -X PUT http://coder-server:8080/api/v2/workspaces/{workspace}/lock \
+curl -X PUT http://coder-server:8080/api/v2/workspaces/{workspace}/extend \
   -H 'Content-Type: application/json' \
   -H 'Accept: application/json' \
   -H 'Coder-Session-Token: API_KEY'
 ```
 
-`PUT /workspaces/{workspace}/lock`
+`PUT /workspaces/{workspace}/extend`
 
 > Body parameter
 
 ```json
 {
-  "lock": true
+  "deadline": "2019-08-24T14:15:22Z"
 }
 ```
 
 ### Parameters
 
-| Name        | In   | Type                                                                   | Required | Description                |
-| ----------- | ---- | ---------------------------------------------------------------------- | -------- | -------------------------- |
-| `workspace` | path | string(uuid)                                                           | true     | Workspace ID               |
-| `body`      | body | [codersdk.UpdateWorkspaceLock](schemas.md#codersdkupdateworkspacelock) | true     | Lock or unlock a workspace |
+| Name        | In   | Type                                                                               | Required | Description                    |
+| ----------- | ---- | ---------------------------------------------------------------------------------- | -------- | ------------------------------ |
+| `workspace` | path | string(uuid)                                                                       | true     | Workspace ID                   |
+| `body`      | body | [codersdk.PutExtendWorkspaceRequest](schemas.md#codersdkputextendworkspacerequest) | true     | Extend deadline update request |
 
 ### Example responses
 
diff --git a/docs/changelogs/README.md b/docs/changelogs/README.md
index e5740216e4f87..753c7ecbd5abb 100644
--- a/docs/changelogs/README.md
+++ b/docs/changelogs/README.md
@@ -1,17 +1,20 @@
 # Changelogs
 
-These are the changelogs used by [get-changelog.sh](https://github.com/coder/coder/blob/main/scripts/release/changelog.sh) for a release.
+These are the changelogs used by [generate_release_notes.sh]https://github.com/coder/coder/blob/main/scripts/release/generate_release_notes.sh) for a release.
 
-These changelogs are currently not kept in-sync with GitHub releases. Use [GitHub releases](https://github.com/coder/coder/releases) for the latest information!
+These changelogs are currently not kept in sync with GitHub releases. Use [GitHub releases](https://github.com/coder/coder/releases) for the latest information!
 
 ## Writing a changelog
 
 Run this command to generate release notes:
 
-```sh
+```shell
+git checkout main; git pull; git fetch --all
+export CODER_IGNORE_MISSING_COMMIT_METADATA=1
+export BRANCH=main
 ./scripts/release/generate_release_notes.sh \
-  --old-version=v0.27.0 \
-  --new-version=v0.28.0 \
-  --ref=$(git rev-parse --short "${ref:-origin/$branch}") \
-  > ./docs/changelogs/v0.28.0.md
+  --old-version=v2.3.3 \
+  --new-version=v2.3.4 \
+  --ref=$(git rev-parse --short "${ref:-origin/$BRANCH}") \
+  > ./docs/changelogs/v2.3.4.md
 ```
diff --git a/docs/changelogs/v0.25.0.md b/docs/changelogs/v0.25.0.md
index 26411eba3b16b..e31fd0dbf959d 100644
--- a/docs/changelogs/v0.25.0.md
+++ b/docs/changelogs/v0.25.0.md
@@ -1,17 +1,27 @@
 ## Changelog
 
-> **Warning**: This release has a known issue: #8351. Upgrade directly to v0.26.0 which includes a fix
+> **Warning**: This release has a known issue: #8351. Upgrade directly to
+> v0.26.0 which includes a fix
 
 ### Features
 
-- The `coder stat` fetches workspace utilization metrics, even from within a container. Our example templates have been updated to use this to show CPU, memory, disk via [agent metadata](https://coder.com/docs/v2/latest/templates/agent-metadata) (#8005)
-- Helm: `coder.command` can specify a different command for the Coder pod (#8116)
-- Enterprise deployments can create templates without 'everyone' group access (#7982)
+- The `coder stat` fetches workspace utilization metrics, even from within a
+  container. Our example templates have been updated to use this to show CPU,
+  memory, disk via
+  [agent metadata](https://coder.com/docs/v2/latest/templates/agent-metadata)
+  (#8005)
+- Helm: `coder.command` can specify a different command for the Coder pod
+  (#8116)
+- Enterprise deployments can create templates without 'everyone' group access
+  (#7982)
   ![Disable "everyone"](https://github.com/coder/coder/assets/22407953/1c31cb9b-be5c-4bef-abee-324856734215)
-- Add login type 'none' to prevent password login. This can come in handy for machine accounts for CI/CD pipelines or other automation (#8009)
+- Add login type 'none' to prevent password login. This can come in handy for
+  machine accounts for CI/CD pipelines or other automation (#8009)
 - Healthcheck endpoint has a database section: `/api/v2/debug/health`
 - Force DERP connections in CLI with `--disable-direct` flag (#8131)
-- Disable all direct connections for a Coder deployment with [--block-direct-connections](https://coder.com/docs/v2/latest/cli/server#--block-direct-connections) (#7936)
+- Disable all direct connections for a Coder deployment with
+  [--block-direct-connections](https://coder.com/docs/v2/latest/cli/server#--block-direct-connections)
+  (#7936)
 - Search for workspaces based on last activity (#2658)
   ```text
   last_seen_before:"2023-01-14T23:59:59Z" last_seen_after:"2023-01-08T00:00:00Z"
@@ -20,8 +30,11 @@
   <img width="1449" alt="Queue position" src="https://github.com/coder/coder/assets/22407953/44515a19-ddfb-4431-8c2a-203487c4efe8">
 - Enable Terraform debug mode via deployment configuration (#8260)
 - Add github device flow for authentication (#8232)
-- Sort Coder parameters with [display_order](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/parameter) property (#8227)
-- Users can convert from username/password accounts to OIDC accounts in Account settings (#8105) (@Emyrk)
+- Sort Coder parameters with
+  [display_order](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/parameter)
+  property (#8227)
+- Users can convert from username/password accounts to OIDC accounts in Account
+  settings (#8105) (@Emyrk)
   ![Convert account](https://github.com/coder/coder/assets/22407953/6ea28c1c-53d7-4eb5-8113-9a066739820c)
 - Show service banner in SSH/TTY sessions (#8186)
 - Helm chart now supports RBAC for deployments (#8233)
@@ -29,7 +42,8 @@
 ### Bug fixes
 
 - `coder logout` will not invalidate long-lived API tokens (#8275)
-- Helm: use `/healthz` for liveness and readiness probes instead of `/api/v2/buildinfo` (#8035)
+- Helm: use `/healthz` for liveness and readiness probes instead of
+  `/api/v2/buildinfo` (#8035)
 - Close output writer before reader on Windows to unblock close (#8299)
 - Resize terminal when dismissing warning (#8028)
 - Fix footer year (#8036)
@@ -57,9 +71,11 @@
 - Add default dir for VS Code Desktop (#8184)
 - Agent metadata is now GA (#8111) (@bpmct)
 - Note SSH key location in workspaces (#8264)
-- Update examples of IDEs: remove JetBrains Projector and add VS Code Server (#8310)
+- Update examples of IDEs: remove JetBrains Projector and add VS Code Server
+  (#8310)
 
-Compare: [`v0.24.1...v0.25.0`](https://github.com/coder/coder/compare/v0.24.1...v0.25.0)
+Compare:
+[`v0.24.1...v0.25.0`](https://github.com/coder/coder/compare/v0.24.1...v0.25.0)
 
 ## Container image
 
@@ -67,4 +83,6 @@ Compare: [`v0.24.1...v0.25.0`](https://github.com/coder/coder/compare/v0.24.1...
 
 ## Install/upgrade
 
-Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v0.26.0.md b/docs/changelogs/v0.26.0.md
index cdba94c5d8ffc..b5b24929dfc90 100644
--- a/docs/changelogs/v0.26.0.md
+++ b/docs/changelogs/v0.26.0.md
@@ -2,7 +2,9 @@
 
 ### Important changes
 
-- [Managed variables](https://coder.com/docs/v2/latest/templates/parameters#terraform-template-wide-variables) are enabled by default. The following block within templates is obsolete and can be removed from your templates:
+- [Managed variables](https://coder.com/docs/v2/latest/templates/parameters#terraform-template-wide-variables)
+  are enabled by default. The following block within templates is obsolete and
+  can be removed from your templates:
 
   ```diff
   provider "coder" {
@@ -10,19 +12,26 @@
   }
   ```
 
-  > The change does not affect your templates because this attribute was previously necessary to activate this additional feature.
+  > The change does not affect your templates because this attribute was
+  > previously necessary to activate this additional feature.
 
-- Our scale test CLI is [experimental](https://coder.com/docs/v2/latest/contributing/feature-stages#experimental-features) to allow for rapid iteration. You can still interact with it via `coder exp scaletest` (#8339)
+- Our scale test CLI is
+  [experimental](https://coder.com/docs/v2/latest/contributing/feature-stages#experimental-features)
+  to allow for rapid iteration. You can still interact with it via
+  `coder exp scaletest` (#8339)
 
 ### Features
 
-- [coder dotfiles](https://coder.com/docs/v2/latest/cli/dotfiles) can checkout a specific branch
+- [coder dotfiles](https://coder.com/docs/v2/latest/cli/dotfiles) can checkout a
+  specific branch
 
 ### Bug fixes
 
-- Delay "Workspace build is pending" banner to avoid quick re-render when a workspace is created (#8309)
+- Delay "Workspace build is pending" banner to avoid quick re-render when a
+  workspace is created (#8309)
 - `coder stat` handles cgroups with no limits
-- Remove concurrency to allow migrations when `coderd` runs on multiple replicas (#8353)
+- Remove concurrency to allow migrations when `coderd` runs on multiple replicas
+  (#8353)
 - Pass oauth configs to site (#8390)
 - Improve error message for missing action in Audit log (#8335)
 - Add missing fields to extract api key config (#8393)
@@ -31,7 +40,8 @@
 - Resolve nil pointer dereference on missing oauth config (#8352)
 - Update fly.io example to remove deprecated parameters (#8194)
 
-Compare: [`v0.25.0...0.26.0`](https://github.com/coder/coder/compare/v0.25.0...v0.26.0)
+Compare:
+[`v0.25.0...0.26.0`](https://github.com/coder/coder/compare/v0.25.0...v0.26.0)
 
 ## Container image
 
@@ -39,4 +49,6 @@ Compare: [`v0.25.0...0.26.0`](https://github.com/coder/coder/compare/v0.25.0...v
 
 ## Install/upgrade
 
-Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v0.26.1.md b/docs/changelogs/v0.26.1.md
index b3b7840a51520..87f5938972aa5 100644
--- a/docs/changelogs/v0.26.1.md
+++ b/docs/changelogs/v0.26.1.md
@@ -2,13 +2,16 @@
 
 ### Features
 
-- [Devcontainer templates](https://coder.com/docs/v2/latest/templates/devcontainers) for Coder (#8256)
+- [Devcontainer templates](https://coder.com/docs/v2/latest/templates/devcontainers)
+  for Coder (#8256)
 - The dashboard will warn users when a workspace is unhealthy (#8422)
-- Audit logs `resource_target` search query allows you to search by resource name (#8423)
+- Audit logs `resource_target` search query allows you to search by resource
+  name (#8423)
 
 ### Refactors
 
-- [pgCoordinator](https://github.com/coder/coder/pull/8044) is generally available (#8419)
+- [pgCoordinator](https://github.com/coder/coder/pull/8044) is generally
+  available (#8419)
 
 ### Bug fixes
 
@@ -19,7 +22,8 @@
 - Document workspace filter query param correctly (#8408)
 - Use numeric comparison to check monotonicity (#8436)
 
-Compare: [`v0.26.0...v0.26.1`](https://github.com/coder/coder/compare/v0.26.0...v0.26.1)
+Compare:
+[`v0.26.0...v0.26.1`](https://github.com/coder/coder/compare/v0.26.0...v0.26.1)
 
 ## Container image
 
@@ -27,4 +31,6 @@ Compare: [`v0.26.0...v0.26.1`](https://github.com/coder/coder/compare/v0.26.0...
 
 ## Install/upgrade
 
-Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v0.27.0.md b/docs/changelogs/v0.27.0.md
index c03d4608e6d32..d212579a6fed0 100644
--- a/docs/changelogs/v0.27.0.md
+++ b/docs/changelogs/v0.27.0.md
@@ -4,26 +4,34 @@
 
 Agent logs can be pushed after a workspace has started (#8528)
 
-> ⚠️ **Warning:** You will need to [update](https://coder.com/docs/v2/latest/install) your local Coder CLI v0.27 to connect via `coder ssh`.
+> ⚠️ **Warning:** You will need to
+> [update](https://coder.com/docs/v2/latest/install) your local Coder CLI v0.27
+> to connect via `coder ssh`.
 
 ### Features
 
-- [Empeheral parameters](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/parameter#ephemeral) allow users to specify a value for a single build (#8415) (#8524)
+- [Empeheral parameters](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/parameter#ephemeral)
+  allow users to specify a value for a single build (#8415) (#8524)
   ![Ephemeral parameters](https://github.com/coder/coder/assets/22407953/89df0888-9abc-453a-ac54-f5d0e221b0b9)
-  > Upgrade to Coder Terraform Provider v0.11.1 to use ephemeral parameters in your templates
+  > Upgrade to Coder Terraform Provider v0.11.1 to use ephemeral parameters in
+  > your templates
 - Create template, if it doesn't exist with `templates push --create` (#8454)
-- Workspaces now appear `unhealthy` in the dashboard and CLI if one or more agents do not exist (#8541) (#8548)
+- Workspaces now appear `unhealthy` in the dashboard and CLI if one or more
+  agents do not exist (#8541) (#8548)
   ![Workspace health](https://github.com/coder/coder/assets/22407953/edbb1d70-61b5-4b45-bfe8-51abdab417cc)
 - Reverse port-forward with `coder ssh -R` (#8515)
 - Helm: custom command arguments in Helm chart (#8567)
 - Template version messages (#8435)
   <img width="428" alt="252772262-087f1338-f1e2-49fb-81f2-358070a46484" src="https://github.com/coder/coder/assets/22407953/5f6e5e47-e61b-41f1-92fe-f624e92f8bd3">
 - TTL and max TTL validation increased to 30 days (#8258)
-- [Self-hosted docs](https://coder.com/docs/v2/latest/install/offline#offline-docs): Host your own copy of Coder's documentation in your own environment (#8527) (#8601)
+- [Self-hosted docs](https://coder.com/docs/v2/latest/install/offline#offline-docs):
+  Host your own copy of Coder's documentation in your own environment (#8527)
+  (#8601)
 - Add custom coder bin path for `config-ssh` (#8425)
 - Admins can create workspaces for other users via the CLI (#8481)
 - `coder_app` supports localhost apps running https (#8585)
-- Base container image contains [jq](https://github.com/coder/coder/pull/8563) for parsing mounted JSON secrets
+- Base container image contains [jq](https://github.com/coder/coder/pull/8563)
+  for parsing mounted JSON secrets
 
 ### Bug fixes
 
@@ -31,7 +39,8 @@ Agent logs can be pushed after a workspace has started (#8528)
 - `coder stat` fixes
   - Read from alternate cgroup path (#8591)
   - Improve detection of container environment (#8643)
-  - Unskip TestStatCPUCmd/JSON and explicitly set --host in test cmd invocation (#8558)
+  - Unskip TestStatCPUCmd/JSON and explicitly set --host in test cmd invocation
+    (#8558)
 - Avoid initial license reconfig if feature isn't enabled (#8586)
 - Audit log records delete workspace action properly (#8494)
 - Audit logs are properly paginated (#8513)
@@ -47,26 +56,34 @@ Agent logs can be pushed after a workspace has started (#8528)
 
 Agent logs can be pushed after a workspace has started (#8528)
 
-> ⚠️ **Warning:** You will need to [update](https://coder.com/docs/v2/latest/install) your local Coder CLI v0.27 to connect via `coder ssh`.
+> ⚠️ **Warning:** You will need to
+> [update](https://coder.com/docs/v2/latest/install) your local Coder CLI v0.27
+> to connect via `coder ssh`.
 
 ### Features
 
-- [Empeheral parameters](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/parameter#ephemeral) allow users to specify a value for a single build (#8415) (#8524)
+- [Empeheral parameters](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/parameter#ephemeral)
+  allow users to specify a value for a single build (#8415) (#8524)
   ![Ephemeral parameters](https://github.com/coder/coder/assets/22407953/89df0888-9abc-453a-ac54-f5d0e221b0b9)
-  > Upgrade to Coder Terraform Provider v0.11.1 to use ephemeral parameters in your templates
+  > Upgrade to Coder Terraform Provider v0.11.1 to use ephemeral parameters in
+  > your templates
 - Create template, if it doesn't exist with `templates push --create` (#8454)
-- Workspaces now appear `unhealthy` in the dashboard and CLI if one or more agents do not exist (#8541) (#8548)
+- Workspaces now appear `unhealthy` in the dashboard and CLI if one or more
+  agents do not exist (#8541) (#8548)
   ![Workspace health](https://github.com/coder/coder/assets/22407953/edbb1d70-61b5-4b45-bfe8-51abdab417cc)
 - Reverse port-forward with `coder ssh -R` (#8515)
 - Helm: custom command arguments in Helm chart (#8567)
 - Template version messages (#8435)
   <img width="428" alt="252772262-087f1338-f1e2-49fb-81f2-358070a46484" src="https://github.com/coder/coder/assets/22407953/5f6e5e47-e61b-41f1-92fe-f624e92f8bd3">
 - TTL and max TTL validation increased to 30 days (#8258)
-- [Self-hosted docs](https://coder.com/docs/v2/latest/install/offline#offline-docs): Host your own copy of Coder's documentation in your own environment (#8527) (#8601)
+- [Self-hosted docs](https://coder.com/docs/v2/latest/install/offline#offline-docs):
+  Host your own copy of Coder's documentation in your own environment (#8527)
+  (#8601)
 - Add custom coder bin path for `config-ssh` (#8425)
 - Admins can create workspaces for other users via the CLI (#8481)
 - `coder_app` supports localhost apps running https (#8585)
-- Base container image contains [jq](https://github.com/coder/coder/pull/8563) for parsing mounted JSON secrets
+- Base container image contains [jq](https://github.com/coder/coder/pull/8563)
+  for parsing mounted JSON secrets
 
 ### Bug fixes
 
@@ -74,7 +91,8 @@ Agent logs can be pushed after a workspace has started (#8528)
 - `coder stat` fixes
   - Read from alternate cgroup path (#8591)
   - Improve detection of container environment (#8643)
-  - Unskip TestStatCPUCmd/JSON and explicitly set --host in test cmd invocation (#8558)
+  - Unskip TestStatCPUCmd/JSON and explicitly set --host in test cmd invocation
+    (#8558)
 - Avoid initial license reconfig if feature isn't enabled (#8586)
 - Audit log records delete workspace action properly (#8494)
 - Audit logs are properly paginated (#8513)
@@ -88,7 +106,8 @@ Agent logs can be pushed after a workspace has started (#8528)
 - Docs on using remote Docker hosts (#8479)
 - Added kubernetes option to workspace proxies (#8533)
 
-Compare: [`v0.26.1...v0.26.2`](https://github.com/coder/coder/compare/v0.26.1...v0.27.0)
+Compare:
+[`v0.26.1...v0.26.2`](https://github.com/coder/coder/compare/v0.26.1...v0.27.0)
 
 ## Container image
 
@@ -96,13 +115,16 @@ Compare: [`v0.26.1...v0.26.2`](https://github.com/coder/coder/compare/v0.26.1...
 
 ## Install/upgrade
 
-Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
 
 - Custom API use cases (custom agent logs, CI/CD pipelines) (#8445)
 - Docs on using remote Docker hosts (#8479)
 - Added kubernetes option to workspace proxies (#8533)
 
-Compare: [`v0.26.1...v0.26.2`](https://github.com/coder/coder/compare/v0.26.1...v0.27.0)
+Compare:
+[`v0.26.1...v0.26.2`](https://github.com/coder/coder/compare/v0.26.1...v0.27.0)
 
 ## Container image
 
@@ -110,4 +132,6 @@ Compare: [`v0.26.1...v0.26.2`](https://github.com/coder/coder/compare/v0.26.1...
 
 ## Install/upgrade
 
-Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v0.27.1.md b/docs/changelogs/v0.27.1.md
index 93e5d3b3f4498..7a02b12dbaf37 100644
--- a/docs/changelogs/v0.27.1.md
+++ b/docs/changelogs/v0.27.1.md
@@ -12,7 +12,8 @@
 
 - Add steps for postgres SSL cert config (#8648)
 
-Compare: [`v0.27.0...v0.27.1`](https://github.com/coder/coder/compare/v0.27.0...v0.27.1)
+Compare:
+[`v0.27.0...v0.27.1`](https://github.com/coder/coder/compare/v0.27.0...v0.27.1)
 
 ## Container image
 
@@ -20,4 +21,6 @@ Compare: [`v0.27.0...v0.27.1`](https://github.com/coder/coder/compare/v0.27.0...
 
 ## Install/upgrade
 
-Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v0.27.3.md b/docs/changelogs/v0.27.3.md
index ce87c5a3ceb09..b9bb5a4c1988b 100644
--- a/docs/changelogs/v0.27.3.md
+++ b/docs/changelogs/v0.27.3.md
@@ -6,7 +6,8 @@
 
 - be2e6f443 fix(enterprise): ensure creating a SCIM user is idempotent (#8730)
 
-Compare: [`v0.27.2...v0.27.3`](https://github.com/coder/coder/compare/v0.27.2...v0.27.3)
+Compare:
+[`v0.27.2...v0.27.3`](https://github.com/coder/coder/compare/v0.27.2...v0.27.3)
 
 ## Container image
 
@@ -14,4 +15,6 @@ Compare: [`v0.27.2...v0.27.3`](https://github.com/coder/coder/compare/v0.27.2...
 
 ## Install/upgrade
 
-Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v2.0.0.md b/docs/changelogs/v2.0.0.md
index 4bcfe513c2caf..fb43de0e9581d 100644
--- a/docs/changelogs/v2.0.0.md
+++ b/docs/changelogs/v2.0.0.md
@@ -1,60 +1,106 @@
-We are thrilled to release Coder v2.0.0. You can safely upgrade from any previous
-[coder/coder](https://github.com/coder/coder) release,
-but we feel like we have outgrown development (v0.x) releases:
+We are thrilled to release Coder v2.0.0. You can safely upgrade from any
+previous [coder/coder](https://github.com/coder/coder) release, but we feel like
+we have outgrown development (v0.x) releases:
 
 - 1600+ users develop on Coder every day
-- A single 4-core Coder server can [happily support](https://coder.com/docs/v2/latest/admin/scale) 1000+ users and workspace connections
-- We have a full suite of [paid features](https://coder.com/docs/v2/latest/enterprise) and enterprise customers deployed in production
-- Users depend on our CLI to [automate Coder](https://coder.com/docs/v2/latest/admin/automation) in Ci/Cd pipelines and templates
-
-Why not v1.0? At the time of writing, our legacy product is currently on v1.34. While Coder v1 is being sunset, we still wanted to avoid versioning conflicts.
+- A single 4-core Coder server can
+  [happily support](https://coder.com/docs/v2/latest/admin/scale) 1000+ users
+  and workspace connections
+- We have a full suite of
+  [paid features](https://coder.com/docs/v2/latest/enterprise) and enterprise
+  customers deployed in production
+- Users depend on our CLI to
+  [automate Coder](https://coder.com/docs/v2/latest/admin/automation) in Ci/Cd
+  pipelines and templates
+
+Why not v1.0? At the time of writing, our legacy product is currently on v1.34.
+While Coder v1 is being sunset, we still wanted to avoid versioning conflicts.
 
 What is not changing:
 
 - Our feature roadmap: See what we have planned at https://coder.com/roadmap
-- Your upgrade path: You can safely upgrade from previous coder/coder releases to v2.x releases!
-- Our release cadence: We want features out as quickly as possible and feature flag any work that isn’t ready for production yet!
+- Your upgrade path: You can safely upgrade from previous coder/coder releases
+  to v2.x releases!
+- Our release cadence: We want features out as quickly as possible and feature
+  flag any work that isn’t ready for production yet!
 
 What is changing:
 
-- Our deprecation policy: Major features will be deprecated for at least 1 minor release before being removed. Any breaking changes to the REST API and SDK are done via minor releases and will be called out in our changelog.
-- Regular scale testing: Follow along on our [ Google Sheets or Grafana dashboard ]
+- Our deprecation policy: Major features will be deprecated for at least 1 minor
+  release before being removed. Any breaking changes to the REST API and SDK are
+  done via minor releases and will be called out in our changelog.
+- Regular scale testing: Follow along on our [ Google Sheets or Grafana
+  dashboard ]
 
-Questions? Feel free to ask in [our Discord](https://discord.gg/coder) or email ben@coder.com!
+Questions? Feel free to ask in [our Discord](https://discord.gg/coder) or email
+ben@coder.com!
 
 ## Changelog
 
 ### BREAKING CHANGES
 
-- RBAC: The default [Member role](https://coder.com/docs/v2/latest/admin/users) can no longer see a list of all users in a Coder deployment. The Template Admin role and above can still use the `Users` page in dashboard and query users via the API (#8650) (@Emyrk)
-- Kubernetes (Helm): The [default ServiceAccount](https://github.com/coder/coder/blob/8d0e8f45e0fb3802d777a396b4c027ab9788e1b8/helm/values.yaml#L67-L82) for Coder can provision `Deployments` on the cluster. (#8704) (@ericpaulsen)
-  - This can be disabled by a [Helm value](https://github.com/coder/coder/blob/8d0e8f45e0fb3802d777a396b4c027ab9788e1b8/helm/values.yaml#L78)
-  - Our [Kubernetes example template](https://github.com/coder/coder/tree/main/examples/templates/kubernetes) uses a `kubernetes_deployment` instead of `kubernetes_pod` since it works best with [log streaming](https://coder.com/docs/v2/latest/platforms/kubernetes/deployment-logs) in Coder.
+- RBAC: The default [Member role](https://coder.com/docs/v2/latest/admin/users)
+  can no longer see a list of all users in a Coder deployment. The Template
+  Admin role and above can still use the `Users` page in dashboard and query
+  users via the API (#8650) (@Emyrk)
+- Kubernetes (Helm): The
+  [default ServiceAccount](https://github.com/coder/coder/blob/8d0e8f45e0fb3802d777a396b4c027ab9788e1b8/helm/values.yaml#L67-L82)
+  for Coder can provision `Deployments` on the cluster. (#8704) (@ericpaulsen)
+  - This can be disabled by a
+    [Helm value](https://github.com/coder/coder/blob/8d0e8f45e0fb3802d777a396b4c027ab9788e1b8/helm/values.yaml#L78)
+  - Our
+    [Kubernetes example template](https://github.com/coder/coder/tree/main/examples/templates/kubernetes)
+    uses a `kubernetes_deployment` instead of `kubernetes_pod` since it works
+    best with
+    [log streaming](https://coder.com/docs/v2/latest/platforms/kubernetes/deployment-logs)
+    in Coder.
 
 ### Features
 
-- Template insights: Admins can see daily active users, user latency, and popular IDEs (#8722) (@BrunoQuaresma)
+- Template insights: Admins can see daily active users, user latency, and
+  popular IDEs (#8722) (@BrunoQuaresma)
   ![Template insights](https://user-images.githubusercontent.com/22407953/258239988-69641bd6-28da-4c60-9ae7-c0b1bba53859.png)
-- [Kubernetes log streaming](https://coder.com/docs/v2/latest/platforms/kubernetes/deployment-logs): Stream Kubernetes event logs to the Coder agent logs to reveal Kuernetes-level issues such as ResourceQuota limitations, invalid images, etc.
+- [Kubernetes log streaming](https://coder.com/docs/v2/latest/platforms/kubernetes/deployment-logs):
+  Stream Kubernetes event logs to the Coder agent logs to reveal Kuernetes-level
+  issues such as ResourceQuota limitations, invalid images, etc.
   ![Kubernetes quota](https://raw.githubusercontent.com/coder/coder/main/docs/platforms/kubernetes/coder-logstream-kube-logs-quota-exceeded.png)
-- [OIDC Role Sync](https://coder.com/docs/v2/latest/admin/auth#group-sync-enterprise) (Enterprise): Sync roles from your OIDC provider to Coder roles (e.g. `Template Admin`) (#8595) (@Emyrk)
-- Users can convert their accounts from username/password authentication to SSO by linking their account (#8742) (@Emyrk)
+- [OIDC Role Sync](https://coder.com/docs/v2/latest/admin/auth#group-sync-enterprise)
+  (Enterprise): Sync roles from your OIDC provider to Coder roles (e.g.
+  `Template Admin`) (#8595) (@Emyrk)
+- Users can convert their accounts from username/password authentication to SSO
+  by linking their account (#8742) (@Emyrk)
   ![Converting OIDC accounts](https://user-images.githubusercontent.com/22407953/257408767-5b136476-99d1-4052-aeec-fe2a42618e04.png)
-- CLI: Added `--var` shorthand for `--variable` in `coder templates <create/push>` CLI (#8710) (@ammario)
-- Accounts are marked as dormant after 90 days of inactivity and do not consume a license seat. When the user logs in again, their account status is reinstated. (#8644) (@mtojek)
-- Groups can have a non-unique display name that takes priority in the dashboard (#8740) (@Emyrk)
-- Dotfiles: Coder checks if dotfiles install script is executable (#8588) (@BRAVO68WEB)
-- CLI: Added `--var` shorthand for `--variable` in `coder templates <create/push>` CLI (#8710) (@ammario)
-- Sever logs: Added fine-grained [filtering](https://coder.com/docs/v2/latest/cli/server#-l---log-filter) with Regex (#8748) (@ammario)
-- d3991fac2 feat(coderd): add parameter insights to template insights (#8656) (@mafredri)
-- Agent metadata: In cases where Coder does not receive metadata in time, we render the previous "stale" value. Stale values are grey versus the typical green color. (#8745) (@BrunoQuaresma)
-- [Open in Coder](https://coder.com/docs/v2/latest/templates/open-in-coder): Generate a link that automatically creates a workspace on behalf of the user, skipping the "Create Workspace" form (#8651) (@BrunoQuaresma)
-  ![Open in Coder](https://user-images.githubusercontent.com/22407953/257410429-712de64d-ea2c-4520-8abf-0a9ba5a16e7a.png)- e85b88ca9 feat(site): add restart button when workspace is unhealthy (#8765) (@BrunoQuaresma)
+- CLI: Added `--var` shorthand for `--variable` in
+  `coder templates <create/push>` CLI (#8710) (@ammario)
+- Accounts are marked as dormant after 90 days of inactivity and do not consume
+  a license seat. When the user logs in again, their account status is
+  reinstated. (#8644) (@mtojek)
+- Groups can have a non-unique display name that takes priority in the dashboard
+  (#8740) (@Emyrk)
+- Dotfiles: Coder checks if dotfiles install script is executable (#8588)
+  (@BRAVO68WEB)
+- CLI: Added `--var` shorthand for `--variable` in
+  `coder templates <create/push>` CLI (#8710) (@ammario)
+- Sever logs: Added fine-grained
+  [filtering](https://coder.com/docs/v2/latest/cli/server#-l---log-filter) with
+  Regex (#8748) (@ammario)
+- d3991fac2 feat(coderd): add parameter insights to template insights (#8656)
+  (@mafredri)
+- Agent metadata: In cases where Coder does not receive metadata in time, we
+  render the previous "stale" value. Stale values are grey versus the typical
+  green color. (#8745) (@BrunoQuaresma)
+- [Open in Coder](https://coder.com/docs/v2/latest/templates/open-in-coder):
+  Generate a link that automatically creates a workspace on behalf of the user,
+  skipping the "Create Workspace" form (#8651) (@BrunoQuaresma)
+  ![Open in Coder](https://user-images.githubusercontent.com/22407953/257410429-712de64d-ea2c-4520-8abf-0a9ba5a16e7a.png)-
+  e85b88ca9 feat(site): add restart button when workspace is unhealthy (#8765)
+  (@BrunoQuaresma)
 
 ### Bug fixes
 
 - Do not wait for devcontainer template volume claim bound (#8539) (@Tirzono)
-- Prevent repetition of template IDs in `template_usage_by_day` (#8693) (@mtojek)
+- Prevent repetition of template IDs in `template_usage_by_day` (#8693)
+  (@mtojek)
 - Unify parameter validation errors (#8738) (@mtojek)
 - Request trial after password is validated (#8750) (@kylecarbs)
 - Fix `coder stat mem` calculation for cgroup v1 workspaces (#8762) (@sreya)
@@ -62,15 +108,18 @@ Questions? Feel free to ask in [our Discord](https://discord.gg/coder) or email
 - Fix tailnet netcheck issues (#8802) (@deansheather)
 - Avoid infinite loop in agent derp-map (#8848) (@deansheather)
 - Avoid agent runLoop exiting due to ws ping (#8852) (@deansheather)
-- Add read call to derp-map endpoint to avoid ws ping timeout (#8859) (@deansheather)
+- Add read call to derp-map endpoint to avoid ws ping timeout (#8859)
+  (@deansheather)
 - Show current DERP name correctly in vscode (#8856) (@deansheather)
 - Apply log-filter to debug logs only (#8751) (@ammario)
 - Correctly print deprecated warnings (#8771) (@ammario)
 - De-duplicate logs (#8686) (@ammario)
 - Always dial agents with `WorkspaceAgentIP` (#8760) (@coadler)
 - Ensure creating a SCIM user is idempotent (#8730) (@coadler)
-- Send build parameters over the confirmation dialog on restart (#8660) (@BrunoQuaresma)
-- Fix error 'Reduce of empty array with no initial value' (#8700) (@BrunoQuaresma)
+- Send build parameters over the confirmation dialog on restart (#8660)
+  (@BrunoQuaresma)
+- Fix error 'Reduce of empty array with no initial value' (#8700)
+  (@BrunoQuaresma)
 - Fix latency values (#8749) (@BrunoQuaresma)
 - Fix metadata value changing width all the time (#8780) (@BrunoQuaresma)
 - Show error when user exists (#8864) (@BrunoQuaresma)
@@ -80,14 +129,17 @@ Questions? Feel free to ask in [our Discord](https://discord.gg/coder) or email
 ### Documentation
 
 - Explain JFrog integration 🐸 (#8682) (@ammario)
-- Allow multiple Coder deployments to use single GitHub OAuth app (#8786) (@matifali)
+- Allow multiple Coder deployments to use single GitHub OAuth app (#8786)
+  (@matifali)
 - Remove Microsoft VS Code Server docs (#8845) (@ericpaulsen)
 
 ### Reverts
 
-- Make [pgCoordinator](https://github.com/coder/coder/pull/8044) experimental again (#8797) (@coadler)
+- Make [pgCoordinator](https://github.com/coder/coder/pull/8044) experimental
+  again (#8797) (@coadler)
 
-Compare: [`v0.27.0...v2.0.0`](https://github.com/coder/coder/compare/v0.27.0...v2.0.0)
+Compare:
+[`v0.27.0...v2.0.0`](https://github.com/coder/coder/compare/v0.27.0...v2.0.0)
 
 ## Container image
 
@@ -95,4 +147,6 @@ Compare: [`v0.27.0...v2.0.0`](https://github.com/coder/coder/compare/v0.27.0...v
 
 ## Install/upgrade
 
-Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v2.0.2.md b/docs/changelogs/v2.0.2.md
new file mode 100644
index 0000000000000..78134f7ef309e
--- /dev/null
+++ b/docs/changelogs/v2.0.2.md
@@ -0,0 +1,61 @@
+## Changelog
+
+### Features
+
+- [External provisioners](https://coder.com/docs/v2/latest/admin/provisioners)
+  updates
+  - Added
+    [PSK authentication](https://coder.com/docs/v2/latest/admin/provisioners#authentication)
+    method (#8877) (@spikecurtis)
+  - Provisioner daemons can be deployed
+    [via Helm](https://github.com/coder/coder/tree/main/helm/provisioner)
+    (#8939) (@spikecurtis)
+- Added login type (OIDC, GitHub, or built-in, or none) to users page (#8912)
+  (@Emyrk)
+- Groups can be
+  [automatically created](https://coder.com/docs/v2/latest/admin/auth#user-not-being-assigned--group-does-not-exist)
+  from OIDC group sync (#8884) (@Emyrk)
+- Parameter values can be specified via the
+  [command line](https://coder.com/docs/v2/latest/cli/create#--parameter) during
+  workspace creation/updates (#8898) (@mtojek)
+- Added date range picker for the template insights page (#8976)
+  (@BrunoQuaresma)
+- We now publish preview
+  [container images](https://github.com/coder/coder/pkgs/container/coder-preview)
+  on every commit to `main`. Only use these images for testing. They are
+  automatically deleted after 7 days.
+- Coder is
+  [officially listed JetBrains Gateway](https://coder.com/blog/self-hosted-remote-development-in-jetbrains-ides-now-available-to-coder-users).
+
+### Bug fixes
+
+- Don't close other web terminal or `coder_app` sessions during a terminal close
+  (#8917)
+- Properly refresh OIDC tokens (#8950) (@Emyrk)
+- Added backoff to validate fresh git auth tokens (#8956) (@kylecarbs)
+- Make preferred region the first in list (#9014) (@matifali)
+- `coder stat`: clistat: accept positional arg for stat disk cmd (#8911)
+- Prompt for confirmation during `coder delete <workspace>` (#8579)
+- Ensure SCIM create user can unsuspend (#8916)
+- Set correct Prometheus port in Helm notes (#8888)
+- Show user avatar on group page (#8997) (@BrunoQuaresma)
+- Make deployment stats bar scrollable on smaller viewports (#8996)
+  (@BrunoQuaresma)
+- Add horizontal scroll to template viewer (#8998) (@BrunoQuaresma)
+- Persist search parameters when user has to authenticate (#9005)
+  (@BrunoQuaresma)
+- Set default color and display error on appearance form (#9004)
+  (@BrunoQuaresma)
+
+Compare:
+[`v2.0.1...v2.0.2`](https://github.com/coder/coder/compare/v2.0.1...v2.0.2)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.0.2`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v2.1.0.md b/docs/changelogs/v2.1.0.md
new file mode 100644
index 0000000000000..bf7af3379aefb
--- /dev/null
+++ b/docs/changelogs/v2.1.0.md
@@ -0,0 +1,76 @@
+## Changelog
+
+### Important changes
+
+- We removed `jq` from our base image. In the unlikely case you use `jq` for
+  fetching Coder's database secret or other values, you'll need to build your
+  own Coder image. Click
+  [here](https://gist.github.com/bpmct/05cfb671d1d468ae3be46e93173a02ea) to
+  learn more. (#8979) (@ericpaulsen)
+
+### Features
+
+- You can manually add OIDC or GitHub users (#9000) (@Emyrk)
+  ![Manual add user](https://user-images.githubusercontent.com/22407953/261455971-adf2707c-93a7-49c6-be5d-2ec177e224b9.png)
+  > Use this with the
+  > [CODER_OIDC_ALLOW_SIGNUPS](https://coder.com/docs/v2/latest/cli/server#--oidc-allow-signups)
+  > flag to manually onboard users before opening the floodgates to every user
+  > in your identity provider!
+- CLI: The
+  [--header-command](https://coder.com/docs/v2/latest/cli#--header-command) flag
+  can leverage external services to provide dynamic headers to authenticate to a
+  Coder deployment behind an application proxy or VPN (#9059) (@code-asher)
+- OIDC: Add support for Azure OIDC PKI auth instead of client secret (#9054)
+  (@Emyrk)
+- Helm chart updates:
+  - Add terminationGracePeriodSeconds to provisioner chart (#9048)
+    (@spikecurtis)
+  - Add support for NodePort service type (#8993) (@ffais)
+  - Published
+    [external provisioner chart](https://coder.com/docs/v2/latest/admin/provisioners#example-running-an-external-provisioner-with-helm)
+    to release and docs (#9050) (@spikecurtis)
+- Exposed everyone group through UI. You can now set
+  [quotas](https://coder.com/docs/v2/latest/admin/quotas) for the `Everyone`
+  group. (#9117) (@sreya)
+- Workspace build errors are shown as a tooltip (#9029) (@BrunoQuaresma)
+- Add build log history to the build log page (#9150) (@BrunoQuaresma)
+  ![Build log history](https://user-images.githubusercontent.com/22407953/261457020-3fbbb274-1e32-4116-affb-4a5ac271110b.png)
+
+### Bug fixes
+
+- Correct GitHub oauth2 callback url (#9052) (@Emyrk)
+- Remove duplication from language of query param error (#9069) (@kylecarbs)
+- Remove unnecessary newlines from the end of cli output (#9068) (@kylecarbs)
+- Change dashboard route `/settings/deployment` to `/deployment` (#9070)
+  (@kylecarbs)
+- Use screen for reconnecting terminal sessions on Linux if available (#8640)
+  (@code-asher)
+- Catch missing output with reconnecting PTY (#9094) (@code-asher)
+- Fix deadlock on tailnet close (#9079) (@spikecurtis)
+- Rename group GET request (#9097) (@ericpaulsen)
+- Change oauth convert oidc cookie to SameSite=Lax (#9129) (@Emyrk)
+- Make PGCoordinator close connections when unhealthy (#9125) (@spikecurtis)
+- Don't navigate away from editor after publishing (#9153) (@aslilac)
+- /workspaces should work even if missing template perms (#9152) (@Emyrk)
+- Redirect to login upon authentication error (#9134) (@aslilac)
+- Avoid showing disabled fields in group settings page (#9154) (@ammario)
+- Disable wireguard trimming (#9098) (@coadler)
+
+### Documentation
+
+- Add
+  [offline docs](https://www.jetbrains.com/help/idea/fully-offline-mode.html)
+  for JetBrains Gateway (#9039) (@ericpaulsen)
+- Add `coder login` to CI docs (#9038) (@ericpaulsen)
+- Expand [JFrog platform](https://coder.com/docs/v2/latest/platforms/jfrog) and
+  example template (#9073) (@matifali)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.1.0`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v2.1.1.md b/docs/changelogs/v2.1.1.md
new file mode 100644
index 0000000000000..ff31ef815fbef
--- /dev/null
+++ b/docs/changelogs/v2.1.1.md
@@ -0,0 +1,49 @@
+## Changelog
+
+### Features
+
+- Add `last_used` search params to workspaces. This can be used to find inactive
+  workspaces (#9230) (@Emyrk)
+  ![Last used](https://user-images.githubusercontent.com/22407953/262407146-06cded4e-684e-4cff-86b7-4388270e7d03.png)
+  > You can use `last_used_before` and `last_used_after` in the workspaces
+  > search with [RFC3339Nano](https://www.rfc-editor.org/rfc/rfc3339) datetime
+- Add `daily_cost`` to `coder ls` to show
+  [quota](https://coder.com/docs/v2/latest/admin/quotas) consumption (#9200)
+  (@ammario)
+- Added `coder_app` usage to template insights (#9138) (@mafredri)
+  ![code-server usage](https://user-images.githubusercontent.com/22407953/262412524-180390de-b1a9-4d57-8473-c8774ec3fd6e.png)
+- Added documentation for
+  [workspace process logging](http://localhost:3000/docs/v2/latest/templates/process-logging).
+  This enterprise feature can be used to log all system-level processes in
+  workspaces. (#9002) (@deansheather)
+
+### Bug fixes
+
+- Avoid temporary license banner when Coder is upgraded via Helm + button to
+  refresh license entitlements (#9155) (@Emyrk)
+- Parameters in the page "Create workspace" will show the display name as the
+  primary field (#9158) (@aslilac)
+  ![Parameter order](https://user-images.githubusercontent.com/418348/261439836-e7e7d9bd-9204-42be-8d13-eae9a9afd17c.png)
+- Fix race in PGCoord at startup (#9144) (@spikecurtis)
+- Do not install strace on OSX (#9167) (@mtojek)
+- Use proper link to workspace proxies page (#9183) (@bpmct)
+- Correctly assess quota for stopped resources (#9201) (@ammario)
+- Add workspace_proxy type to auditlog friendly strings (#9194) (@Emyrk)
+- Always show add user button (#9229) (@aslilac)
+- Correctly reject quota-violating builds (#9233) (@ammario)
+- Log correct script timeout for startup script (#9190) (@mafredri)
+- Remove prompt for immutable parameters on start and restart (#9173) (@mtojek)
+- Server logs: apply filter to log message as well as name (#9232) (@ammario)
+
+Compare:
+[`v2.1.0...v2.1.1`](https://github.com/coder/coder/compare/v2.1.0...v2.1.1)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.1.1`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v2.1.2.md b/docs/changelogs/v2.1.2.md
new file mode 100644
index 0000000000000..c4676154f1729
--- /dev/null
+++ b/docs/changelogs/v2.1.2.md
@@ -0,0 +1,32 @@
+## Changelog
+
+### Features
+
+- Users page: Add descriptions for each auth method to the selection menu
+  (#9252) (@aslilac)
+
+### Bug fixes
+
+- Pull agent metadata even when rate is high (#9251) (@ammario)
+- Disable setup page once setup has been completed (#9198) (@aslilac)
+- Rewrite onlyDataResources (#9263) (@mtojek)
+- Prompt when parameter options are incompatible (#9247) (@mtojek)
+- Resolve deadlock when fetching everyone group for in-memory db (#9277)
+  (@kylecarbs)
+- Do not ask for immutables on update (#9266) (@mtojek)
+- Parallelize queries to improve template insights performance (#9275)
+  (@mafredri)
+- Fix init race and close flush (#9248) (@mafredri)
+
+Compare:
+[`v2.1.1...v2.1.2`](https://github.com/coder/coder/compare/v2.1.1...v2.1.2)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.1.2`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v2.1.3.md b/docs/changelogs/v2.1.3.md
new file mode 100644
index 0000000000000..ecd7c85582d82
--- /dev/null
+++ b/docs/changelogs/v2.1.3.md
@@ -0,0 +1,31 @@
+## Changelog
+
+### Bug fixes
+
+- Prevent oidc refresh being ignored (#9293) (@coryb)
+- Use stable sorting for insights and improve test coverage (#9250) (@mafredri)
+- Rewrite template insights query for speed and fix intervals (#9300)
+  (@mafredri)
+- Optimize template app insights query for speed and decrease intervals (#9302)
+  (@mafredri)
+- Upgrade cdr.dev/slog to fix isTTY race (#9305) (@mafredri)
+- Fix vertical scroll in the bottom bar (#9270) (@BrunoQuaresma)
+
+### Documentation
+
+- Explain
+  [incompatibility in parameter options](https://coder.com/docs/v2/latest/templates/parameters#incompatibility-in-parameter-options-for-workspace-builds)
+  for workspace builds (#9297) (@mtojek)
+
+Compare:
+[`v2.1.2...v2.1.3`](https://github.com/coder/coder/compare/v2.1.2...v2.1.3)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.1.3`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v2.1.4.md b/docs/changelogs/v2.1.4.md
new file mode 100644
index 0000000000000..f2abe83d2fc10
--- /dev/null
+++ b/docs/changelogs/v2.1.4.md
@@ -0,0 +1,41 @@
+## Changelog
+
+### Features
+
+- Add `template_active_version_id` to workspaces (#9226) (@kylecarbs)
+- Show entity name in DeleteDialog (#9347) (@ammario)
+- Improve template publishing flow (#9346) (@aslilac)
+
+### Bug fixes
+
+- Fixed 2 bugs contributing to a memory leak in `coderd` (#9364):
+  - Allow `workspaceAgentLogs` follow to return on non-latest-build (#9382)
+    (@mafredri)
+  - Avoid derp-map updates endpoint leak (#9390) (@deansheather)
+- Send updated workspace data after ws connection (#9392) (@BrunoQuaresma)
+- Fix `coder template pull` on Windows (#9327) (@spikecurtis)
+- Truncate websocket close error (#9360) (@kylecarbs)
+- Add `--max-ttl`` to template create (#9319) (@ammario)
+- Remove rate limits from agent metadata (#9308) (@ammario)
+- Use `websocketNetConn` in `workspaceProxyCoordinate` to bind context (#9395)
+  (@mafredri)
+- Fox default ephemeral parameter value on parameters page (#9314)
+  (@BrunoQuaresma)
+- Render variable width unicode characters in terminal (#9259) (@ammario)
+- Use WebGL renderer for terminal (#9320) (@ammario)
+- 80425c32b fix(site): workaround: reload page every 3sec (#9387) (@mtojek)
+- Make right panel scrollable on template editor (#9344) (@BrunoQuaresma)
+- Use more reasonable restart limit for systemd service (#9355) (@bpmct)
+
+Compare:
+[`v2.1.3...v2.1.4`](https://github.com/coder/coder/compare/v2.1.3...v2.1.4)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.1.4`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v2.1.5.md b/docs/changelogs/v2.1.5.md
new file mode 100644
index 0000000000000..088645529897f
--- /dev/null
+++ b/docs/changelogs/v2.1.5.md
@@ -0,0 +1,73 @@
+## Changelog
+
+### Important changes
+
+- Removed `coder reset-password` from slim binary (#9520) (@mafredri)
+- VS Code Insiders is no longer a default
+  [display app](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#nested-schema-for-display_apps).
+  Keep reading for more details.
+
+### Features
+
+- You can install Coder with
+  [Homebrew](https://formulae.brew.sh/formula/coder#default) (#9414) (@aslilac).
+  Our [install script](https://coder.com/docs/v2/latest/install/install.sh) will
+  also use Homebrew, if present on your machine.
+- You can show/hide specific
+  [display apps](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#nested-schema-for-display_apps)
+  in your template, such as VS Code (Insiders), web terminal, SSH, etc. (#9100)
+  (@sreya) To add VS Code insiders into your template, you can set:
+  ```hcl
+  display_apps {
+    vscode_insiders = true
+  }
+  ```
+  ![Add insiders](https://user-images.githubusercontent.com/4856196/263852602-94a5cb56-b7c3-48cb-928a-3b5e0f4e964b.png)
+- Create a workspace from any template version (#9471) (@aslilac)
+- Add DataDog Go tracer (#9411) (@ammario)
+- Add user object to slog exporter (#9456) (@coadler)
+- Make workspace batch deletion GA (#9313) (@BrunoQuaresma)
+
+### Bug fixes
+
+- Expired OIDC tokens will now redirect to login page (#9442) (@Emyrk)
+- Avoid redirect loop on workspace proxies (#9389) (@deansheather)
+- Stop dropping error log on context canceled after heartbeat (#9427)
+  (@spikecurtis)
+- Fix null pointer on external provisioner daemons with daily_cost (#9401)
+  (@spikecurtis)
+- Hide OIDC and Github auth settings when they are disabled (#9447) (@aslilac)
+- Generate username with uuid to prevent collision (#9496) (@kylecarbs)
+- Make 'NoRefresh' honor unlimited tokens in gitauth (#9472) (@Emyrk)
+- Dotfiles: add an exception for `.gitconfig` (#9515) (@matifali)
+- Close batcher to force flush before asserting agent stats (#9465) (@johnstcn)
+- Ensure audit log json fields are formatted correctly (#9397) (@coadler)
+- Correctly set default tags for PSK auth (#9436) (@johnstcn)
+- Remove reference to non-existent local variable (#9448) (@denbeigh2000)
+- Remove checkbox from ws table loader (#9441) (@BrunoQuaresma)
+- Fix workspace parameters update when having immutable parameters (#9500)
+  (@BrunoQuaresma)
+- Re-add keepalives to tailnet (#9410) (@coadler)
+
+### Documentation
+
+- Add
+  [JetBrains Gateway Offline Mode](https://coder.com/docs/v2/latest/ides/gateway#jetbrains-gateway-in-an-offline-environment)
+  config steps (#9388) (@ericpaulsen)
+- Describe
+  [dynamic options and locals for parameters](https://github.com/coder/coder/tree/main/examples/parameters-dynamic-options)
+  (#9429) (@mtojek)
+- Add macOS installation page (#9443) (@aslilac)
+- Explain why coder port-forward is more performant than dashboard and sshd
+  (#9494) (@sharkymark)
+- Add `CODER_TLS_ADDRESS` to documentation for TLS setup (#9503) (@RaineAllDay)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.1.5`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or
+[upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a
+release asset below.
diff --git a/docs/changelogs/v2.2.0.md b/docs/changelogs/v2.2.0.md
new file mode 100644
index 0000000000000..9d3d97a4bab2f
--- /dev/null
+++ b/docs/changelogs/v2.2.0.md
@@ -0,0 +1,76 @@
+## Changelog
+
+### Features
+
+- Add support for `coder_script`. This allows different sources (such as [modules](http://registry.coder.com/modules)) to provide their own scripts (#9584) (@kylecarbs)
+  ![coder_script example](https://user-images.githubusercontent.com/7122116/270478499-9214d96f-b58d-4284-adfd-817304c2d98e.png)
+- The template editor lets you create a workspace for a version when published, even if it is not promoted (#9475) (@aslilac)
+- Add `template_id` and `template_name` to [workspace data source](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace) (#9655) (@sreya)
+- Implement agent process management. This will ensure the agent stays running when the workspace is under high load in Linux (#9461) (@sreya)
+- Show update messages on workspace page (#9705) (@aslilac)
+- Show version messages in version lists (#9708) (@aslilac)
+- Add `envFrom` value to Helm chart (#9587) (@ericpaulsen)
+- Add Hashicorp Nomad template (#9786) (@matifali)
+- Add middle click support for workspace rows (#9834) (@Parkreiner)
+- Create a workspace from any template version (#9861) (@aslilac)
+- Add `&hellip;` to actions that require confirmation (#9862) (@aslilac)
+- Colorize CLI help page (#9589) (@ammario)
+- Add simple healthcheck formatting option (#9864) (@coadler)
+- Log `start` timestamp for http requests (#9776) (@mafredri)
+- Render .sh and .tpl files in the template editor (#9674) (@BrunoQuaresma)
+- Show CLI flags and env variables for the options (#9757) (@BrunoQuaresma)
+- Linux builds of Coder can optionally be built with boringcrypto (#9543) (@spikecurtis)
+
+### Bug fixes
+
+- Use `$coder_version` instead of hardcoded version in release script (#9539) (@aslilac)
+- Remove tf provider versions in examples/ (#9586) (@ericpaulsen)
+- Stop inserting provisioner daemons into the database (#9108) (@spikecurtis)
+- Use CRC32 to shorten app subdomain (#9645) (@mtojek)
+- Update autostart/autostop text (#9650) (@aslilac)
+- Fix case insensitive agent ssh session env var (#9675) (@Emyrk)
+- Fix wait for build job (#9680) (@mtojek)
+- Prevent workspace search bar text from getting garbled (#9703) (@Parkreiner)
+- Remove broken fly.io template from starter templates (#9711) (@bpmct)
+- Reconnect terminal on non-modified key presses (#9686) (@code-asher)
+- Make sure fly_app name is lower case (#9771) (@pi3ch)
+- User should always belong to an organization (#9781) (@mtojek)
+- Use terminal emulator that keeps state in ReconnectingPTY tests (#9765) (@spikecurtis)
+- Hide empty update message box (#9784) (@aslilac)
+- Call agent directly in cli tests (#9789) (@spikecurtis)
+- Use AlwaysEnable for licenses with all features (#9808) (@spikecurtis)
+- Give more room to lonely resource metadata items (#9832) (@aslilac)
+- Consider all 'devel' builds as 'dev' builds (#9794) (@Emyrk)
+- Resolve flake in log sender by checking context (#9865) (@kylecarbs)
+- Add case for logs without a source (#9866) (@kylecarbs)
+- Allow expansion from `log_path` for `coder_script` (#9868) (@kylecarbs)
+- Remove pinned version for dogfood (#9872) (@kylecarbs)
+- Wait for bash prompt before commands (#9882) (@spikecurtis)
+- Avoid logging env in unit tests (#9885) (@johnstcn)
+- Specify IgnoreErrors in slogtest options for scaletest cli tests (#9751) (@johnstcn)
+- Display pasted session token (#9710) (@ericpaulsen)
+- Emit CollectedAt as UTC in convertWorkspaceAgentMetadata (#9700) (@johnstcn)
+- Subscribe to workspace when streaming agent logs to detect outdated build (#9729) (@mafredri)
+- Remove troublesome test case (#9874) (@johnstcn)
+- Use debug log on context cancellation in flush (#9777) (@mafredri)
+- Use debug log on query cancellation in flush (#9778) (@mafredri)
+- Migrate workspaces.last_used_at to timestamptz (#9699) (@johnstcn)
+- 8d8402da0 fix(coderd/database): avoid clobbering workspace build state (#9826) (@johnstcn)
+- Avoid truncating inserts that span multiple lines (#9756) (@johnstcn)
+- Fix manifest of gcp docs (#9559) (@matifali)
+- Do not skip deleted users when encrypting or deleting (#9694) (@johnstcn)
+- Fix typo in examples.gen.json (#9718) (@johnstcn)
+- Wait for non-zero metrics before cancelling in TestRun (#9663) (@johnstcn)
+- wget terraform directly from releases.hashicorp.com (#9594) (@johnstcn)
+- Modify logic for determining terraform arch (#9595) (@johnstcn)
+- Fix frontend renderer error (#9653) (@BrunoQuaresma)
+
+Compare: [`v2.1.5...v2.2.0`](https://github.com/coder/coder/compare/v2.1.5...v2.2.0)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.2.0`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
diff --git a/docs/changelogs/v2.2.1.md b/docs/changelogs/v2.2.1.md
new file mode 100644
index 0000000000000..94fe06f5fe17e
--- /dev/null
+++ b/docs/changelogs/v2.2.1.md
@@ -0,0 +1,50 @@
+## Changelog
+
+### Features
+
+- Template admins can require users to authenticate with external services, besides git providers (#9996) (@kylecarbs)
+  ![External auth](https://user-images.githubusercontent.com/22407953/272645210-ae197e8b-c012-4e2a-9c73-83f3d6616da6.png)
+  > In a future release, we will provide a CLI command to fetch (and refresh) the OIDC token within a workspace.
+- Users are now warned when renaming workspaces (#10023) (@aslilac)
+- Add reverse tunnelling SSH support for unix sockets (#9976) (@monika-canva)
+- Admins can set a custom application name and logo on the log in screen (#9902) (@mtojek)
+  > This is an [Enterprise feature](https://coder.com/docs/v2/latest/enterprise).
+- Add support for weekly active data on template insights (#9997) (@BrunoQuaresma)
+  ![Weekly active users graph](https://user-images.githubusercontent.com/22407953/272647853-e9d6ca3e-aca4-4897-9be0-15475097d3a6.png)
+- Add weekly user activity on template insights page (#10013) (@BrunoQuaresma)
+
+### API changes
+
+- API breaking change: report and interval_reports can be omitted in `api/v2/insights/templates` (#10010) (@mtojek)
+
+### Bug fixes
+
+- Users can optionally install `CAP_NET_ADMIN` on the agent and CLI to troubleshoot degraded network performance (#9908) (#9953) (@coadler)
+- Add checks for preventing HSL colors from entering React state (#9893) (@Parkreiner)
+- Fix TestCreateValidateRichParameters/ValidateString (#9928) (@mtojek)
+- Pass `OnSubscribe` to HA MultiAgent (#9947) (@coadler)
+  > This fixes a memory leak if you are running Coder in [HA](https://coder.com/docs/v2/latest/admin/high-availability).
+- Remove exp scaletest from slim binary (#9934) (@johnstcn)
+- Fetch workspace agent scripts and log sources using system auth ctx (#10043) (@johnstcn)
+- Fix typo in pgDump (#10033) (@johnstcn)
+- Fix double input box for logo url (#9926) (@mtojek)
+- Fix navbar hover (#10021) (@BrunoQuaresma)
+- Remove 48 week option (#10025) (@BrunoQuaresma)
+- Fix orphan values on insights (#10036) (@BrunoQuaresma)
+
+### Documentation
+
+- Add support to enterprise features list (#10005) (@ericpaulsen)
+- Update frontend contribution docs (#10028) (@Parkreiner)
+
+---
+
+Compare: [`v2.2.0...v2.2.1`](https://github.com/coder/coder/compare/v2.2.0...v2.2.1)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.2.1`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
diff --git a/docs/changelogs/v2.3.0.md b/docs/changelogs/v2.3.0.md
new file mode 100644
index 0000000000000..20138d9f76382
--- /dev/null
+++ b/docs/changelogs/v2.3.0.md
@@ -0,0 +1,97 @@
+## Changelog
+
+### Important changes
+
+- Coder now only displays license warnings to privileged users (#10096) (@sreya)
+
+### Features
+
+- Add "Create Workspace" button to the workspaces page (#10011) (@Parkreiner)
+  <img src="https://user-images.githubusercontent.com/22407953/274334225-427095e4-d047-4cd6-80e7-744fa05ac3bf.png" alt="create workspace" width="600" />
+- Add support for [database encryption for user tokens](https://coder.com/docs/v2/latest/admin/encryption#database-encryption).
+  > This is an [Enterprise feature](https://coder.com/docs/v2/latest/enterprise).
+- Show descriptions for parameter options (#10068) (@aslilac)
+  <img src="https://user-images.githubusercontent.com/418348/272730560-6a9a9c45-5493-4344-94b8-2892d3e9347f.png" width="500" alt="parameter descriptions" />
+- Allow reading the agent token from a file (#10080) (@kylecarbs)
+- Adjust favicon based on system color-scheme (#10087) (@kylecarbs)
+- Add API support for workspace automatic updates (#10099) (@spikecurtis)
+- Show user limit on active users chart (#10101) (@mtojek)
+- Add logging for forwarded TCP connections (@spikecurtis)
+- Add /icons page to browse static icons for templates, `coder_apps`, and parameters (#10093) (@aslilac)
+  <img src="https://user-images.githubusercontent.com/22407953/274330463-cf91021b-7dcf-490d-959c-d79e31b4b4d2.png" width="600" alt="icons page" />
+  > Navigate to `https://coder.your-company.com/icons` to view this page.
+- You can select icons from the emoji picker in template settings (#10119) (@aslilac)
+  <img src="https://user-images.githubusercontent.com/22407953/274330990-8d577ba3-2745-4ff4-8b40-99167d02091d.png" width="600" alt="icon picker" />
+- Add shebang support to scripts (#10134) (@kylecarbs)
+- Improve logging for reconnectingPTY (web terminal) connections (@spikecurtis)
+- Improve logging for speedtest connections (@spikecurtis)
+- Add `request_id` to HTTP trace spans (#10145) (@coadler)
+- Add `external-auth` cli (#10052) (@kylecarbs)
+- Add warning message when trying to delete active template (#10142) (@Parkreiner)
+- Add `--version` flag to `coder templates pull`, default to active version (#10153) (@coadler)
+- Support configurable web terminal rendering (#10095) (@sreya)
+- Allow prefixes at the beginning of subdomain app hostnames (#10150) (@deansheather)
+- Failed template versions can be archived to hide them from the UI (#10179) (@Emyrk)
+  <img src="https://user-images.githubusercontent.com/22407953/274340359-847949b9-6e25-44ef-a9c3-935e40890c65.png" alt="archive version" />
+- Add --parameter flag to `exp scaletest` command (#10132) (@johnstcn)
+- Add `coder users delete` command (#10115) (@coadler)
+- Create a "Load More" button for previous builds (#10076) (@BrunoQuaresma)
+- Parameters can now be disabled via "Open in Coder" buttons (#10114) (@Kira-Pilot)
+
+### Bug fixes
+
+- Allow auditors to query deployment stats and insights (#10058) (@kylecarbs)
+- Update the validation url for GitHub enterprise (#10061) (@kylecarbs)
+- Allow all environment variables to fallback prefix to `HOMEBREW_` (#10050) (@kylecarbs)
+- Change alpha badge color to violet (#10029) (@sreya)
+- Add `--version` flag to the root to support migrating customers (#10063) (@kylecarbs)
+- Only allow promoting successful template versions (#9998) (@aslilac)
+- Fix failed workspaces continuously auto-deleting (#10069) (@sreya)
+- Add build status favicons based on system theme (#10089) (@kylecarbs)
+- Use proper state in system theme (#10090) (@kylecarbs)
+- Apply the same border for button groups (#10092) (@kylecarbs)
+- Use proper react hook for favicon theme (#10094) (@kylecarbs)
+- Invert the favicon on dark mode (#10097) (@kylecarbs)
+- Update ErrorDialog logic and tests (#10111) (@Parkreiner)
+- Check for nil pointer in AwaitWorkspaceAgents (@spikecurtis)
+- Properly trim spaces so multi-line shebang executes (#10146) (@kylecarbs)
+- Apply default `ExtraTokenKeys` to oauth (#10155) (@kylecarbs)
+- Use query to get external-auth by id (#10156) (@kylecarbs)
+- Correct escaping in test regex (#10138) (@spikecurtis)
+- Use CRC32 to shorten app subdomain (@mtojek)
+- Use is-dormant instead of dormant_at (#10191) (@sreya)
+- Append external auth env vars (#10201) (@kylecarbs)
+- Ignore spurious node updates while waiting for errors (#10175) (@spikecurtis)
+- Stop leaking User into API handlers unless authorized (@spikecurtis)
+- Fix log spam related to skipping custom nice scores (#10206) (@sreya)
+- Remove Parallel() call after timeout context (#10203) (@spikecurtis)
+- Prevent sqlDB leaks in ConnectToPostgres (#10072) (@mafredri)
+- Properly check for missing organization membership (@coadler)
+- Impvove ctx cancel in agent logs flush, fix test (#10214) (@mafredri)
+- Properly detect legacy agents (#10083) (@coadler)
+- 5d5a7da67 fix(scaletest): output error and trace instead of {} for json output (#10075) (@mafredri)
+- ed8092c83 fix(scaletest/createworkspaces): address race condition between agent closer and cleanup (#10210) (@johnstcn)
+- b3471bd23 fix(scaletest/dashboard): increase viewport size and handle deadlines (#10197) (@johnstcn)
+- e829cbf2d fix(scaletest/dashboard): fix early exit due to validate (#10212) (@johnstcn)
+- Disable auto fields when they are disabled in the template settings (#10022) (@BrunoQuaresma)
+- Fix chart label depending on interval (#10059) (@BrunoQuaresma)
+- Fix users page for template admins (#10060) (@BrunoQuaresma)
+- Change `utils/delay` import path (#10065) (@coadler)
+- Fix logo width on sign in (#10091) (@BrunoQuaresma)
+- Fix week range for insights (#10173) (@BrunoQuaresma)
+
+### Documentation
+
+- Update offline Terraform provider config (#10062) (@ericpaulsen)
+
+---
+
+Compare: [`v2.2.1...v2.3.0`](https://github.com/coder/coder/compare/v2.2.1...v2.3.0)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.2.2`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
diff --git a/docs/changelogs/v2.3.1.md b/docs/changelogs/v2.3.1.md
new file mode 100644
index 0000000000000..35f9f4dd45a27
--- /dev/null
+++ b/docs/changelogs/v2.3.1.md
@@ -0,0 +1,49 @@
+## Changelog
+
+### Features
+
+- Expose user seat limits in Prometheus metrics (#10169) (@mtojek)
+- Template admins can pick which days can be used for autostart (#10226, #10263) (@Emyrk)
+- feat: fix 404 on the first app loads when unauthenticated (#10262) (@Emyrk)
+- feat(coderd): add support for sending batched agent metadata (#10223) (@mafredri)
+- feat(codersdk/agentsdk): use new agent metadata batch endpoint (#10224) (@mafredri)
+- Add ExtraTemplates in provisioners Helm chart (#10256) (@johnstcn)
+- Limit workspace filtering to `Running`, `Stopped`, `Failed`, `Pending` states (#10283) (@BrunoQuaresma)
+- Add all safe experiments to the deployment page (#10276) (@Kira-Pilot)
+
+### Bug fixes
+
+- Fixes an issue with web terminal rendering by using UTF-8 (#10190) (@code-asher)
+- Display template names even if no display name is set (#10233) (@Parkreiner)
+- fix: display health alert in `DeploymentBannerView` (#10193) (@aslilac)
+- fix(agent): send metadata in batches (#10225) (@mafredri)
+- fix(cli): scaletest: create-worksapces: remove invalid character for kubernetes provider in implicit plan (#10228) (@johnstcn)
+- fix(coderd): make activitybump aware of default template ttl (#10253) (@johnstcn)
+- fix(coderd/provisionerdserver): pass through api ctx to provisionerdserver (#10259) (@johnstcn)
+- fix(scaletest): fix flake in Test_Runner/Cleanup (#10252) (@johnstcn)
+- fix(site): ensure empty string error shows default message (#10196) (@Kira-Pilot)
+- fix(site): display empty component when workspace has no parameters (#10286) (@BrunoQuaresma)
+- fix(site): do not return next page if the current size is lower than the limit (#10287) (@BrunoQuaresma)
+- fix(site): fix state used to check if creating was loading (#10296) (@BrunoQuaresma)
+- fix: prevent metadata queries from short-circuting (#10312) (@Parkreiner)
+- fix: set K8s deployment strategy to Recreate (#10321)
+
+### Documentation
+
+- Mention /icons in the template documentation (#10230) (@aslilac)
+- Reorganize template docs (#10297) (@matifali)
+
+### Other changes
+
+- Clarify external auth regex (#10243) (@ericpaulsen)
+- Prevent terminal being created twice (#10200) (@code-asher)
+
+Compare: [`v2.3.0...v2.3.1`](https://github.com/coder/coder/compare/v2.3.0...v2.3.1)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.3.1`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
diff --git a/docs/changelogs/v2.3.2.md b/docs/changelogs/v2.3.2.md
new file mode 100644
index 0000000000000..373914ac0a5de
--- /dev/null
+++ b/docs/changelogs/v2.3.2.md
@@ -0,0 +1,37 @@
+## Changelog
+
+### Important features
+
+- Moved workspace cleanup to an experimental feature (#10363) (@sreya)
+
+### Features
+
+- Add telemetry for external provisioners (#10322) (@coadler)
+- Expose template insights as Prometheus metrics (#10325) (@mtojek)
+- Add user groups column to users table (#10284) (@Parkreiner)
+- Add cli support for `--require-active-version` (#10337) (@sreya)
+- Add frontend support for mandating active template version (#10338) (@sreya)
+
+### Bug fixes
+
+- Add requester IP to workspace build audit logs (#10242) (@coadler)
+- Resolve User is not unauthenticated error seen on logout (#10349) (@Kira-Pilot)
+- Show dormant and suspended users in groups (#10333) (@Kira-Pilot)
+- Fix additional cluster SA, role names (#10366) (@ericpaulsen)
+- Update external-auth docs to use `coder_external_auth` (#10347) (@matifali)
+- b8c7b56fd fix(site): fix tabs in the template layout (#10334) (@BrunoQuaresma)
+
+### Documentation
+
+- Update vscode web docs (#10327) (@matifali)
+- Rework telemetry doc and add CLI warning (#10354) (@ammario)
+
+Compare: [`v2.3.1...v2.3.2`](https://github.com/coder/coder/compare/v2.3.1...v2.3.2)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.3.2`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
diff --git a/docs/changelogs/v2.3.3.md b/docs/changelogs/v2.3.3.md
new file mode 100644
index 0000000000000..9460703a6df7a
--- /dev/null
+++ b/docs/changelogs/v2.3.3.md
@@ -0,0 +1,43 @@
+## Changelog
+
+### Features
+
+- Make the dotfiles repository directory configurable for `coder dotfiles` (#10377) (@JoshVee)
+- Expose template version to provisioner (#10306) (@JoshVee)
+
+### Bug fixes
+
+- Initialize terminal with correct size (#10369) (@code-asher)
+- Disable tests broken by daylight savings (#10414) (@spikecurtis)
+- Add new aws regions to instance identity (#10434) (@kylecarbs)
+- Prevent infinite redirect oauth auth flow (#10430) (@Emyrk)
+- Prevent metadata from being discarded if report is slow (#10386) (@mafredri)
+- Track cron run and wait for cron stop (#10388) (@mafredri)
+- Display informative error for ErrWaitDelay (#10407) (@mafredri)
+- Avoid error log during shutdown (#10402) (@mafredri)
+- Update installation link (#10275) (@devarshishimpi)
+
+### Tests
+
+- 8f1b4fb06 test(agent): fix service banner trim test flake (#10384) (@mafredri)
+- 1286904de test(agent): improve TestAgent_Session_TTY_MOTD_Update (#10385) (@mafredri)
+- eac155aec test(cli): fix TestServer flake due to DNS lookup (#10390) (@mafredri)
+- 9d3785def test(cli/cliui): make agent tests more robust (#10415) (@mafredri)
+- 6683ad989 test(coderd): fix TestWorkspaceBuild flake (#10387) (@mafredri)
+
+### Continuous integration
+
+- 39fbf74c7 ci: bump the github-actions group with 1 update (#10379) (@app/dependabot)
+- 6b7858c51 ci: bump the github-actions group with 2 updates (#10420) (@app/dependabot)
+
+### Chores
+
+Compare: [`v2.3.2...v2.3.3`](https://github.com/coder/coder/compare/v2.3.2...v2.3.3)
+
+## Container image
+
+- `docker pull ghcr.io/coder/coder:v2.3.3`
+
+## Install/upgrade
+
+Refer to our docs to [install](https://coder.com/docs/v2/latest/install) or [upgrade](https://coder.com/docs/v2/latest/admin/upgrade) Coder, or use a release asset below.
diff --git a/docs/cli.md b/docs/cli.md
index 1a0c40a22fca6..57ce052fa443d 100644
--- a/docs/cli.md
+++ b/docs/cli.md
@@ -14,11 +14,11 @@ coder [global-flags] <subcommand>
 Coder — A tool for provisioning self-hosted development environments with Terraform.
   - Start a Coder server:
 
-      $ coder server
+     $ coder server
 
   - Get started by creating a template from an example:
 
-      $ coder templates init
+     $ coder templates init
 ```
 
 ## Subcommands
@@ -29,6 +29,7 @@ Coder — A tool for provisioning self-hosted development environments with Terr
 | [<code>create</code>](./cli/create.md)                 | Create a workspace                                                                                    |
 | [<code>delete</code>](./cli/delete.md)                 | Delete a workspace                                                                                    |
 | [<code>dotfiles</code>](./cli/dotfiles.md)             | Personalize your workspace by applying a canonical dotfiles repository                                |
+| [<code>external-auth</code>](./cli/external-auth.md)   | Manage external authentication                                                                        |
 | [<code>features</code>](./cli/features.md)             | List Enterprise features                                                                              |
 | [<code>groups</code>](./cli/groups.md)                 | Manage groups                                                                                         |
 | [<code>licenses</code>](./cli/licenses.md)             | Add, delete, and list licenses                                                                        |
@@ -94,7 +95,18 @@ Path to the global `coder` config directory.
 | Type        | <code>string-array</code>  |
 | Environment | <code>$CODER_HEADER</code> |
 
-Additional HTTP headers added to all requests. Provide as key=value. Can be specified multiple times.
+Additional HTTP headers added to all requests. Provide as key=value. Can be
+specified multiple times.
+
+### --header-command
+
+|             |                                    |
+| ----------- | ---------------------------------- |
+| Type        | <code>string</code>                |
+| Environment | <code>$CODER_HEADER_COMMAND</code> |
+
+An external command that outputs additional HTTP headers added to all requests.
+The command must output each header as `key=value` on its own line.
 
 ### --no-feature-warning
 
@@ -121,7 +133,8 @@ Suppress warning when client and server versions do not match.
 | Type        | <code>string</code>               |
 | Environment | <code>$CODER_SESSION_TOKEN</code> |
 
-Specify an authentication token. For security reasons setting CODER_SESSION_TOKEN is preferred.
+Specify an authentication token. For security reasons setting
+CODER_SESSION_TOKEN is preferred.
 
 ### --url
 
diff --git a/docs/cli/config-ssh.md b/docs/cli/config-ssh.md
index 9d5196c824827..b46d6bf55b37f 100644
--- a/docs/cli/config-ssh.md
+++ b/docs/cli/config-ssh.md
@@ -14,13 +14,13 @@ coder config-ssh [flags]
 
 ```console
   - You can use -o (or --ssh-option) so set SSH options to be used for all your
-    workspaces:
+workspaces:
 
-      $ coder config-ssh -o ForwardAgent=yes
+     $ coder config-ssh -o ForwardAgent=yes
 
   - You can use --dry-run (or -n) to see the changes that would be made:
 
-      $ coder config-ssh --dry-run
+     $ coder config-ssh --dry-run
 ```
 
 ## Options
diff --git a/docs/cli/create.md b/docs/cli/create.md
index 3f7ff099b16c8..f7036ac84d9a3 100644
--- a/docs/cli/create.md
+++ b/docs/cli/create.md
@@ -15,11 +15,30 @@ coder create [flags] [name]
 ```console
   - Create a workspace for another user (if you have permission):
 
-      $ coder create <username>/<workspace_name>
+     $ coder create <username>/<workspace_name>
 ```
 
 ## Options
 
+### --automatic-updates
+
+|             |                                                 |
+| ----------- | ----------------------------------------------- |
+| Type        | <code>string</code>                             |
+| Environment | <code>$CODER_WORKSPACE_AUTOMATIC_UPDATES</code> |
+| Default     | <code>never</code>                              |
+
+Specify automatic updates setting for the workspace (accepts 'always' or 'never').
+
+### --parameter
+
+|             |                                    |
+| ----------- | ---------------------------------- |
+| Type        | <code>string-array</code>          |
+| Environment | <code>$CODER_RICH_PARAMETER</code> |
+
+Rich parameter value in the format "name=value".
+
 ### --rich-parameter-file
 
 |             |                                         |
diff --git a/docs/cli/dotfiles.md b/docs/cli/dotfiles.md
index 641b292415adc..2ed5ab1525cb0 100644
--- a/docs/cli/dotfiles.md
+++ b/docs/cli/dotfiles.md
@@ -15,7 +15,7 @@ coder dotfiles [flags] <git_repo_url>
 ```console
   - Check out and install a dotfiles repository without prompts:
 
-      $ coder dotfiles --yes git@github.com:example/dotfiles.git
+     $ coder dotfiles --yes git@github.com:example/dotfiles.git
 ```
 
 ## Options
@@ -28,6 +28,16 @@ coder dotfiles [flags] <git_repo_url>
 
 Specifies which branch to clone. If empty, will default to cloning the default branch or using the existing branch in the cloned repo on disk.
 
+### --repo-dir
+
+|             |                                       |
+| ----------- | ------------------------------------- |
+| Type        | <code>string</code>                   |
+| Environment | <code>$CODER_DOTFILES_REPO_DIR</code> |
+| Default     | <code>dotfiles</code>                 |
+
+Specifies the directory for the dotfiles repository, relative to global config directory.
+
 ### --symlink-dir
 
 |             |                                 |
diff --git a/docs/cli/external-auth.md b/docs/cli/external-auth.md
new file mode 100644
index 0000000000000..ebe16435feb62
--- /dev/null
+++ b/docs/cli/external-auth.md
@@ -0,0 +1,23 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# external-auth
+
+Manage external authentication
+
+## Usage
+
+```console
+coder external-auth
+```
+
+## Description
+
+```console
+Authenticate with external services inside of a workspace.
+```
+
+## Subcommands
+
+| Name                                                         | Purpose                             |
+| ------------------------------------------------------------ | ----------------------------------- |
+| [<code>access-token</code>](./external-auth_access-token.md) | Print auth for an external provider |
diff --git a/docs/cli/external-auth_access-token.md b/docs/cli/external-auth_access-token.md
new file mode 100644
index 0000000000000..ead28af54be31
--- /dev/null
+++ b/docs/cli/external-auth_access-token.md
@@ -0,0 +1,43 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# external-auth access-token
+
+Print auth for an external provider
+
+## Usage
+
+```console
+coder external-auth access-token [flags] <provider>
+```
+
+## Description
+
+```console
+Print an access-token for an external auth provider. The access-token will be validated and sent to stdout with exit code 0. If a valid access-token cannot be obtained, the URL to authenticate will be sent to stdout with exit code 1
+  - Ensure that the user is authenticated with GitHub before cloning.:
+
+     $ #!/usr/bin/env sh
+
+OUTPUT=$(coder external-auth access-token github)
+if [ $? -eq 0 ]; then
+  echo "Authenticated with GitHub"
+else
+  echo "Please authenticate with GitHub:"
+  echo $OUTPUT
+fi
+
+
+  - Obtain an extra property of an access token for additional metadata.:
+
+     $ coder external-auth access-token slack --extra "authed_user.id"
+```
+
+## Options
+
+### --extra
+
+|      |                     |
+| ---- | ------------------- |
+| Type | <code>string</code> |
+
+Extract a field from the "extra" properties of the OAuth token.
diff --git a/docs/cli/list.md b/docs/cli/list.md
index 7a1aa0defb052..b840a32acb151 100644
--- a/docs/cli/list.md
+++ b/docs/cli/list.md
@@ -31,7 +31,7 @@ Specifies whether all workspaces will be listed or not.
 | Type    | <code>string-array</code>                                                                |
 | Default | <code>workspace,template,status,healthy,last built,outdated,starts at,stops after</code> |
 
-Columns to display in table output. Available columns: workspace, template, status, healthy, last built, outdated, starts at, stops after.
+Columns to display in table output. Available columns: workspace, template, status, healthy, last built, outdated, starts at, stops after, daily cost.
 
 ### -o, --output
 
diff --git a/docs/cli/port-forward.md b/docs/cli/port-forward.md
index 791960452398d..3419269c220fc 100644
--- a/docs/cli/port-forward.md
+++ b/docs/cli/port-forward.md
@@ -17,27 +17,27 @@ coder port-forward [flags] <workspace>
 ## Description
 
 ```console
-  - Port forward a single TCP port from 1234 in the workspace to port 5678 on
-    your local machine:
+  - Port forward a single TCP port from 1234 in the workspace to port 5678 on your
+local machine:
 
-      $ coder port-forward <workspace> --tcp 5678:1234
+     $ coder port-forward <workspace> --tcp 5678:1234
 
   - Port forward a single UDP port from port 9000 to port 9000 on your local
-    machine:
+machine:
 
-      $ coder port-forward <workspace> --udp 9000
+     $ coder port-forward <workspace> --udp 9000
 
   - Port forward multiple TCP ports and a UDP port:
 
-      $ coder port-forward <workspace> --tcp 8080:8080 --tcp 9000:3000 --udp 5353:53
+     $ coder port-forward <workspace> --tcp 8080:8080 --tcp 9000:3000 --udp 5353:53
 
   - Port forward multiple ports (TCP or UDP) in condensed syntax:
 
-      $ coder port-forward <workspace> --tcp 8080,9000:3000,9090-9092,10000-10002:10010-10012
+     $ coder port-forward <workspace> --tcp 8080,9000:3000,9090-9092,10000-10002:10010-10012
 
   - Port forward specifying the local address to bind to:
 
-      $ coder port-forward <workspace> --tcp 1.2.3.4:8080:8080
+     $ coder port-forward <workspace> --tcp 1.2.3.4:8080:8080
 ```
 
 ## Options
diff --git a/docs/cli/provisionerd_start.md b/docs/cli/provisionerd_start.md
index 583e520389150..8f7e72b01207a 100644
--- a/docs/cli/provisionerd_start.md
+++ b/docs/cli/provisionerd_start.md
@@ -30,7 +30,7 @@ Directory to store cached data.
 | Environment | <code>$CODER_PROVISIONERD_POLL_INTERVAL</code> |
 | Default     | <code>1s</code>                                |
 
-How often to poll for provisioner jobs.
+Deprecated and ignored.
 
 ### --poll-jitter
 
@@ -40,7 +40,16 @@ How often to poll for provisioner jobs.
 | Environment | <code>$CODER_PROVISIONERD_POLL_JITTER</code> |
 | Default     | <code>100ms</code>                           |
 
-How much to jitter the poll interval by.
+Deprecated and ignored.
+
+### --psk
+
+|             |                                            |
+| ----------- | ------------------------------------------ |
+| Type        | <code>string</code>                        |
+| Environment | <code>$CODER_PROVISIONER_DAEMON_PSK</code> |
+
+Pre-shared key to authenticate with Coder server.
 
 ### -t, --tag
 
diff --git a/docs/cli/restart.md b/docs/cli/restart.md
index 72daa5dec405d..d3b6010a92c2e 100644
--- a/docs/cli/restart.md
+++ b/docs/cli/restart.md
@@ -12,6 +12,15 @@ coder restart [flags] <workspace>
 
 ## Options
 
+### --build-option
+
+|             |                                  |
+| ----------- | -------------------------------- |
+| Type        | <code>string-array</code>        |
+| Environment | <code>$CODER_BUILD_OPTION</code> |
+
+Build option value in the format "name=value".
+
 ### --build-options
 
 |      |                   |
diff --git a/docs/cli/schedule_override-stop.md b/docs/cli/schedule_override-stop.md
index 2caf7661f11ea..8c565d734a585 100644
--- a/docs/cli/schedule_override-stop.md
+++ b/docs/cli/schedule_override-stop.md
@@ -18,5 +18,5 @@ coder schedule override-stop <workspace-name> <duration from now>
   * The new stop time must be at least 30 minutes in the future.
   * The workspace template may restrict the maximum workspace runtime.
 
-  $ coder schedule override-stop my-workspace 90m
+ $ coder schedule override-stop my-workspace 90m
 ```
diff --git a/docs/cli/schedule_start.md b/docs/cli/schedule_start.md
index d967b8448746e..771bb995e65b0 100644
--- a/docs/cli/schedule_start.md
+++ b/docs/cli/schedule_start.md
@@ -25,5 +25,5 @@ Schedule format: <start-time> [day-of-week] [location].
 
   - Set the workspace to start at 9:30am (in Dublin) from Monday to Friday:
 
-      $ coder schedule start my-workspace 9:30AM Mon-Fri Europe/Dublin
+     $ coder schedule start my-workspace 9:30AM Mon-Fri Europe/Dublin
 ```
diff --git a/docs/cli/schedule_stop.md b/docs/cli/schedule_stop.md
index f00bff4bfbd30..399bc69cd5fc9 100644
--- a/docs/cli/schedule_stop.md
+++ b/docs/cli/schedule_stop.md
@@ -26,5 +26,5 @@ When enabling scheduled stop, enter a duration in one of the following formats:
   * 2m   (2 minutes)
   * 2    (2 minutes)
 
-  $ coder schedule stop my-workspace 2h30m
+ $ coder schedule stop my-workspace 2h30m
 ```
diff --git a/docs/cli/server.md b/docs/cli/server.md
index 90c60d7392f00..9258f0f92f7e6 100644
--- a/docs/cli/server.md
+++ b/docs/cli/server.md
@@ -15,6 +15,7 @@ coder server [flags]
 | Name                                                                      | Purpose                                                                                                |
 | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
 | [<code>create-admin-user</code>](./server_create-admin-user.md)           | Create a new admin user with the given username, email and password and adds it to every organization. |
+| [<code>dbcrypt</code>](./server_dbcrypt.md)                               | Manage database encryption.                                                                            |
 | [<code>postgres-builtin-serve</code>](./server_postgres-builtin-serve.md) | Run the built-in PostgreSQL deployment.                                                                |
 | [<code>postgres-builtin-url</code>](./server_postgres-builtin-url.md)     | Output the connection URL for the built-in PostgreSQL deployment.                                      |
 
@@ -118,6 +119,16 @@ Path to read a DERP mapping from. See: https://tailscale.com/kb/1118/custom-derp
 
 URL to fetch a DERP mapping on startup. See: https://tailscale.com/kb/1118/custom-derp-servers/.
 
+### --derp-force-websockets
+
+|             |                                              |
+| ----------- | -------------------------------------------- |
+| Type        | <code>bool</code>                            |
+| Environment | <code>$CODER_DERP_FORCE_WEBSOCKETS</code>    |
+| YAML        | <code>networking.derp.forceWebSockets</code> |
+
+Force clients and agents to always use WebSocket to connect to DERP relay servers. By default, DERP uses `Upgrade: derp`, which may cause issues with some reverse proxies. Clients may automatically fallback to WebSocket if they detect an issue with `Upgrade: derp`, but this does not work in all situations.
+
 ### --derp-server-enable
 
 |             |                                        |
@@ -129,28 +140,6 @@ URL to fetch a DERP mapping on startup. See: https://tailscale.com/kb/1118/custo
 
 Whether to enable or disable the embedded DERP relay server.
 
-### --derp-server-region-code
-
-|             |                                             |
-| ----------- | ------------------------------------------- |
-| Type        | <code>string</code>                         |
-| Environment | <code>$CODER_DERP_SERVER_REGION_CODE</code> |
-| YAML        | <code>networking.derp.regionCode</code>     |
-| Default     | <code>coder</code>                          |
-
-Region code to use for the embedded DERP server.
-
-### --derp-server-region-id
-
-|             |                                           |
-| ----------- | ----------------------------------------- |
-| Type        | <code>int</code>                          |
-| Environment | <code>$CODER_DERP_SERVER_REGION_ID</code> |
-| YAML        | <code>networking.derp.regionID</code>     |
-| Default     | <code>999</code>                          |
-
-Region ID to use for the embedded DERP server.
-
 ### --derp-server-region-name
 
 |             |                                             |
@@ -174,14 +163,14 @@ An HTTP URL that is accessible by other replicas to relay DERP traffic. Required
 
 ### --derp-server-stun-addresses
 
-|             |                                                |
-| ----------- | ---------------------------------------------- |
-| Type        | <code>string-array</code>                      |
-| Environment | <code>$CODER_DERP_SERVER_STUN_ADDRESSES</code> |
-| YAML        | <code>networking.derp.stunAddresses</code>     |
-| Default     | <code>stun.l.google.com:19302</code>           |
+|             |                                                                                                                                          |
+| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| Type        | <code>string-array</code>                                                                                                                |
+| Environment | <code>$CODER_DERP_SERVER_STUN_ADDRESSES</code>                                                                                           |
+| YAML        | <code>networking.derp.stunAddresses</code>                                                                                               |
+| Default     | <code>stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302,stun3.l.google.com:19302,stun4.l.google.com:19302</code> |
 
-Addresses for STUN servers to establish P2P connections. Use special value 'disable' to turn off STUN.
+Addresses for STUN servers to establish P2P connections. It's recommended to have at least two STUN servers to give users the best chance of connecting P2P to workspaces. Each STUN server will get it's own DERP region, with region IDs starting at `--derp-server-region-id + 1`. Use special value 'disable' to turn off STUN completely.
 
 ### --default-quiet-hours-schedule
 
@@ -243,6 +232,17 @@ Disable automatic session expiry bumping due to activity. This forces all sessio
 
 Specifies the custom docs URL.
 
+### --oidc-group-auto-create
+
+|             |                                            |
+| ----------- | ------------------------------------------ |
+| Type        | <code>bool</code>                          |
+| Environment | <code>$CODER_OIDC_GROUP_AUTO_CREATE</code> |
+| YAML        | <code>oidc.enableGroupAutoCreate</code>    |
+| Default     | <code>false</code>                         |
+
+Automatically creates missing groups from a user's groups claim.
+
 ### --enable-terraform-debug-mode
 
 |             |                                                             |
@@ -274,6 +274,15 @@ Expose the swagger endpoint via /swagger.
 
 Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '\*' to opt-in to all available experiments.
 
+### --external-token-encryption-keys
+
+|             |                                                    |
+| ----------- | -------------------------------------------------- |
+| Type        | <code>string-array</code>                          |
+| Environment | <code>$CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS</code> |
+
+Encrypt OIDC and Git authentication tokens with AES-256-GCM in the database. The value must be a comma-separated list of base64-encoded keys. Each key, when base64-decoded, must be exactly 32 bytes in length. The first key will be used to encrypt new values. Subsequent keys will be used as a fallback when decrypting. During normal operation it is recommended to only set one key unless you are in the process of rotating keys with the `coder server dbcrypt rotate` command.
+
 ### --provisioner-force-cancel-interval
 
 |             |                                                       |
@@ -429,6 +438,16 @@ Whether new users can sign up with OIDC.
 
 OIDC auth URL parameters to pass to the upstream provider.
 
+### --oidc-client-cert-file
+
+|             |                                           |
+| ----------- | ----------------------------------------- |
+| Type        | <code>string</code>                       |
+| Environment | <code>$CODER_OIDC_CLIENT_CERT_FILE</code> |
+| YAML        | <code>oidc.oidcClientCertFile</code>      |
+
+Pem encoded certificate file to use for oauth2 PKI/JWT authorization. The public certificate that accompanies oidc-client-key-file. A standard x509 certificate is expected.
+
 ### --oidc-client-id
 
 |             |                                    |
@@ -439,6 +458,16 @@ OIDC auth URL parameters to pass to the upstream provider.
 
 Client ID to use for Login with OIDC.
 
+### --oidc-client-key-file
+
+|             |                                          |
+| ----------- | ---------------------------------------- |
+| Type        | <code>string</code>                      |
+| Environment | <code>$CODER_OIDC_CLIENT_KEY_FILE</code> |
+| YAML        | <code>oidc.oidcClientKeyFile</code>      |
+
+Pem encoded RSA private key to use for oauth2 PKI/JWT authorization. This can be used instead of oidc-client-secret if your IDP supports it.
+
 ### --oidc-client-secret
 
 |             |                                        |
@@ -521,6 +550,17 @@ Ignore the userinfo endpoint and only use the ID token for user information.
 
 Issuer URL to use for Login with OIDC.
 
+### --oidc-group-regex-filter
+
+|             |                                             |
+| ----------- | ------------------------------------------- |
+| Type        | <code>regexp</code>                         |
+| Environment | <code>$CODER_OIDC_GROUP_REGEX_FILTER</code> |
+| YAML        | <code>oidc.groupRegexFilter</code>          |
+| Default     | <code>.\*</code>                            |
+
+If provided any group name not matching the regex is ignored. This allows for filtering out groups that are not needed. This filter is applied after the group mapping.
+
 ### --oidc-scopes
 
 |             |                                   |
@@ -593,7 +633,7 @@ The text to show on the OpenID Connect sign in button.
 | Environment | <code>$CODER_OIDC_ICON_URL</code> |
 | YAML        | <code>oidc.iconURL</code>         |
 
-URL pointing to the icon to use on the OepnID Connect login button.
+URL pointing to the icon to use on the OpenID Connect login button.
 
 ### --provisioner-daemon-poll-interval
 
@@ -604,7 +644,7 @@ URL pointing to the icon to use on the OepnID Connect login button.
 | YAML        | <code>provisioning.daemonPollInterval</code>         |
 | Default     | <code>1s</code>                                      |
 
-Time to wait before polling for a new job.
+Deprecated and ignored.
 
 ### --provisioner-daemon-poll-jitter
 
@@ -615,7 +655,7 @@ Time to wait before polling for a new job.
 | YAML        | <code>provisioning.daemonPollJitter</code>         |
 | Default     | <code>100ms</code>                                 |
 
-Random jitter added to the poll interval.
+Deprecated and ignored.
 
 ### --postgres-url
 
@@ -668,6 +708,16 @@ Collect database metrics (may increase charges for metrics storage).
 
 Serve prometheus metrics on the address defined by prometheus address.
 
+### --provisioner-daemon-psk
+
+|             |                                            |
+| ----------- | ------------------------------------------ |
+| Type        | <code>string</code>                        |
+| Environment | <code>$CODER_PROVISIONER_DAEMON_PSK</code> |
+| YAML        | <code>provisioning.daemonPSK</code>        |
+
+Pre-shared key to authenticate external provisioner daemons to Coder server.
+
 ### --provisioner-daemons
 
 |             |                                         |
@@ -917,17 +967,6 @@ Minimum supported version of TLS. Accepted values are "tls10", "tls11", "tls12"
 
 Whether telemetry is enabled or not. Coder collects anonymized usage data to help improve our product.
 
-### --telemetry-trace
-
-|             |                                     |
-| ----------- | ----------------------------------- |
-| Type        | <code>bool</code>                   |
-| Environment | <code>$CODER_TELEMETRY_TRACE</code> |
-| YAML        | <code>telemetry.trace</code>        |
-| Default     | <code>true</code>                   |
-
-Whether Opentelemetry traces are sent to Coder. Coder collects anonymized application tracing to help improve our product. Disabling telemetry also disables this option.
-
 ### --trace
 
 |             |                                           |
@@ -958,6 +997,17 @@ Enables trace exporting to Honeycomb.io using the provided API Key.
 
 Periodically check for new releases of Coder and inform the owner. The check is performed once per day.
 
+### --web-terminal-renderer
+
+|             |                                           |
+| ----------- | ----------------------------------------- |
+| Type        | <code>string</code>                       |
+| Environment | <code>$CODER_WEB_TERMINAL_RENDERER</code> |
+| YAML        | <code>client.webTerminalRenderer</code>   |
+| Default     | <code>canvas</code>                       |
+
+The renderer to use when opening a web terminal. Valid values are 'canvas', 'webgl', or 'dom'.
+
 ### --wildcard-access-url
 
 |             |                                           |
diff --git a/docs/cli/server_dbcrypt.md b/docs/cli/server_dbcrypt.md
new file mode 100644
index 0000000000000..be06560a275ca
--- /dev/null
+++ b/docs/cli/server_dbcrypt.md
@@ -0,0 +1,19 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# server dbcrypt
+
+Manage database encryption.
+
+## Usage
+
+```console
+coder server dbcrypt
+```
+
+## Subcommands
+
+| Name                                                | Purpose                                                                       |
+| --------------------------------------------------- | ----------------------------------------------------------------------------- |
+| [<code>decrypt</code>](./server_dbcrypt_decrypt.md) | Decrypt a previously encrypted database.                                      |
+| [<code>delete</code>](./server_dbcrypt_delete.md)   | Delete all encrypted data from the database. THIS IS A DESTRUCTIVE OPERATION. |
+| [<code>rotate</code>](./server_dbcrypt_rotate.md)   | Rotate database encryption keys.                                              |
diff --git a/docs/cli/server_dbcrypt_decrypt.md b/docs/cli/server_dbcrypt_decrypt.md
new file mode 100644
index 0000000000000..1141ccc0da94d
--- /dev/null
+++ b/docs/cli/server_dbcrypt_decrypt.md
@@ -0,0 +1,39 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# server dbcrypt decrypt
+
+Decrypt a previously encrypted database.
+
+## Usage
+
+```console
+coder server dbcrypt decrypt [flags]
+```
+
+## Options
+
+### --keys
+
+|             |                                                            |
+| ----------- | ---------------------------------------------------------- |
+| Type        | <code>string-array</code>                                  |
+| Environment | <code>$CODER_EXTERNAL_TOKEN_ENCRYPTION_DECRYPT_KEYS</code> |
+
+Keys required to decrypt existing data. Must be a comma-separated list of base64-encoded keys.
+
+### --postgres-url
+
+|             |                                       |
+| ----------- | ------------------------------------- |
+| Type        | <code>string</code>                   |
+| Environment | <code>$CODER_PG_CONNECTION_URL</code> |
+
+The connection URL for the Postgres database.
+
+### -y, --yes
+
+|      |                   |
+| ---- | ----------------- |
+| Type | <code>bool</code> |
+
+Bypass prompts.
diff --git a/docs/cli/server_dbcrypt_delete.md b/docs/cli/server_dbcrypt_delete.md
new file mode 100644
index 0000000000000..ed81a776035f6
--- /dev/null
+++ b/docs/cli/server_dbcrypt_delete.md
@@ -0,0 +1,34 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# server dbcrypt delete
+
+Delete all encrypted data from the database. THIS IS A DESTRUCTIVE OPERATION.
+
+Aliases:
+
+- rm
+
+## Usage
+
+```console
+coder server dbcrypt delete [flags]
+```
+
+## Options
+
+### --postgres-url
+
+|             |                                                            |
+| ----------- | ---------------------------------------------------------- |
+| Type        | <code>string</code>                                        |
+| Environment | <code>$CODER_EXTERNAL_TOKEN_ENCRYPTION_POSTGRES_URL</code> |
+
+The connection URL for the Postgres database.
+
+### -y, --yes
+
+|      |                   |
+| ---- | ----------------- |
+| Type | <code>bool</code> |
+
+Bypass prompts.
diff --git a/docs/cli/server_dbcrypt_rotate.md b/docs/cli/server_dbcrypt_rotate.md
new file mode 100644
index 0000000000000..e2679e5127869
--- /dev/null
+++ b/docs/cli/server_dbcrypt_rotate.md
@@ -0,0 +1,48 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# server dbcrypt rotate
+
+Rotate database encryption keys.
+
+## Usage
+
+```console
+coder server dbcrypt rotate [flags]
+```
+
+## Options
+
+### --new-key
+
+|             |                                                               |
+| ----------- | ------------------------------------------------------------- |
+| Type        | <code>string</code>                                           |
+| Environment | <code>$CODER_EXTERNAL_TOKEN_ENCRYPTION_ENCRYPT_NEW_KEY</code> |
+
+The new external token encryption key. Must be base64-encoded.
+
+### --old-keys
+
+|             |                                                                |
+| ----------- | -------------------------------------------------------------- |
+| Type        | <code>string-array</code>                                      |
+| Environment | <code>$CODER_EXTERNAL_TOKEN_ENCRYPTION_ENCRYPT_OLD_KEYS</code> |
+
+The old external token encryption keys. Must be a comma-separated list of base64-encoded keys.
+
+### --postgres-url
+
+|             |                                       |
+| ----------- | ------------------------------------- |
+| Type        | <code>string</code>                   |
+| Environment | <code>$CODER_PG_CONNECTION_URL</code> |
+
+The connection URL for the Postgres database.
+
+### -y, --yes
+
+|      |                   |
+| ---- | ----------------- |
+| Type | <code>bool</code> |
+
+Bypass prompts.
diff --git a/docs/cli/start.md b/docs/cli/start.md
index 8c3fd7f71276e..120edfde679eb 100644
--- a/docs/cli/start.md
+++ b/docs/cli/start.md
@@ -12,6 +12,15 @@ coder start [flags] <workspace>
 
 ## Options
 
+### --build-option
+
+|             |                                  |
+| ----------- | -------------------------------- |
+| Type        | <code>string-array</code>        |
+| Environment | <code>$CODER_BUILD_OPTION</code> |
+
+Build option value in the format "name=value".
+
 ### --build-options
 
 |      |                   |
diff --git a/docs/cli/templates.md b/docs/cli/templates.md
index ed459f2d70d82..4a5b60161114f 100644
--- a/docs/cli/templates.md
+++ b/docs/cli/templates.md
@@ -20,27 +20,27 @@ coder templates
 Templates are written in standard Terraform and describe the infrastructure for workspaces
   - Create a template for developers to create workspaces:
 
-      $ coder templates create
+     $ coder templates create
 
   - Make changes to your template, and plan the changes:
 
-      $ coder templates plan my-template
+     $ coder templates plan my-template
 
   - Push an update to the template. Your developers can update their workspaces:
 
-      $ coder templates push my-template
+     $ coder templates push my-template
 ```
 
 ## Subcommands
 
 | Name                                             | Purpose                                                                        |
 | ------------------------------------------------ | ------------------------------------------------------------------------------ |
+| [<code>archive</code>](./templates_archive.md)   | Archive unused or failed template versions from a given template(s)            |
 | [<code>create</code>](./templates_create.md)     | Create a template from the current directory or as specified by flag           |
 | [<code>delete</code>](./templates_delete.md)     | Delete templates                                                               |
 | [<code>edit</code>](./templates_edit.md)         | Edit the metadata of a template by name.                                       |
 | [<code>init</code>](./templates_init.md)         | Get started with a templated template.                                         |
 | [<code>list</code>](./templates_list.md)         | List all the templates available for the organization                          |
-| [<code>plan</code>](./templates_plan.md)         | Plan a template push from the current directory                                |
-| [<code>pull</code>](./templates_pull.md)         | Download the latest version of a template to a path.                           |
+| [<code>pull</code>](./templates_pull.md)         | Download the active, latest, or specified version of a template to a path.     |
 | [<code>push</code>](./templates_push.md)         | Push a new template version from the current directory or as specified by flag |
 | [<code>versions</code>](./templates_versions.md) | Manage different versions of the specified template                            |
diff --git a/docs/cli/templates_archive.md b/docs/cli/templates_archive.md
new file mode 100644
index 0000000000000..6dd6ba1d6460d
--- /dev/null
+++ b/docs/cli/templates_archive.md
@@ -0,0 +1,29 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# templates archive
+
+Archive unused or failed template versions from a given template(s)
+
+## Usage
+
+```console
+coder templates archive [flags] [template-name...]
+```
+
+## Options
+
+### --all
+
+|      |                   |
+| ---- | ----------------- |
+| Type | <code>bool</code> |
+
+Include all unused template versions. By default, only failed template versions are archived.
+
+### -y, --yes
+
+|      |                   |
+| ---- | ----------------- |
+| Type | <code>bool</code> |
+
+Bypass prompts.
diff --git a/docs/cli/templates_create.md b/docs/cli/templates_create.md
index 44081e8986120..83c3b3c5b9aff 100644
--- a/docs/cli/templates_create.md
+++ b/docs/cli/templates_create.md
@@ -19,7 +19,7 @@ coder templates create [flags] [name]
 | Type    | <code>duration</code> |
 | Default | <code>24h</code>      |
 
-Specify a default TTL for workspaces created from this template.
+Specify a default TTL for workspaces created from this template. It is the default time before shutdown - workspaces created from this template default to this value. Maps to "Default autostop" in the UI.
 
 ### -d, --directory
 
@@ -37,7 +37,7 @@ Specify the directory to create from, use '-' to read tar from stdin.
 | Type    | <code>duration</code> |
 | Default | <code>0h</code>       |
 
-Specify a failure TTL for workspaces created from this template. This licensed feature's default is 0h (off).
+Specify a failure TTL for workspaces created from this template. It is the amount of time after a failed "start" build before coder automatically schedules a "stop" build to cleanup.This licensed feature's default is 0h (off). Maps to "Failure cleanup"in the UI.
 
 ### --ignore-lockfile
 
@@ -55,7 +55,15 @@ Ignore warnings about not having a .terraform.lock.hcl file present in the templ
 | Type    | <code>duration</code> |
 | Default | <code>0h</code>       |
 
-Specify an inactivity TTL for workspaces created from this template. This licensed feature's default is 0h (off).
+Specify an inactivity TTL for workspaces created from this template. It is the amount of time the workspace is not used before it is be stopped and auto-locked. This includes across multiple builds (e.g. auto-starts and stops). This licensed feature's default is 0h (off). Maps to "Dormancy threshold" in the UI.
+
+### --max-ttl
+
+|      |                       |
+| ---- | --------------------- |
+| Type | <code>duration</code> |
+
+Edit the template maximum time before shutdown - workspaces created from this template must shutdown within the given duration after starting. This is an enterprise-only feature.
 
 ### -m, --message
 
@@ -81,6 +89,15 @@ Disable the default behavior of granting template access to the 'everyone' group
 
 Specify a set of tags to target provisioner daemons.
 
+### --require-active-version
+
+|         |                    |
+| ------- | ------------------ |
+| Type    | <code>bool</code>  |
+| Default | <code>false</code> |
+
+Requires workspace builds to use the active template version. This setting does not apply to template admins. This is an enterprise-only feature.
+
 ### --var
 
 |      |                           |
diff --git a/docs/cli/templates_edit.md b/docs/cli/templates_edit.md
index 2d25da15b7cc1..cd65ac99ef9d0 100644
--- a/docs/cli/templates_edit.md
+++ b/docs/cli/templates_edit.md
@@ -39,13 +39,21 @@ Allow users to customize the autostop TTL for workspaces on this template. This
 
 Allow users to cancel in-progress workspace jobs.
 
+### --autostart-requirement-weekdays
+
+|      |                           |
+| ---- | ------------------------- |
+| Type | <code>string-array</code> |
+
+Edit the template autostart requirement weekdays - workspaces created from this template can only autostart on the given weekdays. To unset this value for the template (and allow autostart on all days), pass 'all'.
+
 ### --default-ttl
 
 |      |                       |
 | ---- | --------------------- |
 | Type | <code>duration</code> |
 
-Edit the template default time before shutdown - workspaces created from this template default to this value.
+Edit the template default time before shutdown - workspaces created from this template default to this value. Maps to "Default autostop" in the UI.
 
 ### --description
 
@@ -70,7 +78,7 @@ Edit the template display name.
 | Type    | <code>duration</code> |
 | Default | <code>0h</code>       |
 
-Specify a failure TTL for workspaces created from this template. This licensed feature's default is 0h (off).
+Specify a failure TTL for workspaces created from this template. It is the amount of time after a failed "start" build before coder automatically schedules a "stop" build to cleanup.This licensed feature's default is 0h (off). Maps to "Failure cleanup" in the UI.
 
 ### --icon
 
@@ -87,7 +95,7 @@ Edit the template icon path.
 | Type    | <code>duration</code> |
 | Default | <code>0h</code>       |
 
-Specify an inactivity TTL for workspaces created from this template. This licensed feature's default is 0h (off).
+Specify an inactivity TTL for workspaces created from this template. It is the amount of time the workspace is not used before it is be stopped and auto-locked. This includes across multiple builds (e.g. auto-starts and stops). This licensed feature's default is 0h (off). Maps to "Dormancy threshold" in the UI.
 
 ### --max-ttl
 
@@ -95,7 +103,7 @@ Specify an inactivity TTL for workspaces created from this template. This licens
 | ---- | --------------------- |
 | Type | <code>duration</code> |
 
-Edit the template maximum time before shutdown - workspaces created from this template must shutdown within the given duration after starting. This is an enterprise-only feature.
+Edit the template maximum time before shutdown - workspaces created from this template must shutdown within the given duration after starting, regardless of user activity. This is an enterprise-only feature. Maps to "Max lifetime" in the UI.
 
 ### --name
 
@@ -105,6 +113,15 @@ Edit the template maximum time before shutdown - workspaces created from this te
 
 Edit the template name.
 
+### --require-active-version
+
+|         |                    |
+| ------- | ------------------ |
+| Type    | <code>bool</code>  |
+| Default | <code>false</code> |
+
+Requires workspace builds to use the active template version. This setting does not apply to template admins. This is an enterprise-only feature.
+
 ### -y, --yes
 
 |      |                   |
diff --git a/docs/cli/templates_init.md b/docs/cli/templates_init.md
index a128d3533c189..76cea7242cb5b 100644
--- a/docs/cli/templates_init.md
+++ b/docs/cli/templates_init.md
@@ -15,7 +15,7 @@ coder templates init [flags] [directory]
 ### --id
 
 |      |                              |
-| ---- | ---------------------------- | --------- | ----------- | ----------- | -------- | ------ | -------------------- | ---------------- | --------- | ---------------- | ----------- | ------------------ |
-| Type | <code>enum[aws-ecs-container | aws-linux | aws-windows | azure-linux | do-linux | docker | docker-with-dotfiles | fly-docker-image | gcp-linux | gcp-vm-container | gcp-windows | kubernetes]</code> |
+| ---- | ---------------------------- | --------- | ----------- | ----------- | -------- | ------ | -------------------- | --------- | ---------------- | ----------- | ---------- | -------------------- |
+| Type | <code>enum[aws-ecs-container | aws-linux | aws-windows | azure-linux | do-linux | docker | docker-with-dotfiles | gcp-linux | gcp-vm-container | gcp-windows | kubernetes | nomad-docker]</code> |
 
 Specify a given example template by ID.
diff --git a/docs/cli/templates_plan.md b/docs/cli/templates_plan.md
deleted file mode 100644
index 06ed7d56c507d..0000000000000
--- a/docs/cli/templates_plan.md
+++ /dev/null
@@ -1,11 +0,0 @@
-<!-- DO NOT EDIT | GENERATED CONTENT -->
-
-# templates plan
-
-Plan a template push from the current directory
-
-## Usage
-
-```console
-coder templates plan <directory>
-```
diff --git a/docs/cli/templates_pull.md b/docs/cli/templates_pull.md
index 8e0dd41d13282..9ad51ab64c912 100644
--- a/docs/cli/templates_pull.md
+++ b/docs/cli/templates_pull.md
@@ -2,7 +2,7 @@
 
 # templates pull
 
-Download the latest version of a template to a path.
+Download the active, latest, or specified version of a template to a path.
 
 ## Usage
 
@@ -20,6 +20,14 @@ coder templates pull [flags] <name> [destination]
 
 Output the template as a tar archive to stdout.
 
+### --version
+
+|      |                     |
+| ---- | ------------------- |
+| Type | <code>string</code> |
+
+The name of the template version to pull. Use 'active' to pull the active version, 'latest' to pull the latest version, or the name of the template version to pull.
+
 ### -y, --yes
 
 |      |                   |
diff --git a/docs/cli/templates_versions.md b/docs/cli/templates_versions.md
index 9114ce1646ccf..81759d6cd3473 100644
--- a/docs/cli/templates_versions.md
+++ b/docs/cli/templates_versions.md
@@ -19,11 +19,13 @@ coder templates versions
 ```console
   - List versions of a specific template:
 
-      $ coder templates versions list my-template
+     $ coder templates versions list my-template
 ```
 
 ## Subcommands
 
-| Name                                              | Purpose                                         |
-| ------------------------------------------------- | ----------------------------------------------- |
-| [<code>list</code>](./templates_versions_list.md) | List all the versions of the specified template |
+| Name                                                        | Purpose                                         |
+| ----------------------------------------------------------- | ----------------------------------------------- |
+| [<code>archive</code>](./templates_versions_archive.md)     | Archive a template version(s).                  |
+| [<code>list</code>](./templates_versions_list.md)           | List all the versions of the specified template |
+| [<code>unarchive</code>](./templates_versions_unarchive.md) | Unarchive a template version(s).                |
diff --git a/docs/cli/templates_versions_archive.md b/docs/cli/templates_versions_archive.md
new file mode 100644
index 0000000000000..3921f6d0032b5
--- /dev/null
+++ b/docs/cli/templates_versions_archive.md
@@ -0,0 +1,21 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# templates versions archive
+
+Archive a template version(s).
+
+## Usage
+
+```console
+coder templates versions archive [flags] <template-name> [template-version-names...]
+```
+
+## Options
+
+### -y, --yes
+
+|      |                   |
+| ---- | ----------------- |
+| Type | <code>bool</code> |
+
+Bypass prompts.
diff --git a/docs/cli/templates_versions_list.md b/docs/cli/templates_versions_list.md
index 6b351675c778d..f1a49ef55d060 100644
--- a/docs/cli/templates_versions_list.md
+++ b/docs/cli/templates_versions_list.md
@@ -17,9 +17,17 @@ coder templates versions list [flags] <template>
 |         |                                                       |
 | ------- | ----------------------------------------------------- |
 | Type    | <code>string-array</code>                             |
-| Default | <code>name,created at,created by,status,active</code> |
+| Default | <code>Name,Created At,Created By,Status,Active</code> |
 
-Columns to display in table output. Available columns: name, created at, created by, status, active.
+Columns to display in table output. Available columns: name, created at, created by, status, active, archived.
+
+### --include-archived
+
+|      |                   |
+| ---- | ----------------- |
+| Type | <code>bool</code> |
+
+Include archived versions in the result list.
 
 ### -o, --output
 
diff --git a/docs/cli/templates_versions_unarchive.md b/docs/cli/templates_versions_unarchive.md
new file mode 100644
index 0000000000000..eeedfe26c4d48
--- /dev/null
+++ b/docs/cli/templates_versions_unarchive.md
@@ -0,0 +1,21 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# templates versions unarchive
+
+Unarchive a template version(s).
+
+## Usage
+
+```console
+coder templates versions unarchive [flags] <template-name> [template-version-names...]
+```
+
+## Options
+
+### -y, --yes
+
+|      |                   |
+| ---- | ----------------- |
+| Type | <code>bool</code> |
+
+Bypass prompts.
diff --git a/docs/cli/tokens.md b/docs/cli/tokens.md
index a6314c05c9137..4e74eb9516057 100644
--- a/docs/cli/tokens.md
+++ b/docs/cli/tokens.md
@@ -20,15 +20,15 @@ coder tokens
 Tokens are used to authenticate automated clients to Coder.
   - Create a token for automation:
 
-      $ coder tokens create
+     $ coder tokens create
 
   - List your tokens:
 
-      $ coder tokens ls
+     $ coder tokens ls
 
   - Remove a token by ID:
 
-      $ coder tokens rm WuoWs4ZsMX
+     $ coder tokens rm WuoWs4ZsMX
 ```
 
 ## Subcommands
diff --git a/docs/cli/update.md b/docs/cli/update.md
index 0b3d31a9755b8..b81172df6b9ca 100644
--- a/docs/cli/update.md
+++ b/docs/cli/update.md
@@ -26,6 +26,15 @@ Use --always-prompt to change the parameter values of the workspace.
 
 Always prompt all parameters. Does not pull parameter values from existing workspace.
 
+### --build-option
+
+|             |                                  |
+| ----------- | -------------------------------- |
+| Type        | <code>string-array</code>        |
+| Environment | <code>$CODER_BUILD_OPTION</code> |
+
+Build option value in the format "name=value".
+
 ### --build-options
 
 |      |                   |
@@ -34,6 +43,15 @@ Always prompt all parameters. Does not pull parameter values from existing works
 
 Prompt for one-time build options defined with ephemeral parameters.
 
+### --parameter
+
+|             |                                    |
+| ----------- | ---------------------------------- |
+| Type        | <code>string-array</code>          |
+| Environment | <code>$CODER_RICH_PARAMETER</code> |
+
+Rich parameter value in the format "name=value".
+
 ### --rich-parameter-file
 
 |             |                                         |
diff --git a/docs/cli/users.md b/docs/cli/users.md
index ade49b04a866b..f0ca83cd93f2a 100644
--- a/docs/cli/users.md
+++ b/docs/cli/users.md
@@ -20,6 +20,7 @@ coder users [subcommand]
 | -------------------------------------------- | ------------------------------------------------------------------------------------- |
 | [<code>activate</code>](./users_activate.md) | Update a user's status to 'active'. Active users can fully interact with the platform |
 | [<code>create</code>](./users_create.md)     |                                                                                       |
+| [<code>delete</code>](./users_delete.md)     | Delete a user by username or user_id.                                                 |
 | [<code>list</code>](./users_list.md)         |                                                                                       |
 | [<code>show</code>](./users_show.md)         | Show a single user. Use 'me' to indicate the currently authenticated user.            |
 | [<code>suspend</code>](./users_suspend.md)   | Update a user's status to 'suspended'. A suspended user cannot log into the platform  |
diff --git a/docs/cli/users_activate.md b/docs/cli/users_activate.md
index 07c001e81d67f..f5b2d3e8b85ca 100644
--- a/docs/cli/users_activate.md
+++ b/docs/cli/users_activate.md
@@ -17,7 +17,7 @@ coder users activate [flags] <username|user_id>
 ## Description
 
 ```console
-  $ coder users activate example_user
+ $ coder users activate example_user
 ```
 
 ## Options
diff --git a/docs/cli/users_create.md b/docs/cli/users_create.md
index 2eb78318ffa0a..b89ff2aeb6d45 100644
--- a/docs/cli/users_create.md
+++ b/docs/cli/users_create.md
@@ -10,21 +10,21 @@ coder users create [flags]
 
 ## Options
 
-### --disable-login
+### -e, --email
 
-|      |                   |
-| ---- | ----------------- |
-| Type | <code>bool</code> |
+|      |                     |
+| ---- | ------------------- |
+| Type | <code>string</code> |
 
-Disabling login for a user prevents the user from authenticating via password or IdP login. Authentication requires an API key/token generated by an admin. Be careful when using this flag as it can lock the user out of their account.
+Specifies an email address for the new user.
 
-### -e, --email
+### --login-type
 
 |      |                     |
 | ---- | ------------------- |
 | Type | <code>string</code> |
 
-Specifies an email address for the new user.
+Optionally specify the login type for the user. Valid values are: password, none, github, oidc. Using 'none' prevents the user from authenticating and requires an API key/token to be generated by an admin.
 
 ### -p, --password
 
diff --git a/docs/cli/users_delete.md b/docs/cli/users_delete.md
new file mode 100644
index 0000000000000..d4da1c8b5db7a
--- /dev/null
+++ b/docs/cli/users_delete.md
@@ -0,0 +1,15 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+
+# users delete
+
+Delete a user by username or user_id.
+
+Aliases:
+
+- rm
+
+## Usage
+
+```console
+coder users delete <username|user_id>
+```
diff --git a/docs/cli/users_show.md b/docs/cli/users_show.md
index 77f9c914c6924..dc941a9728c8b 100644
--- a/docs/cli/users_show.md
+++ b/docs/cli/users_show.md
@@ -13,7 +13,7 @@ coder users show [flags] <username|user_id|'me'>
 ## Description
 
 ```console
-  $ coder users show me
+ $ coder users show me
 ```
 
 ## Options
diff --git a/docs/cli/users_suspend.md b/docs/cli/users_suspend.md
index 3c9676b8b41d0..d2980d00a4d62 100644
--- a/docs/cli/users_suspend.md
+++ b/docs/cli/users_suspend.md
@@ -4,11 +4,6 @@
 
 Update a user's status to 'suspended'. A suspended user cannot log into the platform
 
-Aliases:
-
-- rm
-- delete
-
 ## Usage
 
 ```console
@@ -18,7 +13,7 @@ coder users suspend [flags] <username|user_id>
 ## Description
 
 ```console
-  $ coder users suspend example_user
+ $ coder users suspend example_user
 ```
 
 ## Options
diff --git a/docs/contributing/CODE_OF_CONDUCT.md b/docs/contributing/CODE_OF_CONDUCT.md
index 81db506b6ff38..5e40eb816bc17 100644
--- a/docs/contributing/CODE_OF_CONDUCT.md
+++ b/docs/contributing/CODE_OF_CONDUCT.md
@@ -5,9 +5,9 @@
 In the interest of fostering an open and welcoming environment, we as
 contributors and maintainers pledge to making participation in our project and
 our community a harassment-free experience for everyone, regardless of age, body
-size, disability, ethnicity, sex characteristics, gender identity and expression,
-level of experience, education, socio-economic status, nationality, personal
-appearance, race, religion, or sexual identity and orientation.
+size, disability, ethnicity, sex characteristics, gender identity and
+expression, level of experience, education, socio-economic status, nationality,
+personal appearance, race, religion, or sexual identity and orientation.
 
 ## Our Standards
 
@@ -37,11 +37,11 @@ Project maintainers are responsible for clarifying the standards of acceptable
 behavior and are expected to take appropriate and fair corrective action in
 response to any instances of unacceptable behavior.
 
-Project maintainers have the right and responsibility to remove, edit, or
-reject comments, commits, code, wiki edits, issues, and other contributions
-that are not aligned to this Code of Conduct, or to ban temporarily or
-permanently any contributor for other behaviors that they deem inappropriate,
-threatening, offensive, or harmful.
+Project maintainers have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, or to ban temporarily or permanently any
+contributor for other behaviors that they deem inappropriate, threatening,
+offensive, or harmful.
 
 ## Scope
 
@@ -55,11 +55,11 @@ further defined and clarified by project maintainers.
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team at opensource@coder.com. All
-complaints will be reviewed and investigated and will result in a response that
-is deemed necessary and appropriate to the circumstances. The project team is
-obligated to maintain confidentiality with regard to the reporter of an incident.
-Further details of specific enforcement policies may be posted separately.
+reported by contacting the project team at opensource@coder.com. All complaints
+will be reviewed and investigated and will result in a response that is deemed
+necessary and appropriate to the circumstances. The project team is obligated to
+maintain confidentiality with regard to the reporter of an incident. Further
+details of specific enforcement policies may be posted separately.
 
 Project maintainers who do not follow or enforce the Code of Conduct in good
 faith may face temporary or permanent repercussions as determined by other
@@ -67,8 +67,9 @@ members of the project's leadership.
 
 ## Attribution
 
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 1.4, available at
+https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
 
 [homepage]: https://www.contributor-covenant.org
 
diff --git a/docs/contributing/SECURITY.md b/docs/contributing/SECURITY.md
index 649e87d772343..35dc53efd6934 100644
--- a/docs/contributing/SECURITY.md
+++ b/docs/contributing/SECURITY.md
@@ -1,4 +1,4 @@
 # Security Policy
 
-If you find a vulnerability, **DO NOT FILE AN ISSUE**.
-Instead, send an email to security@coder.com.
+If you find a vulnerability, **DO NOT FILE AN ISSUE**. Instead, send an email to
+security@coder.com.
diff --git a/docs/contributing/documentation.md b/docs/contributing/documentation.md
index 94eba6a3b8068..0f4ba55877b9a 100644
--- a/docs/contributing/documentation.md
+++ b/docs/contributing/documentation.md
@@ -10,12 +10,12 @@ This style guide is primarily for use with authoring documentation.
 - Use plural nouns and pronouns (_they_, _their_, or _them_), especially when
   the specific number is uncertain (i.e., "Set up your environments" even though
   you don't know if the user will have one or many environments)
-- When writing documentation titles, use the noun form, not the gerund form (e.g., "Environment
-  Management" instead of "Managing Environments")
+- When writing documentation titles, use the noun form, not the gerund form
+  (e.g., "Environment Management" instead of "Managing Environments")
 - Context matters when you decide whether to capitalize something or not. For
-  example, ["A Job creates one or more
-  Pods..."](https://kubernetes.io/docs/concepts/workloads/controllers/job/) is
-  correct when writing about Kubernetes. However, in other contexts, neither
+  example,
+  ["A Job creates one or more Pods..."](https://kubernetes.io/docs/concepts/workloads/controllers/job/)
+  is correct when writing about Kubernetes. However, in other contexts, neither
   _job_ nor _pods_ would be capitalized. Please follow the conventions set forth
   by the relevant companies and open source communities.
 
@@ -79,8 +79,8 @@ For code that you want users to enter via a command-line interface, use
 
 ### Punctuation
 
-Do not use the ampersand (&) as a shorthand for _and_ unless you're referring to a
-UI element or the name of something that uses _&_.
+Do not use the ampersand (&) as a shorthand for _and_ unless you're referring to
+a UI element or the name of something that uses _&_.
 
 You can use the symbol `~` in place of the word _approximately_.
 
@@ -91,13 +91,14 @@ and anything that has a name visible to the user, use bold font.
 
 **Example:** On the **Environment Overview** page, click **Configure SSH**.
 
-Don't use code font for UI elements unless it is rendered based on previously entered
-text. For example, if you tell the user to provide the environment name as
-`myEnvironment`, then use both bold and cold font when referring to the name.
+Don't use code font for UI elements unless it is rendered based on previously
+entered text. For example, if you tell the user to provide the environment name
+as `myEnvironment`, then use both bold and cold font when referring to the name.
 
 **Example**: Click **`myEnvironment`**.
 
-When writing out instructions that involve UI elements, both of the following options are acceptable:
+When writing out instructions that involve UI elements, both of the following
+options are acceptable:
 
 - Go to **Manage** > **Users**.
 - In the **Manage** menu, click **Users**.
@@ -111,13 +112,13 @@ Below summarizes the guidelines regarding how Coder terms should be used.
 The only Coder-specific terms that should be capitalized are the names of
 products (e.g., Coder).
 
-The exception is **code-server**, which is always lowercase. If it appears at the
-beginning of the sentence, rewrite the sentence to avoid this usage.
+The exception is **code-server**, which is always lowercase. If it appears at
+the beginning of the sentence, rewrite the sentence to avoid this usage.
 
 ### Uncapitalized terms
 
-In general, we do not capitalize the names of features (unless the situation calls for it,
-such as the word appearing at the beginning of a sentence):
+In general, we do not capitalize the names of features (unless the situation
+calls for it, such as the word appearing at the beginning of a sentence):
 
 - account dormancy
 - audit logs
diff --git a/docs/contributing/feature-stages.md b/docs/contributing/feature-stages.md
index 6ccb4e6edccb1..25b37bbc01863 100644
--- a/docs/contributing/feature-stages.md
+++ b/docs/contributing/feature-stages.md
@@ -4,13 +4,18 @@ Some Coder features are released as Alpha or Experimental.
 
 ## Alpha features
 
-Alpha features are enabled in all Coder deployments but the feature is subject to change, or even be removed. Breaking changes may not be documented in the changelog. In most cases, features will only stay in alpha for 1 month.
+Alpha features are enabled in all Coder deployments but the feature is subject
+to change, or even be removed. Breaking changes may not be documented in the
+changelog. In most cases, features will only stay in alpha for 1 month.
 
-We recommend using [GitHub issues](https://github.com/coder/coder/issues) to leave feedback and get support for alpha features.
+We recommend using [GitHub issues](https://github.com/coder/coder/issues) to
+leave feedback and get support for alpha features.
 
 ## Experimental features
 
-These features are disabled by default, and not recommended for use in production as they may cause performance or stability issues. In most cases, features will only stay in experimental for 1-2 weeks of internal testing.
+These features are disabled by default, and not recommended for use in
+production as they may cause performance or stability issues. In most cases,
+features will only stay in experimental for 1-2 weeks of internal testing.
 
 ```yaml
 # Enable all experimental features
@@ -22,4 +27,5 @@ coder server --experiments=feature1,feature2
 # Alternatively, use the `CODER_EXPERIMENTS` environment variable.
 ```
 
-For a list of all experiments, refer to the [codersdk reference](https://pkg.go.dev/github.com/coder/coder/codersdk#Experiment).
+For a list of all experiments, refer to the
+[codersdk reference](https://pkg.go.dev/github.com/coder/coder/v2/codersdk#Experiment).
diff --git a/docs/contributing/frontend.md b/docs/contributing/frontend.md
index 03ebd41fa28a0..b1e4858ce5485 100644
--- a/docs/contributing/frontend.md
+++ b/docs/contributing/frontend.md
@@ -1,79 +1,125 @@
 # Frontend
 
-This is a guide to help the Coder community and also Coder members contribute to our UI. It is ongoing work but we hope it provides some useful information to get started. If you have any questions or need help, please send us a message on our [Discord server](https://discord.com/invite/coder). We'll be happy to help you.
+This is a guide to help the Coder community and also Coder members contribute to
+our UI. It is ongoing work but we hope it provides some useful information to
+get started. If you have any questions or need help, please send us a message on
+our [Discord server](https://discord.com/invite/coder). We'll be happy to help
+you.
 
 ## Running the UI
 
 You can run the UI and access the dashboard in two ways:
 
-- Build the UI pointing to an external Coder server: `CODER_HOST=https://mycoder.com yarn dev` inside of the `site` folder. This is helpful when you are building something in the UI and already have the data on your deployed server.
-- Build the entire Coder server + UI locally: `./scripts/develop.sh` in the root folder. It is useful when you have to contribute with features that are not deployed yet or when you have to work on both, frontend and backend.
+- Build the UI pointing to an external Coder server:
+  `CODER_HOST=https://mycoder.com pnpm dev` inside of the `site` folder. This is
+  helpful when you are building something in the UI and already have the data on
+  your deployed server.
+- Build the entire Coder server + UI locally: `./scripts/develop.sh` in the root
+  folder. It is useful when you have to contribute with features that are not
+  deployed yet or when you have to work on both, frontend and backend.
 
-In both cases, you can access the dashboard on `http://localhost:8080`. If you are running the `./scripts/develop.sh` you can log in using the default credentials: `admin@coder.com` and `SomeSecurePassword!`.
+In both cases, you can access the dashboard on `http://localhost:8080`. If you
+are running the `./scripts/develop.sh` you can log in using the default
+credentials: `admin@coder.com` and `SomeSecurePassword!`.
 
 ## Tech Stack
 
-All our dependencies are described in `site/package.json` but here are the most important ones:
+All our dependencies are described in `site/package.json` but here are the most
+important ones:
 
 - [React](https://reactjs.org/) as framework
 - [Typescript](https://www.typescriptlang.org/) to keep our sanity
 - [Vite](https://vitejs.dev/) to build the project
-- [Material V4](https://v4.mui.com/) for UI components
+- [Material V5](https://mui.com/material-ui/getting-started/) for UI components
 - [react-router](https://reactrouter.com/en/main) for routing
-- [TanStack Query v4](https://tanstack.com/query/v4/docs/react/overview) for fetching data
+- [TanStack Query v4](https://tanstack.com/query/v4/docs/react/overview) for
+  fetching data
 - [XState](https://xstate.js.org/docs/) for handling complex state flows
 - [axios](https://github.com/axios/axios) as fetching lib
-- [Playwright](https://playwright.dev/) for E2E testing
+- [Playwright](https://playwright.dev/) for end-to-end (E2E) testing
 - [Jest](https://jestjs.io/) for integration testing
-- [Storybook](https://storybook.js.org/) and [Chromatic](https://www.chromatic.com/) for visual testing
+- [Storybook](https://storybook.js.org/) and
+  [Chromatic](https://www.chromatic.com/) for visual testing
+- [PNPM](https://pnpm.io/) as package manager
 
 ## Structure
 
-All the code related to the UI is inside the `site` folder and we defined a few conventions to help people to navigate through it.
+All the code related to the UI is inside the `site` folder and we defined a few
+conventions to help people to navigate through it.
 
-- **e2e** - E2E tests
+- **e2e** - End-to-end (E2E) tests
 - **src** - Source code
   - **mocks** - [Manual mocks](https://jestjs.io/docs/manual-mocks) used by Jest
   - **@types** - Custom types for dependencies that don't have defined types
+    (largely code that has no server-side equivalent)
   - **api** - API code as function calls and types
   - **components** - UI components
   - **hooks** - Hooks that can be used across the application
-  - **i18n** - Translations
   - **pages** - Page components
   - **testHelpers** - Helper functions to help with integration tests
   - **util** - Helper functions that can be used across the application
-  - **xServices** - XState machines used to fetch data and handle complex scenarios
-- **static** - UI static assets like images, fonts, icons, etc
+  - **xServices** - XState machines used to handle complex state representations
+- **static** - Static UI assets like images, fonts, icons, etc
 
 ## Routing
 
-We use [react-router](https://reactrouter.com/en/main) as our routing engine and adding a new route is very easy. If the new route needs to be authenticated, put it under the `<RequireAuth>` route and if it needs to live inside of the dashboard, put it under the `<DashboardLayout>` route.
+We use [react-router](https://reactrouter.com/en/main) as our routing engine and
+adding a new route is very easy. If the new route needs to be authenticated, put
+it under the `<RequireAuth>` route and if it needs to live inside of the
+dashboard, put it under the `<DashboardLayout>` route.
 
-The `RequireAuth` component handles all the authentication logic for the routes and the `DashboardLayout` wraps the route adding a navbar and passing down common dashboard data.
+The `RequireAuth` component handles all the authentication logic for the routes
+and the `DashboardLayout` wraps the route adding a navbar and passing down
+common dashboard data.
 
 ## Pages
 
-Pages are the top-level components of the app. The page component lives under the `src/pages` folder and each page should have its own folder so we can better group the views, tests, utility functions and so on. We use a structure where the page component is responsible for fetching all the data and passing it down to the view. We explain this decision a bit better in the next section.
+Pages are the top-level components of the app. The page component lives under
+the `src/pages` folder and each page should have its own folder so we can better
+group the views, tests, utility functions and so on. We use a structure where
+the page component is responsible for fetching all the data and passing it down
+to the view. We explain this decision a bit better in the next section.
 
-> ℹ️ Code that is only related to the page should live inside of the page folder but if at some point it is used in other pages or components, you should consider moving it to the `src` level in the `utils`, `hooks` or `components` folder.
+> ℹ️ Code that is only related to the page should live inside of the page folder
+> but if at some point it is used in other pages or components, you should
+> consider moving it to the `src` level in the `utils`, `hooks` or `components`
+> folder.
 
 ### States
 
-A page usually has at least three states: **loading**, **ready** or **success**, and **error** so remember to always handle these scenarios while you are coding a page. We also encourage you to add visual testing for these three states using the `*.stories.ts` file.
+A page usually has at least three states: **loading**, **ready**/**success**,
+and **error**, so always remember to handle these scenarios while you are coding
+a page. We also encourage you to add visual testing for these three states using
+a `*.stories.ts` file.
 
 ## Fetching data
 
-We use [TanStack Query v4](https://tanstack.com/query/v4/docs/react/overview)(previously known as react-query) to fetch data from the API. We also use [XState](https://xstate.js.org/docs/) to handle complex flows with multiple states and transitions.
+We use
+[TanStack Query v4](https://tanstack.com/query/v4/docs/react/overview)(previously
+known as react-query) to fetch data from the API. We also use
+[XState](https://xstate.js.org/docs/) to handle complex flows with multiple
+states and transitions.
 
-> ℹ️ We recently changed how we are going to fetch data from the server so you will see a lot of fetches being made using XState machines but feel free to refactor it if you are already touching those files.
+> ℹ️ We recently changed how we are going to fetch data from the server so you
+> will see a lot of fetches being made using XState machines but feel free to
+> refactor it if you are already touching those files.
 
 ### Where to fetch data
 
-Finding the right place to fetch data in React apps is the one million dollar question but we decided to make it only in the page components and pass the props down to the views. This makes it easier to find where data is being loaded and easy to test using Storybook. So you will see components like `UsersPage` and `UsersPageView`.
+Finding the right place to fetch data in React apps is the million-dollar
+question, but we decided to make it only in the page components and pass the
+props down to the views. This makes it easier to find where data is being loaded
+and easy to test using Storybook. So you will see components like `UsersPage`
+and `UsersPageView`.
 
 ### API
 
-We are using [axios](https://github.com/axios/axios) as our fetching library and writing the API functions in the `site/src/api/api.ts` files. We also have auto-generated types from our Go server on `site/src/api/typesGenerated.ts`. Usually, every endpoint has its own ` Request` and `Response` types but sometimes you need to pass extra parameters to make the call like the example below:
+We are using [axios](https://github.com/axios/axios) as our fetching library and
+writing the API functions in the `site/src/api/api.ts` files. We also have
+auto-generated types from our Go server on `site/src/api/typesGenerated.ts`.
+Usually, every endpoint has its own ` Request` and `Response` types, but
+sometimes you need to pass extra parameters to make the call, like in the
+example below:
 
 ```ts
 export const getAgentListeningPorts = async (
@@ -81,61 +127,118 @@ export const getAgentListeningPorts = async (
 ): Promise<TypesGen.ListeningPortsResponse> => {
   const response = await axios.get(
     `/api/v2/workspaceagents/${agentID}/listening-ports`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 ```
 
-Sometimes, a FE operation can have multiple API calls so it is ok to wrap it as a single function.
+Sometimes, a frontend operation can have multiple API calls, so it is okay to
+wrap it as a single function.
 
 ```ts
 export const updateWorkspaceVersion = async (
   workspace: TypesGen.Workspace,
 ): Promise<TypesGen.WorkspaceBuild> => {
-  const template = await getTemplate(workspace.template_id)
-  return startWorkspace(workspace.id, template.active_version_id)
-}
+  const template = await getTemplate(workspace.template_id);
+  return startWorkspace(workspace.id, template.active_version_id);
+};
 ```
 
-If you need more granular errors or control, you may should consider keep them separated and use XState for that.
+If you need more granular errors or control, you may should consider keep them
+separated and use XState for that.
 
 ## Components
 
-We are using [Material V4](https://v4.mui.com/) in our UI and we don't have any short-term plans to update or even replace it. It still provides good value for us and changing it would cost too much work which is not valuable right now but of course, it can change in the future.
+The codebase is currently using MUI v5. Please see the
+[official documentation](https://mui.com/material-ui/getting-started/). In
+general, favor building a custom component via MUI instead of plain React/HTML,
+as MUI's suite of components is thoroughly battle-tested and accessible right
+out of the box.
 
 ### Structure
 
-Each component gets its own folder. Make sure you add a test and Storybook stories for the component as well. By keeping these tidy, the codebase will remain easy to navigate, healthy and maintainable for all contributors.
+Each component gets its own folder. Make sure you add a test and Storybook
+stories for the component as well. By keeping these tidy, the codebase will
+remain easy to navigate, healthy and maintainable for all contributors.
 
 ### Accessibility
 
-We strive to keep our UI accessible. When using colors, avoid adding new elements with low color contrast. Always use labels on inputs, not just placeholders. These are important for screen-readers.
+We strive to keep our UI accessible.
+
+In general, colors should come from the app theme, but if there is a need to add
+a custom color, please ensure that the foreground and background have a minimum
+contrast ratio of 4.5:1 to meet WCAG level AA compliance. WebAIM has
+[a great tool for checking your colors directly](https://webaim.org/resources/contrastchecker/),
+but tools like
+[Dequeue's axe DevTools](https://chrome.google.com/webstore/detail/axe-devtools-web-accessib/lhdoppojpmngadmnindnejefpokejbdd)
+can also do automated checks in certain situations.
+
+When using any kind of input element, always make sure that there is a label
+associated with that element (the label can be made invisible for aesthetic
+reasons, but it should always be in the HTML markup). Labels are important for
+screen-readers; a placeholder text value is not enough for all users.
+
+When possible, make sure that all image/graphic elements have accompanying text
+that describes the image. `<img />` elements should have an `alt` text value. In
+other situations, it might make sense to place invisible, descriptive text
+inside the component itself using MUI's `visuallyHidden` utility function.
+
+```tsx
+import { visuallyHidden } from "@mui/utils";
+
+<Button>
+  <GearIcon />
+  <Box component="span" sx={visuallyHidden}>
+    Settings
+  </Box>
+</Button>;
+```
 
 ### Should I create a new component?
 
-As with most things in the world, it depends. If you are creating a new component to encapsulate some UI abstraction like `UsersTable` it is ok but you should always try to use the base components that are provided by the library or from the codebase so I recommend you to always do a quick search before creating a custom primitive component like dialogs, popovers, buttons, etc.
+As with most things in the world, it depends. If you are creating a new
+component to encapsulate some UI abstraction like `UsersTable` it is ok but you
+should always try to use the base components that are provided by the library or
+from the codebase. It's recommended that you always do a quick search before
+creating a custom primitive component like dialogs, popovers, buttons, etc.
 
 ## Testing
 
-We use three types of testing in our app: **E2E**, **Integration** and **Visual Testing**.
+We use three types of testing in our app: **End-to-end (E2E)**, **Integration**
+and **Visual Testing**.
 
-### E2E (end-to-end)
+### End-to-End (E2E)
 
-Are useful to test complete flows like "Create a user", "Import template", etc. For this one, we use [Playwright](https://playwright.dev/). If you only need to test if the page is being rendered correctly, you should probably consider using the **Visual Testing** approach.
+These are useful for testing complete flows like "Create a user", "Import
+template", etc. We use [Playwright](https://playwright.dev/). If you only need
+to test if the page is being rendered correctly, you should consider using the
+**Visual Testing** approach.
 
-> ℹ️ For scenarios where you need to be authenticated, you can use `test.use({ storageState: getStatePath("authState") })`.
+> ℹ️ For scenarios where you need to be authenticated, you can use
+> `test.use({ storageState: getStatePath("authState") })`.
 
 ### Integration
 
-Test user interactions like "Click in a button shows a dialog", "Submit the form sends the correct data", etc. For this, we use [Jest](https://jestjs.io/) and [react-testing-library](https://testing-library.com/docs/react-testing-library/intro/). If the test involves routing checks like redirects or maybe checking the info on another page, you should probably consider using the **E2E** approach.
+Test user interactions like "Click in a button shows a dialog", "Submit the form
+sends the correct data", etc. For this, we use [Jest](https://jestjs.io/) and
+[react-testing-library](https://testing-library.com/docs/react-testing-library/intro/).
+If the test involves routing checks like redirects or maybe checking the info on
+another page, you should probably consider using the **E2E** approach.
 
 ### Visual testing
 
-Test components without user interaction like testing if a page view is rendered correctly depending on some parameters, if the button is showing a spinner if the `loading` props are passing, etc. This should always be your first option since it is way easier to maintain. For this, we use [Storybook](https://storybook.js.org/) and [Chromatic](https://www.chromatic.com/).
+Test components without user interaction like testing if a page view is rendered
+correctly depending on some parameters, if the button is showing a spinner if
+the `loading` props are passing, etc. This should always be your first option
+since it is way easier to maintain. For this, we use
+[Storybook](https://storybook.js.org/) and
+[Chromatic](https://www.chromatic.com/).
 
 ### What should I test?
 
-Choosing what to test is not always easy since there are a lot of flows and a lot of things can happen but these are a few indicators that can help you with that:
+Choosing what to test is not always easy since there are a lot of flows and a
+lot of things can happen but these are a few indicators that can help you with
+that:
 
 - Things that can block the user
 - Reported bugs
@@ -143,33 +246,44 @@ Choosing what to test is not always easy since there are a lot of flows and a lo
 
 ### Tests getting too slow
 
-A few times you can notice tests can take a very long time to get done. Sometimes it is because the test itself is complex and runs a lot of stuff, and sometimes it is because of how we are querying things. In the next section, we are going to talk more about them.
+A few times you can notice tests can take a very long time to get done.
+Sometimes it is because the test itself is complex and runs a lot of stuff, and
+sometimes it is because of how we are querying things. In the next section, we
+are going to talk more about them.
 
 #### Using `ByRole` queries
 
-One thing we figured out that was slowing down our tests was the use of `ByRole` queries because of how it calculates the role attribute for every element on the `screen`. You can read more about it on the links below:
+One thing we figured out that was slowing down our tests was the use of `ByRole`
+queries because of how it calculates the role attribute for every element on the
+`screen`. You can read more about it on the links below:
 
 - https://stackoverflow.com/questions/69711888/react-testing-library-getbyrole-is-performing-extremely-slowly
 - https://github.com/testing-library/dom-testing-library/issues/552#issuecomment-625172052
 
-Even with `ByRole` having performance issues we still want to use it but for that, we have to scope the "querying" area by using the `within` command. So instead of using `screen.getByRole("button")` directly we could do `within(form).getByRole("button")`.
+Even with `ByRole` having performance issues we still want to use it but for
+that, we have to scope the "querying" area by using the `within` command. So
+instead of using `screen.getByRole("button")` directly we could do
+`within(form).getByRole("button")`.
 
-❌ Not ideal. If the screen has a hundred or thousand elements it can be VERY slow.
+❌ Not ideal. If the screen has a hundred or thousand elements it can be VERY
+slow.
 
 ```tsx
-user.click(screen.getByRole("button"))
+user.click(screen.getByRole("button"));
 ```
 
 ✅ Better. We can limit the number of elements we are querying.
 
 ```tsx
-const form = screen.getByTestId("form")
-user.click(within(form).getByRole("button"))
+const form = screen.getByTestId("form");
+user.click(within(form).getByRole("button"));
 ```
 
 #### `jest.spyOn` with the API is not working
 
-For some unknown reason, we figured out the `jest.spyOn` is not able to mock the API function when they are passed directly into the services XState machine configuration.
+For some unknown reason, we figured out the `jest.spyOn` is not able to mock the
+API function when they are passed directly into the services XState machine
+configuration.
 
 ❌ Does not work
 
diff --git a/docs/dotfiles.md b/docs/dotfiles.md
index af87e116bb853..7ce12f5b226b6 100644
--- a/docs/dotfiles.md
+++ b/docs/dotfiles.md
@@ -36,13 +36,13 @@ resource "coder_agent" "main" {
 
 ## Persistent Home
 
-Sometimes you want to support personalization without
-requiring dotfiles.
+Sometimes you want to support personalization without requiring dotfiles.
 
 In such cases:
 
 - Mount a persistent volume to the `/home` directory
-- Set the `startup_script` to call a `~/personalize` script that the user can edit
+- Set the `startup_script` to call a `~/personalize` script that the user can
+  edit
 
 ```hcl
 resource "coder_agent" "main" {
@@ -63,7 +63,8 @@ sudo apt install -y neovim fish cargo
 
 ## Setup script support
 
-User can setup their dotfiles by creating one of the following script files in their dotfiles repo:
+User can setup their dotfiles by creating one of the following script files in
+their dotfiles repo:
 
 - `install.sh`
 - `install`
@@ -74,9 +75,13 @@ User can setup their dotfiles by creating one of the following script files in t
 - `setup`
 - `script/setup`
 
-If any of the above files are found (in the specified order), Coder will try to execute the first match. After the first match is found, other files will be ignored.
+If any of the above files are found (in the specified order), Coder will try to
+execute the first match. After the first match is found, other files will be
+ignored.
 
-The setup script must be executable, otherwise the dotfiles setup will fail. If you encounter this issue, you can fix it by making the script executable using the following commands:
+The setup script must be executable, otherwise the dotfiles setup will fail. If
+you encounter this issue, you can fix it by making the script executable using
+the following commands:
 
 ```shell
 cd <path_to_dotfiles_repo>
diff --git a/docs/enterprise.md b/docs/enterprise.md
index f2be0c759642f..1099703f6279c 100644
--- a/docs/enterprise.md
+++ b/docs/enterprise.md
@@ -1,30 +1,39 @@
 # Enterprise Features
 
-Coder is free to use and includes some features that are only accessible with a paid license.
-[Contact Sales](https://coder.com/contact) for pricing or [get a free
-trial](https://coder.com/trial).
-
-| Category        | Feature                                                                              | Open Source | Enterprise |
-| --------------- | ------------------------------------------------------------------------------------ | :---------: | :--------: |
-| User Management | [Groups](./admin/groups.md)                                                          |     ❌      |     ✅     |
-| User Management | [Group & role sync](./admin/auth.md#group-sync-enterprise)                           |     ❌      |     ✅     |
-| User Management | [SCIM](./admin/auth.md#scim)                                                         |     ❌      |     ✅     |
-| Governance      | [Audit Logging](./admin/audit-logs.md)                                               |     ❌      |     ✅     |
-| Governance      | [Browser Only Connections](./networking/#browser-only-connections-enterprise)        |     ❌      |     ✅     |
-| Governance      | [Template Access Control](./admin/rbac.md)                                           |     ❌      |     ✅     |
-| Cost Control    | [Quotas](./admin/quotas.md)                                                          |     ❌      |     ✅     |
-| Cost Control    | [Max Workspace Autostop](./templates/#configure-max-workspace-autostop)              |     ❌      |     ✅     |
-| Deployment      | [High Availability](./admin/high-availability.md)                                    |     ❌      |     ✅     |
-| Deployment      | [Multiple Git Providers](./admin/git-providers.md#multiple-git-providers-enterprise) |     ❌      |     ✅     |
-| Deployment      | [Appearance](./admin/appearance.md)                                                  |     ❌      |     ✅     |
-| Deployment      | [Isolated Terraform Runners](./admin/provisioners.md)                                |     ❌      |     ✅     |
-| Deployment      | [Workspace Proxies](./admin/workspace-proxies.md)                                    |     ❌      |     ✅     |
-
-> Previous plans to restrict OIDC and Git Auth features in OSS have been removed
-> as of 2023-01-11
+Coder is free to use and includes some features that are only accessible with a
+paid license. [Contact Sales](https://coder.com/contact) for pricing or
+[get a free trial](https://coder.com/trial).
+
+| Category        | Feature                                                                                             | Open Source | Enterprise |
+| --------------- | --------------------------------------------------------------------------------------------------- | :---------: | :--------: |
+| Support         | Email, Phone, Prioritization                                                                        |     ❌      |     ✅     |
+| Scale           | [High Availability](./admin/high-availability.md)                                                   |     ❌      |     ✅     |
+| Scale           | [Multiple External Auth Providers](./admin/external-auth.md#multiple-external-providers-enterprise) |     ❌      |     ✅     |
+| Scale           | [Isolated Terraform Runners](./admin/provisioners.md)                                               |     ❌      |     ✅     |
+| Scale           | [Workspace Proxies](./admin/workspace-proxies.md)                                                   |     ❌      |     ✅     |
+| Governance      | [Audit Logging](./admin/audit-logs.md)                                                              |     ❌      |     ✅     |
+| Governance      | [Browser Only Connections](./networking/#browser-only-connections-enterprise)                       |     ❌      |     ✅     |
+| Governance      | [Groups & Template RBAC](./admin/rbac.md)                                                           |     ❌      |     ✅     |
+| Cost Control    | [Quotas](./admin/quotas.md)                                                                         |     ❌      |     ✅     |
+| Cost Control    | [Max Workspace Autostop](./templates/#configure-max-workspace-autostop)                             |     ❌      |     ✅     |
+| User Management | [Groups](./admin/groups.md)                                                                         |     ❌      |     ✅     |
+| User Management | [Group & role sync](./admin/auth.md#group-sync-enterprise)                                          |     ❌      |     ✅     |
+| User Management | [SCIM](./admin/auth.md#scim)                                                                        |     ❌      |     ✅     |
 
 ## Adding your license key
 
+There are two ways to add an enterprise license to a Coder deployment: In the
+Coder UI or with the Coder CLI.
+
+### Coder UI
+
+Click Deployment, Licenses, Add a license then drag or select the license file
+with the `jwt` extension.
+
+![Add License UI](./images/add-license-ui.png)
+
+### Coder CLI
+
 ### Requirements
 
 - Your license key
diff --git a/docs/ides.md b/docs/ides.md
index d53e7e501a88d..c5aafcec4813a 100644
--- a/docs/ides.md
+++ b/docs/ides.md
@@ -18,25 +18,30 @@ support should work:
 
 ## Visual Studio Code
 
-Click `VS Code Desktop` in the dashboard to one-click enter a workspace. This automatically installs the [Coder Remote](https://github.com/coder/vscode-coder) extension, authenticates with Coder, and connects to the workspace.
+Click `VS Code Desktop` in the dashboard to one-click enter a workspace. This
+automatically installs the [Coder Remote](https://github.com/coder/vscode-coder)
+extension, authenticates with Coder, and connects to the workspace.
 
 ![Demo](https://github.com/coder/vscode-coder/raw/main/demo.gif?raw=true)
 
-You can set the default directory in which VS Code opens via the `dir` argument on
-the `coder_agent` resource in your workspace template. See the [Terraform documentation
-for more details](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#dir).
+You can set the default directory in which VS Code opens via the `dir` argument
+on the `coder_agent` resource in your workspace template. See the
+[Terraform documentation for more details](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#dir).
 
-> The `VS Code Desktop` button can be hidden by enabling [Browser-only connections](./networking/index.md#Browser-only).
+> The `VS Code Desktop` button can be hidden by enabling
+> [Browser-only connections](./networking/index.md#Browser-only).
 
 ### Manual Installation
 
-Launch VS Code Quick Open (Ctrl+P), paste the following command, and press enter.
+Launch VS Code Quick Open (Ctrl+P), paste the following command, and press
+enter.
 
 ```text
 ext install coder.coder-remote
 ```
 
-Alternatively, manually install the VSIX from the [latest release](https://github.com/coder/vscode-coder/releases/latest).
+Alternatively, manually install the VSIX from the
+[latest release](https://github.com/coder/vscode-coder/releases/latest).
 
 ## SSH configuration
 
@@ -45,7 +50,7 @@ Alternatively, manually install the VSIX from the [latest release](https://githu
 
 To access Coder via SSH, run the following in the terminal:
 
-```console
+```shell
 coder config-ssh
 ```
 
@@ -74,8 +79,8 @@ Setting up Gateway also involves picking a project directory, so if you have not
 already done so, you may wish to open a terminal on your Coder workspace and
 check out a copy of the project you intend to work on.
 
-After installing Gateway on your local system, [follow these steps to create a
-Connection and connect to your Coder workspace.](./ides/gateway.md)
+After installing Gateway on your local system,
+[follow these steps to create a Connection and connect to your Coder workspace.](./ides/gateway.md)
 
 | Version   | Status  | Notes                                                    |
 | --------- | ------- | -------------------------------------------------------- |
@@ -85,7 +90,8 @@ Connection and connect to your Coder workspace.](./ides/gateway.md)
 
 ## Web IDEs (Jupyter, code-server, JetBrains Projector)
 
-Web IDEs (code-server, JetBrains Projector, VNC, etc.) are defined in the template. See [IDEs](./ides/web-ides.md).
+Web IDEs (code-server, JetBrains Projector, VNC, etc.) are defined in the
+template. See [IDEs](./ides/web-ides.md).
 
 ## Up next
 
diff --git a/docs/ides/emacs-tramp.md b/docs/ides/emacs-tramp.md
index 0ae6d0aef7db7..9a33bd0141716 100644
--- a/docs/ides/emacs-tramp.md
+++ b/docs/ides/emacs-tramp.md
@@ -1,6 +1,7 @@
 # Emacs TRAMP
 
-[Emacs TRAMP](https://www.emacswiki.org/emacs/TrampMode) is a method of running editing operations on a remote server.
+[Emacs TRAMP](https://www.emacswiki.org/emacs/TrampMode) is a method of running
+editing operations on a remote server.
 
 ## Connecting To A Workspace
 
@@ -10,13 +11,17 @@ To connect to your workspace first run:
 coder config-ssh
 ```
 
-Then you can connect to your workspace by its name in the format: `coder.<WORKSPACE NAME>`.
+Then you can connect to your workspace by its name in the format:
+`coder.<WORKSPACE NAME>`.
 
-In Emacs type `C-x d` and then input: `/-:coder.<WORKSPACE NAME>:` and hit enter. This will open up Dired on the workspace's home directory.
+In Emacs type `C-x d` and then input: `/-:coder.<WORKSPACE NAME>:` and hit
+enter. This will open up Dired on the workspace's home directory.
 
 ### Using SSH
 
-By default Emacs TRAMP is setup to use SCP to access files on the Coder workspace instance. However you might want to use SSH if you have a jumpbox or some other complex network setup.
+By default Emacs TRAMP is setup to use SCP to access files on the Coder
+workspace instance. However you might want to use SSH if you have a jumpbox or
+some other complex network setup.
 
 To do so set the following in your Emacs `init.el` file:
 
@@ -24,13 +29,17 @@ To do so set the following in your Emacs `init.el` file:
 (setq tramp-default-method "ssh")
 ```
 
-Then when you access the workspace instance via `/-:coder.<WORKSPACE NAME>` Emacs will use SSH. Setting `tramp-default-method` will also tell `ansi-term` mode the correct way to access the remote when directory tracking.
+Then when you access the workspace instance via `/-:coder.<WORKSPACE NAME>`
+Emacs will use SSH. Setting `tramp-default-method` will also tell `ansi-term`
+mode the correct way to access the remote when directory tracking.
 
 ## Directory Tracking
 
 ### ansi-term
 
-If you run your terminal in Emacs via `ansi-term` then you might run into a problem where while SSH-ed into a workspace Emacs will not change its `default-directory` to open files in the directory your shell is in.
+If you run your terminal in Emacs via `ansi-term` then you might run into a
+problem where while SSH-ed into a workspace Emacs will not change its
+`default-directory` to open files in the directory your shell is in.
 
 To fix this:
 
@@ -49,7 +58,8 @@ To fix this:
    }
    ```
 
-2. Next in the shell profile file on the workspace (ex., `~/.bashrc` for Bash and `~/.zshrc` for Zsh) add the following:
+2. Next in the shell profile file on the workspace (ex., `~/.bashrc` for Bash
+   and `~/.zshrc` for Zsh) add the following:
 
    ```bash
    ansi_term_announce_host() {
@@ -77,17 +87,24 @@ To fix this:
    ansi_term_announce
    ```
 
-   Ansi Term expects the terminal running inside of it to send escape codes to inform Emacs of the hostname, user, and working directory. The above code sends these escape codes and associated data whenever the terminal logs in and whenever the directory changes.
+   Ansi Term expects the terminal running inside of it to send escape codes to
+   inform Emacs of the hostname, user, and working directory. The above code
+   sends these escape codes and associated data whenever the terminal logs in
+   and whenever the directory changes.
 
 ### eshell
 
-The `eshell` mode will perform directory tracking by default, no additional configuration is needed.
+The `eshell` mode will perform directory tracking by default, no additional
+configuration is needed.
 
 ## Language Servers (Code Completion)
 
-If you use [`lsp-mode`](https://emacs-lsp.github.io/lsp-mode) for code intelligence and completion some additional configuration is required.
+If you use [`lsp-mode`](https://emacs-lsp.github.io/lsp-mode) for code
+intelligence and completion some additional configuration is required.
 
-In your Emacs `init.el` file you must register a LSP client and tell `lsp-mode` how to find it on the remote machine using the `lsp-register-client` function. For each LSP server you want to use in your workspace add the following:
+In your Emacs `init.el` file you must register a LSP client and tell `lsp-mode`
+how to find it on the remote machine using the `lsp-register-client` function.
+For each LSP server you want to use in your workspace add the following:
 
 ```lisp
 (lsp-register-client (make-lsp-client :new-connection (lsp-tramp-connection "<LSP SERVER BINARY>")
@@ -96,13 +113,27 @@ In your Emacs `init.el` file you must register a LSP client and tell `lsp-mode`
               :server-id '<LANGUAGE SERVER ID>))
 ```
 
-This tells `lsp-mode` to look for a language server binary named `<LSP SERVER BINARY>` for use in `<LANGUAGE MODE>` on a machine named `coder.<WORKSPACE NAME>`. Be sure to replace the values between angle brackets:
-
-- `<LSP SERVER BINARY>` : The name of the language server binary, without any path components. For example to use the Deno Javascript language server use the value `deno`.
-- `<LANGUAGE MODE>`: The name of the Emacs major mode for which the language server should be used. For example to enable the language server for Javascript development use the value `web-mode`.
-- `<LANGUAGE SERVER ID>`: This is just the name that `lsp-mode` will use to refer to this language server. If you are ever looking for output buffers or files they may have this name in them.
-
-Calling the `lsp-register-client` function will tell `lsp-mode` the name of the LSP server binary. However this binary must be accessible via the path. If the language server binary is not in the path you must modify `tramp-remote-path` so that `lsp-mode` knows in what directories to look for the LSP server. To do this use TRAMP's connection profiles functionality. These connection profiles let you customize variables depending on what machine you are connected to. Add the following to your `init.el`:
+This tells `lsp-mode` to look for a language server binary named
+`<LSP SERVER BINARY>` for use in `<LANGUAGE MODE>` on a machine named
+`coder.<WORKSPACE NAME>`. Be sure to replace the values between angle brackets:
+
+- `<LSP SERVER BINARY>` : The name of the language server binary, without any
+  path components. For example to use the Deno Javascript language server use
+  the value `deno`.
+- `<LANGUAGE MODE>`: The name of the Emacs major mode for which the language
+  server should be used. For example to enable the language server for
+  Javascript development use the value `web-mode`.
+- `<LANGUAGE SERVER ID>`: This is just the name that `lsp-mode` will use to
+  refer to this language server. If you are ever looking for output buffers or
+  files they may have this name in them.
+
+Calling the `lsp-register-client` function will tell `lsp-mode` the name of the
+LSP server binary. However this binary must be accessible via the path. If the
+language server binary is not in the path you must modify `tramp-remote-path` so
+that `lsp-mode` knows in what directories to look for the LSP server. To do this
+use TRAMP's connection profiles functionality. These connection profiles let you
+customize variables depending on what machine you are connected to. Add the
+following to your `init.el`:
 
 ```lisp
 (connection-local-set-profile-variables 'remote-path-lsp-servers
@@ -110,9 +141,20 @@ Calling the `lsp-register-client` function will tell `lsp-mode` the name of the
 (connection-local-set-profiles '(:machine "coder.<WORKSPACE NAME>") 'remote-path-lsp-servers)
 ```
 
-The `connection-local-set-profile-variables` function creates a new connection profile by the name `remote-path-lsp-servers`. The `connection-local-set-profiles` then indicates this `remote-path-lsp-servers` connection profile should be used when connecting to a server named `coder.<WORKSPACE NAME>`. Be sure to replace `<PATH TO ADD>` with the directory in which a LSP server is present.
-
-TRAMP and `lsp-mode` are fickle friends, sometimes there is weird behavior. If you find that language servers are hanging in the `starting` state then [it might be helpful](https://github.com/emacs-lsp/lsp-mode/issues/2709#issuecomment-800868919) to set the `lsp-log-io` variable to `t`.
-
-More details on configuring `lsp-mode` for TRAMP can be found [in the `lsp-mode` documentation](https://emacs-lsp.github.io/lsp-mode/page/remote/).
-The [TRAMP `tramp-remote-path` documentation](https://www.gnu.org/software/emacs/manual/html_node/tramp/Remote-programs.html#Remote-programs) contains more examples and details of connection profiles.
+The `connection-local-set-profile-variables` function creates a new connection
+profile by the name `remote-path-lsp-servers`. The
+`connection-local-set-profiles` then indicates this `remote-path-lsp-servers`
+connection profile should be used when connecting to a server named
+`coder.<WORKSPACE NAME>`. Be sure to replace `<PATH TO ADD>` with the directory
+in which a LSP server is present.
+
+TRAMP and `lsp-mode` are fickle friends, sometimes there is weird behavior. If
+you find that language servers are hanging in the `starting` state then
+[it might be helpful](https://github.com/emacs-lsp/lsp-mode/issues/2709#issuecomment-800868919)
+to set the `lsp-log-io` variable to `t`.
+
+More details on configuring `lsp-mode` for TRAMP can be found
+[in the `lsp-mode` documentation](https://emacs-lsp.github.io/lsp-mode/page/remote/).
+The
+[TRAMP `tramp-remote-path` documentation](https://www.gnu.org/software/emacs/manual/html_node/tramp/Remote-programs.html#Remote-programs)
+contains more examples and details of connection profiles.
diff --git a/docs/ides/gateway.md b/docs/ides/gateway.md
index cb5b62be53f3f..239b561afc94f 100644
--- a/docs/ides/gateway.md
+++ b/docs/ides/gateway.md
@@ -1,43 +1,73 @@
 # JetBrains Gateway
 
-JetBrains Gateway is a compact desktop app that allows you to work remotely with a JetBrains IDE without even downloading one. [See JetBrains' website to learn about and Gateway.](https://www.jetbrains.com/remote-development/gateway/)
+JetBrains Gateway is a compact desktop app that allows you to work remotely with
+a JetBrains IDE without even downloading one.
+[See JetBrains' website to learn about and Gateway.](https://www.jetbrains.com/remote-development/gateway/)
 
-Gateway can connect to a Coder workspace by using Coder's Gateway plugin or manually setting up an SSH connection.
+Gateway can connect to a Coder workspace by using Coder's Gateway plugin or
+manually setting up an SSH connection.
 
 ## Using Coder's JetBrains Gateway Plugin
 
-> If you experience problems, please [create a GitHub issue](https://github.com/coder/coder/issues) or share in [our Discord channel](https://discord.gg/coder).
+> If you experience problems, please
+> [create a GitHub issue](https://github.com/coder/coder/issues) or share in
+> [our Discord channel](https://discord.gg/coder).
 
 1. [Install Gateway](https://www.jetbrains.com/help/idea/jetbrains-gateway.html)
-1. Open Gateway and click the gear icon at the bottom left and then "Settings"
-1. In the Marketplace tab within Plugins, type Coder and then click "Install" and "OK"
-   ![Gateway Settings and Marketplace](../images/gateway/plugin-settings-marketplace.png)
-1. Click the new "Coder" icon on the Gateway home screen
+1. Open Gateway and click the Coder icon to install the Coder plugin.
+1. Click the "Coder" icon under Install More Providers at the bottom of the
+   Gateway home screen
+1. Click "Connect to Coder" at the top of the Gateway home screen to launch the
+   plugin
+
    ![Gateway Connect to Coder](../images/gateway/plugin-connect-to-coder.png)
-1. Enter your Coder deployment's Access Url and click "Connect" then paste the Session Token and click "OK"
+
+1. Enter your Coder deployment's Access Url and click "Connect" then paste the
+   Session Token and click "OK"
+
    ![Gateway Session Token](../images/gateway/plugin-session-token.png)
-1. Click the "+" icon to open a browser and go to the templates page in your Coder deployment to create a workspace
-1. If a workspace already exists but is stopped, click the green arrow to start the workspace
+
+1. Click the "+" icon to open a browser and go to the templates page in your
+   Coder deployment to create a workspace
+
+1. If a workspace already exists but is stopped, click the green arrow to start
+   the workspace
+
 1. Once the workspace status says Running, click "Select IDE and Project"
+
    ![Gateway IDE List](../images/gateway/plugin-select-ide.png)
-1. Select the JetBrains IDE for your project and the project directory then click "Start IDE and connect"
+
+1. Select the JetBrains IDE for your project and the project directory then
+   click "Start IDE and connect"
    ![Gateway Select IDE](../images/gateway/plugin-ide-list.png)
+
    ![Gateway IDE Opened](../images/gateway/gateway-intellij-opened.png)
 
-> Note the JetBrains IDE is remotely installed into `~/.cache/JetBrains/RemoteDev/dist`
+> Note the JetBrains IDE is remotely installed into
+> `~/.cache/JetBrains/RemoteDev/dist`
+
+### Update a Coder plugin version
+
+1. Click the gear icon at the bottom left of the Gateway home screen and then
+   "Settings"
+
+1. In the Marketplace tab within Plugins, type Coder and if a newer plugin
+   release is available, click "Update" and "OK"
+
+   ![Gateway Settings and Marketplace](../images/gateway/plugin-settings-marketplace.png)
 
 ### Configuring the Gateway plugin to use internal certificates
 
-When attempting to connect to a Coder deployment that uses internally signed certificates,
-you may receive the following error in Gateway:
+When attempting to connect to a Coder deployment that uses internally signed
+certificates, you may receive the following error in Gateway:
 
 ```console
 Failed to configure connection to https://coder.internal.enterprise/: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
 ```
 
-To resolve this issue, you will need to add Coder's certificate to the Java trust store
-present on your local machine. Here is the default location of the trust store for
-each OS:
+To resolve this issue, you will need to add Coder's certificate to the Java
+trust store present on your local machine. Here is the default location of the
+trust store for each OS:
 
 ```console
 # Linux
@@ -52,8 +82,8 @@ C:\Program Files (x86)\<Gateway installation directory>\jre\lib\security\cacerts
 %USERPROFILE%\AppData\Local\JetBrains\Toolbox\bin\jre\lib\security\cacerts # Path for Toolbox installation
 ```
 
-To add the certificate to the keystore, you can use the `keytool` utility that ships
-with Java:
+To add the certificate to the keystore, you can use the `keytool` utility that
+ships with Java:
 
 ```console
 keytool -import -alias coder -file <certificate> -keystore /path/to/trust/store
@@ -71,42 +101,67 @@ Windows example:
 
 macOS example:
 
-```sh
+```shell
 keytool -import -alias coder -file cacert.pem -keystore /Applications/JetBrains\ Gateway.app/Contents/jbr/Contents/Home/lib/security/cacerts
 ```
 
 ## Manually Configuring A JetBrains Gateway Connection
 
-> This is in lieu of using Coder's Gateway plugin which automatically performs these steps.
+> This is in lieu of using Coder's Gateway plugin which automatically performs
+> these steps.
 
 1. [Install Gateway](https://www.jetbrains.com/help/idea/jetbrains-gateway.html)
+
 1. [Configure the `coder` CLI](../ides.md#ssh-configuration)
+
 1. Open Gateway, make sure "SSH" is selected under "Remote Development"
+
 1. Click "New Connection"
+
    ![Gateway Home](../images/gateway/gateway-home.png)
+
 1. In the resulting dialog, click the gear icon to the right of "Connection:"
+
    ![Gateway New Connection](../images/gateway/gateway-new-connection.png)
+
 1. Hit the "+" button to add a new SSH connection
+
    ![Gateway Add Connection](../images/gateway/gateway-add-ssh-configuration.png)
 
 1. For the Host, enter `coder.<workspace name>`
+
 1. For the Port, enter `22` (this is ignored by Coder)
+
 1. For the Username, enter your workspace username
-1. For the Authentication Type, select "OpenSSH config and authentication
-   agent"
+
+1. For the Authentication Type, select "OpenSSH config and authentication agent"
+
 1. Make sure the checkbox for "Parse config file ~/.ssh/config" is checked.
+
 1. Click "Test Connection" to validate these settings.
+
 1. Click "OK"
+
    ![Gateway SSH Configuration](../images/gateway/gateway-create-ssh-configuration.png)
+
 1. Select the connection you just added
+
    ![Gateway Welcome](../images/gateway/gateway-welcome.png)
+
 1. Click "Check Connection and Continue"
+
    ![Gateway Continue](../images/gateway/gateway-continue.png)
-1. Select the JetBrains IDE for your project and the project directory.
-   SSH into your server to create a directory or check out code if you haven't already.
+
+1. Select the JetBrains IDE for your project and the project directory. SSH into
+   your server to create a directory or check out code if you haven't already.
+
    ![Gateway Choose IDE](../images/gateway/gateway-choose-ide.png)
-   > Note the JetBrains IDE is remotely installed into `~/. cache/JetBrains/RemoteDev/dist`
+
+   > Note the JetBrains IDE is remotely installed into
+   > `~/. cache/JetBrains/RemoteDev/dist`
+
 1. Click "Download and Start IDE" to connect.
+
    ![Gateway IDE Opened](../images/gateway/gateway-intellij-opened.png)
 
 ## Using an existing JetBrains installation in the workspace
@@ -116,12 +171,170 @@ are air-gapped, and cannot reach jetbrains.com), run the following script in the
 JetBrains IDE directory to point the default Gateway directory to the IDE
 directory. This step must be done before configuring Gateway.
 
-```sh
+```shell
 cd /opt/idea/bin
 ./remote-dev-server.sh registerBackendLocationForGateway
 ```
 
-> Gateway only works with paid versions of JetBrains IDEs so the script will not be located in the `bin` directory of JetBrains Community editions.
+> Gateway only works with paid versions of JetBrains IDEs so the script will not
+> be located in the `bin` directory of JetBrains Community editions.
 
 [Here is the JetBrains article](https://www.jetbrains.com/help/idea/remote-development-troubleshooting.html#setup:~:text=Can%20I%20point%20Remote%20Development%20to%20an%20existing%20IDE%20on%20my%20remote%20server%3F%20Is%20it%20possible%20to%20install%20IDE%20manually%3F)
 explaining this IDE specification.
+
+## JetBrains Gateway in an offline environment
+
+In networks that restrict access to the internet, you will need to leverage the
+JetBrains Client Installer to download and save the IDE clients locally. Please
+see the
+[JetBrains documentation for more information](https://www.jetbrains.com/help/idea/fully-offline-mode.html).
+
+### Configuration Steps
+
+The Coder team built a POC of the JetBrains Gateway Offline Mode solution. Here
+are the steps we took (and "gotchas"):
+
+### 1. Deploy the server and install the Client Downloader
+
+We deployed a simple Ubuntu VM and installed the JetBrains Client Downloader
+binary. Note that the server must be a Linux-based distribution.
+
+```shell
+wget https://download.jetbrains.com/idea/code-with-me/backend/jetbrains-clients-downloader-linux-x86_64-1867.tar.gz && \
+tar -xzvf jetbrains-clients-downloader-linux-x86_64-1867.tar.gz
+```
+
+### 2. Install backends and clients
+
+JetBrains Gateway requires both a backend to be installed on the remote host
+(your Coder workspace) and a client to be installed on your local machine. You
+can host both on the server in this example.
+
+See here for the full
+[JetBrains product list and builds](https://data.services.jetbrains.com/products).
+Below is the full list of supported `--platforms-filter` values:
+
+```console
+windows-x64, windows-aarch64, linux-x64, linux-aarch64, osx-x64, osx-aarch64
+```
+
+To install both backends and clients, you will need to run two commands.
+
+**Backends**
+
+```shell
+mkdir ~/backends
+./jetbrains-clients-downloader-linux-x86_64-1867/bin/jetbrains-clients-downloader --products-filter <product-code> --build-filter <build-number> --platforms-filter linux-x64,windows-x64,osx-x64 --download-backends ~/backends
+```
+
+**Clients**
+
+This is the same command as above, with the `--download-backends` flag removed.
+
+```shell
+mkdir ~/clients
+./jetbrains-clients-downloader-linux-x86_64-1867/bin/jetbrains-clients-downloader --products-filter <product-code> --build-filter <build-number> --platforms-filter linux-x64,windows-x64,osx-x64 ~/clients
+```
+
+We now have both clients and backends installed.
+
+### 3. Install a web server
+
+You will need to run a web server in order to serve requests to the backend and
+client files. We installed `nginx` and setup an FQDN and routed all requests to
+`/`. See below:
+
+```console
+server {
+        listen 80 default_server;
+        listen [::]:80 default_server;
+
+        root /var/www/html;
+
+        index index.html index.htm index.nginx-debian.html;
+
+        server_name _;
+
+        location / {
+                root /home/ubuntu;
+        }
+}
+```
+
+Then, configure your DNS entry to point to the IP address of the server. For the
+purposes of the POC, we did not configure TLS, although that is a supported
+option.
+
+### 4. Add Client Files
+
+You will need to add the following files on your local machine in order for
+Gateway to pull the backend and client from the server.
+
+```shell
+$ cat productsInfoUrl # a path to products.json that was generated by the backend's downloader (it could be http://, https://, or file://)
+
+https://internal.site/backends/<PRODUCT_CODE>/products.json
+
+$ cat clientDownloadUrl # a path for clients that you got from the clients' downloader (it could be http://, https://, or file://)
+
+https://internal.site/clients/
+
+$ cat jreDownloadUrl # a path for JBR that you got from the clients' downloader (it could be http://, https://, or file://)
+
+https://internal.site/jre/
+
+$ cat pgpPublicKeyUrl # a URL to the KEYS file that was downloaded with the clients builds.
+
+https://internal.site/KEYS
+```
+
+The location of these files will depend upon your local operating system:
+
+**macOS**
+
+```console
+# User-specific settings
+/Users/UserName/Library/Application Support/JetBrains/RemoteDev
+# System-wide settings
+/Library/Application Support/JetBrains/RemoteDev/
+```
+
+**Linux**
+
+```console
+# User-specific settings
+$HOME/.config/JetBrains/RemoteDev
+# System-wide settings
+/etc/xdg/JetBrains/RemoteDev/
+```
+
+**Windows**
+
+```console
+# User-specific settings
+HKEY_CURRENT_USER registry
+# System-wide settings
+HKEY_LOCAL_MACHINE registry
+```
+
+Additionally, create a string for each setting with its appropriate value in
+`SOFTWARE\JetBrains\RemoteDev`:
+
+![Alt text](../images/gateway/jetbrains-offline-windows.png)
+
+### 5. Setup SSH connection with JetBrains Gateway
+
+With the server now configured, you can now configure your local machine to use
+Gateway. Here is the documentation to
+[setup SSH config via the Coder CLI](../ides.md#ssh-configuration). On the
+Gateway side, follow our guide here until step 16.
+
+Instead of downloading from jetbrains.com, we will point Gateway to our server
+endpoint. Select `Installation options...` and select `Use download link`. Note
+that the URL must explicitly reference the archive file:
+
+![Offline Gateway](../images/gateway/offline-gateway.png)
+
+Click `Download IDE and Connect`. Gateway should now download the backend and
+clients from the server into your remote workspace and local machine,
+respectively.
diff --git a/docs/ides/remote-desktops.md b/docs/ides/remote-desktops.md
index f7496a1d5620c..51ffe4e264cd6 100644
--- a/docs/ides/remote-desktops.md
+++ b/docs/ides/remote-desktops.md
@@ -1,6 +1,7 @@
 # Remote Desktops
 
-> Built-in remote desktop is on the roadmap ([#2106](https://github.com/coder/coder/issues/2106)).
+> Built-in remote desktop is on the roadmap
+> ([#2106](https://github.com/coder/coder/issues/2106)).
 
 ## VNC Desktop
 
@@ -13,10 +14,13 @@ Workspace requirements:
 - VNC server (e.g. [tigervnc](https://tigervnc.org/))
 - VNC client (e.g. [novnc](https://novnc.com/info.html))
 
-Installation instructions vary depending on your workspace's operating
-system, platform, and build system.
+Installation instructions vary depending on your workspace's operating system,
+platform, and build system.
 
-As a starting point, see the [desktop-container](https://github.com/bpmct/coder-templates/tree/main/desktop-container) community template. It builds and provisions a Dockerized workspace with the following software:
+As a starting point, see the
+[desktop-container](https://github.com/bpmct/coder-templates/tree/main/desktop-container)
+community template. It builds and provisions a Dockerized workspace with the
+following software:
 
 - Ubuntu 20.04
 - TigerVNC server
@@ -25,9 +29,13 @@ As a starting point, see the [desktop-container](https://github.com/bpmct/coder-
 
 ## RDP Desktop
 
-To use RDP with Coder, you'll need to install an [RDP client](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients) on your local machine, and enable RDP on your workspace.
+To use RDP with Coder, you'll need to install an
+[RDP client](https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-clients)
+on your local machine, and enable RDP on your workspace.
 
-As a starting point, see the [gcp-windows-rdp](https://github.com/matifali/coder-templates/tree/main/gcp-windows-rdp) community template. It builds and provisions a Windows Server workspace on GCP.
+As a starting point, see the
+[gcp-windows-rdp](https://github.com/matifali/coder-templates/tree/main/gcp-windows-rdp)
+community template. It builds and provisions a Windows Server workspace on GCP.
 
 Use the following command to forward the RDP port to your local machine:
 
diff --git a/docs/ides/web-ides.md b/docs/ides/web-ides.md
index 1b5df48e1e589..aa466e54c432e 100644
--- a/docs/ides/web-ides.md
+++ b/docs/ides/web-ides.md
@@ -5,14 +5,16 @@ By default, Coder workspaces allow connections via:
 - Web terminal
 - SSH (plus any [SSH-compatible IDE](../ides.md))
 
-It's common to also let developers to connect via web IDEs.
+It's common to also let developers to connect via web IDEs for uses cases like
+zero trust networks, data science, contractors, and infrequent code
+contributors.
 
 ![Row of IDEs](../images/ide-row.png)
 
 In Coder, web IDEs are defined as
 [coder_app](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/app)
-resources in the template. With our generic model, any web application can
-be used as a Coder application. For example:
+resources in the template. With our generic model, any web application can be
+used as a Coder application. For example:
 
 ```hcl
 # Add button to open Portainer in the workspace dashboard
@@ -32,11 +34,38 @@ resource "coder_app" "portainer" {
 }
 ```
 
-## code-server
+## External URLs
 
-![code-server in a workspace](../images/code-server-ide.png)
+Any URL external to the Coder deployment is accessible as a `coder_app`. e.g.,
+Dropbox, Slack, Discord, GitHub
+
+```hcl
+resource "coder_app" "pubslack" {
+  agent_id     = coder_agent.coder.id
+  display_name = "Coder Public Slack"
+  slug         = "pubslack"
+  url          = "https://coder-com.slack.com/"
+  icon         = "/icon/slack.svg"
+  external     = true
+}
+
+resource "coder_app" "discord" {
+  agent_id     = coder_agent.coder.id
+  display_name = "Coder Discord"
+  slug         = "discord"
+  url          = "https://discord.com/invite/coder"
+  icon         = "/icon/discord.svg"
+  external     = true
+}
+```
+
+![External URLs](../images/external-apps.png)
 
-[code-server](https://github.com/coder/coder) is our supported method of running VS Code in the web browser. A simple way to install code-server in Linux/macOS workspaces is via the Coder agent in your template:
+## code-server
+
+[code-server](https://github.com/coder/coder) is our supported method of running
+VS Code in the web browser. A simple way to install code-server in Linux/macOS
+workspaces is via the Coder agent in your template:
 
 ```console
 # edit your template
@@ -62,7 +91,9 @@ resource "coder_agent" "main" {
 }
 ```
 
-For advanced use, we recommend installing code-server in your VM snapshot or container image. Here's a Dockerfile which leverages some special [code-server features](https://coder.com/docs/code-server/):
+For advanced use, we recommend installing code-server in your VM snapshot or
+container image. Here's a Dockerfile which leverages some special
+[code-server features](https://coder.com/docs/code-server/):
 
 ```Dockerfile
 FROM codercom/enterprise-base:ubuntu
@@ -79,7 +110,8 @@ RUN code-server --install-extension eamodio.gitlens
 # or use a process manager like supervisord
 ```
 
-You'll also need to specify a `coder_app` resource related to the agent. This is how code-server is displayed on the workspace page.
+You'll also need to specify a `coder_app` resource related to the agent. This is
+how code-server is displayed on the workspace page.
 
 ```hcl
 resource "coder_app" "code-server" {
@@ -88,7 +120,7 @@ resource "coder_app" "code-server" {
   display_name = "code-server"
   url          = "http://localhost:13337/?folder=/home/coder"
   icon         = "/icon/code.svg"
-  subdomain    = true
+  subdomain    = false
 
   healthcheck {
     url       = "http://localhost:13337/healthz"
@@ -99,6 +131,62 @@ resource "coder_app" "code-server" {
 }
 ```
 
+![code-server in a workspace](../images/code-server-ide.png)
+
+## VS Code Web
+
+VS Code supports launching a local web client using the `code serve-web`
+command. To add VS Code web as a web IDE, you have two options.
+
+1. Install using the
+   [vscode-web module](https://registry.coder.com/modules/vscode-web) from the
+   coder registry.
+
+   ```hcl
+   module "vscode-web" {
+     source         = "https://registry.coder.com/modules/vscode-web"
+     agent_id       = coder_agent.main.id
+     accept_license = true
+   }
+   ```
+
+2. Install and start in your `startup_script` and create a corresponding
+   `coder_app`
+
+   ```hcl
+   resource "coder_agent" "main" {
+       arch           = "amd64"
+       os             = "linux"
+       startup_script = <<EOF
+       #!/bin/sh
+       # install VS Code
+       curl -Lk 'https://code.visualstudio.com/sha/download?build=stable&os=cli-alpine-x64' --output vscode_cli.tar.gz
+       mkdir -p /tmp/vscode-cli
+       tar -xf vscode_cli.tar.gz -C /tmp/vscode-cli
+       rm vscode_cli.tar.gz
+       # start the web server on a specific port
+       /tmp/vscode-cli/code serve-web --port 13338 --without-connection-token  --accept-server-license-terms >/tmp/vscode-web.log 2>&1 &
+       EOF
+   }
+   ```
+
+   > `code serve-web` was introduced in version 1.82.0 (August 2023).
+
+   You also need to add a `coder_app` resource for this.
+
+   ```hcl
+   # VS Code Web
+   resource "coder_app" "vscode-web" {
+     agent_id     = coder_agent.coder.id
+     slug         = "vscode-web"
+     display_name = "VS Code Web"
+     icon         = "/icon/code.svg"
+     url          = "http://localhost:13338?folder=/home/coder"
+     subdomain    = true  # VS Code Web does currently does not work with a subpath https://github.com/microsoft/vscode/issues/192947
+     share        = "owner"
+   }
+   ```
+
 ## JupyterLab
 
 Configure your agent and `coder_app` like so to use Jupyter. Notice the
@@ -134,7 +222,7 @@ resource "coder_app" "jupyter" {
 }
 ```
 
-![JupyterLab in Coder](../images/jupyter-on-docker.png)
+![JupyterLab in Coder](../images/jupyter.png)
 
 ## RStudio
 
@@ -210,6 +298,43 @@ resource "coder_app" "airflow" {
 
 ![Airflow in Coder](../images/airflow-port-forward.png)
 
+## File Browser
+
+Show and manipulate the contents of the `/home/coder` directory in a browser.
+
+```hcl
+resource "coder_agent" "coder" {
+  os   = "linux"
+  arch = "amd64"
+  dir  = "/home/coder"
+  startup_script = <<EOT
+#!/bin/bash
+
+curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash
+filebrowser --noauth --root /home/coder --port 13339 >/tmp/filebrowser.log 2>&1 &
+
+EOT
+}
+
+resource "coder_app" "filebrowser" {
+  agent_id     = coder_agent.coder.id
+  display_name = "file browser"
+  slug         = "filebrowser"
+  url          = "http://localhost:13339"
+  icon         = "https://raw.githubusercontent.com/matifali/logos/main/database.svg"
+  subdomain    = true
+  share        = "owner"
+
+  healthcheck {
+    url       = "http://localhost:13339/healthz"
+    interval  = 3
+    threshold = 10
+  }
+}
+```
+
+![File Browser](../images/file-browser.png)
+
 ## SSH Fallback
 
 If you prefer to run web IDEs in localhost, you can port forward using
diff --git a/docs/images/add-license-ui.png b/docs/images/add-license-ui.png
new file mode 100644
index 0000000000000..03ff419d15a59
Binary files /dev/null and b/docs/images/add-license-ui.png differ
diff --git a/docs/images/autostart.png b/docs/images/autostart.png
index f96eba3bee971..a0855e7ae8ec4 100644
Binary files a/docs/images/autostart.png and b/docs/images/autostart.png differ
diff --git a/docs/images/autostop.png b/docs/images/autostop.png
index e86249e45d1cb..2b93efd757a4f 100644
Binary files a/docs/images/autostop.png and b/docs/images/autostop.png differ
diff --git a/docs/images/code-server-ide.png b/docs/images/code-server-ide.png
index a35720acdd2b8..380dd1e2ddca9 100644
Binary files a/docs/images/code-server-ide.png and b/docs/images/code-server-ide.png differ
diff --git a/docs/images/creating-workspace-ui.png b/docs/images/creating-workspace-ui.png
new file mode 100644
index 0000000000000..27bb47cbe7d15
Binary files /dev/null and b/docs/images/creating-workspace-ui.png differ
diff --git a/docs/images/deploy-pr-manually.png b/docs/images/deploy-pr-manually.png
new file mode 100644
index 0000000000000..718d00c65d1cc
Binary files /dev/null and b/docs/images/deploy-pr-manually.png differ
diff --git a/docs/images/display-apps.png b/docs/images/display-apps.png
new file mode 100644
index 0000000000000..59daab141c2e7
Binary files /dev/null and b/docs/images/display-apps.png differ
diff --git a/docs/images/external-apps.png b/docs/images/external-apps.png
new file mode 100644
index 0000000000000..c5f49fcd6c605
Binary files /dev/null and b/docs/images/external-apps.png differ
diff --git a/docs/images/file-browser.png b/docs/images/file-browser.png
new file mode 100644
index 0000000000000..ec68ef34e2ed2
Binary files /dev/null and b/docs/images/file-browser.png differ
diff --git a/docs/images/gateway/jetbrains-offline-windows.png b/docs/images/gateway/jetbrains-offline-windows.png
new file mode 100644
index 0000000000000..23e8d42014773
Binary files /dev/null and b/docs/images/gateway/jetbrains-offline-windows.png differ
diff --git a/docs/images/gateway/offline-gateway.png b/docs/images/gateway/offline-gateway.png
new file mode 100644
index 0000000000000..754c6c6ae568c
Binary files /dev/null and b/docs/images/gateway/offline-gateway.png differ
diff --git a/docs/images/gateway/plugin-connect-to-coder.png b/docs/images/gateway/plugin-connect-to-coder.png
index 11cecf4ad69fe..295efa7897386 100644
Binary files a/docs/images/gateway/plugin-connect-to-coder.png and b/docs/images/gateway/plugin-connect-to-coder.png differ
diff --git a/docs/images/gateway/plugin-ide-list.png b/docs/images/gateway/plugin-ide-list.png
index 40b9f2f71bcc8..0f767abfd0dd1 100644
Binary files a/docs/images/gateway/plugin-ide-list.png and b/docs/images/gateway/plugin-ide-list.png differ
diff --git a/docs/images/gateway/plugin-select-ide.png b/docs/images/gateway/plugin-select-ide.png
index b138b7b2a41d5..bc4e6cb1ee03b 100644
Binary files a/docs/images/gateway/plugin-select-ide.png and b/docs/images/gateway/plugin-select-ide.png differ
diff --git a/docs/images/gateway/plugin-session-token.png b/docs/images/gateway/plugin-session-token.png
index c233fd0c27759..b13d2fe12828e 100644
Binary files a/docs/images/gateway/plugin-session-token.png and b/docs/images/gateway/plugin-session-token.png differ
diff --git a/docs/images/gateway/plugin-settings-marketplace.png b/docs/images/gateway/plugin-settings-marketplace.png
index 58ccf8155992e..7973fa99811a3 100644
Binary files a/docs/images/gateway/plugin-settings-marketplace.png and b/docs/images/gateway/plugin-settings-marketplace.png differ
diff --git a/docs/images/icons-gallery.png b/docs/images/icons-gallery.png
new file mode 100644
index 0000000000000..ccde696c2407c
Binary files /dev/null and b/docs/images/icons-gallery.png differ
diff --git a/docs/images/icons/lock.svg b/docs/images/icons/lock.svg
new file mode 100644
index 0000000000000..620af5152163c
--- /dev/null
+++ b/docs/images/icons/lock.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512">
+	<path d="M400 224h-24v-72C376 68.2 307.8 0 224 0S72 68.2 72 152v72H48c-26.5 0-48 21.5-48 48v192c0 26.5 21.5 48 48 48h352c26.5 0 48-21.5 48-48V272c0-26.5-21.5-48-48-48zm-104 0H152v-72c0-39.7 32.3-72 72-72s72 32.3 72 72v72z"/>
+</svg>
diff --git a/docs/images/ide-row.png b/docs/images/ide-row.png
index 32d487a0cd5f5..1346f65ca3c7a 100644
Binary files a/docs/images/ide-row.png and b/docs/images/ide-row.png differ
diff --git a/docs/images/install/homebrew.png b/docs/images/install/homebrew.png
new file mode 100644
index 0000000000000..471cea4192746
Binary files /dev/null and b/docs/images/install/homebrew.png differ
diff --git a/docs/images/jupyter-on-docker.png b/docs/images/jupyter-on-docker.png
deleted file mode 100644
index eafbfb1fb0ad8..0000000000000
Binary files a/docs/images/jupyter-on-docker.png and /dev/null differ
diff --git a/docs/images/jupyter.png b/docs/images/jupyter.png
new file mode 100644
index 0000000000000..fe19a0a271299
Binary files /dev/null and b/docs/images/jupyter.png differ
diff --git a/docs/images/oidc-sequence-diagram.svg b/docs/images/oidc-sequence-diagram.svg
new file mode 100644
index 0000000000000..72600e5193201
--- /dev/null
+++ b/docs/images/oidc-sequence-diagram.svg
@@ -0,0 +1,15136 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg 
+   width="751.91998pt"
+   height="1144.07996pt"
+   viewBox="0 0 751.91998 1144.07996"
+   version="1.1"
+   id="svg6042"
+   xmlns:xlink="http://www.w3.org/1999/xlink"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg" content="%3Cmxfile%20host%3D%22app.diagrams.net%22%20modified%3D%222023-08-14T15%3A14%3A01.030Z%22%20agent%3D%22Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F115.0.0.0%20Safari%2F537.36%22%20etag%3D%22zbD8D36tkRvp7eLDew3n%22%20version%3D%2221.6.6%22%20type%3D%22google%22%3E%20%20%20%3Cdiagram%20name%3D%22Page-1%22%20id%3D%222YBvvXClWsGukQMizWep%22%3E%20%20%20%20%20%3CmxGraphModel%20dx%3D%221482%22%20dy%3D%221316%22%20grid%3D%221%22%20gridSize%3D%2210%22%20guides%3D%221%22%20tooltips%3D%221%22%20connect%3D%221%22%20arrows%3D%221%22%20fold%3D%221%22%20page%3D%221%22%20pageScale%3D%221%22%20pageWidth%3D%22850%22%20pageHeight%3D%221100%22%20math%3D%220%22%20shadow%3D%220%22%3E%20%20%20%20%20%20%20%3Croot%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%220%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%221%22%20parent%3D%220%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-137%22%20value%3D%22%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3BfillColor%3D%23fff2cc%3BstrokeColor%3Dnone%3Bopacity%3D50%3BgradientColor%3Dnone%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20y%3D%22440%22%20width%3D%22770%22%20height%3D%22550%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-119%22%20value%3D%22%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3BfillColor%3D%23551759%3BstrokeColor%3D%236E6E6E%3BgradientColor%3Dnone%3BgradientDirection%3Dradial%3Bopacity%3D30%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22230%22%20y%3D%22990%22%20width%3D%22620%22%20height%3D%22710%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-1%22%20value%3D%22User%26%2339%3Bs%20Browser%22%20style%3D%22shape%3DumlLifeline%3Bperimeter%3DlifelinePerimeter%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3Bcontainer%3D0%3BdropTarget%3D0%3Bcollapsible%3D0%3BrecursiveResize%3D0%3BoutlineConnect%3D0%3BportConstraint%3Deastwest%3BnewEdgeStyle%3D%7B%26quot%3BedgeStyle%26quot%3B%3A%26quot%3BelbowEdgeStyle%26quot%3B%2C%26quot%3Belbow%26quot%3B%3A%26quot%3Bvertical%26quot%3B%2C%26quot%3Bcurved%26quot%3B%3A0%2C%26quot%3Brounded%26quot%3B%3A0%7D%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22100%22%20y%3D%22400%22%20width%3D%22100%22%20height%3D%221520%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-3%22%20value%3D%22User%20clicks%20%26quot%3BOIDC%26quot%3B%20Login%22%20style%3D%22html%3D1%3BverticalAlign%3Dbottom%3BstartArrow%3Doval%3BendArrow%3Dblock%3BstartSize%3D8%3BedgeStyle%3DelbowEdgeStyle%3Belbow%3Dvertical%3Bcurved%3D0%3Brounded%3D0%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-1%22%20target%3D%22eYKO086i2hVpJxTEME1l-1%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22-0.1303%22%20y%3D%222%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22-80%22%20y%3D%2262%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%2235%22%20y%3D%2262%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20as%3D%22offset%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-5%22%20value%3D%22Coder%22%20style%3D%22shape%3DumlLifeline%3Bperimeter%3DlifelinePerimeter%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3Bcontainer%3D0%3BdropTarget%3D0%3Bcollapsible%3D0%3BrecursiveResize%3D0%3BoutlineConnect%3D0%3BportConstraint%3Deastwest%3BnewEdgeStyle%3D%7B%26quot%3BedgeStyle%26quot%3B%3A%26quot%3BelbowEdgeStyle%26quot%3B%2C%26quot%3Belbow%26quot%3B%3A%26quot%3Bvertical%26quot%3B%2C%26quot%3Bcurved%26quot%3B%3A0%2C%26quot%3Brounded%26quot%3B%3A0%7D%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22430%22%20y%3D%22400%22%20width%3D%22100%22%20height%3D%221520%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-7%22%20value%3D%22OIDC%20Provider%22%20style%3D%22shape%3DumlLifeline%3Bperimeter%3DlifelinePerimeter%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3Bcontainer%3D0%3BdropTarget%3D0%3Bcollapsible%3D0%3BrecursiveResize%3D0%3BoutlineConnect%3D0%3BportConstraint%3Deastwest%3BnewEdgeStyle%3D%7B%26quot%3BedgeStyle%26quot%3B%3A%26quot%3BelbowEdgeStyle%26quot%3B%2C%26quot%3Belbow%26quot%3B%3A%26quot%3Bvertical%26quot%3B%2C%26quot%3Bcurved%26quot%3B%3A0%2C%26quot%3Brounded%26quot%3B%3A0%7D%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22686%22%20y%3D%22400%22%20width%3D%22100%22%20height%3D%221520%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-8%22%20value%3D%22%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3B%22%20parent%3D%221%22%20target%3D%22eYKO086i2hVpJxTEME1l-5%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22150.22222222222217%22%20y%3D%22470%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22299.5%22%20y%3D%22470%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-9%22%20value%3D%22GET%26amp%3Bnbsp%3Bhttps%3A%2F%2Fcoder.com%2F...%2Fcallback%22%20style%3D%22edgeLabel%3Bhtml%3D1%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3Bresizable%3D0%3Bpoints%3D%5B%5D%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-8%22%20connectable%3D%220%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22-0.1723%22%20y%3D%221%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%225%22%20y%3D%22-9%22%20as%3D%22offset%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-28%22%20value%3D%22%22%20style%3D%22group%22%20parent%3D%221%22%20connectable%3D%220%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22149.81034482758628%22%20y%3D%22505%22%20width%3D%22320.1896551724137%22%20height%3D%2280%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-10%22%20value%3D%22%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-28%22%20source%3D%22eYKO086i2hVpJxTEME1l-5%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22259.68965517241395%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-11%22%20value%3D%22307%20Redirect%22%20style%3D%22edgeLabel%3Bhtml%3D1%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3Bresizable%3D0%3Bpoints%3D%5B%5D%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-10%22%20connectable%3D%220%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22-0.0584%22%20y%3D%22-1%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20y%3D%22-9%22%20as%3D%22offset%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-12%22%20value%3D%22%26lt%3Bdiv%20style%3D%26quot%3Btext-align%3A%20left%3B%26quot%3B%26gt%3B%26lt%3Bspan%20style%3D%26quot%3Bfont-size%3A%2010px%3B%20background-color%3A%20initial%3B%26quot%3B%26gt%3Bhttps%3A%2F%2Foidc.provider.com%2F...%2Fauthorize%3F%26lt%3B%2Fspan%26gt%3B%26lt%3B%2Fdiv%26gt%3B%26lt%3Bfont%20style%3D%26quot%3Bfont-size%3A%2010px%3B%26quot%3B%26gt%3B%26lt%3Bdiv%20style%3D%26quot%3Btext-align%3A%20left%3B%26quot%3B%26gt%3B%26lt%3Bspan%20style%3D%26quot%3Bbackground-color%3A%20initial%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3Bclient_id%3D%26amp%3Blt%3Boidc_client_id%26amp%3Bgt%3B%26amp%3Bamp%3B%26lt%3B%2Fspan%26gt%3B%26lt%3B%2Fdiv%26gt%3B%26lt%3Bdiv%20style%3D%26quot%3Btext-align%3A%20left%3B%26quot%3B%26gt%3B%26lt%3Bspan%20style%3D%26quot%3Bbackground-color%3A%20initial%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3Bredirect_url%3Dhttps%3A%2F%2Fcoder.com%2F...%2Fcallback%26amp%3Bamp%3B%26lt%3B%2Fspan%26gt%3B%26lt%3B%2Fdiv%26gt%3B%26lt%3Bdiv%20style%3D%26quot%3Btext-align%3A%20left%3B%26quot%3B%26gt%3B%26lt%3Bspan%20style%3D%26quot%3Bbackground-color%3A%20initial%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3Bscope%3D%26lt%3Bfont%20color%3D%26quot%3B%230080f0%26quot%3B%26gt%3B%26lt%3Bb%26gt%3Bopenid%2Cprofile%2Cemail%26lt%3B%2Fb%26gt%3B%26lt%3B%2Ffont%26gt%3B%26amp%3Bamp%3B%26lt%3B%2Fspan%26gt%3B%26lt%3B%2Fdiv%26gt%3B%26lt%3Bdiv%20style%3D%26quot%3Btext-align%3A%20left%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3Bstate%3D%26amp%3Blt%3Brandom_string%26amp%3Bgt%3B%26lt%3B%2Fdiv%26gt%3B%26lt%3B%2Ffont%26gt%3B%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3BfontFamily%3DCourier%20New%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-28%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%2220.189655172413723%22%20y%3D%2210%22%20width%3D%22300%22%20height%3D%2270%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-21%22%20value%3D%22%22%20style%3D%22endArrow%3Dnone%3Bhtml%3D1%3Brounded%3D0%3BexitX%3D0.5%3BexitY%3D0%3BexitDx%3D0%3BexitDy%3D0%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-28%22%20source%3D%22eYKO086i2hVpJxTEME1l-12%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22186.18965517241372%22%20y%3D%2210%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22170.18965517241372%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-30%22%20value%3D%22%22%20style%3D%22group%22%20parent%3D%221%22%20connectable%3D%220%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22190%22%20y%3D%22742%22%20width%3D%22280%22%20height%3D%2250%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-16%22%20value%3D%22%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-30%22%20source%3D%22eYKO086i2hVpJxTEME1l-7%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22421.5%22%20y%3D%22-13%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22-40.07142857142867%22%20y%3D%22-13%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-24%22%20value%3D%22302%20Redirect%22%20style%3D%22edgeLabel%3Bhtml%3D1%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3Bresizable%3D0%3Bpoints%3D%5B%5D%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-16%22%20connectable%3D%220%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%220.1831%22%20y%3D%22-1%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%221%22%20y%3D%22-7%22%20as%3D%22offset%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-26%22%20value%3D%22%26lt%3Bblockquote%20style%3D%26quot%3Bmargin%3A%200%200%200%2040px%3B%20border%3A%20none%3B%20padding%3A%200px%3B%26quot%3B%26gt%3B%26lt%3B%2Fblockquote%26gt%3B%26lt%3Bblockquote%20style%3D%26quot%3Bmargin%3A%200%200%200%2040px%3B%20border%3A%20none%3B%20padding%3A%200px%3B%26quot%3B%26gt%3B%26lt%3B%2Fblockquote%26gt%3B%26lt%3Bspan%20style%3D%26quot%3Bbackground-color%3A%20initial%3B%20font-size%3A%2010px%3B%26quot%3B%26gt%3B%26lt%3Bdiv%20style%3D%26quot%3B%26quot%3B%26gt%3B%26lt%3Bspan%20style%3D%26quot%3Bbackground-color%3A%20initial%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3B%20https%3A%2F%2Fcoder.com%2F...%2Fcallback%3F%26lt%3B%2Fspan%26gt%3B%26lt%3B%2Fdiv%26gt%3B%26lt%3B%2Fspan%26gt%3B%26lt%3Bblockquote%20style%3D%26quot%3Bmargin%3A%200%200%200%2040px%3B%20border%3A%20none%3B%20padding%3A%200px%3B%26quot%3B%26gt%3B%26lt%3B%2Fblockquote%26gt%3B%26lt%3Bspan%20style%3D%26quot%3Bbackground-color%3A%20initial%3B%20font-size%3A%2010px%3B%26quot%3B%26gt%3B%26lt%3Bdiv%20style%3D%26quot%3B%26quot%3B%26gt%3B%26lt%3Bspan%20style%3D%26quot%3Bbackground-color%3A%20initial%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3Bcode%3D%26amp%3Blt%3Boidc_code%26amp%3Bgt%3B%26amp%3Bamp%3B%26lt%3B%2Fspan%26gt%3B%26lt%3B%2Fdiv%26gt%3B%26lt%3B%2Fspan%26gt%3B%26lt%3Bfont%20style%3D%26quot%3Bfont-size%3A%2010px%3B%26quot%3B%26gt%3B%26lt%3Bdiv%20style%3D%26quot%3B%26quot%3B%26gt%3B%26lt%3Bspan%20style%3D%26quot%3Bbackground-color%3A%20initial%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3Bstate%3D%26amp%3Blt%3Bstate_string%26amp%3Bgt%3B%26lt%3B%2Fspan%26gt%3B%26lt%3B%2Fdiv%26gt%3B%26lt%3B%2Ffont%26gt%3B%26lt%3Bblockquote%20style%3D%26quot%3Bmargin%3A%200%200%200%2040px%3B%20border%3A%20none%3B%20padding%3A%200px%3B%26quot%3B%26gt%3B%26lt%3B%2Fblockquote%26gt%3B%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3Balign%3Dleft%3BfontFamily%3DCourier%20New%3BlabelPosition%3Dcenter%3BverticalLabelPosition%3Dmiddle%3BverticalAlign%3Dmiddle%3BnoLabel%3D0%3BlabelPadding%3D0%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-30%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%22280%22%20height%3D%2250%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-31%22%20value%3D%22%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3B%22%20parent%3D%221%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22149.92857142857133%22%20y%3D%22819%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22479.5%22%20y%3D%22819%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-32%22%20value%3D%22GET%20https%3A%2F%2Fcoder.com%2F...%2Fcallback%3Fcode%3D...%26amp%3Bamp%3Bstate%3D...%26amp%3Bnbsp%3B%22%20style%3D%22edgeLabel%3Bhtml%3D1%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3Bresizable%3D0%3Bpoints%3D%5B%5D%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-31%22%20connectable%3D%220%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22-0.3381%22%20y%3D%22-1%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%2251%22%20y%3D%22-9%22%20as%3D%22offset%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-34%22%20value%3D%22%22%20style%3D%22endArrow%3Dnone%3Bhtml%3D1%3Brounded%3D0%3BexitX%3D0.5%3BexitY%3D0%3BexitDx%3D0%3BexitDy%3D0%3BendSize%3D6%3B%22%20parent%3D%221%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22332%22%20y%3D%22742%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22332%22%20y%3D%22729%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-35%22%20value%3D%22POST%20https%3A%2F%2Foidc.provider.com%2Foauth%2Ftoken%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3B%22%20parent%3D%221%22%20target%3D%22eYKO086i2hVpJxTEME1l-7%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%220.0356%22%20y%3D%228%22%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22479.92857142857133%22%20y%3D%22848%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22611.5%22%20y%3D%22848%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20as%3D%22offset%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-13%22%20value%3D%22%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3B%22%20parent%3D%221%22%20target%3D%22eYKO086i2hVpJxTEME1l-7%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22149.81034482758628%22%20y%3D%22620%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22610%22%20y%3D%22620%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-14%22%20value%3D%22GET%20https%3A%2F%2Foidc.provider.com%2F...%2Fauthorize%3F...%22%20style%3D%22edgeLabel%3Bhtml%3D1%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3Bresizable%3D0%3Bpoints%3D%5B%5D%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-13%22%20connectable%3D%220%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22-0.5046%22%20y%3D%22-3%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%2236%22%20y%3D%22-10%22%20as%3D%22offset%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-15%22%20value%3D%22OIDC%20provider%20might%20show%20a%20login%20page%20that%20requires%20the%20user%20to%20click%20an%20%26quot%3Bauthorize%26quot%3B%20button.%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22170%22%20y%3D%22633%22%20width%3D%22430%22%20height%3D%2270%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-23%22%20value%3D%22%22%20style%3D%22endArrow%3Dnone%3Bhtml%3D1%3Brounded%3D0%3BexitX%3D0.5%3BexitY%3D0%3BexitDx%3D0%3BexitDy%3D0%3BendSize%3D6%3B%22%20parent%3D%221%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22323%22%20y%3D%22633%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22323%22%20y%3D%22620%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-37%22%20value%3D%22JSON%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3B%22%20parent%3D%221%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22-0.0179%22%20y%3D%22-11%22%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22735.5%22%20y%3D%22881%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22479.92857142857133%22%20y%3D%22881%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20as%3D%22offset%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-41%22%20value%3D%22%26lt%3Bfont%20style%3D%26quot%3Bfont-size%3A%2010px%3B%26quot%3B%20face%3D%26quot%3BCourier%20New%26quot%3B%26gt%3B%7B%26lt%3Bbr%26gt%3B%26amp%3Bnbsp%3B%20%26quot%3Bid_token%26quot%3B%3A%20%26amp%3Blt%3Btoken%26amp%3Bgt%3B%2C%26lt%3Bbr%26gt%3B%26amp%3Bnbsp%3B%20%26quot%3Baccess_token%26quot%3B%3A%20%26amp%3Blt%3Btoken%26amp%3Bgt%3B%2C%26lt%3Bbr%26gt%3B%26amp%3Bnbsp%3B%20%26quot%3Bemail%26quot%3B%3A%20%26quot%3Balice%40coder.com%26quot%3B%2C%26lt%3Bbr%26gt%3B%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B....%20rest%20of%20claims%20...%26lt%3Bbr%26gt%3B%7D%26lt%3B%2Ffont%26gt%3B%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3Balign%3Dleft%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22490%22%20y%3D%22893%22%20width%3D%22240%22%20height%3D%2297%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-43%22%20value%3D%22%22%20style%3D%22endArrow%3Dnone%3Bhtml%3D1%3Brounded%3D0%3BexitX%3D0.5%3BexitY%3D0%3BexitDx%3D0%3BexitDy%3D0%3BendSize%3D6%3B%22%20parent%3D%221%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22613%22%20y%3D%22893%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22613%22%20y%3D%22880%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-45%22%20value%3D%22%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22475%22%20y%3D%221065%22%20width%3D%2210%22%20height%3D%22675%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-47%22%20value%3D%22Verify%20token%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3BlabelBackgroundColor%3Dnone%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22350%22%20y%3D%221085%22%20width%3D%22100%22%20height%3D%2240%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-49%22%20value%3D%22%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3B%22%20parent%3D%221%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22479.5000000000002%22%20y%3D%221095%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22450%22%20y%3D%221095%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-50%22%20value%3D%22%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3BexitX%3D1.03%3BexitY%3D0.607%3BexitDx%3D0%3BexitDy%3D0%3BexitPerimeter%3D0%3B%22%20parent%3D%221%22%20source%3D%22eYKO086i2hVpJxTEME1l-47%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22490%22%20y%3D%221105%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22479.5000000000002%22%20y%3D%221109.2800000000002%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-60%22%20value%3D%22%22%20style%3D%22html%3D1%3BverticalLabelPosition%3Dbottom%3BlabelBackgroundColor%3D%23ffffff%3BverticalAlign%3Dtop%3Bshadow%3D0%3Bdashed%3D0%3BstrokeWidth%3D2%3Bshape%3Dmxgraph.ios7.misc.info%3BstrokeColor%3D%230080f0%3Bsketch%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22710%22%20y%3D%22900%22%20width%3D%2212%22%20height%3D%2212%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-62%22%20value%3D%22%22%20style%3D%22endArrow%3Dnone%3Bdashed%3D1%3Bhtml%3D1%3BdashPattern%3D1%203%3BstrokeWidth%3D3%3Brounded%3D0%3BexitX%3D1%3BexitY%3D0.5%3BexitDx%3D0%3BexitDy%3D0%3BexitPerimeter%3D0%3BfillColor%3D%23dae8fc%3BstrokeColor%3D%236c8ebf%3B%22%20parent%3D%221%22%20source%3D%22eYKO086i2hVpJxTEME1l-61%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22750%22%20y%3D%221115%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22830%22%20y%3D%221282%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-63%22%20value%3D%22%22%20style%3D%22endArrow%3Dnone%3Bdashed%3D1%3Bhtml%3D1%3BdashPattern%3D1%203%3BstrokeWidth%3D3%3Brounded%3D0%3BexitX%3D1%3BexitY%3D0.5%3BexitDx%3D0%3BexitDy%3D0%3BexitPerimeter%3D0%3BfillColor%3D%23dae8fc%3BstrokeColor%3D%236c8ebf%3B%22%20parent%3D%221%22%20source%3D%22eYKO086i2hVpJxTEME1l-60%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22722%22%20y%3D%22900%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22830%22%20y%3D%22906%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-64%22%20value%3D%22%22%20style%3D%22endArrow%3Dnone%3Bdashed%3D1%3Bhtml%3D1%3BdashPattern%3D1%203%3BstrokeWidth%3D3%3Brounded%3D0%3BfillColor%3D%23dae8fc%3BstrokeColor%3D%236c8ebf%3BentryX%3D0%3BentryY%3D1%3BentryDx%3D0%3BentryDy%3D0%3B%22%20parent%3D%221%22%20target%3D%22eYKO086i2hVpJxTEME1l-66%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22830%22%20y%3D%221280%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22830%22%20y%3D%22910%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-66%22%20value%3D%22Claims%20are%20merged%20together.%20%60%26lt%3Bfont%20color%3D%26quot%3B%23ff031c%26quot%3B%20face%3D%26quot%3BCourier%20New%26quot%3B%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%26gt%3Bgroups%26lt%3B%2Ffont%26gt%3B%60%20and%20%60%26lt%3Bfont%20color%3D%26quot%3B%23ff031c%26quot%3B%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%20face%3D%26quot%3BCourier%20New%26quot%3B%26gt%3Broles%26lt%3B%2Ffont%26gt%3B%60%20claims%20can%20be%20returned%20in%20the%20%60%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%20color%3D%26quot%3B%23ff031c%26quot%3B%26gt%3Bid_token%26lt%3B%2Ffont%26gt%3B%60%20AND%2FOR%20the%20%60%26lt%3Bfont%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%20face%3D%26quot%3BCourier%20New%26quot%3B%20color%3D%26quot%3B%23ff031c%26quot%3B%26gt%3Buser_info%26lt%3B%2Ffont%26gt%3B%60%20endpoint.%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3Bdashed%3D1%3BdashPattern%3D1%204%3BfillColor%3Dnone%3BstrokeColor%3D%236C8EBF%3BstrokeWidth%3D3%3Balign%3Dcenter%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22830%22%20y%3D%22940%22%20width%3D%22170%22%20height%3D%22100%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-72%22%20value%3D%22%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22470%22%20y%3D%221396%22%20width%3D%2220%22%20height%3D%22154%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-73%22%20value%3D%22%22%20style%3D%22sketch%3D0%3BoutlineConnect%3D0%3BfillColor%3D%230080F0%3BstrokeColor%3D%236c8ebf%3Bdashed%3D0%3BverticalLabelPosition%3Dbottom%3BverticalAlign%3Dtop%3Balign%3Dcenter%3Bhtml%3D1%3BfontSize%3D12%3BfontStyle%3D0%3Baspect%3Dfixed%3BpointerEvents%3D1%3Bshape%3Dmxgraph.aws4.gear%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22471%22%20y%3D%221463.5%22%20width%3D%2219%22%20height%3D%2219%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-74%22%20value%3D%22%26lt%3Bb%26gt%3B%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%26gt%3B%26lt%3Bfont%20color%3D%26quot%3B%230080f0%26quot%3B%26gt%3B%24CODER_OIDC_GROUP_REGEX_FILTER%26lt%3Bbr%26gt%3B%24CODER_OIDC_GROUP_AUTO_CREATE%26lt%3Bbr%26gt%3B%26lt%3B%2Ffont%26gt%3B%26lt%3B%2Ffont%26gt%3B%26lt%3Bfont%20style%3D%26quot%3Bborder-color%3A%20var(--border-color)%3B%20font-family%3A%20%26amp%3Bquot%3BCourier%20New%26amp%3Bquot%3B%3B%26quot%3B%20color%3D%26quot%3B%230080f0%26quot%3B%26gt%3B%24CODER_OIDC_GROUP_FIELD%26lt%3B%2Ffont%26gt%3B%26lt%3Bbr%20style%3D%26quot%3Bborder-color%3A%20var(--border-color)%3B%20font-family%3A%20%26amp%3Bquot%3BCourier%20New%26amp%3Bquot%3B%3B%26quot%3B%26gt%3B%26lt%3Bfont%20style%3D%26quot%3Bborder-color%3A%20var(--border-color)%3B%20font-family%3A%20%26amp%3Bquot%3BCourier%20New%26amp%3Bquot%3B%3B%26quot%3B%20color%3D%26quot%3B%230080f0%26quot%3B%26gt%3B%24CODER_OIDC_SCOPES%26lt%3B%2Ffont%26gt%3B%26lt%3B%2Fb%26gt%3B%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%26gt%3B%26lt%3Bb%26gt%3B%26lt%3Bbr%26gt%3B%26lt%3Bfont%20color%3D%26quot%3B%23ff031c%26quot%3B%20style%3D%26quot%3Bfont-size%3A%209px%3B%26quot%3B%26gt%3BConfigurable%20step%26lt%3B%2Ffont%26gt%3B%26lt%3B%2Fb%26gt%3B%26lt%3Bbr%26gt%3B%26lt%3B%2Ffont%26gt%3B%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22222%22%20y%3D%221425%22%20width%3D%22249%22%20height%3D%2296%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-77%22%20value%3D%22%26lt%3Bh1%20style%3D%26quot%3Bborder-color%3A%20var(--border-color)%3B%20text-align%3A%20left%3B%20line-height%3A%2024px%3B%26quot%3B%26gt%3B%26lt%3Bb%20style%3D%26quot%3Bborder-color%3A%20var(--border-color)%3B%20font-size%3A%2012px%3B%20text-align%3A%20center%3B%26quot%3B%26gt%3B%26lt%3Bfont%20style%3D%26quot%3Bborder-color%3A%20var(--border-color)%3B%20font-size%3A%2018px%3B%26quot%3B%26gt%3BCoder%20authentication%26lt%3B%2Ffont%26gt%3B%26lt%3B%2Fb%26gt%3B%26lt%3B%2Fh1%26gt%3B%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22260%22%20y%3D%221015%22%20width%3D%22210%22%20height%3D%2230%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-79%22%20value%3D%22How%20Coder%20handles%20an%20authenticated%20OIDC%20user.%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dleft%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3BlabelBackgroundColor%3Dnone%3BlabelBorderColor%3Dnone%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22280%22%20y%3D%221045%22%20width%3D%22180%22%20height%3D%2230%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-80%22%20value%3D%22%22%20style%3D%22group%22%20parent%3D%221%22%20connectable%3D%220%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22260%22%20y%3D%221228%22%20width%3D%22475.5%22%20height%3D%22130%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-51%22%20value%3D%22%26lt%3Bdiv%20style%3D%26quot%3Bfont-size%3A%2010px%3B%26quot%3B%26gt%3B%7B%26lt%3B%2Fdiv%26gt%3B%26lt%3Bdiv%20style%3D%26quot%3Bfont-size%3A%2010px%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3B%20%26quot%3Bsub%26quot%3B%3A%20%26quot%3B83692%26quot%3B%26lt%3Bbr%20style%3D%26quot%3Bborder-color%3A%20var(--border-color)%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3B%20%26quot%3Bemail%26quot%3B%3A%20%26quot%3Balice%40coder.com%26quot%3B%2C%26lt%3B%2Fdiv%26gt%3B%26lt%3Bdiv%20style%3D%26quot%3Bfont-size%3A%2010px%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3B%20%26quot%3Bgroups%26quot%3B%3A%20%5B%26quot%3Bdevs%26quot%3B%2C%26quot%3Badmins%26quot%3B%5D%26lt%3Bbr%20style%3D%26quot%3Bborder-color%3A%20var(--border-color)%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B....%20rest%20of%20claims%20...%26lt%3Bbr%20style%3D%26quot%3Bborder-color%3A%20var(--border-color)%3B%26quot%3B%26gt%3B%7D%26lt%3Bbr%26gt%3B%26lt%3B%2Fdiv%26gt%3B%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3Balign%3Dleft%3BfontSize%3D10%3BfontFamily%3DCourier%20New%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-80%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22250%22%20y%3D%2240%22%20width%3D%22210%22%20height%3D%2280%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-53%22%20value%3D%22%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-80%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22210%22%20width%3D%2220%22%20height%3D%2240%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-54%22%20value%3D%22%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3BexitX%3D1%3BexitY%3D0.25%3BexitDx%3D0%3BexitDy%3D0%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-80%22%20source%3D%22eYKO086i2hVpJxTEME1l-53%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22239%22%20y%3D%22-6%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22475.5%22%20y%3D%229%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-55%22%20value%3D%22GET%20https%3A%2F%2Foidc.provider.com%2F...%2Fuserinfo%22%20style%3D%22edgeLabel%3Bhtml%3D1%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3Bresizable%3D0%3Bpoints%3D%5B%5D%3BlabelBackgroundColor%3Dnone%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-54%22%20connectable%3D%220%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22-0.2051%22%20y%3D%222%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%2212%22%20y%3D%22-7%22%20as%3D%22offset%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-58%22%20value%3D%22JSON%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3BentryX%3D1%3BentryY%3D0.75%3BentryDx%3D0%3BentryDy%3D0%3BlabelBackgroundColor%3Dnone%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-80%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%220.1039%22%20y%3D%22-11%22%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22475.5%22%20y%3D%2233%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22230%22%20y%3D%2233%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20as%3D%22offset%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-59%22%20value%3D%22%22%20style%3D%22endArrow%3Dnone%3Bhtml%3D1%3Brounded%3D0%3BexitX%3D0.5%3BexitY%3D0%3BexitDx%3D0%3BexitDy%3D0%3BendSize%3D6%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-80%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22363%22%20y%3D%2243%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22363%22%20y%3D%2233%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-61%22%20value%3D%22%22%20style%3D%22html%3D1%3BverticalLabelPosition%3Dbottom%3BlabelBackgroundColor%3D%23ffffff%3BverticalAlign%3Dtop%3Bshadow%3D0%3Bdashed%3D0%3BstrokeWidth%3D2%3Bshape%3Dmxgraph.ios7.misc.info%3BstrokeColor%3D%230080f0%3Bsketch%3D0%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-80%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22438%22%20y%3D%2248%22%20width%3D%2212%22%20height%3D%2212%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-68%22%20value%3D%22%22%20style%3D%22sketch%3D0%3BoutlineConnect%3D0%3BfillColor%3D%230080F0%3BstrokeColor%3D%236c8ebf%3Bdashed%3D0%3BverticalLabelPosition%3Dbottom%3BverticalAlign%3Dtop%3Balign%3Dcenter%3Bhtml%3D1%3BfontSize%3D12%3BfontStyle%3D0%3Baspect%3Dfixed%3BpointerEvents%3D1%3Bshape%3Dmxgraph.aws4.gear%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-80%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22210%22%20y%3D%2211%22%20width%3D%2219%22%20height%3D%2219%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-69%22%20value%3D%22%26lt%3Bb%26gt%3B%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%20color%3D%26quot%3B%230080f0%26quot%3B%26gt%3B%24CODER_OIDC_IGNORE_USERINFO%26lt%3Bbr%26gt%3B%26lt%3B%2Ffont%26gt%3B%26lt%3Bfont%20color%3D%26quot%3B%23ff031c%26quot%3B%20face%3D%26quot%3BCourier%20New%26quot%3B%20style%3D%26quot%3Bfont-size%3A%209px%3B%26quot%3B%26gt%3BConfigurable%20step%2C%20will%20skip%20if%20set%20to%20false%26lt%3B%2Ffont%26gt%3B%26lt%3B%2Fb%26gt%3B%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%20color%3D%26quot%3B%230080f0%26quot%3B%26gt%3B%26lt%3Bbr%26gt%3B%26lt%3B%2Ffont%26gt%3B%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-80%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22-30%22%20y%3D%2210%22%20width%3D%22240%22%20height%3D%2230%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-81%22%20value%3D%22%26lt%3Bb%26gt%3BFetch%20user%20info%26lt%3B%2Fb%26gt%3B%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22555%22%20y%3D%221198%22%20width%3D%22110%22%20height%3D%2230%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-82%22%20value%3D%22%26lt%3Bb%26gt%3BGroup%20Sync%26lt%3B%2Fb%26gt%3B%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22600%22%20y%3D%221366%22%20width%3D%22110%22%20height%3D%2230%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-83%22%20value%3D%22%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3BexitX%3D1%3BexitY%3D0.25%3BexitDx%3D0%3BexitDy%3D0%3BstartSize%3D6%3BentryX%3D-0.007%3BentryY%3D0.237%3BentryDx%3D0%3BentryDy%3D0%3BentryPerimeter%3D0%3B%22%20parent%3D%221%22%20source%3D%22eYKO086i2hVpJxTEME1l-72%22%20target%3D%22eYKO086i2hVpJxTEME1l-84%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22700%22%20y%3D%221300%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22530%22%20y%3D%221435%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-84%22%20value%3D%22%26amp%3Bnbsp%3B%201.%20Look%20at%20%26lt%3Bfont%20color%3D%26quot%3B%23ff031c%26quot%3B%20face%3D%26quot%3BCourier%20New%26quot%3B%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%26gt%3BCODER_OIDC_GROUP_FIELD%26lt%3B%2Ffont%26gt%3B%26amp%3Bnbsp%3Bclaim%2C%20if%20unset%20%26lt%3Bspan%20style%3D%26quot%3Bwhite-space%3A%20pre%3B%26quot%3B%26gt%3B%26%23x9%3B%26lt%3B%2Fspan%26gt%3Band%20%26%2339%3Bgroups%26%2339%3B%20scope%20missing%20%26lt%3Bb%26gt%3Babort%20and%20do%20nothing%26lt%3B%2Fb%26gt%3B%26lt%3Bbr%26gt%3B%26amp%3Bnbsp%3B%202.%20Rename%20groups%20in%20list%20with%26lt%3Bbr%26gt%3B%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%20color%3D%26quot%3B%23ff031c%26quot%3B%26gt%3BCODER_OIDC_USER_ROLE_MAPPING%26lt%3Bbr%26gt%3B%26lt%3B%2Ffont%26gt%3B%26amp%3Bnbsp%3B%203.%26amp%3Bnbsp%3B%26lt%3Bfont%20color%3D%26quot%3B%23ff031c%26quot%3B%20style%3D%26quot%3B%26quot%3B%20face%3D%26quot%3BCourier%20New%26quot%3B%26gt%3BCODER_OIDC_GROUP_REGEX_FILTER%20%26lt%3B%2Ffont%26gt%3Bwill%20%26lt%3Bbr%26gt%3B%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%20remove%20groups%20that%20do%20not%20match%20the%20regex.%26lt%3Bbr%26gt%3B%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3B%26lt%3B%2Ffont%26gt%3B%26lt%3Bfont%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%26gt%3B4.%20User%20is%20removed%20from%20all%20their%20groups.%26lt%3Bbr%26gt%3B%26lt%3B%2Ffont%26gt%3B%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3B%26lt%3B%2Ffont%26gt%3B%26lt%3Bfont%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%26gt%3B5.%26amp%3Bnbsp%3B%26lt%3B%2Ffont%26gt%3B%26lt%3Bfont%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%20face%3D%26quot%3BCourier%20New%26quot%3B%20color%3D%26quot%3B%23ff031c%26quot%3B%26gt%3BCODER_OIDC_GROUP_AUTO_CREATE%26lt%3B%2Ffont%26gt%3B%26amp%3Bnbsp%3Bcreates%26lt%3Bbr%26gt%3B%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%20missing%20groups%20in%20Coder%20if%20set%20to%20%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%20color%3D%26quot%3B%23ff031c%26quot%3B%26gt%3Btrue%26lt%3B%2Ffont%26gt%3B.%26lt%3Bbr%26gt%3B%26amp%3Bnbsp%3B%206.%20User%20is%20assigned%20to%20all%20groups%20in%20claim%20that%26lt%3Bbr%26gt%3B%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%20exist%20in%20Coder.%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3Balign%3Dleft%3BverticalAlign%3Dtop%3Bdashed%3D1%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22540%22%20y%3D%221396%22%20width%3D%22300%22%20height%3D%22174%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-85%22%20value%3D%22%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22470%22%20y%3D%221140%22%20width%3D%2220%22%20height%3D%2245%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-86%22%20value%3D%22%22%20style%3D%22sketch%3D0%3BoutlineConnect%3D0%3BfillColor%3D%230080F0%3BstrokeColor%3D%236c8ebf%3Bdashed%3D0%3BverticalLabelPosition%3Dbottom%3BverticalAlign%3Dtop%3Balign%3Dcenter%3Bhtml%3D1%3BfontSize%3D12%3BfontStyle%3D0%3Baspect%3Dfixed%3BpointerEvents%3D1%3Bshape%3Dmxgraph.aws4.gear%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22470.5%22%20y%3D%221153%22%20width%3D%2219%22%20height%3D%2219%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-97%22%20value%3D%22%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%26gt%3B%26lt%3Bb%26gt%3B%26lt%3Bfont%20color%3D%26quot%3B%230080f0%26quot%3B%26gt%3B%24CODER_OIDC_ALLOW_SIGNUPS%26lt%3B%2Ffont%26gt%3B%26lt%3Bbr%26gt%3B%26lt%3Bfont%20color%3D%26quot%3B%23ff031c%26quot%3B%20style%3D%26quot%3Bfont-size%3A%209px%3B%26quot%3B%26gt%3BConfigurable%20step%26lt%3B%2Ffont%26gt%3B%26lt%3B%2Fb%26gt%3B%26lt%3Bbr%26gt%3B%26lt%3B%2Ffont%26gt%3B%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22275.5%22%20y%3D%221140%22%20width%3D%22189%22%20height%3D%2250%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-98%22%20value%3D%22%22%20style%3D%22curved%3D1%3BendArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3BexitX%3D1%3BexitY%3D0.25%3BexitDx%3D0%3BexitDy%3D0%3BentryX%3D1%3BentryY%3D0.75%3BentryDx%3D0%3BentryDy%3D0%3B%22%20parent%3D%221%22%20source%3D%22eYKO086i2hVpJxTEME1l-85%22%20target%3D%22eYKO086i2hVpJxTEME1l-85%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22700%22%20y%3D%221260%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22750%22%20y%3D%221210%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CArray%20as%3D%22points%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22500%22%20y%3D%221150%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22520%22%20y%3D%221160%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22510%22%20y%3D%221170%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3C%2FArray%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-99%22%20value%3D%22If%20user%20does%20not%20exist%2C%20check%20if%20allowing%20signups.%20Reject%20login%20if%20signups%20disabled.%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22510%22%20y%3D%221147.5%22%20width%3D%22200%22%20height%3D%2242.5%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-108%22%20value%3D%22%26lt%3Bb%26gt%3BCheck%20new%20signups%26lt%3B%2Fb%26gt%3B%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22540%22%20y%3D%221125%22%20width%3D%22130%22%20height%3D%2230%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-109%22%20value%3D%22%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22469.5%22%20y%3D%221597%22%20width%3D%2220%22%20height%3D%2245%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-110%22%20value%3D%22%22%20style%3D%22sketch%3D0%3BoutlineConnect%3D0%3BfillColor%3D%230080F0%3BstrokeColor%3D%236c8ebf%3Bdashed%3D0%3BverticalLabelPosition%3Dbottom%3BverticalAlign%3Dtop%3Balign%3Dcenter%3Bhtml%3D1%3BfontSize%3D12%3BfontStyle%3D0%3Baspect%3Dfixed%3BpointerEvents%3D1%3Bshape%3Dmxgraph.aws4.gear%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22469.5%22%20y%3D%221612.5%22%20width%3D%2219%22%20height%3D%2219%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-111%22%20value%3D%22%26lt%3Bb%26gt%3BRoles%20Sync%26lt%3B%2Fb%26gt%3B%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22612%22%20y%3D%221567%22%20width%3D%22110%22%20height%3D%2230%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-112%22%20value%3D%22%26amp%3Bnbsp%3B%201.%20Look%20at%20%26lt%3Bfont%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%20face%3D%26quot%3BCourier%20New%26quot%3B%20color%3D%26quot%3B%23ff031c%26quot%3B%26gt%3BCODER_OIDC_USER_ROLE_FIELD%26lt%3Bbr%26gt%3B%26lt%3B%2Ffont%26gt%3B%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%20claim.%20If%20unset%2C%20%26lt%3Bb%26gt%3Babort%20and%20do%20nothing%26lt%3B%2Fb%26gt%3B%26lt%3Bbr%26gt%3B%26amp%3Bnbsp%3B%202.%20Rename%20roles%20in%20list%20with%26lt%3Bbr%26gt%3B%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3B%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%20style%3D%26quot%3Bfont-size%3A%2011px%3B%26quot%3B%20color%3D%26quot%3B%23ff031c%26quot%3B%26gt%3BCODER_OIDC_USER_ROLE_MAPPING%26lt%3Bbr%26gt%3B%26lt%3B%2Ffont%26gt%3B%26amp%3Bnbsp%3B%203.%20User%20roles%20updated%20to%20roles%20listed%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3Balign%3Dleft%3BverticalAlign%3Dtop%3Bdashed%3D1%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22540%22%20y%3D%221597%22%20width%3D%22260%22%20height%3D%2290%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-113%22%20value%3D%22%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%26gt%3B%26lt%3Bfont%20color%3D%26quot%3B%230080f0%26quot%3B%26gt%3B%26lt%3Bb%26gt%3B%24CODER_OIDC_USER_ROLE_FIELD%26lt%3Bbr%26gt%3B%24CODER_OIDC_USER_ROLE_MAPPING%26lt%3B%2Fb%26gt%3B%26lt%3B%2Ffont%26gt%3B%26lt%3B%2Ffont%26gt%3B%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%26gt%3B%26lt%3Bb%26gt%3B%26lt%3Bbr%26gt%3B%26lt%3Bfont%20color%3D%26quot%3B%23ff031c%26quot%3B%20style%3D%26quot%3Bfont-size%3A%209px%3B%26quot%3B%26gt%3BConfigurable%20step%26lt%3B%2Ffont%26gt%3B%26lt%3B%2Fb%26gt%3B%26lt%3Bbr%26gt%3B%26lt%3B%2Ffont%26gt%3B%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22226%22%20y%3D%221580%22%20width%3D%22249%22%20height%3D%2296%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-114%22%20value%3D%22%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3BentryX%3D0%3BentryY%3D0.25%3BentryDx%3D0%3BentryDy%3D0%3B%22%20parent%3D%221%22%20target%3D%22eYKO086i2hVpJxTEME1l-112%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22490%22%20y%3D%221620%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22555%22%20y%3D%221580%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-121%22%20value%3D%22%22%20style%3D%22endArrow%3Dnone%3Bdashed%3D1%3Bhtml%3D1%3BdashPattern%3D1%203%3BstrokeWidth%3D3%3Brounded%3D0%3BexitX%3D0%3BexitY%3D-0.039%3BexitDx%3D0%3BexitDy%3D0%3BexitPerimeter%3D0%3BfillColor%3D%23dae8fc%3BstrokeColor%3D%236c8ebf%3B%22%20parent%3D%221%22%20source%3D%22eYKO086i2hVpJxTEME1l-66%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22732%22%20y%3D%22916%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22830%22%20y%3D%22910%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-123%22%20value%3D%22%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3BexitX%3D-0.155%3BexitY%3D0.977%3BexitDx%3D0%3BexitDy%3D0%3BexitPerimeter%3D0%3BfontSize%3D11%3Bspacing%3D2%3BspacingLeft%3D0%3B%22%20parent%3D%221%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%220.1337%22%20y%3D%22-17%22%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22473.45000000000005%22%20y%3D%221723.7849999999999%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22149.81034482758628%22%20y%3D%221723.7849999999999%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20as%3D%22offset%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-128%22%20value%3D%22%26lt%3Bblockquote%20style%3D%26quot%3Bmargin%3A%200%200%200%2040px%3B%20border%3A%20none%3B%20padding%3A%200px%3B%26quot%3B%26gt%3B%26lt%3B%2Fblockquote%26gt%3B%26lt%3Bblockquote%20style%3D%26quot%3Bmargin%3A%200%200%200%2040px%3B%20border%3A%20none%3B%20padding%3A%200px%3B%26quot%3B%26gt%3B%26lt%3B%2Fblockquote%26gt%3B%26lt%3Bspan%20style%3D%26quot%3Bbackground-color%3A%20initial%3B%20font-size%3A%2010px%3B%26quot%3B%26gt%3B%26lt%3Bdiv%20style%3D%26quot%3B%26quot%3B%26gt%3B%26lt%3Bspan%20style%3D%26quot%3Bbackground-color%3A%20initial%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3B%20https%3A%2F%2Fcoder.com%2F%26lt%3B%2Fspan%26gt%3B%26lt%3B%2Fdiv%26gt%3B%26lt%3Bdiv%20style%3D%26quot%3B%26quot%3B%26gt%3B%26lt%3Bspan%20style%3D%26quot%3Bbackground-color%3A%20initial%3B%26quot%3B%26gt%3B%26amp%3Bnbsp%3B%20%26amp%3Bnbsp%3BSet-Cookie%3A%20coder_session_token%3D%26amp%3Blt%3B%26amp%3Bgt%3B%26lt%3B%2Fspan%26gt%3B%26lt%3B%2Fdiv%26gt%3B%26lt%3B%2Fspan%26gt%3B%26lt%3Bblockquote%20style%3D%26quot%3Bmargin%3A%200%200%200%2040px%3B%20border%3A%20none%3B%20padding%3A%200px%3B%26quot%3B%26gt%3B%26lt%3B%2Fblockquote%26gt%3B%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3Balign%3Dleft%3BfontFamily%3DCourier%20New%3BlabelPosition%3Dcenter%3BverticalLabelPosition%3Dmiddle%3BverticalAlign%3Dmiddle%3BnoLabel%3D0%3BlabelPadding%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22170%22%20y%3D%221739%22%20width%3D%22280%22%20height%3D%2250%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-130%22%20value%3D%22%22%20style%3D%22endArrow%3Dnone%3Bhtml%3D1%3Brounded%3D0%3BexitX%3D0.5%3BexitY%3D0%3BexitDx%3D0%3BexitDy%3D0%3BendSize%3D6%3B%22%20parent%3D%221%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22306%22%20y%3D%221739%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22306%22%20y%3D%221726%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-131%22%20value%3D%22302%20Redirect%22%20style%3D%22edgeLabel%3Bhtml%3D1%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3Bresizable%3D0%3Bpoints%3D%5B%5D%3B%22%20parent%3D%221%22%20connectable%3D%220%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22289.00310344827585%22%20y%3D%221716.0000000000002%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-132%22%20value%3D%22%22%20style%3D%22endArrow%3Dclassic%3Bhtml%3D1%3Brounded%3D0%3B%22%20parent%3D%221%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%2250%22%20height%3D%2250%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22149.81034482758628%22%20y%3D%221819%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22480%22%20y%3D%221819%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-133%22%20value%3D%22GET%20https%3A%2F%2Fcoder.com%22%20style%3D%22edgeLabel%3Bhtml%3D1%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3Bresizable%3D0%3Bpoints%3D%5B%5D%3B%22%20parent%3D%22eYKO086i2hVpJxTEME1l-132%22%20connectable%3D%220%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22-0.2053%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22-2%22%20y%3D%22-8%22%20as%3D%22offset%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-134%22%20value%3D%22User%20is%20authenticated%20to%20Coder%22%20style%3D%22rounded%3D0%3BwhiteSpace%3Dwrap%3Bhtml%3D1%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22226%22%20y%3D%221827%22%20width%3D%22154%22%20height%3D%2250%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%22eYKO086i2hVpJxTEME1l-138%22%20value%3D%22%26lt%3Bh1%20style%3D%26quot%3Bborder-color%3A%20var(--border-color)%3B%20text-align%3A%20left%3B%20line-height%3A%2024px%3B%26quot%3B%26gt%3B%26lt%3Bb%20style%3D%26quot%3Bborder-color%3A%20var(--border-color)%3B%20font-size%3A%2012px%3B%20text-align%3A%20center%3B%26quot%3B%26gt%3B%26lt%3Bfont%20style%3D%26quot%3Bborder-color%3A%20var(--border-color)%3B%20font-size%3A%2018px%3B%26quot%3B%26gt%3BStandard%20OIDC%20Flow%26lt%3B%2Ffont%26gt%3B%26lt%3B%2Fb%26gt%3B%26lt%3B%2Fh1%26gt%3B%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%22525.5%22%20y%3D%22445%22%20width%3D%22210%22%20height%3D%2230%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%228v4RgwBJSsz-lTrGWPME-2%22%20value%3D%22%26lt%3Bfont%20face%3D%26quot%3BCourier%20New%26quot%3B%26gt%3B%26lt%3Bb%26gt%3B%26lt%3Bfont%20color%3D%26quot%3B%230080f0%26quot%3B%26gt%3B%24CODER_OIDC_SCOPES%26lt%3B%2Ffont%26gt%3B%26lt%3Bbr%26gt%3B%26lt%3Bfont%20color%3D%26quot%3B%23ff031c%26quot%3B%20style%3D%26quot%3Bfont-size%3A%209px%3B%26quot%3B%26gt%3BConfigurable%20step%26lt%3B%2Ffont%26gt%3B%26lt%3B%2Fb%26gt%3B%26lt%3Bbr%26gt%3B%26lt%3B%2Ffont%26gt%3B%22%20style%3D%22text%3Bhtml%3D1%3BstrokeColor%3Dnone%3BfillColor%3Dnone%3Balign%3Dcenter%3BverticalAlign%3Dmiddle%3BwhiteSpace%3Dwrap%3Brounded%3D0%3B%22%20parent%3D%221%22%20vertex%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20x%3D%2210.000000000000004%22%20y%3D%22525%22%20width%3D%22129%22%20height%3D%2250%22%20as%3D%22geometry%22%20%2F%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%20%20%3CmxCell%20id%3D%228v4RgwBJSsz-lTrGWPME-4%22%20value%3D%22%22%20style%3D%22shape%3Dlink%3Bhtml%3D1%3Brounded%3D0%3BexitX%3D1%3BexitY%3D0.5%3BexitDx%3D0%3BexitDy%3D0%3BstrokeColor%3D%230080F0%3B%22%20parent%3D%221%22%20source%3D%228v4RgwBJSsz-lTrGWPME-2%22%20edge%3D%221%22%3E%20%20%20%20%20%20%20%20%20%20%20%3CmxGeometry%20width%3D%22100%22%20relative%3D%221%22%20as%3D%22geometry%22%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22140%22%20y%3D%22560%22%20as%3D%22sourcePoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%20%20%3CmxPoint%20x%3D%22190%22%20y%3D%22560%22%20as%3D%22targetPoint%22%20%2F%3E%20%20%20%20%20%20%20%20%20%20%20%3C%2FmxGeometry%3E%20%20%20%20%20%20%20%20%20%3C%2FmxCell%3E%20%20%20%20%20%20%20%3C%2Froot%3E%20%20%20%20%20%3C%2FmxGraphModel%3E%20%20%20%3C%2Fdiagram%3E%20%3C%2Fmxfile%3E%20">
+  <defs
+     id="defs888">
+    <g
+       id="g883">
+      <g
+         id="glyph-0-0">
+        <path
+           d="M 1.125 0 L 1.125 -5.625 L 5.625 -5.625 L 5.625 0 Z M 1.265625 -0.140625 L 5.484375 -0.140625 L 5.484375 -5.484375 L 1.265625 -5.484375 Z M 1.265625 -0.140625 "
+           id="path2" />
+      </g>
+      <g
+         id="glyph-0-1">
+        <path
+           d="M 4.921875 -6.4375 L 5.78125 -6.4375 L 5.78125 -2.71875 C 5.78125 -2.070313 5.703125 -1.554688 5.546875 -1.171875 C 5.398438 -0.796875 5.132813 -0.488281 4.75 -0.25 C 4.375 -0.0078125 3.875 0.109375 3.25 0.109375 C 2.644531 0.109375 2.148438 0.00390625 1.765625 -0.203125 C 1.390625 -0.410156 1.117188 -0.710938 0.953125 -1.109375 C 0.785156 -1.503906 0.703125 -2.039063 0.703125 -2.71875 L 0.703125 -6.4375 L 1.5625 -6.4375 L 1.5625 -2.71875 C 1.5625 -2.164063 1.613281 -1.753906 1.71875 -1.484375 C 1.820313 -1.222656 2 -1.019531 2.25 -0.875 C 2.5 -0.726563 2.8125 -0.65625 3.1875 -0.65625 C 3.8125 -0.65625 4.253906 -0.796875 4.515625 -1.078125 C 4.785156 -1.367188 4.921875 -1.914063 4.921875 -2.71875 Z M 4.921875 -6.4375 "
+           id="path5" />
+      </g>
+      <g
+         id="glyph-0-2">
+        <path
+           d="M 0.28125 -1.390625 L 1.0625 -1.515625 C 1.101563 -1.203125 1.222656 -0.960938 1.421875 -0.796875 C 1.628906 -0.628906 1.910156 -0.546875 2.265625 -0.546875 C 2.628906 -0.546875 2.898438 -0.617188 3.078125 -0.765625 C 3.253906 -0.910156 3.34375 -1.082031 3.34375 -1.28125 C 3.34375 -1.46875 3.265625 -1.609375 3.109375 -1.703125 C 2.992188 -1.773438 2.722656 -1.867188 2.296875 -1.984375 C 1.710938 -2.128906 1.304688 -2.253906 1.078125 -2.359375 C 0.859375 -2.460938 0.691406 -2.609375 0.578125 -2.796875 C 0.460938 -2.984375 0.40625 -3.191406 0.40625 -3.421875 C 0.40625 -3.628906 0.453125 -3.820313 0.546875 -4 C 0.640625 -4.175781 0.769531 -4.328125 0.9375 -4.453125 C 1.0625 -4.535156 1.226563 -4.609375 1.4375 -4.671875 C 1.65625 -4.734375 1.882813 -4.765625 2.125 -4.765625 C 2.488281 -4.765625 2.804688 -4.710938 3.078125 -4.609375 C 3.359375 -4.503906 3.566406 -4.363281 3.703125 -4.1875 C 3.835938 -4.007813 3.929688 -3.769531 3.984375 -3.46875 L 3.203125 -3.359375 C 3.171875 -3.597656 3.066406 -3.785156 2.890625 -3.921875 C 2.722656 -4.054688 2.488281 -4.125 2.1875 -4.125 C 1.820313 -4.125 1.5625 -4.0625 1.40625 -3.9375 C 1.25 -3.820313 1.171875 -3.679688 1.171875 -3.515625 C 1.171875 -3.410156 1.203125 -3.320313 1.265625 -3.25 C 1.328125 -3.15625 1.429688 -3.082031 1.578125 -3.03125 C 1.648438 -3 1.878906 -2.929688 2.265625 -2.828125 C 2.828125 -2.679688 3.21875 -2.5625 3.4375 -2.46875 C 3.664063 -2.375 3.84375 -2.234375 3.96875 -2.046875 C 4.09375 -1.867188 4.15625 -1.644531 4.15625 -1.375 C 4.15625 -1.101563 4.078125 -0.851563 3.921875 -0.625 C 3.765625 -0.394531 3.539063 -0.210938 3.25 -0.078125 C 2.96875 0.046875 2.640625 0.109375 2.265625 0.109375 C 1.660156 0.109375 1.195313 -0.015625 0.875 -0.265625 C 0.5625 -0.523438 0.363281 -0.898438 0.28125 -1.390625 Z M 0.28125 -1.390625 "
+           id="path8" />
+      </g>
+      <g
+         id="glyph-0-3">
+        <path
+           d="M 3.78125 -1.5 L 4.609375 -1.40625 C 4.472656 -0.925781 4.226563 -0.550781 3.875 -0.28125 C 3.53125 -0.0195313 3.085938 0.109375 2.546875 0.109375 C 1.867188 0.109375 1.328125 -0.0976563 0.921875 -0.515625 C 0.523438 -0.941406 0.328125 -1.535156 0.328125 -2.296875 C 0.328125 -3.078125 0.53125 -3.679688 0.9375 -4.109375 C 1.34375 -4.546875 1.867188 -4.765625 2.515625 -4.765625 C 3.140625 -4.765625 3.644531 -4.550781 4.03125 -4.125 C 4.425781 -3.707031 4.625 -3.113281 4.625 -2.34375 C 4.625 -2.289063 4.625 -2.21875 4.625 -2.125 L 1.140625 -2.125 C 1.171875 -1.613281 1.316406 -1.222656 1.578125 -0.953125 C 1.835938 -0.679688 2.164063 -0.546875 2.5625 -0.546875 C 2.851563 -0.546875 3.097656 -0.617188 3.296875 -0.765625 C 3.503906 -0.921875 3.664063 -1.164063 3.78125 -1.5 Z M 1.1875 -2.78125 L 3.796875 -2.78125 C 3.765625 -3.175781 3.664063 -3.472656 3.5 -3.671875 C 3.25 -3.972656 2.921875 -4.125 2.515625 -4.125 C 2.148438 -4.125 1.84375 -4 1.59375 -3.75 C 1.351563 -3.507813 1.21875 -3.1875 1.1875 -2.78125 Z M 1.1875 -2.78125 "
+           id="path11" />
+      </g>
+      <g
+         id="glyph-0-4">
+        <path
+           d="M 0.578125 0 L 0.578125 -4.671875 L 1.296875 -4.671875 L 1.296875 -3.953125 C 1.472656 -4.285156 1.640625 -4.503906 1.796875 -4.609375 C 1.953125 -4.710938 2.125 -4.765625 2.3125 -4.765625 C 2.570313 -4.765625 2.84375 -4.679688 3.125 -4.515625 L 2.84375 -3.78125 C 2.65625 -3.894531 2.460938 -3.953125 2.265625 -3.953125 C 2.097656 -3.953125 1.941406 -3.898438 1.796875 -3.796875 C 1.660156 -3.691406 1.5625 -3.546875 1.5 -3.359375 C 1.414063 -3.078125 1.375 -2.769531 1.375 -2.4375 L 1.375 0 Z M 0.578125 0 "
+           id="path14" />
+      </g>
+      <g
+         id="glyph-0-5">
+        <path
+           d="M 0.59375 -4.15625 L 0.390625 -5.359375 L 0.390625 -6.4375 L 1.296875 -6.4375 L 1.296875 -5.359375 L 1.078125 -4.15625 Z M 0.59375 -4.15625 "
+           id="path17" />
+      </g>
+      <g
+         id="glyph-0-6" />
+      <g
+         id="glyph-0-7">
+        <path
+           d="M 0.65625 0 L 0.65625 -6.4375 L 3.078125 -6.4375 C 3.566406 -6.4375 3.957031 -6.367188 4.25 -6.234375 C 4.550781 -6.109375 4.785156 -5.910156 4.953125 -5.640625 C 5.128906 -5.367188 5.21875 -5.085938 5.21875 -4.796875 C 5.21875 -4.515625 5.140625 -4.253906 4.984375 -4.015625 C 4.835938 -3.773438 4.613281 -3.578125 4.3125 -3.421875 C 4.695313 -3.304688 4.992188 -3.113281 5.203125 -2.84375 C 5.421875 -2.570313 5.53125 -2.25 5.53125 -1.875 C 5.53125 -1.570313 5.460938 -1.289063 5.328125 -1.03125 C 5.203125 -0.769531 5.046875 -0.566406 4.859375 -0.421875 C 4.671875 -0.285156 4.4375 -0.179688 4.15625 -0.109375 C 3.875 -0.0351563 3.523438 0 3.109375 0 Z M 1.515625 -3.734375 L 2.90625 -3.734375 C 3.28125 -3.734375 3.550781 -3.757813 3.71875 -3.8125 C 3.9375 -3.875 4.097656 -3.976563 4.203125 -4.125 C 4.316406 -4.28125 4.375 -4.46875 4.375 -4.6875 C 4.375 -4.90625 4.320313 -5.09375 4.21875 -5.25 C 4.113281 -5.414063 3.96875 -5.53125 3.78125 -5.59375 C 3.59375 -5.65625 3.265625 -5.6875 2.796875 -5.6875 L 1.515625 -5.6875 Z M 1.515625 -0.765625 L 3.109375 -0.765625 C 3.390625 -0.765625 3.585938 -0.773438 3.703125 -0.796875 C 3.890625 -0.828125 4.050781 -0.882813 4.1875 -0.96875 C 4.320313 -1.050781 4.429688 -1.171875 4.515625 -1.328125 C 4.597656 -1.484375 4.640625 -1.664063 4.640625 -1.875 C 4.640625 -2.113281 4.578125 -2.320313 4.453125 -2.5 C 4.328125 -2.675781 4.15625 -2.796875 3.9375 -2.859375 C 3.71875 -2.929688 3.40625 -2.96875 3 -2.96875 L 1.515625 -2.96875 Z M 1.515625 -0.765625 "
+           id="path21" />
+      </g>
+      <g
+         id="glyph-0-8">
+        <path
+           d="M 0.296875 -2.328125 C 0.296875 -3.191406 0.535156 -3.832031 1.015625 -4.25 C 1.421875 -4.59375 1.910156 -4.765625 2.484375 -4.765625 C 3.128906 -4.765625 3.65625 -4.554688 4.0625 -4.140625 C 4.46875 -3.722656 4.671875 -3.144531 4.671875 -2.40625 C 4.671875 -1.800781 4.578125 -1.328125 4.390625 -0.984375 C 4.210938 -0.640625 3.953125 -0.367188 3.609375 -0.171875 C 3.265625 0.015625 2.890625 0.109375 2.484375 0.109375 C 1.828125 0.109375 1.296875 -0.0976563 0.890625 -0.515625 C 0.492188 -0.941406 0.296875 -1.546875 0.296875 -2.328125 Z M 1.109375 -2.328125 C 1.109375 -1.734375 1.238281 -1.285156 1.5 -0.984375 C 1.757813 -0.691406 2.085938 -0.546875 2.484375 -0.546875 C 2.878906 -0.546875 3.207031 -0.691406 3.46875 -0.984375 C 3.726563 -1.285156 3.859375 -1.742188 3.859375 -2.359375 C 3.859375 -2.929688 3.726563 -3.367188 3.46875 -3.671875 C 3.207031 -3.972656 2.878906 -4.125 2.484375 -4.125 C 2.085938 -4.125 1.757813 -3.972656 1.5 -3.671875 C 1.238281 -3.378906 1.109375 -2.929688 1.109375 -2.328125 Z M 1.109375 -2.328125 "
+           id="path24" />
+      </g>
+      <g
+         id="glyph-0-9">
+        <path
+           d="M 1.453125 0 L 0.03125 -4.671875 L 0.84375 -4.671875 L 1.59375 -1.96875 L 1.859375 -0.96875 C 1.867188 -1.019531 1.953125 -1.34375 2.109375 -1.9375 L 2.84375 -4.671875 L 3.65625 -4.671875 L 4.359375 -1.953125 L 4.59375 -1.0625 L 4.859375 -1.96875 L 5.65625 -4.671875 L 6.421875 -4.671875 L 4.96875 0 L 4.15625 0 L 3.40625 -2.796875 L 3.21875 -3.59375 L 2.28125 0 Z M 1.453125 0 "
+           id="path27" />
+      </g>
+      <g
+         id="glyph-0-10">
+        <path
+           d="M 5.296875 -2.265625 L 6.140625 -2.046875 C 5.960938 -1.347656 5.640625 -0.8125 5.171875 -0.4375 C 4.710938 -0.0703125 4.144531 0.109375 3.46875 0.109375 C 2.78125 0.109375 2.21875 -0.03125 1.78125 -0.3125 C 1.34375 -0.59375 1.007813 -1 0.78125 -1.53125 C 0.5625 -2.070313 0.453125 -2.648438 0.453125 -3.265625 C 0.453125 -3.941406 0.578125 -4.53125 0.828125 -5.03125 C 1.085938 -5.53125 1.453125 -5.90625 1.921875 -6.15625 C 2.398438 -6.414063 2.921875 -6.546875 3.484375 -6.546875 C 4.128906 -6.546875 4.671875 -6.378906 5.109375 -6.046875 C 5.554688 -5.722656 5.863281 -5.265625 6.03125 -4.671875 L 5.1875 -4.484375 C 5.039063 -4.953125 4.828125 -5.289063 4.546875 -5.5 C 4.265625 -5.71875 3.90625 -5.828125 3.46875 -5.828125 C 2.976563 -5.828125 2.566406 -5.707031 2.234375 -5.46875 C 1.898438 -5.226563 1.664063 -4.90625 1.53125 -4.5 C 1.394531 -4.101563 1.328125 -3.695313 1.328125 -3.28125 C 1.328125 -2.726563 1.40625 -2.242188 1.5625 -1.828125 C 1.726563 -1.421875 1.976563 -1.117188 2.3125 -0.921875 C 2.644531 -0.722656 3.007813 -0.625 3.40625 -0.625 C 3.882813 -0.625 4.285156 -0.757813 4.609375 -1.03125 C 4.941406 -1.3125 5.171875 -1.722656 5.296875 -2.265625 Z M 5.296875 -2.265625 "
+           id="path30" />
+      </g>
+      <g
+         id="glyph-0-11">
+        <path
+           d="M 3.625 0 L 3.625 -0.59375 C 3.320313 -0.125 2.882813 0.109375 2.3125 0.109375 C 1.945313 0.109375 1.609375 0.00390625 1.296875 -0.203125 C 0.984375 -0.410156 0.738281 -0.695313 0.5625 -1.0625 C 0.394531 -1.425781 0.3125 -1.847656 0.3125 -2.328125 C 0.3125 -2.796875 0.390625 -3.21875 0.546875 -3.59375 C 0.703125 -3.976563 0.929688 -4.269531 1.234375 -4.46875 C 1.546875 -4.664063 1.894531 -4.765625 2.28125 -4.765625 C 2.5625 -4.765625 2.8125 -4.707031 3.03125 -4.59375 C 3.25 -4.476563 3.425781 -4.320313 3.5625 -4.125 L 3.5625 -6.4375 L 4.359375 -6.4375 L 4.359375 0 Z M 1.125 -2.328125 C 1.125 -1.734375 1.25 -1.285156 1.5 -0.984375 C 1.75 -0.691406 2.046875 -0.546875 2.390625 -0.546875 C 2.734375 -0.546875 3.023438 -0.6875 3.265625 -0.96875 C 3.515625 -1.25 3.640625 -1.679688 3.640625 -2.265625 C 3.640625 -2.898438 3.515625 -3.367188 3.265625 -3.671875 C 3.015625 -3.972656 2.710938 -4.125 2.359375 -4.125 C 2.003906 -4.125 1.707031 -3.976563 1.46875 -3.6875 C 1.238281 -3.394531 1.125 -2.941406 1.125 -2.328125 Z M 1.125 -2.328125 "
+           id="path33" />
+      </g>
+      <g
+         id="glyph-0-12">
+        <path
+           d="M 0.4375 -3.140625 C 0.4375 -4.203125 0.722656 -5.035156 1.296875 -5.640625 C 1.867188 -6.253906 2.609375 -6.5625 3.515625 -6.5625 C 4.109375 -6.5625 4.644531 -6.414063 5.125 -6.125 C 5.601563 -5.84375 5.96875 -5.445313 6.21875 -4.9375 C 6.46875 -4.425781 6.59375 -3.851563 6.59375 -3.21875 C 6.59375 -2.5625 6.460938 -1.972656 6.203125 -1.453125 C 5.941406 -0.941406 5.566406 -0.550781 5.078125 -0.28125 C 4.597656 -0.0195313 4.078125 0.109375 3.515625 0.109375 C 2.910156 0.109375 2.367188 -0.0351563 1.890625 -0.328125 C 1.410156 -0.617188 1.046875 -1.019531 0.796875 -1.53125 C 0.554688 -2.039063 0.4375 -2.578125 0.4375 -3.140625 Z M 1.3125 -3.125 C 1.3125 -2.34375 1.519531 -1.726563 1.9375 -1.28125 C 2.351563 -0.84375 2.878906 -0.625 3.515625 -0.625 C 4.148438 -0.625 4.675781 -0.847656 5.09375 -1.296875 C 5.507813 -1.742188 5.71875 -2.382813 5.71875 -3.21875 C 5.71875 -3.738281 5.628906 -4.191406 5.453125 -4.578125 C 5.273438 -4.972656 5.015625 -5.28125 4.671875 -5.5 C 4.328125 -5.71875 3.945313 -5.828125 3.53125 -5.828125 C 2.925781 -5.828125 2.40625 -5.617188 1.96875 -5.203125 C 1.53125 -4.785156 1.3125 -4.09375 1.3125 -3.125 Z M 1.3125 -3.125 "
+           id="path36" />
+      </g>
+      <g
+         id="glyph-0-13">
+        <path
+           d="M 0.84375 0 L 0.84375 -6.4375 L 1.6875 -6.4375 L 1.6875 0 Z M 0.84375 0 "
+           id="path39" />
+      </g>
+      <g
+         id="glyph-0-14">
+        <path
+           d="M 0.6875 0 L 0.6875 -6.4375 L 2.90625 -6.4375 C 3.414063 -6.4375 3.800781 -6.40625 4.0625 -6.34375 C 4.425781 -6.257813 4.738281 -6.109375 5 -5.890625 C 5.34375 -5.597656 5.597656 -5.226563 5.765625 -4.78125 C 5.929688 -4.34375 6.015625 -3.832031 6.015625 -3.25 C 6.015625 -2.757813 5.957031 -2.328125 5.84375 -1.953125 C 5.726563 -1.578125 5.582031 -1.265625 5.40625 -1.015625 C 5.226563 -0.765625 5.03125 -0.566406 4.8125 -0.421875 C 4.601563 -0.285156 4.347656 -0.179688 4.046875 -0.109375 C 3.753906 -0.0351563 3.410156 0 3.015625 0 Z M 1.546875 -0.765625 L 2.921875 -0.765625 C 3.347656 -0.765625 3.679688 -0.800781 3.921875 -0.875 C 4.160156 -0.957031 4.351563 -1.070313 4.5 -1.21875 C 4.695313 -1.414063 4.851563 -1.6875 4.96875 -2.03125 C 5.082031 -2.375 5.140625 -2.785156 5.140625 -3.265625 C 5.140625 -3.941406 5.03125 -4.457031 4.8125 -4.8125 C 4.59375 -5.175781 4.320313 -5.421875 4 -5.546875 C 3.769531 -5.640625 3.40625 -5.6875 2.90625 -5.6875 L 1.546875 -5.6875 Z M 1.546875 -0.765625 "
+           id="path42" />
+      </g>
+      <g
+         id="glyph-0-15">
+        <path
+           d="M 0.6875 0 L 0.6875 -6.4375 L 3.125 -6.4375 C 3.550781 -6.4375 3.878906 -6.414063 4.109375 -6.375 C 4.421875 -6.320313 4.679688 -6.222656 4.890625 -6.078125 C 5.109375 -5.929688 5.28125 -5.722656 5.40625 -5.453125 C 5.539063 -5.191406 5.609375 -4.898438 5.609375 -4.578125 C 5.609375 -4.023438 5.429688 -3.5625 5.078125 -3.1875 C 4.734375 -2.8125 4.109375 -2.625 3.203125 -2.625 L 1.546875 -2.625 L 1.546875 0 Z M 1.546875 -3.375 L 3.21875 -3.375 C 3.757813 -3.375 4.144531 -3.476563 4.375 -3.6875 C 4.613281 -3.894531 4.734375 -4.179688 4.734375 -4.546875 C 4.734375 -4.816406 4.664063 -5.046875 4.53125 -5.234375 C 4.394531 -5.429688 4.210938 -5.5625 3.984375 -5.625 C 3.847656 -5.664063 3.582031 -5.6875 3.1875 -5.6875 L 1.546875 -5.6875 Z M 1.546875 -3.375 "
+           id="path45" />
+      </g>
+      <g
+         id="glyph-0-16">
+        <path
+           d="M 1.890625 0 L 0.109375 -4.671875 L 0.953125 -4.671875 L 1.953125 -1.875 C 2.054688 -1.570313 2.15625 -1.257813 2.25 -0.9375 C 2.320313 -1.175781 2.421875 -1.46875 2.546875 -1.8125 L 3.578125 -4.671875 L 4.390625 -4.671875 L 2.625 0 Z M 1.890625 0 "
+           id="path48" />
+      </g>
+      <g
+         id="glyph-0-17">
+        <path
+           d="M 0.59375 -5.53125 L 0.59375 -6.4375 L 1.390625 -6.4375 L 1.390625 -5.53125 Z M 0.59375 0 L 0.59375 -4.671875 L 1.390625 -4.671875 L 1.390625 0 Z M 0.59375 0 "
+           id="path51" />
+      </g>
+      <g
+         id="glyph-0-18">
+        <path
+           d="M 0.59375 1.78125 L 0.59375 -4.671875 L 1.3125 -4.671875 L 1.3125 -4.0625 C 1.476563 -4.300781 1.664063 -4.476563 1.875 -4.59375 C 2.09375 -4.707031 2.359375 -4.765625 2.671875 -4.765625 C 3.066406 -4.765625 3.414063 -4.660156 3.71875 -4.453125 C 4.019531 -4.253906 4.25 -3.96875 4.40625 -3.59375 C 4.5625 -3.21875 4.640625 -2.8125 4.640625 -2.375 C 4.640625 -1.894531 4.550781 -1.460938 4.375 -1.078125 C 4.207031 -0.691406 3.960938 -0.394531 3.640625 -0.1875 C 3.316406 0.0078125 2.972656 0.109375 2.609375 0.109375 C 2.347656 0.109375 2.113281 0.0507813 1.90625 -0.0625 C 1.695313 -0.175781 1.523438 -0.316406 1.390625 -0.484375 L 1.390625 1.78125 Z M 1.3125 -2.3125 C 1.3125 -1.707031 1.429688 -1.257813 1.671875 -0.96875 C 1.921875 -0.6875 2.21875 -0.546875 2.5625 -0.546875 C 2.90625 -0.546875 3.203125 -0.691406 3.453125 -0.984375 C 3.710938 -1.285156 3.84375 -1.75 3.84375 -2.375 C 3.84375 -2.96875 3.71875 -3.410156 3.46875 -3.703125 C 3.226563 -4.003906 2.9375 -4.15625 2.59375 -4.15625 C 2.257813 -4.15625 1.960938 -3.992188 1.703125 -3.671875 C 1.441406 -3.359375 1.3125 -2.90625 1.3125 -2.3125 Z M 1.3125 -2.3125 "
+           id="path54" />
+      </g>
+      <g
+         id="glyph-0-19">
+        <path
+           d="M 0.59375 0 L 0.59375 -4.671875 L 1.296875 -4.671875 L 1.296875 -4.015625 C 1.441406 -4.242188 1.632813 -4.425781 1.875 -4.5625 C 2.125 -4.695313 2.40625 -4.765625 2.71875 -4.765625 C 3.0625 -4.765625 3.34375 -4.691406 3.5625 -4.546875 C 3.78125 -4.410156 3.9375 -4.210938 4.03125 -3.953125 C 4.40625 -4.492188 4.882813 -4.765625 5.46875 -4.765625 C 5.9375 -4.765625 6.296875 -4.632813 6.546875 -4.375 C 6.796875 -4.125 6.921875 -3.734375 6.921875 -3.203125 L 6.921875 0 L 6.125 0 L 6.125 -2.9375 C 6.125 -3.257813 6.097656 -3.488281 6.046875 -3.625 C 6.003906 -3.757813 5.914063 -3.867188 5.78125 -3.953125 C 5.644531 -4.046875 5.484375 -4.09375 5.296875 -4.09375 C 4.972656 -4.09375 4.703125 -3.984375 4.484375 -3.765625 C 4.265625 -3.546875 4.15625 -3.195313 4.15625 -2.71875 L 4.15625 0 L 3.359375 0 L 3.359375 -3.03125 C 3.359375 -3.382813 3.296875 -3.648438 3.171875 -3.828125 C 3.046875 -4.003906 2.835938 -4.09375 2.546875 -4.09375 C 2.316406 -4.09375 2.109375 -4.03125 1.921875 -3.90625 C 1.734375 -3.789063 1.597656 -3.617188 1.515625 -3.390625 C 1.429688 -3.171875 1.390625 -2.847656 1.390625 -2.421875 L 1.390625 0 Z M 0.59375 0 "
+           id="path57" />
+      </g>
+      <g
+         id="glyph-0-20">
+        <path
+           d="M 0.453125 0.390625 L 1.21875 0.5 C 1.25 0.738281 1.335938 0.910156 1.484375 1.015625 C 1.679688 1.160156 1.953125 1.234375 2.296875 1.234375 C 2.660156 1.234375 2.941406 1.160156 3.140625 1.015625 C 3.335938 0.867188 3.472656 0.664063 3.546875 0.40625 C 3.585938 0.238281 3.601563 -0.0976563 3.59375 -0.609375 C 3.25 -0.203125 2.820313 0 2.3125 0 C 1.664063 0 1.164063 -0.226563 0.8125 -0.6875 C 0.46875 -1.15625 0.296875 -1.710938 0.296875 -2.359375 C 0.296875 -2.804688 0.375 -3.21875 0.53125 -3.59375 C 0.695313 -3.96875 0.929688 -4.253906 1.234375 -4.453125 C 1.535156 -4.660156 1.894531 -4.765625 2.3125 -4.765625 C 2.863281 -4.765625 3.316406 -4.546875 3.671875 -4.109375 L 3.671875 -4.671875 L 4.40625 -4.671875 L 4.40625 -0.640625 C 4.40625 0.0859375 4.328125 0.601563 4.171875 0.90625 C 4.023438 1.207031 3.789063 1.445313 3.46875 1.625 C 3.15625 1.800781 2.765625 1.890625 2.296875 1.890625 C 1.734375 1.890625 1.28125 1.765625 0.9375 1.515625 C 0.601563 1.265625 0.441406 0.890625 0.453125 0.390625 Z M 1.109375 -2.421875 C 1.109375 -1.804688 1.226563 -1.359375 1.46875 -1.078125 C 1.707031 -0.796875 2.007813 -0.65625 2.375 -0.65625 C 2.738281 -0.65625 3.046875 -0.796875 3.296875 -1.078125 C 3.546875 -1.359375 3.671875 -1.796875 3.671875 -2.390625 C 3.671875 -2.960938 3.539063 -3.394531 3.28125 -3.6875 C 3.03125 -3.976563 2.726563 -4.125 2.375 -4.125 C 2.019531 -4.125 1.71875 -3.976563 1.46875 -3.6875 C 1.226563 -3.40625 1.109375 -2.984375 1.109375 -2.421875 Z M 1.109375 -2.421875 "
+           id="path60" />
+      </g>
+      <g
+         id="glyph-0-21">
+        <path
+           d="M 0.59375 0 L 0.59375 -6.4375 L 1.390625 -6.4375 L 1.390625 -4.125 C 1.753906 -4.550781 2.21875 -4.765625 2.78125 -4.765625 C 3.125 -4.765625 3.421875 -4.695313 3.671875 -4.5625 C 3.929688 -4.425781 4.113281 -4.238281 4.21875 -4 C 4.332031 -3.757813 4.390625 -3.410156 4.390625 -2.953125 L 4.390625 0 L 3.609375 0 L 3.609375 -2.953125 C 3.609375 -3.347656 3.519531 -3.632813 3.34375 -3.8125 C 3.175781 -4 2.9375 -4.09375 2.625 -4.09375 C 2.382813 -4.09375 2.160156 -4.03125 1.953125 -3.90625 C 1.742188 -3.789063 1.597656 -3.628906 1.515625 -3.421875 C 1.429688 -3.210938 1.390625 -2.921875 1.390625 -2.546875 L 1.390625 0 Z M 0.59375 0 "
+           id="path63" />
+      </g>
+      <g
+         id="glyph-0-22">
+        <path
+           d="M 2.328125 -0.703125 L 2.4375 -0.015625 C 2.207031 0.0351563 2.007813 0.0625 1.84375 0.0625 C 1.550781 0.0625 1.328125 0.015625 1.171875 -0.078125 C 1.015625 -0.171875 0.898438 -0.289063 0.828125 -0.4375 C 0.765625 -0.582031 0.734375 -0.890625 0.734375 -1.359375 L 0.734375 -4.046875 L 0.15625 -4.046875 L 0.15625 -4.671875 L 0.734375 -4.671875 L 0.734375 -5.828125 L 1.53125 -6.296875 L 1.53125 -4.671875 L 2.328125 -4.671875 L 2.328125 -4.046875 L 1.53125 -4.046875 L 1.53125 -1.328125 C 1.53125 -1.097656 1.539063 -0.953125 1.5625 -0.890625 C 1.59375 -0.828125 1.640625 -0.773438 1.703125 -0.734375 C 1.765625 -0.691406 1.851563 -0.671875 1.96875 -0.671875 C 2.0625 -0.671875 2.179688 -0.679688 2.328125 -0.703125 Z M 2.328125 -0.703125 "
+           id="path66" />
+      </g>
+      <g
+         id="glyph-0-23">
+        <path
+           d="M 3.640625 -0.578125 C 3.347656 -0.328125 3.066406 -0.148438 2.796875 -0.046875 C 2.523438 0.0546875 2.234375 0.109375 1.921875 0.109375 C 1.410156 0.109375 1.015625 -0.015625 0.734375 -0.265625 C 0.460938 -0.515625 0.328125 -0.835938 0.328125 -1.234375 C 0.328125 -1.460938 0.378906 -1.671875 0.484375 -1.859375 C 0.585938 -2.046875 0.722656 -2.195313 0.890625 -2.3125 C 1.054688 -2.425781 1.242188 -2.515625 1.453125 -2.578125 C 1.609375 -2.609375 1.84375 -2.644531 2.15625 -2.6875 C 2.800781 -2.757813 3.273438 -2.851563 3.578125 -2.96875 C 3.578125 -3.070313 3.578125 -3.140625 3.578125 -3.171875 C 3.578125 -3.492188 3.503906 -3.71875 3.359375 -3.84375 C 3.148438 -4.03125 2.847656 -4.125 2.453125 -4.125 C 2.078125 -4.125 1.800781 -4.054688 1.625 -3.921875 C 1.445313 -3.796875 1.316406 -3.566406 1.234375 -3.234375 L 0.46875 -3.328125 C 0.53125 -3.660156 0.640625 -3.925781 0.796875 -4.125 C 0.960938 -4.332031 1.195313 -4.488281 1.5 -4.59375 C 1.8125 -4.707031 2.164063 -4.765625 2.5625 -4.765625 C 2.96875 -4.765625 3.289063 -4.71875 3.53125 -4.625 C 3.78125 -4.53125 3.960938 -4.410156 4.078125 -4.265625 C 4.203125 -4.128906 4.285156 -3.953125 4.328125 -3.734375 C 4.359375 -3.597656 4.375 -3.359375 4.375 -3.015625 L 4.375 -1.953125 C 4.375 -1.222656 4.390625 -0.757813 4.421875 -0.5625 C 4.453125 -0.363281 4.519531 -0.175781 4.625 0 L 3.796875 0 C 3.710938 -0.164063 3.660156 -0.359375 3.640625 -0.578125 Z M 3.578125 -2.34375 C 3.285156 -2.226563 2.851563 -2.128906 2.28125 -2.046875 C 1.957031 -1.992188 1.726563 -1.9375 1.59375 -1.875 C 1.457031 -1.820313 1.351563 -1.738281 1.28125 -1.625 C 1.207031 -1.507813 1.171875 -1.382813 1.171875 -1.25 C 1.171875 -1.039063 1.25 -0.863281 1.40625 -0.71875 C 1.5625 -0.582031 1.796875 -0.515625 2.109375 -0.515625 C 2.410156 -0.515625 2.679688 -0.582031 2.921875 -0.71875 C 3.160156 -0.851563 3.335938 -1.035156 3.453125 -1.265625 C 3.535156 -1.441406 3.578125 -1.703125 3.578125 -2.046875 Z M 3.578125 -2.34375 "
+           id="path69" />
+      </g>
+      <g
+         id="glyph-0-24">
+        <path
+           d="M 0.578125 0 L 0.578125 -6.4375 L 1.359375 -6.4375 L 1.359375 0 Z M 0.578125 0 "
+           id="path72" />
+      </g>
+      <g
+         id="glyph-0-25">
+        <path
+           d="M 0.59375 0 L 0.59375 -4.671875 L 1.3125 -4.671875 L 1.3125 -4 C 1.644531 -4.507813 2.140625 -4.765625 2.796875 -4.765625 C 3.078125 -4.765625 3.332031 -4.710938 3.5625 -4.609375 C 3.800781 -4.515625 3.976563 -4.382813 4.09375 -4.21875 C 4.207031 -4.0625 4.289063 -3.867188 4.34375 -3.640625 C 4.375 -3.492188 4.390625 -3.238281 4.390625 -2.875 L 4.390625 0 L 3.59375 0 L 3.59375 -2.84375 C 3.59375 -3.164063 3.5625 -3.40625 3.5 -3.5625 C 3.4375 -3.71875 3.328125 -3.84375 3.171875 -3.9375 C 3.015625 -4.039063 2.832031 -4.09375 2.625 -4.09375 C 2.289063 -4.09375 2 -3.984375 1.75 -3.765625 C 1.507813 -3.554688 1.390625 -3.148438 1.390625 -2.546875 L 1.390625 0 Z M 0.59375 0 "
+           id="path75" />
+      </g>
+      <g
+         id="glyph-0-26">
+        <path
+           d="M 3.5625 1.78125 L 3.5625 -0.5 C 3.445313 -0.320313 3.273438 -0.175781 3.046875 -0.0625 C 2.828125 0.0507813 2.59375 0.109375 2.34375 0.109375 C 1.789063 0.109375 1.3125 -0.109375 0.90625 -0.546875 C 0.507813 -0.992188 0.3125 -1.601563 0.3125 -2.375 C 0.3125 -2.84375 0.390625 -3.265625 0.546875 -3.640625 C 0.710938 -4.015625 0.953125 -4.296875 1.265625 -4.484375 C 1.578125 -4.671875 1.914063 -4.765625 2.28125 -4.765625 C 2.863281 -4.765625 3.316406 -4.523438 3.640625 -4.046875 L 3.640625 -4.671875 L 4.359375 -4.671875 L 4.359375 1.78125 Z M 1.125 -2.34375 C 1.125 -1.75 1.25 -1.300781 1.5 -1 C 1.757813 -0.695313 2.0625 -0.546875 2.40625 -0.546875 C 2.75 -0.546875 3.039063 -0.6875 3.28125 -0.96875 C 3.519531 -1.257813 3.640625 -1.695313 3.640625 -2.28125 C 3.640625 -2.894531 3.507813 -3.359375 3.25 -3.671875 C 3 -3.992188 2.703125 -4.15625 2.359375 -4.15625 C 2.015625 -4.15625 1.722656 -4.007813 1.484375 -3.71875 C 1.242188 -3.425781 1.125 -2.96875 1.125 -2.34375 Z M 1.125 -2.34375 "
+           id="path78" />
+      </g>
+      <g
+         id="glyph-0-27">
+        <path
+           d="M 3.65625 0 L 3.65625 -0.6875 C 3.289063 -0.15625 2.796875 0.109375 2.171875 0.109375 C 1.898438 0.109375 1.644531 0.0546875 1.40625 -0.046875 C 1.164063 -0.160156 0.984375 -0.296875 0.859375 -0.453125 C 0.742188 -0.609375 0.664063 -0.800781 0.625 -1.03125 C 0.59375 -1.1875 0.578125 -1.4375 0.578125 -1.78125 L 0.578125 -4.671875 L 1.359375 -4.671875 L 1.359375 -2.078125 C 1.359375 -1.660156 1.378906 -1.382813 1.421875 -1.25 C 1.460938 -1.039063 1.5625 -0.875 1.71875 -0.75 C 1.882813 -0.632813 2.085938 -0.578125 2.328125 -0.578125 C 2.566406 -0.578125 2.789063 -0.632813 3 -0.75 C 3.207031 -0.875 3.351563 -1.039063 3.4375 -1.25 C 3.519531 -1.457031 3.5625 -1.765625 3.5625 -2.171875 L 3.5625 -4.671875 L 4.359375 -4.671875 L 4.359375 0 Z M 3.65625 0 "
+           id="path81" />
+      </g>
+      <g
+         id="glyph-0-28">
+        <path
+           d="M 3.640625 -1.703125 L 4.421875 -1.609375 C 4.335938 -1.066406 4.117188 -0.644531 3.765625 -0.34375 C 3.410156 -0.0390625 2.976563 0.109375 2.46875 0.109375 C 1.832031 0.109375 1.320313 -0.0976563 0.9375 -0.515625 C 0.550781 -0.929688 0.359375 -1.53125 0.359375 -2.3125 C 0.359375 -2.820313 0.441406 -3.265625 0.609375 -3.640625 C 0.773438 -4.015625 1.023438 -4.296875 1.359375 -4.484375 C 1.703125 -4.671875 2.078125 -4.765625 2.484375 -4.765625 C 2.984375 -4.765625 3.394531 -4.632813 3.71875 -4.375 C 4.039063 -4.125 4.25 -3.765625 4.34375 -3.296875 L 3.578125 -3.171875 C 3.503906 -3.484375 3.375 -3.71875 3.1875 -3.875 C 3 -4.039063 2.773438 -4.125 2.515625 -4.125 C 2.109375 -4.125 1.78125 -3.976563 1.53125 -3.6875 C 1.289063 -3.40625 1.171875 -2.957031 1.171875 -2.34375 C 1.171875 -1.707031 1.289063 -1.25 1.53125 -0.96875 C 1.769531 -0.6875 2.082031 -0.546875 2.46875 -0.546875 C 2.78125 -0.546875 3.039063 -0.640625 3.25 -0.828125 C 3.457031 -1.015625 3.585938 -1.304688 3.640625 -1.703125 Z M 3.640625 -1.703125 "
+           id="path84" />
+      </g>
+      <g
+         id="glyph-0-29">
+        <path
+           d="M 0.59375 0 L 0.59375 -6.4375 L 1.390625 -6.4375 L 1.390625 -2.765625 L 3.265625 -4.671875 L 4.28125 -4.671875 L 2.5 -2.9375 L 4.46875 0 L 3.484375 0 L 1.953125 -2.390625 L 1.390625 -1.84375 L 1.390625 0 Z M 0.59375 0 "
+           id="path87" />
+      </g>
+      <g
+         id="glyph-0-30">
+        <path
+           d="M 0.640625 -4.15625 L 0.40625 -5.390625 L 0.40625 -6.4375 L 1.3125 -6.4375 L 1.3125 -5.390625 L 1.109375 -4.15625 Z M 2.09375 -4.15625 L 1.875 -5.390625 L 1.875 -6.4375 L 2.765625 -6.4375 L 2.765625 -5.390625 L 2.5625 -4.15625 Z M 2.09375 -4.15625 "
+           id="path90" />
+      </g>
+      <g
+         id="glyph-0-31">
+        <path
+           d="M 0.171875 0 L 0.171875 -0.640625 L 3.140625 -4.046875 C 2.804688 -4.035156 2.507813 -4.03125 2.25 -4.03125 L 0.359375 -4.03125 L 0.359375 -4.671875 L 4.171875 -4.671875 L 4.171875 -4.140625 L 1.640625 -1.1875 L 1.15625 -0.640625 C 1.507813 -0.671875 1.84375 -0.6875 2.15625 -0.6875 L 4.3125 -0.6875 L 4.3125 0 Z M 0.171875 0 "
+           id="path93" />
+      </g>
+      <g
+         id="glyph-0-32">
+        <path
+           d="M 1.328125 0 L 0.59375 0 L 0.59375 -6.4375 L 1.375 -6.4375 L 1.375 -4.140625 C 1.707031 -4.554688 2.132813 -4.765625 2.65625 -4.765625 C 2.945313 -4.765625 3.21875 -4.707031 3.46875 -4.59375 C 3.726563 -4.476563 3.941406 -4.316406 4.109375 -4.109375 C 4.273438 -3.898438 4.40625 -3.644531 4.5 -3.34375 C 4.59375 -3.050781 4.640625 -2.738281 4.640625 -2.40625 C 4.640625 -1.601563 4.441406 -0.984375 4.046875 -0.546875 C 3.648438 -0.109375 3.175781 0.109375 2.625 0.109375 C 2.070313 0.109375 1.640625 -0.117188 1.328125 -0.578125 Z M 1.3125 -2.375 C 1.3125 -1.8125 1.390625 -1.40625 1.546875 -1.15625 C 1.796875 -0.75 2.128906 -0.546875 2.546875 -0.546875 C 2.898438 -0.546875 3.203125 -0.695313 3.453125 -1 C 3.703125 -1.300781 3.828125 -1.75 3.828125 -2.34375 C 3.828125 -2.945313 3.707031 -3.394531 3.46875 -3.6875 C 3.226563 -3.976563 2.9375 -4.125 2.59375 -4.125 C 2.238281 -4.125 1.9375 -3.972656 1.6875 -3.671875 C 1.4375 -3.367188 1.3125 -2.9375 1.3125 -2.375 Z M 1.3125 -2.375 "
+           id="path96" />
+      </g>
+      <g
+         id="glyph-0-33">
+        <path
+           d="M 0.8125 0 L 0.8125 -0.90625 L 1.71875 -0.90625 L 1.71875 0 Z M 0.8125 0 "
+           id="path99" />
+      </g>
+      <g
+         id="glyph-0-34">
+        <path
+           d="M 2.53125 0 L 0.046875 -6.4375 L 0.96875 -6.4375 L 2.640625 -1.765625 C 2.773438 -1.390625 2.882813 -1.035156 2.96875 -0.703125 C 3.070313 -1.054688 3.191406 -1.410156 3.328125 -1.765625 L 5.0625 -6.4375 L 5.9375 -6.4375 L 3.40625 0 Z M 2.53125 0 "
+           id="path102" />
+      </g>
+      <g
+         id="glyph-0-35">
+        <path
+           d="M 0.78125 0 L 0.78125 -4.046875 L 0.078125 -4.046875 L 0.078125 -4.671875 L 0.78125 -4.671875 L 0.78125 -5.15625 C 0.78125 -5.476563 0.804688 -5.710938 0.859375 -5.859375 C 0.941406 -6.066406 1.078125 -6.234375 1.265625 -6.359375 C 1.460938 -6.484375 1.734375 -6.546875 2.078125 -6.546875 C 2.296875 -6.546875 2.539063 -6.519531 2.8125 -6.46875 L 2.6875 -5.78125 C 2.53125 -5.8125 2.378906 -5.828125 2.234375 -5.828125 C 1.992188 -5.828125 1.820313 -5.773438 1.71875 -5.671875 C 1.613281 -5.566406 1.5625 -5.375 1.5625 -5.09375 L 1.5625 -4.671875 L 2.484375 -4.671875 L 2.484375 -4.046875 L 1.5625 -4.046875 L 1.5625 0 Z M 0.78125 0 "
+           id="path105" />
+      </g>
+      <g
+         id="glyph-0-36">
+        <path
+           d="M 0.5625 1.796875 L 0.46875 1.0625 C 0.644531 1.101563 0.796875 1.125 0.921875 1.125 C 1.097656 1.125 1.238281 1.09375 1.34375 1.03125 C 1.445313 0.976563 1.535156 0.898438 1.609375 0.796875 C 1.648438 0.710938 1.726563 0.515625 1.84375 0.203125 C 1.863281 0.160156 1.890625 0.0976563 1.921875 0.015625 L 0.140625 -4.671875 L 1 -4.671875 L 1.96875 -1.96875 C 2.09375 -1.625 2.207031 -1.265625 2.3125 -0.890625 C 2.394531 -1.242188 2.5 -1.597656 2.625 -1.953125 L 3.625 -4.671875 L 4.421875 -4.671875 L 2.640625 0.078125 C 2.453125 0.585938 2.304688 0.941406 2.203125 1.140625 C 2.054688 1.398438 1.894531 1.585938 1.71875 1.703125 C 1.539063 1.828125 1.320313 1.890625 1.0625 1.890625 C 0.914063 1.890625 0.75 1.859375 0.5625 1.796875 Z M 0.5625 1.796875 "
+           id="path108" />
+      </g>
+      <g
+         id="glyph-0-37">
+        <path
+           d="M 2.046875 -5.25 L 1.40625 -5.25 L 0.390625 -6.484375 L 1.453125 -6.484375 Z M 2.046875 -5.25 "
+           id="path111" />
+      </g>
+      <g
+         id="glyph-0-38">
+        <path
+           d="M -0.015625 0 L 2.46875 -6.4375 L 3.375 -6.4375 L 6.015625 0 L 5.046875 0 L 4.296875 -1.953125 L 1.59375 -1.953125 L 0.890625 0 Z M 1.84375 -2.640625 L 4.03125 -2.640625 L 3.359375 -4.4375 C 3.148438 -4.976563 3 -5.421875 2.90625 -5.765625 C 2.820313 -5.347656 2.703125 -4.9375 2.546875 -4.53125 Z M 1.84375 -2.640625 "
+           id="path114" />
+      </g>
+      <g
+         id="glyph-0-39">
+        <path
+           d="M 0.6875 0 L 0.6875 -6.4375 L 1.5625 -6.4375 L 4.9375 -1.390625 L 4.9375 -6.4375 L 5.765625 -6.4375 L 5.765625 0 L 4.890625 0 L 1.5 -5.0625 L 1.5 0 Z M 0.6875 0 "
+           id="path117" />
+      </g>
+      <g
+         id="glyph-0-40">
+        <path
+           d="M 0 0.109375 L 1.875 -6.546875 L 2.5 -6.546875 L 0.640625 0.109375 Z M 0 0.109375 "
+           id="path120" />
+      </g>
+      <g
+         id="glyph-0-41">
+        <path
+           d="M 0.703125 0 L 0.703125 -6.4375 L 3.5625 -6.4375 C 4.132813 -6.4375 4.570313 -6.378906 4.875 -6.265625 C 5.175781 -6.148438 5.414063 -5.945313 5.59375 -5.65625 C 5.769531 -5.363281 5.859375 -5.039063 5.859375 -4.6875 C 5.859375 -4.226563 5.707031 -3.84375 5.40625 -3.53125 C 5.113281 -3.21875 4.660156 -3.019531 4.046875 -2.9375 C 4.265625 -2.820313 4.4375 -2.710938 4.5625 -2.609375 C 4.8125 -2.378906 5.046875 -2.09375 5.265625 -1.75 L 6.390625 0 L 5.3125 0 L 4.453125 -1.34375 C 4.210938 -1.726563 4.007813 -2.019531 3.84375 -2.21875 C 3.6875 -2.425781 3.539063 -2.570313 3.40625 -2.65625 C 3.28125 -2.738281 3.15625 -2.796875 3.03125 -2.828125 C 2.925781 -2.847656 2.765625 -2.859375 2.546875 -2.859375 L 1.5625 -2.859375 L 1.5625 0 Z M 1.5625 -3.59375 L 3.390625 -3.59375 C 3.785156 -3.59375 4.09375 -3.632813 4.3125 -3.71875 C 4.53125 -3.800781 4.695313 -3.929688 4.8125 -4.109375 C 4.925781 -4.285156 4.984375 -4.476563 4.984375 -4.6875 C 4.984375 -4.988281 4.867188 -5.238281 4.640625 -5.4375 C 4.421875 -5.632813 4.070313 -5.734375 3.59375 -5.734375 L 1.5625 -5.734375 Z M 1.5625 -3.59375 "
+           id="path123" />
+      </g>
+      <g
+         id="glyph-0-42">
+        <path
+           d="M 0.71875 0 L 0.71875 -6.4375 L 1.578125 -6.4375 L 1.578125 -3.796875 L 4.921875 -3.796875 L 4.921875 -6.4375 L 5.78125 -6.4375 L 5.78125 0 L 4.921875 0 L 4.921875 -3.03125 L 1.578125 -3.03125 L 1.578125 0 Z M 0.71875 0 "
+           id="path126" />
+      </g>
+      <g
+         id="glyph-0-43">
+        <path
+           d="M 3.359375 0 L 2.5625 0 L 2.5625 -5.046875 C 2.375 -4.859375 2.125 -4.671875 1.8125 -4.484375 C 1.5 -4.304688 1.222656 -4.175781 0.984375 -4.09375 L 0.984375 -4.859375 C 1.421875 -5.054688 1.804688 -5.300781 2.140625 -5.59375 C 2.472656 -5.894531 2.707031 -6.1875 2.84375 -6.46875 L 3.359375 -6.46875 Z M 3.359375 0 "
+           id="path129" />
+      </g>
+      <g
+         id="glyph-0-44">
+        <path
+           d="M 0.65625 0 L 0.65625 -6.4375 L 1.515625 -6.4375 L 1.515625 -0.765625 L 4.6875 -0.765625 L 4.6875 0 Z M 0.65625 0 "
+           id="path132" />
+      </g>
+      <g
+         id="glyph-0-45">
+        <path
+           d="M 0.796875 0 L 0.796875 -0.90625 L 1.703125 -0.90625 L 1.703125 0 C 1.703125 0.332031 1.640625 0.597656 1.515625 0.796875 C 1.398438 1.003906 1.21875 1.164063 0.96875 1.28125 L 0.75 0.9375 C 0.914063 0.863281 1.035156 0.753906 1.109375 0.609375 C 1.191406 0.472656 1.238281 0.269531 1.25 0 Z M 0.796875 0 "
+           id="path135" />
+      </g>
+      <g
+         id="glyph-0-46">
+        <path
+           d="M 4.53125 -0.765625 L 4.53125 0 L 0.265625 0 C 0.265625 -0.1875 0.296875 -0.367188 0.359375 -0.546875 C 0.472656 -0.835938 0.648438 -1.125 0.890625 -1.40625 C 1.128906 -1.6875 1.472656 -2.007813 1.921875 -2.375 C 2.617188 -2.957031 3.085938 -3.414063 3.328125 -3.75 C 3.578125 -4.082031 3.703125 -4.398438 3.703125 -4.703125 C 3.703125 -5.015625 3.585938 -5.273438 3.359375 -5.484375 C 3.140625 -5.703125 2.851563 -5.8125 2.5 -5.8125 C 2.113281 -5.8125 1.804688 -5.695313 1.578125 -5.46875 C 1.347656 -5.238281 1.234375 -4.921875 1.234375 -4.515625 L 0.421875 -4.609375 C 0.472656 -5.210938 0.679688 -5.671875 1.046875 -5.984375 C 1.410156 -6.304688 1.898438 -6.46875 2.515625 -6.46875 C 3.128906 -6.46875 3.613281 -6.296875 3.96875 -5.953125 C 4.332031 -5.609375 4.515625 -5.1875 4.515625 -4.6875 C 4.515625 -4.425781 4.460938 -4.171875 4.359375 -3.921875 C 4.253906 -3.671875 4.078125 -3.40625 3.828125 -3.125 C 3.585938 -2.851563 3.1875 -2.476563 2.625 -2 C 2.144531 -1.601563 1.835938 -1.332031 1.703125 -1.1875 C 1.566406 -1.039063 1.457031 -0.898438 1.375 -0.765625 Z M 4.53125 -0.765625 "
+           id="path138" />
+      </g>
+      <g
+         id="glyph-0-47">
+        <path
+           d="M 0.375 -1.703125 L 1.171875 -1.8125 C 1.265625 -1.363281 1.414063 -1.039063 1.625 -0.84375 C 1.84375 -0.644531 2.113281 -0.546875 2.4375 -0.546875 C 2.800781 -0.546875 3.109375 -0.671875 3.359375 -0.921875 C 3.617188 -1.179688 3.75 -1.503906 3.75 -1.890625 C 3.75 -2.253906 3.628906 -2.550781 3.390625 -2.78125 C 3.160156 -3.019531 2.863281 -3.140625 2.5 -3.140625 C 2.34375 -3.140625 2.15625 -3.109375 1.9375 -3.046875 L 2.03125 -3.75 C 2.082031 -3.738281 2.125 -3.734375 2.15625 -3.734375 C 2.488281 -3.734375 2.789063 -3.820313 3.0625 -4 C 3.332031 -4.175781 3.46875 -4.445313 3.46875 -4.8125 C 3.46875 -5.101563 3.367188 -5.34375 3.171875 -5.53125 C 2.972656 -5.71875 2.71875 -5.8125 2.40625 -5.8125 C 2.101563 -5.8125 1.847656 -5.710938 1.640625 -5.515625 C 1.441406 -5.328125 1.3125 -5.039063 1.25 -4.65625 L 0.453125 -4.796875 C 0.554688 -5.328125 0.773438 -5.738281 1.109375 -6.03125 C 1.453125 -6.320313 1.878906 -6.46875 2.390625 -6.46875 C 2.742188 -6.46875 3.066406 -6.390625 3.359375 -6.234375 C 3.660156 -6.085938 3.890625 -5.882813 4.046875 -5.625 C 4.203125 -5.363281 4.28125 -5.085938 4.28125 -4.796875 C 4.28125 -4.515625 4.203125 -4.257813 4.046875 -4.03125 C 3.898438 -3.800781 3.679688 -3.617188 3.390625 -3.484375 C 3.773438 -3.398438 4.070313 -3.21875 4.28125 -2.9375 C 4.488281 -2.664063 4.59375 -2.320313 4.59375 -1.90625 C 4.59375 -1.34375 4.382813 -0.863281 3.96875 -0.46875 C 3.5625 -0.0820313 3.046875 0.109375 2.421875 0.109375 C 1.859375 0.109375 1.390625 -0.0546875 1.015625 -0.390625 C 0.640625 -0.722656 0.425781 -1.160156 0.375 -1.703125 Z M 0.375 -1.703125 "
+           id="path141" />
+      </g>
+      <g
+         id="glyph-0-48">
+        <path
+           d="M 0.0625 0 L 1.765625 -2.421875 L 0.1875 -4.671875 L 1.1875 -4.671875 L 1.90625 -3.578125 C 2.03125 -3.367188 2.132813 -3.191406 2.21875 -3.046875 C 2.351563 -3.242188 2.472656 -3.414063 2.578125 -3.5625 L 3.359375 -4.671875 L 4.3125 -4.671875 L 2.703125 -2.46875 L 4.4375 0 L 3.46875 0 L 2.5 -1.453125 L 2.25 -1.84375 L 1.03125 0 Z M 0.0625 0 "
+           id="path144" />
+      </g>
+      <g
+         id="glyph-0-49">
+        <path
+           d="M 4.484375 -4.859375 L 3.6875 -4.796875 C 3.625 -5.109375 3.523438 -5.335938 3.390625 -5.484375 C 3.179688 -5.703125 2.921875 -5.8125 2.609375 -5.8125 C 2.347656 -5.8125 2.125 -5.742188 1.9375 -5.609375 C 1.6875 -5.421875 1.488281 -5.15625 1.34375 -4.8125 C 1.207031 -4.46875 1.132813 -3.972656 1.125 -3.328125 C 1.3125 -3.609375 1.539063 -3.816406 1.8125 -3.953125 C 2.09375 -4.097656 2.382813 -4.171875 2.6875 -4.171875 C 3.21875 -4.171875 3.664063 -3.976563 4.03125 -3.59375 C 4.40625 -3.207031 4.59375 -2.707031 4.59375 -2.09375 C 4.59375 -1.6875 4.503906 -1.304688 4.328125 -0.953125 C 4.148438 -0.609375 3.910156 -0.34375 3.609375 -0.15625 C 3.304688 0.0195313 2.960938 0.109375 2.578125 0.109375 C 1.921875 0.109375 1.382813 -0.128906 0.96875 -0.609375 C 0.550781 -1.097656 0.34375 -1.898438 0.34375 -3.015625 C 0.34375 -4.253906 0.570313 -5.160156 1.03125 -5.734375 C 1.425781 -6.222656 1.96875 -6.46875 2.65625 -6.46875 C 3.15625 -6.46875 3.566406 -6.320313 3.890625 -6.03125 C 4.210938 -5.75 4.410156 -5.359375 4.484375 -4.859375 Z M 1.25 -2.09375 C 1.25 -1.8125 1.304688 -1.546875 1.421875 -1.296875 C 1.535156 -1.054688 1.695313 -0.867188 1.90625 -0.734375 C 2.113281 -0.609375 2.332031 -0.546875 2.5625 -0.546875 C 2.894531 -0.546875 3.179688 -0.675781 3.421875 -0.9375 C 3.660156 -1.207031 3.78125 -1.578125 3.78125 -2.046875 C 3.78125 -2.492188 3.660156 -2.84375 3.421875 -3.09375 C 3.191406 -3.351563 2.894531 -3.484375 2.53125 -3.484375 C 2.175781 -3.484375 1.875 -3.351563 1.625 -3.09375 C 1.375 -2.84375 1.25 -2.507813 1.25 -2.09375 Z M 1.25 -2.09375 "
+           id="path147" />
+      </g>
+      <g
+         id="glyph-0-50">
+        <path
+           d="M 0.59375 -5.53125 L 0.59375 -6.4375 L 1.375 -6.4375 L 1.375 -5.53125 Z M -0.40625 1.8125 L -0.265625 1.140625 C -0.109375 1.179688 0.015625 1.203125 0.109375 1.203125 C 0.273438 1.203125 0.394531 1.144531 0.46875 1.03125 C 0.550781 0.925781 0.59375 0.660156 0.59375 0.234375 L 0.59375 -4.671875 L 1.375 -4.671875 L 1.375 0.25 C 1.375 0.820313 1.300781 1.222656 1.15625 1.453125 C 0.96875 1.742188 0.648438 1.890625 0.203125 1.890625 C -0.00390625 1.890625 -0.207031 1.863281 -0.40625 1.8125 Z M -0.40625 1.8125 "
+           id="path150" />
+      </g>
+      <g
+         id="glyph-1-0">
+        <path
+           d="M 1.03125 0 L 1.03125 -5.15625 L 5.15625 -5.15625 L 5.15625 0 Z M 1.15625 -0.125 L 5.03125 -0.125 L 5.03125 -5.03125 L 1.15625 -5.03125 Z M 1.15625 -0.125 "
+           id="path153" />
+      </g>
+      <g
+         id="glyph-1-1">
+        <path
+           d="M 4.515625 -5.90625 L 5.296875 -5.90625 L 5.296875 -2.5 C 5.296875 -1.90625 5.226563 -1.429688 5.09375 -1.078125 C 4.957031 -0.734375 4.710938 -0.453125 4.359375 -0.234375 C 4.015625 -0.015625 3.554688 0.09375 2.984375 0.09375 C 2.429688 0.09375 1.976563 0 1.625 -0.1875 C 1.269531 -0.375 1.019531 -0.648438 0.875 -1.015625 C 0.726563 -1.378906 0.65625 -1.875 0.65625 -2.5 L 0.65625 -5.90625 L 1.4375 -5.90625 L 1.4375 -2.5 C 1.4375 -1.988281 1.484375 -1.609375 1.578125 -1.359375 C 1.671875 -1.117188 1.832031 -0.929688 2.0625 -0.796875 C 2.289063 -0.671875 2.578125 -0.609375 2.921875 -0.609375 C 3.492188 -0.609375 3.898438 -0.738281 4.140625 -1 C 4.390625 -1.257813 4.515625 -1.757813 4.515625 -2.5 Z M 4.515625 -5.90625 "
+           id="path156" />
+      </g>
+      <g
+         id="glyph-1-2">
+        <path
+           d="M 0.25 -1.28125 L 0.96875 -1.390625 C 1.007813 -1.097656 1.117188 -0.875 1.296875 -0.71875 C 1.484375 -0.570313 1.742188 -0.5 2.078125 -0.5 C 2.410156 -0.5 2.65625 -0.566406 2.8125 -0.703125 C 2.976563 -0.835938 3.0625 -1 3.0625 -1.1875 C 3.0625 -1.34375 2.988281 -1.46875 2.84375 -1.5625 C 2.75 -1.625 2.503906 -1.707031 2.109375 -1.8125 C 1.578125 -1.945313 1.207031 -2.0625 1 -2.15625 C 0.789063 -2.257813 0.632813 -2.394531 0.53125 -2.5625 C 0.425781 -2.738281 0.375 -2.929688 0.375 -3.140625 C 0.375 -3.328125 0.414063 -3.503906 0.5 -3.671875 C 0.59375 -3.835938 0.710938 -3.972656 0.859375 -4.078125 C 0.972656 -4.160156 1.125 -4.226563 1.3125 -4.28125 C 1.507813 -4.34375 1.722656 -4.375 1.953125 -4.375 C 2.285156 -4.375 2.578125 -4.320313 2.828125 -4.21875 C 3.085938 -4.125 3.273438 -3.992188 3.390625 -3.828125 C 3.515625 -3.671875 3.597656 -3.453125 3.640625 -3.171875 L 2.9375 -3.078125 C 2.90625 -3.296875 2.8125 -3.46875 2.65625 -3.59375 C 2.5 -3.71875 2.28125 -3.78125 2 -3.78125 C 1.664063 -3.78125 1.425781 -3.722656 1.28125 -3.609375 C 1.144531 -3.503906 1.078125 -3.378906 1.078125 -3.234375 C 1.078125 -3.128906 1.109375 -3.039063 1.171875 -2.96875 C 1.222656 -2.894531 1.3125 -2.832031 1.4375 -2.78125 C 1.507813 -2.75 1.722656 -2.6875 2.078125 -2.59375 C 2.597656 -2.457031 2.957031 -2.34375 3.15625 -2.25 C 3.351563 -2.164063 3.507813 -2.039063 3.625 -1.875 C 3.75 -1.707031 3.8125 -1.5 3.8125 -1.25 C 3.8125 -1.007813 3.738281 -0.78125 3.59375 -0.5625 C 3.457031 -0.351563 3.253906 -0.191406 2.984375 -0.078125 C 2.722656 0.0351563 2.421875 0.09375 2.078125 0.09375 C 1.523438 0.09375 1.101563 -0.0195313 0.8125 -0.25 C 0.519531 -0.476563 0.332031 -0.820313 0.25 -1.28125 Z M 0.25 -1.28125 "
+           id="path159" />
+      </g>
+      <g
+         id="glyph-1-3">
+        <path
+           d="M 3.46875 -1.375 L 4.21875 -1.28125 C 4.101563 -0.84375 3.882813 -0.503906 3.5625 -0.265625 C 3.238281 -0.0234375 2.832031 0.09375 2.34375 0.09375 C 1.71875 0.09375 1.21875 -0.0976563 0.84375 -0.484375 C 0.476563 -0.867188 0.296875 -1.410156 0.296875 -2.109375 C 0.296875 -2.828125 0.476563 -3.382813 0.84375 -3.78125 C 1.21875 -4.175781 1.703125 -4.375 2.296875 -4.375 C 2.867188 -4.375 3.335938 -4.175781 3.703125 -3.78125 C 4.066406 -3.394531 4.25 -2.847656 4.25 -2.140625 C 4.25 -2.097656 4.242188 -2.035156 4.234375 -1.953125 L 1.046875 -1.953125 C 1.078125 -1.484375 1.210938 -1.125 1.453125 -0.875 C 1.691406 -0.625 1.988281 -0.5 2.34375 -0.5 C 2.613281 -0.5 2.84375 -0.566406 3.03125 -0.703125 C 3.21875 -0.847656 3.363281 -1.070313 3.46875 -1.375 Z M 1.09375 -2.546875 L 3.484375 -2.546875 C 3.453125 -2.910156 3.359375 -3.179688 3.203125 -3.359375 C 2.972656 -3.640625 2.675781 -3.78125 2.3125 -3.78125 C 1.976563 -3.78125 1.695313 -3.664063 1.46875 -3.4375 C 1.238281 -3.21875 1.113281 -2.921875 1.09375 -2.546875 Z M 1.09375 -2.546875 "
+           id="path162" />
+      </g>
+      <g
+         id="glyph-1-4">
+        <path
+           d="M 0.53125 0 L 0.53125 -4.28125 L 1.1875 -4.28125 L 1.1875 -3.625 C 1.351563 -3.925781 1.503906 -4.125 1.640625 -4.21875 C 1.785156 -4.320313 1.941406 -4.375 2.109375 -4.375 C 2.359375 -4.375 2.609375 -4.296875 2.859375 -4.140625 L 2.609375 -3.46875 C 2.429688 -3.570313 2.253906 -3.625 2.078125 -3.625 C 1.921875 -3.625 1.78125 -3.578125 1.65625 -3.484375 C 1.53125 -3.390625 1.4375 -3.253906 1.375 -3.078125 C 1.300781 -2.828125 1.265625 -2.546875 1.265625 -2.234375 L 1.265625 0 Z M 0.53125 0 "
+           id="path165" />
+      </g>
+      <g
+         id="glyph-1-5" />
+      <g
+         id="glyph-1-6">
+        <path
+           d="M 3.328125 -1.5625 L 4.046875 -1.46875 C 3.972656 -0.976563 3.773438 -0.59375 3.453125 -0.3125 C 3.128906 -0.0390625 2.734375 0.09375 2.265625 0.09375 C 1.679688 0.09375 1.210938 -0.09375 0.859375 -0.46875 C 0.503906 -0.851563 0.328125 -1.40625 0.328125 -2.125 C 0.328125 -2.582031 0.398438 -2.984375 0.546875 -3.328125 C 0.703125 -3.679688 0.9375 -3.941406 1.25 -4.109375 C 1.5625 -4.285156 1.898438 -4.375 2.265625 -4.375 C 2.734375 -4.375 3.113281 -4.253906 3.40625 -4.015625 C 3.707031 -3.785156 3.898438 -3.453125 3.984375 -3.015625 L 3.28125 -2.90625 C 3.207031 -3.195313 3.082031 -3.414063 2.90625 -3.5625 C 2.738281 -3.707031 2.535156 -3.78125 2.296875 -3.78125 C 1.929688 -3.78125 1.632813 -3.648438 1.40625 -3.390625 C 1.175781 -3.128906 1.0625 -2.710938 1.0625 -2.140625 C 1.0625 -1.566406 1.171875 -1.148438 1.390625 -0.890625 C 1.617188 -0.628906 1.910156 -0.5 2.265625 -0.5 C 2.546875 -0.5 2.78125 -0.582031 2.96875 -0.75 C 3.164063 -0.925781 3.285156 -1.195313 3.328125 -1.5625 Z M 3.328125 -1.5625 "
+           id="path169" />
+      </g>
+      <g
+         id="glyph-1-7">
+        <path
+           d="M 0.53125 0 L 0.53125 -5.90625 L 1.25 -5.90625 L 1.25 0 Z M 0.53125 0 "
+           id="path172" />
+      </g>
+      <g
+         id="glyph-1-8">
+        <path
+           d="M 0.546875 -5.078125 L 0.546875 -5.90625 L 1.265625 -5.90625 L 1.265625 -5.078125 Z M 0.546875 0 L 0.546875 -4.28125 L 1.265625 -4.28125 L 1.265625 0 Z M 0.546875 0 "
+           id="path175" />
+      </g>
+      <g
+         id="glyph-1-9">
+        <path
+           d="M 0.546875 0 L 0.546875 -5.90625 L 1.265625 -5.90625 L 1.265625 -2.53125 L 2.984375 -4.28125 L 3.921875 -4.28125 L 2.296875 -2.6875 L 4.09375 0 L 3.203125 0 L 1.78125 -2.1875 L 1.265625 -1.703125 L 1.265625 0 Z M 0.546875 0 "
+           id="path178" />
+      </g>
+      <g
+         id="glyph-1-10">
+        <path
+           d="M 0.578125 -3.8125 L 0.375 -4.9375 L 0.375 -5.90625 L 1.203125 -5.90625 L 1.203125 -4.9375 L 1.015625 -3.8125 Z M 1.90625 -3.8125 L 1.71875 -4.9375 L 1.71875 -5.90625 L 2.546875 -5.90625 L 2.546875 -4.9375 L 2.34375 -3.8125 Z M 1.90625 -3.8125 "
+           id="path181" />
+      </g>
+      <g
+         id="glyph-1-11">
+        <path
+           d="M 0.40625 -2.875 C 0.40625 -3.851563 0.664063 -4.617188 1.1875 -5.171875 C 1.71875 -5.734375 2.398438 -6.015625 3.234375 -6.015625 C 3.773438 -6.015625 4.265625 -5.882813 4.703125 -5.625 C 5.140625 -5.363281 5.472656 -5 5.703125 -4.53125 C 5.929688 -4.0625 6.046875 -3.53125 6.046875 -2.9375 C 6.046875 -2.34375 5.925781 -1.804688 5.6875 -1.328125 C 5.445313 -0.859375 5.101563 -0.503906 4.65625 -0.265625 C 4.207031 -0.0234375 3.726563 0.09375 3.21875 0.09375 C 2.664063 0.09375 2.171875 -0.0351563 1.734375 -0.296875 C 1.296875 -0.566406 0.960938 -0.929688 0.734375 -1.390625 C 0.515625 -1.859375 0.40625 -2.351563 0.40625 -2.875 Z M 1.203125 -2.859375 C 1.203125 -2.148438 1.394531 -1.585938 1.78125 -1.171875 C 2.164063 -0.765625 2.644531 -0.5625 3.21875 -0.5625 C 3.800781 -0.5625 4.28125 -0.769531 4.65625 -1.1875 C 5.039063 -1.601563 5.234375 -2.191406 5.234375 -2.953125 C 5.234375 -3.429688 5.148438 -3.847656 4.984375 -4.203125 C 4.828125 -4.566406 4.59375 -4.847656 4.28125 -5.046875 C 3.96875 -5.242188 3.617188 -5.34375 3.234375 -5.34375 C 2.679688 -5.34375 2.203125 -5.148438 1.796875 -4.765625 C 1.398438 -4.390625 1.203125 -3.753906 1.203125 -2.859375 Z M 1.203125 -2.859375 "
+           id="path184" />
+      </g>
+      <g
+         id="glyph-1-12">
+        <path
+           d="M 0.765625 0 L 0.765625 -5.90625 L 1.546875 -5.90625 L 1.546875 0 Z M 0.765625 0 "
+           id="path187" />
+      </g>
+      <g
+         id="glyph-1-13">
+        <path
+           d="M 0.640625 0 L 0.640625 -5.90625 L 2.671875 -5.90625 C 3.128906 -5.90625 3.476563 -5.878906 3.71875 -5.828125 C 4.0625 -5.742188 4.351563 -5.597656 4.59375 -5.390625 C 4.90625 -5.128906 5.132813 -4.796875 5.28125 -4.390625 C 5.4375 -3.984375 5.515625 -3.515625 5.515625 -2.984375 C 5.515625 -2.535156 5.460938 -2.132813 5.359375 -1.78125 C 5.253906 -1.4375 5.117188 -1.148438 4.953125 -0.921875 C 4.796875 -0.703125 4.617188 -0.523438 4.421875 -0.390625 C 4.222656 -0.265625 3.984375 -0.164063 3.703125 -0.09375 C 3.429688 -0.03125 3.117188 0 2.765625 0 Z M 1.421875 -0.703125 L 2.671875 -0.703125 C 3.066406 -0.703125 3.375 -0.738281 3.59375 -0.8125 C 3.8125 -0.882813 3.988281 -0.984375 4.125 -1.109375 C 4.3125 -1.296875 4.457031 -1.546875 4.5625 -1.859375 C 4.664063 -2.171875 4.71875 -2.550781 4.71875 -3 C 4.71875 -3.613281 4.613281 -4.085938 4.40625 -4.421875 C 4.207031 -4.753906 3.960938 -4.976563 3.671875 -5.09375 C 3.460938 -5.164063 3.125 -5.203125 2.65625 -5.203125 L 1.421875 -5.203125 Z M 1.421875 -0.703125 "
+           id="path190" />
+      </g>
+      <g
+         id="glyph-1-14">
+        <path
+           d="M 4.84375 -2.078125 L 5.625 -1.875 C 5.46875 -1.226563 5.175781 -0.738281 4.75 -0.40625 C 4.320313 -0.0703125 3.800781 0.09375 3.1875 0.09375 C 2.550781 0.09375 2.03125 -0.03125 1.625 -0.28125 C 1.226563 -0.539063 0.925781 -0.914063 0.71875 -1.40625 C 0.507813 -1.90625 0.40625 -2.4375 0.40625 -3 C 0.40625 -3.613281 0.519531 -4.148438 0.75 -4.609375 C 0.988281 -5.066406 1.328125 -5.410156 1.765625 -5.640625 C 2.203125 -5.878906 2.679688 -6 3.203125 -6 C 3.785156 -6 4.28125 -5.847656 4.6875 -5.546875 C 5.09375 -5.253906 5.375 -4.832031 5.53125 -4.28125 L 4.765625 -4.109375 C 4.628906 -4.535156 4.429688 -4.847656 4.171875 -5.046875 C 3.910156 -5.242188 3.582031 -5.34375 3.1875 -5.34375 C 2.726563 -5.34375 2.347656 -5.234375 2.046875 -5.015625 C 1.742188 -4.796875 1.53125 -4.5 1.40625 -4.125 C 1.28125 -3.757813 1.21875 -3.382813 1.21875 -3 C 1.21875 -2.5 1.289063 -2.0625 1.4375 -1.6875 C 1.582031 -1.3125 1.804688 -1.03125 2.109375 -0.84375 C 2.421875 -0.65625 2.757813 -0.5625 3.125 -0.5625 C 3.5625 -0.5625 3.929688 -0.6875 4.234375 -0.9375 C 4.535156 -1.195313 4.738281 -1.578125 4.84375 -2.078125 Z M 4.84375 -2.078125 "
+           id="path193" />
+      </g>
+      <g
+         id="glyph-1-15">
+        <path
+           d="M 0.609375 0 L 0.609375 -5.90625 L 1.390625 -5.90625 L 1.390625 -0.703125 L 4.296875 -0.703125 L 4.296875 0 Z M 0.609375 0 "
+           id="path196" />
+      </g>
+      <g
+         id="glyph-1-16">
+        <path
+           d="M 0.28125 -2.140625 C 0.28125 -2.929688 0.5 -3.519531 0.9375 -3.90625 C 1.300781 -4.21875 1.75 -4.375 2.28125 -4.375 C 2.863281 -4.375 3.34375 -4.179688 3.71875 -3.796875 C 4.09375 -3.410156 4.28125 -2.878906 4.28125 -2.203125 C 4.28125 -1.648438 4.195313 -1.210938 4.03125 -0.890625 C 3.863281 -0.578125 3.625 -0.332031 3.3125 -0.15625 C 3 0.0078125 2.65625 0.09375 2.28125 0.09375 C 1.675781 0.09375 1.191406 -0.0976563 0.828125 -0.484375 C 0.460938 -0.867188 0.28125 -1.421875 0.28125 -2.140625 Z M 1.015625 -2.140625 C 1.015625 -1.585938 1.132813 -1.175781 1.375 -0.90625 C 1.613281 -0.632813 1.914063 -0.5 2.28125 -0.5 C 2.632813 -0.5 2.929688 -0.632813 3.171875 -0.90625 C 3.410156 -1.1875 3.53125 -1.601563 3.53125 -2.15625 C 3.53125 -2.6875 3.410156 -3.085938 3.171875 -3.359375 C 2.929688 -3.640625 2.632813 -3.78125 2.28125 -3.78125 C 1.914063 -3.78125 1.613281 -3.640625 1.375 -3.359375 C 1.132813 -3.085938 1.015625 -2.679688 1.015625 -2.140625 Z M 1.015625 -2.140625 "
+           id="path199" />
+      </g>
+      <g
+         id="glyph-1-17">
+        <path
+           d="M 0.40625 0.359375 L 1.109375 0.453125 C 1.140625 0.671875 1.222656 0.832031 1.359375 0.9375 C 1.535156 1.070313 1.78125 1.140625 2.09375 1.140625 C 2.4375 1.140625 2.695313 1.070313 2.875 0.9375 C 3.0625 0.800781 3.1875 0.613281 3.25 0.375 C 3.28125 0.226563 3.296875 -0.0820313 3.296875 -0.5625 C 2.984375 -0.1875 2.585938 0 2.109375 0 C 1.523438 0 1.070313 -0.207031 0.75 -0.625 C 0.425781 -1.050781 0.265625 -1.5625 0.265625 -2.15625 C 0.265625 -2.570313 0.335938 -2.953125 0.484375 -3.296875 C 0.628906 -3.640625 0.84375 -3.90625 1.125 -4.09375 C 1.40625 -4.28125 1.738281 -4.375 2.125 -4.375 C 2.625 -4.375 3.039063 -4.171875 3.375 -3.765625 L 3.375 -4.28125 L 4.03125 -4.28125 L 4.03125 -0.578125 C 4.03125 0.0859375 3.960938 0.554688 3.828125 0.828125 C 3.691406 1.109375 3.476563 1.328125 3.1875 1.484375 C 2.894531 1.648438 2.535156 1.734375 2.109375 1.734375 C 1.597656 1.734375 1.179688 1.617188 0.859375 1.390625 C 0.546875 1.160156 0.394531 0.816406 0.40625 0.359375 Z M 1.015625 -2.21875 C 1.015625 -1.65625 1.125 -1.242188 1.34375 -0.984375 C 1.570313 -0.722656 1.851563 -0.59375 2.1875 -0.59375 C 2.519531 -0.59375 2.796875 -0.722656 3.015625 -0.984375 C 3.242188 -1.242188 3.359375 -1.644531 3.359375 -2.1875 C 3.359375 -2.71875 3.238281 -3.113281 3 -3.375 C 2.769531 -3.644531 2.492188 -3.78125 2.171875 -3.78125 C 1.847656 -3.78125 1.570313 -3.644531 1.34375 -3.375 C 1.125 -3.113281 1.015625 -2.726563 1.015625 -2.21875 Z M 1.015625 -2.21875 "
+           id="path202" />
+      </g>
+      <g
+         id="glyph-1-18">
+        <path
+           d="M 0.546875 0 L 0.546875 -4.28125 L 1.203125 -4.28125 L 1.203125 -3.671875 C 1.515625 -4.140625 1.96875 -4.375 2.5625 -4.375 C 2.8125 -4.375 3.046875 -4.328125 3.265625 -4.234375 C 3.484375 -4.140625 3.644531 -4.015625 3.75 -3.859375 C 3.863281 -3.710938 3.941406 -3.535156 3.984375 -3.328125 C 4.003906 -3.203125 4.015625 -2.96875 4.015625 -2.625 L 4.015625 0 L 3.296875 0 L 3.296875 -2.609375 C 3.296875 -2.898438 3.265625 -3.117188 3.203125 -3.265625 C 3.148438 -3.410156 3.050781 -3.523438 2.90625 -3.609375 C 2.757813 -3.703125 2.59375 -3.75 2.40625 -3.75 C 2.09375 -3.75 1.820313 -3.648438 1.59375 -3.453125 C 1.375 -3.253906 1.265625 -2.882813 1.265625 -2.34375 L 1.265625 0 Z M 0.546875 0 "
+           id="path205" />
+      </g>
+      <g
+         id="glyph-1-19">
+        <path
+           d="M 3.40625 -2.3125 L 3.40625 -3.015625 L 5.90625 -3.015625 L 5.90625 -0.828125 C 5.519531 -0.515625 5.117188 -0.28125 4.703125 -0.125 C 4.296875 0.0195313 3.878906 0.09375 3.453125 0.09375 C 2.878906 0.09375 2.351563 -0.0234375 1.875 -0.265625 C 1.40625 -0.515625 1.046875 -0.875 0.796875 -1.34375 C 0.554688 -1.8125 0.4375 -2.335938 0.4375 -2.921875 C 0.4375 -3.492188 0.554688 -4.03125 0.796875 -4.53125 C 1.035156 -5.03125 1.378906 -5.398438 1.828125 -5.640625 C 2.285156 -5.878906 2.804688 -6 3.390625 -6 C 3.816406 -6 4.203125 -5.929688 4.546875 -5.796875 C 4.898438 -5.660156 5.171875 -5.46875 5.359375 -5.21875 C 5.554688 -4.96875 5.707031 -4.644531 5.8125 -4.25 L 5.109375 -4.0625 C 5.015625 -4.363281 4.898438 -4.597656 4.765625 -4.765625 C 4.640625 -4.941406 4.453125 -5.082031 4.203125 -5.1875 C 3.960938 -5.289063 3.695313 -5.34375 3.40625 -5.34375 C 3.039063 -5.34375 2.726563 -5.285156 2.46875 -5.171875 C 2.207031 -5.066406 2 -4.925781 1.84375 -4.75 C 1.6875 -4.570313 1.5625 -4.375 1.46875 -4.15625 C 1.320313 -3.789063 1.25 -3.394531 1.25 -2.96875 C 1.25 -2.445313 1.335938 -2.007813 1.515625 -1.65625 C 1.691406 -1.300781 1.953125 -1.035156 2.296875 -0.859375 C 2.648438 -0.691406 3.019531 -0.609375 3.40625 -0.609375 C 3.75 -0.609375 4.082031 -0.671875 4.40625 -0.796875 C 4.726563 -0.929688 4.972656 -1.070313 5.140625 -1.21875 L 5.140625 -2.3125 Z M 3.40625 -2.3125 "
+           id="path208" />
+      </g>
+      <g
+         id="glyph-1-20">
+        <path
+           d="M 0.65625 0 L 0.65625 -5.90625 L 4.921875 -5.90625 L 4.921875 -5.203125 L 1.4375 -5.203125 L 1.4375 -3.40625 L 4.703125 -3.40625 L 4.703125 -2.703125 L 1.4375 -2.703125 L 1.4375 -0.703125 L 5.0625 -0.703125 L 5.0625 0 Z M 0.65625 0 "
+           id="path211" />
+      </g>
+      <g
+         id="glyph-1-21">
+        <path
+           d="M 2.140625 0 L 2.140625 -5.203125 L 0.1875 -5.203125 L 0.1875 -5.90625 L 4.875 -5.90625 L 4.875 -5.203125 L 2.921875 -5.203125 L 2.921875 0 Z M 2.140625 0 "
+           id="path214" />
+      </g>
+      <g
+         id="glyph-1-22">
+        <path
+           d="M 0.546875 0 L 0.546875 -5.90625 L 1.265625 -5.90625 L 1.265625 -3.78125 C 1.609375 -4.175781 2.035156 -4.375 2.546875 -4.375 C 2.867188 -4.375 3.144531 -4.3125 3.375 -4.1875 C 3.601563 -4.0625 3.769531 -3.890625 3.875 -3.671875 C 3.976563 -3.453125 4.03125 -3.132813 4.03125 -2.71875 L 4.03125 0 L 3.296875 0 L 3.296875 -2.71875 C 3.296875 -3.070313 3.21875 -3.332031 3.0625 -3.5 C 2.90625 -3.664063 2.6875 -3.75 2.40625 -3.75 C 2.1875 -3.75 1.984375 -3.691406 1.796875 -3.578125 C 1.609375 -3.472656 1.472656 -3.320313 1.390625 -3.125 C 1.304688 -2.9375 1.265625 -2.675781 1.265625 -2.34375 L 1.265625 0 Z M 0.546875 0 "
+           id="path217" />
+      </g>
+      <g
+         id="glyph-1-23">
+        <path
+           d="M 2.125 -0.65625 L 2.234375 -0.015625 C 2.023438 0.0351563 1.84375 0.0625 1.6875 0.0625 C 1.425781 0.0625 1.222656 0.0195313 1.078125 -0.0625 C 0.929688 -0.144531 0.828125 -0.253906 0.765625 -0.390625 C 0.703125 -0.523438 0.671875 -0.8125 0.671875 -1.25 L 0.671875 -3.71875 L 0.140625 -3.71875 L 0.140625 -4.28125 L 0.671875 -4.28125 L 0.671875 -5.34375 L 1.390625 -5.765625 L 1.390625 -4.28125 L 2.125 -4.28125 L 2.125 -3.71875 L 1.390625 -3.71875 L 1.390625 -1.21875 C 1.390625 -1.007813 1.398438 -0.875 1.421875 -0.8125 C 1.453125 -0.75 1.492188 -0.703125 1.546875 -0.671875 C 1.609375 -0.640625 1.695313 -0.625 1.8125 -0.625 C 1.882813 -0.625 1.988281 -0.632813 2.125 -0.65625 Z M 2.125 -0.65625 "
+           id="path220" />
+      </g>
+      <g
+         id="glyph-1-24">
+        <path
+           d="M 0.546875 1.640625 L 0.546875 -4.28125 L 1.203125 -4.28125 L 1.203125 -3.71875 C 1.359375 -3.9375 1.535156 -4.097656 1.734375 -4.203125 C 1.929688 -4.316406 2.164063 -4.375 2.4375 -4.375 C 2.8125 -4.375 3.132813 -4.28125 3.40625 -4.09375 C 3.6875 -3.90625 3.898438 -3.640625 4.046875 -3.296875 C 4.191406 -2.953125 4.265625 -2.578125 4.265625 -2.171875 C 4.265625 -1.734375 4.179688 -1.335938 4.015625 -0.984375 C 3.859375 -0.640625 3.628906 -0.375 3.328125 -0.1875 C 3.035156 0 2.722656 0.09375 2.390625 0.09375 C 2.148438 0.09375 1.929688 0.046875 1.734375 -0.046875 C 1.546875 -0.148438 1.390625 -0.28125 1.265625 -0.4375 L 1.265625 1.640625 Z M 1.203125 -2.109375 C 1.203125 -1.566406 1.3125 -1.160156 1.53125 -0.890625 C 1.757813 -0.628906 2.03125 -0.5 2.34375 -0.5 C 2.664063 -0.5 2.941406 -0.632813 3.171875 -0.90625 C 3.398438 -1.175781 3.515625 -1.597656 3.515625 -2.171875 C 3.515625 -2.722656 3.398438 -3.132813 3.171875 -3.40625 C 2.953125 -3.675781 2.6875 -3.8125 2.375 -3.8125 C 2.0625 -3.8125 1.785156 -3.664063 1.546875 -3.375 C 1.316406 -3.082031 1.203125 -2.660156 1.203125 -2.109375 Z M 1.203125 -2.109375 "
+           id="path223" />
+      </g>
+      <g
+         id="glyph-1-25">
+        <path
+           d="M 0.75 -3.453125 L 0.75 -4.28125 L 1.578125 -4.28125 L 1.578125 -3.453125 Z M 0.75 0 L 0.75 -0.828125 L 1.578125 -0.828125 L 1.578125 0 Z M 0.75 0 "
+           id="path226" />
+      </g>
+      <g
+         id="glyph-1-26">
+        <path
+           d="M 0 0.09375 L 1.71875 -6 L 2.296875 -6 L 0.578125 0.09375 Z M 0 0.09375 "
+           id="path229" />
+      </g>
+      <g
+         id="glyph-1-27">
+        <path
+           d="M 3.3125 0 L 3.3125 -0.546875 C 3.039063 -0.117188 2.644531 0.09375 2.125 0.09375 C 1.78125 0.09375 1.460938 0 1.171875 -0.1875 C 0.890625 -0.375 0.671875 -0.632813 0.515625 -0.96875 C 0.359375 -1.3125 0.28125 -1.703125 0.28125 -2.140625 C 0.28125 -2.566406 0.347656 -2.953125 0.484375 -3.296875 C 0.628906 -3.640625 0.84375 -3.90625 1.125 -4.09375 C 1.414063 -4.28125 1.738281 -4.375 2.09375 -4.375 C 2.351563 -4.375 2.582031 -4.316406 2.78125 -4.203125 C 2.976563 -4.097656 3.140625 -3.957031 3.265625 -3.78125 L 3.265625 -5.90625 L 3.984375 -5.90625 L 3.984375 0 Z M 1.03125 -2.140625 C 1.03125 -1.585938 1.144531 -1.175781 1.375 -0.90625 C 1.601563 -0.632813 1.875 -0.5 2.1875 -0.5 C 2.507813 -0.5 2.78125 -0.628906 3 -0.890625 C 3.21875 -1.148438 3.328125 -1.546875 3.328125 -2.078125 C 3.328125 -2.660156 3.210938 -3.085938 2.984375 -3.359375 C 2.765625 -3.640625 2.488281 -3.78125 2.15625 -3.78125 C 1.832031 -3.78125 1.5625 -3.644531 1.34375 -3.375 C 1.132813 -3.113281 1.03125 -2.703125 1.03125 -2.140625 Z M 1.03125 -2.140625 "
+           id="path232" />
+      </g>
+      <g
+         id="glyph-1-28">
+        <path
+           d="M 0.75 0 L 0.75 -0.828125 L 1.578125 -0.828125 L 1.578125 0 Z M 0.75 0 "
+           id="path235" />
+      </g>
+      <g
+         id="glyph-1-29">
+        <path
+           d="M 0.546875 0 L 0.546875 -4.28125 L 1.1875 -4.28125 L 1.1875 -3.671875 C 1.320313 -3.878906 1.5 -4.046875 1.71875 -4.171875 C 1.945313 -4.304688 2.203125 -4.375 2.484375 -4.375 C 2.804688 -4.375 3.066406 -4.304688 3.265625 -4.171875 C 3.472656 -4.046875 3.617188 -3.863281 3.703125 -3.625 C 4.035156 -4.125 4.472656 -4.375 5.015625 -4.375 C 5.441406 -4.375 5.769531 -4.253906 6 -4.015625 C 6.226563 -3.785156 6.34375 -3.425781 6.34375 -2.9375 L 6.34375 0 L 5.625 0 L 5.625 -2.6875 C 5.625 -2.976563 5.597656 -3.1875 5.546875 -3.3125 C 5.503906 -3.445313 5.421875 -3.550781 5.296875 -3.625 C 5.171875 -3.707031 5.023438 -3.75 4.859375 -3.75 C 4.554688 -3.75 4.304688 -3.644531 4.109375 -3.4375 C 3.910156 -3.238281 3.8125 -2.921875 3.8125 -2.484375 L 3.8125 0 L 3.078125 0 L 3.078125 -2.78125 C 3.078125 -3.101563 3.019531 -3.34375 2.90625 -3.5 C 2.789063 -3.664063 2.597656 -3.75 2.328125 -3.75 C 2.117188 -3.75 1.925781 -3.691406 1.75 -3.578125 C 1.582031 -3.472656 1.457031 -3.316406 1.375 -3.109375 C 1.300781 -2.898438 1.265625 -2.601563 1.265625 -2.21875 L 1.265625 0 Z M 0.546875 0 "
+           id="path238" />
+      </g>
+      <g
+         id="glyph-1-30">
+        <path
+           d="M 3.328125 -0.53125 C 3.066406 -0.300781 2.8125 -0.140625 2.5625 -0.046875 C 2.3125 0.046875 2.046875 0.09375 1.765625 0.09375 C 1.296875 0.09375 0.929688 -0.0195313 0.671875 -0.25 C 0.421875 -0.476563 0.296875 -0.769531 0.296875 -1.125 C 0.296875 -1.332031 0.34375 -1.523438 0.4375 -1.703125 C 0.53125 -1.878906 0.65625 -2.019531 0.8125 -2.125 C 0.96875 -2.226563 1.144531 -2.304688 1.34375 -2.359375 C 1.476563 -2.390625 1.691406 -2.425781 1.984375 -2.46875 C 2.566406 -2.53125 3 -2.613281 3.28125 -2.71875 C 3.28125 -2.8125 3.28125 -2.875 3.28125 -2.90625 C 3.28125 -3.195313 3.210938 -3.40625 3.078125 -3.53125 C 2.890625 -3.695313 2.613281 -3.78125 2.25 -3.78125 C 1.90625 -3.78125 1.648438 -3.71875 1.484375 -3.59375 C 1.328125 -3.476563 1.207031 -3.265625 1.125 -2.953125 L 0.421875 -3.0625 C 0.484375 -3.363281 0.585938 -3.609375 0.734375 -3.796875 C 0.890625 -3.984375 1.101563 -4.125 1.375 -4.21875 C 1.65625 -4.320313 1.984375 -4.375 2.359375 -4.375 C 2.722656 -4.375 3.015625 -4.328125 3.234375 -4.234375 C 3.460938 -4.148438 3.628906 -4.039063 3.734375 -3.90625 C 3.847656 -3.78125 3.925781 -3.617188 3.96875 -3.421875 C 4 -3.304688 4.015625 -3.085938 4.015625 -2.765625 L 4.015625 -1.796875 C 4.015625 -1.117188 4.023438 -0.691406 4.046875 -0.515625 C 4.078125 -0.335938 4.140625 -0.164063 4.234375 0 L 3.484375 0 C 3.410156 -0.144531 3.359375 -0.320313 3.328125 -0.53125 Z M 3.28125 -2.140625 C 3.007813 -2.035156 2.613281 -1.945313 2.09375 -1.875 C 1.789063 -1.832031 1.578125 -1.78125 1.453125 -1.71875 C 1.328125 -1.664063 1.234375 -1.585938 1.171875 -1.484375 C 1.109375 -1.390625 1.078125 -1.273438 1.078125 -1.140625 C 1.078125 -0.953125 1.148438 -0.789063 1.296875 -0.65625 C 1.441406 -0.53125 1.65625 -0.46875 1.9375 -0.46875 C 2.21875 -0.46875 2.460938 -0.53125 2.671875 -0.65625 C 2.890625 -0.78125 3.050781 -0.945313 3.15625 -1.15625 C 3.238281 -1.320313 3.28125 -1.5625 3.28125 -1.875 Z M 3.28125 -2.140625 "
+           id="path241" />
+      </g>
+      <g
+         id="glyph-1-31">
+        <path
+           d="M 1.21875 0 L 0.546875 0 L 0.546875 -5.90625 L 1.265625 -5.90625 L 1.265625 -3.796875 C 1.566406 -4.179688 1.957031 -4.375 2.4375 -4.375 C 2.695313 -4.375 2.941406 -4.320313 3.171875 -4.21875 C 3.410156 -4.113281 3.601563 -3.960938 3.75 -3.765625 C 3.90625 -3.578125 4.023438 -3.347656 4.109375 -3.078125 C 4.203125 -2.804688 4.25 -2.515625 4.25 -2.203125 C 4.25 -1.472656 4.066406 -0.90625 3.703125 -0.5 C 3.335938 -0.101563 2.90625 0.09375 2.40625 0.09375 C 1.894531 0.09375 1.5 -0.113281 1.21875 -0.53125 Z M 1.203125 -2.171875 C 1.203125 -1.660156 1.269531 -1.289063 1.40625 -1.0625 C 1.632813 -0.6875 1.945313 -0.5 2.34375 -0.5 C 2.65625 -0.5 2.925781 -0.632813 3.15625 -0.90625 C 3.394531 -1.1875 3.515625 -1.597656 3.515625 -2.140625 C 3.515625 -2.703125 3.398438 -3.113281 3.171875 -3.375 C 2.953125 -3.644531 2.6875 -3.78125 2.375 -3.78125 C 2.050781 -3.78125 1.773438 -3.640625 1.546875 -3.359375 C 1.316406 -3.085938 1.203125 -2.691406 1.203125 -2.171875 Z M 1.203125 -2.171875 "
+           id="path244" />
+      </g>
+      <g
+         id="glyph-1-32">
+        <path
+           d="M 0.34375 -1.5625 L 1.078125 -1.65625 C 1.160156 -1.25 1.300781 -0.953125 1.5 -0.765625 C 1.695313 -0.585938 1.941406 -0.5 2.234375 -0.5 C 2.566406 -0.5 2.847656 -0.613281 3.078125 -0.84375 C 3.316406 -1.082031 3.4375 -1.378906 3.4375 -1.734375 C 3.4375 -2.066406 3.328125 -2.335938 3.109375 -2.546875 C 2.898438 -2.765625 2.625 -2.875 2.28125 -2.875 C 2.144531 -2.875 1.976563 -2.847656 1.78125 -2.796875 L 1.859375 -3.4375 C 1.898438 -3.425781 1.9375 -3.421875 1.96875 -3.421875 C 2.28125 -3.421875 2.554688 -3.5 2.796875 -3.65625 C 3.046875 -3.820313 3.171875 -4.070313 3.171875 -4.40625 C 3.171875 -4.675781 3.082031 -4.894531 2.90625 -5.0625 C 2.726563 -5.238281 2.5 -5.328125 2.21875 -5.328125 C 1.925781 -5.328125 1.6875 -5.238281 1.5 -5.0625 C 1.3125 -4.882813 1.191406 -4.617188 1.140625 -4.265625 L 0.421875 -4.40625 C 0.503906 -4.882813 0.703125 -5.257813 1.015625 -5.53125 C 1.335938 -5.800781 1.734375 -5.9375 2.203125 -5.9375 C 2.515625 -5.9375 2.804688 -5.863281 3.078125 -5.71875 C 3.359375 -5.582031 3.566406 -5.394531 3.703125 -5.15625 C 3.847656 -4.914063 3.921875 -4.660156 3.921875 -4.390625 C 3.921875 -4.140625 3.851563 -3.910156 3.71875 -3.703125 C 3.582031 -3.492188 3.378906 -3.328125 3.109375 -3.203125 C 3.460938 -3.117188 3.734375 -2.945313 3.921875 -2.6875 C 4.117188 -2.4375 4.21875 -2.125 4.21875 -1.75 C 4.21875 -1.226563 4.023438 -0.785156 3.640625 -0.421875 C 3.265625 -0.0664063 2.789063 0.109375 2.21875 0.109375 C 1.707031 0.109375 1.28125 -0.046875 0.9375 -0.359375 C 0.59375 -0.671875 0.394531 -1.070313 0.34375 -1.5625 Z M 0.34375 -1.5625 "
+           id="path247" />
+      </g>
+      <g
+         id="glyph-1-33">
+        <path
+           d="M 0.34375 -2.90625 C 0.34375 -3.601563 0.414063 -4.164063 0.5625 -4.59375 C 0.707031 -5.019531 0.921875 -5.347656 1.203125 -5.578125 C 1.484375 -5.816406 1.835938 -5.9375 2.265625 -5.9375 C 2.585938 -5.9375 2.863281 -5.867188 3.09375 -5.734375 C 3.332031 -5.609375 3.53125 -5.425781 3.6875 -5.1875 C 3.84375 -4.945313 3.960938 -4.65625 4.046875 -4.3125 C 4.140625 -3.96875 4.1875 -3.5 4.1875 -2.90625 C 4.1875 -2.21875 4.113281 -1.660156 3.96875 -1.234375 C 3.832031 -0.804688 3.625 -0.476563 3.34375 -0.25 C 3.0625 -0.0195313 2.703125 0.09375 2.265625 0.09375 C 1.691406 0.09375 1.242188 -0.109375 0.921875 -0.515625 C 0.535156 -1.003906 0.34375 -1.800781 0.34375 -2.90625 Z M 1.09375 -2.90625 C 1.09375 -1.9375 1.203125 -1.289063 1.421875 -0.96875 C 1.648438 -0.65625 1.929688 -0.5 2.265625 -0.5 C 2.597656 -0.5 2.878906 -0.660156 3.109375 -0.984375 C 3.335938 -1.304688 3.453125 -1.945313 3.453125 -2.90625 C 3.453125 -3.882813 3.335938 -4.53125 3.109375 -4.84375 C 2.878906 -5.164063 2.597656 -5.328125 2.265625 -5.328125 C 1.929688 -5.328125 1.664063 -5.1875 1.46875 -4.90625 C 1.21875 -4.539063 1.09375 -3.875 1.09375 -2.90625 Z M 1.09375 -2.90625 "
+           id="path250" />
+      </g>
+      <g
+         id="glyph-1-34">
+        <path
+           d="M 0.390625 -5.125 L 0.390625 -5.828125 L 4.21875 -5.828125 L 4.21875 -5.265625 C 3.84375 -4.867188 3.46875 -4.335938 3.09375 -3.671875 C 2.726563 -3.003906 2.441406 -2.320313 2.234375 -1.625 C 2.085938 -1.125 2 -0.582031 1.96875 0 L 1.21875 0 C 1.226563 -0.46875 1.316406 -1.03125 1.484375 -1.6875 C 1.660156 -2.34375 1.910156 -2.972656 2.234375 -3.578125 C 2.566406 -4.191406 2.914063 -4.707031 3.28125 -5.125 Z M 0.390625 -5.125 "
+           id="path253" />
+      </g>
+      <g
+         id="glyph-1-35">
+        <path
+           d="M 0.65625 0 L 0.65625 -5.90625 L 3.265625 -5.90625 C 3.796875 -5.90625 4.195313 -5.851563 4.46875 -5.75 C 4.738281 -5.644531 4.957031 -5.457031 5.125 -5.1875 C 5.289063 -4.914063 5.375 -4.617188 5.375 -4.296875 C 5.375 -3.878906 5.238281 -3.523438 4.96875 -3.234375 C 4.695313 -2.941406 4.273438 -2.757813 3.703125 -2.6875 C 3.910156 -2.582031 4.066406 -2.484375 4.171875 -2.390625 C 4.398438 -2.179688 4.617188 -1.921875 4.828125 -1.609375 L 5.859375 0 L 4.875 0 L 4.09375 -1.234375 C 3.863281 -1.585938 3.671875 -1.859375 3.515625 -2.046875 C 3.367188 -2.234375 3.238281 -2.363281 3.125 -2.4375 C 3.007813 -2.507813 2.890625 -2.5625 2.765625 -2.59375 C 2.679688 -2.613281 2.539063 -2.625 2.34375 -2.625 L 1.4375 -2.625 L 1.4375 0 Z M 1.4375 -3.296875 L 3.109375 -3.296875 C 3.460938 -3.296875 3.738281 -3.332031 3.9375 -3.40625 C 4.144531 -3.476563 4.300781 -3.597656 4.40625 -3.765625 C 4.507813 -3.929688 4.5625 -4.109375 4.5625 -4.296875 C 4.5625 -4.578125 4.457031 -4.804688 4.25 -4.984375 C 4.050781 -5.160156 3.734375 -5.25 3.296875 -5.25 L 1.4375 -5.25 Z M 1.4375 -3.296875 "
+           id="path256" />
+      </g>
+      <g
+         id="glyph-1-36">
+        <path
+           d="M 4.15625 -0.703125 L 4.15625 0 L 0.25 0 C 0.238281 -0.175781 0.265625 -0.34375 0.328125 -0.5 C 0.429688 -0.769531 0.59375 -1.03125 0.8125 -1.28125 C 1.03125 -1.539063 1.347656 -1.84375 1.765625 -2.1875 C 2.398438 -2.707031 2.832031 -3.117188 3.0625 -3.421875 C 3.289063 -3.734375 3.40625 -4.03125 3.40625 -4.3125 C 3.40625 -4.59375 3.300781 -4.832031 3.09375 -5.03125 C 2.882813 -5.226563 2.613281 -5.328125 2.28125 -5.328125 C 1.9375 -5.328125 1.660156 -5.222656 1.453125 -5.015625 C 1.242188 -4.804688 1.132813 -4.515625 1.125 -4.140625 L 0.390625 -4.21875 C 0.441406 -4.78125 0.632813 -5.207031 0.96875 -5.5 C 1.300781 -5.789063 1.742188 -5.9375 2.296875 -5.9375 C 2.867188 -5.9375 3.316406 -5.773438 3.640625 -5.453125 C 3.972656 -5.140625 4.140625 -4.753906 4.140625 -4.296875 C 4.140625 -4.054688 4.09375 -3.820313 4 -3.59375 C 3.90625 -3.363281 3.742188 -3.125 3.515625 -2.875 C 3.296875 -2.625 2.925781 -2.273438 2.40625 -1.828125 C 1.96875 -1.460938 1.6875 -1.210938 1.5625 -1.078125 C 1.4375 -0.953125 1.332031 -0.828125 1.25 -0.703125 Z M 4.15625 -0.703125 "
+           id="path259" />
+      </g>
+      <g
+         id="glyph-1-37">
+        <path
+           d="M 1.90625 -1.453125 C 1.894531 -1.546875 1.890625 -1.617188 1.890625 -1.671875 C 1.890625 -1.953125 1.929688 -2.195313 2.015625 -2.40625 C 2.078125 -2.5625 2.171875 -2.71875 2.296875 -2.875 C 2.398438 -2.988281 2.578125 -3.15625 2.828125 -3.375 C 3.078125 -3.601563 3.238281 -3.78125 3.3125 -3.90625 C 3.382813 -4.039063 3.421875 -4.1875 3.421875 -4.34375 C 3.421875 -4.625 3.3125 -4.867188 3.09375 -5.078125 C 2.875 -5.296875 2.601563 -5.40625 2.28125 -5.40625 C 1.976563 -5.40625 1.722656 -5.304688 1.515625 -5.109375 C 1.304688 -4.921875 1.171875 -4.625 1.109375 -4.21875 L 0.359375 -4.296875 C 0.429688 -4.847656 0.628906 -5.269531 0.953125 -5.5625 C 1.285156 -5.851563 1.726563 -6 2.28125 -6 C 2.851563 -6 3.3125 -5.84375 3.65625 -5.53125 C 4 -5.21875 4.171875 -4.835938 4.171875 -4.390625 C 4.171875 -4.140625 4.109375 -3.90625 3.984375 -3.6875 C 3.867188 -3.46875 3.632813 -3.203125 3.28125 -2.890625 C 3.039063 -2.679688 2.882813 -2.523438 2.8125 -2.421875 C 2.75 -2.328125 2.695313 -2.210938 2.65625 -2.078125 C 2.625 -1.953125 2.601563 -1.742188 2.59375 -1.453125 Z M 1.859375 0 L 1.859375 -0.828125 L 2.6875 -0.828125 L 2.6875 0 Z M 1.859375 0 "
+           id="path262" />
+      </g>
+      <g
+         id="glyph-1-38">
+        <path
+           d="M 4.359375 -3.46875 L 0.453125 -3.46875 L 0.453125 -4.15625 L 4.359375 -4.15625 Z M 4.359375 -1.6875 L 0.453125 -1.6875 L 0.453125 -2.359375 L 4.359375 -2.359375 Z M 4.359375 -1.6875 "
+           id="path265" />
+      </g>
+      <g
+         id="glyph-1-39">
+        <path
+           d="M 3.921875 -0.703125 C 3.679688 -0.429688 3.421875 -0.226563 3.140625 -0.09375 C 2.859375 0.03125 2.550781 0.09375 2.21875 0.09375 C 1.613281 0.09375 1.132813 -0.109375 0.78125 -0.515625 C 0.5 -0.847656 0.359375 -1.21875 0.359375 -1.625 C 0.359375 -1.988281 0.472656 -2.316406 0.703125 -2.609375 C 0.941406 -2.910156 1.296875 -3.171875 1.765625 -3.390625 C 1.492188 -3.691406 1.3125 -3.9375 1.21875 -4.125 C 1.132813 -4.320313 1.09375 -4.507813 1.09375 -4.6875 C 1.09375 -5.039063 1.226563 -5.347656 1.5 -5.609375 C 1.78125 -5.867188 2.132813 -6 2.5625 -6 C 2.96875 -6 3.296875 -5.875 3.546875 -5.625 C 3.804688 -5.382813 3.9375 -5.09375 3.9375 -4.75 C 3.9375 -4.1875 3.5625 -3.707031 2.8125 -3.3125 L 3.875 -1.953125 C 4 -2.191406 4.09375 -2.46875 4.15625 -2.78125 L 4.921875 -2.625 C 4.785156 -2.101563 4.609375 -1.675781 4.390625 -1.34375 C 4.660156 -0.988281 4.96875 -0.6875 5.3125 -0.4375 L 4.828125 0.140625 C 4.535156 -0.046875 4.234375 -0.328125 3.921875 -0.703125 Z M 2.4375 -3.78125 C 2.757813 -3.957031 2.960938 -4.113281 3.046875 -4.25 C 3.140625 -4.394531 3.1875 -4.550781 3.1875 -4.71875 C 3.1875 -4.925781 3.125 -5.09375 3 -5.21875 C 2.875 -5.34375 2.71875 -5.40625 2.53125 -5.40625 C 2.332031 -5.40625 2.164063 -5.34375 2.03125 -5.21875 C 1.90625 -5.09375 1.84375 -4.9375 1.84375 -4.75 C 1.84375 -4.664063 1.863281 -4.570313 1.90625 -4.46875 C 1.957031 -4.363281 2.03125 -4.257813 2.125 -4.15625 Z M 3.46875 -1.265625 L 2.140625 -2.921875 C 1.742188 -2.679688 1.476563 -2.460938 1.34375 -2.265625 C 1.207031 -2.066406 1.140625 -1.867188 1.140625 -1.671875 C 1.140625 -1.429688 1.234375 -1.179688 1.421875 -0.921875 C 1.609375 -0.671875 1.878906 -0.546875 2.234375 -0.546875 C 2.453125 -0.546875 2.675781 -0.613281 2.90625 -0.75 C 3.132813 -0.882813 3.320313 -1.054688 3.46875 -1.265625 Z M 3.46875 -1.265625 "
+           id="path268" />
+      </g>
+      <g
+         id="glyph-1-40">
+        <path
+           d="M 0.640625 0 L 0.640625 -5.90625 L 2.859375 -5.90625 C 3.253906 -5.90625 3.554688 -5.882813 3.765625 -5.84375 C 4.054688 -5.800781 4.296875 -5.710938 4.484375 -5.578125 C 4.679688 -5.441406 4.835938 -5.25 4.953125 -5 C 5.078125 -4.757813 5.140625 -4.492188 5.140625 -4.203125 C 5.140625 -3.691406 4.976563 -3.265625 4.65625 -2.921875 C 4.34375 -2.578125 3.769531 -2.40625 2.9375 -2.40625 L 1.421875 -2.40625 L 1.421875 0 Z M 1.421875 -3.09375 L 2.9375 -3.09375 C 3.445313 -3.09375 3.804688 -3.1875 4.015625 -3.375 C 4.234375 -3.5625 4.34375 -3.828125 4.34375 -4.171875 C 4.34375 -4.421875 4.28125 -4.632813 4.15625 -4.8125 C 4.03125 -4.988281 3.863281 -5.101563 3.65625 -5.15625 C 3.519531 -5.1875 3.273438 -5.203125 2.921875 -5.203125 L 1.421875 -5.203125 Z M 1.421875 -3.09375 "
+           id="path271" />
+      </g>
+      <g
+         id="glyph-1-41">
+        <path
+           d="M 0.375 -1.890625 L 1.109375 -1.96875 C 1.140625 -1.664063 1.21875 -1.421875 1.34375 -1.234375 C 1.476563 -1.046875 1.675781 -0.890625 1.9375 -0.765625 C 2.207031 -0.648438 2.515625 -0.59375 2.859375 -0.59375 C 3.148438 -0.59375 3.410156 -0.632813 3.640625 -0.71875 C 3.867188 -0.8125 4.035156 -0.9375 4.140625 -1.09375 C 4.253906 -1.25 4.3125 -1.421875 4.3125 -1.609375 C 4.3125 -1.785156 4.257813 -1.941406 4.15625 -2.078125 C 4.050781 -2.222656 3.875 -2.34375 3.625 -2.4375 C 3.46875 -2.5 3.117188 -2.59375 2.578125 -2.71875 C 2.035156 -2.851563 1.65625 -2.976563 1.4375 -3.09375 C 1.15625 -3.238281 0.941406 -3.421875 0.796875 -3.640625 C 0.660156 -3.859375 0.59375 -4.101563 0.59375 -4.375 C 0.59375 -4.675781 0.675781 -4.957031 0.84375 -5.21875 C 1.019531 -5.476563 1.269531 -5.671875 1.59375 -5.796875 C 1.914063 -5.929688 2.273438 -6 2.671875 -6 C 3.109375 -6 3.492188 -5.925781 3.828125 -5.78125 C 4.160156 -5.644531 4.414063 -5.441406 4.59375 -5.171875 C 4.78125 -4.898438 4.878906 -4.585938 4.890625 -4.234375 L 4.140625 -4.1875 C 4.097656 -4.5625 3.960938 -4.84375 3.734375 -5.03125 C 3.503906 -5.21875 3.160156 -5.3125 2.703125 -5.3125 C 2.234375 -5.3125 1.890625 -5.222656 1.671875 -5.046875 C 1.453125 -4.878906 1.34375 -4.675781 1.34375 -4.4375 C 1.34375 -4.21875 1.421875 -4.039063 1.578125 -3.90625 C 1.734375 -3.769531 2.125 -3.628906 2.75 -3.484375 C 3.382813 -3.335938 3.820313 -3.210938 4.0625 -3.109375 C 4.40625 -2.953125 4.660156 -2.75 4.828125 -2.5 C 4.992188 -2.257813 5.078125 -1.984375 5.078125 -1.671875 C 5.078125 -1.359375 4.984375 -1.0625 4.796875 -0.78125 C 4.617188 -0.5 4.359375 -0.28125 4.015625 -0.125 C 3.679688 0.0195313 3.304688 0.09375 2.890625 0.09375 C 2.359375 0.09375 1.910156 0.0195313 1.546875 -0.125 C 1.179688 -0.28125 0.894531 -0.515625 0.6875 -0.828125 C 0.488281 -1.148438 0.382813 -1.503906 0.375 -1.890625 Z M 0.375 -1.890625 "
+           id="path274" />
+      </g>
+      <g
+         id="glyph-1-42">
+        <path
+           d="M 1.734375 0 L 0.109375 -4.28125 L 0.875 -4.28125 L 1.78125 -1.71875 C 1.882813 -1.4375 1.976563 -1.148438 2.0625 -0.859375 C 2.125 -1.078125 2.210938 -1.347656 2.328125 -1.671875 L 3.28125 -4.28125 L 4.03125 -4.28125 L 2.40625 0 Z M 1.734375 0 "
+           id="path277" />
+      </g>
+      <g
+         id="glyph-1-43">
+        <path
+           d="M 3.34375 0 L 3.34375 -0.625 C 3.007813 -0.144531 2.554688 0.09375 1.984375 0.09375 C 1.734375 0.09375 1.5 0.046875 1.28125 -0.046875 C 1.0625 -0.140625 0.898438 -0.257813 0.796875 -0.40625 C 0.691406 -0.550781 0.617188 -0.734375 0.578125 -0.953125 C 0.546875 -1.097656 0.53125 -1.320313 0.53125 -1.625 L 0.53125 -4.28125 L 1.25 -4.28125 L 1.25 -1.90625 C 1.25 -1.53125 1.265625 -1.273438 1.296875 -1.140625 C 1.335938 -0.953125 1.429688 -0.800781 1.578125 -0.6875 C 1.734375 -0.582031 1.921875 -0.53125 2.140625 -0.53125 C 2.359375 -0.53125 2.5625 -0.582031 2.75 -0.6875 C 2.9375 -0.800781 3.066406 -0.953125 3.140625 -1.140625 C 3.222656 -1.335938 3.265625 -1.617188 3.265625 -1.984375 L 3.265625 -4.28125 L 4 -4.28125 L 4 0 Z M 3.34375 0 "
+           id="path280" />
+      </g>
+      <g
+         id="glyph-1-44">
+        <path
+           d="M 0.15625 0 L 0.15625 -0.59375 L 2.890625 -3.71875 C 2.578125 -3.695313 2.300781 -3.6875 2.0625 -3.6875 L 0.328125 -3.6875 L 0.328125 -4.28125 L 3.8125 -4.28125 L 3.8125 -3.796875 L 1.5 -1.078125 L 1.0625 -0.59375 C 1.382813 -0.613281 1.6875 -0.625 1.96875 -0.625 L 3.953125 -0.625 L 3.953125 0 Z M 0.15625 0 "
+           id="path283" />
+      </g>
+      <g
+         id="glyph-1-45">
+        <path
+           d="M 0.234375 -1.671875 L 0.9375 -1.765625 C 0.957031 -1.316406 1.039063 -1.007813 1.1875 -0.84375 C 1.34375 -0.675781 1.554688 -0.59375 1.828125 -0.59375 C 2.015625 -0.59375 2.179688 -0.632813 2.328125 -0.71875 C 2.472656 -0.8125 2.570313 -0.9375 2.625 -1.09375 C 2.675781 -1.25 2.703125 -1.5 2.703125 -1.84375 L 2.703125 -5.90625 L 3.484375 -5.90625 L 3.484375 -1.875 C 3.484375 -1.382813 3.421875 -1.003906 3.296875 -0.734375 C 3.179688 -0.460938 2.992188 -0.253906 2.734375 -0.109375 C 2.472656 0.0234375 2.171875 0.09375 1.828125 0.09375 C 1.304688 0.09375 0.90625 -0.0507813 0.625 -0.34375 C 0.351563 -0.644531 0.222656 -1.085938 0.234375 -1.671875 Z M 0.234375 -1.671875 "
+           id="path286" />
+      </g>
+      <g
+         id="glyph-1-46">
+        <path
+           d="M 0.625 0 L 0.625 -5.90625 L 1.4375 -5.90625 L 4.53125 -1.265625 L 4.53125 -5.90625 L 5.28125 -5.90625 L 5.28125 0 L 4.484375 0 L 1.375 -4.640625 L 1.375 0 Z M 0.625 0 "
+           id="path289" />
+      </g>
+      <g
+         id="glyph-1-47">
+        <path
+           d="M 0.71875 0 L 0.71875 -3.71875 L 0.078125 -3.71875 L 0.078125 -4.28125 L 0.71875 -4.28125 L 0.71875 -4.734375 C 0.71875 -5.023438 0.742188 -5.238281 0.796875 -5.375 C 0.859375 -5.5625 0.976563 -5.710938 1.15625 -5.828125 C 1.332031 -5.941406 1.582031 -6 1.90625 -6 C 2.101563 -6 2.328125 -5.976563 2.578125 -5.9375 L 2.46875 -5.296875 C 2.320313 -5.328125 2.179688 -5.34375 2.046875 -5.34375 C 1.828125 -5.34375 1.671875 -5.296875 1.578125 -5.203125 C 1.484375 -5.109375 1.4375 -4.929688 1.4375 -4.671875 L 1.4375 -4.28125 L 2.265625 -4.28125 L 2.265625 -3.71875 L 1.4375 -3.71875 L 1.4375 0 Z M 0.71875 0 "
+           id="path292" />
+      </g>
+      <g
+         id="glyph-1-48">
+        <path
+           d="M 2.671875 0 L 2.671875 -1.40625 L 0.109375 -1.40625 L 0.109375 -2.078125 L 2.796875 -5.90625 L 3.390625 -5.90625 L 3.390625 -2.078125 L 4.1875 -2.078125 L 4.1875 -1.40625 L 3.390625 -1.40625 L 3.390625 0 Z M 2.671875 -2.078125 L 2.671875 -4.734375 L 0.8125 -2.078125 Z M 2.671875 -2.078125 "
+           id="path295" />
+      </g>
+      <g
+         id="glyph-1-49">
+        <path
+           d="M 0.34375 -1.546875 L 1.109375 -1.609375 C 1.160156 -1.242188 1.289063 -0.96875 1.5 -0.78125 C 1.707031 -0.59375 1.953125 -0.5 2.234375 -0.5 C 2.585938 -0.5 2.882813 -0.628906 3.125 -0.890625 C 3.363281 -1.148438 3.484375 -1.5 3.484375 -1.9375 C 3.484375 -2.351563 3.367188 -2.679688 3.140625 -2.921875 C 2.910156 -3.160156 2.609375 -3.28125 2.234375 -3.28125 C 1.992188 -3.28125 1.78125 -3.222656 1.59375 -3.109375 C 1.40625 -3.003906 1.257813 -2.867188 1.15625 -2.703125 L 0.46875 -2.796875 L 1.046875 -5.828125 L 3.984375 -5.828125 L 3.984375 -5.125 L 1.625 -5.125 L 1.3125 -3.546875 C 1.664063 -3.796875 2.035156 -3.921875 2.421875 -3.921875 C 2.929688 -3.921875 3.363281 -3.738281 3.71875 -3.375 C 4.082031 -3.019531 4.265625 -2.5625 4.265625 -2 C 4.265625 -1.46875 4.109375 -1.003906 3.796875 -0.609375 C 3.410156 -0.140625 2.890625 0.09375 2.234375 0.09375 C 1.703125 0.09375 1.265625 -0.0507813 0.921875 -0.34375 C 0.585938 -0.644531 0.394531 -1.046875 0.34375 -1.546875 Z M 0.34375 -1.546875 "
+           id="path298" />
+      </g>
+      <g
+         id="glyph-2-0">
+        <path
+           d="M 0.375 0 L 0.375 -4.6875 L 4.125 -4.6875 L 4.125 0 Z M 0.5 -0.125 L 4.015625 -0.125 L 4.015625 -4.578125 L 0.5 -4.578125 Z M 0.5 -0.125 "
+           id="path301" />
+      </g>
+      <g
+         id="glyph-2-1">
+        <path
+           d="M 1.234375 -4.59375 L 1.234375 -2.703125 C 1.429688 -2.910156 1.617188 -3.054688 1.796875 -3.140625 C 1.972656 -3.234375 2.175781 -3.28125 2.40625 -3.28125 C 2.644531 -3.28125 2.847656 -3.238281 3.015625 -3.15625 C 3.179688 -3.070313 3.316406 -2.941406 3.421875 -2.765625 C 3.535156 -2.585938 3.59375 -2.40625 3.59375 -2.21875 L 3.59375 -0.3125 L 3.9375 -0.3125 C 4.019531 -0.3125 4.078125 -0.296875 4.109375 -0.265625 C 4.140625 -0.234375 4.15625 -0.195313 4.15625 -0.15625 C 4.15625 -0.113281 4.140625 -0.078125 4.109375 -0.046875 C 4.078125 -0.015625 4.019531 0 3.9375 0 L 2.9375 0 C 2.863281 0 2.8125 -0.015625 2.78125 -0.046875 C 2.75 -0.078125 2.734375 -0.113281 2.734375 -0.15625 C 2.734375 -0.195313 2.75 -0.234375 2.78125 -0.265625 C 2.8125 -0.296875 2.863281 -0.3125 2.9375 -0.3125 L 3.28125 -0.3125 L 3.28125 -2.1875 C 3.28125 -2.414063 3.203125 -2.601563 3.046875 -2.75 C 2.890625 -2.894531 2.664063 -2.96875 2.375 -2.96875 C 2.15625 -2.96875 1.96875 -2.914063 1.8125 -2.8125 C 1.695313 -2.726563 1.503906 -2.539063 1.234375 -2.25 L 1.234375 -0.3125 L 1.578125 -0.3125 C 1.660156 -0.3125 1.71875 -0.296875 1.75 -0.265625 C 1.78125 -0.234375 1.796875 -0.195313 1.796875 -0.15625 C 1.796875 -0.113281 1.78125 -0.078125 1.75 -0.046875 C 1.71875 -0.015625 1.660156 0 1.578125 0 L 0.578125 0 C 0.503906 0 0.453125 -0.015625 0.421875 -0.046875 C 0.390625 -0.078125 0.375 -0.113281 0.375 -0.15625 C 0.375 -0.195313 0.390625 -0.234375 0.421875 -0.265625 C 0.453125 -0.296875 0.503906 -0.3125 0.578125 -0.3125 L 0.9375 -0.3125 L 0.9375 -4.28125 L 0.515625 -4.28125 C 0.441406 -4.28125 0.390625 -4.296875 0.359375 -4.328125 C 0.328125 -4.359375 0.3125 -4.394531 0.3125 -4.4375 C 0.3125 -4.488281 0.328125 -4.523438 0.359375 -4.546875 C 0.390625 -4.578125 0.441406 -4.59375 0.515625 -4.59375 Z M 1.234375 -4.59375 "
+           id="path304" />
+      </g>
+      <g
+         id="glyph-2-2">
+        <path
+           d="M 1.625 -3.171875 L 3.28125 -3.171875 C 3.363281 -3.171875 3.421875 -3.15625 3.453125 -3.125 C 3.484375 -3.09375 3.5 -3.054688 3.5 -3.015625 C 3.5 -2.972656 3.484375 -2.9375 3.453125 -2.90625 C 3.421875 -2.875 3.363281 -2.859375 3.28125 -2.859375 L 1.625 -2.859375 L 1.625 -0.8125 C 1.625 -0.632813 1.691406 -0.484375 1.828125 -0.359375 C 1.972656 -0.242188 2.1875 -0.1875 2.46875 -0.1875 C 2.664063 -0.1875 2.882813 -0.21875 3.125 -0.28125 C 3.375 -0.34375 3.566406 -0.410156 3.703125 -0.484375 C 3.742188 -0.515625 3.78125 -0.53125 3.8125 -0.53125 C 3.851563 -0.53125 3.890625 -0.515625 3.921875 -0.484375 C 3.953125 -0.460938 3.96875 -0.429688 3.96875 -0.390625 C 3.96875 -0.347656 3.953125 -0.3125 3.921875 -0.28125 C 3.835938 -0.195313 3.644531 -0.109375 3.34375 -0.015625 C 3.039063 0.078125 2.753906 0.125 2.484375 0.125 C 2.117188 0.125 1.832031 0.0390625 1.625 -0.125 C 1.414063 -0.300781 1.3125 -0.53125 1.3125 -0.8125 L 1.3125 -2.859375 L 0.734375 -2.859375 C 0.660156 -2.859375 0.609375 -2.875 0.578125 -2.90625 C 0.546875 -2.9375 0.53125 -2.972656 0.53125 -3.015625 C 0.53125 -3.054688 0.546875 -3.09375 0.578125 -3.125 C 0.609375 -3.15625 0.660156 -3.171875 0.734375 -3.171875 L 1.3125 -3.171875 L 1.3125 -4.078125 C 1.3125 -4.148438 1.320313 -4.203125 1.34375 -4.234375 C 1.375 -4.265625 1.414063 -4.28125 1.46875 -4.28125 C 1.507813 -4.28125 1.546875 -4.265625 1.578125 -4.234375 C 1.609375 -4.203125 1.625 -4.148438 1.625 -4.078125 Z M 1.625 -3.171875 "
+           id="path307" />
+      </g>
+      <g
+         id="glyph-2-3">
+        <path
+           d="M 1.09375 -3.171875 L 1.09375 -2.609375 C 1.269531 -2.828125 1.460938 -2.992188 1.671875 -3.109375 C 1.890625 -3.222656 2.140625 -3.28125 2.421875 -3.28125 C 2.722656 -3.28125 3 -3.207031 3.25 -3.0625 C 3.507813 -2.925781 3.707031 -2.726563 3.84375 -2.46875 C 3.988281 -2.21875 4.0625 -1.957031 4.0625 -1.6875 C 4.0625 -1.238281 3.90625 -0.859375 3.59375 -0.546875 C 3.28125 -0.234375 2.890625 -0.078125 2.421875 -0.078125 C 1.878906 -0.078125 1.4375 -0.300781 1.09375 -0.75 L 1.09375 1.109375 L 1.84375 1.109375 C 1.914063 1.109375 1.96875 1.117188 2 1.140625 C 2.03125 1.171875 2.046875 1.210938 2.046875 1.265625 C 2.046875 1.304688 2.03125 1.335938 2 1.359375 C 1.96875 1.390625 1.914063 1.40625 1.84375 1.40625 L 0.375 1.40625 C 0.300781 1.40625 0.25 1.390625 0.21875 1.359375 C 0.1875 1.335938 0.171875 1.304688 0.171875 1.265625 C 0.171875 1.210938 0.1875 1.171875 0.21875 1.140625 C 0.25 1.117188 0.300781 1.109375 0.375 1.109375 L 0.78125 1.109375 L 0.78125 -2.859375 L 0.375 -2.859375 C 0.300781 -2.859375 0.25 -2.875 0.21875 -2.90625 C 0.1875 -2.9375 0.171875 -2.972656 0.171875 -3.015625 C 0.171875 -3.054688 0.1875 -3.09375 0.21875 -3.125 C 0.25 -3.15625 0.300781 -3.171875 0.375 -3.171875 Z M 3.75 -1.6875 C 3.75 -2.039063 3.617188 -2.34375 3.359375 -2.59375 C 3.109375 -2.84375 2.796875 -2.96875 2.421875 -2.96875 C 2.054688 -2.96875 1.742188 -2.835938 1.484375 -2.578125 C 1.222656 -2.328125 1.09375 -2.03125 1.09375 -1.6875 C 1.09375 -1.332031 1.222656 -1.023438 1.484375 -0.765625 C 1.742188 -0.515625 2.054688 -0.390625 2.421875 -0.390625 C 2.796875 -0.390625 3.109375 -0.515625 3.359375 -0.765625 C 3.617188 -1.015625 3.75 -1.320313 3.75 -1.6875 Z M 3.75 -1.6875 "
+           id="path310" />
+      </g>
+      <g
+         id="glyph-2-4">
+        <path
+           d="M 3.265625 -2.96875 C 3.265625 -3.039063 3.28125 -3.09375 3.3125 -3.125 C 3.34375 -3.15625 3.378906 -3.171875 3.421875 -3.171875 C 3.460938 -3.171875 3.5 -3.15625 3.53125 -3.125 C 3.5625 -3.09375 3.578125 -3.039063 3.578125 -2.96875 L 3.578125 -2.4375 C 3.578125 -2.363281 3.5625 -2.3125 3.53125 -2.28125 C 3.5 -2.25 3.460938 -2.234375 3.421875 -2.234375 C 3.378906 -2.234375 3.34375 -2.242188 3.3125 -2.265625 C 3.289063 -2.296875 3.273438 -2.34375 3.265625 -2.40625 C 3.253906 -2.550781 3.179688 -2.671875 3.046875 -2.765625 C 2.835938 -2.898438 2.570313 -2.96875 2.25 -2.96875 C 1.90625 -2.96875 1.632813 -2.898438 1.4375 -2.765625 C 1.300781 -2.660156 1.234375 -2.539063 1.234375 -2.40625 C 1.234375 -2.257813 1.316406 -2.140625 1.484375 -2.046875 C 1.597656 -1.972656 1.820313 -1.921875 2.15625 -1.890625 C 2.582031 -1.835938 2.878906 -1.785156 3.046875 -1.734375 C 3.273438 -1.640625 3.445313 -1.515625 3.5625 -1.359375 C 3.6875 -1.210938 3.75 -1.050781 3.75 -0.875 C 3.75 -0.613281 3.617188 -0.378906 3.359375 -0.171875 C 3.109375 0.0234375 2.742188 0.125 2.265625 0.125 C 1.773438 0.125 1.375 0 1.0625 -0.25 C 1.0625 -0.164063 1.054688 -0.109375 1.046875 -0.078125 C 1.035156 -0.0546875 1.015625 -0.0351563 0.984375 -0.015625 C 0.960938 -0.00390625 0.9375 0 0.90625 0 C 0.863281 0 0.828125 -0.015625 0.796875 -0.046875 C 0.773438 -0.078125 0.765625 -0.128906 0.765625 -0.203125 L 0.765625 -0.84375 C 0.765625 -0.914063 0.773438 -0.96875 0.796875 -1 C 0.828125 -1.03125 0.863281 -1.046875 0.90625 -1.046875 C 0.957031 -1.046875 0.992188 -1.03125 1.015625 -1 C 1.046875 -0.96875 1.0625 -0.925781 1.0625 -0.875 C 1.0625 -0.757813 1.09375 -0.664063 1.15625 -0.59375 C 1.238281 -0.476563 1.375 -0.378906 1.5625 -0.296875 C 1.75 -0.222656 1.976563 -0.1875 2.25 -0.1875 C 2.644531 -0.1875 2.941406 -0.257813 3.140625 -0.40625 C 3.335938 -0.5625 3.4375 -0.71875 3.4375 -0.875 C 3.4375 -1.070313 3.335938 -1.226563 3.140625 -1.34375 C 2.941406 -1.457031 2.648438 -1.53125 2.265625 -1.5625 C 1.878906 -1.601563 1.601563 -1.65625 1.4375 -1.71875 C 1.269531 -1.78125 1.140625 -1.875 1.046875 -2 C 0.960938 -2.132813 0.921875 -2.273438 0.921875 -2.421875 C 0.921875 -2.679688 1.046875 -2.890625 1.296875 -3.046875 C 1.554688 -3.203125 1.867188 -3.28125 2.234375 -3.28125 C 2.660156 -3.28125 3.003906 -3.175781 3.265625 -2.96875 Z M 3.265625 -2.96875 "
+           id="path313" />
+      </g>
+      <g
+         id="glyph-2-5">
+        <path
+           d="M 2.1875 -3.171875 L 2.3125 -3.171875 C 2.445313 -3.171875 2.5625 -3.117188 2.65625 -3.015625 C 2.757813 -2.921875 2.8125 -2.804688 2.8125 -2.671875 C 2.8125 -2.535156 2.757813 -2.414063 2.65625 -2.3125 C 2.5625 -2.21875 2.445313 -2.171875 2.3125 -2.171875 L 2.1875 -2.171875 C 2.050781 -2.171875 1.929688 -2.21875 1.828125 -2.3125 C 1.734375 -2.414063 1.6875 -2.535156 1.6875 -2.671875 C 1.6875 -2.816406 1.734375 -2.9375 1.828125 -3.03125 C 1.929688 -3.125 2.050781 -3.171875 2.1875 -3.171875 Z M 2.1875 -0.875 L 2.3125 -0.875 C 2.445313 -0.875 2.5625 -0.828125 2.65625 -0.734375 C 2.757813 -0.640625 2.8125 -0.523438 2.8125 -0.390625 C 2.8125 -0.242188 2.757813 -0.125 2.65625 -0.03125 C 2.5625 0.0625 2.445313 0.109375 2.3125 0.109375 L 2.1875 0.109375 C 2.050781 0.109375 1.929688 0.0625 1.828125 -0.03125 C 1.734375 -0.125 1.6875 -0.242188 1.6875 -0.390625 C 1.6875 -0.523438 1.734375 -0.640625 1.828125 -0.734375 C 1.929688 -0.828125 2.050781 -0.875 2.1875 -0.875 Z M 2.1875 -0.875 "
+           id="path316" />
+      </g>
+      <g
+         id="glyph-2-6">
+        <path
+           d="M 3.640625 -4.8125 L 1.15625 0.484375 C 1.113281 0.578125 1.0625 0.625 1 0.625 C 0.957031 0.625 0.921875 0.609375 0.890625 0.578125 C 0.859375 0.546875 0.84375 0.507813 0.84375 0.46875 C 0.84375 0.4375 0.851563 0.398438 0.875 0.359375 L 3.34375 -4.953125 C 3.375 -5.003906 3.398438 -5.039063 3.421875 -5.0625 C 3.453125 -5.082031 3.484375 -5.09375 3.515625 -5.09375 C 3.554688 -5.09375 3.59375 -5.078125 3.625 -5.046875 C 3.65625 -5.015625 3.671875 -4.976563 3.671875 -4.9375 C 3.671875 -4.914063 3.660156 -4.875 3.640625 -4.8125 Z M 3.640625 -4.8125 "
+           id="path319" />
+      </g>
+      <g
+         id="glyph-2-7">
+        <path
+           d="M 3.96875 -1.578125 C 3.96875 -1.109375 3.800781 -0.707031 3.46875 -0.375 C 3.132813 -0.0390625 2.726563 0.125 2.25 0.125 C 1.769531 0.125 1.363281 -0.0390625 1.03125 -0.375 C 0.695313 -0.707031 0.53125 -1.109375 0.53125 -1.578125 C 0.53125 -2.046875 0.695313 -2.445313 1.03125 -2.78125 C 1.363281 -3.113281 1.769531 -3.28125 2.25 -3.28125 C 2.726563 -3.28125 3.132813 -3.113281 3.46875 -2.78125 C 3.800781 -2.445313 3.96875 -2.046875 3.96875 -1.578125 Z M 3.65625 -1.578125 C 3.65625 -1.960938 3.515625 -2.289063 3.234375 -2.5625 C 2.960938 -2.832031 2.632813 -2.96875 2.25 -2.96875 C 1.851563 -2.96875 1.519531 -2.832031 1.25 -2.5625 C 0.976563 -2.289063 0.84375 -1.960938 0.84375 -1.578125 C 0.84375 -1.191406 0.976563 -0.863281 1.25 -0.59375 C 1.519531 -0.320313 1.851563 -0.1875 2.25 -0.1875 C 2.632813 -0.1875 2.960938 -0.320313 3.234375 -0.59375 C 3.515625 -0.863281 3.65625 -1.191406 3.65625 -1.578125 Z M 3.65625 -1.578125 "
+           id="path322" />
+      </g>
+      <g
+         id="glyph-2-8">
+        <path
+           d="M 2.40625 -4.75 L 2.40625 -3.953125 L 1.953125 -3.953125 L 1.953125 -4.75 Z M 2.40625 -3.171875 L 2.40625 -0.3125 L 3.625 -0.3125 C 3.695313 -0.3125 3.75 -0.296875 3.78125 -0.265625 C 3.8125 -0.234375 3.828125 -0.195313 3.828125 -0.15625 C 3.828125 -0.113281 3.8125 -0.078125 3.78125 -0.046875 C 3.75 -0.015625 3.695313 0 3.625 0 L 0.890625 0 C 0.816406 0 0.765625 -0.015625 0.734375 -0.046875 C 0.703125 -0.078125 0.6875 -0.113281 0.6875 -0.15625 C 0.6875 -0.195313 0.703125 -0.234375 0.734375 -0.265625 C 0.765625 -0.296875 0.816406 -0.3125 0.890625 -0.3125 L 2.109375 -0.3125 L 2.109375 -2.859375 L 1.203125 -2.859375 C 1.128906 -2.859375 1.078125 -2.875 1.046875 -2.90625 C 1.015625 -2.9375 1 -2.972656 1 -3.015625 C 1 -3.054688 1.015625 -3.09375 1.046875 -3.125 C 1.078125 -3.15625 1.128906 -3.171875 1.203125 -3.171875 Z M 2.40625 -3.171875 "
+           id="path325" />
+      </g>
+      <g
+         id="glyph-2-9">
+        <path
+           d="M 3.75 -4.59375 L 3.75 -0.3125 L 4.171875 -0.3125 C 4.242188 -0.3125 4.296875 -0.296875 4.328125 -0.265625 C 4.359375 -0.234375 4.375 -0.195313 4.375 -0.15625 C 4.375 -0.113281 4.359375 -0.078125 4.328125 -0.046875 C 4.296875 -0.015625 4.242188 0 4.171875 0 L 3.453125 0 L 3.453125 -0.609375 C 3.085938 -0.117188 2.632813 0.125 2.09375 0.125 C 1.8125 0.125 1.539063 0.0507813 1.28125 -0.09375 C 1.03125 -0.25 0.832031 -0.460938 0.6875 -0.734375 C 0.539063 -1.003906 0.46875 -1.285156 0.46875 -1.578125 C 0.46875 -1.867188 0.539063 -2.148438 0.6875 -2.421875 C 0.832031 -2.691406 1.03125 -2.898438 1.28125 -3.046875 C 1.539063 -3.203125 1.8125 -3.28125 2.09375 -3.28125 C 2.625 -3.28125 3.078125 -3.035156 3.453125 -2.546875 L 3.453125 -4.28125 L 3.03125 -4.28125 C 2.957031 -4.28125 2.90625 -4.296875 2.875 -4.328125 C 2.84375 -4.359375 2.828125 -4.394531 2.828125 -4.4375 C 2.828125 -4.488281 2.84375 -4.523438 2.875 -4.546875 C 2.90625 -4.578125 2.957031 -4.59375 3.03125 -4.59375 Z M 3.453125 -1.578125 C 3.453125 -1.972656 3.316406 -2.300781 3.046875 -2.5625 C 2.785156 -2.832031 2.472656 -2.96875 2.109375 -2.96875 C 1.742188 -2.96875 1.425781 -2.832031 1.15625 -2.5625 C 0.894531 -2.300781 0.765625 -1.972656 0.765625 -1.578125 C 0.765625 -1.191406 0.894531 -0.863281 1.15625 -0.59375 C 1.425781 -0.320313 1.742188 -0.1875 2.109375 -0.1875 C 2.472656 -0.1875 2.785156 -0.320313 3.046875 -0.59375 C 3.316406 -0.863281 3.453125 -1.191406 3.453125 -1.578125 Z M 3.453125 -1.578125 "
+           id="path328" />
+      </g>
+      <g
+         id="glyph-2-10">
+        <path
+           d="M 3.53125 -2.859375 L 3.53125 -2.96875 C 3.53125 -3.039063 3.546875 -3.09375 3.578125 -3.125 C 3.609375 -3.15625 3.644531 -3.171875 3.6875 -3.171875 C 3.726563 -3.171875 3.765625 -3.15625 3.796875 -3.125 C 3.828125 -3.09375 3.84375 -3.039063 3.84375 -2.96875 L 3.84375 -2.265625 C 3.84375 -2.191406 3.828125 -2.140625 3.796875 -2.109375 C 3.765625 -2.078125 3.726563 -2.0625 3.6875 -2.0625 C 3.644531 -2.0625 3.609375 -2.070313 3.578125 -2.09375 C 3.554688 -2.125 3.539063 -2.171875 3.53125 -2.234375 C 3.519531 -2.410156 3.40625 -2.578125 3.1875 -2.734375 C 2.976563 -2.890625 2.691406 -2.96875 2.328125 -2.96875 C 1.867188 -2.96875 1.519531 -2.820313 1.28125 -2.53125 C 1.050781 -2.25 0.9375 -1.925781 0.9375 -1.5625 C 0.9375 -1.164063 1.066406 -0.835938 1.328125 -0.578125 C 1.585938 -0.316406 1.925781 -0.1875 2.34375 -0.1875 C 2.582031 -0.1875 2.820313 -0.226563 3.0625 -0.3125 C 3.3125 -0.40625 3.539063 -0.550781 3.75 -0.75 C 3.789063 -0.789063 3.832031 -0.8125 3.875 -0.8125 C 3.914063 -0.8125 3.953125 -0.796875 3.984375 -0.765625 C 4.015625 -0.742188 4.03125 -0.710938 4.03125 -0.671875 C 4.03125 -0.566406 3.90625 -0.429688 3.65625 -0.265625 C 3.257813 -0.00390625 2.816406 0.125 2.328125 0.125 C 1.828125 0.125 1.414063 -0.03125 1.09375 -0.34375 C 0.78125 -0.664063 0.625 -1.070313 0.625 -1.5625 C 0.625 -2.050781 0.785156 -2.457031 1.109375 -2.78125 C 1.441406 -3.113281 1.851563 -3.28125 2.34375 -3.28125 C 2.8125 -3.28125 3.207031 -3.140625 3.53125 -2.859375 Z M 3.53125 -2.859375 "
+           id="path331" />
+      </g>
+      <g
+         id="glyph-2-11">
+        <path
+           d="M 2.1875 -0.875 L 2.3125 -0.875 C 2.445313 -0.875 2.5625 -0.828125 2.65625 -0.734375 C 2.757813 -0.640625 2.8125 -0.523438 2.8125 -0.390625 C 2.8125 -0.242188 2.757813 -0.125 2.65625 -0.03125 C 2.5625 0.0625 2.445313 0.109375 2.3125 0.109375 L 2.1875 0.109375 C 2.050781 0.109375 1.929688 0.0625 1.828125 -0.03125 C 1.734375 -0.125 1.6875 -0.242188 1.6875 -0.390625 C 1.6875 -0.523438 1.734375 -0.640625 1.828125 -0.734375 C 1.929688 -0.828125 2.050781 -0.875 2.1875 -0.875 Z M 2.1875 -0.875 "
+           id="path334" />
+      </g>
+      <g
+         id="glyph-2-12">
+        <path
+           d="M 1.875 -3.171875 L 1.875 -2.390625 C 2.28125 -2.753906 2.582031 -2.988281 2.78125 -3.09375 C 2.976563 -3.195313 3.160156 -3.25 3.328125 -3.25 C 3.515625 -3.25 3.6875 -3.1875 3.84375 -3.0625 C 4 -2.9375 4.078125 -2.84375 4.078125 -2.78125 C 4.078125 -2.738281 4.0625 -2.703125 4.03125 -2.671875 C 4 -2.640625 3.960938 -2.625 3.921875 -2.625 C 3.890625 -2.625 3.863281 -2.625 3.84375 -2.625 C 3.832031 -2.632813 3.804688 -2.664063 3.765625 -2.71875 C 3.679688 -2.800781 3.601563 -2.859375 3.53125 -2.890625 C 3.46875 -2.921875 3.40625 -2.9375 3.34375 -2.9375 C 3.21875 -2.9375 3.054688 -2.882813 2.859375 -2.78125 C 2.671875 -2.675781 2.34375 -2.414063 1.875 -2 L 1.875 -0.3125 L 3.25 -0.3125 C 3.320313 -0.3125 3.375 -0.296875 3.40625 -0.265625 C 3.4375 -0.234375 3.453125 -0.195313 3.453125 -0.15625 C 3.453125 -0.113281 3.4375 -0.078125 3.40625 -0.046875 C 3.375 -0.015625 3.320313 0 3.25 0 L 0.828125 0 C 0.753906 0 0.703125 -0.0078125 0.671875 -0.03125 C 0.640625 -0.0625 0.625 -0.101563 0.625 -0.15625 C 0.625 -0.195313 0.640625 -0.226563 0.671875 -0.25 C 0.703125 -0.28125 0.753906 -0.296875 0.828125 -0.296875 L 1.578125 -0.296875 L 1.578125 -2.859375 L 1 -2.859375 C 0.925781 -2.859375 0.875 -2.875 0.84375 -2.90625 C 0.8125 -2.9375 0.796875 -2.972656 0.796875 -3.015625 C 0.796875 -3.054688 0.8125 -3.09375 0.84375 -3.125 C 0.875 -3.15625 0.925781 -3.171875 1 -3.171875 Z M 1.875 -3.171875 "
+           id="path337" />
+      </g>
+      <g
+         id="glyph-2-13">
+        <path
+           d="M 2.515625 0 L 2 0 L 0.734375 -2.859375 L 0.421875 -2.859375 C 0.347656 -2.859375 0.296875 -2.875 0.265625 -2.90625 C 0.234375 -2.9375 0.21875 -2.972656 0.21875 -3.015625 C 0.21875 -3.054688 0.234375 -3.09375 0.265625 -3.125 C 0.296875 -3.15625 0.347656 -3.171875 0.421875 -3.171875 L 1.578125 -3.171875 C 1.648438 -3.171875 1.703125 -3.15625 1.734375 -3.125 C 1.765625 -3.09375 1.78125 -3.054688 1.78125 -3.015625 C 1.78125 -2.972656 1.765625 -2.9375 1.734375 -2.90625 C 1.703125 -2.875 1.648438 -2.859375 1.578125 -2.859375 L 1.0625 -2.859375 L 2.1875 -0.3125 L 2.328125 -0.3125 L 3.4375 -2.859375 L 2.921875 -2.859375 C 2.847656 -2.859375 2.796875 -2.875 2.765625 -2.90625 C 2.734375 -2.9375 2.71875 -2.972656 2.71875 -3.015625 C 2.71875 -3.054688 2.734375 -3.09375 2.765625 -3.125 C 2.796875 -3.15625 2.847656 -3.171875 2.921875 -3.171875 L 4.078125 -3.171875 C 4.148438 -3.171875 4.203125 -3.15625 4.234375 -3.125 C 4.265625 -3.09375 4.28125 -3.054688 4.28125 -3.015625 C 4.28125 -2.972656 4.265625 -2.9375 4.234375 -2.90625 C 4.203125 -2.875 4.148438 -2.859375 4.078125 -2.859375 L 3.765625 -2.859375 Z M 2.515625 0 "
+           id="path340" />
+      </g>
+      <g
+         id="glyph-2-14">
+        <path
+           d="M 3.921875 -1.515625 L 0.78125 -1.515625 C 0.832031 -1.117188 1 -0.796875 1.28125 -0.546875 C 1.5625 -0.304688 1.90625 -0.1875 2.3125 -0.1875 C 2.539063 -0.1875 2.78125 -0.222656 3.03125 -0.296875 C 3.289063 -0.367188 3.5 -0.46875 3.65625 -0.59375 C 3.695313 -0.632813 3.738281 -0.65625 3.78125 -0.65625 C 3.8125 -0.65625 3.84375 -0.640625 3.875 -0.609375 C 3.90625 -0.578125 3.921875 -0.539063 3.921875 -0.5 C 3.921875 -0.457031 3.898438 -0.414063 3.859375 -0.375 C 3.742188 -0.257813 3.535156 -0.144531 3.234375 -0.03125 C 2.941406 0.0703125 2.632813 0.125 2.3125 0.125 C 1.789063 0.125 1.351563 -0.046875 1 -0.390625 C 0.644531 -0.742188 0.46875 -1.164063 0.46875 -1.65625 C 0.46875 -2.101563 0.632813 -2.484375 0.96875 -2.796875 C 1.300781 -3.117188 1.707031 -3.28125 2.1875 -3.28125 C 2.695313 -3.28125 3.113281 -3.113281 3.4375 -2.78125 C 3.757813 -2.457031 3.921875 -2.035156 3.921875 -1.515625 Z M 3.609375 -1.828125 C 3.546875 -2.160156 3.382813 -2.429688 3.125 -2.640625 C 2.863281 -2.859375 2.550781 -2.96875 2.1875 -2.96875 C 1.832031 -2.96875 1.523438 -2.863281 1.265625 -2.65625 C 1.003906 -2.445313 0.84375 -2.171875 0.78125 -1.828125 Z M 3.609375 -1.828125 "
+           id="path343" />
+      </g>
+      <g
+         id="glyph-2-15">
+        <path
+           d="M 0.84375 -3.171875 L 0.84375 -2.859375 C 1.101563 -3.140625 1.367188 -3.28125 1.640625 -3.28125 C 1.796875 -3.28125 1.929688 -3.238281 2.046875 -3.15625 C 2.171875 -3.070313 2.273438 -2.941406 2.359375 -2.765625 C 2.492188 -2.941406 2.628906 -3.070313 2.765625 -3.15625 C 2.910156 -3.238281 3.050781 -3.28125 3.1875 -3.28125 C 3.414063 -3.28125 3.59375 -3.207031 3.71875 -3.0625 C 3.894531 -2.875 3.984375 -2.671875 3.984375 -2.453125 L 3.984375 -0.3125 L 4.25 -0.3125 C 4.320313 -0.3125 4.375 -0.296875 4.40625 -0.265625 C 4.4375 -0.234375 4.453125 -0.195313 4.453125 -0.15625 C 4.453125 -0.113281 4.4375 -0.078125 4.40625 -0.046875 C 4.375 -0.015625 4.320313 0 4.25 0 L 3.671875 0 L 3.671875 -2.421875 C 3.671875 -2.578125 3.625 -2.707031 3.53125 -2.8125 C 3.4375 -2.914063 3.328125 -2.96875 3.203125 -2.96875 C 3.085938 -2.96875 2.96875 -2.925781 2.84375 -2.84375 C 2.71875 -2.757813 2.578125 -2.59375 2.421875 -2.34375 L 2.421875 -0.3125 L 2.6875 -0.3125 C 2.757813 -0.3125 2.8125 -0.296875 2.84375 -0.265625 C 2.875 -0.234375 2.890625 -0.195313 2.890625 -0.15625 C 2.890625 -0.113281 2.875 -0.078125 2.84375 -0.046875 C 2.8125 -0.015625 2.757813 0 2.6875 0 L 2.109375 0 L 2.109375 -2.40625 C 2.109375 -2.570313 2.0625 -2.707031 1.96875 -2.8125 C 1.875 -2.914063 1.765625 -2.96875 1.640625 -2.96875 C 1.535156 -2.96875 1.425781 -2.929688 1.3125 -2.859375 C 1.164063 -2.765625 1.007813 -2.59375 0.84375 -2.34375 L 0.84375 -0.3125 L 1.109375 -0.3125 C 1.179688 -0.3125 1.234375 -0.296875 1.265625 -0.265625 C 1.296875 -0.234375 1.3125 -0.195313 1.3125 -0.15625 C 1.3125 -0.113281 1.296875 -0.078125 1.265625 -0.046875 C 1.234375 -0.015625 1.179688 0 1.109375 0 L 0.28125 0 C 0.207031 0 0.15625 -0.015625 0.125 -0.046875 C 0.09375 -0.078125 0.078125 -0.113281 0.078125 -0.15625 C 0.078125 -0.195313 0.09375 -0.234375 0.125 -0.265625 C 0.15625 -0.296875 0.207031 -0.3125 0.28125 -0.3125 L 0.546875 -0.3125 L 0.546875 -2.859375 L 0.28125 -2.859375 C 0.207031 -2.859375 0.15625 -2.875 0.125 -2.90625 C 0.09375 -2.9375 0.078125 -2.972656 0.078125 -3.015625 C 0.078125 -3.054688 0.09375 -3.09375 0.125 -3.125 C 0.15625 -3.15625 0.207031 -3.171875 0.28125 -3.171875 Z M 0.84375 -3.171875 "
+           id="path346" />
+      </g>
+      <g
+         id="glyph-2-16">
+        <path
+           d="M 3.140625 0 L 3.140625 -0.4375 C 2.691406 -0.0625 2.210938 0.125 1.703125 0.125 C 1.335938 0.125 1.050781 0.03125 0.84375 -0.15625 C 0.632813 -0.34375 0.53125 -0.570313 0.53125 -0.84375 C 0.53125 -1.144531 0.664063 -1.40625 0.9375 -1.625 C 1.207031 -1.84375 1.609375 -1.953125 2.140625 -1.953125 C 2.273438 -1.953125 2.425781 -1.941406 2.59375 -1.921875 C 2.757813 -1.910156 2.941406 -1.882813 3.140625 -1.84375 L 3.140625 -2.34375 C 3.140625 -2.507813 3.0625 -2.65625 2.90625 -2.78125 C 2.75 -2.90625 2.515625 -2.96875 2.203125 -2.96875 C 1.960938 -2.96875 1.625 -2.898438 1.1875 -2.765625 C 1.113281 -2.734375 1.066406 -2.71875 1.046875 -2.71875 C 1.003906 -2.71875 0.96875 -2.734375 0.9375 -2.765625 C 0.90625 -2.796875 0.890625 -2.832031 0.890625 -2.875 C 0.890625 -2.914063 0.90625 -2.953125 0.9375 -2.984375 C 0.96875 -3.015625 1.101563 -3.0625 1.34375 -3.125 C 1.726563 -3.226563 2.019531 -3.28125 2.21875 -3.28125 C 2.601563 -3.28125 2.90625 -3.179688 3.125 -2.984375 C 3.34375 -2.796875 3.453125 -2.582031 3.453125 -2.34375 L 3.453125 -0.3125 L 3.859375 -0.3125 C 3.929688 -0.3125 3.984375 -0.296875 4.015625 -0.265625 C 4.046875 -0.234375 4.0625 -0.195313 4.0625 -0.15625 C 4.0625 -0.113281 4.046875 -0.078125 4.015625 -0.046875 C 3.984375 -0.015625 3.929688 0 3.859375 0 Z M 3.140625 -1.53125 C 2.992188 -1.570313 2.835938 -1.601563 2.671875 -1.625 C 2.515625 -1.644531 2.347656 -1.65625 2.171875 -1.65625 C 1.722656 -1.65625 1.375 -1.554688 1.125 -1.359375 C 0.925781 -1.210938 0.828125 -1.039063 0.828125 -0.84375 C 0.828125 -0.65625 0.898438 -0.5 1.046875 -0.375 C 1.191406 -0.25 1.40625 -0.1875 1.6875 -0.1875 C 1.957031 -0.1875 2.203125 -0.238281 2.421875 -0.34375 C 2.648438 -0.445313 2.890625 -0.617188 3.140625 -0.859375 Z M 3.140625 -1.53125 "
+           id="path349" />
+      </g>
+      <g
+         id="glyph-2-17">
+        <path
+           d="M 3.296875 0 L 3.296875 -0.453125 C 2.878906 -0.0664063 2.425781 0.125 1.9375 0.125 C 1.632813 0.125 1.40625 0.0390625 1.25 -0.125 C 1.050781 -0.34375 0.953125 -0.59375 0.953125 -0.875 L 0.953125 -2.859375 L 0.53125 -2.859375 C 0.457031 -2.859375 0.40625 -2.875 0.375 -2.90625 C 0.34375 -2.9375 0.328125 -2.972656 0.328125 -3.015625 C 0.328125 -3.054688 0.34375 -3.09375 0.375 -3.125 C 0.40625 -3.15625 0.457031 -3.171875 0.53125 -3.171875 L 1.265625 -3.171875 L 1.265625 -0.875 C 1.265625 -0.675781 1.328125 -0.507813 1.453125 -0.375 C 1.578125 -0.25 1.734375 -0.1875 1.921875 -0.1875 C 2.421875 -0.1875 2.878906 -0.414063 3.296875 -0.875 L 3.296875 -2.859375 L 2.734375 -2.859375 C 2.660156 -2.859375 2.609375 -2.875 2.578125 -2.90625 C 2.546875 -2.9375 2.53125 -2.972656 2.53125 -3.015625 C 2.53125 -3.054688 2.546875 -3.09375 2.578125 -3.125 C 2.609375 -3.15625 2.660156 -3.171875 2.734375 -3.171875 L 3.609375 -3.171875 L 3.609375 -0.3125 L 3.875 -0.3125 C 3.945313 -0.3125 4 -0.296875 4.03125 -0.265625 C 4.0625 -0.234375 4.078125 -0.195313 4.078125 -0.15625 C 4.078125 -0.113281 4.0625 -0.078125 4.03125 -0.046875 C 4 -0.015625 3.945313 0 3.875 0 Z M 3.296875 0 "
+           id="path352" />
+      </g>
+      <g
+         id="glyph-2-18">
+        <path
+           d="M 3.59375 -3.171875 L 3.59375 -2.890625 L 1.296875 -0.3125 L 3.375 -0.3125 L 3.375 -0.734375 C 3.375 -0.804688 3.382813 -0.859375 3.40625 -0.890625 C 3.4375 -0.921875 3.476563 -0.9375 3.53125 -0.9375 C 3.570313 -0.9375 3.609375 -0.921875 3.640625 -0.890625 C 3.671875 -0.859375 3.6875 -0.804688 3.6875 -0.734375 L 3.6875 0 L 0.875 0 L 0.875 -0.28125 L 3.15625 -2.859375 L 1.25 -2.859375 L 1.25 -2.4375 C 1.25 -2.363281 1.234375 -2.3125 1.203125 -2.28125 C 1.171875 -2.25 1.132813 -2.234375 1.09375 -2.234375 C 1.050781 -2.234375 1.015625 -2.25 0.984375 -2.28125 C 0.953125 -2.3125 0.9375 -2.363281 0.9375 -2.4375 L 0.9375 -3.171875 Z M 3.59375 -3.171875 "
+           id="path355" />
+      </g>
+      <g
+         id="glyph-2-19">
+        <path
+           d="M 2.421875 -1.875 L 2.421875 -1.578125 C 2.421875 -1.503906 2.40625 -1.445313 2.375 -1.40625 C 2.34375 -1.375 2.304688 -1.359375 2.265625 -1.359375 C 2.210938 -1.359375 2.171875 -1.375 2.140625 -1.40625 C 2.117188 -1.445313 2.109375 -1.503906 2.109375 -1.578125 L 2.109375 -2.09375 C 2.640625 -2.289063 3.003906 -2.488281 3.203125 -2.6875 C 3.304688 -2.789063 3.359375 -2.925781 3.359375 -3.09375 C 3.359375 -3.363281 3.257813 -3.597656 3.0625 -3.796875 C 2.863281 -3.992188 2.609375 -4.09375 2.296875 -4.09375 C 2.128906 -4.09375 1.972656 -4.070313 1.828125 -4.03125 C 1.691406 -4 1.519531 -3.929688 1.3125 -3.828125 L 1.3125 -3.515625 C 1.3125 -3.441406 1.296875 -3.390625 1.265625 -3.359375 C 1.242188 -3.328125 1.207031 -3.3125 1.15625 -3.3125 C 1.113281 -3.3125 1.078125 -3.328125 1.046875 -3.359375 C 1.015625 -3.390625 1 -3.441406 1 -3.515625 L 1 -4.03125 C 1.382813 -4.195313 1.632813 -4.296875 1.75 -4.328125 C 1.9375 -4.367188 2.125 -4.390625 2.3125 -4.390625 C 2.726563 -4.390625 3.054688 -4.265625 3.296875 -4.015625 C 3.546875 -3.773438 3.671875 -3.472656 3.671875 -3.109375 C 3.671875 -2.867188 3.597656 -2.660156 3.453125 -2.484375 C 3.304688 -2.316406 2.960938 -2.113281 2.421875 -1.875 Z M 2.109375 -0.65625 L 2.40625 -0.65625 C 2.519531 -0.65625 2.613281 -0.613281 2.6875 -0.53125 C 2.757813 -0.457031 2.796875 -0.367188 2.796875 -0.265625 C 2.796875 -0.160156 2.753906 -0.0703125 2.671875 0 C 2.597656 0.0703125 2.507813 0.109375 2.40625 0.109375 L 2.109375 0.109375 C 1.992188 0.109375 1.898438 0.0703125 1.828125 0 C 1.753906 -0.0703125 1.71875 -0.160156 1.71875 -0.265625 C 1.71875 -0.378906 1.753906 -0.472656 1.828125 -0.546875 C 1.910156 -0.617188 2.003906 -0.65625 2.109375 -0.65625 Z M 2.109375 -0.65625 "
+           id="path358" />
+      </g>
+      <g
+         id="glyph-2-20" />
+      <g
+         id="glyph-2-21">
+        <path
+           d="M 2.40625 -4.59375 L 2.40625 -0.3125 L 3.609375 -0.3125 C 3.691406 -0.3125 3.75 -0.296875 3.78125 -0.265625 C 3.8125 -0.234375 3.828125 -0.195313 3.828125 -0.15625 C 3.828125 -0.113281 3.8125 -0.078125 3.78125 -0.046875 C 3.75 -0.015625 3.691406 0 3.609375 0 L 0.890625 0 C 0.816406 0 0.765625 -0.015625 0.734375 -0.046875 C 0.703125 -0.078125 0.6875 -0.113281 0.6875 -0.15625 C 0.6875 -0.195313 0.703125 -0.234375 0.734375 -0.265625 C 0.765625 -0.296875 0.816406 -0.3125 0.890625 -0.3125 L 2.09375 -0.3125 L 2.09375 -4.28125 L 1.21875 -4.28125 C 1.144531 -4.28125 1.085938 -4.296875 1.046875 -4.328125 C 1.015625 -4.359375 1 -4.394531 1 -4.4375 C 1 -4.488281 1.015625 -4.523438 1.046875 -4.546875 C 1.078125 -4.578125 1.132813 -4.59375 1.21875 -4.59375 Z M 2.40625 -4.59375 "
+           id="path362" />
+      </g>
+      <g
+         id="glyph-2-22">
+        <path
+           d="M 1.25 -3.171875 L 1.25 -2.703125 C 1.46875 -2.921875 1.660156 -3.070313 1.828125 -3.15625 C 2.003906 -3.238281 2.203125 -3.28125 2.421875 -3.28125 C 2.660156 -3.28125 2.875 -3.226563 3.0625 -3.125 C 3.195313 -3.050781 3.320313 -2.929688 3.4375 -2.765625 C 3.550781 -2.597656 3.609375 -2.425781 3.609375 -2.25 L 3.609375 -0.3125 L 3.859375 -0.3125 C 3.929688 -0.3125 3.984375 -0.296875 4.015625 -0.265625 C 4.046875 -0.234375 4.0625 -0.195313 4.0625 -0.15625 C 4.0625 -0.113281 4.046875 -0.078125 4.015625 -0.046875 C 3.984375 -0.015625 3.929688 0 3.859375 0 L 3.046875 0 C 2.960938 0 2.90625 -0.015625 2.875 -0.046875 C 2.84375 -0.078125 2.828125 -0.113281 2.828125 -0.15625 C 2.828125 -0.195313 2.84375 -0.234375 2.875 -0.265625 C 2.90625 -0.296875 2.960938 -0.3125 3.046875 -0.3125 L 3.296875 -0.3125 L 3.296875 -2.1875 C 3.296875 -2.40625 3.210938 -2.585938 3.046875 -2.734375 C 2.890625 -2.890625 2.679688 -2.96875 2.421875 -2.96875 C 2.210938 -2.96875 2.035156 -2.925781 1.890625 -2.84375 C 1.742188 -2.757813 1.53125 -2.554688 1.25 -2.234375 L 1.25 -0.3125 L 1.609375 -0.3125 C 1.679688 -0.3125 1.734375 -0.296875 1.765625 -0.265625 C 1.796875 -0.234375 1.8125 -0.195313 1.8125 -0.15625 C 1.8125 -0.113281 1.796875 -0.078125 1.765625 -0.046875 C 1.734375 -0.015625 1.679688 0 1.609375 0 L 0.59375 0 C 0.519531 0 0.46875 -0.015625 0.4375 -0.046875 C 0.40625 -0.078125 0.390625 -0.113281 0.390625 -0.15625 C 0.390625 -0.195313 0.40625 -0.234375 0.4375 -0.265625 C 0.46875 -0.296875 0.519531 -0.3125 0.59375 -0.3125 L 0.953125 -0.3125 L 0.953125 -2.859375 L 0.6875 -2.859375 C 0.613281 -2.859375 0.5625 -2.875 0.53125 -2.90625 C 0.5 -2.9375 0.484375 -2.972656 0.484375 -3.015625 C 0.484375 -3.054688 0.5 -3.09375 0.53125 -3.125 C 0.5625 -3.15625 0.613281 -3.171875 0.6875 -3.171875 Z M 1.25 -3.171875 "
+           id="path365" />
+      </g>
+      <g
+         id="glyph-2-23">
+        <path
+           d="M 4.296875 2.046875 L 0.203125 2.046875 C 0.128906 2.046875 0.078125 2.03125 0.046875 2 C 0.015625 1.976563 0 1.945313 0 1.90625 C 0 1.851563 0.015625 1.8125 0.046875 1.78125 C 0.078125 1.757813 0.128906 1.75 0.203125 1.75 L 4.296875 1.75 C 4.367188 1.75 4.421875 1.757813 4.453125 1.78125 C 4.484375 1.8125 4.5 1.851563 4.5 1.90625 C 4.5 1.945313 4.484375 1.976563 4.453125 2 C 4.421875 2.03125 4.367188 2.046875 4.296875 2.046875 Z M 4.296875 2.046875 "
+           id="path368" />
+      </g>
+      <g
+         id="glyph-2-24">
+        <path
+           d="M 3.921875 -2.546875 L 0.578125 -2.546875 C 0.503906 -2.546875 0.453125 -2.5625 0.421875 -2.59375 C 0.390625 -2.625 0.375 -2.660156 0.375 -2.703125 C 0.375 -2.742188 0.390625 -2.78125 0.421875 -2.8125 C 0.453125 -2.84375 0.503906 -2.859375 0.578125 -2.859375 L 3.921875 -2.859375 C 4.003906 -2.859375 4.0625 -2.84375 4.09375 -2.8125 C 4.125 -2.78125 4.140625 -2.742188 4.140625 -2.703125 C 4.140625 -2.660156 4.125 -2.625 4.09375 -2.59375 C 4.0625 -2.5625 4.003906 -2.546875 3.921875 -2.546875 Z M 3.921875 -1.4375 L 0.578125 -1.4375 C 0.503906 -1.4375 0.453125 -1.453125 0.421875 -1.484375 C 0.390625 -1.515625 0.375 -1.550781 0.375 -1.59375 C 0.375 -1.644531 0.390625 -1.679688 0.421875 -1.703125 C 0.453125 -1.734375 0.503906 -1.75 0.578125 -1.75 L 3.921875 -1.75 C 4.003906 -1.75 4.0625 -1.734375 4.09375 -1.703125 C 4.125 -1.679688 4.140625 -1.644531 4.140625 -1.59375 C 4.140625 -1.550781 4.125 -1.515625 4.09375 -1.484375 C 4.0625 -1.453125 4.003906 -1.4375 3.921875 -1.4375 Z M 3.921875 -1.4375 "
+           id="path371" />
+      </g>
+      <g
+         id="glyph-2-25">
+        <path
+           d="M 0.359375 -2.140625 L 3.6875 -3.984375 C 3.738281 -4.015625 3.78125 -4.03125 3.8125 -4.03125 C 3.851563 -4.03125 3.882813 -4.015625 3.90625 -3.984375 C 3.9375 -3.953125 3.953125 -3.914063 3.953125 -3.875 C 3.953125 -3.8125 3.910156 -3.757813 3.828125 -3.71875 L 0.984375 -2.140625 L 3.828125 -0.546875 C 3.910156 -0.503906 3.953125 -0.453125 3.953125 -0.390625 C 3.953125 -0.347656 3.9375 -0.3125 3.90625 -0.28125 C 3.875 -0.25 3.835938 -0.234375 3.796875 -0.234375 C 3.773438 -0.234375 3.738281 -0.25 3.6875 -0.28125 Z M 0.359375 -2.140625 "
+           id="path374" />
+      </g>
+      <g
+         id="glyph-2-26">
+        <path
+           d="M 4.140625 -2.140625 L 0.8125 -0.28125 C 0.757813 -0.25 0.722656 -0.234375 0.703125 -0.234375 C 0.660156 -0.234375 0.625 -0.25 0.59375 -0.28125 C 0.5625 -0.3125 0.546875 -0.347656 0.546875 -0.390625 C 0.546875 -0.453125 0.585938 -0.503906 0.671875 -0.546875 L 3.515625 -2.140625 L 0.671875 -3.71875 C 0.585938 -3.757813 0.546875 -3.8125 0.546875 -3.875 C 0.546875 -3.914063 0.5625 -3.953125 0.59375 -3.984375 C 0.625 -4.015625 0.660156 -4.03125 0.703125 -4.03125 C 0.722656 -4.03125 0.765625 -4.015625 0.828125 -3.984375 Z M 4.140625 -2.140625 "
+           id="path377" />
+      </g>
+      <g
+         id="glyph-2-27">
+        <path
+           d="M 3.125 0 L 2.890625 -0.359375 C 2.671875 -0.0351563 2.382813 0.125 2.03125 0.125 C 1.738281 0.125 1.484375 0.0078125 1.265625 -0.21875 C 1.046875 -0.457031 0.9375 -0.742188 0.9375 -1.078125 C 0.9375 -1.335938 1.007813 -1.566406 1.15625 -1.765625 C 1.300781 -1.960938 1.507813 -2.101563 1.78125 -2.1875 C 1.59375 -2.476563 1.484375 -2.664063 1.453125 -2.75 C 1.421875 -2.84375 1.40625 -2.941406 1.40625 -3.046875 C 1.40625 -3.285156 1.492188 -3.492188 1.671875 -3.671875 C 1.859375 -3.859375 2.078125 -3.953125 2.328125 -3.953125 C 2.410156 -3.953125 2.492188 -3.9375 2.578125 -3.90625 C 2.660156 -3.882813 2.742188 -3.847656 2.828125 -3.796875 C 2.929688 -3.847656 3 -3.875 3.03125 -3.875 C 3.070313 -3.875 3.101563 -3.859375 3.125 -3.828125 C 3.15625 -3.796875 3.171875 -3.757813 3.171875 -3.71875 C 3.171875 -3.6875 3.160156 -3.660156 3.140625 -3.640625 C 3.128906 -3.617188 3.097656 -3.59375 3.046875 -3.5625 L 2.8125 -3.4375 C 2.738281 -3.5 2.660156 -3.546875 2.578125 -3.578125 C 2.503906 -3.617188 2.425781 -3.640625 2.34375 -3.640625 C 2.164063 -3.640625 2.015625 -3.578125 1.890625 -3.453125 C 1.765625 -3.328125 1.703125 -3.1875 1.703125 -3.03125 C 1.703125 -2.875 1.8125 -2.617188 2.03125 -2.265625 L 2.890625 -0.921875 C 3.035156 -1.203125 3.148438 -1.523438 3.234375 -1.890625 L 3.53125 -1.890625 C 3.601563 -1.890625 3.65625 -1.875 3.6875 -1.84375 C 3.726563 -1.820313 3.75 -1.785156 3.75 -1.734375 C 3.75 -1.703125 3.738281 -1.671875 3.71875 -1.640625 C 3.695313 -1.617188 3.671875 -1.601563 3.640625 -1.59375 C 3.617188 -1.582031 3.5625 -1.578125 3.46875 -1.578125 C 3.351563 -1.171875 3.21875 -0.851563 3.0625 -0.625 L 3.28125 -0.3125 L 3.53125 -0.3125 C 3.601563 -0.3125 3.65625 -0.296875 3.6875 -0.265625 C 3.726563 -0.234375 3.75 -0.195313 3.75 -0.15625 C 3.75 -0.113281 3.726563 -0.078125 3.6875 -0.046875 C 3.65625 -0.015625 3.601563 0 3.53125 0 Z M 1.90625 -1.90625 C 1.695313 -1.863281 1.53125 -1.765625 1.40625 -1.609375 C 1.289063 -1.460938 1.234375 -1.285156 1.234375 -1.078125 C 1.234375 -0.828125 1.3125 -0.613281 1.46875 -0.4375 C 1.632813 -0.269531 1.820313 -0.1875 2.03125 -0.1875 C 2.300781 -0.1875 2.523438 -0.335938 2.703125 -0.640625 Z M 1.90625 -1.90625 "
+           id="path380" />
+      </g>
+      <g
+         id="glyph-2-28">
+        <path
+           d="M 1.09375 -4.59375 L 1.09375 -2.5625 C 1.457031 -3.039063 1.90625 -3.28125 2.4375 -3.28125 C 2.882813 -3.28125 3.265625 -3.113281 3.578125 -2.78125 C 3.898438 -2.457031 4.0625 -2.0625 4.0625 -1.59375 C 4.0625 -1.113281 3.898438 -0.707031 3.578125 -0.375 C 3.253906 -0.0390625 2.875 0.125 2.4375 0.125 C 1.894531 0.125 1.445313 -0.117188 1.09375 -0.609375 L 1.09375 0 L 0.375 0 C 0.300781 0 0.25 -0.015625 0.21875 -0.046875 C 0.1875 -0.078125 0.171875 -0.113281 0.171875 -0.15625 C 0.171875 -0.195313 0.1875 -0.234375 0.21875 -0.265625 C 0.25 -0.296875 0.300781 -0.3125 0.375 -0.3125 L 0.78125 -0.3125 L 0.78125 -4.28125 L 0.375 -4.28125 C 0.300781 -4.28125 0.25 -4.296875 0.21875 -4.328125 C 0.1875 -4.359375 0.171875 -4.394531 0.171875 -4.4375 C 0.171875 -4.488281 0.1875 -4.523438 0.21875 -4.546875 C 0.25 -4.578125 0.300781 -4.59375 0.375 -4.59375 Z M 3.765625 -1.578125 C 3.765625 -1.960938 3.628906 -2.289063 3.359375 -2.5625 C 3.097656 -2.832031 2.785156 -2.96875 2.421875 -2.96875 C 2.066406 -2.96875 1.753906 -2.832031 1.484375 -2.5625 C 1.222656 -2.289063 1.09375 -1.960938 1.09375 -1.578125 C 1.09375 -1.191406 1.222656 -0.863281 1.484375 -0.59375 C 1.753906 -0.320313 2.066406 -0.1875 2.421875 -0.1875 C 2.785156 -0.1875 3.097656 -0.320313 3.359375 -0.59375 C 3.628906 -0.863281 3.765625 -1.191406 3.765625 -1.578125 Z M 3.765625 -1.578125 "
+           id="path383" />
+      </g>
+      <g
+         id="glyph-2-29">
+        <path
+           d="M 1.625 -1.375 L 1.625 0 L 0.90625 0 C 0.832031 0 0.78125 -0.015625 0.75 -0.046875 C 0.71875 -0.078125 0.703125 -0.113281 0.703125 -0.15625 C 0.703125 -0.195313 0.71875 -0.234375 0.75 -0.265625 C 0.78125 -0.296875 0.832031 -0.3125 0.90625 -0.3125 L 1.3125 -0.3125 L 1.3125 -4.28125 L 0.90625 -4.28125 C 0.832031 -4.28125 0.78125 -4.296875 0.75 -4.328125 C 0.71875 -4.359375 0.703125 -4.394531 0.703125 -4.4375 C 0.703125 -4.488281 0.71875 -4.523438 0.75 -4.546875 C 0.78125 -4.578125 0.832031 -4.59375 0.90625 -4.59375 L 1.625 -4.59375 L 1.625 -1.765625 L 2.9375 -2.859375 L 2.78125 -2.859375 C 2.707031 -2.859375 2.65625 -2.875 2.625 -2.90625 C 2.59375 -2.9375 2.578125 -2.972656 2.578125 -3.015625 C 2.578125 -3.054688 2.59375 -3.09375 2.625 -3.125 C 2.65625 -3.15625 2.707031 -3.171875 2.78125 -3.171875 L 3.765625 -3.171875 C 3.835938 -3.171875 3.890625 -3.15625 3.921875 -3.125 C 3.953125 -3.09375 3.96875 -3.054688 3.96875 -3.015625 C 3.96875 -2.972656 3.953125 -2.9375 3.921875 -2.90625 C 3.890625 -2.875 3.835938 -2.859375 3.765625 -2.859375 L 3.40625 -2.859375 L 2.203125 -1.859375 L 3.71875 -0.3125 L 4.078125 -0.3125 C 4.148438 -0.3125 4.203125 -0.296875 4.234375 -0.265625 C 4.265625 -0.234375 4.28125 -0.195313 4.28125 -0.15625 C 4.28125 -0.113281 4.265625 -0.078125 4.234375 -0.046875 C 4.203125 -0.015625 4.148438 0 4.078125 0 L 3.078125 0 C 3.003906 0 2.953125 -0.015625 2.921875 -0.046875 C 2.890625 -0.078125 2.875 -0.113281 2.875 -0.15625 C 2.875 -0.195313 2.890625 -0.234375 2.921875 -0.265625 C 2.953125 -0.296875 3.003906 -0.3125 3.078125 -0.3125 L 3.296875 -0.3125 L 1.984375 -1.671875 Z M 1.625 -1.375 "
+           id="path386" />
+      </g>
+      <g
+         id="glyph-2-30">
+        <path
+           d="M 3.28125 -2.609375 L 3.28125 -3.171875 L 4 -3.171875 C 4.070313 -3.171875 4.125 -3.15625 4.15625 -3.125 C 4.195313 -3.09375 4.21875 -3.054688 4.21875 -3.015625 C 4.21875 -2.972656 4.195313 -2.9375 4.15625 -2.90625 C 4.125 -2.875 4.070313 -2.859375 4 -2.859375 L 3.59375 -2.859375 L 3.59375 0.21875 C 3.59375 0.414063 3.546875 0.597656 3.453125 0.765625 C 3.398438 0.867188 3.304688 0.976563 3.171875 1.09375 C 3.035156 1.207031 2.910156 1.285156 2.796875 1.328125 C 2.679688 1.378906 2.53125 1.40625 2.34375 1.40625 L 1.46875 1.40625 C 1.394531 1.40625 1.34375 1.390625 1.3125 1.359375 C 1.28125 1.335938 1.265625 1.304688 1.265625 1.265625 C 1.265625 1.210938 1.28125 1.171875 1.3125 1.140625 C 1.34375 1.117188 1.394531 1.109375 1.46875 1.109375 L 2.359375 1.109375 C 2.535156 1.109375 2.695313 1.0625 2.84375 0.96875 C 2.988281 0.875 3.109375 0.738281 3.203125 0.5625 C 3.253906 0.457031 3.28125 0.328125 3.28125 0.171875 L 3.28125 -0.75 C 2.957031 -0.300781 2.535156 -0.078125 2.015625 -0.078125 C 1.585938 -0.078125 1.21875 -0.234375 0.90625 -0.546875 C 0.601563 -0.859375 0.453125 -1.238281 0.453125 -1.6875 C 0.453125 -2.125 0.601563 -2.5 0.90625 -2.8125 C 1.21875 -3.125 1.585938 -3.28125 2.015625 -3.28125 C 2.535156 -3.28125 2.957031 -3.054688 3.28125 -2.609375 Z M 3.28125 -1.6875 C 3.28125 -2.039063 3.15625 -2.34375 2.90625 -2.59375 C 2.664063 -2.84375 2.375 -2.96875 2.03125 -2.96875 C 1.6875 -2.96875 1.390625 -2.84375 1.140625 -2.59375 C 0.890625 -2.34375 0.765625 -2.039063 0.765625 -1.6875 C 0.765625 -1.320313 0.890625 -1.015625 1.140625 -0.765625 C 1.390625 -0.515625 1.6875 -0.390625 2.03125 -0.390625 C 2.375 -0.390625 2.664063 -0.515625 2.90625 -0.765625 C 3.15625 -1.015625 3.28125 -1.320313 3.28125 -1.6875 Z M 3.28125 -1.6875 "
+           id="path389" />
+      </g>
+      <g
+         id="glyph-2-31">
+        <path
+           d="M 2.078125 -1.828125 C 2.191406 -1.734375 2.273438 -1.644531 2.328125 -1.5625 C 2.378906 -1.445313 2.40625 -1.316406 2.40625 -1.171875 L 2.40625 0.140625 C 2.40625 0.285156 2.441406 0.398438 2.515625 0.484375 C 2.597656 0.578125 2.703125 0.628906 2.828125 0.640625 C 2.898438 0.648438 2.953125 0.664063 2.984375 0.6875 C 3.015625 0.71875 3.03125 0.753906 3.03125 0.796875 C 3.03125 0.835938 3.015625 0.875 2.984375 0.90625 C 2.953125 0.9375 2.90625 0.953125 2.84375 0.953125 C 2.644531 0.953125 2.484375 0.890625 2.359375 0.765625 C 2.179688 0.597656 2.09375 0.394531 2.09375 0.15625 L 2.09375 -1.171875 C 2.09375 -1.304688 2.050781 -1.414063 1.96875 -1.5 C 1.894531 -1.59375 1.796875 -1.644531 1.671875 -1.65625 C 1.597656 -1.664063 1.546875 -1.679688 1.515625 -1.703125 C 1.492188 -1.734375 1.484375 -1.773438 1.484375 -1.828125 C 1.484375 -1.867188 1.492188 -1.898438 1.515625 -1.921875 C 1.546875 -1.953125 1.597656 -1.972656 1.671875 -1.984375 C 1.796875 -1.992188 1.894531 -2.046875 1.96875 -2.140625 C 2.050781 -2.234375 2.09375 -2.34375 2.09375 -2.46875 L 2.09375 -3.796875 C 2.09375 -4.023438 2.164063 -4.210938 2.3125 -4.359375 C 2.457031 -4.515625 2.632813 -4.59375 2.84375 -4.59375 C 2.90625 -4.59375 2.953125 -4.578125 2.984375 -4.546875 C 3.015625 -4.523438 3.03125 -4.488281 3.03125 -4.4375 C 3.03125 -4.394531 3.015625 -4.359375 2.984375 -4.328125 C 2.953125 -4.304688 2.898438 -4.289063 2.828125 -4.28125 C 2.703125 -4.269531 2.597656 -4.21875 2.515625 -4.125 C 2.441406 -4.039063 2.40625 -3.929688 2.40625 -3.796875 L 2.40625 -2.46875 C 2.40625 -2.320313 2.378906 -2.203125 2.328125 -2.109375 C 2.285156 -2.015625 2.203125 -1.921875 2.078125 -1.828125 Z M 2.078125 -1.828125 "
+           id="path392" />
+      </g>
+      <g
+         id="glyph-2-32">
+        <path
+           d="M 0.96875 -4.515625 L 1.953125 -4.515625 L 1.6875 -2.734375 C 1.675781 -2.640625 1.648438 -2.570313 1.609375 -2.53125 C 1.566406 -2.5 1.519531 -2.484375 1.46875 -2.484375 C 1.40625 -2.484375 1.351563 -2.5 1.3125 -2.53125 C 1.269531 -2.570313 1.242188 -2.640625 1.234375 -2.734375 Z M 2.546875 -4.515625 L 3.515625 -4.515625 L 3.265625 -2.734375 C 3.242188 -2.640625 3.210938 -2.570313 3.171875 -2.53125 C 3.140625 -2.5 3.09375 -2.484375 3.03125 -2.484375 C 2.96875 -2.484375 2.914063 -2.5 2.875 -2.53125 C 2.84375 -2.570313 2.820313 -2.640625 2.8125 -2.734375 Z M 2.546875 -4.515625 "
+           id="path395" />
+      </g>
+      <g
+         id="glyph-2-33">
+        <path
+           d="M 1.640625 -1.109375 L 2.640625 -1.109375 L 1.546875 0.921875 C 1.484375 1.035156 1.40625 1.09375 1.3125 1.09375 C 1.25 1.09375 1.195313 1.070313 1.15625 1.03125 C 1.113281 0.988281 1.09375 0.9375 1.09375 0.875 C 1.09375 0.851563 1.097656 0.828125 1.109375 0.796875 Z M 1.640625 -1.109375 "
+           id="path398" />
+      </g>
+      <g
+         id="glyph-2-34">
+        <path
+           d="M 3.140625 -1.109375 L 3.140625 -1.140625 C 3.078125 -1.128906 3.019531 -1.117188 2.96875 -1.109375 C 2.925781 -1.109375 2.878906 -1.109375 2.828125 -1.109375 C 2.535156 -1.109375 2.289063 -1.203125 2.09375 -1.390625 C 1.90625 -1.578125 1.8125 -1.800781 1.8125 -2.0625 C 1.8125 -2.363281 1.925781 -2.625 2.15625 -2.84375 C 2.394531 -3.0625 2.722656 -3.171875 3.140625 -3.171875 L 3.140625 -3.515625 C 3.140625 -3.785156 3.054688 -4.003906 2.890625 -4.171875 C 2.722656 -4.347656 2.519531 -4.4375 2.28125 -4.4375 C 2.101563 -4.4375 1.9375 -4.394531 1.78125 -4.3125 C 1.675781 -4.25 1.59375 -4.171875 1.53125 -4.078125 C 1.40625 -3.929688 1.300781 -3.75 1.21875 -3.53125 C 1.132813 -3.3125 1.09375 -3.039063 1.09375 -2.71875 L 1.09375 -1.515625 C 1.09375 -1.035156 1.203125 -0.632813 1.421875 -0.3125 C 1.640625 0.0078125 1.9375 0.171875 2.3125 0.171875 C 2.675781 0.171875 2.945313 0.0820313 3.125 -0.09375 C 3.164063 -0.132813 3.207031 -0.15625 3.25 -0.15625 C 3.289063 -0.15625 3.328125 -0.140625 3.359375 -0.109375 C 3.390625 -0.078125 3.40625 -0.0390625 3.40625 0 C 3.40625 0.0703125 3.332031 0.15625 3.1875 0.25 C 2.945313 0.394531 2.640625 0.46875 2.265625 0.46875 C 2.066406 0.46875 1.882813 0.429688 1.71875 0.359375 C 1.5625 0.296875 1.425781 0.195313 1.3125 0.0625 C 1.25 -0.0078125 1.171875 -0.132813 1.078125 -0.3125 C 0.984375 -0.5 0.914063 -0.664063 0.875 -0.8125 C 0.8125 -1.007813 0.78125 -1.242188 0.78125 -1.515625 L 0.78125 -2.75 C 0.78125 -3.375 0.945313 -3.882813 1.28125 -4.28125 C 1.550781 -4.59375 1.878906 -4.75 2.265625 -4.75 C 2.460938 -4.75 2.644531 -4.707031 2.8125 -4.625 C 2.976563 -4.539063 3.125 -4.398438 3.25 -4.203125 C 3.382813 -4.003906 3.453125 -3.773438 3.453125 -3.515625 L 3.453125 -1.40625 C 3.503906 -1.40625 3.539063 -1.390625 3.5625 -1.359375 C 3.582031 -1.335938 3.59375 -1.304688 3.59375 -1.265625 C 3.59375 -1.234375 3.582031 -1.203125 3.5625 -1.171875 C 3.550781 -1.148438 3.535156 -1.132813 3.515625 -1.125 C 3.492188 -1.113281 3.453125 -1.109375 3.390625 -1.109375 Z M 3.140625 -2.859375 C 2.816406 -2.859375 2.5625 -2.78125 2.375 -2.625 C 2.195313 -2.46875 2.109375 -2.285156 2.109375 -2.078125 C 2.109375 -1.890625 2.175781 -1.734375 2.3125 -1.609375 C 2.445313 -1.484375 2.632813 -1.421875 2.875 -1.421875 C 2.914063 -1.421875 2.957031 -1.421875 3 -1.421875 C 3.050781 -1.429688 3.097656 -1.441406 3.140625 -1.453125 Z M 3.140625 -2.859375 "
+           id="path401" />
+      </g>
+      <g
+         id="glyph-2-35">
+        <path
+           d="M 2.046875 -2.859375 L 2.046875 -0.3125 L 3.40625 -0.3125 C 3.476563 -0.3125 3.53125 -0.296875 3.5625 -0.265625 C 3.59375 -0.234375 3.609375 -0.195313 3.609375 -0.15625 C 3.609375 -0.113281 3.59375 -0.078125 3.5625 -0.046875 C 3.53125 -0.015625 3.476563 0 3.40625 0 L 1 0 C 0.914063 0 0.859375 -0.015625 0.828125 -0.046875 C 0.796875 -0.078125 0.78125 -0.113281 0.78125 -0.15625 C 0.78125 -0.195313 0.796875 -0.234375 0.828125 -0.265625 C 0.859375 -0.296875 0.914063 -0.3125 1 -0.3125 L 1.734375 -0.3125 L 1.734375 -2.859375 L 1.0625 -2.859375 C 0.988281 -2.859375 0.9375 -2.875 0.90625 -2.90625 C 0.875 -2.9375 0.859375 -2.972656 0.859375 -3.015625 C 0.859375 -3.054688 0.875 -3.09375 0.90625 -3.125 C 0.9375 -3.15625 0.988281 -3.171875 1.0625 -3.171875 L 1.734375 -3.171875 L 1.734375 -3.640625 C 1.734375 -3.898438 1.835938 -4.125 2.046875 -4.3125 C 2.253906 -4.5 2.535156 -4.59375 2.890625 -4.59375 C 3.179688 -4.59375 3.488281 -4.566406 3.8125 -4.515625 C 3.9375 -4.492188 4.007813 -4.46875 4.03125 -4.4375 C 4.0625 -4.414063 4.078125 -4.382813 4.078125 -4.34375 C 4.078125 -4.300781 4.0625 -4.265625 4.03125 -4.234375 C 4 -4.203125 3.960938 -4.1875 3.921875 -4.1875 C 3.898438 -4.1875 3.863281 -4.191406 3.8125 -4.203125 C 3.445313 -4.253906 3.140625 -4.28125 2.890625 -4.28125 C 2.617188 -4.28125 2.410156 -4.210938 2.265625 -4.078125 C 2.117188 -3.953125 2.046875 -3.804688 2.046875 -3.640625 L 2.046875 -3.171875 L 3.484375 -3.171875 C 3.554688 -3.171875 3.609375 -3.15625 3.640625 -3.125 C 3.671875 -3.09375 3.6875 -3.054688 3.6875 -3.015625 C 3.6875 -2.972656 3.671875 -2.9375 3.640625 -2.90625 C 3.609375 -2.875 3.554688 -2.859375 3.484375 -2.859375 Z M 2.046875 -2.859375 "
+           id="path404" />
+      </g>
+      <g
+         id="glyph-2-36">
+        <path
+           d="M 2.4375 -1.828125 C 2.3125 -1.921875 2.226563 -2.007813 2.1875 -2.09375 C 2.125 -2.195313 2.09375 -2.320313 2.09375 -2.46875 L 2.09375 -3.796875 C 2.09375 -3.929688 2.050781 -4.039063 1.96875 -4.125 C 1.894531 -4.21875 1.796875 -4.269531 1.671875 -4.28125 C 1.597656 -4.289063 1.550781 -4.304688 1.53125 -4.328125 C 1.5 -4.359375 1.484375 -4.394531 1.484375 -4.4375 C 1.484375 -4.488281 1.5 -4.523438 1.53125 -4.546875 C 1.5625 -4.578125 1.601563 -4.59375 1.65625 -4.59375 C 1.851563 -4.59375 2.015625 -4.53125 2.140625 -4.40625 C 2.316406 -4.238281 2.40625 -4.035156 2.40625 -3.796875 L 2.40625 -2.46875 C 2.40625 -2.34375 2.445313 -2.234375 2.53125 -2.140625 C 2.613281 -2.046875 2.71875 -1.992188 2.84375 -1.984375 C 2.90625 -1.972656 2.945313 -1.953125 2.96875 -1.921875 C 3 -1.898438 3.015625 -1.867188 3.015625 -1.828125 C 3.015625 -1.773438 3 -1.734375 2.96875 -1.703125 C 2.945313 -1.679688 2.90625 -1.664063 2.84375 -1.65625 C 2.707031 -1.644531 2.597656 -1.59375 2.515625 -1.5 C 2.441406 -1.414063 2.40625 -1.304688 2.40625 -1.171875 L 2.40625 0.15625 C 2.40625 0.382813 2.332031 0.570313 2.1875 0.71875 C 2.039063 0.875 1.863281 0.953125 1.65625 0.953125 C 1.601563 0.953125 1.5625 0.9375 1.53125 0.90625 C 1.5 0.875 1.484375 0.835938 1.484375 0.796875 C 1.484375 0.753906 1.5 0.71875 1.53125 0.6875 C 1.550781 0.664063 1.597656 0.648438 1.671875 0.640625 C 1.796875 0.628906 1.894531 0.578125 1.96875 0.484375 C 2.050781 0.390625 2.09375 0.273438 2.09375 0.140625 L 2.09375 -1.171875 C 2.09375 -1.328125 2.117188 -1.453125 2.171875 -1.546875 C 2.222656 -1.640625 2.3125 -1.734375 2.4375 -1.828125 Z M 2.4375 -1.828125 "
+           id="path407" />
+      </g>
+      <g
+         id="glyph-2-37">
+        <path
+           d="M 2.875 -2.390625 C 3.132813 -2.265625 3.328125 -2.097656 3.453125 -1.890625 C 3.585938 -1.679688 3.65625 -1.460938 3.65625 -1.234375 C 3.65625 -0.867188 3.519531 -0.550781 3.25 -0.28125 C 2.976563 -0.0195313 2.644531 0.109375 2.25 0.109375 C 1.863281 0.109375 1.53125 -0.0195313 1.25 -0.28125 C 0.976563 -0.550781 0.84375 -0.867188 0.84375 -1.234375 C 0.84375 -1.460938 0.90625 -1.675781 1.03125 -1.875 C 1.164063 -2.082031 1.363281 -2.253906 1.625 -2.390625 C 1.40625 -2.515625 1.242188 -2.644531 1.140625 -2.78125 C 0.992188 -2.976563 0.921875 -3.195313 0.921875 -3.4375 C 0.921875 -3.78125 1.050781 -4.078125 1.3125 -4.328125 C 1.570313 -4.578125 1.882813 -4.703125 2.25 -4.703125 C 2.625 -4.703125 2.9375 -4.578125 3.1875 -4.328125 C 3.445313 -4.078125 3.578125 -3.78125 3.578125 -3.4375 C 3.578125 -3.195313 3.507813 -2.984375 3.375 -2.796875 C 3.269531 -2.648438 3.101563 -2.515625 2.875 -2.390625 Z M 3.265625 -3.4375 C 3.265625 -3.695313 3.164063 -3.921875 2.96875 -4.109375 C 2.769531 -4.296875 2.53125 -4.390625 2.25 -4.390625 C 1.96875 -4.390625 1.726563 -4.296875 1.53125 -4.109375 C 1.332031 -3.921875 1.234375 -3.695313 1.234375 -3.4375 C 1.234375 -3.195313 1.328125 -2.984375 1.515625 -2.796875 C 1.710938 -2.617188 1.957031 -2.53125 2.25 -2.53125 C 2.539063 -2.53125 2.78125 -2.617188 2.96875 -2.796875 C 3.164063 -2.984375 3.265625 -3.195313 3.265625 -3.4375 Z M 3.34375 -1.234375 C 3.34375 -1.503906 3.238281 -1.738281 3.03125 -1.9375 C 2.820313 -2.132813 2.5625 -2.234375 2.25 -2.234375 C 1.9375 -2.234375 1.675781 -2.132813 1.46875 -1.9375 C 1.257813 -1.738281 1.15625 -1.503906 1.15625 -1.234375 C 1.15625 -0.953125 1.257813 -0.707031 1.46875 -0.5 C 1.675781 -0.300781 1.9375 -0.203125 2.25 -0.203125 C 2.5625 -0.203125 2.820313 -0.300781 3.03125 -0.5 C 3.238281 -0.707031 3.34375 -0.953125 3.34375 -1.234375 Z M 3.34375 -1.234375 "
+           id="path410" />
+      </g>
+      <g
+         id="glyph-2-38">
+        <path
+           d="M 2.875 -2.5 C 3.164063 -2.375 3.382813 -2.195313 3.53125 -1.96875 C 3.675781 -1.75 3.75 -1.523438 3.75 -1.296875 C 3.75 -0.921875 3.597656 -0.59375 3.296875 -0.3125 C 3.003906 -0.03125 2.632813 0.109375 2.1875 0.109375 C 1.914063 0.109375 1.640625 0.0507813 1.359375 -0.0625 C 1.078125 -0.175781 0.878906 -0.289063 0.765625 -0.40625 C 0.734375 -0.445313 0.71875 -0.488281 0.71875 -0.53125 C 0.71875 -0.570313 0.726563 -0.601563 0.75 -0.625 C 0.78125 -0.65625 0.816406 -0.671875 0.859375 -0.671875 C 0.898438 -0.671875 0.941406 -0.65625 0.984375 -0.625 C 1.367188 -0.34375 1.769531 -0.203125 2.1875 -0.203125 C 2.539063 -0.203125 2.835938 -0.3125 3.078125 -0.53125 C 3.328125 -0.757813 3.453125 -1.007813 3.453125 -1.28125 C 3.453125 -1.457031 3.390625 -1.632813 3.265625 -1.8125 C 3.148438 -1.988281 2.976563 -2.128906 2.75 -2.234375 C 2.53125 -2.335938 2.304688 -2.390625 2.078125 -2.390625 C 2.003906 -2.390625 1.953125 -2.398438 1.921875 -2.421875 C 1.890625 -2.453125 1.875 -2.488281 1.875 -2.53125 C 1.875 -2.582031 1.890625 -2.617188 1.921875 -2.640625 C 1.953125 -2.671875 2 -2.6875 2.0625 -2.6875 L 2.328125 -2.6875 C 2.597656 -2.6875 2.820313 -2.769531 3 -2.9375 C 3.1875 -3.101563 3.28125 -3.300781 3.28125 -3.53125 C 3.28125 -3.757813 3.1875 -3.957031 3 -4.125 C 2.8125 -4.300781 2.566406 -4.390625 2.265625 -4.390625 C 2.046875 -4.390625 1.847656 -4.351563 1.671875 -4.28125 C 1.492188 -4.207031 1.351563 -4.109375 1.25 -3.984375 C 1.207031 -3.941406 1.175781 -3.910156 1.15625 -3.890625 C 1.132813 -3.878906 1.109375 -3.875 1.078125 -3.875 C 1.035156 -3.875 1 -3.890625 0.96875 -3.921875 C 0.945313 -3.953125 0.9375 -3.988281 0.9375 -4.03125 C 0.9375 -4.125 1.039063 -4.242188 1.25 -4.390625 C 1.550781 -4.597656 1.890625 -4.703125 2.265625 -4.703125 C 2.648438 -4.703125 2.96875 -4.582031 3.21875 -4.34375 C 3.46875 -4.113281 3.59375 -3.835938 3.59375 -3.515625 C 3.59375 -3.316406 3.53125 -3.125 3.40625 -2.9375 C 3.289063 -2.757813 3.113281 -2.613281 2.875 -2.5 Z M 2.875 -2.5 "
+           id="path413" />
+      </g>
+      <g
+         id="glyph-2-39">
+        <path
+           d="M 1.328125 -1.9375 C 1.523438 -2.21875 1.722656 -2.425781 1.921875 -2.5625 C 2.117188 -2.695313 2.34375 -2.765625 2.59375 -2.765625 C 2.914063 -2.765625 3.203125 -2.628906 3.453125 -2.359375 C 3.710938 -2.085938 3.84375 -1.75 3.84375 -1.34375 C 3.84375 -0.976563 3.726563 -0.644531 3.5 -0.34375 C 3.269531 -0.0390625 2.945313 0.109375 2.53125 0.109375 C 2.269531 0.109375 2.023438 0.03125 1.796875 -0.125 C 1.566406 -0.289063 1.382813 -0.546875 1.25 -0.890625 C 1.082031 -1.316406 1 -1.785156 1 -2.296875 C 1 -2.679688 1.078125 -3.039063 1.234375 -3.375 C 1.347656 -3.625 1.503906 -3.847656 1.703125 -4.046875 C 1.898438 -4.242188 2.128906 -4.398438 2.390625 -4.515625 C 2.648438 -4.640625 2.929688 -4.703125 3.234375 -4.703125 C 3.429688 -4.703125 3.601563 -4.660156 3.75 -4.578125 C 3.800781 -4.546875 3.828125 -4.5 3.828125 -4.4375 C 3.828125 -4.394531 3.8125 -4.359375 3.78125 -4.328125 C 3.757813 -4.296875 3.726563 -4.28125 3.6875 -4.28125 C 3.65625 -4.28125 3.617188 -4.296875 3.578125 -4.328125 C 3.472656 -4.367188 3.347656 -4.390625 3.203125 -4.390625 C 2.722656 -4.390625 2.285156 -4.1875 1.890625 -3.78125 C 1.503906 -3.375 1.3125 -2.890625 1.3125 -2.328125 C 1.3125 -2.242188 1.316406 -2.113281 1.328125 -1.9375 Z M 1.40625 -1.4375 C 1.5 -0.988281 1.644531 -0.671875 1.84375 -0.484375 C 2.039063 -0.296875 2.273438 -0.203125 2.546875 -0.203125 C 2.816406 -0.203125 3.046875 -0.304688 3.234375 -0.515625 C 3.429688 -0.734375 3.53125 -1.007813 3.53125 -1.34375 C 3.53125 -1.664063 3.429688 -1.929688 3.234375 -2.140625 C 3.046875 -2.359375 2.828125 -2.46875 2.578125 -2.46875 C 2.347656 -2.46875 2.117188 -2.363281 1.890625 -2.15625 C 1.742188 -2.019531 1.582031 -1.78125 1.40625 -1.4375 Z M 1.40625 -1.4375 "
+           id="path416" />
+      </g>
+      <g
+         id="glyph-2-40">
+        <path
+           d="M 3.515625 -2.59375 C 3.359375 -2.3125 3.171875 -2.097656 2.953125 -1.953125 C 2.734375 -1.816406 2.507813 -1.75 2.28125 -1.75 C 2.0625 -1.75 1.851563 -1.8125 1.65625 -1.9375 C 1.457031 -2.0625 1.296875 -2.238281 1.171875 -2.46875 C 1.054688 -2.707031 1 -2.957031 1 -3.21875 C 1 -3.59375 1.113281 -3.929688 1.34375 -4.234375 C 1.582031 -4.546875 1.898438 -4.703125 2.296875 -4.703125 C 2.566406 -4.703125 2.816406 -4.613281 3.046875 -4.4375 C 3.285156 -4.269531 3.46875 -4.019531 3.59375 -3.6875 C 3.75 -3.269531 3.828125 -2.78125 3.828125 -2.21875 C 3.828125 -1.78125 3.757813 -1.421875 3.625 -1.140625 C 3.53125 -0.941406 3.394531 -0.75 3.21875 -0.5625 C 3.039063 -0.382813 2.835938 -0.238281 2.609375 -0.125 C 2.304688 0.03125 1.988281 0.109375 1.65625 0.109375 C 1.4375 0.109375 1.253906 0.0664063 1.109375 -0.015625 C 1.046875 -0.0546875 1.015625 -0.101563 1.015625 -0.15625 C 1.015625 -0.195313 1.03125 -0.234375 1.0625 -0.265625 C 1.09375 -0.296875 1.128906 -0.3125 1.171875 -0.3125 C 1.203125 -0.3125 1.242188 -0.296875 1.296875 -0.265625 C 1.390625 -0.222656 1.5 -0.203125 1.625 -0.203125 C 2.144531 -0.203125 2.59375 -0.390625 2.96875 -0.765625 C 3.34375 -1.140625 3.53125 -1.609375 3.53125 -2.171875 C 3.53125 -2.273438 3.523438 -2.414063 3.515625 -2.59375 Z M 3.453125 -3.109375 C 3.328125 -3.609375 3.164063 -3.945313 2.96875 -4.125 C 2.78125 -4.300781 2.554688 -4.390625 2.296875 -4.390625 C 2.035156 -4.390625 1.804688 -4.28125 1.609375 -4.0625 C 1.410156 -3.84375 1.3125 -3.5625 1.3125 -3.21875 C 1.3125 -2.882813 1.410156 -2.609375 1.609375 -2.390625 C 1.804688 -2.171875 2.03125 -2.0625 2.28125 -2.0625 C 2.425781 -2.0625 2.566406 -2.097656 2.703125 -2.171875 C 2.847656 -2.253906 2.984375 -2.375 3.109375 -2.53125 C 3.179688 -2.632813 3.296875 -2.828125 3.453125 -3.109375 Z M 3.453125 -3.109375 "
+           id="path419" />
+      </g>
+      <g
+         id="glyph-2-41">
+        <path
+           d="M 0.921875 -0.3125 L 3.28125 -0.3125 L 3.28125 -0.421875 C 3.28125 -0.492188 3.296875 -0.546875 3.328125 -0.578125 C 3.359375 -0.617188 3.398438 -0.640625 3.453125 -0.640625 C 3.492188 -0.640625 3.523438 -0.617188 3.546875 -0.578125 C 3.578125 -0.546875 3.59375 -0.492188 3.59375 -0.421875 L 3.59375 0 L 0.625 0 L 0.625 -0.453125 C 1.25 -1.015625 1.859375 -1.585938 2.453125 -2.171875 C 2.722656 -2.441406 2.910156 -2.640625 3.015625 -2.765625 C 3.117188 -2.890625 3.1875 -3 3.21875 -3.09375 C 3.257813 -3.195313 3.28125 -3.296875 3.28125 -3.390625 C 3.28125 -3.648438 3.171875 -3.878906 2.953125 -4.078125 C 2.742188 -4.285156 2.492188 -4.390625 2.203125 -4.390625 C 1.929688 -4.390625 1.691406 -4.3125 1.484375 -4.15625 C 1.273438 -4.007813 1.140625 -3.820313 1.078125 -3.59375 C 1.066406 -3.53125 1.050781 -3.492188 1.03125 -3.484375 C 1 -3.453125 0.960938 -3.4375 0.921875 -3.4375 C 0.878906 -3.4375 0.84375 -3.453125 0.8125 -3.484375 C 0.789063 -3.515625 0.78125 -3.546875 0.78125 -3.578125 C 0.78125 -3.703125 0.84375 -3.863281 0.96875 -4.0625 C 1.09375 -4.257813 1.269531 -4.414063 1.5 -4.53125 C 1.726563 -4.644531 1.957031 -4.703125 2.1875 -4.703125 C 2.570313 -4.703125 2.898438 -4.566406 3.171875 -4.296875 C 3.453125 -4.035156 3.59375 -3.738281 3.59375 -3.40625 C 3.59375 -3.257813 3.566406 -3.125 3.515625 -3 C 3.472656 -2.882813 3.394531 -2.753906 3.28125 -2.609375 C 3.175781 -2.472656 2.976563 -2.265625 2.6875 -1.984375 C 1.96875 -1.273438 1.378906 -0.722656 0.921875 -0.328125 Z M 0.921875 -0.3125 "
+           id="path422" />
+      </g>
+      <g
+         id="glyph-2-42">
+        <path
+           d="M 2.40625 -4.28125 L 2.40625 0.640625 L 3.15625 0.640625 C 3.226563 0.640625 3.28125 0.648438 3.3125 0.671875 C 3.34375 0.703125 3.359375 0.742188 3.359375 0.796875 C 3.359375 0.835938 3.34375 0.875 3.3125 0.90625 C 3.28125 0.9375 3.226563 0.953125 3.15625 0.953125 L 2.09375 0.953125 L 2.09375 -4.59375 L 3.15625 -4.59375 C 3.226563 -4.59375 3.28125 -4.578125 3.3125 -4.546875 C 3.34375 -4.523438 3.359375 -4.488281 3.359375 -4.4375 C 3.359375 -4.394531 3.34375 -4.359375 3.3125 -4.328125 C 3.28125 -4.296875 3.226563 -4.28125 3.15625 -4.28125 Z M 2.40625 -4.28125 "
+           id="path425" />
+      </g>
+      <g
+         id="glyph-2-43">
+        <path
+           d="M 2.109375 0.640625 L 2.109375 -4.28125 L 1.359375 -4.28125 C 1.285156 -4.28125 1.234375 -4.296875 1.203125 -4.328125 C 1.171875 -4.359375 1.15625 -4.394531 1.15625 -4.4375 C 1.15625 -4.488281 1.171875 -4.523438 1.203125 -4.546875 C 1.234375 -4.578125 1.285156 -4.59375 1.359375 -4.59375 L 2.421875 -4.59375 L 2.421875 0.953125 L 1.359375 0.953125 C 1.285156 0.953125 1.234375 0.9375 1.203125 0.90625 C 1.171875 0.875 1.15625 0.835938 1.15625 0.796875 C 1.15625 0.753906 1.171875 0.71875 1.203125 0.6875 C 1.234375 0.65625 1.285156 0.640625 1.359375 0.640625 Z M 2.109375 0.640625 "
+           id="path428" />
+      </g>
+      <g
+         id="glyph-2-44">
+        <path
+           d="M 3.34375 -3.984375 L 3.34375 -4.078125 C 3.34375 -4.148438 3.359375 -4.203125 3.390625 -4.234375 C 3.421875 -4.265625 3.457031 -4.28125 3.5 -4.28125 C 3.550781 -4.28125 3.585938 -4.265625 3.609375 -4.234375 C 3.640625 -4.203125 3.65625 -4.148438 3.65625 -4.078125 L 3.65625 -3.296875 C 3.65625 -3.222656 3.640625 -3.171875 3.609375 -3.140625 C 3.585938 -3.109375 3.550781 -3.09375 3.5 -3.09375 C 3.457031 -3.09375 3.421875 -3.101563 3.390625 -3.125 C 3.367188 -3.15625 3.351563 -3.207031 3.34375 -3.28125 C 3.332031 -3.476563 3.226563 -3.660156 3.03125 -3.828125 C 2.832031 -3.992188 2.570313 -4.078125 2.25 -4.078125 C 1.914063 -4.078125 1.644531 -3.988281 1.4375 -3.8125 C 1.238281 -3.632813 1.140625 -3.429688 1.140625 -3.203125 C 1.140625 -3.078125 1.164063 -2.960938 1.21875 -2.859375 C 1.28125 -2.765625 1.359375 -2.6875 1.453125 -2.625 C 1.546875 -2.5625 1.648438 -2.507813 1.765625 -2.46875 C 1.878906 -2.425781 2.0625 -2.382813 2.3125 -2.34375 C 2.726563 -2.28125 3.015625 -2.210938 3.171875 -2.140625 C 3.390625 -2.046875 3.550781 -1.914063 3.65625 -1.75 C 3.769531 -1.582031 3.828125 -1.382813 3.828125 -1.15625 C 3.828125 -0.800781 3.6875 -0.5 3.40625 -0.25 C 3.125 0 2.742188 0.125 2.265625 0.125 C 1.734375 0.125 1.304688 -0.0390625 0.984375 -0.375 L 0.984375 -0.203125 C 0.984375 -0.128906 0.96875 -0.078125 0.9375 -0.046875 C 0.914063 -0.015625 0.878906 0 0.828125 0 C 0.785156 0 0.75 -0.015625 0.71875 -0.046875 C 0.6875 -0.078125 0.671875 -0.128906 0.671875 -0.203125 L 0.671875 -1.0625 C 0.671875 -1.132813 0.6875 -1.1875 0.71875 -1.21875 C 0.75 -1.25 0.785156 -1.265625 0.828125 -1.265625 C 0.867188 -1.265625 0.90625 -1.25 0.9375 -1.21875 C 0.96875 -1.1875 0.984375 -1.140625 0.984375 -1.078125 C 0.992188 -0.847656 1.113281 -0.640625 1.34375 -0.453125 C 1.570313 -0.273438 1.878906 -0.1875 2.265625 -0.1875 C 2.648438 -0.1875 2.953125 -0.28125 3.171875 -0.46875 C 3.398438 -0.664063 3.515625 -0.894531 3.515625 -1.15625 C 3.515625 -1.320313 3.472656 -1.46875 3.390625 -1.59375 C 3.304688 -1.71875 3.175781 -1.816406 3 -1.890625 C 2.882813 -1.941406 2.644531 -2 2.28125 -2.0625 C 1.769531 -2.144531 1.398438 -2.273438 1.171875 -2.453125 C 0.941406 -2.628906 0.828125 -2.878906 0.828125 -3.203125 C 0.828125 -3.523438 0.957031 -3.800781 1.21875 -4.03125 C 1.476563 -4.269531 1.816406 -4.390625 2.234375 -4.390625 C 2.671875 -4.390625 3.039063 -4.253906 3.34375 -3.984375 Z M 3.34375 -3.984375 "
+           id="path431" />
+      </g>
+      <g
+         id="glyph-2-45">
+        <path
+           d="M 3.8125 -2.34375 L 3.8125 -1.90625 L 0.6875 -1.90625 L 0.6875 -2.34375 Z M 3.8125 -2.34375 "
+           id="path434" />
+      </g>
+      <g
+         id="glyph-2-46">
+        <path
+           d="M 3.609375 -3.859375 L 3.609375 -4.078125 C 3.609375 -4.148438 3.617188 -4.203125 3.640625 -4.234375 C 3.671875 -4.265625 3.707031 -4.28125 3.75 -4.28125 C 3.800781 -4.28125 3.835938 -4.265625 3.859375 -4.234375 C 3.890625 -4.203125 3.90625 -4.148438 3.90625 -4.078125 L 3.90625 -3.21875 C 3.90625 -3.144531 3.890625 -3.09375 3.859375 -3.0625 C 3.835938 -3.03125 3.800781 -3.015625 3.75 -3.015625 C 3.707031 -3.015625 3.671875 -3.03125 3.640625 -3.0625 C 3.617188 -3.09375 3.609375 -3.140625 3.609375 -3.203125 C 3.585938 -3.410156 3.472656 -3.59375 3.265625 -3.75 C 2.984375 -3.96875 2.660156 -4.078125 2.296875 -4.078125 C 2.066406 -4.078125 1.847656 -4.023438 1.640625 -3.921875 C 1.484375 -3.847656 1.359375 -3.753906 1.265625 -3.640625 C 1.097656 -3.453125 0.96875 -3.238281 0.875 -3 C 0.800781 -2.832031 0.765625 -2.640625 0.765625 -2.421875 L 0.765625 -1.890625 C 0.765625 -1.429688 0.929688 -1.03125 1.265625 -0.6875 C 1.597656 -0.351563 1.984375 -0.1875 2.421875 -0.1875 C 2.691406 -0.1875 2.929688 -0.242188 3.140625 -0.359375 C 3.347656 -0.472656 3.550781 -0.644531 3.75 -0.875 C 3.789063 -0.925781 3.832031 -0.953125 3.875 -0.953125 C 3.925781 -0.953125 3.960938 -0.9375 3.984375 -0.90625 C 4.015625 -0.882813 4.03125 -0.851563 4.03125 -0.8125 C 4.03125 -0.757813 3.976563 -0.675781 3.875 -0.5625 C 3.675781 -0.332031 3.445313 -0.160156 3.1875 -0.046875 C 2.9375 0.0664063 2.6875 0.125 2.4375 0.125 C 2.21875 0.125 1.992188 0.0820313 1.765625 0 C 1.585938 -0.0703125 1.441406 -0.148438 1.328125 -0.234375 C 1.210938 -0.328125 1.066406 -0.476563 0.890625 -0.6875 C 0.722656 -0.894531 0.609375 -1.085938 0.546875 -1.265625 C 0.492188 -1.441406 0.46875 -1.632813 0.46875 -1.84375 L 0.46875 -2.46875 C 0.46875 -2.769531 0.546875 -3.078125 0.703125 -3.390625 C 0.867188 -3.710938 1.09375 -3.957031 1.375 -4.125 C 1.65625 -4.300781 1.960938 -4.390625 2.296875 -4.390625 C 2.796875 -4.390625 3.234375 -4.210938 3.609375 -3.859375 Z M 3.609375 -3.859375 "
+           id="path437" />
+      </g>
+      <g
+         id="glyph-3-0">
+        <path
+           d="M 0.375 0 L 0.375 -4.6875 L 4.125 -4.6875 L 4.125 0 Z M 0.5 -0.125 L 4.015625 -0.125 L 4.015625 -4.578125 L 0.5 -4.578125 Z M 0.5 -0.125 "
+           id="path440" />
+      </g>
+      <g
+         id="glyph-3-1">
+        <path
+           d="M 4.203125 -1.59375 C 4.203125 -1.3125 4.117188 -1.035156 3.953125 -0.765625 C 3.796875 -0.492188 3.554688 -0.273438 3.234375 -0.109375 C 2.921875 0.046875 2.59375 0.125 2.25 0.125 C 1.914063 0.125 1.59375 0.046875 1.28125 -0.109375 C 0.96875 -0.273438 0.726563 -0.492188 0.5625 -0.765625 C 0.394531 -1.035156 0.3125 -1.316406 0.3125 -1.609375 C 0.3125 -1.910156 0.394531 -2.203125 0.5625 -2.484375 C 0.726563 -2.773438 0.96875 -3.003906 1.28125 -3.171875 C 1.59375 -3.335938 1.914063 -3.421875 2.25 -3.421875 C 2.59375 -3.421875 2.921875 -3.335938 3.234375 -3.171875 C 3.554688 -3.003906 3.796875 -2.773438 3.953125 -2.484375 C 4.117188 -2.191406 4.203125 -1.894531 4.203125 -1.59375 Z M 3.453125 -1.59375 C 3.453125 -1.832031 3.363281 -2.054688 3.1875 -2.265625 C 2.945313 -2.535156 2.632813 -2.671875 2.25 -2.671875 C 1.914063 -2.671875 1.632813 -2.5625 1.40625 -2.34375 C 1.175781 -2.125 1.0625 -1.875 1.0625 -1.59375 C 1.0625 -1.351563 1.175781 -1.128906 1.40625 -0.921875 C 1.632813 -0.722656 1.914063 -0.625 2.25 -0.625 C 2.59375 -0.625 2.878906 -0.722656 3.109375 -0.921875 C 3.335938 -1.128906 3.453125 -1.351563 3.453125 -1.59375 Z M 3.453125 -1.59375 "
+           id="path443" />
+      </g>
+      <g
+         id="glyph-3-2">
+        <path
+           d="M 1.3125 -0.40625 L 1.3125 0.8125 L 1.765625 0.8125 C 1.953125 0.8125 2.082031 0.847656 2.15625 0.921875 C 2.226563 0.992188 2.265625 1.082031 2.265625 1.1875 C 2.265625 1.300781 2.226563 1.390625 2.15625 1.453125 C 2.082031 1.523438 1.953125 1.5625 1.765625 1.5625 L 0.4375 1.5625 C 0.257813 1.5625 0.128906 1.523438 0.046875 1.453125 C -0.0234375 1.390625 -0.0625 1.300781 -0.0625 1.1875 C -0.0625 1.082031 -0.0234375 0.992188 0.046875 0.921875 C 0.128906 0.847656 0.257813 0.8125 0.4375 0.8125 L 0.5625 0.8125 L 0.5625 -2.578125 L 0.4375 -2.578125 C 0.257813 -2.578125 0.128906 -2.609375 0.046875 -2.671875 C -0.0234375 -2.742188 -0.0625 -2.835938 -0.0625 -2.953125 C -0.0625 -3.054688 -0.0234375 -3.144531 0.046875 -3.21875 C 0.128906 -3.289063 0.257813 -3.328125 0.4375 -3.328125 L 1.3125 -3.328125 L 1.3125 -3.0625 C 1.488281 -3.1875 1.671875 -3.273438 1.859375 -3.328125 C 2.046875 -3.390625 2.238281 -3.421875 2.4375 -3.421875 C 2.957031 -3.421875 3.394531 -3.242188 3.75 -2.890625 C 4.113281 -2.546875 4.296875 -2.148438 4.296875 -1.703125 C 4.296875 -1.210938 4.082031 -0.804688 3.65625 -0.484375 C 3.300781 -0.210938 2.898438 -0.078125 2.453125 -0.078125 C 2.253906 -0.078125 2.0625 -0.101563 1.875 -0.15625 C 1.6875 -0.21875 1.5 -0.300781 1.3125 -0.40625 Z M 3.546875 -1.703125 C 3.546875 -1.804688 3.503906 -1.9375 3.421875 -2.09375 C 3.335938 -2.257813 3.207031 -2.394531 3.03125 -2.5 C 2.863281 -2.613281 2.664063 -2.671875 2.4375 -2.671875 C 2.0625 -2.671875 1.765625 -2.53125 1.546875 -2.25 C 1.390625 -2.0625 1.3125 -1.878906 1.3125 -1.703125 C 1.3125 -1.492188 1.414063 -1.296875 1.625 -1.109375 C 1.84375 -0.921875 2.113281 -0.828125 2.4375 -0.828125 C 2.75 -0.828125 3.007813 -0.921875 3.21875 -1.109375 C 3.4375 -1.296875 3.546875 -1.492188 3.546875 -1.703125 Z M 3.546875 -1.703125 "
+           id="path446" />
+      </g>
+      <g
+         id="glyph-3-3">
+        <path
+           d="M 4.140625 -1.28125 L 1.0625 -1.28125 C 1.132813 -1.082031 1.269531 -0.921875 1.46875 -0.796875 C 1.664063 -0.679688 1.9375 -0.625 2.28125 -0.625 C 2.5625 -0.625 2.929688 -0.6875 3.390625 -0.8125 C 3.578125 -0.851563 3.707031 -0.875 3.78125 -0.875 C 3.882813 -0.875 3.96875 -0.835938 4.03125 -0.765625 C 4.101563 -0.703125 4.140625 -0.617188 4.140625 -0.515625 C 4.140625 -0.410156 4.101563 -0.328125 4.03125 -0.265625 C 3.925781 -0.171875 3.6875 -0.0820313 3.3125 0 C 2.9375 0.0820313 2.570313 0.125 2.21875 0.125 C 1.625 0.125 1.144531 -0.0390625 0.78125 -0.375 C 0.414063 -0.71875 0.234375 -1.140625 0.234375 -1.640625 C 0.234375 -2.171875 0.425781 -2.597656 0.8125 -2.921875 C 1.207031 -3.253906 1.660156 -3.421875 2.171875 -3.421875 C 2.472656 -3.421875 2.75 -3.367188 3 -3.265625 C 3.257813 -3.160156 3.453125 -3.046875 3.578125 -2.921875 C 3.753906 -2.734375 3.898438 -2.507813 4.015625 -2.25 C 4.097656 -2.0625 4.140625 -1.84375 4.140625 -1.59375 Z M 3.296875 -2.03125 C 3.179688 -2.25 3.03125 -2.410156 2.84375 -2.515625 C 2.664063 -2.617188 2.445313 -2.671875 2.1875 -2.671875 C 1.9375 -2.671875 1.71875 -2.617188 1.53125 -2.515625 C 1.34375 -2.410156 1.191406 -2.25 1.078125 -2.03125 Z M 3.296875 -2.03125 "
+           id="path449" />
+      </g>
+      <g
+         id="glyph-3-4">
+        <path
+           d="M 1.484375 -3.328125 L 1.484375 -3.078125 C 1.628906 -3.191406 1.78125 -3.273438 1.9375 -3.328125 C 2.101563 -3.390625 2.285156 -3.421875 2.484375 -3.421875 C 2.921875 -3.421875 3.269531 -3.285156 3.53125 -3.015625 C 3.738281 -2.796875 3.84375 -2.503906 3.84375 -2.140625 L 3.84375 -0.75 C 4 -0.75 4.113281 -0.710938 4.1875 -0.640625 C 4.269531 -0.578125 4.3125 -0.488281 4.3125 -0.375 C 4.3125 -0.257813 4.269531 -0.164063 4.1875 -0.09375 C 4.113281 -0.03125 3.988281 0 3.8125 0 L 3.125 0 C 2.945313 0 2.816406 -0.03125 2.734375 -0.09375 C 2.660156 -0.164063 2.625 -0.257813 2.625 -0.375 C 2.625 -0.488281 2.660156 -0.578125 2.734375 -0.640625 C 2.816406 -0.710938 2.9375 -0.75 3.09375 -0.75 L 3.09375 -2.171875 C 3.09375 -2.328125 3.046875 -2.445313 2.953125 -2.53125 C 2.835938 -2.625 2.664063 -2.671875 2.4375 -2.671875 C 2.269531 -2.671875 2.117188 -2.632813 1.984375 -2.5625 C 1.859375 -2.5 1.691406 -2.359375 1.484375 -2.140625 L 1.484375 -0.75 C 1.679688 -0.75 1.804688 -0.734375 1.859375 -0.703125 C 1.984375 -0.628906 2.046875 -0.519531 2.046875 -0.375 C 2.046875 -0.257813 2.003906 -0.164063 1.921875 -0.09375 C 1.847656 -0.03125 1.722656 0 1.546875 0 L 0.6875 0 C 0.507813 0 0.378906 -0.03125 0.296875 -0.09375 C 0.222656 -0.164063 0.1875 -0.257813 0.1875 -0.375 C 0.1875 -0.507813 0.242188 -0.617188 0.359375 -0.703125 C 0.421875 -0.734375 0.546875 -0.75 0.734375 -0.75 L 0.734375 -2.578125 C 0.578125 -2.578125 0.460938 -2.609375 0.390625 -2.671875 C 0.316406 -2.742188 0.28125 -2.835938 0.28125 -2.953125 C 0.28125 -3.054688 0.316406 -3.144531 0.390625 -3.21875 C 0.460938 -3.289063 0.59375 -3.328125 0.78125 -3.328125 Z M 1.484375 -3.328125 "
+           id="path452" />
+      </g>
+      <g
+         id="glyph-3-5">
+        <path
+           d="M 2.515625 -4.75 L 2.515625 -3.953125 L 1.625 -3.953125 L 1.625 -4.75 Z M 2.625 -3.328125 L 2.625 -0.75 L 3.515625 -0.75 C 3.703125 -0.75 3.832031 -0.710938 3.90625 -0.640625 C 3.988281 -0.578125 4.03125 -0.488281 4.03125 -0.375 C 4.03125 -0.257813 3.988281 -0.164063 3.90625 -0.09375 C 3.832031 -0.03125 3.703125 0 3.515625 0 L 0.96875 0 C 0.789063 0 0.660156 -0.03125 0.578125 -0.09375 C 0.503906 -0.164063 0.46875 -0.257813 0.46875 -0.375 C 0.46875 -0.488281 0.503906 -0.578125 0.578125 -0.640625 C 0.660156 -0.710938 0.789063 -0.75 0.96875 -0.75 L 1.875 -0.75 L 1.875 -2.578125 L 1.265625 -2.578125 C 1.085938 -2.578125 0.957031 -2.609375 0.875 -2.671875 C 0.800781 -2.742188 0.765625 -2.835938 0.765625 -2.953125 C 0.765625 -3.054688 0.800781 -3.144531 0.875 -3.21875 C 0.957031 -3.289063 1.085938 -3.328125 1.265625 -3.328125 Z M 2.625 -3.328125 "
+           id="path455" />
+      </g>
+      <g
+         id="glyph-3-6">
+        <path
+           d="M 3.96875 -4.75 L 3.96875 -0.75 L 4.109375 -0.75 C 4.285156 -0.75 4.410156 -0.710938 4.484375 -0.640625 C 4.566406 -0.578125 4.609375 -0.488281 4.609375 -0.375 C 4.609375 -0.257813 4.566406 -0.164063 4.484375 -0.09375 C 4.410156 -0.03125 4.285156 0 4.109375 0 L 3.21875 0 L 3.21875 -0.1875 C 3.050781 -0.0820313 2.875 -0.00390625 2.6875 0.046875 C 2.5 0.0976563 2.304688 0.125 2.109375 0.125 C 1.546875 0.125 1.09375 -0.0351563 0.75 -0.359375 C 0.40625 -0.691406 0.234375 -1.097656 0.234375 -1.578125 C 0.234375 -2.085938 0.410156 -2.519531 0.765625 -2.875 C 1.128906 -3.238281 1.570313 -3.421875 2.09375 -3.421875 C 2.289063 -3.421875 2.484375 -3.390625 2.671875 -3.328125 C 2.859375 -3.273438 3.039063 -3.1875 3.21875 -3.0625 L 3.21875 -4 L 3.09375 -4 C 2.914063 -4 2.785156 -4.03125 2.703125 -4.09375 C 2.628906 -4.164063 2.59375 -4.257813 2.59375 -4.375 C 2.59375 -4.488281 2.628906 -4.578125 2.703125 -4.640625 C 2.785156 -4.710938 2.914063 -4.75 3.09375 -4.75 Z M 3.21875 -1.5625 C 3.21875 -1.875 3.109375 -2.132813 2.890625 -2.34375 C 2.679688 -2.5625 2.414063 -2.671875 2.09375 -2.671875 C 1.78125 -2.671875 1.515625 -2.5625 1.296875 -2.34375 C 1.085938 -2.132813 0.984375 -1.878906 0.984375 -1.578125 C 0.984375 -1.296875 1.078125 -1.066406 1.265625 -0.890625 C 1.460938 -0.710938 1.738281 -0.625 2.09375 -0.625 C 2.445313 -0.625 2.722656 -0.710938 2.921875 -0.890625 C 3.117188 -1.066406 3.21875 -1.289063 3.21875 -1.5625 Z M 3.21875 -1.5625 "
+           id="path458" />
+      </g>
+      <g
+         id="glyph-3-7">
+        <path
+           d="M 2.078125 -1.015625 L 3.078125 -1.015625 L 2 1.03125 C 1.9375 1.144531 1.859375 1.203125 1.765625 1.203125 C 1.691406 1.203125 1.632813 1.179688 1.59375 1.140625 C 1.550781 1.097656 1.53125 1.050781 1.53125 1 C 1.53125 0.96875 1.535156 0.921875 1.546875 0.859375 Z M 2.078125 -1.015625 "
+           id="path461" />
+      </g>
+      <g
+         id="glyph-3-8">
+        <path
+           d="M 2.09375 -3.328125 L 2.09375 -2.859375 C 2.40625 -3.085938 2.648438 -3.238281 2.828125 -3.3125 C 3.015625 -3.382813 3.1875 -3.421875 3.34375 -3.421875 C 3.59375 -3.421875 3.832031 -3.332031 4.0625 -3.15625 C 4.21875 -3.03125 4.296875 -2.90625 4.296875 -2.78125 C 4.296875 -2.675781 4.257813 -2.582031 4.1875 -2.5 C 4.113281 -2.425781 4.023438 -2.390625 3.921875 -2.390625 C 3.828125 -2.390625 3.726563 -2.4375 3.625 -2.53125 C 3.519531 -2.625 3.425781 -2.671875 3.34375 -2.671875 C 3.238281 -2.671875 3.082031 -2.601563 2.875 -2.46875 C 2.664063 -2.34375 2.40625 -2.144531 2.09375 -1.875 L 2.09375 -0.75 L 3.171875 -0.75 C 3.347656 -0.75 3.472656 -0.710938 3.546875 -0.640625 C 3.628906 -0.578125 3.671875 -0.488281 3.671875 -0.375 C 3.671875 -0.257813 3.628906 -0.164063 3.546875 -0.09375 C 3.472656 -0.03125 3.347656 0 3.171875 0 L 0.890625 0 C 0.710938 0 0.582031 -0.03125 0.5 -0.09375 C 0.425781 -0.164063 0.390625 -0.257813 0.390625 -0.375 C 0.390625 -0.488281 0.425781 -0.578125 0.5 -0.640625 C 0.582031 -0.710938 0.710938 -0.75 0.890625 -0.75 L 1.34375 -0.75 L 1.34375 -2.578125 L 1.078125 -2.578125 C 0.890625 -2.578125 0.757813 -2.609375 0.6875 -2.671875 C 0.613281 -2.742188 0.578125 -2.835938 0.578125 -2.953125 C 0.578125 -3.054688 0.613281 -3.144531 0.6875 -3.21875 C 0.757813 -3.289063 0.890625 -3.328125 1.078125 -3.328125 Z M 2.09375 -3.328125 "
+           id="path464" />
+      </g>
+      <g
+         id="glyph-3-9">
+        <path
+           d="M 2.25 -2.578125 L 2.25 -0.75 L 3.3125 -0.75 C 3.488281 -0.75 3.613281 -0.710938 3.6875 -0.640625 C 3.769531 -0.578125 3.8125 -0.488281 3.8125 -0.375 C 3.8125 -0.257813 3.769531 -0.164063 3.6875 -0.09375 C 3.613281 -0.03125 3.488281 0 3.3125 0 L 1.046875 0 C 0.867188 0 0.738281 -0.03125 0.65625 -0.09375 C 0.582031 -0.164063 0.546875 -0.257813 0.546875 -0.375 C 0.546875 -0.488281 0.582031 -0.578125 0.65625 -0.640625 C 0.738281 -0.710938 0.867188 -0.75 1.046875 -0.75 L 1.5 -0.75 L 1.5 -2.578125 L 1.140625 -2.578125 C 0.953125 -2.578125 0.820313 -2.609375 0.75 -2.671875 C 0.675781 -2.742188 0.640625 -2.835938 0.640625 -2.953125 C 0.640625 -3.054688 0.675781 -3.144531 0.75 -3.21875 C 0.820313 -3.289063 0.953125 -3.328125 1.140625 -3.328125 L 1.5 -3.328125 L 1.5 -3.609375 C 1.5 -3.941406 1.617188 -4.210938 1.859375 -4.421875 C 2.109375 -4.640625 2.46875 -4.75 2.9375 -4.75 C 3.132813 -4.75 3.367188 -4.726563 3.640625 -4.6875 C 3.921875 -4.65625 4.097656 -4.601563 4.171875 -4.53125 C 4.242188 -4.46875 4.28125 -4.378906 4.28125 -4.265625 C 4.28125 -4.148438 4.242188 -4.054688 4.171875 -3.984375 C 4.109375 -3.910156 4.03125 -3.875 3.9375 -3.875 C 3.882813 -3.875 3.8125 -3.882813 3.71875 -3.90625 C 3.414063 -3.96875 3.144531 -4 2.90625 -4 C 2.65625 -4 2.484375 -3.960938 2.390625 -3.890625 C 2.296875 -3.816406 2.25 -3.722656 2.25 -3.609375 L 2.25 -3.328125 L 3.40625 -3.328125 C 3.582031 -3.328125 3.707031 -3.289063 3.78125 -3.21875 C 3.863281 -3.144531 3.90625 -3.054688 3.90625 -2.953125 C 3.90625 -2.835938 3.863281 -2.742188 3.78125 -2.671875 C 3.707031 -2.609375 3.582031 -2.578125 3.40625 -2.578125 Z M 2.25 -2.578125 "
+           id="path467" />
+      </g>
+      <g
+         id="glyph-3-10">
+        <path
+           d="M 2.625 -4.75 L 2.625 -0.75 L 3.53125 -0.75 C 3.707031 -0.75 3.832031 -0.710938 3.90625 -0.640625 C 3.988281 -0.578125 4.03125 -0.488281 4.03125 -0.375 C 4.03125 -0.257813 3.988281 -0.164063 3.90625 -0.09375 C 3.832031 -0.03125 3.707031 0 3.53125 0 L 0.96875 0 C 0.789063 0 0.660156 -0.03125 0.578125 -0.09375 C 0.503906 -0.164063 0.46875 -0.257813 0.46875 -0.375 C 0.46875 -0.488281 0.503906 -0.578125 0.578125 -0.640625 C 0.660156 -0.710938 0.789063 -0.75 0.96875 -0.75 L 1.875 -0.75 L 1.875 -4 L 1.265625 -4 C 1.085938 -4 0.957031 -4.03125 0.875 -4.09375 C 0.800781 -4.164063 0.765625 -4.257813 0.765625 -4.375 C 0.765625 -4.488281 0.800781 -4.578125 0.875 -4.640625 C 0.957031 -4.710938 1.085938 -4.75 1.265625 -4.75 Z M 2.625 -4.75 "
+           id="path470" />
+      </g>
+      <g
+         id="glyph-3-11">
+        <path
+           d="M 1.09375 -3.328125 L 1.09375 -3.109375 C 1.21875 -3.234375 1.328125 -3.316406 1.421875 -3.359375 C 1.523438 -3.398438 1.640625 -3.421875 1.765625 -3.421875 C 1.878906 -3.421875 1.988281 -3.394531 2.09375 -3.34375 C 2.195313 -3.289063 2.300781 -3.210938 2.40625 -3.109375 C 2.53125 -3.210938 2.660156 -3.289063 2.796875 -3.34375 C 2.929688 -3.394531 3.066406 -3.421875 3.203125 -3.421875 C 3.484375 -3.421875 3.710938 -3.347656 3.890625 -3.203125 C 4.117188 -3.003906 4.234375 -2.75 4.234375 -2.4375 L 4.234375 -0.75 C 4.390625 -0.75 4.503906 -0.710938 4.578125 -0.640625 C 4.648438 -0.566406 4.6875 -0.476563 4.6875 -0.375 C 4.6875 -0.257813 4.648438 -0.164063 4.578125 -0.09375 C 4.503906 -0.03125 4.375 0 4.1875 0 L 3.484375 0 L 3.484375 -2.375 C 3.484375 -2.488281 3.460938 -2.566406 3.421875 -2.609375 C 3.378906 -2.648438 3.3125 -2.671875 3.21875 -2.671875 C 3.144531 -2.671875 3.070313 -2.648438 3 -2.609375 C 2.90625 -2.546875 2.796875 -2.429688 2.671875 -2.265625 L 2.671875 -0.75 C 2.828125 -0.75 2.941406 -0.710938 3.015625 -0.640625 C 3.085938 -0.566406 3.125 -0.476563 3.125 -0.375 C 3.125 -0.257813 3.085938 -0.164063 3.015625 -0.09375 C 2.941406 -0.03125 2.8125 0 2.625 0 L 1.921875 0 L 1.921875 -2.375 C 1.921875 -2.476563 1.894531 -2.550781 1.84375 -2.59375 C 1.800781 -2.644531 1.738281 -2.671875 1.65625 -2.671875 C 1.570313 -2.671875 1.484375 -2.644531 1.390625 -2.59375 C 1.304688 -2.539063 1.207031 -2.429688 1.09375 -2.265625 L 1.09375 -0.75 C 1.25 -0.75 1.363281 -0.710938 1.4375 -0.640625 C 1.519531 -0.566406 1.5625 -0.476563 1.5625 -0.375 C 1.5625 -0.257813 1.519531 -0.164063 1.4375 -0.09375 C 1.363281 -0.03125 1.238281 0 1.0625 0 L 0.375 0 C 0.195313 0 0.0703125 -0.03125 0 -0.09375 C -0.0820313 -0.164063 -0.125 -0.257813 -0.125 -0.375 C -0.125 -0.488281 -0.0820313 -0.578125 0 -0.640625 C 0.0703125 -0.710938 0.1875 -0.75 0.34375 -0.75 L 0.34375 -2.578125 C 0.1875 -2.578125 0.0703125 -2.609375 0 -2.671875 C -0.0820313 -2.742188 -0.125 -2.835938 -0.125 -2.953125 C -0.125 -3.054688 -0.0820313 -3.144531 0 -3.21875 C 0.0703125 -3.289063 0.195313 -3.328125 0.375 -3.328125 Z M 1.09375 -3.328125 "
+           id="path473" />
+      </g>
+      <g
+         id="glyph-3-12">
+        <path
+           d="M 2.921875 0 L 2.921875 -0.171875 C 2.734375 -0.078125 2.523438 -0.00390625 2.296875 0.046875 C 2.078125 0.0976563 1.875 0.125 1.6875 0.125 C 1.28125 0.125 0.953125 0.0195313 0.703125 -0.1875 C 0.453125 -0.40625 0.328125 -0.644531 0.328125 -0.90625 C 0.328125 -1.21875 0.488281 -1.507813 0.8125 -1.78125 C 1.132813 -2.050781 1.578125 -2.1875 2.140625 -2.1875 C 2.367188 -2.1875 2.628906 -2.160156 2.921875 -2.109375 L 2.921875 -2.296875 C 2.921875 -2.410156 2.875 -2.5 2.78125 -2.5625 C 2.6875 -2.632813 2.503906 -2.671875 2.234375 -2.671875 C 2.003906 -2.671875 1.710938 -2.628906 1.359375 -2.546875 C 1.234375 -2.515625 1.132813 -2.5 1.0625 -2.5 C 0.957031 -2.5 0.867188 -2.53125 0.796875 -2.59375 C 0.734375 -2.664063 0.703125 -2.757813 0.703125 -2.875 C 0.703125 -2.9375 0.710938 -2.988281 0.734375 -3.03125 C 0.753906 -3.082031 0.785156 -3.125 0.828125 -3.15625 C 0.878906 -3.1875 0.972656 -3.21875 1.109375 -3.25 C 1.296875 -3.300781 1.484375 -3.34375 1.671875 -3.375 C 1.867188 -3.40625 2.046875 -3.421875 2.203125 -3.421875 C 2.671875 -3.421875 3.03125 -3.316406 3.28125 -3.109375 C 3.539063 -2.910156 3.671875 -2.640625 3.671875 -2.296875 L 3.671875 -0.75 L 3.8125 -0.75 C 3.988281 -0.75 4.113281 -0.710938 4.1875 -0.640625 C 4.269531 -0.578125 4.3125 -0.488281 4.3125 -0.375 C 4.3125 -0.257813 4.269531 -0.164063 4.1875 -0.09375 C 4.113281 -0.03125 3.988281 0 3.8125 0 Z M 2.921875 -1.34375 C 2.617188 -1.40625 2.34375 -1.4375 2.09375 -1.4375 C 1.789063 -1.4375 1.53125 -1.359375 1.3125 -1.203125 C 1.175781 -1.109375 1.109375 -1.015625 1.109375 -0.921875 C 1.109375 -0.847656 1.140625 -0.789063 1.203125 -0.75 C 1.328125 -0.664063 1.492188 -0.625 1.703125 -0.625 C 1.878906 -0.625 2.082031 -0.660156 2.3125 -0.734375 C 2.539063 -0.804688 2.742188 -0.898438 2.921875 -1.015625 Z M 2.921875 -1.34375 "
+           id="path476" />
+      </g>
+      <g
+         id="glyph-4-0">
+        <path
+           d="M 0.421875 0 L 0.421875 -5.15625 L 4.546875 -5.15625 L 4.546875 0 Z M 0.546875 -0.125 L 4.40625 -0.125 L 4.40625 -5.03125 L 0.546875 -5.03125 Z M 0.546875 -0.125 "
+           id="path479" />
+      </g>
+      <g
+         id="glyph-4-1">
+        <path
+           d="M 3.609375 -2.875 L 3.609375 -3.484375 L 4.40625 -3.484375 C 4.488281 -3.484375 4.546875 -3.46875 4.578125 -3.4375 C 4.609375 -3.40625 4.625 -3.363281 4.625 -3.3125 C 4.625 -3.269531 4.609375 -3.226563 4.578125 -3.1875 C 4.546875 -3.15625 4.488281 -3.140625 4.40625 -3.140625 L 3.953125 -3.140625 L 3.953125 0.234375 C 3.953125 0.460938 3.90625 0.664063 3.8125 0.84375 C 3.738281 0.957031 3.628906 1.078125 3.484375 1.203125 C 3.335938 1.328125 3.203125 1.414063 3.078125 1.46875 C 2.953125 1.53125 2.785156 1.5625 2.578125 1.5625 L 1.625 1.5625 C 1.539063 1.5625 1.476563 1.546875 1.4375 1.515625 C 1.40625 1.484375 1.390625 1.441406 1.390625 1.390625 C 1.390625 1.335938 1.40625 1.296875 1.4375 1.265625 C 1.476563 1.234375 1.539063 1.21875 1.625 1.21875 L 2.59375 1.21875 C 2.789063 1.21875 2.96875 1.164063 3.125 1.0625 C 3.289063 0.957031 3.425781 0.804688 3.53125 0.609375 C 3.582031 0.503906 3.609375 0.363281 3.609375 0.1875 L 3.609375 -0.828125 C 3.242188 -0.328125 2.78125 -0.078125 2.21875 -0.078125 C 1.75 -0.078125 1.34375 -0.25 1 -0.59375 C 0.664063 -0.945313 0.5 -1.363281 0.5 -1.84375 C 0.5 -2.332031 0.664063 -2.75 1 -3.09375 C 1.34375 -3.4375 1.75 -3.609375 2.21875 -3.609375 C 2.78125 -3.609375 3.242188 -3.363281 3.609375 -2.875 Z M 3.609375 -1.84375 C 3.609375 -2.238281 3.472656 -2.570313 3.203125 -2.84375 C 2.929688 -3.125 2.609375 -3.265625 2.234375 -3.265625 C 1.847656 -3.265625 1.519531 -3.125 1.25 -2.84375 C 0.976563 -2.570313 0.84375 -2.238281 0.84375 -1.84375 C 0.84375 -1.445313 0.976563 -1.109375 1.25 -0.828125 C 1.519531 -0.554688 1.847656 -0.421875 2.234375 -0.421875 C 2.609375 -0.421875 2.929688 -0.554688 3.203125 -0.828125 C 3.472656 -1.109375 3.609375 -1.445313 3.609375 -1.84375 Z M 3.609375 -1.84375 "
+           id="path482" />
+      </g>
+      <g
+         id="glyph-4-2">
+        <path
+           d="M 2.078125 -3.484375 L 2.078125 -2.640625 C 2.515625 -3.035156 2.84375 -3.289063 3.0625 -3.40625 C 3.28125 -3.519531 3.484375 -3.578125 3.671875 -3.578125 C 3.867188 -3.578125 4.050781 -3.507813 4.21875 -3.375 C 4.394531 -3.238281 4.484375 -3.132813 4.484375 -3.0625 C 4.484375 -3.007813 4.46875 -2.96875 4.4375 -2.9375 C 4.40625 -2.90625 4.363281 -2.890625 4.3125 -2.890625 C 4.28125 -2.890625 4.253906 -2.890625 4.234375 -2.890625 C 4.222656 -2.898438 4.191406 -2.929688 4.140625 -2.984375 C 4.046875 -3.078125 3.960938 -3.140625 3.890625 -3.171875 C 3.816406 -3.210938 3.75 -3.234375 3.6875 -3.234375 C 3.539063 -3.234375 3.363281 -3.171875 3.15625 -3.046875 C 2.945313 -2.929688 2.585938 -2.644531 2.078125 -2.1875 L 2.078125 -0.34375 L 3.5625 -0.34375 C 3.644531 -0.34375 3.703125 -0.328125 3.734375 -0.296875 C 3.773438 -0.265625 3.796875 -0.222656 3.796875 -0.171875 C 3.796875 -0.117188 3.773438 -0.078125 3.734375 -0.046875 C 3.703125 -0.015625 3.644531 0 3.5625 0 L 0.921875 0 C 0.835938 0 0.773438 -0.015625 0.734375 -0.046875 C 0.703125 -0.078125 0.6875 -0.117188 0.6875 -0.171875 C 0.6875 -0.210938 0.703125 -0.25 0.734375 -0.28125 C 0.773438 -0.3125 0.835938 -0.328125 0.921875 -0.328125 L 1.734375 -0.328125 L 1.734375 -3.140625 L 1.109375 -3.140625 C 1.023438 -3.140625 0.960938 -3.15625 0.921875 -3.1875 C 0.890625 -3.226563 0.875 -3.269531 0.875 -3.3125 C 0.875 -3.363281 0.890625 -3.40625 0.921875 -3.4375 C 0.960938 -3.46875 1.023438 -3.484375 1.109375 -3.484375 Z M 2.078125 -3.484375 "
+           id="path485" />
+      </g>
+      <g
+         id="glyph-4-3">
+        <path
+           d="M 4.359375 -1.734375 C 4.359375 -1.222656 4.175781 -0.78125 3.8125 -0.40625 C 3.445313 -0.0390625 3.003906 0.140625 2.484375 0.140625 C 1.953125 0.140625 1.5 -0.0390625 1.125 -0.40625 C 0.757813 -0.78125 0.578125 -1.222656 0.578125 -1.734375 C 0.578125 -2.253906 0.757813 -2.695313 1.125 -3.0625 C 1.5 -3.425781 1.953125 -3.609375 2.484375 -3.609375 C 3.003906 -3.609375 3.445313 -3.425781 3.8125 -3.0625 C 4.175781 -2.695313 4.359375 -2.253906 4.359375 -1.734375 Z M 4.03125 -1.734375 C 4.03125 -2.160156 3.878906 -2.519531 3.578125 -2.8125 C 3.273438 -3.113281 2.90625 -3.265625 2.46875 -3.265625 C 2.039063 -3.265625 1.675781 -3.113281 1.375 -2.8125 C 1.070313 -2.519531 0.921875 -2.160156 0.921875 -1.734375 C 0.921875 -1.316406 1.070313 -0.957031 1.375 -0.65625 C 1.675781 -0.351563 2.039063 -0.203125 2.46875 -0.203125 C 2.90625 -0.203125 3.273438 -0.351563 3.578125 -0.65625 C 3.878906 -0.957031 4.03125 -1.316406 4.03125 -1.734375 Z M 4.03125 -1.734375 "
+           id="path488" />
+      </g>
+      <g
+         id="glyph-4-4">
+        <path
+           d="M 3.640625 0 L 3.640625 -0.5 C 3.171875 -0.0703125 2.671875 0.140625 2.140625 0.140625 C 1.804688 0.140625 1.550781 0.046875 1.375 -0.140625 C 1.15625 -0.367188 1.046875 -0.644531 1.046875 -0.96875 L 1.046875 -3.140625 L 0.59375 -3.140625 C 0.507813 -3.140625 0.445313 -3.15625 0.40625 -3.1875 C 0.375 -3.226563 0.359375 -3.269531 0.359375 -3.3125 C 0.359375 -3.363281 0.375 -3.40625 0.40625 -3.4375 C 0.445313 -3.46875 0.507813 -3.484375 0.59375 -3.484375 L 1.390625 -3.484375 L 1.390625 -0.96875 C 1.390625 -0.738281 1.457031 -0.550781 1.59375 -0.40625 C 1.738281 -0.269531 1.914063 -0.203125 2.125 -0.203125 C 2.664063 -0.203125 3.171875 -0.457031 3.640625 -0.96875 L 3.640625 -3.140625 L 3.015625 -3.140625 C 2.929688 -3.140625 2.867188 -3.15625 2.828125 -3.1875 C 2.796875 -3.226563 2.78125 -3.269531 2.78125 -3.3125 C 2.78125 -3.363281 2.796875 -3.40625 2.828125 -3.4375 C 2.867188 -3.46875 2.929688 -3.484375 3.015625 -3.484375 L 3.96875 -3.484375 L 3.96875 -0.34375 L 4.265625 -0.34375 C 4.335938 -0.34375 4.390625 -0.328125 4.421875 -0.296875 C 4.460938 -0.265625 4.484375 -0.222656 4.484375 -0.171875 C 4.484375 -0.117188 4.460938 -0.078125 4.421875 -0.046875 C 4.390625 -0.015625 4.335938 0 4.265625 0 Z M 3.640625 0 "
+           id="path491" />
+      </g>
+      <g
+         id="glyph-4-5">
+        <path
+           d="M 1.203125 -3.484375 L 1.203125 -2.875 C 1.398438 -3.113281 1.613281 -3.296875 1.84375 -3.421875 C 2.082031 -3.546875 2.359375 -3.609375 2.671875 -3.609375 C 3.003906 -3.609375 3.3125 -3.53125 3.59375 -3.375 C 3.875 -3.21875 4.085938 -3 4.234375 -2.71875 C 4.390625 -2.445313 4.46875 -2.15625 4.46875 -1.84375 C 4.46875 -1.363281 4.296875 -0.945313 3.953125 -0.59375 C 3.609375 -0.25 3.179688 -0.078125 2.671875 -0.078125 C 2.066406 -0.078125 1.578125 -0.328125 1.203125 -0.828125 L 1.203125 1.21875 L 2.015625 1.21875 C 2.097656 1.21875 2.15625 1.234375 2.1875 1.265625 C 2.226563 1.296875 2.25 1.335938 2.25 1.390625 C 2.25 1.429688 2.226563 1.46875 2.1875 1.5 C 2.15625 1.539063 2.097656 1.5625 2.015625 1.5625 L 0.40625 1.5625 C 0.320313 1.5625 0.265625 1.546875 0.234375 1.515625 C 0.203125 1.484375 0.1875 1.441406 0.1875 1.390625 C 0.1875 1.335938 0.203125 1.296875 0.234375 1.265625 C 0.265625 1.234375 0.320313 1.21875 0.40625 1.21875 L 0.859375 1.21875 L 0.859375 -3.140625 L 0.40625 -3.140625 C 0.320313 -3.140625 0.265625 -3.15625 0.234375 -3.1875 C 0.203125 -3.226563 0.1875 -3.269531 0.1875 -3.3125 C 0.1875 -3.363281 0.203125 -3.40625 0.234375 -3.4375 C 0.265625 -3.46875 0.320313 -3.484375 0.40625 -3.484375 Z M 4.140625 -1.84375 C 4.140625 -2.238281 3.992188 -2.570313 3.703125 -2.84375 C 3.421875 -3.125 3.078125 -3.265625 2.671875 -3.265625 C 2.253906 -3.265625 1.90625 -3.125 1.625 -2.84375 C 1.34375 -2.5625 1.203125 -2.226563 1.203125 -1.84375 C 1.203125 -1.457031 1.34375 -1.125 1.625 -0.84375 C 1.90625 -0.5625 2.253906 -0.421875 2.671875 -0.421875 C 3.078125 -0.421875 3.421875 -0.5625 3.703125 -0.84375 C 3.992188 -1.125 4.140625 -1.457031 4.140625 -1.84375 Z M 4.140625 -1.84375 "
+           id="path494" />
+      </g>
+      <g
+         id="glyph-4-6">
+        <path
+           d="M 3.59375 -3.265625 C 3.59375 -3.347656 3.609375 -3.40625 3.640625 -3.4375 C 3.671875 -3.46875 3.710938 -3.484375 3.765625 -3.484375 C 3.816406 -3.484375 3.859375 -3.46875 3.890625 -3.4375 C 3.921875 -3.40625 3.9375 -3.347656 3.9375 -3.265625 L 3.9375 -2.671875 C 3.9375 -2.597656 3.921875 -2.539063 3.890625 -2.5 C 3.859375 -2.46875 3.816406 -2.453125 3.765625 -2.453125 C 3.710938 -2.453125 3.671875 -2.46875 3.640625 -2.5 C 3.609375 -2.53125 3.59375 -2.578125 3.59375 -2.640625 C 3.570313 -2.804688 3.488281 -2.941406 3.34375 -3.046875 C 3.125 -3.191406 2.832031 -3.265625 2.46875 -3.265625 C 2.09375 -3.265625 1.800781 -3.1875 1.59375 -3.03125 C 1.425781 -2.914063 1.34375 -2.789063 1.34375 -2.65625 C 1.34375 -2.488281 1.4375 -2.351563 1.625 -2.25 C 1.757813 -2.175781 2.003906 -2.117188 2.359375 -2.078125 C 2.828125 -2.023438 3.15625 -1.96875 3.34375 -1.90625 C 3.601563 -1.8125 3.796875 -1.679688 3.921875 -1.515625 C 4.046875 -1.347656 4.109375 -1.164063 4.109375 -0.96875 C 4.109375 -0.6875 3.96875 -0.429688 3.6875 -0.203125 C 3.414063 0.0234375 3.015625 0.140625 2.484375 0.140625 C 1.953125 0.140625 1.515625 0 1.171875 -0.28125 C 1.171875 -0.1875 1.164063 -0.125 1.15625 -0.09375 C 1.144531 -0.0703125 1.125 -0.0507813 1.09375 -0.03125 C 1.070313 -0.0078125 1.039063 0 1 0 C 0.957031 0 0.914063 -0.015625 0.875 -0.046875 C 0.84375 -0.0859375 0.828125 -0.144531 0.828125 -0.21875 L 0.828125 -0.921875 C 0.828125 -1.003906 0.84375 -1.0625 0.875 -1.09375 C 0.90625 -1.125 0.945313 -1.140625 1 -1.140625 C 1.050781 -1.140625 1.09375 -1.125 1.125 -1.09375 C 1.15625 -1.0625 1.171875 -1.019531 1.171875 -0.96875 C 1.171875 -0.84375 1.203125 -0.738281 1.265625 -0.65625 C 1.359375 -0.519531 1.507813 -0.410156 1.71875 -0.328125 C 1.925781 -0.242188 2.175781 -0.203125 2.46875 -0.203125 C 2.914063 -0.203125 3.242188 -0.285156 3.453125 -0.453125 C 3.671875 -0.617188 3.78125 -0.789063 3.78125 -0.96875 C 3.78125 -1.175781 3.671875 -1.34375 3.453125 -1.46875 C 3.234375 -1.59375 2.910156 -1.675781 2.484375 -1.71875 C 2.066406 -1.769531 1.765625 -1.828125 1.578125 -1.890625 C 1.398438 -1.960938 1.257813 -2.066406 1.15625 -2.203125 C 1.050781 -2.347656 1 -2.5 1 -2.65625 C 1 -2.945313 1.140625 -3.175781 1.421875 -3.34375 C 1.710938 -3.519531 2.054688 -3.609375 2.453125 -3.609375 C 2.921875 -3.609375 3.300781 -3.492188 3.59375 -3.265625 Z M 3.59375 -3.265625 "
+           id="path497" />
+      </g>
+      <g
+         id="glyph-4-7">
+        <path
+           d="M 2.640625 -5.0625 L 2.640625 -0.34375 L 3.96875 -0.34375 C 4.050781 -0.34375 4.109375 -0.328125 4.140625 -0.296875 C 4.179688 -0.265625 4.203125 -0.222656 4.203125 -0.171875 C 4.203125 -0.117188 4.179688 -0.078125 4.140625 -0.046875 C 4.109375 -0.015625 4.050781 0 3.96875 0 L 0.984375 0 C 0.898438 0 0.835938 -0.015625 0.796875 -0.046875 C 0.765625 -0.078125 0.75 -0.117188 0.75 -0.171875 C 0.75 -0.222656 0.765625 -0.265625 0.796875 -0.296875 C 0.835938 -0.328125 0.898438 -0.34375 0.984375 -0.34375 L 2.3125 -0.34375 L 2.3125 -4.71875 L 1.328125 -4.71875 C 1.253906 -4.71875 1.195313 -4.734375 1.15625 -4.765625 C 1.125 -4.796875 1.109375 -4.835938 1.109375 -4.890625 C 1.109375 -4.929688 1.125 -4.96875 1.15625 -5 C 1.1875 -5.039063 1.242188 -5.0625 1.328125 -5.0625 Z M 2.640625 -5.0625 "
+           id="path500" />
+      </g>
+      <g
+         id="glyph-4-8">
+        <path
+           d="M 4.3125 -1.65625 L 0.859375 -1.65625 C 0.921875 -1.21875 1.101563 -0.863281 1.40625 -0.59375 C 1.71875 -0.332031 2.097656 -0.203125 2.546875 -0.203125 C 2.796875 -0.203125 3.0625 -0.242188 3.34375 -0.328125 C 3.625 -0.410156 3.847656 -0.519531 4.015625 -0.65625 C 4.066406 -0.695313 4.113281 -0.71875 4.15625 -0.71875 C 4.195313 -0.71875 4.234375 -0.703125 4.265625 -0.671875 C 4.296875 -0.640625 4.3125 -0.597656 4.3125 -0.546875 C 4.3125 -0.503906 4.289063 -0.460938 4.25 -0.421875 C 4.125 -0.285156 3.894531 -0.15625 3.5625 -0.03125 C 3.226563 0.0820313 2.890625 0.140625 2.546875 0.140625 C 1.972656 0.140625 1.488281 -0.046875 1.09375 -0.421875 C 0.707031 -0.804688 0.515625 -1.269531 0.515625 -1.8125 C 0.515625 -2.300781 0.695313 -2.722656 1.0625 -3.078125 C 1.425781 -3.429688 1.875 -3.609375 2.40625 -3.609375 C 2.96875 -3.609375 3.425781 -3.425781 3.78125 -3.0625 C 4.132813 -2.707031 4.3125 -2.238281 4.3125 -1.65625 Z M 3.96875 -2 C 3.894531 -2.375 3.710938 -2.675781 3.421875 -2.90625 C 3.140625 -3.144531 2.800781 -3.265625 2.40625 -3.265625 C 2.019531 -3.265625 1.679688 -3.148438 1.390625 -2.921875 C 1.109375 -2.691406 0.929688 -2.382813 0.859375 -2 Z M 3.96875 -2 "
+           id="path503" />
+      </g>
+      <g
+         id="glyph-4-9">
+        <path
+           d="M 2.640625 -5.21875 L 2.640625 -4.34375 L 2.140625 -4.34375 L 2.140625 -5.21875 Z M 2.65625 -3.484375 L 2.65625 -0.34375 L 3.984375 -0.34375 C 4.066406 -0.34375 4.125 -0.328125 4.15625 -0.296875 C 4.195313 -0.265625 4.21875 -0.222656 4.21875 -0.171875 C 4.21875 -0.117188 4.195313 -0.078125 4.15625 -0.046875 C 4.125 -0.015625 4.066406 0 3.984375 0 L 0.984375 0 C 0.898438 0 0.84375 -0.015625 0.8125 -0.046875 C 0.78125 -0.078125 0.765625 -0.117188 0.765625 -0.171875 C 0.765625 -0.222656 0.78125 -0.265625 0.8125 -0.296875 C 0.84375 -0.328125 0.898438 -0.34375 0.984375 -0.34375 L 2.3125 -0.34375 L 2.3125 -3.140625 L 1.328125 -3.140625 C 1.242188 -3.140625 1.179688 -3.15625 1.140625 -3.1875 C 1.109375 -3.226563 1.09375 -3.269531 1.09375 -3.3125 C 1.09375 -3.363281 1.109375 -3.40625 1.140625 -3.4375 C 1.179688 -3.46875 1.242188 -3.484375 1.328125 -3.484375 Z M 2.65625 -3.484375 "
+           id="path506" />
+      </g>
+      <g
+         id="glyph-4-10">
+        <path
+           d="M 4.140625 -5.0625 L 4.140625 -0.34375 L 4.578125 -0.34375 C 4.660156 -0.34375 4.71875 -0.328125 4.75 -0.296875 C 4.789063 -0.265625 4.8125 -0.222656 4.8125 -0.171875 C 4.8125 -0.117188 4.789063 -0.078125 4.75 -0.046875 C 4.71875 -0.015625 4.660156 0 4.578125 0 L 3.796875 0 L 3.796875 -0.671875 C 3.398438 -0.128906 2.898438 0.140625 2.296875 0.140625 C 1.992188 0.140625 1.703125 0.0546875 1.421875 -0.109375 C 1.140625 -0.273438 0.914063 -0.503906 0.75 -0.796875 C 0.582031 -1.097656 0.5 -1.410156 0.5 -1.734375 C 0.5 -2.054688 0.582031 -2.367188 0.75 -2.671875 C 0.914063 -2.972656 1.140625 -3.203125 1.421875 -3.359375 C 1.703125 -3.523438 1.992188 -3.609375 2.296875 -3.609375 C 2.890625 -3.609375 3.390625 -3.335938 3.796875 -2.796875 L 3.796875 -4.71875 L 3.34375 -4.71875 C 3.257813 -4.71875 3.195313 -4.734375 3.15625 -4.765625 C 3.125 -4.796875 3.109375 -4.835938 3.109375 -4.890625 C 3.109375 -4.929688 3.125 -4.96875 3.15625 -5 C 3.195313 -5.039063 3.257813 -5.0625 3.34375 -5.0625 Z M 3.796875 -1.734375 C 3.796875 -2.160156 3.648438 -2.519531 3.359375 -2.8125 C 3.066406 -3.113281 2.722656 -3.265625 2.328125 -3.265625 C 1.921875 -3.265625 1.570313 -3.113281 1.28125 -2.8125 C 0.988281 -2.519531 0.84375 -2.160156 0.84375 -1.734375 C 0.84375 -1.304688 0.988281 -0.941406 1.28125 -0.640625 C 1.570313 -0.347656 1.921875 -0.203125 2.328125 -0.203125 C 2.722656 -0.203125 3.066406 -0.347656 3.359375 -0.640625 C 3.648438 -0.941406 3.796875 -1.304688 3.796875 -1.734375 Z M 3.796875 -1.734375 "
+           id="path509" />
+      </g>
+      <g
+         id="glyph-4-11">
+        <path
+           d="M 4.71875 2.265625 L 0.21875 2.265625 C 0.144531 2.265625 0.0859375 2.25 0.046875 2.21875 C 0.015625 2.1875 0 2.144531 0 2.09375 C 0 2.039063 0.015625 2 0.046875 1.96875 C 0.0859375 1.9375 0.144531 1.921875 0.21875 1.921875 L 4.71875 1.921875 C 4.800781 1.921875 4.859375 1.9375 4.890625 1.96875 C 4.929688 2 4.953125 2.039063 4.953125 2.09375 C 4.953125 2.144531 4.929688 2.1875 4.890625 2.21875 C 4.859375 2.25 4.800781 2.265625 4.71875 2.265625 Z M 4.71875 2.265625 "
+           id="path512" />
+      </g>
+      <g
+         id="glyph-4-12">
+        <path
+           d="M 1.78125 -3.484375 L 3.625 -3.484375 C 3.695313 -3.484375 3.75 -3.46875 3.78125 -3.4375 C 3.820313 -3.40625 3.84375 -3.363281 3.84375 -3.3125 C 3.84375 -3.269531 3.820313 -3.226563 3.78125 -3.1875 C 3.75 -3.15625 3.695313 -3.140625 3.625 -3.140625 L 1.78125 -3.140625 L 1.78125 -0.890625 C 1.78125 -0.691406 1.859375 -0.523438 2.015625 -0.390625 C 2.171875 -0.265625 2.398438 -0.203125 2.703125 -0.203125 C 2.929688 -0.203125 3.175781 -0.234375 3.4375 -0.296875 C 3.707031 -0.367188 3.914063 -0.453125 4.0625 -0.546875 C 4.125 -0.578125 4.171875 -0.59375 4.203125 -0.59375 C 4.242188 -0.59375 4.28125 -0.570313 4.3125 -0.53125 C 4.34375 -0.5 4.359375 -0.460938 4.359375 -0.421875 C 4.359375 -0.378906 4.34375 -0.34375 4.3125 -0.3125 C 4.226563 -0.21875 4.019531 -0.117188 3.6875 -0.015625 C 3.351563 0.0859375 3.035156 0.140625 2.734375 0.140625 C 2.335938 0.140625 2.019531 0.046875 1.78125 -0.140625 C 1.550781 -0.328125 1.4375 -0.578125 1.4375 -0.890625 L 1.4375 -3.140625 L 0.8125 -3.140625 C 0.726563 -3.140625 0.671875 -3.15625 0.640625 -3.1875 C 0.609375 -3.226563 0.59375 -3.269531 0.59375 -3.3125 C 0.59375 -3.363281 0.609375 -3.40625 0.640625 -3.4375 C 0.671875 -3.46875 0.726563 -3.484375 0.8125 -3.484375 L 1.4375 -3.484375 L 1.4375 -4.484375 C 1.4375 -4.566406 1.453125 -4.625 1.484375 -4.65625 C 1.515625 -4.695313 1.554688 -4.71875 1.609375 -4.71875 C 1.660156 -4.71875 1.703125 -4.695313 1.734375 -4.65625 C 1.765625 -4.625 1.78125 -4.566406 1.78125 -4.484375 Z M 1.78125 -3.484375 "
+           id="path515" />
+      </g>
+      <g
+         id="glyph-4-13">
+        <path
+           d="M 1.78125 -1.5 L 1.78125 0 L 1 0 C 0.914063 0 0.851563 -0.015625 0.8125 -0.046875 C 0.78125 -0.078125 0.765625 -0.117188 0.765625 -0.171875 C 0.765625 -0.222656 0.78125 -0.265625 0.8125 -0.296875 C 0.851563 -0.328125 0.914063 -0.34375 1 -0.34375 L 1.453125 -0.34375 L 1.453125 -4.71875 L 1 -4.71875 C 0.914063 -4.71875 0.851563 -4.734375 0.8125 -4.765625 C 0.78125 -4.796875 0.765625 -4.835938 0.765625 -4.890625 C 0.765625 -4.929688 0.78125 -4.96875 0.8125 -5 C 0.851563 -5.039063 0.914063 -5.0625 1 -5.0625 L 1.78125 -5.0625 L 1.78125 -1.9375 L 3.234375 -3.140625 L 3.046875 -3.140625 C 2.972656 -3.140625 2.914063 -3.15625 2.875 -3.1875 C 2.84375 -3.226563 2.828125 -3.269531 2.828125 -3.3125 C 2.828125 -3.363281 2.84375 -3.40625 2.875 -3.4375 C 2.914063 -3.46875 2.972656 -3.484375 3.046875 -3.484375 L 4.140625 -3.484375 C 4.222656 -3.484375 4.28125 -3.46875 4.3125 -3.4375 C 4.34375 -3.40625 4.359375 -3.363281 4.359375 -3.3125 C 4.359375 -3.269531 4.34375 -3.226563 4.3125 -3.1875 C 4.28125 -3.15625 4.222656 -3.140625 4.140625 -3.140625 L 3.75 -3.140625 L 2.421875 -2.046875 L 4.09375 -0.34375 L 4.484375 -0.34375 C 4.566406 -0.34375 4.625 -0.328125 4.65625 -0.296875 C 4.695313 -0.265625 4.71875 -0.222656 4.71875 -0.171875 C 4.71875 -0.117188 4.695313 -0.078125 4.65625 -0.046875 C 4.625 -0.015625 4.566406 0 4.484375 0 L 3.390625 0 C 3.304688 0 3.25 -0.015625 3.21875 -0.046875 C 3.1875 -0.078125 3.171875 -0.117188 3.171875 -0.171875 C 3.171875 -0.222656 3.1875 -0.265625 3.21875 -0.296875 C 3.25 -0.328125 3.304688 -0.34375 3.390625 -0.34375 L 3.625 -0.34375 L 2.171875 -1.828125 Z M 1.78125 -1.5 "
+           id="path518" />
+      </g>
+      <g
+         id="glyph-4-14">
+        <path
+           d="M 1.375 -3.484375 L 1.375 -2.984375 C 1.613281 -3.210938 1.828125 -3.375 2.015625 -3.46875 C 2.210938 -3.5625 2.429688 -3.609375 2.671875 -3.609375 C 2.921875 -3.609375 3.15625 -3.550781 3.375 -3.4375 C 3.519531 -3.363281 3.65625 -3.234375 3.78125 -3.046875 C 3.90625 -2.859375 3.96875 -2.664063 3.96875 -2.46875 L 3.96875 -0.34375 L 4.25 -0.34375 C 4.332031 -0.34375 4.390625 -0.328125 4.421875 -0.296875 C 4.453125 -0.265625 4.46875 -0.222656 4.46875 -0.171875 C 4.46875 -0.117188 4.453125 -0.078125 4.421875 -0.046875 C 4.390625 -0.015625 4.332031 0 4.25 0 L 3.34375 0 C 3.257813 0 3.195313 -0.015625 3.15625 -0.046875 C 3.125 -0.078125 3.109375 -0.117188 3.109375 -0.171875 C 3.109375 -0.222656 3.125 -0.265625 3.15625 -0.296875 C 3.195313 -0.328125 3.257813 -0.34375 3.34375 -0.34375 L 3.625 -0.34375 L 3.625 -2.40625 C 3.625 -2.644531 3.535156 -2.847656 3.359375 -3.015625 C 3.191406 -3.179688 2.957031 -3.265625 2.65625 -3.265625 C 2.4375 -3.265625 2.242188 -3.21875 2.078125 -3.125 C 1.921875 -3.039063 1.6875 -2.820313 1.375 -2.46875 L 1.375 -0.34375 L 1.765625 -0.34375 C 1.847656 -0.34375 1.90625 -0.328125 1.9375 -0.296875 C 1.96875 -0.265625 1.984375 -0.222656 1.984375 -0.171875 C 1.984375 -0.117188 1.96875 -0.078125 1.9375 -0.046875 C 1.90625 -0.015625 1.847656 0 1.765625 0 L 0.65625 0 C 0.582031 0 0.523438 -0.015625 0.484375 -0.046875 C 0.453125 -0.078125 0.4375 -0.117188 0.4375 -0.171875 C 0.4375 -0.222656 0.453125 -0.265625 0.484375 -0.296875 C 0.523438 -0.328125 0.582031 -0.34375 0.65625 -0.34375 L 1.046875 -0.34375 L 1.046875 -3.140625 L 0.75 -3.140625 C 0.675781 -3.140625 0.617188 -3.15625 0.578125 -3.1875 C 0.546875 -3.226563 0.53125 -3.269531 0.53125 -3.3125 C 0.53125 -3.363281 0.546875 -3.40625 0.578125 -3.4375 C 0.617188 -3.46875 0.675781 -3.484375 0.75 -3.484375 Z M 1.375 -3.484375 "
+           id="path521" />
+      </g>
+      <g
+         id="glyph-4-15">
+        <path
+           d="M 2.25 -3.140625 L 2.25 -0.34375 L 3.734375 -0.34375 C 3.816406 -0.34375 3.875 -0.328125 3.90625 -0.296875 C 3.945313 -0.265625 3.96875 -0.222656 3.96875 -0.171875 C 3.96875 -0.117188 3.945313 -0.078125 3.90625 -0.046875 C 3.875 -0.015625 3.816406 0 3.734375 0 L 1.09375 0 C 1.007813 0 0.945313 -0.015625 0.90625 -0.046875 C 0.875 -0.078125 0.859375 -0.117188 0.859375 -0.171875 C 0.859375 -0.222656 0.875 -0.265625 0.90625 -0.296875 C 0.945313 -0.328125 1.007813 -0.34375 1.09375 -0.34375 L 1.90625 -0.34375 L 1.90625 -3.140625 L 1.171875 -3.140625 C 1.097656 -3.140625 1.039063 -3.15625 1 -3.1875 C 0.96875 -3.226563 0.953125 -3.269531 0.953125 -3.3125 C 0.953125 -3.363281 0.96875 -3.40625 1 -3.4375 C 1.039063 -3.46875 1.097656 -3.484375 1.171875 -3.484375 L 1.90625 -3.484375 L 1.90625 -4 C 1.90625 -4.28125 2.019531 -4.523438 2.25 -4.734375 C 2.488281 -4.953125 2.796875 -5.0625 3.171875 -5.0625 C 3.492188 -5.0625 3.835938 -5.03125 4.203125 -4.96875 C 4.335938 -4.945313 4.414063 -4.921875 4.4375 -4.890625 C 4.46875 -4.859375 4.484375 -4.820313 4.484375 -4.78125 C 4.484375 -4.726563 4.46875 -4.6875 4.4375 -4.65625 C 4.40625 -4.625 4.363281 -4.609375 4.3125 -4.609375 C 4.289063 -4.609375 4.253906 -4.613281 4.203125 -4.625 C 3.796875 -4.6875 3.453125 -4.71875 3.171875 -4.71875 C 2.878906 -4.71875 2.648438 -4.644531 2.484375 -4.5 C 2.328125 -4.351563 2.25 -4.1875 2.25 -4 L 2.25 -3.484375 L 3.828125 -3.484375 C 3.910156 -3.484375 3.96875 -3.46875 4 -3.4375 C 4.039063 -3.40625 4.0625 -3.363281 4.0625 -3.3125 C 4.0625 -3.269531 4.039063 -3.226563 4 -3.1875 C 3.96875 -3.15625 3.910156 -3.140625 3.828125 -3.140625 Z M 2.25 -3.140625 "
+           id="path524" />
+      </g>
+      <g
+         id="glyph-4-16">
+        <path
+           d="M 3.96875 -4.25 L 3.96875 -4.484375 C 3.96875 -4.566406 3.984375 -4.625 4.015625 -4.65625 C 4.046875 -4.695313 4.085938 -4.71875 4.140625 -4.71875 C 4.179688 -4.71875 4.21875 -4.695313 4.25 -4.65625 C 4.28125 -4.625 4.296875 -4.566406 4.296875 -4.484375 L 4.296875 -3.546875 C 4.296875 -3.460938 4.28125 -3.398438 4.25 -3.359375 C 4.21875 -3.328125 4.179688 -3.3125 4.140625 -3.3125 C 4.085938 -3.3125 4.046875 -3.328125 4.015625 -3.359375 C 3.984375 -3.398438 3.96875 -3.457031 3.96875 -3.53125 C 3.945313 -3.75 3.820313 -3.945313 3.59375 -4.125 C 3.28125 -4.363281 2.925781 -4.484375 2.53125 -4.484375 C 2.269531 -4.484375 2.023438 -4.425781 1.796875 -4.3125 C 1.617188 -4.226563 1.484375 -4.125 1.390625 -4 C 1.210938 -3.789063 1.070313 -3.5625 0.96875 -3.3125 C 0.882813 -3.125 0.84375 -2.910156 0.84375 -2.671875 L 0.84375 -2.078125 C 0.84375 -1.578125 1.023438 -1.140625 1.390625 -0.765625 C 1.765625 -0.390625 2.191406 -0.203125 2.671875 -0.203125 C 2.960938 -0.203125 3.222656 -0.265625 3.453125 -0.390625 C 3.679688 -0.515625 3.898438 -0.707031 4.109375 -0.96875 C 4.160156 -1.019531 4.210938 -1.046875 4.265625 -1.046875 C 4.316406 -1.046875 4.359375 -1.03125 4.390625 -1 C 4.421875 -0.976563 4.4375 -0.941406 4.4375 -0.890625 C 4.4375 -0.828125 4.378906 -0.734375 4.265625 -0.609375 C 4.035156 -0.359375 3.785156 -0.171875 3.515625 -0.046875 C 3.242188 0.078125 2.960938 0.140625 2.671875 0.140625 C 2.429688 0.140625 2.1875 0.0859375 1.9375 -0.015625 C 1.738281 -0.078125 1.578125 -0.15625 1.453125 -0.25 C 1.328125 -0.351563 1.171875 -0.519531 0.984375 -0.75 C 0.804688 -0.976563 0.679688 -1.191406 0.609375 -1.390625 C 0.546875 -1.585938 0.515625 -1.800781 0.515625 -2.03125 L 0.515625 -2.71875 C 0.515625 -3.050781 0.601563 -3.390625 0.78125 -3.734375 C 0.957031 -4.085938 1.203125 -4.359375 1.515625 -4.546875 C 1.828125 -4.734375 2.160156 -4.828125 2.515625 -4.828125 C 3.078125 -4.828125 3.5625 -4.632813 3.96875 -4.25 Z M 3.96875 -4.25 "
+           id="path527" />
+      </g>
+      <g
+         id="glyph-4-17">
+        <path
+           d="M 4.546875 -2.34375 C 4.546875 -1.894531 4.453125 -1.476563 4.265625 -1.09375 C 4.085938 -0.707031 3.835938 -0.40625 3.515625 -0.1875 C 3.191406 0.03125 2.847656 0.140625 2.484375 0.140625 C 1.929688 0.140625 1.445313 -0.0859375 1.03125 -0.546875 C 0.625 -1.015625 0.421875 -1.613281 0.421875 -2.34375 C 0.421875 -3.070313 0.625 -3.664063 1.03125 -4.125 C 1.445313 -4.59375 1.929688 -4.828125 2.484375 -4.828125 C 2.847656 -4.828125 3.1875 -4.71875 3.5 -4.5 C 3.820313 -4.28125 4.078125 -3.976563 4.265625 -3.59375 C 4.453125 -3.21875 4.546875 -2.800781 4.546875 -2.34375 Z M 4.203125 -2.34375 C 4.203125 -2.894531 4.039063 -3.390625 3.71875 -3.828125 C 3.40625 -4.265625 2.992188 -4.484375 2.484375 -4.484375 C 2.003906 -4.484375 1.59375 -4.273438 1.25 -3.859375 C 0.914063 -3.441406 0.75 -2.9375 0.75 -2.34375 C 0.75 -1.71875 0.925781 -1.203125 1.28125 -0.796875 C 1.632813 -0.398438 2.035156 -0.203125 2.484375 -0.203125 C 2.992188 -0.203125 3.40625 -0.421875 3.71875 -0.859375 C 4.039063 -1.296875 4.203125 -1.789063 4.203125 -2.34375 Z M 4.203125 -2.34375 "
+           id="path530" />
+      </g>
+      <g
+         id="glyph-4-18">
+        <path
+           d="M 1.140625 -0.34375 L 1.140625 -4.375 L 0.859375 -4.375 C 0.773438 -4.375 0.71875 -4.390625 0.6875 -4.421875 C 0.65625 -4.453125 0.640625 -4.492188 0.640625 -4.546875 C 0.640625 -4.597656 0.65625 -4.640625 0.6875 -4.671875 C 0.71875 -4.703125 0.773438 -4.71875 0.859375 -4.71875 L 2.6875 -4.71875 C 2.96875 -4.71875 3.222656 -4.65625 3.453125 -4.53125 C 3.691406 -4.414063 3.875 -4.285156 4 -4.140625 C 4.207031 -3.878906 4.367188 -3.609375 4.484375 -3.328125 C 4.554688 -3.117188 4.59375 -2.875 4.59375 -2.59375 L 4.59375 -2.125 C 4.59375 -1.78125 4.515625 -1.441406 4.359375 -1.109375 C 4.210938 -0.785156 3.960938 -0.503906 3.609375 -0.265625 C 3.335938 -0.0859375 3.03125 0 2.6875 0 L 0.859375 0 C 0.773438 0 0.71875 -0.015625 0.6875 -0.046875 C 0.65625 -0.078125 0.640625 -0.117188 0.640625 -0.171875 C 0.640625 -0.222656 0.65625 -0.265625 0.6875 -0.296875 C 0.71875 -0.328125 0.773438 -0.34375 0.859375 -0.34375 Z M 1.484375 -0.34375 L 2.71875 -0.34375 C 3 -0.34375 3.265625 -0.429688 3.515625 -0.609375 C 3.765625 -0.796875 3.953125 -1.019531 4.078125 -1.28125 C 4.203125 -1.539063 4.265625 -1.796875 4.265625 -2.046875 L 4.265625 -2.65625 C 4.265625 -2.875 4.226563 -3.0625 4.15625 -3.21875 C 4.0625 -3.457031 3.925781 -3.6875 3.75 -3.90625 C 3.65625 -4.019531 3.515625 -4.125 3.328125 -4.21875 C 3.140625 -4.320313 2.9375 -4.375 2.71875 -4.375 L 1.484375 -4.375 Z M 1.484375 -0.34375 "
+           id="path533" />
+      </g>
+      <g
+         id="glyph-4-19">
+        <path
+           d="M 1.375 -2.28125 L 1.375 -0.34375 L 3.96875 -0.34375 L 3.96875 -1.34375 C 3.96875 -1.414063 3.984375 -1.46875 4.015625 -1.5 C 4.046875 -1.539063 4.085938 -1.5625 4.140625 -1.5625 C 4.191406 -1.5625 4.234375 -1.539063 4.265625 -1.5 C 4.296875 -1.46875 4.3125 -1.414063 4.3125 -1.34375 L 4.3125 0 L 0.578125 0 C 0.492188 0 0.4375 -0.015625 0.40625 -0.046875 C 0.375 -0.078125 0.359375 -0.117188 0.359375 -0.171875 C 0.359375 -0.222656 0.375 -0.265625 0.40625 -0.296875 C 0.4375 -0.328125 0.492188 -0.34375 0.578125 -0.34375 L 1.03125 -0.34375 L 1.03125 -4.375 L 0.578125 -4.375 C 0.492188 -4.375 0.4375 -4.390625 0.40625 -4.421875 C 0.375 -4.453125 0.359375 -4.492188 0.359375 -4.546875 C 0.359375 -4.597656 0.375 -4.640625 0.40625 -4.671875 C 0.4375 -4.703125 0.492188 -4.71875 0.578125 -4.71875 L 4.140625 -4.71875 L 4.140625 -3.546875 C 4.140625 -3.460938 4.125 -3.40625 4.09375 -3.375 C 4.0625 -3.34375 4.019531 -3.328125 3.96875 -3.328125 C 3.914063 -3.328125 3.875 -3.34375 3.84375 -3.375 C 3.8125 -3.40625 3.796875 -3.460938 3.796875 -3.546875 L 3.796875 -4.375 L 1.375 -4.375 L 1.375 -2.609375 L 2.59375 -2.609375 L 2.59375 -3 C 2.59375 -3.082031 2.609375 -3.140625 2.640625 -3.171875 C 2.671875 -3.203125 2.710938 -3.21875 2.765625 -3.21875 C 2.804688 -3.21875 2.84375 -3.203125 2.875 -3.171875 C 2.90625 -3.140625 2.921875 -3.082031 2.921875 -3 L 2.921875 -1.890625 C 2.921875 -1.804688 2.90625 -1.75 2.875 -1.71875 C 2.84375 -1.6875 2.804688 -1.671875 2.765625 -1.671875 C 2.710938 -1.671875 2.671875 -1.6875 2.640625 -1.71875 C 2.609375 -1.75 2.59375 -1.804688 2.59375 -1.890625 L 2.59375 -2.28125 Z M 1.375 -2.28125 "
+           id="path536" />
+      </g>
+      <g
+         id="glyph-4-20">
+        <path
+           d="M 1.375 -2.109375 L 1.375 -0.34375 L 2 -0.34375 C 2.082031 -0.34375 2.140625 -0.328125 2.171875 -0.296875 C 2.210938 -0.265625 2.234375 -0.222656 2.234375 -0.171875 C 2.234375 -0.117188 2.210938 -0.078125 2.171875 -0.046875 C 2.140625 -0.015625 2.082031 0 2 0 L 0.578125 0 C 0.492188 0 0.4375 -0.015625 0.40625 -0.046875 C 0.375 -0.078125 0.359375 -0.117188 0.359375 -0.171875 C 0.359375 -0.222656 0.375 -0.265625 0.40625 -0.296875 C 0.4375 -0.328125 0.492188 -0.34375 0.578125 -0.34375 L 1.03125 -0.34375 L 1.03125 -4.375 L 0.578125 -4.375 C 0.492188 -4.375 0.4375 -4.390625 0.40625 -4.421875 C 0.375 -4.453125 0.359375 -4.492188 0.359375 -4.546875 C 0.359375 -4.597656 0.375 -4.640625 0.40625 -4.671875 C 0.4375 -4.703125 0.492188 -4.71875 0.578125 -4.71875 L 2.625 -4.71875 C 3.050781 -4.71875 3.40625 -4.582031 3.6875 -4.3125 C 3.976563 -4.039063 4.125 -3.738281 4.125 -3.40625 C 4.125 -3.164063 4.035156 -2.9375 3.859375 -2.71875 C 3.679688 -2.507813 3.378906 -2.332031 2.953125 -2.1875 C 3.203125 -2.019531 3.410156 -1.832031 3.578125 -1.625 C 3.753906 -1.414063 4.03125 -0.988281 4.40625 -0.34375 L 4.671875 -0.34375 C 4.742188 -0.34375 4.796875 -0.328125 4.828125 -0.296875 C 4.867188 -0.265625 4.890625 -0.222656 4.890625 -0.171875 C 4.890625 -0.117188 4.867188 -0.078125 4.828125 -0.046875 C 4.796875 -0.015625 4.742188 0 4.671875 0 L 4.21875 0 C 3.789063 -0.75 3.460938 -1.25 3.234375 -1.5 C 3.003906 -1.757813 2.742188 -1.960938 2.453125 -2.109375 Z M 1.375 -2.4375 L 2.296875 -2.4375 C 2.585938 -2.4375 2.851563 -2.488281 3.09375 -2.59375 C 3.332031 -2.707031 3.503906 -2.835938 3.609375 -2.984375 C 3.722656 -3.128906 3.78125 -3.273438 3.78125 -3.421875 C 3.78125 -3.648438 3.664063 -3.863281 3.4375 -4.0625 C 3.21875 -4.269531 2.945313 -4.375 2.625 -4.375 L 1.375 -4.375 Z M 1.375 -2.4375 "
+           id="path539" />
+      </g>
+      <g
+         id="glyph-4-21">
+        <path
+           d="M 2.640625 -4.375 L 2.640625 -0.34375 L 3.8125 -0.34375 C 3.882813 -0.34375 3.9375 -0.328125 3.96875 -0.296875 C 4.007813 -0.265625 4.03125 -0.222656 4.03125 -0.171875 C 4.03125 -0.117188 4.007813 -0.078125 3.96875 -0.046875 C 3.9375 -0.015625 3.882813 0 3.8125 0 L 1.140625 0 C 1.066406 0 1.007813 -0.015625 0.96875 -0.046875 C 0.9375 -0.078125 0.921875 -0.117188 0.921875 -0.171875 C 0.921875 -0.222656 0.9375 -0.265625 0.96875 -0.296875 C 1.007813 -0.328125 1.066406 -0.34375 1.140625 -0.34375 L 2.3125 -0.34375 L 2.3125 -4.375 L 1.140625 -4.375 C 1.066406 -4.375 1.007813 -4.390625 0.96875 -4.421875 C 0.9375 -4.453125 0.921875 -4.492188 0.921875 -4.546875 C 0.921875 -4.597656 0.9375 -4.640625 0.96875 -4.671875 C 1.007813 -4.703125 1.066406 -4.71875 1.140625 -4.71875 L 3.8125 -4.71875 C 3.882813 -4.71875 3.9375 -4.703125 3.96875 -4.671875 C 4.007813 -4.640625 4.03125 -4.597656 4.03125 -4.546875 C 4.03125 -4.492188 4.007813 -4.453125 3.96875 -4.421875 C 3.9375 -4.390625 3.882813 -4.375 3.8125 -4.375 Z M 2.640625 -4.375 "
+           id="path542" />
+      </g>
+      <g
+         id="glyph-4-22">
+        <path
+           d="M 4.3125 -1.75 L 4.3125 -0.296875 C 4.050781 -0.148438 3.789063 -0.0390625 3.53125 0.03125 C 3.28125 0.101563 3.03125 0.140625 2.78125 0.140625 C 2.414063 0.140625 2.09375 0.0859375 1.8125 -0.015625 C 1.539063 -0.128906 1.304688 -0.28125 1.109375 -0.46875 C 0.921875 -0.664063 0.773438 -0.882813 0.671875 -1.125 C 0.566406 -1.363281 0.515625 -1.664063 0.515625 -2.03125 L 0.515625 -2.65625 C 0.515625 -3.03125 0.601563 -3.390625 0.78125 -3.734375 C 0.96875 -4.085938 1.222656 -4.359375 1.546875 -4.546875 C 1.867188 -4.734375 2.21875 -4.828125 2.59375 -4.828125 C 3.132813 -4.828125 3.59375 -4.675781 3.96875 -4.375 C 3.96875 -4.507813 3.972656 -4.585938 3.984375 -4.609375 C 3.992188 -4.640625 4.015625 -4.664063 4.046875 -4.6875 C 4.078125 -4.707031 4.109375 -4.71875 4.140625 -4.71875 C 4.191406 -4.71875 4.234375 -4.695313 4.265625 -4.65625 C 4.296875 -4.625 4.3125 -4.566406 4.3125 -4.484375 L 4.3125 -3.71875 C 4.3125 -3.632813 4.296875 -3.578125 4.265625 -3.546875 C 4.234375 -3.515625 4.191406 -3.5 4.140625 -3.5 C 4.097656 -3.5 4.0625 -3.515625 4.03125 -3.546875 C 4 -3.578125 3.984375 -3.628906 3.984375 -3.703125 C 3.960938 -3.929688 3.8125 -4.117188 3.53125 -4.265625 C 3.25 -4.410156 2.945313 -4.484375 2.625 -4.484375 C 2.3125 -4.484375 2.023438 -4.414063 1.765625 -4.28125 C 1.515625 -4.144531 1.285156 -3.882813 1.078125 -3.5 C 0.929688 -3.25 0.859375 -2.96875 0.859375 -2.65625 L 0.859375 -2.03125 C 0.859375 -1.476563 1.03125 -1.035156 1.375 -0.703125 C 1.71875 -0.367188 2.191406 -0.203125 2.796875 -0.203125 C 2.992188 -0.203125 3.179688 -0.222656 3.359375 -0.265625 C 3.535156 -0.304688 3.738281 -0.382813 3.96875 -0.5 L 3.96875 -1.75 L 2.8125 -1.75 C 2.726563 -1.75 2.664063 -1.765625 2.625 -1.796875 C 2.59375 -1.828125 2.578125 -1.867188 2.578125 -1.921875 C 2.578125 -1.972656 2.59375 -2.015625 2.625 -2.046875 C 2.664063 -2.078125 2.726563 -2.09375 2.8125 -2.09375 L 4.4375 -2.09375 C 4.519531 -2.09375 4.578125 -2.078125 4.609375 -2.046875 C 4.640625 -2.015625 4.65625 -1.972656 4.65625 -1.921875 C 4.65625 -1.878906 4.644531 -1.84375 4.625 -1.8125 C 4.601563 -1.789063 4.578125 -1.773438 4.546875 -1.765625 C 4.523438 -1.753906 4.445313 -1.75 4.3125 -1.75 Z M 4.3125 -1.75 "
+           id="path545" />
+      </g>
+      <g
+         id="glyph-4-23">
+        <path
+           d="M 4.109375 -4.375 L 4.109375 -1.546875 C 4.109375 -1.066406 3.945313 -0.664063 3.625 -0.34375 C 3.3125 -0.0195313 2.929688 0.140625 2.484375 0.140625 C 2.179688 0.140625 1.914063 0.0703125 1.6875 -0.0625 C 1.457031 -0.195313 1.257813 -0.394531 1.09375 -0.65625 C 0.925781 -0.925781 0.84375 -1.222656 0.84375 -1.546875 L 0.84375 -4.375 L 0.5625 -4.375 C 0.476563 -4.375 0.414063 -4.390625 0.375 -4.421875 C 0.34375 -4.453125 0.328125 -4.492188 0.328125 -4.546875 C 0.328125 -4.597656 0.347656 -4.640625 0.390625 -4.671875 C 0.421875 -4.703125 0.476563 -4.71875 0.5625 -4.71875 L 1.8125 -4.71875 C 1.882813 -4.71875 1.9375 -4.703125 1.96875 -4.671875 C 2.007813 -4.640625 2.03125 -4.597656 2.03125 -4.546875 C 2.03125 -4.492188 2.007813 -4.453125 1.96875 -4.421875 C 1.9375 -4.390625 1.882813 -4.375 1.8125 -4.375 L 1.1875 -4.375 L 1.1875 -1.546875 C 1.1875 -1.171875 1.3125 -0.851563 1.5625 -0.59375 C 1.820313 -0.332031 2.125 -0.203125 2.46875 -0.203125 C 2.695313 -0.203125 2.898438 -0.253906 3.078125 -0.359375 C 3.265625 -0.460938 3.425781 -0.617188 3.5625 -0.828125 C 3.707031 -1.035156 3.78125 -1.273438 3.78125 -1.546875 L 3.78125 -4.375 L 3.15625 -4.375 C 3.070313 -4.375 3.007813 -4.390625 2.96875 -4.421875 C 2.9375 -4.453125 2.921875 -4.492188 2.921875 -4.546875 C 2.921875 -4.597656 2.9375 -4.640625 2.96875 -4.671875 C 3.007813 -4.703125 3.070313 -4.71875 3.15625 -4.71875 L 4.40625 -4.71875 C 4.476563 -4.71875 4.53125 -4.703125 4.5625 -4.671875 C 4.601563 -4.640625 4.625 -4.597656 4.625 -4.546875 C 4.625 -4.492188 4.601563 -4.453125 4.5625 -4.421875 C 4.53125 -4.390625 4.476563 -4.375 4.40625 -4.375 Z M 4.109375 -4.375 "
+           id="path548" />
+      </g>
+      <g
+         id="glyph-4-24">
+        <path
+           d="M 1.734375 -1.9375 L 1.734375 -0.34375 L 2.90625 -0.34375 C 2.976563 -0.34375 3.03125 -0.328125 3.0625 -0.296875 C 3.101563 -0.265625 3.125 -0.222656 3.125 -0.171875 C 3.125 -0.117188 3.101563 -0.078125 3.0625 -0.046875 C 3.03125 -0.015625 2.976563 0 2.90625 0 L 0.953125 0 C 0.867188 0 0.804688 -0.015625 0.765625 -0.046875 C 0.734375 -0.078125 0.71875 -0.117188 0.71875 -0.171875 C 0.71875 -0.222656 0.734375 -0.265625 0.765625 -0.296875 C 0.804688 -0.328125 0.867188 -0.34375 0.953125 -0.34375 L 1.40625 -0.34375 L 1.40625 -4.375 L 0.953125 -4.375 C 0.867188 -4.375 0.804688 -4.390625 0.765625 -4.421875 C 0.734375 -4.453125 0.71875 -4.492188 0.71875 -4.546875 C 0.71875 -4.597656 0.734375 -4.640625 0.765625 -4.671875 C 0.804688 -4.703125 0.867188 -4.71875 0.953125 -4.71875 L 2.90625 -4.71875 C 3.375 -4.71875 3.753906 -4.578125 4.046875 -4.296875 C 4.335938 -4.023438 4.484375 -3.707031 4.484375 -3.34375 C 4.484375 -3.125 4.4375 -2.925781 4.34375 -2.75 C 4.25 -2.570313 4.132813 -2.4375 4 -2.34375 C 3.800781 -2.1875 3.59375 -2.078125 3.375 -2.015625 C 3.21875 -1.960938 3.023438 -1.9375 2.796875 -1.9375 Z M 1.734375 -2.265625 L 2.8125 -2.265625 C 3.0625 -2.265625 3.296875 -2.320313 3.515625 -2.4375 C 3.734375 -2.550781 3.894531 -2.6875 4 -2.84375 C 4.101563 -3.007813 4.15625 -3.175781 4.15625 -3.34375 C 4.15625 -3.601563 4.039063 -3.835938 3.8125 -4.046875 C 3.582031 -4.265625 3.289063 -4.375 2.9375 -4.375 L 1.734375 -4.375 Z M 1.734375 -2.265625 "
+           id="path551" />
+      </g>
+      <g
+         id="glyph-4-25">
+        <path
+           d="M 1.65625 -2.28125 L 1.65625 -0.34375 L 2.8125 -0.34375 C 2.894531 -0.34375 2.953125 -0.328125 2.984375 -0.296875 C 3.023438 -0.265625 3.046875 -0.222656 3.046875 -0.171875 C 3.046875 -0.117188 3.023438 -0.078125 2.984375 -0.046875 C 2.953125 -0.015625 2.894531 0 2.8125 0 L 0.859375 0 C 0.785156 0 0.726563 -0.015625 0.6875 -0.046875 C 0.65625 -0.078125 0.640625 -0.117188 0.640625 -0.171875 C 0.640625 -0.222656 0.65625 -0.265625 0.6875 -0.296875 C 0.726563 -0.328125 0.785156 -0.34375 0.859375 -0.34375 L 1.328125 -0.34375 L 1.328125 -4.375 L 0.859375 -4.375 C 0.785156 -4.375 0.726563 -4.390625 0.6875 -4.421875 C 0.65625 -4.453125 0.640625 -4.492188 0.640625 -4.546875 C 0.640625 -4.597656 0.660156 -4.640625 0.703125 -4.671875 C 0.734375 -4.703125 0.785156 -4.71875 0.859375 -4.71875 L 4.59375 -4.71875 L 4.59375 -3.546875 C 4.59375 -3.460938 4.578125 -3.40625 4.546875 -3.375 C 4.515625 -3.34375 4.472656 -3.328125 4.421875 -3.328125 C 4.367188 -3.328125 4.328125 -3.34375 4.296875 -3.375 C 4.265625 -3.40625 4.25 -3.460938 4.25 -3.546875 L 4.25 -4.375 L 1.65625 -4.375 L 1.65625 -2.609375 L 2.875 -2.609375 L 2.875 -3 C 2.875 -3.082031 2.890625 -3.140625 2.921875 -3.171875 C 2.953125 -3.203125 2.992188 -3.21875 3.046875 -3.21875 C 3.097656 -3.21875 3.140625 -3.203125 3.171875 -3.171875 C 3.203125 -3.140625 3.21875 -3.082031 3.21875 -3 L 3.21875 -1.890625 C 3.21875 -1.804688 3.203125 -1.75 3.171875 -1.71875 C 3.140625 -1.6875 3.097656 -1.671875 3.046875 -1.671875 C 2.992188 -1.671875 2.953125 -1.6875 2.921875 -1.71875 C 2.890625 -1.75 2.875 -1.804688 2.875 -1.890625 L 2.875 -2.28125 Z M 1.65625 -2.28125 "
+           id="path554" />
+      </g>
+      <g
+         id="glyph-4-26">
+        <path
+           d="M 1.890625 -4.375 L 1.890625 -0.34375 L 4.140625 -0.34375 L 4.140625 -1.6875 C 4.140625 -1.769531 4.15625 -1.828125 4.1875 -1.859375 C 4.21875 -1.890625 4.257813 -1.90625 4.3125 -1.90625 C 4.363281 -1.90625 4.40625 -1.890625 4.4375 -1.859375 C 4.46875 -1.828125 4.484375 -1.769531 4.484375 -1.6875 L 4.484375 0 L 0.734375 0 C 0.660156 0 0.601563 -0.015625 0.5625 -0.046875 C 0.53125 -0.078125 0.515625 -0.117188 0.515625 -0.171875 C 0.515625 -0.222656 0.53125 -0.265625 0.5625 -0.296875 C 0.601563 -0.328125 0.660156 -0.34375 0.734375 -0.34375 L 1.546875 -0.34375 L 1.546875 -4.375 L 0.734375 -4.375 C 0.660156 -4.375 0.601563 -4.390625 0.5625 -4.421875 C 0.53125 -4.453125 0.515625 -4.492188 0.515625 -4.546875 C 0.515625 -4.597656 0.53125 -4.640625 0.5625 -4.671875 C 0.601563 -4.703125 0.660156 -4.71875 0.734375 -4.71875 L 2.6875 -4.71875 C 2.769531 -4.71875 2.828125 -4.703125 2.859375 -4.671875 C 2.898438 -4.640625 2.921875 -4.597656 2.921875 -4.546875 C 2.921875 -4.492188 2.898438 -4.453125 2.859375 -4.421875 C 2.828125 -4.390625 2.769531 -4.375 2.6875 -4.375 Z M 1.890625 -4.375 "
+           id="path557" />
+      </g>
+      <g
+         id="glyph-4-27">
+        <path
+           d="M 3.6875 -4.375 L 3.6875 -4.484375 C 3.6875 -4.566406 3.703125 -4.625 3.734375 -4.65625 C 3.765625 -4.695313 3.804688 -4.71875 3.859375 -4.71875 C 3.910156 -4.71875 3.953125 -4.695313 3.984375 -4.65625 C 4.015625 -4.625 4.03125 -4.566406 4.03125 -4.484375 L 4.03125 -3.625 C 4.03125 -3.539063 4.015625 -3.484375 3.984375 -3.453125 C 3.953125 -3.421875 3.910156 -3.40625 3.859375 -3.40625 C 3.804688 -3.40625 3.765625 -3.421875 3.734375 -3.453125 C 3.703125 -3.484375 3.6875 -3.535156 3.6875 -3.609375 C 3.675781 -3.828125 3.5625 -4.023438 3.34375 -4.203125 C 3.125 -4.390625 2.835938 -4.484375 2.484375 -4.484375 C 2.109375 -4.484375 1.804688 -4.382813 1.578125 -4.1875 C 1.359375 -4 1.25 -3.773438 1.25 -3.515625 C 1.25 -3.378906 1.28125 -3.253906 1.34375 -3.140625 C 1.40625 -3.035156 1.488281 -2.945313 1.59375 -2.875 C 1.695313 -2.8125 1.8125 -2.757813 1.9375 -2.71875 C 2.070313 -2.675781 2.273438 -2.632813 2.546875 -2.59375 C 3.003906 -2.507813 3.320313 -2.429688 3.5 -2.359375 C 3.726563 -2.253906 3.898438 -2.109375 4.015625 -1.921875 C 4.140625 -1.734375 4.203125 -1.515625 4.203125 -1.265625 C 4.203125 -0.878906 4.046875 -0.546875 3.734375 -0.265625 C 3.429688 0.00390625 3.019531 0.140625 2.5 0.140625 C 1.90625 0.140625 1.429688 -0.046875 1.078125 -0.421875 L 1.078125 -0.21875 C 1.078125 -0.144531 1.0625 -0.0859375 1.03125 -0.046875 C 1 -0.015625 0.960938 0 0.921875 0 C 0.867188 0 0.828125 -0.015625 0.796875 -0.046875 C 0.765625 -0.0859375 0.75 -0.144531 0.75 -0.21875 L 0.75 -1.15625 C 0.75 -1.238281 0.765625 -1.296875 0.796875 -1.328125 C 0.828125 -1.367188 0.867188 -1.390625 0.921875 -1.390625 C 0.960938 -1.390625 1 -1.375 1.03125 -1.34375 C 1.0625 -1.3125 1.078125 -1.257813 1.078125 -1.1875 C 1.097656 -0.9375 1.234375 -0.707031 1.484375 -0.5 C 1.734375 -0.300781 2.070313 -0.203125 2.5 -0.203125 C 2.914063 -0.203125 3.25 -0.304688 3.5 -0.515625 C 3.75 -0.734375 3.875 -0.988281 3.875 -1.28125 C 3.875 -1.457031 3.820313 -1.613281 3.71875 -1.75 C 3.625 -1.882813 3.488281 -1.992188 3.3125 -2.078125 C 3.175781 -2.128906 2.90625 -2.191406 2.5 -2.265625 C 1.9375 -2.359375 1.535156 -2.503906 1.296875 -2.703125 C 1.046875 -2.890625 0.921875 -3.164063 0.921875 -3.53125 C 0.921875 -3.882813 1.0625 -4.1875 1.34375 -4.4375 C 1.625 -4.695313 2 -4.828125 2.46875 -4.828125 C 2.9375 -4.828125 3.34375 -4.675781 3.6875 -4.375 Z M 3.6875 -4.375 "
+           id="path560" />
+      </g>
+      <g
+         id="glyph-4-28">
+        <path
+           d="M 2.703125 -1.40625 L 2.3125 -1.40625 L 1.015625 -4.375 L 0.953125 -4.375 L 0.953125 -0.34375 L 1.578125 -0.34375 C 1.648438 -0.34375 1.703125 -0.328125 1.734375 -0.296875 C 1.773438 -0.265625 1.796875 -0.222656 1.796875 -0.171875 C 1.796875 -0.117188 1.773438 -0.078125 1.734375 -0.046875 C 1.703125 -0.015625 1.648438 0 1.578125 0 L 0.328125 0 C 0.242188 0 0.179688 -0.015625 0.140625 -0.046875 C 0.109375 -0.078125 0.09375 -0.117188 0.09375 -0.171875 C 0.09375 -0.222656 0.109375 -0.265625 0.140625 -0.296875 C 0.179688 -0.328125 0.242188 -0.34375 0.328125 -0.34375 L 0.609375 -0.34375 L 0.609375 -4.375 L 0.390625 -4.375 C 0.316406 -4.375 0.257813 -4.390625 0.21875 -4.421875 C 0.1875 -4.453125 0.171875 -4.492188 0.171875 -4.546875 C 0.171875 -4.597656 0.1875 -4.640625 0.21875 -4.671875 C 0.257813 -4.703125 0.316406 -4.71875 0.390625 -4.71875 L 1.21875 -4.71875 L 2.5 -1.796875 L 3.765625 -4.71875 L 4.59375 -4.71875 C 4.675781 -4.71875 4.734375 -4.703125 4.765625 -4.671875 C 4.804688 -4.640625 4.828125 -4.597656 4.828125 -4.546875 C 4.828125 -4.492188 4.804688 -4.453125 4.765625 -4.421875 C 4.734375 -4.390625 4.675781 -4.375 4.59375 -4.375 L 4.390625 -4.375 L 4.390625 -0.34375 L 4.671875 -0.34375 C 4.753906 -0.34375 4.8125 -0.328125 4.84375 -0.296875 C 4.882813 -0.265625 4.90625 -0.222656 4.90625 -0.171875 C 4.90625 -0.117188 4.882813 -0.078125 4.84375 -0.046875 C 4.8125 -0.015625 4.753906 0 4.671875 0 L 3.421875 0 C 3.335938 0 3.273438 -0.015625 3.234375 -0.046875 C 3.203125 -0.078125 3.1875 -0.117188 3.1875 -0.171875 C 3.1875 -0.222656 3.203125 -0.265625 3.234375 -0.296875 C 3.273438 -0.328125 3.335938 -0.34375 3.421875 -0.34375 L 4.046875 -0.34375 L 4.046875 -4.375 L 3.96875 -4.375 Z M 2.703125 -1.40625 "
+           id="path563" />
+      </g>
+      <g
+         id="glyph-4-29">
+        <path
+           d="M 3.59375 -1.578125 L 1.359375 -1.578125 L 0.90625 -0.34375 L 1.5625 -0.34375 C 1.644531 -0.34375 1.703125 -0.328125 1.734375 -0.296875 C 1.765625 -0.265625 1.78125 -0.222656 1.78125 -0.171875 C 1.78125 -0.117188 1.765625 -0.078125 1.734375 -0.046875 C 1.703125 -0.015625 1.644531 0 1.5625 0 L 0.296875 0 C 0.210938 0 0.148438 -0.015625 0.109375 -0.046875 C 0.078125 -0.078125 0.0625 -0.117188 0.0625 -0.171875 C 0.0625 -0.222656 0.078125 -0.265625 0.109375 -0.296875 C 0.148438 -0.328125 0.210938 -0.34375 0.296875 -0.34375 L 0.5625 -0.34375 L 2.046875 -4.375 L 1.046875 -4.375 C 0.972656 -4.375 0.914063 -4.390625 0.875 -4.421875 C 0.84375 -4.453125 0.828125 -4.492188 0.828125 -4.546875 C 0.828125 -4.597656 0.84375 -4.640625 0.875 -4.671875 C 0.914063 -4.703125 0.972656 -4.71875 1.046875 -4.71875 L 2.75 -4.71875 L 4.40625 -0.34375 L 4.671875 -0.34375 C 4.753906 -0.34375 4.8125 -0.328125 4.84375 -0.296875 C 4.875 -0.265625 4.890625 -0.222656 4.890625 -0.171875 C 4.890625 -0.117188 4.875 -0.078125 4.84375 -0.046875 C 4.8125 -0.015625 4.753906 0 4.671875 0 L 3.40625 0 C 3.320313 0 3.257813 -0.015625 3.21875 -0.046875 C 3.1875 -0.078125 3.171875 -0.117188 3.171875 -0.171875 C 3.171875 -0.222656 3.1875 -0.265625 3.21875 -0.296875 C 3.257813 -0.328125 3.320313 -0.34375 3.40625 -0.34375 L 4.046875 -0.34375 Z M 3.453125 -1.90625 L 2.53125 -4.375 L 2.40625 -4.375 L 1.5 -1.90625 Z M 3.453125 -1.90625 "
+           id="path566" />
+      </g>
+      <g
+         id="glyph-4-30">
+        <path
+           d="M 4.140625 0 L 3.703125 0 L 1.203125 -4.21875 L 1.203125 -0.34375 L 1.828125 -0.34375 C 1.910156 -0.34375 1.96875 -0.328125 2 -0.296875 C 2.039063 -0.265625 2.0625 -0.222656 2.0625 -0.171875 C 2.0625 -0.117188 2.039063 -0.078125 2 -0.046875 C 1.96875 -0.015625 1.910156 0 1.828125 0 L 0.578125 0 C 0.492188 0 0.4375 -0.015625 0.40625 -0.046875 C 0.375 -0.078125 0.359375 -0.117188 0.359375 -0.171875 C 0.359375 -0.222656 0.375 -0.265625 0.40625 -0.296875 C 0.4375 -0.328125 0.492188 -0.34375 0.578125 -0.34375 L 0.859375 -0.34375 L 0.859375 -4.375 L 0.40625 -4.375 C 0.332031 -4.375 0.273438 -4.390625 0.234375 -4.421875 C 0.203125 -4.453125 0.1875 -4.492188 0.1875 -4.546875 C 0.1875 -4.597656 0.203125 -4.640625 0.234375 -4.671875 C 0.273438 -4.703125 0.332031 -4.71875 0.40625 -4.71875 L 1.296875 -4.71875 L 3.796875 -0.484375 L 3.796875 -4.375 L 3.171875 -4.375 C 3.085938 -4.375 3.023438 -4.390625 2.984375 -4.421875 C 2.953125 -4.453125 2.9375 -4.492188 2.9375 -4.546875 C 2.9375 -4.597656 2.953125 -4.640625 2.984375 -4.671875 C 3.023438 -4.703125 3.085938 -4.71875 3.171875 -4.71875 L 4.421875 -4.71875 C 4.503906 -4.71875 4.5625 -4.703125 4.59375 -4.671875 C 4.625 -4.640625 4.640625 -4.597656 4.640625 -4.546875 C 4.640625 -4.492188 4.625 -4.453125 4.59375 -4.421875 C 4.5625 -4.390625 4.503906 -4.375 4.421875 -4.375 L 4.140625 -4.375 Z M 4.140625 0 "
+           id="path569" />
+      </g>
+      <g
+         id="glyph-4-31" />
+      <g
+         id="glyph-4-32">
+        <path
+           d="M 2.640625 -4.375 L 2.640625 -0.34375 L 3.515625 -0.34375 C 3.597656 -0.34375 3.65625 -0.328125 3.6875 -0.296875 C 3.726563 -0.265625 3.75 -0.222656 3.75 -0.171875 C 3.75 -0.117188 3.726563 -0.078125 3.6875 -0.046875 C 3.65625 -0.015625 3.597656 0 3.515625 0 L 1.421875 0 C 1.335938 0 1.28125 -0.015625 1.25 -0.046875 C 1.21875 -0.078125 1.203125 -0.117188 1.203125 -0.171875 C 1.203125 -0.222656 1.21875 -0.265625 1.25 -0.296875 C 1.28125 -0.328125 1.335938 -0.34375 1.421875 -0.34375 L 2.296875 -0.34375 L 2.296875 -4.375 L 0.921875 -4.375 L 0.921875 -3.203125 C 0.921875 -3.117188 0.90625 -3.054688 0.875 -3.015625 C 0.84375 -2.984375 0.800781 -2.96875 0.75 -2.96875 C 0.695313 -2.96875 0.65625 -2.984375 0.625 -3.015625 C 0.59375 -3.054688 0.578125 -3.117188 0.578125 -3.203125 L 0.578125 -4.71875 L 4.359375 -4.71875 L 4.359375 -3.203125 C 4.359375 -3.117188 4.34375 -3.054688 4.3125 -3.015625 C 4.289063 -2.984375 4.253906 -2.96875 4.203125 -2.96875 C 4.148438 -2.96875 4.109375 -2.984375 4.078125 -3.015625 C 4.046875 -3.054688 4.03125 -3.117188 4.03125 -3.203125 L 4.03125 -4.375 Z M 2.640625 -4.375 "
+           id="path573" />
+      </g>
+      <g
+         id="glyph-5-0">
+        <path
+           d="M 0.453125 0 L 0.453125 -5.625 L 4.953125 -5.625 L 4.953125 0 Z M 0.59375 -0.140625 L 4.8125 -0.140625 L 4.8125 -5.484375 L 0.59375 -5.484375 Z M 0.59375 -0.140625 "
+           id="path576" />
+      </g>
+      <g
+         id="glyph-5-1">
+        <path
+           d="M 3.15625 -5.40625 C 3.363281 -5.382813 3.566406 -5.328125 3.765625 -5.234375 C 3.804688 -5.265625 3.847656 -5.285156 3.890625 -5.296875 C 3.929688 -5.304688 3.972656 -5.3125 4.015625 -5.3125 C 4.148438 -5.3125 4.257813 -5.265625 4.34375 -5.171875 C 4.425781 -5.078125 4.46875 -4.925781 4.46875 -4.71875 L 4.46875 -4.421875 C 4.46875 -4.203125 4.425781 -4.046875 4.34375 -3.953125 C 4.257813 -3.859375 4.15625 -3.8125 4.03125 -3.8125 C 3.90625 -3.8125 3.800781 -3.851563 3.71875 -3.9375 C 3.632813 -4.019531 3.585938 -4.132813 3.578125 -4.28125 C 3.359375 -4.445313 3.09375 -4.53125 2.78125 -4.53125 C 2.445313 -4.53125 2.203125 -4.46875 2.046875 -4.34375 C 1.898438 -4.226563 1.828125 -4.101563 1.828125 -3.96875 C 1.828125 -3.851563 1.875 -3.753906 1.96875 -3.671875 C 2.0625 -3.578125 2.253906 -3.5 2.546875 -3.4375 L 3.15625 -3.3125 C 3.65625 -3.207031 4.015625 -3.054688 4.234375 -2.859375 C 4.523438 -2.597656 4.671875 -2.25 4.671875 -1.8125 C 4.671875 -1.4375 4.535156 -1.101563 4.265625 -0.8125 C 4.003906 -0.519531 3.632813 -0.328125 3.15625 -0.234375 L 3.15625 0.515625 C 3.15625 0.734375 3.113281 0.890625 3.03125 0.984375 C 2.945313 1.078125 2.835938 1.125 2.703125 1.125 C 2.566406 1.125 2.457031 1.078125 2.375 0.984375 C 2.289063 0.890625 2.25 0.734375 2.25 0.515625 L 2.25 -0.234375 C 2.019531 -0.285156 1.785156 -0.363281 1.546875 -0.46875 C 1.421875 -0.363281 1.304688 -0.3125 1.203125 -0.3125 C 1.054688 -0.3125 0.941406 -0.359375 0.859375 -0.453125 C 0.773438 -0.546875 0.734375 -0.703125 0.734375 -0.921875 L 0.734375 -1.484375 C 0.734375 -1.703125 0.773438 -1.851563 0.859375 -1.9375 C 0.941406 -2.03125 1.050781 -2.078125 1.1875 -2.078125 C 1.289063 -2.078125 1.378906 -2.046875 1.453125 -1.984375 C 1.523438 -1.929688 1.578125 -1.84375 1.609375 -1.71875 C 1.640625 -1.601563 1.6875 -1.515625 1.75 -1.453125 C 1.832031 -1.359375 1.960938 -1.28125 2.140625 -1.21875 C 2.328125 -1.15625 2.515625 -1.125 2.703125 -1.125 C 3.035156 -1.125 3.316406 -1.207031 3.546875 -1.375 C 3.691406 -1.488281 3.765625 -1.640625 3.765625 -1.828125 C 3.765625 -1.972656 3.710938 -2.09375 3.609375 -2.1875 C 3.515625 -2.28125 3.304688 -2.363281 2.984375 -2.4375 L 2.3125 -2.5625 C 1.832031 -2.65625 1.484375 -2.828125 1.265625 -3.078125 C 1.035156 -3.328125 0.921875 -3.628906 0.921875 -3.984375 C 0.921875 -4.328125 1.039063 -4.628906 1.28125 -4.890625 C 1.519531 -5.160156 1.84375 -5.332031 2.25 -5.40625 L 2.25 -5.65625 C 2.25 -5.875 2.289063 -6.023438 2.375 -6.109375 C 2.457031 -6.203125 2.566406 -6.25 2.703125 -6.25 C 2.835938 -6.25 2.945313 -6.203125 3.03125 -6.109375 C 3.113281 -6.023438 3.15625 -5.875 3.15625 -5.65625 Z M 3.15625 -5.40625 "
+           id="path579" />
+      </g>
+      <g
+         id="glyph-5-2">
+        <path
+           d="M 4.109375 -5.09375 C 4.171875 -5.175781 4.234375 -5.234375 4.296875 -5.265625 C 4.359375 -5.304688 4.429688 -5.328125 4.515625 -5.328125 C 4.640625 -5.328125 4.742188 -5.28125 4.828125 -5.1875 C 4.910156 -5.09375 4.953125 -4.941406 4.953125 -4.734375 L 4.953125 -3.96875 C 4.953125 -3.75 4.910156 -3.59375 4.828125 -3.5 C 4.742188 -3.40625 4.640625 -3.359375 4.515625 -3.359375 C 4.390625 -3.359375 4.289063 -3.394531 4.21875 -3.46875 C 4.144531 -3.53125 4.09375 -3.65625 4.0625 -3.84375 C 4.039063 -3.96875 4 -4.0625 3.9375 -4.125 C 3.8125 -4.257813 3.640625 -4.363281 3.421875 -4.4375 C 3.210938 -4.519531 3 -4.5625 2.78125 -4.5625 C 2.507813 -4.5625 2.257813 -4.5 2.03125 -4.375 C 1.8125 -4.257813 1.613281 -4.070313 1.4375 -3.8125 C 1.269531 -3.550781 1.1875 -3.238281 1.1875 -2.875 L 1.1875 -2.296875 C 1.1875 -1.859375 1.34375 -1.492188 1.65625 -1.203125 C 1.96875 -0.910156 2.40625 -0.765625 2.96875 -0.765625 C 3.300781 -0.765625 3.582031 -0.8125 3.8125 -0.90625 C 3.945313 -0.957031 4.09375 -1.0625 4.25 -1.21875 C 4.34375 -1.3125 4.414063 -1.367188 4.46875 -1.390625 C 4.519531 -1.421875 4.578125 -1.4375 4.640625 -1.4375 C 4.765625 -1.4375 4.867188 -1.390625 4.953125 -1.296875 C 5.046875 -1.210938 5.09375 -1.109375 5.09375 -0.984375 C 5.09375 -0.859375 5.03125 -0.726563 4.90625 -0.59375 C 4.726563 -0.382813 4.5 -0.222656 4.21875 -0.109375 C 3.84375 0.046875 3.425781 0.125 2.96875 0.125 C 2.4375 0.125 1.957031 0.015625 1.53125 -0.203125 C 1.1875 -0.378906 0.890625 -0.65625 0.640625 -1.03125 C 0.398438 -1.40625 0.28125 -1.816406 0.28125 -2.265625 L 0.28125 -2.890625 C 0.28125 -3.359375 0.390625 -3.789063 0.609375 -4.1875 C 0.828125 -4.59375 1.128906 -4.90625 1.515625 -5.125 C 1.898438 -5.351563 2.3125 -5.46875 2.75 -5.46875 C 3.007813 -5.46875 3.25 -5.4375 3.46875 -5.375 C 3.695313 -5.3125 3.910156 -5.21875 4.109375 -5.09375 Z M 4.109375 -5.09375 "
+           id="path582" />
+      </g>
+      <g
+         id="glyph-5-3">
+        <path
+           d="M 5.234375 -2.65625 C 5.234375 -1.863281 4.976563 -1.203125 4.46875 -0.671875 C 3.957031 -0.140625 3.367188 0.125 2.703125 0.125 C 2.097656 0.125 1.554688 -0.09375 1.078125 -0.53125 C 0.484375 -1.082031 0.1875 -1.789063 0.1875 -2.65625 C 0.1875 -3.53125 0.484375 -4.242188 1.078125 -4.796875 C 1.554688 -5.242188 2.097656 -5.46875 2.703125 -5.46875 C 3.367188 -5.46875 3.957031 -5.203125 4.46875 -4.671875 C 4.976563 -4.140625 5.234375 -3.46875 5.234375 -2.65625 Z M 4.328125 -2.65625 C 4.328125 -3.207031 4.160156 -3.660156 3.828125 -4.015625 C 3.492188 -4.378906 3.117188 -4.5625 2.703125 -4.5625 C 2.285156 -4.5625 1.910156 -4.378906 1.578125 -4.015625 C 1.242188 -3.660156 1.078125 -3.207031 1.078125 -2.65625 C 1.078125 -2.113281 1.242188 -1.660156 1.578125 -1.296875 C 1.910156 -0.941406 2.285156 -0.765625 2.703125 -0.765625 C 3.117188 -0.765625 3.492188 -0.941406 3.828125 -1.296875 C 4.160156 -1.660156 4.328125 -2.113281 4.328125 -2.65625 Z M 4.328125 -2.65625 "
+           id="path585" />
+      </g>
+      <g
+         id="glyph-5-4">
+        <path
+           d="M 0.6875 -0.90625 L 0.6875 -4.421875 C 0.5 -4.429688 0.359375 -4.476563 0.265625 -4.5625 C 0.171875 -4.644531 0.125 -4.75 0.125 -4.875 C 0.125 -5.007813 0.171875 -5.117188 0.265625 -5.203125 C 0.359375 -5.285156 0.515625 -5.328125 0.734375 -5.328125 L 2.609375 -5.328125 C 2.898438 -5.328125 3.1875 -5.269531 3.46875 -5.15625 C 3.75 -5.050781 3.976563 -4.914063 4.15625 -4.75 C 4.28125 -4.625 4.410156 -4.453125 4.546875 -4.234375 C 4.691406 -4.015625 4.796875 -3.796875 4.859375 -3.578125 C 4.929688 -3.359375 4.96875 -3.09375 4.96875 -2.78125 L 4.96875 -2.34375 C 4.96875 -1.96875 4.898438 -1.628906 4.765625 -1.328125 C 4.640625 -1.035156 4.472656 -0.796875 4.265625 -0.609375 C 4.054688 -0.429688 3.859375 -0.296875 3.671875 -0.203125 C 3.378906 -0.0664063 3.003906 0 2.546875 0 L 0.734375 0 C 0.515625 0 0.359375 -0.0390625 0.265625 -0.125 C 0.171875 -0.207031 0.125 -0.316406 0.125 -0.453125 C 0.125 -0.585938 0.171875 -0.695313 0.265625 -0.78125 C 0.359375 -0.863281 0.5 -0.90625 0.6875 -0.90625 Z M 1.59375 -0.90625 L 2.546875 -0.90625 C 2.898438 -0.90625 3.171875 -0.957031 3.359375 -1.0625 C 3.585938 -1.1875 3.757813 -1.351563 3.875 -1.5625 C 4 -1.769531 4.0625 -2.039063 4.0625 -2.375 L 4.0625 -2.796875 C 4.0625 -3.085938 4.007813 -3.335938 3.90625 -3.546875 C 3.738281 -3.878906 3.546875 -4.109375 3.328125 -4.234375 C 3.117188 -4.359375 2.851563 -4.421875 2.53125 -4.421875 L 1.59375 -4.421875 Z M 1.59375 -0.90625 "
+           id="path588" />
+      </g>
+      <g
+         id="glyph-5-5">
+        <path
+           d="M 1.78125 -2.21875 L 1.78125 -0.90625 L 4.078125 -0.90625 L 4.078125 -1.390625 C 4.078125 -1.609375 4.117188 -1.757813 4.203125 -1.84375 C 4.285156 -1.9375 4.394531 -1.984375 4.53125 -1.984375 C 4.65625 -1.984375 4.757813 -1.9375 4.84375 -1.84375 C 4.925781 -1.757813 4.96875 -1.609375 4.96875 -1.390625 L 4.96875 0 L 0.734375 0 C 0.515625 0 0.359375 -0.0390625 0.265625 -0.125 C 0.171875 -0.207031 0.125 -0.316406 0.125 -0.453125 C 0.125 -0.585938 0.171875 -0.695313 0.265625 -0.78125 C 0.359375 -0.863281 0.515625 -0.90625 0.734375 -0.90625 L 0.875 -0.90625 L 0.875 -4.421875 L 0.734375 -4.421875 C 0.515625 -4.421875 0.359375 -4.460938 0.265625 -4.546875 C 0.171875 -4.628906 0.125 -4.738281 0.125 -4.875 C 0.125 -5.007813 0.171875 -5.117188 0.265625 -5.203125 C 0.359375 -5.285156 0.515625 -5.328125 0.734375 -5.328125 L 4.78125 -5.328125 L 4.78125 -3.953125 C 4.78125 -3.742188 4.738281 -3.59375 4.65625 -3.5 C 4.570313 -3.40625 4.460938 -3.359375 4.328125 -3.359375 C 4.191406 -3.359375 4.082031 -3.398438 4 -3.484375 C 3.914063 -3.578125 3.875 -3.734375 3.875 -3.953125 L 3.875 -4.421875 L 1.78125 -4.421875 L 1.78125 -3.125 L 2.5625 -3.125 C 2.5625 -3.351563 2.582031 -3.503906 2.625 -3.578125 C 2.71875 -3.722656 2.847656 -3.796875 3.015625 -3.796875 C 3.148438 -3.796875 3.257813 -3.75 3.34375 -3.65625 C 3.425781 -3.5625 3.46875 -3.40625 3.46875 -3.1875 L 3.46875 -2.15625 C 3.46875 -1.957031 3.441406 -1.828125 3.390625 -1.765625 C 3.296875 -1.617188 3.171875 -1.546875 3.015625 -1.546875 C 2.847656 -1.546875 2.71875 -1.617188 2.625 -1.765625 C 2.582031 -1.835938 2.5625 -1.988281 2.5625 -2.21875 Z M 1.78125 -2.21875 "
+           id="path591" />
+      </g>
+      <g
+         id="glyph-5-6">
+        <path
+           d="M 1.765625 -2.03125 L 1.765625 -0.90625 L 2.09375 -0.90625 C 2.3125 -0.90625 2.46875 -0.863281 2.5625 -0.78125 C 2.65625 -0.695313 2.703125 -0.585938 2.703125 -0.453125 C 2.703125 -0.316406 2.65625 -0.207031 2.5625 -0.125 C 2.46875 -0.0390625 2.3125 0 2.09375 0 L 0.734375 0 C 0.515625 0 0.359375 -0.0390625 0.265625 -0.125 C 0.171875 -0.207031 0.125 -0.316406 0.125 -0.453125 C 0.125 -0.585938 0.171875 -0.695313 0.265625 -0.78125 C 0.359375 -0.863281 0.515625 -0.90625 0.734375 -0.90625 L 0.875 -0.90625 L 0.875 -4.421875 L 0.734375 -4.421875 C 0.515625 -4.421875 0.359375 -4.460938 0.265625 -4.546875 C 0.171875 -4.628906 0.125 -4.738281 0.125 -4.875 C 0.125 -5.007813 0.171875 -5.117188 0.265625 -5.203125 C 0.359375 -5.285156 0.515625 -5.328125 0.734375 -5.328125 L 2.765625 -5.328125 C 3.398438 -5.328125 3.890625 -5.164063 4.234375 -4.84375 C 4.585938 -4.53125 4.765625 -4.148438 4.765625 -3.703125 C 4.765625 -3.421875 4.679688 -3.164063 4.515625 -2.9375 C 4.359375 -2.707031 4.113281 -2.503906 3.78125 -2.328125 C 3.96875 -2.160156 4.171875 -1.945313 4.390625 -1.6875 C 4.523438 -1.519531 4.707031 -1.257813 4.9375 -0.90625 C 5.164063 -0.90625 5.316406 -0.878906 5.390625 -0.828125 C 5.523438 -0.734375 5.59375 -0.609375 5.59375 -0.453125 C 5.59375 -0.316406 5.546875 -0.207031 5.453125 -0.125 C 5.359375 -0.0390625 5.207031 0 5 0 L 4.484375 0 C 3.753906 -1.125 3.144531 -1.800781 2.65625 -2.03125 Z M 1.765625 -2.9375 L 2.46875 -2.9375 C 2.726563 -2.9375 2.960938 -2.972656 3.171875 -3.046875 C 3.453125 -3.160156 3.640625 -3.273438 3.734375 -3.390625 C 3.828125 -3.503906 3.875 -3.617188 3.875 -3.734375 C 3.875 -3.898438 3.78125 -4.054688 3.59375 -4.203125 C 3.414063 -4.347656 3.148438 -4.421875 2.796875 -4.421875 L 1.765625 -4.421875 Z M 1.765625 -2.9375 "
+           id="path594" />
+      </g>
+      <g
+         id="glyph-5-7">
+        <path
+           d="M 5.1875 2.703125 L 0.25 2.703125 C 0.03125 2.703125 -0.125 2.660156 -0.21875 2.578125 C -0.3125 2.492188 -0.359375 2.382813 -0.359375 2.25 C -0.359375 2.113281 -0.3125 2.003906 -0.21875 1.921875 C -0.125 1.835938 0.03125 1.796875 0.25 1.796875 L 5.1875 1.796875 C 5.40625 1.796875 5.5625 1.835938 5.65625 1.921875 C 5.75 2.003906 5.796875 2.113281 5.796875 2.25 C 5.796875 2.382813 5.75 2.492188 5.65625 2.578125 C 5.5625 2.660156 5.40625 2.703125 5.1875 2.703125 Z M 5.1875 2.703125 "
+           id="path597" />
+      </g>
+      <g
+         id="glyph-5-8">
+        <path
+           d="M 3.15625 -4.421875 L 3.15625 -0.90625 L 4.0625 -0.90625 C 4.28125 -0.90625 4.429688 -0.863281 4.515625 -0.78125 C 4.609375 -0.695313 4.65625 -0.585938 4.65625 -0.453125 C 4.65625 -0.316406 4.609375 -0.207031 4.515625 -0.125 C 4.429688 -0.0390625 4.28125 0 4.0625 0 L 1.34375 0 C 1.125 0 0.96875 -0.0390625 0.875 -0.125 C 0.78125 -0.207031 0.734375 -0.316406 0.734375 -0.453125 C 0.734375 -0.585938 0.78125 -0.695313 0.875 -0.78125 C 0.96875 -0.863281 1.125 -0.90625 1.34375 -0.90625 L 2.25 -0.90625 L 2.25 -4.421875 L 1.34375 -4.421875 C 1.125 -4.421875 0.96875 -4.460938 0.875 -4.546875 C 0.78125 -4.628906 0.734375 -4.738281 0.734375 -4.875 C 0.734375 -5.007813 0.78125 -5.117188 0.875 -5.203125 C 0.96875 -5.285156 1.125 -5.328125 1.34375 -5.328125 L 4.0625 -5.328125 C 4.28125 -5.328125 4.429688 -5.285156 4.515625 -5.203125 C 4.609375 -5.117188 4.65625 -5.007813 4.65625 -4.875 C 4.65625 -4.738281 4.609375 -4.628906 4.515625 -4.546875 C 4.429688 -4.460938 4.28125 -4.421875 4.0625 -4.421875 Z M 3.15625 -4.421875 "
+           id="path600" />
+      </g>
+      <g
+         id="glyph-5-9">
+        <path
+           d="M 4.96875 -1.640625 L 4.96875 -0.4375 C 4.5625 -0.21875 4.210938 -0.0703125 3.921875 0 C 3.640625 0.0820313 3.332031 0.125 3 0.125 C 2.539063 0.125 2.117188 0.0546875 1.734375 -0.078125 C 1.421875 -0.179688 1.175781 -0.3125 1 -0.46875 C 0.820313 -0.632813 0.65625 -0.875 0.5 -1.1875 C 0.351563 -1.5 0.28125 -1.851563 0.28125 -2.25 L 0.28125 -2.890625 C 0.28125 -3.492188 0.460938 -4.03125 0.828125 -4.5 C 1.328125 -5.144531 2 -5.46875 2.84375 -5.46875 C 3.09375 -5.46875 3.328125 -5.441406 3.546875 -5.390625 C 3.765625 -5.335938 3.972656 -5.257813 4.171875 -5.15625 C 4.296875 -5.269531 4.414063 -5.328125 4.53125 -5.328125 C 4.65625 -5.328125 4.757813 -5.28125 4.84375 -5.1875 C 4.925781 -5.09375 4.96875 -4.941406 4.96875 -4.734375 L 4.96875 -4.140625 C 4.96875 -3.921875 4.925781 -3.765625 4.84375 -3.671875 C 4.757813 -3.585938 4.648438 -3.546875 4.515625 -3.546875 C 4.410156 -3.546875 4.320313 -3.578125 4.25 -3.640625 C 4.1875 -3.679688 4.132813 -3.773438 4.09375 -3.921875 C 4.0625 -4.078125 4.019531 -4.179688 3.96875 -4.234375 C 3.882813 -4.316406 3.742188 -4.390625 3.546875 -4.453125 C 3.347656 -4.523438 3.125 -4.5625 2.875 -4.5625 C 2.519531 -4.5625 2.207031 -4.488281 1.9375 -4.34375 C 1.75 -4.226563 1.578125 -4.035156 1.421875 -3.765625 C 1.265625 -3.503906 1.1875 -3.210938 1.1875 -2.890625 L 1.1875 -2.25 C 1.1875 -1.757813 1.328125 -1.390625 1.609375 -1.140625 C 1.890625 -0.890625 2.332031 -0.765625 2.9375 -0.765625 C 3.351563 -0.765625 3.726563 -0.84375 4.0625 -1 L 4.0625 -1.640625 L 3.15625 -1.640625 C 2.9375 -1.640625 2.78125 -1.679688 2.6875 -1.765625 C 2.59375 -1.859375 2.546875 -1.96875 2.546875 -2.09375 C 2.546875 -2.226563 2.59375 -2.335938 2.6875 -2.421875 C 2.78125 -2.503906 2.9375 -2.546875 3.15625 -2.546875 L 4.75 -2.546875 C 4.96875 -2.546875 5.125 -2.503906 5.21875 -2.421875 C 5.3125 -2.335938 5.359375 -2.226563 5.359375 -2.09375 C 5.359375 -1.988281 5.320313 -1.894531 5.25 -1.8125 C 5.1875 -1.738281 5.09375 -1.679688 4.96875 -1.640625 Z M 4.96875 -1.640625 "
+           id="path603" />
+      </g>
+      <g
+         id="glyph-5-10">
+        <path
+           d="M 4.765625 -4.421875 L 4.765625 -1.875 C 4.765625 -1.3125 4.5625 -0.835938 4.15625 -0.453125 C 3.757813 -0.0664063 3.28125 0.125 2.71875 0.125 C 2.4375 0.125 2.171875 0.078125 1.921875 -0.015625 C 1.679688 -0.109375 1.460938 -0.25 1.265625 -0.4375 C 1.078125 -0.632813 0.925781 -0.835938 0.8125 -1.046875 C 0.707031 -1.253906 0.65625 -1.53125 0.65625 -1.875 L 0.65625 -4.421875 C 0.46875 -4.421875 0.328125 -4.460938 0.234375 -4.546875 C 0.140625 -4.640625 0.09375 -4.75 0.09375 -4.875 C 0.09375 -5.007813 0.140625 -5.117188 0.234375 -5.203125 C 0.328125 -5.285156 0.484375 -5.328125 0.703125 -5.328125 L 1.875 -5.328125 C 2.09375 -5.328125 2.25 -5.285156 2.34375 -5.203125 C 2.4375 -5.117188 2.484375 -5.007813 2.484375 -4.875 C 2.484375 -4.738281 2.4375 -4.628906 2.34375 -4.546875 C 2.25 -4.460938 2.09375 -4.421875 1.875 -4.421875 L 1.5625 -4.421875 L 1.5625 -1.796875 C 1.5625 -1.523438 1.671875 -1.285156 1.890625 -1.078125 C 2.117188 -0.867188 2.390625 -0.765625 2.703125 -0.765625 C 2.910156 -0.765625 3.109375 -0.8125 3.296875 -0.90625 C 3.484375 -1.007813 3.632813 -1.160156 3.75 -1.359375 C 3.820313 -1.472656 3.859375 -1.617188 3.859375 -1.796875 L 3.859375 -4.421875 L 3.53125 -4.421875 C 3.3125 -4.421875 3.15625 -4.460938 3.0625 -4.546875 C 2.976563 -4.628906 2.9375 -4.738281 2.9375 -4.875 C 2.9375 -5.007813 2.976563 -5.117188 3.0625 -5.203125 C 3.15625 -5.285156 3.3125 -5.328125 3.53125 -5.328125 L 4.71875 -5.328125 C 4.9375 -5.328125 5.085938 -5.285156 5.171875 -5.203125 C 5.265625 -5.117188 5.3125 -5.007813 5.3125 -4.875 C 5.3125 -4.75 5.265625 -4.640625 5.171875 -4.546875 C 5.085938 -4.460938 4.953125 -4.421875 4.765625 -4.421875 Z M 4.765625 -4.421875 "
+           id="path606" />
+      </g>
+      <g
+         id="glyph-5-11">
+        <path
+           d="M 2.1875 -1.828125 L 2.1875 -0.90625 L 3.09375 -0.90625 C 3.3125 -0.90625 3.460938 -0.863281 3.546875 -0.78125 C 3.640625 -0.695313 3.6875 -0.585938 3.6875 -0.453125 C 3.6875 -0.316406 3.640625 -0.207031 3.546875 -0.125 C 3.460938 -0.0390625 3.3125 0 3.09375 0 L 1.140625 0 C 0.921875 0 0.765625 -0.0390625 0.671875 -0.125 C 0.578125 -0.207031 0.53125 -0.316406 0.53125 -0.453125 C 0.53125 -0.585938 0.578125 -0.695313 0.671875 -0.78125 C 0.765625 -0.863281 0.921875 -0.90625 1.140625 -0.90625 L 1.28125 -0.90625 L 1.28125 -4.421875 L 1.140625 -4.421875 C 0.921875 -4.421875 0.765625 -4.460938 0.671875 -4.546875 C 0.578125 -4.628906 0.53125 -4.738281 0.53125 -4.875 C 0.53125 -5.007813 0.578125 -5.117188 0.671875 -5.203125 C 0.765625 -5.285156 0.921875 -5.328125 1.140625 -5.328125 L 3.21875 -5.328125 C 3.820313 -5.328125 4.300781 -5.160156 4.65625 -4.828125 C 5.007813 -4.492188 5.1875 -4.085938 5.1875 -3.609375 C 5.1875 -3.347656 5.128906 -3.097656 5.015625 -2.859375 C 4.921875 -2.691406 4.765625 -2.519531 4.546875 -2.34375 C 4.335938 -2.175781 4.125 -2.046875 3.90625 -1.953125 C 3.6875 -1.867188 3.394531 -1.828125 3.03125 -1.828125 Z M 2.1875 -2.734375 L 3.015625 -2.734375 C 3.410156 -2.734375 3.722656 -2.820313 3.953125 -3 C 4.179688 -3.175781 4.296875 -3.390625 4.296875 -3.640625 C 4.296875 -3.847656 4.203125 -4.03125 4.015625 -4.1875 C 3.828125 -4.34375 3.5625 -4.421875 3.21875 -4.421875 L 2.1875 -4.421875 Z M 2.1875 -2.734375 "
+           id="path609" />
+      </g>
+      <g
+         id="glyph-5-12">
+        <path
+           d="M 3.296875 -2.71875 L 4.796875 -0.90625 C 4.972656 -0.894531 5.101563 -0.847656 5.1875 -0.765625 C 5.28125 -0.679688 5.328125 -0.578125 5.328125 -0.453125 C 5.328125 -0.316406 5.28125 -0.207031 5.1875 -0.125 C 5.09375 -0.0390625 4.941406 0 4.734375 0 L 3.71875 0 C 3.5 0 3.34375 -0.0390625 3.25 -0.125 C 3.15625 -0.207031 3.109375 -0.316406 3.109375 -0.453125 C 3.109375 -0.578125 3.148438 -0.679688 3.234375 -0.765625 C 3.328125 -0.847656 3.457031 -0.894531 3.625 -0.90625 L 2.71875 -2.015625 L 1.8125 -0.90625 C 1.976563 -0.894531 2.101563 -0.847656 2.1875 -0.765625 C 2.269531 -0.679688 2.3125 -0.578125 2.3125 -0.453125 C 2.3125 -0.316406 2.265625 -0.207031 2.171875 -0.125 C 2.078125 -0.0390625 1.921875 0 1.703125 0 L 0.703125 0 C 0.484375 0 0.328125 -0.0390625 0.234375 -0.125 C 0.140625 -0.207031 0.09375 -0.316406 0.09375 -0.453125 C 0.09375 -0.578125 0.140625 -0.679688 0.234375 -0.765625 C 0.328125 -0.859375 0.460938 -0.90625 0.640625 -0.90625 L 2.125 -2.71875 L 0.703125 -4.421875 C 0.523438 -4.429688 0.394531 -4.476563 0.3125 -4.5625 C 0.226563 -4.644531 0.1875 -4.75 0.1875 -4.875 C 0.1875 -5.007813 0.226563 -5.117188 0.3125 -5.203125 C 0.40625 -5.285156 0.5625 -5.328125 0.78125 -5.328125 L 1.609375 -5.328125 C 1.828125 -5.328125 1.984375 -5.285156 2.078125 -5.203125 C 2.171875 -5.117188 2.21875 -5.007813 2.21875 -4.875 C 2.21875 -4.78125 2.1875 -4.691406 2.125 -4.609375 C 2.082031 -4.554688 2 -4.492188 1.875 -4.421875 L 2.71875 -3.421875 L 3.53125 -4.421875 C 3.394531 -4.492188 3.3125 -4.554688 3.28125 -4.609375 C 3.21875 -4.691406 3.1875 -4.78125 3.1875 -4.875 C 3.1875 -5.007813 3.234375 -5.117188 3.328125 -5.203125 C 3.421875 -5.285156 3.578125 -5.328125 3.796875 -5.328125 L 4.625 -5.328125 C 4.832031 -5.328125 4.984375 -5.285156 5.078125 -5.203125 C 5.171875 -5.117188 5.21875 -5.007813 5.21875 -4.875 C 5.21875 -4.75 5.171875 -4.644531 5.078125 -4.5625 C 4.992188 -4.476563 4.867188 -4.429688 4.703125 -4.421875 Z M 3.296875 -2.71875 "
+           id="path612" />
+      </g>
+      <g
+         id="glyph-5-13">
+        <path
+           d="M 2.078125 -2.21875 L 2.078125 -0.90625 L 3 -0.90625 C 3.21875 -0.90625 3.375 -0.863281 3.46875 -0.78125 C 3.5625 -0.695313 3.609375 -0.585938 3.609375 -0.453125 C 3.609375 -0.316406 3.5625 -0.207031 3.46875 -0.125 C 3.375 -0.0390625 3.21875 0 3 0 L 1.046875 0 C 0.828125 0 0.671875 -0.0390625 0.578125 -0.125 C 0.484375 -0.207031 0.4375 -0.316406 0.4375 -0.453125 C 0.4375 -0.585938 0.484375 -0.695313 0.578125 -0.78125 C 0.671875 -0.863281 0.828125 -0.90625 1.046875 -0.90625 L 1.1875 -0.90625 L 1.1875 -4.421875 L 1.046875 -4.421875 C 0.828125 -4.421875 0.671875 -4.460938 0.578125 -4.546875 C 0.484375 -4.628906 0.4375 -4.738281 0.4375 -4.875 C 0.4375 -5.007813 0.484375 -5.117188 0.578125 -5.203125 C 0.671875 -5.285156 0.828125 -5.328125 1.046875 -5.328125 L 5.28125 -5.328125 L 5.28125 -3.953125 C 5.28125 -3.734375 5.238281 -3.578125 5.15625 -3.484375 C 5.070313 -3.398438 4.960938 -3.359375 4.828125 -3.359375 C 4.691406 -3.359375 4.582031 -3.398438 4.5 -3.484375 C 4.414063 -3.578125 4.375 -3.734375 4.375 -3.953125 L 4.375 -4.421875 L 2.078125 -4.421875 L 2.078125 -3.125 L 2.875 -3.125 C 2.875 -3.351563 2.894531 -3.503906 2.9375 -3.578125 C 3.03125 -3.710938 3.160156 -3.78125 3.328125 -3.78125 C 3.460938 -3.78125 3.570313 -3.734375 3.65625 -3.640625 C 3.738281 -3.554688 3.78125 -3.40625 3.78125 -3.1875 L 3.78125 -2.15625 C 3.78125 -1.9375 3.738281 -1.78125 3.65625 -1.6875 C 3.570313 -1.59375 3.460938 -1.546875 3.328125 -1.546875 C 3.160156 -1.546875 3.03125 -1.617188 2.9375 -1.765625 C 2.894531 -1.828125 2.875 -1.976563 2.875 -2.21875 Z M 2.078125 -2.21875 "
+           id="path615" />
+      </g>
+      <g
+         id="glyph-5-14">
+        <path
+           d="M 2.328125 -4.421875 L 2.328125 -0.90625 L 4.265625 -0.90625 L 4.265625 -1.75 C 4.265625 -1.96875 4.304688 -2.125 4.390625 -2.21875 C 4.472656 -2.3125 4.582031 -2.359375 4.71875 -2.359375 C 4.851563 -2.359375 4.960938 -2.3125 5.046875 -2.21875 C 5.128906 -2.125 5.171875 -1.96875 5.171875 -1.75 L 5.171875 0 L 0.90625 0 C 0.6875 0 0.53125 -0.0390625 0.4375 -0.125 C 0.34375 -0.207031 0.296875 -0.316406 0.296875 -0.453125 C 0.296875 -0.585938 0.34375 -0.695313 0.4375 -0.78125 C 0.53125 -0.863281 0.6875 -0.90625 0.90625 -0.90625 L 1.421875 -0.90625 L 1.421875 -4.421875 L 0.90625 -4.421875 C 0.6875 -4.421875 0.53125 -4.460938 0.4375 -4.546875 C 0.34375 -4.628906 0.296875 -4.738281 0.296875 -4.875 C 0.296875 -5.007813 0.34375 -5.117188 0.4375 -5.203125 C 0.53125 -5.285156 0.6875 -5.328125 0.90625 -5.328125 L 2.859375 -5.328125 C 3.066406 -5.328125 3.21875 -5.285156 3.3125 -5.203125 C 3.40625 -5.117188 3.453125 -5.007813 3.453125 -4.875 C 3.453125 -4.738281 3.40625 -4.628906 3.3125 -4.546875 C 3.21875 -4.460938 3.066406 -4.421875 2.859375 -4.421875 Z M 2.328125 -4.421875 "
+           id="path618" />
+      </g>
+      <g
+         id="glyph-5-15">
+        <path
+           d="M 3.140625 -4.421875 L 3.140625 -0.90625 L 3.75 -0.90625 C 3.957031 -0.90625 4.109375 -0.863281 4.203125 -0.78125 C 4.296875 -0.695313 4.34375 -0.585938 4.34375 -0.453125 C 4.34375 -0.316406 4.296875 -0.207031 4.203125 -0.125 C 4.109375 -0.0390625 3.957031 0 3.75 0 L 1.640625 0 C 1.421875 0 1.265625 -0.0390625 1.171875 -0.125 C 1.078125 -0.207031 1.03125 -0.316406 1.03125 -0.453125 C 1.03125 -0.585938 1.078125 -0.695313 1.171875 -0.78125 C 1.265625 -0.863281 1.421875 -0.90625 1.640625 -0.90625 L 2.234375 -0.90625 L 2.234375 -4.421875 L 1.265625 -4.421875 L 1.265625 -3.578125 C 1.265625 -3.359375 1.222656 -3.203125 1.140625 -3.109375 C 1.054688 -3.015625 0.945313 -2.96875 0.8125 -2.96875 C 0.675781 -2.96875 0.566406 -3.015625 0.484375 -3.109375 C 0.398438 -3.203125 0.359375 -3.359375 0.359375 -3.578125 L 0.359375 -5.328125 L 5.03125 -5.328125 L 5.03125 -3.578125 C 5.03125 -3.359375 4.988281 -3.203125 4.90625 -3.109375 C 4.820313 -3.015625 4.710938 -2.96875 4.578125 -2.96875 C 4.441406 -2.96875 4.332031 -3.015625 4.25 -3.109375 C 4.164063 -3.203125 4.125 -3.359375 4.125 -3.578125 L 4.125 -4.421875 Z M 3.140625 -4.421875 "
+           id="path621" />
+      </g>
+      <g
+         id="glyph-5-16">
+        <path
+           d="M 3.796875 -1.453125 L 1.609375 -1.453125 L 1.390625 -0.90625 L 1.609375 -0.90625 C 1.828125 -0.90625 1.984375 -0.863281 2.078125 -0.78125 C 2.171875 -0.695313 2.21875 -0.585938 2.21875 -0.453125 C 2.21875 -0.316406 2.171875 -0.207031 2.078125 -0.125 C 1.984375 -0.0390625 1.828125 0 1.609375 0 L 0.40625 0 C 0.1875 0 0.03125 -0.0390625 -0.0625 -0.125 C -0.15625 -0.207031 -0.203125 -0.316406 -0.203125 -0.453125 C -0.203125 -0.585938 -0.148438 -0.695313 -0.046875 -0.78125 C 0.046875 -0.863281 0.203125 -0.90625 0.421875 -0.90625 L 1.84375 -4.421875 L 1.25 -4.421875 C 1.03125 -4.421875 0.875 -4.460938 0.78125 -4.546875 C 0.6875 -4.628906 0.640625 -4.738281 0.640625 -4.875 C 0.640625 -5.007813 0.6875 -5.117188 0.78125 -5.203125 C 0.875 -5.285156 1.03125 -5.328125 1.25 -5.328125 L 3.1875 -5.328125 L 4.984375 -0.90625 C 5.191406 -0.90625 5.332031 -0.878906 5.40625 -0.828125 C 5.539063 -0.734375 5.609375 -0.609375 5.609375 -0.453125 C 5.609375 -0.316406 5.5625 -0.207031 5.46875 -0.125 C 5.375 -0.0390625 5.222656 0 5.015625 0 L 3.796875 0 C 3.578125 0 3.421875 -0.0390625 3.328125 -0.125 C 3.234375 -0.207031 3.1875 -0.316406 3.1875 -0.453125 C 3.1875 -0.585938 3.234375 -0.695313 3.328125 -0.78125 C 3.421875 -0.863281 3.578125 -0.90625 3.796875 -0.90625 L 4.015625 -0.90625 Z M 3.421875 -2.34375 L 2.703125 -4.140625 L 1.96875 -2.34375 Z M 3.421875 -2.34375 "
+           id="path624" />
+      </g>
+      <g
+         id="glyph-5-17">
+        <path
+           d="M 1.390625 -0.234375 C 1.304688 -0.140625 1.238281 -0.078125 1.1875 -0.046875 C 1.144531 -0.0234375 1.085938 -0.015625 1.015625 -0.015625 C 0.878906 -0.015625 0.769531 -0.0546875 0.6875 -0.140625 C 0.601563 -0.234375 0.5625 -0.390625 0.5625 -0.609375 L 0.5625 -1.21875 C 0.5625 -1.425781 0.601563 -1.578125 0.6875 -1.671875 C 0.769531 -1.765625 0.878906 -1.8125 1.015625 -1.8125 C 1.117188 -1.8125 1.207031 -1.78125 1.28125 -1.71875 C 1.351563 -1.664063 1.40625 -1.570313 1.4375 -1.4375 C 1.476563 -1.3125 1.519531 -1.226563 1.5625 -1.1875 C 1.644531 -1.09375 1.796875 -1 2.015625 -0.90625 C 2.234375 -0.8125 2.472656 -0.765625 2.734375 -0.765625 C 3.128906 -0.765625 3.457031 -0.859375 3.71875 -1.046875 C 3.882813 -1.160156 3.96875 -1.300781 3.96875 -1.46875 C 3.96875 -1.582031 3.925781 -1.6875 3.84375 -1.78125 C 3.769531 -1.882813 3.640625 -1.96875 3.453125 -2.03125 C 3.335938 -2.070313 3.078125 -2.128906 2.671875 -2.203125 C 2.179688 -2.296875 1.804688 -2.40625 1.546875 -2.53125 C 1.296875 -2.664063 1.097656 -2.847656 0.953125 -3.078125 C 0.804688 -3.316406 0.734375 -3.570313 0.734375 -3.84375 C 0.734375 -4.269531 0.910156 -4.644531 1.265625 -4.96875 C 1.628906 -5.300781 2.101563 -5.46875 2.6875 -5.46875 C 2.914063 -5.46875 3.128906 -5.441406 3.328125 -5.390625 C 3.523438 -5.335938 3.707031 -5.257813 3.875 -5.15625 C 3.988281 -5.269531 4.101563 -5.328125 4.21875 -5.328125 C 4.351563 -5.328125 4.460938 -5.28125 4.546875 -5.1875 C 4.628906 -5.09375 4.671875 -4.9375 4.671875 -4.71875 L 4.671875 -4.046875 C 4.671875 -3.828125 4.628906 -3.671875 4.546875 -3.578125 C 4.460938 -3.492188 4.351563 -3.453125 4.21875 -3.453125 C 4.101563 -3.453125 4.003906 -3.484375 3.921875 -3.546875 C 3.859375 -3.597656 3.8125 -3.695313 3.78125 -3.84375 C 3.75 -3.988281 3.707031 -4.097656 3.65625 -4.171875 C 3.570313 -4.273438 3.445313 -4.363281 3.28125 -4.4375 C 3.113281 -4.519531 2.914063 -4.5625 2.6875 -4.5625 C 2.363281 -4.5625 2.109375 -4.484375 1.921875 -4.328125 C 1.734375 -4.179688 1.640625 -4.023438 1.640625 -3.859375 C 1.640625 -3.753906 1.675781 -3.648438 1.75 -3.546875 C 1.832031 -3.441406 1.945313 -3.359375 2.09375 -3.296875 C 2.1875 -3.253906 2.460938 -3.1875 2.921875 -3.09375 C 3.390625 -3.007813 3.75 -2.910156 4 -2.796875 C 4.25 -2.691406 4.453125 -2.519531 4.609375 -2.28125 C 4.773438 -2.050781 4.859375 -1.78125 4.859375 -1.46875 C 4.859375 -1.019531 4.703125 -0.660156 4.390625 -0.390625 C 3.972656 -0.046875 3.441406 0.125 2.796875 0.125 C 2.546875 0.125 2.300781 0.09375 2.0625 0.03125 C 1.832031 -0.0195313 1.609375 -0.109375 1.390625 -0.234375 Z M 1.390625 -0.234375 "
+           id="path627" />
+      </g>
+      <g
+         id="glyph-5-18">
+        <path
+           d="M 1.578125 -3.625 L 1.578125 -0.90625 L 1.90625 -0.90625 C 2.113281 -0.90625 2.265625 -0.863281 2.359375 -0.78125 C 2.453125 -0.695313 2.5 -0.585938 2.5 -0.453125 C 2.5 -0.316406 2.453125 -0.207031 2.359375 -0.125 C 2.265625 -0.0390625 2.113281 0 1.90625 0 L 0.71875 0 C 0.5 0 0.34375 -0.0390625 0.25 -0.125 C 0.15625 -0.207031 0.109375 -0.316406 0.109375 -0.453125 C 0.109375 -0.578125 0.15625 -0.679688 0.25 -0.765625 C 0.34375 -0.859375 0.484375 -0.90625 0.671875 -0.90625 L 0.671875 -4.421875 L 0.53125 -4.421875 C 0.3125 -4.421875 0.15625 -4.460938 0.0625 -4.546875 C -0.03125 -4.628906 -0.078125 -4.738281 -0.078125 -4.875 C -0.078125 -5.007813 -0.03125 -5.117188 0.0625 -5.203125 C 0.15625 -5.285156 0.3125 -5.328125 0.53125 -5.328125 L 1.578125 -5.328125 L 3.875 -1.71875 L 3.875 -4.421875 L 3.546875 -4.421875 C 3.328125 -4.421875 3.171875 -4.460938 3.078125 -4.546875 C 2.992188 -4.628906 2.953125 -4.738281 2.953125 -4.875 C 2.953125 -5.007813 2.992188 -5.117188 3.078125 -5.203125 C 3.171875 -5.285156 3.328125 -5.328125 3.546875 -5.328125 L 4.734375 -5.328125 C 4.953125 -5.328125 5.101563 -5.285156 5.1875 -5.203125 C 5.28125 -5.117188 5.328125 -5.007813 5.328125 -4.875 C 5.328125 -4.75 5.28125 -4.640625 5.1875 -4.546875 C 5.101563 -4.460938 4.96875 -4.421875 4.78125 -4.421875 L 4.78125 0 L 3.890625 0 Z M 1.578125 -3.625 "
+           id="path630" />
+      </g>
+      <g
+         id="glyph-5-19">
+        <path
+           d="M 2.703125 -2.5625 L 1.875 0 L 0.859375 0 L 0.328125 -4.421875 C 0.179688 -4.441406 0.0703125 -4.488281 0 -4.5625 C -0.0625 -4.644531 -0.09375 -4.742188 -0.09375 -4.859375 C -0.09375 -5.003906 -0.046875 -5.117188 0.046875 -5.203125 C 0.140625 -5.285156 0.289063 -5.328125 0.5 -5.328125 L 1.703125 -5.328125 C 1.921875 -5.328125 2.078125 -5.285156 2.171875 -5.203125 C 2.265625 -5.117188 2.3125 -5.007813 2.3125 -4.875 C 2.3125 -4.738281 2.265625 -4.628906 2.171875 -4.546875 C 2.078125 -4.460938 1.921875 -4.421875 1.703125 -4.421875 L 1.234375 -4.421875 L 1.53125 -1.90625 L 2.234375 -4 L 3.171875 -4 L 3.875 -1.90625 L 4.171875 -4.421875 L 3.703125 -4.421875 C 3.492188 -4.421875 3.34375 -4.460938 3.25 -4.546875 C 3.15625 -4.628906 3.109375 -4.738281 3.109375 -4.875 C 3.109375 -5.007813 3.15625 -5.117188 3.25 -5.203125 C 3.34375 -5.285156 3.492188 -5.328125 3.703125 -5.328125 L 4.90625 -5.328125 C 5.125 -5.328125 5.273438 -5.285156 5.359375 -5.203125 C 5.453125 -5.117188 5.5 -5.007813 5.5 -4.875 C 5.5 -4.757813 5.460938 -4.660156 5.390625 -4.578125 C 5.316406 -4.492188 5.210938 -4.441406 5.078125 -4.421875 L 4.5625 0 L 3.5625 0 Z M 2.703125 -2.5625 "
+           id="path633" />
+      </g>
+      <g
+         id="glyph-5-20">
+        <path
+           d="M 1.296875 -3.59375 L 1.296875 -0.90625 L 1.625 -0.90625 C 1.832031 -0.90625 1.984375 -0.863281 2.078125 -0.78125 C 2.171875 -0.695313 2.21875 -0.585938 2.21875 -0.453125 C 2.21875 -0.316406 2.171875 -0.207031 2.078125 -0.125 C 1.984375 -0.0390625 1.832031 0 1.625 0 L 0.4375 0 C 0.21875 0 0.0625 -0.0390625 -0.03125 -0.125 C -0.125 -0.207031 -0.171875 -0.316406 -0.171875 -0.453125 C -0.171875 -0.585938 -0.125 -0.695313 -0.03125 -0.78125 C 0.0625 -0.863281 0.203125 -0.90625 0.390625 -0.90625 L 0.390625 -4.421875 C 0.234375 -4.441406 0.113281 -4.488281 0.03125 -4.5625 C -0.0507813 -4.644531 -0.09375 -4.75 -0.09375 -4.875 C -0.09375 -5.007813 -0.046875 -5.117188 0.046875 -5.203125 C 0.140625 -5.285156 0.296875 -5.328125 0.515625 -5.328125 L 1.5 -5.328125 L 2.734375 -2.609375 L 3.9375 -5.328125 L 4.9375 -5.328125 C 5.144531 -5.328125 5.296875 -5.285156 5.390625 -5.203125 C 5.484375 -5.117188 5.53125 -5.007813 5.53125 -4.875 C 5.53125 -4.75 5.488281 -4.644531 5.40625 -4.5625 C 5.320313 -4.488281 5.203125 -4.441406 5.046875 -4.421875 L 5.046875 -0.90625 C 5.242188 -0.90625 5.382813 -0.859375 5.46875 -0.765625 C 5.5625 -0.679688 5.609375 -0.578125 5.609375 -0.453125 C 5.609375 -0.316406 5.5625 -0.207031 5.46875 -0.125 C 5.375 -0.0390625 5.222656 0 5.015625 0 L 3.828125 0 C 3.609375 0 3.453125 -0.0390625 3.359375 -0.125 C 3.265625 -0.207031 3.21875 -0.316406 3.21875 -0.453125 C 3.21875 -0.585938 3.265625 -0.695313 3.359375 -0.78125 C 3.453125 -0.863281 3.609375 -0.90625 3.828125 -0.90625 L 4.15625 -0.90625 L 4.15625 -3.59375 L 3.125 -1.265625 L 2.34375 -1.265625 Z M 1.296875 -3.59375 "
+           id="path636" />
+      </g>
+      <g
+         id="glyph-6-0">
+        <path
+           d="M 0.34375 0 L 0.34375 -4.21875 L 3.71875 -4.21875 L 3.71875 0 Z M 0.4375 -0.109375 L 3.609375 -0.109375 L 3.609375 -4.109375 L 0.4375 -4.109375 Z M 0.4375 -0.109375 "
+           id="path639" />
+      </g>
+      <g
+         id="glyph-6-1">
+        <path
+           d="M 3.078125 -3.828125 C 3.117188 -3.878906 3.164063 -3.921875 3.21875 -3.953125 C 3.269531 -3.984375 3.320313 -4 3.375 -4 C 3.476563 -4 3.5625 -3.960938 3.625 -3.890625 C 3.6875 -3.828125 3.71875 -3.710938 3.71875 -3.546875 L 3.71875 -2.96875 C 3.71875 -2.8125 3.6875 -2.695313 3.625 -2.625 C 3.5625 -2.550781 3.476563 -2.515625 3.375 -2.515625 C 3.289063 -2.515625 3.222656 -2.539063 3.171875 -2.59375 C 3.109375 -2.644531 3.066406 -2.738281 3.046875 -2.875 C 3.023438 -2.96875 2.992188 -3.039063 2.953125 -3.09375 C 2.859375 -3.195313 2.726563 -3.273438 2.5625 -3.328125 C 2.40625 -3.390625 2.25 -3.421875 2.09375 -3.421875 C 1.882813 -3.421875 1.695313 -3.375 1.53125 -3.28125 C 1.363281 -3.195313 1.210938 -3.054688 1.078125 -2.859375 C 0.953125 -2.660156 0.890625 -2.425781 0.890625 -2.15625 L 0.890625 -1.71875 C 0.890625 -1.394531 1.003906 -1.125 1.234375 -0.90625 C 1.472656 -0.6875 1.800781 -0.578125 2.21875 -0.578125 C 2.46875 -0.578125 2.679688 -0.609375 2.859375 -0.671875 C 2.960938 -0.710938 3.070313 -0.789063 3.1875 -0.90625 C 3.257813 -0.976563 3.3125 -1.023438 3.34375 -1.046875 C 3.382813 -1.066406 3.429688 -1.078125 3.484375 -1.078125 C 3.578125 -1.078125 3.65625 -1.039063 3.71875 -0.96875 C 3.789063 -0.90625 3.828125 -0.828125 3.828125 -0.734375 C 3.828125 -0.640625 3.78125 -0.539063 3.6875 -0.4375 C 3.550781 -0.289063 3.378906 -0.171875 3.171875 -0.078125 C 2.890625 0.0351563 2.578125 0.09375 2.234375 0.09375 C 1.828125 0.09375 1.460938 0.015625 1.140625 -0.140625 C 0.890625 -0.273438 0.671875 -0.484375 0.484375 -0.765625 C 0.304688 -1.054688 0.21875 -1.367188 0.21875 -1.703125 L 0.21875 -2.15625 C 0.21875 -2.507813 0.296875 -2.835938 0.453125 -3.140625 C 0.617188 -3.453125 0.847656 -3.6875 1.140625 -3.84375 C 1.429688 -4.007813 1.738281 -4.09375 2.0625 -4.09375 C 2.257813 -4.09375 2.441406 -4.070313 2.609375 -4.03125 C 2.773438 -3.988281 2.929688 -3.921875 3.078125 -3.828125 Z M 3.078125 -3.828125 "
+           id="path642" />
+      </g>
+      <g
+         id="glyph-6-2">
+        <path
+           d="M 3.78125 -1.4375 C 3.78125 -1.175781 3.707031 -0.925781 3.5625 -0.6875 C 3.414063 -0.445313 3.203125 -0.253906 2.921875 -0.109375 C 2.640625 0.0351563 2.34375 0.109375 2.03125 0.109375 C 1.71875 0.109375 1.421875 0.0390625 1.140625 -0.09375 C 0.859375 -0.238281 0.644531 -0.429688 0.5 -0.671875 C 0.351563 -0.921875 0.28125 -1.179688 0.28125 -1.453125 C 0.28125 -1.722656 0.351563 -1.988281 0.5 -2.25 C 0.65625 -2.507813 0.875 -2.710938 1.15625 -2.859375 C 1.4375 -3.003906 1.726563 -3.078125 2.03125 -3.078125 C 2.332031 -3.078125 2.625 -3 2.90625 -2.84375 C 3.195313 -2.695313 3.414063 -2.492188 3.5625 -2.234375 C 3.707031 -1.972656 3.78125 -1.707031 3.78125 -1.4375 Z M 3.109375 -1.4375 C 3.109375 -1.65625 3.03125 -1.851563 2.875 -2.03125 C 2.65625 -2.28125 2.375 -2.40625 2.03125 -2.40625 C 1.726563 -2.40625 1.472656 -2.304688 1.265625 -2.109375 C 1.054688 -1.910156 0.953125 -1.6875 0.953125 -1.4375 C 0.953125 -1.226563 1.054688 -1.03125 1.265625 -0.84375 C 1.472656 -0.65625 1.726563 -0.5625 2.03125 -0.5625 C 2.332031 -0.5625 2.585938 -0.65625 2.796875 -0.84375 C 3.003906 -1.03125 3.109375 -1.226563 3.109375 -1.4375 Z M 3.109375 -1.4375 "
+           id="path645" />
+      </g>
+      <g
+         id="glyph-6-3">
+        <path
+           d="M 1.34375 -3 L 1.34375 -2.765625 C 1.46875 -2.867188 1.601563 -2.945313 1.75 -3 C 1.894531 -3.050781 2.054688 -3.078125 2.234375 -3.078125 C 2.628906 -3.078125 2.945313 -2.953125 3.1875 -2.703125 C 3.363281 -2.503906 3.453125 -2.25 3.453125 -1.9375 L 3.453125 -0.671875 C 3.597656 -0.671875 3.703125 -0.640625 3.765625 -0.578125 C 3.835938 -0.515625 3.875 -0.4375 3.875 -0.34375 C 3.875 -0.238281 3.835938 -0.15625 3.765625 -0.09375 C 3.703125 -0.03125 3.585938 0 3.421875 0 L 2.8125 0 C 2.65625 0 2.539063 -0.03125 2.46875 -0.09375 C 2.394531 -0.15625 2.359375 -0.238281 2.359375 -0.34375 C 2.359375 -0.4375 2.390625 -0.515625 2.453125 -0.578125 C 2.523438 -0.640625 2.632813 -0.671875 2.78125 -0.671875 L 2.78125 -1.953125 C 2.78125 -2.097656 2.738281 -2.207031 2.65625 -2.28125 C 2.5625 -2.363281 2.410156 -2.40625 2.203125 -2.40625 C 2.046875 -2.40625 1.90625 -2.375 1.78125 -2.3125 C 1.664063 -2.25 1.519531 -2.125 1.34375 -1.9375 L 1.34375 -0.671875 C 1.519531 -0.671875 1.628906 -0.65625 1.671875 -0.625 C 1.785156 -0.5625 1.84375 -0.46875 1.84375 -0.34375 C 1.84375 -0.238281 1.804688 -0.15625 1.734375 -0.09375 C 1.660156 -0.03125 1.546875 0 1.390625 0 L 0.625 0 C 0.457031 0 0.335938 -0.03125 0.265625 -0.09375 C 0.203125 -0.15625 0.171875 -0.238281 0.171875 -0.34375 C 0.171875 -0.46875 0.222656 -0.5625 0.328125 -0.625 C 0.378906 -0.65625 0.492188 -0.671875 0.671875 -0.671875 L 0.671875 -2.3125 C 0.523438 -2.3125 0.414063 -2.34375 0.34375 -2.40625 C 0.28125 -2.476563 0.25 -2.5625 0.25 -2.65625 C 0.25 -2.757813 0.28125 -2.84375 0.34375 -2.90625 C 0.414063 -2.96875 0.535156 -3 0.703125 -3 Z M 1.34375 -3 "
+           id="path648" />
+      </g>
+      <g
+         id="glyph-6-4">
+        <path
+           d="M 2.015625 -2.3125 L 2.015625 -0.671875 L 2.984375 -0.671875 C 3.148438 -0.671875 3.265625 -0.640625 3.328125 -0.578125 C 3.398438 -0.515625 3.4375 -0.4375 3.4375 -0.34375 C 3.4375 -0.238281 3.398438 -0.15625 3.328125 -0.09375 C 3.265625 -0.03125 3.148438 0 2.984375 0 L 0.9375 0 C 0.78125 0 0.664063 -0.03125 0.59375 -0.09375 C 0.519531 -0.15625 0.484375 -0.238281 0.484375 -0.34375 C 0.484375 -0.4375 0.519531 -0.515625 0.59375 -0.578125 C 0.664063 -0.640625 0.78125 -0.671875 0.9375 -0.671875 L 1.34375 -0.671875 L 1.34375 -2.3125 L 1.015625 -2.3125 C 0.859375 -2.3125 0.742188 -2.34375 0.671875 -2.40625 C 0.597656 -2.46875 0.5625 -2.550781 0.5625 -2.65625 C 0.5625 -2.757813 0.597656 -2.84375 0.671875 -2.90625 C 0.742188 -2.96875 0.859375 -3 1.015625 -3 L 1.34375 -3 L 1.34375 -3.25 C 1.34375 -3.539063 1.453125 -3.785156 1.671875 -3.984375 C 1.890625 -4.179688 2.210938 -4.28125 2.640625 -4.28125 C 2.828125 -4.28125 3.039063 -4.257813 3.28125 -4.21875 C 3.53125 -4.1875 3.6875 -4.140625 3.75 -4.078125 C 3.820313 -4.015625 3.859375 -3.9375 3.859375 -3.84375 C 3.859375 -3.738281 3.828125 -3.65625 3.765625 -3.59375 C 3.703125 -3.53125 3.628906 -3.5 3.546875 -3.5 C 3.503906 -3.5 3.441406 -3.503906 3.359375 -3.515625 C 3.078125 -3.566406 2.828125 -3.59375 2.609375 -3.59375 C 2.390625 -3.59375 2.234375 -3.554688 2.140625 -3.484375 C 2.054688 -3.421875 2.015625 -3.34375 2.015625 -3.25 L 2.015625 -3 L 3.0625 -3 C 3.226563 -3 3.34375 -2.96875 3.40625 -2.90625 C 3.476563 -2.84375 3.515625 -2.757813 3.515625 -2.65625 C 3.515625 -2.550781 3.476563 -2.46875 3.40625 -2.40625 C 3.34375 -2.34375 3.226563 -2.3125 3.0625 -2.3125 Z M 2.015625 -2.3125 "
+           id="path651" />
+      </g>
+      <g
+         id="glyph-6-5">
+        <path
+           d="M 2.265625 -4.28125 L 2.265625 -3.5625 L 1.46875 -3.5625 L 1.46875 -4.28125 Z M 2.359375 -3 L 2.359375 -0.671875 L 3.171875 -0.671875 C 3.335938 -0.671875 3.453125 -0.640625 3.515625 -0.578125 C 3.585938 -0.515625 3.625 -0.4375 3.625 -0.34375 C 3.625 -0.238281 3.585938 -0.15625 3.515625 -0.09375 C 3.453125 -0.03125 3.335938 0 3.171875 0 L 0.875 0 C 0.707031 0 0.585938 -0.03125 0.515625 -0.09375 C 0.453125 -0.15625 0.421875 -0.238281 0.421875 -0.34375 C 0.421875 -0.4375 0.453125 -0.515625 0.515625 -0.578125 C 0.585938 -0.640625 0.707031 -0.671875 0.875 -0.671875 L 1.6875 -0.671875 L 1.6875 -2.3125 L 1.140625 -2.3125 C 0.984375 -2.3125 0.867188 -2.34375 0.796875 -2.40625 C 0.722656 -2.46875 0.6875 -2.550781 0.6875 -2.65625 C 0.6875 -2.757813 0.71875 -2.84375 0.78125 -2.90625 C 0.851563 -2.96875 0.972656 -3 1.140625 -3 Z M 2.359375 -3 "
+           id="path654" />
+      </g>
+      <g
+         id="glyph-6-6">
+        <path
+           d="M 2.765625 -2.796875 L 2.765625 -3 L 3.5625 -3 C 3.71875 -3 3.832031 -2.96875 3.90625 -2.90625 C 3.976563 -2.84375 4.015625 -2.757813 4.015625 -2.65625 C 4.015625 -2.550781 3.976563 -2.46875 3.90625 -2.40625 C 3.832031 -2.34375 3.71875 -2.3125 3.5625 -2.3125 L 3.4375 -2.3125 L 3.4375 0.140625 C 3.4375 0.378906 3.382813 0.585938 3.28125 0.765625 C 3.1875 0.941406 3.035156 1.09375 2.828125 1.21875 C 2.628906 1.34375 2.398438 1.40625 2.140625 1.40625 L 1.375 1.40625 C 1.207031 1.40625 1.085938 1.375 1.015625 1.3125 C 0.953125 1.25 0.921875 1.171875 0.921875 1.078125 C 0.921875 0.972656 0.953125 0.890625 1.015625 0.828125 C 1.085938 0.765625 1.207031 0.734375 1.375 0.734375 L 2.109375 0.734375 C 2.316406 0.734375 2.476563 0.675781 2.59375 0.5625 C 2.707031 0.457031 2.765625 0.316406 2.765625 0.140625 L 2.765625 -0.1875 C 2.617188 -0.09375 2.46875 -0.0195313 2.3125 0.03125 C 2.15625 0.0820313 1.992188 0.109375 1.828125 0.109375 C 1.367188 0.109375 0.984375 -0.0390625 0.671875 -0.34375 C 0.367188 -0.65625 0.21875 -1.039063 0.21875 -1.5 C 0.21875 -1.945313 0.367188 -2.320313 0.671875 -2.625 C 0.984375 -2.9375 1.367188 -3.09375 1.828125 -3.09375 C 2.003906 -3.09375 2.171875 -3.066406 2.328125 -3.015625 C 2.484375 -2.960938 2.628906 -2.890625 2.765625 -2.796875 Z M 2.765625 -1.5 C 2.765625 -1.75 2.671875 -1.960938 2.484375 -2.140625 C 2.304688 -2.328125 2.085938 -2.421875 1.828125 -2.421875 C 1.566406 -2.421875 1.34375 -2.328125 1.15625 -2.140625 C 0.976563 -1.960938 0.890625 -1.75 0.890625 -1.5 C 0.890625 -1.25 0.976563 -1.03125 1.15625 -0.84375 C 1.34375 -0.664063 1.566406 -0.578125 1.828125 -0.578125 C 2.085938 -0.578125 2.304688 -0.664063 2.484375 -0.84375 C 2.671875 -1.03125 2.765625 -1.25 2.765625 -1.5 Z M 2.765625 -1.5 "
+           id="path657" />
+      </g>
+      <g
+         id="glyph-6-7">
+        <path
+           d="M 3.453125 -3 L 3.453125 -0.671875 C 3.597656 -0.671875 3.703125 -0.640625 3.765625 -0.578125 C 3.835938 -0.515625 3.875 -0.4375 3.875 -0.34375 C 3.875 -0.238281 3.835938 -0.15625 3.765625 -0.09375 C 3.703125 -0.03125 3.585938 0 3.421875 0 L 2.78125 0 L 2.78125 -0.15625 C 2.59375 -0.0625 2.410156 0.00390625 2.234375 0.046875 C 2.054688 0.0859375 1.890625 0.109375 1.734375 0.109375 C 1.503906 0.109375 1.304688 0.0625 1.140625 -0.03125 C 0.984375 -0.125 0.859375 -0.253906 0.765625 -0.421875 C 0.703125 -0.535156 0.671875 -0.679688 0.671875 -0.859375 L 0.671875 -2.3125 L 0.546875 -2.3125 C 0.390625 -2.3125 0.273438 -2.34375 0.203125 -2.40625 C 0.128906 -2.46875 0.09375 -2.550781 0.09375 -2.65625 C 0.09375 -2.757813 0.128906 -2.84375 0.203125 -2.90625 C 0.273438 -2.96875 0.390625 -3 0.546875 -3 L 1.34375 -3 L 1.34375 -0.984375 C 1.34375 -0.835938 1.375 -0.726563 1.4375 -0.65625 C 1.507813 -0.59375 1.617188 -0.5625 1.765625 -0.5625 C 1.898438 -0.5625 2.046875 -0.585938 2.203125 -0.640625 C 2.359375 -0.703125 2.550781 -0.800781 2.78125 -0.9375 L 2.78125 -2.3125 L 2.546875 -2.3125 C 2.378906 -2.3125 2.257813 -2.34375 2.1875 -2.40625 C 2.125 -2.46875 2.09375 -2.550781 2.09375 -2.65625 C 2.09375 -2.757813 2.125 -2.84375 2.1875 -2.90625 C 2.257813 -2.96875 2.378906 -3 2.546875 -3 Z M 3.453125 -3 "
+           id="path660" />
+      </g>
+      <g
+         id="glyph-6-8">
+        <path
+           d="M 1.890625 -3 L 1.890625 -2.578125 C 2.171875 -2.773438 2.390625 -2.90625 2.546875 -2.96875 C 2.710938 -3.039063 2.867188 -3.078125 3.015625 -3.078125 C 3.234375 -3.078125 3.445313 -3 3.65625 -2.84375 C 3.789063 -2.726563 3.859375 -2.613281 3.859375 -2.5 C 3.859375 -2.40625 3.828125 -2.320313 3.765625 -2.25 C 3.703125 -2.1875 3.617188 -2.15625 3.515625 -2.15625 C 3.429688 -2.15625 3.34375 -2.195313 3.25 -2.28125 C 3.164063 -2.363281 3.085938 -2.40625 3.015625 -2.40625 C 2.921875 -2.40625 2.78125 -2.34375 2.59375 -2.21875 C 2.40625 -2.101563 2.171875 -1.925781 1.890625 -1.6875 L 1.890625 -0.671875 L 2.84375 -0.671875 C 3.007813 -0.671875 3.125 -0.640625 3.1875 -0.578125 C 3.257813 -0.515625 3.296875 -0.4375 3.296875 -0.34375 C 3.296875 -0.238281 3.257813 -0.15625 3.1875 -0.09375 C 3.125 -0.03125 3.007813 0 2.84375 0 L 0.8125 0 C 0.644531 0 0.523438 -0.03125 0.453125 -0.09375 C 0.390625 -0.15625 0.359375 -0.238281 0.359375 -0.34375 C 0.359375 -0.4375 0.390625 -0.515625 0.453125 -0.578125 C 0.523438 -0.640625 0.644531 -0.671875 0.8125 -0.671875 L 1.203125 -0.671875 L 1.203125 -2.3125 L 0.96875 -2.3125 C 0.800781 -2.3125 0.679688 -2.34375 0.609375 -2.40625 C 0.546875 -2.46875 0.515625 -2.550781 0.515625 -2.65625 C 0.515625 -2.757813 0.546875 -2.84375 0.609375 -2.90625 C 0.679688 -2.96875 0.800781 -3 0.96875 -3 Z M 1.890625 -3 "
+           id="path663" />
+      </g>
+      <g
+         id="glyph-6-9">
+        <path
+           d="M 2.640625 0 L 2.640625 -0.15625 C 2.460938 -0.0625 2.269531 0.00390625 2.0625 0.046875 C 1.863281 0.0859375 1.679688 0.109375 1.515625 0.109375 C 1.148438 0.109375 0.851563 0.015625 0.625 -0.171875 C 0.40625 -0.367188 0.296875 -0.582031 0.296875 -0.8125 C 0.296875 -1.09375 0.4375 -1.351563 0.71875 -1.59375 C 1.007813 -1.84375 1.410156 -1.96875 1.921875 -1.96875 C 2.128906 -1.96875 2.367188 -1.945313 2.640625 -1.90625 L 2.640625 -2.0625 C 2.640625 -2.164063 2.59375 -2.25 2.5 -2.3125 C 2.414063 -2.375 2.25 -2.40625 2 -2.40625 C 1.800781 -2.40625 1.546875 -2.363281 1.234375 -2.28125 C 1.109375 -2.257813 1.015625 -2.25 0.953125 -2.25 C 0.859375 -2.25 0.78125 -2.28125 0.71875 -2.34375 C 0.65625 -2.40625 0.625 -2.488281 0.625 -2.59375 C 0.625 -2.644531 0.632813 -2.691406 0.65625 -2.734375 C 0.6875 -2.773438 0.71875 -2.804688 0.75 -2.828125 C 0.789063 -2.859375 0.875 -2.894531 1 -2.9375 C 1.164063 -2.976563 1.332031 -3.007813 1.5 -3.03125 C 1.675781 -3.0625 1.835938 -3.078125 1.984375 -3.078125 C 2.398438 -3.078125 2.722656 -2.984375 2.953125 -2.796875 C 3.191406 -2.617188 3.3125 -2.375 3.3125 -2.0625 L 3.3125 -0.671875 L 3.421875 -0.671875 C 3.585938 -0.671875 3.703125 -0.640625 3.765625 -0.578125 C 3.835938 -0.515625 3.875 -0.4375 3.875 -0.34375 C 3.875 -0.238281 3.835938 -0.15625 3.765625 -0.09375 C 3.703125 -0.03125 3.585938 0 3.421875 0 Z M 2.640625 -1.203125 C 2.367188 -1.253906 2.117188 -1.28125 1.890625 -1.28125 C 1.609375 -1.28125 1.367188 -1.21875 1.171875 -1.09375 C 1.046875 -1 0.984375 -0.910156 0.984375 -0.828125 C 0.984375 -0.765625 1.015625 -0.710938 1.078125 -0.671875 C 1.191406 -0.597656 1.34375 -0.5625 1.53125 -0.5625 C 1.695313 -0.5625 1.878906 -0.59375 2.078125 -0.65625 C 2.285156 -0.71875 2.472656 -0.804688 2.640625 -0.921875 Z M 2.640625 -1.203125 "
+           id="path666" />
+      </g>
+      <g
+         id="glyph-6-10">
+        <path
+           d="M 1.171875 -4.28125 L 1.171875 -2.765625 C 1.335938 -2.867188 1.503906 -2.945313 1.671875 -3 C 1.847656 -3.050781 2.019531 -3.078125 2.1875 -3.078125 C 2.65625 -3.078125 3.050781 -2.914063 3.375 -2.59375 C 3.707031 -2.269531 3.875 -1.878906 3.875 -1.421875 C 3.875 -0.984375 3.71875 -0.617188 3.40625 -0.328125 C 3.09375 -0.0351563 2.679688 0.109375 2.171875 0.109375 C 1.992188 0.109375 1.820313 0.0820313 1.65625 0.03125 C 1.488281 -0.0078125 1.328125 -0.078125 1.171875 -0.171875 L 1.171875 0 L 0.375 0 C 0.21875 0 0.101563 -0.03125 0.03125 -0.09375 C -0.03125 -0.15625 -0.0625 -0.238281 -0.0625 -0.34375 C -0.0625 -0.4375 -0.03125 -0.515625 0.03125 -0.578125 C 0.101563 -0.640625 0.21875 -0.671875 0.375 -0.671875 L 0.5 -0.671875 L 0.5 -3.59375 L 0.375 -3.59375 C 0.21875 -3.59375 0.101563 -3.625 0.03125 -3.6875 C -0.03125 -3.75 -0.0625 -3.832031 -0.0625 -3.9375 C -0.0625 -4.039063 -0.03125 -4.125 0.03125 -4.1875 C 0.101563 -4.25 0.21875 -4.28125 0.375 -4.28125 Z M 3.1875 -1.40625 C 3.1875 -1.6875 3.085938 -1.921875 2.890625 -2.109375 C 2.703125 -2.304688 2.46875 -2.40625 2.1875 -2.40625 C 1.90625 -2.40625 1.664063 -2.304688 1.46875 -2.109375 C 1.269531 -1.921875 1.171875 -1.691406 1.171875 -1.421875 C 1.171875 -1.171875 1.257813 -0.960938 1.4375 -0.796875 C 1.613281 -0.640625 1.863281 -0.5625 2.1875 -0.5625 C 2.5 -0.5625 2.742188 -0.640625 2.921875 -0.796875 C 3.097656 -0.960938 3.1875 -1.164063 3.1875 -1.40625 Z M 3.1875 -1.40625 "
+           id="path669" />
+      </g>
+      <g
+         id="glyph-6-11">
+        <path
+           d="M 2.359375 -4.28125 L 2.359375 -0.671875 L 3.171875 -0.671875 C 3.335938 -0.671875 3.453125 -0.640625 3.515625 -0.578125 C 3.585938 -0.515625 3.625 -0.4375 3.625 -0.34375 C 3.625 -0.238281 3.585938 -0.15625 3.515625 -0.09375 C 3.453125 -0.03125 3.335938 0 3.171875 0 L 0.875 0 C 0.71875 0 0.601563 -0.03125 0.53125 -0.09375 C 0.457031 -0.15625 0.421875 -0.238281 0.421875 -0.34375 C 0.421875 -0.4375 0.457031 -0.515625 0.53125 -0.578125 C 0.601563 -0.640625 0.71875 -0.671875 0.875 -0.671875 L 1.6875 -0.671875 L 1.6875 -3.59375 L 1.140625 -3.59375 C 0.984375 -3.59375 0.867188 -3.625 0.796875 -3.6875 C 0.722656 -3.75 0.6875 -3.832031 0.6875 -3.9375 C 0.6875 -4.039063 0.722656 -4.125 0.796875 -4.1875 C 0.867188 -4.25 0.984375 -4.28125 1.140625 -4.28125 Z M 2.359375 -4.28125 "
+           id="path672" />
+      </g>
+      <g
+         id="glyph-6-12">
+        <path
+           d="M 3.71875 -1.15625 L 0.953125 -1.15625 C 1.023438 -0.976563 1.148438 -0.832031 1.328125 -0.71875 C 1.503906 -0.613281 1.742188 -0.5625 2.046875 -0.5625 C 2.296875 -0.5625 2.628906 -0.617188 3.046875 -0.734375 C 3.222656 -0.773438 3.34375 -0.796875 3.40625 -0.796875 C 3.5 -0.796875 3.570313 -0.765625 3.625 -0.703125 C 3.6875 -0.640625 3.71875 -0.554688 3.71875 -0.453125 C 3.71875 -0.367188 3.6875 -0.296875 3.625 -0.234375 C 3.539063 -0.148438 3.328125 -0.0703125 2.984375 0 C 2.640625 0.0703125 2.3125 0.109375 2 0.109375 C 1.457031 0.109375 1.023438 -0.0390625 0.703125 -0.34375 C 0.378906 -0.65625 0.21875 -1.035156 0.21875 -1.484375 C 0.21875 -1.953125 0.390625 -2.332031 0.734375 -2.625 C 1.085938 -2.925781 1.492188 -3.078125 1.953125 -3.078125 C 2.222656 -3.078125 2.472656 -3.03125 2.703125 -2.9375 C 2.941406 -2.84375 3.113281 -2.738281 3.21875 -2.625 C 3.375 -2.457031 3.503906 -2.253906 3.609375 -2.015625 C 3.679688 -1.847656 3.71875 -1.65625 3.71875 -1.4375 Z M 2.96875 -1.828125 C 2.863281 -2.023438 2.726563 -2.171875 2.5625 -2.265625 C 2.394531 -2.359375 2.195313 -2.40625 1.96875 -2.40625 C 1.738281 -2.40625 1.539063 -2.359375 1.375 -2.265625 C 1.207031 -2.171875 1.070313 -2.023438 0.96875 -1.828125 Z M 2.96875 -1.828125 "
+           id="path675" />
+      </g>
+      <g
+         id="glyph-6-13" />
+      <g
+         id="glyph-6-14">
+        <path
+           d="M 2.75 -2.203125 C 2.644531 -2.265625 2.53125 -2.3125 2.40625 -2.34375 C 2.289063 -2.382813 2.164063 -2.40625 2.03125 -2.40625 C 1.769531 -2.40625 1.5625 -2.363281 1.40625 -2.28125 C 1.34375 -2.238281 1.3125 -2.195313 1.3125 -2.15625 C 1.3125 -2.101563 1.351563 -2.050781 1.4375 -2 C 1.507813 -1.96875 1.671875 -1.9375 1.921875 -1.90625 C 2.367188 -1.84375 2.675781 -1.78125 2.84375 -1.71875 C 3.082031 -1.632813 3.265625 -1.515625 3.390625 -1.359375 C 3.515625 -1.203125 3.578125 -1.03125 3.578125 -0.84375 C 3.578125 -0.601563 3.46875 -0.40625 3.25 -0.25 C 2.945313 -0.0078125 2.550781 0.109375 2.0625 0.109375 C 1.863281 0.109375 1.679688 0.0859375 1.515625 0.046875 C 1.347656 0.015625 1.195313 -0.03125 1.0625 -0.09375 C 1.03125 -0.0625 0.992188 -0.0351563 0.953125 -0.015625 C 0.921875 -0.00390625 0.882813 0 0.84375 0 C 0.738281 0 0.65625 -0.0351563 0.59375 -0.109375 C 0.53125 -0.179688 0.5 -0.296875 0.5 -0.453125 L 0.5 -0.6875 C 0.5 -0.84375 0.53125 -0.957031 0.59375 -1.03125 C 0.65625 -1.101563 0.738281 -1.140625 0.84375 -1.140625 C 0.914063 -1.140625 0.976563 -1.113281 1.03125 -1.0625 C 1.09375 -1.019531 1.140625 -0.941406 1.171875 -0.828125 C 1.273438 -0.742188 1.398438 -0.675781 1.546875 -0.625 C 1.691406 -0.582031 1.859375 -0.5625 2.046875 -0.5625 C 2.359375 -0.5625 2.597656 -0.613281 2.765625 -0.71875 C 2.847656 -0.757813 2.890625 -0.804688 2.890625 -0.859375 C 2.890625 -0.953125 2.832031 -1.023438 2.71875 -1.078125 C 2.59375 -1.140625 2.347656 -1.1875 1.984375 -1.21875 C 1.441406 -1.28125 1.082031 -1.394531 0.90625 -1.5625 C 0.71875 -1.71875 0.625 -1.914063 0.625 -2.15625 C 0.625 -2.394531 0.726563 -2.59375 0.9375 -2.75 C 1.207031 -2.96875 1.570313 -3.078125 2.03125 -3.078125 C 2.175781 -3.078125 2.320313 -3.0625 2.46875 -3.03125 C 2.613281 -3.007813 2.753906 -2.96875 2.890625 -2.90625 C 2.929688 -2.9375 2.96875 -2.957031 3 -2.96875 C 3.039063 -2.988281 3.078125 -3 3.109375 -3 C 3.203125 -3 3.273438 -2.960938 3.328125 -2.890625 C 3.390625 -2.816406 3.421875 -2.703125 3.421875 -2.546875 L 3.421875 -2.375 C 3.421875 -2.226563 3.40625 -2.128906 3.375 -2.078125 C 3.300781 -1.972656 3.207031 -1.921875 3.09375 -1.921875 C 3.007813 -1.921875 2.9375 -1.945313 2.875 -2 C 2.8125 -2.050781 2.769531 -2.117188 2.75 -2.203125 Z M 2.75 -2.203125 "
+           id="path679" />
+      </g>
+      <g
+         id="glyph-6-15">
+        <path
+           d="M 1.859375 -2.3125 L 1.859375 -0.96875 C 1.859375 -0.820313 1.890625 -0.722656 1.953125 -0.671875 C 2.046875 -0.597656 2.207031 -0.5625 2.4375 -0.5625 C 2.78125 -0.5625 3.097656 -0.632813 3.390625 -0.78125 C 3.503906 -0.84375 3.59375 -0.875 3.65625 -0.875 C 3.75 -0.875 3.828125 -0.835938 3.890625 -0.765625 C 3.953125 -0.703125 3.984375 -0.625 3.984375 -0.53125 C 3.984375 -0.445313 3.945313 -0.375 3.875 -0.3125 C 3.769531 -0.207031 3.554688 -0.109375 3.234375 -0.015625 C 2.921875 0.0664063 2.65625 0.109375 2.4375 0.109375 C 2.019531 0.109375 1.707031 0.0195313 1.5 -0.15625 C 1.289063 -0.34375 1.1875 -0.566406 1.1875 -0.828125 L 1.1875 -2.3125 L 0.9375 -2.3125 C 0.78125 -2.3125 0.664063 -2.34375 0.59375 -2.40625 C 0.519531 -2.46875 0.484375 -2.550781 0.484375 -2.65625 C 0.484375 -2.757813 0.519531 -2.84375 0.59375 -2.90625 C 0.664063 -2.96875 0.78125 -3 0.9375 -3 L 1.1875 -3 L 1.1875 -3.609375 C 1.1875 -3.765625 1.21875 -3.875 1.28125 -3.9375 C 1.34375 -4.007813 1.421875 -4.046875 1.515625 -4.046875 C 1.617188 -4.046875 1.703125 -4.007813 1.765625 -3.9375 C 1.828125 -3.875 1.859375 -3.765625 1.859375 -3.609375 L 1.859375 -3 L 3.109375 -3 C 3.273438 -3 3.390625 -2.96875 3.453125 -2.90625 C 3.523438 -2.84375 3.5625 -2.757813 3.5625 -2.65625 C 3.5625 -2.550781 3.523438 -2.46875 3.453125 -2.40625 C 3.390625 -2.34375 3.273438 -2.3125 3.109375 -2.3125 Z M 1.859375 -2.3125 "
+           id="path682" />
+      </g>
+      <g
+         id="glyph-6-16">
+        <path
+           d="M 1.1875 -0.375 L 1.1875 0.734375 L 1.59375 0.734375 C 1.75 0.734375 1.863281 0.765625 1.9375 0.828125 C 2.007813 0.890625 2.046875 0.972656 2.046875 1.078125 C 2.046875 1.171875 2.007813 1.25 1.9375 1.3125 C 1.863281 1.375 1.75 1.40625 1.59375 1.40625 L 0.390625 1.40625 C 0.234375 1.40625 0.117188 1.375 0.046875 1.3125 C -0.0234375 1.25 -0.0625 1.171875 -0.0625 1.078125 C -0.0625 0.972656 -0.0234375 0.890625 0.046875 0.828125 C 0.117188 0.765625 0.234375 0.734375 0.390625 0.734375 L 0.515625 0.734375 L 0.515625 -2.3125 L 0.390625 -2.3125 C 0.234375 -2.3125 0.117188 -2.34375 0.046875 -2.40625 C -0.0234375 -2.46875 -0.0625 -2.550781 -0.0625 -2.65625 C -0.0625 -2.757813 -0.0234375 -2.84375 0.046875 -2.90625 C 0.117188 -2.96875 0.234375 -3 0.390625 -3 L 1.1875 -3 L 1.1875 -2.765625 C 1.34375 -2.867188 1.503906 -2.945313 1.671875 -3 C 1.847656 -3.050781 2.023438 -3.078125 2.203125 -3.078125 C 2.660156 -3.078125 3.050781 -2.921875 3.375 -2.609375 C 3.695313 -2.296875 3.859375 -1.9375 3.859375 -1.53125 C 3.859375 -1.082031 3.671875 -0.71875 3.296875 -0.4375 C 2.972656 -0.1875 2.609375 -0.0625 2.203125 -0.0625 C 2.023438 -0.0625 1.851563 -0.0859375 1.6875 -0.140625 C 1.519531 -0.191406 1.351563 -0.269531 1.1875 -0.375 Z M 3.1875 -1.53125 C 3.1875 -1.625 3.148438 -1.742188 3.078125 -1.890625 C 3.003906 -2.035156 2.890625 -2.15625 2.734375 -2.25 C 2.578125 -2.351563 2.394531 -2.40625 2.1875 -2.40625 C 1.851563 -2.40625 1.585938 -2.28125 1.390625 -2.03125 C 1.253906 -1.851563 1.1875 -1.6875 1.1875 -1.53125 C 1.1875 -1.34375 1.28125 -1.164063 1.46875 -1 C 1.664063 -0.832031 1.90625 -0.75 2.1875 -0.75 C 2.46875 -0.75 2.703125 -0.832031 2.890625 -1 C 3.085938 -1.164063 3.1875 -1.34375 3.1875 -1.53125 Z M 3.1875 -1.53125 "
+           id="path685" />
+      </g>
+      <g
+         id="glyph-6-17">
+        <path
+           d="M 1.859375 -0.90625 L 2.765625 -0.90625 L 1.796875 0.921875 C 1.734375 1.023438 1.660156 1.078125 1.578125 1.078125 C 1.523438 1.078125 1.476563 1.054688 1.4375 1.015625 C 1.394531 0.984375 1.375 0.945313 1.375 0.90625 C 1.375 0.875 1.378906 0.828125 1.390625 0.765625 Z M 1.859375 -0.90625 "
+           id="path688" />
+      </g>
+      <g
+         id="glyph-6-18">
+        <path
+           d="M 2.03125 -1.25 L 1.5625 0 L 0.921875 0 L 0.359375 -2.3125 C 0.234375 -2.320313 0.140625 -2.359375 0.078125 -2.421875 C 0.015625 -2.484375 -0.015625 -2.5625 -0.015625 -2.65625 C -0.015625 -2.757813 0.015625 -2.84375 0.078125 -2.90625 C 0.148438 -2.96875 0.269531 -3 0.4375 -3 L 1.0625 -3 C 1.226563 -3 1.34375 -2.96875 1.40625 -2.90625 C 1.476563 -2.84375 1.515625 -2.757813 1.515625 -2.65625 C 1.515625 -2.550781 1.476563 -2.460938 1.40625 -2.390625 C 1.34375 -2.335938 1.222656 -2.3125 1.046875 -2.3125 L 1.3125 -1.25 L 1.734375 -2.34375 L 2.328125 -2.34375 L 2.75 -1.25 L 3.015625 -2.3125 C 2.847656 -2.3125 2.738281 -2.328125 2.6875 -2.359375 C 2.582031 -2.429688 2.53125 -2.53125 2.53125 -2.65625 C 2.53125 -2.757813 2.5625 -2.84375 2.625 -2.90625 C 2.695313 -2.96875 2.8125 -3 2.96875 -3 L 3.609375 -3 C 3.773438 -3 3.890625 -2.96875 3.953125 -2.90625 C 4.023438 -2.84375 4.0625 -2.757813 4.0625 -2.65625 C 4.0625 -2.5625 4.03125 -2.484375 3.96875 -2.421875 C 3.90625 -2.359375 3.816406 -2.320313 3.703125 -2.3125 L 3.15625 0 L 2.53125 0 Z M 2.03125 -1.25 "
+           id="path691" />
+      </g>
+      <g
+         id="glyph-6-19">
+        <path
+           d="M 1.46875 -1.125 L 1.46875 0 L 0.671875 0 C 0.515625 0 0.398438 -0.03125 0.328125 -0.09375 C 0.265625 -0.15625 0.234375 -0.238281 0.234375 -0.34375 C 0.234375 -0.4375 0.265625 -0.515625 0.328125 -0.578125 C 0.398438 -0.640625 0.515625 -0.671875 0.671875 -0.671875 L 0.796875 -0.671875 L 0.796875 -3.59375 L 0.671875 -3.59375 C 0.515625 -3.59375 0.398438 -3.625 0.328125 -3.6875 C 0.265625 -3.75 0.234375 -3.832031 0.234375 -3.9375 C 0.234375 -4.039063 0.265625 -4.125 0.328125 -4.1875 C 0.398438 -4.25 0.515625 -4.28125 0.671875 -4.28125 L 1.46875 -4.28125 L 1.46875 -2 L 2 -2.421875 C 1.945313 -2.515625 1.921875 -2.59375 1.921875 -2.65625 C 1.921875 -2.757813 1.953125 -2.84375 2.015625 -2.90625 C 2.085938 -2.96875 2.203125 -3 2.359375 -3 L 3.140625 -3 C 3.296875 -3 3.410156 -2.96875 3.484375 -2.90625 C 3.554688 -2.84375 3.59375 -2.757813 3.59375 -2.65625 C 3.59375 -2.550781 3.554688 -2.46875 3.484375 -2.40625 C 3.410156 -2.34375 3.296875 -2.3125 3.140625 -2.3125 L 2.953125 -2.3125 L 2.125 -1.65625 L 3.234375 -0.671875 L 3.421875 -0.671875 C 3.585938 -0.671875 3.703125 -0.640625 3.765625 -0.578125 C 3.835938 -0.515625 3.875 -0.4375 3.875 -0.34375 C 3.875 -0.238281 3.835938 -0.15625 3.765625 -0.09375 C 3.703125 -0.03125 3.585938 0 3.421875 0 L 2.65625 0 C 2.488281 0 2.367188 -0.03125 2.296875 -0.09375 C 2.234375 -0.15625 2.203125 -0.238281 2.203125 -0.34375 C 2.203125 -0.425781 2.238281 -0.507813 2.3125 -0.59375 L 1.59375 -1.21875 Z M 1.46875 -1.125 "
+           id="path694" />
+      </g>
+      <g
+         id="glyph-7-0">
+        <path
+           d="M 1.6875 0 L 1.6875 -8.4375 L 8.4375 -8.4375 L 8.4375 0 Z M 1.90625 -0.21875 L 8.234375 -0.21875 L 8.234375 -8.234375 L 1.90625 -8.234375 Z M 1.90625 -0.21875 "
+           id="path697" />
+      </g>
+      <g
+         id="glyph-7-1">
+        <path
+           d="M 7.171875 -3.546875 L 9.0625 -2.953125 C 8.769531 -1.898438 8.285156 -1.113281 7.609375 -0.59375 C 6.929688 -0.0820313 6.078125 0.171875 5.046875 0.171875 C 3.765625 0.171875 2.707031 -0.265625 1.875 -1.140625 C 1.050781 -2.023438 0.640625 -3.226563 0.640625 -4.75 C 0.640625 -6.351563 1.050781 -7.597656 1.875 -8.484375 C 2.707031 -9.378906 3.800781 -9.828125 5.15625 -9.828125 C 6.34375 -9.828125 7.304688 -9.476563 8.046875 -8.78125 C 8.484375 -8.363281 8.8125 -7.769531 9.03125 -7 L 7.09375 -6.546875 C 6.976563 -7.046875 6.738281 -7.4375 6.375 -7.71875 C 6.019531 -8.007813 5.582031 -8.15625 5.0625 -8.15625 C 4.34375 -8.15625 3.757813 -7.898438 3.3125 -7.390625 C 2.875 -6.878906 2.65625 -6.046875 2.65625 -4.890625 C 2.65625 -3.671875 2.875 -2.800781 3.3125 -2.28125 C 3.75 -1.757813 4.316406 -1.5 5.015625 -1.5 C 5.535156 -1.5 5.984375 -1.660156 6.359375 -1.984375 C 6.734375 -2.316406 7.003906 -2.835938 7.171875 -3.546875 Z M 7.171875 -3.546875 "
+           id="path700" />
+      </g>
+      <g
+         id="glyph-7-2">
+        <path
+           d="M 0.546875 -3.59375 C 0.546875 -4.207031 0.695313 -4.800781 1 -5.375 C 1.300781 -5.957031 1.726563 -6.398438 2.28125 -6.703125 C 2.84375 -7.003906 3.460938 -7.15625 4.140625 -7.15625 C 5.203125 -7.15625 6.070313 -6.8125 6.75 -6.125 C 7.425781 -5.4375 7.765625 -4.566406 7.765625 -3.515625 C 7.765625 -2.460938 7.421875 -1.585938 6.734375 -0.890625 C 6.054688 -0.191406 5.195313 0.15625 4.15625 0.15625 C 3.519531 0.15625 2.910156 0.0078125 2.328125 -0.28125 C 1.742188 -0.570313 1.300781 -0.992188 1 -1.546875 C 0.695313 -2.109375 0.546875 -2.789063 0.546875 -3.59375 Z M 2.4375 -3.5 C 2.4375 -2.800781 2.597656 -2.265625 2.921875 -1.890625 C 3.253906 -1.523438 3.664063 -1.34375 4.15625 -1.34375 C 4.632813 -1.34375 5.035156 -1.523438 5.359375 -1.890625 C 5.691406 -2.265625 5.859375 -2.804688 5.859375 -3.515625 C 5.859375 -4.203125 5.691406 -4.726563 5.359375 -5.09375 C 5.035156 -5.46875 4.632813 -5.65625 4.15625 -5.65625 C 3.664063 -5.65625 3.253906 -5.46875 2.921875 -5.09375 C 2.597656 -4.726563 2.4375 -4.195313 2.4375 -3.5 Z M 2.4375 -3.5 "
+           id="path703" />
+      </g>
+      <g
+         id="glyph-7-3">
+        <path
+           d="M 7.390625 0 L 5.671875 0 L 5.671875 -1.03125 C 5.378906 -0.625 5.039063 -0.320313 4.65625 -0.125 C 4.269531 0.0625 3.878906 0.15625 3.484375 0.15625 C 2.679688 0.15625 1.988281 -0.164063 1.40625 -0.8125 C 0.832031 -1.457031 0.546875 -2.363281 0.546875 -3.53125 C 0.546875 -4.71875 0.828125 -5.617188 1.390625 -6.234375 C 1.953125 -6.847656 2.65625 -7.15625 3.5 -7.15625 C 4.289063 -7.15625 4.96875 -6.832031 5.53125 -6.1875 L 5.53125 -9.65625 L 7.390625 -9.65625 Z M 2.453125 -3.65625 C 2.453125 -2.90625 2.550781 -2.363281 2.75 -2.03125 C 3.050781 -1.550781 3.472656 -1.3125 4.015625 -1.3125 C 4.429688 -1.3125 4.789063 -1.488281 5.09375 -1.84375 C 5.394531 -2.207031 5.546875 -2.75 5.546875 -3.46875 C 5.546875 -4.28125 5.398438 -4.859375 5.109375 -5.203125 C 4.816406 -5.554688 4.445313 -5.734375 4 -5.734375 C 3.550781 -5.734375 3.179688 -5.554688 2.890625 -5.203125 C 2.597656 -4.859375 2.453125 -4.34375 2.453125 -3.65625 Z M 2.453125 -3.65625 "
+           id="path706" />
+      </g>
+      <g
+         id="glyph-7-4">
+        <path
+           d="M 5.015625 -2.234375 L 6.875 -1.921875 C 6.632813 -1.242188 6.257813 -0.726563 5.75 -0.375 C 5.238281 -0.0195313 4.597656 0.15625 3.828125 0.15625 C 2.609375 0.15625 1.707031 -0.238281 1.125 -1.03125 C 0.65625 -1.664063 0.421875 -2.472656 0.421875 -3.453125 C 0.421875 -4.609375 0.722656 -5.515625 1.328125 -6.171875 C 1.941406 -6.828125 2.710938 -7.15625 3.640625 -7.15625 C 4.679688 -7.15625 5.5 -6.8125 6.09375 -6.125 C 6.695313 -5.4375 6.988281 -4.382813 6.96875 -2.96875 L 2.328125 -2.96875 C 2.335938 -2.414063 2.484375 -1.984375 2.765625 -1.671875 C 3.054688 -1.367188 3.414063 -1.21875 3.84375 -1.21875 C 4.132813 -1.21875 4.378906 -1.296875 4.578125 -1.453125 C 4.773438 -1.617188 4.921875 -1.878906 5.015625 -2.234375 Z M 5.125 -4.09375 C 5.113281 -4.632813 4.972656 -5.039063 4.703125 -5.3125 C 4.441406 -5.59375 4.125 -5.734375 3.75 -5.734375 C 3.34375 -5.734375 3.007813 -5.585938 2.75 -5.296875 C 2.488281 -5.003906 2.359375 -4.601563 2.359375 -4.09375 Z M 5.125 -4.09375 "
+           id="path709" />
+      </g>
+      <g
+         id="glyph-7-5">
+        <path
+           d="M 2.75 0 L 0.890625 0 L 0.890625 -7 L 2.609375 -7 L 2.609375 -6 C 2.898438 -6.46875 3.160156 -6.773438 3.390625 -6.921875 C 3.628906 -7.078125 3.898438 -7.15625 4.203125 -7.15625 C 4.628906 -7.15625 5.035156 -7.039063 5.421875 -6.8125 L 4.859375 -5.1875 C 4.546875 -5.394531 4.253906 -5.5 3.984375 -5.5 C 3.722656 -5.5 3.5 -5.425781 3.3125 -5.28125 C 3.132813 -5.132813 2.992188 -4.875 2.890625 -4.5 C 2.796875 -4.132813 2.75 -3.351563 2.75 -2.15625 Z M 2.75 0 "
+           id="path712" />
+      </g>
+      <g
+         id="glyph-7-6" />
+      <g
+         id="glyph-7-7">
+        <path
+           d="M 2.359375 -4.859375 L 0.671875 -5.171875 C 0.859375 -5.847656 1.179688 -6.347656 1.640625 -6.671875 C 2.109375 -6.992188 2.796875 -7.15625 3.703125 -7.15625 C 4.523438 -7.15625 5.140625 -7.054688 5.546875 -6.859375 C 5.953125 -6.671875 6.238281 -6.425781 6.40625 -6.125 C 6.570313 -5.820313 6.65625 -5.269531 6.65625 -4.46875 L 6.625 -2.296875 C 6.625 -1.679688 6.65625 -1.226563 6.71875 -0.9375 C 6.78125 -0.644531 6.890625 -0.332031 7.046875 0 L 5.21875 0 C 5.164063 -0.125 5.109375 -0.304688 5.046875 -0.546875 C 5.015625 -0.660156 4.992188 -0.734375 4.984375 -0.765625 C 4.660156 -0.453125 4.316406 -0.21875 3.953125 -0.0625 C 3.597656 0.0820313 3.21875 0.15625 2.8125 0.15625 C 2.09375 0.15625 1.523438 -0.0351563 1.109375 -0.421875 C 0.691406 -0.816406 0.484375 -1.3125 0.484375 -1.90625 C 0.484375 -2.300781 0.578125 -2.65625 0.765625 -2.96875 C 0.953125 -3.28125 1.210938 -3.515625 1.546875 -3.671875 C 1.890625 -3.835938 2.382813 -3.984375 3.03125 -4.109375 C 3.894531 -4.273438 4.492188 -4.425781 4.828125 -4.5625 L 4.828125 -4.75 C 4.828125 -5.101563 4.738281 -5.351563 4.5625 -5.5 C 4.382813 -5.65625 4.054688 -5.734375 3.578125 -5.734375 C 3.242188 -5.734375 2.984375 -5.671875 2.796875 -5.546875 C 2.617188 -5.421875 2.472656 -5.191406 2.359375 -4.859375 Z M 4.828125 -3.359375 C 4.585938 -3.285156 4.210938 -3.191406 3.703125 -3.078125 C 3.191406 -2.960938 2.859375 -2.851563 2.703125 -2.75 C 2.453125 -2.582031 2.328125 -2.367188 2.328125 -2.109375 C 2.328125 -1.847656 2.421875 -1.617188 2.609375 -1.421875 C 2.804688 -1.234375 3.054688 -1.140625 3.359375 -1.140625 C 3.691406 -1.140625 4.007813 -1.253906 4.3125 -1.484375 C 4.539063 -1.648438 4.691406 -1.851563 4.765625 -2.09375 C 4.804688 -2.25 4.828125 -2.550781 4.828125 -3 Z M 4.828125 -3.359375 "
+           id="path716" />
+      </g>
+      <g
+         id="glyph-7-8">
+        <path
+           d="M 5.578125 0 L 5.578125 -1.046875 C 5.316406 -0.671875 4.976563 -0.375 4.5625 -0.15625 C 4.15625 0.0507813 3.71875 0.15625 3.25 0.15625 C 2.78125 0.15625 2.359375 0.0507813 1.984375 -0.15625 C 1.617188 -0.363281 1.347656 -0.648438 1.171875 -1.015625 C 1.003906 -1.390625 0.921875 -1.910156 0.921875 -2.578125 L 0.921875 -7 L 2.78125 -7 L 2.78125 -3.78125 C 2.78125 -2.800781 2.8125 -2.195313 2.875 -1.96875 C 2.945313 -1.75 3.070313 -1.570313 3.25 -1.4375 C 3.4375 -1.3125 3.664063 -1.25 3.9375 -1.25 C 4.257813 -1.25 4.546875 -1.332031 4.796875 -1.5 C 5.046875 -1.675781 5.210938 -1.894531 5.296875 -2.15625 C 5.390625 -2.414063 5.4375 -3.046875 5.4375 -4.046875 L 5.4375 -7 L 7.296875 -7 L 7.296875 0 Z M 5.578125 0 "
+           id="path719" />
+      </g>
+      <g
+         id="glyph-7-9">
+        <path
+           d="M 4.171875 -7 L 4.171875 -5.53125 L 2.90625 -5.53125 L 2.90625 -2.703125 C 2.90625 -2.128906 2.914063 -1.796875 2.9375 -1.703125 C 2.96875 -1.609375 3.023438 -1.53125 3.109375 -1.46875 C 3.203125 -1.40625 3.304688 -1.375 3.421875 -1.375 C 3.597656 -1.375 3.847656 -1.4375 4.171875 -1.5625 L 4.328125 -0.125 C 3.898438 0.0625 3.414063 0.15625 2.875 0.15625 C 2.53125 0.15625 2.222656 0.101563 1.953125 0 C 1.691406 -0.113281 1.5 -0.257813 1.375 -0.4375 C 1.25 -0.625 1.160156 -0.867188 1.109375 -1.171875 C 1.078125 -1.378906 1.0625 -1.8125 1.0625 -2.46875 L 1.0625 -5.53125 L 0.203125 -5.53125 L 0.203125 -7 L 1.0625 -7 L 1.0625 -8.390625 L 2.90625 -9.46875 L 2.90625 -7 Z M 4.171875 -7 "
+           id="path722" />
+      </g>
+      <g
+         id="glyph-7-10">
+        <path
+           d="M 2.8125 -9.65625 L 2.8125 -6.109375 C 3.414063 -6.804688 4.128906 -7.15625 4.953125 -7.15625 C 5.378906 -7.15625 5.765625 -7.078125 6.109375 -6.921875 C 6.453125 -6.765625 6.707031 -6.5625 6.875 -6.3125 C 7.050781 -6.070313 7.171875 -5.800781 7.234375 -5.5 C 7.304688 -5.195313 7.34375 -4.734375 7.34375 -4.109375 L 7.34375 0 L 5.484375 0 L 5.484375 -3.703125 C 5.484375 -4.429688 5.445313 -4.894531 5.375 -5.09375 C 5.3125 -5.289063 5.1875 -5.445313 5 -5.5625 C 4.820313 -5.675781 4.601563 -5.734375 4.34375 -5.734375 C 4.03125 -5.734375 3.753906 -5.660156 3.515625 -5.515625 C 3.273438 -5.367188 3.097656 -5.144531 2.984375 -4.84375 C 2.867188 -4.539063 2.8125 -4.09375 2.8125 -3.5 L 2.8125 0 L 0.96875 0 L 0.96875 -9.65625 Z M 2.8125 -9.65625 "
+           id="path725" />
+      </g>
+      <g
+         id="glyph-7-11">
+        <path
+           d="M 7.34375 0 L 5.484375 0 L 5.484375 -3.578125 C 5.484375 -4.328125 5.441406 -4.8125 5.359375 -5.03125 C 5.285156 -5.257813 5.160156 -5.429688 4.984375 -5.546875 C 4.804688 -5.671875 4.59375 -5.734375 4.34375 -5.734375 C 4.019531 -5.734375 3.726563 -5.644531 3.46875 -5.46875 C 3.21875 -5.300781 3.046875 -5.070313 2.953125 -4.78125 C 2.859375 -4.488281 2.8125 -3.953125 2.8125 -3.171875 L 2.8125 0 L 0.953125 0 L 0.953125 -7 L 2.671875 -7 L 2.671875 -5.96875 C 3.285156 -6.757813 4.054688 -7.15625 4.984375 -7.15625 C 5.390625 -7.15625 5.757813 -7.082031 6.09375 -6.9375 C 6.4375 -6.789063 6.691406 -6.601563 6.859375 -6.375 C 7.035156 -6.144531 7.160156 -5.882813 7.234375 -5.59375 C 7.304688 -5.300781 7.34375 -4.882813 7.34375 -4.34375 Z M 7.34375 0 "
+           id="path728" />
+      </g>
+      <g
+         id="glyph-7-12">
+        <path
+           d="M 0.96875 -7.953125 L 0.96875 -9.65625 L 2.828125 -9.65625 L 2.828125 -7.953125 Z M 0.96875 0 L 0.96875 -7 L 2.828125 -7 L 2.828125 0 Z M 0.96875 0 "
+           id="path731" />
+      </g>
+      <g
+         id="glyph-7-13">
+        <path
+           d="M 7.078125 -4.9375 L 5.25 -4.59375 C 5.1875 -4.957031 5.046875 -5.234375 4.828125 -5.421875 C 4.609375 -5.609375 4.328125 -5.703125 3.984375 -5.703125 C 3.523438 -5.703125 3.15625 -5.539063 2.875 -5.21875 C 2.601563 -4.90625 2.46875 -4.375 2.46875 -3.625 C 2.46875 -2.789063 2.601563 -2.203125 2.875 -1.859375 C 3.15625 -1.515625 3.535156 -1.34375 4.015625 -1.34375 C 4.359375 -1.34375 4.640625 -1.441406 4.859375 -1.640625 C 5.085938 -1.847656 5.25 -2.195313 5.34375 -2.6875 L 7.171875 -2.375 C 6.972656 -1.539063 6.609375 -0.910156 6.078125 -0.484375 C 5.546875 -0.0546875 4.828125 0.15625 3.921875 0.15625 C 2.898438 0.15625 2.082031 -0.164063 1.46875 -0.8125 C 0.863281 -1.457031 0.5625 -2.351563 0.5625 -3.5 C 0.5625 -4.65625 0.863281 -5.550781 1.46875 -6.1875 C 2.082031 -6.832031 2.910156 -7.15625 3.953125 -7.15625 C 4.804688 -7.15625 5.484375 -6.972656 5.984375 -6.609375 C 6.492188 -6.242188 6.859375 -5.6875 7.078125 -4.9375 Z M 7.078125 -4.9375 "
+           id="path734" />
+      </g>
+      <g
+         id="glyph-7-14">
+        <path
+           d="M 0.484375 -3.140625 L 2.390625 -3.328125 C 2.503906 -2.691406 2.734375 -2.222656 3.078125 -1.921875 C 3.429688 -1.628906 3.90625 -1.484375 4.5 -1.484375 C 5.125 -1.484375 5.59375 -1.613281 5.90625 -1.875 C 6.226563 -2.144531 6.390625 -2.457031 6.390625 -2.8125 C 6.390625 -3.039063 6.320313 -3.234375 6.1875 -3.390625 C 6.050781 -3.546875 5.816406 -3.6875 5.484375 -3.8125 C 5.253906 -3.882813 4.734375 -4.023438 3.921875 -4.234375 C 2.878906 -4.492188 2.148438 -4.8125 1.734375 -5.1875 C 1.140625 -5.71875 0.84375 -6.363281 0.84375 -7.125 C 0.84375 -7.625 0.976563 -8.085938 1.25 -8.515625 C 1.53125 -8.941406 1.929688 -9.265625 2.453125 -9.484375 C 2.984375 -9.710938 3.617188 -9.828125 4.359375 -9.828125 C 5.578125 -9.828125 6.488281 -9.5625 7.09375 -9.03125 C 7.707031 -8.5 8.03125 -7.789063 8.0625 -6.90625 L 6.125 -6.8125 C 6.03125 -7.3125 5.847656 -7.671875 5.578125 -7.890625 C 5.304688 -8.109375 4.894531 -8.21875 4.34375 -8.21875 C 3.78125 -8.21875 3.335938 -8.097656 3.015625 -7.859375 C 2.804688 -7.710938 2.703125 -7.515625 2.703125 -7.265625 C 2.703125 -7.035156 2.800781 -6.835938 3 -6.671875 C 3.238281 -6.472656 3.832031 -6.257813 4.78125 -6.03125 C 5.726563 -5.8125 6.429688 -5.582031 6.890625 -5.34375 C 7.347656 -5.101563 7.703125 -4.773438 7.953125 -4.359375 C 8.210938 -3.941406 8.34375 -3.425781 8.34375 -2.8125 C 8.34375 -2.257813 8.1875 -1.738281 7.875 -1.25 C 7.570313 -0.769531 7.140625 -0.410156 6.578125 -0.171875 C 6.015625 0.0546875 5.3125 0.171875 4.46875 0.171875 C 3.25 0.171875 2.3125 -0.109375 1.65625 -0.671875 C 1 -1.234375 0.609375 -2.054688 0.484375 -3.140625 Z M 0.484375 -3.140625 "
+           id="path737" />
+      </g>
+      <g
+         id="glyph-7-15">
+        <path
+           d="M 0.59375 -4.765625 C 0.59375 -5.753906 0.738281 -6.582031 1.03125 -7.25 C 1.25 -7.738281 1.546875 -8.175781 1.921875 -8.5625 C 2.304688 -8.957031 2.722656 -9.253906 3.171875 -9.453125 C 3.773438 -9.703125 4.472656 -9.828125 5.265625 -9.828125 C 6.679688 -9.828125 7.816406 -9.382813 8.671875 -8.5 C 9.523438 -7.613281 9.953125 -6.382813 9.953125 -4.8125 C 9.953125 -3.257813 9.53125 -2.039063 8.6875 -1.15625 C 7.84375 -0.269531 6.707031 0.171875 5.28125 0.171875 C 3.84375 0.171875 2.703125 -0.265625 1.859375 -1.140625 C 1.015625 -2.023438 0.59375 -3.234375 0.59375 -4.765625 Z M 2.59375 -4.84375 C 2.59375 -3.75 2.84375 -2.914063 3.34375 -2.34375 C 3.851563 -1.78125 4.5 -1.5 5.28125 -1.5 C 6.0625 -1.5 6.695313 -1.78125 7.1875 -2.34375 C 7.6875 -2.90625 7.9375 -3.742188 7.9375 -4.859375 C 7.9375 -5.972656 7.691406 -6.800781 7.203125 -7.34375 C 6.722656 -7.882813 6.082031 -8.15625 5.28125 -8.15625 C 4.476563 -8.15625 3.828125 -7.878906 3.328125 -7.328125 C 2.835938 -6.773438 2.59375 -5.945313 2.59375 -4.84375 Z M 2.59375 -4.84375 "
+           id="path740" />
+      </g>
+      <g
+         id="glyph-7-16">
+        <path
+           d="M 0.921875 0 L 0.921875 -9.65625 L 2.875 -9.65625 L 2.875 0 Z M 0.921875 0 "
+           id="path743" />
+      </g>
+      <g
+         id="glyph-7-17">
+        <path
+           d="M 0.96875 -9.65625 L 4.546875 -9.65625 C 5.347656 -9.65625 5.957031 -9.597656 6.375 -9.484375 C 6.945313 -9.316406 7.429688 -9.019531 7.828125 -8.59375 C 8.234375 -8.164063 8.539063 -7.640625 8.75 -7.015625 C 8.96875 -6.398438 9.078125 -5.640625 9.078125 -4.734375 C 9.078125 -3.941406 8.976563 -3.257813 8.78125 -2.6875 C 8.539063 -1.976563 8.195313 -1.40625 7.75 -0.96875 C 7.40625 -0.644531 6.945313 -0.390625 6.375 -0.203125 C 5.945313 -0.0664063 5.367188 0 4.640625 0 L 0.96875 0 Z M 2.921875 -8.03125 L 2.921875 -1.625 L 4.390625 -1.625 C 4.929688 -1.625 5.320313 -1.65625 5.5625 -1.71875 C 5.875 -1.800781 6.132813 -1.9375 6.34375 -2.125 C 6.5625 -2.3125 6.734375 -2.617188 6.859375 -3.046875 C 6.992188 -3.484375 7.0625 -4.078125 7.0625 -4.828125 C 7.0625 -5.578125 6.992188 -6.148438 6.859375 -6.546875 C 6.734375 -6.941406 6.550781 -7.25 6.3125 -7.46875 C 6.070313 -7.695313 5.769531 -7.851563 5.40625 -7.9375 C 5.132813 -8 4.597656 -8.03125 3.796875 -8.03125 Z M 2.921875 -8.03125 "
+           id="path746" />
+      </g>
+      <g
+         id="glyph-7-18">
+        <path
+           d="M 1 0 L 1 -9.65625 L 7.625 -9.65625 L 7.625 -8.03125 L 2.953125 -8.03125 L 2.953125 -5.734375 L 6.984375 -5.734375 L 6.984375 -4.109375 L 2.953125 -4.109375 L 2.953125 0 Z M 1 0 "
+           id="path749" />
+      </g>
+      <g
+         id="glyph-7-19">
+        <path
+           d="M 0.96875 0 L 0.96875 -9.65625 L 2.828125 -9.65625 L 2.828125 0 Z M 0.96875 0 "
+           id="path752" />
+      </g>
+      <g
+         id="glyph-7-20">
+        <path
+           d="M 2.28125 0 L 0.0625 -7 L 1.859375 -7 L 3.171875 -2.40625 L 4.375 -7 L 6.15625 -7 L 7.328125 -2.40625 L 8.671875 -7 L 10.5 -7 L 8.25 0 L 6.46875 0 L 5.265625 -4.5 L 4.078125 0 Z M 2.28125 0 "
+           id="path755" />
+      </g>
+      <g
+         id="glyph-8-0">
+        <path
+           d="M 1.125 0 L 1.125 -5.625 L 5.625 -5.625 L 5.625 0 Z M 1.265625 -0.140625 L 5.484375 -0.140625 L 5.484375 -5.484375 L 1.265625 -5.484375 Z M 1.265625 -0.140625 "
+           id="path758" />
+      </g>
+      <g
+         id="glyph-8-1">
+        <path
+           d="M 0.65625 0 L 0.65625 -6.4375 L 5.078125 -6.4375 L 5.078125 -5.359375 L 1.96875 -5.359375 L 1.96875 -3.828125 L 4.65625 -3.828125 L 4.65625 -2.734375 L 1.96875 -2.734375 L 1.96875 0 Z M 0.65625 0 "
+           id="path761" />
+      </g>
+      <g
+         id="glyph-8-2">
+        <path
+           d="M 3.34375 -1.484375 L 4.578125 -1.28125 C 4.421875 -0.832031 4.171875 -0.488281 3.828125 -0.25 C 3.484375 -0.0078125 3.054688 0.109375 2.546875 0.109375 C 1.734375 0.109375 1.132813 -0.15625 0.75 -0.6875 C 0.4375 -1.113281 0.28125 -1.648438 0.28125 -2.296875 C 0.28125 -3.066406 0.484375 -3.671875 0.890625 -4.109375 C 1.296875 -4.546875 1.804688 -4.765625 2.421875 -4.765625 C 3.117188 -4.765625 3.664063 -4.535156 4.0625 -4.078125 C 4.46875 -3.617188 4.660156 -2.921875 4.640625 -1.984375 L 1.546875 -1.984375 C 1.554688 -1.609375 1.65625 -1.316406 1.84375 -1.109375 C 2.039063 -0.910156 2.28125 -0.8125 2.5625 -0.8125 C 2.757813 -0.8125 2.921875 -0.863281 3.046875 -0.96875 C 3.179688 -1.082031 3.28125 -1.253906 3.34375 -1.484375 Z M 3.421875 -2.734375 C 3.410156 -3.085938 3.316406 -3.359375 3.140625 -3.546875 C 2.960938 -3.734375 2.75 -3.828125 2.5 -3.828125 C 2.226563 -3.828125 2.003906 -3.726563 1.828125 -3.53125 C 1.648438 -3.332031 1.566406 -3.066406 1.578125 -2.734375 Z M 3.421875 -2.734375 "
+           id="path764" />
+      </g>
+      <g
+         id="glyph-8-3">
+        <path
+           d="M 2.78125 -4.671875 L 2.78125 -3.6875 L 1.9375 -3.6875 L 1.9375 -1.796875 C 1.9375 -1.421875 1.941406 -1.203125 1.953125 -1.140625 C 1.972656 -1.078125 2.007813 -1.023438 2.0625 -0.984375 C 2.125 -0.941406 2.195313 -0.921875 2.28125 -0.921875 C 2.394531 -0.921875 2.5625 -0.957031 2.78125 -1.03125 L 2.890625 -0.078125 C 2.597656 0.046875 2.269531 0.109375 1.90625 0.109375 C 1.6875 0.109375 1.488281 0.0703125 1.3125 0 C 1.132813 -0.0820313 1.003906 -0.179688 0.921875 -0.296875 C 0.835938 -0.410156 0.78125 -0.570313 0.75 -0.78125 C 0.71875 -0.925781 0.703125 -1.210938 0.703125 -1.640625 L 0.703125 -3.6875 L 0.140625 -3.6875 L 0.140625 -4.671875 L 0.703125 -4.671875 L 0.703125 -5.59375 L 1.9375 -6.3125 L 1.9375 -4.671875 Z M 2.78125 -4.671875 "
+           id="path767" />
+      </g>
+      <g
+         id="glyph-8-4">
+        <path
+           d="M 4.71875 -3.28125 L 3.5 -3.0625 C 3.457031 -3.3125 3.363281 -3.492188 3.21875 -3.609375 C 3.070313 -3.734375 2.882813 -3.796875 2.65625 -3.796875 C 2.34375 -3.796875 2.09375 -3.691406 1.90625 -3.484375 C 1.726563 -3.273438 1.640625 -2.921875 1.640625 -2.421875 C 1.640625 -1.867188 1.734375 -1.476563 1.921875 -1.25 C 2.109375 -1.019531 2.359375 -0.90625 2.671875 -0.90625 C 2.910156 -0.90625 3.101563 -0.96875 3.25 -1.09375 C 3.394531 -1.226563 3.5 -1.457031 3.5625 -1.78125 L 4.78125 -1.578125 C 4.65625 -1.023438 4.410156 -0.601563 4.046875 -0.3125 C 3.691406 -0.03125 3.210938 0.109375 2.609375 0.109375 C 1.929688 0.109375 1.390625 -0.101563 0.984375 -0.53125 C 0.578125 -0.96875 0.375 -1.566406 0.375 -2.328125 C 0.375 -3.097656 0.578125 -3.695313 0.984375 -4.125 C 1.390625 -4.550781 1.941406 -4.765625 2.640625 -4.765625 C 3.203125 -4.765625 3.648438 -4.640625 3.984375 -4.390625 C 4.328125 -4.148438 4.570313 -3.78125 4.71875 -3.28125 Z M 4.71875 -3.28125 "
+           id="path770" />
+      </g>
+      <g
+         id="glyph-8-5">
+        <path
+           d="M 1.875 -6.4375 L 1.875 -4.078125 C 2.269531 -4.535156 2.75 -4.765625 3.3125 -4.765625 C 3.59375 -4.765625 3.847656 -4.710938 4.078125 -4.609375 C 4.304688 -4.503906 4.476563 -4.367188 4.59375 -4.203125 C 4.707031 -4.046875 4.785156 -3.863281 4.828125 -3.65625 C 4.867188 -3.457031 4.890625 -3.148438 4.890625 -2.734375 L 4.890625 0 L 3.65625 0 L 3.65625 -2.46875 C 3.65625 -2.957031 3.628906 -3.265625 3.578125 -3.390625 C 3.535156 -3.523438 3.453125 -3.628906 3.328125 -3.703125 C 3.210938 -3.785156 3.066406 -3.828125 2.890625 -3.828125 C 2.679688 -3.828125 2.492188 -3.773438 2.328125 -3.671875 C 2.171875 -3.578125 2.054688 -3.425781 1.984375 -3.21875 C 1.910156 -3.019531 1.875 -2.726563 1.875 -2.34375 L 1.875 0 L 0.640625 0 L 0.640625 -6.4375 Z M 1.875 -6.4375 "
+           id="path773" />
+      </g>
+      <g
+         id="glyph-8-6" />
+      <g
+         id="glyph-8-7">
+        <path
+           d="M 3.71875 0 L 3.71875 -0.703125 C 3.550781 -0.453125 3.328125 -0.253906 3.046875 -0.109375 C 2.765625 0.0351563 2.472656 0.109375 2.171875 0.109375 C 1.859375 0.109375 1.578125 0.0390625 1.328125 -0.09375 C 1.078125 -0.238281 0.894531 -0.4375 0.78125 -0.6875 C 0.675781 -0.9375 0.625 -1.28125 0.625 -1.71875 L 0.625 -4.671875 L 1.859375 -4.671875 L 1.859375 -2.515625 C 1.859375 -1.859375 1.878906 -1.457031 1.921875 -1.3125 C 1.960938 -1.164063 2.039063 -1.046875 2.15625 -0.953125 C 2.28125 -0.867188 2.4375 -0.828125 2.625 -0.828125 C 2.832031 -0.828125 3.019531 -0.882813 3.1875 -1 C 3.363281 -1.125 3.476563 -1.269531 3.53125 -1.4375 C 3.59375 -1.613281 3.625 -2.035156 3.625 -2.703125 L 3.625 -4.671875 L 4.859375 -4.671875 L 4.859375 0 Z M 3.71875 0 "
+           id="path777" />
+      </g>
+      <g
+         id="glyph-8-8">
+        <path
+           d="M 0.21875 -1.328125 L 1.453125 -1.515625 C 1.503906 -1.273438 1.609375 -1.09375 1.765625 -0.96875 C 1.929688 -0.84375 2.160156 -0.78125 2.453125 -0.78125 C 2.765625 -0.78125 3.003906 -0.84375 3.171875 -0.96875 C 3.273438 -1.039063 3.328125 -1.148438 3.328125 -1.296875 C 3.328125 -1.390625 3.300781 -1.46875 3.25 -1.53125 C 3.1875 -1.582031 3.046875 -1.632813 2.828125 -1.6875 C 1.835938 -1.90625 1.207031 -2.109375 0.9375 -2.296875 C 0.5625 -2.546875 0.375 -2.894531 0.375 -3.34375 C 0.375 -3.75 0.535156 -4.085938 0.859375 -4.359375 C 1.179688 -4.628906 1.675781 -4.765625 2.34375 -4.765625 C 2.988281 -4.765625 3.460938 -4.660156 3.765625 -4.453125 C 4.078125 -4.253906 4.289063 -3.945313 4.40625 -3.53125 L 3.25 -3.328125 C 3.195313 -3.503906 3.097656 -3.640625 2.953125 -3.734375 C 2.816406 -3.835938 2.625 -3.890625 2.375 -3.890625 C 2.039063 -3.890625 1.804688 -3.84375 1.671875 -3.75 C 1.578125 -3.6875 1.53125 -3.601563 1.53125 -3.5 C 1.53125 -3.40625 1.570313 -3.332031 1.65625 -3.28125 C 1.757813 -3.195313 2.140625 -3.078125 2.796875 -2.921875 C 3.460938 -2.773438 3.925781 -2.59375 4.1875 -2.375 C 4.445313 -2.15625 4.578125 -1.847656 4.578125 -1.453125 C 4.578125 -1.023438 4.394531 -0.65625 4.03125 -0.34375 C 3.675781 -0.0390625 3.148438 0.109375 2.453125 0.109375 C 1.816406 0.109375 1.3125 -0.0195313 0.9375 -0.28125 C 0.5625 -0.539063 0.320313 -0.890625 0.21875 -1.328125 Z M 0.21875 -1.328125 "
+           id="path780" />
+      </g>
+      <g
+         id="glyph-8-9">
+        <path
+           d="M 1.828125 0 L 0.59375 0 L 0.59375 -4.671875 L 1.734375 -4.671875 L 1.734375 -4 C 1.929688 -4.3125 2.109375 -4.515625 2.265625 -4.609375 C 2.421875 -4.710938 2.597656 -4.765625 2.796875 -4.765625 C 3.078125 -4.765625 3.347656 -4.691406 3.609375 -4.546875 L 3.234375 -3.46875 C 3.023438 -3.601563 2.832031 -3.671875 2.65625 -3.671875 C 2.476563 -3.671875 2.328125 -3.617188 2.203125 -3.515625 C 2.085938 -3.421875 1.992188 -3.25 1.921875 -3 C 1.859375 -2.75 1.828125 -2.226563 1.828125 -1.4375 Z M 1.828125 0 "
+           id="path783" />
+      </g>
+      <g
+         id="glyph-8-10">
+        <path
+           d="M 0.640625 -5.296875 L 0.640625 -6.4375 L 1.875 -6.4375 L 1.875 -5.296875 Z M 0.640625 0 L 0.640625 -4.671875 L 1.875 -4.671875 L 1.875 0 Z M 0.640625 0 "
+           id="path786" />
+      </g>
+      <g
+         id="glyph-8-11">
+        <path
+           d="M 4.890625 0 L 3.65625 0 L 3.65625 -2.375 C 3.65625 -2.882813 3.628906 -3.210938 3.578125 -3.359375 C 3.523438 -3.503906 3.4375 -3.617188 3.3125 -3.703125 C 3.195313 -3.785156 3.054688 -3.828125 2.890625 -3.828125 C 2.679688 -3.828125 2.488281 -3.765625 2.3125 -3.640625 C 2.144531 -3.523438 2.03125 -3.367188 1.96875 -3.171875 C 1.90625 -2.984375 1.875 -2.628906 1.875 -2.109375 L 1.875 0 L 0.640625 0 L 0.640625 -4.671875 L 1.78125 -4.671875 L 1.78125 -3.984375 C 2.1875 -4.503906 2.703125 -4.765625 3.328125 -4.765625 C 3.597656 -4.765625 3.84375 -4.71875 4.0625 -4.625 C 4.289063 -4.53125 4.460938 -4.40625 4.578125 -4.25 C 4.691406 -4.09375 4.769531 -3.914063 4.8125 -3.71875 C 4.863281 -3.53125 4.890625 -3.257813 4.890625 -2.90625 Z M 4.890625 0 "
+           id="path789" />
+      </g>
+      <g
+         id="glyph-8-12">
+        <path
+           d="M 0.109375 -4.671875 L 0.796875 -4.671875 L 0.796875 -5.015625 C 0.796875 -5.410156 0.835938 -5.703125 0.921875 -5.890625 C 1.003906 -6.085938 1.15625 -6.242188 1.375 -6.359375 C 1.601563 -6.484375 1.890625 -6.546875 2.234375 -6.546875 C 2.578125 -6.546875 2.921875 -6.492188 3.265625 -6.390625 L 3.09375 -5.53125 C 2.894531 -5.582031 2.707031 -5.609375 2.53125 -5.609375 C 2.351563 -5.609375 2.222656 -5.566406 2.140625 -5.484375 C 2.066406 -5.398438 2.03125 -5.238281 2.03125 -5 L 2.03125 -4.671875 L 2.953125 -4.671875 L 2.953125 -3.703125 L 2.03125 -3.703125 L 2.03125 0 L 0.796875 0 L 0.796875 -3.703125 L 0.109375 -3.703125 Z M 0.109375 -4.671875 "
+           id="path792" />
+      </g>
+      <g
+         id="glyph-8-13">
+        <path
+           d="M 0.359375 -2.40625 C 0.359375 -2.8125 0.457031 -3.207031 0.65625 -3.59375 C 0.863281 -3.976563 1.148438 -4.269531 1.515625 -4.46875 C 1.890625 -4.664063 2.304688 -4.765625 2.765625 -4.765625 C 3.472656 -4.765625 4.050781 -4.535156 4.5 -4.078125 C 4.945313 -3.617188 5.171875 -3.039063 5.171875 -2.34375 C 5.171875 -1.632813 4.941406 -1.046875 4.484375 -0.578125 C 4.035156 -0.117188 3.460938 0.109375 2.765625 0.109375 C 2.335938 0.109375 1.929688 0.015625 1.546875 -0.171875 C 1.160156 -0.367188 0.863281 -0.65625 0.65625 -1.03125 C 0.457031 -1.40625 0.359375 -1.863281 0.359375 -2.40625 Z M 1.625 -2.328125 C 1.625 -1.867188 1.734375 -1.515625 1.953125 -1.265625 C 2.171875 -1.023438 2.441406 -0.90625 2.765625 -0.90625 C 3.085938 -0.90625 3.359375 -1.023438 3.578125 -1.265625 C 3.796875 -1.515625 3.90625 -1.875 3.90625 -2.34375 C 3.90625 -2.800781 3.796875 -3.148438 3.578125 -3.390625 C 3.359375 -3.640625 3.085938 -3.765625 2.765625 -3.765625 C 2.441406 -3.765625 2.171875 -3.640625 1.953125 -3.390625 C 1.734375 -3.148438 1.625 -2.796875 1.625 -2.328125 Z M 1.625 -2.328125 "
+           id="path795" />
+      </g>
+      <g
+         id="glyph-8-14">
+        <path
+           d="M 3.65625 -2.375 L 3.65625 -3.453125 L 6.453125 -3.453125 L 6.453125 -0.890625 C 6.179688 -0.628906 5.785156 -0.394531 5.265625 -0.1875 C 4.753906 0.0078125 4.234375 0.109375 3.703125 0.109375 C 3.023438 0.109375 2.4375 -0.03125 1.9375 -0.3125 C 1.4375 -0.59375 1.0625 -0.992188 0.8125 -1.515625 C 0.5625 -2.046875 0.4375 -2.625 0.4375 -3.25 C 0.4375 -3.914063 0.578125 -4.507813 0.859375 -5.03125 C 1.140625 -5.550781 1.550781 -5.953125 2.09375 -6.234375 C 2.5 -6.441406 3.007813 -6.546875 3.625 -6.546875 C 4.425781 -6.546875 5.050781 -6.378906 5.5 -6.046875 C 5.945313 -5.710938 6.238281 -5.25 6.375 -4.65625 L 5.078125 -4.421875 C 4.984375 -4.734375 4.8125 -4.976563 4.5625 -5.15625 C 4.3125 -5.34375 4 -5.4375 3.625 -5.4375 C 3.0625 -5.4375 2.609375 -5.253906 2.265625 -4.890625 C 1.929688 -4.535156 1.765625 -4.003906 1.765625 -3.296875 C 1.765625 -2.535156 1.9375 -1.960938 2.28125 -1.578125 C 2.625 -1.191406 3.066406 -1 3.609375 -1 C 3.890625 -1 4.164063 -1.050781 4.4375 -1.15625 C 4.707031 -1.269531 4.941406 -1.398438 5.140625 -1.546875 L 5.140625 -2.375 Z M 3.65625 -2.375 "
+           id="path798" />
+      </g>
+      <g
+         id="glyph-8-15">
+        <path
+           d="M 0.609375 -4.671875 L 1.765625 -4.671875 L 1.765625 -3.984375 C 1.910156 -4.210938 2.109375 -4.398438 2.359375 -4.546875 C 2.617188 -4.691406 2.90625 -4.765625 3.21875 -4.765625 C 3.757813 -4.765625 4.21875 -4.550781 4.59375 -4.125 C 4.96875 -3.707031 5.15625 -3.117188 5.15625 -2.359375 C 5.15625 -1.578125 4.960938 -0.96875 4.578125 -0.53125 C 4.203125 -0.101563 3.742188 0.109375 3.203125 0.109375 C 2.953125 0.109375 2.71875 0.0546875 2.5 -0.046875 C 2.289063 -0.148438 2.070313 -0.328125 1.84375 -0.578125 L 1.84375 1.78125 L 0.609375 1.78125 Z M 1.828125 -2.40625 C 1.828125 -1.882813 1.929688 -1.5 2.140625 -1.25 C 2.347656 -1 2.601563 -0.875 2.90625 -0.875 C 3.1875 -0.875 3.421875 -0.988281 3.609375 -1.21875 C 3.804688 -1.445313 3.90625 -1.820313 3.90625 -2.34375 C 3.90625 -2.832031 3.804688 -3.195313 3.609375 -3.4375 C 3.410156 -3.675781 3.171875 -3.796875 2.890625 -3.796875 C 2.585938 -3.796875 2.332031 -3.675781 2.125 -3.4375 C 1.925781 -3.207031 1.828125 -2.863281 1.828125 -2.40625 Z M 1.828125 -2.40625 "
+           id="path801" />
+      </g>
+      <g
+         id="glyph-8-16">
+        <path
+           d="M 0.328125 -2.09375 L 1.59375 -2.21875 C 1.664063 -1.789063 1.816406 -1.476563 2.046875 -1.28125 C 2.285156 -1.082031 2.601563 -0.984375 3 -0.984375 C 3.414063 -0.984375 3.726563 -1.070313 3.9375 -1.25 C 4.15625 -1.425781 4.265625 -1.632813 4.265625 -1.875 C 4.265625 -2.019531 4.21875 -2.144531 4.125 -2.25 C 4.039063 -2.363281 3.882813 -2.460938 3.65625 -2.546875 C 3.507813 -2.597656 3.164063 -2.691406 2.625 -2.828125 C 1.925781 -2.992188 1.4375 -3.203125 1.15625 -3.453125 C 0.757813 -3.804688 0.5625 -4.238281 0.5625 -4.75 C 0.5625 -5.082031 0.648438 -5.390625 0.828125 -5.671875 C 1.015625 -5.960938 1.285156 -6.179688 1.640625 -6.328125 C 1.992188 -6.472656 2.414063 -6.546875 2.90625 -6.546875 C 3.71875 -6.546875 4.328125 -6.367188 4.734375 -6.015625 C 5.140625 -5.660156 5.351563 -5.1875 5.375 -4.59375 L 4.078125 -4.546875 C 4.023438 -4.878906 3.90625 -5.113281 3.71875 -5.25 C 3.539063 -5.394531 3.265625 -5.46875 2.890625 -5.46875 C 2.515625 -5.46875 2.222656 -5.394531 2.015625 -5.25 C 1.867188 -5.144531 1.796875 -5.007813 1.796875 -4.84375 C 1.796875 -4.6875 1.863281 -4.554688 2 -4.453125 C 2.15625 -4.316406 2.550781 -4.171875 3.1875 -4.015625 C 3.820313 -3.867188 4.289063 -3.710938 4.59375 -3.546875 C 4.894531 -3.390625 5.128906 -3.171875 5.296875 -2.890625 C 5.472656 -2.617188 5.5625 -2.28125 5.5625 -1.875 C 5.5625 -1.507813 5.457031 -1.164063 5.25 -0.84375 C 5.050781 -0.519531 4.765625 -0.28125 4.390625 -0.125 C 4.015625 0.03125 3.546875 0.109375 2.984375 0.109375 C 2.171875 0.109375 1.546875 -0.078125 1.109375 -0.453125 C 0.671875 -0.828125 0.410156 -1.375 0.328125 -2.09375 Z M 0.328125 -2.09375 "
+           id="path804" />
+      </g>
+      <g
+         id="glyph-8-17">
+        <path
+           d="M 0.0625 -4.671875 L 1.375 -4.671875 L 2.484375 -1.359375 L 3.578125 -4.671875 L 4.859375 -4.671875 L 3.21875 -0.171875 L 2.921875 0.640625 C 2.804688 0.910156 2.703125 1.117188 2.609375 1.265625 C 2.515625 1.410156 2.398438 1.523438 2.265625 1.609375 C 2.140625 1.703125 1.984375 1.769531 1.796875 1.8125 C 1.609375 1.863281 1.398438 1.890625 1.171875 1.890625 C 0.929688 1.890625 0.695313 1.863281 0.46875 1.8125 L 0.359375 0.859375 C 0.554688 0.890625 0.734375 0.90625 0.890625 0.90625 C 1.171875 0.90625 1.378906 0.820313 1.515625 0.65625 C 1.660156 0.488281 1.769531 0.273438 1.84375 0.015625 Z M 0.0625 -4.671875 "
+           id="path807" />
+      </g>
+      <g
+         id="glyph-8-18">
+        <path
+           d="M 1.5625 -3.25 L 0.453125 -3.453125 C 0.578125 -3.898438 0.789063 -4.226563 1.09375 -4.4375 C 1.40625 -4.65625 1.863281 -4.765625 2.46875 -4.765625 C 3.019531 -4.765625 3.429688 -4.695313 3.703125 -4.5625 C 3.972656 -4.4375 4.160156 -4.273438 4.265625 -4.078125 C 4.378906 -3.878906 4.4375 -3.507813 4.4375 -2.96875 L 4.421875 -1.53125 C 4.421875 -1.125 4.441406 -0.820313 4.484375 -0.625 C 4.523438 -0.425781 4.597656 -0.21875 4.703125 0 L 3.484375 0 C 3.453125 -0.0820313 3.410156 -0.203125 3.359375 -0.359375 C 3.335938 -0.429688 3.320313 -0.484375 3.3125 -0.515625 C 3.101563 -0.304688 2.878906 -0.148438 2.640625 -0.046875 C 2.398438 0.0546875 2.144531 0.109375 1.875 0.109375 C 1.394531 0.109375 1.015625 -0.0195313 0.734375 -0.28125 C 0.460938 -0.539063 0.328125 -0.875 0.328125 -1.28125 C 0.328125 -1.539063 0.390625 -1.773438 0.515625 -1.984375 C 0.640625 -2.191406 0.8125 -2.347656 1.03125 -2.453125 C 1.257813 -2.566406 1.585938 -2.664063 2.015625 -2.75 C 2.597656 -2.851563 3 -2.953125 3.21875 -3.046875 L 3.21875 -3.171875 C 3.21875 -3.410156 3.160156 -3.578125 3.046875 -3.671875 C 2.929688 -3.773438 2.707031 -3.828125 2.375 -3.828125 C 2.15625 -3.828125 1.984375 -3.78125 1.859375 -3.6875 C 1.742188 -3.601563 1.644531 -3.457031 1.5625 -3.25 Z M 3.21875 -2.234375 C 3.0625 -2.179688 2.8125 -2.117188 2.46875 -2.046875 C 2.125 -1.972656 1.898438 -1.90625 1.796875 -1.84375 C 1.640625 -1.726563 1.5625 -1.582031 1.5625 -1.40625 C 1.5625 -1.226563 1.625 -1.078125 1.75 -0.953125 C 1.875 -0.828125 2.035156 -0.765625 2.234375 -0.765625 C 2.460938 -0.765625 2.675781 -0.835938 2.875 -0.984375 C 3.03125 -1.097656 3.128906 -1.234375 3.171875 -1.390625 C 3.203125 -1.492188 3.21875 -1.695313 3.21875 -2 Z M 3.21875 -2.234375 "
+           id="path810" />
+      </g>
+      <g
+         id="glyph-8-19">
+        <path
+           d="M 0.59375 0 L 0.59375 -6.4375 L 1.828125 -6.4375 L 1.828125 -4.125 C 2.210938 -4.550781 2.664063 -4.765625 3.1875 -4.765625 C 3.75 -4.765625 4.21875 -4.554688 4.59375 -4.140625 C 4.96875 -3.734375 5.15625 -3.144531 5.15625 -2.375 C 5.15625 -1.582031 4.960938 -0.96875 4.578125 -0.53125 C 4.203125 -0.101563 3.742188 0.109375 3.203125 0.109375 C 2.929688 0.109375 2.664063 0.0390625 2.40625 -0.09375 C 2.144531 -0.226563 1.921875 -0.425781 1.734375 -0.6875 L 1.734375 0 Z M 1.8125 -2.4375 C 1.8125 -1.945313 1.890625 -1.585938 2.046875 -1.359375 C 2.265625 -1.035156 2.550781 -0.875 2.90625 -0.875 C 3.175781 -0.875 3.40625 -0.988281 3.59375 -1.21875 C 3.789063 -1.445313 3.890625 -1.816406 3.890625 -2.328125 C 3.890625 -2.859375 3.789063 -3.238281 3.59375 -3.46875 C 3.40625 -3.707031 3.160156 -3.828125 2.859375 -3.828125 C 2.554688 -3.828125 2.304688 -3.710938 2.109375 -3.484375 C 1.910156 -3.253906 1.8125 -2.90625 1.8125 -2.4375 Z M 1.8125 -2.4375 "
+           id="path813" />
+      </g>
+      <g
+         id="glyph-8-20">
+        <path
+           d="M 4.921875 0 L 3.78125 0 L 3.78125 -0.6875 C 3.59375 -0.414063 3.367188 -0.210938 3.109375 -0.078125 C 2.847656 0.046875 2.585938 0.109375 2.328125 0.109375 C 1.785156 0.109375 1.320313 -0.101563 0.9375 -0.53125 C 0.5625 -0.96875 0.375 -1.570313 0.375 -2.34375 C 0.375 -3.132813 0.554688 -3.734375 0.921875 -4.140625 C 1.296875 -4.554688 1.769531 -4.765625 2.34375 -4.765625 C 2.863281 -4.765625 3.3125 -4.550781 3.6875 -4.125 L 3.6875 -6.4375 L 4.921875 -6.4375 Z M 1.625 -2.4375 C 1.625 -1.9375 1.695313 -1.578125 1.84375 -1.359375 C 2.039063 -1.035156 2.316406 -0.875 2.671875 -0.875 C 2.953125 -0.875 3.191406 -0.992188 3.390625 -1.234375 C 3.597656 -1.472656 3.703125 -1.832031 3.703125 -2.3125 C 3.703125 -2.851563 3.601563 -3.238281 3.40625 -3.46875 C 3.207031 -3.707031 2.957031 -3.828125 2.65625 -3.828125 C 2.363281 -3.828125 2.117188 -3.707031 1.921875 -3.46875 C 1.722656 -3.238281 1.625 -2.894531 1.625 -2.4375 Z M 1.625 -2.4375 "
+           id="path816" />
+      </g>
+      <g
+         id="glyph-8-21">
+        <path
+           d="M 0.53125 0.3125 L 1.9375 0.484375 C 1.96875 0.640625 2.023438 0.75 2.109375 0.8125 C 2.222656 0.90625 2.40625 0.953125 2.65625 0.953125 C 2.976563 0.953125 3.222656 0.898438 3.390625 0.796875 C 3.492188 0.734375 3.570313 0.632813 3.625 0.5 C 3.664063 0.394531 3.6875 0.203125 3.6875 -0.078125 L 3.6875 -0.75 C 3.320313 -0.25 2.859375 0 2.296875 0 C 1.660156 0 1.160156 -0.265625 0.796875 -0.796875 C 0.515625 -1.210938 0.375 -1.734375 0.375 -2.359375 C 0.375 -3.140625 0.5625 -3.734375 0.9375 -4.140625 C 1.3125 -4.554688 1.78125 -4.765625 2.34375 -4.765625 C 2.914063 -4.765625 3.390625 -4.515625 3.765625 -4.015625 L 3.765625 -4.671875 L 4.921875 -4.671875 L 4.921875 -0.484375 C 4.921875 0.0664063 4.875 0.476563 4.78125 0.75 C 4.695313 1.03125 4.570313 1.242188 4.40625 1.390625 C 4.238281 1.546875 4.015625 1.664063 3.734375 1.75 C 3.460938 1.84375 3.117188 1.890625 2.703125 1.890625 C 1.910156 1.890625 1.347656 1.753906 1.015625 1.484375 C 0.691406 1.210938 0.53125 0.867188 0.53125 0.453125 C 0.53125 0.410156 0.53125 0.363281 0.53125 0.3125 Z M 1.640625 -2.4375 C 1.640625 -1.9375 1.734375 -1.570313 1.921875 -1.34375 C 2.109375 -1.113281 2.34375 -1 2.625 -1 C 2.925781 -1 3.179688 -1.113281 3.390625 -1.34375 C 3.597656 -1.582031 3.703125 -1.9375 3.703125 -2.40625 C 3.703125 -2.882813 3.601563 -3.238281 3.40625 -3.46875 C 3.207031 -3.707031 2.957031 -3.828125 2.65625 -3.828125 C 2.351563 -3.828125 2.109375 -3.710938 1.921875 -3.484375 C 1.734375 -3.253906 1.640625 -2.90625 1.640625 -2.4375 Z M 1.640625 -2.4375 "
+           id="path819" />
+      </g>
+      <g
+         id="glyph-8-22">
+        <path
+           d="M 4.78125 -2.375 L 6.03125 -1.96875 C 5.84375 -1.269531 5.523438 -0.75 5.078125 -0.40625 C 4.628906 -0.0625 4.054688 0.109375 3.359375 0.109375 C 2.503906 0.109375 1.800781 -0.179688 1.25 -0.765625 C 0.695313 -1.347656 0.421875 -2.148438 0.421875 -3.171875 C 0.421875 -4.234375 0.695313 -5.0625 1.25 -5.65625 C 1.8125 -6.25 2.539063 -6.546875 3.4375 -6.546875 C 4.226563 -6.546875 4.867188 -6.316406 5.359375 -5.859375 C 5.648438 -5.578125 5.867188 -5.179688 6.015625 -4.671875 L 4.734375 -4.359375 C 4.660156 -4.691406 4.5 -4.953125 4.25 -5.140625 C 4.007813 -5.335938 3.71875 -5.4375 3.375 -5.4375 C 2.894531 -5.4375 2.503906 -5.265625 2.203125 -4.921875 C 1.910156 -4.578125 1.765625 -4.023438 1.765625 -3.265625 C 1.765625 -2.453125 1.910156 -1.867188 2.203125 -1.515625 C 2.492188 -1.171875 2.875 -1 3.34375 -1 C 3.695313 -1 3.992188 -1.109375 4.234375 -1.328125 C 4.484375 -1.546875 4.664063 -1.894531 4.78125 -2.375 Z M 4.78125 -2.375 "
+           id="path822" />
+      </g>
+      <g
+         id="glyph-8-23">
+        <path
+           d="M 0.609375 0 L 0.609375 -6.4375 L 1.84375 -6.4375 L 1.84375 -3.03125 L 3.28125 -4.671875 L 4.796875 -4.671875 L 3.203125 -2.96875 L 4.921875 0 L 3.59375 0 L 2.40625 -2.09375 L 1.84375 -1.5 L 1.84375 0 Z M 0.609375 0 "
+           id="path825" />
+      </g>
+      <g
+         id="glyph-8-24">
+        <path
+           d="M 1.515625 0 L 0.046875 -4.671875 L 1.234375 -4.671875 L 2.109375 -1.609375 L 2.921875 -4.671875 L 4.109375 -4.671875 L 4.890625 -1.609375 L 5.78125 -4.671875 L 7 -4.671875 L 5.5 0 L 4.3125 0 L 3.5 -3 L 2.71875 0 Z M 1.515625 0 "
+           id="path828" />
+      </g>
+      <g
+         id="glyph-8-25">
+        <path
+           d="M 0.65625 0 L 0.65625 -6.4375 L 3.390625 -6.4375 C 4.085938 -6.4375 4.585938 -6.378906 4.890625 -6.265625 C 5.203125 -6.148438 5.453125 -5.941406 5.640625 -5.640625 C 5.828125 -5.347656 5.921875 -5.015625 5.921875 -4.640625 C 5.921875 -4.148438 5.78125 -3.75 5.5 -3.4375 C 5.21875 -3.125 4.796875 -2.925781 4.234375 -2.84375 C 4.515625 -2.675781 4.742188 -2.492188 4.921875 -2.296875 C 5.109375 -2.109375 5.359375 -1.757813 5.671875 -1.25 L 6.453125 0 L 4.890625 0 L 3.953125 -1.40625 C 3.617188 -1.90625 3.390625 -2.21875 3.265625 -2.34375 C 3.140625 -2.476563 3.007813 -2.566406 2.875 -2.609375 C 2.738281 -2.660156 2.519531 -2.6875 2.21875 -2.6875 L 1.953125 -2.6875 L 1.953125 0 Z M 1.953125 -3.71875 L 2.921875 -3.71875 C 3.546875 -3.71875 3.9375 -3.742188 4.09375 -3.796875 C 4.25 -3.847656 4.367188 -3.9375 4.453125 -4.0625 C 4.546875 -4.195313 4.59375 -4.359375 4.59375 -4.546875 C 4.59375 -4.765625 4.53125 -4.941406 4.40625 -5.078125 C 4.289063 -5.210938 4.128906 -5.296875 3.921875 -5.328125 C 3.816406 -5.347656 3.5 -5.359375 2.96875 -5.359375 L 1.953125 -5.359375 Z M 1.953125 -3.71875 "
+           id="path831" />
+      </g>
+      <g
+         id="glyph-8-26">
+        <path
+           d="M 0.640625 0 L 0.640625 -6.4375 L 1.875 -6.4375 L 1.875 0 Z M 0.640625 0 "
+           id="path834" />
+      </g>
+      <g
+         id="glyph-9-0">
+        <path
+           d="M 0.453125 0 L 0.453125 -5.625 L 4.953125 -5.625 L 4.953125 0 Z M 0.59375 -0.140625 L 4.8125 -0.140625 L 4.8125 -5.484375 L 0.59375 -5.484375 Z M 0.59375 -0.140625 "
+           id="path837" />
+      </g>
+      <g
+         id="glyph-9-1">
+        <path
+           d="M 4.328125 -4.640625 L 4.328125 -4.890625 C 4.328125 -4.984375 4.34375 -5.046875 4.375 -5.078125 C 4.40625 -5.117188 4.453125 -5.140625 4.515625 -5.140625 C 4.566406 -5.140625 4.609375 -5.117188 4.640625 -5.078125 C 4.671875 -5.046875 4.6875 -4.984375 4.6875 -4.890625 L 4.6875 -3.875 C 4.6875 -3.78125 4.671875 -3.710938 4.640625 -3.671875 C 4.609375 -3.640625 4.566406 -3.625 4.515625 -3.625 C 4.460938 -3.625 4.414063 -3.640625 4.375 -3.671875 C 4.34375 -3.710938 4.328125 -3.769531 4.328125 -3.84375 C 4.304688 -4.09375 4.171875 -4.3125 3.921875 -4.5 C 3.585938 -4.757813 3.203125 -4.890625 2.765625 -4.890625 C 2.484375 -4.890625 2.210938 -4.828125 1.953125 -4.703125 C 1.765625 -4.609375 1.617188 -4.5 1.515625 -4.375 C 1.316406 -4.144531 1.160156 -3.890625 1.046875 -3.609375 C 0.960938 -3.398438 0.921875 -3.164063 0.921875 -2.90625 L 0.921875 -2.265625 C 0.921875 -1.710938 1.117188 -1.234375 1.515625 -0.828125 C 1.921875 -0.421875 2.382813 -0.21875 2.90625 -0.21875 C 3.226563 -0.21875 3.515625 -0.285156 3.765625 -0.421875 C 4.015625 -0.566406 4.253906 -0.78125 4.484375 -1.0625 C 4.535156 -1.113281 4.59375 -1.140625 4.65625 -1.140625 C 4.707031 -1.140625 4.75 -1.125 4.78125 -1.09375 C 4.8125 -1.0625 4.828125 -1.019531 4.828125 -0.96875 C 4.828125 -0.90625 4.765625 -0.804688 4.640625 -0.671875 C 4.398438 -0.398438 4.128906 -0.195313 3.828125 -0.0625 C 3.535156 0.0703125 3.234375 0.140625 2.921875 0.140625 C 2.648438 0.140625 2.378906 0.0859375 2.109375 -0.015625 C 1.898438 -0.0859375 1.722656 -0.175781 1.578125 -0.28125 C 1.441406 -0.382813 1.273438 -0.5625 1.078125 -0.8125 C 0.878906 -1.070313 0.742188 -1.304688 0.671875 -1.515625 C 0.597656 -1.722656 0.5625 -1.957031 0.5625 -2.21875 L 0.5625 -2.96875 C 0.5625 -3.332031 0.65625 -3.703125 0.84375 -4.078125 C 1.039063 -4.460938 1.304688 -4.753906 1.640625 -4.953125 C 1.984375 -5.160156 2.351563 -5.265625 2.75 -5.265625 C 3.363281 -5.265625 3.890625 -5.054688 4.328125 -4.640625 Z M 4.328125 -4.640625 "
+           id="path840" />
+      </g>
+      <g
+         id="glyph-9-2">
+        <path
+           d="M 4.953125 -2.5625 C 4.953125 -2.0625 4.851563 -1.601563 4.65625 -1.1875 C 4.457031 -0.769531 4.179688 -0.441406 3.828125 -0.203125 C 3.484375 0.0234375 3.109375 0.140625 2.703125 0.140625 C 2.109375 0.140625 1.582031 -0.109375 1.125 -0.609375 C 0.675781 -1.117188 0.453125 -1.769531 0.453125 -2.5625 C 0.453125 -3.351563 0.675781 -4 1.125 -4.5 C 1.582031 -5.007813 2.109375 -5.265625 2.703125 -5.265625 C 3.109375 -5.265625 3.484375 -5.144531 3.828125 -4.90625 C 4.179688 -4.675781 4.457031 -4.347656 4.65625 -3.921875 C 4.851563 -3.503906 4.953125 -3.050781 4.953125 -2.5625 Z M 4.578125 -2.5625 C 4.578125 -3.15625 4.398438 -3.691406 4.046875 -4.171875 C 3.703125 -4.648438 3.253906 -4.890625 2.703125 -4.890625 C 2.179688 -4.890625 1.738281 -4.660156 1.375 -4.203125 C 1.007813 -3.753906 0.828125 -3.207031 0.828125 -2.5625 C 0.828125 -1.875 1.019531 -1.3125 1.40625 -0.875 C 1.789063 -0.4375 2.222656 -0.21875 2.703125 -0.21875 C 3.253906 -0.21875 3.703125 -0.457031 4.046875 -0.9375 C 4.398438 -1.414063 4.578125 -1.957031 4.578125 -2.5625 Z M 4.578125 -2.5625 "
+           id="path843" />
+      </g>
+      <g
+         id="glyph-9-3">
+        <path
+           d="M 1.25 -0.375 L 1.25 -4.765625 L 0.9375 -4.765625 C 0.851563 -4.765625 0.789063 -4.78125 0.75 -4.8125 C 0.707031 -4.851563 0.6875 -4.898438 0.6875 -4.953125 C 0.6875 -5.015625 0.707031 -5.0625 0.75 -5.09375 C 0.789063 -5.125 0.851563 -5.140625 0.9375 -5.140625 L 2.921875 -5.140625 C 3.234375 -5.140625 3.515625 -5.070313 3.765625 -4.9375 C 4.023438 -4.8125 4.222656 -4.671875 4.359375 -4.515625 C 4.597656 -4.234375 4.773438 -3.9375 4.890625 -3.625 C 4.972656 -3.394531 5.015625 -3.128906 5.015625 -2.828125 L 5.015625 -2.3125 C 5.015625 -1.9375 4.929688 -1.570313 4.765625 -1.21875 C 4.597656 -0.863281 4.320313 -0.554688 3.9375 -0.296875 C 3.644531 -0.0976563 3.304688 0 2.921875 0 L 0.9375 0 C 0.851563 0 0.789063 -0.015625 0.75 -0.046875 C 0.707031 -0.0859375 0.6875 -0.132813 0.6875 -0.1875 C 0.6875 -0.238281 0.707031 -0.28125 0.75 -0.3125 C 0.789063 -0.351563 0.851563 -0.375 0.9375 -0.375 Z M 1.625 -0.375 L 2.96875 -0.375 C 3.269531 -0.375 3.554688 -0.472656 3.828125 -0.671875 C 4.097656 -0.867188 4.300781 -1.109375 4.4375 -1.390625 C 4.582031 -1.679688 4.65625 -1.960938 4.65625 -2.234375 L 4.65625 -2.90625 C 4.65625 -3.132813 4.617188 -3.335938 4.546875 -3.515625 C 4.429688 -3.773438 4.28125 -4.023438 4.09375 -4.265625 C 3.988281 -4.390625 3.832031 -4.503906 3.625 -4.609375 C 3.414063 -4.710938 3.195313 -4.765625 2.96875 -4.765625 L 1.625 -4.765625 Z M 1.625 -0.375 "
+           id="path846" />
+      </g>
+      <g
+         id="glyph-9-4">
+        <path
+           d="M 1.5 -2.484375 L 1.5 -0.375 L 4.34375 -0.375 L 4.34375 -1.453125 C 4.34375 -1.546875 4.359375 -1.609375 4.390625 -1.640625 C 4.421875 -1.679688 4.460938 -1.703125 4.515625 -1.703125 C 4.578125 -1.703125 4.625 -1.679688 4.65625 -1.640625 C 4.6875 -1.609375 4.703125 -1.546875 4.703125 -1.453125 L 4.703125 0 L 0.640625 0 C 0.546875 0 0.476563 -0.015625 0.4375 -0.046875 C 0.40625 -0.0859375 0.390625 -0.132813 0.390625 -0.1875 C 0.390625 -0.238281 0.40625 -0.28125 0.4375 -0.3125 C 0.476563 -0.351563 0.546875 -0.375 0.640625 -0.375 L 1.125 -0.375 L 1.125 -4.765625 L 0.640625 -4.765625 C 0.546875 -4.765625 0.476563 -4.78125 0.4375 -4.8125 C 0.40625 -4.851563 0.390625 -4.898438 0.390625 -4.953125 C 0.390625 -5.015625 0.40625 -5.0625 0.4375 -5.09375 C 0.476563 -5.125 0.546875 -5.140625 0.640625 -5.140625 L 4.515625 -5.140625 L 4.515625 -3.875 C 4.515625 -3.78125 4.492188 -3.710938 4.453125 -3.671875 C 4.421875 -3.640625 4.378906 -3.625 4.328125 -3.625 C 4.273438 -3.625 4.226563 -3.640625 4.1875 -3.671875 C 4.15625 -3.710938 4.140625 -3.78125 4.140625 -3.875 L 4.140625 -4.765625 L 1.5 -4.765625 L 1.5 -2.859375 L 2.828125 -2.859375 L 2.828125 -3.265625 C 2.828125 -3.359375 2.84375 -3.421875 2.875 -3.453125 C 2.90625 -3.492188 2.953125 -3.515625 3.015625 -3.515625 C 3.066406 -3.515625 3.109375 -3.492188 3.140625 -3.453125 C 3.171875 -3.421875 3.1875 -3.359375 3.1875 -3.265625 L 3.1875 -2.0625 C 3.1875 -1.976563 3.171875 -1.914063 3.140625 -1.875 C 3.109375 -1.832031 3.066406 -1.8125 3.015625 -1.8125 C 2.953125 -1.8125 2.90625 -1.832031 2.875 -1.875 C 2.84375 -1.914063 2.828125 -1.976563 2.828125 -2.0625 L 2.828125 -2.484375 Z M 1.5 -2.484375 "
+           id="path849" />
+      </g>
+      <g
+         id="glyph-9-5">
+        <path
+           d="M 1.5 -2.296875 L 1.5 -0.375 L 2.1875 -0.375 C 2.269531 -0.375 2.332031 -0.351563 2.375 -0.3125 C 2.414063 -0.28125 2.4375 -0.238281 2.4375 -0.1875 C 2.4375 -0.132813 2.414063 -0.0859375 2.375 -0.046875 C 2.332031 -0.015625 2.269531 0 2.1875 0 L 0.640625 0 C 0.546875 0 0.476563 -0.015625 0.4375 -0.046875 C 0.40625 -0.0859375 0.390625 -0.132813 0.390625 -0.1875 C 0.390625 -0.238281 0.40625 -0.28125 0.4375 -0.3125 C 0.476563 -0.351563 0.546875 -0.375 0.640625 -0.375 L 1.125 -0.375 L 1.125 -4.765625 L 0.640625 -4.765625 C 0.546875 -4.765625 0.476563 -4.78125 0.4375 -4.8125 C 0.40625 -4.851563 0.390625 -4.898438 0.390625 -4.953125 C 0.390625 -5.015625 0.40625 -5.0625 0.4375 -5.09375 C 0.476563 -5.125 0.546875 -5.140625 0.640625 -5.140625 L 2.859375 -5.140625 C 3.328125 -5.140625 3.71875 -4.992188 4.03125 -4.703125 C 4.34375 -4.410156 4.5 -4.082031 4.5 -3.71875 C 4.5 -3.457031 4.398438 -3.207031 4.203125 -2.96875 C 4.015625 -2.738281 3.691406 -2.546875 3.234375 -2.390625 C 3.492188 -2.210938 3.71875 -2.007813 3.90625 -1.78125 C 4.09375 -1.550781 4.394531 -1.082031 4.8125 -0.375 L 5.09375 -0.375 C 5.175781 -0.375 5.234375 -0.351563 5.265625 -0.3125 C 5.304688 -0.28125 5.328125 -0.238281 5.328125 -0.1875 C 5.328125 -0.132813 5.304688 -0.0859375 5.265625 -0.046875 C 5.234375 -0.015625 5.175781 0 5.09375 0 L 4.59375 0 C 4.132813 -0.8125 3.78125 -1.359375 3.53125 -1.640625 C 3.28125 -1.921875 2.992188 -2.140625 2.671875 -2.296875 Z M 1.5 -2.65625 L 2.5 -2.65625 C 2.820313 -2.65625 3.113281 -2.710938 3.375 -2.828125 C 3.644531 -2.953125 3.835938 -3.09375 3.953125 -3.25 C 4.066406 -3.40625 4.125 -3.566406 4.125 -3.734375 C 4.125 -3.984375 4 -4.21875 3.75 -4.4375 C 3.507813 -4.65625 3.210938 -4.765625 2.859375 -4.765625 L 1.5 -4.765625 Z M 1.5 -2.65625 "
+           id="path852" />
+      </g>
+      <g
+         id="glyph-9-6">
+        <path
+           d="M 5.15625 2.46875 L 0.25 2.46875 C 0.15625 2.46875 0.0859375 2.445313 0.046875 2.40625 C 0.015625 2.375 0 2.332031 0 2.28125 C 0 2.226563 0.015625 2.179688 0.046875 2.140625 C 0.0859375 2.109375 0.15625 2.09375 0.25 2.09375 L 5.15625 2.09375 C 5.25 2.09375 5.3125 2.109375 5.34375 2.140625 C 5.382813 2.179688 5.40625 2.226563 5.40625 2.28125 C 5.40625 2.332031 5.382813 2.375 5.34375 2.40625 C 5.3125 2.445313 5.25 2.46875 5.15625 2.46875 Z M 5.15625 2.46875 "
+           id="path855" />
+      </g>
+      <g
+         id="glyph-9-7">
+        <path
+           d="M 2.890625 -4.765625 L 2.890625 -0.375 L 4.15625 -0.375 C 4.238281 -0.375 4.300781 -0.351563 4.34375 -0.3125 C 4.382813 -0.28125 4.40625 -0.238281 4.40625 -0.1875 C 4.40625 -0.132813 4.382813 -0.0859375 4.34375 -0.046875 C 4.300781 -0.015625 4.238281 0 4.15625 0 L 1.25 0 C 1.164063 0 1.101563 -0.015625 1.0625 -0.046875 C 1.019531 -0.0859375 1 -0.132813 1 -0.1875 C 1 -0.238281 1.019531 -0.28125 1.0625 -0.3125 C 1.101563 -0.351563 1.164063 -0.375 1.25 -0.375 L 2.515625 -0.375 L 2.515625 -4.765625 L 1.25 -4.765625 C 1.164063 -4.765625 1.101563 -4.78125 1.0625 -4.8125 C 1.019531 -4.851563 1 -4.898438 1 -4.953125 C 1 -5.015625 1.019531 -5.0625 1.0625 -5.09375 C 1.101563 -5.125 1.164063 -5.140625 1.25 -5.140625 L 4.15625 -5.140625 C 4.238281 -5.140625 4.300781 -5.125 4.34375 -5.09375 C 4.382813 -5.0625 4.40625 -5.015625 4.40625 -4.953125 C 4.40625 -4.898438 4.382813 -4.851563 4.34375 -4.8125 C 4.300781 -4.78125 4.238281 -4.765625 4.15625 -4.765625 Z M 2.890625 -4.765625 "
+           id="path858" />
+      </g>
+      <g
+         id="glyph-9-8">
+        <path
+           d="M 4.703125 -1.90625 L 4.703125 -0.328125 C 4.421875 -0.171875 4.140625 -0.0546875 3.859375 0.015625 C 3.585938 0.0976563 3.3125 0.140625 3.03125 0.140625 C 2.632813 0.140625 2.285156 0.0820313 1.984375 -0.03125 C 1.679688 -0.144531 1.425781 -0.304688 1.21875 -0.515625 C 1.007813 -0.734375 0.847656 -0.972656 0.734375 -1.234375 C 0.617188 -1.492188 0.5625 -1.820313 0.5625 -2.21875 L 0.5625 -2.90625 C 0.5625 -3.300781 0.660156 -3.691406 0.859375 -4.078125 C 1.066406 -4.460938 1.34375 -4.753906 1.6875 -4.953125 C 2.03125 -5.160156 2.410156 -5.265625 2.828125 -5.265625 C 3.421875 -5.265625 3.921875 -5.097656 4.328125 -4.765625 C 4.328125 -4.910156 4.332031 -5 4.34375 -5.03125 C 4.351563 -5.0625 4.375 -5.085938 4.40625 -5.109375 C 4.4375 -5.128906 4.472656 -5.140625 4.515625 -5.140625 C 4.566406 -5.140625 4.609375 -5.117188 4.640625 -5.078125 C 4.679688 -5.046875 4.703125 -4.984375 4.703125 -4.890625 L 4.703125 -4.0625 C 4.703125 -3.96875 4.679688 -3.898438 4.640625 -3.859375 C 4.609375 -3.828125 4.566406 -3.8125 4.515625 -3.8125 C 4.472656 -3.8125 4.429688 -3.828125 4.390625 -3.859375 C 4.359375 -3.898438 4.34375 -3.960938 4.34375 -4.046875 C 4.320313 -4.296875 4.15625 -4.5 3.84375 -4.65625 C 3.539063 -4.8125 3.210938 -4.890625 2.859375 -4.890625 C 2.515625 -4.890625 2.207031 -4.816406 1.9375 -4.671875 C 1.664063 -4.523438 1.410156 -4.242188 1.171875 -3.828125 C 1.015625 -3.554688 0.9375 -3.242188 0.9375 -2.890625 L 0.9375 -2.21875 C 0.9375 -1.613281 1.125 -1.128906 1.5 -0.765625 C 1.875 -0.398438 2.390625 -0.21875 3.046875 -0.21875 C 3.265625 -0.21875 3.46875 -0.238281 3.65625 -0.28125 C 3.851563 -0.332031 4.078125 -0.421875 4.328125 -0.546875 L 4.328125 -1.90625 L 3.0625 -1.90625 C 2.976563 -1.90625 2.914063 -1.921875 2.875 -1.953125 C 2.832031 -1.992188 2.8125 -2.039063 2.8125 -2.09375 C 2.8125 -2.144531 2.832031 -2.1875 2.875 -2.21875 C 2.914063 -2.257813 2.976563 -2.28125 3.0625 -2.28125 L 4.84375 -2.28125 C 4.925781 -2.28125 4.984375 -2.257813 5.015625 -2.21875 C 5.054688 -2.1875 5.078125 -2.144531 5.078125 -2.09375 C 5.078125 -2.050781 5.066406 -2.015625 5.046875 -1.984375 C 5.023438 -1.953125 5 -1.929688 4.96875 -1.921875 C 4.9375 -1.910156 4.847656 -1.90625 4.703125 -1.90625 Z M 4.703125 -1.90625 "
+           id="path861" />
+      </g>
+      <g
+         id="glyph-9-9">
+        <path
+           d="M 4.484375 -4.765625 L 4.484375 -1.6875 C 4.484375 -1.164063 4.3125 -0.726563 3.96875 -0.375 C 3.625 -0.03125 3.207031 0.140625 2.71875 0.140625 C 2.382813 0.140625 2.085938 0.0703125 1.828125 -0.0625 C 1.578125 -0.207031 1.363281 -0.425781 1.1875 -0.71875 C 1.007813 -1.007813 0.921875 -1.332031 0.921875 -1.6875 L 0.921875 -4.765625 L 0.609375 -4.765625 C 0.523438 -4.765625 0.460938 -4.78125 0.421875 -4.8125 C 0.378906 -4.851563 0.359375 -4.898438 0.359375 -4.953125 C 0.359375 -5.015625 0.378906 -5.0625 0.421875 -5.09375 C 0.460938 -5.125 0.523438 -5.140625 0.609375 -5.140625 L 1.96875 -5.140625 C 2.0625 -5.140625 2.125 -5.125 2.15625 -5.09375 C 2.195313 -5.0625 2.21875 -5.015625 2.21875 -4.953125 C 2.21875 -4.898438 2.195313 -4.851563 2.15625 -4.8125 C 2.125 -4.78125 2.0625 -4.765625 1.96875 -4.765625 L 1.296875 -4.765625 L 1.296875 -1.6875 C 1.296875 -1.28125 1.429688 -0.929688 1.703125 -0.640625 C 1.984375 -0.359375 2.316406 -0.21875 2.703125 -0.21875 C 2.941406 -0.21875 3.160156 -0.273438 3.359375 -0.390625 C 3.566406 -0.503906 3.742188 -0.675781 3.890625 -0.90625 C 4.046875 -1.132813 4.125 -1.394531 4.125 -1.6875 L 4.125 -4.765625 L 3.4375 -4.765625 C 3.351563 -4.765625 3.289063 -4.78125 3.25 -4.8125 C 3.207031 -4.851563 3.1875 -4.898438 3.1875 -4.953125 C 3.1875 -5.015625 3.207031 -5.0625 3.25 -5.09375 C 3.289063 -5.125 3.351563 -5.140625 3.4375 -5.140625 L 4.796875 -5.140625 C 4.890625 -5.140625 4.953125 -5.125 4.984375 -5.09375 C 5.023438 -5.0625 5.046875 -5.015625 5.046875 -4.953125 C 5.046875 -4.898438 5.023438 -4.851563 4.984375 -4.8125 C 4.953125 -4.78125 4.890625 -4.765625 4.796875 -4.765625 Z M 4.484375 -4.765625 "
+           id="path864" />
+      </g>
+      <g
+         id="glyph-9-10">
+        <path
+           d="M 1.90625 -2.109375 L 1.90625 -0.375 L 3.171875 -0.375 C 3.253906 -0.375 3.3125 -0.351563 3.34375 -0.3125 C 3.382813 -0.28125 3.40625 -0.238281 3.40625 -0.1875 C 3.40625 -0.132813 3.382813 -0.0859375 3.34375 -0.046875 C 3.3125 -0.015625 3.253906 0 3.171875 0 L 1.03125 0 C 0.945313 0 0.882813 -0.015625 0.84375 -0.046875 C 0.800781 -0.0859375 0.78125 -0.132813 0.78125 -0.1875 C 0.78125 -0.238281 0.800781 -0.28125 0.84375 -0.3125 C 0.882813 -0.351563 0.945313 -0.375 1.03125 -0.375 L 1.53125 -0.375 L 1.53125 -4.765625 L 1.03125 -4.765625 C 0.945313 -4.765625 0.882813 -4.78125 0.84375 -4.8125 C 0.800781 -4.851563 0.78125 -4.898438 0.78125 -4.953125 C 0.78125 -5.015625 0.800781 -5.0625 0.84375 -5.09375 C 0.882813 -5.125 0.945313 -5.140625 1.03125 -5.140625 L 3.171875 -5.140625 C 3.679688 -5.140625 4.097656 -4.988281 4.421875 -4.6875 C 4.742188 -4.394531 4.90625 -4.046875 4.90625 -3.640625 C 4.90625 -3.398438 4.851563 -3.1875 4.75 -3 C 4.644531 -2.8125 4.519531 -2.660156 4.375 -2.546875 C 4.144531 -2.390625 3.914063 -2.269531 3.6875 -2.1875 C 3.519531 -2.132813 3.304688 -2.109375 3.046875 -2.109375 Z M 1.90625 -2.484375 L 3.078125 -2.484375 C 3.347656 -2.484375 3.601563 -2.539063 3.84375 -2.65625 C 4.082031 -2.78125 4.253906 -2.929688 4.359375 -3.109375 C 4.472656 -3.285156 4.53125 -3.460938 4.53125 -3.640625 C 4.53125 -3.929688 4.40625 -4.191406 4.15625 -4.421875 C 3.90625 -4.648438 3.59375 -4.765625 3.21875 -4.765625 L 1.90625 -4.765625 Z M 1.90625 -2.484375 "
+           id="path867" />
+      </g>
+      <g
+         id="glyph-9-11">
+        <path
+           d="M 2.921875 -2.625 L 4.671875 -0.375 L 4.8125 -0.375 C 4.90625 -0.375 4.96875 -0.351563 5 -0.3125 C 5.039063 -0.28125 5.0625 -0.238281 5.0625 -0.1875 C 5.0625 -0.132813 5.039063 -0.0859375 5 -0.046875 C 4.96875 -0.015625 4.90625 0 4.8125 0 L 3.625 0 C 3.539063 0 3.476563 -0.015625 3.4375 -0.046875 C 3.40625 -0.0859375 3.390625 -0.132813 3.390625 -0.1875 C 3.390625 -0.238281 3.40625 -0.28125 3.4375 -0.3125 C 3.476563 -0.351563 3.539063 -0.375 3.625 -0.375 L 4.21875 -0.375 L 2.6875 -2.328125 L 1.1875 -0.375 L 1.78125 -0.375 C 1.863281 -0.375 1.921875 -0.351563 1.953125 -0.3125 C 1.992188 -0.28125 2.015625 -0.238281 2.015625 -0.1875 C 2.015625 -0.132813 1.992188 -0.0859375 1.953125 -0.046875 C 1.921875 -0.015625 1.863281 0 1.78125 0 L 0.59375 0 C 0.507813 0 0.445313 -0.015625 0.40625 -0.046875 C 0.375 -0.0859375 0.359375 -0.132813 0.359375 -0.1875 C 0.359375 -0.226563 0.367188 -0.265625 0.390625 -0.296875 C 0.410156 -0.328125 0.4375 -0.347656 0.46875 -0.359375 C 0.5 -0.367188 0.585938 -0.375 0.734375 -0.375 L 2.46875 -2.625 L 0.8125 -4.765625 L 0.671875 -4.765625 C 0.585938 -4.765625 0.523438 -4.78125 0.484375 -4.8125 C 0.453125 -4.851563 0.4375 -4.898438 0.4375 -4.953125 C 0.4375 -5.015625 0.453125 -5.0625 0.484375 -5.09375 C 0.523438 -5.125 0.585938 -5.140625 0.671875 -5.140625 L 1.6875 -5.140625 C 1.769531 -5.140625 1.832031 -5.125 1.875 -5.09375 C 1.914063 -5.0625 1.9375 -5.015625 1.9375 -4.953125 C 1.9375 -4.898438 1.914063 -4.851563 1.875 -4.8125 C 1.832031 -4.78125 1.769531 -4.765625 1.6875 -4.765625 L 1.265625 -4.765625 L 2.6875 -2.9375 L 4.109375 -4.765625 L 3.703125 -4.765625 C 3.609375 -4.765625 3.539063 -4.78125 3.5 -4.8125 C 3.46875 -4.851563 3.453125 -4.898438 3.453125 -4.953125 C 3.453125 -5.015625 3.46875 -5.0625 3.5 -5.09375 C 3.539063 -5.125 3.609375 -5.140625 3.703125 -5.140625 L 4.703125 -5.140625 C 4.796875 -5.140625 4.859375 -5.125 4.890625 -5.09375 C 4.929688 -5.0625 4.953125 -5.015625 4.953125 -4.953125 C 4.953125 -4.898438 4.929688 -4.851563 4.890625 -4.8125 C 4.859375 -4.78125 4.796875 -4.765625 4.703125 -4.765625 L 4.5625 -4.765625 Z M 2.921875 -2.625 "
+           id="path870" />
+      </g>
+      <g
+         id="glyph-9-12">
+        <path
+           d="M 1.8125 -2.484375 L 1.8125 -0.375 L 3.078125 -0.375 C 3.160156 -0.375 3.222656 -0.351563 3.265625 -0.3125 C 3.304688 -0.28125 3.328125 -0.238281 3.328125 -0.1875 C 3.328125 -0.132813 3.304688 -0.0859375 3.265625 -0.046875 C 3.222656 -0.015625 3.160156 0 3.078125 0 L 0.9375 0 C 0.851563 0 0.789063 -0.015625 0.75 -0.046875 C 0.71875 -0.0859375 0.703125 -0.132813 0.703125 -0.1875 C 0.703125 -0.238281 0.71875 -0.28125 0.75 -0.3125 C 0.789063 -0.351563 0.851563 -0.375 0.9375 -0.375 L 1.4375 -0.375 L 1.4375 -4.765625 L 0.9375 -4.765625 C 0.851563 -4.765625 0.789063 -4.78125 0.75 -4.8125 C 0.71875 -4.851563 0.703125 -4.898438 0.703125 -4.953125 C 0.703125 -5.015625 0.722656 -5.0625 0.765625 -5.09375 C 0.796875 -5.125 0.851563 -5.140625 0.9375 -5.140625 L 5.015625 -5.140625 L 5.015625 -3.875 C 5.015625 -3.78125 4.992188 -3.710938 4.953125 -3.671875 C 4.921875 -3.640625 4.878906 -3.625 4.828125 -3.625 C 4.765625 -3.625 4.71875 -3.640625 4.6875 -3.671875 C 4.65625 -3.710938 4.640625 -3.78125 4.640625 -3.875 L 4.640625 -4.765625 L 1.8125 -4.765625 L 1.8125 -2.859375 L 3.140625 -2.859375 L 3.140625 -3.265625 C 3.140625 -3.359375 3.15625 -3.421875 3.1875 -3.453125 C 3.21875 -3.492188 3.265625 -3.515625 3.328125 -3.515625 C 3.378906 -3.515625 3.421875 -3.492188 3.453125 -3.453125 C 3.484375 -3.421875 3.5 -3.359375 3.5 -3.265625 L 3.5 -2.0625 C 3.5 -1.976563 3.484375 -1.914063 3.453125 -1.875 C 3.421875 -1.832031 3.378906 -1.8125 3.328125 -1.8125 C 3.265625 -1.8125 3.21875 -1.832031 3.1875 -1.875 C 3.15625 -1.914063 3.140625 -1.976563 3.140625 -2.0625 L 3.140625 -2.484375 Z M 1.8125 -2.484375 "
+           id="path873" />
+      </g>
+      <g
+         id="glyph-9-13">
+        <path
+           d="M 2.0625 -4.765625 L 2.0625 -0.375 L 4.515625 -0.375 L 4.515625 -1.84375 C 4.515625 -1.925781 4.53125 -1.984375 4.5625 -2.015625 C 4.601563 -2.054688 4.648438 -2.078125 4.703125 -2.078125 C 4.753906 -2.078125 4.796875 -2.054688 4.828125 -2.015625 C 4.867188 -1.984375 4.890625 -1.925781 4.890625 -1.84375 L 4.890625 0 L 0.8125 0 C 0.71875 0 0.648438 -0.015625 0.609375 -0.046875 C 0.578125 -0.0859375 0.5625 -0.132813 0.5625 -0.1875 C 0.5625 -0.238281 0.578125 -0.28125 0.609375 -0.3125 C 0.648438 -0.351563 0.71875 -0.375 0.8125 -0.375 L 1.6875 -0.375 L 1.6875 -4.765625 L 0.8125 -4.765625 C 0.71875 -4.765625 0.648438 -4.78125 0.609375 -4.8125 C 0.578125 -4.851563 0.5625 -4.898438 0.5625 -4.953125 C 0.5625 -5.015625 0.578125 -5.0625 0.609375 -5.09375 C 0.648438 -5.125 0.71875 -5.140625 0.8125 -5.140625 L 2.9375 -5.140625 C 3.03125 -5.140625 3.09375 -5.125 3.125 -5.09375 C 3.164063 -5.0625 3.1875 -5.015625 3.1875 -4.953125 C 3.1875 -4.898438 3.164063 -4.851563 3.125 -4.8125 C 3.09375 -4.78125 3.03125 -4.765625 2.9375 -4.765625 Z M 2.0625 -4.765625 "
+           id="path876" />
+      </g>
+      <g
+         id="glyph-9-14">
+        <path
+           d="M 2.890625 -4.765625 L 2.890625 -0.375 L 3.84375 -0.375 C 3.925781 -0.375 3.988281 -0.351563 4.03125 -0.3125 C 4.070313 -0.28125 4.09375 -0.238281 4.09375 -0.1875 C 4.09375 -0.132813 4.070313 -0.0859375 4.03125 -0.046875 C 3.988281 -0.015625 3.925781 0 3.84375 0 L 1.546875 0 C 1.460938 0 1.398438 -0.015625 1.359375 -0.046875 C 1.328125 -0.0859375 1.3125 -0.132813 1.3125 -0.1875 C 1.3125 -0.238281 1.328125 -0.28125 1.359375 -0.3125 C 1.398438 -0.351563 1.460938 -0.375 1.546875 -0.375 L 2.515625 -0.375 L 2.515625 -4.765625 L 1 -4.765625 L 1 -3.5 C 1 -3.40625 0.976563 -3.335938 0.9375 -3.296875 C 0.90625 -3.265625 0.863281 -3.25 0.8125 -3.25 C 0.757813 -3.25 0.710938 -3.265625 0.671875 -3.296875 C 0.640625 -3.335938 0.625 -3.40625 0.625 -3.5 L 0.625 -5.140625 L 4.765625 -5.140625 L 4.765625 -3.5 C 4.765625 -3.40625 4.742188 -3.335938 4.703125 -3.296875 C 4.671875 -3.265625 4.628906 -3.25 4.578125 -3.25 C 4.523438 -3.25 4.476563 -3.265625 4.4375 -3.296875 C 4.40625 -3.335938 4.390625 -3.40625 4.390625 -3.5 L 4.390625 -4.765625 Z M 2.890625 -4.765625 "
+           id="path879" />
+      </g>
+      <g
+         id="glyph-9-15" />
+    </g>
+    <clipPath
+       id="clip-0">
+      <path
+         clip-rule="nonzero"
+         d="M 621 404 L 751.921875 404 L 751.921875 483 L 621 483 Z M 621 404 "
+         id="path885" />
+    </clipPath>
+  </defs>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 94.898987%, 79.998779%)"
+     fill-opacity="0.502"
+     d="M 0.375 31.113281 L 577.683594 31.113281 L 577.683594 443.476563 L 0.375 443.476563 Z M 0.375 31.113281 "
+     id="path890" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(33.329773%, 9.01947%, 34.899902%)"
+     fill-opacity="0.302"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(43.139648%, 43.139648%, 43.139648%)"
+     stroke-opacity="0.302"
+     stroke-miterlimit="4"
+     d="M 229.998506 590.998732 L 850.001506 590.998732 L 850.001506 1301.000402 L 229.998506 1301.000402 Z M 229.998506 590.998732 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path892" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 100.002163 1.000499 L 199.998949 1.000499 L 199.998949 40.998171 L 100.002163 40.998171 Z M 100.002163 1.000499 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path894" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     d="M 113.210938 31.113281 L 113.210938 33.363281 L 112.460938 33.363281 L 112.460938 31.113281 M 113.210938 35.613281 L 113.210938 37.863281 L 112.460938 37.863281 L 112.460938 35.613281 M 113.210938 40.113281 L 113.210938 42.359375 L 112.460938 42.359375 L 112.460938 40.113281 M 113.210938 44.609375 L 113.210938 46.859375 L 112.460938 46.859375 L 112.460938 44.609375 M 113.210938 49.109375 L 113.210938 51.359375 L 112.460938 51.359375 L 112.460938 49.109375 M 113.210938 53.605469 L 113.210938 55.855469 L 112.460938 55.855469 L 112.460938 53.605469 M 113.210938 58.105469 L 113.210938 60.355469 L 112.460938 60.355469 L 112.460938 58.105469 M 113.210938 62.605469 L 113.210938 64.851563 L 112.460938 64.851563 L 112.460938 62.605469 M 113.210938 67.101563 L 113.210938 69.351563 L 112.460938 69.351563 L 112.460938 67.101563 M 113.210938 71.601563 L 113.210938 73.851563 L 112.460938 73.851563 L 112.460938 71.601563 M 113.210938 76.101563 L 113.210938 78.347656 L 112.460938 78.347656 L 112.460938 76.101563 M 113.210938 80.597656 L 113.210938 82.847656 L 112.460938 82.847656 L 112.460938 80.597656 M 113.210938 85.097656 L 113.210938 87.347656 L 112.460938 87.347656 L 112.460938 85.097656 M 113.210938 89.59375 L 113.210938 91.84375 L 112.460938 91.84375 L 112.460938 89.59375 M 113.210938 94.09375 L 113.210938 96.34375 L 112.460938 96.34375 L 112.460938 94.09375 M 113.210938 98.59375 L 113.210938 100.839844 L 112.460938 100.839844 L 112.460938 98.59375 M 113.210938 103.089844 L 113.210938 105.339844 L 112.460938 105.339844 L 112.460938 103.089844 M 113.210938 107.589844 L 113.210938 109.839844 L 112.460938 109.839844 L 112.460938 107.589844 M 113.210938 112.085938 L 113.210938 114.335938 L 112.460938 114.335938 L 112.460938 112.085938 M 113.210938 116.585938 L 113.210938 118.835938 L 112.460938 118.835938 L 112.460938 116.585938 M 113.210938 121.085938 L 113.210938 123.332031 L 112.460938 123.332031 L 112.460938 121.085938 M 113.210938 125.582031 L 113.210938 127.832031 L 112.460938 127.832031 L 112.460938 125.582031 M 113.210938 130.082031 L 113.210938 132.332031 L 112.460938 132.332031 L 112.460938 130.082031 M 113.210938 134.582031 L 113.210938 136.828125 L 112.460938 136.828125 L 112.460938 134.582031 M 113.210938 139.078125 L 113.210938 141.328125 L 112.460938 141.328125 L 112.460938 139.078125 M 113.210938 143.578125 L 113.210938 145.828125 L 112.460938 145.828125 L 112.460938 143.578125 M 113.210938 148.074219 L 113.210938 150.324219 L 112.460938 150.324219 L 112.460938 148.074219 M 113.210938 152.574219 L 113.210938 154.824219 L 112.460938 154.824219 L 112.460938 152.574219 M 113.210938 157.074219 L 113.210938 159.320313 L 112.460938 159.320313 L 112.460938 157.074219 M 113.210938 161.570313 L 113.210938 163.820313 L 112.460938 163.820313 L 112.460938 161.570313 M 113.210938 166.070313 L 113.210938 168.320313 L 112.460938 168.320313 L 112.460938 166.070313 M 113.210938 170.566406 L 113.210938 172.816406 L 112.460938 172.816406 L 112.460938 170.566406 M 113.210938 175.066406 L 113.210938 177.316406 L 112.460938 177.316406 L 112.460938 175.066406 M 113.210938 179.566406 L 113.210938 181.816406 L 112.460938 181.816406 L 112.460938 179.566406 M 113.210938 184.0625 L 113.210938 186.3125 L 112.460938 186.3125 L 112.460938 184.0625 M 113.210938 188.5625 L 113.210938 190.8125 L 112.460938 190.8125 L 112.460938 188.5625 M 113.210938 193.0625 L 113.210938 195.308594 L 112.460938 195.308594 L 112.460938 193.0625 M 113.210938 197.558594 L 113.210938 199.808594 L 112.460938 199.808594 L 112.460938 197.558594 M 113.210938 202.058594 L 113.210938 204.308594 L 112.460938 204.308594 L 112.460938 202.058594 M 113.210938 206.554688 L 113.210938 208.804688 L 112.460938 208.804688 L 112.460938 206.554688 M 113.210938 211.054688 L 113.210938 213.304688 L 112.460938 213.304688 L 112.460938 211.054688 M 113.210938 215.554688 L 113.210938 217.800781 L 112.460938 217.800781 L 112.460938 215.554688 M 113.210938 220.050781 L 113.210938 222.300781 L 112.460938 222.300781 L 112.460938 220.050781 M 113.210938 224.550781 L 113.210938 226.800781 L 112.460938 226.800781 L 112.460938 224.550781 M 113.210938 229.046875 L 113.210938 231.296875 L 112.460938 231.296875 L 112.460938 229.046875 M 113.210938 233.546875 L 113.210938 235.796875 L 112.460938 235.796875 L 112.460938 233.546875 M 113.210938 238.046875 L 113.210938 240.296875 L 112.460938 240.296875 L 112.460938 238.046875 M 113.210938 242.542969 L 113.210938 244.792969 L 112.460938 244.792969 L 112.460938 242.542969 M 113.210938 247.042969 L 113.210938 249.292969 L 112.460938 249.292969 L 112.460938 247.042969 M 113.210938 251.542969 L 113.210938 253.789063 L 112.460938 253.789063 L 112.460938 251.542969 M 113.210938 256.039063 L 113.210938 258.289063 L 112.460938 258.289063 L 112.460938 256.039063 M 113.210938 260.539063 L 113.210938 262.789063 L 112.460938 262.789063 L 112.460938 260.539063 M 113.210938 265.035156 L 113.210938 267.285156 L 112.460938 267.285156 L 112.460938 265.035156 M 113.210938 269.535156 L 113.210938 271.785156 L 112.460938 271.785156 L 112.460938 269.535156 M 113.210938 274.035156 L 113.210938 276.28125 L 112.460938 276.28125 L 112.460938 274.035156 M 113.210938 278.53125 L 113.210938 280.78125 L 112.460938 280.78125 L 112.460938 278.53125 M 113.210938 283.03125 L 113.210938 285.28125 L 112.460938 285.28125 L 112.460938 283.03125 M 113.210938 287.53125 L 113.210938 289.777344 L 112.460938 289.777344 L 112.460938 287.53125 M 113.210938 292.027344 L 113.210938 294.277344 L 112.460938 294.277344 L 112.460938 292.027344 M 113.210938 296.527344 L 113.210938 298.777344 L 112.460938 298.777344 L 112.460938 296.527344 M 113.210938 301.023438 L 113.210938 303.273438 L 112.460938 303.273438 L 112.460938 301.023438 M 113.210938 305.523438 L 113.210938 307.773438 L 112.460938 307.773438 L 112.460938 305.523438 M 113.210938 310.023438 L 113.210938 312.269531 L 112.460938 312.269531 L 112.460938 310.023438 M 113.210938 314.519531 L 113.210938 316.769531 L 112.460938 316.769531 L 112.460938 314.519531 M 113.210938 319.019531 L 113.210938 321.269531 L 112.460938 321.269531 L 112.460938 319.019531 M 113.210938 323.515625 L 113.210938 325.765625 L 112.460938 325.765625 L 112.460938 323.515625 M 113.210938 328.015625 L 113.210938 330.265625 L 112.460938 330.265625 L 112.460938 328.015625 M 113.210938 332.515625 L 113.210938 334.761719 L 112.460938 334.761719 L 112.460938 332.515625 M 113.210938 337.011719 L 113.210938 339.261719 L 112.460938 339.261719 L 112.460938 337.011719 M 113.210938 341.511719 L 113.210938 343.761719 L 112.460938 343.761719 L 112.460938 341.511719 M 113.210938 346.011719 L 113.210938 348.257813 L 112.460938 348.257813 L 112.460938 346.011719 M 113.210938 350.507813 L 113.210938 352.757813 L 112.460938 352.757813 L 112.460938 350.507813 M 113.210938 355.007813 L 113.210938 357.257813 L 112.460938 357.257813 L 112.460938 355.007813 M 113.210938 359.503906 L 113.210938 361.753906 L 112.460938 361.753906 L 112.460938 359.503906 M 113.210938 364.003906 L 113.210938 366.253906 L 112.460938 366.253906 L 112.460938 364.003906 M 113.210938 368.503906 L 113.210938 370.75 L 112.460938 370.75 L 112.460938 368.503906 M 113.210938 373 L 113.210938 375.25 L 112.460938 375.25 L 112.460938 373 M 113.210938 377.5 L 113.210938 379.75 L 112.460938 379.75 L 112.460938 377.5 M 113.210938 381.996094 L 113.210938 384.246094 L 112.460938 384.246094 L 112.460938 381.996094 M 113.210938 386.496094 L 113.210938 388.746094 L 112.460938 388.746094 L 112.460938 386.496094 M 113.210938 390.996094 L 113.210938 393.246094 L 112.460938 393.246094 L 112.460938 390.996094 M 113.210938 395.492188 L 113.210938 397.742188 L 112.460938 397.742188 L 112.460938 395.492188 M 113.210938 399.992188 L 113.210938 402.242188 L 112.460938 402.242188 L 112.460938 399.992188 M 113.210938 404.492188 L 113.210938 406.738281 L 112.460938 406.738281 L 112.460938 404.492188 M 113.210938 408.988281 L 113.210938 411.238281 L 112.460938 411.238281 L 112.460938 408.988281 M 113.210938 413.488281 L 113.210938 415.738281 L 112.460938 415.738281 L 112.460938 413.488281 M 113.210938 417.984375 L 113.210938 420.234375 L 112.460938 420.234375 L 112.460938 417.984375 M 113.210938 422.484375 L 113.210938 424.734375 L 112.460938 424.734375 L 112.460938 422.484375 M 113.210938 426.984375 L 113.210938 429.230469 L 112.460938 429.230469 L 112.460938 426.984375 M 113.210938 431.480469 L 113.210938 433.730469 L 112.460938 433.730469 L 112.460938 431.480469 M 113.210938 435.980469 L 113.210938 438.230469 L 112.460938 438.230469 L 112.460938 435.980469 M 113.210938 440.476563 L 113.210938 442.726563 L 112.460938 442.726563 L 112.460938 440.476563 M 113.210938 444.976563 L 113.210938 447.226563 L 112.460938 447.226563 L 112.460938 444.976563 M 113.210938 449.476563 L 113.210938 451.726563 L 112.460938 451.726563 L 112.460938 449.476563 M 113.210938 453.972656 L 113.210938 456.222656 L 112.460938 456.222656 L 112.460938 453.972656 M 113.210938 458.472656 L 113.210938 460.722656 L 112.460938 460.722656 L 112.460938 458.472656 M 113.210938 462.972656 L 113.210938 465.21875 L 112.460938 465.21875 L 112.460938 462.972656 M 113.210938 467.46875 L 113.210938 469.71875 L 112.460938 469.71875 L 112.460938 467.46875 M 113.210938 471.96875 L 113.210938 474.21875 L 112.460938 474.21875 L 112.460938 471.96875 M 113.210938 476.464844 L 113.210938 478.714844 L 112.460938 478.714844 L 112.460938 476.464844 M 113.210938 480.964844 L 113.210938 483.214844 L 112.460938 483.214844 L 112.460938 480.964844 M 113.210938 485.464844 L 113.210938 487.710938 L 112.460938 487.710938 L 112.460938 485.464844 M 113.210938 489.960938 L 113.210938 492.210938 L 112.460938 492.210938 L 112.460938 489.960938 M 113.210938 494.460938 L 113.210938 496.710938 L 112.460938 496.710938 L 112.460938 494.460938 M 113.210938 498.960938 L 113.210938 501.207031 L 112.460938 501.207031 L 112.460938 498.960938 M 113.210938 503.457031 L 113.210938 505.707031 L 112.460938 505.707031 L 112.460938 503.457031 M 113.210938 507.957031 L 113.210938 510.207031 L 112.460938 510.207031 L 112.460938 507.957031 M 113.210938 512.453125 L 113.210938 514.703125 L 112.460938 514.703125 L 112.460938 512.453125 M 113.210938 516.953125 L 113.210938 519.203125 L 112.460938 519.203125 L 112.460938 516.953125 M 113.210938 521.453125 L 113.210938 523.699219 L 112.460938 523.699219 L 112.460938 521.453125 M 113.210938 525.949219 L 113.210938 528.199219 L 112.460938 528.199219 L 112.460938 525.949219 M 113.210938 530.449219 L 113.210938 532.699219 L 112.460938 532.699219 L 112.460938 530.449219 M 113.210938 534.945313 L 113.210938 537.195313 L 112.460938 537.195313 L 112.460938 534.945313 M 113.210938 539.445313 L 113.210938 541.695313 L 112.460938 541.695313 L 112.460938 539.445313 M 113.210938 543.945313 L 113.210938 546.191406 L 112.460938 546.191406 L 112.460938 543.945313 M 113.210938 548.441406 L 113.210938 550.691406 L 112.460938 550.691406 L 112.460938 548.441406 M 113.210938 552.941406 L 113.210938 555.191406 L 112.460938 555.191406 L 112.460938 552.941406 M 113.210938 557.441406 L 113.210938 559.6875 L 112.460938 559.6875 L 112.460938 557.441406 M 113.210938 561.9375 L 113.210938 564.1875 L 112.460938 564.1875 L 112.460938 561.9375 M 113.210938 566.4375 L 113.210938 568.6875 L 112.460938 568.6875 L 112.460938 566.4375 M 113.210938 570.933594 L 113.210938 573.183594 L 112.460938 573.183594 L 112.460938 570.933594 M 113.210938 575.433594 L 113.210938 577.683594 L 112.460938 577.683594 L 112.460938 575.433594 M 113.210938 579.933594 L 113.210938 582.179688 L 112.460938 582.179688 L 112.460938 579.933594 M 113.210938 584.429688 L 113.210938 586.679688 L 112.460938 586.679688 L 112.460938 584.429688 M 113.210938 588.929688 L 113.210938 591.179688 L 112.460938 591.179688 L 112.460938 588.929688 M 113.210938 593.425781 L 113.210938 595.675781 L 112.460938 595.675781 L 112.460938 593.425781 M 113.210938 597.925781 L 113.210938 600.175781 L 112.460938 600.175781 L 112.460938 597.925781 M 113.210938 602.425781 L 113.210938 604.675781 L 112.460938 604.675781 L 112.460938 602.425781 M 113.210938 606.921875 L 113.210938 609.171875 L 112.460938 609.171875 L 112.460938 606.921875 M 113.210938 611.421875 L 113.210938 613.671875 L 112.460938 613.671875 L 112.460938 611.421875 M 113.210938 615.921875 L 113.210938 618.167969 L 112.460938 618.167969 L 112.460938 615.921875 M 113.210938 620.417969 L 113.210938 622.667969 L 112.460938 622.667969 L 112.460938 620.417969 M 113.210938 624.917969 L 113.210938 627.167969 L 112.460938 627.167969 L 112.460938 624.917969 M 113.210938 629.414063 L 113.210938 631.664063 L 112.460938 631.664063 L 112.460938 629.414063 M 113.210938 633.914063 L 113.210938 636.164063 L 112.460938 636.164063 L 112.460938 633.914063 M 113.210938 638.414063 L 113.210938 640.660156 L 112.460938 640.660156 L 112.460938 638.414063 M 113.210938 642.910156 L 113.210938 645.160156 L 112.460938 645.160156 L 112.460938 642.910156 M 113.210938 647.410156 L 113.210938 649.660156 L 112.460938 649.660156 L 112.460938 647.410156 M 113.210938 651.90625 L 113.210938 654.15625 L 112.460938 654.15625 L 112.460938 651.90625 M 113.210938 656.40625 L 113.210938 658.65625 L 112.460938 658.65625 L 112.460938 656.40625 M 113.210938 660.90625 L 113.210938 663.15625 L 112.460938 663.15625 L 112.460938 660.90625 M 113.210938 665.402344 L 113.210938 667.652344 L 112.460938 667.652344 L 112.460938 665.402344 M 113.210938 669.902344 L 113.210938 672.152344 L 112.460938 672.152344 L 112.460938 669.902344 M 113.210938 674.402344 L 113.210938 676.648438 L 112.460938 676.648438 L 112.460938 674.402344 M 113.210938 678.898438 L 113.210938 681.148438 L 112.460938 681.148438 L 112.460938 678.898438 M 113.210938 683.398438 L 113.210938 685.648438 L 112.460938 685.648438 L 112.460938 683.398438 M 113.210938 687.894531 L 113.210938 690.144531 L 112.460938 690.144531 L 112.460938 687.894531 M 113.210938 692.394531 L 113.210938 694.644531 L 112.460938 694.644531 L 112.460938 692.394531 M 113.210938 696.894531 L 113.210938 699.140625 L 112.460938 699.140625 L 112.460938 696.894531 M 113.210938 701.390625 L 113.210938 703.640625 L 112.460938 703.640625 L 112.460938 701.390625 M 113.210938 705.890625 L 113.210938 708.140625 L 112.460938 708.140625 L 112.460938 705.890625 M 113.210938 710.390625 L 113.210938 712.636719 L 112.460938 712.636719 L 112.460938 710.390625 M 113.210938 714.886719 L 113.210938 717.136719 L 112.460938 717.136719 L 112.460938 714.886719 M 113.210938 719.386719 L 113.210938 721.636719 L 112.460938 721.636719 L 112.460938 719.386719 M 113.210938 723.882813 L 113.210938 726.132813 L 112.460938 726.132813 L 112.460938 723.882813 M 113.210938 728.382813 L 113.210938 730.632813 L 112.460938 730.632813 L 112.460938 728.382813 M 113.210938 732.882813 L 113.210938 735.128906 L 112.460938 735.128906 L 112.460938 732.882813 M 113.210938 737.378906 L 113.210938 739.628906 L 112.460938 739.628906 L 112.460938 737.378906 M 113.210938 741.878906 L 113.210938 744.128906 L 112.460938 744.128906 L 112.460938 741.878906 M 113.210938 746.375 L 113.210938 748.625 L 112.460938 748.625 L 112.460938 746.375 M 113.210938 750.875 L 113.210938 753.125 L 112.460938 753.125 L 112.460938 750.875 M 113.210938 755.375 L 113.210938 757.621094 L 112.460938 757.621094 L 112.460938 755.375 M 113.210938 759.871094 L 113.210938 762.121094 L 112.460938 762.121094 L 112.460938 759.871094 M 113.210938 764.371094 L 113.210938 766.621094 L 112.460938 766.621094 L 112.460938 764.371094 M 113.210938 768.871094 L 113.210938 771.117188 L 112.460938 771.117188 L 112.460938 768.871094 M 113.210938 773.367188 L 113.210938 775.617188 L 112.460938 775.617188 L 112.460938 773.367188 M 113.210938 777.867188 L 113.210938 780.117188 L 112.460938 780.117188 L 112.460938 777.867188 M 113.210938 782.363281 L 113.210938 784.613281 L 112.460938 784.613281 L 112.460938 782.363281 M 113.210938 786.863281 L 113.210938 789.113281 L 112.460938 789.113281 L 112.460938 786.863281 M 113.210938 791.363281 L 113.210938 793.609375 L 112.460938 793.609375 L 112.460938 791.363281 M 113.210938 795.859375 L 113.210938 798.109375 L 112.460938 798.109375 L 112.460938 795.859375 M 113.210938 800.359375 L 113.210938 802.609375 L 112.460938 802.609375 L 112.460938 800.359375 M 113.210938 804.855469 L 113.210938 807.105469 L 112.460938 807.105469 L 112.460938 804.855469 M 113.210938 809.355469 L 113.210938 811.605469 L 112.460938 811.605469 L 112.460938 809.355469 M 113.210938 813.855469 L 113.210938 816.105469 L 112.460938 816.105469 L 112.460938 813.855469 M 113.210938 818.351563 L 113.210938 820.601563 L 112.460938 820.601563 L 112.460938 818.351563 M 113.210938 822.851563 L 113.210938 825.101563 L 112.460938 825.101563 L 112.460938 822.851563 M 113.210938 827.351563 L 113.210938 829.597656 L 112.460938 829.597656 L 112.460938 827.351563 M 113.210938 831.847656 L 113.210938 834.097656 L 112.460938 834.097656 L 112.460938 831.847656 M 113.210938 836.347656 L 113.210938 838.597656 L 112.460938 838.597656 L 112.460938 836.347656 M 113.210938 840.84375 L 113.210938 843.09375 L 112.460938 843.09375 L 112.460938 840.84375 M 113.210938 845.34375 L 113.210938 847.59375 L 112.460938 847.59375 L 112.460938 845.34375 M 113.210938 849.84375 L 113.210938 852.089844 L 112.460938 852.089844 L 112.460938 849.84375 M 113.210938 854.339844 L 113.210938 856.589844 L 112.460938 856.589844 L 112.460938 854.339844 M 113.210938 858.839844 L 113.210938 861.089844 L 112.460938 861.089844 L 112.460938 858.839844 M 113.210938 863.335938 L 113.210938 865.585938 L 112.460938 865.585938 L 112.460938 863.335938 M 113.210938 867.835938 L 113.210938 870.085938 L 112.460938 870.085938 L 112.460938 867.835938 M 113.210938 872.335938 L 113.210938 874.585938 L 112.460938 874.585938 L 112.460938 872.335938 M 113.210938 876.832031 L 113.210938 879.082031 L 112.460938 879.082031 L 112.460938 876.832031 M 113.210938 881.332031 L 113.210938 883.582031 L 112.460938 883.582031 L 112.460938 881.332031 M 113.210938 885.832031 L 113.210938 888.078125 L 112.460938 888.078125 L 112.460938 885.832031 M 113.210938 890.328125 L 113.210938 892.578125 L 112.460938 892.578125 L 112.460938 890.328125 M 113.210938 894.828125 L 113.210938 897.078125 L 112.460938 897.078125 L 112.460938 894.828125 M 113.210938 899.324219 L 113.210938 901.574219 L 112.460938 901.574219 L 112.460938 899.324219 M 113.210938 903.824219 L 113.210938 906.074219 L 112.460938 906.074219 L 112.460938 903.824219 M 113.210938 908.324219 L 113.210938 910.570313 L 112.460938 910.570313 L 112.460938 908.324219 M 113.210938 912.820313 L 113.210938 915.070313 L 112.460938 915.070313 L 112.460938 912.820313 M 113.210938 917.320313 L 113.210938 919.570313 L 112.460938 919.570313 L 112.460938 917.320313 M 113.210938 921.820313 L 113.210938 924.066406 L 112.460938 924.066406 L 112.460938 921.820313 M 113.210938 926.316406 L 113.210938 928.566406 L 112.460938 928.566406 L 112.460938 926.316406 M 113.210938 930.816406 L 113.210938 933.066406 L 112.460938 933.066406 L 112.460938 930.816406 M 113.210938 935.3125 L 113.210938 937.5625 L 112.460938 937.5625 L 112.460938 935.3125 M 113.210938 939.8125 L 113.210938 942.0625 L 112.460938 942.0625 L 112.460938 939.8125 M 113.210938 944.3125 L 113.210938 946.558594 L 112.460938 946.558594 L 112.460938 944.3125 M 113.210938 948.808594 L 113.210938 951.058594 L 112.460938 951.058594 L 112.460938 948.808594 M 113.210938 953.308594 L 113.210938 955.558594 L 112.460938 955.558594 L 112.460938 953.308594 M 113.210938 957.804688 L 113.210938 960.054688 L 112.460938 960.054688 L 112.460938 957.804688 M 113.210938 962.304688 L 113.210938 964.554688 L 112.460938 964.554688 L 112.460938 962.304688 M 113.210938 966.804688 L 113.210938 969.050781 L 112.460938 969.050781 L 112.460938 966.804688 M 113.210938 971.300781 L 113.210938 973.550781 L 112.460938 973.550781 L 112.460938 971.300781 M 113.210938 975.800781 L 113.210938 978.050781 L 112.460938 978.050781 L 112.460938 975.800781 M 113.210938 980.300781 L 113.210938 982.546875 L 112.460938 982.546875 L 112.460938 980.300781 M 113.210938 984.796875 L 113.210938 987.046875 L 112.460938 987.046875 L 112.460938 984.796875 M 113.210938 989.296875 L 113.210938 991.546875 L 112.460938 991.546875 L 112.460938 989.296875 M 113.210938 993.792969 L 113.210938 996.042969 L 112.460938 996.042969 L 112.460938 993.792969 M 113.210938 998.292969 L 113.210938 1000.542969 L 112.460938 1000.542969 L 112.460938 998.292969 M 113.210938 1002.792969 L 113.210938 1005.039063 L 112.460938 1005.039063 L 112.460938 1002.792969 M 113.210938 1007.289063 L 113.210938 1009.539063 L 112.460938 1009.539063 L 112.460938 1007.289063 M 113.210938 1011.789063 L 113.210938 1014.039063 L 112.460938 1014.039063 L 112.460938 1011.789063 M 113.210938 1016.285156 L 113.210938 1018.535156 L 112.460938 1018.535156 L 112.460938 1016.285156 M 113.210938 1020.785156 L 113.210938 1023.035156 L 112.460938 1023.035156 L 112.460938 1020.785156 M 113.210938 1025.285156 L 113.210938 1027.535156 L 112.460938 1027.535156 L 112.460938 1025.285156 M 113.210938 1029.78125 L 113.210938 1032.03125 L 112.460938 1032.03125 L 112.460938 1029.78125 M 113.210938 1034.28125 L 113.210938 1036.53125 L 112.460938 1036.53125 L 112.460938 1034.28125 M 113.210938 1038.78125 L 113.210938 1041.027344 L 112.460938 1041.027344 L 112.460938 1038.78125 M 113.210938 1043.277344 L 113.210938 1045.527344 L 112.460938 1045.527344 L 112.460938 1043.277344 M 113.210938 1047.777344 L 113.210938 1050.027344 L 112.460938 1050.027344 L 112.460938 1047.777344 M 113.210938 1052.273438 L 113.210938 1054.523438 L 112.460938 1054.523438 L 112.460938 1052.273438 M 113.210938 1056.773438 L 113.210938 1059.023438 L 112.460938 1059.023438 L 112.460938 1056.773438 M 113.210938 1061.273438 L 113.210938 1063.519531 L 112.460938 1063.519531 L 112.460938 1061.273438 M 113.210938 1065.769531 L 113.210938 1068.019531 L 112.460938 1068.019531 L 112.460938 1065.769531 M 113.210938 1070.269531 L 113.210938 1072.519531 L 112.460938 1072.519531 L 112.460938 1070.269531 M 113.210938 1074.765625 L 113.210938 1077.015625 L 112.460938 1077.015625 L 112.460938 1074.765625 M 113.210938 1079.265625 L 113.210938 1081.515625 L 112.460938 1081.515625 L 112.460938 1079.265625 M 113.210938 1083.765625 L 113.210938 1086.015625 L 112.460938 1086.015625 L 112.460938 1083.765625 M 113.210938 1088.261719 L 113.210938 1090.511719 L 112.460938 1090.511719 L 112.460938 1088.261719 M 113.210938 1092.761719 L 113.210938 1095.011719 L 112.460938 1095.011719 L 112.460938 1092.761719 M 113.210938 1097.261719 L 113.210938 1099.507813 L 112.460938 1099.507813 L 112.460938 1097.261719 M 113.210938 1101.757813 L 113.210938 1104.007813 L 112.460938 1104.007813 L 112.460938 1101.757813 M 113.210938 1106.257813 L 113.210938 1108.507813 L 112.460938 1108.507813 L 112.460938 1106.257813 M 113.210938 1110.753906 L 113.210938 1113.003906 L 112.460938 1113.003906 L 112.460938 1110.753906 M 113.210938 1115.253906 L 113.210938 1117.503906 L 112.460938 1117.503906 L 112.460938 1115.253906 M 113.210938 1119.753906 L 113.210938 1122 L 112.460938 1122 L 112.460938 1119.753906 M 113.210938 1124.25 L 113.210938 1126.5 L 112.460938 1126.5 L 112.460938 1124.25 M 113.210938 1128.75 L 113.210938 1131 L 112.460938 1131 L 112.460938 1128.75 M 113.210938 1133.25 L 113.210938 1135.496094 L 112.460938 1135.496094 L 112.460938 1133.25 M 113.210938 1137.746094 L 113.210938 1139.996094 L 112.460938 1139.996094 L 112.460938 1137.746094 "
+     id="path896" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g926">
+    <use
+       xlink:href="#glyph-0-1"
+       x="82.097694"
+       y="18.743767"
+       id="use898" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="88.595047"
+       y="18.743767"
+       id="use900" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="93.093552"
+       y="18.743767"
+       id="use902" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="98.09726"
+       y="18.743767"
+       id="use904" />
+    <use
+       xlink:href="#glyph-0-5"
+       x="101.09333"
+       y="18.743767"
+       id="use906" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="102.81102"
+       y="18.743767"
+       id="use908" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="107.30952"
+       y="18.743767"
+       id="use910" />
+    <use
+       xlink:href="#glyph-0-7"
+       x="109.80918"
+       y="18.743767"
+       id="use912" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="115.81012"
+       y="18.743767"
+       id="use914" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="118.80619"
+       y="18.743767"
+       id="use916" />
+    <use
+       xlink:href="#glyph-0-9"
+       x="123.8099"
+       y="18.743767"
+       id="use918" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="130.30725"
+       y="18.743767"
+       id="use920" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="134.80576"
+       y="18.743767"
+       id="use922" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="139.80946"
+       y="18.743767"
+       id="use924" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 23.997728 63.000278 L 141.380503 63.000278 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path928" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 23.997728 63.000278 C 23.997728 63.531704 23.898737 64.042291 23.695544 64.532037 C 23.492351 65.021783 23.205798 65.454219 22.830673 65.829343 C 22.455548 66.204468 22.023113 66.491022 21.528157 66.694214 C 21.038411 66.897407 20.533034 67.001608 20.001608 67.001608 C 19.470181 67.001608 18.959594 66.897407 18.469848 66.694214 C 17.980102 66.491022 17.547667 66.204468 17.172542 65.829343 C 16.797417 65.454219 16.505654 65.021783 16.302461 64.532037 C 16.099269 64.042291 16.000277 63.531704 16.000277 63.000278 C 16.000277 62.468851 16.099269 61.958265 16.302461 61.468519 C 16.505654 60.978772 16.797417 60.546337 17.172542 60.171212 C 17.547667 59.796088 17.980102 59.509534 18.469848 59.306341 C 18.959594 59.103149 19.470181 58.998948 20.001608 58.998948 C 20.533034 58.998948 21.038411 59.103149 21.528157 59.306341 C 22.023113 59.509534 22.455548 59.796088 22.830673 60.171212 C 23.205798 60.546337 23.492351 60.978772 23.695544 61.468519 C 23.898737 61.958265 23.997728 62.468851 23.997728 63.000278 Z M 23.997728 63.000278 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path930" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 148.377621 63.000278 L 141.380503 66.501442 L 141.380503 59.499114 Z M 148.377621 63.000278 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path932" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     d="M 11.996094 34.488281 L 102.714844 34.488281 L 102.714844 44.234375 L 11.996094 44.234375 Z M 11.996094 34.488281 "
+     id="path934" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g984">
+    <use
+       xlink:href="#glyph-1-1"
+       x="11.808573"
+       y="41.986038"
+       id="use936" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="17.764479"
+       y="41.986038"
+       id="use938" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="21.888105"
+       y="41.986038"
+       id="use940" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="26.474838"
+       y="41.986038"
+       id="use942" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="29.221239"
+       y="41.986038"
+       id="use944" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="31.51259"
+       y="41.986038"
+       id="use946" />
+    <use
+       xlink:href="#glyph-1-7"
+       x="35.636219"
+       y="41.986038"
+       id="use948" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="37.468494"
+       y="41.986038"
+       id="use950" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="39.300774"
+       y="41.986038"
+       id="use952" />
+    <use
+       xlink:href="#glyph-1-9"
+       x="43.4244"
+       y="41.986038"
+       id="use954" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="47.548031"
+       y="41.986038"
+       id="use956" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="51.671658"
+       y="41.986038"
+       id="use958" />
+    <use
+       xlink:href="#glyph-1-10"
+       x="53.963013"
+       y="41.986038"
+       id="use960" />
+    <use
+       xlink:href="#glyph-1-11"
+       x="56.890625"
+       y="41.986038"
+       id="use962" />
+    <use
+       xlink:href="#glyph-1-12"
+       x="63.305607"
+       y="41.986038"
+       id="use964" />
+    <use
+       xlink:href="#glyph-1-13"
+       x="65.596962"
+       y="41.986038"
+       id="use966" />
+    <use
+       xlink:href="#glyph-1-14"
+       x="71.552864"
+       y="41.986038"
+       id="use968" />
+    <use
+       xlink:href="#glyph-1-10"
+       x="77.508766"
+       y="41.986038"
+       id="use970" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="80.436386"
+       y="41.986038"
+       id="use972" />
+    <use
+       xlink:href="#glyph-1-15"
+       x="82.727737"
+       y="41.986038"
+       id="use974" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="87.314468"
+       y="41.986038"
+       id="use976" />
+    <use
+       xlink:href="#glyph-1-17"
+       x="91.901199"
+       y="41.986038"
+       id="use978" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="96.48793"
+       y="41.986038"
+       id="use980" />
+    <use
+       xlink:href="#glyph-1-18"
+       x="98.320206"
+       y="41.986038"
+       id="use982" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 430.002499 1.000499 L 529.999285 1.000499 L 529.999285 40.998171 L 430.002499 40.998171 Z M 430.002499 1.000499 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path986" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     d="M 360.628906 31.113281 L 360.628906 33.363281 L 359.878906 33.363281 L 359.878906 31.113281 M 360.628906 35.613281 L 360.628906 37.863281 L 359.878906 37.863281 L 359.878906 35.613281 M 360.628906 40.113281 L 360.628906 42.359375 L 359.878906 42.359375 L 359.878906 40.113281 M 360.628906 44.609375 L 360.628906 46.859375 L 359.878906 46.859375 L 359.878906 44.609375 M 360.628906 49.109375 L 360.628906 51.359375 L 359.878906 51.359375 L 359.878906 49.109375 M 360.628906 53.605469 L 360.628906 55.855469 L 359.878906 55.855469 L 359.878906 53.605469 M 360.628906 58.105469 L 360.628906 60.355469 L 359.878906 60.355469 L 359.878906 58.105469 M 360.628906 62.605469 L 360.628906 64.851563 L 359.878906 64.851563 L 359.878906 62.605469 M 360.628906 67.101563 L 360.628906 69.351563 L 359.878906 69.351563 L 359.878906 67.101563 M 360.628906 71.601563 L 360.628906 73.851563 L 359.878906 73.851563 L 359.878906 71.601563 M 360.628906 76.101563 L 360.628906 78.347656 L 359.878906 78.347656 L 359.878906 76.101563 M 360.628906 80.597656 L 360.628906 82.847656 L 359.878906 82.847656 L 359.878906 80.597656 M 360.628906 85.097656 L 360.628906 87.347656 L 359.878906 87.347656 L 359.878906 85.097656 M 360.628906 89.59375 L 360.628906 91.84375 L 359.878906 91.84375 L 359.878906 89.59375 M 360.628906 94.09375 L 360.628906 96.34375 L 359.878906 96.34375 L 359.878906 94.09375 M 360.628906 98.59375 L 360.628906 100.839844 L 359.878906 100.839844 L 359.878906 98.59375 M 360.628906 103.089844 L 360.628906 105.339844 L 359.878906 105.339844 L 359.878906 103.089844 M 360.628906 107.589844 L 360.628906 109.839844 L 359.878906 109.839844 L 359.878906 107.589844 M 360.628906 112.085938 L 360.628906 114.335938 L 359.878906 114.335938 L 359.878906 112.085938 M 360.628906 116.585938 L 360.628906 118.835938 L 359.878906 118.835938 L 359.878906 116.585938 M 360.628906 121.085938 L 360.628906 123.332031 L 359.878906 123.332031 L 359.878906 121.085938 M 360.628906 125.582031 L 360.628906 127.832031 L 359.878906 127.832031 L 359.878906 125.582031 M 360.628906 130.082031 L 360.628906 132.332031 L 359.878906 132.332031 L 359.878906 130.082031 M 360.628906 134.582031 L 360.628906 136.828125 L 359.878906 136.828125 L 359.878906 134.582031 M 360.628906 139.078125 L 360.628906 141.328125 L 359.878906 141.328125 L 359.878906 139.078125 M 360.628906 143.578125 L 360.628906 145.828125 L 359.878906 145.828125 L 359.878906 143.578125 M 360.628906 148.074219 L 360.628906 150.324219 L 359.878906 150.324219 L 359.878906 148.074219 M 360.628906 152.574219 L 360.628906 154.824219 L 359.878906 154.824219 L 359.878906 152.574219 M 360.628906 157.074219 L 360.628906 159.320313 L 359.878906 159.320313 L 359.878906 157.074219 M 360.628906 161.570313 L 360.628906 163.820313 L 359.878906 163.820313 L 359.878906 161.570313 M 360.628906 166.070313 L 360.628906 168.320313 L 359.878906 168.320313 L 359.878906 166.070313 M 360.628906 170.566406 L 360.628906 172.816406 L 359.878906 172.816406 L 359.878906 170.566406 M 360.628906 175.066406 L 360.628906 177.316406 L 359.878906 177.316406 L 359.878906 175.066406 M 360.628906 179.566406 L 360.628906 181.816406 L 359.878906 181.816406 L 359.878906 179.566406 M 360.628906 184.0625 L 360.628906 186.3125 L 359.878906 186.3125 L 359.878906 184.0625 M 360.628906 188.5625 L 360.628906 190.8125 L 359.878906 190.8125 L 359.878906 188.5625 M 360.628906 193.0625 L 360.628906 195.308594 L 359.878906 195.308594 L 359.878906 193.0625 M 360.628906 197.558594 L 360.628906 199.808594 L 359.878906 199.808594 L 359.878906 197.558594 M 360.628906 202.058594 L 360.628906 204.308594 L 359.878906 204.308594 L 359.878906 202.058594 M 360.628906 206.554688 L 360.628906 208.804688 L 359.878906 208.804688 L 359.878906 206.554688 M 360.628906 211.054688 L 360.628906 213.304688 L 359.878906 213.304688 L 359.878906 211.054688 M 360.628906 215.554688 L 360.628906 217.800781 L 359.878906 217.800781 L 359.878906 215.554688 M 360.628906 220.050781 L 360.628906 222.300781 L 359.878906 222.300781 L 359.878906 220.050781 M 360.628906 224.550781 L 360.628906 226.800781 L 359.878906 226.800781 L 359.878906 224.550781 M 360.628906 229.046875 L 360.628906 231.296875 L 359.878906 231.296875 L 359.878906 229.046875 M 360.628906 233.546875 L 360.628906 235.796875 L 359.878906 235.796875 L 359.878906 233.546875 M 360.628906 238.046875 L 360.628906 240.296875 L 359.878906 240.296875 L 359.878906 238.046875 M 360.628906 242.542969 L 360.628906 244.792969 L 359.878906 244.792969 L 359.878906 242.542969 M 360.628906 247.042969 L 360.628906 249.292969 L 359.878906 249.292969 L 359.878906 247.042969 M 360.628906 251.542969 L 360.628906 253.789063 L 359.878906 253.789063 L 359.878906 251.542969 M 360.628906 256.039063 L 360.628906 258.289063 L 359.878906 258.289063 L 359.878906 256.039063 M 360.628906 260.539063 L 360.628906 262.789063 L 359.878906 262.789063 L 359.878906 260.539063 M 360.628906 265.035156 L 360.628906 267.285156 L 359.878906 267.285156 L 359.878906 265.035156 M 360.628906 269.535156 L 360.628906 271.785156 L 359.878906 271.785156 L 359.878906 269.535156 M 360.628906 274.035156 L 360.628906 276.28125 L 359.878906 276.28125 L 359.878906 274.035156 M 360.628906 278.53125 L 360.628906 280.78125 L 359.878906 280.78125 L 359.878906 278.53125 M 360.628906 283.03125 L 360.628906 285.28125 L 359.878906 285.28125 L 359.878906 283.03125 M 360.628906 287.53125 L 360.628906 289.777344 L 359.878906 289.777344 L 359.878906 287.53125 M 360.628906 292.027344 L 360.628906 294.277344 L 359.878906 294.277344 L 359.878906 292.027344 M 360.628906 296.527344 L 360.628906 298.777344 L 359.878906 298.777344 L 359.878906 296.527344 M 360.628906 301.023438 L 360.628906 303.273438 L 359.878906 303.273438 L 359.878906 301.023438 M 360.628906 305.523438 L 360.628906 307.773438 L 359.878906 307.773438 L 359.878906 305.523438 M 360.628906 310.023438 L 360.628906 312.269531 L 359.878906 312.269531 L 359.878906 310.023438 M 360.628906 314.519531 L 360.628906 316.769531 L 359.878906 316.769531 L 359.878906 314.519531 M 360.628906 319.019531 L 360.628906 321.269531 L 359.878906 321.269531 L 359.878906 319.019531 M 360.628906 323.515625 L 360.628906 325.765625 L 359.878906 325.765625 L 359.878906 323.515625 M 360.628906 328.015625 L 360.628906 330.265625 L 359.878906 330.265625 L 359.878906 328.015625 M 360.628906 332.515625 L 360.628906 334.761719 L 359.878906 334.761719 L 359.878906 332.515625 M 360.628906 337.011719 L 360.628906 339.261719 L 359.878906 339.261719 L 359.878906 337.011719 M 360.628906 341.511719 L 360.628906 343.761719 L 359.878906 343.761719 L 359.878906 341.511719 M 360.628906 346.011719 L 360.628906 348.257813 L 359.878906 348.257813 L 359.878906 346.011719 M 360.628906 350.507813 L 360.628906 352.757813 L 359.878906 352.757813 L 359.878906 350.507813 M 360.628906 355.007813 L 360.628906 357.257813 L 359.878906 357.257813 L 359.878906 355.007813 M 360.628906 359.503906 L 360.628906 361.753906 L 359.878906 361.753906 L 359.878906 359.503906 M 360.628906 364.003906 L 360.628906 366.253906 L 359.878906 366.253906 L 359.878906 364.003906 M 360.628906 368.503906 L 360.628906 370.75 L 359.878906 370.75 L 359.878906 368.503906 M 360.628906 373 L 360.628906 375.25 L 359.878906 375.25 L 359.878906 373 M 360.628906 377.5 L 360.628906 379.75 L 359.878906 379.75 L 359.878906 377.5 M 360.628906 381.996094 L 360.628906 384.246094 L 359.878906 384.246094 L 359.878906 381.996094 M 360.628906 386.496094 L 360.628906 388.746094 L 359.878906 388.746094 L 359.878906 386.496094 M 360.628906 390.996094 L 360.628906 393.246094 L 359.878906 393.246094 L 359.878906 390.996094 M 360.628906 395.492188 L 360.628906 397.742188 L 359.878906 397.742188 L 359.878906 395.492188 M 360.628906 399.992188 L 360.628906 402.242188 L 359.878906 402.242188 L 359.878906 399.992188 M 360.628906 404.492188 L 360.628906 406.738281 L 359.878906 406.738281 L 359.878906 404.492188 M 360.628906 408.988281 L 360.628906 411.238281 L 359.878906 411.238281 L 359.878906 408.988281 M 360.628906 413.488281 L 360.628906 415.738281 L 359.878906 415.738281 L 359.878906 413.488281 M 360.628906 417.984375 L 360.628906 420.234375 L 359.878906 420.234375 L 359.878906 417.984375 M 360.628906 422.484375 L 360.628906 424.734375 L 359.878906 424.734375 L 359.878906 422.484375 M 360.628906 426.984375 L 360.628906 429.230469 L 359.878906 429.230469 L 359.878906 426.984375 M 360.628906 431.480469 L 360.628906 433.730469 L 359.878906 433.730469 L 359.878906 431.480469 M 360.628906 435.980469 L 360.628906 438.230469 L 359.878906 438.230469 L 359.878906 435.980469 M 360.628906 440.476563 L 360.628906 442.726563 L 359.878906 442.726563 L 359.878906 440.476563 M 360.628906 444.976563 L 360.628906 447.226563 L 359.878906 447.226563 L 359.878906 444.976563 M 360.628906 449.476563 L 360.628906 451.726563 L 359.878906 451.726563 L 359.878906 449.476563 M 360.628906 453.972656 L 360.628906 456.222656 L 359.878906 456.222656 L 359.878906 453.972656 M 360.628906 458.472656 L 360.628906 460.722656 L 359.878906 460.722656 L 359.878906 458.472656 M 360.628906 462.972656 L 360.628906 465.21875 L 359.878906 465.21875 L 359.878906 462.972656 M 360.628906 467.46875 L 360.628906 469.71875 L 359.878906 469.71875 L 359.878906 467.46875 M 360.628906 471.96875 L 360.628906 474.21875 L 359.878906 474.21875 L 359.878906 471.96875 M 360.628906 476.464844 L 360.628906 478.714844 L 359.878906 478.714844 L 359.878906 476.464844 M 360.628906 480.964844 L 360.628906 483.214844 L 359.878906 483.214844 L 359.878906 480.964844 M 360.628906 485.464844 L 360.628906 487.710938 L 359.878906 487.710938 L 359.878906 485.464844 M 360.628906 489.960938 L 360.628906 492.210938 L 359.878906 492.210938 L 359.878906 489.960938 M 360.628906 494.460938 L 360.628906 496.710938 L 359.878906 496.710938 L 359.878906 494.460938 M 360.628906 498.960938 L 360.628906 501.207031 L 359.878906 501.207031 L 359.878906 498.960938 M 360.628906 503.457031 L 360.628906 505.707031 L 359.878906 505.707031 L 359.878906 503.457031 M 360.628906 507.957031 L 360.628906 510.207031 L 359.878906 510.207031 L 359.878906 507.957031 M 360.628906 512.453125 L 360.628906 514.703125 L 359.878906 514.703125 L 359.878906 512.453125 M 360.628906 516.953125 L 360.628906 519.203125 L 359.878906 519.203125 L 359.878906 516.953125 M 360.628906 521.453125 L 360.628906 523.699219 L 359.878906 523.699219 L 359.878906 521.453125 M 360.628906 525.949219 L 360.628906 528.199219 L 359.878906 528.199219 L 359.878906 525.949219 M 360.628906 530.449219 L 360.628906 532.699219 L 359.878906 532.699219 L 359.878906 530.449219 M 360.628906 534.945313 L 360.628906 537.195313 L 359.878906 537.195313 L 359.878906 534.945313 M 360.628906 539.445313 L 360.628906 541.695313 L 359.878906 541.695313 L 359.878906 539.445313 M 360.628906 543.945313 L 360.628906 546.191406 L 359.878906 546.191406 L 359.878906 543.945313 M 360.628906 548.441406 L 360.628906 550.691406 L 359.878906 550.691406 L 359.878906 548.441406 M 360.628906 552.941406 L 360.628906 555.191406 L 359.878906 555.191406 L 359.878906 552.941406 M 360.628906 557.441406 L 360.628906 559.6875 L 359.878906 559.6875 L 359.878906 557.441406 M 360.628906 561.9375 L 360.628906 564.1875 L 359.878906 564.1875 L 359.878906 561.9375 M 360.628906 566.4375 L 360.628906 568.6875 L 359.878906 568.6875 L 359.878906 566.4375 M 360.628906 570.933594 L 360.628906 573.183594 L 359.878906 573.183594 L 359.878906 570.933594 M 360.628906 575.433594 L 360.628906 577.683594 L 359.878906 577.683594 L 359.878906 575.433594 M 360.628906 579.933594 L 360.628906 582.179688 L 359.878906 582.179688 L 359.878906 579.933594 M 360.628906 584.429688 L 360.628906 586.679688 L 359.878906 586.679688 L 359.878906 584.429688 M 360.628906 588.929688 L 360.628906 591.179688 L 359.878906 591.179688 L 359.878906 588.929688 M 360.628906 593.425781 L 360.628906 595.675781 L 359.878906 595.675781 L 359.878906 593.425781 M 360.628906 597.925781 L 360.628906 600.175781 L 359.878906 600.175781 L 359.878906 597.925781 M 360.628906 602.425781 L 360.628906 604.675781 L 359.878906 604.675781 L 359.878906 602.425781 M 360.628906 606.921875 L 360.628906 609.171875 L 359.878906 609.171875 L 359.878906 606.921875 M 360.628906 611.421875 L 360.628906 613.671875 L 359.878906 613.671875 L 359.878906 611.421875 M 360.628906 615.921875 L 360.628906 618.167969 L 359.878906 618.167969 L 359.878906 615.921875 M 360.628906 620.417969 L 360.628906 622.667969 L 359.878906 622.667969 L 359.878906 620.417969 M 360.628906 624.917969 L 360.628906 627.167969 L 359.878906 627.167969 L 359.878906 624.917969 M 360.628906 629.414063 L 360.628906 631.664063 L 359.878906 631.664063 L 359.878906 629.414063 M 360.628906 633.914063 L 360.628906 636.164063 L 359.878906 636.164063 L 359.878906 633.914063 M 360.628906 638.414063 L 360.628906 640.660156 L 359.878906 640.660156 L 359.878906 638.414063 M 360.628906 642.910156 L 360.628906 645.160156 L 359.878906 645.160156 L 359.878906 642.910156 M 360.628906 647.410156 L 360.628906 649.660156 L 359.878906 649.660156 L 359.878906 647.410156 M 360.628906 651.90625 L 360.628906 654.15625 L 359.878906 654.15625 L 359.878906 651.90625 M 360.628906 656.40625 L 360.628906 658.65625 L 359.878906 658.65625 L 359.878906 656.40625 M 360.628906 660.90625 L 360.628906 663.15625 L 359.878906 663.15625 L 359.878906 660.90625 M 360.628906 665.402344 L 360.628906 667.652344 L 359.878906 667.652344 L 359.878906 665.402344 M 360.628906 669.902344 L 360.628906 672.152344 L 359.878906 672.152344 L 359.878906 669.902344 M 360.628906 674.402344 L 360.628906 676.648438 L 359.878906 676.648438 L 359.878906 674.402344 M 360.628906 678.898438 L 360.628906 681.148438 L 359.878906 681.148438 L 359.878906 678.898438 M 360.628906 683.398438 L 360.628906 685.648438 L 359.878906 685.648438 L 359.878906 683.398438 M 360.628906 687.894531 L 360.628906 690.144531 L 359.878906 690.144531 L 359.878906 687.894531 M 360.628906 692.394531 L 360.628906 694.644531 L 359.878906 694.644531 L 359.878906 692.394531 M 360.628906 696.894531 L 360.628906 699.140625 L 359.878906 699.140625 L 359.878906 696.894531 M 360.628906 701.390625 L 360.628906 703.640625 L 359.878906 703.640625 L 359.878906 701.390625 M 360.628906 705.890625 L 360.628906 708.140625 L 359.878906 708.140625 L 359.878906 705.890625 M 360.628906 710.390625 L 360.628906 712.636719 L 359.878906 712.636719 L 359.878906 710.390625 M 360.628906 714.886719 L 360.628906 717.136719 L 359.878906 717.136719 L 359.878906 714.886719 M 360.628906 719.386719 L 360.628906 721.636719 L 359.878906 721.636719 L 359.878906 719.386719 M 360.628906 723.882813 L 360.628906 726.132813 L 359.878906 726.132813 L 359.878906 723.882813 M 360.628906 728.382813 L 360.628906 730.632813 L 359.878906 730.632813 L 359.878906 728.382813 M 360.628906 732.882813 L 360.628906 735.128906 L 359.878906 735.128906 L 359.878906 732.882813 M 360.628906 737.378906 L 360.628906 739.628906 L 359.878906 739.628906 L 359.878906 737.378906 M 360.628906 741.878906 L 360.628906 744.128906 L 359.878906 744.128906 L 359.878906 741.878906 M 360.628906 746.375 L 360.628906 748.625 L 359.878906 748.625 L 359.878906 746.375 M 360.628906 750.875 L 360.628906 753.125 L 359.878906 753.125 L 359.878906 750.875 M 360.628906 755.375 L 360.628906 757.621094 L 359.878906 757.621094 L 359.878906 755.375 M 360.628906 759.871094 L 360.628906 762.121094 L 359.878906 762.121094 L 359.878906 759.871094 M 360.628906 764.371094 L 360.628906 766.621094 L 359.878906 766.621094 L 359.878906 764.371094 M 360.628906 768.871094 L 360.628906 771.117188 L 359.878906 771.117188 L 359.878906 768.871094 M 360.628906 773.367188 L 360.628906 775.617188 L 359.878906 775.617188 L 359.878906 773.367188 M 360.628906 777.867188 L 360.628906 780.117188 L 359.878906 780.117188 L 359.878906 777.867188 M 360.628906 782.363281 L 360.628906 784.613281 L 359.878906 784.613281 L 359.878906 782.363281 M 360.628906 786.863281 L 360.628906 789.113281 L 359.878906 789.113281 L 359.878906 786.863281 M 360.628906 791.363281 L 360.628906 793.609375 L 359.878906 793.609375 L 359.878906 791.363281 M 360.628906 795.859375 L 360.628906 798.109375 L 359.878906 798.109375 L 359.878906 795.859375 M 360.628906 800.359375 L 360.628906 802.609375 L 359.878906 802.609375 L 359.878906 800.359375 M 360.628906 804.855469 L 360.628906 807.105469 L 359.878906 807.105469 L 359.878906 804.855469 M 360.628906 809.355469 L 360.628906 811.605469 L 359.878906 811.605469 L 359.878906 809.355469 M 360.628906 813.855469 L 360.628906 816.105469 L 359.878906 816.105469 L 359.878906 813.855469 M 360.628906 818.351563 L 360.628906 820.601563 L 359.878906 820.601563 L 359.878906 818.351563 M 360.628906 822.851563 L 360.628906 825.101563 L 359.878906 825.101563 L 359.878906 822.851563 M 360.628906 827.351563 L 360.628906 829.597656 L 359.878906 829.597656 L 359.878906 827.351563 M 360.628906 831.847656 L 360.628906 834.097656 L 359.878906 834.097656 L 359.878906 831.847656 M 360.628906 836.347656 L 360.628906 838.597656 L 359.878906 838.597656 L 359.878906 836.347656 M 360.628906 840.84375 L 360.628906 843.09375 L 359.878906 843.09375 L 359.878906 840.84375 M 360.628906 845.34375 L 360.628906 847.59375 L 359.878906 847.59375 L 359.878906 845.34375 M 360.628906 849.84375 L 360.628906 852.089844 L 359.878906 852.089844 L 359.878906 849.84375 M 360.628906 854.339844 L 360.628906 856.589844 L 359.878906 856.589844 L 359.878906 854.339844 M 360.628906 858.839844 L 360.628906 861.089844 L 359.878906 861.089844 L 359.878906 858.839844 M 360.628906 863.335938 L 360.628906 865.585938 L 359.878906 865.585938 L 359.878906 863.335938 M 360.628906 867.835938 L 360.628906 870.085938 L 359.878906 870.085938 L 359.878906 867.835938 M 360.628906 872.335938 L 360.628906 874.585938 L 359.878906 874.585938 L 359.878906 872.335938 M 360.628906 876.832031 L 360.628906 879.082031 L 359.878906 879.082031 L 359.878906 876.832031 M 360.628906 881.332031 L 360.628906 883.582031 L 359.878906 883.582031 L 359.878906 881.332031 M 360.628906 885.832031 L 360.628906 888.078125 L 359.878906 888.078125 L 359.878906 885.832031 M 360.628906 890.328125 L 360.628906 892.578125 L 359.878906 892.578125 L 359.878906 890.328125 M 360.628906 894.828125 L 360.628906 897.078125 L 359.878906 897.078125 L 359.878906 894.828125 M 360.628906 899.324219 L 360.628906 901.574219 L 359.878906 901.574219 L 359.878906 899.324219 M 360.628906 903.824219 L 360.628906 906.074219 L 359.878906 906.074219 L 359.878906 903.824219 M 360.628906 908.324219 L 360.628906 910.570313 L 359.878906 910.570313 L 359.878906 908.324219 M 360.628906 912.820313 L 360.628906 915.070313 L 359.878906 915.070313 L 359.878906 912.820313 M 360.628906 917.320313 L 360.628906 919.570313 L 359.878906 919.570313 L 359.878906 917.320313 M 360.628906 921.820313 L 360.628906 924.066406 L 359.878906 924.066406 L 359.878906 921.820313 M 360.628906 926.316406 L 360.628906 928.566406 L 359.878906 928.566406 L 359.878906 926.316406 M 360.628906 930.816406 L 360.628906 933.066406 L 359.878906 933.066406 L 359.878906 930.816406 M 360.628906 935.3125 L 360.628906 937.5625 L 359.878906 937.5625 L 359.878906 935.3125 M 360.628906 939.8125 L 360.628906 942.0625 L 359.878906 942.0625 L 359.878906 939.8125 M 360.628906 944.3125 L 360.628906 946.558594 L 359.878906 946.558594 L 359.878906 944.3125 M 360.628906 948.808594 L 360.628906 951.058594 L 359.878906 951.058594 L 359.878906 948.808594 M 360.628906 953.308594 L 360.628906 955.558594 L 359.878906 955.558594 L 359.878906 953.308594 M 360.628906 957.804688 L 360.628906 960.054688 L 359.878906 960.054688 L 359.878906 957.804688 M 360.628906 962.304688 L 360.628906 964.554688 L 359.878906 964.554688 L 359.878906 962.304688 M 360.628906 966.804688 L 360.628906 969.050781 L 359.878906 969.050781 L 359.878906 966.804688 M 360.628906 971.300781 L 360.628906 973.550781 L 359.878906 973.550781 L 359.878906 971.300781 M 360.628906 975.800781 L 360.628906 978.050781 L 359.878906 978.050781 L 359.878906 975.800781 M 360.628906 980.300781 L 360.628906 982.546875 L 359.878906 982.546875 L 359.878906 980.300781 M 360.628906 984.796875 L 360.628906 987.046875 L 359.878906 987.046875 L 359.878906 984.796875 M 360.628906 989.296875 L 360.628906 991.546875 L 359.878906 991.546875 L 359.878906 989.296875 M 360.628906 993.792969 L 360.628906 996.042969 L 359.878906 996.042969 L 359.878906 993.792969 M 360.628906 998.292969 L 360.628906 1000.542969 L 359.878906 1000.542969 L 359.878906 998.292969 M 360.628906 1002.792969 L 360.628906 1005.039063 L 359.878906 1005.039063 L 359.878906 1002.792969 M 360.628906 1007.289063 L 360.628906 1009.539063 L 359.878906 1009.539063 L 359.878906 1007.289063 M 360.628906 1011.789063 L 360.628906 1014.039063 L 359.878906 1014.039063 L 359.878906 1011.789063 M 360.628906 1016.285156 L 360.628906 1018.535156 L 359.878906 1018.535156 L 359.878906 1016.285156 M 360.628906 1020.785156 L 360.628906 1023.035156 L 359.878906 1023.035156 L 359.878906 1020.785156 M 360.628906 1025.285156 L 360.628906 1027.535156 L 359.878906 1027.535156 L 359.878906 1025.285156 M 360.628906 1029.78125 L 360.628906 1032.03125 L 359.878906 1032.03125 L 359.878906 1029.78125 M 360.628906 1034.28125 L 360.628906 1036.53125 L 359.878906 1036.53125 L 359.878906 1034.28125 M 360.628906 1038.78125 L 360.628906 1041.027344 L 359.878906 1041.027344 L 359.878906 1038.78125 M 360.628906 1043.277344 L 360.628906 1045.527344 L 359.878906 1045.527344 L 359.878906 1043.277344 M 360.628906 1047.777344 L 360.628906 1050.027344 L 359.878906 1050.027344 L 359.878906 1047.777344 M 360.628906 1052.273438 L 360.628906 1054.523438 L 359.878906 1054.523438 L 359.878906 1052.273438 M 360.628906 1056.773438 L 360.628906 1059.023438 L 359.878906 1059.023438 L 359.878906 1056.773438 M 360.628906 1061.273438 L 360.628906 1063.519531 L 359.878906 1063.519531 L 359.878906 1061.273438 M 360.628906 1065.769531 L 360.628906 1068.019531 L 359.878906 1068.019531 L 359.878906 1065.769531 M 360.628906 1070.269531 L 360.628906 1072.519531 L 359.878906 1072.519531 L 359.878906 1070.269531 M 360.628906 1074.765625 L 360.628906 1077.015625 L 359.878906 1077.015625 L 359.878906 1074.765625 M 360.628906 1079.265625 L 360.628906 1081.515625 L 359.878906 1081.515625 L 359.878906 1079.265625 M 360.628906 1083.765625 L 360.628906 1086.015625 L 359.878906 1086.015625 L 359.878906 1083.765625 M 360.628906 1088.261719 L 360.628906 1090.511719 L 359.878906 1090.511719 L 359.878906 1088.261719 M 360.628906 1092.761719 L 360.628906 1095.011719 L 359.878906 1095.011719 L 359.878906 1092.761719 M 360.628906 1097.261719 L 360.628906 1099.507813 L 359.878906 1099.507813 L 359.878906 1097.261719 M 360.628906 1101.757813 L 360.628906 1104.007813 L 359.878906 1104.007813 L 359.878906 1101.757813 M 360.628906 1106.257813 L 360.628906 1108.507813 L 359.878906 1108.507813 L 359.878906 1106.257813 M 360.628906 1110.753906 L 360.628906 1113.003906 L 359.878906 1113.003906 L 359.878906 1110.753906 M 360.628906 1115.253906 L 360.628906 1117.503906 L 359.878906 1117.503906 L 359.878906 1115.253906 M 360.628906 1119.753906 L 360.628906 1122 L 359.878906 1122 L 359.878906 1119.753906 M 360.628906 1124.25 L 360.628906 1126.5 L 359.878906 1126.5 L 359.878906 1124.25 M 360.628906 1128.75 L 360.628906 1131 L 359.878906 1131 L 359.878906 1128.75 M 360.628906 1133.25 L 360.628906 1135.496094 L 359.878906 1135.496094 L 359.878906 1133.25 M 360.628906 1137.746094 L 360.628906 1139.996094 L 359.878906 1139.996094 L 359.878906 1137.746094 "
+     id="path988" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1000">
+    <use
+       xlink:href="#glyph-0-10"
+       x="347.62659"
+       y="18.743767"
+       id="use990" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="354.12393"
+       y="18.743767"
+       id="use992" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="359.12762"
+       y="18.743767"
+       id="use994" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="364.13135"
+       y="18.743767"
+       id="use996" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="369.13504"
+       y="18.743767"
+       id="use998" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 685.999065 1.000499 L 786.001062 1.000499 L 786.001062 40.998171 L 685.999065 40.998171 Z M 685.999065 1.000499 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1002" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     d="M 552.566406 31.113281 L 552.566406 33.363281 L 551.816406 33.363281 L 551.816406 31.113281 M 552.566406 35.613281 L 552.566406 37.863281 L 551.816406 37.863281 L 551.816406 35.613281 M 552.566406 40.113281 L 552.566406 42.359375 L 551.816406 42.359375 L 551.816406 40.113281 M 552.566406 44.609375 L 552.566406 46.859375 L 551.816406 46.859375 L 551.816406 44.609375 M 552.566406 49.109375 L 552.566406 51.359375 L 551.816406 51.359375 L 551.816406 49.109375 M 552.566406 53.605469 L 552.566406 55.855469 L 551.816406 55.855469 L 551.816406 53.605469 M 552.566406 58.105469 L 552.566406 60.355469 L 551.816406 60.355469 L 551.816406 58.105469 M 552.566406 62.605469 L 552.566406 64.851563 L 551.816406 64.851563 L 551.816406 62.605469 M 552.566406 67.101563 L 552.566406 69.351563 L 551.816406 69.351563 L 551.816406 67.101563 M 552.566406 71.601563 L 552.566406 73.851563 L 551.816406 73.851563 L 551.816406 71.601563 M 552.566406 76.101563 L 552.566406 78.347656 L 551.816406 78.347656 L 551.816406 76.101563 M 552.566406 80.597656 L 552.566406 82.847656 L 551.816406 82.847656 L 551.816406 80.597656 M 552.566406 85.097656 L 552.566406 87.347656 L 551.816406 87.347656 L 551.816406 85.097656 M 552.566406 89.59375 L 552.566406 91.84375 L 551.816406 91.84375 L 551.816406 89.59375 M 552.566406 94.09375 L 552.566406 96.34375 L 551.816406 96.34375 L 551.816406 94.09375 M 552.566406 98.59375 L 552.566406 100.839844 L 551.816406 100.839844 L 551.816406 98.59375 M 552.566406 103.089844 L 552.566406 105.339844 L 551.816406 105.339844 L 551.816406 103.089844 M 552.566406 107.589844 L 552.566406 109.839844 L 551.816406 109.839844 L 551.816406 107.589844 M 552.566406 112.085938 L 552.566406 114.335938 L 551.816406 114.335938 L 551.816406 112.085938 M 552.566406 116.585938 L 552.566406 118.835938 L 551.816406 118.835938 L 551.816406 116.585938 M 552.566406 121.085938 L 552.566406 123.332031 L 551.816406 123.332031 L 551.816406 121.085938 M 552.566406 125.582031 L 552.566406 127.832031 L 551.816406 127.832031 L 551.816406 125.582031 M 552.566406 130.082031 L 552.566406 132.332031 L 551.816406 132.332031 L 551.816406 130.082031 M 552.566406 134.582031 L 552.566406 136.828125 L 551.816406 136.828125 L 551.816406 134.582031 M 552.566406 139.078125 L 552.566406 141.328125 L 551.816406 141.328125 L 551.816406 139.078125 M 552.566406 143.578125 L 552.566406 145.828125 L 551.816406 145.828125 L 551.816406 143.578125 M 552.566406 148.074219 L 552.566406 150.324219 L 551.816406 150.324219 L 551.816406 148.074219 M 552.566406 152.574219 L 552.566406 154.824219 L 551.816406 154.824219 L 551.816406 152.574219 M 552.566406 157.074219 L 552.566406 159.320313 L 551.816406 159.320313 L 551.816406 157.074219 M 552.566406 161.570313 L 552.566406 163.820313 L 551.816406 163.820313 L 551.816406 161.570313 M 552.566406 166.070313 L 552.566406 168.320313 L 551.816406 168.320313 L 551.816406 166.070313 M 552.566406 170.566406 L 552.566406 172.816406 L 551.816406 172.816406 L 551.816406 170.566406 M 552.566406 175.066406 L 552.566406 177.316406 L 551.816406 177.316406 L 551.816406 175.066406 M 552.566406 179.566406 L 552.566406 181.816406 L 551.816406 181.816406 L 551.816406 179.566406 M 552.566406 184.0625 L 552.566406 186.3125 L 551.816406 186.3125 L 551.816406 184.0625 M 552.566406 188.5625 L 552.566406 190.8125 L 551.816406 190.8125 L 551.816406 188.5625 M 552.566406 193.0625 L 552.566406 195.308594 L 551.816406 195.308594 L 551.816406 193.0625 M 552.566406 197.558594 L 552.566406 199.808594 L 551.816406 199.808594 L 551.816406 197.558594 M 552.566406 202.058594 L 552.566406 204.308594 L 551.816406 204.308594 L 551.816406 202.058594 M 552.566406 206.554688 L 552.566406 208.804688 L 551.816406 208.804688 L 551.816406 206.554688 M 552.566406 211.054688 L 552.566406 213.304688 L 551.816406 213.304688 L 551.816406 211.054688 M 552.566406 215.554688 L 552.566406 217.800781 L 551.816406 217.800781 L 551.816406 215.554688 M 552.566406 220.050781 L 552.566406 222.300781 L 551.816406 222.300781 L 551.816406 220.050781 M 552.566406 224.550781 L 552.566406 226.800781 L 551.816406 226.800781 L 551.816406 224.550781 M 552.566406 229.046875 L 552.566406 231.296875 L 551.816406 231.296875 L 551.816406 229.046875 M 552.566406 233.546875 L 552.566406 235.796875 L 551.816406 235.796875 L 551.816406 233.546875 M 552.566406 238.046875 L 552.566406 240.296875 L 551.816406 240.296875 L 551.816406 238.046875 M 552.566406 242.542969 L 552.566406 244.792969 L 551.816406 244.792969 L 551.816406 242.542969 M 552.566406 247.042969 L 552.566406 249.292969 L 551.816406 249.292969 L 551.816406 247.042969 M 552.566406 251.542969 L 552.566406 253.789063 L 551.816406 253.789063 L 551.816406 251.542969 M 552.566406 256.039063 L 552.566406 258.289063 L 551.816406 258.289063 L 551.816406 256.039063 M 552.566406 260.539063 L 552.566406 262.789063 L 551.816406 262.789063 L 551.816406 260.539063 M 552.566406 265.035156 L 552.566406 267.285156 L 551.816406 267.285156 L 551.816406 265.035156 M 552.566406 269.535156 L 552.566406 271.785156 L 551.816406 271.785156 L 551.816406 269.535156 M 552.566406 274.035156 L 552.566406 276.28125 L 551.816406 276.28125 L 551.816406 274.035156 M 552.566406 278.53125 L 552.566406 280.78125 L 551.816406 280.78125 L 551.816406 278.53125 M 552.566406 283.03125 L 552.566406 285.28125 L 551.816406 285.28125 L 551.816406 283.03125 M 552.566406 287.53125 L 552.566406 289.777344 L 551.816406 289.777344 L 551.816406 287.53125 M 552.566406 292.027344 L 552.566406 294.277344 L 551.816406 294.277344 L 551.816406 292.027344 M 552.566406 296.527344 L 552.566406 298.777344 L 551.816406 298.777344 L 551.816406 296.527344 M 552.566406 301.023438 L 552.566406 303.273438 L 551.816406 303.273438 L 551.816406 301.023438 M 552.566406 305.523438 L 552.566406 307.773438 L 551.816406 307.773438 L 551.816406 305.523438 M 552.566406 310.023438 L 552.566406 312.269531 L 551.816406 312.269531 L 551.816406 310.023438 M 552.566406 314.519531 L 552.566406 316.769531 L 551.816406 316.769531 L 551.816406 314.519531 M 552.566406 319.019531 L 552.566406 321.269531 L 551.816406 321.269531 L 551.816406 319.019531 M 552.566406 323.515625 L 552.566406 325.765625 L 551.816406 325.765625 L 551.816406 323.515625 M 552.566406 328.015625 L 552.566406 330.265625 L 551.816406 330.265625 L 551.816406 328.015625 M 552.566406 332.515625 L 552.566406 334.761719 L 551.816406 334.761719 L 551.816406 332.515625 M 552.566406 337.011719 L 552.566406 339.261719 L 551.816406 339.261719 L 551.816406 337.011719 M 552.566406 341.511719 L 552.566406 343.761719 L 551.816406 343.761719 L 551.816406 341.511719 M 552.566406 346.011719 L 552.566406 348.257813 L 551.816406 348.257813 L 551.816406 346.011719 M 552.566406 350.507813 L 552.566406 352.757813 L 551.816406 352.757813 L 551.816406 350.507813 M 552.566406 355.007813 L 552.566406 357.257813 L 551.816406 357.257813 L 551.816406 355.007813 M 552.566406 359.503906 L 552.566406 361.753906 L 551.816406 361.753906 L 551.816406 359.503906 M 552.566406 364.003906 L 552.566406 366.253906 L 551.816406 366.253906 L 551.816406 364.003906 M 552.566406 368.503906 L 552.566406 370.75 L 551.816406 370.75 L 551.816406 368.503906 M 552.566406 373 L 552.566406 375.25 L 551.816406 375.25 L 551.816406 373 M 552.566406 377.5 L 552.566406 379.75 L 551.816406 379.75 L 551.816406 377.5 M 552.566406 381.996094 L 552.566406 384.246094 L 551.816406 384.246094 L 551.816406 381.996094 M 552.566406 386.496094 L 552.566406 388.746094 L 551.816406 388.746094 L 551.816406 386.496094 M 552.566406 390.996094 L 552.566406 393.246094 L 551.816406 393.246094 L 551.816406 390.996094 M 552.566406 395.492188 L 552.566406 397.742188 L 551.816406 397.742188 L 551.816406 395.492188 M 552.566406 399.992188 L 552.566406 402.242188 L 551.816406 402.242188 L 551.816406 399.992188 M 552.566406 404.492188 L 552.566406 406.738281 L 551.816406 406.738281 L 551.816406 404.492188 M 552.566406 408.988281 L 552.566406 411.238281 L 551.816406 411.238281 L 551.816406 408.988281 M 552.566406 413.488281 L 552.566406 415.738281 L 551.816406 415.738281 L 551.816406 413.488281 M 552.566406 417.984375 L 552.566406 420.234375 L 551.816406 420.234375 L 551.816406 417.984375 M 552.566406 422.484375 L 552.566406 424.734375 L 551.816406 424.734375 L 551.816406 422.484375 M 552.566406 426.984375 L 552.566406 429.230469 L 551.816406 429.230469 L 551.816406 426.984375 M 552.566406 431.480469 L 552.566406 433.730469 L 551.816406 433.730469 L 551.816406 431.480469 M 552.566406 435.980469 L 552.566406 438.230469 L 551.816406 438.230469 L 551.816406 435.980469 M 552.566406 440.476563 L 552.566406 442.726563 L 551.816406 442.726563 L 551.816406 440.476563 M 552.566406 444.976563 L 552.566406 447.226563 L 551.816406 447.226563 L 551.816406 444.976563 M 552.566406 449.476563 L 552.566406 451.726563 L 551.816406 451.726563 L 551.816406 449.476563 M 552.566406 453.972656 L 552.566406 456.222656 L 551.816406 456.222656 L 551.816406 453.972656 M 552.566406 458.472656 L 552.566406 460.722656 L 551.816406 460.722656 L 551.816406 458.472656 M 552.566406 462.972656 L 552.566406 465.21875 L 551.816406 465.21875 L 551.816406 462.972656 M 552.566406 467.46875 L 552.566406 469.71875 L 551.816406 469.71875 L 551.816406 467.46875 M 552.566406 471.96875 L 552.566406 474.21875 L 551.816406 474.21875 L 551.816406 471.96875 M 552.566406 476.464844 L 552.566406 478.714844 L 551.816406 478.714844 L 551.816406 476.464844 M 552.566406 480.964844 L 552.566406 483.214844 L 551.816406 483.214844 L 551.816406 480.964844 M 552.566406 485.464844 L 552.566406 487.710938 L 551.816406 487.710938 L 551.816406 485.464844 M 552.566406 489.960938 L 552.566406 492.210938 L 551.816406 492.210938 L 551.816406 489.960938 M 552.566406 494.460938 L 552.566406 496.710938 L 551.816406 496.710938 L 551.816406 494.460938 M 552.566406 498.960938 L 552.566406 501.207031 L 551.816406 501.207031 L 551.816406 498.960938 M 552.566406 503.457031 L 552.566406 505.707031 L 551.816406 505.707031 L 551.816406 503.457031 M 552.566406 507.957031 L 552.566406 510.207031 L 551.816406 510.207031 L 551.816406 507.957031 M 552.566406 512.453125 L 552.566406 514.703125 L 551.816406 514.703125 L 551.816406 512.453125 M 552.566406 516.953125 L 552.566406 519.203125 L 551.816406 519.203125 L 551.816406 516.953125 M 552.566406 521.453125 L 552.566406 523.699219 L 551.816406 523.699219 L 551.816406 521.453125 M 552.566406 525.949219 L 552.566406 528.199219 L 551.816406 528.199219 L 551.816406 525.949219 M 552.566406 530.449219 L 552.566406 532.699219 L 551.816406 532.699219 L 551.816406 530.449219 M 552.566406 534.945313 L 552.566406 537.195313 L 551.816406 537.195313 L 551.816406 534.945313 M 552.566406 539.445313 L 552.566406 541.695313 L 551.816406 541.695313 L 551.816406 539.445313 M 552.566406 543.945313 L 552.566406 546.191406 L 551.816406 546.191406 L 551.816406 543.945313 M 552.566406 548.441406 L 552.566406 550.691406 L 551.816406 550.691406 L 551.816406 548.441406 M 552.566406 552.941406 L 552.566406 555.191406 L 551.816406 555.191406 L 551.816406 552.941406 M 552.566406 557.441406 L 552.566406 559.6875 L 551.816406 559.6875 L 551.816406 557.441406 M 552.566406 561.9375 L 552.566406 564.1875 L 551.816406 564.1875 L 551.816406 561.9375 M 552.566406 566.4375 L 552.566406 568.6875 L 551.816406 568.6875 L 551.816406 566.4375 M 552.566406 570.933594 L 552.566406 573.183594 L 551.816406 573.183594 L 551.816406 570.933594 M 552.566406 575.433594 L 552.566406 577.683594 L 551.816406 577.683594 L 551.816406 575.433594 M 552.566406 579.933594 L 552.566406 582.179688 L 551.816406 582.179688 L 551.816406 579.933594 M 552.566406 584.429688 L 552.566406 586.679688 L 551.816406 586.679688 L 551.816406 584.429688 M 552.566406 588.929688 L 552.566406 591.179688 L 551.816406 591.179688 L 551.816406 588.929688 M 552.566406 593.425781 L 552.566406 595.675781 L 551.816406 595.675781 L 551.816406 593.425781 M 552.566406 597.925781 L 552.566406 600.175781 L 551.816406 600.175781 L 551.816406 597.925781 M 552.566406 602.425781 L 552.566406 604.675781 L 551.816406 604.675781 L 551.816406 602.425781 M 552.566406 606.921875 L 552.566406 609.171875 L 551.816406 609.171875 L 551.816406 606.921875 M 552.566406 611.421875 L 552.566406 613.671875 L 551.816406 613.671875 L 551.816406 611.421875 M 552.566406 615.921875 L 552.566406 618.167969 L 551.816406 618.167969 L 551.816406 615.921875 M 552.566406 620.417969 L 552.566406 622.667969 L 551.816406 622.667969 L 551.816406 620.417969 M 552.566406 624.917969 L 552.566406 627.167969 L 551.816406 627.167969 L 551.816406 624.917969 M 552.566406 629.414063 L 552.566406 631.664063 L 551.816406 631.664063 L 551.816406 629.414063 M 552.566406 633.914063 L 552.566406 636.164063 L 551.816406 636.164063 L 551.816406 633.914063 M 552.566406 638.414063 L 552.566406 640.660156 L 551.816406 640.660156 L 551.816406 638.414063 M 552.566406 642.910156 L 552.566406 645.160156 L 551.816406 645.160156 L 551.816406 642.910156 M 552.566406 647.410156 L 552.566406 649.660156 L 551.816406 649.660156 L 551.816406 647.410156 M 552.566406 651.90625 L 552.566406 654.15625 L 551.816406 654.15625 L 551.816406 651.90625 M 552.566406 656.40625 L 552.566406 658.65625 L 551.816406 658.65625 L 551.816406 656.40625 M 552.566406 660.90625 L 552.566406 663.15625 L 551.816406 663.15625 L 551.816406 660.90625 M 552.566406 665.402344 L 552.566406 667.652344 L 551.816406 667.652344 L 551.816406 665.402344 M 552.566406 669.902344 L 552.566406 672.152344 L 551.816406 672.152344 L 551.816406 669.902344 M 552.566406 674.402344 L 552.566406 676.648438 L 551.816406 676.648438 L 551.816406 674.402344 M 552.566406 678.898438 L 552.566406 681.148438 L 551.816406 681.148438 L 551.816406 678.898438 M 552.566406 683.398438 L 552.566406 685.648438 L 551.816406 685.648438 L 551.816406 683.398438 M 552.566406 687.894531 L 552.566406 690.144531 L 551.816406 690.144531 L 551.816406 687.894531 M 552.566406 692.394531 L 552.566406 694.644531 L 551.816406 694.644531 L 551.816406 692.394531 M 552.566406 696.894531 L 552.566406 699.140625 L 551.816406 699.140625 L 551.816406 696.894531 M 552.566406 701.390625 L 552.566406 703.640625 L 551.816406 703.640625 L 551.816406 701.390625 M 552.566406 705.890625 L 552.566406 708.140625 L 551.816406 708.140625 L 551.816406 705.890625 M 552.566406 710.390625 L 552.566406 712.636719 L 551.816406 712.636719 L 551.816406 710.390625 M 552.566406 714.886719 L 552.566406 717.136719 L 551.816406 717.136719 L 551.816406 714.886719 M 552.566406 719.386719 L 552.566406 721.636719 L 551.816406 721.636719 L 551.816406 719.386719 M 552.566406 723.882813 L 552.566406 726.132813 L 551.816406 726.132813 L 551.816406 723.882813 M 552.566406 728.382813 L 552.566406 730.632813 L 551.816406 730.632813 L 551.816406 728.382813 M 552.566406 732.882813 L 552.566406 735.128906 L 551.816406 735.128906 L 551.816406 732.882813 M 552.566406 737.378906 L 552.566406 739.628906 L 551.816406 739.628906 L 551.816406 737.378906 M 552.566406 741.878906 L 552.566406 744.128906 L 551.816406 744.128906 L 551.816406 741.878906 M 552.566406 746.375 L 552.566406 748.625 L 551.816406 748.625 L 551.816406 746.375 M 552.566406 750.875 L 552.566406 753.125 L 551.816406 753.125 L 551.816406 750.875 M 552.566406 755.375 L 552.566406 757.621094 L 551.816406 757.621094 L 551.816406 755.375 M 552.566406 759.871094 L 552.566406 762.121094 L 551.816406 762.121094 L 551.816406 759.871094 M 552.566406 764.371094 L 552.566406 766.621094 L 551.816406 766.621094 L 551.816406 764.371094 M 552.566406 768.871094 L 552.566406 771.117188 L 551.816406 771.117188 L 551.816406 768.871094 M 552.566406 773.367188 L 552.566406 775.617188 L 551.816406 775.617188 L 551.816406 773.367188 M 552.566406 777.867188 L 552.566406 780.117188 L 551.816406 780.117188 L 551.816406 777.867188 M 552.566406 782.363281 L 552.566406 784.613281 L 551.816406 784.613281 L 551.816406 782.363281 M 552.566406 786.863281 L 552.566406 789.113281 L 551.816406 789.113281 L 551.816406 786.863281 M 552.566406 791.363281 L 552.566406 793.609375 L 551.816406 793.609375 L 551.816406 791.363281 M 552.566406 795.859375 L 552.566406 798.109375 L 551.816406 798.109375 L 551.816406 795.859375 M 552.566406 800.359375 L 552.566406 802.609375 L 551.816406 802.609375 L 551.816406 800.359375 M 552.566406 804.855469 L 552.566406 807.105469 L 551.816406 807.105469 L 551.816406 804.855469 M 552.566406 809.355469 L 552.566406 811.605469 L 551.816406 811.605469 L 551.816406 809.355469 M 552.566406 813.855469 L 552.566406 816.105469 L 551.816406 816.105469 L 551.816406 813.855469 M 552.566406 818.351563 L 552.566406 820.601563 L 551.816406 820.601563 L 551.816406 818.351563 M 552.566406 822.851563 L 552.566406 825.101563 L 551.816406 825.101563 L 551.816406 822.851563 M 552.566406 827.351563 L 552.566406 829.597656 L 551.816406 829.597656 L 551.816406 827.351563 M 552.566406 831.847656 L 552.566406 834.097656 L 551.816406 834.097656 L 551.816406 831.847656 M 552.566406 836.347656 L 552.566406 838.597656 L 551.816406 838.597656 L 551.816406 836.347656 M 552.566406 840.84375 L 552.566406 843.09375 L 551.816406 843.09375 L 551.816406 840.84375 M 552.566406 845.34375 L 552.566406 847.59375 L 551.816406 847.59375 L 551.816406 845.34375 M 552.566406 849.84375 L 552.566406 852.089844 L 551.816406 852.089844 L 551.816406 849.84375 M 552.566406 854.339844 L 552.566406 856.589844 L 551.816406 856.589844 L 551.816406 854.339844 M 552.566406 858.839844 L 552.566406 861.089844 L 551.816406 861.089844 L 551.816406 858.839844 M 552.566406 863.335938 L 552.566406 865.585938 L 551.816406 865.585938 L 551.816406 863.335938 M 552.566406 867.835938 L 552.566406 870.085938 L 551.816406 870.085938 L 551.816406 867.835938 M 552.566406 872.335938 L 552.566406 874.585938 L 551.816406 874.585938 L 551.816406 872.335938 M 552.566406 876.832031 L 552.566406 879.082031 L 551.816406 879.082031 L 551.816406 876.832031 M 552.566406 881.332031 L 552.566406 883.582031 L 551.816406 883.582031 L 551.816406 881.332031 M 552.566406 885.832031 L 552.566406 888.078125 L 551.816406 888.078125 L 551.816406 885.832031 M 552.566406 890.328125 L 552.566406 892.578125 L 551.816406 892.578125 L 551.816406 890.328125 M 552.566406 894.828125 L 552.566406 897.078125 L 551.816406 897.078125 L 551.816406 894.828125 M 552.566406 899.324219 L 552.566406 901.574219 L 551.816406 901.574219 L 551.816406 899.324219 M 552.566406 903.824219 L 552.566406 906.074219 L 551.816406 906.074219 L 551.816406 903.824219 M 552.566406 908.324219 L 552.566406 910.570313 L 551.816406 910.570313 L 551.816406 908.324219 M 552.566406 912.820313 L 552.566406 915.070313 L 551.816406 915.070313 L 551.816406 912.820313 M 552.566406 917.320313 L 552.566406 919.570313 L 551.816406 919.570313 L 551.816406 917.320313 M 552.566406 921.820313 L 552.566406 924.066406 L 551.816406 924.066406 L 551.816406 921.820313 M 552.566406 926.316406 L 552.566406 928.566406 L 551.816406 928.566406 L 551.816406 926.316406 M 552.566406 930.816406 L 552.566406 933.066406 L 551.816406 933.066406 L 551.816406 930.816406 M 552.566406 935.3125 L 552.566406 937.5625 L 551.816406 937.5625 L 551.816406 935.3125 M 552.566406 939.8125 L 552.566406 942.0625 L 551.816406 942.0625 L 551.816406 939.8125 M 552.566406 944.3125 L 552.566406 946.558594 L 551.816406 946.558594 L 551.816406 944.3125 M 552.566406 948.808594 L 552.566406 951.058594 L 551.816406 951.058594 L 551.816406 948.808594 M 552.566406 953.308594 L 552.566406 955.558594 L 551.816406 955.558594 L 551.816406 953.308594 M 552.566406 957.804688 L 552.566406 960.054688 L 551.816406 960.054688 L 551.816406 957.804688 M 552.566406 962.304688 L 552.566406 964.554688 L 551.816406 964.554688 L 551.816406 962.304688 M 552.566406 966.804688 L 552.566406 969.050781 L 551.816406 969.050781 L 551.816406 966.804688 M 552.566406 971.300781 L 552.566406 973.550781 L 551.816406 973.550781 L 551.816406 971.300781 M 552.566406 975.800781 L 552.566406 978.050781 L 551.816406 978.050781 L 551.816406 975.800781 M 552.566406 980.300781 L 552.566406 982.546875 L 551.816406 982.546875 L 551.816406 980.300781 M 552.566406 984.796875 L 552.566406 987.046875 L 551.816406 987.046875 L 551.816406 984.796875 M 552.566406 989.296875 L 552.566406 991.546875 L 551.816406 991.546875 L 551.816406 989.296875 M 552.566406 993.792969 L 552.566406 996.042969 L 551.816406 996.042969 L 551.816406 993.792969 M 552.566406 998.292969 L 552.566406 1000.542969 L 551.816406 1000.542969 L 551.816406 998.292969 M 552.566406 1002.792969 L 552.566406 1005.039063 L 551.816406 1005.039063 L 551.816406 1002.792969 M 552.566406 1007.289063 L 552.566406 1009.539063 L 551.816406 1009.539063 L 551.816406 1007.289063 M 552.566406 1011.789063 L 552.566406 1014.039063 L 551.816406 1014.039063 L 551.816406 1011.789063 M 552.566406 1016.285156 L 552.566406 1018.535156 L 551.816406 1018.535156 L 551.816406 1016.285156 M 552.566406 1020.785156 L 552.566406 1023.035156 L 551.816406 1023.035156 L 551.816406 1020.785156 M 552.566406 1025.285156 L 552.566406 1027.535156 L 551.816406 1027.535156 L 551.816406 1025.285156 M 552.566406 1029.78125 L 552.566406 1032.03125 L 551.816406 1032.03125 L 551.816406 1029.78125 M 552.566406 1034.28125 L 552.566406 1036.53125 L 551.816406 1036.53125 L 551.816406 1034.28125 M 552.566406 1038.78125 L 552.566406 1041.027344 L 551.816406 1041.027344 L 551.816406 1038.78125 M 552.566406 1043.277344 L 552.566406 1045.527344 L 551.816406 1045.527344 L 551.816406 1043.277344 M 552.566406 1047.777344 L 552.566406 1050.027344 L 551.816406 1050.027344 L 551.816406 1047.777344 M 552.566406 1052.273438 L 552.566406 1054.523438 L 551.816406 1054.523438 L 551.816406 1052.273438 M 552.566406 1056.773438 L 552.566406 1059.023438 L 551.816406 1059.023438 L 551.816406 1056.773438 M 552.566406 1061.273438 L 552.566406 1063.519531 L 551.816406 1063.519531 L 551.816406 1061.273438 M 552.566406 1065.769531 L 552.566406 1068.019531 L 551.816406 1068.019531 L 551.816406 1065.769531 M 552.566406 1070.269531 L 552.566406 1072.519531 L 551.816406 1072.519531 L 551.816406 1070.269531 M 552.566406 1074.765625 L 552.566406 1077.015625 L 551.816406 1077.015625 L 551.816406 1074.765625 M 552.566406 1079.265625 L 552.566406 1081.515625 L 551.816406 1081.515625 L 551.816406 1079.265625 M 552.566406 1083.765625 L 552.566406 1086.015625 L 551.816406 1086.015625 L 551.816406 1083.765625 M 552.566406 1088.261719 L 552.566406 1090.511719 L 551.816406 1090.511719 L 551.816406 1088.261719 M 552.566406 1092.761719 L 552.566406 1095.011719 L 551.816406 1095.011719 L 551.816406 1092.761719 M 552.566406 1097.261719 L 552.566406 1099.507813 L 551.816406 1099.507813 L 551.816406 1097.261719 M 552.566406 1101.757813 L 552.566406 1104.007813 L 551.816406 1104.007813 L 551.816406 1101.757813 M 552.566406 1106.257813 L 552.566406 1108.507813 L 551.816406 1108.507813 L 551.816406 1106.257813 M 552.566406 1110.753906 L 552.566406 1113.003906 L 551.816406 1113.003906 L 551.816406 1110.753906 M 552.566406 1115.253906 L 552.566406 1117.503906 L 551.816406 1117.503906 L 551.816406 1115.253906 M 552.566406 1119.753906 L 552.566406 1122 L 551.816406 1122 L 551.816406 1119.753906 M 552.566406 1124.25 L 552.566406 1126.5 L 551.816406 1126.5 L 551.816406 1124.25 M 552.566406 1128.75 L 552.566406 1131 L 551.816406 1131 L 551.816406 1128.75 M 552.566406 1133.25 L 552.566406 1135.496094 L 551.816406 1135.496094 L 551.816406 1133.25 M 552.566406 1137.746094 L 552.566406 1139.996094 L 551.816406 1139.996094 L 551.816406 1137.746094 "
+     id="path1004" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1032">
+    <use
+       xlink:href="#glyph-0-12"
+       x="522.56451"
+       y="18.743767"
+       id="use1006" />
+    <use
+       xlink:href="#glyph-0-13"
+       x="529.56268"
+       y="18.743767"
+       id="use1008" />
+    <use
+       xlink:href="#glyph-0-14"
+       x="532.06232"
+       y="18.743767"
+       id="use1010" />
+    <use
+       xlink:href="#glyph-0-10"
+       x="538.55969"
+       y="18.743767"
+       id="use1012" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="545.05701"
+       y="18.743767"
+       id="use1014" />
+    <use
+       xlink:href="#glyph-0-15"
+       x="547.5567"
+       y="18.743767"
+       id="use1016" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="553.55762"
+       y="18.743767"
+       id="use1018" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="556.55371"
+       y="18.743767"
+       id="use1020" />
+    <use
+       xlink:href="#glyph-0-16"
+       x="561.55737"
+       y="18.743767"
+       id="use1022" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="566.05591"
+       y="18.743767"
+       id="use1024" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="568.05475"
+       y="18.743767"
+       id="use1026" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="573.05847"
+       y="18.743767"
+       id="use1028" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="578.06213"
+       y="18.743767"
+       id="use1030" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 150.221984 70.997728 L 473.131421 70.997728 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1034" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 478.377957 70.997728 L 471.380839 74.498892 L 473.131421 70.997728 L 471.380839 67.501774 Z M 478.377957 70.997728 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1036" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     d="M 157.449219 41.984375 L 281.15625 41.984375 L 281.15625 51.734375 L 157.449219 51.734375 Z M 157.449219 41.984375 "
+     id="path1038" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1046">
+    <use
+       xlink:href="#glyph-1-19"
+       x="157.72879"
+       y="49.483543"
+       id="use1040" />
+    <use
+       xlink:href="#glyph-1-20"
+       x="164.14377"
+       y="49.483543"
+       id="use1042" />
+    <use
+       xlink:href="#glyph-1-21"
+       x="169.64464"
+       y="49.483543"
+       id="use1044" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1050">
+    <use
+       xlink:href="#glyph-1-5"
+       x="174.53339"
+       y="49.483543"
+       id="use1048" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1078">
+    <use
+       xlink:href="#glyph-1-22"
+       x="176.82474"
+       y="49.483543"
+       id="use1052" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="181.41147"
+       y="49.483543"
+       id="use1054" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="183.70282"
+       y="49.483543"
+       id="use1056" />
+    <use
+       xlink:href="#glyph-1-24"
+       x="185.99417"
+       y="49.483543"
+       id="use1058" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="190.5809"
+       y="49.483543"
+       id="use1060" />
+    <use
+       xlink:href="#glyph-1-25"
+       x="194.70453"
+       y="49.483543"
+       id="use1062" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="196.99588"
+       y="49.483543"
+       id="use1064" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="199.28723"
+       y="49.483543"
+       id="use1066" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="201.5786"
+       y="49.483543"
+       id="use1068" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="205.70222"
+       y="49.483543"
+       id="use1070" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="210.28896"
+       y="49.483543"
+       id="use1072" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="214.87569"
+       y="49.483543"
+       id="use1074" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="219.46242"
+       y="49.483543"
+       id="use1076" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1114">
+    <use
+       xlink:href="#glyph-1-28"
+       x="221.75377"
+       y="49.483543"
+       id="use1080" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="224.04512"
+       y="49.483543"
+       id="use1082" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="228.16875"
+       y="49.483543"
+       id="use1084" />
+    <use
+       xlink:href="#glyph-1-29"
+       x="232.75548"
+       y="49.483543"
+       id="use1086" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="239.6255"
+       y="49.483543"
+       id="use1088" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="241.91685"
+       y="49.483543"
+       id="use1090" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="244.20821"
+       y="49.483543"
+       id="use1092" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="246.49956"
+       y="49.483543"
+       id="use1094" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="248.79092"
+       y="49.483543"
+       id="use1096" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="251.08228"
+       y="49.483543"
+       id="use1098" />
+    <use
+       xlink:href="#glyph-1-30"
+       x="255.2059"
+       y="49.483543"
+       id="use1100" />
+    <use
+       xlink:href="#glyph-1-7"
+       x="259.79263"
+       y="49.483543"
+       id="use1102" />
+    <use
+       xlink:href="#glyph-1-7"
+       x="261.62491"
+       y="49.483543"
+       id="use1104" />
+    <use
+       xlink:href="#glyph-1-31"
+       x="263.45718"
+       y="49.483543"
+       id="use1106" />
+    <use
+       xlink:href="#glyph-1-30"
+       x="268.04391"
+       y="49.483543"
+       id="use1108" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="272.63065"
+       y="49.483543"
+       id="use1110" />
+    <use
+       xlink:href="#glyph-1-9"
+       x="276.75427"
+       y="49.483543"
+       id="use1112" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 479.498121 105.998948 L 156.182299 105.998948 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1116" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 150.930553 105.998948 L 157.92767 102.497784 L 156.182299 105.998948 L 157.92767 109.500112 Z M 150.930553 105.998948 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1118" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     d="M 220.425781 68.226563 L 267.660156 68.226563 L 267.660156 77.972656 L 220.425781 77.972656 Z M 220.425781 68.226563 "
+     id="path1120" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1146">
+    <use
+       xlink:href="#glyph-1-32"
+       x="220.661"
+       y="75.724815"
+       id="use1122" />
+    <use
+       xlink:href="#glyph-1-33"
+       x="225.24773"
+       y="75.724815"
+       id="use1124" />
+    <use
+       xlink:href="#glyph-1-34"
+       x="229.83446"
+       y="75.724815"
+       id="use1126" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="234.42119"
+       y="75.724815"
+       id="use1128" />
+    <use
+       xlink:href="#glyph-1-35"
+       x="236.71254"
+       y="75.724815"
+       id="use1130" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="242.66844"
+       y="75.724815"
+       id="use1132" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="247.25517"
+       y="75.724815"
+       id="use1134" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="251.8419"
+       y="75.724815"
+       id="use1136" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="253.67418"
+       y="75.724815"
+       id="use1138" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="256.42059"
+       y="75.724815"
+       id="use1140" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="261.00732"
+       y="75.724815"
+       id="use1142" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="265.13095"
+       y="75.724815"
+       id="use1144" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 169.999392 116.002274 L 470.000171 116.002274 L 470.000171 185.999503 L 169.999392 185.999503 Z M 169.999392 116.002274 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1148" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1230">
+    <use
+       xlink:href="#glyph-2-1"
+       x="138.68044"
+       y="97.467583"
+       id="use1150" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="143.17967"
+       y="97.467583"
+       id="use1152" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="147.67891"
+       y="97.467583"
+       id="use1154" />
+    <use
+       xlink:href="#glyph-2-3"
+       x="152.17815"
+       y="97.467583"
+       id="use1156" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="156.67738"
+       y="97.467583"
+       id="use1158" />
+    <use
+       xlink:href="#glyph-2-5"
+       x="161.17662"
+       y="97.467583"
+       id="use1160" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="165.67586"
+       y="97.467583"
+       id="use1162" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="170.17509"
+       y="97.467583"
+       id="use1164" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="174.67433"
+       y="97.467583"
+       id="use1166" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="179.17357"
+       y="97.467583"
+       id="use1168" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="183.67281"
+       y="97.467583"
+       id="use1170" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="188.17204"
+       y="97.467583"
+       id="use1172" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="192.67128"
+       y="97.467583"
+       id="use1174" />
+    <use
+       xlink:href="#glyph-2-3"
+       x="197.17052"
+       y="97.467583"
+       id="use1176" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="201.66975"
+       y="97.467583"
+       id="use1178" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="206.16899"
+       y="97.467583"
+       id="use1180" />
+    <use
+       xlink:href="#glyph-2-13"
+       x="210.66821"
+       y="97.467583"
+       id="use1182" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="215.16745"
+       y="97.467583"
+       id="use1184" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="219.66669"
+       y="97.467583"
+       id="use1186" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="224.16592"
+       y="97.467583"
+       id="use1188" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="228.66516"
+       y="97.467583"
+       id="use1190" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="233.1644"
+       y="97.467583"
+       id="use1192" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="237.66364"
+       y="97.467583"
+       id="use1194" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="242.16287"
+       y="97.467583"
+       id="use1196" />
+    <use
+       xlink:href="#glyph-2-15"
+       x="246.66211"
+       y="97.467583"
+       id="use1198" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="251.16135"
+       y="97.467583"
+       id="use1200" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="255.66058"
+       y="97.467583"
+       id="use1202" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="260.15982"
+       y="97.467583"
+       id="use1204" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="264.65906"
+       y="97.467583"
+       id="use1206" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="269.15829"
+       y="97.467583"
+       id="use1208" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="273.65753"
+       y="97.467583"
+       id="use1210" />
+    <use
+       xlink:href="#glyph-2-17"
+       x="278.15677"
+       y="97.467583"
+       id="use1212" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="282.65601"
+       y="97.467583"
+       id="use1214" />
+    <use
+       xlink:href="#glyph-2-1"
+       x="287.15524"
+       y="97.467583"
+       id="use1216" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="291.65448"
+       y="97.467583"
+       id="use1218" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="296.15372"
+       y="97.467583"
+       id="use1220" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="300.65295"
+       y="97.467583"
+       id="use1222" />
+    <use
+       xlink:href="#glyph-2-18"
+       x="305.15219"
+       y="97.467583"
+       id="use1224" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="309.65143"
+       y="97.467583"
+       id="use1226" />
+    <use
+       xlink:href="#glyph-2-19"
+       x="314.15067"
+       y="97.467583"
+       id="use1228" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1234">
+    <use
+       xlink:href="#glyph-2-20"
+       x="138.68044"
+       y="107.21434"
+       id="use1232" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1290">
+    <use
+       xlink:href="#glyph-2-10"
+       x="143.17967"
+       y="107.21434"
+       id="use1236" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="147.67891"
+       y="107.21434"
+       id="use1238" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="152.17815"
+       y="107.21434"
+       id="use1240" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="156.67738"
+       y="107.21434"
+       id="use1242" />
+    <use
+       xlink:href="#glyph-2-22"
+       x="161.17662"
+       y="107.21434"
+       id="use1244" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="165.67586"
+       y="107.21434"
+       id="use1246" />
+    <use
+       xlink:href="#glyph-2-23"
+       x="170.17509"
+       y="107.21434"
+       id="use1248" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="174.67433"
+       y="107.21434"
+       id="use1250" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="179.17357"
+       y="107.21434"
+       id="use1252" />
+    <use
+       xlink:href="#glyph-2-24"
+       x="183.67281"
+       y="107.21434"
+       id="use1254" />
+    <use
+       xlink:href="#glyph-2-25"
+       x="188.17204"
+       y="107.21434"
+       id="use1256" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="192.67128"
+       y="107.21434"
+       id="use1258" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="197.17052"
+       y="107.21434"
+       id="use1260" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="201.66975"
+       y="107.21434"
+       id="use1262" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="206.16899"
+       y="107.21434"
+       id="use1264" />
+    <use
+       xlink:href="#glyph-2-23"
+       x="210.66821"
+       y="107.21434"
+       id="use1266" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="215.16745"
+       y="107.21434"
+       id="use1268" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="219.66669"
+       y="107.21434"
+       id="use1270" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="224.16592"
+       y="107.21434"
+       id="use1272" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="228.66516"
+       y="107.21434"
+       id="use1274" />
+    <use
+       xlink:href="#glyph-2-22"
+       x="233.1644"
+       y="107.21434"
+       id="use1276" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="237.66364"
+       y="107.21434"
+       id="use1278" />
+    <use
+       xlink:href="#glyph-2-23"
+       x="242.16287"
+       y="107.21434"
+       id="use1280" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="246.66211"
+       y="107.21434"
+       id="use1282" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="251.16135"
+       y="107.21434"
+       id="use1284" />
+    <use
+       xlink:href="#glyph-2-26"
+       x="255.66058"
+       y="107.21434"
+       id="use1286" />
+    <use
+       xlink:href="#glyph-2-27"
+       x="260.15982"
+       y="107.21434"
+       id="use1288" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1294">
+    <use
+       xlink:href="#glyph-2-20"
+       x="138.68044"
+       y="116.21135"
+       id="use1292" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1384">
+    <use
+       xlink:href="#glyph-2-12"
+       x="143.17967"
+       y="116.21135"
+       id="use1296" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="147.67891"
+       y="116.21135"
+       id="use1298" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="152.17815"
+       y="116.21135"
+       id="use1300" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="156.67738"
+       y="116.21135"
+       id="use1302" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="161.17662"
+       y="116.21135"
+       id="use1304" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="165.67586"
+       y="116.21135"
+       id="use1306" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="170.17509"
+       y="116.21135"
+       id="use1308" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="174.67433"
+       y="116.21135"
+       id="use1310" />
+    <use
+       xlink:href="#glyph-2-23"
+       x="179.17357"
+       y="116.21135"
+       id="use1312" />
+    <use
+       xlink:href="#glyph-2-17"
+       x="183.67281"
+       y="116.21135"
+       id="use1314" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="188.17204"
+       y="116.21135"
+       id="use1316" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="192.67128"
+       y="116.21135"
+       id="use1318" />
+    <use
+       xlink:href="#glyph-2-24"
+       x="197.17052"
+       y="116.21135"
+       id="use1320" />
+    <use
+       xlink:href="#glyph-2-1"
+       x="201.66975"
+       y="116.21135"
+       id="use1322" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="206.16899"
+       y="116.21135"
+       id="use1324" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="210.66821"
+       y="116.21135"
+       id="use1326" />
+    <use
+       xlink:href="#glyph-2-3"
+       x="215.16745"
+       y="116.21135"
+       id="use1328" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="219.66669"
+       y="116.21135"
+       id="use1330" />
+    <use
+       xlink:href="#glyph-2-5"
+       x="224.16592"
+       y="116.21135"
+       id="use1332" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="228.66516"
+       y="116.21135"
+       id="use1334" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="233.1644"
+       y="116.21135"
+       id="use1336" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="237.66364"
+       y="116.21135"
+       id="use1338" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="242.16287"
+       y="116.21135"
+       id="use1340" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="246.66211"
+       y="116.21135"
+       id="use1342" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="251.16135"
+       y="116.21135"
+       id="use1344" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="255.66058"
+       y="116.21135"
+       id="use1346" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="260.15982"
+       y="116.21135"
+       id="use1348" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="264.65906"
+       y="116.21135"
+       id="use1350" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="269.15829"
+       y="116.21135"
+       id="use1352" />
+    <use
+       xlink:href="#glyph-2-15"
+       x="273.65753"
+       y="116.21135"
+       id="use1354" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="278.15677"
+       y="116.21135"
+       id="use1356" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="282.65601"
+       y="116.21135"
+       id="use1358" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="287.15524"
+       y="116.21135"
+       id="use1360" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="291.65448"
+       y="116.21135"
+       id="use1362" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="296.15372"
+       y="116.21135"
+       id="use1364" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="300.65295"
+       y="116.21135"
+       id="use1366" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="305.15219"
+       y="116.21135"
+       id="use1368" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="309.65143"
+       y="116.21135"
+       id="use1370" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="314.15067"
+       y="116.21135"
+       id="use1372" />
+    <use
+       xlink:href="#glyph-2-28"
+       x="318.6499"
+       y="116.21135"
+       id="use1374" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="323.14911"
+       y="116.21135"
+       id="use1376" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="327.64835"
+       y="116.21135"
+       id="use1378" />
+    <use
+       xlink:href="#glyph-2-29"
+       x="332.14758"
+       y="116.21135"
+       id="use1380" />
+    <use
+       xlink:href="#glyph-2-27"
+       x="336.64682"
+       y="116.21135"
+       id="use1382" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1388">
+    <use
+       xlink:href="#glyph-2-20"
+       x="138.68044"
+       y="125.20836"
+       id="use1386" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1402">
+    <use
+       xlink:href="#glyph-2-4"
+       x="143.17967"
+       y="125.20836"
+       id="use1390" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="147.67891"
+       y="125.20836"
+       id="use1392" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="152.17815"
+       y="125.20836"
+       id="use1394" />
+    <use
+       xlink:href="#glyph-2-3"
+       x="156.67738"
+       y="125.20836"
+       id="use1396" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="161.17662"
+       y="125.20836"
+       id="use1398" />
+    <use
+       xlink:href="#glyph-2-24"
+       x="165.67586"
+       y="125.20836"
+       id="use1400" />
+  </g>
+  <g
+     fill="#0080f0"
+     fill-opacity="1"
+     id="g1444">
+    <use
+       xlink:href="#glyph-3-1"
+       x="170.18169"
+       y="125.20836"
+       id="use1404" />
+    <use
+       xlink:href="#glyph-3-2"
+       x="174.68092"
+       y="125.20836"
+       id="use1406" />
+    <use
+       xlink:href="#glyph-3-3"
+       x="179.18016"
+       y="125.20836"
+       id="use1408" />
+    <use
+       xlink:href="#glyph-3-4"
+       x="183.6794"
+       y="125.20836"
+       id="use1410" />
+    <use
+       xlink:href="#glyph-3-5"
+       x="188.17863"
+       y="125.20836"
+       id="use1412" />
+    <use
+       xlink:href="#glyph-3-6"
+       x="192.67787"
+       y="125.20836"
+       id="use1414" />
+    <use
+       xlink:href="#glyph-3-7"
+       x="197.17711"
+       y="125.20836"
+       id="use1416" />
+    <use
+       xlink:href="#glyph-3-2"
+       x="201.67635"
+       y="125.20836"
+       id="use1418" />
+    <use
+       xlink:href="#glyph-3-8"
+       x="206.17558"
+       y="125.20836"
+       id="use1420" />
+    <use
+       xlink:href="#glyph-3-1"
+       x="210.67482"
+       y="125.20836"
+       id="use1422" />
+    <use
+       xlink:href="#glyph-3-9"
+       x="215.17404"
+       y="125.20836"
+       id="use1424" />
+    <use
+       xlink:href="#glyph-3-5"
+       x="219.67328"
+       y="125.20836"
+       id="use1426" />
+    <use
+       xlink:href="#glyph-3-10"
+       x="224.17252"
+       y="125.20836"
+       id="use1428" />
+    <use
+       xlink:href="#glyph-3-3"
+       x="228.67175"
+       y="125.20836"
+       id="use1430" />
+    <use
+       xlink:href="#glyph-3-7"
+       x="233.17099"
+       y="125.20836"
+       id="use1432" />
+    <use
+       xlink:href="#glyph-3-3"
+       x="237.67023"
+       y="125.20836"
+       id="use1434" />
+    <use
+       xlink:href="#glyph-3-11"
+       x="242.16946"
+       y="125.20836"
+       id="use1436" />
+    <use
+       xlink:href="#glyph-3-12"
+       x="246.6687"
+       y="125.20836"
+       id="use1438" />
+    <use
+       xlink:href="#glyph-3-5"
+       x="251.16794"
+       y="125.20836"
+       id="use1440" />
+    <use
+       xlink:href="#glyph-3-10"
+       x="255.66718"
+       y="125.20836"
+       id="use1442" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1448">
+    <use
+       xlink:href="#glyph-2-27"
+       x="260.1752"
+       y="125.20836"
+       id="use1446" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1452">
+    <use
+       xlink:href="#glyph-2-20"
+       x="138.68044"
+       y="134.20537"
+       id="use1450" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1496">
+    <use
+       xlink:href="#glyph-2-4"
+       x="143.17967"
+       y="134.20537"
+       id="use1454" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="147.67891"
+       y="134.20537"
+       id="use1456" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="152.17815"
+       y="134.20537"
+       id="use1458" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="156.67738"
+       y="134.20537"
+       id="use1460" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="161.17662"
+       y="134.20537"
+       id="use1462" />
+    <use
+       xlink:href="#glyph-2-24"
+       x="165.67586"
+       y="134.20537"
+       id="use1464" />
+    <use
+       xlink:href="#glyph-2-25"
+       x="170.17509"
+       y="134.20537"
+       id="use1466" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="174.67433"
+       y="134.20537"
+       id="use1468" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="179.17357"
+       y="134.20537"
+       id="use1470" />
+    <use
+       xlink:href="#glyph-2-22"
+       x="183.67281"
+       y="134.20537"
+       id="use1472" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="188.17204"
+       y="134.20537"
+       id="use1474" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="192.67128"
+       y="134.20537"
+       id="use1476" />
+    <use
+       xlink:href="#glyph-2-15"
+       x="197.17052"
+       y="134.20537"
+       id="use1478" />
+    <use
+       xlink:href="#glyph-2-23"
+       x="201.66975"
+       y="134.20537"
+       id="use1480" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="206.16899"
+       y="134.20537"
+       id="use1482" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="210.66821"
+       y="134.20537"
+       id="use1484" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="215.16745"
+       y="134.20537"
+       id="use1486" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="219.66669"
+       y="134.20537"
+       id="use1488" />
+    <use
+       xlink:href="#glyph-2-22"
+       x="224.16592"
+       y="134.20537"
+       id="use1490" />
+    <use
+       xlink:href="#glyph-2-30"
+       x="228.66516"
+       y="134.20537"
+       id="use1492" />
+    <use
+       xlink:href="#glyph-2-26"
+       x="233.1644"
+       y="134.20537"
+       id="use1494" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 320.002387 116.002274 L 320.002387 105.998948 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1498" />
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 735.499897 330.000502 L 156.30213 330.000502 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1500" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 151.050384 330.000502 L 158.047502 326.499338 L 156.30213 330.000502 L 158.047502 333.501666 Z M 151.050384 330.000502 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1502" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     d="M 269.910156 237.671875 L 317.144531 237.671875 L 317.144531 247.417969 L 269.910156 247.417969 Z M 269.910156 237.671875 "
+     id="path1504" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1530">
+    <use
+       xlink:href="#glyph-1-32"
+       x="270.14453"
+       y="245.16847"
+       id="use1506" />
+    <use
+       xlink:href="#glyph-1-33"
+       x="274.73126"
+       y="245.16847"
+       id="use1508" />
+    <use
+       xlink:href="#glyph-1-36"
+       x="279.31799"
+       y="245.16847"
+       id="use1510" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="283.90472"
+       y="245.16847"
+       id="use1512" />
+    <use
+       xlink:href="#glyph-1-35"
+       x="286.19608"
+       y="245.16847"
+       id="use1514" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="292.15198"
+       y="245.16847"
+       id="use1516" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="296.73871"
+       y="245.16847"
+       id="use1518" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="301.32544"
+       y="245.16847"
+       id="use1520" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="303.15771"
+       y="245.16847"
+       id="use1522" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="305.90411"
+       y="245.16847"
+       id="use1524" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="310.49084"
+       y="245.16847"
+       id="use1526" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="314.61447"
+       y="245.16847"
+       id="use1528" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 190.000833 342.999616 L 470.000171 342.999616 L 470.000171 393.000614 L 190.000833 393.000614 Z M 190.000833 342.999616 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1532" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1536">
+    <use
+       xlink:href="#glyph-2-20"
+       x="143.95213"
+       y="269.16049"
+       id="use1534" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1602">
+    <use
+       xlink:href="#glyph-2-20"
+       x="148.45135"
+       y="269.16049"
+       id="use1538" />
+    <use
+       xlink:href="#glyph-2-1"
+       x="152.95059"
+       y="269.16049"
+       id="use1540" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="157.44983"
+       y="269.16049"
+       id="use1542" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="161.94907"
+       y="269.16049"
+       id="use1544" />
+    <use
+       xlink:href="#glyph-2-3"
+       x="166.4483"
+       y="269.16049"
+       id="use1546" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="170.94754"
+       y="269.16049"
+       id="use1548" />
+    <use
+       xlink:href="#glyph-2-5"
+       x="175.44678"
+       y="269.16049"
+       id="use1550" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="179.94601"
+       y="269.16049"
+       id="use1552" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="184.44525"
+       y="269.16049"
+       id="use1554" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="188.94449"
+       y="269.16049"
+       id="use1556" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="193.44373"
+       y="269.16049"
+       id="use1558" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="197.94296"
+       y="269.16049"
+       id="use1560" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="202.4422"
+       y="269.16049"
+       id="use1562" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="206.94144"
+       y="269.16049"
+       id="use1564" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="211.44067"
+       y="269.16049"
+       id="use1566" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="215.93991"
+       y="269.16049"
+       id="use1568" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="220.43915"
+       y="269.16049"
+       id="use1570" />
+    <use
+       xlink:href="#glyph-2-15"
+       x="224.93837"
+       y="269.16049"
+       id="use1572" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="229.43761"
+       y="269.16049"
+       id="use1574" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="233.93684"
+       y="269.16049"
+       id="use1576" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="238.43608"
+       y="269.16049"
+       id="use1578" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="242.93532"
+       y="269.16049"
+       id="use1580" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="247.43456"
+       y="269.16049"
+       id="use1582" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="251.93379"
+       y="269.16049"
+       id="use1584" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="256.43304"
+       y="269.16049"
+       id="use1586" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="260.93225"
+       y="269.16049"
+       id="use1588" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="265.43149"
+       y="269.16049"
+       id="use1590" />
+    <use
+       xlink:href="#glyph-2-28"
+       x="269.93073"
+       y="269.16049"
+       id="use1592" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="274.42996"
+       y="269.16049"
+       id="use1594" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="278.9292"
+       y="269.16049"
+       id="use1596" />
+    <use
+       xlink:href="#glyph-2-29"
+       x="283.42844"
+       y="269.16049"
+       id="use1598" />
+    <use
+       xlink:href="#glyph-2-19"
+       x="287.92767"
+       y="269.16049"
+       id="use1600" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1606">
+    <use
+       xlink:href="#glyph-2-20"
+       x="143.95213"
+       y="278.1575"
+       id="use1604" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1610">
+    <use
+       xlink:href="#glyph-2-20"
+       x="148.45135"
+       y="278.1575"
+       id="use1608" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1614">
+    <use
+       xlink:href="#glyph-2-20"
+       x="152.95059"
+       y="278.1575"
+       id="use1612" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1650">
+    <use
+       xlink:href="#glyph-2-10"
+       x="157.44983"
+       y="278.1575"
+       id="use1616" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="161.94907"
+       y="278.1575"
+       id="use1618" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="166.4483"
+       y="278.1575"
+       id="use1620" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="170.94754"
+       y="278.1575"
+       id="use1622" />
+    <use
+       xlink:href="#glyph-2-24"
+       x="175.44678"
+       y="278.1575"
+       id="use1624" />
+    <use
+       xlink:href="#glyph-2-25"
+       x="179.94601"
+       y="278.1575"
+       id="use1626" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="184.44525"
+       y="278.1575"
+       id="use1628" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="188.94449"
+       y="278.1575"
+       id="use1630" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="193.44373"
+       y="278.1575"
+       id="use1632" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="197.94296"
+       y="278.1575"
+       id="use1634" />
+    <use
+       xlink:href="#glyph-2-23"
+       x="202.4422"
+       y="278.1575"
+       id="use1636" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="206.94144"
+       y="278.1575"
+       id="use1638" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="211.44067"
+       y="278.1575"
+       id="use1640" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="215.93991"
+       y="278.1575"
+       id="use1642" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="220.43915"
+       y="278.1575"
+       id="use1644" />
+    <use
+       xlink:href="#glyph-2-26"
+       x="224.93837"
+       y="278.1575"
+       id="use1646" />
+    <use
+       xlink:href="#glyph-2-27"
+       x="229.43761"
+       y="278.1575"
+       id="use1648" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1654">
+    <use
+       xlink:href="#glyph-2-20"
+       x="143.95213"
+       y="287.15451"
+       id="use1652" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1658">
+    <use
+       xlink:href="#glyph-2-20"
+       x="148.45135"
+       y="287.15451"
+       id="use1656" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1662">
+    <use
+       xlink:href="#glyph-2-20"
+       x="152.95059"
+       y="287.15451"
+       id="use1660" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1704">
+    <use
+       xlink:href="#glyph-2-4"
+       x="157.44983"
+       y="287.15451"
+       id="use1664" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="161.94907"
+       y="287.15451"
+       id="use1666" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="166.4483"
+       y="287.15451"
+       id="use1668" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="170.94754"
+       y="287.15451"
+       id="use1670" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="175.44678"
+       y="287.15451"
+       id="use1672" />
+    <use
+       xlink:href="#glyph-2-24"
+       x="179.94601"
+       y="287.15451"
+       id="use1674" />
+    <use
+       xlink:href="#glyph-2-25"
+       x="184.44525"
+       y="287.15451"
+       id="use1676" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="188.94449"
+       y="287.15451"
+       id="use1678" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="193.44373"
+       y="287.15451"
+       id="use1680" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="197.94296"
+       y="287.15451"
+       id="use1682" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="202.4422"
+       y="287.15451"
+       id="use1684" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="206.94144"
+       y="287.15451"
+       id="use1686" />
+    <use
+       xlink:href="#glyph-2-23"
+       x="211.44067"
+       y="287.15451"
+       id="use1688" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="215.93991"
+       y="287.15451"
+       id="use1690" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="220.43915"
+       y="287.15451"
+       id="use1692" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="224.93837"
+       y="287.15451"
+       id="use1694" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="229.43761"
+       y="287.15451"
+       id="use1696" />
+    <use
+       xlink:href="#glyph-2-22"
+       x="233.93684"
+       y="287.15451"
+       id="use1698" />
+    <use
+       xlink:href="#glyph-2-30"
+       x="238.43608"
+       y="287.15451"
+       id="use1700" />
+    <use
+       xlink:href="#glyph-2-26"
+       x="242.93532"
+       y="287.15451"
+       id="use1702" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 149.93022 419.999173 L 473.131421 419.999173 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1706" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 478.377957 419.999173 L 471.380839 423.500337 L 473.131421 419.999173 L 471.380839 416.498009 Z M 478.377957 419.999173 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1708" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     d="M 135.703125 305.148438 L 329.890625 305.148438 L 329.890625 314.894531 L 135.703125 314.894531 Z M 135.703125 305.148438 "
+     id="path1710" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1718">
+    <use
+       xlink:href="#glyph-1-19"
+       x="135.45886"
+       y="312.64603"
+       id="use1712" />
+    <use
+       xlink:href="#glyph-1-20"
+       x="141.87384"
+       y="312.64603"
+       id="use1714" />
+    <use
+       xlink:href="#glyph-1-21"
+       x="147.37469"
+       y="312.64603"
+       id="use1716" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1748">
+    <use
+       xlink:href="#glyph-1-5"
+       x="152.26346"
+       y="312.64603"
+       id="use1720" />
+    <use
+       xlink:href="#glyph-1-22"
+       x="154.55481"
+       y="312.64603"
+       id="use1722" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="159.14154"
+       y="312.64603"
+       id="use1724" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="161.43289"
+       y="312.64603"
+       id="use1726" />
+    <use
+       xlink:href="#glyph-1-24"
+       x="163.72424"
+       y="312.64603"
+       id="use1728" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="168.31097"
+       y="312.64603"
+       id="use1730" />
+    <use
+       xlink:href="#glyph-1-25"
+       x="172.4346"
+       y="312.64603"
+       id="use1732" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="174.72595"
+       y="312.64603"
+       id="use1734" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="177.0173"
+       y="312.64603"
+       id="use1736" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="179.30865"
+       y="312.64603"
+       id="use1738" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="183.43228"
+       y="312.64603"
+       id="use1740" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="188.01901"
+       y="312.64603"
+       id="use1742" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="192.60574"
+       y="312.64603"
+       id="use1744" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="197.19247"
+       y="312.64603"
+       id="use1746" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1822">
+    <use
+       xlink:href="#glyph-1-28"
+       x="199.48383"
+       y="312.64603"
+       id="use1750" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="201.77518"
+       y="312.64603"
+       id="use1752" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="205.89882"
+       y="312.64603"
+       id="use1754" />
+    <use
+       xlink:href="#glyph-1-29"
+       x="210.48555"
+       y="312.64603"
+       id="use1756" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="217.35558"
+       y="312.64603"
+       id="use1758" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="219.64693"
+       y="312.64603"
+       id="use1760" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="221.93828"
+       y="312.64603"
+       id="use1762" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="224.22963"
+       y="312.64603"
+       id="use1764" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="226.52098"
+       y="312.64603"
+       id="use1766" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="228.81233"
+       y="312.64603"
+       id="use1768" />
+    <use
+       xlink:href="#glyph-1-30"
+       x="232.93596"
+       y="312.64603"
+       id="use1770" />
+    <use
+       xlink:href="#glyph-1-7"
+       x="237.52269"
+       y="312.64603"
+       id="use1772" />
+    <use
+       xlink:href="#glyph-1-7"
+       x="239.35497"
+       y="312.64603"
+       id="use1774" />
+    <use
+       xlink:href="#glyph-1-31"
+       x="241.18724"
+       y="312.64603"
+       id="use1776" />
+    <use
+       xlink:href="#glyph-1-30"
+       x="245.77397"
+       y="312.64603"
+       id="use1778" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="250.36072"
+       y="312.64603"
+       id="use1780" />
+    <use
+       xlink:href="#glyph-1-9"
+       x="254.48434"
+       y="312.64603"
+       id="use1782" />
+    <use
+       xlink:href="#glyph-1-37"
+       x="258.60797"
+       y="312.64603"
+       id="use1784" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="263.1947"
+       y="312.64603"
+       id="use1786" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="267.31833"
+       y="312.64603"
+       id="use1788" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="271.90506"
+       y="312.64603"
+       id="use1790" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="276.49179"
+       y="312.64603"
+       id="use1792" />
+    <use
+       xlink:href="#glyph-1-38"
+       x="281.07852"
+       y="312.64603"
+       id="use1794" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="285.89481"
+       y="312.64603"
+       id="use1796" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="288.18616"
+       y="312.64603"
+       id="use1798" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="290.47751"
+       y="312.64603"
+       id="use1800" />
+    <use
+       xlink:href="#glyph-1-39"
+       x="292.76886"
+       y="312.64603"
+       id="use1802" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="298.26971"
+       y="312.64603"
+       id="use1804" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="302.39334"
+       y="312.64603"
+       id="use1806" />
+    <use
+       xlink:href="#glyph-1-30"
+       x="304.68469"
+       y="312.64603"
+       id="use1808" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="309.27142"
+       y="312.64603"
+       id="use1810" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="311.56277"
+       y="312.64603"
+       id="use1812" />
+    <use
+       xlink:href="#glyph-1-38"
+       x="316.14951"
+       y="312.64603"
+       id="use1814" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="320.96576"
+       y="312.64603"
+       id="use1816" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="323.25711"
+       y="312.64603"
+       id="use1818" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="325.54846"
+       y="312.64603"
+       id="use1820" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1826">
+    <use
+       xlink:href="#glyph-1-5"
+       x="327.83981"
+       y="312.64603"
+       id="use1824" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 332.001168 342.999616 L 332.001168 330.000502 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1828" />
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 479.930556 448.998398 L 729.127987 448.998398 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1830" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 734.379733 448.998398 L 727.377405 452.499562 L 729.127987 448.998398 L 727.377405 445.502444 Z M 734.379733 448.998398 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1832" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     d="M 379.375 326.140625 L 539.070313 326.140625 L 539.070313 335.886719 L 379.375 335.886719 Z M 379.375 326.140625 "
+     id="path1834" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1844">
+    <use
+       xlink:href="#glyph-1-40"
+       x="379.53784"
+       y="333.63904"
+       id="use1836" />
+    <use
+       xlink:href="#glyph-1-11"
+       x="385.0387"
+       y="333.63904"
+       id="use1838" />
+    <use
+       xlink:href="#glyph-1-41"
+       x="391.45367"
+       y="333.63904"
+       id="use1840" />
+    <use
+       xlink:href="#glyph-1-21"
+       x="396.95453"
+       y="333.63904"
+       id="use1842" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1890">
+    <use
+       xlink:href="#glyph-1-5"
+       x="401.84329"
+       y="333.63904"
+       id="use1846" />
+    <use
+       xlink:href="#glyph-1-22"
+       x="404.13464"
+       y="333.63904"
+       id="use1848" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="408.72137"
+       y="333.63904"
+       id="use1850" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="411.01273"
+       y="333.63904"
+       id="use1852" />
+    <use
+       xlink:href="#glyph-1-24"
+       x="413.30408"
+       y="333.63904"
+       id="use1854" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="417.89081"
+       y="333.63904"
+       id="use1856" />
+    <use
+       xlink:href="#glyph-1-25"
+       x="422.01443"
+       y="333.63904"
+       id="use1858" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="424.30579"
+       y="333.63904"
+       id="use1860" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="426.59714"
+       y="333.63904"
+       id="use1862" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="428.88849"
+       y="333.63904"
+       id="use1864" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="433.47522"
+       y="333.63904"
+       id="use1866" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="435.3075"
+       y="333.63904"
+       id="use1868" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="439.89423"
+       y="333.63904"
+       id="use1870" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="444.01785"
+       y="333.63904"
+       id="use1872" />
+    <use
+       xlink:href="#glyph-1-24"
+       x="446.3092"
+       y="333.63904"
+       id="use1874" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="450.89594"
+       y="333.63904"
+       id="use1876" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="453.64233"
+       y="333.63904"
+       id="use1878" />
+    <use
+       xlink:href="#glyph-1-42"
+       x="458.22906"
+       y="333.63904"
+       id="use1880" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="462.35269"
+       y="333.63904"
+       id="use1882" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="464.18497"
+       y="333.63904"
+       id="use1884" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="468.7717"
+       y="333.63904"
+       id="use1886" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="473.35846"
+       y="333.63904"
+       id="use1888" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1924">
+    <use
+       xlink:href="#glyph-1-28"
+       x="475.64981"
+       y="333.63904"
+       id="use1892" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="477.94116"
+       y="333.63904"
+       id="use1894" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="482.06479"
+       y="333.63904"
+       id="use1896" />
+    <use
+       xlink:href="#glyph-1-29"
+       x="486.65152"
+       y="333.63904"
+       id="use1898" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="493.52155"
+       y="333.63904"
+       id="use1900" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="495.8129"
+       y="333.63904"
+       id="use1902" />
+    <use
+       xlink:href="#glyph-1-30"
+       x="500.39963"
+       y="333.63904"
+       id="use1904" />
+    <use
+       xlink:href="#glyph-1-43"
+       x="504.98636"
+       y="333.63904"
+       id="use1906" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="509.57309"
+       y="333.63904"
+       id="use1908" />
+    <use
+       xlink:href="#glyph-1-22"
+       x="511.86444"
+       y="333.63904"
+       id="use1910" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="516.45117"
+       y="333.63904"
+       id="use1912" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="518.74249"
+       y="333.63904"
+       id="use1914" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="521.03387"
+       y="333.63904"
+       id="use1916" />
+    <use
+       xlink:href="#glyph-1-9"
+       x="525.62061"
+       y="333.63904"
+       id="use1918" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="529.74426"
+       y="333.63904"
+       id="use1920" />
+    <use
+       xlink:href="#glyph-1-18"
+       x="534.33099"
+       y="333.63904"
+       id="use1922" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 149.810389 221.000723 L 729.127987 221.000723 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1926" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 734.379733 221.000723 L 727.377405 224.501887 L 729.127987 221.000723 L 727.377405 217.499559 Z M 734.379733 221.000723 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path1928" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     d="M 165.695313 156.699219 L 331.390625 156.699219 L 331.390625 166.445313 L 165.695313 166.445313 Z M 165.695313 156.699219 "
+     id="path1930" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1938">
+    <use
+       xlink:href="#glyph-1-19"
+       x="165.88234"
+       y="164.19539"
+       id="use1932" />
+    <use
+       xlink:href="#glyph-1-20"
+       x="172.29732"
+       y="164.19539"
+       id="use1934" />
+    <use
+       xlink:href="#glyph-1-21"
+       x="177.79817"
+       y="164.19539"
+       id="use1936" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g1984">
+    <use
+       xlink:href="#glyph-1-5"
+       x="182.68692"
+       y="164.19539"
+       id="use1940" />
+    <use
+       xlink:href="#glyph-1-22"
+       x="184.97827"
+       y="164.19539"
+       id="use1942" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="189.565"
+       y="164.19539"
+       id="use1944" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="191.85635"
+       y="164.19539"
+       id="use1946" />
+    <use
+       xlink:href="#glyph-1-24"
+       x="194.14772"
+       y="164.19539"
+       id="use1948" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="198.73445"
+       y="164.19539"
+       id="use1950" />
+    <use
+       xlink:href="#glyph-1-25"
+       x="202.85808"
+       y="164.19539"
+       id="use1952" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="205.14943"
+       y="164.19539"
+       id="use1954" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="207.44078"
+       y="164.19539"
+       id="use1956" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="209.73213"
+       y="164.19539"
+       id="use1958" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="214.31886"
+       y="164.19539"
+       id="use1960" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="216.15114"
+       y="164.19539"
+       id="use1962" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="220.73787"
+       y="164.19539"
+       id="use1964" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="224.8615"
+       y="164.19539"
+       id="use1966" />
+    <use
+       xlink:href="#glyph-1-24"
+       x="227.15285"
+       y="164.19539"
+       id="use1968" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="231.73958"
+       y="164.19539"
+       id="use1970" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="234.48598"
+       y="164.19539"
+       id="use1972" />
+    <use
+       xlink:href="#glyph-1-42"
+       x="239.07271"
+       y="164.19539"
+       id="use1974" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="243.19633"
+       y="164.19539"
+       id="use1976" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="245.02863"
+       y="164.19539"
+       id="use1978" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="249.61536"
+       y="164.19539"
+       id="use1980" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="254.20209"
+       y="164.19539"
+       id="use1982" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2030">
+    <use
+       xlink:href="#glyph-1-28"
+       x="256.49344"
+       y="164.19539"
+       id="use1986" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="258.78479"
+       y="164.19539"
+       id="use1988" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="262.90842"
+       y="164.19539"
+       id="use1990" />
+    <use
+       xlink:href="#glyph-1-29"
+       x="267.49515"
+       y="164.19539"
+       id="use1992" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="274.36517"
+       y="164.19539"
+       id="use1994" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="276.65652"
+       y="164.19539"
+       id="use1996" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="278.94788"
+       y="164.19539"
+       id="use1998" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="281.23923"
+       y="164.19539"
+       id="use2000" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="283.53058"
+       y="164.19539"
+       id="use2002" />
+    <use
+       xlink:href="#glyph-1-30"
+       x="285.82193"
+       y="164.19539"
+       id="use2004" />
+    <use
+       xlink:href="#glyph-1-43"
+       x="290.40866"
+       y="164.19539"
+       id="use2006" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="294.99539"
+       y="164.19539"
+       id="use2008" />
+    <use
+       xlink:href="#glyph-1-22"
+       x="297.28674"
+       y="164.19539"
+       id="use2010" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="301.87347"
+       y="164.19539"
+       id="use2012" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="306.46021"
+       y="164.19539"
+       id="use2014" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="309.2066"
+       y="164.19539"
+       id="use2016" />
+    <use
+       xlink:href="#glyph-1-44"
+       x="311.03888"
+       y="164.19539"
+       id="use2018" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="315.16251"
+       y="164.19539"
+       id="use2020" />
+    <use
+       xlink:href="#glyph-1-37"
+       x="319.74924"
+       y="164.19539"
+       id="use2022" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="324.33597"
+       y="164.19539"
+       id="use2024" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="326.62735"
+       y="164.19539"
+       id="use2026" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="328.9187"
+       y="164.19539"
+       id="use2028" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 169.999392 233.999836 L 600.001725 233.999836 L 600.001725 304.002276 L 169.999392 304.002276 Z M 169.999392 233.999836 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2032" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2178">
+    <use
+       xlink:href="#glyph-0-12"
+       x="145.12361"
+       y="199.43367"
+       id="use2034" />
+    <use
+       xlink:href="#glyph-0-13"
+       x="152.12177"
+       y="199.43367"
+       id="use2036" />
+    <use
+       xlink:href="#glyph-0-14"
+       x="154.62143"
+       y="199.43367"
+       id="use2038" />
+    <use
+       xlink:href="#glyph-0-10"
+       x="161.11877"
+       y="199.43367"
+       id="use2040" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="167.61613"
+       y="199.43367"
+       id="use2042" />
+    <use
+       xlink:href="#glyph-0-18"
+       x="170.11578"
+       y="199.43367"
+       id="use2044" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="175.11949"
+       y="199.43367"
+       id="use2046" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="178.11557"
+       y="199.43367"
+       id="use2048" />
+    <use
+       xlink:href="#glyph-0-16"
+       x="183.11928"
+       y="199.43367"
+       id="use2050" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="187.61778"
+       y="199.43367"
+       id="use2052" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="189.61662"
+       y="199.43367"
+       id="use2054" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="194.62033"
+       y="199.43367"
+       id="use2056" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="199.62404"
+       y="199.43367"
+       id="use2058" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="202.62012"
+       y="199.43367"
+       id="use2060" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="205.11977"
+       y="199.43367"
+       id="use2062" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="212.61435"
+       y="199.43367"
+       id="use2064" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="214.61319"
+       y="199.43367"
+       id="use2066" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="219.6169"
+       y="199.43367"
+       id="use2068" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="224.62061"
+       y="199.43367"
+       id="use2070" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="227.12027"
+       y="199.43367"
+       id="use2072" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="229.61992"
+       y="199.43367"
+       id="use2074" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="234.11842"
+       y="199.43367"
+       id="use2076" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="239.12213"
+       y="199.43367"
+       id="use2078" />
+    <use
+       xlink:href="#glyph-0-9"
+       x="244.12584"
+       y="199.43367"
+       id="use2080" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="250.6232"
+       y="199.43367"
+       id="use2082" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="253.12285"
+       y="199.43367"
+       id="use2084" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="258.12656"
+       y="199.43367"
+       id="use2086" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="260.62622"
+       y="199.43367"
+       id="use2088" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="262.62506"
+       y="199.43367"
+       id="use2090" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="267.62875"
+       y="199.43367"
+       id="use2092" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="272.63248"
+       y="199.43367"
+       id="use2094" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="274.63132"
+       y="199.43367"
+       id="use2096" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="279.63504"
+       y="199.43367"
+       id="use2098" />
+    <use
+       xlink:href="#glyph-0-18"
+       x="282.13467"
+       y="199.43367"
+       id="use2100" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="287.1384"
+       y="199.43367"
+       id="use2102" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="292.14209"
+       y="199.43367"
+       id="use2104" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="297.14581"
+       y="199.43367"
+       id="use2106" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="302.14951"
+       y="199.43367"
+       id="use2108" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="304.64917"
+       y="199.43367"
+       id="use2110" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="307.14883"
+       y="199.43367"
+       id="use2112" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="312.15253"
+       y="199.43367"
+       id="use2114" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="317.15625"
+       y="199.43367"
+       id="use2116" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="319.65588"
+       y="199.43367"
+       id="use2118" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="322.15555"
+       y="199.43367"
+       id="use2120" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="325.15164"
+       y="199.43367"
+       id="use2122" />
+    <use
+       xlink:href="#glyph-0-26"
+       x="330.15533"
+       y="199.43367"
+       id="use2124" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="335.15906"
+       y="199.43367"
+       id="use2126" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="340.16275"
+       y="199.43367"
+       id="use2128" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="342.16159"
+       y="199.43367"
+       id="use2130" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="345.15768"
+       y="199.43367"
+       id="use2132" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="350.16138"
+       y="199.43367"
+       id="use2134" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="354.65988"
+       y="199.43367"
+       id="use2136" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="357.15955"
+       y="199.43367"
+       id="use2138" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="359.65921"
+       y="199.43367"
+       id="use2140" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="364.6629"
+       y="199.43367"
+       id="use2142" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="369.6666"
+       y="199.43367"
+       id="use2144" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="372.16626"
+       y="199.43367"
+       id="use2146" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="377.16998"
+       y="199.43367"
+       id="use2148" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="381.66849"
+       y="199.43367"
+       id="use2150" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="386.67218"
+       y="199.43367"
+       id="use2152" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="389.66827"
+       y="199.43367"
+       id="use2154" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="392.16791"
+       y="199.43367"
+       id="use2156" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="394.66757"
+       y="199.43367"
+       id="use2158" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="399.6713"
+       y="199.43367"
+       id="use2160" />
+    <use
+       xlink:href="#glyph-0-28"
+       x="402.17093"
+       y="199.43367"
+       id="use2162" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="406.66943"
+       y="199.43367"
+       id="use2164" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="408.66827"
+       y="199.43367"
+       id="use2166" />
+    <use
+       xlink:href="#glyph-0-28"
+       x="410.66714"
+       y="199.43367"
+       id="use2168" />
+    <use
+       xlink:href="#glyph-0-29"
+       x="415.16565"
+       y="199.43367"
+       id="use2170" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="419.66415"
+       y="199.43367"
+       id="use2172" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="422.16379"
+       y="199.43367"
+       id="use2174" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="427.16751"
+       y="199.43367"
+       id="use2176" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2218">
+    <use
+       xlink:href="#glyph-0-30"
+       x="251.93965"
+       y="210.67993"
+       id="use2180" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="255.13341"
+       y="210.67993"
+       id="use2182" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="260.13712"
+       y="210.67993"
+       id="use2184" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="265.14084"
+       y="210.67993"
+       id="use2186" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="267.64047"
+       y="210.67993"
+       id="use2188" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="272.6442"
+       y="210.67993"
+       id="use2190" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="277.64789"
+       y="210.67993"
+       id="use2192" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="280.64398"
+       y="210.67993"
+       id="use2194" />
+    <use
+       xlink:href="#glyph-0-31"
+       x="282.64282"
+       y="210.67993"
+       id="use2196" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="287.14133"
+       y="210.67993"
+       id="use2198" />
+    <use
+       xlink:href="#glyph-0-30"
+       x="292.14502"
+       y="210.67993"
+       id="use2200" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="295.33881"
+       y="210.67993"
+       id="use2202" />
+    <use
+       xlink:href="#glyph-0-32"
+       x="297.83844"
+       y="210.67993"
+       id="use2204" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="302.84216"
+       y="210.67993"
+       id="use2206" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="307.84586"
+       y="210.67993"
+       id="use2208" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="310.34552"
+       y="210.67993"
+       id="use2210" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="312.84518"
+       y="210.67993"
+       id="use2212" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="317.84888"
+       y="210.67993"
+       id="use2214" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="322.8526"
+       y="210.67993"
+       id="use2216" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 322.998174 233.999836 L 322.998174 221.000723 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2220" />
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 735.499897 481.998952 L 486.302466 481.998952 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2222" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 481.05072 481.998952 L 488.047838 478.497788 L 486.302466 481.998952 L 488.047838 485.500116 Z M 481.05072 481.998952 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2224" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     d="M 447.601563 348.632813 L 469.34375 348.632813 L 469.34375 358.378906 L 447.601563 358.378906 Z M 447.601563 348.632813 "
+     id="path2226" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2236">
+    <use
+       xlink:href="#glyph-1-45"
+       x="447.47229"
+       y="356.13156"
+       id="use2228" />
+    <use
+       xlink:href="#glyph-1-41"
+       x="451.59592"
+       y="356.13156"
+       id="use2230" />
+    <use
+       xlink:href="#glyph-1-11"
+       x="457.09677"
+       y="356.13156"
+       id="use2232" />
+    <use
+       xlink:href="#glyph-1-46"
+       x="463.51175"
+       y="356.13156"
+       id="use2234" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 490.001613 493.997733 L 729.998068 493.997733 L 729.998068 590.998732 L 490.001613 590.998732 Z M 490.001613 493.997733 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2238" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2242">
+    <use
+       xlink:href="#glyph-2-31"
+       x="368.87732"
+       y="382.37283"
+       id="use2240" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2246">
+    <use
+       xlink:href="#glyph-2-20"
+       x="368.87732"
+       y="393.61911"
+       id="use2244" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2290">
+    <use
+       xlink:href="#glyph-2-20"
+       x="373.37656"
+       y="393.61911"
+       id="use2248" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="377.87579"
+       y="393.61911"
+       id="use2250" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="382.37503"
+       y="393.61911"
+       id="use2252" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="386.87427"
+       y="393.61911"
+       id="use2254" />
+    <use
+       xlink:href="#glyph-2-23"
+       x="391.3735"
+       y="393.61911"
+       id="use2256" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="395.87274"
+       y="393.61911"
+       id="use2258" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="400.37198"
+       y="393.61911"
+       id="use2260" />
+    <use
+       xlink:href="#glyph-2-29"
+       x="404.87122"
+       y="393.61911"
+       id="use2262" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="409.37045"
+       y="393.61911"
+       id="use2264" />
+    <use
+       xlink:href="#glyph-2-22"
+       x="413.86969"
+       y="393.61911"
+       id="use2266" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="418.36893"
+       y="393.61911"
+       id="use2268" />
+    <use
+       xlink:href="#glyph-2-5"
+       x="422.86816"
+       y="393.61911"
+       id="use2270" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="427.3674"
+       y="393.61911"
+       id="use2272" />
+    <use
+       xlink:href="#glyph-2-25"
+       x="431.86664"
+       y="393.61911"
+       id="use2274" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="436.36588"
+       y="393.61911"
+       id="use2276" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="440.86511"
+       y="393.61911"
+       id="use2278" />
+    <use
+       xlink:href="#glyph-2-29"
+       x="445.36435"
+       y="393.61911"
+       id="use2280" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="449.86359"
+       y="393.61911"
+       id="use2282" />
+    <use
+       xlink:href="#glyph-2-22"
+       x="454.36282"
+       y="393.61911"
+       id="use2284" />
+    <use
+       xlink:href="#glyph-2-26"
+       x="458.86206"
+       y="393.61911"
+       id="use2286" />
+    <use
+       xlink:href="#glyph-2-33"
+       x="463.36127"
+       y="393.61911"
+       id="use2288" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2294">
+    <use
+       xlink:href="#glyph-2-20"
+       x="368.87732"
+       y="404.86536"
+       id="use2292" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2346">
+    <use
+       xlink:href="#glyph-2-20"
+       x="373.37656"
+       y="404.86536"
+       id="use2296" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="377.87579"
+       y="404.86536"
+       id="use2298" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="382.37503"
+       y="404.86536"
+       id="use2300" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="386.87427"
+       y="404.86536"
+       id="use2302" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="391.3735"
+       y="404.86536"
+       id="use2304" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="395.87274"
+       y="404.86536"
+       id="use2306" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="400.37198"
+       y="404.86536"
+       id="use2308" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="404.87122"
+       y="404.86536"
+       id="use2310" />
+    <use
+       xlink:href="#glyph-2-23"
+       x="409.37045"
+       y="404.86536"
+       id="use2312" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="413.86969"
+       y="404.86536"
+       id="use2314" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="418.36893"
+       y="404.86536"
+       id="use2316" />
+    <use
+       xlink:href="#glyph-2-29"
+       x="422.86816"
+       y="404.86536"
+       id="use2318" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="427.3674"
+       y="404.86536"
+       id="use2320" />
+    <use
+       xlink:href="#glyph-2-22"
+       x="431.86664"
+       y="404.86536"
+       id="use2322" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="436.36588"
+       y="404.86536"
+       id="use2324" />
+    <use
+       xlink:href="#glyph-2-5"
+       x="440.86511"
+       y="404.86536"
+       id="use2326" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="445.36435"
+       y="404.86536"
+       id="use2328" />
+    <use
+       xlink:href="#glyph-2-25"
+       x="449.86359"
+       y="404.86536"
+       id="use2330" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="454.36282"
+       y="404.86536"
+       id="use2332" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="458.86206"
+       y="404.86536"
+       id="use2334" />
+    <use
+       xlink:href="#glyph-2-29"
+       x="463.36127"
+       y="404.86536"
+       id="use2336" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="467.8605"
+       y="404.86536"
+       id="use2338" />
+    <use
+       xlink:href="#glyph-2-22"
+       x="472.35974"
+       y="404.86536"
+       id="use2340" />
+    <use
+       xlink:href="#glyph-2-26"
+       x="476.85898"
+       y="404.86536"
+       id="use2342" />
+    <use
+       xlink:href="#glyph-2-33"
+       x="481.35822"
+       y="404.86536"
+       id="use2344" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2350">
+    <use
+       xlink:href="#glyph-2-20"
+       x="368.87732"
+       y="416.1116"
+       id="use2348" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2408">
+    <use
+       xlink:href="#glyph-2-20"
+       x="373.37656"
+       y="416.1116"
+       id="use2352" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="377.87579"
+       y="416.1116"
+       id="use2354" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="382.37503"
+       y="416.1116"
+       id="use2356" />
+    <use
+       xlink:href="#glyph-2-15"
+       x="386.87427"
+       y="416.1116"
+       id="use2358" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="391.3735"
+       y="416.1116"
+       id="use2360" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="395.87274"
+       y="416.1116"
+       id="use2362" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="400.37198"
+       y="416.1116"
+       id="use2364" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="404.87122"
+       y="416.1116"
+       id="use2366" />
+    <use
+       xlink:href="#glyph-2-5"
+       x="409.37045"
+       y="416.1116"
+       id="use2368" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="413.86969"
+       y="416.1116"
+       id="use2370" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="418.36893"
+       y="416.1116"
+       id="use2372" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="422.86816"
+       y="416.1116"
+       id="use2374" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="427.3674"
+       y="416.1116"
+       id="use2376" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="431.86664"
+       y="416.1116"
+       id="use2378" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="436.36588"
+       y="416.1116"
+       id="use2380" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="440.86511"
+       y="416.1116"
+       id="use2382" />
+    <use
+       xlink:href="#glyph-2-34"
+       x="445.36435"
+       y="416.1116"
+       id="use2384" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="449.86359"
+       y="416.1116"
+       id="use2386" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="454.36282"
+       y="416.1116"
+       id="use2388" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="458.86206"
+       y="416.1116"
+       id="use2390" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="463.36127"
+       y="416.1116"
+       id="use2392" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="467.8605"
+       y="416.1116"
+       id="use2394" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="472.35974"
+       y="416.1116"
+       id="use2396" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="476.85898"
+       y="416.1116"
+       id="use2398" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="481.35822"
+       y="416.1116"
+       id="use2400" />
+    <use
+       xlink:href="#glyph-2-15"
+       x="485.85745"
+       y="416.1116"
+       id="use2402" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="490.35669"
+       y="416.1116"
+       id="use2404" />
+    <use
+       xlink:href="#glyph-2-33"
+       x="494.85593"
+       y="416.1116"
+       id="use2406" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2412">
+    <use
+       xlink:href="#glyph-2-20"
+       x="368.87732"
+       y="427.35788"
+       id="use2410" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2416">
+    <use
+       xlink:href="#glyph-2-20"
+       x="373.37656"
+       y="427.35788"
+       id="use2414" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2420">
+    <use
+       xlink:href="#glyph-2-20"
+       x="377.87579"
+       y="427.35788"
+       id="use2418" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2468">
+    <use
+       xlink:href="#glyph-2-11"
+       x="382.37503"
+       y="427.35788"
+       id="use2422" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="386.87427"
+       y="427.35788"
+       id="use2424" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="391.3735"
+       y="427.35788"
+       id="use2426" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="395.87274"
+       y="427.35788"
+       id="use2428" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="400.37198"
+       y="427.35788"
+       id="use2430" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="404.87122"
+       y="427.35788"
+       id="use2432" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="409.37045"
+       y="427.35788"
+       id="use2434" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="413.86969"
+       y="427.35788"
+       id="use2436" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="418.36893"
+       y="427.35788"
+       id="use2438" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="422.86816"
+       y="427.35788"
+       id="use2440" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="427.3674"
+       y="427.35788"
+       id="use2442" />
+    <use
+       xlink:href="#glyph-2-35"
+       x="431.86664"
+       y="427.35788"
+       id="use2444" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="436.36588"
+       y="427.35788"
+       id="use2446" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="440.86511"
+       y="427.35788"
+       id="use2448" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="445.36435"
+       y="427.35788"
+       id="use2450" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="449.86359"
+       y="427.35788"
+       id="use2452" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="454.36282"
+       y="427.35788"
+       id="use2454" />
+    <use
+       xlink:href="#glyph-2-15"
+       x="458.86206"
+       y="427.35788"
+       id="use2456" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="463.36127"
+       y="427.35788"
+       id="use2458" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="467.8605"
+       y="427.35788"
+       id="use2460" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="472.35974"
+       y="427.35788"
+       id="use2462" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="476.85898"
+       y="427.35788"
+       id="use2464" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="481.35822"
+       y="427.35788"
+       id="use2466" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2472">
+    <use
+       xlink:href="#glyph-2-36"
+       x="368.87732"
+       y="438.60413"
+       id="use2470" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 613.000838 493.997733 L 613.000838 480.99862 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2474" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 475.001834 665.997624 L 484.99995 665.997624 L 484.99995 1340.998075 L 475.001834 1340.998075 Z M 475.001834 665.997624 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2476" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 350.001944 685.999065 L 449.99873 685.999065 L 449.99873 726.001948 L 350.001944 726.001948 Z M 350.001944 685.999065 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2478" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2482">
+    <use
+       xlink:href="#glyph-0-34"
+       x="276.38855"
+       y="532.32294"
+       id="use2480" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2506">
+    <use
+       xlink:href="#glyph-0-3"
+       x="281.89307"
+       y="532.32294"
+       id="use2484" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="286.89679"
+       y="532.32294"
+       id="use2486" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="289.89285"
+       y="532.32294"
+       id="use2488" />
+    <use
+       xlink:href="#glyph-0-35"
+       x="291.89169"
+       y="532.32294"
+       id="use2490" />
+    <use
+       xlink:href="#glyph-0-36"
+       x="294.39136"
+       y="532.32294"
+       id="use2492" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="298.88986"
+       y="532.32294"
+       id="use2494" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="301.38953"
+       y="532.32294"
+       id="use2496" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="303.88916"
+       y="532.32294"
+       id="use2498" />
+    <use
+       xlink:href="#glyph-0-29"
+       x="308.89288"
+       y="532.32294"
+       id="use2500" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="313.39139"
+       y="532.32294"
+       id="use2502" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="318.39508"
+       y="532.32294"
+       id="use2504" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 479.498121 696.002391 L 456.37064 696.002391 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2508" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 451.118894 696.002391 L 458.121222 692.501227 L 456.37064 696.002391 L 458.121222 699.498345 Z M 451.118894 696.002391 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2510" />
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 452.999728 710.27797 L 473.131421 710.27797 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2512" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 478.377957 710.27797 L 471.380839 713.779134 L 473.131421 710.27797 L 471.380839 706.782016 Z M 478.377957 710.27797 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2514" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="0.24"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 50.19989%, 94.119263%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 722.000451 507.00189 C 722.000451 507.392645 721.963981 507.7834 721.88583 508.168945 C 721.807679 508.554489 721.693057 508.929614 721.541965 509.294319 C 721.390874 509.659023 721.208521 510.008098 720.989699 510.331122 C 720.770876 510.659356 720.520793 510.96154 720.244659 511.242883 C 719.963316 511.519017 719.661132 511.7691 719.332898 511.987923 C 719.004664 512.206745 718.660799 512.394308 718.296095 512.5454 C 717.93139 512.696492 717.556265 512.805903 717.170721 512.884054 C 716.785176 512.962205 716.394421 512.998675 715.998456 512.998675 C 715.607701 512.998675 715.216946 512.962205 714.831401 512.884054 C 714.440646 512.805903 714.065522 512.696492 713.706027 512.5454 C 713.341322 512.394308 712.992248 512.206745 712.664014 511.987923 C 712.34099 511.7691 712.033596 511.519017 711.757463 511.242883 C 711.481329 510.96154 711.231246 510.659356 711.012423 510.331122 C 710.7936 510.008098 710.606038 509.659023 710.454946 509.294319 C 710.303854 508.929614 710.194443 508.554489 710.116292 508.168945 C 710.038141 507.7834 710.00167 507.392645 710.00167 507.00189 C 710.00167 506.605925 710.038141 506.21517 710.116292 505.829625 C 710.194443 505.44408 710.303854 505.068956 710.454946 504.704251 C 710.606038 504.339547 710.7936 503.995682 711.012423 503.667448 C 711.231246 503.339214 711.481329 503.03703 711.757463 502.755687 C 712.033596 502.479553 712.34099 502.22947 712.664014 502.010647 C 712.992248 501.791825 713.341322 501.609472 713.706027 501.45838 C 714.065522 501.307288 714.440646 501.192667 714.831401 501.114516 C 715.216946 501.036365 715.607701 500.999895 715.998456 500.999895 C 716.394421 500.999895 716.785176 501.036365 717.170721 501.114516 C 717.556265 501.192667 717.93139 501.307288 718.296095 501.45838 C 718.660799 501.609472 719.004664 501.791825 719.332898 502.010647 C 719.661132 502.22947 719.963316 502.479553 720.244659 502.755687 C 720.520793 503.03703 720.770876 503.339214 720.989699 503.667448 C 721.208521 503.995682 721.390874 504.339547 721.541965 504.704251 C 721.693057 505.068956 721.807679 505.44408 721.88583 505.829625 C 721.963981 506.21517 722.000451 506.605925 722.000451 507.00189 Z M 722.000451 507.00189 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0, 0)"
+     id="path2516" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 50.19989%, 94.119263%)"
+     fill-opacity="1"
+     d="M 536.101563 378.773438 L 537.269531 378.773438 L 537.269531 382.824219 C 537.269531 382.972656 537.390625 383.09375 537.542969 383.09375 L 536.101563 383.09375 C 536.25 383.09375 536.371094 382.972656 536.371094 382.824219 L 536.371094 379.042969 C 536.371094 378.96875 536.339844 378.902344 536.289063 378.855469 C 536.246094 378.804688 536.175781 378.773438 536.101563 378.773438 "
+     id="path2518" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 50.19989%, 94.119263%)"
+     fill-opacity="1"
+     d="M 537.269531 377.875 C 537.269531 378 537.226563 378.105469 537.140625 378.191406 C 537.050781 378.28125 536.945313 378.324219 536.820313 378.324219 C 536.695313 378.324219 536.589844 378.28125 536.503906 378.191406 C 536.414063 378.105469 536.371094 378 536.371094 377.875 C 536.371094 377.75 536.414063 377.644531 536.503906 377.554688 C 536.589844 377.46875 536.695313 377.425781 536.820313 377.425781 C 536.945313 377.425781 537.050781 377.46875 537.140625 377.554688 C 537.226563 377.644531 537.269531 377.75 537.269531 377.875 Z M 537.269531 377.875 "
+     id="path2520" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(42.349243%, 55.688477%, 74.899292%)"
+     fill-opacity="1"
+     d="M 532.699219 661.28125 L 534.945313 661.28125 L 534.945313 663.53125 L 532.699219 663.53125 M 541.695313 661.28125 L 543.945313 661.28125 L 543.945313 663.53125 L 541.695313 663.53125 M 550.691406 661.28125 L 552.941406 661.28125 L 552.941406 663.53125 L 550.691406 663.53125 M 559.6875 661.28125 L 561.9375 661.28125 L 561.9375 663.53125 L 559.6875 663.53125 M 568.6875 661.28125 L 570.933594 661.28125 L 570.933594 663.53125 L 568.6875 663.53125 M 577.683594 661.28125 L 579.933594 661.28125 L 579.933594 663.53125 L 577.683594 663.53125 M 586.679688 661.28125 L 588.929688 661.28125 L 588.929688 663.53125 L 586.679688 663.53125 M 595.675781 661.28125 L 597.925781 661.28125 L 597.925781 663.53125 L 595.675781 663.53125 M 604.675781 661.28125 L 606.921875 661.28125 L 606.921875 663.53125 L 604.675781 663.53125 M 613.671875 661.28125 L 615.921875 661.28125 L 615.921875 663.53125 L 613.671875 663.53125 "
+     id="path2522" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(42.349243%, 55.688477%, 74.899292%)"
+     fill-opacity="1"
+     d="M 541.695313 379.375 L 543.945313 379.375 L 543.945313 381.625 L 541.695313 381.625 M 550.691406 379.375 L 552.941406 379.375 L 552.941406 381.625 L 550.691406 381.625 M 559.6875 379.375 L 561.9375 379.375 L 561.9375 381.625 L 559.6875 381.625 M 568.6875 379.375 L 570.933594 379.375 L 570.933594 381.625 L 568.6875 381.625 M 577.683594 379.375 L 579.933594 379.375 L 579.933594 381.625 L 577.683594 381.625 M 586.679688 379.375 L 588.929688 379.375 L 588.929688 381.625 L 586.679688 381.625 M 595.675781 379.375 L 597.925781 379.375 L 597.925781 381.625 L 595.675781 381.625 M 604.675781 379.375 L 606.921875 379.375 L 606.921875 381.625 L 604.675781 381.625 M 613.671875 379.375 L 615.921875 379.375 L 615.921875 381.625 L 613.671875 381.625 "
+     id="path2524" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(42.349243%, 55.688477%, 74.899292%)"
+     fill-opacity="1"
+     d="M 621.542969 660.90625 L 621.542969 658.65625 L 623.792969 658.65625 L 623.792969 660.90625 M 621.542969 651.90625 L 621.542969 649.660156 L 623.792969 649.660156 L 623.792969 651.90625 M 621.542969 642.910156 L 621.542969 640.660156 L 623.792969 640.660156 L 623.792969 642.910156 M 621.542969 633.914063 L 621.542969 631.664063 L 623.792969 631.664063 L 623.792969 633.914063 M 621.542969 624.917969 L 621.542969 622.667969 L 623.792969 622.667969 L 623.792969 624.917969 M 621.542969 615.921875 L 621.542969 613.671875 L 623.792969 613.671875 L 623.792969 615.921875 M 621.542969 606.921875 L 621.542969 604.675781 L 623.792969 604.675781 L 623.792969 606.921875 M 621.542969 597.925781 L 621.542969 595.675781 L 623.792969 595.675781 L 623.792969 597.925781 M 621.542969 588.929688 L 621.542969 586.679688 L 623.792969 586.679688 L 623.792969 588.929688 M 621.542969 579.933594 L 621.542969 577.683594 L 623.792969 577.683594 L 623.792969 579.933594 M 621.542969 570.933594 L 621.542969 568.6875 L 623.792969 568.6875 L 623.792969 570.933594 M 621.542969 561.9375 L 621.542969 559.6875 L 623.792969 559.6875 L 623.792969 561.9375 M 621.542969 552.941406 L 621.542969 550.691406 L 623.792969 550.691406 L 623.792969 552.941406 M 621.542969 543.945313 L 621.542969 541.695313 L 623.792969 541.695313 L 623.792969 543.945313 M 621.542969 534.945313 L 621.542969 532.699219 L 623.792969 532.699219 L 623.792969 534.945313 M 621.542969 525.949219 L 621.542969 523.699219 L 623.792969 523.699219 L 623.792969 525.949219 M 621.542969 516.953125 L 621.542969 514.703125 L 623.792969 514.703125 L 623.792969 516.953125 M 621.542969 507.957031 L 621.542969 505.707031 L 623.792969 505.707031 L 623.792969 507.957031 M 621.542969 498.960938 L 621.542969 496.710938 L 623.792969 496.710938 L 623.792969 498.960938 M 621.542969 489.960938 L 621.542969 487.710938 L 623.792969 487.710938 L 623.792969 489.960938 "
+     id="path2526" />
+  <g
+     clip-path="url(#clip-0)"
+     id="g2530">
+    <path
+       fill-rule="nonzero"
+       fill="#6c8ebf"
+       fill-opacity="1"
+       d="m 633.91406,404.86719 h 2.25 v 2.24609 h -2.25 z m 11.2461,0 h 2.25 v 2.24609 h -2.25 z m 11.24609,0 h 2.25 v 2.24609 h -2.25 z m 11.24609,0 h 2.25 v 2.24609 h -2.25 z m 11.2461,0 h 2.25 v 2.24609 h -2.25 z m 11.24609,0 h 2.25 v 2.24609 h -2.25 z m 11.24609,0 h 2.25 v 2.24609 h -2.25 z m 11.2461,0 h 2.25 v 2.24609 h -2.25 z m 11.24609,0 h 2.25 v 2.24609 h -2.25 z m 11.2461,0 h 2.25 v 2.24609 h -2.25 z m 11.24609,0 h 2.25 v 2.24609 h -2.25 z m 4.875,8.62109 v 2.25 H 749 v -2.25 z m 0,11.24609 v 2.25 H 749 v -2.25 z m 0,11.2461 v 2.25 H 749 v -2.25 z m 0,11.24609 v 2.25 H 749 v -2.25 z m 0,11.2461 v 2.25 H 749 v -2.25 z m 0,11.24609 v 2.25 H 749 v -2.25 z m -1.125,12.37109 h -2.25 v -2.25 h 2.25 z m -11.24609,0 h -2.25 v -2.25 h 2.25 z m -11.2461,0 h -2.25 v -2.25 h 2.25 z m -11.24609,0 h -2.25 v -2.25 h 2.25 z m -11.2461,0 h -2.25 v -2.25 h 2.25 z m -11.24609,0 h -2.25 v -2.25 h 2.25 z m -11.24609,0 h -2.25 v -2.25 h 2.25 z m -11.2461,0 h -2.25 v -2.25 h 2.25 z m -11.24609,0 h -2.25 v -2.25 h 2.25 z m -11.24609,0 h -2.25 v -2.25 h 2.25 z m -11.2461,0 h -2.25 v -2.25 h 2.25 z m -11.24609,0 h -2.25 v -2.25 h 2.25 z m -4.875,-8.62109 v -2.25 h 2.25 v 2.25 z m 0,-11.24609 v -2.25 h 2.25 v 2.25 z m 0,-11.2461 v -2.25 h 2.25 v 2.25 z m 0,-11.24609 v -2.25 h 2.25 v 2.25 z m 0,-11.2461 v -2.25 h 2.25 v 2.25 z m 0,-11.25 v -2.24609 h 2.25 v 2.24609 z m 1.125,-12.36718 h 2.25 v 2.24609 h -2.25 z m 0,0"
+       id="path2528" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2584">
+    <use
+       xlink:href="#glyph-0-10"
+       x="629.26337"
+       y="423.60913"
+       id="use2532" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="635.76074"
+       y="423.60913"
+       id="use2534" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="637.75958"
+       y="423.60913"
+       id="use2536" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="642.76331"
+       y="423.60913"
+       id="use2538" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="644.76215"
+       y="423.60913"
+       id="use2540" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="652.25671"
+       y="423.60913"
+       id="use2542" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="656.75525"
+       y="423.60913"
+       id="use2544" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="659.25488"
+       y="423.60913"
+       id="use2546" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="664.25861"
+       y="423.60913"
+       id="use2548" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="667.25464"
+       y="423.60913"
+       id="use2550" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="672.25836"
+       y="423.60913"
+       id="use2552" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="674.758"
+       y="423.60913"
+       id="use2554" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="682.25262"
+       y="423.60913"
+       id="use2556" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="687.25629"
+       y="423.60913"
+       id="use2558" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="690.25238"
+       y="423.60913"
+       id="use2560" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="695.2561"
+       y="423.60913"
+       id="use2562" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="700.25977"
+       y="423.60913"
+       id="use2564" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="705.26349"
+       y="423.60913"
+       id="use2566" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="707.76318"
+       y="423.60913"
+       id="use2568" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="710.26282"
+       y="423.60913"
+       id="use2570" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="715.26654"
+       y="423.60913"
+       id="use2572" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="720.2702"
+       y="423.60913"
+       id="use2574" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="725.27393"
+       y="423.60913"
+       id="use2576" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="727.77362"
+       y="423.60913"
+       id="use2578" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="732.77728"
+       y="423.60913"
+       id="use2580" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="737.78101"
+       y="423.60913"
+       id="use2582" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2588">
+    <use
+       xlink:href="#glyph-0-33"
+       x="740.28064"
+       y="423.60913"
+       id="use2586" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2592">
+    <use
+       xlink:href="#glyph-0-37"
+       x="628.7948"
+       y="434.85538"
+       id="use2590" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g2606">
+    <use
+       xlink:href="#glyph-4-1"
+       x="631.79382"
+       y="434.85538"
+       id="use2594" />
+    <use
+       xlink:href="#glyph-4-2"
+       x="636.74298"
+       y="434.85538"
+       id="use2596" />
+    <use
+       xlink:href="#glyph-4-3"
+       x="641.69214"
+       y="434.85538"
+       id="use2598" />
+    <use
+       xlink:href="#glyph-4-4"
+       x="646.6413"
+       y="434.85538"
+       id="use2600" />
+    <use
+       xlink:href="#glyph-4-5"
+       x="651.59045"
+       y="434.85538"
+       id="use2602" />
+    <use
+       xlink:href="#glyph-4-6"
+       x="656.53961"
+       y="434.85538"
+       id="use2604" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2622">
+    <use
+       xlink:href="#glyph-0-37"
+       x="661.49097"
+       y="434.85538"
+       id="use2608" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="664.487"
+       y="434.85538"
+       id="use2610" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="666.98669"
+       y="434.85538"
+       id="use2612" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="671.99036"
+       y="434.85538"
+       id="use2614" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="676.99408"
+       y="434.85538"
+       id="use2616" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="681.9978"
+       y="434.85538"
+       id="use2618" />
+    <use
+       xlink:href="#glyph-0-37"
+       x="684.49744"
+       y="434.85538"
+       id="use2620" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g2634">
+    <use
+       xlink:href="#glyph-4-2"
+       x="687.49792"
+       y="434.85538"
+       id="use2624" />
+    <use
+       xlink:href="#glyph-4-3"
+       x="692.44708"
+       y="434.85538"
+       id="use2626" />
+    <use
+       xlink:href="#glyph-4-7"
+       x="697.39624"
+       y="434.85538"
+       id="use2628" />
+    <use
+       xlink:href="#glyph-4-8"
+       x="702.3454"
+       y="434.85538"
+       id="use2630" />
+    <use
+       xlink:href="#glyph-4-6"
+       x="707.29456"
+       y="434.85538"
+       id="use2632" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2652">
+    <use
+       xlink:href="#glyph-0-37"
+       x="712.2514"
+       y="434.85538"
+       id="use2636" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="715.2475"
+       y="434.85538"
+       id="use2638" />
+    <use
+       xlink:href="#glyph-0-28"
+       x="717.74713"
+       y="434.85538"
+       id="use2640" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="722.24567"
+       y="434.85538"
+       id="use2642" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="724.24451"
+       y="434.85538"
+       id="use2644" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="729.24823"
+       y="434.85538"
+       id="use2646" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="731.24707"
+       y="434.85538"
+       id="use2648" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="738.74164"
+       y="434.85538"
+       id="use2650" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2698">
+    <use
+       xlink:href="#glyph-0-28"
+       x="642.25513"
+       y="446.10165"
+       id="use2654" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="646.75366"
+       y="446.10165"
+       id="use2656" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="651.75739"
+       y="446.10165"
+       id="use2658" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="656.76105"
+       y="446.10165"
+       id="use2660" />
+    <use
+       xlink:href="#glyph-0-32"
+       x="659.26074"
+       y="446.10165"
+       id="use2662" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="664.26447"
+       y="446.10165"
+       id="use2664" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="669.26813"
+       y="446.10165"
+       id="use2666" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="671.76782"
+       y="446.10165"
+       id="use2668" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="674.76385"
+       y="446.10165"
+       id="use2670" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="679.76758"
+       y="446.10165"
+       id="use2672" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="682.26721"
+       y="446.10165"
+       id="use2674" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="687.27094"
+       y="446.10165"
+       id="use2676" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="690.26703"
+       y="446.10165"
+       id="use2678" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="695.27075"
+       y="446.10165"
+       id="use2680" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="700.27441"
+       y="446.10165"
+       id="use2682" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="705.27814"
+       y="446.10165"
+       id="use2684" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="707.77777"
+       y="446.10165"
+       id="use2686" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="709.77667"
+       y="446.10165"
+       id="use2688" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="714.78033"
+       y="446.10165"
+       id="use2690" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="717.28003"
+       y="446.10165"
+       id="use2692" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="719.77966"
+       y="446.10165"
+       id="use2694" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="724.78339"
+       y="446.10165"
+       id="use2696" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2702">
+    <use
+       xlink:href="#glyph-0-37"
+       x="637.21777"
+       y="456.59814"
+       id="use2700" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g2720">
+    <use
+       xlink:href="#glyph-4-9"
+       x="640.2168"
+       y="456.59814"
+       id="use2704" />
+    <use
+       xlink:href="#glyph-4-10"
+       x="645.16595"
+       y="456.59814"
+       id="use2706" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="650.11511"
+       y="456.59814"
+       id="use2708" />
+    <use
+       xlink:href="#glyph-4-12"
+       x="655.06427"
+       y="456.59814"
+       id="use2710" />
+    <use
+       xlink:href="#glyph-4-3"
+       x="660.01343"
+       y="456.59814"
+       id="use2712" />
+    <use
+       xlink:href="#glyph-4-13"
+       x="664.96259"
+       y="456.59814"
+       id="use2714" />
+    <use
+       xlink:href="#glyph-4-8"
+       x="669.91174"
+       y="456.59814"
+       id="use2716" />
+    <use
+       xlink:href="#glyph-4-14"
+       x="674.8609"
+       y="456.59814"
+       id="use2718" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2726">
+    <use
+       xlink:href="#glyph-0-37"
+       x="679.81299"
+       y="456.59814"
+       id="use2722" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="682.80908"
+       y="456.59814"
+       id="use2724" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2748">
+    <use
+       xlink:href="#glyph-0-38"
+       x="684.81232"
+       y="456.59814"
+       id="use2728" />
+    <use
+       xlink:href="#glyph-0-39"
+       x="690.81323"
+       y="456.59814"
+       id="use2730" />
+    <use
+       xlink:href="#glyph-0-14"
+       x="697.31055"
+       y="456.59814"
+       id="use2732" />
+    <use
+       xlink:href="#glyph-0-40"
+       x="703.80792"
+       y="456.59814"
+       id="use2734" />
+    <use
+       xlink:href="#glyph-0-12"
+       x="706.30756"
+       y="456.59814"
+       id="use2736" />
+    <use
+       xlink:href="#glyph-0-41"
+       x="713.30573"
+       y="456.59814"
+       id="use2738" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="719.8031"
+       y="456.59814"
+       id="use2740" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="722.30273"
+       y="456.59814"
+       id="use2742" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="724.80243"
+       y="456.59814"
+       id="use2744" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="729.80609"
+       y="456.59814"
+       id="use2746" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2752">
+    <use
+       xlink:href="#glyph-0-37"
+       x="640.97827"
+       y="467.84442"
+       id="use2750" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g2772">
+    <use
+       xlink:href="#glyph-4-4"
+       x="643.97723"
+       y="467.84442"
+       id="use2754" />
+    <use
+       xlink:href="#glyph-4-6"
+       x="648.92639"
+       y="467.84442"
+       id="use2756" />
+    <use
+       xlink:href="#glyph-4-8"
+       x="653.87555"
+       y="467.84442"
+       id="use2758" />
+    <use
+       xlink:href="#glyph-4-2"
+       x="658.82471"
+       y="467.84442"
+       id="use2760" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="663.77386"
+       y="467.84442"
+       id="use2762" />
+    <use
+       xlink:href="#glyph-4-9"
+       x="668.72302"
+       y="467.84442"
+       id="use2764" />
+    <use
+       xlink:href="#glyph-4-14"
+       x="673.67218"
+       y="467.84442"
+       id="use2766" />
+    <use
+       xlink:href="#glyph-4-15"
+       x="678.62134"
+       y="467.84442"
+       id="use2768" />
+    <use
+       xlink:href="#glyph-4-3"
+       x="683.5705"
+       y="467.84442"
+       id="use2770" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g2796">
+    <use
+       xlink:href="#glyph-0-37"
+       x="688.52881"
+       y="467.84442"
+       id="use2774" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="691.5249"
+       y="467.84442"
+       id="use2776" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="694.02454"
+       y="467.84442"
+       id="use2778" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="699.02826"
+       y="467.84442"
+       id="use2780" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="704.03198"
+       y="467.84442"
+       id="use2782" />
+    <use
+       xlink:href="#glyph-0-18"
+       x="709.03571"
+       y="467.84442"
+       id="use2784" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="714.03937"
+       y="467.84442"
+       id="use2786" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="719.04309"
+       y="467.84442"
+       id="use2788" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="721.04193"
+       y="467.84442"
+       id="use2790" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="726.04565"
+       y="467.84442"
+       id="use2792" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="728.54529"
+       y="467.84442"
+       id="use2794" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 470.000171 996.998293 L 490.001613 996.998293 L 490.001613 1150.997407 L 470.000171 1150.997407 Z M 470.000171 996.998293 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path2798" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 50.19989%, 94.119263%)"
+     fill-opacity="1"
+     d="M 360.628906 808.132813 C 359.234375 808.132813 358.101563 807 358.101563 805.605469 C 358.101563 804.210938 359.234375 803.082031 360.628906 803.082031 C 362.023438 803.082031 363.15625 804.210938 363.15625 805.605469 C 363.15625 807 362.023438 808.132813 360.628906 808.132813 Z M 360.628906 802.4375 C 358.882813 802.4375 357.457031 803.859375 357.457031 805.605469 C 357.457031 807.355469 358.882813 808.777344 360.628906 808.777344 C 362.378906 808.777344 363.800781 807.355469 363.800781 805.605469 C 363.800781 803.859375 362.378906 802.4375 360.628906 802.4375 Z M 367.109375 806.820313 L 365.960938 806.820313 C 365.816406 806.820313 365.691406 806.917969 365.652344 807.0625 C 365.535156 807.511719 365.339844 807.832031 365.121094 808.214844 C 365.046875 808.34375 365.0625 808.5 365.167969 808.605469 L 365.976563 809.410156 L 364.421875 810.953125 L 363.613281 810.152344 C 363.507813 810.046875 363.351563 810.023438 363.222656 810.097656 L 363.148438 810.136719 C 362.773438 810.359375 362.496094 810.519531 362.085938 810.628906 C 361.941406 810.667969 361.84375 810.796875 361.84375 810.9375 L 361.84375 812.085938 L 359.414063 812.085938 L 359.414063 810.9375 C 359.414063 810.796875 359.316406 810.667969 359.175781 810.628906 C 358.734375 810.511719 358.410156 810.332031 358.007813 810.097656 C 357.878906 810.023438 357.722656 810.046875 357.617188 810.152344 L 356.8125 810.953125 L 355.277344 809.402344 L 356.078125 808.589844 C 356.175781 808.484375 356.199219 808.328125 356.125 808.203125 L 356.09375 808.140625 C 355.871094 807.757813 355.710938 807.480469 355.597656 807.0625 C 355.5625 806.917969 355.433594 806.820313 355.285156 806.820313 L 354.152344 806.820313 L 354.152344 804.390625 L 355.300781 804.390625 C 355.441406 804.390625 355.570313 804.296875 355.605469 804.152344 C 355.726563 803.703125 355.914063 803.367188 356.140625 802.976563 C 356.214844 802.847656 356.191406 802.691406 356.085938 802.585938 L 355.285156 801.785156 L 356.835938 800.230469 L 357.644531 801.042969 C 357.742188 801.144531 357.910156 801.160156 358.035156 801.09375 L 358.089844 801.054688 C 358.476563 800.832031 358.753906 800.671875 359.175781 800.5625 C 359.316406 800.523438 359.414063 800.394531 359.414063 800.246094 L 359.414063 799.128906 L 361.84375 799.128906 L 361.84375 800.269531 C 361.84375 800.410156 361.941406 800.546875 362.085938 800.582031 C 362.488281 800.6875 362.765625 800.855469 363.148438 801.078125 L 363.203125 801.109375 C 363.328125 801.183594 363.492188 801.167969 363.597656 801.054688 L 364.386719 800.261719 L 365.910156 801.804688 L 365.113281 802.609375 C 365.007813 802.714844 364.992188 802.871094 365.0625 802.996094 C 365.292969 803.394531 365.472656 803.703125 365.585938 804.152344 C 365.625 804.296875 365.75 804.390625 365.902344 804.390625 L 367.109375 804.390625 Z M 367.144531 803.746094 L 366.140625 803.746094 C 366.035156 803.425781 365.902344 803.164063 365.75 802.886719 L 366.394531 802.226563 C 366.628906 801.992188 366.628906 801.609375 366.394531 801.378906 L 364.820313 799.773438 C 364.589844 799.542969 364.183594 799.542969 363.953125 799.773438 L 363.3125 800.425781 C 363.050781 800.269531 362.796875 800.132813 362.488281 800.027344 L 362.488281 799.089844 C 362.488281 798.753906 362.21875 798.484375 361.882813 798.484375 L 359.378906 798.484375 C 359.039063 798.484375 358.769531 798.753906 358.769531 799.089844 L 358.769531 800.007813 C 358.457031 800.113281 358.195313 800.253906 357.921875 800.402344 L 357.265625 799.742188 C 357.03125 799.511719 356.640625 799.511719 356.410156 799.742188 L 354.796875 801.347656 C 354.683594 801.46875 354.617188 801.617188 354.617188 801.785156 C 354.617188 801.941406 354.683594 802.097656 354.796875 802.210938 L 355.457031 802.871094 C 355.300781 803.140625 355.164063 803.417969 355.050781 803.746094 L 354.113281 803.746094 C 353.777344 803.746094 353.507813 804.019531 353.507813 804.355469 L 353.507813 806.859375 C 353.507813 807.195313 353.777344 807.464844 354.113281 807.464844 L 355.042969 807.464844 C 355.148438 807.78125 355.292969 808.042969 355.441406 808.3125 L 354.78125 808.972656 C 354.550781 809.207031 354.550781 809.597656 354.789063 809.828125 L 356.386719 811.441406 C 356.5 811.550781 356.648438 811.621094 356.8125 811.621094 C 356.980469 811.621094 357.128906 811.550781 357.25 811.441406 L 357.902344 810.78125 C 358.179688 810.9375 358.449219 811.074219 358.769531 811.183594 L 358.769531 812.121094 C 358.769531 812.460938 359.039063 812.730469 359.378906 812.730469 L 361.882813 812.730469 C 362.21875 812.730469 362.488281 812.460938 362.488281 812.121094 L 362.488281 811.179688 C 362.804688 811.074219 363.066406 810.9375 363.328125 810.78125 L 363.996094 811.441406 C 364.230469 811.671875 364.609375 811.671875 364.851563 811.441406 L 366.464844 809.835938 C 366.574219 809.722656 366.644531 809.574219 366.644531 809.410156 C 366.644531 809.242188 366.574219 809.09375 366.464844 808.980469 L 365.804688 808.320313 C 365.953125 808.058594 366.097656 807.789063 366.199219 807.464844 L 367.144531 807.464844 C 367.484375 807.464844 367.753906 807.195313 367.753906 806.859375 L 367.753906 804.355469 C 367.753906 804.019531 367.484375 803.746094 367.144531 803.746094 Z M 367.144531 803.746094 "
+     id="path2800" />
+  <g
+     fill="#0080f0"
+     fill-opacity="1"
+     id="g2862">
+    <use
+       xlink:href="#glyph-5-1"
+       x="178.7921"
+       y="784.98895"
+       id="use2802" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="184.19119"
+       y="784.98895"
+       id="use2804" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="189.59027"
+       y="784.98895"
+       id="use2806" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="194.98935"
+       y="784.98895"
+       id="use2808" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="200.38843"
+       y="784.98895"
+       id="use2810" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="205.78752"
+       y="784.98895"
+       id="use2812" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="211.1866"
+       y="784.98895"
+       id="use2814" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="216.58569"
+       y="784.98895"
+       id="use2816" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="221.98477"
+       y="784.98895"
+       id="use2818" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="227.38385"
+       y="784.98895"
+       id="use2820" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="232.78293"
+       y="784.98895"
+       id="use2822" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="238.18202"
+       y="784.98895"
+       id="use2824" />
+    <use
+       xlink:href="#glyph-5-9"
+       x="243.5811"
+       y="784.98895"
+       id="use2826" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="248.98018"
+       y="784.98895"
+       id="use2828" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="254.37927"
+       y="784.98895"
+       id="use2830" />
+    <use
+       xlink:href="#glyph-5-10"
+       x="259.77835"
+       y="784.98895"
+       id="use2832" />
+    <use
+       xlink:href="#glyph-5-11"
+       x="265.17743"
+       y="784.98895"
+       id="use2834" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="270.57651"
+       y="784.98895"
+       id="use2836" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="275.97562"
+       y="784.98895"
+       id="use2838" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="281.37469"
+       y="784.98895"
+       id="use2840" />
+    <use
+       xlink:href="#glyph-5-9"
+       x="286.77377"
+       y="784.98895"
+       id="use2842" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="292.17285"
+       y="784.98895"
+       id="use2844" />
+    <use
+       xlink:href="#glyph-5-12"
+       x="297.57193"
+       y="784.98895"
+       id="use2846" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="302.97101"
+       y="784.98895"
+       id="use2848" />
+    <use
+       xlink:href="#glyph-5-13"
+       x="308.37012"
+       y="784.98895"
+       id="use2850" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="313.7692"
+       y="784.98895"
+       id="use2852" />
+    <use
+       xlink:href="#glyph-5-14"
+       x="319.16827"
+       y="784.98895"
+       id="use2854" />
+    <use
+       xlink:href="#glyph-5-15"
+       x="324.56735"
+       y="784.98895"
+       id="use2856" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="329.96643"
+       y="784.98895"
+       id="use2858" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="335.36551"
+       y="784.98895"
+       id="use2860" />
+  </g>
+  <g
+     fill="#0080f0"
+     fill-opacity="1"
+     id="g2922">
+    <use
+       xlink:href="#glyph-5-1"
+       x="181.48651"
+       y="796.23517"
+       id="use2864" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="186.8856"
+       y="796.23517"
+       id="use2866" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="192.28468"
+       y="796.23517"
+       id="use2868" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="197.68376"
+       y="796.23517"
+       id="use2870" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="203.08286"
+       y="796.23517"
+       id="use2872" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="208.48193"
+       y="796.23517"
+       id="use2874" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="213.88101"
+       y="796.23517"
+       id="use2876" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="219.28011"
+       y="796.23517"
+       id="use2878" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="224.67918"
+       y="796.23517"
+       id="use2880" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="230.07826"
+       y="796.23517"
+       id="use2882" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="235.47736"
+       y="796.23517"
+       id="use2884" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="240.87643"
+       y="796.23517"
+       id="use2886" />
+    <use
+       xlink:href="#glyph-5-9"
+       x="246.27551"
+       y="796.23517"
+       id="use2888" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="251.67461"
+       y="796.23517"
+       id="use2890" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="257.0737"
+       y="796.23517"
+       id="use2892" />
+    <use
+       xlink:href="#glyph-5-10"
+       x="262.47278"
+       y="796.23517"
+       id="use2894" />
+    <use
+       xlink:href="#glyph-5-11"
+       x="267.87186"
+       y="796.23517"
+       id="use2896" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="273.27094"
+       y="796.23517"
+       id="use2898" />
+    <use
+       xlink:href="#glyph-5-16"
+       x="278.67001"
+       y="796.23517"
+       id="use2900" />
+    <use
+       xlink:href="#glyph-5-10"
+       x="284.06909"
+       y="796.23517"
+       id="use2902" />
+    <use
+       xlink:href="#glyph-5-15"
+       x="289.4682"
+       y="796.23517"
+       id="use2904" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="294.86728"
+       y="796.23517"
+       id="use2906" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="300.26636"
+       y="796.23517"
+       id="use2908" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="305.66544"
+       y="796.23517"
+       id="use2910" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="311.06451"
+       y="796.23517"
+       id="use2912" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="316.46359"
+       y="796.23517"
+       id="use2914" />
+    <use
+       xlink:href="#glyph-5-16"
+       x="321.86267"
+       y="796.23517"
+       id="use2916" />
+    <use
+       xlink:href="#glyph-5-15"
+       x="327.26178"
+       y="796.23517"
+       id="use2918" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="332.66086"
+       y="796.23517"
+       id="use2920" />
+  </g>
+  <g
+     fill="#0080f0"
+     fill-opacity="1"
+     id="g2970">
+    <use
+       xlink:href="#glyph-5-1"
+       x="197.68817"
+       y="808.2312"
+       id="use2924" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="203.08725"
+       y="808.2312"
+       id="use2926" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="208.48633"
+       y="808.2312"
+       id="use2928" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="213.88542"
+       y="808.2312"
+       id="use2930" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="219.2845"
+       y="808.2312"
+       id="use2932" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="224.68358"
+       y="808.2312"
+       id="use2934" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="230.08267"
+       y="808.2312"
+       id="use2936" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="235.48175"
+       y="808.2312"
+       id="use2938" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="240.88083"
+       y="808.2312"
+       id="use2940" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="246.27992"
+       y="808.2312"
+       id="use2942" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="251.679"
+       y="808.2312"
+       id="use2944" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="257.07809"
+       y="808.2312"
+       id="use2946" />
+    <use
+       xlink:href="#glyph-5-9"
+       x="262.47717"
+       y="808.2312"
+       id="use2948" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="267.87625"
+       y="808.2312"
+       id="use2950" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="273.27533"
+       y="808.2312"
+       id="use2952" />
+    <use
+       xlink:href="#glyph-5-10"
+       x="278.67441"
+       y="808.2312"
+       id="use2954" />
+    <use
+       xlink:href="#glyph-5-11"
+       x="284.07349"
+       y="808.2312"
+       id="use2956" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="289.4726"
+       y="808.2312"
+       id="use2958" />
+    <use
+       xlink:href="#glyph-5-13"
+       x="294.87167"
+       y="808.2312"
+       id="use2960" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="300.27075"
+       y="808.2312"
+       id="use2962" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="305.66983"
+       y="808.2312"
+       id="use2964" />
+    <use
+       xlink:href="#glyph-5-14"
+       x="311.06891"
+       y="808.2312"
+       id="use2966" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="316.46799"
+       y="808.2312"
+       id="use2968" />
+  </g>
+  <g
+     fill="#0080f0"
+     fill-opacity="1"
+     id="g3008">
+    <use
+       xlink:href="#glyph-5-1"
+       x="211.18367"
+       y="819.47748"
+       id="use2972" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="216.58276"
+       y="819.47748"
+       id="use2974" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="221.98184"
+       y="819.47748"
+       id="use2976" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="227.38092"
+       y="819.47748"
+       id="use2978" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="232.78001"
+       y="819.47748"
+       id="use2980" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="238.17909"
+       y="819.47748"
+       id="use2982" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="243.57817"
+       y="819.47748"
+       id="use2984" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="248.97726"
+       y="819.47748"
+       id="use2986" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="254.37634"
+       y="819.47748"
+       id="use2988" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="259.77542"
+       y="819.47748"
+       id="use2990" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="265.1745"
+       y="819.47748"
+       id="use2992" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="270.57361"
+       y="819.47748"
+       id="use2994" />
+    <use
+       xlink:href="#glyph-5-17"
+       x="275.97269"
+       y="819.47748"
+       id="use2996" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="281.37177"
+       y="819.47748"
+       id="use2998" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="286.77084"
+       y="819.47748"
+       id="use3000" />
+    <use
+       xlink:href="#glyph-5-11"
+       x="292.16992"
+       y="819.47748"
+       id="use3002" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="297.569"
+       y="819.47748"
+       id="use3004" />
+    <use
+       xlink:href="#glyph-5-17"
+       x="302.96811"
+       y="819.47748"
+       id="use3006" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g3044">
+    <use
+       xlink:href="#glyph-6-1"
+       x="225.35864"
+       y="831.47345"
+       id="use3010" />
+    <use
+       xlink:href="#glyph-6-2"
+       x="229.40796"
+       y="831.47345"
+       id="use3012" />
+    <use
+       xlink:href="#glyph-6-3"
+       x="233.45728"
+       y="831.47345"
+       id="use3014" />
+    <use
+       xlink:href="#glyph-6-4"
+       x="237.50659"
+       y="831.47345"
+       id="use3016" />
+    <use
+       xlink:href="#glyph-6-5"
+       x="241.55591"
+       y="831.47345"
+       id="use3018" />
+    <use
+       xlink:href="#glyph-6-6"
+       x="245.60521"
+       y="831.47345"
+       id="use3020" />
+    <use
+       xlink:href="#glyph-6-7"
+       x="249.65453"
+       y="831.47345"
+       id="use3022" />
+    <use
+       xlink:href="#glyph-6-8"
+       x="253.70384"
+       y="831.47345"
+       id="use3024" />
+    <use
+       xlink:href="#glyph-6-9"
+       x="257.75314"
+       y="831.47345"
+       id="use3026" />
+    <use
+       xlink:href="#glyph-6-10"
+       x="261.80246"
+       y="831.47345"
+       id="use3028" />
+    <use
+       xlink:href="#glyph-6-11"
+       x="265.85178"
+       y="831.47345"
+       id="use3030" />
+    <use
+       xlink:href="#glyph-6-12"
+       x="269.90109"
+       y="831.47345"
+       id="use3032" />
+    <use
+       xlink:href="#glyph-6-13"
+       x="273.95041"
+       y="831.47345"
+       id="use3034" />
+    <use
+       xlink:href="#glyph-6-14"
+       x="277.99973"
+       y="831.47345"
+       id="use3036" />
+    <use
+       xlink:href="#glyph-6-15"
+       x="282.04901"
+       y="831.47345"
+       id="use3038" />
+    <use
+       xlink:href="#glyph-6-12"
+       x="286.09833"
+       y="831.47345"
+       id="use3040" />
+    <use
+       xlink:href="#glyph-6-16"
+       x="290.14764"
+       y="831.47345"
+       id="use3042" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3086">
+    <use
+       xlink:href="#glyph-7-1"
+       x="206.16972"
+       y="478.34091"
+       id="use3046" />
+    <use
+       xlink:href="#glyph-7-2"
+       x="215.91574"
+       y="478.34091"
+       id="use3048" />
+    <use
+       xlink:href="#glyph-7-3"
+       x="224.15935"
+       y="478.34091"
+       id="use3050" />
+    <use
+       xlink:href="#glyph-7-4"
+       x="232.40294"
+       y="478.34091"
+       id="use3052" />
+    <use
+       xlink:href="#glyph-7-5"
+       x="239.90849"
+       y="478.34091"
+       id="use3054" />
+    <use
+       xlink:href="#glyph-7-6"
+       x="245.16042"
+       y="478.34091"
+       id="use3056" />
+    <use
+       xlink:href="#glyph-7-7"
+       x="248.9099"
+       y="478.34091"
+       id="use3058" />
+    <use
+       xlink:href="#glyph-7-8"
+       x="256.41547"
+       y="478.34091"
+       id="use3060" />
+    <use
+       xlink:href="#glyph-7-9"
+       x="264.65906"
+       y="478.34091"
+       id="use3062" />
+    <use
+       xlink:href="#glyph-7-10"
+       x="269.15317"
+       y="478.34091"
+       id="use3064" />
+    <use
+       xlink:href="#glyph-7-4"
+       x="277.39676"
+       y="478.34091"
+       id="use3066" />
+    <use
+       xlink:href="#glyph-7-11"
+       x="284.90231"
+       y="478.34091"
+       id="use3068" />
+    <use
+       xlink:href="#glyph-7-9"
+       x="293.14594"
+       y="478.34091"
+       id="use3070" />
+    <use
+       xlink:href="#glyph-7-12"
+       x="297.64005"
+       y="478.34091"
+       id="use3072" />
+    <use
+       xlink:href="#glyph-7-13"
+       x="301.38953"
+       y="478.34091"
+       id="use3074" />
+    <use
+       xlink:href="#glyph-7-7"
+       x="308.89508"
+       y="478.34091"
+       id="use3076" />
+    <use
+       xlink:href="#glyph-7-9"
+       x="316.40063"
+       y="478.34091"
+       id="use3078" />
+    <use
+       xlink:href="#glyph-7-12"
+       x="320.89474"
+       y="478.34091"
+       id="use3080" />
+    <use
+       xlink:href="#glyph-7-2"
+       x="324.64423"
+       y="478.34091"
+       id="use3082" />
+    <use
+       xlink:href="#glyph-7-11"
+       x="332.88782"
+       y="478.34091"
+       id="use3084" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3128">
+    <use
+       xlink:href="#glyph-0-42"
+       x="211.42969"
+       y="493.33594"
+       id="use3088" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="217.92703"
+       y="493.33594"
+       id="use3090" />
+    <use
+       xlink:href="#glyph-0-9"
+       x="222.93074"
+       y="493.33594"
+       id="use3092" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="229.4281"
+       y="493.33594"
+       id="use3094" />
+    <use
+       xlink:href="#glyph-0-10"
+       x="231.92775"
+       y="493.33594"
+       id="use3096" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="238.42509"
+       y="493.33594"
+       id="use3098" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="243.4288"
+       y="493.33594"
+       id="use3100" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="248.43251"
+       y="493.33594"
+       id="use3102" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="253.43622"
+       y="493.33594"
+       id="use3104" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="256.43231"
+       y="493.33594"
+       id="use3106" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="258.93195"
+       y="493.33594"
+       id="use3108" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="263.93567"
+       y="493.33594"
+       id="use3110" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="268.93936"
+       y="493.33594"
+       id="use3112" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="273.94308"
+       y="493.33594"
+       id="use3114" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="278.94678"
+       y="493.33594"
+       id="use3116" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="280.94562"
+       y="493.33594"
+       id="use3118" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="285.94934"
+       y="493.33594"
+       id="use3120" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="290.44785"
+       y="493.33594"
+       id="use3122" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="292.94751"
+       y="493.33594"
+       id="use3124" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="297.9512"
+       y="493.33594"
+       id="use3126" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3176">
+    <use
+       xlink:href="#glyph-0-23"
+       x="211.42969"
+       y="504.58218"
+       id="use3130" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="216.4334"
+       y="504.58218"
+       id="use3132" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="221.4371"
+       y="504.58218"
+       id="use3134" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="223.93675"
+       y="504.58218"
+       id="use3136" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="228.94046"
+       y="504.58218"
+       id="use3138" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="233.94417"
+       y="504.58218"
+       id="use3140" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="238.94788"
+       y="504.58218"
+       id="use3142" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="241.44754"
+       y="504.58218"
+       id="use3144" />
+    <use
+       xlink:href="#glyph-0-28"
+       x="243.44638"
+       y="504.58218"
+       id="use3146" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="247.94489"
+       y="504.58218"
+       id="use3148" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="252.94859"
+       y="504.58218"
+       id="use3150" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="255.44824"
+       y="504.58218"
+       id="use3152" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="260.45197"
+       y="504.58218"
+       id="use3154" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="265.45566"
+       y="504.58218"
+       id="use3156" />
+    <use
+       xlink:href="#glyph-0-12"
+       x="267.95532"
+       y="504.58218"
+       id="use3158" />
+    <use
+       xlink:href="#glyph-0-13"
+       x="274.95349"
+       y="504.58218"
+       id="use3160" />
+    <use
+       xlink:href="#glyph-0-14"
+       x="277.45312"
+       y="504.58218"
+       id="use3162" />
+    <use
+       xlink:href="#glyph-0-10"
+       x="283.9505"
+       y="504.58218"
+       id="use3164" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="290.44785"
+       y="504.58218"
+       id="use3166" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="292.94751"
+       y="504.58218"
+       id="use3168" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="297.9512"
+       y="504.58218"
+       id="use3170" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="302.44971"
+       y="504.58218"
+       id="use3172" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="307.4534"
+       y="504.58218"
+       id="use3174" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3180">
+    <use
+       xlink:href="#glyph-0-33"
+       x="309.95306"
+       y="504.58218"
+       id="use3178" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 509.997844 868.997404 L 719.999952 868.997404 L 719.999952 948.99796 L 509.997844 948.99796 Z M 509.997844 868.997404 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path3182" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3186">
+    <use
+       xlink:href="#glyph-2-31"
+       x="383.87234"
+       y="661.28009"
+       id="use3184" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3190">
+    <use
+       xlink:href="#glyph-2-20"
+       x="383.87234"
+       y="670.2771"
+       id="use3188" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3222">
+    <use
+       xlink:href="#glyph-2-20"
+       x="388.37158"
+       y="670.2771"
+       id="use3192" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="392.87082"
+       y="670.2771"
+       id="use3194" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="397.37006"
+       y="670.2771"
+       id="use3196" />
+    <use
+       xlink:href="#glyph-2-17"
+       x="401.86929"
+       y="670.2771"
+       id="use3198" />
+    <use
+       xlink:href="#glyph-2-28"
+       x="406.36853"
+       y="670.2771"
+       id="use3200" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="410.86777"
+       y="670.2771"
+       id="use3202" />
+    <use
+       xlink:href="#glyph-2-5"
+       x="415.36697"
+       y="670.2771"
+       id="use3204" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="419.86621"
+       y="670.2771"
+       id="use3206" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="424.36545"
+       y="670.2771"
+       id="use3208" />
+    <use
+       xlink:href="#glyph-2-37"
+       x="428.86469"
+       y="670.2771"
+       id="use3210" />
+    <use
+       xlink:href="#glyph-2-38"
+       x="433.36392"
+       y="670.2771"
+       id="use3212" />
+    <use
+       xlink:href="#glyph-2-39"
+       x="437.86316"
+       y="670.2771"
+       id="use3214" />
+    <use
+       xlink:href="#glyph-2-40"
+       x="442.3624"
+       y="670.2771"
+       id="use3216" />
+    <use
+       xlink:href="#glyph-2-41"
+       x="446.86163"
+       y="670.2771"
+       id="use3218" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="451.36087"
+       y="670.2771"
+       id="use3220" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3226">
+    <use
+       xlink:href="#glyph-2-20"
+       x="383.87234"
+       y="679.27411"
+       id="use3224" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3284">
+    <use
+       xlink:href="#glyph-2-20"
+       x="388.37158"
+       y="679.27411"
+       id="use3228" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="392.87082"
+       y="679.27411"
+       id="use3230" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="397.37006"
+       y="679.27411"
+       id="use3232" />
+    <use
+       xlink:href="#glyph-2-15"
+       x="401.86929"
+       y="679.27411"
+       id="use3234" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="406.36853"
+       y="679.27411"
+       id="use3236" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="410.86777"
+       y="679.27411"
+       id="use3238" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="415.36697"
+       y="679.27411"
+       id="use3240" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="419.86621"
+       y="679.27411"
+       id="use3242" />
+    <use
+       xlink:href="#glyph-2-5"
+       x="424.36545"
+       y="679.27411"
+       id="use3244" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="428.86469"
+       y="679.27411"
+       id="use3246" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="433.36392"
+       y="679.27411"
+       id="use3248" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="437.86316"
+       y="679.27411"
+       id="use3250" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="442.3624"
+       y="679.27411"
+       id="use3252" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="446.86163"
+       y="679.27411"
+       id="use3254" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="451.36087"
+       y="679.27411"
+       id="use3256" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="455.86011"
+       y="679.27411"
+       id="use3258" />
+    <use
+       xlink:href="#glyph-2-34"
+       x="460.35934"
+       y="679.27411"
+       id="use3260" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="464.85858"
+       y="679.27411"
+       id="use3262" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="469.35782"
+       y="679.27411"
+       id="use3264" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="473.85706"
+       y="679.27411"
+       id="use3266" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="478.35629"
+       y="679.27411"
+       id="use3268" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="482.85553"
+       y="679.27411"
+       id="use3270" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="487.35477"
+       y="679.27411"
+       id="use3272" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="491.854"
+       y="679.27411"
+       id="use3274" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="496.35324"
+       y="679.27411"
+       id="use3276" />
+    <use
+       xlink:href="#glyph-2-15"
+       x="500.85248"
+       y="679.27411"
+       id="use3278" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="505.35172"
+       y="679.27411"
+       id="use3280" />
+    <use
+       xlink:href="#glyph-2-33"
+       x="509.85095"
+       y="679.27411"
+       id="use3282" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3288">
+    <use
+       xlink:href="#glyph-2-20"
+       x="383.87234"
+       y="688.27112"
+       id="use3286" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3346">
+    <use
+       xlink:href="#glyph-2-20"
+       x="388.37158"
+       y="688.27112"
+       id="use3290" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="392.87082"
+       y="688.27112"
+       id="use3292" />
+    <use
+       xlink:href="#glyph-2-30"
+       x="397.37006"
+       y="688.27112"
+       id="use3294" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="401.86929"
+       y="688.27112"
+       id="use3296" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="406.36853"
+       y="688.27112"
+       id="use3298" />
+    <use
+       xlink:href="#glyph-2-17"
+       x="410.86777"
+       y="688.27112"
+       id="use3300" />
+    <use
+       xlink:href="#glyph-2-3"
+       x="415.36697"
+       y="688.27112"
+       id="use3302" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="419.86621"
+       y="688.27112"
+       id="use3304" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="424.36545"
+       y="688.27112"
+       id="use3306" />
+    <use
+       xlink:href="#glyph-2-5"
+       x="428.86469"
+       y="688.27112"
+       id="use3308" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="433.36392"
+       y="688.27112"
+       id="use3310" />
+    <use
+       xlink:href="#glyph-2-42"
+       x="437.86316"
+       y="688.27112"
+       id="use3312" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="442.3624"
+       y="688.27112"
+       id="use3314" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="446.86163"
+       y="688.27112"
+       id="use3316" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="451.36087"
+       y="688.27112"
+       id="use3318" />
+    <use
+       xlink:href="#glyph-2-13"
+       x="455.86011"
+       y="688.27112"
+       id="use3320" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="460.35934"
+       y="688.27112"
+       id="use3322" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="464.85858"
+       y="688.27112"
+       id="use3324" />
+    <use
+       xlink:href="#glyph-2-33"
+       x="469.35782"
+       y="688.27112"
+       id="use3326" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="473.85706"
+       y="688.27112"
+       id="use3328" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="478.35629"
+       y="688.27112"
+       id="use3330" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="482.85553"
+       y="688.27112"
+       id="use3332" />
+    <use
+       xlink:href="#glyph-2-15"
+       x="487.35477"
+       y="688.27112"
+       id="use3334" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="491.854"
+       y="688.27112"
+       id="use3336" />
+    <use
+       xlink:href="#glyph-2-22"
+       x="496.35324"
+       y="688.27112"
+       id="use3338" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="500.85248"
+       y="688.27112"
+       id="use3340" />
+    <use
+       xlink:href="#glyph-2-32"
+       x="505.35172"
+       y="688.27112"
+       id="use3342" />
+    <use
+       xlink:href="#glyph-2-43"
+       x="509.85095"
+       y="688.27112"
+       id="use3344" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3350">
+    <use
+       xlink:href="#glyph-2-20"
+       x="383.87234"
+       y="697.26813"
+       id="use3348" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3354">
+    <use
+       xlink:href="#glyph-2-20"
+       x="388.37158"
+       y="697.26813"
+       id="use3352" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3358">
+    <use
+       xlink:href="#glyph-2-20"
+       x="392.87082"
+       y="697.26813"
+       id="use3356" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3406">
+    <use
+       xlink:href="#glyph-2-11"
+       x="397.37006"
+       y="697.26813"
+       id="use3360" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="401.86929"
+       y="697.26813"
+       id="use3362" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="406.36853"
+       y="697.26813"
+       id="use3364" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="410.86777"
+       y="697.26813"
+       id="use3366" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="415.36697"
+       y="697.26813"
+       id="use3368" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="419.86621"
+       y="697.26813"
+       id="use3370" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="424.36545"
+       y="697.26813"
+       id="use3372" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="428.86469"
+       y="697.26813"
+       id="use3374" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="433.36392"
+       y="697.26813"
+       id="use3376" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="437.86316"
+       y="697.26813"
+       id="use3378" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="442.3624"
+       y="697.26813"
+       id="use3380" />
+    <use
+       xlink:href="#glyph-2-35"
+       x="446.86163"
+       y="697.26813"
+       id="use3382" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="451.36087"
+       y="697.26813"
+       id="use3384" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="455.86011"
+       y="697.26813"
+       id="use3386" />
+    <use
+       xlink:href="#glyph-2-21"
+       x="460.35934"
+       y="697.26813"
+       id="use3388" />
+    <use
+       xlink:href="#glyph-2-16"
+       x="464.85858"
+       y="697.26813"
+       id="use3390" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="469.35782"
+       y="697.26813"
+       id="use3392" />
+    <use
+       xlink:href="#glyph-2-15"
+       x="473.85706"
+       y="697.26813"
+       id="use3394" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="478.35629"
+       y="697.26813"
+       id="use3396" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="482.85553"
+       y="697.26813"
+       id="use3398" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="487.35477"
+       y="697.26813"
+       id="use3400" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="491.854"
+       y="697.26813"
+       id="use3402" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="496.35324"
+       y="697.26813"
+       id="use3404" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3410">
+    <use
+       xlink:href="#glyph-2-36"
+       x="383.87234"
+       y="706.26514"
+       id="use3408" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 470.000171 828.999732 L 490.001613 828.999732 L 490.001613 868.997404 L 470.000171 868.997404 Z M 470.000171 828.999732 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path3412" />
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 490.001613 838.997847 L 729.127987 838.028775 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path3414" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 734.379733 837.997515 L 727.398245 841.529939 L 729.127987 838.028775 L 727.372195 834.527611 Z M 734.379733 837.997515 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path3416" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3424">
+    <use
+       xlink:href="#glyph-1-19"
+       x="375.58994"
+       y="625.29205"
+       id="use3418" />
+    <use
+       xlink:href="#glyph-1-20"
+       x="382.00491"
+       y="625.29205"
+       id="use3420" />
+    <use
+       xlink:href="#glyph-1-21"
+       x="387.50577"
+       y="625.29205"
+       id="use3422" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3470">
+    <use
+       xlink:href="#glyph-1-5"
+       x="392.39453"
+       y="625.29205"
+       id="use3426" />
+    <use
+       xlink:href="#glyph-1-22"
+       x="394.68588"
+       y="625.29205"
+       id="use3428" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="399.27261"
+       y="625.29205"
+       id="use3430" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="401.56396"
+       y="625.29205"
+       id="use3432" />
+    <use
+       xlink:href="#glyph-1-24"
+       x="403.85532"
+       y="625.29205"
+       id="use3434" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="408.44205"
+       y="625.29205"
+       id="use3436" />
+    <use
+       xlink:href="#glyph-1-25"
+       x="412.56567"
+       y="625.29205"
+       id="use3438" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="414.85703"
+       y="625.29205"
+       id="use3440" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="417.14838"
+       y="625.29205"
+       id="use3442" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="419.43973"
+       y="625.29205"
+       id="use3444" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="424.02646"
+       y="625.29205"
+       id="use3446" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="425.85873"
+       y="625.29205"
+       id="use3448" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="430.44547"
+       y="625.29205"
+       id="use3450" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="434.56909"
+       y="625.29205"
+       id="use3452" />
+    <use
+       xlink:href="#glyph-1-24"
+       x="436.86044"
+       y="625.29205"
+       id="use3454" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="441.44717"
+       y="625.29205"
+       id="use3456" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="444.19357"
+       y="625.29205"
+       id="use3458" />
+    <use
+       xlink:href="#glyph-1-42"
+       x="448.7803"
+       y="625.29205"
+       id="use3460" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="452.90396"
+       y="625.29205"
+       id="use3462" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="454.73624"
+       y="625.29205"
+       id="use3464" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="459.32297"
+       y="625.29205"
+       id="use3466" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="463.9097"
+       y="625.29205"
+       id="use3468" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3506">
+    <use
+       xlink:href="#glyph-1-28"
+       x="466.20105"
+       y="625.29205"
+       id="use3472" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="468.4924"
+       y="625.29205"
+       id="use3474" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="472.61603"
+       y="625.29205"
+       id="use3476" />
+    <use
+       xlink:href="#glyph-1-29"
+       x="477.20276"
+       y="625.29205"
+       id="use3478" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="484.07278"
+       y="625.29205"
+       id="use3480" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="486.36414"
+       y="625.29205"
+       id="use3482" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="488.65549"
+       y="625.29205"
+       id="use3484" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="490.94684"
+       y="625.29205"
+       id="use3486" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="493.23819"
+       y="625.29205"
+       id="use3488" />
+    <use
+       xlink:href="#glyph-1-43"
+       x="495.52954"
+       y="625.29205"
+       id="use3490" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="500.11627"
+       y="625.29205"
+       id="use3492" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="504.2399"
+       y="625.29205"
+       id="use3494" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="508.82663"
+       y="625.29205"
+       id="use3496" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="511.57303"
+       y="625.29205"
+       id="use3498" />
+    <use
+       xlink:href="#glyph-1-18"
+       x="513.40533"
+       y="625.29205"
+       id="use3500" />
+    <use
+       xlink:href="#glyph-1-47"
+       x="517.99207"
+       y="625.29205"
+       id="use3502" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="520.28339"
+       y="625.29205"
+       id="use3504" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 735.499897 862.000286 L 496.368313 862.000286 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path3508" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 491.121777 862.000286 L 498.118895 858.499122 L 496.368313 862.000286 L 498.118895 865.50145 Z M 491.121777 862.000286 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path3510" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3520">
+    <use
+       xlink:href="#glyph-1-45"
+       x="439.22504"
+       y="641.0368"
+       id="use3512" />
+    <use
+       xlink:href="#glyph-1-41"
+       x="443.34866"
+       y="641.0368"
+       id="use3514" />
+    <use
+       xlink:href="#glyph-1-11"
+       x="448.84952"
+       y="641.0368"
+       id="use3516" />
+    <use
+       xlink:href="#glyph-1-46"
+       x="455.2645"
+       y="641.0368"
+       id="use3518" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 622.998954 871.998402 L 622.998954 862.000286 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path3522" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="0.24"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 50.19989%, 94.119263%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 710.00167 883.001894 C 710.00167 883.392649 709.95999 883.783404 709.887049 884.168949 C 709.808898 884.554494 709.694277 884.929618 709.543185 885.294323 C 709.392093 885.659027 709.209741 886.008102 708.990918 886.331126 C 708.772095 886.65936 708.522012 886.961544 708.240668 887.242887 C 707.964535 887.519021 707.662351 887.769104 707.334117 887.987927 C 707.005883 888.206749 706.662019 888.394312 706.297314 888.545404 C 705.932609 888.696496 705.557485 888.805907 705.17194 888.884058 C 704.786395 888.962209 704.39564 888.998679 703.999675 888.998679 C 703.60371 888.998679 703.218165 888.962209 702.82741 888.884058 C 702.441866 888.805907 702.066741 888.696496 701.702036 888.545404 C 701.337332 888.394312 700.993467 888.206749 700.665233 887.987927 C 700.336999 887.769104 700.034815 887.519021 699.758682 887.242887 C 699.477338 886.961544 699.232465 886.65936 699.013642 886.331126 C 698.79482 886.008102 698.607257 885.659027 698.456165 885.294323 C 698.305074 884.929618 698.190452 884.554494 698.117511 884.168949 C 698.03936 883.783404 697.99768 883.392649 697.99768 883.001894 C 697.99768 882.605929 698.03936 882.215174 698.117511 881.829629 C 698.190452 881.444084 698.305074 881.06896 698.456165 880.704255 C 698.607257 880.339551 698.79482 879.995686 699.013642 879.667452 C 699.232465 879.339218 699.477338 879.037034 699.758682 878.755691 C 700.034815 878.479557 700.336999 878.229474 700.665233 878.010651 C 700.993467 877.791829 701.337332 877.609476 701.702036 877.458384 C 702.066741 877.307293 702.441866 877.192671 702.82741 877.11452 C 703.218165 877.036369 703.60371 876.999899 703.999675 876.999899 C 704.39564 876.999899 704.786395 877.036369 705.17194 877.11452 C 705.557485 877.192671 705.932609 877.307293 706.297314 877.458384 C 706.662019 877.609476 707.005883 877.791829 707.334117 878.010651 C 707.662351 878.229474 707.964535 878.479557 708.240668 878.755691 C 708.522012 879.037034 708.772095 879.339218 708.990918 879.667452 C 709.209741 879.995686 709.392093 880.339551 709.543185 880.704255 C 709.694277 881.06896 709.808898 881.444084 709.887049 881.829629 C 709.95999 882.215174 710.00167 882.605929 710.00167 883.001894 Z M 710.00167 883.001894 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0, 0)"
+     id="path3524" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 50.19989%, 94.119263%)"
+     fill-opacity="1"
+     d="M 527.105469 660.679688 L 528.273438 660.679688 L 528.273438 664.730469 C 528.273438 664.804688 528.304688 664.871094 528.355469 664.917969 C 528.402344 664.96875 528.46875 665 528.542969 665 L 527.105469 665 C 527.179688 665 527.246094 664.96875 527.292969 664.917969 C 527.34375 664.871094 527.375 664.804688 527.375 664.730469 L 527.375 660.949219 C 527.375 660.800781 527.253906 660.679688 527.105469 660.679688 "
+     id="path3526" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 50.19989%, 94.119263%)"
+     fill-opacity="1"
+     d="M 528.273438 659.78125 C 528.273438 659.90625 528.230469 660.011719 528.140625 660.097656 C 528.054688 660.1875 527.949219 660.230469 527.824219 660.230469 C 527.699219 660.230469 527.59375 660.1875 527.507813 660.097656 C 527.417969 660.011719 527.375 659.90625 527.375 659.78125 C 527.375 659.65625 527.417969 659.550781 527.507813 659.460938 C 527.59375 659.375 527.699219 659.332031 527.824219 659.332031 C 527.949219 659.332031 528.054688 659.375 528.140625 659.460938 C 528.230469 659.550781 528.273438 659.65625 528.273438 659.78125 Z M 528.273438 659.78125 "
+     id="path3528" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 50.19989%, 94.119263%)"
+     fill-opacity="1"
+     d="M 359.878906 639.816406 C 358.484375 639.816406 357.355469 638.683594 357.355469 637.289063 C 357.355469 635.894531 358.484375 634.761719 359.878906 634.761719 C 361.273438 634.761719 362.40625 635.894531 362.40625 637.289063 C 362.40625 638.683594 361.273438 639.816406 359.878906 639.816406 Z M 359.878906 634.117188 C 358.132813 634.117188 356.707031 635.542969 356.707031 637.289063 C 356.707031 639.035156 358.132813 640.460938 359.878906 640.460938 C 361.628906 640.460938 363.050781 639.035156 363.050781 637.289063 C 363.050781 635.542969 361.628906 634.117188 359.878906 634.117188 Z M 366.359375 638.503906 L 365.210938 638.503906 C 365.070313 638.503906 364.941406 638.601563 364.902344 638.742188 C 364.785156 639.191406 364.589844 639.515625 364.371094 639.898438 C 364.296875 640.023438 364.3125 640.183594 364.417969 640.285156 L 365.226563 641.089844 L 363.675781 642.632813 L 362.863281 641.832031 C 362.757813 641.726563 362.601563 641.703125 362.472656 641.777344 L 362.398438 641.816406 C 362.023438 642.042969 361.746094 642.199219 361.335938 642.3125 C 361.191406 642.347656 361.09375 642.476563 361.09375 642.617188 L 361.09375 643.765625 L 358.664063 643.765625 L 358.664063 642.617188 C 358.664063 642.476563 358.566406 642.347656 358.425781 642.3125 C 357.984375 642.191406 357.660156 642.011719 357.257813 641.777344 C 357.128906 641.703125 356.972656 641.726563 356.867188 641.832031 L 356.0625 642.632813 L 354.527344 641.082031 L 355.328125 640.273438 C 355.425781 640.167969 355.449219 640.007813 355.375 639.882813 L 355.34375 639.820313 C 355.121094 639.441406 354.960938 639.164063 354.847656 638.742188 C 354.8125 638.601563 354.683594 638.503906 354.535156 638.503906 L 353.402344 638.503906 L 353.402344 636.074219 L 354.550781 636.074219 C 354.691406 636.074219 354.820313 635.976563 354.855469 635.832031 C 354.976563 635.382813 355.164063 635.046875 355.390625 634.65625 C 355.464844 634.527344 355.441406 634.371094 355.335938 634.265625 L 354.535156 633.464844 L 356.085938 631.914063 L 356.894531 632.722656 C 356.992188 632.828125 357.160156 632.84375 357.285156 632.773438 L 357.339844 632.738281 C 357.730469 632.511719 358.007813 632.355469 358.425781 632.242188 C 358.566406 632.203125 358.664063 632.078125 358.664063 631.925781 L 358.664063 630.808594 L 361.09375 630.808594 L 361.09375 631.949219 C 361.09375 632.09375 361.191406 632.226563 361.335938 632.265625 C 361.738281 632.371094 362.015625 632.535156 362.398438 632.757813 L 362.453125 632.789063 C 362.578125 632.863281 362.746094 632.847656 362.847656 632.738281 L 363.636719 631.941406 L 365.160156 633.488281 L 364.363281 634.289063 C 364.257813 634.394531 364.242188 634.550781 364.3125 634.679688 C 364.542969 635.078125 364.722656 635.382813 364.835938 635.832031 C 364.875 635.976563 365 636.074219 365.152344 636.074219 L 366.359375 636.074219 Z M 366.394531 635.429688 L 365.390625 635.429688 C 365.285156 635.105469 365.152344 634.84375 365 634.566406 L 365.644531 633.90625 C 365.878906 633.675781 365.878906 633.292969 365.644531 633.058594 L 364.070313 631.453125 C 363.839844 631.222656 363.433594 631.222656 363.203125 631.453125 L 362.5625 632.105469 C 362.300781 631.949219 362.046875 631.816406 361.738281 631.710938 L 361.738281 630.773438 C 361.738281 630.433594 361.46875 630.164063 361.132813 630.164063 L 358.628906 630.164063 C 358.289063 630.164063 358.019531 630.433594 358.019531 630.773438 L 358.019531 631.6875 C 357.707031 631.792969 357.445313 631.933594 357.171875 632.085938 L 356.515625 631.425781 C 356.28125 631.191406 355.890625 631.191406 355.660156 631.425781 L 354.046875 633.03125 C 353.933594 633.148438 353.867188 633.300781 353.867188 633.464844 C 353.867188 633.621094 353.933594 633.777344 354.046875 633.890625 L 354.707031 634.550781 C 354.550781 634.820313 354.414063 635.097656 354.300781 635.429688 L 353.363281 635.429688 C 353.027344 635.429688 352.757813 635.699219 352.757813 636.035156 L 352.757813 638.539063 C 352.757813 638.878906 353.027344 639.148438 353.363281 639.148438 L 354.292969 639.148438 C 354.398438 639.460938 354.542969 639.726563 354.691406 639.996094 L 354.03125 640.65625 C 353.800781 640.886719 353.800781 641.277344 354.039063 641.507813 L 355.636719 643.121094 C 355.75 643.234375 355.898438 643.300781 356.0625 643.300781 C 356.230469 643.300781 356.378906 643.234375 356.5 643.121094 L 357.152344 642.460938 C 357.429688 642.617188 357.699219 642.753906 358.019531 642.867188 L 358.019531 643.804688 C 358.019531 644.140625 358.289063 644.410156 358.628906 644.410156 L 361.132813 644.410156 C 361.46875 644.410156 361.738281 644.140625 361.738281 643.804688 L 361.738281 642.859375 C 362.054688 642.753906 362.316406 642.617188 362.578125 642.460938 L 363.246094 643.121094 C 363.480469 643.355469 363.863281 643.355469 364.101563 643.121094 L 365.714844 641.515625 C 365.824219 641.402344 365.894531 641.253906 365.894531 641.089844 C 365.894531 640.925781 365.824219 640.773438 365.714844 640.660156 L 365.054688 640.003906 C 365.203125 639.738281 365.347656 639.46875 365.449219 639.148438 L 366.394531 639.148438 C 366.734375 639.148438 367.003906 638.878906 367.003906 638.539063 L 367.003906 636.035156 C 367.003906 635.699219 366.734375 635.429688 366.394531 635.429688 Z M 366.394531 635.429688 "
+     id="path3530" />
+  <g
+     fill="#0080f0"
+     fill-opacity="1"
+     id="g3586">
+    <use
+       xlink:href="#glyph-5-1"
+       x="189.5112"
+       y="637.28809"
+       id="use3532" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="194.91028"
+       y="637.28809"
+       id="use3534" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="200.30936"
+       y="637.28809"
+       id="use3536" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="205.70845"
+       y="637.28809"
+       id="use3538" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="211.10753"
+       y="637.28809"
+       id="use3540" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="216.50661"
+       y="637.28809"
+       id="use3542" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="221.9057"
+       y="637.28809"
+       id="use3544" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="227.30478"
+       y="637.28809"
+       id="use3546" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="232.70386"
+       y="637.28809"
+       id="use3548" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="238.10295"
+       y="637.28809"
+       id="use3550" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="243.50203"
+       y="637.28809"
+       id="use3552" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="248.90111"
+       y="637.28809"
+       id="use3554" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="254.3002"
+       y="637.28809"
+       id="use3556" />
+    <use
+       xlink:href="#glyph-5-9"
+       x="259.69928"
+       y="637.28809"
+       id="use3558" />
+    <use
+       xlink:href="#glyph-5-18"
+       x="265.09836"
+       y="637.28809"
+       id="use3560" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="270.49744"
+       y="637.28809"
+       id="use3562" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="275.89655"
+       y="637.28809"
+       id="use3564" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="281.29562"
+       y="637.28809"
+       id="use3566" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="286.6947"
+       y="637.28809"
+       id="use3568" />
+    <use
+       xlink:href="#glyph-5-10"
+       x="292.09378"
+       y="637.28809"
+       id="use3570" />
+    <use
+       xlink:href="#glyph-5-17"
+       x="297.49286"
+       y="637.28809"
+       id="use3572" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="302.89194"
+       y="637.28809"
+       id="use3574" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="308.29105"
+       y="637.28809"
+       id="use3576" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="313.69012"
+       y="637.28809"
+       id="use3578" />
+    <use
+       xlink:href="#glyph-5-18"
+       x="319.0892"
+       y="637.28809"
+       id="use3580" />
+    <use
+       xlink:href="#glyph-5-13"
+       x="324.48828"
+       y="637.28809"
+       id="use3582" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="329.88736"
+       y="637.28809"
+       id="use3584" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g3676">
+    <use
+       xlink:href="#glyph-6-1"
+       x="173.32127"
+       y="649.28406"
+       id="use3588" />
+    <use
+       xlink:href="#glyph-6-2"
+       x="177.37057"
+       y="649.28406"
+       id="use3590" />
+    <use
+       xlink:href="#glyph-6-3"
+       x="181.41989"
+       y="649.28406"
+       id="use3592" />
+    <use
+       xlink:href="#glyph-6-4"
+       x="185.46921"
+       y="649.28406"
+       id="use3594" />
+    <use
+       xlink:href="#glyph-6-5"
+       x="189.51852"
+       y="649.28406"
+       id="use3596" />
+    <use
+       xlink:href="#glyph-6-6"
+       x="193.56783"
+       y="649.28406"
+       id="use3598" />
+    <use
+       xlink:href="#glyph-6-7"
+       x="197.61714"
+       y="649.28406"
+       id="use3600" />
+    <use
+       xlink:href="#glyph-6-8"
+       x="201.66646"
+       y="649.28406"
+       id="use3602" />
+    <use
+       xlink:href="#glyph-6-9"
+       x="205.71577"
+       y="649.28406"
+       id="use3604" />
+    <use
+       xlink:href="#glyph-6-10"
+       x="209.76508"
+       y="649.28406"
+       id="use3606" />
+    <use
+       xlink:href="#glyph-6-11"
+       x="213.81439"
+       y="649.28406"
+       id="use3608" />
+    <use
+       xlink:href="#glyph-6-12"
+       x="217.86371"
+       y="649.28406"
+       id="use3610" />
+    <use
+       xlink:href="#glyph-6-13"
+       x="221.91302"
+       y="649.28406"
+       id="use3612" />
+    <use
+       xlink:href="#glyph-6-14"
+       x="225.96233"
+       y="649.28406"
+       id="use3614" />
+    <use
+       xlink:href="#glyph-6-15"
+       x="230.01164"
+       y="649.28406"
+       id="use3616" />
+    <use
+       xlink:href="#glyph-6-12"
+       x="234.06096"
+       y="649.28406"
+       id="use3618" />
+    <use
+       xlink:href="#glyph-6-16"
+       x="238.11028"
+       y="649.28406"
+       id="use3620" />
+    <use
+       xlink:href="#glyph-6-17"
+       x="242.15958"
+       y="649.28406"
+       id="use3622" />
+    <use
+       xlink:href="#glyph-6-13"
+       x="246.20889"
+       y="649.28406"
+       id="use3624" />
+    <use
+       xlink:href="#glyph-6-18"
+       x="250.25821"
+       y="649.28406"
+       id="use3626" />
+    <use
+       xlink:href="#glyph-6-5"
+       x="254.30753"
+       y="649.28406"
+       id="use3628" />
+    <use
+       xlink:href="#glyph-6-11"
+       x="258.35684"
+       y="649.28406"
+       id="use3630" />
+    <use
+       xlink:href="#glyph-6-11"
+       x="262.40616"
+       y="649.28406"
+       id="use3632" />
+    <use
+       xlink:href="#glyph-6-13"
+       x="266.45544"
+       y="649.28406"
+       id="use3634" />
+    <use
+       xlink:href="#glyph-6-14"
+       x="270.50476"
+       y="649.28406"
+       id="use3636" />
+    <use
+       xlink:href="#glyph-6-19"
+       x="274.55408"
+       y="649.28406"
+       id="use3638" />
+    <use
+       xlink:href="#glyph-6-5"
+       x="278.60339"
+       y="649.28406"
+       id="use3640" />
+    <use
+       xlink:href="#glyph-6-16"
+       x="282.65271"
+       y="649.28406"
+       id="use3642" />
+    <use
+       xlink:href="#glyph-6-13"
+       x="286.70203"
+       y="649.28406"
+       id="use3644" />
+    <use
+       xlink:href="#glyph-6-5"
+       x="290.75134"
+       y="649.28406"
+       id="use3646" />
+    <use
+       xlink:href="#glyph-6-4"
+       x="294.80066"
+       y="649.28406"
+       id="use3648" />
+    <use
+       xlink:href="#glyph-6-13"
+       x="298.84995"
+       y="649.28406"
+       id="use3650" />
+    <use
+       xlink:href="#glyph-6-14"
+       x="302.89926"
+       y="649.28406"
+       id="use3652" />
+    <use
+       xlink:href="#glyph-6-12"
+       x="306.94858"
+       y="649.28406"
+       id="use3654" />
+    <use
+       xlink:href="#glyph-6-15"
+       x="310.99789"
+       y="649.28406"
+       id="use3656" />
+    <use
+       xlink:href="#glyph-6-13"
+       x="315.04721"
+       y="649.28406"
+       id="use3658" />
+    <use
+       xlink:href="#glyph-6-15"
+       x="319.09653"
+       y="649.28406"
+       id="use3660" />
+    <use
+       xlink:href="#glyph-6-2"
+       x="323.14584"
+       y="649.28406"
+       id="use3662" />
+    <use
+       xlink:href="#glyph-6-13"
+       x="327.19516"
+       y="649.28406"
+       id="use3664" />
+    <use
+       xlink:href="#glyph-6-4"
+       x="331.24445"
+       y="649.28406"
+       id="use3666" />
+    <use
+       xlink:href="#glyph-6-9"
+       x="335.29376"
+       y="649.28406"
+       id="use3668" />
+    <use
+       xlink:href="#glyph-6-11"
+       x="339.34308"
+       y="649.28406"
+       id="use3670" />
+    <use
+       xlink:href="#glyph-6-14"
+       x="343.3924"
+       y="649.28406"
+       id="use3672" />
+    <use
+       xlink:href="#glyph-6-12"
+       x="347.44171"
+       y="649.28406"
+       id="use3674" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3708">
+    <use
+       xlink:href="#glyph-8-1"
+       x="425.09692"
+       y="613.29602"
+       id="use3678" />
+    <use
+       xlink:href="#glyph-8-2"
+       x="430.59265"
+       y="613.29602"
+       id="use3680" />
+    <use
+       xlink:href="#glyph-8-3"
+       x="435.59634"
+       y="613.29602"
+       id="use3682" />
+    <use
+       xlink:href="#glyph-8-4"
+       x="438.59244"
+       y="613.29602"
+       id="use3684" />
+    <use
+       xlink:href="#glyph-8-5"
+       x="443.59613"
+       y="613.29602"
+       id="use3686" />
+    <use
+       xlink:href="#glyph-8-6"
+       x="449.09186"
+       y="613.29602"
+       id="use3688" />
+    <use
+       xlink:href="#glyph-8-7"
+       x="451.59152"
+       y="613.29602"
+       id="use3690" />
+    <use
+       xlink:href="#glyph-8-8"
+       x="457.08725"
+       y="613.29602"
+       id="use3692" />
+    <use
+       xlink:href="#glyph-8-2"
+       x="462.09094"
+       y="613.29602"
+       id="use3694" />
+    <use
+       xlink:href="#glyph-8-9"
+       x="467.09467"
+       y="613.29602"
+       id="use3696" />
+    <use
+       xlink:href="#glyph-8-6"
+       x="470.59595"
+       y="613.29602"
+       id="use3698" />
+    <use
+       xlink:href="#glyph-8-10"
+       x="473.09561"
+       y="613.29602"
+       id="use3700" />
+    <use
+       xlink:href="#glyph-8-11"
+       x="475.59525"
+       y="613.29602"
+       id="use3702" />
+    <use
+       xlink:href="#glyph-8-12"
+       x="481.09097"
+       y="613.29602"
+       id="use3704" />
+    <use
+       xlink:href="#glyph-8-13"
+       x="484.08707"
+       y="613.29602"
+       id="use3706" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3730">
+    <use
+       xlink:href="#glyph-8-14"
+       x="465.58344"
+       y="739.25415"
+       id="use3710" />
+    <use
+       xlink:href="#glyph-8-9"
+       x="472.5816"
+       y="739.25415"
+       id="use3712" />
+    <use
+       xlink:href="#glyph-8-13"
+       x="476.08289"
+       y="739.25415"
+       id="use3714" />
+    <use
+       xlink:href="#glyph-8-7"
+       x="481.57861"
+       y="739.25415"
+       id="use3716" />
+    <use
+       xlink:href="#glyph-8-15"
+       x="487.07434"
+       y="739.25415"
+       id="use3718" />
+    <use
+       xlink:href="#glyph-8-6"
+       x="492.57007"
+       y="739.25415"
+       id="use3720" />
+    <use
+       xlink:href="#glyph-8-16"
+       x="495.06973"
+       y="739.25415"
+       id="use3722" />
+    <use
+       xlink:href="#glyph-8-17"
+       x="501.07068"
+       y="739.25415"
+       id="use3724" />
+    <use
+       xlink:href="#glyph-8-11"
+       x="506.07437"
+       y="739.25415"
+       id="use3726" />
+    <use
+       xlink:href="#glyph-8-4"
+       x="511.5701"
+       y="739.25415"
+       id="use3728" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 490.001613 1035.500676 L 531.541465 1037.871256 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path3732" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 536.77758 1038.16823 L 529.59811 1041.268219 L 531.541465 1037.871256 L 529.988865 1034.281521 Z M 536.77758 1038.16823 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path3734" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     d="M 405.238281 747.875 L 630.164063 747.875 L 630.164063 878.332031 L 405.238281 878.332031 Z M 405.238281 747.875 "
+     id="path3736" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     d="M 409.738281 747.5 L 411.988281 747.5 L 411.988281 748.25 L 409.738281 748.25 Z M 414.238281 747.5 L 416.488281 747.5 L 416.488281 748.25 L 414.238281 748.25 Z M 418.734375 747.5 L 420.984375 747.5 L 420.984375 748.25 L 418.734375 748.25 Z M 423.234375 747.5 L 425.484375 747.5 L 425.484375 748.25 L 423.234375 748.25 Z M 427.734375 747.5 L 429.980469 747.5 L 429.980469 748.25 L 427.734375 748.25 Z M 432.230469 747.5 L 434.480469 747.5 L 434.480469 748.25 L 432.230469 748.25 Z M 436.730469 747.5 L 438.980469 747.5 L 438.980469 748.25 L 436.730469 748.25 Z M 441.226563 747.5 L 443.476563 747.5 L 443.476563 748.25 L 441.226563 748.25 Z M 445.726563 747.5 L 447.976563 747.5 L 447.976563 748.25 L 445.726563 748.25 Z M 450.226563 747.5 L 452.472656 747.5 L 452.472656 748.25 L 450.226563 748.25 Z M 454.722656 747.5 L 456.972656 747.5 L 456.972656 748.25 L 454.722656 748.25 Z M 459.222656 747.5 L 461.472656 747.5 L 461.472656 748.25 L 459.222656 748.25 Z M 463.722656 747.5 L 465.96875 747.5 L 465.96875 748.25 L 463.722656 748.25 Z M 468.21875 747.5 L 470.46875 747.5 L 470.46875 748.25 L 468.21875 748.25 Z M 472.71875 747.5 L 474.96875 747.5 L 474.96875 748.25 L 472.71875 748.25 Z M 477.214844 747.5 L 479.464844 747.5 L 479.464844 748.25 L 477.214844 748.25 Z M 481.714844 747.5 L 483.964844 747.5 L 483.964844 748.25 L 481.714844 748.25 Z M 486.214844 747.5 L 488.460938 747.5 L 488.460938 748.25 L 486.214844 748.25 Z M 490.710938 747.5 L 492.960938 747.5 L 492.960938 748.25 L 490.710938 748.25 Z M 495.210938 747.5 L 497.460938 747.5 L 497.460938 748.25 L 495.210938 748.25 Z M 499.707031 747.5 L 501.957031 747.5 L 501.957031 748.25 L 499.707031 748.25 Z M 504.207031 747.5 L 506.457031 747.5 L 506.457031 748.25 L 504.207031 748.25 Z M 508.707031 747.5 L 510.953125 747.5 L 510.953125 748.25 L 508.707031 748.25 Z M 513.203125 747.5 L 515.453125 747.5 L 515.453125 748.25 L 513.203125 748.25 Z M 517.703125 747.5 L 519.953125 747.5 L 519.953125 748.25 L 517.703125 748.25 Z M 522.203125 747.5 L 524.449219 747.5 L 524.449219 748.25 L 522.203125 748.25 Z M 526.699219 747.5 L 528.949219 747.5 L 528.949219 748.25 L 526.699219 748.25 Z M 531.199219 747.5 L 533.449219 747.5 L 533.449219 748.25 L 531.199219 748.25 Z M 535.695313 747.5 L 537.945313 747.5 L 537.945313 748.25 L 535.695313 748.25 Z M 540.195313 747.5 L 542.445313 747.5 L 542.445313 748.25 L 540.195313 748.25 Z M 544.695313 747.5 L 546.941406 747.5 L 546.941406 748.25 L 544.695313 748.25 Z M 549.191406 747.5 L 551.441406 747.5 L 551.441406 748.25 L 549.191406 748.25 Z M 553.691406 747.5 L 555.941406 747.5 L 555.941406 748.25 L 553.691406 748.25 Z M 558.1875 747.5 L 560.4375 747.5 L 560.4375 748.25 L 558.1875 748.25 Z M 562.6875 747.5 L 564.9375 747.5 L 564.9375 748.25 L 562.6875 748.25 Z M 567.1875 747.5 L 569.4375 747.5 L 569.4375 748.25 L 567.1875 748.25 Z M 571.683594 747.5 L 573.933594 747.5 L 573.933594 748.25 L 571.683594 748.25 Z M 576.183594 747.5 L 578.433594 747.5 L 578.433594 748.25 L 576.183594 748.25 Z M 580.683594 747.5 L 582.929688 747.5 L 582.929688 748.25 L 580.683594 748.25 Z M 585.179688 747.5 L 587.429688 747.5 L 587.429688 748.25 L 585.179688 748.25 Z M 589.679688 747.5 L 591.929688 747.5 L 591.929688 748.25 L 589.679688 748.25 Z M 594.175781 747.5 L 596.425781 747.5 L 596.425781 748.25 L 594.175781 748.25 Z M 598.675781 747.5 L 600.925781 747.5 L 600.925781 748.25 L 598.675781 748.25 Z M 603.175781 747.5 L 605.421875 747.5 L 605.421875 748.25 L 603.175781 748.25 Z M 607.671875 747.5 L 609.921875 747.5 L 609.921875 748.25 L 607.671875 748.25 Z M 612.171875 747.5 L 614.421875 747.5 L 614.421875 748.25 L 612.171875 748.25 Z M 616.667969 747.5 L 618.917969 747.5 L 618.917969 748.25 L 616.667969 748.25 Z M 621.167969 747.5 L 623.417969 747.5 L 623.417969 748.25 L 621.167969 748.25 Z M 625.667969 747.5 L 627.917969 747.5 L 627.917969 748.25 L 625.667969 748.25 Z M 630.539063 747.875 L 630.539063 750.125 L 629.789063 750.125 L 629.789063 747.875 Z M 630.539063 752.375 L 630.539063 754.625 L 629.789063 754.625 L 629.789063 752.375 Z M 630.539063 756.875 L 630.539063 759.121094 L 629.789063 759.121094 L 629.789063 756.875 Z M 630.539063 761.371094 L 630.539063 763.621094 L 629.789063 763.621094 L 629.789063 761.371094 Z M 630.539063 765.871094 L 630.539063 768.121094 L 629.789063 768.121094 L 629.789063 765.871094 Z M 630.539063 770.367188 L 630.539063 772.617188 L 629.789063 772.617188 L 629.789063 770.367188 Z M 630.539063 774.867188 L 630.539063 777.117188 L 629.789063 777.117188 L 629.789063 774.867188 Z M 630.539063 779.367188 L 630.539063 781.613281 L 629.789063 781.613281 L 629.789063 779.367188 Z M 630.539063 783.863281 L 630.539063 786.113281 L 629.789063 786.113281 L 629.789063 783.863281 Z M 630.539063 788.363281 L 630.539063 790.613281 L 629.789063 790.613281 L 629.789063 788.363281 Z M 630.539063 792.859375 L 630.539063 795.109375 L 629.789063 795.109375 L 629.789063 792.859375 Z M 630.539063 797.359375 L 630.539063 799.609375 L 629.789063 799.609375 L 629.789063 797.359375 Z M 630.539063 801.859375 L 630.539063 804.109375 L 629.789063 804.109375 L 629.789063 801.859375 Z M 630.539063 806.355469 L 630.539063 808.605469 L 629.789063 808.605469 L 629.789063 806.355469 Z M 630.539063 810.855469 L 630.539063 813.105469 L 629.789063 813.105469 L 629.789063 810.855469 Z M 630.539063 815.355469 L 630.539063 817.601563 L 629.789063 817.601563 L 629.789063 815.355469 Z M 630.539063 819.851563 L 630.539063 822.101563 L 629.789063 822.101563 L 629.789063 819.851563 Z M 630.539063 824.351563 L 630.539063 826.601563 L 629.789063 826.601563 L 629.789063 824.351563 Z M 630.539063 828.847656 L 630.539063 831.097656 L 629.789063 831.097656 L 629.789063 828.847656 Z M 630.539063 833.347656 L 630.539063 835.597656 L 629.789063 835.597656 L 629.789063 833.347656 Z M 630.539063 837.847656 L 630.539063 840.09375 L 629.789063 840.09375 L 629.789063 837.847656 Z M 630.539063 842.34375 L 630.539063 844.59375 L 629.789063 844.59375 L 629.789063 842.34375 Z M 630.539063 846.84375 L 630.539063 849.09375 L 629.789063 849.09375 L 629.789063 846.84375 Z M 630.539063 851.34375 L 630.539063 853.589844 L 629.789063 853.589844 L 629.789063 851.34375 Z M 630.539063 855.839844 L 630.539063 858.089844 L 629.789063 858.089844 L 629.789063 855.839844 Z M 630.539063 860.339844 L 630.539063 862.589844 L 629.789063 862.589844 L 629.789063 860.339844 Z M 630.539063 864.835938 L 630.539063 867.085938 L 629.789063 867.085938 L 629.789063 864.835938 Z M 630.539063 869.335938 L 630.539063 871.585938 L 629.789063 871.585938 L 629.789063 869.335938 Z M 630.539063 873.835938 L 630.539063 876.082031 L 629.789063 876.082031 L 629.789063 873.835938 Z M 630.164063 878.707031 L 627.917969 878.707031 L 627.917969 877.957031 L 630.164063 877.957031 Z M 625.667969 878.707031 L 623.417969 878.707031 L 623.417969 877.957031 L 625.667969 877.957031 Z M 621.167969 878.707031 L 618.917969 878.707031 L 618.917969 877.957031 L 621.167969 877.957031 Z M 616.667969 878.707031 L 614.421875 878.707031 L 614.421875 877.957031 L 616.667969 877.957031 Z M 612.171875 878.707031 L 609.921875 878.707031 L 609.921875 877.957031 L 612.171875 877.957031 Z M 607.671875 878.707031 L 605.421875 878.707031 L 605.421875 877.957031 L 607.671875 877.957031 Z M 603.175781 878.707031 L 600.925781 878.707031 L 600.925781 877.957031 L 603.175781 877.957031 Z M 598.675781 878.707031 L 596.425781 878.707031 L 596.425781 877.957031 L 598.675781 877.957031 Z M 594.175781 878.707031 L 591.929688 878.707031 L 591.929688 877.957031 L 594.175781 877.957031 Z M 589.679688 878.707031 L 587.429688 878.707031 L 587.429688 877.957031 L 589.679688 877.957031 Z M 585.179688 878.707031 L 582.929688 878.707031 L 582.929688 877.957031 L 585.179688 877.957031 Z M 580.683594 878.707031 L 578.433594 878.707031 L 578.433594 877.957031 L 580.683594 877.957031 Z M 576.183594 878.707031 L 573.933594 878.707031 L 573.933594 877.957031 L 576.183594 877.957031 Z M 571.683594 878.707031 L 569.4375 878.707031 L 569.4375 877.957031 L 571.683594 877.957031 Z M 567.1875 878.707031 L 564.9375 878.707031 L 564.9375 877.957031 L 567.1875 877.957031 Z M 562.6875 878.707031 L 560.4375 878.707031 L 560.4375 877.957031 L 562.6875 877.957031 Z M 558.1875 878.707031 L 555.941406 878.707031 L 555.941406 877.957031 L 558.1875 877.957031 Z M 553.691406 878.707031 L 551.441406 878.707031 L 551.441406 877.957031 L 553.691406 877.957031 Z M 549.191406 878.707031 L 546.941406 878.707031 L 546.941406 877.957031 L 549.191406 877.957031 Z M 544.695313 878.707031 L 542.445313 878.707031 L 542.445313 877.957031 L 544.695313 877.957031 Z M 540.195313 878.707031 L 537.945313 878.707031 L 537.945313 877.957031 L 540.195313 877.957031 Z M 535.695313 878.707031 L 533.449219 878.707031 L 533.449219 877.957031 L 535.695313 877.957031 Z M 531.199219 878.707031 L 528.949219 878.707031 L 528.949219 877.957031 L 531.199219 877.957031 Z M 526.699219 878.707031 L 524.449219 878.707031 L 524.449219 877.957031 L 526.699219 877.957031 Z M 522.203125 878.707031 L 519.953125 878.707031 L 519.953125 877.957031 L 522.203125 877.957031 Z M 517.703125 878.707031 L 515.453125 878.707031 L 515.453125 877.957031 L 517.703125 877.957031 Z M 513.203125 878.707031 L 510.953125 878.707031 L 510.953125 877.957031 L 513.203125 877.957031 Z M 508.707031 878.707031 L 506.457031 878.707031 L 506.457031 877.957031 L 508.707031 877.957031 Z M 504.207031 878.707031 L 501.957031 878.707031 L 501.957031 877.957031 L 504.207031 877.957031 Z M 499.707031 878.707031 L 497.460938 878.707031 L 497.460938 877.957031 L 499.707031 877.957031 Z M 495.210938 878.707031 L 492.960938 878.707031 L 492.960938 877.957031 L 495.210938 877.957031 Z M 490.710938 878.707031 L 488.460938 878.707031 L 488.460938 877.957031 L 490.710938 877.957031 Z M 486.214844 878.707031 L 483.964844 878.707031 L 483.964844 877.957031 L 486.214844 877.957031 Z M 481.714844 878.707031 L 479.464844 878.707031 L 479.464844 877.957031 L 481.714844 877.957031 Z M 477.214844 878.707031 L 474.96875 878.707031 L 474.96875 877.957031 L 477.214844 877.957031 Z M 472.71875 878.707031 L 470.46875 878.707031 L 470.46875 877.957031 L 472.71875 877.957031 Z M 468.21875 878.707031 L 465.96875 878.707031 L 465.96875 877.957031 L 468.21875 877.957031 Z M 463.722656 878.707031 L 461.472656 878.707031 L 461.472656 877.957031 L 463.722656 877.957031 Z M 459.222656 878.707031 L 456.972656 878.707031 L 456.972656 877.957031 L 459.222656 877.957031 Z M 454.722656 878.707031 L 452.472656 878.707031 L 452.472656 877.957031 L 454.722656 877.957031 Z M 450.226563 878.707031 L 447.976563 878.707031 L 447.976563 877.957031 L 450.226563 877.957031 Z M 445.726563 878.707031 L 443.476563 878.707031 L 443.476563 877.957031 L 445.726563 877.957031 Z M 441.226563 878.707031 L 438.980469 878.707031 L 438.980469 877.957031 L 441.226563 877.957031 Z M 436.730469 878.707031 L 434.480469 878.707031 L 434.480469 877.957031 L 436.730469 877.957031 Z M 432.230469 878.707031 L 429.980469 878.707031 L 429.980469 877.957031 L 432.230469 877.957031 Z M 427.734375 878.707031 L 425.484375 878.707031 L 425.484375 877.957031 L 427.734375 877.957031 Z M 423.234375 878.707031 L 420.984375 878.707031 L 420.984375 877.957031 L 423.234375 877.957031 Z M 418.734375 878.707031 L 416.488281 878.707031 L 416.488281 877.957031 L 418.734375 877.957031 Z M 414.238281 878.707031 L 411.988281 878.707031 L 411.988281 877.957031 L 414.238281 877.957031 Z M 409.738281 878.707031 L 407.488281 878.707031 L 407.488281 877.957031 L 409.738281 877.957031 Z M 404.867188 878.332031 L 404.867188 876.082031 L 405.613281 876.082031 L 405.613281 878.332031 Z M 404.867188 873.835938 L 404.867188 871.585938 L 405.613281 871.585938 L 405.613281 873.835938 Z M 404.867188 869.335938 L 404.867188 867.085938 L 405.613281 867.085938 L 405.613281 869.335938 Z M 404.867188 864.835938 L 404.867188 862.589844 L 405.613281 862.589844 L 405.613281 864.835938 Z M 404.867188 860.339844 L 404.867188 858.089844 L 405.613281 858.089844 L 405.613281 860.339844 Z M 404.867188 855.839844 L 404.867188 853.589844 L 405.613281 853.589844 L 405.613281 855.839844 Z M 404.867188 851.34375 L 404.867188 849.09375 L 405.613281 849.09375 L 405.613281 851.34375 Z M 404.867188 846.84375 L 404.867188 844.59375 L 405.613281 844.59375 L 405.613281 846.84375 Z M 404.867188 842.34375 L 404.867188 840.09375 L 405.613281 840.09375 L 405.613281 842.34375 Z M 404.867188 837.847656 L 404.867188 835.597656 L 405.613281 835.597656 L 405.613281 837.847656 Z M 404.867188 833.347656 L 404.867188 831.097656 L 405.613281 831.097656 L 405.613281 833.347656 Z M 404.867188 828.847656 L 404.867188 826.601563 L 405.613281 826.601563 L 405.613281 828.847656 Z M 404.867188 824.351563 L 404.867188 822.101563 L 405.613281 822.101563 L 405.613281 824.351563 Z M 404.867188 819.851563 L 404.867188 817.601563 L 405.613281 817.601563 L 405.613281 819.851563 Z M 404.867188 815.355469 L 404.867188 813.105469 L 405.613281 813.105469 L 405.613281 815.355469 Z M 404.867188 810.855469 L 404.867188 808.605469 L 405.613281 808.605469 L 405.613281 810.855469 Z M 404.867188 806.355469 L 404.867188 804.109375 L 405.613281 804.109375 L 405.613281 806.355469 Z M 404.867188 801.859375 L 404.867188 799.609375 L 405.613281 799.609375 L 405.613281 801.859375 Z M 404.867188 797.359375 L 404.867188 795.109375 L 405.613281 795.109375 L 405.613281 797.359375 Z M 404.867188 792.859375 L 404.867188 790.613281 L 405.613281 790.613281 L 405.613281 792.859375 Z M 404.867188 788.363281 L 404.867188 786.113281 L 405.613281 786.113281 L 405.613281 788.363281 Z M 404.867188 783.863281 L 404.867188 781.613281 L 405.613281 781.613281 L 405.613281 783.863281 Z M 404.867188 779.367188 L 404.867188 777.117188 L 405.613281 777.117188 L 405.613281 779.367188 Z M 404.867188 774.867188 L 404.867188 772.617188 L 405.613281 772.617188 L 405.613281 774.867188 Z M 404.867188 770.367188 L 404.867188 768.121094 L 405.613281 768.121094 L 405.613281 770.367188 Z M 404.867188 765.871094 L 404.867188 763.621094 L 405.613281 763.621094 L 405.613281 765.871094 Z M 404.867188 761.371094 L 404.867188 759.121094 L 405.613281 759.121094 L 405.613281 761.371094 Z M 404.867188 756.875 L 404.867188 754.625 L 405.613281 754.625 L 405.613281 756.875 Z M 404.867188 752.375 L 404.867188 750.125 L 405.613281 750.125 L 405.613281 752.375 Z M 405.238281 747.5 L 407.488281 747.5 L 407.488281 748.25 L 405.238281 748.25 Z M 405.238281 747.5 "
+     id="path3738" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3742">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="760.99689"
+       id="use3740" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3768">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="760.99689"
+       id="use3744" />
+    <use
+       xlink:href="#glyph-0-43"
+       x="411.36417"
+       y="760.99689"
+       id="use3746" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="416.36789"
+       y="760.99689"
+       id="use3748" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86752"
+       y="760.99689"
+       id="use3750" />
+    <use
+       xlink:href="#glyph-0-44"
+       x="421.36719"
+       y="760.99689"
+       id="use3752" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="426.37091"
+       y="760.99689"
+       id="use3754" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="431.3746"
+       y="760.99689"
+       id="use3756" />
+    <use
+       xlink:href="#glyph-0-29"
+       x="436.37833"
+       y="760.99689"
+       id="use3758" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="440.87683"
+       y="760.99689"
+       id="use3760" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="443.37646"
+       y="760.99689"
+       id="use3762" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="448.38019"
+       y="760.99689"
+       id="use3764" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="450.87982"
+       y="760.99689"
+       id="use3766" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g3814">
+    <use
+       xlink:href="#glyph-4-16"
+       x="453.38828"
+       y="760.99689"
+       id="use3770" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="458.33743"
+       y="760.99689"
+       id="use3772" />
+    <use
+       xlink:href="#glyph-4-18"
+       x="463.28659"
+       y="760.99689"
+       id="use3774" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="468.23575"
+       y="760.99689"
+       id="use3776" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="473.18491"
+       y="760.99689"
+       id="use3778" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="478.13409"
+       y="760.99689"
+       id="use3780" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="483.08325"
+       y="760.99689"
+       id="use3782" />
+    <use
+       xlink:href="#glyph-4-21"
+       x="488.03241"
+       y="760.99689"
+       id="use3784" />
+    <use
+       xlink:href="#glyph-4-18"
+       x="492.98157"
+       y="760.99689"
+       id="use3786" />
+    <use
+       xlink:href="#glyph-4-16"
+       x="497.93073"
+       y="760.99689"
+       id="use3788" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="502.87988"
+       y="760.99689"
+       id="use3790" />
+    <use
+       xlink:href="#glyph-4-22"
+       x="507.82904"
+       y="760.99689"
+       id="use3792" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="512.7782"
+       y="760.99689"
+       id="use3794" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="517.72736"
+       y="760.99689"
+       id="use3796" />
+    <use
+       xlink:href="#glyph-4-23"
+       x="522.67651"
+       y="760.99689"
+       id="use3798" />
+    <use
+       xlink:href="#glyph-4-24"
+       x="527.62567"
+       y="760.99689"
+       id="use3800" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="532.57483"
+       y="760.99689"
+       id="use3802" />
+    <use
+       xlink:href="#glyph-4-25"
+       x="537.52399"
+       y="760.99689"
+       id="use3804" />
+    <use
+       xlink:href="#glyph-4-21"
+       x="542.47314"
+       y="760.99689"
+       id="use3806" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="547.4223"
+       y="760.99689"
+       id="use3808" />
+    <use
+       xlink:href="#glyph-4-26"
+       x="552.37146"
+       y="760.99689"
+       id="use3810" />
+    <use
+       xlink:href="#glyph-4-18"
+       x="557.32062"
+       y="760.99689"
+       id="use3812" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3818">
+    <use
+       xlink:href="#glyph-0-6"
+       x="562.27783"
+       y="760.99689"
+       id="use3816" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3850">
+    <use
+       xlink:href="#glyph-0-28"
+       x="564.77753"
+       y="760.99689"
+       id="use3820" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="569.276"
+       y="760.99689"
+       id="use3822" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="571.27484"
+       y="760.99689"
+       id="use3824" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="576.27856"
+       y="760.99689"
+       id="use3826" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="578.2774"
+       y="760.99689"
+       id="use3828" />
+    <use
+       xlink:href="#glyph-0-45"
+       x="585.77197"
+       y="760.99689"
+       id="use3830" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="588.27167"
+       y="760.99689"
+       id="use3832" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="590.7713"
+       y="760.99689"
+       id="use3834" />
+    <use
+       xlink:href="#glyph-0-35"
+       x="592.77014"
+       y="760.99689"
+       id="use3836" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="595.26984"
+       y="760.99689"
+       id="use3838" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="597.76947"
+       y="760.99689"
+       id="use3840" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="602.77319"
+       y="760.99689"
+       id="use3842" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="607.77686"
+       y="760.99689"
+       id="use3844" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="612.27539"
+       y="760.99689"
+       id="use3846" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="617.27911"
+       y="760.99689"
+       id="use3848" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3906">
+    <use
+       xlink:href="#glyph-0-23"
+       x="426.36212"
+       y="772.24316"
+       id="use3852" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="431.36581"
+       y="772.24316"
+       id="use3854" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="436.36954"
+       y="772.24316"
+       id="use3856" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="441.37323"
+       y="772.24316"
+       id="use3858" />
+    <use
+       xlink:href="#glyph-0-5"
+       x="443.87289"
+       y="772.24316"
+       id="use3860" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="445.59058"
+       y="772.24316"
+       id="use3862" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="450.5943"
+       y="772.24316"
+       id="use3864" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="453.59036"
+       y="772.24316"
+       id="use3866" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="458.59409"
+       y="772.24316"
+       id="use3868" />
+    <use
+       xlink:href="#glyph-0-18"
+       x="463.59778"
+       y="772.24316"
+       id="use3870" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="468.60147"
+       y="772.24316"
+       id="use3872" />
+    <use
+       xlink:href="#glyph-0-5"
+       x="473.09998"
+       y="772.24316"
+       id="use3874" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="474.81769"
+       y="772.24316"
+       id="use3876" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="477.31732"
+       y="772.24316"
+       id="use3878" />
+    <use
+       xlink:href="#glyph-0-28"
+       x="481.81583"
+       y="772.24316"
+       id="use3880" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="486.31433"
+       y="772.24316"
+       id="use3882" />
+    <use
+       xlink:href="#glyph-0-18"
+       x="491.31805"
+       y="772.24316"
+       id="use3884" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="496.32175"
+       y="772.24316"
+       id="use3886" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="501.32547"
+       y="772.24316"
+       id="use3888" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="503.82513"
+       y="772.24316"
+       id="use3890" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="511.3197"
+       y="772.24316"
+       id="use3892" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="513.31854"
+       y="772.24316"
+       id="use3894" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="517.81708"
+       y="772.24316"
+       id="use3896" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="522.31555"
+       y="772.24316"
+       id="use3898" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="524.31439"
+       y="772.24316"
+       id="use3900" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="529.31812"
+       y="772.24316"
+       id="use3902" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="534.32184"
+       y="772.24316"
+       id="use3904" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3948">
+    <use
+       xlink:href="#glyph-8-18"
+       x="536.82147"
+       y="772.24316"
+       id="use3908" />
+    <use
+       xlink:href="#glyph-8-19"
+       x="541.8252"
+       y="772.24316"
+       id="use3910" />
+    <use
+       xlink:href="#glyph-8-13"
+       x="547.32092"
+       y="772.24316"
+       id="use3912" />
+    <use
+       xlink:href="#glyph-8-9"
+       x="552.81665"
+       y="772.24316"
+       id="use3914" />
+    <use
+       xlink:href="#glyph-8-3"
+       x="556.31793"
+       y="772.24316"
+       id="use3916" />
+    <use
+       xlink:href="#glyph-8-6"
+       x="559.31396"
+       y="772.24316"
+       id="use3918" />
+    <use
+       xlink:href="#glyph-8-18"
+       x="561.81366"
+       y="772.24316"
+       id="use3920" />
+    <use
+       xlink:href="#glyph-8-11"
+       x="566.81738"
+       y="772.24316"
+       id="use3922" />
+    <use
+       xlink:href="#glyph-8-20"
+       x="572.31311"
+       y="772.24316"
+       id="use3924" />
+    <use
+       xlink:href="#glyph-8-6"
+       x="577.80884"
+       y="772.24316"
+       id="use3926" />
+    <use
+       xlink:href="#glyph-8-20"
+       x="580.30847"
+       y="772.24316"
+       id="use3928" />
+    <use
+       xlink:href="#glyph-8-13"
+       x="585.8042"
+       y="772.24316"
+       id="use3930" />
+    <use
+       xlink:href="#glyph-8-6"
+       x="591.29993"
+       y="772.24316"
+       id="use3932" />
+    <use
+       xlink:href="#glyph-8-11"
+       x="593.79956"
+       y="772.24316"
+       id="use3934" />
+    <use
+       xlink:href="#glyph-8-13"
+       x="599.29535"
+       y="772.24316"
+       id="use3936" />
+    <use
+       xlink:href="#glyph-8-3"
+       x="604.79108"
+       y="772.24316"
+       id="use3938" />
+    <use
+       xlink:href="#glyph-8-5"
+       x="607.78711"
+       y="772.24316"
+       id="use3940" />
+    <use
+       xlink:href="#glyph-8-10"
+       x="613.28284"
+       y="772.24316"
+       id="use3942" />
+    <use
+       xlink:href="#glyph-8-11"
+       x="615.78253"
+       y="772.24316"
+       id="use3944" />
+    <use
+       xlink:href="#glyph-8-21"
+       x="621.27826"
+       y="772.24316"
+       id="use3946" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g3952">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="783.48944"
+       id="use3950" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4014">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="783.48944"
+       id="use3954" />
+    <use
+       xlink:href="#glyph-0-46"
+       x="411.36417"
+       y="783.48944"
+       id="use3956" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="416.36789"
+       y="783.48944"
+       id="use3958" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86752"
+       y="783.48944"
+       id="use3960" />
+    <use
+       xlink:href="#glyph-0-41"
+       x="421.36719"
+       y="783.48944"
+       id="use3962" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="427.86453"
+       y="783.48944"
+       id="use3964" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="432.86826"
+       y="783.48944"
+       id="use3966" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="437.87195"
+       y="783.48944"
+       id="use3968" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="442.87567"
+       y="783.48944"
+       id="use3970" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="450.37024"
+       y="783.48944"
+       id="use3972" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="455.37393"
+       y="783.48944"
+       id="use3974" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="457.8736"
+       y="783.48944"
+       id="use3976" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="462.87732"
+       y="783.48944"
+       id="use3978" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="465.87338"
+       y="783.48944"
+       id="use3980" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="470.87711"
+       y="783.48944"
+       id="use3982" />
+    <use
+       xlink:href="#glyph-0-18"
+       x="475.8808"
+       y="783.48944"
+       id="use3984" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="480.88449"
+       y="783.48944"
+       id="use3986" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="485.383"
+       y="783.48944"
+       id="use3988" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="487.88266"
+       y="783.48944"
+       id="use3990" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="489.8815"
+       y="783.48944"
+       id="use3992" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="494.88522"
+       y="783.48944"
+       id="use3994" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="497.38489"
+       y="783.48944"
+       id="use3996" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="499.38373"
+       y="783.48944"
+       id="use3998" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="501.38257"
+       y="783.48944"
+       id="use4000" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="505.88107"
+       y="783.48944"
+       id="use4002" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="508.38074"
+       y="783.48944"
+       id="use4004" />
+    <use
+       xlink:href="#glyph-0-9"
+       x="510.8804"
+       y="783.48944"
+       id="use4006" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="517.37775"
+       y="783.48944"
+       id="use4008" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="519.37659"
+       y="783.48944"
+       id="use4010" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="521.87622"
+       y="783.48944"
+       id="use4012" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4018">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="793.98596"
+       id="use4016" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4022">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="793.98596"
+       id="use4020" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4026">
+    <use
+       xlink:href="#glyph-0-6"
+       x="411.36417"
+       y="793.98596"
+       id="use4024" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4030">
+    <use
+       xlink:href="#glyph-0-6"
+       x="413.86383"
+       y="793.98596"
+       id="use4028" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4034">
+    <use
+       xlink:href="#glyph-0-6"
+       x="416.36349"
+       y="793.98596"
+       id="use4032" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4038">
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86313"
+       y="793.98596"
+       id="use4036" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4042">
+    <use
+       xlink:href="#glyph-0-6"
+       x="421.36279"
+       y="793.98596"
+       id="use4040" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g4100">
+    <use
+       xlink:href="#glyph-4-16"
+       x="423.86685"
+       y="793.98596"
+       id="use4044" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="428.81601"
+       y="793.98596"
+       id="use4046" />
+    <use
+       xlink:href="#glyph-4-18"
+       x="433.76517"
+       y="793.98596"
+       id="use4048" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="438.71432"
+       y="793.98596"
+       id="use4050" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="443.66348"
+       y="793.98596"
+       id="use4052" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="448.61264"
+       y="793.98596"
+       id="use4054" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="453.5618"
+       y="793.98596"
+       id="use4056" />
+    <use
+       xlink:href="#glyph-4-21"
+       x="458.51096"
+       y="793.98596"
+       id="use4058" />
+    <use
+       xlink:href="#glyph-4-18"
+       x="463.46011"
+       y="793.98596"
+       id="use4060" />
+    <use
+       xlink:href="#glyph-4-16"
+       x="468.40927"
+       y="793.98596"
+       id="use4062" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="473.35846"
+       y="793.98596"
+       id="use4064" />
+    <use
+       xlink:href="#glyph-4-23"
+       x="478.30762"
+       y="793.98596"
+       id="use4066" />
+    <use
+       xlink:href="#glyph-4-27"
+       x="483.25677"
+       y="793.98596"
+       id="use4068" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="488.20593"
+       y="793.98596"
+       id="use4070" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="493.15509"
+       y="793.98596"
+       id="use4072" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="498.10425"
+       y="793.98596"
+       id="use4074" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="503.05341"
+       y="793.98596"
+       id="use4076" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="508.00256"
+       y="793.98596"
+       id="use4078" />
+    <use
+       xlink:href="#glyph-4-26"
+       x="512.95172"
+       y="793.98596"
+       id="use4080" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="517.90088"
+       y="793.98596"
+       id="use4082" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="522.85004"
+       y="793.98596"
+       id="use4084" />
+    <use
+       xlink:href="#glyph-4-28"
+       x="527.79919"
+       y="793.98596"
+       id="use4086" />
+    <use
+       xlink:href="#glyph-4-29"
+       x="532.74835"
+       y="793.98596"
+       id="use4088" />
+    <use
+       xlink:href="#glyph-4-24"
+       x="537.69751"
+       y="793.98596"
+       id="use4090" />
+    <use
+       xlink:href="#glyph-4-24"
+       x="542.64667"
+       y="793.98596"
+       id="use4092" />
+    <use
+       xlink:href="#glyph-4-21"
+       x="547.59583"
+       y="793.98596"
+       id="use4094" />
+    <use
+       xlink:href="#glyph-4-30"
+       x="552.54498"
+       y="793.98596"
+       id="use4096" />
+    <use
+       xlink:href="#glyph-4-22"
+       x="557.49414"
+       y="793.98596"
+       id="use4098" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4104">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="805.23218"
+       id="use4102" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4112">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="805.23218"
+       id="use4106" />
+    <use
+       xlink:href="#glyph-0-47"
+       x="411.36417"
+       y="805.23218"
+       id="use4108" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="416.36789"
+       y="805.23218"
+       id="use4110" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4116">
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86752"
+       y="805.23218"
+       id="use4114" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g4178">
+    <use
+       xlink:href="#glyph-9-1"
+       x="421.37158"
+       y="805.23218"
+       id="use4118" />
+    <use
+       xlink:href="#glyph-9-2"
+       x="426.77066"
+       y="805.23218"
+       id="use4120" />
+    <use
+       xlink:href="#glyph-9-3"
+       x="432.16974"
+       y="805.23218"
+       id="use4122" />
+    <use
+       xlink:href="#glyph-9-4"
+       x="437.56885"
+       y="805.23218"
+       id="use4124" />
+    <use
+       xlink:href="#glyph-9-5"
+       x="442.96793"
+       y="805.23218"
+       id="use4126" />
+    <use
+       xlink:href="#glyph-9-6"
+       x="448.367"
+       y="805.23218"
+       id="use4128" />
+    <use
+       xlink:href="#glyph-9-2"
+       x="453.76608"
+       y="805.23218"
+       id="use4130" />
+    <use
+       xlink:href="#glyph-9-7"
+       x="459.16516"
+       y="805.23218"
+       id="use4132" />
+    <use
+       xlink:href="#glyph-9-3"
+       x="464.56427"
+       y="805.23218"
+       id="use4134" />
+    <use
+       xlink:href="#glyph-9-1"
+       x="469.96335"
+       y="805.23218"
+       id="use4136" />
+    <use
+       xlink:href="#glyph-9-6"
+       x="475.36243"
+       y="805.23218"
+       id="use4138" />
+    <use
+       xlink:href="#glyph-9-8"
+       x="480.76151"
+       y="805.23218"
+       id="use4140" />
+    <use
+       xlink:href="#glyph-9-5"
+       x="486.16058"
+       y="805.23218"
+       id="use4142" />
+    <use
+       xlink:href="#glyph-9-2"
+       x="491.55966"
+       y="805.23218"
+       id="use4144" />
+    <use
+       xlink:href="#glyph-9-9"
+       x="496.95874"
+       y="805.23218"
+       id="use4146" />
+    <use
+       xlink:href="#glyph-9-10"
+       x="502.35785"
+       y="805.23218"
+       id="use4148" />
+    <use
+       xlink:href="#glyph-9-6"
+       x="507.75693"
+       y="805.23218"
+       id="use4150" />
+    <use
+       xlink:href="#glyph-9-5"
+       x="513.15601"
+       y="805.23218"
+       id="use4152" />
+    <use
+       xlink:href="#glyph-9-4"
+       x="518.55511"
+       y="805.23218"
+       id="use4154" />
+    <use
+       xlink:href="#glyph-9-8"
+       x="523.95416"
+       y="805.23218"
+       id="use4156" />
+    <use
+       xlink:href="#glyph-9-4"
+       x="529.35327"
+       y="805.23218"
+       id="use4158" />
+    <use
+       xlink:href="#glyph-9-11"
+       x="534.75232"
+       y="805.23218"
+       id="use4160" />
+    <use
+       xlink:href="#glyph-9-6"
+       x="540.15143"
+       y="805.23218"
+       id="use4162" />
+    <use
+       xlink:href="#glyph-9-12"
+       x="545.55048"
+       y="805.23218"
+       id="use4164" />
+    <use
+       xlink:href="#glyph-9-7"
+       x="550.94958"
+       y="805.23218"
+       id="use4166" />
+    <use
+       xlink:href="#glyph-9-13"
+       x="556.34869"
+       y="805.23218"
+       id="use4168" />
+    <use
+       xlink:href="#glyph-9-14"
+       x="561.74774"
+       y="805.23218"
+       id="use4170" />
+    <use
+       xlink:href="#glyph-9-4"
+       x="567.14685"
+       y="805.23218"
+       id="use4172" />
+    <use
+       xlink:href="#glyph-9-5"
+       x="572.5459"
+       y="805.23218"
+       id="use4174" />
+    <use
+       xlink:href="#glyph-9-15"
+       x="577.94501"
+       y="805.23218"
+       id="use4176" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4188">
+    <use
+       xlink:href="#glyph-0-9"
+       x="583.35284"
+       y="805.23218"
+       id="use4180" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="589.85022"
+       y="805.23218"
+       id="use4182" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="591.84906"
+       y="805.23218"
+       id="use4184" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="593.8479"
+       y="805.23218"
+       id="use4186" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4192">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="817.22821"
+       id="use4190" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4196">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="817.22821"
+       id="use4194" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4200">
+    <use
+       xlink:href="#glyph-0-6"
+       x="411.36417"
+       y="817.22821"
+       id="use4198" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4204">
+    <use
+       xlink:href="#glyph-0-6"
+       x="413.86383"
+       y="817.22821"
+       id="use4202" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4208">
+    <use
+       xlink:href="#glyph-0-6"
+       x="416.36349"
+       y="817.22821"
+       id="use4206" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4296">
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86313"
+       y="817.22821"
+       id="use4210" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="421.36279"
+       y="817.22821"
+       id="use4212" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="424.35889"
+       y="817.22821"
+       id="use4214" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="429.36258"
+       y="817.22821"
+       id="use4216" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="436.85715"
+       y="817.22821"
+       id="use4218" />
+    <use
+       xlink:href="#glyph-0-16"
+       x="441.86087"
+       y="817.22821"
+       id="use4220" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="446.35938"
+       y="817.22821"
+       id="use4222" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="451.36307"
+       y="817.22821"
+       id="use4224" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="453.86273"
+       y="817.22821"
+       id="use4226" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="458.86642"
+       y="817.22821"
+       id="use4228" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="461.86252"
+       y="817.22821"
+       id="use4230" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="466.86621"
+       y="817.22821"
+       id="use4232" />
+    <use
+       xlink:href="#glyph-0-18"
+       x="471.86993"
+       y="817.22821"
+       id="use4234" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="476.87363"
+       y="817.22821"
+       id="use4236" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="481.37213"
+       y="817.22821"
+       id="use4238" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="483.8718"
+       y="817.22821"
+       id="use4240" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="486.37146"
+       y="817.22821"
+       id="use4242" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="491.37515"
+       y="817.22821"
+       id="use4244" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="496.37888"
+       y="817.22821"
+       id="use4246" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="498.87851"
+       y="817.22821"
+       id="use4248" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="501.37817"
+       y="817.22821"
+       id="use4250" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="506.3819"
+       y="817.22821"
+       id="use4252" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="511.38559"
+       y="817.22821"
+       id="use4254" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="513.88525"
+       y="817.22821"
+       id="use4256" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="518.88898"
+       y="817.22821"
+       id="use4258" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="523.89264"
+       y="817.22821"
+       id="use4260" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="526.39233"
+       y="817.22821"
+       id="use4262" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="528.89197"
+       y="817.22821"
+       id="use4264" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="536.38654"
+       y="817.22821"
+       id="use4266" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="541.39026"
+       y="817.22821"
+       id="use4268" />
+    <use
+       xlink:href="#glyph-0-28"
+       x="543.88989"
+       y="817.22821"
+       id="use4270" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="548.38843"
+       y="817.22821"
+       id="use4272" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="553.39215"
+       y="817.22821"
+       id="use4274" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="555.89178"
+       y="817.22821"
+       id="use4276" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="558.39142"
+       y="817.22821"
+       id="use4278" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="563.39514"
+       y="817.22821"
+       id="use4280" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="568.39886"
+       y="817.22821"
+       id="use4282" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="570.8985"
+       y="817.22821"
+       id="use4284" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="573.89459"
+       y="817.22821"
+       id="use4286" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="578.89832"
+       y="817.22821"
+       id="use4288" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="583.90198"
+       y="817.22821"
+       id="use4290" />
+    <use
+       xlink:href="#glyph-0-48"
+       x="588.9057"
+       y="817.22821"
+       id="use4292" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="593.40424"
+       y="817.22821"
+       id="use4294" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4300">
+    <use
+       xlink:href="#glyph-4-31"
+       x="406.36487"
+       y="827.72473"
+       id="use4298" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4384">
+    <use
+       xlink:href="#glyph-1-48"
+       x="411.32025"
+       y="827.72473"
+       id="use4302" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="415.90698"
+       y="827.72473"
+       id="use4304" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="418.19833"
+       y="827.72473"
+       id="use4306" />
+    <use
+       xlink:href="#glyph-1-1"
+       x="420.48969"
+       y="827.72473"
+       id="use4308" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="426.44559"
+       y="827.72473"
+       id="use4310" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="430.56921"
+       y="827.72473"
+       id="use4312" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="435.15594"
+       y="827.72473"
+       id="use4314" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="437.90234"
+       y="827.72473"
+       id="use4316" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="440.1937"
+       y="827.72473"
+       id="use4318" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="442.02597"
+       y="827.72473"
+       id="use4320" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="446.1496"
+       y="827.72473"
+       id="use4322" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="448.44095"
+       y="827.72473"
+       id="use4324" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="451.18735"
+       y="827.72473"
+       id="use4326" />
+    <use
+       xlink:href="#glyph-1-29"
+       x="455.77408"
+       y="827.72473"
+       id="use4328" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="462.6441"
+       y="827.72473"
+       id="use4330" />
+    <use
+       xlink:href="#glyph-1-42"
+       x="467.23083"
+       y="827.72473"
+       id="use4332" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="471.35446"
+       y="827.72473"
+       id="use4334" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="475.94122"
+       y="827.72473"
+       id="use4336" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="480.52795"
+       y="827.72473"
+       id="use4338" />
+    <use
+       xlink:href="#glyph-1-47"
+       x="482.81931"
+       y="827.72473"
+       id="use4340" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="485.11066"
+       y="827.72473"
+       id="use4342" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="487.85706"
+       y="827.72473"
+       id="use4344" />
+    <use
+       xlink:href="#glyph-1-29"
+       x="492.44379"
+       y="827.72473"
+       id="use4346" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="499.31381"
+       y="827.72473"
+       id="use4348" />
+    <use
+       xlink:href="#glyph-1-30"
+       x="501.60516"
+       y="827.72473"
+       id="use4350" />
+    <use
+       xlink:href="#glyph-1-7"
+       x="506.19189"
+       y="827.72473"
+       id="use4352" />
+    <use
+       xlink:href="#glyph-1-7"
+       x="508.02417"
+       y="827.72473"
+       id="use4354" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="509.85645"
+       y="827.72473"
+       id="use4356" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="512.14777"
+       y="827.72473"
+       id="use4358" />
+    <use
+       xlink:href="#glyph-1-22"
+       x="514.43915"
+       y="827.72473"
+       id="use4360" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="519.02588"
+       y="827.72473"
+       id="use4362" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="523.61261"
+       y="827.72473"
+       id="use4364" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="525.44489"
+       y="827.72473"
+       id="use4366" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="528.19128"
+       y="827.72473"
+       id="use4368" />
+    <use
+       xlink:href="#glyph-1-17"
+       x="530.48267"
+       y="827.72473"
+       id="use4370" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="535.0694"
+       y="827.72473"
+       id="use4372" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="537.8158"
+       y="827.72473"
+       id="use4374" />
+    <use
+       xlink:href="#glyph-1-43"
+       x="542.40253"
+       y="827.72473"
+       id="use4376" />
+    <use
+       xlink:href="#glyph-1-24"
+       x="546.98926"
+       y="827.72473"
+       id="use4378" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="551.57599"
+       y="827.72473"
+       id="use4380" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="555.69958"
+       y="827.72473"
+       id="use4382" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4388">
+    <use
+       xlink:href="#glyph-4-31"
+       x="406.36487"
+       y="838.97101"
+       id="use4386" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4394">
+    <use
+       xlink:href="#glyph-1-49"
+       x="411.32025"
+       y="838.97101"
+       id="use4390" />
+    <use
+       xlink:href="#glyph-1-28"
+       x="415.90698"
+       y="838.97101"
+       id="use4392" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4398">
+    <use
+       xlink:href="#glyph-1-5"
+       x="418.19833"
+       y="838.97101"
+       id="use4396" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g4456">
+    <use
+       xlink:href="#glyph-4-16"
+       x="420.49298"
+       y="838.97101"
+       id="use4400" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="425.44214"
+       y="838.97101"
+       id="use4402" />
+    <use
+       xlink:href="#glyph-4-18"
+       x="430.3913"
+       y="838.97101"
+       id="use4404" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="435.34045"
+       y="838.97101"
+       id="use4406" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="440.28961"
+       y="838.97101"
+       id="use4408" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="445.23877"
+       y="838.97101"
+       id="use4410" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="450.18793"
+       y="838.97101"
+       id="use4412" />
+    <use
+       xlink:href="#glyph-4-21"
+       x="455.13708"
+       y="838.97101"
+       id="use4414" />
+    <use
+       xlink:href="#glyph-4-18"
+       x="460.08624"
+       y="838.97101"
+       id="use4416" />
+    <use
+       xlink:href="#glyph-4-16"
+       x="465.0354"
+       y="838.97101"
+       id="use4418" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="469.98456"
+       y="838.97101"
+       id="use4420" />
+    <use
+       xlink:href="#glyph-4-22"
+       x="474.93372"
+       y="838.97101"
+       id="use4422" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="479.88287"
+       y="838.97101"
+       id="use4424" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="484.83206"
+       y="838.97101"
+       id="use4426" />
+    <use
+       xlink:href="#glyph-4-23"
+       x="489.78122"
+       y="838.97101"
+       id="use4428" />
+    <use
+       xlink:href="#glyph-4-24"
+       x="494.73038"
+       y="838.97101"
+       id="use4430" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="499.67953"
+       y="838.97101"
+       id="use4432" />
+    <use
+       xlink:href="#glyph-4-29"
+       x="504.62869"
+       y="838.97101"
+       id="use4434" />
+    <use
+       xlink:href="#glyph-4-23"
+       x="509.57785"
+       y="838.97101"
+       id="use4436" />
+    <use
+       xlink:href="#glyph-4-32"
+       x="514.52698"
+       y="838.97101"
+       id="use4438" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="519.47614"
+       y="838.97101"
+       id="use4440" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="524.42535"
+       y="838.97101"
+       id="use4442" />
+    <use
+       xlink:href="#glyph-4-16"
+       x="529.37451"
+       y="838.97101"
+       id="use4444" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="534.32367"
+       y="838.97101"
+       id="use4446" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="539.27283"
+       y="838.97101"
+       id="use4448" />
+    <use
+       xlink:href="#glyph-4-29"
+       x="544.22198"
+       y="838.97101"
+       id="use4450" />
+    <use
+       xlink:href="#glyph-4-32"
+       x="549.17114"
+       y="838.97101"
+       id="use4452" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="554.1203"
+       y="838.97101"
+       id="use4454" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4460">
+    <use
+       xlink:href="#glyph-0-6"
+       x="559.07971"
+       y="838.97101"
+       id="use4458" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4476">
+    <use
+       xlink:href="#glyph-0-28"
+       x="561.57935"
+       y="838.97101"
+       id="use4462" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="566.07788"
+       y="838.97101"
+       id="use4464" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="569.07391"
+       y="838.97101"
+       id="use4466" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="574.07764"
+       y="838.97101"
+       id="use4468" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="579.08136"
+       y="838.97101"
+       id="use4470" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="581.58099"
+       y="838.97101"
+       id="use4472" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="586.58472"
+       y="838.97101"
+       id="use4474" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4480">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="850.21722"
+       id="use4478" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4484">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="850.21722"
+       id="use4482" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4488">
+    <use
+       xlink:href="#glyph-0-6"
+       x="411.36417"
+       y="850.21722"
+       id="use4486" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4492">
+    <use
+       xlink:href="#glyph-0-6"
+       x="413.86383"
+       y="850.21722"
+       id="use4490" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4496">
+    <use
+       xlink:href="#glyph-0-6"
+       x="416.36349"
+       y="850.21722"
+       id="use4494" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4568">
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86313"
+       y="850.21722"
+       id="use4498" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="421.36279"
+       y="850.21722"
+       id="use4500" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="428.85736"
+       y="850.21722"
+       id="use4502" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="430.85623"
+       y="850.21722"
+       id="use4504" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="435.35474"
+       y="850.21722"
+       id="use4506" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="439.85324"
+       y="850.21722"
+       id="use4508" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="441.85208"
+       y="850.21722"
+       id="use4510" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="446.85577"
+       y="850.21722"
+       id="use4512" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="451.8595"
+       y="850.21722"
+       id="use4514" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="454.35916"
+       y="850.21722"
+       id="use4516" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="459.36285"
+       y="850.21722"
+       id="use4518" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="462.35892"
+       y="850.21722"
+       id="use4520" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="467.36264"
+       y="850.21722"
+       id="use4522" />
+    <use
+       xlink:href="#glyph-0-18"
+       x="472.36633"
+       y="850.21722"
+       id="use4524" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="477.37006"
+       y="850.21722"
+       id="use4526" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="481.86856"
+       y="850.21722"
+       id="use4528" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="484.36823"
+       y="850.21722"
+       id="use4530" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="486.36707"
+       y="850.21722"
+       id="use4532" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="491.37076"
+       y="850.21722"
+       id="use4534" />
+    <use
+       xlink:href="#glyph-0-10"
+       x="493.87042"
+       y="850.21722"
+       id="use4536" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="500.36777"
+       y="850.21722"
+       id="use4538" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="505.37149"
+       y="850.21722"
+       id="use4540" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="510.37518"
+       y="850.21722"
+       id="use4542" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="515.37891"
+       y="850.21722"
+       id="use4544" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="518.37494"
+       y="850.21722"
+       id="use4546" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="520.87463"
+       y="850.21722"
+       id="use4548" />
+    <use
+       xlink:href="#glyph-0-35"
+       x="522.87347"
+       y="850.21722"
+       id="use4550" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="525.37311"
+       y="850.21722"
+       id="use4552" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="527.8728"
+       y="850.21722"
+       id="use4554" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="532.37128"
+       y="850.21722"
+       id="use4556" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="537.375"
+       y="850.21722"
+       id="use4558" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="539.87463"
+       y="850.21722"
+       id="use4560" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="542.37433"
+       y="850.21722"
+       id="use4562" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="544.87396"
+       y="850.21722"
+       id="use4564" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="549.87769"
+       y="850.21722"
+       id="use4566" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g4578">
+    <use
+       xlink:href="#glyph-4-12"
+       x="552.37878"
+       y="850.21722"
+       id="use4570" />
+    <use
+       xlink:href="#glyph-4-2"
+       x="557.32794"
+       y="850.21722"
+       id="use4572" />
+    <use
+       xlink:href="#glyph-4-4"
+       x="562.2771"
+       y="850.21722"
+       id="use4574" />
+    <use
+       xlink:href="#glyph-4-8"
+       x="567.22626"
+       y="850.21722"
+       id="use4576" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4582">
+    <use
+       xlink:href="#glyph-0-33"
+       x="572.17688"
+       y="850.21722"
+       id="use4580" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4586">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="862.21326"
+       id="use4584" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4684">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="862.21326"
+       id="use4588" />
+    <use
+       xlink:href="#glyph-0-49"
+       x="411.36417"
+       y="862.21326"
+       id="use4590" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="416.36789"
+       y="862.21326"
+       id="use4592" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86752"
+       y="862.21326"
+       id="use4594" />
+    <use
+       xlink:href="#glyph-0-1"
+       x="421.36719"
+       y="862.21326"
+       id="use4596" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="427.86453"
+       y="862.21326"
+       id="use4598" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="432.36304"
+       y="862.21326"
+       id="use4600" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="437.36676"
+       y="862.21326"
+       id="use4602" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="440.36282"
+       y="862.21326"
+       id="use4604" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="442.86249"
+       y="862.21326"
+       id="use4606" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="444.86133"
+       y="862.21326"
+       id="use4608" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="449.35983"
+       y="862.21326"
+       id="use4610" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="451.8595"
+       y="862.21326"
+       id="use4612" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="456.86319"
+       y="862.21326"
+       id="use4614" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="461.36169"
+       y="862.21326"
+       id="use4616" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="465.8602"
+       y="862.21326"
+       id="use4618" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="467.85904"
+       y="862.21326"
+       id="use4620" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="472.86276"
+       y="862.21326"
+       id="use4622" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="477.86646"
+       y="862.21326"
+       id="use4624" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="482.87018"
+       y="862.21326"
+       id="use4626" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="487.87387"
+       y="862.21326"
+       id="use4628" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="490.37354"
+       y="862.21326"
+       id="use4630" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="492.8732"
+       y="862.21326"
+       id="use4632" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="497.87689"
+       y="862.21326"
+       id="use4634" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="500.37656"
+       y="862.21326"
+       id="use4636" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="505.38028"
+       y="862.21326"
+       id="use4638" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="507.37912"
+       y="862.21326"
+       id="use4640" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="509.37796"
+       y="862.21326"
+       id="use4642" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="511.87762"
+       y="862.21326"
+       id="use4644" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="516.88135"
+       y="862.21326"
+       id="use4646" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="519.87738"
+       y="862.21326"
+       id="use4648" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="524.8811"
+       y="862.21326"
+       id="use4650" />
+    <use
+       xlink:href="#glyph-0-18"
+       x="529.88483"
+       y="862.21326"
+       id="use4652" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="534.88849"
+       y="862.21326"
+       id="use4654" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="539.38702"
+       y="862.21326"
+       id="use4656" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="541.88666"
+       y="862.21326"
+       id="use4658" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="543.8855"
+       y="862.21326"
+       id="use4660" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="548.88922"
+       y="862.21326"
+       id="use4662" />
+    <use
+       xlink:href="#glyph-0-28"
+       x="551.38892"
+       y="862.21326"
+       id="use4664" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="555.88739"
+       y="862.21326"
+       id="use4666" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="557.88623"
+       y="862.21326"
+       id="use4668" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="562.88995"
+       y="862.21326"
+       id="use4670" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="564.88879"
+       y="862.21326"
+       id="use4672" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="572.38336"
+       y="862.21326"
+       id="use4674" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="574.88306"
+       y="862.21326"
+       id="use4676" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="577.38269"
+       y="862.21326"
+       id="use4678" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="582.38641"
+       y="862.21326"
+       id="use4680" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="587.39008"
+       y="862.21326"
+       id="use4682" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4688">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="872.70978"
+       id="use4686" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4692">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="872.70978"
+       id="use4690" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4696">
+    <use
+       xlink:href="#glyph-0-6"
+       x="411.36417"
+       y="872.70978"
+       id="use4694" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4700">
+    <use
+       xlink:href="#glyph-0-6"
+       x="413.86383"
+       y="872.70978"
+       id="use4698" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4704">
+    <use
+       xlink:href="#glyph-0-6"
+       x="416.36349"
+       y="872.70978"
+       id="use4702" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4736">
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86313"
+       y="872.70978"
+       id="use4706" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="421.36279"
+       y="872.70978"
+       id="use4708" />
+    <use
+       xlink:href="#glyph-0-48"
+       x="426.36652"
+       y="872.70978"
+       id="use4710" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="430.86502"
+       y="872.70978"
+       id="use4712" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="432.86386"
+       y="872.70978"
+       id="use4714" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="437.36237"
+       y="872.70978"
+       id="use4716" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="439.86203"
+       y="872.70978"
+       id="use4718" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="442.36166"
+       y="872.70978"
+       id="use4720" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="444.36053"
+       y="872.70978"
+       id="use4722" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="449.36423"
+       y="872.70978"
+       id="use4724" />
+    <use
+       xlink:href="#glyph-0-10"
+       x="451.86389"
+       y="872.70978"
+       id="use4726" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="458.36124"
+       y="872.70978"
+       id="use4728" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="463.36493"
+       y="872.70978"
+       id="use4730" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="468.36865"
+       y="872.70978"
+       id="use4732" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="473.37234"
+       y="872.70978"
+       id="use4734" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4740">
+    <use
+       xlink:href="#glyph-0-33"
+       x="475.87201"
+       y="872.70978"
+       id="use4738" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 470.000171 741.001726 L 490.001613 741.001726 L 490.001613 786.001062 L 470.000171 786.001062 Z M 470.000171 741.001726 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path4742" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 50.19989%, 94.119263%)"
+     fill-opacity="1"
+     d="M 360.253906 575.335938 C 358.859375 575.335938 357.730469 574.203125 357.730469 572.808594 C 357.730469 571.414063 358.859375 570.28125 360.253906 570.28125 C 361.648438 570.28125 362.78125 571.414063 362.78125 572.808594 C 362.78125 574.203125 361.648438 575.335938 360.253906 575.335938 Z M 360.253906 569.636719 C 358.507813 569.636719 357.082031 571.0625 357.082031 572.808594 C 357.082031 574.554688 358.507813 575.980469 360.253906 575.980469 C 362.003906 575.980469 363.425781 574.554688 363.425781 572.808594 C 363.425781 571.0625 362.003906 569.636719 360.253906 569.636719 Z M 366.734375 574.023438 L 365.585938 574.023438 C 365.445313 574.023438 365.316406 574.121094 365.277344 574.265625 C 365.160156 574.714844 364.964844 575.035156 364.746094 575.417969 C 364.671875 575.546875 364.6875 575.703125 364.792969 575.808594 L 365.601563 576.609375 L 364.050781 578.15625 L 363.238281 577.351563 C 363.132813 577.246094 362.976563 577.226563 362.847656 577.300781 L 362.773438 577.339844 C 362.398438 577.5625 362.121094 577.71875 361.710938 577.832031 C 361.566406 577.871094 361.46875 577.996094 361.46875 578.140625 L 361.46875 579.289063 L 359.039063 579.289063 L 359.039063 578.140625 C 359.039063 577.996094 358.941406 577.871094 358.800781 577.832031 C 358.359375 577.710938 358.035156 577.53125 357.632813 577.300781 C 357.503906 577.226563 357.347656 577.246094 357.242188 577.351563 L 356.4375 578.15625 L 354.902344 576.601563 L 355.703125 575.792969 C 355.800781 575.6875 355.824219 575.53125 355.75 575.402344 L 355.71875 575.34375 C 355.496094 574.960938 355.335938 574.683594 355.222656 574.265625 C 355.1875 574.121094 355.058594 574.023438 354.910156 574.023438 L 353.777344 574.023438 L 353.777344 571.59375 L 354.925781 571.59375 C 355.066406 571.59375 355.195313 571.496094 355.230469 571.355469 C 355.351563 570.90625 355.539063 570.566406 355.765625 570.179688 C 355.839844 570.050781 355.816406 569.894531 355.710938 569.789063 L 354.910156 568.984375 L 356.460938 567.433594 L 357.269531 568.242188 C 357.367188 568.347656 357.535156 568.363281 357.660156 568.296875 L 357.714844 568.257813 C 358.101563 568.035156 358.378906 567.875 358.800781 567.765625 C 358.941406 567.726563 359.039063 567.597656 359.039063 567.449219 L 359.039063 566.332031 L 361.46875 566.332031 L 361.46875 567.472656 C 361.46875 567.613281 361.566406 567.75 361.710938 567.785156 C 362.113281 567.890625 362.390625 568.054688 362.773438 568.28125 L 362.828125 568.3125 C 362.953125 568.386719 363.121094 568.371094 363.222656 568.257813 L 364.011719 567.464844 L 365.535156 569.007813 L 364.738281 569.808594 C 364.632813 569.914063 364.617188 570.074219 364.6875 570.199219 C 364.917969 570.597656 365.097656 570.90625 365.210938 571.355469 C 365.25 571.496094 365.375 571.59375 365.527344 571.59375 L 366.734375 571.59375 Z M 366.769531 570.949219 L 365.765625 570.949219 C 365.660156 570.628906 365.527344 570.367188 365.375 570.089844 L 366.019531 569.429688 C 366.253906 569.195313 366.253906 568.8125 366.019531 568.582031 L 364.445313 566.976563 C 364.214844 566.742188 363.808594 566.742188 363.578125 566.976563 L 362.9375 567.628906 C 362.675781 567.472656 362.421875 567.335938 362.113281 567.230469 L 362.113281 566.292969 C 362.113281 565.957031 361.84375 565.6875 361.507813 565.6875 L 359.003906 565.6875 C 358.664063 565.6875 358.394531 565.957031 358.394531 566.292969 L 358.394531 567.207031 C 358.082031 567.3125 357.820313 567.457031 357.546875 567.605469 L 356.890625 566.945313 C 356.65625 566.714844 356.265625 566.714844 356.035156 566.945313 L 354.421875 568.550781 C 354.308594 568.671875 354.242188 568.820313 354.242188 568.984375 C 354.242188 569.144531 354.308594 569.300781 354.421875 569.414063 L 355.082031 570.074219 C 354.925781 570.34375 354.789063 570.621094 354.675781 570.949219 L 353.738281 570.949219 C 353.402344 570.949219 353.132813 571.21875 353.132813 571.558594 L 353.132813 574.0625 C 353.132813 574.398438 353.402344 574.667969 353.738281 574.667969 L 354.667969 574.667969 C 354.773438 574.984375 354.917969 575.246094 355.066406 575.515625 L 354.40625 576.175781 C 354.175781 576.410156 354.175781 576.796875 354.414063 577.03125 L 356.011719 578.644531 C 356.125 578.753906 356.273438 578.824219 356.4375 578.824219 C 356.605469 578.824219 356.753906 578.753906 356.875 578.644531 L 357.527344 577.984375 C 357.804688 578.140625 358.074219 578.273438 358.394531 578.386719 L 358.394531 579.324219 C 358.394531 579.664063 358.664063 579.933594 359.003906 579.933594 L 361.507813 579.933594 C 361.84375 579.933594 362.113281 579.664063 362.113281 579.324219 L 362.113281 578.378906 C 362.429688 578.273438 362.691406 578.140625 362.953125 577.984375 L 363.621094 578.644531 C 363.855469 578.875 364.238281 578.875 364.476563 578.644531 L 366.089844 577.039063 C 366.199219 576.925781 366.269531 576.777344 366.269531 576.609375 C 366.269531 576.445313 366.199219 576.296875 366.089844 576.183594 L 365.429688 575.523438 C 365.578125 575.261719 365.722656 574.992188 365.824219 574.667969 L 366.769531 574.667969 C 367.109375 574.667969 367.378906 574.398438 367.378906 574.0625 L 367.378906 571.558594 C 367.378906 571.21875 367.109375 570.949219 366.769531 570.949219 Z M 366.769531 570.949219 "
+     id="path4744" />
+  <g
+     fill="#0080f0"
+     fill-opacity="1"
+     id="g4796">
+    <use
+       xlink:href="#glyph-5-1"
+       x="210.29335"
+       y="571.31"
+       id="use4746" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="215.69243"
+       y="571.31"
+       id="use4748" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="221.09152"
+       y="571.31"
+       id="use4750" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="226.4906"
+       y="571.31"
+       id="use4752" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="231.88968"
+       y="571.31"
+       id="use4754" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="237.28877"
+       y="571.31"
+       id="use4756" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="242.68785"
+       y="571.31"
+       id="use4758" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="248.08693"
+       y="571.31"
+       id="use4760" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="253.48601"
+       y="571.31"
+       id="use4762" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="258.8851"
+       y="571.31"
+       id="use4764" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="264.28418"
+       y="571.31"
+       id="use4766" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="269.68326"
+       y="571.31"
+       id="use4768" />
+    <use
+       xlink:href="#glyph-5-16"
+       x="275.08234"
+       y="571.31"
+       id="use4770" />
+    <use
+       xlink:href="#glyph-5-14"
+       x="280.48145"
+       y="571.31"
+       id="use4772" />
+    <use
+       xlink:href="#glyph-5-14"
+       x="285.88052"
+       y="571.31"
+       id="use4774" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="291.2796"
+       y="571.31"
+       id="use4776" />
+    <use
+       xlink:href="#glyph-5-19"
+       x="296.67868"
+       y="571.31"
+       id="use4778" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="302.07776"
+       y="571.31"
+       id="use4780" />
+    <use
+       xlink:href="#glyph-5-17"
+       x="307.47684"
+       y="571.31"
+       id="use4782" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="312.87595"
+       y="571.31"
+       id="use4784" />
+    <use
+       xlink:href="#glyph-5-9"
+       x="318.27502"
+       y="571.31"
+       id="use4786" />
+    <use
+       xlink:href="#glyph-5-18"
+       x="323.6741"
+       y="571.31"
+       id="use4788" />
+    <use
+       xlink:href="#glyph-5-10"
+       x="329.07318"
+       y="571.31"
+       id="use4790" />
+    <use
+       xlink:href="#glyph-5-11"
+       x="334.47226"
+       y="571.31"
+       id="use4792" />
+    <use
+       xlink:href="#glyph-5-17"
+       x="339.87134"
+       y="571.31"
+       id="use4794" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g4832">
+    <use
+       xlink:href="#glyph-6-1"
+       x="243.35266"
+       y="583.30603"
+       id="use4798" />
+    <use
+       xlink:href="#glyph-6-2"
+       x="247.40198"
+       y="583.30603"
+       id="use4800" />
+    <use
+       xlink:href="#glyph-6-3"
+       x="251.45129"
+       y="583.30603"
+       id="use4802" />
+    <use
+       xlink:href="#glyph-6-4"
+       x="255.50061"
+       y="583.30603"
+       id="use4804" />
+    <use
+       xlink:href="#glyph-6-5"
+       x="259.54993"
+       y="583.30603"
+       id="use4806" />
+    <use
+       xlink:href="#glyph-6-6"
+       x="263.59924"
+       y="583.30603"
+       id="use4808" />
+    <use
+       xlink:href="#glyph-6-7"
+       x="267.64853"
+       y="583.30603"
+       id="use4810" />
+    <use
+       xlink:href="#glyph-6-8"
+       x="271.69785"
+       y="583.30603"
+       id="use4812" />
+    <use
+       xlink:href="#glyph-6-9"
+       x="275.74716"
+       y="583.30603"
+       id="use4814" />
+    <use
+       xlink:href="#glyph-6-10"
+       x="279.79648"
+       y="583.30603"
+       id="use4816" />
+    <use
+       xlink:href="#glyph-6-11"
+       x="283.84579"
+       y="583.30603"
+       id="use4818" />
+    <use
+       xlink:href="#glyph-6-12"
+       x="287.89511"
+       y="583.30603"
+       id="use4820" />
+    <use
+       xlink:href="#glyph-6-13"
+       x="291.94443"
+       y="583.30603"
+       id="use4822" />
+    <use
+       xlink:href="#glyph-6-14"
+       x="295.99374"
+       y="583.30603"
+       id="use4824" />
+    <use
+       xlink:href="#glyph-6-15"
+       x="300.04303"
+       y="583.30603"
+       id="use4826" />
+    <use
+       xlink:href="#glyph-6-12"
+       x="304.09235"
+       y="583.30603"
+       id="use4828" />
+    <use
+       xlink:href="#glyph-6-16"
+       x="308.14166"
+       y="583.30603"
+       id="use4830" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 490.001613 752.250258 C 496.665286 751.416647 503.33417 752.667063 509.997844 756.001505 C 516.666728 759.330737 518.333949 762.665178 514.999507 765.99962 C 511.665065 769.334062 505.418196 771.860944 496.258901 773.580266 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path4834" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 491.100936 774.538918 L 497.332175 769.808178 L 496.258901 773.580266 L 498.619061 776.690675 Z M 491.100936 774.538918 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path4836" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4902">
+    <use
+       xlink:href="#glyph-0-13"
+       x="398.08246"
+       y="569.81049"
+       id="use4838" />
+    <use
+       xlink:href="#glyph-0-35"
+       x="400.58212"
+       y="569.81049"
+       id="use4840" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="403.08179"
+       y="569.81049"
+       id="use4842" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="405.58142"
+       y="569.81049"
+       id="use4844" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="410.58514"
+       y="569.81049"
+       id="use4846" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="415.08365"
+       y="569.81049"
+       id="use4848" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="420.08734"
+       y="569.81049"
+       id="use4850" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="423.08344"
+       y="569.81049"
+       id="use4852" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="425.58307"
+       y="569.81049"
+       id="use4854" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="430.58679"
+       y="569.81049"
+       id="use4856" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="435.59048"
+       y="569.81049"
+       id="use4858" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="440.59421"
+       y="569.81049"
+       id="use4860" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="445.09271"
+       y="569.81049"
+       id="use4862" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="447.59235"
+       y="569.81049"
+       id="use4864" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="452.59607"
+       y="569.81049"
+       id="use4866" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="457.59976"
+       y="569.81049"
+       id="use4868" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="460.09943"
+       y="569.81049"
+       id="use4870" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="462.59909"
+       y="569.81049"
+       id="use4872" />
+    <use
+       xlink:href="#glyph-0-48"
+       x="467.60278"
+       y="569.81049"
+       id="use4874" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="472.10129"
+       y="569.81049"
+       id="use4876" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="474.10016"
+       y="569.81049"
+       id="use4878" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="478.59866"
+       y="569.81049"
+       id="use4880" />
+    <use
+       xlink:href="#glyph-0-45"
+       x="481.0983"
+       y="569.81049"
+       id="use4882" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="483.59796"
+       y="569.81049"
+       id="use4884" />
+    <use
+       xlink:href="#glyph-0-28"
+       x="486.09763"
+       y="569.81049"
+       id="use4886" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="490.59613"
+       y="569.81049"
+       id="use4888" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="495.59982"
+       y="569.81049"
+       id="use4890" />
+    <use
+       xlink:href="#glyph-0-28"
+       x="500.60355"
+       y="569.81049"
+       id="use4892" />
+    <use
+       xlink:href="#glyph-0-29"
+       x="505.10205"
+       y="569.81049"
+       id="use4894" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="509.60056"
+       y="569.81049"
+       id="use4896" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="512.10022"
+       y="569.81049"
+       id="use4898" />
+    <use
+       xlink:href="#glyph-0-35"
+       x="514.09906"
+       y="569.81049"
+       id="use4900" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g4970">
+    <use
+       xlink:href="#glyph-0-23"
+       x="394.82571"
+       y="580.30701"
+       id="use4904" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="399.82944"
+       y="580.30701"
+       id="use4906" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="401.82828"
+       y="580.30701"
+       id="use4908" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="403.82712"
+       y="580.30701"
+       id="use4910" />
+    <use
+       xlink:href="#glyph-0-9"
+       x="408.83084"
+       y="580.30701"
+       id="use4912" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="415.32819"
+       y="580.30701"
+       id="use4914" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="417.32703"
+       y="580.30701"
+       id="use4916" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="422.33075"
+       y="580.30701"
+       id="use4918" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="427.33444"
+       y="580.30701"
+       id="use4920" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="429.83411"
+       y="580.30701"
+       id="use4922" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="434.33261"
+       y="580.30701"
+       id="use4924" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="436.33145"
+       y="580.30701"
+       id="use4926" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="441.33517"
+       y="580.30701"
+       id="use4928" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="446.33887"
+       y="580.30701"
+       id="use4930" />
+    <use
+       xlink:href="#glyph-0-18"
+       x="451.34259"
+       y="580.30701"
+       id="use4932" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="456.34628"
+       y="580.30701"
+       id="use4934" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="460.84479"
+       y="580.30701"
+       id="use4936" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="463.34445"
+       y="580.30701"
+       id="use4938" />
+    <use
+       xlink:href="#glyph-0-41"
+       x="465.84412"
+       y="580.30701"
+       id="use4940" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="472.34146"
+       y="580.30701"
+       id="use4942" />
+    <use
+       xlink:href="#glyph-0-50"
+       x="477.34515"
+       y="580.30701"
+       id="use4944" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="479.34399"
+       y="580.30701"
+       id="use4946" />
+    <use
+       xlink:href="#glyph-0-28"
+       x="484.34772"
+       y="580.30701"
+       id="use4948" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="488.84622"
+       y="580.30701"
+       id="use4950" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="491.34589"
+       y="580.30701"
+       id="use4952" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="493.84552"
+       y="580.30701"
+       id="use4954" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="495.84439"
+       y="580.30701"
+       id="use4956" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="500.84808"
+       y="580.30701"
+       id="use4958" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="505.85181"
+       y="580.30701"
+       id="use4960" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="507.85065"
+       y="580.30701"
+       id="use4962" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="512.85437"
+       y="580.30701"
+       id="use4964" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="515.354"
+       y="580.30701"
+       id="use4966" />
+    <use
+       xlink:href="#glyph-0-35"
+       x="517.35284"
+       y="580.30701"
+       id="use4968" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5006">
+    <use
+       xlink:href="#glyph-0-2"
+       x="422.57822"
+       y="591.55328"
+       id="use4972" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="427.07672"
+       y="591.55328"
+       id="use4974" />
+    <use
+       xlink:href="#glyph-0-20"
+       x="429.07556"
+       y="591.55328"
+       id="use4976" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="434.07928"
+       y="591.55328"
+       id="use4978" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="439.08298"
+       y="591.55328"
+       id="use4980" />
+    <use
+       xlink:href="#glyph-0-18"
+       x="444.0867"
+       y="591.55328"
+       id="use4982" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="449.09039"
+       y="591.55328"
+       id="use4984" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="453.5889"
+       y="591.55328"
+       id="use4986" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="456.08856"
+       y="591.55328"
+       id="use4988" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="461.09225"
+       y="591.55328"
+       id="use4990" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="463.09109"
+       y="591.55328"
+       id="use4992" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="467.5896"
+       y="591.55328"
+       id="use4994" />
+    <use
+       xlink:href="#glyph-0-32"
+       x="472.59332"
+       y="591.55328"
+       id="use4996" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="477.59702"
+       y="591.55328"
+       id="use4998" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="479.59589"
+       y="591.55328"
+       id="use5000" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="484.59958"
+       y="591.55328"
+       id="use5002" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="489.6033"
+       y="591.55328"
+       id="use5004" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5042">
+    <use
+       xlink:href="#glyph-8-22"
+       x="411.60141"
+       y="558.56421"
+       id="use5008" />
+    <use
+       xlink:href="#glyph-8-5"
+       x="418.09875"
+       y="558.56421"
+       id="use5010" />
+    <use
+       xlink:href="#glyph-8-2"
+       x="423.59448"
+       y="558.56421"
+       id="use5012" />
+    <use
+       xlink:href="#glyph-8-4"
+       x="428.59818"
+       y="558.56421"
+       id="use5014" />
+    <use
+       xlink:href="#glyph-8-23"
+       x="433.6019"
+       y="558.56421"
+       id="use5016" />
+    <use
+       xlink:href="#glyph-8-6"
+       x="438.60559"
+       y="558.56421"
+       id="use5018" />
+    <use
+       xlink:href="#glyph-8-11"
+       x="441.10526"
+       y="558.56421"
+       id="use5020" />
+    <use
+       xlink:href="#glyph-8-2"
+       x="446.60098"
+       y="558.56421"
+       id="use5022" />
+    <use
+       xlink:href="#glyph-8-24"
+       x="451.60471"
+       y="558.56421"
+       id="use5024" />
+    <use
+       xlink:href="#glyph-8-6"
+       x="458.60284"
+       y="558.56421"
+       id="use5026" />
+    <use
+       xlink:href="#glyph-8-8"
+       x="461.10251"
+       y="558.56421"
+       id="use5028" />
+    <use
+       xlink:href="#glyph-8-10"
+       x="466.10623"
+       y="558.56421"
+       id="use5030" />
+    <use
+       xlink:href="#glyph-8-21"
+       x="468.60587"
+       y="558.56421"
+       id="use5032" />
+    <use
+       xlink:href="#glyph-8-11"
+       x="474.10162"
+       y="558.56421"
+       id="use5034" />
+    <use
+       xlink:href="#glyph-8-7"
+       x="479.59735"
+       y="558.56421"
+       id="use5036" />
+    <use
+       xlink:href="#glyph-8-15"
+       x="485.09308"
+       y="558.56421"
+       id="use5038" />
+    <use
+       xlink:href="#glyph-8-8"
+       x="490.58881"
+       y="558.56421"
+       id="use5040" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 469.500005 1197.997408 L 489.501446 1197.997408 L 489.501446 1243.001953 L 469.500005 1243.001953 Z M 469.500005 1197.997408 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path5044" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 50.19989%, 94.119263%)"
+     fill-opacity="1"
+     d="M 359.503906 919.847656 C 358.109375 919.847656 356.980469 918.714844 356.980469 917.320313 C 356.980469 915.925781 358.109375 914.792969 359.503906 914.792969 C 360.898438 914.792969 362.03125 915.925781 362.03125 917.320313 C 362.03125 918.714844 360.898438 919.847656 359.503906 919.847656 Z M 359.503906 914.148438 C 357.757813 914.148438 356.335938 915.574219 356.335938 917.320313 C 356.335938 919.066406 357.757813 920.492188 359.503906 920.492188 C 361.253906 920.492188 362.675781 919.066406 362.675781 917.320313 C 362.675781 915.574219 361.253906 914.148438 359.503906 914.148438 Z M 365.984375 918.535156 L 364.835938 918.535156 C 364.695313 918.535156 364.566406 918.632813 364.527344 918.773438 C 364.410156 919.222656 364.214844 919.546875 363.996094 919.929688 C 363.921875 920.054688 363.9375 920.214844 364.042969 920.320313 L 364.851563 921.121094 L 363.300781 922.664063 L 362.488281 921.863281 C 362.382813 921.757813 362.226563 921.734375 362.097656 921.8125 L 362.023438 921.847656 C 361.648438 922.074219 361.371094 922.230469 360.960938 922.34375 C 360.816406 922.378906 360.71875 922.507813 360.71875 922.652344 L 360.71875 923.796875 L 358.289063 923.796875 L 358.289063 922.652344 C 358.289063 922.507813 358.195313 922.378906 358.050781 922.34375 C 357.609375 922.222656 357.285156 922.042969 356.882813 921.8125 C 356.753906 921.734375 356.597656 921.757813 356.492188 921.863281 L 355.6875 922.664063 L 354.152344 921.113281 L 354.953125 920.304688 C 355.050781 920.199219 355.074219 920.042969 355 919.914063 L 354.96875 919.855469 C 354.746094 919.472656 354.585938 919.195313 354.476563 918.773438 C 354.4375 918.632813 354.308594 918.535156 354.160156 918.535156 L 353.027344 918.535156 L 353.027344 916.105469 L 354.175781 916.105469 C 354.316406 916.105469 354.445313 916.007813 354.480469 915.867188 C 354.601563 915.414063 354.789063 915.078125 355.015625 914.6875 C 355.089844 914.5625 355.066406 914.402344 354.960938 914.296875 L 354.160156 913.496094 L 355.710938 911.945313 L 356.519531 912.753906 C 356.617188 912.859375 356.785156 912.875 356.910156 912.804688 L 356.964844 912.769531 C 357.355469 912.542969 357.632813 912.386719 358.050781 912.273438 C 358.195313 912.238281 358.289063 912.109375 358.289063 911.960938 L 358.289063 910.84375 L 360.71875 910.84375 L 360.71875 911.980469 C 360.71875 912.125 360.816406 912.257813 360.960938 912.296875 C 361.363281 912.402344 361.640625 912.566406 362.023438 912.792969 L 362.078125 912.820313 C 362.203125 912.894531 362.371094 912.882813 362.472656 912.769531 L 363.261719 911.972656 L 364.785156 913.519531 L 363.988281 914.320313 C 363.882813 914.425781 363.867188 914.582031 363.9375 914.710938 C 364.167969 915.109375 364.347656 915.414063 364.460938 915.867188 C 364.5 916.007813 364.625 916.105469 364.777344 916.105469 L 365.984375 916.105469 Z M 366.019531 915.460938 L 365.015625 915.460938 C 364.910156 915.136719 364.777344 914.875 364.625 914.597656 L 365.269531 913.9375 C 365.503906 913.707031 365.503906 913.324219 365.269531 913.089844 L 363.695313 911.488281 C 363.464844 911.253906 363.058594 911.253906 362.828125 911.488281 L 362.191406 912.140625 C 361.925781 911.980469 361.671875 911.847656 361.363281 911.742188 L 361.363281 910.804688 C 361.363281 910.46875 361.09375 910.199219 360.757813 910.199219 L 358.253906 910.199219 C 357.914063 910.199219 357.644531 910.46875 357.644531 910.804688 L 357.644531 911.71875 C 357.332031 911.824219 357.070313 911.964844 356.800781 912.117188 L 356.140625 911.457031 C 355.90625 911.222656 355.515625 911.222656 355.285156 911.457031 L 353.671875 913.0625 C 353.558594 913.179688 353.492188 913.332031 353.492188 913.496094 C 353.492188 913.652344 353.558594 913.8125 353.671875 913.921875 L 354.332031 914.582031 C 354.175781 914.851563 354.039063 915.128906 353.925781 915.460938 L 352.988281 915.460938 C 352.652344 915.460938 352.382813 915.730469 352.382813 916.066406 L 352.382813 918.570313 C 352.382813 918.910156 352.652344 919.179688 352.988281 919.179688 L 353.917969 919.179688 C 354.023438 919.496094 354.167969 919.757813 354.316406 920.027344 L 353.65625 920.6875 C 353.425781 920.917969 353.425781 921.308594 353.664063 921.542969 L 355.261719 923.152344 C 355.375 923.265625 355.523438 923.332031 355.6875 923.332031 C 355.855469 923.332031 356.003906 923.265625 356.125 923.152344 L 356.777344 922.492188 C 357.054688 922.652344 357.324219 922.785156 357.644531 922.898438 L 357.644531 923.835938 C 357.644531 924.171875 357.914063 924.441406 358.253906 924.441406 L 360.757813 924.441406 C 361.09375 924.441406 361.363281 924.171875 361.363281 923.835938 L 361.363281 922.890625 C 361.679688 922.785156 361.941406 922.652344 362.203125 922.492188 L 362.871094 923.152344 C 363.105469 923.386719 363.488281 923.386719 363.726563 923.152344 L 365.339844 921.546875 C 365.449219 921.4375 365.519531 921.285156 365.519531 921.121094 C 365.519531 920.957031 365.449219 920.804688 365.339844 920.695313 L 364.679688 920.035156 C 364.828125 919.773438 364.972656 919.5 365.074219 919.179688 L 366.019531 919.179688 C 366.359375 919.179688 366.628906 918.910156 366.628906 918.570313 L 366.628906 916.066406 C 366.628906 915.730469 366.359375 915.460938 366.019531 915.460938 Z M 366.019531 915.460938 "
+     id="path5046" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5068">
+    <use
+       xlink:href="#glyph-8-25"
+       x="475.82224"
+       y="889.95404"
+       id="use5048" />
+    <use
+       xlink:href="#glyph-8-13"
+       x="482.31958"
+       y="889.95404"
+       id="use5050" />
+    <use
+       xlink:href="#glyph-8-26"
+       x="487.81531"
+       y="889.95404"
+       id="use5052" />
+    <use
+       xlink:href="#glyph-8-2"
+       x="490.31497"
+       y="889.95404"
+       id="use5054" />
+    <use
+       xlink:href="#glyph-8-8"
+       x="495.31866"
+       y="889.95404"
+       id="use5056" />
+    <use
+       xlink:href="#glyph-8-6"
+       x="500.32239"
+       y="889.95404"
+       id="use5058" />
+    <use
+       xlink:href="#glyph-8-16"
+       x="502.82205"
+       y="889.95404"
+       id="use5060" />
+    <use
+       xlink:href="#glyph-8-17"
+       x="508.82297"
+       y="889.95404"
+       id="use5062" />
+    <use
+       xlink:href="#glyph-8-11"
+       x="513.82666"
+       y="889.95404"
+       id="use5064" />
+    <use
+       xlink:href="#glyph-8-4"
+       x="519.32239"
+       y="889.95404"
+       id="use5066" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     d="M 405.238281 898.574219 L 600.175781 898.574219 L 600.175781 966.054688 L 405.238281 966.054688 Z M 405.238281 898.574219 "
+     id="path5070" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     d="M 409.738281 898.203125 L 411.988281 898.203125 L 411.988281 898.949219 L 409.738281 898.949219 Z M 414.238281 898.203125 L 416.488281 898.203125 L 416.488281 898.949219 L 414.238281 898.949219 Z M 418.734375 898.203125 L 420.984375 898.203125 L 420.984375 898.949219 L 418.734375 898.949219 Z M 423.234375 898.203125 L 425.484375 898.203125 L 425.484375 898.949219 L 423.234375 898.949219 Z M 427.734375 898.203125 L 429.980469 898.203125 L 429.980469 898.949219 L 427.734375 898.949219 Z M 432.230469 898.203125 L 434.480469 898.203125 L 434.480469 898.949219 L 432.230469 898.949219 Z M 436.730469 898.203125 L 438.980469 898.203125 L 438.980469 898.949219 L 436.730469 898.949219 Z M 441.226563 898.203125 L 443.476563 898.203125 L 443.476563 898.949219 L 441.226563 898.949219 Z M 445.726563 898.203125 L 447.976563 898.203125 L 447.976563 898.949219 L 445.726563 898.949219 Z M 450.226563 898.203125 L 452.472656 898.203125 L 452.472656 898.949219 L 450.226563 898.949219 Z M 454.722656 898.203125 L 456.972656 898.203125 L 456.972656 898.949219 L 454.722656 898.949219 Z M 459.222656 898.203125 L 461.472656 898.203125 L 461.472656 898.949219 L 459.222656 898.949219 Z M 463.722656 898.203125 L 465.96875 898.203125 L 465.96875 898.949219 L 463.722656 898.949219 Z M 468.21875 898.203125 L 470.46875 898.203125 L 470.46875 898.949219 L 468.21875 898.949219 Z M 472.71875 898.203125 L 474.96875 898.203125 L 474.96875 898.949219 L 472.71875 898.949219 Z M 477.214844 898.203125 L 479.464844 898.203125 L 479.464844 898.949219 L 477.214844 898.949219 Z M 481.714844 898.203125 L 483.964844 898.203125 L 483.964844 898.949219 L 481.714844 898.949219 Z M 486.214844 898.203125 L 488.460938 898.203125 L 488.460938 898.949219 L 486.214844 898.949219 Z M 490.710938 898.203125 L 492.960938 898.203125 L 492.960938 898.949219 L 490.710938 898.949219 Z M 495.210938 898.203125 L 497.460938 898.203125 L 497.460938 898.949219 L 495.210938 898.949219 Z M 499.707031 898.203125 L 501.957031 898.203125 L 501.957031 898.949219 L 499.707031 898.949219 Z M 504.207031 898.203125 L 506.457031 898.203125 L 506.457031 898.949219 L 504.207031 898.949219 Z M 508.707031 898.203125 L 510.953125 898.203125 L 510.953125 898.949219 L 508.707031 898.949219 Z M 513.203125 898.203125 L 515.453125 898.203125 L 515.453125 898.949219 L 513.203125 898.949219 Z M 517.703125 898.203125 L 519.953125 898.203125 L 519.953125 898.949219 L 517.703125 898.949219 Z M 522.203125 898.203125 L 524.449219 898.203125 L 524.449219 898.949219 L 522.203125 898.949219 Z M 526.699219 898.203125 L 528.949219 898.203125 L 528.949219 898.949219 L 526.699219 898.949219 Z M 531.199219 898.203125 L 533.449219 898.203125 L 533.449219 898.949219 L 531.199219 898.949219 Z M 535.695313 898.203125 L 537.945313 898.203125 L 537.945313 898.949219 L 535.695313 898.949219 Z M 540.195313 898.203125 L 542.445313 898.203125 L 542.445313 898.949219 L 540.195313 898.949219 Z M 544.695313 898.203125 L 546.941406 898.203125 L 546.941406 898.949219 L 544.695313 898.949219 Z M 549.191406 898.203125 L 551.441406 898.203125 L 551.441406 898.949219 L 549.191406 898.949219 Z M 553.691406 898.203125 L 555.941406 898.203125 L 555.941406 898.949219 L 553.691406 898.949219 Z M 558.1875 898.203125 L 560.4375 898.203125 L 560.4375 898.949219 L 558.1875 898.949219 Z M 562.6875 898.203125 L 564.9375 898.203125 L 564.9375 898.949219 L 562.6875 898.949219 Z M 567.1875 898.203125 L 569.4375 898.203125 L 569.4375 898.949219 L 567.1875 898.949219 Z M 571.683594 898.203125 L 573.933594 898.203125 L 573.933594 898.949219 L 571.683594 898.949219 Z M 576.183594 898.203125 L 578.433594 898.203125 L 578.433594 898.949219 L 576.183594 898.949219 Z M 580.683594 898.203125 L 582.929688 898.203125 L 582.929688 898.949219 L 580.683594 898.949219 Z M 585.179688 898.203125 L 587.429688 898.203125 L 587.429688 898.949219 L 585.179688 898.949219 Z M 589.679688 898.203125 L 591.929688 898.203125 L 591.929688 898.949219 L 589.679688 898.949219 Z M 594.175781 898.203125 L 596.425781 898.203125 L 596.425781 898.949219 L 594.175781 898.949219 Z M 598.675781 898.203125 L 600.550781 898.203125 L 600.550781 899.324219 L 599.800781 899.324219 L 599.800781 898.574219 L 600.175781 898.574219 L 600.175781 898.949219 L 598.675781 898.949219 Z M 600.550781 901.574219 L 600.550781 903.824219 L 599.800781 903.824219 L 599.800781 901.574219 Z M 600.550781 906.074219 L 600.550781 908.324219 L 599.800781 908.324219 L 599.800781 906.074219 Z M 600.550781 910.570313 L 600.550781 912.820313 L 599.800781 912.820313 L 599.800781 910.570313 Z M 600.550781 915.070313 L 600.550781 917.320313 L 599.800781 917.320313 L 599.800781 915.070313 Z M 600.550781 919.570313 L 600.550781 921.820313 L 599.800781 921.820313 L 599.800781 919.570313 Z M 600.550781 924.066406 L 600.550781 926.316406 L 599.800781 926.316406 L 599.800781 924.066406 Z M 600.550781 928.566406 L 600.550781 930.816406 L 599.800781 930.816406 L 599.800781 928.566406 Z M 600.550781 933.066406 L 600.550781 935.3125 L 599.800781 935.3125 L 599.800781 933.066406 Z M 600.550781 937.5625 L 600.550781 939.8125 L 599.800781 939.8125 L 599.800781 937.5625 Z M 600.550781 942.0625 L 600.550781 944.3125 L 599.800781 944.3125 L 599.800781 942.0625 Z M 600.550781 946.558594 L 600.550781 948.808594 L 599.800781 948.808594 L 599.800781 946.558594 Z M 600.550781 951.058594 L 600.550781 953.308594 L 599.800781 953.308594 L 599.800781 951.058594 Z M 600.550781 955.558594 L 600.550781 957.804688 L 599.800781 957.804688 L 599.800781 955.558594 Z M 600.550781 960.054688 L 600.550781 962.304688 L 599.800781 962.304688 L 599.800781 960.054688 Z M 600.550781 964.554688 L 600.550781 966.429688 L 599.425781 966.429688 L 599.425781 965.679688 L 600.175781 965.679688 L 600.175781 966.054688 L 599.800781 966.054688 L 599.800781 964.554688 Z M 597.175781 966.429688 L 594.925781 966.429688 L 594.925781 965.679688 L 597.175781 965.679688 Z M 592.679688 966.429688 L 590.429688 966.429688 L 590.429688 965.679688 L 592.679688 965.679688 Z M 588.179688 966.429688 L 585.929688 966.429688 L 585.929688 965.679688 L 588.179688 965.679688 Z M 583.679688 966.429688 L 581.429688 966.429688 L 581.429688 965.679688 L 583.679688 965.679688 Z M 579.183594 966.429688 L 576.933594 966.429688 L 576.933594 965.679688 L 579.183594 965.679688 Z M 574.683594 966.429688 L 572.433594 966.429688 L 572.433594 965.679688 L 574.683594 965.679688 Z M 570.183594 966.429688 L 567.9375 966.429688 L 567.9375 965.679688 L 570.183594 965.679688 Z M 565.6875 966.429688 L 563.4375 966.429688 L 563.4375 965.679688 L 565.6875 965.679688 Z M 561.1875 966.429688 L 558.9375 966.429688 L 558.9375 965.679688 L 561.1875 965.679688 Z M 556.691406 966.429688 L 554.441406 966.429688 L 554.441406 965.679688 L 556.691406 965.679688 Z M 552.191406 966.429688 L 549.941406 966.429688 L 549.941406 965.679688 L 552.191406 965.679688 Z M 547.691406 966.429688 L 545.445313 966.429688 L 545.445313 965.679688 L 547.691406 965.679688 Z M 543.195313 966.429688 L 540.945313 966.429688 L 540.945313 965.679688 L 543.195313 965.679688 Z M 538.695313 966.429688 L 536.445313 966.429688 L 536.445313 965.679688 L 538.695313 965.679688 Z M 534.199219 966.429688 L 531.949219 966.429688 L 531.949219 965.679688 L 534.199219 965.679688 Z M 529.699219 966.429688 L 527.449219 966.429688 L 527.449219 965.679688 L 529.699219 965.679688 Z M 525.199219 966.429688 L 522.949219 966.429688 L 522.949219 965.679688 L 525.199219 965.679688 Z M 520.703125 966.429688 L 518.453125 966.429688 L 518.453125 965.679688 L 520.703125 965.679688 Z M 516.203125 966.429688 L 513.953125 966.429688 L 513.953125 965.679688 L 516.203125 965.679688 Z M 511.703125 966.429688 L 509.457031 966.429688 L 509.457031 965.679688 L 511.703125 965.679688 Z M 507.207031 966.429688 L 504.957031 966.429688 L 504.957031 965.679688 L 507.207031 965.679688 Z M 502.707031 966.429688 L 500.457031 966.429688 L 500.457031 965.679688 L 502.707031 965.679688 Z M 498.210938 966.429688 L 495.960938 966.429688 L 495.960938 965.679688 L 498.210938 965.679688 Z M 493.710938 966.429688 L 491.460938 966.429688 L 491.460938 965.679688 L 493.710938 965.679688 Z M 489.210938 966.429688 L 486.964844 966.429688 L 486.964844 965.679688 L 489.210938 965.679688 Z M 484.714844 966.429688 L 482.464844 966.429688 L 482.464844 965.679688 L 484.714844 965.679688 Z M 480.214844 966.429688 L 477.964844 966.429688 L 477.964844 965.679688 L 480.214844 965.679688 Z M 475.714844 966.429688 L 473.46875 966.429688 L 473.46875 965.679688 L 475.714844 965.679688 Z M 471.21875 966.429688 L 468.96875 966.429688 L 468.96875 965.679688 L 471.21875 965.679688 Z M 466.71875 966.429688 L 464.46875 966.429688 L 464.46875 965.679688 L 466.71875 965.679688 Z M 462.222656 966.429688 L 459.972656 966.429688 L 459.972656 965.679688 L 462.222656 965.679688 Z M 457.722656 966.429688 L 455.472656 966.429688 L 455.472656 965.679688 L 457.722656 965.679688 Z M 453.222656 966.429688 L 450.976563 966.429688 L 450.976563 965.679688 L 453.222656 965.679688 Z M 448.726563 966.429688 L 446.476563 966.429688 L 446.476563 965.679688 L 448.726563 965.679688 Z M 444.226563 966.429688 L 441.976563 966.429688 L 441.976563 965.679688 L 444.226563 965.679688 Z M 439.730469 966.429688 L 437.480469 966.429688 L 437.480469 965.679688 L 439.730469 965.679688 Z M 435.230469 966.429688 L 432.980469 966.429688 L 432.980469 965.679688 L 435.230469 965.679688 Z M 430.730469 966.429688 L 428.484375 966.429688 L 428.484375 965.679688 L 430.730469 965.679688 Z M 426.234375 966.429688 L 423.984375 966.429688 L 423.984375 965.679688 L 426.234375 965.679688 Z M 421.734375 966.429688 L 419.484375 966.429688 L 419.484375 965.679688 L 421.734375 965.679688 Z M 417.234375 966.429688 L 414.988281 966.429688 L 414.988281 965.679688 L 417.234375 965.679688 Z M 412.738281 966.429688 L 410.488281 966.429688 L 410.488281 965.679688 L 412.738281 965.679688 Z M 408.238281 966.429688 L 405.988281 966.429688 L 405.988281 965.679688 L 408.238281 965.679688 Z M 404.867188 964.554688 L 404.867188 962.304688 L 405.613281 962.304688 L 405.613281 964.554688 Z M 404.867188 960.054688 L 404.867188 957.804688 L 405.613281 957.804688 L 405.613281 960.054688 Z M 404.867188 955.558594 L 404.867188 953.308594 L 405.613281 953.308594 L 405.613281 955.558594 Z M 404.867188 951.058594 L 404.867188 948.808594 L 405.613281 948.808594 L 405.613281 951.058594 Z M 404.867188 946.558594 L 404.867188 944.3125 L 405.613281 944.3125 L 405.613281 946.558594 Z M 404.867188 942.0625 L 404.867188 939.8125 L 405.613281 939.8125 L 405.613281 942.0625 Z M 404.867188 937.5625 L 404.867188 935.3125 L 405.613281 935.3125 L 405.613281 937.5625 Z M 404.867188 933.066406 L 404.867188 930.816406 L 405.613281 930.816406 L 405.613281 933.066406 Z M 404.867188 928.566406 L 404.867188 926.316406 L 405.613281 926.316406 L 405.613281 928.566406 Z M 404.867188 924.066406 L 404.867188 921.820313 L 405.613281 921.820313 L 405.613281 924.066406 Z M 404.867188 919.570313 L 404.867188 917.320313 L 405.613281 917.320313 L 405.613281 919.570313 Z M 404.867188 915.070313 L 404.867188 912.820313 L 405.613281 912.820313 L 405.613281 915.070313 Z M 404.867188 910.570313 L 404.867188 908.324219 L 405.613281 908.324219 L 405.613281 910.570313 Z M 404.867188 906.074219 L 404.867188 903.824219 L 405.613281 903.824219 L 405.613281 906.074219 Z M 404.867188 901.574219 L 404.867188 899.324219 L 405.613281 899.324219 L 405.613281 901.574219 Z M 405.238281 898.203125 L 407.488281 898.203125 L 407.488281 898.949219 L 405.238281 898.949219 Z M 405.238281 898.203125 "
+     id="path5072" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5076">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="911.69678"
+       id="use5074" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5102">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="911.69678"
+       id="use5078" />
+    <use
+       xlink:href="#glyph-0-43"
+       x="411.36417"
+       y="911.69678"
+       id="use5080" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="416.36789"
+       y="911.69678"
+       id="use5082" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86752"
+       y="911.69678"
+       id="use5084" />
+    <use
+       xlink:href="#glyph-0-44"
+       x="421.36719"
+       y="911.69678"
+       id="use5086" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="426.37091"
+       y="911.69678"
+       id="use5088" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="431.3746"
+       y="911.69678"
+       id="use5090" />
+    <use
+       xlink:href="#glyph-0-29"
+       x="436.37833"
+       y="911.69678"
+       id="use5092" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="440.87683"
+       y="911.69678"
+       id="use5094" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="443.37646"
+       y="911.69678"
+       id="use5096" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="448.38019"
+       y="911.69678"
+       id="use5098" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="450.87982"
+       y="911.69678"
+       id="use5100" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g5156">
+    <use
+       xlink:href="#glyph-4-16"
+       x="453.38828"
+       y="911.69678"
+       id="use5104" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="458.33743"
+       y="911.69678"
+       id="use5106" />
+    <use
+       xlink:href="#glyph-4-18"
+       x="463.28659"
+       y="911.69678"
+       id="use5108" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="468.23575"
+       y="911.69678"
+       id="use5110" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="473.18491"
+       y="911.69678"
+       id="use5112" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="478.13409"
+       y="911.69678"
+       id="use5114" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="483.08325"
+       y="911.69678"
+       id="use5116" />
+    <use
+       xlink:href="#glyph-4-21"
+       x="488.03241"
+       y="911.69678"
+       id="use5118" />
+    <use
+       xlink:href="#glyph-4-18"
+       x="492.98157"
+       y="911.69678"
+       id="use5120" />
+    <use
+       xlink:href="#glyph-4-16"
+       x="497.93073"
+       y="911.69678"
+       id="use5122" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="502.87988"
+       y="911.69678"
+       id="use5124" />
+    <use
+       xlink:href="#glyph-4-23"
+       x="507.82904"
+       y="911.69678"
+       id="use5126" />
+    <use
+       xlink:href="#glyph-4-27"
+       x="512.7782"
+       y="911.69678"
+       id="use5128" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="517.72736"
+       y="911.69678"
+       id="use5130" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="522.67651"
+       y="911.69678"
+       id="use5132" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="527.62567"
+       y="911.69678"
+       id="use5134" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="532.57483"
+       y="911.69678"
+       id="use5136" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="537.52399"
+       y="911.69678"
+       id="use5138" />
+    <use
+       xlink:href="#glyph-4-26"
+       x="542.47314"
+       y="911.69678"
+       id="use5140" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="547.4223"
+       y="911.69678"
+       id="use5142" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="552.37146"
+       y="911.69678"
+       id="use5144" />
+    <use
+       xlink:href="#glyph-4-25"
+       x="557.32062"
+       y="911.69678"
+       id="use5146" />
+    <use
+       xlink:href="#glyph-4-21"
+       x="562.26978"
+       y="911.69678"
+       id="use5148" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="567.21893"
+       y="911.69678"
+       id="use5150" />
+    <use
+       xlink:href="#glyph-4-26"
+       x="572.16809"
+       y="911.69678"
+       id="use5152" />
+    <use
+       xlink:href="#glyph-4-18"
+       x="577.11725"
+       y="911.69678"
+       id="use5154" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5160">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="922.94305"
+       id="use5158" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5164">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="922.94305"
+       id="use5162" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5168">
+    <use
+       xlink:href="#glyph-0-6"
+       x="411.36417"
+       y="922.94305"
+       id="use5166" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5172">
+    <use
+       xlink:href="#glyph-0-6"
+       x="413.86383"
+       y="922.94305"
+       id="use5170" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5176">
+    <use
+       xlink:href="#glyph-0-6"
+       x="416.36349"
+       y="922.94305"
+       id="use5174" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5214">
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86313"
+       y="922.94305"
+       id="use5178" />
+    <use
+       xlink:href="#glyph-0-28"
+       x="421.36279"
+       y="922.94305"
+       id="use5180" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="425.8613"
+       y="922.94305"
+       id="use5182" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="427.86014"
+       y="922.94305"
+       id="use5184" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="432.86386"
+       y="922.94305"
+       id="use5186" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="434.8627"
+       y="922.94305"
+       id="use5188" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="442.35727"
+       y="922.94305"
+       id="use5190" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="444.85693"
+       y="922.94305"
+       id="use5192" />
+    <use
+       xlink:href="#glyph-0-13"
+       x="447.3566"
+       y="922.94305"
+       id="use5194" />
+    <use
+       xlink:href="#glyph-0-35"
+       x="449.85626"
+       y="922.94305"
+       id="use5196" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="452.3559"
+       y="922.94305"
+       id="use5198" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="454.85556"
+       y="922.94305"
+       id="use5200" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="459.85928"
+       y="922.94305"
+       id="use5202" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="464.86298"
+       y="922.94305"
+       id="use5204" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="469.36148"
+       y="922.94305"
+       id="use5206" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="474.3652"
+       y="922.94305"
+       id="use5208" />
+    <use
+       xlink:href="#glyph-0-45"
+       x="476.86484"
+       y="922.94305"
+       id="use5210" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="479.3645"
+       y="922.94305"
+       id="use5212" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5256">
+    <use
+       xlink:href="#glyph-8-18"
+       x="481.8671"
+       y="922.94305"
+       id="use5216" />
+    <use
+       xlink:href="#glyph-8-19"
+       x="486.87079"
+       y="922.94305"
+       id="use5218" />
+    <use
+       xlink:href="#glyph-8-13"
+       x="492.36655"
+       y="922.94305"
+       id="use5220" />
+    <use
+       xlink:href="#glyph-8-9"
+       x="497.86227"
+       y="922.94305"
+       id="use5222" />
+    <use
+       xlink:href="#glyph-8-3"
+       x="501.36353"
+       y="922.94305"
+       id="use5224" />
+    <use
+       xlink:href="#glyph-8-6"
+       x="504.35962"
+       y="922.94305"
+       id="use5226" />
+    <use
+       xlink:href="#glyph-8-18"
+       x="506.85928"
+       y="922.94305"
+       id="use5228" />
+    <use
+       xlink:href="#glyph-8-11"
+       x="511.86298"
+       y="922.94305"
+       id="use5230" />
+    <use
+       xlink:href="#glyph-8-20"
+       x="517.3587"
+       y="922.94305"
+       id="use5232" />
+    <use
+       xlink:href="#glyph-8-6"
+       x="522.85443"
+       y="922.94305"
+       id="use5234" />
+    <use
+       xlink:href="#glyph-8-20"
+       x="525.35413"
+       y="922.94305"
+       id="use5236" />
+    <use
+       xlink:href="#glyph-8-13"
+       x="530.84985"
+       y="922.94305"
+       id="use5238" />
+    <use
+       xlink:href="#glyph-8-6"
+       x="536.34558"
+       y="922.94305"
+       id="use5240" />
+    <use
+       xlink:href="#glyph-8-11"
+       x="538.84521"
+       y="922.94305"
+       id="use5242" />
+    <use
+       xlink:href="#glyph-8-13"
+       x="544.34094"
+       y="922.94305"
+       id="use5244" />
+    <use
+       xlink:href="#glyph-8-3"
+       x="549.83667"
+       y="922.94305"
+       id="use5246" />
+    <use
+       xlink:href="#glyph-8-5"
+       x="552.83276"
+       y="922.94305"
+       id="use5248" />
+    <use
+       xlink:href="#glyph-8-10"
+       x="558.32849"
+       y="922.94305"
+       id="use5250" />
+    <use
+       xlink:href="#glyph-8-11"
+       x="560.82812"
+       y="922.94305"
+       id="use5252" />
+    <use
+       xlink:href="#glyph-8-21"
+       x="566.32385"
+       y="922.94305"
+       id="use5254" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5260">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="934.18933"
+       id="use5258" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5320">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="934.18933"
+       id="use5262" />
+    <use
+       xlink:href="#glyph-0-46"
+       x="411.36417"
+       y="934.18933"
+       id="use5264" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="416.36789"
+       y="934.18933"
+       id="use5266" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86752"
+       y="934.18933"
+       id="use5268" />
+    <use
+       xlink:href="#glyph-0-41"
+       x="421.36719"
+       y="934.18933"
+       id="use5270" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="427.86453"
+       y="934.18933"
+       id="use5272" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="432.86826"
+       y="934.18933"
+       id="use5274" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="437.87195"
+       y="934.18933"
+       id="use5276" />
+    <use
+       xlink:href="#glyph-0-19"
+       x="442.87567"
+       y="934.18933"
+       id="use5278" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="450.37024"
+       y="934.18933"
+       id="use5280" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="455.37393"
+       y="934.18933"
+       id="use5282" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="457.8736"
+       y="934.18933"
+       id="use5284" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="460.86969"
+       y="934.18933"
+       id="use5286" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="465.87338"
+       y="934.18933"
+       id="use5288" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="467.87222"
+       y="934.18933"
+       id="use5290" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="472.87595"
+       y="934.18933"
+       id="use5292" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="477.37445"
+       y="934.18933"
+       id="use5294" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="479.87411"
+       y="934.18933"
+       id="use5296" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="481.87296"
+       y="934.18933"
+       id="use5298" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="486.87665"
+       y="934.18933"
+       id="use5300" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="489.37631"
+       y="934.18933"
+       id="use5302" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="491.37515"
+       y="934.18933"
+       id="use5304" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="493.37399"
+       y="934.18933"
+       id="use5306" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="497.8725"
+       y="934.18933"
+       id="use5308" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="500.37216"
+       y="934.18933"
+       id="use5310" />
+    <use
+       xlink:href="#glyph-0-9"
+       x="502.87183"
+       y="934.18933"
+       id="use5312" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="509.36917"
+       y="934.18933"
+       id="use5314" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="511.36801"
+       y="934.18933"
+       id="use5316" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="513.86768"
+       y="934.18933"
+       id="use5318" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5324">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="944.68585"
+       id="use5322" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5328">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="944.68585"
+       id="use5326" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5332">
+    <use
+       xlink:href="#glyph-0-6"
+       x="411.36417"
+       y="944.68585"
+       id="use5330" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5336">
+    <use
+       xlink:href="#glyph-0-6"
+       x="413.86383"
+       y="944.68585"
+       id="use5334" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5340">
+    <use
+       xlink:href="#glyph-0-6"
+       x="416.36349"
+       y="944.68585"
+       id="use5338" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5344">
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86313"
+       y="944.68585"
+       id="use5342" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5348">
+    <use
+       xlink:href="#glyph-0-6"
+       x="421.36279"
+       y="944.68585"
+       id="use5346" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g5406">
+    <use
+       xlink:href="#glyph-4-16"
+       x="423.86685"
+       y="944.68585"
+       id="use5350" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="428.81601"
+       y="944.68585"
+       id="use5352" />
+    <use
+       xlink:href="#glyph-4-18"
+       x="433.76517"
+       y="944.68585"
+       id="use5354" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="438.71432"
+       y="944.68585"
+       id="use5356" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="443.66348"
+       y="944.68585"
+       id="use5358" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="448.61264"
+       y="944.68585"
+       id="use5360" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="453.5618"
+       y="944.68585"
+       id="use5362" />
+    <use
+       xlink:href="#glyph-4-21"
+       x="458.51096"
+       y="944.68585"
+       id="use5364" />
+    <use
+       xlink:href="#glyph-4-18"
+       x="463.46011"
+       y="944.68585"
+       id="use5366" />
+    <use
+       xlink:href="#glyph-4-16"
+       x="468.40927"
+       y="944.68585"
+       id="use5368" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="473.35846"
+       y="944.68585"
+       id="use5370" />
+    <use
+       xlink:href="#glyph-4-23"
+       x="478.30762"
+       y="944.68585"
+       id="use5372" />
+    <use
+       xlink:href="#glyph-4-27"
+       x="483.25677"
+       y="944.68585"
+       id="use5374" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="488.20593"
+       y="944.68585"
+       id="use5376" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="493.15509"
+       y="944.68585"
+       id="use5378" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="498.10425"
+       y="944.68585"
+       id="use5380" />
+    <use
+       xlink:href="#glyph-4-20"
+       x="503.05341"
+       y="944.68585"
+       id="use5382" />
+    <use
+       xlink:href="#glyph-4-17"
+       x="508.00256"
+       y="944.68585"
+       id="use5384" />
+    <use
+       xlink:href="#glyph-4-26"
+       x="512.95172"
+       y="944.68585"
+       id="use5386" />
+    <use
+       xlink:href="#glyph-4-19"
+       x="517.90088"
+       y="944.68585"
+       id="use5388" />
+    <use
+       xlink:href="#glyph-4-11"
+       x="522.85004"
+       y="944.68585"
+       id="use5390" />
+    <use
+       xlink:href="#glyph-4-28"
+       x="527.79919"
+       y="944.68585"
+       id="use5392" />
+    <use
+       xlink:href="#glyph-4-29"
+       x="532.74835"
+       y="944.68585"
+       id="use5394" />
+    <use
+       xlink:href="#glyph-4-24"
+       x="537.69751"
+       y="944.68585"
+       id="use5396" />
+    <use
+       xlink:href="#glyph-4-24"
+       x="542.64667"
+       y="944.68585"
+       id="use5398" />
+    <use
+       xlink:href="#glyph-4-21"
+       x="547.59583"
+       y="944.68585"
+       id="use5400" />
+    <use
+       xlink:href="#glyph-4-30"
+       x="552.54498"
+       y="944.68585"
+       id="use5402" />
+    <use
+       xlink:href="#glyph-4-22"
+       x="557.49414"
+       y="944.68585"
+       id="use5404" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5410">
+    <use
+       xlink:href="#glyph-0-6"
+       x="406.36487"
+       y="955.93207"
+       id="use5408" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5488">
+    <use
+       xlink:href="#glyph-0-6"
+       x="408.8645"
+       y="955.93207"
+       id="use5412" />
+    <use
+       xlink:href="#glyph-0-47"
+       x="411.36417"
+       y="955.93207"
+       id="use5414" />
+    <use
+       xlink:href="#glyph-0-33"
+       x="416.36789"
+       y="955.93207"
+       id="use5416" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="418.86752"
+       y="955.93207"
+       id="use5418" />
+    <use
+       xlink:href="#glyph-0-1"
+       x="421.36719"
+       y="955.93207"
+       id="use5420" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="427.86453"
+       y="955.93207"
+       id="use5422" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="432.36304"
+       y="955.93207"
+       id="use5424" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="437.36676"
+       y="955.93207"
+       id="use5426" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="440.36282"
+       y="955.93207"
+       id="use5428" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="442.86249"
+       y="955.93207"
+       id="use5430" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="445.85855"
+       y="955.93207"
+       id="use5432" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="450.86227"
+       y="955.93207"
+       id="use5434" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="452.86111"
+       y="955.93207"
+       id="use5436" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="457.86481"
+       y="955.93207"
+       id="use5438" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="462.36331"
+       y="955.93207"
+       id="use5440" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="464.86298"
+       y="955.93207"
+       id="use5442" />
+    <use
+       xlink:href="#glyph-0-18"
+       x="469.8667"
+       y="955.93207"
+       id="use5444" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="474.87039"
+       y="955.93207"
+       id="use5446" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="479.87411"
+       y="955.93207"
+       id="use5448" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="484.87781"
+       y="955.93207"
+       id="use5450" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="487.37747"
+       y="955.93207"
+       id="use5452" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="492.38116"
+       y="955.93207"
+       id="use5454" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="497.38489"
+       y="955.93207"
+       id="use5456" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="499.88452"
+       y="955.93207"
+       id="use5458" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="502.38419"
+       y="955.93207"
+       id="use5460" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="507.38791"
+       y="955.93207"
+       id="use5462" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="509.88754"
+       y="955.93207"
+       id="use5464" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="512.88361"
+       y="955.93207"
+       id="use5466" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="517.88733"
+       y="955.93207"
+       id="use5468" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="519.88617"
+       y="955.93207"
+       id="use5470" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="524.88989"
+       y="955.93207"
+       id="use5472" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="529.38837"
+       y="955.93207"
+       id="use5474" />
+    <use
+       xlink:href="#glyph-0-24"
+       x="531.88806"
+       y="955.93207"
+       id="use5476" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="533.8869"
+       y="955.93207"
+       id="use5478" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="535.88574"
+       y="955.93207"
+       id="use5480" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="540.38428"
+       y="955.93207"
+       id="use5482" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="542.88391"
+       y="955.93207"
+       id="use5484" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="547.88763"
+       y="955.93207"
+       id="use5486" />
+  </g>
+  <g
+     fill="#0080f0"
+     fill-opacity="1"
+     id="g5544">
+    <use
+       xlink:href="#glyph-5-1"
+       x="189.89778"
+       y="912.44653"
+       id="use5490" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="195.29686"
+       y="912.44653"
+       id="use5492" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="200.69595"
+       y="912.44653"
+       id="use5494" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="206.09503"
+       y="912.44653"
+       id="use5496" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="211.49411"
+       y="912.44653"
+       id="use5498" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="216.8932"
+       y="912.44653"
+       id="use5500" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="222.29228"
+       y="912.44653"
+       id="use5502" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="227.69136"
+       y="912.44653"
+       id="use5504" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="233.09045"
+       y="912.44653"
+       id="use5506" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="238.48953"
+       y="912.44653"
+       id="use5508" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="243.88861"
+       y="912.44653"
+       id="use5510" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="249.2877"
+       y="912.44653"
+       id="use5512" />
+    <use
+       xlink:href="#glyph-5-10"
+       x="254.68678"
+       y="912.44653"
+       id="use5514" />
+    <use
+       xlink:href="#glyph-5-17"
+       x="260.08588"
+       y="912.44653"
+       id="use5516" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="265.48495"
+       y="912.44653"
+       id="use5518" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="270.88403"
+       y="912.44653"
+       id="use5520" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="276.28311"
+       y="912.44653"
+       id="use5522" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="281.68219"
+       y="912.44653"
+       id="use5524" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="287.0813"
+       y="912.44653"
+       id="use5526" />
+    <use
+       xlink:href="#glyph-5-14"
+       x="292.48038"
+       y="912.44653"
+       id="use5528" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="297.87946"
+       y="912.44653"
+       id="use5530" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="303.27853"
+       y="912.44653"
+       id="use5532" />
+    <use
+       xlink:href="#glyph-5-13"
+       x="308.67761"
+       y="912.44653"
+       id="use5534" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="314.07669"
+       y="912.44653"
+       id="use5536" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="319.4758"
+       y="912.44653"
+       id="use5538" />
+    <use
+       xlink:href="#glyph-5-14"
+       x="324.87488"
+       y="912.44653"
+       id="use5540" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="330.27396"
+       y="912.44653"
+       id="use5542" />
+  </g>
+  <g
+     fill="#0080f0"
+     fill-opacity="1"
+     id="g5604">
+    <use
+       xlink:href="#glyph-5-1"
+       x="184.49724"
+       y="924.44257"
+       id="use5546" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="189.89632"
+       y="924.44257"
+       id="use5548" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="195.29541"
+       y="924.44257"
+       id="use5550" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="200.69449"
+       y="924.44257"
+       id="use5552" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="206.09357"
+       y="924.44257"
+       id="use5554" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="211.49266"
+       y="924.44257"
+       id="use5556" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="216.89174"
+       y="924.44257"
+       id="use5558" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="222.29082"
+       y="924.44257"
+       id="use5560" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="227.68991"
+       y="924.44257"
+       id="use5562" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="233.08899"
+       y="924.44257"
+       id="use5564" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="238.48807"
+       y="924.44257"
+       id="use5566" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="243.88716"
+       y="924.44257"
+       id="use5568" />
+    <use
+       xlink:href="#glyph-5-10"
+       x="249.28624"
+       y="924.44257"
+       id="use5570" />
+    <use
+       xlink:href="#glyph-5-17"
+       x="254.68532"
+       y="924.44257"
+       id="use5572" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="260.08441"
+       y="924.44257"
+       id="use5574" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="265.48349"
+       y="924.44257"
+       id="use5576" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="270.88257"
+       y="924.44257"
+       id="use5578" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="276.28165"
+       y="924.44257"
+       id="use5580" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="281.68073"
+       y="924.44257"
+       id="use5582" />
+    <use
+       xlink:href="#glyph-5-14"
+       x="287.07983"
+       y="924.44257"
+       id="use5584" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="292.47891"
+       y="924.44257"
+       id="use5586" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="297.87799"
+       y="924.44257"
+       id="use5588" />
+    <use
+       xlink:href="#glyph-5-20"
+       x="303.27707"
+       y="924.44257"
+       id="use5590" />
+    <use
+       xlink:href="#glyph-5-16"
+       x="308.67615"
+       y="924.44257"
+       id="use5592" />
+    <use
+       xlink:href="#glyph-5-11"
+       x="314.07523"
+       y="924.44257"
+       id="use5594" />
+    <use
+       xlink:href="#glyph-5-11"
+       x="319.47433"
+       y="924.44257"
+       id="use5596" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="324.87341"
+       y="924.44257"
+       id="use5598" />
+    <use
+       xlink:href="#glyph-5-18"
+       x="330.27249"
+       y="924.44257"
+       id="use5600" />
+    <use
+       xlink:href="#glyph-5-9"
+       x="335.67157"
+       y="924.44257"
+       id="use5602" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g5640">
+    <use
+       xlink:href="#glyph-6-1"
+       x="228.35765"
+       y="935.68884"
+       id="use5606" />
+    <use
+       xlink:href="#glyph-6-2"
+       x="232.40697"
+       y="935.68884"
+       id="use5608" />
+    <use
+       xlink:href="#glyph-6-3"
+       x="236.45628"
+       y="935.68884"
+       id="use5610" />
+    <use
+       xlink:href="#glyph-6-4"
+       x="240.50558"
+       y="935.68884"
+       id="use5612" />
+    <use
+       xlink:href="#glyph-6-5"
+       x="244.5549"
+       y="935.68884"
+       id="use5614" />
+    <use
+       xlink:href="#glyph-6-6"
+       x="248.60422"
+       y="935.68884"
+       id="use5616" />
+    <use
+       xlink:href="#glyph-6-7"
+       x="252.65353"
+       y="935.68884"
+       id="use5618" />
+    <use
+       xlink:href="#glyph-6-8"
+       x="256.70285"
+       y="935.68884"
+       id="use5620" />
+    <use
+       xlink:href="#glyph-6-9"
+       x="260.75217"
+       y="935.68884"
+       id="use5622" />
+    <use
+       xlink:href="#glyph-6-10"
+       x="264.80145"
+       y="935.68884"
+       id="use5624" />
+    <use
+       xlink:href="#glyph-6-11"
+       x="268.85077"
+       y="935.68884"
+       id="use5626" />
+    <use
+       xlink:href="#glyph-6-12"
+       x="272.90009"
+       y="935.68884"
+       id="use5628" />
+    <use
+       xlink:href="#glyph-6-13"
+       x="276.9494"
+       y="935.68884"
+       id="use5630" />
+    <use
+       xlink:href="#glyph-6-14"
+       x="280.99872"
+       y="935.68884"
+       id="use5632" />
+    <use
+       xlink:href="#glyph-6-15"
+       x="285.04803"
+       y="935.68884"
+       id="use5634" />
+    <use
+       xlink:href="#glyph-6-12"
+       x="289.09735"
+       y="935.68884"
+       id="use5636" />
+    <use
+       xlink:href="#glyph-6-16"
+       x="293.14667"
+       y="935.68884"
+       id="use5638" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 490.001613 1220.999847 L 533.630701 1220.562201 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path5642" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 538.882447 1220.510101 L 531.921799 1224.078996 L 533.630701 1220.562201 L 531.848858 1217.081878 Z M 538.882447 1220.510101 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path5644" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(42.349243%, 55.688477%, 74.899292%)"
+     fill-opacity="1"
+     d="M 621.542969 403.066406 L 621.542969 400.816406 L 623.792969 400.816406 L 623.792969 403.066406 M 621.542969 394.070313 L 621.542969 391.820313 L 623.792969 391.820313 L 623.792969 394.070313 M 621.542969 385.070313 L 621.542969 383.496094 L 623.792969 383.496094 L 623.792969 385.070313 "
+     id="path5646" />
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 473.449235 1324.779141 L 156.182299 1324.779141 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path5648" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 150.930553 1324.779141 L 157.92767 1321.277977 L 156.182299 1324.779141 L 157.92767 1328.280305 Z M 150.930553 1324.779141 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path5650" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 169.999392 1339.997742 L 449.99873 1339.997742 L 449.99873 1389.99874 L 169.999392 1389.99874 Z M 169.999392 1339.997742 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path5652" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5656">
+    <use
+       xlink:href="#glyph-2-20"
+       x="128.95711"
+       y="1021.1604"
+       id="use5654" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5696">
+    <use
+       xlink:href="#glyph-2-20"
+       x="133.45634"
+       y="1021.1604"
+       id="use5658" />
+    <use
+       xlink:href="#glyph-2-1"
+       x="137.95558"
+       y="1021.1604"
+       id="use5660" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="142.45482"
+       y="1021.1604"
+       id="use5662" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="146.95406"
+       y="1021.1604"
+       id="use5664" />
+    <use
+       xlink:href="#glyph-2-3"
+       x="151.45329"
+       y="1021.1604"
+       id="use5666" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="155.95253"
+       y="1021.1604"
+       id="use5668" />
+    <use
+       xlink:href="#glyph-2-5"
+       x="160.45177"
+       y="1021.1604"
+       id="use5670" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="164.951"
+       y="1021.1604"
+       id="use5672" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="169.45024"
+       y="1021.1604"
+       id="use5674" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="173.94948"
+       y="1021.1604"
+       id="use5676" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="178.44872"
+       y="1021.1604"
+       id="use5678" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="182.94795"
+       y="1021.1604"
+       id="use5680" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="187.44719"
+       y="1021.1604"
+       id="use5682" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="191.94643"
+       y="1021.1604"
+       id="use5684" />
+    <use
+       xlink:href="#glyph-2-11"
+       x="196.44565"
+       y="1021.1604"
+       id="use5686" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="200.94489"
+       y="1021.1604"
+       id="use5688" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="205.44412"
+       y="1021.1604"
+       id="use5690" />
+    <use
+       xlink:href="#glyph-2-15"
+       x="209.94336"
+       y="1021.1604"
+       id="use5692" />
+    <use
+       xlink:href="#glyph-2-6"
+       x="214.4426"
+       y="1021.1604"
+       id="use5694" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5700">
+    <use
+       xlink:href="#glyph-2-20"
+       x="128.95711"
+       y="1030.1573"
+       id="use5698" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5704">
+    <use
+       xlink:href="#glyph-2-20"
+       x="133.45634"
+       y="1030.1573"
+       id="use5702" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5708">
+    <use
+       xlink:href="#glyph-2-20"
+       x="137.95558"
+       y="1030.1573"
+       id="use5706" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5778">
+    <use
+       xlink:href="#glyph-2-44"
+       x="142.45482"
+       y="1030.1573"
+       id="use5710" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="146.95406"
+       y="1030.1573"
+       id="use5712" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="151.45329"
+       y="1030.1573"
+       id="use5714" />
+    <use
+       xlink:href="#glyph-2-45"
+       x="155.95253"
+       y="1030.1573"
+       id="use5716" />
+    <use
+       xlink:href="#glyph-2-46"
+       x="160.45177"
+       y="1030.1573"
+       id="use5718" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="164.951"
+       y="1030.1573"
+       id="use5720" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="169.45024"
+       y="1030.1573"
+       id="use5722" />
+    <use
+       xlink:href="#glyph-2-29"
+       x="173.94948"
+       y="1030.1573"
+       id="use5724" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="178.44872"
+       y="1030.1573"
+       id="use5726" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="182.94795"
+       y="1030.1573"
+       id="use5728" />
+    <use
+       xlink:href="#glyph-2-5"
+       x="187.44719"
+       y="1030.1573"
+       id="use5730" />
+    <use
+       xlink:href="#glyph-2-20"
+       x="191.94643"
+       y="1030.1573"
+       id="use5732" />
+    <use
+       xlink:href="#glyph-2-10"
+       x="196.44565"
+       y="1030.1573"
+       id="use5734" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="200.94489"
+       y="1030.1573"
+       id="use5736" />
+    <use
+       xlink:href="#glyph-2-9"
+       x="205.44412"
+       y="1030.1573"
+       id="use5738" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="209.94336"
+       y="1030.1573"
+       id="use5740" />
+    <use
+       xlink:href="#glyph-2-12"
+       x="214.4426"
+       y="1030.1573"
+       id="use5742" />
+    <use
+       xlink:href="#glyph-2-23"
+       x="218.94183"
+       y="1030.1573"
+       id="use5744" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="223.44107"
+       y="1030.1573"
+       id="use5746" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="227.94031"
+       y="1030.1573"
+       id="use5748" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="232.43954"
+       y="1030.1573"
+       id="use5750" />
+    <use
+       xlink:href="#glyph-2-4"
+       x="236.93878"
+       y="1030.1573"
+       id="use5752" />
+    <use
+       xlink:href="#glyph-2-8"
+       x="241.43802"
+       y="1030.1573"
+       id="use5754" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="245.93726"
+       y="1030.1573"
+       id="use5756" />
+    <use
+       xlink:href="#glyph-2-22"
+       x="250.43649"
+       y="1030.1573"
+       id="use5758" />
+    <use
+       xlink:href="#glyph-2-23"
+       x="254.93573"
+       y="1030.1573"
+       id="use5760" />
+    <use
+       xlink:href="#glyph-2-2"
+       x="259.43497"
+       y="1030.1573"
+       id="use5762" />
+    <use
+       xlink:href="#glyph-2-7"
+       x="263.9342"
+       y="1030.1573"
+       id="use5764" />
+    <use
+       xlink:href="#glyph-2-29"
+       x="268.43344"
+       y="1030.1573"
+       id="use5766" />
+    <use
+       xlink:href="#glyph-2-14"
+       x="272.93268"
+       y="1030.1573"
+       id="use5768" />
+    <use
+       xlink:href="#glyph-2-22"
+       x="277.43192"
+       y="1030.1573"
+       id="use5770" />
+    <use
+       xlink:href="#glyph-2-24"
+       x="281.93115"
+       y="1030.1573"
+       id="use5772" />
+    <use
+       xlink:href="#glyph-2-25"
+       x="286.43039"
+       y="1030.1573"
+       id="use5774" />
+    <use
+       xlink:href="#glyph-2-26"
+       x="290.92963"
+       y="1030.1573"
+       id="use5776" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 305.997731 1339.997742 L 305.997731 1326.998629 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path5780" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     d="M 194.183594 983.671875 L 241.417969 983.671875 L 241.417969 993.417969 L 194.183594 993.417969 Z M 194.183594 983.671875 "
+     id="path5782" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5808">
+    <use
+       xlink:href="#glyph-1-32"
+       x="194.41972"
+       y="991.17035"
+       id="use5784" />
+    <use
+       xlink:href="#glyph-1-33"
+       x="199.00645"
+       y="991.17035"
+       id="use5786" />
+    <use
+       xlink:href="#glyph-1-36"
+       x="203.59319"
+       y="991.17035"
+       id="use5788" />
+    <use
+       xlink:href="#glyph-1-5"
+       x="208.17992"
+       y="991.17035"
+       id="use5790" />
+    <use
+       xlink:href="#glyph-1-35"
+       x="210.47127"
+       y="991.17035"
+       id="use5792" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="216.42717"
+       y="991.17035"
+       id="use5794" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="221.0139"
+       y="991.17035"
+       id="use5796" />
+    <use
+       xlink:href="#glyph-1-8"
+       x="225.60063"
+       y="991.17035"
+       id="use5798" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="227.43291"
+       y="991.17035"
+       id="use5800" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="230.17931"
+       y="991.17035"
+       id="use5802" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="234.76604"
+       y="991.17035"
+       id="use5804" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="238.88966"
+       y="991.17035"
+       id="use5806" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 149.810389 1419.998297 L 473.631587 1419.998297 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path5810" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(0%, 0%, 0%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 478.878123 1419.998297 L 471.881005 1423.499461 L 473.631587 1419.998297 L 471.881005 1416.502343 Z M 478.878123 1419.998297 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path5812" />
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     d="M 168.695313 1054.898438 L 250.417969 1054.898438 L 250.417969 1064.644531 L 168.695313 1064.644531 Z M 168.695313 1054.898438 "
+     id="path5814" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5822">
+    <use
+       xlink:href="#glyph-1-19"
+       x="168.61189"
+       y="1062.3967"
+       id="use5816" />
+    <use
+       xlink:href="#glyph-1-20"
+       x="175.02687"
+       y="1062.3967"
+       id="use5818" />
+    <use
+       xlink:href="#glyph-1-21"
+       x="180.52774"
+       y="1062.3967"
+       id="use5820" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5852">
+    <use
+       xlink:href="#glyph-1-5"
+       x="185.41649"
+       y="1062.3967"
+       id="use5824" />
+    <use
+       xlink:href="#glyph-1-22"
+       x="187.70784"
+       y="1062.3967"
+       id="use5826" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="192.29457"
+       y="1062.3967"
+       id="use5828" />
+    <use
+       xlink:href="#glyph-1-23"
+       x="194.58592"
+       y="1062.3967"
+       id="use5830" />
+    <use
+       xlink:href="#glyph-1-24"
+       x="196.87727"
+       y="1062.3967"
+       id="use5832" />
+    <use
+       xlink:href="#glyph-1-2"
+       x="201.464"
+       y="1062.3967"
+       id="use5834" />
+    <use
+       xlink:href="#glyph-1-25"
+       x="205.58763"
+       y="1062.3967"
+       id="use5836" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="207.87898"
+       y="1062.3967"
+       id="use5838" />
+    <use
+       xlink:href="#glyph-1-26"
+       x="210.17035"
+       y="1062.3967"
+       id="use5840" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="212.4617"
+       y="1062.3967"
+       id="use5842" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="216.58533"
+       y="1062.3967"
+       id="use5844" />
+    <use
+       xlink:href="#glyph-1-27"
+       x="221.17206"
+       y="1062.3967"
+       id="use5846" />
+    <use
+       xlink:href="#glyph-1-3"
+       x="225.75879"
+       y="1062.3967"
+       id="use5848" />
+    <use
+       xlink:href="#glyph-1-4"
+       x="230.34552"
+       y="1062.3967"
+       id="use5850" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5862">
+    <use
+       xlink:href="#glyph-1-28"
+       x="232.63687"
+       y="1062.3967"
+       id="use5854" />
+    <use
+       xlink:href="#glyph-1-6"
+       x="234.92822"
+       y="1062.3967"
+       id="use5856" />
+    <use
+       xlink:href="#glyph-1-16"
+       x="239.05185"
+       y="1062.3967"
+       id="use5858" />
+    <use
+       xlink:href="#glyph-1-29"
+       x="243.63858"
+       y="1062.3967"
+       id="use5860" />
+  </g>
+  <path
+     fill-rule="nonzero"
+     fill="rgb(100%, 100%, 100%)"
+     fill-opacity="1"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 0%, 0%)"
+     stroke-opacity="1"
+     stroke-miterlimit="4"
+     d="M 226.002386 1428.000958 L 380.001501 1428.000958 L 380.001501 1478.001956 L 226.002386 1478.001956 Z M 226.002386 1428.000958 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path5864" />
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5914">
+    <use
+       xlink:href="#glyph-0-1"
+       x="179.90501"
+       y="1087.1384"
+       id="use5866" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="186.40237"
+       y="1087.1384"
+       id="use5868" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="190.90088"
+       y="1087.1384"
+       id="use5870" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="195.90457"
+       y="1087.1384"
+       id="use5872" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="198.90065"
+       y="1087.1384"
+       id="use5874" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="201.40031"
+       y="1087.1384"
+       id="use5876" />
+    <use
+       xlink:href="#glyph-0-2"
+       x="203.39915"
+       y="1087.1384"
+       id="use5878" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="207.89766"
+       y="1087.1384"
+       id="use5880" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="210.39732"
+       y="1087.1384"
+       id="use5882" />
+    <use
+       xlink:href="#glyph-0-27"
+       x="215.40103"
+       y="1087.1384"
+       id="use5884" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="220.40472"
+       y="1087.1384"
+       id="use5886" />
+    <use
+       xlink:href="#glyph-0-21"
+       x="222.90439"
+       y="1087.1384"
+       id="use5888" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="227.9081"
+       y="1087.1384"
+       id="use5890" />
+    <use
+       xlink:href="#glyph-0-25"
+       x="232.9118"
+       y="1087.1384"
+       id="use5892" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="237.91551"
+       y="1087.1384"
+       id="use5894" />
+    <use
+       xlink:href="#glyph-0-17"
+       x="240.41516"
+       y="1087.1384"
+       id="use5896" />
+    <use
+       xlink:href="#glyph-0-28"
+       x="242.41402"
+       y="1087.1384"
+       id="use5898" />
+    <use
+       xlink:href="#glyph-0-23"
+       x="246.91252"
+       y="1087.1384"
+       id="use5900" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="251.91623"
+       y="1087.1384"
+       id="use5902" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="254.41588"
+       y="1087.1384"
+       id="use5904" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="259.41959"
+       y="1087.1384"
+       id="use5906" />
+    <use
+       xlink:href="#glyph-0-6"
+       x="264.42331"
+       y="1087.1384"
+       id="use5908" />
+    <use
+       xlink:href="#glyph-0-22"
+       x="266.92294"
+       y="1087.1384"
+       id="use5910" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="269.42261"
+       y="1087.1384"
+       id="use5912" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5926">
+    <use
+       xlink:href="#glyph-0-10"
+       x="214.92072"
+       y="1098.3848"
+       id="use5916" />
+    <use
+       xlink:href="#glyph-0-8"
+       x="221.41806"
+       y="1098.3848"
+       id="use5918" />
+    <use
+       xlink:href="#glyph-0-11"
+       x="226.42177"
+       y="1098.3848"
+       id="use5920" />
+    <use
+       xlink:href="#glyph-0-3"
+       x="231.42548"
+       y="1098.3848"
+       id="use5922" />
+    <use
+       xlink:href="#glyph-0-4"
+       x="236.42918"
+       y="1098.3848"
+       id="use5924" />
+  </g>
+  <g
+     fill="#000000"
+     fill-opacity="1"
+     id="g5964">
+    <use
+       xlink:href="#glyph-7-14"
+       x="407.85266"
+       y="50.983044"
+       id="use5928" />
+    <use
+       xlink:href="#glyph-7-9"
+       x="416.85403"
+       y="50.983044"
+       id="use5930" />
+    <use
+       xlink:href="#glyph-7-7"
+       x="421.34814"
+       y="50.983044"
+       id="use5932" />
+    <use
+       xlink:href="#glyph-7-11"
+       x="428.85373"
+       y="50.983044"
+       id="use5934" />
+    <use
+       xlink:href="#glyph-7-3"
+       x="437.09732"
+       y="50.983044"
+       id="use5936" />
+    <use
+       xlink:href="#glyph-7-7"
+       x="445.34091"
+       y="50.983044"
+       id="use5938" />
+    <use
+       xlink:href="#glyph-7-5"
+       x="452.84647"
+       y="50.983044"
+       id="use5940" />
+    <use
+       xlink:href="#glyph-7-3"
+       x="458.09839"
+       y="50.983044"
+       id="use5942" />
+    <use
+       xlink:href="#glyph-7-6"
+       x="466.34198"
+       y="50.983044"
+       id="use5944" />
+    <use
+       xlink:href="#glyph-7-15"
+       x="470.09146"
+       y="50.983044"
+       id="use5946" />
+    <use
+       xlink:href="#glyph-7-16"
+       x="480.58871"
+       y="50.983044"
+       id="use5948" />
+    <use
+       xlink:href="#glyph-7-17"
+       x="484.3382"
+       y="50.983044"
+       id="use5950" />
+    <use
+       xlink:href="#glyph-7-1"
+       x="494.08423"
+       y="50.983044"
+       id="use5952" />
+    <use
+       xlink:href="#glyph-7-6"
+       x="503.83026"
+       y="50.983044"
+       id="use5954" />
+    <use
+       xlink:href="#glyph-7-18"
+       x="507.57974"
+       y="50.983044"
+       id="use5956" />
+    <use
+       xlink:href="#glyph-7-19"
+       x="515.8233"
+       y="50.983044"
+       id="use5958" />
+    <use
+       xlink:href="#glyph-7-2"
+       x="519.57281"
+       y="50.983044"
+       id="use5960" />
+    <use
+       xlink:href="#glyph-7-20"
+       x="527.81641"
+       y="50.983044"
+       id="use5962" />
+  </g>
+  <g
+     fill="#0080f0"
+     fill-opacity="1"
+     id="g6002">
+    <use
+       xlink:href="#glyph-5-1"
+       x="7.2632089"
+       y="110.21335"
+       id="use5966" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="12.662293"
+       y="110.21335"
+       id="use5968" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="18.061377"
+       y="110.21335"
+       id="use5970" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="23.460461"
+       y="110.21335"
+       id="use5972" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="28.859543"
+       y="110.21335"
+       id="use5974" />
+    <use
+       xlink:href="#glyph-5-6"
+       x="34.258625"
+       y="110.21335"
+       id="use5976" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="39.657711"
+       y="110.21335"
+       id="use5978" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="45.056793"
+       y="110.21335"
+       id="use5980" />
+    <use
+       xlink:href="#glyph-5-8"
+       x="50.455875"
+       y="110.21335"
+       id="use5982" />
+    <use
+       xlink:href="#glyph-5-4"
+       x="55.854961"
+       y="110.21335"
+       id="use5984" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="61.254044"
+       y="110.21335"
+       id="use5986" />
+    <use
+       xlink:href="#glyph-5-7"
+       x="66.65313"
+       y="110.21335"
+       id="use5988" />
+    <use
+       xlink:href="#glyph-5-17"
+       x="72.052208"
+       y="110.21335"
+       id="use5990" />
+    <use
+       xlink:href="#glyph-5-2"
+       x="77.451294"
+       y="110.21335"
+       id="use5992" />
+    <use
+       xlink:href="#glyph-5-3"
+       x="82.85038"
+       y="110.21335"
+       id="use5994" />
+    <use
+       xlink:href="#glyph-5-11"
+       x="88.249458"
+       y="110.21335"
+       id="use5996" />
+    <use
+       xlink:href="#glyph-5-5"
+       x="93.648544"
+       y="110.21335"
+       id="use5998" />
+    <use
+       xlink:href="#glyph-5-17"
+       x="99.04763"
+       y="110.21335"
+       id="use6000" />
+  </g>
+  <g
+     fill="#ff031c"
+     fill-opacity="1"
+     id="g6038">
+    <use
+       xlink:href="#glyph-6-1"
+       x="21.426468"
+       y="122.20936"
+       id="use6004" />
+    <use
+       xlink:href="#glyph-6-2"
+       x="25.47578"
+       y="122.20936"
+       id="use6006" />
+    <use
+       xlink:href="#glyph-6-3"
+       x="29.525093"
+       y="122.20936"
+       id="use6008" />
+    <use
+       xlink:href="#glyph-6-4"
+       x="33.574406"
+       y="122.20936"
+       id="use6010" />
+    <use
+       xlink:href="#glyph-6-5"
+       x="37.623718"
+       y="122.20936"
+       id="use6012" />
+    <use
+       xlink:href="#glyph-6-6"
+       x="41.673031"
+       y="122.20936"
+       id="use6014" />
+    <use
+       xlink:href="#glyph-6-7"
+       x="45.722343"
+       y="122.20936"
+       id="use6016" />
+    <use
+       xlink:href="#glyph-6-8"
+       x="49.771656"
+       y="122.20936"
+       id="use6018" />
+    <use
+       xlink:href="#glyph-6-9"
+       x="53.820969"
+       y="122.20936"
+       id="use6020" />
+    <use
+       xlink:href="#glyph-6-10"
+       x="57.870281"
+       y="122.20936"
+       id="use6022" />
+    <use
+       xlink:href="#glyph-6-11"
+       x="61.919594"
+       y="122.20936"
+       id="use6024" />
+    <use
+       xlink:href="#glyph-6-12"
+       x="65.968903"
+       y="122.20936"
+       id="use6026" />
+    <use
+       xlink:href="#glyph-6-13"
+       x="70.018219"
+       y="122.20936"
+       id="use6028" />
+    <use
+       xlink:href="#glyph-6-14"
+       x="74.067528"
+       y="122.20936"
+       id="use6030" />
+    <use
+       xlink:href="#glyph-6-15"
+       x="78.116844"
+       y="122.20936"
+       id="use6032" />
+    <use
+       xlink:href="#glyph-6-12"
+       x="82.166153"
+       y="122.20936"
+       id="use6034" />
+    <use
+       xlink:href="#glyph-6-16"
+       x="86.215469"
+       y="122.20936"
+       id="use6036" />
+  </g>
+  <path
+     fill="none"
+     stroke-width="1"
+     stroke-linecap="butt"
+     stroke-linejoin="miter"
+     stroke="rgb(0%, 50.19989%, 94.119263%)"
+     stroke-opacity="1"
+     stroke-miterlimit="10"
+     d="M 139.379837 149.039299 L 190.381168 159.037414 M 189.620499 162.960594 L 138.619168 152.962478 "
+     transform="matrix(0.749751, 0, 0, 0.749751, 0.374875, 0.374875)"
+     id="path6040" />
+</svg>
diff --git a/docs/images/platforms/gcp/launch.mp4 b/docs/images/platforms/gcp/launch.mp4
new file mode 100644
index 0000000000000..5090e0a311afd
Binary files /dev/null and b/docs/images/platforms/gcp/launch.mp4 differ
diff --git a/docs/images/platforms/gcp/marketplace.png b/docs/images/platforms/gcp/marketplace.png
new file mode 100644
index 0000000000000..3e2654ce01a43
Binary files /dev/null and b/docs/images/platforms/gcp/marketplace.png differ
diff --git a/docs/images/platforms/gcp/start.png b/docs/images/platforms/gcp/start.png
new file mode 100644
index 0000000000000..b96040691f6a9
Binary files /dev/null and b/docs/images/platforms/gcp/start.png differ
diff --git a/docs/images/platforms/google-cloud-platform/gcp0.png b/docs/images/platforms/google-cloud-platform/gcp0.png
deleted file mode 100644
index d54e02c289ff8..0000000000000
Binary files a/docs/images/platforms/google-cloud-platform/gcp0.png and /dev/null differ
diff --git a/docs/images/platforms/google-cloud-platform/gcp1.png b/docs/images/platforms/google-cloud-platform/gcp1.png
deleted file mode 100644
index 582fa7156b5fe..0000000000000
Binary files a/docs/images/platforms/google-cloud-platform/gcp1.png and /dev/null differ
diff --git a/docs/images/platforms/google-cloud-platform/gcp2.png b/docs/images/platforms/google-cloud-platform/gcp2.png
deleted file mode 100644
index da07975113116..0000000000000
Binary files a/docs/images/platforms/google-cloud-platform/gcp2.png and /dev/null differ
diff --git a/docs/images/platforms/google-cloud-platform/gcp3.png b/docs/images/platforms/google-cloud-platform/gcp3.png
deleted file mode 100644
index dc357e92989ea..0000000000000
Binary files a/docs/images/platforms/google-cloud-platform/gcp3.png and /dev/null differ
diff --git a/docs/images/platforms/google-cloud-platform/gcp4.png b/docs/images/platforms/google-cloud-platform/gcp4.png
deleted file mode 100644
index 6016bc61a42aa..0000000000000
Binary files a/docs/images/platforms/google-cloud-platform/gcp4.png and /dev/null differ
diff --git a/docs/images/platforms/google-cloud-platform/gcp5.png b/docs/images/platforms/google-cloud-platform/gcp5.png
deleted file mode 100644
index 6c1c0c6e48505..0000000000000
Binary files a/docs/images/platforms/google-cloud-platform/gcp5.png and /dev/null differ
diff --git a/docs/images/platforms/google-cloud-platform/gcp6.png b/docs/images/platforms/google-cloud-platform/gcp6.png
deleted file mode 100644
index 06dcc7454ae44..0000000000000
Binary files a/docs/images/platforms/google-cloud-platform/gcp6.png and /dev/null differ
diff --git a/docs/images/platforms/google-cloud-platform/gcp7.png b/docs/images/platforms/google-cloud-platform/gcp7.png
deleted file mode 100644
index 7929f2b0ed085..0000000000000
Binary files a/docs/images/platforms/google-cloud-platform/gcp7.png and /dev/null differ
diff --git a/docs/images/platforms/google-cloud-platform/gcp8.png b/docs/images/platforms/google-cloud-platform/gcp8.png
deleted file mode 100644
index 26dd676646445..0000000000000
Binary files a/docs/images/platforms/google-cloud-platform/gcp8.png and /dev/null differ
diff --git a/docs/images/pr-deploy-manual.png b/docs/images/pr-deploy-manual.png
deleted file mode 100644
index eab92cc2249e7..0000000000000
Binary files a/docs/images/pr-deploy-manual.png and /dev/null differ
diff --git a/docs/images/schedule.png b/docs/images/schedule.png
index 224cf575c63c4..16c861d534658 100644
Binary files a/docs/images/schedule.png and b/docs/images/schedule.png differ
diff --git a/docs/images/template-variables.png b/docs/images/template-variables.png
new file mode 100644
index 0000000000000..3a2429de7ecb7
Binary files /dev/null and b/docs/images/template-variables.png differ
diff --git a/docs/images/templates/build-template.png b/docs/images/templates/build-template.png
new file mode 100644
index 0000000000000..53052794d068b
Binary files /dev/null and b/docs/images/templates/build-template.png differ
diff --git a/docs/images/templates/choosing-edit-template.gif b/docs/images/templates/choosing-edit-template.gif
new file mode 100644
index 0000000000000..faf49624e1a18
Binary files /dev/null and b/docs/images/templates/choosing-edit-template.gif differ
diff --git a/docs/images/templates/coder-login-web.png b/docs/images/templates/coder-login-web.png
new file mode 100644
index 0000000000000..161ff92a00401
Binary files /dev/null and b/docs/images/templates/coder-login-web.png differ
diff --git a/docs/images/templates/coder-session-token.png b/docs/images/templates/coder-session-token.png
new file mode 100644
index 0000000000000..f982550901813
Binary files /dev/null and b/docs/images/templates/coder-session-token.png differ
diff --git a/docs/images/templates/create-template.png b/docs/images/templates/create-template.png
new file mode 100644
index 0000000000000..3705cea3a6b50
Binary files /dev/null and b/docs/images/templates/create-template.png differ
diff --git a/docs/images/templates/create-workspace.png b/docs/images/templates/create-workspace.png
new file mode 100644
index 0000000000000..cb2a6678c6bf9
Binary files /dev/null and b/docs/images/templates/create-workspace.png differ
diff --git a/docs/images/templates/develop-in-docker-template.png b/docs/images/templates/develop-in-docker-template.png
new file mode 100644
index 0000000000000..bbd812d3109e5
Binary files /dev/null and b/docs/images/templates/develop-in-docker-template.png differ
diff --git a/docs/images/templates/edit-files.png b/docs/images/templates/edit-files.png
new file mode 100644
index 0000000000000..e9ae92a72ef8a
Binary files /dev/null and b/docs/images/templates/edit-files.png differ
diff --git a/docs/images/templates/edit-source-code.png b/docs/images/templates/edit-source-code.png
new file mode 100644
index 0000000000000..6eafd4caaeac7
Binary files /dev/null and b/docs/images/templates/edit-source-code.png differ
diff --git a/docs/images/templates/new-workspace.png b/docs/images/templates/new-workspace.png
new file mode 100644
index 0000000000000..85fdd002d8bce
Binary files /dev/null and b/docs/images/templates/new-workspace.png differ
diff --git a/docs/images/templates/publish.png b/docs/images/templates/publish.png
new file mode 100644
index 0000000000000..bd72230a425fd
Binary files /dev/null and b/docs/images/templates/publish.png differ
diff --git a/docs/images/templates/select-template.png b/docs/images/templates/select-template.png
new file mode 100644
index 0000000000000..4210064de8479
Binary files /dev/null and b/docs/images/templates/select-template.png differ
diff --git a/docs/images/templates/source-code.png b/docs/images/templates/source-code.png
new file mode 100644
index 0000000000000..641b97171c0cb
Binary files /dev/null and b/docs/images/templates/source-code.png differ
diff --git a/docs/images/templates/starter-templates-button.png b/docs/images/templates/starter-templates-button.png
new file mode 100644
index 0000000000000..d8607abc06007
Binary files /dev/null and b/docs/images/templates/starter-templates-button.png differ
diff --git a/docs/images/templates/starter-templates.png b/docs/images/templates/starter-templates.png
new file mode 100644
index 0000000000000..2008a41f5b4b0
Binary files /dev/null and b/docs/images/templates/starter-templates.png differ
diff --git a/docs/images/templates/template-architecture.png b/docs/images/templates/template-architecture.png
new file mode 100644
index 0000000000000..6d84ac27738d3
Binary files /dev/null and b/docs/images/templates/template-architecture.png differ
diff --git a/docs/images/templates/template-tour.png b/docs/images/templates/template-tour.png
new file mode 100644
index 0000000000000..d5a75f5155fdb
Binary files /dev/null and b/docs/images/templates/template-tour.png differ
diff --git a/docs/images/templates/template-variables.png b/docs/images/templates/template-variables.png
new file mode 100644
index 0000000000000..e900fb9f3c6dc
Binary files /dev/null and b/docs/images/templates/template-variables.png differ
diff --git a/docs/images/templates/update.png b/docs/images/templates/update.png
new file mode 100644
index 0000000000000..799a96cbc4ac3
Binary files /dev/null and b/docs/images/templates/update.png differ
diff --git a/docs/images/templates/use-template.png b/docs/images/templates/use-template.png
new file mode 100644
index 0000000000000..e8e11a15ba040
Binary files /dev/null and b/docs/images/templates/use-template.png differ
diff --git a/docs/images/templates/workspace-apps.png b/docs/images/templates/workspace-apps.png
new file mode 100644
index 0000000000000..cf4f8061899e6
Binary files /dev/null and b/docs/images/templates/workspace-apps.png differ
diff --git a/docs/images/templates/workspace-ready.png b/docs/images/templates/workspace-ready.png
new file mode 100644
index 0000000000000..8f4fc70d9c598
Binary files /dev/null and b/docs/images/templates/workspace-ready.png differ
diff --git a/docs/images/workspace-update.png b/docs/images/workspace-update.png
new file mode 100644
index 0000000000000..2ae1fcd483e61
Binary files /dev/null and b/docs/images/workspace-update.png differ
diff --git a/docs/install/binary.md b/docs/install/binary.md
index 33e2bbc1c5f4d..8e646816945c5 100644
--- a/docs/install/binary.md
+++ b/docs/install/binary.md
@@ -1,15 +1,22 @@
-Coder publishes self-contained .zip and .tar.gz archives in [GitHub releases](https://github.com/coder/coder/releases/latest). The archives bundle `coder` binary.
+Coder publishes self-contained .zip and .tar.gz archives in
+[GitHub releases](https://github.com/coder/coder/releases/latest). The archives
+bundle `coder` binary.
 
-1. Download the [release archive](https://github.com/coder/coder/releases/latest) appropriate for your operating system
+1. Download the
+   [release archive](https://github.com/coder/coder/releases/latest) appropriate
+   for your operating system
 
-1. Unzip the folder you just downloaded, and move the `coder` executable to a location that's on your `PATH`
+1. Unzip the folder you just downloaded, and move the `coder` executable to a
+   location that's on your `PATH`
 
    ```console
    # ex. macOS and Linux
    mv coder /usr/local/bin
    ```
 
-   > Windows users: see [this guide](https://answers.microsoft.com/en-us/windows/forum/all/adding-path-variable/97300613-20cb-4d85-8d0e-cc9d3549ba23) for adding folders to `PATH`.
+   > Windows users: see
+   > [this guide](https://answers.microsoft.com/en-us/windows/forum/all/adding-path-variable/97300613-20cb-4d85-8d0e-cc9d3549ba23)
+   > for adding folders to `PATH`.
 
 1. Start a Coder server
 
@@ -21,9 +28,9 @@ Coder publishes self-contained .zip and .tar.gz archives in [GitHub releases](ht
    coder server --postgres-url <url> --access-url <url>
    ```
 
-   > Set `CODER_ACCESS_URL` to the external URL that users and workspaces will use to
-   > connect to Coder. This is not required if you are using the tunnel. Learn more
-   > about Coder's [configuration options](../admin/configure.md).
+   > Set `CODER_ACCESS_URL` to the external URL that users and workspaces will
+   > use to connect to Coder. This is not required if you are using the tunnel.
+   > Learn more about Coder's [configuration options](../admin/configure.md).
 
 1. Visit the Coder URL in the logs to set up your first account, or use the CLI.
 
diff --git a/docs/install/database.md b/docs/install/database.md
index e88daa3b0ea7a..482ff22320053 100644
--- a/docs/install/database.md
+++ b/docs/install/database.md
@@ -1,11 +1,12 @@
 ## Recommendation
 
-For production deployments, we recommend using an external [PostgreSQL](https://www.postgresql.org/) database (version 13 or higher).
+For production deployments, we recommend using an external
+[PostgreSQL](https://www.postgresql.org/) database (version 13 or higher).
 
 ## Basic configuration
 
-Before starting the Coder server, prepare the database server by creating a role and a database.
-Remember that the role must have access to the created database.
+Before starting the Coder server, prepare the database server by creating a role
+and a database. Remember that the role must have access to the created database.
 
 With `psql`:
 
@@ -19,8 +20,9 @@ With `psql -U coder`:
 CREATE DATABASE coder;
 ```
 
-Coder configuration is defined via [environment variables](../admin/configure.md).
-The database client requires the connection string provided via the `CODER_PG_CONNECTION_URL` variable.
+Coder configuration is defined via
+[environment variables](../admin/configure.md). The database client requires the
+connection string provided via the `CODER_PG_CONNECTION_URL` variable.
 
 ```console
 export CODER_PG_CONNECTION_URL="postgres://coder:secret42@localhost/coder?sslmode=disable"
@@ -28,7 +30,9 @@ export CODER_PG_CONNECTION_URL="postgres://coder:secret42@localhost/coder?sslmod
 
 ## Custom schema
 
-For installations with elevated security requirements, it's advised to use a separate [schema](https://www.postgresql.org/docs/current/ddl-schemas.html) instead of the public one.
+For installations with elevated security requirements, it's advised to use a
+separate [schema](https://www.postgresql.org/docs/current/ddl-schemas.html)
+instead of the public one.
 
 With `psql -U coder`:
 
@@ -53,8 +57,10 @@ In this case the database client requires the modified connection string:
 export CODER_PG_CONNECTION_URL="postgres://coder:secret42@localhost/coder?sslmode=disable&search_path=myschema"
 ```
 
-The `search_path` parameter determines the order of schemas in which they are visited while looking for a specific table.
-The first schema named in the search path is called the current schema. By default `search_path` defines the following schemas:
+The `search_path` parameter determines the order of schemas in which they are
+visited while looking for a specific table. The first schema named in the search
+path is called the current schema. By default `search_path` defines the
+following schemas:
 
 ```sql
 SHOW search_path;
@@ -64,7 +70,8 @@ search_path
  "$user", public
 ```
 
-Using the `search_path` in the connection string corresponds to the following `psql` command:
+Using the `search_path` in the connection string corresponds to the following
+`psql` command:
 
 ```sql
 ALTER ROLE coder SET search_path = myschema;
@@ -74,8 +81,9 @@ ALTER ROLE coder SET search_path = myschema;
 
 ### Coder server fails startup with "current_schema: converting NULL to string is unsupported"
 
-Please make sure that the schema selected in the connection string `...&search_path=myschema` exists
-and the role has granted permissions to access it. The schema should be present on this listing:
+Please make sure that the schema selected in the connection string
+`...&search_path=myschema` exists and the role has granted permissions to access
+it. The schema should be present on this listing:
 
 ```console
 psql -U coder -c '\dn'
diff --git a/docs/install/docker.md b/docs/install/docker.md
index 038146b30085b..e3b2196f941f7 100644
--- a/docs/install/docker.md
+++ b/docs/install/docker.md
@@ -1,15 +1,18 @@
-You can install and run Coder using the official Docker images published on [GitHub Container Registry](https://github.com/coder/coder/pkgs/container/coder).
+You can install and run Coder using the official Docker images published on
+[GitHub Container Registry](https://github.com/coder/coder/pkgs/container/coder).
 
 ## Requirements
 
-Docker is required. See the [official installation documentation](https://docs.docker.com/install/).
+Docker is required. See the
+[official installation documentation](https://docs.docker.com/install/).
 
-> Note that the below steps are only supported on a Linux distribution. If on macOS, please [run Coder via the standalone binary](./binary.md).
+> Note that the below steps are only supported on a Linux distribution. If on
+> macOS, please [run Coder via the standalone binary](./binary.md).
 
 ## Run Coder with the built-in database (quick)
 
-For proof-of-concept deployments, you can run a complete Coder instance with
-the following command.
+For proof-of-concept deployments, you can run a complete Coder instance with the
+following command.
 
 ```console
 export CODER_DATA=$HOME/.config/coderv2-docker
@@ -27,8 +30,8 @@ ensure Coder has permissions to manage Docker via `docker.sock`. If the host
 systems `/var/run/docker.sock` is not group writeable or does not belong to the
 `docker` group, the above may not work as-is.</sup>
 
-Coder configuration is defined via environment variables.
-Learn more about Coder's [configuration options](../admin/configure.md).
+Coder configuration is defined via environment variables. Learn more about
+Coder's [configuration options](../admin/configure.md).
 
 ## Run Coder with access URL and external PostgreSQL (recommended)
 
@@ -44,13 +47,14 @@ docker run --rm -it \
   ghcr.io/coder/coder:latest
 ```
 
-Coder configuration is defined via environment variables.
-Learn more about Coder's [configuration options](../admin/configure.md).
+Coder configuration is defined via environment variables. Learn more about
+Coder's [configuration options](../admin/configure.md).
 
 ## Run Coder with docker-compose
 
-Coder's publishes a [docker-compose example](https://github.com/coder/coder/blob/main/docker-compose.yaml) which includes
-an PostgreSQL container and volume.
+Coder's publishes a
+[docker-compose example](https://github.com/coder/coder/blob/main/docker-compose.yaml)
+which includes an PostgreSQL container and volume.
 
 1. Install [Docker Compose](https://docs.docker.com/compose/install/)
 
@@ -62,9 +66,11 @@ an PostgreSQL container and volume.
 
 3. Start Coder with `docker-compose up`:
 
-   In order to use cloud-based templates (e.g. Kubernetes, AWS), you must have an external URL that users and workspaces will use to connect to Coder.
+   In order to use cloud-based templates (e.g. Kubernetes, AWS), you must have
+   an external URL that users and workspaces will use to connect to Coder.
 
-   For proof-of-concept deployments, you can use [Coder's tunnel](../admin/configure.md#tunnel):
+   For proof-of-concept deployments, you can use
+   [Coder's tunnel](../admin/configure.md#tunnel):
 
    ```console
    cd coder
@@ -72,7 +78,8 @@ an PostgreSQL container and volume.
    docker-compose up
    ```
 
-   For production deployments, we recommend setting an [access URL](../admin/configure.md#access-url):
+   For production deployments, we recommend setting an
+   [access URL](../admin/configure.md#access-url):
 
    ```console
    cd coder
@@ -80,19 +87,24 @@ an PostgreSQL container and volume.
    CODER_ACCESS_URL=https://coder.example.com docker-compose up
    ```
 
-4. Visit the web ui via the configured url. You can add `/login` to the base url to create the first user via the ui.
+4. Visit the web ui via the configured url. You can add `/login` to the base url
+   to create the first user via the ui.
 
-5. Follow the on-screen instructions log in and create your first template and workspace
+5. Follow the on-screen instructions log in and create your first template and
+   workspace
 
 ## Troubleshooting
 
 ### Docker-based workspace is stuck in "Connecting..."
 
-Ensure you have an externally-reachable `CODER_ACCESS_URL` set. See [troubleshooting templates](../templates/index.md#troubleshooting-templates) for more steps.
+Ensure you have an externally-reachable `CODER_ACCESS_URL` set. See
+[troubleshooting templates](../templates/index.md#troubleshooting-templates) for
+more steps.
 
 ### Permission denied while trying to connect to the Docker daemon socket
 
-See Docker's official documentation to [Manage Docker as a non-root user](https://docs.docker.com/engine/install/linux-postinstall/#manage-docker-as-a-non-root-user)
+See Docker's official documentation to
+[Manage Docker as a non-root user](https://docs.docker.com/engine/install/linux-postinstall/#manage-docker-as-a-non-root-user)
 
 ## Next steps
 
diff --git a/docs/install/install.sh.md b/docs/install/install.sh.md
index 4acd34288e3d9..ab23cec5731c6 100644
--- a/docs/install/install.sh.md
+++ b/docs/install/install.sh.md
@@ -1,4 +1,6 @@
-The easiest way to install Coder is to use our [install script](https://github.com/coder/coder/blob/main/install.sh) for Linux and macOS.
+The easiest way to install Coder is to use our
+[install script](https://github.com/coder/coder/blob/main/install.sh) for Linux
+and macOS.
 
 To install, run:
 
@@ -12,15 +14,99 @@ You can preview what occurs during the install process:
 curl -fsSL https://coder.com/install.sh | sh -s -- --dry-run
 ```
 
-You can modify the installation process by including flags. Run the help command for reference:
+You can modify the installation process by including flags. Run the help command
+for reference:
 
 ```bash
 curl -fsSL https://coder.com/install.sh | sh -s -- --help
 ```
 
-After installing, use the in-terminal instructions to start the Coder server manually via `coder server` or as a system package.
+After installing, use the in-terminal instructions to start the Coder server
+manually via `coder server` or as a system package.
 
-By default, the Coder server runs on `http://127.0.0.1:3000` and uses a [public tunnel](../admin/configure.md#tunnel) for workspace connections.
+By default, the Coder server runs on `http://127.0.0.1:3000` and uses a
+[public tunnel](../admin/configure.md#tunnel) for workspace connections.
+
+## PATH conflicts
+
+It's possible to end up in situations where you have multiple `coder` binaries
+in your `PATH`, and your system may use a version that you don't intend. Your
+`PATH` is a variable that tells your shell where to look for programs to run.
+
+You can check where all of the versions are by running `which -a coder`.
+
+For example, a common conflict on macOS might be between a version installed by
+Homebrew, and a version installed manually to the /usr/local/bin directory.
+
+```console
+$ which -a coder
+/usr/local/bin/coder
+/opt/homebrew/bin/coder
+```
+
+Whichever binary comes first in this list will be used when running `coder`
+commands.
+
+### Reordering your PATH
+
+If you use bash or zsh, you can update your `PATH` like this:
+
+```shell
+# You might want to add this line to the end of your ~/.bashrc or ~/.zshrc file!
+export PATH="/opt/homebrew/bin:$PATH"
+```
+
+If you use fish, you can update your `PATH` like this:
+
+```shell
+# You might want to add this line to the end of your ~/.config/fish/config.fish file!
+fish_add_path "/opt/homebrew/bin"
+```
+
+> ℹ If you ran install.sh with a `--prefix` flag, you can replace
+> `/opt/homebrew` with whatever value you used there. Make sure to leave the
+> `/bin` at the end!
+
+Now we can observe that the order has changed:
+
+```console
+$ which -a coder
+/opt/homebrew/bin/coder
+/usr/local/bin/coder
+```
+
+### Removing unneeded binaries
+
+If you want to uninstall a version of `coder` that you installed with a package
+manager, you can run whichever one of these commands applies:
+
+```shell
+# On macOS, with Homebrew installed
+brew uninstall coder
+```
+
+```shell
+# On Debian/Ubuntu based systems
+sudo dpkg -r coder
+```
+
+```shell
+# On Fedora/RHEL-like systems
+sudo rpm -e coder
+```
+
+```shell
+# On Alpine
+sudo apk del coder
+```
+
+If the conflicting binary is not installed by your system package manager, you
+can just delete it.
+
+```shell
+# You might not need `sudo`, depending on the location
+sudo rm /usr/local/bin/coder
+```
 
 ## Next steps
 
diff --git a/docs/install/kubernetes.md b/docs/install/kubernetes.md
index 191ef1aba0338..6e07f68fd57c6 100644
--- a/docs/install/kubernetes.md
+++ b/docs/install/kubernetes.md
@@ -1,20 +1,18 @@
 ## Requirements
 
-Before proceeding, please ensure that you have a Kubernetes cluster running K8s 1.19+ and have Helm 3.5+ installed.
+Before proceeding, please ensure that you have a Kubernetes cluster running K8s
+1.19+ and have Helm 3.5+ installed.
 
-You'll also want to install the [latest version of Coder](https://github.com/coder/coder/releases/latest) locally in order
-to log in and manage templates.
+You'll also want to install the
+[latest version of Coder](https://github.com/coder/coder/releases/latest)
+locally in order to log in and manage templates.
 
 ## Install Coder with Helm
 
-> **Warning**: Helm support is new and not yet complete. There may be changes
-> to the Helm chart between releases which require manual values updates. Please
-> file an issue if you run into any issues.
-
 1. Create a namespace for Coder, such as `coder`:
 
    ```console
-   $ kubectl create namespace coder
+   kubectl create namespace coder
    ```
 
 1. Create a PostgreSQL deployment. Coder does not manage a database server for
@@ -25,12 +23,13 @@ to log in and manage templates.
    [AWS](https://aws.amazon.com/rds/postgresql/),
    [Azure](https://docs.microsoft.com/en-us/azure/postgresql/), or
    [DigitalOcean](https://www.digitalocean.com/products/managed-databases-postgresql),
-   you can use the managed PostgreSQL offerings they provide. Make sure that
-   the PostgreSQL service is running and accessible from your cluster. It
-   should be in the same network, same project, etc.
+   you can use the managed PostgreSQL offerings they provide. Make sure that the
+   PostgreSQL service is running and accessible from your cluster. It should be
+   in the same network, same project, etc.
 
    You can install Postgres manually on your cluster using the
-   [Bitnami PostgreSQL Helm chart](https://github.com/bitnami/charts/tree/master/bitnami/postgresql#readme). There are some
+   [Bitnami PostgreSQL Helm chart](https://github.com/bitnami/charts/tree/master/bitnami/postgresql#readme).
+   There are some
    [helpful guides](https://phoenixnap.com/kb/postgresql-kubernetes) on the
    internet that explain sensible configurations for this chart. Example:
 
@@ -53,15 +52,8 @@ to log in and manage templates.
 
    > Ensure you set up periodic backups so you don't lose data.
 
-   You can use
-   [Postgres operator](https://github.com/zalando/postgres-operator) to
-   manage PostgreSQL deployments on your Kubernetes cluster.
-
-1. Add the Coder Helm repo:
-
-   ```console
-   helm repo add coder-v2 https://helm.coder.com/v2
-   ```
+   You can use [Postgres operator](https://github.com/zalando/postgres-operator)
+   to manage PostgreSQL deployments on your Kubernetes cluster.
 
 1. Create a secret with the database URL:
 
@@ -72,6 +64,12 @@ to log in and manage templates.
       --from-literal=url="postgres://coder:coder@coder-db-postgresql.coder.svc.cluster.local:5432/coder?sslmode=disable"
    ```
 
+1. Add the Coder Helm repo:
+
+   ```console
+   helm repo add coder-v2 https://helm.coder.com/v2
+   ```
+
 1. Create a `values.yaml` with the configuration settings you'd like for your
    deployment. For example:
 
@@ -109,38 +107,71 @@ to log in and manage templates.
    > You can view our
    > [Helm README](https://github.com/coder/coder/blob/main/helm#readme) for
    > details on the values that are available, or you can view the
-   > [values.yaml](https://github.com/coder/coder/blob/main/helm/values.yaml)
+   > [values.yaml](https://github.com/coder/coder/blob/main/helm/coder/values.yaml)
    > file directly.
 
-   If you are deploying Coder on AWS EKS and service is set to `LoadBalancer`, AWS will default to the Classic load balancer. The load balancer external IP will be stuck in a pending status unless sessionAffinity is set to None.
+1. Run the following command to install the chart in your cluster.
 
-   ```yaml
-   coder:
-     service:
-       type: LoadBalancer
-       sessionAffinity: None
+   ```console
+   helm install coder coder-v2/coder \
+       --namespace coder \
+       --values values.yaml
    ```
 
+   You can watch Coder start up by running `kubectl get pods -n coder`. Once
+   Coder has started, the `coder-*` pods should enter the `Running` state.
+
+1. Log in to Coder
+
+   Use `kubectl get svc -n coder` to get the IP address of the LoadBalancer.
+   Visit this in the browser to set up your first account.
+
+   If you do not have a domain, you should set `CODER_ACCESS_URL` to this URL in
+   the Helm chart and upgrade Coder (see below). This allows workspaces to
+   connect to the proper Coder URL.
+
+## Upgrading Coder via Helm
+
+To upgrade Coder in the future or change values, you can run the following
+command:
+
+```console
+helm repo update
+helm upgrade coder coder-v2/coder \
+  --namespace coder \
+  -f values.yaml
+```
+
 ## Load balancing considerations
 
 ### AWS
 
-AWS however recommends a Network load balancer in lieu of the Classic load balancer. Use the following `values.yaml` settings to request a Network load balancer:
+If you are deploying Coder on AWS EKS and service is set to `LoadBalancer`, AWS
+will default to the Classic load balancer. The load balancer external IP will be
+stuck in a pending status unless sessionAffinity is set to None.
+
+```yaml
+coder:
+  service:
+    type: LoadBalancer
+    sessionAffinity: None
+```
+
+AWS recommends a Network load balancer in lieu of the Classic load balancer. Use
+the following `values.yaml` settings to request a Network load balancer:
 
 ```yaml
 coder:
-   service:
-   externalTrafficPolicy: Local
-   sessionAffinity: None
-   annotations: {
-      service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
- }
+  service:
+    externalTrafficPolicy: Local
+    sessionAffinity: None
+    annotations: { service.beta.kubernetes.io/aws-load-balancer-type: "nlb" }
 ```
 
 By default, Coder will set the `externalTrafficPolicy` to `Cluster` which will
-mask client IP addresses in the Audit log. To preserve the source IP, you can either
-set this value to `Local`, or pass through the client IP via the X-Forwarded-For
-header. To configure the latter, set the following environment
+mask client IP addresses in the Audit log. To preserve the source IP, you can
+either set this value to `Local`, or pass through the client IP via the
+X-Forwarded-For header. To configure the latter, set the following environment
 variables:
 
 ```yaml
@@ -152,39 +183,23 @@ coder:
       value: 10.0.0.1/8 # this will be the CIDR range of your Load Balancer IP address
 ```
 
-1. Run the following command to install the chart in your cluster.
-
-   ```console
-   helm install coder coder-v2/coder \
-       --namespace coder \
-       --values values.yaml
-   ```
-
-   You can watch Coder start up by running `kubectl get pods -n coder`. Once Coder has
-   started, the `coder-*` pods should enter the `Running` state.
-
-1. Log in to Coder
-
-   Use `kubectl get svc -n coder` to get the IP address of the
-   LoadBalancer. Visit this in the browser to set up your first account.
-
-   If you do not have a domain, you should set `CODER_ACCESS_URL`
-   to this URL in the Helm chart and upgrade Coder (see below).
-   This allows workspaces to connect to the proper Coder URL.
-
 ### Azure
 
-In certain enterprise environments, the [Azure Application Gateway](https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-overview) was needed. The Application Gateway supports:
+In certain enterprise environments, the
+[Azure Application Gateway](https://learn.microsoft.com/en-us/azure/application-gateway/ingress-controller-overview)
+was needed. The Application Gateway supports:
 
 - Websocket traffic (required for workspace connections)
 - TLS termination
 
 ## PostgreSQL Certificates
 
-Your organization may require connecting to the database instance over SSL. To supply
-Coder with the appropriate certificates, and have it connect over SSL, follow the steps below:
+Your organization may require connecting to the database instance over SSL. To
+supply Coder with the appropriate certificates, and have it connect over SSL,
+follow the steps below:
 
-1. Create the certificate as a secret in your Kubernetes cluster, if not already present:
+1. Create the certificate as a secret in your Kubernetes cluster, if not already
+   present:
 
 ```console
 $ kubectl create secret tls postgres-certs -n coder --key="postgres.key" --cert="postgres.crt"
@@ -210,32 +225,24 @@ coder:
 postgres://<user>:<password>@databasehost:<port>/<db-name>?sslmode=require&sslcert=$HOME/.postgresql/postgres.crt&sslkey=$HOME/.postgresql/postgres.key"
 ```
 
-> More information on connecting to PostgreSQL databases using certificates can be found [here](https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-CLIENTCERT).
-
-## Upgrading Coder via Helm
-
-To upgrade Coder in the future or change values,
-you can run the following command:
-
-```console
-helm repo update
-helm upgrade coder coder-v2/coder \
-  --namespace coder \
-  -f values.yaml
-```
+> More information on connecting to PostgreSQL databases using certificates can
+> be found
+> [here](https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-CLIENTCERT).
 
 ## Troubleshooting
 
-You can view Coder's logs by getting the pod name from `kubectl get pods` and then running `kubectl logs <pod name>`. You can also
-view these logs in your
+You can view Coder's logs by getting the pod name from `kubectl get pods` and
+then running `kubectl logs <pod name>`. You can also view these logs in your
 Cloud's log management system if you are using managed Kubernetes.
 
 ### Kubernetes-based workspace is stuck in "Connecting..."
 
-Ensure you have an externally-reachable `CODER_ACCESS_URL` set in your helm chart. If you do not have a domain set up,
-this should be the IP address of Coder's LoadBalancer (`kubectl get svc -n coder`).
+Ensure you have an externally-reachable `CODER_ACCESS_URL` set in your helm
+chart. If you do not have a domain set up, this should be the IP address of
+Coder's LoadBalancer (`kubectl get svc -n coder`).
 
-See [troubleshooting templates](../templates/index.md#troubleshooting-templates) for more steps.
+See [troubleshooting templates](../templates/index.md#troubleshooting-templates)
+for more steps.
 
 ## Next steps
 
diff --git a/docs/install/macos.md b/docs/install/macos.md
new file mode 100644
index 0000000000000..18b9f0b32652e
--- /dev/null
+++ b/docs/install/macos.md
@@ -0,0 +1,35 @@
+# macOS
+
+You can use [Homebrew](https://brew.sh) to install the `coder` command. Homebrew
+is recommended, but you can also use our [install script](./install.sh.md) or
+download a [standalone binary](./binary.md).
+
+1. Install Coder from our official
+   [Homebrew tap](https://github.com/coder/homebrew-coder)
+
+   ```console
+   brew install coder/coder/coder
+   ```
+
+   ![Homebrew output from installing Coder](../images/install/homebrew.png)
+
+2. Start a Coder server
+
+   ```console
+   # Automatically sets up an external access URL on *.try.coder.app
+   coder server
+
+   # Requires a PostgreSQL instance (version 13 or higher) and external access URL
+   coder server --postgres-url <url> --access-url <url>
+   ```
+
+   > Set `CODER_ACCESS_URL` to the external URL that users and workspaces will
+   > use to connect to Coder. This is not required if you are using the tunnel.
+   > Learn more about Coder's [configuration options](../admin/configure.md).
+
+3. Visit the Coder URL in the logs to set up your first account, or use the CLI.
+
+## Next steps
+
+- [Configuring Coder](../admin/configure.md)
+- [Templates](../templates/index.md)
diff --git a/docs/install/offline.md b/docs/install/offline.md
index 1081843c24643..e9fe821f8dbce 100644
--- a/docs/install/offline.md
+++ b/docs/install/offline.md
@@ -1,8 +1,10 @@
 # Offline Deployments
 
-All Coder features are supported in offline / behind firewalls / in air-gapped environments. However, some changes to your configuration are necessary.
+All Coder features are supported in offline / behind firewalls / in air-gapped
+environments. However, some changes to your configuration are necessary.
 
-> This is a general comparison. Keep reading for a full tutorial running Coder offline with Kubernetes or Docker.
+> This is a general comparison. Keep reading for a full tutorial running Coder
+> offline with Kubernetes or Docker.
 
 |                    | Public deployments                                                                                                                                                                                                                                                 | Offline deployments                                                                                                                                                                                                                                                         |
 | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -16,16 +18,23 @@ All Coder features are supported in offline / behind firewalls / in air-gapped e
 
 ## Offline container images
 
-The following instructions walk you through how to build a custom Coder server image for Docker or Kubernetes
+The following instructions walk you through how to build a custom Coder server
+image for Docker or Kubernetes
 
-First, build and push a container image extending our official image with the following:
+First, build and push a container image extending our official image with the
+following:
 
-- CLI config (.tfrc) for Terraform referring to [external mirror](https://www.terraform.io/cli/config/config-file#explicit-installation-method-configuration)
+- CLI config (.tfrc) for Terraform referring to
+  [external mirror](https://www.terraform.io/cli/config/config-file#explicit-installation-method-configuration)
 - [Terraform Providers](https://registry.terraform.io) for templates
-  - These could also be specified via a volume mount (Docker) or [network mirror](https://www.terraform.io/internals/provider-network-mirror-protocol). See below for details.
+  - These could also be specified via a volume mount (Docker) or
+    [network mirror](https://www.terraform.io/internals/provider-network-mirror-protocol).
+    See below for details.
 
-> Note: Coder includes the latest [supported version](https://github.com/coder/coder/blob/main/provisioner/terraform/install.go#L23-L24) of Terraform in the official Docker images.
-> If you need to bundle a different version of terraform, you can do so by customizing the image.
+> Note: Coder includes the latest
+> [supported version](https://github.com/coder/coder/blob/main/provisioner/terraform/install.go#L23-L24)
+> of Terraform in the official Docker images. If you need to bundle a different
+> version of terraform, you can do so by customizing the image.
 
 Here's an example Dockerfile:
 
@@ -45,7 +54,7 @@ RUN mkdir -p /opt/terraform
 # The below step is optional if you wish to keep the existing version.
 # See https://github.com/coder/coder/blob/main/provisioner/terraform/install.go#L23-L24
 # for supported Terraform versions.
-ARG TERRAFORM_VERSION=1.3.9
+ARG TERRAFORM_VERSION=1.5.6
 RUN apk update && \
     apk del terraform && \
     curl -LOs https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip \
@@ -58,59 +67,61 @@ ENV PATH=/opt/terraform:${PATH}
 # to download the Terraform providers used in Coder templates.
 # There are two options:
 
-# Option 1) Use a filesystem mirror. We can seed this at build-time
-#    or by mounting a volume to /opt/terraform/plugins in the container.
-#    https://developer.hashicorp.com/terraform/cli/config/config-file#filesystem_mirror
-#    Be sure to add all the providers you use in your templates to /opt/terraform/plugins
+# Option 1) Use a filesystem mirror.
+#  We can seed this at build-time or by mounting a volume to
+#  /opt/terraform/plugins in the container.
+#  https://developer.hashicorp.com/terraform/cli/config/config-file#filesystem_mirror
+#  Be sure to add all the providers you use in your templates to /opt/terraform/plugins
 
-RUN mkdir -p /opt/terraform/plugins
-ADD filesystem-mirror-example.tfrc /opt/terraform/config.tfrc
+RUN mkdir -p /home/coder/.terraform.d/plugins/registry.terraform.io
+ADD filesystem-mirror-example.tfrc /home/coder/.terraformrc
 
 # Optionally, we can "seed" the filesystem mirror with common providers.
 # Comment out lines 40-49 if you plan on only using a volume or network mirror:
-RUN mkdir -p /opt/terraform/plugins/registry.terraform.io
-WORKDIR /opt/terraform/plugins/registry.terraform.io
-ARG CODER_PROVIDER_VERSION=0.6.10
+WORKDIR /home/coder/.terraform.d/plugins/registry.terraform.io
+ARG CODER_PROVIDER_VERSION=0.12.1
 RUN echo "Adding coder/coder v${CODER_PROVIDER_VERSION}" \
     && mkdir -p coder/coder && cd coder/coder \
     && curl -LOs https://github.com/coder/terraform-provider-coder/releases/download/v${CODER_PROVIDER_VERSION}/terraform-provider-coder_${CODER_PROVIDER_VERSION}_linux_amd64.zip
-ARG DOCKER_PROVIDER_VERSION=3.0.1
+ARG DOCKER_PROVIDER_VERSION=3.0.2
 RUN echo "Adding kreuzwerker/docker v${DOCKER_PROVIDER_VERSION}" \
     && mkdir -p kreuzwerker/docker && cd kreuzwerker/docker \
     && curl -LOs https://github.com/kreuzwerker/terraform-provider-docker/releases/download/v${DOCKER_PROVIDER_VERSION}/terraform-provider-docker_${DOCKER_PROVIDER_VERSION}_linux_amd64.zip
-ARG KUBERNETES_PROVIDER_VERSION=2.18.1
+ARG KUBERNETES_PROVIDER_VERSION=2.23.0
 RUN echo "Adding kubernetes/kubernetes v${KUBERNETES_PROVIDER_VERSION}" \
-    && mkdir -p kubernetes/kubernetes && cd kubernetes/kubernetes \
+    && mkdir -p hashicorp/kubernetes && cd hashicorp/kubernetes \
     && curl -LOs https://releases.hashicorp.com/terraform-provider-kubernetes/${KUBERNETES_PROVIDER_VERSION}/terraform-provider-kubernetes_${KUBERNETES_PROVIDER_VERSION}_linux_amd64.zip
-ARG AWS_PROVIDER_VERSION=4.59.0
+ARG AWS_PROVIDER_VERSION=5.19.0
 RUN echo "Adding aws/aws v${AWS_PROVIDER_VERSION}" \
     && mkdir -p aws/aws && cd aws/aws \
     && curl -LOs https://releases.hashicorp.com/terraform-provider-aws/${AWS_PROVIDER_VERSION}/terraform-provider-aws_${AWS_PROVIDER_VERSION}_linux_amd64.zip
 
-RUN chown -R coder:coder /opt/terraform/plugins
+RUN chown -R coder:coder /home/coder/.terraform*
 WORKDIR /home/coder
 
 # Option 2) Use a network mirror.
-#    https://developer.hashicorp.com/terraform/cli/config/config-file#network_mirror
-#    Be sure uncomment line 60 and edit network-mirror-example.tfrc to
-#    specify the HTTPS base URL of your mirror.
+#  https://developer.hashicorp.com/terraform/cli/config/config-file#network_mirror
+#  Be sure uncomment line 60 and edit network-mirror-example.tfrc to
+#  specify the HTTPS base URL of your mirror.
 
-# ADD network-mirror-example.tfrc /opt/terraform/config.tfrc
+# ADD network-mirror-example.tfrc /home/coder/.terraformrc
 
 USER coder
 
-# Use the tfrc file to inform
-ENV TF_CLI_CONFIG_FILE=/opt/terraform/config.tfrc
+# Use the .terraformrc file to inform Terraform of the locally installed providers.
+ENV TF_CLI_CONFIG_FILE=/home/coder/.terraformrc
 ```
 
 > If you are bundling Terraform providers into your Coder image, be sure the
-> provider version matches any templates or [example templates](https://github.com/coder/coder/tree/main/examples/templates) you intend to use.
+> provider version matches any templates or
+> [example templates](https://github.com/coder/coder/tree/main/examples/templates)
+> you intend to use.
 
 ```hcl
 # filesystem-mirror-example.tfrc
 provider_installation {
   filesystem_mirror {
-    path = "/opt/terraform/plugins"
+    path = "/home/coder/.terraform.d/plugins"
   }
 }
 ```
@@ -126,7 +137,10 @@ provider_installation {
 
 ## Run offline via Docker
 
-Follow our [docker-compose](./docker.md#run-coder-with-docker-compose) documentation and modify the docker-compose file to specify your custom Coder image. Additionally, you can add a volume mount to add providers to the filesystem mirror without re-building the image.
+Follow our [docker-compose](./docker.md#run-coder-with-docker-compose)
+documentation and modify the docker-compose file to specify your custom Coder
+image. Additionally, you can add a volume mount to add providers to the
+filesystem mirror without re-building the image.
 
 First, make a create an empty plugins directory:
 
@@ -158,11 +172,17 @@ services:
     # ...
 ```
 
-> The [terraform providers mirror](https://www.terraform.io/cli/commands/providers/mirror) command can be used to download the required plugins for a Coder template. This can be uploaded into the `plugins` directory on your offline server.
+> The
+> [terraform providers mirror](https://www.terraform.io/cli/commands/providers/mirror)
+> command can be used to download the required plugins for a Coder template.
+> This can be uploaded into the `plugins` directory on your offline server.
 
 ## Run offline via Kubernetes
 
-We publish the Helm chart for download on [GitHub Releases](https://github.com/coder/coder/releases/latest). Follow our [Kubernetes](./kubernetes.md) documentation and modify the Helm values to specify your custom Coder image.
+We publish the Helm chart for download on
+[GitHub Releases](https://github.com/coder/coder/releases/latest). Follow our
+[Kubernetes](./kubernetes.md) documentation and modify the Helm values to
+specify your custom Coder image.
 
 ```yaml
 # values.yaml
@@ -188,12 +208,31 @@ coder:
 
 ## Offline docs
 
-Coder also provides offline documentation in case you want to host it on your own server. The docs are exported as static files that you can host on any web server, as demonstrated in the example below:
+Coder also provides offline documentation in case you want to host it on your
+own server. The docs are exported as static files that you can host on any web
+server, as demonstrated in the example below:
 
-1. Go to the release page. In this case, we want to use the [latest version](https://github.com/coder/coder/releases/latest).
-2. Download the documentation files from the "Assets" section. It is named as `coder_docs_<version>.tgz`.
+1. Go to the release page. In this case, we want to use the
+   [latest version](https://github.com/coder/coder/releases/latest).
+2. Download the documentation files from the "Assets" section. It is named as
+   `coder_docs_<version>.tgz`.
 3. Extract the file and move its contents to your server folder.
-4. If you are using NodeJS, you can execute the following command: `cd docs && npx http-server .`
-5. Set the [CODER_DOCS_URL](../cli/server#--docs-url) environment variable to use the URL of your hosted docs. This way, the Coder UI will reference the documentation from your specified URL.
+4. If you are using NodeJS, you can execute the following command:
+   `cd docs && npx http-server .`
+5. Set the [CODER_DOCS_URL](../cli/server.md#--docs-url) environment variable to
+   use the URL of your hosted docs. This way, the Coder UI will reference the
+   documentation from your specified URL.
 
-With these steps, you'll have the Coder documentation hosted on your server and accessible for your team to use.
+With these steps, you'll have the Coder documentation hosted on your server and
+accessible for your team to use.
+
+## Firewall exceptions
+
+In restricted internet networks, Coder may require connection to internet.
+Ensure that the following web addresses are accessible from the machine where
+Coder is installed.
+
+- code-server.dev (install via AUR)
+- open-vsx.org (optional if someone would use code-server)
+- registry.terraform.io (to create and push template)
+- v2-licensor.coder.com (developing Coder in Coder)
diff --git a/docs/install/openshift.md b/docs/install/openshift.md
index dd0ab0a569601..7d7440978da24 100644
--- a/docs/install/openshift.md
+++ b/docs/install/openshift.md
@@ -2,10 +2,11 @@
 
 Before proceeding, please ensure that you have an OpenShift cluster running K8s
 1.19+ (OpenShift 4.7+) and have Helm 3.5+ installed. In addition, you'll need to
-install the OpenShift CLI (`oc`) to authenticate to your cluster and create OpenShift
-resources.
+install the OpenShift CLI (`oc`) to authenticate to your cluster and create
+OpenShift resources.
 
-You'll also want to install the [latest version of Coder](https://github.com/coder/coder/releases/latest)
+You'll also want to install the
+[latest version of Coder](https://github.com/coder/coder/releases/latest)
 locally in order to log in and manage templates.
 
 ## Install Coder with OpenShift
@@ -26,11 +27,12 @@ oc new-project coder
 
 ### 2. Configure SecurityContext values
 
-Depending upon your configured Security Context Constraints (SCC), you'll need to modify
-some or all of the following `securityContext` values from the default values:
+Depending upon your configured Security Context Constraints (SCC), you'll need
+to modify some or all of the following `securityContext` values from the default
+values:
 
-The below values are modified from Coder defaults and allow the Coder deployment to run
-under the SCC `restricted-v2`.
+The below values are modified from Coder defaults and allow the Coder deployment
+to run under the SCC `restricted-v2`.
 
 > Note: `readOnlyRootFilesystem: true` is not technically required under
 > `restricted-v2`, but is often mandated in OpenShift environments.
@@ -45,8 +47,8 @@ coder:
     seccompProfile: RuntimeDefault # Unchanged from default
 ```
 
-- For `runAsUser` / `runAsGroup`, you can retrieve the correct values for project UID and project GID with the following
-  command:
+- For `runAsUser` / `runAsGroup`, you can retrieve the correct values for
+  project UID and project GID with the following command:
 
       ```console
       oc get project coder -o json | jq -r '.metadata.annotations'
@@ -56,12 +58,12 @@ coder:
       }
       ```
 
-  Alternatively, you can set these values to `null` to allow OpenShift to automatically select
-  the correct value for the project.
+  Alternatively, you can set these values to `null` to allow OpenShift to
+  automatically select the correct value for the project.
 
 - For `readOnlyRootFilesystem`, consult the SCC under which Coder needs to run.
-  In the below example, the `restricted-v2` SCC does not require a read-only root filesystem,
-  while `restricted-custom` does:
+  In the below example, the `restricted-v2` SCC does not require a read-only
+  root filesystem, while `restricted-custom` does:
 
   ```console
   oc get scc -o wide
@@ -70,34 +72,34 @@ coder:
   restricted-v2       false   ["NET_BIND_SERVICE"]   MustRunAs   MustRunAsRange     MustRunAs   RunAsAny    <no value>   false            ["configMap","downwardAPI","emptyDir","ephemeral","persistentVolumeClaim","projected","secret"]
   ```
 
-  If you are unsure, we recommend setting `readOnlyRootFilesystem` to `true` in an OpenShift
-  environment.
+  If you are unsure, we recommend setting `readOnlyRootFilesystem` to `true` in
+  an OpenShift environment.
 
-- For `seccompProfile`: in some environments, you may need to set this to `null` to allow OpenShift
-  to pick its preferred value.
+- For `seccompProfile`: in some environments, you may need to set this to `null`
+  to allow OpenShift to pick its preferred value.
 
 ### 3. Configure the Coder service, connection URLs, and cache values
 
-To establish a connection to PostgreSQL, set the `CODER_PG_CONNECTION_URL` value.
-[See our Helm documentation](./kubernetes.md) on configuring the PostgreSQL connection
-URL as a secret. Additionally, if accessing Coder over a hostname, set the `CODER_ACCESS_URL`
-value.
+To establish a connection to PostgreSQL, set the `CODER_PG_CONNECTION_URL`
+value. [See our Helm documentation](./kubernetes.md) on configuring the
+PostgreSQL connection URL as a secret. Additionally, if accessing Coder over a
+hostname, set the `CODER_ACCESS_URL` value.
 
 By default, Coder creates the cache directory in `/home/coder/.cache`. Given the
-OpenShift-provided UID and `readOnlyRootFS` security context constraint, the Coder
-container does not have permission to write to this directory.
+OpenShift-provided UID and `readOnlyRootFS` security context constraint, the
+Coder container does not have permission to write to this directory.
 
-To fix this, you can mount a temporary volume in the pod and set
-the `CODER_CACHE_DIRECTORY` environment variable to that location.
-In the below example, we mount this under `/tmp` and set the cache location to
-`/tmp/coder`. This enables Coder to run with `readOnlyRootFilesystem: true`.
+To fix this, you can mount a temporary volume in the pod and set the
+`CODER_CACHE_DIRECTORY` environment variable to that location. In the below
+example, we mount this under `/tmp` and set the cache location to `/tmp/coder`.
+This enables Coder to run with `readOnlyRootFilesystem: true`.
 
 > Note: Depending on the number of templates and provisioners you use, you may
-> need to increase the size of the volume, as the `coder` pod will be automatically
-> restarted when this volume fills up.
+> need to increase the size of the volume, as the `coder` pod will be
+> automatically restarted when this volume fills up.
 
-Additionally, create the Coder service as a `ClusterIP`. In the next step,
-you will create an OpenShift route that points to the service HTTP target port.
+Additionally, create the Coder service as a `ClusterIP`. In the next step, you
+will create an OpenShift route that points to the service HTTP target port.
 
 ```yaml
 coder:
@@ -128,8 +130,8 @@ coder:
       readOnly: false
 ```
 
-> Note: OpenShift provides a Developer Catalog offering you can use to
-> install PostgreSQL into your cluster.
+> Note: OpenShift provides a Developer Catalog offering you can use to install
+> PostgreSQL into your cluster.
 
 ### 4. Create the OpenShift route
 
@@ -165,8 +167,8 @@ oc apply -f route.yaml
 
 ### 5. Install Coder
 
-You can now install Coder using the values you've set from the above steps. To do
-so, run the series of `helm` commands below:
+You can now install Coder using the values you've set from the above steps. To
+do so, run the series of `helm` commands below:
 
 ```console
 helm repo add coder-v2 https://helm.coder.com/v2
@@ -176,8 +178,8 @@ helm install coder coder-v2/coder \
   --values values.yaml
 ```
 
-> Note: If the Helm installation fails with a Kubernetes RBAC error, check the permissions
-> of your OpenShift user using the `oc auth can-i` command.
+> Note: If the Helm installation fails with a Kubernetes RBAC error, check the
+> permissions of your OpenShift user using the `oc auth can-i` command.
 >
 > The below permissions are the minimum required:
 >
@@ -212,9 +214,9 @@ helm install coder coder-v2/coder \
 
 ### 6. Create an OpenShift-compatible image
 
-While the deployment is spinning up, we will need to create some images that
-are compatible with OpenShift. These images can then be run without modifying
-the Security Context Constraints (SCCs) in OpenShift.
+While the deployment is spinning up, we will need to create some images that are
+compatible with OpenShift. These images can then be run without modifying the
+Security Context Constraints (SCCs) in OpenShift.
 
 1. Determine the UID range for the project:
 
@@ -230,15 +232,18 @@ the Security Context Constraints (SCCs) in OpenShift.
    }
    ```
 
-   Note the `uid-range` and `supplemental-groups`. In this case, the project `coder`
-   has been allocated 10,000 UIDs and GIDs, both starting at `1000680000`.
+   Note the `uid-range` and `supplemental-groups`. In this case, the project
+   `coder` has been allocated 10,000 UIDs and GIDs, both starting at
+   `1000680000`.
 
    In this example, we will pick both UID and GID `1000680000`.
 
 1. Create a `BuildConfig` referencing the source image you want to customize.
-   This will automatically kick off a `Build` that will remain pending until step 3.
+   This will automatically kick off a `Build` that will remain pending until
+   step 3.
 
-   > For more information, please consult the [OpenShift Documentation](https://docs.openshift.com/container-platform/4.12/cicd/builds/understanding-buildconfigs.html).
+   > For more information, please consult the
+   > [OpenShift Documentation](https://docs.openshift.com/container-platform/4.12/cicd/builds/understanding-buildconfigs.html).
 
    ```console
    oc create -f - <<EOF
@@ -289,8 +294,8 @@ the Security Context Constraints (SCCs) in OpenShift.
    oc create imagestream enterprise-base
    ```
 
-   The `Build` created in the previous step should now begin.
-   Once completed, you should see output similar to the following:
+   The `Build` created in the previous step should now begin. Once completed,
+   you should see output similar to the following:
 
    ```console
    oc get imagestreamtag
@@ -310,8 +315,8 @@ cd ./openshift-k8s
 Edit `main.tf` and update the following fields of the Kubernetes pod resource:
 
 - `spec.security_context`: remove this field.
-- `spec.container.image`: update this field to the newly built image hosted
-  on the OpenShift image registry from the previous step.
+- `spec.container.image`: update this field to the newly built image hosted on
+  the OpenShift image registry from the previous step.
 - `spec.container.security_context`: remove this field.
 
 Finally, create the template:
diff --git a/docs/install/packages.md b/docs/install/packages.md
index c17431c576191..bc4aca3aaca14 100644
--- a/docs/install/packages.md
+++ b/docs/install/packages.md
@@ -1,4 +1,5 @@
-1. Download and install one of the following system packages from [GitHub releases](https://github.com/coder/coder/releases/latest):
+1. Download and install one of the following system packages from
+   [GitHub releases](https://github.com/coder/coder/releases/latest):
 
    - .deb (Debian, Ubuntu)
    - .rpm (Fedora, CentOS, RHEL, SUSE)
@@ -17,9 +18,9 @@
    journalctl -u coder.service -b
    ```
 
-   > Set `CODER_ACCESS_URL` to the external URL that users and workspaces will use to
-   > connect to Coder. This is not required if you are using the tunnel. Learn more
-   > about Coder's [configuration options](../admin/configure.md).
+   > Set `CODER_ACCESS_URL` to the external URL that users and workspaces will
+   > use to connect to Coder. This is not required if you are using the tunnel.
+   > Learn more about Coder's [configuration options](../admin/configure.md).
 
 1. Visit the Coder URL in the logs to set up your first account, or use the CLI:
 
diff --git a/docs/install/uninstall.md b/docs/install/uninstall.md
index ae99930da8563..c6c5056f1e557 100644
--- a/docs/install/uninstall.md
+++ b/docs/install/uninstall.md
@@ -30,7 +30,8 @@ Alpine:
 sudo apk del coder
 ```
 
-If you installed Coder manually or used the install script on an unsupported operating system, you can remove the binary directly:
+If you installed Coder manually or used the install script on an unsupported
+operating system, you can remove the binary directly:
 
 ```console
 sudo rm /usr/local/bin/coder
@@ -45,9 +46,8 @@ sudo rm /etc/coder.d/coder.env
 ## Coder settings and the optional built-in PostgreSQL database
 
 > There is a `postgres` directory within the `coderv2` directory that has the
-> database engine and database. If you want to reuse the database, consider
-> not performing the following step or copying the directory to another
-> location.
+> database engine and database. If you want to reuse the database, consider not
+> performing the following step or copying the directory to another location.
 
 ### macOS
 
diff --git a/docs/install/windows.md b/docs/install/windows.md
index 86de80da7755a..d4eb53e6cf2d4 100644
--- a/docs/install/windows.md
+++ b/docs/install/windows.md
@@ -1,8 +1,12 @@
 # Windows
 
-Use the Windows installer to download the CLI and add Coder to `PATH`. Alternatively, you can install Coder on Windows via a [standalone binary](./binary.md).
+Use the Windows installer to download the CLI and add Coder to `PATH`.
+Alternatively, you can install Coder on Windows via a
+[standalone binary](./binary.md).
 
-1. Download the Windows installer from [GitHub releases](https://github.com/coder/coder/releases/latest) or from `winget`
+1. Download the Windows installer from
+   [GitHub releases](https://github.com/coder/coder/releases/latest) or from
+   `winget`
 
    ```powershell
     winget install Coder.Coder
@@ -22,9 +26,9 @@ Use the Windows installer to download the CLI and add Coder to `PATH`. Alternati
    coder server --postgres-url <url> --access-url <url>
    ```
 
-   > Set `CODER_ACCESS_URL` to the external URL that users and workspaces will use to
-   > connect to Coder. This is not required if you are using the tunnel. Learn more
-   > about Coder's [configuration options](../admin/configure.md).
+   > Set `CODER_ACCESS_URL` to the external URL that users and workspaces will
+   > use to connect to Coder. This is not required if you are using the tunnel.
+   > Learn more about Coder's [configuration options](../admin/configure.md).
 
 4. Visit the Coder URL in the logs to set up your first account, or use the CLI.
 
diff --git a/docs/manifest.json b/docs/manifest.json
index d6c59b477f053..7353f80931d75 100644
--- a/docs/manifest.json
+++ b/docs/manifest.json
@@ -31,6 +31,11 @@
           "description": "System packages for Debian, Ubuntu, Fedora, CentOS, RHEL, SUSE, and Alpine",
           "path": "./install/packages.md"
         },
+        {
+          "title": "macOS",
+          "description": "Install Coder using our Homebrew tap",
+          "path": "./install/macos.md"
+        },
         {
           "title": "Kubernetes",
           "description": "Install Coder with Kubernetes via Helm",
@@ -100,7 +105,7 @@
         {
           "title": "GCP",
           "description": "Set up Coder on a GCP Compute Engine VM",
-          "path": "./platforms/google-cloud-platform.md",
+          "path": "./platforms/gcp.md",
           "icon_path": "./images/google-cloud.svg"
         },
         {
@@ -134,55 +139,86 @@
     },
     {
       "title": "Templates",
-      "description": "Learn about templates, which define the infrastructure underlying workspaces",
+      "description": "Templates define the infrastructure for workspaces",
       "path": "./templates/index.md",
       "icon_path": "./images/icons/picture.svg",
       "children": [
         {
-          "title": "Resource Persistence",
-          "description": "Learn how resource persistence works in Coder",
-          "path": "./templates/resource-persistence.md",
-          "icon_path": "./images/icons/infinity.svg"
+          "title": "Working with templates",
+          "description": "Creating, editing, and updating templates",
+          "path": "./templates/creating.md"
         },
         {
-          "title": "Provider Authentication",
-          "description": "Learn how to authenticate the provisioner",
-          "path": "./templates/authentication.md",
-          "icon_path": "./images/icons/key.svg"
+          "title": "Your first template",
+          "description": "A tutorial for creating and editing your first template",
+          "path": "./templates/tutorial.md"
         },
         {
-          "title": "Change Management",
-          "description": "Learn how to source-control templates with git and CI",
-          "path": "./templates/change-management.md",
-          "icon_path": "./images/icons/git.svg"
+          "title": "Guided tour",
+          "description": "Create a template from scratch",
+          "path": "./templates/tour.md"
         },
         {
-          "title": "Resource Metadata",
-          "description": "Learn how to expose resource data to users",
-          "path": "./templates/resource-metadata.md",
-          "icon_path": "./images/icons/table-rows.svg"
-        },
-        {
-          "title": "Agent Metadata",
-          "description": "Learn how to expose live agent information to users",
-          "path": "./templates/agent-metadata.md",
-          "icon_path": "./images/icons/table-rows.svg"
+          "title": "Setting up templates",
+          "description": "Best practices for writing templates",
+          "path": "./templates/best-practices.md",
+          "children": [
+            {
+              "title": "Change management",
+              "description": "Versioning templates with git and CI",
+              "path": "./templates/change-management.md",
+              "icon_path": "./images/icons/git.svg"
+            },
+            {
+              "title": "Provider authentication",
+              "description": "Authenticate the provisioner",
+              "path": "./templates/authentication.md",
+              "icon_path": "./images/icons/key.svg"
+            },
+            {
+              "title": "Resource persistence",
+              "description": "How resource persistence works in Coder",
+              "path": "./templates/resource-persistence.md",
+              "icon_path": "./images/icons/infinity.svg"
+            },
+            {
+              "title": "Terraform modules",
+              "description": "Reuse code across Coder templates",
+              "path": "./templates/modules.md"
+            }
+          ]
         },
         {
-          "title": "Parameters",
-          "description": "Use parameters to customize templates",
-          "path": "./templates/parameters.md",
-          "icon_path": "./images/icons/code.svg"
+          "title": "Customizing templates",
+          "description": "Give information and options to workspace users",
+          "path": "./templates/customizing.md",
+          "children": [
+            {
+              "title": "Agent metadata",
+              "description": "Show operational metrics in the workspace",
+              "path": "./templates/agent-metadata.md"
+            },
+            {
+              "title": "Resource metadata",
+              "description": "Show information in the workspace about template resources",
+              "path": "./templates/resource-metadata.md"
+            },
+            {
+              "title": "Parameters",
+              "description": "Prompt the user for additional information about a workspace",
+              "path": "./templates/parameters.md"
+            }
+          ]
         },
         {
           "title": "Open in Coder",
-          "description": "Learn how to add an \"Open in Coder\" button to your repos",
+          "description": "Add an \"Open in Coder\" button to your repos",
           "path": "./templates/open-in-coder.md",
           "icon_path": "./images/icons/key.svg"
         },
         {
-          "title": "Docker in Workspaces",
-          "description": "Use docker inside containerized templates",
+          "title": "Docker in workspaces",
+          "description": "Use Docker inside containerized templates",
           "path": "./templates/docker-in-workspaces.md",
           "icon_path": "./images/icons/docker.svg"
         },
@@ -193,9 +229,20 @@
           "state": "alpha"
         },
         {
-          "title": "Terraform Modules",
-          "description": "Reuse code across Coder templates",
-          "path": "./templates/modules.md"
+          "title": "Troubleshooting templates",
+          "description": "Fix common template problems",
+          "path": "./templates/troubleshooting.md"
+        },
+        {
+          "title": "Process Logging",
+          "description": "Audit commands in workspaces with exectrace",
+          "path": "./templates/process-logging.md",
+          "state": "enterprise"
+        },
+        {
+          "title": "Icons",
+          "description": "Coder includes icons for popular cloud providers and programming languages for you to use",
+          "path": "./templates/icons.md"
         }
       ]
     },
@@ -297,9 +344,9 @@
           "icon_path": "./images/icons/toggle_on.svg"
         },
         {
-          "title": "Git Providers",
-          "description": "Learn how connect Coder with external git providers",
-          "path": "./admin/git-providers.md",
+          "title": "External Auth",
+          "description": "Learn how connect Coder with external auth providers",
+          "path": "./admin/external-auth.md",
           "icon_path": "./images/icons/git.svg"
         },
         {
@@ -321,7 +368,7 @@
           "icon_path": "./images/icons/scale.svg"
         },
         {
-          "title": "Provisioners",
+          "title": "External Provisioners",
           "description": "Run provisioners isolated from the Coder server",
           "path": "./admin/provisioners.md",
           "icon_path": "./images/icons/queue.svg",
@@ -379,6 +426,13 @@
           "description": "Learn what usage telemetry Coder collects",
           "path": "./admin/telemetry.md",
           "icon_path": "./images/icons/science.svg"
+        },
+        {
+          "title": "Database Encryption",
+          "description": "Learn how to encrypt sensitive data at rest in Coder",
+          "path": "./admin/encryption.md",
+          "icon_path": "./images/icons/lock.svg",
+          "state": "enterprise"
         }
       ]
     },
@@ -539,6 +593,16 @@
           "description": "Personalize your workspace by applying a canonical dotfiles repository",
           "path": "cli/dotfiles.md"
         },
+        {
+          "title": "external-auth",
+          "description": "Manage external authentication",
+          "path": "cli/external-auth.md"
+        },
+        {
+          "title": "external-auth access-token",
+          "description": "Print auth for an external provider",
+          "path": "cli/external-auth_access-token.md"
+        },
         {
           "title": "features",
           "description": "List Enterprise features",
@@ -688,6 +752,26 @@
           "description": "Create a new admin user with the given username, email and password and adds it to every organization.",
           "path": "cli/server_create-admin-user.md"
         },
+        {
+          "title": "server dbcrypt",
+          "description": "Manage database encryption.",
+          "path": "cli/server_dbcrypt.md"
+        },
+        {
+          "title": "server dbcrypt decrypt",
+          "description": "Decrypt a previously encrypted database.",
+          "path": "cli/server_dbcrypt_decrypt.md"
+        },
+        {
+          "title": "server dbcrypt delete",
+          "description": "Delete all encrypted data from the database. THIS IS A DESTRUCTIVE OPERATION.",
+          "path": "cli/server_dbcrypt_delete.md"
+        },
+        {
+          "title": "server dbcrypt rotate",
+          "description": "Rotate database encryption keys.",
+          "path": "cli/server_dbcrypt_rotate.md"
+        },
         {
           "title": "server postgres-builtin-serve",
           "description": "Run the built-in PostgreSQL deployment.",
@@ -763,6 +847,11 @@
           "description": "Manage templates",
           "path": "cli/templates.md"
         },
+        {
+          "title": "templates archive",
+          "description": "Archive unused or failed template versions from a given template(s)",
+          "path": "cli/templates_archive.md"
+        },
         {
           "title": "templates create",
           "description": "Create a template from the current directory or as specified by flag",
@@ -788,14 +877,9 @@
           "description": "List all the templates available for the organization",
           "path": "cli/templates_list.md"
         },
-        {
-          "title": "templates plan",
-          "description": "Plan a template push from the current directory",
-          "path": "cli/templates_plan.md"
-        },
         {
           "title": "templates pull",
-          "description": "Download the latest version of a template to a path.",
+          "description": "Download the active, latest, or specified version of a template to a path.",
           "path": "cli/templates_pull.md"
         },
         {
@@ -808,11 +892,21 @@
           "description": "Manage different versions of the specified template",
           "path": "cli/templates_versions.md"
         },
+        {
+          "title": "templates versions archive",
+          "description": "Archive a template version(s).",
+          "path": "cli/templates_versions_archive.md"
+        },
         {
           "title": "templates versions list",
           "description": "List all the versions of the specified template",
           "path": "cli/templates_versions_list.md"
         },
+        {
+          "title": "templates versions unarchive",
+          "description": "Unarchive a template version(s).",
+          "path": "cli/templates_versions_unarchive.md"
+        },
         {
           "title": "tokens",
           "description": "Manage personal access tokens",
@@ -852,6 +946,11 @@
           "title": "users create",
           "path": "cli/users_create.md"
         },
+        {
+          "title": "users delete",
+          "description": "Delete a user by username or user_id.",
+          "path": "cli/users_delete.md"
+        },
         {
           "title": "users list",
           "path": "cli/users_list.md"
diff --git a/docs/networking/index.md b/docs/networking/index.md
index c83d8289eb358..f5d94b10b70e6 100644
--- a/docs/networking/index.md
+++ b/docs/networking/index.md
@@ -1,29 +1,30 @@
 # Networking
 
-Coder's network topology has three types of nodes:
-workspaces, coder servers, and users.
+Coder's network topology has three types of nodes: workspaces, coder servers,
+and users.
 
 The coder server must have an inbound address reachable by users and workspaces,
 but otherwise, all topologies _just work_ with Coder.
 
 When possible, we establish direct connections between users and workspaces.
 Direct connections are as fast as connecting to the workspace outside of Coder.
-When NAT traversal fails, connections are relayed through the coder server.
-All user <-> workspace connections are end-to-end encrypted.
+When NAT traversal fails, connections are relayed through the coder server. All
+user <-> workspace connections are end-to-end encrypted.
 
 [Tailscale's open source](https://tailscale.com) backs our networking logic.
 
 ## coder server
 
-Workspaces connect to the coder server via the server's external address,
-set via [`ACCESS_URL`](../admin/configure.md#access-url). There must not be a
-NAT between workspaces and coder server.
+Workspaces connect to the coder server via the server's external address, set
+via [`ACCESS_URL`](../admin/configure.md#access-url). There must not be a NAT
+between workspaces and coder server.
 
 Users connect to the coder server's dashboard and API through its `ACCESS_URL`
 as well. There must not be a NAT between users and the coder server.
 
 Template admins can overwrite the site-wide access URL at the template level by
-leveraging the `url` argument when [defining the Coder provider](https://registry.terraform.io/providers/coder/coder/latest/docs#url):
+leveraging the `url` argument when
+[defining the Coder provider](https://registry.terraform.io/providers/coder/coder/latest/docs#url):
 
 ```terraform
 provider "coder" {
@@ -31,16 +32,17 @@ provider "coder" {
 }
 ```
 
-This is useful when debugging connectivity issues between the workspace agent and
-the Coder server.
+This is useful when debugging connectivity issues between the workspace agent
+and the Coder server.
 
 ## Web Apps
 
 The coder servers relays dashboard-initiated connections between the user and
-the workspace. Web terminal <-> workspace connections are an exception and may be direct.
+the workspace. Web terminal <-> workspace connections are an exception and may
+be direct.
 
-In general, [port forwarded](./port-forwarding.md) web apps are
-faster than dashboard-accessed web apps.
+In general, [port forwarded](./port-forwarding.md) web apps are faster than
+dashboard-accessed web apps.
 
 ## 🌎 Geo-distribution
 
@@ -50,16 +52,20 @@ Direct connections are a straight line between the user and workspace, so there
 is no special geo-distribution configuration. To speed up direct connections,
 move the user and workspace closer together.
 
-If a direct connection is not available (e.g. client or server is behind NAT), Coder
-will use a relayed connection. By default, [Coder uses Google's public STUN server](../cli/server.md#--derp-server-stun-addresses), but
-this can be disabled or changed for [offline deployments](../install/offline.md).
+If a direct connection is not available (e.g. client or server is behind NAT),
+Coder will use a relayed connection. By default,
+[Coder uses Google's public STUN server](../cli/server.md#--derp-server-stun-addresses),
+but this can be disabled or changed for
+[offline deployments](../install/offline.md).
 
 ### Relayed connections
 
-By default, your Coder server also runs a built-in DERP relay which can be used for both public and [offline deployments](../install/offline.md).
+By default, your Coder server also runs a built-in DERP relay which can be used
+for both public and [offline deployments](../install/offline.md).
 
 However, Tailscale has graciously allowed us to use
-[their global DERP relays](https://tailscale.com/kb/1118/custom-derp-servers/#what-are-derp-servers). You can launch `coder server` with Tailscale's DERPs like so:
+[their global DERP relays](https://tailscale.com/kb/1118/custom-derp-servers/#what-are-derp-servers).
+You can launch `coder server` with Tailscale's DERPs like so:
 
 ```bash
 $ coder server --derp-config-url https://controlplane.tailscale.com/derpmap/default
@@ -67,7 +73,9 @@ $ coder server --derp-config-url https://controlplane.tailscale.com/derpmap/defa
 
 #### Custom Relays
 
-If you want lower latency than what Tailscale offers or want additional DERP relays for offline deployments, you may run custom DERP servers. Refer to [Tailscale's documentation](https://tailscale.com/kb/1118/custom-derp-servers/#why-run-your-own-derp-server)
+If you want lower latency than what Tailscale offers or want additional DERP
+relays for offline deployments, you may run custom DERP servers. Refer to
+[Tailscale's documentation](https://tailscale.com/kb/1118/custom-derp-servers/#why-run-your-own-derp-server)
 to learn how to set them up.
 
 After you have custom DERP servers, you can launch Coder with them like so:
@@ -109,7 +117,8 @@ Some Coder deployments require that all access is through the browser to comply
 with security policies. In these cases, pass the `--browser-only` flag to
 `coder server` or set `CODER_BROWSER_ONLY=true`.
 
-With browser-only connections, developers can only connect to their workspaces via the web terminal and [web IDEs](../ides/web-ides.md).
+With browser-only connections, developers can only connect to their workspaces
+via the web terminal and [web IDEs](../ides/web-ides.md).
 
 ## Troubleshooting
 
@@ -128,8 +137,8 @@ pong from my-workspace proxied via DERP(Denver) in 90ms
 2023-06-21 17:50:22.504 [debu] wgengine: wg: [v2] Device closed
 ```
 
-The `coder speedtest <workspace>` command measures user <-> workspace throughput.
-E.g.:
+The `coder speedtest <workspace>` command measures user <-> workspace
+throughput. E.g.:
 
 ```
 $ coder speedtest dev
diff --git a/docs/networking/port-forwarding.md b/docs/networking/port-forwarding.md
index 9e8f075d5e06c..c4250d3acdddd 100644
--- a/docs/networking/port-forwarding.md
+++ b/docs/networking/port-forwarding.md
@@ -1,8 +1,8 @@
 # Port Forwarding
 
 Port forwarding lets developers securely access processes on their Coder
-workspace from a local machine. A common use case is testing web
-applications in a browser.
+workspace from a local machine. A common use case is testing web applications in
+a browser.
 
 There are three ways to forward ports in Coder:
 
@@ -10,13 +10,17 @@ There are three ways to forward ports in Coder:
 - Dashboard
 - SSH
 
-The `coder port-forward` command is generally more performant.
+The `coder port-forward` command is generally more performant than:
+
+1. The Dashboard which proxies traffic through the Coder control plane versus
+   peer-to-peer which is possible with the Coder CLI
+1. `sshd` which does double encryption of traffic with both Wireguard and SSH
 
 ## The `coder port-forward` command
 
-This command can be used to forward TCP or UDP ports from the remote
-workspace so they can be accessed locally. Both the TCP and UDP command
-line flags (`--tcp` and `--udp`) can be given once or multiple times.
+This command can be used to forward TCP or UDP ports from the remote workspace
+so they can be accessed locally. Both the TCP and UDP command line flags
+(`--tcp` and `--udp`) can be given once or multiple times.
 
 The supported syntax variations for the `--tcp` and `--udp` flag are:
 
@@ -33,8 +37,8 @@ Forward the remote TCP port `8080` to local port `8000`:
 coder port-forward myworkspace --tcp 8000:8080
 ```
 
-Forward the remote TCP port `3000` and all ports from `9990` to `9999`
-to their respective local ports.
+Forward the remote TCP port `3000` and all ports from `9990` to `9999` to their
+respective local ports.
 
 ```console
 coder port-forward myworkspace --tcp 3000,9990-9999
@@ -46,20 +50,27 @@ For more examples, see `coder port-forward --help`.
 
 > To enable port forwarding via the dashboard, Coder must be configured with a
 > [wildcard access URL](../admin/configure.md#wildcard-access-url). If an access
-> URL is not specified, Coder will create [a publicly accessible URL](../admin/configure.md#tunnel)
-> to reverse proxy the deployment, and port forwarding will work. There is a
-> known limitation where if the port forwarding URL length is greater than 63
-> characters, port forwarding will not work.
+> URL is not specified, Coder will create
+> [a publicly accessible URL](../admin/configure.md#tunnel) to reverse proxy the
+> deployment, and port forwarding will work. There is a known limitation where
+> if the port forwarding URL length is greater than 63 characters, port
+> forwarding will not work.
 
 ### From an arbitrary port
 
-One way to port forward in the dashboard is to use the "Port forward" button to specify an arbitrary port. Coder will also detect if processes are running, and will list them below the port picklist to click an open the running processes in the browser.
+One way to port forward in the dashboard is to use the "Port forward" button to
+specify an arbitrary port. Coder will also detect if processes are running, and
+will list them below the port picklist to click an open the running processes in
+the browser.
 
 ![Port forwarding in the UI](../images/port-forward-dashboard.png)
 
 ### From an coder_app resource
 
-Another way to port forward is to configure a `coder_app` resource in the workspace's template. This approach shows a visual application icon in the dashboard. See the following `coder_app` example for a Node React app and note the `subdomain` and `share` settings:
+Another way to port forward is to configure a `coder_app` resource in the
+workspace's template. This approach shows a visual application icon in the
+dashboard. See the following `coder_app` example for a Node React app and note
+the `subdomain` and `share` settings:
 
 ```hcl
 # node app
@@ -80,7 +91,9 @@ resource "coder_app" "node-react-app" {
 }
 ```
 
-Valid `share` values include `owner` - private to the user, `authenticated` - accessible by any user authenticated to the Coder deployment, and `public` - accessible by users outside of the Coder deployment.
+Valid `share` values include `owner` - private to the user, `authenticated` -
+accessible by any user authenticated to the Coder deployment, and `public` -
+accessible by users outside of the Coder deployment.
 
 ![Port forwarding from an app in the UI](../images/coderapp-port-forward.png)
 
@@ -100,7 +113,12 @@ must include credentials (set `credentials: "include"` if using `fetch`) or the
 requests cannot be authenticated and you will see an error resembling the
 following:
 
-> Access to fetch at 'https://coder.example.com/api/v2/applications/auth-redirect' from origin 'https://8000--dev--user--apps.coder.example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
+> Access to fetch at
+> 'https://coder.example.com/api/v2/applications/auth-redirect' from origin
+> 'https://8000--dev--user--apps.coder.example.com' has been blocked by CORS
+> policy: No 'Access-Control-Allow-Origin' header is present on the requested
+> resource. If an opaque response serves your needs, set the request's mode to
+> 'no-cors' to fetch the resource with CORS disabled.
 
 #### Headers
 
@@ -197,11 +215,12 @@ configurable by either admins or users.
 
 ## SSH
 
-First, [configure SSH](../ides.md#ssh-configuration) on your
-local machine. Then, use `ssh` to forward like so:
+First, [configure SSH](../ides.md#ssh-configuration) on your local machine.
+Then, use `ssh` to forward like so:
 
 ```console
 ssh -L 8080:localhost:8000 coder.myworkspace
 ```
 
-You can read more on SSH port forwarding [here](https://www.ssh.com/academy/ssh/tunneling/example).
+You can read more on SSH port forwarding
+[here](https://www.ssh.com/academy/ssh/tunneling/example).
diff --git a/docs/platforms/aws.md b/docs/platforms/aws.md
index c74f65b7b2a0d..6d7d6ef11dd43 100644
--- a/docs/platforms/aws.md
+++ b/docs/platforms/aws.md
@@ -1,6 +1,10 @@
 # Amazon Web Services
 
-This guide is designed to get you up and running with a Coder proof-of-concept VM on AWS EC2 using a [Coder-provided AMI](https://github.com/coder/packages). If you are familiar with EC2 however, you can use our [install script](../install/install.sh.md) to run Coder on any popular Linux distribution.
+This guide is designed to get you up and running with a Coder proof-of-concept
+VM on AWS EC2 using a [Coder-provided AMI](https://github.com/coder/packages).
+If you are familiar with EC2 however, you can use our
+[install script](../install/install.sh.md) to run Coder on any popular Linux
+distribution.
 
 ## Requirements
 
@@ -8,50 +12,72 @@ This guide assumes your AWS account has `AmazonEC2FullAccess` permissions.
 
 ## Launch a Coder instance from the from AWS Marketplace
 
-We publish an Ubuntu 22.04 AMI with Coder and Docker pre-installed. Search for `Coder` in the EC2 "Launch an Instance" screen or [launch directly from the marketplace](https://aws.amazon.com/marketplace/pp/prodview-5gxjyur2vc7rg).
+We publish an Ubuntu 22.04 AMI with Coder and Docker pre-installed. Search for
+`Coder` in the EC2 "Launch an Instance" screen or
+[launch directly from the marketplace](https://aws.amazon.com/marketplace/pp/prodview-5gxjyur2vc7rg).
 
 ![Coder on AWS Marketplace](../images/platforms/aws/marketplace.png)
 
-Be sure to keep the default firewall (SecurityGroup) options checked so you can connect over HTTP, HTTPS, and SSH.
+Be sure to keep the default firewall (SecurityGroup) options checked so you can
+connect over HTTP, HTTPS, and SSH.
 
 ![AWS Security Groups](../images/platforms/aws/security-groups.png)
 
-We recommend keeping the default instance type (`t2.xlarge`, 4 cores and 16 GB memory) if you plan on provisioning Docker containers as workspaces on this EC2 instance. Keep in mind this platforms is intended for proof-of-concept deployments and you should adjust your infrastructure when preparing for production use. See: [Scaling Coder](../admin/scale.md)
+We recommend keeping the default instance type (`t2.xlarge`, 4 cores and 16 GB
+memory) if you plan on provisioning Docker containers as workspaces on this EC2
+instance. Keep in mind this platforms is intended for proof-of-concept
+deployments and you should adjust your infrastructure when preparing for
+production use. See: [Scaling Coder](../admin/scale.md)
 
-Be sure to add a keypair so that you can connect over SSH to further [configure Coder](../admin/configure.md).
+Be sure to add a keypair so that you can connect over SSH to further
+[configure Coder](../admin/configure.md).
 
-After launching the instance, wait 30 seconds and navigate to the public IPv4 address. You should be redirected to a public tunnel URL.
+After launching the instance, wait 30 seconds and navigate to the public IPv4
+address. You should be redirected to a public tunnel URL.
 
 <video autoplay playsinline loop>
   <source src="https://github.com/coder/coder/blob/main/docs/images/platforms/aws/launch.mp4?raw=true" type="video/mp4">
 Your browser does not support the video tag.
 </video>
 
-That's all! Use the UI to create your first user, template, and workspace. We recommend starting with a Docker template since the instance has Docker pre-installed.
+That's all! Use the UI to create your first user, template, and workspace. We
+recommend starting with a Docker template since the instance has Docker
+pre-installed.
 
 ![Coder Workspace and IDE in AWS EC2](../images/platforms/aws/workspace.png)
 
 ## Configuring Coder server
 
-Coder is primarily configured by server-side flags and environment variables. Given you created or added key-pairs when launching the instance, you can [configure your Coder deployment](../admin/configure.md) by logging in via SSH or using the console:
+Coder is primarily configured by server-side flags and environment variables.
+Given you created or added key-pairs when launching the instance, you can
+[configure your Coder deployment](../admin/configure.md) by logging in via SSH
+or using the console:
 
-```sh
+```shell
 ssh ubuntu@<ec2-public-IPv4>
 sudo vim /etc/coder.d/coder.env # edit config
-sudo service coder restart # restart Coder
+sudo systemctl daemon-reload
+sudo systemctl restart coder # restart Coder
 ```
 
 ## Give developers EC2 workspaces (optional)
 
-Instead of running containers on the Coder instance, you can offer developers full EC2 instances with the [aws-linux](https://github.com/coder/coder/tree/main/examples/templates/aws-linux) template.
+Instead of running containers on the Coder instance, you can offer developers
+full EC2 instances with the
+[aws-linux](https://github.com/coder/coder/tree/main/examples/templates/aws-linux)
+template.
 
-Before you add the AWS template from the dashboard or CLI, you'll need to modify the instance IAM role.
+Before you add the AWS template from the dashboard or CLI, you'll need to modify
+the instance IAM role.
 
 ![Modify IAM role](../images/platforms/aws/modify-iam.png)
 
-You must create or select a role that has `EC2FullAccess` permissions or a limited [Coder-specific permissions policy](https://github.com/coder/coder/tree/main/examples/templates/aws-linux#required-permissions--policy).
+You must create or select a role that has `EC2FullAccess` permissions or a
+limited
+[Coder-specific permissions policy](https://github.com/coder/coder/tree/main/examples/templates/aws-linux#required-permissions--policy).
 
-From there, you can import the AWS starter template in the dashboard and begin creating VM-based workspaces.
+From there, you can import the AWS starter template in the dashboard and begin
+creating VM-based workspaces.
 
 ![Modify IAM role](../images/platforms/aws/aws-linux.png)
 
diff --git a/docs/platforms/azure.md b/docs/platforms/azure.md
index 318b1d8b4ceb2..72fab874d3322 100644
--- a/docs/platforms/azure.md
+++ b/docs/platforms/azure.md
@@ -9,23 +9,33 @@ This guide assumes you have full administrator privileges on Azure.
 
 ## Create An Azure VM
 
-From the Azure Portal, navigate to the Virtual Machines Dashboard. Click Create, and select creating a new Azure Virtual machine .
+From the Azure Portal, navigate to the Virtual Machines Dashboard. Click Create,
+and select creating a new Azure Virtual machine .
 
 <img src="../images/platforms/azure/azure1.jpg">
 
-This will bring you to the `Create a virtual machine` page. Select the subscription group of your choice, or create one if necessary.
+This will bring you to the `Create a virtual machine` page. Select the
+subscription group of your choice, or create one if necessary.
 
-Next, name the VM something relevant to this project using the naming convention of your choice. Change the region to something more appropriate for your current location. For this tutorial, we will use the base selection of the Ubuntu Gen2 Image and keep the rest of the base settings for this image the same.
+Next, name the VM something relevant to this project using the naming convention
+of your choice. Change the region to something more appropriate for your current
+location. For this tutorial, we will use the base selection of the Ubuntu Gen2
+Image and keep the rest of the base settings for this image the same.
 
 <img src="../images/platforms/azure/azure2.png">
 
 <img src="../images/platforms/azure/azure3.png">
 
-Up next, under `Inbound port rules` modify the Select `inbound ports` to also take in `HTTPS` and `HTTP`.
+Up next, under `Inbound port rules` modify the Select `inbound ports` to also
+take in `HTTPS` and `HTTP`.
 
 <img src="../images/platforms/azure/azure4.png">
 
-The set up for the image is complete at this stage. Click `Review and Create` - review the information and click `Create`. A popup will appear asking you to download the key pair for the server. Click `Download private key and create resource` and place it into a folder of your choice on your local system.
+The set up for the image is complete at this stage. Click `Review and Create` -
+review the information and click `Create`. A popup will appear asking you to
+download the key pair for the server. Click
+`Download private key and create resource` and place it into a folder of your
+choice on your local system.
 
 <img src="../images/platforms/azure/azure5.png">
 
@@ -33,74 +43,96 @@ Click `Return to create a virtual machine`. Your VM will start up!
 
 <img src="../images/platforms/azure/azure6.png">
 
-Click `Go to resource` in the virtual machine and copy the public IP address. You will need it to SSH into the virtual machine via your local machine.
+Click `Go to resource` in the virtual machine and copy the public IP address.
+You will need it to SSH into the virtual machine via your local machine.
 
-Follow [these instructions](https://learn.microsoft.com/en-us/azure/virtual-machines/linux-vm-connect?tabs=Linux) to SSH into the virtual machine. Once on the VM, you can run and install Coder using your method of choice. For the fastest install, we recommend running Coder as a system service.
+Follow
+[these instructions](https://learn.microsoft.com/en-us/azure/virtual-machines/linux-vm-connect?tabs=Linux)
+to SSH into the virtual machine. Once on the VM, you can run and install Coder
+using your method of choice. For the fastest install, we recommend running Coder
+as a system service.
 
 ## Install Coder
 
-For this instance, we will run Coder as a system service, however you can run Coder a multitude of different ways. You can learn more about those [here](https://coder.com/docs/coder-oss/latest/install).
+For this instance, we will run Coder as a system service, however you can run
+Coder a multitude of different ways. You can learn more about those
+[here](https://coder.com/docs/coder-oss/latest/install).
 
 In the Azure VM instance, run the following command to install Coder
 
-```console
-curl -fsSL <https://coder.com/install.sh> | sh
+```shell
+curl -fsSL https://coder.com/install.sh | sh
 ```
 
 ## Run Coder
 
 Run the following command to start Coder as a system level service:
 
-```console
- sudo systemctl enable --now coder
+```shell
+sudo systemctl enable --now coder
 ```
 
 The following command will get you information about the Coder launch service
 
-```console
- journalctl -u coder.service -b
+```shell
+journalctl -u coder.service -b
 ```
 
-This will return a series of logs related to running Coder as a system service. Embedded in the logs is the Coder Access URL.
+This will return a series of logs related to running Coder as a system service.
+Embedded in the logs is the Coder Access URL.
 
-Copy the URL and run the following command to create the first user, either on your local machine or in the instance terminal.
+Copy the URL and run the following command to create the first user, either on
+your local machine or in the instance terminal.
 
-```console
+```shell
 coder login <url***.try.coder.app>
 ```
 
-Fill out the prompts. Be sure to save use email and password as these are your admin username and password.
+Fill out the prompts. Be sure to save use email and password as these are your
+admin username and password.
 
-You can now access Coder on your local machine with the relevant `***.try.coder.app` URL and logging in with the username and password.
+You can now access Coder on your local machine with the relevant
+`***.try.coder.app` URL and logging in with the username and password.
 
 ## Creating and Uploading Your First Template
 
-First, run `coder template init` to create your first template. You’ll be given a list of possible templates to use. This tutorial will show you how to set up your Coder instance to create a Linux based machine on Azure.
+First, run `coder template init` to create your first template. You’ll be given
+a list of possible templates to use. This tutorial will show you how to set up
+your Coder instance to create a Linux based machine on Azure.
 
 <img src="../images/platforms/azure/azure9.png">
 
-Press `enter` to select `Develop in Linux on Azure` template. This will return the following:
+Press `enter` to select `Develop in Linux on Azure` template. This will return
+the following:
 
 <img src="../images/platforms/azure/azure10.png">
 
-To get started using the Azure template, install the Azure CLI by following the instructions [here](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux?pivots=apt). Run `az login` and follow the instructions to configure the Azure command line.
+To get started using the Azure template, install the Azure CLI by following the
+instructions
+[here](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux?pivots=apt).
+Run `az login` and follow the instructions to configure the Azure command line.
 
-Coder is running as a system service, which creates the system user `coder` for handling processes. The Coder user will require access to the Azure credentials to initialize the template.
+Coder is running as a system service, which creates the system user `coder` for
+handling processes. The Coder user will require access to the Azure credentials
+to initialize the template.
 
-Run the following commands to copy the Azure credentials and give the `coder` user access to them:
+Run the following commands to copy the Azure credentials and give the `coder`
+user access to them:
 
-```console
+```shell
 sudo cp -r ~/.azure /home/coder/.azure
 sudo chown -R coder:coder /home/coder/.azure/
 ```
 
-Navigate to the `./azure-linux` folder where you created your template and run the following command to put the template on your Coder instance.
+Navigate to the `./azure-linux` folder where you created your template and run
+the following command to put the template on your Coder instance.
 
-```console
+```shell
 coder templates create
 ```
 
-Congrats! You can now navigate to your Coder dashboard and use this Linux on Azure template to create a new workspace!
+Congrats! You can now navigate to your Coder dashboard and use this Linux on
+Azure template to create a new workspace!
 
 ## Next Steps
 
diff --git a/docs/platforms/docker.md b/docs/platforms/docker.md
index 2a33c678830ec..7784e455da570 100644
--- a/docs/platforms/docker.md
+++ b/docs/platforms/docker.md
@@ -6,8 +6,8 @@ Coder with Docker has the following advantages:
 - Workspace images are easily configured
 - Workspaces share resources for burst operations
 
-> Note that the below steps are only supported on a Linux distribution.
-> If on macOS, please [run Coder via the standalone binary](../install//binary.md).
+> Note that the below steps are only supported on a Linux distribution. If on
+> macOS, please [run Coder via the standalone binary](../install//binary.md).
 
 ## Requirements
 
@@ -29,18 +29,23 @@ Coder with Docker has the following advantages:
        ghcr.io/coder/coder:latest
    ```
 
-   > This will use Coder's tunnel and built-in database. See our [Docker documentation](../install/docker.md) for other configuration options such as running on localhost, using docker-compose, and external PostgreSQL.
+   > This will use Coder's tunnel and built-in database. See our
+   > [Docker documentation](../install/docker.md) for other configuration
+   > options such as running on localhost, using docker-compose, and external
+   > PostgreSQL.
 
-1. In new terminal, [install Coder](../install/) in order to connect to your deployment through the CLI.
+1. In new terminal, [install Coder](../install/) in order to connect to your
+   deployment through the CLI.
 
    ```console
    curl -L https://coder.com/install.sh | sh
    ```
 
-1. Run `coder login <access url>` and follow the
-   interactive instructions to create your user.
+1. Run `coder login <access url>` and follow the interactive instructions to
+   create your user.
 
-1. Pull the "Docker" example template using the interactive `coder templates init`:
+1. Pull the "Docker" example template using the interactive
+   `coder templates init`:
 
    ```console
    coder templates init
@@ -49,8 +54,7 @@ Coder with Docker has the following advantages:
 
 1. Push up the template with `coder templates create`
 
-1. Open the dashboard in your browser to create your
-   first workspace:
+1. Open the dashboard in your browser to create your first workspace:
 
    <img src="../images/platforms/docker/login.png">
 
@@ -74,18 +78,25 @@ Coder with Docker has the following advantages:
 
 You can use a remote Docker host in 2 ways.
 
-1. Over SSH. See [here](https://registry.terraform.io/providers/kreuzwerker/docker/latest/docs#remote-hosts) for details.
-2. Over TCP. See [here](https://registry.terraform.io/providers/kreuzwerker/docker/latest/docs#certificate-information) for details.
+1. Over SSH. See
+   [here](https://registry.terraform.io/providers/kreuzwerker/docker/latest/docs#remote-hosts)
+   for details.
+2. Over TCP. See
+   [here](https://registry.terraform.io/providers/kreuzwerker/docker/latest/docs#certificate-information)
+   for details.
 
 ## Troubleshooting
 
 ### Docker-based workspace is stuck in "Connecting..."
 
-Ensure you have an externally-reachable `CODER_ACCESS_URL` set. See [troubleshooting templates](../templates/index.md#Troubleshooting) for more steps.
+Ensure you have an externally-reachable `CODER_ACCESS_URL` set. See
+[troubleshooting templates](../templates/index.md#Troubleshooting) for more
+steps.
 
 ### Permission denied while trying to connect to the Docker daemon socket
 
-See Docker's official documentation to [Manage Docker as a non-root user](https://docs.docker.com/engine/install/linux-postinstall/#manage-docker-as-a-non-root-user).
+See Docker's official documentation to
+[Manage Docker as a non-root user](https://docs.docker.com/engine/install/linux-postinstall/#manage-docker-as-a-non-root-user).
 
 ## Next Steps
 
diff --git a/docs/platforms/gcp.md b/docs/platforms/gcp.md
new file mode 100644
index 0000000000000..630897fc79d6e
--- /dev/null
+++ b/docs/platforms/gcp.md
@@ -0,0 +1,78 @@
+# Google Cloud Platform
+
+In this guide, you will learn how to deploy the Coder control plane instance and
+your first template.
+
+## Requirements
+
+This guide assumes you have `roles/compute.instanceAdmin.v1` access to your
+Google Cloud Platform project.
+
+## Launch a Coder instance from the Google Cloud Marketplace
+
+We publish an Ubuntu 22.04 VM image with Coder and Docker pre-installed. Search
+for `Coder v2` in the GCP Marketplace or
+[use direct link](https://console.cloud.google.com/marketplace/product/coder-enterprise-market-public/coder-v2).
+
+![Coder on GCP Marketplace](../images/platforms/gcp/marketplace.png)
+
+Be sure to keep the default firewall options checked so you can connect over
+HTTP, HTTPS, and SSH.
+
+We recommend keeping the default instance type (`e2-standard-4`, 4 cores and 16
+GB memory) if you plan on provisioning Docker containers as workspaces on this
+VM instance. Keep in mind this platforms is intended for proof-of-concept
+deployments and you should adjust your infrastructure when preparing for
+production use. See: [Scaling Coder](../admin/scale.md)
+
+<video autoplay playsinline loop>
+  <source src="https://github.com/coder/coder/blob/main/docs/images/platforms/gcp/launch.mp4?raw=true" type="video/mp4">
+Your browser does not support the video tag.
+</video>
+
+Be sure to add a keypair so that you can connect over SSH to further
+[configure Coder](../admin/configure.md).
+
+After launching the instance, wait 30 seconds and navigate to the public IPv4
+address. You should be redirected to a public tunnel URL.
+
+![Coder on GCP Marketplace start](../images/platforms/gcp/start.png)
+
+That's all! Use the UI to create your first user, template, and workspace. We
+recommend starting with a Docker template since the instance has Docker
+pre-installed.
+
+![Coder Workspace and IDE in GCP VM](../images/platforms/aws/workspace.png)
+
+## Configuring Coder server
+
+Coder is primarily configured by server-side flags and environment variables.
+Given you created or added key-pairs when launching the instance, you can
+[configure your Coder deployment](../admin/configure.md) by logging in via SSH
+or using the console:
+
+```shell
+ssh ubuntu@<gcp-public-IPv4>
+sudo vim /etc/coder.d/coder.env # edit config
+sudo systemctl daemon-reload
+sudo systemctl restart coder # restart Coder
+```
+
+## Give developers VM workspaces (optional)
+
+Instead of running containers on the Coder instance, you can offer developers
+full VM instances with the
+[gcp-linux](https://github.com/coder/coder/tree/main/examples/templates/gcp-linux)
+template.
+
+Before you can use this template, you must authorize Coder to create VM
+instances in your GCP project. Follow the instructions in the
+[gcp-linux template README](https://github.com/coder/coder/tree/main/examples/templates/gcp-linux#authentication)
+to set up authentication.
+
+## Next Steps
+
+- [IDEs with Coder](../ides.md)
+- [Writing custom templates for Coder](../templates/index.md)
+- [Configure the Coder server](../admin/configure.md)
+- [Use your own domain + TLS](../admin/configure.md#tls--reverse-proxy)
diff --git a/docs/platforms/google-cloud-platform.md b/docs/platforms/google-cloud-platform.md
deleted file mode 100644
index 8f20820c65806..0000000000000
--- a/docs/platforms/google-cloud-platform.md
+++ /dev/null
@@ -1,114 +0,0 @@
-# Google Cloud Platform
-
-In this guide, you will learn how to deploy the Coder control plane instance and your first template.
-
-## Requirements
-
-This guide assumes you have `roles/compute.instanceAdmin.v1` access to your Google Cloud Platform project.
-
-## Setting Up your VM
-
-If this is the first time you’re creating a VM on this project, you will need to enable the `Compute Engine API`. On the Compute Engine API page, click `enable` and wait for the service to finish connecting.
-
-<img src="../images/platforms/google-cloud-platform/gcp0.png">
-
-This will pull up the `Create an Instance` page - name the instance something relevant to this project, following your naming convention of choice. In addition, select a region and zone that is close to your physical location. For this instance, we will use the base suggested image.
-
-<img src="../images/platforms/google-cloud-platform/gcp1.png">
-
-Under `Identity and API Access`, click `Allow full access to all Cloud APIs`. Scroll down to `Firewall` and click `Allow HTTPS traffic` and `Allow HTTP traffic`.
-
-<img src="../images/platforms/google-cloud-platform/gcp2.png">
-
-Scroll down to the bottom and click `Create` to create and deploy the VM.
-
-Congrats you’ve created your VM instance!
-
-## SSH-ing into the VM
-
-On the Compute Engine Dashboard, click on the VM for this project. Under `Details`, click `SSH` and select `Open in browser window`.
-
-<img src="../images/platforms/google-cloud-platform/gcp3.png">
-
-This will give you a terminal into the VM that we will use to install Coder.
-
-## Install Coder
-
-In the terminal, run the following command
-
-```console
-curl -fsSL https://coder.com/install.sh | sh
-```
-
-## Run Coder
-
-For this tutorial, we will run Coder as a `systemd` service. You can run Coder in [a multitude of different ways](https://coder.com/docs/coder-oss/latest/install).
-
-First, edit the `coder.env` file to enable `CODER_TUNNEL` by setting the value to true with the following command:
-
-```console
-sudo vim /etc/coder.d/coder.env
-```
-
-<img src="../images/platforms/google-cloud-platform/gcp4.png">
-
-Exit vim and run the following command to start Coder as a system service:
-
-```console
-sudo systemctl enable --now coder
-```
-
-The following command shows the Coder service's logs, including the Access URL. The Access URL will be used to access the Coder control plane.
-
-```console
-journalctl -u coder.service -b
-```
-
-<img src="../images/platforms/google-cloud-platform/gcp5.png">
-
-In this instance, Coder can be accessed at the URL `https://fcca2f3bfc9d2e3bf1b9feb50e723448.pit-1.try.coder.app`.
-
-Copy the URL and run the following command to create the workspace admin:
-
-```console
-coder login <url***.try.coder.app>
-```
-
-Fill out the prompts and be sure to save use email and password. This is your admin login. Now, you can now access Coder from your local machine by navigating to the `***.try.coder.app` URL and logging in with that same username and password.
-
-## Creating and Uploading your First Template
-
-First, run `coder template init` to create your first template. You’ll be given a list of prefabricated templates. This tutorial shows you how to create a Linux based template on GCP.
-
-<img src="../images/platforms/google-cloud-platform/gcp6.png">
-
-Select the `Develop in Linux on Google Cloud`, then `cd ./gcp-linux`.
-
-Run the following command:
-
-```console
-coder templates create
-```
-
-It will ask for your `project-id`, which you can find on the home page of your GCP Dashboard.
-
-Given it’s your first time setting up Coder, it may give an error that will look like the following:
-
-<img src="../images/platforms/google-cloud-platform/gcp7.png">
-
-In the error message will be a link. In this case, the URL is `https://console.developes.google.com/apis/api/iam.googles.com/overview:?project=1073148106645`. Copy the respective URL from your error message, and visit it via your browser. It may ask you to enable `Identity and Access Management (IAM) API`.
-
-Click `enable` and wait as the API initializes for your account.
-
-Once initialized, click create credentials in the upper right-hand corner. Select the `Compute Engine API` from the dropdown, and select `Application Data` under `What data will you be accessing?`. In addition, select `Yes, I’m using one or more` under `Are you planning on using this API with Compute Engine, Kubernetes Engine, App Engine, or Cloud Functions?`.
-
-<img src="../images/platforms/google-cloud-platform/gcp8.png">
-
-Back in your GCP terminal, run the `coder templates create` one more time.
-
-Congrats! You can now create new Linux-based workspaces that use Google Cloud Platform. Go onto your Coder dashboard, build your workspace, and get started coding!
-
-## Next Steps
-
-- [Learn more about template configuration](../templates/index.md)
-- [Configure more IDEs](../ides/web-ides.md)
diff --git a/docs/platforms/jfrog.md b/docs/platforms/jfrog.md
index 966d1472f6bd5..d25cd491be33f 100644
--- a/docs/platforms/jfrog.md
+++ b/docs/platforms/jfrog.md
@@ -1,24 +1,33 @@
 # JFrog
 
-Use Coder and JFrog together to secure your development environments without disturbing your developers' existing workflows.
+Use Coder and JFrog together to secure your development environments without
+disturbing your developers' existing workflows.
 
 This guide will demonstrate how to use JFrog Artifactory as a package registry
-within a workspace. We'll use Docker as the underlying compute. But, these concepts apply to any compute platform.
+within a workspace. We'll use Docker as the underlying compute. But, these
+concepts apply to any compute platform.
 
-The full example template can be found [here](https://github.com/coder/coder/tree/main/examples/templates/jfrog-docker).
+The full example template can be found
+[here](https://github.com/coder/coder/tree/main/examples/templates/jfrog/docker).
 
 ## Requirements
 
 - A JFrog Artifactory instance
 - An admin-level access token for Artifactory
-- 1:1 mapping of users in Coder to users in Artifactory by email address
-- An npm repository in Artifactory named "npm"
+- 1:1 mapping of users in Coder to users in Artifactory by email address and
+  username
+- Repositories configured in Artifactory for each package manager you want to
+  use
 
 <blockquote class="info">
 The admin-level access token is used to provision user tokens and is never exposed to
 developers or stored in workspaces.
 </blockquote>
 
+<blockquote class="info">
+You can skip the whole page and use [JFrog module](https://registry.coder.com/modules/jfrog) for easy JFrog Artifactory integration.
+</blockquote>
+
 ## Provisioner Authentication
 
 The most straight-forward way to authenticate your template with Artifactory is
@@ -40,14 +49,14 @@ terraform {
     }
     artifactory = {
       source  = "registry.terraform.io/jfrog/artifactory"
-      version = "6.22.3"
+      version = "~> 8.4.0"
     }
   }
 }
 
-variable "jfrog_url" {
+variable "jfrog_host" {
   type        = string
-  description = "The URL of the JFrog instance."
+  description = "JFrog instance hostname. e.g. YYY.jfrog.io"
 }
 
 variable "artifactory_access_token" {
@@ -57,15 +66,15 @@ variable "artifactory_access_token" {
 
 # Configure the Artifactory provider
 provider "artifactory" {
-  url           = "${var.jfrog_url}/artifactory"
+  url           = "https://${var.jfrog_host}/artifactory"
   access_token  = "${var.artifactory_access_token}"
 }
 ```
 
-When pushing the template, you can pass in the variables using the `-V` flag:
+When pushing the template, you can pass in the variables using the `--var` flag:
 
-```sh
-coder templates push --var 'jfrog_url=https://YYY.jfrog.io' --var 'artifactory_access_token=XXX'
+```shell
+coder templates push --var 'jfrog_host=YYY.jfrog.io' --var 'artifactory_access_token=XXX'
 ```
 
 ## Installing JFrog CLI
@@ -74,21 +83,40 @@ coder templates push --var 'jfrog_url=https://YYY.jfrog.io' --var 'artifactory_a
 we'll focus on its ability to configure package managers, as that's the relevant
 functionality for most developers.
 
-The generic method of installing the JFrog CLI is the following command:
+Most users should be able to install `jf` by running the following command:
 
-```sh
+```shell
 curl -fL https://install-cli.jfrog.io | sh
 ```
 
 Other methods are listed [here](https://jfrog.com/getcli/).
 
-In our Docker-based example, we install `jf` by adding these lines to our `Dockerfile`:
+In our Docker-based example, we install `jf` by adding these lines to our
+`Dockerfile`:
 
 ```Dockerfile
 RUN curl -fL https://install-cli.jfrog.io | sh && chmod 755 $(which jf)
 ```
 
-and use this `coder_agent` block:
+## Configuring Coder workspace to use JFrog Artifactory repositories
+
+Create a `locals` block to store the Artifactory repository keys for each
+package manager you want to use in your workspace. For example, if you want to
+use artifactory repositories with keys `npm`, `pypi`, and `go`, you can create a
+`locals` block like this:
+
+```hcl
+locals {
+  artifactory_repository_keys = {
+    npm    = "npm"
+    python = "pypi"
+    go     = "go"
+  }
+}
+```
+
+To automatically configure `jf` CLI and Artifactory repositories for each user,
+add the following lines to your `startup_script` in the `coder_agent` block:
 
 ```hcl
 resource "coder_agent" "main" {
@@ -107,24 +135,43 @@ resource "coder_agent" "main" {
     export CI=true
 
     jf c rm 0 || true
-    echo ${artifactory_access_token.me.access_token} | \
-      jf c add --access-token-stdin --url ${var.jfrog_url} 0
+    echo ${artifactory_scoped_token.me.access_token} | \
+      jf c add --access-token-stdin --url https://${var.jfrog_host} 0
+
+    # Configure the `npm` CLI to use the Artifactory "npm" repository.
+    cat << EOF > ~/.npmrc
+    email = ${data.coder_workspace.me.owner_email}
+    registry = https://${var.jfrog_host}/artifactory/api/npm/${local.artifactory_repository_keys["npm"]}
+    EOF
+    jf rt curl /api/npm/auth >> .npmrc
+
+    # Configure the `pip` to use the Artifactory "python" repository.
+    mkdir -p ~/.pip
+    cat << EOF > ~/.pip/pip.conf
+    [global]
+    index-url = https://${local.artifactory_username}:${artifactory_scoped_token.me.access_token}@${var.jfrog_host}/artifactory/api/pypi/${local.artifactory_repository_keys["python"]}/simple
+    EOF
+
   EOT
+  # Set GOPROXY to use the Artifactory "go" repository.
+  env = {
+    GOPROXY : "https://${local.artifactory_username}:${artifactory_scoped_token.me.access_token}@${var.jfrog_host}/artifactory/api/go/${local.artifactory_repository_keys["go"]}"
+  }
 }
 ```
 
-You can verify that `jf` is configured correctly in your workspace by
-running `jf c show`. It should display output like:
+You can verify that `jf` is configured correctly in your workspace by running
+`jf c show`. It should display output like:
 
 ```text
 coder@jf:~$ jf c show
 Server ID:                      0
-JFrog Platform URL:             https://cdr.jfrog.io/
-Artifactory URL:                https://cdr.jfrog.io/artifactory/
-Distribution URL:               https://cdr.jfrog.io/distribution/
-Xray URL:                       https://cdr.jfrog.io/xray/
-Mission Control URL:            https://cdr.jfrog.io/mc/
-Pipelines URL:                  https://cdr.jfrog.io/pipelines/
+JFrog Platform URL:             https://YYY.jfrog.io/
+Artifactory URL:                https://YYY.jfrog.io/artifactory/
+Distribution URL:               https://YYY.jfrog.io/distribution/
+Xray URL:                       https://YYY.jfrog.io/xray/
+Mission Control URL:            https://YYY.jfrog.io/mc/
+Pipelines URL:                  https://YYY.jfrog.io/pipelines/
 User:                           ammar@....com
 Access token:                   ...
 Default:                        true
@@ -132,16 +179,16 @@ Default:                        true
 
 ## Installing the JFrog VS Code Extension
 
-You can install the JFrog VS Code extension into workspaces automatically
-by inserting the following lines into your `startup_script`:
+You can install the JFrog VS Code extension into workspaces by inserting the
+following lines into your `startup_script`:
 
-```sh
-  # Install the JFrog VS Code extension.
-  # Find the latest version number at
-  # https://open-vsx.org/extension/JFrog/jfrog-vscode-extension.
-  JFROG_EXT_VERSION=2.4.1
-  curl -o /tmp/jfrog.vsix -L "https://open-vsx.org/api/JFrog/jfrog-vscode-extension/$JFROG_EXT_VERSION/file/JFrog.jfrog-vscode-extension-$JFROG_EXT_VERSION.vsix"
-  /tmp/code-server/bin/code-server --install-extension /tmp/jfrog.vsix
+```shell
+# Install the JFrog VS Code extension.
+# Find the latest version number at
+# https://open-vsx.org/extension/JFrog/jfrog-vscode-extension.
+JFROG_EXT_VERSION=2.4.1
+curl -o /tmp/jfrog.vsix -L "https://open-vsx.org/api/JFrog/jfrog-vscode-extension/$JFROG_EXT_VERSION/file/JFrog.jfrog-vscode-extension-$JFROG_EXT_VERSION.vsix"
+/tmp/code-server/bin/code-server --install-extension /tmp/jfrog.vsix
 ```
 
 Note that this method will only work if your developers use code-server.
@@ -151,24 +198,59 @@ Note that this method will only work if your developers use code-server.
 Add the following line to your `startup_script` to configure `npm` to use
 Artifactory:
 
-```sh
+```shell
     # Configure the `npm` CLI to use the Artifactory "npm" registry.
     cat << EOF > ~/.npmrc
     email = ${data.coder_workspace.me.owner_email}
-    registry=${var.jfrog_url}/artifactory/api/npm/npm/
+    registry = https://${var.jfrog_host}/artifactory/api/npm/npm/
     EOF
     jf rt curl /api/npm/auth >> .npmrc
 ```
 
 Now, your developers can run `npm install`, `npm audit`, etc. and transparently
 use Artifactory as the package registry. You can verify that `npm` is configured
-correctly by running `npm install --loglevel=http react` and checking that
-npm is only hitting your Artifactory URL.
+correctly by running `npm install --loglevel=http react` and checking that npm
+is only hitting your Artifactory URL.
+
+## Configuring pip
+
+Add the following lines to your `startup_script` to configure `pip` to use
+Artifactory:
+
+```shell
+    mkdir -p ~/.pip
+    cat << EOF > ~/.pip/pip.conf
+    [global]
+    index-url = https://${data.coder_workspace.me.owner}:${artifactory_scoped_token.me.access_token}@${var.jfrog_host}/artifactory/api/pypi/pypi/simple
+    EOF
+```
+
+Now, your developers can run `pip install` and transparently use Artifactory as
+the package registry. You can verify that `pip` is configured correctly by
+running `pip install --verbose requests` and checking that pip is only hitting
+your Artifactory URL.
+
+## Configuring Go
+
+Add the following environment variable to your `coder_agent` block to configure
+`go` to use Artifactory:
+
+```hcl
+  env = {
+    GOPROXY : "https://${data.coder_workspace.me.owner}:${artifactory_scoped_token.me.access_token}@${var.jfrog_host}/artifactory/api/go/go"
+  }
+```
 
-You can apply the same concepts to Docker, Go, Maven, and other package managers
-supported by Artifactory.
+You can apply the same concepts to Docker, Maven, and other package managers
+supported by Artifactory. See the
+[JFrog documentation](https://jfrog.com/help/r/jfrog-artifactory-documentation/package-management)
+for more information.
 
 ## More reading
 
-- See the full example template [here](https://github.com/coder/coder/tree/main/examples/templates/jfrog-docker).
-- To serve extensions from your own VS Code Marketplace, check out [code-marketplace](https://github.com/coder/code-marketplace#artifactory-storage).
+- See the full example template
+  [here](https://github.com/coder/coder/tree/main/examples/templates/jfrog/docker).
+- To serve extensions from your own VS Code Marketplace, check out
+  [code-marketplace](https://github.com/coder/code-marketplace#artifactory-storage).
+- To store templates in Artifactory, check out our
+  [Artifactory modules](../templates/modules.md#artifactory) docs.
diff --git a/docs/platforms/kubernetes/additional-clusters.md b/docs/platforms/kubernetes/additional-clusters.md
index 47a193ad9abb8..b8a25e5cc6cd7 100644
--- a/docs/platforms/kubernetes/additional-clusters.md
+++ b/docs/platforms/kubernetes/additional-clusters.md
@@ -1,15 +1,19 @@
 # Additional clusters
 
-With Coder, you can deploy workspaces in additional Kubernetes clusters using different [authentication methods](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs#authentication) in the Terraform provider.
+With Coder, you can deploy workspaces in additional Kubernetes clusters using
+different
+[authentication methods](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs#authentication)
+in the Terraform provider.
 
 ![Region picker in "Create Workspace" screen](../../images/platforms/kubernetes/region-picker.png)
 
 ## Option 1) Kubernetes contexts and kubeconfig
 
-First, create a kubeconfig file with [multiple contexts](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/).
+First, create a kubeconfig file with
+[multiple contexts](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/).
 
-```sh
-$ kubectl config get-contexts
+```shell
+kubectl config get-contexts
 
 CURRENT   NAME                        CLUSTER
           workspaces-europe-west2-c   workspaces-europe-west2-c
@@ -20,9 +24,10 @@ CURRENT   NAME                        CLUSTER
 
 If you deployed Coder on Kubernetes, you can attach a kubeconfig as a secret.
 
-This assumes Coder is deployed on the `coder` namespace and your kubeconfig file is in ~/.kube/config.
+This assumes Coder is deployed on the `coder` namespace and your kubeconfig file
+is in ~/.kube/config.
 
-```sh
+```shell
 kubectl create secret generic kubeconfig-secret -n coder --from-file=~/.kube/config
 ```
 
@@ -41,15 +46,20 @@ coder:
       readOnly: true
 ```
 
-[Upgrade Coder](../../install/kubernetes.md#upgrading-coder-via-helm) with these new values.
+[Upgrade Coder](../../install/kubernetes.md#upgrading-coder-via-helm) with these
+new values.
 
 ### VM control plane
 
-If you deployed Coder on a VM, copy the kubeconfig file to `/home/coder/.kube/config`.
+If you deployed Coder on a VM, copy the kubeconfig file to
+`/home/coder/.kube/config`.
 
 ### Create a Coder template
 
-You can start from our [example template](https://github.com/coder/coder/tree/main/examples/templates/kubernetes). From there, add [template parameters](../../templates/parameters.md) to allow developers to pick their desired cluster.
+You can start from our
+[example template](https://github.com/coder/coder/tree/main/examples/templates/kubernetes).
+From there, add [template parameters](../../templates/parameters.md) to allow
+developers to pick their desired cluster.
 
 ```hcl
 # main.tf
@@ -79,22 +89,28 @@ provider "kubernetes" {
 
 ## Option 2) Kubernetes ServiceAccounts
 
-Alternatively, you can authenticate with remote clusters with ServiceAccount tokens. Coder can store these secrets on your behalf with [managed Terraform variables](../../templates/parameters.md#managed-terraform-variables).
+Alternatively, you can authenticate with remote clusters with ServiceAccount
+tokens. Coder can store these secrets on your behalf with
+[managed Terraform variables](../../templates/parameters.md#managed-terraform-variables).
 
-Alternatively, these could also be fetched from Kubernetes secrets or even [Hashicorp Vault](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/data-sources/generic_secret).
+Alternatively, these could also be fetched from Kubernetes secrets or even
+[Hashicorp Vault](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/data-sources/generic_secret).
 
-This guide assumes you have a `coder-workspaces` namespace on your remote cluster. Change the namespace accordingly.
+This guide assumes you have a `coder-workspaces` namespace on your remote
+cluster. Change the namespace accordingly.
 
 ### Create a ServiceAccount
 
-Run this command against your remote cluster to create a ServiceAccount, Role, RoleBinding, and token:
+Run this command against your remote cluster to create a ServiceAccount, Role,
+RoleBinding, and token:
 
-```sh
+```shell
 kubectl apply -n coder-workspaces -f - <<EOF
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: coder
+  # Must be different than the Coder control plane service account, so prevent duplicates.
+  name: coder-2
 ---
 apiVersion: v1
 kind: Secret
@@ -107,7 +123,8 @@ type: kubernetes.io/service-account-token
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: coder
+  # Must be different than the Coder control plane service account, so prevent duplicates.
+  name: coder-2
 rules:
   - apiGroups: ["", "apps", "networking.k8s.io"] # "" indicates the core API group
     resources: ["persistentvolumeclaims", "pods", "deployments", "services", "secrets", "pods/exec","pods/log", "events", "networkpolicies", "serviceaccounts"]
@@ -119,7 +136,8 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: coder
+  # Must be different than the Coder control plane service account, so prevent duplicates.
+  name: coder-2
 subjects:
   - kind: ServiceAccount
     name: coder
@@ -141,7 +159,8 @@ rolebinding.rbac.authorization.k8s.io/coder created
 
 ### 2. Modify the Kubernetes template
 
-You can start from our [example template](https://github.com/coder/coder/tree/main/examples/templates/kubernetes).
+You can start from our
+[example template](https://github.com/coder/coder/tree/main/examples/templates/kubernetes).
 
 ```hcl
 variable "host" {
@@ -172,20 +191,21 @@ provider "kubernetes" {
 
 ### Create Coder template with managed variables
 
-Fetch the values from the secret and pass them to Coder. This should work on macOS and Linux.
+Fetch the values from the secret and pass them to Coder. This should work on
+macOS and Linux.
 
 To get the cluster address:
 
-```sh
-$ kubectl cluster-info
+```shell
+kubectl cluster-info
 Kubernetes control plane is running at https://example.domain:6443
 
-$ export CLUSTER_ADDRESS=https://example.domain:6443
+export CLUSTER_ADDRESS=https://example.domain:6443
 ```
 
 To fetch the CA certificate and token:
 
-```sh
+```shell
 export CLUSTER_CA_CERTIFICATE=$(kubectl get secrets coder-service-account-token -n coder-workspaces -o jsonpath="{.data.ca\.crt}")
 
 export CLUSTER_SERVICEACCOUNT_TOKEN=$(kubectl get secrets coder-service-account-token -n coder-workspaces -o jsonpath="{.data.token}")
@@ -193,7 +213,7 @@ export CLUSTER_SERVICEACCOUNT_TOKEN=$(kubectl get secrets coder-service-account-
 
 Create the template with these values:
 
-```sh
+```shell
 coder templates create \
     --variable host=$CLUSTER_ADDRESS \
     --variable cluster_ca_certificate=$CLUSTER_CA_CERTIFICATE \
@@ -201,9 +221,10 @@ coder templates create \
     --variable namespace=coder-workspaces
 ```
 
-If you're on a Windows machine (or if one of the commands fail), try grabbing the values manually:
+If you're on a Windows machine (or if one of the commands fail), try grabbing
+the values manually:
 
-```sh
+```shell
 # Get cluster API address
 kubectl cluster-info
 
diff --git a/docs/platforms/kubernetes/deployment-logs.md b/docs/platforms/kubernetes/deployment-logs.md
index d420cec49f74e..14d8abd170832 100644
--- a/docs/platforms/kubernetes/deployment-logs.md
+++ b/docs/platforms/kubernetes/deployment-logs.md
@@ -1,13 +1,22 @@
 # Kubernetes event logs
 
-To stream Kubernetes events into your workspace startup logs, you can use Coder's [`coder-logstream-kube`](https://github.com/coder/coder-logstream-kube) tool. `coder-logstream-kube` provides useful information about the workspace pod or deployment, such as:
+To stream Kubernetes events into your workspace startup logs, you can use
+Coder's [`coder-logstream-kube`](https://github.com/coder/coder-logstream-kube)
+tool. `coder-logstream-kube` provides useful information about the workspace pod
+or deployment, such as:
 
 - Causes of pod provisioning failures, or why a pod is stuck in a pending state.
 - Visibility into when pods are OOMKilled, or when they are evicted.
 
 ## Prerequisites
 
-`coder-logstream-kube` works best with the [`kubernetes_deployment`](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/deployment) Terraform resource, which requires the `coder` service account to have permission to create deployments. For example, if you use [Helm](https://coder.com/docs/v2/latest/install/kubernetes#install-coder-with-helm) to install Coder, you should set `coder.serviceAccount.enableDeployments=true` in your `values.yaml`
+`coder-logstream-kube` works best with the
+[`kubernetes_deployment`](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/deployment)
+Terraform resource, which requires the `coder` service account to have
+permission to create deployments. For example, if you use
+[Helm](../../install/kubernetes.md#install-coder-with-helm) to install Coder,
+you should set `coder.serviceAccount.enableDeployments=true` in your
+`values.yaml`
 
 ```diff
 coder:
@@ -19,11 +28,13 @@ serviceAccount:
     name: coder
 ```
 
-> Note: This is only required for Coder versions < 0.28.0, as this will be the default value for Coder versions >= 0.28.0
+> Note: This is only required for Coder versions < 0.28.0, as this will be the
+> default value for Coder versions >= 0.28.0
 
 ## Installation
 
-Install the `coder-kubestream-logs` helm chart on the cluster where the deployment is running.
+Install the `coder-kubestream-logs` helm chart on the cluster where the
+deployment is running.
 
 ```shell
 helm repo add coder-logstream-kube https://helm.coder.com/logstream-kube
@@ -34,7 +45,8 @@ helm install coder-logstream-kube coder-logstream-kube/coder-logstream-kube \
 
 ## Example logs
 
-Here is an example of the logs you can expect to see in the workspace startup logs:
+Here is an example of the logs you can expect to see in the workspace startup
+logs:
 
 ### Normal pod deployment
 
@@ -54,6 +66,13 @@ Here is an example of the logs you can expect to see in the workspace startup lo
 
 ## How it works
 
-Kubernetes provides an [informers](https://pkg.go.dev/k8s.io/client-go/informers) API that streams pod and event data from the API server.
+Kubernetes provides an
+[informers](https://pkg.go.dev/k8s.io/client-go/informers) API that streams pod
+and event data from the API server.
 
-coder-logstream-kube listens for pod creation events with containers that have the CODER_AGENT_TOKEN environment variable set. All pod events are streamed as logs to the Coder API using the agent token for authentication. For more details, see the [coder-logstream-kube](https://github.com/coder/coder-logstream-kube) repository.
+coder-logstream-kube listens for pod creation events with containers that have
+the CODER_AGENT_TOKEN environment variable set. All pod events are streamed as
+logs to the Coder API using the agent token for authentication. For more
+details, see the
+[coder-logstream-kube](https://github.com/coder/coder-logstream-kube)
+repository.
diff --git a/docs/platforms/kubernetes/index.md b/docs/platforms/kubernetes/index.md
index d52d10e4cddb8..9ad7dfd61879c 100644
--- a/docs/platforms/kubernetes/index.md
+++ b/docs/platforms/kubernetes/index.md
@@ -4,10 +4,12 @@ Coder's control plane and/or workspaces can be deployed on Kubernetes.
 
 ## Installation
 
-Refer to our [Helm install docs](../../install/kubernetes.md) to deploy Coder on Kubernetes. The default helm values will provision the following:
+Refer to our [Helm install docs](../../install/kubernetes.md) to deploy Coder on
+Kubernetes. The default helm values will provision the following:
 
 - Coder control plane (as a `Deployment`)
-- ServiceAccount + Role + RoleBinding to provision pods + PVCS in the current namespace (used for Kubernetes workspaces)
+- ServiceAccount + Role + RoleBinding to provision pods + PVCS in the current
+  namespace (used for Kubernetes workspaces)
 - LoadBalancer to access control plane
 
 ## Kubernetes templates
@@ -18,9 +20,11 @@ From the dashboard, import the Kubernetes starter template:
 
 In the next screen, set the following template variables:
 
-- `use_kubeconfig`: `false` (The ServiceAccount will authorize Coder to create pods on your cluster)
+- `use_kubeconfig`: `false` (The ServiceAccount will authorize Coder to create
+  pods on your cluster)
 - `namespace`: `coder` (or whatever namespace you deployed Coder on)
 
 ![Variables for Kubernetes template](../../images/platforms/kubernetes/template-variables.png)
 
-> If you deployed Coder on another platform besides Kubernetes, you can set `use_kubeconfig: true` for Coder to read the config from your VM, for example.
+> If you deployed Coder on another platform besides Kubernetes, you can set
+> `use_kubeconfig: true` for Coder to read the config from your VM, for example.
diff --git a/docs/platforms/other.md b/docs/platforms/other.md
index 7cccea0968eb3..a01654cec04e4 100644
--- a/docs/platforms/other.md
+++ b/docs/platforms/other.md
@@ -1,6 +1,9 @@
 # Other platforms
 
-Coder is highly extensible and is not limited to the platforms outlined in these docs. The control plane can be provisioned on any VM or container compute, and workspaces can include any Terraform resource. See our [architecture diagram](../about/architecture.md) for more details.
+Coder is highly extensible and is not limited to the platforms outlined in these
+docs. The control plane can be provisioned on any VM or container compute, and
+workspaces can include any Terraform resource. See our
+[architecture diagram](../about/architecture.md) for more details.
 
 The following resources may help as you're deploying Coder.
 
diff --git a/docs/secrets.md b/docs/secrets.md
index 791fab5f1123d..c6057f146a190 100644
--- a/docs/secrets.md
+++ b/docs/secrets.md
@@ -9,26 +9,26 @@ Coder is open-minded about how you get your secrets into your workspaces.
 
 ## Wait a minute...
 
-Your first stab at secrets with Coder should be your local method.
-You can do everything you can locally and more with your Coder workspace, so
-whatever workflow and tools you already use to manage secrets may be brought
-over.
+Your first stab at secrets with Coder should be your local method. You can do
+everything you can locally and more with your Coder workspace, so whatever
+workflow and tools you already use to manage secrets may be brought over.
 
 Often, this workflow is simply:
 
 1. Give your users their secrets in advance
-1. Your users write them to a persistent file after
-   they've built their workspace
+1. Your users write them to a persistent file after they've built their
+   workspace
 
-[Template parameters](./templates/parameters.md) are a dangerous way to accept secrets.
-We show parameters in cleartext around the product. Assume anyone with view
-access to a workspace can also see its parameters.
+[Template parameters](./templates/parameters.md) are a dangerous way to accept
+secrets. We show parameters in cleartext around the product. Assume anyone with
+view access to a workspace can also see its parameters.
 
 ## SSH Keys
 
-Coder generates SSH key pairs for each user. This can be used as an authentication mechanism for
-git providers or other tools. Within workspaces, git will attempt to use this key within workspaces
-via the `$GIT_SSH_COMMAND` environment variable.
+Coder generates SSH key pairs for each user. This can be used as an
+authentication mechanism for git providers or other tools. Within workspaces,
+git will attempt to use this key within workspaces via the `$GIT_SSH_COMMAND`
+environment variable.
 
 Users can view their public key in their account settings:
 
@@ -40,8 +40,8 @@ Users can view their public key in their account settings:
 ## Dynamic Secrets
 
 Dynamic secrets are attached to the workspace lifecycle and automatically
-injected into the workspace. With a little bit of up front template work,
-they make life simpler for both the end user and the security team.
+injected into the workspace. With a little bit of up front template work, they
+make life simpler for both the end user and the security team.
 
 This method is limited to
 [services with Terraform providers](https://registry.terraform.io/browse/providers),
@@ -64,14 +64,17 @@ resource "coder_agent" "main" {
 }
 ```
 
-A catch-all variation of this approach is dynamically provisioning a cloud service account (e.g [GCP](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_key#private_key))
-for each workspace and then making the relevant secrets available via the cloud's secret management
-system.
+A catch-all variation of this approach is dynamically provisioning a cloud
+service account (e.g
+[GCP](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_service_account_key#private_key))
+for each workspace and then making the relevant secrets available via the
+cloud's secret management system.
 
 ## Displaying Secrets
 
 While you can inject secrets into the workspace via environment variables, you
-can also show them in the Workspace UI with [`coder_metadata`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/metadata).
+can also show them in the Workspace UI with
+[`coder_metadata`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/metadata).
 
 ![secret UI](./images/secret-metadata-ui.png)
 
diff --git a/docs/security/0001_user_apikeys_invalidation.md b/docs/security/0001_user_apikeys_invalidation.md
index e47a5a89d72ba..c6f8fde3bd371 100644
--- a/docs/security/0001_user_apikeys_invalidation.md
+++ b/docs/security/0001_user_apikeys_invalidation.md
@@ -4,31 +4,47 @@
 
 ## Summary
 
-Coder identified an issue in [https://github.com/coder/coder](https://github.com/coder/coder) where API tokens belonging to a deleted user were not invalidated. A deleted user in possession of a valid and non-expired API token is still able to use the above token with their full suite of capabilities.
+Coder identified an issue in
+[https://github.com/coder/coder](https://github.com/coder/coder) where API
+tokens belonging to a deleted user were not invalidated. A deleted user in
+possession of a valid and non-expired API token is still able to use the above
+token with their full suite of capabilities.
 
 ## Impact: HIGH
 
-If exploited, an attacker could perform any action that the deleted user was authorized to perform.
+If exploited, an attacker could perform any action that the deleted user was
+authorized to perform.
 
 ## Exploitability: HIGH
 
-The CLI writes the API key to `~/.coderv2/session` by default, so any deleted user who previously logged in via the Coder CLI has the potential to exploit this. Note that there is a time window for exploitation; API tokens have a maximum lifetime after which they are no longer valid.
+The CLI writes the API key to `~/.coderv2/session` by default, so any deleted
+user who previously logged in via the Coder CLI has the potential to exploit
+this. Note that there is a time window for exploitation; API tokens have a
+maximum lifetime after which they are no longer valid.
 
-The issue only affects users who were active (not suspended) at the time they were deleted. Users who were first suspended and later deleted cannot exploit this issue.
+The issue only affects users who were active (not suspended) at the time they
+were deleted. Users who were first suspended and later deleted cannot exploit
+this issue.
 
 ## Affected Versions
 
 All versions of Coder between v0.8.15 and v0.22.2 (inclusive) are affected.
 
-All customers are advised to upgrade to [v0.23.0](https://github.com/coder/coder/releases/tag/v0.23.0) as soon as possible.
+All customers are advised to upgrade to
+[v0.23.0](https://github.com/coder/coder/releases/tag/v0.23.0) as soon as
+possible.
 
 ## Details
 
-Coder incorrectly failed to invalidate API keys belonging to a user when they were deleted. When authenticating a user via their API key, Coder incorrectly failed to check whether the API key corresponds to a deleted user.
+Coder incorrectly failed to invalidate API keys belonging to a user when they
+were deleted. When authenticating a user via their API key, Coder incorrectly
+failed to check whether the API key corresponds to a deleted user.
 
 ## Indications of Compromise
 
-> 💡 Automated remediation steps in the upgrade purge all affected API keys. Either perform the following query before upgrade or run it on a backup of your database from before the upgrade.
+> 💡 Automated remediation steps in the upgrade purge all affected API keys.
+> Either perform the following query before upgrade or run it on a backup of
+> your database from before the upgrade.
 
 Execute the following SQL query:
 
@@ -65,4 +81,7 @@ Otherwise, the following information will be reported:
 - User API key ID
 - Time the affected API key was last used
 
-> 💡 If your license includes the [Audit Logs](https://coder.com/docs/v2/latest/admin/audit-logs#filtering-logs) feature, you can then query all actions performed by the above users by using the filter `email:$USER_EMAIL`.
+> 💡 If your license includes the
+> [Audit Logs](https://coder.com/docs/v2/latest/admin/audit-logs#filtering-logs)
+> feature, you can then query all actions performed by the above users by using
+> the filter `email:$USER_EMAIL`.
diff --git a/docs/security/index.md b/docs/security/index.md
index 76d2d069e657e..1193f572dab75 100644
--- a/docs/security/index.md
+++ b/docs/security/index.md
@@ -1,12 +1,17 @@
 # Security Advisories
 
-> If you discover a vulnerability in Coder, please do not hesitate to report it to us by following the instructions [here](https://github.com/coder/coder/blob/main/SECURITY.md).
+> If you discover a vulnerability in Coder, please do not hesitate to report it
+> to us by following the instructions
+> [here](https://github.com/coder/coder/blob/main/SECURITY.md).
 
-From time to time, Coder employees or other community members may discover vulnerabilities in the product.
+From time to time, Coder employees or other community members may discover
+vulnerabilities in the product.
 
-If a vulnerability requires an immediate upgrade to mitigate a potential security risk, we will add it to the below table.
+If a vulnerability requires an immediate upgrade to mitigate a potential
+security risk, we will add it to the below table.
 
-Click on the description links to view more details about each specific vulnerability.
+Click on the description links to view more details about each specific
+vulnerability.
 
 ---
 
diff --git a/docs/templates/README.md b/docs/templates/README.md
index fc338650b8ef6..9df47f3d8db0f 100644
--- a/docs/templates/README.md
+++ b/docs/templates/README.md
@@ -16,13 +16,13 @@ individuals can start their own Coder deployments.
 From your local machine, download the CLI for your operating system from the
 [releases](https://github.com/coder/coder/releases/latest) or run:
 
-```console
+```shell
 curl -fsSL https://coder.com/install.sh | sh
 ```
 
 To see the sub-commands for managing templates, run:
 
-```console
+```shell
 coder templates --help
 ```
 
@@ -31,7 +31,7 @@ coder templates --help
 Before you can create templates, you must first login to your Coder deployment
 with the CLI.
 
-```console
+```shell
 coder login https://coder.example.com # aka the URL to your coder instance
 ```
 
@@ -41,7 +41,7 @@ returning an API Key.
 > Make a note of the API Key. You can re-use the API Key in future CLI logins or
 > sessions.
 
-```console
+```shell
 coder --token <your-api-key> login https://coder.example.com/ # aka the URL to your coder instance
 ```
 
@@ -49,7 +49,7 @@ coder --token <your-api-key> login https://coder.example.com/ # aka the URL to y
 
 Before users can create workspaces, you'll need at least one template in Coder.
 
-```sh
+```shell
 # create a local directory to store templates
 mkdir -p $HOME/coder/templates
 cd $HOME/coder/templates
@@ -74,7 +74,7 @@ coder templates create <template-name>
 To control cost, specify a maximum time to live flag for a template in hours or
 minutes.
 
-```sh
+```shell
 coder templates create my-template --default-ttl 4h
 ```
 
@@ -232,7 +232,7 @@ Alternatively, if you're willing to wait for longer start times from Coder, you
 can set the `imagePullPolicy` to `Always` in your Terraform template; when set,
 Coder will check `image:tag` on every build and update if necessary:
 
-```tf
+```hcl
 resource "kubernetes_pod" "podName" {
     spec {
         container {
@@ -254,7 +254,7 @@ Using the UI, navigate to the template page, click on the menu, and select "Edit
 Using the CLI, login to Coder and run the following command to edit a single
 template:
 
-```console
+```shell
 coder templates edit <template-name> --description "This is my template"
 ```
 
@@ -263,20 +263,20 @@ Review editable template properties by running `coder templates edit -h`.
 Alternatively, you can pull down the template as a tape archive (`.tar`) to your
 current directory:
 
-```console
+```shell
 coder templates pull <template-name> file.tar
 ```
 
 Then, extract it by running:
 
-```sh
+```shell
 tar -xf file.tar
 ```
 
 Make the changes to your template then run this command from the root of the
 template folder:
 
-```console
+```shell
 coder templates push <template-name>
 ```
 
@@ -292,7 +292,7 @@ have any running workspaces associated to it.
 Using the CLI, login to Coder and run the following command to delete a
 template:
 
-```console
+```shell
 coder templates delete <template-name>
 ```
 
@@ -329,7 +329,7 @@ sets a few environment variables based on the username and email address of the
 workspace's owner, so that you can make Git commits immediately without any
 manual configuration:
 
-```tf
+```hcl
 resource "coder_agent" "main" {
   # ...
   env = {
@@ -370,7 +370,7 @@ practices:
   - The Coder agent logs are typically stored in `/tmp/coder-agent.log`
   - The Coder agent startup script logs are typically stored in `/tmp/coder-startup-script.log`
   - The Coder agent shutdown script logs are typically stored in `/tmp/coder-shutdown-script.log`
-- This can also happen if the websockets are not being forwarded correctly when running Coder behind a reverse proxy. [Read our reverse-proxy docs](https://coder.com/docs/v2/latest/admin/configure#tls--reverse-proxy)
+- This can also happen if the websockets are not being forwarded correctly when running Coder behind a reverse proxy. [Read our reverse-proxy docs](../admin/configure.md#tls--reverse-proxy)
 
 ### Agent does not become ready
 
diff --git a/docs/templates/agent-metadata.md b/docs/templates/agent-metadata.md
index 34a8c19a76760..52d01d769e65a 100644
--- a/docs/templates/agent-metadata.md
+++ b/docs/templates/agent-metadata.md
@@ -1,20 +1,24 @@
-# Agent Metadata
+# Agent metadata
 
 ![agent-metadata](../images/agent-metadata.png)
 
-With Agent Metadata, template admins can expose operational metrics from
-their workspaces to their users. It is the dynamic complement of [Resource Metadata](./resource-metadata.md).
+You can show live operational metrics to workspace users with agent metadata. It
+is the dynamic complement of [resource metadata](./resource-metadata.md).
 
-See the [Terraform reference](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#metadata).
+You specify agent metadata in the
+[`coder_agent`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent).
 
 ## Examples
 
-All of these examples use [heredoc strings](https://developer.hashicorp.com/terraform/language/expressions/strings#heredoc-strings) for the script declaration. With heredoc strings, you
-can script without messy escape codes, just as if you were working in your terminal.
+All of these examples use
+[heredoc strings](https://developer.hashicorp.com/terraform/language/expressions/strings#heredoc-strings)
+for the script declaration. With heredoc strings, you can script without messy
+escape codes, just as if you were working in your terminal.
 
-Some of the below examples use the [`coder stat`](../cli/stat.md) command.
-This is useful for determining CPU/memory usage inside a container, which
-can be tricky otherwise.
+Some of the examples use the [`coder stat`](../cli/stat.md) command. This is
+useful for determining CPU and memory usage of the VM or container that the
+workspace is running in, which is more accurate than resource usage about the
+workspace's host.
 
 Here's a standard set of metadata snippets for Linux agents:
 
@@ -82,11 +86,13 @@ resource "coder_agent" "main" {
 }
 ```
 
-## Utilities
+## Useful utilities
 
-[top](https://linux.die.net/man/1/top) is available in most Linux
-distributions and provides virtual memory, CPU and IO statistics. Running `top`
-produces output that looks like:
+You can also show agent metadata for information about the workspace's host.
+
+[top](https://manpages.ubuntu.com/manpages/jammy/en/man1/top.1.html) is
+available in most Linux distributions and provides virtual memory, CPU and IO
+statistics. Running `top` produces output that looks like:
 
 ```text
 %Cpu(s): 65.8 us,  4.4 sy,  0.0 ni, 29.3 id,  0.3 wa,  0.0 hi,  0.2 si,  0.0 st
@@ -94,9 +100,9 @@ MiB Mem :  16009.0 total,    493.7 free,   4624.8 used,  10890.5 buff/cache
 MiB Swap:      0.0 total,      0.0 free,      0.0 used.  11021.3 avail Mem
 ```
 
-[vmstat](https://linux.die.net/man/8/vmstat) is available in most Linux
-distributions and provides virtual memory, CPU and IO statistics. Running `vmstat`
-produces output that looks like:
+[vmstat](https://manpages.ubuntu.com/manpages/jammy/en/man8/vmstat.8.html) is
+available in most Linux distributions and provides virtual memory, CPU and IO
+statistics. Running `vmstat` produces output that looks like:
 
 ```text
 procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
@@ -104,10 +110,10 @@ r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
 0  0  19580 4781680 12133692 217646944    0    2     4    32    1    0  1  1 98  0  0
 ```
 
-[dstat](https://linux.die.net/man/1/dstat) is considerably more parseable
-than `vmstat` but often not included in base images. It is easily installed by
-most package managers under the name `dstat`. The output of running `dstat 1 1` looks
-like:
+[dstat](https://manpages.ubuntu.com/manpages/jammy/man1/dstat.1.html) is
+considerably more parseable than `vmstat` but often not included in base images.
+It is easily installed by most package managers under the name `dstat`. The
+output of running `dstat 1 1` looks like:
 
 ```text
 --total-cpu-usage-- -dsk/total- -net/total- ---paging-- ---system--
@@ -115,9 +121,9 @@ usr sys idl wai stl| read  writ| recv  send|  in   out | int   csw
 1   1  98   0   0|3422k   25M|   0     0 | 153k  904k| 123k  174k
 ```
 
-## DB Write Load
+## Managing the database load
 
-Agent metadata can generate a significant write load and overwhelm your
+Agent metadata can generate a significant write load and overwhelm your Coder
 database if you're not careful. The approximate writes per second can be
 calculated using the formula:
 
@@ -131,7 +137,12 @@ For example, let's say you have
 - each with 6 metadata snippets
 - with an average interval of 4 seconds
 
-You can expect `(10 * 6 * 2) / 4` or 30 writes per second.
+You can expect `(10 * 6 * 2) / 4`, or 30 writes per second.
+
+One of the writes is to the `UNLOGGED` `workspace_agent_metadata` table and the
+other to the `NOTIFY` query that enables live stats streaming in the UI.
+
+## Next Steps
 
-One of the writes is to the `UNLOGGED` `workspace_agent_metadata` table and
-the other to the `NOTIFY` query that enables live stats streaming in the UI.
+- [Resource metadata](./resource-metadata.md)
+- [Parameters](./parameters.md)
diff --git a/docs/templates/authentication.md b/docs/templates/authentication.md
index 4f25be1711b74..770aeb3179927 100644
--- a/docs/templates/authentication.md
+++ b/docs/templates/authentication.md
@@ -7,28 +7,42 @@
   </p>
 </blockquote>
 
-Coder's provisioner process needs to authenticate with cloud provider APIs to provision
-workspaces. You can either pass credentials to the provisioner as parameters or execute Coder
-in an environment that is authenticated with the cloud provider.
+The Coder server's
+[provisioner](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/provisioner)
+process needs to authenticate with other provider APIs to provision workspaces.
+There are two approaches to do this:
 
-We encourage the latter where supported. This approach simplifies the template, keeps cloud
-provider credentials out of Coder's database (making it a less valuable target for attackers),
-and is compatible with agent-based authentication schemes (that handle credential rotation
-and/or ensure the credentials are not written to disk).
+- Pass credentials to the provisioner as parameters.
+- Preferred: Execute the Coder server in an environment that is authenticated
+  with the provider.
 
-Cloud providers for which the Terraform provider supports authenticated environments include
+We encourage the latter approach where supported:
+
+- Simplifies the template.
+- Keeps provider credentials out of Coder's database, making it a less valuable
+  target for attackers.
+- Compatible with agent-based authentication schemes, which handle credential
+  rotation or ensure the credentials are not written to disk.
+
+Generally, you can set up an environment to provide credentials to Coder in
+these ways:
+
+- A well-known location on disk. For example, `~/.aws/credentials` for AWS on
+  POSIX systems.
+- Environment variables.
+
+It is usually sufficient to authenticate using the CLI or SDK for the provider
+before running Coder, but check the Terraform provider's documentation for
+details.
+
+These platforms have Terraform providers that support authenticated
+environments:
 
 - [Google Cloud](https://registry.terraform.io/providers/hashicorp/google/latest/docs)
 - [Amazon Web Services](https://registry.terraform.io/providers/hashicorp/aws/latest/docs)
 - [Microsoft Azure](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs)
 - [Kubernetes](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs)
 
-Additional providers may be supported; check the
-[documentation of the Terraform provider](https://registry.terraform.io/browse/providers) for
-details.
-
-The way these generally work is via the credentials being available to Coder either in some
-well-known location on disk (e.g. `~/.aws/credentials` for AWS on posix systems), or via
-environment variables. It is usually sufficient to authenticate using the CLI or SDK for the
-cloud provider before running Coder for this to work, but check the Terraform provider
-documentation for details.
+Other providers might also support authenticated environments. Check the
+[documentation of the Terraform provider](https://registry.terraform.io/browse/providers)
+for details.
diff --git a/docs/templates/best-practices.md b/docs/templates/best-practices.md
new file mode 100644
index 0000000000000..71aed19447d39
--- /dev/null
+++ b/docs/templates/best-practices.md
@@ -0,0 +1,7 @@
+# Template best practices
+
+We recommend a few ways to manage workspace resources, authentication, and
+versioning.
+
+<children>
+</children>
diff --git a/docs/templates/change-management.md b/docs/templates/change-management.md
index a1add78ec64f8..fe995070ce780 100644
--- a/docs/templates/change-management.md
+++ b/docs/templates/change-management.md
@@ -1,6 +1,7 @@
 # Template Change Management
 
-We recommend source controlling your templates as you would other code. [Install Coder](../install/) in CI/CD pipelines to push new template versions.
+We recommend source-controlling your templates as you would other code. You can
+[install Coder](../install/) in CI/CD pipelines to push new template versions.
 
 ```console
 # Install the Coder CLI
@@ -25,7 +26,7 @@ coder templates push --yes $CODER_TEMPLATE_NAME \
     --name=$CODER_TEMPLATE_VERSION # Version name is optional
 ```
 
-> Looking for an example? See how we push our development image
-> and template [via GitHub actions](https://github.com/coder/coder/blob/main/.github/workflows/dogfood.yaml).
-
-> To cap token lifetime on creation, [configure Coder server to set a shorter max token lifetime](../cli/server.md#--max-token-lifetime)
+To cap token lifetime on creation,
+[configure Coder server to set a shorter max token lifetime](../cli/server.md#--max-token-lifetime).
+For an example, see how we push our development image and template
+[with GitHub actions](https://github.com/coder/coder/blob/main/.github/workflows/dogfood.yaml).
diff --git a/docs/templates/creating.md b/docs/templates/creating.md
new file mode 100644
index 0000000000000..7ebbafac2c084
--- /dev/null
+++ b/docs/templates/creating.md
@@ -0,0 +1,94 @@
+# Working with templates
+
+You create and edit Coder templates as [Terraform](./tour.md) configuration
+files (`.tf`) and any supporting files, like a README or configuration files for
+other services.
+
+## Who creates templates?
+
+The [Template Admin](../admin/users.md) role (and above) can create templates.
+End users, like developers, create workspaces from them.
+
+Templates can also be [managed with git](./change-management.md), allowing any
+developer to propose changes to a template.
+
+You can give different users and groups access to templates with
+[role-based access control](../admin/rbac.md).
+
+## Starter templates
+
+We provide starter templates for common cloud providers, like AWS, and
+orchestrators, like Kubernetes. From there, you can modify them to use your own
+images, VPC, cloud credentials, and so on. Coder supports all Terraform
+resources and properties, so fear not if your favorite cloud provider isn't
+here!
+
+![Starter templates](../images/templates/starter-templates.png)
+
+If you prefer to use Coder on the [command line](../cli.md), use
+`coder templates init`.
+
+> Coder starter templates are also available on our
+> [GitHub repo](https://github.com/coder/coder/tree/main/examples/templates).
+
+## Community Templates
+
+As well as Coder's starter templates, you can see a list of community templates
+by our users
+[here](https://github.com/coder/coder/blob/main/examples/templates/community-templates.md).
+
+## Editing templates
+
+Our starter templates are meant to be modified for your use cases. You can edit
+any template's files directly in the Coder dashboard.
+
+![Editing a template](../images/templates/choosing-edit-template.gif)
+
+If you'd prefer to use the CLI, use `coder templates pull`, edit the template
+files, then `coder templates push`.
+
+> Even if you are a Terraform expert, we suggest reading our
+> [guided tour](./tour.md).
+
+## Updating templates
+
+Coder tracks a template's versions, keeping all developer workspaces up-to-date.
+When you publish a new version, developers are notified to get the latest
+infrastructure, software, or security patches. Learn more about
+[change management](./change-management.md).
+
+![Updating a template](../images/templates/update.png)
+
+## Delete templates
+
+You can delete a template using both the coder CLI and UI. Only
+[template admins and owners](../admin/users.md) can delete a template, and the
+template must not have any running workspaces associated to it.
+
+In the UI, navigate to the template you want to delete, and select the dropdown
+in the right-hand corner of the page to delete the template.
+
+![delete-template](../images/delete-template.png)
+
+Using the CLI, login to Coder and run the following command to delete a
+template:
+
+```shell
+coder templates delete <template-name>
+```
+
+### Delete workspaces
+
+When a workspace is deleted, the Coder server essentially runs a
+[terraform destroy](https://www.terraform.io/cli/commands/destroy) to remove all
+resources associated with the workspace.
+
+> Terraform's
+> [prevent-destroy](https://www.terraform.io/language/meta-arguments/lifecycle#prevent_destroy)
+> and
+> [ignore-changes](https://www.terraform.io/language/meta-arguments/lifecycle#ignore_changes)
+> meta-arguments can be used to prevent accidental data loss.
+
+## Next steps
+
+- [Your first template](./tutorial.md)
diff --git a/docs/templates/customizing.md b/docs/templates/customizing.md
new file mode 100644
index 0000000000000..16a951243371c
--- /dev/null
+++ b/docs/templates/customizing.md
@@ -0,0 +1,6 @@
+# Customizing templates
+
+You can give developers more information and control over their workspaces:
+
+<children>
+</children>
diff --git a/docs/templates/devcontainers.md b/docs/templates/devcontainers.md
index 3a92e79a90843..d8b0417ac1149 100644
--- a/docs/templates/devcontainers.md
+++ b/docs/templates/devcontainers.md
@@ -1,20 +1,32 @@
 # Devcontainers (alpha)
 
-[Devcontainers](https://containers.dev) are an open source specification for defining development environments. [envbuilder](https://github.com/coder/envbuilder) is an open source project by Coder that runs devcontainers via Coder templates and your underlying infrastructure.
+[Devcontainers](https://containers.dev) are an open source specification for
+defining development environments.
 
-There are several benefits to adding a devcontainer-compatible template to Coder:
+[envbuilder](https://github.com/coder/envbuilder) is an open source project by
+Coder that runs devcontainers via Coder templates and your underlying
+infrastructure. It can run on Docker or Kubernetes.
 
-- Drop-in migration from Codespaces (or any existing repositories that use devcontainers)
-- Easier to start projects from Coder (new workspace, pick starter devcontainer)
-- Developer teams can "bring their own image." No need for platform teams to manage complex images, registries, and CI pipelines.
+There are several benefits to adding a devcontainer-compatible template to
+Coder:
 
-## How it works
+- Drop-in migration from Codespaces (or any existing repositories that use
+  devcontainers)
+- Easier to start projects from Coder. Just create a new workspace then pick a
+  starter devcontainer.
+- Developer teams can "bring their own image." No need for platform teams to
+  manage complex images, registries, and CI pipelines.
 
-- Coder admins add a devcontainer-compatible template to Coder (envbuilder can run on Docker or Kubernetes)
+## How it works
 
-- Developers enter their repository URL as a [parameter](./parameters.md) when they create their workspace. [envbuilder](https://github.com/coder/envbuilder) clones the repo and builds a container from the `devcontainer.json` specified in the repo.
+A Coder admin adds a devcontainer-compatible template to Coder (envbuilder).
+Then developers enter their repository URL as a [parameter](./parameters.md)
+when they create their workspace.
+[envbuilder](https://github.com/coder/envbuilder) clones the repo and builds a
+container from the `devcontainer.json` specified in the repo.
 
-- Developers can edit the `devcontainer.json` in their workspace to rebuild to iterate on their development environments.
+Developers can edit the `devcontainer.json` in their workspace to rebuild to
+iterate on their development environments.
 
 ## Example templates
 
@@ -23,16 +35,24 @@ There are several benefits to adding a devcontainer-compatible template to Coder
 
 ![Devcontainer parameter screen](../images/templates/devcontainers.png)
 
-[Parameters](./parameters.md) can be used to prompt the user for a repo URL when they are creating a workspace.
+Your template can prompt the user for a repo URL with
+[Parameters](./parameters.md).
 
 ## Authentication
 
-You may need to authenticate to your container registry (e.g. Artifactory) or git provider (e.g. GitLab) to use envbuilder. Refer to the [envbuilder documentation](https://github.com/coder/envbuilder/) for more information.
+You may need to authenticate to your container registry, such as Artifactory, or
+git provider such as GitLab, to use envbuilder. See the
+[envbuilder documentation](https://github.com/coder/envbuilder/) for more
+information.
 
 ## Caching
 
-To improve build times, devcontainers can be cached. Refer to the [envbuilder documentation](https://github.com/coder/envbuilder/) for more information.
+To improve build times, devcontainers can be cached. Refer to the
+[envbuilder documentation](https://github.com/coder/envbuilder/) for more
+information.
 
 ## Other features & known issues
 
-Envbuilder is still under active development. Refer to the [envbuilder GitHub repo](https://github.com/coder/envbuilder/) for more information and to submit feature requests.
+Envbuilder is still under active development. Refer to the
+[envbuilder GitHub repo](https://github.com/coder/envbuilder/) for more
+information and to submit feature requests.
diff --git a/docs/templates/docker-in-workspaces.md b/docs/templates/docker-in-workspaces.md
index c0e0cf9bc351a..9388450ae7b4c 100644
--- a/docs/templates/docker-in-workspaces.md
+++ b/docs/templates/docker-in-workspaces.md
@@ -4,18 +4,24 @@ There are a few ways to run Docker within container-based Coder workspaces.
 
 | Method                                                     | Description                                                                                                                                                        | Limitations                                                                                                                                                                                                                                        |
 | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [Sysbox container runtime](#sysbox-container-runtime)      | Install the sysbox runtime on your Kubernetes nodes for secure docker-in-docker and systemd-in-docker. Works with GKE, EKS, AKS.                                   | Requires [compatible nodes](https://github.com/nestybox/sysbox#host-requirements). Max of 16 sysbox pods per node. [See all](https://github.com/nestybox/sysbox/blob/master/docs/user-guide/limitations.md)                                        |
+| [Sysbox container runtime](#sysbox-container-runtime)      | Install the sysbox runtime on your Kubernetes nodes for secure docker-in-docker and systemd-in-docker. Works with GKE, EKS, AKS.                                   | Requires [compatible nodes](https://github.com/nestybox/sysbox#host-requirements). [Limitations](https://github.com/nestybox/sysbox/blob/master/docs/user-guide/limitations.md)                                                                    |
 | [Envbox](#envbox)                                          | A container image with all the packages necessary to run an inner sysbox container. Removes the need to setup sysbox-runc on your nodes. Works with GKE, EKS, AKS. | Requires running the outer container as privileged (the inner container that acts as the workspace is locked down). Requires compatible [nodes](https://github.com/nestybox/sysbox/blob/master/docs/distro-compat.md#sysbox-distro-compatibility). |
 | [Rootless Podman](#rootless-podman)                        | Run podman inside Coder workspaces. Does not require a custom runtime or privileged containers. Works with GKE, EKS, AKS, RKE, OpenShift                           | Requires smarter-device-manager for FUSE mounts. [See all](https://github.com/containers/podman/blob/main/rootless.md#shortcomings-of-rootless-podman)                                                                                             |
 | [Privileged docker sidecar](#privileged-sidecar-container) | Run docker as a privileged sidecar container.                                                                                                                      | Requires a privileged container. Workspaces can break out to root on the host machine.                                                                                                                                                             |
 
 ## Sysbox container runtime
 
-The [Sysbox](https://github.com/nestybox/sysbox) container runtime allows unprivileged users to run system-level applications, such as Docker, securely from the workspace containers. Sysbox requires a [compatible Linux distribution](https://github.com/nestybox/sysbox/blob/master/docs/distro-compat.md) to implement these security features. Sysbox can also be used to run systemd inside Coder workspaces. See [Systemd in Docker](#systemd-in-docker).
+The [Sysbox](https://github.com/nestybox/sysbox) container runtime allows
+unprivileged users to run system-level applications, such as Docker, securely
+from the workspace containers. Sysbox requires a
+[compatible Linux distribution](https://github.com/nestybox/sysbox/blob/master/docs/distro-compat.md)
+to implement these security features. Sysbox can also be used to run systemd
+inside Coder workspaces. See [Systemd in Docker](#systemd-in-docker).
 
 ### Use Sysbox in Docker-based templates
 
-After [installing Sysbox](https://github.com/nestybox/sysbox#installation) on the Coder host, modify your template to use the sysbox-runc runtime:
+After [installing Sysbox](https://github.com/nestybox/sysbox#installation) on
+the Coder host, modify your template to use the sysbox-runc runtime:
 
 ```hcl
 resource "docker_container" "workspace" {
@@ -44,7 +50,10 @@ resource "coder_agent" "main" {
 
 ### Use Sysbox in Kubernetes-based templates
 
-After [installing Sysbox on Kubernetes](https://github.com/nestybox/sysbox/blob/master/docs/user-guide/install-k8s.md), modify your template to use the sysbox-runc RuntimeClass. This requires the Kubernetes Terraform provider version 2.16.0 or greater.
+After
+[installing Sysbox on Kubernetes](https://github.com/nestybox/sysbox/blob/master/docs/user-guide/install-k8s.md),
+modify your template to use the sysbox-runc RuntimeClass. This requires the
+Kubernetes Terraform provider version 2.16.0 or greater.
 
 ```hcl
 terraform {
@@ -109,15 +118,15 @@ resource "kubernetes_pod" "dev" {
 }
 ```
 
-> Sysbox CE (Community Edition) supports a maximum of 16 pods (workspaces) per node on Kubernetes. See the [Sysbox documentation](https://github.com/nestybox/sysbox/blob/master/docs/user-guide/install-k8s.md#limitations) for more details.
-
 ## Envbox
 
-[Envbox](https://github.com/coder/envbox) is an image developed and maintained by Coder that bundles the sysbox runtime. It works
-by starting an outer container that manages the various sysbox daemons and spawns an unprivileged
-inner container that acts as the user's workspace. The inner container is able to run system-level
-software similar to a regular virtual machine (e.g. `systemd`, `dockerd`, etc). Envbox offers the
-following benefits over running sysbox directly on the nodes:
+[Envbox](https://github.com/coder/envbox) is an image developed and maintained
+by Coder that bundles the sysbox runtime. It works by starting an outer
+container that manages the various sysbox daemons and spawns an unprivileged
+inner container that acts as the user's workspace. The inner container is able
+to run system-level software similar to a regular virtual machine (e.g.
+`systemd`, `dockerd`, etc). Envbox offers the following benefits over running
+sysbox directly on the nodes:
 
 - No custom runtime installation or management on your Kubernetes nodes.
 - No limit to the number of pods that run envbox.
@@ -125,27 +134,37 @@ following benefits over running sysbox directly on the nodes:
 Some drawbacks include:
 
 - The outer container must be run as privileged
-  - Note: the inner container is _not_ privileged. For more information on the security of sysbox
-    containers see sysbox's [official documentation](https://github.com/nestybox/sysbox/blob/master/docs/user-guide/security.md).
-- Initial workspace startup is slower than running `sysbox-runc` directly on the nodes. This is due
-  to `envbox` having to pull the image to its own Docker cache on its initial startup. Once the image
-  is cached in `envbox`, startup performance is similar.
-
-Envbox requires the same kernel requirements as running sysbox directly on the nodes. Refer
-to sysbox's [compatibility matrix](https://github.com/nestybox/sysbox/blob/master/docs/distro-compat.md#sysbox-distro-compatibility) to ensure your nodes are compliant.
-
-To get started with `envbox` check out the [starter template](https://github.com/coder/coder/tree/main/examples/templates/envbox) or visit the [repo](https://github.com/coder/envbox).
+  - Note: the inner container is _not_ privileged. For more information on the
+    security of sysbox containers see sysbox's
+    [official documentation](https://github.com/nestybox/sysbox/blob/master/docs/user-guide/security.md).
+- Initial workspace startup is slower than running `sysbox-runc` directly on the
+  nodes. This is due to `envbox` having to pull the image to its own Docker
+  cache on its initial startup. Once the image is cached in `envbox`, startup
+  performance is similar.
+
+Envbox requires the same kernel requirements as running sysbox directly on the
+nodes. Refer to sysbox's
+[compatibility matrix](https://github.com/nestybox/sysbox/blob/master/docs/distro-compat.md#sysbox-distro-compatibility)
+to ensure your nodes are compliant.
+
+To get started with `envbox` check out the
+[starter template](https://github.com/coder/coder/tree/main/examples/templates/envbox)
+or visit the [repo](https://github.com/coder/envbox).
 
 ### Authenticating with a Private Registry
 
-Authenticating with a private container registry can be done by referencing the credentials
-via the `CODER_IMAGE_PULL_SECRET` environment variable. It is encouraged to populate this
-[environment variable](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data) by using a Kubernetes [secret](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#registry-secret-existing-credentials).
+Authenticating with a private container registry can be done by referencing the
+credentials via the `CODER_IMAGE_PULL_SECRET` environment variable. It is
+encouraged to populate this
+[environment variable](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data)
+by using a Kubernetes
+[secret](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#registry-secret-existing-credentials).
 
-Refer to your container registry documentation to understand how to best create this secret.
+Refer to your container registry documentation to understand how to best create
+this secret.
 
-The following shows a minimal example using a the JSON API key from a GCP service account to pull
-a private image:
+The following shows a minimal example using a the JSON API key from a GCP
+service account to pull a private image:
 
 ```bash
 # Create the secret
@@ -170,17 +189,21 @@ env {
 
 ## Rootless podman
 
-[Podman](https://docs.podman.io/en/latest/) is Docker alternative that is compatible with OCI containers specification. which can run rootless inside Kubernetes pods. No custom RuntimeClass is required.
+[Podman](https://docs.podman.io/en/latest/) is Docker alternative that is
+compatible with OCI containers specification. which can run rootless inside
+Kubernetes pods. No custom RuntimeClass is required.
 
-Prior to completing the steps below, please review the following Podman documentation:
+Before using Podman, please review the following documentation:
 
 - [Basic setup and use of Podman in a rootless environment](https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md)
 
 - [Shortcomings of Rootless Podman](https://github.com/containers/podman/blob/main/rootless.md#shortcomings-of-rootless-podman)
 
-1. Enable [smart-device-manager](https://gitlab.com/arm-research/smarter/smarter-device-manager#enabling-access) to securely expose a FUSE devices to pods.
+1. Enable
+   [smart-device-manager](https://gitlab.com/arm-research/smarter/smarter-device-manager#enabling-access)
+   to securely expose a FUSE devices to pods.
 
-   ```sh
+   ```shell
    cat <<EOF | kubectl create -f -
    apiVersion: apps/v1
    kind: DaemonSet
@@ -218,30 +241,40 @@ Prior to completing the steps below, please review the following Podman document
 
 2. Be sure to label your nodes to enable smarter-device-manager:
 
-   ```sh
+   ```shell
    kubectl get nodes
    kubectl label nodes --all smarter-device-manager=enabled
    ```
 
-   > ⚠️ **Warning**: If you are using a managed Kubernetes distribution (e.g. AKS, EKS, GKE), be sure to set node labels via your cloud provider. Otherwise, your nodes may drop the labels and break podman functionality.
+   > ⚠️ **Warning**: If you are using a managed Kubernetes distribution (e.g.
+   > AKS, EKS, GKE), be sure to set node labels via your cloud provider.
+   > Otherwise, your nodes may drop the labels and break podman functionality.
 
-3. For systems running SELinux (typically Fedora-, CentOS-, and Red Hat-based systems), you may need to disable SELinux or set it to permissive mode.
+3. For systems running SELinux (typically Fedora-, CentOS-, and Red Hat-based
+   systems), you might need to disable SELinux or set it to permissive mode.
 
-4. Import our [kubernetes-with-podman](https://github.com/coder/coder/tree/main/examples/templates/kubernetes-with-podman) example template, or make your own.
+4. Import our
+   [kubernetes-with-podman](https://github.com/coder/coder/tree/main/examples/templates/kubernetes-with-podman)
+   example template, or make your own.
 
-   ```sh
+   ```shell
    echo "kubernetes-with-podman" | coder templates init
    cd ./kubernetes-with-podman
    coder templates create
    ```
 
-   > For more information around the requirements of rootless podman pods, see: [How to run Podman inside of Kubernetes](https://www.redhat.com/sysadmin/podman-inside-kubernetes)
+   > For more information around the requirements of rootless podman pods, see:
+   > [How to run Podman inside of Kubernetes](https://www.redhat.com/sysadmin/podman-inside-kubernetes)
 
 ## Privileged sidecar container
 
-A [privileged container](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities) can be added to your templates to add docker support. This may come in handy if your nodes cannot run Sysbox.
+A
+[privileged container](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities)
+can be added to your templates to add docker support. This may come in handy if
+your nodes cannot run Sysbox.
 
-> ⚠️ **Warning**: This is insecure. Workspaces will be able to gain root access to the host machine.
+> ⚠️ **Warning**: This is insecure. Workspaces will be able to gain root access
+> to the host machine.
 
 ### Use a privileged sidecar container in Docker-based templates
 
@@ -345,10 +378,13 @@ resource "kubernetes_pod" "main" {
 
 ## Systemd in Docker
 
-Additionally, [Sysbox](https://github.com/nestybox/sysbox) can be used to give workspaces full `systemd` capabilities.
+Additionally, [Sysbox](https://github.com/nestybox/sysbox) can be used to give
+workspaces full `systemd` capabilities.
 
-After [installing Sysbox on Kubernetes](https://github.com/nestybox/sysbox/blob/master/docs/user-guide/install-k8s.md),
-modify your template to use the sysbox-runc RuntimeClass. This requires the Kubernetes Terraform provider version 2.16.0 or greater.
+After
+[installing Sysbox on Kubernetes](https://github.com/nestybox/sysbox/blob/master/docs/user-guide/install-k8s.md),
+modify your template to use the sysbox-runc RuntimeClass. This requires the
+Kubernetes Terraform provider version 2.16.0 or greater.
 
 ```hcl
 terraform {
diff --git a/docs/templates/icons.md b/docs/templates/icons.md
new file mode 100644
index 0000000000000..a9072c3f14a01
--- /dev/null
+++ b/docs/templates/icons.md
@@ -0,0 +1,69 @@
+# Icons
+
+---
+
+Coder uses icons in several places, including ones that can be configured
+throughout the app, or specified in your Terraform. They're specified by a URL,
+which can be to an image hosted on a CDN of your own, or one of the icons that
+come bundled with your Coder deployment.
+
+- **Template Icons**:
+
+  - Make templates and workspaces visually recognizable with a relevant or
+    memorable icon
+
+- [**Terraform**](https://registry.terraform.io/providers/coder/coder/latest/docs):
+
+  - [`coder_app`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/app#icon)
+  - [`coder_parameter`](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/parameter#icon)
+    and
+    [`option`](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/parameter#nested-schema-for-option)
+    blocks
+  - [`coder_script`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/script#icon)
+  - [`coder_metadata`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/metadata#icon)
+
+  These can all be configured to use an icon by setting the `icon` field.
+
+  ```hcl
+  data "coder_parameter" "my_parameter" {
+    icon = "/icon/coder.svg"
+
+    option {
+      icon = "/emojis/1f3f3-fe0f-200d-26a7-fe0f.png"
+    }
+  }
+  ```
+
+- [**Authentication Providers**](https://coder.com/docs/v2/latest/admin/external-auth):
+
+  - Use icons for external authentication providers to make them recognizable
+
+## Bundled icons
+
+Coder is distributed with a bundle of icons for popular cloud providers and
+programming languages. You can see all of the icons (or suggest new ones) in our
+repository on
+[GitHub](https://github.com/coder/coder/tree/main/site/static/icon).
+
+You can also view the entire list, with search and previews, by navigating to
+/icons on your Coder deployment. E.g. [https://coder.example.com/icons](#). This
+can be particularly useful in airgapped deployments.
+
+![The icon gallery](../images/icons-gallery.png)
+
+## External icons
+
+You can use any image served over HTTPS as an icon, by specifying the full URL
+of the image. We recommend that you use a CDN that you control, but it can be
+served from any source that you trust.
+
+You can also embed an image by using data: URLs.
+
+- Only the https: and data: protocols are supported in icon URLs (not http:)
+
+- Be careful when using images hosted by someone else; they might disappear or
+  change!
+
+- Be careful when using data: URLs. They can get rather large, and can
+  negatively impact loading times for pages and queries they appear in. Only use
+  them for very small icons that compress well.
diff --git a/docs/templates/index.md b/docs/templates/index.md
index c9a3a455be064..75f0a37e47e8e 100644
--- a/docs/templates/index.md
+++ b/docs/templates/index.md
@@ -1,493 +1,8 @@
 # Templates
 
-Templates are written in [Terraform](https://www.terraform.io/) and describe the
-infrastructure for workspaces (e.g., docker_container, aws_instance,
-kubernetes_pod).
+Templates define the underlying infrastructure that Coder
+[workspaces](../workspaces.md) run on. All workspaces are created from
+templates.
 
-In most cases, a small group of users (team leads or Coder administrators) [have permissions](../admin/users.md#roles) to create and manage templates. Then, other
-users provision their [workspaces](../workspaces.md) from templates using the UI
-or CLI.
-
-## Get the CLI
-
-The CLI and the server are the same binary. We did this to encourage virality so
-individuals can start their own Coder deployments.
-
-From your local machine, download the CLI for your operating system from the
-[releases](https://github.com/coder/coder/releases/latest) or run:
-
-```console
-curl -fsSL https://coder.com/install.sh | sh
-```
-
-To see the sub-commands for managing templates, run:
-
-```console
-coder templates --help
-```
-
-## Login to your Coder Deployment
-
-Before you can create templates, you must first login to your Coder deployment
-with the CLI.
-
-```console
-coder login https://coder.example.com # aka the URL to your coder instance
-```
-
-This will open a browser and ask you to authenticate to your Coder deployment,
-returning an API Key.
-
-> Make a note of the API Key. You can re-use the API Key in future CLI logins or
-> sessions.
-
-```console
-coder --token <your-api-key> login https://coder.example.com/ # aka the URL to your coder instance
-```
-
-## Add a template
-
-Before users can create workspaces, you'll need at least one template in Coder.
-
-```sh
-# create a local directory to store templates
-mkdir -p $HOME/coder/templates
-cd $HOME/coder/templates
-
-# start from an example
-coder templates init
-
-# optional: modify the template
-vim <template-name>/main.tf
-
-# add the template to Coder deployment
-coder templates create <template-name>
-```
-
-> See the documentation and source code for each example as well as community
-> templates in the
-> [examples/](https://github.com/coder/coder/tree/main/examples/templates)
-> directory in the repo.
-
-## Configure Max Workspace Autostop
-
-To control cost, specify a maximum time to live flag for a template in hours or
-minutes.
-
-```sh
-coder templates create my-template --default-ttl 4h
-```
-
-## Customize templates
-
-Example templates are not designed to support every use (e.g
-[examples/aws-linux](https://github.com/coder/coder/tree/main/examples/templates/aws-linux)
-does not support custom VPCs). You can add these features by editing the
-Terraform code once you run `coder templates init` (new) or `coder templates pull` (existing).
-
-Refer to the following resources to build your own templates:
-
-- Terraform: [Documentation](https://developer.hashicorp.com/terraform/docs) and
-  [Registry](https://registry.terraform.io)
-- Common [concepts in templates](#concepts-in-templates) and [Coder Terraform provider](https://registry.terraform.io/providers/coder/coder/latest/docs)
-- [Coder example templates](https://github.com/coder/coder/tree/main/examples/templates) code
-
-## Concepts in templates
-
-While templates are written with standard Terraform, the [Coder Terraform Provider](https://registry.terraform.io/providers/coder/coder/latest/docs) is used to define the workspace lifecycle and establish a connection from resources
-to Coder.
-
-Below is an overview of some key concepts in templates (and workspaces). For all
-template options, reference [Coder Terraform provider docs](https://registry.terraform.io/providers/coder/coder/latest/docs).
-
-### Resource
-
-Resources in Coder are simply [Terraform resources](https://www.terraform.io/language/resources).
-If a Coder agent is attached to a resource, users can connect directly to the
-resource over SSH or web apps.
-
-### Coder agent
-
-Once a Coder workspace is created, the Coder agent establishes a connection
-between a resource (docker_container) and Coder, so that a user can connect to
-their workspace from the web UI or CLI. A template can have multiple agents to
-allow users to connect to multiple resources in their workspace.
-
-> Resources must download and start the Coder agent binary to connect to Coder.
-> This means the resource must be able to reach your Coder URL.
-
-```hcl
-data "coder_workspace" "me" {
-}
-
-resource "coder_agent" "pod1" {
-  os   = "linux"
-  arch = "amd64"
-}
-
-resource "kubernetes_pod" "pod1" {
-  spec {
-    ...
-    container {
-      command = ["sh", "-c", coder_agent.pod1.init_script]
-      env {
-        name  = "CODER_AGENT_TOKEN"
-        value = coder_agent.dev.token
-      }
-    }
-  }
-}
-```
-
-The `coder_agent` resource can be configured with additional arguments. For example,
-you can use the `env` property to set environment variables that will be inherited
-by all child processes of the agent, including SSH sessions. See the
-[Coder Terraform Provider documentation](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent)
-for the full list of supported arguments for the `coder_agent`.
-
-#### `startup_script`
-
-Use the Coder agent's `startup_script` to run additional commands like
-installing IDEs, [cloning dotfiles](../dotfiles.md#templates), and cloning
-project repos.
-
-**Note:** By default, the startup script is executed in the background.
-This allows users to access the workspace before the script completes.
-If you want to change this, see [`startup_script_behavior`](#startup_script_behavior) below.
-
-Here are a few guidelines for writing a good startup script (more on these below):
-
-1. Use `set -e` to exit the script if any command fails and `|| true` for commands that are allowed to fail
-2. Use `&` to start a process in the background, allowing the startup script to complete
-3. Inform the user about what's going on via `echo`
-
-```hcl
-resource "coder_agent" "coder" {
-  os   = "linux"
-  arch = "amd64"
-  dir = "/home/coder"
-  startup_script = <<EOT
-#!/bin/bash
-
-# Install code-server 4.8.3 under /tmp/code-server using the "standalone" installation
-# that does not require root permissions. Note that /tmp may be mounted in tmpfs which
-# can lead to increased RAM usage. To avoid this, you can pre-install code-server inside
-# the Docker image or VM image.
-echo "Installing code-server..."
-curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server --version 4.8.3
-
-# The & prevents the startup_script from blocking so the next commands can run.
-# The stdout and stderr of code-server is redirected to /tmp/code-server.log.
-echo "Starting code-server..."
-/tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &
-
-# Notice: var.repo and var.dotfiles_uri are specified elsewhere in the Terraform
-# code as input variables.
-REPO=${var.repo}
-DOTFILES_URI=${var.dotfiles_uri}
-
-# clone repo
-ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts
-echo "Cloning $REPO..."
-git clone --progress git@github.com:"$REPO"
-
-# use coder CLI to clone and install dotfiles
-echo "Cloning dotfiles..."
-coder dotfiles -y "$DOTFILES_URI"
-  EOT
-}
-```
-
-The startup script can contain important steps that must be executed successfully so that the workspace is in a usable state, for this reason we recommend using `set -e` (exit on error) at the top and `|| true` (allow command to fail) to ensure the user is notified when something goes wrong. These are not shown in the example above because, while useful, they need to be used with care. For more assurance, you can utilize [shellcheck](https://www.shellcheck.net) to find bugs in the script and employ [`set -euo pipefail`](https://wizardzines.com/comics/bash-errors/) to exit on error, unset variables, and fail on pipe errors.
-
-We also recommend that startup scripts do not run forever. Long-running processes, like code-server, should be run in the background. This is usually achieved by adding `&` to the end of the command. For example, `sleep 10 &` will run the command in the background and allow the startup script to complete.
-
-> **Note:** If a backgrounded command (`&`) writes to stdout or stderr, the startup script will not complete until the command completes or closes the file descriptors. To avoid this, you can redirect the stdout and stderr to a file. For example, `sleep 10 >/dev/null 2>&1 &` will redirect the stdout and stderr to `/dev/null` (discard) and run the command in the background.
-
-PS. Notice how each step starts with `echo "..."` to provide feedback to the user about what is happening? This is especially useful when the startup script behavior is set to blocking because the user will be informed about why they're waiting to access their workspace.
-
-#### `startup_script_behavior`
-
-Use the Coder agent's `startup_script_behavior` to change the behavior between `blocking` and `non-blocking` (default). The blocking behavior is recommended for most use cases because it allows the startup script to complete before the user accesses the workspace. For example, let's say you want to check out a very large repo in the startup script. If the startup script is non-blocking, the user may log in via SSH or open the IDE before the repo is fully checked out. This can lead to a poor user experience.
-
-```hcl
-resource "coder_agent" "coder" {
-  os   = "linux"
-  arch = "amd64"
-  startup_script_behavior = "blocking"
-  startup_script = "echo 'Starting...'"
-```
-
-Whichever behavior is enabled, the user can still choose to override it by specifying the appropriate flags (or environment variables) in the CLI when connecting to the workspace. The behavior can be overridden by one of the following means:
-
-- Set an environment variable (for use with `ssh` or `coder ssh`):
-  - `export CODER_SSH_WAIT=yes` (blocking)
-  - `export CODER_SSH_WAIT=no` (non-blocking)
-- Use a flag with `coder ssh`:
-  - `coder ssh --wait=yes my-workspace` (blocking)
-  - `coder ssh --wait=no my-workspace` (non-blocking)
-- Use a flag to configure all future `ssh` connections:
-  - `coder config-ssh --wait=yes` (blocking)
-  - `coder config-ssh --wait=no` (non-blocking)
-
-### Start/stop
-
-[Learn about resource persistence in Coder](./resource-persistence.md)
-
-Coder workspaces can be started/stopped. This is often used to save on cloud
-costs or enforce ephemeral workflows. When a workspace is started or stopped,
-the Coder server runs an additional [terraform apply](https://www.terraform.io/cli/commands/apply),
-informing the Coder provider that the workspace has a new transition state.
-
-This template sample has one persistent resource (docker volume) and one
-ephemeral resource (docker container).
-
-```hcl
-data "coder_workspace" "me" {
-}
-
-resource "docker_volume" "home_volume" {
-  # persistent resource (remains a workspace is stopped)
-  count = 1
-  name  = "coder-${data.coder_workspace.me.id}-home"
-  lifecycle {
-    ignore_changes = all
-  }
-}
-
-resource "docker_container" "workspace" {
-  # ephemeral resource (deleted when workspace is stopped, created when started)
-  count = data.coder_workspace.me.start_count # 0 (stopped), 1 (started)
-  volumes {
-    container_path = "/home/coder/"
-    volume_name    = docker_volume.home_volume.name
-    read_only      = false
-  }
-  # ... other config
-}
-```
-
-#### Using updated images when rebuilding a workspace
-
-To ensure that Coder uses an updated image when rebuilding a workspace, we
-suggest that admins update the tag in the template (e.g., `my-image:v0.4.2` ->
-`my-image:v0.4.3`) or digest (`my-image@sha256:[digest]` ->
-`my-image@sha256:[new_digest]`).
-
-Alternatively, if you're willing to wait for longer start times from Coder, you
-can set the `imagePullPolicy` to `Always` in your Terraform template; when set,
-Coder will check `image:tag` on every build and update if necessary:
-
-```tf
-resource "kubernetes_pod" "podName" {
-    spec {
-        container {
-            image_pull_policy = "Always"
-        }
-    }
-}
-```
-
-### Edit templates
-
-You can edit a template using the coder CLI or the UI. Only [template admins and
-owners](../admin/users.md) can edit a template.
-
-Using the UI, navigate to the template page, click on the menu, and select "Edit files". In the template editor, you create, edit and remove files. Before publishing a new template version, you can test your modifications by clicking the "Build template" button. Newly published template versions automatically become the default version selection when creating a workspace.
-
-> **Tip**: Even without publishing a version as active, you can still use it to create a workspace before making it the default for everybody in your organization. This may help you debug new changes without impacting others.
-
-Using the CLI, login to Coder and run the following command to edit a single
-template:
-
-```console
-coder templates edit <template-name> --description "This is my template"
-```
-
-Review editable template properties by running `coder templates edit -h`.
-
-Alternatively, you can pull down the template as a tape archive (`.tar`) to your
-current directory:
-
-```console
-coder templates pull <template-name> file.tar
-```
-
-Then, extract it by running:
-
-```sh
-tar -xf file.tar
-```
-
-Make the changes to your template then run this command from the root of the
-template folder:
-
-```console
-coder templates push <template-name>
-```
-
-Your updated template will now be available. Outdated workspaces will have a
-prompt in the dashboard to update.
-
-### Delete templates
-
-You can delete a template using both the coder CLI and UI. Only [template admins
-and owners](../admin/users.md) can delete a template, and the template must not
-have any running workspaces associated to it.
-
-Using the CLI, login to Coder and run the following command to delete a
-template:
-
-```console
-coder templates delete <template-name>
-```
-
-In the UI, navigate to the template you want to delete, and select the dropdown
-in the right-hand corner of the page to delete the template.
-
-![delete-template](../images/delete-template.png)
-
-#### Delete workspaces
-
-When a workspace is deleted, the Coder server essentially runs a [terraform
-destroy](https://www.terraform.io/cli/commands/destroy) to remove all resources
-associated with the workspace.
-
-> Terraform's
-> [prevent-destroy](https://www.terraform.io/language/meta-arguments/lifecycle#prevent_destroy)
-> and
-> [ignore-changes](https://www.terraform.io/language/meta-arguments/lifecycle#ignore_changes)
-> meta-arguments can be used to prevent accidental data loss.
-
-### Coder apps
-
-By default, all templates allow developers to connect over SSH and a web
-terminal. See [Configuring Web IDEs](../ides/web-ides.md) to learn how to give
-users access to additional web applications.
-
-### Data source
-
-When a workspace is being started or stopped, the `coder_workspace` data source
-provides some useful parameters. See the [Coder Terraform provider](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace) for more information.
-
-For example, the [Docker quick-start template](https://github.com/coder/coder/tree/main/examples/templates/docker)
-sets a few environment variables based on the username and email address of the
-workspace's owner, so that you can make Git commits immediately without any
-manual configuration:
-
-```tf
-resource "coder_agent" "main" {
-  # ...
-  env = {
-    GIT_AUTHOR_NAME = "${data.coder_workspace.me.owner}"
-    GIT_COMMITTER_NAME = "${data.coder_workspace.me.owner}"
-    GIT_AUTHOR_EMAIL = "${data.coder_workspace.me.owner_email}"
-    GIT_COMMITTER_EMAIL = "${data.coder_workspace.me.owner_email}"
-  }
-}
-```
-
-You can add these environment variable definitions to your own templates, or
-customize them however you like.
-
-## Troubleshooting templates
-
-Occasionally, you may run into scenarios where a workspace is created, but the
-agent is either not connected or the [startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script)
-has failed or timed out.
-
-### Agent connection issues
-
-If the agent is not connected, it means the agent or [init script](https://github.com/coder/coder/tree/main/provisionersdk/scripts)
-has failed on the resource.
-
-```console
-$ coder ssh myworkspace
-⢄⡱ Waiting for connection from [agent]...
-```
-
-While troubleshooting steps vary by resource, here are some general best
-practices:
-
-- Ensure the resource has `curl` installed (alternatively, `wget` or `busybox`)
-- Ensure the resource can `curl` your Coder [access
-  URL](../admin/configure.md#access-url)
-- Manually connect to the resource and check the agent logs (e.g., `kubectl exec`, `docker exec` or AWS console)
-  - The Coder agent logs are typically stored in `/tmp/coder-agent.log`
-  - The Coder agent startup script logs are typically stored in `/tmp/coder-startup-script.log`
-  - The Coder agent shutdown script logs are typically stored in `/tmp/coder-shutdown-script.log`
-- This can also happen if the websockets are not being forwarded correctly when running Coder behind a reverse proxy. [Read our reverse-proxy docs](https://coder.com/docs/v2/latest/admin/configure#tls--reverse-proxy)
-
-### Startup script issues
-
-Depending on the contents of the [startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script), and whether or not the [startup script behavior](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script_behavior) is set to blocking or non-blocking, you may notice issues related to the startup script. In this section we will cover common scenarios and how to resolve them.
-
-#### Unable to access workspace, startup script is still running
-
-If you're trying to access your workspace and are unable to because the [startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script) is still running, it means the [startup script behavior](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script_behavior) option is set to blocking or you have enabled the `--wait=yes` option (for e.g. `coder ssh` or `coder config-ssh`). In such an event, you can always access the workspace by using the web terminal, or via SSH using the `--wait=no` option. If the startup script is running longer than it should, or never completing, you can try to [debug the startup script](#debugging-the-startup-script) to resolve the issue. Alternatively, you can try to force the startup script to exit by terminating processes started by it or terminating the startup script itself (on Linux, `ps` and `kill` are useful tools).
-
-For tips on how to write a startup script that doesn't run forever, see the [`startup_script`](#startup_script) section. For more ways to override the startup script behavior, see the [`startup_script_behavior`](#startup_script_behavior) section.
-
-Template authors can also set the [startup script behavior](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script_behavior) option to non-blocking, which will allow users to access the workspace while the startup script is still running. Note that the workspace must be updated after changing this option.
-
-#### Your workspace may be incomplete
-
-If you see a warning that your workspace may be incomplete, it means you should be aware that programs, files, or settings may be missing from your workspace. This can happen if the [startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script) is still running or has exited with a non-zero status (see [startup script error](#startup-script-error)). No action is necessary, but you may want to [start a new shell session](#session-was-started-before-the-startup-script-finished-web-terminal) after it has completed or check the [startup script logs](#debugging-the-startup-script) to see if there are any issues.
-
-#### Session was started before the startup script finished
-
-The web terminal may show this message if it was started before the [startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script) finished, but the startup script has since finished. This message can safely be dismissed, however, be aware that your preferred shell or dotfiles may not yet be activated for this shell session. You can either start a new session or source your dotfiles manually. Note that starting a new session means that commands running in the terminal will be terminated and you may lose unsaved work.
-
-Examples for activating your preferred shell or sourcing your dotfiles:
-
-- `exec zsh -l`
-- `source ~/.bashrc`
-
-#### Startup script exited with an error
-
-When the [startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script) exits with an error, it means the last command run by the script failed. When `set -e` is used, this means that any failing command will immediately exit the script and the remaining commands will not be executed. This also means that [your workspace may be incomplete](#your-workspace-may-be-incomplete). If you see this error, you can check the [startup script logs](#debugging-the-startup-script) to figure out what the issue is.
-
-Common causes for startup script errors:
-
-- A missing command or file
-- A command that fails due to missing permissions
-- Network issues (e.g., unable to reach a server)
-
-#### Debugging the startup script
-
-The simplest way to debug the [startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script) is to open the workspace in the Coder dashboard and click "Show startup log" (if not already visible). This will show all the output from the script. Another option is to view the log file inside the workspace (usually `/tmp/coder-startup-script.log`). If the logs don't indicate what's going on or going wrong, you can increase verbosity by adding `set -x` to the top of the startup script (note that this will show all commands run and may output sensitive information). Alternatively, you can add `echo` statements to show what's going on.
-
-Here's a short example of an informative startup script:
-
-```sh
-echo "Running startup script..."
-echo "Run: long-running-command"
-/path/to/long-running-command
-status=$?
-echo "Done: long-running-command, exit status: ${status}"
-if [ $status -ne 0 ]; then
-  echo "Startup script failed, exiting..."
-  exit $status
-fi
-```
-
-> **Note:** We don't use `set -x` here because we're manually echoing the commands. This protects against sensitive information being shown in the log.
-
-This script tells us what command is being run and what the exit status is. If the exit status is non-zero, it means the command failed and we exit the script. Since we are manually checking the exit status here, we don't need `set -e` at the top of the script to exit on error.
-
-## Template permissions (enterprise)
-
-Template permissions can be used to give users and groups access to specific
-templates. [Learn more about RBAC](../admin/rbac.md) to learn how to manage
-
-## Community Templates
-
-You can see a list of community templates by our users
-[here](https://github.com/coder/coder/blob/main/examples/templates/community-templates.md).
-
-## Next Steps
-
-- Learn about [Authentication & Secrets](./authentication.md)
-- Learn about [Change Management](./change-management.md)
-- Learn about [Resource Metadata](./resource-metadata.md)
-- Learn about [Workspaces](../workspaces.md)
+<children>
+</children>
diff --git a/docs/templates/modules.md b/docs/templates/modules.md
index 06827bc2c0fbd..137679d82bf95 100644
--- a/docs/templates/modules.md
+++ b/docs/templates/modules.md
@@ -1,8 +1,12 @@
-# Template inheritance
+# Reusing template code
 
-In instances where you want to reuse code across different Coder templates, such as common scripts or resource definitions, we suggest using [Terraform Modules](https://developer.hashicorp.com/terraform/language/modules).
+To reuse code across different Coder templates, such as common scripts or
+resource definitions, we suggest using
+[Terraform Modules](https://developer.hashicorp.com/terraform/language/modules).
 
-These modules can be stored externally from Coder, like in a Git repository or a Terraform registry. Below is an example of how to reference a module in your template:
+You can store these modules externally from your Coder deployment, like in a git
+repository or a Terraform registry. This example shows how to reference a module
+from your template:
 
 ```hcl
 data "coder_workspace" "me" {}
@@ -25,36 +29,52 @@ resource "coder_agent" "dev" {
 }
 ```
 
-> Learn more about [creating modules](https://developer.hashicorp.com/terraform/language/modules) and [module sources](https://developer.hashicorp.com/terraform/language/modules/sources) in the Terraform documentation.
+Learn more about
+[creating modules](https://developer.hashicorp.com/terraform/language/modules)
+and
+[module sources](https://developer.hashicorp.com/terraform/language/modules/sources)
+in the Terraform documentation.
 
 ## Git authentication
 
-If you are importing a module from a private git repository, the Coder server [or provisioner](../admin/provisioners.md) needs git credentials. Since this token will only be used for cloning your repositories with modules, it is best to create a token with limited access to repositories and no extra permissions. In GitHub, you can generate a [fine-grained token](https://docs.github.com/en/rest/overview/permissions-required-for-fine-grained-personal-access-tokens?apiVersion=2022-11-28) with read only access to repos.
+If you are importing a module from a private git repository, the Coder server or
+[provisioner](../admin/provisioners.md) needs git credentials. Since this token
+will only be used for cloning your repositories with modules, it is best to
+create a token with access limited to the repository and no extra permissions.
+In GitHub, you can generate a
+[fine-grained token](https://docs.github.com/en/rest/overview/permissions-required-for-fine-grained-personal-access-tokens?apiVersion=2022-11-28)
+with read only access to the necessary repos.
 
-If you are running Coder on a VM, make sure you have `git` installed and the `coder` user has access to the following files
+If you are running Coder on a VM, make sure that you have `git` installed and
+the `coder` user has access to the following files:
 
-```sh
+```shell
 # /home/coder/.gitconfig
 [credential]
   helper = store
 ```
 
-```sh
+```shell
 # /home/coder/.git-credentials
 
 # GitHub example:
 https://your-github-username:your-github-pat@github.com
 ```
 
-If you are running Coder on Docker or Kubernetes, `git` is pre-installed in the Coder image. However, you still need to mount credentials. This can be done via a Docker volume mount or Kubernetes secrets.
+If you are running Coder on Docker or Kubernetes, `git` is pre-installed in the
+Coder image. However, you still need to mount credentials. This can be done via
+a Docker volume mount or Kubernetes secrets.
 
 ### Passing git credentials in Kubernetes
 
-First, create a `.gitconfig` and `.git-credentials` file on your local machine. You may want to do this in a temporary directory to avoid conflicting with your own git credentials.
+First, create a `.gitconfig` and `.git-credentials` file on your local machine.
+You might want to do this in a temporary directory to avoid conflicting with
+your own git credentials.
 
-Next, create the secret in Kubernetes. Be sure to do this in the same namespace that Coder is installed in.
+Next, create the secret in Kubernetes. Be sure to do this in the same namespace
+that Coder is installed in.
 
-```sh
+```shell
 export NAMESPACE=coder
 kubectl apply -f - <<EOF
 apiVersion: v1
@@ -87,3 +107,55 @@ coder:
       subPath: .git-credentials
       readOnly: true
 ```
+
+## Artifactory
+
+JFrog Artifactory can serve as a Terraform module registry, allowing you to
+simplify a Coder-stored template to a `module` block and input variables.
+
+With this approach, you can:
+
+- Easily share templates across multiple Coder instances
+- Store templates far larger than the 1MB limit of Coder's template storage
+- Apply JFrog platform security policies to your templates
+
+### Basic Scaffolding
+
+For example, a template with:
+
+```hcl
+module "frontend" {
+  source = "cdr.jfrog.io/tf__main/frontend/docker"
+}
+```
+
+References the `frontend` module in the `main` namespace of the `tf` repository.
+Remember to replace `cdr.jfrog.io` with your Artifactory instance URL.
+
+You can upload the underlying module to Artifactory with:
+
+```shell
+# one-time setup commands
+# run this on the coder server (or external provisioners, if you have them)
+terraform login cdr.jfrog.io; jf tfc --global
+
+# jf tf p assumes the module name is the same as the current directory name.
+jf tf p --namespace=main --provider=docker --tag=v0.0.1
+```
+
+### Example template
+
+We have an example template
+[here](https://github.com/coder/coder/tree/main/examples/templates/jfrog/remote)
+that uses our [JFrog Docker](../platforms/jfrog.md) template as the underlying
+module.
+
+### Next up
+
+Learn more about
+
+- JFrog's Terraform Registry support
+  [here](https://jfrog.com/help/r/jfrog-artifactory-documentation/terraform-registry).
+- Configuring the JFrog toolchain inside a workspace
+  [here](../platforms/jfrog.md).
+- Coder Module Registry [here](https://registry.coder.com/modules)
diff --git a/docs/templates/open-in-coder.md b/docs/templates/open-in-coder.md
index d179fabd36187..936c04681a446 100644
--- a/docs/templates/open-in-coder.md
+++ b/docs/templates/open-in-coder.md
@@ -1,6 +1,7 @@
 # Open in Coder
 
-An "Open in Coder" button can be embedded into your git repos or internal wikis to allow developers to quickly launch a new workspace.
+You can embed an "Open in Coder" button into your git repos or internal wikis to
+let developers quickly launch a new workspace.
 
 <video autoplay playsinline loop>
   <source src="https://github.com/coder/coder/blob/main/docs/images/templates/open-in-coder.mp4?raw=true" type="video/mp4">
@@ -9,99 +10,111 @@ Your browser does not support the video tag.
 
 ## How it works
 
-To support any infrastructure and software stack, Coder provides a generic approach for "Open in Coder" flows.
+To support any infrastructure and software stack, Coder provides a generic
+approach for "Open in Coder" flows.
 
-1. Set up [Git Authentication](../admin/git-providers.md#require-git-authentication-in-templates) in your Coder deployment
+### 1. Set up git authentication
 
-1. Modify your template to auto-clone repos:
+See [External Authentication](../admin/external-auth.md) to set up git
+authentication in your Coder deployment.
 
-> The id in the template's `coder_git_auth` data source must match the `CODER_GITAUTH_0_ID` in the Coder deployment configuration.
+### 2. Modify your template to auto-clone repos
 
-- If you want the template to clone a specific git repo
+The id in the template's `coder_external_auth` data source must match the
+`CODER_EXTERNAL_AUTH_X_ID` in the Coder deployment configuration.
 
-  ```hcl
-  # Require git authentication to use this template
-  data "coder_git_auth" "github" {
-      id = "primary-github"
-  }
+If you want the template to clone a specific git repo:
 
-  resource "coder_agent" "dev" {
-      # ...
-      dir = "~/coder"
-      startup_script =<<EOF
+```hcl
+# Require git authentication to use this template
+data "coder_git_auth" "github" {
+    id = "primary-github"
+}
 
-      # Clone repo from GitHub
-      if [ ! -d "coder" ]
-      then
-          git clone https://github.com/coder/coder
-      fi
+resource "coder_agent" "dev" {
+    # ...
+    dir = "~/coder"
+    startup_script =<<EOF
 
-      EOF
-  }
-  ```
+    # Clone repo from GitHub
+    if [ ! -d "coder" ]
+    then
+        git clone https://github.com/coder/coder
+    fi
 
-  > Note: The `dir` attribute can be set in multiple ways, for example:
-  >
-  > - `~/coder`
-  > - `/home/coder/coder`
-  > - `coder` (relative to the home directory)
+    EOF
+}
+```
 
-- If you want the template to support any repository via [parameters](./parameters.md)
+> Note: The `dir` attribute can be set in multiple ways, for example:
+>
+> - `~/coder`
+> - `/home/coder/coder`
+> - `coder` (relative to the home directory)
 
-  ```hcl
-  # Require git authentication to use this template
-  data "coder_git_auth" "github" {
-      id = "primary-github"
-  }
+If you want the template to support any repository via
+[parameters](./parameters.md)
 
-  # Prompt the user for the git repo URL
-  data "coder_parameter" "git_repo" {
-      name          = "git_repo"
-      display_name  = "Git repository"
-      default       = "https://github.com/coder/coder"
-  }
+```hcl
+# Require git authentication to use this template
+data "coder_git_auth" "github" {
+    id = "primary-github"
+}
 
-  locals {
-      folder_name = try(element(split("/", data.coder_parameter.git_repo.value), length(split("/", data.coder_parameter.git_repo.value)) - 1), "")
-  }
+# Prompt the user for the git repo URL
+data "coder_parameter" "git_repo" {
+    name          = "git_repo"
+    display_name  = "Git repository"
+    default       = "https://github.com/coder/coder"
+}
 
-  resource "coder_agent" "dev" {
-      # ...
-      dir = "~/${local.folder_name}"
-      startup_script =<<EOF
+locals {
+    folder_name = try(element(split("/", data.coder_parameter.git_repo.value), length(split("/", data.coder_parameter.git_repo.value)) - 1), "")
+}
 
-      # Clone repo from GitHub
-      if [ ! -d "${local.folder_name}" ]
-      then
-          git clone ${data.coder_parameter.git_repo.value}
-      fi
+resource "coder_agent" "dev" {
+    # ...
+    dir = "~/${local.folder_name}"
+    startup_script =<<EOF
 
-      EOF
-  }
-  ```
+    # Clone repo from GitHub
+    if [ ! -d "${local.folder_name}" ]
+    then
+        git clone ${data.coder_parameter.git_repo.value}
+    fi
 
-1. Embed the "Open in Coder" button with Markdown
+    EOF
+}
+```
 
-   ```md
-   [![Open in Coder](https://YOUR_ACCESS_URL/open-in-coder.svg)](https://YOUR_ACCESS_URL/templates/YOUR_TEMPLATE/workspace)
-   ```
+### 3. Embed the "Open in Coder" button with Markdown
 
-   > Be sure to replace `YOUR_ACCESS_URL` with your Coder access url (e.g. https://coder.example.com) and `YOUR_TEMPLATE` with the name of your template.
+```md
+[![Open in Coder](https://YOUR_ACCESS_URL/open-in-coder.svg)](https://YOUR_ACCESS_URL/templates/YOUR_TEMPLATE/workspace)
+```
 
-1. Optional: pre-fill parameter values in the "Create Workspace" page
+Be sure to replace `YOUR_ACCESS_URL` with your Coder access url (e.g.
+<https://coder.example.com>) and `YOUR_TEMPLATE` with the name of your template.
 
-   This can be used to pre-fill the git repo URL, disk size, image, etc.
+### 4. Optional: pre-fill parameter values in the "Create Workspace" page
 
-   ```md
-   [![Open in Coder](https://YOUR_ACCESS_URL/open-in-coder.svg)](https://YOUR_ACCESS_URL/templates/YOUR_TEMPLATE/workspace?param.git_repo=https://github.com/coder/slog&param.home_disk_size%20%28GB%29=20)
-   ```
+This can be used to pre-fill the git repo URL, disk size, image, etc.
 
-   ![Pre-filled parameters](../images/templates/pre-filled-parameters.png)
+```md
+[![Open in Coder](https://YOUR_ACCESS_URL/open-in-coder.svg)](https://YOUR_ACCESS_URL/templates/YOUR_TEMPLATE/workspace?param.git_repo=https://github.com/coder/slog&param.home_disk_size%20%28GB%29=20)
+```
 
-## Example: Kubernetes
+![Pre-filled parameters](../images/templates/pre-filled-parameters.png)
 
-For a full example of the Open in Coder flow in Kubernetes, check out [this example template](https://github.com/bpmct/coder-templates/tree/main/kubernetes-open-in-coder).
+### 5. Optional: disable specific parameter fields by including their names as
 
-## Devcontainer support
+specified in your template in the `disable_params` search params list
 
-Devcontainer support is on the roadmap. [Follow along here](https://github.com/coder/coder/issues/5559)
+```md
+[![Open in Coder](https://YOUR_ACCESS_URL/open-in-coder.svg)](https://YOUR_ACCESS_URL/templates/YOUR_TEMPLATE/workspace?disable_params=first_parameter,second_parameter)
+```
+
+### Example: Kubernetes
+
+For a full example of the Open in Coder flow in Kubernetes, check out
+[this example template](https://github.com/bpmct/coder-templates/tree/main/kubernetes-open-in-coder).
diff --git a/docs/templates/parameters.md b/docs/templates/parameters.md
index c74413d48b392..a417157f2563a 100644
--- a/docs/templates/parameters.md
+++ b/docs/templates/parameters.md
@@ -1,9 +1,19 @@
 # Parameters
 
-Templates can contain _parameters_, which allow prompting the user for additional information when creating workspaces in both the UI and CLI.
+A template can prompt the user for additional information when creating
+workspaces with
+[_parameters_](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/parameter).
 
 ![Parameters in Create Workspace screen](../images/parameters.png)
 
+The user can set parameters in the dashboard UI and CLI.
+
+You'll likely want to hardcode certain template properties for workspaces, such
+as security group. But you can let developers specify other properties with
+parameters like instance size, geographical location, repository URL, etc.
+
+This example lets a developer choose a Docker host for the workspace:
+
 ```hcl
 data "coder_parameter" "docker_host" {
   name        = "Region"
@@ -32,7 +42,7 @@ data "coder_parameter" "docker_host" {
 }
 ```
 
-From there, parameters can be referenced during build-time:
+From there, a template can refer to a parameter's value:
 
 ```hcl
 provider "docker" {
@@ -40,18 +50,19 @@ provider "docker" {
 }
 ```
 
-> For a complete list of supported parameter properties, see the
-> [coder_parameter Terraform reference](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/parameter)
-
 ## Types
 
-The following parameter types are supported: `string`, `list(string)`, `bool`, and `number`.
+A Coder parameter can have one of these types:
 
-### List of strings
+- `string`
+- `bool`
+- `number`.
+- `list(string)`
 
-List of strings is a specific parameter type, that can't be easily mapped to the default value, which is string type.
-Parameters with the `list(string)` type must be converted to JSON arrays using [jsonencode](https://developer.hashicorp.com/terraform/language/functions/jsonencode)
-function.
+To specify a default value for a parameter with the `list(string)` type, use a
+JSON array and the Terraform
+[jsonencode](https://developer.hashicorp.com/terraform/language/functions/jsonencode)
+function. For example:
 
 ```hcl
 data "coder_parameter" "security_groups" {
@@ -70,7 +81,7 @@ data "coder_parameter" "security_groups" {
 
 ## Options
 
-A _string_ parameter can provide a set of options to limit the choice:
+A `string` parameter can provide a set of options to limit the user's choices:
 
 ```hcl
 data "coder_parameter" "docker_host" {
@@ -99,9 +110,40 @@ data "coder_parameter" "docker_host" {
 }
 ```
 
+### Incompatibility in Parameter Options for Workspace Builds
+
+When creating Coder templates, authors have the flexibility to modify parameter
+options associated with rich parameters. Such modifications can involve adding,
+substituting, or removing a parameter option. It's important to note that making
+these changes can lead to discrepancies in parameter values utilized by ongoing
+workspace builds.
+
+Consequently, workspace users will be prompted to select the new value from a
+pop-up window or by using the command-line interface. While this additional
+interactive step might seem like an interruption, it serves a crucial purpose.
+It prevents workspace users from becoming trapped with outdated template
+versions, ensuring they can smoothly update their workspace without any
+hindrances.
+
+Example:
+
+- Bob creates a workspace using the `python-dev` template. This template has a
+  parameter `image_tag`, and Bob selects `1.12`.
+- Later, the template author Alice is notified of a critical vulnerability in a
+  package installed in the `python-dev` template, which affects the image tag
+  `1.12`.
+- Alice remediates this vulnerability, and pushes an updated template version
+  that replaces option `1.12` with `1.13` for the `image_tag` parameter. She
+  then notifies all users of that template to update their workspace
+  immediately.
+- Bob saves their work, and selects the `Update` option in the UI. As their
+  workspace uses the now-invalid option `1.12`, for the `image_tag` parameter,
+  they are prompted to select a new value for `image_tag`.
+
 ## Required and optional parameters
 
-A parameter is considered to be _required_ if it doesn't have the `default` property. The user **must** provide a value to this parameter before creating a workspace.
+A parameter is _required_ if it doesn't have the `default` property. The user
+**must** provide a value to this parameter before creating a workspace:
 
 ```hcl
 data "coder_parameter" "account_name" {
@@ -111,8 +153,8 @@ data "coder_parameter" "account_name" {
 }
 ```
 
-If a parameter contains the `default` property, Coder will use this value
-if the user does not specify any:
+If a parameter contains the `default` property, Coder will use this value if the
+user does not specify any:
 
 ```hcl
 data "coder_parameter" "base_image" {
@@ -122,7 +164,8 @@ data "coder_parameter" "base_image" {
 }
 ```
 
-Admins can also set the `default` property to an empty value so that the parameter field can remain empty:
+Admins can also set the `default` property to an empty value so that the
+parameter field can remain empty:
 
 ```hcl
 data "coder_parameter" "dotfiles_url" {
@@ -135,7 +178,16 @@ data "coder_parameter" "dotfiles_url" {
 
 ## Mutability
 
-Immutable parameters can be only set before workspace creation, or during update on the first usage to set the initial value for required parameters. The idea is to prevent users from modifying fragile or persistent workspace resources like volumes, regions, etc.:
+Immutable parameters can only be set in these situations:
+
+- Creating a workspace for the first time.
+- Updating a workspace to a new template version. This sets the initial value
+  for required parameters.
+
+The idea is to prevent users from modifying fragile or persistent workspace
+resources like volumes, regions, and so on.
+
+Example:
 
 ```hcl
 data "coder_parameter" "region" {
@@ -146,16 +198,19 @@ data "coder_parameter" "region" {
 }
 ```
 
-It is allowed to modify the mutability state anytime. In case of emergency, template authors can temporarily allow for changing immutable parameters to fix an operational issue, but it is not
-advised to overuse this opportunity.
+You can modify a parameter's `mutable` attribute state anytime. In case of
+emergency, you can temporarily allow for changing immutable parameters to fix an
+operational issue, but it is not advised to overuse this opportunity.
 
 ## Ephemeral parameters
 
-Ephemeral parameters are introduced to users in the form of "build options." This functionality can be used to model
-specific behaviors within a Coder workspace, such as reverting to a previous image, restoring from a volume snapshot, or
-building a project without utilizing cache.
+Ephemeral parameters are introduced to users in the form of "build options." Use
+ephemeral parameters to model specific behaviors in a Coder workspace, such as
+reverting to a previous image, restoring from a volume snapshot, or building a
+project without using cache.
 
-As these parameters are ephemeral in nature, subsequent builds will proceed in the standard manner.
+Since these parameters are ephemeral in nature, subsequent builds proceed in the
+standard manner:
 
 ```hcl
 data "coder_parameter" "force_rebuild" {
@@ -168,14 +223,18 @@ data "coder_parameter" "force_rebuild" {
 }
 ```
 
-## Validation
+## Validating parameters
 
-Rich parameters support multiple validation modes - min, max, monotonic numbers, and regular expressions.
+Coder supports rich parameters with multiple validation modes: min, max,
+monotonic numbers, and regular expressions.
 
 ### Number
 
-A _number_ parameter can be limited to boundaries - min, max. Additionally, the monotonicity (`increasing` or `decreasing`) between the current parameter value and the new one can be verified too.
-Monotonicity can be enabled for resources that can't be shrunk without implications, for instance - disk volume size.
+You can limit a `number` parameter to `min` and `max` boundaries.
+
+You can also specify its monotonicity as `increasing` or `decreasing` to verify
+the current and new values. Use the `monotonic` aatribute for resources that
+can't be shrunk or grown without implications, like disk volume size.
 
 ```hcl
 data "coder_parameter" "instances" {
@@ -192,7 +251,8 @@ data "coder_parameter" "instances" {
 
 ### String
 
-A _string_ parameter can have a regular expression defined to make sure that the parameter value matches the pattern. The `regex` property requires a corresponding `error` property.
+You can validate a `string` parameter to match a regular expression. The `regex`
+property requires a corresponding `error` property.
 
 ```hcl
 data "coder_parameter" "project_id" {
@@ -200,86 +260,24 @@ data "coder_parameter" "project_id" {
   description = "Alpha-numeric project ID"
   validation {
     regex = "^[a-z0-9]+$"
-    error = "Unfortunately, it isn't a valid project ID"
+    error = "Unfortunately, this isn't a valid project ID"
   }
 }
 ```
 
-## Legacy
-
-### Legacy parameters are unsupported now
-
-In Coder, workspaces using legacy parameters can't be deployed anymore. To address this, it is necessary to either remove or adjust incompatible templates.
-In some cases, deleting a workspace with a hard dependency on a legacy parameter may be challenging. To cleanup unsupported workspaces, administrators are advised to take the following actions for affected templates:
-
-1. Enable the `feature_use_managed_variables` provider flag.
-2. Ensure that every legacy variable block has defined missing default values, or convert it to `coder_parameter`.
-3. Push the new template version using UI or CLI.
-4. Update unsupported workspaces to the newest template version.
-5. Delete the affected workspaces that have been updated to the newest template version.
-
-### Migration
-
-> ⚠️ Migration is available until v0.24.0 (Jun 2023) release.
+## Terraform template-wide variables
 
-Terraform `variable` shouldn't be used for workspace scoped parameters anymore, and it's required to convert `variable` to `coder_parameter` resources. To make the migration smoother, there is a special property introduced -
-`legacy_variable` and `legacy_variable_name` , which can link `coder_parameter` with a legacy variable.
+As parameters are intended to be used only for workspace customization purposes,
+Terraform variables can be freely managed by the template author to build
+templates. Workspace users are not able to modify template variables.
 
 ```hcl
-variable "legacy_cpu" {
-  sensitive   = false
-  description = "CPU cores"
-  default     = 2
-}
-
-data "coder_parameter" "cpu" {
-  name        = "CPU cores"
-  type        = "number"
-  description = "Number of CPU cores"
-  mutable     = true
 
-  legacy_variable_name = "legacy_cpu"
-  legacy_variable = var.legacy_cpu
+variable "CLOUD_API_KEY" {
+  type        = string
+  description = "API key for the service"
+  default     = "1234567890"
+  sensitive   = true
 }
-```
-
-#### Steps
-
-1. Prepare and update a new template version:
-
-   - Add `coder_parameter` resource matching the legacy variable to migrate.
-   - Use `legacy_variable_name` and `legacy_variable` to link the `coder_parameter` to the legacy variable.
-   - Mark the new parameter as `mutable`, so that Coder will not block updating existing workspaces.
-
-2. Update all workspaces to the updated template version. Coder will populate the added `coder_parameter`s with values from legacy variables.
-3. Prepare another template version:
-
-   - Remove the migrated variables.
-   - Remove properties `legacy_variable` and `legacy_variable_name` from `coder_parameter`s.
-
-4. Update all workspaces to the updated template version (2nd).
-5. Prepare a third template version:
-
-   - Enable the `feature_use_managed_variables` provider flag to use managed Terraform variables for template customization. Once the flag is enabled, legacy variables won't be used.
-
-6. Update all workspaces to the updated template version (3rd).
-7. Delete legacy parameters.
 
-As a template improvement, the template author can consider making some of the new `coder_parameter` resources `mutable`.
-
-## Terraform template-wide variables
-
-> ⚠️ Flag `feature_use_managed_variables` is available until v0.25.0 (Jul 2023) release. After this release, template-wide Terraform variables will be enabled by default.
-
-As parameters are intended to be used only for workspace customization purposes, Terraform variables can be freely managed by the template author to build templates. Workspace users are not able to modify
-template variables.
-
-The template author can enable Terraform template-wide variables mode by specifying the following flag:
-
-```hcl
-provider "coder" {
-  feature_use_managed_variables = "true"
-}
 ```
-
-Once it's defined, coder will allow for modifying variables by using CLI and UI forms, but it will not be possible to use legacy parameters.
diff --git a/docs/templates/process-logging.md b/docs/templates/process-logging.md
new file mode 100644
index 0000000000000..51bf613238a44
--- /dev/null
+++ b/docs/templates/process-logging.md
@@ -0,0 +1,315 @@
+# Workspace Process Logging
+
+The workspace process logging feature allows you to log all system-level
+processes executing in the workspace.
+
+> **Note:** This feature is only available on Linux in Kubernetes. There are
+> additional requirements outlined further in this document.
+
+Workspace process logging adds a sidecar container to workspace pods that will
+log all processes started in the workspace container (e.g., commands executed in
+the terminal or processes created in the background by other processes).
+Processes launched inside containers or nested containers within the workspace
+are also logged. You can view the output from the sidecar or send it to a
+monitoring stack, such as CloudWatch, for further analysis or long-term storage.
+
+Please note that these logs are not recorded or captured by the Coder
+organization in any way, shape, or form.
+
+> This is an [Enterprise](https://coder.com/docs/v2/latest/enterprise) feature.
+> To learn more about Coder Enterprise, please
+> [contact sales](https://coder.com/contact).
+
+## How this works
+
+Coder uses [eBPF](https://ebpf.io/) (which we chose for its minimal performance
+impact) to perform in-kernel logging and filtering of all exec system calls
+originating from the workspace container.
+
+The core of this feature is also open source and can be found in the
+[exectrace](https://github.com/coder/exectrace) GitHub repo. The enterprise
+component (in the `enterprise/` directory of the repo) is responsible for
+starting the eBPF program with the correct filtering options for the specific
+workspace.
+
+## Requirements
+
+The host machine must be running a Linux kernel >= 5.8 with the kernel config
+`CONFIG_DEBUG_INFO_BTF=y` enabled.
+
+To check your kernel version, run:
+
+```shell
+uname -r
+```
+
+To validate the required kernel config is enabled, run either of the following
+commands on your nodes directly (_not_ from a workspace terminal):
+
+```shell
+cat /proc/config.gz | gunzip | grep CONFIG_DEBUG_INFO_BTF
+```
+
+```shell
+cat "/boot/config-$(uname -r)" | grep CONFIG_DEBUG_INFO_BTF
+```
+
+If these requirements are not met, workspaces will fail to start for security
+reasons.
+
+Your template must be a Kubernetes template. Workspace process logging is not
+compatible with the `sysbox-runc` runtime due to technical limitations, but it
+is compatible with our `envbox` template family.
+
+## Example templates
+
+We provide working example templates for Kubernetes, and Kubernetes with
+`envbox` (for [Docker support in workspaces](./docker-in-workspaces.md)). You
+can view these templates in the
+[exectrace repo](https://github.com/coder/exectrace/tree/main/enterprise/templates).
+
+## Configuring custom templates to use workspace process logging
+
+If you have an existing Kubernetes or Kubernetes with `envbox` template that you
+would like to add workspace process logging to, follow these steps:
+
+1. Ensure the image used in your template has `curl` installed.
+
+1. Add the following section to your template's `main.tf` file:
+
+   <!--
+     If you are updating this section, please also update the example templates
+     in the exectrace repo.
+   -->
+
+   ```hcl
+   locals {
+     # This is the init script for the main workspace container that runs before the
+     # agent starts to configure workspace process logging.
+     exectrace_init_script = <<EOT
+       set -eu
+       pidns_inum=$(readlink /proc/self/ns/pid | sed 's/[^0-9]//g')
+       if [ -z "$pidns_inum" ]; then
+         echo "Could not determine process ID namespace inum"
+         exit 1
+       fi
+
+       # Before we start the script, does curl exist?
+       if ! command -v curl >/dev/null 2>&1; then
+         echo "curl is required to download the Coder binary"
+         echo "Please install curl to your image and try again"
+         # 127 is command not found.
+         exit 127
+       fi
+
+       echo "Sending process ID namespace inum to exectrace sidecar"
+       rc=0
+       max_retry=5
+       counter=0
+       until [ $counter -ge $max_retry ]; do
+         set +e
+         curl \
+           --fail \
+           --silent \
+           --connect-timeout 5 \
+           -X POST \
+           -H "Content-Type: text/plain" \
+           --data "$pidns_inum" \
+           http://127.0.0.1:56123
+         rc=$?
+         set -e
+         if [ $rc -eq 0 ]; then
+           break
+         fi
+
+         counter=$((counter+1))
+         echo "Curl failed with exit code $${rc}, attempt $${counter}/$${max_retry}; Retrying in 3 seconds..."
+         sleep 3
+       done
+       if [ $rc -ne 0 ]; then
+         echo "Failed to send process ID namespace inum to exectrace sidecar"
+         exit $rc
+       fi
+
+     EOT
+   }
+   ```
+
+1. Update the `command` of your workspace container like the following:
+
+   <!--
+     If you are updating this section, please also update the example templates
+     in the exectrace repo.
+   -->
+
+   ```hcl
+   resource "kubernetes_pod" "main" {
+     ...
+     spec {
+       ...
+       container {
+         ...
+         // NOTE: this command is changed compared to the upstream kubernetes
+         // template
+         command = [
+           "sh",
+           "-c",
+           "${local.exectrace_init_script}\n\n${coder_agent.main.init_script}",
+         ]
+         ...
+       }
+       ...
+     }
+     ...
+   }
+   ```
+
+   > **Note:** If you are using the `envbox` template, you will need to update
+   > the third argument to be
+   > `"${local.exectrace_init_script}\n\nexec /envbox docker"` instead.
+
+1. Add the following container to your workspace pod spec.
+
+   <!--
+     If you are updating this section, please also update the example templates
+     in the exectrace repo.
+   -->
+
+   ```hcl
+   resource "kubernetes_pod" "main" {
+     ...
+     spec {
+       ...
+       // NOTE: this container is added compared to the upstream kubernetes
+       // template
+       container {
+         name              = "exectrace"
+         image             = "ghcr.io/coder/exectrace:latest"
+         image_pull_policy = "Always"
+         command = [
+           "/opt/exectrace",
+           "--init-address", "127.0.0.1:56123",
+           "--label", "workspace_id=${data.coder_workspace.me.id}",
+           "--label", "workspace_name=${data.coder_workspace.me.name}",
+           "--label", "user_id=${data.coder_workspace.me.owner_id}",
+           "--label", "username=${data.coder_workspace.me.owner}",
+           "--label", "user_email=${data.coder_workspace.me.owner_email}",
+         ]
+         security_context {
+           // exectrace must be started as root so it can attach probes into the
+           // kernel to record process events with high throughput.
+           run_as_user  = "0"
+           run_as_group = "0"
+           // exectrace requires a privileged container so it can control mounts
+           // and perform privileged syscalls against the host kernel to attach
+           // probes.
+           privileged = true
+         }
+       }
+       ...
+     }
+     ...
+   }
+   ```
+
+   > **Note:** `exectrace` requires root privileges and a privileged container
+   > to attach probes to the kernel. This is a requirement of eBPF.
+
+1. Add the following environment variable to your workspace pod:
+
+   <!--
+     If you are updating this section, please also update the example templates
+     in the exectrace repo.
+   -->
+
+   ```hcl
+   resource "kubernetes_pod" "main" {
+     ...
+     spec {
+       ...
+       env {
+         name = "CODER_AGENT_SUBSYSTEM"
+         value = "exectrace"
+       }
+       ...
+     }
+     ...
+   }
+   ```
+
+Once you have made these changes, you can push a new version of your template
+and workspace process logging will be enabled for all workspaces once they are
+restarted.
+
+## Viewing workspace process logs
+
+To view the process logs for a specific workspace you can use `kubectl` to print
+the logs:
+
+```bash
+kubectl logs pod-name --container exectrace
+```
+
+The raw logs will look something like this:
+
+```json
+{
+  "ts": "2022-02-28T20:29:38.038452202Z",
+  "level": "INFO",
+  "msg": "exec",
+  "fields": {
+    "labels": {
+      "user_email": "jessie@coder.com",
+      "user_id": "5e876e9a-121663f01ebd1522060d5270",
+      "username": "jessie",
+      "workspace_id": "621d2e52-a6987ef6c56210058ee2593c",
+      "workspace_name": "main"
+    },
+    "cmdline": "uname -a",
+    "event": {
+      "filename": "/usr/bin/uname",
+      "argv": ["uname", "-a"],
+      "truncated": false,
+      "pid": 920684,
+      "uid": 101000,
+      "gid": 101000,
+      "comm": "bash"
+    }
+  }
+}
+```
+
+### View logs in AWS EKS
+
+If you're using AWS' Elastic Kubernetes Service, you can
+[configure your cluster](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Container-Insights-EKS-logs.html)
+to send logs to CloudWatch. This allows you to view the logs for a specific user
+or workspace.
+
+To view your logs, go to the CloudWatch dashboard (which is available on the
+**Log Insights** tab) and run a query similar to the following:
+
+```text
+fields @timestamp, log_processed.fields.cmdline
+| sort @timestamp asc
+| filter kubernetes.container_name="exectrace"
+| filter log_processed.fields.labels.username="zac"
+| filter log_processed.fields.labels.workspace_name="code"
+```
+
+## Usage considerations
+
+- The sidecar attached to each workspace is a privileged container, so you may
+  need to review your organization's security policies before enabling this
+  feature. Enabling workspace process logging does _not_ grant extra privileges
+  to the workspace container itself, however.
+- `exectrace` will log processes from nested Docker containers (including deeply
+  nested containers) correctly, but Coder does not distinguish between processes
+  started in the workspace and processes started in a child container in the
+  logs.
+- With `envbox` workspaces, this feature will detect and log startup processes
+  begun in the outer container (including container initialization processes).
+- Because this feature logs **all** processes in the workspace, high levels of
+  usage (e.g., during a `make` run) will result in an abundance of output in the
+  sidecar container. Depending on how your Kubernetes cluster is configured, you
+  may incur extra charges from your cloud provider to store the additional logs.
diff --git a/docs/templates/resource-metadata.md b/docs/templates/resource-metadata.md
index ef267cdf33113..d597aea1bbfb9 100644
--- a/docs/templates/resource-metadata.md
+++ b/docs/templates/resource-metadata.md
@@ -1,26 +1,29 @@
 # Resource Metadata
 
-Expose key workspace information to your users via [`coder_metadata`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/metadata) resources in your template code.
+Expose key workspace information to your users with
+[`coder_metadata`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/metadata)
+resources in your template code.
 
-![ui](../images/metadata-ui.png)
-
-<blockquote class="info">
-Coder automatically generates the <code>type</code> metadata.
-</blockquote>
-
-You can use `coder_metadata` to show
+You can use `coder_metadata` to show Terraform resource attributes like these:
 
 - Compute resources
 - IP addresses
 - [Secrets](../secrets.md#displaying-secrets)
 - Important file paths
 
-and any other Terraform resource attribute.
+![ui](../images/metadata-ui.png)
+
+<blockquote class="info">
+Coder automatically generates the <code>type</code> metadata.
+</blockquote>
+
+You can also present automatically updating, dynamic values with
+[agent metadata](./agent-metadata.md).
 
 ## Example
 
-Expose the disk size, deployment name, and persistent
-directory in a Kubernetes template with:
+Expose the disk size, deployment name, and persistent directory in a Kubernetes
+template with:
 
 ```hcl
 resource "kubernetes_persistent_volume_claim" "root" {
@@ -55,9 +58,11 @@ resource "coder_metadata" "deployment" {
 }
 ```
 
-## Hiding resources in the UI
+## Hiding resources in the dashboard
 
-Some resources don't need to be exposed in the UI; this helps keep the workspace view clean for developers. To hide a resource, use the `hide` attribute:
+Some resources don't need to be exposed in the dashboard's UI. This helps keep
+the workspace view clean for developers. To hide a resource, use the `hide`
+attribute:
 
 ```hcl
 resource "coder_metadata" "hide_serviceaccount" {
@@ -71,9 +76,10 @@ resource "coder_metadata" "hide_serviceaccount" {
 }
 ```
 
-## Using custom resource icon
+## Using a custom resource icon
 
-To use custom icons on your resources, use the `icon` attribute (must be a valid path or URL):
+To use custom icons for your resource metadata, use the `icon` attribute. It
+must be a valid path or URL.
 
 ```hcl
 resource "coder_metadata" "resource_with_icon" {
@@ -87,7 +93,8 @@ resource "coder_metadata" "resource_with_icon" {
 }
 ```
 
-To make easier for you to customize your resource we added some built-in icons:
+To make it easier for you to customize your resource we added some built-in
+icons:
 
 - Folder `/icon/folder.svg`
 - Memory `/icon/memory.svg`
@@ -95,30 +102,10 @@ To make easier for you to customize your resource we added some built-in icons:
 - Widgets `/icon/widgets.svg`
 - Database `/icon/database.svg`
 
-We also have other icons related to the IDEs. You can see all the icons [here](https://github.com/coder/coder/tree/main/site/static/icon).
-
-## Agent Metadata
-
-In cases where you want to present automatically updating, dynamic values. You
-can use the `metadata` block in the `coder_agent` resource. For example:
-
-```hcl
-resource "coder_agent" "dev" {
-  os   = "linux"
-  arch = "amd64"
-  dir  = "/workspace"
-  metadata {
-    name = "Process Count"
-    script = "ps aux | wc -l"
-    interval = 1
-    timeout = 3
-  }
-}
-```
-
-Read more [here](./agent-metadata.md).
+We also have other icons related to the IDEs. You can see more information on
+how to use the builtin icons [here](./icons.md).
 
 ## Up next
 
-- Learn about [secrets](../secrets.md)
-- Learn about [Agent Metadata](./agent-metadata.md)
+- [Secrets](../secrets.md)
+- [Agent metadata](./agent-metadata.md)
diff --git a/docs/templates/resource-persistence.md b/docs/templates/resource-persistence.md
index 97233460f3fdd..4ca38a6d397d9 100644
--- a/docs/templates/resource-persistence.md
+++ b/docs/templates/resource-persistence.md
@@ -1,24 +1,28 @@
-# Resource Persistence
+# Resource persistence
 
-Coder templates have full control over workspace ephemerality. In a
-completely ephemeral workspace, there are zero resources in the Off state. In
-a completely persistent workspace, there is no difference between the Off and
-On states.
+By default, all Coder resources are persistent, but production templates
+**must** use the practices laid out in this document to prevent accidental
+deletion.
 
-Most workspaces fall somewhere in the middle, persisting user data
-such as filesystem volumes, but deleting expensive, reproducible resources
-such as compute instances.
+Coder templates have full control over workspace ephemerality. In a completely
+ephemeral workspace, there are zero resources in the Off state. In a completely
+persistent workspace, there is no difference between the Off and On states.
 
-By default, all Coder resources are persistent, but
-production templates **must** employ the practices laid out in this document
-to prevent accidental deletion.
+The needs of most workspaces fall somewhere in the middle, persisting user data
+like filesystem volumes, but deleting expensive, reproducible resources such as
+compute instances.
 
-## Disabling Persistence
+## Disabling persistence
 
-The [`coder_workspace` data source](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace) exposes the `start_count = [0 | 1]` attribute that other
-resources reference to become ephemeral.
+The Terraform
+[`coder_workspace` data source](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace)
+exposes the `start_count = [0 | 1]` attribute. To make a resource ephemeral, you
+can assign the `start_count` attribute to resource's
+[`count`](https://developer.hashicorp.com/terraform/language/meta-arguments/count)
+meta-argument.
 
-For example:
+In this example, Coder will provision or tear down the `docker_container`
+resource:
 
 ```hcl
 data "coder_workspace" "me" {
@@ -31,7 +35,7 @@ resource "docker_container" "workspace" {
 }
 ```
 
-## ⚠️ Persistence Pitfalls
+## ⚠️ Persistence pitfalls
 
 Take this example resource:
 
@@ -45,10 +49,10 @@ resource "docker_volume" "home_volume" {
 ```
 
 Because we depend on `coder_workspace.me.owner`, if the owner changes their
-username, Terraform would recreate the volume (wiping its data!) the next
-time the workspace restarts.
+username, Terraform will recreate the volume (wiping its data!) the next time
+that Coder starts the workspace.
 
-Therefore, persistent resource names must only depend on immutable IDs such as:
+To prevent this, use immutable IDs:
 
 - `coder_workspace.me.owner_id`
 - `coder_workspace.me.id`
@@ -66,10 +70,13 @@ resource "docker_volume" "home_volume" {
 
 ## 🛡 Bulletproofing
 
-Even if our persistent resource depends exclusively on static IDs, a change to
-the `name` format or other attributes would cause Terraform to rebuild the resource.
+Even if your persistent resource depends exclusively on immutable IDs, a change
+to the `name` format or other attributes would cause Terraform to rebuild the
+resource.
 
-Prevent Terraform from recreating the resource under any circumstance by setting the [`ignore_changes = all` directive in the `lifecycle` block](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes).
+You can prevent Terraform from recreating a resource under any circumstance by
+setting the
+[`ignore_changes = all` directive in the `lifecycle` block](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes).
 
 ```hcl
 data "coder_workspace" "me" {
@@ -84,7 +91,3 @@ resource "docker_volume" "home_volume" {
   }
 }
 ```
-
-## Up next
-
-- [Templates](../templates/index.md)
diff --git a/docs/templates/tour.md b/docs/templates/tour.md
new file mode 100644
index 0000000000000..28bd14a071f21
--- /dev/null
+++ b/docs/templates/tour.md
@@ -0,0 +1,418 @@
+# A guided tour of a template
+
+This guided tour introduces you to the different parts of a Coder template by
+showing you how to create a template from scratch.
+
+You'll write a simple template that provisions a workspace as a Docker container
+with Ubuntu. This simple template is based on the same Docker starter template
+that the [tutorial](./tutorial.md) uses.
+
+## Before you start
+
+To follow this guide, you'll need:
+
+- A computer or cloud computing instance with both
+  [Docker](https://docs.docker.com/get-docker/) and [Coder](../install/index.md)
+  installed on it.
+
+> When setting up your computer or computing instance, make sure to install
+> Docker first, then Coder.
+
+- The URL for your Coder instance. If you're running Coder locally, the default
+  URL is [http://127.0.0.1:3000](http://127.0.0.1:3000).
+
+- A text editor. For this tour, we use [GNU nano](https://nano-editor.org/).
+
+> Haven't written Terraform before? Check out Hashicorp's
+> [Getting Started Guides](https://developer.hashicorp.com/terraform/tutorials).
+
+## What's in a template
+
+The main part of a Coder template is a [Terraform](https://terraform.io) `tf`
+file. A Coder template often has other files to configure the other resources
+that the template needs. In this tour you'll also create a `Dockerfile`.
+
+Coder can provision all Terraform modules, resources, and properties. The Coder
+server essentially runs a `terraform apply` every time a workspace is created,
+started, or stopped.
+
+Here's a simplified diagram that shows the main parts of the template we'll
+create.
+
+![Template architecture](../images/templates/template-architecture.png)
+
+## 1. Create template files
+
+On your local computer, create a directory for your template and create the
+`Dockerfile`.
+
+```shell
+mkdir template-tour
+cd template-tour
+mkdir build
+nano build/Dockerfile
+```
+
+You'll enter a simple `Dockerfile` that starts with the
+[official Ubuntu image](https://hub.docker.com/_/ubuntu/). In the editor, enter
+and save the following text in `Dockerfile` then exit the editor:
+
+```dockerfile
+FROM ubuntu
+
+RUN apt-get update \
+	&& apt-get install -y \
+	sudo \
+	curl \
+	&& rm -rf /var/lib/apt/lists/*
+
+ARG USER=coder
+RUN useradd --groups sudo --no-create-home --shell /bin/bash ${USER} \
+	&& echo "${USER} ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/${USER} \
+	&& chmod 0440 /etc/sudoers.d/${USER}
+USER ${USER}
+WORKDIR /home/${USER}
+
+```
+
+Notice how `Dockerfile` adds a few things to the parent `ubuntu` image, which
+your template needs later:
+
+- It installs the `sudo` and `curl` packages.
+- It adds a `coder` user, including a home directory.
+
+## 2. Set up template providers
+
+Now you can edit the Terraform file, which provisions the workspace's resources.
+
+```shell
+nano main.tf
+```
+
+We'll start by setting up our providers. At a minimum, we need the `coder`
+provider. For this template, we also need the `docker` provider:
+
+```hcl
+terraform {
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = "~> 0.8.3"
+    }
+    docker = {
+      source  = "kreuzwerker/docker"
+      version = "~> 3.0.1"
+    }
+  }
+}
+
+provider "coder" {
+}
+
+provider "docker" {
+}
+
+locals {
+  username = data.coder_workspace.me.owner
+}
+
+data "coder_provisioner" "me" {
+}
+
+data "coder_workspace" "me" {
+}
+
+```
+
+Notice that the `provider` blocks for `coder` and `docker` are empty. In a more
+practical template, you would add arguments to these blocks to configure the
+providers, if needed.
+
+The
+[`coder_workspace`](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace)
+data source provides details about the state of a workspace, such as its name,
+owner, and so on. The data source also lets us know when a workspace is being
+started or stopped. We'll take advantage of this information in later steps to
+do these things:
+
+- Set some environment variables based on the workspace owner.
+- Manage ephemeral and persistent storage.
+
+## 3. coder_agent
+
+All templates need to create and run a
+[Coder agent](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent).
+This lets developers connect to their workspaces. The `coder_agent` resource
+runs inside the compute aspect of your workspace, typically a VM or container.
+In our case, it will run in Docker.
+
+You do not need to have any open ports on the compute aspect, but the agent
+needs `curl` access to the Coder server. Remember that we installed `curl` in
+`Dockerfile`, earlier.
+
+This snippet creates the agent:
+
+```hcl
+resource "coder_agent" "main" {
+  arch                   = data.coder_provisioner.me.arch
+  os                     = "linux"
+  startup_script_timeout = 180
+  startup_script         = <<-EOT
+    set -e
+
+    # install and start code-server
+    curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server --version 4.11.0
+    /tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &
+  EOT
+
+  env = {
+    GIT_AUTHOR_NAME = "${data.coder_workspace.me.owner}"
+    GIT_COMMITTER_NAME = "${data.coder_workspace.me.owner}"
+    GIT_AUTHOR_EMAIL = "${data.coder_workspace.me.owner_email}"
+    GIT_COMMITTER_EMAIL = "${data.coder_workspace.me.owner_email}"
+  }
+
+  metadata {
+    display_name = "CPU Usage"
+    key          = "0_cpu_usage"
+    script       = "coder stat cpu"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "RAM Usage"
+    key          = "1_ram_usage"
+    script       = "coder stat mem"
+    interval     = 10
+    timeout      = 1
+  }
+}
+
+```
+
+Because Docker is running locally in the Coder server, there is no need to
+authenticate `coder_agent`. But if your `coder_agent` were running on a remote
+host, your template would need
+[authentication credentials](./authentication.md).
+
+This template's agent also runs a startup script, sets environment variables,
+and provides metadata.
+
+The
+[`startup script`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script)
+installs [code-server](https://coder.com/docs/code-server), a browser-based
+[VS Code](https://code.visualstudio.com/) app that runs in the workspace. We'll
+give users access to code-server through `coder_app`, later.
+
+The
+[`env`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#env)
+block sets environments variables for the workspace. We use the data source from
+`coder_workspace` to set the environment variables based on the workspace's
+owner. This way, the owner can make git commits immediately without any manual
+configuration.
+
+Your template can use metadata to show information to the workspace owner. Coder
+displays this metadata in the Coder dashboard. Our template has
+[`metadata`](./agent-metadata.md) blocks for CPU and RAM usage.
+
+## 4. coder_app
+
+A
+[`coder_app`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/app)
+resource lets a developer use an app from the workspace's Coder dashboard.
+
+![Apps in a Coder workspace](../images/templates/workspace-apps.png)
+
+This is commonly used for [web IDEs](../ides/web-ides.md) such as
+[code-server](https://coder.com/docs/code-server/latest), RStudio, and
+JupyterLab.
+
+To install and code-server in the workspace, remember that we installed it in
+the `startup_script` argument in `coder_agent`. We make it available from a
+workspace with a `coder_app` resource. See [web IDEs](../ides/web-ides.md) for
+more examples.
+
+```hcl
+resource "coder_app" "code-server" {
+  agent_id     = coder_agent.main.id
+  slug         = "code-server"
+  display_name = "code-server"
+  url          = "http://localhost:13337/?folder=/home/${local.username}"
+  icon         = "/icon/code.svg"
+  subdomain    = false
+  share        = "owner"
+
+  healthcheck {
+    url       = "http://localhost:13337/healthz"
+    interval  = 5
+    threshold = 6
+  }
+}
+
+```
+
+You can also use a `coder_app` resource to link to external apps, such as links
+to wikis or cloud consoles.
+
+```hcl
+resource "coder_app" "coder-server-doc" {
+  agent_id     = coder_agent.main.id
+  icon         = "/emojis/1f4dd.png"
+  slug         = "getting-started"
+  url          = "https://coder.com/docs/code-server"
+  external     = true
+}
+
+```
+
+## 5. Persistent and ephemeral resources
+
+Managing the lifecycle of template resources is important. We want to make sure
+that workspaces use computing, storage, and other services efficiently.
+
+We want our workspace's home directory to persist after the workspace is stopped
+so that a developer can continue their work when they start the workspace again.
+
+We do this in 2 parts:
+
+- Our `docker_volume` resource uses the `lifecycle` block with the
+  `ignore_changes = all` argument to prevent accidental deletions.
+- To prevent Terraform from destroying persistent Docker volumes in case of a
+  workspace name change, we use an immutable parameter, like
+  `data.coder_workspace.me.id`.
+
+You'll see later that we make sure that our Docker container is ephemeral with
+the Terraform
+[count](https://developer.hashicorp.com/terraform/language/meta-arguments/count)
+meta-argument.
+
+```hcl
+resource "docker_volume" "home_volume" {
+  name = "coder-${data.coder_workspace.me.id}-home"
+  # Protect the volume from being deleted due to changes in attributes.
+  lifecycle {
+    ignore_changes = all
+  }
+}
+
+```
+
+For details, see [Resource persistence](./resource-persistence.md).
+
+## 6. Set up the Docker container
+
+To set up our Docker container, our template has a `docker_image` resource that
+uses `build/Dockerfile`, which we created earlier.
+
+```hcl
+resource "docker_image" "main" {
+  name = "coder-${data.coder_workspace.me.id}"
+  build {
+    context = "./build"
+    build_args = {
+      USER = local.username
+    }
+  }
+  triggers = {
+    dir_sha1 = sha1(join("", [for f in fileset(path.module, "build/*") : filesha1(f)]))
+  }
+}
+
+```
+
+Our `docker_container` resource uses `coder_workspace` `start_count` to start
+and stop the Docker container:
+
+```hcl
+resource "docker_container" "workspace" {
+  count = data.coder_workspace.me.start_count
+  image = docker_image.main.name
+  # Uses lower() to avoid Docker restriction on container names.
+  name = "coder-${data.coder_workspace.me.owner}-${lower(data.coder_workspace.me.name)}"
+  # Hostname makes the shell more user friendly: coder@my-workspace:~$
+  hostname = data.coder_workspace.me.name
+  # Use the docker gateway if the access URL is 127.0.0.1
+  entrypoint = ["sh", "-c", replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal")]
+  env = [
+    "CODER_AGENT_TOKEN=${coder_agent.main.token}",
+  ]
+  host {
+    host = "host.docker.internal"
+    ip   = "host-gateway"
+  }
+  volumes {
+    container_path = "/home/${local.username}"
+    volume_name    = docker_volume.home_volume.name
+    read_only      = false
+  }
+}
+
+```
+
+## 7. Create the template in Coder
+
+Save `main.tf` and exit the editor.
+
+Now that we've created the files for our template, we can add them to our Coder
+deployment.
+
+We can do this with the Coder CLI or the Coder dashboard. For this tour, we'll
+use the Coder CLI.
+
+First, you'll need to log in to your Coder deployment from the CLI. This is
+where you need the URL for your deployment:
+
+```console
+$ coder login https://coder.example.com
+Your browser has been opened to visit:
+
+        https://coder.example.com/cli-auth
+
+> Paste your token here:
+```
+
+In your web browser, enter your credentials:
+
+![Logging in to your Coder deployment](../images/templates/coder-login-web.png)
+
+Copy the session token into the clipboard:
+
+![Logging in to your Coder deployment](../images/templates/coder-session-token.png)
+
+And paste it into the CLI:
+
+```
+> Welcome to Coder, marc! You're authenticated.
+$
+```
+
+Now you can add your template files to your Coder deployment:
+
+```console
+$ pwd
+/home/marc/template-tour
+$ coder templates create
+> Upload "."? (yes/no) yes
+```
+
+The Coder CLI tool gives progress information then prompts you to confirm:
+
+```console
+> Confirm create? (yes/no) yes
+
+The template-tour template has been created! Developers can provision a workspace with this template using:
+
+   coder create --template="template-tour" [workspace name]
+```
+
+In your web browser, log in to your Coder dashboard, select **Templates**. Your
+template is ready to use for new workspaces.
+
+![Your new template, ready to use](../images/templates/template-tour.png)
+
+## Next steps
+
+- [Setting up templates](./best-practices.md)
+- [Customizing templates](./customizing.md)
+- [Troubleshooting template](./troubleshooting.md)
diff --git a/docs/templates/troubleshooting.md b/docs/templates/troubleshooting.md
new file mode 100644
index 0000000000000..2c406824ecec7
--- /dev/null
+++ b/docs/templates/troubleshooting.md
@@ -0,0 +1,152 @@
+# Troubleshooting templates
+
+Occasionally, you may run into scenarios where a workspace is created, but the
+agent is either not connected or the
+[startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script)
+has failed or timed out.
+
+## Agent connection issues
+
+If the agent is not connected, it means the agent or
+[init script](https://github.com/coder/coder/tree/main/provisionersdk/scripts)
+has failed on the resource.
+
+```console
+$ coder ssh myworkspace
+⢄⡱ Waiting for connection from [agent]...
+```
+
+While troubleshooting steps vary by resource, here are some general best
+practices:
+
+- Ensure the resource has `curl` installed (alternatively, `wget` or `busybox`)
+- Ensure the resource can `curl` your Coder
+  [access URL](../admin/configure.md#access-url)
+- Manually connect to the resource and check the agent logs (e.g.,
+  `kubectl exec`, `docker exec` or AWS console)
+  - The Coder agent logs are typically stored in `/tmp/coder-agent.log`
+  - The Coder agent startup script logs are typically stored in
+    `/tmp/coder-startup-script.log`
+  - The Coder agent shutdown script logs are typically stored in
+    `/tmp/coder-shutdown-script.log`
+- This can also happen if the websockets are not being forwarded correctly when
+  running Coder behind a reverse proxy.
+  [Read our reverse-proxy docs](../admin/configure.md#tls--reverse-proxy)
+
+## Startup script issues
+
+Depending on the contents of the
+[startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script),
+and whether or not the
+[startup script behavior](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script_behavior)
+is set to blocking or non-blocking, you may notice issues related to the startup
+script. In this section we will cover common scenarios and how to resolve them.
+
+### Unable to access workspace, startup script is still running
+
+If you're trying to access your workspace and are unable to because the
+[startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script)
+is still running, it means the
+[startup script behavior](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script_behavior)
+option is set to blocking or you have enabled the `--wait=yes` option (for e.g.
+`coder ssh` or `coder config-ssh`). In such an event, you can always access the
+workspace by using the web terminal, or via SSH using the `--wait=no` option. If
+the startup script is running longer than it should, or never completing, you
+can try to [debug the startup script](#debugging-the-startup-script) to resolve
+the issue. Alternatively, you can try to force the startup script to exit by
+terminating processes started by it or terminating the startup script itself (on
+Linux, `ps` and `kill` are useful tools).
+
+For tips on how to write a startup script that doesn't run forever, see the
+[`startup_script`](#startup_script) section. For more ways to override the
+startup script behavior, see the
+[`startup_script_behavior`](#startup_script_behavior) section.
+
+Template authors can also set the
+[startup script behavior](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script_behavior)
+option to non-blocking, which will allow users to access the workspace while the
+startup script is still running. Note that the workspace must be updated after
+changing this option.
+
+### Your workspace may be incomplete
+
+If you see a warning that your workspace may be incomplete, it means you should
+be aware that programs, files, or settings may be missing from your workspace.
+This can happen if the
+[startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script)
+is still running or has exited with a non-zero status (see
+[startup script error](#startup-script-error)). No action is necessary, but you
+may want to
+[start a new shell session](#session-was-started-before-the-startup-script-finished-web-terminal)
+after it has completed or check the
+[startup script logs](#debugging-the-startup-script) to see if there are any
+issues.
+
+### Session was started before the startup script finished
+
+The web terminal may show this message if it was started before the
+[startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script)
+finished, but the startup script has since finished. This message can safely be
+dismissed, however, be aware that your preferred shell or dotfiles may not yet
+be activated for this shell session. You can either start a new session or
+source your dotfiles manually. Note that starting a new session means that
+commands running in the terminal will be terminated and you may lose unsaved
+work.
+
+Examples for activating your preferred shell or sourcing your dotfiles:
+
+- `exec zsh -l`
+- `source ~/.bashrc`
+
+### Startup script exited with an error
+
+When the
+[startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script)
+exits with an error, it means the last command run by the script failed. When
+`set -e` is used, this means that any failing command will immediately exit the
+script and the remaining commands will not be executed. This also means that
+[your workspace may be incomplete](#your-workspace-may-be-incomplete). If you
+see this error, you can check the
+[startup script logs](#debugging-the-startup-script) to figure out what the
+issue is.
+
+Common causes for startup script errors:
+
+- A missing command or file
+- A command that fails due to missing permissions
+- Network issues (e.g., unable to reach a server)
+
+### Debugging the startup script
+
+The simplest way to debug the
+[startup script](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#startup_script)
+is to open the workspace in the Coder dashboard and click "Show startup log" (if
+not already visible). This will show all the output from the script. Another
+option is to view the log file inside the workspace (usually
+`/tmp/coder-startup-script.log`). If the logs don't indicate what's going on or
+going wrong, you can increase verbosity by adding `set -x` to the top of the
+startup script (note that this will show all commands run and may output
+sensitive information). Alternatively, you can add `echo` statements to show
+what's going on.
+
+Here's a short example of an informative startup script:
+
+```shell
+echo "Running startup script..."
+echo "Run: long-running-command"
+/path/to/long-running-command
+status=$?
+echo "Done: long-running-command, exit status: ${status}"
+if [ $status -ne 0 ]; then
+  echo "Startup script failed, exiting..."
+  exit $status
+fi
+```
+
+> **Note:** We don't use `set -x` here because we're manually echoing the
+> commands. This protects against sensitive information being shown in the log.
+
+This script tells us what command is being run and what the exit status is. If
+the exit status is non-zero, it means the command failed and we exit the script.
+Since we are manually checking the exit status here, we don't need `set -e` at
+the top of the script to exit on error.
diff --git a/docs/templates/tutorial.md b/docs/templates/tutorial.md
new file mode 100644
index 0000000000000..7063b7b288e7d
--- /dev/null
+++ b/docs/templates/tutorial.md
@@ -0,0 +1,130 @@
+# Your first template
+
+A common way to create a template is to begin with a starter template then
+modify it for your needs. Coder makes this easy with starter templates for
+popular development targets like Docker, Kubernetes, Azure, and so on. Once your
+template is up and running, you can edit it in the Coder dashboard. Coder even
+handles versioning for you so you can publish official updates or revert to
+previous versions.
+
+In this tutorial, you'll create your first template from the Docker starter
+template.
+
+## Before you start
+
+You'll need a computer or cloud computing instance with both
+[Docker](https://docs.docker.com/get-docker/) and [Coder](../install/index.md)
+installed on it.
+
+> When setting up your computer or computing instance, make sure to install
+> Docker first, then Coder.
+
+## 1. Log in to Coder
+
+In your web browser, go to your Coder dashboard to log in.
+
+## 2. Choose a starter template
+
+Select **Templates** > **Starter Templates**.
+
+![Starter Templates button](../images/templates/starter-templates-button.png)
+
+In **Filter**, select **Docker** then select **Develop in Docker**.
+
+![Choosing a starter template](../images/templates/develop-in-docker-template.png)
+
+Select **Use template**.
+
+![Using a starter template](../images/templates/use-template.png)
+
+## 3. Create your template
+
+In **Create template**, fill in **Name** and **Display name**,then scroll down
+and select **Create template**.
+
+![Creating a template](../images/templates/create-template.png)
+
+## 4. Create a workspace from your template
+
+When the template is ready, select **Create Workspace**.
+
+![Create workspace](../images/templates/create-workspace.png)
+
+In **New workspace**, fill in **Name** then scroll down to select **Create
+Workspace**.
+
+![New workspace](../images/templates/new-workspace.png)
+
+Coder starts your new workspace from your template.
+
+After a few seconds, your workspace is ready to use.
+
+![Workspace is ready](../images/templates/workspace-ready.png)
+
+## 5. Try out your new workspace
+
+This starter template lets you connect to your workspace in a few ways:
+
+- VS Code Desktop: Loads your workspace into
+  [VS Code Desktop](https://code.visualstudio.com/Download) installed on your
+  local computer.
+- code-server: Opens [browser-based VS Code](../ides/web-ides.md) with your
+  workspace.
+- Terminal: Opens a browser-based terminal with a shell in the workspace's
+  Docker instance.
+- SSH: Use SSH to log in to the workspace from your local machine. If you
+  haven't already, you'll have to install Coder on your local machine to
+  configure your SSH client.
+
+> **Tip**: You can edit the template to let developers connect to a workspace in
+> [a few more ways](../ides.md).
+
+When you're done, you can stop the workspace.
+
+## 6. Modify your template
+
+Now you can modify your template to suit your team's needs.
+
+Let's replace the `golang` package in the Docker image with the `python3`
+package. You can do this by editing the template's `Dockerfile` directly in your
+web browser.
+
+In the Coder dashboard, select **Templates** then your first template.
+
+![Selecting the first template](../images/templates/select-template.png)
+
+In the drop-down menu, select **Edit files**.
+
+![Edit template files](../images/templates/edit-files.png)
+
+Expand the **build** directory and select **Dockerfile**.
+
+![Selecting source code](../images/templates/source-code.png)
+
+Edit `build/Dockerfile` to replace `golang` with `python3`.
+
+![Editing source code](../images/templates/edit-source-code.png)
+
+Select **Build template** and wait for Coder to prepare the template for
+workspaces.
+
+![Building a template](../images/templates/build-template.png)
+
+Select **Publish version**. In the **Publish new version** dialog, make sure
+**Promote to default version** is checked then select **Publish**.
+
+![Publish a template](../images/templates/publish.png)
+
+Now when developers create a new workspace from this template, they can use
+Python 3 instead of Go.
+
+For developers with workspaces that were created with a previous version of your
+template, Coder will notify them that there's a new version of the template.
+
+You can also handle [change management](./change-management.md) through your own
+repo and continuous integration.
+
+## Next steps
+
+- [Write your own template](./tour.md)
+- [Setting up templates](./best-practices.md)
diff --git a/docs/workspaces.md b/docs/workspaces.md
index 757f0b02d75bc..ad5001ee82cfe 100644
--- a/docs/workspaces.md
+++ b/docs/workspaces.md
@@ -1,13 +1,30 @@
 # Workspaces
 
-Workspaces contain the IDEs, dependencies, and configuration information needed
-for software development.
+A workspace is the environment that a developer works in. Developers in a team
+each work from their own workspace and can use [multiple IDEs](./ides.md).
 
-## Create workspaces
+A developer creates a workspace from a [shared template](./templates/index.md).
+This lets an entire team work in environments that are identically configured
+and provisioned with the same resources.
 
-Each Coder user has their own workspaces created from [shared templates](./templates/index.md):
+## Creating workspaces
 
-```console
+You can create a workspace in the UI. Log in to your Coder instance, go to the
+**Templates** tab, find the template you need, and select **Create Workspace**.
+
+![Creating a workspace in the UI](./images/creating-workspace-ui.png)
+
+When you create a workspace, you will be prompted to give it a name. You might
+also be prompted to set some parameters that the template provides.
+
+You can manage your existing templates in the **Workspaces** tab.
+
+You can also create a workspace from the command line:
+
+Each Coder user has their own workspaces created from
+[shared templates](./templates/index.md):
+
+```shell
 # create a workspace from the template; specify any variables
 coder create --template="<templateName>" <workspaceName>
 
@@ -15,76 +32,128 @@ coder create --template="<templateName>" <workspaceName>
 coder show <workspace-name>
 ```
 
-## IDEs
-
-Coder [supports multiple IDEs](./ides.md) for use with your workspaces.
-
-## Workspace lifecycle
+## Workspace filtering
 
-Workspaces in Coder are started and stopped, often based on whether there was
-any activity or if there was a [template update](./templates/index.md#Start/stop) available.
+In the Coder UI, you can filter your workspaces using pre-defined filters or
+Coder's filter query. For example, you can find the workspaces that you own or
+that are currently running.
 
-Resources are often destroyed and re-created when a workspace is restarted,
-though the exact behavior depends on the template. For more
-information, see [Resource Persistence](./templates/resource-persistence.md).
+The following filters are supported:
 
-> ⚠️ To avoid data loss, refer to your template documentation for information on
-> where to store files, install software, etc., so that they persist. Default
-> templates are documented in [../examples/templates](https://github.com/coder/coder/tree/c6b1daabc5a7aa67bfbb6c89966d728919ba7f80/examples/templates).
->
-> You can use `coder show <workspace-name>` to see which resources are
-> persistent and which are ephemeral.
+- `owner` - Represents the `username` of the owner. You can also use `me` as a
+  convenient alias for the logged-in user.
+- `template` - Specifies the name of the template.
+- `status` - Indicates the status of the workspace. For a list of supported
+  statuses, see
+  [WorkspaceStatus documentation](https://pkg.go.dev/github.com/coder/coder/codersdk#WorkspaceStatus).
 
-When a workspace is deleted, all of the workspace's resources are deleted.
+## Starting and stopping workspaces
 
-## Workspace scheduling
+By default, you manually start and stop workspaces as you need. You can also
+schedule a workspace to start and stop automatically.
 
-By default, workspaces are manually turned on/off by the user. However, a schedule
-can be defined on a per-workspace basis to automate the workspace start/stop.
+To set a workspace's schedule, go to the workspace, then **Settings** >
+**Schedule**.
 
 ![Scheduling UI](./images/schedule.png)
 
-### Autostart
+Coder might also stop a workspace automatically if there is a
+[template update](./templates/index.md#Start/stop) available.
 
-The autostart feature automates the workspace build at a user-specified time
-and day(s) of the week. In addition, users can select their preferred timezone.
+### Autostart and autostop
 
-![Autostart UI](./images/autostart.png)
+Use autostart to start a workspace at a specified time and which days of the
+week. Also, you can choose your preferred timezone.
 
-### Autostop
+![Autostart UI](./images/autostart.png)
 
-The autostop feature shuts off workspaces after given number of hours in the "on"
-state. If Coder detects workspace connection activity, the autostop timer is bumped up
-one hour. IDE, SSH, Port Forwarding, and coder_app activity trigger this bump.
+Use autostop to stop a workspace after a number of hours. Autostop won't stop a
+workspace if you're still using it. It waits for another hour before checking
+again. Coder checks for active connections in the IDE, SSH, Port Forwarding, and
+coder_app.
 
-![autostop UI](./images/autostop.png)
+![Autostop UI](./images/autostop.png)
 
 ### Max lifetime
 
-Max lifetime is a template-level setting that determines the number of hours a
-workspace can run before it is automatically shutdown, regardless of any
-active connections. This setting ensures workspaces do not run in perpetuity
+Max lifetime is a template setting that determines the number of hours a
+workspace will run before Coder automatically stops it, regardless of any active
+connections. Use this setting to ensure that workspaces do not run in perpetuity
 when connections are left open inadvertently.
 
 ## Updating workspaces
 
-Use the following command to update a workspace to the latest template version.
-The workspace will be stopped and started:
+After updating the default version of the template that a workspace was created
+from, you can update the workspace.
+
+![Updating a workspace](./images/workspace-update.png)
 
-```console
+If the workspace is running, Coder stops it, updates it, then starts the
+workspace again.
+
+On the command line:
+
+```shell
 coder update <workspace-name>
 ```
 
+## Workspace resources
+
+Workspaces in Coder are started and stopped, often based on whether there was
+any activity or if there was a
+[template update](./templates/index.md#Start/stop) available.
+
+Resources are often destroyed and re-created when a workspace is restarted,
+though the exact behavior depends on the template. For more information, see
+[Resource Persistence](./templates/resource-persistence.md).
+
+> ⚠️ To avoid data loss, refer to your template documentation for information on
+> where to store files, install software, etc., so that they persist. Default
+> templates are documented in
+> [../examples/templates](https://github.com/coder/coder/tree/main/examples/templates).
+>
+> You can use `coder show <workspace-name>` to see which resources are
+> persistent and which are ephemeral.
+
+When a workspace is deleted, all of the workspace's resources are deleted.
+
 ## Repairing workspaces
 
-Use the following command to re-enter template input
-variables in an existing workspace. This command is useful when a workspace fails
-to build because its state is out of sync with the template.
+Use the following command to re-enter template input variables in an existing
+workspace. This command is useful when a workspace fails to build because its
+state is out of sync with the template.
 
-```console
+```shell
 coder update <your workspace name> --always-prompt
 ```
 
+First, try re-entering parameters from a workspace. In the Coder UI, you can
+filter your workspaces using pre-defined filters or employing the Coder's filter
+query. Take a look at the following examples to understand how to use the
+Coder's filter query:
+
+- To find the workspaces that you own, use the filter `owner:me`.
+- To find workspaces that are currently running, use the filter
+  `status:running`.
+
+![Re-entering template variables](./images/template-variables.png)
+
+You can also do this in the CLI with the following command:
+
+```shell
+coder update <your workspace name> --always-prompt
+```
+
+If that does not work, a Coder admin can manually push and pull the Terraform
+state for a given workspace. This can lead to state corruption or deleted
+resources if you do not know what you are doing.
+
+```shell
+coder state pull <username>/<workspace name>
+# Make changes
+coder state push <username>/<workspace name>
+```
+
 ## Logging
 
 Coder stores macOS and Linux logs at the following locations:
@@ -97,21 +166,6 @@ Coder stores macOS and Linux logs at the following locations:
 
 > Note: Logs are truncated once they reach 5MB in size.
 
-## Workspace filtering
-
-In the Coder UI, you can filter your workspaces using pre-defined filters or employing the Coder's filter query. Take a look at the following examples to understand how to use the Coder's filter query:
-
-- To find the workspaces that you own, use the filter `owner:me`.
-- To find workspaces that are currently running, use the filter `status:running`.
-
-The following filters are supported:
-
-- `owner` - Represents the `username` of the owner. You can also use `me` as a convenient alias for the logged-in user.
-- `template` - Specifies the name of the template.
-- `status` - Indicates the status of the workspace. For a list of supported statuses, please refer to the [WorkspaceStatus documentation](https://pkg.go.dev/github.com/coder/coder/codersdk#WorkspaceStatus).
-
----
-
 ## Up next
 
 - Learn about how to personalize your workspace with [Dotfiles](./dotfiles.md)
diff --git a/dogfood/Dockerfile b/dogfood/Dockerfile
deleted file mode 100644
index c5f1481679147..0000000000000
--- a/dogfood/Dockerfile
+++ /dev/null
@@ -1,347 +0,0 @@
-FROM rust:slim AS rust-utils
-# Install rust helper programs
-# ENV CARGO_NET_GIT_FETCH_WITH_CLI=true
-ENV CARGO_INSTALL_ROOT=/tmp/
-RUN cargo install exa bat ripgrep typos-cli watchexec-cli
-
-FROM ubuntu:jammy AS go
-
-RUN apt-get update && apt-get install --yes curl gcc
-# Install Go manually, so that we can control the version
-ARG GO_VERSION=1.20.6
-RUN mkdir --parents /usr/local/go
-
-# Boring Go is needed to build FIPS-compliant binaries.
-RUN curl --silent --show-error --location \
-	"https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" \
-	-o /usr/local/go.tar.gz
-
-RUN tar --extract --gzip --directory=/usr/local/go --file=/usr/local/go.tar.gz --strip-components=1
-
-ENV PATH=$PATH:/usr/local/go/bin
-
-# Install Go utilities.
-ARG GOPATH="/tmp/"
-RUN mkdir --parents "$GOPATH" && \
-	# moq for Go tests.
-	go install github.com/matryer/moq@v0.2.3 && \
-	# swag for Swagger doc generation
-	go install github.com/swaggo/swag/cmd/swag@v1.7.4 && \
-	# go-swagger tool to generate the go coder api client
-	go install github.com/go-swagger/go-swagger/cmd/swagger@v0.28.0 && \
-	# goimports for updating imports
-	go install golang.org/x/tools/cmd/goimports@v0.1.7 && \
-	# protoc-gen-go is needed to build sysbox from source
-	go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.30 && \
-	# drpc support for v2
-	go install storj.io/drpc/cmd/protoc-gen-go-drpc@v0.0.33 && \
-	# migrate for migration support for v2
-	go install github.com/golang-migrate/migrate/v4/cmd/migrate@v4.15.1 && \
-	# goreleaser for compiling v2 binaries
-	go install github.com/goreleaser/goreleaser@v1.6.1 && \
-	# Install the latest version of gopls for editors that support
-	# the language server protocol
-	go install golang.org/x/tools/gopls@latest && \
-	# gotestsum makes test output more readable
-	go install gotest.tools/gotestsum@v1.9.0 && \
-	# goveralls collects code coverage metrics from tests
-	# and sends to Coveralls
-	go install github.com/mattn/goveralls@v0.0.11 && \
-	# kind for running Kubernetes-in-Docker, needed for tests
-	go install sigs.k8s.io/kind@v0.10.0 && \
-	# helm-docs generates our Helm README based on a template and the
-	# charts and values files
-	go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.5.0 && \
-	# sqlc for Go code generation
-	go install github.com/kyleconroy/sqlc/cmd/sqlc@v1.19.1 && \
-	# gcr-cleaner-cli used by CI to prune unused images
-	go install github.com/sethvargo/gcr-cleaner/cmd/gcr-cleaner-cli@v0.5.1 && \
-	# ruleguard for checking custom rules, without needing to run all of
-	# golangci-lint. Check the go.mod in the release of golangci-lint that
-	# we're using for the version of go-critic that it embeds, then check
-	# the version of ruleguard in go-critic for that tag.
-	go install github.com/quasilyte/go-ruleguard/cmd/ruleguard@v0.3.13 && \
-	# go-fuzz for fuzzy testing. they don't publish releases so we rely on latest.
-	go install github.com/dvyukov/go-fuzz/go-fuzz@latest && \
-	go install github.com/dvyukov/go-fuzz/go-fuzz-build@latest && \
-	# go-releaser for building 'fat binaries' that work cross-platform
-	go install github.com/goreleaser/goreleaser@v1.6.1 && \
-	go install mvdan.cc/sh/v3/cmd/shfmt@latest && \
-	# nfpm is used with `make build` to make release packages
-	go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.16.0 && \
-	# yq v4 is used to process yaml files in coder v2. Conflicts with
-	# yq v3 used in v1.
-	go install github.com/mikefarah/yq/v4@v4.30.6 && \
-	mv /tmp/bin/yq /tmp/bin/yq4 && \
-	go install github.com/golang/mock/mockgen@v1.6.0
-
-FROM gcr.io/coder-dev-1/alpine:3.18 as proto
-WORKDIR /tmp
-RUN apk add curl unzip
-RUN curl -L -o protoc.zip https://github.com/protocolbuffers/protobuf/releases/download/v23.3/protoc-23.3-linux-x86_64.zip
-RUN unzip protoc.zip
-
-FROM ubuntu:jammy
-
-SHELL ["/bin/bash", "-c"]
-
-# Updated certificates are necessary to use the teraswitch mirror.
-# This must be ran before copying in configuration since the config replaces
-# the default mirror with teraswitch.
-RUN apt-get update && apt-get install --yes ca-certificates
-
-COPY files /
-
-# Install packages from apt repositories
-ARG DEBIAN_FRONTEND="noninteractive"
-
-RUN apt-get update --quiet && apt-get install --yes \
-	apt-transport-https \
-	apt-utils \
-	bash \
-	bash-completion \
-	bats \
-	bind9-dnsutils \
-	build-essential \
-	ca-certificates \
-	cmake \
-	crypto-policies \
-	curl \
-	fd-find \
-	file \
-	git \
-	gnupg \
-	graphviz \
-	htop \
-	httpie \
-	inetutils-tools \
-	iproute2 \
-	iputils-ping \
-	iputils-tracepath \
-	jq \
-	language-pack-en \
-	less \
-	lsb-release \
-	man \
-	meld \
-	net-tools \
-	openjdk-11-jdk-headless \
-	openssh-server \
-	openssl \
-	libssl-dev \
-	pkg-config \
-	python3 \
-	python3-pip \
-	rsync \
-	shellcheck \
-	strace \
-	sudo \
-	tcptraceroute \
-	termshark \
-	traceroute \
-	vim \
-	wget \
-	xauth \
-	zip \
-	ncdu \
-	cargo \
-	asciinema \
-	zsh \
-	ansible \
-	neovim \
-	google-cloud-sdk \
-	google-cloud-sdk-datastore-emulator \
-	kubectl \
-	postgresql-13 \
-	containerd.io \
-	docker-ce \
-	docker-ce-cli \
-	docker-compose-plugin \
-	packer \
-	terraform \
-	fish \
-	unzip \
-	zstd \
-	gettext-base && \
-	# Delete package cache to avoid consuming space in layer
-	apt-get clean && \
-	# Configure FIPS-compliant policies
-	update-crypto-policies --set FIPS
-
-# Install the docker buildx component.
-RUN DOCKER_BUILDX_VERSION=$(curl -s "https://api.github.com/repos/docker/buildx/releases/latest" | grep '"tag_name":' |  sed -E 's/.*"(v[^"]+)".*/\1/') && \
-	mkdir -p /usr/local/lib/docker/cli-plugins && \
-	curl -Lo /usr/local/lib/docker/cli-plugins/docker-buildx "https://github.com/docker/buildx/releases/download/${DOCKER_BUILDX_VERSION}/buildx-${DOCKER_BUILDX_VERSION}.linux-amd64" && \
-	chmod a+x /usr/local/lib/docker/cli-plugins/docker-buildx
-
-# See https://github.com/cli/cli/issues/6175#issuecomment-1235984381 for proof
-# the apt repository is unreliable
-RUN GH_CLI_VERSION=$(curl -s "https://api.github.com/repos/cli/cli/releases/latest" | grep '"tag_name":' |  sed -E 's/.*"v([^"]+)".*/\1/') && \
-	curl -L https://github.com/cli/cli/releases/download/v${GH_CLI_VERSION}/gh_${GH_CLI_VERSION}_linux_amd64.deb -o gh.deb && \
-	dpkg -i gh.deb && \
-	rm gh.deb
-
-# Install Lazygit
-# See https://github.com/jesseduffield/lazygit#ubuntu
-RUN LAZYGIT_VERSION=$(curl -s "https://api.github.com/repos/jesseduffield/lazygit/releases/latest" | grep '"tag_name":' |  sed -E 's/.*"v*([^"]+)".*/\1/') && \
-	curl -Lo lazygit.tar.gz "https://github.com/jesseduffield/lazygit/releases/latest/download/lazygit_${LAZYGIT_VERSION}_Linux_x86_64.tar.gz" && \
-	tar xf lazygit.tar.gz -C /usr/local/bin lazygit
-
-# Install frontend utilities
-RUN apt-get update && \
-	# Node.js (from nodesource) and Yarn (from yarnpkg)
-	curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - &&\
-	apt-get install --yes --quiet \
-	nodejs yarn \
-	# Install browsers for e2e testing
-	google-chrome-stable microsoft-edge-beta && \
-	# Pre-install system dependencies that Playwright needs. npx doesn't work here
-	# for some reason. See https://github.com/microsoft/playwright-cli/issues/136
-	npm i -g playwright@1.36.2 pnpm@^8 && playwright install-deps && \
-	npm cache clean --force
-
-# Ensure PostgreSQL binaries are in the users $PATH.
-RUN update-alternatives --install /usr/local/bin/initdb initdb /usr/lib/postgresql/13/bin/initdb 100 && \
-	update-alternatives --install /usr/local/bin/postgres postgres /usr/lib/postgresql/13/bin/postgres 100
-
-# Create links for injected dependencies
-RUN ln --symbolic /var/tmp/coder/coder-cli/coder /usr/local/bin/coder && \
-	ln --symbolic /var/tmp/coder/code-server/bin/code-server /usr/local/bin/code-server
-
-# Disable the PostgreSQL systemd service.
-# Coder uses a custom timescale container to test the database instead.
-RUN systemctl disable \
-	postgresql
-
-# Configure systemd services for CVMs
-RUN systemctl enable \
-	docker \
-	ssh
-
-# Install tools with published releases, where that is the
-# preferred/recommended installation method.
-ARG CLOUD_SQL_PROXY_VERSION=2.2.0 \
-	DIVE_VERSION=0.10.0 \
-	DOCKER_GCR_VERSION=2.1.8 \
-	GOLANGCI_LINT_VERSION=1.52.2 \
-	GRYPE_VERSION=0.61.1 \
-	HELM_VERSION=3.12.0 \
-	KUBE_LINTER_VERSION=0.6.3 \
-	KUBECTX_VERSION=0.9.4 \
-	STRIPE_VERSION=1.14.5 \
-	TERRAGRUNT_VERSION=0.45.11 \
-	TRIVY_VERSION=0.41.0
-
-# cloud_sql_proxy, for connecting to cloudsql instances
-# the upstream go.mod prevents this from being installed with go install
-RUN curl --silent --show-error --location --output /usr/local/bin/cloud_sql_proxy "https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v${CLOUD_SQL_PROXY_VERSION}/cloud-sql-proxy.linux.amd64" && \
-	chmod a=rx /usr/local/bin/cloud_sql_proxy && \
-	# dive for scanning image layer utilization metrics in CI
-	curl --silent --show-error --location "https://github.com/wagoodman/dive/releases/download/v${DIVE_VERSION}/dive_${DIVE_VERSION}_linux_amd64.tar.gz" | \
-	tar --extract --gzip --directory=/usr/local/bin --file=- dive && \
-	# docker-credential-gcr is a Docker credential helper for pushing/pulling
-	# images from Google Container Registry and Artifact Registry
-	curl --silent --show-error --location "https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/download/v${DOCKER_GCR_VERSION}/docker-credential-gcr_linux_amd64-${DOCKER_GCR_VERSION}.tar.gz" | \
-	tar --extract --gzip --directory=/usr/local/bin --file=- docker-credential-gcr && \
-	# golangci-lint performs static code analysis for our Go code
-	curl --silent --show-error --location "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}/golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64.tar.gz" | \
-	tar --extract --gzip --directory=/usr/local/bin --file=- --strip-components=1 "golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64/golangci-lint" && \
-	# Anchore Grype for scanning container images for security issues
-	curl --silent --show-error --location "https://github.com/anchore/grype/releases/download/v${GRYPE_VERSION}/grype_${GRYPE_VERSION}_linux_amd64.tar.gz" | \
-	tar --extract --gzip --directory=/usr/local/bin --file=- grype && \
-	# Helm is necessary for deploying Coder
-	curl --silent --show-error --location "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" | \
-	tar --extract --gzip --directory=/usr/local/bin --file=- --strip-components=1 linux-amd64/helm && \
-	# kube-linter for linting Kubernetes objects, including those
-	# that Helm generates from our charts
-	curl --silent --show-error --location "https://github.com/stackrox/kube-linter/releases/download/${KUBE_LINTER_VERSION}/kube-linter-linux" --output /usr/local/bin/kube-linter && \
-	# kubens and kubectx for managing Kubernetes namespaces and contexts
-	curl --silent --show-error --location "https://github.com/ahmetb/kubectx/releases/download/v${KUBECTX_VERSION}/kubectx_v${KUBECTX_VERSION}_linux_x86_64.tar.gz" | \
-	tar --extract --gzip --directory=/usr/local/bin --file=- kubectx && \
-	curl --silent --show-error --location "https://github.com/ahmetb/kubectx/releases/download/v${KUBECTX_VERSION}/kubens_v${KUBECTX_VERSION}_linux_x86_64.tar.gz" | \
-	tar --extract --gzip --directory=/usr/local/bin --file=- kubens && \
-	# stripe for coder.com billing API
-	curl --silent --show-error --location "https://github.com/stripe/stripe-cli/releases/download/v${STRIPE_VERSION}/stripe_${STRIPE_VERSION}_linux_x86_64.tar.gz" | \
-	tar --extract --gzip --directory=/usr/local/bin --file=- stripe && \
-	# terragrunt for running Terraform and Terragrunt files
-	curl --silent --show-error --location --output /usr/local/bin/terragrunt "https://github.com/gruntwork-io/terragrunt/releases/download/v${TERRAGRUNT_VERSION}/terragrunt_linux_amd64" && \
-	chmod a=rx /usr/local/bin/terragrunt && \
-	# AquaSec Trivy for scanning container images for security issues
-	curl --silent --show-error --location "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" | \
-	tar --extract --gzip --directory=/usr/local/bin --file=- trivy
-
-# Add Vercel globally. We can't install it in packages.json, because it
-# includes Go files which make golangci-lint unhappy.
-RUN yarn global add --prefix=/usr/local \
-	vercel \
-	typescript \
-	typescript-language-server \
-	prettier && \
-	yarn cache clean
-
-# We use yq during "make deploy" to manually substitute out fields in
-# our helm values.yaml file. See https://github.com/helm/helm/issues/3141
-#
-# TODO: update to 4.x, we can't do this now because it included breaking
-# changes (yq w doesn't work anymore)
-# RUN curl --silent --show-error --location "https://github.com/mikefarah/yq/releases/download/v4.9.0/yq_linux_amd64.tar.gz" | \
-#       tar --extract --gzip --directory=/usr/local/bin --file=- ./yq_linux_amd64 && \
-#     mv /usr/local/bin/yq_linux_amd64 /usr/local/bin/yq
-
-RUN curl --silent --show-error --location --output /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/3.3.0/yq_linux_amd64" && \
-	chmod a=rx /usr/local/bin/yq
-
-# Install GoLand.
-RUN mkdir --parents /usr/local/goland && \
-	curl --silent --show-error --location "https://download.jetbrains.com/go/goland-2021.2.tar.gz" | \
-	tar --extract --gzip --directory=/usr/local/goland --file=- --strip-components=1 && \
-	ln --symbolic /usr/local/goland/bin/goland.sh /usr/local/bin/goland
-
-# Install Antlrv4, needed to generate paramlang lexer/parser
-RUN curl --silent --show-error --location --output /usr/local/lib/antlr-4.9.2-complete.jar "https://www.antlr.org/download/antlr-4.9.2-complete.jar"
-ENV CLASSPATH="/usr/local/lib/antlr-4.9.2-complete.jar:${PATH}"
-
-# Add coder user and allow use of docker/sudo
-RUN useradd coder \
-	--create-home \
-	--shell=/bin/bash \
-	--groups=docker \
-	--uid=1000 \
-	--user-group
-
-# Adjust OpenSSH config
-RUN echo "PermitUserEnvironment yes" >>/etc/ssh/sshd_config && \
-	echo "X11Forwarding yes" >>/etc/ssh/sshd_config && \
-	echo "X11UseLocalhost no" >>/etc/ssh/sshd_config
-
-# We avoid copying the extracted directory since COPY slows to minutes when there
-# are a lot of small files.
-COPY --from=go /usr/local/go.tar.gz /usr/local/go.tar.gz
-RUN mkdir /usr/local/go && \
-	tar --extract --gzip --directory=/usr/local/go --file=/usr/local/go.tar.gz --strip-components=1
-
-ENV PATH=$PATH:/usr/local/go/bin
-
-RUN update-alternatives --install /usr/local/bin/gofmt gofmt /usr/local/go/bin/gofmt 100
-
-COPY --from=go /tmp/bin /usr/local/bin
-COPY --from=rust-utils /tmp/bin /usr/local/bin
-COPY --from=proto /tmp/bin /usr/local/bin
-COPY --from=proto /tmp/include /usr/local/bin/include
-
-USER coder
-
-# Ensure go bins are in the 'coder' user's path. Note that no go bins are
-# installed in this docker file, as they'd be mounted over by the persistent
-# home volume.
-ENV PATH="/home/coder/go/bin:${PATH}"
-
-# This setting prevents Go from using the public checksum database for
-# our module path prefixes. It is required because these are in private
-# repositories that require authentication.
-#
-# For details, see: https://golang.org/ref/mod#private-modules
-ENV GOPRIVATE="coder.com,cdr.dev,go.coder.com,github.com/cdr,github.com/coder"
-
-# Increase memory allocation to NodeJS
-ENV NODE_OPTIONS="--max-old-space-size=8192"
diff --git a/dogfood/Makefile b/dogfood/Makefile
deleted file mode 100644
index 061530f50dd45..0000000000000
--- a/dogfood/Makefile
+++ /dev/null
@@ -1,10 +0,0 @@
-.PHONY: docker-build docker-push
-
-branch=$(shell git rev-parse --abbrev-ref HEAD)
-build_tag=codercom/oss-dogfood:${branch}
-
-build:
-	DOCKER_BUILDKIT=1 docker build . -t ${build_tag}
-
-push: build
-	docker push ${build_tag}
diff --git a/dogfood/files/etc/apt/apt.conf.d/80-no-recommends b/dogfood/files/etc/apt/apt.conf.d/80-no-recommends
deleted file mode 100644
index 8cb79c96386c4..0000000000000
--- a/dogfood/files/etc/apt/apt.conf.d/80-no-recommends
+++ /dev/null
@@ -1,6 +0,0 @@
-// Do not install recommended packages by default
-APT::Install-Recommends "0";
-
-// Do not install suggested packages by default (this is already
-// the Ubuntu default)
-APT::Install-Suggests "0";
diff --git a/dogfood/files/etc/apt/apt.conf.d/80-retries b/dogfood/files/etc/apt/apt.conf.d/80-retries
deleted file mode 100644
index d7ee5185258ec..0000000000000
--- a/dogfood/files/etc/apt/apt.conf.d/80-retries
+++ /dev/null
@@ -1 +0,0 @@
-APT::Acquire::Retries "3";
diff --git a/dogfood/files/etc/apt/preferences.d/docker b/dogfood/files/etc/apt/preferences.d/docker
deleted file mode 100644
index a92c0abb03d7c..0000000000000
--- a/dogfood/files/etc/apt/preferences.d/docker
+++ /dev/null
@@ -1,19 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin download.docker.com
-Pin-Priority: 1
-
-# Docker Community Edition
-Package: docker-ce
-Pin: origin download.docker.com
-Pin-Priority: 500
-
-# Docker command-line tool
-Package: docker-ce-cli
-Pin: origin download.docker.com
-Pin-Priority: 500
-
-# containerd runtime
-Package: containerd.io
-Pin: origin download.docker.com
-Pin-Priority: 500
diff --git a/dogfood/files/etc/apt/preferences.d/github-cli b/dogfood/files/etc/apt/preferences.d/github-cli
deleted file mode 100644
index d2dce9f5f3097..0000000000000
--- a/dogfood/files/etc/apt/preferences.d/github-cli
+++ /dev/null
@@ -1,8 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin cli.github.com
-Pin-Priority: 1
-
-Package: gh
-Pin: origin cli.github.com
-Pin-Priority: 500
diff --git a/dogfood/files/etc/apt/preferences.d/google-chrome b/dogfood/files/etc/apt/preferences.d/google-chrome
deleted file mode 100644
index 4551ec390ff20..0000000000000
--- a/dogfood/files/etc/apt/preferences.d/google-chrome
+++ /dev/null
@@ -1,16 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin dl.google.com
-Pin-Priority: 1
-
-Package: google-chrome-stable
-Pin: origin dl.google.com
-Pin-Priority: 500
-
-Package: google-chrome-beta
-Pin: origin dl.google.com
-Pin-Priority: 500
-
-Package: google-chrome-unstable
-Pin: origin dl.google.com
-Pin-Priority: 500
diff --git a/dogfood/files/etc/apt/preferences.d/google-cloud b/dogfood/files/etc/apt/preferences.d/google-cloud
deleted file mode 100644
index 637b0e9bb3c51..0000000000000
--- a/dogfood/files/etc/apt/preferences.d/google-cloud
+++ /dev/null
@@ -1,19 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin packages.cloud.google.com
-Pin-Priority: 1
-
-# Google Cloud SDK for gcloud and gsutil CLI tools
-Package: google-cloud-sdk
-Pin: origin packages.cloud.google.com
-Pin-Priority: 500
-
-# Datastore emulator for working with the licensor
-Package: google-cloud-sdk-datastore-emulator
-Pin: origin packages.cloud.google.com
-Pin-Priority: 500
-
-# Kubectl for working with Kubernetes (GKE)
-Package: kubectl
-Pin: origin packages.cloud.google.com
-Pin-Priority: 500
diff --git a/dogfood/files/etc/apt/preferences.d/hashicorp b/dogfood/files/etc/apt/preferences.d/hashicorp
deleted file mode 100644
index 4323f331cc722..0000000000000
--- a/dogfood/files/etc/apt/preferences.d/hashicorp
+++ /dev/null
@@ -1,14 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin apt.releases.hashicorp.com
-Pin-Priority: 1
-
-# Packer for creating virtual machine disk images
-Package: packer
-Pin: origin apt.releases.hashicorp.com
-Pin-Priority: 500
-
-# Terraform for managing infrastructure
-Package: terraform
-Pin: origin apt.releases.hashicorp.com
-Pin-Priority: 500
diff --git a/dogfood/files/etc/apt/preferences.d/microsoft-edge b/dogfood/files/etc/apt/preferences.d/microsoft-edge
deleted file mode 100644
index 2441961adac38..0000000000000
--- a/dogfood/files/etc/apt/preferences.d/microsoft-edge
+++ /dev/null
@@ -1,12 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin packages.microsoft.com
-Pin-Priority: 1
-
-Package: microsoft-edge-beta
-Pin: origin packages.microsoft.com
-Pin-Priority: 500
-
-Package: microsoft-edge-dev
-Pin: origin packages.microsoft.com
-Pin-Priority: 500
diff --git a/dogfood/files/etc/apt/preferences.d/nodesource b/dogfood/files/etc/apt/preferences.d/nodesource
deleted file mode 100644
index de55d5553411e..0000000000000
--- a/dogfood/files/etc/apt/preferences.d/nodesource
+++ /dev/null
@@ -1,9 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin deb.nodesource.com
-Pin-Priority: 1
-
-# Node.js for building the frontend
-Package: nodejs
-Pin: origin deb.nodesource.com
-Pin-Priority: 500
diff --git a/dogfood/files/etc/apt/preferences.d/ppa b/dogfood/files/etc/apt/preferences.d/ppa
deleted file mode 100644
index 1dc9da8f9fffc..0000000000000
--- a/dogfood/files/etc/apt/preferences.d/ppa
+++ /dev/null
@@ -1,19 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin ppa.launchpad.net
-Pin-Priority: 1
-
-# Ansible
-Package: ansible-base
-Pin: origin ppa.launchpad.net
-Pin-Priority: 500
-
-# Neovim
-Package: neovim
-Pin: origin ppa.launchpad.net
-Pin-Priority: 500
-
-# Neovim Runtime
-Package: neovim-runtime
-Pin: origin ppa.launchpad.net
-Pin-Priority: 500
diff --git a/dogfood/files/etc/apt/preferences.d/yarnpkg b/dogfood/files/etc/apt/preferences.d/yarnpkg
deleted file mode 100644
index 7237fcad5c356..0000000000000
--- a/dogfood/files/etc/apt/preferences.d/yarnpkg
+++ /dev/null
@@ -1,9 +0,0 @@
-# Ignore all packages from this repository by default
-Package: *
-Pin: origin dl.yarnpkg.com
-Pin-Priority: 1
-
-# Yarn for managing Node.js packages
-Package: yarn
-Pin: origin dl.yarnpkg.com
-Pin-Priority: 500
diff --git a/dogfood/files/etc/apt/sources.list b/dogfood/files/etc/apt/sources.list
deleted file mode 100644
index 745bcefcf2b0c..0000000000000
--- a/dogfood/files/etc/apt/sources.list
+++ /dev/null
@@ -1,3 +0,0 @@
-deb https://mirror.pit.teraswitch.com/ubuntu/ jammy main restricted universe
-deb https://mirror.pit.teraswitch.com/ubuntu/ jammy-updates main restricted universe
-deb https://mirror.pit.teraswitch.com/ubuntu/ jammy-backports main restricted universe
diff --git a/dogfood/files/etc/apt/sources.list.d/docker.list b/dogfood/files/etc/apt/sources.list.d/docker.list
deleted file mode 100644
index f00cada1ad16e..0000000000000
--- a/dogfood/files/etc/apt/sources.list.d/docker.list
+++ /dev/null
@@ -1 +0,0 @@
-deb [signed-by=/usr/share/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu jammy stable
diff --git a/dogfood/files/etc/apt/sources.list.d/google-chrome.list b/dogfood/files/etc/apt/sources.list.d/google-chrome.list
deleted file mode 100644
index 8dd71926f26df..0000000000000
--- a/dogfood/files/etc/apt/sources.list.d/google-chrome.list
+++ /dev/null
@@ -1 +0,0 @@
-deb [signed-by=/usr/share/keyrings/google-chrome.gpg] https://dl.google.com/linux/chrome/deb/ stable main
diff --git a/dogfood/files/etc/apt/sources.list.d/google-cloud.list b/dogfood/files/etc/apt/sources.list.d/google-cloud.list
deleted file mode 100644
index 24df98effea28..0000000000000
--- a/dogfood/files/etc/apt/sources.list.d/google-cloud.list
+++ /dev/null
@@ -1 +0,0 @@
-deb [signed-by=/usr/share/keyrings/google-cloud.gpg] https://packages.cloud.google.com/apt cloud-sdk main
diff --git a/dogfood/files/etc/apt/sources.list.d/hashicorp.list b/dogfood/files/etc/apt/sources.list.d/hashicorp.list
deleted file mode 100644
index 6e60053905ec7..0000000000000
--- a/dogfood/files/etc/apt/sources.list.d/hashicorp.list
+++ /dev/null
@@ -1 +0,0 @@
-deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com jammy main
diff --git a/dogfood/files/etc/apt/sources.list.d/microsoft-edge.list b/dogfood/files/etc/apt/sources.list.d/microsoft-edge.list
deleted file mode 100644
index f0c036f79a5c5..0000000000000
--- a/dogfood/files/etc/apt/sources.list.d/microsoft-edge.list
+++ /dev/null
@@ -1 +0,0 @@
-deb [signed-by=/usr/share/keyrings/microsoft.gpg] https://packages.microsoft.com/repos/edge stable main
diff --git a/dogfood/files/etc/apt/sources.list.d/nodesource.list b/dogfood/files/etc/apt/sources.list.d/nodesource.list
deleted file mode 100644
index a328c2c3c47dc..0000000000000
--- a/dogfood/files/etc/apt/sources.list.d/nodesource.list
+++ /dev/null
@@ -1 +0,0 @@
-deb [signed-by=/usr/share/keyrings/nodesource.gpg] https://deb.nodesource.com/node_16.x jammy main
diff --git a/dogfood/files/etc/apt/sources.list.d/postgresql.list b/dogfood/files/etc/apt/sources.list.d/postgresql.list
deleted file mode 100644
index 10262f3e64a10..0000000000000
--- a/dogfood/files/etc/apt/sources.list.d/postgresql.list
+++ /dev/null
@@ -1 +0,0 @@
-deb [signed-by=/usr/share/keyrings/postgresql.gpg] https://apt.postgresql.org/pub/repos/apt jammy-pgdg main
diff --git a/dogfood/files/etc/apt/sources.list.d/ppa.list b/dogfood/files/etc/apt/sources.list.d/ppa.list
deleted file mode 100644
index e817c20915cb1..0000000000000
--- a/dogfood/files/etc/apt/sources.list.d/ppa.list
+++ /dev/null
@@ -1,2 +0,0 @@
-deb [signed-by=/usr/share/keyrings/ansible.gpg] https://ppa.launchpadcontent.net/ansible/ansible/ubuntu focal main
-deb [signed-by=/usr/share/keyrings/neovim.gpg] https://ppa.launchpadcontent.net/neovim-ppa/stable/ubuntu focal main
diff --git a/dogfood/files/etc/apt/sources.list.d/security.list b/dogfood/files/etc/apt/sources.list.d/security.list
deleted file mode 100644
index 1f3dae8d09b19..0000000000000
--- a/dogfood/files/etc/apt/sources.list.d/security.list
+++ /dev/null
@@ -1 +0,0 @@
-deb http://security.ubuntu.com/ubuntu/ jammy-security main restricted universe
diff --git a/dogfood/files/etc/apt/sources.list.d/yarnpkg.list b/dogfood/files/etc/apt/sources.list.d/yarnpkg.list
deleted file mode 100644
index ada8a06f7b9b2..0000000000000
--- a/dogfood/files/etc/apt/sources.list.d/yarnpkg.list
+++ /dev/null
@@ -1 +0,0 @@
-deb [signed-by=/usr/share/keyrings/yarnpkg.gpg] https://dl.yarnpkg.com/debian/ stable main
diff --git a/dogfood/files/etc/default/google-chrome b/dogfood/files/etc/default/google-chrome
deleted file mode 100644
index 8620a6054380a..0000000000000
--- a/dogfood/files/etc/default/google-chrome
+++ /dev/null
@@ -1,4 +0,0 @@
-# These settings are required to prevent the postinst script
-# from modifying /etc/apt/sources.list.d
-repo_add_once="false"
-repo_reenable_on_distupgrade="false"
diff --git a/dogfood/files/etc/default/microsoft-edge-beta b/dogfood/files/etc/default/microsoft-edge-beta
deleted file mode 100644
index 8620a6054380a..0000000000000
--- a/dogfood/files/etc/default/microsoft-edge-beta
+++ /dev/null
@@ -1,4 +0,0 @@
-# These settings are required to prevent the postinst script
-# from modifying /etc/apt/sources.list.d
-repo_add_once="false"
-repo_reenable_on_distupgrade="false"
diff --git a/dogfood/files/etc/docker/daemon.json b/dogfood/files/etc/docker/daemon.json
deleted file mode 100644
index 8e19eeeec15b8..0000000000000
--- a/dogfood/files/etc/docker/daemon.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "registry-mirrors": ["https://mirror.gcr.io"]
-}
diff --git a/dogfood/files/etc/sudoers.d/nopasswd b/dogfood/files/etc/sudoers.d/nopasswd
deleted file mode 100644
index 3283f4455630c..0000000000000
--- a/dogfood/files/etc/sudoers.d/nopasswd
+++ /dev/null
@@ -1 +0,0 @@
-coder ALL=(ALL) NOPASSWD:ALL
diff --git a/dogfood/files/usr/share/keyrings/ansible.gpg b/dogfood/files/usr/share/keyrings/ansible.gpg
deleted file mode 100644
index 1731dd2b2fbd7..0000000000000
Binary files a/dogfood/files/usr/share/keyrings/ansible.gpg and /dev/null differ
diff --git a/dogfood/files/usr/share/keyrings/docker.gpg b/dogfood/files/usr/share/keyrings/docker.gpg
deleted file mode 100644
index e5dc8cfda8e5d..0000000000000
Binary files a/dogfood/files/usr/share/keyrings/docker.gpg and /dev/null differ
diff --git a/dogfood/files/usr/share/keyrings/github-cli.gpg b/dogfood/files/usr/share/keyrings/github-cli.gpg
deleted file mode 100644
index eddea90bd75df..0000000000000
Binary files a/dogfood/files/usr/share/keyrings/github-cli.gpg and /dev/null differ
diff --git a/dogfood/files/usr/share/keyrings/google-chrome.gpg b/dogfood/files/usr/share/keyrings/google-chrome.gpg
deleted file mode 100644
index cee005a7386d9..0000000000000
Binary files a/dogfood/files/usr/share/keyrings/google-chrome.gpg and /dev/null differ
diff --git a/dogfood/files/usr/share/keyrings/google-cloud.gpg b/dogfood/files/usr/share/keyrings/google-cloud.gpg
deleted file mode 100644
index 0f478144f1491..0000000000000
Binary files a/dogfood/files/usr/share/keyrings/google-cloud.gpg and /dev/null differ
diff --git a/dogfood/files/usr/share/keyrings/hashicorp.gpg b/dogfood/files/usr/share/keyrings/hashicorp.gpg
deleted file mode 100644
index 674dd40c4219e..0000000000000
Binary files a/dogfood/files/usr/share/keyrings/hashicorp.gpg and /dev/null differ
diff --git a/dogfood/files/usr/share/keyrings/microsoft.gpg b/dogfood/files/usr/share/keyrings/microsoft.gpg
deleted file mode 100644
index 0cffae08d061d..0000000000000
Binary files a/dogfood/files/usr/share/keyrings/microsoft.gpg and /dev/null differ
diff --git a/dogfood/files/usr/share/keyrings/neovim.gpg b/dogfood/files/usr/share/keyrings/neovim.gpg
deleted file mode 100644
index b88f69c53b482..0000000000000
Binary files a/dogfood/files/usr/share/keyrings/neovim.gpg and /dev/null differ
diff --git a/dogfood/files/usr/share/keyrings/nodesource.gpg b/dogfood/files/usr/share/keyrings/nodesource.gpg
deleted file mode 100644
index 4f3ec4ed793b3..0000000000000
Binary files a/dogfood/files/usr/share/keyrings/nodesource.gpg and /dev/null differ
diff --git a/dogfood/files/usr/share/keyrings/postgresql.gpg b/dogfood/files/usr/share/keyrings/postgresql.gpg
deleted file mode 100644
index afa15cb1087de..0000000000000
Binary files a/dogfood/files/usr/share/keyrings/postgresql.gpg and /dev/null differ
diff --git a/dogfood/files/usr/share/keyrings/yarnpkg.gpg b/dogfood/files/usr/share/keyrings/yarnpkg.gpg
deleted file mode 100644
index 32a096756e317..0000000000000
Binary files a/dogfood/files/usr/share/keyrings/yarnpkg.gpg and /dev/null differ
diff --git a/dogfood/guide.md b/dogfood/guide.md
index 621cb69d2a588..fc6e8cd93d932 100644
--- a/dogfood/guide.md
+++ b/dogfood/guide.md
@@ -1,6 +1,8 @@
 # Dogfooding Guide
 
-This guide explains how to [dogfood](https://www.techopedia.com/definition/30784/dogfooding) coder for employees at Coder.
+This guide explains how to
+[dogfood](https://www.techopedia.com/definition/30784/dogfooding) coder for
+employees at Coder.
 
 ## How to
 
@@ -8,17 +10,21 @@ The following explains how to do certain things related to dogfooding.
 
 ### Dogfood using Coder's Deployment
 
-1. Go to [https://dev.coder.com/templates/coder-ts](https://dev.coder.com/templates/coder-ts)
+1. Go to
+   [https://dev.coder.com/templates/coder-ts](https://dev.coder.com/templates/coder-ts)
    1. If you don't have an account, sign in with GitHub
    2. If you see a dialog/pop-up, hit "Cancel" (this is because of Rippling)
 2. Create a workspace
 3. [Connect with your favorite IDE](https://coder.com/docs/coder-oss/latest/ides)
 4. Clone the repo: `git clone git@github.com:coder/coder.git`
-5. Follow the [contributing guide](https://coder.com/docs/coder-oss/latest/CONTRIBUTING)
+5. Follow the
+   [contributing guide](https://coder.com/docs/coder-oss/latest/CONTRIBUTING)
 
 ### Run Coder in your Coder Workspace
 
-1.  Clone the Git repo `[https://github.com/coder/coder](https://github.com/coder/coder)` and `cd` into it
+1.  Clone the Git repo
+    `[https://github.com/coder/coder](https://github.com/coder/coder)` and `cd`
+    into it
 2.  Run `sudo apt update` and then `sudo apt install -y netcat`
     - skip this step if using the `coder` template
 3.  Run `make bin`
@@ -33,7 +39,8 @@ The following explains how to do certain things related to dogfooding.
 
     Don’t fret! This is a known issue. To get around it:
 
-    1. Add `export DB_FROM=coderdb` to your `.bashrc` (make sure you `source ~/.bashrc`)
+    1. Add `export DB_FROM=coderdb` to your `.bashrc` (make sure you
+       `source ~/.bashrc`)
     2. Run `sudo service postgresql start`
     3. Run `sudo -u postgres psql` (this will open the PostgreSQL CLI)
     4. Run `postgres-# alter user postgres password 'postgres';`
@@ -44,13 +51,23 @@ The following explains how to do certain things related to dogfooding.
     </aside>
 
 4.  Run `./scripts/develop.sh` which will start _two_ separate processes:
-    1. `[http://localhost:3000](http://localhost:3000)` — backend API server 👈 Backend devs will want to talk to this
-    2. `[http://localhost:8080](http://localhost:8080)` — Node.js dev server 👈 Frontend devs will want to talk to this
-5.  Ensure that you’re logged in: `./scripts/coder-dev.sh list` — should return no workspace. If this returns an error, double-check the output of running `scripts/develop.sh`.
-6.  A template named `docker-amd64` (or `docker-arm64` if you’re on ARM) will have automatically been created for you. If you just want to create a workspace quickly, you can run `./scripts/coder-dev.sh create myworkspace -t docker-amd64` and this will get you going quickly!
-7.  To create your own template, you can do: `./scripts/coder-dev.sh templates init` and choose your preferred option.
-    For example, choosing “Develop in Docker” will create a new folder `docker` that contains the bare bones for starting a Docker workspace template.
-    Then, enter the folder that was just created and customize as you wish.
+    1. `[http://localhost:3000](http://localhost:3000)` — backend API server
+       👈 Backend devs will want to talk to this
+    2. `[http://localhost:8080](http://localhost:8080)` — Node.js dev server
+       👈 Frontend devs will want to talk to this
+5.  Ensure that you’re logged in: `./scripts/coder-dev.sh list` — should return
+    no workspace. If this returns an error, double-check the output of running
+    `scripts/develop.sh`.
+6.  A template named `docker-amd64` (or `docker-arm64` if you’re on ARM) will
+    have automatically been created for you. If you just want to create a
+    workspace quickly, you can run
+    `./scripts/coder-dev.sh create myworkspace -t docker-amd64` and this will
+    get you going quickly!
+7.  To create your own template, you can do:
+    `./scripts/coder-dev.sh templates init` and choose your preferred option.
+    For example, choosing “Develop in Docker” will create a new folder `docker`
+    that contains the bare bones for starting a Docker workspace template. Then,
+    enter the folder that was just created and customize as you wish.
 
       <aside>
       💡 **For all Docker templates:**
@@ -85,11 +102,13 @@ Run 'coder create --help' for usage.
 
 Check the output of `docker ps -a`
 
-- If you see a container with the status `Exited` run `docker logs <container name>` and see what the issue with the container output is
+- If you see a container with the status `Exited` run
+  `docker logs <container name>` and see what the issue with the container
+  output is
 
 Enable verbose container logging for Docker:
 
-```console
+```shell
 sudo cp /etc/docker/daemon.json /etc/docker/daemon.json.orig
 sudo cat > /etc/docker/daemon.json << EOF
 {
@@ -105,4 +124,5 @@ sudo journalctl -u docker -f
 
 ### Help! I'm still blocked
 
-Post in the #dogfood Slack channel internally or open a Discussion on GitHub and tag @jsjoeio or @bpmct
+Post in the #dogfood Slack channel internally or open a Discussion on GitHub and
+tag @jsjoeio or @bpmct
diff --git a/dogfood/main.tf b/dogfood/main.tf
index 554ba21eda07f..3211a499d364f 100644
--- a/dogfood/main.tf
+++ b/dogfood/main.tf
@@ -1,12 +1,11 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "0.11.0"
+      source = "coder/coder"
     }
     docker = {
       source  = "kreuzwerker/docker"
-      version = "~> 2.22.0"
+      version = "~> 3.0.0"
     }
   }
 }
@@ -21,6 +20,8 @@ locals {
     "sa-saopaulo"   = "tcp://100.99.64.123:2375"
     "eu-paris"      = "tcp://100.74.161.61:2375"
   }
+
+  repo_dir = replace(data.coder_parameter.repo_dir.value, "/^~\\//", "/home/coder/")
 }
 
 data "coder_parameter" "repo_dir" {
@@ -31,18 +32,11 @@ data "coder_parameter" "repo_dir" {
   mutable     = true
 }
 
-data "coder_parameter" "dotfiles_url" {
-  type        = "string"
-  name        = "Dotfiles URL"
-  description = "A path to your dotfiles. See: https://dotfiles.github.io"
-  default     = " "
-  mutable     = true
-}
-
 data "coder_parameter" "region" {
-  type = "string"
-  name = "Region"
-  icon = "/emojis/1f30e.png"
+  type    = "string"
+  name    = "Region"
+  icon    = "/emojis/1f30e.png"
+  default = "us-pittsburgh"
   option {
     icon  = "/emojis/1f1fa-1f1f8.png"
     name  = "Pittsburgh"
@@ -63,11 +57,6 @@ data "coder_parameter" "region" {
     name  = "São Paulo"
     value = "sa-saopaulo"
   }
-  # option {
-  #   icon = "/emojis/1f1eb-1f1f7.png"
-  #   name = "Phorcys' Server in Paris"
-  #   value = "eu-paris"
-  # }
 }
 
 provider "docker" {
@@ -76,22 +65,80 @@ provider "docker" {
 
 provider "coder" {}
 
-data "coder_git_auth" "github" {
+data "coder_external_auth" "github" {
   id = "github"
 }
 
 data "coder_workspace" "me" {}
 
+module "slackme" {
+  source           = "https://registry.coder.com/modules/slackme"
+  agent_id         = coder_agent.dev.id
+  auth_provider_id = "slack"
+}
+
+module "dotfiles" {
+  source   = "https://registry.coder.com/modules/dotfiles"
+  agent_id = coder_agent.dev.id
+}
+
+module "git-clone" {
+  source   = "https://registry.coder.com/modules/git-clone"
+  agent_id = coder_agent.dev.id
+  url      = "https://github.com/coder/coder"
+  path     = local.repo_dir
+}
+
+module "personalize" {
+  source   = "https://registry.coder.com/modules/personalize"
+  agent_id = coder_agent.dev.id
+}
+
+module "code-server" {
+  source   = "https://registry.coder.com/modules/code-server"
+  agent_id = coder_agent.dev.id
+  folder   = local.repo_dir
+}
+
+module "jetbrains_gateway" {
+  source         = "https://registry.coder.com/modules/jetbrains-gateway"
+  agent_id       = coder_agent.dev.id
+  agent_name     = "dev"
+  folder         = local.repo_dir
+  jetbrains_ides = ["GO", "WS"]
+  default        = "GO"
+}
+
+module "vscode-desktop" {
+  source   = "https://registry.coder.com/modules/vscode-desktop"
+  agent_id = coder_agent.dev.id
+  folder   = local.repo_dir
+}
+
+module "filebrowser" {
+  source   = "https://registry.coder.com/modules/filebrowser"
+  agent_id = coder_agent.dev.id
+}
+
+module "coder-login" {
+  source   = "https://registry.coder.com/modules/coder-login"
+  agent_id = coder_agent.dev.id
+}
+
 resource "coder_agent" "dev" {
   arch = "amd64"
   os   = "linux"
   dir  = data.coder_parameter.repo_dir.value
   env = {
-    GITHUB_TOKEN : data.coder_git_auth.github.access_token,
+    GITHUB_TOKEN : data.coder_external_auth.github.access_token,
     OIDC_TOKEN : data.coder_workspace.me.owner_oidc_access_token,
   }
   startup_script_behavior = "blocking"
 
+  display_apps {
+    vscode = false
+  }
+
   # The following metadata blocks are optional. They are used to display
   # information about your workspace in the dashboard. You can remove them
   # if you don't want to display any information.
@@ -131,6 +178,7 @@ resource "coder_agent" "dev" {
     display_name = "Swap Usage (Host)"
     key          = "4_swap_usage_host"
     script       = <<EOT
+      #!/bin/bash
       echo "$(free -b | awk '/^Swap/ { printf("%.1f/%.1f", $3/1024.0/1024.0/1024.0, $2/1024.0/1024.0/1024.0) }') GiB"
     EOT
     interval     = 10
@@ -142,6 +190,7 @@ resource "coder_agent" "dev" {
     key          = "5_load_host"
     # get load avg scaled by number of cores
     script   = <<EOT
+      #!/bin/bash
       echo "`cat /proc/loadavg | awk '{ print $1 }'` `nproc`" | awk '{ printf "%0.2f", $1/$2 }'
     EOT
     interval = 60
@@ -160,74 +209,20 @@ resource "coder_agent" "dev" {
     display_name = "Word of the Day"
     key          = "7_word"
     script       = <<EOT
+      #!/bin/bash
       curl -o - --silent https://www.merriam-webster.com/word-of-the-day 2>&1 | awk ' $0 ~ "Word of the Day: [A-z]+" { print $5; exit }'
     EOT
     interval     = 86400
     timeout      = 5
   }
 
-
   startup_script_timeout = 60
   startup_script         = <<-EOT
     set -eux -o pipefail
-
-    # change to home
-    cd "$HOME"
-
-    # install and start code-server
-    curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server --version 4.8.3
-    /tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &
-
-    # Install and launch filebrowser
-    curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash
-    filebrowser --noauth --root /home/coder --port 13338 >/tmp/filebrowser.log 2>&1 &
-
-    if [ ! -d ${data.coder_parameter.repo_dir.value} ]; then
-      mkdir -p ${data.coder_parameter.repo_dir.value}
-
-      git clone https://github.com/coder/coder ${data.coder_parameter.repo_dir.value}
-    fi
-
     sudo service docker start
-    DOTFILES_URI="${data.coder_parameter.dotfiles_url.value}"
-    rm -f ~/.personalize.log
-    if [ -n "$${DOTFILES_URI// }" ]; then
-      coder dotfiles "$DOTFILES_URI" -y 2>&1 | tee -a ~/.personalize.log
-    fi
-    if [ -x ~/personalize ]; then
-      ~/personalize 2>&1 | tee -a ~/.personalize.log
-    elif [ -f ~/personalize ]; then
-      echo "~/personalize is not executable, skipping..." | tee -a ~/.personalize.log
-    fi
   EOT
 }
 
-resource "coder_app" "code-server" {
-  agent_id     = coder_agent.dev.id
-  slug         = "code-server"
-  display_name = "code-server"
-  url          = "http://localhost:13337/"
-  icon         = "/icon/code.svg"
-  subdomain    = false
-  share        = "owner"
-
-  healthcheck {
-    url       = "http://localhost:13337/healthz"
-    interval  = 3
-    threshold = 10
-  }
-}
-
-resource "coder_app" "filebrowser" {
-  agent_id     = coder_agent.dev.id
-  display_name = "File Browser"
-  slug         = "filebrowser"
-  url          = "http://localhost:13338"
-  icon         = "https://raw.githubusercontent.com/matifali/logos/main/database.svg"
-  subdomain    = true
-  share        = "owner"
-}
-
 resource "docker_volume" "home_volume" {
   name = "coder-${data.coder_workspace.me.id}-home"
   # Protect the volume from being deleted due to changes in attributes.
@@ -260,15 +255,15 @@ locals {
   registry_name  = "codercom/oss-dogfood"
 }
 data "docker_registry_image" "dogfood" {
-  name = "${local.registry_name}:main"
+  // This is temporarily pinned to a pre-nix version of the image at commit
+  // 6cdf1c73c until the Nix kinks are worked out.
+  name = "${local.registry_name}:pre-nix"
 }
 
 resource "docker_image" "dogfood" {
   name = "${local.registry_name}@${data.docker_registry_image.dogfood.sha256_digest}"
   pull_triggers = [
-    data.docker_registry_image.dogfood.sha256_digest,
-    sha1(join("", [for f in fileset(path.module, "files/*") : filesha1(f)])),
-    filesha1("Dockerfile"),
+    data.docker_registry_image.dogfood.sha256_digest
   ]
   keep_locally = true
 }
@@ -286,6 +281,7 @@ resource "docker_container" "workspace" {
   runtime = "sysbox-runc"
   env = [
     "CODER_AGENT_TOKEN=${coder_agent.dev.token}",
+    "USE_CAP_NET_ADMIN=true",
   ]
   host {
     host = "host.docker.internal"
@@ -296,6 +292,9 @@ resource "docker_container" "workspace" {
     volume_name    = docker_volume.home_volume.name
     read_only      = false
   }
+  capabilities {
+    add = ["CAP_NET_ADMIN", "CAP_SYS_NICE"]
+  }
   # Add labels in Docker to keep track of orphan resources.
   labels {
     label = "coder.owner"
@@ -326,4 +325,8 @@ resource "coder_metadata" "container_info" {
     key   = "runtime"
     value = docker_container.workspace[0].runtime
   }
+  item {
+    key   = "region"
+    value = data.coder_parameter.region.option[index(data.coder_parameter.region.option.*.value, data.coder_parameter.region.value)].name
+  }
 }
diff --git a/dogfood/update-keys.sh b/dogfood/update-keys.sh
deleted file mode 100755
index 9ebaf77bb5256..0000000000000
--- a/dogfood/update-keys.sh
+++ /dev/null
@@ -1,62 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-PROJECT_ROOT="$(git rev-parse --show-toplevel)"
-
-curl_flags=(
-	--silent
-	--show-error
-	--location
-)
-
-gpg_flags=(
-	--dearmor
-	--yes
-)
-
-pushd "$PROJECT_ROOT/dogfood/files/usr/share/keyrings"
-# Upstream Docker signing key
-curl "${curl_flags[@]}" "https://download.docker.com/linux/ubuntu/gpg" |
-	gpg "${gpg_flags[@]}" --output="docker.gpg"
-
-# Google Cloud signing key
-curl "${curl_flags[@]}" "https://packages.cloud.google.com/apt/doc/apt-key.gpg" |
-	gpg "${gpg_flags[@]}" --output="google-cloud.gpg"
-
-# Google Linux Software repository signing key (Chrome)
-curl "${curl_flags[@]}" "https://dl.google.com/linux/linux_signing_key.pub" |
-	gpg "${gpg_flags[@]}" --output="google-chrome.gpg"
-
-# Microsoft repository signing key (Edge)
-curl "${curl_flags[@]}" "https://packages.microsoft.com/keys/microsoft.asc" |
-	gpg "${gpg_flags[@]}" --output="microsoft.gpg"
-
-# Upstream PostgreSQL signing key
-curl "${curl_flags[@]}" "https://www.postgresql.org/media/keys/ACCC4CF8.asc" |
-	gpg "${gpg_flags[@]}" --output="postgresql.gpg"
-
-# NodeSource signing key
-curl "${curl_flags[@]}" "https://deb.nodesource.com/gpgkey/nodesource.gpg.key" |
-	gpg "${gpg_flags[@]}" --output="nodesource.gpg"
-
-# Yarnpkg signing key
-curl "${curl_flags[@]}" "https://dl.yarnpkg.com/debian/pubkey.gpg" |
-	gpg "${gpg_flags[@]}" --output="yarnpkg.gpg"
-
-# Ansible PPA signing key
-curl "${curl_flags[@]}" "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x6125e2a8c77f2818fb7bd15b93c4a3fd7bb9c367" |
-	gpg "${gpg_flags[@]}" --output="ansible.gpg"
-
-# Neovim signing key
-curl "${curl_flags[@]}" "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x9dbb0be9366964f134855e2255f96fcf8231b6dd" |
-	gpg "${gpg_flags[@]}" --output="neovim.gpg"
-
-# Hashicorp signing key
-curl "${curl_flags[@]}" "https://apt.releases.hashicorp.com/gpg" |
-	gpg "${gpg_flags[@]}" --output="hashicorp.gpg"
-
-# GitHub CLI signing key
-curl "${curl_flags[@]}" "https://cli.github.com/packages/githubcli-archive-keyring.gpg" |
-	gpg "${gpg_flags[@]}" --output="github-cli.gpg"
-popd
diff --git a/enterprise/audit/audit.go b/enterprise/audit/audit.go
index 7b345f22f8c66..999923893043a 100644
--- a/enterprise/audit/audit.go
+++ b/enterprise/audit/audit.go
@@ -2,23 +2,37 @@ package audit
 
 import (
 	"context"
+	"database/sql"
 
+	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
 )
 
+type BackendDetails struct {
+	Actor *Actor
+}
+
+type Actor struct {
+	ID       uuid.UUID `json:"id"`
+	Email    string    `json:"email"`
+	Username string    `json:"username"`
+}
+
 // Backends can store or send audit logs to arbitrary locations.
 type Backend interface {
 	// Decision determines the FilterDecisions that the backend tolerates.
 	Decision() FilterDecision
 	// Export sends an audit log to the backend.
-	Export(ctx context.Context, alog database.AuditLog) error
+	Export(ctx context.Context, alog database.AuditLog, details BackendDetails) error
 }
 
-func NewAuditor(filter Filter, backends ...Backend) audit.Auditor {
+func NewAuditor(db database.Store, filter Filter, backends ...Backend) audit.Auditor {
 	return &auditor{
+		db:       db,
 		filter:   filter,
 		backends: backends,
 		Differ: audit.Differ{DiffFn: func(old, new any) audit.Map {
@@ -29,6 +43,7 @@ func NewAuditor(filter Filter, backends ...Backend) audit.Auditor {
 
 // auditor is the enterprise implementation of the Auditor interface.
 type auditor struct {
+	db       database.Store
 	filter   Filter
 	backends []Backend
 
@@ -41,12 +56,21 @@ func (a *auditor) Export(ctx context.Context, alog database.AuditLog) error {
 		return xerrors.Errorf("filter check: %w", err)
 	}
 
+	actor, err := a.db.GetUserByID(dbauthz.AsSystemRestricted(ctx), alog.UserID) //nolint
+	if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
+		return err
+	}
+
 	for _, backend := range a.backends {
 		if decision&backend.Decision() != backend.Decision() {
 			continue
 		}
 
-		err = backend.Export(ctx, alog)
+		err = backend.Export(ctx, alog, BackendDetails{Actor: &Actor{
+			ID:       actor.ID,
+			Email:    actor.Email,
+			Username: actor.Username,
+		}})
 		if err != nil {
 			// naively return the first error. should probably make this smarter
 			// by returning multiple errors.
diff --git a/enterprise/audit/audit_test.go b/enterprise/audit/audit_test.go
index 06c2514323eb5..6d825306c3346 100644
--- a/enterprise/audit/audit_test.go
+++ b/enterprise/audit/audit_test.go
@@ -7,9 +7,10 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/enterprise/audit"
-	"github.com/coder/coder/enterprise/audit/audittest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/enterprise/audit"
+	"github.com/coder/coder/v2/enterprise/audit/audittest"
 )
 
 func TestAuditor(t *testing.T) {
@@ -90,6 +91,7 @@ func TestAuditor(t *testing.T) {
 			var (
 				backend  = &testBackend{decision: test.backendDecision, err: test.backendError}
 				exporter = audit.NewAuditor(
+					dbmem.New(),
 					audit.FilterFunc(func(_ context.Context, _ database.AuditLog) (audit.FilterDecision, error) {
 						return test.filterDecision, test.filterError
 					}),
@@ -113,18 +115,26 @@ type testBackend struct {
 	decision audit.FilterDecision
 	err      error
 
-	alogs []database.AuditLog
+	alogs []testExport
+}
+
+type testExport struct {
+	alog    database.AuditLog
+	details audit.BackendDetails
 }
 
 func (t *testBackend) Decision() audit.FilterDecision {
 	return t.decision
 }
 
-func (t *testBackend) Export(_ context.Context, alog database.AuditLog) error {
+func (t *testBackend) Export(_ context.Context, alog database.AuditLog, details audit.BackendDetails) error {
 	if t.err != nil {
 		return t.err
 	}
 
-	t.alogs = append(t.alogs, alog)
+	t.alogs = append(t.alogs, testExport{
+		alog:    alog,
+		details: details,
+	})
 	return nil
 }
diff --git a/enterprise/audit/audittest/rand.go b/enterprise/audit/audittest/rand.go
index c1560825f0e37..eb7b624249146 100644
--- a/enterprise/audit/audittest/rand.go
+++ b/enterprise/audit/audittest/rand.go
@@ -9,7 +9,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/sqlc-dev/pqtype"
 
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/database"
 )
 
 func RandomLog() database.AuditLog {
@@ -23,12 +23,13 @@ func RandomLog() database.AuditLog {
 			IPNet: *inet,
 			Valid: true,
 		},
-		UserAgent:      sql.NullString{String: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36", Valid: true},
-		ResourceType:   database.ResourceTypeOrganization,
-		ResourceID:     uuid.New(),
-		ResourceTarget: "colin's organization",
-		Action:         database.AuditActionDelete,
-		Diff:           []byte("{}"),
-		StatusCode:     http.StatusNoContent,
+		UserAgent:        sql.NullString{String: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36", Valid: true},
+		ResourceType:     database.ResourceTypeOrganization,
+		ResourceID:       uuid.New(),
+		ResourceTarget:   "colin's organization",
+		Action:           database.AuditActionDelete,
+		Diff:             []byte("{}"),
+		StatusCode:       http.StatusNoContent,
+		AdditionalFields: []byte("{}"),
 	}
 }
diff --git a/enterprise/audit/backends/postgres.go b/enterprise/audit/backends/postgres.go
index a0cadd28995ed..09f29acbe3464 100644
--- a/enterprise/audit/backends/postgres.go
+++ b/enterprise/audit/backends/postgres.go
@@ -5,8 +5,8 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/enterprise/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/enterprise/audit"
 )
 
 type postgresBackend struct {
@@ -30,7 +30,7 @@ func (b *postgresBackend) Decision() audit.FilterDecision {
 	return audit.FilterDecisionExport
 }
 
-func (b *postgresBackend) Export(ctx context.Context, alog database.AuditLog) error {
+func (b *postgresBackend) Export(ctx context.Context, alog database.AuditLog, _ audit.BackendDetails) error {
 	_, err := b.db.InsertAuditLog(ctx, database.InsertAuditLogParams(alog))
 	if err != nil {
 		return xerrors.Errorf("insert audit log: %w", err)
diff --git a/enterprise/audit/backends/postgres_test.go b/enterprise/audit/backends/postgres_test.go
index a11001e55d6e4..f566db9cb507b 100644
--- a/enterprise/audit/backends/postgres_test.go
+++ b/enterprise/audit/backends/postgres_test.go
@@ -6,10 +6,11 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/enterprise/audit/audittest"
-	"github.com/coder/coder/enterprise/audit/backends"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/enterprise/audit"
+	"github.com/coder/coder/v2/enterprise/audit/audittest"
+	"github.com/coder/coder/v2/enterprise/audit/backends"
 )
 
 func TestPostgresBackend(t *testing.T) {
@@ -19,13 +20,13 @@ func TestPostgresBackend(t *testing.T) {
 
 		var (
 			ctx, cancel = context.WithCancel(context.Background())
-			db          = dbfake.New()
+			db          = dbmem.New()
 			pgb         = backends.NewPostgres(db, true)
 			alog        = audittest.RandomLog()
 		)
 		defer cancel()
 
-		err := pgb.Export(ctx, alog)
+		err := pgb.Export(ctx, alog, audit.BackendDetails{})
 		require.NoError(t, err)
 
 		got, err := db.GetAuditLogsOffset(ctx, database.GetAuditLogsOffsetParams{
diff --git a/enterprise/audit/backends/slog.go b/enterprise/audit/backends/slog.go
index 2fea8fcbc57c9..c49ebae296ff0 100644
--- a/enterprise/audit/backends/slog.go
+++ b/enterprise/audit/backends/slog.go
@@ -2,12 +2,14 @@ package backends
 
 import (
 	"context"
+	"database/sql"
 
 	"github.com/fatih/structs"
+	"github.com/sqlc-dev/pqtype"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/enterprise/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/enterprise/audit"
 )
 
 type slogBackend struct {
@@ -15,14 +17,14 @@ type slogBackend struct {
 }
 
 func NewSlog(logger slog.Logger) audit.Backend {
-	return slogBackend{log: logger}
+	return &slogBackend{log: logger}
 }
 
-func (slogBackend) Decision() audit.FilterDecision {
+func (*slogBackend) Decision() audit.FilterDecision {
 	return audit.FilterDecisionExport
 }
 
-func (b slogBackend) Export(ctx context.Context, alog database.AuditLog) error {
+func (b *slogBackend) Export(ctx context.Context, alog database.AuditLog, details audit.BackendDetails) error {
 	// We don't use structs.Map because we don't want to recursively convert
 	// fields into maps. When we keep the type information, slog can more
 	// pleasantly format the output. For example, the clean result of
@@ -30,9 +32,26 @@ func (b slogBackend) Export(ctx context.Context, alog database.AuditLog) error {
 	sfs := structs.Fields(alog)
 	var fields []any
 	for _, sf := range sfs {
-		fields = append(fields, slog.F(sf.Name(), sf.Value()))
+		fields = append(fields, b.fieldToSlog(sf))
+	}
+
+	if details.Actor != nil {
+		fields = append(fields, slog.F("actor", details.Actor))
 	}
 
 	b.log.Info(ctx, "audit_log", fields...)
 	return nil
 }
+
+func (*slogBackend) fieldToSlog(field *structs.Field) slog.Field {
+	val := field.Value()
+
+	switch ty := field.Value().(type) {
+	case pqtype.Inet:
+		val = ty.IPNet.IP.String()
+	case sql.NullString:
+		val = ty.String
+	}
+
+	return slog.F(field.Name(), val)
+}
diff --git a/enterprise/audit/backends/slog_test.go b/enterprise/audit/backends/slog_test.go
index c963746bf2dd3..5fe3cf70c519a 100644
--- a/enterprise/audit/backends/slog_test.go
+++ b/enterprise/audit/backends/slog_test.go
@@ -1,15 +1,27 @@
 package backends_test
 
 import (
+	"bytes"
 	"context"
+	"database/sql"
+	"encoding/json"
+	"net"
+	"net/http"
 	"testing"
+	"time"
 
 	"github.com/fatih/structs"
+	"github.com/google/uuid"
+	"github.com/sqlc-dev/pqtype"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/enterprise/audit/audittest"
-	"github.com/coder/coder/enterprise/audit/backends"
+	"cdr.dev/slog/sloggers/slogjson"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/enterprise/audit"
+	"github.com/coder/coder/v2/enterprise/audit/audittest"
+	"github.com/coder/coder/v2/enterprise/audit/backends"
 )
 
 func TestSlogBackend(t *testing.T) {
@@ -28,12 +40,64 @@ func TestSlogBackend(t *testing.T) {
 		)
 		defer cancel()
 
-		err := backend.Export(ctx, alog)
+		err := backend.Export(ctx, alog, audit.BackendDetails{})
 		require.NoError(t, err)
 		require.Len(t, sink.entries, 1)
 		require.Equal(t, sink.entries[0].Message, "audit_log")
 		require.Len(t, sink.entries[0].Fields, len(structs.Fields(alog)))
 	})
+
+	t.Run("FormatsCorrectly", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			ctx, cancel = context.WithCancel(context.Background())
+
+			buf     = bytes.NewBuffer(nil)
+			logger  = slog.Make(slogjson.Sink(buf))
+			backend = backends.NewSlog(logger)
+
+			_, inet, _ = net.ParseCIDR("127.0.0.1/32")
+			alog       = database.AuditLog{
+				ID:             uuid.UUID{1},
+				Time:           time.Unix(1257894000, 0).UTC(),
+				UserID:         uuid.UUID{2},
+				OrganizationID: uuid.UUID{3},
+				Ip: pqtype.Inet{
+					IPNet: *inet,
+					Valid: true,
+				},
+				UserAgent:        sql.NullString{String: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36", Valid: true},
+				ResourceType:     database.ResourceTypeOrganization,
+				ResourceID:       uuid.UUID{4},
+				ResourceTarget:   "colin's organization",
+				ResourceIcon:     "photo.png",
+				Action:           database.AuditActionDelete,
+				Diff:             []byte(`{"1": 2}`),
+				StatusCode:       http.StatusNoContent,
+				AdditionalFields: []byte(`{"name":"doug","species":"cat"}`),
+				RequestID:        uuid.UUID{5},
+			}
+		)
+		defer cancel()
+
+		err := backend.Export(ctx, alog, audit.BackendDetails{Actor: &audit.Actor{
+			ID:       uuid.UUID{2},
+			Username: "coadler",
+			Email:    "doug@coder.com",
+		}})
+		require.NoError(t, err)
+		logger.Sync()
+
+		s := struct {
+			Fields json.RawMessage `json:"fields"`
+		}{}
+		err = json.Unmarshal(buf.Bytes(), &s)
+		require.NoError(t, err)
+
+		expected := `{"ID":"01000000-0000-0000-0000-000000000000","Time":"2009-11-10T23:00:00Z","UserID":"02000000-0000-0000-0000-000000000000","OrganizationID":"03000000-0000-0000-0000-000000000000","Ip":"127.0.0.1","UserAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36","ResourceType":"organization","ResourceID":"04000000-0000-0000-0000-000000000000","ResourceTarget":"colin's organization","Action":"delete","Diff":{"1":2},"StatusCode":204,"AdditionalFields":{"name":"doug","species":"cat"},"RequestID":"05000000-0000-0000-0000-000000000000","ResourceIcon":"photo.png","actor":{"id":"02000000-0000-0000-0000-000000000000","email":"doug@coder.com","username":"coadler"}}`
+		assert.Equal(t, expected, string(s.Fields))
+	})
 }
 
 type fakeSink struct {
diff --git a/enterprise/audit/diff.go b/enterprise/audit/diff.go
index ca5c454e51b54..59780d2918418 100644
--- a/enterprise/audit/diff.go
+++ b/enterprise/audit/diff.go
@@ -8,9 +8,9 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/util/ptr"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/util/ptr"
 )
 
 func structName(t reflect.Type) string {
diff --git a/enterprise/audit/diff_internal_test.go b/enterprise/audit/diff_internal_test.go
index d53a9ad1f3e82..f98d16138cf1f 100644
--- a/enterprise/audit/diff_internal_test.go
+++ b/enterprise/audit/diff_internal_test.go
@@ -11,9 +11,9 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/util/ptr"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/util/ptr"
 )
 
 func Test_diffValues(t *testing.T) {
diff --git a/enterprise/audit/filter.go b/enterprise/audit/filter.go
index 868d5bb7d77db..113bfc101b799 100644
--- a/enterprise/audit/filter.go
+++ b/enterprise/audit/filter.go
@@ -3,7 +3,7 @@ package audit
 import (
 	"context"
 
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/database"
 )
 
 // FilterDecision is a bitwise flag describing the actions a given filter allows
diff --git a/enterprise/audit/table.go b/enterprise/audit/table.go
index b5ab50457c963..f272354d649ac 100644
--- a/enterprise/audit/table.go
+++ b/enterprise/audit/table.go
@@ -6,8 +6,8 @@ import (
 	"reflect"
 	"runtime"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // This mapping creates a relationship between an Auditable Resource
@@ -58,47 +58,50 @@ var auditableResourcesTypes = map[any]map[string]Action{
 		"public_key":  ActionTrack,  // Public keys are ok to expose in a diff.
 	},
 	&database.Template{}: {
-		"id":                               ActionTrack,
-		"created_at":                       ActionIgnore, // Never changes, but is implicit and not helpful in a diff.
-		"updated_at":                       ActionIgnore, // Changes, but is implicit and not helpful in a diff.
-		"organization_id":                  ActionIgnore, /// Never changes.
-		"deleted":                          ActionIgnore, // Changes, but is implicit when a delete event is fired.
-		"name":                             ActionTrack,
-		"display_name":                     ActionTrack,
-		"provisioner":                      ActionTrack,
-		"active_version_id":                ActionTrack,
-		"description":                      ActionTrack,
-		"icon":                             ActionTrack,
-		"default_ttl":                      ActionTrack,
-		"max_ttl":                          ActionTrack,
-		"restart_requirement_days_of_week": ActionTrack,
-		"restart_requirement_weeks":        ActionTrack,
-		"created_by":                       ActionTrack,
-		"created_by_username":              ActionIgnore,
-		"created_by_avatar_url":            ActionIgnore,
-		"group_acl":                        ActionTrack,
-		"user_acl":                         ActionTrack,
-		"allow_user_autostart":             ActionTrack,
-		"allow_user_autostop":              ActionTrack,
-		"allow_user_cancel_workspace_jobs": ActionTrack,
-		"failure_ttl":                      ActionTrack,
-		"inactivity_ttl":                   ActionTrack,
-		"locked_ttl":                       ActionTrack,
+		"id":                                ActionTrack,
+		"created_at":                        ActionIgnore, // Never changes, but is implicit and not helpful in a diff.
+		"updated_at":                        ActionIgnore, // Changes, but is implicit and not helpful in a diff.
+		"organization_id":                   ActionIgnore, /// Never changes.
+		"deleted":                           ActionIgnore, // Changes, but is implicit when a delete event is fired.
+		"name":                              ActionTrack,
+		"display_name":                      ActionTrack,
+		"provisioner":                       ActionTrack,
+		"active_version_id":                 ActionTrack,
+		"description":                       ActionTrack,
+		"icon":                              ActionTrack,
+		"default_ttl":                       ActionTrack,
+		"max_ttl":                           ActionTrack,
+		"autostart_block_days_of_week":      ActionTrack,
+		"autostop_requirement_days_of_week": ActionTrack,
+		"autostop_requirement_weeks":        ActionTrack,
+		"created_by":                        ActionTrack,
+		"created_by_username":               ActionIgnore,
+		"created_by_avatar_url":             ActionIgnore,
+		"group_acl":                         ActionTrack,
+		"user_acl":                          ActionTrack,
+		"allow_user_autostart":              ActionTrack,
+		"allow_user_autostop":               ActionTrack,
+		"allow_user_cancel_workspace_jobs":  ActionTrack,
+		"failure_ttl":                       ActionTrack,
+		"time_til_dormant":                  ActionTrack,
+		"time_til_dormant_autodelete":       ActionTrack,
+		"require_active_version":            ActionTrack,
 	},
 	&database.TemplateVersion{}: {
-		"id":                    ActionTrack,
-		"template_id":           ActionTrack,
-		"organization_id":       ActionIgnore, // Never changes.
-		"created_at":            ActionIgnore, // Never changes, but is implicit and not helpful in a diff.
-		"updated_at":            ActionIgnore, // Changes, but is implicit and not helpful in a diff.
-		"name":                  ActionTrack,
-		"message":               ActionIgnore, // Never changes after creation.
-		"readme":                ActionTrack,
-		"job_id":                ActionIgnore, // Not helpful in a diff because jobs aren't tracked in audit logs.
-		"created_by":            ActionTrack,
-		"git_auth_providers":    ActionIgnore, // Not helpful because this can only change when new versions are added.
-		"created_by_avatar_url": ActionIgnore,
-		"created_by_username":   ActionIgnore,
+		"id":                      ActionTrack,
+		"template_id":             ActionTrack,
+		"organization_id":         ActionIgnore, // Never changes.
+		"created_at":              ActionIgnore, // Never changes, but is implicit and not helpful in a diff.
+		"updated_at":              ActionIgnore, // Changes, but is implicit and not helpful in a diff.
+		"name":                    ActionTrack,
+		"message":                 ActionIgnore, // Never changes after creation.
+		"readme":                  ActionTrack,
+		"job_id":                  ActionIgnore, // Not helpful in a diff because jobs aren't tracked in audit logs.
+		"created_by":              ActionTrack,
+		"external_auth_providers": ActionIgnore, // Not helpful because this can only change when new versions are added.
+		"created_by_avatar_url":   ActionIgnore,
+		"created_by_username":     ActionIgnore,
+		"archived":                ActionTrack,
 	},
 	&database.User{}: {
 		"id":                   ActionTrack,
@@ -127,8 +130,9 @@ var auditableResourcesTypes = map[any]map[string]Action{
 		"autostart_schedule": ActionTrack,
 		"ttl":                ActionTrack,
 		"last_used_at":       ActionIgnore,
-		"locked_at":          ActionTrack,
+		"dormant_at":         ActionTrack,
 		"deleting_at":        ActionTrack,
+		"automatic_updates":  ActionTrack,
 	},
 	&database.WorkspaceBuild{}: {
 		"id":                      ActionIgnore,
@@ -156,6 +160,7 @@ var auditableResourcesTypes = map[any]map[string]Action{
 		"avatar_url":      ActionTrack,
 		"quota_allowance": ActionTrack,
 		"members":         ActionTrack,
+		"source":          ActionIgnore,
 	},
 	&database.APIKey{}: {
 		"id":               ActionIgnore,
diff --git a/enterprise/audit/table_internal_test.go b/enterprise/audit/table_internal_test.go
index 77e75257d3f08..4882828574db6 100644
--- a/enterprise/audit/table_internal_test.go
+++ b/enterprise/audit/table_internal_test.go
@@ -10,9 +10,9 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/tools/go/packages"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/util/slice"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/util/slice"
 )
 
 // TestAuditableResources ensures that all auditable resources are included in
@@ -48,7 +48,7 @@ func TestAuditableResources(t *testing.T) {
 	expectedList := make([]string, 0)
 	// Now we check we have all the resources in the AuditableResources
 	for i := 0; i < unionType.Len(); i++ {
-		// All types come across like 'github.com/coder/coder/coderd/database.<type>'
+		// All types come across like 'github.com/coder/coder/v2/coderd/database.<type>'
 		typeName := unionType.Term(i).Type().String()
 		_, ok := AuditableResources[typeName]
 		assert.True(t, ok, "missing resource %q from AuditableResources", typeName)
diff --git a/enterprise/cli/features.go b/enterprise/cli/features.go
index e02feb7781ce6..57435dbbf29dd 100644
--- a/enterprise/cli/features.go
+++ b/enterprise/cli/features.go
@@ -10,9 +10,9 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) features() *clibase.Cmd {
diff --git a/enterprise/cli/features_test.go b/enterprise/cli/features_test.go
index 042a67a2dad31..406e626d363bd 100644
--- a/enterprise/cli/features_test.go
+++ b/enterprise/cli/features_test.go
@@ -8,10 +8,10 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestFeaturesList(t *testing.T) {
diff --git a/enterprise/cli/groupcreate.go b/enterprise/cli/groupcreate.go
index d80c1d441e69d..e5f7bbd8a3bb9 100644
--- a/enterprise/cli/groupcreate.go
+++ b/enterprise/cli/groupcreate.go
@@ -5,10 +5,11 @@ import (
 
 	"golang.org/x/xerrors"
 
-	agpl "github.com/coder/coder/cli"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	agpl "github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/pretty"
 )
 
 func (r *RootCmd) groupCreate() *clibase.Cmd {
@@ -42,7 +43,7 @@ func (r *RootCmd) groupCreate() *clibase.Cmd {
 				return xerrors.Errorf("create group: %w", err)
 			}
 
-			_, _ = fmt.Fprintf(inv.Stdout, "Successfully created group %s!\n", cliui.DefaultStyles.Keyword.Render(group.Name))
+			_, _ = fmt.Fprintf(inv.Stdout, "Successfully created group %s!\n", pretty.Sprint(cliui.DefaultStyles.Keyword, group.Name))
 			return nil
 		},
 	}
diff --git a/enterprise/cli/groupcreate_test.go b/enterprise/cli/groupcreate_test.go
index 484cb42c46b59..783ce12f7cf8e 100644
--- a/enterprise/cli/groupcreate_test.go
+++ b/enterprise/cli/groupcreate_test.go
@@ -6,12 +6,14 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestCreateGroup(t *testing.T) {
@@ -43,6 +45,6 @@ func TestCreateGroup(t *testing.T) {
 		err := inv.Run()
 		require.NoError(t, err)
 
-		pty.ExpectMatch(fmt.Sprintf("Successfully created group %s!", cliui.DefaultStyles.Keyword.Render(groupName)))
+		pty.ExpectMatch(fmt.Sprintf("Successfully created group %s!", pretty.Sprint(cliui.DefaultStyles.Keyword, groupName)))
 	})
 }
diff --git a/enterprise/cli/groupdelete.go b/enterprise/cli/groupdelete.go
index 268d8064df310..e7ca01ba36de8 100644
--- a/enterprise/cli/groupdelete.go
+++ b/enterprise/cli/groupdelete.go
@@ -5,10 +5,11 @@ import (
 
 	"golang.org/x/xerrors"
 
-	agpl "github.com/coder/coder/cli"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	agpl "github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/pretty"
 )
 
 func (r *RootCmd) groupDelete() *clibase.Cmd {
@@ -41,7 +42,7 @@ func (r *RootCmd) groupDelete() *clibase.Cmd {
 				return xerrors.Errorf("delete group: %w", err)
 			}
 
-			_, _ = fmt.Fprintf(inv.Stdout, "Successfully deleted group %s!\n", cliui.DefaultStyles.Keyword.Render(group.Name))
+			_, _ = fmt.Fprintf(inv.Stdout, "Successfully deleted group %s!\n", pretty.Sprint(cliui.DefaultStyles.Keyword, group.Name))
 			return nil
 		},
 	}
diff --git a/enterprise/cli/groupdelete_test.go b/enterprise/cli/groupdelete_test.go
index 91ee5a337155b..21aa6391bd4ba 100644
--- a/enterprise/cli/groupdelete_test.go
+++ b/enterprise/cli/groupdelete_test.go
@@ -6,13 +6,15 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestGroupDelete(t *testing.T) {
@@ -45,7 +47,7 @@ func TestGroupDelete(t *testing.T) {
 		err = inv.Run()
 		require.NoError(t, err)
 
-		pty.ExpectMatch(fmt.Sprintf("Successfully deleted group %s", cliui.DefaultStyles.Keyword.Render(group.Name)))
+		pty.ExpectMatch(fmt.Sprintf("Successfully deleted group %s", pretty.Sprint(cliui.DefaultStyles.Keyword, group.Name)))
 	})
 
 	t.Run("NoArg", func(t *testing.T) {
diff --git a/enterprise/cli/groupedit.go b/enterprise/cli/groupedit.go
index 9ef6a3100658d..8811378bc0a34 100644
--- a/enterprise/cli/groupedit.go
+++ b/enterprise/cli/groupedit.go
@@ -7,10 +7,12 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	agpl "github.com/coder/coder/cli"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/pretty"
+
+	agpl "github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) groupEdit() *clibase.Cmd {
@@ -77,7 +79,7 @@ func (r *RootCmd) groupEdit() *clibase.Cmd {
 				return xerrors.Errorf("patch group: %w", err)
 			}
 
-			_, _ = fmt.Fprintf(inv.Stdout, "Successfully patched group %s!\n", cliui.DefaultStyles.Keyword.Render(group.Name))
+			_, _ = fmt.Fprintf(inv.Stdout, "Successfully patched group %s!\n", pretty.Sprint(cliui.DefaultStyles.Keyword, group.Name))
 			return nil
 		},
 	}
diff --git a/enterprise/cli/groupedit_test.go b/enterprise/cli/groupedit_test.go
index d91704885717d..a0d192854f85a 100644
--- a/enterprise/cli/groupedit_test.go
+++ b/enterprise/cli/groupedit_test.go
@@ -6,14 +6,16 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestGroupEdit(t *testing.T) {
@@ -65,7 +67,7 @@ func TestGroupEdit(t *testing.T) {
 		err = inv.Run()
 		require.NoError(t, err)
 
-		pty.ExpectMatch(fmt.Sprintf("Successfully patched group %s", cliui.DefaultStyles.Keyword.Render(expectedName)))
+		pty.ExpectMatch(fmt.Sprintf("Successfully patched group %s", pretty.Sprint(cliui.DefaultStyles.Keyword, expectedName)))
 	})
 
 	t.Run("InvalidUserInput", func(t *testing.T) {
diff --git a/enterprise/cli/grouplist.go b/enterprise/cli/grouplist.go
index 51c36c4ba8ac9..78bcb28ca13ac 100644
--- a/enterprise/cli/grouplist.go
+++ b/enterprise/cli/grouplist.go
@@ -7,10 +7,10 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	agpl "github.com/coder/coder/cli"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	agpl "github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) groupList() *clibase.Cmd {
diff --git a/enterprise/cli/grouplist_test.go b/enterprise/cli/grouplist_test.go
index 90e054a03faab..2787893faecb1 100644
--- a/enterprise/cli/grouplist_test.go
+++ b/enterprise/cli/grouplist_test.go
@@ -5,13 +5,13 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestGroupList(t *testing.T) {
@@ -74,10 +74,10 @@ func TestGroupList(t *testing.T) {
 		}
 	})
 
-	t.Run("NoGroups", func(t *testing.T) {
+	t.Run("Everyone", func(t *testing.T) {
 		t.Parallel()
 
-		client, _ := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+		client, user := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
 			Features: license.Features{
 				codersdk.FeatureTemplateRBAC: 1,
 			},
@@ -87,13 +87,19 @@ func TestGroupList(t *testing.T) {
 
 		pty := ptytest.New(t)
 
-		inv.Stderr = pty.Output()
+		inv.Stdout = pty.Output()
 		clitest.SetupConfig(t, client, conf)
 
 		err := inv.Run()
 		require.NoError(t, err)
 
-		pty.ExpectMatch("No groups found")
-		pty.ExpectMatch("coder groups create <name>")
+		matches := []string{
+			"NAME", "ORGANIZATION ID", "MEMBERS", " AVATAR URL",
+			"Everyone", user.OrganizationID.String(), coderdtest.FirstUserParams.Email, "",
+		}
+
+		for _, match := range matches {
+			pty.ExpectMatch(match)
+		}
 	})
 }
diff --git a/enterprise/cli/groups.go b/enterprise/cli/groups.go
index adf7c8c527509..ff537697ea02c 100644
--- a/enterprise/cli/groups.go
+++ b/enterprise/cli/groups.go
@@ -1,7 +1,7 @@
 package cli
 
 import (
-	"github.com/coder/coder/cli/clibase"
+	"github.com/coder/coder/v2/cli/clibase"
 )
 
 func (r *RootCmd) groups() *clibase.Cmd {
diff --git a/enterprise/cli/licenses.go b/enterprise/cli/licenses.go
index e4bf3e0731636..45e3d3e6ec97d 100644
--- a/enterprise/cli/licenses.go
+++ b/enterprise/cli/licenses.go
@@ -13,9 +13,9 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 var jwtRegexp = regexp.MustCompile(`^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$`)
diff --git a/enterprise/cli/licenses_test.go b/enterprise/cli/licenses_test.go
index 9272a103fad08..178068840dd56 100644
--- a/enterprise/cli/licenses_test.go
+++ b/enterprise/cli/licenses_test.go
@@ -16,13 +16,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 const (
@@ -254,6 +254,7 @@ func newFakeLicenseAPI(t *testing.T) http.Handler {
 	r.Post("/api/v2/licenses", a.postLicense)
 	r.Get("/api/v2/licenses", a.licenses)
 	r.Get("/api/v2/buildinfo", a.noop)
+	r.Get("/api/v2/users/me", a.noop)
 	r.Delete("/api/v2/licenses/{id}", a.deleteLicense)
 	r.Get("/api/v2/entitlements", a.entitlements)
 	return r
diff --git a/enterprise/cli/provisionerdaemons.go b/enterprise/cli/provisionerdaemons.go
index f3dfc2ba367d7..623368487ff68 100644
--- a/enterprise/cli/provisionerdaemons.go
+++ b/enterprise/cli/provisionerdaemons.go
@@ -1,3 +1,5 @@
+//go:build !slim
+
 package cli
 
 import (
@@ -7,20 +9,22 @@ import (
 	"os/signal"
 	"time"
 
+	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
-	agpl "github.com/coder/coder/cli"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner/terraform"
-	"github.com/coder/coder/provisionerd"
-	provisionerdproto "github.com/coder/coder/provisionerd/proto"
-	"github.com/coder/coder/provisionersdk"
-	"github.com/coder/coder/provisionersdk/proto"
+	agpl "github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/provisionerdserver"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/terraform"
+	"github.com/coder/coder/v2/provisionerd"
+	provisionerdproto "github.com/coder/coder/v2/provisionerd/proto"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 func (r *RootCmd) provisionerDaemons() *clibase.Cmd {
@@ -44,13 +48,14 @@ func (r *RootCmd) provisionerDaemonStart() *clibase.Cmd {
 		rawTags      []string
 		pollInterval time.Duration
 		pollJitter   time.Duration
+		preSharedKey string
 	)
 	client := new(codersdk.Client)
 	cmd := &clibase.Cmd{
 		Use:   "start",
 		Short: "Run a provisioner daemon",
 		Middleware: clibase.Chain(
-			r.InitClient(client),
+			r.InitClientMissingTokenOK(client),
 		),
 		Handler: func(inv *clibase.Invocation) error {
 			ctx, cancel := context.WithCancel(inv.Context())
@@ -59,21 +64,38 @@ func (r *RootCmd) provisionerDaemonStart() *clibase.Cmd {
 			notifyCtx, notifyStop := signal.NotifyContext(ctx, agpl.InterruptSignals...)
 			defer notifyStop()
 
-			org, err := agpl.CurrentOrganization(inv, client)
-			if err != nil {
-				return xerrors.Errorf("get current organization: %w", err)
-			}
-
 			tags, err := agpl.ParseProvisionerTags(rawTags)
 			if err != nil {
 				return err
 			}
 
+			logger := slog.Make(sloghuman.Sink(inv.Stderr))
+			if ok, _ := inv.ParsedFlags().GetBool("verbose"); ok {
+				logger = logger.Leveled(slog.LevelDebug)
+			}
+
+			if len(tags) != 0 {
+				logger.Info(ctx, "note: tagged provisioners can currently pick up jobs from untagged templates")
+				logger.Info(ctx, "see https://github.com/coder/coder/issues/6442 for details")
+			}
+
+			// When authorizing with a PSK, we automatically scope the provisionerd
+			// to organization. Scoping to user with PSK auth is not a valid configuration.
+			if preSharedKey != "" {
+				logger.Info(ctx, "psk auth automatically sets tag "+provisionerdserver.TagScope+"="+provisionerdserver.ScopeOrganization)
+				tags[provisionerdserver.TagScope] = provisionerdserver.ScopeOrganization
+			}
+
 			err = os.MkdirAll(cacheDir, 0o700)
 			if err != nil {
 				return xerrors.Errorf("mkdir %q: %w", cacheDir, err)
 			}
 
+			tempDir, err := os.MkdirTemp("", "provisionerd")
+			if err != nil {
+				return err
+			}
+
 			terraformClient, terraformServer := provisionersdk.MemTransportPipe()
 			go func() {
 				<-ctx.Done()
@@ -81,17 +103,17 @@ func (r *RootCmd) provisionerDaemonStart() *clibase.Cmd {
 				_ = terraformServer.Close()
 			}()
 
-			logger := slog.Make(sloghuman.Sink(inv.Stderr))
 			errCh := make(chan error, 1)
 			go func() {
 				defer cancel()
 
 				err := terraform.Serve(ctx, &terraform.ServeOptions{
 					ServeOptions: &provisionersdk.ServeOptions{
-						Listener: terraformServer,
+						Listener:      terraformServer,
+						Logger:        logger.Named("terraform"),
+						WorkDirectory: tempDir,
 					},
 					CachePath: cacheDir,
-					Logger:    logger.Named("terraform"),
 				})
 				if err != nil && !xerrors.Is(err, context.Canceled) {
 					select {
@@ -101,34 +123,32 @@ func (r *RootCmd) provisionerDaemonStart() *clibase.Cmd {
 				}
 			}()
 
-			tempDir, err := os.MkdirTemp("", "provisionerd")
-			if err != nil {
-				return err
-			}
-
 			logger.Info(ctx, "starting provisioner daemon", slog.F("tags", tags))
 
-			provisioners := provisionerd.Provisioners{
+			connector := provisionerd.LocalProvisioners{
 				string(database.ProvisionerTypeTerraform): proto.NewDRPCProvisionerClient(terraformClient),
 			}
+			id := uuid.New()
 			srv := provisionerd.New(func(ctx context.Context) (provisionerdproto.DRPCProvisionerDaemonClient, error) {
-				return client.ServeProvisionerDaemon(ctx, org.ID, []codersdk.ProvisionerType{
-					codersdk.ProvisionerTypeTerraform,
-				}, tags)
+				return client.ServeProvisionerDaemon(ctx, codersdk.ServeProvisionerDaemonRequest{
+					ID: id,
+					Provisioners: []codersdk.ProvisionerType{
+						codersdk.ProvisionerTypeTerraform,
+					},
+					Tags:         tags,
+					PreSharedKey: preSharedKey,
+				})
 			}, &provisionerd.Options{
-				Logger:          logger,
-				JobPollInterval: pollInterval,
-				JobPollJitter:   pollJitter,
-				UpdateInterval:  500 * time.Millisecond,
-				Provisioners:    provisioners,
-				WorkDirectory:   tempDir,
+				Logger:         logger,
+				UpdateInterval: 500 * time.Millisecond,
+				Connector:      connector,
 			})
 
 			var exitErr error
 			select {
 			case <-notifyCtx.Done():
 				exitErr = notifyCtx.Err()
-				_, _ = fmt.Fprintln(inv.Stdout, cliui.DefaultStyles.Bold.Render(
+				_, _ = fmt.Fprintln(inv.Stdout, cliui.Bold(
 					"Interrupt caught, gracefully exiting. Use ctrl+\\ to force quit",
 				))
 			case exitErr = <-errCh:
@@ -137,9 +157,7 @@ func (r *RootCmd) provisionerDaemonStart() *clibase.Cmd {
 				cliui.Errorf(inv.Stderr, "Unexpected error, shutting down server: %s\n", exitErr)
 			}
 
-			shutdown, shutdownCancel := context.WithTimeout(ctx, time.Minute)
-			defer shutdownCancel()
-			err = srv.Shutdown(shutdown)
+			err = srv.Shutdown(ctx)
 			if err != nil {
 				return xerrors.Errorf("shutdown: %w", err)
 			}
@@ -172,16 +190,22 @@ func (r *RootCmd) provisionerDaemonStart() *clibase.Cmd {
 			Flag:        "poll-interval",
 			Env:         "CODER_PROVISIONERD_POLL_INTERVAL",
 			Default:     time.Second.String(),
-			Description: "How often to poll for provisioner jobs.",
+			Description: "Deprecated and ignored.",
 			Value:       clibase.DurationOf(&pollInterval),
 		},
 		{
 			Flag:        "poll-jitter",
 			Env:         "CODER_PROVISIONERD_POLL_JITTER",
-			Description: "How much to jitter the poll interval by.",
+			Description: "Deprecated and ignored.",
 			Default:     (100 * time.Millisecond).String(),
 			Value:       clibase.DurationOf(&pollJitter),
 		},
+		{
+			Flag:        "psk",
+			Env:         "CODER_PROVISIONER_DAEMON_PSK",
+			Description: "Pre-shared key to authenticate with Coder server.",
+			Value:       clibase.StringOf(&preSharedKey),
+		},
 	}
 
 	return cmd
diff --git a/enterprise/cli/provisionerdaemons_slim.go b/enterprise/cli/provisionerdaemons_slim.go
new file mode 100644
index 0000000000000..27fdf74b0ac59
--- /dev/null
+++ b/enterprise/cli/provisionerdaemons_slim.go
@@ -0,0 +1,24 @@
+//go:build slim
+
+package cli
+
+import (
+	agplcli "github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clibase"
+)
+
+func (r *RootCmd) provisionerDaemons() *clibase.Cmd {
+	cmd := &clibase.Cmd{
+		Use:   "provisionerd",
+		Short: "Manage provisioner daemons",
+		// We accept RawArgs so all commands and flags are accepted.
+		RawArgs: true,
+		Hidden:  true,
+		Handler: func(inv *clibase.Invocation) error {
+			agplcli.SlimUnsupported(inv.Stderr, "provisionerd")
+			return nil
+		},
+	}
+
+	return cmd
+}
diff --git a/enterprise/cli/provisionerdaemons_test.go b/enterprise/cli/provisionerdaemons_test.go
new file mode 100644
index 0000000000000..038ba97ec7a54
--- /dev/null
+++ b/enterprise/cli/provisionerdaemons_test.go
@@ -0,0 +1,56 @@
+package cli_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestProvisionerDaemon_PSK(t *testing.T) {
+	t.Parallel()
+
+	client, _ := coderdenttest.New(t, &coderdenttest.Options{
+		ProvisionerDaemonPSK: "provisionersftw",
+		LicenseOptions: &coderdenttest.LicenseOptions{
+			Features: license.Features{
+				codersdk.FeatureExternalProvisionerDaemons: 1,
+			},
+		},
+	})
+	inv, conf := newCLI(t, "provisionerd", "start", "--psk=provisionersftw")
+	err := conf.URL().Write(client.URL.String())
+	require.NoError(t, err)
+	pty := ptytest.New(t).Attach(inv)
+	ctx, cancel := context.WithTimeout(inv.Context(), testutil.WaitLong)
+	defer cancel()
+	clitest.Start(t, inv)
+	pty.ExpectMatchContext(ctx, "starting provisioner daemon")
+}
+
+func TestProvisionerDaemon_SessionToken(t *testing.T) {
+	t.Parallel()
+
+	client, _ := coderdenttest.New(t, &coderdenttest.Options{
+		ProvisionerDaemonPSK: "provisionersftw",
+		LicenseOptions: &coderdenttest.LicenseOptions{
+			Features: license.Features{
+				codersdk.FeatureExternalProvisionerDaemons: 1,
+			},
+		},
+	})
+	inv, conf := newCLI(t, "provisionerd", "start")
+	clitest.SetupConfig(t, client, conf)
+	pty := ptytest.New(t).Attach(inv)
+	ctx, cancel := context.WithTimeout(inv.Context(), testutil.WaitLong)
+	defer cancel()
+	clitest.Start(t, inv)
+	pty.ExpectMatchContext(ctx, "starting provisioner daemon")
+}
diff --git a/enterprise/cli/proxyserver.go b/enterprise/cli/proxyserver.go
index f40d12d6d4cde..6829b155eb2fd 100644
--- a/enterprise/cli/proxyserver.go
+++ b/enterprise/cli/proxyserver.go
@@ -22,14 +22,14 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/cli"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/wsproxy"
+	"github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/wsproxy"
 )
 
 type closers []func()
@@ -151,7 +151,7 @@ func (*RootCmd) proxyServer() *clibase.Cmd {
 			defer http.DefaultClient.CloseIdleConnections()
 			closers.Add(http.DefaultClient.CloseIdleConnections)
 
-			tracer, _, closeTracing := cli.ConfigureTraceProvider(ctx, logger, inv, cfg)
+			tracer, _, closeTracing := cli.ConfigureTraceProvider(ctx, logger, cfg)
 			defer func() {
 				logger.Debug(ctx, "closing tracing")
 				traceCloseErr := shutdownWithTimeout(closeTracing, 5*time.Second)
@@ -305,7 +305,7 @@ func (*RootCmd) proxyServer() *clibase.Cmd {
 			case exitErr = <-errCh:
 			case <-notifyCtx.Done():
 				exitErr = notifyCtx.Err()
-				_, _ = fmt.Fprintln(inv.Stdout, cliui.DefaultStyles.Bold.Render(
+				_, _ = fmt.Fprintln(inv.Stdout, cliui.Bold(
 					"Interrupt caught, gracefully exiting. Use ctrl+\\ to force quit",
 				))
 			}
diff --git a/enterprise/cli/proxyserver_slim.go b/enterprise/cli/proxyserver_slim.go
index 48dd85710ded7..c23ccd998aa21 100644
--- a/enterprise/cli/proxyserver_slim.go
+++ b/enterprise/cli/proxyserver_slim.go
@@ -3,12 +3,8 @@
 package cli
 
 import (
-	"fmt"
-	"io"
-	"os"
-
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
+	agplcli "github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clibase"
 )
 
 func (r *RootCmd) proxyServer() *clibase.Cmd {
@@ -20,18 +16,10 @@ func (r *RootCmd) proxyServer() *clibase.Cmd {
 		RawArgs: true,
 		Hidden:  true,
 		Handler: func(inv *clibase.Invocation) error {
-			serverUnsupported(inv.Stderr)
+			agplcli.SlimUnsupported(inv.Stderr, "workspace-proxy server")
 			return nil
 		},
 	}
 
 	return root
 }
-
-func serverUnsupported(w io.Writer) {
-	_, _ = fmt.Fprintf(w, "You are using a 'slim' build of Coder, which does not support the %s subcommand.\n", cliui.DefaultStyles.Code.Render("server"))
-	_, _ = fmt.Fprintln(w, "")
-	_, _ = fmt.Fprintln(w, "Please use a build of Coder from GitHub releases:")
-	_, _ = fmt.Fprintln(w, "  https://github.com/coder/coder/releases")
-	os.Exit(1)
-}
diff --git a/enterprise/cli/root.go b/enterprise/cli/root.go
index a89a8008fc977..360582a3e5193 100644
--- a/enterprise/cli/root.go
+++ b/enterprise/cli/root.go
@@ -1,8 +1,8 @@
 package cli
 
 import (
-	"github.com/coder/coder/cli"
-	"github.com/coder/coder/cli/clibase"
+	"github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clibase"
 )
 
 type RootCmd struct {
@@ -11,7 +11,7 @@ type RootCmd struct {
 
 func (r *RootCmd) enterpriseOnly() []*clibase.Cmd {
 	return []*clibase.Cmd{
-		r.server(),
+		r.Server(nil),
 		r.workspaceProxy(),
 		r.features(),
 		r.licenses(),
diff --git a/enterprise/cli/root_internal_test.go b/enterprise/cli/root_internal_test.go
index 3b3c86bc8d011..e2af6bcdd46ae 100644
--- a/enterprise/cli/root_internal_test.go
+++ b/enterprise/cli/root_internal_test.go
@@ -5,9 +5,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/clitest"
+	"github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/clitest"
 )
 
 //nolint:tparallel,paralleltest
diff --git a/enterprise/cli/root_test.go b/enterprise/cli/root_test.go
index bf44ad08ff921..3017b6cb0b5b3 100644
--- a/enterprise/cli/root_test.go
+++ b/enterprise/cli/root_test.go
@@ -1,14 +1,18 @@
 package cli_test
 
 import (
+	"bytes"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/cli/config"
-	"github.com/coder/coder/enterprise/cli"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/cli/config"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/enterprise/cli"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
 )
 
 func newCLI(t *testing.T, args ...string) (*clibase.Invocation, config.Root) {
@@ -27,3 +31,49 @@ func TestEnterpriseHandlersOK(t *testing.T) {
 
 	clitest.HandlersOK(t, cmd)
 }
+
+func TestCheckWarnings(t *testing.T) {
+	t.Parallel()
+
+	t.Run("LicenseWarningForPrivilegedRoles", func(t *testing.T) {
+		t.Parallel()
+		client, _ := coderdenttest.New(t, &coderdenttest.Options{
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				ExpiresAt: time.Now().Add(time.Hour * 24),
+			},
+		})
+
+		inv, conf := newCLI(t, "list")
+
+		var buf bytes.Buffer
+		inv.Stderr = &buf
+		clitest.SetupConfig(t, client, conf)
+
+		err := inv.Run()
+		require.NoError(t, err)
+
+		require.Contains(t, buf.String(), "Your license expires in 1 day.")
+	})
+
+	t.Run("NoLicenseWarningForRegularUser", func(t *testing.T) {
+		t.Parallel()
+		adminClient, admin := coderdenttest.New(t, &coderdenttest.Options{
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				ExpiresAt: time.Now().Add(time.Hour * 24),
+			},
+		})
+
+		client, _ := coderdtest.CreateAnotherUser(t, adminClient, admin.OrganizationID)
+
+		inv, conf := newCLI(t, "list")
+
+		var buf bytes.Buffer
+		inv.Stderr = &buf
+		clitest.SetupConfig(t, client, conf)
+
+		err := inv.Run()
+		require.NoError(t, err)
+
+		require.NotContains(t, buf.String(), "Your license expires")
+	})
+}
diff --git a/enterprise/cli/server.go b/enterprise/cli/server.go
index b0561a0de1850..7fb1526c50197 100644
--- a/enterprise/cli/server.go
+++ b/enterprise/cli/server.go
@@ -5,6 +5,7 @@ package cli
 import (
 	"context"
 	"database/sql"
+	"encoding/base64"
 	"errors"
 	"io"
 	"net/url"
@@ -13,19 +14,21 @@ import (
 	"tailscale.com/derp"
 	"tailscale.com/types/key"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/enterprise/audit"
-	"github.com/coder/coder/enterprise/audit/backends"
-	"github.com/coder/coder/enterprise/coderd"
-	"github.com/coder/coder/enterprise/trialer"
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/enterprise/audit"
+	"github.com/coder/coder/v2/enterprise/audit/backends"
+	"github.com/coder/coder/v2/enterprise/coderd"
+	"github.com/coder/coder/v2/enterprise/coderd/dormancy"
+	"github.com/coder/coder/v2/enterprise/dbcrypt"
+	"github.com/coder/coder/v2/enterprise/trialer"
+	"github.com/coder/coder/v2/tailnet"
 
-	agplcoderd "github.com/coder/coder/coderd"
+	agplcoderd "github.com/coder/coder/v2/coderd"
 )
 
-func (r *RootCmd) server() *clibase.Cmd {
-	cmd := r.Server(func(ctx context.Context, options *agplcoderd.Options) (*agplcoderd.API, io.Closer, error) {
+func (r *RootCmd) Server(_ func()) *clibase.Cmd {
+	cmd := r.RootCmd.Server(func(ctx context.Context, options *agplcoderd.Options) (*agplcoderd.API, io.Closer, error) {
 		if options.DeploymentValues.DERP.Server.RelayURL.String() != "" {
 			_, err := url.Parse(options.DeploymentValues.DERP.Server.RelayURL.String())
 			if err != nil {
@@ -49,7 +52,9 @@ func (r *RootCmd) server() *clibase.Cmd {
 			}
 		}
 		options.DERPServer.SetMeshKey(meshKey)
-		options.Auditor = audit.NewAuditor(audit.DefaultFilter,
+		options.Auditor = audit.NewAuditor(
+			options.Database,
+			audit.DefaultFilter,
 			backends.NewPostgres(options.Database, true),
 			backends.NewSlog(options.Logger),
 		)
@@ -66,6 +71,25 @@ func (r *RootCmd) server() *clibase.Cmd {
 			DERPServerRegionID:        int(options.DeploymentValues.DERP.Server.RegionID.Value()),
 			ProxyHealthInterval:       options.DeploymentValues.ProxyHealthStatusInterval.Value(),
 			DefaultQuietHoursSchedule: options.DeploymentValues.UserQuietHoursSchedule.DefaultSchedule.Value(),
+			ProvisionerDaemonPSK:      options.DeploymentValues.Provisioner.DaemonPSK.Value(),
+
+			CheckInactiveUsersCancelFunc: dormancy.CheckInactiveUsers(ctx, options.Logger, options.Database),
+		}
+
+		if encKeys := options.DeploymentValues.ExternalTokenEncryptionKeys.Value(); len(encKeys) != 0 {
+			keys := make([][]byte, 0, len(encKeys))
+			for idx, ek := range encKeys {
+				dk, err := base64.StdEncoding.DecodeString(ek)
+				if err != nil {
+					return nil, nil, xerrors.Errorf("decode external-token-encryption-key %d: %w", idx, err)
+				}
+				keys = append(keys, dk)
+			}
+			cs, err := dbcrypt.NewCiphers(keys...)
+			if err != nil {
+				return nil, nil, xerrors.Errorf("initialize encryption: %w", err)
+			}
+			o.ExternalTokenEncryption = cs
 		}
 
 		api, err := coderd.New(ctx, o)
@@ -74,5 +98,9 @@ func (r *RootCmd) server() *clibase.Cmd {
 		}
 		return api.AGPL, api, nil
 	})
+
+	cmd.AddSubcommands(
+		r.dbcryptCmd(),
+	)
 	return cmd
 }
diff --git a/enterprise/cli/server_dbcrypt.go b/enterprise/cli/server_dbcrypt.go
new file mode 100644
index 0000000000000..481df1dae6c2e
--- /dev/null
+++ b/enterprise/cli/server_dbcrypt.go
@@ -0,0 +1,344 @@
+//go:build !slim
+
+package cli
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"strings"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/sloghuman"
+	"github.com/coder/coder/v2/cli"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/enterprise/dbcrypt"
+
+	"golang.org/x/xerrors"
+)
+
+func (r *RootCmd) dbcryptCmd() *clibase.Cmd {
+	dbcryptCmd := &clibase.Cmd{
+		Use:   "dbcrypt",
+		Short: "Manage database encryption.",
+		Handler: func(inv *clibase.Invocation) error {
+			return inv.Command.HelpHandler(inv)
+		},
+	}
+	dbcryptCmd.AddSubcommands(
+		r.dbcryptDecryptCmd(),
+		r.dbcryptDeleteCmd(),
+		r.dbcryptRotateCmd(),
+	)
+	return dbcryptCmd
+}
+
+func (*RootCmd) dbcryptRotateCmd() *clibase.Cmd {
+	var flags rotateFlags
+	cmd := &clibase.Cmd{
+		Use:   "rotate",
+		Short: "Rotate database encryption keys.",
+		Handler: func(inv *clibase.Invocation) error {
+			ctx, cancel := context.WithCancel(inv.Context())
+			defer cancel()
+			logger := slog.Make(sloghuman.Sink(inv.Stdout))
+			if ok, _ := inv.ParsedFlags().GetBool("verbose"); ok {
+				logger = logger.Leveled(slog.LevelDebug)
+			}
+
+			if err := flags.valid(); err != nil {
+				return err
+			}
+
+			ks := [][]byte{}
+			dk, err := base64.StdEncoding.DecodeString(flags.New)
+			if err != nil {
+				return xerrors.Errorf("decode new key: %w", err)
+			}
+			ks = append(ks, dk)
+
+			for _, k := range flags.Old {
+				dk, err := base64.StdEncoding.DecodeString(k)
+				if err != nil {
+					return xerrors.Errorf("decode old key: %w", err)
+				}
+				ks = append(ks, dk)
+			}
+
+			ciphers, err := dbcrypt.NewCiphers(ks...)
+			if err != nil {
+				return xerrors.Errorf("create ciphers: %w", err)
+			}
+
+			var act string
+			switch len(flags.Old) {
+			case 0:
+				act = "Data will be encrypted with the new key."
+			default:
+				act = "Data will be decrypted with all available keys and re-encrypted with new key."
+			}
+
+			msg := fmt.Sprintf("%s\n\n- New key: %s\n- Old keys: %s\n\nRotate external token encryption keys?\n",
+				act,
+				flags.New,
+				strings.Join(flags.Old, ", "),
+			)
+			if _, err := cliui.Prompt(inv, cliui.PromptOptions{Text: msg, IsConfirm: true}); err != nil {
+				return err
+			}
+
+			sqlDB, err := cli.ConnectToPostgres(inv.Context(), logger, "postgres", flags.PostgresURL)
+			if err != nil {
+				return xerrors.Errorf("connect to postgres: %w", err)
+			}
+			defer func() {
+				_ = sqlDB.Close()
+			}()
+			logger.Info(ctx, "connected to postgres")
+			if err := dbcrypt.Rotate(ctx, logger, sqlDB, ciphers); err != nil {
+				return xerrors.Errorf("rotate ciphers: %w", err)
+			}
+			logger.Info(ctx, "operation completed successfully")
+			return nil
+		},
+	}
+	flags.attach(&cmd.Options)
+	return cmd
+}
+
+func (*RootCmd) dbcryptDecryptCmd() *clibase.Cmd {
+	var flags decryptFlags
+	cmd := &clibase.Cmd{
+		Use:   "decrypt",
+		Short: "Decrypt a previously encrypted database.",
+		Handler: func(inv *clibase.Invocation) error {
+			ctx, cancel := context.WithCancel(inv.Context())
+			defer cancel()
+			logger := slog.Make(sloghuman.Sink(inv.Stdout))
+			if ok, _ := inv.ParsedFlags().GetBool("verbose"); ok {
+				logger = logger.Leveled(slog.LevelDebug)
+			}
+
+			if err := flags.valid(); err != nil {
+				return err
+			}
+
+			ks := make([][]byte, 0, len(flags.Keys))
+			for _, k := range flags.Keys {
+				dk, err := base64.StdEncoding.DecodeString(k)
+				if err != nil {
+					return xerrors.Errorf("decode key: %w", err)
+				}
+				ks = append(ks, dk)
+			}
+
+			ciphers, err := dbcrypt.NewCiphers(ks...)
+			if err != nil {
+				return xerrors.Errorf("create ciphers: %w", err)
+			}
+
+			if _, err := cliui.Prompt(inv, cliui.PromptOptions{
+				Text:      "This will decrypt all encrypted data in the database. Are you sure you want to continue?",
+				IsConfirm: true,
+			}); err != nil {
+				return err
+			}
+
+			sqlDB, err := cli.ConnectToPostgres(inv.Context(), logger, "postgres", flags.PostgresURL)
+			if err != nil {
+				return xerrors.Errorf("connect to postgres: %w", err)
+			}
+			defer func() {
+				_ = sqlDB.Close()
+			}()
+			logger.Info(ctx, "connected to postgres")
+			if err := dbcrypt.Decrypt(ctx, logger, sqlDB, ciphers); err != nil {
+				return xerrors.Errorf("rotate ciphers: %w", err)
+			}
+			logger.Info(ctx, "operation completed successfully")
+			return nil
+		},
+	}
+	flags.attach(&cmd.Options)
+	return cmd
+}
+
+func (*RootCmd) dbcryptDeleteCmd() *clibase.Cmd {
+	var flags deleteFlags
+	cmd := &clibase.Cmd{
+		Use:   "delete",
+		Short: "Delete all encrypted data from the database. THIS IS A DESTRUCTIVE OPERATION.",
+		Handler: func(inv *clibase.Invocation) error {
+			ctx, cancel := context.WithCancel(inv.Context())
+			defer cancel()
+			logger := slog.Make(sloghuman.Sink(inv.Stdout))
+			if ok, _ := inv.ParsedFlags().GetBool("verbose"); ok {
+				logger = logger.Leveled(slog.LevelDebug)
+			}
+
+			if err := flags.valid(); err != nil {
+				return err
+			}
+			msg := `All encrypted data will be deleted from the database:
+- Encrypted user OAuth access and refresh tokens
+- Encrypted user Git authentication access and refresh tokens
+
+Are you sure you want to continue?`
+			if _, err := cliui.Prompt(inv, cliui.PromptOptions{
+				Text:      msg,
+				IsConfirm: true,
+			}); err != nil {
+				return err
+			}
+
+			sqlDB, err := cli.ConnectToPostgres(inv.Context(), logger, "postgres", flags.PostgresURL)
+			if err != nil {
+				return xerrors.Errorf("connect to postgres: %w", err)
+			}
+			defer func() {
+				_ = sqlDB.Close()
+			}()
+			logger.Info(ctx, "connected to postgres")
+			if err := dbcrypt.Delete(ctx, logger, sqlDB); err != nil {
+				return xerrors.Errorf("delete encrypted data: %w", err)
+			}
+			logger.Info(ctx, "operation completed successfully")
+			return nil
+		},
+	}
+	flags.attach(&cmd.Options)
+	return cmd
+}
+
+type rotateFlags struct {
+	PostgresURL string
+	New         string
+	Old         []string
+}
+
+func (f *rotateFlags) attach(opts *clibase.OptionSet) {
+	*opts = append(
+		*opts,
+		clibase.Option{
+			Flag:        "postgres-url",
+			Env:         "CODER_PG_CONNECTION_URL",
+			Description: "The connection URL for the Postgres database.",
+			Value:       clibase.StringOf(&f.PostgresURL),
+		},
+		clibase.Option{
+			Flag:        "new-key",
+			Env:         "CODER_EXTERNAL_TOKEN_ENCRYPTION_ENCRYPT_NEW_KEY",
+			Description: "The new external token encryption key. Must be base64-encoded.",
+			Value:       clibase.StringOf(&f.New),
+		},
+		clibase.Option{
+			Flag:        "old-keys",
+			Env:         "CODER_EXTERNAL_TOKEN_ENCRYPTION_ENCRYPT_OLD_KEYS",
+			Description: "The old external token encryption keys. Must be a comma-separated list of base64-encoded keys.",
+			Value:       clibase.StringArrayOf(&f.Old),
+		},
+		cliui.SkipPromptOption(),
+	)
+}
+
+func (f *rotateFlags) valid() error {
+	if f.PostgresURL == "" {
+		return xerrors.Errorf("no database configured")
+	}
+
+	if f.New == "" {
+		return xerrors.Errorf("no new key provided")
+	}
+
+	if val, err := base64.StdEncoding.DecodeString(f.New); err != nil {
+		return xerrors.Errorf("new key must be base64-encoded")
+	} else if len(val) != 32 {
+		return xerrors.Errorf("new key must be exactly 32 bytes in length")
+	}
+
+	for i, k := range f.Old {
+		if val, err := base64.StdEncoding.DecodeString(k); err != nil {
+			return xerrors.Errorf("old key at index %d must be base64-encoded", i)
+		} else if len(val) != 32 {
+			return xerrors.Errorf("old key at index %d must be exactly 32 bytes in length", i)
+		}
+
+		// Pedantic, but typos here will ruin your day.
+		if k == f.New {
+			return xerrors.Errorf("old key at index %d is the same as the new key", i)
+		}
+	}
+
+	return nil
+}
+
+type decryptFlags struct {
+	PostgresURL string
+	Keys        []string
+}
+
+func (f *decryptFlags) attach(opts *clibase.OptionSet) {
+	*opts = append(
+		*opts,
+		clibase.Option{
+			Flag:        "postgres-url",
+			Env:         "CODER_PG_CONNECTION_URL",
+			Description: "The connection URL for the Postgres database.",
+			Value:       clibase.StringOf(&f.PostgresURL),
+		},
+		clibase.Option{
+			Flag:        "keys",
+			Env:         "CODER_EXTERNAL_TOKEN_ENCRYPTION_DECRYPT_KEYS",
+			Description: "Keys required to decrypt existing data. Must be a comma-separated list of base64-encoded keys.",
+			Value:       clibase.StringArrayOf(&f.Keys),
+		},
+		cliui.SkipPromptOption(),
+	)
+}
+
+func (f *decryptFlags) valid() error {
+	if f.PostgresURL == "" {
+		return xerrors.Errorf("no database configured")
+	}
+
+	if len(f.Keys) == 0 {
+		return xerrors.Errorf("no keys provided")
+	}
+
+	for i, k := range f.Keys {
+		if val, err := base64.StdEncoding.DecodeString(k); err != nil {
+			return xerrors.Errorf("key at index %d must be base64-encoded", i)
+		} else if len(val) != 32 {
+			return xerrors.Errorf("key at index %d must be exactly 32 bytes in length", i)
+		}
+	}
+
+	return nil
+}
+
+type deleteFlags struct {
+	PostgresURL string
+	Confirm     bool
+}
+
+func (f *deleteFlags) attach(opts *clibase.OptionSet) {
+	*opts = append(
+		*opts,
+		clibase.Option{
+			Flag:        "postgres-url",
+			Env:         "CODER_EXTERNAL_TOKEN_ENCRYPTION_POSTGRES_URL",
+			Description: "The connection URL for the Postgres database.",
+			Value:       clibase.StringOf(&f.PostgresURL),
+		},
+		cliui.SkipPromptOption(),
+	)
+}
+
+func (f *deleteFlags) valid() error {
+	if f.PostgresURL == "" {
+		return xerrors.Errorf("no database configured")
+	}
+
+	return nil
+}
diff --git a/enterprise/cli/server_dbcrypt_test.go b/enterprise/cli/server_dbcrypt_test.go
new file mode 100644
index 0000000000000..8b1bbffa52b9f
--- /dev/null
+++ b/enterprise/cli/server_dbcrypt_test.go
@@ -0,0 +1,314 @@
+package cli_test
+
+import (
+	"context"
+	"database/sql"
+	"encoding/base64"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/lib/pq"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/postgres"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/enterprise/dbcrypt"
+	"github.com/coder/coder/v2/pty/ptytest"
+)
+
+// TestServerDBCrypt tests end-to-end encryption, decryption, and deletion
+// of encrypted user data.
+//
+// nolint: paralleltest // use of t.Setenv
+func TestServerDBCrypt(t *testing.T) {
+	if !dbtestutil.WillUsePostgres() {
+		t.Skip("this test requires a postgres instance")
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	// Setup a postgres database.
+	connectionURL, closePg, err := postgres.Open()
+	require.NoError(t, err)
+	t.Cleanup(closePg)
+	t.Cleanup(func() { dbtestutil.DumpOnFailure(t, connectionURL) })
+
+	sqlDB, err := sql.Open("postgres", connectionURL)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_ = sqlDB.Close()
+	})
+	db := database.New(sqlDB)
+
+	// Populate the database with some unencrypted data.
+	t.Logf("Generating unencrypted data")
+	users := genData(t, db)
+
+	// Setup an initial cipher A
+	keyA := mustString(t, 32)
+	cipherA, err := dbcrypt.NewCiphers([]byte(keyA))
+	require.NoError(t, err)
+
+	// Create an encrypted database
+	cryptdb, err := dbcrypt.New(ctx, db, cipherA...)
+	require.NoError(t, err)
+
+	// Populate the database with some encrypted data using cipher A.
+	t.Logf("Generating data encrypted with cipher A")
+	newUsers := genData(t, cryptdb)
+
+	// Validate that newly created users were encrypted with cipher A
+	for _, usr := range newUsers {
+		requireEncryptedWithCipher(ctx, t, db, cipherA[0], usr.ID)
+	}
+	users = append(users, newUsers...)
+
+	// Encrypt all the data with the initial cipher.
+	t.Logf("Encrypting all data with cipher A")
+	inv, _ := newCLI(t, "server", "dbcrypt", "rotate",
+		"--postgres-url", connectionURL,
+		"--new-key", base64.StdEncoding.EncodeToString([]byte(keyA)),
+		"--yes",
+	)
+	pty := ptytest.New(t)
+	inv.Stdout = pty.Output()
+	err = inv.Run()
+	require.NoError(t, err)
+	require.NoError(t, pty.Close())
+
+	// Validate that all existing data has been encrypted with cipher A.
+	for _, usr := range users {
+		requireEncryptedWithCipher(ctx, t, db, cipherA[0], usr.ID)
+	}
+
+	// Re-encrypt all existing data with a new cipher.
+	keyB := mustString(t, 32)
+	cipherBA, err := dbcrypt.NewCiphers([]byte(keyB), []byte(keyA))
+	require.NoError(t, err)
+
+	t.Logf("Enrypting all data with cipher B")
+	inv, _ = newCLI(t, "server", "dbcrypt", "rotate",
+		"--postgres-url", connectionURL,
+		"--new-key", base64.StdEncoding.EncodeToString([]byte(keyB)),
+		"--old-keys", base64.StdEncoding.EncodeToString([]byte(keyA)),
+		"--yes",
+	)
+	pty = ptytest.New(t)
+	inv.Stdout = pty.Output()
+	err = inv.Run()
+	require.NoError(t, err)
+	require.NoError(t, pty.Close())
+
+	// Validate that all data has been re-encrypted with cipher B.
+	for _, usr := range users {
+		requireEncryptedWithCipher(ctx, t, db, cipherBA[0], usr.ID)
+	}
+
+	// Assert that we can revoke the old key.
+	t.Logf("Revoking cipher A")
+	err = db.RevokeDBCryptKey(ctx, cipherA[0].HexDigest())
+	require.NoError(t, err, "failed to revoke old key")
+
+	// Assert that the key has been revoked in the database.
+	keys, err := db.GetDBCryptKeys(ctx)
+	oldKey := keys[0] // ORDER BY number ASC;
+	newKey := keys[1]
+	require.NoError(t, err, "failed to get db crypt keys")
+	require.Len(t, keys, 2, "expected exactly 2 keys")
+	require.Equal(t, cipherBA[0].HexDigest(), newKey.ActiveKeyDigest.String, "expected the new key to be the active key")
+	require.Empty(t, newKey.RevokedKeyDigest.String, "expected the new key to not be revoked")
+	require.Equal(t, cipherBA[1].HexDigest(), oldKey.RevokedKeyDigest.String, "expected the old key to be revoked")
+	require.Empty(t, oldKey.ActiveKeyDigest.String, "expected the old key to not be active")
+
+	// Revoking the new key should fail.
+	t.Logf("Attempting to revoke cipher B should fail as it is still in use")
+	err = db.RevokeDBCryptKey(ctx, cipherBA[0].HexDigest())
+	require.Error(t, err, "expected to fail to revoke the new key")
+	var pgErr *pq.Error
+	require.True(t, xerrors.As(err, &pgErr), "expected a pg error")
+	require.EqualValues(t, "23503", pgErr.Code, "expected a foreign key constraint violation error")
+
+	// Decrypt the data using only cipher B. This should result in the key being revoked.
+	t.Logf("Decrypting with cipher B")
+	inv, _ = newCLI(t, "server", "dbcrypt", "decrypt",
+		"--postgres-url", connectionURL,
+		"--keys", base64.StdEncoding.EncodeToString([]byte(keyB)),
+		"--yes",
+	)
+	pty = ptytest.New(t)
+	inv.Stdout = pty.Output()
+	err = inv.Run()
+	require.NoError(t, err)
+	require.NoError(t, pty.Close())
+
+	// Validate that both keys have been revoked.
+	keys, err = db.GetDBCryptKeys(ctx)
+	require.NoError(t, err, "failed to get db crypt keys")
+	require.Len(t, keys, 2, "expected exactly 2 keys")
+	for _, key := range keys {
+		require.Empty(t, key.ActiveKeyDigest.String, "expected the new key to not be active")
+	}
+
+	// Validate that all data has been decrypted.
+	for _, usr := range users {
+		requireEncryptedWithCipher(ctx, t, db, &nullCipher{}, usr.ID)
+	}
+
+	// Re-encrypt all existing data with a new cipher.
+	keyC := mustString(t, 32)
+	cipherC, err := dbcrypt.NewCiphers([]byte(keyC))
+	require.NoError(t, err)
+
+	t.Logf("Re-encrypting with cipher C")
+	inv, _ = newCLI(t, "server", "dbcrypt", "rotate",
+		"--postgres-url", connectionURL,
+		"--new-key", base64.StdEncoding.EncodeToString([]byte(keyC)),
+		"--yes",
+	)
+
+	pty = ptytest.New(t)
+	inv.Stdout = pty.Output()
+	err = inv.Run()
+	require.NoError(t, err)
+	require.NoError(t, pty.Close())
+
+	// Validate that all data has been re-encrypted with cipher C.
+	for _, usr := range users {
+		requireEncryptedWithCipher(ctx, t, db, cipherC[0], usr.ID)
+	}
+
+	// Now delete all the encrypted data.
+	t.Logf("Deleting all encrypted data")
+	inv, _ = newCLI(t, "server", "dbcrypt", "delete",
+		"--postgres-url", connectionURL,
+		"--external-token-encryption-keys", base64.StdEncoding.EncodeToString([]byte(keyC)),
+		"--yes",
+	)
+	pty = ptytest.New(t)
+	inv.Stdout = pty.Output()
+	err = inv.Run()
+	require.NoError(t, err)
+	require.NoError(t, pty.Close())
+
+	// Assert that no user links remain.
+	for _, usr := range users {
+		userLinks, err := db.GetUserLinksByUserID(ctx, usr.ID)
+		require.NoError(t, err, "failed to get user links for user %s", usr.ID)
+		require.Empty(t, userLinks)
+		gitAuthLinks, err := db.GetExternalAuthLinksByUserID(ctx, usr.ID)
+		require.NoError(t, err, "failed to get git auth links for user %s", usr.ID)
+		require.Empty(t, gitAuthLinks)
+	}
+
+	// Validate that the key has been revoked in the database.
+	keys, err = db.GetDBCryptKeys(ctx)
+	require.NoError(t, err, "failed to get db crypt keys")
+	require.Len(t, keys, 3, "expected exactly 3 keys")
+	for _, k := range keys {
+		require.Empty(t, k.ActiveKeyDigest.String, "expected the key to not be active")
+		require.NotEmpty(t, k.RevokedKeyDigest.String, "expected the key to be revoked")
+	}
+}
+
+func genData(t *testing.T, db database.Store) []database.User {
+	t.Helper()
+	var users []database.User
+	// Make some users
+	for _, status := range database.AllUserStatusValues() {
+		for _, loginType := range database.AllLoginTypeValues() {
+			for _, deleted := range []bool{false, true} {
+				randName := mustString(t, 32)
+				usr := dbgen.User(t, db, database.User{
+					Username:  randName,
+					Email:     randName + "@notcoder.com",
+					LoginType: loginType,
+					Status:    status,
+					Deleted:   deleted,
+				})
+				_ = dbgen.ExternalAuthLink(t, db, database.ExternalAuthLink{
+					UserID:            usr.ID,
+					ProviderID:        "fake",
+					OAuthAccessToken:  "access-" + usr.ID.String(),
+					OAuthRefreshToken: "refresh-" + usr.ID.String(),
+				})
+				// Fun fact: our schema allows _all_ login types to have
+				// a user_link. Even though I'm not sure how it could occur
+				// in practice, making sure to test all combinations here.
+				_ = dbgen.UserLink(t, db, database.UserLink{
+					UserID:            usr.ID,
+					LoginType:         usr.LoginType,
+					OAuthAccessToken:  "access-" + usr.ID.String(),
+					OAuthRefreshToken: "refresh-" + usr.ID.String(),
+				})
+				users = append(users, usr)
+			}
+		}
+	}
+	return users
+}
+
+func mustString(t *testing.T, n int) string {
+	t.Helper()
+	s, err := cryptorand.String(n)
+	require.NoError(t, err)
+	return s
+}
+
+func requireEncryptedEquals(t *testing.T, c dbcrypt.Cipher, expected, actual string) {
+	t.Helper()
+	var decodedVal []byte
+	var err error
+	if _, ok := c.(*nullCipher); !ok {
+		decodedVal, err = base64.StdEncoding.DecodeString(actual)
+		require.NoError(t, err, "failed to decode base64 string")
+	} else {
+		// If a nullCipher is being used, we expect the value not to be encrypted.
+		decodedVal = []byte(actual)
+	}
+	val, err := c.Decrypt(decodedVal)
+	require.NoError(t, err, "failed to decrypt value")
+	require.Equal(t, expected, string(val))
+}
+
+func requireEncryptedWithCipher(ctx context.Context, t *testing.T, db database.Store, c dbcrypt.Cipher, userID uuid.UUID) {
+	t.Helper()
+	userLinks, err := db.GetUserLinksByUserID(ctx, userID)
+	require.NoError(t, err, "failed to get user links for user %s", userID)
+	for _, ul := range userLinks {
+		requireEncryptedEquals(t, c, "access-"+userID.String(), ul.OAuthAccessToken)
+		requireEncryptedEquals(t, c, "refresh-"+userID.String(), ul.OAuthRefreshToken)
+		require.Equal(t, c.HexDigest(), ul.OAuthAccessTokenKeyID.String)
+		require.Equal(t, c.HexDigest(), ul.OAuthRefreshTokenKeyID.String)
+	}
+	gitAuthLinks, err := db.GetExternalAuthLinksByUserID(ctx, userID)
+	require.NoError(t, err, "failed to get git auth links for user %s", userID)
+	for _, gal := range gitAuthLinks {
+		requireEncryptedEquals(t, c, "access-"+userID.String(), gal.OAuthAccessToken)
+		requireEncryptedEquals(t, c, "refresh-"+userID.String(), gal.OAuthRefreshToken)
+		require.Equal(t, c.HexDigest(), gal.OAuthAccessTokenKeyID.String)
+		require.Equal(t, c.HexDigest(), gal.OAuthRefreshTokenKeyID.String)
+	}
+}
+
+// nullCipher is a dbcrypt.Cipher that does not encrypt or decrypt.
+// used for testing
+type nullCipher struct{}
+
+func (*nullCipher) Encrypt(b []byte) ([]byte, error) {
+	return b, nil
+}
+
+func (*nullCipher) Decrypt(b []byte) ([]byte, error) {
+	return b, nil
+}
+
+func (*nullCipher) HexDigest() string {
+	return "" // This co-incidentally happens to be the value of sql.NullString{}.String...
+}
+
+var _ dbcrypt.Cipher = (*nullCipher)(nil)
diff --git a/enterprise/cli/server_slim.go b/enterprise/cli/server_slim.go
deleted file mode 100644
index 301151fd38893..0000000000000
--- a/enterprise/cli/server_slim.go
+++ /dev/null
@@ -1,20 +0,0 @@
-//go:build slim
-
-package cli
-
-import (
-	"context"
-	"io"
-
-	"golang.org/x/xerrors"
-
-	"github.com/coder/coder/cli/clibase"
-	agplcoderd "github.com/coder/coder/coderd"
-)
-
-func (r *RootCmd) server() *clibase.Cmd {
-	cmd := r.Server(func(ctx context.Context, options *agplcoderd.Options) (*agplcoderd.API, io.Closer, error) {
-		return nil, nil, xerrors.Errorf("slim build does not support `coder server`")
-	})
-	return cmd
-}
diff --git a/enterprise/cli/start_test.go b/enterprise/cli/start_test.go
new file mode 100644
index 0000000000000..665b67d4f829f
--- /dev/null
+++ b/enterprise/cli/start_test.go
@@ -0,0 +1,177 @@
+package cli_test
+
+import (
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
+)
+
+// TestStart also tests restart since the tests are virtually identical.
+func TestStart(t *testing.T) {
+	t.Parallel()
+
+	t.Run("RequireActiveVersion", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+		ownerClient, owner := coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				IncludeProvisionerDaemon: true,
+			},
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureAccessControl:              1,
+					codersdk.FeatureTemplateRBAC:               1,
+					codersdk.FeatureAdvancedTemplateScheduling: 1,
+				},
+			},
+		})
+
+		// Create an initial version.
+		oldVersion := coderdtest.CreateTemplateVersion(t, ownerClient, owner.OrganizationID, nil)
+		// Create a template that mandates the promoted version.
+		// This should be enforced for everyone except template admins.
+		template := coderdtest.CreateTemplate(t, ownerClient, owner.OrganizationID, oldVersion.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, ownerClient, oldVersion.ID)
+		require.Equal(t, oldVersion.ID, template.ActiveVersionID)
+		template, err := ownerClient.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+			RequireActiveVersion: true,
+		})
+		require.NoError(t, err)
+		require.True(t, template.RequireActiveVersion)
+
+		// Create a new version that we will promote.
+		activeVersion := coderdtest.CreateTemplateVersion(t, ownerClient, owner.OrganizationID, nil, func(ctvr *codersdk.CreateTemplateVersionRequest) {
+			ctvr.TemplateID = template.ID
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, ownerClient, activeVersion.ID)
+		err = ownerClient.UpdateActiveTemplateVersion(ctx, template.ID, codersdk.UpdateActiveTemplateVersion{
+			ID: activeVersion.ID,
+		})
+		require.NoError(t, err)
+		err = ownerClient.UpdateActiveTemplateVersion(ctx, template.ID, codersdk.UpdateActiveTemplateVersion{
+			ID: activeVersion.ID,
+		})
+		require.NoError(t, err)
+
+		templateAdminClient, templateAdmin := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		templateACLAdminClient, templateACLAdmin := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID)
+		templateGroupACLAdminClient, templateGroupACLAdmin := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID)
+		memberClient, member := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID)
+
+		// Create a group so we can also test group template admin ownership.
+		group, err := ownerClient.CreateGroup(ctx, owner.OrganizationID, codersdk.CreateGroupRequest{
+			Name: "test",
+		})
+		require.NoError(t, err)
+
+		// Add the user who gains template admin via group membership.
+		group, err = ownerClient.PatchGroup(ctx, group.ID, codersdk.PatchGroupRequest{
+			AddUsers: []string{templateGroupACLAdmin.ID.String()},
+		})
+		require.NoError(t, err)
+
+		// Update the template for both users and groups.
+		err = ownerClient.UpdateTemplateACL(ctx, template.ID, codersdk.UpdateTemplateACL{
+			UserPerms: map[string]codersdk.TemplateRole{
+				templateACLAdmin.ID.String(): codersdk.TemplateRoleAdmin,
+			},
+			GroupPerms: map[string]codersdk.TemplateRole{
+				group.ID.String(): codersdk.TemplateRoleAdmin,
+			},
+		})
+		require.NoError(t, err)
+
+		type testcase struct {
+			Name            string
+			Client          *codersdk.Client
+			WorkspaceOwner  uuid.UUID
+			ExpectedVersion uuid.UUID
+		}
+
+		cases := []testcase{
+			{
+				Name:            "OwnerUnchanged",
+				Client:          ownerClient,
+				WorkspaceOwner:  owner.UserID,
+				ExpectedVersion: oldVersion.ID,
+			},
+			{
+				Name:            "TemplateAdminUnchanged",
+				Client:          templateAdminClient,
+				WorkspaceOwner:  templateAdmin.ID,
+				ExpectedVersion: oldVersion.ID,
+			},
+			{
+				Name:            "TemplateACLAdminUnchanged",
+				Client:          templateACLAdminClient,
+				WorkspaceOwner:  templateACLAdmin.ID,
+				ExpectedVersion: oldVersion.ID,
+			},
+			{
+				Name:            "TemplateGroupACLAdminUnchanged",
+				Client:          templateGroupACLAdminClient,
+				WorkspaceOwner:  templateGroupACLAdmin.ID,
+				ExpectedVersion: oldVersion.ID,
+			},
+			{
+				Name:            "MemberUpdates",
+				Client:          memberClient,
+				WorkspaceOwner:  member.ID,
+				ExpectedVersion: activeVersion.ID,
+			},
+		}
+
+		for _, cmd := range []string{"start", "restart"} {
+			cmd := cmd
+			t.Run(cmd, func(t *testing.T) {
+				t.Parallel()
+				for _, c := range cases {
+					c := c
+					t.Run(c.Name, func(t *testing.T) {
+						t.Parallel()
+
+						// Instantiate a new context for each subtest since
+						// they can potentially be lengthy.
+						ctx := testutil.Context(t, testutil.WaitMedium)
+						// Create the workspace using the admin since we want
+						// to force the old version.
+						ws, err := ownerClient.CreateWorkspace(ctx, owner.OrganizationID, c.WorkspaceOwner.String(), codersdk.CreateWorkspaceRequest{
+							TemplateVersionID: oldVersion.ID,
+							Name:              coderdtest.RandomUsername(t),
+							AutomaticUpdates:  codersdk.AutomaticUpdatesNever,
+						})
+						require.NoError(t, err)
+						coderdtest.AwaitWorkspaceBuildJobCompleted(t, c.Client, ws.LatestBuild.ID)
+
+						if cmd == "start" {
+							// Stop the workspace so that we can start it.
+							coderdtest.MustTransitionWorkspace(t, c.Client, ws.ID, database.WorkspaceTransitionStart, database.WorkspaceTransitionStop, func(req *codersdk.CreateWorkspaceBuildRequest) {
+								req.TemplateVersionID = oldVersion.ID
+							})
+						}
+						// Start the workspace. Every test permutation should
+						// pass.
+						inv, conf := newCLI(t, cmd, ws.Name, "-y")
+						clitest.SetupConfig(t, c.Client, conf)
+						err = inv.Run()
+						require.NoError(t, err)
+
+						ws = coderdtest.MustWorkspace(t, c.Client, ws.ID)
+						require.Equal(t, c.ExpectedVersion, ws.LatestBuild.TemplateVersionID)
+					})
+				}
+			})
+		}
+	})
+}
diff --git a/enterprise/cli/templatecreate_test.go b/enterprise/cli/templatecreate_test.go
new file mode 100644
index 0000000000000..7fe699d531e20
--- /dev/null
+++ b/enterprise/cli/templatecreate_test.go
@@ -0,0 +1,95 @@
+package cli_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestTemplateCreate(t *testing.T) {
+	t.Parallel()
+
+	t.Run("OK", func(t *testing.T) {
+		t.Parallel()
+
+		dv := coderdtest.DeploymentValues(t)
+		dv.Experiments = []string{
+			string(codersdk.ExperimentTemplateUpdatePolicies),
+		}
+
+		client, user := coderdenttest.New(t, &coderdenttest.Options{
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureAccessControl: 1,
+				},
+			},
+			Options: &coderdtest.Options{
+				DeploymentValues:         dv,
+				IncludeProvisionerDaemon: true,
+			},
+		})
+
+		source := clitest.CreateTemplateVersionSource(t, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionApply: echo.ApplyComplete,
+		})
+
+		inv, conf := newCLI(t, "templates",
+			"create", "new",
+			"--directory", source,
+			"--test.provisioner", string(database.ProvisionerTypeEcho),
+			"--require-active-version",
+			"-y",
+		)
+
+		clitest.SetupConfig(t, client, conf)
+
+		err := inv.Run()
+		require.NoError(t, err)
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+		template, err := client.TemplateByName(ctx, user.OrganizationID, "new")
+		require.NoError(t, err)
+		require.True(t, template.RequireActiveVersion)
+	})
+
+	t.Run("NotEntitled", func(t *testing.T) {
+		t.Parallel()
+
+		dv := coderdtest.DeploymentValues(t)
+		dv.Experiments = []string{
+			string(codersdk.ExperimentTemplateUpdatePolicies),
+		}
+
+		client, _ := coderdenttest.New(t, &coderdenttest.Options{
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{},
+			},
+			Options: &coderdtest.Options{
+				DeploymentValues:         dv,
+				IncludeProvisionerDaemon: true,
+			},
+		})
+
+		inv, conf := newCLI(t, "templates",
+			"create", "new",
+			"--require-active-version",
+			"-y",
+		)
+
+		clitest.SetupConfig(t, client, conf)
+
+		err := inv.Run()
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "your license is not entitled to use enterprise access control, so you cannot set --require-active-version")
+	})
+}
diff --git a/enterprise/cli/templateedit_test.go b/enterprise/cli/templateedit_test.go
new file mode 100644
index 0000000000000..5c26c19d820d7
--- /dev/null
+++ b/enterprise/cli/templateedit_test.go
@@ -0,0 +1,98 @@
+package cli_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestTemplateEdit(t *testing.T) {
+	t.Parallel()
+
+	t.Run("OK", func(t *testing.T) {
+		t.Parallel()
+
+		dv := coderdtest.DeploymentValues(t)
+		dv.Experiments = []string{
+			string(codersdk.ExperimentTemplateUpdatePolicies),
+		}
+
+		ownerClient, owner := coderdenttest.New(t, &coderdenttest.Options{
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureAccessControl: 1,
+				},
+			},
+			Options: &coderdtest.Options{
+				DeploymentValues:         dv,
+				IncludeProvisionerDaemon: true,
+			},
+		})
+
+		templateAdmin, _ := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		version := coderdtest.CreateTemplateVersion(t, templateAdmin, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, templateAdmin, version.ID)
+		template := coderdtest.CreateTemplate(t, templateAdmin, owner.OrganizationID, version.ID)
+		require.False(t, template.RequireActiveVersion)
+
+		inv, conf := newCLI(t, "templates",
+			"edit", template.Name,
+			"--require-active-version",
+			"-y",
+		)
+
+		clitest.SetupConfig(t, templateAdmin, conf)
+
+		err := inv.Run()
+		require.NoError(t, err)
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+		template, err = templateAdmin.Template(ctx, template.ID)
+		require.NoError(t, err)
+		require.True(t, template.RequireActiveVersion)
+	})
+
+	t.Run("NotEntitled", func(t *testing.T) {
+		t.Parallel()
+
+		dv := coderdtest.DeploymentValues(t)
+		dv.Experiments = []string{
+			string(codersdk.ExperimentTemplateUpdatePolicies),
+		}
+
+		client, owner := coderdenttest.New(t, &coderdenttest.Options{
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{},
+			},
+			Options: &coderdtest.Options{
+				DeploymentValues:         dv,
+				IncludeProvisionerDaemon: true,
+			},
+		})
+
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+		require.False(t, template.RequireActiveVersion)
+
+		inv, conf := newCLI(t, "templates",
+			"edit", template.Name,
+			"--require-active-version",
+			"-y",
+		)
+
+		clitest.SetupConfig(t, client, conf)
+
+		err := inv.Run()
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "your license is not entitled to use enterprise access control, so you cannot set --require-active-version")
+	})
+}
diff --git a/enterprise/cli/testdata/coder_--help.golden b/enterprise/cli/testdata/coder_--help.golden
index 7fc6962ded847..7c2ff5c835dff 100644
--- a/enterprise/cli/testdata/coder_--help.golden
+++ b/enterprise/cli/testdata/coder_--help.golden
@@ -1,22 +1,26 @@
-Usage: coder [global-flags] <subcommand>
-
-Coder v0.0.0-devel — A tool for provisioning self-hosted development environments with Terraform.
-  - Start a Coder server:                                                       
-
-      $ coder server 
-
-  - Get started by creating a template from an example:                         
-
-      $ coder templates init 
-
-Subcommands
+coder v0.0.0-devel
+
+USAGE:
+  coder [global-flags] <subcommand>
+
+  Coder v0.0.0-devel — A tool for provisioning self-hosted development
+  environments with Terraform.
+    - Start a Coder server:
+  
+       $ coder server
+  
+    - Get started by creating a template from an example:
+  
+       $ coder templates init
+
+SUBCOMMANDS:
     features           List Enterprise features
     groups             Manage groups
     licenses           Add, delete, and list licenses
     provisionerd       Manage provisioner daemons
     server             Start a Coder server
 
-Global Options 
+GLOBAL OPTIONS: 
 Global options are applied to all commands. They can be set using environment
 variables or flags.
 
@@ -33,6 +37,11 @@ variables or flags.
           Additional HTTP headers added to all requests. Provide as key=value.
           Can be specified multiple times.
 
+      --header-command string, $CODER_HEADER_COMMAND
+          An external command that outputs additional HTTP headers added to all
+          requests. The command must output each header as `key=value` on its
+          own line.
+
       --no-feature-warning bool, $CODER_NO_FEATURE_WARNING
           Suppress warnings about unlicensed features.
 
@@ -49,5 +58,5 @@ variables or flags.
   -v, --verbose bool, $CODER_VERBOSE
           Enable verbose output.
 
----
+———
 Report bugs and request features at https://github.com/coder/coder/issues/new
diff --git a/enterprise/cli/testdata/coder_features_--help.golden b/enterprise/cli/testdata/coder_features_--help.golden
index 7826df161c28b..3f6b8971c9c9b 100644
--- a/enterprise/cli/testdata/coder_features_--help.golden
+++ b/enterprise/cli/testdata/coder_features_--help.golden
@@ -1,11 +1,14 @@
-Usage: coder features
+coder v0.0.0-devel
 
-List Enterprise features
+USAGE:
+  coder features
 
-Aliases: feature
+  List Enterprise features
 
-Subcommands
+  Aliases: feature
+
+SUBCOMMANDS:
     list    
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_features_list_--help.golden b/enterprise/cli/testdata/coder_features_list_--help.golden
index cb6369fb3f234..04159afa2b206 100644
--- a/enterprise/cli/testdata/coder_features_list_--help.golden
+++ b/enterprise/cli/testdata/coder_features_list_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder features list [flags]
+coder v0.0.0-devel
 
-Aliases: ls
+USAGE:
+  coder features list [flags]
 
-Options
+  Aliases: ls
+
+OPTIONS:
   -c, --column string-array (default: Name,Entitlement,Enabled,Limit,Actual)
           Specify a column to filter in the table. Available columns are: Name,
           Entitlement, Enabled, Limit, Actual.
@@ -10,5 +13,5 @@ Aliases: ls
   -o, --output string (default: table)
           Output format. Available formats are: table, json.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_groups_--help.golden b/enterprise/cli/testdata/coder_groups_--help.golden
index 1cf56bca86d33..cf5b13bd32938 100644
--- a/enterprise/cli/testdata/coder_groups_--help.golden
+++ b/enterprise/cli/testdata/coder_groups_--help.golden
@@ -1,14 +1,17 @@
-Usage: coder groups
+coder v0.0.0-devel
 
-Manage groups
+USAGE:
+  coder groups
 
-Aliases: group
+  Manage groups
 
-Subcommands
+  Aliases: group
+
+SUBCOMMANDS:
     create    Create a user group
     delete    Delete a user group
     edit      Edit a user group
     list      List user groups
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_groups_create_--help.golden b/enterprise/cli/testdata/coder_groups_create_--help.golden
index d661a25b8740e..c7e73c82e88a6 100644
--- a/enterprise/cli/testdata/coder_groups_create_--help.golden
+++ b/enterprise/cli/testdata/coder_groups_create_--help.golden
@@ -1,13 +1,16 @@
-Usage: coder groups create [flags] <name>
+coder v0.0.0-devel
 
-Create a user group
+USAGE:
+  coder groups create [flags] <name>
 
-Options
+  Create a user group
+
+OPTIONS:
   -u, --avatar-url string, $CODER_AVATAR_URL
           Set an avatar for a group.
 
       --display-name string, $CODER_DISPLAY_NAME
           Optional human friendly name for the group.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_groups_delete_--help.golden b/enterprise/cli/testdata/coder_groups_delete_--help.golden
index 5997603176890..6e916b0f2afd3 100644
--- a/enterprise/cli/testdata/coder_groups_delete_--help.golden
+++ b/enterprise/cli/testdata/coder_groups_delete_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder groups delete <name>
+coder v0.0.0-devel
 
-Delete a user group
+USAGE:
+  coder groups delete <name>
 
-Aliases: rm
+  Delete a user group
 
----
+  Aliases: rm
+
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_groups_edit_--help.golden b/enterprise/cli/testdata/coder_groups_edit_--help.golden
index b5743bc4fc260..66dce68303279 100644
--- a/enterprise/cli/testdata/coder_groups_edit_--help.golden
+++ b/enterprise/cli/testdata/coder_groups_edit_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder groups edit [flags] <name>
+coder v0.0.0-devel
 
-Edit a user group
+USAGE:
+  coder groups edit [flags] <name>
 
-Options
+  Edit a user group
+
+OPTIONS:
   -a, --add-users string-array
           Add users to the group. Accepts emails or IDs.
 
@@ -18,5 +21,5 @@ Edit a user group
   -r, --rm-users string-array
           Remove users to the group. Accepts emails or IDs.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_groups_list_--help.golden b/enterprise/cli/testdata/coder_groups_list_--help.golden
index fafa537205fad..9a86620665b0d 100644
--- a/enterprise/cli/testdata/coder_groups_list_--help.golden
+++ b/enterprise/cli/testdata/coder_groups_list_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder groups list [flags]
+coder v0.0.0-devel
 
-List user groups
+USAGE:
+  coder groups list [flags]
 
-Options
+  List user groups
+
+OPTIONS:
   -c, --column string-array (default: name,display name,organization id,members,avatar url)
           Columns to display in table output. Available columns: name, display
           name, organization id, members, avatar url.
@@ -10,5 +13,5 @@ List user groups
   -o, --output string (default: table)
           Output format. Available formats: table, json.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_licenses_--help.golden b/enterprise/cli/testdata/coder_licenses_--help.golden
index c500aadce209e..a23a4d9e05eed 100644
--- a/enterprise/cli/testdata/coder_licenses_--help.golden
+++ b/enterprise/cli/testdata/coder_licenses_--help.golden
@@ -1,13 +1,16 @@
-Usage: coder licenses
+coder v0.0.0-devel
 
-Add, delete, and list licenses
+USAGE:
+  coder licenses
 
-Aliases: license
+  Add, delete, and list licenses
 
-Subcommands
+  Aliases: license
+
+SUBCOMMANDS:
     add       Add license to Coder deployment
     delete    Delete license by ID
     list      List licenses (including expired)
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_licenses_add_--help.golden b/enterprise/cli/testdata/coder_licenses_add_--help.golden
index 710a3fd67f4f8..fae42f4b32be6 100644
--- a/enterprise/cli/testdata/coder_licenses_add_--help.golden
+++ b/enterprise/cli/testdata/coder_licenses_add_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder licenses add [flags] [-f file | -l license]
+coder v0.0.0-devel
 
-Add license to Coder deployment
+USAGE:
+  coder licenses add [flags] [-f file | -l license]
 
-Options
+  Add license to Coder deployment
+
+OPTIONS:
       --debug bool
           Output license claims for debugging.
 
@@ -12,5 +15,5 @@ Add license to Coder deployment
   -l, --license string
           License string.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_licenses_delete_--help.golden b/enterprise/cli/testdata/coder_licenses_delete_--help.golden
index 6492aa4414965..2d933689ffd08 100644
--- a/enterprise/cli/testdata/coder_licenses_delete_--help.golden
+++ b/enterprise/cli/testdata/coder_licenses_delete_--help.golden
@@ -1,8 +1,11 @@
-Usage: coder licenses delete <id>
+coder v0.0.0-devel
 
-Delete license by ID
+USAGE:
+  coder licenses delete <id>
 
-Aliases: del, rm
+  Delete license by ID
 
----
+  Aliases: del, rm
+
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_licenses_list_--help.golden b/enterprise/cli/testdata/coder_licenses_list_--help.golden
index 7ccab7ae23f8d..414a9e324248e 100644
--- a/enterprise/cli/testdata/coder_licenses_list_--help.golden
+++ b/enterprise/cli/testdata/coder_licenses_list_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder licenses list [flags]
+coder v0.0.0-devel
 
-List licenses (including expired)
+USAGE:
+  coder licenses list [flags]
 
-Aliases: ls
+  List licenses (including expired)
 
-Options
+  Aliases: ls
+
+OPTIONS:
   -c, --column string-array (default: UUID,Expires At,Uploaded At,Features)
           Columns to display in table output. Available columns: id, uuid,
           uploaded at, features, expires at, trial.
@@ -12,5 +15,5 @@ Aliases: ls
   -o, --output string (default: table)
           Output format. Available formats: table, json.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_provisionerd_--help.golden b/enterprise/cli/testdata/coder_provisionerd_--help.golden
index 973c1b4a7053d..bfa9ec147e03d 100644
--- a/enterprise/cli/testdata/coder_provisionerd_--help.golden
+++ b/enterprise/cli/testdata/coder_provisionerd_--help.golden
@@ -1,9 +1,12 @@
-Usage: coder provisionerd
+coder v0.0.0-devel
 
-Manage provisioner daemons
+USAGE:
+  coder provisionerd
 
-Subcommands
+  Manage provisioner daemons
+
+SUBCOMMANDS:
     start    Run a provisioner daemon
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_provisionerd_start_--help.golden b/enterprise/cli/testdata/coder_provisionerd_start_--help.golden
index 1236cfb5ae7e1..80d28883a8854 100644
--- a/enterprise/cli/testdata/coder_provisionerd_start_--help.golden
+++ b/enterprise/cli/testdata/coder_provisionerd_start_--help.golden
@@ -1,19 +1,25 @@
-Usage: coder provisionerd start [flags]
+coder v0.0.0-devel
 
-Run a provisioner daemon
+USAGE:
+  coder provisionerd start [flags]
 
-Options
+  Run a provisioner daemon
+
+OPTIONS:
   -c, --cache-dir string, $CODER_CACHE_DIRECTORY (default: [cache dir])
           Directory to store cached data.
 
       --poll-interval duration, $CODER_PROVISIONERD_POLL_INTERVAL (default: 1s)
-          How often to poll for provisioner jobs.
+          Deprecated and ignored.
 
       --poll-jitter duration, $CODER_PROVISIONERD_POLL_JITTER (default: 100ms)
-          How much to jitter the poll interval by.
+          Deprecated and ignored.
+
+      --psk string, $CODER_PROVISIONER_DAEMON_PSK
+          Pre-shared key to authenticate with Coder server.
 
   -t, --tag string-array, $CODER_PROVISIONERD_TAGS
           Tags to filter provisioner jobs by.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_server_--help.golden b/enterprise/cli/testdata/coder_server_--help.golden
index cb7ca61b4913a..f4bb522f5ec62 100644
--- a/enterprise/cli/testdata/coder_server_--help.golden
+++ b/enterprise/cli/testdata/coder_server_--help.golden
@@ -1,16 +1,20 @@
-Usage: coder server [flags]
+coder v0.0.0-devel
 
-Start a Coder server
+USAGE:
+  coder server [flags]
 
-Subcommands
+  Start a Coder server
+
+SUBCOMMANDS:
     create-admin-user         Create a new admin user with the given username,
                               email and password and adds it to every
                               organization.
+    dbcrypt                   Manage database encryption.
     postgres-builtin-serve    Run the built-in PostgreSQL deployment.
     postgres-builtin-url      Output the connection URL for the built-in
                               PostgreSQL deployment.
 
-Options
+OPTIONS:
       --cache-dir string, $CODER_CACHE_DIRECTORY (default: [cache dir])
           The directory to cache temporary files. If unspecified and
           $CACHE_DIRECTORY is set, it will be used for compatibility with
@@ -50,7 +54,7 @@ Start a Coder server
           Periodically check for new releases of Coder and inform the owner. The
           check is performed once per day.
 
-Client Options 
+CLIENT OPTIONS: 
 These options change the behavior of how clients interact with the Coder.
 Clients include the coder cli, vs code extension, and the web UI.
 
@@ -63,7 +67,11 @@ Clients include the coder cli, vs code extension, and the web UI.
       --ssh-hostname-prefix string, $CODER_SSH_HOSTNAME_PREFIX (default: coder.)
           The SSH deployment prefix is used in the Host of the ssh config.
 
-Config Options 
+      --web-terminal-renderer string, $CODER_WEB_TERMINAL_RENDERER (default: canvas)
+          The renderer to use when opening a web terminal. Valid values are
+          'canvas', 'webgl', or 'dom'.
+
+CONFIG OPTIONS: 
 Use a YAML configuration file when your server launch become unwieldy.
 
   -c, --config yaml-config-path, $CODER_CONFIG_PATH
@@ -73,7 +81,7 @@ Use a YAML configuration file when your server launch become unwieldy.
           
           Write out the current server config as YAML to stdout.
 
-Introspection / Logging Options 
+INTROSPECTION / LOGGING OPTIONS: 
       --enable-terraform-debug-mode bool, $CODER_ENABLE_TERRAFORM_DEBUG_MODE (default: false)
           Allow administrators to enable Terraform debug output.
 
@@ -90,7 +98,7 @@ Use a YAML configuration file when your server launch become unwieldy.
       --log-stackdriver string, $CODER_LOGGING_STACKDRIVER
           Output Stackdriver compatible logs to a given file.
 
-Introspection / Prometheus Options 
+INTROSPECTION / PROMETHEUS OPTIONS: 
       --prometheus-address host:port, $CODER_PROMETHEUS_ADDRESS (default: 127.0.0.1:2112)
           The bind address to serve prometheus metrics.
 
@@ -103,7 +111,7 @@ Use a YAML configuration file when your server launch become unwieldy.
       --prometheus-enable bool, $CODER_PROMETHEUS_ENABLE
           Serve prometheus metrics on the address defined by prometheus address.
 
-Introspection / Tracing Options 
+INTROSPECTION / TRACING OPTIONS: 
       --trace-logs bool, $CODER_TRACE_LOGS
           Enables capturing of logs as events in traces. This is useful for
           debugging, but may result in a very large amount of events being sent
@@ -117,14 +125,14 @@ Use a YAML configuration file when your server launch become unwieldy.
       --trace-honeycomb-api-key string, $CODER_TRACE_HONEYCOMB_API_KEY
           Enables trace exporting to Honeycomb.io using the provided API Key.
 
-Introspection / pprof Options 
+INTROSPECTION / PPROF OPTIONS: 
       --pprof-address host:port, $CODER_PPROF_ADDRESS (default: 127.0.0.1:6060)
           The bind address to serve pprof.
 
       --pprof-enable bool, $CODER_PPROF_ENABLE
           Serve pprof metrics on the address defined by pprof address.
 
-Networking Options 
+NETWORKING OPTIONS: 
       --access-url url, $CODER_ACCESS_URL
           The URL that users will use to access the Coder deployment.
 
@@ -150,7 +158,7 @@ Use a YAML configuration file when your server launch become unwieldy.
           Specifies the wildcard hostname to use for workspace applications in
           the form "*.example.com".
 
-Networking / DERP Options 
+NETWORKING / DERP OPTIONS: 
 Most Coder deployments never have to think about DERP because all connections
 between workspaces and users are peer-to-peer. However, when Coder cannot
 establish a peer to peer connection, Coder uses a distributed relay network
@@ -172,23 +180,27 @@ backed by Tailscale and WireGuard.
           URL to fetch a DERP mapping on startup. See:
           https://tailscale.com/kb/1118/custom-derp-servers/.
 
+      --derp-force-websockets bool, $CODER_DERP_FORCE_WEBSOCKETS
+          Force clients and agents to always use WebSocket to connect to DERP
+          relay servers. By default, DERP uses `Upgrade: derp`, which may cause
+          issues with some reverse proxies. Clients may automatically fallback
+          to WebSocket if they detect an issue with `Upgrade: derp`, but this
+          does not work in all situations.
+
       --derp-server-enable bool, $CODER_DERP_SERVER_ENABLE (default: true)
           Whether to enable or disable the embedded DERP relay server.
 
-      --derp-server-region-code string, $CODER_DERP_SERVER_REGION_CODE (default: coder)
-          Region code to use for the embedded DERP server.
-
-      --derp-server-region-id int, $CODER_DERP_SERVER_REGION_ID (default: 999)
-          Region ID to use for the embedded DERP server.
-
       --derp-server-region-name string, $CODER_DERP_SERVER_REGION_NAME (default: Coder Embedded Relay)
           Region name that for the embedded DERP server.
 
-      --derp-server-stun-addresses string-array, $CODER_DERP_SERVER_STUN_ADDRESSES (default: stun.l.google.com:19302)
-          Addresses for STUN servers to establish P2P connections. Use special
-          value 'disable' to turn off STUN.
+      --derp-server-stun-addresses string-array, $CODER_DERP_SERVER_STUN_ADDRESSES (default: stun.l.google.com:19302,stun1.l.google.com:19302,stun2.l.google.com:19302,stun3.l.google.com:19302,stun4.l.google.com:19302)
+          Addresses for STUN servers to establish P2P connections. It's
+          recommended to have at least two STUN servers to give users the best
+          chance of connecting P2P to workspaces. Each STUN server will get it's
+          own DERP region, with region IDs starting at `--derp-server-region-id
+          + 1`. Use special value 'disable' to turn off STUN completely.
 
-Networking / HTTP Options 
+NETWORKING / HTTP OPTIONS: 
       --disable-password-auth bool, $CODER_DISABLE_PASSWORD_AUTH
           Disable password authentication. This is recommended for security
           purposes in production deployments that rely on an identity provider.
@@ -219,7 +231,7 @@ backed by Tailscale and WireGuard.
           longer if they are actively making requests, but this functionality
           can be disabled via --disable-session-expiry-refresh.
 
-Networking / TLS Options 
+NETWORKING / TLS OPTIONS: 
 Configure TLS / HTTPS for your Coder deployment. If you're running Coder behind
 a TLS-terminating reverse proxy or are accessing Coder over a secure link, you
 can safely ignore these settings.
@@ -272,7 +284,7 @@ can safely ignore these settings.
           Minimum supported version of TLS. Accepted values are "tls10",
           "tls11", "tls12" or "tls13".
 
-OAuth2 / GitHub Options 
+OAUTH2 / GITHUB OPTIONS: 
       --oauth2-github-allow-everyone bool, $CODER_OAUTH2_GITHUB_ALLOW_EVERYONE
           Allow all logins, setting this option means allowed orgs and teams
           must be empty.
@@ -297,16 +309,29 @@ can safely ignore these settings.
           Base URL of a GitHub Enterprise deployment to use for Login with
           GitHub.
 
-OIDC Options 
+OIDC OPTIONS: 
+      --oidc-group-auto-create bool, $CODER_OIDC_GROUP_AUTO_CREATE (default: false)
+          Automatically creates missing groups from a user's groups claim.
+
       --oidc-allow-signups bool, $CODER_OIDC_ALLOW_SIGNUPS (default: true)
           Whether new users can sign up with OIDC.
 
       --oidc-auth-url-params struct[map[string]string], $CODER_OIDC_AUTH_URL_PARAMS (default: {"access_type": "offline"})
           OIDC auth URL parameters to pass to the upstream provider.
 
+      --oidc-client-cert-file string, $CODER_OIDC_CLIENT_CERT_FILE
+          Pem encoded certificate file to use for oauth2 PKI/JWT authorization.
+          The public certificate that accompanies oidc-client-key-file. A
+          standard x509 certificate is expected.
+
       --oidc-client-id string, $CODER_OIDC_CLIENT_ID
           Client ID to use for Login with OIDC.
 
+      --oidc-client-key-file string, $CODER_OIDC_CLIENT_KEY_FILE
+          Pem encoded RSA private key to use for oauth2 PKI/JWT authorization.
+          This can be used instead of oidc-client-secret if your IDP supports
+          it.
+
       --oidc-client-secret string, $CODER_OIDC_CLIENT_SECRET
           Client secret to use for Login with OIDC.
 
@@ -334,6 +359,11 @@ can safely ignore these settings.
       --oidc-issuer-url string, $CODER_OIDC_ISSUER_URL
           Issuer URL to use for Login with OIDC.
 
+      --oidc-group-regex-filter regexp, $CODER_OIDC_GROUP_REGEX_FILTER (default: .*)
+          If provided any group name not matching the regex is ignored. This
+          allows for filtering out groups that are not needed. This filter is
+          applied after the group mapping.
+
       --oidc-scopes string-array, $CODER_OIDC_SCOPES (default: openid,profile,email)
           Scopes to grant when authenticating with OIDC.
 
@@ -358,9 +388,9 @@ can safely ignore these settings.
           The text to show on the OpenID Connect sign in button.
 
       --oidc-icon-url url, $CODER_OIDC_ICON_URL
-          URL pointing to the icon to use on the OepnID Connect login button.
+          URL pointing to the icon to use on the OpenID Connect login button.
 
-Provisioning Options 
+PROVISIONING OPTIONS: 
 Tune the behavior of the provisioner, which is responsible for creating,
 updating, and deleting workspace resources.
 
@@ -368,16 +398,20 @@ updating, and deleting workspace resources.
           Time to force cancel provisioning tasks that are stuck.
 
       --provisioner-daemon-poll-interval duration, $CODER_PROVISIONER_DAEMON_POLL_INTERVAL (default: 1s)
-          Time to wait before polling for a new job.
+          Deprecated and ignored.
 
       --provisioner-daemon-poll-jitter duration, $CODER_PROVISIONER_DAEMON_POLL_JITTER (default: 100ms)
-          Random jitter added to the poll interval.
+          Deprecated and ignored.
+
+      --provisioner-daemon-psk string, $CODER_PROVISIONER_DAEMON_PSK
+          Pre-shared key to authenticate external provisioner daemons to Coder
+          server.
 
       --provisioner-daemons int, $CODER_PROVISIONER_DAEMONS (default: 3)
           Number of provisioner daemons to create on start. If builds are stuck
           in queued state for a long time, consider increasing this.
 
-Telemetry Options 
+TELEMETRY OPTIONS: 
 Telemetry is critical to our ability to improve Coder. We strip all
 personalinformation before sending data to our servers. Please only disable
 telemetrywhen required by your organization's security policy.
@@ -386,12 +420,7 @@ telemetrywhen required by your organization's security policy.
           Whether telemetry is enabled or not. Coder collects anonymized usage
           data to help improve our product.
 
-      --telemetry-trace bool, $CODER_TELEMETRY_TRACE (default: false)
-          Whether Opentelemetry traces are sent to Coder. Coder collects
-          anonymized application tracing to help improve our product. Disabling
-          telemetry also disables this option.
-
-User Quiet Hours Schedule Options 
+USER QUIET HOURS SCHEDULE OPTIONS: 
 Allow users to set quiet hours schedules each day for workspaces to avoid
 workspaces stopping during the day due to template max TTL.
 
@@ -405,7 +434,7 @@ workspaces stopping during the day due to template max TTL.
           one hour and minute can be specified (ranges or comma separated values
           are not supported).
 
-⚠️ Dangerous Options 
+⚠️ DANGEROUS OPTIONS: 
       --dangerous-allow-path-app-sharing bool, $CODER_DANGEROUS_ALLOW_PATH_APP_SHARING
           Allow workspace apps that are not served from subdomains to be shared.
           Path-based app sharing is DISABLED by default for security purposes.
@@ -422,7 +451,7 @@ workspaces stopping during the day due to template max TTL.
           can be disabled entirely with --disable-path-apps for further
           security.
 
-Enterprise Options 
+ENTERPRISE OPTIONS: 
 These options are only available in the Enterprise Edition.
 
       --browser-only bool, $CODER_BROWSER_ONLY
@@ -432,9 +461,19 @@ These options are only available in the Enterprise Edition.
           An HTTP URL that is accessible by other replicas to relay DERP
           traffic. Required for high availability.
 
+      --external-token-encryption-keys string-array, $CODER_EXTERNAL_TOKEN_ENCRYPTION_KEYS
+          Encrypt OIDC and Git authentication tokens with AES-256-GCM in the
+          database. The value must be a comma-separated list of base64-encoded
+          keys. Each key, when base64-decoded, must be exactly 32 bytes in
+          length. The first key will be used to encrypt new values. Subsequent
+          keys will be used as a fallback when decrypting. During normal
+          operation it is recommended to only set one key unless you are in the
+          process of rotating keys with the `coder server dbcrypt rotate`
+          command.
+
       --scim-auth-header string, $CODER_SCIM_AUTH_HEADER
           Enables SCIM and sets the authentication header for the built-in SCIM
           server. New users are automatically created with OIDC authentication.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_server_create-admin-user_--help.golden b/enterprise/cli/testdata/coder_server_create-admin-user_--help.golden
index 6c95fb1954756..e600132a976d8 100644
--- a/enterprise/cli/testdata/coder_server_create-admin-user_--help.golden
+++ b/enterprise/cli/testdata/coder_server_create-admin-user_--help.golden
@@ -1,9 +1,12 @@
-Usage: coder server create-admin-user [flags]
+coder v0.0.0-devel
 
-Create a new admin user with the given username, email and password and adds it
-to every organization.
+USAGE:
+  coder server create-admin-user [flags]
 
-Options
+  Create a new admin user with the given username, email and password and adds
+  it to every organization.
+
+OPTIONS:
       --email string, $CODER_EMAIL
           The email of the new user. If not specified, you will be prompted via
           stdin.
@@ -28,5 +31,5 @@ to every organization.
           The username of the new user. If not specified, you will be prompted
           via stdin.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_server_dbcrypt_--help.golden b/enterprise/cli/testdata/coder_server_dbcrypt_--help.golden
new file mode 100644
index 0000000000000..0cfb18547cf7d
--- /dev/null
+++ b/enterprise/cli/testdata/coder_server_dbcrypt_--help.golden
@@ -0,0 +1,15 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder server dbcrypt
+
+  Manage database encryption.
+
+SUBCOMMANDS:
+    decrypt    Decrypt a previously encrypted database.
+    delete     Delete all encrypted data from the database. THIS IS A
+               DESTRUCTIVE OPERATION.
+    rotate     Rotate database encryption keys.
+
+———
+Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_server_dbcrypt_decrypt_--help.golden b/enterprise/cli/testdata/coder_server_dbcrypt_decrypt_--help.golden
new file mode 100644
index 0000000000000..270abf2a5f492
--- /dev/null
+++ b/enterprise/cli/testdata/coder_server_dbcrypt_decrypt_--help.golden
@@ -0,0 +1,20 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder server dbcrypt decrypt [flags]
+
+  Decrypt a previously encrypted database.
+
+OPTIONS:
+      --keys string-array, $CODER_EXTERNAL_TOKEN_ENCRYPTION_DECRYPT_KEYS
+          Keys required to decrypt existing data. Must be a comma-separated list
+          of base64-encoded keys.
+
+      --postgres-url string, $CODER_PG_CONNECTION_URL
+          The connection URL for the Postgres database.
+
+  -y, --yes bool
+          Bypass prompts.
+
+———
+Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_server_dbcrypt_delete_--help.golden b/enterprise/cli/testdata/coder_server_dbcrypt_delete_--help.golden
new file mode 100644
index 0000000000000..c1a28dcfef002
--- /dev/null
+++ b/enterprise/cli/testdata/coder_server_dbcrypt_delete_--help.golden
@@ -0,0 +1,18 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder server dbcrypt delete [flags]
+
+  Delete all encrypted data from the database. THIS IS A DESTRUCTIVE OPERATION.
+
+  Aliases: rm
+
+OPTIONS:
+      --postgres-url string, $CODER_EXTERNAL_TOKEN_ENCRYPTION_POSTGRES_URL
+          The connection URL for the Postgres database.
+
+  -y, --yes bool
+          Bypass prompts.
+
+———
+Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_server_dbcrypt_rotate_--help.golden b/enterprise/cli/testdata/coder_server_dbcrypt_rotate_--help.golden
new file mode 100644
index 0000000000000..bd3adcb6afe41
--- /dev/null
+++ b/enterprise/cli/testdata/coder_server_dbcrypt_rotate_--help.golden
@@ -0,0 +1,23 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder server dbcrypt rotate [flags]
+
+  Rotate database encryption keys.
+
+OPTIONS:
+      --new-key string, $CODER_EXTERNAL_TOKEN_ENCRYPTION_ENCRYPT_NEW_KEY
+          The new external token encryption key. Must be base64-encoded.
+
+      --old-keys string-array, $CODER_EXTERNAL_TOKEN_ENCRYPTION_ENCRYPT_OLD_KEYS
+          The old external token encryption keys. Must be a comma-separated list
+          of base64-encoded keys.
+
+      --postgres-url string, $CODER_PG_CONNECTION_URL
+          The connection URL for the Postgres database.
+
+  -y, --yes bool
+          Bypass prompts.
+
+———
+Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_server_postgres-builtin-serve_--help.golden b/enterprise/cli/testdata/coder_server_postgres-builtin-serve_--help.golden
index bb61bd8292916..18b87581c5b71 100644
--- a/enterprise/cli/testdata/coder_server_postgres-builtin-serve_--help.golden
+++ b/enterprise/cli/testdata/coder_server_postgres-builtin-serve_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder server postgres-builtin-serve [flags]
+coder v0.0.0-devel
 
-Run the built-in PostgreSQL deployment.
+USAGE:
+  coder server postgres-builtin-serve [flags]
 
-Options
+  Run the built-in PostgreSQL deployment.
+
+OPTIONS:
       --raw-url bool
           Output the raw connection URL instead of a psql command.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_server_postgres-builtin-url_--help.golden b/enterprise/cli/testdata/coder_server_postgres-builtin-url_--help.golden
index af6ca07dc1c61..647ad7ae26c21 100644
--- a/enterprise/cli/testdata/coder_server_postgres-builtin-url_--help.golden
+++ b/enterprise/cli/testdata/coder_server_postgres-builtin-url_--help.golden
@@ -1,10 +1,13 @@
-Usage: coder server postgres-builtin-url [flags]
+coder v0.0.0-devel
 
-Output the connection URL for the built-in PostgreSQL deployment.
+USAGE:
+  coder server postgres-builtin-url [flags]
 
-Options
+  Output the connection URL for the built-in PostgreSQL deployment.
+
+OPTIONS:
       --raw-url bool
           Output the raw connection URL instead of a psql command.
 
----
+———
 Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/workspaceproxy.go b/enterprise/cli/workspaceproxy.go
index 6c0f7aa06e614..95f17a251c5ee 100644
--- a/enterprise/cli/workspaceproxy.go
+++ b/enterprise/cli/workspaceproxy.go
@@ -8,9 +8,11 @@ import (
 	"github.com/fatih/color"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/cli/cliui"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/pretty"
+
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (r *RootCmd) workspaceProxy() *clibase.Cmd {
@@ -206,7 +208,7 @@ func (r *RootCmd) deleteProxy() *clibase.Cmd {
 
 			// Confirm deletion of the template.
 			_, err = cliui.Prompt(inv, cliui.PromptOptions{
-				Text:      fmt.Sprintf("Delete this workspace proxy: %s?", cliui.DefaultStyles.Code.Render(wsproxy.DisplayName)),
+				Text:      fmt.Sprintf("Delete this workspace proxy: %s?", pretty.Sprint(cliui.DefaultStyles.Code, wsproxy.DisplayName)),
 				IsConfirm: true,
 				Default:   cliui.ConfirmNo,
 			})
@@ -428,14 +430,14 @@ func newUpdateProxyResponseFormatter() *updateProxyResponseFormatter {
 			}
 
 			return fmt.Sprintf("Workspace Proxy %[1]q updated successfully.\n"+
-				cliui.DefaultStyles.Placeholder.Render("—————————————————————————————————————————————————")+"\n"+
+				pretty.Sprint(cliui.DefaultStyles.Placeholder, "—————————————————————————————————————————————————")+"\n"+
 				"Save this authentication token, it will not be shown again.\n"+
 				"Token: %[2]s\n"+
 				"\n"+
 				"Start the proxy by running:\n"+
-				cliui.DefaultStyles.Code.Render("CODER_PROXY_SESSION_TOKEN=%[2]s coder wsproxy server --primary-access-url %[3]s --http-address=0.0.0.0:3001")+
+				cliui.Code("CODER_PROXY_SESSION_TOKEN=%[2]s coder wsproxy server --primary-access-url %[3]s --http-address=0.0.0.0:3001")+
 				// This is required to turn off the code style. Otherwise it appears in the code block until the end of the line.
-				cliui.DefaultStyles.Placeholder.Render(""),
+				pretty.Sprint(cliui.DefaultStyles.Placeholder, ""),
 				response.Proxy.Name, response.ProxyToken, up.primaryAccessURL), nil
 		}),
 		cliui.JSONFormat(),
diff --git a/enterprise/cli/workspaceproxy_test.go b/enterprise/cli/workspaceproxy_test.go
index e7396ab12191f..fd9d241172560 100644
--- a/enterprise/cli/workspaceproxy_test.go
+++ b/enterprise/cli/workspaceproxy_test.go
@@ -8,13 +8,13 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clitest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func Test_ProxyCRUD(t *testing.T) {
diff --git a/enterprise/cmd/coder/main.go b/enterprise/cmd/coder/main.go
index b44275e3696a5..0aa1400c5c32f 100644
--- a/enterprise/cmd/coder/main.go
+++ b/enterprise/cmd/coder/main.go
@@ -3,7 +3,7 @@ package main
 import (
 	_ "time/tzdata"
 
-	entcli "github.com/coder/coder/enterprise/cli"
+	entcli "github.com/coder/coder/v2/enterprise/cli"
 )
 
 func main() {
diff --git a/enterprise/coderd/appearance.go b/enterprise/coderd/appearance.go
index c4dc8b34e1941..aceeec9ef16db 100644
--- a/enterprise/coderd/appearance.go
+++ b/enterprise/coderd/appearance.go
@@ -6,15 +6,14 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"net/http"
 
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 var DefaultSupportLinks = []codersdk.LinkConfig{
@@ -67,8 +66,16 @@ func (api *API) fetchAppearanceConfig(ctx context.Context) (codersdk.AppearanceC
 	}
 
 	var eg errgroup.Group
+	var applicationName string
 	var logoURL string
 	var serviceBannerJSON string
+	eg.Go(func() (err error) {
+		applicationName, err = api.Database.GetApplicationName(ctx)
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			return xerrors.Errorf("get application name: %w", err)
+		}
+		return nil
+	})
 	eg.Go(func() (err error) {
 		logoURL, err = api.Database.GetLogoURL(ctx)
 		if err != nil && !errors.Is(err, sql.ErrNoRows) {
@@ -89,7 +96,8 @@ func (api *API) fetchAppearanceConfig(ctx context.Context) (codersdk.AppearanceC
 	}
 
 	cfg := codersdk.AppearanceConfig{
-		LogoURL: logoURL,
+		ApplicationName: applicationName,
+		LogoURL:         logoURL,
 	}
 	if serviceBannerJSON != "" {
 		err = json.Unmarshal([]byte(serviceBannerJSON), &cfg.ServiceBanner)
@@ -111,7 +119,7 @@ func (api *API) fetchAppearanceConfig(ctx context.Context) (codersdk.AppearanceC
 
 func validateHexColor(color string) error {
 	if len(color) != 7 {
-		return xerrors.New("expected 7 characters")
+		return xerrors.New("expected # prefix and 6 characters")
 	}
 	if color[0] != '#' {
 		return xerrors.New("no # prefix")
@@ -147,7 +155,8 @@ func (api *API) putAppearance(rw http.ResponseWriter, r *http.Request) {
 	if appearance.ServiceBanner.Enabled {
 		if err := validateHexColor(appearance.ServiceBanner.BackgroundColor); err != nil {
 			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-				Message: fmt.Sprintf("parse color: %+v", err),
+				Message: "Invalid color format",
+				Detail:  err.Error(),
 			})
 			return
 		}
@@ -156,7 +165,8 @@ func (api *API) putAppearance(rw http.ResponseWriter, r *http.Request) {
 	serviceBannerJSON, err := json.Marshal(appearance.ServiceBanner)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: fmt.Sprintf("marshal banner: %+v", err),
+			Message: "Unable to marshal service banner",
+			Detail:  err.Error(),
 		})
 		return
 	}
@@ -164,7 +174,17 @@ func (api *API) putAppearance(rw http.ResponseWriter, r *http.Request) {
 	err = api.Database.UpsertServiceBanner(ctx, string(serviceBannerJSON))
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: fmt.Sprintf("database error: %+v", err),
+			Message: "Unable to set service banner",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	err = api.Database.UpsertApplicationName(ctx, appearance.ApplicationName)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Unable to set application name",
+			Detail:  err.Error(),
 		})
 		return
 	}
@@ -172,7 +192,8 @@ func (api *API) putAppearance(rw http.ResponseWriter, r *http.Request) {
 	err = api.Database.UpsertLogoURL(ctx, appearance.LogoURL)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: fmt.Sprintf("database error: %+v", err),
+			Message: "Unable to set logo URL",
+			Detail:  err.Error(),
 		})
 		return
 	}
diff --git a/enterprise/coderd/appearance_test.go b/enterprise/coderd/appearance_test.go
index 6f564eaa3a680..05edf7c11ca14 100644
--- a/enterprise/coderd/appearance_test.go
+++ b/enterprise/coderd/appearance_test.go
@@ -7,19 +7,51 @@ import (
 	"testing"
 
 	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/enterprise/coderd"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/enterprise/coderd"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
 )
 
+func TestCustomLogoAndCompanyName(t *testing.T) {
+	t.Parallel()
+
+	// Prepare enterprise deployment
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	adminClient, _ := coderdenttest.New(t, &coderdenttest.Options{DontAddLicense: true})
+	coderdenttest.AddLicense(t, adminClient, coderdenttest.LicenseOptions{
+		Features: license.Features{
+			codersdk.FeatureAppearance: 1,
+		},
+	})
+
+	// Update logo and application name
+	uac := codersdk.UpdateAppearanceConfig{
+		ApplicationName: "ACME Ltd",
+		LogoURL:         "http://logo-url/file.png",
+	}
+
+	err := adminClient.UpdateAppearance(ctx, uac)
+	require.NoError(t, err)
+
+	// Verify update
+	got, err := adminClient.Appearance(ctx)
+	require.NoError(t, err)
+
+	require.Equal(t, uac.ApplicationName, got.ApplicationName)
+	require.Equal(t, uac.LogoURL, got.LogoURL)
+}
+
 func TestServiceBanners(t *testing.T) {
 	t.Parallel()
 
@@ -77,6 +109,13 @@ func TestServiceBanners(t *testing.T) {
 		wantBanner.ServiceBanner.BackgroundColor = "#bad color"
 		err = adminClient.UpdateAppearance(ctx, wantBanner)
 		require.Error(t, err)
+
+		var sdkErr *codersdk.Error
+		if assert.ErrorAs(t, err, &sdkErr) {
+			assert.Equal(t, http.StatusBadRequest, sdkErr.StatusCode())
+			assert.Contains(t, sdkErr.Message, "Invalid color format")
+			assert.Contains(t, sdkErr.Detail, "expected # prefix and 6 characters")
+		}
 	})
 
 	t.Run("Agent", func(t *testing.T) {
@@ -111,13 +150,13 @@ func TestServiceBanners(t *testing.T) {
 		agentClient.SetSessionToken(authToken)
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
 			ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		banner, err := agentClient.GetServiceBanner(ctx)
 		require.NoError(t, err)
diff --git a/enterprise/coderd/authorize_test.go b/enterprise/coderd/authorize_test.go
index 68452bc52b38f..8a1fab590acee 100644
--- a/enterprise/coderd/authorize_test.go
+++ b/enterprise/coderd/authorize_test.go
@@ -7,12 +7,12 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestCheckACLPermissions(t *testing.T) {
@@ -40,7 +40,7 @@ func TestCheckACLPermissions(t *testing.T) {
 	require.NoError(t, err)
 
 	version := coderdtest.CreateTemplateVersion(t, adminClient, adminUser.OrganizationID, nil)
-	coderdtest.AwaitTemplateVersionJob(t, adminClient, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, adminClient, version.ID)
 	template := coderdtest.CreateTemplate(t, adminClient, adminUser.OrganizationID, version.ID)
 
 	err = adminClient.UpdateTemplateACL(ctx, template.ID, codersdk.UpdateTemplateACL{
diff --git a/enterprise/coderd/coderd.go b/enterprise/coderd/coderd.go
index c3cc5e0be5ccd..55defaf9b964d 100644
--- a/enterprise/coderd/coderd.go
+++ b/enterprise/coderd/coderd.go
@@ -22,22 +22,24 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd"
-	agplaudit "github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	agplschedule "github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/enterprise/coderd/proxyhealth"
-	"github.com/coder/coder/enterprise/coderd/schedule"
-	"github.com/coder/coder/enterprise/derpmesh"
-	"github.com/coder/coder/enterprise/replicasync"
-	"github.com/coder/coder/enterprise/tailnet"
-	"github.com/coder/coder/provisionerd/proto"
-	agpltailnet "github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/coderd"
+	agplaudit "github.com/coder/coder/v2/coderd/audit"
+	agpldbauthz "github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	agplschedule "github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/dbauthz"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/enterprise/coderd/proxyhealth"
+	"github.com/coder/coder/v2/enterprise/coderd/schedule"
+	"github.com/coder/coder/v2/enterprise/dbcrypt"
+	"github.com/coder/coder/v2/enterprise/derpmesh"
+	"github.com/coder/coder/v2/enterprise/replicasync"
+	"github.com/coder/coder/v2/enterprise/tailnet"
+	"github.com/coder/coder/v2/provisionerd/proto"
+	agpltailnet "github.com/coder/coder/v2/tailnet"
 )
 
 // New constructs an Enterprise coderd API instance.
@@ -47,8 +49,8 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 	if options.EntitlementsUpdateInterval == 0 {
 		options.EntitlementsUpdateInterval = 10 * time.Minute
 	}
-	if options.Keys == nil {
-		options.Keys = Keys
+	if options.LicenseKeys == nil {
+		options.LicenseKeys = Keys
 	}
 	if options.Options == nil {
 		options.Options = &coderd.Options{}
@@ -61,12 +63,44 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 	}
 
 	ctx, cancelFunc := context.WithCancel(ctx)
-	api := &API{
-		ctx:    ctx,
-		cancel: cancelFunc,
 
+	if options.ExternalTokenEncryption == nil {
+		options.ExternalTokenEncryption = make([]dbcrypt.Cipher, 0)
+	}
+	// Database encryption is an enterprise feature, but as checking license entitlements
+	// depends on the database, we end up in a chicken-and-egg situation. To avoid this,
+	// we always enable it but only soft-enforce it.
+	if len(options.ExternalTokenEncryption) > 0 {
+		var keyDigests []string
+		for _, cipher := range options.ExternalTokenEncryption {
+			keyDigests = append(keyDigests, cipher.HexDigest())
+		}
+		options.Logger.Info(ctx, "database encryption enabled", slog.F("keys", keyDigests))
+	}
+
+	cryptDB, err := dbcrypt.New(ctx, options.Database, options.ExternalTokenEncryption...)
+	if err != nil {
+		cancelFunc()
+		// If we fail to initialize the database, it's likely that the
+		// database is encrypted with an unknown external token encryption key.
+		// This is a fatal error.
+		var derr *dbcrypt.DecryptFailedError
+		if xerrors.As(err, &derr) {
+			return nil, xerrors.Errorf("database encrypted with unknown key, either add the key or see https://coder.com/docs/v2/latest/admin/encryption#disabling-encryption: %w", derr)
+		}
+		return nil, xerrors.Errorf("init database encryption: %w", err)
+	}
+	options.Database = cryptDB
+
+	api := &API{
+		ctx:     ctx,
+		cancel:  cancelFunc,
 		AGPL:    coderd.New(options.Options),
 		Options: options,
+		provisionerDaemonAuth: &provisionerDaemonAuth{
+			psk:        options.ProvisionerDaemonPSK,
+			authorizer: options.Authorizer,
+		},
 	}
 	defer func() {
 		if err != nil {
@@ -80,7 +114,7 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 	api.AGPL.SiteHandler.RegionsFetcher = func(ctx context.Context) (any, error) {
 		// If the user can read the workspace proxy resource, return that.
 		// If not, always default to the regions.
-		actor, ok := dbauthz.ActorFromContext(ctx)
+		actor, ok := agpldbauthz.ActorFromContext(ctx)
 		if ok && api.Authorizer.Authorize(ctx, actor, rbac.ActionRead, rbac.ResourceWorkspaceProxy) == nil {
 			return api.fetchWorkspaceProxies(ctx)
 		}
@@ -126,6 +160,7 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 		})
 		r.Route("/licenses", func(r chi.Router) {
 			r.Use(apiKeyMiddleware)
+			r.Post("/refresh-entitlements", api.postRefreshEntitlements)
 			r.Post("/", api.postLicense)
 			r.Get("/", api.licenses)
 			r.Delete("/{id}", api.deleteLicense)
@@ -163,6 +198,7 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 				)
 				r.Get("/coordinate", api.workspaceProxyCoordinate)
 				r.Post("/issue-signed-app-token", api.workspaceProxyIssueSignedAppToken)
+				r.Post("/app-stats", api.workspaceProxyReportAppStats)
 				r.Post("/register", api.workspaceProxyRegister)
 				r.Post("/deregister", api.workspaceProxyDeregister)
 			})
@@ -193,14 +229,21 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 				r.Get("/", api.groupByOrganization)
 			})
 		})
+		// TODO: provisioner daemons are not scoped to organizations in the database, so placing them
+		// under an organization route doesn't make sense.  In order to allow the /serve endpoint to
+		// work with a pre-shared key (PSK) without an API key, these routes will simply ignore the
+		// value of {organization}.  That is, the route will work with any organization ID, whether or
+		// not it exits.  This doesn't leak any information about the existence of organizations, so is
+		// fine from a security perspective, but might be a little surprising.
+		//
+		// We may in future decide to scope provisioner daemons to organizations, so we'll keep the API
+		// route as is.
 		r.Route("/organizations/{organization}/provisionerdaemons", func(r chi.Router) {
 			r.Use(
 				api.provisionerDaemonsEnabledMW,
-				apiKeyMiddleware,
-				httpmw.ExtractOrganizationParam(api.Database),
 			)
-			r.Get("/", api.provisionerDaemons)
-			r.Get("/serve", api.provisionerDaemonServe)
+			r.With(apiKeyMiddleware).Get("/", api.provisionerDaemons)
+			r.With(apiKeyMiddlewareOptional).Get("/serve", api.provisionerDaemonServe)
 		})
 		r.Route("/templates/{template}/acl", func(r chi.Router) {
 			r.Use(
@@ -227,7 +270,7 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 				apiKeyMiddleware,
 			)
 			r.Route("/{user}", func(r chi.Router) {
-				r.Use(httpmw.ExtractUserParam(options.Database, false))
+				r.Use(httpmw.ExtractUserParam(options.Database))
 				r.Get("/", api.workspaceQuota)
 			})
 		})
@@ -252,9 +295,9 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 		})
 		r.Route("/users/{user}/quiet-hours", func(r chi.Router) {
 			r.Use(
-				api.restartRequirementEnabledMW,
+				api.autostopRequirementEnabledMW,
 				apiKeyMiddleware,
-				httpmw.ExtractUserParam(options.Database, false),
+				httpmw.ExtractUserParam(options.Database),
 			)
 
 			r.Get("/", api.userQuietHoursSchedule)
@@ -333,6 +376,11 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 		api.AGPL.WorkspaceProxyHostsFn.Store(&f)
 	}
 
+	err = api.PrometheusRegistry.Register(&api.licenseMetricsCollector)
+	if err != nil {
+		return nil, xerrors.Errorf("unable to register license metrics collector")
+	}
+
 	err = api.updateEntitlements(ctx)
 	if err != nil {
 		return nil, xerrors.Errorf("update entitlements: %w", err)
@@ -351,6 +399,8 @@ type Options struct {
 	BrowserOnly bool
 	SCIMAPIKey  []byte
 
+	ExternalTokenEncryption []dbcrypt.Cipher
+
 	// Used for high availability.
 	ReplicaSyncUpdateInterval time.Duration
 	DERPServerRelayAddress    string
@@ -361,7 +411,12 @@ type Options struct {
 
 	EntitlementsUpdateInterval time.Duration
 	ProxyHealthInterval        time.Duration
-	Keys                       map[string]ed25519.PublicKey
+	LicenseKeys                map[string]ed25519.PublicKey
+
+	// optional pre-shared key for authentication of external provisioner daemons
+	ProvisionerDaemonPSK string
+
+	CheckInactiveUsersCancelFunc func()
 }
 
 type API struct {
@@ -383,16 +438,27 @@ type API struct {
 	entitlementsUpdateMu sync.Mutex
 	entitlementsMu       sync.RWMutex
 	entitlements         codersdk.Entitlements
+
+	provisionerDaemonAuth *provisionerDaemonAuth
+
+	licenseMetricsCollector license.MetricsCollector
 }
 
 func (api *API) Close() error {
-	api.cancel()
+	// Replica manager should be closed first. This is because the replica
+	// manager updates the replica's table in the database when it closes.
+	// This tells other Coderds that it is now offline.
 	if api.replicaManager != nil {
 		_ = api.replicaManager.Close()
 	}
+	api.cancel()
 	if api.derpMesh != nil {
 		_ = api.derpMesh.Close()
 	}
+
+	if api.Options.CheckInactiveUsersCancelFunc != nil {
+		api.Options.CheckInactiveUsersCancelFunc()
+	}
 	return api.AGPL.Close()
 }
 
@@ -402,20 +468,22 @@ func (api *API) updateEntitlements(ctx context.Context) error {
 
 	entitlements, err := license.Entitlements(
 		ctx, api.Database,
-		api.Logger, len(api.replicaManager.AllPrimary()), len(api.GitAuthConfigs), api.Keys, map[codersdk.FeatureName]bool{
+		api.Logger, len(api.replicaManager.AllPrimary()), len(api.ExternalAuthConfigs), api.LicenseKeys, map[codersdk.FeatureName]bool{
 			codersdk.FeatureAuditLog:                   api.AuditLogging,
 			codersdk.FeatureBrowserOnly:                api.BrowserOnly,
 			codersdk.FeatureSCIM:                       len(api.SCIMAPIKey) != 0,
 			codersdk.FeatureHighAvailability:           api.DERPServerRelayAddress != "",
-			codersdk.FeatureMultipleGitAuth:            len(api.GitAuthConfigs) > 1,
+			codersdk.FeatureMultipleExternalAuth:       len(api.ExternalAuthConfigs) > 1,
 			codersdk.FeatureTemplateRBAC:               api.RBAC,
+			codersdk.FeatureExternalTokenEncryption:    len(api.ExternalTokenEncryption) > 0,
 			codersdk.FeatureExternalProvisionerDaemons: true,
 			codersdk.FeatureAdvancedTemplateScheduling: true,
-			// FeatureTemplateRestartRequirement depends on
+			// FeatureTemplateAutostopRequirement depends on
 			// FeatureAdvancedTemplateScheduling.
-			codersdk.FeatureTemplateRestartRequirement: api.DefaultQuietHoursSchedule != "",
-			codersdk.FeatureWorkspaceProxy:             true,
-			codersdk.FeatureUserRoleManagement:         true,
+			codersdk.FeatureTemplateAutostopRequirement: api.AGPL.Experiments.Enabled(codersdk.ExperimentTemplateAutostopRequirement) && api.DefaultQuietHoursSchedule != "",
+			codersdk.FeatureWorkspaceProxy:              true,
+			codersdk.FeatureUserRoleManagement:          true,
+			codersdk.FeatureAccessControl:               true,
 		})
 	if err != nil {
 		return err
@@ -434,15 +502,15 @@ func (api *API) updateEntitlements(ctx context.Context) error {
 		return nil
 	}
 
-	if entitlements.Features[codersdk.FeatureTemplateRestartRequirement].Enabled && !entitlements.Features[codersdk.FeatureAdvancedTemplateScheduling].Enabled {
+	if entitlements.Features[codersdk.FeatureTemplateAutostopRequirement].Enabled && !entitlements.Features[codersdk.FeatureAdvancedTemplateScheduling].Enabled {
 		api.entitlements.Errors = []string{
-			`Your license is entitled to the feature "template restart ` +
+			`Your license is entitled to the feature "template autostop ` +
 				`requirement" (and you have it enabled by setting the ` +
 				"default quiet hours schedule), but you are not entitled to " +
 				`the dependency feature "advanced template scheduling". ` +
 				"Please contact support for a new license.",
 		}
-		api.Logger.Error(ctx, "license is entitled to template restart requirement but not advanced template scheduling")
+		api.Logger.Error(ctx, "license is entitled to template autostop requirement but not advanced template scheduling")
 		return nil
 	}
 
@@ -481,7 +549,10 @@ func (api *API) updateEntitlements(ctx context.Context) error {
 
 	if initial, changed, enabled := featureChanged(codersdk.FeatureTemplateRBAC); shouldUpdate(initial, changed, enabled) {
 		if enabled {
-			committer := committer{Database: api.Database}
+			committer := committer{
+				Log:      api.Logger.Named("quota_committer"),
+				Database: api.Database,
+			}
 			ptr := proto.QuotaCommitter(&committer)
 			api.AGPL.QuotaCommitter.Store(&ptr)
 		} else {
@@ -491,7 +562,7 @@ func (api *API) updateEntitlements(ctx context.Context) error {
 
 	if initial, changed, enabled := featureChanged(codersdk.FeatureAdvancedTemplateScheduling); shouldUpdate(initial, changed, enabled) {
 		if enabled {
-			templateStore := schedule.NewEnterpriseTemplateScheduleStore()
+			templateStore := schedule.NewEnterpriseTemplateScheduleStore(api.AGPL.UserQuietHoursScheduleStore)
 			templateStoreInterface := agplschedule.TemplateScheduleStore(templateStore)
 			api.AGPL.TemplateScheduleStore.Store(&templateStoreInterface)
 		} else {
@@ -500,30 +571,30 @@ func (api *API) updateEntitlements(ctx context.Context) error {
 		}
 	}
 
-	if initial, changed, enabled := featureChanged(codersdk.FeatureTemplateRestartRequirement); shouldUpdate(initial, changed, enabled) {
+	if initial, changed, enabled := featureChanged(codersdk.FeatureTemplateAutostopRequirement); shouldUpdate(initial, changed, enabled) {
 		if enabled {
 			templateStore := *(api.AGPL.TemplateScheduleStore.Load())
 			enterpriseTemplateStore, ok := templateStore.(*schedule.EnterpriseTemplateScheduleStore)
 			if !ok {
-				api.Logger.Error(ctx, "unable to set up enterprise template schedule store, template restart requirements will not be applied to workspace builds")
+				api.Logger.Error(ctx, "unable to set up enterprise template schedule store, template autostop requirements will not be applied to workspace builds")
 			}
-			enterpriseTemplateStore.UseRestartRequirement.Store(true)
+			enterpriseTemplateStore.UseAutostopRequirement.Store(true)
 
 			quietHoursStore, err := schedule.NewEnterpriseUserQuietHoursScheduleStore(api.DefaultQuietHoursSchedule)
 			if err != nil {
-				api.Logger.Error(ctx, "unable to set up enterprise user quiet hours schedule store, template restart requirements will not be applied to workspace builds", slog.Error(err))
+				api.Logger.Error(ctx, "unable to set up enterprise user quiet hours schedule store, template autostop requirements will not be applied to workspace builds", slog.Error(err))
 			} else {
 				api.AGPL.UserQuietHoursScheduleStore.Store(&quietHoursStore)
 			}
 		} else {
 			if api.DefaultQuietHoursSchedule != "" {
-				api.Logger.Warn(ctx, "template restart requirements are not enabled (due to setting default quiet hours schedule) as your license is not entitled to this feature")
+				api.Logger.Warn(ctx, "template autostop requirements are not enabled (due to setting default quiet hours schedule) as your license is not entitled to this feature")
 			}
 
 			templateStore := *(api.AGPL.TemplateScheduleStore.Load())
 			enterpriseTemplateStore, ok := templateStore.(*schedule.EnterpriseTemplateScheduleStore)
 			if ok {
-				enterpriseTemplateStore.UseRestartRequirement.Store(false)
+				enterpriseTemplateStore.UseAutostopRequirement.Store(false)
 			}
 
 			quietHoursStore := agplschedule.NewAGPLUserQuietHoursScheduleStore()
@@ -578,18 +649,36 @@ func (api *API) updateEntitlements(ctx context.Context) error {
 
 	if initial, changed, enabled := featureChanged(codersdk.FeatureWorkspaceProxy); shouldUpdate(initial, changed, enabled) {
 		if enabled {
-			fn := derpMapper(api.Logger, api.DeploymentValues, api.ProxyHealth)
+			fn := derpMapper(api.Logger, api.ProxyHealth)
 			api.AGPL.DERPMapper.Store(&fn)
 		} else {
 			api.AGPL.DERPMapper.Store(nil)
 		}
 	}
 
+	if initial, changed, enabled := featureChanged(codersdk.FeatureAccessControl); shouldUpdate(initial, changed, enabled) {
+		var acs agpldbauthz.AccessControlStore = agpldbauthz.AGPLTemplateAccessControlStore{}
+		if enabled {
+			acs = dbauthz.EnterpriseTemplateAccessControlStore{}
+		}
+		api.AGPL.AccessControlStore.Store(&acs)
+	}
+
+	// External token encryption is soft-enforced
+	featureExternalTokenEncryption := entitlements.Features[codersdk.FeatureExternalTokenEncryption]
+	featureExternalTokenEncryption.Enabled = len(api.ExternalTokenEncryption) > 0
+	if featureExternalTokenEncryption.Enabled && featureExternalTokenEncryption.Entitlement != codersdk.EntitlementEntitled {
+		msg := fmt.Sprintf("%s is enabled (due to setting external token encryption keys) but your license is not entitled to this feature.", codersdk.FeatureExternalTokenEncryption.Humanize())
+		api.Logger.Warn(ctx, msg)
+		entitlements.Warnings = append(entitlements.Warnings, msg)
+	}
+	entitlements.Features[codersdk.FeatureExternalTokenEncryption] = featureExternalTokenEncryption
+
 	api.entitlementsMu.Lock()
 	defer api.entitlementsMu.Unlock()
 	api.entitlements = entitlements
+	api.licenseMetricsCollector.Entitlements.Store(&entitlements)
 	api.AGPL.SiteHandler.Entitlements.Store(&entitlements)
-
 	return nil
 }
 
@@ -643,7 +732,7 @@ var (
 	lastDerpConflictLog   time.Time
 )
 
-func derpMapper(logger slog.Logger, cfg *codersdk.DeploymentValues, proxyHealth *proxyhealth.ProxyHealth) func(*tailcfg.DERPMap) *tailcfg.DERPMap {
+func derpMapper(logger slog.Logger, proxyHealth *proxyhealth.ProxyHealth) func(*tailcfg.DERPMap) *tailcfg.DERPMap {
 	return func(derpMap *tailcfg.DERPMap) *tailcfg.DERPMap {
 		derpMap = derpMap.Clone()
 
@@ -737,43 +826,22 @@ func derpMapper(logger slog.Logger, cfg *codersdk.DeploymentValues, proxyHealth
 				}
 			}
 
-			var stunNodes []*tailcfg.DERPNode
-			if !cfg.DERP.Config.BlockDirect.Value() {
-				stunNodes, err = agpltailnet.STUNNodes(regionID, cfg.DERP.Server.STUNAddresses)
-				if err != nil {
-					// Log a warning if we haven't logged one in the last
-					// minute.
-					lastDerpConflictMutex.Lock()
-					shouldLog := lastDerpConflictLog.IsZero() || time.Since(lastDerpConflictLog) > time.Minute
-					if shouldLog {
-						lastDerpConflictLog = time.Now()
-					}
-					lastDerpConflictMutex.Unlock()
-					if shouldLog {
-						logger.Error(context.Background(), "failed to calculate STUN nodes", slog.Error(err))
-					}
-
-					// No continue because we can keep going.
-					stunNodes = []*tailcfg.DERPNode{}
-				}
-			}
-
-			nodes := append(stunNodes, &tailcfg.DERPNode{
-				Name:      fmt.Sprintf("%da", regionID),
-				RegionID:  regionID,
-				HostName:  u.Hostname(),
-				DERPPort:  portInt,
-				STUNPort:  -1,
-				ForceHTTP: u.Scheme == "http",
-			})
-
 			derpMap.Regions[regionID] = &tailcfg.DERPRegion{
 				// EmbeddedRelay ONLY applies to the primary.
 				EmbeddedRelay: false,
 				RegionID:      regionID,
 				RegionCode:    regionCode,
 				RegionName:    regionName,
-				Nodes:         nodes,
+				Nodes: []*tailcfg.DERPNode{
+					{
+						Name:      fmt.Sprintf("%da", regionID),
+						RegionID:  regionID,
+						HostName:  u.Hostname(),
+						DERPPort:  portInt,
+						STUNPort:  -1,
+						ForceHTTP: u.Scheme == "http",
+					},
+				},
 			}
 		}
 
@@ -803,6 +871,17 @@ func (api *API) runEntitlementsLoop(ctx context.Context) {
 	updates := make(chan struct{}, 1)
 	subscribed := false
 
+	defer func() {
+		// If this function ends, it means the context was canceled and this
+		// coderd is shutting down. In this case, post a pubsub message to
+		// tell other coderd's to resync their entitlements. This is required to
+		// make sure things like replica counts are updated in the UI.
+		// Ignore the error, as this is just a best effort. If it fails,
+		// the system will eventually recover as replicas timeout
+		// if their heartbeats stop. The best effort just tries to update the
+		// UI faster if it succeeds.
+		_ = api.Pubsub.Publish(PubsubEventLicenses, []byte("going away"))
+	}()
 	for {
 		select {
 		case <-ctx.Done():
diff --git a/enterprise/coderd/coderd_test.go b/enterprise/coderd/coderd_test.go
index 2271c79064b4f..855ecef059c75 100644
--- a/enterprise/coderd/coderd_test.go
+++ b/enterprise/coderd/coderd_test.go
@@ -1,29 +1,33 @@
 package coderd_test
 
 import (
+	"bytes"
 	"context"
 	"reflect"
+	"strings"
 	"testing"
 	"time"
 
 	"github.com/google/uuid"
-
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/rbac"
-
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/goleak"
 
-	agplaudit "github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/audit"
-	"github.com/coder/coder/enterprise/coderd"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/testutil"
+	agplaudit "github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/audit"
+	"github.com/coder/coder/v2/enterprise/coderd"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/enterprise/dbcrypt"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
@@ -48,25 +52,27 @@ func TestEntitlements(t *testing.T) {
 			AuditLogging:   true,
 			DontAddLicense: true,
 		})
+		// Enable all features
+		features := make(license.Features)
+		for _, feature := range codersdk.FeatureNames {
+			features[feature] = 1
+		}
+		features[codersdk.FeatureUserLimit] = 100
 		coderdenttest.AddLicense(t, client, coderdenttest.LicenseOptions{
-			Features: license.Features{
-				codersdk.FeatureUserLimit:                  100,
-				codersdk.FeatureAuditLog:                   1,
-				codersdk.FeatureTemplateRBAC:               1,
-				codersdk.FeatureExternalProvisionerDaemons: 1,
-				codersdk.FeatureAdvancedTemplateScheduling: 1,
-				codersdk.FeatureWorkspaceProxy:             1,
-				codersdk.FeatureUserRoleManagement:         1,
-			},
-			GraceAt: time.Now().Add(59 * 24 * time.Hour),
+			Features: features,
+			GraceAt:  time.Now().Add(59 * 24 * time.Hour),
 		})
 		res, err := client.Entitlements(context.Background())
 		require.NoError(t, err)
 		assert.True(t, res.HasLicense)
 		ul := res.Features[codersdk.FeatureUserLimit]
 		assert.Equal(t, codersdk.EntitlementEntitled, ul.Entitlement)
-		assert.Equal(t, int64(100), *ul.Limit)
-		assert.Equal(t, int64(1), *ul.Actual)
+		if assert.NotNil(t, ul.Limit) {
+			assert.Equal(t, int64(100), *ul.Limit)
+		}
+		if assert.NotNil(t, ul.Actual) {
+			assert.Equal(t, int64(1), *ul.Actual)
+		}
 		assert.True(t, ul.Enabled)
 		al := res.Features[codersdk.FeatureAuditLog]
 		assert.Equal(t, codersdk.EntitlementEntitled, al.Entitlement)
@@ -113,8 +119,8 @@ func TestEntitlements(t *testing.T) {
 		//nolint:gocritic // unit test
 		ctx := testDBAuthzRole(context.Background())
 		_, err = api.Database.InsertLicense(ctx, database.InsertLicenseParams{
-			UploadedAt: database.Now(),
-			Exp:        database.Now().AddDate(1, 0, 0),
+			UploadedAt: dbtime.Now(),
+			Exp:        dbtime.Now().AddDate(1, 0, 0),
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
 				Features: license.Features{
 					codersdk.FeatureAuditLog: 1,
@@ -143,8 +149,8 @@ func TestEntitlements(t *testing.T) {
 		ctx := context.Background()
 		//nolint:gocritic // unit test
 		_, err = api.Database.InsertLicense(testDBAuthzRole(ctx), database.InsertLicenseParams{
-			UploadedAt: database.Now(),
-			Exp:        database.Now().AddDate(1, 0, 0),
+			UploadedAt: dbtime.Now(),
+			Exp:        dbtime.Now().AddDate(1, 0, 0),
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
 				Features: license.Features{
 					codersdk.FeatureAuditLog: 1,
@@ -155,18 +161,18 @@ func TestEntitlements(t *testing.T) {
 		// Expired
 		//nolint:gocritic // unit test
 		_, err = api.Database.InsertLicense(testDBAuthzRole(ctx), database.InsertLicenseParams{
-			UploadedAt: database.Now(),
-			Exp:        database.Now().AddDate(-1, 0, 0),
+			UploadedAt: dbtime.Now(),
+			Exp:        dbtime.Now().AddDate(-1, 0, 0),
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
-				ExpiresAt: database.Now().AddDate(-1, 0, 0),
+				ExpiresAt: dbtime.Now().AddDate(-1, 0, 0),
 			}),
 		})
 		require.NoError(t, err)
 		// Invalid
 		//nolint:gocritic // unit test
 		_, err = api.Database.InsertLicense(testDBAuthzRole(ctx), database.InsertLicenseParams{
-			UploadedAt: database.Now(),
-			Exp:        database.Now().AddDate(1, 0, 0),
+			UploadedAt: dbtime.Now(),
+			Exp:        dbtime.Now().AddDate(1, 0, 0),
 			JWT:        "invalid",
 		})
 		require.NoError(t, err)
@@ -185,7 +191,7 @@ func TestAuditLogging(t *testing.T) {
 		_, _, api, _ := coderdenttest.NewWithAPI(t, &coderdenttest.Options{
 			AuditLogging: true,
 			Options: &coderdtest.Options{
-				Auditor: audit.NewAuditor(audit.DefaultFilter),
+				Auditor: audit.NewAuditor(dbmem.New(), audit.DefaultFilter),
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{
@@ -194,7 +200,7 @@ func TestAuditLogging(t *testing.T) {
 			},
 		})
 		auditor := *api.AGPL.Auditor.Load()
-		ea := audit.NewAuditor(audit.DefaultFilter)
+		ea := audit.NewAuditor(dbmem.New(), audit.DefaultFilter)
 		t.Logf("%T = %T", auditor, ea)
 		assert.EqualValues(t, reflect.ValueOf(ea).Type(), reflect.ValueOf(auditor).Type())
 	})
@@ -224,7 +230,135 @@ func TestAuditLogging(t *testing.T) {
 		connected := conn.AwaitReachable(ctx)
 		require.True(t, connected)
 		build := coderdtest.CreateWorkspaceBuild(t, client, workspace, database.WorkspaceTransitionStop)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, build.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
+	})
+}
+
+func TestExternalTokenEncryption(t *testing.T) {
+	t.Parallel()
+
+	t.Run("Enabled", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitShort)
+		db, ps := dbtestutil.NewDB(t)
+		ciphers, err := dbcrypt.NewCiphers(bytes.Repeat([]byte("a"), 32))
+		require.NoError(t, err)
+		client, _ := coderdenttest.New(t, &coderdenttest.Options{
+			EntitlementsUpdateInterval: 25 * time.Millisecond,
+			ExternalTokenEncryption:    ciphers,
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureExternalTokenEncryption: 1,
+				},
+			},
+			Options: &coderdtest.Options{
+				Database: db,
+				Pubsub:   ps,
+			},
+		})
+		keys, err := db.GetDBCryptKeys(ctx)
+		require.NoError(t, err)
+		require.Len(t, keys, 1)
+		require.Equal(t, ciphers[0].HexDigest(), keys[0].ActiveKeyDigest.String)
+
+		require.Eventually(t, func() bool {
+			entitlements, err := client.Entitlements(context.Background())
+			assert.NoError(t, err)
+			feature := entitlements.Features[codersdk.FeatureExternalTokenEncryption]
+			entitled := feature.Entitlement == codersdk.EntitlementEntitled
+			var warningExists bool
+			for _, warning := range entitlements.Warnings {
+				if strings.Contains(warning, codersdk.FeatureExternalTokenEncryption.Humanize()) {
+					warningExists = true
+					break
+				}
+			}
+			t.Logf("feature: %+v, warnings: %+v, errors: %+v", feature, entitlements.Warnings, entitlements.Errors)
+			return feature.Enabled && entitled && !warningExists
+		}, testutil.WaitShort, testutil.IntervalFast)
+	})
+
+	t.Run("Disabled", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitShort)
+		db, ps := dbtestutil.NewDB(t)
+		ciphers, err := dbcrypt.NewCiphers()
+		require.NoError(t, err)
+		client, _ := coderdenttest.New(t, &coderdenttest.Options{
+			DontAddLicense:             true,
+			EntitlementsUpdateInterval: 25 * time.Millisecond,
+			ExternalTokenEncryption:    ciphers,
+			Options: &coderdtest.Options{
+				Database: db,
+				Pubsub:   ps,
+			},
+		})
+		keys, err := db.GetDBCryptKeys(ctx)
+		require.NoError(t, err)
+		require.Empty(t, keys)
+
+		require.Eventually(t, func() bool {
+			entitlements, err := client.Entitlements(context.Background())
+			assert.NoError(t, err)
+			feature := entitlements.Features[codersdk.FeatureExternalTokenEncryption]
+			entitled := feature.Entitlement == codersdk.EntitlementEntitled
+			var warningExists bool
+			for _, warning := range entitlements.Warnings {
+				if strings.Contains(warning, codersdk.FeatureExternalTokenEncryption.Humanize()) {
+					warningExists = true
+					break
+				}
+			}
+			t.Logf("feature: %+v, warnings: %+v, errors: %+v", feature, entitlements.Warnings, entitlements.Errors)
+			return !feature.Enabled && !entitled && !warningExists
+		}, testutil.WaitShort, testutil.IntervalFast)
+	})
+
+	t.Run("PreviouslyEnabledButMissingFromLicense", func(t *testing.T) {
+		// If this test fails, it potentially means that a customer who has
+		// actively been using this feature is now unable _start coderd_
+		// because of a licensing issue. This should never happen.
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitShort)
+		db, ps := dbtestutil.NewDB(t)
+		ciphers, err := dbcrypt.NewCiphers(bytes.Repeat([]byte("a"), 32))
+		require.NoError(t, err)
+
+		dbc, err := dbcrypt.New(ctx, db, ciphers...) // should insert key
+		require.NoError(t, err)
+
+		keys, err := dbc.GetDBCryptKeys(ctx)
+		require.NoError(t, err)
+		require.Len(t, keys, 1)
+
+		client, _ := coderdenttest.New(t, &coderdenttest.Options{
+			DontAddLicense:             true,
+			EntitlementsUpdateInterval: 25 * time.Millisecond,
+			ExternalTokenEncryption:    ciphers,
+			Options: &coderdtest.Options{
+				Database: db,
+				Pubsub:   ps,
+			},
+		})
+
+		require.Eventually(t, func() bool {
+			entitlements, err := client.Entitlements(context.Background())
+			assert.NoError(t, err)
+			feature := entitlements.Features[codersdk.FeatureExternalTokenEncryption]
+			entitled := feature.Entitlement == codersdk.EntitlementEntitled
+			var warningExists bool
+			for _, warning := range entitlements.Warnings {
+				if strings.Contains(warning, codersdk.FeatureExternalTokenEncryption.Humanize()) {
+					warningExists = true
+					break
+				}
+			}
+			t.Logf("feature: %+v, warnings: %+v, errors: %+v", feature, entitlements.Warnings, entitlements.Errors)
+			return feature.Enabled && !entitled && warningExists
+		}, testutil.WaitShort, testutil.IntervalFast)
 	})
 }
 
diff --git a/enterprise/coderd/coderdenttest/coderdenttest.go b/enterprise/coderd/coderdenttest/coderdenttest.go
index 92e0b627d60ae..26e3bfaef22d6 100644
--- a/enterprise/coderd/coderdenttest/coderdenttest.go
+++ b/enterprise/coderd/coderdenttest/coderdenttest.go
@@ -10,17 +10,18 @@ import (
 	"testing"
 	"time"
 
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
 
 	"github.com/golang-jwt/jwt/v4"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd"
-	"github.com/coder/coder/enterprise/coderd/license"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/enterprise/dbcrypt"
 )
 
 const (
@@ -56,6 +57,8 @@ type Options struct {
 	DontAddLicense              bool
 	DontAddFirstUser            bool
 	ReplicaSyncUpdateInterval   time.Duration
+	ExternalTokenEncryption     []dbcrypt.Cipher
+	ProvisionerDaemonPSK        string
 }
 
 // New constructs a codersdk client connected to an in-memory Enterprise API instance.
@@ -91,9 +94,11 @@ func NewWithAPI(t *testing.T, options *Options) (
 		ReplicaSyncUpdateInterval:  options.ReplicaSyncUpdateInterval,
 		Options:                    oop,
 		EntitlementsUpdateInterval: options.EntitlementsUpdateInterval,
-		Keys:                       Keys,
+		LicenseKeys:                Keys,
 		ProxyHealthInterval:        options.ProxyHealthInterval,
 		DefaultQuietHoursSchedule:  oop.DeploymentValues.UserQuietHoursSchedule.DefaultSchedule.Value(),
+		ProvisionerDaemonPSK:       options.ProvisionerDaemonPSK,
+		ExternalTokenEncryption:    options.ExternalTokenEncryption,
 	})
 	require.NoError(t, err)
 	setHandler(coderAPI.AGPL.RootHandler)
@@ -128,8 +133,8 @@ func NewWithAPI(t *testing.T, options *Options) (
 					// we check for the in-memory test types so that the real types don't have to exported
 					_, ok := coderAPI.Pubsub.(*pubsub.MemoryPubsub)
 					require.False(t, ok, "FeatureHighAvailability is incompatible with MemoryPubsub")
-					_, ok = coderAPI.Database.(*dbfake.FakeQuerier)
-					require.False(t, ok, "FeatureHighAvailability is incompatible with dbfake")
+					_, ok = coderAPI.Database.(*dbmem.FakeQuerier)
+					require.False(t, ok, "FeatureHighAvailability is incompatible with dbmem")
 				}
 			}
 			_ = AddLicense(t, client, lo)
diff --git a/enterprise/coderd/coderdenttest/coderdenttest_test.go b/enterprise/coderd/coderdenttest/coderdenttest_test.go
index c3db8b31eadc2..ef828ac699e58 100644
--- a/enterprise/coderd/coderdenttest/coderdenttest_test.go
+++ b/enterprise/coderd/coderdenttest/coderdenttest_test.go
@@ -3,7 +3,7 @@ package coderdenttest_test
 import (
 	"testing"
 
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
 )
 
 func TestNew(t *testing.T) {
diff --git a/enterprise/coderd/coderdenttest/proxytest.go b/enterprise/coderd/coderdenttest/proxytest.go
index c544e14b44a46..8a28b077c16f4 100644
--- a/enterprise/coderd/coderdenttest/proxytest.go
+++ b/enterprise/coderd/coderdenttest/proxytest.go
@@ -19,10 +19,10 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd"
-	"github.com/coder/coder/enterprise/wsproxy"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd"
+	"github.com/coder/coder/v2/enterprise/wsproxy"
 )
 
 type ProxyOptions struct {
@@ -110,6 +110,10 @@ func NewWorkspaceProxy(t *testing.T, coderdAPI *coderd.API, owner *codersdk.Clie
 	})
 	require.NoError(t, err, "failed to create workspace proxy")
 
+	// Inherit collector options from coderd, but keep the wsproxy reporter.
+	statsCollectorOptions := coderdAPI.Options.WorkspaceAppsStatsCollectorOptions
+	statsCollectorOptions.Reporter = nil
+
 	wssrv, err := wsproxy.New(ctx, &wsproxy.Options{
 		Logger:            slogtest.Make(t, nil).Leveled(slog.LevelDebug),
 		Experiments:       options.Experiments,
@@ -129,6 +133,7 @@ func NewWorkspaceProxy(t *testing.T, coderdAPI *coderd.API, owner *codersdk.Clie
 		DERPEnabled:            !options.DerpDisabled,
 		DERPOnly:               options.DerpOnly,
 		DERPServerRelayAddress: accessURL.String(),
+		StatsCollectorOptions:  statsCollectorOptions,
 	})
 	require.NoError(t, err)
 	t.Cleanup(func() {
diff --git a/enterprise/coderd/coderdenttest/swagger_test.go b/enterprise/coderd/coderdenttest/swagger_test.go
index 7de2678d55dba..c8b95174867d9 100644
--- a/enterprise/coderd/coderdenttest/swagger_test.go
+++ b/enterprise/coderd/coderdenttest/swagger_test.go
@@ -5,8 +5,8 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
 )
 
 func TestEnterpriseEndpointsDocumented(t *testing.T) {
diff --git a/enterprise/coderd/dbauthz/accesscontrol.go b/enterprise/coderd/dbauthz/accesscontrol.go
new file mode 100644
index 0000000000000..454f416ab8736
--- /dev/null
+++ b/enterprise/coderd/dbauthz/accesscontrol.go
@@ -0,0 +1,30 @@
+package dbauthz
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/database"
+	agpldbz "github.com/coder/coder/v2/coderd/database/dbauthz"
+)
+
+type EnterpriseTemplateAccessControlStore struct{}
+
+func (EnterpriseTemplateAccessControlStore) GetTemplateAccessControl(t database.Template) agpldbz.TemplateAccessControl {
+	return agpldbz.TemplateAccessControl{
+		RequireActiveVersion: t.RequireActiveVersion,
+	}
+}
+
+func (EnterpriseTemplateAccessControlStore) SetTemplateAccessControl(ctx context.Context, store database.Store, id uuid.UUID, opts agpldbz.TemplateAccessControl) error {
+	err := store.UpdateTemplateAccessControlByID(ctx, database.UpdateTemplateAccessControlByIDParams{
+		ID:                   id,
+		RequireActiveVersion: opts.RequireActiveVersion,
+	})
+	if err != nil {
+		return xerrors.Errorf("update template access control: %w", err)
+	}
+	return nil
+}
diff --git a/coderd/dormancy/dormantusersjob.go b/enterprise/coderd/dormancy/dormantusersjob.go
similarity index 91%
rename from coderd/dormancy/dormantusersjob.go
rename to enterprise/coderd/dormancy/dormantusersjob.go
index be1e0cf0fe61b..8c8e22310c031 100644
--- a/coderd/dormancy/dormantusersjob.go
+++ b/enterprise/coderd/dormancy/dormantusersjob.go
@@ -9,7 +9,8 @@ import (
 
 	"cdr.dev/slog"
 
-	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
 )
 
 const (
@@ -44,12 +45,12 @@ func CheckInactiveUsersWithOptions(ctx context.Context, logger slog.Logger, db d
 			}
 
 			startTime := time.Now()
-			lastSeenAfter := database.Now().Add(-dormancyPeriod)
+			lastSeenAfter := dbtime.Now().Add(-dormancyPeriod)
 			logger.Debug(ctx, "check inactive user accounts", slog.F("dormancy_period", dormancyPeriod), slog.F("last_seen_after", lastSeenAfter))
 
 			updatedUsers, err := db.UpdateInactiveUsersToDormant(ctx, database.UpdateInactiveUsersToDormantParams{
 				LastSeenAfter: lastSeenAfter,
-				UpdatedAt:     database.Now(),
+				UpdatedAt:     dbtime.Now(),
 			})
 			if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
 				logger.Error(ctx, "can't mark inactive users as dormant", slog.Error(err))
diff --git a/coderd/dormancy/dormantusersjob_test.go b/enterprise/coderd/dormancy/dormantusersjob_test.go
similarity index 91%
rename from coderd/dormancy/dormantusersjob_test.go
rename to enterprise/coderd/dormancy/dormantusersjob_test.go
index 73224da872c6e..c752e84bc1d90 100644
--- a/coderd/dormancy/dormantusersjob_test.go
+++ b/enterprise/coderd/dormancy/dormantusersjob_test.go
@@ -6,15 +6,14 @@ import (
 	"time"
 
 	"github.com/google/uuid"
-	"github.com/moby/moby/pkg/namesgenerator"
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/dormancy"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/enterprise/coderd/dormancy"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestCheckInactiveUsers(t *testing.T) {
@@ -26,7 +25,7 @@ func TestCheckInactiveUsers(t *testing.T) {
 
 	// Add some dormant accounts
 	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
-	db := dbfake.New()
+	db := dbmem.New()
 
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	t.Cleanup(cancelFunc)
@@ -87,7 +86,7 @@ func TestCheckInactiveUsers(t *testing.T) {
 func setupUser(ctx context.Context, t *testing.T, db database.Store, email string, status database.UserStatus, lastSeenAt time.Time) database.User {
 	t.Helper()
 
-	user, err := db.InsertUser(ctx, database.InsertUserParams{ID: uuid.New(), LoginType: database.LoginTypePassword, Username: namesgenerator.GetRandomName(8), Email: email})
+	user, err := db.InsertUser(ctx, database.InsertUserParams{ID: uuid.New(), LoginType: database.LoginTypePassword, Username: uuid.NewString()[:8], Email: email})
 	require.NoError(t, err)
 	// At the beginning of the test all users are marked as active
 	user, err = db.UpdateUserStatus(ctx, database.UpdateUserStatusParams{ID: user.ID, Status: status})
diff --git a/enterprise/coderd/groups.go b/enterprise/coderd/groups.go
index b6f126e1f62e0..c209fd5a80255 100644
--- a/enterprise/coderd/groups.go
+++ b/enterprise/coderd/groups.go
@@ -8,13 +8,13 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // @Summary Create group for organization
@@ -46,9 +46,9 @@ func (api *API) postGroupByOrganization(rw http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	if req.Name == database.AllUsersGroup {
+	if req.Name == database.EveryoneGroup {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: fmt.Sprintf("%q is a reserved keyword and cannot be used for a group name.", database.AllUsersGroup),
+			Message: fmt.Sprintf("%q is a reserved keyword and cannot be used for a group name.", database.EveryoneGroup),
 		})
 		return
 	}
@@ -81,9 +81,11 @@ func (api *API) postGroupByOrganization(rw http.ResponseWriter, r *http.Request)
 // @Summary Update group by name
 // @ID update-group-by-name
 // @Security CoderSessionToken
+// @Accept json
 // @Produce json
 // @Tags Enterprise
 // @Param group path string true "Group name"
+// @Param request body codersdk.PatchGroupRequest true "Patch group request"
 // @Success 200 {object} codersdk.Group
 // @Router /groups/{group} [patch]
 func (api *API) patchGroup(rw http.ResponseWriter, r *http.Request) {
@@ -100,36 +102,56 @@ func (api *API) patchGroup(rw http.ResponseWriter, r *http.Request) {
 	)
 	defer commitAudit()
 
-	currentMembers, currentMembersErr := api.Database.GetGroupMembers(ctx, group.ID)
-	if currentMembersErr != nil {
-		httpapi.InternalServerError(rw, currentMembersErr)
+	var req codersdk.PatchGroupRequest
+	if !httpapi.Read(ctx, rw, r, &req) {
 		return
 	}
 
-	aReq.Old = group.Auditable(currentMembers)
+	// If the name matches the existing group name pretend we aren't
+	// updating the name at all.
+	if req.Name == group.Name {
+		req.Name = ""
+	}
 
-	var req codersdk.PatchGroupRequest
-	if !httpapi.Read(ctx, rw, r, &req) {
+	if group.IsEveryone() && req.Name != "" {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: fmt.Sprintf("Cannot rename the %q group!", database.EveryoneGroup),
+		})
 		return
 	}
 
-	if req.Name != "" && req.Name == database.AllUsersGroup {
+	if group.IsEveryone() && (req.DisplayName != nil && *req.DisplayName != "") {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: fmt.Sprintf("%q is a reserved group name!", database.AllUsersGroup),
+			Message: fmt.Sprintf("Cannot update the Display Name for the %q group!", database.EveryoneGroup),
 		})
 		return
 	}
 
-	// If the name matches the existing group name pretend we aren't
-	// updating the name at all.
-	if req.Name == group.Name {
-		req.Name = ""
+	if req.Name == database.EveryoneGroup {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: fmt.Sprintf("%q is a reserved group name!", database.EveryoneGroup),
+		})
+		return
 	}
 
 	users := make([]string, 0, len(req.AddUsers)+len(req.RemoveUsers))
 	users = append(users, req.AddUsers...)
 	users = append(users, req.RemoveUsers...)
 
+	if len(users) > 0 && group.Name == database.EveryoneGroup {
+		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
+			Message: fmt.Sprintf("Cannot add or remove users from the %q group!", database.EveryoneGroup),
+		})
+		return
+	}
+
+	currentMembers, err := api.Database.GetGroupMembers(ctx, group.ID)
+	if err != nil {
+		httpapi.InternalServerError(rw, err)
+		return
+	}
+	aReq.Old = group.Auditable(currentMembers)
+
 	for _, id := range users {
 		if _, err := uuid.Parse(id); err != nil {
 			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
@@ -154,6 +176,7 @@ func (api *API) patchGroup(rw http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
+
 	if req.Name != "" && req.Name != group.Name {
 		_, err := api.Database.GetGroupByOrgAndName(ctx, database.GetGroupByOrgAndNameParams{
 			OrganizationID: group.OrganizationID,
@@ -167,8 +190,7 @@ func (api *API) patchGroup(rw http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	err := api.Database.InTx(func(tx database.Store) error {
-		var err error
+	err = database.ReadModifyUpdate(api.Database, func(tx database.Store) error {
 		group, err = tx.GetGroupByID(ctx, group.ID)
 		if err != nil {
 			return xerrors.Errorf("get group by ID: %w", err)
@@ -228,7 +250,8 @@ func (api *API) patchGroup(rw http.ResponseWriter, r *http.Request) {
 			}
 		}
 		return nil
-	}, nil)
+	})
+
 	if database.IsUniqueViolation(err) {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 			Message: "Cannot add the same user to a group twice!",
@@ -281,6 +304,13 @@ func (api *API) deleteGroup(rw http.ResponseWriter, r *http.Request) {
 	)
 	defer commitAudit()
 
+	if group.Name == database.EveryoneGroup {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: fmt.Sprintf("%q is a reserved group and cannot be deleted!", database.EveryoneGroup),
+		})
+		return
+	}
+
 	groupMembers, getMembersErr := api.Database.GetGroupMembers(ctx, group.ID)
 	if getMembersErr != nil {
 		httpapi.InternalServerError(rw, getMembersErr)
@@ -289,13 +319,6 @@ func (api *API) deleteGroup(rw http.ResponseWriter, r *http.Request) {
 
 	aReq.Old = group.Auditable(groupMembers)
 
-	if group.Name == database.AllUsersGroup {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: fmt.Sprintf("%q is a reserved group and cannot be deleted!", database.AllUsersGroup),
-		})
-		return
-	}
-
 	err := api.Database.DeleteGroupByID(ctx, group.ID)
 	if err != nil {
 		httpapi.InternalServerError(rw, err)
@@ -320,12 +343,12 @@ func (api *API) groupByOrganization(rw http.ResponseWriter, r *http.Request) {
 	api.group(rw, r)
 }
 
-// @Summary Get group by name
-// @ID get-group-by-name
+// @Summary Get group by ID
+// @ID get-group-by-id
 // @Security CoderSessionToken
 // @Produce json
 // @Tags Enterprise
-// @Param group path string true "Group name"
+// @Param group path string true "Group id"
 // @Success 200 {object} codersdk.Group
 // @Router /groups/{group} [get]
 func (api *API) group(rw http.ResponseWriter, r *http.Request) {
@@ -409,6 +432,7 @@ func convertGroup(g database.Group, users []database.User) codersdk.Group {
 		AvatarURL:      g.AvatarURL,
 		QuotaAllowance: int(g.QuotaAllowance),
 		Members:        convertUsers(users, orgs),
+		Source:         codersdk.GroupSource(g.Source),
 	}
 }
 
diff --git a/enterprise/coderd/groups_test.go b/enterprise/coderd/groups_test.go
index 5999fa47b1f6d..bfbfffa5eecfb 100644
--- a/enterprise/coderd/groups_test.go
+++ b/enterprise/coderd/groups_test.go
@@ -7,14 +7,14 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestCreateGroup(t *testing.T) {
@@ -105,7 +105,7 @@ func TestCreateGroup(t *testing.T) {
 		}})
 		ctx := testutil.Context(t, testutil.WaitLong)
 		_, err := client.CreateGroup(ctx, user.OrganizationID, codersdk.CreateGroupRequest{
-			Name: database.AllUsersGroup,
+			Name: database.EveryoneGroup,
 		})
 		require.Error(t, err)
 		cerr, ok := codersdk.AsError(err)
@@ -399,7 +399,7 @@ func TestPatchGroup(t *testing.T) {
 		require.Equal(t, http.StatusBadRequest, cerr.StatusCode())
 	})
 
-	t.Run("allUsers", func(t *testing.T) {
+	t.Run("ReservedName", func(t *testing.T) {
 		t.Parallel()
 
 		client, user := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
@@ -414,13 +414,114 @@ func TestPatchGroup(t *testing.T) {
 		require.NoError(t, err)
 
 		group, err = client.PatchGroup(ctx, group.ID, codersdk.PatchGroupRequest{
-			Name: database.AllUsersGroup,
+			Name: database.EveryoneGroup,
 		})
 		require.Error(t, err)
 		cerr, ok := codersdk.AsError(err)
 		require.True(t, ok)
 		require.Equal(t, http.StatusBadRequest, cerr.StatusCode())
 	})
+
+	t.Run("Everyone", func(t *testing.T) {
+		t.Parallel()
+		t.Run("NoUpdateName", func(t *testing.T) {
+			t.Parallel()
+
+			client, user := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureTemplateRBAC: 1,
+				},
+			}})
+			ctx := testutil.Context(t, testutil.WaitLong)
+			_, err := client.PatchGroup(ctx, user.OrganizationID, codersdk.PatchGroupRequest{
+				Name: "hi",
+			})
+			require.Error(t, err)
+			cerr, ok := codersdk.AsError(err)
+			require.True(t, ok)
+			require.Equal(t, http.StatusBadRequest, cerr.StatusCode())
+		})
+
+		t.Run("NoUpdateDisplayName", func(t *testing.T) {
+			t.Parallel()
+
+			client, user := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureTemplateRBAC: 1,
+				},
+			}})
+			ctx := testutil.Context(t, testutil.WaitLong)
+			_, err := client.PatchGroup(ctx, user.OrganizationID, codersdk.PatchGroupRequest{
+				DisplayName: ptr.Ref("hi"),
+			})
+			require.Error(t, err)
+			cerr, ok := codersdk.AsError(err)
+			require.True(t, ok)
+			require.Equal(t, http.StatusBadRequest, cerr.StatusCode())
+		})
+
+		t.Run("NoAddUsers", func(t *testing.T) {
+			t.Parallel()
+
+			client, user := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureTemplateRBAC: 1,
+				},
+			}})
+			_, user2 := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
+
+			ctx := testutil.Context(t, testutil.WaitLong)
+			_, err := client.PatchGroup(ctx, user.OrganizationID, codersdk.PatchGroupRequest{
+				AddUsers: []string{user2.ID.String()},
+			})
+			require.Error(t, err)
+			cerr, ok := codersdk.AsError(err)
+			require.True(t, ok)
+			require.Equal(t, http.StatusForbidden, cerr.StatusCode())
+		})
+
+		t.Run("NoRmUsers", func(t *testing.T) {
+			t.Parallel()
+
+			client, user := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureTemplateRBAC: 1,
+				},
+			}})
+
+			ctx := testutil.Context(t, testutil.WaitLong)
+			_, err := client.PatchGroup(ctx, user.OrganizationID, codersdk.PatchGroupRequest{
+				RemoveUsers: []string{user.UserID.String()},
+			})
+			require.Error(t, err)
+			cerr, ok := codersdk.AsError(err)
+			require.True(t, ok)
+			require.Equal(t, http.StatusForbidden, cerr.StatusCode())
+		})
+
+		t.Run("UpdateQuota", func(t *testing.T) {
+			t.Parallel()
+
+			client, user := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureTemplateRBAC: 1,
+				},
+			}})
+
+			ctx := testutil.Context(t, testutil.WaitLong)
+			group, err := client.Group(ctx, user.OrganizationID)
+			require.NoError(t, err)
+
+			require.Equal(t, 0, group.QuotaAllowance)
+
+			expectedQuota := 123
+			group, err = client.PatchGroup(ctx, user.OrganizationID, codersdk.PatchGroupRequest{
+				QuotaAllowance: ptr.Ref(expectedQuota),
+			})
+			require.NoError(t, err)
+			require.Equal(t, expectedQuota, group.QuotaAllowance)
+		})
+	})
 }
 
 // TODO: test auth.
@@ -547,7 +648,7 @@ func TestGroup(t *testing.T) {
 		require.NotContains(t, group.Members, user1)
 	})
 
-	t.Run("FilterSuspendedUsers", func(t *testing.T) {
+	t.Run("IncludeSuspendedAndDormantUsers", func(t *testing.T) {
 		t.Parallel()
 
 		client, user := coderdenttest.New(t, &coderdenttest.Options{LicenseOptions: &coderdenttest.LicenseOptions{
@@ -578,8 +679,30 @@ func TestGroup(t *testing.T) {
 
 		group, err = client.Group(ctx, group.ID)
 		require.NoError(t, err)
-		require.Len(t, group.Members, 1)
-		require.NotContains(t, group.Members, user1)
+		require.Len(t, group.Members, 2)
+		require.Contains(t, group.Members, user1)
+		require.Contains(t, group.Members, user2)
+
+		// cannot explicitly set a dormant user status so must create a new user
+		anotherUser, err := client.CreateUser(ctx, codersdk.CreateUserRequest{
+			Email:          "coder@coder.com",
+			Username:       "coder",
+			Password:       "SomeStrongPassword!",
+			OrganizationID: user.OrganizationID,
+		})
+		require.NoError(t, err)
+
+		// Ensure that new user has dormant account
+		require.Equal(t, codersdk.UserStatusDormant, anotherUser.Status)
+
+		group, _ = client.PatchGroup(ctx, group.ID, codersdk.PatchGroupRequest{
+			AddUsers: []string{anotherUser.ID.String()},
+		})
+
+		group, err = client.Group(ctx, group.ID)
+		require.NoError(t, err)
+		require.Len(t, group.Members, 3)
+		require.Contains(t, group.Members, user1)
 		require.Contains(t, group.Members, user2)
 	})
 
@@ -591,13 +714,17 @@ func TestGroup(t *testing.T) {
 				codersdk.FeatureTemplateRBAC: 1,
 			},
 		}})
+		_, user1 := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
+		_, user2 := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
+
 		ctx := testutil.Context(t, testutil.WaitLong)
 		// The 'Everyone' group always has an ID that matches the organization ID.
 		group, err := client.Group(ctx, user.OrganizationID)
 		require.NoError(t, err)
-		require.Len(t, group.Members, 0)
+		require.Len(t, group.Members, 3)
 		require.Equal(t, "Everyone", group.Name)
 		require.Equal(t, user.OrganizationID, group.OrganizationID)
+		require.Contains(t, group.Members, user1, user2)
 	})
 }
 
@@ -641,7 +768,8 @@ func TestGroups(t *testing.T) {
 
 		groups, err := client.GroupsByOrganization(ctx, user.OrganizationID)
 		require.NoError(t, err)
-		require.Len(t, groups, 2)
+		// 'Everyone' group + 2 custom groups.
+		require.Len(t, groups, 3)
 		require.Contains(t, groups, group1)
 		require.Contains(t, groups, group2)
 	})
diff --git a/enterprise/coderd/insights_test.go b/enterprise/coderd/insights_test.go
index be74c8dad2808..0af7b7ad94840 100644
--- a/enterprise/coderd/insights_test.go
+++ b/enterprise/coderd/insights_test.go
@@ -9,11 +9,11 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestTemplateInsightsWithTemplateAdminACL(t *testing.T) {
diff --git a/enterprise/coderd/license/license.go b/enterprise/coderd/license/license.go
index a41dba4be3972..a8c10f0c4571e 100644
--- a/enterprise/coderd/license/license.go
+++ b/enterprise/coderd/license/license.go
@@ -12,9 +12,9 @@ import (
 
 	"cdr.dev/slog"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // Entitlements processes licenses to return whether features are enabled or not.
@@ -23,7 +23,7 @@ func Entitlements(
 	db database.Store,
 	logger slog.Logger,
 	replicaCount int,
-	gitAuthCount int,
+	externalAuthCount int,
 	keys map[string]ed25519.PublicKey,
 	enablements map[codersdk.FeatureName]bool,
 ) (codersdk.Entitlements, error) {
@@ -61,6 +61,7 @@ func Entitlements(
 	}
 
 	allFeatures := false
+	allFeaturesEntitlement := codersdk.EntitlementNotEntitled
 
 	// Here we loop through licenses to detect enabled features.
 	for _, l := range licenses {
@@ -117,7 +118,7 @@ func Entitlements(
 				}
 			default:
 				entitlements.Features[featureName] = codersdk.Feature{
-					Entitlement: entitlement,
+					Entitlement: maxEntitlement(entitlements.Features[featureName].Entitlement, entitlement),
 					Enabled:     enablements[featureName] || featureName.AlwaysEnable(),
 				}
 			}
@@ -125,6 +126,7 @@ func Entitlements(
 
 		if claims.AllFeatures {
 			allFeatures = true
+			allFeaturesEntitlement = maxEntitlement(allFeaturesEntitlement, entitlement)
 		}
 		entitlements.RequireTelemetry = entitlements.RequireTelemetry || claims.RequireTelemetry
 	}
@@ -136,7 +138,8 @@ func Entitlements(
 				continue
 			}
 			feature := entitlements.Features[featureName]
-			feature.Entitlement = codersdk.EntitlementEntitled
+			feature.Entitlement = maxEntitlement(feature.Entitlement, allFeaturesEntitlement)
+			feature.Enabled = enablements[featureName] || featureName.AlwaysEnable()
 			entitlements.Features[featureName] = feature
 		}
 	}
@@ -158,8 +161,8 @@ func Entitlements(
 			if featureName == codersdk.FeatureHighAvailability {
 				continue
 			}
-			// Multiple Git auth has it's own warnings based on the number configured!
-			if featureName == codersdk.FeatureMultipleGitAuth {
+			// External Auth Providers auth has it's own warnings based on the number configured!
+			if featureName == codersdk.FeatureMultipleExternalAuth {
 				continue
 			}
 			feature := entitlements.Features[featureName]
@@ -197,23 +200,23 @@ func Entitlements(
 		}
 	}
 
-	if gitAuthCount > 1 {
-		feature := entitlements.Features[codersdk.FeatureMultipleGitAuth]
+	if externalAuthCount > 1 {
+		feature := entitlements.Features[codersdk.FeatureMultipleExternalAuth]
 
 		switch feature.Entitlement {
 		case codersdk.EntitlementNotEntitled:
 			if entitlements.HasLicense {
 				entitlements.Errors = append(entitlements.Errors,
-					"You have multiple Git authorizations configured but your license is limited at one.",
+					"You have multiple External Auth Providers configured but your license is limited at one.",
 				)
 			} else {
 				entitlements.Errors = append(entitlements.Errors,
-					"You have multiple Git authorizations configured but this is an Enterprise feature. Reduce to one.",
+					"You have multiple External Auth Providers configured but this is an Enterprise feature. Reduce to one.",
 				)
 			}
 		case codersdk.EntitlementGracePeriod:
 			entitlements.Warnings = append(entitlements.Warnings,
-				"You have multiple Git authorizations configured but your license is expired. Reduce to one.",
+				"You have multiple External Auth Providers configured but your license is expired. Reduce to one.",
 			)
 		}
 	}
@@ -225,6 +228,7 @@ func Entitlements(
 			entitlements.Features[featureName] = feature
 		}
 	}
+	entitlements.RefreshedAt = now
 
 	return entitlements, nil
 }
@@ -323,3 +327,14 @@ func keyFunc(keys map[string]ed25519.PublicKey) func(*jwt.Token) (interface{}, e
 		return k, nil
 	}
 }
+
+// maxEntitlement is the "greater" entitlement between the given values
+func maxEntitlement(e1, e2 codersdk.Entitlement) codersdk.Entitlement {
+	if e1 == codersdk.EntitlementEntitled || e2 == codersdk.EntitlementEntitled {
+		return codersdk.EntitlementEntitled
+	}
+	if e1 == codersdk.EntitlementGracePeriod || e2 == codersdk.EntitlementGracePeriod {
+		return codersdk.EntitlementGracePeriod
+	}
+	return codersdk.EntitlementNotEntitled
+}
diff --git a/enterprise/coderd/license/license_test.go b/enterprise/coderd/license/license_test.go
index 546333b87a2af..f57dd0292d5c2 100644
--- a/enterprise/coderd/license/license_test.go
+++ b/enterprise/coderd/license/license_test.go
@@ -10,11 +10,12 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
 )
 
 func TestEntitlements(t *testing.T) {
@@ -28,7 +29,7 @@ func TestEntitlements(t *testing.T) {
 
 	t.Run("Defaults", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		entitlements, err := license.Entitlements(context.Background(), db, slog.Logger{}, 1, 1, coderdenttest.Keys, all)
 		require.NoError(t, err)
 		require.False(t, entitlements.HasLicense)
@@ -40,7 +41,7 @@ func TestEntitlements(t *testing.T) {
 	})
 	t.Run("Always return the current user count", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		entitlements, err := license.Entitlements(context.Background(), db, slog.Logger{}, 1, 1, coderdenttest.Keys, all)
 		require.NoError(t, err)
 		require.False(t, entitlements.HasLicense)
@@ -49,7 +50,7 @@ func TestEntitlements(t *testing.T) {
 	})
 	t.Run("SingleLicenseNothing", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{}),
 			Exp: time.Now().Add(time.Hour),
@@ -65,7 +66,7 @@ func TestEntitlements(t *testing.T) {
 	})
 	t.Run("SingleLicenseAll", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
 				Features: func() license.Features {
@@ -88,7 +89,7 @@ func TestEntitlements(t *testing.T) {
 	})
 	t.Run("SingleLicenseGrace", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
 				Features: license.Features{
@@ -114,7 +115,7 @@ func TestEntitlements(t *testing.T) {
 	})
 	t.Run("Expiration warning", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
 				Features: license.Features{
@@ -143,7 +144,7 @@ func TestEntitlements(t *testing.T) {
 
 	t.Run("Expiration warning for license expiring in 1 day", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
 				Features: license.Features{
@@ -172,7 +173,7 @@ func TestEntitlements(t *testing.T) {
 
 	t.Run("Expiration warning for trials", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
 				Features: license.Features{
@@ -202,7 +203,7 @@ func TestEntitlements(t *testing.T) {
 
 	t.Run("Expiration warning for non trials", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
 				Features: license.Features{
@@ -231,7 +232,7 @@ func TestEntitlements(t *testing.T) {
 
 	t.Run("SingleLicenseNotEntitled", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{}),
 			Exp: time.Now().Add(time.Hour),
@@ -247,7 +248,7 @@ func TestEntitlements(t *testing.T) {
 			if featureName == codersdk.FeatureHighAvailability {
 				continue
 			}
-			if featureName == codersdk.FeatureMultipleGitAuth {
+			if featureName == codersdk.FeatureMultipleExternalAuth {
 				continue
 			}
 			niceName := featureName.Humanize()
@@ -259,7 +260,7 @@ func TestEntitlements(t *testing.T) {
 	})
 	t.Run("TooManyUsers", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		activeUser1, err := db.InsertUser(context.Background(), database.InsertUserParams{
 			ID:        uuid.New(),
 			Username:  "test1",
@@ -269,7 +270,7 @@ func TestEntitlements(t *testing.T) {
 		_, err = db.UpdateUserStatus(context.Background(), database.UpdateUserStatusParams{
 			ID:        activeUser1.ID,
 			Status:    database.UserStatusActive,
-			UpdatedAt: database.Now(),
+			UpdatedAt: dbtime.Now(),
 		})
 		require.NoError(t, err)
 		activeUser2, err := db.InsertUser(context.Background(), database.InsertUserParams{
@@ -281,7 +282,7 @@ func TestEntitlements(t *testing.T) {
 		_, err = db.UpdateUserStatus(context.Background(), database.UpdateUserStatusParams{
 			ID:        activeUser2.ID,
 			Status:    database.UserStatusActive,
-			UpdatedAt: database.Now(),
+			UpdatedAt: dbtime.Now(),
 		})
 		require.NoError(t, err)
 		_, err = db.InsertUser(context.Background(), database.InsertUserParams{
@@ -305,7 +306,7 @@ func TestEntitlements(t *testing.T) {
 	})
 	t.Run("MaximizeUserLimit", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertUser(context.Background(), database.InsertUserParams{})
 		db.InsertUser(context.Background(), database.InsertUserParams{})
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
@@ -333,7 +334,7 @@ func TestEntitlements(t *testing.T) {
 	})
 	t.Run("MultipleLicenseEnabled", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		// One trial
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			Exp: time.Now().Add(time.Hour),
@@ -357,7 +358,7 @@ func TestEntitlements(t *testing.T) {
 
 	t.Run("AllFeatures", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			Exp: time.Now().Add(time.Hour),
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
@@ -377,9 +378,56 @@ func TestEntitlements(t *testing.T) {
 		}
 	})
 
+	t.Run("AllFeaturesAlwaysEnable", func(t *testing.T) {
+		t.Parallel()
+		db := dbmem.New()
+		db.InsertLicense(context.Background(), database.InsertLicenseParams{
+			Exp: dbtime.Now().Add(time.Hour),
+			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
+				AllFeatures: true,
+			}),
+		})
+		entitlements, err := license.Entitlements(context.Background(), db, slog.Logger{}, 1, 1, coderdenttest.Keys, empty)
+		require.NoError(t, err)
+		require.True(t, entitlements.HasLicense)
+		require.False(t, entitlements.Trial)
+		for _, featureName := range codersdk.FeatureNames {
+			if featureName == codersdk.FeatureUserLimit {
+				continue
+			}
+			feature := entitlements.Features[featureName]
+			require.Equal(t, featureName.AlwaysEnable(), feature.Enabled)
+			require.Equal(t, codersdk.EntitlementEntitled, feature.Entitlement)
+		}
+	})
+
+	t.Run("AllFeaturesGrace", func(t *testing.T) {
+		t.Parallel()
+		db := dbmem.New()
+		db.InsertLicense(context.Background(), database.InsertLicenseParams{
+			Exp: dbtime.Now().Add(time.Hour),
+			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
+				AllFeatures: true,
+				GraceAt:     dbtime.Now().Add(-time.Hour),
+				ExpiresAt:   dbtime.Now().Add(time.Hour),
+			}),
+		})
+		entitlements, err := license.Entitlements(context.Background(), db, slog.Logger{}, 1, 1, coderdenttest.Keys, all)
+		require.NoError(t, err)
+		require.True(t, entitlements.HasLicense)
+		require.False(t, entitlements.Trial)
+		for _, featureName := range codersdk.FeatureNames {
+			if featureName == codersdk.FeatureUserLimit {
+				continue
+			}
+			require.True(t, entitlements.Features[featureName].Enabled)
+			require.Equal(t, codersdk.EntitlementGracePeriod, entitlements.Features[featureName].Entitlement)
+		}
+	})
+
 	t.Run("MultipleReplicasNoLicense", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		entitlements, err := license.Entitlements(context.Background(), db, slog.Logger{}, 2, 1, coderdenttest.Keys, all)
 		require.NoError(t, err)
 		require.False(t, entitlements.HasLicense)
@@ -389,7 +437,7 @@ func TestEntitlements(t *testing.T) {
 
 	t.Run("MultipleReplicasNotEntitled", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			Exp: time.Now().Add(time.Hour),
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
@@ -409,7 +457,7 @@ func TestEntitlements(t *testing.T) {
 
 	t.Run("MultipleReplicasGrace", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
 				Features: license.Features{
@@ -431,17 +479,17 @@ func TestEntitlements(t *testing.T) {
 
 	t.Run("MultipleGitAuthNoLicense", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		entitlements, err := license.Entitlements(context.Background(), db, slog.Logger{}, 1, 2, coderdenttest.Keys, all)
 		require.NoError(t, err)
 		require.False(t, entitlements.HasLicense)
 		require.Len(t, entitlements.Errors, 1)
-		require.Equal(t, "You have multiple Git authorizations configured but this is an Enterprise feature. Reduce to one.", entitlements.Errors[0])
+		require.Equal(t, "You have multiple External Auth Providers configured but this is an Enterprise feature. Reduce to one.", entitlements.Errors[0])
 	})
 
 	t.Run("MultipleGitAuthNotEntitled", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			Exp: time.Now().Add(time.Hour),
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
@@ -451,33 +499,33 @@ func TestEntitlements(t *testing.T) {
 			}),
 		})
 		entitlements, err := license.Entitlements(context.Background(), db, slog.Logger{}, 1, 2, coderdenttest.Keys, map[codersdk.FeatureName]bool{
-			codersdk.FeatureMultipleGitAuth: true,
+			codersdk.FeatureMultipleExternalAuth: true,
 		})
 		require.NoError(t, err)
 		require.True(t, entitlements.HasLicense)
 		require.Len(t, entitlements.Errors, 1)
-		require.Equal(t, "You have multiple Git authorizations configured but your license is limited at one.", entitlements.Errors[0])
+		require.Equal(t, "You have multiple External Auth Providers configured but your license is limited at one.", entitlements.Errors[0])
 	})
 
 	t.Run("MultipleGitAuthGrace", func(t *testing.T) {
 		t.Parallel()
-		db := dbfake.New()
+		db := dbmem.New()
 		db.InsertLicense(context.Background(), database.InsertLicenseParams{
 			JWT: coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
 				GraceAt:   time.Now().Add(-time.Hour),
 				ExpiresAt: time.Now().Add(time.Hour),
 				Features: license.Features{
-					codersdk.FeatureMultipleGitAuth: 1,
+					codersdk.FeatureMultipleExternalAuth: 1,
 				},
 			}),
 			Exp: time.Now().Add(time.Hour),
 		})
 		entitlements, err := license.Entitlements(context.Background(), db, slog.Logger{}, 1, 2, coderdenttest.Keys, map[codersdk.FeatureName]bool{
-			codersdk.FeatureMultipleGitAuth: true,
+			codersdk.FeatureMultipleExternalAuth: true,
 		})
 		require.NoError(t, err)
 		require.True(t, entitlements.HasLicense)
 		require.Len(t, entitlements.Warnings, 1)
-		require.Equal(t, "You have multiple Git authorizations configured but your license is expired. Reduce to one.", entitlements.Warnings[0])
+		require.Equal(t, "You have multiple External Auth Providers configured but your license is expired. Reduce to one.", entitlements.Warnings[0])
 	})
 }
diff --git a/enterprise/coderd/license/metricscollector.go b/enterprise/coderd/license/metricscollector.go
new file mode 100644
index 0000000000000..85aac23b2fcaf
--- /dev/null
+++ b/enterprise/coderd/license/metricscollector.go
@@ -0,0 +1,53 @@
+package license
+
+import (
+	"sync/atomic"
+
+	"github.com/prometheus/client_golang/prometheus"
+
+	"github.com/coder/coder/v2/codersdk"
+)
+
+var (
+	activeUsersDesc      = prometheus.NewDesc("coderd_license_active_users", "The number of active users.", nil, nil)
+	limitUsersDesc       = prometheus.NewDesc("coderd_license_limit_users", "The user seats limit based on the active Coder license.", nil, nil)
+	userLimitEnabledDesc = prometheus.NewDesc("coderd_license_user_limit_enabled", "Returns 1 if the current license enforces the user limit.", nil, nil)
+)
+
+type MetricsCollector struct {
+	Entitlements atomic.Pointer[codersdk.Entitlements]
+}
+
+var _ prometheus.Collector = new(MetricsCollector)
+
+func (*MetricsCollector) Describe(descCh chan<- *prometheus.Desc) {
+	descCh <- activeUsersDesc
+	descCh <- limitUsersDesc
+	descCh <- userLimitEnabledDesc
+}
+
+func (mc *MetricsCollector) Collect(metricsCh chan<- prometheus.Metric) {
+	entitlements := mc.Entitlements.Load()
+	if entitlements == nil || entitlements.Features == nil {
+		return
+	}
+
+	userLimitEntitlement, ok := entitlements.Features[codersdk.FeatureUserLimit]
+	if !ok {
+		return
+	}
+
+	var enabled float64
+	if userLimitEntitlement.Enabled {
+		enabled = 1
+	}
+	metricsCh <- prometheus.MustNewConstMetric(userLimitEnabledDesc, prometheus.GaugeValue, enabled)
+
+	if userLimitEntitlement.Actual != nil {
+		metricsCh <- prometheus.MustNewConstMetric(activeUsersDesc, prometheus.GaugeValue, float64(*userLimitEntitlement.Actual))
+	}
+
+	if userLimitEntitlement.Limit != nil {
+		metricsCh <- prometheus.MustNewConstMetric(limitUsersDesc, prometheus.GaugeValue, float64(*userLimitEntitlement.Limit))
+	}
+}
diff --git a/enterprise/coderd/license/metricscollector_test.go b/enterprise/coderd/license/metricscollector_test.go
new file mode 100644
index 0000000000000..36661c8cdb364
--- /dev/null
+++ b/enterprise/coderd/license/metricscollector_test.go
@@ -0,0 +1,63 @@
+package license_test
+
+import (
+	"encoding/json"
+	"os"
+	"testing"
+
+	"github.com/aws/smithy-go/ptr"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+)
+
+func TestCollectLicenseMetrics(t *testing.T) {
+	t.Parallel()
+
+	// Given
+	registry := prometheus.NewRegistry()
+
+	var sut license.MetricsCollector
+
+	const (
+		actualUsers = 4
+		userLimit   = 7
+	)
+	sut.Entitlements.Store(&codersdk.Entitlements{
+		Features: map[codersdk.FeatureName]codersdk.Feature{
+			codersdk.FeatureUserLimit: {
+				Enabled: true,
+				Actual:  ptr.Int64(actualUsers),
+				Limit:   ptr.Int64(userLimit),
+			},
+		},
+	})
+
+	registry.Register(&sut)
+
+	// When
+	metrics, err := registry.Gather()
+	require.NoError(t, err)
+
+	// Then
+	goldenFile, err := os.ReadFile("testdata/license-metrics.json")
+	require.NoError(t, err)
+	golden := map[string]int{}
+	err = json.Unmarshal(goldenFile, &golden)
+	require.NoError(t, err)
+
+	collected := map[string]int{}
+	for _, metric := range metrics {
+		switch metric.GetName() {
+		case "coderd_license_active_users", "coderd_license_limit_users", "coderd_license_user_limit_enabled":
+			for _, m := range metric.Metric {
+				collected[metric.GetName()] = int(m.Gauge.GetValue())
+			}
+		default:
+			require.FailNowf(t, "unexpected metric collected", "metric: %s", metric.GetName())
+		}
+	}
+	require.EqualValues(t, golden, collected)
+}
diff --git a/enterprise/coderd/license/testdata/license-metrics.json b/enterprise/coderd/license/testdata/license-metrics.json
new file mode 100644
index 0000000000000..7326b47da7a35
--- /dev/null
+++ b/enterprise/coderd/license/testdata/license-metrics.json
@@ -0,0 +1,5 @@
+{
+  "coderd_license_active_users": 4,
+  "coderd_license_limit_users": 7,
+  "coderd_license_user_limit_enabled": 1
+}
diff --git a/enterprise/coderd/licenses.go b/enterprise/coderd/licenses.go
index 24085ee9a7bea..b7c7b5af6e4f0 100644
--- a/enterprise/coderd/licenses.go
+++ b/enterprise/coderd/licenses.go
@@ -8,6 +8,7 @@ import (
 	_ "embed"
 	"encoding/base64"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"strconv"
 	"strings"
@@ -19,13 +20,14 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/license"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
 )
 
 const (
@@ -82,7 +84,7 @@ func (api *API) postLicense(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	rawClaims, err := license.ParseRaw(addLicense.License, api.Keys)
+	rawClaims, err := license.ParseRaw(addLicense.License, api.LicenseKeys)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 			Message: "Invalid license",
@@ -100,7 +102,7 @@ func (api *API) postLicense(rw http.ResponseWriter, r *http.Request) {
 	}
 	expTime := time.Unix(int64(exp), 0)
 
-	claims, err := license.ParseClaims(addLicense.License, api.Keys)
+	claims, err := license.ParseClaims(addLicense.License, api.LicenseKeys)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 			Message: "Invalid license",
@@ -119,7 +121,7 @@ func (api *API) postLicense(rw http.ResponseWriter, r *http.Request) {
 		id = uuid.New()
 	}
 	dl, err := api.Database.InsertLicense(ctx, database.InsertLicenseParams{
-		UploadedAt: database.Now(),
+		UploadedAt: dbtime.Now(),
 		JWT:        addLicense.License,
 		Exp:        expTime,
 		UUID:       id,
@@ -150,6 +152,75 @@ func (api *API) postLicense(rw http.ResponseWriter, r *http.Request) {
 	httpapi.Write(ctx, rw, http.StatusCreated, convertLicense(dl, rawClaims))
 }
 
+// postRefreshEntitlements forces an `updateEntitlements` call and publishes
+// a message to the PubsubEventLicenses topic to force other replicas
+// to update their entitlements.
+// Updates happen automatically on a timer, however that time is every 10 minutes,
+// and we want to be able to force an update immediately in some cases.
+//
+// @Summary Update license entitlements
+// @ID update-license-entitlements
+// @Security CoderSessionToken
+// @Produce json
+// @Tags Organizations
+// @Success 201 {object} codersdk.Response
+// @Router /licenses/refresh-entitlements [post]
+func (api *API) postRefreshEntitlements(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+
+	// If the user cannot create a new license, then they cannot refresh entitlements.
+	// Refreshing entitlements is a way to force a refresh of the license, so it is
+	// equivalent to creating a new license.
+	if !api.AGPL.Authorize(r, rbac.ActionCreate, rbac.ResourceLicense) {
+		httpapi.Forbidden(rw)
+		return
+	}
+
+	// Prevent abuse by limiting how often we allow a forced refresh.
+	now := time.Now()
+	if diff := now.Sub(api.entitlements.RefreshedAt); diff < time.Minute {
+		wait := time.Minute - diff
+		rw.Header().Set("Retry-After", strconv.Itoa(int(wait.Seconds())))
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: fmt.Sprintf("Entitlements already recently refreshed, please wait %d seconds to force a new refresh", int(wait.Seconds())),
+			Detail:  fmt.Sprintf("Last refresh at %s", now.UTC().String()),
+		})
+		return
+	}
+
+	err := api.replicaManager.UpdateNow(ctx)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Failed to sync replicas",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	err = api.updateEntitlements(ctx)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Failed to update entitlements",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	err = api.Pubsub.Publish(PubsubEventLicenses, []byte("refresh"))
+	if err != nil {
+		api.Logger.Error(context.Background(), "failed to publish forced entitlement update", slog.Error(err))
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Failed to publish forced entitlement update. Other replicas might not be updated.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	httpapi.Write(ctx, rw, http.StatusOK, codersdk.Response{
+		Message: "Entitlements updated",
+	})
+}
+
 // @Summary Get licenses
 // @ID get-licenses
 // @Security CoderSessionToken
diff --git a/enterprise/coderd/licenses_test.go b/enterprise/coderd/licenses_test.go
index 59b2e7f306f11..be340e44d3c54 100644
--- a/enterprise/coderd/licenses_test.go
+++ b/enterprise/coderd/licenses_test.go
@@ -9,10 +9,10 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestPostLicense(t *testing.T) {
diff --git a/enterprise/coderd/provisionerdaemons.go b/enterprise/coderd/provisionerdaemons.go
index 055704a6bcb11..e10489f45a6c7 100644
--- a/enterprise/coderd/provisionerdaemons.go
+++ b/enterprise/coderd/provisionerdaemons.go
@@ -2,14 +2,15 @@ package coderd
 
 import (
 	"context"
+	"crypto/subtle"
 	"database/sql"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"net"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/google/uuid"
 	"github.com/hashicorp/yamux"
@@ -21,14 +22,16 @@ import (
 	"storj.io/drpc/drpcserver"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/provisionerdserver"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisionerd/proto"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/provisionerdserver"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisionerd/proto"
 )
 
 func (api *API) provisionerDaemonsEnabledMW(next http.Handler) http.Handler {
@@ -87,6 +90,42 @@ func (api *API) provisionerDaemons(rw http.ResponseWriter, r *http.Request) {
 	httpapi.Write(ctx, rw, http.StatusOK, apiDaemons)
 }
 
+type provisionerDaemonAuth struct {
+	psk        string
+	authorizer rbac.Authorizer
+}
+
+// authorize returns mutated tags and true if the given HTTP request is authorized to access the provisioner daemon
+// protobuf API, and returns nil, false otherwise.
+func (p *provisionerDaemonAuth) authorize(r *http.Request, tags map[string]string) (map[string]string, bool) {
+	ctx := r.Context()
+	apiKey, ok := httpmw.APIKeyOptional(r)
+	if ok {
+		tags = provisionerdserver.MutateTags(apiKey.UserID, tags)
+		if tags[provisionerdserver.TagScope] == provisionerdserver.ScopeUser {
+			// Any authenticated user can create provisioner daemons scoped
+			// for jobs that they own,
+			return tags, true
+		}
+		ua := httpmw.UserAuthorization(r)
+		if err := p.authorizer.Authorize(ctx, ua.Actor, rbac.ActionCreate, rbac.ResourceProvisionerDaemon); err == nil {
+			// User is allowed to create provisioner daemons
+			return tags, true
+		}
+	}
+
+	// Check for PSK
+	if p.psk != "" {
+		psk := r.Header.Get(codersdk.ProvisionerDaemonPSK)
+		if subtle.ConstantTimeCompare([]byte(p.psk), []byte(psk)) == 1 {
+			// If using PSK auth, the daemon is, by definition, scoped to the organization.
+			tags[provisionerdserver.TagScope] = provisionerdserver.ScopeOrganization
+			return tags, true
+		}
+	}
+	return nil, false
+}
+
 // Serves the provisioner daemon protobuf API over a WebSocket.
 //
 // @Summary Serve provisioner daemon
@@ -119,6 +158,11 @@ func (api *API) provisionerDaemonServe(rw http.ResponseWriter, r *http.Request)
 		return
 	}
 
+	id, _ := uuid.Parse(r.URL.Query().Get("id"))
+	if id == uuid.Nil {
+		id = uuid.New()
+	}
+
 	provisionersMap := map[codersdk.ProvisionerType]struct{}{}
 	for _, provisioner := range r.URL.Query()["provisioner"] {
 		switch provisioner {
@@ -134,19 +178,22 @@ func (api *API) provisionerDaemonServe(rw http.ResponseWriter, r *http.Request)
 		}
 	}
 
-	// Any authenticated user can create provisioner daemons scoped
-	// for jobs that they own, but only authorized users can create
-	// globally scoped provisioners that attach to all jobs.
-	apiKey := httpmw.APIKey(r)
-	tags = provisionerdserver.MutateTags(apiKey.UserID, tags)
-
-	if tags[provisionerdserver.TagScope] == provisionerdserver.ScopeOrganization {
-		if !api.AGPL.Authorize(r, rbac.ActionCreate, rbac.ResourceProvisionerDaemon) {
-			httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
-				Message: "You aren't allowed to create provisioner daemons for the organization.",
-			})
-			return
-		}
+	tags, authorized := api.provisionerDaemonAuth.authorize(r, tags)
+	if !authorized {
+		api.Logger.Warn(ctx, "unauthorized provisioner daemon serve request", slog.F("tags", tags))
+		httpapi.Write(ctx, rw, http.StatusForbidden,
+			codersdk.Response{Message: "You aren't allowed to create provisioner daemons"})
+		return
+	}
+	api.Logger.Debug(ctx, "provisioner authorized", slog.F("tags", tags))
+	if err := provisionerdserver.Tags(tags).Valid(); err != nil {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "Given tags are not acceptable to the service",
+			Validations: []codersdk.ValidationError{
+				{Field: "tags", Detail: err.Error()},
+			},
+		})
+		return
 	}
 
 	provisioners := make([]database.ProvisionerType, 0)
@@ -160,40 +207,32 @@ func (api *API) provisionerDaemonServe(rw http.ResponseWriter, r *http.Request)
 	}
 
 	name := namesgenerator.GetRandomName(1)
-	daemon, err := api.Database.InsertProvisionerDaemon(ctx, database.InsertProvisionerDaemonParams{
-		ID:           uuid.New(),
-		CreatedAt:    database.Now(),
-		Name:         name,
-		Provisioners: provisioners,
-		Tags:         tags,
-	})
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error writing provisioner daemon.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-
-	rawTags, err := json.Marshal(daemon.Tags)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error marshaling daemon tags.",
-			Detail:  err.Error(),
-		})
-		return
-	}
+	log := api.Logger.With(
+		slog.F("name", name),
+		slog.F("provisioners", provisioners),
+		slog.F("tags", tags),
+	)
 
 	api.AGPL.WebsocketWaitMutex.Lock()
 	api.AGPL.WebsocketWaitGroup.Add(1)
 	api.AGPL.WebsocketWaitMutex.Unlock()
 	defer api.AGPL.WebsocketWaitGroup.Done()
 
+	tep := telemetry.ConvertExternalProvisioner(id, tags, provisioners)
+	api.Telemetry.Report(&telemetry.Snapshot{ExternalProvisioners: []telemetry.ExternalProvisioner{tep}})
+	defer func() {
+		tep.ShutdownAt = ptr.Ref(time.Now())
+		api.Telemetry.Report(&telemetry.Snapshot{ExternalProvisioners: []telemetry.ExternalProvisioner{tep}})
+	}()
+
 	conn, err := websocket.Accept(rw, r, &websocket.AcceptOptions{
 		// Need to disable compression to avoid a data-race.
 		CompressionMode: websocket.CompressionDisabled,
 	})
 	if err != nil {
+		if !xerrors.Is(err, context.Canceled) {
+			log.Error(ctx, "accept provisioner websocket conn", slog.Error(err))
+		}
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 			Message: "Internal error accepting websocket connection.",
 			Detail:  err.Error(),
@@ -216,23 +255,38 @@ func (api *API) provisionerDaemonServe(rw http.ResponseWriter, r *http.Request)
 		return
 	}
 	mux := drpcmux.New()
-	err = proto.DRPCRegisterProvisionerDaemon(mux, &provisionerdserver.Server{
-		AccessURL:                   api.AccessURL,
-		GitAuthConfigs:              api.GitAuthConfigs,
-		OIDCConfig:                  api.OIDCConfig,
-		ID:                          daemon.ID,
-		Database:                    api.Database,
-		Pubsub:                      api.Pubsub,
-		Provisioners:                daemon.Provisioners,
-		Telemetry:                   api.Telemetry,
-		Auditor:                     &api.AGPL.Auditor,
-		TemplateScheduleStore:       api.AGPL.TemplateScheduleStore,
-		UserQuietHoursScheduleStore: api.AGPL.UserQuietHoursScheduleStore,
-		Logger:                      api.Logger.Named(fmt.Sprintf("provisionerd-%s", daemon.Name)),
-		Tags:                        rawTags,
-		Tracer:                      trace.NewNoopTracerProvider().Tracer("noop"),
-		DeploymentValues:            api.DeploymentValues,
-	})
+	logger := api.Logger.Named(fmt.Sprintf("ext-provisionerd-%s", name))
+	logger.Info(ctx, "starting external provisioner daemon")
+	srv, err := provisionerdserver.NewServer(
+		api.ctx,
+		api.AccessURL,
+		id,
+		logger,
+		provisioners,
+		tags,
+		api.Database,
+		api.Pubsub,
+		api.AGPL.Acquirer,
+		api.Telemetry,
+		trace.NewNoopTracerProvider().Tracer("noop"),
+		&api.AGPL.QuotaCommitter,
+		&api.AGPL.Auditor,
+		api.AGPL.TemplateScheduleStore,
+		api.AGPL.UserQuietHoursScheduleStore,
+		api.DeploymentValues,
+		provisionerdserver.Options{
+			ExternalAuthConfigs: api.ExternalAuthConfigs,
+			OIDCConfig:          api.OIDCConfig,
+		},
+	)
+	if err != nil {
+		if !xerrors.Is(err, context.Canceled) {
+			log.Error(ctx, "create provisioner daemon server", slog.Error(err))
+		}
+		_ = conn.Close(websocket.StatusInternalError, httpapi.WebsocketCloseSprintf("create provisioner daemon server: %s", err))
+		return
+	}
+	err = proto.DRPCRegisterProvisionerDaemon(mux, srv)
 	if err != nil {
 		_ = conn.Close(websocket.StatusInternalError, httpapi.WebsocketCloseSprintf("drpc register provisioner daemon: %s", err))
 		return
@@ -242,12 +296,12 @@ func (api *API) provisionerDaemonServe(rw http.ResponseWriter, r *http.Request)
 			if xerrors.Is(err, io.EOF) {
 				return
 			}
-			api.Logger.Debug(ctx, "drpc server error", slog.Error(err))
+			logger.Debug(ctx, "drpc server error", slog.Error(err))
 		},
 	})
 	err = server.Serve(ctx, session)
+	logger.Info(ctx, "provisioner daemon disconnected", slog.Error(err))
 	if err != nil && !xerrors.Is(err, io.EOF) {
-		api.Logger.Debug(ctx, "provisioner daemon disconnected", slog.Error(err))
 		_ = conn.Close(websocket.StatusInternalError, httpapi.WebsocketCloseSprintf("serve: %s", err))
 		return
 	}
diff --git a/enterprise/coderd/provisionerdaemons_test.go b/enterprise/coderd/provisionerdaemons_test.go
index 28a89431b4f00..b5516bff2a0bd 100644
--- a/enterprise/coderd/provisionerdaemons_test.go
+++ b/enterprise/coderd/provisionerdaemons_test.go
@@ -9,14 +9,22 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/provisionerdserver"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/provisionerdserver"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionerd"
+	provisionerdproto "github.com/coder/coder/v2/provisionerd/proto"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestProvisionerDaemonServe(t *testing.T) {
@@ -28,9 +36,15 @@ func TestProvisionerDaemonServe(t *testing.T) {
 				codersdk.FeatureExternalProvisionerDaemons: 1,
 			},
 		}})
-		srv, err := client.ServeProvisionerDaemon(context.Background(), user.OrganizationID, []codersdk.ProvisionerType{
-			codersdk.ProvisionerTypeEcho,
-		}, map[string]string{})
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+		srv, err := client.ServeProvisionerDaemon(ctx, codersdk.ServeProvisionerDaemonRequest{
+			Organization: user.OrganizationID,
+			Provisioners: []codersdk.ProvisionerType{
+				codersdk.ProvisionerTypeEcho,
+			},
+			Tags: map[string]string{},
+		})
 		require.NoError(t, err)
 		srv.DRPCConn().Close()
 	})
@@ -38,9 +52,15 @@ func TestProvisionerDaemonServe(t *testing.T) {
 	t.Run("NoLicense", func(t *testing.T) {
 		t.Parallel()
 		client, user := coderdenttest.New(t, &coderdenttest.Options{DontAddLicense: true})
-		_, err := client.ServeProvisionerDaemon(context.Background(), user.OrganizationID, []codersdk.ProvisionerType{
-			codersdk.ProvisionerTypeEcho,
-		}, map[string]string{})
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+		_, err := client.ServeProvisionerDaemon(ctx, codersdk.ServeProvisionerDaemonRequest{
+			Organization: user.OrganizationID,
+			Provisioners: []codersdk.ProvisionerType{
+				codersdk.ProvisionerTypeEcho,
+			},
+			Tags: map[string]string{},
+		})
 		require.Error(t, err)
 		var apiError *codersdk.Error
 		require.ErrorAs(t, err, &apiError)
@@ -55,10 +75,16 @@ func TestProvisionerDaemonServe(t *testing.T) {
 			},
 		}})
 		another, _ := coderdtest.CreateAnotherUser(t, client, user.OrganizationID, rbac.RoleOrgAdmin(user.OrganizationID))
-		_, err := another.ServeProvisionerDaemon(context.Background(), user.OrganizationID, []codersdk.ProvisionerType{
-			codersdk.ProvisionerTypeEcho,
-		}, map[string]string{
-			provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+		_, err := another.ServeProvisionerDaemon(ctx, codersdk.ServeProvisionerDaemonRequest{
+			Organization: user.OrganizationID,
+			Provisioners: []codersdk.ProvisionerType{
+				codersdk.ProvisionerTypeEcho,
+			},
+			Tags: map[string]string{
+				provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+			},
 		})
 		require.Error(t, err)
 		var apiError *codersdk.Error
@@ -74,10 +100,16 @@ func TestProvisionerDaemonServe(t *testing.T) {
 			},
 		}})
 		another, _ := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
-		_, err := another.ServeProvisionerDaemon(context.Background(), user.OrganizationID, []codersdk.ProvisionerType{
-			codersdk.ProvisionerTypeEcho,
-		}, map[string]string{
-			provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+		_, err := another.ServeProvisionerDaemon(ctx, codersdk.ServeProvisionerDaemonRequest{
+			Organization: user.OrganizationID,
+			Provisioners: []codersdk.ProvisionerType{
+				codersdk.ProvisionerTypeEcho,
+			},
+			Tags: map[string]string{
+				provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+			},
 		})
 		require.Error(t, err)
 		var apiError *codersdk.Error
@@ -100,9 +132,9 @@ func TestProvisionerDaemonServe(t *testing.T) {
 		authToken := uuid.NewString()
 		data, err := echo.Tar(&echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionPlan: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionPlan: []*proto.Response{{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
 						Resources: []*proto.Resource{{
 							Name: "example",
 							Type: "aws_instance",
@@ -130,7 +162,7 @@ func TestProvisionerDaemonServe(t *testing.T) {
 			},
 		})
 		require.NoError(t, err)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 		another, _ := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)
 		_ = closer.Close()
@@ -139,6 +171,220 @@ func TestProvisionerDaemonServe(t *testing.T) {
 		})
 		defer closer.Close()
 		workspace := coderdtest.CreateWorkspace(t, another, user.OrganizationID, template.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+	})
+
+	t.Run("PSK", func(t *testing.T) {
+		t.Parallel()
+		client, user := coderdenttest.New(t, &coderdenttest.Options{
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureExternalProvisionerDaemons: 1,
+				},
+			},
+			ProvisionerDaemonPSK: "provisionersftw",
+		})
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+		another := codersdk.New(client.URL)
+		srv, err := another.ServeProvisionerDaemon(ctx, codersdk.ServeProvisionerDaemonRequest{
+			Organization: user.OrganizationID,
+			Provisioners: []codersdk.ProvisionerType{
+				codersdk.ProvisionerTypeEcho,
+			},
+			Tags: map[string]string{
+				provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+			},
+			PreSharedKey: "provisionersftw",
+		})
+		require.NoError(t, err)
+		err = srv.DRPCConn().Close()
+		require.NoError(t, err)
+	})
+
+	t.Run("PSK_daily_cost", func(t *testing.T) {
+		t.Parallel()
+		client, user := coderdenttest.New(t, &coderdenttest.Options{
+			UserWorkspaceQuota: 10,
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureExternalProvisionerDaemons: 1,
+					codersdk.FeatureTemplateRBAC:               1,
+				},
+			},
+			ProvisionerDaemonPSK: "provisionersftw",
+		})
+		logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		terraformClient, terraformServer := provisionersdk.MemTransportPipe()
+		go func() {
+			<-ctx.Done()
+			_ = terraformClient.Close()
+			_ = terraformServer.Close()
+		}()
+
+		tempDir := t.TempDir()
+		errCh := make(chan error)
+		go func() {
+			err := echo.Serve(ctx, &provisionersdk.ServeOptions{
+				Listener:      terraformServer,
+				Logger:        logger.Named("echo"),
+				WorkDirectory: tempDir,
+			})
+			errCh <- err
+		}()
+
+		connector := provisionerd.LocalProvisioners{
+			string(database.ProvisionerTypeEcho): proto.NewDRPCProvisionerClient(terraformClient),
+		}
+		another := codersdk.New(client.URL)
+		pd := provisionerd.New(func(ctx context.Context) (provisionerdproto.DRPCProvisionerDaemonClient, error) {
+			return another.ServeProvisionerDaemon(ctx, codersdk.ServeProvisionerDaemonRequest{
+				Organization: user.OrganizationID,
+				Provisioners: []codersdk.ProvisionerType{
+					codersdk.ProvisionerTypeEcho,
+				},
+				Tags: map[string]string{
+					provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+				},
+				PreSharedKey: "provisionersftw",
+			})
+		}, &provisionerd.Options{
+			Logger:    logger.Named("provisionerd"),
+			Connector: connector,
+		})
+		defer pd.Close()
+
+		// Patch the 'Everyone' group to give the user quota to build their workspace.
+		_, err := client.PatchGroup(ctx, user.OrganizationID, codersdk.PatchGroupRequest{
+			QuotaAllowance: ptr.Ref(1),
+		})
+		require.NoError(t, err)
+
+		authToken := uuid.NewString()
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse: echo.ParseComplete,
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
+						Resources: []*proto.Resource{{
+							Name:      "example",
+							Type:      "aws_instance",
+							DailyCost: 1,
+							Agents: []*proto.Agent{{
+								Id:   uuid.NewString(),
+								Name: "example",
+								Auth: &proto.Agent_Token{
+									Token: authToken,
+								},
+							}},
+						}},
+					},
+				},
+			}},
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+		require.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
+
+		err = pd.Shutdown(ctx)
+		require.NoError(t, err)
+		err = terraformServer.Close()
+		require.NoError(t, err)
+		select {
+		case <-ctx.Done():
+			t.Error("timeout waiting for server to shut down")
+		case err := <-errCh:
+			require.NoError(t, err)
+		}
+	})
+
+	t.Run("BadPSK", func(t *testing.T) {
+		t.Parallel()
+		client, user := coderdenttest.New(t, &coderdenttest.Options{
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureExternalProvisionerDaemons: 1,
+				},
+			},
+			ProvisionerDaemonPSK: "provisionersftw",
+		})
+		another := codersdk.New(client.URL)
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+		_, err := another.ServeProvisionerDaemon(ctx, codersdk.ServeProvisionerDaemonRequest{
+			Organization: user.OrganizationID,
+			Provisioners: []codersdk.ProvisionerType{
+				codersdk.ProvisionerTypeEcho,
+			},
+			Tags: map[string]string{
+				provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+			},
+			PreSharedKey: "the wrong key",
+		})
+		require.Error(t, err)
+		var apiError *codersdk.Error
+		require.ErrorAs(t, err, &apiError)
+		require.Equal(t, http.StatusForbidden, apiError.StatusCode())
+	})
+
+	t.Run("NoAuth", func(t *testing.T) {
+		t.Parallel()
+		client, user := coderdenttest.New(t, &coderdenttest.Options{
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureExternalProvisionerDaemons: 1,
+				},
+			},
+			ProvisionerDaemonPSK: "provisionersftw",
+		})
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+		another := codersdk.New(client.URL)
+		_, err := another.ServeProvisionerDaemon(ctx, codersdk.ServeProvisionerDaemonRequest{
+			Organization: user.OrganizationID,
+			Provisioners: []codersdk.ProvisionerType{
+				codersdk.ProvisionerTypeEcho,
+			},
+			Tags: map[string]string{
+				provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+			},
+		})
+		require.Error(t, err)
+		var apiError *codersdk.Error
+		require.ErrorAs(t, err, &apiError)
+		require.Equal(t, http.StatusForbidden, apiError.StatusCode())
+	})
+
+	t.Run("NoPSK", func(t *testing.T) {
+		t.Parallel()
+		client, user := coderdenttest.New(t, &coderdenttest.Options{
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureExternalProvisionerDaemons: 1,
+				},
+			},
+		})
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+		another := codersdk.New(client.URL)
+		_, err := another.ServeProvisionerDaemon(ctx, codersdk.ServeProvisionerDaemonRequest{
+			Organization: user.OrganizationID,
+			Provisioners: []codersdk.ProvisionerType{
+				codersdk.ProvisionerTypeEcho,
+			},
+			Tags: map[string]string{
+				provisionerdserver.TagScope: provisionerdserver.ScopeOrganization,
+			},
+			PreSharedKey: "provisionersftw",
+		})
+		require.Error(t, err)
+		var apiError *codersdk.Error
+		require.ErrorAs(t, err, &apiError)
+		require.Equal(t, http.StatusForbidden, apiError.StatusCode())
 	})
 }
diff --git a/enterprise/coderd/proxyhealth/proxyhealth.go b/enterprise/coderd/proxyhealth/proxyhealth.go
index d95a44d5a0831..9f3abdac849f2 100644
--- a/enterprise/coderd/proxyhealth/proxyhealth.go
+++ b/enterprise/coderd/proxyhealth/proxyhealth.go
@@ -17,10 +17,10 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/prometheusmetrics"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/prometheusmetrics"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type Status string
@@ -289,7 +289,27 @@ func (p *ProxyHealth) runOnce(ctx context.Context, now time.Time) (map[uuid.UUID
 			case err == nil && resp.StatusCode != http.StatusOK:
 				// Unhealthy as we did reach the proxy but it got an unexpected response.
 				status.Status = Unhealthy
-				status.Report.Errors = []string{fmt.Sprintf("unexpected status code %d", resp.StatusCode)}
+				var builder strings.Builder
+				// This string is shown on the UI where newlines are respected.
+				// This error message is not ever decoded programmatically, so keep it human-
+				// readable.
+				builder.WriteString(fmt.Sprintf("unexpected status code %d. ", resp.StatusCode))
+				builder.WriteString(fmt.Sprintf("\nEncountered error, send a request to %q from the Coderd environment to debug this issue.", reqURL))
+				err := codersdk.ReadBodyAsError(resp)
+				if err != nil {
+					var apiErr *codersdk.Error
+					if xerrors.As(err, &apiErr) {
+						builder.WriteString(fmt.Sprintf("\nError Message: %s\nError Detail: %s", apiErr.Message, apiErr.Detail))
+						for _, v := range apiErr.Validations {
+							// Pretty sure this is not possible from the called endpoint, but just in case.
+							builder.WriteString(fmt.Sprintf("\n\tValidation: %s=%s", v.Field, v.Detail))
+						}
+					} else {
+						builder.WriteString(fmt.Sprintf("\nError: %s", err.Error()))
+					}
+				}
+
+				status.Report.Errors = []string{builder.String()}
 			case err != nil:
 				// Request failed, mark the proxy as unreachable.
 				status.Status = Unreachable
diff --git a/enterprise/coderd/proxyhealth/proxyhealth_test.go b/enterprise/coderd/proxyhealth/proxyhealth_test.go
index 10d8d69dba2ec..6f20c1e48ebef 100644
--- a/enterprise/coderd/proxyhealth/proxyhealth_test.go
+++ b/enterprise/coderd/proxyhealth/proxyhealth_test.go
@@ -11,13 +11,13 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/proxyhealth"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/proxyhealth"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func insertProxy(t *testing.T, db database.Store, url string) database.WorkspaceProxy {
@@ -46,7 +46,7 @@ func TestProxyHealth_Nil(t *testing.T) {
 
 func TestProxyHealth_Unregistered(t *testing.T) {
 	t.Parallel()
-	db := dbfake.New()
+	db := dbmem.New()
 
 	proxies := []database.WorkspaceProxy{
 		insertProxy(t, db, ""),
@@ -72,7 +72,7 @@ func TestProxyHealth_Unregistered(t *testing.T) {
 
 func TestProxyHealth_Unhealthy(t *testing.T) {
 	t.Parallel()
-	db := dbfake.New()
+	db := dbmem.New()
 
 	srvBadReport := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		httpapi.Write(context.Background(), w, http.StatusOK, codersdk.ProxyHealthReport{
@@ -112,7 +112,7 @@ func TestProxyHealth_Unhealthy(t *testing.T) {
 
 func TestProxyHealth_Reachable(t *testing.T) {
 	t.Parallel()
-	db := dbfake.New()
+	db := dbmem.New()
 
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		httpapi.Write(context.Background(), w, http.StatusOK, codersdk.ProxyHealthReport{
@@ -147,7 +147,7 @@ func TestProxyHealth_Reachable(t *testing.T) {
 
 func TestProxyHealth_Unreachable(t *testing.T) {
 	t.Parallel()
-	db := dbfake.New()
+	db := dbmem.New()
 
 	cli := &http.Client{
 		Transport: &http.Transport{
diff --git a/enterprise/coderd/replicas.go b/enterprise/coderd/replicas.go
index 77e0c45aeff2c..536048aaac84a 100644
--- a/enterprise/coderd/replicas.go
+++ b/enterprise/coderd/replicas.go
@@ -3,10 +3,10 @@ package coderd
 import (
 	"net/http"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // replicas returns the number of replicas that are active in Coder.
diff --git a/enterprise/coderd/replicas_test.go b/enterprise/coderd/replicas_test.go
index 7133919c6715b..1081ec81e3d04 100644
--- a/enterprise/coderd/replicas_test.go
+++ b/enterprise/coderd/replicas_test.go
@@ -10,12 +10,12 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestReplicas(t *testing.T) {
diff --git a/enterprise/coderd/schedule/template.go b/enterprise/coderd/schedule/template.go
index 278e315dda3af..26b0c78c6bfc9 100644
--- a/enterprise/coderd/schedule/template.go
+++ b/enterprise/coderd/schedule/template.go
@@ -6,30 +6,55 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	agpl "github.com/coder/coder/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	agpl "github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // EnterpriseTemplateScheduleStore provides an agpl.TemplateScheduleStore that
 // has all fields implemented for enterprise customers.
 type EnterpriseTemplateScheduleStore struct {
-	// UseRestartRequirement decides whether the RestartRequirement field should
-	// be used instead of the MaxTTL field for determining the max deadline of a
-	// workspace build. This value is determined by a feature flag, licensing,
-	// and whether a default user quiet hours schedule is set.
-	UseRestartRequirement atomic.Bool
+	// UseAutostopRequirement decides whether the AutostopRequirement field
+	// should be used instead of the MaxTTL field for determining the max
+	// deadline of a workspace build. This value is determined by a feature
+	// flag, licensing, and whether a default user quiet hours schedule is set.
+	UseAutostopRequirement atomic.Bool
+
+	// UserQuietHoursScheduleStore is used when recalculating build deadlines on
+	// update.
+	UserQuietHoursScheduleStore *atomic.Pointer[agpl.UserQuietHoursScheduleStore]
+
+	// Custom time.Now() function to use in tests. Defaults to dbtime.Now().
+	TimeNowFn func() time.Time
 }
 
 var _ agpl.TemplateScheduleStore = &EnterpriseTemplateScheduleStore{}
 
-func NewEnterpriseTemplateScheduleStore() *EnterpriseTemplateScheduleStore {
-	return &EnterpriseTemplateScheduleStore{}
+func NewEnterpriseTemplateScheduleStore(userQuietHoursStore *atomic.Pointer[agpl.UserQuietHoursScheduleStore]) *EnterpriseTemplateScheduleStore {
+	return &EnterpriseTemplateScheduleStore{
+		UserQuietHoursScheduleStore: userQuietHoursStore,
+	}
+}
+
+func (s *EnterpriseTemplateScheduleStore) now() time.Time {
+	if s.TimeNowFn != nil {
+		return s.TimeNowFn()
+	}
+	return dbtime.Now()
 }
 
 // Get implements agpl.TemplateScheduleStore.
 func (s *EnterpriseTemplateScheduleStore) Get(ctx context.Context, db database.Store, templateID uuid.UUID) (agpl.TemplateScheduleOptions, error) {
+	ctx, span := tracing.StartSpan(ctx)
+	defer span.End()
+
 	tpl, err := db.GetTemplateByID(ctx, templateID)
 	if err != nil {
 		return agpl.TemplateScheduleOptions{}, err
@@ -37,90 +62,143 @@ func (s *EnterpriseTemplateScheduleStore) Get(ctx context.Context, db database.S
 
 	// These extra checks have to be done before the conversion because we lose
 	// precision and signs when converting to the agpl types from the database.
-	if tpl.RestartRequirementDaysOfWeek < 0 {
-		return agpl.TemplateScheduleOptions{}, xerrors.New("invalid restart requirement days, negative")
+	if tpl.AutostopRequirementDaysOfWeek < 0 {
+		return agpl.TemplateScheduleOptions{}, xerrors.New("invalid autostop requirement days, negative")
+	}
+	if tpl.AutostopRequirementDaysOfWeek > 0b11111111 {
+		return agpl.TemplateScheduleOptions{}, xerrors.New("invalid autostop requirement days, too large")
 	}
-	if tpl.RestartRequirementDaysOfWeek > 0b11111111 {
-		return agpl.TemplateScheduleOptions{}, xerrors.New("invalid restart requirement days, too large")
+	if tpl.AutostopRequirementWeeks == 0 {
+		tpl.AutostopRequirementWeeks = 1
 	}
-	err = agpl.VerifyTemplateRestartRequirement(uint8(tpl.RestartRequirementDaysOfWeek), tpl.RestartRequirementWeeks)
+	err = agpl.VerifyTemplateAutostopRequirement(uint8(tpl.AutostopRequirementDaysOfWeek), tpl.AutostopRequirementWeeks)
 	if err != nil {
 		return agpl.TemplateScheduleOptions{}, err
 	}
 
 	return agpl.TemplateScheduleOptions{
-		UserAutostartEnabled:  tpl.AllowUserAutostart,
-		UserAutostopEnabled:   tpl.AllowUserAutostop,
-		DefaultTTL:            time.Duration(tpl.DefaultTTL),
-		MaxTTL:                time.Duration(tpl.MaxTTL),
-		UseRestartRequirement: s.UseRestartRequirement.Load(),
-		RestartRequirement: agpl.TemplateRestartRequirement{
-			DaysOfWeek: uint8(tpl.RestartRequirementDaysOfWeek),
-			Weeks:      tpl.RestartRequirementWeeks,
+		UserAutostartEnabled:   tpl.AllowUserAutostart,
+		UserAutostopEnabled:    tpl.AllowUserAutostop,
+		DefaultTTL:             time.Duration(tpl.DefaultTTL),
+		MaxTTL:                 time.Duration(tpl.MaxTTL),
+		UseAutostopRequirement: s.UseAutostopRequirement.Load(),
+		AutostopRequirement: agpl.TemplateAutostopRequirement{
+			DaysOfWeek: uint8(tpl.AutostopRequirementDaysOfWeek),
+			Weeks:      tpl.AutostopRequirementWeeks,
 		},
-		FailureTTL:    time.Duration(tpl.FailureTTL),
-		InactivityTTL: time.Duration(tpl.InactivityTTL),
-		LockedTTL:     time.Duration(tpl.LockedTTL),
+		AutostartRequirement: agpl.TemplateAutostartRequirement{
+			DaysOfWeek: tpl.AutostartAllowedDays(),
+		},
+		FailureTTL:               time.Duration(tpl.FailureTTL),
+		TimeTilDormant:           time.Duration(tpl.TimeTilDormant),
+		TimeTilDormantAutoDelete: time.Duration(tpl.TimeTilDormantAutoDelete),
 	}, nil
 }
 
 // Set implements agpl.TemplateScheduleStore.
-func (*EnterpriseTemplateScheduleStore) Set(ctx context.Context, db database.Store, tpl database.Template, opts agpl.TemplateScheduleOptions) (database.Template, error) {
+func (s *EnterpriseTemplateScheduleStore) Set(ctx context.Context, db database.Store, tpl database.Template, opts agpl.TemplateScheduleOptions) (database.Template, error) {
+	ctx, span := tracing.StartSpan(ctx)
+	defer span.End()
+
+	if opts.AutostopRequirement.Weeks <= 0 {
+		opts.AutostopRequirement.Weeks = 1
+	}
+	if tpl.AutostopRequirementWeeks <= 0 {
+		tpl.AutostopRequirementWeeks = 1
+	}
+
 	if int64(opts.DefaultTTL) == tpl.DefaultTTL &&
 		int64(opts.MaxTTL) == tpl.MaxTTL &&
-		int16(opts.RestartRequirement.DaysOfWeek) == tpl.RestartRequirementDaysOfWeek &&
-		opts.RestartRequirement.Weeks == tpl.RestartRequirementWeeks &&
+		int16(opts.AutostopRequirement.DaysOfWeek) == tpl.AutostopRequirementDaysOfWeek &&
+		opts.AutostartRequirement.DaysOfWeek == tpl.AutostartAllowedDays() &&
+		opts.AutostopRequirement.Weeks == tpl.AutostopRequirementWeeks &&
 		int64(opts.FailureTTL) == tpl.FailureTTL &&
-		int64(opts.InactivityTTL) == tpl.InactivityTTL &&
-		int64(opts.LockedTTL) == tpl.LockedTTL &&
+		int64(opts.TimeTilDormant) == tpl.TimeTilDormant &&
+		int64(opts.TimeTilDormantAutoDelete) == tpl.TimeTilDormantAutoDelete &&
 		opts.UserAutostartEnabled == tpl.AllowUserAutostart &&
 		opts.UserAutostopEnabled == tpl.AllowUserAutostop {
 		// Avoid updating the UpdatedAt timestamp if nothing will be changed.
 		return tpl, nil
 	}
 
-	err := agpl.VerifyTemplateRestartRequirement(opts.RestartRequirement.DaysOfWeek, opts.RestartRequirement.Weeks)
+	err := agpl.VerifyTemplateAutostopRequirement(opts.AutostopRequirement.DaysOfWeek, opts.AutostopRequirement.Weeks)
 	if err != nil {
-		return database.Template{}, err
+		return database.Template{}, xerrors.Errorf("verify autostop requirement: %w", err)
+	}
+
+	err = agpl.VerifyTemplateAutostartRequirement(opts.AutostartRequirement.DaysOfWeek)
+	if err != nil {
+		return database.Template{}, xerrors.Errorf("verify autostart requirement: %w", err)
 	}
 
 	var template database.Template
-	err = db.InTx(func(db database.Store) error {
-		err := db.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
-			ID:                           tpl.ID,
-			UpdatedAt:                    database.Now(),
-			AllowUserAutostart:           opts.UserAutostartEnabled,
-			AllowUserAutostop:            opts.UserAutostopEnabled,
-			DefaultTTL:                   int64(opts.DefaultTTL),
-			MaxTTL:                       int64(opts.MaxTTL),
-			RestartRequirementDaysOfWeek: int16(opts.RestartRequirement.DaysOfWeek),
-			RestartRequirementWeeks:      opts.RestartRequirement.Weeks,
-			FailureTTL:                   int64(opts.FailureTTL),
-			InactivityTTL:                int64(opts.InactivityTTL),
-			LockedTTL:                    int64(opts.LockedTTL),
+	err = db.InTx(func(tx database.Store) error {
+		ctx, span := tracing.StartSpanWithName(ctx, "(*schedule.EnterpriseTemplateScheduleStore).Set()-InTx()")
+		defer span.End()
+
+		err := tx.UpdateTemplateScheduleByID(ctx, database.UpdateTemplateScheduleByIDParams{
+			ID:                            tpl.ID,
+			UpdatedAt:                     s.now(),
+			AllowUserAutostart:            opts.UserAutostartEnabled,
+			AllowUserAutostop:             opts.UserAutostopEnabled,
+			DefaultTTL:                    int64(opts.DefaultTTL),
+			MaxTTL:                        int64(opts.MaxTTL),
+			AutostopRequirementDaysOfWeek: int16(opts.AutostopRequirement.DaysOfWeek),
+			AutostopRequirementWeeks:      opts.AutostopRequirement.Weeks,
+			// Database stores the inverse of the allowed days of the week.
+			// Make sure the 8th bit is always zeroed out, as there is no 8th day of the week.
+			AutostartBlockDaysOfWeek: int16(^opts.AutostartRequirement.DaysOfWeek & 0b01111111),
+			FailureTTL:               int64(opts.FailureTTL),
+			TimeTilDormant:           int64(opts.TimeTilDormant),
+			TimeTilDormantAutoDelete: int64(opts.TimeTilDormantAutoDelete),
 		})
 		if err != nil {
 			return xerrors.Errorf("update template schedule: %w", err)
 		}
 
-		// If we updated the locked_ttl we need to update all the workspaces deleting_at
+		var dormantAt time.Time
+		if opts.UpdateWorkspaceDormantAt {
+			dormantAt = dbtime.Now()
+		}
+
+		// If we updated the time_til_dormant_autodelete we need to update all the workspaces deleting_at
 		// to ensure workspaces are being cleaned up correctly. Similarly if we are
 		// disabling it (by passing 0), then we want to delete nullify the deleting_at
 		// fields of all the template workspaces.
-		err = db.UpdateWorkspacesDeletingAtByTemplateID(ctx, database.UpdateWorkspacesDeletingAtByTemplateIDParams{
-			TemplateID:  tpl.ID,
-			LockedTtlMs: opts.LockedTTL.Milliseconds(),
+		err = tx.UpdateWorkspacesDormantDeletingAtByTemplateID(ctx, database.UpdateWorkspacesDormantDeletingAtByTemplateIDParams{
+			TemplateID:                 tpl.ID,
+			TimeTilDormantAutodeleteMs: opts.TimeTilDormantAutoDelete.Milliseconds(),
+			DormantAt:                  dormantAt,
 		})
 		if err != nil {
-			return xerrors.Errorf("update deleting_at of all workspaces for new locked_ttl %q: %w", opts.LockedTTL, err)
+			return xerrors.Errorf("update deleting_at of all workspaces for new time_til_dormant_autodelete %q: %w", opts.TimeTilDormantAutoDelete, err)
+		}
+
+		if opts.UpdateWorkspaceLastUsedAt {
+			err = tx.UpdateTemplateWorkspacesLastUsedAt(ctx, database.UpdateTemplateWorkspacesLastUsedAtParams{
+				TemplateID: tpl.ID,
+				LastUsedAt: dbtime.Now(),
+			})
+			if err != nil {
+				return xerrors.Errorf("update template workspaces last_used_at: %w", err)
+			}
 		}
 
 		// TODO: update all workspace max_deadlines to be within new bounds
-		template, err = db.GetTemplateByID(ctx, tpl.ID)
+		template, err = tx.GetTemplateByID(ctx, tpl.ID)
 		if err != nil {
 			return xerrors.Errorf("get updated template schedule: %w", err)
 		}
 
+		// Recalculate max_deadline and deadline for all running workspace
+		// builds on this template.
+		if s.UseAutostopRequirement.Load() {
+			err = s.updateWorkspaceBuilds(ctx, tx, template)
+			if err != nil {
+				return xerrors.Errorf("update workspace builds: %w", err)
+			}
+		}
+
 		return nil
 	}, nil)
 	if err != nil {
@@ -129,3 +207,98 @@ func (*EnterpriseTemplateScheduleStore) Set(ctx context.Context, db database.Sto
 
 	return template, nil
 }
+
+func (s *EnterpriseTemplateScheduleStore) updateWorkspaceBuilds(ctx context.Context, db database.Store, template database.Template) error {
+	ctx, span := tracing.StartSpan(ctx)
+	defer span.End()
+
+	//nolint:gocritic // This function will retrieve all workspace builds on
+	// the template and update their max deadline to be within the new
+	// policy parameters.
+	ctx = dbauthz.AsSystemRestricted(ctx)
+
+	builds, err := db.GetActiveWorkspaceBuildsByTemplateID(ctx, template.ID)
+	if err != nil {
+		return xerrors.Errorf("get active workspace builds: %w", err)
+	}
+
+	for _, build := range builds {
+		err := s.updateWorkspaceBuild(ctx, db, build)
+		if err != nil {
+			return xerrors.Errorf("update workspace build %q: %w", build.ID, err)
+		}
+	}
+
+	return nil
+}
+
+func (s *EnterpriseTemplateScheduleStore) updateWorkspaceBuild(ctx context.Context, db database.Store, build database.WorkspaceBuild) error {
+	ctx, span := tracing.StartSpan(ctx,
+		trace.WithAttributes(attribute.String("coder.workspace_id", build.WorkspaceID.String())),
+		trace.WithAttributes(attribute.String("coder.workspace_build_id", build.ID.String())),
+	)
+	defer span.End()
+
+	if !build.MaxDeadline.IsZero() && build.MaxDeadline.Before(s.now().Add(2*time.Hour)) {
+		// Skip this since it's already too close to the max_deadline.
+		return nil
+	}
+
+	workspace, err := db.GetWorkspaceByID(ctx, build.WorkspaceID)
+	if err != nil {
+		return xerrors.Errorf("get workspace %q: %w", build.WorkspaceID, err)
+	}
+
+	job, err := db.GetProvisionerJobByID(ctx, build.JobID)
+	if err != nil {
+		return xerrors.Errorf("get provisioner job %q: %w", build.JobID, err)
+	}
+	if codersdk.ProvisionerJobStatus(job.JobStatus) != codersdk.ProvisionerJobSucceeded {
+		// Only touch builds that are completed.
+		return nil
+	}
+
+	// If the job completed before the autostop epoch, then it must be skipped
+	// to avoid failures below. Add a week to account for timezones.
+	if job.CompletedAt.Time.Before(agpl.TemplateAutostopRequirementEpoch(time.UTC).Add(time.Hour * 7 * 24)) {
+		return nil
+	}
+
+	autostop, err := agpl.CalculateAutostop(ctx, agpl.CalculateAutostopParams{
+		Database:                    db,
+		TemplateScheduleStore:       s,
+		UserQuietHoursScheduleStore: *s.UserQuietHoursScheduleStore.Load(),
+		// Use the job completion time as the time we calculate autostop from.
+		Now:       job.CompletedAt.Time,
+		Workspace: workspace,
+	})
+	if err != nil {
+		return xerrors.Errorf("calculate new autostop for workspace %q: %w", workspace.ID, err)
+	}
+
+	// If max deadline is before now()+2h, then set it to that.
+	now := s.now()
+	if autostop.MaxDeadline.Before(now.Add(2 * time.Hour)) {
+		autostop.MaxDeadline = now.Add(time.Hour * 2)
+	}
+
+	// If the current deadline on the build is after the new max_deadline, then
+	// set it to the max_deadline.
+	autostop.Deadline = build.Deadline
+	if autostop.Deadline.After(autostop.MaxDeadline) {
+		autostop.Deadline = autostop.MaxDeadline
+	}
+
+	// Update the workspace build deadline.
+	err = db.UpdateWorkspaceBuildDeadlineByID(ctx, database.UpdateWorkspaceBuildDeadlineByIDParams{
+		ID:          build.ID,
+		UpdatedAt:   now,
+		Deadline:    autostop.Deadline,
+		MaxDeadline: autostop.MaxDeadline,
+	})
+	if err != nil {
+		return xerrors.Errorf("update workspace build %q: %w", build.ID, err)
+	}
+
+	return nil
+}
diff --git a/enterprise/coderd/schedule/template_test.go b/enterprise/coderd/schedule/template_test.go
new file mode 100644
index 0000000000000..1fdbd6ba241dd
--- /dev/null
+++ b/enterprise/coderd/schedule/template_test.go
@@ -0,0 +1,545 @@
+package schedule_test
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	agplschedule "github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/enterprise/coderd/schedule"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestTemplateUpdateBuildDeadlines(t *testing.T) {
+	t.Parallel()
+
+	db, _ := dbtestutil.NewDB(t)
+
+	var (
+		org  = dbgen.Organization(t, db, database.Organization{})
+		user = dbgen.User(t, db, database.User{})
+		file = dbgen.File(t, db, database.File{
+			CreatedBy: user.ID,
+		})
+		templateJob = dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
+			OrganizationID: org.ID,
+			FileID:         file.ID,
+			InitiatorID:    user.ID,
+			Tags: database.StringMap{
+				"foo": "bar",
+			},
+		})
+		templateVersion = dbgen.TemplateVersion(t, db, database.TemplateVersion{
+			OrganizationID: org.ID,
+			CreatedBy:      user.ID,
+			JobID:          templateJob.ID,
+		})
+	)
+
+	const userQuietHoursSchedule = "CRON_TZ=UTC 0 0 * * *" // midnight UTC
+	ctx := testutil.Context(t, testutil.WaitLong)
+	user, err := db.UpdateUserQuietHoursSchedule(ctx, database.UpdateUserQuietHoursScheduleParams{
+		ID:                 user.ID,
+		QuietHoursSchedule: userQuietHoursSchedule,
+	})
+	require.NoError(t, err)
+
+	realNow := time.Now().UTC()
+	nowY, nowM, nowD := realNow.Date()
+	buildTime := time.Date(nowY, nowM, nowD, 12, 0, 0, 0, time.UTC)       // noon today UTC
+	nextQuietHours := time.Date(nowY, nowM, nowD+1, 0, 0, 0, 0, time.UTC) // midnight tomorrow UTC
+
+	// Workspace old max_deadline too soon
+	cases := []struct {
+		name           string
+		now            time.Time
+		deadline       time.Time
+		maxDeadline    time.Time
+		newDeadline    time.Time // 0 for no change
+		newMaxDeadline time.Time
+	}{
+		{
+			name:        "SkippedWorkspaceMaxDeadlineTooSoon",
+			now:         buildTime,
+			deadline:    buildTime,
+			maxDeadline: buildTime.Add(1 * time.Hour),
+			// Unchanged since the max deadline is too soon.
+			newDeadline:    time.Time{},
+			newMaxDeadline: buildTime.Add(1 * time.Hour),
+		},
+		{
+			name: "NewWorkspaceMaxDeadlineBeforeNow",
+			// After the new max deadline...
+			now:      nextQuietHours.Add(6 * time.Hour),
+			deadline: buildTime,
+			// Far into the future...
+			maxDeadline: nextQuietHours.Add(24 * time.Hour),
+			newDeadline: time.Time{},
+			// We will use now() + 2 hours if the newly calculated max deadline
+			// from the workspace build time is before now.
+			newMaxDeadline: nextQuietHours.Add(8 * time.Hour),
+		},
+		{
+			name: "NewWorkspaceMaxDeadlineSoon",
+			// Right before the new max deadline...
+			now:      nextQuietHours.Add(-1 * time.Hour),
+			deadline: buildTime,
+			// Far into the future...
+			maxDeadline: nextQuietHours.Add(24 * time.Hour),
+			newDeadline: time.Time{},
+			// We will use now() + 2 hours if the newly calculated max deadline
+			// from the workspace build time is within the next 2 hours.
+			newMaxDeadline: nextQuietHours.Add(1 * time.Hour),
+		},
+		{
+			name: "NewWorkspaceMaxDeadlineFuture",
+			// Well before the new max deadline...
+			now:      nextQuietHours.Add(-6 * time.Hour),
+			deadline: buildTime,
+			// Far into the future...
+			maxDeadline:    nextQuietHours.Add(24 * time.Hour),
+			newDeadline:    time.Time{},
+			newMaxDeadline: nextQuietHours,
+		},
+		{
+			name: "DeadlineAfterNewWorkspaceMaxDeadline",
+			// Well before the new max deadline...
+			now: nextQuietHours.Add(-6 * time.Hour),
+			// Far into the future...
+			deadline:    nextQuietHours.Add(24 * time.Hour),
+			maxDeadline: nextQuietHours.Add(24 * time.Hour),
+			// The deadline should match since it is after the new max deadline.
+			newDeadline:    nextQuietHours,
+			newMaxDeadline: nextQuietHours,
+		},
+	}
+
+	for _, c := range cases {
+		c := c
+
+		t.Run(c.name, func(t *testing.T) {
+			t.Parallel()
+
+			t.Log("buildTime", buildTime)
+			t.Log("nextQuietHours", nextQuietHours)
+			t.Log("now", c.now)
+			t.Log("deadline", c.deadline)
+			t.Log("maxDeadline", c.maxDeadline)
+			t.Log("newDeadline", c.newDeadline)
+			t.Log("newMaxDeadline", c.newMaxDeadline)
+
+			var (
+				template = dbgen.Template(t, db, database.Template{
+					OrganizationID:  org.ID,
+					ActiveVersionID: templateVersion.ID,
+					CreatedBy:       user.ID,
+				})
+				ws = dbgen.Workspace(t, db, database.Workspace{
+					OrganizationID: org.ID,
+					OwnerID:        user.ID,
+					TemplateID:     template.ID,
+				})
+				job = dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
+					OrganizationID: org.ID,
+					FileID:         file.ID,
+					InitiatorID:    user.ID,
+					Provisioner:    database.ProvisionerTypeEcho,
+					Tags: database.StringMap{
+						c.name: "yeah",
+					},
+				})
+				wsBuild = dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
+					WorkspaceID:       ws.ID,
+					BuildNumber:       1,
+					JobID:             job.ID,
+					InitiatorID:       user.ID,
+					TemplateVersionID: templateVersion.ID,
+					ProvisionerState:  []byte(must(cryptorand.String(64))),
+				})
+			)
+
+			// Assert test invariant: workspace build state must not be empty
+			require.NotEmpty(t, wsBuild.ProvisionerState, "provisioner state must not be empty")
+
+			acquiredJob, err := db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+				StartedAt: sql.NullTime{
+					Time:  buildTime,
+					Valid: true,
+				},
+				WorkerID: uuid.NullUUID{
+					UUID:  uuid.New(),
+					Valid: true,
+				},
+				Types: []database.ProvisionerType{database.ProvisionerTypeEcho},
+				Tags:  json.RawMessage(fmt.Sprintf(`{%q: "yeah"}`, c.name)),
+			})
+			require.NoError(t, err)
+			require.Equal(t, job.ID, acquiredJob.ID)
+			err = db.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
+				ID: job.ID,
+				CompletedAt: sql.NullTime{
+					Time:  buildTime,
+					Valid: true,
+				},
+				UpdatedAt: buildTime,
+			})
+			require.NoError(t, err)
+
+			err = db.UpdateWorkspaceBuildDeadlineByID(ctx, database.UpdateWorkspaceBuildDeadlineByIDParams{
+				ID:          wsBuild.ID,
+				UpdatedAt:   buildTime,
+				Deadline:    c.deadline,
+				MaxDeadline: c.maxDeadline,
+			})
+			require.NoError(t, err)
+
+			wsBuild, err = db.GetWorkspaceBuildByID(ctx, wsBuild.ID)
+			require.NoError(t, err)
+
+			userQuietHoursStore, err := schedule.NewEnterpriseUserQuietHoursScheduleStore(userQuietHoursSchedule)
+			require.NoError(t, err)
+			userQuietHoursStorePtr := &atomic.Pointer[agplschedule.UserQuietHoursScheduleStore]{}
+			userQuietHoursStorePtr.Store(&userQuietHoursStore)
+
+			// Set the template policy.
+			templateScheduleStore := schedule.NewEnterpriseTemplateScheduleStore(userQuietHoursStorePtr)
+			templateScheduleStore.UseAutostopRequirement.Store(true)
+			templateScheduleStore.TimeNowFn = func() time.Time {
+				return c.now
+			}
+			_, err = templateScheduleStore.Set(ctx, db, template, agplschedule.TemplateScheduleOptions{
+				UserAutostartEnabled:   false,
+				UserAutostopEnabled:    false,
+				DefaultTTL:             0,
+				MaxTTL:                 0,
+				UseAutostopRequirement: true,
+				AutostopRequirement: agplschedule.TemplateAutostopRequirement{
+					// Every day
+					DaysOfWeek: 0b01111111,
+					Weeks:      0,
+				},
+				FailureTTL:               0,
+				TimeTilDormant:           0,
+				TimeTilDormantAutoDelete: 0,
+			})
+			require.NoError(t, err)
+
+			// Check that the workspace build has the expected deadlines.
+			newBuild, err := db.GetWorkspaceBuildByID(ctx, wsBuild.ID)
+			require.NoError(t, err)
+
+			if c.newDeadline.IsZero() {
+				c.newDeadline = wsBuild.Deadline
+			}
+			require.WithinDuration(t, c.newDeadline, newBuild.Deadline, time.Second)
+			require.WithinDuration(t, c.newMaxDeadline, newBuild.MaxDeadline, time.Second)
+
+			// Check that the new build has the same state as before.
+			require.Equal(t, wsBuild.ProvisionerState, newBuild.ProvisionerState, "provisioner state mismatch")
+		})
+	}
+}
+
+func TestTemplateUpdateBuildDeadlinesSkip(t *testing.T) {
+	t.Parallel()
+
+	db, _ := dbtestutil.NewDB(t)
+
+	var (
+		org  = dbgen.Organization(t, db, database.Organization{})
+		user = dbgen.User(t, db, database.User{})
+		file = dbgen.File(t, db, database.File{
+			CreatedBy: user.ID,
+		})
+		templateJob = dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
+			OrganizationID: org.ID,
+			FileID:         file.ID,
+			InitiatorID:    user.ID,
+			Tags: database.StringMap{
+				"foo": "bar",
+			},
+		})
+		templateVersion = dbgen.TemplateVersion(t, db, database.TemplateVersion{
+			OrganizationID: org.ID,
+			CreatedBy:      user.ID,
+			JobID:          templateJob.ID,
+		})
+		template = dbgen.Template(t, db, database.Template{
+			OrganizationID:  org.ID,
+			ActiveVersionID: templateVersion.ID,
+			CreatedBy:       user.ID,
+		})
+		otherTemplate = dbgen.Template(t, db, database.Template{
+			OrganizationID:  org.ID,
+			ActiveVersionID: templateVersion.ID,
+			CreatedBy:       user.ID,
+		})
+	)
+
+	// Create a workspace that will be shared by two builds.
+	ws := dbgen.Workspace(t, db, database.Workspace{
+		OrganizationID: org.ID,
+		OwnerID:        user.ID,
+		TemplateID:     template.ID,
+	})
+
+	const userQuietHoursSchedule = "CRON_TZ=UTC 0 0 * * *" // midnight UTC
+	ctx := testutil.Context(t, testutil.WaitLong)
+	user, err := db.UpdateUserQuietHoursSchedule(ctx, database.UpdateUserQuietHoursScheduleParams{
+		ID:                 user.ID,
+		QuietHoursSchedule: userQuietHoursSchedule,
+	})
+	require.NoError(t, err)
+
+	realNow := time.Now().UTC()
+	nowY, nowM, nowD := realNow.Date()
+	buildTime := time.Date(nowY, nowM, nowD, 12, 0, 0, 0, time.UTC)       // noon today UTC
+	now := time.Date(nowY, nowM, nowD, 18, 0, 0, 0, time.UTC)             // 6pm today UTC
+	nextQuietHours := time.Date(nowY, nowM, nowD+1, 0, 0, 0, 0, time.UTC) // midnight tomorrow UTC
+
+	// A date very far in the future which would definitely be updated.
+	originalMaxDeadline := time.Date(nowY+1, nowM, nowD, 0, 0, 0, 0, time.UTC)
+
+	_ = otherTemplate
+
+	builds := []struct {
+		name       string
+		templateID uuid.UUID
+		// Nil workspaceID means create a new workspace.
+		workspaceID    uuid.UUID
+		buildNumber    int32
+		buildStarted   bool
+		buildCompleted bool
+		buildError     bool
+
+		shouldBeUpdated bool
+
+		// Set below:
+		wsBuild database.WorkspaceBuild
+	}{
+		{
+			name:            "DifferentTemplate",
+			templateID:      otherTemplate.ID,
+			workspaceID:     uuid.Nil,
+			buildNumber:     1,
+			buildStarted:    true,
+			buildCompleted:  true,
+			buildError:      false,
+			shouldBeUpdated: false,
+		},
+		{
+			name:            "NonStartedBuild",
+			templateID:      template.ID,
+			workspaceID:     uuid.Nil,
+			buildNumber:     1,
+			buildStarted:    false,
+			buildCompleted:  false,
+			buildError:      false,
+			shouldBeUpdated: false,
+		},
+		{
+			name:            "InProgressBuild",
+			templateID:      template.ID,
+			workspaceID:     uuid.Nil,
+			buildNumber:     1,
+			buildStarted:    true,
+			buildCompleted:  false,
+			buildError:      false,
+			shouldBeUpdated: false,
+		},
+		{
+			name:            "FailedBuild",
+			templateID:      template.ID,
+			workspaceID:     uuid.Nil,
+			buildNumber:     1,
+			buildStarted:    true,
+			buildCompleted:  true,
+			buildError:      true,
+			shouldBeUpdated: false,
+		},
+		{
+			name:           "NonLatestBuild",
+			templateID:     template.ID,
+			workspaceID:    ws.ID,
+			buildNumber:    1,
+			buildStarted:   true,
+			buildCompleted: true,
+			buildError:     false,
+			// This build was successful but is not the latest build for this
+			// workspace, see the next build.
+			shouldBeUpdated: false,
+		},
+		{
+			name:            "LatestBuild",
+			templateID:      template.ID,
+			workspaceID:     ws.ID,
+			buildNumber:     2,
+			buildStarted:    true,
+			buildCompleted:  true,
+			buildError:      false,
+			shouldBeUpdated: true,
+		},
+		{
+			name:            "LatestBuildOtherWorkspace",
+			templateID:      template.ID,
+			workspaceID:     uuid.Nil,
+			buildNumber:     1,
+			buildStarted:    true,
+			buildCompleted:  true,
+			buildError:      false,
+			shouldBeUpdated: true,
+		},
+	}
+
+	for i, b := range builds {
+		wsID := b.workspaceID
+		if wsID == uuid.Nil {
+			ws := dbgen.Workspace(t, db, database.Workspace{
+				OrganizationID: org.ID,
+				OwnerID:        user.ID,
+				TemplateID:     b.templateID,
+			})
+			wsID = ws.ID
+		}
+		job := dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
+			OrganizationID: org.ID,
+			FileID:         file.ID,
+			InitiatorID:    user.ID,
+			Provisioner:    database.ProvisionerTypeEcho,
+			Tags: database.StringMap{
+				wsID.String(): "yeah",
+			},
+		})
+		wsBuild := dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
+			WorkspaceID:       wsID,
+			BuildNumber:       b.buildNumber,
+			JobID:             job.ID,
+			InitiatorID:       user.ID,
+			TemplateVersionID: templateVersion.ID,
+			ProvisionerState:  []byte(must(cryptorand.String(64))),
+		})
+
+		// Assert test invariant: workspace build state must not be empty
+		require.NotEmpty(t, wsBuild.ProvisionerState, "provisioner state must not be empty")
+
+		err := db.UpdateWorkspaceBuildDeadlineByID(ctx, database.UpdateWorkspaceBuildDeadlineByIDParams{
+			ID:          wsBuild.ID,
+			UpdatedAt:   buildTime,
+			Deadline:    originalMaxDeadline,
+			MaxDeadline: originalMaxDeadline,
+		})
+		require.NoError(t, err)
+
+		wsBuild, err = db.GetWorkspaceBuildByID(ctx, wsBuild.ID)
+		require.NoError(t, err)
+
+		// Assert test invariant: workspace build state must not be empty
+		require.NotEmpty(t, wsBuild.ProvisionerState, "provisioner state must not be empty")
+
+		builds[i].wsBuild = wsBuild
+
+		if !b.buildStarted {
+			continue
+		}
+
+		acquiredJob, err := db.AcquireProvisionerJob(ctx, database.AcquireProvisionerJobParams{
+			StartedAt: sql.NullTime{
+				Time:  buildTime,
+				Valid: true,
+			},
+			WorkerID: uuid.NullUUID{
+				UUID:  uuid.New(),
+				Valid: true,
+			},
+			Types: []database.ProvisionerType{database.ProvisionerTypeEcho},
+			Tags:  json.RawMessage(fmt.Sprintf(`{%q: "yeah"}`, wsID)),
+		})
+		require.NoError(t, err)
+		require.Equal(t, job.ID, acquiredJob.ID)
+
+		if !b.buildCompleted {
+			continue
+		}
+
+		buildError := ""
+		if b.buildError {
+			buildError = "error"
+		}
+		err = db.UpdateProvisionerJobWithCompleteByID(ctx, database.UpdateProvisionerJobWithCompleteByIDParams{
+			ID: job.ID,
+			CompletedAt: sql.NullTime{
+				Time:  buildTime,
+				Valid: true,
+			},
+			Error: sql.NullString{
+				String: buildError,
+				Valid:  b.buildError,
+			},
+			UpdatedAt: buildTime,
+		})
+		require.NoError(t, err)
+	}
+
+	userQuietHoursStore, err := schedule.NewEnterpriseUserQuietHoursScheduleStore(userQuietHoursSchedule)
+	require.NoError(t, err)
+	userQuietHoursStorePtr := &atomic.Pointer[agplschedule.UserQuietHoursScheduleStore]{}
+	userQuietHoursStorePtr.Store(&userQuietHoursStore)
+
+	// Set the template policy.
+	templateScheduleStore := schedule.NewEnterpriseTemplateScheduleStore(userQuietHoursStorePtr)
+	templateScheduleStore.UseAutostopRequirement.Store(true)
+	templateScheduleStore.TimeNowFn = func() time.Time {
+		return now
+	}
+	_, err = templateScheduleStore.Set(ctx, db, template, agplschedule.TemplateScheduleOptions{
+		UserAutostartEnabled:   false,
+		UserAutostopEnabled:    false,
+		DefaultTTL:             0,
+		MaxTTL:                 0,
+		UseAutostopRequirement: true,
+		AutostopRequirement: agplschedule.TemplateAutostopRequirement{
+			// Every day
+			DaysOfWeek: 0b01111111,
+			Weeks:      0,
+		},
+		FailureTTL:               0,
+		TimeTilDormant:           0,
+		TimeTilDormantAutoDelete: 0,
+	})
+	require.NoError(t, err)
+
+	// Check each build.
+	for i, b := range builds {
+		msg := fmt.Sprintf("build %d: %s", i, b.name)
+		newBuild, err := db.GetWorkspaceBuildByID(ctx, b.wsBuild.ID)
+		require.NoError(t, err)
+
+		if b.shouldBeUpdated {
+			assert.WithinDuration(t, nextQuietHours, newBuild.Deadline, time.Second, msg)
+			assert.WithinDuration(t, nextQuietHours, newBuild.MaxDeadline, time.Second, msg)
+		} else {
+			assert.WithinDuration(t, originalMaxDeadline, newBuild.Deadline, time.Second, msg)
+			assert.WithinDuration(t, originalMaxDeadline, newBuild.MaxDeadline, time.Second, msg)
+		}
+
+		assert.Equal(t, builds[i].wsBuild.ProvisionerState, newBuild.ProvisionerState, "provisioner state mismatch")
+	}
+}
+
+func must[V any](v V, err error) V {
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
diff --git a/enterprise/coderd/schedule/user.go b/enterprise/coderd/schedule/user.go
index c7d76f86119c8..49c2b61b30e99 100644
--- a/enterprise/coderd/schedule/user.go
+++ b/enterprise/coderd/schedule/user.go
@@ -7,8 +7,10 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/database"
-	agpl "github.com/coder/coder/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/database"
+	agpl "github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 // enterpriseUserQuietHoursScheduleStore provides an
@@ -29,7 +31,8 @@ func NewEnterpriseUserQuietHoursScheduleStore(defaultSchedule string) (agpl.User
 		defaultSchedule: defaultSchedule,
 	}
 
-	_, err := s.parseSchedule(defaultSchedule)
+	// The context is only used for tracing so using a background ctx is fine.
+	_, err := s.parseSchedule(context.Background(), defaultSchedule)
 	if err != nil {
 		return nil, xerrors.Errorf("parse default schedule: %w", err)
 	}
@@ -37,14 +40,17 @@ func NewEnterpriseUserQuietHoursScheduleStore(defaultSchedule string) (agpl.User
 	return s, nil
 }
 
-func (s *enterpriseUserQuietHoursScheduleStore) parseSchedule(rawSchedule string) (agpl.UserQuietHoursScheduleOptions, error) {
+func (s *enterpriseUserQuietHoursScheduleStore) parseSchedule(ctx context.Context, rawSchedule string) (agpl.UserQuietHoursScheduleOptions, error) {
+	_, span := tracing.StartSpan(ctx)
+	defer span.End()
+
 	userSet := true
 	if strings.TrimSpace(rawSchedule) == "" {
 		userSet = false
 		rawSchedule = s.defaultSchedule
 	}
 
-	sched, err := agpl.Daily(rawSchedule)
+	sched, err := cron.Daily(rawSchedule)
 	if err != nil {
 		// This shouldn't get hit during Gets, only Sets.
 		return agpl.UserQuietHoursScheduleOptions{}, xerrors.Errorf("parse daily schedule %q: %w", rawSchedule, err)
@@ -64,16 +70,22 @@ func (s *enterpriseUserQuietHoursScheduleStore) parseSchedule(rawSchedule string
 }
 
 func (s *enterpriseUserQuietHoursScheduleStore) Get(ctx context.Context, db database.Store, userID uuid.UUID) (agpl.UserQuietHoursScheduleOptions, error) {
+	ctx, span := tracing.StartSpan(ctx)
+	defer span.End()
+
 	user, err := db.GetUserByID(ctx, userID)
 	if err != nil {
 		return agpl.UserQuietHoursScheduleOptions{}, xerrors.Errorf("get user by ID: %w", err)
 	}
 
-	return s.parseSchedule(user.QuietHoursSchedule)
+	return s.parseSchedule(ctx, user.QuietHoursSchedule)
 }
 
 func (s *enterpriseUserQuietHoursScheduleStore) Set(ctx context.Context, db database.Store, userID uuid.UUID, rawSchedule string) (agpl.UserQuietHoursScheduleOptions, error) {
-	opts, err := s.parseSchedule(rawSchedule)
+	ctx, span := tracing.StartSpan(ctx)
+	defer span.End()
+
+	opts, err := s.parseSchedule(ctx, rawSchedule)
 	if err != nil {
 		return opts, err
 	}
@@ -91,8 +103,12 @@ func (s *enterpriseUserQuietHoursScheduleStore) Set(ctx context.Context, db data
 		return agpl.UserQuietHoursScheduleOptions{}, xerrors.Errorf("update user quiet hours schedule: %w", err)
 	}
 
-	// TODO(@dean): update max_deadline for all active builds for this user to clamp to
-	// the new schedule.
+	// We don't update workspace build deadlines when the user changes their own
+	// quiet hours schedule, because they could potentially keep their workspace
+	// running forever.
+	//
+	// Workspace build deadlines are updated when the template admin changes the
+	// template's settings however.
 
 	return opts, nil
 }
diff --git a/enterprise/coderd/scim.go b/enterprise/coderd/scim.go
index efba55b932684..9eda42da59a72 100644
--- a/enterprise/coderd/scim.go
+++ b/enterprise/coderd/scim.go
@@ -14,11 +14,12 @@ import (
 	"github.com/imulab/go-scim/pkg/v2/spec"
 	"golang.org/x/xerrors"
 
-	agpl "github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	agpl "github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (api *API) scimEnabledMW(next http.Handler) http.Handler {
@@ -155,7 +156,7 @@ func (api *API) scimPostUser(rw http.ResponseWriter, r *http.Request) {
 	}
 
 	//nolint:gocritic
-	user, err := api.Database.GetUserByEmailOrUsername(dbauthz.AsSystemRestricted(ctx), database.GetUserByEmailOrUsernameParams{
+	dbUser, err := api.Database.GetUserByEmailOrUsername(dbauthz.AsSystemRestricted(ctx), database.GetUserByEmailOrUsernameParams{
 		Email:    email,
 		Username: sUser.UserName,
 	})
@@ -164,8 +165,22 @@ func (api *API) scimPostUser(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if err == nil {
-		sUser.ID = user.ID.String()
-		sUser.UserName = user.Username
+		sUser.ID = dbUser.ID.String()
+		sUser.UserName = dbUser.Username
+
+		if sUser.Active && dbUser.Status == database.UserStatusSuspended {
+			//nolint:gocritic
+			_, err = api.Database.UpdateUserStatus(dbauthz.AsSystemRestricted(r.Context()), database.UpdateUserStatusParams{
+				ID: dbUser.ID,
+				// The user will get transitioned to Active after logging in.
+				Status:    database.UserStatusDormant,
+				UpdatedAt: dbtime.Now(),
+			})
+			if err != nil {
+				_ = handlerutil.WriteError(rw, err)
+				return
+			}
+		}
 
 		httpapi.Write(ctx, rw, http.StatusOK, sUser)
 		return
@@ -201,7 +216,7 @@ func (api *API) scimPostUser(rw http.ResponseWriter, r *http.Request) {
 	}
 
 	//nolint:gocritic // needed for SCIM
-	user, _, err = api.AGPL.CreateUser(dbauthz.AsSystemRestricted(ctx), api.Database, agpl.CreateUserRequest{
+	dbUser, _, err = api.AGPL.CreateUser(dbauthz.AsSystemRestricted(ctx), api.Database, agpl.CreateUserRequest{
 		CreateUserRequest: codersdk.CreateUserRequest{
 			Username:       sUser.UserName,
 			Email:          email,
@@ -214,8 +229,8 @@ func (api *API) scimPostUser(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	sUser.ID = user.ID.String()
-	sUser.UserName = user.Username
+	sUser.ID = dbUser.ID.String()
+	sUser.UserName = dbUser.Username
 
 	httpapi.Write(ctx, rw, http.StatusOK, sUser)
 }
@@ -263,7 +278,8 @@ func (api *API) scimPatchUser(rw http.ResponseWriter, r *http.Request) {
 
 	var status database.UserStatus
 	if sUser.Active {
-		status = database.UserStatusActive
+		// The user will get transitioned to Active after logging in.
+		status = database.UserStatusDormant
 	} else {
 		status = database.UserStatusSuspended
 	}
@@ -272,7 +288,7 @@ func (api *API) scimPatchUser(rw http.ResponseWriter, r *http.Request) {
 	_, err = api.Database.UpdateUserStatus(dbauthz.AsSystemRestricted(r.Context()), database.UpdateUserStatusParams{
 		ID:        dbUser.ID,
 		Status:    status,
-		UpdatedAt: database.Now(),
+		UpdatedAt: dbtime.Now(),
 	})
 	if err != nil {
 		_ = handlerutil.WriteError(rw, err)
diff --git a/enterprise/coderd/scim_test.go b/enterprise/coderd/scim_test.go
index f0778c26b51d0..3d12c3402ac41 100644
--- a/enterprise/coderd/scim_test.go
+++ b/enterprise/coderd/scim_test.go
@@ -4,18 +4,19 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/enterprise/coderd"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/enterprise/coderd"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
 )
 
 //nolint:revive
@@ -164,6 +165,54 @@ func TestScim(t *testing.T) {
 			assert.Equal(t, sUser.UserName, userRes.Users[0].Username)
 		})
 
+		t.Run("Unsuspend", func(t *testing.T) {
+			t.Parallel()
+
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+			defer cancel()
+
+			scimAPIKey := []byte("hi")
+			client, _ := coderdenttest.New(t, &coderdenttest.Options{
+				SCIMAPIKey: scimAPIKey,
+				LicenseOptions: &coderdenttest.LicenseOptions{
+					AccountID: "coolin",
+					Features: license.Features{
+						codersdk.FeatureSCIM: 1,
+					},
+				},
+			})
+
+			sUser := makeScimUser(t)
+			res, err := client.Request(ctx, "POST", "/scim/v2/Users", sUser, setScimAuth(scimAPIKey))
+			require.NoError(t, err)
+			defer res.Body.Close()
+			assert.Equal(t, http.StatusOK, res.StatusCode)
+			err = json.NewDecoder(res.Body).Decode(&sUser)
+			require.NoError(t, err)
+
+			sUser.Active = false
+			res, err = client.Request(ctx, "PATCH", "/scim/v2/Users/"+sUser.ID, sUser, setScimAuth(scimAPIKey))
+			require.NoError(t, err)
+			_, _ = io.Copy(io.Discard, res.Body)
+			_ = res.Body.Close()
+			assert.Equal(t, http.StatusOK, res.StatusCode)
+
+			sUser.Active = true
+			res, err = client.Request(ctx, "POST", "/scim/v2/Users", sUser, setScimAuth(scimAPIKey))
+			require.NoError(t, err)
+			_, _ = io.Copy(io.Discard, res.Body)
+			_ = res.Body.Close()
+			assert.Equal(t, http.StatusOK, res.StatusCode)
+
+			userRes, err := client.Users(ctx, codersdk.UsersRequest{Search: sUser.Emails[0].Value})
+			require.NoError(t, err)
+			require.Len(t, userRes.Users, 1)
+
+			assert.Equal(t, sUser.Emails[0].Value, userRes.Users[0].Email)
+			assert.Equal(t, sUser.UserName, userRes.Users[0].Username)
+			assert.Equal(t, codersdk.UserStatusDormant, userRes.Users[0].Status)
+		})
+
 		t.Run("DomainStrips", func(t *testing.T) {
 			t.Parallel()
 
@@ -185,7 +234,8 @@ func TestScim(t *testing.T) {
 			sUser.UserName = sUser.UserName + "@coder.com"
 			res, err := client.Request(ctx, "POST", "/scim/v2/Users", sUser, setScimAuth(scimAPIKey))
 			require.NoError(t, err)
-			defer res.Body.Close()
+			_, _ = io.Copy(io.Discard, res.Body)
+			_ = res.Body.Close()
 			assert.Equal(t, http.StatusOK, res.StatusCode)
 
 			userRes, err := client.Users(ctx, codersdk.UsersRequest{Search: sUser.Emails[0].Value})
@@ -220,7 +270,8 @@ func TestScim(t *testing.T) {
 
 			res, err := client.Request(ctx, "PATCH", "/scim/v2/Users/bob", struct{}{})
 			require.NoError(t, err)
-			defer res.Body.Close()
+			_, _ = io.Copy(io.Discard, res.Body)
+			_ = res.Body.Close()
 			assert.Equal(t, http.StatusNotFound, res.StatusCode)
 		})
 
@@ -242,7 +293,8 @@ func TestScim(t *testing.T) {
 
 			res, err := client.Request(ctx, "PATCH", "/scim/v2/Users/bob", struct{}{})
 			require.NoError(t, err)
-			defer res.Body.Close()
+			_, _ = io.Copy(io.Discard, res.Body)
+			_ = res.Body.Close()
 			assert.Equal(t, http.StatusInternalServerError, res.StatusCode)
 		})
 
@@ -276,7 +328,8 @@ func TestScim(t *testing.T) {
 
 			res, err = client.Request(ctx, "PATCH", "/scim/v2/Users/"+sUser.ID, sUser, setScimAuth(scimAPIKey))
 			require.NoError(t, err)
-			defer res.Body.Close()
+			_, _ = io.Copy(io.Discard, res.Body)
+			_ = res.Body.Close()
 			assert.Equal(t, http.StatusOK, res.StatusCode)
 
 			userRes, err := client.Users(ctx, codersdk.UsersRequest{Search: sUser.Emails[0].Value})
diff --git a/enterprise/coderd/templates.go b/enterprise/coderd/templates.go
index 5ba96712aaa89..4e7e0c669dfd6 100644
--- a/enterprise/coderd/templates.go
+++ b/enterprise/coderd/templates.go
@@ -9,13 +9,13 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // @Summary Get template available acl users/groups
diff --git a/enterprise/coderd/templates_test.go b/enterprise/coderd/templates_test.go
index 68e91a3ff0975..6b51e706e2d81 100644
--- a/enterprise/coderd/templates_test.go
+++ b/enterprise/coderd/templates_test.go
@@ -10,16 +10,17 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/enterprise/coderd/schedule"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestTemplates(t *testing.T) {
@@ -45,7 +46,7 @@ func TestTemplates(t *testing.T) {
 			ctr.DefaultTTLMillis = &exp
 			ctr.MaxTTLMillis = &exp
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -105,7 +106,7 @@ func TestTemplates(t *testing.T) {
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 			ctr.MaxTTLMillis = &exp
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
@@ -140,7 +141,7 @@ func TestTemplates(t *testing.T) {
 		require.EqualValues(t, exp, *ws.TTLMillis)
 	})
 
-	t.Run("SetRestartRequirement", func(t *testing.T) {
+	t.Run("SetAutostartRequirement", func(t *testing.T) {
 		t.Parallel()
 
 		client, user := coderdenttest.New(t, &coderdenttest.Options{
@@ -155,10 +156,93 @@ func TestTemplates(t *testing.T) {
 		})
 
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		require.Empty(t, 0, template.RestartRequirement.DaysOfWeek)
-		require.Zero(t, template.RestartRequirement.Weeks)
+		require.Equal(t, []string{"monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday"}, template.AutostartRequirement.DaysOfWeek)
+
+		ctx := testutil.Context(t, testutil.WaitLong)
+		updated, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+			Name:        template.Name,
+			DisplayName: template.DisplayName,
+			Description: template.Description,
+			Icon:        template.Icon,
+			AutostartRequirement: &codersdk.TemplateAutostartRequirement{
+				DaysOfWeek: []string{"monday", "saturday"},
+			},
+		})
+		require.NoError(t, err)
+		require.Equal(t, []string{"monday", "saturday"}, updated.AutostartRequirement.DaysOfWeek)
+
+		template, err = client.Template(ctx, template.ID)
+		require.NoError(t, err)
+		require.Equal(t, []string{"monday", "saturday"}, template.AutostartRequirement.DaysOfWeek)
+
+		// Ensure a missing field is a noop
+		updated, err = client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+			Name:        template.Name,
+			DisplayName: template.DisplayName,
+			Description: template.Description,
+			Icon:        template.Icon + "something",
+		})
+		require.NoError(t, err)
+		require.Equal(t, []string{"monday", "saturday"}, updated.AutostartRequirement.DaysOfWeek)
+
+		template, err = client.Template(ctx, template.ID)
+		require.NoError(t, err)
+		require.Equal(t, []string{"monday", "saturday"}, template.AutostartRequirement.DaysOfWeek)
+	})
+
+	t.Run("SetInvalidAutostartRequirement", func(t *testing.T) {
+		t.Parallel()
+
+		client, user := coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				IncludeProvisionerDaemon: true,
+			},
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureAdvancedTemplateScheduling: 1,
+				},
+			},
+		})
+
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		require.Equal(t, []string{"monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday"}, template.AutostartRequirement.DaysOfWeek)
+
+		ctx := testutil.Context(t, testutil.WaitLong)
+		_, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+			Name:        template.Name,
+			DisplayName: template.DisplayName,
+			Description: template.Description,
+			Icon:        template.Icon,
+			AutostartRequirement: &codersdk.TemplateAutostartRequirement{
+				DaysOfWeek: []string{"foobar", "saturday"},
+			},
+		})
+		require.Error(t, err)
+	})
+
+	t.Run("SetAutostopRequirement", func(t *testing.T) {
+		t.Parallel()
+
+		client, user := coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				IncludeProvisionerDaemon: true,
+			},
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureAdvancedTemplateScheduling: 1,
+				},
+			},
+		})
+
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+		require.Empty(t, 0, template.AutostopRequirement.DaysOfWeek)
+		require.EqualValues(t, 1, template.AutostopRequirement.Weeks)
 
 		// ctx := testutil.Context(t, testutil.WaitLong)
 		ctx := context.Background()
@@ -169,22 +253,141 @@ func TestTemplates(t *testing.T) {
 			Icon:                         template.Icon,
 			AllowUserCancelWorkspaceJobs: template.AllowUserCancelWorkspaceJobs,
 			DefaultTTLMillis:             time.Hour.Milliseconds(),
-			RestartRequirement: &codersdk.TemplateRestartRequirement{
+			AutostopRequirement: &codersdk.TemplateAutostopRequirement{
 				DaysOfWeek: []string{"monday", "saturday"},
 				Weeks:      3,
 			},
 		})
 		require.NoError(t, err)
-		require.Equal(t, []string{"monday", "saturday"}, updated.RestartRequirement.DaysOfWeek)
-		require.EqualValues(t, 3, updated.RestartRequirement.Weeks)
+		require.Equal(t, []string{"monday", "saturday"}, updated.AutostopRequirement.DaysOfWeek)
+		require.EqualValues(t, 3, updated.AutostopRequirement.Weeks)
 
 		template, err = client.Template(ctx, template.ID)
 		require.NoError(t, err)
-		require.Equal(t, []string{"monday", "saturday"}, template.RestartRequirement.DaysOfWeek)
-		require.EqualValues(t, 3, template.RestartRequirement.Weeks)
+		require.Equal(t, []string{"monday", "saturday"}, template.AutostopRequirement.DaysOfWeek)
+		require.EqualValues(t, 3, template.AutostopRequirement.Weeks)
 	})
 
 	t.Run("CleanupTTLs", func(t *testing.T) {
+		t.Run("OK", func(t *testing.T) {
+			t.Parallel()
+
+			ctx := testutil.Context(t, testutil.WaitMedium)
+			client, user := coderdenttest.New(t, &coderdenttest.Options{
+				Options: &coderdtest.Options{
+					IncludeProvisionerDaemon: true,
+				},
+				LicenseOptions: &coderdenttest.LicenseOptions{
+					Features: license.Features{
+						codersdk.FeatureAdvancedTemplateScheduling: 1,
+					},
+				},
+			})
+
+			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+			coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+			require.EqualValues(t, 0, template.TimeTilDormantMillis)
+			require.EqualValues(t, 0, template.FailureTTLMillis)
+			require.EqualValues(t, 0, template.TimeTilDormantAutoDeleteMillis)
+
+			var (
+				failureTTL    = 1 * time.Minute
+				inactivityTTL = 2 * time.Minute
+				dormantTTL    = 3 * time.Minute
+			)
+
+			updated, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+				Name:                           template.Name,
+				DisplayName:                    template.DisplayName,
+				Description:                    template.Description,
+				Icon:                           template.Icon,
+				AllowUserCancelWorkspaceJobs:   template.AllowUserCancelWorkspaceJobs,
+				TimeTilDormantMillis:           inactivityTTL.Milliseconds(),
+				FailureTTLMillis:               failureTTL.Milliseconds(),
+				TimeTilDormantAutoDeleteMillis: dormantTTL.Milliseconds(),
+			})
+			require.NoError(t, err)
+			require.Equal(t, failureTTL.Milliseconds(), updated.FailureTTLMillis)
+			require.Equal(t, inactivityTTL.Milliseconds(), updated.TimeTilDormantMillis)
+			require.Equal(t, dormantTTL.Milliseconds(), updated.TimeTilDormantAutoDeleteMillis)
+
+			// Validate fetching the template returns the same values as updating
+			// the template.
+			template, err = client.Template(ctx, template.ID)
+			require.NoError(t, err)
+			require.Equal(t, failureTTL.Milliseconds(), updated.FailureTTLMillis)
+			require.Equal(t, inactivityTTL.Milliseconds(), updated.TimeTilDormantMillis)
+			require.Equal(t, dormantTTL.Milliseconds(), updated.TimeTilDormantAutoDeleteMillis)
+		})
+
+		t.Run("BadRequest", func(t *testing.T) {
+			t.Parallel()
+
+			ctx := testutil.Context(t, testutil.WaitMedium)
+			client, user := coderdenttest.New(t, &coderdenttest.Options{
+				Options: &coderdtest.Options{
+					IncludeProvisionerDaemon: true,
+				},
+				LicenseOptions: &coderdenttest.LicenseOptions{
+					Features: license.Features{
+						codersdk.FeatureAdvancedTemplateScheduling: 1,
+					},
+				},
+			})
+
+			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+			coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+
+			type testcase struct {
+				Name                string
+				TimeTilDormantMS    int64
+				FailureTTLMS        int64
+				DormantAutoDeleteMS int64
+			}
+
+			cases := []testcase{
+				{
+					Name:                "NegativeValue",
+					TimeTilDormantMS:    -1,
+					FailureTTLMS:        -2,
+					DormantAutoDeleteMS: -3,
+				},
+				{
+					Name:                "ValueTooSmall",
+					TimeTilDormantMS:    1,
+					FailureTTLMS:        999,
+					DormantAutoDeleteMS: 500,
+				},
+			}
+
+			for _, c := range cases {
+				c := c
+
+				// nolint: paralleltest // context is from parent t.Run
+				t.Run(c.Name, func(t *testing.T) {
+					_, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+						Name:                           template.Name,
+						DisplayName:                    template.DisplayName,
+						Description:                    template.Description,
+						Icon:                           template.Icon,
+						AllowUserCancelWorkspaceJobs:   template.AllowUserCancelWorkspaceJobs,
+						TimeTilDormantMillis:           c.TimeTilDormantMS,
+						FailureTTLMillis:               c.FailureTTLMS,
+						TimeTilDormantAutoDeleteMillis: c.DormantAutoDeleteMS,
+					})
+					require.Error(t, err)
+					cerr, ok := codersdk.AsError(err)
+					require.True(t, ok)
+					require.Len(t, cerr.Validations, 3)
+					require.Equal(t, "Value must be at least one minute.", cerr.Validations[0].Detail)
+				})
+			}
+		})
+	})
+
+	t.Run("UpdateTimeTilDormantAutoDelete", func(t *testing.T) {
 		t.Parallel()
 
 		ctx := testutil.Context(t, testutil.WaitMedium)
@@ -198,45 +401,66 @@ func TestTemplates(t *testing.T) {
 				},
 			},
 		})
-
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		require.EqualValues(t, 0, template.InactivityTTLMillis)
-		require.EqualValues(t, 0, template.FailureTTLMillis)
-		require.EqualValues(t, 0, template.LockedTTLMillis)
 
-		var (
-			failureTTL    int64 = 1
-			inactivityTTL int64 = 2
-			lockedTTL     int64 = 3
-		)
+		activeWS := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		dormantWS := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		require.Nil(t, activeWS.DeletingAt)
+		require.Nil(t, dormantWS.DeletingAt)
+
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, activeWS.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, dormantWS.LatestBuild.ID)
+
+		err := client.UpdateWorkspaceDormancy(ctx, dormantWS.ID, codersdk.UpdateWorkspaceDormancy{
+			Dormant: true,
+		})
+		require.NoError(t, err)
+
+		dormantWS = coderdtest.MustWorkspace(t, client, dormantWS.ID)
+		require.NotNil(t, dormantWS.DormantAt)
+		// The deleting_at field should be nil since there is no template time_til_dormant_autodelete set.
+		require.Nil(t, dormantWS.DeletingAt)
 
+		dormantTTL := time.Minute
 		updated, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
-			Name:                         template.Name,
-			DisplayName:                  template.DisplayName,
-			Description:                  template.Description,
-			Icon:                         template.Icon,
-			AllowUserCancelWorkspaceJobs: template.AllowUserCancelWorkspaceJobs,
-			InactivityTTLMillis:          inactivityTTL,
-			FailureTTLMillis:             failureTTL,
-			LockedTTLMillis:              lockedTTL,
+			TimeTilDormantAutoDeleteMillis: dormantTTL.Milliseconds(),
 		})
 		require.NoError(t, err)
-		require.Equal(t, failureTTL, updated.FailureTTLMillis)
-		require.Equal(t, inactivityTTL, updated.InactivityTTLMillis)
-		require.Equal(t, lockedTTL, updated.LockedTTLMillis)
+		require.Equal(t, dormantTTL.Milliseconds(), updated.TimeTilDormantAutoDeleteMillis)
 
-		// Validate fetching the template returns the same values as updating
-		// the template.
-		template, err = client.Template(ctx, template.ID)
+		activeWS = coderdtest.MustWorkspace(t, client, activeWS.ID)
+		require.Nil(t, activeWS.DormantAt)
+		require.Nil(t, activeWS.DeletingAt)
+
+		updatedDormantWorkspace := coderdtest.MustWorkspace(t, client, dormantWS.ID)
+		require.NotNil(t, updatedDormantWorkspace.DormantAt)
+		require.NotNil(t, updatedDormantWorkspace.DeletingAt)
+		require.Equal(t, updatedDormantWorkspace.DormantAt.Add(dormantTTL), *updatedDormantWorkspace.DeletingAt)
+		require.Equal(t, updatedDormantWorkspace.DormantAt, dormantWS.DormantAt)
+
+		// Disable the time_til_dormant_auto_delete on the template, then we can assert that the workspaces
+		// no longer have a deleting_at field.
+		updated, err = client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+			TimeTilDormantAutoDeleteMillis: 0,
+		})
 		require.NoError(t, err)
-		require.Equal(t, failureTTL, updated.FailureTTLMillis)
-		require.Equal(t, inactivityTTL, updated.InactivityTTLMillis)
-		require.Equal(t, lockedTTL, updated.LockedTTLMillis)
+		require.EqualValues(t, 0, updated.TimeTilDormantAutoDeleteMillis)
+
+		// The active workspace should remain unchanged.
+		activeWS = coderdtest.MustWorkspace(t, client, activeWS.ID)
+		require.Nil(t, activeWS.DormantAt)
+		require.Nil(t, activeWS.DeletingAt)
+
+		// Fetch the dormant workspace. It should still be dormant, but it should no
+		// longer be scheduled for deletion.
+		dormantWS = coderdtest.MustWorkspace(t, client, dormantWS.ID)
+		require.NotNil(t, dormantWS.DormantAt)
+		require.Nil(t, dormantWS.DeletingAt)
 	})
 
-	t.Run("UpdateLockedTTL", func(t *testing.T) {
+	t.Run("UpdateDormantAt", func(t *testing.T) {
 		t.Parallel()
 
 		ctx := testutil.Context(t, testutil.WaitMedium)
@@ -251,61 +475,147 @@ func TestTemplates(t *testing.T) {
 			},
 		})
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 
-		unlockedWorkspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		lockedWorkspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		require.Nil(t, unlockedWorkspace.DeletingAt)
-		require.Nil(t, lockedWorkspace.DeletingAt)
+		activeWS := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		dormantWS := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		require.Nil(t, activeWS.DeletingAt)
+		require.Nil(t, dormantWS.DeletingAt)
 
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, unlockedWorkspace.LatestBuild.ID)
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, lockedWorkspace.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, activeWS.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, dormantWS.LatestBuild.ID)
 
-		err := client.UpdateWorkspaceLock(ctx, lockedWorkspace.ID, codersdk.UpdateWorkspaceLock{
-			Lock: true,
+		err := client.UpdateWorkspaceDormancy(ctx, dormantWS.ID, codersdk.UpdateWorkspaceDormancy{
+			Dormant: true,
 		})
 		require.NoError(t, err)
 
-		lockedWorkspace = coderdtest.MustWorkspace(t, client, lockedWorkspace.ID)
-		require.NotNil(t, lockedWorkspace.LockedAt)
-		// The deleting_at field should be nil since there is no template locked_ttl set.
-		require.Nil(t, lockedWorkspace.DeletingAt)
+		dormantWS = coderdtest.MustWorkspace(t, client, dormantWS.ID)
+		require.NotNil(t, dormantWS.DormantAt)
+		// The deleting_at field should be nil since there is no template time_til_dormant_autodelete set.
+		require.Nil(t, dormantWS.DeletingAt)
 
-		lockedTTL := time.Minute
+		dormantTTL := time.Minute
 		updated, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
-			LockedTTLMillis: lockedTTL.Milliseconds(),
+			TimeTilDormantAutoDeleteMillis: dormantTTL.Milliseconds(),
+			UpdateWorkspaceDormantAt:       true,
 		})
 		require.NoError(t, err)
-		require.Equal(t, lockedTTL.Milliseconds(), updated.LockedTTLMillis)
+		require.Equal(t, dormantTTL.Milliseconds(), updated.TimeTilDormantAutoDeleteMillis)
 
-		unlockedWorkspace = coderdtest.MustWorkspace(t, client, unlockedWorkspace.ID)
-		require.Nil(t, unlockedWorkspace.LockedAt)
-		require.Nil(t, unlockedWorkspace.DeletingAt)
+		activeWS = coderdtest.MustWorkspace(t, client, activeWS.ID)
+		require.Nil(t, activeWS.DormantAt)
+		require.Nil(t, activeWS.DeletingAt)
 
-		lockedWorkspace = coderdtest.MustWorkspace(t, client, lockedWorkspace.ID)
-		require.NotNil(t, lockedWorkspace.LockedAt)
-		require.NotNil(t, lockedWorkspace.DeletingAt)
-		require.Equal(t, lockedWorkspace.LockedAt.Add(lockedTTL), *lockedWorkspace.DeletingAt)
+		updatedDormantWorkspace := coderdtest.MustWorkspace(t, client, dormantWS.ID)
+		require.NotNil(t, updatedDormantWorkspace.DormantAt)
+		require.NotNil(t, updatedDormantWorkspace.DeletingAt)
+		// Validate that the workspace dormant_at value is updated.
+		require.True(t, updatedDormantWorkspace.DormantAt.After(*dormantWS.DormantAt))
+		require.Equal(t, updatedDormantWorkspace.DormantAt.Add(dormantTTL), *updatedDormantWorkspace.DeletingAt)
+	})
 
-		// Disable the locked_ttl on the template, then we can assert that the workspaces
-		// no longer have a deleting_at field.
-		updated, err = client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
-			LockedTTLMillis: 0,
+	t.Run("UpdateLastUsedAt", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+		client, user := coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				IncludeProvisionerDaemon: true,
+			},
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureAdvancedTemplateScheduling: 1,
+				},
+			},
+		})
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+
+		activeWorkspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		dormantWorkspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		require.Nil(t, activeWorkspace.DeletingAt)
+		require.Nil(t, dormantWorkspace.DeletingAt)
+
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, activeWorkspace.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, dormantWorkspace.LatestBuild.ID)
+
+		err := client.UpdateWorkspaceDormancy(ctx, dormantWorkspace.ID, codersdk.UpdateWorkspaceDormancy{
+			Dormant: true,
 		})
 		require.NoError(t, err)
-		require.EqualValues(t, 0, updated.LockedTTLMillis)
 
-		// The unlocked workspace should remain unchanged.
-		unlockedWorkspace = coderdtest.MustWorkspace(t, client, unlockedWorkspace.ID)
-		require.Nil(t, unlockedWorkspace.LockedAt)
-		require.Nil(t, unlockedWorkspace.DeletingAt)
+		dormantWorkspace = coderdtest.MustWorkspace(t, client, dormantWorkspace.ID)
+		require.NotNil(t, dormantWorkspace.DormantAt)
+		// The deleting_at field should be nil since there is no template time_til_dormant_autodelete set.
+		require.Nil(t, dormantWorkspace.DeletingAt)
 
-		// Fetch the locked workspace. It should still be locked, but it should no
-		// longer be scheduled for deletion.
-		lockedWorkspace = coderdtest.MustWorkspace(t, client, lockedWorkspace.ID)
-		require.NotNil(t, lockedWorkspace.LockedAt)
-		require.Nil(t, lockedWorkspace.DeletingAt)
+		inactivityTTL := time.Minute
+		updated, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+			TimeTilDormantMillis:      inactivityTTL.Milliseconds(),
+			UpdateWorkspaceLastUsedAt: true,
+		})
+		require.NoError(t, err)
+		require.Equal(t, inactivityTTL.Milliseconds(), updated.TimeTilDormantMillis)
+
+		updatedActiveWS := coderdtest.MustWorkspace(t, client, activeWorkspace.ID)
+		require.Nil(t, updatedActiveWS.DormantAt)
+		require.Nil(t, updatedActiveWS.DeletingAt)
+		require.True(t, updatedActiveWS.LastUsedAt.After(activeWorkspace.LastUsedAt))
+
+		updatedDormantWS := coderdtest.MustWorkspace(t, client, dormantWorkspace.ID)
+		require.NotNil(t, updatedDormantWS.DormantAt)
+		require.Nil(t, updatedDormantWS.DeletingAt)
+		// Validate that the workspace dormant_at value is updated.
+		require.Equal(t, updatedDormantWS.DormantAt, dormantWorkspace.DormantAt)
+		require.True(t, updatedDormantWS.LastUsedAt.After(dormantWorkspace.LastUsedAt))
+	})
+
+	t.Run("RequireActiveVersion", func(t *testing.T) {
+		t.Parallel()
+		client, user := coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				IncludeProvisionerDaemon: true,
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
+			},
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureAccessControl: 1,
+				},
+			},
+		})
+
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
+			ctr.RequireActiveVersion = true
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		require.True(t, template.RequireActiveVersion)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		// Update the field and assert it persists.
+		updatedTemplate, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+			RequireActiveVersion: false,
+		})
+		require.NoError(t, err)
+		require.False(t, updatedTemplate.RequireActiveVersion)
+
+		// Flip it back to ensure we aren't hardcoding to a default value.
+		updatedTemplate, err = client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+			RequireActiveVersion: true,
+		})
+		require.NoError(t, err)
+		require.True(t, updatedTemplate.RequireActiveVersion)
+
+		// Assert that fetching a template is no different from the response
+		// when updating.
+		template, err = client.Template(ctx, template.ID)
+		require.NoError(t, err)
+		require.Equal(t, updatedTemplate, template)
 	})
 }
 
@@ -373,8 +683,7 @@ func TestTemplateACL(t *testing.T) {
 		require.NoError(t, err)
 
 		require.Len(t, acl.Groups, 1)
-		// We don't return members for the 'Everyone' group.
-		require.Len(t, acl.Groups[0].Members, 0)
+		require.Len(t, acl.Groups[0].Members, 2)
 		require.Len(t, acl.Users, 0)
 	})
 
diff --git a/enterprise/coderd/userauth.go b/enterprise/coderd/userauth.go
index 86aa9f0ddf88b..f504a6c0325c4 100644
--- a/enterprise/coderd/userauth.go
+++ b/enterprise/coderd/userauth.go
@@ -7,12 +7,14 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/codersdk"
 )
 
-func (api *API) setUserGroups(ctx context.Context, db database.Store, userID uuid.UUID, groupNames []string) error {
+// nolint: revive
+func (api *API) setUserGroups(ctx context.Context, logger slog.Logger, db database.Store, userID uuid.UUID, groupNames []string, createMissingGroups bool) error {
 	api.entitlementsMu.RLock()
 	enabled := api.entitlements.Features[codersdk.FeatureTemplateRBAC].Enabled
 	api.entitlementsMu.RUnlock()
@@ -39,6 +41,25 @@ func (api *API) setUserGroups(ctx context.Context, db database.Store, userID uui
 			return xerrors.Errorf("delete user groups: %w", err)
 		}
 
+		if createMissingGroups {
+			// This is the system creating these additional groups, so we use the system restricted context.
+			// nolint:gocritic
+			created, err := tx.InsertMissingGroups(dbauthz.AsSystemRestricted(ctx), database.InsertMissingGroupsParams{
+				OrganizationID: orgs[0].ID,
+				GroupNames:     groupNames,
+				Source:         database.GroupSourceOidc,
+			})
+			if err != nil {
+				return xerrors.Errorf("insert missing groups: %w", err)
+			}
+			if len(created) > 0 {
+				logger.Debug(ctx, "auto created missing groups",
+					slog.F("org_id", orgs[0].ID),
+					slog.F("created", created),
+				)
+			}
+		}
+
 		// Re-add the user to all groups returned by the auth provider.
 		err = tx.InsertUserGroupsByName(ctx, database.InsertUserGroupsByNameParams{
 			UserID:         userID,
@@ -53,13 +74,13 @@ func (api *API) setUserGroups(ctx context.Context, db database.Store, userID uui
 	}, nil)
 }
 
-func (api *API) setUserSiteRoles(ctx context.Context, db database.Store, userID uuid.UUID, roles []string) error {
+func (api *API) setUserSiteRoles(ctx context.Context, logger slog.Logger, db database.Store, userID uuid.UUID, roles []string) error {
 	api.entitlementsMu.RLock()
 	enabled := api.entitlements.Features[codersdk.FeatureUserRoleManagement].Enabled
 	api.entitlementsMu.RUnlock()
 
 	if !enabled {
-		api.Logger.Warn(ctx, "attempted to assign OIDC user roles without enterprise entitlement, roles left unchanged",
+		logger.Warn(ctx, "attempted to assign OIDC user roles without enterprise entitlement, roles left unchanged",
 			slog.F("user_id", userID), slog.F("roles", roles),
 		)
 		return nil
diff --git a/enterprise/coderd/userauth_test.go b/enterprise/coderd/userauth_test.go
index 428cf91a6fef2..9d7e2762f005e 100644
--- a/enterprise/coderd/userauth_test.go
+++ b/enterprise/coderd/userauth_test.go
@@ -2,24 +2,26 @@ package coderd_test
 
 import (
 	"context"
-	"fmt"
-	"io"
 	"net/http"
+	"regexp"
 	"testing"
 
-	"github.com/coder/coder/enterprise/coderd/license"
-
-	"github.com/golang-jwt/jwt"
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
+	"github.com/golang-jwt/jwt/v4"
 	"github.com/stretchr/testify/require"
-
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/testutil"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/coderdtest/oidctest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/codersdk"
+	coderden "github.com/coder/coder/v2/enterprise/coderd"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // nolint:bodyclose
@@ -28,126 +30,123 @@ func TestUserOIDC(t *testing.T) {
 	t.Run("RoleSync", func(t *testing.T) {
 		t.Parallel()
 
+		// NoRoles is the "control group". It has claims with 0 roles
+		// assigned, and asserts that the user has no roles.
 		t.Run("NoRoles", func(t *testing.T) {
 			t.Parallel()
 
-			ctx := testutil.Context(t, testutil.WaitMedium)
-			conf := coderdtest.NewOIDCConfig(t, "")
-
-			oidcRoleName := "TemplateAuthor"
-
-			config := conf.OIDCConfig(t, jwt.MapClaims{}, func(cfg *coderd.OIDCConfig) {
-				cfg.UserRoleMapping = map[string][]string{oidcRoleName: {rbac.RoleTemplateAdmin(), rbac.RoleUserAdmin()}}
-			})
-			config.AllowSignups = true
-			config.UserRoleField = "roles"
-
-			client, _ := coderdenttest.New(t, &coderdenttest.Options{
-				Options: &coderdtest.Options{
-					OIDCConfig: config,
-				},
-				LicenseOptions: &coderdenttest.LicenseOptions{
-					Features: license.Features{codersdk.FeatureUserRoleManagement: 1},
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+					cfg.UserRoleField = "roles"
 				},
 			})
 
-			admin, err := client.User(ctx, "me")
-			require.NoError(t, err)
-			require.Len(t, admin.OrganizationIDs, 1)
-
-			resp := oidcCallback(t, client, conf.EncodeClaims(t, jwt.MapClaims{
+			claims := jwt.MapClaims{
 				"email": "alice@coder.com",
-			}))
-			require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
-			user, err := client.User(ctx, "alice")
-			require.NoError(t, err)
-
-			require.Len(t, user.Roles, 0)
-			roleNames := []string{}
-			require.ElementsMatch(t, roleNames, []string{})
+			}
+			// Login a new client that signs up
+			client, resp := runner.Login(t, claims)
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			// User should be in 0 groups.
+			runner.AssertRoles(t, "alice", []string{})
+			// Force a refresh, and assert nothing has changes
+			runner.ForceRefresh(t, client, claims)
+			runner.AssertRoles(t, "alice", []string{})
 		})
 
-		t.Run("NewUserAndRemoveRoles", func(t *testing.T) {
+		// A user has some roles, then on an oauth refresh will lose said
+		// roles from an updated claim.
+		t.Run("NewUserAndRemoveRolesOnRefresh", func(t *testing.T) {
+			// TODO: Implement new feature to update roles/groups on OIDC
+			// refresh tokens. https://github.com/coder/coder/issues/9312
+			t.Skip("Refreshing tokens does not update roles :(")
 			t.Parallel()
 
-			ctx := testutil.Context(t, testutil.WaitMedium)
-			conf := coderdtest.NewOIDCConfig(t, "")
+			const oidcRoleName = "TemplateAuthor"
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Userinfo: jwt.MapClaims{oidcRoleName: []string{rbac.RoleTemplateAdmin(), rbac.RoleUserAdmin()}},
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+					cfg.UserRoleField = "roles"
+					cfg.UserRoleMapping = map[string][]string{
+						oidcRoleName: {rbac.RoleTemplateAdmin(), rbac.RoleUserAdmin()},
+					}
+				},
+			})
 
-			oidcRoleName := "TemplateAuthor"
+			// User starts with the owner role
+			client, resp := runner.Login(t, jwt.MapClaims{
+				"email": "alice@coder.com",
+				"roles": []string{"random", oidcRoleName, rbac.RoleOwner()},
+			})
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertRoles(t, "alice", []string{rbac.RoleTemplateAdmin(), rbac.RoleUserAdmin(), rbac.RoleOwner()})
 
-			config := conf.OIDCConfig(t, jwt.MapClaims{}, func(cfg *coderd.OIDCConfig) {
-				cfg.UserRoleMapping = map[string][]string{oidcRoleName: {rbac.RoleTemplateAdmin(), rbac.RoleUserAdmin()}}
+			// Now refresh the oauth, and check the roles are removed.
+			// Force a refresh, and assert nothing has changes
+			runner.ForceRefresh(t, client, jwt.MapClaims{
+				"email": "alice@coder.com",
+				"roles": []string{"random"},
 			})
-			config.AllowSignups = true
-			config.UserRoleField = "roles"
+			runner.AssertRoles(t, "alice", []string{})
+		})
 
-			client, _ := coderdenttest.New(t, &coderdenttest.Options{
-				Options: &coderdtest.Options{
-					OIDCConfig: config,
-				},
-				LicenseOptions: &coderdenttest.LicenseOptions{
-					Features: license.Features{codersdk.FeatureUserRoleManagement: 1},
+		// A user has some roles, then on another oauth login will lose said
+		// roles from an updated claim.
+		t.Run("NewUserAndRemoveRolesOnReAuth", func(t *testing.T) {
+			t.Parallel()
+
+			const oidcRoleName = "TemplateAuthor"
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Userinfo: jwt.MapClaims{oidcRoleName: []string{rbac.RoleTemplateAdmin(), rbac.RoleUserAdmin()}},
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+					cfg.UserRoleField = "roles"
+					cfg.UserRoleMapping = map[string][]string{
+						oidcRoleName: {rbac.RoleTemplateAdmin(), rbac.RoleUserAdmin()},
+					}
 				},
 			})
 
-			admin, err := client.User(ctx, "me")
-			require.NoError(t, err)
-			require.Len(t, admin.OrganizationIDs, 1)
-
-			resp := oidcCallback(t, client, conf.EncodeClaims(t, jwt.MapClaims{
+			// User starts with the owner role
+			_, resp := runner.Login(t, jwt.MapClaims{
 				"email": "alice@coder.com",
 				"roles": []string{"random", oidcRoleName, rbac.RoleOwner()},
-			}))
-			require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
-			user, err := client.User(ctx, "alice")
-			require.NoError(t, err)
-
-			require.Len(t, user.Roles, 3)
-			roleNames := []string{user.Roles[0].Name, user.Roles[1].Name, user.Roles[2].Name}
-			require.ElementsMatch(t, roleNames, []string{rbac.RoleTemplateAdmin(), rbac.RoleUserAdmin(), rbac.RoleOwner()})
+			})
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertRoles(t, "alice", []string{rbac.RoleTemplateAdmin(), rbac.RoleUserAdmin(), rbac.RoleOwner()})
 
-			// Now remove the roles with a new oidc login
-			resp = oidcCallback(t, client, conf.EncodeClaims(t, jwt.MapClaims{
+			// Now login with oauth again, and check the roles are removed.
+			_, resp = runner.Login(t, jwt.MapClaims{
 				"email": "alice@coder.com",
 				"roles": []string{"random"},
-			}))
-			require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
-			user, err = client.User(ctx, "alice")
-			require.NoError(t, err)
+			})
+			require.Equal(t, http.StatusOK, resp.StatusCode)
 
-			require.Len(t, user.Roles, 0)
+			runner.AssertRoles(t, "alice", []string{})
 		})
+
+		// All manual role updates should fail when role sync is enabled.
 		t.Run("BlockAssignRoles", func(t *testing.T) {
 			t.Parallel()
 
-			ctx := testutil.Context(t, testutil.WaitMedium)
-			conf := coderdtest.NewOIDCConfig(t, "")
-
-			config := conf.OIDCConfig(t, jwt.MapClaims{})
-			config.AllowSignups = true
-			config.UserRoleField = "roles"
-
-			client, _ := coderdenttest.New(t, &coderdenttest.Options{
-				Options: &coderdtest.Options{
-					OIDCConfig: config,
-				},
-				LicenseOptions: &coderdenttest.LicenseOptions{
-					Features: license.Features{codersdk.FeatureUserRoleManagement: 1},
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+					cfg.UserRoleField = "roles"
 				},
 			})
 
-			admin, err := client.User(ctx, "me")
-			require.NoError(t, err)
-			require.Len(t, admin.OrganizationIDs, 1)
-
-			resp := oidcCallback(t, client, conf.EncodeClaims(t, jwt.MapClaims{
+			_, resp := runner.Login(t, jwt.MapClaims{
 				"email": "alice@coder.com",
 				"roles": []string{},
-			}))
-			require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
+			})
+			require.Equal(t, http.StatusOK, resp.StatusCode)
 			// Try to manually update user roles, even though controlled by oidc
 			// role sync.
-			_, err = client.UpdateUserRoles(ctx, "alice", codersdk.UpdateRoles{
+			ctx := testutil.Context(t, testutil.WaitShort)
+			_, err := runner.AdminClient.UpdateUserRoles(ctx, "alice", codersdk.UpdateRoles{
 				Roles: []string{
 					rbac.RoleTemplateAdmin(),
 				},
@@ -159,217 +158,555 @@ func TestUserOIDC(t *testing.T) {
 
 	t.Run("Groups", func(t *testing.T) {
 		t.Parallel()
+
+		// Assigns does a simple test of assigning a user to a group based
+		// on the oidc claims.
 		t.Run("Assigns", func(t *testing.T) {
 			t.Parallel()
 
-			ctx := testutil.Context(t, testutil.WaitLong)
-			conf := coderdtest.NewOIDCConfig(t, "")
-
 			const groupClaim = "custom-groups"
-			config := conf.OIDCConfig(t, jwt.MapClaims{}, func(cfg *coderd.OIDCConfig) {
-				cfg.GroupField = groupClaim
-			})
-			config.AllowSignups = true
-
-			client, _ := coderdenttest.New(t, &coderdenttest.Options{
-				Options: &coderdtest.Options{
-					OIDCConfig: config,
-				},
-				LicenseOptions: &coderdenttest.LicenseOptions{
-					Features: license.Features{codersdk.FeatureTemplateRBAC: 1},
+			const groupName = "bingbong"
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+					cfg.GroupField = groupClaim
 				},
 			})
 
-			admin, err := client.User(ctx, "me")
-			require.NoError(t, err)
-			require.Len(t, admin.OrganizationIDs, 1)
-
-			groupName := "bingbong"
-			group, err := client.CreateGroup(ctx, admin.OrganizationIDs[0], codersdk.CreateGroupRequest{
+			ctx := testutil.Context(t, testutil.WaitShort)
+			group, err := runner.AdminClient.CreateGroup(ctx, runner.AdminUser.OrganizationIDs[0], codersdk.CreateGroupRequest{
 				Name: groupName,
 			})
 			require.NoError(t, err)
 			require.Len(t, group.Members, 0)
 
-			resp := oidcCallback(t, client, conf.EncodeClaims(t, jwt.MapClaims{
-				"email":    "colin@coder.com",
+			_, resp := runner.Login(t, jwt.MapClaims{
+				"email":    "alice@coder.com",
 				groupClaim: []string{groupName},
-			}))
-			assert.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
-
-			group, err = client.Group(ctx, group.ID)
-			require.NoError(t, err)
-			require.Len(t, group.Members, 1)
+			})
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertGroups(t, "alice", []string{groupName})
 		})
+
+		// Tests the group mapping feature.
 		t.Run("AssignsMapped", func(t *testing.T) {
 			t.Parallel()
 
-			ctx := testutil.Context(t, testutil.WaitMedium)
-			conf := coderdtest.NewOIDCConfig(t, "")
+			const groupClaim = "custom-groups"
 
-			oidcGroupName := "pingpong"
-			coderGroupName := "bingbong"
+			const oidcGroupName = "pingpong"
+			const coderGroupName = "bingbong"
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+					cfg.GroupField = groupClaim
+					cfg.GroupMapping = map[string]string{oidcGroupName: coderGroupName}
+				},
+			})
 
-			config := conf.OIDCConfig(t, jwt.MapClaims{}, func(cfg *coderd.OIDCConfig) {
-				cfg.GroupMapping = map[string]string{oidcGroupName: coderGroupName}
+			ctx := testutil.Context(t, testutil.WaitShort)
+			group, err := runner.AdminClient.CreateGroup(ctx, runner.AdminUser.OrganizationIDs[0], codersdk.CreateGroupRequest{
+				Name: coderGroupName,
 			})
-			config.AllowSignups = true
+			require.NoError(t, err)
+			require.Len(t, group.Members, 0)
 
-			client, _ := coderdenttest.New(t, &coderdenttest.Options{
-				Options: &coderdtest.Options{
-					OIDCConfig: config,
-				},
-				LicenseOptions: &coderdenttest.LicenseOptions{
-					Features: license.Features{codersdk.FeatureTemplateRBAC: 1},
-				},
+			_, resp := runner.Login(t, jwt.MapClaims{
+				"email":    "alice@coder.com",
+				groupClaim: []string{oidcGroupName},
 			})
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertGroups(t, "alice", []string{coderGroupName})
+		})
 
-			admin, err := client.User(ctx, "me")
-			require.NoError(t, err)
-			require.Len(t, admin.OrganizationIDs, 1)
+		// User is in a group, then on an oauth refresh will lose said
+		// group.
+		t.Run("AddThenRemoveOnRefresh", func(t *testing.T) {
+			t.Parallel()
 
-			group, err := client.CreateGroup(ctx, admin.OrganizationIDs[0], codersdk.CreateGroupRequest{
-				Name: coderGroupName,
+			// TODO: Implement new feature to update roles/groups on OIDC
+			// refresh tokens. https://github.com/coder/coder/issues/9312
+			t.Skip("Refreshing tokens does not update groups :(")
+
+			const groupClaim = "custom-groups"
+			const groupName = "bingbong"
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+					cfg.GroupField = groupClaim
+				},
+			})
+
+			ctx := testutil.Context(t, testutil.WaitShort)
+			group, err := runner.AdminClient.CreateGroup(ctx, runner.AdminUser.OrganizationIDs[0], codersdk.CreateGroupRequest{
+				Name: groupName,
 			})
 			require.NoError(t, err)
 			require.Len(t, group.Members, 0)
 
-			resp := oidcCallback(t, client, conf.EncodeClaims(t, jwt.MapClaims{
-				"email":  "colin@coder.com",
-				"groups": []string{oidcGroupName},
-			}))
-			assert.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
+			client, resp := runner.Login(t, jwt.MapClaims{
+				"email":    "alice@coder.com",
+				groupClaim: []string{groupName},
+			})
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertGroups(t, "alice", []string{groupName})
 
-			group, err = client.Group(ctx, group.ID)
-			require.NoError(t, err)
-			require.Len(t, group.Members, 1)
+			// Refresh without the group claim
+			runner.ForceRefresh(t, client, jwt.MapClaims{
+				"email": "alice@coder.com",
+			})
+			runner.AssertGroups(t, "alice", []string{})
 		})
 
-		t.Run("AddThenRemove", func(t *testing.T) {
+		t.Run("AddThenRemoveOnReAuth", func(t *testing.T) {
 			t.Parallel()
 
-			ctx := testutil.Context(t, testutil.WaitLong)
-			conf := coderdtest.NewOIDCConfig(t, "")
+			const groupClaim = "custom-groups"
+			const groupName = "bingbong"
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+					cfg.GroupField = groupClaim
+				},
+			})
 
-			config := conf.OIDCConfig(t, jwt.MapClaims{})
-			config.AllowSignups = true
+			ctx := testutil.Context(t, testutil.WaitShort)
+			group, err := runner.AdminClient.CreateGroup(ctx, runner.AdminUser.OrganizationIDs[0], codersdk.CreateGroupRequest{
+				Name: groupName,
+			})
+			require.NoError(t, err)
+			require.Len(t, group.Members, 0)
 
-			client, firstUser := coderdenttest.New(t, &coderdenttest.Options{
-				Options: &coderdtest.Options{
-					OIDCConfig: config,
-				},
-				LicenseOptions: &coderdenttest.LicenseOptions{
-					Features: license.Features{codersdk.FeatureTemplateRBAC: 1},
+			_, resp := runner.Login(t, jwt.MapClaims{
+				"email":    "alice@coder.com",
+				groupClaim: []string{groupName},
+			})
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertGroups(t, "alice", []string{groupName})
+
+			// Refresh without the group claim
+			_, resp = runner.Login(t, jwt.MapClaims{
+				"email": "alice@coder.com",
+			})
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertGroups(t, "alice", []string{})
+		})
+
+		// Updating groups where the claimed group does not exist.
+		t.Run("NoneMatch", func(t *testing.T) {
+			t.Parallel()
+
+			const groupClaim = "custom-groups"
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+					cfg.GroupField = groupClaim
 				},
 			})
 
-			// Add some extra users/groups that should be asserted after.
-			// Adding this user as there was a bug that removing 1 user removed
-			// all users from the group.
-			_, extra := coderdtest.CreateAnotherUser(t, client, firstUser.OrganizationID)
-			groupName := "bingbong"
-			group, err := client.CreateGroup(ctx, firstUser.OrganizationID, codersdk.CreateGroupRequest{
-				Name: groupName,
+			_, resp := runner.Login(t, jwt.MapClaims{
+				"email":    "alice@coder.com",
+				groupClaim: []string{"not-exists"},
 			})
-			require.NoError(t, err, "create group")
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertGroups(t, "alice", []string{})
+		})
+
+		// Updating groups where the claimed group does not exist creates
+		// the group.
+		t.Run("AutoCreate", func(t *testing.T) {
+			t.Parallel()
 
-			group, err = client.PatchGroup(ctx, group.ID, codersdk.PatchGroupRequest{
-				AddUsers: []string{
-					firstUser.UserID.String(),
-					extra.ID.String(),
+			const groupClaim = "custom-groups"
+			const groupName = "make-me"
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+					cfg.GroupField = groupClaim
+					cfg.CreateMissingGroups = true
 				},
 			})
-			require.NoError(t, err, "patch group")
-			require.Len(t, group.Members, 2, "expect both members")
 
-			// Now add OIDC user into the group
-			resp := oidcCallback(t, client, conf.EncodeClaims(t, jwt.MapClaims{
-				"email":  "colin@coder.com",
-				"groups": []string{groupName},
-			}))
-			assert.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
+			_, resp := runner.Login(t, jwt.MapClaims{
+				"email":    "alice@coder.com",
+				groupClaim: []string{groupName},
+			})
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+			runner.AssertGroups(t, "alice", []string{groupName})
+		})
+	})
+
+	t.Run("Refresh", func(t *testing.T) {
+		t.Run("RefreshTokensMultiple", func(t *testing.T) {
+			t.Parallel()
 
-			group, err = client.Group(ctx, group.ID)
-			require.NoError(t, err)
-			require.Len(t, group.Members, 3)
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+					cfg.UserRoleField = "roles"
+				},
+			})
 
-			// Login to remove the OIDC user from the group
-			resp = oidcCallback(t, client, conf.EncodeClaims(t, jwt.MapClaims{
-				"email":  "colin@coder.com",
-				"groups": []string{},
-			}))
-			assert.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
+			claims := jwt.MapClaims{
+				"email": "alice@coder.com",
+			}
+			// Login a new client that signs up
+			client, resp := runner.Login(t, claims)
+			require.Equal(t, http.StatusOK, resp.StatusCode)
 
-			group, err = client.Group(ctx, group.ID)
-			require.NoError(t, err)
-			require.Len(t, group.Members, 2)
-			var expected []uuid.UUID
-			for _, mem := range group.Members {
-				expected = append(expected, mem.ID)
+			// Refresh multiple times.
+			for i := 0; i < 3; i++ {
+				runner.ForceRefresh(t, client, claims)
 			}
-			require.ElementsMatchf(t, expected, []uuid.UUID{firstUser.UserID, extra.ID}, "expected members")
 		})
 
-		t.Run("NoneMatch", func(t *testing.T) {
+		t.Run("FailedRefresh", func(t *testing.T) {
 			t.Parallel()
 
-			ctx := testutil.Context(t, testutil.WaitLong)
-			conf := coderdtest.NewOIDCConfig(t, "")
+			runner := setupOIDCTest(t, oidcTestConfig{
+				FakeOpts: []oidctest.FakeIDPOpt{
+					oidctest.WithRefresh(func(_ string) error {
+						// Always "expired" refresh token.
+						return xerrors.New("refresh token is expired")
+					}),
+				},
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.AllowSignups = true
+				},
+			})
+
+			claims := jwt.MapClaims{
+				"email": "alice@coder.com",
+			}
+			// Login a new client that signs up
+			client, resp := runner.Login(t, claims)
+			require.Equal(t, http.StatusOK, resp.StatusCode)
+
+			// Expire the token, cause a refresh
+			runner.ExpireOauthToken(t, client)
+
+			// This should fail because the oauth token refresh should fail.
+			_, err := client.User(context.Background(), codersdk.Me)
+			require.Error(t, err)
+			var apiError *codersdk.Error
+			require.ErrorAs(t, err, &apiError)
+			require.Equal(t, http.StatusUnauthorized, apiError.StatusCode())
+			require.ErrorContains(t, apiError, "refresh")
+		})
+	})
+}
 
-			config := conf.OIDCConfig(t, jwt.MapClaims{})
-			config.AllowSignups = true
+// nolint:bodyclose
+func TestGroupSync(t *testing.T) {
+	t.Parallel()
 
-			client, _ := coderdenttest.New(t, &coderdenttest.Options{
-				Options: &coderdtest.Options{
-					OIDCConfig: config,
+	testCases := []struct {
+		name   string
+		modCfg func(cfg *coderd.OIDCConfig)
+		// initialOrgGroups is initial groups in the org
+		initialOrgGroups []string
+		// initialUserGroups is initial groups for the user
+		initialUserGroups []string
+		// expectedUserGroups is expected groups for the user
+		expectedUserGroups []string
+		// expectedOrgGroups is expected all groups on the system
+		expectedOrgGroups []string
+		claims            jwt.MapClaims
+	}{
+		{
+			name: "NoGroups",
+			modCfg: func(cfg *coderd.OIDCConfig) {
+			},
+			initialOrgGroups:   []string{},
+			expectedUserGroups: []string{},
+			expectedOrgGroups:  []string{},
+			claims:             jwt.MapClaims{},
+		},
+		{
+			name: "GroupSyncDisabled",
+			modCfg: func(cfg *coderd.OIDCConfig) {
+				// Disable group sync
+				cfg.GroupField = ""
+				cfg.GroupFilter = regexp.MustCompile(".*")
+			},
+			initialOrgGroups:   []string{"a", "b", "c", "d"},
+			initialUserGroups:  []string{"b", "c", "d"},
+			expectedUserGroups: []string{"b", "c", "d"},
+			expectedOrgGroups:  []string{"a", "b", "c", "d"},
+			claims:             jwt.MapClaims{},
+		},
+		{
+			// From a,c,b -> b,c,d
+			name: "ChangeUserGroups",
+			modCfg: func(cfg *coderd.OIDCConfig) {
+				cfg.GroupMapping = map[string]string{
+					"D": "d",
+				}
+			},
+			initialOrgGroups:   []string{"a", "b", "c", "d"},
+			initialUserGroups:  []string{"a", "b", "c"},
+			expectedUserGroups: []string{"b", "c", "d"},
+			expectedOrgGroups:  []string{"a", "b", "c", "d"},
+			claims: jwt.MapClaims{
+				// D -> d mapped
+				"groups": []string{"b", "c", "D"},
+			},
+		},
+		{
+			// From a,c,b -> []
+			name: "RemoveAllGroups",
+			modCfg: func(cfg *coderd.OIDCConfig) {
+				cfg.GroupFilter = regexp.MustCompile(".*")
+			},
+			initialOrgGroups:   []string{"a", "b", "c", "d"},
+			initialUserGroups:  []string{"a", "b", "c"},
+			expectedUserGroups: []string{},
+			expectedOrgGroups:  []string{"a", "b", "c", "d"},
+			claims:             jwt.MapClaims{
+				// No claim == no groups
+			},
+		},
+		{
+			// From a,c,b -> b,c,d,e,f
+			name: "CreateMissingGroups",
+			modCfg: func(cfg *coderd.OIDCConfig) {
+				cfg.CreateMissingGroups = true
+			},
+			initialOrgGroups:   []string{"a", "b", "c", "d"},
+			initialUserGroups:  []string{"a", "b", "c"},
+			expectedUserGroups: []string{"b", "c", "d", "e", "f"},
+			expectedOrgGroups:  []string{"a", "b", "c", "d", "e", "f"},
+			claims: jwt.MapClaims{
+				"groups": []string{"b", "c", "d", "e", "f"},
+			},
+		},
+		{
+			// From a,c,b -> b,c,d,e,f
+			name: "CreateMissingGroupsFilter",
+			modCfg: func(cfg *coderd.OIDCConfig) {
+				cfg.CreateMissingGroups = true
+				// Only single letter groups
+				cfg.GroupFilter = regexp.MustCompile("^[a-z]$")
+				cfg.GroupMapping = map[string]string{
+					// Does not match the filter, but does after being mapped!
+					"zebra": "z",
+				}
+			},
+			initialOrgGroups:   []string{"a", "b", "c", "d"},
+			initialUserGroups:  []string{"a", "b", "c"},
+			expectedUserGroups: []string{"b", "c", "d", "e", "f", "z"},
+			expectedOrgGroups:  []string{"a", "b", "c", "d", "e", "f", "z"},
+			claims: jwt.MapClaims{
+				"groups": []string{
+					"b", "c", "d", "e", "f",
+					// These groups are ignored
+					"excess", "ignore", "dumb", "foobar", "zebra",
 				},
-				LicenseOptions: &coderdenttest.LicenseOptions{
-					Features: license.Features{codersdk.FeatureTemplateRBAC: 1},
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			runner := setupOIDCTest(t, oidcTestConfig{
+				Config: func(cfg *coderd.OIDCConfig) {
+					cfg.GroupField = "groups"
+					tc.modCfg(cfg)
 				},
 			})
 
-			admin, err := client.User(ctx, "me")
-			require.NoError(t, err)
-			require.Len(t, admin.OrganizationIDs, 1)
+			// Setup
+			ctx := testutil.Context(t, testutil.WaitLong)
+			org := runner.AdminUser.OrganizationIDs[0]
+
+			initialGroups := make(map[string]codersdk.Group)
+			for _, group := range tc.initialOrgGroups {
+				newGroup, err := runner.AdminClient.CreateGroup(ctx, org, codersdk.CreateGroupRequest{
+					Name: group,
+				})
+				require.NoError(t, err)
+				require.Len(t, newGroup.Members, 0)
+				initialGroups[group] = newGroup
+			}
 
-			groupName := "bingbong"
-			group, err := client.CreateGroup(ctx, admin.OrganizationIDs[0], codersdk.CreateGroupRequest{
-				Name: groupName,
+			// Create the user and add them to their initial groups
+			_, user := coderdtest.CreateAnotherUser(t, runner.AdminClient, org)
+			for _, group := range tc.initialUserGroups {
+				_, err := runner.AdminClient.PatchGroup(ctx, initialGroups[group].ID, codersdk.PatchGroupRequest{
+					AddUsers: []string{user.ID.String()},
+				})
+				require.NoError(t, err)
+			}
+
+			// nolint:gocritic
+			_, err := runner.API.Database.UpdateUserLoginType(dbauthz.AsSystemRestricted(ctx), database.UpdateUserLoginTypeParams{
+				NewLoginType: database.LoginTypeOIDC,
+				UserID:       user.ID,
 			})
-			require.NoError(t, err)
-			require.Len(t, group.Members, 0)
+			require.NoError(t, err, "user must be oidc type")
 
-			resp := oidcCallback(t, client, conf.EncodeClaims(t, jwt.MapClaims{
-				"email":  "colin@coder.com",
-				"groups": []string{"coolin"},
-			}))
-			assert.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
+			// Log in the new user
+			tc.claims["email"] = user.Email
+			_, resp := runner.Login(t, tc.claims)
+			require.Equal(t, http.StatusOK, resp.StatusCode)
 
-			group, err = client.Group(ctx, group.ID)
+			// Check group sources
+			orgGroups, err := runner.AdminClient.GroupsByOrganization(ctx, org)
 			require.NoError(t, err)
-			require.Len(t, group.Members, 0)
+
+			for _, group := range orgGroups {
+				if slice.Contains(tc.initialOrgGroups, group.Name) || group.IsEveryone() {
+					require.Equal(t, group.Source, codersdk.GroupSourceUser)
+				} else {
+					require.Equal(t, group.Source, codersdk.GroupSourceOIDC)
+				}
+			}
+
+			orgGroupsMap := make(map[string]struct{})
+			for _, group := range orgGroups {
+				orgGroupsMap[group.Name] = struct{}{}
+			}
+
+			for _, expected := range tc.expectedOrgGroups {
+				if _, ok := orgGroupsMap[expected]; !ok {
+					t.Errorf("expected group %s not found", expected)
+				}
+				delete(orgGroupsMap, expected)
+			}
+			delete(orgGroupsMap, database.EveryoneGroup)
+			require.Empty(t, orgGroupsMap, "unexpected groups found")
+
+			expectedUserGroups := make(map[string]struct{})
+			for _, group := range tc.expectedUserGroups {
+				expectedUserGroups[group] = struct{}{}
+			}
+
+			for _, group := range orgGroups {
+				userInGroup := slice.ContainsCompare(group.Members, codersdk.User{Email: user.Email}, func(a, b codersdk.User) bool {
+					return a.Email == b.Email
+				})
+				if group.IsEveryone() {
+					require.True(t, userInGroup, "user cannot be removed from 'Everyone' group")
+				} else if _, ok := expectedUserGroups[group.Name]; ok {
+					require.Truef(t, userInGroup, "user should be in group %s", group.Name)
+				} else {
+					require.Falsef(t, userInGroup, "user should not be in group %s", group.Name)
+				}
+			}
 		})
-	})
+	}
+}
+
+// oidcTestRunner is just a helper to setup and run oidc tests.
+// An actual Coderd instance is used to run the tests.
+type oidcTestRunner struct {
+	AdminClient *codersdk.Client
+	AdminUser   codersdk.User
+	API         *coderden.API
+
+	// Login will call the OIDC flow with an unauthenticated client.
+	// The IDP will return the idToken claims.
+	Login func(t *testing.T, idToken jwt.MapClaims) (*codersdk.Client, *http.Response)
+	// ForceRefresh will use an authenticated codersdk.Client, and force their
+	// OIDC token to be expired and require a refresh. The refresh will use the claims provided.
+	// It just calls the /users/me endpoint to trigger the refresh.
+	ForceRefresh     func(t *testing.T, client *codersdk.Client, idToken jwt.MapClaims)
+	ExpireOauthToken func(t *testing.T, client *codersdk.Client)
 }
 
-func oidcCallback(t *testing.T, client *codersdk.Client, code string) *http.Response {
+type oidcTestConfig struct {
+	Userinfo jwt.MapClaims
+
+	// Config allows modifying the Coderd OIDC configuration.
+	Config   func(cfg *coderd.OIDCConfig)
+	FakeOpts []oidctest.FakeIDPOpt
+}
+
+func (r *oidcTestRunner) AssertRoles(t *testing.T, userIdent string, roles []string) {
 	t.Helper()
-	client.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
-		return http.ErrUseLastResponse
+
+	ctx := testutil.Context(t, testutil.WaitMedium)
+	user, err := r.AdminClient.User(ctx, userIdent)
+	require.NoError(t, err)
+
+	roleNames := []string{}
+	for _, role := range user.Roles {
+		roleNames = append(roleNames, role.Name)
 	}
-	oauthURL, err := client.URL.Parse(fmt.Sprintf("/api/v2/users/oidc/callback?code=%s&state=somestate", code))
+	require.ElementsMatch(t, roles, roleNames, "expected roles")
+}
+
+func (r *oidcTestRunner) AssertGroups(t *testing.T, userIdent string, groups []string) {
+	t.Helper()
+
+	if !slice.Contains(groups, database.EveryoneGroup) {
+		var cpy []string
+		cpy = append(cpy, groups...)
+		// always include everyone group
+		cpy = append(cpy, database.EveryoneGroup)
+		groups = cpy
+	}
+	ctx := testutil.Context(t, testutil.WaitMedium)
+	user, err := r.AdminClient.User(ctx, userIdent)
 	require.NoError(t, err)
-	req, err := http.NewRequestWithContext(context.Background(), "GET", oauthURL.String(), nil)
+
+	allGroups, err := r.AdminClient.GroupsByOrganization(ctx, user.OrganizationIDs[0])
 	require.NoError(t, err)
-	req.AddCookie(&http.Cookie{
-		Name:  codersdk.OAuth2StateCookie,
-		Value: "somestate",
+
+	userInGroups := []string{}
+	for _, g := range allGroups {
+		for _, mem := range g.Members {
+			if mem.ID == user.ID {
+				userInGroups = append(userInGroups, g.Name)
+			}
+		}
+	}
+
+	require.ElementsMatch(t, groups, userInGroups, "expected groups")
+}
+
+func setupOIDCTest(t *testing.T, settings oidcTestConfig) *oidcTestRunner {
+	t.Helper()
+
+	fake := oidctest.NewFakeIDP(t,
+		append([]oidctest.FakeIDPOpt{
+			oidctest.WithStaticUserInfo(settings.Userinfo),
+			oidctest.WithLogging(t, nil),
+			// Run fake IDP on a real webserver
+			oidctest.WithServing(),
+		}, settings.FakeOpts...)...,
+	)
+
+	ctx := testutil.Context(t, testutil.WaitMedium)
+	cfg := fake.OIDCConfig(t, nil, settings.Config)
+	owner, _, api, _ := coderdenttest.NewWithAPI(t, &coderdenttest.Options{
+		Options: &coderdtest.Options{
+			OIDCConfig: cfg,
+		},
+		LicenseOptions: &coderdenttest.LicenseOptions{
+			Features: license.Features{
+				codersdk.FeatureUserRoleManagement: 1,
+				codersdk.FeatureTemplateRBAC:       1,
+			},
+		},
 	})
-	res, err := client.HTTPClient.Do(req)
-	require.NoError(t, err)
-	defer res.Body.Close()
-	data, err := io.ReadAll(res.Body)
+	admin, err := owner.User(ctx, "me")
 	require.NoError(t, err)
-	t.Log(string(data))
-	return res
+
+	helper := oidctest.NewLoginHelper(owner, fake)
+
+	return &oidcTestRunner{
+		AdminClient: owner,
+		AdminUser:   admin,
+		API:         api,
+		Login:       helper.Login,
+		ForceRefresh: func(t *testing.T, client *codersdk.Client, idToken jwt.MapClaims) {
+			helper.ForceRefresh(t, api.Database, client, idToken)
+		},
+		ExpireOauthToken: func(t *testing.T, client *codersdk.Client) {
+			helper.ExpireOauthToken(t, api.Database, client)
+		},
+	}
 }
diff --git a/enterprise/coderd/users.go b/enterprise/coderd/users.go
index 3f1e61fddb10d..6398a93c95e85 100644
--- a/enterprise/coderd/users.go
+++ b/enterprise/coderd/users.go
@@ -4,35 +4,35 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
-func (api *API) restartRequirementEnabledMW(next http.Handler) http.Handler {
+func (api *API) autostopRequirementEnabledMW(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 		// The experiment must be enabled.
-		if !api.AGPL.Experiments.Enabled(codersdk.ExperimentTemplateRestartRequirement) {
+		if !api.AGPL.Experiments.Enabled(codersdk.ExperimentTemplateAutostopRequirement) {
 			httpapi.RouteNotFound(rw)
 			return
 		}
 
 		// Entitlement must be enabled.
 		api.entitlementsMu.RLock()
-		entitled := api.entitlements.Features[codersdk.FeatureTemplateRestartRequirement].Entitlement != codersdk.EntitlementNotEntitled
-		enabled := api.entitlements.Features[codersdk.FeatureTemplateRestartRequirement].Enabled
+		entitled := api.entitlements.Features[codersdk.FeatureTemplateAutostopRequirement].Entitlement != codersdk.EntitlementNotEntitled
+		enabled := api.entitlements.Features[codersdk.FeatureTemplateAutostopRequirement].Enabled
 		api.entitlementsMu.RUnlock()
 		if !entitled {
 			httpapi.Write(r.Context(), rw, http.StatusForbidden, codersdk.Response{
-				Message: "Template restart requirement is an Enterprise feature. Contact sales!",
+				Message: "Template autostop requirement is an Enterprise feature. Contact sales!",
 			})
 			return
 		}
 		if !enabled {
 			httpapi.Write(r.Context(), rw, http.StatusForbidden, codersdk.Response{
-				Message: "Template restart requirement feature is not enabled. Please specify a default user quiet hours schedule to use this feature.",
+				Message: "Template autostop requirement feature is not enabled. Please specify a default user quiet hours schedule to use this feature.",
 			})
 			return
 		}
@@ -68,7 +68,7 @@ func (api *API) userQuietHoursSchedule(rw http.ResponseWriter, r *http.Request)
 	httpapi.Write(ctx, rw, http.StatusOK, codersdk.UserQuietHoursScheduleResponse{
 		RawSchedule: opts.Schedule.String(),
 		UserSet:     opts.UserSet,
-		Time:        opts.Schedule.Time(),
+		Time:        opts.Schedule.TimeParsed().Format("15:40"),
 		Timezone:    opts.Schedule.Location().String(),
 		Next:        opts.Schedule.Next(time.Now().In(opts.Schedule.Location())),
 	})
@@ -114,7 +114,7 @@ func (api *API) putUserQuietHoursSchedule(rw http.ResponseWriter, r *http.Reques
 	httpapi.Write(ctx, rw, http.StatusOK, codersdk.UserQuietHoursScheduleResponse{
 		RawSchedule: opts.Schedule.String(),
 		UserSet:     opts.UserSet,
-		Time:        opts.Schedule.Time(),
+		Time:        opts.Schedule.TimeParsed().Format("15:40"),
 		Timezone:    opts.Schedule.Location().String(),
 		Next:        opts.Schedule.Next(time.Now().In(opts.Schedule.Location())),
 	})
diff --git a/enterprise/coderd/users_test.go b/enterprise/coderd/users_test.go
index b908dfd9600bf..e88a3e4df55f3 100644
--- a/enterprise/coderd/users_test.go
+++ b/enterprise/coderd/users_test.go
@@ -7,12 +7,12 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestUserQuietHours(t *testing.T) {
@@ -21,21 +21,21 @@ func TestUserQuietHours(t *testing.T) {
 	t.Run("OK", func(t *testing.T) {
 		t.Parallel()
 
-		defaultQuietHoursSchedule := "CRON_TZ=America/Chicago 0 0 * * *"
-		defaultScheduleParsed, err := schedule.Daily(defaultQuietHoursSchedule)
+		defaultQuietHoursSchedule := "CRON_TZ=America/Chicago 0 1 * * *"
+		defaultScheduleParsed, err := cron.Daily(defaultQuietHoursSchedule)
 		require.NoError(t, err)
 		nextTime := defaultScheduleParsed.Next(time.Now().In(defaultScheduleParsed.Location()))
 		if time.Until(nextTime) < time.Hour {
 			// Use a different default schedule instead, because we want to avoid
 			// the schedule "ticking over" during this test run.
-			defaultQuietHoursSchedule = "CRON_TZ=America/Chicago 0 12 * * *"
-			defaultScheduleParsed, err = schedule.Daily(defaultQuietHoursSchedule)
+			defaultQuietHoursSchedule = "CRON_TZ=America/Chicago 0 13 * * *"
+			defaultScheduleParsed, err = cron.Daily(defaultQuietHoursSchedule)
 			require.NoError(t, err)
 		}
 
 		dv := coderdtest.DeploymentValues(t)
 		dv.UserQuietHoursSchedule.DefaultSchedule.Set(defaultQuietHoursSchedule)
-		dv.Experiments.Set(string(codersdk.ExperimentTemplateRestartRequirement))
+		dv.Experiments.Set(string(codersdk.ExperimentTemplateAutostopRequirement))
 
 		client, user := coderdenttest.New(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
@@ -43,8 +43,8 @@ func TestUserQuietHours(t *testing.T) {
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{
-					codersdk.FeatureAdvancedTemplateScheduling: 1,
-					codersdk.FeatureTemplateRestartRequirement: 1,
+					codersdk.FeatureAdvancedTemplateScheduling:  1,
+					codersdk.FeatureTemplateAutostopRequirement: 1,
 				},
 			},
 		})
@@ -55,20 +55,20 @@ func TestUserQuietHours(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, defaultScheduleParsed.String(), sched1.RawSchedule)
 		require.False(t, sched1.UserSet)
-		require.Equal(t, defaultScheduleParsed.Time(), sched1.Time)
+		require.Equal(t, defaultScheduleParsed.TimeParsed().Format("15:40"), sched1.Time)
 		require.Equal(t, defaultScheduleParsed.Location().String(), sched1.Timezone)
 		require.WithinDuration(t, defaultScheduleParsed.Next(time.Now()), sched1.Next, 15*time.Second)
 
 		// Set their quiet hours.
 		customQuietHoursSchedule := "CRON_TZ=Australia/Sydney 0 0 * * *"
-		customScheduleParsed, err := schedule.Daily(customQuietHoursSchedule)
+		customScheduleParsed, err := cron.Daily(customQuietHoursSchedule)
 		require.NoError(t, err)
 		nextTime = customScheduleParsed.Next(time.Now().In(customScheduleParsed.Location()))
 		if time.Until(nextTime) < time.Hour {
 			// Use a different default schedule instead, because we want to avoid
 			// the schedule "ticking over" during this test run.
 			customQuietHoursSchedule = "CRON_TZ=Australia/Sydney 0 12 * * *"
-			customScheduleParsed, err = schedule.Daily(customQuietHoursSchedule)
+			customScheduleParsed, err = cron.Daily(customQuietHoursSchedule)
 			require.NoError(t, err)
 		}
 
@@ -78,7 +78,7 @@ func TestUserQuietHours(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, customScheduleParsed.String(), sched2.RawSchedule)
 		require.True(t, sched2.UserSet)
-		require.Equal(t, customScheduleParsed.Time(), sched2.Time)
+		require.Equal(t, customScheduleParsed.TimeParsed().Format("15:40"), sched2.Time)
 		require.Equal(t, customScheduleParsed.Location().String(), sched2.Timezone)
 		require.WithinDuration(t, customScheduleParsed.Next(time.Now()), sched2.Next, 15*time.Second)
 
@@ -87,7 +87,7 @@ func TestUserQuietHours(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, customScheduleParsed.String(), sched3.RawSchedule)
 		require.True(t, sched3.UserSet)
-		require.Equal(t, customScheduleParsed.Time(), sched3.Time)
+		require.Equal(t, customScheduleParsed.TimeParsed().Format("15:40"), sched3.Time)
 		require.Equal(t, customScheduleParsed.Location().String(), sched3.Timezone)
 		require.WithinDuration(t, customScheduleParsed.Next(time.Now()), sched3.Next, 15*time.Second)
 
@@ -133,7 +133,7 @@ func TestUserQuietHours(t *testing.T) {
 
 		dv := coderdtest.DeploymentValues(t)
 		dv.UserQuietHoursSchedule.DefaultSchedule.Set("CRON_TZ=America/Chicago 0 0 * * *")
-		dv.Experiments.Set(string(codersdk.ExperimentTemplateRestartRequirement))
+		dv.Experiments.Set(string(codersdk.ExperimentTemplateAutostopRequirement))
 
 		client, user := coderdenttest.New(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
@@ -143,7 +143,7 @@ func TestUserQuietHours(t *testing.T) {
 				Features: license.Features{
 					codersdk.FeatureAdvancedTemplateScheduling: 1,
 					// Not entitled.
-					// codersdk.FeatureTemplateRestartRequirement: 1,
+					// codersdk.FeatureTemplateAutostopRequirement: 1,
 				},
 			},
 		})
@@ -161,7 +161,7 @@ func TestUserQuietHours(t *testing.T) {
 
 		dv := coderdtest.DeploymentValues(t)
 		dv.UserQuietHoursSchedule.DefaultSchedule.Set("")
-		dv.Experiments.Set(string(codersdk.ExperimentTemplateRestartRequirement))
+		dv.Experiments.Set(string(codersdk.ExperimentTemplateAutostopRequirement))
 
 		client, user := coderdenttest.New(t, &coderdenttest.Options{
 			NoDefaultQuietHoursSchedule: true,
@@ -170,8 +170,8 @@ func TestUserQuietHours(t *testing.T) {
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{
-					codersdk.FeatureAdvancedTemplateScheduling: 1,
-					codersdk.FeatureTemplateRestartRequirement: 1,
+					codersdk.FeatureAdvancedTemplateScheduling:  1,
+					codersdk.FeatureTemplateAutostopRequirement: 1,
 				},
 			},
 		})
@@ -197,8 +197,8 @@ func TestUserQuietHours(t *testing.T) {
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{
-					codersdk.FeatureAdvancedTemplateScheduling: 1,
-					codersdk.FeatureTemplateRestartRequirement: 1,
+					codersdk.FeatureAdvancedTemplateScheduling:  1,
+					codersdk.FeatureTemplateAutostopRequirement: 1,
 				},
 			},
 		})
diff --git a/enterprise/coderd/workspaceagents.go b/enterprise/coderd/workspaceagents.go
index 05590342aec5b..d14aa9580bbd4 100644
--- a/enterprise/coderd/workspaceagents.go
+++ b/enterprise/coderd/workspaceagents.go
@@ -4,8 +4,8 @@ import (
 	"context"
 	"net/http"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 func (api *API) shouldBlockNonBrowserConnections(rw http.ResponseWriter) bool {
diff --git a/enterprise/coderd/workspaceagents_test.go b/enterprise/coderd/workspaceagents_test.go
index 0395d71c3ca4e..a5c4ef2063636 100644
--- a/enterprise/coderd/workspaceagents_test.go
+++ b/enterprise/coderd/workspaceagents_test.go
@@ -11,15 +11,15 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // App names for each app sharing level.
@@ -73,9 +73,9 @@ func setupWorkspaceAgent(t *testing.T, client *codersdk.Client, user codersdk.Cr
 	authToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse: echo.ParseComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "example",
 						Type: "aws_instance",
@@ -111,10 +111,10 @@ func setupWorkspaceAgent(t *testing.T, client *codersdk.Client, user codersdk.Cr
 			},
 		}},
 	})
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	agentClient := agentsdk.New(client.URL)
 	agentClient.SDK.HTTPClient = &http.Client{
 		Transport: &http.Transport{
diff --git a/enterprise/coderd/workspacebuilds_test.go b/enterprise/coderd/workspacebuilds_test.go
new file mode 100644
index 0000000000000..615991a65dec9
--- /dev/null
+++ b/enterprise/coderd/workspacebuilds_test.go
@@ -0,0 +1,139 @@
+package coderd_test
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestWorkspaceBuild(t *testing.T) {
+	t.Parallel()
+	t.Run("TemplateRequiresActiveVersion", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+		ownerClient, owner := coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				IncludeProvisionerDaemon: true,
+			},
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureAccessControl:              1,
+					codersdk.FeatureTemplateRBAC:               1,
+					codersdk.FeatureAdvancedTemplateScheduling: 1,
+				},
+			},
+		})
+
+		// Create an initial version.
+		oldVersion := coderdtest.CreateTemplateVersion(t, ownerClient, owner.OrganizationID, nil)
+		// Create a template that mandates the promoted version.
+		// This should be enforced for everyone except template admins.
+		template := coderdtest.CreateTemplate(t, ownerClient, owner.OrganizationID, oldVersion.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, ownerClient, oldVersion.ID)
+		require.Equal(t, oldVersion.ID, template.ActiveVersionID)
+		template, err := ownerClient.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+			RequireActiveVersion: true,
+		})
+		require.NoError(t, err)
+		require.True(t, template.RequireActiveVersion)
+
+		// Create a new version that we will promote.
+		activeVersion := coderdtest.CreateTemplateVersion(t, ownerClient, owner.OrganizationID, nil, func(ctvr *codersdk.CreateTemplateVersionRequest) {
+			ctvr.TemplateID = template.ID
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, ownerClient, activeVersion.ID)
+		err = ownerClient.UpdateActiveTemplateVersion(ctx, template.ID, codersdk.UpdateActiveTemplateVersion{
+			ID: activeVersion.ID,
+		})
+		require.NoError(t, err)
+
+		templateAdminClient, _ := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID, rbac.RoleTemplateAdmin())
+		templateACLAdminClient, templateACLAdmin := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID)
+		templateGroupACLAdminClient, templateGroupACLAdmin := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID)
+		memberClient, _ := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID)
+
+		// Create a group so we can also test group template admin ownership.
+		group, err := ownerClient.CreateGroup(ctx, owner.OrganizationID, codersdk.CreateGroupRequest{
+			Name: "test",
+		})
+		require.NoError(t, err)
+
+		// Add the user who gains template admin via group membership.
+		group, err = ownerClient.PatchGroup(ctx, group.ID, codersdk.PatchGroupRequest{
+			AddUsers: []string{templateGroupACLAdmin.ID.String()},
+		})
+		require.NoError(t, err)
+
+		// Update the template for both users and groups.
+		err = ownerClient.UpdateTemplateACL(ctx, template.ID, codersdk.UpdateTemplateACL{
+			UserPerms: map[string]codersdk.TemplateRole{
+				templateACLAdmin.ID.String(): codersdk.TemplateRoleAdmin,
+			},
+			GroupPerms: map[string]codersdk.TemplateRole{
+				group.ID.String(): codersdk.TemplateRoleAdmin,
+			},
+		})
+		require.NoError(t, err)
+
+		type testcase struct {
+			Name               string
+			Client             *codersdk.Client
+			ExpectedStatusCode int
+		}
+
+		cases := []testcase{
+			{
+				Name:               "OwnerOK",
+				Client:             ownerClient,
+				ExpectedStatusCode: http.StatusOK,
+			},
+			{
+				Name:               "TemplateAdminOK",
+				Client:             templateAdminClient,
+				ExpectedStatusCode: http.StatusOK,
+			},
+			{
+				Name:               "TemplateACLAdminOK",
+				Client:             templateACLAdminClient,
+				ExpectedStatusCode: http.StatusOK,
+			},
+			{
+				Name:               "TemplateGroupACLAdminOK",
+				Client:             templateGroupACLAdminClient,
+				ExpectedStatusCode: http.StatusOK,
+			},
+			{
+				Name:               "MemberFails",
+				Client:             memberClient,
+				ExpectedStatusCode: http.StatusUnauthorized,
+			},
+		}
+
+		for _, c := range cases {
+			t.Run(c.Name, func(t *testing.T) {
+				_, err = c.Client.CreateWorkspace(ctx, owner.OrganizationID, codersdk.Me, codersdk.CreateWorkspaceRequest{
+					TemplateVersionID: oldVersion.ID,
+					Name:              "abc123",
+					AutomaticUpdates:  codersdk.AutomaticUpdatesNever,
+				})
+				if c.ExpectedStatusCode == http.StatusOK {
+					require.NoError(t, err)
+				} else {
+					require.Error(t, err)
+					cerr, ok := codersdk.AsError(err)
+					require.True(t, ok)
+					require.Equal(t, c.ExpectedStatusCode, cerr.StatusCode())
+				}
+			})
+		}
+	})
+}
diff --git a/enterprise/coderd/workspaceproxy.go b/enterprise/coderd/workspaceproxy.go
index 591f2fa33374f..49f0849b951b7 100644
--- a/enterprise/coderd/workspaceproxy.go
+++ b/enterprise/coderd/workspaceproxy.go
@@ -15,20 +15,22 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/buildinfo"
-	agpl "github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/audit"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/enterprise/coderd/proxyhealth"
-	"github.com/coder/coder/enterprise/replicasync"
-	"github.com/coder/coder/enterprise/wsproxy/wsproxysdk"
+	"github.com/coder/coder/v2/buildinfo"
+	agpl "github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/telemetry"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/enterprise/coderd/proxyhealth"
+	"github.com/coder/coder/v2/enterprise/replicasync"
+	"github.com/coder/coder/v2/enterprise/wsproxy/wsproxysdk"
 )
 
 // forceWorkspaceProxyHealthUpdate forces an update of the proxy health.
@@ -355,8 +357,8 @@ func (api *API) postWorkspaceProxy(rw http.ResponseWriter, r *http.Request) {
 		DerpEnabled: true,
 		// Disabled by default, but blah blah blah.
 		DerpOnly:  false,
-		CreatedAt: database.Now(),
-		UpdatedAt: database.Now(),
+		CreatedAt: dbtime.Now(),
+		UpdatedAt: dbtime.Now(),
 	})
 	if database.IsUniqueViolation(err, database.UniqueWorkspaceProxiesLowerNameIndex) {
 		httpapi.Write(ctx, rw, http.StatusConflict, codersdk.Response{
@@ -369,6 +371,10 @@ func (api *API) postWorkspaceProxy(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	api.Telemetry.Report(&telemetry.Snapshot{
+		WorkspaceProxies: []telemetry.WorkspaceProxy{telemetry.ConvertWorkspaceProxy(proxy)},
+	})
+
 	aReq.New = proxy
 	httpapi.Write(ctx, rw, http.StatusCreated, codersdk.UpdateWorkspaceProxyResponse{
 		Proxy: convertProxy(proxy, proxyhealth.ProxyStatus{
@@ -492,6 +498,36 @@ func (api *API) workspaceProxyIssueSignedAppToken(rw http.ResponseWriter, r *htt
 	})
 }
 
+// @Summary Report workspace app stats
+// @ID report-workspace-app-stats
+// @Security CoderSessionToken
+// @Accept json
+// @Tags Enterprise
+// @Param request body wsproxysdk.ReportAppStatsRequest true "Report app stats request"
+// @Success 204
+// @Router /workspaceproxies/me/app-stats [post]
+// @x-apidocgen {"skip": true}
+func (api *API) workspaceProxyReportAppStats(rw http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	_ = httpmw.WorkspaceProxy(r) // Ensure the proxy is authenticated.
+
+	var req wsproxysdk.ReportAppStatsRequest
+	if !httpapi.Read(ctx, rw, r, &req) {
+		return
+	}
+
+	api.Logger.Debug(ctx, "report app stats", slog.F("stats", req.Stats))
+
+	reporter := api.WorkspaceAppsStatsCollectorOptions.Reporter
+	if err := reporter.Report(ctx, req.Stats); err != nil {
+		api.Logger.Error(ctx, "report app stats failed", slog.Error(err))
+		httpapi.InternalServerError(rw, err)
+		return
+	}
+
+	httpapi.Write(ctx, rw, http.StatusNoContent, nil)
+}
+
 // workspaceProxyRegister is used to register a new workspace proxy. When a proxy
 // comes online, it will announce itself to this endpoint. This updates its values
 // in the database and returns a signed token that can be used to authenticate
@@ -536,9 +572,9 @@ func (api *API) workspaceProxyRegister(rw http.ResponseWriter, r *http.Request)
 	}
 
 	// Version check should be forced in non-dev builds and when running in
-	// tests.
+	// tests. Only Major + minor versions are checked.
 	shouldForceVersion := !buildinfo.IsDev() || flag.Lookup("test.v") != nil
-	if shouldForceVersion && req.Version != buildinfo.Version() {
+	if shouldForceVersion && !buildinfo.VersionsMatch(req.Version, buildinfo.Version()) {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 			Message: "Version mismatch.",
 			Detail:  fmt.Sprintf("Proxy version %q does not match primary server version %q", req.Version, buildinfo.Version()),
@@ -682,10 +718,12 @@ func (api *API) workspaceProxyRegister(rw http.ResponseWriter, r *http.Request)
 
 	// aReq.New = updatedProxy
 	httpapi.Write(ctx, rw, http.StatusCreated, wsproxysdk.RegisterWorkspaceProxyResponse{
-		AppSecurityKey:  api.AppSecurityKey.String(),
-		DERPMeshKey:     api.DERPServer.MeshKey(),
-		DERPRegionID:    regionID,
-		SiblingReplicas: siblingsRes,
+		AppSecurityKey:      api.AppSecurityKey.String(),
+		DERPMeshKey:         api.DERPServer.MeshKey(),
+		DERPRegionID:        regionID,
+		DERPMap:             api.AGPL.DERPMap(),
+		DERPForceWebSockets: api.DeploymentValues.DERP.Config.ForceWebSockets.Value(),
+		SiblingReplicas:     siblingsRes,
 	})
 
 	go api.forceWorkspaceProxyHealthUpdate(api.ctx)
diff --git a/enterprise/coderd/workspaceproxy_test.go b/enterprise/coderd/workspaceproxy_test.go
index 781ef3974ed15..386149902ad5d 100644
--- a/enterprise/coderd/workspaceproxy_test.go
+++ b/enterprise/coderd/workspaceproxy_test.go
@@ -14,21 +14,18 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"cdr.dev/slog"
-	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/enterprise/wsproxy/wsproxysdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/enterprise/wsproxy/wsproxysdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestRegions(t *testing.T) {
@@ -412,37 +409,6 @@ func TestProxyRegisterDeregister(t *testing.T) {
 		require.Error(t, err)
 	})
 
-	t.Run("BlockMismatchingVersion", func(t *testing.T) {
-		t.Parallel()
-
-		client, _ := setup(t)
-
-		ctx := testutil.Context(t, testutil.WaitLong)
-		createRes, err := client.CreateWorkspaceProxy(ctx, codersdk.CreateWorkspaceProxyRequest{
-			Name: "hi",
-		})
-		require.NoError(t, err)
-
-		proxyClient := wsproxysdk.New(client.URL)
-		proxyClient.SetSessionToken(createRes.ProxyToken)
-
-		_, err = proxyClient.RegisterWorkspaceProxy(ctx, wsproxysdk.RegisterWorkspaceProxyRequest{
-			AccessURL:           "https://proxy.coder.test",
-			WildcardHostname:    "*.proxy.coder.test",
-			DerpEnabled:         true,
-			ReplicaID:           uuid.New(),
-			ReplicaHostname:     "mars",
-			ReplicaError:        "",
-			ReplicaRelayAddress: "http://127.0.0.1:8080",
-			Version:             "v0.0.0",
-		})
-		require.Error(t, err)
-		var sdkErr *codersdk.Error
-		require.ErrorAs(t, err, &sdkErr)
-		require.Equal(t, http.StatusBadRequest, sdkErr.StatusCode())
-		require.Contains(t, sdkErr.Response.Message, "Version mismatch")
-	})
-
 	t.Run("ReregisterUpdateReplica", func(t *testing.T) {
 		t.Parallel()
 
@@ -671,23 +637,14 @@ func TestIssueSignedAppToken(t *testing.T) {
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	build := coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	workspace.LatestBuild = build
 
 	// Connect an agent to the workspace
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: slogtest.Make(t, nil).Named("agent").Leveled(slog.LevelDebug),
-	})
-	t.Cleanup(func() {
-		_ = agentCloser.Close()
-	})
-
-	coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+	_ = agenttest.New(t, client.URL, authToken)
+	_ = coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 	createProxyCtx := testutil.Context(t, testutil.WaitLong)
 	proxyRes, err := client.CreateWorkspaceProxy(createProxyCtx, codersdk.CreateWorkspaceProxyRequest{
@@ -780,23 +737,15 @@ func TestReconnectingPTYSignedToken(t *testing.T) {
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	build := coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	workspace.LatestBuild = build
 
 	// Connect an agent to the workspace
 	agentID := build.Resources[0].Agents[0].ID
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: slogtest.Make(t, nil).Named("agent").Leveled(slog.LevelDebug),
-	})
-	t.Cleanup(func() {
-		_ = agentCloser.Close()
-	})
-	coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+	_ = agenttest.New(t, client.URL, authToken)
+	_ = coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 	proxyURL, err := url.Parse(fmt.Sprintf("https://%s.com", namesgenerator.GetRandomName(1)))
 	require.NoError(t, err)
diff --git a/enterprise/coderd/workspaceproxycoordinate.go b/enterprise/coderd/workspaceproxycoordinate.go
index 919098a3d8b6a..501095d44477e 100644
--- a/enterprise/coderd/workspaceproxycoordinate.go
+++ b/enterprise/coderd/workspaceproxycoordinate.go
@@ -6,11 +6,11 @@ import (
 	"github.com/google/uuid"
 	"nhooyr.io/websocket"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/tailnet"
-	"github.com/coder/coder/enterprise/wsproxy/wsproxysdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/tailnet"
+	"github.com/coder/coder/v2/enterprise/wsproxy/wsproxysdk"
 )
 
 // @Summary Agent is legacy
@@ -68,7 +68,8 @@ func (api *API) workspaceProxyCoordinate(rw http.ResponseWriter, r *http.Request
 
 	id := uuid.New()
 	sub := (*api.AGPL.TailnetCoordinator.Load()).ServeMultiAgent(id)
-	nc := websocket.NetConn(ctx, conn, websocket.MessageText)
+
+	ctx, nc := websocketNetConn(ctx, conn, websocket.MessageText)
 	defer nc.Close()
 
 	err = tailnet.ServeWorkspaceProxy(ctx, nc, sub)
diff --git a/enterprise/coderd/workspaceproxycoordinator_test.go b/enterprise/coderd/workspaceproxycoordinator_test.go
index 6a2df0d6cd279..de72c288b2eee 100644
--- a/enterprise/coderd/workspaceproxycoordinator_test.go
+++ b/enterprise/coderd/workspaceproxycoordinator_test.go
@@ -13,14 +13,14 @@ import (
 	"tailscale.com/types/key"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/enterprise/wsproxy/wsproxysdk"
-	agpl "github.com/coder/coder/tailnet"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/enterprise/wsproxy/wsproxysdk"
+	agpl "github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // workspaceProxyCoordinate and agentIsLegacy are both tested by wsproxy tests.
diff --git a/enterprise/coderd/workspacequota.go b/enterprise/coderd/workspacequota.go
index 28198ca9a3570..44ea3f302ff37 100644
--- a/enterprise/coderd/workspacequota.go
+++ b/enterprise/coderd/workspacequota.go
@@ -3,20 +3,23 @@ package coderd
 import (
 	"context"
 	"database/sql"
+	"errors"
 	"net/http"
 
 	"github.com/google/uuid"
-	"golang.org/x/xerrors"
-
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/rbac"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisionerd/proto"
+
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisionerd/proto"
 )
 
 type committer struct {
+	Log      slog.Logger
 	Database database.Store
 }
 
@@ -28,12 +31,12 @@ func (c *committer) CommitQuota(
 		return nil, err
 	}
 
-	build, err := c.Database.GetWorkspaceBuildByJobID(ctx, jobID)
+	nextBuild, err := c.Database.GetWorkspaceBuildByJobID(ctx, jobID)
 	if err != nil {
 		return nil, err
 	}
 
-	workspace, err := c.Database.GetWorkspaceByID(ctx, build.WorkspaceID)
+	workspace, err := c.Database.GetWorkspaceByID(ctx, nextBuild.WorkspaceID)
 	if err != nil {
 		return nil, err
 	}
@@ -58,25 +61,35 @@ func (c *committer) CommitQuota(
 		// If the new build will reduce overall quota consumption, then we
 		// allow it even if the user is over quota.
 		netIncrease := true
-		previousBuild, err := s.GetWorkspaceBuildByWorkspaceIDAndBuildNumber(ctx, database.GetWorkspaceBuildByWorkspaceIDAndBuildNumberParams{
+		prevBuild, err := s.GetWorkspaceBuildByWorkspaceIDAndBuildNumber(ctx, database.GetWorkspaceBuildByWorkspaceIDAndBuildNumberParams{
 			WorkspaceID: workspace.ID,
-			BuildNumber: build.BuildNumber - 1,
+			BuildNumber: nextBuild.BuildNumber - 1,
 		})
 		if err == nil {
-			if build.DailyCost < previousBuild.DailyCost {
-				netIncrease = false
-			}
-		} else if !xerrors.Is(err, sql.ErrNoRows) {
+			netIncrease = request.DailyCost >= prevBuild.DailyCost
+			c.Log.Debug(
+				ctx, "previous build cost",
+				slog.F("prev_cost", prevBuild.DailyCost),
+				slog.F("next_cost", request.DailyCost),
+				slog.F("net_increase", netIncrease),
+			)
+		} else if !errors.Is(err, sql.ErrNoRows) {
 			return err
 		}
 
 		newConsumed := int64(request.DailyCost) + consumed
 		if newConsumed > budget && netIncrease {
+			c.Log.Debug(
+				ctx, "over quota, rejecting",
+				slog.F("prev_consumed", consumed),
+				slog.F("next_consumed", newConsumed),
+				slog.F("budget", budget),
+			)
 			return nil
 		}
 
 		err = s.UpdateWorkspaceBuildCostByID(ctx, database.UpdateWorkspaceBuildCostByIDParams{
-			ID:        build.ID,
+			ID:        nextBuild.ID,
 			DailyCost: request.DailyCost,
 		})
 		if err != nil {
diff --git a/enterprise/coderd/workspacequota_test.go b/enterprise/coderd/workspacequota_test.go
index a142c86535c4d..2d99a4ce31ac5 100644
--- a/enterprise/coderd/workspacequota_test.go
+++ b/enterprise/coderd/workspacequota_test.go
@@ -9,13 +9,15 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func verifyQuota(ctx context.Context, t *testing.T, client *codersdk.Client, consumed, total int) {
@@ -30,12 +32,13 @@ func verifyQuota(ctx context.Context, t *testing.T, client *codersdk.Client, con
 }
 
 func TestWorkspaceQuota(t *testing.T) {
-	// TODO: refactor for new impl
-
 	t.Parallel()
 
-	t.Run("BlocksBuild", func(t *testing.T) {
+	// This first test verifies the behavior of creating and deleting workspaces.
+	// It also tests multi-group quota stacking and the everyone group.
+	t.Run("CreateDelete", func(t *testing.T) {
 		t.Parallel()
+
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 		max := 1
@@ -48,12 +51,17 @@ func TestWorkspaceQuota(t *testing.T) {
 			},
 		})
 		coderdtest.NewProvisionerDaemon(t, api.AGPL)
-		coderdtest.NewProvisionerDaemon(t, api.AGPL)
-		coderdtest.NewProvisionerDaemon(t, api.AGPL)
 
 		verifyQuota(ctx, t, client, 0, 0)
 
-		// Add user to two groups, granting them a total budget of 3.
+		// Patch the 'Everyone' group to verify its quota allowance is being accounted for.
+		_, err := client.PatchGroup(ctx, user.OrganizationID, codersdk.PatchGroupRequest{
+			QuotaAllowance: ptr.Ref(1),
+		})
+		require.NoError(t, err)
+		verifyQuota(ctx, t, client, 0, 1)
+
+		// Add user to two groups, granting them a total budget of 4.
 		group1, err := client.CreateGroup(ctx, user.OrganizationID, codersdk.CreateGroupRequest{
 			Name:           "test-1",
 			QuotaAllowance: 1,
@@ -76,14 +84,14 @@ func TestWorkspaceQuota(t *testing.T) {
 		})
 		require.NoError(t, err)
 
-		verifyQuota(ctx, t, client, 0, 3)
+		verifyQuota(ctx, t, client, 0, 4)
 
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse: echo.ParseComplete,
-			ProvisionApply: []*proto.Provision_Response{{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
+			ProvisionApply: []*proto.Response{{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
 						Resources: []*proto.Resource{{
 							Name:      "example",
 							Type:      "aws_instance",
@@ -100,29 +108,29 @@ func TestWorkspaceQuota(t *testing.T) {
 				},
 			}},
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 
 		// Spin up three workspaces fine
 		var wg sync.WaitGroup
-		for i := 0; i < 3; i++ {
+		for i := 0; i < 4; i++ {
 			wg.Add(1)
 			go func() {
 				defer wg.Done()
 				workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-				build := coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+				build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 				assert.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
 			}()
 		}
 		wg.Wait()
-		verifyQuota(ctx, t, client, 3, 3)
+		verifyQuota(ctx, t, client, 4, 4)
 
 		// Next one must fail
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		// Consumed shouldn't bump
-		verifyQuota(ctx, t, client, 3, 3)
+		verifyQuota(ctx, t, client, 4, 4)
 		require.Equal(t, codersdk.WorkspaceStatusFailed, build.Status)
 		require.Contains(t, build.Job.Error, "quota")
 
@@ -137,16 +145,120 @@ func TestWorkspaceQuota(t *testing.T) {
 				Transition: codersdk.WorkspaceTransitionDelete,
 			})
 			require.NoError(t, err)
-			coderdtest.AwaitWorkspaceBuildJob(t, client, build.ID)
-			verifyQuota(ctx, t, client, 2, 3)
+			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
+			verifyQuota(ctx, t, client, 3, 4)
 			break
 		}
 
 		// Next one should now succeed
 		workspace = coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		build = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		verifyQuota(ctx, t, client, 4, 4)
+		require.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
+	})
+
+	t.Run("StartStop", func(t *testing.T) {
+		t.Parallel()
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+		max := 1
+		client, _, api, user := coderdenttest.NewWithAPI(t, &coderdenttest.Options{
+			UserWorkspaceQuota: max,
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{
+					codersdk.FeatureTemplateRBAC: 1,
+				},
+			},
+		})
+		coderdtest.NewProvisionerDaemon(t, api.AGPL)
+
+		verifyQuota(ctx, t, client, 0, 0)
+
+		// Patch the 'Everyone' group to verify its quota allowance is being accounted for.
+		_, err := client.PatchGroup(ctx, user.OrganizationID, codersdk.PatchGroupRequest{
+			QuotaAllowance: ptr.Ref(4),
+		})
+		require.NoError(t, err)
+		verifyQuota(ctx, t, client, 0, 4)
+
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse: echo.ParseComplete,
+			ProvisionPlanMap: map[proto.WorkspaceTransition][]*proto.Response{
+				proto.WorkspaceTransition_START: planWithCost(2),
+				proto.WorkspaceTransition_STOP:  planWithCost(1),
+			},
+			ProvisionApplyMap: map[proto.WorkspaceTransition][]*proto.Response{
+				proto.WorkspaceTransition_START: applyWithCost(2),
+				proto.WorkspaceTransition_STOP:  applyWithCost(1),
+			},
+		})
 
-		verifyQuota(ctx, t, client, 3, 3)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+
+		// Spin up two workspaces.
+		var wg sync.WaitGroup
+		var workspaces []codersdk.Workspace
+		for i := 0; i < 2; i++ {
+			workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+			workspaces = append(workspaces, workspace)
+			build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+			assert.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
+		}
+		wg.Wait()
+		verifyQuota(ctx, t, client, 4, 4)
+
+		// Next one must fail
+		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+		require.Contains(t, build.Job.Error, "quota")
+
+		// Consumed shouldn't bump
+		verifyQuota(ctx, t, client, 4, 4)
+		require.Equal(t, codersdk.WorkspaceStatusFailed, build.Status)
+
+		build = coderdtest.CreateWorkspaceBuild(t, client, workspaces[0], database.WorkspaceTransitionStop)
+		build = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
+
+		// Quota goes down one
+		verifyQuota(ctx, t, client, 3, 4)
+		require.Equal(t, codersdk.WorkspaceStatusStopped, build.Status)
+
+		build = coderdtest.CreateWorkspaceBuild(t, client, workspaces[0], database.WorkspaceTransitionStart)
+		build = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
+
+		// Quota goes back up
+		verifyQuota(ctx, t, client, 4, 4)
 		require.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
 	})
 }
+
+func planWithCost(cost int32) []*proto.Response {
+	return []*proto.Response{{
+		Type: &proto.Response_Plan{
+			Plan: &proto.PlanComplete{
+				Resources: []*proto.Resource{{
+					Name:      "example",
+					Type:      "aws_instance",
+					DailyCost: cost,
+				}},
+			},
+		},
+	}}
+}
+
+func applyWithCost(cost int32) []*proto.Response {
+	return []*proto.Response{{
+		Type: &proto.Response_Apply{
+			Apply: &proto.ApplyComplete{
+				Resources: []*proto.Resource{{
+					Name:      "example",
+					Type:      "aws_instance",
+					DailyCost: cost,
+				}},
+			},
+		},
+	}}
+}
diff --git a/enterprise/coderd/workspaces_test.go b/enterprise/coderd/workspaces_test.go
index 07e501032f9e0..a80107d379e74 100644
--- a/enterprise/coderd/workspaces_test.go
+++ b/enterprise/coderd/workspaces_test.go
@@ -2,8 +2,9 @@ package coderd_test
 
 import (
 	"context"
-	"fmt"
+	"encoding/json"
 	"net/http"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -11,19 +12,31 @@ import (
 
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/coderd/autobuild"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/database"
-	agplschedule "github.com/coder/coder/coderd/schedule"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/enterprise/coderd/schedule"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/audit"
+	"github.com/coder/coder/v2/coderd/autobuild"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	agplschedule "github.com/coder/coder/v2/coderd/schedule"
+	"github.com/coder/coder/v2/coderd/schedule/cron"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/enterprise/coderd/schedule"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
 )
 
+// agplUserQuietHoursScheduleStore is passed to
+// NewEnterpriseTemplateScheduleStore as we don't care about updating the
+// schedule and having it recalculate the build deadline in these tests.
+func agplUserQuietHoursScheduleStore() *atomic.Pointer[agplschedule.UserQuietHoursScheduleStore] {
+	store := agplschedule.NewAGPLUserQuietHoursScheduleStore()
+	p := &atomic.Pointer[agplschedule.UserQuietHoursScheduleStore]{}
+	p.Store(&store)
+	return p
+}
+
 func TestCreateWorkspace(t *testing.T) {
 	t.Parallel()
 
@@ -100,7 +113,7 @@ func TestWorkspaceAutobuild(t *testing.T) {
 				AutobuildTicker:          ticker,
 				IncludeProvisionerDaemon: true,
 				AutobuildStats:           statCh,
-				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(),
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
@@ -109,15 +122,15 @@ func TestWorkspaceAutobuild(t *testing.T) {
 
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionFailed,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyFailed,
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 			ctr.FailureTTLMillis = ptr.Ref[int64](failureTTL.Milliseconds())
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		require.Equal(t, codersdk.WorkspaceStatusFailed, build.Status)
 		ticker <- build.Job.CompletedAt.Add(failureTTL * 2)
 		stats := <-statCh
@@ -147,7 +160,7 @@ func TestWorkspaceAutobuild(t *testing.T) {
 				AutobuildTicker:          ticker,
 				IncludeProvisionerDaemon: true,
 				AutobuildStats:           statCh,
-				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(),
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
@@ -155,15 +168,15 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		})
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionFailed,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyFailed,
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
 			ctr.FailureTTLMillis = ptr.Ref[int64](failureTTL.Milliseconds())
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		require.Equal(t, codersdk.WorkspaceStatusFailed, build.Status)
 		// Make it impossible to trigger the failure TTL.
 		ticker <- build.Job.CompletedAt.Add(-failureTTL * 2)
@@ -193,7 +206,7 @@ func TestWorkspaceAutobuild(t *testing.T) {
 				AutobuildTicker:          ticker,
 				IncludeProvisionerDaemon: true,
 				AutobuildStats:           statCh,
-				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(),
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
@@ -201,18 +214,18 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		})
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 		// Create a template without setting a failure_ttl.
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		require.Zero(t, template.InactivityTTLMillis)
+		require.Zero(t, template.TimeTilDormantMillis)
 		require.Zero(t, template.FailureTTLMillis)
-		require.Zero(t, template.LockedTTLMillis)
+		require.Zero(t, template.TimeTilDormantAutoDeleteMillis)
 
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		require.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
 		ticker <- time.Now()
 		stats := <-statCh
@@ -224,10 +237,11 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		t.Parallel()
 
 		var (
-			ctx         = testutil.Context(t, testutil.WaitMedium)
-			ticker      = make(chan time.Time)
-			statCh      = make(chan autobuild.Stats)
-			inactiveTTL = time.Minute
+			ctx           = testutil.Context(t, testutil.WaitMedium)
+			ticker        = make(chan time.Time)
+			statCh        = make(chan autobuild.Stats)
+			inactiveTTL   = time.Minute
+			auditRecorder = audit.NewMock()
 		)
 
 		client, user := coderdenttest.New(t, &coderdenttest.Options{
@@ -235,7 +249,8 @@ func TestWorkspaceAutobuild(t *testing.T) {
 				AutobuildTicker:          ticker,
 				IncludeProvisionerDaemon: true,
 				AutobuildStats:           statCh,
-				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(),
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
+				Auditor:                  auditRecorder,
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
@@ -244,17 +259,20 @@ func TestWorkspaceAutobuild(t *testing.T) {
 
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
-			ctr.InactivityTTLMillis = ptr.Ref[int64](inactiveTTL.Milliseconds())
+			ctr.TimeTilDormantMillis = ptr.Ref[int64](inactiveTTL.Milliseconds())
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		require.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
+
+		// Reset the audit log so we can verify a log is generated.
+		auditRecorder.ResetLogs()
 		// Simulate being inactive.
 		ticker <- ws.LastUsedAt.Add(inactiveTTL * 2)
 		stats := <-statCh
@@ -263,13 +281,23 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		// failure TTL.
 		require.Len(t, stats.Transitions, 1)
 		require.Equal(t, stats.Transitions[ws.ID], database.WorkspaceTransitionStop)
+		require.Len(t, auditRecorder.AuditLogs(), 1)
+
+		auditLog := auditRecorder.AuditLogs()[0]
+		require.Equal(t, auditLog.Action, database.AuditActionWrite)
+
+		var fields audit.AdditionalFields
+		err := json.Unmarshal(auditLog.AdditionalFields, &fields)
+		require.NoError(t, err)
+		require.Equal(t, ws.Name, fields.WorkspaceName)
+		require.Equal(t, database.BuildReasonAutolock, fields.BuildReason)
 
-		// The workspace should be locked.
+		// The workspace should be dormant.
 		ws = coderdtest.MustWorkspace(t, client, ws.ID)
-		require.NotNil(t, ws.LockedAt)
+		require.NotNil(t, ws.DormantAt)
 		lastUsedAt := ws.LastUsedAt
 
-		err := client.UpdateWorkspaceLock(ctx, ws.ID, codersdk.UpdateWorkspaceLock{Lock: false})
+		err = client.UpdateWorkspaceDormancy(ctx, ws.ID, codersdk.UpdateWorkspaceDormancy{Dormant: false})
 		require.NoError(t, err)
 
 		// Assert that we updated our last_used_at so that we don't immediately
@@ -292,7 +320,7 @@ func TestWorkspaceAutobuild(t *testing.T) {
 				AutobuildTicker:          ticker,
 				IncludeProvisionerDaemon: true,
 				AutobuildStats:           statCh,
-				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(),
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
@@ -300,15 +328,15 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		})
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
-			ctr.InactivityTTLMillis = ptr.Ref[int64](inactiveTTL.Milliseconds())
+			ctr.TimeTilDormantMillis = ptr.Ref[int64](inactiveTTL.Milliseconds())
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		require.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
 		// Make it impossible to trigger the inactive ttl.
 		ticker <- ws.LastUsedAt.Add(-inactiveTTL)
@@ -320,13 +348,13 @@ func TestWorkspaceAutobuild(t *testing.T) {
 	// This is kind of a dumb test but it exists to offer some marginal
 	// confidence that a bug in the auto-deletion logic doesn't delete running
 	// workspaces.
-	t.Run("UnlockedWorkspacesNotDeleted", func(t *testing.T) {
+	t.Run("ActiveWorkspacesNotDeleted", func(t *testing.T) {
 		t.Parallel()
 
 		var (
-			ticker    = make(chan time.Time)
-			statCh    = make(chan autobuild.Stats)
-			lockedTTL = time.Minute
+			ticker        = make(chan time.Time)
+			statCh        = make(chan autobuild.Stats)
+			autoDeleteTTL = time.Minute
 		)
 
 		client, user := coderdenttest.New(t, &coderdenttest.Options{
@@ -334,7 +362,7 @@ func TestWorkspaceAutobuild(t *testing.T) {
 				AutobuildTicker:          ticker,
 				IncludeProvisionerDaemon: true,
 				AutobuildStats:           statCh,
-				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(),
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
@@ -342,20 +370,20 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		})
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
-			ctr.LockedTTLMillis = ptr.Ref[int64](lockedTTL.Milliseconds())
+			ctr.TimeTilDormantAutoDeleteMillis = ptr.Ref[int64](autoDeleteTTL.Milliseconds())
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
-		require.Nil(t, ws.LockedAt)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
+		require.Nil(t, ws.DormantAt)
 		require.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
-		ticker <- ws.LastUsedAt.Add(lockedTTL * 2)
+		ticker <- ws.LastUsedAt.Add(autoDeleteTTL * 2)
 		stats := <-statCh
-		// Expect no transitions since workspace is unlocked.
+		// Expect no transitions since workspace is active.
 		require.Len(t, stats.Transitions, 0)
 	})
 
@@ -376,7 +404,7 @@ func TestWorkspaceAutobuild(t *testing.T) {
 				AutobuildTicker:          ticker,
 				IncludeProvisionerDaemon: true,
 				AutobuildStats:           statCh,
-				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(),
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
@@ -384,16 +412,16 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		})
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
-			ctr.InactivityTTLMillis = ptr.Ref[int64](inactiveTTL.Milliseconds())
+			ctr.TimeTilDormantMillis = ptr.Ref[int64](inactiveTTL.Milliseconds())
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		require.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
 
 		// Stop the workspace so we can assert autobuild does nothing
@@ -406,13 +434,13 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		// Expect no transitions since workspace is stopped.
 		require.Len(t, stats.Transitions, 0)
 		ws = coderdtest.MustWorkspace(t, client, ws.ID)
-		// The workspace should still be locked even though we didn't
+		// The workspace should still be dormant even though we didn't
 		// transition the workspace.
-		require.NotNil(t, ws.LockedAt)
+		require.NotNil(t, ws.DormantAt)
 	})
 
 	// Test the flow of a workspace transitioning from
-	// inactive -> locked -> deleted.
+	// inactive -> dormant -> deleted.
 	t.Run("WorkspaceInactiveDeleteTransition", func(t *testing.T) {
 		t.Parallel()
 
@@ -427,7 +455,7 @@ func TestWorkspaceAutobuild(t *testing.T) {
 				AutobuildTicker:          ticker,
 				IncludeProvisionerDaemon: true,
 				AutobuildStats:           statCh,
-				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(),
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
@@ -436,17 +464,17 @@ func TestWorkspaceAutobuild(t *testing.T) {
 
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
-			ctr.InactivityTTLMillis = ptr.Ref[int64](transitionTTL.Milliseconds())
-			ctr.LockedTTLMillis = ptr.Ref[int64](transitionTTL.Milliseconds())
+			ctr.TimeTilDormantMillis = ptr.Ref[int64](transitionTTL.Milliseconds())
+			ctr.TimeTilDormantAutoDeleteMillis = ptr.Ref[int64](transitionTTL.Milliseconds())
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		require.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
 
 		// Simulate not having accessed the workspace in a while.
@@ -458,14 +486,14 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		require.Equal(t, stats.Transitions[ws.ID], database.WorkspaceTransitionStop)
 
 		ws = coderdtest.MustWorkspace(t, client, ws.ID)
-		// The workspace should be locked.
-		require.NotNil(t, ws.LockedAt)
+		// The workspace should be dormant.
+		require.NotNil(t, ws.DormantAt)
 
 		// Wait for the autobuilder to stop the workspace.
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 
-		// Simulate the workspace being locked beyond the threshold.
-		ticker <- ws.LockedAt.Add(2 * transitionTTL)
+		// Simulate the workspace being dormant beyond the threshold.
+		ticker <- ws.DormantAt.Add(2 * transitionTTL)
 		stats = <-statCh
 		require.Len(t, stats.Transitions, 1)
 		// The workspace should be scheduled for deletion.
@@ -473,7 +501,7 @@ func TestWorkspaceAutobuild(t *testing.T) {
 
 		// Wait for the workspace to be deleted.
 		ws = coderdtest.MustWorkspace(t, client, ws.ID)
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 
 		// Assert that the workspace is actually deleted.
 		_, err := client.Workspace(testutil.Context(t, testutil.WaitShort), ws.ID)
@@ -483,13 +511,13 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		require.Equal(t, http.StatusGone, cerr.StatusCode())
 	})
 
-	t.Run("LockedTTTooEarly", func(t *testing.T) {
+	t.Run("DormantTTLTooEarly", func(t *testing.T) {
 		t.Parallel()
 
 		var (
-			ticker    = make(chan time.Time)
-			statCh    = make(chan autobuild.Stats)
-			lockedTTL = time.Minute
+			ticker     = make(chan time.Time)
+			statCh     = make(chan autobuild.Stats)
+			dormantTTL = time.Minute
 		)
 
 		client, user := coderdenttest.New(t, &coderdenttest.Options{
@@ -497,7 +525,7 @@ func TestWorkspaceAutobuild(t *testing.T) {
 				AutobuildTicker:          ticker,
 				IncludeProvisionerDaemon: true,
 				AutobuildStats:           statCh,
-				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(),
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
@@ -505,46 +533,46 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		})
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
-			ctr.LockedTTLMillis = ptr.Ref[int64](lockedTTL.Milliseconds())
+			ctr.TimeTilDormantAutoDeleteMillis = ptr.Ref[int64](dormantTTL.Milliseconds())
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		build := coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		require.Equal(t, codersdk.WorkspaceStatusRunning, build.Status)
 
 		ctx := testutil.Context(t, testutil.WaitMedium)
-		err := client.UpdateWorkspaceLock(ctx, ws.ID, codersdk.UpdateWorkspaceLock{
-			Lock: true,
+		err := client.UpdateWorkspaceDormancy(ctx, ws.ID, codersdk.UpdateWorkspaceDormancy{
+			Dormant: true,
 		})
 		require.NoError(t, err)
 
 		ws = coderdtest.MustWorkspace(t, client, ws.ID)
-		require.NotNil(t, ws.LockedAt)
+		require.NotNil(t, ws.DormantAt)
 
 		// Ensure we haven't breached our threshold.
-		ticker <- ws.LockedAt.Add(-lockedTTL * 2)
+		ticker <- ws.DormantAt.Add(-dormantTTL * 2)
 		stats := <-statCh
 		// Expect no transitions since not enough time has elapsed.
 		require.Len(t, stats.Transitions, 0)
 
 		_, err = client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
-			LockedTTLMillis: lockedTTL.Milliseconds(),
+			TimeTilDormantAutoDeleteMillis: dormantTTL.Milliseconds(),
 		})
 		require.NoError(t, err)
 
 		// Simlute the workspace breaching the threshold.
-		ticker <- ws.LockedAt.Add(lockedTTL * 2)
+		ticker <- ws.DormantAt.Add(dormantTTL * 2)
 		stats = <-statCh
 		require.Len(t, stats.Transitions, 1)
 		require.Equal(t, database.WorkspaceTransitionDelete, stats.Transitions[ws.ID])
 	})
 
-	// Assert that a locked workspace does not autostart.
-	t.Run("LockedNoAutostart", func(t *testing.T) {
+	// Assert that a dormant workspace does not autostart.
+	t.Run("DormantNoAutostart", func(t *testing.T) {
 		t.Parallel()
 
 		var (
@@ -558,7 +586,7 @@ func TestWorkspaceAutobuild(t *testing.T) {
 				AutobuildTicker:          tickCh,
 				IncludeProvisionerDaemon: true,
 				AutobuildStats:           statsCh,
-				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(),
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
@@ -567,23 +595,23 @@ func TestWorkspaceAutobuild(t *testing.T) {
 
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:          echo.ParseComplete,
-			ProvisionPlan:  echo.ProvisionComplete,
-			ProvisionApply: echo.ProvisionComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 
-		sched, err := agplschedule.Weekly("CRON_TZ=UTC 0 * * * *")
+		sched, err := cron.Weekly("CRON_TZ=UTC 0 * * * *")
 		require.NoError(t, err)
 
 		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 			cwr.AutostartSchedule = ptr.Ref(sched.String())
 		})
-		coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		coderdtest.MustTransitionWorkspace(t, client, ws.ID, database.WorkspaceTransitionStart, database.WorkspaceTransitionStop)
 
-		// Assert that autostart works when the workspace isn't locked..
+		// Assert that autostart works when the workspace isn't dormant..
 		tickCh <- sched.Next(ws.LatestBuild.CreatedAt)
 		stats := <-statsCh
 		require.NoError(t, stats.Error)
@@ -592,12 +620,12 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		require.Equal(t, database.WorkspaceTransitionStart, stats.Transitions[ws.ID])
 
 		ws = coderdtest.MustWorkspace(t, client, ws.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 
 		// Now that we've validated that the workspace is eligible for autostart
-		// lets cause it to become locked.
+		// lets cause it to become dormant.
 		_, err = client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
-			InactivityTTLMillis: inactiveTTL.Milliseconds(),
+			TimeTilDormantMillis: inactiveTTL.Milliseconds(),
 		})
 		require.NoError(t, err)
 
@@ -609,78 +637,369 @@ func TestWorkspaceAutobuild(t *testing.T) {
 		require.Contains(t, stats.Transitions, ws.ID)
 		require.Equal(t, database.WorkspaceTransitionStop, stats.Transitions[ws.ID])
 
-		// The workspace should be locked now.
+		// The workspace should be dormant now.
 		ws = coderdtest.MustWorkspace(t, client, ws.ID)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
-		require.NotNil(t, ws.LockedAt)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
+		require.NotNil(t, ws.DormantAt)
 
-		// Assert that autostart is no longer triggered since workspace is locked.
+		// Assert that autostart is no longer triggered since workspace is dormant.
 		tickCh <- sched.Next(ws.LatestBuild.CreatedAt)
 		stats = <-statsCh
 		require.Len(t, stats.Transitions, 0)
 	})
-}
 
-func TestWorkspacesFiltering(t *testing.T) {
-	t.Parallel()
-
-	t.Run("DeletingBy", func(t *testing.T) {
+	// Test that failing to auto-delete a workspace will only retry
+	// once a day.
+	t.Run("FailedDeleteRetryDaily", func(t *testing.T) {
 		t.Parallel()
 
-		lockedTTL := 24 * time.Hour
+		var (
+			ticker        = make(chan time.Time)
+			statCh        = make(chan autobuild.Stats)
+			transitionTTL = time.Minute
+			ctx           = testutil.Context(t, testutil.WaitMedium)
+		)
 
 		client, user := coderdenttest.New(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
+				AutobuildTicker:          ticker,
 				IncludeProvisionerDaemon: true,
+				AutobuildStats:           statCh,
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
-				Features: license.Features{
-					codersdk.FeatureAdvancedTemplateScheduling: 1,
-				},
+				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
 			},
 		})
 
-		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-		_ = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		// Create a template version that passes to get a functioning workspace.
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 
-		// update template with inactivity ttl
-		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-		defer cancel()
+		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
+
+		// Create a new version that will fail when we try to delete a workspace.
+		version = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyFailed,
+		}, func(ctvr *codersdk.CreateTemplateVersionRequest) {
+			ctvr.TemplateID = template.ID
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
-		template, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
-			LockedTTLMillis: lockedTTL.Milliseconds(),
+		// Try to delete the workspace. This simulates a "failed" autodelete.
+		build, err := client.CreateWorkspaceBuild(ctx, ws.ID, codersdk.CreateWorkspaceBuildRequest{
+			Transition:        codersdk.WorkspaceTransitionDelete,
+			TemplateVersionID: version.ID,
 		})
 		require.NoError(t, err)
-		require.Equal(t, lockedTTL.Milliseconds(), template.LockedTTLMillis)
 
-		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		build = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, build.ID)
+		require.NotEmpty(t, build.Job.Error)
 
-		// stop build so workspace is inactive
-		stopBuild := coderdtest.CreateWorkspaceBuild(t, client, workspace, database.WorkspaceTransitionStop)
-		coderdtest.AwaitWorkspaceBuildJob(t, client, stopBuild.ID)
-		err = client.UpdateWorkspaceLock(ctx, workspace.ID, codersdk.UpdateWorkspaceLock{
-			Lock: true,
+		// Update our workspace to be dormant so that it qualifies for auto-deletion.
+		err = client.UpdateWorkspaceDormancy(ctx, ws.ID, codersdk.UpdateWorkspaceDormancy{
+			Dormant: true,
 		})
 		require.NoError(t, err)
-		workspace = coderdtest.MustWorkspace(t, client, workspace.ID)
-		require.NotNil(t, workspace.DeletingAt)
 
-		res, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{
-			// adding a second to time.Now() to give some buffer in case test runs quickly
-			FilterQuery: fmt.Sprintf("deleting_by:%s", time.Now().Add(time.Second).Add(lockedTTL).Format("2006-01-02")),
+		// Enable auto-deletion for the template.
+		_, err = client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+			TimeTilDormantAutoDeleteMillis: transitionTTL.Milliseconds(),
+		})
+		require.NoError(t, err)
+
+		ws = coderdtest.MustWorkspace(t, client, ws.ID)
+		require.NotNil(t, ws.DeletingAt)
+
+		// Simulate ticking an hour after the workspace is expected to be deleted.
+		// Under normal circumstances this should result in a transition but
+		// since our last build resulted in failure it should be skipped.
+		ticker <- build.Job.CompletedAt.Add(time.Hour)
+		stats := <-statCh
+		require.Len(t, stats.Transitions, 0)
+
+		// Simulate ticking a day after the workspace was last attempted to
+		// be deleted. This should result in an attempt.
+		ticker <- build.Job.CompletedAt.Add(time.Hour * 25)
+		stats = <-statCh
+		require.Len(t, stats.Transitions, 1)
+		require.Equal(t, database.WorkspaceTransitionDelete, stats.Transitions[ws.ID])
+	})
+
+	t.Run("RequireActiveVersion", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			tickCh  = make(chan time.Time)
+			statsCh = make(chan autobuild.Stats)
+			ctx     = testutil.Context(t, testutil.WaitMedium)
+		)
+
+		client, user := coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				AutobuildTicker:          tickCh,
+				IncludeProvisionerDaemon: true,
+				AutobuildStats:           statsCh,
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
+			},
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{codersdk.FeatureAccessControl: 1},
+			},
+		})
+
+		sched, err := cron.Weekly("CRON_TZ=UTC 0 * * * *")
+		require.NoError(t, err)
+
+		// Create a template version1 that passes to get a functioning workspace.
+		version1 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version1.ID)
+
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version1.ID)
+		require.Equal(t, version1.ID, template.ActiveVersionID)
+
+		ws := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
+			cwr.AutostartSchedule = ptr.Ref(sched.String())
+		})
+
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
+		ws = coderdtest.MustTransitionWorkspace(t, client, ws.ID, database.WorkspaceTransitionStart, database.WorkspaceTransitionStop)
+
+		// Create a new version so that we can assert we don't update
+		// to the latest by default.
+		version2 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil, func(ctvr *codersdk.CreateTemplateVersionRequest) {
+			ctvr.TemplateID = template.ID
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version2.ID)
+
+		// Make sure to promote it.
+		err = client.UpdateActiveTemplateVersion(ctx, template.ID, codersdk.UpdateActiveTemplateVersion{
+			ID: version2.ID,
+		})
+		require.NoError(t, err)
+
+		// Kick of an autostart build.
+		tickCh <- sched.Next(ws.LatestBuild.CreatedAt)
+		stats := <-statsCh
+		require.NoError(t, stats.Error)
+		require.Len(t, stats.Transitions, 1)
+		require.Contains(t, stats.Transitions, ws.ID)
+		require.Equal(t, database.WorkspaceTransitionStart, stats.Transitions[ws.ID])
+
+		// Validate that we didn't update to the promoted version.
+		started := coderdtest.MustWorkspace(t, client, ws.ID)
+		firstBuild := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, started.LatestBuild.ID)
+		require.Equal(t, version1.ID, firstBuild.TemplateVersionID)
+
+		// Update the template to require the promoted version.
+		_, err = client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+			RequireActiveVersion: true,
+			AllowUserAutostart:   true,
+		})
+		require.NoError(t, err)
+
+		// Reset the workspace to the stopped state so we can try
+		// to autostart again.
+		coderdtest.MustTransitionWorkspace(t, client, ws.ID, database.WorkspaceTransitionStart, database.WorkspaceTransitionStop, func(req *codersdk.CreateWorkspaceBuildRequest) {
+			req.TemplateVersionID = ws.LatestBuild.TemplateVersionID
+		})
+
+		// Force an autostart transition again.
+		tickCh <- sched.Next(firstBuild.CreatedAt)
+		stats = <-statsCh
+		require.NoError(t, stats.Error)
+		require.Len(t, stats.Transitions, 1)
+		require.Contains(t, stats.Transitions, ws.ID)
+		require.Equal(t, database.WorkspaceTransitionStart, stats.Transitions[ws.ID])
+
+		// Validate that we are using the promoted version.
+		ws = coderdtest.MustWorkspace(t, client, ws.ID)
+		require.Equal(t, version2.ID, ws.LatestBuild.TemplateVersionID)
+	})
+}
+
+// Blocked by autostart requirements
+func TestExecutorAutostartBlocked(t *testing.T) {
+	t.Parallel()
+
+	now := time.Now()
+	var allowed []string
+	for _, day := range agplschedule.DaysOfWeek {
+		// Skip the day the workspace was created on and if the next day is within 2
+		// hours, skip that too. The cron scheduler will start the workspace every hour,
+		// so it can span into the next day.
+		if day != now.UTC().Weekday() &&
+			day != now.UTC().Add(time.Hour*2).Weekday() {
+			allowed = append(allowed, day.String())
+		}
+	}
+
+	var (
+		sched         = must(cron.Weekly("CRON_TZ=UTC 0 * * * *"))
+		tickCh        = make(chan time.Time)
+		statsCh       = make(chan autobuild.Stats)
+		client, owner = coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				AutobuildTicker:          tickCh,
+				IncludeProvisionerDaemon: true,
+				AutobuildStats:           statsCh,
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
+			},
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
+			},
+		})
+		version  = coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, nil)
+		template = coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID, func(request *codersdk.CreateTemplateRequest) {
+			request.AutostartRequirement = &codersdk.TemplateAutostartRequirement{
+				DaysOfWeek: allowed,
+			}
+		})
+		_         = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		workspace = coderdtest.CreateWorkspace(t, client, owner.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
+			cwr.AutostartSchedule = ptr.Ref(sched.String())
+		})
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+	)
+
+	// Given: workspace is stopped
+	workspace = coderdtest.MustTransitionWorkspace(t, client, workspace.ID, database.WorkspaceTransitionStart, database.WorkspaceTransitionStop)
+
+	// When: the autobuild executor ticks way into the future
+	go func() {
+		tickCh <- workspace.LatestBuild.CreatedAt.Add(24 * time.Hour)
+		close(tickCh)
+	}()
+
+	// Then: the workspace should not be started.
+	stats := <-statsCh
+	require.NoError(t, stats.Error)
+	require.Len(t, stats.Transitions, 0)
+}
+
+func TestWorkspacesFiltering(t *testing.T) {
+	t.Parallel()
+
+	t.Run("IsDormant", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitMedium)
+		client, user := coderdenttest.New(t, &coderdenttest.Options{
+			Options: &coderdtest.Options{
+				IncludeProvisionerDaemon: true,
+				TemplateScheduleStore:    schedule.NewEnterpriseTemplateScheduleStore(agplUserQuietHoursScheduleStore()),
+			},
+			LicenseOptions: &coderdenttest.LicenseOptions{
+				Features: license.Features{codersdk.FeatureAdvancedTemplateScheduling: 1},
+			},
+		})
+
+		// Create a template version that passes to get a functioning workspace.
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionPlan:  echo.PlanComplete,
+			ProvisionApply: echo.ApplyComplete,
 		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+
+		dormantWS1 := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, dormantWS1.LatestBuild.ID)
+
+		dormantWS2 := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, dormantWS2.LatestBuild.ID)
+
+		activeWS := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, activeWS.LatestBuild.ID)
+
+		err := client.UpdateWorkspaceDormancy(ctx, dormantWS1.ID, codersdk.UpdateWorkspaceDormancy{Dormant: true})
 		require.NoError(t, err)
-		require.Len(t, res.Workspaces, 1)
-		require.Equal(t, workspace.ID, res.Workspaces[0].ID)
+
+		err = client.UpdateWorkspaceDormancy(ctx, dormantWS2.ID, codersdk.UpdateWorkspaceDormancy{Dormant: true})
+		require.NoError(t, err)
+
+		resp, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{
+			FilterQuery: "is-dormant:true",
+		})
+		require.NoError(t, err)
+		require.Len(t, resp.Workspaces, 2)
+
+		for _, ws := range resp.Workspaces {
+			if ws.ID != dormantWS1.ID && ws.ID != dormantWS2.ID {
+				t.Fatalf("Unexpected workspace %+v", ws)
+			}
+		}
 	})
 }
 
+// TestWorkspacesWithoutTemplatePerms creates a workspace for a user, then drops
+// the user's perms to the underlying template.
+func TestWorkspacesWithoutTemplatePerms(t *testing.T) {
+	t.Parallel()
+
+	client, first := coderdenttest.New(t, &coderdenttest.Options{
+		Options: &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+		},
+		LicenseOptions: &coderdenttest.LicenseOptions{
+			Features: license.Features{
+				codersdk.FeatureTemplateRBAC: 1,
+			},
+		},
+	})
+
+	version := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID, nil)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+	template := coderdtest.CreateTemplate(t, client, first.OrganizationID, version.ID)
+
+	user, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)
+	workspace := coderdtest.CreateWorkspace(t, user, first.OrganizationID, template.ID)
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	// Remove everyone access
+	err := client.UpdateTemplateACL(ctx, template.ID, codersdk.UpdateTemplateACL{
+		GroupPerms: map[string]codersdk.TemplateRole{
+			first.OrganizationID.String(): codersdk.TemplateRoleDeleted,
+		},
+	})
+	require.NoError(t, err, "remove everyone access")
+
+	// This should fail as the user cannot read the template
+	_, err = user.Workspace(ctx, workspace.ID)
+	require.Error(t, err, "fetch workspace")
+	var sdkError *codersdk.Error
+	require.ErrorAs(t, err, &sdkError)
+	require.Equal(t, http.StatusForbidden, sdkError.StatusCode())
+
+	_, err = user.Workspaces(ctx, codersdk.WorkspaceFilter{})
+	require.NoError(t, err, "fetch workspaces should not fail")
+
+	// Now create another workspace the user can read.
+	version2 := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID, nil)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version2.ID)
+	template2 := coderdtest.CreateTemplate(t, client, first.OrganizationID, version2.ID)
+	_ = coderdtest.CreateWorkspace(t, user, first.OrganizationID, template2.ID)
+
+	workspaces, err := user.Workspaces(ctx, codersdk.WorkspaceFilter{})
+	require.NoError(t, err, "fetch workspaces should not fail")
+	require.Len(t, workspaces.Workspaces, 1)
+}
+
 func TestWorkspaceLock(t *testing.T) {
 	t.Parallel()
 
-	t.Run("TemplateLockedTTL", func(t *testing.T) {
+	t.Run("TemplateTimeTilDormantAutoDelete", func(t *testing.T) {
 		t.Parallel()
 		var (
 			client, user = coderdenttest.New(t, &coderdenttest.Options{
@@ -695,49 +1014,56 @@ func TestWorkspaceLock(t *testing.T) {
 				},
 			})
 
-			version   = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			_         = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
-			lockedTTL = time.Minute
+			version    = coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+			_          = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+			dormantTTL = time.Minute
 		)
 
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(ctr *codersdk.CreateTemplateRequest) {
-			ctr.LockedTTLMillis = ptr.Ref[int64](lockedTTL.Milliseconds())
+			ctr.TimeTilDormantAutoDeleteMillis = ptr.Ref[int64](dormantTTL.Milliseconds())
 		})
 
 		workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-		_ = coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
 		lastUsedAt := workspace.LastUsedAt
-		err := client.UpdateWorkspaceLock(ctx, workspace.ID, codersdk.UpdateWorkspaceLock{
-			Lock: true,
+		err := client.UpdateWorkspaceDormancy(ctx, workspace.ID, codersdk.UpdateWorkspaceDormancy{
+			Dormant: true,
 		})
 		require.NoError(t, err)
 
 		workspace = coderdtest.MustWorkspace(t, client, workspace.ID)
 		require.NoError(t, err, "fetch provisioned workspace")
 		require.NotNil(t, workspace.DeletingAt)
-		require.NotNil(t, workspace.LockedAt)
-		require.Equal(t, workspace.LockedAt.Add(lockedTTL), *workspace.DeletingAt)
-		require.WithinRange(t, *workspace.LockedAt, time.Now().Add(-time.Second*10), time.Now())
+		require.NotNil(t, workspace.DormantAt)
+		require.Equal(t, workspace.DormantAt.Add(dormantTTL), *workspace.DeletingAt)
+		require.WithinRange(t, *workspace.DormantAt, time.Now().Add(-time.Second*10), time.Now())
 		// Locking a workspace shouldn't update the last_used_at.
 		require.Equal(t, lastUsedAt, workspace.LastUsedAt)
 
 		workspace = coderdtest.MustWorkspace(t, client, workspace.ID)
 		lastUsedAt = workspace.LastUsedAt
-		err = client.UpdateWorkspaceLock(ctx, workspace.ID, codersdk.UpdateWorkspaceLock{
-			Lock: false,
+		err = client.UpdateWorkspaceDormancy(ctx, workspace.ID, codersdk.UpdateWorkspaceDormancy{
+			Dormant: false,
 		})
 		require.NoError(t, err)
 
 		workspace, err = client.Workspace(ctx, workspace.ID)
 		require.NoError(t, err, "fetch provisioned workspace")
-		require.Nil(t, workspace.LockedAt)
+		require.Nil(t, workspace.DormantAt)
 		// Unlocking a workspace should cause the deleting_at to be unset.
 		require.Nil(t, workspace.DeletingAt)
 		// The last_used_at should get updated when we unlock the workspace.
 		require.True(t, workspace.LastUsedAt.After(lastUsedAt))
 	})
 }
+
+func must[T any](value T, err error) T {
+	if err != nil {
+		panic(err)
+	}
+	return value
+}
diff --git a/enterprise/dbcrypt/cipher.go b/enterprise/dbcrypt/cipher.go
new file mode 100644
index 0000000000000..fc6f25ee90955
--- /dev/null
+++ b/enterprise/dbcrypt/cipher.go
@@ -0,0 +1,98 @@
+package dbcrypt
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+	"io"
+
+	"golang.org/x/xerrors"
+)
+
+// cipherAES256GCM is the name of the AES-256 cipher.
+// This is used to identify the cipher used to encrypt a value.
+// It is added to the digest to ensure that if, in the future,
+// we add a new cipher type, and a key is re-used, we don't
+// accidentally decrypt the wrong values.
+// When adding a new cipher type, add a new constant here
+// and ensure to add the cipher name to the digest of the new
+// cipher type.
+const (
+	cipherAES256GCM = "aes256gcm"
+)
+
+type Cipher interface {
+	Encrypt([]byte) ([]byte, error)
+	Decrypt([]byte) ([]byte, error)
+	HexDigest() string
+}
+
+// NewCiphers is a convenience function for creating multiple ciphers.
+// It currently only supports AES-256-GCM.
+func NewCiphers(keys ...[]byte) ([]Cipher, error) {
+	var cs []Cipher
+	for _, key := range keys {
+		c, err := cipherAES256(key)
+		if err != nil {
+			return nil, err
+		}
+		cs = append(cs, c)
+	}
+	return cs, nil
+}
+
+// cipherAES256 returns a new AES-256 cipher.
+func cipherAES256(key []byte) (*aes256, error) {
+	if len(key) != 32 {
+		return nil, xerrors.Errorf("key must be 32 bytes")
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, err
+	}
+	aead, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	// We add the cipher name to the digest to ensure that if, in the future,
+	// we add a new cipher type, and a key is re-used, we don't accidentally
+	// decrypt the wrong values.
+	toDigest := []byte(cipherAES256GCM)
+	toDigest = append(toDigest, key...)
+	digest := fmt.Sprintf("%x", sha256.Sum256(toDigest))[:7]
+	return &aes256{aead: aead, digest: digest}, nil
+}
+
+type aes256 struct {
+	aead cipher.AEAD
+	// digest is the first 7 bytes of the hex-encoded SHA-256 digest of aead.
+	digest string
+}
+
+func (a *aes256) Encrypt(plaintext []byte) ([]byte, error) {
+	nonce := make([]byte, a.aead.NonceSize())
+	_, err := io.ReadFull(rand.Reader, nonce)
+	if err != nil {
+		return nil, err
+	}
+	dst := make([]byte, len(nonce))
+	copy(dst, nonce)
+	return a.aead.Seal(dst, nonce, plaintext, nil), nil
+}
+
+func (a *aes256) Decrypt(ciphertext []byte) ([]byte, error) {
+	if len(ciphertext) < a.aead.NonceSize() {
+		return nil, xerrors.Errorf("ciphertext too short")
+	}
+	decrypted, err := a.aead.Open(nil, ciphertext[:a.aead.NonceSize()], ciphertext[a.aead.NonceSize():], nil)
+	if err != nil {
+		return nil, &DecryptFailedError{Inner: err}
+	}
+	return decrypted, nil
+}
+
+func (a *aes256) HexDigest() string {
+	return a.digest
+}
diff --git a/enterprise/dbcrypt/cipher_internal_test.go b/enterprise/dbcrypt/cipher_internal_test.go
new file mode 100644
index 0000000000000..b6740de17eec6
--- /dev/null
+++ b/enterprise/dbcrypt/cipher_internal_test.go
@@ -0,0 +1,91 @@
+package dbcrypt
+
+import (
+	"bytes"
+	"encoding/base64"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCipherAES256(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ValidInput", func(t *testing.T) {
+		t.Parallel()
+		key := bytes.Repeat([]byte{'a'}, 32)
+		cipher, err := cipherAES256(key)
+		require.NoError(t, err)
+
+		output, err := cipher.Encrypt([]byte("hello world"))
+		require.NoError(t, err)
+
+		response, err := cipher.Decrypt(output)
+		require.NoError(t, err)
+		require.Equal(t, "hello world", string(response))
+	})
+
+	t.Run("InvalidInput", func(t *testing.T) {
+		t.Parallel()
+		key := bytes.Repeat([]byte{'a'}, 32)
+		cipher, err := cipherAES256(key)
+		require.NoError(t, err)
+		_, err = cipher.Decrypt(bytes.Repeat([]byte{'a'}, 100))
+		var decryptErr *DecryptFailedError
+		require.ErrorAs(t, err, &decryptErr)
+	})
+
+	t.Run("InvalidKeySize", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := cipherAES256(bytes.Repeat([]byte{'a'}, 31))
+		require.ErrorContains(t, err, "key must be 32 bytes")
+	})
+
+	t.Run("TestNonce", func(t *testing.T) {
+		t.Parallel()
+		key := bytes.Repeat([]byte{'a'}, 32)
+		cipher, err := cipherAES256(key)
+		require.NoError(t, err)
+		require.Equal(t, "864f702", cipher.HexDigest())
+
+		encrypted1, err := cipher.Encrypt([]byte("hello world"))
+		require.NoError(t, err)
+		encrypted2, err := cipher.Encrypt([]byte("hello world"))
+		require.NoError(t, err)
+		require.NotEqual(t, encrypted1, encrypted2, "nonce should be different for each encryption")
+
+		munged := make([]byte, len(encrypted1))
+		copy(munged, encrypted1)
+		munged[0] = munged[0] ^ 0xff
+		_, err = cipher.Decrypt(munged)
+		var decryptErr *DecryptFailedError
+		require.ErrorAs(t, err, &decryptErr, "munging the first byte of the encrypted data should cause decryption to fail")
+	})
+}
+
+// This test ensures backwards compatibility. If it breaks, something is very wrong.
+func TestCiphersBackwardCompatibility(t *testing.T) {
+	t.Parallel()
+	var (
+		msg = "hello world"
+		key = bytes.Repeat([]byte{'a'}, 32)
+		//nolint: gosec // The below is the base64-encoded result of encrypting the above message with the above key.
+		encoded = `YhAz+lE2fFeeiVPH9voKN7UV1xSDrgcnC0LmNXmaAk1Yg0kPFO3x`
+	)
+
+	cipher, err := cipherAES256(key)
+	require.NoError(t, err)
+
+	// This is the code that was used to generate the above.
+	// Note that the output of this code will change every time it is run.
+	// encrypted, err := cipher.Encrypt([]byte(msg))
+	// require.NoError(t, err)
+	// t.Logf("encoded: %q", base64.StdEncoding.EncodeToString(encrypted))
+
+	decoded, err := base64.StdEncoding.DecodeString(encoded)
+	require.NoError(t, err, "the encoded string should be valid base64")
+	decrypted, err := cipher.Decrypt(decoded)
+	require.NoError(t, err, "decryption should succeed")
+	require.Equal(t, msg, string(decrypted), "decrypted message should match original message")
+}
diff --git a/enterprise/dbcrypt/cliutil.go b/enterprise/dbcrypt/cliutil.go
new file mode 100644
index 0000000000000..77986b669bb61
--- /dev/null
+++ b/enterprise/dbcrypt/cliutil.go
@@ -0,0 +1,224 @@
+package dbcrypt
+
+import (
+	"context"
+	"database/sql"
+
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+	"github.com/coder/coder/v2/coderd/database"
+)
+
+// Rotate rotates the database encryption keys by re-encrypting all user tokens
+// with the first cipher and revoking all other ciphers.
+func Rotate(ctx context.Context, log slog.Logger, sqlDB *sql.DB, ciphers []Cipher) error {
+	db := database.New(sqlDB)
+	cryptDB, err := New(ctx, db, ciphers...)
+	if err != nil {
+		return xerrors.Errorf("create cryptdb: %w", err)
+	}
+
+	userIDs, err := db.AllUserIDs(ctx)
+	if err != nil {
+		return xerrors.Errorf("get users: %w", err)
+	}
+	log.Info(ctx, "encrypting user tokens", slog.F("user_count", len(userIDs)))
+	for idx, uid := range userIDs {
+		err := cryptDB.InTx(func(cryptTx database.Store) error {
+			userLinks, err := cryptTx.GetUserLinksByUserID(ctx, uid)
+			if err != nil {
+				return xerrors.Errorf("get user links for user: %w", err)
+			}
+			for _, userLink := range userLinks {
+				if userLink.OAuthAccessTokenKeyID.String == ciphers[0].HexDigest() && userLink.OAuthRefreshTokenKeyID.String == ciphers[0].HexDigest() {
+					log.Debug(ctx, "skipping user link", slog.F("user_id", uid), slog.F("current", idx+1), slog.F("cipher", ciphers[0].HexDigest()))
+					continue
+				}
+				if _, err := cryptTx.UpdateUserLink(ctx, database.UpdateUserLinkParams{
+					OAuthAccessToken:       userLink.OAuthAccessToken,
+					OAuthAccessTokenKeyID:  sql.NullString{}, // dbcrypt will update as required
+					OAuthRefreshToken:      userLink.OAuthRefreshToken,
+					OAuthRefreshTokenKeyID: sql.NullString{}, // dbcrypt will update as required
+					OAuthExpiry:            userLink.OAuthExpiry,
+					UserID:                 uid,
+					LoginType:              userLink.LoginType,
+				}); err != nil {
+					return xerrors.Errorf("update user link user_id=%s linked_id=%s: %w", userLink.UserID, userLink.LinkedID, err)
+				}
+			}
+
+			externalAuthLinks, err := cryptTx.GetExternalAuthLinksByUserID(ctx, uid)
+			if err != nil {
+				return xerrors.Errorf("get git auth links for user: %w", err)
+			}
+			for _, externalAuthLink := range externalAuthLinks {
+				if externalAuthLink.OAuthAccessTokenKeyID.String == ciphers[0].HexDigest() && externalAuthLink.OAuthRefreshTokenKeyID.String == ciphers[0].HexDigest() {
+					log.Debug(ctx, "skipping external auth link", slog.F("user_id", uid), slog.F("current", idx+1), slog.F("cipher", ciphers[0].HexDigest()))
+					continue
+				}
+				if _, err := cryptTx.UpdateExternalAuthLink(ctx, database.UpdateExternalAuthLinkParams{
+					ProviderID:             externalAuthLink.ProviderID,
+					UserID:                 uid,
+					UpdatedAt:              externalAuthLink.UpdatedAt,
+					OAuthAccessToken:       externalAuthLink.OAuthAccessToken,
+					OAuthAccessTokenKeyID:  sql.NullString{}, // dbcrypt will update as required
+					OAuthRefreshToken:      externalAuthLink.OAuthRefreshToken,
+					OAuthRefreshTokenKeyID: sql.NullString{}, // dbcrypt will update as required
+					OAuthExpiry:            externalAuthLink.OAuthExpiry,
+					OAuthExtra:             externalAuthLink.OAuthExtra,
+				}); err != nil {
+					return xerrors.Errorf("update external auth link user_id=%s provider_id=%s: %w", externalAuthLink.UserID, externalAuthLink.ProviderID, err)
+				}
+			}
+			return nil
+		}, &sql.TxOptions{
+			Isolation: sql.LevelRepeatableRead,
+		})
+		if err != nil {
+			return xerrors.Errorf("update user links: %w", err)
+		}
+		log.Debug(ctx, "encrypted user tokens", slog.F("user_id", uid), slog.F("current", idx+1), slog.F("cipher", ciphers[0].HexDigest()))
+	}
+
+	// Revoke old keys
+	for _, c := range ciphers[1:] {
+		if err := db.RevokeDBCryptKey(ctx, c.HexDigest()); err != nil {
+			return xerrors.Errorf("revoke key: %w", err)
+		}
+		log.Info(ctx, "revoked unused key", slog.F("digest", c.HexDigest()))
+	}
+
+	return nil
+}
+
+// Decrypt decrypts all user tokens and revokes all ciphers.
+func Decrypt(ctx context.Context, log slog.Logger, sqlDB *sql.DB, ciphers []Cipher) error {
+	db := database.New(sqlDB)
+	cdb, err := New(ctx, db, ciphers...)
+	if err != nil {
+		return xerrors.Errorf("create cryptdb: %w", err)
+	}
+
+	// HACK: instead of adding logic to configure the primary cipher, we just
+	// set it to the empty string so that it will not encrypt anything.
+	cryptDB, ok := cdb.(*dbCrypt)
+	if !ok {
+		return xerrors.Errorf("developer error: dbcrypt.New did not return *dbCrypt")
+	}
+	cryptDB.primaryCipherDigest = ""
+
+	userIDs, err := db.AllUserIDs(ctx)
+	if err != nil {
+		return xerrors.Errorf("get users: %w", err)
+	}
+	log.Info(ctx, "decrypting user tokens", slog.F("user_count", len(userIDs)))
+	for idx, uid := range userIDs {
+		err := cryptDB.InTx(func(tx database.Store) error {
+			userLinks, err := tx.GetUserLinksByUserID(ctx, uid)
+			if err != nil {
+				return xerrors.Errorf("get user links for user: %w", err)
+			}
+			for _, userLink := range userLinks {
+				if !userLink.OAuthAccessTokenKeyID.Valid && !userLink.OAuthRefreshTokenKeyID.Valid {
+					log.Debug(ctx, "skipping user link", slog.F("user_id", uid), slog.F("current", idx+1))
+					continue
+				}
+				if _, err := tx.UpdateUserLink(ctx, database.UpdateUserLinkParams{
+					OAuthAccessToken:       userLink.OAuthAccessToken,
+					OAuthAccessTokenKeyID:  sql.NullString{}, // we explicitly want to clear the key id
+					OAuthRefreshToken:      userLink.OAuthRefreshToken,
+					OAuthRefreshTokenKeyID: sql.NullString{}, // we explicitly want to clear the key id
+					OAuthExpiry:            userLink.OAuthExpiry,
+					UserID:                 uid,
+					LoginType:              userLink.LoginType,
+				}); err != nil {
+					return xerrors.Errorf("update user link user_id=%s linked_id=%s: %w", userLink.UserID, userLink.LinkedID, err)
+				}
+			}
+
+			externalAuthLinks, err := tx.GetExternalAuthLinksByUserID(ctx, uid)
+			if err != nil {
+				return xerrors.Errorf("get git auth links for user: %w", err)
+			}
+			for _, externalAuthLink := range externalAuthLinks {
+				if !externalAuthLink.OAuthAccessTokenKeyID.Valid && !externalAuthLink.OAuthRefreshTokenKeyID.Valid {
+					log.Debug(ctx, "skipping external auth link", slog.F("user_id", uid), slog.F("current", idx+1))
+					continue
+				}
+				if _, err := tx.UpdateExternalAuthLink(ctx, database.UpdateExternalAuthLinkParams{
+					ProviderID:             externalAuthLink.ProviderID,
+					UserID:                 uid,
+					UpdatedAt:              externalAuthLink.UpdatedAt,
+					OAuthAccessToken:       externalAuthLink.OAuthAccessToken,
+					OAuthAccessTokenKeyID:  sql.NullString{}, // we explicitly want to clear the key id
+					OAuthRefreshToken:      externalAuthLink.OAuthRefreshToken,
+					OAuthRefreshTokenKeyID: sql.NullString{}, // we explicitly want to clear the key id
+					OAuthExpiry:            externalAuthLink.OAuthExpiry,
+					OAuthExtra:             externalAuthLink.OAuthExtra,
+				}); err != nil {
+					return xerrors.Errorf("update external auth link user_id=%s provider_id=%s: %w", externalAuthLink.UserID, externalAuthLink.ProviderID, err)
+				}
+			}
+			return nil
+		}, &sql.TxOptions{
+			Isolation: sql.LevelRepeatableRead,
+		})
+		if err != nil {
+			return xerrors.Errorf("update user links: %w", err)
+		}
+		log.Debug(ctx, "decrypted user tokens", slog.F("user_id", uid), slog.F("current", idx+1), slog.F("cipher", ciphers[0].HexDigest()))
+	}
+
+	// Revoke _all_ keys
+	for _, c := range ciphers {
+		if err := db.RevokeDBCryptKey(ctx, c.HexDigest()); err != nil {
+			return xerrors.Errorf("revoke key: %w", err)
+		}
+		log.Info(ctx, "revoked unused key", slog.F("digest", c.HexDigest()))
+	}
+
+	return nil
+}
+
+// nolint: gosec
+const sqlDeleteEncryptedUserTokens = `
+BEGIN;
+DELETE FROM user_links
+  WHERE oauth_access_token_key_id IS NOT NULL
+	OR oauth_refresh_token_key_id IS NOT NULL;
+DELETE FROM external_auth_links
+	WHERE oauth_access_token_key_id IS NOT NULL
+	OR oauth_refresh_token_key_id IS NOT NULL;
+COMMIT;
+`
+
+// Delete deletes all user tokens and revokes all ciphers.
+// This is a destructive operation and should only be used
+// as a last resort, for example, if the database encryption key has been
+// lost.
+func Delete(ctx context.Context, log slog.Logger, sqlDB *sql.DB) error {
+	store := database.New(sqlDB)
+	_, err := sqlDB.ExecContext(ctx, sqlDeleteEncryptedUserTokens)
+	if err != nil {
+		return xerrors.Errorf("delete user links: %w", err)
+	}
+	log.Info(ctx, "deleted encrypted user tokens")
+
+	log.Info(ctx, "revoking all active keys")
+	keys, err := store.GetDBCryptKeys(ctx)
+	if err != nil {
+		return xerrors.Errorf("get db crypt keys: %w", err)
+	}
+	for _, k := range keys {
+		if !k.ActiveKeyDigest.Valid {
+			continue
+		}
+		if err := store.RevokeDBCryptKey(ctx, k.ActiveKeyDigest.String); err != nil {
+			return xerrors.Errorf("revoke key: %w", err)
+		}
+		log.Info(ctx, "revoked unused key", slog.F("digest", k.ActiveKeyDigest.String))
+	}
+
+	return nil
+}
diff --git a/enterprise/dbcrypt/dbcrypt.go b/enterprise/dbcrypt/dbcrypt.go
new file mode 100644
index 0000000000000..ec56a4897a1e3
--- /dev/null
+++ b/enterprise/dbcrypt/dbcrypt.go
@@ -0,0 +1,374 @@
+package dbcrypt
+
+import (
+	"context"
+	"database/sql"
+	"encoding/base64"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+)
+
+// testValue is the value that is stored in dbcrypt_keys.test.
+// This is used to determine if the key is valid.
+const testValue = "coder"
+
+var (
+	b64encode = base64.StdEncoding.EncodeToString
+	b64decode = base64.StdEncoding.DecodeString
+)
+
+// DecryptFailedError is returned when decryption fails.
+type DecryptFailedError struct {
+	Inner error
+}
+
+func (e *DecryptFailedError) Error() string {
+	return xerrors.Errorf("decrypt failed: %w", e.Inner).Error()
+}
+
+// New creates a database.Store wrapper that encrypts/decrypts values
+// stored at rest in the database.
+func New(ctx context.Context, db database.Store, ciphers ...Cipher) (database.Store, error) {
+	cm := make(map[string]Cipher)
+	for _, c := range ciphers {
+		cm[c.HexDigest()] = c
+	}
+	dbc := &dbCrypt{
+		ciphers: cm,
+		Store:   db,
+	}
+	if len(ciphers) > 0 {
+		dbc.primaryCipherDigest = ciphers[0].HexDigest()
+	}
+	// nolint: gocritic // This is allowed.
+	authCtx := dbauthz.AsSystemRestricted(ctx)
+	if err := dbc.ensureEncryptedWithRetry(authCtx); err != nil {
+		return nil, xerrors.Errorf("ensure encrypted database fields: %w", err)
+	}
+	return dbc, nil
+}
+
+type dbCrypt struct {
+	// primaryCipherDigest is the digest of the primary cipher used for encrypting data.
+	primaryCipherDigest string
+	// ciphers is a map of cipher digests to ciphers.
+	ciphers map[string]Cipher
+	database.Store
+}
+
+func (db *dbCrypt) InTx(function func(database.Store) error, txOpts *sql.TxOptions) error {
+	return db.Store.InTx(func(s database.Store) error {
+		return function(&dbCrypt{
+			primaryCipherDigest: db.primaryCipherDigest,
+			ciphers:             db.ciphers,
+			Store:               s,
+		})
+	}, txOpts)
+}
+
+func (db *dbCrypt) GetDBCryptKeys(ctx context.Context) ([]database.DBCryptKey, error) {
+	ks, err := db.Store.GetDBCryptKeys(ctx)
+	if err != nil {
+		return nil, err
+	}
+	// Decrypt the test field to ensure that the key is valid.
+	for i := range ks {
+		if !ks[i].ActiveKeyDigest.Valid {
+			// Key has been revoked. We can't decrypt the test field, but
+			// we need to return it so that the caller knows that the key
+			// has been revoked.
+			continue
+		}
+		if err := db.decryptField(&ks[i].Test, ks[i].ActiveKeyDigest); err != nil {
+			return nil, err
+		}
+	}
+	return ks, nil
+}
+
+// This does not need any special handling as it does not touch any encrypted fields.
+// Explicitly defining this here to avoid confusion.
+func (db *dbCrypt) RevokeDBCryptKey(ctx context.Context, activeKeyDigest string) error {
+	return db.Store.RevokeDBCryptKey(ctx, activeKeyDigest)
+}
+
+func (db *dbCrypt) InsertDBCryptKey(ctx context.Context, arg database.InsertDBCryptKeyParams) error {
+	// It's nicer to be able to pass a *sql.NullString to encryptField, but we need to pass a string here.
+	var digest sql.NullString
+	err := db.encryptField(&arg.Test, &digest)
+	if err != nil {
+		return err
+	}
+	arg.ActiveKeyDigest = digest.String
+	return db.Store.InsertDBCryptKey(ctx, arg)
+}
+
+func (db *dbCrypt) GetUserLinkByLinkedID(ctx context.Context, linkedID string) (database.UserLink, error) {
+	link, err := db.Store.GetUserLinkByLinkedID(ctx, linkedID)
+	if err != nil {
+		return database.UserLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthAccessToken, link.OAuthAccessTokenKeyID); err != nil {
+		return database.UserLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthRefreshToken, link.OAuthRefreshTokenKeyID); err != nil {
+		return database.UserLink{}, err
+	}
+	return link, nil
+}
+
+func (db *dbCrypt) GetUserLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.UserLink, error) {
+	links, err := db.Store.GetUserLinksByUserID(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	for idx := range links {
+		if err := db.decryptField(&links[idx].OAuthAccessToken, links[idx].OAuthAccessTokenKeyID); err != nil {
+			return nil, err
+		}
+		if err := db.decryptField(&links[idx].OAuthRefreshToken, links[idx].OAuthRefreshTokenKeyID); err != nil {
+			return nil, err
+		}
+	}
+	return links, nil
+}
+
+func (db *dbCrypt) GetUserLinkByUserIDLoginType(ctx context.Context, params database.GetUserLinkByUserIDLoginTypeParams) (database.UserLink, error) {
+	link, err := db.Store.GetUserLinkByUserIDLoginType(ctx, params)
+	if err != nil {
+		return database.UserLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthAccessToken, link.OAuthAccessTokenKeyID); err != nil {
+		return database.UserLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthRefreshToken, link.OAuthRefreshTokenKeyID); err != nil {
+		return database.UserLink{}, err
+	}
+	return link, nil
+}
+
+func (db *dbCrypt) InsertUserLink(ctx context.Context, params database.InsertUserLinkParams) (database.UserLink, error) {
+	if err := db.encryptField(&params.OAuthAccessToken, &params.OAuthAccessTokenKeyID); err != nil {
+		return database.UserLink{}, err
+	}
+	if err := db.encryptField(&params.OAuthRefreshToken, &params.OAuthRefreshTokenKeyID); err != nil {
+		return database.UserLink{}, err
+	}
+	link, err := db.Store.InsertUserLink(ctx, params)
+	if err != nil {
+		return database.UserLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthAccessToken, link.OAuthAccessTokenKeyID); err != nil {
+		return database.UserLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthRefreshToken, link.OAuthRefreshTokenKeyID); err != nil {
+		return database.UserLink{}, err
+	}
+	return link, nil
+}
+
+func (db *dbCrypt) UpdateUserLink(ctx context.Context, params database.UpdateUserLinkParams) (database.UserLink, error) {
+	if err := db.encryptField(&params.OAuthAccessToken, &params.OAuthAccessTokenKeyID); err != nil {
+		return database.UserLink{}, err
+	}
+	if err := db.encryptField(&params.OAuthRefreshToken, &params.OAuthRefreshTokenKeyID); err != nil {
+		return database.UserLink{}, err
+	}
+	link, err := db.Store.UpdateUserLink(ctx, params)
+	if err != nil {
+		return database.UserLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthAccessToken, link.OAuthAccessTokenKeyID); err != nil {
+		return database.UserLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthRefreshToken, link.OAuthRefreshTokenKeyID); err != nil {
+		return database.UserLink{}, err
+	}
+	return link, nil
+}
+
+func (db *dbCrypt) InsertExternalAuthLink(ctx context.Context, params database.InsertExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+	if err := db.encryptField(&params.OAuthAccessToken, &params.OAuthAccessTokenKeyID); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	if err := db.encryptField(&params.OAuthRefreshToken, &params.OAuthRefreshTokenKeyID); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	link, err := db.Store.InsertExternalAuthLink(ctx, params)
+	if err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthAccessToken, link.OAuthAccessTokenKeyID); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthRefreshToken, link.OAuthRefreshTokenKeyID); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	return link, nil
+}
+
+func (db *dbCrypt) GetExternalAuthLink(ctx context.Context, params database.GetExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+	link, err := db.Store.GetExternalAuthLink(ctx, params)
+	if err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthAccessToken, link.OAuthAccessTokenKeyID); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthRefreshToken, link.OAuthRefreshTokenKeyID); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	return link, nil
+}
+
+func (db *dbCrypt) GetExternalAuthLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.ExternalAuthLink, error) {
+	links, err := db.Store.GetExternalAuthLinksByUserID(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	for idx := range links {
+		if err := db.decryptField(&links[idx].OAuthAccessToken, links[idx].OAuthAccessTokenKeyID); err != nil {
+			return nil, err
+		}
+		if err := db.decryptField(&links[idx].OAuthRefreshToken, links[idx].OAuthRefreshTokenKeyID); err != nil {
+			return nil, err
+		}
+	}
+	return links, nil
+}
+
+func (db *dbCrypt) UpdateExternalAuthLink(ctx context.Context, params database.UpdateExternalAuthLinkParams) (database.ExternalAuthLink, error) {
+	if err := db.encryptField(&params.OAuthAccessToken, &params.OAuthAccessTokenKeyID); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	if err := db.encryptField(&params.OAuthRefreshToken, &params.OAuthRefreshTokenKeyID); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	link, err := db.Store.UpdateExternalAuthLink(ctx, params)
+	if err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthAccessToken, link.OAuthAccessTokenKeyID); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	if err := db.decryptField(&link.OAuthRefreshToken, link.OAuthRefreshTokenKeyID); err != nil {
+		return database.ExternalAuthLink{}, err
+	}
+	return link, nil
+}
+
+func (db *dbCrypt) encryptField(field *string, digest *sql.NullString) error {
+	// If no cipher is loaded, then we can't encrypt anything!
+	if db.ciphers == nil || db.primaryCipherDigest == "" {
+		return nil
+	}
+
+	if field == nil {
+		return xerrors.Errorf("developer error: encryptField called with nil field")
+	}
+	if digest == nil {
+		return xerrors.Errorf("developer error: encryptField called with nil digest")
+	}
+
+	encrypted, err := db.ciphers[db.primaryCipherDigest].Encrypt([]byte(*field))
+	if err != nil {
+		return err
+	}
+	// Base64 is used to support UTF-8 encoding in PostgreSQL.
+	*field = b64encode(encrypted)
+	*digest = sql.NullString{String: db.primaryCipherDigest, Valid: true}
+	return nil
+}
+
+// decryptFields decrypts the given field using the key with the given digest.
+// If the value fails to decrypt, sql.ErrNoRows will be returned.
+func (db *dbCrypt) decryptField(field *string, digest sql.NullString) error {
+	if field == nil {
+		return xerrors.Errorf("developer error: decryptField called with nil field")
+	}
+
+	if !digest.Valid || digest.String == "" {
+		// This field is not encrypted.
+		return nil
+	}
+
+	key, ok := db.ciphers[digest.String]
+	if !ok {
+		return &DecryptFailedError{
+			Inner: xerrors.Errorf("no cipher with digest %q", digest.String),
+		}
+	}
+
+	data, err := b64decode(*field)
+	if err != nil {
+		// If it's not valid base64, we should complain loudly.
+		return &DecryptFailedError{
+			Inner: xerrors.Errorf("malformed encrypted field %q: %w", *field, err),
+		}
+	}
+	decrypted, err := key.Decrypt(data)
+	if err != nil {
+		return &DecryptFailedError{Inner: err}
+	}
+	*field = string(decrypted)
+	return nil
+}
+
+func (db *dbCrypt) ensureEncryptedWithRetry(ctx context.Context) error {
+	var err error
+	for i := 0; i < 3; i++ {
+		err = db.ensureEncrypted(ctx)
+		if err == nil {
+			return nil
+		}
+		// If we get a serialization error, then we need to retry.
+		if !database.IsSerializedError(err) {
+			return err
+		}
+		// otherwise, retry
+	}
+	// If we get here, then we ran out of retries
+	return err
+}
+
+func (db *dbCrypt) ensureEncrypted(ctx context.Context) error {
+	return db.InTx(func(s database.Store) error {
+		// Attempt to read the encrypted test fields of the currently active keys.
+		ks, err := s.GetDBCryptKeys(ctx)
+		if err != nil && !xerrors.Is(err, sql.ErrNoRows) {
+			return err
+		}
+
+		var highestNumber int32
+		var activeCipherFound bool
+		for _, k := range ks {
+			// If our primary key has been revoked, then we can't do anything.
+			if k.RevokedKeyDigest.Valid && k.RevokedKeyDigest.String == db.primaryCipherDigest {
+				return xerrors.Errorf("primary encryption key %q has been revoked", db.primaryCipherDigest)
+			}
+
+			if k.ActiveKeyDigest.Valid && k.ActiveKeyDigest.String == db.primaryCipherDigest {
+				activeCipherFound = true
+			}
+
+			if k.Number > highestNumber {
+				highestNumber = k.Number
+			}
+		}
+
+		if activeCipherFound || len(db.ciphers) == 0 {
+			return nil
+		}
+
+		// If we get here, then we have a new key that we need to insert.
+		return db.InsertDBCryptKey(ctx, database.InsertDBCryptKeyParams{
+			Number:          highestNumber + 1,
+			ActiveKeyDigest: db.primaryCipherDigest,
+			Test:            testValue,
+		})
+	}, &sql.TxOptions{Isolation: sql.LevelRepeatableRead})
+}
diff --git a/enterprise/dbcrypt/dbcrypt_internal_test.go b/enterprise/dbcrypt/dbcrypt_internal_test.go
new file mode 100644
index 0000000000000..589531d0dbeba
--- /dev/null
+++ b/enterprise/dbcrypt/dbcrypt_internal_test.go
@@ -0,0 +1,673 @@
+package dbcrypt
+
+import (
+	"context"
+	"crypto/rand"
+	"database/sql"
+	"encoding/base64"
+	"io"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/lib/pq"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmock"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+)
+
+func TestUserLinks(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	t.Run("InsertUserLink", func(t *testing.T) {
+		t.Parallel()
+		db, crypt, ciphers := setup(t)
+		user := dbgen.User(t, crypt, database.User{})
+		link := dbgen.UserLink(t, crypt, database.UserLink{
+			UserID:            user.ID,
+			OAuthAccessToken:  "access",
+			OAuthRefreshToken: "refresh",
+		})
+		require.Equal(t, "access", link.OAuthAccessToken)
+		require.Equal(t, "refresh", link.OAuthRefreshToken)
+		require.Equal(t, ciphers[0].HexDigest(), link.OAuthAccessTokenKeyID.String)
+		require.Equal(t, ciphers[0].HexDigest(), link.OAuthRefreshTokenKeyID.String)
+
+		rawLink, err := db.GetUserLinkByLinkedID(ctx, link.LinkedID)
+		require.NoError(t, err)
+		requireEncryptedEquals(t, ciphers[0], rawLink.OAuthAccessToken, "access")
+		requireEncryptedEquals(t, ciphers[0], rawLink.OAuthRefreshToken, "refresh")
+	})
+
+	t.Run("UpdateUserLink", func(t *testing.T) {
+		t.Parallel()
+		db, crypt, ciphers := setup(t)
+		user := dbgen.User(t, crypt, database.User{})
+		link := dbgen.UserLink(t, crypt, database.UserLink{
+			UserID: user.ID,
+		})
+
+		updated, err := crypt.UpdateUserLink(ctx, database.UpdateUserLinkParams{
+			OAuthAccessToken:  "access",
+			OAuthRefreshToken: "refresh",
+			UserID:            link.UserID,
+			LoginType:         link.LoginType,
+		})
+		require.NoError(t, err)
+		require.Equal(t, "access", updated.OAuthAccessToken)
+		require.Equal(t, "refresh", updated.OAuthRefreshToken)
+		require.Equal(t, ciphers[0].HexDigest(), link.OAuthAccessTokenKeyID.String)
+		require.Equal(t, ciphers[0].HexDigest(), link.OAuthRefreshTokenKeyID.String)
+
+		rawLink, err := db.GetUserLinkByLinkedID(ctx, link.LinkedID)
+		require.NoError(t, err)
+		requireEncryptedEquals(t, ciphers[0], rawLink.OAuthAccessToken, "access")
+		requireEncryptedEquals(t, ciphers[0], rawLink.OAuthRefreshToken, "refresh")
+	})
+
+	t.Run("GetUserLinkByLinkedID", func(t *testing.T) {
+		t.Parallel()
+		t.Run("OK", func(t *testing.T) {
+			t.Parallel()
+			db, crypt, ciphers := setup(t)
+			user := dbgen.User(t, crypt, database.User{})
+			link := dbgen.UserLink(t, crypt, database.UserLink{
+				UserID:            user.ID,
+				OAuthAccessToken:  "access",
+				OAuthRefreshToken: "refresh",
+			})
+
+			link, err := crypt.GetUserLinkByLinkedID(ctx, link.LinkedID)
+			require.NoError(t, err)
+			require.Equal(t, "access", link.OAuthAccessToken)
+			require.Equal(t, "refresh", link.OAuthRefreshToken)
+			require.Equal(t, ciphers[0].HexDigest(), link.OAuthAccessTokenKeyID.String)
+			require.Equal(t, ciphers[0].HexDigest(), link.OAuthRefreshTokenKeyID.String)
+
+			rawLink, err := db.GetUserLinkByLinkedID(ctx, link.LinkedID)
+			require.NoError(t, err)
+			requireEncryptedEquals(t, ciphers[0], rawLink.OAuthAccessToken, "access")
+			requireEncryptedEquals(t, ciphers[0], rawLink.OAuthRefreshToken, "refresh")
+		})
+
+		t.Run("DecryptErr", func(t *testing.T) {
+			t.Parallel()
+			db, crypt, ciphers := setup(t)
+			user := dbgen.User(t, db, database.User{})
+			link := dbgen.UserLink(t, db, database.UserLink{
+				UserID:                 user.ID,
+				OAuthAccessToken:       fakeBase64RandomData(t, 32),
+				OAuthRefreshToken:      fakeBase64RandomData(t, 32),
+				OAuthAccessTokenKeyID:  sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
+				OAuthRefreshTokenKeyID: sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
+			})
+
+			_, err := crypt.GetUserLinkByLinkedID(ctx, link.LinkedID)
+			require.Error(t, err, "expected an error")
+			var derr *DecryptFailedError
+			require.ErrorAs(t, err, &derr, "expected a decrypt error")
+		})
+	})
+
+	t.Run("GetUserLinksByUserID", func(t *testing.T) {
+		t.Parallel()
+
+		t.Run("OK", func(t *testing.T) {
+			t.Parallel()
+			db, crypt, ciphers := setup(t)
+			user := dbgen.User(t, crypt, database.User{})
+			link := dbgen.UserLink(t, crypt, database.UserLink{
+				UserID:            user.ID,
+				OAuthAccessToken:  "access",
+				OAuthRefreshToken: "refresh",
+			})
+			links, err := crypt.GetUserLinksByUserID(ctx, link.UserID)
+			require.NoError(t, err)
+			require.Len(t, links, 1)
+			require.Equal(t, "access", links[0].OAuthAccessToken)
+			require.Equal(t, "refresh", links[0].OAuthRefreshToken)
+			require.Equal(t, ciphers[0].HexDigest(), links[0].OAuthAccessTokenKeyID.String)
+			require.Equal(t, ciphers[0].HexDigest(), links[0].OAuthRefreshTokenKeyID.String)
+
+			rawLinks, err := db.GetUserLinksByUserID(ctx, link.UserID)
+			require.NoError(t, err)
+			require.Len(t, rawLinks, 1)
+			requireEncryptedEquals(t, ciphers[0], rawLinks[0].OAuthAccessToken, "access")
+			requireEncryptedEquals(t, ciphers[0], rawLinks[0].OAuthRefreshToken, "refresh")
+		})
+
+		t.Run("Empty", func(t *testing.T) {
+			t.Parallel()
+			_, crypt, _ := setup(t)
+			user := dbgen.User(t, crypt, database.User{})
+			links, err := crypt.GetUserLinksByUserID(ctx, user.ID)
+			require.NoError(t, err)
+			require.Empty(t, links)
+		})
+
+		t.Run("DecryptErr", func(t *testing.T) {
+			t.Parallel()
+			db, crypt, ciphers := setup(t)
+			user := dbgen.User(t, db, database.User{})
+			_ = dbgen.UserLink(t, db, database.UserLink{
+				UserID:                 user.ID,
+				OAuthAccessToken:       fakeBase64RandomData(t, 32),
+				OAuthRefreshToken:      fakeBase64RandomData(t, 32),
+				OAuthAccessTokenKeyID:  sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
+				OAuthRefreshTokenKeyID: sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
+			})
+			_, err := crypt.GetUserLinksByUserID(ctx, user.ID)
+			require.Error(t, err, "expected an error")
+			var derr *DecryptFailedError
+			require.ErrorAs(t, err, &derr, "expected a decrypt error")
+		})
+	})
+
+	t.Run("GetUserLinkByUserIDLoginType", func(t *testing.T) {
+		t.Parallel()
+		t.Run("OK", func(t *testing.T) {
+			t.Parallel()
+			db, crypt, ciphers := setup(t)
+			user := dbgen.User(t, crypt, database.User{})
+			link := dbgen.UserLink(t, crypt, database.UserLink{
+				UserID:            user.ID,
+				OAuthAccessToken:  "access",
+				OAuthRefreshToken: "refresh",
+			})
+
+			link, err := crypt.GetUserLinkByUserIDLoginType(ctx, database.GetUserLinkByUserIDLoginTypeParams{
+				UserID:    link.UserID,
+				LoginType: link.LoginType,
+			})
+			require.NoError(t, err)
+			require.Equal(t, "access", link.OAuthAccessToken)
+			require.Equal(t, "refresh", link.OAuthRefreshToken)
+			require.Equal(t, ciphers[0].HexDigest(), link.OAuthAccessTokenKeyID.String)
+			require.Equal(t, ciphers[0].HexDigest(), link.OAuthRefreshTokenKeyID.String)
+
+			rawLink, err := db.GetUserLinkByUserIDLoginType(ctx, database.GetUserLinkByUserIDLoginTypeParams{
+				UserID:    link.UserID,
+				LoginType: link.LoginType,
+			})
+			require.NoError(t, err)
+			requireEncryptedEquals(t, ciphers[0], rawLink.OAuthAccessToken, "access")
+			requireEncryptedEquals(t, ciphers[0], rawLink.OAuthRefreshToken, "refresh")
+		})
+
+		t.Run("DecryptErr", func(t *testing.T) {
+			t.Parallel()
+			db, crypt, ciphers := setup(t)
+			user := dbgen.User(t, db, database.User{})
+			link := dbgen.UserLink(t, db, database.UserLink{
+				UserID:                 user.ID,
+				OAuthAccessToken:       fakeBase64RandomData(t, 32),
+				OAuthRefreshToken:      fakeBase64RandomData(t, 32),
+				OAuthAccessTokenKeyID:  sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
+				OAuthRefreshTokenKeyID: sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
+			})
+
+			_, err := crypt.GetUserLinkByUserIDLoginType(ctx, database.GetUserLinkByUserIDLoginTypeParams{
+				UserID:    link.UserID,
+				LoginType: link.LoginType,
+			})
+			require.Error(t, err, "expected an error")
+			var derr *DecryptFailedError
+			require.ErrorAs(t, err, &derr, "expected a decrypt error")
+		})
+	})
+}
+
+func TestExternalAuthLinks(t *testing.T) {
+	t.Parallel()
+	ctx := context.Background()
+
+	t.Run("InsertExternalAuthLink", func(t *testing.T) {
+		t.Parallel()
+		db, crypt, ciphers := setup(t)
+		link := dbgen.ExternalAuthLink(t, crypt, database.ExternalAuthLink{
+			OAuthAccessToken:  "access",
+			OAuthRefreshToken: "refresh",
+		})
+		require.Equal(t, "access", link.OAuthAccessToken)
+		require.Equal(t, "refresh", link.OAuthRefreshToken)
+
+		link, err := db.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
+			ProviderID: link.ProviderID,
+			UserID:     link.UserID,
+		})
+		require.NoError(t, err)
+		requireEncryptedEquals(t, ciphers[0], link.OAuthAccessToken, "access")
+		requireEncryptedEquals(t, ciphers[0], link.OAuthRefreshToken, "refresh")
+	})
+
+	t.Run("UpdateExternalAuthLink", func(t *testing.T) {
+		t.Parallel()
+		db, crypt, ciphers := setup(t)
+		link := dbgen.ExternalAuthLink(t, crypt, database.ExternalAuthLink{})
+		updated, err := crypt.UpdateExternalAuthLink(ctx, database.UpdateExternalAuthLinkParams{
+			ProviderID:        link.ProviderID,
+			UserID:            link.UserID,
+			OAuthAccessToken:  "access",
+			OAuthRefreshToken: "refresh",
+		})
+		require.NoError(t, err)
+		require.Equal(t, "access", updated.OAuthAccessToken)
+		require.Equal(t, "refresh", updated.OAuthRefreshToken)
+
+		link, err = db.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
+			ProviderID: link.ProviderID,
+			UserID:     link.UserID,
+		})
+		require.NoError(t, err)
+		requireEncryptedEquals(t, ciphers[0], link.OAuthAccessToken, "access")
+		requireEncryptedEquals(t, ciphers[0], link.OAuthRefreshToken, "refresh")
+	})
+
+	t.Run("GetExternalAuthLink", func(t *testing.T) {
+		t.Run("OK", func(t *testing.T) {
+			t.Parallel()
+			db, crypt, ciphers := setup(t)
+			link := dbgen.ExternalAuthLink(t, crypt, database.ExternalAuthLink{
+				OAuthAccessToken:  "access",
+				OAuthRefreshToken: "refresh",
+			})
+			link, err := db.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
+				UserID:     link.UserID,
+				ProviderID: link.ProviderID,
+			})
+			require.NoError(t, err)
+			requireEncryptedEquals(t, ciphers[0], link.OAuthAccessToken, "access")
+			requireEncryptedEquals(t, ciphers[0], link.OAuthRefreshToken, "refresh")
+		})
+		t.Run("DecryptErr", func(t *testing.T) {
+			t.Parallel()
+			db, crypt, ciphers := setup(t)
+			link := dbgen.ExternalAuthLink(t, db, database.ExternalAuthLink{
+				OAuthAccessToken:       fakeBase64RandomData(t, 32),
+				OAuthRefreshToken:      fakeBase64RandomData(t, 32),
+				OAuthAccessTokenKeyID:  sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
+				OAuthRefreshTokenKeyID: sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
+			})
+
+			_, err := crypt.GetExternalAuthLink(ctx, database.GetExternalAuthLinkParams{
+				UserID:     link.UserID,
+				ProviderID: link.ProviderID,
+			})
+			require.Error(t, err, "expected an error")
+			var derr *DecryptFailedError
+			require.ErrorAs(t, err, &derr, "expected a decrypt error")
+		})
+	})
+
+	t.Run("GetExternalAuthLinksByUserID", func(t *testing.T) {
+		t.Parallel()
+
+		t.Run("OK", func(t *testing.T) {
+			t.Parallel()
+			db, crypt, ciphers := setup(t)
+			user := dbgen.User(t, crypt, database.User{})
+			link := dbgen.ExternalAuthLink(t, crypt, database.ExternalAuthLink{
+				UserID:            user.ID,
+				OAuthAccessToken:  "access",
+				OAuthRefreshToken: "refresh",
+			})
+			links, err := crypt.GetExternalAuthLinksByUserID(ctx, link.UserID)
+			require.NoError(t, err)
+			require.Len(t, links, 1)
+			require.Equal(t, "access", links[0].OAuthAccessToken)
+			require.Equal(t, "refresh", links[0].OAuthRefreshToken)
+			require.Equal(t, ciphers[0].HexDigest(), links[0].OAuthAccessTokenKeyID.String)
+			require.Equal(t, ciphers[0].HexDigest(), links[0].OAuthRefreshTokenKeyID.String)
+
+			rawLinks, err := db.GetExternalAuthLinksByUserID(ctx, link.UserID)
+			require.NoError(t, err)
+			require.Len(t, rawLinks, 1)
+			requireEncryptedEquals(t, ciphers[0], rawLinks[0].OAuthAccessToken, "access")
+			requireEncryptedEquals(t, ciphers[0], rawLinks[0].OAuthRefreshToken, "refresh")
+		})
+
+		t.Run("DecryptErr", func(t *testing.T) {
+			db, crypt, ciphers := setup(t)
+			user := dbgen.User(t, db, database.User{})
+			link := dbgen.ExternalAuthLink(t, db, database.ExternalAuthLink{
+				UserID:                 user.ID,
+				OAuthAccessToken:       fakeBase64RandomData(t, 32),
+				OAuthRefreshToken:      fakeBase64RandomData(t, 32),
+				OAuthAccessTokenKeyID:  sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
+				OAuthRefreshTokenKeyID: sql.NullString{String: ciphers[0].HexDigest(), Valid: true},
+			})
+			_, err := crypt.GetExternalAuthLinksByUserID(ctx, link.UserID)
+			require.Error(t, err, "expected an error")
+			var derr *DecryptFailedError
+			require.ErrorAs(t, err, &derr, "expected a decrypt error")
+		})
+	})
+}
+
+func TestNew(t *testing.T) {
+	t.Parallel()
+
+	t.Run("OK", func(t *testing.T) {
+		t.Parallel()
+		// Given: a cipher is loaded
+		cipher := initCipher(t)
+		ctx, cancel := context.WithCancel(context.Background())
+		t.Cleanup(cancel)
+		rawDB, _ := dbtestutil.NewDB(t)
+
+		// Before: no keys should be present
+		keys, err := rawDB.GetDBCryptKeys(ctx)
+		require.NoError(t, err, "no error should be returned")
+		require.Empty(t, keys, "no keys should be present")
+
+		// When: we init the crypt db
+		_, err = New(ctx, rawDB, cipher)
+		require.NoError(t, err)
+
+		// Then: a new key is inserted
+		keys, err = rawDB.GetDBCryptKeys(ctx)
+		require.NoError(t, err)
+		require.Len(t, keys, 1, "one key should be present")
+		require.Equal(t, cipher.HexDigest(), keys[0].ActiveKeyDigest.String, "key digest mismatch")
+		require.Empty(t, keys[0].RevokedKeyDigest.String, "key should not be revoked")
+		requireEncryptedEquals(t, cipher, keys[0].Test, "coder")
+	})
+
+	t.Run("MissingKey", func(t *testing.T) {
+		t.Parallel()
+
+		// Given: there exist two valid encryption keys
+		cipher1 := initCipher(t)
+		cipher2 := initCipher(t)
+		ctx, cancel := context.WithCancel(context.Background())
+		t.Cleanup(cancel)
+		rawDB, _ := dbtestutil.NewDB(t)
+
+		// Given: key 1 is already present in the database
+		err := rawDB.InsertDBCryptKey(ctx, database.InsertDBCryptKeyParams{
+			Number:          1,
+			ActiveKeyDigest: cipher1.HexDigest(),
+			Test:            fakeBase64RandomData(t, 32),
+		})
+		require.NoError(t, err, "no error should be returned")
+		keys, err := rawDB.GetDBCryptKeys(ctx)
+		require.NoError(t, err, "no error should be returned")
+		require.Len(t, keys, 1, "one key should be present")
+
+		// When: we init the crypt db with no keys
+		_, err = New(ctx, rawDB)
+		// Then: we error because we don't know how to decrypt the existing key
+		require.Error(t, err, "expected an error")
+		var derr *DecryptFailedError
+		require.ErrorAs(t, err, &derr, "expected a decrypt error")
+
+		// When: we init the crypt db with key 2
+		_, err = New(ctx, rawDB, cipher2)
+
+		// Then: we error because the key is not revoked and we don't know how to decrypt it
+		require.Error(t, err, "expected an error")
+		require.ErrorAs(t, err, &derr, "expected a decrypt error")
+
+		// When: the existing key is marked as having been revoked
+		err = rawDB.RevokeDBCryptKey(ctx, cipher1.HexDigest())
+		require.NoError(t, err, "no error should be returned")
+
+		// And: we init the crypt db with key 2
+		_, err = New(ctx, rawDB, cipher2)
+
+		// Then: we succeed
+		require.NoError(t, err)
+
+		// And: key 2 should now be the active key
+		keys, err = rawDB.GetDBCryptKeys(ctx)
+		require.NoError(t, err)
+		require.Len(t, keys, 2, "two keys should be present")
+		require.EqualValues(t, keys[0].Number, 1, "key number mismatch")
+		require.Empty(t, keys[0].ActiveKeyDigest.String, "key should not be active")
+		require.Equal(t, cipher1.HexDigest(), keys[0].RevokedKeyDigest.String, "key should be revoked")
+
+		require.EqualValues(t, keys[1].Number, 2, "key number mismatch")
+		require.Equal(t, cipher2.HexDigest(), keys[1].ActiveKeyDigest.String, "key digest mismatch")
+		require.Empty(t, keys[1].RevokedKeyDigest.String, "key should not be revoked")
+		requireEncryptedEquals(t, cipher2, keys[1].Test, "coder")
+	})
+
+	t.Run("NoKeys", func(t *testing.T) {
+		t.Parallel()
+		// Given: no cipher is loaded
+		ctx, cancel := context.WithCancel(context.Background())
+		t.Cleanup(cancel)
+		rawDB, _ := dbtestutil.NewDB(t)
+
+		keys, err := rawDB.GetDBCryptKeys(ctx)
+		require.NoError(t, err, "no error should be returned")
+		require.Empty(t, keys, "no keys should be present")
+
+		// When: we init the crypt db with no ciphers
+		_, err = New(ctx, rawDB)
+
+		// Then: it should succeed.
+		require.NoError(t, err, "dbcrypt.New should work with no keys against an unencrypted database")
+
+		// Assert invariant: no keys are inserted
+		keys, err = rawDB.GetDBCryptKeys(ctx)
+		require.NoError(t, err, "no error should be returned")
+		require.Empty(t, keys, "no keys should be present")
+
+		// Insert a key
+		require.NoError(t, rawDB.InsertDBCryptKey(ctx, database.InsertDBCryptKeyParams{
+			Number:          1,
+			ActiveKeyDigest: "whatever",
+			Test:            fakeBase64RandomData(t, 32),
+		}))
+
+		// This should fail as we do not know how to decrypt the key:
+		_, err = New(ctx, rawDB)
+		require.Error(t, err)
+		// Until we revoke the key:
+		require.NoError(t, rawDB.RevokeDBCryptKey(ctx, "whatever"))
+		_, err = New(ctx, rawDB)
+		require.NoError(t, err, "the above should still hold if the key is revoked")
+	})
+
+	t.Run("PrimaryRevoked", func(t *testing.T) {
+		t.Parallel()
+		// Given: a cipher is loaded
+		cipher := initCipher(t)
+		ctx, cancel := context.WithCancel(context.Background())
+		t.Cleanup(cancel)
+		rawDB, _ := dbtestutil.NewDB(t)
+
+		// And: the cipher is revoked before we init the crypt db
+		err := rawDB.InsertDBCryptKey(ctx, database.InsertDBCryptKeyParams{
+			Number:          1,
+			ActiveKeyDigest: cipher.HexDigest(),
+			Test:            fakeBase64RandomData(t, 32),
+		})
+		require.NoError(t, err, "no error should be returned")
+		err = rawDB.RevokeDBCryptKey(ctx, cipher.HexDigest())
+		require.NoError(t, err, "no error should be returned")
+
+		// Then: when we init the crypt db, we error because the key is revoked
+		_, err = New(ctx, rawDB, cipher)
+		require.Error(t, err)
+		require.ErrorContains(t, err, "has been revoked")
+	})
+
+	t.Run("Retry", func(t *testing.T) {
+		t.Parallel()
+		// Given: a cipher is loaded
+		cipher := initCipher(t)
+		ctx, cancel := context.WithCancel(context.Background())
+		testVal, err := cipher.Encrypt([]byte("coder"))
+		key := database.DBCryptKey{
+			Number:          1,
+			ActiveKeyDigest: sql.NullString{String: cipher.HexDigest(), Valid: true},
+			Test:            b64encode(testVal),
+		}
+		require.NoError(t, err)
+		t.Cleanup(cancel)
+
+		// And: a database that returns an error once when we try to serialize a key
+		ctrl := gomock.NewController(t)
+		mockDB := dbmock.NewMockStore(ctrl)
+
+		gomock.InOrder(
+			// First try: we get a serialization error.
+			expectInTx(mockDB),
+			mockDB.EXPECT().GetDBCryptKeys(gomock.Any()).Times(1).Return([]database.DBCryptKey{}, nil),
+			mockDB.EXPECT().InsertDBCryptKey(gomock.Any(), gomock.Any()).Times(1).Return(&pq.Error{Code: "40001"}),
+			// Second try: we get the key we wanted to insert initially.
+			expectInTx(mockDB),
+			mockDB.EXPECT().GetDBCryptKeys(gomock.Any()).Times(1).Return([]database.DBCryptKey{key}, nil),
+		)
+
+		_, err = New(ctx, mockDB, cipher)
+		require.NoError(t, err)
+	})
+}
+
+func TestEncryptDecryptField(t *testing.T) {
+	t.Parallel()
+	t.Run("OK", func(t *testing.T) {
+		t.Parallel()
+		_, cryptDB, ciphers := setup(t)
+		field := "coder"
+		digest := sql.NullString{}
+		require.NoError(t, cryptDB.encryptField(&field, &digest))
+		require.Equal(t, ciphers[0].HexDigest(), digest.String)
+		requireEncryptedEquals(t, ciphers[0], field, "coder")
+		require.NoError(t, cryptDB.decryptField(&field, digest))
+		require.Equal(t, "coder", field)
+	})
+
+	t.Run("NoKeys", func(t *testing.T) {
+		t.Parallel()
+		// With no keys, encryption and decryption are both no-ops.
+		_, cryptDB := setupNoCiphers(t)
+		field := "coder"
+		digest := sql.NullString{}
+		require.NoError(t, cryptDB.encryptField(&field, &digest))
+		require.Empty(t, digest.String)
+		require.Equal(t, "coder", field)
+		require.NoError(t, cryptDB.decryptField(&field, digest))
+		require.Equal(t, "coder", field)
+	})
+
+	t.Run("MissingKey", func(t *testing.T) {
+		t.Parallel()
+		_, cryptDB, ciphers := setup(t)
+		field := "coder"
+		digest := sql.NullString{}
+		err := cryptDB.encryptField(&field, &digest)
+		require.NoError(t, err)
+		requireEncryptedEquals(t, ciphers[0], field, "coder")
+		require.Equal(t, ciphers[0].HexDigest(), digest.String)
+		require.True(t, digest.Valid)
+
+		digest = sql.NullString{String: "missing", Valid: true}
+		var derr *DecryptFailedError
+		err = cryptDB.decryptField(&field, digest)
+		require.Error(t, err)
+		require.ErrorAs(t, err, &derr)
+	})
+
+	t.Run("CantEncryptOrDecryptNil", func(t *testing.T) {
+		t.Parallel()
+		_, cryptDB, _ := setup(t)
+		require.ErrorContains(t, cryptDB.encryptField(nil, nil), "developer error")
+		require.ErrorContains(t, cryptDB.decryptField(nil, sql.NullString{}), "developer error")
+	})
+
+	t.Run("EncryptEmptyString", func(t *testing.T) {
+		t.Parallel()
+		_, cryptDB, ciphers := setup(t)
+		field := ""
+		digest := sql.NullString{}
+		require.NoError(t, cryptDB.encryptField(&field, &digest))
+		requireEncryptedEquals(t, ciphers[0], field, "")
+		require.Equal(t, ciphers[0].HexDigest(), digest.String)
+		require.NoError(t, cryptDB.decryptField(&field, digest))
+		require.Empty(t, field)
+	})
+
+	t.Run("DecryptEmptyString", func(t *testing.T) {
+		t.Parallel()
+		_, cryptDB, ciphers := setup(t)
+		field := ""
+		digest := sql.NullString{String: ciphers[0].HexDigest(), Valid: true}
+		err := cryptDB.decryptField(&field, digest)
+		// Currently this has to fail because the ciphertext must at least
+		// have a nonce. This may need to be changed depending on future
+		// ciphers.
+		require.ErrorContains(t, err, "ciphertext too short")
+	})
+
+	t.Run("InvalidBase64", func(t *testing.T) {
+		t.Parallel()
+		_, cryptDB, ciphers := setup(t)
+		field := "not valid base64"
+		digest := sql.NullString{String: ciphers[0].HexDigest(), Valid: true}
+		err := cryptDB.decryptField(&field, digest)
+		require.ErrorContains(t, err, "illegal base64 data")
+	})
+}
+
+func expectInTx(mdb *dbmock.MockStore) *gomock.Call {
+	return mdb.EXPECT().InTx(gomock.Any(), gomock.Any()).Times(1).DoAndReturn(
+		func(f func(store database.Store) error, _ *sql.TxOptions) error {
+			return f(mdb)
+		},
+	)
+}
+
+func requireEncryptedEquals(t *testing.T, c Cipher, value, expected string) {
+	t.Helper()
+	data, err := base64.StdEncoding.DecodeString(value)
+	require.NoError(t, err, "invalid base64")
+	got, err := c.Decrypt(data)
+	require.NoError(t, err, "failed to decrypt data")
+	require.Equal(t, expected, string(got), "decrypted data does not match")
+}
+
+func initCipher(t *testing.T) *aes256 {
+	t.Helper()
+	key := make([]byte, 32) // AES-256 key size is 32 bytes
+	_, err := io.ReadFull(rand.Reader, key)
+	require.NoError(t, err)
+	c, err := cipherAES256(key)
+	require.NoError(t, err)
+	return c
+}
+
+func setup(t *testing.T) (db database.Store, cryptDB *dbCrypt, cs []Cipher) {
+	t.Helper()
+	rawDB, _ := dbtestutil.NewDB(t)
+	cs = append(cs, initCipher(t))
+	cdb, err := New(context.Background(), rawDB, cs...)
+	require.NoError(t, err)
+	cryptDB, ok := cdb.(*dbCrypt)
+	require.True(t, ok)
+	return rawDB, cryptDB, cs
+}
+
+func setupNoCiphers(t *testing.T) (db database.Store, cryptodb *dbCrypt) {
+	t.Helper()
+	rawDB, _ := dbtestutil.NewDB(t)
+	cdb, err := New(context.Background(), rawDB)
+	require.NoError(t, err)
+	cryptDB, ok := cdb.(*dbCrypt)
+	require.True(t, ok)
+	return rawDB, cryptDB
+}
+
+func fakeBase64RandomData(t *testing.T, n int) string {
+	t.Helper()
+	b := make([]byte, n)
+	_, err := io.ReadFull(rand.Reader, b)
+	require.NoError(t, err)
+	return base64.StdEncoding.EncodeToString(b)
+}
diff --git a/enterprise/dbcrypt/doc.go b/enterprise/dbcrypt/doc.go
new file mode 100644
index 0000000000000..39429f059a200
--- /dev/null
+++ b/enterprise/dbcrypt/doc.go
@@ -0,0 +1,34 @@
+// Package dbcrypt provides a database.Store wrapper that encrypts/decrypts
+// values stored at rest in the database.
+//
+// Encryption is done using Ciphers, which is an abstraction over a set of
+// encryption keys. Each key has a unique identifier, which is used to
+// uniquely identify the key whilst maintaining secrecy.
+//
+// Currently, AES-256-GCM is the only implemented cipher mode.
+// The Cipher is currently used to encrypt/decrypt the following fields:
+// - database.UserLink.OAuthAccessToken
+// - database.UserLink.OAuthRefreshToken
+// - database.GitAuthLink.OAuthAccessToken
+// - database.GitAuthLink.OAuthRefreshToken
+// - database.DBCryptSentinelValue
+//
+// Multiple ciphers can be provided to support key rotation. The primary cipher
+// is used to encrypt and decrypt all data. Secondary ciphers are only used
+// for decryption and, as a general rule, should only be active when rotating
+// keys.
+//
+// Encryption keys are stored in the database in the table `dbcrypt_keys`.
+// The table has the following schema:
+//   - number: the key number. This is used to avoid conflicts when rotating keys.
+//   - created_at: the time the key was created.
+//   - active_key_digest: the SHA256 digest of the active key. If null, the key has been revoked.
+//   - revoked_key_digest: the SHA256 digest of the revoked key. If null, the key has not been revoked.
+//   - revoked_at: the time the key was revoked. If null, the key has not been revoked.
+//   - test: the encrypted value of the string "coder". This is used to ensure that the key is valid.
+//
+// Encrypted fields are stored in the database as a base64-encoded string.
+// Each encrypted column MUST have a corresponding _key_id column that is a foreign key
+// reference to `dbcrypt_keys.active_key_digest`. This ensures that a key cannot be
+// revoked until all rows that use that key have been migrated to a new key.
+package dbcrypt
diff --git a/enterprise/derpmesh/derpmesh.go b/enterprise/derpmesh/derpmesh.go
index c3f322e9707e9..d5d7b17e09b94 100644
--- a/enterprise/derpmesh/derpmesh.go
+++ b/enterprise/derpmesh/derpmesh.go
@@ -12,7 +12,7 @@ import (
 	"tailscale.com/derp/derphttp"
 	"tailscale.com/types/key"
 
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/tailnet"
 
 	"cdr.dev/slog"
 )
diff --git a/enterprise/derpmesh/derpmesh_test.go b/enterprise/derpmesh/derpmesh_test.go
index a4a7373c9aab0..9f24ba7b1c971 100644
--- a/enterprise/derpmesh/derpmesh_test.go
+++ b/enterprise/derpmesh/derpmesh_test.go
@@ -19,9 +19,9 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/enterprise/derpmesh"
-	"github.com/coder/coder/tailnet"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/enterprise/derpmesh"
+	"github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
diff --git a/enterprise/provisionerd/remoteprovisioners.go b/enterprise/provisionerd/remoteprovisioners.go
new file mode 100644
index 0000000000000..26c93322e662a
--- /dev/null
+++ b/enterprise/provisionerd/remoteprovisioners.go
@@ -0,0 +1,466 @@
+package provisionerd
+
+import (
+	"bufio"
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/subtle"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/base64"
+	"encoding/pem"
+	"fmt"
+	"io"
+	"math/big"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"golang.org/x/xerrors"
+	"storj.io/drpc/drpcconn"
+
+	"cdr.dev/slog"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/provisioner/echo"
+	agpl "github.com/coder/coder/v2/provisionerd"
+	"github.com/coder/coder/v2/provisionerd/proto"
+	"github.com/coder/coder/v2/provisionersdk"
+	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
+)
+
+// Executor is responsible for executing the remote provisioners.
+//
+// TODO: this interface is where we will run Kubernetes Jobs in a future
+// version; right now, only the unit tests implement this interface.
+type Executor interface {
+	// Execute a provisioner that connects back to the remoteConnector.  errCh
+	// allows signaling of errors asynchronously and is closed on completion
+	// with no error.
+	Execute(
+		ctx context.Context,
+		provisionerType database.ProvisionerType,
+		jobID, token, daemonCert, daemonAddress string) (errCh <-chan error)
+}
+
+type waiter struct {
+	ctx    context.Context
+	job    *proto.AcquiredJob
+	respCh chan<- agpl.ConnectResponse
+	token  string
+}
+
+type remoteConnector struct {
+	ctx      context.Context
+	executor Executor
+	cert     string
+	addr     string
+	listener net.Listener
+	logger   slog.Logger
+	tlsCfg   *tls.Config
+
+	mu      sync.Mutex
+	waiters map[string]waiter
+}
+
+func NewRemoteConnector(ctx context.Context, logger slog.Logger, exec Executor) (agpl.Connector, error) {
+	// nolint: gosec
+	listener, err := net.Listen("tcp", ":0")
+	if err != nil {
+		return nil, xerrors.Errorf("failed to listen: %w", err)
+	}
+	go func() {
+		<-ctx.Done()
+		ce := listener.Close()
+		logger.Debug(ctx, "listener closed", slog.Error(ce))
+	}()
+	r := &remoteConnector{
+		ctx:      ctx,
+		executor: exec,
+		listener: listener,
+		addr:     listener.Addr().String(),
+		logger:   logger,
+		waiters:  make(map[string]waiter),
+	}
+	err = r.genCert()
+	if err != nil {
+		return nil, xerrors.Errorf("failed to generate certificate: %w", err)
+	}
+	go r.listenLoop()
+	return r, nil
+}
+
+func (r *remoteConnector) genCert() error {
+	privateKey, cert, err := GenCert()
+	if err != nil {
+		return err
+	}
+	r.cert = string(cert)
+	privateKeyBytes, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	if err != nil {
+		return xerrors.Errorf("failed to marshal private key: %w", err)
+	}
+	pkPEM := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: privateKeyBytes})
+	certKey, err := tls.X509KeyPair(cert, pkPEM)
+	if err != nil {
+		return xerrors.Errorf("failed to create TLS certificate: %w", err)
+	}
+	r.tlsCfg = &tls.Config{Certificates: []tls.Certificate{certKey}, MinVersion: tls.VersionTLS13}
+	return nil
+}
+
+// GenCert is a helper function that generates a private key and certificate.  It
+// is exported so that we can test a certificate generated in exactly the same
+// way, but with a different private key.
+func GenCert() (*ecdsa.PrivateKey, []byte, error) {
+	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, nil, xerrors.Errorf("generate private key: %w", err)
+	}
+	template := x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject: pkix.Name{
+			CommonName: "Coder Provisioner Daemon",
+		},
+		DNSNames:  []string{serverName},
+		NotBefore: time.Now(),
+		// cert is valid for 5 years, which is much longer than we expect this
+		// process to stay up.  The idea is that the certificate is self-signed
+		// and is valid for as long as the daemon is up and starting new remote
+		// provisioners
+		NotAfter: time.Now().Add(time.Hour * 24 * 365 * 5),
+
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+	}
+
+	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
+	if err != nil {
+		return nil, nil, xerrors.Errorf("failed to create certificate: %w", err)
+	}
+	cert := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
+	return privateKey, cert, nil
+}
+
+func (r *remoteConnector) listenLoop() {
+	for {
+		conn, err := r.listener.Accept()
+		if err != nil {
+			r.logger.Info(r.ctx, "stopping listenLoop", slog.Error(err))
+			return
+		}
+		go r.handleConn(conn)
+	}
+}
+
+func (r *remoteConnector) handleConn(conn net.Conn) {
+	logger := r.logger.With(slog.F("remote_addr", conn.RemoteAddr()))
+
+	// If we hit an error while setting up, we want to close the connection.
+	// This construction makes the default to close until we explicitly set
+	// closeConn = false just before handing the connection over the respCh.
+	closeConn := true
+	defer func() {
+		if closeConn {
+			ce := conn.Close()
+			logger.Debug(r.ctx, "closed connection", slog.Error(ce))
+		}
+	}()
+
+	tlsConn := tls.Server(conn, r.tlsCfg)
+	err := tlsConn.HandshakeContext(r.ctx)
+	if err != nil {
+		logger.Info(r.ctx, "failed TLS handshake", slog.Error(err))
+		return
+	}
+	w, err := r.authenticate(tlsConn)
+	if err != nil {
+		logger.Info(r.ctx, "failed provisioner authentication", slog.Error(err))
+		return
+	}
+	logger = logger.With(slog.F("job_id", w.job.JobId))
+	logger.Info(r.ctx, "provisioner connected")
+	closeConn = false // we're passing the conn over the channel
+	w.respCh <- agpl.ConnectResponse{
+		Job:    w.job,
+		Client: sdkproto.NewDRPCProvisionerClient(drpcconn.New(tlsConn)),
+	}
+}
+
+var (
+	errInvalidJobID = xerrors.New("invalid jobID")
+	errInvalidToken = xerrors.New("invalid token")
+)
+
+func (r *remoteConnector) pullWaiter(jobID, token string) (waiter, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	// provisioners authenticate with a jobID and token.  The jobID is required
+	// because we need to use public information for the lookup, to avoid timing
+	// attacks against the token.
+	w, ok := r.waiters[jobID]
+	if !ok {
+		return waiter{}, errInvalidJobID
+	}
+	if subtle.ConstantTimeCompare([]byte(token), []byte(w.token)) == 1 {
+		delete(r.waiters, jobID)
+		return w, nil
+	}
+	return waiter{}, errInvalidToken
+}
+
+func (r *remoteConnector) Connect(
+	ctx context.Context, job *proto.AcquiredJob, respCh chan<- agpl.ConnectResponse,
+) {
+	pt := database.ProvisionerType(job.Provisioner)
+	if !pt.Valid() {
+		go errResponse(job, respCh, xerrors.Errorf("invalid provisioner type: %s", job.Provisioner))
+	}
+	tb := make([]byte, 16) // 128-bit token
+	n, err := rand.Read(tb)
+	if err != nil {
+		go errResponse(job, respCh, err)
+		return
+	}
+	if n != 16 {
+		go errResponse(job, respCh, xerrors.New("short read generating token"))
+	}
+	token := base64.StdEncoding.EncodeToString(tb)
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.waiters[job.JobId] = waiter{
+		ctx:    ctx,
+		job:    job,
+		respCh: respCh,
+		token:  token,
+	}
+	go r.handleContextExpired(ctx, job.JobId)
+	errCh := r.executor.Execute(ctx, pt, job.JobId, token, r.cert, r.addr)
+	go r.handleExecError(job.JobId, errCh)
+}
+
+func (r *remoteConnector) handleContextExpired(ctx context.Context, jobID string) {
+	<-ctx.Done()
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	w, ok := r.waiters[jobID]
+	if !ok {
+		// something else already responded.
+		return
+	}
+	delete(r.waiters, jobID)
+	// separate goroutine, so we don't hold the lock while trying to write
+	// to the channel.
+	go func() {
+		w.respCh <- agpl.ConnectResponse{
+			Job:   w.job,
+			Error: ctx.Err(),
+		}
+	}()
+}
+
+func (r *remoteConnector) handleExecError(jobID string, errCh <-chan error) {
+	err := <-errCh
+	if err == nil {
+		return
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	w, ok := r.waiters[jobID]
+	if !ok {
+		// something else already responded.
+		return
+	}
+	delete(r.waiters, jobID)
+	// separate goroutine, so we don't hold the lock while trying to write
+	// to the channel.
+	go func() {
+		w.respCh <- agpl.ConnectResponse{
+			Job:   w.job,
+			Error: err,
+		}
+	}()
+}
+
+func errResponse(job *proto.AcquiredJob, respCh chan<- agpl.ConnectResponse, err error) {
+	respCh <- agpl.ConnectResponse{
+		Job:   job,
+		Error: err,
+	}
+}
+
+// EphemeralEcho starts an Echo provisioner that connects to provisioner daemon,
+// handles one job, then exits.
+func EphemeralEcho(
+	ctx context.Context,
+	logger slog.Logger,
+	cacheDir, jobID, token, daemonCert, daemonAddress string,
+) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	workdir := filepath.Join(cacheDir, "echo")
+	err := os.MkdirAll(workdir, 0o777)
+	if err != nil {
+		return xerrors.Errorf("create workdir %s: %w", workdir, err)
+	}
+	conn, err := DialTLS(ctx, daemonCert, daemonAddress)
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+	err = AuthenticateProvisioner(conn, token, jobID)
+	if err != nil {
+		return err
+	}
+	// so it's a little confusing, but the provisioner is the client with
+	// respect to TLS, but is the server with respect to dRPC
+	exitErr := echo.Serve(ctx, &provisionersdk.ServeOptions{
+		Conn:          conn,
+		Logger:        logger.Named("echo"),
+		WorkDirectory: workdir,
+	})
+	logger.Debug(ctx, "echo.Serve done", slog.Error(exitErr))
+
+	if xerrors.Is(exitErr, context.Canceled) {
+		return nil
+	}
+	return exitErr
+}
+
+// DialTLS establishes a TLS connection to the given addr using the given cert
+// as the root CA
+func DialTLS(ctx context.Context, cert, addr string) (*tls.Conn, error) {
+	roots := x509.NewCertPool()
+	ok := roots.AppendCertsFromPEM([]byte(cert))
+	if !ok {
+		return nil, xerrors.New("failed to parse daemon certificate")
+	}
+	cfg := &tls.Config{RootCAs: roots, MinVersion: tls.VersionTLS13, ServerName: serverName}
+	d := net.Dialer{}
+	nc, err := d.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return nil, xerrors.Errorf("dial: %w", err)
+	}
+	tc := tls.Client(nc, cfg)
+	// Explicitly handshake so we don't have to mess with setting read
+	// and write deadlines.
+	err = tc.HandshakeContext(ctx)
+	if err != nil {
+		_ = nc.Close()
+		return nil, xerrors.Errorf("TLS handshake: %w", err)
+	}
+	return tc, nil
+}
+
+// Authentication Protocol:
+//
+// Ephemeral provisioners connect to the connector using TLS.  This allows the
+// provisioner to authenticate the daemon/connector based on the TLS certificate
+// delivered to the provisioner out-of-band.
+//
+// The daemon/connector authenticates the provisioner by jobID and token, which
+// are sent over the TLS connection separated by newlines.  The daemon/connector
+// responds with a 3-byte response to complete the handshake.
+//
+// Although the token is unique to the job and unambiguous, we also send the
+// jobID.  This allows the daemon/connector to look up the job based on public
+// information (jobID), shielding the token from timing attacks.  I'm not sure
+// how practical a timing attack against an in-memory golang map is, but it's
+// better to avoid it entirely.  After the job is looked up by jobID, we do a
+// constant time compare on the token to authenticate.
+//
+// Also note that we don't really have to worry about cross-version
+// compatibility in this protocol, since the provisioners are always started by
+// the same daemon/connector as they connect to.
+
+// Responses are all exactly 3 bytes so that don't have to use a scanner
+// which might accidentally buffer some of the first dRPC request.
+const (
+	responseOK           = "OK\n"
+	responseInvalidJobID = "IJ\n"
+	responseInvalidToken = "IT\n"
+)
+
+// serverName is the name on the x509 certificate the daemon/connector generates
+// this name doesn't matter as long as both sides agree, since the provisioners
+// get the IP address directly.  It is also fine to reuse, since each generates
+// a unique private key and self-signs, we will not correctly authenticate to
+// a different provisionerd.
+const serverName = "provisionerd"
+
+// AuthenticateProvisioner performs the provisioner's side of the authentication
+// protocol.
+func AuthenticateProvisioner(conn io.ReadWriter, token, jobID string) error {
+	sb := strings.Builder{}
+	_, _ = sb.WriteString(jobID)
+	_, _ = sb.WriteString("\n")
+	_, _ = sb.WriteString(token)
+	_, _ = sb.WriteString("\n")
+	_, err := conn.Write([]byte(sb.String()))
+	if err != nil {
+		return xerrors.Errorf("failed to write token: %w", err)
+	}
+	b := make([]byte, 3)
+	_, err = conn.Read(b)
+	if err != nil {
+		return xerrors.Errorf("failed to read token resp: %w", err)
+	}
+	if string(b) != responseOK {
+		// convert to a human-readable format
+		var reason string
+		switch string(b) {
+		case responseInvalidJobID:
+			reason = "invalid job ID"
+		case responseInvalidToken:
+			reason = "invalid token"
+		default:
+			reason = fmt.Sprintf("unknown response code: %s", b)
+		}
+		return xerrors.Errorf("authenticate protocol error: %s", reason)
+	}
+	return nil
+}
+
+// authenticate performs the daemon/connector's side of the authentication
+// protocol.
+func (r *remoteConnector) authenticate(conn io.ReadWriter) (waiter, error) {
+	// it's fine to use a scanner here because the provisioner side doesn't hand
+	// off the connection to the dRPC handler until after we send our response.
+	scn := bufio.NewScanner(conn)
+	if ok := scn.Scan(); !ok {
+		return waiter{}, xerrors.Errorf("failed to receive jobID: %w", scn.Err())
+	}
+	jobID := scn.Text()
+	if ok := scn.Scan(); !ok {
+		return waiter{}, xerrors.Errorf("failed to receive job token: %w", scn.Err())
+	}
+	token := scn.Text()
+	w, err := r.pullWaiter(jobID, token)
+	if err == nil {
+		_, err = conn.Write([]byte(responseOK))
+		if err != nil {
+			err = xerrors.Errorf("failed to write authentication response: %w", err)
+			// if we fail here, it's our responsibility to send the error response on the respCh
+			// because we're not going to return the waiter to the caller.
+			go errResponse(w.job, w.respCh, err)
+			return waiter{}, err
+		}
+		return w, nil
+	}
+	if xerrors.Is(err, errInvalidJobID) {
+		_, wErr := conn.Write([]byte(responseInvalidJobID))
+		r.logger.Debug(r.ctx, "responded invalid jobID", slog.Error(wErr))
+	}
+	if xerrors.Is(err, errInvalidToken) {
+		_, wErr := conn.Write([]byte(responseInvalidToken))
+		r.logger.Debug(r.ctx, "responded invalid token", slog.Error(wErr))
+	}
+	return waiter{}, err
+}
diff --git a/enterprise/provisionerd/remoteprovisioners_test.go b/enterprise/provisionerd/remoteprovisioners_test.go
new file mode 100644
index 0000000000000..1e1ca3d788b02
--- /dev/null
+++ b/enterprise/provisionerd/remoteprovisioners_test.go
@@ -0,0 +1,371 @@
+package provisionerd_test
+
+import (
+	"context"
+	"crypto/rand"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/goleak"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/enterprise/provisionerd"
+	"github.com/coder/coder/v2/provisioner/echo"
+	agpl "github.com/coder/coder/v2/provisionerd"
+	"github.com/coder/coder/v2/provisionerd/proto"
+	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestMain(m *testing.M) {
+	goleak.VerifyTestMain(m)
+}
+
+func TestRemoteConnector_Mainline(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name        string
+		smokescreen bool
+	}{
+		{name: "NoSmokescreen", smokescreen: false},
+		{name: "Smokescreen", smokescreen: true},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+			defer cancel()
+			logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+			exec := &testExecutor{
+				t:           t,
+				logger:      logger,
+				smokescreen: tc.smokescreen,
+			}
+			uut, err := provisionerd.NewRemoteConnector(ctx, logger.Named("connector"), exec)
+			require.NoError(t, err)
+
+			respCh := make(chan agpl.ConnectResponse)
+			job := &proto.AcquiredJob{
+				JobId:       "test-job",
+				Provisioner: string(database.ProvisionerTypeEcho),
+			}
+			uut.Connect(ctx, job, respCh)
+			var resp agpl.ConnectResponse
+			select {
+			case <-ctx.Done():
+				t.Error("timeout waiting for connect response")
+			case resp = <-respCh:
+				// OK
+			}
+			require.NoError(t, resp.Error)
+			require.Equal(t, job, resp.Job)
+			require.NotNil(t, resp.Client)
+
+			// check that we can communicate with the provisioner
+			er := &echo.Responses{
+				Parse:          echo.ParseComplete,
+				ProvisionApply: echo.ApplyComplete,
+				ProvisionPlan:  echo.PlanComplete,
+			}
+			arc, err := echo.Tar(er)
+			require.NoError(t, err)
+			c := resp.Client
+			s, err := c.Session(ctx)
+			require.NoError(t, err)
+			err = s.Send(&sdkproto.Request{Type: &sdkproto.Request_Config{Config: &sdkproto.Config{
+				TemplateSourceArchive: arc,
+			}}})
+			require.NoError(t, err)
+			err = s.Send(&sdkproto.Request{Type: &sdkproto.Request_Parse{Parse: &sdkproto.ParseRequest{}}})
+			require.NoError(t, err)
+			r, err := s.Recv()
+			require.NoError(t, err)
+			require.IsType(t, &sdkproto.Response_Parse{}, r.Type)
+		})
+	}
+}
+
+func TestRemoteConnector_BadToken(t *testing.T) {
+	t.Parallel()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+	exec := &testExecutor{
+		t:             t,
+		logger:        logger,
+		overrideToken: "bad-token",
+	}
+	uut, err := provisionerd.NewRemoteConnector(ctx, logger.Named("connector"), exec)
+	require.NoError(t, err)
+
+	respCh := make(chan agpl.ConnectResponse)
+	job := &proto.AcquiredJob{
+		JobId:       "test-job",
+		Provisioner: string(database.ProvisionerTypeEcho),
+	}
+	uut.Connect(ctx, job, respCh)
+	var resp agpl.ConnectResponse
+	select {
+	case <-ctx.Done():
+		t.Fatal("timeout waiting for connect response")
+	case resp = <-respCh:
+		// OK
+	}
+	require.Equal(t, job, resp.Job)
+	require.ErrorContains(t, resp.Error, "invalid token")
+}
+
+func TestRemoteConnector_BadJobID(t *testing.T) {
+	t.Parallel()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+	exec := &testExecutor{
+		t:             t,
+		logger:        logger,
+		overrideJobID: "bad-job",
+	}
+	uut, err := provisionerd.NewRemoteConnector(ctx, logger.Named("connector"), exec)
+	require.NoError(t, err)
+
+	respCh := make(chan agpl.ConnectResponse)
+	job := &proto.AcquiredJob{
+		JobId:       "test-job",
+		Provisioner: string(database.ProvisionerTypeEcho),
+	}
+	uut.Connect(ctx, job, respCh)
+	var resp agpl.ConnectResponse
+	select {
+	case <-ctx.Done():
+		t.Fatal("timeout waiting for connect response")
+	case resp = <-respCh:
+		// OK
+	}
+	require.Equal(t, job, resp.Job)
+	require.ErrorContains(t, resp.Error, "invalid job ID")
+}
+
+func TestRemoteConnector_BadCert(t *testing.T) {
+	t.Parallel()
+	_, cert, err := provisionerd.GenCert()
+	require.NoError(t, err)
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+	exec := &testExecutor{
+		t:            t,
+		logger:       logger,
+		overrideCert: string(cert),
+	}
+	uut, err := provisionerd.NewRemoteConnector(ctx, logger.Named("connector"), exec)
+	require.NoError(t, err)
+
+	respCh := make(chan agpl.ConnectResponse)
+	job := &proto.AcquiredJob{
+		JobId:       "test-job",
+		Provisioner: string(database.ProvisionerTypeEcho),
+	}
+	uut.Connect(ctx, job, respCh)
+	var resp agpl.ConnectResponse
+	select {
+	case <-ctx.Done():
+		t.Fatal("timeout waiting for connect response")
+	case resp = <-respCh:
+		// OK
+	}
+	require.Equal(t, job, resp.Job)
+	require.ErrorContains(t, resp.Error, "certificate signed by unknown authority")
+}
+
+func TestRemoteConnector_Fuzz(t *testing.T) {
+	t.Parallel()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+	exec := newFuzzExecutor(t, logger)
+	uut, err := provisionerd.NewRemoteConnector(ctx, logger.Named("connector"), exec)
+	require.NoError(t, err)
+
+	respCh := make(chan agpl.ConnectResponse)
+	job := &proto.AcquiredJob{
+		JobId:       "test-job",
+		Provisioner: string(database.ProvisionerTypeEcho),
+	}
+
+	connectCtx, connectCtxCancel := context.WithCancel(ctx)
+	defer connectCtxCancel()
+
+	uut.Connect(connectCtx, job, respCh)
+	select {
+	case <-ctx.Done():
+		t.Fatal("timeout waiting for fuzzer")
+	case <-exec.done:
+		// Connector hung up on the fuzzer
+	}
+	require.Less(t, exec.bytesFuzzed, 2<<20, "should not allow more than 1 MiB")
+	connectCtxCancel()
+	var resp agpl.ConnectResponse
+	select {
+	case <-ctx.Done():
+		t.Fatal("timeout waiting for connect response")
+	case resp = <-respCh:
+		// OK
+	}
+	require.Equal(t, job, resp.Job)
+	require.ErrorIs(t, resp.Error, context.Canceled)
+}
+
+func TestRemoteConnector_CancelConnect(t *testing.T) {
+	t.Parallel()
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+	defer cancel()
+	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
+	exec := &testExecutor{
+		t:         t,
+		logger:    logger,
+		dontStart: true,
+	}
+	uut, err := provisionerd.NewRemoteConnector(ctx, logger.Named("connector"), exec)
+	require.NoError(t, err)
+
+	respCh := make(chan agpl.ConnectResponse)
+	job := &proto.AcquiredJob{
+		JobId:       "test-job",
+		Provisioner: string(database.ProvisionerTypeEcho),
+	}
+
+	connectCtx, connectCtxCancel := context.WithCancel(ctx)
+	defer connectCtxCancel()
+
+	uut.Connect(connectCtx, job, respCh)
+	connectCtxCancel()
+	var resp agpl.ConnectResponse
+	select {
+	case <-ctx.Done():
+		t.Fatal("timeout waiting for connect response")
+	case resp = <-respCh:
+		// OK
+	}
+	require.Equal(t, job, resp.Job)
+	require.ErrorIs(t, resp.Error, context.Canceled)
+}
+
+type testExecutor struct {
+	t             *testing.T
+	logger        slog.Logger
+	overrideToken string
+	overrideJobID string
+	overrideCert  string
+	// dontStart simulates when everything looks good to the connector but
+	// the provisioner never starts
+	dontStart bool
+	// smokescreen starts a connection that fails authentication before starting
+	// the real connection.  Tests that failed connections don't interfere with
+	// real ones.
+	smokescreen bool
+}
+
+func (e *testExecutor) Execute(
+	ctx context.Context,
+	provisionerType database.ProvisionerType,
+	jobID, token, daemonCert, daemonAddress string,
+) <-chan error {
+	assert.Equal(e.t, database.ProvisionerTypeEcho, provisionerType)
+	if e.overrideToken != "" {
+		token = e.overrideToken
+	}
+	if e.overrideJobID != "" {
+		jobID = e.overrideJobID
+	}
+	if e.overrideCert != "" {
+		daemonCert = e.overrideCert
+	}
+	cacheDir := e.t.TempDir()
+	errCh := make(chan error)
+	go func() {
+		defer close(errCh)
+		if e.smokescreen {
+			e.doSmokeScreen(ctx, jobID, daemonCert, daemonAddress)
+		}
+		if !e.dontStart {
+			err := provisionerd.EphemeralEcho(ctx, e.logger, cacheDir, jobID, token, daemonCert, daemonAddress)
+			e.logger.Debug(ctx, "provisioner done", slog.Error(err))
+			if err != nil {
+				errCh <- err
+			}
+		}
+	}()
+	return errCh
+}
+
+func (e *testExecutor) doSmokeScreen(ctx context.Context, jobID, daemonCert, daemonAddress string) {
+	conn, err := provisionerd.DialTLS(ctx, daemonCert, daemonAddress)
+	if !assert.NoError(e.t, err) {
+		return
+	}
+	defer conn.Close()
+	err = provisionerd.AuthenticateProvisioner(conn, "smokescreen", jobID)
+	assert.ErrorContains(e.t, err, "invalid token")
+}
+
+type fuzzExecutor struct {
+	t           *testing.T
+	logger      slog.Logger
+	done        chan struct{}
+	bytesFuzzed int
+}
+
+func newFuzzExecutor(t *testing.T, logger slog.Logger) *fuzzExecutor {
+	return &fuzzExecutor{
+		t:           t,
+		logger:      logger,
+		done:        make(chan struct{}),
+		bytesFuzzed: 0,
+	}
+}
+
+func (e *fuzzExecutor) Execute(
+	ctx context.Context,
+	_ database.ProvisionerType,
+	_, _, daemonCert, daemonAddress string,
+) <-chan error {
+	errCh := make(chan error)
+	go func() {
+		defer close(errCh)
+		defer close(e.done)
+		conn, err := provisionerd.DialTLS(ctx, daemonCert, daemonAddress)
+		assert.NoError(e.t, err)
+		rb := make([]byte, 128)
+		for {
+			if ctx.Err() != nil {
+				e.t.Error("context canceled while fuzzing")
+				return
+			}
+			n, err := rand.Read(rb)
+			if err != nil {
+				e.t.Errorf("random read: %s", err)
+			}
+			if n < 128 {
+				e.t.Error("short random read")
+				return
+			}
+			// replace newlines so the Connector doesn't think we are done
+			// with the JobID
+			for i := 0; i < len(rb); i++ {
+				if rb[i] == '\n' || rb[i] == '\r' {
+					rb[i] = 'A'
+				}
+			}
+			n, err = conn.Write(rb)
+			e.bytesFuzzed += n
+			if err != nil {
+				return
+			}
+		}
+	}()
+	return errCh
+}
diff --git a/enterprise/replicasync/replicasync.go b/enterprise/replicasync/replicasync.go
index 42bf402a6682e..1d6cd349b376d 100644
--- a/enterprise/replicasync/replicasync.go
+++ b/enterprise/replicasync/replicasync.go
@@ -17,10 +17,11 @@ import (
 
 	"cdr.dev/slog"
 
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/database/pubsub"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
 )
 
 var PubsubEvent = "replica"
@@ -66,9 +67,9 @@ func New(ctx context.Context, logger slog.Logger, db database.Store, ps pubsub.P
 	// nolint:gocritic // Inserting a replica is a system function.
 	replica, err := db.InsertReplica(dbauthz.AsSystemRestricted(ctx), database.InsertReplicaParams{
 		ID:              options.ID,
-		CreatedAt:       database.Now(),
-		StartedAt:       database.Now(),
-		UpdatedAt:       database.Now(),
+		CreatedAt:       dbtime.Now(),
+		StartedAt:       dbtime.Now(),
+		UpdatedAt:       dbtime.Now(),
 		Hostname:        hostname,
 		RegionID:        options.RegionID,
 		RelayAddress:    options.RelayAddress,
@@ -144,7 +145,7 @@ func (m *Manager) PublishUpdate() error {
 // If the replica was updated > the time, it's considered healthy.
 // If the replica was updated < the time, it's considered stale.
 func (m *Manager) updateInterval() time.Time {
-	return database.Now().Add(-3 * m.options.UpdateInterval)
+	return dbtime.Now().Add(-3 * m.options.UpdateInterval)
 }
 
 // loop runs the replica update sequence on an update interval.
@@ -305,7 +306,7 @@ func (m *Manager) syncReplicas(ctx context.Context) error {
 	// nolint:gocritic // Updating a replica is a system function.
 	replica, err := m.db.UpdateReplica(dbauthz.AsSystemRestricted(ctx), database.UpdateReplicaParams{
 		ID:              m.self.ID,
-		UpdatedAt:       database.Now(),
+		UpdatedAt:       dbtime.Now(),
 		StartedAt:       m.self.StartedAt,
 		StoppedAt:       m.self.StoppedAt,
 		RelayAddress:    m.self.RelayAddress,
@@ -375,7 +376,13 @@ func (m *Manager) InRegion(regionID int32) []database.Replica {
 
 // Regional returns all replicas in the same region excluding itself.
 func (m *Manager) Regional() []database.Replica {
-	return m.InRegion(m.self.RegionID)
+	return m.InRegion(m.regionID())
+}
+
+func (m *Manager) regionID() int32 {
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+	return m.self.RegionID
 }
 
 // SetCallback sets a function to execute whenever new peers
@@ -407,17 +414,19 @@ func (m *Manager) Close() error {
 	// nolint:gocritic // Updating a replica is a system function.
 	_, err := m.db.UpdateReplica(dbauthz.AsSystemRestricted(ctx), database.UpdateReplicaParams{
 		ID:        m.self.ID,
-		UpdatedAt: database.Now(),
+		UpdatedAt: dbtime.Now(),
 		StartedAt: m.self.StartedAt,
 		StoppedAt: sql.NullTime{
-			Time:  database.Now(),
+			Time:  dbtime.Now(),
 			Valid: true,
 		},
-		RelayAddress: m.self.RelayAddress,
-		RegionID:     m.self.RegionID,
-		Hostname:     m.self.Hostname,
-		Version:      m.self.Version,
-		Error:        m.self.Error,
+		RelayAddress:    m.self.RelayAddress,
+		RegionID:        m.self.RegionID,
+		Hostname:        m.self.Hostname,
+		Version:         m.self.Version,
+		Error:           m.self.Error,
+		DatabaseLatency: 0,     // A stopped replica has no latency.
+		Primary:         false, // A stopped replica cannot be primary.
 	})
 	if err != nil {
 		return xerrors.Errorf("update replica: %w", err)
diff --git a/enterprise/replicasync/replicasync_test.go b/enterprise/replicasync/replicasync_test.go
index 1f33075fd44b3..89ee49bec2bb6 100644
--- a/enterprise/replicasync/replicasync_test.go
+++ b/enterprise/replicasync/replicasync_test.go
@@ -15,12 +15,13 @@ import (
 	"go.uber.org/goleak"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/enterprise/replicasync"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/enterprise/replicasync"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
@@ -61,9 +62,9 @@ func TestReplica(t *testing.T) {
 		db, pubsub := dbtestutil.NewDB(t)
 		peer, err := db.InsertReplica(context.Background(), database.InsertReplicaParams{
 			ID:           uuid.New(),
-			CreatedAt:    database.Now(),
-			StartedAt:    database.Now(),
-			UpdatedAt:    database.Now(),
+			CreatedAt:    dbtime.Now(),
+			StartedAt:    dbtime.Now(),
+			UpdatedAt:    dbtime.Now(),
 			Hostname:     "something",
 			RelayAddress: srv.URL,
 			Primary:      true,
@@ -106,9 +107,9 @@ func TestReplica(t *testing.T) {
 		db, pubsub := dbtestutil.NewDB(t)
 		peer, err := db.InsertReplica(context.Background(), database.InsertReplicaParams{
 			ID:           uuid.New(),
-			CreatedAt:    database.Now(),
-			StartedAt:    database.Now(),
-			UpdatedAt:    database.Now(),
+			CreatedAt:    dbtime.Now(),
+			StartedAt:    dbtime.Now(),
+			UpdatedAt:    dbtime.Now(),
 			Hostname:     "something",
 			RelayAddress: srv.URL,
 			Primary:      true,
@@ -133,9 +134,9 @@ func TestReplica(t *testing.T) {
 		db, pubsub := dbtestutil.NewDB(t)
 		peer, err := db.InsertReplica(context.Background(), database.InsertReplicaParams{
 			ID:        uuid.New(),
-			CreatedAt: database.Now().Add(time.Minute),
-			StartedAt: database.Now().Add(time.Minute),
-			UpdatedAt: database.Now().Add(time.Minute),
+			CreatedAt: dbtime.Now().Add(time.Minute),
+			StartedAt: dbtime.Now().Add(time.Minute),
+			UpdatedAt: dbtime.Now().Add(time.Minute),
 			Hostname:  "something",
 			// Fake address to dial!
 			RelayAddress: "http://127.0.0.1:1",
@@ -173,7 +174,7 @@ func TestReplica(t *testing.T) {
 		peer, err := db.InsertReplica(ctx, database.InsertReplicaParams{
 			ID:           uuid.New(),
 			RelayAddress: srv.URL,
-			UpdatedAt:    database.Now(),
+			UpdatedAt:    dbtime.Now(),
 			Primary:      true,
 		})
 		require.NoError(t, err)
@@ -192,7 +193,7 @@ func TestReplica(t *testing.T) {
 		db, pubsub := dbtestutil.NewDB(t)
 		_, err := db.InsertReplica(context.Background(), database.InsertReplicaParams{
 			ID:        uuid.New(),
-			UpdatedAt: database.Now().Add(-time.Hour),
+			UpdatedAt: dbtime.Now().Add(-time.Hour),
 			Primary:   true,
 		})
 		require.NoError(t, err)
@@ -217,7 +218,7 @@ func TestReplica(t *testing.T) {
 		// This doesn't use the database fake because creating
 		// this many PostgreSQL connections takes some
 		// configuration tweaking.
-		db := dbfake.New()
+		db := dbmem.New()
 		pubsub := pubsub.NewInMemory()
 		logger := slogtest.Make(t, nil)
 		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
diff --git a/enterprise/tailnet/connio.go b/enterprise/tailnet/connio.go
new file mode 100644
index 0000000000000..fed307758603e
--- /dev/null
+++ b/enterprise/tailnet/connio.go
@@ -0,0 +1,137 @@
+package tailnet
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+	"nhooyr.io/websocket"
+
+	"cdr.dev/slog"
+	agpl "github.com/coder/coder/v2/tailnet"
+)
+
+// connIO manages the reading and writing to a connected client or agent.  Agent connIOs have their client field set to
+// uuid.Nil.  It reads node updates via its decoder, then pushes them onto the bindings channel.  It receives mappings
+// via its updates TrackedConn, which then writes them.
+type connIO struct {
+	pCtx     context.Context
+	ctx      context.Context
+	cancel   context.CancelFunc
+	logger   slog.Logger
+	decoder  *json.Decoder
+	updates  *agpl.TrackedConn
+	bindings chan<- binding
+}
+
+func newConnIO(pCtx context.Context,
+	logger slog.Logger,
+	bindings chan<- binding,
+	conn net.Conn,
+	id uuid.UUID,
+	name string,
+	kind agpl.QueueKind,
+) *connIO {
+	ctx, cancel := context.WithCancel(pCtx)
+	c := &connIO{
+		pCtx:     pCtx,
+		ctx:      ctx,
+		cancel:   cancel,
+		logger:   logger,
+		decoder:  json.NewDecoder(conn),
+		updates:  agpl.NewTrackedConn(ctx, cancel, conn, id, logger, name, 0, kind),
+		bindings: bindings,
+	}
+	go c.recvLoop()
+	go c.updates.SendUpdates()
+	logger.Info(ctx, "serving connection")
+	return c
+}
+
+func (c *connIO) recvLoop() {
+	defer func() {
+		// withdraw bindings when we exit.  We need to use the parent context here, since our own context might be
+		// canceled, but we still need to withdraw bindings.
+		b := binding{
+			bKey: bKey{
+				id:   c.UniqueID(),
+				kind: c.Kind(),
+			},
+		}
+		if err := sendCtx(c.pCtx, c.bindings, b); err != nil {
+			c.logger.Debug(c.ctx, "parent context expired while withdrawing bindings", slog.Error(err))
+		}
+	}()
+	defer c.cancel()
+	for {
+		var node agpl.Node
+		err := c.decoder.Decode(&node)
+		if err != nil {
+			if xerrors.Is(err, io.EOF) ||
+				xerrors.Is(err, io.ErrClosedPipe) ||
+				xerrors.Is(err, context.Canceled) ||
+				xerrors.Is(err, context.DeadlineExceeded) ||
+				websocket.CloseStatus(err) > 0 {
+				c.logger.Debug(c.ctx, "exiting recvLoop", slog.Error(err))
+			} else {
+				c.logger.Error(c.ctx, "failed to decode Node update", slog.Error(err))
+			}
+			return
+		}
+		c.logger.Debug(c.ctx, "got node update", slog.F("node", node))
+		b := binding{
+			bKey: bKey{
+				id:   c.UniqueID(),
+				kind: c.Kind(),
+			},
+			node: &node,
+		}
+		if err := sendCtx(c.ctx, c.bindings, b); err != nil {
+			c.logger.Debug(c.ctx, "recvLoop ctx expired", slog.Error(err))
+			return
+		}
+	}
+}
+
+func (c *connIO) UniqueID() uuid.UUID {
+	return c.updates.UniqueID()
+}
+
+func (c *connIO) Kind() agpl.QueueKind {
+	return c.updates.Kind()
+}
+
+func (c *connIO) Enqueue(n []*agpl.Node) error {
+	return c.updates.Enqueue(n)
+}
+
+func (c *connIO) Name() string {
+	return c.updates.Name()
+}
+
+func (c *connIO) Stats() (start int64, lastWrite int64) {
+	return c.updates.Stats()
+}
+
+func (c *connIO) Overwrites() int64 {
+	return c.updates.Overwrites()
+}
+
+// CoordinatorClose is used by the coordinator when closing a Queue. It
+// should skip removing itself from the coordinator.
+func (c *connIO) CoordinatorClose() error {
+	c.cancel()
+	return c.updates.CoordinatorClose()
+}
+
+func (c *connIO) Done() <-chan struct{} {
+	return c.ctx.Done()
+}
+
+func (c *connIO) Close() error {
+	c.cancel()
+	return c.updates.Close()
+}
diff --git a/enterprise/tailnet/coordinator.go b/enterprise/tailnet/coordinator.go
index fd0d05149ccf7..5a26cdc92ae54 100644
--- a/enterprise/tailnet/coordinator.go
+++ b/enterprise/tailnet/coordinator.go
@@ -15,9 +15,9 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/codersdk"
-	agpl "github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/codersdk"
+	agpl "github.com/coder/coder/v2/tailnet"
 )
 
 // NewCoordinator creates a new high availability coordinator
@@ -57,6 +57,7 @@ func (c *haCoordinator) ServeMultiAgent(id uuid.UUID) agpl.MultiAgentConn {
 		ID:                id,
 		AgentIsLegacyFunc: c.agentIsLegacy,
 		OnSubscribe:       c.clientSubscribeToAgent,
+		OnUnsubscribe:     c.clientUnsubscribeFromAgent,
 		OnNodeUpdate:      c.clientNodeUpdate,
 		OnRemove:          c.clientDisconnected,
 	}).Init()
@@ -101,6 +102,22 @@ func (c *haCoordinator) clientSubscribeToAgent(enq agpl.Queue, agentID uuid.UUID
 	return nil, nil
 }
 
+func (c *haCoordinator) clientUnsubscribeFromAgent(enq agpl.Queue, agentID uuid.UUID) error {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	connectionSockets, ok := c.agentToConnectionSockets[agentID]
+	if !ok {
+		return nil
+	}
+	delete(connectionSockets, enq.UniqueID())
+	if len(connectionSockets) == 0 {
+		delete(c.agentToConnectionSockets, agentID)
+	}
+
+	return nil
+}
+
 type haCoordinator struct {
 	id        uuid.UUID
 	log       slog.Logger
@@ -157,11 +174,11 @@ func (c *haCoordinator) ServeClient(conn net.Conn, id, agentID uuid.UUID) error
 	defer cancel()
 	logger := c.clientLogger(id, agentID)
 
-	tc := agpl.NewTrackedConn(ctx, cancel, conn, id, logger, id.String(), 0)
+	tc := agpl.NewTrackedConn(ctx, cancel, conn, id, logger, id.String(), 0, agpl.QueueKindClient)
 	defer tc.Close()
 
 	c.addClient(id, tc)
-	defer c.clientDisconnected(id)
+	defer c.clientDisconnected(tc)
 
 	agentNode, err := c.clientSubscribeToAgent(tc, agentID)
 	if err != nil {
@@ -200,26 +217,24 @@ func (c *haCoordinator) initOrSetAgentConnectionSocketLocked(agentID uuid.UUID,
 	c.clientsToAgents[enq.UniqueID()][agentID] = c.agentSockets[agentID]
 }
 
-func (c *haCoordinator) clientDisconnected(id uuid.UUID) {
+func (c *haCoordinator) clientDisconnected(enq agpl.Queue) {
 	c.mutex.Lock()
 	defer c.mutex.Unlock()
 
-	for agentID := range c.clientsToAgents[id] {
-		// Clean all traces of this connection from the map.
-		delete(c.nodes, id)
+	for agentID := range c.clientsToAgents[enq.UniqueID()] {
 		connectionSockets, ok := c.agentToConnectionSockets[agentID]
 		if !ok {
-			return
+			continue
 		}
-		delete(connectionSockets, id)
-		if len(connectionSockets) != 0 {
-			return
+		delete(connectionSockets, enq.UniqueID())
+		if len(connectionSockets) == 0 {
+			delete(c.agentToConnectionSockets, agentID)
 		}
-		delete(c.agentToConnectionSockets, agentID)
 	}
 
-	delete(c.clients, id)
-	delete(c.clientsToAgents, id)
+	delete(c.nodes, enq.UniqueID())
+	delete(c.clients, enq.UniqueID())
+	delete(c.clientsToAgents, enq.UniqueID())
 }
 
 func (c *haCoordinator) handleNextClientMessage(id uuid.UUID, decoder *json.Decoder) error {
@@ -300,7 +315,7 @@ func (c *haCoordinator) ServeAgent(conn net.Conn, id uuid.UUID, name string) err
 	}
 	// This uniquely identifies a connection that belongs to this goroutine.
 	unique := uuid.New()
-	tc := agpl.NewTrackedConn(ctx, cancel, conn, unique, logger, name, overwrites)
+	tc := agpl.NewTrackedConn(ctx, cancel, conn, unique, logger, name, overwrites, agpl.QueueKindAgent)
 
 	// Publish all nodes on this instance that want to connect to this agent.
 	nodes := c.nodesSubscribedToAgent(id)
diff --git a/enterprise/tailnet/coordinator_test.go b/enterprise/tailnet/coordinator_test.go
index a29bf2ad273a9..367b07c586faa 100644
--- a/enterprise/tailnet/coordinator_test.go
+++ b/enterprise/tailnet/coordinator_test.go
@@ -10,11 +10,11 @@ import (
 
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/enterprise/tailnet"
-	agpl "github.com/coder/coder/tailnet"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/enterprise/tailnet"
+	agpl "github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestCoordinatorSingle(t *testing.T) {
diff --git a/enterprise/tailnet/multiagent_test.go b/enterprise/tailnet/multiagent_test.go
new file mode 100644
index 0000000000000..7546bec350504
--- /dev/null
+++ b/enterprise/tailnet/multiagent_test.go
@@ -0,0 +1,354 @@
+package tailnet_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/enterprise/tailnet"
+	agpl "github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/testutil"
+)
+
+// TestPGCoordinator_MultiAgent tests a single coordinator with a MultiAgent
+// connecting to one agent.
+//
+//	            +--------+
+//	agent1 ---> | coord1 | <--- client
+//	            +--------+
+func TestPGCoordinator_MultiAgent(t *testing.T) {
+	t.Parallel()
+	if !dbtestutil.WillUsePostgres() {
+		t.Skip("test only with postgres")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+	defer cancel()
+
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+	store, ps := dbtestutil.NewDB(t)
+	coord1, err := tailnet.NewPGCoord(ctx, logger.Named("coord1"), ps, store)
+	require.NoError(t, err)
+	defer coord1.Close()
+
+	agent1 := newTestAgent(t, coord1, "agent1")
+	defer agent1.close()
+	agent1.sendNode(&agpl.Node{PreferredDERP: 5})
+
+	id := uuid.New()
+	ma1 := coord1.ServeMultiAgent(id)
+	defer ma1.Close()
+
+	err = ma1.SubscribeAgent(agent1.id)
+	require.NoError(t, err)
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 5)
+
+	agent1.sendNode(&agpl.Node{PreferredDERP: 1})
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 1)
+
+	err = ma1.UpdateSelf(&agpl.Node{PreferredDERP: 3})
+	require.NoError(t, err)
+	assertEventuallyHasDERPs(ctx, t, agent1, 3)
+
+	require.NoError(t, ma1.Close())
+	require.NoError(t, agent1.close())
+
+	assertEventuallyNoClientsForAgent(ctx, t, store, agent1.id)
+	assertEventuallyNoAgents(ctx, t, store, agent1.id)
+}
+
+// TestPGCoordinator_MultiAgent_UnsubscribeRace tests a single coordinator with
+// a MultiAgent connecting to one agent. It tries to race a call to Unsubscribe
+// with the MultiAgent closing.
+//
+//	            +--------+
+//	agent1 ---> | coord1 | <--- client
+//	            +--------+
+func TestPGCoordinator_MultiAgent_UnsubscribeRace(t *testing.T) {
+	t.Parallel()
+	if !dbtestutil.WillUsePostgres() {
+		t.Skip("test only with postgres")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+	defer cancel()
+
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+	store, ps := dbtestutil.NewDB(t)
+	coord1, err := tailnet.NewPGCoord(ctx, logger.Named("coord1"), ps, store)
+	require.NoError(t, err)
+	defer coord1.Close()
+
+	agent1 := newTestAgent(t, coord1, "agent1")
+	defer agent1.close()
+	agent1.sendNode(&agpl.Node{PreferredDERP: 5})
+
+	id := uuid.New()
+	ma1 := coord1.ServeMultiAgent(id)
+	defer ma1.Close()
+
+	err = ma1.SubscribeAgent(agent1.id)
+	require.NoError(t, err)
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 5)
+
+	agent1.sendNode(&agpl.Node{PreferredDERP: 1})
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 1)
+
+	err = ma1.UpdateSelf(&agpl.Node{PreferredDERP: 3})
+	require.NoError(t, err)
+	assertEventuallyHasDERPs(ctx, t, agent1, 3)
+
+	require.NoError(t, ma1.UnsubscribeAgent(agent1.id))
+	require.NoError(t, ma1.Close())
+	require.NoError(t, agent1.close())
+
+	assertEventuallyNoClientsForAgent(ctx, t, store, agent1.id)
+	assertEventuallyNoAgents(ctx, t, store, agent1.id)
+}
+
+// TestPGCoordinator_MultiAgent_Unsubscribe tests a single coordinator with a
+// MultiAgent connecting to one agent. It unsubscribes before closing, and
+// ensures node updates are no longer propagated.
+//
+//	            +--------+
+//	agent1 ---> | coord1 | <--- client
+//	            +--------+
+func TestPGCoordinator_MultiAgent_Unsubscribe(t *testing.T) {
+	t.Parallel()
+	if !dbtestutil.WillUsePostgres() {
+		t.Skip("test only with postgres")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+	store, ps := dbtestutil.NewDB(t)
+	coord1, err := tailnet.NewPGCoord(ctx, logger.Named("coord1"), ps, store)
+	require.NoError(t, err)
+	defer coord1.Close()
+
+	agent1 := newTestAgent(t, coord1, "agent1")
+	defer agent1.close()
+	agent1.sendNode(&agpl.Node{PreferredDERP: 5})
+
+	id := uuid.New()
+	ma1 := coord1.ServeMultiAgent(id)
+	defer ma1.Close()
+
+	err = ma1.SubscribeAgent(agent1.id)
+	require.NoError(t, err)
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 5)
+
+	agent1.sendNode(&agpl.Node{PreferredDERP: 1})
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 1)
+
+	require.NoError(t, ma1.UpdateSelf(&agpl.Node{PreferredDERP: 3}))
+	assertEventuallyHasDERPs(ctx, t, agent1, 3)
+
+	require.NoError(t, ma1.UnsubscribeAgent(agent1.id))
+	assertEventuallyNoClientsForAgent(ctx, t, store, agent1.id)
+
+	func() {
+		ctx, cancel := context.WithTimeout(ctx, testutil.IntervalSlow*3)
+		defer cancel()
+		require.NoError(t, ma1.UpdateSelf(&agpl.Node{PreferredDERP: 9}))
+		assertNeverHasDERPs(ctx, t, agent1, 9)
+	}()
+	func() {
+		ctx, cancel := context.WithTimeout(ctx, testutil.IntervalSlow*3)
+		defer cancel()
+		agent1.sendNode(&agpl.Node{PreferredDERP: 8})
+		assertMultiAgentNeverHasDERPs(ctx, t, ma1, 8)
+	}()
+
+	require.NoError(t, ma1.Close())
+	require.NoError(t, agent1.close())
+
+	assertEventuallyNoClientsForAgent(ctx, t, store, agent1.id)
+	assertEventuallyNoAgents(ctx, t, store, agent1.id)
+}
+
+// TestPGCoordinator_MultiAgent_MultiCoordinator tests two coordinators with a
+// MultiAgent connecting to an agent on a separate coordinator.
+//
+//	            +--------+
+//	agent1 ---> | coord1 |
+//	            +--------+
+//	            +--------+
+//	            | coord2 | <--- client
+//	            +--------+
+func TestPGCoordinator_MultiAgent_MultiCoordinator(t *testing.T) {
+	t.Parallel()
+	if !dbtestutil.WillUsePostgres() {
+		t.Skip("test only with postgres")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+	defer cancel()
+
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+	store, ps := dbtestutil.NewDB(t)
+	coord1, err := tailnet.NewPGCoord(ctx, logger.Named("coord1"), ps, store)
+	require.NoError(t, err)
+	defer coord1.Close()
+	coord2, err := tailnet.NewPGCoord(ctx, logger.Named("coord2"), ps, store)
+	require.NoError(t, err)
+	defer coord2.Close()
+
+	agent1 := newTestAgent(t, coord1, "agent1")
+	defer agent1.close()
+	agent1.sendNode(&agpl.Node{PreferredDERP: 5})
+
+	id := uuid.New()
+	ma1 := coord2.ServeMultiAgent(id)
+	defer ma1.Close()
+
+	err = ma1.SubscribeAgent(agent1.id)
+	require.NoError(t, err)
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 5)
+
+	agent1.sendNode(&agpl.Node{PreferredDERP: 1})
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 1)
+
+	err = ma1.UpdateSelf(&agpl.Node{PreferredDERP: 3})
+	require.NoError(t, err)
+	assertEventuallyHasDERPs(ctx, t, agent1, 3)
+
+	require.NoError(t, ma1.Close())
+	require.NoError(t, agent1.close())
+
+	assertEventuallyNoClientsForAgent(ctx, t, store, agent1.id)
+	assertEventuallyNoAgents(ctx, t, store, agent1.id)
+}
+
+// TestPGCoordinator_MultiAgent_MultiCoordinator_UpdateBeforeSubscribe tests two
+// coordinators with a MultiAgent connecting to an agent on a separate
+// coordinator. The MultiAgent updates its own node before subscribing.
+//
+//	            +--------+
+//	agent1 ---> | coord1 |
+//	            +--------+
+//	            +--------+
+//	            | coord2 | <--- client
+//	            +--------+
+func TestPGCoordinator_MultiAgent_MultiCoordinator_UpdateBeforeSubscribe(t *testing.T) {
+	t.Parallel()
+	if !dbtestutil.WillUsePostgres() {
+		t.Skip("test only with postgres")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+	defer cancel()
+
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+	store, ps := dbtestutil.NewDB(t)
+	coord1, err := tailnet.NewPGCoord(ctx, logger.Named("coord1"), ps, store)
+	require.NoError(t, err)
+	defer coord1.Close()
+	coord2, err := tailnet.NewPGCoord(ctx, logger.Named("coord2"), ps, store)
+	require.NoError(t, err)
+	defer coord2.Close()
+
+	agent1 := newTestAgent(t, coord1, "agent1")
+	defer agent1.close()
+	agent1.sendNode(&agpl.Node{PreferredDERP: 5})
+
+	id := uuid.New()
+	ma1 := coord2.ServeMultiAgent(id)
+	defer ma1.Close()
+
+	err = ma1.UpdateSelf(&agpl.Node{PreferredDERP: 3})
+	require.NoError(t, err)
+
+	err = ma1.SubscribeAgent(agent1.id)
+	require.NoError(t, err)
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 5)
+	assertEventuallyHasDERPs(ctx, t, agent1, 3)
+
+	agent1.sendNode(&agpl.Node{PreferredDERP: 1})
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 1)
+
+	require.NoError(t, ma1.Close())
+	require.NoError(t, agent1.close())
+
+	assertEventuallyNoClientsForAgent(ctx, t, store, agent1.id)
+	assertEventuallyNoAgents(ctx, t, store, agent1.id)
+}
+
+// TestPGCoordinator_MultiAgent_TwoAgents tests three coordinators with a
+// MultiAgent connecting to two agents on separate coordinators.
+//
+//	            +--------+
+//	agent1 ---> | coord1 |
+//	            +--------+
+//	            +--------+
+//	agent2 ---> | coord2 |
+//	            +--------+
+//	            +--------+
+//	            | coord3 | <--- client
+//	            +--------+
+func TestPGCoordinator_MultiAgent_TwoAgents(t *testing.T) {
+	t.Parallel()
+	if !dbtestutil.WillUsePostgres() {
+		t.Skip("test only with postgres")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+	defer cancel()
+
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+	store, ps := dbtestutil.NewDB(t)
+	coord1, err := tailnet.NewPGCoord(ctx, logger.Named("coord1"), ps, store)
+	require.NoError(t, err)
+	defer coord1.Close()
+	coord2, err := tailnet.NewPGCoord(ctx, logger.Named("coord2"), ps, store)
+	require.NoError(t, err)
+	defer coord2.Close()
+	coord3, err := tailnet.NewPGCoord(ctx, logger.Named("coord3"), ps, store)
+	require.NoError(t, err)
+	defer coord3.Close()
+
+	agent1 := newTestAgent(t, coord1, "agent1")
+	defer agent1.close()
+	agent1.sendNode(&agpl.Node{PreferredDERP: 5})
+
+	agent2 := newTestAgent(t, coord2, "agent2")
+	defer agent1.close()
+	agent2.sendNode(&agpl.Node{PreferredDERP: 6})
+
+	id := uuid.New()
+	ma1 := coord3.ServeMultiAgent(id)
+	defer ma1.Close()
+
+	err = ma1.SubscribeAgent(agent1.id)
+	require.NoError(t, err)
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 5)
+
+	agent1.sendNode(&agpl.Node{PreferredDERP: 1})
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 1)
+
+	err = ma1.SubscribeAgent(agent2.id)
+	require.NoError(t, err)
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 6)
+
+	agent2.sendNode(&agpl.Node{PreferredDERP: 2})
+	assertMultiAgentEventuallyHasDERPs(ctx, t, ma1, 2)
+
+	err = ma1.UpdateSelf(&agpl.Node{PreferredDERP: 3})
+	require.NoError(t, err)
+	assertEventuallyHasDERPs(ctx, t, agent1, 3)
+	assertEventuallyHasDERPs(ctx, t, agent2, 3)
+
+	require.NoError(t, ma1.Close())
+	require.NoError(t, agent1.close())
+	require.NoError(t, agent2.close())
+
+	assertEventuallyNoClientsForAgent(ctx, t, store, agent1.id)
+	assertEventuallyNoAgents(ctx, t, store, agent1.id)
+}
diff --git a/enterprise/tailnet/pgcoord.go b/enterprise/tailnet/pgcoord.go
index 8693d8e9a5bdd..bb2a2ac7eac0e 100644
--- a/enterprise/tailnet/pgcoord.go
+++ b/enterprise/tailnet/pgcoord.go
@@ -4,9 +4,10 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
-	"io"
+	"fmt"
 	"net"
 	"net/http"
+	"net/netip"
 	"strings"
 	"sync"
 	"time"
@@ -15,28 +16,30 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/exp/slices"
 	"golang.org/x/xerrors"
-	"nhooyr.io/websocket"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/database/pubsub"
-	"github.com/coder/coder/coderd/rbac"
-	agpl "github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	agpl "github.com/coder/coder/v2/tailnet"
 )
 
 const (
-	EventHeartbeats   = "tailnet_coordinator_heartbeat"
-	eventClientUpdate = "tailnet_client_update"
-	eventAgentUpdate  = "tailnet_agent_update"
-	HeartbeatPeriod   = time.Second * 2
-	MissedHeartbeats  = 3
-	numQuerierWorkers = 10
-	numBinderWorkers  = 10
-	dbMaxBackoff      = 10 * time.Second
-	cleanupPeriod     = time.Hour
+	EventHeartbeats      = "tailnet_coordinator_heartbeat"
+	eventClientUpdate    = "tailnet_client_update"
+	eventAgentUpdate     = "tailnet_agent_update"
+	HeartbeatPeriod      = time.Second * 2
+	MissedHeartbeats     = 3
+	numQuerierWorkers    = 10
+	numBinderWorkers     = 10
+	numSubscriberWorkers = 10
+	dbMaxBackoff         = 10 * time.Second
+	cleanupPeriod        = time.Hour
 )
 
+// TODO: add subscriber to this graphic
 // pgCoord is a postgres-backed coordinator
 //
 //	┌────────┐       ┌────────┐        ┌───────┐
@@ -70,16 +73,20 @@ type pgCoord struct {
 	pubsub pubsub.Pubsub
 	store  database.Store
 
-	bindings       chan binding
-	newConnections chan *connIO
-	id             uuid.UUID
+	bindings         chan binding
+	newConnections   chan agpl.Queue
+	closeConnections chan agpl.Queue
+	subscriberCh     chan subscribe
+	querierSubCh     chan subscribe
+	id               uuid.UUID
 
 	cancel    context.CancelFunc
 	closeOnce sync.Once
 	closed    chan struct{}
 
-	binder  *binder
-	querier *querier
+	binder     *binder
+	subscriber *subscriber
+	querier    *querier
 }
 
 var pgCoordSubject = rbac.Subject{
@@ -105,30 +112,136 @@ func NewPGCoord(ctx context.Context, logger slog.Logger, ps pubsub.Pubsub, store
 	id := uuid.New()
 	logger = logger.Named("pgcoord").With(slog.F("coordinator_id", id))
 	bCh := make(chan binding)
-	cCh := make(chan *connIO)
+	// used for opening connections
+	cCh := make(chan agpl.Queue)
+	// used for closing connections
+	ccCh := make(chan agpl.Queue)
+	// for communicating subscriptions with the subscriber
+	sCh := make(chan subscribe)
+	// for communicating subscriptions with the querier
+	qsCh := make(chan subscribe)
 	// signals when first heartbeat has been sent, so it's safe to start binding.
 	fHB := make(chan struct{})
 
 	c := &pgCoord{
-		ctx:            ctx,
-		cancel:         cancel,
-		logger:         logger,
-		pubsub:         ps,
-		store:          store,
-		binder:         newBinder(ctx, logger, id, store, bCh, fHB),
-		bindings:       bCh,
-		newConnections: cCh,
-		id:             id,
-		querier:        newQuerier(ctx, logger, ps, store, id, cCh, numQuerierWorkers, fHB),
-		closed:         make(chan struct{}),
+		ctx:              ctx,
+		cancel:           cancel,
+		logger:           logger,
+		pubsub:           ps,
+		store:            store,
+		binder:           newBinder(ctx, logger, id, store, bCh, fHB),
+		bindings:         bCh,
+		newConnections:   cCh,
+		closeConnections: ccCh,
+		subscriber:       newSubscriber(ctx, logger, id, store, sCh, fHB),
+		subscriberCh:     sCh,
+		querierSubCh:     qsCh,
+		id:               id,
+		querier:          newQuerier(ctx, logger, id, ps, store, id, cCh, ccCh, qsCh, numQuerierWorkers, fHB),
+		closed:           make(chan struct{}),
 	}
 	logger.Info(ctx, "starting coordinator")
 	return c, nil
 }
 
+// This is copied from codersdk because importing it here would cause an import
+// cycle. This is just temporary until wsconncache is phased out.
+var legacyAgentIP = netip.MustParseAddr("fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4")
+
 func (c *pgCoord) ServeMultiAgent(id uuid.UUID) agpl.MultiAgentConn {
-	_, _ = c, id
-	panic("not implemented") // TODO: Implement
+	ma := (&agpl.MultiAgent{
+		ID: id,
+		AgentIsLegacyFunc: func(agentID uuid.UUID) bool {
+			if n := c.Node(agentID); n == nil {
+				// If we don't have the node at all assume it's legacy for
+				// safety.
+				return true
+			} else if len(n.Addresses) > 0 && n.Addresses[0].Addr() == legacyAgentIP {
+				// An agent is determined to be "legacy" if it's first IP is the
+				// legacy IP. Agents with only the legacy IP aren't compatible
+				// with single_tailnet and must be routed through wsconncache.
+				return true
+			} else {
+				return false
+			}
+		},
+		OnSubscribe: func(enq agpl.Queue, agent uuid.UUID) (*agpl.Node, error) {
+			err := c.addSubscription(enq, agent)
+			return c.Node(agent), err
+		},
+		OnUnsubscribe: c.removeSubscription,
+		OnNodeUpdate: func(id uuid.UUID, node *agpl.Node) error {
+			return sendCtx(c.ctx, c.bindings, binding{
+				bKey: bKey{id, agpl.QueueKindClient},
+				node: node,
+			})
+		},
+		OnRemove: func(enq agpl.Queue) {
+			_ = sendCtx(c.ctx, c.bindings, binding{
+				bKey: bKey{
+					id:   enq.UniqueID(),
+					kind: enq.Kind(),
+				},
+			})
+			_ = sendCtx(c.ctx, c.subscriberCh, subscribe{
+				sKey:   sKey{clientID: id},
+				q:      enq,
+				active: false,
+			})
+			_ = sendCtx(c.ctx, c.closeConnections, enq)
+		},
+	}).Init()
+
+	if err := sendCtx(c.ctx, c.newConnections, agpl.Queue(ma)); err != nil {
+		// If we can't successfully send the multiagent, that means the
+		// coordinator is shutting down. In this case, just return a closed
+		// multiagent.
+		ma.CoordinatorClose()
+	}
+
+	return ma
+}
+
+func (c *pgCoord) addSubscription(q agpl.Queue, agentID uuid.UUID) error {
+	sub := subscribe{
+		sKey: sKey{
+			clientID: q.UniqueID(),
+			agentID:  agentID,
+		},
+		q:      q,
+		active: true,
+	}
+	if err := sendCtx(c.ctx, c.subscriberCh, sub); err != nil {
+		return err
+	}
+	if err := sendCtx(c.ctx, c.querierSubCh, sub); err != nil {
+		// There's no need to clean up the sub sent to the subscriber if this
+		// fails, since it means the entire coordinator is being torn down.
+		return err
+	}
+
+	return nil
+}
+
+func (c *pgCoord) removeSubscription(q agpl.Queue, agentID uuid.UUID) error {
+	sub := subscribe{
+		sKey: sKey{
+			clientID: q.UniqueID(),
+			agentID:  agentID,
+		},
+		q:      q,
+		active: false,
+	}
+	if err := sendCtx(c.ctx, c.subscriberCh, sub); err != nil {
+		return err
+	}
+	if err := sendCtx(c.ctx, c.querierSubCh, sub); err != nil {
+		// There's no need to clean up the sub sent to the subscriber if this
+		// fails, since it means the entire coordinator is being torn down.
+		return err
+	}
+
+	return nil
 }
 
 func (c *pgCoord) Node(id uuid.UUID) *agpl.Node {
@@ -161,11 +274,19 @@ func (c *pgCoord) ServeClient(conn net.Conn, id uuid.UUID, agent uuid.UUID) erro
 				slog.Error(err))
 		}
 	}()
-	cIO := newConnIO(c.ctx, c.logger, c.bindings, conn, id, agent, id.String())
-	if err := sendCtx(c.ctx, c.newConnections, cIO); err != nil {
+
+	cIO := newConnIO(c.ctx, c.logger, c.bindings, conn, id, id.String(), agpl.QueueKindClient)
+	if err := sendCtx(c.ctx, c.newConnections, agpl.Queue(cIO)); err != nil {
 		// can only be a context error, no need to log here.
 		return err
 	}
+	defer func() { _ = sendCtx(c.ctx, c.closeConnections, agpl.Queue(cIO)) }()
+
+	if err := c.addSubscription(cIO, agent); err != nil {
+		return err
+	}
+	defer func() { _ = c.removeSubscription(cIO, agent) }()
+
 	<-cIO.ctx.Done()
 	return nil
 }
@@ -180,11 +301,13 @@ func (c *pgCoord) ServeAgent(conn net.Conn, id uuid.UUID, name string) error {
 		}
 	}()
 	logger := c.logger.With(slog.F("name", name))
-	cIO := newConnIO(c.ctx, logger, c.bindings, conn, uuid.Nil, id, name)
-	if err := sendCtx(c.ctx, c.newConnections, cIO); err != nil {
+	cIO := newConnIO(c.ctx, logger, c.bindings, conn, id, name, agpl.QueueKindAgent)
+	if err := sendCtx(c.ctx, c.newConnections, agpl.Queue(cIO)); err != nil {
 		// can only be a context error, no need to log here.
 		return err
 	}
+	defer func() { _ = sendCtx(c.ctx, c.closeConnections, agpl.Queue(cIO)) }()
+
 	<-cIO.ctx.Done()
 	return nil
 }
@@ -196,110 +319,200 @@ func (c *pgCoord) Close() error {
 	return nil
 }
 
-// connIO manages the reading and writing to a connected client or agent.  Agent connIOs have their client field set to
-// uuid.Nil.  It reads node updates via its decoder, then pushes them onto the bindings channel.  It receives mappings
-// via its updates TrackedConn, which then writes them.
-type connIO struct {
-	pCtx     context.Context
-	ctx      context.Context
-	cancel   context.CancelFunc
-	logger   slog.Logger
-	client   uuid.UUID
-	agent    uuid.UUID
-	decoder  *json.Decoder
-	updates  *agpl.TrackedConn
-	bindings chan<- binding
+func sendCtx[A any](ctx context.Context, c chan<- A, a A) (err error) {
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case c <- a:
+		return nil
+	}
+}
+
+type sKey struct {
+	clientID uuid.UUID
+	agentID  uuid.UUID
 }
 
-func newConnIO(pCtx context.Context,
+type subscribe struct {
+	sKey
+
+	q agpl.Queue
+	// whether the subscription should be active. if true, the subscription is
+	// added. if false, the subscription is removed.
+	active bool
+}
+
+type subscriber struct {
+	ctx           context.Context
+	logger        slog.Logger
+	coordinatorID uuid.UUID
+	store         database.Store
+	subscriptions <-chan subscribe
+
+	mu sync.Mutex
+	// map[clientID]map[agentID]subscribe
+	latest map[uuid.UUID]map[uuid.UUID]subscribe
+	workQ  *workQ[sKey]
+}
+
+func newSubscriber(ctx context.Context,
 	logger slog.Logger,
-	bindings chan<- binding,
-	conn net.Conn,
-	client, agent uuid.UUID,
-	name string,
-) *connIO {
-	ctx, cancel := context.WithCancel(pCtx)
-	id := agent
-	logger = logger.With(slog.F("agent_id", agent))
-	if client != uuid.Nil {
-		logger = logger.With(slog.F("client_id", client))
-		id = client
-	}
-	c := &connIO{
-		pCtx:     pCtx,
-		ctx:      ctx,
-		cancel:   cancel,
-		logger:   logger,
-		client:   client,
-		agent:    agent,
-		decoder:  json.NewDecoder(conn),
-		updates:  agpl.NewTrackedConn(ctx, cancel, conn, id, logger, name, 0),
-		bindings: bindings,
-	}
-	go c.recvLoop()
-	go c.updates.SendUpdates()
-	logger.Info(ctx, "serving connection")
-	return c
-}
-
-func (c *connIO) recvLoop() {
-	defer func() {
-		// withdraw bindings when we exit.  We need to use the parent context here, since our own context might be
-		// canceled, but we still need to withdraw bindings.
-		b := binding{
-			bKey: bKey{
-				client: c.client,
-				agent:  c.agent,
-			},
-		}
-		if err := sendCtx(c.pCtx, c.bindings, b); err != nil {
-			c.logger.Debug(c.ctx, "parent context expired while withdrawing bindings", slog.Error(err))
+	id uuid.UUID,
+	store database.Store,
+	subscriptions <-chan subscribe,
+	startWorkers <-chan struct{},
+) *subscriber {
+	s := &subscriber{
+		ctx:           ctx,
+		logger:        logger,
+		coordinatorID: id,
+		store:         store,
+		subscriptions: subscriptions,
+		latest:        make(map[uuid.UUID]map[uuid.UUID]subscribe),
+		workQ:         newWorkQ[sKey](ctx),
+	}
+	go s.handleSubscriptions()
+	go func() {
+		<-startWorkers
+		for i := 0; i < numSubscriberWorkers; i++ {
+			go s.worker()
 		}
 	}()
-	defer c.cancel()
+	return s
+}
+
+func (s *subscriber) handleSubscriptions() {
+	for {
+		select {
+		case <-s.ctx.Done():
+			s.logger.Debug(s.ctx, "subscriber exiting", slog.Error(s.ctx.Err()))
+			return
+		case sub := <-s.subscriptions:
+			s.storeSubscription(sub)
+			s.workQ.enqueue(sub.sKey)
+		}
+	}
+}
+
+func (s *subscriber) worker() {
+	eb := backoff.NewExponentialBackOff()
+	eb.MaxElapsedTime = 0 // retry indefinitely
+	eb.MaxInterval = dbMaxBackoff
+	bkoff := backoff.WithContext(eb, s.ctx)
 	for {
-		var node agpl.Node
-		err := c.decoder.Decode(&node)
+		bk, err := s.workQ.acquire()
 		if err != nil {
-			if xerrors.Is(err, io.EOF) ||
-				xerrors.Is(err, io.ErrClosedPipe) ||
-				xerrors.Is(err, context.Canceled) ||
-				xerrors.Is(err, context.DeadlineExceeded) ||
-				websocket.CloseStatus(err) > 0 {
-				c.logger.Debug(c.ctx, "exiting recvLoop", slog.Error(err))
-			} else {
-				c.logger.Error(c.ctx, "failed to decode Node update", slog.Error(err))
-			}
+			// context expired
 			return
 		}
-		c.logger.Debug(c.ctx, "got node update", slog.F("node", node))
-		b := binding{
-			bKey: bKey{
-				client: c.client,
-				agent:  c.agent,
-			},
-			node: &node,
+		err = backoff.Retry(func() error {
+			bnd := s.retrieveSubscription(bk)
+			return s.writeOne(bnd)
+		}, bkoff)
+		if err != nil {
+			bkoff.Reset()
+		}
+		s.workQ.done(bk)
+	}
+}
+
+func (s *subscriber) storeSubscription(sub subscribe) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if sub.active {
+		if _, ok := s.latest[sub.clientID]; !ok {
+			s.latest[sub.clientID] = map[uuid.UUID]subscribe{}
 		}
-		if err := sendCtx(c.ctx, c.bindings, b); err != nil {
-			c.logger.Debug(c.ctx, "recvLoop ctx expired", slog.Error(err))
-			return
+		s.latest[sub.clientID][sub.agentID] = sub
+	} else {
+		// If the agentID is nil, clean up all of the clients subscriptions.
+		if sub.agentID == uuid.Nil {
+			delete(s.latest, sub.clientID)
+		} else {
+			delete(s.latest[sub.clientID], sub.agentID)
+			// clean up the subscription map if all the subscriptions are gone.
+			if len(s.latest[sub.clientID]) == 0 {
+				delete(s.latest, sub.clientID)
+			}
 		}
 	}
 }
 
-func sendCtx[A any](ctx context.Context, c chan<- A, a A) (err error) {
-	select {
-	case <-ctx.Done():
-		return ctx.Err()
-	case c <- a:
-		return nil
+// retrieveBinding gets the latest binding for a key.
+func (s *subscriber) retrieveSubscription(sk sKey) subscribe {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	agents, ok := s.latest[sk.clientID]
+	if !ok {
+		return subscribe{
+			sKey:   sk,
+			active: false,
+		}
 	}
+
+	sub, ok := agents[sk.agentID]
+	if !ok {
+		return subscribe{
+			sKey:   sk,
+			active: false,
+		}
+	}
+
+	return sub
+}
+
+func (s *subscriber) writeOne(sub subscribe) error {
+	var err error
+	switch {
+	case sub.agentID == uuid.Nil:
+		err = s.store.DeleteAllTailnetClientSubscriptions(s.ctx, database.DeleteAllTailnetClientSubscriptionsParams{
+			ClientID:      sub.clientID,
+			CoordinatorID: s.coordinatorID,
+		})
+		s.logger.Debug(s.ctx, "deleted all client subscriptions",
+			slog.F("client_id", sub.clientID),
+			slog.Error(err),
+		)
+	case sub.active:
+		err = s.store.UpsertTailnetClientSubscription(s.ctx, database.UpsertTailnetClientSubscriptionParams{
+			ClientID:      sub.clientID,
+			CoordinatorID: s.coordinatorID,
+			AgentID:       sub.agentID,
+		})
+		s.logger.Debug(s.ctx, "upserted client subscription",
+			slog.F("client_id", sub.clientID),
+			slog.F("agent_id", sub.agentID),
+			slog.Error(err),
+		)
+	case !sub.active:
+		err = s.store.DeleteTailnetClientSubscription(s.ctx, database.DeleteTailnetClientSubscriptionParams{
+			ClientID:      sub.clientID,
+			CoordinatorID: s.coordinatorID,
+			AgentID:       sub.agentID,
+		})
+		s.logger.Debug(s.ctx, "deleted client subscription",
+			slog.F("client_id", sub.clientID),
+			slog.F("agent_id", sub.agentID),
+			slog.Error(err),
+		)
+	default:
+		panic("unreachable")
+	}
+	if err != nil && !database.IsQueryCanceledError(err) {
+		s.logger.Error(s.ctx, "write subscription to database",
+			slog.F("client_id", sub.clientID),
+			slog.F("agent_id", sub.agentID),
+			slog.F("active", sub.active),
+			slog.Error(err))
+	}
+	return err
 }
 
-// bKey, or "binding key" identifies a client or agent in a binding.  Agents have their client field set to uuid.Nil.
+// bKey, or "binding key" identifies a client or agent in a binding. Agents and
+// clients are differentiated by the kind field.
 type bKey struct {
-	client uuid.UUID
-	agent  uuid.UUID
+	id   uuid.UUID
+	kind agpl.QueueKind
 }
 
 // binding represents an association between a client or agent and a Node.
@@ -308,8 +521,8 @@ type binding struct {
 	node *agpl.Node
 }
 
-func (b *binding) isAgent() bool  { return b.client == uuid.Nil }
-func (b *binding) isClient() bool { return b.client != uuid.Nil }
+func (b *binding) isAgent() bool  { return b.kind == agpl.QueueKindAgent }
+func (b *binding) isClient() bool { return b.kind == agpl.QueueKindClient }
 
 // binder reads node bindings from the channel and writes them to the database.  It handles retries with a backoff.
 type binder struct {
@@ -324,9 +537,12 @@ type binder struct {
 	workQ  *workQ[bKey]
 }
 
-func newBinder(ctx context.Context, logger slog.Logger,
-	id uuid.UUID, store database.Store,
-	bindings <-chan binding, startWorkers <-chan struct{},
+func newBinder(ctx context.Context,
+	logger slog.Logger,
+	id uuid.UUID,
+	store database.Store,
+	bindings <-chan binding,
+	startWorkers <-chan struct{},
 ) *binder {
 	b := &binder{
 		ctx:           ctx,
@@ -398,31 +614,39 @@ func (b *binder) writeOne(bnd binding) error {
 	switch {
 	case bnd.isAgent() && len(nodeRaw) > 0:
 		_, err = b.store.UpsertTailnetAgent(b.ctx, database.UpsertTailnetAgentParams{
-			ID:            bnd.agent,
+			ID:            bnd.id,
 			CoordinatorID: b.coordinatorID,
 			Node:          nodeRaw,
 		})
+		b.logger.Debug(b.ctx, "upserted agent binding",
+			slog.F("agent_id", bnd.id), slog.F("node", nodeRaw), slog.Error(err))
 	case bnd.isAgent() && len(nodeRaw) == 0:
 		_, err = b.store.DeleteTailnetAgent(b.ctx, database.DeleteTailnetAgentParams{
-			ID:            bnd.agent,
+			ID:            bnd.id,
 			CoordinatorID: b.coordinatorID,
 		})
+		b.logger.Debug(b.ctx, "deleted agent binding",
+			slog.F("agent_id", bnd.id), slog.Error(err))
 		if xerrors.Is(err, sql.ErrNoRows) {
 			// treat deletes as idempotent
 			err = nil
 		}
 	case bnd.isClient() && len(nodeRaw) > 0:
 		_, err = b.store.UpsertTailnetClient(b.ctx, database.UpsertTailnetClientParams{
-			ID:            bnd.client,
+			ID:            bnd.id,
 			CoordinatorID: b.coordinatorID,
-			AgentID:       bnd.agent,
 			Node:          nodeRaw,
 		})
+		b.logger.Debug(b.ctx, "upserted client binding",
+			slog.F("client_id", bnd.id),
+			slog.F("node", nodeRaw), slog.Error(err))
 	case bnd.isClient() && len(nodeRaw) == 0:
 		_, err = b.store.DeleteTailnetClient(b.ctx, database.DeleteTailnetClientParams{
-			ID:            bnd.client,
+			ID:            bnd.id,
 			CoordinatorID: b.coordinatorID,
 		})
+		b.logger.Debug(b.ctx, "deleted client binding",
+			slog.F("client_id", bnd.id))
 		if xerrors.Is(err, sql.ErrNoRows) {
 			// treat deletes as idempotent
 			err = nil
@@ -432,8 +656,8 @@ func (b *binder) writeOne(bnd binding) error {
 	}
 	if err != nil && !database.IsQueryCanceledError(err) {
 		b.logger.Error(b.ctx, "failed to write binding to database",
-			slog.F("client_id", bnd.client),
-			slog.F("agent_id", bnd.agent),
+			slog.F("binding_id", bnd.id),
+			slog.F("kind", bnd.kind),
 			slog.F("node", string(nodeRaw)),
 			slog.Error(err))
 	}
@@ -473,8 +697,8 @@ type mapper struct {
 	ctx    context.Context
 	logger slog.Logger
 
-	add chan *connIO
-	del chan *connIO
+	add chan agpl.Queue
+	del chan agpl.Queue
 
 	// reads from this channel trigger sending latest nodes to
 	// all connections.  It is used when coordinators are added
@@ -483,7 +707,7 @@ type mapper struct {
 
 	mappings chan []mapping
 
-	conns  map[bKey]*connIO
+	conns  map[bKey]agpl.Queue
 	latest []mapping
 
 	heartbeats *heartbeats
@@ -492,15 +716,15 @@ type mapper struct {
 func newMapper(ctx context.Context, logger slog.Logger, mk mKey, h *heartbeats) *mapper {
 	logger = logger.With(
 		slog.F("agent_id", mk.agent),
-		slog.F("clients_of_agent", mk.clientsOfAgent),
+		slog.F("kind", mk.kind),
 	)
 	m := &mapper{
 		ctx:        ctx,
 		logger:     logger,
-		add:        make(chan *connIO),
-		del:        make(chan *connIO),
+		add:        make(chan agpl.Queue),
+		del:        make(chan agpl.Queue),
 		update:     make(chan struct{}),
-		conns:      make(map[bKey]*connIO),
+		conns:      make(map[bKey]agpl.Queue),
 		mappings:   make(chan []mapping),
 		heartbeats: h,
 	}
@@ -514,17 +738,17 @@ func (m *mapper) run() {
 		case <-m.ctx.Done():
 			return
 		case c := <-m.add:
-			m.conns[bKey{c.client, c.agent}] = c
+			m.conns[bKey{id: c.UniqueID(), kind: c.Kind()}] = c
 			nodes := m.mappingsToNodes(m.latest)
 			if len(nodes) == 0 {
 				m.logger.Debug(m.ctx, "skipping 0 length node update")
 				continue
 			}
-			if err := c.updates.Enqueue(nodes); err != nil {
+			if err := c.Enqueue(nodes); err != nil {
 				m.logger.Error(m.ctx, "failed to enqueue node update", slog.Error(err))
 			}
 		case c := <-m.del:
-			delete(m.conns, bKey{c.client, c.agent})
+			delete(m.conns, bKey{id: c.UniqueID(), kind: c.Kind()})
 		case mappings := <-m.mappings:
 			m.latest = mappings
 			nodes := m.mappingsToNodes(mappings)
@@ -533,7 +757,7 @@ func (m *mapper) run() {
 				continue
 			}
 			for _, conn := range m.conns {
-				if err := conn.updates.Enqueue(nodes); err != nil {
+				if err := conn.Enqueue(nodes); err != nil {
 					m.logger.Error(m.ctx, "failed to enqueue node update", slog.Error(err))
 				}
 			}
@@ -544,7 +768,7 @@ func (m *mapper) run() {
 				continue
 			}
 			for _, conn := range m.conns {
-				if err := conn.updates.Enqueue(nodes); err != nil {
+				if err := conn.Enqueue(nodes); err != nil {
 					m.logger.Error(m.ctx, "failed to enqueue triggered node update", slog.Error(err))
 				}
 			}
@@ -560,7 +784,13 @@ func (m *mapper) mappingsToNodes(mappings []mapping) []*agpl.Node {
 	mappings = m.heartbeats.filter(mappings)
 	best := make(map[bKey]mapping, len(mappings))
 	for _, m := range mappings {
-		bk := bKey{client: m.client, agent: m.agent}
+		var bk bKey
+		if m.client == uuid.Nil {
+			bk = bKey{id: m.agent, kind: agpl.QueueKindAgent}
+		} else {
+			bk = bKey{id: m.client, kind: agpl.QueueKindClient}
+		}
+
 		bestM, ok := best[bk]
 		if !ok || m.updatedAt.After(bestM.updatedAt) {
 			best[bk] = m
@@ -577,18 +807,28 @@ func (m *mapper) mappingsToNodes(mappings []mapping) []*agpl.Node {
 // connected clients and agents need.  It also checks heartbeats and withdraws mappings from coordinators that have
 // failed heartbeats.
 type querier struct {
-	ctx            context.Context
-	logger         slog.Logger
-	pubsub         pubsub.Pubsub
-	store          database.Store
-	newConnections chan *connIO
+	ctx           context.Context
+	logger        slog.Logger
+	coordinatorID uuid.UUID
+	pubsub        pubsub.Pubsub
+	store         database.Store
+
+	newConnections   chan agpl.Queue
+	closeConnections chan agpl.Queue
+	subscriptions    chan subscribe
+
+	workQ *workQ[mKey]
 
-	workQ      *workQ[mKey]
 	heartbeats *heartbeats
-	updates    <-chan struct{}
+	updates    <-chan hbUpdate
 
 	mu      sync.Mutex
 	mappers map[mKey]*countedMapper
+	conns   map[uuid.UUID]agpl.Queue
+	// clientSubscriptions maps client ids to the agent ids they're subscribed to.
+	// map[client_id]map[agent_id]
+	clientSubscriptions map[uuid.UUID]map[uuid.UUID]struct{}
+	healthy             bool
 }
 
 type countedMapper struct {
@@ -597,51 +837,92 @@ type countedMapper struct {
 	cancel context.CancelFunc
 }
 
-func newQuerier(
-	ctx context.Context, logger slog.Logger,
-	ps pubsub.Pubsub, store database.Store,
-	self uuid.UUID, newConnections chan *connIO, numWorkers int,
-	firstHeartbeat chan<- struct{},
+func newQuerier(ctx context.Context,
+	logger slog.Logger,
+	coordinatorID uuid.UUID,
+	ps pubsub.Pubsub,
+	store database.Store,
+	self uuid.UUID,
+	newConnections chan agpl.Queue,
+	closeConnections chan agpl.Queue,
+	subscriptions chan subscribe,
+	numWorkers int,
+	firstHeartbeat chan struct{},
 ) *querier {
-	updates := make(chan struct{})
+	updates := make(chan hbUpdate)
 	q := &querier{
-		ctx:            ctx,
-		logger:         logger.Named("querier"),
-		pubsub:         ps,
-		store:          store,
-		newConnections: newConnections,
-		workQ:          newWorkQ[mKey](ctx),
-		heartbeats:     newHeartbeats(ctx, logger, ps, store, self, updates, firstHeartbeat),
-		mappers:        make(map[mKey]*countedMapper),
-		updates:        updates,
-	}
-	go q.subscribe()
-	go q.handleConnIO()
-	for i := 0; i < numWorkers; i++ {
-		go q.worker()
-	}
-	go q.handleUpdates()
+		ctx:                 ctx,
+		logger:              logger.Named("querier"),
+		coordinatorID:       coordinatorID,
+		pubsub:              ps,
+		store:               store,
+		newConnections:      newConnections,
+		closeConnections:    closeConnections,
+		subscriptions:       subscriptions,
+		workQ:               newWorkQ[mKey](ctx),
+		heartbeats:          newHeartbeats(ctx, logger, ps, store, self, updates, firstHeartbeat),
+		mappers:             make(map[mKey]*countedMapper),
+		conns:               make(map[uuid.UUID]agpl.Queue),
+		updates:             updates,
+		clientSubscriptions: make(map[uuid.UUID]map[uuid.UUID]struct{}),
+		healthy:             true, // assume we start healthy
+	}
+	q.subscribe()
+
+	go func() {
+		<-firstHeartbeat
+		go q.handleIncoming()
+		for i := 0; i < numWorkers; i++ {
+			go q.worker()
+		}
+		go q.handleUpdates()
+	}()
 	return q
 }
 
-func (q *querier) handleConnIO() {
+func (q *querier) handleIncoming() {
 	for {
 		select {
 		case <-q.ctx.Done():
 			return
+
 		case c := <-q.newConnections:
-			q.newConn(c)
+			switch c.Kind() {
+			case agpl.QueueKindAgent:
+				q.newAgentConn(c)
+			case agpl.QueueKindClient:
+				q.newClientConn(c)
+			default:
+				panic(fmt.Sprint("unreachable: invalid queue kind ", c.Kind()))
+			}
+
+		case c := <-q.closeConnections:
+			q.cleanupConn(c)
+
+		case sub := <-q.subscriptions:
+			if sub.active {
+				q.newClientSubscription(sub.q, sub.agentID)
+			} else {
+				q.removeClientSubscription(sub.q, sub.agentID)
+			}
 		}
 	}
 }
 
-func (q *querier) newConn(c *connIO) {
+func (q *querier) newAgentConn(c agpl.Queue) {
 	q.mu.Lock()
 	defer q.mu.Unlock()
+	if !q.healthy {
+		err := c.Close()
+		q.logger.Info(q.ctx, "closed incoming connection while unhealthy",
+			slog.Error(err),
+			slog.F("agent_id", c.UniqueID()),
+		)
+		return
+	}
 	mk := mKey{
-		agent: c.agent,
-		// if client is Nil, this is an agent connection, and it wants the mappings for all the clients of itself
-		clientsOfAgent: c.client == uuid.Nil,
+		agent: c.UniqueID(),
+		kind:  c.Kind(),
 	}
 	cm, ok := q.mappers[mk]
 	if !ok {
@@ -660,19 +941,118 @@ func (q *querier) newConn(c *connIO) {
 		return
 	}
 	cm.count++
-	go q.cleanupConn(c)
+	q.conns[c.UniqueID()] = c
 }
 
-func (q *querier) cleanupConn(c *connIO) {
-	<-c.ctx.Done()
+func (q *querier) newClientSubscription(c agpl.Queue, agentID uuid.UUID) {
 	q.mu.Lock()
 	defer q.mu.Unlock()
+
+	if _, ok := q.clientSubscriptions[c.UniqueID()]; !ok {
+		q.clientSubscriptions[c.UniqueID()] = map[uuid.UUID]struct{}{}
+	}
+
 	mk := mKey{
-		agent: c.agent,
-		// if client is Nil, this is an agent connection, and it wants the mappings for all the clients of itself
-		clientsOfAgent: c.client == uuid.Nil,
+		agent: agentID,
+		kind:  agpl.QueueKindClient,
+	}
+	cm, ok := q.mappers[mk]
+	if !ok {
+		ctx, cancel := context.WithCancel(q.ctx)
+		mpr := newMapper(ctx, q.logger, mk, q.heartbeats)
+		cm = &countedMapper{
+			mapper: mpr,
+			count:  0,
+			cancel: cancel,
+		}
+		q.mappers[mk] = cm
+		// we don't have any mapping state for this key yet
+		q.workQ.enqueue(mk)
+	}
+	if err := sendCtx(cm.ctx, cm.add, c); err != nil {
+		return
+	}
+	q.clientSubscriptions[c.UniqueID()][agentID] = struct{}{}
+	cm.count++
+}
+
+func (q *querier) removeClientSubscription(c agpl.Queue, agentID uuid.UUID) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+
+	// Allow duplicate unsubscribes. It's possible for cleanupConn to race with
+	// an external call to removeClientSubscription, so we just ensure the
+	// client subscription exists before attempting to remove it.
+	if _, ok := q.clientSubscriptions[c.UniqueID()][agentID]; !ok {
+		return
+	}
+
+	mk := mKey{
+		agent: agentID,
+		kind:  agpl.QueueKindClient,
 	}
 	cm := q.mappers[mk]
+	if err := sendCtx(cm.ctx, cm.del, c); err != nil {
+		return
+	}
+	delete(q.clientSubscriptions[c.UniqueID()], agentID)
+	cm.count--
+	if cm.count == 0 {
+		cm.cancel()
+		delete(q.mappers, mk)
+	}
+	if len(q.clientSubscriptions[c.UniqueID()]) == 0 {
+		delete(q.clientSubscriptions, c.UniqueID())
+	}
+}
+
+func (q *querier) newClientConn(c agpl.Queue) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	if !q.healthy {
+		err := c.Close()
+		q.logger.Info(q.ctx, "closed incoming connection while unhealthy",
+			slog.Error(err),
+			slog.F("client_id", c.UniqueID()),
+		)
+		return
+	}
+
+	q.conns[c.UniqueID()] = c
+}
+
+func (q *querier) cleanupConn(c agpl.Queue) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	delete(q.conns, c.UniqueID())
+
+	// Iterate over all subscriptions and remove them from the mappers.
+	for agentID := range q.clientSubscriptions[c.UniqueID()] {
+		mk := mKey{
+			agent: agentID,
+			kind:  c.Kind(),
+		}
+		cm := q.mappers[mk]
+		if err := sendCtx(cm.ctx, cm.del, c); err != nil {
+			continue
+		}
+		cm.count--
+		if cm.count == 0 {
+			cm.cancel()
+			delete(q.mappers, mk)
+		}
+	}
+	delete(q.clientSubscriptions, c.UniqueID())
+
+	mk := mKey{
+		agent: c.UniqueID(),
+		kind:  c.Kind(),
+	}
+	cm, ok := q.mappers[mk]
+	if !ok {
+		return
+	}
+
 	if err := sendCtx(cm.ctx, cm.del, c); err != nil {
 		return
 	}
@@ -707,12 +1087,15 @@ func (q *querier) worker() {
 func (q *querier) query(mk mKey) error {
 	var mappings []mapping
 	var err error
-	if mk.clientsOfAgent {
+	// If the mapping is an agent, query all of its clients.
+	if mk.kind == agpl.QueueKindAgent {
 		mappings, err = q.queryClientsOfAgent(mk.agent)
 		if err != nil {
 			return err
 		}
 	} else {
+		// The mapping is for clients subscribed to the agent. Query the agent
+		// itself.
 		mappings, err = q.queryAgent(mk.agent)
 		if err != nil {
 			return err
@@ -723,15 +1106,18 @@ func (q *querier) query(mk mKey) error {
 	q.mu.Unlock()
 	if !ok {
 		q.logger.Debug(q.ctx, "query for missing mapper",
-			slog.F("agent_id", mk.agent), slog.F("clients_of_agent", mk.clientsOfAgent))
+			slog.F("agent_id", mk.agent), slog.F("kind", mk.kind))
 		return nil
 	}
+	q.logger.Debug(q.ctx, "sending mappings", slog.F("mapping_len", len(mappings)))
 	mpr.mappings <- mappings
 	return nil
 }
 
 func (q *querier) queryClientsOfAgent(agent uuid.UUID) ([]mapping, error) {
 	clients, err := q.store.GetTailnetClientsForAgent(q.ctx, agent)
+	q.logger.Debug(q.ctx, "queried clients of agent",
+		slog.F("agent_id", agent), slog.F("num_clients", len(clients)), slog.Error(err))
 	if err != nil {
 		return nil, err
 	}
@@ -745,7 +1131,7 @@ func (q *querier) queryClientsOfAgent(agent uuid.UUID) ([]mapping, error) {
 		}
 		mappings = append(mappings, mapping{
 			client:      client.ID,
-			agent:       client.AgentID,
+			agent:       agent,
 			coordinator: client.CoordinatorID,
 			updatedAt:   client.UpdatedAt,
 			node:        node,
@@ -756,9 +1142,16 @@ func (q *querier) queryClientsOfAgent(agent uuid.UUID) ([]mapping, error) {
 
 func (q *querier) queryAgent(agentID uuid.UUID) ([]mapping, error) {
 	agents, err := q.store.GetTailnetAgents(q.ctx, agentID)
+	q.logger.Debug(q.ctx, "queried agents",
+		slog.F("agent_id", agentID), slog.F("num_agents", len(agents)), slog.Error(err))
 	if err != nil {
 		return nil, err
 	}
+	return q.agentsToMappings(agents)
+}
+
+func (q *querier) agentsToMappings(agents []database.TailnetAgent) ([]mapping, error) {
+	slog.Helper()
 	mappings := make([]mapping, 0, len(agents))
 	for _, agent := range agents {
 		node := new(agpl.Node)
@@ -777,50 +1170,62 @@ func (q *querier) queryAgent(agentID uuid.UUID) ([]mapping, error) {
 	return mappings, nil
 }
 
+// subscribe starts our subscriptions to client and agent updates in a new goroutine, and returns once we are subscribed
+// or the querier context is canceled.
 func (q *querier) subscribe() {
-	eb := backoff.NewExponentialBackOff()
-	eb.MaxElapsedTime = 0 // retry indefinitely
-	eb.MaxInterval = dbMaxBackoff
-	bkoff := backoff.WithContext(eb, q.ctx)
-	var cancelClient context.CancelFunc
-	err := backoff.Retry(func() error {
-		cancelFn, err := q.pubsub.SubscribeWithErr(eventClientUpdate, q.listenClient)
+	subscribed := make(chan struct{})
+	go func() {
+		defer close(subscribed)
+		eb := backoff.NewExponentialBackOff()
+		eb.MaxElapsedTime = 0 // retry indefinitely
+		eb.MaxInterval = dbMaxBackoff
+		bkoff := backoff.WithContext(eb, q.ctx)
+		var cancelClient context.CancelFunc
+		err := backoff.Retry(func() error {
+			cancelFn, err := q.pubsub.SubscribeWithErr(eventClientUpdate, q.listenClient)
+			if err != nil {
+				q.logger.Warn(q.ctx, "failed to subscribe to client updates", slog.Error(err))
+				return err
+			}
+			cancelClient = cancelFn
+			return nil
+		}, bkoff)
 		if err != nil {
-			q.logger.Warn(q.ctx, "failed to subscribe to client updates", slog.Error(err))
-			return err
-		}
-		cancelClient = cancelFn
-		return nil
-	}, bkoff)
-	if err != nil {
-		if q.ctx.Err() == nil {
-			q.logger.Error(q.ctx, "code bug: retry failed before context canceled", slog.Error(err))
+			if q.ctx.Err() == nil {
+				q.logger.Error(q.ctx, "code bug: retry failed before context canceled", slog.Error(err))
+			}
+			return
 		}
-		return
-	}
-	defer cancelClient()
-	bkoff.Reset()
+		defer cancelClient()
+		bkoff.Reset()
+		q.logger.Debug(q.ctx, "subscribed to client updates")
 
-	var cancelAgent context.CancelFunc
-	err = backoff.Retry(func() error {
-		cancelFn, err := q.pubsub.SubscribeWithErr(eventAgentUpdate, q.listenAgent)
+		var cancelAgent context.CancelFunc
+		err = backoff.Retry(func() error {
+			cancelFn, err := q.pubsub.SubscribeWithErr(eventAgentUpdate, q.listenAgent)
+			if err != nil {
+				q.logger.Warn(q.ctx, "failed to subscribe to agent updates", slog.Error(err))
+				return err
+			}
+			cancelAgent = cancelFn
+			return nil
+		}, bkoff)
 		if err != nil {
-			q.logger.Warn(q.ctx, "failed to subscribe to agent updates", slog.Error(err))
-			return err
-		}
-		cancelAgent = cancelFn
-		return nil
-	}, bkoff)
-	if err != nil {
-		if q.ctx.Err() == nil {
-			q.logger.Error(q.ctx, "code bug: retry failed before context canceled", slog.Error(err))
+			if q.ctx.Err() == nil {
+				q.logger.Error(q.ctx, "code bug: retry failed before context canceled", slog.Error(err))
+			}
+			return
 		}
-		return
-	}
-	defer cancelAgent()
+		defer cancelAgent()
+		q.logger.Debug(q.ctx, "subscribed to agent updates")
+
+		// unblock the outer function from returning
+		subscribed <- struct{}{}
 
-	// hold subscriptions open until context is canceled
-	<-q.ctx.Done()
+		// hold subscriptions open until context is canceled
+		<-q.ctx.Done()
+	}()
+	<-subscribed
 }
 
 func (q *querier) listenClient(_ context.Context, msg []byte, err error) {
@@ -832,6 +1237,7 @@ func (q *querier) listenClient(_ context.Context, msg []byte, err error) {
 	}
 	if err != nil {
 		q.logger.Warn(q.ctx, "unhandled pubsub error", slog.Error(err))
+		return
 	}
 	client, agent, err := parseClientUpdate(string(msg))
 	if err != nil {
@@ -840,9 +1246,10 @@ func (q *querier) listenClient(_ context.Context, msg []byte, err error) {
 	}
 	logger := q.logger.With(slog.F("client_id", client), slog.F("agent_id", agent))
 	logger.Debug(q.ctx, "got client update")
+
 	mk := mKey{
-		agent:          agent,
-		clientsOfAgent: true,
+		agent: agent,
+		kind:  agpl.QueueKindAgent,
 	}
 	q.mu.Lock()
 	_, ok := q.mappers[mk]
@@ -864,7 +1271,7 @@ func (q *querier) listenAgent(_ context.Context, msg []byte, err error) {
 	if err != nil {
 		q.logger.Warn(q.ctx, "unhandled pubsub error", slog.Error(err))
 	}
-	agent, err := parseAgentUpdate(string(msg))
+	agent, err := parseUpdateMessage(string(msg))
 	if err != nil {
 		q.logger.Error(q.ctx, "failed to parse agent update", slog.F("msg", string(msg)), slog.Error(err))
 		return
@@ -872,8 +1279,8 @@ func (q *querier) listenAgent(_ context.Context, msg []byte, err error) {
 	logger := q.logger.With(slog.F("agent_id", agent))
 	logger.Debug(q.ctx, "got agent update")
 	mk := mKey{
-		agent:          agent,
-		clientsOfAgent: false,
+		agent: agent,
+		kind:  agpl.QueueKindClient,
 	}
 	q.mu.Lock()
 	_, ok := q.mappers[mk]
@@ -889,7 +1296,7 @@ func (q *querier) resyncClientMappings() {
 	q.mu.Lock()
 	defer q.mu.Unlock()
 	for mk := range q.mappers {
-		if mk.clientsOfAgent {
+		if mk.kind == agpl.QueueKindClient {
 			q.workQ.enqueue(mk)
 		}
 	}
@@ -899,7 +1306,7 @@ func (q *querier) resyncAgentMappings() {
 	q.mu.Lock()
 	defer q.mu.Unlock()
 	for mk := range q.mappers {
-		if !mk.clientsOfAgent {
+		if mk.kind == agpl.QueueKindAgent {
 			q.workQ.enqueue(mk)
 		}
 	}
@@ -910,8 +1317,18 @@ func (q *querier) handleUpdates() {
 		select {
 		case <-q.ctx.Done():
 			return
-		case <-q.updates:
-			q.updateAll()
+		case u := <-q.updates:
+			if u.filter == filterUpdateUpdated {
+				q.updateAll()
+			}
+			if u.health == healthUpdateUnhealthy {
+				q.unhealthyCloseAll()
+				continue
+			}
+			if u.health == healthUpdateHealthy {
+				q.setHealthy()
+				continue
+			}
 		}
 	}
 }
@@ -931,6 +1348,30 @@ func (q *querier) updateAll() {
 	}
 }
 
+// unhealthyCloseAll marks the coordinator unhealthy and closes all connections.  We do this so that clients and agents
+// are forced to reconnect to the coordinator, and will hopefully land on a healthy coordinator.
+func (q *querier) unhealthyCloseAll() {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	q.healthy = false
+	for _, c := range q.conns {
+		// close connections async so that we don't block the querier routine that responds to updates
+		go func(c agpl.Queue) {
+			err := c.Close()
+			if err != nil {
+				q.logger.Debug(q.ctx, "error closing conn while unhealthy", slog.Error(err))
+			}
+		}(c)
+		// NOTE: we don't need to remove the connection from the map, as that will happen async in q.cleanupConn()
+	}
+}
+
+func (q *querier) setHealthy() {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	q.healthy = true
+}
+
 func (q *querier) getAll(ctx context.Context) (map[uuid.UUID]database.TailnetAgent, map[uuid.UUID][]database.TailnetClient, error) {
 	agents, err := q.store.GetAllTailnetAgents(ctx)
 	if err != nil {
@@ -946,7 +1387,9 @@ func (q *querier) getAll(ctx context.Context) (map[uuid.UUID]database.TailnetAge
 	}
 	clientsMap := map[uuid.UUID][]database.TailnetClient{}
 	for _, client := range clients {
-		clientsMap[client.AgentID] = append(clientsMap[client.AgentID], client)
+		for _, agentID := range client.AgentIds {
+			clientsMap[agentID] = append(clientsMap[agentID], client.TailnetClient)
+		}
 	}
 
 	return agentsMap, clientsMap, nil
@@ -961,17 +1404,19 @@ func parseClientUpdate(msg string) (client, agent uuid.UUID, err error) {
 	if err != nil {
 		return uuid.Nil, uuid.Nil, xerrors.Errorf("failed to parse client UUID: %w", err)
 	}
+
 	agent, err = uuid.Parse(parts[1])
 	if err != nil {
 		return uuid.Nil, uuid.Nil, xerrors.Errorf("failed to parse agent UUID: %w", err)
 	}
+
 	return client, agent, nil
 }
 
-func parseAgentUpdate(msg string) (agent uuid.UUID, err error) {
+func parseUpdateMessage(msg string) (agent uuid.UUID, err error) {
 	agent, err = uuid.Parse(msg)
 	if err != nil {
-		return uuid.Nil, xerrors.Errorf("failed to parse agent UUID: %w", err)
+		return uuid.Nil, xerrors.Errorf("failed to parse update message UUID: %w", err)
 	}
 	return agent, nil
 }
@@ -981,7 +1426,7 @@ type mKey struct {
 	agent uuid.UUID
 	// we always query based on the agent ID, but if we have client connection(s), we query the agent itself.  If we
 	// have an agent connection, we need the node mappings for all clients of the agent.
-	clientsOfAgent bool
+	kind agpl.QueueKind
 }
 
 // mapping associates a particular client or agent, and its respective coordinator with a node.  It is generalized to
@@ -994,9 +1439,13 @@ type mapping struct {
 	node        *agpl.Node
 }
 
+type queueKey interface {
+	mKey | bKey | sKey
+}
+
 // workQ allows scheduling work based on a key.  Multiple enqueue requests for the same key are coalesced, and
 // only one in-progress job per key is scheduled.
-type workQ[K mKey | bKey] struct {
+type workQ[K queueKey] struct {
 	ctx context.Context
 
 	cond       *sync.Cond
@@ -1004,7 +1453,7 @@ type workQ[K mKey | bKey] struct {
 	inProgress map[K]bool
 }
 
-func newWorkQ[K mKey | bKey](ctx context.Context) *workQ[K] {
+func newWorkQ[K queueKey](ctx context.Context) *workQ[K] {
 	q := &workQ[K]{
 		ctx:        ctx,
 		cond:       sync.NewCond(&sync.Mutex{}),
@@ -1077,6 +1526,28 @@ func (q *workQ[K]) done(key K) {
 	q.cond.Signal()
 }
 
+type filterUpdate int
+
+const (
+	filterUpdateNone filterUpdate = iota
+	filterUpdateUpdated
+)
+
+type healthUpdate int
+
+const (
+	healthUpdateNone healthUpdate = iota
+	healthUpdateHealthy
+	healthUpdateUnhealthy
+)
+
+// hbUpdate is an update sent from the heartbeats to the querier.  Zero values of the fields mean no update of that
+// kind.
+type hbUpdate struct {
+	filter filterUpdate
+	health healthUpdate
+}
+
 // heartbeats sends heartbeats for this coordinator on a timer, and monitors heartbeats from other coordinators.  If a
 // coordinator misses their heartbeat, we remove it from our map of "valid" coordinators, such that we will filter out
 // any mappings for it when filter() is called, and we send a signal on the update channel, which triggers all mappers
@@ -1088,8 +1559,9 @@ type heartbeats struct {
 	store  database.Store
 	self   uuid.UUID
 
-	update         chan<- struct{}
-	firstHeartbeat chan<- struct{}
+	update           chan<- hbUpdate
+	firstHeartbeat   chan<- struct{}
+	failedHeartbeats int
 
 	lock         sync.RWMutex
 	coordinators map[uuid.UUID]time.Time
@@ -1102,7 +1574,7 @@ type heartbeats struct {
 func newHeartbeats(
 	ctx context.Context, logger slog.Logger,
 	ps pubsub.Pubsub, store database.Store,
-	self uuid.UUID, update chan<- struct{},
+	self uuid.UUID, update chan<- hbUpdate,
 	firstHeartbeat chan<- struct{},
 ) *heartbeats {
 	h := &heartbeats{
@@ -1193,7 +1665,7 @@ func (h *heartbeats) recvBeat(id uuid.UUID) {
 		h.logger.Info(h.ctx, "heartbeats (re)started", slog.F("other_coordinator_id", id))
 		// send on a separate goroutine to avoid holding lock.  Triggering update can be async
 		go func() {
-			_ = sendCtx(h.ctx, h.update, struct{}{})
+			_ = sendCtx(h.ctx, h.update, hbUpdate{filter: filterUpdateUpdated})
 		}()
 	}
 	h.coordinators[id] = time.Now()
@@ -1240,7 +1712,7 @@ func (h *heartbeats) checkExpiry() {
 	if expired {
 		// send on a separate goroutine to avoid holding lock.  Triggering update can be async
 		go func() {
-			_ = sendCtx(h.ctx, h.update, struct{}{})
+			_ = sendCtx(h.ctx, h.update, hbUpdate{filter: filterUpdateUpdated})
 		}()
 	}
 	// we need to reset the timer for when the next oldest coordinator will expire, if any.
@@ -1267,12 +1739,24 @@ func (h *heartbeats) sendBeats() {
 
 func (h *heartbeats) sendBeat() {
 	_, err := h.store.UpsertTailnetCoordinator(h.ctx, h.self)
+	if xerrors.Is(err, context.Canceled) {
+		return
+	}
 	if err != nil {
-		// just log errors, heartbeats are rescheduled on a timer
 		h.logger.Error(h.ctx, "failed to send heartbeat", slog.Error(err))
+		h.failedHeartbeats++
+		if h.failedHeartbeats == 3 {
+			h.logger.Error(h.ctx, "coordinator failed 3 heartbeats and is unhealthy")
+			_ = sendCtx(h.ctx, h.update, hbUpdate{health: healthUpdateUnhealthy})
+		}
 		return
 	}
 	h.logger.Debug(h.ctx, "sent heartbeat")
+	if h.failedHeartbeats >= 3 {
+		h.logger.Info(h.ctx, "coordinator sent heartbeat and is healthy")
+		_ = sendCtx(h.ctx, h.update, hbUpdate{health: healthUpdateHealthy})
+	}
+	h.failedHeartbeats = 0
 }
 
 func (h *heartbeats) sendDelete() {
@@ -1351,8 +1835,8 @@ func (c *pgCoord) htmlDebug(ctx context.Context) (agpl.HTMLDebug, error) {
 				Node: conn.Node,
 			})
 		}
-		slices.SortFunc(htmlAgent.Connections, func(a, b *agpl.HTMLClient) bool {
-			return a.Name < b.Name
+		slices.SortFunc(htmlAgent.Connections, func(a, b *agpl.HTMLClient) int {
+			return slice.Ascending(a.Name, b.Name)
 		})
 
 		data.Agents = append(data.Agents, htmlAgent)
@@ -1362,8 +1846,8 @@ func (c *pgCoord) htmlDebug(ctx context.Context) (agpl.HTMLDebug, error) {
 			Node: agent.Node,
 		})
 	}
-	slices.SortFunc(data.Agents, func(a, b *agpl.HTMLAgent) bool {
-		return a.Name < b.Name
+	slices.SortFunc(data.Agents, func(a, b *agpl.HTMLAgent) int {
+		return slice.Ascending(a.Name, b.Name)
 	})
 
 	for agentID, conns := range clients {
@@ -1389,14 +1873,14 @@ func (c *pgCoord) htmlDebug(ctx context.Context) (agpl.HTMLDebug, error) {
 				Node: conn.Node,
 			})
 		}
-		slices.SortFunc(agent.Connections, func(a, b *agpl.HTMLClient) bool {
-			return a.Name < b.Name
+		slices.SortFunc(agent.Connections, func(a, b *agpl.HTMLClient) int {
+			return slice.Ascending(a.Name, b.Name)
 		})
 
 		data.MissingAgents = append(data.MissingAgents, agent)
 	}
-	slices.SortFunc(data.MissingAgents, func(a, b *agpl.HTMLAgent) bool {
-		return a.Name < b.Name
+	slices.SortFunc(data.MissingAgents, func(a, b *agpl.HTMLAgent) int {
+		return slice.Ascending(a.Name, b.Name)
 	})
 
 	return data, nil
diff --git a/enterprise/tailnet/pgcoord_internal_test.go b/enterprise/tailnet/pgcoord_internal_test.go
index 86666f8105582..95481e6af3cc4 100644
--- a/enterprise/tailnet/pgcoord_internal_test.go
+++ b/enterprise/tailnet/pgcoord_internal_test.go
@@ -10,8 +10,8 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/coderd/database/dbmock"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database/dbmock"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // TestHeartbeat_Cleanup is internal so that we can overwrite the cleanup period and not wait an hour for the timed
diff --git a/enterprise/tailnet/pgcoord_test.go b/enterprise/tailnet/pgcoord_test.go
index 25d80ca854566..7bc7c89767054 100644
--- a/enterprise/tailnet/pgcoord_test.go
+++ b/enterprise/tailnet/pgcoord_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/golang/mock/gomock"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -20,11 +21,13 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/dbtestutil"
-	"github.com/coder/coder/enterprise/tailnet"
-	agpl "github.com/coder/coder/tailnet"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbmock"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/enterprise/tailnet"
+	agpl "github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
@@ -36,11 +39,11 @@ func TestPGCoordinatorSingle_ClientWithoutAgent(t *testing.T) {
 	if !dbtestutil.WillUsePostgres() {
 		t.Skip("test only with postgres")
 	}
-	store, pubsub := dbtestutil.NewDB(t)
+	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
 	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
-	coordinator, err := tailnet.NewPGCoord(ctx, logger, pubsub, store)
+	coordinator, err := tailnet.NewPGCoord(ctx, logger, ps, store)
 	require.NoError(t, err)
 	defer coordinator.Close()
 
@@ -75,15 +78,15 @@ func TestPGCoordinatorSingle_AgentWithoutClients(t *testing.T) {
 	if !dbtestutil.WillUsePostgres() {
 		t.Skip("test only with postgres")
 	}
-	store, pubsub := dbtestutil.NewDB(t)
+	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
 	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
-	coordinator, err := tailnet.NewPGCoord(ctx, logger, pubsub, store)
+	coordinator, err := tailnet.NewPGCoord(ctx, logger, ps, store)
 	require.NoError(t, err)
 	defer coordinator.Close()
 
-	agent := newTestAgent(t, coordinator)
+	agent := newTestAgent(t, coordinator, "agent")
 	defer agent.close()
 	agent.sendNode(&agpl.Node{PreferredDERP: 10})
 	require.Eventually(t, func() bool {
@@ -112,15 +115,15 @@ func TestPGCoordinatorSingle_AgentWithClient(t *testing.T) {
 	if !dbtestutil.WillUsePostgres() {
 		t.Skip("test only with postgres")
 	}
-	store, pubsub := dbtestutil.NewDB(t)
+	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
 	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
-	coordinator, err := tailnet.NewPGCoord(ctx, logger, pubsub, store)
+	coordinator, err := tailnet.NewPGCoord(ctx, logger, ps, store)
 	require.NoError(t, err)
 	defer coordinator.Close()
 
-	agent := newTestAgent(t, coordinator)
+	agent := newTestAgent(t, coordinator, "original")
 	defer agent.close()
 	agent.sendNode(&agpl.Node{PreferredDERP: 10})
 
@@ -148,7 +151,7 @@ func TestPGCoordinatorSingle_AgentWithClient(t *testing.T) {
 	agent.waitForClose(ctx, t)
 
 	// Create a new agent connection. This is to simulate a reconnect!
-	agent = newTestAgent(t, coordinator, agent.id)
+	agent = newTestAgent(t, coordinator, "reconnection", agent.id)
 	// Ensure the existing listening connIO sends its node immediately!
 	clientNodes = agent.recvNodes(ctx, t)
 	require.Len(t, clientNodes, 1)
@@ -189,15 +192,15 @@ func TestPGCoordinatorSingle_MissedHeartbeats(t *testing.T) {
 	if !dbtestutil.WillUsePostgres() {
 		t.Skip("test only with postgres")
 	}
-	store, pubsub := dbtestutil.NewDB(t)
+	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
 	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
-	coordinator, err := tailnet.NewPGCoord(ctx, logger, pubsub, store)
+	coordinator, err := tailnet.NewPGCoord(ctx, logger, ps, store)
 	require.NoError(t, err)
 	defer coordinator.Close()
 
-	agent := newTestAgent(t, coordinator)
+	agent := newTestAgent(t, coordinator, "agent")
 	defer agent.close()
 	agent.sendNode(&agpl.Node{PreferredDERP: 10})
 
@@ -276,14 +279,14 @@ func TestPGCoordinatorSingle_SendsHeartbeats(t *testing.T) {
 	if !dbtestutil.WillUsePostgres() {
 		t.Skip("test only with postgres")
 	}
-	store, pubsub := dbtestutil.NewDB(t)
+	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
 	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
 
 	mu := sync.Mutex{}
 	heartbeats := []time.Time{}
-	unsub, err := pubsub.SubscribeWithErr(tailnet.EventHeartbeats, func(_ context.Context, msg []byte, err error) {
+	unsub, err := ps.SubscribeWithErr(tailnet.EventHeartbeats, func(_ context.Context, msg []byte, err error) {
 		assert.NoError(t, err)
 		mu.Lock()
 		defer mu.Unlock()
@@ -293,7 +296,7 @@ func TestPGCoordinatorSingle_SendsHeartbeats(t *testing.T) {
 	defer unsub()
 
 	start := time.Now()
-	coordinator, err := tailnet.NewPGCoord(ctx, logger, pubsub, store)
+	coordinator, err := tailnet.NewPGCoord(ctx, logger, ps, store)
 	require.NoError(t, err)
 	defer coordinator.Close()
 
@@ -326,20 +329,20 @@ func TestPGCoordinatorDual_Mainline(t *testing.T) {
 	if !dbtestutil.WillUsePostgres() {
 		t.Skip("test only with postgres")
 	}
-	store, pubsub := dbtestutil.NewDB(t)
+	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
 	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
-	coord1, err := tailnet.NewPGCoord(ctx, logger, pubsub, store)
+	coord1, err := tailnet.NewPGCoord(ctx, logger.Named("coord1"), ps, store)
 	require.NoError(t, err)
 	defer coord1.Close()
-	coord2, err := tailnet.NewPGCoord(ctx, logger, pubsub, store)
+	coord2, err := tailnet.NewPGCoord(ctx, logger.Named("coord2"), ps, store)
 	require.NoError(t, err)
 	defer coord2.Close()
 
-	agent1 := newTestAgent(t, coord1)
+	agent1 := newTestAgent(t, coord1, "agent1")
 	defer agent1.close()
-	agent2 := newTestAgent(t, coord2)
+	agent2 := newTestAgent(t, coord2, "agent2")
 	defer agent2.close()
 
 	client11 := newTestClient(t, coord1, agent1.id)
@@ -435,7 +438,7 @@ func TestPGCoordinatorDual_Mainline(t *testing.T) {
 	assertEventuallyNoClientsForAgent(ctx, t, store, agent2.id)
 }
 
-// TestPGCoordinator_MultiAgent tests when a single agent connects to multiple coordinators.
+// TestPGCoordinator_MultiCoordinatorAgent tests when a single agent connects to multiple coordinators.
 // We use two agent connections, but they share the same AgentID.  This could happen due to a reconnection,
 // or an infrastructure problem where an old workspace is not fully cleaned up before a new one started.
 //
@@ -448,28 +451,28 @@ func TestPGCoordinatorDual_Mainline(t *testing.T) {
 //	            +---------+
 //	            | coord3  | <--- client
 //	            +---------+
-func TestPGCoordinator_MultiAgent(t *testing.T) {
+func TestPGCoordinator_MultiCoordinatorAgent(t *testing.T) {
 	t.Parallel()
 	if !dbtestutil.WillUsePostgres() {
 		t.Skip("test only with postgres")
 	}
-	store, pubsub := dbtestutil.NewDB(t)
+	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
 	logger := slogtest.Make(t, nil).Leveled(slog.LevelDebug)
-	coord1, err := tailnet.NewPGCoord(ctx, logger, pubsub, store)
+	coord1, err := tailnet.NewPGCoord(ctx, logger.Named("coord1"), ps, store)
 	require.NoError(t, err)
 	defer coord1.Close()
-	coord2, err := tailnet.NewPGCoord(ctx, logger, pubsub, store)
+	coord2, err := tailnet.NewPGCoord(ctx, logger.Named("coord2"), ps, store)
 	require.NoError(t, err)
 	defer coord2.Close()
-	coord3, err := tailnet.NewPGCoord(ctx, logger, pubsub, store)
+	coord3, err := tailnet.NewPGCoord(ctx, logger.Named("coord3"), ps, store)
 	require.NoError(t, err)
 	defer coord3.Close()
 
-	agent1 := newTestAgent(t, coord1)
+	agent1 := newTestAgent(t, coord1, "agent1")
 	defer agent1.close()
-	agent2 := newTestAgent(t, coord2, agent1.id)
+	agent2 := newTestAgent(t, coord2, "agent2", agent1.id)
 	defer agent2.close()
 
 	client := newTestClient(t, coord3, agent1.id)
@@ -516,6 +519,76 @@ func TestPGCoordinator_MultiAgent(t *testing.T) {
 	assertEventuallyNoAgents(ctx, t, store, agent1.id)
 }
 
+func TestPGCoordinator_Unhealthy(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
+	defer cancel()
+	ctrl := gomock.NewController(t)
+	mStore := dbmock.NewMockStore(ctrl)
+	ps := pubsub.NewInMemory()
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+
+	calls := make(chan struct{})
+	threeMissed := mStore.EXPECT().UpsertTailnetCoordinator(gomock.Any(), gomock.Any()).
+		Times(3).
+		Do(func(_ context.Context, _ uuid.UUID) { <-calls }).
+		Return(database.TailnetCoordinator{}, xerrors.New("test disconnect"))
+	mStore.EXPECT().UpsertTailnetCoordinator(gomock.Any(), gomock.Any()).
+		MinTimes(1).
+		After(threeMissed).
+		Do(func(_ context.Context, _ uuid.UUID) { <-calls }).
+		Return(database.TailnetCoordinator{}, nil)
+	// extra calls we don't particularly care about for this test
+	mStore.EXPECT().CleanTailnetCoordinators(gomock.Any()).AnyTimes().Return(nil)
+	mStore.EXPECT().GetTailnetClientsForAgent(gomock.Any(), gomock.Any()).AnyTimes().Return(nil, nil)
+	mStore.EXPECT().DeleteTailnetAgent(gomock.Any(), gomock.Any()).
+		AnyTimes().Return(database.DeleteTailnetAgentRow{}, nil)
+	mStore.EXPECT().DeleteCoordinator(gomock.Any(), gomock.Any()).AnyTimes().Return(nil)
+
+	uut, err := tailnet.NewPGCoord(ctx, logger, ps, mStore)
+	require.NoError(t, err)
+	defer func() {
+		err := uut.Close()
+		require.NoError(t, err)
+	}()
+	agent1 := newTestAgent(t, uut, "agent1")
+	defer agent1.close()
+	for i := 0; i < 3; i++ {
+		select {
+		case <-ctx.Done():
+			t.Fatal("timeout")
+		case calls <- struct{}{}:
+			// OK
+		}
+	}
+	// connected agent should be disconnected
+	agent1.waitForClose(ctx, t)
+
+	// new agent should immediately disconnect
+	agent2 := newTestAgent(t, uut, "agent2")
+	defer agent2.close()
+	agent2.waitForClose(ctx, t)
+
+	// next heartbeats succeed, so we are healthy
+	for i := 0; i < 2; i++ {
+		select {
+		case <-ctx.Done():
+			t.Fatal("timeout")
+		case calls <- struct{}{}:
+			// OK
+		}
+	}
+	agent3 := newTestAgent(t, uut, "agent3")
+	defer agent3.close()
+	select {
+	case <-agent3.closeChan:
+		t.Fatal("agent conn closed after we are healthy")
+	case <-time.After(time.Second):
+		// OK
+	}
+}
+
 type testConn struct {
 	ws, serverWS net.Conn
 	nodeChan     chan []*agpl.Node
@@ -545,10 +618,10 @@ func newTestConn(ids []uuid.UUID) *testConn {
 	return a
 }
 
-func newTestAgent(t *testing.T, coord agpl.Coordinator, id ...uuid.UUID) *testConn {
+func newTestAgent(t *testing.T, coord agpl.Coordinator, name string, id ...uuid.UUID) *testConn {
 	a := newTestConn(id)
 	go func() {
-		err := coord.ServeAgent(a.serverWS, a.id, "")
+		err := coord.ServeAgent(a.serverWS, a.id, name)
 		assert.NoError(t, err)
 		close(a.closeChan)
 	}()
@@ -563,7 +636,7 @@ func (c *testConn) recvNodes(ctx context.Context, t *testing.T) []*agpl.Node {
 	t.Helper()
 	select {
 	case <-ctx.Done():
-		t.Fatal("timeout receiving nodes")
+		t.Fatalf("testConn id %s: timeout receiving nodes ", c.id)
 		return nil
 	case nodes := <-c.nodeChan:
 		return nodes
@@ -572,12 +645,20 @@ func (c *testConn) recvNodes(ctx context.Context, t *testing.T) []*agpl.Node {
 
 func (c *testConn) recvErr(ctx context.Context, t *testing.T) error {
 	t.Helper()
-	select {
-	case <-ctx.Done():
-		t.Fatal("timeout receiving error")
-		return ctx.Err()
-	case err := <-c.errChan:
-		return err
+	// pgCoord works on eventual consistency, so it sometimes sends extra node
+	// updates, and these block errors if not read from the nodes channel.
+	for {
+		select {
+		case nodes := <-c.nodeChan:
+			t.Logf("ignoring nodes update while waiting for error; id=%s, nodes=%+v",
+				c.id.String(), nodes)
+			continue
+		case <-ctx.Done():
+			t.Fatal("timeout receiving error")
+			return ctx.Err()
+		case err := <-c.errChan:
+			return err
+		}
 	}
 }
 
@@ -620,8 +701,79 @@ func assertEventuallyHasDERPs(ctx context.Context, t *testing.T, c *testConn, ex
 				t.Logf("expected DERP %d to be in %v", e, derps)
 				continue
 			}
+			return
+		}
+	}
+}
+
+func assertNeverHasDERPs(ctx context.Context, t *testing.T, c *testConn, expected ...int) {
+	t.Helper()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case nodes := <-c.nodeChan:
+			derps := make([]int, 0, len(nodes))
+			for _, n := range nodes {
+				derps = append(derps, n.PreferredDERP)
+			}
+			for _, e := range expected {
+				if slices.Contains(derps, e) {
+					t.Fatalf("expected not to get DERP %d, but received it", e)
+					return
+				}
+			}
+		}
+	}
+}
+
+func assertMultiAgentEventuallyHasDERPs(ctx context.Context, t *testing.T, ma agpl.MultiAgentConn, expected ...int) {
+	t.Helper()
+	for {
+		nodes, ok := ma.NextUpdate(ctx)
+		require.True(t, ok)
+		if len(nodes) != len(expected) {
+			t.Logf("expected %d, got %d nodes", len(expected), len(nodes))
+			continue
+		}
+
+		derps := make([]int, 0, len(nodes))
+		for _, n := range nodes {
+			derps = append(derps, n.PreferredDERP)
+		}
+		for _, e := range expected {
+			if !slices.Contains(derps, e) {
+				t.Logf("expected DERP %d to be in %v", e, derps)
+				continue
+			}
+			return
+		}
+	}
+}
+
+func assertMultiAgentNeverHasDERPs(ctx context.Context, t *testing.T, ma agpl.MultiAgentConn, expected ...int) {
+	t.Helper()
+	for {
+		nodes, ok := ma.NextUpdate(ctx)
+		if !ok {
+			return
+		}
+		if len(nodes) != len(expected) {
+			t.Logf("expected %d, got %d nodes", len(expected), len(nodes))
+			continue
+		}
+
+		derps := make([]int, 0, len(nodes))
+		for _, n := range nodes {
+			derps = append(derps, n.PreferredDERP)
+		}
+		for _, e := range expected {
+			if !slices.Contains(derps, e) {
+				t.Logf("expected DERP %d to be in %v", e, derps)
+				continue
+			}
+			return
 		}
-		return
 	}
 }
 
@@ -639,6 +791,7 @@ func assertEventuallyNoAgents(ctx context.Context, t *testing.T, store database.
 }
 
 func assertEventuallyNoClientsForAgent(ctx context.Context, t *testing.T, store database.Store, agentID uuid.UUID) {
+	t.Helper()
 	assert.Eventually(t, func() bool {
 		clients, err := store.GetTailnetClientsForAgent(ctx, agentID)
 		if xerrors.Is(err, sql.ErrNoRows) {
diff --git a/enterprise/tailnet/workspaceproxy.go b/enterprise/tailnet/workspaceproxy.go
index 13e1f6663a2c0..3150890c13fa9 100644
--- a/enterprise/tailnet/workspaceproxy.go
+++ b/enterprise/tailnet/workspaceproxy.go
@@ -4,13 +4,14 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"net"
 	"time"
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/enterprise/wsproxy/wsproxysdk"
-	agpl "github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/enterprise/wsproxy/wsproxysdk"
+	agpl "github.com/coder/coder/v2/tailnet"
 )
 
 func ServeWorkspaceProxy(ctx context.Context, conn net.Conn, ma agpl.MultiAgentConn) error {
@@ -26,6 +27,9 @@ func ServeWorkspaceProxy(ctx context.Context, conn net.Conn, ma agpl.MultiAgentC
 		var msg wsproxysdk.CoordinateMessage
 		err := decoder.Decode(&msg)
 		if err != nil {
+			if errors.Is(err, net.ErrClosed) {
+				return nil
+			}
 			return xerrors.Errorf("read json: %w", err)
 		}
 
diff --git a/enterprise/trialer/trialer.go b/enterprise/trialer/trialer.go
index 69d395e5a3e16..14a8fa7b50ce0 100644
--- a/enterprise/trialer/trialer.go
+++ b/enterprise/trialer/trialer.go
@@ -13,8 +13,9 @@ import (
 
 	"github.com/google/uuid"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/enterprise/coderd/license"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
 )
 
 type request struct {
@@ -68,7 +69,7 @@ func New(db database.Store, url string, keys map[string]ed25519.PublicKey) func(
 			return xerrors.Errorf("parse uuid: %w", err)
 		}
 		_, err = db.InsertLicense(ctx, database.InsertLicenseParams{
-			UploadedAt: database.Now(),
+			UploadedAt: dbtime.Now(),
 			JWT:        string(raw),
 			Exp:        expTime,
 			UUID:       id,
diff --git a/enterprise/trialer/trialer_test.go b/enterprise/trialer/trialer_test.go
index 1a6ce695b7491..22a9eeaca31a0 100644
--- a/enterprise/trialer/trialer_test.go
+++ b/enterprise/trialer/trialer_test.go
@@ -8,9 +8,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/trialer"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/trialer"
 )
 
 func TestTrialer(t *testing.T) {
@@ -23,7 +23,7 @@ func TestTrialer(t *testing.T) {
 		_, _ = w.Write([]byte(license))
 	}))
 	defer srv.Close()
-	db := dbfake.New()
+	db := dbmem.New()
 
 	gen := trialer.New(db, srv.URL, coderdenttest.Keys)
 	err := gen(context.Background(), "kyle@coder.com")
diff --git a/enterprise/wsproxy/appstatsreporter.go b/enterprise/wsproxy/appstatsreporter.go
new file mode 100644
index 0000000000000..44ffe87e1a5e3
--- /dev/null
+++ b/enterprise/wsproxy/appstatsreporter.go
@@ -0,0 +1,21 @@
+package wsproxy
+
+import (
+	"context"
+
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/enterprise/wsproxy/wsproxysdk"
+)
+
+var _ workspaceapps.StatsReporter = (*appStatsReporter)(nil)
+
+type appStatsReporter struct {
+	Client *wsproxysdk.Client
+}
+
+func (r *appStatsReporter) Report(ctx context.Context, stats []workspaceapps.StatsReport) error {
+	err := r.Client.ReportAppStats(ctx, wsproxysdk.ReportAppStatsRequest{
+		Stats: stats,
+	})
+	return err
+}
diff --git a/enterprise/wsproxy/tokenprovider.go b/enterprise/wsproxy/tokenprovider.go
index 8efef6d979db3..38822a4e7a22d 100644
--- a/enterprise/wsproxy/tokenprovider.go
+++ b/enterprise/wsproxy/tokenprovider.go
@@ -7,8 +7,8 @@ import (
 
 	"cdr.dev/slog"
 
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/enterprise/wsproxy/wsproxysdk"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/enterprise/wsproxy/wsproxysdk"
 )
 
 var _ workspaceapps.SignedTokenProvider = (*TokenProvider)(nil)
diff --git a/enterprise/wsproxy/wsproxy.go b/enterprise/wsproxy/wsproxy.go
index 843b79ee394bf..b0194d69d3f26 100644
--- a/enterprise/wsproxy/wsproxy.go
+++ b/enterprise/wsproxy/wsproxy.go
@@ -11,6 +11,7 @@ import (
 	"reflect"
 	"regexp"
 	"strings"
+	"sync/atomic"
 	"time"
 
 	"github.com/go-chi/chi/v5"
@@ -21,21 +22,22 @@ import (
 	"golang.org/x/xerrors"
 	"tailscale.com/derp"
 	"tailscale.com/derp/derphttp"
+	"tailscale.com/tailcfg"
 	"tailscale.com/types/key"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/coderd/wsconncache"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/enterprise/derpmesh"
-	"github.com/coder/coder/enterprise/wsproxy/wsproxysdk"
-	"github.com/coder/coder/site"
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/coderd/wsconncache"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/derpmesh"
+	"github.com/coder/coder/v2/enterprise/wsproxy/wsproxysdk"
+	"github.com/coder/coder/v2/site"
+	"github.com/coder/coder/v2/tailnet"
 )
 
 type Options struct {
@@ -79,6 +81,8 @@ type Options struct {
 	// By default, CORs is set to accept external requests
 	// from the dashboardURL. This should only be used in development.
 	AllowAllCors bool
+
+	StatsCollectorOptions workspaceapps.StatsCollectorOptions
 }
 
 func (o *Options) Validate() error {
@@ -117,7 +121,8 @@ type Server struct {
 	SDKClient *wsproxysdk.Client
 
 	// DERP
-	derpMesh *derpmesh.Mesh
+	derpMesh      *derpmesh.Mesh
+	latestDERPMap atomic.Pointer[tailcfg.DERPMap]
 
 	// Used for graceful shutdown. Required for the dialer.
 	ctx           context.Context
@@ -237,19 +242,18 @@ func New(ctx context.Context, opts *Options) (*Server, error) {
 		return nil, xerrors.Errorf("parse app security key: %w", err)
 	}
 
-	connInfo, err := client.SDKClient.WorkspaceAgentConnectionInfoGeneric(ctx)
-	if err != nil {
-		return nil, xerrors.Errorf("get derpmap: %w", err)
-	}
-
 	var agentProvider workspaceapps.AgentProvider
 	if opts.Experiments.Enabled(codersdk.ExperimentSingleTailnet) {
 		stn, err := coderd.NewServerTailnet(ctx,
 			s.Logger,
 			nil,
-			connInfo.DERPMap,
+			func() *tailcfg.DERPMap {
+				return s.latestDERPMap.Load()
+			},
+			regResp.DERPForceWebSockets,
 			s.DialCoordinator,
 			wsconncache.New(s.DialWorkspaceAgent, 0),
+			s.TracerProvider,
 		)
 		if err != nil {
 			return nil, xerrors.Errorf("create server tailnet: %w", err)
@@ -261,8 +265,17 @@ func New(ctx context.Context, opts *Options) (*Server, error) {
 		}
 	}
 
+	workspaceAppsLogger := opts.Logger.Named("workspaceapps")
+	if opts.StatsCollectorOptions.Logger == nil {
+		named := workspaceAppsLogger.Named("stats_collector")
+		opts.StatsCollectorOptions.Logger = &named
+	}
+	if opts.StatsCollectorOptions.Reporter == nil {
+		opts.StatsCollectorOptions.Reporter = &appStatsReporter{Client: client}
+	}
+
 	s.AppServer = &workspaceapps.Server{
-		Logger:        opts.Logger.Named("workspaceapps"),
+		Logger:        workspaceAppsLogger,
 		DashboardURL:  opts.DashboardURL,
 		AccessURL:     opts.AccessURL,
 		Hostname:      opts.AppHostname,
@@ -278,9 +291,11 @@ func New(ctx context.Context, opts *Options) (*Server, error) {
 		},
 		AppSecurityKey: secKey,
 
-		AgentProvider:    agentProvider,
 		DisablePathApps:  opts.DisablePathApps,
 		SecureAuthCookie: opts.SecureAuthCookie,
+
+		AgentProvider:  agentProvider,
+		StatsCollector: workspaceapps.NewStatsCollector(opts.StatsCollectorOptions),
 	}
 
 	derpHandler := derphttp.Handler(derpServer)
@@ -442,6 +457,8 @@ func (s *Server) handleRegister(_ context.Context, res wsproxysdk.RegisterWorksp
 	}
 	s.derpMesh.SetAddresses(addresses, false)
 
+	s.latestDERPMap.Store(res.DERPMap)
+
 	return nil
 }
 
diff --git a/enterprise/wsproxy/wsproxy_test.go b/enterprise/wsproxy/wsproxy_test.go
index afcb3d1f16143..173fb3df4edff 100644
--- a/enterprise/wsproxy/wsproxy_test.go
+++ b/enterprise/wsproxy/wsproxy_test.go
@@ -15,20 +15,18 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/coderd"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/healthcheck"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/workspaceapps/apptest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/enterprise/coderd/license"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/tailnet"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/healthcheck/derphealth"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/workspaceapps/apptest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
+	"github.com/coder/coder/v2/enterprise/coderd/license"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestDERPOnly(t *testing.T) {
@@ -169,9 +167,9 @@ func TestDERP(t *testing.T) {
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	build := coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	workspace.LatestBuild = build
 
 	agentID := uuid.Nil
@@ -185,16 +183,8 @@ resourceLoop:
 	require.NotEqual(t, uuid.Nil, agentID)
 
 	// Connect an agent to the workspace
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: slogtest.Make(t, nil).Named("agent").Leveled(slog.LevelDebug),
-	})
-	t.Cleanup(func() {
-		_ = agentCloser.Close()
-	})
-	coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+	_ = agenttest.New(t, client.URL, authToken)
+	_ = coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 	t.Run("ReturnedInDERPMap", func(t *testing.T) {
 		t.Parallel()
@@ -203,10 +193,10 @@ resourceLoop:
 		connInfo, err := client.WorkspaceAgentConnectionInfo(ctx, agentID)
 		require.NoError(t, err)
 
-		// There should be three DERP servers in the map: the primary, and each
-		// of the two running proxies.
+		// There should be three DERP regions in the map: the primary, and each
+		// of the two running proxies. Also the STUN-only regions.
 		require.NotNil(t, connInfo.DERPMap)
-		require.Len(t, connInfo.DERPMap.Regions, 3)
+		require.Len(t, connInfo.DERPMap.Regions, 3+len(api.DeploymentValues.DERP.Server.STUNAddresses.Value()))
 
 		var (
 			primaryRegion *tailcfg.DERPRegion
@@ -230,6 +220,11 @@ resourceLoop:
 			// The last region is never started, which means it's never healthy,
 			// which means it's never added to the DERP map.
 
+			if len(r.Nodes) == 1 && r.Nodes[0].STUNOnly {
+				// Skip STUN-only regions.
+				continue
+			}
+
 			t.Fatalf("unexpected region: %+v", r)
 		}
 
@@ -244,24 +239,24 @@ resourceLoop:
 		require.Equal(t, "coder_best-proxy", proxy1Region.RegionCode)
 		require.Equal(t, 10001, proxy1Region.RegionID)
 		require.False(t, proxy1Region.EmbeddedRelay)
-		require.Len(t, proxy1Region.Nodes, 2) // proxy + stun
-		require.Equal(t, "10001a", proxy1Region.Nodes[1].Name)
-		require.Equal(t, 10001, proxy1Region.Nodes[1].RegionID)
-		require.Equal(t, proxyAPI1.Options.AccessURL.Hostname(), proxy1Region.Nodes[1].HostName)
-		require.Equal(t, proxyAPI1.Options.AccessURL.Port(), fmt.Sprint(proxy1Region.Nodes[1].DERPPort))
-		require.Equal(t, proxyAPI1.Options.AccessURL.Scheme == "http", proxy1Region.Nodes[1].ForceHTTP)
+		require.Len(t, proxy1Region.Nodes, 1)
+		require.Equal(t, "10001a", proxy1Region.Nodes[0].Name)
+		require.Equal(t, 10001, proxy1Region.Nodes[0].RegionID)
+		require.Equal(t, proxyAPI1.Options.AccessURL.Hostname(), proxy1Region.Nodes[0].HostName)
+		require.Equal(t, proxyAPI1.Options.AccessURL.Port(), fmt.Sprint(proxy1Region.Nodes[0].DERPPort))
+		require.Equal(t, proxyAPI1.Options.AccessURL.Scheme == "http", proxy1Region.Nodes[0].ForceHTTP)
 
 		// The second proxy region:
 		require.Equal(t, "worst-proxy", proxy2Region.RegionName)
 		require.Equal(t, "coder_worst-proxy", proxy2Region.RegionCode)
 		require.Equal(t, 10002, proxy2Region.RegionID)
 		require.False(t, proxy2Region.EmbeddedRelay)
-		require.Len(t, proxy2Region.Nodes, 2) // proxy + stun
-		require.Equal(t, "10002a", proxy2Region.Nodes[1].Name)
-		require.Equal(t, 10002, proxy2Region.Nodes[1].RegionID)
-		require.Equal(t, proxyAPI2.Options.AccessURL.Hostname(), proxy2Region.Nodes[1].HostName)
-		require.Equal(t, proxyAPI2.Options.AccessURL.Port(), fmt.Sprint(proxy2Region.Nodes[1].DERPPort))
-		require.Equal(t, proxyAPI2.Options.AccessURL.Scheme == "http", proxy2Region.Nodes[1].ForceHTTP)
+		require.Len(t, proxy2Region.Nodes, 1)
+		require.Equal(t, "10002a", proxy2Region.Nodes[0].Name)
+		require.Equal(t, 10002, proxy2Region.Nodes[0].RegionID)
+		require.Equal(t, proxyAPI2.Options.AccessURL.Hostname(), proxy2Region.Nodes[0].HostName)
+		require.Equal(t, proxyAPI2.Options.AccessURL.Port(), fmt.Sprint(proxy2Region.Nodes[0].DERPPort))
+		require.Equal(t, proxyAPI2.Options.AccessURL.Scheme == "http", proxy2Region.Nodes[0].ForceHTTP)
 	})
 
 	t.Run("ConnectDERP", func(t *testing.T) {
@@ -270,11 +265,15 @@ resourceLoop:
 		connInfo, err := client.WorkspaceAgentConnectionInfo(testutil.Context(t, testutil.WaitLong), agentID)
 		require.NoError(t, err)
 		require.NotNil(t, connInfo.DERPMap)
-		require.Len(t, connInfo.DERPMap.Regions, 3)
+		require.Len(t, connInfo.DERPMap.Regions, 3+len(api.DeploymentValues.DERP.Server.STUNAddresses.Value()))
 
 		// Connect to each region.
 		for _, r := range connInfo.DERPMap.Regions {
 			r := r
+			if len(r.Nodes) == 1 && r.Nodes[0].STUNOnly {
+				// Skip STUN-only regions.
+				continue
+			}
 
 			t.Run(r.RegionName, func(t *testing.T) {
 				t.Parallel()
@@ -287,8 +286,8 @@ resourceLoop:
 				}
 
 				ctx := testutil.Context(t, testutil.WaitLong)
-				report := healthcheck.DERPReport{}
-				report.Run(ctx, &healthcheck.DERPReportOptions{
+				report := derphealth.Report{}
+				report.Run(ctx, &derphealth.ReportOptions{
 					DERPMap: derpMap,
 				})
 
@@ -311,132 +310,6 @@ resourceLoop:
 	})
 }
 
-func TestDERPMapStunNodes(t *testing.T) {
-	t.Parallel()
-
-	deploymentValues := coderdtest.DeploymentValues(t)
-	deploymentValues.Experiments = []string{
-		string(codersdk.ExperimentMoons),
-		"*",
-	}
-	stunAddresses := []string{
-		"stun.l.google.com:19302",
-		"stun1.l.google.com:19302",
-		"stun2.l.google.com:19302",
-		"stun3.l.google.com:19302",
-		"stun4.l.google.com:19302",
-	}
-	deploymentValues.DERP.Server.STUNAddresses = stunAddresses
-
-	client, closer, api, _ := coderdenttest.NewWithAPI(t, &coderdenttest.Options{
-		Options: &coderdtest.Options{
-			DeploymentValues:         deploymentValues,
-			AppHostname:              "*.primary.test.coder.com",
-			IncludeProvisionerDaemon: true,
-			RealIPConfig: &httpmw.RealIPConfig{
-				TrustedOrigins: []*net.IPNet{{
-					IP:   net.ParseIP("127.0.0.1"),
-					Mask: net.CIDRMask(8, 32),
-				}},
-				TrustedHeaders: []string{
-					"CF-Connecting-IP",
-				},
-			},
-		},
-		LicenseOptions: &coderdenttest.LicenseOptions{
-			Features: license.Features{
-				codersdk.FeatureWorkspaceProxy: 1,
-			},
-		},
-	})
-	t.Cleanup(func() {
-		_ = closer.Close()
-	})
-
-	// Create a running external proxy.
-	_ = coderdenttest.NewWorkspaceProxy(t, api, client, &coderdenttest.ProxyOptions{
-		Name: "cool-proxy",
-	})
-
-	// Wait for both running proxies to become healthy.
-	require.Eventually(t, func() bool {
-		healthCtx := testutil.Context(t, testutil.WaitLong)
-		err := api.ProxyHealth.ForceUpdate(healthCtx)
-		if !assert.NoError(t, err) {
-			return false
-		}
-
-		regions, err := client.Regions(healthCtx)
-		if !assert.NoError(t, err) {
-			return false
-		}
-		if !assert.Len(t, regions, 2) {
-			return false
-		}
-
-		// All regions should be healthy.
-		for _, r := range regions {
-			if !r.Healthy {
-				return false
-			}
-		}
-		return true
-	}, testutil.WaitLong, testutil.IntervalMedium)
-
-	// Get the DERP map and ensure that the built-in region and the proxy region
-	// both have the STUN nodes.
-	ctx := testutil.Context(t, testutil.WaitLong)
-	connInfo, err := client.WorkspaceAgentConnectionInfoGeneric(ctx)
-	require.NoError(t, err)
-
-	// There should be two DERP servers in the map: the primary and the
-	// proxy.
-	require.NotNil(t, connInfo.DERPMap)
-	require.Len(t, connInfo.DERPMap.Regions, 2)
-
-	var (
-		primaryRegion *tailcfg.DERPRegion
-		proxyRegion   *tailcfg.DERPRegion
-	)
-	for _, r := range connInfo.DERPMap.Regions {
-		if r.EmbeddedRelay {
-			primaryRegion = r
-			continue
-		}
-		if r.RegionName == "cool-proxy" {
-			proxyRegion = r
-			continue
-		}
-
-		t.Fatalf("unexpected region: %+v", r)
-	}
-
-	// The primary region:
-	require.Equal(t, "Coder Embedded Relay", primaryRegion.RegionName)
-	require.Equal(t, "coder", primaryRegion.RegionCode)
-	require.Equal(t, 999, primaryRegion.RegionID)
-	require.True(t, primaryRegion.EmbeddedRelay)
-	require.Len(t, primaryRegion.Nodes, len(stunAddresses)+1)
-
-	// The proxy region:
-	require.Equal(t, "cool-proxy", proxyRegion.RegionName)
-	require.Equal(t, "coder_cool-proxy", proxyRegion.RegionCode)
-	require.Equal(t, 10001, proxyRegion.RegionID)
-	require.False(t, proxyRegion.EmbeddedRelay)
-	require.Len(t, proxyRegion.Nodes, len(stunAddresses)+1)
-
-	for _, region := range []*tailcfg.DERPRegion{primaryRegion, proxyRegion} {
-		stunNodes, err := tailnet.STUNNodes(region.RegionID, stunAddresses)
-		require.NoError(t, err)
-		require.Len(t, stunNodes, len(stunAddresses))
-
-		require.Equal(t, stunNodes, region.Nodes[:len(stunNodes)])
-
-		// The last node should be the Coder server.
-		require.NotZero(t, region.Nodes[len(region.Nodes)-1].DERPPort)
-	}
-}
-
 func TestDERPEndToEnd(t *testing.T) {
 	t.Parallel()
 
@@ -519,9 +392,9 @@ func TestDERPEndToEnd(t *testing.T) {
 		ProvisionApply: echo.ProvisionApplyWithAgent(authToken),
 	})
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	build := coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+	build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 	workspace.LatestBuild = build
 
 	agentID := uuid.Nil
@@ -535,16 +408,8 @@ resourceLoop:
 	require.NotEqual(t, uuid.Nil, agentID)
 
 	// Connect an agent to the workspace
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: slogtest.Make(t, nil).Named("agent").Leveled(slog.LevelDebug),
-	})
-	t.Cleanup(func() {
-		_ = agentCloser.Close()
-	})
-	coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+	_ = agenttest.New(t, client.URL, authToken)
+	_ = coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 
 	// Connect to the workspace agent.
 	ctx := testutil.Context(t, testutil.WaitLong)
@@ -596,6 +461,7 @@ func TestWorkspaceProxyWorkspaceApps_Wsconncache(t *testing.T) {
 						"CF-Connecting-IP",
 					},
 				},
+				WorkspaceAppsStatsCollectorOptions: opts.StatsCollectorOptions,
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{
@@ -654,6 +520,7 @@ func TestWorkspaceProxyWorkspaceApps_SingleTailnet(t *testing.T) {
 						"CF-Connecting-IP",
 					},
 				},
+				WorkspaceAppsStatsCollectorOptions: opts.StatsCollectorOptions,
 			},
 			LicenseOptions: &coderdenttest.LicenseOptions{
 				Features: license.Features{
diff --git a/enterprise/wsproxy/wsproxysdk/wsproxysdk.go b/enterprise/wsproxy/wsproxysdk/wsproxysdk.go
index 6d1a4b1227b5d..c00ab834b7c25 100644
--- a/enterprise/wsproxy/wsproxysdk/wsproxysdk.go
+++ b/enterprise/wsproxy/wsproxysdk/wsproxysdk.go
@@ -14,14 +14,15 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 	"nhooyr.io/websocket"
+	"tailscale.com/tailcfg"
 	"tailscale.com/util/singleflight"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/codersdk"
+	agpl "github.com/coder/coder/v2/tailnet"
 )
 
 // Client is a HTTP client for a subset of Coder API routes that external
@@ -152,6 +153,25 @@ func (c *Client) IssueSignedAppTokenHTML(ctx context.Context, rw http.ResponseWr
 	return res, true
 }
 
+type ReportAppStatsRequest struct {
+	Stats []workspaceapps.StatsReport `json:"stats"`
+}
+
+// ReportAppStats reports the given app stats to the primary coder server.
+func (c *Client) ReportAppStats(ctx context.Context, req ReportAppStatsRequest) error {
+	resp, err := c.Request(ctx, http.MethodPost, "/api/v2/workspaceproxies/me/app-stats", req)
+	if err != nil {
+		return xerrors.Errorf("make request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusNoContent {
+		return codersdk.ReadBodyAsError(resp)
+	}
+
+	return nil
+}
+
 type RegisterWorkspaceProxyRequest struct {
 	// AccessURL that hits the workspace proxy api.
 	AccessURL string `json:"access_url"`
@@ -187,9 +207,11 @@ type RegisterWorkspaceProxyRequest struct {
 }
 
 type RegisterWorkspaceProxyResponse struct {
-	AppSecurityKey string `json:"app_security_key"`
-	DERPMeshKey    string `json:"derp_mesh_key"`
-	DERPRegionID   int32  `json:"derp_region_id"`
+	AppSecurityKey      string           `json:"app_security_key"`
+	DERPMeshKey         string           `json:"derp_mesh_key"`
+	DERPRegionID        int32            `json:"derp_region_id"`
+	DERPMap             *tailcfg.DERPMap `json:"derp_map"`
+	DERPForceWebSockets bool             `json:"derp_force_websockets"`
 	// SiblingReplicas is a list of all other replicas of the proxy that have
 	// not timed out.
 	SiblingReplicas []codersdk.Replica `json:"sibling_replicas"`
@@ -400,14 +422,14 @@ const (
 type CoordinateMessage struct {
 	Type    CoordinateMessageType `json:"type"`
 	AgentID uuid.UUID             `json:"agent_id"`
-	Node    *tailnet.Node         `json:"node"`
+	Node    *agpl.Node            `json:"node"`
 }
 
 type CoordinateNodes struct {
-	Nodes []*tailnet.Node
+	Nodes []*agpl.Node
 }
 
-func (c *Client) DialCoordinator(ctx context.Context) (tailnet.MultiAgentConn, error) {
+func (c *Client) DialCoordinator(ctx context.Context) (agpl.MultiAgentConn, error) {
 	ctx, cancel := context.WithCancel(ctx)
 
 	coordinateURL, err := c.SDKClient.URL.Parse("/api/v2/workspaceproxies/me/coordinate")
@@ -441,13 +463,13 @@ func (c *Client) DialCoordinator(ctx context.Context) (tailnet.MultiAgentConn, e
 		legacyAgentCache: map[uuid.UUID]bool{},
 	}
 
-	ma := (&tailnet.MultiAgent{
+	ma := (&agpl.MultiAgent{
 		ID:                uuid.New(),
 		AgentIsLegacyFunc: rma.AgentIsLegacy,
 		OnSubscribe:       rma.OnSubscribe,
 		OnUnsubscribe:     rma.OnUnsubscribe,
 		OnNodeUpdate:      rma.OnNodeUpdate,
-		OnRemove:          func(uuid.UUID) { conn.Close(websocket.StatusGoingAway, "closed") },
+		OnRemove:          func(agpl.Queue) { conn.Close(websocket.StatusGoingAway, "closed") },
 	}).Init()
 
 	go func() {
@@ -493,7 +515,7 @@ func (a *remoteMultiAgentHandler) writeJSON(v interface{}) error {
 
 	// Set a deadline so that hung connections don't put back pressure on the system.
 	// Node updates are tiny, so even the dinkiest connection can handle them if it's not hung.
-	err = a.nc.SetWriteDeadline(time.Now().Add(tailnet.WriteTimeout))
+	err = a.nc.SetWriteDeadline(time.Now().Add(agpl.WriteTimeout))
 	if err != nil {
 		return xerrors.Errorf("set write deadline: %w", err)
 	}
@@ -515,21 +537,21 @@ func (a *remoteMultiAgentHandler) writeJSON(v interface{}) error {
 	return nil
 }
 
-func (a *remoteMultiAgentHandler) OnNodeUpdate(_ uuid.UUID, node *tailnet.Node) error {
+func (a *remoteMultiAgentHandler) OnNodeUpdate(_ uuid.UUID, node *agpl.Node) error {
 	return a.writeJSON(CoordinateMessage{
 		Type: CoordinateMessageTypeNodeUpdate,
 		Node: node,
 	})
 }
 
-func (a *remoteMultiAgentHandler) OnSubscribe(_ tailnet.Queue, agentID uuid.UUID) (*tailnet.Node, error) {
+func (a *remoteMultiAgentHandler) OnSubscribe(_ agpl.Queue, agentID uuid.UUID) (*agpl.Node, error) {
 	return nil, a.writeJSON(CoordinateMessage{
 		Type:    CoordinateMessageTypeSubscribe,
 		AgentID: agentID,
 	})
 }
 
-func (a *remoteMultiAgentHandler) OnUnsubscribe(_ tailnet.Queue, agentID uuid.UUID) error {
+func (a *remoteMultiAgentHandler) OnUnsubscribe(_ agpl.Queue, agentID uuid.UUID) error {
 	return a.writeJSON(CoordinateMessage{
 		Type:    CoordinateMessageTypeUnsubscribe,
 		AgentID: agentID,
diff --git a/enterprise/wsproxy/wsproxysdk/wsproxysdk_test.go b/enterprise/wsproxy/wsproxysdk/wsproxysdk_test.go
index 207283a098532..4be8d510fb723 100644
--- a/enterprise/wsproxy/wsproxysdk/wsproxysdk_test.go
+++ b/enterprise/wsproxy/wsproxysdk/wsproxysdk_test.go
@@ -24,14 +24,14 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/coderd/workspaceapps"
-	"github.com/coder/coder/enterprise/tailnet"
-	"github.com/coder/coder/enterprise/wsproxy/wsproxysdk"
-	agpl "github.com/coder/coder/tailnet"
-	"github.com/coder/coder/tailnet/tailnettest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/workspaceapps"
+	"github.com/coder/coder/v2/enterprise/tailnet"
+	"github.com/coder/coder/v2/enterprise/wsproxy/wsproxysdk"
+	agpl "github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/tailnet/tailnettest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func Test_IssueSignedAppTokenHTML(t *testing.T) {
diff --git a/examples/examples.gen.json b/examples/examples.gen.json
new file mode 100644
index 0000000000000..4dff0ecc53e0b
--- /dev/null
+++ b/examples/examples.gen.json
@@ -0,0 +1,149 @@
+// Code generated by examplegen. DO NOT EDIT.
+[
+  {
+    "id": "aws-ecs-container",
+    "url": "",
+    "name": "Develop in an ECS-hosted container",
+    "description": "Get started with Linux development on AWS ECS.",
+    "icon": "/icon/aws.png",
+    "tags": [
+      "cloud",
+      "aws"
+    ],
+    "markdown": "\n# aws-ecs\n\nThis is a sample template for running a Coder workspace on ECS. It assumes there\nis a pre-existing ECS cluster with EC2-based compute to host the workspace.\n\n## Architecture\n\nThis workspace is built using the following AWS resources:\n\n- Task definition - the container definition, includes the image, command, volume(s)\n- ECS service - manages the task definition\n\n## code-server\n\n`code-server` is installed via the `startup_script` argument in the `coder_agent`\nresource block. The `coder_app` resource is defined to access `code-server` through\nthe dashboard UI over `localhost:13337`.\n"
+  },
+  {
+    "id": "aws-linux",
+    "url": "",
+    "name": "Develop in Linux on AWS EC2",
+    "description": "Get started with Linux development on AWS EC2.",
+    "icon": "/icon/aws.png",
+    "tags": [
+      "cloud",
+      "aws"
+    ],
+    "markdown": "\n# aws-linux\n\nTo get started, run `coder templates init`. When prompted, select this template.\nFollow the on-screen instructions to proceed.\n\n## Authentication\n\nThis template assumes that coderd is run in an environment that is authenticated\nwith AWS. For example, run `aws configure import` to import credentials on the\nsystem and user running coderd. For other ways to authenticate [consult the\nTerraform docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration).\n\n## Required permissions / policy\n\nThe following sample policy allows Coder to create EC2 instances and modify\ninstances provisioned by Coder:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"VisualEditor0\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ec2:GetDefaultCreditSpecification\",\n        \"ec2:DescribeIamInstanceProfileAssociations\",\n        \"ec2:DescribeTags\",\n        \"ec2:DescribeInstances\",\n        \"ec2:DescribeInstanceTypes\",\n        \"ec2:CreateTags\",\n        \"ec2:RunInstances\",\n        \"ec2:DescribeInstanceCreditSpecifications\",\n        \"ec2:DescribeImages\",\n        \"ec2:ModifyDefaultCreditSpecification\",\n        \"ec2:DescribeVolumes\"\n      ],\n      \"Resource\": \"*\"\n    },\n    {\n      \"Sid\": \"CoderResources\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ec2:DescribeInstanceAttribute\",\n        \"ec2:UnmonitorInstances\",\n        \"ec2:TerminateInstances\",\n        \"ec2:StartInstances\",\n        \"ec2:StopInstances\",\n        \"ec2:DeleteTags\",\n        \"ec2:MonitorInstances\",\n        \"ec2:CreateTags\",\n        \"ec2:RunInstances\",\n        \"ec2:ModifyInstanceAttribute\",\n        \"ec2:ModifyInstanceCreditSpecification\"\n      ],\n      \"Resource\": \"arn:aws:ec2:*:*:instance/*\",\n      \"Condition\": {\n        \"StringEquals\": {\n          \"aws:ResourceTag/Coder_Provisioned\": \"true\"\n        }\n      }\n    }\n  ]\n}\n```\n\n## code-server\n\n`code-server` is installed via the `startup_script` argument in the `coder_agent`\nresource block. The `coder_app` resource is defined to access `code-server` through\nthe dashboard UI over `localhost:13337`.\n"
+  },
+  {
+    "id": "aws-windows",
+    "url": "",
+    "name": "Develop in Windows on AWS",
+    "description": "Get started with Windows development on AWS.",
+    "icon": "/icon/aws.png",
+    "tags": [
+      "cloud",
+      "aws"
+    ],
+    "markdown": "\n# aws-windows\n\n## Getting started\n\nTo get started, run `coder templates init`. When prompted, select this template.\nFollow the on-screen instructions to proceed.\n\n## Authentication\n\nThis template assumes that coderd is run in an environment that is authenticated\nwith AWS. For example, run `aws configure import` to import credentials on the\nsystem and user running coderd. For other ways to authenticate [consult the\nTerraform docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration).\n\n## Required permissions / policy\n\nThe following sample policy allows Coder to create EC2 instances and modify\ninstances provisioned by Coder:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"VisualEditor0\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ec2:GetDefaultCreditSpecification\",\n        \"ec2:DescribeIamInstanceProfileAssociations\",\n        \"ec2:DescribeTags\",\n        \"ec2:DescribeInstances\",\n        \"ec2:DescribeInstanceTypes\",\n        \"ec2:CreateTags\",\n        \"ec2:RunInstances\",\n        \"ec2:DescribeInstanceCreditSpecifications\",\n        \"ec2:DescribeImages\",\n        \"ec2:ModifyDefaultCreditSpecification\",\n        \"ec2:DescribeVolumes\"\n      ],\n      \"Resource\": \"*\"\n    },\n    {\n      \"Sid\": \"CoderResources\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"ec2:DescribeInstanceAttribute\",\n        \"ec2:UnmonitorInstances\",\n        \"ec2:TerminateInstances\",\n        \"ec2:StartInstances\",\n        \"ec2:StopInstances\",\n        \"ec2:DeleteTags\",\n        \"ec2:MonitorInstances\",\n        \"ec2:CreateTags\",\n        \"ec2:RunInstances\",\n        \"ec2:ModifyInstanceAttribute\",\n        \"ec2:ModifyInstanceCreditSpecification\"\n      ],\n      \"Resource\": \"arn:aws:ec2:*:*:instance/*\",\n      \"Condition\": {\n        \"StringEquals\": {\n          \"aws:ResourceTag/Coder_Provisioned\": \"true\"\n        }\n      }\n    }\n  ]\n}\n```\n"
+  },
+  {
+    "id": "azure-linux",
+    "url": "",
+    "name": "Develop in Linux on Azure",
+    "description": "Get started with Linux development on Microsoft Azure.",
+    "icon": "/icon/azure.png",
+    "tags": [
+      "cloud",
+      "azure",
+      "linux"
+    ],
+    "markdown": "\n# azure-linux\n\nTo get started, run `coder templates init`. When prompted, select this template.\nFollow the on-screen instructions to proceed.\n\n## Authentication\n\nThis template assumes that coderd is run in an environment that is authenticated\nwith Azure. For example, run `az login` then `az account set --subscription=\u003cid\u003e`\nto import credentials on the system and user running coderd. For other ways to\nauthenticate [consult the Terraform docs](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs#authenticating-to-azure).\n"
+  },
+  {
+    "id": "do-linux",
+    "url": "",
+    "name": "Develop in Linux on a Digital Ocean Droplet",
+    "description": "Get started with Linux development on a Digital Ocean Droplet.",
+    "icon": "/icon/do.png",
+    "tags": [
+      "cloud",
+      "digitalocean"
+    ],
+    "markdown": "\n# do-linux\n\nTo deploy workspaces as DigitalOcean Droplets, you'll need:\n\n- DigitalOcean [personal access token\n  (PAT)](https://docs.digitalocean.com/reference/api/create-personal-access-token/)\n\n- DigitalOcean project ID (you can get your project information via the `doctl`\n  CLI by running `doctl projects list`)\n\n  - Remove the following sections from the `main.tf` file if you don't want to\n    associate your workspaces with a project:\n\n    - `variable \"step2_do_project_id\"`\n    - `resource \"digitalocean_project_resources\" \"project\"`\n\n- **Optional:** DigitalOcean SSH key ID (obtain via the `doctl` CLI by running\n  `doctl compute ssh-key list`)\n\n  - Note that this is only required for Fedora images to work.\n\n## Authentication\n\nThis template assumes that coderd is run in an environment that is authenticated\nwith Digital Ocean. Obtain a [Digital Ocean Personal Access\nToken](https://cloud.digitalocean.com/account/api/tokens) and set the\nenvironment variable `DIGITALOCEAN_TOKEN` to the access token before starting\ncoderd. For other ways to authenticate [consult the Terraform\ndocs](https://registry.terraform.io/providers/digitalocean/digitalocean/latest/docs).\n"
+  },
+  {
+    "id": "docker",
+    "url": "",
+    "name": "Develop in Docker",
+    "description": "Develop inside Docker containers using your local daemon",
+    "icon": "/icon/docker.png",
+    "tags": [
+      "local",
+      "docker"
+    ],
+    "markdown": "\n# docker\n\nTo get started, run `coder templates init`. When prompted, select this template.\nFollow the on-screen instructions to proceed.\n\n## Editing the image\n\nEdit the `Dockerfile` and run `coder templates push` to update workspaces.\n\n## code-server\n\n`code-server` is installed via the `startup_script` argument in the `coder_agent`\nresource block. The `coder_app` resource is defined to access `code-server` through\nthe dashboard UI over `localhost:13337`.\n\n## Extending this template\n\nSee the [kreuzwerker/docker](https://registry.terraform.io/providers/kreuzwerker/docker) Terraform provider documentation to\nadd the following features to your Coder template:\n\n- SSH/TCP docker host\n- Registry authentication\n- Build args\n- Volume mounts\n- Custom container spec\n- More\n\nWe also welcome contributions!\n"
+  },
+  {
+    "id": "docker-with-dotfiles",
+    "url": "",
+    "name": "Develop in Docker with a dotfiles URL",
+    "description": "Develop inside Docker containers using your local daemon",
+    "icon": "/icon/docker.png",
+    "tags": [
+      "local",
+      "docker"
+    ],
+    "markdown": "\n# docker-with-dotfiles\n\nThis is an example for deploying workspaces with a prompt for the users' dotfiles repo URI.\n\n## Getting started\n\nRun `coder templates init` and select this template. Follow the instructions that appear.\n\n## How it works\n\nDuring workspace creation, Coder prompts you to specify a dotfiles URL via a Terraform variable. Once the workspace starts, the Coder agent runs `coder dotfiles` via the startup script:\n\n```hcl\nvariable \"dotfiles_uri\" {\n  description = \u003c\u003c-EOF\n  Dotfiles repo URI (optional)\n\n  see https://dotfiles.github.io\n  EOF\n    # The codercom/enterprise-* images are only built for amd64\n  default = \"\"\n}\n\nresource \"coder_agent\" \"main\" {\n  ...\n  startup_script = var.dotfiles_uri != \"\" ? \"/tmp/tmp.coder*/coder dotfiles -y ${var.dotfiles_uri}\" : null\n}\n```\n\n# Managing images and workspaces\n\nRefer to the documentation in the [Docker template](../docker/README.md).\n"
+  },
+  {
+    "id": "gcp-linux",
+    "url": "",
+    "name": "Develop in Linux on Google Cloud",
+    "description": "Get started with Linux development on Google Cloud.",
+    "icon": "/icon/gcp.png",
+    "tags": [
+      "cloud",
+      "google"
+    ],
+    "markdown": "\n# gcp-linux\n\nTo get started, run `coder templates init`. When prompted, select this template,\nand follow the on-screen instructions to proceed.\n\n## Authentication\n\nThis template assumes that coderd is run in an environment that is authenticated\nwith Google Cloud. For example, run `gcloud auth application-default login` to\nimport credentials on the system and user running coderd. For other ways to\nauthenticate [consult the Terraform\ndocs](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/getting_started#adding-credentials).\n\n## Service account\n\nCoder requires a Google Cloud Service Account to provision workspaces. To create\na service account:\n\n1. Navigate to the [CGP\n   console](https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts/create),\n   and select your Cloud project (if you have more than one project associated\n   with your account)\n\n1. Provide a service account name (this name is used to generate the service\n   account ID)\n\n1. Click **Create and continue**, and choose the following IAM roles to grant to\n   the service account:\n\n   - Compute Admin\n   - Service Account User\n\n   Click **Continue**.\n\n1. Click on the created key, and navigate to the **Keys** tab.\n\n1. Click **Add key** \u003e **Create new key**.\n\n1. Generate a **JSON private key**, which will be what you provide to Coder\n   during the setup process.\n\n## code-server\n\n`code-server` is installed via the `startup_script` argument in the `coder_agent`\nresource block. The `coder_app` resource is defined to access `code-server` through\nthe dashboard UI over `localhost:13337`.\n"
+  },
+  {
+    "id": "gcp-vm-container",
+    "url": "",
+    "name": "Develop in a container on a Google Cloud VM",
+    "description": "Get started with Linux development on Google Cloud.",
+    "icon": "/icon/gcp.png",
+    "tags": [
+      "cloud",
+      "google",
+      "container"
+    ],
+    "markdown": "\n# gcp-vm-container\n\nTo get started, run `coder templates init`. When prompted, select this template,\nand follow the on-screen instructions to proceed.\n\n## Authentication\n\nThis template assumes that coderd is run in an environment that is authenticated\nwith Google Cloud. For example, run `gcloud auth application-default login` to\nimport credentials on the system and user running coderd. For other ways to\nauthenticate [consult the Terraform\ndocs](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/getting_started#adding-credentials).\n\n## Service account\n\nCoder requires a Google Cloud Service Account to provision workspaces. To create\na service account:\n\n1. Navigate to the [CGP\n   console](https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts/create),\n   and select your Cloud project (if you have more than one project associated\n   with your account)\n\n1. Provide a service account name (this name is used to generate the service\n   account ID)\n\n1. Click **Create and continue**, and choose the following IAM roles to grant to\n   the service account:\n\n   - Compute Admin\n   - Service Account User\n\n   Click **Continue**.\n\n1. Click on the created key, and navigate to the **Keys** tab.\n\n1. Click **Add key** \u003e **Create new key**.\n\n1. Generate a **JSON private key**, which will be what you provide to Coder\n   during the setup process.\n\n## code-server\n\n`code-server` is installed via the `startup_script` argument in the `coder_agent`\nresource block. The `coder_app` resource is defined to access `code-server` through\nthe dashboard UI over `localhost:13337`.\n"
+  },
+  {
+    "id": "gcp-windows",
+    "url": "",
+    "name": "Develop in Windows on Google Cloud",
+    "description": "Get started with Windows development on Google Cloud.",
+    "icon": "/icon/gcp.png",
+    "tags": [
+      "cloud",
+      "google"
+    ],
+    "markdown": "\n# gcp-windows\n\nTo get started, run `coder templates init`. When prompted, select this template,\nand follow the on-screen instructions to proceed.\n\n## Authentication\n\nThis template assumes that coderd is run in an environment that is authenticated\nwith Google Cloud. For example, run `gcloud auth application-default login` to\nimport credentials on the system and user running coderd. For other ways to\nauthenticate [consult the Terraform\ndocs](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/getting_started#adding-credentials).\n\n## Service account\n\nCoder requires a Google Cloud Service Account to provision workspaces. To create\na service account:\n\n1. Navigate to the [CGP\n   console](https://console.cloud.google.com/projectselector/iam-admin/serviceaccounts/create),\n   and select your Cloud project (if you have more than one project associated\n   with your account)\n\n1. Provide a service account name (this name is used to generate the service\n   account ID)\n\n1. Click **Create and continue**, and choose the following IAM roles to grant to\n   the service account:\n\n   - Compute Admin\n   - Service Account User\n\n   Click **Continue**.\n\n1. Click on the created key, and navigate to the **Keys** tab.\n\n1. Click **Add key** \u003e **Create new key**.\n\n1. Generate a **JSON private key**, which will be what you provide to Coder\n   during the setup process.\n"
+  },
+  {
+    "id": "kubernetes",
+    "url": "",
+    "name": "Develop in Kubernetes",
+    "description": "Get started with Kubernetes development.",
+    "icon": "/icon/k8s.png",
+    "tags": [
+      "cloud",
+      "kubernetes"
+    ],
+    "markdown": "\n# Getting started\n\nThis template creates a deployment running the `codercom/enterprise-base:ubuntu` image.\n\n## Prerequisites\n\nThis template uses [`kubernetes_deployment`](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/deployment) terraform resource, which requires the `coder` service account to have permission to create deploymnets. For example if you are using [helm](https://coder.com/docs/v2/latest/install/kubernetes#install-coder-with-helm) to install Coder, you should set `coder.serviceAccount.enableDeployments=true` in your `values.yaml`\n\n```diff\ncoder:\nserviceAccount:\n    workspacePerms: true\n-   enableDeployments: false\n+   enableDeployments: true\n    annotations: {}\n    name: coder\n```\n\n\u003e Note: This is only required for Coder versions \u003c 0.28.0, as this will be the default value for Coder versions \u003e= 0.28.0\n\n## Authentication\n\nThis template can authenticate using in-cluster authentication, or using a kubeconfig local to the\nCoder host. For additional authentication options, consult the [Kubernetes provider\ndocumentation](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs).\n\n### kubeconfig on Coder host\n\nIf the Coder host has a local `~/.kube/config`, you can use this to authenticate\nwith Coder. Make sure this is done with same user that's running the `coder` service.\n\nTo use this authentication, set the parameter `use_kubeconfig` to true.\n\n### In-cluster authentication\n\nIf the Coder host runs in a Pod on the same Kubernetes cluster as you are creating workspaces in,\nyou can use in-cluster authentication.\n\nTo use this authentication, set the parameter `use_kubeconfig` to false.\n\nThe Terraform provisioner will automatically use the service account associated with the pod to\nauthenticate to Kubernetes. Be sure to bind a [role with appropriate permission](#rbac) to the\nservice account. For example, assuming the Coder host runs in the same namespace as you intend\nto create workspaces:\n\n```yaml\napiVersion: v1\nkind: ServiceAccount\nmetadata:\n  name: coder\n\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n  name: coder\nsubjects:\n  - kind: ServiceAccount\n    name: coder\nroleRef:\n  kind: Role\n  name: coder\n  apiGroup: rbac.authorization.k8s.io\n```\n\nThen start the Coder host with `serviceAccountName: coder` in the pod spec.\n\n### Authenticate against external clusters\n\nYou may want to deploy workspaces on a cluster outside of the Coder control plane. Refer to the [Coder docs](https://coder.com/docs/v2/latest/platforms/kubernetes/additional-clusters) to learn how to modify your template to authenticate against external clusters.\n\n## Namespace\n\nThe target namespace in which the deployment will be deployed is defined via the `coder_workspace`\nvariable. The namespace must exist prior to creating workspaces.\n\n## Persistence\n\nThe `/home/coder` directory in this example is persisted via the attached PersistentVolumeClaim.\nAny data saved outside of this directory will be wiped when the workspace stops.\n\nSince most binary installations and environment configurations live outside of\nthe `/home` directory, we suggest including these in the `startup_script` argument\nof the `coder_agent` resource block, which will run each time the workspace starts up.\n\nFor example, when installing the `aws` CLI, the install script will place the\n`aws` binary in `/usr/local/bin/aws`. To ensure the `aws` CLI is persisted across\nworkspace starts/stops, include the following code in the `coder_agent` resource\nblock of your workspace template:\n\n```terraform\nresource \"coder_agent\" \"main\" {\n  startup_script = \u003c\u003c-EOT\n    set -e\n    # install AWS CLI\n    curl \"https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip\" -o \"awscliv2.zip\"\n    unzip awscliv2.zip\n    sudo ./aws/install\n  EOT\n}\n```\n\n## code-server\n\n`code-server` is installed via the `startup_script` argument in the `coder_agent`\nresource block. The `coder_app` resource is defined to access `code-server` through\nthe dashboard UI over `localhost:13337`.\n\n## Deployment logs\n\nTo stream kubernetes pods events from the deployment, you can use Coder's [`coder-logstream-kube`](https://github.com/coder/coder-logstream-kube) tool. This can stream logs from the deployment to Coder's workspace startup logs. You just need to install the `coder-logstream-kube` helm chart on the cluster where the deployment is running.\n\n```shell\nhelm repo add coder-logstream-kube https://helm.coder.com/logstream-kube\nhelm install coder-logstream-kube coder-logstream-kube/coder-logstream-kube \\\n    --namespace coder \\\n    --set url=\u003cyour-coder-url-including-http-or-https\u003e\n```\n\nFor detailed instructions, see [Deployment logs](https://coder.com/docs/v2/latest/platforms/kubernetes/deployment-logs)\n"
+  },
+  {
+    "id": "nomad-docker",
+    "url": "",
+    "name": "Develop in a Nomad Docker Container",
+    "description": "Get started with Nomad Workspaces.",
+    "icon": "/icon/nomad.svg",
+    "tags": [
+      "cloud",
+      "nomad"
+    ],
+    "markdown": "\n# Develop in a Nomad Docker Container\n\nThis example shows how to use Nomad service tasks to be used as a development environment using docker and host csi volumes.\n\n## Prerequisites\n\n- [Nomad](https://www.nomadproject.io/downloads)\n- [Docker](https://docs.docker.com/get-docker/)\n\n## Setup\n\n### 1. Start the CSI Host Volume Plugin\n\nThe CSI Host Volume plugin is used to mount host volumes into Nomad tasks. This is useful for development environments where you want to mount persistent volumes into your container workspace.\n\n1. Login to the Nomad server using SSH.\n\n2. Append the following stanza to your Nomad server configuration file and restart the nomad service.\n\n   ```hcl\n   plugin \"docker\" {\n     config {\n       allow_privileged = true\n     }\n   }\n   ```\n\n   ```shell\n   sudo systemctl restart nomad\n   ```\n\n3. Create a file `hostpath.nomad` with following content:\n\n   ```hcl\n   job \"hostpath-csi-plugin\" {\n     datacenters = [\"dc1\"]\n     type = \"system\"\n\n     group \"csi\" {\n       task \"plugin\" {\n         driver = \"docker\"\n\n         config {\n           image = \"registry.k8s.io/sig-storage/hostpathplugin:v1.10.0\"\n\n           args = [\n             \"--drivername=csi-hostpath\",\n             \"--v=5\",\n             \"--endpoint=${CSI_ENDPOINT}\",\n             \"--nodeid=node-${NOMAD_ALLOC_INDEX}\",\n           ]\n\n           privileged = true\n         }\n\n         csi_plugin {\n           id   = \"hostpath\"\n           type = \"monolith\"\n           mount_dir = \"/csi\"\n         }\n\n         resources {\n           cpu    = 256\n           memory = 128\n         }\n       }\n     }\n   }\n   ```\n\n4. Run the job:\n\n   ```shell\n   nomad job run hostpath.nomad\n   ```\n\n### 2. Setup the Nomad Template\n\n1. Create the template by running the following command:\n\n   ```shell\n   coder template init nomad-docker\n   cd nomad-docker\n   coder template create\n   ```\n\n2. Set up Nomad server address and optional authentication:\n\n3. Create a new workspace and start developing.\n"
+  }
+]
diff --git a/examples/examples.go b/examples/examples.go
index 5f8f37bb5075e..016804a073ba2 100644
--- a/examples/examples.go
+++ b/examples/examples.go
@@ -2,23 +2,27 @@ package examples
 
 import (
 	"archive/tar"
+	"bufio"
 	"bytes"
 	"embed"
+	"encoding/json"
 	"io"
 	"io/fs"
 	"path"
+	"sort"
 	"strings"
 	"sync"
 
-	"github.com/gohugoio/hugo/parser/pageparser"
 	"golang.org/x/sync/singleflight"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 var (
 	// Only some templates are embedded that we want to display inside the UI.
+	// The metadata in examples.gen.json is generated via scripts/examplegen.
+	//go:embed examples.gen.json
 	//go:embed templates/aws-ecs-container
 	//go:embed templates/aws-linux
 	//go:embed templates/aws-windows
@@ -30,13 +34,14 @@ var (
 	//go:embed templates/gcp-vm-container
 	//go:embed templates/gcp-windows
 	//go:embed templates/kubernetes
-	//go:embed templates/fly-docker-image
+	//go:embed templates/nomad-docker
 	files embed.FS
 
 	exampleBasePath = "https://github.com/coder/coder/tree/main/examples/templates/"
-	examples        = make([]codersdk.TemplateExample, 0)
+	examplesJSON    = "examples.gen.json"
+	parsedExamples  []codersdk.TemplateExample
 	parseExamples   sync.Once
-	archives        = singleflight.Group{}
+	archives        singleflight.Group
 	ErrNotFound     = xerrors.New("example not found")
 )
 
@@ -44,102 +49,65 @@ const rootDir = "templates"
 
 // List returns all embedded examples.
 func List() ([]codersdk.TemplateExample, error) {
-	var returnError error
+	var err error
 	parseExamples.Do(func() {
-		files, err := fs.Sub(files, rootDir)
-		if err != nil {
-			returnError = xerrors.Errorf("get example fs: %w", err)
-		}
-
-		dirs, err := fs.ReadDir(files, ".")
-		if err != nil {
-			returnError = xerrors.Errorf("read dir: %w", err)
-			return
-		}
-
-		for _, dir := range dirs {
-			if !dir.IsDir() {
-				continue
-			}
-			exampleID := dir.Name()
-			exampleURL := exampleBasePath + exampleID
-			// Each one of these is a example!
-			readme, err := fs.ReadFile(files, path.Join(dir.Name(), "README.md"))
-			if err != nil {
-				returnError = xerrors.Errorf("example %q does not contain README.md", exampleID)
-				return
-			}
+		parsedExamples, err = parseAndVerifyExamples()
+	})
+	return parsedExamples, err
+}
 
-			frontMatter, err := pageparser.ParseFrontMatterAndContent(bytes.NewReader(readme))
-			if err != nil {
-				returnError = xerrors.Errorf("parse example %q front matter: %w", exampleID, err)
-				return
-			}
+func parseAndVerifyExamples() (examples []codersdk.TemplateExample, err error) {
+	f, err := files.Open(examplesJSON)
+	if err != nil {
+		return nil, xerrors.Errorf("open %s: %w", examplesJSON, err)
+	}
+	defer f.Close()
 
-			nameRaw, exists := frontMatter.FrontMatter["name"]
-			if !exists {
-				returnError = xerrors.Errorf("example %q front matter does not contain name", exampleID)
-				return
-			}
+	b := bufio.NewReader(f)
 
-			name, valid := nameRaw.(string)
-			if !valid {
-				returnError = xerrors.Errorf("example %q name isn't a string", exampleID)
-				return
-			}
+	// Discard the first line (code generated by-comment).
+	_, _, err = b.ReadLine()
+	if err != nil {
+		return nil, xerrors.Errorf("read %s: %w", examplesJSON, err)
+	}
 
-			descriptionRaw, exists := frontMatter.FrontMatter["description"]
-			if !exists {
-				returnError = xerrors.Errorf("example %q front matter does not contain name", exampleID)
-				return
-			}
+	err = json.NewDecoder(b).Decode(&examples)
+	if err != nil {
+		return nil, xerrors.Errorf("decode %s: %w", examplesJSON, err)
+	}
 
-			description, valid := descriptionRaw.(string)
-			if !valid {
-				returnError = xerrors.Errorf("example %q description isn't a string", exampleID)
-				return
-			}
+	// Sanity-check: Verify that the examples in the JSON file match the
+	// embedded files.
+	var wantEmbedFiles []string
+	for i, example := range examples {
+		examples[i].URL = exampleBasePath + example.ID
+		wantEmbedFiles = append(wantEmbedFiles, example.ID)
+	}
 
-			tags := []string{}
-			tagsRaw, exists := frontMatter.FrontMatter["tags"]
-			if exists {
-				tagsI, valid := tagsRaw.([]interface{})
-				if !valid {
-					returnError = xerrors.Errorf("example %q tags isn't a slice: type %T", exampleID, tagsRaw)
-					return
-				}
-				for _, tagI := range tagsI {
-					tag, valid := tagI.(string)
-					if !valid {
-						returnError = xerrors.Errorf("example %q tag isn't a string: type %T", exampleID, tagI)
-						return
-					}
-					tags = append(tags, tag)
-				}
-			}
+	files, err := fs.Sub(files, rootDir)
+	if err != nil {
+		return nil, xerrors.Errorf("get templates fs: %w", err)
+	}
+	dirs, err := fs.ReadDir(files, ".")
+	if err != nil {
+		return nil, xerrors.Errorf("read templates dir: %w", err)
+	}
+	var gotEmbedFiles []string
+	for _, dir := range dirs {
+		if dir.IsDir() {
+			gotEmbedFiles = append(gotEmbedFiles, dir.Name())
+		}
+	}
 
-			var icon string
-			iconRaw, exists := frontMatter.FrontMatter["icon"]
-			if exists {
-				icon, valid = iconRaw.(string)
-				if !valid {
-					returnError = xerrors.Errorf("example %q icon isn't a string", exampleID)
-					return
-				}
-			}
+	sort.Strings(wantEmbedFiles)
+	sort.Strings(gotEmbedFiles)
+	want := strings.Join(wantEmbedFiles, ", ")
+	got := strings.Join(gotEmbedFiles, ", ")
+	if want != got {
+		return nil, xerrors.Errorf("mismatch between %s and embedded files: want %q, got %q", examplesJSON, want, got)
+	}
 
-			examples = append(examples, codersdk.TemplateExample{
-				ID:          exampleID,
-				URL:         exampleURL,
-				Name:        name,
-				Description: description,
-				Icon:        icon,
-				Tags:        tags,
-				Markdown:    string(frontMatter.Content),
-			})
-		}
-	})
-	return examples, returnError
+	return examples, nil
 }
 
 // Archive returns a tar by example ID.
diff --git a/examples/examples_test.go b/examples/examples_test.go
index e4a3c38a0ea79..13b4df12f6cb9 100644
--- a/examples/examples_test.go
+++ b/examples/examples_test.go
@@ -10,13 +10,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/examples"
+	"github.com/coder/coder/v2/examples"
 )
 
 func TestTemplate(t *testing.T) {
 	t.Parallel()
 	list, err := examples.List()
-	require.NoError(t, err)
+	require.NoError(t, err, "error listing examples, run \"make gen\" to ensure examples are up to date")
 	require.NotEmpty(t, list)
 	for _, eg := range list {
 		eg := eg
diff --git a/examples/lima/README.md b/examples/lima/README.md
index 9828201ae9d80..aac38a8ec24ba 100644
--- a/examples/lima/README.md
+++ b/examples/lima/README.md
@@ -20,7 +20,7 @@ This will:
 
 - Start an Ubuntu 22.04 VM
 - Install Docker and Terraform from the official repos
-- Install Coder using the [installation script](https://coder.com/docs/coder-oss/latest/install#installsh)
+- Install Coder using the [installation script](../../docs/install/install.sh.md)
 - Generates an initial user account `admin@coder.com` with a randomly generated password (stored in the VM under `/home/${USER}.linux/.config/coderv2/password`)
 - Initializes a [sample Docker template](https://github.com/coder/coder/tree/main/examples/templates/docker) for creating workspaces
 
diff --git a/examples/parameters-dynamic-options/README.md b/examples/parameters-dynamic-options/README.md
new file mode 100644
index 0000000000000..2c6c00d6acc83
--- /dev/null
+++ b/examples/parameters-dynamic-options/README.md
@@ -0,0 +1,40 @@
+---
+name: Sample Template with Dynamic Parameter Options
+description: Review the sample template and introduce dynamic parameter options to your template
+tags: [local, docker, parameters]
+icon: /icon/docker.png
+---
+
+# Overview
+
+This Coder template presents use of [dynamic](https://developer.hashicorp.com/terraform/language/expressions/dynamic-blocks) [parameter options](https://coder.com/docs/v2/latest/templates/parameters#options) and Terraform [locals](https://developer.hashicorp.com/terraform/language/values/locals).
+
+## Use case
+
+The Coder template makes use of Docker containers to provide workspace users with programming language SDKs like Go, Java, and more.
+The template administrator wants to make sure that only certain versions of these programming environments are available,
+without allowing users to manually change them.
+
+Workspace users should simply choose the programming environment they prefer. When the template admin upgrades SDK versions,
+during the next workspace update the chosen environment will automatically be upgraded to the latest version without causing any disruption or prompts.
+
+The references to Docker images are represented by Terraform variables, and they're passed via the configuration file like this:
+
+```yaml
+go_image: "bitnami/golang:1.20-debian-11"
+java_image: "bitnami/java:1.8-debian-11
+```
+
+The template admin needs to update image references, publish a new version of the template, and then either handle workspace updates on their own or let workspace users take care of it.
+
+## Development
+
+Update the template and push it using the following command:
+
+```bash
+./scripts/coder-dev.sh templates push examples-parameters-dynamic-options \
+  -d examples/parameters-dynamic-options \
+  --variables-file examples/parameters-dynamic-options/variables.yml \
+  --create \
+  -y
+```
diff --git a/examples/parameters-dynamic-options/main.tf b/examples/parameters-dynamic-options/main.tf
new file mode 100644
index 0000000000000..d459a41f70461
--- /dev/null
+++ b/examples/parameters-dynamic-options/main.tf
@@ -0,0 +1,155 @@
+terraform {
+  required_providers {
+    coder = {
+      source = "coder/coder"
+    }
+    docker = {
+      source = "kreuzwerker/docker"
+    }
+  }
+}
+
+variable "go_image" {
+  description = "Go SDK image reference"
+  type        = string
+}
+
+variable "java_image" {
+  description = "Java image reference."
+  type        = string
+}
+
+locals {
+  username = data.coder_workspace.me.owner
+
+  images = {
+    "go"   = var.go_image,
+    "java" = var.java_image,
+  }
+}
+
+data "coder_provisioner" "me" {
+}
+
+data "coder_workspace" "me" {
+}
+
+data "coder_parameter" "container_image" {
+  name         = "container_image"
+  display_name = "Workspace container image"
+  description  = "Select the container image for your development environment."
+  default      = "java"
+  mutable      = true
+
+  dynamic "option" {
+    for_each = [for k in keys(local.images) : { name = k, value = lower(k) }]
+    content {
+      name  = option.value.name
+      value = option.value.value
+    }
+  }
+}
+
+resource "coder_agent" "main" {
+  arch           = data.coder_provisioner.me.arch
+  os             = "linux"
+  startup_script = <<EOF
+    #!/bin/sh
+    # install and start code-server
+    curl -fsSL https://code-server.dev/install.sh | sh -s -- --version 4.8.3
+    code-server --auth none --port 13337
+    EOF
+
+  env = {
+    GIT_AUTHOR_NAME     = "${data.coder_workspace.me.owner}"
+    GIT_COMMITTER_NAME  = "${data.coder_workspace.me.owner}"
+    GIT_AUTHOR_EMAIL    = "${data.coder_workspace.me.owner_email}"
+    GIT_COMMITTER_EMAIL = "${data.coder_workspace.me.owner_email}"
+  }
+}
+
+resource "coder_app" "code-server" {
+  agent_id     = coder_agent.main.id
+  slug         = "code-server"
+  display_name = "code-server"
+  url          = "http://localhost:13337/?folder=/home/${local.username}"
+  icon         = "/icon/code.svg"
+  subdomain    = false
+  share        = "owner"
+
+  healthcheck {
+    url       = "http://localhost:13337/healthz"
+    interval  = 5
+    threshold = 6
+  }
+}
+
+resource "docker_volume" "home_volume" {
+  name = "coder-${data.coder_workspace.me.id}-home"
+  lifecycle {
+    ignore_changes = all
+  }
+  labels {
+    label = "coder.owner"
+    value = data.coder_workspace.me.owner
+  }
+  labels {
+    label = "coder.owner_id"
+    value = data.coder_workspace.me.owner_id
+  }
+  labels {
+    label = "coder.workspace_id"
+    value = data.coder_workspace.me.id
+  }
+  labels {
+    label = "coder.workspace_name_at_creation"
+    value = data.coder_workspace.me.name
+  }
+}
+
+resource "coder_metadata" "home_info" {
+  resource_id = docker_volume.home_volume.id
+
+  item {
+    key   = "size"
+    value = "5 GiB"
+  }
+}
+
+resource "docker_container" "workspace" {
+  count      = data.coder_workspace.me.start_count
+  image      = local.images[data.coder_parameter.container_image.value]
+  name       = "coder-${data.coder_workspace.me.owner}-${lower(data.coder_workspace.me.name)}"
+  hostname   = data.coder_workspace.me.name
+  entrypoint = ["sh", "-c", replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal")]
+  env = [
+    "CODER_AGENT_TOKEN=${coder_agent.main.token}",
+    "CODER_PARAMETER_CONTAINER_IMAGE=${local.images[data.coder_parameter.container_image.value]}"
+  ]
+  host {
+    host = "host.docker.internal"
+    ip   = "host-gateway"
+  }
+  volumes {
+    container_path = "/home/${local.username}"
+    volume_name    = docker_volume.home_volume.name
+    read_only      = false
+  }
+
+  labels {
+    label = "coder.owner"
+    value = data.coder_workspace.me.owner
+  }
+  labels {
+    label = "coder.owner_id"
+    value = data.coder_workspace.me.owner_id
+  }
+  labels {
+    label = "coder.workspace_id"
+    value = data.coder_workspace.me.id
+  }
+  labels {
+    label = "coder.workspace_name"
+    value = data.coder_workspace.me.name
+  }
+}
diff --git a/examples/parameters-dynamic-options/variables.yml b/examples/parameters-dynamic-options/variables.yml
new file mode 100644
index 0000000000000..5699c9698de6a
--- /dev/null
+++ b/examples/parameters-dynamic-options/variables.yml
@@ -0,0 +1,2 @@
+go_image: "bitnami/golang:1.20-debian-11"
+java_image: "bitnami/java:1.8-debian-11"
diff --git a/examples/parameters/README.md b/examples/parameters/README.md
new file mode 100644
index 0000000000000..8ebd3ee3c8b50
--- /dev/null
+++ b/examples/parameters/README.md
@@ -0,0 +1,19 @@
+---
+name: Sample Template with Parameters
+description: Review the sample template and introduce parameters to your template
+tags: [local, docker, parameters]
+icon: /icon/docker.png
+---
+
+# Overview
+
+This Coder template presents various features of [rich parameters](https://coder.com/docs/v2/latest/templates/parameters), including types, validation constraints,
+mutability, ephemeral (one-time) parameters, etc.
+
+## Development
+
+Update the template and push it using the following command:
+
+```bash
+./scripts/coder-dev.sh templates push examples-parameters -d examples/parameters --create
+```
diff --git a/examples/parameters/build/Dockerfile b/examples/parameters/build/Dockerfile
new file mode 100644
index 0000000000000..a443b5d07100e
--- /dev/null
+++ b/examples/parameters/build/Dockerfile
@@ -0,0 +1,18 @@
+FROM ubuntu
+
+RUN apt-get update \
+	&& apt-get install -y \
+	curl \
+	git \
+	golang \
+	sudo \
+	vim \
+	wget \
+	&& rm -rf /var/lib/apt/lists/*
+
+ARG USER=coder
+RUN useradd --groups sudo --no-create-home --shell /bin/bash ${USER} \
+	&& echo "${USER} ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/${USER} \
+	&& chmod 0440 /etc/sudoers.d/${USER}
+USER ${USER}
+WORKDIR /home/${USER}
diff --git a/examples/parameters/main.tf b/examples/parameters/main.tf
new file mode 100644
index 0000000000000..10dc82f5759b6
--- /dev/null
+++ b/examples/parameters/main.tf
@@ -0,0 +1,279 @@
+terraform {
+  required_providers {
+    coder = {
+      source = "coder/coder"
+    }
+    docker = {
+      source = "kreuzwerker/docker"
+    }
+  }
+}
+
+locals {
+  username = data.coder_workspace.me.owner
+}
+
+data "coder_provisioner" "me" {
+}
+
+provider "docker" {
+}
+
+data "coder_workspace" "me" {
+}
+
+resource "coder_agent" "main" {
+  arch                   = data.coder_provisioner.me.arch
+  os                     = "linux"
+  startup_script_timeout = 180
+  startup_script         = <<-EOT
+    set -e
+
+    # install and start code-server
+    curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server --version 4.11.0
+    /tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &
+  EOT
+}
+
+resource "coder_app" "code-server" {
+  agent_id     = coder_agent.main.id
+  slug         = "code-server"
+  display_name = "code-server"
+  url          = "http://localhost:13337/?folder=/home/${local.username}"
+  icon         = "/icon/code.svg"
+  subdomain    = false
+  share        = "owner"
+
+  healthcheck {
+    url       = "http://localhost:13337/healthz"
+    interval  = 5
+    threshold = 6
+  }
+}
+
+resource "docker_volume" "home_volume" {
+  name = "coder-${data.coder_workspace.me.id}-home"
+  # Protect the volume from being deleted due to changes in attributes.
+  lifecycle {
+    ignore_changes = all
+  }
+  # Add labels in Docker to keep track of orphan resources.
+  labels {
+    label = "coder.owner"
+    value = data.coder_workspace.me.owner
+  }
+  labels {
+    label = "coder.owner_id"
+    value = data.coder_workspace.me.owner_id
+  }
+  labels {
+    label = "coder.workspace_id"
+    value = data.coder_workspace.me.id
+  }
+  # This field becomes outdated if the workspace is renamed but can
+  # be useful for debugging or cleaning out dangling volumes.
+  labels {
+    label = "coder.workspace_name_at_creation"
+    value = data.coder_workspace.me.name
+  }
+}
+
+resource "docker_image" "main" {
+  name = "coder-${data.coder_workspace.me.id}"
+  build {
+    context = "./build"
+    build_args = {
+      USER = local.username
+    }
+  }
+  triggers = {
+    dir_sha1 = sha1(join("", [for f in fileset(path.module, "build/*") : filesha1(f)]))
+  }
+}
+
+resource "docker_container" "workspace" {
+  count = data.coder_workspace.me.start_count
+  image = docker_image.main.name
+  # Uses lower() to avoid Docker restriction on container names.
+  name = "coder-${data.coder_workspace.me.owner}-${lower(data.coder_workspace.me.name)}"
+  # Hostname makes the shell more user friendly: coder@my-workspace:~$
+  hostname = data.coder_workspace.me.name
+  # Use the docker gateway if the access URL is 127.0.0.1
+  entrypoint = ["sh", "-c", replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal")]
+  env        = ["CODER_AGENT_TOKEN=${coder_agent.main.token}"]
+  host {
+    host = "host.docker.internal"
+    ip   = "host-gateway"
+  }
+  volumes {
+    container_path = "/home/${local.username}"
+    volume_name    = docker_volume.home_volume.name
+    read_only      = false
+  }
+  # Add labels in Docker to keep track of orphan resources.
+  labels {
+    label = "coder.owner"
+    value = data.coder_workspace.me.owner
+  }
+  labels {
+    label = "coder.owner_id"
+    value = data.coder_workspace.me.owner_id
+  }
+  labels {
+    label = "coder.workspace_id"
+    value = data.coder_workspace.me.id
+  }
+  labels {
+    label = "coder.workspace_name"
+    value = data.coder_workspace.me.name
+  }
+}
+
+// Rich parameters
+// See: https://coder.com/docs/v2/latest/templates/parameters
+
+data "coder_parameter" "project_id" {
+  name         = "project_id"
+  display_name = "My Project ID"
+  icon         = "/emojis/1fab5.png"
+  description  = "Specify the project ID to deploy in workspace."
+  default      = "A1B2C3"
+  mutable      = true
+  validation {
+    regex = "^[A-Z0-9]+$"
+    error = "Project ID is incorrect"
+  }
+
+  order = 1
+}
+
+data "coder_parameter" "region" {
+  name         = "region"
+  display_name = "Region"
+  icon         = "/emojis/1f30e.png"
+  description  = "Select the region in which you would like to deploy your workspace."
+  default      = "eu-helsinki"
+  option {
+    icon        = "/emojis/1f1fa-1f1f8.png"
+    name        = "Pittsburgh"
+    description = "Pittsburgh is a city in the Commonwealth of Pennsylvania and the county seat of Allegheny County."
+    value       = "us-pittsburgh"
+  }
+  option {
+    icon        = "/emojis/1f1eb-1f1ee.png"
+    name        = "Helsinki"
+    description = "Helsinki, the capital city of Finland, is renowned for its vibrant cultural scene, stunning waterfront architecture, and a harmonious blend of modernity and natural beauty."
+    value       = "eu-helsinki"
+  }
+  option {
+    icon        = "/emojis/1f1e6-1f1fa.png"
+    name        = "Sydney"
+    description = "Sydney, the largest city in Australia, captivates with its iconic Sydney Opera House, picturesque harbor, and diverse neighborhoods, making it a captivating blend of urban sophistication and coastal charm."
+    value       = "ap-sydney"
+  }
+
+  order = 1
+}
+
+data "coder_parameter" "apps_dir" {
+  name         = "apps_dir"
+  display_name = "Apps Directory"
+  icon         = "/emojis/1f9ba.png"
+  type         = "string"
+  description  = "Specify the directory to install project applications and tools."
+  default      = "/var/apps"
+
+  order = 2
+}
+
+data "coder_parameter" "worker_instances" {
+  name         = "worker_instances"
+  display_name = "Worker Instances"
+  icon         = "/emojis/2697.png"
+  type         = "number"
+  description  = "Specify the number of worker instances to spawn."
+  default      = "3"
+  mutable      = true
+  validation {
+    min       = 3
+    max       = 12
+    monotonic = "increasing"
+  }
+  order = 2
+}
+
+data "coder_parameter" "security_groups" {
+  name         = "security_groups"
+  display_name = "Security Groups"
+  icon         = "/emojis/26f4.png"
+  type         = "list(string)"
+  description  = "Select relevant security groups."
+  mutable      = true
+  default = jsonencode([
+    "Web Server Security Group",
+    "Database Security Group",
+    "Backend Security Group"
+  ])
+  order = 2
+}
+
+data "coder_parameter" "docker_image" {
+  name         = "docker_image"
+  display_name = "Docker Image"
+  mutable      = true
+  type         = "string"
+  description  = "Docker image for the development container"
+  default      = "ghcr.io/coder/coder-preview:main"
+
+  order = 3
+}
+
+data "coder_parameter" "command_line_args" {
+  name         = "command_line_args"
+  display_name = "Extra command line args"
+  type         = "string"
+  default      = ""
+  description  = "Provide extra command line args for the startup script."
+  mutable      = true
+  order        = 80
+}
+
+data "coder_parameter" "enable_monitoring" {
+  name         = "enable_monitoring"
+  display_name = "Enable Workspace Monitoring"
+  type         = "bool"
+  description  = "This monitoring functionality empowers you to closely track the health and resource utilization of your instance in real-time."
+  mutable      = true
+  order        = 90
+}
+
+// Build options (ephemeral parameters)
+// See: https://coder.com/docs/v2/latest/templates/parameters#ephemeral-parameters
+
+data "coder_parameter" "pause-startup" {
+  name         = "pause-startup"
+  display_name = "Pause startup script"
+  type         = "number"
+  description  = "Pause the startup script (seconds)"
+  default      = "1"
+  mutable      = true
+  ephemeral    = true
+  validation {
+    min = 0
+    max = 300
+  }
+
+  order = 4
+}
+
+data "coder_parameter" "force-rebuild" {
+  name         = "force-rebuild"
+  display_name = "Force rebuild project"
+  type         = "bool"
+  description  = "Rebuild the workspace project"
+  default      = "false"
+  mutable      = true
+  ephemeral    = true
+
+  order = 4
+}
diff --git a/examples/templates/aws-ecs-container/main.tf b/examples/templates/aws-ecs-container/main.tf
index f7f2249ee8807..ee1ebae0d7983 100644
--- a/examples/templates/aws-ecs-container/main.tf
+++ b/examples/templates/aws-ecs-container/main.tf
@@ -1,17 +1,16 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "~> 0.7.0"
+      source = "coder/coder"
     }
     aws = {
-      source  = "hashicorp/aws"
-      version = "~> 4.55"
+      source = "hashicorp/aws"
     }
   }
 }
 
 provider "coder" {
+  feature_use_managed_variables = true
 }
 
 variable "ecs-cluster" {
diff --git a/examples/templates/aws-linux/main.tf b/examples/templates/aws-linux/main.tf
index 96d9136dfe758..cce6252c82649 100644
--- a/examples/templates/aws-linux/main.tf
+++ b/examples/templates/aws-linux/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "~> 0.7.0"
+      source = "coder/coder"
     }
     aws = {
-      source  = "hashicorp/aws"
-      version = "~> 4.55"
+      source = "hashicorp/aws"
     }
   }
 }
@@ -30,24 +28,24 @@ data "coder_parameter" "region" {
     icon  = "/emojis/1f1f0-1f1f7.png"
   }
   option {
-    name  = "Asia Pacific (Osaka-Local)"
+    name  = "Asia Pacific (Osaka)"
     value = "ap-northeast-3"
-    icon  = "/emojis/1f1f0-1f1f7.png"
+    icon  = "/emojis/1f1ef-1f1f5.png"
   }
   option {
     name  = "Asia Pacific (Mumbai)"
     value = "ap-south-1"
-    icon  = "/emojis/1f1f0-1f1f7.png"
+    icon  = "/emojis/1f1ee-1f1f3.png"
   }
   option {
     name  = "Asia Pacific (Singapore)"
     value = "ap-southeast-1"
-    icon  = "/emojis/1f1f0-1f1f7.png"
+    icon  = "/emojis/1f1f8-1f1ec.png"
   }
   option {
     name  = "Asia Pacific (Sydney)"
     value = "ap-southeast-2"
-    icon  = "/emojis/1f1f0-1f1f7.png"
+    icon  = "/emojis/1f1e6-1f1fa.png"
   }
   option {
     name  = "Canada (Central)"
@@ -158,7 +156,8 @@ data "aws_ami" "ubuntu" {
   owners = ["099720109477"] # Canonical
 }
 
-resource "coder_agent" "main" {
+resource "coder_agent" "dev" {
+  count                  = data.coder_workspace.me.start_count
   arch                   = "amd64"
   auth                   = "aws-instance-identity"
   os                     = "linux"
@@ -176,38 +175,27 @@ resource "coder_agent" "main" {
     display_name = "CPU Usage"
     interval     = 5
     timeout      = 5
-    script       = <<-EOT
-      #!/bin/bash
-      set -e
-      top -bn1 | grep "Cpu(s)" | awk '{print $2 + $4 "%"}'
-    EOT
+    script       = "coder stat cpu"
   }
   metadata {
     key          = "memory"
     display_name = "Memory Usage"
     interval     = 5
     timeout      = 5
-    script       = <<-EOT
-      #!/bin/bash
-      set -e
-      free -m | awk 'NR==2{printf "%.2f%%\t", $3*100/$2 }'
-    EOT
+    script       = "coder stat mem"
   }
   metadata {
     key          = "disk"
     display_name = "Disk Usage"
     interval     = 600 # every 10 minutes
     timeout      = 30  # df can take a while on large filesystems
-    script       = <<-EOT
-      #!/bin/bash
-      set -e
-      df /home/coder | awk '$NF=="/"{printf "%s", $5}'
-    EOT
+    script       = "coder stat disk --path $HOME"
   }
 }
 
 resource "coder_app" "code-server" {
-  agent_id     = coder_agent.main.id
+  count        = data.coder_workspace.me.start_count
+  agent_id     = coder_agent.dev[0].id
   slug         = "code-server"
   display_name = "code-server"
   url          = "http://localhost:13337/?folder=/home/coder"
@@ -223,11 +211,8 @@ resource "coder_app" "code-server" {
 }
 
 locals {
-
-  # User data is used to stop/start AWS instances. See:
-  # https://github.com/hashicorp/terraform-provider-aws/issues/22
-
-  user_data_start = <<EOT
+  linux_user = "coder"
+  user_data = data.coder_workspace.me.start_count > 0 ? trimspace(<<EOT
 Content-Type: multipart/mixed; boundary="//"
 MIME-Version: 1.0
 
@@ -253,37 +238,10 @@ Content-Transfer-Encoding: 7bit
 Content-Disposition: attachment; filename="userdata.txt"
 
 #!/bin/bash
-sudo -u ${local.linux_user} sh -c '${coder_agent.main.init_script}'
---//--
-EOT
-
-  user_data_end = <<EOT
-Content-Type: multipart/mixed; boundary="//"
-MIME-Version: 1.0
-
---//
-Content-Type: text/cloud-config; charset="us-ascii"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Content-Disposition: attachment; filename="cloud-config.txt"
-
-#cloud-config
-cloud_final_modules:
-- [scripts-user, always]
-
---//
-Content-Type: text/x-shellscript; charset="us-ascii"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Content-Disposition: attachment; filename="userdata.txt"
-
-#!/bin/bash
-sudo shutdown -h now
+sudo -u ${local.linux_user} sh -c '${coder_agent.dev[0].init_script}'
 --//--
 EOT
-
-  linux_user = "coder" # Ensure this user/group does not exist in your VM image
-
+  ) : ""
 }
 
 resource "aws_instance" "dev" {
@@ -291,7 +249,7 @@ resource "aws_instance" "dev" {
   availability_zone = "${data.coder_parameter.region.value}a"
   instance_type     = data.coder_parameter.instance_type.value
 
-  user_data = data.coder_workspace.me.transition == "start" ? local.user_data_start : local.user_data_end
+  user_data = local.user_data
   tags = {
     Name = "coder-${data.coder_workspace.me.owner}-${data.coder_workspace.me.name}"
     # Required if you are using our example policy, see template README
@@ -314,3 +272,8 @@ resource "coder_metadata" "workspace_info" {
     value = "${aws_instance.dev.root_block_device[0].volume_size} GiB"
   }
 }
+
+resource "aws_ec2_instance_state" "dev" {
+  instance_id = aws_instance.dev.id
+  state       = data.coder_workspace.me.transition == "start" ? "running" : "stopped"
+}
diff --git a/examples/templates/aws-windows/main.tf b/examples/templates/aws-windows/main.tf
index 215aaff56f828..39e10f473fa26 100644
--- a/examples/templates/aws-windows/main.tf
+++ b/examples/templates/aws-windows/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "~> 0.7.0"
+      source = "coder/coder"
     }
     aws = {
-      source  = "hashicorp/aws"
-      version = "~> 4.55"
+      source = "hashicorp/aws"
     }
   }
 }
diff --git a/examples/templates/azure-linux/main.tf b/examples/templates/azure-linux/main.tf
index ccb934a8b6286..9afb876a3c753 100644
--- a/examples/templates/azure-linux/main.tf
+++ b/examples/templates/azure-linux/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "~> 0.7.0"
+      source = "coder/coder"
     }
     azurerm = {
-      source  = "hashicorp/azurerm"
-      version = "~>3.47.0"
+      source = "hashicorp/azurerm"
     }
   }
 }
diff --git a/examples/templates/azure-windows/main.tf b/examples/templates/azure-windows/main.tf
index 92f62c1f10726..e494b037f7348 100644
--- a/examples/templates/azure-windows/main.tf
+++ b/examples/templates/azure-windows/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "0.7.0"
+      source = "coder/coder"
     }
     azurerm = {
-      source  = "hashicorp/azurerm"
-      version = "=3.52.0"
+      source = "hashicorp/azurerm"
     }
   }
 }
diff --git a/examples/templates/community-templates.md b/examples/templates/community-templates.md
index 53b10dddcb0a0..b7bb876bdc44c 100644
--- a/examples/templates/community-templates.md
+++ b/examples/templates/community-templates.md
@@ -2,21 +2,35 @@
 
 This is a list of templates and actions created by the community.
 
-See [Getting Started](./README.md#getting-started) for how to use these templates.
+See [Getting Started](./README.md#getting-started) for how to use these
+templates.
 
 > If you have created a template, see one that's missing or one that's no longer
 > maintained, please submit a pull request to improve this list. Thank you!
 
 ## Templates
 
-- [ntimo/coder-hetzner-cloud-template](https://github.com/ntimo/coder-hetzner-cloud-template) - Setup a Hetzner Cloud instance as dev environment with or without vscode.
-- [matifali/coder-templates](https://github.com/matifali/coder-templates) - Deeplearning with Jupyter Notebook/Lab and Matlab in browser.
-- [m.lan/coder-templates](https://gitlab.com/m.lan/coder-templates) - Kubernetes template with DinD.
-- [jsjoeio/coder-templates](https://github.com/jsjoeio/coder-templates) - Docker templates that prompt for dotfiles and base Docker image.
-- [sharkymark/v2-templates](https://github.com/sharkymark/v2-templates) - Kubernetes, Docker, AWS, Google Cloud, Azure templates, videos, emoji links, and API examples.
-- [kozmiknano/vscode-server-template](https://github.com/KozmikNano/vscode-server-template) - Run the full VS Code server within docker! (Built-in settings sync and Microsoft Marketplace enabled)
-- [atnomoverflow/coder-template](https://github.com/atnomoverflow/coder-template) - Kubernetes template that install VS code server Rstudio jupyter and also set ssh access to gitlab (Works also on self managed gitlab).
+- [ntimo/coder-hetzner-cloud-template](https://github.com/ntimo/coder-hetzner-cloud-template) -
+  Setup a Hetzner Cloud instance as dev environment with or without vscode.
+- [matifali/coder-templates](https://github.com/matifali/coder-templates) -
+  Deeplearning with Jupyter Notebook/Lab and Matlab in browser.
+- [m.lan/coder-templates](https://gitlab.com/m.lan/coder-templates) - Kubernetes
+  template with DinD.
+- [jsjoeio/coder-templates](https://github.com/jsjoeio/coder-templates) - Docker
+  templates that prompt for dotfiles and base Docker image.
+- [sharkymark/v2-templates](https://github.com/sharkymark/v2-templates) -
+  Kubernetes, Docker, AWS, Google Cloud, Azure templates, videos, emoji links,
+  and API examples.
+- [bpmct/coder-templates](https://github.com/bpmct/coder-templates) -
+  Kubernetes, OpenStack, podman, Docker, VM, AWS, Google Cloud, Azure templates.
+- [kozmiknano/vscode-server-template](https://github.com/KozmikNano/vscode-server-template) -
+  Run the full VS Code server within docker! (Built-in settings sync and
+  Microsoft Marketplace enabled)
+- [atnomoverflow/coder-template](https://github.com/atnomoverflow/coder-template) -
+  Kubernetes template that install VS code server Rstudio jupyter and also set
+  ssh access to gitlab (Works also on self managed gitlab).
 
 ## Automation
 
-- [Update Coder Template](https://github.com/marketplace/actions/update-coder-template) - A GitHub action to automate coder template changes.
+- [Update Coder Template](https://github.com/marketplace/actions/update-coder-template) -
+  A GitHub action to automate coder template changes.
diff --git a/examples/templates/devcontainer-docker/main.tf b/examples/templates/devcontainer-docker/main.tf
index 8769ff1f07078..f69e03b58eda1 100644
--- a/examples/templates/devcontainer-docker/main.tf
+++ b/examples/templates/devcontainer-docker/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "0.11.0"
+      source = "coder/coder"
     }
     docker = {
-      source  = "kreuzwerker/docker"
-      version = "3.0.2"
+      source = "kreuzwerker/docker"
     }
   }
 }
@@ -206,7 +204,9 @@ data "coder_parameter" "custom_repo_url" {
 
 resource "docker_container" "workspace" {
   count = data.coder_workspace.me.start_count
-  image = "ghcr.io/coder/envbuilder:0.1.3"
+  # Find the latest version here:
+  # https://github.com/coder/envbuilder/tags
+  image = "ghcr.io/coder/envbuilder:0.2.1"
   # Uses lower() to avoid Docker restriction on container names.
   name = "coder-${data.coder_workspace.me.owner}-${lower(data.coder_workspace.me.name)}"
   # Hostname makes the shell more user friendly: coder@my-workspace:~$
diff --git a/examples/templates/devcontainer-kubernetes/main.tf b/examples/templates/devcontainer-kubernetes/main.tf
index 65694c25989a9..c61e26351e197 100644
--- a/examples/templates/devcontainer-kubernetes/main.tf
+++ b/examples/templates/devcontainer-kubernetes/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "0.11.0"
+      source = "coder/coder"
     }
     kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = "~> 2.3.2"
+      source = "hashicorp/kubernetes"
     }
   }
 }
@@ -179,6 +177,9 @@ resource "kubernetes_deployment" "workspace" {
         "coder.workspace_id" = data.coder_workspace.me.id
       }
     }
+    strategy {
+      type = "Recreate"
+    }
     template {
       metadata {
         labels = {
@@ -187,8 +188,10 @@ resource "kubernetes_deployment" "workspace" {
       }
       spec {
         container {
-          name  = "coder-${data.coder_workspace.me.owner}-${lower(data.coder_workspace.me.name)}"
-          image = "ghcr.io/coder/envbuilder:0.1.3"
+          name = "coder-${data.coder_workspace.me.owner}-${lower(data.coder_workspace.me.name)}"
+          # Find the latest version here:
+          # https://github.com/coder/envbuilder/tags
+          image = "ghcr.io/coder/envbuilder:0.2.1"
           env {
             name  = "CODER_AGENT_TOKEN"
             value = coder_agent.main.token
diff --git a/examples/templates/do-linux/main.tf b/examples/templates/do-linux/main.tf
index 3080c9228b368..22eed81bdb4e1 100644
--- a/examples/templates/do-linux/main.tf
+++ b/examples/templates/do-linux/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "~> 0.7.0"
+      source = "coder/coder"
     }
     digitalocean = {
-      source  = "digitalocean/digitalocean"
-      version = "~> 2.0"
+      source = "digitalocean/digitalocean"
     }
   }
 }
diff --git a/examples/templates/docker-with-dotfiles/main.tf b/examples/templates/docker-with-dotfiles/main.tf
index f5b2b92747644..956a4308b922a 100644
--- a/examples/templates/docker-with-dotfiles/main.tf
+++ b/examples/templates/docker-with-dotfiles/main.tf
@@ -8,12 +8,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "~> 0.7.0"
+      source = "coder/coder"
     }
     docker = {
-      source  = "kreuzwerker/docker"
-      version = "~> 3.0.1"
+      source = "kreuzwerker/docker"
     }
   }
 }
diff --git a/examples/templates/docker/main.tf b/examples/templates/docker/main.tf
index 7749cd983b835..48a5478fcdec2 100644
--- a/examples/templates/docker/main.tf
+++ b/examples/templates/docker/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "~> 0.8.3"
+      source = "coder/coder"
     }
     docker = {
-      source  = "kreuzwerker/docker"
-      version = "~> 3.0.1"
+      source = "kreuzwerker/docker"
     }
   }
 }
@@ -189,6 +187,7 @@ resource "docker_container" "workspace" {
     volume_name    = docker_volume.home_volume.name
     read_only      = false
   }
+
   # Add labels in Docker to keep track of orphan resources.
   labels {
     label = "coder.owner"
diff --git a/examples/templates/envbox/main.tf b/examples/templates/envbox/main.tf
index f5460c622b4eb..e452ac450794f 100644
--- a/examples/templates/envbox/main.tf
+++ b/examples/templates/envbox/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "0.6.12"
+      source = "coder/coder"
     }
     kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = "~> 2.12.1"
+      source = "hashicorp/kubernetes"
     }
   }
 }
diff --git a/examples/templates/fly-docker-image/README.md b/examples/templates/fly-docker-image/README.md
deleted file mode 100644
index df79210a2f6d4..0000000000000
--- a/examples/templates/fly-docker-image/README.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-name: Develop on a Fly.io container
-description: Run workspaces as Firecracker VMs on Fly.io
-tags: [docker, fly.io]
-icon: /icon/fly.io.svg
----
-
-# Coder Fly.io Template
-
-This template provisions a [code-server](https://github.com/coder/code-server) instance on [fly.io](https://fly.io) using the [codercom/code-server](https://hub.docker.com/r/codercom/code-server) image.
-
-## Prerequisites
-
-- [flyctl](https://fly.io/docs/getting-started/installing-flyctl/) installed.
-- [Coder](https://coder.com/) already setup and running with coder-cli installed locally.
-
-## Getting started
-
-1. Run `coder templates init` and select this template. Follow the instructions that appear.
-2. cd into the directory that was created. (e.g. `cd fly-docker-image`)
-3. Create the new template by running the following command from the `fly-docker-image` directory:
-
-```bash
-coder templates create fly-docker-image \
-  --var fly_api_token=$(flyctl auth token) \
-  --var fly_org=personal
-```
-
-> If the Coder server is also running as a fly.io app, then instead of setting variable `fly_api_token` you can also set a fly.io secret with the name `FLY_API_TOKEN`
->
-> ```bash
-> flyctl secrets set FLY_API_TOKEN=$(flyctl auth token) --app <your-coder-app-name>
-> ```
-
-> Read our blog [post](coder.com/blog/deploying-coder-on-fly-io) to learn more about how to deploy Coder on fly.io.
-
-4. Navigate to the Coder dashboard and create a new workspace using the template.
-
-This is all. You should now have a code-server instance running on fly.io.
diff --git a/examples/templates/fly-docker-image/main.tf b/examples/templates/fly-docker-image/main.tf
deleted file mode 100644
index abd84c0e7d9ea..0000000000000
--- a/examples/templates/fly-docker-image/main.tf
+++ /dev/null
@@ -1,349 +0,0 @@
-terraform {
-  required_providers {
-    fly = {
-      source  = "fly-apps/fly"
-      version = "~>0.0.23"
-    }
-    coder = {
-      source  = "coder/coder"
-      version = "~>0.7.0"
-    }
-  }
-}
-
-provider "fly" {
-  fly_api_token = var.fly_api_token == "" ? null : var.fly_api_token
-}
-
-provider "coder" {
-}
-
-resource "fly_app" "workspace" {
-  name = "coder-${data.coder_workspace.me.owner}-${lower(data.coder_workspace.me.name)}"
-  org  = var.fly_org
-}
-
-resource "fly_volume" "home-volume" {
-  app    = fly_app.workspace.name
-  name   = "coder_${data.coder_workspace.me.owner}_${lower(replace(data.coder_workspace.me.name, "-", "_"))}_home"
-  size   = data.coder_parameter.volume-size.value
-  region = data.coder_parameter.region.value
-}
-
-resource "fly_machine" "workspace" {
-  count    = data.coder_workspace.me.start_count
-  app      = fly_app.workspace.name
-  region   = data.coder_parameter.region.value
-  name     = data.coder_workspace.me.name
-  image    = data.coder_parameter.docker-image.value
-  cpus     = data.coder_parameter.cpu.value
-  cputype  = data.coder_parameter.cputype.value
-  memorymb = data.coder_parameter.memory.value * 1024
-  env = {
-    CODER_AGENT_TOKEN = "${coder_agent.main.token}"
-  }
-  entrypoint = ["sh", "-c", coder_agent.main.init_script]
-  services = [
-    {
-      ports = [
-        {
-          port     = 443
-          handlers = ["tls", "http"]
-        },
-        {
-          port     = 80
-          handlers = ["http"]
-        }
-
-      ]
-      protocol        = "tcp",
-      "internal_port" = 80
-    },
-    {
-      ports = [
-        {
-          port     = 8080
-          handlers = ["tls", "http"]
-        }
-      ]
-      protocol        = "tcp",
-      "internal_port" = 8080
-    }
-  ]
-  mounts = [
-    {
-      volume = fly_volume.home-volume.id
-      path   = "/home/coder"
-    }
-  ]
-}
-
-variable "fly_api_token" {
-  type        = string
-  description = <<-EOF
-The Fly.io API token to use for deploying the workspace. You can generate one by running:
-
-$ flyctl auth token
-EOF
-  sensitive   = true
-}
-
-variable "fly_org" {
-  type        = string
-  description = <<-EOF
-The Fly.io organization slug to deploy the workspace in. List organizations by running:
-
-$ flyctl orgs list
-EOF
-}
-
-data "coder_parameter" "docker-image" {
-  name         = "docker-image"
-  display_name = "Docker image"
-  description  = "The docker image to use for the workspace"
-  default      = "codercom/code-server:latest"
-  icon         = "https://raw.githubusercontent.com/matifali/logos/main/docker.svg"
-}
-
-data "coder_parameter" "cpu" {
-  name         = "cpu"
-  display_name = "CPU"
-  description  = "The number of CPUs to allocate to the workspace (1-8)"
-  type         = "number"
-  default      = "1"
-  icon         = "https://raw.githubusercontent.com/matifali/logos/main/cpu-3.svg"
-  mutable      = true
-  validation {
-    min = 1
-    max = 8
-  }
-}
-
-data "coder_parameter" "cputype" {
-  name         = "cputype"
-  display_name = "CPU type"
-  description  = "Which CPU type do you want?"
-  default      = "shared"
-  icon         = "https://raw.githubusercontent.com/matifali/logos/main/cpu-1.svg"
-  mutable      = true
-  option {
-    name  = "Shared"
-    value = "shared"
-  }
-  option {
-    name  = "Performance"
-    value = "performance"
-  }
-}
-
-data "coder_parameter" "memory" {
-  name         = "memory"
-  display_name = "Memory"
-  description  = "The amount of memory to allocate to the workspace in GB (up to 16GB)"
-  type         = "number"
-  default      = "2"
-  icon         = "/icon/memory.svg"
-  mutable      = true
-  validation {
-    min = data.coder_parameter.cputype.value == "performance" ? 2 : 1 # if the CPU type is performance, the minimum memory is 2GB
-    max = 16
-  }
-}
-
-data "coder_parameter" "volume-size" {
-  name         = "volume-size"
-  display_name = "Home volume size"
-  description  = "The size of the volume to create for the workspace in GB (1-20)"
-  type         = "number"
-  default      = "1"
-  icon         = "https://raw.githubusercontent.com/matifali/logos/main/database.svg"
-  validation {
-    min = 1
-    max = 20
-  }
-}
-
-# You can see all available regions here: https://fly.io/docs/reference/regions/
-data "coder_parameter" "region" {
-  name         = "region"
-  display_name = "Region"
-  description  = "The region to deploy the workspace in"
-  default      = "ams"
-  icon         = "/emojis/1f30e.png"
-  option {
-    name  = "Amsterdam, Netherlands"
-    value = "ams"
-    icon  = "/emojis/1f1f3-1f1f1.png"
-  }
-  option {
-    name  = "Frankfurt, Germany"
-    value = "fra"
-    icon  = "/emojis/1f1e9-1f1ea.png"
-  }
-  option {
-    name  = "Paris, France"
-    value = "cdg"
-    icon  = "/emojis/1f1eb-1f1f7.png"
-  }
-  option {
-    name  = "Denver, Colorado (US)"
-    value = "den"
-    icon  = "/emojis/1f1fa-1f1f8.png"
-  }
-  option {
-    name  = "Dallas, Texas (US)"
-    value = "dfw"
-    icon  = "/emojis/1f1fa-1f1f8.png"
-  }
-  option {
-    name  = "Hong Kong"
-    value = "hkg"
-    icon  = "/emojis/1f1ed-1f1f0.png"
-  }
-  option {
-    name  = "Los Angeles, California (US)"
-    value = "lax"
-    icon  = "/emojis/1f1fa-1f1f8.png"
-  }
-  option {
-    name  = "London, United Kingdom"
-    value = "lhr"
-    icon  = "/emojis/1f1ec-1f1e7.png"
-  }
-  option {
-    name  = "Chennai, India"
-    value = "maa"
-    icon  = "/emojis/1f1ee-1f1f3.png"
-  }
-  option {
-    name  = "Tokyo, Japan"
-    value = "nrt"
-    icon  = "/emojis/1f1ef-1f1f5.png"
-  }
-  option {
-    name  = "Chicago, Illinois (US)"
-    value = "ord"
-    icon  = "/emojis/1f1fa-1f1f8.png"
-  }
-  option {
-    name  = "Seattle, Washington (US)"
-    value = "sea"
-    icon  = "/emojis/1f1fa-1f1f8.png"
-  }
-  option {
-    name  = "Singapore"
-    value = "sin"
-    icon  = "/emojis/1f1f8-1f1ec.png"
-  }
-  option {
-    name  = "Sydney, Australia"
-    value = "syd"
-    icon  = "/emojis/1f1e6-1f1fa.png"
-  }
-  option {
-    name  = "Toronto, Canada"
-    value = "yyz"
-    icon  = "/emojis/1f1e8-1f1e6.png"
-  }
-}
-
-resource "coder_app" "code-server" {
-  count        = 1
-  agent_id     = coder_agent.main.id
-  display_name = "code-server"
-  slug         = "code-server"
-  url          = "http://localhost:8080?folder=/home/coder/"
-  icon         = "/icon/code.svg"
-  subdomain    = false
-  share        = "owner"
-
-  healthcheck {
-    url       = "http://localhost:8080/healthz"
-    interval  = 3
-    threshold = 10
-  }
-}
-
-resource "coder_agent" "main" {
-  arch                   = data.coder_provisioner.me.arch
-  os                     = "linux"
-  startup_script_timeout = 180
-  startup_script         = <<-EOT
-    set -e
-    # Start code-server
-    code-server --auth none >/tmp/code-server.log 2>&1 &
-    # Set the hostname to the workspace name
-    sudo hostname -b "${data.coder_workspace.me.name}-fly"
-    echo "127.0.0.1  ${data.coder_workspace.me.name}-fly" | sudo tee -a /etc/hosts
-    # Install the Fly CLI and add it to the PATH
-    curl -L https://fly.io/install.sh | sh
-    echo "export PATH=$PATH:/home/coder/.fly/bin" >> /home/coder/.bashrc
-    source /home/coder/.bashrc
-  EOT
-
-  metadata {
-    key          = "cpu"
-    display_name = "CPU Usage"
-    interval     = 5
-    timeout      = 5
-    script       = <<-EOT
-      #!/bin/bash
-      set -e
-      top -bn1 | grep "Cpu(s)" | awk '{print $2 + $4 "%"}'
-    EOT
-  }
-  metadata {
-    key          = "memory"
-    display_name = "Memory Usage"
-    interval     = 5
-    timeout      = 5
-    script       = <<-EOT
-      #!/bin/bash
-      set -e
-      free -m | awk 'NR==2{printf "%.2f%%\t", $3*100/$2 }'
-    EOT
-  }
-  metadata {
-    key          = "disk"
-    display_name = "Disk Usage"
-    interval     = 600 # every 10 minutes
-    timeout      = 30  # df can take a while on large filesystems
-    script       = <<-EOT
-      #!/bin/bash
-      set -e
-      df | awk '$NF=="/home/coder" {printf "%s", $5}'
-    EOT
-  }
-}
-
-resource "coder_metadata" "workspace" {
-  count       = data.coder_workspace.me.start_count
-  resource_id = fly_app.workspace.id
-  icon        = data.coder_parameter.region.option[index(data.coder_parameter.region.option.*.value, data.coder_parameter.region.value)].icon
-  item {
-    key   = "Region"
-    value = data.coder_parameter.region.option[index(data.coder_parameter.region.option.*.value, data.coder_parameter.region.value)].name
-  }
-  item {
-    key   = "CPU Type"
-    value = data.coder_parameter.cputype.option[index(data.coder_parameter.cputype.option.*.value, data.coder_parameter.cputype.value)].name
-  }
-  item {
-    key   = "CPU Count"
-    value = data.coder_parameter.cpu.value
-  }
-  item {
-    key   = "Memory (GB)"
-    value = data.coder_parameter.memory.value
-  }
-  item {
-    key   = "Volume Size (GB)"
-    value = data.coder_parameter.volume-size.value
-  }
-}
-
-data "coder_provisioner" "me" {
-}
-
-data "coder_workspace" "me" {
-}
diff --git a/examples/templates/gcp-linux/main.tf b/examples/templates/gcp-linux/main.tf
index e4bba1bcbe58f..29c64393e5d2e 100644
--- a/examples/templates/gcp-linux/main.tf
+++ b/examples/templates/gcp-linux/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "~> 0.7.0"
+      source = "coder/coder"
     }
     google = {
-      source  = "hashicorp/google"
-      version = "~> 4.34.0"
+      source = "hashicorp/google"
     }
   }
 }
diff --git a/examples/templates/gcp-vm-container/main.tf b/examples/templates/gcp-vm-container/main.tf
index 45a76c63a4431..ba203e0270280 100644
--- a/examples/templates/gcp-vm-container/main.tf
+++ b/examples/templates/gcp-vm-container/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "~> 0.7.0"
+      source = "coder/coder"
     }
     google = {
-      source  = "hashicorp/google"
-      version = "~> 4.34.0"
+      source = "hashicorp/google"
     }
   }
 }
diff --git a/examples/templates/gcp-windows/main.tf b/examples/templates/gcp-windows/main.tf
index 16148ef407e1a..ea9032eaf3772 100644
--- a/examples/templates/gcp-windows/main.tf
+++ b/examples/templates/gcp-windows/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "~> 0.7.0"
+      source = "coder/coder"
     }
     google = {
-      source  = "hashicorp/google"
-      version = "~> 4.34.0"
+      source = "hashicorp/google"
     }
   }
 }
diff --git a/examples/templates/jfrog-docker/README.md b/examples/templates/jfrog-docker/README.md
deleted file mode 100644
index ac1a3a128643f..0000000000000
--- a/examples/templates/jfrog-docker/README.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-name: JFrog and Docker
-description: Develop inside Docker containers using your local daemon
-tags: [local, docker, jfrog]
-icon: /icon/docker.png
----
-
-# jfrog-docker
-
-To get started, run `coder templates init`. When prompted, select this template.
-Follow the on-screen instructions to proceed.
-
-## Editing the image
-
-Edit the `Dockerfile` and run `coder templates push` to update workspaces.
-
-## code-server
-
-`code-server` is installed via the `startup_script` argument in the `coder_agent`
-resource block. The `coder_app` resource is defined to access `code-server` through
-the dashboard UI over `localhost:13337`.
-
-# Next steps
-
-Check out our [Docker](../docker/) template for a more fully featured Docker
-example.
diff --git a/examples/templates/jfrog-docker/build/Dockerfile b/examples/templates/jfrog-docker/build/Dockerfile
deleted file mode 100644
index 1dfaa77015f32..0000000000000
--- a/examples/templates/jfrog-docker/build/Dockerfile
+++ /dev/null
@@ -1,21 +0,0 @@
-FROM ubuntu
-
-RUN apt-get update \
-	&& apt-get install -y \
-	curl \
-	git \
-	golang \
-	sudo \
-	vim \
-	wget \
-	npm \
-	&& rm -rf /var/lib/apt/lists/*
-
-ARG USER=coder
-RUN useradd --groups sudo --no-create-home --shell /bin/bash ${USER} \
-	&& echo "${USER} ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/${USER} \
-	&& chmod 0440 /etc/sudoers.d/${USER}
-RUN curl -fL https://install-cli.jfrog.io | sh
-RUN chmod 755 $(which jf)
-USER ${USER}
-WORKDIR /home/${USER}
diff --git a/examples/templates/jfrog-docker/main.tf b/examples/templates/jfrog-docker/main.tf
deleted file mode 100644
index 0c409d5ebe54b..0000000000000
--- a/examples/templates/jfrog-docker/main.tf
+++ /dev/null
@@ -1,137 +0,0 @@
-terraform {
-  required_providers {
-    coder = {
-      source  = "coder/coder"
-      version = "~> 0.11.1"
-    }
-    docker = {
-      source  = "kreuzwerker/docker"
-      version = "~> 3.0.1"
-    }
-    artifactory = {
-      source  = "registry.terraform.io/jfrog/artifactory"
-      version = "6.22.3"
-    }
-  }
-}
-
-locals {
-  username = data.coder_workspace.me.owner
-}
-
-data "coder_provisioner" "me" {
-}
-
-provider "docker" {
-}
-
-data "coder_workspace" "me" {
-}
-
-variable "jfrog_url" {
-  type        = string
-  description = "The URL of the JFrog instance."
-}
-
-variable "artifactory_access_token" {
-  type        = string
-  description = "The admin-level access token to use for JFrog."
-}
-
-
-# Configure the Artifactory provider
-provider "artifactory" {
-  url          = "${var.jfrog_url}/artifactory"
-  access_token = var.artifactory_access_token
-}
-
-resource "artifactory_access_token" "me" {
-  username = data.coder_workspace.me.owner_email
-  # The token should live for the duration of the workspace.
-  end_date_relative = "0s"
-}
-
-resource "coder_agent" "main" {
-  arch                   = data.coder_provisioner.me.arch
-  os                     = "linux"
-  startup_script_timeout = 180
-  startup_script         = <<-EOT
-    set -e
-
-    # install and start code-server
-    curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server --version 4.11.0
-    /tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &
-
-    # The jf CLI checks $CI when determining whether to use interactive
-    # flows.
-    export CI=true
-
-    jf c rm 0 || true
-    echo ${artifactory_access_token.me.access_token} | \
-      jf c add --access-token-stdin --url ${var.jfrog_url} 0
-
-    # Configure the `npm` CLI to use the Artifactory "npm" registry.
-    cat << EOF > ~/.npmrc
-    email = ${data.coder_workspace.me.owner_email}
-    registry=${var.jfrog_url}/artifactory/api/npm/npm/
-    EOF
-    jf rt curl /api/npm/auth >> .npmrc
-  EOT
-}
-
-resource "coder_app" "code-server" {
-  agent_id     = coder_agent.main.id
-  slug         = "code-server"
-  display_name = "code-server"
-  url          = "http://localhost:13337/?folder=/home/${local.username}"
-  icon         = "/icon/code.svg"
-  subdomain    = false
-  share        = "owner"
-
-  healthcheck {
-    url       = "http://localhost:13337/healthz"
-    interval  = 5
-    threshold = 6
-  }
-}
-
-resource "docker_volume" "home_volume" {
-  name = "coder-${data.coder_workspace.me.id}-home"
-  # Protect the volume from being deleted due to changes in attributes.
-  lifecycle {
-    ignore_changes = all
-  }
-}
-
-resource "docker_image" "main" {
-  name = "coder-${data.coder_workspace.me.id}"
-  build {
-    context = "./build"
-    build_args = {
-      USER = local.username
-    }
-  }
-  triggers = {
-    dir_sha1 = sha1(join("", [for f in fileset(path.module, "build/*") : filesha1(f)]))
-  }
-}
-
-resource "docker_container" "workspace" {
-  count = data.coder_workspace.me.start_count
-  image = docker_image.main.name
-  # Uses lower() to avoid Docker restriction on container names.
-  name = "coder-${data.coder_workspace.me.owner}-${lower(data.coder_workspace.me.name)}"
-  # Hostname makes the shell more user friendly: coder@my-workspace:~$
-  hostname   = data.coder_workspace.me.name
-  entrypoint = ["sh", "-c", coder_agent.main.init_script]
-  env        = ["CODER_AGENT_TOKEN=${coder_agent.main.token}"]
-  host {
-    host = "host.docker.internal"
-    ip   = "host-gateway"
-  }
-  volumes {
-    container_path = "/home/${local.username}"
-    volume_name    = docker_volume.home_volume.name
-    read_only      = false
-  }
-}
diff --git a/examples/templates/jfrog/docker/README.md b/examples/templates/jfrog/docker/README.md
new file mode 100644
index 0000000000000..4db4676e8a43d
--- /dev/null
+++ b/examples/templates/jfrog/docker/README.md
@@ -0,0 +1,26 @@
+---
+name: JFrog and Docker
+description: Develop inside Docker containers using your local daemon
+tags: [local, docker, jfrog]
+icon: /icon/docker.png
+---
+
+# docker
+
+To get started, run `coder templates init`. When prompted, select this template.
+Follow the on-screen instructions to proceed.
+
+## Editing the image
+
+Edit the `Dockerfile` and run `coder templates push` to update workspaces.
+
+## code-server
+
+`code-server` is installed via the `startup_script` argument in the `coder_agent`
+resource block. The `coder_app` resource is defined to access `code-server` through
+the dashboard UI over `localhost:13337`.
+
+# Next steps
+
+Check out our [Docker](../docker/) template for a more fully featured Docker
+example.
diff --git a/examples/templates/jfrog/docker/build/Dockerfile b/examples/templates/jfrog/docker/build/Dockerfile
new file mode 100644
index 0000000000000..ff627a010a464
--- /dev/null
+++ b/examples/templates/jfrog/docker/build/Dockerfile
@@ -0,0 +1,28 @@
+FROM ubuntu
+
+RUN apt-get update \
+	&& apt-get install -y \
+	curl \
+	git \
+	python3-pip \
+	sudo \
+	vim \
+	wget \
+	npm \
+	&& rm -rf /var/lib/apt/lists/*
+
+ARG GO_VERSION=1.20.8
+RUN mkdir --parents /usr/local/go && curl --silent --show-error --location \
+	"https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" -o /usr/local/go.tar.gz && \
+	tar --extract --gzip --directory=/usr/local/go --file=/usr/local/go.tar.gz --strip-components=1
+
+ENV PATH=$PATH:/usr/local/go/bin
+
+ARG USER=coder
+RUN useradd --groups sudo --no-create-home --shell /bin/bash ${USER} \
+	&& echo "${USER} ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/${USER} \
+	&& chmod 0440 /etc/sudoers.d/${USER}
+RUN curl -fL https://install-cli.jfrog.io | sh
+RUN chmod 755 $(which jf)
+USER ${USER}
+WORKDIR /home/${USER}
diff --git a/examples/templates/jfrog/docker/main.tf b/examples/templates/jfrog/docker/main.tf
new file mode 100644
index 0000000000000..54b952b2fd30b
--- /dev/null
+++ b/examples/templates/jfrog/docker/main.tf
@@ -0,0 +1,166 @@
+terraform {
+  required_providers {
+    coder = {
+      source = "coder/coder"
+    }
+    docker = {
+      source = "kreuzwerker/docker"
+    }
+    artifactory = {
+      source = "registry.terraform.io/jfrog/artifactory"
+    }
+  }
+}
+
+locals {
+  # take care to use owner_email instead of owner because users can change
+  # their username.
+  artifactory_username = data.coder_workspace.me.owner_email
+  artifactory_repository_keys = {
+    "npm"    = "npm"
+    "python" = "python"
+    "go"     = "go"
+  }
+  workspace_user = data.coder_workspace.me.owner
+}
+
+data "coder_provisioner" "me" {
+}
+
+provider "docker" {
+}
+
+data "coder_workspace" "me" {
+}
+
+variable "jfrog_host" {
+  type        = string
+  description = "JFrog instance hostname. For example, 'YYY.jfrog.io'."
+}
+
+variable "artifactory_access_token" {
+  type        = string
+  description = "The admin-level access token to use for JFrog."
+}
+
+# Configure the Artifactory provider
+provider "artifactory" {
+  url          = "https://${var.jfrog_host}/artifactory"
+  access_token = var.artifactory_access_token
+}
+
+resource "artifactory_scoped_token" "me" {
+  # This is hacky, but on terraform plan the data source gives empty strings,
+  # which fails validation.
+  username = length(local.artifactory_username) > 0 ? local.artifactory_username : "plan"
+}
+
+resource "coder_agent" "main" {
+  arch                   = data.coder_provisioner.me.arch
+  os                     = "linux"
+  startup_script_timeout = 180
+  startup_script         = <<-EOT
+    set -e
+
+    # install and start code-server
+    curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server --version 4.11.0
+    /tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &
+
+    # Install the JFrog VS Code extension.
+    # Find the latest version number at
+    # https://open-vsx.org/extension/JFrog/jfrog-vscode-extension.
+    JFROG_EXT_VERSION=2.4.1
+    curl -o /tmp/jfrog.vsix -L "https://open-vsx.org/api/JFrog/jfrog-vscode-extension/$JFROG_EXT_VERSION/file/JFrog.jfrog-vscode-extension-$JFROG_EXT_VERSION.vsix"
+    /tmp/code-server/bin/code-server --install-extension /tmp/jfrog.vsix
+
+    # The jf CLI checks $CI when determining whether to use interactive
+    # flows.
+    export CI=true
+
+    jf c rm 0 || true
+    echo ${artifactory_scoped_token.me.access_token} | \
+      jf c add --access-token-stdin --url https://${var.jfrog_host} 0
+
+    # Configure the `npm` CLI to use the Artifactory "npm" repository.
+    cat << EOF > ~/.npmrc
+    email = ${data.coder_workspace.me.owner_email}
+    registry = https://${var.jfrog_host}/artifactory/api/npm/${local.artifactory_repository_keys["npm"]}
+    EOF
+    jf rt curl /api/npm/auth >> .npmrc
+
+    # Configure the `pip` to use the Artifactory "python" repository.
+    mkdir -p ~/.pip
+    cat << EOF > ~/.pip/pip.conf
+    [global]
+    index-url = https://${local.artifactory_username}:${artifactory_scoped_token.me.access_token}@${var.jfrog_host}/artifactory/api/pypi/${local.artifactory_repository_keys["python"]}/simple
+    EOF
+
+  EOT
+  # Set GOPROXY to use the Artifactory "go" repository.
+  env = {
+    GOPROXY : "https://${local.artifactory_username}:${artifactory_scoped_token.me.access_token}@${var.jfrog_host}/artifactory/api/go/${local.artifactory_repository_keys["go"]}"
+    # Authenticate with JFrog extension.
+    JFROG_IDE_URL : "https://${var.jfrog_host}"
+    JFROG_IDE_USERNAME : "${local.artifactory_username}"
+    JFROG_IDE_PASSWORD : "${artifactory_scoped_token.me.access_token}"
+    JFROG_IDE_ACCESS_TOKEN : "${artifactory_scoped_token.me.access_token}"
+    JFROG_IDE_STORE_CONNECTION : "true"
+  }
+}
+
+resource "coder_app" "code-server" {
+  agent_id     = coder_agent.main.id
+  slug         = "code-server"
+  display_name = "code-server"
+  url          = "http://localhost:13337/?folder=/home/${local.workspace_user}"
+  icon         = "/icon/code.svg"
+  subdomain    = false
+  share        = "owner"
+
+  healthcheck {
+    url       = "http://localhost:13337/healthz"
+    interval  = 5
+    threshold = 6
+  }
+}
+
+resource "docker_volume" "home_volume" {
+  name = "coder-${data.coder_workspace.me.id}-home"
+  # Protect the volume from being deleted due to changes in attributes.
+  lifecycle {
+    ignore_changes = all
+  }
+}
+
+resource "docker_image" "main" {
+  name = "coder-${data.coder_workspace.me.id}"
+  build {
+    context = "${path.module}/build"
+    build_args = {
+      USER = local.workspace_user
+    }
+  }
+  triggers = {
+    dir_sha1 = sha1(join("", [for f in fileset(path.module, "build/*") : filesha1("${path.module}/${f}")]))
+  }
+}
+
+resource "docker_container" "workspace" {
+  count = data.coder_workspace.me.start_count
+  image = docker_image.main.name
+  # Uses lower() to avoid Docker restriction on container names.
+  name = "coder-${data.coder_workspace.me.owner}-${lower(data.coder_workspace.me.name)}"
+  # Hostname makes the shell more user friendly: coder@my-workspace:~$
+  hostname   = data.coder_workspace.me.name
+  entrypoint = ["sh", "-c", coder_agent.main.init_script]
+  env        = ["CODER_AGENT_TOKEN=${coder_agent.main.token}"]
+  host {
+    host = "host.docker.internal"
+    ip   = "host-gateway"
+  }
+  volumes {
+    container_path = "/home/${local.workspace_user}"
+    volume_name    = docker_volume.home_volume.name
+    read_only      = false
+  }
+}
diff --git a/examples/templates/jfrog/remote/main.tf b/examples/templates/jfrog/remote/main.tf
new file mode 100644
index 0000000000000..77fd75ed55b56
--- /dev/null
+++ b/examples/templates/jfrog/remote/main.tf
@@ -0,0 +1,16 @@
+module "docker" {
+  source                   = "cdr.jfrog.io/tf__main/docker/docker"
+  jfrog_host               = var.jfrog_host
+  artifactory_access_token = var.artifactory_access_token
+}
+
+variable "jfrog_host" {
+  type        = string
+  description = "JFrog instance hostname. For example, 'YYY.jfrog.io'."
+}
+
+variable "artifactory_access_token" {
+  type        = string
+  description = "The admin-level access token to use for JFrog."
+}
+
diff --git a/examples/templates/kubernetes-with-podman/main.tf b/examples/templates/kubernetes-with-podman/main.tf
index e0d76492df65f..2a041c1e8d9e8 100644
--- a/examples/templates/kubernetes-with-podman/main.tf
+++ b/examples/templates/kubernetes-with-podman/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "~> 0.7.0"
+      source = "coder/coder"
     }
     kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = "~> 2.18"
+      source = "hashicorp/kubernetes"
     }
   }
 }
diff --git a/examples/templates/kubernetes/README.md b/examples/templates/kubernetes/README.md
index 01721b5caf215..28bb1135d4146 100644
--- a/examples/templates/kubernetes/README.md
+++ b/examples/templates/kubernetes/README.md
@@ -7,7 +7,7 @@ icon: /icon/k8s.png
 
 # Getting started
 
-This template creates a deplyment running the `codercom/enterprise-base:ubuntu` image.
+This template creates a deployment running the `codercom/enterprise-base:ubuntu` image.
 
 ## Prerequisites
 
diff --git a/examples/templates/kubernetes/main.tf b/examples/templates/kubernetes/main.tf
index 7eef83dd45ae7..b8ed0c3d78d74 100644
--- a/examples/templates/kubernetes/main.tf
+++ b/examples/templates/kubernetes/main.tf
@@ -1,12 +1,10 @@
 terraform {
   required_providers {
     coder = {
-      source  = "coder/coder"
-      version = "~> 0.11.0"
+      source = "coder/coder"
     }
     kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = "~> 2.22"
+      source = "hashicorp/kubernetes"
     }
   }
 }
@@ -252,6 +250,9 @@ resource "kubernetes_deployment" "main" {
         "app.kubernetes.io/name" = "coder-workspace"
       }
     }
+    strategy {
+      type = "Recreate"
+    }
 
     template {
       metadata {
diff --git a/examples/templates/nomad-docker/README.md b/examples/templates/nomad-docker/README.md
new file mode 100644
index 0000000000000..f676ed3aac14f
--- /dev/null
+++ b/examples/templates/nomad-docker/README.md
@@ -0,0 +1,96 @@
+---
+name: Develop in a Nomad Docker Container
+description: Get started with Nomad Workspaces.
+tags: [cloud, nomad]
+icon: /icon/nomad.svg
+---
+
+# Develop in a Nomad Docker Container
+
+This example shows how to use Nomad service tasks to be used as a development environment using docker and host csi volumes.
+
+## Prerequisites
+
+- [Nomad](https://www.nomadproject.io/downloads)
+- [Docker](https://docs.docker.com/get-docker/)
+
+## Setup
+
+### 1. Start the CSI Host Volume Plugin
+
+The CSI Host Volume plugin is used to mount host volumes into Nomad tasks. This is useful for development environments where you want to mount persistent volumes into your container workspace.
+
+1. Login to the Nomad server using SSH.
+
+2. Append the following stanza to your Nomad server configuration file and restart the nomad service.
+
+   ```hcl
+   plugin "docker" {
+     config {
+       allow_privileged = true
+     }
+   }
+   ```
+
+   ```shell
+   sudo systemctl restart nomad
+   ```
+
+3. Create a file `hostpath.nomad` with following content:
+
+   ```hcl
+   job "hostpath-csi-plugin" {
+     datacenters = ["dc1"]
+     type = "system"
+
+     group "csi" {
+       task "plugin" {
+         driver = "docker"
+
+         config {
+           image = "registry.k8s.io/sig-storage/hostpathplugin:v1.10.0"
+
+           args = [
+             "--drivername=csi-hostpath",
+             "--v=5",
+             "--endpoint=${CSI_ENDPOINT}",
+             "--nodeid=node-${NOMAD_ALLOC_INDEX}",
+           ]
+
+           privileged = true
+         }
+
+         csi_plugin {
+           id   = "hostpath"
+           type = "monolith"
+           mount_dir = "/csi"
+         }
+
+         resources {
+           cpu    = 256
+           memory = 128
+         }
+       }
+     }
+   }
+   ```
+
+4. Run the job:
+
+   ```shell
+   nomad job run hostpath.nomad
+   ```
+
+### 2. Setup the Nomad Template
+
+1. Create the template by running the following command:
+
+   ```shell
+   coder template init nomad-docker
+   cd nomad-docker
+   coder template create
+   ```
+
+2. Set up Nomad server address and optional authentication:
+
+3. Create a new workspace and start developing.
diff --git a/examples/templates/nomad-docker/main.tf b/examples/templates/nomad-docker/main.tf
new file mode 100644
index 0000000000000..26a9e2f09fe9f
--- /dev/null
+++ b/examples/templates/nomad-docker/main.tf
@@ -0,0 +1,192 @@
+terraform {
+  required_providers {
+    coder = {
+      source = "coder/coder"
+    }
+    nomad = {
+      source = "hashicorp/nomad"
+    }
+  }
+}
+
+variable "nomad_provider_address" {
+  type        = string
+  description = "Nomad provider address. e.g., http://IP:PORT"
+  default     = "http://localhost:4646"
+}
+
+variable "nomad_provider_http_auth" {
+  type        = string
+  description = "Nomad provider http_auth in the form of `user:password`"
+  sensitive   = true
+  default     = ""
+}
+
+provider "coder" {}
+
+provider "nomad" {
+  address   = var.nomad_provider_address
+  http_auth = var.nomad_provider_http_auth == "" ? null : var.nomad_provider_http_auth
+}
+
+data "coder_parameter" "cpu" {
+  name         = "cpu"
+  display_name = "CPU"
+  description  = "The number of CPU cores"
+  default      = "1"
+  icon         = "/icon/memory.svg"
+  mutable      = true
+  option {
+    name  = "1 Cores"
+    value = "1"
+  }
+  option {
+    name  = "2 Cores"
+    value = "2"
+  }
+  option {
+    name  = "3 Cores"
+    value = "3"
+  }
+  option {
+    name  = "4 Cores"
+    value = "4"
+  }
+}
+
+data "coder_parameter" "memory" {
+  name         = "memory"
+  display_name = "Memory"
+  description  = "The amount of memory in GB"
+  default      = "2"
+  icon         = "/icon/memory.svg"
+  mutable      = true
+  option {
+    name  = "2 GB"
+    value = "2"
+  }
+  option {
+    name  = "4 GB"
+    value = "4"
+  }
+  option {
+    name  = "6 GB"
+    value = "6"
+  }
+  option {
+    name  = "8 GB"
+    value = "8"
+  }
+}
+
+data "coder_workspace" "me" {}
+
+resource "coder_agent" "main" {
+  os                     = "linux"
+  arch                   = "amd64"
+  startup_script_timeout = 180
+  startup_script         = <<-EOT
+    set -e
+    # install and start code-server
+    curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server
+    /tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &
+  EOT
+
+  metadata {
+    display_name = "Load Average (Host)"
+    key          = "load_host"
+    # get load avg scaled by number of cores
+    script   = <<EOT
+      echo "`cat /proc/loadavg | awk '{ print $1 }'` `nproc`" | awk '{ printf "%0.2f", $1/$2 }'
+    EOT
+    interval = 60
+    timeout  = 1
+  }
+}
+
+# code-server
+resource "coder_app" "code-server" {
+  agent_id     = coder_agent.main.id
+  slug         = "code-server"
+  display_name = "code-server"
+  icon         = "/icon/code.svg"
+  url          = "http://localhost:13337?folder=/home/coder"
+  subdomain    = false
+  share        = "owner"
+
+  healthcheck {
+    url       = "http://localhost:13337/healthz"
+    interval  = 3
+    threshold = 10
+  }
+}
+
+locals {
+  workspace_tag    = "coder-${data.coder_workspace.me.owner}-${data.coder_workspace.me.name}"
+  home_volume_name = "coder_${data.coder_workspace.me.id}_home"
+}
+
+resource "nomad_namespace" "coder_workspace" {
+  name        = local.workspace_tag
+  description = "Coder workspace"
+  meta = {
+    owner = data.coder_workspace.me.owner
+  }
+}
+
+data "nomad_plugin" "hostpath" {
+  plugin_id        = "hostpath"
+  wait_for_healthy = true
+}
+
+resource "nomad_csi_volume" "home_volume" {
+  depends_on = [data.nomad_plugin.hostpath]
+
+  lifecycle {
+    ignore_changes = all
+  }
+  plugin_id = "hostpath"
+  volume_id = local.home_volume_name
+  name      = local.home_volume_name
+  namespace = nomad_namespace.coder_workspace.name
+
+  capability {
+    access_mode     = "single-node-writer"
+    attachment_mode = "file-system"
+  }
+
+  mount_options {
+    fs_type = "ext4"
+  }
+}
+
+resource "nomad_job" "workspace" {
+  count      = data.coder_workspace.me.start_count
+  depends_on = [nomad_csi_volume.home_volume]
+  jobspec = templatefile("${path.module}/workspace.nomad.tpl", {
+    coder_workspace_owner = data.coder_workspace.me.owner
+    coder_workspace_name  = data.coder_workspace.me.name
+    workspace_tag         = local.workspace_tag
+    cores                 = tonumber(data.coder_parameter.cpu.value)
+    memory_mb             = tonumber(data.coder_parameter.memory.value * 1024)
+    coder_init_script     = coder_agent.main.init_script
+    coder_agent_token     = coder_agent.main.token
+    workspace_name        = data.coder_workspace.me.name
+    home_volume_name      = local.home_volume_name
+  })
+  deregister_on_destroy = true
+  purge_on_destroy      = true
+}
+
+resource "coder_metadata" "workspace_info" {
+  count       = data.coder_workspace.me.start_count
+  resource_id = nomad_job.workspace[0].id
+  item {
+    key   = "CPU (Cores)"
+    value = data.coder_parameter.cpu.value
+  }
+  item {
+    key   = "Memory (GiB)"
+    value = data.coder_parameter.memory.value
+  }
+}
diff --git a/examples/templates/nomad-docker/workspace.nomad.tpl b/examples/templates/nomad-docker/workspace.nomad.tpl
new file mode 100644
index 0000000000000..803d8327d892a
--- /dev/null
+++ b/examples/templates/nomad-docker/workspace.nomad.tpl
@@ -0,0 +1,53 @@
+job "workspace" {
+  datacenters = ["dc1"]
+  namespace = "${workspace_tag}"
+  type = "service"
+  group "workspace" {
+    volume "home_volume" {
+      type   = "csi"
+      source = "${home_volume_name}"
+      read_only = false
+      attachment_mode = "file-system"
+      access_mode     = "single-node-writer"
+    }
+    network {
+      port "http" {}
+    }
+    task "workspace" {
+      driver = "docker"
+      config {
+        image = "codercom/enterprise-base:ubuntu"
+        ports = ["http"]
+        labels {
+          name = "${workspace_tag}"
+          managed_by = "coder"
+        }
+        hostname = "${workspace_name}"
+        entrypoint = ["sh", "-c", "sudo chown coder:coder -R /home/coder && echo '${base64encode(coder_init_script)}' | base64 --decode | sh"]
+      }
+      volume_mount {
+        volume      = "home_volume"
+        destination = "/home/coder"
+      }
+      resources {
+        cores  = ${cores}
+        memory = ${memory_mb}
+      }
+      env {
+        CODER_AGENT_TOKEN = "${coder_agent_token}"
+      }
+      meta {
+        tag = "${workspace_tag}"
+        managed_by = "coder"
+      }
+    }
+    meta {
+      tag = "${workspace_tag}"
+      managed_by = "coder"
+    }
+  }
+  meta {
+    tag = "${workspace_tag}"
+    managed_by = "coder"
+  }
+}
diff --git a/examples/update_template_versions.sh b/examples/update_template_versions.sh
deleted file mode 100755
index d747b36460eb2..0000000000000
--- a/examples/update_template_versions.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-EXAMPLES_DIR=$(dirname "${BASH_SOURCE[0]}")
-PROJECT_ROOT=$(cd "$EXAMPLES_DIR" && git rev-parse --show-toplevel)
-
-# shellcheck source=scripts/lib.sh
-source "$PROJECT_ROOT/scripts/lib.sh"
-
-dependencies curl jq sed
-
-sed_args=(-i)
-if isdarwin; then
-	sed_args=(-i '')
-fi
-
-main() {
-	pushd "$EXAMPLES_DIR/templates"
-
-	# Fetch the latest release of terraform-provider-coder from GitHub.
-	latest_provider_coder="$(curl --fail -sSL https://api.github.com/repos/coder/terraform-provider-coder/releases/latest | jq -r .tag_name)"
-	latest_provider_coder=${latest_provider_coder#v}
-
-	# Update all terraform files that contain ~ the following lines:
-	#   source  = "coder/coder"
-	#   version = "[version]"
-	find . -type f -name "*.tf" -print0 | while read -r -d $'\0' f; do
-		current_version_raw="$(grep -n -A 1 'source *= *"coder/coder"' "$f" | tail -n 1)"
-		if [[ $current_version_raw = *version* ]]; then
-			line="${current_version_raw%%-*}"
-			sed "${sed_args[@]}" "$line s/\".*\"/\"$latest_provider_coder\"/" "$f"
-		fi
-	done
-}
-
-# Wrap the main function in a subshell to restore the working directory.
-(main)
diff --git a/examples/web-server/apache/README.md b/examples/web-server/apache/README.md
index e2b5ba4a1164c..787aa884b35ad 100644
--- a/examples/web-server/apache/README.md
+++ b/examples/web-server/apache/README.md
@@ -4,7 +4,7 @@
 
 1. Start a Coder deployment and be sure to set the following [configuration values](https://coder.com/docs/v2/latest/admin/configure):
 
-   ```console
+   ```env
    CODER_HTTP_ADDRESS=127.0.0.1:3000
    CODER_ACCESS_URL=https://coder.example.com
    CODER_WILDCARD_ACCESS_URL=*coder.example.com
@@ -18,13 +18,13 @@
 
 3. Install Apache (assuming you're on Debian/Ubuntu):
 
-   ```console
+   ```shell
    sudo apt install apache2
    ```
 
 4. Enable the following Apache modules:
 
-   ```console
+   ```shell
    sudo a2enmod proxy
    sudo a2enmod proxy_http
    sudo a2enmod ssl
@@ -33,7 +33,7 @@
 
 5. Stop Apache service and disable default site:
 
-   ```console
+   ```shell
    sudo a2dissite 000-default.conf
    sudo systemctl stop apache2
    ```
@@ -56,7 +56,7 @@
    dns_cloudflare_api_token = YOUR_API_TOKEN
    ```
 
-   ```console
+   ```shell
    mkdir -p ~/.secrets/certbot
    touch ~/.secrets/certbot/cloudflare.ini
    nano ~/.secrets/certbot/cloudflare.ini
@@ -64,7 +64,7 @@
 
 3. Set the correct permissions:
 
-   ```console
+   ```shell
    sudo chmod 600 ~/.secrets/certbot/cloudflare.ini
    ```
 
@@ -72,7 +72,7 @@
 
 1. Create the wildcard certificate:
 
-   ```console
+   ```shell
    sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini -d coder.example.com -d *.coder.example.com
    ```
 
@@ -82,7 +82,7 @@
 
 1. Create Apache configuration for Coder:
 
-   ```console
+   ```shell
    sudo nano /etc/apache2/sites-available/coder.conf
    ```
 
@@ -122,13 +122,13 @@
 
 3. Enable the site:
 
-   ```console
+   ```shell
    sudo a2ensite coder.conf
    ```
 
 4. Restart Apache:
 
-   ```console
+   ```shell
    sudo systemctl restart apache2
    ```
 
@@ -136,19 +136,19 @@
 
 1. Create a new file in `/etc/cron.weekly`:
 
-   ```console
+   ```shell
    sudo touch /etc/cron.weekly/certbot
    ```
 
 2. Make it executable:
 
-   ```console
+   ```shell
    sudo chmod +x /etc/cron.weekly/certbot
    ```
 
 3. And add this code:
 
-   ```sh
+   ```shell
    #!/bin/sh
    sudo certbot renew -q
    ```
diff --git a/examples/web-server/caddy/README.md b/examples/web-server/caddy/README.md
index 1b8eef65570ce..7e345fe08eb3b 100644
--- a/examples/web-server/caddy/README.md
+++ b/examples/web-server/caddy/README.md
@@ -10,7 +10,7 @@ This is an example configuration of how to use Coder with [caddy](https://caddys
 
 1. Start with our example configuration
 
-   ```console
+   ```shell
    # Create a project folder
    cd $HOME
    mkdir coder-with-caddy
@@ -30,7 +30,7 @@ This is an example configuration of how to use Coder with [caddy](https://caddys
 
 1. Start Coder. Set `CODER_ACCESS_URL` and `CODER_WILDCARD_ACCESS_URL` to the domain you're using in your Caddyfile.
 
-   ```console
+   ```shell
    export CODER_ACCESS_URL=https://coder.example.com
    export CODER_WILDCARD_ACCESS_URL=*.coder.example.com
    docker compose up -d # Run on startup
@@ -60,19 +60,19 @@ This is an example configuration of how to use Coder with [caddy](https://caddys
 
    If you're [keeping Caddy running](https://caddyserver.com/docs/running) via a system service:
 
-   ```console
+   ```shell
    sudo systemctl restart caddy
    ```
 
    Or run a standalone server:
 
-   ```console
+   ```shell
    caddy run
    ```
 
 6. Optionally, use [ufw](https://wiki.ubuntu.com/UncomplicatedFirewall) or another firewall to disable external traffic outside of Caddy.
 
-   ```console
+   ```shell
    # Check status of UncomplicatedFirewall
    sudo ufw status
 
diff --git a/examples/web-server/nginx/README.md b/examples/web-server/nginx/README.md
index c09edb5099db0..3454fe190f38c 100644
--- a/examples/web-server/nginx/README.md
+++ b/examples/web-server/nginx/README.md
@@ -4,10 +4,10 @@
 
 1. Start a Coder deployment and be sure to set the following [configuration values](https://coder.com/docs/v2/latest/admin/configure):
 
-   ```console
+   ```env
    CODER_HTTP_ADDRESS=127.0.0.1:3000
    CODER_ACCESS_URL=https://coder.example.com
-   CODER_WILDCARD_ACCESS_URL=*coder.example.com
+   CODER_WILDCARD_ACCESS_URL=*.coder.example.com
    ```
 
    Throughout the guide, be sure to replace `coder.example.com` with the domain you intend to use with Coder.
@@ -18,13 +18,13 @@
 
 3. Install NGINX (assuming you're on Debian/Ubuntu):
 
-   ```console
+   ```shell
    sudo apt install nginx
    ```
 
 4. Stop NGINX service:
 
-   ```console
+   ```shell
    sudo systemctl stop nginx
    ```
 
@@ -34,13 +34,13 @@
 
 1. Create NGINX configuration for this app:
 
-   ```console
+   ```shell
    sudo touch /etc/nginx/sites-available/coder.example.com
    ```
 
 2. Activate this file:
 
-   ```console
+   ```shell
    sudo ln -s /etc/nginx/sites-available/coder.example.com /etc/nginx/sites-enabled/coder.example.com
    ```
 
@@ -62,7 +62,7 @@
    dns_cloudflare_api_token = YOUR_API_TOKEN
    ```
 
-   ```console
+   ```shell
    mkdir -p ~/.secrets/certbot
    touch ~/.secrets/certbot/cloudflare.ini
    nano ~/.secrets/certbot/cloudflare.ini
@@ -70,7 +70,7 @@
 
 3. Set the correct permissions:
 
-   ```console
+   ```shell
    sudo chmod 600 ~/.secrets/certbot/cloudflare.ini
    ```
 
@@ -78,7 +78,7 @@
 
 1. Create the wildcard certificate:
 
-   ```console
+   ```shell
    sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini -d coder.example.com -d *.coder.example.com
    ```
 
@@ -86,7 +86,7 @@
 
 1. Edit the file with:
 
-   ```console
+   ```shell
    sudo nano /etc/nginx/sites-available/coder.example.com
    ```
 
@@ -129,7 +129,7 @@
 
 3. Test the configuration:
 
-   ```console
+   ```shell
    sudo nginx -t
    ```
 
@@ -137,26 +137,26 @@
 
 1. Create a new file in `/etc/cron.weekly`:
 
-   ```console
+   ```shell
    sudo touch /etc/cron.weekly/certbot
    ```
 
 2. Make it executable:
 
-   ```console
+   ```shell
    sudo chmod +x /etc/cron.weekly/certbot
    ```
 
 3. And add this code:
 
-   ```sh
+   ```shell
    #!/bin/sh
    sudo certbot renew -q
    ```
 
 ## Restart NGINX
 
-```console
+```shell
 sudo systemctl restart nginx
 ```
 
diff --git a/flake.lock b/flake.lock
index 79d823fd527c6..9dc65b9c61e9f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -70,11 +70,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1690179384,
-        "narHash": "sha256-+arbgqFTAtoeKtepW9wCnA0njCOyoiDFyl0Q0SBSOtE=",
+        "lastModified": 1692447944,
+        "narHash": "sha256-fkJGNjEmTPvqBs215EQU4r9ivecV5Qge5cF/QDLVn3U=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b12803b6d90e2e583429bb79b859ca53c348b39a",
+        "rev": "d680ded26da5cf104dd2735a51e88d2d8f487b4d",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index d2e7cd492dd7a..e8861a139fac0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,49 +11,233 @@
     flake-utils.lib.eachDefaultSystem (system:
       let
         pkgs = nixpkgs.legacyPackages.${system};
-      in
-      {
         formatter = pkgs.nixpkgs-fmt;
-        devShells.default = pkgs.mkShell {
-          buildInputs = with pkgs; [
-            bash
-            bat
-            cairo
-            drpc.defaultPackage.${system}
-            exa
-            getopt
-            git
-            go-migrate
-            go_1_20
-            golangci-lint
-            gopls
-            gotestsum
-            jq
-            kubernetes-helm
-            mockgen
-            nfpm
-            nodePackages.pnpm
-            nodePackages.typescript
-            nodePackages.typescript-language-server
-            nodejs
-            openssh
-            openssl
-            pango
-            pixman
-            pkg-config
-            postgresql
-            protoc-gen-go
-            ripgrep
-            shellcheck
-            shfmt
-            sqlc
-            terraform
-            typos
-            yq
-            zip
-            zstd
+        # Check in https://search.nixos.org/packages to find new packages.
+        # Use `nix --extra-experimental-features nix-command --extra-experimental-features flakes flake update`
+        # to update the lock file if packages are out-of-date.
+
+        # From https://nixos.wiki/wiki/Google_Cloud_SDK
+        gdk = pkgs.google-cloud-sdk.withExtraComponents ([pkgs.google-cloud-sdk.components.gke-gcloud-auth-plugin]);
+
+        devShellPackages = with pkgs; [
+          bat
+          cairo
+          curl
+          drpc.defaultPackage.${system}
+          gcc
+          gdk
+          getopt
+          git
+          gh
+          gnumake
+          gnused
+          go_1_20
+          go-migrate
+          golangci-lint
+          gopls
+          gotestsum
+          jq
+          kubectl
+          kubectx
+          kubernetes-helm
+          less
+          # Needed for many LD system libs!
+          libuuid
+          mockgen
+          nfpm
+          nodejs
+          nodePackages.pnpm
+          nodePackages.prettier
+          nodePackages.typescript
+          nodePackages.typescript-language-server
+          openssh
+          openssl
+          pango
+          pixman
+          pkg-config
+          postgresql_13
+          protobuf
+          protoc-gen-go
+          ripgrep
+          sapling
+          shellcheck
+          shfmt
+          sqlc
+          # strace is not available on OSX
+          (if system == "aarch64-darwin" then null else strace)
+          terraform
+          typos
+          vim
+          wget
+          yarn
+          yq-go
+          zip
+          zsh
+          zstd
+        ];
+        # We separate these to reduce the size of the dev shell for packages that we only
+        # want in the image.
+        devImagePackages = with pkgs; [
+          docker
+          exa
+          freetype
+          glib
+          harfbuzz
+          nix
+          nixpkgs-fmt
+          screen
+        ];
+
+        # This is the base image for our Docker container used for development.
+        # Use `nix-prefetch-docker ubuntu --arch amd64 --image-tag lunar` to get this.
+        baseDevEnvImage = pkgs.dockerTools.pullImage {
+          imageName = "ubuntu";
+          imageDigest = "sha256:7a520eeb6c18bc6d32a21bb7edcf673a7830813c169645d51c949cecb62387d0";
+          sha256 = "ajZzFSG/q7F5wAXfBOPpYBT+aVy8lqAXtBzkmAe2SeE=";
+          finalImageName = "ubuntu";
+          finalImageTag = "lunar";
+        };
+        # This is an intermediate stage that adds sudo with the setuid bit set.
+        # Nix doesn't allow setuid binaries in the store, so we have to do this
+        # in a separate stage.
+        intermediateDevEnvImage = pkgs.dockerTools.buildImage {
+          name = "intermediate";
+          fromImage = baseDevEnvImage;
+          runAsRoot = ''
+            #!${pkgs.runtimeShell}
+            ${pkgs.dockerTools.shadowSetup}
+            userdel ubuntu
+            groupadd docker
+            useradd coder \
+              --create-home \
+              --shell=/bin/bash \
+              --uid=1000 \
+              --user-group \
+              --groups docker
+            cp ${pkgs.sudo}/bin/sudo usr/bin/sudo
+            chmod 4755 usr/bin/sudo
+            mkdir -p /etc/init.d
+          '';
+        };
+        allPackages = devShellPackages ++ devImagePackages;
+        # Environment variables that live in `/etc/environment` in the container.
+        # These will also be applied to the container config.
+        devEnvVars = [
+          "PATH=${pkgs.lib.makeBinPath (allPackages)}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/coder/go/bin"
+          "LD_LIBRARY_PATH=${pkgs.lib.makeLibraryPath allPackages}"
+          # This setting prevents Go from using the public checksum database for
+          # our module path prefixes. It is required because these are in private
+          # repositories that require authentication.
+          #
+          # For details, see: https://golang.org/ref/mod#private-modules
+          "GOPRIVATE=coder.com,cdr.dev,go.coder.com,github.com/cdr,github.com/coder"
+          # Increase memory allocation to NodeJS
+          "NODE_OPTIONS=--max_old_space_size=8192"
+          "TERM=xterm-256color"
+          "LANG=en_US.UTF-8"
+          "LOCALE_ARCHIVE=/usr/lib/locale/locale-archive"
+        ];
+        # Builds our development environment image with all the tools included.
+        # Using Nix instead of Docker is **significantly** faster. This _build_
+        # doesn't really build anything, it just copies pre-built binaries into
+        # a container and adds them to the $PATH.
+        #
+        # To test changes and iterate on this, you can run:
+        # > nix build .#devEnvImage && ./result | docker load
+        # This will import the image into your local Docker daemon.
+        devEnvImage = pkgs.dockerTools.streamLayeredImage {
+          name = "codercom/oss-dogfood";
+          tag = "latest";
+          fromImage = intermediateDevEnvImage;
+          maxLayers = 64;
+          contents = [
+            # Required for `sudo` to persist the proper `PATH`.
+            (
+              pkgs.writeTextDir "etc/environment" (pkgs.lib.strings.concatLines devEnvVars)
+            )
+            # Allows `coder` to use `sudo` without a password.
+            (
+              pkgs.writeTextDir "etc/sudoers" ''
+                coder ALL=(ALL) NOPASSWD:ALL
+              ''
+            )
+            # Also allows `coder` to use `sudo` without a password.
+            (
+              pkgs.writeTextDir "etc/pam.d/other" ''
+                account sufficient pam_unix.so
+                auth sufficient pam_rootok.so
+                password requisite pam_unix.so nullok yescrypt
+                session required pam_unix.so
+              ''
+            )
+            # This allows users to chsh.
+            (
+              pkgs.writeTextDir "etc/pam.d/chsh" ''
+                auth        sufficient  pam_rootok.so
+              ''
+            )
+            # The default Nix config!
+            (
+              pkgs.writeTextDir "etc/nix/nix.conf" ''
+                experimental-features = nix-command flakes
+              ''
+            )
+            # Allow people to change shells!
+            (
+              pkgs.writeTextDir "etc/shells" ''
+                /bin/bash
+                ${pkgs.zsh}/bin/zsh
+              ''
+            )
+            # This is the debian script for managing Docker with `sudo service docker ...`.
+            (
+              pkgs.writeTextFile {
+                name = "docker";
+                destination = "/etc/init.d/docker";
+                executable = true;
+                text = (builtins.readFile (
+                  pkgs.fetchFromGitHub
+                    {
+                      owner = "moby";
+                      repo = "moby";
+                      rev = "ae737656f9817fbd5afab96aa083754cfb81aab0";
+                      sha256 = "sha256-oS3WplsxhKHCuHwL4/ytsCNJ1N/SZhlUZmzZTf81AoE=";
+                    } + "/contrib/init/sysvinit-debian/docker"
+                ));
+              }
+            )
+            # The Docker script above looks here for the daemon binary location.
+            # Because we're injecting it with Nix, it's not in the default spot.
+            (
+              pkgs.writeTextDir "etc/default/docker" ''
+                DOCKERD=${pkgs.docker}/bin/dockerd
+              ''
+            )
+            # The same as `sudo apt install ca-certificates -y'.
+            (
+              pkgs.writeTextDir "etc/ssl/certs/ca-certificates.crt"
+                (builtins.readFile "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt")
+            )
           ];
+          # Required for the UTF-8 locale to exist!
+          extraCommands = ''
+            mkdir -p usr/lib/locale
+            cp -a ${pkgs.glibcLocales}/lib/locale/locale-archive usr/lib/locale/locale-archive
+          '';
+
+          config = {
+            Env = devEnvVars;
+            Entrypoint = [ "/bin/bash" ];
+            User = "coder";
+          };
+        };
+      in
+      {
+        packages = {
+          devEnvImage = devEnvImage;
         };
+        defaultPackage = formatter; # or replace it with your desired default package.
+        devShell = pkgs.mkShell { buildInputs = devShellPackages; };
       }
     );
 }
diff --git a/go.mod b/go.mod
index fa411a3263e27..8ddcf94dc1c9f 100644
--- a/go.mod
+++ b/go.mod
@@ -1,4 +1,4 @@
-module github.com/coder/coder
+module github.com/coder/coder/v2
 
 go 1.20
 
@@ -11,9 +11,6 @@ replace github.com/chzyer/readline => github.com/kylecarbs/readline v0.0.0-20220
 // Required until https://github.com/briandowns/spinner/pull/136 is merged.
 replace github.com/briandowns/spinner => github.com/kylecarbs/spinner v1.18.2-0.20220329160715-20702b5af89e
 
-// Required until https://github.com/fergusstrange/embedded-postgres/pull/75 is merged.
-replace github.com/fergusstrange/embedded-postgres => github.com/kylecarbs/embedded-postgres v1.17.1-0.20220615202325-461532cecd3a
-
 // opencensus-go leaks a goroutine by default.
 replace go.opencensus.io => github.com/kylecarbs/opencensus-go v0.23.1-0.20220307014935-4d0325a68f8b
 
@@ -36,7 +33,18 @@ replace github.com/dlclark/regexp2 => github.com/dlclark/regexp2 v1.7.0
 
 // There are a few minor changes we make to Tailscale that we're slowly upstreaming. Compare here:
 // https://github.com/tailscale/tailscale/compare/main...coder:tailscale:main
-replace tailscale.com => github.com/coder/tailscale v0.0.0-20230731105344-d1b7f8087191
+replace tailscale.com => github.com/coder/tailscale v1.1.1-0.20230921183700-c821c9c9966d
+
+// Fixes a race-condition in coder/wgtunnel.
+// Upstream PR: https://github.com/WireGuard/wireguard-go/pull/85
+replace golang.zx2c4.com/wireguard => github.com/coder/wireguard-go v0.0.0-20230920225835-b7d43c468619
+
+// This is replaced to include a fix that causes a deadlock when closing the
+// wireguard network.
+// The branch used is from https://github.com/coder/wireguard-go/tree/colin/tailscale
+// It is based on https://github.com/tailscale/wireguard-go/tree/tailscale, but
+// includes the upstream fix https://github.com/WireGuard/wireguard-go/commit/b7cd547315bed421a648d0a0f1ee5a0fc1b1151e
+replace github.com/tailscale/wireguard-go => github.com/coder/wireguard-go v0.0.0-20230807234434-d825b45ccbf5
 
 // Use our tempfork of gvisor that includes a fix for TCP connection stalls:
 // https://github.com/coder/coder/issues/7388
@@ -61,68 +69,68 @@ replace github.com/gliderlabs/ssh => github.com/coder/ssh v0.0.0-20230621095435-
 replace github.com/imulab/go-scim/pkg/v2 => github.com/coder/go-scim/pkg/v2 v2.0.0-20230221055123-1d63c1222136
 
 require (
-	cdr.dev/slog v1.6.1
+	cdr.dev/slog v1.6.2-0.20230929193652-f0c466fabe10
 	cloud.google.com/go/compute/metadata v0.2.3
 	github.com/AlecAivazis/survey/v2 v2.3.5
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/adrg/xdg v0.4.0
 	github.com/ammario/tlru v0.3.0
-	github.com/andybalholm/brotli v1.0.5
+	github.com/andybalholm/brotli v1.0.6
 	github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2
 	github.com/awalterschulze/gographviz v2.0.3+incompatible
-	github.com/bep/debounce v1.2.1
-	github.com/bgentry/speakeasy v0.1.0
+	github.com/bgentry/speakeasy v0.1.1-0.20220910012023-760eaf8b6816
 	github.com/bramvdbogaerde/go-scp v1.2.1-0.20221219230748-977ee74ac37b
 	github.com/briandowns/spinner v1.18.1
 	github.com/cakturk/go-netstat v0.0.0-20200220111822-e5b49efee7a5
 	github.com/cenkalti/backoff/v4 v4.2.1
-	github.com/charmbracelet/charm v0.12.4
 	github.com/charmbracelet/glamour v0.6.0
 	// In later at least v0.7.1, lipgloss changes its terminal detection
 	// which breaks most of our CLI golden files tests.
-	github.com/charmbracelet/lipgloss v0.7.1
+	github.com/charmbracelet/lipgloss v0.8.0 // indirect
 	github.com/cli/safeexec v1.0.1
 	github.com/codeclysm/extract/v3 v3.1.1
 	github.com/coder/flog v1.1.0
+	github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0
 	github.com/coder/retry v1.4.0
-	github.com/coder/terraform-provider-coder v0.11.1
-	github.com/coder/wgtunnel v0.1.5
-	github.com/coreos/go-oidc/v3 v3.6.0
+	github.com/coder/terraform-provider-coder v0.12.2
+	github.com/coder/wgtunnel v0.1.12
+	github.com/coreos/go-oidc/v3 v3.7.0
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 	github.com/creack/pty v1.1.18
 	github.com/dave/dst v0.27.2
-	github.com/davecgh/go-spew v1.1.1
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
+	github.com/djherbis/times v1.6.0
 	github.com/elastic/go-sysinfo v1.11.0
 	github.com/fatih/color v1.15.0
 	github.com/fatih/structs v1.1.0
 	github.com/fatih/structtag v1.2.0
-	github.com/fergusstrange/embedded-postgres v1.16.0
+	github.com/fergusstrange/embedded-postgres v1.24.0
 	github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa
 	github.com/gen2brain/beeep v0.0.0-20220402123239-6a3042f4b71a
 	github.com/gliderlabs/ssh v0.3.4
-	github.com/go-chi/chi v1.5.4
-	github.com/go-chi/chi/v5 v5.0.8
+	github.com/go-chi/chi/v5 v5.0.10
 	github.com/go-chi/cors v1.2.1
-	github.com/go-chi/httprate v0.7.1
+	github.com/go-chi/httprate v0.7.4
 	github.com/go-chi/render v1.0.1
 	github.com/go-jose/go-jose/v3 v3.0.0
-	github.com/go-logr/logr v1.2.4
+	github.com/go-logr/logr v1.3.0
 	github.com/go-ping/ping v1.1.0
-	github.com/go-playground/validator/v10 v10.14.0
+	github.com/go-playground/validator/v10 v10.15.1
 	github.com/gofrs/flock v0.8.1
-	github.com/gohugoio/hugo v0.116.0
-	github.com/golang-jwt/jwt v3.2.2+incompatible
+	github.com/gohugoio/hugo v0.119.0
 	github.com/golang-jwt/jwt/v4 v4.5.0
 	github.com/golang-migrate/migrate/v4 v4.16.0
 	github.com/golang/mock v1.6.0
+	github.com/google/go-cmp v0.6.0
 	github.com/google/go-github/v43 v43.0.1-0.20220414155304-00e42332e405
-	github.com/google/uuid v1.3.0
+	github.com/google/uuid v1.3.1
+	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-reap v0.0.0-20170704170343-bf58d8a43e7b
 	github.com/hashicorp/go-version v1.6.0
-	github.com/hashicorp/golang-lru/v2 v2.0.1
-	github.com/hashicorp/hc-install v0.5.2
+	github.com/hashicorp/golang-lru/v2 v2.0.3
+	github.com/hashicorp/hc-install v0.6.0
 	github.com/hashicorp/terraform-config-inspect v0.0.0-20211115214459-90acf1ca460f
-	github.com/hashicorp/terraform-json v0.17.0
+	github.com/hashicorp/terraform-json v0.17.2-0.20230905102422-cd7b46b136bb
 	github.com/hashicorp/yamux v0.1.1
 	github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02
 	github.com/imulab/go-scim/pkg/v2 v2.2.0
@@ -130,78 +138,95 @@ require (
 	github.com/jmoiron/sqlx v1.3.5
 	github.com/justinas/nosurf v1.1.1
 	github.com/kirsle/configdir v0.0.0-20170128060238-e45d2f54772f
-	github.com/klauspost/compress v1.16.3
-	github.com/lib/pq v1.10.6
-	github.com/mattn/go-isatty v0.0.19
+	github.com/klauspost/compress v1.17.1
+	github.com/lib/pq v1.10.9
+	github.com/mattn/go-isatty v0.0.20
 	github.com/mitchellh/go-wordwrap v1.0.1
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/moby/moby v24.0.1+incompatible
 	github.com/muesli/termenv v0.15.2
-	github.com/open-policy-agent/opa v0.55.0
+	github.com/open-policy-agent/opa v0.57.0
 	github.com/ory/dockertest/v3 v3.10.0
 	github.com/pion/udp v0.1.2
 	github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8
 	github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e
 	github.com/pkg/sftp v1.13.6-0.20221018182125-7da137aa03f0
-	github.com/prometheus/client_golang v1.16.0
-	github.com/prometheus/client_model v0.3.0
-	github.com/prometheus/common v0.42.0
+	github.com/prometheus/client_golang v1.17.0
+	github.com/prometheus/client_model v0.5.0
+	github.com/prometheus/common v0.45.0
 	github.com/quasilyte/go-ruleguard/dsl v0.3.21
 	github.com/robfig/cron/v3 v3.0.1
-	github.com/spf13/afero v1.9.5
+	github.com/spf13/afero v1.10.0
 	github.com/spf13/pflag v1.0.5
-	github.com/sqlc-dev/pqtype v0.2.0
+	github.com/sqlc-dev/pqtype v0.3.0
 	github.com/stretchr/testify v1.8.4
 	github.com/swaggo/http-swagger/v2 v2.0.1
-	github.com/swaggo/swag v1.8.6
+	github.com/swaggo/swag v1.16.2
 	github.com/u-root/u-root v0.11.0
 	github.com/unrolled/secure v1.13.0
-	github.com/valyala/fasthttp v1.48.0
+	github.com/valyala/fasthttp v1.50.0
 	github.com/wagslane/go-password-validator v0.3.0
 	go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1
-	go.nhat.io/otelsql v0.11.0
-	go.opentelemetry.io/otel v1.16.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.16.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.16.0
-	go.opentelemetry.io/otel/sdk v1.16.0
-	go.opentelemetry.io/otel/trace v1.16.0
+	go.nhat.io/otelsql v0.12.0
+	go.opentelemetry.io/otel v1.19.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0
+	go.opentelemetry.io/otel/sdk v1.19.0
+	go.opentelemetry.io/otel/trace v1.19.0
 	go.uber.org/atomic v1.11.0
-	go.uber.org/goleak v1.2.1
-	go4.org/netipx v0.0.0-20220725152314-7e7bdc8411bf
-	golang.org/x/crypto v0.11.0
-	golang.org/x/exp v0.0.0-20230315142452-642cacee5cc0
-	golang.org/x/mod v0.12.0
-	golang.org/x/net v0.12.0
-	golang.org/x/oauth2 v0.10.0
-	golang.org/x/sync v0.3.0
-	golang.org/x/sys v0.10.0
-	golang.org/x/term v0.10.0
-	golang.org/x/tools v0.11.0
+	go.uber.org/goleak v1.3.0
+	go4.org/netipx v0.0.0-20230728180743-ad4cb58a6516
+	golang.org/x/crypto v0.14.0
+	golang.org/x/exp v0.0.0-20230801115018-d63ba01acd4b
+	golang.org/x/mod v0.13.0
+	golang.org/x/net v0.17.0
+	golang.org/x/oauth2 v0.13.0
+	golang.org/x/sync v0.4.0
+	golang.org/x/sys v0.13.0
+	golang.org/x/term v0.13.0
+	golang.org/x/text v0.13.0
+	golang.org/x/tools v0.14.0
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
-	golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b
-	google.golang.org/api v0.134.0
-	google.golang.org/grpc v1.57.0
+	golang.zx2c4.com/wireguard v0.0.0-20230704135630-469159ecf7d1
+	google.golang.org/api v0.148.0
+	google.golang.org/grpc v1.59.0
 	google.golang.org/protobuf v1.31.0
+	gopkg.in/DataDog/dd-trace-go.v1 v1.56.1
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gopkg.in/yaml.v3 v3.0.1
-	gvisor.dev/gvisor v0.0.0-20221203005347-703fd9b7fbc0
+	gvisor.dev/gvisor v0.0.0-20230504175454-7b0a1988a28f
 	nhooyr.io/websocket v1.8.7
 	storj.io/drpc v0.0.33-0.20230420154621-9716137f6037
-	tailscale.com v1.32.3
+	tailscale.com v1.46.1
+)
+
+require (
+	github.com/aws/smithy-go v1.15.0
+	github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89
+	github.com/chromedp/chromedp v0.9.2
+	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
+	github.com/tidwall/gjson v1.17.0
 )
 
 require (
 	cloud.google.com/go/compute v1.23.0 // indirect
-	cloud.google.com/go/logging v1.7.0 // indirect
+	cloud.google.com/go/logging v1.8.1 // indirect
 	cloud.google.com/go/longrunning v0.5.1 // indirect
-	filippo.io/edwards25519 v1.0.0-rc.1 // indirect
+	filippo.io/edwards25519 v1.0.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
+	github.com/DataDog/appsec-internal-go v1.0.0 // indirect
+	github.com/DataDog/datadog-agent/pkg/obfuscate v0.48.0 // indirect
+	github.com/DataDog/datadog-agent/pkg/remoteconfig/state v0.48.0-devel.0.20230725154044-2549ba9058df // indirect
+	github.com/DataDog/datadog-go/v5 v5.3.0 // indirect
+	github.com/DataDog/go-libddwaf v1.5.0 // indirect
+	github.com/DataDog/go-tuf v1.0.2-0.5.2 // indirect
+	github.com/DataDog/gostackparse v0.7.0 // indirect
+	github.com/DataDog/sketches-go v1.4.2 // indirect
 	github.com/KyleBanks/depth v1.2.1 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
 	github.com/OneOfOne/xxhash v1.2.8 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8 // indirect
+	github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/agnivade/levenshtein v1.1.1 // indirect
 	github.com/akutz/memconn v0.1.0 // indirect
@@ -209,7 +234,20 @@ require (
 	github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.20.3 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.18.32 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.31 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.7 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.40 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.34 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.38 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.34 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssm v1.37.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.13.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.15.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.21.1 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
@@ -217,95 +255,96 @@ require (
 	github.com/bep/godartsass/v2 v2.0.0 // indirect
 	github.com/bep/golibsass v1.1.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/charmbracelet/bubbles v0.15.0 // indirect
-	github.com/charmbracelet/bubbletea v0.23.2 // indirect
-	github.com/clbanning/mxj/v2 v2.5.7 // indirect
+	github.com/chromedp/sysutil v1.0.0 // indirect
+	github.com/clbanning/mxj/v2 v2.7.0 // indirect
 	github.com/cloudflare/circl v1.3.3 // indirect
-	github.com/containerd/console v1.0.3 // indirect
-	github.com/containerd/continuity v0.4.1 // indirect
+	github.com/containerd/continuity v0.4.2 // indirect
 	github.com/coreos/go-iptables v0.6.0 // indirect
 	github.com/dlclark/regexp2 v1.10.0 // indirect
-	github.com/docker/cli v20.10.17+incompatible // indirect
-	github.com/docker/docker v23.0.3+incompatible // indirect
+	github.com/docker/cli v23.0.5+incompatible // indirect
+	github.com/docker/docker v23.0.5+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/ebitengine/purego v0.5.0-alpha.1 // indirect
 	github.com/elastic/go-windows v1.0.0 // indirect
+	github.com/felixge/httpsnoop v1.0.3 // indirect
 	github.com/fxamacker/cbor/v2 v2.4.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
-	github.com/ghodss/yaml v1.0.0 // indirect
-	github.com/gin-gonic/gin v1.9.1 // indirect
+	github.com/go-chi/hostrouter v0.2.0 // indirect
+	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/jsonreference v0.20.0 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/spec v0.20.6 // indirect
-	github.com/go-openapi/swag v0.19.15 // indirect
+	github.com/go-openapi/swag v0.22.4 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-sql-driver/mysql v1.7.1 // indirect
 	github.com/go-test/deep v1.0.8 // indirect
 	github.com/go-toast/toast v0.0.0-20190211030409-01e6764cf0a4 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
-	github.com/gobwas/ws v1.1.0 // indirect
+	github.com/gobwas/httphead v0.1.0 // indirect
+	github.com/gobwas/pool v0.2.1 // indirect
+	github.com/gobwas/ws v1.2.1 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/glog v1.1.0 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/btree v1.1.2 // indirect
 	github.com/google/flatbuffers v23.1.21+incompatible // indirect
-	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/s2a-go v0.1.4 // indirect
+	github.com/google/nftables v0.1.1-0.20230115205135-9aa6fdf5a28c // indirect
+	github.com/google/pprof v0.0.0-20230817174616-7a8ec2ada47b // indirect
+	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.1 // indirect
 	github.com/gorilla/css v1.0.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.15.1 // indirect
+	github.com/gorilla/mux v1.8.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.0 // indirect
 	github.com/h2non/filetype v1.1.3 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 // indirect
-	github.com/hashicorp/go-hclog v1.2.1 // indirect
-	github.com/hashicorp/go-multierror v1.1.1
+	github.com/hashicorp/go-hclog v1.5.0 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
 	github.com/hashicorp/hcl/v2 v2.17.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/terraform-plugin-go v0.12.0 // indirect
 	github.com/hashicorp/terraform-plugin-log v0.7.0 // indirect
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.20.0 // indirect
-	github.com/hdevalence/ed25519consensus v0.0.0-20220222234857-c00d1f31bab3 // indirect
+	github.com/hdevalence/ed25519consensus v0.1.0 // indirect
 	github.com/illarion/gonotify v1.0.1 // indirect
-	github.com/imdario/mergo v0.3.13 // indirect
-	github.com/insomniacslk/dhcp v0.0.0-20221215072855-de60144f33f8 // indirect
+	github.com/imdario/mergo v0.3.15 // indirect
+	github.com/insomniacslk/dhcp v0.0.0-20230407062729-974c6f05fe16 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/joeshaw/multierror v0.0.0-20140124173710-69b34d4ec901 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86 // indirect
-	github.com/jsimonetti/rtnetlink v1.1.2-0.20220408201609-d380b505068b // indirect
+	github.com/jsimonetti/rtnetlink v1.3.2 // indirect
 	github.com/juju/errors v1.0.0 // indirect
-	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/leodido/go-urn v1.2.4 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.15 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/mdlayher/genetlink v1.2.0 // indirect
-	github.com/mdlayher/netlink v1.6.2 // indirect
+	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
+	github.com/mdlayher/genetlink v1.3.2 // indirect
+	github.com/mdlayher/netlink v1.7.2 // indirect
 	github.com/mdlayher/sdnotify v1.0.0 // indirect
-	github.com/mdlayher/socket v0.2.3 // indirect
+	github.com/mdlayher/socket v0.4.1 // indirect
 	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
 	github.com/microcosm-cc/bluemonday v1.0.23 // indirect
-	github.com/miekg/dns v1.1.45 // indirect
+	github.com/miekg/dns v1.1.55 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/term v0.5.0 // indirect
-	github.com/muesli/ansi v0.0.0-20221106050444-61f0cd9a192a // indirect
-	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/reflow v0.3.0 // indirect
 	github.com/niklasfasching/go-org v1.7.0 // indirect
 	github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d // indirect
@@ -313,64 +352,72 @@ require (
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0-rc4 // indirect
 	github.com/opencontainers/runc v1.1.5 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
+	github.com/outcaste-io/ristretto v0.2.3 // indirect
+	github.com/pelletier/go-toml/v2 v2.1.0 // indirect
+	github.com/philhofer/fwd v1.1.2 // indirect
+	github.com/pierrec/lz4/v4 v4.1.18 // indirect
 	github.com/pion/transport v0.14.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/procfs v0.10.1 // indirect
-	github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/procfs v0.11.1 // indirect
+	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
+	github.com/riandyrn/otelchi v0.5.1 // indirect
+	github.com/richardartoul/molecule v1.0.1-0.20221107223329-32cfee06a052 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
 	github.com/satori/go.uuid v1.2.1-0.20181028125025-b2ce2384e17b // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.7.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/spf13/cast v1.5.1 // indirect
 	github.com/swaggo/files/v2 v2.0.0 // indirect
 	github.com/tadvi/systray v0.0.0-20190226123456-11a2b8fa57af // indirect
 	github.com/tailscale/certstore v0.1.1-0.20220316223106-78d6e1c49d8d // indirect
-	github.com/tailscale/golang-x-crypto v0.0.0-20221102133106-bc99ab8c2d17 // indirect
+	github.com/tailscale/golang-x-crypto v0.0.0-20230713185742-f0b76a10a08e // indirect
 	github.com/tailscale/goupnp v1.0.1-0.20210804011211-c64d0f06ea05 // indirect
 	github.com/tailscale/netlink v1.1.1-0.20211101221916-cabfb018fe85 // indirect
-	github.com/tailscale/wireguard-go v0.0.0-20221219190806-4fa124729667 // indirect
+	github.com/tailscale/wireguard-go v0.0.0-20230710185534-bb2c8f22eccf // indirect
 	github.com/tchap/go-patricia/v2 v2.3.1 // indirect
 	github.com/tcnksm/go-httpstat v0.2.0 // indirect
 	github.com/tdewolff/parse/v2 v2.6.6 // indirect
 	github.com/tdewolff/test v1.0.9 // indirect
-	github.com/u-root/uio v0.0.0-20221213070652-c3537552635f // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tinylib/msgp v1.1.8 // indirect
+	github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63 // indirect
 	github.com/ulikunitz/xz v0.5.11 // indirect
 	github.com/vishvananda/netlink v1.2.1-beta.2 // indirect
-	github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74 // indirect
+	github.com/vishvananda/netns v0.0.4 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
-	github.com/vmihailenco/tagparser v0.1.1 // indirect
+	github.com/vmihailenco/tagparser v0.1.2 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
 	github.com/yashtewari/glob-intersection v0.2.0 // indirect
-	github.com/yuin/goldmark v1.5.5 // indirect
+	github.com/yuin/goldmark v1.5.6 // indirect
 	github.com/yuin/goldmark-emoji v1.0.1 // indirect
-	github.com/zclconf/go-cty v1.13.2 // indirect
+	github.com/zclconf/go-cty v1.14.0 // indirect
 	github.com/zeebo/errs v1.3.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0 // indirect
-	go.opentelemetry.io/otel/metric v1.16.0 // indirect
-	go.opentelemetry.io/proto/otlp v0.19.0 // indirect
-	go4.org/mem v0.0.0-20210711025021-927187094b94 // indirect
-	golang.org/x/text v0.11.0
+	go.opentelemetry.io/contrib v1.19.0 // indirect
+	go.opentelemetry.io/otel/metric v1.19.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
+	go4.org/intern v0.0.0-20230525184215-6c62f75575cb // indirect
+	go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect
+	go4.org/unsafe/assume-no-moving-gc v0.0.0-20230525183740-e7c30c78aeb2 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
-	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230215201556-9c5414ab4bde // indirect
+	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 // indirect
 	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230726155614-23370e0ffb3e // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230706204954-ccb25ca9f130 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230720185612-659f7aaaa771 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto v0.0.0-20231002182017-d307bd883b97 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20231002182017-d307bd883b97 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	howett.net/plist v1.0.0 // indirect
+	inet.af/netaddr v0.0.0-20230525184311-b8eac61e914a // indirect
 	inet.af/peercred v0.0.0-20210906144145-0893ea02156a // indirect
-)
-
-require (
-	github.com/go-ini/ini v1.67.0 // indirect
-	github.com/gorilla/mux v1.8.0 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 7e721762b664b..c4180c4191b45 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-cdr.dev/slog v1.6.1 h1:IQjWZD0x6//sfv5n+qEhbu3wBkmtBQY5DILXNvMaIv4=
-cdr.dev/slog v1.6.1/go.mod h1:eHEYQLaZvxnIAXC+XdTSNLb/kgA/X2RVSF72v5wsxEI=
+cdr.dev/slog v1.6.2-0.20230929193652-f0c466fabe10 h1:gnB1By6Hzs2PVQXyi/cvo6L3kHPb8utLuzycWHfCztQ=
+cdr.dev/slog v1.6.2-0.20230929193652-f0c466fabe10/go.mod h1:NaoTA7KwopCrnaSb0JXTC0PTp/O/Y83Lndnq0OEV3ZQ=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -31,8 +31,8 @@ cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGB
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/logging v1.7.0 h1:CJYxlNNNNAMkHp9em/YEXcfJg+rPDg7YfwoRpMU+t5I=
-cloud.google.com/go/logging v1.7.0/go.mod h1:3xjP2CjkM3ZkO73aj4ASA5wRPGGCRrPIAeNqVNkzY8M=
+cloud.google.com/go/logging v1.8.1 h1:26skQWPeYhvIasWKm48+Eq7oUqdcdbwsCVwz5Ys0FvU=
+cloud.google.com/go/logging v1.8.1/go.mod h1:TJjR+SimHwuC8MZ9cjByQulAMgni+RkXeI3wwctHJEI=
 cloud.google.com/go/longrunning v0.5.1 h1:Fr7TXftcqTudoyRJa113hyaqlGdiBQkp0Gq7tErFDWI=
 cloud.google.com/go/longrunning v0.5.1/go.mod h1:spvimkwdz6SPWKEt/XBij79E9fiTkHSQl/fRUUQJYJc=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
@@ -46,30 +46,45 @@ cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RX
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-filippo.io/edwards25519 v1.0.0-rc.1 h1:m0VOOB23frXZvAOK44usCgLWvtsxIoMCTBGJZlpmGfU=
-filippo.io/edwards25519 v1.0.0-rc.1/go.mod h1:N1IkdkCkiLB6tki+MYJoSx2JTY9NUlxZE7eHn5EwJns=
-filippo.io/mkcert v1.4.3 h1:axpnmtrZMM8u5Hf4N3UXxboGemMOV+Tn+e+pkHM6E3o=
+filippo.io/edwards25519 v1.0.0 h1:0wAIcmJUqRdI8IJ/3eGi5/HwXZWPujYXXlkrQogz0Ek=
+filippo.io/edwards25519 v1.0.0/go.mod h1:N1IkdkCkiLB6tki+MYJoSx2JTY9NUlxZE7eHn5EwJns=
+filippo.io/mkcert v1.4.4 h1:8eVbbwfVlaqUM7OwuftKc2nuYOoTDQWqsoXmzoXZdbc=
 github.com/AlecAivazis/survey/v2 v2.3.5 h1:A8cYupsAZkjaUmhtTYv3sSqc7LO5mp1XDfqe5E/9wRQ=
 github.com/AlecAivazis/survey/v2 v2.3.5/go.mod h1:4AuI9b7RjAR+G7v9+C4YSlX/YL3K3cWNXgWXOhllqvI=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
+github.com/DataDog/appsec-internal-go v1.0.0 h1:2u5IkF4DBj3KVeQn5Vg2vjPUtt513zxEYglcqnd500U=
+github.com/DataDog/appsec-internal-go v1.0.0/go.mod h1:+Y+4klVWKPOnZx6XESG7QHydOaUGEXyH2j/vSg9JiNM=
+github.com/DataDog/datadog-agent/pkg/obfuscate v0.48.0 h1:bUMSNsw1iofWiju9yc1f+kBd33E3hMJtq9GuU602Iy8=
+github.com/DataDog/datadog-agent/pkg/obfuscate v0.48.0/go.mod h1:HzySONXnAgSmIQfL6gOv9hWprKJkx8CicuXuUbmgWfo=
+github.com/DataDog/datadog-agent/pkg/remoteconfig/state v0.48.0-devel.0.20230725154044-2549ba9058df h1:PbzrhHhs2+RRdKKti7JBSM8ATIeiji2T2cVt/d8GT8k=
+github.com/DataDog/datadog-agent/pkg/remoteconfig/state v0.48.0-devel.0.20230725154044-2549ba9058df/go.mod h1:5Q39ZOIOwZMnFyRadp+5gH1bFdjmb+Pgxe+j5XOwaTg=
+github.com/DataDog/datadog-go/v5 v5.3.0 h1:2q2qjFOb3RwAZNU+ez27ZVDwErJv5/VpbBPprz7Z+s8=
+github.com/DataDog/datadog-go/v5 v5.3.0/go.mod h1:XRDJk1pTc00gm+ZDiBKsjh7oOOtJfYfglVCmFb8C2+Q=
+github.com/DataDog/go-libddwaf v1.5.0 h1:lrHP3VrEriy1M5uQuaOcKphf5GU40mBhihMAp6Ik55c=
+github.com/DataDog/go-libddwaf v1.5.0/go.mod h1:Fpnmoc2k53h6desQrH1P0/gR52CUzkLNFugE5zWwUBQ=
+github.com/DataDog/go-tuf v1.0.2-0.5.2 h1:EeZr937eKAWPxJ26IykAdWA4A0jQXJgkhUjqEI/w7+I=
+github.com/DataDog/go-tuf v1.0.2-0.5.2/go.mod h1:zBcq6f654iVqmkk8n2Cx81E1JnNTMOAx1UEO/wZR+P0=
+github.com/DataDog/gostackparse v0.7.0 h1:i7dLkXHvYzHV308hnkvVGDL3BR4FWl7IsXNPz/IGQh4=
+github.com/DataDog/gostackparse v0.7.0/go.mod h1:lTfqcJKqS9KnXQGnyQMCugq3u1FP6UZMfWR0aitKFMM=
+github.com/DataDog/sketches-go v1.4.2 h1:gppNudE9d19cQ98RYABOetxIhpTCl4m7CnbRZjvVA/o=
+github.com/DataDog/sketches-go v1.4.2/go.mod h1:xJIXldczJyyjnbDop7ZZcLxJdV3+7Kra7H1KMgpgkLk=
 github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
 github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
+github.com/Microsoft/go-winio v0.5.0/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
 github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
 github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEVMRuU21PR1EtLVZJmdB18Gu3Rw=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5/go.mod h1:lmUJ/7eu/Q8D7ML55dXQrVaamCz2vxCfdQBasLZfHKk=
-github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
-github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8 h1:wPbRQzjjwFc0ih8puEVAOFGELsn1zoIIYdxvML7mDxA=
-github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8/go.mod h1:I0gYDMZ6Z5GRU7l58bNFSkPTFN6Yl12dsUlAZ8xy98g=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 h1:KLq8BE0KwCL+mmXnjLWEAOYO+2l2AE4YMmqG1ZpZHBs=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/adrg/xdg v0.4.0 h1:RzRqFcjH4nE5C6oTAxhBtoE2IRyjBSa62SCbyPidvls=
@@ -88,17 +103,18 @@ github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3Uu
 github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/ammario/tlru v0.3.0 h1:yK8ESoFlEyz/BVVL8yZQKAUzJwFJR/j9EfxjnKxtR/Q=
 github.com/ammario/tlru v0.3.0/go.mod h1:aYzRFu0XLo4KavE9W8Lx7tzjkX+pAApz+NgcKYIFUBQ=
-github.com/andybalholm/brotli v1.0.5 h1:8uQZIdzKmjc/iuPu7O2ioW48L81FgatrcpfFmiq/cCs=
-github.com/andybalholm/brotli v1.0.5/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
+github.com/andybalholm/brotli v1.0.6 h1:Yf9fFpf49Zrxb9NlQaluyE92/+X7UVHlhMNJN2sxfOI=
+github.com/andybalholm/brotli v1.0.6/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/apparentlymart/go-dump v0.0.0-20180507223929-23540a00eaa3/go.mod h1:oL81AME2rN47vu18xqj1S1jPIPuN7afo62yKTNn3XMM=
 github.com/apparentlymart/go-dump v0.0.0-20190214190832-042adf3cf4a0 h1:MzVXffFUye+ZcSR6opIgz9Co7WcDx6ZcY+RjfFHoA0I=
 github.com/apparentlymart/go-textseg v1.0.0/go.mod h1:z96Txxhf3xSFMPmb5X/1W05FF/Nj9VFpLOpjS5yuumk=
 github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
 github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw=
 github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
 github.com/arduino/go-paths-helper v1.2.0 h1:qDW93PR5IZUN/jzO4rCtexiwF8P4OIcOmcSgAYLZfY4=
@@ -106,80 +122,98 @@ github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 h1:7Ip0wMmLHLRJdrloD
 github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
 github.com/awalterschulze/gographviz v2.0.3+incompatible h1:9sVEXJBJLwGX7EQVhLm2elIKCm7P2YHFC8v6096G09E=
 github.com/awalterschulze/gographviz v2.0.3+incompatible/go.mod h1:GEV5wmg4YquNw7v1kkyoX9etIk8yVmXj+AkDHuuETHs=
+github.com/aws/aws-sdk-go-v2 v1.20.0/go.mod h1:uWOr0m0jDsiWw8nnXiqZ+YG6LdvAlGYDLLf2NmHZoy4=
+github.com/aws/aws-sdk-go-v2 v1.20.3 h1:lgeKmAZhlj1JqN43bogrM75spIvYnRxqTAh1iupu1yE=
+github.com/aws/aws-sdk-go-v2 v1.20.3/go.mod h1:/RfNgGmRxI+iFOB1OeJUyxiU+9s88k3pfHvDagGEp0M=
+github.com/aws/aws-sdk-go-v2/config v1.18.32 h1:tqEOvkbTxwEV7hToRcJ1xZRjcATqwDVsWbAscgRKyNI=
+github.com/aws/aws-sdk-go-v2/config v1.18.32/go.mod h1:U3ZF0fQRRA4gnbn9GGvOWLoT2EzzZfAWeKwnVrm1rDc=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.31 h1:vJyON3lG7R8VOErpJJBclBADiWTwzcwdkQpTKx8D2sk=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.31/go.mod h1:T4sESjBtY2lNxLgkIASmeP57b5j7hTQqCbqG0tWnxC4=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.7 h1:X3H6+SU21x+76LRglk21dFRgMTJMa5QcpW+SqUf5BBg=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.7/go.mod h1:3we0V09SwcJBzNlnyovrR2wWJhWmVdqAsmVs4uronv8=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.37/go.mod h1:Pdn4j43v49Kk6+82spO3Tu5gSeQXRsxo56ePPQAvFiA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.40 h1:CXceCS9BrDInRc74GDCQ8Qyk/Gp9VLdK+Rlve+zELSE=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.40/go.mod h1:5kKmFhLeOVy6pwPDpDNA6/hK/d6URC98pqDDqHgdBx4=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.31/go.mod h1:fTJDMe8LOFYtqiFFFeHA+SVMAwqLhoq0kcInYoLa9Js=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.34 h1:B+nZtd22cbko5+793hg7LEaTeLMiZwlgCLUrN5Y0uzg=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.34/go.mod h1:RZP0scceAyhMIQ9JvFp7HvkpcgqjL4l/4C+7RAeGbuM=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.38 h1:+i1DOFrW3YZ3apE45tCal9+aDKK6kNEbW6Ib7e1nFxE=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.3.38/go.mod h1:1/jLp0OgOaWIetycOmycW+vYTYgTZFPttJQRgsI1PoU=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.31/go.mod h1:3+lloe3sZuBQw1aBc5MyndvodzQlyqCZ7x1QPDHaWP4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.34 h1:JwvXk+1ePAD9xkFHprhHYqwsxLDcbNFsPI1IAT2sPS0=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.34/go.mod h1:ytsF+t+FApY2lFnN51fJKPhH6ICKOPXKEcwwgmJEdWI=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.37.1 h1:8wSXZ0h+Oqwe44nBX8kW5A98pgoKaI3BpolnnpuBcOA=
+github.com/aws/aws-sdk-go-v2/service/ssm v1.37.1/go.mod h1:Z4GG8XYwKzRKKtexaeWeVmPVdwRDgh+LaR5ildi4mYQ=
+github.com/aws/aws-sdk-go-v2/service/sso v1.13.1 h1:DSNpSbfEgFXRV+IfEcKE5kTbqxm+MeF5WgyeRlsLnHY=
+github.com/aws/aws-sdk-go-v2/service/sso v1.13.1/go.mod h1:TC9BubuFMVScIU+TLKamO6VZiYTkYoEHqlSQwAe2omw=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.15.1 h1:hd0SKLMdOL/Sl6Z0np1PX9LeH2gqNtBe0MhTedA8MGI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.15.1/go.mod h1:XO/VcyoQ8nKyKfFW/3DMsRQXsfh/052tHTWmg3xBXRg=
+github.com/aws/aws-sdk-go-v2/service/sts v1.21.1 h1:pAOJj+80tC8sPVgSDHzMYD6KLWsaLQ1kZw31PTeORbs=
+github.com/aws/aws-sdk-go-v2/service/sts v1.21.1/go.mod h1:G8SbvL0rFk4WOJroU8tKBczhsbhj2p/YY7qeJezJ3CI=
+github.com/aws/smithy-go v1.14.0/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
+github.com/aws/smithy-go v1.14.2/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
+github.com/aws/smithy-go v1.15.0 h1:PS/durmlzvAFpQHDs4wi4sNNP9ExsqZh6IlfdHXgKK8=
+github.com/aws/smithy-go v1.15.0/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/aymanbagabas/go-osc52 v1.0.3/go.mod h1:zT8H+Rk4VSabYN90pWyugflM3ZhpTZNC7cASDfUCdT4=
-github.com/aymanbagabas/go-osc52 v1.2.1/go.mod h1:zT8H+Rk4VSabYN90pWyugflM3ZhpTZNC7cASDfUCdT4=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/bep/debounce v1.2.1 h1:v67fRdBA9UQu2NhLFXrSg0Brw7CexQekrBwDMM8bzeY=
-github.com/bep/debounce v1.2.1/go.mod h1:H8yggRPQKLUhUoqrJC1bO2xNya7vanpDl7xR3ISbCJ0=
 github.com/bep/godartsass v1.2.0 h1:E2VvQrxAHAFwbjyOIExAMmogTItSKodoKuijNrGm5yU=
 github.com/bep/godartsass v1.2.0/go.mod h1:6LvK9RftsXMxGfsA0LDV12AGc4Jylnu6NgHL+Q5/pE8=
 github.com/bep/godartsass/v2 v2.0.0 h1:Ruht+BpBWkpmW+yAM2dkp7RSSeN0VLaTobyW0CiSP3Y=
 github.com/bep/godartsass/v2 v2.0.0/go.mod h1:AcP8QgC+OwOXEq6im0WgDRYK7scDsmZCEW62o1prQLo=
 github.com/bep/golibsass v1.1.1 h1:xkaet75ygImMYjM+FnHIT3xJn7H0xBA9UxSOJjk8Khw=
 github.com/bep/golibsass v1.1.1/go.mod h1:DL87K8Un/+pWUS75ggYv41bliGiolxzDKWJAq3eJ1MA=
-github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/bgentry/speakeasy v0.1.1-0.20220910012023-760eaf8b6816 h1:41iFGWnSlI2gVpmOtVTJZNodLdLQLn/KsJqFvXwnd/s=
+github.com/bgentry/speakeasy v0.1.1-0.20220910012023-760eaf8b6816/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bool64/shared v0.1.5 h1:fp3eUhBsrSjNCQPcSdQqZxxh9bBwrYiZ+zOKFkM0/2E=
 github.com/bramvdbogaerde/go-scp v1.2.1-0.20221219230748-977ee74ac37b h1:UJeNthMS3NHVtMFKMhzZNxdaXpYqQlbLrDRtVXorT7w=
 github.com/bramvdbogaerde/go-scp v1.2.1-0.20221219230748-977ee74ac37b/go.mod h1:s4ZldBoRAOgUg8IrRP2Urmq5qqd2yPXQTPshACY8vQ0=
-github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/bytecodealliance/wasmtime-go/v3 v3.0.2 h1:3uZCA/BLTIu+DqCfguByNMJa2HVHpXvjfy0Dy7g6fuA=
-github.com/bytedance/sonic v1.9.1 h1:6iJ6NqdoxCDr6mbY8h18oSO+cShGSMRGCEo7F2h0x8s=
+github.com/bytedance/sonic v1.10.0 h1:qtNZduETEIWJVIyDl01BeNxur2rW9OwTQ/yBqFRkKEk=
 github.com/cakturk/go-netstat v0.0.0-20200220111822-e5b49efee7a5 h1:BjkPE3785EwPhhyuFkbINB+2a1xATwk8SNDWnJiD41g=
 github.com/cakturk/go-netstat v0.0.0-20200220111822-e5b49efee7a5/go.mod h1:jtAfVaU/2cu1+wdSRPWE2c1N2qeAA3K4RH9pYgqwets=
 github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
 github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
-github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/bubbles v0.15.0 h1:c5vZ3woHV5W2b8YZI1q7v4ZNQaPetfHuoHzx+56Z6TI=
-github.com/charmbracelet/bubbles v0.15.0/go.mod h1:Y7gSFbBzlMpUDR/XM9MhZI374Q+1p1kluf1uLl8iK74=
-github.com/charmbracelet/bubbletea v0.23.1/go.mod h1:JAfGK/3/pPKHTnAS8JIE2u9f61BjWTQY57RbT25aMXU=
-github.com/charmbracelet/bubbletea v0.23.2 h1:vuUJ9HJ7b/COy4I30e8xDVQ+VRDUEFykIjryPfgsdps=
-github.com/charmbracelet/bubbletea v0.23.2/go.mod h1:FaP3WUivcTM0xOKNmhciz60M6I+weYLF76mr1JyI7sM=
-github.com/charmbracelet/charm v0.12.4 h1:YEB64WxLvdnmmGLiejXlC/e4hAd4a5SY4TqW8bdErv4=
-github.com/charmbracelet/charm v0.12.4/go.mod h1:BOvE692iyhnFctYs6Es3gb7xjx/JBgKpR9gxUmqXo3A=
 github.com/charmbracelet/glamour v0.6.0 h1:wi8fse3Y7nfcabbbDuwolqTqMQPMnVPeZhDM273bISc=
 github.com/charmbracelet/glamour v0.6.0/go.mod h1:taqWV4swIMMbWALc0m7AfE9JkPSU8om2538k9ITBxOc=
-github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
-github.com/charmbracelet/lipgloss v0.6.0/go.mod h1:tHh2wr34xcHjC2HCXIlGSG1jaDF0S0atAUvBMP6Ppuk=
-github.com/charmbracelet/lipgloss v0.7.1 h1:17WMwi7N1b1rVWOjMT+rCh7sQkvDU75B2hbZpc5Kc1E=
-github.com/charmbracelet/lipgloss v0.7.1/go.mod h1:yG0k3giv8Qj8edTCbbg6AlQ5e8KNWpFujkNawKNhE2c=
+github.com/charmbracelet/lipgloss v0.8.0 h1:IS00fk4XAHcf8uZKc3eHeMUTCxUH6NkaTrdyCQk84RU=
+github.com/charmbracelet/lipgloss v0.8.0/go.mod h1:p4eYUZZJ/0oXTuCQKFF8mqyKCz0ja6y+7DniDDw5KKU=
 github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E=
-github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 h1:qSGYFH7+jGhDF8vLC+iwCD4WpbV1EBDSzWkJODFLams=
+github.com/chenzhuoyu/base64x v0.0.0-20230717121745-296ad89f973d h1:77cEq6EriyTZ0g/qfRdp61a3Uu/AWrgIq2s0ClJV1g0=
+github.com/chenzhuoyu/iasm v0.9.0 h1:9fhXjVzq5hUy2gkhhgHl95zG2cEAhw9OSGs8toWWAwo=
+github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89 h1:aPflPkRFkVwbW6dmcVqfgwp1i+UWGFH6VgR1Jim5Ygc=
+github.com/chromedp/cdproto v0.0.0-20230802225258-3cf4e6d46a89/go.mod h1:GKljq0VrfU4D5yc+2qA6OVr8pmO/MBbPEWqWQ/oqGEs=
+github.com/chromedp/chromedp v0.9.2 h1:dKtNz4kApb06KuSXoTQIyUC2TrA0fhGDwNZf3bcgfKw=
+github.com/chromedp/chromedp v0.9.2/go.mod h1:LkSXJKONWTCHAfQasKFUZI+mxqS4tZqhmtGzzhLsnLs=
+github.com/chromedp/sysutil v1.0.0 h1:+ZxhTpfpZlmchB58ih/LBHX52ky7w2VhQVKQMucy3Ic=
+github.com/chromedp/sysutil v1.0.0/go.mod h1:kgWmDdq8fTzXYcKIBqIYvRRTnYb9aNS9moAV0xufSww=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
-github.com/cilium/ebpf v0.8.1/go.mod h1:f5zLIM0FSNuAkSyLAN7X+Hy6yznlF1mNiWUMfxMtrgk=
-github.com/cilium/ebpf v0.9.3 h1:5KtxXZU+scyERvkJMEm16TbScVvuuMrlhPly78ZMbSc=
-github.com/clbanning/mxj/v2 v2.5.7 h1:7q5lvUpaPF/WOkqgIDiwjBJaznaLCCBd78pi8ZyAnE0=
-github.com/clbanning/mxj/v2 v2.5.7/go.mod h1:hNiWqW14h+kc+MdF9C6/YoRfjEJoR3ou6tn/Qo+ve2s=
+github.com/cilium/ebpf v0.10.0 h1:nk5HPMeoBXtOzbkZBWym+ZWq1GIiHUsBFXxwewXAHLQ=
+github.com/clbanning/mxj/v2 v2.7.0 h1:WA/La7UGCanFe5NpHF0Q3DNtnCsVoxbPKuyBNHWRyME=
+github.com/clbanning/mxj/v2 v2.7.0/go.mod h1:hNiWqW14h+kc+MdF9C6/YoRfjEJoR3ou6tn/Qo+ve2s=
 github.com/cli/safeexec v1.0.0/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=
 github.com/cli/safeexec v1.0.1 h1:e/C79PbXF4yYTN/wauC4tviMxEV13BwljGj0N9j+N00=
 github.com/cli/safeexec v1.0.1/go.mod h1:Z/D4tTN8Vs5gXYHDCbaM1S/anmEDnJb1iW0+EJ5zx3Q=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I=
 github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
 github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/codeclysm/extract/v3 v3.1.1 h1:iHZtdEAwSTqPrd+1n4jfhr1qBhUWtHlMTjT90+fJVXg=
 github.com/codeclysm/extract/v3 v3.1.1/go.mod h1:ZJi80UG2JtfHqJI+lgJSCACttZi++dHxfWuPaMhlOfQ=
 github.com/coder/flog v1.1.0 h1:kbAes1ai8fIS5OeV+QAnKBQE22ty1jRF/mcAwHpLBa4=
@@ -192,24 +226,29 @@ github.com/coder/go-scim/pkg/v2 v2.0.0-20230221055123-1d63c1222136 h1:0RgB61LcNs
 github.com/coder/go-scim/pkg/v2 v2.0.0-20230221055123-1d63c1222136/go.mod h1:VkD1P761nykiq75dz+4iFqIQIZka189tx1BQLOp0Skc=
 github.com/coder/gvisor v0.0.0-20230714132058-be2e4ac102c3 h1:gtuDFa+InmMVUYiurBV+XYu24AeMGv57qlZ23i6rmyE=
 github.com/coder/gvisor v0.0.0-20230714132058-be2e4ac102c3/go.mod h1:pzr6sy8gDLfVmDAg8OYrlKvGEHw5C3PGTiBXBTCx76Q=
+github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 h1:3A0ES21Ke+FxEM8CXx9n47SZOKOpgSE1bbJzlE4qPVs=
+github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0/go.mod h1:5UuS2Ts+nTToAMeOjNlnHFkPahrtDkmpydBen/3wgZc=
 github.com/coder/retry v1.4.0 h1:g0fojHFxcdgM3sBULqgjFDxw1UIvaCqk4ngUDu0EWag=
 github.com/coder/retry v1.4.0/go.mod h1:blHMk9vs6LkoRT9ZHyuZo360cufXEhrxqvEzeMtRGoY=
 github.com/coder/ssh v0.0.0-20230621095435-9a7e23486f1c h1:TI7TzdFI0UvQmwgyQhtI1HeyYNRxAQpr8Tw/rjT8VSA=
 github.com/coder/ssh v0.0.0-20230621095435-9a7e23486f1c/go.mod h1:aGQbuCLyhRLMzZF067xc84Lh7JDs1FKwCmF1Crl9dxQ=
-github.com/coder/tailscale v0.0.0-20230731105344-d1b7f8087191 h1:FweUPlasdC67APP0jS8LTUdVlWcl49cX4NqTkr0ZL/4=
-github.com/coder/tailscale v0.0.0-20230731105344-d1b7f8087191/go.mod h1:jpg+77g19FpXL43U1VoIqoSg1K/Vh5CVxycGldQ8KhA=
-github.com/coder/terraform-provider-coder v0.11.1 h1:1sXcHfQrX8XhmLbtKxBED2lZ5jk3/ezBtaw6uVhpJZ4=
-github.com/coder/terraform-provider-coder v0.11.1/go.mod h1:UIfU3bYNeSzJJvHyJ30tEKjD6Z9utloI+HUM/7n94CY=
-github.com/coder/wgtunnel v0.1.5 h1:WP3sCj/3iJ34eKvpMQEp1oJHvm24RYh0NHbj1kfUKfs=
-github.com/coder/wgtunnel v0.1.5/go.mod h1:bokoUrHnUFY4lu9KOeSYiIcHTI2MO1KwqumU4DPDyJI=
-github.com/containerd/console v1.0.3 h1:lIr7SlA5PxZyMV30bDW0MGbiOPXwc63yRuCP0ARubLw=
+github.com/coder/tailscale v1.1.1-0.20230921183700-c821c9c9966d h1:Y2nq36GM7lKzjrM2pi3BnjS4BNGDTJqkqhMMYAUl+YE=
+github.com/coder/tailscale v1.1.1-0.20230921183700-c821c9c9966d/go.mod h1:L8tPrwSi31RAMEMV8rjb0vYTGs7rXt8rAHbqY/p41j4=
+github.com/coder/terraform-provider-coder v0.12.2 h1:KsnJLHyTtELvV1Rzkm75iCQ7npXjL0KcoU3NTreagZU=
+github.com/coder/terraform-provider-coder v0.12.2/go.mod h1:+BHer8AX5Y0QqZS9viau+ZkDTaOCOE3ga1lx1QIJDrk=
+github.com/coder/wgtunnel v0.1.12 h1:j3v1Q7qyplrRyyNPm0DK50d3O3flboIErxBFhm4NCkA=
+github.com/coder/wgtunnel v0.1.12/go.mod h1:QzfptVUdEO+XbkzMKx1kw13i9wwpJlfI1RrZ6SNZ0hA=
+github.com/coder/wireguard-go v0.0.0-20230807234434-d825b45ccbf5 h1:eDk/42Kj4xN4yfE504LsvcFEo3dWUiCOaBiWJ2uIH2A=
+github.com/coder/wireguard-go v0.0.0-20230807234434-d825b45ccbf5/go.mod h1:QRIcq2+DbdIC5sKh/gcAZhuqu6WT6L6G8/ALPN5wqYw=
+github.com/coder/wireguard-go v0.0.0-20230920225835-b7d43c468619 h1:Ug4+d7ooZNjQPVHL+zrHF2hLCr0FOpxHdB2Urr77VmY=
+github.com/coder/wireguard-go v0.0.0-20230920225835-b7d43c468619/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4=
 github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
-github.com/containerd/continuity v0.4.1 h1:wQnVrjIyQ8vhU2sgOiL5T07jo+ouqc2bnKsv5/EqGhU=
-github.com/containerd/continuity v0.4.1/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
+github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM=
+github.com/containerd/continuity v0.4.2/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
 github.com/coreos/go-iptables v0.6.0 h1:is9qnZMPYjLd8LYqmm/qlE+wwEgJIkTYdhV3rfZo4jk=
 github.com/coreos/go-iptables v0.6.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
-github.com/coreos/go-oidc/v3 v3.6.0 h1:AKVxfYw1Gmkn/w96z0DbT/B/xFnzTd3MkZvWLjF4n/o=
-github.com/coreos/go-oidc/v3 v3.6.0/go.mod h1:ZpHUsHBucTUj6WOkrP4E20UPynbLZzhTQ1XKCXkxyPc=
+github.com/coreos/go-oidc/v3 v3.7.0 h1:FTdj0uexT4diYIPlF4yoFVI5MRO1r5+SEcIpEw9vC0o=
+github.com/coreos/go-oidc/v3 v3.7.0/go.mod h1:yQzSCqBnK3e6Fs5l+f5i0F8Kwf0zpH9bPEsbY00KanM=
 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=
 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
@@ -221,28 +260,38 @@ github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr
 github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/dave/dst v0.27.2 h1:4Y5VFTkhGLC1oddtNwuxxe36pnyLxMFXT51FOzH8Ekc=
 github.com/dave/dst v0.27.2/go.mod h1:jHh6EOibnHgcUW3WjKHisiooEkYwqpHLBSX1iOBhEyc=
-github.com/dave/jennifer v1.5.0 h1:HmgPN93bVDpkQyYbqhCHj5QlgvUkvEOzMyEvKLgCRrg=
+github.com/dave/jennifer v1.6.1 h1:T4T/67t6RAA5AIV6+NP8Uk/BIsXgDoqEowgycdQQLuk=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgraph-io/badger/v3 v3.2103.5 h1:ylPa6qzbjYRQMU6jokoj4wzcaweHylt//CH0AKt0akg=
 github.com/dgraph-io/ristretto v0.1.1 h1:6CWw5tJNgpegArSHpNHJKldNeq03FQCwYvfMVWajOK8=
+github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
+github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 h1:fAjc9m62+UWV/WAFKLNi6ZS0675eEUC9y3AlwSbQu1Y=
 github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48 h1:fRzb/w+pyskVMQ+UbP35JkH8yB7MYb4q/qhBarqZE6g=
 github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
 github.com/dhui/dktest v0.3.16 h1:i6gq2YQEtcrjKbeJpBkWjE8MmLZPYllcjOFbTZuPDnw=
+github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
+github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
 github.com/dlclark/regexp2 v1.7.0 h1:7lJfhqlPssTb1WQx4yvTHN0uElPEv52sbaECrAQxjAo=
 github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/docker/cli v20.10.17+incompatible h1:eO2KS7ZFeov5UJeaDmIs1NFEDRf32PaqRpvoEkKBy5M=
-github.com/docker/cli v20.10.17+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v23.0.5+incompatible h1:ufWmAOuD3Vmr7JP2G5K3cyuNC4YZWiAsuDEvFVVDafE=
+github.com/docker/cli v23.0.5+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
-github.com/docker/docker v23.0.3+incompatible h1:9GhVsShNWz1hO//9BNg/dpMnZW25KydO4wtVxWAIbho=
-github.com/docker/docker v23.0.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v23.0.5+incompatible h1:DaxtlTJjFSnLOXVNUBU1+6kXGz2lpDoEAH6QoxaSg8k=
+github.com/docker/docker v23.0.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dvyukov/go-fuzz v0.0.0-20210103155950-6a8e9d1f2415/go.mod h1:11Gm+ccJnvAhCNLlf5+cS9KjtbaD5I5zaZpFMsTHWTw=
+github.com/ebitengine/purego v0.5.0-alpha.1 h1:0gVgWGb8GjKYs7cufvfNSleJAD00m2xWC26FMwOjNrw=
+github.com/ebitengine/purego v0.5.0-alpha.1/go.mod h1:ah1In8AOtksoNK6yk5z1HTJeUkC1Ez4Wk2idgGslMwQ=
 github.com/elastic/go-sysinfo v1.11.0 h1:QW+6BF1oxBoAprH3w2yephF7xLkrrSXj7gl2xC2BM4w=
 github.com/elastic/go-sysinfo v1.11.0/go.mod h1:6KQb31j0QeWBDF88jIdWSxE8cwoOB9tO4Y4osN7Q70E=
 github.com/elastic/go-windows v1.0.0 h1:qLURgZFkkrYyTTkvYpsZIgf83AUsdIHfvlJaqaZ7aSY=
@@ -252,10 +301,7 @@ github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.m
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fanliao/go-promise v0.0.0-20141029170127-1890db352a72/go.mod h1:PjfxuH4FZdUyfMdtBio2lsRr1AKEaVPwelzuHuh8Lqc=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
@@ -264,14 +310,17 @@ github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
 github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4=
 github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94=
+github.com/felixge/httpsnoop v1.0.2/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
+github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fergusstrange/embedded-postgres v1.24.0 h1:WqXbmYrBeT5JfNWQ8Qa+yHa5YJO/0sBIgL9k5rn3dFk=
+github.com/fergusstrange/embedded-postgres v1.24.0/go.mod h1:wL562t1V+iuFwq0UcgMi2e9rp8CROY9wxWZEfP8Y874=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
 github.com/foxcpp/go-mockdns v1.0.0 h1:7jBqxd3WDWwi/6WhDvacvH1XsN3rOLXyHM1uhvIx6FI=
 github.com/frankban/quicktest v1.7.2/go.mod h1:jaStnuzAqU1AJdCO0l53JDCJrVDKcS03DbaAcR7Ks/o=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
-github.com/frankban/quicktest v1.14.0/go.mod h1:NeW+ay9A/U67EYXNFA1nPE8e/tnQv/09mUdL/ijj8og=
 github.com/frankban/quicktest v1.14.2/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps=
-github.com/frankban/quicktest v1.14.5 h1:dfYrrRyLtiqT9GyKXgdh+k4inNeTvmGbuSgZ3lx3GhA=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa h1:RDBNVkRviHZtvDvId8XSGPu3rmpmSe+wKRcEWNgsfWU=
 github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
 github.com/fxamacker/cbor/v2 v2.4.0 h1:ri0ArlOR+5XunOP8CRUowT0pSJOwhW098ZCUyskZD88=
@@ -280,23 +329,22 @@ github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q
 github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
 github.com/gen2brain/beeep v0.0.0-20220402123239-6a3042f4b71a h1:fwNLHrP5Rbg/mGSXCjtPdpbqv2GucVTA/KMi8wEm6mE=
 github.com/gen2brain/beeep v0.0.0-20220402123239-6a3042f4b71a/go.mod h1:/WeFVhhxMOGypVKS0w8DUJxUBbHypnWkUVnW7p5c9Pw=
-github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwvtwp4M=
 github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg=
-github.com/gin-gonic/gin v1.9.1/go.mod h1:hPrL7YrpYKXt5YId3A/Tnip5kqbEAP+KLuI3SUcPTeU=
 github.com/github/fakeca v0.1.0 h1:Km/MVOFvclqxPM9dZBC4+QE564nU4gz4iZ0D9pMw28I=
 github.com/github/fakeca v0.1.0/go.mod h1:+bormgoGMMuamOscx7N91aOuUST7wdaJ2rNjeohylyo=
-github.com/go-chi/chi v1.5.4 h1:QHdzF2szwjqVV4wmByUnTcsbIg7UGaQ0tPF2t5GcAIs=
-github.com/go-chi/chi v1.5.4/go.mod h1:uaf8YgoFazUOkPBG7fxPftUylNumIev9awIWOENIuEg=
-github.com/go-chi/chi/v5 v5.0.8 h1:lD+NLqFcAi1ovnVZpsnObHGW4xb4J8lNmoYVfECH1Y0=
+github.com/go-chi/chi/v5 v5.0.0/go.mod h1:BBug9lr0cqtdAhsu6R4AAdvufI0/XBzAQSsUqJpoZOs=
 github.com/go-chi/chi/v5 v5.0.8/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
+github.com/go-chi/chi/v5 v5.0.10 h1:rLz5avzKpjqxrYwXNfmjkrYYXOyLJd37pz53UFHC6vk=
+github.com/go-chi/chi/v5 v5.0.10/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
 github.com/go-chi/cors v1.2.1 h1:xEC8UT3Rlp2QuWNEr4Fs/c2EAGVKBwy/1vHx3bppil4=
 github.com/go-chi/cors v1.2.1/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
-github.com/go-chi/httprate v0.7.1 h1:d5kXARdms2PREQfU4pHvq44S6hJ1hPu4OXLeBKmCKWs=
-github.com/go-chi/httprate v0.7.1/go.mod h1:6GOYBSwnpra4CQfAKXu8sQZg+nZ0M1g9QnyFvxrAB8A=
+github.com/go-chi/hostrouter v0.2.0 h1:GwC7TZz8+SlJN/tV/aeJgx4F+mI5+sp+5H1PelQUjHM=
+github.com/go-chi/hostrouter v0.2.0/go.mod h1:pJ49vWVmtsKRKZivQx0YMYv4h0aX+Gcn6V23Np9Wf1s=
+github.com/go-chi/httprate v0.7.4 h1:a2GIjv8he9LRf3712zxxnRdckQCm7I8y8yQhkJ84V6M=
+github.com/go-chi/httprate v0.7.4/go.mod h1:6GOYBSwnpra4CQfAKXu8sQZg+nZ0M1g9QnyFvxrAB8A=
 github.com/go-chi/render v1.0.1 h1:4/5tis2cKaNdnv9zFLfXzcquC9HbeZgCnxGnKrltBS8=
 github.com/go-chi/render v1.0.1/go.mod h1:pq4Rr7HbnsdaeHagklXub+p6Wd16Af5l9koip1OvJns=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
@@ -306,23 +354,30 @@ github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
 github.com/go-jose/go-jose/v3 v3.0.0 h1:s6rrhirfEP/CGIoc6p+PZAeogN2SxKav6Wp7+dyMWVo=
 github.com/go-jose/go-jose/v3 v3.0.0/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
+github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.1/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
-github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
+github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.0/go.mod h1:YkVgnZu1ZjjL7xTxrfm/LLZBfkhTqSR1ydtm6jTKKwI=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
-github.com/go-openapi/jsonreference v0.20.0 h1:MYlu0sBgChmCfJxxUKZ8g1cPWFOB37YSZqewK7OKeyA=
+github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
+github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
 github.com/go-openapi/jsonreference v0.20.0/go.mod h1:Ag74Ico3lPc+zR+qjn4XBUmXymS4zJbYVCZmcgkasdo=
+github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
+github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
 github.com/go-openapi/spec v0.20.6 h1:ich1RQ3WDbfoeTqTAb+5EIxNmpKVJZWBNah9RAT0jIQ=
 github.com/go-openapi/spec v0.20.6/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
-github.com/go-openapi/swag v0.19.15 h1:D2NRCBzS9/pEY3gP9Nl8aDqGUcPFrwG2p+CNFrLyrCM=
 github.com/go-openapi/swag v0.19.15/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
+github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
+github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
 github.com/go-ping/ping v1.1.0 h1:3MCGhVX4fyEUuhsfwPrsEdQw6xspHkv5zHsiSoDFZYw=
 github.com/go-ping/ping v1.1.0/go.mod h1:xIFjORFzTxqIV/tDVGO4eDy/bLuSyawEeojSm3GfRGk=
 github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
@@ -334,10 +389,11 @@ github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
 github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GOhaH6EGOAJShg8Id5JGkI=
-github.com/go-playground/validator/v10 v10.14.0 h1:vgvQWe3XCz3gIeFDm/HnTIbj6UGmg/+t63MyGU2n5js=
-github.com/go-playground/validator/v10 v10.14.0/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
-github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
+github.com/go-playground/validator/v10 v10.15.1 h1:BSe8uhN+xQ4r5guV/ywQI4gO59C2raYcGffYWZEjZzM=
+github.com/go-playground/validator/v10 v10.15.1/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
+github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
 github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
 github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
@@ -352,8 +408,8 @@ github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6Wezm
 github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
-github.com/gobwas/ws v1.1.0 h1:7RFti/xnNkMJnrK7D1yQ/iCIB5OrrY/54/H930kIbHA=
-github.com/gobwas/ws v1.1.0/go.mod h1:nzvNcVha5eUziGrbxFCo6qFIojQHjJV5cLYIbezhfL0=
+github.com/gobwas/ws v1.2.1 h1:F2aeBZrm2NDsc7vbovKrWSogd4wvfAxg0FQ89/iqOTk=
+github.com/gobwas/ws v1.2.1/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
@@ -363,10 +419,8 @@ github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
 github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/gohugoio/hugo v0.116.0 h1:hUxu+nTFBi+fkQef5HBxmpxunzqnB9e5e7g6kdj+3Oc=
-github.com/gohugoio/hugo v0.116.0/go.mod h1:Xg+aNZZj+wHiGiSVbaPAv3Y+FnpL5GXPvviQy/JrrXs=
-github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
-github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
+github.com/gohugoio/hugo v0.119.0 h1:kQha6WHt5GcCbI2PELB5KjWMHFJ8LJLrh3lusxnmCng=
+github.com/gohugoio/hugo v0.119.0/go.mod h1:pXwmL2lFumAkr3qS2D262seu4SWDLphQLvYfhdGdLRU=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-migrate/migrate/v4 v4.16.0 h1:FU2GR7EdAO0LmhNLcKthfDzuYCtMcWNR7rUbZjsgH3o=
@@ -423,16 +477,22 @@ github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-github/v43 v43.0.1-0.20220414155304-00e42332e405 h1:DdHws/YnnPrSywrjNYu2lEHqYHWp/LnEx56w59esd54=
 github.com/google/go-github/v43 v43.0.1-0.20220414155304-00e42332e405/go.mod h1:4RgUDSnsxP19d65zJWqvqJ/poJxBCvmna50eXmIvoR8=
 github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/nftables v0.1.1-0.20230115205135-9aa6fdf5a28c h1:06RMfw+TMMHtRuUOroMeatRCCgSMWXCJQeABvHU69YQ=
+github.com/google/nftables v0.1.1-0.20230115205135-9aa6fdf5a28c/go.mod h1:BVIYo3cdnT4qSylnYqcd5YtmXhr51cJPGtnLBe/uLBU=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -443,32 +503,31 @@ github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20230817174616-7a8ec2ada47b h1:h9U78+dx9a4BKdQkBBos92HalKpaGKHrp+3Uo6yTodo=
+github.com/google/pprof v0.0.0-20230817174616-7a8ec2ada47b/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/s2a-go v0.1.4 h1:1kZ/sQM3srePvKs3tXAvQzo66XfcReoqFpIpIccE7Oc=
-github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
+github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
+github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.2.5 h1:UR4rDjcgpgEnqpIEvkiqTYKBCKLNmlge2eVjoZfySzM=
-github.com/googleapis/enterprise-certificate-proxy v0.2.5/go.mod h1:RxW0N9901Cko1VOCW3SXCpWP+mlIEkk2tP7jnHy9a3w=
+github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.1 h1:SBWmZhjUDRorQxrN0nwzf+AHBxnbFjViHQS4P0yVpmQ=
+github.com/googleapis/enterprise-certificate-proxy v0.3.1/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
 github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
-github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/css v1.0.0 h1:BQqNyPTi50JCFMTw/b67hByjMVXZRwGha6wxVGkeihY=
 github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl60c=
 github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.15.1 h1:I6ITHEanAwjB0FvaxmGm8pKqmCLR7QIe05ZmO4QAXMw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.15.1/go.mod h1:gYC+WX4YJFarA2ie73G2epzt7TBWpo9pzcBnK1g0MSw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.0 h1:RtRsiaGvWxcwd8y3BiRZxsylPT8hLWZ5SPcfI+3IDNk=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.18.0/go.mod h1:TzP6duP4Py2pHLVPPQp42aoYI92+PCrVotyR5e8Vqlk=
 github.com/h2non/filetype v1.1.3 h1:FKkx9QbD7HR/zjK1Ia5XiBsq9zdLi5Kf3zGyFTAFkGg=
 github.com/h2non/filetype v1.1.3/go.mod h1:319b3zT68BvV+WRj7cwy856M2ehB3HqNOt6sy1HndBY=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -479,8 +538,8 @@ github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9n
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320 h1:1/D3zfFHttUKaCaGKZ/dR2roBXv0vKbSCnssIldfQdI=
 github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320/go.mod h1:EiZBMaudVLy8fmjf9Npq1dq9RalhveqZG5w/yz3mHWs=
-github.com/hashicorp/go-hclog v1.2.1 h1:YQsLlGDJgwhXFpucSPyVbCBviQtjlHv3jLTlp8YmtEw=
-github.com/hashicorp/go-hclog v1.2.1/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
+github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-plugin v1.4.4 h1:NVdrSdFRt3SkZtNckJ6tog7gbpRrcbOjQi/rgF7JYWQ=
@@ -491,21 +550,21 @@ github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/b
 github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru/v2 v2.0.1 h1:5pv5N1lT1fjLg2VQ5KWc7kmucp2x/kvFOnxuVTqZ6x4=
-github.com/hashicorp/golang-lru/v2 v2.0.1/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
-github.com/hashicorp/hc-install v0.5.2 h1:SfwMFnEXVVirpwkDuSF5kymUOhrUxrTq3udEseZdOD0=
-github.com/hashicorp/hc-install v0.5.2/go.mod h1:9QISwe6newMWIfEiXpzuu1k9HAGtQYgnSH8H9T8wmoI=
+github.com/hashicorp/golang-lru/v2 v2.0.3 h1:kmRrRLlInXvng0SmLxmQpQkpbYAvcXm7NPDrgxJa9mE=
+github.com/hashicorp/golang-lru/v2 v2.0.3/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/hc-install v0.6.0 h1:fDHnU7JNFNSQebVKYhHZ0va1bC6SrPQ8fpebsvNr2w4=
+github.com/hashicorp/hc-install v0.6.0/go.mod h1:10I912u3nntx9Umo1VAeYPUUuehk0aRQJYpMwbX5wQA=
 github.com/hashicorp/hcl v0.0.0-20170504190234-a4b07c25de5f/go.mod h1:oZtUIOe8dh44I2q6ScRibXws4Ajl+d+nod3AaR9vL5w=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/hcl v1.0.1-vault-5 h1:kI3hhbbyzr4dldA8UdTb7ZlVVlI2DACdCfz31RPDgJM=
+github.com/hashicorp/hcl v1.0.1-vault-5/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
 github.com/hashicorp/hcl/v2 v2.0.0/go.mod h1:oVVDG71tEinNGYCxinCYadcmKU9bglqW9pV3txagJ90=
 github.com/hashicorp/hcl/v2 v2.17.0 h1:z1XvSUyXd1HP10U4lrLg5e0JMVz6CPaJvAgxM0KNZVY=
 github.com/hashicorp/hcl/v2 v2.17.0/go.mod h1:gJyW2PTShkJqQBKpAmPO3yxMxIuoXkOF2TpqXzrQyx4=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
 github.com/hashicorp/terraform-exec v0.17.2 h1:EU7i3Fh7vDUI9nNRdMATCEfnm9axzTnad8zszYZ73Go=
-github.com/hashicorp/terraform-json v0.17.0 h1:EiA1Wp07nknYQAiv+jIt4dX4Cq5crgP+TsTE45MjMmM=
-github.com/hashicorp/terraform-json v0.17.0/go.mod h1:Huy6zt6euxaY9knPAFKjUITn8QxUFIe9VuSzb4zn/0o=
+github.com/hashicorp/terraform-json v0.17.2-0.20230905102422-cd7b46b136bb h1:tYx6g/IihykJWZXCzn9lpPql1IrADtaMpqNY6lUifA4=
+github.com/hashicorp/terraform-json v0.17.2-0.20230905102422-cd7b46b136bb/go.mod h1:0a5tk65jPDbGo2lEMmvmwwvM0qCbOhW33hXtGrJQBgc=
 github.com/hashicorp/terraform-plugin-go v0.12.0 h1:6wW9mT1dSs0Xq4LR6HXj1heQ5ovr5GxXNJwkErZzpJw=
 github.com/hashicorp/terraform-plugin-go v0.12.0/go.mod h1:kwhmaWHNDvT1B3QiSJdAtrB/D4RaKSY/v3r2BuoWK4M=
 github.com/hashicorp/terraform-plugin-log v0.7.0 h1:SDxJUyT8TwN4l5b5/VkiTIaQgY6R+Y2BQ0sRZftGKQs=
@@ -516,45 +575,42 @@ github.com/hashicorp/terraform-registry-address v0.0.0-20220623143253-7d51757b57
 github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734 h1:HKLsbzeOsfXmKNpr3GiT18XAblV0BjCbzL8KQAMZGa0=
 github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
 github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
-github.com/hdevalence/ed25519consensus v0.0.0-20220222234857-c00d1f31bab3 h1:aSVUgRRRtOrZOC1fYmY9gV0e9z/Iu+xNVSASWjsuyGU=
-github.com/hdevalence/ed25519consensus v0.0.0-20220222234857-c00d1f31bab3/go.mod h1:5PC6ZNPde8bBqU/ewGZig35+UIZtw9Ytxez8/q5ZyFE=
+github.com/hdevalence/ed25519consensus v0.1.0 h1:jtBwzzcHuTmFrQN6xQZn6CQEO/V9f7HsjsjeEZ6auqU=
+github.com/hdevalence/ed25519consensus v0.1.0/go.mod h1:w3BHWjwJbFU29IRHL1Iqkw3sus+7FctEyM4RqDxYNzo=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
 github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02 h1:AgcIVYPa6XJnU3phs104wLj8l5GEththEw6+F79YsIY=
 github.com/hinshun/vt10x v0.0.0-20220301184237-5011da428d02/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
-github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714/go.mod h1:2Goc3h8EklBH5mspfHFxBnEoURQCGzQQH1ga9Myjvis=
-github.com/iancoleman/orderedmap v0.2.0 h1:sq1N/TFpYH++aViPcaKjys3bDClUEU7s5B+z6jq8pNA=
+github.com/iancoleman/orderedmap v0.3.0 h1:5cbR2grmZR/DiVt+VJopEhtVs9YGInGIxAoMJn+Ichc=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/illarion/gonotify v1.0.1 h1:F1d+0Fgbq/sDWjj/r66ekjDG+IDeecQKUFH4wNwsoio=
 github.com/illarion/gonotify v1.0.1/go.mod h1:zt5pmDofZpU1f8aqlK0+95eQhoEAn/d4G4B/FjVW4jE=
-github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
-github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
-github.com/insomniacslk/dhcp v0.0.0-20221215072855-de60144f33f8 h1:Z72DOke2yOK0Ms4Z2LK1E1OrRJXOxSj5DllTz2FYTRg=
-github.com/insomniacslk/dhcp v0.0.0-20221215072855-de60144f33f8/go.mod h1:m5WMe03WCvWcXjRnhvaAbAAXdCnu20J5P+mmH44ZzpE=
+github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
+github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
+github.com/insomniacslk/dhcp v0.0.0-20230407062729-974c6f05fe16 h1:+aAGyK41KRn8jbF2Q7PLL0Sxwg6dShGcQSeCC7nZQ8E=
+github.com/insomniacslk/dhcp v0.0.0-20230407062729-974c6f05fe16/go.mod h1:IKrnDWs3/Mqq5n0lI+RxA2sB7MvN/vbMBP3ehXg65UI=
 github.com/jedib0t/go-pretty/v6 v6.4.0 h1:YlI/2zYDrweA4MThiYMKtGRfT+2qZOO65ulej8GTcVI=
 github.com/jedib0t/go-pretty/v6 v6.4.0/go.mod h1:MgmISkTWDSFu0xOqiZ0mKNntMQ2mDgOcwOkwBEkMDJI=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
 github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
 github.com/joeshaw/multierror v0.0.0-20140124173710-69b34d4ec901 h1:rp+c0RAYOWj8l6qbCUTSiRLG/iKnW3K3/QfPPuSsBt4=
 github.com/joeshaw/multierror v0.0.0-20140124173710-69b34d4ec901/go.mod h1:Z86h9688Y0wesXCyonoVr47MasHilkuLMqGhRZ4Hpak=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
-github.com/josharian/native v1.0.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/josharian/native v1.0.1-0.20221213033349-c1e37c09b531/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86 h1:elKwZS1OcdQ0WwEDBeqxKwb7WB62QX8bvZ/FJnVXIfk=
 github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86/go.mod h1:aFAMtuldEgx/4q7iSGazk22+IcgvtiC+HIimFO9XlS8=
-github.com/jsimonetti/rtnetlink v0.0.0-20190606172950-9527aa82566a/go.mod h1:Oz+70psSo5OFh8DBl0Zv2ACw7Esh6pPUphlvZG9x7uw=
-github.com/jsimonetti/rtnetlink v0.0.0-20200117123717-f846d4f6c1f4/go.mod h1:WGuG/smIU4J/54PblvSbh+xvCZmpJnFgr3ds6Z55XMQ=
-github.com/jsimonetti/rtnetlink v0.0.0-20201009170750-9c6f07d100c1/go.mod h1:hqoO/u39cqLeBLebZ8fWdE96O7FxrAsRYhnVOdgHxok=
-github.com/jsimonetti/rtnetlink v0.0.0-20201110080708-d2c240429e6c/go.mod h1:huN4d1phzjhlOsNIjFsw2SVRbwIHj3fJDMEU2SDPTmg=
-github.com/jsimonetti/rtnetlink v1.1.2-0.20220408201609-d380b505068b h1:Yws7RV6kZr2O7PPdT+RkbSmmOponA8i/1DuGHe8BRsM=
-github.com/jsimonetti/rtnetlink v1.1.2-0.20220408201609-d380b505068b/go.mod h1:TzDCVOZKUa79z6iXbbXqhtAflVgUKaFkZ21M5tK5tzY=
+github.com/jsimonetti/rtnetlink v1.3.2 h1:dcn0uWkfxycEEyNy0IGfx3GrhQ38LH7odjxAghimsVI=
+github.com/jsimonetti/rtnetlink v1.3.2/go.mod h1:BBu4jZCpTjP6Gk0/wfrO8qcqymnN3g0hoFqObRmUo6U=
 github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/juju/errors v1.0.0 h1:yiq7kjCLll1BiaRuNY53MGI0+EQ3rF6GB+wvboZDefM=
 github.com/juju/errors v1.0.0/go.mod h1:B5x9thDqx0wIMH3+aLIMP9HjItInYWObRovoCFM5Qe8=
 github.com/justinas/nosurf v1.1.1 h1:92Aw44hjSK4MxJeMSyDa7jwuI9GR2J/JCQiaKvXXSlk=
@@ -566,9 +622,9 @@ github.com/kirsle/configdir v0.0.0-20170128060238-e45d2f54772f/go.mod h1:4rEELDS
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
-github.com/klauspost/compress v1.16.3 h1:XuJt9zzcnaz6a16/OU53ZjWp/v7/42WcR5t2a0PcNQY=
-github.com/klauspost/compress v1.16.3/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
-github.com/klauspost/cpuid/v2 v2.2.4 h1:acbojRNwl3o09bUq+yDCtZFc1aiwaAAxtcn8YkZXnvk=
+github.com/klauspost/compress v1.17.1 h1:NE3C767s2ak2bweCZo3+rdP4U/HoyVXLv/X9f2gPS5g=
+github.com/klauspost/compress v1.17.1/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/cpuid/v2 v2.2.5 h1:0E5MSMDEoAulmXNFquVs//DdoomxaoTY1kUhbc/qbZg=
 github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a h1:+RR6SqnTkDLWyICxS1xpjCi/3dhyV+TgZwA6Ww3KncQ=
 github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a/go.mod h1:YTtCCM3ryyfiu4F7t8HQ1mxvp1UBdWM2r6Xa+nGWvDk=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
@@ -581,8 +637,6 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kylecarbs/embedded-postgres v1.17.1-0.20220615202325-461532cecd3a h1:uOnis+HNE6e6eR17YlqzKk51GDahd7E/FacnZxS8h8w=
-github.com/kylecarbs/embedded-postgres v1.17.1-0.20220615202325-461532cecd3a/go.mod h1:0B+3bPsMvcNgR9nN+bdM2x9YaNYDnf3ksUqYp1OAub0=
 github.com/kylecarbs/opencensus-go v0.23.1-0.20220307014935-4d0325a68f8b h1:1Y1X6aR78kMEQE1iCjQodB3lA7VO4jB88Wf8ZrzXSsA=
 github.com/kylecarbs/opencensus-go v0.23.1-0.20220307014935-4d0325a68f8b/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 github.com/kylecarbs/readline v0.0.0-20220211054233-0d62993714c8/go.mod h1:n/KX1BZoN1m9EwoXkn/xAV4fd3k8c++gGBsgLONaPOY=
@@ -593,13 +647,14 @@ github.com/kylecarbs/terraform-config-inspect v0.0.0-20211215004401-bbc517866b88
 github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80 h1:6Yzfa6GP0rIo/kULo2bwGEkFvCePZ3qHDDTC3/J9Swo=
+github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
 github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
 github.com/leodido/go-urn v1.2.4 h1:XlAE/cm/ms7TE/VMVoduSpNBoyc2dOxHs5MZSwAN63Q=
 github.com/leodido/go-urn v1.2.4/go.mod h1:7ZrI8mTSeBSHl/UaRyKQW1qZeMgak41ANeCNaVckg+4=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.10.4/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.10.6 h1:jbk+ZieJ0D7EVGJYpL9QTz7/YW6UHbmdnZWYyK5cdBs=
-github.com/lib/pq v1.10.6/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
@@ -616,13 +671,9 @@ github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hd
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
-github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
-github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-runewidth v0.0.10/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
 github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
 github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
@@ -630,32 +681,23 @@ github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZ
 github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
 github.com/mattn/go-sqlite3 v1.14.16 h1:yOQRA0RpS5PFz/oikGwBEqvAWhWg5ufRz4ETLjwpU1Y=
-github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
-github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
-github.com/mdlayher/ethernet v0.0.0-20190606142754-0394541c37b7/go.mod h1:U6ZQobyTjI/tJyq2HG+i/dfSoFUt8/aZCM+GKtmFk/Y=
-github.com/mdlayher/genetlink v1.2.0 h1:4yrIkRV5Wfk1WfpWTcoOlGmsWgQj3OtQN9ZsbrE+XtU=
-github.com/mdlayher/genetlink v1.2.0/go.mod h1:ra5LDov2KrUCZJiAtEvXXZBxGMInICMXIwshlJ+qRxQ=
-github.com/mdlayher/netlink v0.0.0-20190409211403-11939a169225/go.mod h1:eQB3mZE4aiYnlUsyGGCOpPETfdQq4Jhsgf1fk3cwQaA=
-github.com/mdlayher/netlink v1.0.0/go.mod h1:KxeJAFOFLG6AjpyDkQ/iIhxygIUKD+vcwqcnu43w/+M=
-github.com/mdlayher/netlink v1.1.0/go.mod h1:H4WCitaheIsdF9yOYu8CFmCgQthAPIWZmcKp9uZHgmY=
-github.com/mdlayher/netlink v1.1.1/go.mod h1:WTYpFb/WTvlRJAyKhZL5/uy69TDDpHHu2VZmb2XgV7o=
-github.com/mdlayher/netlink v1.6.0/go.mod h1:0o3PlBmGst1xve7wQ7j/hwpNaFaH4qCRyWCdcZk8/vA=
-github.com/mdlayher/netlink v1.6.2 h1:D2zGSkvYsJ6NreeED3JiVTu1lj2sIYATqSaZlhPzUgQ=
-github.com/mdlayher/netlink v1.6.2/go.mod h1:O1HXX2sIWSMJ3Qn1BYZk1yZM+7iMki/uYGGiwGyq/iU=
-github.com/mdlayher/raw v0.0.0-20190606142536-fef19f00fc18/go.mod h1:7EpbotpCmVZcu+KCX4g9WaRNuu11uyhiW7+Le1dKawg=
-github.com/mdlayher/raw v0.0.0-20191009151244-50f2db8cc065/go.mod h1:7EpbotpCmVZcu+KCX4g9WaRNuu11uyhiW7+Le1dKawg=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
+github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
+github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
+github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
+github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
 github.com/mdlayher/sdnotify v1.0.0 h1:Ma9XeLVN/l0qpyx1tNeMSeTjCPH6NtuD6/N9XdTlQ3c=
 github.com/mdlayher/sdnotify v1.0.0/go.mod h1:HQUmpM4XgYkhDLtd+Uad8ZFK1T9D5+pNxnXQjCeJlGE=
-github.com/mdlayher/socket v0.1.1/go.mod h1:mYV5YIZAfHh4dzDVzI8x8tWLWCliuX8Mon5Awbj+qDs=
-github.com/mdlayher/socket v0.2.3 h1:XZA2X2TjdOwNoNPVPclRCURoX/hokBY8nkTmRZFEheM=
-github.com/mdlayher/socket v0.2.3/go.mod h1:bz12/FozYNH/VbvC3q7TRIK/Y6dH1kCKsXaUeXi/FmY=
+github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
+github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b h1:j7+1HpAFS1zy5+Q4qx1fWh90gTKwiN4QCGoY9TWyyO4=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/microcosm-cc/bluemonday v1.0.21/go.mod h1:ytNkv4RrDrLJ2pqlsSI46O6IVXmZOBBD4SaJyDwwTkM=
 github.com/microcosm-cc/bluemonday v1.0.23 h1:SMZe2IGa0NuHvnVNAZ+6B38gsTbi5e4sViiWJyDDqFY=
 github.com/microcosm-cc/bluemonday v1.0.23/go.mod h1:mN70sk7UkkF8TUr2IGBpNN0jAgStuPzlK76QuruE/z4=
-github.com/miekg/dns v1.1.45 h1:g5fRIhm9nx7g8osrAvgb16QJfmyMsyOCb+J7LSv+Qzk=
-github.com/miekg/dns v1.1.45/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
+github.com/miekg/dns v1.1.55 h1:GoQ4hpsj0nFLYe+bWiCToyrBEJXkQfOOIvFGFy0lEgo=
+github.com/miekg/dns v1.1.55/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
@@ -681,17 +723,9 @@ github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lN
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
-github.com/muesli/ansi v0.0.0-20211018074035-2e021307bc4b/go.mod h1:fQuZ0gauxyBcmsdE3ZT4NasjaRdxmbCS0jRHsrWu3Ho=
-github.com/muesli/ansi v0.0.0-20221106050444-61f0cd9a192a h1:jlDOeO5TU0pYlbc/y6PFguab5IjANI0Knrpg3u/ton4=
-github.com/muesli/ansi v0.0.0-20221106050444-61f0cd9a192a/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
-github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
-github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
-github.com/muesli/reflow v0.2.1-0.20210115123740-9e1d0d53df68/go.mod h1:Xk+z4oIWdQqJzsxyjgl3P22oYZnHdZ8FFTHAQQt5BMQ=
 github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
 github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8=
-github.com/muesli/termenv v0.11.1-0.20220204035834-5ac8409525e0/go.mod h1:Bd5NYQ7pd+SrtBSrSNoBBmXlcY8+Xj4BMJgh8qcZrvs=
 github.com/muesli/termenv v0.13.0/go.mod h1:sP1+uffeLaEYpyOTb8pLCUctGcGLnoFjSn4YJK5e2bc=
-github.com/muesli/termenv v0.14.0/go.mod h1:kG/pF1E7fh949Xhe156crRUrHNyK221IuGO7Ez60Uc8=
 github.com/muesli/termenv v0.15.2 h1:GohcuySI0QmI3wN8Ok9PtKGkgkFIk7y6Vpb5PvrY+Wo=
 github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1noLXviQ8=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
@@ -703,8 +737,8 @@ github.com/nu7hatch/gouuid v0.0.0-20131221200532-179d4d0c4d8d/go.mod h1:YUTz3bUH
 github.com/oklog/run v1.0.0 h1:Ru7dDtJNOyC66gQ5dQmaCa0qIsAUFY3sFpK1Xk8igrw=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/open-policy-agent/opa v0.55.0 h1:s7Vm4ph6zDqqP/KzvUSw9fsKVsm9lhbTZhYGxxTK7mo=
-github.com/open-policy-agent/opa v0.55.0/go.mod h1:2Vh8fj/bXCqSwGMbBiHGrw+O8yrho6T/fdaHt5ROmaQ=
+github.com/open-policy-agent/opa v0.57.0 h1:DftxYfOEHOheXvO2Q6HCIM2ZVdKrvnF4cZlU9C64MIQ=
+github.com/open-policy-agent/opa v0.57.0/go.mod h1:3FY6GNSbUqOhjCdvTXCBJ2rNuh66p/XrIc2owr/hSwo=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0-rc4 h1:oOxKUJWnFC4YGHCCMNql1x4YaDfYBTS5Y4x/Cgeo1E0=
@@ -713,10 +747,20 @@ github.com/opencontainers/runc v1.1.5 h1:L44KXEpKmfWDcS02aeGm8QNTFXTo2D+8MYGDIJ/
 github.com/opencontainers/runc v1.1.5/go.mod h1:1J5XiS+vdZ3wCyZybsuxXZWGrgSr8fFJHLXuG2PsnNg=
 github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
+github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
+github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde h1:x0TT0RDC7UhAVbbWWBzr41ElhJx5tXPWkIHA2HWPRuw=
+github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
 github.com/ory/dockertest/v3 v3.10.0 h1:4K3z2VMe8Woe++invjaTB7VRyQXQy5UY+loujO4aNE4=
 github.com/ory/dockertest/v3 v3.10.0/go.mod h1:nr57ZbRWMqfsdGdFNLHz5jjNdDb7VVFnzAeW1n5N1Lg=
-github.com/pelletier/go-toml/v2 v2.0.8 h1:0ctb6s9mE31h0/lhu+J6OPmVeDxJn+kYnJc2jZR9tGQ=
-github.com/pelletier/go-toml/v2 v2.0.8/go.mod h1:vuYfssBdrU2XDZ9bYydBu6t+6a6PYNcZljzZR9VXg+4=
+github.com/outcaste-io/ristretto v0.2.3 h1:AK4zt/fJ76kjlYObOeNwh4T3asEuaCmp26pOvUOL9w0=
+github.com/outcaste-io/ristretto v0.2.3/go.mod h1:W8HywhmtlopSB1jeMg3JtdIhf+DYkLAr0VN/s4+MHac=
+github.com/pelletier/go-toml/v2 v2.1.0 h1:FnwAJ4oYMvbT/34k9zzHuZNrhlz48GB3/s6at6/MHO4=
+github.com/pelletier/go-toml/v2 v2.1.0/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
+github.com/philhofer/fwd v1.1.2 h1:bnDivRJ1EWPjUIRXV5KfORO897HTbpFAQddBdE8t7Gw=
+github.com/philhofer/fwd v1.1.2/go.mod h1:qkPdfjR2SIEbspLqpe1tO4n5yICnr2DY7mqEx2tUTP0=
+github.com/pierrec/lz4/v4 v4.1.14/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pierrec/lz4/v4 v4.1.18 h1:xaKrnTkyoqfh1YItXl56+6KJNVYWlEEPuAQW9xsplYQ=
+github.com/pierrec/lz4/v4 v4.1.18/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pion/logging v0.2.2/go.mod h1:k0/tDVsRCX2Mb2ZEmTqNa7CWsQPc+YYCB7Q+5pahoms=
 github.com/pion/transport v0.14.1 h1:XSM6olwW+o8J4SCmOBb/BpwZypkHeyM0PGFCxNQBr40=
 github.com/pion/transport v0.14.1/go.mod h1:4tGmbk00NeYA3rUa9+n+dzCCoKkcy3YlYb99Jn2fNnI=
@@ -733,59 +777,64 @@ github.com/pkg/profile v1.6.0/go.mod h1:qBsxPvzyUincmltOk6iyRVxHYg4adc0OFOv72ZdL
 github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pkg/sftp v1.13.6-0.20221018182125-7da137aa03f0 h1:QJypP3NZEUt+ka49zyp/MSdpjjM9EYkg0WA1NZQaxT0=
 github.com/pkg/sftp v1.13.6-0.20221018182125-7da137aa03f0/go.mod h1:wHDZ0IZX6JcBYRK1TH9bcVq8G7TLpVHYIGJRFnmPfxg=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
-github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.17.0 h1:rl2sfwZMtSthVU752MqfjQozy7blglC+1SOtjMAMh+Q=
+github.com/prometheus/client_golang v1.17.0/go.mod h1:VeL+gMmOAxkS2IqfCq0ZmHSL+LjWfWDUmp1mBz9JgUY=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4=
-github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
-github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
-github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
-github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg=
-github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM=
+github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
+github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
+github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
+github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
+github.com/prometheus/procfs v0.11.1 h1:xRC8Iq1yyca5ypa9n1EZnWZkt7dwcoRPQwX/5gwaUuI=
+github.com/prometheus/procfs v0.11.1/go.mod h1:eesXgaPo1q7lBpVMoMy0ZOFTth9hBn4W/y0/p/ScXhY=
 github.com/quasilyte/go-ruleguard/dsl v0.3.21 h1:vNkC6fC6qMLzCOGbnIHOd5ixUGgTbp3Z4fGnUgULlDA=
 github.com/quasilyte/go-ruleguard/dsl v0.3.21/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
-github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 h1:MkV+77GLUNo5oJ0jf870itWm3D0Sjh7+Za9gazKc5LQ=
-github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
+github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/riandyrn/otelchi v0.5.1 h1:0/45omeqpP7f/cvdL16GddQBfAEmZvUyl2QzLSE6uYo=
+github.com/riandyrn/otelchi v0.5.1/go.mod h1:ZxVxNEl+jQ9uHseRYIxKWRb3OY8YXFEu+EkNiiSNUEA=
+github.com/richardartoul/molecule v1.0.1-0.20221107223329-32cfee06a052 h1:Qp27Idfgi6ACvFQat5+VJvlYToylpM/hcyLBI3WaKPA=
+github.com/richardartoul/molecule v1.0.1-0.20221107223329-32cfee06a052/go.mod h1:uvX/8buq8uVeiZiFht+0lqSLBHF+uGV8BrTv8W/SIwk=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
 github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sahilm/fuzzy v0.1.0/go.mod h1:VFvziUEIMCrT6A6tw2RFIXPXXmzXbOsSHF0DOI8ZK9Y=
 github.com/satori/go.uuid v1.2.1-0.20181028125025-b2ce2384e17b h1:gQZ0qzfKHQIybLANtM3mBXNUtOfsCFXeTsnBqCsx1KM=
 github.com/satori/go.uuid v1.2.1-0.20181028125025-b2ce2384e17b/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/seccomp/libseccomp-golang v0.9.2-0.20220502022130-f33da4d89646/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
+github.com/secure-systems-lab/go-securesystemslib v0.7.0 h1:OwvJ5jQf9LnIAS83waAjPbcMsODrTQUpJ02eNLUoxBg=
+github.com/secure-systems-lab/go-securesystemslib v0.7.0/go.mod h1:/2gYnlnHVQ6xeGtfIqFy7Do03K4cdCY0A/GlJLDKLHI=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
-github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/afero v1.9.5 h1:stMpOSZFs//0Lv29HduCmli3GUfpFoF3Y1Q/aXj/wVM=
-github.com/spf13/afero v1.9.5/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
+github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
+github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
+github.com/spf13/afero v1.10.0 h1:EaGW2JJh15aKOejeuJ+wpFSHnbd7GE6Wvp3TsNhb6LY=
+github.com/spf13/afero v1.10.0/go.mod h1:UBogFpq8E9Hx+xc5CNTTEpTnuHVmXDwZcZcE1eb/UhQ=
 github.com/spf13/cast v1.5.1 h1:R+kOtfhWQE6TVQzY+4D7wJLBgkdVasCEFxSUBYBYIlA=
 github.com/spf13/cast v1.5.1/go.mod h1:b9PdjNptOpzXr7Rq1q9gJML/2cdGQAo69NKzQ10KN48=
 github.com/spf13/pflag v1.0.2/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/sqlc-dev/pqtype v0.2.0 h1:zfzDpAxjCU0/GO7EgZ7ELUh0w28SrMSHzO3rH5Wd3is=
-github.com/sqlc-dev/pqtype v0.2.0/go.mod h1:oyUjp5981ctiL9UYvj1bVvCKi8OXkCa0u645hce7CAs=
+github.com/sqlc-dev/pqtype v0.3.0 h1:b09TewZ3cSnO5+M1Kqq05y0+OjqIptxELaSayg7bmqk=
+github.com/sqlc-dev/pqtype v0.3.0/go.mod h1:oyUjp5981ctiL9UYvj1bVvCKi8OXkCa0u645hce7CAs=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.1 h1:4VhoImhV/Bm0ToFkXFi8hXNXwpDRZ/ynw3amt82mzq0=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
@@ -796,30 +845,28 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
 github.com/stretchr/testify v1.7.4/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/swaggest/assertjson v1.8.1 h1:Be2EHY9S2qwKWV+xWZB747Cd7Y79YK6JLdeyrgFvyMo=
+github.com/swaggest/assertjson v1.9.0 h1:dKu0BfJkIxv/xe//mkCrK5yZbs79jL7OVf9Ija7o2xQ=
 github.com/swaggo/files/v2 v2.0.0 h1:hmAt8Dkynw7Ssz46F6pn8ok6YmGZqHSVLZ+HQM7i0kw=
 github.com/swaggo/files/v2 v2.0.0/go.mod h1:24kk2Y9NYEJ5lHuCra6iVwkMjIekMCaFq/0JQj66kyM=
 github.com/swaggo/http-swagger/v2 v2.0.1 h1:mNOBLxDjSNwCKlMxcErjjvct/xhc9t2KIO48xzz/V/k=
 github.com/swaggo/http-swagger/v2 v2.0.1/go.mod h1:XYhrQVIKz13CxuKD4p4kvpaRB4jJ1/MlfQXVOE+CX8Y=
-github.com/swaggo/swag v1.8.6 h1:2rgOaLbonWu1PLP6G+/rYjSvPg0jQE0HtrEKuE380eg=
-github.com/swaggo/swag v1.8.6/go.mod h1:jMLeXOOmYyjk8PvHTsXBdrubsNd9gUJTTCzL5iBnseg=
+github.com/swaggo/swag v1.16.2 h1:28Pp+8DkQoV+HLzLx8RGJZXNGKbFqnuvSbAAtoxiY04=
+github.com/swaggo/swag v1.16.2/go.mod h1:6YzXnDcpr0767iOejs318CwYkCQqyGer6BizOg03f+E=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
 github.com/tadvi/systray v0.0.0-20190226123456-11a2b8fa57af h1:6yITBqGTE2lEeTPG04SN9W+iWHCRyHqlVYILiSXziwk=
 github.com/tadvi/systray v0.0.0-20190226123456-11a2b8fa57af/go.mod h1:4F09kP5F+am0jAwlQLddpoMDM+iewkxxt6nxUQ5nq5o=
 github.com/tailscale/certstore v0.1.1-0.20220316223106-78d6e1c49d8d h1:K3j02b5j2Iw1xoggN9B2DIEkhWGheqFOeDkdJdBrJI8=
 github.com/tailscale/certstore v0.1.1-0.20220316223106-78d6e1c49d8d/go.mod h1:2P+hpOwd53e7JMX/L4f3VXkv1G+33ES6IWZSrkIeWNs=
-github.com/tailscale/golang-x-crypto v0.0.0-20221102133106-bc99ab8c2d17 h1:cSm67hIDABvL13S0n9TNoVhzYwjb24M46znbABLll18=
-github.com/tailscale/golang-x-crypto v0.0.0-20221102133106-bc99ab8c2d17/go.mod h1:95n9fbUCixVSI4QXLEvdKJjnYK2eUlkTx9+QwLPXFKU=
+github.com/tailscale/golang-x-crypto v0.0.0-20230713185742-f0b76a10a08e h1:JyeJF/HuSwvxWtsR1c0oKX1lzaSH5Wh4aX+MgiStaGQ=
+github.com/tailscale/golang-x-crypto v0.0.0-20230713185742-f0b76a10a08e/go.mod h1:DjoeCULdP6vTJ/xY+nzzR9LaUHprkbZEpNidX0aqEEk=
 github.com/tailscale/goupnp v1.0.1-0.20210804011211-c64d0f06ea05 h1:4chzWmimtJPxRs2O36yuGRW3f9SYV+bMTTvMBI0EKio=
 github.com/tailscale/goupnp v1.0.1-0.20210804011211-c64d0f06ea05/go.mod h1:PdCqy9JzfWMJf1H5UJW2ip33/d4YkoKN0r67yKH1mG8=
 github.com/tailscale/netlink v1.1.1-0.20211101221916-cabfb018fe85 h1:zrsUcqrG2uQSPhaUPjUQwozcRdDdSxxqhNgNZ3drZFk=
 github.com/tailscale/netlink v1.1.1-0.20211101221916-cabfb018fe85/go.mod h1:NzVQi3Mleb+qzq8VmcWpSkcSYxXIg0DkI6XDzpVkhJ0=
-github.com/tailscale/wireguard-go v0.0.0-20221219190806-4fa124729667 h1:etWp6uUwKu8NEj37K2OuMBnZ7EnVMKA7gJg5AqPFy/o=
-github.com/tailscale/wireguard-go v0.0.0-20221219190806-4fa124729667/go.mod h1:iiClgxBTruKI+nmzlQxbFw6c3nB/wb4Td/WCyX2berY=
 github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BGhTkes=
 github.com/tchap/go-patricia/v2 v2.3.1/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
 github.com/tdewolff/parse/v2 v2.6.6 h1:Yld+0CrKUJaCV78DL1G2nk3C9lKrxyRTux5aaK/AkDo=
@@ -827,12 +874,21 @@ github.com/tdewolff/parse/v2 v2.6.6/go.mod h1:woz0cgbLwFdtbjJu8PIKxhW05KplTFQkOd
 github.com/tdewolff/test v1.0.7/go.mod h1:6DAvZliBAAnD7rhVgwaM7DE5/d9NMOAJ09SqYqeK4QE=
 github.com/tdewolff/test v1.0.9 h1:SswqJCmeN4B+9gEAi/5uqT0qpi1y2/2O47V/1hhGZT0=
 github.com/tdewolff/test v1.0.9/go.mod h1:6DAvZliBAAnD7rhVgwaM7DE5/d9NMOAJ09SqYqeK4QE=
+github.com/tidwall/gjson v1.17.0 h1:/Jocvlh98kcTfpN2+JzGQWQcqrPQwDrVEMApx/M5ZwM=
+github.com/tidwall/gjson v1.17.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tinylib/msgp v1.1.8 h1:FCXC1xanKO4I8plpHGH2P7koL/RzZs12l/+r7vakfm0=
+github.com/tinylib/msgp v1.1.8/go.mod h1:qkpG+2ldGg4xRFmx+jfTvZPxfGFhi64BcnL9vkCm/Tw=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/u-root/gobusybox/src v0.0.0-20221229083637-46b2883a7f90 h1:zTk5683I9K62wtZ6eUa6vu6IWwVHXPnoKK5n2unAwv0=
 github.com/u-root/u-root v0.11.0 h1:6gCZLOeRyevw7gbTwMj3fKxnr9+yHFlgF3N7udUVNO8=
 github.com/u-root/u-root v0.11.0/go.mod h1:DBkDtiZyONk9hzVEdB/PWI9B4TxDkElWlVTHseglrZY=
-github.com/u-root/uio v0.0.0-20221213070652-c3537552635f h1:dpx1PHxYqAnXzbryJrWP1NQLzEjwcVgFLhkknuFQ7ww=
-github.com/u-root/uio v0.0.0-20221213070652-c3537552635f/go.mod h1:IogEAUBXDEwX7oR/BMmCctShYs80ql4hF0ySdzGxf7E=
+github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63 h1:YcojQL98T/OO+rybuzn2+5KrD5dBwXIvYBvQ2cD3Avg=
+github.com/u-root/uio v0.0.0-20230305220412-3e8cd9d6bf63/go.mod h1:eLL9Nub3yfAho7qB0MzZizFhTU2QkLeoVsWdHtDW264=
 github.com/ugorji/go v1.1.7 h1:/68gy2h+1mWMrwZFeD1kQialdSzAb432dtpeJ42ovdo=
 github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
 github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
@@ -843,22 +899,23 @@ github.com/unrolled/secure v1.13.0 h1:sdr3Phw2+f8Px8HE5sd1EHdj1aV3yUwed/uZXChLFs
 github.com/unrolled/secure v1.13.0/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40=
 github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
-github.com/valyala/fasthttp v1.48.0 h1:oJWvHb9BIZToTQS3MuQ2R3bJZiNSa2KiNdeI8A+79Tc=
-github.com/valyala/fasthttp v1.48.0/go.mod h1:k2zXd82h/7UZc3VOdJ2WaUqt1uZ/XpXAfE9i+HBC3lA=
+github.com/valyala/fasthttp v1.50.0 h1:H7fweIlBm0rXLs2q0XbalvJ6r0CUPFWK3/bB4N13e9M=
+github.com/valyala/fasthttp v1.50.0/go.mod h1:k2zXd82h/7UZc3VOdJ2WaUqt1uZ/XpXAfE9i+HBC3lA=
 github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
 github.com/vishvananda/netlink v1.2.1-beta.2 h1:Llsql0lnQEbHj0I1OuKyp8otXp0r3q0mPkuhwHfStVs=
 github.com/vishvananda/netlink v1.2.1-beta.2/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
 github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
 github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
-github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74 h1:gga7acRE695APm9hlsSMoOoE65U4/TcqNj90mc69Rlg=
-github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
+github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
+github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
 github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/vmihailenco/msgpack/v4 v4.3.12 h1:07s4sz9IReOgdikxLTKNbBdqDMLsjPKXwvCazn8G65U=
 github.com/vmihailenco/msgpack/v4 v4.3.12/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+NXzzngzBKDPIqw4=
-github.com/vmihailenco/tagparser v0.1.1 h1:quXMXlA39OCbd2wAdTsGDlK9RkOk6Wuw+x37wVyIuWY=
 github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
+github.com/vmihailenco/tagparser v0.1.2 h1:gnjoVuB/kljJ5wICEEOpx98oXMWPLj22G67Vbd1qPqc=
+github.com/vmihailenco/tagparser v0.1.2/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
 github.com/wagslane/go-password-validator v0.3.0 h1:vfxOPzGHkz5S146HDpavl0cw1DSVP061Ry2PX0/ON6I=
 github.com/wagslane/go-password-validator v0.3.0/go.mod h1:TI1XJ6T5fRdRnHqHt14pvy1tNVnrwe7m3/f1f2fDphQ=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
@@ -883,55 +940,60 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.5.2/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.5.5 h1:IJznPe8wOzfIKETmMkd06F8nXkmlhaHqFRM9l1hAGsU=
-github.com/yuin/goldmark v1.5.5/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/goldmark v1.5.6 h1:COmQAWTCcGetChm3Ig7G/t8AFAN00t+o8Mt4cf7JpwA=
+github.com/yuin/goldmark v1.5.6/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark-emoji v1.0.1 h1:ctuWEyzGBwiucEqxzwe0SOYDXPAucOrE9NQC18Wa1os=
 github.com/yuin/goldmark-emoji v1.0.1/go.mod h1:2w1E6FEWLcDQkoTE+7HU6QF1F6SLlNGjRIBbIZQFqkQ=
 github.com/zclconf/go-cty v1.1.0/go.mod h1:xnAOWiHeOqg2nWS62VtQ7pbOu17FtxJNW8RLEih+O3s=
-github.com/zclconf/go-cty v1.13.2 h1:4GvrUxe/QUDYuJKAav4EYqdM47/kZa672LwmXFmEKT0=
-github.com/zclconf/go-cty v1.13.2/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0=
+github.com/zclconf/go-cty v1.14.0 h1:/Xrd39K7DXbHzlisFP9c4pHao4yyf+/Ug9LEz+Y/yhc=
+github.com/zclconf/go-cty v1.14.0/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
 github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
 github.com/zeebo/errs v1.3.0 h1:hmiaKqgYZzcVgRL1Vkc1Mn2914BbzB0IBxs+ebeutGs=
 github.com/zeebo/errs v1.3.0/go.mod h1:sgbWHsvVuTPHcqJJGQ1WhI5KbWlHYz+2+2C/LSEtCw4=
 go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 h1:A/5uWzF44DlIgdm/PQFwfMkW0JX+cIcQi/SwLAmZP5M=
 go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
-go.nhat.io/otelsql v0.11.0 h1:wUrIKv6+YioYbArKLrfs3txmOjNGUNws2/eE0FzlVCo=
-go.nhat.io/otelsql v0.11.0/go.mod h1:sh4rZG+McDPlmGy1hTGchPHIkMqmLpuy37Bnu3cmqhU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.42.0 h1:pginetY7+onl4qN1vl0xW/V/v6OBZ0vVdH+esuJgvmM=
-go.opentelemetry.io/otel v1.16.0 h1:Z7GVAX/UkAXPKsy94IU+i6thsQS4nb7LviLpnaNeW8s=
-go.opentelemetry.io/otel v1.16.0/go.mod h1:vl0h9NUa1D5s1nv3A5vZOYWn8av4K8Ml6JDeHrT/bx4=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0 h1:t4ZwRPU+emrcvM2e9DHd0Fsf0JTPVcbfa/BhTDF03d0=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0/go.mod h1:vLarbg68dH2Wa77g71zmKQqlQ8+8Rq3GRG31uc0WcWI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0 h1:cbsD4cUcviQGXdw8+bo5x2wazq10SKz8hEbtCRPcU78=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0/go.mod h1:JgXSGah17croqhJfhByOLVY719k1emAXC8MVhCIJlRs=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.16.0 h1:TVQp/bboR4mhZSav+MdgXB8FaRho1RC8UwVn3T0vjVc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.16.0/go.mod h1:I33vtIe0sR96wfrUcilIzLoA3mLHhRmz9S9Te0S3gDo=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.16.0 h1:iqjq9LAB8aK++sKVcELezzn655JnBNdsDhghU4G/So8=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.16.0/go.mod h1:hGXzO5bhhSHZnKvrDaXB82Y9DRFour0Nz/KrBh7reWw=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v0.39.0 h1:fl2WmyenEf6LYYlfHAtCUEDyGcpwJNqD4dHGO7PVm4w=
-go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.16.0 h1:+XWJd3jf75RXJq29mxbuXhCXFDG3S3R4vBUeSI2P7tE=
-go.opentelemetry.io/otel/metric v1.16.0 h1:RbrpwVG1Hfv85LgnZ7+txXioPDoh6EdbZHo26Q3hqOo=
-go.opentelemetry.io/otel/metric v1.16.0/go.mod h1:QE47cpOmkwipPiefDwo2wDzwJrlfxxNYodqc4xnGCo4=
-go.opentelemetry.io/otel/sdk v1.16.0 h1:Z1Ok1YsijYL0CSJpHt4cS3wDDh7p572grzNrBMiMWgE=
-go.opentelemetry.io/otel/sdk v1.16.0/go.mod h1:tMsIuKXuuIWPBAOrH+eHtvhTL+SntFtXF9QD68aP6p4=
-go.opentelemetry.io/otel/sdk/metric v0.39.0 h1:Kun8i1eYf48kHH83RucG93ffz0zGV1sh46FAScOTuDI=
-go.opentelemetry.io/otel/trace v1.16.0 h1:8JRpaObFoW0pxuVPapkgH8UhHQj+bJW8jJsCZEu5MQs=
-go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLkqr2QVwea0ef0=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v0.19.0 h1:IVN6GR+mhC4s5yfcTbmzHYODqvWAp3ZedA2SJPI1Nnw=
-go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
+go.nhat.io/otelsql v0.12.0 h1:/rBhWZiwHFLpCm5SGdafm+Owm0OmGmnF31XWxgecFtY=
+go.nhat.io/otelsql v0.12.0/go.mod h1:39Hc9/JDfCl7NGrBi1uPP3QPofqwnC/i5SFd7gtDMWM=
+go.opentelemetry.io/contrib v1.0.0/go.mod h1:EH4yDYeNoaTqn/8yCWQmfNB78VHfGX2Jt2bvnvzBlGM=
+go.opentelemetry.io/contrib v1.19.0 h1:rnYI7OEPMWFeM4QCqWQ3InMJ0arWMR1i0Cx9A5hcjYM=
+go.opentelemetry.io/contrib v1.19.0/go.mod h1:gIzjwWFoGazJmtCaDgViqOSJPde2mCWzv60o0bWPcZs=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0 h1:KfYpVmrjI7JuToy5k8XV3nkapjWx48k4E4JOtVstzQI=
+go.opentelemetry.io/otel v1.3.0/go.mod h1:PWIKzi6JCp7sM0k9yZ43VX+T345uNbAkDKwHVjb2PTs=
+go.opentelemetry.io/otel v1.19.0 h1:MuS/TNf4/j4IXsZuJegVzI1cwut7Qc00344rgH7p8bs=
+go.opentelemetry.io/otel v1.19.0/go.mod h1:i0QyjOq3UPoTzff0PJB2N66fb4S0+rSbSB15/oyH9fY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0 h1:3d+S281UTjM+AbF31XSOYn1qXn3BgIdWl8HNEpx08Jk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0/go.mod h1:0+KuTDyKL4gjKCF75pHOX4wuzYDUZYfAQdSu43o+Z2I=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v0.40.0 h1:hf7JSONqAuXT1PDYYlVhKNMPLe4060d+4RFREcv7X2c=
+go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.17.0 h1:Ut6hgtYcASHwCzRHkXEtSsM251cXJPW+Z9DyLwEn6iI=
+go.opentelemetry.io/otel/metric v1.19.0 h1:aTzpGtV0ar9wlV4Sna9sdJyII5jTVJEvKETPiOKwvpE=
+go.opentelemetry.io/otel/metric v1.19.0/go.mod h1:L5rUsV9kM1IxCj1MmSdS+JQAcVm319EUrDVLrt7jqt8=
+go.opentelemetry.io/otel/sdk v1.3.0/go.mod h1:rIo4suHNhQwBIPg9axF8V9CA72Wz2mKF1teNrup8yzs=
+go.opentelemetry.io/otel/sdk v1.19.0 h1:6USY6zH+L8uMH8L3t1enZPR3WFEmSTADlqldyHtJi3o=
+go.opentelemetry.io/otel/sdk v1.19.0/go.mod h1:NedEbbS4w3C6zElbLdPJKOpJQOrGUJ+GfzpjUvI0v1A=
+go.opentelemetry.io/otel/sdk/metric v0.40.0 h1:qOM29YaGcxipWjL5FzpyZDpCYrDREvX0mVlmXdOjCHU=
+go.opentelemetry.io/otel/trace v1.3.0/go.mod h1:c/VDhno8888bvQYmbYLqe41/Ldmr/KKunbvWM4/fEjk=
+go.opentelemetry.io/otel/trace v1.19.0 h1:DFVQmlVbfVeOuBRrwdtaehRrWiL1JoVs9CPIQ1Dzxpg=
+go.opentelemetry.io/otel/trace v1.19.0/go.mod h1:mfaSyvGyEJEI0nyV2I4qhNQnbBOUUmYZpYojqMnX2vo=
+go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
+go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
-go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
-go4.org/intern v0.0.0-20211027215823-ae77deb06f29 h1:UXLjNohABv4S58tHmeuIZDO6e3mHpW2Dx33gaNt03LE=
-go4.org/mem v0.0.0-20210711025021-927187094b94 h1:OAAkygi2Js191AJP1Ds42MhJRgeofeKGjuoUqNp1QC4=
-go4.org/mem v0.0.0-20210711025021-927187094b94/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
-go4.org/netipx v0.0.0-20220725152314-7e7bdc8411bf h1:IdwJUzqoIo5lkr2EOyKoe5qipUaEjbOKKY5+fzPBZ3A=
-go4.org/netipx v0.0.0-20220725152314-7e7bdc8411bf/go.mod h1:+QXzaoURFd0rGDIjDNpyIkv+F9R7EmeKorvlKRnhqgA=
-go4.org/unsafe/assume-no-moving-gc v0.0.0-20220617031537-928513b29760 h1:FyBZqvoA/jbNzuAWLQE2kG820zMAkcilx6BMjGbL/E4=
-golang.org/x/arch v0.3.0 h1:02VY4/ZcO/gBOH6PUaoiptASxtXU10jazRCP865E97k=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go4.org/intern v0.0.0-20211027215823-ae77deb06f29/go.mod h1:cS2ma+47FKrLPdXFpr7CuxiTW3eyJbWew4qx0qtQWDA=
+go4.org/intern v0.0.0-20230525184215-6c62f75575cb h1:ae7kzL5Cfdmcecbh22ll7lYP3iuUdnfnhiPcSaDgH/8=
+go4.org/intern v0.0.0-20230525184215-6c62f75575cb/go.mod h1:Ycrt6raEcnF5FTsLiLKkhBTO6DPX3RCUCUVnks3gFJU=
+go4.org/mem v0.0.0-20220726221520-4f986261bf13 h1:CbZeCBZ0aZj8EfVgnqQcYZgf0lpZ3H9rmp5nkDTAst8=
+go4.org/mem v0.0.0-20220726221520-4f986261bf13/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
+go4.org/netipx v0.0.0-20230728180743-ad4cb58a6516 h1:X66ZEoMN2SuaoI/dfZVYobB6E5zjZyyHUMWlCA7MgGE=
+go4.org/netipx v0.0.0-20230728180743-ad4cb58a6516/go.mod h1:TQvodOM+hJTioNQJilmLXu08JNb8i+ccq418+KWu1/Y=
+go4.org/unsafe/assume-no-moving-gc v0.0.0-20211027215541-db492cf91b37/go.mod h1:FftLjUGFEDu5k8lt0ddY+HcrH/qU/0qk+H8j9/nTl3E=
+go4.org/unsafe/assume-no-moving-gc v0.0.0-20230525183740-e7c30c78aeb2 h1:WJhcL4p+YeDxmZWg141nRm7XC8IDmhz7lk5GpadO1Sg=
+go4.org/unsafe/assume-no-moving-gc v0.0.0-20230525183740-e7c30c78aeb2/go.mod h1:FftLjUGFEDu5k8lt0ddY+HcrH/qU/0qk+H8j9/nTl3E=
+golang.org/x/arch v0.4.0 h1:A8WCeEWhLwPBKNbFi5Wv5UTCBx5zzubnXDlMOFAzFMc=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -945,10 +1007,11 @@ golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5
 golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
-golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -959,9 +1022,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20230315142452-642cacee5cc0 h1:pVgRXcIictcr+lBQIFeiwuwtDIs4eL21OuM9nyAADmo=
-golang.org/x/exp v0.0.0-20230315142452-642cacee5cc0/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
-golang.org/x/exp/typeparams v0.0.0-20221208152030-732eee02a75a h1:Jw5wfR+h9mnIYH+OtGT2im5wV1YGGDora5vTv/aa5bE=
+golang.org/x/exp v0.0.0-20230801115018-d63ba01acd4b h1:r+vk0EmXNmekl0S0BascoeeoHk/L7wmaW2QF90K+kYI=
+golang.org/x/exp v0.0.0-20230801115018-d63ba01acd4b/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -987,8 +1049,10 @@ golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
+golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180811021610-c39426892332/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -996,14 +1060,11 @@ golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73r
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190419010253-1f3472d942ba/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -1018,7 +1079,6 @@ golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
@@ -1027,16 +1087,16 @@ golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210928044308-7d9f5e0b762b/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220923203811-8be639271d50/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.0.0-20221002022538-bcab6841153b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
 golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
-golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
-golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1046,9 +1106,8 @@ golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
-golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
+golang.org/x/oauth2 v0.13.0 h1:jDDenyj+WgFtmV3zYVoi8aE2BwtXFLWOA67ZfNWftiY=
+golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1061,28 +1120,22 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220923202941-7f9b1623fab7/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
+golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190418153312-f0ce4c0180be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502175342-a43fa875dd82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606122018-79a91cf218c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1105,11 +1158,8 @@ golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201101102859-da207088b7d1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201207223542-d4d67f95c62d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1127,46 +1177,53 @@ golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220204135822-1c1b9b1eba6a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220622161953-175b2fd9d664/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220627191245-f75cf1eec38b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.4.1-0.20230131160137-e7d7f63158de/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
-golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210503060354-a79de5458b56/go.mod h1:tfny5GFUkzUvx4ps4ajbZsCe5lw1metzhBm9T3x7oIY=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c=
-golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
-golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1178,7 +1235,6 @@ golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
@@ -1223,11 +1279,11 @@ golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.11.0 h1:EMCa6U9S2LtZXLAMoWiR/R8dAQFRqbAitmbJ2UKhoi8=
-golang.org/x/tools v0.11.0/go.mod h1:anzJrxPjNtfgiYQYirP2CPGzGLxrH2u2QBhn6Bf3qY8=
+golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc=
+golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1236,10 +1292,8 @@ golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3j
 golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
-golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b h1:J1CaxgLerRR5lgx3wnr6L04cJFbWoceSK9JWBdglINo=
-golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4=
-golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230215201556-9c5414ab4bde h1:ybF7AMzIUikL9x4LgwEmzhXtzRpKNqngme1VGDWz+Nk=
-golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230215201556-9c5414ab4bde/go.mod h1:mQqgjkW8GQQcJQsbBvK890TKqUK1DfKWkuBGbOkuMHQ=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 h1:CawjfCvYQH2OU3/TnxLx97WDSUDRABfT18pCOYwc2GE=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6/go.mod h1:3rxYc4HtVcSG9gVaTs2GEBdehh+sYPOwKtyUWEOTb80=
 golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
 golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
@@ -1261,16 +1315,17 @@ google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz513
 google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
 google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
 google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/api v0.134.0 h1:ktL4Goua+UBgoP1eL1/60LwZJqa1sIzkLmvoR3hR6Gw=
-google.golang.org/api v0.134.0/go.mod h1:sjRL3UnjTx5UqNQS9EWr9N8p7xbHpy1k0XGRLCf3Spk=
+google.golang.org/api v0.148.0 h1:HBq4TZlN4/1pNcu0geJZ/Q50vIwIXT532UIMYoo0vOs=
+google.golang.org/api v0.148.0/go.mod h1:8/TBgwaKjfqTdacOJrOv2+2Q6fBDU1uHKK06oGSkxzU=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -1293,7 +1348,6 @@ google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfG
 google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
@@ -1307,13 +1361,12 @@ google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6D
 google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20230726155614-23370e0ffb3e h1:xIXmWJ303kJCuogpj0bHq+dcjcZHU+XFyc1I0Yl9cRg=
-google.golang.org/genproto v0.0.0-20230726155614-23370e0ffb3e/go.mod h1:0ggbjUrZYpy1q+ANUS30SEoGZ53cdfwtbuG7Ptgy108=
-google.golang.org/genproto/googleapis/api v0.0.0-20230706204954-ccb25ca9f130 h1:XVeBY8d/FaK4848myy41HBqnDwvxeV3zMZhwN1TvAMU=
-google.golang.org/genproto/googleapis/api v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:mPBs5jNgx2GuQGvFwUvVKqtn6HsUw9nP64BedgvqEsQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230720185612-659f7aaaa771 h1:Z8qdAF9GFsmcUuWQ5KVYIpP3PCKydn/YKORnghIalu4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230720185612-659f7aaaa771/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
+google.golang.org/genproto v0.0.0-20231002182017-d307bd883b97 h1:SeZZZx0cP0fqUyA+oRzP9k7cSwJlvDFiROO72uwD6i0=
+google.golang.org/genproto v0.0.0-20231002182017-d307bd883b97/go.mod h1:t1VqOqqvce95G3hIDCT5FeO3YUc6Q4Oe24L/+rNMxRk=
+google.golang.org/genproto/googleapis/api v0.0.0-20231002182017-d307bd883b97 h1:W18sezcAYs+3tDZX4F80yctqa12jcP1PUS2gQu1zTPU=
+google.golang.org/genproto/googleapis/api v0.0.0-20231002182017-d307bd883b97/go.mod h1:iargEX0SFPm3xcfMI0d1domjg0ZF4Aa0p2awqyxhvF0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a h1:a2MQQVoTo96JC9PMGtGBymLp7+/RzpFc2yX/9WfFg1c=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a/go.mod h1:4cYg8o5yUbm77w8ZX00LhMVNl/YVBFJRYWDc0uYWMs0=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1327,16 +1380,11 @@ google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3Iji
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
 google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
-google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw=
-google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
+google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
+google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1350,26 +1398,30 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
 google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+gopkg.in/DataDog/dd-trace-go.v1 v1.56.1 h1:AUe/ZF7xm6vYnigPe+TY54DmfWYJxhMRaw/TfvrbzvE=
+gopkg.in/DataDog/dd-trace-go.v1 v1.56.1/go.mod h1:KDLJ3CWVOSuVVwu+0ZR5KZo2rP6c7YyBV3v387dIpUU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
 gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
+gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -1378,9 +1430,10 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.4.2 h1:6qXr+R5w+ktL5UkwEbPp+fEvfyoMPche6GkOpGHZcLc=
 howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM=
 howett.net/plist v1.0.0/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
+inet.af/netaddr v0.0.0-20230525184311-b8eac61e914a h1:1XCVEdxrvL6c0TGOhecLuB7U9zYNdxZEjvOqJreKZiM=
+inet.af/netaddr v0.0.0-20230525184311-b8eac61e914a/go.mod h1:e83i32mAQOW1LAqEIweALsuK2Uw4mhQadA5r7b0Wobo=
 inet.af/peercred v0.0.0-20210906144145-0893ea02156a h1:qdkS8Q5/i10xU2ArJMKYhVa1DORzBfYS/qA2UK2jheg=
 inet.af/peercred v0.0.0-20210906144145-0893ea02156a/go.mod h1:FjawnflS/udxX+SvpsMgZfdqx2aykOlkISeAsADi5IU=
 nhooyr.io/websocket v1.8.7 h1:usjR2uOr/zjjkVMy0lW+PPohFok7PCow5sDjLgX4P4g=
@@ -1388,6 +1441,8 @@ nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
+sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
+sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
 software.sslmate.com/src/go-pkcs12 v0.2.0 h1:nlFkj7bTysH6VkC4fGphtjXRbezREPgrHuJG20hBGPE=
 storj.io/drpc v0.0.33-0.20230420154621-9716137f6037 h1:SYRl2YUthhsXNkrP30KwxkDGN9TESdNrbpr14rOxsnM=
 storj.io/drpc v0.0.33-0.20230420154621-9716137f6037/go.mod h1:vR804UNzhBa49NOJ6HeLjd2H3MakC1j5Gv8bsOQT6N4=
diff --git a/helm/Chart.yaml b/helm/Chart.yaml
deleted file mode 100644
index a68aa330d8d49..0000000000000
--- a/helm/Chart.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-apiVersion: v2
-name: coder
-description: Remote development environments on your infrastructure
-home: https://github.com/coder/coder
-
-# version and appVersion are injected at release and will always be shown as
-# 0.1.0 in the repository.
-#
-# If you're installing the Helm chart directly from git it will have this
-# version, which means the auto-generated image URI will be invalid. You can set
-# "coder.image.tag" to the desired tag manually.
-type: application
-version: "0.1.0"
-appVersion: "0.1.0"
-
-# Coder has a hard requirement on Kubernetes 1.19, as this version introduced
-# the networking.k8s.io/v1 API.
-kubeVersion: ">= 1.19.0-0"
-
-keywords:
-  - coder
-  - terraform
-sources:
-  - https://github.com/coder/coder/tree/main/helm
-icon: https://helm.coder.com/coder_logo_black.png
-maintainers:
-  - name: Coder Technologies, Inc.
-    email: support@coder.com
-    url: https://coder.com/contact
diff --git a/helm/Makefile b/helm/Makefile
index a3f689b1637af..4010cf42d64fb 100644
--- a/helm/Makefile
+++ b/helm/Makefile
@@ -13,6 +13,13 @@ all: lint
 lint: lint/helm
 .PHONY: lint
 
-lint/helm:
-	helm lint --strict --set coder.image.tag=v0.0.1 .
+lint/helm: lint/helm/coder lint/helm/provisioner
 .PHONY: lint/helm
+
+lint/helm/coder:
+	helm lint --strict --set coder.image.tag=v0.0.1 coder/
+.PHONY: lint/helm/coder
+
+lint/helm/provisioner:
+	helm lint --strict --set coder.image.tag=v0.0.1 provisioner/
+.PHONY: lint/helm/provisioner
diff --git a/helm/.helmignore b/helm/coder/.helmignore
similarity index 100%
rename from helm/.helmignore
rename to helm/coder/.helmignore
diff --git a/helm/coder/Chart.lock b/helm/coder/Chart.lock
new file mode 100644
index 0000000000000..9692722e192f1
--- /dev/null
+++ b/helm/coder/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: libcoder
+  repository: file://../libcoder
+  version: 0.1.0
+digest: sha256:5c9a99109258073b590a9f98268490ef387fde24c0c7c7ade9c1a8c7ef5e6e10
+generated: "2023-08-08T07:27:19.677972411Z"
diff --git a/helm/coder/Chart.yaml b/helm/coder/Chart.yaml
new file mode 100644
index 0000000000000..99f6b710474c3
--- /dev/null
+++ b/helm/coder/Chart.yaml
@@ -0,0 +1,34 @@
+apiVersion: v2
+name: coder
+description: Remote development environments on your infrastructure
+home: https://github.com/coder/coder
+
+# version and appVersion are injected at release and will always be shown as
+# 0.1.0 in the repository.
+#
+# If you're installing the Helm chart directly from git it will have this
+# version, which means the auto-generated image URI will be invalid. You can set
+# "coder.image.tag" to the desired tag manually.
+type: application
+version: "0.1.0"
+appVersion: "0.1.0"
+
+# Coder has a hard requirement on Kubernetes 1.19, as this version introduced
+# the networking.k8s.io/v1 API.
+kubeVersion: ">= 1.19.0-0"
+
+keywords:
+  - coder
+  - terraform
+sources:
+  - https://github.com/coder/coder/tree/main/helm/coder
+icon: https://helm.coder.com/coder_logo_black.png
+maintainers:
+  - name: Coder Technologies, Inc.
+    email: support@coder.com
+    url: https://coder.com/contact
+
+dependencies:
+  - name: libcoder
+    version: 0.1.0
+    repository: file://../libcoder
diff --git a/helm/README.md b/helm/coder/README.md
similarity index 100%
rename from helm/README.md
rename to helm/coder/README.md
diff --git a/helm/coder/charts/libcoder-0.1.0.tgz b/helm/coder/charts/libcoder-0.1.0.tgz
new file mode 100644
index 0000000000000..baae560bb8310
Binary files /dev/null and b/helm/coder/charts/libcoder-0.1.0.tgz differ
diff --git a/helm/templates/NOTES.txt b/helm/coder/templates/NOTES.txt
similarity index 100%
rename from helm/templates/NOTES.txt
rename to helm/coder/templates/NOTES.txt
diff --git a/helm/coder/templates/_coder.tpl b/helm/coder/templates/_coder.tpl
new file mode 100644
index 0000000000000..d0846ecf739b7
--- /dev/null
+++ b/helm/coder/templates/_coder.tpl
@@ -0,0 +1,108 @@
+{{/*
+Service account to merge into the libcoder template
+*/}}
+{{- define "coder.serviceaccount" -}}
+{{- end -}}
+
+{{/*
+Deployment to merge into the libcoder template
+*/}}
+{{- define "coder.deployment" -}}
+spec:
+  template:
+    spec:
+      containers:
+      -
+{{ include "libcoder.containerspec" (list . "coder.containerspec") | indent 8}}
+
+{{- end -}}
+
+{{/*
+ContainerSpec for the Coder container of the Coder deployment
+*/}}
+{{- define "coder.containerspec" -}}
+args:
+{{- if .Values.coder.commandArgs }}
+  {{- toYaml .Values.coder.commandArgs | nindent 12 }}
+{{- else }}
+  {{- if .Values.coder.workspaceProxy }}
+- wsproxy
+  {{- end }}
+- server
+{{- end }}
+{{- if .Values.coder.envFrom }}
+envFrom:
+{{- with .Values.coder.envFrom }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+env:
+- name: CODER_HTTP_ADDRESS
+  value: "0.0.0.0:8080"
+- name: CODER_PROMETHEUS_ADDRESS
+  value: "0.0.0.0:2112"
+{{- if .Values.provisionerDaemon.pskSecretName }}
+- name: CODER_PROVISIONER_DAEMON_PSK
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.provisionerDaemon.pskSecretName | quote }}
+      key: psk
+{{- end }}
+  # Set the default access URL so a `helm apply` works by default.
+  # See: https://github.com/coder/coder/issues/5024
+{{- $hasAccessURL := false }}
+{{- range .Values.coder.env }}
+{{- if eq .name "CODER_ACCESS_URL" }}
+{{- $hasAccessURL = true }}
+{{- end }}
+{{- end }}
+{{- if and (not $hasAccessURL) .Values.coder.envUseClusterAccessURL }}
+- name: CODER_ACCESS_URL
+  value: {{ include "coder.defaultAccessURL" . | quote }}
+{{- end }}
+# Used for inter-pod communication with high-availability.
+- name: KUBE_POD_IP
+  valueFrom:
+    fieldRef:
+      fieldPath: status.podIP
+- name: CODER_DERP_SERVER_RELAY_URL
+  value: "http://$(KUBE_POD_IP):8080"
+{{- include "coder.tlsEnv" . }}
+{{- with .Values.coder.env }}
+{{ toYaml . }}
+{{- end }}
+ports:
+- name: "http"
+  containerPort: 8080
+  protocol: TCP
+  {{- if eq (include "coder.tlsEnabled" .) "true" }}
+- name: "https"
+  containerPort: 8443
+  protocol: TCP
+  {{- end }}
+  {{- range .Values.coder.env }}
+  {{- if eq .name "CODER_PROMETHEUS_ENABLE" }}
+  {{/*
+    This sadly has to be nested to avoid evaluating the second part
+    of the condition too early and potentially getting type errors if
+    the value is not a string (like a `valueFrom`). We do not support
+    `valueFrom` for this env var specifically.
+    */}}
+  {{- if eq .value "true" }}
+- name: "prometheus-http"
+  containerPort: 2112
+  protocol: TCP
+  {{- end }}
+  {{- end }}
+  {{- end }}
+readinessProbe:
+  httpGet:
+    path: /healthz
+    port: "http"
+    scheme: "HTTP"
+livenessProbe:
+  httpGet:
+    path: /healthz
+    port: "http"
+    scheme: "HTTP"
+{{- end }}
diff --git a/helm/coder/templates/coder.yaml b/helm/coder/templates/coder.yaml
new file mode 100644
index 0000000000000..65eaac00ac001
--- /dev/null
+++ b/helm/coder/templates/coder.yaml
@@ -0,0 +1,5 @@
+---
+{{ include "libcoder.serviceaccount" (list . "coder.serviceaccount") }}
+
+---
+{{ include "libcoder.deployment" (list . "coder.deployment") }}
diff --git a/helm/templates/extra-templates.yaml b/helm/coder/templates/extra-templates.yaml
similarity index 100%
rename from helm/templates/extra-templates.yaml
rename to helm/coder/templates/extra-templates.yaml
diff --git a/helm/templates/ingress.yaml b/helm/coder/templates/ingress.yaml
similarity index 100%
rename from helm/templates/ingress.yaml
rename to helm/coder/templates/ingress.yaml
diff --git a/helm/coder/templates/rbac.yaml b/helm/coder/templates/rbac.yaml
new file mode 100644
index 0000000000000..07fb36d876824
--- /dev/null
+++ b/helm/coder/templates/rbac.yaml
@@ -0,0 +1 @@
+{{ include "libcoder.rbac.tpl" . }}
diff --git a/helm/templates/service.yaml b/helm/coder/templates/service.yaml
similarity index 78%
rename from helm/templates/service.yaml
rename to helm/coder/templates/service.yaml
index 60dd5fe931dfa..1881f992a695e 100644
--- a/helm/templates/service.yaml
+++ b/helm/coder/templates/service.yaml
@@ -16,11 +16,17 @@ spec:
       port: 80
       targetPort: "http"
       protocol: TCP
+      {{ if eq .Values.coder.service.type "NodePort" }}
+      nodePort: {{ .Values.coder.service.httpNodePort }}
+      {{ end }}
     {{- if eq (include "coder.tlsEnabled" .) "true" }}
     - name: "https"
       port: 443
       targetPort: "https"
       protocol: TCP
+      {{ if eq .Values.coder.service.type "NodePort" }}
+      nodePort: {{ .Values.coder.service.httpsNodePort }}
+      {{ end }}
     {{- end }}
   {{- if eq "LoadBalancer" .Values.coder.service.type }}
   {{- with .Values.coder.service.loadBalancerIP }}
diff --git a/helm/coder/tests/chart_test.go b/helm/coder/tests/chart_test.go
new file mode 100644
index 0000000000000..a58ea36e675c5
--- /dev/null
+++ b/helm/coder/tests/chart_test.go
@@ -0,0 +1,200 @@
+package tests // nolint: testpackage
+
+import (
+	"bytes"
+	"flag"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/testutil"
+)
+
+// These tests run `helm template` with the values file specified in each test
+// and compare the output to the contents of the corresponding golden file.
+// All values and golden files are located in the `testdata` directory.
+// To update golden files, run `go test . -update`.
+
+// updateGoldenFiles is a flag that can be set to update golden files.
+var updateGoldenFiles = flag.Bool("update", false, "Update golden files")
+
+var testCases = []testCase{
+	{
+		name:          "default_values",
+		expectedError: "",
+	},
+	{
+		name:          "missing_values",
+		expectedError: `You must specify the coder.image.tag value if you're installing the Helm chart directly from Git.`,
+	},
+	{
+		name:          "tls",
+		expectedError: "",
+	},
+	{
+		name:          "sa",
+		expectedError: "",
+	},
+	{
+		name:          "labels_annotations",
+		expectedError: "",
+	},
+	{
+		name:          "workspace_proxy",
+		expectedError: "",
+	},
+	{
+		name:          "command",
+		expectedError: "",
+	},
+	{
+		name:          "command_args",
+		expectedError: "",
+	},
+	{
+		name:          "provisionerd_psk",
+		expectedError: "",
+	},
+	{
+		name:          "auto_access_url_1",
+		expectedError: "",
+	},
+	{
+		name:          "auto_access_url_2",
+		expectedError: "",
+	},
+	{
+		name:          "auto_access_url_3",
+		expectedError: "",
+	},
+	{
+		name:          "env_from",
+		expectedError: "",
+	},
+	{
+		name:          "extra_templates",
+		expectedError: "",
+	},
+}
+
+type testCase struct {
+	name          string // Name of the test case. This is used to control which values and golden file are used.
+	expectedError string // Expected error from running `helm template`.
+}
+
+func (tc testCase) valuesFilePath() string {
+	return filepath.Join("./testdata", tc.name+".yaml")
+}
+
+func (tc testCase) goldenFilePath() string {
+	return filepath.Join("./testdata", tc.name+".golden")
+}
+
+func TestRenderChart(t *testing.T) {
+	t.Parallel()
+	if *updateGoldenFiles {
+		t.Skip("Golden files are being updated. Skipping test.")
+	}
+	if testutil.InCI() {
+		switch runtime.GOOS {
+		case "windows", "darwin":
+			t.Skip("Skipping tests on Windows and macOS in CI")
+		}
+	}
+
+	// Ensure that Helm is available in $PATH
+	helmPath := lookupHelm(t)
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			// Ensure that the values file exists.
+			valuesFilePath := tc.valuesFilePath()
+			if _, err := os.Stat(valuesFilePath); os.IsNotExist(err) {
+				t.Fatalf("values file %q does not exist", valuesFilePath)
+			}
+
+			// Run helm template with the values file.
+			templateOutput, err := runHelmTemplate(t, helmPath, "..", valuesFilePath)
+			if tc.expectedError != "" {
+				require.Error(t, err, "helm template should have failed")
+				require.Contains(t, templateOutput, tc.expectedError, "helm template output should contain expected error")
+			} else {
+				require.NoError(t, err, "helm template should not have failed")
+				require.NotEmpty(t, templateOutput, "helm template output should not be empty")
+				goldenFilePath := tc.goldenFilePath()
+				goldenBytes, err := os.ReadFile(goldenFilePath)
+				require.NoError(t, err, "failed to read golden file %q", goldenFilePath)
+
+				// Remove carriage returns to make tests pass on Windows.
+				goldenBytes = bytes.Replace(goldenBytes, []byte("\r"), []byte(""), -1)
+				expected := string(goldenBytes)
+
+				require.NoError(t, err, "failed to load golden file %q")
+				require.Equal(t, expected, templateOutput)
+			}
+		})
+	}
+}
+
+func TestUpdateGoldenFiles(t *testing.T) {
+	t.Parallel()
+	if !*updateGoldenFiles {
+		t.Skip("Run with -update to update golden files")
+	}
+
+	helmPath := lookupHelm(t)
+	for _, tc := range testCases {
+		if tc.expectedError != "" {
+			t.Logf("skipping test case %q with render error", tc.name)
+			continue
+		}
+
+		valuesPath := tc.valuesFilePath()
+		templateOutput, err := runHelmTemplate(t, helmPath, "..", valuesPath)
+
+		require.NoError(t, err, "failed to run `helm template -f %q`", valuesPath)
+
+		goldenFilePath := tc.goldenFilePath()
+		err = os.WriteFile(goldenFilePath, []byte(templateOutput), 0o644) // nolint:gosec
+		require.NoError(t, err, "failed to write golden file %q", goldenFilePath)
+	}
+	t.Log("Golden files updated. Please review the changes and commit them.")
+}
+
+// runHelmTemplate runs helm template on the given chart with the given values and
+// returns the raw output.
+func runHelmTemplate(t testing.TB, helmPath, chartDir, valuesFilePath string) (string, error) {
+	// Ensure that valuesFilePath exists
+	if _, err := os.Stat(valuesFilePath); err != nil {
+		return "", xerrors.Errorf("values file %q does not exist: %w", valuesFilePath, err)
+	}
+
+	cmd := exec.Command(helmPath, "template", chartDir, "-f", valuesFilePath, "--namespace", "default")
+	t.Logf("exec command: %v", cmd.Args)
+	out, err := cmd.CombinedOutput()
+	return string(out), err
+}
+
+// lookupHelm ensures that Helm is available in $PATH and returns the path to the
+// Helm executable.
+func lookupHelm(t testing.TB) string {
+	helmPath, err := exec.LookPath("helm")
+	if err != nil {
+		t.Fatalf("helm not found in $PATH: %v", err)
+		return ""
+	}
+	t.Logf("Using helm at %q", helmPath)
+	return helmPath
+}
+
+func TestMain(m *testing.M) {
+	flag.Parse()
+	os.Exit(m.Run())
+}
diff --git a/helm/coder/tests/testdata/auto_access_url_1.golden b/helm/coder/tests/testdata/auto_access_url_1.golden
new file mode 100644
index 0000000000000..a55a7413fb95b
--- /dev/null
+++ b/helm/coder/tests/testdata/auto_access_url_1.golden
@@ -0,0 +1,192 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder"
+subjects:
+  - kind: ServiceAccount
+    name: "coder"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - server
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        - name: SOME_ENV
+          value: some value
+        - name: CODER_ACCESS_URL
+          value: https://dev.coder.com
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes: []
diff --git a/helm/coder/tests/testdata/auto_access_url_1.yaml b/helm/coder/tests/testdata/auto_access_url_1.yaml
new file mode 100644
index 0000000000000..68700538df2b8
--- /dev/null
+++ b/helm/coder/tests/testdata/auto_access_url_1.yaml
@@ -0,0 +1,11 @@
+coder:
+  image:
+    tag: latest
+
+  env:
+    - name: "SOME_ENV"
+      value: "some value"
+    - name: "CODER_ACCESS_URL"
+      value: "https://dev.coder.com"
+
+  envUseClusterAccessURL: true # default
diff --git a/helm/coder/tests/testdata/auto_access_url_2.golden b/helm/coder/tests/testdata/auto_access_url_2.golden
new file mode 100644
index 0000000000000..c7dd0b3c8780b
--- /dev/null
+++ b/helm/coder/tests/testdata/auto_access_url_2.golden
@@ -0,0 +1,192 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder"
+subjects:
+  - kind: ServiceAccount
+    name: "coder"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - server
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_ACCESS_URL
+          value: http://coder.default.svc.cluster.local
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        - name: SOME_ENV
+          value: some value
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes: []
diff --git a/helm/coder/tests/testdata/auto_access_url_2.yaml b/helm/coder/tests/testdata/auto_access_url_2.yaml
new file mode 100644
index 0000000000000..2253c161ed8e1
--- /dev/null
+++ b/helm/coder/tests/testdata/auto_access_url_2.yaml
@@ -0,0 +1,9 @@
+coder:
+  image:
+    tag: latest
+
+  env:
+    - name: "SOME_ENV"
+      value: "some value"
+
+  envUseClusterAccessURL: true # default
diff --git a/helm/coder/tests/testdata/auto_access_url_3.golden b/helm/coder/tests/testdata/auto_access_url_3.golden
new file mode 100644
index 0000000000000..2a07c1e42f050
--- /dev/null
+++ b/helm/coder/tests/testdata/auto_access_url_3.golden
@@ -0,0 +1,190 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder"
+subjects:
+  - kind: ServiceAccount
+    name: "coder"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - server
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        - name: SOME_ENV
+          value: some value
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes: []
diff --git a/helm/coder/tests/testdata/auto_access_url_3.yaml b/helm/coder/tests/testdata/auto_access_url_3.yaml
new file mode 100644
index 0000000000000..528697cccf4d6
--- /dev/null
+++ b/helm/coder/tests/testdata/auto_access_url_3.yaml
@@ -0,0 +1,9 @@
+coder:
+  image:
+    tag: latest
+
+  env:
+    - name: "SOME_ENV"
+      value: "some value"
+
+  envUseClusterAccessURL: false
diff --git a/helm/coder/tests/testdata/command.golden b/helm/coder/tests/testdata/command.golden
new file mode 100644
index 0000000000000..9897e34382d6c
--- /dev/null
+++ b/helm/coder/tests/testdata/command.golden
@@ -0,0 +1,190 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder"
+subjects:
+  - kind: ServiceAccount
+    name: "coder"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - server
+        command:
+        - /opt/colin
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_ACCESS_URL
+          value: http://coder.default.svc.cluster.local
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes: []
diff --git a/helm/tests/testdata/command.yaml b/helm/coder/tests/testdata/command.yaml
similarity index 100%
rename from helm/tests/testdata/command.yaml
rename to helm/coder/tests/testdata/command.yaml
diff --git a/helm/coder/tests/testdata/command_args.golden b/helm/coder/tests/testdata/command_args.golden
new file mode 100644
index 0000000000000..126127838b89c
--- /dev/null
+++ b/helm/coder/tests/testdata/command_args.golden
@@ -0,0 +1,191 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder"
+subjects:
+  - kind: ServiceAccount
+    name: "coder"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - arg1
+        - arg2
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_ACCESS_URL
+          value: http://coder.default.svc.cluster.local
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes: []
diff --git a/helm/tests/testdata/command_args.yaml b/helm/coder/tests/testdata/command_args.yaml
similarity index 100%
rename from helm/tests/testdata/command_args.yaml
rename to helm/coder/tests/testdata/command_args.yaml
diff --git a/helm/coder/tests/testdata/default_values.golden b/helm/coder/tests/testdata/default_values.golden
new file mode 100644
index 0000000000000..f5d6b2ad2c82f
--- /dev/null
+++ b/helm/coder/tests/testdata/default_values.golden
@@ -0,0 +1,190 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder"
+subjects:
+  - kind: ServiceAccount
+    name: "coder"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - server
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_ACCESS_URL
+          value: http://coder.default.svc.cluster.local
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes: []
diff --git a/helm/tests/testdata/default_values.yaml b/helm/coder/tests/testdata/default_values.yaml
similarity index 100%
rename from helm/tests/testdata/default_values.yaml
rename to helm/coder/tests/testdata/default_values.yaml
diff --git a/helm/coder/tests/testdata/env_from.golden b/helm/coder/tests/testdata/env_from.golden
new file mode 100644
index 0000000000000..caef038614e90
--- /dev/null
+++ b/helm/coder/tests/testdata/env_from.golden
@@ -0,0 +1,202 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder"
+subjects:
+  - kind: ServiceAccount
+    name: "coder"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - server
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_ACCESS_URL
+          value: http://coder.default.svc.cluster.local
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        - name: COOL_ENV
+          valueFrom:
+            configMapKeyRef:
+              key: value
+              name: cool-env
+        - name: COOL_ENV2
+          value: cool value
+        envFrom:
+        - configMapRef:
+            name: cool-configmap
+        - secretRef:
+            name: cool-secret
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes: []
diff --git a/helm/coder/tests/testdata/env_from.yaml b/helm/coder/tests/testdata/env_from.yaml
new file mode 100644
index 0000000000000..0e1b7956e4722
--- /dev/null
+++ b/helm/coder/tests/testdata/env_from.yaml
@@ -0,0 +1,18 @@
+coder:
+  image:
+    tag: latest
+
+  env:
+    - name: "COOL_ENV"
+      valueFrom:
+        configMapKeyRef:
+          name: "cool-env"
+          key: "value"
+    - name: "COOL_ENV2"
+      value: "cool value"
+
+  envFrom:
+    - configMapRef:
+        name: "cool-configmap"
+    - secretRef:
+        name: "cool-secret"
diff --git a/helm/coder/tests/testdata/extra_templates.golden b/helm/coder/tests/testdata/extra_templates.golden
new file mode 100644
index 0000000000000..437b7ce13d15d
--- /dev/null
+++ b/helm/coder/tests/testdata/extra_templates.golden
@@ -0,0 +1,199 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+---
+# Source: coder/templates/extra-templates.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: some-config
+  namespace: default
+data:
+  key: some-value
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder"
+subjects:
+  - kind: ServiceAccount
+    name: "coder"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - server
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_ACCESS_URL
+          value: http://coder.default.svc.cluster.local
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes: []
diff --git a/helm/coder/tests/testdata/extra_templates.yaml b/helm/coder/tests/testdata/extra_templates.yaml
new file mode 100644
index 0000000000000..6d9fd6531e3a3
--- /dev/null
+++ b/helm/coder/tests/testdata/extra_templates.yaml
@@ -0,0 +1,12 @@
+coder:
+  image:
+    tag: latest
+extraTemplates:
+  - |
+    apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: some-config
+      namespace: {{ .Release.Namespace }}
+    data:
+      key: some-value
diff --git a/helm/coder/tests/testdata/labels_annotations.golden b/helm/coder/tests/testdata/labels_annotations.golden
new file mode 100644
index 0000000000000..c6598737d2410
--- /dev/null
+++ b/helm/coder/tests/testdata/labels_annotations.golden
@@ -0,0 +1,198 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder"
+subjects:
+  - kind: ServiceAccount
+    name: "coder"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    com.coder/annotation/baz: qux
+    com.coder/annotation/foo: bar
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    com.coder/label/baz: qux
+    com.coder/label/foo: bar
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations:
+        com.coder/podAnnotation/baz: qux
+        com.coder/podAnnotation/foo: bar
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        com.coder/podLabel/baz: qux
+        com.coder/podLabel/foo: bar
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - server
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_ACCESS_URL
+          value: http://coder.default.svc.cluster.local
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes: []
diff --git a/helm/tests/testdata/labels_annotations.yaml b/helm/coder/tests/testdata/labels_annotations.yaml
similarity index 100%
rename from helm/tests/testdata/labels_annotations.yaml
rename to helm/coder/tests/testdata/labels_annotations.yaml
diff --git a/helm/tests/testdata/missing_values.yaml b/helm/coder/tests/testdata/missing_values.yaml
similarity index 100%
rename from helm/tests/testdata/missing_values.yaml
rename to helm/coder/tests/testdata/missing_values.yaml
diff --git a/helm/coder/tests/testdata/provisionerd_psk.golden b/helm/coder/tests/testdata/provisionerd_psk.golden
new file mode 100644
index 0000000000000..93f9e817ebc80
--- /dev/null
+++ b/helm/coder/tests/testdata/provisionerd_psk.golden
@@ -0,0 +1,195 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder"
+subjects:
+  - kind: ServiceAccount
+    name: "coder"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - server
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_PROVISIONER_DAEMON_PSK
+          valueFrom:
+            secretKeyRef:
+              key: psk
+              name: coder-provisionerd-psk
+        - name: CODER_ACCESS_URL
+          value: http://coder.default.svc.cluster.local
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes: []
diff --git a/helm/coder/tests/testdata/provisionerd_psk.yaml b/helm/coder/tests/testdata/provisionerd_psk.yaml
new file mode 100644
index 0000000000000..915b7aeb66f0f
--- /dev/null
+++ b/helm/coder/tests/testdata/provisionerd_psk.yaml
@@ -0,0 +1,5 @@
+coder:
+  image:
+    tag: latest
+provisionerDaemon:
+  pskSecretName: "coder-provisionerd-psk"
diff --git a/helm/coder/tests/testdata/sa.golden b/helm/coder/tests/testdata/sa.golden
new file mode 100644
index 0000000000000..386131531bef4
--- /dev/null
+++ b/helm/coder/tests/testdata/sa.golden
@@ -0,0 +1,191 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/coder-service-account
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder-service-account
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-service-account-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder-service-account"
+subjects:
+  - kind: ServiceAccount
+    name: "coder-service-account"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-service-account-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - server
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_ACCESS_URL
+          value: http://coder.default.svc.cluster.local
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder-service-account
+      terminationGracePeriodSeconds: 60
+      volumes: []
diff --git a/helm/tests/testdata/sa.yaml b/helm/coder/tests/testdata/sa.yaml
similarity index 100%
rename from helm/tests/testdata/sa.yaml
rename to helm/coder/tests/testdata/sa.yaml
diff --git a/helm/coder/tests/testdata/tls.golden b/helm/coder/tests/testdata/tls.golden
new file mode 100644
index 0000000000000..33b1a85b9d56b
--- /dev/null
+++ b/helm/coder/tests/testdata/tls.golden
@@ -0,0 +1,212 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder"
+subjects:
+  - kind: ServiceAccount
+    name: "coder"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+    - name: "https"
+      port: 443
+      targetPort: "https"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - server
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_ACCESS_URL
+          value: https://coder.default.svc.cluster.local
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        - name: CODER_TLS_ENABLE
+          value: "true"
+        - name: CODER_TLS_ADDRESS
+          value: 0.0.0.0:8443
+        - name: CODER_TLS_CERT_FILE
+          value: /etc/ssl/certs/coder/coder-tls/tls.crt
+        - name: CODER_TLS_KEY_FILE
+          value: /etc/ssl/certs/coder/coder-tls/tls.key
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        - containerPort: 8443
+          name: https
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts:
+        - mountPath: /etc/ssl/certs/coder/coder-tls
+          name: tls-coder-tls
+          readOnly: true
+      restartPolicy: Always
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes:
+      - name: tls-coder-tls
+        secret:
+          secretName: coder-tls
diff --git a/helm/tests/testdata/tls.yaml b/helm/coder/tests/testdata/tls.yaml
similarity index 100%
rename from helm/tests/testdata/tls.yaml
rename to helm/coder/tests/testdata/tls.yaml
diff --git a/helm/coder/tests/testdata/workspace_proxy.golden b/helm/coder/tests/testdata/workspace_proxy.golden
new file mode 100644
index 0000000000000..4ac30acbad86b
--- /dev/null
+++ b/helm/coder/tests/testdata/workspace_proxy.golden
@@ -0,0 +1,198 @@
+---
+# Source: coder/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder"
+subjects:
+  - kind: ServiceAccount
+    name: "coder"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-workspace-perms
+---
+# Source: coder/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: coder
+  labels:
+    helm.sh/chart: coder-0.1.0
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    {}
+spec:
+  type: LoadBalancer
+  sessionAffinity: None
+  ports:
+    - name: "http"
+      port: 80
+      targetPort: "http"
+      protocol: TCP
+      
+  externalTrafficPolicy: "Cluster"
+  selector:
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/instance: release-name
+---
+# Source: coder/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder
+    app.kubernetes.io/part-of: coder
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-0.1.0
+  name: coder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder
+        app.kubernetes.io/part-of: coder
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-0.1.0
+    spec:
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                  - coder
+              topologyKey: kubernetes.io/hostname
+            weight: 1
+      containers:
+      - args:
+        - wsproxy
+        - server
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_HTTP_ADDRESS
+          value: 0.0.0.0:8080
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_ACCESS_URL
+          value: http://coder.default.svc.cluster.local
+        - name: KUBE_POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        - name: CODER_DERP_SERVER_RELAY_URL
+          value: http://$(KUBE_POD_IP):8080
+        - name: CODER_PRIMARY_ACCESS_URL
+          value: https://dev.coder.com
+        - name: CODER_PROXY_SESSION_TOKEN
+          valueFrom:
+            secretKeyRef:
+              key: token
+              name: coder-workspace-proxy-session-token
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        name: coder
+        ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+            scheme: HTTP
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder
+      terminationGracePeriodSeconds: 60
+      volumes: []
diff --git a/helm/tests/testdata/workspace_proxy.yaml b/helm/coder/tests/testdata/workspace_proxy.yaml
similarity index 100%
rename from helm/tests/testdata/workspace_proxy.yaml
rename to helm/coder/tests/testdata/workspace_proxy.yaml
diff --git a/helm/coder/values.yaml b/helm/coder/values.yaml
new file mode 100644
index 0000000000000..2f064836d5321
--- /dev/null
+++ b/helm/coder/values.yaml
@@ -0,0 +1,327 @@
+# coder -- Primary configuration for `coder server`.
+coder:
+  # coder.env -- The environment variables to set for Coder. These can be used
+  # to configure all aspects of `coder server`. Please see `coder server --help`
+  # for information about what environment variables can be set.
+  # Note: The following environment variables are set by default and cannot be
+  # overridden:
+  # - CODER_HTTP_ADDRESS: set to 0.0.0.0:8080 and cannot be changed.
+  # - CODER_TLS_ADDRESS: set to 0.0.0.0:8443 if tls.secretName is not empty.
+  # - CODER_TLS_ENABLE: set if tls.secretName is not empty.
+  # - CODER_TLS_CERT_FILE: set if tls.secretName is not empty.
+  # - CODER_TLS_KEY_FILE: set if tls.secretName is not empty.
+  # - CODER_PROMETHEUS_ADDRESS: set to 0.0.0.0:2112 and cannot be changed.
+  #   Prometheus must still be enabled by setting CODER_PROMETHEUS_ENABLE.
+  # - KUBE_POD_IP
+  # - CODER_DERP_SERVER_RELAY_URL
+  #
+  # We will additionally set CODER_ACCESS_URL if unset to the cluster service
+  # URL, unless coder.envUseClusterAccessURL is set to false.
+  env: []
+  # - name: "CODER_ACCESS_URL"
+  #   value: "https://coder.example.com"
+
+  # coder.envFrom -- Secrets or ConfigMaps to use for Coder's environment
+  # variables. If you want one environment variable read from a secret, then use
+  # coder.env valueFrom. See the K8s docs for valueFrom here:
+  # https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data
+  #
+  # If setting CODER_ACCESS_URL in coder.envFrom, then you must set
+  # coder.envUseClusterAccessURL to false.
+  envFrom: []
+  # - configMapRef:
+  #     name: coder-config
+  # - secretRef:
+  #     name: coder-config
+
+  # coder.envUseClusterAccessURL -- Determines whether the CODER_ACCESS_URL env
+  # is added to coder.env if it's not already set there. Set this to false if
+  # defining CODER_ACCESS_URL in coder.envFrom to avoid conflicts.
+  envUseClusterAccessURL: true
+
+  # coder.image -- The image to use for Coder.
+  image:
+    # coder.image.repo -- The repository of the image.
+    repo: "ghcr.io/coder/coder"
+    # coder.image.tag -- The tag of the image, defaults to {{.Chart.AppVersion}}
+    # if not set. If you're using the chart directly from git, the default
+    # app version will not work and you'll need to set this value. The helm
+    # chart helpfully fails quickly in this case.
+    tag: ""
+    # coder.image.pullPolicy -- The pull policy to use for the image. See:
+    # https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
+    pullPolicy: IfNotPresent
+    # coder.image.pullSecrets -- The secrets used for pulling the Coder image from
+    # a private registry.
+    pullSecrets: []
+    #  - name: "pull-secret"
+
+  # coder.initContainers -- Init containers for the deployment. See:
+  # https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
+  initContainers:
+    []
+    # - name: init-container
+    #   image: busybox:1.28
+    #   command: ['sh', '-c', "sleep 2"]
+
+  # coder.annotations -- The Deployment annotations. See:
+  # https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  annotations: {}
+
+  # coder.labels -- The Deployment labels. See:
+  # https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+  labels: {}
+
+  # coder.podAnnotations -- The Coder pod annotations. See:
+  # https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  podAnnotations: {}
+
+  # coder.podLabels -- The Coder pod labels. See:
+  # https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+  podLabels: {}
+
+  # coder.serviceAccount -- Configuration for the automatically created service
+  # account. Creation of the service account cannot be disabled.
+  serviceAccount:
+    # coder.serviceAccount.workspacePerms -- Whether or not to grant the coder
+    # service account permissions to manage workspaces. This includes
+    # permission to manage pods and persistent volume claims in the deployment
+    # namespace.
+    #
+    # It is recommended to keep this on if you are using Kubernetes templates
+    # within Coder.
+    workspacePerms: true
+    # coder.serviceAccount.enableDeployments -- Provides the service account permission
+    # to manage Kubernetes deployments.
+    enableDeployments: true
+    # coder.serviceAccount.annotations -- The Coder service account annotations.
+    annotations: {}
+    # coder.serviceAccount.name -- The service account name
+    name: coder
+
+  # coder.securityContext -- Fields related to the container's security
+  # context (as opposed to the pod). Some fields are also present in the pod
+  # security context, in which case these values will take precedence.
+  securityContext:
+    # coder.securityContext.runAsNonRoot -- Requires that the coder container
+    # runs as an unprivileged user. If setting runAsUser to 0 (root), this
+    # will need to be set to false.
+    runAsNonRoot: true
+    # coder.securityContext.runAsUser -- Sets the user id of the container.
+    # For security reasons, we recommend using a non-root user.
+    runAsUser: 1000
+    # coder.securityContext.runAsGroup -- Sets the group id of the container.
+    # For security reasons, we recommend using a non-root group.
+    runAsGroup: 1000
+    # coder.securityContext.readOnlyRootFilesystem -- Mounts the container's
+    # root filesystem as read-only.
+    readOnlyRootFilesystem: null
+    # coder.securityContext.seccompProfile -- Sets the seccomp profile for
+    # the coder container.
+    seccompProfile:
+      type: RuntimeDefault
+    # coder.securityContext.allowPrivilegeEscalation -- Controls whether
+    # the container can gain additional privileges, such as escalating to
+    # root. It is recommended to leave this setting disabled in production.
+    allowPrivilegeEscalation: false
+
+  # coder.volumes -- A list of extra volumes to add to the Coder pod.
+  volumes: []
+  # - name: "my-volume"
+  #   emptyDir: {}
+
+  # coder.volumeMounts -- A list of extra volume mounts to add to the Coder pod.
+  volumeMounts: []
+  # - name: "my-volume"
+  #   mountPath: "/mnt/my-volume"
+
+  # coder.tls -- The TLS configuration for Coder.
+  tls:
+    # coder.tls.secretNames -- A list of TLS server certificate secrets to mount
+    # into the Coder pod. The secrets should exist in the same namespace as the
+    # Helm deployment and should be of type "kubernetes.io/tls". The secrets
+    # will be automatically mounted into the pod if specified, and the correct
+    # "CODER_TLS_*" environment variables will be set for you.
+    secretNames: []
+
+  # coder.replicaCount -- The number of Kubernetes deployment replicas. This
+  # should only be increased if High Availability is enabled.
+  #
+  # This is an Enterprise feature. Contact sales@coder.com.
+  replicaCount: 1
+
+  # coder.workspaceProxy -- Whether or not this deployment of Coder is a Coder
+  # Workspace Proxy. Workspace Proxies reduce the latency between the user and
+  # their workspace for web connections (workspace apps and web terminal) and
+  # proxied connections from the CLI. Workspace Proxies are optional and only
+  # recommended for geographically sparse teams.
+  #
+  # Make sure you set CODER_PRIMARY_ACCESS_URL and CODER_PROXY_SESSION_TOKEN in
+  # the environment below. You can get a proxy token using the CLI:
+  #   coder wsproxy create \
+  #     --name "proxy-name" \
+  #     --display-name "Proxy Name" \
+  #     --icon "/emojis/xyz.png"
+  #
+  # This is an Enterprise feature. Contact sales@coder.com
+  # Docs: https://coder.com/docs/v2/latest/admin/workspace-proxies
+  workspaceProxy: false
+
+  # coder.lifecycle -- container lifecycle handlers for the Coder container, allowing
+  # for lifecycle events such as postStart and preStop events
+  # See: https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/
+  lifecycle:
+    {}
+    # postStart:
+    #   exec:
+    #     command: ["/bin/sh", "-c", "echo postStart"]
+    # preStop:
+    #   exec:
+    #     command: ["/bin/sh","-c","echo preStart"]
+
+  # coder.resources -- The resources to request for Coder. These are optional
+  # and are not set by default.
+  resources:
+    {}
+    # limits:
+    #   cpu: 2000m
+    #   memory: 4096Mi
+    # requests:
+    #   cpu: 2000m
+    #   memory: 4096Mi
+
+  # coder.certs -- CA bundles to mount inside the Coder pod.
+  certs:
+    # coder.certs.secrets -- A list of CA bundle secrets to mount into the Coder
+    # pod. The secrets should exist in the same namespace as the Helm
+    # deployment.
+    #
+    # The given key in each secret is mounted at
+    # `/etc/ssl/certs/{secret_name}.crt`.
+    secrets:
+      []
+      # - name: "my-ca-bundle"
+      #   key: "ca-bundle.crt"
+
+  # coder.affinity -- Allows specifying an affinity rule for the `coder` deployment.
+  # The default rule prefers to schedule coder pods on different
+  # nodes, which is only applicable if coder.replicaCount is greater than 1.
+  affinity:
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+        - podAffinityTerm:
+            labelSelector:
+              matchExpressions:
+                - key: app.kubernetes.io/instance
+                  operator: In
+                  values:
+                    - "coder"
+            topologyKey: kubernetes.io/hostname
+          weight: 1
+
+  # coder.tolerations -- Tolerations for tainted nodes.
+  # See: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+  tolerations:
+    {}
+    # - key: "key"
+    #   operator: "Equal"
+    #   value: "value"
+    #   effect: "NoSchedule"
+
+  # coder.nodeSelector -- Node labels for constraining coder pods to nodes.
+  # See: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
+  nodeSelector: {}
+  #  kubernetes.io/os: linux
+
+  # coder.service -- The Service object to expose for Coder.
+  service:
+    # coder.service.enable -- Whether to create the Service object.
+    enable: true
+    # coder.service.type -- The type of service to expose. See:
+    # https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
+    type: LoadBalancer
+    # coder.service.sessionAffinity -- Must be set to ClientIP or None
+    # AWS ELB does not support session stickiness based on ClientIP, so you must set this to None.
+    # The error message you might see: "Unsupported load balancer affinity: ClientIP"
+    # https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity
+    sessionAffinity: None
+    # coder.service.externalTrafficPolicy -- The external traffic policy to use.
+    # You may need to change this to "Local" to preserve the source IP address
+    # in some situations.
+    # https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
+    externalTrafficPolicy: Cluster
+    # coder.service.loadBalancerIP -- The IP address of the LoadBalancer. If not
+    # specified, a new IP will be generated each time the load balancer is
+    # recreated. It is recommended to manually create a static IP address in
+    # your cloud and specify it here in production to avoid accidental IP
+    # address changes.
+    loadBalancerIP: ""
+    # coder.service.annotations -- The service annotations. See:
+    # https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
+    annotations: {}
+    # coder.service.httpNodePort -- Enabled if coder.service.type is set to NodePort.
+    # If not set, Kubernetes will allocate a port from the default range, 30000-32767.
+    httpNodePort: ""
+    # coder.service.httpsNodePort -- Enabled if coder.service.type is set to NodePort.
+    # If not set, Kubernetes will allocate a port from the default range, 30000-32767.
+    httpsNodePort: ""
+
+  # coder.ingress -- The Ingress object to expose for Coder.
+  ingress:
+    # coder.ingress.enable -- Whether to create the Ingress object. If using an
+    # Ingress, we recommend not specifying coder.tls.secretNames as the Ingress
+    # will handle TLS termination.
+    enable: false
+    # coder.ingress.className -- The name of the Ingress class to use.
+    className: ""
+    # coder.ingress.host -- The hostname to match on.
+    # Be sure to also set CODER_ACCESS_URL within coder.env[]
+    host: ""
+    # coder.ingress.wildcardHost -- The wildcard hostname to match on. Should be
+    # in the form "*.example.com" or "*-suffix.example.com". If you are using a
+    # suffix after the wildcard, the suffix will be stripped from the created
+    # ingress to ensure that it is a legal ingress host. Optional if not using
+    # applications over subdomains.
+    # Be sure to also set CODER_WILDCARD_ACCESS_URL within coder.env[]
+    wildcardHost: ""
+    # coder.ingress.annotations -- The ingress annotations.
+    annotations: {}
+    # coder.ingress.tls -- The TLS configuration to use for the Ingress.
+    tls:
+      # coder.ingress.tls.enable -- Whether to enable TLS on the Ingress.
+      enable: false
+      # coder.ingress.tls.secretName -- The name of the TLS secret to use.
+      secretName: ""
+      # coder.ingress.tls.wildcardSecretName -- The name of the TLS secret to
+      # use for the wildcard host.
+      wildcardSecretName: ""
+
+  # coder.command -- The command to use when running the Coder container. Used
+  # for customizing the location of the `coder` binary in your image.
+  command:
+    - /opt/coder
+
+  # coder.commandArgs -- Set arguments for the entrypoint command of the Coder pod.
+  commandArgs: []
+
+# provisionerDaemon -- Configuration for external provisioner daemons.
+#
+# This is an Enterprise feature. Contact sales@coder.com.
+provisionerDaemon:
+  # provisionerDaemon.pskSecretName -- The name of the Kubernetes secret that contains the
+  # Pre-Shared Key (PSK) to use to authenticate external provisioner daemons with Coder.  The
+  # secret must be in the same namespace as the Helm deployment, and contain an item called "psk"
+  # which contains the pre-shared key.
+  pskSecretName: ""
+
+# extraTemplates -- Array of extra objects to deploy with the release. Strings
+# are evaluated as a template and can use template expansions and functions. All
+# other objects are used as yaml.
+extraTemplates:
+  #- |
+  #    apiVersion: v1
+  #    kind: ConfigMap
+  #    metadata:
+  #      name: my-configmap
+  #    data:
+  #      key: {{ .Values.myCustomValue | quote }}
diff --git a/helm/libcoder/Chart.yaml b/helm/libcoder/Chart.yaml
new file mode 100644
index 0000000000000..90c881af5d62d
--- /dev/null
+++ b/helm/libcoder/Chart.yaml
@@ -0,0 +1,13 @@
+apiVersion: v2
+name: libcoder
+description: Coder library chart
+home: https://github.com/coder/coder
+
+type: library
+version: "0.1.0"
+appVersion: "0.1.0"
+
+maintainers:
+  - name: Coder Technologies, Inc.
+    email: support@coder.com
+    url: https://coder.com/contact
diff --git a/helm/libcoder/templates/_coder.yaml b/helm/libcoder/templates/_coder.yaml
new file mode 100644
index 0000000000000..77cdbb2a3dfe5
--- /dev/null
+++ b/helm/libcoder/templates/_coder.yaml
@@ -0,0 +1,85 @@
+{{- define "libcoder.deployment.tpl" -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "coder.name" .}}
+  labels:
+    {{- include "coder.labels" . | nindent 4 }}
+    {{- with .Values.coder.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  annotations: {{ toYaml .Values.coder.annotations | nindent 4}}
+spec:
+  replicas: {{ .Values.coder.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "coder.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "coder.labels" . | nindent 8 }}
+          {{- with .Values.coder.podLabels }}
+          {{- toYaml . | nindent 8 }}
+          {{- end }}
+      annotations:
+        {{- toYaml .Values.coder.podAnnotations | nindent 8  }}
+    spec:
+      serviceAccountName: {{ .Values.coder.serviceAccount.name | quote }}
+      restartPolicy: Always
+      {{- with .Values.coder.image.pullSecrets }}
+      imagePullSecrets:
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: 60
+      {{- with .Values.coder.affinity }}
+      affinity:
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.coder.tolerations }}
+      tolerations:
+      {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.coder.nodeSelector }}
+      nodeSelector:
+      {{ toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.coder.initContainers }}
+      initContainers:
+      {{ toYaml . | nindent 8 }}
+      {{- end }}
+      containers: []
+      {{- include "coder.volumes" . | nindent 6 }}
+{{- end -}}
+{{- define "libcoder.deployment" -}}
+{{- include "libcoder.util.merge" (append . "libcoder.deployment.tpl") -}}
+{{- end -}}
+
+{{- define "libcoder.containerspec.tpl" -}}
+name: coder
+image: {{ include "coder.image" . | quote }}
+imagePullPolicy: {{ .Values.coder.image.pullPolicy }}
+command:
+  {{- toYaml .Values.coder.command | nindent 2 }}
+resources:
+  {{- toYaml .Values.coder.resources | nindent 2 }}
+lifecycle:
+  {{- toYaml .Values.coder.lifecycle | nindent 2 }}
+securityContext: {{ toYaml .Values.coder.securityContext | nindent 2 }}
+{{ include "coder.volumeMounts" . }}
+{{- end -}}
+{{- define "libcoder.containerspec" -}}
+{{- include "libcoder.util.merge" (append . "libcoder.containerspec.tpl") -}}
+{{- end -}}
+
+{{- define "libcoder.serviceaccount.tpl" -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.coder.serviceAccount.name | quote }}
+  annotations: {{ toYaml .Values.coder.serviceAccount.annotations | nindent 4 }}
+  labels:
+    {{- include "coder.labels" . | nindent 4 }}
+{{- end -}}
+{{- define "libcoder.serviceaccount" -}}
+{{- include "libcoder.util.merge" (append . "libcoder.serviceaccount.tpl") -}}
+{{- end -}}
diff --git a/helm/templates/_helpers.tpl b/helm/libcoder/templates/_helpers.tpl
similarity index 93%
rename from helm/templates/_helpers.tpl
rename to helm/libcoder/templates/_helpers.tpl
index d884b28402000..9a6c5dfcfb82d 100644
--- a/helm/templates/_helpers.tpl
+++ b/helm/libcoder/templates/_helpers.tpl
@@ -49,11 +49,15 @@ Coder Docker image URI
 Coder TLS enabled.
 */}}
 {{- define "coder.tlsEnabled" -}}
-{{- if .Values.coder.tls.secretNames -}}
-true
-{{- else -}}
-false
-{{- end -}}
+    {{- if hasKey .Values.coder "tls" -}}
+      {{- if .Values.coder.tls.secretNames -}}
+        true
+      {{- else -}}
+        false
+      {{- end -}}
+    {{- else -}}
+      false
+    {{- end -}}
 {{- end }}
 
 {{/*
@@ -88,11 +92,13 @@ http
 Coder volume definitions.
 */}}
 {{- define "coder.volumeList" }}
-{{ range $secretName := .Values.coder.tls.secretNames -}}
+{{- if hasKey .Values.coder "tls" -}}
+{{- range $secretName := .Values.coder.tls.secretNames }}
 - name: "tls-{{ $secretName }}"
   secret:
     secretName: {{ $secretName | quote }}
 {{ end -}}
+{{- end }}
 {{ range $secret := .Values.coder.certs.secrets -}}
 - name: "ca-cert-{{ $secret.name }}"
   secret:
@@ -119,11 +125,13 @@ volumes: []
 Coder volume mounts.
 */}}
 {{- define "coder.volumeMountList" }}
+{{- if hasKey .Values.coder "tls" }}
 {{ range $secretName := .Values.coder.tls.secretNames -}}
 - name: "tls-{{ $secretName }}"
   mountPath: "/etc/ssl/certs/coder/{{ $secretName }}"
   readOnly: true
 {{ end -}}
+{{- end }}
 {{ range $secret := .Values.coder.certs.secrets -}}
 - name: "ca-cert-{{ $secret.name }}"
   mountPath: "/etc/ssl/certs/{{ $secret.name }}.crt"
diff --git a/helm/libcoder/templates/_rbac.yaml b/helm/libcoder/templates/_rbac.yaml
new file mode 100644
index 0000000000000..c60357ad2a796
--- /dev/null
+++ b/helm/libcoder/templates/_rbac.yaml
@@ -0,0 +1,59 @@
+{{- define "libcoder.rbac.tpl" -}}
+{{- if .Values.coder.serviceAccount.workspacePerms }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ .Values.coder.serviceAccount.name }}-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+{{- if .Values.coder.serviceAccount.enableDeployments }}
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+{{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ .Values.coder.serviceAccount.name | quote }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ .Values.coder.serviceAccount.name | quote }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ .Values.coder.serviceAccount.name }}-workspace-perms
+{{- end }}
+{{- end -}}
diff --git a/helm/libcoder/templates/_util.yaml b/helm/libcoder/templates/_util.yaml
new file mode 100644
index 0000000000000..ebdc13e3631ec
--- /dev/null
+++ b/helm/libcoder/templates/_util.yaml
@@ -0,0 +1,13 @@
+{{- /*
+  libcoder.util.merge will merge two YAML templates and output the result.
+  This takes an array of three values:
+    - the top context
+    - the template name of the overrides (destination)
+    - the template name of the base (source)
+*/}}
+{{- define "libcoder.util.merge" -}}
+{{- $top := first . -}}
+{{- $overrides := fromYaml (include (index . 1) $top) | default (dict ) -}}
+{{- $tpl := fromYaml (include (index . 2) $top) | default (dict ) -}}
+{{- toYaml (merge $overrides $tpl) -}}
+{{- end -}}
diff --git a/helm/provisioner/Chart.lock b/helm/provisioner/Chart.lock
new file mode 100644
index 0000000000000..b51a533086d42
--- /dev/null
+++ b/helm/provisioner/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: libcoder
+  repository: file://../libcoder
+  version: 0.1.0
+digest: sha256:5c9a99109258073b590a9f98268490ef387fde24c0c7c7ade9c1a8c7ef5e6e10
+generated: "2023-08-07T12:43:45.49343898Z"
diff --git a/helm/provisioner/Chart.yaml b/helm/provisioner/Chart.yaml
new file mode 100644
index 0000000000000..de0102e1b5d41
--- /dev/null
+++ b/helm/provisioner/Chart.yaml
@@ -0,0 +1,36 @@
+apiVersion: v2
+name: coder-provisioner
+description:
+  "External provisioner daemon for Coder. This is an Enterprise feature; contact
+  sales@coder.com."
+home: https://github.com/coder/coder
+
+# version and appVersion are injected at release and will always be shown as
+# 0.1.0 in the repository.
+#
+# If you're installing the Helm chart directly from git it will have this
+# version, which means the auto-generated image URI will be invalid. You can set
+# "coder.image.tag" to the desired tag manually.
+type: application
+version: "0.1.0"
+appVersion: "0.1.0"
+
+# Coder has a hard requirement on Kubernetes 1.19, as this version introduced
+# the networking.k8s.io/v1 API.
+kubeVersion: ">= 1.19.0-0"
+
+keywords:
+  - coder
+  - terraform
+sources:
+  - https://github.com/coder/coder/tree/main/helm/provisioner
+icon: https://helm.coder.com/coder_logo_black.png
+maintainers:
+  - name: Coder Technologies, Inc.
+    email: support@coder.com
+    url: https://coder.com/contact
+
+dependencies:
+  - name: libcoder
+    version: 0.1.0
+    repository: file://../libcoder
diff --git a/helm/provisioner/README.md b/helm/provisioner/README.md
new file mode 100644
index 0000000000000..d1f8b6727fa11
--- /dev/null
+++ b/helm/provisioner/README.md
@@ -0,0 +1,36 @@
+# Coder Helm Chart
+
+This directory contains the Helm chart used to deploy Coder provisioner daemons onto a Kubernetes
+cluster.
+
+External provisioner daemons are an Enterprise feature. Contact sales@coder.com.
+
+## Getting Started
+
+> **Warning**: The main branch in this repository does not represent the
+> latest release of Coder. Please reference our installation docs for
+> instructions on a tagged release.
+
+View
+[our docs](https://coder.com/docs/v2/latest/admin/provisioners)
+for detailed installation instructions.
+
+## Values
+
+Please refer to [values.yaml](values.yaml) for available Helm values and their
+defaults.
+
+A good starting point for your values file is:
+
+```yaml
+coder:
+  env:
+    - name: CODER_URL
+      value: "https://coder.example.com"
+    # This env enables the Prometheus metrics endpoint.
+    - name: CODER_PROMETHEUS_ADDRESS
+      value: "0.0.0.0:2112"
+  replicaCount: 10
+provisionerDaemon:
+  pskSecretName: "coder-provisioner-psk"
+```
diff --git a/helm/provisioner/charts/libcoder-0.1.0.tgz b/helm/provisioner/charts/libcoder-0.1.0.tgz
new file mode 100644
index 0000000000000..094e3f64207ad
Binary files /dev/null and b/helm/provisioner/charts/libcoder-0.1.0.tgz differ
diff --git a/helm/provisioner/templates/_coder.tpl b/helm/provisioner/templates/_coder.tpl
new file mode 100644
index 0000000000000..b84b7d8c4e48c
--- /dev/null
+++ b/helm/provisioner/templates/_coder.tpl
@@ -0,0 +1,86 @@
+{{/*
+Service account to merge into the libcoder template
+*/}}
+{{- define "coder.serviceaccount" -}}
+{{- end }}
+
+{{/*
+Deployment to merge into the libcoder template
+*/}}
+{{- define "coder.deployment" -}}
+spec:
+  template:
+    spec:
+      terminationGracePeriodSeconds: {{ .Values.provisionerDaemon.terminationGracePeriodSeconds }}
+      containers:
+      -
+{{ include "libcoder.containerspec" (list . "coder.containerspec") | indent 8}}
+
+{{- end }}
+
+{{/*
+ContainerSpec for the Coder container of the Coder deployment
+*/}}
+{{- define "coder.containerspec" -}}
+args:
+{{- if .Values.coder.commandArgs }}
+  {{- toYaml .Values.coder.commandArgs | nindent 12 }}
+{{- else }}
+- provisionerd
+- start
+{{- end }}
+env:
+- name: CODER_PROMETHEUS_ADDRESS
+  value: "0.0.0.0:2112"
+- name: CODER_PROVISIONER_DAEMON_PSK
+  valueFrom:
+    secretKeyRef:
+      name: {{ .Values.provisionerDaemon.pskSecretName | quote }}
+      key: psk
+{{- if include "provisioner.tags" . }}
+- name: CODER_PROVISIONERD_TAGS
+  value: {{ include "provisioner.tags" . }}
+{{- end }}
+  # Set the default access URL so a `helm apply` works by default.
+  # See: https://github.com/coder/coder/issues/5024
+{{- $hasAccessURL := false }}
+{{- range .Values.coder.env }}
+{{- if eq .name "CODER_URL" }}
+{{- $hasAccessURL = true }}
+{{- end }}
+{{- end }}
+{{- if not $hasAccessURL }}
+- name: CODER_URL
+  value: {{ include "coder.defaultAccessURL" . | quote }}
+{{- end }}
+{{- with .Values.coder.env }}
+{{ toYaml . }}
+{{- end }}
+ports:
+  {{- range .Values.coder.env }}
+  {{- if eq .name "CODER_PROMETHEUS_ENABLE" }}
+  {{/*
+    This sadly has to be nested to avoid evaluating the second part
+    of the condition too early and potentially getting type errors if
+    the value is not a string (like a `valueFrom`). We do not support
+    `valueFrom` for this env var specifically.
+    */}}
+  {{- if eq .value "true" }}
+- name: "prometheus-http"
+  containerPort: 2112
+  protocol: TCP
+  {{- end }}
+  {{- end }}
+  {{- end }}
+{{- end }}
+
+{{/*
+Convert provisioner tags to the environment variable format
+*/}}
+{{- define "provisioner.tags" -}}
+  {{- $keys := keys .Values.provisionerDaemon.tags | sortAlpha -}}
+  {{- range $i, $key := $keys -}}
+    {{- $val := get $.Values.provisionerDaemon.tags $key -}}
+    {{- if ne $i 0 -}},{{- end -}}{{ $key }}={{ $val }}
+  {{- end -}}
+{{- end -}}
diff --git a/helm/provisioner/templates/coder.yaml b/helm/provisioner/templates/coder.yaml
new file mode 100644
index 0000000000000..65eaac00ac001
--- /dev/null
+++ b/helm/provisioner/templates/coder.yaml
@@ -0,0 +1,5 @@
+---
+{{ include "libcoder.serviceaccount" (list . "coder.serviceaccount") }}
+
+---
+{{ include "libcoder.deployment" (list . "coder.deployment") }}
diff --git a/helm/provisioner/templates/extra-templates.yaml b/helm/provisioner/templates/extra-templates.yaml
new file mode 100644
index 0000000000000..e04765810055a
--- /dev/null
+++ b/helm/provisioner/templates/extra-templates.yaml
@@ -0,0 +1,4 @@
+{{- range .Values.extraTemplates }}
+---
+{{ include "coder.renderTemplate" (dict "value" . "context" $) }}
+{{- end }}
diff --git a/helm/provisioner/templates/rbac.yaml b/helm/provisioner/templates/rbac.yaml
new file mode 100644
index 0000000000000..07fb36d876824
--- /dev/null
+++ b/helm/provisioner/templates/rbac.yaml
@@ -0,0 +1 @@
+{{ include "libcoder.rbac.tpl" . }}
diff --git a/helm/provisioner/tests/chart_test.go b/helm/provisioner/tests/chart_test.go
new file mode 100644
index 0000000000000..c7f379ddd18a5
--- /dev/null
+++ b/helm/provisioner/tests/chart_test.go
@@ -0,0 +1,176 @@
+package tests // nolint: testpackage
+
+import (
+	"bytes"
+	"flag"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/testutil"
+)
+
+// These tests run `helm template` with the values file specified in each test
+// and compare the output to the contents of the corresponding golden file.
+// All values and golden files are located in the `testdata` directory.
+// To update golden files, run `go test . -update`.
+
+// updateGoldenFiles is a flag that can be set to update golden files.
+var updateGoldenFiles = flag.Bool("update", false, "Update golden files")
+
+var testCases = []testCase{
+	{
+		name:          "default_values",
+		expectedError: "",
+	},
+	{
+		name:          "missing_values",
+		expectedError: `You must specify the coder.image.tag value if you're installing the Helm chart directly from Git.`,
+	},
+	{
+		name:          "sa",
+		expectedError: "",
+	},
+	{
+		name:          "labels_annotations",
+		expectedError: "",
+	},
+	{
+		name:          "command",
+		expectedError: "",
+	},
+	{
+		name:          "command_args",
+		expectedError: "",
+	},
+	{
+		name:          "provisionerd_psk",
+		expectedError: "",
+	},
+	{
+		name:          "extra_templates",
+		expectedError: "",
+	},
+}
+
+type testCase struct {
+	name          string // Name of the test case. This is used to control which values and golden file are used.
+	expectedError string // Expected error from running `helm template`.
+}
+
+func (tc testCase) valuesFilePath() string {
+	return filepath.Join("./testdata", tc.name+".yaml")
+}
+
+func (tc testCase) goldenFilePath() string {
+	return filepath.Join("./testdata", tc.name+".golden")
+}
+
+func TestRenderChart(t *testing.T) {
+	t.Parallel()
+	if *updateGoldenFiles {
+		t.Skip("Golden files are being updated. Skipping test.")
+	}
+	if testutil.InCI() {
+		switch runtime.GOOS {
+		case "windows", "darwin":
+			t.Skip("Skipping tests on Windows and macOS in CI")
+		}
+	}
+
+	// Ensure that Helm is available in $PATH
+	helmPath := lookupHelm(t)
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			// Ensure that the values file exists.
+			valuesFilePath := tc.valuesFilePath()
+			if _, err := os.Stat(valuesFilePath); os.IsNotExist(err) {
+				t.Fatalf("values file %q does not exist", valuesFilePath)
+			}
+
+			// Run helm template with the values file.
+			templateOutput, err := runHelmTemplate(t, helmPath, "..", valuesFilePath)
+			if tc.expectedError != "" {
+				require.Error(t, err, "helm template should have failed")
+				require.Contains(t, templateOutput, tc.expectedError, "helm template output should contain expected error")
+			} else {
+				require.NoError(t, err, "helm template should not have failed")
+				require.NotEmpty(t, templateOutput, "helm template output should not be empty")
+				goldenFilePath := tc.goldenFilePath()
+				goldenBytes, err := os.ReadFile(goldenFilePath)
+				require.NoError(t, err, "failed to read golden file %q", goldenFilePath)
+
+				// Remove carriage returns to make tests pass on Windows.
+				goldenBytes = bytes.Replace(goldenBytes, []byte("\r"), []byte(""), -1)
+				expected := string(goldenBytes)
+
+				require.NoError(t, err, "failed to load golden file %q")
+				require.Equal(t, expected, templateOutput)
+			}
+		})
+	}
+}
+
+func TestUpdateGoldenFiles(t *testing.T) {
+	t.Parallel()
+	if !*updateGoldenFiles {
+		t.Skip("Run with -update to update golden files")
+	}
+
+	helmPath := lookupHelm(t)
+	for _, tc := range testCases {
+		if tc.expectedError != "" {
+			t.Logf("skipping test case %q with render error", tc.name)
+			continue
+		}
+
+		valuesPath := tc.valuesFilePath()
+		templateOutput, err := runHelmTemplate(t, helmPath, "..", valuesPath)
+
+		require.NoError(t, err, "failed to run `helm template -f %q`", valuesPath)
+
+		goldenFilePath := tc.goldenFilePath()
+		err = os.WriteFile(goldenFilePath, []byte(templateOutput), 0o644) // nolint:gosec
+		require.NoError(t, err, "failed to write golden file %q", goldenFilePath)
+	}
+	t.Log("Golden files updated. Please review the changes and commit them.")
+}
+
+// runHelmTemplate runs helm template on the given chart with the given values and
+// returns the raw output.
+func runHelmTemplate(t testing.TB, helmPath, chartDir, valuesFilePath string) (string, error) {
+	// Ensure that valuesFilePath exists
+	if _, err := os.Stat(valuesFilePath); err != nil {
+		return "", xerrors.Errorf("values file %q does not exist: %w", valuesFilePath, err)
+	}
+
+	cmd := exec.Command(helmPath, "template", chartDir, "-f", valuesFilePath, "--namespace", "default")
+	t.Logf("exec command: %v", cmd.Args)
+	out, err := cmd.CombinedOutput()
+	return string(out), err
+}
+
+// lookupHelm ensures that Helm is available in $PATH and returns the path to the
+// Helm executable.
+func lookupHelm(t testing.TB) string {
+	helmPath, err := exec.LookPath("helm")
+	if err != nil {
+		t.Fatalf("helm not found in $PATH: %v", err)
+		return ""
+	}
+	t.Logf("Using helm at %q", helmPath)
+	return helmPath
+}
+
+func TestMain(m *testing.M) {
+	flag.Parse()
+	os.Exit(m.Run())
+}
diff --git a/helm/provisioner/tests/testdata/command.golden b/helm/provisioner/tests/testdata/command.golden
new file mode 100644
index 0000000000000..39760332be082
--- /dev/null
+++ b/helm/provisioner/tests/testdata/command.golden
@@ -0,0 +1,135 @@
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-provisioner-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder-provisioner"
+subjects:
+  - kind: ServiceAccount
+    name: "coder-provisioner"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-provisioner-workspace-perms
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder-provisioner
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder-provisioner
+        app.kubernetes.io/part-of: coder-provisioner
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-provisioner-0.1.0
+    spec:
+      containers:
+      - args:
+        - provisionerd
+        - start
+        command:
+        - /opt/colin
+        env:
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_PROVISIONER_DAEMON_PSK
+          valueFrom:
+            secretKeyRef:
+              key: psk
+              name: coder-provisioner-psk
+        - name: CODER_URL
+          value: http://coder.default.svc.cluster.local
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        name: coder
+        ports: null
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder-provisioner
+      terminationGracePeriodSeconds: 600
+      volumes: []
diff --git a/helm/provisioner/tests/testdata/command.yaml b/helm/provisioner/tests/testdata/command.yaml
new file mode 100644
index 0000000000000..ef4c8de967f1a
--- /dev/null
+++ b/helm/provisioner/tests/testdata/command.yaml
@@ -0,0 +1,5 @@
+coder:
+  image:
+    tag: latest
+  command:
+    - /opt/colin
diff --git a/helm/provisioner/tests/testdata/command_args.golden b/helm/provisioner/tests/testdata/command_args.golden
new file mode 100644
index 0000000000000..48162991f61eb
--- /dev/null
+++ b/helm/provisioner/tests/testdata/command_args.golden
@@ -0,0 +1,135 @@
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-provisioner-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder-provisioner"
+subjects:
+  - kind: ServiceAccount
+    name: "coder-provisioner"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-provisioner-workspace-perms
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder-provisioner
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder-provisioner
+        app.kubernetes.io/part-of: coder-provisioner
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-provisioner-0.1.0
+    spec:
+      containers:
+      - args:
+        - arg1
+        - arg2
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_PROVISIONER_DAEMON_PSK
+          valueFrom:
+            secretKeyRef:
+              key: psk
+              name: coder-provisioner-psk
+        - name: CODER_URL
+          value: http://coder.default.svc.cluster.local
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        name: coder
+        ports: null
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder-provisioner
+      terminationGracePeriodSeconds: 600
+      volumes: []
diff --git a/helm/provisioner/tests/testdata/command_args.yaml b/helm/provisioner/tests/testdata/command_args.yaml
new file mode 100644
index 0000000000000..59d012aabbefb
--- /dev/null
+++ b/helm/provisioner/tests/testdata/command_args.yaml
@@ -0,0 +1,6 @@
+coder:
+  image:
+    tag: latest
+  commandArgs:
+    - arg1
+    - arg2
diff --git a/helm/provisioner/tests/testdata/default_values.golden b/helm/provisioner/tests/testdata/default_values.golden
new file mode 100644
index 0000000000000..04197fca37468
--- /dev/null
+++ b/helm/provisioner/tests/testdata/default_values.golden
@@ -0,0 +1,135 @@
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-provisioner-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder-provisioner"
+subjects:
+  - kind: ServiceAccount
+    name: "coder-provisioner"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-provisioner-workspace-perms
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder-provisioner
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder-provisioner
+        app.kubernetes.io/part-of: coder-provisioner
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-provisioner-0.1.0
+    spec:
+      containers:
+      - args:
+        - provisionerd
+        - start
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_PROVISIONER_DAEMON_PSK
+          valueFrom:
+            secretKeyRef:
+              key: psk
+              name: coder-provisioner-psk
+        - name: CODER_URL
+          value: http://coder.default.svc.cluster.local
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        name: coder
+        ports: null
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder-provisioner
+      terminationGracePeriodSeconds: 600
+      volumes: []
diff --git a/helm/provisioner/tests/testdata/default_values.yaml b/helm/provisioner/tests/testdata/default_values.yaml
new file mode 100644
index 0000000000000..70cdc8b472215
--- /dev/null
+++ b/helm/provisioner/tests/testdata/default_values.yaml
@@ -0,0 +1,3 @@
+coder:
+  image:
+    tag: latest
diff --git a/helm/provisioner/tests/testdata/extra_templates.golden b/helm/provisioner/tests/testdata/extra_templates.golden
new file mode 100644
index 0000000000000..73fd654dd7245
--- /dev/null
+++ b/helm/provisioner/tests/testdata/extra_templates.golden
@@ -0,0 +1,144 @@
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+---
+# Source: coder-provisioner/templates/extra-templates.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: some-config
+  namespace: default
+data:
+  key: some-value
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-provisioner-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder-provisioner"
+subjects:
+  - kind: ServiceAccount
+    name: "coder-provisioner"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-provisioner-workspace-perms
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder-provisioner
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder-provisioner
+        app.kubernetes.io/part-of: coder-provisioner
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-provisioner-0.1.0
+    spec:
+      containers:
+      - args:
+        - provisionerd
+        - start
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_PROVISIONER_DAEMON_PSK
+          valueFrom:
+            secretKeyRef:
+              key: psk
+              name: coder-provisioner-psk
+        - name: CODER_URL
+          value: http://coder.default.svc.cluster.local
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        name: coder
+        ports: null
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder-provisioner
+      terminationGracePeriodSeconds: 600
+      volumes: []
diff --git a/helm/provisioner/tests/testdata/extra_templates.yaml b/helm/provisioner/tests/testdata/extra_templates.yaml
new file mode 100644
index 0000000000000..6d9fd6531e3a3
--- /dev/null
+++ b/helm/provisioner/tests/testdata/extra_templates.yaml
@@ -0,0 +1,12 @@
+coder:
+  image:
+    tag: latest
+extraTemplates:
+  - |
+    apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: some-config
+      namespace: {{ .Release.Namespace }}
+    data:
+      key: some-value
diff --git a/helm/provisioner/tests/testdata/labels_annotations.golden b/helm/provisioner/tests/testdata/labels_annotations.golden
new file mode 100644
index 0000000000000..1c2d49d8c424c
--- /dev/null
+++ b/helm/provisioner/tests/testdata/labels_annotations.golden
@@ -0,0 +1,143 @@
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-provisioner-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder-provisioner"
+subjects:
+  - kind: ServiceAccount
+    name: "coder-provisioner"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-provisioner-workspace-perms
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    com.coder/annotation/baz: qux
+    com.coder/annotation/foo: bar
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    com.coder/label/baz: qux
+    com.coder/label/foo: bar
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder-provisioner
+  template:
+    metadata:
+      annotations:
+        com.coder/podAnnotation/baz: qux
+        com.coder/podAnnotation/foo: bar
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder-provisioner
+        app.kubernetes.io/part-of: coder-provisioner
+        app.kubernetes.io/version: 0.1.0
+        com.coder/podLabel/baz: qux
+        com.coder/podLabel/foo: bar
+        helm.sh/chart: coder-provisioner-0.1.0
+    spec:
+      containers:
+      - args:
+        - provisionerd
+        - start
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_PROVISIONER_DAEMON_PSK
+          valueFrom:
+            secretKeyRef:
+              key: psk
+              name: coder-provisioner-psk
+        - name: CODER_URL
+          value: http://coder.default.svc.cluster.local
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        name: coder
+        ports: null
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder-provisioner
+      terminationGracePeriodSeconds: 600
+      volumes: []
diff --git a/helm/provisioner/tests/testdata/labels_annotations.yaml b/helm/provisioner/tests/testdata/labels_annotations.yaml
new file mode 100644
index 0000000000000..a7ddda708be79
--- /dev/null
+++ b/helm/provisioner/tests/testdata/labels_annotations.yaml
@@ -0,0 +1,15 @@
+coder:
+  image:
+    tag: latest
+  annotations:
+    com.coder/annotation/foo: bar
+    com.coder/annotation/baz: qux
+  labels:
+    com.coder/label/foo: bar
+    com.coder/label/baz: qux
+  podAnnotations:
+    com.coder/podAnnotation/foo: bar
+    com.coder/podAnnotation/baz: qux
+  podLabels:
+    com.coder/podLabel/foo: bar
+    com.coder/podLabel/baz: qux
diff --git a/helm/provisioner/tests/testdata/missing_values.yaml b/helm/provisioner/tests/testdata/missing_values.yaml
new file mode 100644
index 0000000000000..e69de29bb2d1d
diff --git a/helm/provisioner/tests/testdata/provisionerd_psk.golden b/helm/provisioner/tests/testdata/provisionerd_psk.golden
new file mode 100644
index 0000000000000..b641ee0db37cb
--- /dev/null
+++ b/helm/provisioner/tests/testdata/provisionerd_psk.golden
@@ -0,0 +1,137 @@
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-provisioner-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder-provisioner"
+subjects:
+  - kind: ServiceAccount
+    name: "coder-provisioner"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-provisioner-workspace-perms
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder-provisioner
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder-provisioner
+        app.kubernetes.io/part-of: coder-provisioner
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-provisioner-0.1.0
+    spec:
+      containers:
+      - args:
+        - provisionerd
+        - start
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_PROVISIONER_DAEMON_PSK
+          valueFrom:
+            secretKeyRef:
+              key: psk
+              name: coder-provisionerd-psk
+        - name: CODER_PROVISIONERD_TAGS
+          value: clusterType=k8s,location=auh
+        - name: CODER_URL
+          value: http://coder.default.svc.cluster.local
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        name: coder
+        ports: null
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder-provisioner
+      terminationGracePeriodSeconds: 600
+      volumes: []
diff --git a/helm/provisioner/tests/testdata/provisionerd_psk.yaml b/helm/provisioner/tests/testdata/provisionerd_psk.yaml
new file mode 100644
index 0000000000000..f891b007db539
--- /dev/null
+++ b/helm/provisioner/tests/testdata/provisionerd_psk.yaml
@@ -0,0 +1,8 @@
+coder:
+  image:
+    tag: latest
+provisionerDaemon:
+  pskSecretName: "coder-provisionerd-psk"
+  tags:
+    location: auh
+    clusterType: k8s
diff --git a/helm/provisioner/tests/testdata/sa.golden b/helm/provisioner/tests/testdata/sa.golden
new file mode 100644
index 0000000000000..e8f6ee3bd45dd
--- /dev/null
+++ b/helm/provisioner/tests/testdata/sa.golden
@@ -0,0 +1,136 @@
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/coder-service-account
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-service-account
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: coder-service-account-workspace-perms
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+  - apiGroups:
+    - apps
+    resources:
+    - deployments
+    verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+---
+# Source: coder-provisioner/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: "coder-service-account"
+subjects:
+  - kind: ServiceAccount
+    name: "coder-service-account"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: coder-service-account-workspace-perms
+---
+# Source: coder-provisioner/templates/coder.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations: {}
+  labels:
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: coder-provisioner
+    app.kubernetes.io/part-of: coder-provisioner
+    app.kubernetes.io/version: 0.1.0
+    helm.sh/chart: coder-provisioner-0.1.0
+  name: coder-provisioner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: release-name
+      app.kubernetes.io/name: coder-provisioner
+  template:
+    metadata:
+      annotations: {}
+      labels:
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: coder-provisioner
+        app.kubernetes.io/part-of: coder-provisioner
+        app.kubernetes.io/version: 0.1.0
+        helm.sh/chart: coder-provisioner-0.1.0
+    spec:
+      containers:
+      - args:
+        - provisionerd
+        - start
+        command:
+        - /opt/coder
+        env:
+        - name: CODER_PROMETHEUS_ADDRESS
+          value: 0.0.0.0:2112
+        - name: CODER_PROVISIONER_DAEMON_PSK
+          valueFrom:
+            secretKeyRef:
+              key: psk
+              name: coder-provisioner-psk
+        - name: CODER_URL
+          value: http://coder.default.svc.cluster.local
+        image: ghcr.io/coder/coder:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle: {}
+        name: coder
+        ports: null
+        resources: {}
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: null
+          runAsGroup: 1000
+          runAsNonRoot: true
+          runAsUser: 1000
+          seccompProfile:
+            type: RuntimeDefault
+        volumeMounts: []
+      restartPolicy: Always
+      serviceAccountName: coder-service-account
+      terminationGracePeriodSeconds: 600
+      volumes: []
diff --git a/helm/provisioner/tests/testdata/sa.yaml b/helm/provisioner/tests/testdata/sa.yaml
new file mode 100644
index 0000000000000..4e0c98c223ae1
--- /dev/null
+++ b/helm/provisioner/tests/testdata/sa.yaml
@@ -0,0 +1,8 @@
+coder:
+  image:
+    tag: latest
+  serviceAccount:
+    name: coder-service-account
+    annotations:
+      eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/coder-service-account
+    workspacePerms: true
diff --git a/helm/provisioner/values.yaml b/helm/provisioner/values.yaml
new file mode 100644
index 0000000000000..273a74bd759b1
--- /dev/null
+++ b/helm/provisioner/values.yaml
@@ -0,0 +1,221 @@
+# coder -- Common configuration options.
+coder:
+  # coder.env -- The environment variables to set. These can be used to
+  # configure all aspects of Coder provisioner daemon. Please see
+  # `coder provisionerd start --help for information about what environment
+  # variables can be set.
+  # Note: The following environment variables are set by default and cannot be
+  # overridden:
+  # - CODER_PROMETHEUS_ADDRESS: set to 0.0.0.0:2112 and cannot be changed.
+  #   Prometheus must still be enabled by setting CODER_PROMETHEUS_ENABLE.
+  #
+  # We will additionally set CODER_URL, if unset, to the cluster service
+  # URL.
+  env: []
+  # - name: "CODER_URL"
+  #   value: "https://coder.example.com"
+
+  # coder.image -- The image to use for Coder provisioner daemon.
+  image:
+    # coder.image.repo -- The repository of the image.
+    repo: "ghcr.io/coder/coder"
+    # coder.image.tag -- The tag of the image, defaults to {{.Chart.AppVersion}}
+    # if not set. If you're using the chart directly from git, the default
+    # app version will not work and you'll need to set this value. The helm
+    # chart helpfully fails quickly in this case.
+    tag: ""
+    # coder.image.pullPolicy -- The pull policy to use for the image. See:
+    # https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
+    pullPolicy: IfNotPresent
+    # coder.image.pullSecrets -- The secrets used for pulling the Coder image from
+    # a private registry.
+    pullSecrets: []
+    #  - name: "pull-secret"
+
+  # coder.initContainers -- Init containers for the deployment. See:
+  # https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
+  initContainers:
+    []
+    # - name: init-container
+    #   image: busybox:1.28
+    #   command: ['sh', '-c', "sleep 2"]
+
+  # coder.annotations -- The Deployment annotations. See:
+  # https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  annotations: {}
+
+  # coder.labels -- The Deployment labels. See:
+  # https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+  labels: {}
+
+  # coder.podAnnotations -- The Coder pod annotations. See:
+  # https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  podAnnotations: {}
+
+  # coder.podLabels -- The Coder pod labels. See:
+  # https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+  podLabels: {}
+
+  # coder.serviceAccount -- Configuration for the automatically created service
+  # account. Creation of the service account cannot be disabled.
+  serviceAccount:
+    # coder.serviceAccount.workspacePerms -- Whether or not to grant the
+    # service account permissions to manage workspaces. This includes
+    # permission to manage pods and persistent volume claims in the deployment
+    # namespace.
+    #
+    # It is recommended to keep this on if you are using Kubernetes templates
+    # within Coder.
+    workspacePerms: true
+    # coder.serviceAccount.enableDeployments -- Provides the service account permission
+    # to manage Kubernetes deployments.
+    enableDeployments: true
+    # coder.serviceAccount.annotations -- The Coder service account annotations.
+    annotations: {}
+    # coder.serviceAccount.name -- The service account name
+    name: coder-provisioner
+
+  # coder.securityContext -- Fields related to the container's security
+  # context (as opposed to the pod). Some fields are also present in the pod
+  # security context, in which case these values will take precedence.
+  securityContext:
+    # coder.securityContext.runAsNonRoot -- Requires that the coder container
+    # runs as an unprivileged user. If setting runAsUser to 0 (root), this
+    # will need to be set to false.
+    runAsNonRoot: true
+    # coder.securityContext.runAsUser -- Sets the user id of the container.
+    # For security reasons, we recommend using a non-root user.
+    runAsUser: 1000
+    # coder.securityContext.runAsGroup -- Sets the group id of the container.
+    # For security reasons, we recommend using a non-root group.
+    runAsGroup: 1000
+    # coder.securityContext.readOnlyRootFilesystem -- Mounts the container's
+    # root filesystem as read-only.
+    readOnlyRootFilesystem: null
+    # coder.securityContext.seccompProfile -- Sets the seccomp profile for
+    # the coder container.
+    seccompProfile:
+      type: RuntimeDefault
+    # coder.securityContext.allowPrivilegeEscalation -- Controls whether
+    # the container can gain additional privileges, such as escalating to
+    # root. It is recommended to leave this setting disabled in production.
+    allowPrivilegeEscalation: false
+
+  # coder.volumes -- A list of extra volumes to add to the Coder provisioner daemon pod.
+  volumes: []
+  # - name: "my-volume"
+  #   emptyDir: {}
+
+  # coder.volumeMounts -- A list of extra volume mounts to add to the Coder provisioner daemon pod.
+  volumeMounts: []
+  # - name: "my-volume"
+  #   mountPath: "/mnt/my-volume"
+
+  # coder.replicaCount -- The number of Kubernetes deployment replicas. This
+  # should only be increased if High Availability is enabled.
+  #
+  # This is an Enterprise feature. Contact sales@coder.com.
+  replicaCount: 1
+
+  # coder.lifecycle -- container lifecycle handlers for the Coder container, allowing
+  # for lifecycle events such as postStart and preStop events
+  # See: https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/
+  lifecycle:
+    {}
+    # postStart:
+    #   exec:
+    #     command: ["/bin/sh", "-c", "echo postStart"]
+    # preStop:
+    #   exec:
+    #     command: ["/bin/sh","-c","echo preStart"]
+
+  # coder.resources -- The resources to request for Coder. These are optional
+  # and are not set by default.
+  resources:
+    {}
+    # limits:
+    #   cpu: 2000m
+    #   memory: 4096Mi
+    # requests:
+    #   cpu: 2000m
+    #   memory: 4096Mi
+
+  # coder.certs -- CA bundles to mount inside the Coder pod.
+  certs:
+    # coder.certs.secrets -- A list of CA bundle secrets to mount into the
+    # pod. The secrets should exist in the same namespace as the Helm
+    # deployment.
+    #
+    # The given key in each secret is mounted at
+    # `/etc/ssl/certs/{secret_name}.crt`.
+    secrets:
+      []
+      # - name: "my-ca-bundle"
+      #   key: "ca-bundle.crt"
+
+  # coder.affinity -- Allows specifying an affinity rule for the deployment.
+  affinity:
+    {}
+    #  podAntiAffinity:
+    #    preferredDuringSchedulingIgnoredDuringExecution:
+    #      - podAffinityTerm:
+    #          labelSelector:
+    #            matchExpressions:
+    #              - key: app.kubernetes.io/instance
+    #                operator: In
+    #                values:
+    #                  - "coder"
+    #          topologyKey: kubernetes.io/hostname
+    #        weight: 1
+
+  # coder.tolerations -- Tolerations for tainted nodes.
+  # See: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+  tolerations:
+    {}
+    # - key: "key"
+    #   operator: "Equal"
+    #   value: "value"
+    #   effect: "NoSchedule"
+
+  # coder.nodeSelector -- Node labels for constraining coder pods to nodes.
+  # See: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
+  nodeSelector: {}
+  #  kubernetes.io/os: linux
+
+  # coder.command -- The command to use when running the container. Used
+  # for customizing the location of the `coder` binary in your image.
+  command:
+    - /opt/coder
+
+  # coder.commandArgs -- Set arguments for the entrypoint command of the Coder pod.
+  commandArgs: []
+
+# provisionerDaemon -- Provisioner Daemon configuration options
+provisionerDaemon:
+  # provisionerDaemon.pskSecretName -- The name of the Kubernetes secret that contains the
+  # Pre-Shared Key (PSK) to use to authenticate with Coder.  The secret must be in the same namespace
+  # as the Helm deployment, and contain an item called "psk" which contains the pre-shared key.
+  pskSecretName: "coder-provisioner-psk"
+
+  # provisionerDaemon.tags -- Tags to filter provisioner jobs by
+  tags:
+    {}
+    # location: usa
+    # provider: kubernetes
+
+  # provisionerDaemon.terminationGracePeriodSeconds -- Time in seconds that Kubernetes should wait before forcibly
+  # terminating the provisioner daemon.  You should set this to be longer than your longest expected build time so that
+  # redeployments do not interrupt builds in progress.
+  terminationGracePeriodSeconds: 600
+
+# extraTemplates -- Array of extra objects to deploy with the release. Strings
+# are evaluated as a template and can use template expansions and functions. All
+# other objects are used as yaml.
+extraTemplates:
+  #- |
+  #    apiVersion: v1
+  #    kind: ConfigMap
+  #    metadata:
+  #      name: my-configmap
+  #    data:
+  #      key: {{ .Values.myCustomValue | quote }}
diff --git a/helm/templates/coder.yaml b/helm/templates/coder.yaml
deleted file mode 100644
index 09b284e676bc8..0000000000000
--- a/helm/templates/coder.yaml
+++ /dev/null
@@ -1,143 +0,0 @@
-{{- include "coder.verifyDeprecated" . -}}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ .Values.coder.serviceAccount.name | quote }}
-  annotations: {{ toYaml .Values.coder.serviceAccount.annotations | nindent 4 }}
-  labels:
-    {{- include "coder.labels" . | nindent 4 }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coder
-  labels:
-    {{- include "coder.labels" . | nindent 4 }}
-    {{- with .Values.coder.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  annotations: {{ toYaml .Values.coder.annotations | nindent 4}}
-spec:
-  replicas: {{ .Values.coder.replicaCount }}
-  selector:
-    matchLabels:
-      {{- include "coder.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      labels:
-        {{- include "coder.labels" . | nindent 8 }}
-        {{- with .Values.coder.podLabels }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
-      annotations:
-        {{- toYaml .Values.coder.podAnnotations | nindent 8  }}
-    spec:
-      serviceAccountName: {{ .Values.coder.serviceAccount.name | quote }}
-      restartPolicy: Always
-      {{- with .Values.coder.image.pullSecrets }}
-      imagePullSecrets:
-      {{- toYaml . | nindent 8 }}
-      {{- end }}
-      terminationGracePeriodSeconds: 60
-      {{- with .Values.coder.affinity }}
-      affinity:
-      {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.coder.tolerations }}
-      tolerations:
-      {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.coder.nodeSelector }}
-      nodeSelector:
-      {{ toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.coder.initContainers }}
-      initContainers:
-      {{ toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: coder
-          image: {{ include "coder.image" . | quote }}
-          imagePullPolicy: {{ .Values.coder.image.pullPolicy }}
-          command:
-            {{- toYaml .Values.coder.command | nindent 12 }}
-          args:
-            {{- if .Values.coder.commandArgs }}
-            {{- toYaml .Values.coder.commandArgs | nindent 12 }}
-            {{- else }}
-              {{- if .Values.coder.workspaceProxy }}
-            - wsproxy
-              {{- end }}
-            - server
-            {{- end }}
-          resources:
-            {{- toYaml .Values.coder.resources | nindent 12 }}
-          lifecycle:
-            {{- toYaml .Values.coder.lifecycle | nindent 12 }}
-          env:
-            - name: CODER_HTTP_ADDRESS
-              value: "0.0.0.0:8080"
-            - name: CODER_PROMETHEUS_ADDRESS
-              value: "0.0.0.0:2112"
-            # Set the default access URL so a `helm apply` works by default.
-            # See: https://github.com/coder/coder/issues/5024
-            {{- $hasAccessURL := false }}
-            {{- range .Values.coder.env }}
-              {{- if eq .name "CODER_ACCESS_URL" }}
-                {{- $hasAccessURL = true }}
-              {{- end }}
-            {{- end }}
-            {{- if not $hasAccessURL }}
-            - name: CODER_ACCESS_URL
-              value: {{ include "coder.defaultAccessURL" . | quote }}
-            {{- end }}
-            # Used for inter-pod communication with high-availability.
-            - name: KUBE_POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: CODER_DERP_SERVER_RELAY_URL
-              value: "http://$(KUBE_POD_IP):8080"
-            {{- include "coder.tlsEnv" . | nindent 12 }}
-            {{- with .Values.coder.env -}}
-            {{ toYaml . | nindent 12 }}
-            {{- end }}
-          ports:
-            - name: "http"
-              containerPort: 8080
-              protocol: TCP
-            {{- if eq (include "coder.tlsEnabled" .) "true" }}
-            - name: "https"
-              containerPort: 8443
-              protocol: TCP
-            {{- end }}
-            {{- range .Values.coder.env }}
-            {{- if eq .name "CODER_PROMETHEUS_ENABLE" }}
-            {{/*
-            This sadly has to be nested to avoid evaluating the second part
-            of the condition too early and potentially getting type errors if
-            the value is not a string (like a `valueFrom`). We do not support
-            `valueFrom` for this env var specifically.
-            */}}
-            {{- if eq .value "true" }}
-            - name: "prometheus-http"
-              containerPort: 2112
-              protocol: TCP
-            {{- end }}
-            {{- end }}
-            {{- end }}
-          securityContext: {{ toYaml .Values.coder.securityContext | nindent 12 }}
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          {{- include "coder.volumeMounts" . | nindent 10 }}
-
-      {{- include "coder.volumes" . | nindent 6 }}
diff --git a/helm/templates/rbac.yaml b/helm/templates/rbac.yaml
deleted file mode 100644
index 3105e1a604b63..0000000000000
--- a/helm/templates/rbac.yaml
+++ /dev/null
@@ -1,57 +0,0 @@
-{{- if .Values.coder.serviceAccount.workspacePerms }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: coder-workspace-perms
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-{{- if .Values.coder.serviceAccount.enableDeployments }}
-  - apiGroups:
-    - apps
-    resources:
-    - deployments
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-{{- end }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ .Values.coder.serviceAccount.name | quote }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ .Values.coder.serviceAccount.name | quote }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: coder-workspace-perms
-{{- end }}
diff --git a/helm/tests/chart_test.go b/helm/tests/chart_test.go
deleted file mode 100644
index 7442be08fc2e3..0000000000000
--- a/helm/tests/chart_test.go
+++ /dev/null
@@ -1,176 +0,0 @@
-package tests // nolint: testpackage
-
-import (
-	"bytes"
-	"flag"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"golang.org/x/xerrors"
-
-	"github.com/coder/coder/testutil"
-)
-
-// These tests run `helm template` with the values file specified in each test
-// and compare the output to the contents of the corresponding golden file.
-// All values and golden files are located in the `testdata` directory.
-// To update golden files, run `go test . -update`.
-
-// UpdateGoldenFiles is a flag that can be set to update golden files.
-var UpdateGoldenFiles = flag.Bool("update", false, "Update golden files")
-
-var TestCases = []TestCase{
-	{
-		name:          "default_values",
-		expectedError: "",
-	},
-	{
-		name:          "missing_values",
-		expectedError: `You must specify the coder.image.tag value if you're installing the Helm chart directly from Git.`,
-	},
-	{
-		name:          "tls",
-		expectedError: "",
-	},
-	{
-		name:          "sa",
-		expectedError: "",
-	},
-	{
-		name:          "labels_annotations",
-		expectedError: "",
-	},
-	{
-		name:          "workspace_proxy",
-		expectedError: "",
-	},
-	{
-		name:          "command",
-		expectedError: "",
-	},
-	{
-		name:          "command_args",
-		expectedError: "",
-	},
-}
-
-type TestCase struct {
-	name          string // Name of the test case. This is used to control which values and golden file are used.
-	expectedError string // Expected error from running `helm template`.
-}
-
-func (tc TestCase) valuesFilePath() string {
-	return filepath.Join("./testdata", tc.name+".yaml")
-}
-
-func (tc TestCase) goldenFilePath() string {
-	return filepath.Join("./testdata", tc.name+".golden")
-}
-
-func TestRenderChart(t *testing.T) {
-	t.Parallel()
-	if *UpdateGoldenFiles {
-		t.Skip("Golden files are being updated. Skipping test.")
-	}
-	if testutil.InCI() {
-		switch runtime.GOOS {
-		case "windows", "darwin":
-			t.Skip("Skipping tests on Windows and macOS in CI")
-		}
-	}
-
-	// Ensure that Helm is available in $PATH
-	helmPath := lookupHelm(t)
-	for _, tc := range TestCases {
-		tc := tc
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			// Ensure that the values file exists.
-			valuesFilePath := tc.valuesFilePath()
-			if _, err := os.Stat(valuesFilePath); os.IsNotExist(err) {
-				t.Fatalf("values file %q does not exist", valuesFilePath)
-			}
-
-			// Run helm template with the values file.
-			templateOutput, err := runHelmTemplate(t, helmPath, "..", valuesFilePath)
-			if tc.expectedError != "" {
-				require.Error(t, err, "helm template should have failed")
-				require.Contains(t, templateOutput, tc.expectedError, "helm template output should contain expected error")
-			} else {
-				require.NoError(t, err, "helm template should not have failed")
-				require.NotEmpty(t, templateOutput, "helm template output should not be empty")
-				goldenFilePath := tc.goldenFilePath()
-				goldenBytes, err := os.ReadFile(goldenFilePath)
-				require.NoError(t, err, "failed to read golden file %q", goldenFilePath)
-
-				// Remove carriage returns to make tests pass on Windows.
-				goldenBytes = bytes.Replace(goldenBytes, []byte("\r"), []byte(""), -1)
-				expected := string(goldenBytes)
-
-				require.NoError(t, err, "failed to load golden file %q")
-				require.Equal(t, expected, templateOutput)
-			}
-		})
-	}
-}
-
-func TestUpdateGoldenFiles(t *testing.T) {
-	t.Parallel()
-	if !*UpdateGoldenFiles {
-		t.Skip("Run with -update to update golden files")
-	}
-
-	helmPath := lookupHelm(t)
-	for _, tc := range TestCases {
-		if tc.expectedError != "" {
-			t.Logf("skipping test case %q with render error", tc.name)
-			continue
-		}
-
-		valuesPath := tc.valuesFilePath()
-		templateOutput, err := runHelmTemplate(t, helmPath, "..", valuesPath)
-
-		require.NoError(t, err, "failed to run `helm template -f %q`", valuesPath)
-
-		goldenFilePath := tc.goldenFilePath()
-		err = os.WriteFile(goldenFilePath, []byte(templateOutput), 0o644) // nolint:gosec
-		require.NoError(t, err, "failed to write golden file %q", goldenFilePath)
-	}
-	t.Log("Golden files updated. Please review the changes and commit them.")
-}
-
-// runHelmTemplate runs helm template on the given chart with the given values and
-// returns the raw output.
-func runHelmTemplate(t testing.TB, helmPath, chartDir, valuesFilePath string) (string, error) {
-	// Ensure that valuesFilePath exists
-	if _, err := os.Stat(valuesFilePath); err != nil {
-		return "", xerrors.Errorf("values file %q does not exist: %w", valuesFilePath, err)
-	}
-
-	cmd := exec.Command(helmPath, "template", chartDir, "-f", valuesFilePath, "--namespace", "default")
-	t.Logf("exec command: %v", cmd.Args)
-	out, err := cmd.CombinedOutput()
-	return string(out), err
-}
-
-// lookupHelm ensures that Helm is available in $PATH and returns the path to the
-// Helm executable.
-func lookupHelm(t testing.TB) string {
-	helmPath, err := exec.LookPath("helm")
-	if err != nil {
-		t.Fatalf("helm not found in $PATH: %v", err)
-		return ""
-	}
-	t.Logf("Using helm at %q", helmPath)
-	return helmPath
-}
-
-func TestMain(m *testing.M) {
-	flag.Parse()
-	os.Exit(m.Run())
-}
diff --git a/helm/tests/testdata/command.golden b/helm/tests/testdata/command.golden
deleted file mode 100644
index 616971e98d458..0000000000000
--- a/helm/tests/testdata/command.golden
+++ /dev/null
@@ -1,198 +0,0 @@
----
-# Source: coder/templates/coder.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: "coder"
-  annotations: 
-    {}
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: coder-workspace-perms
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups:
-    - apps
-    resources:
-    - deployments
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: "coder"
-subjects:
-  - kind: ServiceAccount
-    name: "coder"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: coder-workspace-perms
----
-# Source: coder/templates/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    {}
-spec:
-  type: LoadBalancer
-  sessionAffinity: ClientIP
-  ports:
-    - name: "http"
-      port: 80
-      targetPort: "http"
-      protocol: TCP
-  externalTrafficPolicy: "Cluster"
-  selector:
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
----
-# Source: coder/templates/coder.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations: 
-    {}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: coder
-      app.kubernetes.io/instance: release-name
-  template:
-    metadata:
-      labels:
-        helm.sh/chart: coder-0.1.0
-        app.kubernetes.io/name: coder
-        app.kubernetes.io/instance: release-name
-        app.kubernetes.io/part-of: coder
-        app.kubernetes.io/version: "0.1.0"
-        app.kubernetes.io/managed-by: Helm
-      annotations:
-        {}
-    spec:
-      serviceAccountName: "coder"
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/instance
-                  operator: In
-                  values:
-                  - coder
-              topologyKey: kubernetes.io/hostname
-            weight: 1
-      containers:
-        - name: coder
-          image: "ghcr.io/coder/coder:latest"
-          imagePullPolicy: IfNotPresent
-          command:
-            - /opt/colin
-          args:
-            - server
-          resources:
-            {}
-          lifecycle:
-            {}
-          env:
-            - name: CODER_HTTP_ADDRESS
-              value: "0.0.0.0:8080"
-            - name: CODER_PROMETHEUS_ADDRESS
-              value: "0.0.0.0:2112"
-            # Set the default access URL so a `helm apply` works by default.
-            # See: https://github.com/coder/coder/issues/5024
-            - name: CODER_ACCESS_URL
-              value: "http://coder.default.svc.cluster.local"
-            # Used for inter-pod communication with high-availability.
-            - name: KUBE_POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: CODER_DERP_SERVER_RELAY_URL
-              value: "http://$(KUBE_POD_IP):8080"
-            
-          ports:
-            - name: "http"
-              containerPort: 8080
-              protocol: TCP
-          securityContext: 
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: null
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          volumeMounts: []
-      volumes: []
diff --git a/helm/tests/testdata/command_args.golden b/helm/tests/testdata/command_args.golden
deleted file mode 100644
index 92e87fd58097c..0000000000000
--- a/helm/tests/testdata/command_args.golden
+++ /dev/null
@@ -1,199 +0,0 @@
----
-# Source: coder/templates/coder.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: "coder"
-  annotations: 
-    {}
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: coder-workspace-perms
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups:
-    - apps
-    resources:
-    - deployments
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: "coder"
-subjects:
-  - kind: ServiceAccount
-    name: "coder"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: coder-workspace-perms
----
-# Source: coder/templates/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    {}
-spec:
-  type: LoadBalancer
-  sessionAffinity: ClientIP
-  ports:
-    - name: "http"
-      port: 80
-      targetPort: "http"
-      protocol: TCP
-  externalTrafficPolicy: "Cluster"
-  selector:
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
----
-# Source: coder/templates/coder.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations: 
-    {}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: coder
-      app.kubernetes.io/instance: release-name
-  template:
-    metadata:
-      labels:
-        helm.sh/chart: coder-0.1.0
-        app.kubernetes.io/name: coder
-        app.kubernetes.io/instance: release-name
-        app.kubernetes.io/part-of: coder
-        app.kubernetes.io/version: "0.1.0"
-        app.kubernetes.io/managed-by: Helm
-      annotations:
-        {}
-    spec:
-      serviceAccountName: "coder"
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/instance
-                  operator: In
-                  values:
-                  - coder
-              topologyKey: kubernetes.io/hostname
-            weight: 1
-      containers:
-        - name: coder
-          image: "ghcr.io/coder/coder:latest"
-          imagePullPolicy: IfNotPresent
-          command:
-            - /opt/coder
-          args:
-            - arg1
-            - arg2
-          resources:
-            {}
-          lifecycle:
-            {}
-          env:
-            - name: CODER_HTTP_ADDRESS
-              value: "0.0.0.0:8080"
-            - name: CODER_PROMETHEUS_ADDRESS
-              value: "0.0.0.0:2112"
-            # Set the default access URL so a `helm apply` works by default.
-            # See: https://github.com/coder/coder/issues/5024
-            - name: CODER_ACCESS_URL
-              value: "http://coder.default.svc.cluster.local"
-            # Used for inter-pod communication with high-availability.
-            - name: KUBE_POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: CODER_DERP_SERVER_RELAY_URL
-              value: "http://$(KUBE_POD_IP):8080"
-            
-          ports:
-            - name: "http"
-              containerPort: 8080
-              protocol: TCP
-          securityContext: 
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: null
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          volumeMounts: []
-      volumes: []
diff --git a/helm/tests/testdata/default_values.golden b/helm/tests/testdata/default_values.golden
deleted file mode 100644
index cb1988e1ab3e9..0000000000000
--- a/helm/tests/testdata/default_values.golden
+++ /dev/null
@@ -1,198 +0,0 @@
----
-# Source: coder/templates/coder.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: "coder"
-  annotations: 
-    {}
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: coder-workspace-perms
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups:
-    - apps
-    resources:
-    - deployments
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: "coder"
-subjects:
-  - kind: ServiceAccount
-    name: "coder"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: coder-workspace-perms
----
-# Source: coder/templates/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    {}
-spec:
-  type: LoadBalancer
-  sessionAffinity: ClientIP
-  ports:
-    - name: "http"
-      port: 80
-      targetPort: "http"
-      protocol: TCP
-  externalTrafficPolicy: "Cluster"
-  selector:
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
----
-# Source: coder/templates/coder.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations: 
-    {}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: coder
-      app.kubernetes.io/instance: release-name
-  template:
-    metadata:
-      labels:
-        helm.sh/chart: coder-0.1.0
-        app.kubernetes.io/name: coder
-        app.kubernetes.io/instance: release-name
-        app.kubernetes.io/part-of: coder
-        app.kubernetes.io/version: "0.1.0"
-        app.kubernetes.io/managed-by: Helm
-      annotations:
-        {}
-    spec:
-      serviceAccountName: "coder"
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/instance
-                  operator: In
-                  values:
-                  - coder
-              topologyKey: kubernetes.io/hostname
-            weight: 1
-      containers:
-        - name: coder
-          image: "ghcr.io/coder/coder:latest"
-          imagePullPolicy: IfNotPresent
-          command:
-            - /opt/coder
-          args:
-            - server
-          resources:
-            {}
-          lifecycle:
-            {}
-          env:
-            - name: CODER_HTTP_ADDRESS
-              value: "0.0.0.0:8080"
-            - name: CODER_PROMETHEUS_ADDRESS
-              value: "0.0.0.0:2112"
-            # Set the default access URL so a `helm apply` works by default.
-            # See: https://github.com/coder/coder/issues/5024
-            - name: CODER_ACCESS_URL
-              value: "http://coder.default.svc.cluster.local"
-            # Used for inter-pod communication with high-availability.
-            - name: KUBE_POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: CODER_DERP_SERVER_RELAY_URL
-              value: "http://$(KUBE_POD_IP):8080"
-            
-          ports:
-            - name: "http"
-              containerPort: 8080
-              protocol: TCP
-          securityContext: 
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: null
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          volumeMounts: []
-      volumes: []
diff --git a/helm/tests/testdata/labels_annotations.golden b/helm/tests/testdata/labels_annotations.golden
deleted file mode 100644
index e6f85d0dfa476..0000000000000
--- a/helm/tests/testdata/labels_annotations.golden
+++ /dev/null
@@ -1,204 +0,0 @@
----
-# Source: coder/templates/coder.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: "coder"
-  annotations: 
-    {}
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: coder-workspace-perms
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups:
-    - apps
-    resources:
-    - deployments
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: "coder"
-subjects:
-  - kind: ServiceAccount
-    name: "coder"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: coder-workspace-perms
----
-# Source: coder/templates/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    {}
-spec:
-  type: LoadBalancer
-  sessionAffinity: ClientIP
-  ports:
-    - name: "http"
-      port: 80
-      targetPort: "http"
-      protocol: TCP
-  externalTrafficPolicy: "Cluster"
-  selector:
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
----
-# Source: coder/templates/coder.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-    com.coder/label/baz: qux
-    com.coder/label/foo: bar
-  annotations: 
-    com.coder/annotation/baz: qux
-    com.coder/annotation/foo: bar
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: coder
-      app.kubernetes.io/instance: release-name
-  template:
-    metadata:
-      labels:
-        helm.sh/chart: coder-0.1.0
-        app.kubernetes.io/name: coder
-        app.kubernetes.io/instance: release-name
-        app.kubernetes.io/part-of: coder
-        app.kubernetes.io/version: "0.1.0"
-        app.kubernetes.io/managed-by: Helm
-        com.coder/podLabel/baz: qux
-        com.coder/podLabel/foo: bar
-      annotations:
-        com.coder/podAnnotation/baz: qux
-        com.coder/podAnnotation/foo: bar
-    spec:
-      serviceAccountName: "coder"
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/instance
-                  operator: In
-                  values:
-                  - coder
-              topologyKey: kubernetes.io/hostname
-            weight: 1
-      containers:
-        - name: coder
-          image: "ghcr.io/coder/coder:latest"
-          imagePullPolicy: IfNotPresent
-          command:
-            - /opt/coder
-          args:
-            - server
-          resources:
-            {}
-          lifecycle:
-            {}
-          env:
-            - name: CODER_HTTP_ADDRESS
-              value: "0.0.0.0:8080"
-            - name: CODER_PROMETHEUS_ADDRESS
-              value: "0.0.0.0:2112"
-            # Set the default access URL so a `helm apply` works by default.
-            # See: https://github.com/coder/coder/issues/5024
-            - name: CODER_ACCESS_URL
-              value: "http://coder.default.svc.cluster.local"
-            # Used for inter-pod communication with high-availability.
-            - name: KUBE_POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: CODER_DERP_SERVER_RELAY_URL
-              value: "http://$(KUBE_POD_IP):8080"
-            
-          ports:
-            - name: "http"
-              containerPort: 8080
-              protocol: TCP
-          securityContext: 
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: null
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          volumeMounts: []
-      volumes: []
diff --git a/helm/tests/testdata/sa.golden b/helm/tests/testdata/sa.golden
deleted file mode 100644
index 5e94a67818c62..0000000000000
--- a/helm/tests/testdata/sa.golden
+++ /dev/null
@@ -1,198 +0,0 @@
----
-# Source: coder/templates/coder.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: "coder-service-account"
-  annotations: 
-    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/coder-service-account
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: coder-workspace-perms
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups:
-    - apps
-    resources:
-    - deployments
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: "coder-service-account"
-subjects:
-  - kind: ServiceAccount
-    name: "coder-service-account"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: coder-workspace-perms
----
-# Source: coder/templates/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    {}
-spec:
-  type: LoadBalancer
-  sessionAffinity: ClientIP
-  ports:
-    - name: "http"
-      port: 80
-      targetPort: "http"
-      protocol: TCP
-  externalTrafficPolicy: "Cluster"
-  selector:
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
----
-# Source: coder/templates/coder.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations: 
-    {}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: coder
-      app.kubernetes.io/instance: release-name
-  template:
-    metadata:
-      labels:
-        helm.sh/chart: coder-0.1.0
-        app.kubernetes.io/name: coder
-        app.kubernetes.io/instance: release-name
-        app.kubernetes.io/part-of: coder
-        app.kubernetes.io/version: "0.1.0"
-        app.kubernetes.io/managed-by: Helm
-      annotations:
-        {}
-    spec:
-      serviceAccountName: "coder-service-account"
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/instance
-                  operator: In
-                  values:
-                  - coder
-              topologyKey: kubernetes.io/hostname
-            weight: 1
-      containers:
-        - name: coder
-          image: "ghcr.io/coder/coder:latest"
-          imagePullPolicy: IfNotPresent
-          command:
-            - /opt/coder
-          args:
-            - server
-          resources:
-            {}
-          lifecycle:
-            {}
-          env:
-            - name: CODER_HTTP_ADDRESS
-              value: "0.0.0.0:8080"
-            - name: CODER_PROMETHEUS_ADDRESS
-              value: "0.0.0.0:2112"
-            # Set the default access URL so a `helm apply` works by default.
-            # See: https://github.com/coder/coder/issues/5024
-            - name: CODER_ACCESS_URL
-              value: "http://coder.default.svc.cluster.local"
-            # Used for inter-pod communication with high-availability.
-            - name: KUBE_POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: CODER_DERP_SERVER_RELAY_URL
-              value: "http://$(KUBE_POD_IP):8080"
-            
-          ports:
-            - name: "http"
-              containerPort: 8080
-              protocol: TCP
-          securityContext: 
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: null
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          volumeMounts: []
-      volumes: []
diff --git a/helm/tests/testdata/tls.golden b/helm/tests/testdata/tls.golden
deleted file mode 100644
index 8ef85d138f722..0000000000000
--- a/helm/tests/testdata/tls.golden
+++ /dev/null
@@ -1,220 +0,0 @@
----
-# Source: coder/templates/coder.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: "coder"
-  annotations: 
-    {}
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: coder-workspace-perms
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups:
-    - apps
-    resources:
-    - deployments
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: "coder"
-subjects:
-  - kind: ServiceAccount
-    name: "coder"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: coder-workspace-perms
----
-# Source: coder/templates/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    {}
-spec:
-  type: LoadBalancer
-  sessionAffinity: ClientIP
-  ports:
-    - name: "http"
-      port: 80
-      targetPort: "http"
-      protocol: TCP
-    - name: "https"
-      port: 443
-      targetPort: "https"
-      protocol: TCP
-  externalTrafficPolicy: "Cluster"
-  selector:
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
----
-# Source: coder/templates/coder.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations: 
-    {}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: coder
-      app.kubernetes.io/instance: release-name
-  template:
-    metadata:
-      labels:
-        helm.sh/chart: coder-0.1.0
-        app.kubernetes.io/name: coder
-        app.kubernetes.io/instance: release-name
-        app.kubernetes.io/part-of: coder
-        app.kubernetes.io/version: "0.1.0"
-        app.kubernetes.io/managed-by: Helm
-      annotations:
-        {}
-    spec:
-      serviceAccountName: "coder"
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/instance
-                  operator: In
-                  values:
-                  - coder
-              topologyKey: kubernetes.io/hostname
-            weight: 1
-      containers:
-        - name: coder
-          image: "ghcr.io/coder/coder:latest"
-          imagePullPolicy: IfNotPresent
-          command:
-            - /opt/coder
-          args:
-            - server
-          resources:
-            {}
-          lifecycle:
-            {}
-          env:
-            - name: CODER_HTTP_ADDRESS
-              value: "0.0.0.0:8080"
-            - name: CODER_PROMETHEUS_ADDRESS
-              value: "0.0.0.0:2112"
-            # Set the default access URL so a `helm apply` works by default.
-            # See: https://github.com/coder/coder/issues/5024
-            - name: CODER_ACCESS_URL
-              value: "https://coder.default.svc.cluster.local"
-            # Used for inter-pod communication with high-availability.
-            - name: KUBE_POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: CODER_DERP_SERVER_RELAY_URL
-              value: "http://$(KUBE_POD_IP):8080"
-            
-            - name: CODER_TLS_ENABLE
-              value: "true"
-            - name: CODER_TLS_ADDRESS
-              value: "0.0.0.0:8443"
-            - name: CODER_TLS_CERT_FILE
-              value: "/etc/ssl/certs/coder/coder-tls/tls.crt"
-            - name: CODER_TLS_KEY_FILE
-              value: "/etc/ssl/certs/coder/coder-tls/tls.key"
-          ports:
-            - name: "http"
-              containerPort: 8080
-              protocol: TCP
-            - name: "https"
-              containerPort: 8443
-              protocol: TCP
-          securityContext: 
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: null
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          volumeMounts:
-          - name: "tls-coder-tls"
-            mountPath: "/etc/ssl/certs/coder/coder-tls"
-            readOnly: true
-          
-      volumes:
-      - name: "tls-coder-tls"
-        secret:
-          secretName: "coder-tls"
diff --git a/helm/tests/testdata/workspace_proxy.golden b/helm/tests/testdata/workspace_proxy.golden
deleted file mode 100644
index 88e0213be559d..0000000000000
--- a/helm/tests/testdata/workspace_proxy.golden
+++ /dev/null
@@ -1,206 +0,0 @@
----
-# Source: coder/templates/coder.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: "coder"
-  annotations: 
-    {}
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: coder-workspace-perms
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups: [""]
-    resources: ["persistentvolumeclaims"]
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
-  - apiGroups:
-    - apps
-    resources:
-    - deployments
-    verbs:
-    - create
-    - delete
-    - deletecollection
-    - get
-    - list
-    - patch
-    - update
-    - watch
----
-# Source: coder/templates/rbac.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: "coder"
-subjects:
-  - kind: ServiceAccount
-    name: "coder"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: coder-workspace-perms
----
-# Source: coder/templates/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations:
-    {}
-spec:
-  type: LoadBalancer
-  sessionAffinity: ClientIP
-  ports:
-    - name: "http"
-      port: 80
-      targetPort: "http"
-      protocol: TCP
-  externalTrafficPolicy: "Cluster"
-  selector:
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
----
-# Source: coder/templates/coder.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coder
-  labels:
-    helm.sh/chart: coder-0.1.0
-    app.kubernetes.io/name: coder
-    app.kubernetes.io/instance: release-name
-    app.kubernetes.io/part-of: coder
-    app.kubernetes.io/version: "0.1.0"
-    app.kubernetes.io/managed-by: Helm
-  annotations: 
-    {}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: coder
-      app.kubernetes.io/instance: release-name
-  template:
-    metadata:
-      labels:
-        helm.sh/chart: coder-0.1.0
-        app.kubernetes.io/name: coder
-        app.kubernetes.io/instance: release-name
-        app.kubernetes.io/part-of: coder
-        app.kubernetes.io/version: "0.1.0"
-        app.kubernetes.io/managed-by: Helm
-      annotations:
-        {}
-    spec:
-      serviceAccountName: "coder"
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/instance
-                  operator: In
-                  values:
-                  - coder
-              topologyKey: kubernetes.io/hostname
-            weight: 1
-      containers:
-        - name: coder
-          image: "ghcr.io/coder/coder:latest"
-          imagePullPolicy: IfNotPresent
-          command:
-            - /opt/coder
-          args:
-            - wsproxy
-            - server
-          resources:
-            {}
-          lifecycle:
-            {}
-          env:
-            - name: CODER_HTTP_ADDRESS
-              value: "0.0.0.0:8080"
-            - name: CODER_PROMETHEUS_ADDRESS
-              value: "0.0.0.0:2112"
-            # Set the default access URL so a `helm apply` works by default.
-            # See: https://github.com/coder/coder/issues/5024
-            - name: CODER_ACCESS_URL
-              value: "http://coder.default.svc.cluster.local"
-            # Used for inter-pod communication with high-availability.
-            - name: KUBE_POD_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.podIP
-            - name: CODER_DERP_SERVER_RELAY_URL
-              value: "http://$(KUBE_POD_IP):8080"
-            
-            - name: CODER_PRIMARY_ACCESS_URL
-              value: https://dev.coder.com
-            - name: CODER_PROXY_SESSION_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  key: token
-                  name: coder-workspace-proxy-session-token
-          ports:
-            - name: "http"
-              containerPort: 8080
-              protocol: TCP
-          securityContext: 
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: null
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: "http"
-              scheme: "HTTP"
-          volumeMounts: []
-      volumes: []
diff --git a/helm/values.yaml b/helm/values.yaml
deleted file mode 100644
index e3a1298628d5b..0000000000000
--- a/helm/values.yaml
+++ /dev/null
@@ -1,293 +0,0 @@
-# coder -- Primary configuration for `coder server`.
-coder:
-  # coder.env -- The environment variables to set for Coder. These can be used
-  # to configure all aspects of `coder server`. Please see `coder server --help`
-  # for information about what environment variables can be set.
-  # Note: The following environment variables are set by default and cannot be
-  # overridden:
-  # - CODER_HTTP_ADDRESS: set to 0.0.0.0:8080 and cannot be changed.
-  # - CODER_TLS_ADDRESS: set to 0.0.0.0:8443 if tls.secretName is not empty.
-  # - CODER_TLS_ENABLE: set if tls.secretName is not empty.
-  # - CODER_TLS_CERT_FILE: set if tls.secretName is not empty.
-  # - CODER_TLS_KEY_FILE: set if tls.secretName is not empty.
-  # - CODER_PROMETHEUS_ADDRESS: set to 0.0.0.0:6060 and cannot be changed.
-  #   Prometheus must still be enabled by setting CODER_PROMETHEUS_ENABLE.
-  # - KUBE_POD_IP
-  # - CODER_DERP_SERVER_RELAY_URL
-  #
-  # We will additionally set CODER_ACCESS_URL if unset to the cluster service
-  # URL.
-  env: []
-  # - name: "CODER_ACCESS_URL"
-  #   value: "https://coder.example.com"
-
-  # coder.image -- The image to use for Coder.
-  image:
-    # coder.image.repo -- The repository of the image.
-    repo: "ghcr.io/coder/coder"
-    # coder.image.tag -- The tag of the image, defaults to {{.Chart.AppVersion}}
-    # if not set. If you're using the chart directly from git, the default
-    # app version will not work and you'll need to set this value. The helm
-    # chart helpfully fails quickly in this case.
-    tag: ""
-    # coder.image.pullPolicy -- The pull policy to use for the image. See:
-    # https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
-    pullPolicy: IfNotPresent
-    # coder.image.pullSecrets -- The secrets used for pulling the Coder image from
-    # a private registry.
-    pullSecrets: []
-    #  - name: "pull-secret"
-
-  # coder.initContainers -- Init containers for the deployment. See:
-  # https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
-  initContainers:
-    []
-    # - name: init-container
-    #   image: busybox:1.28
-    #   command: ['sh', '-c', "sleep 2"]
-
-  # coder.annotations -- The Deployment annotations. See:
-  # https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
-  annotations: {}
-
-  # coder.labels -- The Deployment labels. See:
-  # https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
-  labels: {}
-
-  # coder.podAnnotations -- The Coder pod annotations. See:
-  # https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
-  podAnnotations: {}
-
-  # coder.podLabels -- The Coder pod labels. See:
-  # https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
-  podLabels: {}
-
-  # coder.serviceAccount -- Configuration for the automatically created service
-  # account. Creation of the service account cannot be disabled.
-  serviceAccount:
-    # coder.serviceAccount.workspacePerms -- Whether or not to grant the coder
-    # service account permissions to manage workspaces. This includes
-    # permission to manage pods and persistent volume claims in the deployment
-    # namespace.
-    #
-    # It is recommended to keep this on if you are using Kubernetes templates
-    # within Coder.
-    workspacePerms: true
-    # coder.serviceAccount.enableDeployments -- Provides the service account permission
-    # to manage Kubernetes deployments.
-    enableDeployments: true
-    # coder.serviceAccount.annotations -- The Coder service account annotations.
-    annotations: {}
-    # coder.serviceAccount.name -- The service account name
-    name: coder
-
-  # coder.securityContext -- Fields related to the container's security
-  # context (as opposed to the pod). Some fields are also present in the pod
-  # security context, in which case these values will take precedence.
-  securityContext:
-    # coder.securityContext.runAsNonRoot -- Requires that the coder container
-    # runs as an unprivileged user. If setting runAsUser to 0 (root), this
-    # will need to be set to false.
-    runAsNonRoot: true
-    # coder.securityContext.runAsUser -- Sets the user id of the container.
-    # For security reasons, we recommend using a non-root user.
-    runAsUser: 1000
-    # coder.securityContext.runAsGroup -- Sets the group id of the container.
-    # For security reasons, we recommend using a non-root group.
-    runAsGroup: 1000
-    # coder.securityContext.readOnlyRootFilesystem -- Mounts the container's
-    # root filesystem as read-only.
-    readOnlyRootFilesystem: null
-    # coder.securityContext.seccompProfile -- Sets the seccomp profile for
-    # the coder container.
-    seccompProfile:
-      type: RuntimeDefault
-    # coder.securityContext.allowPrivilegeEscalation -- Controls whether
-    # the container can gain additional privileges, such as escalating to
-    # root. It is recommended to leave this setting disabled in production.
-    allowPrivilegeEscalation: false
-
-  # coder.volumes -- A list of extra volumes to add to the Coder pod.
-  volumes: []
-  # - name: "my-volume"
-  #   emptyDir: {}
-
-  # coder.volumeMounts -- A list of extra volume mounts to add to the Coder pod.
-  volumeMounts: []
-  # - name: "my-volume"
-  #   mountPath: "/mnt/my-volume"
-
-  # coder.tls -- The TLS configuration for Coder.
-  tls:
-    # coder.tls.secretNames -- A list of TLS server certificate secrets to mount
-    # into the Coder pod. The secrets should exist in the same namespace as the
-    # Helm deployment and should be of type "kubernetes.io/tls". The secrets
-    # will be automatically mounted into the pod if specified, and the correct
-    # "CODER_TLS_*" environment variables will be set for you.
-    secretNames: []
-
-  # coder.replicaCount -- The number of Kubernetes deployment replicas. This
-  # should only be increased if High Availability is enabled.
-  #
-  # This is an Enterprise feature. Contact sales@coder.com.
-  replicaCount: 1
-
-  # coder.workspaceProxy -- Whether or not this deployment of Coder is a Coder
-  # Workspace Proxy. Workspace Proxies reduce the latency between the user and
-  # their workspace for web connections (workspace apps and web terminal) and
-  # proxied connections from the CLI. Workspace Proxies are optional and only
-  # recommended for geographically sparse teams.
-  #
-  # Make sure you set CODER_PRIMARY_ACCESS_URL and CODER_PROXY_SESSION_TOKEN in
-  # the environment below. You can get a proxy token using the CLI:
-  #   coder wsproxy create \
-  #     --name "proxy-name" \
-  #     --display-name "Proxy Name" \
-  #     --icon "/emojis/xyz.png"
-  #
-  # This is an Enterprise feature. Contact sales@coder.com
-  # Docs: https://coder.com/docs/v2/latest/admin/workspace-proxies
-  workspaceProxy: false
-
-  # coder.lifecycle -- container lifecycle handlers for the Coder container, allowing
-  # for lifecycle events such as postStart and preStop events
-  # See: https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/
-  lifecycle:
-    {}
-    # postStart:
-    #   exec:
-    #     command: ["/bin/sh", "-c", "echo postStart"]
-    # preStop:
-    #   exec:
-    #     command: ["/bin/sh","-c","echo preStart"]
-
-  # coder.resources -- The resources to request for Coder. These are optional
-  # and are not set by default.
-  resources:
-    {}
-    # limits:
-    #   cpu: 2000m
-    #   memory: 4096Mi
-    # requests:
-    #   cpu: 2000m
-    #   memory: 4096Mi
-
-  # coder.certs -- CA bundles to mount inside the Coder pod.
-  certs:
-    # coder.certs.secrets -- A list of CA bundle secrets to mount into the Coder
-    # pod. The secrets should exist in the same namespace as the Helm
-    # deployment.
-    #
-    # The given key in each secret is mounted at
-    # `/etc/ssl/certs/{secret_name}.crt`.
-    secrets:
-      []
-      # - name: "my-ca-bundle"
-      #   key: "ca-bundle.crt"
-
-  # coder.affinity -- Allows specifying an affinity rule for the `coder` deployment.
-  # The default rule prefers to schedule coder pods on different
-  # nodes, which is only applicable if coder.replicaCount is greater than 1.
-  affinity:
-    podAntiAffinity:
-      preferredDuringSchedulingIgnoredDuringExecution:
-        - podAffinityTerm:
-            labelSelector:
-              matchExpressions:
-                - key: app.kubernetes.io/instance
-                  operator: In
-                  values:
-                    - "coder"
-            topologyKey: kubernetes.io/hostname
-          weight: 1
-
-  # coder.tolerations -- Tolerations for tainted nodes.
-  # See: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
-  tolerations:
-    {}
-    # - key: "key"
-    #   operator: "Equal"
-    #   value: "value"
-    #   effect: "NoSchedule"
-
-  # coder.nodeSelector -- Node labels for constraining coder pods to nodes.
-  # See: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
-  nodeSelector: {}
-  #  kubernetes.io/os: linux
-
-  # coder.service -- The Service object to expose for Coder.
-  service:
-    # coder.service.enable -- Whether to create the Service object.
-    enable: true
-    # coder.service.type -- The type of service to expose. See:
-    # https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
-    type: LoadBalancer
-    # coder.service.sessionAffinity -- Must be set to ClientIP or None
-    # AWS ELB does not support session stickiness based on ClientIP, so you must set this to None.
-    # The error message you might see: "Unsupported load balancer affinity: ClientIP"
-    # https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity
-    sessionAffinity: ClientIP
-    # coder.service.externalTrafficPolicy -- The external traffic policy to use.
-    # You may need to change this to "Local" to preserve the source IP address
-    # in some situations.
-    # https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
-    externalTrafficPolicy: Cluster
-    # coder.service.loadBalancerIP -- The IP address of the LoadBalancer. If not
-    # specified, a new IP will be generated each time the load balancer is
-    # recreated. It is recommended to manually create a static IP address in
-    # your cloud and specify it here in production to avoid accidental IP
-    # address changes.
-    loadBalancerIP: ""
-    # coder.service.annotations -- The service annotations. See:
-    # https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
-    annotations: {}
-
-  # coder.ingress -- The Ingress object to expose for Coder.
-  ingress:
-    # coder.ingress.enable -- Whether to create the Ingress object. If using an
-    # Ingress, we recommend not specifying coder.tls.secretNames as the Ingress
-    # will handle TLS termination.
-    enable: false
-    # coder.ingress.className -- The name of the Ingress class to use.
-    className: ""
-    # coder.ingress.host -- The hostname to match on.
-    # Be sure to also set CODER_ACCESS_URL within coder.env[]
-    host: ""
-    # coder.ingress.wildcardHost -- The wildcard hostname to match on. Should be
-    # in the form "*.example.com" or "*-suffix.example.com". If you are using a
-    # suffix after the wildcard, the suffix will be stripped from the created
-    # ingress to ensure that it is a legal ingress host. Optional if not using
-    # applications over subdomains.
-    # Be sure to also set CODER_WILDCARD_ACCESS_URL within coder.env[]
-    wildcardHost: ""
-    # coder.ingress.annotations -- The ingress annotations.
-    annotations: {}
-    # coder.ingress.tls -- The TLS configuration to use for the Ingress.
-    tls:
-      # coder.ingress.tls.enable -- Whether to enable TLS on the Ingress.
-      enable: false
-      # coder.ingress.tls.secretName -- The name of the TLS secret to use.
-      secretName: ""
-      # coder.ingress.tls.wildcardSecretName -- The name of the TLS secret to
-      # use for the wildcard host.
-      wildcardSecretName: ""
-
-  # coder.command -- The command to use when running the Coder container. Used
-  # for customizing the location of the `coder` binary in your image.
-  command:
-    - /opt/coder
-
-  # coder.commandArgs -- Set arguments for the entrypoint command of the Coder pod.
-  commandArgs: []
-
-# extraTemplates -- Array of extra objects to deploy with the release. Strings
-# are evaluated as a template and can use template expansions and functions. All
-# other objects are used as yaml.
-extraTemplates:
-  #- |
-  #    apiVersion: v1
-  #    kind: ConfigMap
-  #    metadata:
-  #      name: my-configmap
-  #    data:
-  #      key: {{ .Values.myCustomValue | quote }}
diff --git a/install.sh b/install.sh
index 32f8799ddecbf..bdcf3af007eda 100755
--- a/install.sh
+++ b/install.sh
@@ -2,7 +2,10 @@
 set -eu
 
 # Coder's automatic install script.
-# See https://github.com/coder/coder#installing-coder
+# See https://github.com/coder/coder#install
+#
+# To run:
+# curl -L https://coder.com/install.sh | sh
 
 usage() {
 	arg0="$0"
@@ -61,14 +64,19 @@ Usage:
 	  just want it on your base system aswell.
 	  This supports most systems, however if you are unsure yours is supported you can check
 	  the link above.
+  --net-admin
+	  Adds \`CAP_NET_ADMIN\` to the installed binary. This allows Coder to
+	  increase network speeds, but has security implications.
+	  See: https://man7.org/linux/man-pages/man7/capabilities.7.html
+	  This only works on Linux based systems.
 
 
 The detection method works as follows:
   - Debian, Ubuntu, Raspbian: install the deb package from GitHub.
   - Fedora, CentOS, RHEL, openSUSE: install the rpm package from GitHub.
   - Alpine: install the apk package from GitHub.
-  - macOS: install the release from GitHub.
-  - All others: install the release from GitHub.
+  - macOS:  if \`brew\` is available, install from the coder/coder Homebrew tap.
+  - Otherwise, download from GitHub and install into \`--prefix\`.
 
 We build releases on GitHub for amd64, armv7, and arm64 on Windows, Linux, and macOS.
 
@@ -100,20 +108,67 @@ echo_standalone_postinstall() {
 
 	cath <<EOF
 
-Standalone release has been installed into $STANDALONE_INSTALL_PREFIX/bin/$STANDALONE_BINARY_NAME
+Coder has been installed to
+
+  $STANDALONE_INSTALL_PREFIX/bin/$STANDALONE_BINARY_NAME
 
 EOF
 
-	if [ "$STANDALONE_INSTALL_PREFIX" != /usr/local ]; then
+	CODER_COMMAND="$(command -v "$STANDALONE_BINARY_NAME" || true)"
+
+	if [ -z "${CODER_COMMAND}" ]; then
 		cath <<EOF
 Extend your path to use Coder:
-PATH="$STANDALONE_INSTALL_PREFIX/bin:\$PATH"
+
+  $ PATH="$STANDALONE_INSTALL_PREFIX/bin:\$PATH"
+
+EOF
+	elif [ "$CODER_COMMAND" != "$STANDALONE_BINARY_LOCATION" ]; then
+		echo_path_conflict "$CODER_COMMAND"
+	else
+		cath <<EOF
+To run a Coder server:
+
+  $ $STANDALONE_BINARY_NAME server
+
+To connect to a Coder deployment:
+
+  $ $STANDALONE_BINARY_NAME login <deployment url>
 
 EOF
 	fi
+}
+
+echo_brew_postinstall() {
+	if [ "${DRY_RUN-}" ]; then
+		echo_dryrun_postinstall
+		return
+	fi
+
+	BREW_PREFIX="$(brew --prefix)"
+
 	cath <<EOF
-Run Coder:
-  $STANDALONE_BINARY_NAME server
+
+Coder has been installed to
+
+  $BREW_PREFIX/bin/coder
+
+EOF
+
+	CODER_COMMAND="$(command -v "coder" || true)"
+
+	if [ "$CODER_COMMAND" != "$BREW_PREFIX/bin/coder" ]; then
+		echo_path_conflict "$CODER_COMMAND"
+	fi
+
+	cath <<EOF
+To run a Coder server:
+
+  $ coder server
+
+To connect to a Coder deployment:
+
+  $ coder login <deployment url>
 
 EOF
 }
@@ -137,7 +192,6 @@ To run a Coder server:
   # Or just run the server directly
   $ coder server
 
-  Default URL: http://127.0.0.1:3000
   Configuring Coder: https://coder.com/docs/v2/latest/admin/configure
 
 To connect to a Coder deployment:
@@ -149,18 +203,33 @@ EOF
 
 echo_dryrun_postinstall() {
 	cath <<EOF
-
 Dry-run complete.
 
 To install Coder, re-run this script without the --dry-run flag.
+
+EOF
+}
+
+echo_path_conflict() {
+	cath <<EOF
+There is another binary in your PATH that conflicts with the binary we've installed.
+
+  $1
+
+This is likely because of an existing installation of Coder. See our documentation for suggestions on how to resolve this.
+
+	https://coder.com/docs/v2/latest/install/install.sh#path-conflicts
+
 EOF
 }
 
 main() {
 	TERRAFORM_VERSION="1.3.4"
+
 	if [ "${TRACE-}" ]; then
 		set -x
 	fi
+
 	unset \
 		DRY_RUN \
 		METHOD \
@@ -168,9 +237,12 @@ main() {
 		ALL_FLAGS \
 		RSH_ARGS \
 		EDGE \
-		RSH
+		RSH \
+		WITH_TERRAFORM \
+		CAP_NET_ADMIN
 
 	ALL_FLAGS=""
+
 	while [ "$#" -gt 0 ]; do
 		case "$1" in
 		-*)
@@ -225,7 +297,10 @@ main() {
 			exit 0
 			;;
 		--with-terraform)
-			METHOD=with_terraform
+			WITH_TERRAFORM=1
+			;;
+		--net-admin)
+			CAP_NET_ADMIN=1
 			;;
 		--)
 			shift
@@ -255,8 +330,29 @@ main() {
 		return
 	fi
 
+	# These can be overridden for testing but shouldn't normally be used as it can
+	# result in a broken coder.
+	OS=${OS:-$(os)}
+	ARCH=${ARCH:-$(arch)}
+	TERRAFORM_ARCH=${TERRAFORM_ARCH:-$(terraform_arch)}
+
+	# We can't reasonably support installing specific versions of Coder through
+	# Homebrew, so if we're on macOS and the `--version` flag was set, we should
+	# "detect" standalone to be the appropriate installation method. This check
+	# needs to occur before we set `VERSION` to a default of the latest release.
+	if [ "$OS" = "darwin" ] && [ "${VERSION-}" ]; then
+		METHOD=standalone
+	fi
+
+	# If we've been provided a flag which is specific to the standalone installation
+	# method, we should "detect" standalone to be the appropriate installation method.
+	# This check needs to occur before we set these variables with defaults.
+	if [ "${STANDALONE_INSTALL_PREFIX-}" ] || [ "${STANDALONE_BINARY_NAME-}" ]; then
+		METHOD=standalone
+	fi
+
 	METHOD="${METHOD-detect}"
-	if [ "$METHOD" != detect ] && [ "$METHOD" != with_terraform ] && [ "$METHOD" != standalone ]; then
+	if [ "$METHOD" != detect ] && [ "$METHOD" != standalone ]; then
 		echoerr "Unknown install method \"$METHOD\""
 		echoerr "Run with --help to see usage."
 		exit 1
@@ -265,15 +361,10 @@ main() {
 	# These are used by the various install_* functions that make use of GitHub
 	# releases in order to download and unpack the right release.
 	CACHE_DIR=$(echo_cache_dir)
-	STANDALONE_INSTALL_PREFIX=${STANDALONE_INSTALL_PREFIX:-/usr/local}
 	TERRAFORM_INSTALL_PREFIX=${TERRAFORM_INSTALL_PREFIX:-/usr/local}
+	STANDALONE_INSTALL_PREFIX=${STANDALONE_INSTALL_PREFIX:-/usr/local}
 	STANDALONE_BINARY_NAME=${STANDALONE_BINARY_NAME:-coder}
 	VERSION=${VERSION:-$(echo_latest_version)}
-	# These can be overridden for testing but shouldn't normally be used as it can
-	# result in a broken coder.
-	OS=${OS:-$(os)}
-	ARCH=${ARCH:-$(arch)}
-	TERRAFORM_ARCH=${TERRAFORM_ARCH:-$(terraform_arch)}
 
 	distro_name
 
@@ -282,6 +373,11 @@ main() {
 		echoh
 	fi
 
+	# Start by installing Terraform, if requested
+	if [ "${WITH_TERRAFORM-}" ]; then
+		with_terraform
+	fi
+
 	# Standalone installs by pulling pre-built releases from GitHub.
 	if [ "$METHOD" = standalone ]; then
 		if has_standalone; then
@@ -293,19 +389,13 @@ main() {
 			exit 1
 		fi
 	fi
-	if [ "$METHOD" = with_terraform ]; then
-		# Install terraform then continue the script
-		with_terraform
-	fi
 
 	# DISTRO can be overridden for testing but shouldn't normally be used as it
 	# can result in a broken coder.
 	DISTRO=${DISTRO:-$(distro)}
 
 	case $DISTRO in
-	# macOS uses the standalone installation for now.
-	# Homebrew support is planned. See: https://github.com/coder/coder/issues/1925
-	macos) install_standalone ;;
+	darwin) install_macos ;;
 	# The .deb and .rpm files are pulled from GitHub.
 	debian) install_deb ;;
 	fedora | opensuse) install_rpm ;;
@@ -320,6 +410,26 @@ main() {
 		install_standalone
 		;;
 	esac
+
+	if [ "${CAP_NET_ADMIN:-}" ]; then
+		cap_net_admin
+	fi
+}
+
+cap_net_admin() {
+	if ! command_exists setcap && command_exists capsh; then
+		echo "Package 'libcap' not found. See install instructions for your distro: https://command-not-found.com/setcap"
+		return
+	fi
+
+	# Make sure we'e allowed to add CAP_NET_ADMIN.
+	if sudo_sh_c capsh --has-p=CAP_NET_ADMIN; then
+		sudo_sh_c setcap CAP_NET_ADMIN=+ep "$(command -v coder)" || true
+
+	# Unable to escalate perms, notify the user.
+	else
+		echo "Unable to setcap agent binary. Ensure the root user has CAP_NET_ADMIN permissions."
+	fi
 }
 
 parse_arg() {
@@ -408,6 +518,23 @@ with_terraform() {
 	"$sh_c" cp "$CACHE_DIR/terraform" "$COPY_LOCATION"
 }
 
+install_macos() {
+	# If there is no `brew` binary available, just default to installing standalone
+	if command_exists brew; then
+		echoh "Installing coder with Homebrew from the coder/coder tap."
+		echoh
+
+		sh_c brew install coder/coder/coder
+
+		echo_brew_postinstall
+		return
+	fi
+
+	echoh "Homebrew is not available."
+	echoh "Falling back to standalone installation."
+	install_standalone
+}
+
 install_deb() {
 	echoh "Installing v$VERSION of the $ARCH deb package from GitHub."
 	echoh
@@ -470,16 +597,16 @@ install_standalone() {
 		"$sh_c" unzip -d "$CACHE_DIR" -o "$CACHE_DIR/coder_${VERSION}_${OS}_${ARCH}.zip"
 	fi
 
-	COPY_LOCATION="$STANDALONE_INSTALL_PREFIX/bin/$STANDALONE_BINARY_NAME"
+	STANDALONE_BINARY_LOCATION="$STANDALONE_INSTALL_PREFIX/bin/$STANDALONE_BINARY_NAME"
 
 	# Remove the file if it already exists to
 	# avoid https://github.com/coder/coder/issues/2086
-	if [ -f "$COPY_LOCATION" ]; then
-		"$sh_c" rm "$COPY_LOCATION"
+	if [ -f "$STANDALONE_BINARY_LOCATION" ]; then
+		"$sh_c" rm "$STANDALONE_BINARY_LOCATION"
 	fi
 
 	# Copy the binary to the correct location.
-	"$sh_c" cp "$CACHE_DIR/coder" "$COPY_LOCATION"
+	"$sh_c" cp "$CACHE_DIR/coder" "$STANDALONE_BINARY_LOCATION"
 
 	echo_standalone_postinstall
 }
@@ -602,10 +729,10 @@ sh_c() {
 sudo_sh_c() {
 	if [ "$(id -u)" = 0 ]; then
 		sh_c "$@"
-	elif command_exists doas; then
-		sh_c "doas $*"
 	elif command_exists sudo; then
 		sh_c "sudo $*"
+	elif command_exists doas; then
+		sh_c "doas $*"
 	elif command_exists su; then
 		sh_c "su - -c '$*'"
 	else
diff --git a/offlinedocs/next.config.js b/offlinedocs/next.config.js
index 0128f08b2744c..bf2eb08b5f9be 100644
--- a/offlinedocs/next.config.js
+++ b/offlinedocs/next.config.js
@@ -2,6 +2,6 @@
 const nextConfig = {
   reactStrictMode: true,
   trailingSlash: true,
-}
+};
 
-module.exports = nextConfig
+module.exports = nextConfig;
diff --git a/offlinedocs/package.json b/offlinedocs/package.json
index b97c978a44d46..614ce0d943e63 100644
--- a/offlinedocs/package.json
+++ b/offlinedocs/package.json
@@ -19,15 +19,15 @@
     "@emotion/react": "11",
     "@emotion/styled": "11",
     "@types/lodash": "4.14.196",
-    "archiver": "5.3.1",
+    "archiver": "6.0.0",
     "framer-motion": "10",
     "front-matter": "4.0.2",
     "fs-extra": "11.1.1",
     "lodash": "4.17.21",
-    "next": "13.4.12",
+    "next": "13.5.3",
     "react": "18.2.0",
     "react-dom": "18.2.0",
-    "react-icons": "4.10.1",
+    "react-icons": "4.11.0",
     "react-markdown": "8.0.3",
     "rehype-raw": "6.1.1",
     "remark-gfm": "3.0.1"
@@ -35,11 +35,11 @@
   "devDependencies": {
     "@react-native-community/eslint-config": "3.2.0",
     "@react-native-community/eslint-plugin": "1.3.0",
-    "@types/node": "18.17.0",
+    "@types/node": "18.18.1",
     "@types/react": "18.2.17",
     "@types/react-dom": "18.2.7",
-    "eslint": "8.46.0",
-    "eslint-config-next": "13.4.10",
+    "eslint": "8.50.0",
+    "eslint-config-next": "13.5.3",
     "prettier": "3.0.0",
     "typescript": "5.1.6"
   },
diff --git a/offlinedocs/pages/[[...slug]].tsx b/offlinedocs/pages/[[...slug]].tsx
index 7f6cc7ddd4d47..ca40353f76f96 100644
--- a/offlinedocs/pages/[[...slug]].tsx
+++ b/offlinedocs/pages/[[...slug]].tsx
@@ -24,57 +24,57 @@ import {
   Tr,
   UnorderedList,
   useDisclosure,
-} from "@chakra-ui/react"
-import fm from "front-matter"
-import { readFileSync } from "fs"
-import _ from "lodash"
-import { GetStaticPaths, GetStaticProps, NextPage } from "next"
-import Head from "next/head"
-import NextLink from "next/link"
-import { useRouter } from "next/router"
-import path from "path"
-import { MdMenu } from "react-icons/md"
-import ReactMarkdown from "react-markdown"
-import rehypeRaw from "rehype-raw"
-import remarkGfm from "remark-gfm"
-
-type FilePath = string
-type UrlPath = string
+} from "@chakra-ui/react";
+import fm from "front-matter";
+import { readFileSync } from "fs";
+import _ from "lodash";
+import { GetStaticPaths, GetStaticProps, NextPage } from "next";
+import Head from "next/head";
+import NextLink from "next/link";
+import { useRouter } from "next/router";
+import path from "path";
+import { MdMenu } from "react-icons/md";
+import ReactMarkdown from "react-markdown";
+import rehypeRaw from "rehype-raw";
+import remarkGfm from "remark-gfm";
+
+type FilePath = string;
+type UrlPath = string;
 type Route = {
-  path: FilePath
-  title: string
-  description?: string
-  children?: Route[]
-}
-type Manifest = { versions: string[]; routes: Route[] }
-type NavItem = { title: string; path: UrlPath; children?: NavItem[] }
-type Nav = NavItem[]
+  path: FilePath;
+  title: string;
+  description?: string;
+  children?: Route[];
+};
+type Manifest = { versions: string[]; routes: Route[] };
+type NavItem = { title: string; path: UrlPath; children?: NavItem[] };
+type Nav = NavItem[];
 
 const readContentFile = (filePath: string) => {
-  const baseDir = process.cwd()
-  const docsPath = path.join(baseDir, "..", "docs")
-  return readFileSync(path.join(docsPath, filePath), { encoding: "utf-8" })
-}
+  const baseDir = process.cwd();
+  const docsPath = path.join(baseDir, "..", "docs");
+  return readFileSync(path.join(docsPath, filePath), { encoding: "utf-8" });
+};
 
-const removeTrailingSlash = (path: string) => path.replace(/\/+$/, "")
+const removeTrailingSlash = (path: string) => path.replace(/\/+$/, "");
 
-const removeMkdExtension = (path: string) => path.replace(/\.md/g, "")
+const removeMkdExtension = (path: string) => path.replace(/\.md/g, "");
 
 const removeIndexFilename = (path: string) => {
   if (path.endsWith("index")) {
-    path = path.replace("index", "")
+    path = path.replace("index", "");
   }
 
-  return path
-}
+  return path;
+};
 
 const removeREADMEName = (path: string) => {
   if (path.startsWith("README")) {
-    path = path.replace("README", "")
+    path = path.replace("README", "");
   }
 
-  return path
-}
+  return path;
+};
 
 // transformLinkUri converts the links in the markdown file to
 // href html links. All index page routes are the directory name, and all
@@ -87,142 +87,142 @@ const removeREADMEName = (path: string) => {
 // file.md -> ../file-next-to-file = ../file-next-to-file
 const transformLinkUriSource = (sourceFile: string) => {
   return (href = "") => {
-    const isExternal = href.startsWith("http") || href.startsWith("https")
+    const isExternal = href.startsWith("http") || href.startsWith("https");
     if (!isExternal) {
       // Remove .md form the path
-      href = removeMkdExtension(href)
+      href = removeMkdExtension(href);
 
       // Add the extra '..' if not an index file.
-      sourceFile = removeMkdExtension(sourceFile)
+      sourceFile = removeMkdExtension(sourceFile);
       if (!sourceFile.endsWith("index")) {
-        href = "../" + href
+        href = "../" + href;
       }
 
       // Remove the index path
-      href = removeIndexFilename(href)
-      href = removeREADMEName(href)
+      href = removeIndexFilename(href);
+      href = removeREADMEName(href);
     }
-    return href
-  }
-}
+    return href;
+  };
+};
 
 const transformFilePathToUrlPath = (filePath: string) => {
   // Remove markdown extension
-  let urlPath = removeMkdExtension(filePath)
+  let urlPath = removeMkdExtension(filePath);
 
   // Remove relative path
   if (urlPath.startsWith("./")) {
-    urlPath = urlPath.replace("./", "")
+    urlPath = urlPath.replace("./", "");
   }
 
   // Remove index from the root file
-  urlPath = removeIndexFilename(urlPath)
-  urlPath = removeREADMEName(urlPath)
+  urlPath = removeIndexFilename(urlPath);
+  urlPath = removeREADMEName(urlPath);
 
   // Remove trailing slash
   if (urlPath.endsWith("/")) {
-    urlPath = removeTrailingSlash(urlPath)
+    urlPath = removeTrailingSlash(urlPath);
   }
 
-  return urlPath
-}
+  return urlPath;
+};
 
 const mapRoutes = (manifest: Manifest): Record<UrlPath, Route> => {
-  const paths: Record<UrlPath, Route> = {}
+  const paths: Record<UrlPath, Route> = {};
 
   const addPaths = (routes: Route[]) => {
     for (const route of routes) {
-      paths[transformFilePathToUrlPath(route.path)] = route
+      paths[transformFilePathToUrlPath(route.path)] = route;
 
       if (route.children) {
-        addPaths(route.children)
+        addPaths(route.children);
       }
     }
-  }
+  };
 
-  addPaths(manifest.routes)
+  addPaths(manifest.routes);
 
-  return paths
-}
+  return paths;
+};
 
-let manifest: Manifest | undefined
+let manifest: Manifest | undefined;
 
 const getManifest = () => {
   if (manifest) {
-    return manifest
+    return manifest;
   }
 
-  const manifestContent = readContentFile("manifest.json")
-  manifest = JSON.parse(manifestContent) as Manifest
-  return manifest
-}
+  const manifestContent = readContentFile("manifest.json");
+  manifest = JSON.parse(manifestContent) as Manifest;
+  return manifest;
+};
 
-let navigation: Nav | undefined
+let navigation: Nav | undefined;
 
 const getNavigation = (manifest: Manifest): Nav => {
   if (navigation) {
-    return navigation
+    return navigation;
   }
 
   const getNavItem = (route: Route, parentPath?: UrlPath): NavItem => {
     const path = parentPath
       ? `${parentPath}/${transformFilePathToUrlPath(route.path)}`
-      : transformFilePathToUrlPath(route.path)
+      : transformFilePathToUrlPath(route.path);
     const navItem: NavItem = {
       title: route.title,
       path,
-    }
+    };
 
     if (route.children) {
-      navItem.children = []
+      navItem.children = [];
 
       for (const childRoute of route.children) {
-        navItem.children.push(getNavItem(childRoute))
+        navItem.children.push(getNavItem(childRoute));
       }
     }
 
-    return navItem
-  }
+    return navItem;
+  };
 
-  navigation = []
+  navigation = [];
 
   for (const route of manifest.routes) {
-    navigation.push(getNavItem(route))
+    navigation.push(getNavItem(route));
   }
 
-  return navigation
-}
+  return navigation;
+};
 
 const removeHtmlComments = (string: string) => {
-  return string.replace(/<!--[\s\S]*?-->/g, "")
-}
+  return string.replace(/<!--[\s\S]*?-->/g, "");
+};
 
 export const getStaticPaths: GetStaticPaths = () => {
-  const manifest = getManifest()
-  const routes = mapRoutes(manifest)
+  const manifest = getManifest();
+  const routes = mapRoutes(manifest);
   const paths = Object.keys(routes).map((urlPath) => ({
     params: { slug: urlPath.split("/") },
-  }))
+  }));
 
   return {
     paths,
     fallback: false,
-  }
-}
+  };
+};
 
 export const getStaticProps: GetStaticProps = (context) => {
   // When it is home page, the slug is undefined because there is no url path
   // so we make it an empty string to work good with the mapRoutes
-  const { slug = [""] } = context.params as { slug: string[] }
-  const manifest = getManifest()
-  const routes = mapRoutes(manifest)
-  const urlPath = slug.join("/")
-  const route = routes[urlPath]
-  const { body } = fm(readContentFile(route.path))
+  const { slug = [""] } = context.params as { slug: string[] };
+  const manifest = getManifest();
+  const routes = mapRoutes(manifest);
+  const urlPath = slug.join("/");
+  const route = routes[urlPath];
+  const { body } = fm(readContentFile(route.path));
   // Serialize MDX to support custom components
-  const content = removeHtmlComments(body)
-  const navigation = getNavigation(manifest)
-  const version = manifest.versions[0]
+  const content = removeHtmlComments(body);
+  const navigation = getNavigation(manifest);
+  const version = manifest.versions[0];
 
   return {
     props: {
@@ -231,25 +231,26 @@ export const getStaticProps: GetStaticProps = (context) => {
       route,
       version,
     },
-  }
-}
+  };
+};
 
 const SidebarNavItem: React.FC<{ item: NavItem; nav: Nav }> = ({
   item,
   nav,
 }) => {
-  const router = useRouter()
-  let isActive = router.asPath.startsWith(`/${item.path}`)
+  const router = useRouter();
+  let isActive = router.asPath.startsWith(`/${item.path}`);
 
   // Special case to handle the home path
   if (item.path === "") {
-    isActive = router.asPath === "/"
+    isActive = router.asPath === "/";
 
     // Special case to handle the home path children
-    const homeNav = nav.find((navItem) => navItem.path === "") as NavItem
-    const homeNavPaths = homeNav.children?.map((item) => `/${item.path}/`) ?? []
+    const homeNav = nav.find((navItem) => navItem.path === "") as NavItem;
+    const homeNavPaths =
+      homeNav.children?.map((item) => `/${item.path}/`) ?? [];
     if (homeNavPaths.includes(router.asPath)) {
-      isActive = true
+      isActive = true;
     }
   }
 
@@ -280,8 +281,8 @@ const SidebarNavItem: React.FC<{ item: NavItem; nav: Nav }> = ({
         </Grid>
       )}
     </Box>
-  )
-}
+  );
+};
 
 const SidebarNav: React.FC<{ nav: Nav; version: string } & GridProps> = ({
   nav,
@@ -312,14 +313,14 @@ const SidebarNav: React.FC<{ nav: Nav; version: string } & GridProps> = ({
         <SidebarNavItem key={navItem.path} item={navItem} nav={nav} />
       ))}
     </Grid>
-  )
-}
+  );
+};
 
 const MobileNavbar: React.FC<{ nav: Nav; version: string }> = ({
   nav,
   version,
 }) => {
-  const { isOpen, onOpen, onClose } = useDisclosure()
+  const { isOpen, onOpen, onClose } = useDisclosure();
 
   return (
     <>
@@ -347,26 +348,26 @@ const MobileNavbar: React.FC<{ nav: Nav; version: string }> = ({
         </DrawerContent>
       </Drawer>
     </>
-  )
-}
+  );
+};
 
 const slugifyTitle = (title: string) => {
-  return _.kebabCase(title.toLowerCase())
-}
+  return _.kebabCase(title.toLowerCase());
+};
 
 const getImageUrl = (src: string | undefined) => {
   if (src === undefined) {
-    return ""
+    return "";
   }
-  const assetPath = src.split("images/")[1]
-  return `/images/${assetPath}`
-}
+  const assetPath = src.split("images/")[1];
+  return `/images/${assetPath}`;
+};
 
 const DocsPage: NextPage<{
-  content: string
-  navigation: Nav
-  route: Route
-  version: string
+  content: string;
+  navigation: Nav;
+  route: Route;
+  version: string;
 }> = ({ content, navigation, route, version }) => {
   return (
     <>
@@ -486,7 +487,7 @@ const DocsPage: NextPage<{
                   ),
                   a: ({ children, href = "" }) => {
                     const isExternal =
-                      href.startsWith("http") || href.startsWith("https")
+                      href.startsWith("http") || href.startsWith("https");
 
                     return (
                       <Link
@@ -497,7 +498,7 @@ const DocsPage: NextPage<{
                       >
                         {children}
                       </Link>
-                    )
+                    );
                   },
                   code: ({ node, ...props }) => (
                     <Code {...props} bgColor="gray.100" />
@@ -538,7 +539,7 @@ const DocsPage: NextPage<{
         </Box>
       </Box>
     </>
-  )
-}
+  );
+};
 
-export default DocsPage
+export default DocsPage;
diff --git a/offlinedocs/pages/_app.tsx b/offlinedocs/pages/_app.tsx
index 9c79747e47913..31bd99af73c2f 100644
--- a/offlinedocs/pages/_app.tsx
+++ b/offlinedocs/pages/_app.tsx
@@ -1,6 +1,6 @@
-import { ChakraProvider, extendTheme } from "@chakra-ui/react"
-import type { AppProps } from "next/app"
-import Head from "next/head"
+import { ChakraProvider, extendTheme } from "@chakra-ui/react";
+import type { AppProps } from "next/app";
+import Head from "next/head";
 
 const theme = extendTheme({
   styles: {
@@ -10,7 +10,7 @@ const theme = extendTheme({
       },
     },
   },
-})
+});
 
 const MyApp: React.FC<AppProps> = ({ Component, pageProps }) => {
   return (
@@ -23,7 +23,7 @@ const MyApp: React.FC<AppProps> = ({ Component, pageProps }) => {
         <Component {...pageProps} />
       </ChakraProvider>
     </>
-  )
-}
+  );
+};
 
-export default MyApp
+export default MyApp;
diff --git a/offlinedocs/pnpm-lock.yaml b/offlinedocs/pnpm-lock.yaml
index 7f60f70f0f514..e32277f77cff9 100644
--- a/offlinedocs/pnpm-lock.yaml
+++ b/offlinedocs/pnpm-lock.yaml
@@ -7,7 +7,7 @@ settings:
 dependencies:
   '@chakra-ui/react':
     specifier: 2.8.0
-    version: 2.8.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(@types/react@18.2.17)(framer-motion@10.15.0)(react-dom@18.2.0)(react@18.2.0)
+    version: 2.8.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(@types/react@18.2.17)(framer-motion@10.16.1)(react-dom@18.2.0)(react@18.2.0)
   '@emotion/react':
     specifier: '11'
     version: 11.11.1(@types/react@18.2.17)(react@18.2.0)
@@ -18,11 +18,11 @@ dependencies:
     specifier: 4.14.196
     version: 4.14.196
   archiver:
-    specifier: 5.3.1
-    version: 5.3.1
+    specifier: 6.0.0
+    version: 6.0.0
   framer-motion:
     specifier: '10'
-    version: 10.15.0(react-dom@18.2.0)(react@18.2.0)
+    version: 10.16.1(react-dom@18.2.0)(react@18.2.0)
   front-matter:
     specifier: 4.0.2
     version: 4.0.2
@@ -33,8 +33,8 @@ dependencies:
     specifier: 4.17.21
     version: 4.17.21
   next:
-    specifier: 13.4.12
-    version: 13.4.12(@babel/core@7.22.9)(react-dom@18.2.0)(react@18.2.0)
+    specifier: 13.5.3
+    version: 13.5.3(@babel/core@7.22.9)(react-dom@18.2.0)(react@18.2.0)
   react:
     specifier: 18.2.0
     version: 18.2.0
@@ -42,8 +42,8 @@ dependencies:
     specifier: 18.2.0
     version: 18.2.0(react@18.2.0)
   react-icons:
-    specifier: 4.10.1
-    version: 4.10.1(react@18.2.0)
+    specifier: 4.11.0
+    version: 4.11.0(react@18.2.0)
   react-markdown:
     specifier: 8.0.3
     version: 8.0.3(@types/react@18.2.17)(react@18.2.0)
@@ -57,13 +57,13 @@ dependencies:
 devDependencies:
   '@react-native-community/eslint-config':
     specifier: 3.2.0
-    version: 3.2.0(eslint@8.46.0)(prettier@3.0.0)(typescript@5.1.6)
+    version: 3.2.0(eslint@8.50.0)(prettier@3.0.0)(typescript@5.1.6)
   '@react-native-community/eslint-plugin':
     specifier: 1.3.0
     version: 1.3.0
   '@types/node':
-    specifier: 18.17.0
-    version: 18.17.0
+    specifier: 18.18.1
+    version: 18.18.1
   '@types/react':
     specifier: 18.2.17
     version: 18.2.17
@@ -71,11 +71,11 @@ devDependencies:
     specifier: 18.2.7
     version: 18.2.7
   eslint:
-    specifier: 8.46.0
-    version: 8.46.0
+    specifier: 8.50.0
+    version: 8.50.0
   eslint-config-next:
-    specifier: 13.4.10
-    version: 13.4.10(eslint@8.46.0)(typescript@5.1.6)
+    specifier: 13.5.3
+    version: 13.5.3(eslint@8.50.0)(typescript@5.1.6)
   prettier:
     specifier: 3.0.0
     version: 3.0.0
@@ -97,6 +97,13 @@ packages:
       '@jridgewell/gen-mapping': 0.3.3
       '@jridgewell/trace-mapping': 0.3.18
 
+  /@babel/code-frame@7.22.13:
+    resolution: {integrity: sha512-XktuhWlJ5g+3TJXc5upd9Ks1HutSArik6jf2eAjYFyIOf4ej3RN+184cZbzDvbPnuTJIUhPKKJE3cIsYTiAT3w==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/highlight': 7.22.20
+      chalk: 2.4.2
+
   /@babel/code-frame@7.22.5:
     resolution: {integrity: sha512-Xmwn266vad+6DAqEB2A6V/CcZVp62BbwVmcOJc2RPuwih1kw02TjQvWVWlcKGbBPd+8/0V5DEkOcizRGYsspYQ==}
     engines: {node: '>=6.9.0'}
@@ -119,7 +126,7 @@ packages:
       '@babel/helpers': 7.22.6
       '@babel/parser': 7.22.7
       '@babel/template': 7.22.5
-      '@babel/traverse': 7.22.8
+      '@babel/traverse': 7.23.2
       '@babel/types': 7.22.5
       convert-source-map: 1.9.0
       debug: 4.3.4
@@ -129,7 +136,7 @@ packages:
     transitivePeerDependencies:
       - supports-color
 
-  /@babel/eslint-parser@7.22.9(@babel/core@7.22.9)(eslint@8.46.0):
+  /@babel/eslint-parser@7.22.9(@babel/core@7.22.9)(eslint@8.50.0):
     resolution: {integrity: sha512-xdMkt39/nviO/4vpVdrEYPwXCsYIXSSAr6mC7WQsNIlGnuxKyKE7GZjalcnbSWiC4OXGNNN3UQPeHfjSC6sTDA==}
     engines: {node: ^10.13.0 || ^12.13.0 || >=14.0.0}
     peerDependencies:
@@ -138,7 +145,7 @@ packages:
     dependencies:
       '@babel/core': 7.22.9
       '@nicolo-ribaudo/eslint-scope-5-internals': 5.1.1-v1
-      eslint: 8.46.0
+      eslint: 8.50.0
       eslint-visitor-keys: 2.1.0
       semver: 6.3.1
     dev: true
@@ -152,6 +159,15 @@ packages:
       '@jridgewell/trace-mapping': 0.3.18
       jsesc: 2.5.2
 
+  /@babel/generator@7.23.0:
+    resolution: {integrity: sha512-lN85QRR+5IbYrMWM6Y4pE/noaQtg4pNiqeNGX60eqOfo6gtEj6uw/JagelB8vVztSd7R6M5n1+PQkDbHbBRU4g==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/types': 7.23.0
+      '@jridgewell/gen-mapping': 0.3.3
+      '@jridgewell/trace-mapping': 0.3.18
+      jsesc: 2.5.2
+
   /@babel/helper-compilation-targets@7.22.9(@babel/core@7.22.9):
     resolution: {integrity: sha512-7qYrNM6HjpnPHJbopxmb8hSPoZ0gsX8IvUS32JGVoy+pU9e5N0nLr1VjJoR6kA4d9dmGLxNYOjeB8sUDal2WMw==}
     engines: {node: '>=6.9.0'}
@@ -165,22 +181,26 @@ packages:
       lru-cache: 5.1.1
       semver: 6.3.1
 
+  /@babel/helper-environment-visitor@7.22.20:
+    resolution: {integrity: sha512-zfedSIzFhat/gFhWfHtgWvlec0nqB9YEIVrpuwjruLlXfUSnA8cJB0miHKwqDnQ7d32aKo2xt88/xZptwxbfhA==}
+    engines: {node: '>=6.9.0'}
+
   /@babel/helper-environment-visitor@7.22.5:
     resolution: {integrity: sha512-XGmhECfVA/5sAt+H+xpSg0mfrHq6FzNr9Oxh7PSEBBRUb/mL7Kz3NICXb194rCqAEdxkhPT1a88teizAFyvk8Q==}
     engines: {node: '>=6.9.0'}
 
-  /@babel/helper-function-name@7.22.5:
-    resolution: {integrity: sha512-wtHSq6jMRE3uF2otvfuD3DIvVhOsSNshQl0Qrd7qC9oQJzHvOL4qQXlQn2916+CXGywIjpGuIkoyZRRxHPiNQQ==}
+  /@babel/helper-function-name@7.23.0:
+    resolution: {integrity: sha512-OErEqsrxjZTJciZ4Oo+eoZqeW9UIiOcuYKRJA4ZAgV9myA+pOXhhmpfNCKjEH/auVfEYVFJ6y1Tc4r0eIApqiw==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/template': 7.22.5
-      '@babel/types': 7.22.5
+      '@babel/template': 7.22.15
+      '@babel/types': 7.23.0
 
   /@babel/helper-hoist-variables@7.22.5:
     resolution: {integrity: sha512-wGjk9QZVzvknA6yKIUURb8zY3grXCcOZt+/7Wcy8O2uctxhplmUPkOdlgoNhmdVee2c92JXbf1xpMtVNbfoxRw==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
 
   /@babel/helper-module-imports@7.22.5:
     resolution: {integrity: sha512-8Dl6+HD/cKifutF5qGd/8ZJi84QeAKh+CEe1sBzz8UayBBGg1dAIJrdHOcOM5b2MpzWL2yuotJTtGjETq0qjXg==}
@@ -211,12 +231,16 @@ packages:
     resolution: {integrity: sha512-AsUnxuLhRYsisFiaJwvp1QF+I3KjD5FOxut14q/GzovUe6orHLesW2C7d754kRm53h5gqrz6sFl6sxc4BVtE/g==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
 
   /@babel/helper-string-parser@7.22.5:
     resolution: {integrity: sha512-mM4COjgZox8U+JcXQwPijIZLElkgEpO5rsERVDJTc2qfCDfERyob6k5WegS14SX18IIjv+XD+GrqNumY5JRCDw==}
     engines: {node: '>=6.9.0'}
 
+  /@babel/helper-validator-identifier@7.22.20:
+    resolution: {integrity: sha512-Y4OZ+ytlatR8AI+8KZfKuL5urKp7qey08ha31L8b3BwewJAoJamTzyvxPR/5D+KkdJCGPq/+8TukHBlY10FX9A==}
+    engines: {node: '>=6.9.0'}
+
   /@babel/helper-validator-identifier@7.22.5:
     resolution: {integrity: sha512-aJXu+6lErq8ltp+JhkJUfk1MTGyuA4v7f3pA+BJ5HLfNC6nAQ0Cpi9uOquUj8Hehg0aUiHzWQbOVJGao6ztBAQ==}
     engines: {node: '>=6.9.0'}
@@ -230,11 +254,19 @@ packages:
     engines: {node: '>=6.9.0'}
     dependencies:
       '@babel/template': 7.22.5
-      '@babel/traverse': 7.22.8
+      '@babel/traverse': 7.23.2
       '@babel/types': 7.22.5
     transitivePeerDependencies:
       - supports-color
 
+  /@babel/highlight@7.22.20:
+    resolution: {integrity: sha512-dkdMCN3py0+ksCgYmGG8jKeGA/8Tk+gJwSYYlFGxG5lmhfKNoAy004YpLxpS1W2J8m/EK2Ew+yOs9pVRwO89mg==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/helper-validator-identifier': 7.22.20
+      chalk: 2.4.2
+      js-tokens: 4.0.0
+
   /@babel/highlight@7.22.5:
     resolution: {integrity: sha512-BSKlD1hgnedS5XRnGOljZawtag7H1yPfQp0tdNJCHoH6AZ+Pcm9VvkrK59/Yy593Ypg0zMxH2BxD1VPYUQ7UIw==}
     engines: {node: '>=6.9.0'}
@@ -250,12 +282,27 @@ packages:
     dependencies:
       '@babel/types': 7.22.5
 
+  /@babel/parser@7.23.0:
+    resolution: {integrity: sha512-vvPKKdMemU85V9WE/l5wZEmImpCtLqbnTvqDS2U1fJ96KrxoW7KrXhNsNCblQlg8Ck4b85yxdTyelsMUgFUXiw==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+    dependencies:
+      '@babel/types': 7.23.0
+
   /@babel/runtime@7.22.6:
     resolution: {integrity: sha512-wDb5pWm4WDdF6LFUde3Jl8WzPA+3ZbxYqkC6xAXuD3irdEHN1k0NfTRrJD8ZD378SJ61miMLCqIOXYhd8x+AJQ==}
     engines: {node: '>=6.9.0'}
     dependencies:
       regenerator-runtime: 0.13.11
 
+  /@babel/template@7.22.15:
+    resolution: {integrity: sha512-QPErUVm4uyJa60rkI73qneDacvdvzxshT3kksGqlGWYdOTIUOwJ7RDUL8sGqslY1uXWSL6xMFKEXDS3ox2uF0w==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/code-frame': 7.22.13
+      '@babel/parser': 7.23.0
+      '@babel/types': 7.23.0
+
   /@babel/template@7.22.5:
     resolution: {integrity: sha512-X7yV7eiwAxdj9k94NEylvbVHLiVG1nvzCV2EAowhxLTwODV1jl9UzZ48leOC0sH7OnuHrIkllaBgneUykIcZaw==}
     engines: {node: '>=6.9.0'}
@@ -264,18 +311,18 @@ packages:
       '@babel/parser': 7.22.7
       '@babel/types': 7.22.5
 
-  /@babel/traverse@7.22.8:
-    resolution: {integrity: sha512-y6LPR+wpM2I3qJrsheCTwhIinzkETbplIgPBbwvqPKc+uljeA5gP+3nP8irdYt1mjQaDnlIcG+dw8OjAco4GXw==}
+  /@babel/traverse@7.23.2:
+    resolution: {integrity: sha512-azpe59SQ48qG6nu2CzcMLbxUudtN+dOM9kDbUqGq3HXUJRlo7i8fvPoxQUzYgLZ4cMVmuZgm8vvBpNeRhd6XSw==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/code-frame': 7.22.5
-      '@babel/generator': 7.22.9
-      '@babel/helper-environment-visitor': 7.22.5
-      '@babel/helper-function-name': 7.22.5
+      '@babel/code-frame': 7.22.13
+      '@babel/generator': 7.23.0
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-function-name': 7.23.0
       '@babel/helper-hoist-variables': 7.22.5
       '@babel/helper-split-export-declaration': 7.22.6
-      '@babel/parser': 7.22.7
-      '@babel/types': 7.22.5
+      '@babel/parser': 7.23.0
+      '@babel/types': 7.23.0
       debug: 4.3.4
       globals: 11.12.0
     transitivePeerDependencies:
@@ -289,7 +336,15 @@ packages:
       '@babel/helper-validator-identifier': 7.22.5
       to-fast-properties: 2.0.0
 
-  /@chakra-ui/accordion@2.3.0(@chakra-ui/system@2.6.0)(framer-motion@10.15.0)(react@18.2.0):
+  /@babel/types@7.23.0:
+    resolution: {integrity: sha512-0oIyUfKoI3mSqMvsxBdclDwxXKXAUA8v/apZbc+iSyARYou1o8ZGDxbUYyLFoW2arqS2jDGqJuZvv1d/io1axg==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/helper-string-parser': 7.22.5
+      '@babel/helper-validator-identifier': 7.22.20
+      to-fast-properties: 2.0.0
+
+  /@chakra-ui/accordion@2.3.0(@chakra-ui/system@2.6.0)(framer-motion@10.16.1)(react@18.2.0):
     resolution: {integrity: sha512-A4TkRw3Jnt+Fam6dSSJ62rskdrvjF3JGctYcfXlojfFIpHPuIw4pDwfZgNAxlaxWkcj0e7JJKlQ88dnZW+QfFg==}
     peerDependencies:
       '@chakra-ui/system': '>=2.0.0'
@@ -303,8 +358,8 @@ packages:
       '@chakra-ui/react-use-merge-refs': 2.1.0(react@18.2.0)
       '@chakra-ui/shared-utils': 2.0.5
       '@chakra-ui/system': 2.6.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(react@18.2.0)
-      '@chakra-ui/transition': 2.1.0(framer-motion@10.15.0)(react@18.2.0)
-      framer-motion: 10.15.0(react-dom@18.2.0)(react@18.2.0)
+      '@chakra-ui/transition': 2.1.0(framer-motion@10.16.1)(react@18.2.0)
+      framer-motion: 10.16.1(react-dom@18.2.0)(react@18.2.0)
       react: 18.2.0
     dev: false
 
@@ -621,7 +676,7 @@ packages:
       react: 18.2.0
     dev: false
 
-  /@chakra-ui/menu@2.2.0(@chakra-ui/system@2.6.0)(framer-motion@10.15.0)(react@18.2.0):
+  /@chakra-ui/menu@2.2.0(@chakra-ui/system@2.6.0)(framer-motion@10.16.1)(react@18.2.0):
     resolution: {integrity: sha512-l7HQjriW4JGeCyxDdguAzekwwB+kHGDLxACi0DJNp37sil51SRaN1S1OrneISbOHVpHuQB+KVNgU0rqhoglVew==}
     peerDependencies:
       '@chakra-ui/system': '>=2.0.0'
@@ -643,12 +698,12 @@ packages:
       '@chakra-ui/react-use-update-effect': 2.1.0(react@18.2.0)
       '@chakra-ui/shared-utils': 2.0.5
       '@chakra-ui/system': 2.6.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(react@18.2.0)
-      '@chakra-ui/transition': 2.1.0(framer-motion@10.15.0)(react@18.2.0)
-      framer-motion: 10.15.0(react-dom@18.2.0)(react@18.2.0)
+      '@chakra-ui/transition': 2.1.0(framer-motion@10.16.1)(react@18.2.0)
+      framer-motion: 10.16.1(react-dom@18.2.0)(react@18.2.0)
       react: 18.2.0
     dev: false
 
-  /@chakra-ui/modal@2.3.0(@chakra-ui/system@2.6.0)(@types/react@18.2.17)(framer-motion@10.15.0)(react-dom@18.2.0)(react@18.2.0):
+  /@chakra-ui/modal@2.3.0(@chakra-ui/system@2.6.0)(@types/react@18.2.17)(framer-motion@10.16.1)(react-dom@18.2.0)(react@18.2.0):
     resolution: {integrity: sha512-S1sITrIeLSf21LJ0Vz8xZhj5fWEud5z5Dl2dmvOEv1ezypgOrCCBdOEnnqCkoEKZDbKvzZWZXWR5791ikLP6+g==}
     peerDependencies:
       '@chakra-ui/system': '>=2.0.0'
@@ -664,9 +719,9 @@ packages:
       '@chakra-ui/react-use-merge-refs': 2.1.0(react@18.2.0)
       '@chakra-ui/shared-utils': 2.0.5
       '@chakra-ui/system': 2.6.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(react@18.2.0)
-      '@chakra-ui/transition': 2.1.0(framer-motion@10.15.0)(react@18.2.0)
+      '@chakra-ui/transition': 2.1.0(framer-motion@10.16.1)(react@18.2.0)
       aria-hidden: 1.2.3
-      framer-motion: 10.15.0(react-dom@18.2.0)(react@18.2.0)
+      framer-motion: 10.16.1(react-dom@18.2.0)(react@18.2.0)
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
       react-remove-scroll: 2.5.6(@types/react@18.2.17)(react@18.2.0)
@@ -720,7 +775,7 @@ packages:
       react: 18.2.0
     dev: false
 
-  /@chakra-ui/popover@2.2.0(@chakra-ui/system@2.6.0)(framer-motion@10.15.0)(react@18.2.0):
+  /@chakra-ui/popover@2.2.0(@chakra-ui/system@2.6.0)(framer-motion@10.16.1)(react@18.2.0):
     resolution: {integrity: sha512-cTqXdgkU0vgK82AR1nWcC2MJYhEL/y6uTeprvO2+j4o2D0yPrzVMuIZZRl0abrQwiravQyVGEMgA5y0ZLYwbiQ==}
     peerDependencies:
       '@chakra-ui/system': '>=2.0.0'
@@ -739,7 +794,7 @@ packages:
       '@chakra-ui/react-use-merge-refs': 2.1.0(react@18.2.0)
       '@chakra-ui/shared-utils': 2.0.5
       '@chakra-ui/system': 2.6.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(react@18.2.0)
-      framer-motion: 10.15.0(react-dom@18.2.0)(react@18.2.0)
+      framer-motion: 10.16.1(react-dom@18.2.0)(react@18.2.0)
       react: 18.2.0
     dev: false
 
@@ -1007,7 +1062,7 @@ packages:
       react: 18.2.0
     dev: false
 
-  /@chakra-ui/react@2.8.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(@types/react@18.2.17)(framer-motion@10.15.0)(react-dom@18.2.0)(react@18.2.0):
+  /@chakra-ui/react@2.8.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(@types/react@18.2.17)(framer-motion@10.16.1)(react-dom@18.2.0)(react@18.2.0):
     resolution: {integrity: sha512-tV82DaqE4fMbLIWq58BYh4Ol3gAlNEn+qYOzx8bPrZudboEDnboq8aVfSBwWOY++MLWz2Nn7CkT69YRm91e5sg==}
     peerDependencies:
       '@emotion/react': ^11.0.0
@@ -1016,7 +1071,7 @@ packages:
       react: '>=18'
       react-dom: '>=18'
     dependencies:
-      '@chakra-ui/accordion': 2.3.0(@chakra-ui/system@2.6.0)(framer-motion@10.15.0)(react@18.2.0)
+      '@chakra-ui/accordion': 2.3.0(@chakra-ui/system@2.6.0)(framer-motion@10.16.1)(react@18.2.0)
       '@chakra-ui/alert': 2.2.0(@chakra-ui/system@2.6.0)(react@18.2.0)
       '@chakra-ui/avatar': 2.3.0(@chakra-ui/system@2.6.0)(react@18.2.0)
       '@chakra-ui/breadcrumb': 2.2.0(@chakra-ui/system@2.6.0)(react@18.2.0)
@@ -1037,11 +1092,11 @@ packages:
       '@chakra-ui/layout': 2.3.0(@chakra-ui/system@2.6.0)(react@18.2.0)
       '@chakra-ui/live-region': 2.1.0(react@18.2.0)
       '@chakra-ui/media-query': 3.3.0(@chakra-ui/system@2.6.0)(react@18.2.0)
-      '@chakra-ui/menu': 2.2.0(@chakra-ui/system@2.6.0)(framer-motion@10.15.0)(react@18.2.0)
-      '@chakra-ui/modal': 2.3.0(@chakra-ui/system@2.6.0)(@types/react@18.2.17)(framer-motion@10.15.0)(react-dom@18.2.0)(react@18.2.0)
+      '@chakra-ui/menu': 2.2.0(@chakra-ui/system@2.6.0)(framer-motion@10.16.1)(react@18.2.0)
+      '@chakra-ui/modal': 2.3.0(@chakra-ui/system@2.6.0)(@types/react@18.2.17)(framer-motion@10.16.1)(react-dom@18.2.0)(react@18.2.0)
       '@chakra-ui/number-input': 2.1.0(@chakra-ui/system@2.6.0)(react@18.2.0)
       '@chakra-ui/pin-input': 2.1.0(@chakra-ui/system@2.6.0)(react@18.2.0)
-      '@chakra-ui/popover': 2.2.0(@chakra-ui/system@2.6.0)(framer-motion@10.15.0)(react@18.2.0)
+      '@chakra-ui/popover': 2.2.0(@chakra-ui/system@2.6.0)(framer-motion@10.16.1)(react@18.2.0)
       '@chakra-ui/popper': 3.1.0(react@18.2.0)
       '@chakra-ui/portal': 2.1.0(react-dom@18.2.0)(react@18.2.0)
       '@chakra-ui/progress': 2.2.0(@chakra-ui/system@2.6.0)(react@18.2.0)
@@ -1056,7 +1111,7 @@ packages:
       '@chakra-ui/stat': 2.1.0(@chakra-ui/system@2.6.0)(react@18.2.0)
       '@chakra-ui/stepper': 2.3.0(@chakra-ui/system@2.6.0)(react@18.2.0)
       '@chakra-ui/styled-system': 2.9.1
-      '@chakra-ui/switch': 2.1.0(@chakra-ui/system@2.6.0)(framer-motion@10.15.0)(react@18.2.0)
+      '@chakra-ui/switch': 2.1.0(@chakra-ui/system@2.6.0)(framer-motion@10.16.1)(react@18.2.0)
       '@chakra-ui/system': 2.6.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(react@18.2.0)
       '@chakra-ui/table': 2.1.0(@chakra-ui/system@2.6.0)(react@18.2.0)
       '@chakra-ui/tabs': 2.2.0(@chakra-ui/system@2.6.0)(react@18.2.0)
@@ -1064,14 +1119,14 @@ packages:
       '@chakra-ui/textarea': 2.1.0(@chakra-ui/system@2.6.0)(react@18.2.0)
       '@chakra-ui/theme': 3.2.0(@chakra-ui/styled-system@2.9.1)
       '@chakra-ui/theme-utils': 2.0.19
-      '@chakra-ui/toast': 7.0.0(@chakra-ui/system@2.6.0)(framer-motion@10.15.0)(react-dom@18.2.0)(react@18.2.0)
-      '@chakra-ui/tooltip': 2.3.0(@chakra-ui/system@2.6.0)(framer-motion@10.15.0)(react-dom@18.2.0)(react@18.2.0)
-      '@chakra-ui/transition': 2.1.0(framer-motion@10.15.0)(react@18.2.0)
+      '@chakra-ui/toast': 7.0.0(@chakra-ui/system@2.6.0)(framer-motion@10.16.1)(react-dom@18.2.0)(react@18.2.0)
+      '@chakra-ui/tooltip': 2.3.0(@chakra-ui/system@2.6.0)(framer-motion@10.16.1)(react-dom@18.2.0)(react@18.2.0)
+      '@chakra-ui/transition': 2.1.0(framer-motion@10.16.1)(react@18.2.0)
       '@chakra-ui/utils': 2.0.15
       '@chakra-ui/visually-hidden': 2.1.0(@chakra-ui/system@2.6.0)(react@18.2.0)
       '@emotion/react': 11.11.1(@types/react@18.2.17)(react@18.2.0)
       '@emotion/styled': 11.11.0(@emotion/react@11.11.1)(@types/react@18.2.17)(react@18.2.0)
-      framer-motion: 10.15.0(react-dom@18.2.0)(react@18.2.0)
+      framer-motion: 10.16.1(react-dom@18.2.0)(react@18.2.0)
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
     transitivePeerDependencies:
@@ -1182,7 +1237,7 @@ packages:
       lodash.mergewith: 4.6.2
     dev: false
 
-  /@chakra-ui/switch@2.1.0(@chakra-ui/system@2.6.0)(framer-motion@10.15.0)(react@18.2.0):
+  /@chakra-ui/switch@2.1.0(@chakra-ui/system@2.6.0)(framer-motion@10.16.1)(react@18.2.0):
     resolution: {integrity: sha512-uWHOaIDQdGh+mszxeppj5aYVepbkSK445KZlJJkfr9Bnr6sythTwM63HSufnVDiTEE4uRqegv9jEjZK2JKA+9A==}
     peerDependencies:
       '@chakra-ui/system': '>=2.0.0'
@@ -1192,7 +1247,7 @@ packages:
       '@chakra-ui/checkbox': 2.3.0(@chakra-ui/system@2.6.0)(react@18.2.0)
       '@chakra-ui/shared-utils': 2.0.5
       '@chakra-ui/system': 2.6.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(react@18.2.0)
-      framer-motion: 10.15.0(react-dom@18.2.0)(react@18.2.0)
+      framer-motion: 10.16.1(react-dom@18.2.0)(react@18.2.0)
       react: 18.2.0
     dev: false
 
@@ -1301,7 +1356,7 @@ packages:
       '@chakra-ui/theme-tools': 2.1.0(@chakra-ui/styled-system@2.9.1)
     dev: false
 
-  /@chakra-ui/toast@7.0.0(@chakra-ui/system@2.6.0)(framer-motion@10.15.0)(react-dom@18.2.0)(react@18.2.0):
+  /@chakra-ui/toast@7.0.0(@chakra-ui/system@2.6.0)(framer-motion@10.16.1)(react-dom@18.2.0)(react@18.2.0):
     resolution: {integrity: sha512-XQgSnn4DYRgfOBzBvh8GI/AZ7SfrO8wlVSmChfp92Nfmqm7tRDUT9x8ws/iNKAvMRHkhl7fmRjJ39ipeXYrMvA==}
     peerDependencies:
       '@chakra-ui/system': 2.6.0
@@ -1319,12 +1374,12 @@ packages:
       '@chakra-ui/styled-system': 2.9.1
       '@chakra-ui/system': 2.6.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(react@18.2.0)
       '@chakra-ui/theme': 3.2.0(@chakra-ui/styled-system@2.9.1)
-      framer-motion: 10.15.0(react-dom@18.2.0)(react@18.2.0)
+      framer-motion: 10.16.1(react-dom@18.2.0)(react@18.2.0)
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
     dev: false
 
-  /@chakra-ui/tooltip@2.3.0(@chakra-ui/system@2.6.0)(framer-motion@10.15.0)(react-dom@18.2.0)(react@18.2.0):
+  /@chakra-ui/tooltip@2.3.0(@chakra-ui/system@2.6.0)(framer-motion@10.16.1)(react-dom@18.2.0)(react@18.2.0):
     resolution: {integrity: sha512-2s23f93YIij1qEDwIK//KtEu4LLYOslhR1cUhDBk/WUzyFR3Ez0Ee+HlqlGEGfGe9x77E6/UXPnSAKKdF/cpsg==}
     peerDependencies:
       '@chakra-ui/system': '>=2.0.0'
@@ -1341,19 +1396,19 @@ packages:
       '@chakra-ui/react-use-merge-refs': 2.1.0(react@18.2.0)
       '@chakra-ui/shared-utils': 2.0.5
       '@chakra-ui/system': 2.6.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(react@18.2.0)
-      framer-motion: 10.15.0(react-dom@18.2.0)(react@18.2.0)
+      framer-motion: 10.16.1(react-dom@18.2.0)(react@18.2.0)
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
     dev: false
 
-  /@chakra-ui/transition@2.1.0(framer-motion@10.15.0)(react@18.2.0):
+  /@chakra-ui/transition@2.1.0(framer-motion@10.16.1)(react@18.2.0):
     resolution: {integrity: sha512-orkT6T/Dt+/+kVwJNy7zwJ+U2xAZ3EU7M3XCs45RBvUnZDr/u9vdmaM/3D/rOpmQJWgQBwKPJleUXrYWUagEDQ==}
     peerDependencies:
       framer-motion: '>=4.0.0'
       react: '>=18'
     dependencies:
       '@chakra-ui/shared-utils': 2.0.5
-      framer-motion: 10.15.0(react-dom@18.2.0)(react@18.2.0)
+      framer-motion: 10.16.1(react-dom@18.2.0)(react@18.2.0)
       react: 18.2.0
     dev: false
 
@@ -1506,14 +1561,14 @@ packages:
     resolution: {integrity: sha512-EsBwpc7hBUJWAsNPBmJy4hxWx12v6bshQsldrVmjxJoc3isbxhOrF2IcCpaXxfvq03NwkI7sbsOLXbYuqF/8Ww==}
     dev: false
 
-  /@eslint-community/eslint-utils@4.4.0(eslint@8.46.0):
+  /@eslint-community/eslint-utils@4.4.0(eslint@8.50.0):
     resolution: {integrity: sha512-1/sA4dwrzBAyeUoQ6oxahHKmrZvsnLCg4RfxW3ZFGGmQkSNQPFNLV9CUEFQP1x9EYXHTo5p6xdhZM1Ne9p/AfA==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     peerDependencies:
       eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
     dependencies:
-      eslint: 8.46.0
-      eslint-visitor-keys: 3.4.2
+      eslint: 8.50.0
+      eslint-visitor-keys: 3.4.3
     dev: true
 
   /@eslint-community/regexpp@4.6.2:
@@ -1521,8 +1576,8 @@ packages:
     engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
     dev: true
 
-  /@eslint/eslintrc@2.1.1:
-    resolution: {integrity: sha512-9t7ZA7NGGK8ckelF0PQCfcxIUzs1Md5rrO6U/c+FIQNanea5UZC0wqKXH4vHBccmu4ZJgZ2idtPeW7+Q2npOEA==}
+  /@eslint/eslintrc@2.1.2:
+    resolution: {integrity: sha512-+wvgpDsrB1YqAMdEUCcnTlpfVBH7Vqn6A/NT3D8WVXFIaKMlErPIZT3oCIAVCOtarRpMtelZLqJeU3t7WY6X6g==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     dependencies:
       ajv: 6.12.6
@@ -1538,13 +1593,13 @@ packages:
       - supports-color
     dev: true
 
-  /@eslint/js@8.46.0:
-    resolution: {integrity: sha512-a8TLtmPi8xzPkCbp/OGFUo5yhRkHM2Ko9kOWP4znJr0WAhWyThaw3PnwX4vOTWOAMsV2uRt32PPDcEz63esSaA==}
+  /@eslint/js@8.50.0:
+    resolution: {integrity: sha512-NCC3zz2+nvYd+Ckfh87rA47zfu2QsQpvc6k1yzTk+b9KzRj0wkGa8LSoGOXN6Zv4lRf/EIoZ80biDh9HOI+RNQ==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     dev: true
 
-  /@humanwhocodes/config-array@0.11.10:
-    resolution: {integrity: sha512-KVVjQmNUepDVGXNuoRRdmmEjruj0KfiGSbS8LVc12LMsWDQzRXJ0qdhN8L8uUigKpfEHRhlaQFY0ib1tnUbNeQ==}
+  /@humanwhocodes/config-array@0.11.11:
+    resolution: {integrity: sha512-N2brEuAadi0CcdeMXUkhbZB84eskAc8MEX1By6qEchoVywSgXPIjou4rYsl0V3Hj0ZnuGycGCjdNgockbzeWNA==}
     engines: {node: '>=10.10.0'}
     dependencies:
       '@humanwhocodes/object-schema': 1.2.1
@@ -1591,18 +1646,18 @@ packages:
       '@jridgewell/resolve-uri': 3.1.0
       '@jridgewell/sourcemap-codec': 1.4.14
 
-  /@next/env@13.4.12:
-    resolution: {integrity: sha512-RmHanbV21saP/6OEPBJ7yJMuys68cIf8OBBWd7+uj40LdpmswVAwe1uzeuFyUsd6SfeITWT3XnQfn6wULeKwDQ==}
+  /@next/env@13.5.3:
+    resolution: {integrity: sha512-X4te86vsbjsB7iO4usY9jLPtZ827Mbx+WcwNBGUOIuswuTAKQtzsuoxc/6KLxCMvogKG795MhrR1LDhYgDvasg==}
     dev: false
 
-  /@next/eslint-plugin-next@13.4.10:
-    resolution: {integrity: sha512-YJqyq6vk39JQfvaNtN83t/p5Jy45+bazRL+V4QI8FPd3FBqFYMEsULiwRLgSJMgFqkk4t4JbeZurz+gILEAFpA==}
+  /@next/eslint-plugin-next@13.5.3:
+    resolution: {integrity: sha512-lbZOoEjzSuTtpk9UgV9rOmxYw+PsSfNR+00mZcInqooiDMZ1u+RqT1YQYLsEZPW1kumZoQe5+exkCBtZ2xn0uw==}
     dependencies:
       glob: 7.1.7
     dev: true
 
-  /@next/swc-darwin-arm64@13.4.12:
-    resolution: {integrity: sha512-deUrbCXTMZ6ZhbOoloqecnUeNpUOupi8SE2tx4jPfNS9uyUR9zK4iXBvH65opVcA/9F5I/p8vDXSYbUlbmBjZg==}
+  /@next/swc-darwin-arm64@13.5.3:
+    resolution: {integrity: sha512-6hiYNJxJmyYvvKGrVThzo4nTcqvqUTA/JvKim7Auaj33NexDqSNwN5YrrQu+QhZJCIpv2tULSHt+lf+rUflLSw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
@@ -1610,8 +1665,8 @@ packages:
     dev: false
     optional: true
 
-  /@next/swc-darwin-x64@13.4.12:
-    resolution: {integrity: sha512-WRvH7RxgRHlC1yb5oG0ZLx8F7uci9AivM5/HGGv9ZyG2Als8Ij64GC3d+mQ5sJhWjusyU6T6V1WKTUoTmOB0zQ==}
+  /@next/swc-darwin-x64@13.5.3:
+    resolution: {integrity: sha512-UpBKxu2ob9scbpJyEq/xPgpdrgBgN3aLYlxyGqlYX5/KnwpJpFuIHU2lx8upQQ7L+MEmz+fA1XSgesoK92ppwQ==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [darwin]
@@ -1619,8 +1674,8 @@ packages:
     dev: false
     optional: true
 
-  /@next/swc-linux-arm64-gnu@13.4.12:
-    resolution: {integrity: sha512-YEKracAWuxp54tKiAvvq73PUs9lok57cc8meYRibTWe/VdPB2vLgkTVWFcw31YDuRXdEhdX0fWS6Q+ESBhnEig==}
+  /@next/swc-linux-arm64-gnu@13.5.3:
+    resolution: {integrity: sha512-5AzM7Yx1Ky+oLY6pHs7tjONTF22JirDPd5Jw/3/NazJ73uGB05NqhGhB4SbeCchg7SlVYVBeRMrMSZwJwq/xoA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
@@ -1628,8 +1683,8 @@ packages:
     dev: false
     optional: true
 
-  /@next/swc-linux-arm64-musl@13.4.12:
-    resolution: {integrity: sha512-LhJR7/RAjdHJ2Isl2pgc/JaoxNk0KtBgkVpiDJPVExVWA1c6gzY57+3zWuxuyWzTG+fhLZo2Y80pLXgIJv7g3g==}
+  /@next/swc-linux-arm64-musl@13.5.3:
+    resolution: {integrity: sha512-A/C1shbyUhj7wRtokmn73eBksjTM7fFQoY2v/0rTM5wehpkjQRLOXI8WJsag2uLhnZ4ii5OzR1rFPwoD9cvOgA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
@@ -1637,8 +1692,8 @@ packages:
     dev: false
     optional: true
 
-  /@next/swc-linux-x64-gnu@13.4.12:
-    resolution: {integrity: sha512-1DWLL/B9nBNiQRng+1aqs3OaZcxC16Nf+mOnpcrZZSdyKHek3WQh6j/fkbukObgNGwmCoVevLUa/p3UFTTqgqg==}
+  /@next/swc-linux-x64-gnu@13.5.3:
+    resolution: {integrity: sha512-FubPuw/Boz8tKkk+5eOuDHOpk36F80rbgxlx4+xty/U71e3wZZxVYHfZXmf0IRToBn1Crb8WvLM9OYj/Ur815g==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
@@ -1646,8 +1701,8 @@ packages:
     dev: false
     optional: true
 
-  /@next/swc-linux-x64-musl@13.4.12:
-    resolution: {integrity: sha512-kEAJmgYFhp0VL+eRWmUkVxLVunn7oL9Mdue/FS8yzRBVj7Z0AnIrHpTIeIUl1bbdQq1VaoOztnKicAjfkLTRCQ==}
+  /@next/swc-linux-x64-musl@13.5.3:
+    resolution: {integrity: sha512-DPw8nFuM1uEpbX47tM3wiXIR0Qa+atSzs9Q3peY1urkhofx44o7E1svnq+a5Q0r8lAcssLrwiM+OyJJgV/oj7g==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
@@ -1655,8 +1710,8 @@ packages:
     dev: false
     optional: true
 
-  /@next/swc-win32-arm64-msvc@13.4.12:
-    resolution: {integrity: sha512-GMLuL/loR6yIIRTnPRY6UGbLL9MBdw2anxkOnANxvLvsml4F0HNIgvnU3Ej4BjbqMTNjD4hcPFdlEow4XHPdZA==}
+  /@next/swc-win32-arm64-msvc@13.5.3:
+    resolution: {integrity: sha512-zBPSP8cHL51Gub/YV8UUePW7AVGukp2D8JU93IHbVDu2qmhFAn9LWXiOOLKplZQKxnIPUkJTQAJDCWBWU4UWUA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
@@ -1664,8 +1719,8 @@ packages:
     dev: false
     optional: true
 
-  /@next/swc-win32-ia32-msvc@13.4.12:
-    resolution: {integrity: sha512-PhgNqN2Vnkm7XaMdRmmX0ZSwZXQAtamBVSa9A/V1dfKQCV1rjIZeiy/dbBnVYGdj63ANfsOR/30XpxP71W0eww==}
+  /@next/swc-win32-ia32-msvc@13.5.3:
+    resolution: {integrity: sha512-ONcL/lYyGUj4W37D4I2I450SZtSenmFAvapkJQNIJhrPMhzDU/AdfLkW98NvH1D2+7FXwe7yclf3+B7v28uzBQ==}
     engines: {node: '>= 10'}
     cpu: [ia32]
     os: [win32]
@@ -1673,8 +1728,8 @@ packages:
     dev: false
     optional: true
 
-  /@next/swc-win32-x64-msvc@13.4.12:
-    resolution: {integrity: sha512-Z+56e/Ljt0bUs+T+jPjhFyxYBcdY2RIq9ELFU+qAMQMteHo7ymbV7CKmlcX59RI9C4YzN8PgMgLyAoi916b5HA==}
+  /@next/swc-win32-x64-msvc@13.5.3:
+    resolution: {integrity: sha512-2Vz2tYWaLqJvLcWbbTlJ5k9AN6JD7a5CN2pAeIzpbecK8ZF/yobA39cXtv6e+Z8c5UJuVOmaTldEAIxvsIux/Q==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
@@ -1725,26 +1780,26 @@ packages:
     resolution: {integrity: sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A==}
     dev: false
 
-  /@react-native-community/eslint-config@3.2.0(eslint@8.46.0)(prettier@3.0.0)(typescript@5.1.6):
+  /@react-native-community/eslint-config@3.2.0(eslint@8.50.0)(prettier@3.0.0)(typescript@5.1.6):
     resolution: {integrity: sha512-ZjGvoeiBtCbd506hQqwjKmkWPgynGUoJspG8/MuV/EfKnkjCtBmeJvq2n+sWbWEvL9LWXDp2GJmPzmvU5RSvKQ==}
     peerDependencies:
       eslint: '>=8'
       prettier: '>=2'
     dependencies:
       '@babel/core': 7.22.9
-      '@babel/eslint-parser': 7.22.9(@babel/core@7.22.9)(eslint@8.46.0)
+      '@babel/eslint-parser': 7.22.9(@babel/core@7.22.9)(eslint@8.50.0)
       '@react-native-community/eslint-plugin': 1.3.0
-      '@typescript-eslint/eslint-plugin': 5.62.0(@typescript-eslint/parser@5.62.0)(eslint@8.46.0)(typescript@5.1.6)
-      '@typescript-eslint/parser': 5.62.0(eslint@8.46.0)(typescript@5.1.6)
-      eslint: 8.46.0
-      eslint-config-prettier: 8.9.0(eslint@8.46.0)
-      eslint-plugin-eslint-comments: 3.2.0(eslint@8.46.0)
-      eslint-plugin-ft-flow: 2.0.3(@babel/eslint-parser@7.22.9)(eslint@8.46.0)
-      eslint-plugin-jest: 26.9.0(@typescript-eslint/eslint-plugin@5.62.0)(eslint@8.46.0)(typescript@5.1.6)
-      eslint-plugin-prettier: 4.2.1(eslint-config-prettier@8.9.0)(eslint@8.46.0)(prettier@3.0.0)
-      eslint-plugin-react: 7.33.0(eslint@8.46.0)
-      eslint-plugin-react-hooks: 4.6.0(eslint@8.46.0)
-      eslint-plugin-react-native: 4.0.0(eslint@8.46.0)
+      '@typescript-eslint/eslint-plugin': 5.62.0(@typescript-eslint/parser@5.62.0)(eslint@8.50.0)(typescript@5.1.6)
+      '@typescript-eslint/parser': 5.62.0(eslint@8.50.0)(typescript@5.1.6)
+      eslint: 8.50.0
+      eslint-config-prettier: 8.9.0(eslint@8.50.0)
+      eslint-plugin-eslint-comments: 3.2.0(eslint@8.50.0)
+      eslint-plugin-ft-flow: 2.0.3(@babel/eslint-parser@7.22.9)(eslint@8.50.0)
+      eslint-plugin-jest: 26.9.0(@typescript-eslint/eslint-plugin@5.62.0)(eslint@8.50.0)(typescript@5.1.6)
+      eslint-plugin-prettier: 4.2.1(eslint-config-prettier@8.9.0)(eslint@8.50.0)(prettier@3.0.0)
+      eslint-plugin-react: 7.33.0(eslint@8.50.0)
+      eslint-plugin-react-hooks: 4.6.0(eslint@8.50.0)
+      eslint-plugin-react-native: 4.0.0(eslint@8.50.0)
       prettier: 3.0.0
     transitivePeerDependencies:
       - jest
@@ -1756,12 +1811,12 @@ packages:
     resolution: {integrity: sha512-+zDZ20NUnSWghj7Ku5aFphMzuM9JulqCW+aPXT6IfIXFbb8tzYTTOSeRFOtuekJ99ibW2fUCSsjuKNlwDIbHFg==}
     dev: true
 
-  /@rushstack/eslint-patch@1.3.2:
-    resolution: {integrity: sha512-V+MvGwaHH03hYhY+k6Ef/xKd6RYlc4q8WBx+2ANmipHJcKuktNcI/NgEsJgdSUF6Lw32njT6OnrRsKYCdgHjYw==}
+  /@rushstack/eslint-patch@1.5.1:
+    resolution: {integrity: sha512-6i/8UoL0P5y4leBIGzvkZdS85RDMG9y1ihZzmTZQ5LdHUYmZ7pKFoj8X0236s3lusPs1Fa5HTQUpwI+UfTcmeA==}
     dev: true
 
-  /@swc/helpers@0.5.1:
-    resolution: {integrity: sha512-sJ902EfIzn1Fa+qYmjdQqh8tPsoxyBz+8yBKC2HKUxyezKJFwPGOn7pv4WY6QuQW//ySQi5lJjA/ZT9sNWWNTg==}
+  /@swc/helpers@0.5.2:
+    resolution: {integrity: sha512-E4KcWTpoLHqwPHLxidpOqQbcrZVgi0rsmmZXUle1jXmJfuIf/UWpczUJ7MZZ5tlxytgJXyp0w4PGkkeLiuIdZw==}
     dependencies:
       tslib: 2.6.1
     dev: false
@@ -1806,8 +1861,8 @@ packages:
     resolution: {integrity: sha512-iiUgKzV9AuaEkZqkOLDIvlQiL6ltuZd9tGcW3gwpnX8JbuiuhFlEGmmFXEXkN50Cvq7Os88IY2v0dkDqXYWVgA==}
     dev: false
 
-  /@types/node@18.17.0:
-    resolution: {integrity: sha512-GXZxEtOxYGFchyUzxvKI14iff9KZ2DI+A6a37o6EQevtg6uO9t+aUZKcaC1Te5Ng1OnLM7K9NVVj+FbecD9cJg==}
+  /@types/node@18.18.1:
+    resolution: {integrity: sha512-3G42sxmm0fF2+Vtb9TJQpnjmP+uKlWvFa8KoEGquh4gqRmoUG/N0ufuhikw6HEsdG2G2oIKhog1GCTfz9v5NdQ==}
     dev: true
 
   /@types/parse-json@4.0.0:
@@ -1845,7 +1900,7 @@ packages:
     resolution: {integrity: sha512-cputDpIbFgLUaGQn6Vqg3/YsJwxUwHLO13v3i5ouxT4lat0khip9AEWxtERujXV9wxIB1EyF97BSJFt6vpdI8g==}
     dev: false
 
-  /@typescript-eslint/eslint-plugin@5.62.0(@typescript-eslint/parser@5.62.0)(eslint@8.46.0)(typescript@5.1.6):
+  /@typescript-eslint/eslint-plugin@5.62.0(@typescript-eslint/parser@5.62.0)(eslint@8.50.0)(typescript@5.1.6):
     resolution: {integrity: sha512-TiZzBSJja/LbhNPvk6yc0JrX9XqhQ0hdh6M2svYfsHGejaKFIAGd9MQ+ERIMzLGlN/kZoYIgdxFV0PuljTKXag==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     peerDependencies:
@@ -1857,12 +1912,12 @@ packages:
         optional: true
     dependencies:
       '@eslint-community/regexpp': 4.6.2
-      '@typescript-eslint/parser': 5.62.0(eslint@8.46.0)(typescript@5.1.6)
+      '@typescript-eslint/parser': 5.62.0(eslint@8.50.0)(typescript@5.1.6)
       '@typescript-eslint/scope-manager': 5.62.0
-      '@typescript-eslint/type-utils': 5.62.0(eslint@8.46.0)(typescript@5.1.6)
-      '@typescript-eslint/utils': 5.62.0(eslint@8.46.0)(typescript@5.1.6)
+      '@typescript-eslint/type-utils': 5.62.0(eslint@8.50.0)(typescript@5.1.6)
+      '@typescript-eslint/utils': 5.62.0(eslint@8.50.0)(typescript@5.1.6)
       debug: 4.3.4
-      eslint: 8.46.0
+      eslint: 8.50.0
       graphemer: 1.4.0
       ignore: 5.2.4
       natural-compare-lite: 1.4.0
@@ -1873,7 +1928,7 @@ packages:
       - supports-color
     dev: true
 
-  /@typescript-eslint/parser@5.62.0(eslint@8.46.0)(typescript@5.1.6):
+  /@typescript-eslint/parser@5.62.0(eslint@8.50.0)(typescript@5.1.6):
     resolution: {integrity: sha512-VlJEV0fOQ7BExOsHYAGrgbEiZoi8D+Bl2+f6V2RrXerRSylnp+ZBHmPvaIa8cz0Ajx7WO7Z5RqfgYg7ED1nRhA==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     peerDependencies:
@@ -1887,7 +1942,7 @@ packages:
       '@typescript-eslint/types': 5.62.0
       '@typescript-eslint/typescript-estree': 5.62.0(typescript@5.1.6)
       debug: 4.3.4
-      eslint: 8.46.0
+      eslint: 8.50.0
       typescript: 5.1.6
     transitivePeerDependencies:
       - supports-color
@@ -1901,7 +1956,7 @@ packages:
       '@typescript-eslint/visitor-keys': 5.62.0
     dev: true
 
-  /@typescript-eslint/type-utils@5.62.0(eslint@8.46.0)(typescript@5.1.6):
+  /@typescript-eslint/type-utils@5.62.0(eslint@8.50.0)(typescript@5.1.6):
     resolution: {integrity: sha512-xsSQreu+VnfbqQpW5vnCJdq1Z3Q0U31qiWmRhr98ONQmcp/yhiPJFPq8MXiJVLiksmOKSjIldZzkebzHuCGzew==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     peerDependencies:
@@ -1912,9 +1967,9 @@ packages:
         optional: true
     dependencies:
       '@typescript-eslint/typescript-estree': 5.62.0(typescript@5.1.6)
-      '@typescript-eslint/utils': 5.62.0(eslint@8.46.0)(typescript@5.1.6)
+      '@typescript-eslint/utils': 5.62.0(eslint@8.50.0)(typescript@5.1.6)
       debug: 4.3.4
-      eslint: 8.46.0
+      eslint: 8.50.0
       tsutils: 3.21.0(typescript@5.1.6)
       typescript: 5.1.6
     transitivePeerDependencies:
@@ -1947,19 +2002,19 @@ packages:
       - supports-color
     dev: true
 
-  /@typescript-eslint/utils@5.62.0(eslint@8.46.0)(typescript@5.1.6):
+  /@typescript-eslint/utils@5.62.0(eslint@8.50.0)(typescript@5.1.6):
     resolution: {integrity: sha512-n8oxjeb5aIbPFEtmQxQYOLI0i9n5ySBEY/ZEHHZqKQSFnxio1rv6dthascc9dLuwrL0RC5mPCxB7vnAVGAYWAQ==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     peerDependencies:
       eslint: ^6.0.0 || ^7.0.0 || ^8.0.0
     dependencies:
-      '@eslint-community/eslint-utils': 4.4.0(eslint@8.46.0)
+      '@eslint-community/eslint-utils': 4.4.0(eslint@8.50.0)
       '@types/json-schema': 7.0.12
       '@types/semver': 7.5.0
       '@typescript-eslint/scope-manager': 5.62.0
       '@typescript-eslint/types': 5.62.0
       '@typescript-eslint/typescript-estree': 5.62.0(typescript@5.1.6)
-      eslint: 8.46.0
+      eslint: 8.50.0
       eslint-scope: 5.1.1
       semver: 7.5.4
     transitivePeerDependencies:
@@ -1972,7 +2027,7 @@ packages:
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     dependencies:
       '@typescript-eslint/types': 5.62.0
-      eslint-visitor-keys: 3.4.2
+      eslint-visitor-keys: 3.4.3
     dev: true
 
   /@zag-js/dom-query@0.10.5:
@@ -2046,11 +2101,27 @@ packages:
       readable-stream: 2.3.8
     dev: false
 
-  /archiver@5.3.1:
-    resolution: {integrity: sha512-8KyabkmbYrH+9ibcTScQ1xCJC/CGcugdVIwB+53f5sZziXgwUh3iXlAlANMxcZyDEfTHMe6+Z5FofV8nopXP7w==}
+  /archiver-utils@3.0.3:
+    resolution: {integrity: sha512-fXzpEZTKgBJMWy0eUT0/332CAQnJ27OJd7sGcvNZzxS2Yzg7iITivMhXOm+zUTO4vT8ZqlPCqiaLPmB8qWhWRA==}
     engines: {node: '>= 10'}
     dependencies:
-      archiver-utils: 2.1.0
+      glob: 7.2.3
+      graceful-fs: 4.2.11
+      lazystream: 1.0.1
+      lodash.defaults: 4.2.0
+      lodash.difference: 4.5.0
+      lodash.flatten: 4.4.0
+      lodash.isplainobject: 4.0.6
+      lodash.union: 4.6.0
+      normalize-path: 3.0.0
+      readable-stream: 3.6.2
+    dev: false
+
+  /archiver@6.0.0:
+    resolution: {integrity: sha512-EPGa+bYaxaMiCT8DCbEDqFz8IjeBSExrJzyUOJx2FBkFJ/OZzJuso3lMSk901M50gMqXxTQcumlGajOFlXhVhw==}
+    engines: {node: '>= 12.0.0'}
+    dependencies:
+      archiver-utils: 3.0.3
       async: 3.2.4
       buffer-crc32: 0.2.13
       readable-stream: 3.6.2
@@ -2105,6 +2176,17 @@ packages:
     engines: {node: '>=8'}
     dev: true
 
+  /array.prototype.findlastindex@1.2.3:
+    resolution: {integrity: sha512-LzLoiOMAxvy+Gd3BAq3B7VeIgPdo+Q8hthvKtXybMvRV0jrXfJM/t8mw7nNlpEcVlVUnCnM2KSX4XU5HmpodOA==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      call-bind: 1.0.2
+      define-properties: 1.2.0
+      es-abstract: 1.22.1
+      es-shim-unscopables: 1.0.0
+      get-intrinsic: 1.2.1
+    dev: true
+
   /array.prototype.flat@1.3.1:
     resolution: {integrity: sha512-roTU0KWIOmJ4DRLmwKd19Otg0/mT3qPNt0Qb3GWW8iObuZXxrjB/pzn0R3hqpRSWg4HCwqx+0vwOnWnvlOyeIA==}
     engines: {node: '>= 0.4'}
@@ -2155,6 +2237,12 @@ packages:
     resolution: {integrity: sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ==}
     dev: false
 
+  /asynciterator.prototype@1.0.0:
+    resolution: {integrity: sha512-wwHYEIS0Q80f5mosx3L/dfG5t5rjEa9Ft51GTaNt862EnpyGHpgz2RkZvLPp1oF5TnAiTohkEKVEu8pQPJI7Vg==}
+    dependencies:
+      has-symbols: 1.0.3
+    dev: true
+
   /available-typed-arrays@1.0.5:
     resolution: {integrity: sha512-DMD0KiN46eipeziST1LPP/STfDU0sufISXmjSgvVsoU2tqxctQeASejWcfNtxYKqETM1UxQ8sp2OrSBWpHY6sw==}
     engines: {node: '>= 0.4'}
@@ -2461,6 +2549,15 @@ packages:
       titleize: 3.0.0
     dev: true
 
+  /define-data-property@1.1.0:
+    resolution: {integrity: sha512-UzGwzcjyv3OtAvolTj1GoyNYzfFR+iqbGjcnBEENZVCpM4/Ng1yhGNvS3lR/xDS74Tb2wGG9WzNSNIOS9UVb2g==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      get-intrinsic: 1.2.1
+      gopd: 1.0.1
+      has-property-descriptors: 1.0.0
+    dev: true
+
   /define-lazy-prop@3.0.0:
     resolution: {integrity: sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg==}
     engines: {node: '>=12'}
@@ -2474,6 +2571,15 @@ packages:
       object-keys: 1.1.1
     dev: true
 
+  /define-properties@1.2.1:
+    resolution: {integrity: sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      define-data-property: 1.1.0
+      has-property-descriptors: 1.0.0
+      object-keys: 1.1.1
+    dev: true
+
   /dequal@2.0.3:
     resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
     engines: {node: '>=6'}
@@ -2580,6 +2686,25 @@ packages:
       which-typed-array: 1.1.11
     dev: true
 
+  /es-iterator-helpers@1.0.15:
+    resolution: {integrity: sha512-GhoY8uYqd6iwUl2kgjTm4CZAf6oo5mHK7BPqx3rKgx893YSsy0LGHV6gfqqQvZt/8xM8xeOnfXBCfqclMKkJ5g==}
+    dependencies:
+      asynciterator.prototype: 1.0.0
+      call-bind: 1.0.2
+      define-properties: 1.2.1
+      es-abstract: 1.22.1
+      es-set-tostringtag: 2.0.1
+      function-bind: 1.1.1
+      get-intrinsic: 1.2.1
+      globalthis: 1.0.3
+      has-property-descriptors: 1.0.0
+      has-proto: 1.0.1
+      has-symbols: 1.0.3
+      internal-slot: 1.0.5
+      iterator.prototype: 1.1.2
+      safe-array-concat: 1.0.1
+    dev: true
+
   /es-set-tostringtag@2.0.1:
     resolution: {integrity: sha512-g3OMbtlwY3QewlqAiMLI47KywjWZoEytKr8pf6iTC8uJq5bIAH52Z9pnQ8pVL6whrCto53JZDuUIsifGeLorTg==}
     engines: {node: '>= 0.4'}
@@ -2621,8 +2746,8 @@ packages:
     engines: {node: '>=12'}
     dev: false
 
-  /eslint-config-next@13.4.10(eslint@8.46.0)(typescript@5.1.6):
-    resolution: {integrity: sha512-+JjcM6lQmFR5Mw0ORm9o1CR29+z/uajgSfYAPEGIBxOhTHBgCMs7ysuwi72o7LkMmA8E3N7/h09pSGZxs0s85g==}
+  /eslint-config-next@13.5.3(eslint@8.50.0)(typescript@5.1.6):
+    resolution: {integrity: sha512-VN2qbCpq2DMWgs7SVF8KTmc8bVaWz3s4nmcFqRLs7PNBt5AXejOhJuZ4zg2sCEHOvz5RvqdwLeI++NSCV6qHVg==}
     peerDependencies:
       eslint: ^7.23.0 || ^8.0.0
       typescript: '>=3.3.1'
@@ -2630,29 +2755,29 @@ packages:
       typescript:
         optional: true
     dependencies:
-      '@next/eslint-plugin-next': 13.4.10
-      '@rushstack/eslint-patch': 1.3.2
-      '@typescript-eslint/parser': 5.62.0(eslint@8.46.0)(typescript@5.1.6)
-      eslint: 8.46.0
+      '@next/eslint-plugin-next': 13.5.3
+      '@rushstack/eslint-patch': 1.5.1
+      '@typescript-eslint/parser': 5.62.0(eslint@8.50.0)(typescript@5.1.6)
+      eslint: 8.50.0
       eslint-import-resolver-node: 0.3.7
-      eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-node@0.3.7)(eslint-plugin-import@2.27.5)(eslint@8.46.0)
-      eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.46.0)
-      eslint-plugin-jsx-a11y: 6.7.1(eslint@8.46.0)
-      eslint-plugin-react: 7.33.0(eslint@8.46.0)
-      eslint-plugin-react-hooks: 5.0.0-canary-7118f5dd7-20230705(eslint@8.46.0)
+      eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-node@0.3.7)(eslint-plugin-import@2.28.1)(eslint@8.50.0)
+      eslint-plugin-import: 2.28.1(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.50.0)
+      eslint-plugin-jsx-a11y: 6.7.1(eslint@8.50.0)
+      eslint-plugin-react: 7.33.2(eslint@8.50.0)
+      eslint-plugin-react-hooks: 4.6.0(eslint@8.50.0)
       typescript: 5.1.6
     transitivePeerDependencies:
       - eslint-import-resolver-webpack
       - supports-color
     dev: true
 
-  /eslint-config-prettier@8.9.0(eslint@8.46.0):
+  /eslint-config-prettier@8.9.0(eslint@8.50.0):
     resolution: {integrity: sha512-+sbni7NfVXnOpnRadUA8S28AUlsZt9GjgFvABIRL9Hkn8KqNzOp+7Lw4QWtrwn20KzU3wqu1QoOj2m+7rKRqkA==}
     hasBin: true
     peerDependencies:
       eslint: '>=7.0.0'
     dependencies:
-      eslint: 8.46.0
+      eslint: 8.50.0
     dev: true
 
   /eslint-import-resolver-node@0.3.7:
@@ -2665,7 +2790,7 @@ packages:
       - supports-color
     dev: true
 
-  /eslint-import-resolver-typescript@3.5.5(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-node@0.3.7)(eslint-plugin-import@2.27.5)(eslint@8.46.0):
+  /eslint-import-resolver-typescript@3.5.5(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-node@0.3.7)(eslint-plugin-import@2.28.1)(eslint@8.50.0):
     resolution: {integrity: sha512-TdJqPHs2lW5J9Zpe17DZNQuDnox4xo2o+0tE7Pggain9Rbc19ik8kFtXdxZ250FVx2kF4vlt2RSf4qlUpG7bhw==}
     engines: {node: ^14.18.0 || >=16.0.0}
     peerDependencies:
@@ -2674,9 +2799,9 @@ packages:
     dependencies:
       debug: 4.3.4
       enhanced-resolve: 5.15.0
-      eslint: 8.46.0
-      eslint-module-utils: 2.8.0(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.46.0)
-      eslint-plugin-import: 2.27.5(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.46.0)
+      eslint: 8.50.0
+      eslint-module-utils: 2.8.0(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.50.0)
+      eslint-plugin-import: 2.28.1(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.50.0)
       get-tsconfig: 4.6.2
       globby: 13.2.2
       is-core-module: 2.12.1
@@ -2689,7 +2814,7 @@ packages:
       - supports-color
     dev: true
 
-  /eslint-module-utils@2.8.0(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.46.0):
+  /eslint-module-utils@2.8.0(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.50.0):
     resolution: {integrity: sha512-aWajIYfsqCKRDgUfjEXNN/JlrzauMuSEy5sbd7WXbtW3EH6A6MpwEh42c7qD+MqQo9QMJ6fWLAeIJynx0g6OAw==}
     engines: {node: '>=4'}
     peerDependencies:
@@ -2710,41 +2835,41 @@ packages:
       eslint-import-resolver-webpack:
         optional: true
     dependencies:
-      '@typescript-eslint/parser': 5.62.0(eslint@8.46.0)(typescript@5.1.6)
+      '@typescript-eslint/parser': 5.62.0(eslint@8.50.0)(typescript@5.1.6)
       debug: 3.2.7
-      eslint: 8.46.0
+      eslint: 8.50.0
       eslint-import-resolver-node: 0.3.7
-      eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-node@0.3.7)(eslint-plugin-import@2.27.5)(eslint@8.46.0)
+      eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-node@0.3.7)(eslint-plugin-import@2.28.1)(eslint@8.50.0)
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /eslint-plugin-eslint-comments@3.2.0(eslint@8.46.0):
+  /eslint-plugin-eslint-comments@3.2.0(eslint@8.50.0):
     resolution: {integrity: sha512-0jkOl0hfojIHHmEHgmNdqv4fmh7300NdpA9FFpF7zaoLvB/QeXOGNLIo86oAveJFrfB1p05kC8hpEMHM8DwWVQ==}
     engines: {node: '>=6.5.0'}
     peerDependencies:
       eslint: '>=4.19.1'
     dependencies:
       escape-string-regexp: 1.0.5
-      eslint: 8.46.0
+      eslint: 8.50.0
       ignore: 5.2.4
     dev: true
 
-  /eslint-plugin-ft-flow@2.0.3(@babel/eslint-parser@7.22.9)(eslint@8.46.0):
+  /eslint-plugin-ft-flow@2.0.3(@babel/eslint-parser@7.22.9)(eslint@8.50.0):
     resolution: {integrity: sha512-Vbsd/b+LYA99jUbsL6viEUWShFaYQt2YQs3QN3f+aeszOhh2sgdcU0mjzDyD4yyBvMc8qy2uwvBBWfMzEX06tg==}
     engines: {node: '>=12.22.0'}
     peerDependencies:
       '@babel/eslint-parser': ^7.12.0
       eslint: ^8.1.0
     dependencies:
-      '@babel/eslint-parser': 7.22.9(@babel/core@7.22.9)(eslint@8.46.0)
-      eslint: 8.46.0
+      '@babel/eslint-parser': 7.22.9(@babel/core@7.22.9)(eslint@8.50.0)
+      eslint: 8.50.0
       lodash: 4.17.21
       string-natural-compare: 3.0.1
     dev: true
 
-  /eslint-plugin-import@2.27.5(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.46.0):
-    resolution: {integrity: sha512-LmEt3GVofgiGuiE+ORpnvP+kAm3h6MLZJ4Q5HCyHADofsb4VzXFsRiWj3c0OFiV+3DWFh0qg3v9gcPlfc3zRow==}
+  /eslint-plugin-import@2.28.1(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-typescript@3.5.5)(eslint@8.50.0):
+    resolution: {integrity: sha512-9I9hFlITvOV55alzoKBI+K9q74kv0iKMeY6av5+umsNwayt59fz692daGyjR+oStBQgx6nwR9rXldDev3Clw+A==}
     engines: {node: '>=4'}
     peerDependencies:
       '@typescript-eslint/parser': '*'
@@ -2753,21 +2878,23 @@ packages:
       '@typescript-eslint/parser':
         optional: true
     dependencies:
-      '@typescript-eslint/parser': 5.62.0(eslint@8.46.0)(typescript@5.1.6)
+      '@typescript-eslint/parser': 5.62.0(eslint@8.50.0)(typescript@5.1.6)
       array-includes: 3.1.6
+      array.prototype.findlastindex: 1.2.3
       array.prototype.flat: 1.3.1
       array.prototype.flatmap: 1.3.1
       debug: 3.2.7
       doctrine: 2.1.0
-      eslint: 8.46.0
+      eslint: 8.50.0
       eslint-import-resolver-node: 0.3.7
-      eslint-module-utils: 2.8.0(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.46.0)
+      eslint-module-utils: 2.8.0(@typescript-eslint/parser@5.62.0)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.50.0)
       has: 1.0.3
-      is-core-module: 2.12.1
+      is-core-module: 2.13.0
       is-glob: 4.0.3
       minimatch: 3.1.2
+      object.fromentries: 2.0.6
+      object.groupby: 1.0.1
       object.values: 1.1.6
-      resolve: 1.22.2
       semver: 6.3.1
       tsconfig-paths: 3.14.2
     transitivePeerDependencies:
@@ -2776,7 +2903,7 @@ packages:
       - supports-color
     dev: true
 
-  /eslint-plugin-jest@26.9.0(@typescript-eslint/eslint-plugin@5.62.0)(eslint@8.46.0)(typescript@5.1.6):
+  /eslint-plugin-jest@26.9.0(@typescript-eslint/eslint-plugin@5.62.0)(eslint@8.50.0)(typescript@5.1.6):
     resolution: {integrity: sha512-TWJxWGp1J628gxh2KhaH1H1paEdgE2J61BBF1I59c6xWeL5+D1BzMxGDN/nXAfX+aSkR5u80K+XhskK6Gwq9ng==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     peerDependencies:
@@ -2789,15 +2916,15 @@ packages:
       jest:
         optional: true
     dependencies:
-      '@typescript-eslint/eslint-plugin': 5.62.0(@typescript-eslint/parser@5.62.0)(eslint@8.46.0)(typescript@5.1.6)
-      '@typescript-eslint/utils': 5.62.0(eslint@8.46.0)(typescript@5.1.6)
-      eslint: 8.46.0
+      '@typescript-eslint/eslint-plugin': 5.62.0(@typescript-eslint/parser@5.62.0)(eslint@8.50.0)(typescript@5.1.6)
+      '@typescript-eslint/utils': 5.62.0(eslint@8.50.0)(typescript@5.1.6)
+      eslint: 8.50.0
     transitivePeerDependencies:
       - supports-color
       - typescript
     dev: true
 
-  /eslint-plugin-jsx-a11y@6.7.1(eslint@8.46.0):
+  /eslint-plugin-jsx-a11y@6.7.1(eslint@8.50.0):
     resolution: {integrity: sha512-63Bog4iIethyo8smBklORknVjB0T2dwB8Mr/hIC+fBS0uyHdYYpzM/Ed+YC8VxTjlXHEWFOdmgwcDn1U2L9VCA==}
     engines: {node: '>=4.0'}
     peerDependencies:
@@ -2812,7 +2939,7 @@ packages:
       axobject-query: 3.2.1
       damerau-levenshtein: 1.0.8
       emoji-regex: 9.2.2
-      eslint: 8.46.0
+      eslint: 8.50.0
       has: 1.0.3
       jsx-ast-utils: 3.3.4
       language-tags: 1.0.5
@@ -2822,7 +2949,7 @@ packages:
       semver: 6.3.1
     dev: true
 
-  /eslint-plugin-prettier@4.2.1(eslint-config-prettier@8.9.0)(eslint@8.46.0)(prettier@3.0.0):
+  /eslint-plugin-prettier@4.2.1(eslint-config-prettier@8.9.0)(eslint@8.50.0)(prettier@3.0.0):
     resolution: {integrity: sha512-f/0rXLXUt0oFYs8ra4w49wYZBG5GKZpAYsJSm6rnYL5uVDjd+zowwMwVZHnAjf4edNrKpCDYfXDgmRE/Ak7QyQ==}
     engines: {node: '>=12.0.0'}
     peerDependencies:
@@ -2833,47 +2960,38 @@ packages:
       eslint-config-prettier:
         optional: true
     dependencies:
-      eslint: 8.46.0
-      eslint-config-prettier: 8.9.0(eslint@8.46.0)
+      eslint: 8.50.0
+      eslint-config-prettier: 8.9.0(eslint@8.50.0)
       prettier: 3.0.0
       prettier-linter-helpers: 1.0.0
     dev: true
 
-  /eslint-plugin-react-hooks@4.6.0(eslint@8.46.0):
+  /eslint-plugin-react-hooks@4.6.0(eslint@8.50.0):
     resolution: {integrity: sha512-oFc7Itz9Qxh2x4gNHStv3BqJq54ExXmfC+a1NjAta66IAN87Wu0R/QArgIS9qKzX3dXKPI9H5crl9QchNMY9+g==}
     engines: {node: '>=10'}
     peerDependencies:
       eslint: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0
     dependencies:
-      eslint: 8.46.0
-    dev: true
-
-  /eslint-plugin-react-hooks@5.0.0-canary-7118f5dd7-20230705(eslint@8.46.0):
-    resolution: {integrity: sha512-AZYbMo/NW9chdL7vk6HQzQhT+PvTAEVqWk9ziruUoW2kAOcN5qNyelv70e0F1VNQAbvutOC9oc+xfWycI9FxDw==}
-    engines: {node: '>=10'}
-    peerDependencies:
-      eslint: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0
-    dependencies:
-      eslint: 8.46.0
+      eslint: 8.50.0
     dev: true
 
   /eslint-plugin-react-native-globals@0.1.2:
     resolution: {integrity: sha512-9aEPf1JEpiTjcFAmmyw8eiIXmcNZOqaZyHO77wgm0/dWfT/oxC1SrIq8ET38pMxHYrcB6Uew+TzUVsBeczF88g==}
     dev: true
 
-  /eslint-plugin-react-native@4.0.0(eslint@8.46.0):
+  /eslint-plugin-react-native@4.0.0(eslint@8.50.0):
     resolution: {integrity: sha512-kMmdxrSY7A1WgdqaGC+rY/28rh7kBGNBRsk48ovqkQmdg5j4K+DaFmegENDzMrdLkoufKGRNkKX6bgSwQTCAxQ==}
     peerDependencies:
       eslint: ^3.17.0 || ^4 || ^5 || ^6 || ^7 || ^8
     dependencies:
-      '@babel/traverse': 7.22.8
-      eslint: 8.46.0
+      '@babel/traverse': 7.23.2
+      eslint: 8.50.0
       eslint-plugin-react-native-globals: 0.1.2
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /eslint-plugin-react@7.33.0(eslint@8.46.0):
+  /eslint-plugin-react@7.33.0(eslint@8.50.0):
     resolution: {integrity: sha512-qewL/8P34WkY8jAqdQxsiL82pDUeT7nhs8IsuXgfgnsEloKCT4miAV9N9kGtx7/KM9NH/NCGUE7Edt9iGxLXFw==}
     engines: {node: '>=4'}
     peerDependencies:
@@ -2883,7 +3001,32 @@ packages:
       array.prototype.flatmap: 1.3.1
       array.prototype.tosorted: 1.1.1
       doctrine: 2.1.0
-      eslint: 8.46.0
+      eslint: 8.50.0
+      estraverse: 5.3.0
+      jsx-ast-utils: 3.3.4
+      minimatch: 3.1.2
+      object.entries: 1.1.6
+      object.fromentries: 2.0.6
+      object.hasown: 1.1.2
+      object.values: 1.1.6
+      prop-types: 15.8.1
+      resolve: 2.0.0-next.4
+      semver: 6.3.1
+      string.prototype.matchall: 4.0.8
+    dev: true
+
+  /eslint-plugin-react@7.33.2(eslint@8.50.0):
+    resolution: {integrity: sha512-73QQMKALArI8/7xGLNI/3LylrEYrlKZSb5C9+q3OtOewTnMQi5cT+aE9E41sLCmli3I9PGGmD1yiZydyo4FEPw==}
+    engines: {node: '>=4'}
+    peerDependencies:
+      eslint: ^3 || ^4 || ^5 || ^6 || ^7 || ^8
+    dependencies:
+      array-includes: 3.1.6
+      array.prototype.flatmap: 1.3.1
+      array.prototype.tosorted: 1.1.1
+      doctrine: 2.1.0
+      es-iterator-helpers: 1.0.15
+      eslint: 8.50.0
       estraverse: 5.3.0
       jsx-ast-utils: 3.3.4
       minimatch: 3.1.2
@@ -2918,21 +3061,21 @@ packages:
     engines: {node: '>=10'}
     dev: true
 
-  /eslint-visitor-keys@3.4.2:
-    resolution: {integrity: sha512-8drBzUEyZ2llkpCA67iYrgEssKDUu68V8ChqqOfFupIaG/LCVPUT+CoGJpT77zJprs4T/W7p07LP7zAIMuweVw==}
+  /eslint-visitor-keys@3.4.3:
+    resolution: {integrity: sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     dev: true
 
-  /eslint@8.46.0:
-    resolution: {integrity: sha512-cIO74PvbW0qU8e0mIvk5IV3ToWdCq5FYG6gWPHHkx6gNdjlbAYvtfHmlCMXxjcoVaIdwy/IAt3+mDkZkfvb2Dg==}
+  /eslint@8.50.0:
+    resolution: {integrity: sha512-FOnOGSuFuFLv/Sa+FDVRZl4GGVAAFFi8LecRsI5a1tMO5HIE8nCm4ivAlzt4dT3ol/PaaGC0rJEEXQmHJBGoOg==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     hasBin: true
     dependencies:
-      '@eslint-community/eslint-utils': 4.4.0(eslint@8.46.0)
+      '@eslint-community/eslint-utils': 4.4.0(eslint@8.50.0)
       '@eslint-community/regexpp': 4.6.2
-      '@eslint/eslintrc': 2.1.1
-      '@eslint/js': 8.46.0
-      '@humanwhocodes/config-array': 0.11.10
+      '@eslint/eslintrc': 2.1.2
+      '@eslint/js': 8.50.0
+      '@humanwhocodes/config-array': 0.11.11
       '@humanwhocodes/module-importer': 1.0.1
       '@nodelib/fs.walk': 1.2.8
       ajv: 6.12.6
@@ -2942,7 +3085,7 @@ packages:
       doctrine: 3.0.0
       escape-string-regexp: 4.0.0
       eslint-scope: 7.2.2
-      eslint-visitor-keys: 3.4.2
+      eslint-visitor-keys: 3.4.3
       espree: 9.6.1
       esquery: 1.5.0
       esutils: 2.0.3
@@ -2975,7 +3118,7 @@ packages:
     dependencies:
       acorn: 8.10.0
       acorn-jsx: 5.3.2(acorn@8.10.0)
-      eslint-visitor-keys: 3.4.2
+      eslint-visitor-keys: 3.4.3
     dev: true
 
   /esprima@4.0.1:
@@ -3131,8 +3274,8 @@ packages:
       is-callable: 1.2.7
     dev: true
 
-  /framer-motion@10.15.0(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-HDjWrYWgbO5orKuhnXETLFzk7UUvwWur2HFs2elAZ8lVpI49ClHql31DNTVvVBcOrSHfAOS4eBDBedIvOx634w==}
+  /framer-motion@10.16.1(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-K6TXr5mZtitC/dxQCBdg7xzdN0d5IAIrlaqCPKtIQVdzVPGC0qBuJKXggHX1vjnP5gPOFwB1KbCCTWcnFc3kWg==}
     peerDependencies:
       react: ^18.0.0
       react-dom: ^18.0.0
@@ -3285,7 +3428,7 @@ packages:
     resolution: {integrity: sha512-sFdI5LyBiNTHjRd7cGPWapiHWMOXKyuBNX/cWJ3NfzrZQVa8GI/8cofCl74AOVqq9W5kNmguTIzJ/1s2gyI9wA==}
     engines: {node: '>= 0.4'}
     dependencies:
-      define-properties: 1.2.0
+      define-properties: 1.2.1
     dev: true
 
   /globby@11.1.0:
@@ -3506,6 +3649,13 @@ packages:
     resolution: {integrity: sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==}
     dev: false
 
+  /is-async-function@2.0.0:
+    resolution: {integrity: sha512-Y1JXKrfykRJGdlDwdKlLpLyMIiWqWvuSd17TvZk68PLAOGOoF4Xyav1z0Xhoi+gCYjZVeC5SI+hYFOfvXmGRCA==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      has-tostringtag: 1.0.0
+    dev: true
+
   /is-bigint@1.0.4:
     resolution: {integrity: sha512-zB9CruMamjym81i2JZ3UMn54PKGsQzsJeo6xvN3HJJ4CAsQNB6iRutp2To77OfCNuoxspsIhzaPoO1zyCEhFOg==}
     dependencies:
@@ -3535,6 +3685,12 @@ packages:
     dependencies:
       has: 1.0.3
 
+  /is-core-module@2.13.0:
+    resolution: {integrity: sha512-Z7dk6Qo8pOCp3l4tsX2C5ZVas4V+UxwQodwZhLopL91TX8UyyHEXafPcyoeeWuLrwzHcr3igO78wNLwHJHsMCQ==}
+    dependencies:
+      has: 1.0.3
+    dev: true
+
   /is-date-object@1.0.5:
     resolution: {integrity: sha512-9YQaSxsAiSwcvS33MBk3wTCVnWK+HhF8VZR2jRxehM16QcVOdHqPn4VPHmRK4lSr38n9JriurInLcP90xsYNfQ==}
     engines: {node: '>= 0.4'}
@@ -3559,6 +3715,19 @@ packages:
     engines: {node: '>=0.10.0'}
     dev: true
 
+  /is-finalizationregistry@1.0.2:
+    resolution: {integrity: sha512-0by5vtUJs8iFQb5TYUHHPudOR+qXYIMKtiUzvLIZITZUjknFmziyBJuLhVRc+Ds0dREFlskDNJKYIdIzu/9pfw==}
+    dependencies:
+      call-bind: 1.0.2
+    dev: true
+
+  /is-generator-function@1.0.10:
+    resolution: {integrity: sha512-jsEjy9l3yiXEQ+PsXdmBwEPcOxaXWLspKdplFUVI9vq1iZgIekeC0L167qeu86czQaxed3q/Uzuw0swL0irL8A==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      has-tostringtag: 1.0.0
+    dev: true
+
   /is-glob@4.0.3:
     resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
     engines: {node: '>=0.10.0'}
@@ -3574,6 +3743,10 @@ packages:
       is-docker: 3.0.0
     dev: true
 
+  /is-map@2.0.2:
+    resolution: {integrity: sha512-cOZFQQozTha1f4MxLFzlgKYPTyj26picdZTx82hbc/Xf4K/tZOOXSCkMvU4pKioRXGDLJRn0GM7Upe7kR721yg==}
+    dev: true
+
   /is-negative-zero@2.0.2:
     resolution: {integrity: sha512-dqJvarLawXsFbNDeJW7zAz8ItJ9cd28YufuuFzh0G8pNHjJMnY08Dv7sYX2uF5UpQOwieAeOExEYAWWfu7ZZUA==}
     engines: {node: '>= 0.4'}
@@ -3609,6 +3782,10 @@ packages:
       has-tostringtag: 1.0.0
     dev: true
 
+  /is-set@2.0.2:
+    resolution: {integrity: sha512-+2cnTEZeY5z/iXGbLhPrOAaK/Mau5k5eXq9j14CpRTftq0pAJu2MwVRSZhyZWBzx3o6X795Lz6Bpb6R0GKf37g==}
+    dev: true
+
   /is-shared-array-buffer@1.0.2:
     resolution: {integrity: sha512-sqN2UDu1/0y6uvXyStCOzyhAjCSlHceFoMKJW8W9EU9cvic/QdsZ0kEU93HEy3IUEFZIiH/3w+AH/UQbPHNdhA==}
     dependencies:
@@ -3646,12 +3823,23 @@ packages:
       which-typed-array: 1.1.11
     dev: true
 
+  /is-weakmap@2.0.1:
+    resolution: {integrity: sha512-NSBR4kH5oVj1Uwvv970ruUkCV7O1mzgVFO4/rev2cLRda9Tm9HrL70ZPut4rOHgY0FNrUu9BCbXA2sdQ+x0chA==}
+    dev: true
+
   /is-weakref@1.0.2:
     resolution: {integrity: sha512-qctsuLZmIQ0+vSSMfoVvyFe2+GSEvnmZ2ezTup1SBse9+twCCeial6EEi3Nc2KFcf6+qz2FBPnjXsk8xhKSaPQ==}
     dependencies:
       call-bind: 1.0.2
     dev: true
 
+  /is-weakset@2.0.2:
+    resolution: {integrity: sha512-t2yVvttHkQktwnNNmBQ98AhENLdPUTDTE21uPqAQ0ARwQfGeQKRVS0NNurH7bTf7RrvcVn1OOge45CnBeHCSmg==}
+    dependencies:
+      call-bind: 1.0.2
+      get-intrinsic: 1.2.1
+    dev: true
+
   /is-wsl@2.2.0:
     resolution: {integrity: sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==}
     engines: {node: '>=8'}
@@ -3671,6 +3859,16 @@ packages:
     resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
     dev: true
 
+  /iterator.prototype@1.1.2:
+    resolution: {integrity: sha512-DR33HMMr8EzwuRL8Y9D3u2BMj8+RqSE850jfGu59kS7tbmPLzGkZmVSfyCFSDxuZiEY6Rzt3T2NA/qU+NwVj1w==}
+    dependencies:
+      define-properties: 1.2.1
+      get-intrinsic: 1.2.1
+      has-symbols: 1.0.3
+      reflect.getprototypeof: 1.0.4
+      set-function-name: 2.0.1
+    dev: true
+
   /js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
@@ -4281,26 +4479,23 @@ packages:
     resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
     dev: true
 
-  /next@13.4.12(@babel/core@7.22.9)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-eHfnru9x6NRmTMcjQp6Nz0J4XH9OubmzOa7CkWL+AUrUxpibub3vWwttjduu9No16dug1kq04hiUUpo7J3m3Xw==}
-    engines: {node: '>=16.8.0'}
+  /next@13.5.3(@babel/core@7.22.9)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-4Nt4HRLYDW/yRpJ/QR2t1v63UOMS55A38dnWv3UDOWGezuY0ZyFO1ABNbD7mulVzs9qVhgy2+ppjdsANpKP1mg==}
+    engines: {node: '>=16.14.0'}
     hasBin: true
     peerDependencies:
       '@opentelemetry/api': ^1.1.0
-      fibers: '>= 3.1.0'
       react: ^18.2.0
       react-dom: ^18.2.0
       sass: ^1.3.0
     peerDependenciesMeta:
       '@opentelemetry/api':
         optional: true
-      fibers:
-        optional: true
       sass:
         optional: true
     dependencies:
-      '@next/env': 13.4.12
-      '@swc/helpers': 0.5.1
+      '@next/env': 13.5.3
+      '@swc/helpers': 0.5.2
       busboy: 1.6.0
       caniuse-lite: 1.0.30001517
       postcss: 8.4.14
@@ -4310,15 +4505,15 @@ packages:
       watchpack: 2.4.0
       zod: 3.21.4
     optionalDependencies:
-      '@next/swc-darwin-arm64': 13.4.12
-      '@next/swc-darwin-x64': 13.4.12
-      '@next/swc-linux-arm64-gnu': 13.4.12
-      '@next/swc-linux-arm64-musl': 13.4.12
-      '@next/swc-linux-x64-gnu': 13.4.12
-      '@next/swc-linux-x64-musl': 13.4.12
-      '@next/swc-win32-arm64-msvc': 13.4.12
-      '@next/swc-win32-ia32-msvc': 13.4.12
-      '@next/swc-win32-x64-msvc': 13.4.12
+      '@next/swc-darwin-arm64': 13.5.3
+      '@next/swc-darwin-x64': 13.5.3
+      '@next/swc-linux-arm64-gnu': 13.5.3
+      '@next/swc-linux-arm64-musl': 13.5.3
+      '@next/swc-linux-x64-gnu': 13.5.3
+      '@next/swc-linux-x64-musl': 13.5.3
+      '@next/swc-win32-arm64-msvc': 13.5.3
+      '@next/swc-win32-ia32-msvc': 13.5.3
+      '@next/swc-win32-x64-msvc': 13.5.3
     transitivePeerDependencies:
       - '@babel/core'
       - babel-plugin-macros
@@ -4387,6 +4582,15 @@ packages:
       es-abstract: 1.22.1
     dev: true
 
+  /object.groupby@1.0.1:
+    resolution: {integrity: sha512-HqaQtqLnp/8Bn4GL16cj+CUYbnpe1bh0TtEaWvybszDG4tgxCJuRpV8VGuvNaI1fAnI4lUJzDG55MXcOH4JZcQ==}
+    dependencies:
+      call-bind: 1.0.2
+      define-properties: 1.2.0
+      es-abstract: 1.22.1
+      get-intrinsic: 1.2.1
+    dev: true
+
   /object.hasown@1.1.2:
     resolution: {integrity: sha512-B5UIT3J1W+WuWIU55h0mjlwaqxiE5vYENJXIXZ4VFe05pNYrkKuK0U/6aFcb0pKywYJh7IhfoqUfKVmrJJHZHw==}
     dependencies:
@@ -4605,8 +4809,8 @@ packages:
       use-sidecar: 1.1.2(@types/react@18.2.17)(react@18.2.0)
     dev: false
 
-  /react-icons@4.10.1(react@18.2.0):
-    resolution: {integrity: sha512-/ngzDP/77tlCfqthiiGNZeYFACw85fUjZtLbedmJ5DTlNDIwETxhwBzdOJ21zj4iJdvc0J3y7yOsX3PpxAJzrw==}
+  /react-icons@4.11.0(react@18.2.0):
+    resolution: {integrity: sha512-V+4khzYcE5EBk/BvcuYRq6V/osf11ODUM2J8hg2FDSswRrGvqiYUYPRy4OdrWaQOBj4NcpJfmHZLNaD+VH0TyA==}
     peerDependencies:
       react: '*'
     dependencies:
@@ -4733,6 +4937,18 @@ packages:
       minimatch: 5.1.6
     dev: false
 
+  /reflect.getprototypeof@1.0.4:
+    resolution: {integrity: sha512-ECkTw8TmJwW60lOTR+ZkODISW6RQ8+2CL3COqtiJKLd6MmB45hN51HprHFziKLGkAuTGQhBb91V8cy+KHlaCjw==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      call-bind: 1.0.2
+      define-properties: 1.2.1
+      es-abstract: 1.22.1
+      get-intrinsic: 1.2.1
+      globalthis: 1.0.3
+      which-builtin-type: 1.1.3
+    dev: true
+
   /regenerator-runtime@0.13.11:
     resolution: {integrity: sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg==}
 
@@ -4850,6 +5066,16 @@ packages:
       isarray: 2.0.5
     dev: true
 
+  /safe-array-concat@1.0.1:
+    resolution: {integrity: sha512-6XbUAseYE2KtOuGueyeobCySj9L4+66Tn6KQMOPQJrAJEowYKW/YR/MGJZl7FdydUdaFu4LYyDZjxf4/Nmo23Q==}
+    engines: {node: '>=0.4'}
+    dependencies:
+      call-bind: 1.0.2
+      get-intrinsic: 1.2.1
+      has-symbols: 1.0.3
+      isarray: 2.0.5
+    dev: true
+
   /safe-buffer@5.1.2:
     resolution: {integrity: sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==}
     dev: false
@@ -4884,6 +5110,15 @@ packages:
       lru-cache: 6.0.0
     dev: true
 
+  /set-function-name@2.0.1:
+    resolution: {integrity: sha512-tMNCiqYVkXIZgc2Hnoy2IvC/f8ezc5koaRFkCjrpWzGpCd3qbZXPzVy9MAZzK1ch/X0jvSkojys3oqJN0qCmdA==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      define-data-property: 1.1.0
+      functions-have-names: 1.2.3
+      has-property-descriptors: 1.0.0
+    dev: true
+
   /shebang-command@2.0.0:
     resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
     engines: {node: '>=8'}
@@ -5388,6 +5623,33 @@ packages:
       is-symbol: 1.0.4
     dev: true
 
+  /which-builtin-type@1.1.3:
+    resolution: {integrity: sha512-YmjsSMDBYsM1CaFiayOVT06+KJeXf0o5M/CAd4o1lTadFAtacTUM49zoYxr/oroopFDfhvN6iEcBxUyc3gvKmw==}
+    engines: {node: '>= 0.4'}
+    dependencies:
+      function.prototype.name: 1.1.5
+      has-tostringtag: 1.0.0
+      is-async-function: 2.0.0
+      is-date-object: 1.0.5
+      is-finalizationregistry: 1.0.2
+      is-generator-function: 1.0.10
+      is-regex: 1.1.4
+      is-weakref: 1.0.2
+      isarray: 2.0.5
+      which-boxed-primitive: 1.0.2
+      which-collection: 1.0.1
+      which-typed-array: 1.1.11
+    dev: true
+
+  /which-collection@1.0.1:
+    resolution: {integrity: sha512-W8xeTUwaln8i3K/cY1nGXzdnVZlidBcagyNFtBdD5kxnb4TvGKR7FfSIS3mYpwWS1QUCutfKz8IY8RjftB0+1A==}
+    dependencies:
+      is-map: 2.0.2
+      is-set: 2.0.2
+      is-weakmap: 2.0.1
+      is-weakset: 2.0.2
+    dev: true
+
   /which-typed-array@1.1.11:
     resolution: {integrity: sha512-qe9UWWpkeG5yzZ0tNYxDmd7vo58HDBc39mZ0xWWpolAGADdFOzkfamWLDxkOWcvHQKVmdTyQdLD4NOfjLWTKew==}
     engines: {node: '>= 0.4'}
diff --git a/package.json b/package.json
index 356cfea31f613..2286328d3902d 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,14 @@
 {
+  "_comment": "This version doesn't matter, it's just to allow importing from other repos.",
+  "name": "coder",
+  "version": "0.0.0",
   "scripts": {
-    "format:write:only": "pnpm exec prettier --write"
+    "format:write:only": "prettier --cache --write"
   },
   "devDependencies": {
     "prettier": "3.0.0"
+  },
+  "dependencies": {
+    "exec": "^0.2.1"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 34c73146883c8..e5e4d2584e40f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4,6 +4,11 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+dependencies:
+  exec:
+    specifier: ^0.2.1
+    version: 0.2.1
+
 devDependencies:
   prettier:
     specifier: 3.0.0
@@ -11,6 +16,12 @@ devDependencies:
 
 packages:
 
+  /exec@0.2.1:
+    resolution: {integrity: sha512-lE5ZlJgRYh+rmwidatL2AqRA/U9IBoCpKlLriBmnfUIrV/Rj4oLjb63qZ57iBCHWi5j9IjLt5wOWkFYPiTfYAg==}
+    engines: {node: '>= v0.9.1'}
+    deprecated: deprecated in favor of builtin child_process.execFile
+    dev: false
+
   /prettier@3.0.0:
     resolution: {integrity: sha512-zBf5eHpwHOGPC47h0zrPyNn+eAEIdEzfywMoYn2XPi0P44Zp0tSq64rq0xAREh4auw2cJZHo9QUob+NqCQky4g==}
     engines: {node: '>=14'}
diff --git a/provisioner/appslug_test.go b/provisioner/appslug_test.go
index 2fbd3f08ea1cd..f13f220e9c63c 100644
--- a/provisioner/appslug_test.go
+++ b/provisioner/appslug_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/provisioner"
+	"github.com/coder/coder/v2/provisioner"
 )
 
 func TestValidAppSlugRegex(t *testing.T) {
diff --git a/provisioner/echo/serve.go b/provisioner/echo/serve.go
index 6df498a9af495..6ab89c13a629e 100644
--- a/provisioner/echo/serve.go
+++ b/provisioner/echo/serve.go
@@ -5,25 +5,24 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"os"
 	"path/filepath"
 	"strings"
 
+	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 	protobuf "google.golang.org/protobuf/proto"
 
-	"github.com/google/uuid"
-	"github.com/spf13/afero"
-
-	"github.com/coder/coder/provisionersdk"
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 // ProvisionApplyWithAgent returns provision responses that will mock a fake
 // "aws_instance" resource with an agent that has the given auth token.
-func ProvisionApplyWithAgent(authToken string) []*proto.Provision_Response {
-	return []*proto.Provision_Response{{
-		Type: &proto.Provision_Response_Complete{
-			Complete: &proto.Provision_Complete{
+func ProvisionApplyWithAgent(authToken string) []*proto.Response {
+	return []*proto.Response{{
+		Type: &proto.Response_Apply{
+			Apply: &proto.ApplyComplete{
 				Resources: []*proto.Resource{{
 					Name: "example",
 					Type: "aws_instance",
@@ -42,23 +41,36 @@ func ProvisionApplyWithAgent(authToken string) []*proto.Provision_Response {
 
 var (
 	// ParseComplete is a helper to indicate an empty parse completion.
-	ParseComplete = []*proto.Parse_Response{{
-		Type: &proto.Parse_Response_Complete{
-			Complete: &proto.Parse_Complete{},
+	ParseComplete = []*proto.Response{{
+		Type: &proto.Response_Parse{
+			Parse: &proto.ParseComplete{},
 		},
 	}}
-	// ProvisionComplete is a helper to indicate an empty provision completion.
-	ProvisionComplete = []*proto.Provision_Response{{
-		Type: &proto.Provision_Response_Complete{
-			Complete: &proto.Provision_Complete{},
+	// PlanComplete is a helper to indicate an empty provision completion.
+	PlanComplete = []*proto.Response{{
+		Type: &proto.Response_Plan{
+			Plan: &proto.PlanComplete{},
+		},
+	}}
+	// ApplyComplete is a helper to indicate an empty provision completion.
+	ApplyComplete = []*proto.Response{{
+		Type: &proto.Response_Apply{
+			Apply: &proto.ApplyComplete{},
 		},
 	}}
 
-	// ProvisionFailed is a helper to convey a failed provision
-	// operation.
-	ProvisionFailed = []*proto.Provision_Response{{
-		Type: &proto.Provision_Response_Complete{
-			Complete: &proto.Provision_Complete{
+	// PlanFailed is a helper to convey a failed plan operation
+	PlanFailed = []*proto.Response{{
+		Type: &proto.Response_Plan{
+			Plan: &proto.PlanComplete{
+				Error: "failed!",
+			},
+		},
+	}}
+	// ApplyFailed is a helper to convey a failed apply operation
+	ApplyFailed = []*proto.Response{{
+		Type: &proto.Response_Apply{
+			Apply: &proto.ApplyComplete{
 				Error: "failed!",
 			},
 		},
@@ -66,179 +78,219 @@ var (
 )
 
 // Serve starts the echo provisioner.
-func Serve(ctx context.Context, filesystem afero.Fs, options *provisionersdk.ServeOptions) error {
-	return provisionersdk.Serve(ctx, &echo{
-		filesystem: filesystem,
-	}, options)
+func Serve(ctx context.Context, options *provisionersdk.ServeOptions) error {
+	return provisionersdk.Serve(ctx, &echo{}, options)
 }
 
 // The echo provisioner serves as a dummy provisioner primarily
 // used for testing. It echos responses from JSON files in the
 // format %d.protobuf. It's used for testing.
-type echo struct {
-	filesystem afero.Fs
-}
+type echo struct{}
 
-// Parse reads requests from the provided directory to stream responses.
-func (e *echo) Parse(request *proto.Parse_Request, stream proto.DRPCProvisioner_ParseStream) error {
-	for index := 0; ; index++ {
-		path := filepath.Join(request.Directory, fmt.Sprintf("%d.parse.protobuf", index))
-		_, err := e.filesystem.Stat(path)
-		if err != nil {
-			if index == 0 {
-				// Error if nothing is around to enable failed states.
-				return xerrors.Errorf("no state: %w", err)
+func readResponses(sess *provisionersdk.Session, trans string, suffix string) ([]*proto.Response, error) {
+	var responses []*proto.Response
+	for i := 0; ; i++ {
+		paths := []string{
+			// Try more specific path first, then fallback to generic.
+			filepath.Join(sess.WorkDirectory, fmt.Sprintf("%d.%s.%s", i, trans, suffix)),
+			filepath.Join(sess.WorkDirectory, fmt.Sprintf("%d.%s", i, suffix)),
+		}
+		for pathIndex, path := range paths {
+			_, err := os.Stat(path)
+			if err != nil && pathIndex == (len(paths)-1) {
+				// If there are zero messages, something is wrong
+				if i == 0 {
+					// Error if nothing is around to enable failed states.
+					return nil, xerrors.Errorf("no state: %w", err)
+				}
+				// Otherwise, we've read all responses
+				return responses, nil
+			}
+			if err != nil {
+				// try next path
+				continue
+			}
+			data, err := os.ReadFile(path)
+			if err != nil {
+				return nil, xerrors.Errorf("read file %q: %w", path, err)
 			}
+			response := new(proto.Response)
+			err = protobuf.Unmarshal(data, response)
+			if err != nil {
+				return nil, xerrors.Errorf("unmarshal: %w", err)
+			}
+			responses = append(responses, response)
 			break
 		}
-		data, err := afero.ReadFile(e.filesystem, path)
-		if err != nil {
-			return xerrors.Errorf("read file %q: %w", path, err)
-		}
-		var response proto.Parse_Response
-		err = protobuf.Unmarshal(data, &response)
-		if err != nil {
-			return xerrors.Errorf("unmarshal: %w", err)
-		}
-		err = stream.Send(&response)
-		if err != nil {
-			return err
-		}
 	}
-	<-stream.Context().Done()
-	return stream.Context().Err()
 }
 
-// Provision reads requests from the provided directory to stream responses.
-func (e *echo) Provision(stream proto.DRPCProvisioner_ProvisionStream) error {
-	msg, err := stream.Recv()
+// Parse reads requests from the provided directory to stream responses.
+func (*echo) Parse(sess *provisionersdk.Session, _ *proto.ParseRequest, _ <-chan struct{}) *proto.ParseComplete {
+	responses, err := readResponses(sess, "unspecified", "parse.protobuf")
 	if err != nil {
-		return err
+		return &proto.ParseComplete{Error: err.Error()}
 	}
-
-	var config *proto.Provision_Config
-	switch {
-	case msg.GetPlan() != nil:
-		config = msg.GetPlan().GetConfig()
-	case msg.GetApply() != nil:
-		config = msg.GetApply().GetConfig()
-	default:
-		// Probably a cancel
-		return nil
-	}
-
-	for index := 0; ; index++ {
-		var extension string
-		if msg.GetPlan() != nil {
-			extension = ".plan.protobuf"
-		} else {
-			extension = ".apply.protobuf"
-		}
-		path := filepath.Join(config.Directory, fmt.Sprintf("%d.provision"+extension, index))
-		_, err := e.filesystem.Stat(path)
-		if err != nil {
-			if index == 0 {
-				// Error if nothing is around to enable failed states.
-				return xerrors.New("no state")
-			}
-			break
+	for _, response := range responses {
+		if log := response.GetLog(); log != nil {
+			sess.ProvisionLog(log.Level, log.Output)
 		}
-		data, err := afero.ReadFile(e.filesystem, path)
-		if err != nil {
-			return xerrors.Errorf("read file %q: %w", path, err)
+		if complete := response.GetParse(); complete != nil {
+			return complete
 		}
-		var response proto.Provision_Response
-		err = protobuf.Unmarshal(data, &response)
-		if err != nil {
-			return xerrors.Errorf("unmarshal: %w", err)
+	}
+
+	// if we didn't get a complete from the filesystem, that's an error
+	return provisionersdk.ParseErrorf("complete response missing")
+}
+
+// Plan reads requests from the provided directory to stream responses.
+func (*echo) Plan(sess *provisionersdk.Session, req *proto.PlanRequest, canceledOrComplete <-chan struct{}) *proto.PlanComplete {
+	responses, err := readResponses(
+		sess,
+		strings.ToLower(req.GetMetadata().GetWorkspaceTransition().String()),
+		"plan.protobuf")
+	if err != nil {
+		return &proto.PlanComplete{Error: err.Error()}
+	}
+	for _, response := range responses {
+		if log := response.GetLog(); log != nil {
+			sess.ProvisionLog(log.Level, log.Output)
 		}
-		r, ok := filterLogResponses(config, &response)
-		if !ok {
-			continue
+		if complete := response.GetPlan(); complete != nil {
+			return complete
 		}
+	}
 
-		err = stream.Send(r)
-		if err != nil {
-			return err
+	// some tests use Echo without a complete response to test cancel
+	<-canceledOrComplete
+	return provisionersdk.PlanErrorf("canceled")
+}
+
+// Apply reads requests from the provided directory to stream responses.
+func (*echo) Apply(sess *provisionersdk.Session, req *proto.ApplyRequest, canceledOrComplete <-chan struct{}) *proto.ApplyComplete {
+	responses, err := readResponses(
+		sess,
+		strings.ToLower(req.GetMetadata().GetWorkspaceTransition().String()),
+		"apply.protobuf")
+	if err != nil {
+		return &proto.ApplyComplete{Error: err.Error()}
+	}
+	for _, response := range responses {
+		if log := response.GetLog(); log != nil {
+			sess.ProvisionLog(log.Level, log.Output)
+		}
+		if complete := response.GetApply(); complete != nil {
+			return complete
 		}
 	}
-	<-stream.Context().Done()
-	return stream.Context().Err()
+
+	// some tests use Echo without a complete response to test cancel
+	<-canceledOrComplete
+	return provisionersdk.ApplyErrorf("canceled")
 }
 
 func (*echo) Shutdown(_ context.Context, _ *proto.Empty) (*proto.Empty, error) {
 	return &proto.Empty{}, nil
 }
 
+// Responses is a collection of mocked responses to Provision operations.
 type Responses struct {
-	Parse          []*proto.Parse_Response
-	ProvisionApply []*proto.Provision_Response
-	ProvisionPlan  []*proto.Provision_Response
+	Parse []*proto.Response
+
+	// ProvisionApply and ProvisionPlan are used to mock ALL responses of
+	// Apply and Plan, regardless of transition.
+	ProvisionApply []*proto.Response
+	ProvisionPlan  []*proto.Response
+
+	// ProvisionApplyMap and ProvisionPlanMap are used to mock specific
+	// transition responses. They are prioritized over the generic responses.
+	ProvisionApplyMap map[proto.WorkspaceTransition][]*proto.Response
+	ProvisionPlanMap  map[proto.WorkspaceTransition][]*proto.Response
 }
 
 // Tar returns a tar archive of responses to provisioner operations.
 func Tar(responses *Responses) ([]byte, error) {
 	if responses == nil {
-		responses = &Responses{ParseComplete, ProvisionComplete, ProvisionComplete}
+		responses = &Responses{
+			ParseComplete, ApplyComplete, PlanComplete,
+			nil, nil,
+		}
 	}
 	if responses.ProvisionPlan == nil {
-		responses.ProvisionPlan = responses.ProvisionApply
+		for _, resp := range responses.ProvisionApply {
+			if resp.GetLog() != nil {
+				responses.ProvisionPlan = append(responses.ProvisionPlan, resp)
+				continue
+			}
+			responses.ProvisionPlan = append(responses.ProvisionPlan, &proto.Response{
+				Type: &proto.Response_Plan{Plan: &proto.PlanComplete{
+					Error:                 resp.GetApply().GetError(),
+					Resources:             resp.GetApply().GetResources(),
+					Parameters:            resp.GetApply().GetParameters(),
+					ExternalAuthProviders: resp.GetApply().GetExternalAuthProviders(),
+				}},
+			})
+		}
 	}
 
 	var buffer bytes.Buffer
 	writer := tar.NewWriter(&buffer)
-	for index, response := range responses.Parse {
-		data, err := protobuf.Marshal(response)
+
+	writeProto := func(name string, message protobuf.Message) error {
+		data, err := protobuf.Marshal(message)
 		if err != nil {
-			return nil, err
+			return err
 		}
+
 		err = writer.WriteHeader(&tar.Header{
-			Name: fmt.Sprintf("%d.parse.protobuf", index),
+			Name: name,
 			Size: int64(len(data)),
 			Mode: 0o644,
 		})
 		if err != nil {
-			return nil, err
+			return err
 		}
+
 		_, err = writer.Write(data)
 		if err != nil {
-			return nil, err
+			return err
 		}
+
+		return nil
 	}
-	for index, response := range responses.ProvisionApply {
-		data, err := protobuf.Marshal(response)
-		if err != nil {
-			return nil, err
-		}
-		err = writer.WriteHeader(&tar.Header{
-			Name: fmt.Sprintf("%d.provision.apply.protobuf", index),
-			Size: int64(len(data)),
-			Mode: 0o644,
-		})
+	for index, response := range responses.Parse {
+		err := writeProto(fmt.Sprintf("%d.parse.protobuf", index), response)
 		if err != nil {
 			return nil, err
 		}
-		_, err = writer.Write(data)
+	}
+	for index, response := range responses.ProvisionApply {
+		err := writeProto(fmt.Sprintf("%d.apply.protobuf", index), response)
 		if err != nil {
 			return nil, err
 		}
 	}
 	for index, response := range responses.ProvisionPlan {
-		data, err := protobuf.Marshal(response)
+		err := writeProto(fmt.Sprintf("%d.plan.protobuf", index), response)
 		if err != nil {
 			return nil, err
 		}
-		err = writer.WriteHeader(&tar.Header{
-			Name: fmt.Sprintf("%d.provision.plan.protobuf", index),
-			Size: int64(len(data)),
-			Mode: 0o644,
-		})
-		if err != nil {
-			return nil, err
+	}
+	for trans, m := range responses.ProvisionApplyMap {
+		for i, rs := range m {
+			err := writeProto(fmt.Sprintf("%d.%s.apply.protobuf", i, strings.ToLower(trans.String())), rs)
+			if err != nil {
+				return nil, err
+			}
 		}
-		_, err = writer.Write(data)
-		if err != nil {
-			return nil, err
+	}
+	for trans, m := range responses.ProvisionPlanMap {
+		for i, rs := range m {
+			err := writeProto(fmt.Sprintf("%d.%s.plan.protobuf", i, strings.ToLower(trans.String())), rs)
+			if err != nil {
+				return nil, err
+			}
 		}
 	}
 	err := writer.Flush()
@@ -248,22 +300,14 @@ func Tar(responses *Responses) ([]byte, error) {
 	return buffer.Bytes(), nil
 }
 
-func filterLogResponses(config *proto.Provision_Config, response *proto.Provision_Response) (*proto.Provision_Response, bool) {
-	responseLog, ok := response.Type.(*proto.Provision_Response_Log)
-	if !ok {
-		// Pass all non-log responses
-		return response, true
-	}
-
-	if config.ProvisionerLogLevel == "" {
-		// Don't change the default behavior of "echo"
-		return response, true
-	}
-
-	provisionerLogLevel := proto.LogLevel_value[strings.ToUpper(config.ProvisionerLogLevel)]
-	if int32(responseLog.Log.Level) < provisionerLogLevel {
-		// Log level is not enabled
-		return nil, false
+func WithResources(resources []*proto.Resource) *Responses {
+	return &Responses{
+		Parse: ParseComplete,
+		ProvisionApply: []*proto.Response{{Type: &proto.Response_Apply{Apply: &proto.ApplyComplete{
+			Resources: resources,
+		}}}},
+		ProvisionPlan: []*proto.Response{{Type: &proto.Response_Plan{Plan: &proto.PlanComplete{
+			Resources: resources,
+		}}}},
 	}
-	return response, true
 }
diff --git a/provisioner/echo/serve_test.go b/provisioner/echo/serve_test.go
index d240b08e7a36e..6590f2ecafc54 100644
--- a/provisioner/echo/serve_test.go
+++ b/provisioner/echo/serve_test.go
@@ -1,27 +1,23 @@
 package echo_test
 
 import (
-	"archive/tar"
-	"bytes"
 	"context"
-	"io"
-	"os"
-	"path/filepath"
 	"testing"
 
-	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk"
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestEcho(t *testing.T) {
 	t.Parallel()
 
-	fs := afero.NewMemMapFs()
+	workdir := t.TempDir()
+
 	// Create an in-memory provisioner to communicate with.
 	client, server := provisionersdk.MemTransportPipe()
 	ctx, cancelFunc := context.WithCancel(context.Background())
@@ -31,8 +27,9 @@ func TestEcho(t *testing.T) {
 		cancelFunc()
 	})
 	go func() {
-		err := echo.Serve(ctx, fs, &provisionersdk.ServeOptions{
-			Listener: server,
+		err := echo.Serve(ctx, &provisionersdk.ServeOptions{
+			Listener:      server,
+			WorkDirectory: workdir,
 		})
 		assert.NoError(t, err)
 	}()
@@ -40,25 +37,39 @@ func TestEcho(t *testing.T) {
 
 	t.Run("Parse", func(t *testing.T) {
 		t.Parallel()
+		ctx, cancel := context.WithTimeout(ctx, testutil.WaitShort)
+		defer cancel()
 
-		responses := []*proto.Parse_Response{{
-			Type: &proto.Parse_Response_Log{
-				Log: &proto.Log{
-					Output: "log-output",
+		responses := []*proto.Response{
+			{
+				Type: &proto.Response_Log{
+					Log: &proto.Log{
+						Output: "log-output",
+					},
 				},
 			},
-		}, {
-			Type: &proto.Parse_Response_Complete{
-				Complete: &proto.Parse_Complete{},
+			{
+				Type: &proto.Response_Parse{
+					Parse: &proto.ParseComplete{},
+				},
 			},
-		}}
+		}
 		data, err := echo.Tar(&echo.Responses{
 			Parse: responses,
 		})
 		require.NoError(t, err)
-		client, err := api.Parse(ctx, &proto.Parse_Request{
-			Directory: unpackTar(t, fs, data),
-		})
+		client, err := api.Session(ctx)
+		require.NoError(t, err)
+		defer func() {
+			err := client.Close()
+			require.NoError(t, err)
+		}()
+		err = client.Send(&proto.Request{Type: &proto.Request_Config{Config: &proto.Config{
+			TemplateSourceArchive: data,
+		}}})
+		require.NoError(t, err)
+
+		err = client.Send(&proto.Request{Type: &proto.Request_Parse{Parse: &proto.ParseRequest{}}})
 		require.NoError(t, err)
 		log, err := client.Recv()
 		require.NoError(t, err)
@@ -70,68 +81,172 @@ func TestEcho(t *testing.T) {
 
 	t.Run("Provision", func(t *testing.T) {
 		t.Parallel()
+		ctx, cancel := context.WithTimeout(ctx, testutil.WaitShort)
+		defer cancel()
 
-		responses := []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Log{
-				Log: &proto.Log{
-					Level:  proto.LogLevel_INFO,
-					Output: "log-output",
+		planResponses := []*proto.Response{
+			{
+				Type: &proto.Response_Log{
+					Log: &proto.Log{
+						Level:  proto.LogLevel_INFO,
+						Output: "log-output",
+					},
 				},
 			},
-		}, {
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
-					Resources: []*proto.Resource{{
-						Name: "resource",
-					}},
+			{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
+						Resources: []*proto.Resource{{
+							Name: "resource",
+						}},
+					},
 				},
 			},
-		}}
+		}
+		applyResponses := []*proto.Response{
+			{
+				Type: &proto.Response_Log{
+					Log: &proto.Log{
+						Level:  proto.LogLevel_INFO,
+						Output: "log-output",
+					},
+				},
+			},
+			{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
+						Resources: []*proto.Resource{{
+							Name: "resource",
+						}},
+					},
+				},
+			},
+		}
 		data, err := echo.Tar(&echo.Responses{
-			ProvisionApply: responses,
+			ProvisionPlan:  planResponses,
+			ProvisionApply: applyResponses,
 		})
 		require.NoError(t, err)
-		client, err := api.Provision(ctx)
+		client, err := api.Session(ctx)
+		require.NoError(t, err)
+		defer func() {
+			err := client.Close()
+			require.NoError(t, err)
+		}()
+		err = client.Send(&proto.Request{Type: &proto.Request_Config{Config: &proto.Config{
+			TemplateSourceArchive: data,
+		}}})
+		require.NoError(t, err)
+
+		err = client.Send(&proto.Request{Type: &proto.Request_Plan{Plan: &proto.PlanRequest{}}})
 		require.NoError(t, err)
-		err = client.Send(&proto.Provision_Request{
-			Type: &proto.Provision_Request_Plan{
-				Plan: &proto.Provision_Plan{
-					Config: &proto.Provision_Config{
-						Directory: unpackTar(t, fs, data),
+		log, err := client.Recv()
+		require.NoError(t, err)
+		require.Equal(t, planResponses[0].GetLog().Output, log.GetLog().Output)
+		complete, err := client.Recv()
+		require.NoError(t, err)
+		require.Equal(t, planResponses[1].GetPlan().Resources[0].Name,
+			complete.GetPlan().Resources[0].Name)
+
+		err = client.Send(&proto.Request{Type: &proto.Request_Apply{Apply: &proto.ApplyRequest{}}})
+		require.NoError(t, err)
+		log, err = client.Recv()
+		require.NoError(t, err)
+		require.Equal(t, applyResponses[0].GetLog().Output, log.GetLog().Output)
+		complete, err = client.Recv()
+		require.NoError(t, err)
+		require.Equal(t, applyResponses[1].GetApply().Resources[0].Name,
+			complete.GetApply().Resources[0].Name)
+	})
+
+	t.Run("ProvisionStop", func(t *testing.T) {
+		t.Parallel()
+
+		// Stop responses should be returned when the workspace is being stopped.
+		data, err := echo.Tar(&echo.Responses{
+			ProvisionApply: applyCompleteResource("DEFAULT"),
+			ProvisionPlan:  planCompleteResource("DEFAULT"),
+			ProvisionPlanMap: map[proto.WorkspaceTransition][]*proto.Response{
+				proto.WorkspaceTransition_STOP: planCompleteResource("STOP"),
+			},
+			ProvisionApplyMap: map[proto.WorkspaceTransition][]*proto.Response{
+				proto.WorkspaceTransition_STOP: applyCompleteResource("STOP"),
+			},
+		})
+		require.NoError(t, err)
+
+		client, err := api.Session(ctx)
+		require.NoError(t, err)
+		defer func() {
+			err := client.Close()
+			require.NoError(t, err)
+		}()
+		err = client.Send(&proto.Request{Type: &proto.Request_Config{Config: &proto.Config{
+			TemplateSourceArchive: data,
+		}}})
+		require.NoError(t, err)
+
+		// Do stop.
+		err = client.Send(&proto.Request{
+			Type: &proto.Request_Plan{
+				Plan: &proto.PlanRequest{
+					Metadata: &proto.Metadata{
+						WorkspaceTransition: proto.WorkspaceTransition_STOP,
 					},
 				},
 			},
 		})
 		require.NoError(t, err)
-		log, err := client.Recv()
-		require.NoError(t, err)
-		require.Equal(t, responses[0].GetLog().Output, log.GetLog().Output)
+
 		complete, err := client.Recv()
 		require.NoError(t, err)
-		require.Equal(t, responses[1].GetComplete().Resources[0].Name,
-			complete.GetComplete().Resources[0].Name)
+		require.Equal(t,
+			"STOP",
+			complete.GetPlan().Resources[0].Name,
+		)
+
+		// Do start.
+		err = client.Send(&proto.Request{
+			Type: &proto.Request_Plan{
+				Plan: &proto.PlanRequest{
+					Metadata: &proto.Metadata{
+						WorkspaceTransition: proto.WorkspaceTransition_START,
+					},
+				},
+			},
+		})
+		require.NoError(t, err)
+
+		complete, err = client.Recv()
+		require.NoError(t, err)
+		require.Equal(t,
+			"DEFAULT",
+			complete.GetPlan().Resources[0].Name,
+		)
 	})
 
 	t.Run("ProvisionWithLogLevel", func(t *testing.T) {
 		t.Parallel()
+		ctx, cancel := context.WithTimeout(ctx, testutil.WaitShort)
+		defer cancel()
 
-		responses := []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Log{
+		responses := []*proto.Response{{
+			Type: &proto.Response_Log{
 				Log: &proto.Log{
 					Level:  proto.LogLevel_TRACE,
 					Output: "log-output-trace",
 				},
 			},
 		}, {
-			Type: &proto.Provision_Response_Log{
+			Type: &proto.Response_Log{
 				Log: &proto.Log{
 					Level:  proto.LogLevel_INFO,
 					Output: "log-output-info",
 				},
 			},
 		}, {
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "resource",
 					}},
@@ -139,49 +254,62 @@ func TestEcho(t *testing.T) {
 			},
 		}}
 		data, err := echo.Tar(&echo.Responses{
+			ProvisionPlan:  echo.PlanComplete,
 			ProvisionApply: responses,
 		})
 		require.NoError(t, err)
-		client, err := api.Provision(ctx)
+		client, err := api.Session(ctx)
 		require.NoError(t, err)
-		err = client.Send(&proto.Provision_Request{
-			Type: &proto.Provision_Request_Plan{
-				Plan: &proto.Provision_Plan{
-					Config: &proto.Provision_Config{
-						Directory:           unpackTar(t, fs, data),
-						ProvisionerLogLevel: "debug",
-					},
-				},
-			},
-		})
+		defer func() {
+			err := client.Close()
+			require.NoError(t, err)
+		}()
+		err = client.Send(&proto.Request{Type: &proto.Request_Config{Config: &proto.Config{
+			TemplateSourceArchive: data,
+			ProvisionerLogLevel:   "debug",
+		}}})
+		require.NoError(t, err)
+
+		// Plan is required before apply
+		err = client.Send(&proto.Request{Type: &proto.Request_Plan{Plan: &proto.PlanRequest{}}})
+		require.NoError(t, err)
+		complete, err := client.Recv()
+		require.NoError(t, err)
+		require.NotNil(t, complete.GetPlan())
+
+		err = client.Send(&proto.Request{Type: &proto.Request_Apply{Apply: &proto.ApplyRequest{}}})
 		require.NoError(t, err)
 		log, err := client.Recv()
 		require.NoError(t, err)
 		// Skip responses[0] as it's trace level
 		require.Equal(t, responses[1].GetLog().Output, log.GetLog().Output)
-		complete, err := client.Recv()
+		complete, err = client.Recv()
 		require.NoError(t, err)
-		require.Equal(t, responses[2].GetComplete().Resources[0].Name,
-			complete.GetComplete().Resources[0].Name)
+		require.Equal(t, responses[2].GetApply().Resources[0].Name,
+			complete.GetApply().Resources[0].Name)
 	})
 }
 
-func unpackTar(t *testing.T, fs afero.Fs, data []byte) string {
-	directory := t.TempDir()
-	reader := tar.NewReader(bytes.NewReader(data))
-	for {
-		header, err := reader.Next()
-		if err != nil {
-			break
-		}
-		// #nosec
-		path := filepath.Join(directory, header.Name)
-		file, err := fs.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
-		require.NoError(t, err)
-		_, err = io.CopyN(file, reader, 1<<20)
-		require.ErrorIs(t, err, io.EOF)
-		err = file.Close()
-		require.NoError(t, err)
-	}
-	return directory
+func planCompleteResource(name string) []*proto.Response {
+	return []*proto.Response{{
+		Type: &proto.Response_Plan{
+			Plan: &proto.PlanComplete{
+				Resources: []*proto.Resource{{
+					Name: name,
+				}},
+			},
+		},
+	}}
+}
+
+func applyCompleteResource(name string) []*proto.Response {
+	return []*proto.Response{{
+		Type: &proto.Response_Apply{
+			Apply: &proto.ApplyComplete{
+				Resources: []*proto.Resource{{
+					Name: name,
+				}},
+			},
+		},
+	}}
 }
diff --git a/provisioner/terraform/cleanup.go b/provisioner/terraform/cleanup.go
new file mode 100644
index 0000000000000..65f876551b6d7
--- /dev/null
+++ b/provisioner/terraform/cleanup.go
@@ -0,0 +1,153 @@
+package terraform
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/djherbis/times"
+	"github.com/spf13/afero"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+)
+
+// CleanStaleTerraformPlugins browses the Terraform cache directory
+// and remove stale plugins that haven't been used for a while.
+// Additionally, it sweeps empty, old directory trees.
+//
+// Sample cachePath:
+//
+//	/Users/john.doe/Library/Caches/coder/provisioner-1/tf
+//	/tmp/coder/provisioner-0/tf
+func CleanStaleTerraformPlugins(ctx context.Context, cachePath string, fs afero.Fs, now time.Time, logger slog.Logger) error {
+	cachePath, err := filepath.Abs(cachePath) // sanity check in case the path is e.g. ../../../cache
+	if err != nil {
+		return xerrors.Errorf("unable to determine absolute path %q: %w", cachePath, err)
+	}
+
+	// Firstly, check if the cache path exists.
+	_, err = fs.Stat(cachePath)
+	if os.IsNotExist(err) {
+		return nil
+	} else if err != nil {
+		return xerrors.Errorf("unable to stat cache path %q: %w", cachePath, err)
+	}
+
+	logger.Info(ctx, "clean stale Terraform plugins", slog.F("cache_path", cachePath))
+
+	// Filter directory trees matching pattern: <repositoryURL>/<company>/<plugin>/<version>/<distribution>
+	filterFunc := func(path string, info os.FileInfo) bool {
+		if !info.IsDir() {
+			return false
+		}
+
+		relativePath, err := filepath.Rel(cachePath, path)
+		if err != nil {
+			logger.Error(ctx, "unable to evaluate a relative path", slog.F("base", cachePath), slog.F("target", path), slog.Error(err))
+			return false
+		}
+
+		parts := strings.Split(relativePath, string(filepath.Separator))
+		return len(parts) == 5
+	}
+
+	// Review cached Terraform plugins
+	var pluginPaths []string
+	err = afero.Walk(fs, cachePath, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if !filterFunc(path, info) {
+			return nil
+		}
+
+		logger.Debug(ctx, "plugin directory discovered", slog.F("path", path))
+		pluginPaths = append(pluginPaths, path)
+		return nil
+	})
+	if err != nil {
+		return xerrors.Errorf("unable to walk through cache directory %q: %w", cachePath, err)
+	}
+
+	// Identify stale plugins
+	var stalePlugins []string
+	for _, pluginPath := range pluginPaths {
+		accessTime, err := latestAccessTime(fs, pluginPath)
+		if err != nil {
+			return xerrors.Errorf("unable to evaluate latest access time for directory %q: %w", pluginPath, err)
+		}
+
+		if accessTime.Add(staleTerraformPluginRetention).Before(now) {
+			logger.Info(ctx, "plugin directory is stale and will be removed", slog.F("plugin_path", pluginPath))
+			stalePlugins = append(stalePlugins, pluginPath)
+		} else {
+			logger.Debug(ctx, "plugin directory is not stale", slog.F("plugin_path", pluginPath))
+		}
+	}
+
+	// Remove stale plugins
+	for _, stalePluginPath := range stalePlugins {
+		// Remove the plugin directory
+		err = fs.RemoveAll(stalePluginPath)
+		if err != nil {
+			return xerrors.Errorf("unable to remove stale plugin %q: %w", stalePluginPath, err)
+		}
+
+		// Compact the plugin structure by removing empty directories.
+		wd := stalePluginPath
+		level := 5 // <repositoryURL>/<company>/<plugin>/<version>/<distribution>
+		for {
+			level--
+			if level == 0 {
+				break // do not compact further
+			}
+
+			wd = filepath.Dir(wd)
+
+			files, err := afero.ReadDir(fs, wd)
+			if err != nil {
+				return xerrors.Errorf("unable to read directory content %q: %w", wd, err)
+			}
+
+			if len(files) > 0 {
+				break // there are still other plugins
+			}
+
+			logger.Debug(ctx, "remove empty directory", slog.F("path", wd))
+			err = fs.Remove(wd)
+			if err != nil {
+				return xerrors.Errorf("unable to remove directory %q: %w", wd, err)
+			}
+		}
+	}
+	return nil
+}
+
+// latestAccessTime walks recursively through the directory content, and locates
+// the last accessed file.
+func latestAccessTime(fs afero.Fs, pluginPath string) (time.Time, error) {
+	var latest time.Time
+	err := afero.Walk(fs, pluginPath, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+
+		accessTime := info.ModTime() // fallback to modTime if accessTime is not available (afero)
+		if info.Sys() != nil {
+			timeSpec := times.Get(info)
+			accessTime = timeSpec.AccessTime()
+		}
+		if latest.Before(accessTime) {
+			latest = accessTime
+		}
+		return nil
+	})
+	if err != nil {
+		return time.Time{}, xerrors.Errorf("unable to walk the plugin path %q: %w", pluginPath, err)
+	}
+	return latest, nil
+}
diff --git a/provisioner/terraform/cleanup_test.go b/provisioner/terraform/cleanup_test.go
new file mode 100644
index 0000000000000..42e97305df89b
--- /dev/null
+++ b/provisioner/terraform/cleanup_test.go
@@ -0,0 +1,186 @@
+//go:build linux || darwin
+
+package terraform_test
+
+import (
+	"bytes"
+	"context"
+	"flag"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/provisioner/terraform"
+	"github.com/coder/coder/v2/testutil"
+)
+
+const cachePath = "/tmp/coder/provisioner-0/tf"
+
+// updateGoldenFiles is a flag that can be set to update golden files.
+var updateGoldenFiles = flag.Bool("update", false, "Update golden files")
+
+var (
+	coderPluginPath  = filepath.Join("registry.terraform.io", "coder", "coder", "0.11.1", "darwin_arm64")
+	dockerPluginPath = filepath.Join("registry.terraform.io", "kreuzwerker", "docker", "2.25.0", "darwin_arm64")
+)
+
+func TestPluginCache_Golden(t *testing.T) {
+	t.Parallel()
+
+	prepare := func() (afero.Fs, time.Time, slog.Logger) {
+		fs := afero.NewMemMapFs()
+		now := time.Date(2023, time.June, 3, 4, 5, 6, 0, time.UTC)
+		logger := slogtest.Make(t, nil).
+			Leveled(slog.LevelDebug).
+			Named("cleanup-test")
+		return fs, now, logger
+	}
+
+	t.Run("all plugins are stale", func(t *testing.T) {
+		t.Parallel()
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+
+		fs, now, logger := prepare()
+
+		// given
+		// This plugin is older than 30 days.
+		addPluginFile(t, fs, coderPluginPath, "terraform-provider-coder_v0.11.1", now.Add(-63*24*time.Hour))
+		addPluginFile(t, fs, coderPluginPath, "LICENSE", now.Add(-33*24*time.Hour))
+		addPluginFile(t, fs, coderPluginPath, "README.md", now.Add(-31*24*time.Hour))
+		addPluginFolder(t, fs, coderPluginPath, "new_folder", now.Add(-31*24*time.Hour))
+		addPluginFile(t, fs, coderPluginPath, filepath.Join("new_folder", "foobar.tf"), now.Add(-43*24*time.Hour))
+
+		// This plugin is older than 30 days.
+		addPluginFile(t, fs, dockerPluginPath, "terraform-provider-docker_v2.25.0", now.Add(-31*24*time.Hour))
+		addPluginFile(t, fs, dockerPluginPath, "LICENSE", now.Add(-32*24*time.Hour))
+		addPluginFile(t, fs, dockerPluginPath, "README.md", now.Add(-33*24*time.Hour))
+
+		// when
+		terraform.CleanStaleTerraformPlugins(ctx, cachePath, fs, now, logger)
+
+		// then
+		diffFileSystem(t, fs)
+	})
+
+	t.Run("one plugin is stale", func(t *testing.T) {
+		t.Parallel()
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+
+		fs, now, logger := prepare()
+
+		// given
+		addPluginFile(t, fs, coderPluginPath, "terraform-provider-coder_v0.11.1", now.Add(-2*time.Hour))
+		addPluginFile(t, fs, coderPluginPath, "LICENSE", now.Add(-3*time.Hour))
+		addPluginFile(t, fs, coderPluginPath, "README.md", now.Add(-4*time.Hour))
+		addPluginFolder(t, fs, coderPluginPath, "new_folder", now.Add(-5*time.Hour))
+		addPluginFile(t, fs, coderPluginPath, filepath.Join("new_folder", "foobar.tf"), now.Add(-4*time.Hour))
+
+		// This plugin is older than 30 days.
+		addPluginFile(t, fs, dockerPluginPath, "terraform-provider-docker_v2.25.0", now.Add(-31*24*time.Hour))
+		addPluginFile(t, fs, dockerPluginPath, "LICENSE", now.Add(-32*24*time.Hour))
+		addPluginFile(t, fs, dockerPluginPath, "README.md", now.Add(-33*24*time.Hour))
+
+		// when
+		terraform.CleanStaleTerraformPlugins(ctx, cachePath, fs, now, logger)
+
+		// then
+		diffFileSystem(t, fs)
+	})
+
+	t.Run("one plugin file is touched", func(t *testing.T) {
+		t.Parallel()
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+
+		fs, now, logger := prepare()
+
+		// given
+		addPluginFile(t, fs, coderPluginPath, "terraform-provider-coder_v0.11.1", now.Add(-63*24*time.Hour))
+		addPluginFile(t, fs, coderPluginPath, "LICENSE", now.Add(-33*24*time.Hour))
+		addPluginFile(t, fs, coderPluginPath, "README.md", now.Add(-31*24*time.Hour))
+		addPluginFolder(t, fs, coderPluginPath, "new_folder", now.Add(-4*time.Hour)) // touched
+		addPluginFile(t, fs, coderPluginPath, filepath.Join("new_folder", "foobar.tf"), now.Add(-43*24*time.Hour))
+
+		addPluginFile(t, fs, dockerPluginPath, "terraform-provider-docker_v2.25.0", now.Add(-31*24*time.Hour))
+		addPluginFile(t, fs, dockerPluginPath, "LICENSE", now.Add(-2*time.Hour))
+		addPluginFile(t, fs, dockerPluginPath, "README.md", now.Add(-33*24*time.Hour))
+
+		// when
+		terraform.CleanStaleTerraformPlugins(ctx, cachePath, fs, now, logger)
+
+		// then
+		diffFileSystem(t, fs)
+	})
+}
+
+func addPluginFile(t *testing.T, fs afero.Fs, pluginPath string, resourcePath string, accessTime time.Time) {
+	err := fs.MkdirAll(filepath.Join(cachePath, pluginPath), 0o755)
+	require.NoError(t, err, "can't create test folder for plugin file")
+
+	err = fs.Chtimes(filepath.Join(cachePath, pluginPath), accessTime, accessTime)
+	require.NoError(t, err, "can't set times")
+
+	err = afero.WriteFile(fs, filepath.Join(cachePath, pluginPath, resourcePath), []byte("foo"), 0o644)
+	require.NoError(t, err, "can't create test file")
+
+	err = fs.Chtimes(filepath.Join(cachePath, pluginPath, resourcePath), accessTime, accessTime)
+	require.NoError(t, err, "can't set times")
+}
+
+func addPluginFolder(t *testing.T, fs afero.Fs, pluginPath string, folderPath string, accessTime time.Time) {
+	err := fs.MkdirAll(filepath.Join(cachePath, pluginPath, folderPath), 0o755)
+	require.NoError(t, err, "can't create plugin folder")
+
+	err = fs.Chtimes(filepath.Join(cachePath, pluginPath, folderPath), accessTime, accessTime)
+	require.NoError(t, err, "can't set times")
+}
+
+func diffFileSystem(t *testing.T, fs afero.Fs) {
+	actual := dumpFileSystem(t, fs)
+
+	partialName := strings.Join(strings.Split(t.Name(), "/")[1:], "_")
+	goldenFile := filepath.Join("testdata", "cleanup-stale-plugins", partialName+".txt.golden")
+	if *updateGoldenFiles {
+		err := os.MkdirAll(filepath.Dir(goldenFile), 0o755)
+		require.NoError(t, err, "want no error creating golden file directory")
+
+		err = os.WriteFile(goldenFile, actual, 0o600)
+		require.NoError(t, err, "want no error creating golden file")
+		return
+	}
+
+	want, err := os.ReadFile(goldenFile)
+	require.NoError(t, err, "open golden file, run \"make update-golden-files\" and commit the changes")
+	assert.Empty(t, cmp.Diff(want, actual), "golden file mismatch (-want +got): %s, run \"make update-golden-files\", verify and commit the changes", goldenFile)
+}
+
+func dumpFileSystem(t *testing.T, fs afero.Fs) []byte {
+	var buffer bytes.Buffer
+	err := afero.Walk(fs, "/", func(path string, info os.FileInfo, err error) error {
+		_, _ = buffer.WriteString(path)
+		_ = buffer.WriteByte(' ')
+		if info.IsDir() {
+			_ = buffer.WriteByte('d')
+		} else {
+			_ = buffer.WriteByte('f')
+		}
+		_ = buffer.WriteByte('\n')
+		return nil
+	})
+	require.NoError(t, err, "can't dump the file system")
+	return buffer.Bytes()
+}
diff --git a/provisioner/terraform/diagnostic_test.go b/provisioner/terraform/diagnostic_test.go
index 836ae85e4915c..54b5b6c5c35d3 100644
--- a/provisioner/terraform/diagnostic_test.go
+++ b/provisioner/terraform/diagnostic_test.go
@@ -8,7 +8,7 @@ import (
 	tfjson "github.com/hashicorp/terraform-json"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/provisioner/terraform"
+	"github.com/coder/coder/v2/provisioner/terraform"
 )
 
 type hasDiagnostic struct {
diff --git a/provisioner/terraform/executor.go b/provisioner/terraform/executor.go
index c595d39f8043e..3917e4ca154fd 100644
--- a/provisioner/terraform/executor.go
+++ b/provisioner/terraform/executor.go
@@ -20,11 +20,12 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 type executor struct {
+	logger     slog.Logger
 	server     *server
 	mut        *sync.Mutex
 	binaryPath string
@@ -50,8 +51,10 @@ func (e *executor) execWriteOutput(ctx, killCtx context.Context, args, env []str
 	ctx, span := e.server.startTrace(ctx, fmt.Sprintf("exec - terraform %s", args[0]))
 	defer span.End()
 	span.SetAttributes(attribute.StringSlice("args", args))
+	e.logger.Debug(ctx, "starting command", slog.F("args", args))
 
 	defer func() {
+		e.logger.Debug(ctx, "closing writers", slog.Error(err))
 		closeErr := stdOutWriter.Close()
 		if err == nil && closeErr != nil {
 			err = closeErr
@@ -62,6 +65,7 @@ func (e *executor) execWriteOutput(ctx, killCtx context.Context, args, env []str
 		}
 	}()
 	if ctx.Err() != nil {
+		e.logger.Debug(ctx, "context canceled before command started", slog.F("args", args))
 		return ctx.Err()
 	}
 
@@ -84,13 +88,20 @@ func (e *executor) execWriteOutput(ctx, killCtx context.Context, args, env []str
 	cmd.Stdout = syncWriter{mut, stdOutWriter}
 	cmd.Stderr = syncWriter{mut, stdErrWriter}
 
+	e.server.logger.Debug(ctx, "executing terraform command",
+		slog.F("binary_path", e.binaryPath),
+		slog.F("args", args),
+	)
 	err = cmd.Start()
 	if err != nil {
+		e.logger.Debug(ctx, "failed to start command", slog.F("args", args))
 		return err
 	}
-	interruptCommandOnCancel(ctx, killCtx, cmd)
+	interruptCommandOnCancel(ctx, killCtx, e.logger, cmd)
 
-	return cmd.Wait()
+	err = cmd.Wait()
+	e.logger.Debug(ctx, "command done", slog.F("args", args), slog.Error(err))
+	return err
 }
 
 // execParseJSON must only be called while the lock is held.
@@ -116,7 +127,7 @@ func (e *executor) execParseJSON(ctx, killCtx context.Context, args, env []strin
 	if err != nil {
 		return err
 	}
-	interruptCommandOnCancel(ctx, killCtx, cmd)
+	interruptCommandOnCancel(ctx, killCtx, e.logger, cmd)
 
 	err = cmd.Wait()
 	if err != nil {
@@ -203,15 +214,23 @@ func (e *executor) init(ctx, killCtx context.Context, logr logSink) error {
 	return e.execWriteOutput(ctx, killCtx, args, e.basicEnv(), outWriter, errWriter)
 }
 
+func getPlanFilePath(workdir string) string {
+	return filepath.Join(workdir, "terraform.tfplan")
+}
+
+func getStateFilePath(workdir string) string {
+	return filepath.Join(workdir, "terraform.tfstate")
+}
+
 // revive:disable-next-line:flag-parameter
-func (e *executor) plan(ctx, killCtx context.Context, env, vars []string, logr logSink, destroy bool) (*proto.Provision_Response, error) {
+func (e *executor) plan(ctx, killCtx context.Context, env, vars []string, logr logSink, destroy bool) (*proto.PlanComplete, error) {
 	ctx, span := e.server.startTrace(ctx, tracing.FuncName())
 	defer span.End()
 
 	e.mut.Lock()
 	defer e.mut.Unlock()
 
-	planfilePath := filepath.Join(e.workdir, "terraform.tfplan")
+	planfilePath := getPlanFilePath(e.workdir)
 	args := []string{
 		"plan",
 		"-no-color",
@@ -244,22 +263,30 @@ func (e *executor) plan(ctx, killCtx context.Context, env, vars []string, logr l
 	if err != nil {
 		return nil, err
 	}
-	planFileByt, err := os.ReadFile(planfilePath)
-	if err != nil {
-		return nil, err
-	}
-	return &proto.Provision_Response{
-		Type: &proto.Provision_Response_Complete{
-			Complete: &proto.Provision_Complete{
-				Parameters:       state.Parameters,
-				Resources:        state.Resources,
-				GitAuthProviders: state.GitAuthProviders,
-				Plan:             planFileByt,
-			},
-		},
+	return &proto.PlanComplete{
+		Parameters:            state.Parameters,
+		Resources:             state.Resources,
+		ExternalAuthProviders: state.ExternalAuthProviders,
 	}, nil
 }
 
+func onlyDataResources(sm tfjson.StateModule) tfjson.StateModule {
+	filtered := sm
+	filtered.Resources = []*tfjson.StateResource{}
+	for _, r := range sm.Resources {
+		if r.Mode == "data" {
+			filtered.Resources = append(filtered.Resources, r)
+		}
+	}
+
+	filtered.ChildModules = []*tfjson.StateModule{}
+	for _, c := range sm.ChildModules {
+		filteredChild := onlyDataResources(*c)
+		filtered.ChildModules = append(filtered.ChildModules, &filteredChild)
+	}
+	return filtered
+}
+
 // planResources must only be called while the lock is held.
 func (e *executor) planResources(ctx, killCtx context.Context, planfilePath string) (*State, error) {
 	ctx, span := e.server.startTrace(ctx, tracing.FuncName())
@@ -276,7 +303,15 @@ func (e *executor) planResources(ctx, killCtx context.Context, planfilePath stri
 	}
 	modules := []*tfjson.StateModule{}
 	if plan.PriorState != nil {
-		modules = append(modules, plan.PriorState.Values.RootModule)
+		// We need the data resources for rich parameters. For some reason, they
+		// only show up in the PriorState.
+		//
+		// We don't want all prior resources, because Quotas (and
+		// future features) would never know which resources are getting
+		// deleted by a stop.
+
+		filtered := onlyDataResources(*plan.PriorState.Values.RootModule)
+		modules = append(modules, &filtered)
 	}
 	modules = append(modules, plan.PlannedValues.RootModule)
 
@@ -317,7 +352,7 @@ func (e *executor) graph(ctx, killCtx context.Context) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	interruptCommandOnCancel(ctx, killCtx, cmd)
+	interruptCommandOnCancel(ctx, killCtx, e.logger, cmd)
 
 	err = cmd.Wait()
 	if err != nil {
@@ -328,33 +363,22 @@ func (e *executor) graph(ctx, killCtx context.Context) (string, error) {
 
 func (e *executor) apply(
 	ctx, killCtx context.Context,
-	plan []byte,
 	env []string,
 	logr logSink,
-) (*proto.Provision_Response, error) {
+) (*proto.ApplyComplete, error) {
 	ctx, span := e.server.startTrace(ctx, tracing.FuncName())
 	defer span.End()
 
 	e.mut.Lock()
 	defer e.mut.Unlock()
 
-	planFile, err := os.CreateTemp("", "coder-terrafrom-plan")
-	if err != nil {
-		return nil, xerrors.Errorf("create plan file: %w", err)
-	}
-	_, err = planFile.Write(plan)
-	if err != nil {
-		return nil, xerrors.Errorf("write plan file: %w", err)
-	}
-	defer os.Remove(planFile.Name())
-
 	args := []string{
 		"apply",
 		"-no-color",
 		"-auto-approve",
 		"-input=false",
 		"-json",
-		planFile.Name(),
+		getPlanFilePath(e.workdir),
 	}
 
 	outWriter, doneOut := provisionLogWriter(logr)
@@ -366,7 +390,7 @@ func (e *executor) apply(
 		<-doneErr
 	}()
 
-	err = e.execWriteOutput(ctx, killCtx, args, env, outWriter, errWriter)
+	err := e.execWriteOutput(ctx, killCtx, args, env, outWriter, errWriter)
 	if err != nil {
 		return nil, xerrors.Errorf("terraform apply: %w", err)
 	}
@@ -379,15 +403,11 @@ func (e *executor) apply(
 	if err != nil {
 		return nil, xerrors.Errorf("read statefile %q: %w", statefilePath, err)
 	}
-	return &proto.Provision_Response{
-		Type: &proto.Provision_Response_Complete{
-			Complete: &proto.Provision_Complete{
-				Parameters:       state.Parameters,
-				Resources:        state.Resources,
-				GitAuthProviders: state.GitAuthProviders,
-				State:            stateContent,
-			},
-		},
+	return &proto.ApplyComplete{
+		Parameters:            state.Parameters,
+		Resources:             state.Resources,
+		ExternalAuthProviders: state.ExternalAuthProviders,
+		State:                 stateContent,
 	}, nil
 }
 
@@ -432,48 +452,28 @@ func (e *executor) state(ctx, killCtx context.Context) (*tfjson.State, error) {
 	return state, nil
 }
 
-func interruptCommandOnCancel(ctx, killCtx context.Context, cmd *exec.Cmd) {
+func interruptCommandOnCancel(ctx, killCtx context.Context, logger slog.Logger, cmd *exec.Cmd) {
 	go func() {
 		select {
 		case <-ctx.Done():
+			var err error
 			switch runtime.GOOS {
 			case "windows":
 				// Interrupts aren't supported by Windows.
-				_ = cmd.Process.Kill()
+				err = cmd.Process.Kill()
 			default:
-				_ = cmd.Process.Signal(os.Interrupt)
+				err = cmd.Process.Signal(os.Interrupt)
 			}
+			logger.Debug(ctx, "interrupted command", slog.F("args", cmd.Args), slog.Error(err))
 
 		case <-killCtx.Done():
+			logger.Debug(ctx, "kill context ended", slog.F("args", cmd.Args))
 		}
 	}()
 }
 
 type logSink interface {
-	Log(*proto.Log)
-}
-
-type streamLogSink struct {
-	// Any errors writing to the stream will be logged to logger.
-	logger slog.Logger
-	stream proto.DRPCProvisioner_ProvisionStream
-}
-
-var _ logSink = streamLogSink{}
-
-func (s streamLogSink) Log(l *proto.Log) {
-	err := s.stream.Send(&proto.Provision_Response{
-		Type: &proto.Provision_Response_Log{
-			Log: l,
-		},
-	})
-	if err != nil {
-		s.logger.Warn(context.Background(), "write log to stream",
-			slog.F("level", l.Level.String()),
-			slog.F("message", l.Output),
-			slog.Error(err),
-		)
-	}
+	ProvisionLog(l proto.LogLevel, o string)
 }
 
 // logWriter creates a WriteCloser that will log each line of text at the given level.  The WriteCloser must be closed
@@ -497,7 +497,7 @@ func readAndLog(sink logSink, r io.Reader, done chan<- any, level proto.LogLevel
 				continue
 			}
 
-			sink.Log(&proto.Log{Level: level, Output: scanner.Text()})
+			sink.ProvisionLog(level, scanner.Text())
 			continue
 		}
 
@@ -514,7 +514,7 @@ func readAndLog(sink logSink, r io.Reader, done chan<- any, level proto.LogLevel
 		if logLevel == proto.LogLevel_INFO {
 			logLevel = proto.LogLevel_DEBUG
 		}
-		sink.Log(&proto.Log{Level: logLevel, Output: log.Message})
+		sink.ProvisionLog(logLevel, log.Message)
 	}
 }
 
@@ -559,7 +559,7 @@ func provisionReadAndLog(sink logSink, r io.Reader, done chan<- any) {
 		}
 
 		logLevel := convertTerraformLogLevel(log.Level, sink)
-		sink.Log(&proto.Log{Level: logLevel, Output: log.Message})
+		sink.ProvisionLog(logLevel, log.Message)
 
 		// If the diagnostic is provided, let's provide a bit more info!
 		if log.Diagnostic == nil {
@@ -567,7 +567,7 @@ func provisionReadAndLog(sink logSink, r io.Reader, done chan<- any) {
 		}
 		logLevel = convertTerraformLogLevel(string(log.Diagnostic.Severity), sink)
 		for _, diagLine := range strings.Split(FormatDiagnostic(log.Diagnostic), "\n") {
-			sink.Log(&proto.Log{Level: logLevel, Output: diagLine})
+			sink.ProvisionLog(logLevel, diagLine)
 		}
 	}
 }
@@ -585,10 +585,7 @@ func convertTerraformLogLevel(logLevel string, sink logSink) proto.LogLevel {
 	case "error":
 		return proto.LogLevel_ERROR
 	default:
-		sink.Log(&proto.Log{
-			Level:  proto.LogLevel_WARN,
-			Output: fmt.Sprintf("unable to convert log level %s", logLevel),
-		})
+		sink.ProvisionLog(proto.LogLevel_WARN, fmt.Sprintf("unable to convert log level %s", logLevel))
 		return proto.LogLevel_INFO
 	}
 }
diff --git a/provisioner/terraform/executor_internal_test.go b/provisioner/terraform/executor_internal_test.go
index 7c9d6d6f082e5..97cb5285372f2 100644
--- a/provisioner/terraform/executor_internal_test.go
+++ b/provisioner/terraform/executor_internal_test.go
@@ -1,11 +1,13 @@
 package terraform
 
 import (
+	"encoding/json"
 	"testing"
 
+	tfjson "github.com/hashicorp/terraform-json"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 type mockLogger struct {
@@ -14,8 +16,8 @@ type mockLogger struct {
 
 var _ logSink = &mockLogger{}
 
-func (m *mockLogger) Log(l *proto.Log) {
-	m.logs = append(m.logs, l)
+func (m *mockLogger) ProvisionLog(l proto.LogLevel, o string) {
+	m.logs = append(m.logs, &proto.Log{Level: l, Output: o})
 }
 
 func TestLogWriter_Mainline(t *testing.T) {
@@ -41,3 +43,133 @@ From standing in the English rain`))
 	}
 	require.Equal(t, expected, logr.logs)
 }
+
+func TestOnlyDataResources(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		stateMod *tfjson.StateModule
+		expected *tfjson.StateModule
+	}{
+		{
+			name:     "empty state module",
+			stateMod: &tfjson.StateModule{},
+			expected: &tfjson.StateModule{},
+		},
+		{
+			name: "only data resources",
+			stateMod: &tfjson.StateModule{
+				Resources: []*tfjson.StateResource{
+					{Name: "cat", Type: "coder_parameter", Mode: "data", Address: "cat-address"},
+					{Name: "cow", Type: "foobaz", Mode: "data", Address: "cow-address"},
+				},
+				ChildModules: []*tfjson.StateModule{
+					{
+						Resources: []*tfjson.StateResource{
+							{Name: "child-cat", Type: "coder_parameter", Mode: "data", Address: "child-cat-address"},
+							{Name: "child-dog", Type: "foobar", Mode: "data", Address: "child-dog-address"},
+						},
+						Address: "child-module-1",
+					},
+				},
+				Address: "fake-module",
+			},
+			expected: &tfjson.StateModule{
+				Resources: []*tfjson.StateResource{
+					{Name: "cat", Type: "coder_parameter", Mode: "data", Address: "cat-address"},
+					{Name: "cow", Type: "foobaz", Mode: "data", Address: "cow-address"},
+				},
+				ChildModules: []*tfjson.StateModule{
+					{
+						Resources: []*tfjson.StateResource{
+							{Name: "child-cat", Type: "coder_parameter", Mode: "data", Address: "child-cat-address"},
+							{Name: "child-dog", Type: "foobar", Mode: "data", Address: "child-dog-address"},
+						},
+						Address: "child-module-1",
+					},
+				},
+				Address: "fake-module",
+			},
+		},
+		{
+			name: "only non-data resources",
+			stateMod: &tfjson.StateModule{
+				Resources: []*tfjson.StateResource{
+					{Name: "cat", Type: "coder_parameter", Mode: "foobar", Address: "cat-address"},
+					{Name: "cow", Type: "foobaz", Mode: "foo", Address: "cow-address"},
+				},
+				ChildModules: []*tfjson.StateModule{
+					{
+						Resources: []*tfjson.StateResource{
+							{Name: "child-cat", Type: "coder_parameter", Mode: "foobar", Address: "child-cat-address"},
+							{Name: "child-dog", Type: "foobar", Mode: "foobaz", Address: "child-dog-address"},
+						},
+						Address: "child-module-1",
+					},
+				},
+				Address: "fake-module",
+			},
+			expected: &tfjson.StateModule{
+				Address: "fake-module",
+				ChildModules: []*tfjson.StateModule{
+					{Address: "child-module-1"},
+				},
+			},
+		},
+		{
+			name: "mixed resources",
+			stateMod: &tfjson.StateModule{
+				Resources: []*tfjson.StateResource{
+					{Name: "cat", Type: "coder_parameter", Mode: "data", Address: "cat-address"},
+					{Name: "dog", Type: "foobar", Mode: "magic", Address: "dog-address"},
+					{Name: "cow", Type: "foobaz", Mode: "data", Address: "cow-address"},
+				},
+				ChildModules: []*tfjson.StateModule{
+					{
+						Resources: []*tfjson.StateResource{
+							{Name: "child-cat", Type: "coder_parameter", Mode: "data", Address: "child-cat-address"},
+							{Name: "child-dog", Type: "foobar", Mode: "data", Address: "child-dog-address"},
+							{Name: "child-cow", Type: "foobaz", Mode: "magic", Address: "child-cow-address"},
+						},
+						Address: "child-module-1",
+					},
+				},
+				Address: "fake-module",
+			},
+			expected: &tfjson.StateModule{
+				Resources: []*tfjson.StateResource{
+					{Name: "cat", Type: "coder_parameter", Mode: "data", Address: "cat-address"},
+					{Name: "cow", Type: "foobaz", Mode: "data", Address: "cow-address"},
+				},
+				ChildModules: []*tfjson.StateModule{
+					{
+						Resources: []*tfjson.StateResource{
+							{Name: "child-cat", Type: "coder_parameter", Mode: "data", Address: "child-cat-address"},
+							{Name: "child-dog", Type: "foobar", Mode: "data", Address: "child-dog-address"},
+						},
+						Address: "child-module-1",
+					},
+				},
+				Address: "fake-module",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			filtered := onlyDataResources(*tt.stateMod)
+
+			expected, err := json.Marshal(tt.expected)
+			require.NoError(t, err)
+			got, err := json.Marshal(filtered)
+			require.NoError(t, err)
+
+			require.Equal(t, string(expected), string(got))
+		})
+	}
+}
diff --git a/provisioner/terraform/install_test.go b/provisioner/terraform/install_test.go
index 67f7a5ddb1188..700ae237b1c9e 100644
--- a/provisioner/terraform/install_test.go
+++ b/provisioner/terraform/install_test.go
@@ -17,7 +17,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/provisioner/terraform"
+	"github.com/coder/coder/v2/provisioner/terraform"
 )
 
 func TestInstall(t *testing.T) {
diff --git a/provisioner/terraform/parse.go b/provisioner/terraform/parse.go
index dc57cde28a591..10ab7b801b071 100644
--- a/provisioner/terraform/parse.go
+++ b/provisioner/terraform/parse.go
@@ -11,19 +11,21 @@ import (
 	"github.com/mitchellh/go-wordwrap"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 // Parse extracts Terraform variables from source-code.
-func (s *server) Parse(request *proto.Parse_Request, stream proto.DRPCProvisioner_ParseStream) error {
-	_, span := s.startTrace(stream.Context(), tracing.FuncName())
+func (s *server) Parse(sess *provisionersdk.Session, _ *proto.ParseRequest, _ <-chan struct{}) *proto.ParseComplete {
+	ctx := sess.Context()
+	_, span := s.startTrace(ctx, tracing.FuncName())
 	defer span.End()
 
 	// Load the module and print any parse errors.
-	module, diags := tfconfig.LoadModule(request.Directory)
+	module, diags := tfconfig.LoadModule(sess.WorkDirectory)
 	if diags.HasErrors() {
-		return xerrors.Errorf("load module: %s", formatDiagnostics(request.Directory, diags))
+		return provisionersdk.ParseErrorf("load module: %s", formatDiagnostics(sess.WorkDirectory, diags))
 	}
 
 	// Sort variables by (filename, line) to make the ordering consistent
@@ -40,17 +42,13 @@ func (s *server) Parse(request *proto.Parse_Request, stream proto.DRPCProvisione
 	for _, v := range variables {
 		mv, err := convertTerraformVariable(v)
 		if err != nil {
-			return xerrors.Errorf("can't convert the Terraform variable to a managed one: %w", err)
+			return provisionersdk.ParseErrorf("can't convert the Terraform variable to a managed one: %s", err)
 		}
 		templateVariables = append(templateVariables, mv)
 	}
-	return stream.Send(&proto.Parse_Response{
-		Type: &proto.Parse_Response_Complete{
-			Complete: &proto.Parse_Complete{
-				TemplateVariables: templateVariables,
-			},
-		},
-	})
+	return &proto.ParseComplete{
+		TemplateVariables: templateVariables,
+	}
 }
 
 // Converts a Terraform variable to a template-wide variable, processed by Coder.
diff --git a/provisioner/terraform/parse_test.go b/provisioner/terraform/parse_test.go
index e82bcba470857..c28532af25831 100644
--- a/provisioner/terraform/parse_test.go
+++ b/provisioner/terraform/parse_test.go
@@ -4,13 +4,11 @@ package terraform_test
 
 import (
 	"encoding/json"
-	"os"
-	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 func TestParse(t *testing.T) {
@@ -21,9 +19,8 @@ func TestParse(t *testing.T) {
 	testCases := []struct {
 		Name     string
 		Files    map[string]string
-		Response *proto.Parse_Response
-		// If ErrorContains is not empty, then response.Recv() should return an
-		// error containing this string before a Complete response is returned.
+		Response *proto.ParseComplete
+		// If ErrorContains is not empty, then the ParseComplete should have an Error containing the given string
 		ErrorContains string
 	}{
 		{
@@ -33,16 +30,12 @@ func TestParse(t *testing.T) {
 				description = "Testing!"
 			}`,
 			},
-			Response: &proto.Parse_Response{
-				Type: &proto.Parse_Response_Complete{
-					Complete: &proto.Parse_Complete{
-						TemplateVariables: []*proto.TemplateVariable{
-							{
-								Name:        "A",
-								Description: "Testing!",
-								Required:    true,
-							},
-						},
+			Response: &proto.ParseComplete{
+				TemplateVariables: []*proto.TemplateVariable{
+					{
+						Name:        "A",
+						Description: "Testing!",
+						Required:    true,
 					},
 				},
 			},
@@ -54,15 +47,11 @@ func TestParse(t *testing.T) {
 				default = "wow"
 			}`,
 			},
-			Response: &proto.Parse_Response{
-				Type: &proto.Parse_Response_Complete{
-					Complete: &proto.Parse_Complete{
-						TemplateVariables: []*proto.TemplateVariable{
-							{
-								Name:         "A",
-								DefaultValue: "wow",
-							},
-						},
+			Response: &proto.ParseComplete{
+				TemplateVariables: []*proto.TemplateVariable{
+					{
+						Name:         "A",
+						DefaultValue: "wow",
 					},
 				},
 			},
@@ -76,15 +65,11 @@ func TestParse(t *testing.T) {
 				}
 			}`,
 			},
-			Response: &proto.Parse_Response{
-				Type: &proto.Parse_Response_Complete{
-					Complete: &proto.Parse_Complete{
-						TemplateVariables: []*proto.TemplateVariable{
-							{
-								Name:     "A",
-								Required: true,
-							},
-						},
+			Response: &proto.ParseComplete{
+				TemplateVariables: []*proto.TemplateVariable{
+					{
+						Name:     "A",
+						Required: true,
 					},
 				},
 			},
@@ -104,27 +89,23 @@ func TestParse(t *testing.T) {
 				"main2.tf": `variable "baz" { }
 				variable "quux" { }`,
 			},
-			Response: &proto.Parse_Response{
-				Type: &proto.Parse_Response_Complete{
-					Complete: &proto.Parse_Complete{
-						TemplateVariables: []*proto.TemplateVariable{
-							{
-								Name:     "foo",
-								Required: true,
-							},
-							{
-								Name:     "bar",
-								Required: true,
-							},
-							{
-								Name:     "baz",
-								Required: true,
-							},
-							{
-								Name:     "quux",
-								Required: true,
-							},
-						},
+			Response: &proto.ParseComplete{
+				TemplateVariables: []*proto.TemplateVariable{
+					{
+						Name:     "foo",
+						Required: true,
+					},
+					{
+						Name:     "bar",
+						Required: true,
+					},
+					{
+						Name:     "baz",
+						Required: true,
+					},
+					{
+						Name:     "quux",
+						Required: true,
 					},
 				},
 			},
@@ -139,19 +120,15 @@ func TestParse(t *testing.T) {
 				sensitive = true
 			}`,
 			},
-			Response: &proto.Parse_Response{
-				Type: &proto.Parse_Response_Complete{
-					Complete: &proto.Parse_Complete{
-						TemplateVariables: []*proto.TemplateVariable{
-							{
-								Name:         "A",
-								Description:  "Testing!",
-								Type:         "bool",
-								DefaultValue: "true",
-								Required:     false,
-								Sensitive:    true,
-							},
-						},
+			Response: &proto.ParseComplete{
+				TemplateVariables: []*proto.TemplateVariable{
+					{
+						Name:         "A",
+						Description:  "Testing!",
+						Type:         "bool",
+						DefaultValue: "true",
+						Required:     false,
+						Sensitive:    true,
 					},
 				},
 			},
@@ -166,19 +143,15 @@ func TestParse(t *testing.T) {
 				sensitive = true
 			}`,
 			},
-			Response: &proto.Parse_Response{
-				Type: &proto.Parse_Response_Complete{
-					Complete: &proto.Parse_Complete{
-						TemplateVariables: []*proto.TemplateVariable{
-							{
-								Name:         "A",
-								Description:  "Testing!",
-								Type:         "string",
-								DefaultValue: "abc",
-								Required:     false,
-								Sensitive:    true,
-							},
-						},
+			Response: &proto.ParseComplete{
+				TemplateVariables: []*proto.TemplateVariable{
+					{
+						Name:         "A",
+						Description:  "Testing!",
+						Type:         "string",
+						DefaultValue: "abc",
+						Required:     false,
+						Sensitive:    true,
 					},
 				},
 			},
@@ -193,19 +166,15 @@ func TestParse(t *testing.T) {
 				sensitive = true
 			}`,
 			},
-			Response: &proto.Parse_Response{
-				Type: &proto.Parse_Response_Complete{
-					Complete: &proto.Parse_Complete{
-						TemplateVariables: []*proto.TemplateVariable{
-							{
-								Name:         "A",
-								Description:  "Testing!",
-								Type:         "string",
-								DefaultValue: "",
-								Required:     false,
-								Sensitive:    true,
-							},
-						},
+			Response: &proto.ParseComplete{
+				TemplateVariables: []*proto.TemplateVariable{
+					{
+						Name:         "A",
+						Description:  "Testing!",
+						Type:         "string",
+						DefaultValue: "",
+						Required:     false,
+						Sensitive:    true,
 					},
 				},
 			},
@@ -219,19 +188,15 @@ func TestParse(t *testing.T) {
 				sensitive = true
 			}`,
 			},
-			Response: &proto.Parse_Response{
-				Type: &proto.Parse_Response_Complete{
-					Complete: &proto.Parse_Complete{
-						TemplateVariables: []*proto.TemplateVariable{
-							{
-								Name:         "A",
-								Description:  "Testing!",
-								Type:         "string",
-								DefaultValue: "",
-								Required:     true,
-								Sensitive:    true,
-							},
-						},
+			Response: &proto.ParseComplete{
+				TemplateVariables: []*proto.TemplateVariable{
+					{
+						Name:         "A",
+						Description:  "Testing!",
+						Type:         "string",
+						DefaultValue: "",
+						Required:     true,
+						Sensitive:    true,
 					},
 				},
 			},
@@ -243,40 +208,31 @@ func TestParse(t *testing.T) {
 		t.Run(testCase.Name, func(t *testing.T) {
 			t.Parallel()
 
-			// Write all files to the temporary test directory.
-			directory := t.TempDir()
-			for path, content := range testCase.Files {
-				err := os.WriteFile(filepath.Join(directory, path), []byte(content), 0o600)
-				require.NoError(t, err)
-			}
-
-			response, err := api.Parse(ctx, &proto.Parse_Request{
-				Directory: directory,
+			session := configure(ctx, t, api, &proto.Config{
+				TemplateSourceArchive: makeTar(t, testCase.Files),
 			})
+
+			err := session.Send(&proto.Request{Type: &proto.Request_Parse{Parse: &proto.ParseRequest{}}})
 			require.NoError(t, err)
 
 			for {
-				msg, err := response.Recv()
-				if err != nil {
-					if testCase.ErrorContains != "" {
-						require.ErrorContains(t, err, testCase.ErrorContains)
-						break
-					}
+				msg, err := session.Recv()
+				require.NoError(t, err)
 
-					require.NoError(t, err)
+				if testCase.ErrorContains != "" {
+					require.Contains(t, msg.GetParse().GetError(), testCase.ErrorContains)
+					break
 				}
 
-				if msg.GetComplete() == nil {
+				// Ignore logs in this test
+				if msg.GetLog() != nil {
 					continue
 				}
-				if testCase.ErrorContains != "" {
-					t.Fatal("expected error but job completed successfully")
-				}
 
 				// Ensure the want and got are equivalent!
 				want, err := json.Marshal(testCase.Response)
 				require.NoError(t, err)
-				got, err := json.Marshal(msg)
+				got, err := json.Marshal(msg.GetParse())
 				require.NoError(t, err)
 
 				require.Equal(t, string(want), string(got))
diff --git a/provisioner/terraform/provision.go b/provisioner/terraform/provision.go
index 5d249a30b30f6..e980a26d833fc 100644
--- a/provisioner/terraform/provision.go
+++ b/provisioner/terraform/provision.go
@@ -4,60 +4,38 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"path/filepath"
 	"strings"
 	"time"
 
-	"golang.org/x/xerrors"
+	"github.com/spf13/afero"
 
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/provisionersdk"
-	"github.com/coder/coder/provisionersdk/proto"
+	"cdr.dev/slog"
 	"github.com/coder/terraform-provider-coder/provider"
-)
-
-// Provision executes `terraform apply` or `terraform plan` for dry runs.
-func (s *server) Provision(stream proto.DRPCProvisioner_ProvisionStream) error {
-	ctx, span := s.startTrace(stream.Context(), tracing.FuncName())
-	defer span.End()
-
-	request, err := stream.Recv()
-	if err != nil {
-		return err
-	}
-	if request.GetCancel() != nil {
-		return nil
-	}
 
-	var (
-		applyRequest = request.GetApply()
-		planRequest  = request.GetPlan()
-	)
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+)
 
-	var config *proto.Provision_Config
-	if applyRequest == nil && planRequest == nil {
-		return nil
-	} else if applyRequest != nil {
-		config = applyRequest.Config
-	} else if planRequest != nil {
-		config = planRequest.Config
-	}
+const staleTerraformPluginRetention = 30 * 24 * time.Hour
 
-	// Create a context for graceful cancellation bound to the stream
+func (s *server) setupContexts(parent context.Context, canceledOrComplete <-chan struct{}) (
+	ctx context.Context, cancel func(), killCtx context.Context, kill func(),
+) {
+	// Create a context for graceful cancellation bound to the session
 	// context. This ensures that we will perform graceful cancellation
 	// even on connection loss.
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
+	ctx, cancel = context.WithCancel(parent)
 
 	// Create a separate context for forceful cancellation not tied to
 	// the stream so that we can control when to terminate the process.
-	killCtx, kill := context.WithCancel(context.Background())
-	defer kill()
+	killCtx, kill = context.WithCancel(context.Background())
 
 	// Ensure processes are eventually cleaned up on graceful
 	// cancellation or disconnect.
 	go func() {
 		<-ctx.Done()
+		s.logger.Debug(ctx, "graceful context done")
 
 		// TODO(mafredri): We should track this provision request as
 		// part of graceful server shutdown procedure. Waiting on a
@@ -66,134 +44,136 @@ func (s *server) Provision(stream proto.DRPCProvisioner_ProvisionStream) error {
 		defer t.Stop()
 		select {
 		case <-t.C:
+			s.logger.Debug(ctx, "exit timeout hit")
 			kill()
 		case <-killCtx.Done():
+			s.logger.Debug(ctx, "kill context done")
 		}
 	}()
 
+	// Process cancel
 	go func() {
-		for {
-			request, err := stream.Recv()
-			if err != nil {
-				return
-			}
-			if request.GetCancel() == nil {
-				// We only process cancellation requests here.
-				continue
-			}
-			cancel()
-			return
-		}
+		<-canceledOrComplete
+		s.logger.Debug(ctx, "canceledOrComplete closed")
+		cancel()
 	}()
+	return ctx, cancel, killCtx, kill
+}
 
-	sink := streamLogSink{
-		logger: s.logger.Named("execution_logs"),
-		stream: stream,
-	}
-
-	e := s.executor(config.Directory)
-	if err = e.checkMinVersion(ctx); err != nil {
-		return err
-	}
-	logTerraformEnvVars(sink)
+func (s *server) Plan(
+	sess *provisionersdk.Session, request *proto.PlanRequest, canceledOrComplete <-chan struct{},
+) *proto.PlanComplete {
+	ctx, span := s.startTrace(sess.Context(), tracing.FuncName())
+	defer span.End()
+	ctx, cancel, killCtx, kill := s.setupContexts(ctx, canceledOrComplete)
+	defer cancel()
+	defer kill()
 
-	statefilePath := filepath.Join(config.Directory, "terraform.tfstate")
-	if len(config.State) > 0 {
-		err = os.WriteFile(statefilePath, config.State, 0o600)
-		if err != nil {
-			return xerrors.Errorf("write statefile %q: %w", statefilePath, err)
-		}
+	e := s.executor(sess.WorkDirectory)
+	if err := e.checkMinVersion(ctx); err != nil {
+		return provisionersdk.PlanErrorf(err.Error())
 	}
+	logTerraformEnvVars(sess)
 
 	// If we're destroying, exit early if there's no state. This is necessary to
 	// avoid any cases where a workspace is "locked out" of terraform due to
 	// e.g. bad template param values and cannot be deleted. This is just for
 	// contingency, in the future we will try harder to prevent workspaces being
 	// broken this hard.
-	if config.Metadata.WorkspaceTransition == proto.WorkspaceTransition_DESTROY && len(config.State) == 0 {
-		_ = stream.Send(&proto.Provision_Response{
-			Type: &proto.Provision_Response_Log{
-				Log: &proto.Log{
-					Level:  proto.LogLevel_INFO,
-					Output: "The terraform state does not exist, there is nothing to do",
-				},
-			},
-		})
+	if request.Metadata.GetWorkspaceTransition() == proto.WorkspaceTransition_DESTROY && len(sess.Config.State) == 0 {
+		sess.ProvisionLog(proto.LogLevel_INFO, "The terraform state does not exist, there is nothing to do")
+		return &proto.PlanComplete{}
+	}
+
+	statefilePath := getStateFilePath(sess.WorkDirectory)
+	if len(sess.Config.State) > 0 {
+		err := os.WriteFile(statefilePath, sess.Config.State, 0o600)
+		if err != nil {
+			return provisionersdk.PlanErrorf("write statefile %q: %s", statefilePath, err)
+		}
+	}
 
-		return stream.Send(&proto.Provision_Response{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{},
-			},
-		})
+	err := CleanStaleTerraformPlugins(sess.Context(), s.cachePath, afero.NewOsFs(), time.Now(), s.logger)
+	if err != nil {
+		return provisionersdk.PlanErrorf("unable to clean stale Terraform plugins: %s", err)
 	}
 
 	s.logger.Debug(ctx, "running initialization")
-	err = e.init(ctx, killCtx, sink)
+	err = e.init(ctx, killCtx, sess)
 	if err != nil {
-		if ctx.Err() != nil {
-			return stream.Send(&proto.Provision_Response{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Error: err.Error(),
-					},
-				},
-			})
-		}
-		return xerrors.Errorf("initialize terraform: %w", err)
+		s.logger.Debug(ctx, "init failed", slog.Error(err))
+		return provisionersdk.PlanErrorf("initialize terraform: %s", err)
 	}
 	s.logger.Debug(ctx, "ran initialization")
-	env, err := provisionEnv(config, request.GetPlan().GetRichParameterValues(), request.GetPlan().GetGitAuthProviders())
+
+	env, err := provisionEnv(sess.Config, request.Metadata, request.RichParameterValues, request.ExternalAuthProviders)
 	if err != nil {
-		return err
+		return provisionersdk.PlanErrorf("setup env: %s", err)
 	}
 
-	var resp *proto.Provision_Response
-	if planRequest != nil {
-		vars, err := planVars(planRequest)
-		if err != nil {
-			return err
-		}
+	vars, err := planVars(request)
+	if err != nil {
+		return provisionersdk.PlanErrorf("plan vars: %s", err)
+	}
 
-		resp, err = e.plan(
-			ctx, killCtx, env, vars, sink,
-			config.Metadata.WorkspaceTransition == proto.WorkspaceTransition_DESTROY,
-		)
-		if err != nil {
-			if ctx.Err() != nil {
-				return stream.Send(&proto.Provision_Response{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
-							Error: err.Error(),
-						},
-					},
-				})
-			}
-			return xerrors.Errorf("plan terraform: %w", err)
-		}
-		return stream.Send(resp)
+	resp, err := e.plan(
+		ctx, killCtx, env, vars, sess,
+		request.Metadata.GetWorkspaceTransition() == proto.WorkspaceTransition_DESTROY,
+	)
+	if err != nil {
+		return provisionersdk.PlanErrorf(err.Error())
 	}
-	// Must be apply
-	resp, err = e.apply(
-		ctx, killCtx, applyRequest.Plan, env, sink,
+	return resp
+}
+
+func (s *server) Apply(
+	sess *provisionersdk.Session, request *proto.ApplyRequest, canceledOrComplete <-chan struct{},
+) *proto.ApplyComplete {
+	ctx, span := s.startTrace(sess.Context(), tracing.FuncName())
+	defer span.End()
+	ctx, cancel, killCtx, kill := s.setupContexts(ctx, canceledOrComplete)
+	defer cancel()
+	defer kill()
+
+	e := s.executor(sess.WorkDirectory)
+	if err := e.checkMinVersion(ctx); err != nil {
+		return provisionersdk.ApplyErrorf(err.Error())
+	}
+	logTerraformEnvVars(sess)
+
+	// Exit early if there is no plan file. This is necessary to
+	// avoid any cases where a workspace is "locked out" of terraform due to
+	// e.g. bad template param values and cannot be deleted. This is just for
+	// contingency, in the future we will try harder to prevent workspaces being
+	// broken this hard.
+	if request.Metadata.GetWorkspaceTransition() == proto.WorkspaceTransition_DESTROY && len(sess.Config.State) == 0 {
+		sess.ProvisionLog(proto.LogLevel_INFO, "The terraform plan does not exist, there is nothing to do")
+		return &proto.ApplyComplete{}
+	}
+
+	// Earlier in the session, Plan() will have written the state file and the plan file.
+	statefilePath := getStateFilePath(sess.WorkDirectory)
+	env, err := provisionEnv(sess.Config, request.Metadata, nil, nil)
+	if err != nil {
+		return provisionersdk.ApplyErrorf("provision env: %s", err)
+	}
+	resp, err := e.apply(
+		ctx, killCtx, env, sess,
 	)
 	if err != nil {
 		errorMessage := err.Error()
 		// Terraform can fail and apply and still need to store it's state.
 		// In this case, we return Complete with an explicit error message.
 		stateData, _ := os.ReadFile(statefilePath)
-		return stream.Send(&proto.Provision_Response{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
-					State: stateData,
-					Error: errorMessage,
-				},
-			},
-		})
+		return &proto.ApplyComplete{
+			State: stateData,
+			Error: errorMessage,
+		}
 	}
-	return stream.Send(resp)
+	return resp
 }
 
-func planVars(plan *proto.Provision_Plan) ([]string, error) {
+func planVars(plan *proto.PlanRequest) ([]string, error) {
 	vars := []string{}
 	for _, variable := range plan.VariableValues {
 		vars = append(vars, fmt.Sprintf("%s=%s", variable.Name, variable.Value))
@@ -201,18 +181,24 @@ func planVars(plan *proto.Provision_Plan) ([]string, error) {
 	return vars, nil
 }
 
-func provisionEnv(config *proto.Provision_Config, richParams []*proto.RichParameterValue, gitAuth []*proto.GitAuthProvider) ([]string, error) {
+func provisionEnv(
+	config *proto.Config, metadata *proto.Metadata,
+	richParams []*proto.RichParameterValue, externalAuth []*proto.ExternalAuthProvider,
+) ([]string, error) {
 	env := safeEnviron()
 	env = append(env,
-		"CODER_AGENT_URL="+config.Metadata.CoderUrl,
-		"CODER_WORKSPACE_TRANSITION="+strings.ToLower(config.Metadata.WorkspaceTransition.String()),
-		"CODER_WORKSPACE_NAME="+config.Metadata.WorkspaceName,
-		"CODER_WORKSPACE_OWNER="+config.Metadata.WorkspaceOwner,
-		"CODER_WORKSPACE_OWNER_EMAIL="+config.Metadata.WorkspaceOwnerEmail,
-		"CODER_WORKSPACE_OWNER_OIDC_ACCESS_TOKEN="+config.Metadata.WorkspaceOwnerOidcAccessToken,
-		"CODER_WORKSPACE_ID="+config.Metadata.WorkspaceId,
-		"CODER_WORKSPACE_OWNER_ID="+config.Metadata.WorkspaceOwnerId,
-		"CODER_WORKSPACE_OWNER_SESSION_TOKEN="+config.Metadata.WorkspaceOwnerSessionToken,
+		"CODER_AGENT_URL="+metadata.GetCoderUrl(),
+		"CODER_WORKSPACE_TRANSITION="+strings.ToLower(metadata.GetWorkspaceTransition().String()),
+		"CODER_WORKSPACE_NAME="+metadata.GetWorkspaceName(),
+		"CODER_WORKSPACE_OWNER="+metadata.GetWorkspaceOwner(),
+		"CODER_WORKSPACE_OWNER_EMAIL="+metadata.GetWorkspaceOwnerEmail(),
+		"CODER_WORKSPACE_OWNER_OIDC_ACCESS_TOKEN="+metadata.GetWorkspaceOwnerOidcAccessToken(),
+		"CODER_WORKSPACE_ID="+metadata.GetWorkspaceId(),
+		"CODER_WORKSPACE_OWNER_ID="+metadata.GetWorkspaceOwnerId(),
+		"CODER_WORKSPACE_OWNER_SESSION_TOKEN="+metadata.GetWorkspaceOwnerSessionToken(),
+		"CODER_WORKSPACE_TEMPLATE_ID="+metadata.GetTemplateId(),
+		"CODER_WORKSPACE_TEMPLATE_NAME="+metadata.GetTemplateName(),
+		"CODER_WORKSPACE_TEMPLATE_VERSION="+metadata.GetTemplateVersion(),
 	)
 	for key, value := range provisionersdk.AgentScriptEnv() {
 		env = append(env, key+"="+value)
@@ -220,8 +206,9 @@ func provisionEnv(config *proto.Provision_Config, richParams []*proto.RichParame
 	for _, param := range richParams {
 		env = append(env, provider.ParameterEnvironmentVariable(param.Name)+"="+param.Value)
 	}
-	for _, gitAuth := range gitAuth {
-		env = append(env, provider.GitAuthAccessTokenEnvironmentVariable(gitAuth.Id)+"="+gitAuth.AccessToken)
+	for _, extAuth := range externalAuth {
+		env = append(env, provider.GitAuthAccessTokenEnvironmentVariable(extAuth.Id)+"="+extAuth.AccessToken)
+		env = append(env, provider.ExternalAuthAccessTokenEnvironmentVariable(extAuth.Id)+"="+extAuth.AccessToken)
 	}
 
 	if config.ProvisionerLogLevel != "" {
@@ -258,10 +245,10 @@ func logTerraformEnvVars(sink logSink) {
 			if !tfEnvSafeToPrint[parts[0]] {
 				parts[1] = "<value redacted>"
 			}
-			sink.Log(&proto.Log{
-				Level:  proto.LogLevel_WARN,
-				Output: fmt.Sprintf("terraform environment variable: %s=%s", parts[0], parts[1]),
-			})
+			sink.ProvisionLog(
+				proto.LogLevel_WARN,
+				fmt.Sprintf("terraform environment variable: %s=%s", parts[0], parts[1]),
+			)
 		}
 	}
 }
diff --git a/provisioner/terraform/provision_test.go b/provisioner/terraform/provision_test.go
index c882807a8d434..c85604a86cdb1 100644
--- a/provisioner/terraform/provision_test.go
+++ b/provisioner/terraform/provision_test.go
@@ -3,6 +3,8 @@
 package terraform_test
 
 import (
+	"archive/tar"
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -20,9 +22,9 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/provisioner/terraform"
-	"github.com/coder/coder/provisionersdk"
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/provisioner/terraform"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 type provisionerServeOptions struct {
@@ -35,6 +37,7 @@ func setupProvisioner(t *testing.T, opts *provisionerServeOptions) (context.Cont
 		opts = &provisionerServeOptions{}
 	}
 	cachePath := t.TempDir()
+	workDir := t.TempDir()
 	client, server := provisionersdk.MemTransportPipe()
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	serverErr := make(chan error, 1)
@@ -50,40 +53,75 @@ func setupProvisioner(t *testing.T, opts *provisionerServeOptions) (context.Cont
 	go func() {
 		serverErr <- terraform.Serve(ctx, &terraform.ServeOptions{
 			ServeOptions: &provisionersdk.ServeOptions{
-				Listener: server,
+				Listener:      server,
+				Logger:        slogtest.Make(t, nil).Leveled(slog.LevelDebug),
+				WorkDirectory: workDir,
 			},
 			BinaryPath:  opts.binaryPath,
 			CachePath:   cachePath,
-			Logger:      slogtest.Make(t, nil).Leveled(slog.LevelDebug),
 			ExitTimeout: opts.exitTimeout,
 		})
 	}()
 	api := proto.NewDRPCProvisionerClient(client)
+
 	return ctx, api
 }
 
-func readProvisionLog(t *testing.T, response proto.DRPCProvisioner_ProvisionClient) (
-	string,
-	*proto.Provision_Complete,
-) {
-	var (
-		logBuf strings.Builder
-		c      *proto.Provision_Complete
-	)
+func makeTar(t *testing.T, files map[string]string) []byte {
+	t.Helper()
+	var buffer bytes.Buffer
+	writer := tar.NewWriter(&buffer)
+	for name, content := range files {
+		err := writer.WriteHeader(&tar.Header{
+			Name: name,
+			Size: int64(len(content)),
+			Mode: 0o644,
+		})
+		require.NoError(t, err)
+		_, err = writer.Write([]byte(content))
+		require.NoError(t, err)
+	}
+	err := writer.Flush()
+	require.NoError(t, err)
+	return buffer.Bytes()
+}
+
+func configure(ctx context.Context, t *testing.T, client proto.DRPCProvisionerClient, config *proto.Config) proto.DRPCProvisioner_SessionClient {
+	t.Helper()
+	sess, err := client.Session(ctx)
+	require.NoError(t, err)
+	err = sess.Send(&proto.Request{Type: &proto.Request_Config{Config: config}})
+	require.NoError(t, err)
+	return sess
+}
+
+func readProvisionLog(t *testing.T, response proto.DRPCProvisioner_SessionClient) string {
+	var logBuf strings.Builder
 	for {
 		msg, err := response.Recv()
 		require.NoError(t, err)
 
 		if log := msg.GetLog(); log != nil {
 			t.Log(log.Level.String(), log.Output)
-			_, _ = logBuf.WriteString(log.Output)
-		}
-		if c = msg.GetComplete(); c != nil {
-			require.Empty(t, c.Error)
-			break
+			_, err = logBuf.WriteString(log.Output)
+			require.NoError(t, err)
+			continue
 		}
+		break
 	}
-	return logBuf.String(), c
+	return logBuf.String()
+}
+
+func sendPlan(sess proto.DRPCProvisioner_SessionClient, transition proto.WorkspaceTransition) error {
+	return sess.Send(&proto.Request{Type: &proto.Request_Plan{Plan: &proto.PlanRequest{
+		Metadata: &proto.Metadata{WorkspaceTransition: transition},
+	}}})
+}
+
+func sendApply(sess proto.DRPCProvisioner_SessionClient, transition proto.WorkspaceTransition) error {
+	return sess.Send(&proto.Request{Type: &proto.Request_Apply{Apply: &proto.ApplyRequest{
+		Metadata: &proto.Metadata{WorkspaceTransition: transition},
+	}}})
 }
 
 func TestProvision_Cancel(t *testing.T) {
@@ -109,9 +147,10 @@ func TestProvision_Cancel(t *testing.T) {
 			wantLog:       []string{"interrupt", "exit"},
 		},
 		{
-			name:          "Cancel apply",
-			mode:          "apply",
-			startSequence: []string{"init", "apply_start"},
+			// Provisioner requires a plan before an apply, so test cancel with plan.
+			name:          "Cancel plan",
+			mode:          "plan",
+			startSequence: []string{"init", "plan_start"},
 			wantLog:       []string{"interrupt", "exit"},
 		},
 	}
@@ -131,24 +170,16 @@ func TestProvision_Cancel(t *testing.T) {
 			ctx, api := setupProvisioner(t, &provisionerServeOptions{
 				binaryPath: binPath,
 			})
-
-			response, err := api.Provision(ctx)
-			require.NoError(t, err)
-			err = response.Send(&proto.Provision_Request{
-				Type: &proto.Provision_Request_Apply{
-					Apply: &proto.Provision_Apply{
-						Config: &proto.Provision_Config{
-							Directory: dir,
-							Metadata:  &proto.Provision_Metadata{},
-						},
-					},
-				},
+			sess := configure(ctx, t, api, &proto.Config{
+				TemplateSourceArchive: makeTar(t, nil),
 			})
+
+			err = sendPlan(sess, proto.WorkspaceTransition_START)
 			require.NoError(t, err)
 
 			for _, line := range tt.startSequence {
 			LoopStart:
-				msg, err := response.Recv()
+				msg, err := sess.Recv()
 				require.NoError(t, err)
 
 				t.Log(msg.Type)
@@ -160,22 +191,22 @@ func TestProvision_Cancel(t *testing.T) {
 				require.Equal(t, line, log.Output)
 			}
 
-			err = response.Send(&proto.Provision_Request{
-				Type: &proto.Provision_Request_Cancel{
-					Cancel: &proto.Provision_Cancel{},
+			err = sess.Send(&proto.Request{
+				Type: &proto.Request_Cancel{
+					Cancel: &proto.CancelRequest{},
 				},
 			})
 			require.NoError(t, err)
 
 			var gotLog []string
 			for {
-				msg, err := response.Recv()
+				msg, err := sess.Recv()
 				require.NoError(t, err)
 
 				if log := msg.GetLog(); log != nil {
 					gotLog = append(gotLog, log.Output)
 				}
-				if c := msg.GetComplete(); c != nil {
+				if c := msg.GetPlan(); c != nil {
 					require.Contains(t, c.Error, "exit status 1")
 					break
 				}
@@ -208,23 +239,17 @@ func TestProvision_CancelTimeout(t *testing.T) {
 		exitTimeout: time.Second,
 	})
 
-	response, err := api.Provision(ctx)
-	require.NoError(t, err)
-	err = response.Send(&proto.Provision_Request{
-		Type: &proto.Provision_Request_Apply{
-			Apply: &proto.Provision_Apply{
-				Config: &proto.Provision_Config{
-					Directory: dir,
-					Metadata:  &proto.Provision_Metadata{},
-				},
-			},
-		},
+	sess := configure(ctx, t, api, &proto.Config{
+		TemplateSourceArchive: makeTar(t, nil),
 	})
+
+	// provisioner requires plan before apply, so test cancel with plan.
+	err = sendPlan(sess, proto.WorkspaceTransition_START)
 	require.NoError(t, err)
 
-	for _, line := range []string{"init", "apply_start"} {
+	for _, line := range []string{"init", "plan_start"} {
 	LoopStart:
-		msg, err := response.Recv()
+		msg, err := sess.Recv()
 		require.NoError(t, err)
 
 		t.Log(msg.Type)
@@ -236,18 +261,14 @@ func TestProvision_CancelTimeout(t *testing.T) {
 		require.Equal(t, line, log.Output)
 	}
 
-	err = response.Send(&proto.Provision_Request{
-		Type: &proto.Provision_Request_Cancel{
-			Cancel: &proto.Provision_Cancel{},
-		},
-	})
+	err = sess.Send(&proto.Request{Type: &proto.Request_Cancel{Cancel: &proto.CancelRequest{}}})
 	require.NoError(t, err)
 
 	for {
-		msg, err := response.Recv()
+		msg, err := sess.Recv()
 		require.NoError(t, err)
 
-		if c := msg.GetComplete(); c != nil {
+		if c := msg.GetPlan(); c != nil {
 			require.Contains(t, c.Error, "killed")
 			break
 		}
@@ -258,17 +279,18 @@ func TestProvision(t *testing.T) {
 	t.Parallel()
 
 	testCases := []struct {
-		Name    string
-		Files   map[string]string
-		Request *proto.Provision_Plan
+		Name     string
+		Files    map[string]string
+		Metadata *proto.Metadata
+		Request  *proto.PlanRequest
 		// Response may be nil to not check the response.
-		Response *proto.Provision_Response
-		// If ErrorContains is not empty, then response.Recv() should return an
-		// error containing this string before a Complete response is returned.
+		Response *proto.PlanComplete
+		// If ErrorContains is not empty, PlanComplete should have an Error containing the given string
 		ErrorContains string
 		// If ExpectLogContains is not empty, then the logs should contain it.
 		ExpectLogContains string
-		Apply             bool
+		// If Apply is true, then send an Apply request and check we get the same Resources as in Response.
+		Apply bool
 	}{
 		{
 			Name: "missing-variable",
@@ -293,15 +315,11 @@ func TestProvision(t *testing.T) {
 			Files: map[string]string{
 				"main.tf": `resource "null_resource" "A" {}`,
 			},
-			Response: &proto.Provision_Response{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Resources: []*proto.Resource{{
-							Name: "A",
-							Type: "null_resource",
-						}},
-					},
-				},
+			Response: &proto.PlanComplete{
+				Resources: []*proto.Resource{{
+					Name: "A",
+					Type: "null_resource",
+				}},
 			},
 		},
 		{
@@ -309,15 +327,11 @@ func TestProvision(t *testing.T) {
 			Files: map[string]string{
 				"main.tf": `resource "null_resource" "A" {}`,
 			},
-			Response: &proto.Provision_Response{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Resources: []*proto.Resource{{
-							Name: "A",
-							Type: "null_resource",
-						}},
-					},
-				},
+			Response: &proto.PlanComplete{
+				Resources: []*proto.Resource{{
+					Name: "A",
+					Type: "null_resource",
+				}},
 			},
 			Apply: true,
 		},
@@ -334,15 +348,11 @@ func TestProvision(t *testing.T) {
 					}
 				}`,
 			},
-			Response: &proto.Provision_Response{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Resources: []*proto.Resource{{
-							Name: "A",
-							Type: "null_resource",
-						}},
-					},
-				},
+			Response: &proto.PlanComplete{
+				Resources: []*proto.Resource{{
+					Name: "A",
+					Type: "null_resource",
+				}},
 			},
 			Apply: true,
 		},
@@ -351,7 +361,7 @@ func TestProvision(t *testing.T) {
 			Files: map[string]string{
 				"main.tf": `a`,
 			},
-			ErrorContains:     "plan terraform",
+			ErrorContains:     "initialize terraform",
 			ExpectLogContains: "Argument or block definition required",
 		},
 		{
@@ -359,7 +369,7 @@ func TestProvision(t *testing.T) {
 			Files: map[string]string{
 				"main.tf": `;asdf;`,
 			},
-			ErrorContains:     "plan terraform",
+			ErrorContains:     "initialize terraform",
 			ExpectLogContains: `The ";" character is not valid.`,
 		},
 		{
@@ -367,12 +377,8 @@ func TestProvision(t *testing.T) {
 			Files: map[string]string{
 				"main.tf": `resource "null_resource" "A" {}`,
 			},
-			Request: &proto.Provision_Plan{
-				Config: &proto.Provision_Config{
-					Metadata: &proto.Provision_Metadata{
-						WorkspaceTransition: proto.WorkspaceTransition_DESTROY,
-					},
-				},
+			Metadata: &proto.Metadata{
+				WorkspaceTransition: proto.WorkspaceTransition_DESTROY,
 			},
 			ExpectLogContains: "nothing to do",
 		},
@@ -406,7 +412,7 @@ func TestProvision(t *testing.T) {
 					}
 				  }`,
 			},
-			Request: &proto.Provision_Plan{
+			Request: &proto.PlanRequest{
 				RichParameterValues: []*proto.RichParameterValue{
 					{
 						Name:  "Example",
@@ -418,27 +424,23 @@ func TestProvision(t *testing.T) {
 					},
 				},
 			},
-			Response: &proto.Provision_Response{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Parameters: []*proto.RichParameter{
-							{
-								Name:         "Example",
-								Type:         "string",
-								DefaultValue: "foobar",
-							},
-							{
-								Name:         "Sample",
-								Type:         "string",
-								DefaultValue: "foobaz",
-							},
-						},
-						Resources: []*proto.Resource{{
-							Name: "example",
-							Type: "null_resource",
-						}},
+			Response: &proto.PlanComplete{
+				Parameters: []*proto.RichParameter{
+					{
+						Name:         "Example",
+						Type:         "string",
+						DefaultValue: "foobar",
+					},
+					{
+						Name:         "Sample",
+						Type:         "string",
+						DefaultValue: "foobaz",
 					},
 				},
+				Resources: []*proto.Resource{{
+					Name: "example",
+					Type: "null_resource",
+				}},
 			},
 		},
 		{
@@ -488,7 +490,7 @@ func TestProvision(t *testing.T) {
 					]
 				}`,
 			},
-			Request: &proto.Provision_Plan{
+			Request: &proto.PlanRequest{
 				RichParameterValues: []*proto.RichParameterValue{
 					{
 						Name:  "Example",
@@ -500,27 +502,23 @@ func TestProvision(t *testing.T) {
 					},
 				},
 			},
-			Response: &proto.Provision_Response{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Parameters: []*proto.RichParameter{
-							{
-								Name:         "Example",
-								Type:         "string",
-								DefaultValue: "foobar",
-							},
-							{
-								Name:         "Sample",
-								Type:         "string",
-								DefaultValue: "foobaz",
-							},
-						},
-						Resources: []*proto.Resource{{
-							Name: "example",
-							Type: "null_resource",
-						}},
+			Response: &proto.PlanComplete{
+				Parameters: []*proto.RichParameter{
+					{
+						Name:         "Example",
+						Type:         "string",
+						DefaultValue: "foobar",
+					},
+					{
+						Name:         "Sample",
+						Type:         "string",
+						DefaultValue: "foobaz",
 					},
 				},
+				Resources: []*proto.Resource{{
+					Name: "example",
+					Type: "null_resource",
+				}},
 			},
 		},
 		{
@@ -550,25 +548,21 @@ func TestProvision(t *testing.T) {
 				}
 				`,
 			},
-			Request: &proto.Provision_Plan{
-				GitAuthProviders: []*proto.GitAuthProvider{{
+			Request: &proto.PlanRequest{
+				ExternalAuthProviders: []*proto.ExternalAuthProvider{{
 					Id:          "github",
 					AccessToken: "some-value",
 				}},
 			},
-			Response: &proto.Provision_Response{
-				Type: &proto.Provision_Response_Complete{
-					Complete: &proto.Provision_Complete{
-						Resources: []*proto.Resource{{
-							Name: "example",
-							Type: "null_resource",
-							Metadata: []*proto.Resource_Metadata{{
-								Key:   "token",
-								Value: "some-value",
-							}},
-						}},
-					},
-				},
+			Response: &proto.PlanComplete{
+				Resources: []*proto.Resource{{
+					Name: "example",
+					Type: "null_resource",
+					Metadata: []*proto.Resource_Metadata{{
+						Key:   "token",
+						Value: "some-value",
+					}},
+				}},
 			},
 		},
 	}
@@ -579,50 +573,26 @@ func TestProvision(t *testing.T) {
 			t.Parallel()
 
 			ctx, api := setupProvisioner(t, nil)
+			sess := configure(ctx, t, api, &proto.Config{
+				TemplateSourceArchive: makeTar(t, testCase.Files),
+			})
 
-			directory := t.TempDir()
-			for path, content := range testCase.Files {
-				err := os.WriteFile(filepath.Join(directory, path), []byte(content), 0o600)
-				require.NoError(t, err)
-			}
-
-			planRequest := &proto.Provision_Request{
-				Type: &proto.Provision_Request_Plan{
-					Plan: &proto.Provision_Plan{
-						Config: &proto.Provision_Config{
-							Directory: directory,
-						},
-					},
-				},
-			}
+			planRequest := &proto.Request{Type: &proto.Request_Plan{Plan: &proto.PlanRequest{
+				Metadata: testCase.Metadata,
+			}}}
 			if testCase.Request != nil {
-				if planRequest.GetPlan().GetConfig() == nil {
-					planRequest.GetPlan().Config = &proto.Provision_Config{}
-				}
-				planRequest.GetPlan().RichParameterValues = testCase.Request.RichParameterValues
-				planRequest.GetPlan().GitAuthProviders = testCase.Request.GitAuthProviders
-				if testCase.Request.Config != nil {
-					planRequest.GetPlan().Config.State = testCase.Request.Config.State
-					planRequest.GetPlan().Config.Metadata = testCase.Request.Config.Metadata
-				}
-			}
-			if planRequest.GetPlan().Config.Metadata == nil {
-				planRequest.GetPlan().Config.Metadata = &proto.Provision_Metadata{}
+				planRequest = &proto.Request{Type: &proto.Request_Plan{Plan: testCase.Request}}
 			}
 
 			gotExpectedLog := testCase.ExpectLogContains == ""
 
-			provision := func(req *proto.Provision_Request) *proto.Provision_Complete {
-				response, err := api.Provision(ctx)
-				require.NoError(t, err)
-				err = response.Send(req)
+			provision := func(req *proto.Request) *proto.Response {
+				err := sess.Send(req)
 				require.NoError(t, err)
-
-				var complete *proto.Provision_Complete
-
 				for {
-					msg, err := response.Recv()
-					if msg != nil && msg.GetLog() != nil {
+					msg, err := sess.Recv()
+					require.NoError(t, err)
+					if msg.GetLog() != nil {
 						if testCase.ExpectLogContains != "" && strings.Contains(msg.GetLog().Output, testCase.ExpectLogContains) {
 							gotExpectedLog = true
 						}
@@ -630,67 +600,51 @@ func TestProvision(t *testing.T) {
 						t.Logf("log: [%s] %s", msg.GetLog().Level, msg.GetLog().Output)
 						continue
 					}
-					if testCase.ErrorContains != "" {
-						require.ErrorContains(t, err, testCase.ErrorContains)
-						break
-					}
-					require.NoError(t, err)
-
-					if complete = msg.GetComplete(); complete == nil {
-						continue
-					}
-
-					require.NoError(t, err)
-
-					// Remove randomly generated data.
-					for _, resource := range msg.GetComplete().Resources {
-						sort.Slice(resource.Agents, func(i, j int) bool {
-							return resource.Agents[i].Name < resource.Agents[j].Name
-						})
-
-						for _, agent := range resource.Agents {
-							agent.Id = ""
-							if agent.GetToken() == "" {
-								continue
-							}
-							agent.Auth = &proto.Agent_Token{}
-						}
-					}
+					return msg
+				}
+			}
 
-					if testCase.Response != nil {
-						require.Equal(t, testCase.Response.GetComplete().Error, msg.GetComplete().Error)
+			resp := provision(planRequest)
+			planComplete := resp.GetPlan()
+			require.NotNil(t, planComplete)
 
-						resourcesGot, err := json.Marshal(msg.GetComplete().Resources)
-						require.NoError(t, err)
-						resourcesWant, err := json.Marshal(testCase.Response.GetComplete().Resources)
-						require.NoError(t, err)
+			if testCase.ErrorContains != "" {
+				require.Contains(t, planComplete.GetError(), testCase.ErrorContains)
+			}
 
-						require.Equal(t, string(resourcesWant), string(resourcesGot))
+			if testCase.Response != nil {
+				require.Equal(t, testCase.Response.Error, planComplete.Error)
 
-						parametersGot, err := json.Marshal(msg.GetComplete().Parameters)
-						require.NoError(t, err)
-						parametersWant, err := json.Marshal(testCase.Response.GetComplete().Parameters)
-						require.NoError(t, err)
-						require.Equal(t, string(parametersWant), string(parametersGot))
-					}
-					break
-				}
+				// Remove randomly generated data.
+				normalizeResources(planComplete.Resources)
+				resourcesGot, err := json.Marshal(planComplete.Resources)
+				require.NoError(t, err)
+				resourcesWant, err := json.Marshal(testCase.Response.Resources)
+				require.NoError(t, err)
+				require.Equal(t, string(resourcesWant), string(resourcesGot))
 
-				return complete
+				parametersGot, err := json.Marshal(planComplete.Parameters)
+				require.NoError(t, err)
+				parametersWant, err := json.Marshal(testCase.Response.Parameters)
+				require.NoError(t, err)
+				require.Equal(t, string(parametersWant), string(parametersGot))
 			}
 
-			planComplete := provision(planRequest)
-
 			if testCase.Apply {
-				require.NotNil(t, planComplete.Plan)
-				provision(&proto.Provision_Request{
-					Type: &proto.Provision_Request_Apply{
-						Apply: &proto.Provision_Apply{
-							Config: planRequest.GetPlan().GetConfig(),
-							Plan:   planComplete.Plan,
-						},
-					},
-				})
+				resp = provision(&proto.Request{Type: &proto.Request_Apply{Apply: &proto.ApplyRequest{
+					Metadata: &proto.Metadata{WorkspaceTransition: proto.WorkspaceTransition_START},
+				}}})
+				applyComplete := resp.GetApply()
+				require.NotNil(t, applyComplete)
+
+				if testCase.Response != nil {
+					normalizeResources(applyComplete.Resources)
+					resourcesGot, err := json.Marshal(applyComplete.Resources)
+					require.NoError(t, err)
+					resourcesWant, err := json.Marshal(testCase.Response.Resources)
+					require.NoError(t, err)
+					require.Equal(t, string(resourcesWant), string(resourcesGot))
+				}
 			}
 
 			if !gotExpectedLog {
@@ -700,6 +654,22 @@ func TestProvision(t *testing.T) {
 	}
 }
 
+func normalizeResources(resources []*proto.Resource) {
+	for _, resource := range resources {
+		sort.Slice(resource.Agents, func(i, j int) bool {
+			return resource.Agents[i].Name < resource.Agents[j].Name
+		})
+
+		for _, agent := range resource.Agents {
+			agent.Id = ""
+			if agent.GetToken() == "" {
+				continue
+			}
+			agent.Auth = &proto.Agent_Token{}
+		}
+	}
+}
+
 // nolint:paralleltest
 func TestProvision_ExtraEnv(t *testing.T) {
 	// #nosec
@@ -708,31 +678,15 @@ func TestProvision_ExtraEnv(t *testing.T) {
 	t.Setenv("TF_SUPERSECRET", secretValue)
 
 	ctx, api := setupProvisioner(t, nil)
+	sess := configure(ctx, t, api, &proto.Config{
+		TemplateSourceArchive: makeTar(t, map[string]string{"main.tf": `resource "null_resource" "A" {}`}),
+	})
 
-	directory := t.TempDir()
-	path := filepath.Join(directory, "main.tf")
-	err := os.WriteFile(path, []byte(`resource "null_resource" "A" {}`), 0o600)
-	require.NoError(t, err)
-
-	request := &proto.Provision_Request{
-		Type: &proto.Provision_Request_Plan{
-			Plan: &proto.Provision_Plan{
-				Config: &proto.Provision_Config{
-					Directory: directory,
-					Metadata: &proto.Provision_Metadata{
-						WorkspaceTransition: proto.WorkspaceTransition_START,
-					},
-				},
-			},
-		},
-	}
-	response, err := api.Provision(ctx)
-	require.NoError(t, err)
-	err = response.Send(request)
+	err := sendPlan(sess, proto.WorkspaceTransition_START)
 	require.NoError(t, err)
 	found := false
 	for {
-		msg, err := response.Recv()
+		msg, err := sess.Recv()
 		require.NoError(t, err)
 
 		if log := msg.GetLog(); log != nil {
@@ -742,7 +696,7 @@ func TestProvision_ExtraEnv(t *testing.T) {
 			}
 			require.NotContains(t, log.Output, secretValue)
 		}
-		if c := msg.GetComplete(); c != nil {
+		if c := msg.GetPlan(); c != nil {
 			require.Empty(t, c.Error)
 			break
 		}
@@ -774,48 +728,19 @@ func TestProvision_SafeEnv(t *testing.T) {
 	`
 
 	ctx, api := setupProvisioner(t, nil)
-
-	directory := t.TempDir()
-	path := filepath.Join(directory, "main.tf")
-	err := os.WriteFile(path, []byte(echoResource), 0o600)
-	require.NoError(t, err)
-
-	response, err := api.Provision(ctx)
-	require.NoError(t, err)
-	err = response.Send(&proto.Provision_Request{
-		Type: &proto.Provision_Request_Plan{
-			Plan: &proto.Provision_Plan{
-				Config: &proto.Provision_Config{
-					Directory: directory,
-					Metadata: &proto.Provision_Metadata{
-						WorkspaceTransition: proto.WorkspaceTransition_START,
-					},
-				},
-			},
-		},
+	sess := configure(ctx, t, api, &proto.Config{
+		TemplateSourceArchive: makeTar(t, map[string]string{"main.tf": echoResource}),
 	})
+
+	err := sendPlan(sess, proto.WorkspaceTransition_START)
 	require.NoError(t, err)
 
-	_, complete := readProvisionLog(t, response)
+	_ = readProvisionLog(t, sess)
 
-	response, err = api.Provision(ctx)
-	require.NoError(t, err)
-	err = response.Send(&proto.Provision_Request{
-		Type: &proto.Provision_Request_Apply{
-			Apply: &proto.Provision_Apply{
-				Config: &proto.Provision_Config{
-					Directory: directory,
-					Metadata: &proto.Provision_Metadata{
-						WorkspaceTransition: proto.WorkspaceTransition_START,
-					},
-				},
-				Plan: complete.GetPlan(),
-			},
-		},
-	})
+	err = sendApply(sess, proto.WorkspaceTransition_START)
 	require.NoError(t, err)
 
-	log, _ := readProvisionLog(t, response)
+	log := readProvisionLog(t, sess)
 	require.Contains(t, log, passedValue)
 	require.NotContains(t, log, secretValue)
 	require.Contains(t, log, "CODER_")
diff --git a/provisioner/terraform/resources.go b/provisioner/terraform/resources.go
index c98e21fb21789..77fb7e6f906e0 100644
--- a/provisioner/terraform/resources.go
+++ b/provisioner/terraform/resources.go
@@ -11,11 +11,12 @@ import (
 
 	"github.com/coder/terraform-provider-coder/provider"
 
-	"github.com/coder/coder/coderd/util/slice"
-	stringutil "github.com/coder/coder/coderd/util/strings"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/provisioner"
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	stringutil "github.com/coder/coder/v2/coderd/util/strings"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 type agentMetadata struct {
@@ -28,24 +29,34 @@ type agentMetadata struct {
 
 // A mapping of attributes on the "coder_agent" resource.
 type agentAttributes struct {
-	Auth                     string            `mapstructure:"auth"`
-	OperatingSystem          string            `mapstructure:"os"`
-	Architecture             string            `mapstructure:"arch"`
-	Directory                string            `mapstructure:"dir"`
-	ID                       string            `mapstructure:"id"`
-	Token                    string            `mapstructure:"token"`
-	Env                      map[string]string `mapstructure:"env"`
-	StartupScript            string            `mapstructure:"startup_script"`
-	ConnectionTimeoutSeconds int32             `mapstructure:"connection_timeout"`
-	TroubleshootingURL       string            `mapstructure:"troubleshooting_url"`
-	MOTDFile                 string            `mapstructure:"motd_file"`
+	Auth            string            `mapstructure:"auth"`
+	OperatingSystem string            `mapstructure:"os"`
+	Architecture    string            `mapstructure:"arch"`
+	Directory       string            `mapstructure:"dir"`
+	ID              string            `mapstructure:"id"`
+	Token           string            `mapstructure:"token"`
+	Env             map[string]string `mapstructure:"env"`
 	// Deprecated, but remains here for backwards compatibility.
-	LoginBeforeReady             bool            `mapstructure:"login_before_ready"`
-	StartupScriptBehavior        string          `mapstructure:"startup_script_behavior"`
-	StartupScriptTimeoutSeconds  int32           `mapstructure:"startup_script_timeout"`
-	ShutdownScript               string          `mapstructure:"shutdown_script"`
-	ShutdownScriptTimeoutSeconds int32           `mapstructure:"shutdown_script_timeout"`
-	Metadata                     []agentMetadata `mapstructure:"metadata"`
+	StartupScript                string `mapstructure:"startup_script"`
+	StartupScriptBehavior        string `mapstructure:"startup_script_behavior"`
+	StartupScriptTimeoutSeconds  int32  `mapstructure:"startup_script_timeout"`
+	LoginBeforeReady             bool   `mapstructure:"login_before_ready"`
+	ShutdownScript               string `mapstructure:"shutdown_script"`
+	ShutdownScriptTimeoutSeconds int32  `mapstructure:"shutdown_script_timeout"`
+
+	ConnectionTimeoutSeconds int32                        `mapstructure:"connection_timeout"`
+	TroubleshootingURL       string                       `mapstructure:"troubleshooting_url"`
+	MOTDFile                 string                       `mapstructure:"motd_file"`
+	Metadata                 []agentMetadata              `mapstructure:"metadata"`
+	DisplayApps              []agentDisplayAppsAttributes `mapstructure:"display_apps"`
+}
+
+type agentDisplayAppsAttributes struct {
+	VSCode               bool `mapstructure:"vscode"`
+	VSCodeInsiders       bool `mapstructure:"vscode_insiders"`
+	WebTerminal          bool `mapstructure:"web_terminal"`
+	SSHHelper            bool `mapstructure:"ssh_helper"`
+	PortForwardingHelper bool `mapstructure:"port_forwarding_helper"`
 }
 
 // A mapping of attributes on the "coder_app" resource.
@@ -66,6 +77,19 @@ type agentAppAttributes struct {
 	Healthcheck []appHealthcheckAttributes `mapstructure:"healthcheck"`
 }
 
+type agentScriptAttributes struct {
+	AgentID          string `mapstructure:"agent_id"`
+	DisplayName      string `mapstructure:"display_name"`
+	Icon             string `mapstructure:"icon"`
+	Script           string `mapstructure:"script"`
+	Cron             string `mapstructure:"cron"`
+	LogPath          string `mapstructure:"log_path"`
+	StartBlocksLogin bool   `mapstructure:"start_blocks_login"`
+	RunOnStart       bool   `mapstructure:"run_on_start"`
+	RunOnStop        bool   `mapstructure:"run_on_stop"`
+	TimeoutSeconds   int32  `mapstructure:"timeout"`
+}
+
 // A mapping of attributes on the "healthcheck" resource.
 type appHealthcheckAttributes struct {
 	URL       string `mapstructure:"url"`
@@ -90,14 +114,14 @@ type resourceMetadataItem struct {
 }
 
 type State struct {
-	Resources        []*proto.Resource
-	Parameters       []*proto.RichParameter
-	GitAuthProviders []string
+	Resources             []*proto.Resource
+	Parameters            []*proto.RichParameter
+	ExternalAuthProviders []string
 }
 
 // ConvertState consumes Terraform state and a GraphViz representation
 // produced by `terraform graph` to produce resources consumable by Coder.
-// nolint:gocyclo
+// nolint:gocognit // This function makes more sense being large for now, until refactored.
 func ConvertState(modules []*tfjson.StateModule, rawGraph string) (*State, error) {
 	parsedGraph, err := gographviz.ParseString(rawGraph)
 	if err != nil {
@@ -182,22 +206,54 @@ func ConvertState(modules []*tfjson.StateModule, rawGraph string) (*State, error
 				})
 			}
 
+			// If a user doesn't specify 'display_apps' then they default
+			// into all apps except VSCode Insiders.
+			displayApps := provisionersdk.DefaultDisplayApps()
+
+			if len(attrs.DisplayApps) != 0 {
+				displayApps = &proto.DisplayApps{
+					Vscode:               attrs.DisplayApps[0].VSCode,
+					VscodeInsiders:       attrs.DisplayApps[0].VSCodeInsiders,
+					WebTerminal:          attrs.DisplayApps[0].WebTerminal,
+					PortForwardingHelper: attrs.DisplayApps[0].PortForwardingHelper,
+					SshHelper:            attrs.DisplayApps[0].SSHHelper,
+				}
+			}
+
 			agent := &proto.Agent{
-				Name:                         tfResource.Name,
-				Id:                           attrs.ID,
-				Env:                          attrs.Env,
-				StartupScript:                attrs.StartupScript,
-				OperatingSystem:              attrs.OperatingSystem,
-				Architecture:                 attrs.Architecture,
-				Directory:                    attrs.Directory,
-				ConnectionTimeoutSeconds:     attrs.ConnectionTimeoutSeconds,
-				TroubleshootingUrl:           attrs.TroubleshootingURL,
-				MotdFile:                     attrs.MOTDFile,
-				StartupScriptBehavior:        startupScriptBehavior,
-				StartupScriptTimeoutSeconds:  attrs.StartupScriptTimeoutSeconds,
-				ShutdownScript:               attrs.ShutdownScript,
-				ShutdownScriptTimeoutSeconds: attrs.ShutdownScriptTimeoutSeconds,
-				Metadata:                     metadata,
+				Name:                     tfResource.Name,
+				Id:                       attrs.ID,
+				Env:                      attrs.Env,
+				OperatingSystem:          attrs.OperatingSystem,
+				Architecture:             attrs.Architecture,
+				Directory:                attrs.Directory,
+				ConnectionTimeoutSeconds: attrs.ConnectionTimeoutSeconds,
+				TroubleshootingUrl:       attrs.TroubleshootingURL,
+				MotdFile:                 attrs.MOTDFile,
+				Metadata:                 metadata,
+				DisplayApps:              displayApps,
+			}
+			// Support the legacy script attributes in the agent!
+			if attrs.StartupScript != "" {
+				agent.Scripts = append(agent.Scripts, &proto.Script{
+					// This is ▶️
+					Icon:             "/emojis/25b6.png",
+					LogPath:          "coder-startup-script.log",
+					DisplayName:      "Startup Script",
+					Script:           attrs.StartupScript,
+					StartBlocksLogin: startupScriptBehavior == string(codersdk.WorkspaceAgentStartupScriptBehaviorBlocking),
+					RunOnStart:       true,
+				})
+			}
+			if attrs.ShutdownScript != "" {
+				agent.Scripts = append(agent.Scripts, &proto.Script{
+					// This is ◀️
+					Icon:        "/emojis/25c0.png",
+					LogPath:     "coder-shutdown-script.log",
+					DisplayName: "Shutdown Script",
+					Script:      attrs.ShutdownScript,
+					RunOnStop:   true,
+				})
 			}
 			switch attrs.Auth {
 			case "token":
@@ -379,6 +435,39 @@ func ConvertState(modules []*tfjson.StateModule, rawGraph string) (*State, error
 		}
 	}
 
+	// Associate scripts with agents.
+	for _, resources := range tfResourcesByLabel {
+		for _, resource := range resources {
+			if resource.Type != "coder_script" {
+				continue
+			}
+			var attrs agentScriptAttributes
+			err = mapstructure.Decode(resource.AttributeValues, &attrs)
+			if err != nil {
+				return nil, xerrors.Errorf("decode app attributes: %w", err)
+			}
+			for _, agents := range resourceAgents {
+				for _, agent := range agents {
+					// Find agents with the matching ID and associate them!
+					if agent.Id != attrs.AgentID {
+						continue
+					}
+					agent.Scripts = append(agent.Scripts, &proto.Script{
+						DisplayName:      attrs.DisplayName,
+						Icon:             attrs.Icon,
+						Script:           attrs.Script,
+						Cron:             attrs.Cron,
+						LogPath:          attrs.LogPath,
+						StartBlocksLogin: attrs.StartBlocksLogin,
+						RunOnStart:       attrs.RunOnStart,
+						RunOnStop:        attrs.RunOnStop,
+						TimeoutSeconds:   attrs.TimeoutSeconds,
+					})
+				}
+			}
+		}
+	}
+
 	// Associate metadata blocks with resources.
 	resourceMetadata := map[string][]*proto.Resource_Metadata{}
 	resourceHidden := map[string]bool{}
@@ -458,7 +547,7 @@ func ConvertState(modules []*tfjson.StateModule, rawGraph string) (*State, error
 			if resource.Mode == tfjson.DataResourceMode {
 				continue
 			}
-			if resource.Type == "coder_agent" || resource.Type == "coder_agent_instance" || resource.Type == "coder_app" || resource.Type == "coder_metadata" {
+			if resource.Type == "coder_script" || resource.Type == "coder_agent" || resource.Type == "coder_agent_instance" || resource.Type == "coder_app" || resource.Type == "coder_metadata" {
 				continue
 			}
 			label := convertAddressToLabel(resource.Address)
@@ -572,28 +661,29 @@ func ConvertState(modules []*tfjson.StateModule, rawGraph string) (*State, error
 	}
 
 	// A map is used to ensure we don't have duplicates!
-	gitAuthProvidersMap := map[string]struct{}{}
+	externalAuthProvidersMap := map[string]struct{}{}
 	for _, tfResources := range tfResourcesByLabel {
 		for _, resource := range tfResources {
-			if resource.Type != "coder_git_auth" {
+			// Checking for `coder_git_auth` is legacy!
+			if resource.Type != "coder_external_auth" && resource.Type != "coder_git_auth" {
 				continue
 			}
 			id, ok := resource.AttributeValues["id"].(string)
 			if !ok {
-				return nil, xerrors.Errorf("git auth id is not a string")
+				return nil, xerrors.Errorf("external auth id is not a string")
 			}
-			gitAuthProvidersMap[id] = struct{}{}
+			externalAuthProvidersMap[id] = struct{}{}
 		}
 	}
-	gitAuthProviders := make([]string, 0, len(gitAuthProvidersMap))
-	for id := range gitAuthProvidersMap {
-		gitAuthProviders = append(gitAuthProviders, id)
+	externalAuthProviders := make([]string, 0, len(externalAuthProvidersMap))
+	for id := range externalAuthProvidersMap {
+		externalAuthProviders = append(externalAuthProviders, id)
 	}
 
 	return &State{
-		Resources:        resources,
-		Parameters:       parameters,
-		GitAuthProviders: gitAuthProviders,
+		Resources:             resources,
+		Parameters:            parameters,
+		ExternalAuthProviders: externalAuthProviders,
 	}, nil
 }
 
diff --git a/provisioner/terraform/resources_test.go b/provisioner/terraform/resources_test.go
index 5c85b829dd77a..83aaabf21a8ea 100644
--- a/provisioner/terraform/resources_test.go
+++ b/provisioner/terraform/resources_test.go
@@ -13,9 +13,9 @@ import (
 	"github.com/stretchr/testify/require"
 	protobuf "google.golang.org/protobuf/proto"
 
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/provisioner/terraform"
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/provisioner/terraform"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 func TestConvertResources(t *testing.T) {
@@ -27,6 +27,17 @@ func TestConvertResources(t *testing.T) {
 		parameters       []*proto.RichParameter
 		gitAuthProviders []string
 	}
+
+	// If a user doesn't specify 'display_apps' then they default
+	// into all apps except VSCode Insiders.
+	displayApps := proto.DisplayApps{
+		Vscode:               true,
+		VscodeInsiders:       false,
+		WebTerminal:          true,
+		PortForwardingHelper: true,
+		SshHelper:            true,
+	}
+
 	// nolint:paralleltest
 	for folderName, expected := range map[string]testCase{
 		// When a resource depends on another, the shortest route
@@ -43,8 +54,8 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_Token{},
-					StartupScriptBehavior:    "non-blocking",
 					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}},
 			}},
 		},
@@ -60,8 +71,8 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_Token{},
-					StartupScriptBehavior:    "non-blocking",
 					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}},
 			}, {
 				Name: "second",
@@ -78,8 +89,8 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_InstanceId{},
-					StartupScriptBehavior:    "non-blocking",
 					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}},
 			}},
 		},
@@ -94,8 +105,8 @@ func TestConvertResources(t *testing.T) {
 					OperatingSystem:          "linux",
 					Architecture:             "amd64",
 					Auth:                     &proto.Agent_Token{},
-					StartupScriptBehavior:    "non-blocking",
 					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}},
 			}},
 		},
@@ -106,44 +117,42 @@ func TestConvertResources(t *testing.T) {
 				Name: "dev",
 				Type: "null_resource",
 				Agents: []*proto.Agent{{
-					Name:                         "dev1",
-					OperatingSystem:              "linux",
-					Architecture:                 "amd64",
-					Auth:                         &proto.Agent_Token{},
-					ConnectionTimeoutSeconds:     120,
-					StartupScriptBehavior:        "non-blocking",
-					StartupScriptTimeoutSeconds:  300,
-					ShutdownScriptTimeoutSeconds: 300,
+					Name:                     "dev1",
+					OperatingSystem:          "linux",
+					Architecture:             "amd64",
+					Auth:                     &proto.Agent_Token{},
+					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}, {
-					Name:                         "dev2",
-					OperatingSystem:              "darwin",
-					Architecture:                 "amd64",
-					Auth:                         &proto.Agent_Token{},
-					ConnectionTimeoutSeconds:     1,
-					MotdFile:                     "/etc/motd",
-					StartupScriptBehavior:        "non-blocking",
-					StartupScriptTimeoutSeconds:  30,
-					ShutdownScript:               "echo bye bye",
-					ShutdownScriptTimeoutSeconds: 30,
+					Name:                     "dev2",
+					OperatingSystem:          "darwin",
+					Architecture:             "amd64",
+					Auth:                     &proto.Agent_Token{},
+					ConnectionTimeoutSeconds: 1,
+					MotdFile:                 "/etc/motd",
+					DisplayApps:              &displayApps,
+					Scripts: []*proto.Script{{
+						Icon:        "/emojis/25c0.png",
+						DisplayName: "Shutdown Script",
+						RunOnStop:   true,
+						LogPath:     "coder-shutdown-script.log",
+						Script:      "echo bye bye",
+					}},
 				}, {
-					Name:                         "dev3",
-					OperatingSystem:              "windows",
-					Architecture:                 "arm64",
-					Auth:                         &proto.Agent_Token{},
-					ConnectionTimeoutSeconds:     120,
-					TroubleshootingUrl:           "https://coder.com/troubleshoot",
-					StartupScriptBehavior:        "blocking",
-					StartupScriptTimeoutSeconds:  300,
-					ShutdownScriptTimeoutSeconds: 300,
+					Name:                     "dev3",
+					OperatingSystem:          "windows",
+					Architecture:             "arm64",
+					Auth:                     &proto.Agent_Token{},
+					ConnectionTimeoutSeconds: 120,
+					TroubleshootingUrl:       "https://coder.com/troubleshoot",
+					DisplayApps:              &displayApps,
 				}, {
-					Name:                         "dev4",
-					OperatingSystem:              "linux",
-					Architecture:                 "amd64",
-					Auth:                         &proto.Agent_Token{},
-					ConnectionTimeoutSeconds:     120,
-					StartupScriptBehavior:        "blocking",
-					StartupScriptTimeoutSeconds:  300,
-					ShutdownScriptTimeoutSeconds: 300,
+					Name:                     "dev4",
+					OperatingSystem:          "linux",
+					Architecture:             "amd64",
+					Auth:                     &proto.Agent_Token{},
+					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}},
 			}},
 		},
@@ -180,8 +189,8 @@ func TestConvertResources(t *testing.T) {
 						},
 					},
 					Auth:                     &proto.Agent_Token{},
-					StartupScriptBehavior:    "non-blocking",
 					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}},
 			}},
 		},
@@ -204,8 +213,8 @@ func TestConvertResources(t *testing.T) {
 						},
 					},
 					Auth:                     &proto.Agent_Token{},
-					StartupScriptBehavior:    "non-blocking",
 					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}},
 			}},
 		},
@@ -242,10 +251,8 @@ func TestConvertResources(t *testing.T) {
 						Interval:    5,
 						Timeout:     1,
 					}},
-					ShutdownScriptTimeoutSeconds: 300,
-					StartupScriptTimeoutSeconds:  300,
-					StartupScriptBehavior:        "non-blocking",
-					ConnectionTimeoutSeconds:     120,
+					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}},
 			}},
 		},
@@ -285,7 +292,6 @@ func TestConvertResources(t *testing.T) {
 						Name:            "main",
 						OperatingSystem: "linux",
 						Architecture:    "amd64",
-						StartupScript:   "    #!/bin/bash\n    # home folder can be empty, so copying default bash settings\n    if [ ! -f ~/.profile ]; then\n      cp /etc/skel/.profile $HOME\n    fi\n    if [ ! -f ~/.bashrc ]; then\n      cp /etc/skel/.bashrc $HOME\n    fi\n    # install and start code-server\n    curl -fsSL https://code-server.dev/install.sh | sh  | tee code-server-install.log\n    code-server --auth none --port 13337 | tee code-server-install.log &\n",
 						Apps: []*proto.App{
 							{
 								Icon:        "/icon/code.svg",
@@ -295,8 +301,15 @@ func TestConvertResources(t *testing.T) {
 							},
 						},
 						Auth:                     &proto.Agent_Token{},
-						StartupScriptBehavior:    "non-blocking",
 						ConnectionTimeoutSeconds: 120,
+						DisplayApps:              &displayApps,
+						Scripts: []*proto.Script{{
+							DisplayName: "Startup Script",
+							RunOnStart:  true,
+							LogPath:     "coder-startup-script.log",
+							Icon:        "/emojis/25b6.png",
+							Script:      "    #!/bin/bash\n    # home folder can be empty, so copying default bash settings\n    if [ ! -f ~/.profile ]; then\n      cp /etc/skel/.profile $HOME\n    fi\n    if [ ! -f ~/.bashrc ]; then\n      cp /etc/skel/.bashrc $HOME\n    fi\n    # install and start code-server\n    curl -fsSL https://code-server.dev/install.sh | sh  | tee code-server-install.log\n    code-server --auth none --port 13337 | tee code-server-install.log &\n",
+						}},
 					}},
 				},
 			},
@@ -306,14 +319,12 @@ func TestConvertResources(t *testing.T) {
 				Name: "dev",
 				Type: "null_resource",
 				Agents: []*proto.Agent{{
-					Name:                         "dev",
-					OperatingSystem:              "windows",
-					ShutdownScriptTimeoutSeconds: 300,
-					StartupScriptTimeoutSeconds:  300,
-					Architecture:                 "arm64",
-					Auth:                         &proto.Agent_Token{},
-					StartupScriptBehavior:        "non-blocking",
-					ConnectionTimeoutSeconds:     120,
+					Name:                     "dev",
+					OperatingSystem:          "windows",
+					Architecture:             "arm64",
+					Auth:                     &proto.Agent_Token{},
+					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}},
 			}},
 			parameters: []*proto.RichParameter{{
@@ -387,14 +398,12 @@ func TestConvertResources(t *testing.T) {
 				Name: "dev",
 				Type: "null_resource",
 				Agents: []*proto.Agent{{
-					Name:                         "dev",
-					OperatingSystem:              "windows",
-					ShutdownScriptTimeoutSeconds: 300,
-					StartupScriptTimeoutSeconds:  300,
-					Architecture:                 "arm64",
-					Auth:                         &proto.Agent_Token{},
-					StartupScriptBehavior:        "non-blocking",
-					ConnectionTimeoutSeconds:     120,
+					Name:                     "dev",
+					OperatingSystem:          "windows",
+					Architecture:             "arm64",
+					Auth:                     &proto.Agent_Token{},
+					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}},
 			}},
 			parameters: []*proto.RichParameter{{
@@ -415,14 +424,12 @@ func TestConvertResources(t *testing.T) {
 				Name: "dev",
 				Type: "null_resource",
 				Agents: []*proto.Agent{{
-					Name:                         "dev",
-					OperatingSystem:              "windows",
-					ShutdownScriptTimeoutSeconds: 300,
-					StartupScriptTimeoutSeconds:  300,
-					Architecture:                 "arm64",
-					Auth:                         &proto.Agent_Token{},
-					StartupScriptBehavior:        "non-blocking",
-					ConnectionTimeoutSeconds:     120,
+					Name:                     "dev",
+					OperatingSystem:          "windows",
+					Architecture:             "arm64",
+					Auth:                     &proto.Agent_Token{},
+					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}},
 			}},
 			parameters: []*proto.RichParameter{{
@@ -470,18 +477,47 @@ func TestConvertResources(t *testing.T) {
 				Name: "dev",
 				Type: "null_resource",
 				Agents: []*proto.Agent{{
-					Name:                         "main",
-					OperatingSystem:              "linux",
-					Architecture:                 "amd64",
-					Auth:                         &proto.Agent_Token{},
-					StartupScriptBehavior:        "non-blocking",
-					ConnectionTimeoutSeconds:     120,
-					StartupScriptTimeoutSeconds:  300,
-					ShutdownScriptTimeoutSeconds: 300,
+					Name:                     "main",
+					OperatingSystem:          "linux",
+					Architecture:             "amd64",
+					Auth:                     &proto.Agent_Token{},
+					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &displayApps,
 				}},
 			}},
 			gitAuthProviders: []string{"github", "gitlab"},
 		},
+		"display-apps": {
+			resources: []*proto.Resource{{
+				Name: "dev",
+				Type: "null_resource",
+				Agents: []*proto.Agent{{
+					Name:                     "main",
+					OperatingSystem:          "linux",
+					Architecture:             "amd64",
+					Auth:                     &proto.Agent_Token{},
+					ConnectionTimeoutSeconds: 120,
+					DisplayApps: &proto.DisplayApps{
+						VscodeInsiders: true,
+						WebTerminal:    true,
+					},
+				}},
+			}},
+		},
+		"display-apps-disabled": {
+			resources: []*proto.Resource{{
+				Name: "dev",
+				Type: "null_resource",
+				Agents: []*proto.Agent{{
+					Name:                     "main",
+					OperatingSystem:          "linux",
+					Architecture:             "amd64",
+					Auth:                     &proto.Agent_Token{},
+					ConnectionTimeoutSeconds: 120,
+					DisplayApps:              &proto.DisplayApps{},
+				}},
+			}},
+		},
 	} {
 		folderName := folderName
 		expected := expected
@@ -510,7 +546,7 @@ func TestConvertResources(t *testing.T) {
 				state, err := terraform.ConvertState(modules, string(tfPlanGraph))
 				require.NoError(t, err)
 				sortResources(state.Resources)
-				sort.Strings(state.GitAuthProviders)
+				sort.Strings(state.ExternalAuthProviders)
 
 				expectedNoMetadata := make([]*proto.Resource, 0)
 				for _, resource := range expected.resources {
@@ -548,7 +584,7 @@ func TestConvertResources(t *testing.T) {
 				require.Equal(t, string(parametersWant), string(parametersGot))
 				require.Equal(t, expectedNoMetadataMap, resourcesMap)
 
-				require.ElementsMatch(t, expected.gitAuthProviders, state.GitAuthProviders)
+				require.ElementsMatch(t, expected.gitAuthProviders, state.ExternalAuthProviders)
 			})
 
 			t.Run("Provision", func(t *testing.T) {
@@ -564,7 +600,7 @@ func TestConvertResources(t *testing.T) {
 				state, err := terraform.ConvertState([]*tfjson.StateModule{tfState.Values.RootModule}, string(tfStateGraph))
 				require.NoError(t, err)
 				sortResources(state.Resources)
-				sort.Strings(state.GitAuthProviders)
+				sort.Strings(state.ExternalAuthProviders)
 				for _, resource := range state.Resources {
 					for _, agent := range resource.Agents {
 						agent.Id = ""
@@ -591,7 +627,7 @@ func TestConvertResources(t *testing.T) {
 				require.NoError(t, err)
 
 				require.Equal(t, expectedMap, resourcesMap)
-				require.ElementsMatch(t, expected.gitAuthProviders, state.GitAuthProviders)
+				require.ElementsMatch(t, expected.gitAuthProviders, state.ExternalAuthProviders)
 			})
 		})
 	}
diff --git a/provisioner/terraform/serve.go b/provisioner/terraform/serve.go
index 23f880e6c0418..0fc12ea870896 100644
--- a/provisioner/terraform/serve.go
+++ b/provisioner/terraform/serve.go
@@ -12,8 +12,8 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/unhanger"
-	"github.com/coder/coder/provisionersdk"
+	"github.com/coder/coder/v2/coderd/unhanger"
+	"github.com/coder/coder/v2/provisionersdk"
 )
 
 type ServeOptions struct {
@@ -24,7 +24,6 @@ type ServeOptions struct {
 	BinaryPath string
 	// CachePath must not be used by multiple processes at once.
 	CachePath string
-	Logger    slog.Logger
 	Tracer    trace.Tracer
 
 	// ExitTimeout defines how long we will wait for a running Terraform
@@ -128,5 +127,6 @@ func (s *server) executor(workdir string) *executor {
 		binaryPath: s.binaryPath,
 		cachePath:  s.cachePath,
 		workdir:    workdir,
+		logger:     s.logger.Named("executor"),
 	}
 }
diff --git a/provisioner/terraform/testdata/calling-module/calling-module.tfplan.json b/provisioner/terraform/testdata/calling-module/calling-module.tfplan.json
index be7a0aaaca9da..e71a071e4fd9d 100644
--- a/provisioner/terraform/testdata/calling-module/calling-module.tfplan.json
+++ b/provisioner/terraform/testdata/calling-module/calling-module.tfplan.json
@@ -1,6 +1,6 @@
 {
-  "format_version": "1.1",
-  "terraform_version": "1.3.7",
+  "format_version": "1.2",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -235,5 +235,6 @@
         "init_script"
       ]
     }
-  ]
+  ],
+  "timestamp": "2023-08-30T19:24:59Z"
 }
diff --git a/provisioner/terraform/testdata/calling-module/calling-module.tfstate.json b/provisioner/terraform/testdata/calling-module/calling-module.tfstate.json
index eb44278efaacd..dc3627f793ffc 100644
--- a/provisioner/terraform/testdata/calling-module/calling-module.tfstate.json
+++ b/provisioner/terraform/testdata/calling-module/calling-module.tfstate.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.3.7",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
@@ -17,14 +17,16 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "2d84db09-c3c3-4272-8119-1847e68e2dbe",
+            "id": "c6fd4a45-dc64-4830-8ff1-9a6c8074fca8",
             "init_script": "",
             "os": "linux",
             "startup_script": null,
-            "token": "d5d46d6a-5e4b-493f-9b68-dd8c78727cac",
+            "token": "2559767b-afc6-4293-92cf-d57d98bda13a",
             "troubleshooting_url": null
           },
-          "sensitive_values": {}
+          "sensitive_values": {
+            "token": true
+          }
         }
       ],
       "child_modules": [
@@ -46,7 +48,7 @@
                 "outputs": {
                   "script": ""
                 },
-                "random": "6336115403873146745"
+                "random": "5659889568915200015"
               },
               "sensitive_values": {
                 "inputs": {},
@@ -61,7 +63,7 @@
               "provider_name": "registry.terraform.io/hashicorp/null",
               "schema_version": 0,
               "values": {
-                "id": "3671991160538447687",
+                "id": "4052095409343470524",
                 "triggers": null
               },
               "sensitive_values": {},
diff --git a/provisioner/terraform/testdata/chaining-resources/chaining-resources.tfplan.json b/provisioner/terraform/testdata/chaining-resources/chaining-resources.tfplan.json
index 9097d4a673473..c34eba1bf5e2c 100644
--- a/provisioner/terraform/testdata/chaining-resources/chaining-resources.tfplan.json
+++ b/provisioner/terraform/testdata/chaining-resources/chaining-resources.tfplan.json
@@ -1,6 +1,6 @@
 {
-  "format_version": "1.1",
-  "terraform_version": "1.3.7",
+  "format_version": "1.2",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -180,5 +180,6 @@
         }
       ]
     }
-  }
+  },
+  "timestamp": "2023-08-30T19:25:02Z"
 }
diff --git a/provisioner/terraform/testdata/chaining-resources/chaining-resources.tfstate.json b/provisioner/terraform/testdata/chaining-resources/chaining-resources.tfstate.json
index 75f44e52662c9..60821742c70b5 100644
--- a/provisioner/terraform/testdata/chaining-resources/chaining-resources.tfstate.json
+++ b/provisioner/terraform/testdata/chaining-resources/chaining-resources.tfstate.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.3.7",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
@@ -17,14 +17,16 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "36c5629c-8ac4-4e6b-ae6e-94b8f1bbb0bc",
+            "id": "9fb263ae-2d96-414f-abfa-7874e73695d2",
             "init_script": "",
             "os": "linux",
             "startup_script": null,
-            "token": "9ed706cc-8b11-4b05-b6c3-ea943af2c60c",
+            "token": "4f391c60-20f9-4d57-906e-92e2f3e1e3c1",
             "troubleshooting_url": null
           },
-          "sensitive_values": {}
+          "sensitive_values": {
+            "token": true
+          }
         },
         {
           "address": "null_resource.a",
@@ -34,7 +36,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "4876594853562919335",
+            "id": "2616597461049838347",
             "triggers": null
           },
           "sensitive_values": {},
@@ -51,7 +53,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "3012307200839131913",
+            "id": "6759504907417146954",
             "triggers": null
           },
           "sensitive_values": {},
diff --git a/provisioner/terraform/testdata/cleanup-stale-plugins/all_plugins_are_stale.txt.golden b/provisioner/terraform/testdata/cleanup-stale-plugins/all_plugins_are_stale.txt.golden
new file mode 100644
index 0000000000000..385a8c0ae7835
--- /dev/null
+++ b/provisioner/terraform/testdata/cleanup-stale-plugins/all_plugins_are_stale.txt.golden
@@ -0,0 +1,5 @@
+/ d
+/tmp d
+/tmp/coder d
+/tmp/coder/provisioner-0 d
+/tmp/coder/provisioner-0/tf d
diff --git a/provisioner/terraform/testdata/cleanup-stale-plugins/one_plugin_file_is_touched.txt.golden b/provisioner/terraform/testdata/cleanup-stale-plugins/one_plugin_file_is_touched.txt.golden
new file mode 100644
index 0000000000000..399d94a8dfc2d
--- /dev/null
+++ b/provisioner/terraform/testdata/cleanup-stale-plugins/one_plugin_file_is_touched.txt.golden
@@ -0,0 +1,22 @@
+/ d
+/tmp d
+/tmp/coder d
+/tmp/coder/provisioner-0 d
+/tmp/coder/provisioner-0/tf d
+/tmp/coder/provisioner-0/tf/registry.terraform.io d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1 d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1/darwin_arm64 d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1/darwin_arm64/LICENSE f
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1/darwin_arm64/README.md f
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1/darwin_arm64/new_folder d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1/darwin_arm64/new_folder/foobar.tf f
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1/darwin_arm64/terraform-provider-coder_v0.11.1 f
+/tmp/coder/provisioner-0/tf/registry.terraform.io/kreuzwerker d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/kreuzwerker/docker d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/kreuzwerker/docker/2.25.0 d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/kreuzwerker/docker/2.25.0/darwin_arm64 d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/kreuzwerker/docker/2.25.0/darwin_arm64/LICENSE f
+/tmp/coder/provisioner-0/tf/registry.terraform.io/kreuzwerker/docker/2.25.0/darwin_arm64/README.md f
+/tmp/coder/provisioner-0/tf/registry.terraform.io/kreuzwerker/docker/2.25.0/darwin_arm64/terraform-provider-docker_v2.25.0 f
diff --git a/provisioner/terraform/testdata/cleanup-stale-plugins/one_plugin_is_stale.txt.golden b/provisioner/terraform/testdata/cleanup-stale-plugins/one_plugin_is_stale.txt.golden
new file mode 100644
index 0000000000000..7f6a2cf1b7f1a
--- /dev/null
+++ b/provisioner/terraform/testdata/cleanup-stale-plugins/one_plugin_is_stale.txt.golden
@@ -0,0 +1,15 @@
+/ d
+/tmp d
+/tmp/coder d
+/tmp/coder/provisioner-0 d
+/tmp/coder/provisioner-0/tf d
+/tmp/coder/provisioner-0/tf/registry.terraform.io d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1 d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1/darwin_arm64 d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1/darwin_arm64/LICENSE f
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1/darwin_arm64/README.md f
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1/darwin_arm64/new_folder d
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1/darwin_arm64/new_folder/foobar.tf f
+/tmp/coder/provisioner-0/tf/registry.terraform.io/coder/coder/0.11.1/darwin_arm64/terraform-provider-coder_v0.11.1 f
diff --git a/provisioner/terraform/testdata/conflicting-resources/conflicting-resources.tfplan.json b/provisioner/terraform/testdata/conflicting-resources/conflicting-resources.tfplan.json
index ff45f741cfeaa..ec759bd57e6e6 100644
--- a/provisioner/terraform/testdata/conflicting-resources/conflicting-resources.tfplan.json
+++ b/provisioner/terraform/testdata/conflicting-resources/conflicting-resources.tfplan.json
@@ -1,6 +1,6 @@
 {
-  "format_version": "1.1",
-  "terraform_version": "1.3.7",
+  "format_version": "1.2",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -180,5 +180,6 @@
         }
       ]
     }
-  }
+  },
+  "timestamp": "2023-08-30T19:25:04Z"
 }
diff --git a/provisioner/terraform/testdata/conflicting-resources/conflicting-resources.tfstate.json b/provisioner/terraform/testdata/conflicting-resources/conflicting-resources.tfstate.json
index ef172db9b63b6..cc9d6c4d07bed 100644
--- a/provisioner/terraform/testdata/conflicting-resources/conflicting-resources.tfstate.json
+++ b/provisioner/terraform/testdata/conflicting-resources/conflicting-resources.tfstate.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.3.7",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
@@ -17,14 +17,16 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "a79d53f2-f616-4be2-b1bf-6f6ce7409e23",
+            "id": "56d6f6e2-a7f8-4594-9bc3-044a4fd3b021",
             "init_script": "",
             "os": "linux",
             "startup_script": null,
-            "token": "bb333041-5225-490d-86a0-69d1b5afd0db",
+            "token": "715216d1-fca1-4652-9032-d5367072706f",
             "troubleshooting_url": null
           },
-          "sensitive_values": {}
+          "sensitive_values": {
+            "token": true
+          }
         },
         {
           "address": "null_resource.first",
@@ -34,7 +36,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "3651093174168180448",
+            "id": "7470209964325643389",
             "triggers": null
           },
           "sensitive_values": {},
@@ -50,7 +52,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "3820948743929828676",
+            "id": "251158623761758523",
             "triggers": null
           },
           "sensitive_values": {},
diff --git a/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tf b/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tf
new file mode 100644
index 0000000000000..ab6c4cd551802
--- /dev/null
+++ b/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tf
@@ -0,0 +1,26 @@
+terraform {
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = "0.11.2"
+    }
+  }
+}
+
+resource "coder_agent" "main" {
+  os   = "linux"
+  arch = "amd64"
+  display_apps {
+    vscode                 = false
+    vscode_insiders        = false
+    web_terminal           = false
+    ssh_helper             = false
+    port_forwarding_helper = false
+  }
+}
+
+resource "null_resource" "dev" {
+  depends_on = [
+    coder_agent.main
+  ]
+}
diff --git a/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfplan.dot b/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfplan.dot
new file mode 100644
index 0000000000000..a1dd4289708f0
--- /dev/null
+++ b/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfplan.dot
@@ -0,0 +1,18 @@
+digraph {
+	compound = "true"
+	newrank = "true"
+	subgraph "root" {
+		"[root] coder_agent.main (expand)" [label = "coder_agent.main", shape = "box"]
+		"[root] null_resource.dev (expand)" [label = "null_resource.dev", shape = "box"]
+		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
+		"[root] provider[\"registry.terraform.io/hashicorp/null\"]" [label = "provider[\"registry.terraform.io/hashicorp/null\"]", shape = "diamond"]
+		"[root] coder_agent.main (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] null_resource.dev (expand)" -> "[root] coder_agent.main (expand)"
+		"[root] null_resource.dev (expand)" -> "[root] provider[\"registry.terraform.io/hashicorp/null\"]"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_agent.main (expand)"
+		"[root] provider[\"registry.terraform.io/hashicorp/null\"] (close)" -> "[root] null_resource.dev (expand)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/coder/coder\"] (close)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/hashicorp/null\"] (close)"
+	}
+}
+
diff --git a/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfplan.json b/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfplan.json
new file mode 100644
index 0000000000000..07d7647d1ec07
--- /dev/null
+++ b/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfplan.json
@@ -0,0 +1,205 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.5.5",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_agent.main",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "main",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 0,
+          "values": {
+            "arch": "amd64",
+            "auth": "token",
+            "connection_timeout": 120,
+            "dir": null,
+            "display_apps": [
+              {
+                "port_forwarding_helper": false,
+                "ssh_helper": false,
+                "vscode": false,
+                "vscode_insiders": false,
+                "web_terminal": false
+              }
+            ],
+            "env": null,
+            "login_before_ready": true,
+            "metadata": [],
+            "motd_file": null,
+            "os": "linux",
+            "shutdown_script": null,
+            "shutdown_script_timeout": 300,
+            "startup_script": null,
+            "startup_script_behavior": null,
+            "startup_script_timeout": 300,
+            "troubleshooting_url": null
+          },
+          "sensitive_values": {
+            "display_apps": [
+              {}
+            ],
+            "metadata": []
+          }
+        },
+        {
+          "address": "null_resource.dev",
+          "mode": "managed",
+          "type": "null_resource",
+          "name": "dev",
+          "provider_name": "registry.terraform.io/hashicorp/null",
+          "schema_version": 0,
+          "values": {
+            "triggers": null
+          },
+          "sensitive_values": {}
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "coder_agent.main",
+      "mode": "managed",
+      "type": "coder_agent",
+      "name": "main",
+      "provider_name": "registry.terraform.io/coder/coder",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "arch": "amd64",
+          "auth": "token",
+          "connection_timeout": 120,
+          "dir": null,
+          "display_apps": [
+            {
+              "port_forwarding_helper": false,
+              "ssh_helper": false,
+              "vscode": false,
+              "vscode_insiders": false,
+              "web_terminal": false
+            }
+          ],
+          "env": null,
+          "login_before_ready": true,
+          "metadata": [],
+          "motd_file": null,
+          "os": "linux",
+          "shutdown_script": null,
+          "shutdown_script_timeout": 300,
+          "startup_script": null,
+          "startup_script_behavior": null,
+          "startup_script_timeout": 300,
+          "troubleshooting_url": null
+        },
+        "after_unknown": {
+          "display_apps": [
+            {}
+          ],
+          "id": true,
+          "init_script": true,
+          "metadata": [],
+          "token": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "display_apps": [
+            {}
+          ],
+          "metadata": [],
+          "token": true
+        }
+      }
+    },
+    {
+      "address": "null_resource.dev",
+      "mode": "managed",
+      "type": "null_resource",
+      "name": "dev",
+      "provider_name": "registry.terraform.io/hashicorp/null",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "triggers": null
+        },
+        "after_unknown": {
+          "id": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "coder": {
+        "name": "coder",
+        "full_name": "registry.terraform.io/coder/coder",
+        "version_constraint": "0.11.2"
+      },
+      "null": {
+        "name": "null",
+        "full_name": "registry.terraform.io/hashicorp/null"
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_agent.main",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "main",
+          "provider_config_key": "coder",
+          "expressions": {
+            "arch": {
+              "constant_value": "amd64"
+            },
+            "display_apps": [
+              {
+                "port_forwarding_helper": {
+                  "constant_value": false
+                },
+                "ssh_helper": {
+                  "constant_value": false
+                },
+                "vscode": {
+                  "constant_value": false
+                },
+                "vscode_insiders": {
+                  "constant_value": false
+                },
+                "web_terminal": {
+                  "constant_value": false
+                }
+              }
+            ],
+            "os": {
+              "constant_value": "linux"
+            }
+          },
+          "schema_version": 0
+        },
+        {
+          "address": "null_resource.dev",
+          "mode": "managed",
+          "type": "null_resource",
+          "name": "dev",
+          "provider_config_key": "null",
+          "schema_version": 0,
+          "depends_on": [
+            "coder_agent.main"
+          ]
+        }
+      ]
+    }
+  },
+  "timestamp": "2023-08-30T19:25:10Z"
+}
diff --git a/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfstate.dot b/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfstate.dot
new file mode 100644
index 0000000000000..a1dd4289708f0
--- /dev/null
+++ b/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfstate.dot
@@ -0,0 +1,18 @@
+digraph {
+	compound = "true"
+	newrank = "true"
+	subgraph "root" {
+		"[root] coder_agent.main (expand)" [label = "coder_agent.main", shape = "box"]
+		"[root] null_resource.dev (expand)" [label = "null_resource.dev", shape = "box"]
+		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
+		"[root] provider[\"registry.terraform.io/hashicorp/null\"]" [label = "provider[\"registry.terraform.io/hashicorp/null\"]", shape = "diamond"]
+		"[root] coder_agent.main (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] null_resource.dev (expand)" -> "[root] coder_agent.main (expand)"
+		"[root] null_resource.dev (expand)" -> "[root] provider[\"registry.terraform.io/hashicorp/null\"]"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_agent.main (expand)"
+		"[root] provider[\"registry.terraform.io/hashicorp/null\"] (close)" -> "[root] null_resource.dev (expand)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/coder/coder\"] (close)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/hashicorp/null\"] (close)"
+	}
+}
+
diff --git a/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfstate.json b/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfstate.json
new file mode 100644
index 0000000000000..dd0f7eed39ed9
--- /dev/null
+++ b/provisioner/terraform/testdata/display-apps-disabled/display-apps-disabled.tfstate.json
@@ -0,0 +1,70 @@
+{
+  "format_version": "1.0",
+  "terraform_version": "1.5.5",
+  "values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_agent.main",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "main",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 0,
+          "values": {
+            "arch": "amd64",
+            "auth": "token",
+            "connection_timeout": 120,
+            "dir": null,
+            "display_apps": [
+              {
+                "port_forwarding_helper": false,
+                "ssh_helper": false,
+                "vscode": false,
+                "vscode_insiders": false,
+                "web_terminal": false
+              }
+            ],
+            "env": null,
+            "id": "ba0faeb0-5a14-4908-946e-360329a8c852",
+            "init_script": "",
+            "login_before_ready": true,
+            "metadata": [],
+            "motd_file": null,
+            "os": "linux",
+            "shutdown_script": null,
+            "shutdown_script_timeout": 300,
+            "startup_script": null,
+            "startup_script_behavior": null,
+            "startup_script_timeout": 300,
+            "token": "010c13b9-95aa-4b66-a2ad-5937e467134a",
+            "troubleshooting_url": null
+          },
+          "sensitive_values": {
+            "display_apps": [
+              {}
+            ],
+            "metadata": [],
+            "token": true
+          }
+        },
+        {
+          "address": "null_resource.dev",
+          "mode": "managed",
+          "type": "null_resource",
+          "name": "dev",
+          "provider_name": "registry.terraform.io/hashicorp/null",
+          "schema_version": 0,
+          "values": {
+            "id": "7220106781059326067",
+            "triggers": null
+          },
+          "sensitive_values": {},
+          "depends_on": [
+            "coder_agent.main"
+          ]
+        }
+      ]
+    }
+  }
+}
diff --git a/provisioner/terraform/testdata/display-apps/display-apps.tf b/provisioner/terraform/testdata/display-apps/display-apps.tf
new file mode 100644
index 0000000000000..f4398bcdf34c2
--- /dev/null
+++ b/provisioner/terraform/testdata/display-apps/display-apps.tf
@@ -0,0 +1,26 @@
+terraform {
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = "0.11.2"
+    }
+  }
+}
+
+resource "coder_agent" "main" {
+  os   = "linux"
+  arch = "amd64"
+  display_apps {
+    vscode                 = false
+    vscode_insiders        = true
+    web_terminal           = true
+    port_forwarding_helper = false
+    ssh_helper             = false
+  }
+}
+
+resource "null_resource" "dev" {
+  depends_on = [
+    coder_agent.main
+  ]
+}
diff --git a/provisioner/terraform/testdata/display-apps/display-apps.tfplan.dot b/provisioner/terraform/testdata/display-apps/display-apps.tfplan.dot
new file mode 100644
index 0000000000000..a1dd4289708f0
--- /dev/null
+++ b/provisioner/terraform/testdata/display-apps/display-apps.tfplan.dot
@@ -0,0 +1,18 @@
+digraph {
+	compound = "true"
+	newrank = "true"
+	subgraph "root" {
+		"[root] coder_agent.main (expand)" [label = "coder_agent.main", shape = "box"]
+		"[root] null_resource.dev (expand)" [label = "null_resource.dev", shape = "box"]
+		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
+		"[root] provider[\"registry.terraform.io/hashicorp/null\"]" [label = "provider[\"registry.terraform.io/hashicorp/null\"]", shape = "diamond"]
+		"[root] coder_agent.main (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] null_resource.dev (expand)" -> "[root] coder_agent.main (expand)"
+		"[root] null_resource.dev (expand)" -> "[root] provider[\"registry.terraform.io/hashicorp/null\"]"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_agent.main (expand)"
+		"[root] provider[\"registry.terraform.io/hashicorp/null\"] (close)" -> "[root] null_resource.dev (expand)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/coder/coder\"] (close)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/hashicorp/null\"] (close)"
+	}
+}
+
diff --git a/provisioner/terraform/testdata/display-apps/display-apps.tfplan.json b/provisioner/terraform/testdata/display-apps/display-apps.tfplan.json
new file mode 100644
index 0000000000000..135f576b99422
--- /dev/null
+++ b/provisioner/terraform/testdata/display-apps/display-apps.tfplan.json
@@ -0,0 +1,205 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.5.5",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_agent.main",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "main",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 0,
+          "values": {
+            "arch": "amd64",
+            "auth": "token",
+            "connection_timeout": 120,
+            "dir": null,
+            "display_apps": [
+              {
+                "port_forwarding_helper": false,
+                "ssh_helper": false,
+                "vscode": false,
+                "vscode_insiders": true,
+                "web_terminal": true
+              }
+            ],
+            "env": null,
+            "login_before_ready": true,
+            "metadata": [],
+            "motd_file": null,
+            "os": "linux",
+            "shutdown_script": null,
+            "shutdown_script_timeout": 300,
+            "startup_script": null,
+            "startup_script_behavior": null,
+            "startup_script_timeout": 300,
+            "troubleshooting_url": null
+          },
+          "sensitive_values": {
+            "display_apps": [
+              {}
+            ],
+            "metadata": []
+          }
+        },
+        {
+          "address": "null_resource.dev",
+          "mode": "managed",
+          "type": "null_resource",
+          "name": "dev",
+          "provider_name": "registry.terraform.io/hashicorp/null",
+          "schema_version": 0,
+          "values": {
+            "triggers": null
+          },
+          "sensitive_values": {}
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "coder_agent.main",
+      "mode": "managed",
+      "type": "coder_agent",
+      "name": "main",
+      "provider_name": "registry.terraform.io/coder/coder",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "arch": "amd64",
+          "auth": "token",
+          "connection_timeout": 120,
+          "dir": null,
+          "display_apps": [
+            {
+              "port_forwarding_helper": false,
+              "ssh_helper": false,
+              "vscode": false,
+              "vscode_insiders": true,
+              "web_terminal": true
+            }
+          ],
+          "env": null,
+          "login_before_ready": true,
+          "metadata": [],
+          "motd_file": null,
+          "os": "linux",
+          "shutdown_script": null,
+          "shutdown_script_timeout": 300,
+          "startup_script": null,
+          "startup_script_behavior": null,
+          "startup_script_timeout": 300,
+          "troubleshooting_url": null
+        },
+        "after_unknown": {
+          "display_apps": [
+            {}
+          ],
+          "id": true,
+          "init_script": true,
+          "metadata": [],
+          "token": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "display_apps": [
+            {}
+          ],
+          "metadata": [],
+          "token": true
+        }
+      }
+    },
+    {
+      "address": "null_resource.dev",
+      "mode": "managed",
+      "type": "null_resource",
+      "name": "dev",
+      "provider_name": "registry.terraform.io/hashicorp/null",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "triggers": null
+        },
+        "after_unknown": {
+          "id": true
+        },
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "configuration": {
+    "provider_config": {
+      "coder": {
+        "name": "coder",
+        "full_name": "registry.terraform.io/coder/coder",
+        "version_constraint": "0.11.2"
+      },
+      "null": {
+        "name": "null",
+        "full_name": "registry.terraform.io/hashicorp/null"
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_agent.main",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "main",
+          "provider_config_key": "coder",
+          "expressions": {
+            "arch": {
+              "constant_value": "amd64"
+            },
+            "display_apps": [
+              {
+                "port_forwarding_helper": {
+                  "constant_value": false
+                },
+                "ssh_helper": {
+                  "constant_value": false
+                },
+                "vscode": {
+                  "constant_value": false
+                },
+                "vscode_insiders": {
+                  "constant_value": true
+                },
+                "web_terminal": {
+                  "constant_value": true
+                }
+              }
+            ],
+            "os": {
+              "constant_value": "linux"
+            }
+          },
+          "schema_version": 0
+        },
+        {
+          "address": "null_resource.dev",
+          "mode": "managed",
+          "type": "null_resource",
+          "name": "dev",
+          "provider_config_key": "null",
+          "schema_version": 0,
+          "depends_on": [
+            "coder_agent.main"
+          ]
+        }
+      ]
+    }
+  },
+  "timestamp": "2023-08-30T19:25:07Z"
+}
diff --git a/provisioner/terraform/testdata/display-apps/display-apps.tfstate.dot b/provisioner/terraform/testdata/display-apps/display-apps.tfstate.dot
new file mode 100644
index 0000000000000..a1dd4289708f0
--- /dev/null
+++ b/provisioner/terraform/testdata/display-apps/display-apps.tfstate.dot
@@ -0,0 +1,18 @@
+digraph {
+	compound = "true"
+	newrank = "true"
+	subgraph "root" {
+		"[root] coder_agent.main (expand)" [label = "coder_agent.main", shape = "box"]
+		"[root] null_resource.dev (expand)" [label = "null_resource.dev", shape = "box"]
+		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
+		"[root] provider[\"registry.terraform.io/hashicorp/null\"]" [label = "provider[\"registry.terraform.io/hashicorp/null\"]", shape = "diamond"]
+		"[root] coder_agent.main (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] null_resource.dev (expand)" -> "[root] coder_agent.main (expand)"
+		"[root] null_resource.dev (expand)" -> "[root] provider[\"registry.terraform.io/hashicorp/null\"]"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_agent.main (expand)"
+		"[root] provider[\"registry.terraform.io/hashicorp/null\"] (close)" -> "[root] null_resource.dev (expand)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/coder/coder\"] (close)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/hashicorp/null\"] (close)"
+	}
+}
+
diff --git a/provisioner/terraform/testdata/display-apps/display-apps.tfstate.json b/provisioner/terraform/testdata/display-apps/display-apps.tfstate.json
new file mode 100644
index 0000000000000..6742240dd2800
--- /dev/null
+++ b/provisioner/terraform/testdata/display-apps/display-apps.tfstate.json
@@ -0,0 +1,70 @@
+{
+  "format_version": "1.0",
+  "terraform_version": "1.5.5",
+  "values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_agent.main",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "main",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 0,
+          "values": {
+            "arch": "amd64",
+            "auth": "token",
+            "connection_timeout": 120,
+            "dir": null,
+            "display_apps": [
+              {
+                "port_forwarding_helper": false,
+                "ssh_helper": false,
+                "vscode": false,
+                "vscode_insiders": true,
+                "web_terminal": true
+              }
+            ],
+            "env": null,
+            "id": "a7b8ff17-66ba-47b4-a4b4-51da1ad835fc",
+            "init_script": "",
+            "login_before_ready": true,
+            "metadata": [],
+            "motd_file": null,
+            "os": "linux",
+            "shutdown_script": null,
+            "shutdown_script_timeout": 300,
+            "startup_script": null,
+            "startup_script_behavior": null,
+            "startup_script_timeout": 300,
+            "token": "75fc044a-b120-4e86-be94-056cec981bd9",
+            "troubleshooting_url": null
+          },
+          "sensitive_values": {
+            "display_apps": [
+              {}
+            ],
+            "metadata": [],
+            "token": true
+          }
+        },
+        {
+          "address": "null_resource.dev",
+          "mode": "managed",
+          "type": "null_resource",
+          "name": "dev",
+          "provider_name": "registry.terraform.io/hashicorp/null",
+          "schema_version": 0,
+          "values": {
+            "id": "4184951391452107661",
+            "triggers": null
+          },
+          "sensitive_values": {},
+          "depends_on": [
+            "coder_agent.main"
+          ]
+        }
+      ]
+    }
+  }
+}
diff --git a/provisioner/terraform/testdata/fake_cancel.sh b/provisioner/terraform/testdata/fake_cancel.sh
index cd2511facf938..2ea713379cce9 100755
--- a/provisioner/terraform/testdata/fake_cancel.sh
+++ b/provisioner/terraform/testdata/fake_cancel.sh
@@ -22,8 +22,9 @@ version)
 	;;
 init)
 	case "$MODE" in
-	apply)
+	plan)
 		echo "init"
+		exit 0
 		;;
 	init)
 		sleep 10 &
@@ -39,7 +40,7 @@ init)
 		;;
 	esac
 	;;
-apply)
+plan)
 	sleep 10 &
 	sleep_pid=$!
 
@@ -47,14 +48,14 @@ apply)
 	trap 'json_print interrupt; exit 1' INT
 	trap 'json_print terminate; exit 2' TERM
 
-	json_print apply_start
+	json_print plan_start
 	wait
-	json_print apply_end
+	json_print plan_end
 	;;
-plan)
-	echo "plan not supported"
+apply)
+	echo "apply not supported"
 	exit 1
 	;;
 esac
 
-exit 0
+exit 10
diff --git a/provisioner/terraform/testdata/fake_cancel_hang.sh b/provisioner/terraform/testdata/fake_cancel_hang.sh
index c6d29c88c733f..e8db67f6837cd 100755
--- a/provisioner/terraform/testdata/fake_cancel_hang.sh
+++ b/provisioner/terraform/testdata/fake_cancel_hang.sh
@@ -23,19 +23,19 @@ init)
 	echo "init"
 	exit 0
 	;;
-apply)
+plan)
 	trap 'json_print interrupt' INT
 
-	json_print apply_start
+	json_print plan_start
 	sleep 10 2>/dev/null >/dev/null
-	json_print apply_end
+	json_print plan_end
 
 	exit 0
 	;;
-plan)
-	echo "plan not supported"
+apply)
+	echo "apply not supported"
 	exit 1
 	;;
 esac
 
-exit 0
+exit 10
diff --git a/provisioner/terraform/testdata/generate.sh b/provisioner/terraform/testdata/generate.sh
index 29e26a310c522..4ae1a87fb2504 100755
--- a/provisioner/terraform/testdata/generate.sh
+++ b/provisioner/terraform/testdata/generate.sh
@@ -13,6 +13,12 @@ for d in */; do
 		continue
 	fi
 
+	# This directory is used for a different purpose (quick workaround).
+	if [[ $name == "cleanup-stale-plugins" ]]; then
+		popd
+		continue
+	fi
+
 	terraform init -upgrade
 	terraform plan -out terraform.tfplan
 	terraform show -json ./terraform.tfplan | jq >"$name".tfplan.json
diff --git a/provisioner/terraform/testdata/git-auth-providers/git-auth-providers.tfplan.json b/provisioner/terraform/testdata/git-auth-providers/git-auth-providers.tfplan.json
index 05d34d9265d50..e5976f1d4341d 100644
--- a/provisioner/terraform/testdata/git-auth-providers/git-auth-providers.tfplan.json
+++ b/provisioner/terraform/testdata/git-auth-providers/git-auth-providers.tfplan.json
@@ -1,6 +1,6 @@
 {
-  "format_version": "1.1",
-  "terraform_version": "1.3.7",
+  "format_version": "1.2",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -105,7 +105,7 @@
   ],
   "prior_state": {
     "format_version": "1.0",
-    "terraform_version": "1.3.7",
+    "terraform_version": "1.5.5",
     "values": {
       "root_module": {
         "resources": [
@@ -208,5 +208,6 @@
         }
       ]
     }
-  }
+  },
+  "timestamp": "2023-08-30T19:25:13Z"
 }
diff --git a/provisioner/terraform/testdata/git-auth-providers/git-auth-providers.tfstate.json b/provisioner/terraform/testdata/git-auth-providers/git-auth-providers.tfstate.json
index 6116c9d09377d..0abc4e8a4cf32 100644
--- a/provisioner/terraform/testdata/git-auth-providers/git-auth-providers.tfstate.json
+++ b/provisioner/terraform/testdata/git-auth-providers/git-auth-providers.tfstate.json
@@ -1,36 +1,9 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.3.7",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
-        {
-          "address": "coder_agent.main",
-          "mode": "managed",
-          "type": "coder_agent",
-          "name": "main",
-          "provider_name": "registry.terraform.io/coder/coder",
-          "schema_version": 0,
-          "values": {
-            "arch": "amd64",
-            "auth": "token",
-            "connection_timeout": 120,
-            "dir": null,
-            "env": null,
-            "id": "7060319c-a8bf-44b7-8fb9-5a4dc3bd35fe",
-            "init_script": "",
-            "login_before_ready": true,
-            "motd_file": null,
-            "os": "linux",
-            "shutdown_script": null,
-            "shutdown_script_timeout": 300,
-            "startup_script": null,
-            "startup_script_timeout": 300,
-            "token": "9ea68982-fd51-4510-9c23-9e9ad1ce1ef7",
-            "troubleshooting_url": null
-          },
-          "sensitive_values": {}
-        },
         {
           "address": "data.coder_git_auth.github",
           "mode": "data",
@@ -57,6 +30,35 @@
           },
           "sensitive_values": {}
         },
+        {
+          "address": "coder_agent.main",
+          "mode": "managed",
+          "type": "coder_agent",
+          "name": "main",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 0,
+          "values": {
+            "arch": "amd64",
+            "auth": "token",
+            "connection_timeout": 120,
+            "dir": null,
+            "env": null,
+            "id": "a8139f31-219b-4ee5-9e64-60d8dd94be27",
+            "init_script": "",
+            "login_before_ready": true,
+            "motd_file": null,
+            "os": "linux",
+            "shutdown_script": null,
+            "shutdown_script_timeout": 300,
+            "startup_script": null,
+            "startup_script_timeout": 300,
+            "token": "20cdf0ee-2da9-432e-a3ad-674b900ed3c1",
+            "troubleshooting_url": null
+          },
+          "sensitive_values": {
+            "token": true
+          }
+        },
         {
           "address": "null_resource.dev",
           "mode": "managed",
@@ -65,7 +67,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "4918728983070449527",
+            "id": "8246789295692160686",
             "triggers": null
           },
           "sensitive_values": {},
diff --git a/provisioner/terraform/testdata/instance-id/instance-id.tfplan.json b/provisioner/terraform/testdata/instance-id/instance-id.tfplan.json
index f54a0d003e4c8..cd94915162d1c 100644
--- a/provisioner/terraform/testdata/instance-id/instance-id.tfplan.json
+++ b/provisioner/terraform/testdata/instance-id/instance-id.tfplan.json
@@ -1,6 +1,6 @@
 {
-  "format_version": "1.1",
-  "terraform_version": "1.3.7",
+  "format_version": "1.2",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -200,5 +200,6 @@
         "id"
       ]
     }
-  ]
+  ],
+  "timestamp": "2023-08-30T19:25:15Z"
 }
diff --git a/provisioner/terraform/testdata/instance-id/instance-id.tfstate.json b/provisioner/terraform/testdata/instance-id/instance-id.tfstate.json
index cc8870100a9b9..6b91850750048 100644
--- a/provisioner/terraform/testdata/instance-id/instance-id.tfstate.json
+++ b/provisioner/terraform/testdata/instance-id/instance-id.tfstate.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.3.7",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
@@ -17,14 +17,16 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "facfb2ad-417d-412c-8304-ce50ff8a886e",
+            "id": "07c39e97-3461-4912-87c6-aab06714fb79",
             "init_script": "",
             "os": "linux",
             "startup_script": null,
-            "token": "f1b3312a-af1c-45a8-9695-23d92c4cb68d",
+            "token": "4d389c4e-479b-4004-8ad1-b10da989bbdb",
             "troubleshooting_url": null
           },
-          "sensitive_values": {}
+          "sensitive_values": {
+            "token": true
+          }
         },
         {
           "address": "coder_agent_instance.main",
@@ -34,8 +36,8 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 0,
           "values": {
-            "agent_id": "facfb2ad-417d-412c-8304-ce50ff8a886e",
-            "id": "6ce4c6f4-1b93-4b22-9b17-1dcb50a36e77",
+            "agent_id": "07c39e97-3461-4912-87c6-aab06714fb79",
+            "id": "13ac93bd-54bf-4e93-b2a1-35534139e255",
             "instance_id": "example"
           },
           "sensitive_values": {},
@@ -51,7 +53,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "2761080386857837319",
+            "id": "8984327635720248545",
             "triggers": null
           },
           "sensitive_values": {},
diff --git a/provisioner/terraform/testdata/mapped-apps/mapped-apps.tfplan.json b/provisioner/terraform/testdata/mapped-apps/mapped-apps.tfplan.json
index 41e69f1cc351f..600373f73aeb0 100644
--- a/provisioner/terraform/testdata/mapped-apps/mapped-apps.tfplan.json
+++ b/provisioner/terraform/testdata/mapped-apps/mapped-apps.tfplan.json
@@ -1,6 +1,6 @@
 {
-  "format_version": "1.1",
-  "terraform_version": "1.3.7",
+  "format_version": "1.2",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -294,5 +294,6 @@
         "id"
       ]
     }
-  ]
+  ],
+  "timestamp": "2023-08-30T19:25:17Z"
 }
diff --git a/provisioner/terraform/testdata/mapped-apps/mapped-apps.tfstate.json b/provisioner/terraform/testdata/mapped-apps/mapped-apps.tfstate.json
index 91f08d1e250e4..99ab3f5adad8a 100644
--- a/provisioner/terraform/testdata/mapped-apps/mapped-apps.tfstate.json
+++ b/provisioner/terraform/testdata/mapped-apps/mapped-apps.tfstate.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.3.7",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
@@ -17,14 +17,16 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "441cfb02-3044-4d2b-ac2c-1ac150ec8c58",
+            "id": "9a8356cf-b5ef-4da0-9b4e-cfeaca1fbfcf",
             "init_script": "",
             "os": "linux",
             "startup_script": null,
-            "token": "75ee44b6-4cbb-4615-acb2-19c53f82dc58",
+            "token": "7116ebd2-5205-4427-8cdb-5f86ec819911",
             "troubleshooting_url": null
           },
-          "sensitive_values": {}
+          "sensitive_values": {
+            "token": true
+          }
         },
         {
           "address": "coder_app.apps[\"app1\"]",
@@ -35,12 +37,12 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 0,
           "values": {
-            "agent_id": "441cfb02-3044-4d2b-ac2c-1ac150ec8c58",
+            "agent_id": "9a8356cf-b5ef-4da0-9b4e-cfeaca1fbfcf",
             "command": null,
             "display_name": "app1",
             "healthcheck": [],
             "icon": null,
-            "id": "abbc4449-5dd1-4ee0-ac58-3055a6da206b",
+            "id": "8ad9b3c3-0951-4612-adea-5c89ac12642a",
             "name": null,
             "relative_path": null,
             "share": "owner",
@@ -64,12 +66,12 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 0,
           "values": {
-            "agent_id": "441cfb02-3044-4d2b-ac2c-1ac150ec8c58",
+            "agent_id": "9a8356cf-b5ef-4da0-9b4e-cfeaca1fbfcf",
             "command": null,
             "display_name": "app2",
             "healthcheck": [],
             "icon": null,
-            "id": "ff87411e-4edb-48ce-b62f-6f792d02b25c",
+            "id": "b3cbb3eb-62d8-485f-8378-2d2ed751aa38",
             "name": null,
             "relative_path": null,
             "share": "owner",
@@ -92,7 +94,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "3464468981645058362",
+            "id": "5757307222275435634",
             "triggers": null
           },
           "sensitive_values": {},
diff --git a/provisioner/terraform/testdata/multiple-agents/multiple-agents.tfplan.json b/provisioner/terraform/testdata/multiple-agents/multiple-agents.tfplan.json
index 0dcfef92a671a..4cdf0a05ee33b 100644
--- a/provisioner/terraform/testdata/multiple-agents/multiple-agents.tfplan.json
+++ b/provisioner/terraform/testdata/multiple-agents/multiple-agents.tfplan.json
@@ -1,6 +1,6 @@
 {
-  "format_version": "1.1",
-  "terraform_version": "1.3.7",
+  "format_version": "1.2",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -439,5 +439,6 @@
         }
       ]
     }
-  }
+  },
+  "timestamp": "2023-08-30T19:25:20Z"
 }
diff --git a/provisioner/terraform/testdata/multiple-agents/multiple-agents.tfstate.json b/provisioner/terraform/testdata/multiple-agents/multiple-agents.tfstate.json
index 01a31f1524136..d9bfc636cd442 100644
--- a/provisioner/terraform/testdata/multiple-agents/multiple-agents.tfstate.json
+++ b/provisioner/terraform/testdata/multiple-agents/multiple-agents.tfstate.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.3.7",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
@@ -17,7 +17,7 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "ff8b851f-127f-452f-9180-4e619b0093f2",
+            "id": "094d300c-f07a-4357-870f-6ca1fc9154a2",
             "init_script": "",
             "login_before_ready": true,
             "metadata": [],
@@ -28,11 +28,12 @@
             "startup_script": null,
             "startup_script_behavior": null,
             "startup_script_timeout": 300,
-            "token": "36dbfd5d-adf5-4e3e-9d92-190be56773fa",
+            "token": "27bd44bc-0126-4c8d-9b98-8f27619e3656",
             "troubleshooting_url": null
           },
           "sensitive_values": {
-            "metadata": []
+            "metadata": [],
+            "token": true
           }
         },
         {
@@ -48,7 +49,7 @@
             "connection_timeout": 1,
             "dir": null,
             "env": null,
-            "id": "a4951d98-2e07-4144-8942-a6f7584a6da0",
+            "id": "bb844516-2cdd-419c-87e1-d0d3ea69fe78",
             "init_script": "",
             "login_before_ready": true,
             "metadata": [],
@@ -59,11 +60,12 @@
             "startup_script": null,
             "startup_script_behavior": "non-blocking",
             "startup_script_timeout": 30,
-            "token": "f101a336-401d-4744-848f-437fe635f832",
+            "token": "8a31b688-d3d2-4c22-b37e-c9810b9b329a",
             "troubleshooting_url": null
           },
           "sensitive_values": {
-            "metadata": []
+            "metadata": [],
+            "token": true
           }
         },
         {
@@ -79,7 +81,7 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "a3e1eaae-4bfd-4240-bc0a-0e940c3dd861",
+            "id": "c6123c01-0543-4102-bdcf-f0ee2a9c1269",
             "init_script": "",
             "login_before_ready": true,
             "metadata": [],
@@ -90,11 +92,12 @@
             "startup_script": null,
             "startup_script_behavior": "blocking",
             "startup_script_timeout": 300,
-            "token": "1551c374-aae3-4be8-8fa2-6082921b837f",
+            "token": "64185462-292f-4b75-b350-625326ba596e",
             "troubleshooting_url": "https://coder.com/troubleshoot"
           },
           "sensitive_values": {
-            "metadata": []
+            "metadata": [],
+            "token": true
           }
         },
         {
@@ -110,7 +113,7 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "fb94747b-e187-4c69-9c95-fb09c0832664",
+            "id": "85d0614c-3e44-4f20-b4bf-a015c8dfcaac",
             "init_script": "",
             "login_before_ready": false,
             "metadata": [],
@@ -121,11 +124,12 @@
             "startup_script": null,
             "startup_script_behavior": null,
             "startup_script_timeout": 300,
-            "token": "714bf65d-92ff-4e7c-adbe-211b15a21085",
+            "token": "021b1139-fa63-42ba-be1a-85f8456f3c28",
             "troubleshooting_url": null
           },
           "sensitive_values": {
-            "metadata": []
+            "metadata": [],
+            "token": true
           }
         },
         {
@@ -136,7 +140,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "3687348305461113369",
+            "id": "6753149467284740901",
             "triggers": null
           },
           "sensitive_values": {},
diff --git a/provisioner/terraform/testdata/multiple-apps/multiple-apps.tfplan.json b/provisioner/terraform/testdata/multiple-apps/multiple-apps.tfplan.json
index 9b10a6a2d50d7..27958fe02d975 100644
--- a/provisioner/terraform/testdata/multiple-apps/multiple-apps.tfplan.json
+++ b/provisioner/terraform/testdata/multiple-apps/multiple-apps.tfplan.json
@@ -1,6 +1,6 @@
 {
-  "format_version": "1.1",
-  "terraform_version": "1.3.7",
+  "format_version": "1.2",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -409,5 +409,6 @@
         "id"
       ]
     }
-  ]
+  ],
+  "timestamp": "2023-08-30T19:25:22Z"
 }
diff --git a/provisioner/terraform/testdata/multiple-apps/multiple-apps.tfstate.json b/provisioner/terraform/testdata/multiple-apps/multiple-apps.tfstate.json
index 1f27d054930ec..92ede7e786e85 100644
--- a/provisioner/terraform/testdata/multiple-apps/multiple-apps.tfstate.json
+++ b/provisioner/terraform/testdata/multiple-apps/multiple-apps.tfstate.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.3.7",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
@@ -17,14 +17,16 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "54519a12-e34b-4c4f-aef9-7dfac5f4949b",
+            "id": "c8dab94d-651c-4d9b-a19a-1c067a2976ea",
             "init_script": "",
             "os": "linux",
             "startup_script": null,
-            "token": "bf339e89-0594-4f44-83f0-fc7cde9ceb0c",
+            "token": "96745539-f607-45f5-aa71-4f70f593ca6a",
             "troubleshooting_url": null
           },
-          "sensitive_values": {}
+          "sensitive_values": {
+            "token": true
+          }
         },
         {
           "address": "coder_app.app1",
@@ -34,12 +36,12 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 0,
           "values": {
-            "agent_id": "54519a12-e34b-4c4f-aef9-7dfac5f4949b",
+            "agent_id": "c8dab94d-651c-4d9b-a19a-1c067a2976ea",
             "command": null,
             "display_name": null,
             "healthcheck": [],
             "icon": null,
-            "id": "13101247-bdf1-409e-81e2-51a4ff45576b",
+            "id": "de5959cb-248c-44a0-bd04-9d5f28dfb415",
             "name": null,
             "relative_path": null,
             "share": "owner",
@@ -62,7 +64,7 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 0,
           "values": {
-            "agent_id": "54519a12-e34b-4c4f-aef9-7dfac5f4949b",
+            "agent_id": "c8dab94d-651c-4d9b-a19a-1c067a2976ea",
             "command": null,
             "display_name": null,
             "healthcheck": [
@@ -73,7 +75,7 @@
               }
             ],
             "icon": null,
-            "id": "ef508497-0437-43eb-b773-c0622582ab5d",
+            "id": "60aaa860-01d1-4d42-804b-2dc689676307",
             "name": null,
             "relative_path": null,
             "share": "owner",
@@ -98,12 +100,12 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 0,
           "values": {
-            "agent_id": "54519a12-e34b-4c4f-aef9-7dfac5f4949b",
+            "agent_id": "c8dab94d-651c-4d9b-a19a-1c067a2976ea",
             "command": null,
             "display_name": null,
             "healthcheck": [],
             "icon": null,
-            "id": "2c187306-80cc-46ba-a75c-42d4648ff94a",
+            "id": "3455e899-9bf9-4c0e-ac5b-6f861d5541a0",
             "name": null,
             "relative_path": null,
             "share": "owner",
@@ -126,7 +128,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "1264552698255765246",
+            "id": "7562947701260361048",
             "triggers": null
           },
           "sensitive_values": {},
diff --git a/provisioner/terraform/testdata/resource-metadata-duplicate/resource-metadata-duplicate.tfplan.json b/provisioner/terraform/testdata/resource-metadata-duplicate/resource-metadata-duplicate.tfplan.json
index 7b707c26d89e4..54a7edb51063b 100644
--- a/provisioner/terraform/testdata/resource-metadata-duplicate/resource-metadata-duplicate.tfplan.json
+++ b/provisioner/terraform/testdata/resource-metadata-duplicate/resource-metadata-duplicate.tfplan.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.2",
-  "terraform_version": "1.5.1",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -424,5 +424,5 @@
       ]
     }
   ],
-  "timestamp": "2023-07-05T10:28:42Z"
+  "timestamp": "2023-08-30T19:25:27Z"
 }
diff --git a/provisioner/terraform/testdata/resource-metadata-duplicate/resource-metadata-duplicate.tfstate.json b/provisioner/terraform/testdata/resource-metadata-duplicate/resource-metadata-duplicate.tfstate.json
index cd0c4afd775c7..f09fea579e70f 100644
--- a/provisioner/terraform/testdata/resource-metadata-duplicate/resource-metadata-duplicate.tfstate.json
+++ b/provisioner/terraform/testdata/resource-metadata-duplicate/resource-metadata-duplicate.tfstate.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.5.1",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
@@ -17,7 +17,7 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "d211806f-511a-4ced-aa68-c70ca3eeab60",
+            "id": "4d2791c5-e623-4c79-9c3a-81d70fde0f1d",
             "init_script": "",
             "login_before_ready": true,
             "metadata": [
@@ -36,7 +36,7 @@
             "startup_script": null,
             "startup_script_behavior": null,
             "startup_script_timeout": 300,
-            "token": "746a2a79-b575-4eab-9e03-ec95d53a810c",
+            "token": "b068b430-4ecb-4116-a103-de3aaa1abd3e",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -57,7 +57,7 @@
             "daily_cost": 29,
             "hide": true,
             "icon": "/icon/server.svg",
-            "id": "0ddb64e0-ed2f-493a-a305-bd617837faad",
+            "id": "0a46d060-c676-4324-a016-8dcdc7581d36",
             "item": [
               {
                 "is_null": false,
@@ -72,7 +72,7 @@
                 "value": ""
               }
             ],
-            "resource_id": "799423861826055007"
+            "resource_id": "6477445272839759515"
           },
           "sensitive_values": {
             "item": [
@@ -96,7 +96,7 @@
             "daily_cost": 20,
             "hide": true,
             "icon": "/icon/server.svg",
-            "id": "305c001c-28d4-4d90-adc7-655a3a89eb2e",
+            "id": "77a107bc-073e-4180-9f7f-0e60fc42b6c2",
             "item": [
               {
                 "is_null": false,
@@ -105,7 +105,7 @@
                 "value": "world"
               }
             ],
-            "resource_id": "799423861826055007"
+            "resource_id": "6477445272839759515"
           },
           "sensitive_values": {
             "item": [
@@ -125,7 +125,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "799423861826055007",
+            "id": "6477445272839759515",
             "triggers": null
           },
           "sensitive_values": {},
diff --git a/provisioner/terraform/testdata/resource-metadata/resource-metadata.tfplan.json b/provisioner/terraform/testdata/resource-metadata/resource-metadata.tfplan.json
index 9fae1dcf31951..a145791cb9b26 100644
--- a/provisioner/terraform/testdata/resource-metadata/resource-metadata.tfplan.json
+++ b/provisioner/terraform/testdata/resource-metadata/resource-metadata.tfplan.json
@@ -1,6 +1,6 @@
 {
-  "format_version": "1.1",
-  "terraform_version": "1.3.7",
+  "format_version": "1.2",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -246,7 +246,7 @@
       "coder": {
         "name": "coder",
         "full_name": "registry.terraform.io/coder/coder",
-        "version_constraint": "0.7.0-rc0"
+        "version_constraint": "0.7.0"
       },
       "null": {
         "name": "null",
@@ -370,5 +370,6 @@
         "id"
       ]
     }
-  ]
+  ],
+  "timestamp": "2023-08-30T19:25:25Z"
 }
diff --git a/provisioner/terraform/testdata/resource-metadata/resource-metadata.tfstate.json b/provisioner/terraform/testdata/resource-metadata/resource-metadata.tfstate.json
index efcf3b98e13ed..b06c9e2964296 100644
--- a/provisioner/terraform/testdata/resource-metadata/resource-metadata.tfstate.json
+++ b/provisioner/terraform/testdata/resource-metadata/resource-metadata.tfstate.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.3.7",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
@@ -17,7 +17,7 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "2090d6c6-c4c1-4219-b8f8-9df6db6d5864",
+            "id": "6b3b30af-2ac4-4e70-a162-42008b6f7b61",
             "init_script": "",
             "login_before_ready": true,
             "metadata": [
@@ -35,13 +35,14 @@
             "shutdown_script_timeout": 300,
             "startup_script": null,
             "startup_script_timeout": 300,
-            "token": "a984d85d-eff6-4366-9658-9719fb3dd82e",
+            "token": "fd450209-d2ce-4d89-8a48-b937de972e41",
             "troubleshooting_url": null
           },
           "sensitive_values": {
             "metadata": [
               {}
-            ]
+            ],
+            "token": true
           }
         },
         {
@@ -55,7 +56,7 @@
             "daily_cost": 29,
             "hide": true,
             "icon": "/icon/server.svg",
-            "id": "9e239cb2-e381-423a-bf16-74ece8254eff",
+            "id": "0bd3be9b-5733-48ee-807a-dadf70117512",
             "item": [
               {
                 "is_null": false,
@@ -82,7 +83,7 @@
                 "value": "squirrel"
               }
             ],
-            "resource_id": "3104684855633455084"
+            "resource_id": "5418245869413214440"
           },
           "sensitive_values": {
             "item": [
@@ -105,7 +106,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "3104684855633455084",
+            "id": "5418245869413214440",
             "triggers": null
           },
           "sensitive_values": {},
diff --git a/provisioner/terraform/testdata/rich-parameters-order/rich-parameters-order.tfplan.json b/provisioner/terraform/testdata/rich-parameters-order/rich-parameters-order.tfplan.json
index 3e0b5d90553f4..169a8883f2596 100644
--- a/provisioner/terraform/testdata/rich-parameters-order/rich-parameters-order.tfplan.json
+++ b/provisioner/terraform/testdata/rich-parameters-order/rich-parameters-order.tfplan.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.2",
-  "terraform_version": "1.5.1",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -113,7 +113,7 @@
   ],
   "prior_state": {
     "format_version": "1.0",
-    "terraform_version": "1.5.1",
+    "terraform_version": "1.5.5",
     "values": {
       "root_module": {
         "resources": [
@@ -129,7 +129,7 @@
               "description": null,
               "display_name": null,
               "icon": null,
-              "id": "0d872aa0-e755-48a7-986d-4d6aa8ad9a17",
+              "id": "245304bd-d7c0-4dc0-b4b2-90a036245af0",
               "legacy_variable": null,
               "legacy_variable_name": null,
               "mutable": false,
@@ -157,7 +157,7 @@
               "description": "blah blah",
               "display_name": null,
               "icon": null,
-              "id": "76eff4ae-28f0-409f-b002-58ebced3fdcb",
+              "id": "bccaddc6-97f1-48aa-a1c0-3438cc96139d",
               "legacy_variable": null,
               "legacy_variable_name": null,
               "mutable": false,
@@ -265,5 +265,5 @@
       ]
     }
   },
-  "timestamp": "2023-06-30T08:41:59Z"
+  "timestamp": "2023-08-30T19:25:32Z"
 }
diff --git a/provisioner/terraform/testdata/rich-parameters-order/rich-parameters-order.tfstate.json b/provisioner/terraform/testdata/rich-parameters-order/rich-parameters-order.tfstate.json
index 67b650dcdbd0b..c46df3e313f47 100644
--- a/provisioner/terraform/testdata/rich-parameters-order/rich-parameters-order.tfstate.json
+++ b/provisioner/terraform/testdata/rich-parameters-order/rich-parameters-order.tfstate.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.5.1",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
@@ -16,7 +16,7 @@
             "description": null,
             "display_name": null,
             "icon": null,
-            "id": "885aeb22-be2b-486a-8e0d-1883c7e27b3c",
+            "id": "20e486cd-35aa-4916-8cbf-c8b6fd235cd1",
             "legacy_variable": null,
             "legacy_variable_name": null,
             "mutable": false,
@@ -44,7 +44,7 @@
             "description": "blah blah",
             "display_name": null,
             "icon": null,
-            "id": "be62f5ff-0e46-44f1-84e2-3fe0e57bb16f",
+            "id": "6c077b3f-ba6c-482b-9232-12a3d4892700",
             "legacy_variable": null,
             "legacy_variable_name": null,
             "mutable": false,
@@ -73,7 +73,7 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "7fe5bde1-7063-4426-9acc-76f5a8834fa6",
+            "id": "1414c0f9-be31-4efa-b1c9-57ab7c951b97",
             "init_script": "",
             "login_before_ready": true,
             "metadata": [],
@@ -84,7 +84,7 @@
             "startup_script": null,
             "startup_script_behavior": null,
             "startup_script_timeout": 300,
-            "token": "9b835c2c-fbb1-4824-a79f-12017badf015",
+            "token": "712872cf-fde6-4683-91a3-9ad9fc759e14",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -100,7 +100,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "2516512654554147618",
+            "id": "9132401905565595068",
             "triggers": null
           },
           "sensitive_values": {},
diff --git a/provisioner/terraform/testdata/rich-parameters-validation/rich-parameters-validation.tfplan.json b/provisioner/terraform/testdata/rich-parameters-validation/rich-parameters-validation.tfplan.json
index b7711b136db48..7da089a43ea98 100644
--- a/provisioner/terraform/testdata/rich-parameters-validation/rich-parameters-validation.tfplan.json
+++ b/provisioner/terraform/testdata/rich-parameters-validation/rich-parameters-validation.tfplan.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.2",
-  "terraform_version": "1.5.1",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -113,7 +113,7 @@
   ],
   "prior_state": {
     "format_version": "1.0",
-    "terraform_version": "1.5.1",
+    "terraform_version": "1.5.5",
     "values": {
       "root_module": {
         "resources": [
@@ -130,7 +130,7 @@
               "display_name": null,
               "ephemeral": true,
               "icon": null,
-              "id": "2ef43cec-ce06-45d0-9dc2-5e9dcc5e506a",
+              "id": "858cb978-eef0-47e6-b7b8-7f9093303ad9",
               "mutable": true,
               "name": "number_example",
               "option": null,
@@ -157,7 +157,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "240d3feb-e553-4ec9-b72d-644f4937caae",
+              "id": "0add04ee-5c08-4702-b32e-727fc8c3fcd7",
               "mutable": false,
               "name": "number_example_max",
               "option": null,
@@ -196,7 +196,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "006306f8-3541-4a3c-9bd5-ddc9acac22da",
+              "id": "90bc3085-b65d-496a-b52c-2a6bfda1c439",
               "mutable": false,
               "name": "number_example_max_zero",
               "option": null,
@@ -235,7 +235,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "2cc53ecc-6086-461a-989d-77b5c40be5d7",
+              "id": "2499264c-7fa4-41da-9c78-6b5c86ddfd9c",
               "mutable": false,
               "name": "number_example_min",
               "option": null,
@@ -274,7 +274,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "691a525b-9424-4c38-a6da-d6029ab9c3ac",
+              "id": "dd6c2f30-6320-4e4a-ba82-deef628330f1",
               "mutable": false,
               "name": "number_example_min_max",
               "option": null,
@@ -313,7 +313,7 @@
               "display_name": null,
               "ephemeral": false,
               "icon": null,
-              "id": "a7c46d06-44dd-4df2-8d16-a1130298dc59",
+              "id": "8e04ddc9-c245-408d-92b0-dec669259b4a",
               "mutable": false,
               "name": "number_example_min_zero",
               "option": null,
@@ -545,5 +545,5 @@
       ]
     }
   },
-  "timestamp": "2023-07-10T08:58:27Z"
+  "timestamp": "2023-08-30T19:25:35Z"
 }
diff --git a/provisioner/terraform/testdata/rich-parameters-validation/rich-parameters-validation.tfstate.json b/provisioner/terraform/testdata/rich-parameters-validation/rich-parameters-validation.tfstate.json
index 0a23853fe93b5..d04c4ef4027ab 100644
--- a/provisioner/terraform/testdata/rich-parameters-validation/rich-parameters-validation.tfstate.json
+++ b/provisioner/terraform/testdata/rich-parameters-validation/rich-parameters-validation.tfstate.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.5.1",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
@@ -17,7 +17,7 @@
             "display_name": null,
             "ephemeral": true,
             "icon": null,
-            "id": "dcde525b-5871-486a-b731-f0c4d874bf5b",
+            "id": "3eac44eb-b74f-471e-ae3a-783083f33b58",
             "mutable": true,
             "name": "number_example",
             "option": null,
@@ -44,7 +44,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "756214c3-1df4-4438-ab8b-1f116bda1a91",
+            "id": "b767a52b-0b1d-4bea-a1b1-23180308a25d",
             "mutable": false,
             "name": "number_example_max",
             "option": null,
@@ -83,7 +83,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "073d8a2b-abc0-4a8d-a7a8-9e1f934e50fc",
+            "id": "f6857c45-04cf-47ae-85bc-caab3341ead5",
             "mutable": false,
             "name": "number_example_max_zero",
             "option": null,
@@ -122,7 +122,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "f6891e4d-d281-4af2-9459-9c5c7c1fb4f1",
+            "id": "634a2e89-47c0-4d4b-aed6-b20177c959d5",
             "mutable": false,
             "name": "number_example_min",
             "option": null,
@@ -161,7 +161,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "cf54b361-5505-4997-8eef-0d6216097927",
+            "id": "9ae1f0ff-2fe9-460c-97b8-6bb0cb7fb2c7",
             "mutable": false,
             "name": "number_example_min_max",
             "option": null,
@@ -200,7 +200,7 @@
             "display_name": null,
             "ephemeral": false,
             "icon": null,
-            "id": "069f66cf-0098-44c0-9af3-c0ee5a93f110",
+            "id": "e6951857-18a9-44b8-bc0d-d78375fdf92d",
             "mutable": false,
             "name": "number_example_min_zero",
             "option": null,
@@ -239,7 +239,7 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "45694bbb-29e4-41c7-8172-7f0c17835578",
+            "id": "870767c4-6479-414c-aa08-a3f659ea3ec2",
             "init_script": "",
             "login_before_ready": true,
             "metadata": [],
@@ -250,7 +250,7 @@
             "startup_script": null,
             "startup_script_behavior": null,
             "startup_script_timeout": 300,
-            "token": "8fa25787-7aba-4d94-ac1c-7181faea0519",
+            "token": "59f08143-3fcb-48d6-a80d-3a87863cd865",
             "troubleshooting_url": null
           },
           "sensitive_values": {
@@ -266,7 +266,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "2669634748288884064",
+            "id": "643597385910559727",
             "triggers": null
           },
           "sensitive_values": {},
diff --git a/provisioner/terraform/testdata/rich-parameters/rich-parameters.tfplan.json b/provisioner/terraform/testdata/rich-parameters/rich-parameters.tfplan.json
index 234c2ff0b589a..e3d5497b4d3e1 100644
--- a/provisioner/terraform/testdata/rich-parameters/rich-parameters.tfplan.json
+++ b/provisioner/terraform/testdata/rich-parameters/rich-parameters.tfplan.json
@@ -1,6 +1,6 @@
 {
-  "format_version": "1.1",
-  "terraform_version": "1.4.0",
+  "format_version": "1.2",
+  "terraform_version": "1.5.5",
   "planned_values": {
     "root_module": {
       "resources": [
@@ -111,7 +111,7 @@
   ],
   "prior_state": {
     "format_version": "1.0",
-    "terraform_version": "1.4.0",
+    "terraform_version": "1.5.5",
     "values": {
       "root_module": {
         "resources": [
@@ -127,7 +127,7 @@
               "description": null,
               "display_name": null,
               "icon": null,
-              "id": "5b7b6210-ce5d-4cc4-bbd6-0b329ca1c04f",
+              "id": "67c923e2-cb0c-4955-b7bb-cdb8b7fab8be",
               "legacy_variable": null,
               "legacy_variable_name": null,
               "mutable": false,
@@ -170,7 +170,7 @@
               "description": null,
               "display_name": null,
               "icon": null,
-              "id": "72a5396c-0b3f-427d-b491-2700b025b3a1",
+              "id": "69ab9bf0-dadf-47ed-8486-b38b8d521c67",
               "legacy_variable": null,
               "legacy_variable_name": null,
               "mutable": false,
@@ -195,7 +195,7 @@
               "description": null,
               "display_name": null,
               "icon": null,
-              "id": "63769975-a1e0-42ed-92c1-e003af6b4c54",
+              "id": "4dcc41e1-8d07-4018-98df-de5fadce5aa3",
               "legacy_variable": null,
               "legacy_variable_name": null,
               "mutable": false,
@@ -232,7 +232,7 @@
               "description": null,
               "display_name": null,
               "icon": null,
-              "id": "2fce5c05-7018-402b-b653-98d75ad076a2",
+              "id": "c64e111c-496f-458d-924c-5ee13460f2ee",
               "legacy_variable": null,
               "legacy_variable_name": null,
               "mutable": false,
@@ -269,7 +269,7 @@
               "description": null,
               "display_name": null,
               "icon": null,
-              "id": "4408d7e5-3353-4434-810c-d8c913f29edd",
+              "id": "ecc13f6b-a8bd-423a-8585-ac08882cd25c",
               "legacy_variable": null,
               "legacy_variable_name": null,
               "mutable": false,
@@ -306,7 +306,7 @@
               "description": "blah blah",
               "display_name": null,
               "icon": null,
-              "id": "2b05e465-b243-4ae0-9210-634cf0f65d20",
+              "id": "ea6bbb0a-fdf5-46b4-8c68-22b59283fa6d",
               "legacy_variable": null,
               "legacy_variable_name": null,
               "mutable": false,
@@ -335,7 +335,7 @@
                   "description": "First parameter from module",
                   "display_name": null,
                   "icon": null,
-                  "id": "fc0491e2-ea2e-4fa7-9b0b-08298fb768f4",
+                  "id": "69e9bbe9-114a-43df-a050-a030efb3b89a",
                   "legacy_variable": null,
                   "legacy_variable_name": null,
                   "mutable": true,
@@ -360,7 +360,7 @@
                   "description": "Second parameter from module",
                   "display_name": null,
                   "icon": null,
-                  "id": "693fb916-39ed-4798-8724-0e751a2458e4",
+                  "id": "607e122d-a7fd-4200-834f-c24e0e9a12c5",
                   "legacy_variable": null,
                   "legacy_variable_name": null,
                   "mutable": true,
@@ -390,7 +390,7 @@
                       "description": "First parameter from child module",
                       "display_name": null,
                       "icon": null,
-                      "id": "8014f515-a467-4dfe-ac63-8c7eadfc3521",
+                      "id": "8cc5d1b7-391f-43ff-91e6-0293724a915b",
                       "legacy_variable": null,
                       "legacy_variable_name": null,
                       "mutable": true,
@@ -415,7 +415,7 @@
                       "description": "Second parameter from child module",
                       "display_name": null,
                       "icon": null,
-                      "id": "e94a306e-c1aa-47f5-833f-19719868d9ce",
+                      "id": "dfb6a1c4-82fd-47d3-b58c-65beddcd8b0d",
                       "legacy_variable": null,
                       "legacy_variable_name": null,
                       "mutable": true,
@@ -766,5 +766,6 @@
         }
       }
     }
-  }
+  },
+  "timestamp": "2023-08-30T19:25:30Z"
 }
diff --git a/provisioner/terraform/testdata/rich-parameters/rich-parameters.tfstate.json b/provisioner/terraform/testdata/rich-parameters/rich-parameters.tfstate.json
index f744b809615b4..b53dcd8568cef 100644
--- a/provisioner/terraform/testdata/rich-parameters/rich-parameters.tfstate.json
+++ b/provisioner/terraform/testdata/rich-parameters/rich-parameters.tfstate.json
@@ -1,6 +1,6 @@
 {
   "format_version": "1.0",
-  "terraform_version": "1.4.0",
+  "terraform_version": "1.5.5",
   "values": {
     "root_module": {
       "resources": [
@@ -16,7 +16,7 @@
             "description": null,
             "display_name": null,
             "icon": null,
-            "id": "ca194a3d-90c5-4a74-8b9f-c299bc4dad33",
+            "id": "3d3a933a-b52b-4b38-bf91-0937615b1b29",
             "legacy_variable": null,
             "legacy_variable_name": null,
             "mutable": false,
@@ -59,7 +59,7 @@
             "description": null,
             "display_name": null,
             "icon": null,
-            "id": "c1a68d9c-5a5e-4560-9319-053addb068af",
+            "id": "f8b06fc2-f0c6-4483-8d10-d4601dfdd787",
             "legacy_variable": null,
             "legacy_variable_name": null,
             "mutable": false,
@@ -84,7 +84,7 @@
             "description": null,
             "display_name": null,
             "icon": null,
-            "id": "04492d05-0c3b-4fc1-a8b7-da70499ff7b6",
+            "id": "886575fc-1863-49be-9a7d-125077df0ca5",
             "legacy_variable": null,
             "legacy_variable_name": null,
             "mutable": false,
@@ -121,7 +121,7 @@
             "description": null,
             "display_name": null,
             "icon": null,
-            "id": "852d5fc8-6d3b-4279-8165-fc6942e361f3",
+            "id": "feb32685-cfdc-4aed-b8bd-290d7e41822f",
             "legacy_variable": null,
             "legacy_variable_name": null,
             "mutable": false,
@@ -158,7 +158,7 @@
             "description": null,
             "display_name": null,
             "icon": null,
-            "id": "b811e107-17b2-44bd-a2aa-58586ba3725f",
+            "id": "a5e72ae7-67f8-442c-837e-cce15f49fff0",
             "legacy_variable": null,
             "legacy_variable_name": null,
             "mutable": false,
@@ -195,7 +195,7 @@
             "description": "blah blah",
             "display_name": null,
             "icon": null,
-            "id": "60d8c0b7-8442-4751-a4b3-0bff927fdbcb",
+            "id": "1dcf470f-25f5-4c1d-a68e-1833f8239591",
             "legacy_variable": null,
             "legacy_variable_name": null,
             "mutable": false,
@@ -221,7 +221,7 @@
             "connection_timeout": 120,
             "dir": null,
             "env": null,
-            "id": "4c9d79a7-73e9-4f4f-8efb-464a393d64cd",
+            "id": "126f2d92-9556-4187-be69-5827ba3e7ddd",
             "init_script": "",
             "login_before_ready": true,
             "metadata": [],
@@ -231,11 +231,12 @@
             "shutdown_script_timeout": 300,
             "startup_script": null,
             "startup_script_timeout": 300,
-            "token": "c31a5e7a-f0f2-4e61-aae8-82ae2456358b",
+            "token": "e2021a4f-4db5-4e26-8ecd-c4b6c6e79e92",
             "troubleshooting_url": null
           },
           "sensitive_values": {
-            "metadata": []
+            "metadata": [],
+            "token": true
           }
         },
         {
@@ -246,7 +247,7 @@
           "provider_name": "registry.terraform.io/hashicorp/null",
           "schema_version": 0,
           "values": {
-            "id": "3848665340553657624",
+            "id": "3170372688900630060",
             "triggers": null
           },
           "sensitive_values": {},
@@ -270,7 +271,7 @@
                 "description": "First parameter from module",
                 "display_name": null,
                 "icon": null,
-                "id": "3f49f2f3-0a0a-49ff-9b7d-e34867f0f515",
+                "id": "24874d90-5faf-4574-b54d-01a12e25159d",
                 "legacy_variable": null,
                 "legacy_variable_name": null,
                 "mutable": true,
@@ -295,7 +296,7 @@
                 "description": "Second parameter from module",
                 "display_name": null,
                 "icon": null,
-                "id": "d1a6e987-b032-4107-88fd-f0aee0f3c1d3",
+                "id": "015a8629-347a-43f9-ba79-33d895f3b5b7",
                 "legacy_variable": null,
                 "legacy_variable_name": null,
                 "mutable": true,
@@ -325,7 +326,7 @@
                     "description": "First parameter from child module",
                     "display_name": null,
                     "icon": null,
-                    "id": "79d7a875-18e2-4fcd-ac9a-ad6de9f00c20",
+                    "id": "85793115-42a5-4e52-be7b-77dcf337ffb6",
                     "legacy_variable": null,
                     "legacy_variable_name": null,
                     "mutable": true,
@@ -350,7 +351,7 @@
                     "description": "Second parameter from child module",
                     "display_name": null,
                     "icon": null,
-                    "id": "b71db658-46c0-4dca-8530-1d4f464b7ad6",
+                    "id": "7754596b-a8b1-4a64-9ff1-27dd9473924c",
                     "legacy_variable": null,
                     "legacy_variable_name": null,
                     "mutable": true,
diff --git a/provisionerd/localprovisioners.go b/provisionerd/localprovisioners.go
new file mode 100644
index 0000000000000..0e495f536dc85
--- /dev/null
+++ b/provisionerd/localprovisioners.go
@@ -0,0 +1,28 @@
+package provisionerd
+
+import (
+	"context"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/provisionerd/proto"
+
+	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
+)
+
+// LocalProvisioners is a Connector that stores a static set of in-process
+// provisioners.
+type LocalProvisioners map[string]sdkproto.DRPCProvisionerClient
+
+func (l LocalProvisioners) Connect(_ context.Context, job *proto.AcquiredJob, respCh chan<- ConnectResponse) {
+	r := ConnectResponse{Job: job}
+	p, ok := l[job.Provisioner]
+	if ok {
+		r.Client = p
+	} else {
+		r.Error = xerrors.Errorf("missing provisioner type %s", job.Provisioner)
+	}
+	go func() {
+		respCh <- r
+	}()
+}
diff --git a/provisionerd/proto/provisionerd.pb.go b/provisionerd/proto/provisionerd.pb.go
index d7db84d69813e..451d301e9c38d 100644
--- a/provisionerd/proto/provisionerd.pb.go
+++ b/provisionerd/proto/provisionerd.pb.go
@@ -7,7 +7,7 @@
 package proto
 
 import (
-	proto "github.com/coder/coder/provisionersdk/proto"
+	proto "github.com/coder/coder/v2/provisionersdk/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -809,25 +809,63 @@ func (x *CommitQuotaResponse) GetBudget() int32 {
 	return 0
 }
 
+type CancelAcquire struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *CancelAcquire) Reset() {
+	*x = CancelAcquire{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CancelAcquire) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CancelAcquire) ProtoMessage() {}
+
+func (x *CancelAcquire) ProtoReflect() protoreflect.Message {
+	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CancelAcquire.ProtoReflect.Descriptor instead.
+func (*CancelAcquire) Descriptor() ([]byte, []int) {
+	return file_provisionerd_proto_provisionerd_proto_rawDescGZIP(), []int{9}
+}
+
 type AcquiredJob_WorkspaceBuild struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	WorkspaceBuildId    string                      `protobuf:"bytes,1,opt,name=workspace_build_id,json=workspaceBuildId,proto3" json:"workspace_build_id,omitempty"`
-	WorkspaceName       string                      `protobuf:"bytes,2,opt,name=workspace_name,json=workspaceName,proto3" json:"workspace_name,omitempty"`
-	RichParameterValues []*proto.RichParameterValue `protobuf:"bytes,4,rep,name=rich_parameter_values,json=richParameterValues,proto3" json:"rich_parameter_values,omitempty"`
-	VariableValues      []*proto.VariableValue      `protobuf:"bytes,5,rep,name=variable_values,json=variableValues,proto3" json:"variable_values,omitempty"`
-	GitAuthProviders    []*proto.GitAuthProvider    `protobuf:"bytes,6,rep,name=git_auth_providers,json=gitAuthProviders,proto3" json:"git_auth_providers,omitempty"`
-	Metadata            *proto.Provision_Metadata   `protobuf:"bytes,7,opt,name=metadata,proto3" json:"metadata,omitempty"`
-	State               []byte                      `protobuf:"bytes,8,opt,name=state,proto3" json:"state,omitempty"`
-	LogLevel            string                      `protobuf:"bytes,9,opt,name=log_level,json=logLevel,proto3" json:"log_level,omitempty"`
+	WorkspaceBuildId      string                        `protobuf:"bytes,1,opt,name=workspace_build_id,json=workspaceBuildId,proto3" json:"workspace_build_id,omitempty"`
+	WorkspaceName         string                        `protobuf:"bytes,2,opt,name=workspace_name,json=workspaceName,proto3" json:"workspace_name,omitempty"`
+	RichParameterValues   []*proto.RichParameterValue   `protobuf:"bytes,4,rep,name=rich_parameter_values,json=richParameterValues,proto3" json:"rich_parameter_values,omitempty"`
+	VariableValues        []*proto.VariableValue        `protobuf:"bytes,5,rep,name=variable_values,json=variableValues,proto3" json:"variable_values,omitempty"`
+	ExternalAuthProviders []*proto.ExternalAuthProvider `protobuf:"bytes,6,rep,name=external_auth_providers,json=externalAuthProviders,proto3" json:"external_auth_providers,omitempty"`
+	Metadata              *proto.Metadata               `protobuf:"bytes,7,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	State                 []byte                        `protobuf:"bytes,8,opt,name=state,proto3" json:"state,omitempty"`
+	LogLevel              string                        `protobuf:"bytes,9,opt,name=log_level,json=logLevel,proto3" json:"log_level,omitempty"`
 }
 
 func (x *AcquiredJob_WorkspaceBuild) Reset() {
 	*x = AcquiredJob_WorkspaceBuild{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[9]
+		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -840,7 +878,7 @@ func (x *AcquiredJob_WorkspaceBuild) String() string {
 func (*AcquiredJob_WorkspaceBuild) ProtoMessage() {}
 
 func (x *AcquiredJob_WorkspaceBuild) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[9]
+	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -884,14 +922,14 @@ func (x *AcquiredJob_WorkspaceBuild) GetVariableValues() []*proto.VariableValue
 	return nil
 }
 
-func (x *AcquiredJob_WorkspaceBuild) GetGitAuthProviders() []*proto.GitAuthProvider {
+func (x *AcquiredJob_WorkspaceBuild) GetExternalAuthProviders() []*proto.ExternalAuthProvider {
 	if x != nil {
-		return x.GitAuthProviders
+		return x.ExternalAuthProviders
 	}
 	return nil
 }
 
-func (x *AcquiredJob_WorkspaceBuild) GetMetadata() *proto.Provision_Metadata {
+func (x *AcquiredJob_WorkspaceBuild) GetMetadata() *proto.Metadata {
 	if x != nil {
 		return x.Metadata
 	}
@@ -917,14 +955,14 @@ type AcquiredJob_TemplateImport struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Metadata           *proto.Provision_Metadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
-	UserVariableValues []*proto.VariableValue    `protobuf:"bytes,2,rep,name=user_variable_values,json=userVariableValues,proto3" json:"user_variable_values,omitempty"`
+	Metadata           *proto.Metadata        `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	UserVariableValues []*proto.VariableValue `protobuf:"bytes,2,rep,name=user_variable_values,json=userVariableValues,proto3" json:"user_variable_values,omitempty"`
 }
 
 func (x *AcquiredJob_TemplateImport) Reset() {
 	*x = AcquiredJob_TemplateImport{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[10]
+		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -937,7 +975,7 @@ func (x *AcquiredJob_TemplateImport) String() string {
 func (*AcquiredJob_TemplateImport) ProtoMessage() {}
 
 func (x *AcquiredJob_TemplateImport) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[10]
+	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -953,7 +991,7 @@ func (*AcquiredJob_TemplateImport) Descriptor() ([]byte, []int) {
 	return file_provisionerd_proto_provisionerd_proto_rawDescGZIP(), []int{1, 1}
 }
 
-func (x *AcquiredJob_TemplateImport) GetMetadata() *proto.Provision_Metadata {
+func (x *AcquiredJob_TemplateImport) GetMetadata() *proto.Metadata {
 	if x != nil {
 		return x.Metadata
 	}
@@ -974,13 +1012,13 @@ type AcquiredJob_TemplateDryRun struct {
 
 	RichParameterValues []*proto.RichParameterValue `protobuf:"bytes,2,rep,name=rich_parameter_values,json=richParameterValues,proto3" json:"rich_parameter_values,omitempty"`
 	VariableValues      []*proto.VariableValue      `protobuf:"bytes,3,rep,name=variable_values,json=variableValues,proto3" json:"variable_values,omitempty"`
-	Metadata            *proto.Provision_Metadata   `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	Metadata            *proto.Metadata             `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
 }
 
 func (x *AcquiredJob_TemplateDryRun) Reset() {
 	*x = AcquiredJob_TemplateDryRun{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[11]
+		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -993,7 +1031,7 @@ func (x *AcquiredJob_TemplateDryRun) String() string {
 func (*AcquiredJob_TemplateDryRun) ProtoMessage() {}
 
 func (x *AcquiredJob_TemplateDryRun) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[11]
+	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1023,7 +1061,7 @@ func (x *AcquiredJob_TemplateDryRun) GetVariableValues() []*proto.VariableValue
 	return nil
 }
 
-func (x *AcquiredJob_TemplateDryRun) GetMetadata() *proto.Provision_Metadata {
+func (x *AcquiredJob_TemplateDryRun) GetMetadata() *proto.Metadata {
 	if x != nil {
 		return x.Metadata
 	}
@@ -1041,7 +1079,7 @@ type FailedJob_WorkspaceBuild struct {
 func (x *FailedJob_WorkspaceBuild) Reset() {
 	*x = FailedJob_WorkspaceBuild{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[13]
+		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1054,7 +1092,7 @@ func (x *FailedJob_WorkspaceBuild) String() string {
 func (*FailedJob_WorkspaceBuild) ProtoMessage() {}
 
 func (x *FailedJob_WorkspaceBuild) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[13]
+	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1086,7 +1124,7 @@ type FailedJob_TemplateImport struct {
 func (x *FailedJob_TemplateImport) Reset() {
 	*x = FailedJob_TemplateImport{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[14]
+		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1099,7 +1137,7 @@ func (x *FailedJob_TemplateImport) String() string {
 func (*FailedJob_TemplateImport) ProtoMessage() {}
 
 func (x *FailedJob_TemplateImport) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[14]
+	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1124,7 +1162,7 @@ type FailedJob_TemplateDryRun struct {
 func (x *FailedJob_TemplateDryRun) Reset() {
 	*x = FailedJob_TemplateDryRun{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[15]
+		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1137,7 +1175,7 @@ func (x *FailedJob_TemplateDryRun) String() string {
 func (*FailedJob_TemplateDryRun) ProtoMessage() {}
 
 func (x *FailedJob_TemplateDryRun) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[15]
+	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1165,7 +1203,7 @@ type CompletedJob_WorkspaceBuild struct {
 func (x *CompletedJob_WorkspaceBuild) Reset() {
 	*x = CompletedJob_WorkspaceBuild{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[16]
+		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1178,7 +1216,7 @@ func (x *CompletedJob_WorkspaceBuild) String() string {
 func (*CompletedJob_WorkspaceBuild) ProtoMessage() {}
 
 func (x *CompletedJob_WorkspaceBuild) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[16]
+	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1213,16 +1251,16 @@ type CompletedJob_TemplateImport struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	StartResources   []*proto.Resource      `protobuf:"bytes,1,rep,name=start_resources,json=startResources,proto3" json:"start_resources,omitempty"`
-	StopResources    []*proto.Resource      `protobuf:"bytes,2,rep,name=stop_resources,json=stopResources,proto3" json:"stop_resources,omitempty"`
-	RichParameters   []*proto.RichParameter `protobuf:"bytes,3,rep,name=rich_parameters,json=richParameters,proto3" json:"rich_parameters,omitempty"`
-	GitAuthProviders []string               `protobuf:"bytes,4,rep,name=git_auth_providers,json=gitAuthProviders,proto3" json:"git_auth_providers,omitempty"`
+	StartResources        []*proto.Resource      `protobuf:"bytes,1,rep,name=start_resources,json=startResources,proto3" json:"start_resources,omitempty"`
+	StopResources         []*proto.Resource      `protobuf:"bytes,2,rep,name=stop_resources,json=stopResources,proto3" json:"stop_resources,omitempty"`
+	RichParameters        []*proto.RichParameter `protobuf:"bytes,3,rep,name=rich_parameters,json=richParameters,proto3" json:"rich_parameters,omitempty"`
+	ExternalAuthProviders []string               `protobuf:"bytes,4,rep,name=external_auth_providers,json=externalAuthProviders,proto3" json:"external_auth_providers,omitempty"`
 }
 
 func (x *CompletedJob_TemplateImport) Reset() {
 	*x = CompletedJob_TemplateImport{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[17]
+		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[18]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1235,7 +1273,7 @@ func (x *CompletedJob_TemplateImport) String() string {
 func (*CompletedJob_TemplateImport) ProtoMessage() {}
 
 func (x *CompletedJob_TemplateImport) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[17]
+	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[18]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1272,9 +1310,9 @@ func (x *CompletedJob_TemplateImport) GetRichParameters() []*proto.RichParameter
 	return nil
 }
 
-func (x *CompletedJob_TemplateImport) GetGitAuthProviders() []string {
+func (x *CompletedJob_TemplateImport) GetExternalAuthProviders() []string {
 	if x != nil {
-		return x.GitAuthProviders
+		return x.ExternalAuthProviders
 	}
 	return nil
 }
@@ -1290,7 +1328,7 @@ type CompletedJob_TemplateDryRun struct {
 func (x *CompletedJob_TemplateDryRun) Reset() {
 	*x = CompletedJob_TemplateDryRun{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[18]
+		mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[19]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1303,7 +1341,7 @@ func (x *CompletedJob_TemplateDryRun) String() string {
 func (*CompletedJob_TemplateDryRun) ProtoMessage() {}
 
 func (x *CompletedJob_TemplateDryRun) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[18]
+	mi := &file_provisionerd_proto_provisionerd_proto_msgTypes[19]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1335,7 +1373,7 @@ var file_provisionerd_proto_provisionerd_proto_rawDesc = []byte{
 	0x6f, 0x6e, 0x65, 0x72, 0x64, 0x1a, 0x26, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
 	0x65, 0x72, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x70, 0x72, 0x6f, 0x76,
 	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x07, 0x0a,
-	0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0xab, 0x0b, 0x0a, 0x0b, 0x41, 0x63, 0x71, 0x75, 0x69,
+	0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x9c, 0x0b, 0x0a, 0x0b, 0x41, 0x63, 0x71, 0x75, 0x69,
 	0x72, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x12, 0x15, 0x0a, 0x06, 0x6a, 0x6f, 0x62, 0x5f, 0x69, 0x64,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6a, 0x6f, 0x62, 0x49, 0x64, 0x12, 0x1d, 0x0a,
 	0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
@@ -1368,7 +1406,7 @@ var file_provisionerd_proto_provisionerd_proto_rawDesc = []byte{
 	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x41, 0x63, 0x71, 0x75, 0x69,
 	0x72, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x2e, 0x54, 0x72, 0x61, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61,
 	0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0d, 0x74, 0x72, 0x61, 0x63, 0x65,
-	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x1a, 0xc1, 0x03, 0x0a, 0x0e, 0x57, 0x6f, 0x72,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x1a, 0xc6, 0x03, 0x0a, 0x0e, 0x57, 0x6f, 0x72,
 	0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x12, 0x2c, 0x0a, 0x12, 0x77,
 	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x5f, 0x69,
 	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
@@ -1384,198 +1422,204 @@ var file_provisionerd_proto_provisionerd_proto_rawDesc = []byte{
 	0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a,
 	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x56, 0x61, 0x72,
 	0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x76, 0x61, 0x72, 0x69,
-	0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x4a, 0x0a, 0x12, 0x67, 0x69,
-	0x74, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73,
-	0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
-	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x47, 0x69, 0x74, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76,
-	0x69, 0x64, 0x65, 0x72, 0x52, 0x10, 0x67, 0x69, 0x74, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f,
-	0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x12, 0x3b, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x08, 0x20, 0x01,
-	0x28, 0x0c, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x6c, 0x6f, 0x67,
-	0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6c, 0x6f,
-	0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x4a, 0x04, 0x08, 0x03, 0x10, 0x04, 0x1a, 0x9b, 0x01, 0x0a,
-	0x0e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x12,
-	0x3b, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
-	0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x4c, 0x0a, 0x14,
-	0x75, 0x73, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f,
-	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c,
-	0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x12, 0x75, 0x73, 0x65, 0x72, 0x56, 0x61, 0x72, 0x69,
-	0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x1a, 0xed, 0x01, 0x0a, 0x0e, 0x54,
-	0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x44, 0x72, 0x79, 0x52, 0x75, 0x6e, 0x12, 0x53, 0x0a,
-	0x15, 0x72, 0x69, 0x63, 0x68, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x5f,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x69, 0x63, 0x68, 0x50,
-	0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x13, 0x72,
-	0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75,
-	0x65, 0x73, 0x12, 0x43, 0x0a, 0x0f, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62,
-	0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c,
-	0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x3b, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
-	0x61, 0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
-	0x6e, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x1a, 0x40, 0x0a, 0x12, 0x54, 0x72,
-	0x61, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
-	0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x06, 0x0a, 0x04,
-	0x74, 0x79, 0x70, 0x65, 0x22, 0xa5, 0x03, 0x0a, 0x09, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x4a,
-	0x6f, 0x62, 0x12, 0x15, 0x0a, 0x06, 0x6a, 0x6f, 0x62, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x05, 0x6a, 0x6f, 0x62, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72,
-	0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12,
-	0x51, 0x0a, 0x0f, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x62, 0x75, 0x69,
-	0x6c, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x4a, 0x6f,
-	0x62, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64,
-	0x48, 0x00, 0x52, 0x0e, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69,
-	0x6c, 0x64, 0x12, 0x51, 0x0a, 0x0f, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x69,
-	0x6d, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x46, 0x61, 0x69, 0x6c, 0x65,
-	0x64, 0x4a, 0x6f, 0x62, 0x2e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x49, 0x6d, 0x70,
-	0x6f, 0x72, 0x74, 0x48, 0x00, 0x52, 0x0e, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x49,
-	0x6d, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x52, 0x0a, 0x10, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74,
-	0x65, 0x5f, 0x64, 0x72, 0x79, 0x5f, 0x72, 0x75, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x26, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x46,
-	0x61, 0x69, 0x6c, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x2e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74,
-	0x65, 0x44, 0x72, 0x79, 0x52, 0x75, 0x6e, 0x48, 0x00, 0x52, 0x0e, 0x74, 0x65, 0x6d, 0x70, 0x6c,
-	0x61, 0x74, 0x65, 0x44, 0x72, 0x79, 0x52, 0x75, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x65, 0x72, 0x72,
-	0x6f, 0x72, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x65,
-	0x72, 0x72, 0x6f, 0x72, 0x43, 0x6f, 0x64, 0x65, 0x1a, 0x26, 0x0a, 0x0e, 0x57, 0x6f, 0x72, 0x6b,
+	0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x59, 0x0a, 0x17, 0x65, 0x78,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x15,
+	0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x73, 0x12, 0x31, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73,
+	0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74,
+	0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x1b,
+	0x0a, 0x09, 0x6c, 0x6f, 0x67, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x09, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x6c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x4a, 0x04, 0x08, 0x03, 0x10,
+	0x04, 0x1a, 0x91, 0x01, 0x0a, 0x0e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x49, 0x6d,
+	0x70, 0x6f, 0x72, 0x74, 0x12, 0x31, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
+	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x4c, 0x0a, 0x14, 0x75, 0x73, 0x65, 0x72, 0x5f,
+	0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
+	0x6e, 0x65, 0x72, 0x2e, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x52, 0x12, 0x75, 0x73, 0x65, 0x72, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x73, 0x1a, 0xe3, 0x01, 0x0a, 0x0e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61,
+	0x74, 0x65, 0x44, 0x72, 0x79, 0x52, 0x75, 0x6e, 0x12, 0x53, 0x0a, 0x15, 0x72, 0x69, 0x63, 0x68,
+	0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73,
+	0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65,
+	0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x13, 0x72, 0x69, 0x63, 0x68, 0x50, 0x61,
+	0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x43, 0x0a,
+	0x0f, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
+	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c,
+	0x75, 0x65, 0x52, 0x0e, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75,
+	0x65, 0x73, 0x12, 0x31, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x65, 0x72, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x1a, 0x40, 0x0a, 0x12, 0x54,
+	0x72, 0x61, 0x63, 0x65, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x06, 0x0a,
+	0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0xa5, 0x03, 0x0a, 0x09, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64,
+	0x4a, 0x6f, 0x62, 0x12, 0x15, 0x0a, 0x06, 0x6a, 0x6f, 0x62, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x6a, 0x6f, 0x62, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72,
+	0x72, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72,
+	0x12, 0x51, 0x0a, 0x0f, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x62, 0x75,
+	0x69, 0x6c, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x4a,
+	0x6f, 0x62, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c,
+	0x64, 0x48, 0x00, 0x52, 0x0e, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75,
+	0x69, 0x6c, 0x64, 0x12, 0x51, 0x0a, 0x0f, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f,
+	0x69, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x70,
+	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x46, 0x61, 0x69, 0x6c,
+	0x65, 0x64, 0x4a, 0x6f, 0x62, 0x2e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x49, 0x6d,
+	0x70, 0x6f, 0x72, 0x74, 0x48, 0x00, 0x52, 0x0e, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65,
+	0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x52, 0x0a, 0x10, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61,
+	0x74, 0x65, 0x5f, 0x64, 0x72, 0x79, 0x5f, 0x72, 0x75, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x26, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x2e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61,
+	0x74, 0x65, 0x44, 0x72, 0x79, 0x52, 0x75, 0x6e, 0x48, 0x00, 0x52, 0x0e, 0x74, 0x65, 0x6d, 0x70,
+	0x6c, 0x61, 0x74, 0x65, 0x44, 0x72, 0x79, 0x52, 0x75, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x65, 0x72,
+	0x72, 0x6f, 0x72, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x65, 0x72, 0x72, 0x6f, 0x72, 0x43, 0x6f, 0x64, 0x65, 0x1a, 0x26, 0x0a, 0x0e, 0x57, 0x6f, 0x72,
+	0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x73,
+	0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74,
+	0x65, 0x1a, 0x10, 0x0a, 0x0e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x49, 0x6d, 0x70,
+	0x6f, 0x72, 0x74, 0x1a, 0x10, 0x0a, 0x0e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x44,
+	0x72, 0x79, 0x52, 0x75, 0x6e, 0x42, 0x06, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0xe2, 0x05,
+	0x0a, 0x0c, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x12, 0x15,
+	0x0a, 0x06, 0x6a, 0x6f, 0x62, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x6a, 0x6f, 0x62, 0x49, 0x64, 0x12, 0x54, 0x0a, 0x0f, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x5f, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29,
+	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x43, 0x6f,
+	0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x48, 0x00, 0x52, 0x0e, 0x77, 0x6f, 0x72,
+	0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x12, 0x54, 0x0a, 0x0f, 0x74,
+	0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x69, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x65, 0x72, 0x64, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x4a, 0x6f, 0x62,
+	0x2e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x48,
+	0x00, 0x52, 0x0e, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x49, 0x6d, 0x70, 0x6f, 0x72,
+	0x74, 0x12, 0x55, 0x0a, 0x10, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x64, 0x72,
+	0x79, 0x5f, 0x72, 0x75, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x6c,
+	0x65, 0x74, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x2e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65,
+	0x44, 0x72, 0x79, 0x52, 0x75, 0x6e, 0x48, 0x00, 0x52, 0x0e, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61,
+	0x74, 0x65, 0x44, 0x72, 0x79, 0x52, 0x75, 0x6e, 0x1a, 0x5b, 0x0a, 0x0e, 0x57, 0x6f, 0x72, 0x6b,
 	0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74,
 	0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65,
-	0x1a, 0x10, 0x0a, 0x0e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x49, 0x6d, 0x70, 0x6f,
-	0x72, 0x74, 0x1a, 0x10, 0x0a, 0x0e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x44, 0x72,
-	0x79, 0x52, 0x75, 0x6e, 0x42, 0x06, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0xd8, 0x05, 0x0a,
-	0x0c, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x12, 0x15, 0x0a,
-	0x06, 0x6a, 0x6f, 0x62, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6a,
-	0x6f, 0x62, 0x49, 0x64, 0x12, 0x54, 0x0a, 0x0f, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63,
-	0x65, 0x5f, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e,
-	0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x43, 0x6f, 0x6d,
-	0x70, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70,
-	0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x48, 0x00, 0x52, 0x0e, 0x77, 0x6f, 0x72, 0x6b,
-	0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x12, 0x54, 0x0a, 0x0f, 0x74, 0x65,
-	0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x69, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
-	0x72, 0x64, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x2e,
-	0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x48, 0x00,
-	0x52, 0x0e, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74,
-	0x12, 0x55, 0x0a, 0x10, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x64, 0x72, 0x79,
-	0x5f, 0x72, 0x75, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x70, 0x72, 0x6f,
-	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65,
-	0x74, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x2e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x44,
-	0x72, 0x79, 0x52, 0x75, 0x6e, 0x48, 0x00, 0x52, 0x0e, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74,
-	0x65, 0x44, 0x72, 0x79, 0x52, 0x75, 0x6e, 0x1a, 0x5b, 0x0a, 0x0e, 0x57, 0x6f, 0x72, 0x6b, 0x73,
-	0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61,
-	0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12,
-	0x33, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
-	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x73, 0x1a, 0x81, 0x02, 0x0a, 0x0e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74,
-	0x65, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x3e, 0x0a, 0x0f, 0x73, 0x74, 0x61, 0x72, 0x74,
-	0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x12, 0x33, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
+	0x72, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x73, 0x1a, 0x8b, 0x02, 0x0a, 0x0e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61,
+	0x74, 0x65, 0x49, 0x6d, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x3e, 0x0a, 0x0f, 0x73, 0x74, 0x61, 0x72,
+	0x74, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x0e, 0x73, 0x74, 0x61, 0x72, 0x74, 0x52,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x3c, 0x0a, 0x0e, 0x73, 0x74, 0x6f, 0x70,
+	0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
 	0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x0e, 0x73, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x3c, 0x0a, 0x0e, 0x73, 0x74, 0x6f, 0x70, 0x5f,
-	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x0d, 0x73, 0x74, 0x6f, 0x70, 0x52, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x43, 0x0a, 0x0f, 0x72, 0x69, 0x63, 0x68, 0x5f, 0x70, 0x61,
-	0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a,
-	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x69, 0x63,
-	0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x52, 0x0e, 0x72, 0x69, 0x63, 0x68,
-	0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x12, 0x67, 0x69,
-	0x74, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73,
-	0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x67, 0x69, 0x74, 0x41, 0x75, 0x74, 0x68, 0x50,
-	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x1a, 0x45, 0x0a, 0x0e, 0x54, 0x65, 0x6d, 0x70,
-	0x6c, 0x61, 0x74, 0x65, 0x44, 0x72, 0x79, 0x52, 0x75, 0x6e, 0x12, 0x33, 0x0a, 0x09, 0x72, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e,
-	0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x42,
-	0x06, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0xb0, 0x01, 0x0a, 0x03, 0x4c, 0x6f, 0x67, 0x12,
-	0x2f, 0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x17, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x4c,
-	0x6f, 0x67, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x12, 0x2b, 0x0a, 0x05, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4c, 0x6f,
-	0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x05, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x1d, 0x0a,
-	0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x03, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x14, 0x0a, 0x05,
-	0x73, 0x74, 0x61, 0x67, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x73, 0x74, 0x61,
-	0x67, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x22, 0x8a, 0x02, 0x0a, 0x10, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x4a, 0x6f, 0x62, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x15, 0x0a, 0x06, 0x6a, 0x6f, 0x62, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x05, 0x6a, 0x6f, 0x62, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x04, 0x6c, 0x6f, 0x67, 0x73, 0x18, 0x02,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x64, 0x2e, 0x4c, 0x6f, 0x67, 0x52, 0x04, 0x6c, 0x6f, 0x67, 0x73, 0x12, 0x4c, 0x0a,
-	0x12, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62,
-	0x6c, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65,
-	0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x11, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61,
-	0x74, 0x65, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x12, 0x4c, 0x0a, 0x14, 0x75,
-	0x73, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c,
-	0x75, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65,
-	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x12, 0x75, 0x73, 0x65, 0x72, 0x56, 0x61, 0x72, 0x69, 0x61,
-	0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x61,
-	0x64, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x72, 0x65, 0x61, 0x64, 0x6d,
-	0x65, 0x4a, 0x04, 0x08, 0x03, 0x10, 0x04, 0x22, 0x7a, 0x0a, 0x11, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x4a, 0x6f, 0x62, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1a, 0x0a, 0x08,
-	0x63, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08,
-	0x63, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x65, 0x64, 0x12, 0x43, 0x0a, 0x0f, 0x76, 0x61, 0x72, 0x69,
-	0x61, 0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
-	0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x76,
-	0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x4a, 0x04, 0x08,
-	0x02, 0x10, 0x03, 0x22, 0x4a, 0x0a, 0x12, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x51, 0x75, 0x6f,
-	0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x15, 0x0a, 0x06, 0x6a, 0x6f, 0x62,
-	0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6a, 0x6f, 0x62, 0x49, 0x64,
-	0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x61, 0x69, 0x6c, 0x79, 0x5f, 0x63, 0x6f, 0x73, 0x74, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x64, 0x61, 0x69, 0x6c, 0x79, 0x43, 0x6f, 0x73, 0x74, 0x22,
-	0x68, 0x0a, 0x13, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x51, 0x75, 0x6f, 0x74, 0x61, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x6f, 0x6b, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x02, 0x6f, 0x6b, 0x12, 0x29, 0x0a, 0x10, 0x63, 0x72, 0x65, 0x64, 0x69, 0x74,
-	0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05,
-	0x52, 0x0f, 0x63, 0x72, 0x65, 0x64, 0x69, 0x74, 0x73, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65,
-	0x64, 0x12, 0x16, 0x0a, 0x06, 0x62, 0x75, 0x64, 0x67, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x05, 0x52, 0x06, 0x62, 0x75, 0x64, 0x67, 0x65, 0x74, 0x2a, 0x34, 0x0a, 0x09, 0x4c, 0x6f, 0x67,
-	0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x52, 0x4f, 0x56, 0x49, 0x53,
-	0x49, 0x4f, 0x4e, 0x45, 0x52, 0x5f, 0x44, 0x41, 0x45, 0x4d, 0x4f, 0x4e, 0x10, 0x00, 0x12, 0x0f,
-	0x0a, 0x0b, 0x50, 0x52, 0x4f, 0x56, 0x49, 0x53, 0x49, 0x4f, 0x4e, 0x45, 0x52, 0x10, 0x01, 0x32,
-	0xec, 0x02, 0x0a, 0x11, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x44,
-	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x12, 0x3c, 0x0a, 0x0a, 0x41, 0x63, 0x71, 0x75, 0x69, 0x72, 0x65,
-	0x4a, 0x6f, 0x62, 0x12, 0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
-	0x72, 0x64, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x19, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x41, 0x63, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64,
-	0x4a, 0x6f, 0x62, 0x12, 0x52, 0x0a, 0x0b, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x51, 0x75, 0x6f,
-	0x74, 0x61, 0x12, 0x20, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
-	0x64, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x51, 0x75, 0x6f, 0x74, 0x61, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x64, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x51, 0x75, 0x6f, 0x74, 0x61, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4c, 0x0a, 0x09, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x4a, 0x6f, 0x62, 0x12, 0x1e, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x64, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4a, 0x6f, 0x62, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x64, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4a, 0x6f, 0x62, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x07, 0x46, 0x61, 0x69, 0x6c, 0x4a, 0x6f, 0x62,
-	0x12, 0x17, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e,
-	0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x1a, 0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x3e,
-	0x0a, 0x0b, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x4a, 0x6f, 0x62, 0x12, 0x1a, 0x2e,
-	0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x43, 0x6f, 0x6d,
-	0x70, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x1a, 0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x42, 0x2b,
-	0x5a, 0x29, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x64,
-	0x65, 0x72, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
-	0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x33,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x0d, 0x73, 0x74, 0x6f, 0x70, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x43, 0x0a, 0x0f, 0x72, 0x69, 0x63, 0x68, 0x5f, 0x70,
+	0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x69,
+	0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x52, 0x0e, 0x72, 0x69, 0x63,
+	0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12, 0x36, 0x0a, 0x17, 0x65,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x65, 0x78,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64,
+	0x65, 0x72, 0x73, 0x1a, 0x45, 0x0a, 0x0e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x44,
+	0x72, 0x79, 0x52, 0x75, 0x6e, 0x12, 0x33, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
+	0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x42, 0x06, 0x0a, 0x04, 0x74, 0x79,
+	0x70, 0x65, 0x22, 0xb0, 0x01, 0x0a, 0x03, 0x4c, 0x6f, 0x67, 0x12, 0x2f, 0x0a, 0x06, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x17, 0x2e, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x4c, 0x6f, 0x67, 0x53, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x52, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x2b, 0x0a, 0x05, 0x6c,
+	0x65, 0x76, 0x65, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65,
+	0x6c, 0x52, 0x05, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x1d, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x63, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x67, 0x65,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x73, 0x74, 0x61, 0x67, 0x65, 0x12, 0x16, 0x0a,
+	0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6f,
+	0x75, 0x74, 0x70, 0x75, 0x74, 0x22, 0x8a, 0x02, 0x0a, 0x10, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x4a, 0x6f, 0x62, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x15, 0x0a, 0x06, 0x6a, 0x6f,
+	0x62, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6a, 0x6f, 0x62, 0x49,
+	0x64, 0x12, 0x25, 0x0a, 0x04, 0x6c, 0x6f, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x11, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x4c,
+	0x6f, 0x67, 0x52, 0x04, 0x6c, 0x6f, 0x67, 0x73, 0x12, 0x4c, 0x0a, 0x12, 0x74, 0x65, 0x6d, 0x70,
+	0x6c, 0x61, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x18, 0x04,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x65, 0x72, 0x2e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x56, 0x61, 0x72, 0x69, 0x61,
+	0x62, 0x6c, 0x65, 0x52, 0x11, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x56, 0x61, 0x72,
+	0x69, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x12, 0x4c, 0x0a, 0x14, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x76,
+	0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x05,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x65, 0x72, 0x2e, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x52, 0x12, 0x75, 0x73, 0x65, 0x72, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x61, 0x64, 0x6d, 0x65, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x72, 0x65, 0x61, 0x64, 0x6d, 0x65, 0x4a, 0x04, 0x08, 0x03,
+	0x10, 0x04, 0x22, 0x7a, 0x0a, 0x11, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4a, 0x6f, 0x62, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x63, 0x61, 0x6e, 0x63, 0x65,
+	0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x63, 0x61, 0x6e, 0x63, 0x65,
+	0x6c, 0x65, 0x64, 0x12, 0x43, 0x0a, 0x0f, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x5f,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70,
+	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x56, 0x61, 0x72, 0x69, 0x61,
+	0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62,
+	0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x22, 0x4a,
+	0x0a, 0x12, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x51, 0x75, 0x6f, 0x74, 0x61, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x15, 0x0a, 0x06, 0x6a, 0x6f, 0x62, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6a, 0x6f, 0x62, 0x49, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x64,
+	0x61, 0x69, 0x6c, 0x79, 0x5f, 0x63, 0x6f, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52,
+	0x09, 0x64, 0x61, 0x69, 0x6c, 0x79, 0x43, 0x6f, 0x73, 0x74, 0x22, 0x68, 0x0a, 0x13, 0x43, 0x6f,
+	0x6d, 0x6d, 0x69, 0x74, 0x51, 0x75, 0x6f, 0x74, 0x61, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x0e, 0x0a, 0x02, 0x6f, 0x6b, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x02, 0x6f,
+	0x6b, 0x12, 0x29, 0x0a, 0x10, 0x63, 0x72, 0x65, 0x64, 0x69, 0x74, 0x73, 0x5f, 0x63, 0x6f, 0x6e,
+	0x73, 0x75, 0x6d, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0f, 0x63, 0x72, 0x65,
+	0x64, 0x69, 0x74, 0x73, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6d, 0x65, 0x64, 0x12, 0x16, 0x0a, 0x06,
+	0x62, 0x75, 0x64, 0x67, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x62, 0x75,
+	0x64, 0x67, 0x65, 0x74, 0x22, 0x0f, 0x0a, 0x0d, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x41, 0x63,
+	0x71, 0x75, 0x69, 0x72, 0x65, 0x2a, 0x34, 0x0a, 0x09, 0x4c, 0x6f, 0x67, 0x53, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x12, 0x16, 0x0a, 0x12, 0x50, 0x52, 0x4f, 0x56, 0x49, 0x53, 0x49, 0x4f, 0x4e, 0x45,
+	0x52, 0x5f, 0x44, 0x41, 0x45, 0x4d, 0x4f, 0x4e, 0x10, 0x00, 0x12, 0x0f, 0x0a, 0x0b, 0x50, 0x52,
+	0x4f, 0x56, 0x49, 0x53, 0x49, 0x4f, 0x4e, 0x45, 0x52, 0x10, 0x01, 0x32, 0xc5, 0x03, 0x0a, 0x11,
+	0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x44, 0x61, 0x65, 0x6d, 0x6f,
+	0x6e, 0x12, 0x41, 0x0a, 0x0a, 0x41, 0x63, 0x71, 0x75, 0x69, 0x72, 0x65, 0x4a, 0x6f, 0x62, 0x12,
+	0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x45,
+	0x6d, 0x70, 0x74, 0x79, 0x1a, 0x19, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x65, 0x72, 0x64, 0x2e, 0x41, 0x63, 0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x22,
+	0x03, 0x88, 0x02, 0x01, 0x12, 0x52, 0x0a, 0x14, 0x41, 0x63, 0x71, 0x75, 0x69, 0x72, 0x65, 0x4a,
+	0x6f, 0x62, 0x57, 0x69, 0x74, 0x68, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x12, 0x1b, 0x2e, 0x70,
+	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x43, 0x61, 0x6e, 0x63,
+	0x65, 0x6c, 0x41, 0x63, 0x71, 0x75, 0x69, 0x72, 0x65, 0x1a, 0x19, 0x2e, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x41, 0x63, 0x71, 0x75, 0x69, 0x72, 0x65,
+	0x64, 0x4a, 0x6f, 0x62, 0x28, 0x01, 0x30, 0x01, 0x12, 0x52, 0x0a, 0x0b, 0x43, 0x6f, 0x6d, 0x6d,
+	0x69, 0x74, 0x51, 0x75, 0x6f, 0x74, 0x61, 0x12, 0x20, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73,
+	0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x51, 0x75, 0x6f,
+	0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x51,
+	0x75, 0x6f, 0x74, 0x61, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4c, 0x0a, 0x09,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4a, 0x6f, 0x62, 0x12, 0x1e, 0x2e, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4a,
+	0x6f, 0x62, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4a,
+	0x6f, 0x62, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x07, 0x46, 0x61,
+	0x69, 0x6c, 0x4a, 0x6f, 0x62, 0x12, 0x17, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
+	0x6e, 0x65, 0x72, 0x64, 0x2e, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x1a, 0x13,
+	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x12, 0x3e, 0x0a, 0x0b, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x4a,
+	0x6f, 0x62, 0x12, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
+	0x64, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x4a, 0x6f, 0x62, 0x1a, 0x13,
+	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x42, 0x2e, 0x5a, 0x2c, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x76, 0x32,
+	0x2f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1591,7 +1635,7 @@ func file_provisionerd_proto_provisionerd_proto_rawDescGZIP() []byte {
 }
 
 var file_provisionerd_proto_provisionerd_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_provisionerd_proto_provisionerd_proto_msgTypes = make([]protoimpl.MessageInfo, 19)
+var file_provisionerd_proto_provisionerd_proto_msgTypes = make([]protoimpl.MessageInfo, 20)
 var file_provisionerd_proto_provisionerd_proto_goTypes = []interface{}{
 	(LogSource)(0),                      // 0: provisionerd.LogSource
 	(*Empty)(nil),                       // 1: provisionerd.Empty
@@ -1603,68 +1647,71 @@ var file_provisionerd_proto_provisionerd_proto_goTypes = []interface{}{
 	(*UpdateJobResponse)(nil),           // 7: provisionerd.UpdateJobResponse
 	(*CommitQuotaRequest)(nil),          // 8: provisionerd.CommitQuotaRequest
 	(*CommitQuotaResponse)(nil),         // 9: provisionerd.CommitQuotaResponse
-	(*AcquiredJob_WorkspaceBuild)(nil),  // 10: provisionerd.AcquiredJob.WorkspaceBuild
-	(*AcquiredJob_TemplateImport)(nil),  // 11: provisionerd.AcquiredJob.TemplateImport
-	(*AcquiredJob_TemplateDryRun)(nil),  // 12: provisionerd.AcquiredJob.TemplateDryRun
-	nil,                                 // 13: provisionerd.AcquiredJob.TraceMetadataEntry
-	(*FailedJob_WorkspaceBuild)(nil),    // 14: provisionerd.FailedJob.WorkspaceBuild
-	(*FailedJob_TemplateImport)(nil),    // 15: provisionerd.FailedJob.TemplateImport
-	(*FailedJob_TemplateDryRun)(nil),    // 16: provisionerd.FailedJob.TemplateDryRun
-	(*CompletedJob_WorkspaceBuild)(nil), // 17: provisionerd.CompletedJob.WorkspaceBuild
-	(*CompletedJob_TemplateImport)(nil), // 18: provisionerd.CompletedJob.TemplateImport
-	(*CompletedJob_TemplateDryRun)(nil), // 19: provisionerd.CompletedJob.TemplateDryRun
-	(proto.LogLevel)(0),                 // 20: provisioner.LogLevel
-	(*proto.TemplateVariable)(nil),      // 21: provisioner.TemplateVariable
-	(*proto.VariableValue)(nil),         // 22: provisioner.VariableValue
-	(*proto.RichParameterValue)(nil),    // 23: provisioner.RichParameterValue
-	(*proto.GitAuthProvider)(nil),       // 24: provisioner.GitAuthProvider
-	(*proto.Provision_Metadata)(nil),    // 25: provisioner.Provision.Metadata
-	(*proto.Resource)(nil),              // 26: provisioner.Resource
-	(*proto.RichParameter)(nil),         // 27: provisioner.RichParameter
+	(*CancelAcquire)(nil),               // 10: provisionerd.CancelAcquire
+	(*AcquiredJob_WorkspaceBuild)(nil),  // 11: provisionerd.AcquiredJob.WorkspaceBuild
+	(*AcquiredJob_TemplateImport)(nil),  // 12: provisionerd.AcquiredJob.TemplateImport
+	(*AcquiredJob_TemplateDryRun)(nil),  // 13: provisionerd.AcquiredJob.TemplateDryRun
+	nil,                                 // 14: provisionerd.AcquiredJob.TraceMetadataEntry
+	(*FailedJob_WorkspaceBuild)(nil),    // 15: provisionerd.FailedJob.WorkspaceBuild
+	(*FailedJob_TemplateImport)(nil),    // 16: provisionerd.FailedJob.TemplateImport
+	(*FailedJob_TemplateDryRun)(nil),    // 17: provisionerd.FailedJob.TemplateDryRun
+	(*CompletedJob_WorkspaceBuild)(nil), // 18: provisionerd.CompletedJob.WorkspaceBuild
+	(*CompletedJob_TemplateImport)(nil), // 19: provisionerd.CompletedJob.TemplateImport
+	(*CompletedJob_TemplateDryRun)(nil), // 20: provisionerd.CompletedJob.TemplateDryRun
+	(proto.LogLevel)(0),                 // 21: provisioner.LogLevel
+	(*proto.TemplateVariable)(nil),      // 22: provisioner.TemplateVariable
+	(*proto.VariableValue)(nil),         // 23: provisioner.VariableValue
+	(*proto.RichParameterValue)(nil),    // 24: provisioner.RichParameterValue
+	(*proto.ExternalAuthProvider)(nil),  // 25: provisioner.ExternalAuthProvider
+	(*proto.Metadata)(nil),              // 26: provisioner.Metadata
+	(*proto.Resource)(nil),              // 27: provisioner.Resource
+	(*proto.RichParameter)(nil),         // 28: provisioner.RichParameter
 }
 var file_provisionerd_proto_provisionerd_proto_depIdxs = []int32{
-	10, // 0: provisionerd.AcquiredJob.workspace_build:type_name -> provisionerd.AcquiredJob.WorkspaceBuild
-	11, // 1: provisionerd.AcquiredJob.template_import:type_name -> provisionerd.AcquiredJob.TemplateImport
-	12, // 2: provisionerd.AcquiredJob.template_dry_run:type_name -> provisionerd.AcquiredJob.TemplateDryRun
-	13, // 3: provisionerd.AcquiredJob.trace_metadata:type_name -> provisionerd.AcquiredJob.TraceMetadataEntry
-	14, // 4: provisionerd.FailedJob.workspace_build:type_name -> provisionerd.FailedJob.WorkspaceBuild
-	15, // 5: provisionerd.FailedJob.template_import:type_name -> provisionerd.FailedJob.TemplateImport
-	16, // 6: provisionerd.FailedJob.template_dry_run:type_name -> provisionerd.FailedJob.TemplateDryRun
-	17, // 7: provisionerd.CompletedJob.workspace_build:type_name -> provisionerd.CompletedJob.WorkspaceBuild
-	18, // 8: provisionerd.CompletedJob.template_import:type_name -> provisionerd.CompletedJob.TemplateImport
-	19, // 9: provisionerd.CompletedJob.template_dry_run:type_name -> provisionerd.CompletedJob.TemplateDryRun
+	11, // 0: provisionerd.AcquiredJob.workspace_build:type_name -> provisionerd.AcquiredJob.WorkspaceBuild
+	12, // 1: provisionerd.AcquiredJob.template_import:type_name -> provisionerd.AcquiredJob.TemplateImport
+	13, // 2: provisionerd.AcquiredJob.template_dry_run:type_name -> provisionerd.AcquiredJob.TemplateDryRun
+	14, // 3: provisionerd.AcquiredJob.trace_metadata:type_name -> provisionerd.AcquiredJob.TraceMetadataEntry
+	15, // 4: provisionerd.FailedJob.workspace_build:type_name -> provisionerd.FailedJob.WorkspaceBuild
+	16, // 5: provisionerd.FailedJob.template_import:type_name -> provisionerd.FailedJob.TemplateImport
+	17, // 6: provisionerd.FailedJob.template_dry_run:type_name -> provisionerd.FailedJob.TemplateDryRun
+	18, // 7: provisionerd.CompletedJob.workspace_build:type_name -> provisionerd.CompletedJob.WorkspaceBuild
+	19, // 8: provisionerd.CompletedJob.template_import:type_name -> provisionerd.CompletedJob.TemplateImport
+	20, // 9: provisionerd.CompletedJob.template_dry_run:type_name -> provisionerd.CompletedJob.TemplateDryRun
 	0,  // 10: provisionerd.Log.source:type_name -> provisionerd.LogSource
-	20, // 11: provisionerd.Log.level:type_name -> provisioner.LogLevel
+	21, // 11: provisionerd.Log.level:type_name -> provisioner.LogLevel
 	5,  // 12: provisionerd.UpdateJobRequest.logs:type_name -> provisionerd.Log
-	21, // 13: provisionerd.UpdateJobRequest.template_variables:type_name -> provisioner.TemplateVariable
-	22, // 14: provisionerd.UpdateJobRequest.user_variable_values:type_name -> provisioner.VariableValue
-	22, // 15: provisionerd.UpdateJobResponse.variable_values:type_name -> provisioner.VariableValue
-	23, // 16: provisionerd.AcquiredJob.WorkspaceBuild.rich_parameter_values:type_name -> provisioner.RichParameterValue
-	22, // 17: provisionerd.AcquiredJob.WorkspaceBuild.variable_values:type_name -> provisioner.VariableValue
-	24, // 18: provisionerd.AcquiredJob.WorkspaceBuild.git_auth_providers:type_name -> provisioner.GitAuthProvider
-	25, // 19: provisionerd.AcquiredJob.WorkspaceBuild.metadata:type_name -> provisioner.Provision.Metadata
-	25, // 20: provisionerd.AcquiredJob.TemplateImport.metadata:type_name -> provisioner.Provision.Metadata
-	22, // 21: provisionerd.AcquiredJob.TemplateImport.user_variable_values:type_name -> provisioner.VariableValue
-	23, // 22: provisionerd.AcquiredJob.TemplateDryRun.rich_parameter_values:type_name -> provisioner.RichParameterValue
-	22, // 23: provisionerd.AcquiredJob.TemplateDryRun.variable_values:type_name -> provisioner.VariableValue
-	25, // 24: provisionerd.AcquiredJob.TemplateDryRun.metadata:type_name -> provisioner.Provision.Metadata
-	26, // 25: provisionerd.CompletedJob.WorkspaceBuild.resources:type_name -> provisioner.Resource
-	26, // 26: provisionerd.CompletedJob.TemplateImport.start_resources:type_name -> provisioner.Resource
-	26, // 27: provisionerd.CompletedJob.TemplateImport.stop_resources:type_name -> provisioner.Resource
-	27, // 28: provisionerd.CompletedJob.TemplateImport.rich_parameters:type_name -> provisioner.RichParameter
-	26, // 29: provisionerd.CompletedJob.TemplateDryRun.resources:type_name -> provisioner.Resource
+	22, // 13: provisionerd.UpdateJobRequest.template_variables:type_name -> provisioner.TemplateVariable
+	23, // 14: provisionerd.UpdateJobRequest.user_variable_values:type_name -> provisioner.VariableValue
+	23, // 15: provisionerd.UpdateJobResponse.variable_values:type_name -> provisioner.VariableValue
+	24, // 16: provisionerd.AcquiredJob.WorkspaceBuild.rich_parameter_values:type_name -> provisioner.RichParameterValue
+	23, // 17: provisionerd.AcquiredJob.WorkspaceBuild.variable_values:type_name -> provisioner.VariableValue
+	25, // 18: provisionerd.AcquiredJob.WorkspaceBuild.external_auth_providers:type_name -> provisioner.ExternalAuthProvider
+	26, // 19: provisionerd.AcquiredJob.WorkspaceBuild.metadata:type_name -> provisioner.Metadata
+	26, // 20: provisionerd.AcquiredJob.TemplateImport.metadata:type_name -> provisioner.Metadata
+	23, // 21: provisionerd.AcquiredJob.TemplateImport.user_variable_values:type_name -> provisioner.VariableValue
+	24, // 22: provisionerd.AcquiredJob.TemplateDryRun.rich_parameter_values:type_name -> provisioner.RichParameterValue
+	23, // 23: provisionerd.AcquiredJob.TemplateDryRun.variable_values:type_name -> provisioner.VariableValue
+	26, // 24: provisionerd.AcquiredJob.TemplateDryRun.metadata:type_name -> provisioner.Metadata
+	27, // 25: provisionerd.CompletedJob.WorkspaceBuild.resources:type_name -> provisioner.Resource
+	27, // 26: provisionerd.CompletedJob.TemplateImport.start_resources:type_name -> provisioner.Resource
+	27, // 27: provisionerd.CompletedJob.TemplateImport.stop_resources:type_name -> provisioner.Resource
+	28, // 28: provisionerd.CompletedJob.TemplateImport.rich_parameters:type_name -> provisioner.RichParameter
+	27, // 29: provisionerd.CompletedJob.TemplateDryRun.resources:type_name -> provisioner.Resource
 	1,  // 30: provisionerd.ProvisionerDaemon.AcquireJob:input_type -> provisionerd.Empty
-	8,  // 31: provisionerd.ProvisionerDaemon.CommitQuota:input_type -> provisionerd.CommitQuotaRequest
-	6,  // 32: provisionerd.ProvisionerDaemon.UpdateJob:input_type -> provisionerd.UpdateJobRequest
-	3,  // 33: provisionerd.ProvisionerDaemon.FailJob:input_type -> provisionerd.FailedJob
-	4,  // 34: provisionerd.ProvisionerDaemon.CompleteJob:input_type -> provisionerd.CompletedJob
-	2,  // 35: provisionerd.ProvisionerDaemon.AcquireJob:output_type -> provisionerd.AcquiredJob
-	9,  // 36: provisionerd.ProvisionerDaemon.CommitQuota:output_type -> provisionerd.CommitQuotaResponse
-	7,  // 37: provisionerd.ProvisionerDaemon.UpdateJob:output_type -> provisionerd.UpdateJobResponse
-	1,  // 38: provisionerd.ProvisionerDaemon.FailJob:output_type -> provisionerd.Empty
-	1,  // 39: provisionerd.ProvisionerDaemon.CompleteJob:output_type -> provisionerd.Empty
-	35, // [35:40] is the sub-list for method output_type
-	30, // [30:35] is the sub-list for method input_type
+	10, // 31: provisionerd.ProvisionerDaemon.AcquireJobWithCancel:input_type -> provisionerd.CancelAcquire
+	8,  // 32: provisionerd.ProvisionerDaemon.CommitQuota:input_type -> provisionerd.CommitQuotaRequest
+	6,  // 33: provisionerd.ProvisionerDaemon.UpdateJob:input_type -> provisionerd.UpdateJobRequest
+	3,  // 34: provisionerd.ProvisionerDaemon.FailJob:input_type -> provisionerd.FailedJob
+	4,  // 35: provisionerd.ProvisionerDaemon.CompleteJob:input_type -> provisionerd.CompletedJob
+	2,  // 36: provisionerd.ProvisionerDaemon.AcquireJob:output_type -> provisionerd.AcquiredJob
+	2,  // 37: provisionerd.ProvisionerDaemon.AcquireJobWithCancel:output_type -> provisionerd.AcquiredJob
+	9,  // 38: provisionerd.ProvisionerDaemon.CommitQuota:output_type -> provisionerd.CommitQuotaResponse
+	7,  // 39: provisionerd.ProvisionerDaemon.UpdateJob:output_type -> provisionerd.UpdateJobResponse
+	1,  // 40: provisionerd.ProvisionerDaemon.FailJob:output_type -> provisionerd.Empty
+	1,  // 41: provisionerd.ProvisionerDaemon.CompleteJob:output_type -> provisionerd.Empty
+	36, // [36:42] is the sub-list for method output_type
+	30, // [30:36] is the sub-list for method input_type
 	30, // [30:30] is the sub-list for extension type_name
 	30, // [30:30] is the sub-list for extension extendee
 	0,  // [0:30] is the sub-list for field type_name
@@ -1785,7 +1832,7 @@ func file_provisionerd_proto_provisionerd_proto_init() {
 			}
 		}
 		file_provisionerd_proto_provisionerd_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AcquiredJob_WorkspaceBuild); i {
+			switch v := v.(*CancelAcquire); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1797,7 +1844,7 @@ func file_provisionerd_proto_provisionerd_proto_init() {
 			}
 		}
 		file_provisionerd_proto_provisionerd_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AcquiredJob_TemplateImport); i {
+			switch v := v.(*AcquiredJob_WorkspaceBuild); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1809,6 +1856,18 @@ func file_provisionerd_proto_provisionerd_proto_init() {
 			}
 		}
 		file_provisionerd_proto_provisionerd_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AcquiredJob_TemplateImport); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_provisionerd_proto_provisionerd_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*AcquiredJob_TemplateDryRun); i {
 			case 0:
 				return &v.state
@@ -1820,7 +1879,7 @@ func file_provisionerd_proto_provisionerd_proto_init() {
 				return nil
 			}
 		}
-		file_provisionerd_proto_provisionerd_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+		file_provisionerd_proto_provisionerd_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*FailedJob_WorkspaceBuild); i {
 			case 0:
 				return &v.state
@@ -1832,7 +1891,7 @@ func file_provisionerd_proto_provisionerd_proto_init() {
 				return nil
 			}
 		}
-		file_provisionerd_proto_provisionerd_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+		file_provisionerd_proto_provisionerd_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*FailedJob_TemplateImport); i {
 			case 0:
 				return &v.state
@@ -1844,7 +1903,7 @@ func file_provisionerd_proto_provisionerd_proto_init() {
 				return nil
 			}
 		}
-		file_provisionerd_proto_provisionerd_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+		file_provisionerd_proto_provisionerd_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*FailedJob_TemplateDryRun); i {
 			case 0:
 				return &v.state
@@ -1856,7 +1915,7 @@ func file_provisionerd_proto_provisionerd_proto_init() {
 				return nil
 			}
 		}
-		file_provisionerd_proto_provisionerd_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+		file_provisionerd_proto_provisionerd_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CompletedJob_WorkspaceBuild); i {
 			case 0:
 				return &v.state
@@ -1868,7 +1927,7 @@ func file_provisionerd_proto_provisionerd_proto_init() {
 				return nil
 			}
 		}
-		file_provisionerd_proto_provisionerd_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+		file_provisionerd_proto_provisionerd_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CompletedJob_TemplateImport); i {
 			case 0:
 				return &v.state
@@ -1880,7 +1939,7 @@ func file_provisionerd_proto_provisionerd_proto_init() {
 				return nil
 			}
 		}
-		file_provisionerd_proto_provisionerd_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+		file_provisionerd_proto_provisionerd_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*CompletedJob_TemplateDryRun); i {
 			case 0:
 				return &v.state
@@ -1914,7 +1973,7 @@ func file_provisionerd_proto_provisionerd_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_provisionerd_proto_provisionerd_proto_rawDesc,
 			NumEnums:      1,
-			NumMessages:   19,
+			NumMessages:   20,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/provisionerd/proto/provisionerd.proto b/provisionerd/proto/provisionerd.proto
index 1c44ceef37dc4..705c0ffbed258 100644
--- a/provisionerd/proto/provisionerd.proto
+++ b/provisionerd/proto/provisionerd.proto
@@ -1,6 +1,6 @@
 
 syntax = "proto3";
-option go_package = "github.com/coder/coder/provisionerd/proto";
+option go_package = "github.com/coder/coder/v2/provisionerd/proto";
 
 package provisionerd;
 
@@ -18,13 +18,13 @@ message AcquiredJob {
         string workspace_name = 2;
         repeated provisioner.RichParameterValue rich_parameter_values = 4;
         repeated provisioner.VariableValue variable_values = 5;
-        repeated provisioner.GitAuthProvider git_auth_providers = 6;
-        provisioner.Provision.Metadata metadata = 7;
+        repeated provisioner.ExternalAuthProvider external_auth_providers = 6;
+        provisioner.Metadata metadata = 7;
         bytes state = 8;
         string log_level = 9;
     }
     message TemplateImport {
-        provisioner.Provision.Metadata metadata = 1;
+        provisioner.Metadata metadata = 1;
         repeated provisioner.VariableValue user_variable_values = 2;
     }
     message TemplateDryRun {
@@ -32,7 +32,7 @@ message AcquiredJob {
 
         repeated provisioner.RichParameterValue rich_parameter_values = 2;
         repeated provisioner.VariableValue variable_values = 3;
-        provisioner.Provision.Metadata metadata = 4;
+        provisioner.Metadata metadata = 4;
     }
 
     string job_id = 1;
@@ -45,9 +45,9 @@ message AcquiredJob {
         TemplateImport template_import = 7;
         TemplateDryRun template_dry_run = 8;
     }
-	// trace_metadata is currently used for tracing information only. It allows
-	// jobs to be tied to the request that created them.
-	map<string, string> trace_metadata = 9;
+    // trace_metadata is currently used for tracing information only. It allows
+    // jobs to be tied to the request that created them.
+    map<string, string> trace_metadata = 9;
 }
 
 message FailedJob {
@@ -77,7 +77,7 @@ message CompletedJob {
         repeated provisioner.Resource start_resources = 1;
         repeated provisioner.Resource stop_resources = 2;
         repeated provisioner.RichParameter rich_parameters = 3;
-        repeated string git_auth_providers = 4;
+        repeated string external_auth_providers = 4;
     }
     message TemplateDryRun {
         repeated provisioner.Resource resources = 1;
@@ -113,7 +113,7 @@ message UpdateJobRequest {
     string job_id = 1;
     repeated Log logs = 2;
     repeated provisioner.TemplateVariable template_variables = 4;
-	repeated provisioner.VariableValue user_variable_values = 5;
+    repeated provisioner.VariableValue user_variable_values = 5;
     bytes readme = 6;
 }
 
@@ -121,7 +121,7 @@ message UpdateJobResponse {
     reserved 2;
 
     bool canceled = 1;
-	repeated provisioner.VariableValue variable_values = 3;
+    repeated provisioner.VariableValue variable_values = 3;
 }
 
 message CommitQuotaRequest {
@@ -135,11 +135,22 @@ message CommitQuotaResponse {
     int32 budget = 3;
 }
 
+message CancelAcquire {}
+
 service ProvisionerDaemon {
     // AcquireJob requests a job. Implementations should
     // hold a lock on the job until CompleteJob() is
     // called with the matching ID.
-    rpc AcquireJob(Empty) returns (AcquiredJob);
+    rpc AcquireJob(Empty) returns (AcquiredJob) {
+        option deprecated = true;
+    };
+    // AcquireJobWithCancel requests a job, blocking until
+    // a job is available or the client sends CancelAcquire.
+    // Server will send exactly one AcquiredJob, which is
+    // empty if a cancel was successful.  This RPC is a bidirectional
+    // stream since both messages are asynchronous with no implied
+    // ordering.
+    rpc AcquireJobWithCancel(stream CancelAcquire) returns (stream AcquiredJob);
 
     rpc CommitQuota(CommitQuotaRequest) returns (CommitQuotaResponse);
 
diff --git a/provisionerd/proto/provisionerd_drpc.pb.go b/provisionerd/proto/provisionerd_drpc.pb.go
index ed3155fb21eaa..60d78a86acb17 100644
--- a/provisionerd/proto/provisionerd_drpc.pb.go
+++ b/provisionerd/proto/provisionerd_drpc.pb.go
@@ -39,6 +39,7 @@ type DRPCProvisionerDaemonClient interface {
 	DRPCConn() drpc.Conn
 
 	AcquireJob(ctx context.Context, in *Empty) (*AcquiredJob, error)
+	AcquireJobWithCancel(ctx context.Context) (DRPCProvisionerDaemon_AcquireJobWithCancelClient, error)
 	CommitQuota(ctx context.Context, in *CommitQuotaRequest) (*CommitQuotaResponse, error)
 	UpdateJob(ctx context.Context, in *UpdateJobRequest) (*UpdateJobResponse, error)
 	FailJob(ctx context.Context, in *FailedJob) (*Empty, error)
@@ -64,6 +65,45 @@ func (c *drpcProvisionerDaemonClient) AcquireJob(ctx context.Context, in *Empty)
 	return out, nil
 }
 
+func (c *drpcProvisionerDaemonClient) AcquireJobWithCancel(ctx context.Context) (DRPCProvisionerDaemon_AcquireJobWithCancelClient, error) {
+	stream, err := c.cc.NewStream(ctx, "/provisionerd.ProvisionerDaemon/AcquireJobWithCancel", drpcEncoding_File_provisionerd_proto_provisionerd_proto{})
+	if err != nil {
+		return nil, err
+	}
+	x := &drpcProvisionerDaemon_AcquireJobWithCancelClient{stream}
+	return x, nil
+}
+
+type DRPCProvisionerDaemon_AcquireJobWithCancelClient interface {
+	drpc.Stream
+	Send(*CancelAcquire) error
+	Recv() (*AcquiredJob, error)
+}
+
+type drpcProvisionerDaemon_AcquireJobWithCancelClient struct {
+	drpc.Stream
+}
+
+func (x *drpcProvisionerDaemon_AcquireJobWithCancelClient) GetStream() drpc.Stream {
+	return x.Stream
+}
+
+func (x *drpcProvisionerDaemon_AcquireJobWithCancelClient) Send(m *CancelAcquire) error {
+	return x.MsgSend(m, drpcEncoding_File_provisionerd_proto_provisionerd_proto{})
+}
+
+func (x *drpcProvisionerDaemon_AcquireJobWithCancelClient) Recv() (*AcquiredJob, error) {
+	m := new(AcquiredJob)
+	if err := x.MsgRecv(m, drpcEncoding_File_provisionerd_proto_provisionerd_proto{}); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (x *drpcProvisionerDaemon_AcquireJobWithCancelClient) RecvMsg(m *AcquiredJob) error {
+	return x.MsgRecv(m, drpcEncoding_File_provisionerd_proto_provisionerd_proto{})
+}
+
 func (c *drpcProvisionerDaemonClient) CommitQuota(ctx context.Context, in *CommitQuotaRequest) (*CommitQuotaResponse, error) {
 	out := new(CommitQuotaResponse)
 	err := c.cc.Invoke(ctx, "/provisionerd.ProvisionerDaemon/CommitQuota", drpcEncoding_File_provisionerd_proto_provisionerd_proto{}, in, out)
@@ -102,6 +142,7 @@ func (c *drpcProvisionerDaemonClient) CompleteJob(ctx context.Context, in *Compl
 
 type DRPCProvisionerDaemonServer interface {
 	AcquireJob(context.Context, *Empty) (*AcquiredJob, error)
+	AcquireJobWithCancel(DRPCProvisionerDaemon_AcquireJobWithCancelStream) error
 	CommitQuota(context.Context, *CommitQuotaRequest) (*CommitQuotaResponse, error)
 	UpdateJob(context.Context, *UpdateJobRequest) (*UpdateJobResponse, error)
 	FailJob(context.Context, *FailedJob) (*Empty, error)
@@ -114,6 +155,10 @@ func (s *DRPCProvisionerDaemonUnimplementedServer) AcquireJob(context.Context, *
 	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
 }
 
+func (s *DRPCProvisionerDaemonUnimplementedServer) AcquireJobWithCancel(DRPCProvisionerDaemon_AcquireJobWithCancelStream) error {
+	return drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
 func (s *DRPCProvisionerDaemonUnimplementedServer) CommitQuota(context.Context, *CommitQuotaRequest) (*CommitQuotaResponse, error) {
 	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
 }
@@ -132,7 +177,7 @@ func (s *DRPCProvisionerDaemonUnimplementedServer) CompleteJob(context.Context,
 
 type DRPCProvisionerDaemonDescription struct{}
 
-func (DRPCProvisionerDaemonDescription) NumMethods() int { return 5 }
+func (DRPCProvisionerDaemonDescription) NumMethods() int { return 6 }
 
 func (DRPCProvisionerDaemonDescription) Method(n int) (string, drpc.Encoding, drpc.Receiver, interface{}, bool) {
 	switch n {
@@ -146,6 +191,14 @@ func (DRPCProvisionerDaemonDescription) Method(n int) (string, drpc.Encoding, dr
 					)
 			}, DRPCProvisionerDaemonServer.AcquireJob, true
 	case 1:
+		return "/provisionerd.ProvisionerDaemon/AcquireJobWithCancel", drpcEncoding_File_provisionerd_proto_provisionerd_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return nil, srv.(DRPCProvisionerDaemonServer).
+					AcquireJobWithCancel(
+						&drpcProvisionerDaemon_AcquireJobWithCancelStream{in1.(drpc.Stream)},
+					)
+			}, DRPCProvisionerDaemonServer.AcquireJobWithCancel, true
+	case 2:
 		return "/provisionerd.ProvisionerDaemon/CommitQuota", drpcEncoding_File_provisionerd_proto_provisionerd_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCProvisionerDaemonServer).
@@ -154,7 +207,7 @@ func (DRPCProvisionerDaemonDescription) Method(n int) (string, drpc.Encoding, dr
 						in1.(*CommitQuotaRequest),
 					)
 			}, DRPCProvisionerDaemonServer.CommitQuota, true
-	case 2:
+	case 3:
 		return "/provisionerd.ProvisionerDaemon/UpdateJob", drpcEncoding_File_provisionerd_proto_provisionerd_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCProvisionerDaemonServer).
@@ -163,7 +216,7 @@ func (DRPCProvisionerDaemonDescription) Method(n int) (string, drpc.Encoding, dr
 						in1.(*UpdateJobRequest),
 					)
 			}, DRPCProvisionerDaemonServer.UpdateJob, true
-	case 3:
+	case 4:
 		return "/provisionerd.ProvisionerDaemon/FailJob", drpcEncoding_File_provisionerd_proto_provisionerd_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCProvisionerDaemonServer).
@@ -172,7 +225,7 @@ func (DRPCProvisionerDaemonDescription) Method(n int) (string, drpc.Encoding, dr
 						in1.(*FailedJob),
 					)
 			}, DRPCProvisionerDaemonServer.FailJob, true
-	case 4:
+	case 5:
 		return "/provisionerd.ProvisionerDaemon/CompleteJob", drpcEncoding_File_provisionerd_proto_provisionerd_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCProvisionerDaemonServer).
@@ -206,6 +259,32 @@ func (x *drpcProvisionerDaemon_AcquireJobStream) SendAndClose(m *AcquiredJob) er
 	return x.CloseSend()
 }
 
+type DRPCProvisionerDaemon_AcquireJobWithCancelStream interface {
+	drpc.Stream
+	Send(*AcquiredJob) error
+	Recv() (*CancelAcquire, error)
+}
+
+type drpcProvisionerDaemon_AcquireJobWithCancelStream struct {
+	drpc.Stream
+}
+
+func (x *drpcProvisionerDaemon_AcquireJobWithCancelStream) Send(m *AcquiredJob) error {
+	return x.MsgSend(m, drpcEncoding_File_provisionerd_proto_provisionerd_proto{})
+}
+
+func (x *drpcProvisionerDaemon_AcquireJobWithCancelStream) Recv() (*CancelAcquire, error) {
+	m := new(CancelAcquire)
+	if err := x.MsgRecv(m, drpcEncoding_File_provisionerd_proto_provisionerd_proto{}); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (x *drpcProvisionerDaemon_AcquireJobWithCancelStream) RecvMsg(m *CancelAcquire) error {
+	return x.MsgRecv(m, drpcEncoding_File_provisionerd_proto_provisionerd_proto{})
+}
+
 type DRPCProvisionerDaemon_CommitQuotaStream interface {
 	drpc.Stream
 	SendAndClose(*CommitQuotaResponse) error
diff --git a/provisionerd/provisionerd.go b/provisionerd/provisionerd.go
index d7e50f96bfab1..9072085ff5e09 100644
--- a/provisionerd/provisionerd.go
+++ b/provisionerd/provisionerd.go
@@ -12,39 +12,44 @@ import (
 	"github.com/hashicorp/yamux"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promauto"
-	"github.com/spf13/afero"
 	"github.com/valyala/fasthttp/fasthttputil"
 	"go.opentelemetry.io/otel/attribute"
 	semconv "go.opentelemetry.io/otel/semconv/v1.14.0"
 	"go.opentelemetry.io/otel/trace"
-	"go.uber.org/atomic"
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/provisionerd/proto"
-	"github.com/coder/coder/provisionerd/runner"
-	sdkproto "github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/provisionerd/proto"
+	"github.com/coder/coder/v2/provisionerd/runner"
+	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
 	"github.com/coder/retry"
 )
 
-// IsMissingParameterErrorCode returns whether the error is a missing parameter error.
-// This can indicate to consumers that they should check parameters.
-func IsMissingParameterErrorCode(code string) bool {
-	return code == runner.MissingParameterErrorCode
-}
-
 // Dialer represents the function to create a daemon client connection.
 type Dialer func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error)
 
-// Provisioners maps provisioner ID to implementation.
-type Provisioners map[string]sdkproto.DRPCProvisionerClient
+// ConnectResponse is the response returned asynchronously from Connector.Connect
+// containing either the Provisioner Client or an Error.  The Job is also returned
+// unaltered to disambiguate responses if the respCh is shared among multiple jobs
+type ConnectResponse struct {
+	Job    *proto.AcquiredJob
+	Client sdkproto.DRPCProvisionerClient
+	Error  error
+}
+
+// Connector allows the provisioner daemon to Connect to a provisioner
+// for the given job.
+type Connector interface {
+	// Connect to the correct provisioner for the given job. The response is
+	// delivered asynchronously over the respCh.  If the provided context expires,
+	// the Connector may stop waiting for the provisioner and return an error
+	// response.
+	Connect(ctx context.Context, job *proto.AcquiredJob, respCh chan<- ConnectResponse)
+}
 
 // Options provides customizations to the behavior of a provisioner daemon.
 type Options struct {
-	Filesystem     afero.Fs
 	Logger         slog.Logger
 	TracerProvider trace.TracerProvider
 	Metrics        *Metrics
@@ -52,12 +57,7 @@ type Options struct {
 	ForceCancelInterval time.Duration
 	UpdateInterval      time.Duration
 	LogBufferInterval   time.Duration
-	JobPollInterval     time.Duration
-	JobPollJitter       time.Duration
-	JobPollDebounce     time.Duration
-	Provisioners        Provisioners
-	// WorkDirectory must not be used by multiple processes at once.
-	WorkDirectory string
+	Connector           Connector
 }
 
 // New creates and starts a provisioner daemon.
@@ -65,12 +65,6 @@ func New(clientDialer Dialer, opts *Options) *Server {
 	if opts == nil {
 		opts = &Options{}
 	}
-	if opts.JobPollInterval == 0 {
-		opts.JobPollInterval = 5 * time.Second
-	}
-	if opts.JobPollJitter == 0 {
-		opts.JobPollJitter = time.Second
-	}
 	if opts.UpdateInterval == 0 {
 		opts.UpdateInterval = 5 * time.Second
 	}
@@ -80,9 +74,6 @@ func New(clientDialer Dialer, opts *Options) *Server {
 	if opts.LogBufferInterval == 0 {
 		opts.LogBufferInterval = 250 * time.Millisecond
 	}
-	if opts.Filesystem == nil {
-		opts.Filesystem = afero.NewOsFs()
-	}
 	if opts.TracerProvider == nil {
 		opts.TracerProvider = trace.NewNoopTracerProvider()
 	}
@@ -98,14 +89,18 @@ func New(clientDialer Dialer, opts *Options) *Server {
 		tracer: opts.TracerProvider.Tracer(tracing.TracerName),
 
 		clientDialer: clientDialer,
+		clientCh:     make(chan proto.DRPCProvisionerDaemonClient),
 
-		closeContext: ctx,
-		closeCancel:  ctxCancel,
-
-		shutdown: make(chan struct{}),
+		closeContext:   ctx,
+		closeCancel:    ctxCancel,
+		closedCh:       make(chan struct{}),
+		shuttingDownCh: make(chan struct{}),
+		acquireDoneCh:  make(chan struct{}),
 	}
 
-	go daemon.connect(ctx)
+	daemon.wg.Add(2)
+	go daemon.connect()
+	go daemon.acquireLoop()
 	return daemon
 }
 
@@ -114,15 +109,28 @@ type Server struct {
 	tracer trace.Tracer
 
 	clientDialer Dialer
-	clientValue  atomic.Pointer[proto.DRPCProvisionerDaemonClient]
+	clientCh     chan proto.DRPCProvisionerDaemonClient
+
+	wg sync.WaitGroup
 
-	// Locked when closing the daemon, shutting down, or starting a new job.
-	mutex        sync.Mutex
+	// mutex protects all subsequent fields
+	mutex sync.Mutex
+	// closeContext is canceled when we start closing.
 	closeContext context.Context
 	closeCancel  context.CancelFunc
-	closeError   error
-	shutdown     chan struct{}
-	activeJob    *runner.Runner
+	// closeError stores the error when closing to return to subsequent callers
+	closeError error
+	// closingB is set to true when we start closing
+	closingB bool
+	// closedCh will receive when we complete closing
+	closedCh chan struct{}
+	// shuttingDownB is set to true when we start graceful shutdown
+	shuttingDownB bool
+	// shuttingDownCh will receive when we start graceful shutdown
+	shuttingDownCh chan struct{}
+	// acquireDoneCh will receive when the acquireLoop exits
+	acquireDoneCh chan struct{}
+	activeJob     *runner.Runner
 }
 
 type Metrics struct {
@@ -173,16 +181,20 @@ func NewMetrics(reg prometheus.Registerer) Metrics {
 }
 
 // Connect establishes a connection to coderd.
-func (p *Server) connect(ctx context.Context) {
+func (p *Server) connect() {
+	defer p.opts.Logger.Debug(p.closeContext, "connect loop exited")
+	defer p.wg.Done()
 	// An exponential back-off occurs when the connection is failing to dial.
 	// This is to prevent server spam in case of a coderd outage.
-	for retrier := retry.New(50*time.Millisecond, 10*time.Second); retrier.Wait(ctx); {
+connectLoop:
+	for retrier := retry.New(50*time.Millisecond, 10*time.Second); retrier.Wait(p.closeContext); {
 		// It's possible for the provisioner daemon to be shut down
 		// before the wait is complete!
 		if p.isClosed() {
 			return
 		}
-		client, err := p.clientDialer(ctx)
+		p.opts.Logger.Debug(p.closeContext, "dialing coderd")
+		client, err := p.clientDialer(p.closeContext)
 		if err != nil {
 			if errors.Is(err, context.Canceled) {
 				return
@@ -190,142 +202,75 @@ func (p *Server) connect(ctx context.Context) {
 			if p.isClosed() {
 				return
 			}
-			p.opts.Logger.Warn(context.Background(), "coderd client failed to dial", slog.Error(err))
+			p.opts.Logger.Warn(p.closeContext, "coderd client failed to dial", slog.Error(err))
 			continue
 		}
-		// Ensure connection is not left hanging during a race between
-		// close and dial succeeding.
-		p.mutex.Lock()
-		if p.isClosed() {
-			client.DRPCConn().Close()
-			p.mutex.Unlock()
-			break
-		}
-		p.clientValue.Store(ptr.Ref(client))
-		p.mutex.Unlock()
+		p.opts.Logger.Info(p.closeContext, "successfully connected to coderd")
+		retrier.Reset()
 
-		p.opts.Logger.Debug(context.Background(), "connected")
-		break
-	}
-	select {
-	case <-ctx.Done():
-		return
-	default:
-	}
-
-	go func() {
-		if p.isClosed() {
-			return
-		}
-		client, ok := p.client()
-		if !ok {
-			return
-		}
-		select {
-		case <-p.closeContext.Done():
-			return
-		case <-client.DRPCConn().Closed():
-			// We use the update stream to detect when the connection
-			// has been interrupted. This works well, because logs need
-			// to buffer if a job is running in the background.
-			p.opts.Logger.Debug(context.Background(), "client stream ended")
-			p.connect(ctx)
-		}
-	}()
-
-	go func() {
-		if p.isClosed() {
-			return
-		}
-		timer := time.NewTimer(p.opts.JobPollInterval)
-		defer timer.Stop()
+		// serve the client until we are closed or it disconnects
 		for {
-			client, ok := p.client()
-			if !ok {
-				return
-			}
 			select {
 			case <-p.closeContext.Done():
+				client.DRPCConn().Close()
 				return
 			case <-client.DRPCConn().Closed():
-				return
-			case <-timer.C:
-				p.acquireJob(ctx)
-				timer.Reset(p.nextInterval())
+				p.opts.Logger.Info(p.closeContext, "connection to coderd closed")
+				continue connectLoop
+			case p.clientCh <- client:
+				continue
 			}
 		}
-	}()
-}
-
-func (p *Server) nextInterval() time.Duration {
-	r, err := cryptorand.Float64()
-	if err != nil {
-		panic("get random float:" + err.Error())
 	}
-
-	return p.opts.JobPollInterval + time.Duration(float64(p.opts.JobPollJitter)*r)
 }
 
 func (p *Server) client() (proto.DRPCProvisionerDaemonClient, bool) {
-	client := p.clientValue.Load()
-	if client == nil {
+	select {
+	case <-p.closeContext.Done():
 		return nil, false
+	case client := <-p.clientCh:
+		return client, true
 	}
-	return *client, true
 }
 
-// isRunningJob returns true if a job is running.  Caller must hold the mutex.
-func (p *Server) isRunningJob() bool {
-	if p.activeJob == nil {
-		return false
-	}
-	select {
-	case <-p.activeJob.Done():
-		return false
-	default:
-		return true
+func (p *Server) acquireLoop() {
+	defer p.opts.Logger.Debug(p.closeContext, "acquire loop exited")
+	defer p.wg.Done()
+	defer func() { close(p.acquireDoneCh) }()
+	ctx := p.closeContext
+	for {
+		if p.acquireExit() {
+			return
+		}
+		client, ok := p.client()
+		if !ok {
+			p.opts.Logger.Debug(ctx, "shut down before client (re) connected")
+			return
+		}
+		p.acquireAndRunOne(client)
 	}
 }
 
-var (
-	lastAcquire      time.Time
-	lastAcquireMutex sync.RWMutex
-)
-
-// Locks a job in the database, and runs it!
-func (p *Server) acquireJob(ctx context.Context) {
+// acquireExit returns true if the acquire loop should exit
+func (p *Server) acquireExit() bool {
 	p.mutex.Lock()
 	defer p.mutex.Unlock()
-	if p.isClosed() {
-		return
-	}
-	if p.isRunningJob() {
-		return
-	}
-	if p.isShutdown() {
-		p.opts.Logger.Debug(context.Background(), "skipping acquire; provisionerd is shutting down")
-		return
-	}
-
-	// This prevents loads of provisioner daemons from consistently sending
-	// requests when no jobs are available.
-	//
-	// The debounce only occurs when no job is returned, so if loads of jobs are
-	// added at once, they will start after at most this duration.
-	lastAcquireMutex.RLock()
-	if !lastAcquire.IsZero() && time.Since(lastAcquire) < p.opts.JobPollDebounce {
-		lastAcquireMutex.RUnlock()
-		return
+	if p.closingB {
+		p.opts.Logger.Debug(p.closeContext, "exiting acquire; provisionerd is closing")
+		return true
 	}
-	lastAcquireMutex.RUnlock()
-
-	var err error
-	client, ok := p.client()
-	if !ok {
-		return
+	if p.shuttingDownB {
+		p.opts.Logger.Debug(p.closeContext, "exiting acquire; provisionerd is shutting down")
+		return true
 	}
+	return false
+}
 
-	job, err := client.AcquireJob(ctx, &proto.Empty{})
+func (p *Server) acquireAndRunOne(client proto.DRPCProvisionerDaemonClient) {
+	ctx := p.closeContext
+	p.opts.Logger.Debug(ctx, "start of acquireAndRunOne")
+	job, err := p.acquireGraceful(client)
+	p.opts.Logger.Debug(ctx, "graceful acquire done", slog.F("job_id", job.GetJobId()), slog.Error(err))
 	if err != nil {
 		if errors.Is(err, context.Canceled) ||
 			errors.Is(err, yamux.ErrSessionShutdown) ||
@@ -337,9 +282,7 @@ func (p *Server) acquireJob(ctx context.Context) {
 		return
 	}
 	if job.JobId == "" {
-		lastAcquireMutex.Lock()
-		lastAcquire = time.Now()
-		lastAcquireMutex.Unlock()
+		p.opts.Logger.Debug(ctx, "acquire job successfully canceled")
 		return
 	}
 
@@ -386,11 +329,13 @@ func (p *Server) acquireJob(ctx context.Context) {
 
 	p.opts.Logger.Debug(ctx, "acquired job", fields...)
 
-	provisioner, ok := p.opts.Provisioners[job.Provisioner]
-	if !ok {
+	respCh := make(chan ConnectResponse)
+	p.opts.Connector.Connect(ctx, job, respCh)
+	resp := <-respCh
+	if resp.Error != nil {
 		err := p.FailJob(ctx, &proto.FailedJob{
 			JobId: job.JobId,
-			Error: fmt.Sprintf("no provisioner %s", job.Provisioner),
+			Error: fmt.Sprintf("failed to connect to provisioner: %s", resp.Error),
 		})
 		if err != nil {
 			p.opts.Logger.Error(ctx, "provisioner job failed", slog.F("job_id", job.JobId), slog.Error(err))
@@ -398,16 +343,15 @@ func (p *Server) acquireJob(ctx context.Context) {
 		return
 	}
 
+	p.mutex.Lock()
 	p.activeJob = runner.New(
 		ctx,
 		job,
 		runner.Options{
 			Updater:             p,
 			QuotaCommitter:      p,
-			Logger:              p.opts.Logger,
-			Filesystem:          p.opts.Filesystem,
-			WorkDirectory:       p.opts.WorkDirectory,
-			Provisioner:         provisioner,
+			Logger:              p.opts.Logger.Named("runner"),
+			Provisioner:         resp.Client,
 			UpdateInterval:      p.opts.UpdateInterval,
 			ForceCancelInterval: p.opts.ForceCancelInterval,
 			LogDebounceInterval: p.opts.LogBufferInterval,
@@ -415,8 +359,39 @@ func (p *Server) acquireJob(ctx context.Context) {
 			Metrics:             p.opts.Metrics.Runner,
 		},
 	)
+	p.mutex.Unlock()
+	p.activeJob.Run()
+	p.mutex.Lock()
+	p.activeJob = nil
+	p.mutex.Unlock()
+}
 
-	go p.activeJob.Run()
+// acquireGraceful attempts to acquire a job from the server, handling canceling the acquisition if we gracefully shut
+// down.
+func (p *Server) acquireGraceful(client proto.DRPCProvisionerDaemonClient) (*proto.AcquiredJob, error) {
+	stream, err := client.AcquireJobWithCancel(p.closeContext)
+	if err != nil {
+		return nil, err
+	}
+	acquireDone := make(chan struct{})
+	go func() {
+		select {
+		case <-p.closeContext.Done():
+			return
+		case <-p.shuttingDownCh:
+			p.opts.Logger.Debug(p.closeContext, "sending acquire job cancel")
+			err := stream.Send(&proto.CancelAcquire{})
+			if err != nil {
+				p.opts.Logger.Warn(p.closeContext, "failed to gracefully cancel acquire job")
+			}
+			return
+		case <-acquireDone:
+			return
+		}
+	}()
+	job, err := stream.Recv()
+	close(acquireDone)
+	return job, err
 }
 
 func retryable(err error) bool {
@@ -491,36 +466,23 @@ func (p *Server) isClosed() bool {
 	}
 }
 
-// isShutdown returns whether the API is shutdown or not.
-func (p *Server) isShutdown() bool {
-	select {
-	case <-p.shutdown:
-		return true
-	default:
-		return false
-	}
-}
-
 // Shutdown triggers a graceful exit of each registered provisioner.
-// It exits when an active job stops.
 func (p *Server) Shutdown(ctx context.Context) error {
 	p.mutex.Lock()
-	defer p.mutex.Unlock()
-	if !p.isRunningJob() {
-		return nil
-	}
 	p.opts.Logger.Info(ctx, "attempting graceful shutdown")
-	close(p.shutdown)
-	if p.activeJob == nil {
-		return nil
+	if !p.shuttingDownB {
+		close(p.shuttingDownCh)
+		p.shuttingDownB = true
 	}
-	// wait for active job
-	p.activeJob.Cancel()
+	if p.activeJob != nil {
+		p.activeJob.Cancel()
+	}
+	p.mutex.Unlock()
 	select {
 	case <-ctx.Done():
 		p.opts.Logger.Warn(ctx, "graceful shutdown failed", slog.Error(ctx.Err()))
 		return ctx.Err()
-	case <-p.activeJob.Done():
+	case <-p.acquireDoneCh:
 		p.opts.Logger.Info(ctx, "gracefully shutdown")
 		return nil
 	}
@@ -528,41 +490,51 @@ func (p *Server) Shutdown(ctx context.Context) error {
 
 // Close ends the provisioner. It will mark any running jobs as failed.
 func (p *Server) Close() error {
+	p.opts.Logger.Info(p.closeContext, "closing provisionerd")
 	return p.closeWithError(nil)
 }
 
 // closeWithError closes the provisioner; subsequent reads/writes will return the error err.
 func (p *Server) closeWithError(err error) error {
 	p.mutex.Lock()
-	defer p.mutex.Unlock()
-	if p.isClosed() {
-		return p.closeError
-	}
-	p.closeError = err
-
-	errMsg := "provisioner daemon was shutdown gracefully"
-	if err != nil {
-		errMsg = err.Error()
-	}
-	if p.activeJob != nil {
+	var activeJob *runner.Runner
+	first := false
+	if !p.closingB {
+		first = true
+		p.closingB = true
+		// only the first caller to close should attempt to fail the active job
+		activeJob = p.activeJob
+	}
+	// don't hold the mutex while doing I/O.
+	p.mutex.Unlock()
+	if activeJob != nil {
+		errMsg := "provisioner daemon was shutdown gracefully"
+		if err != nil {
+			errMsg = err.Error()
+		}
+		p.opts.Logger.Debug(p.closeContext, "failing active job because of close")
 		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
 		defer cancel()
-		failErr := p.activeJob.Fail(ctx, &proto.FailedJob{Error: errMsg})
+		failErr := activeJob.Fail(ctx, &proto.FailedJob{Error: errMsg})
 		if failErr != nil {
-			p.activeJob.ForceStop()
+			activeJob.ForceStop()
 		}
 		if err == nil {
 			err = failErr
 		}
 	}
 
-	p.closeCancel()
-
-	p.opts.Logger.Debug(context.Background(), "closing server with error", slog.Error(err))
-
-	if c, ok := p.client(); ok {
-		_ = c.DRPCConn().Close()
+	if first {
+		p.closeCancel()
+		p.opts.Logger.Debug(context.Background(), "waiting for goroutines to exit")
+		p.wg.Wait()
+		p.opts.Logger.Debug(context.Background(), "closing server with error", slog.Error(err))
+		p.closeError = err
+		close(p.closedCh)
+		return err
 	}
-
-	return err
+	p.opts.Logger.Debug(p.closeContext, "waiting for first closer to complete")
+	<-p.closedCh
+	p.opts.Logger.Debug(p.closeContext, "first closer completed")
+	return p.closeError
 }
diff --git a/provisionerd/provisionerd_test.go b/provisionerd/provisionerd_test.go
index 32e70fb8e1483..c39edd491a3b2 100644
--- a/provisionerd/provisionerd_test.go
+++ b/provisionerd/provisionerd_test.go
@@ -23,12 +23,11 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/provisionerd"
-	"github.com/coder/coder/provisionerd/proto"
-	"github.com/coder/coder/provisionerd/runner"
-	"github.com/coder/coder/provisionersdk"
-	sdkproto "github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/provisionerd"
+	"github.com/coder/coder/v2/provisionerd/proto"
+	"github.com/coder/coder/v2/provisionersdk"
+	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
@@ -61,7 +60,7 @@ func TestProvisionerd(t *testing.T) {
 		})
 		closer := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{}), nil
-		}, provisionerd.Provisioners{})
+		}, provisionerd.LocalProvisioners{})
 		require.NoError(t, closer.Close())
 	})
 
@@ -75,34 +74,7 @@ func TestProvisionerd(t *testing.T) {
 		closer := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			defer close(completeChan)
 			return nil, xerrors.New("an error")
-		}, provisionerd.Provisioners{})
-		require.Condition(t, closedWithin(completeChan, testutil.WaitShort))
-		require.NoError(t, closer.Close())
-	})
-
-	t.Run("AcquireEmptyJob", func(t *testing.T) {
-		// The provisioner daemon is supposed to skip the job acquire if
-		// the job provided is empty. This is to show it successfully
-		// tried to get a job, but none were available.
-		t.Parallel()
-		done := make(chan struct{})
-		t.Cleanup(func() {
-			close(done)
-		})
-		completeChan := make(chan struct{})
-		closer := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
-			acquireJobAttempt := 0
-			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
-					if acquireJobAttempt == 1 {
-						close(completeChan)
-					}
-					acquireJobAttempt++
-					return &proto.AcquiredJob{}, nil
-				},
-				updateJob: noopUpdateJob,
-			}), nil
-		}, provisionerd.Provisioners{})
+		}, provisionerd.LocalProvisioners{})
 		require.Condition(t, closedWithin(completeChan, testutil.WaitShort))
 		require.NoError(t, closer.Close())
 	})
@@ -120,8 +92,8 @@ func TestProvisionerd(t *testing.T) {
 		closerMutex.Lock()
 		closer = createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
-					return &proto.AcquiredJob{
+				acquireJobWithCancel: func(stream proto.DRPCProvisionerDaemon_AcquireJobWithCancelStream) error {
+					err := stream.Send(&proto.AcquiredJob{
 						JobId:       "test",
 						Provisioner: "someprovisioner",
 						TemplateSourceArchive: createTar(t, map[string]string{
@@ -129,10 +101,12 @@ func TestProvisionerd(t *testing.T) {
 						}),
 						Type: &proto.AcquiredJob_TemplateImport_{
 							TemplateImport: &proto.AcquiredJob_TemplateImport{
-								Metadata: &sdkproto.Provision_Metadata{},
+								Metadata: &sdkproto.Metadata{},
 							},
 						},
-					}, nil
+					})
+					assert.NoError(t, err)
+					return nil
 				},
 				updateJob: noopUpdateJob,
 				failJob: func(ctx context.Context, job *proto.FailedJob) (*proto.Empty, error) {
@@ -142,12 +116,17 @@ func TestProvisionerd(t *testing.T) {
 					return &proto.Empty{}, nil
 				},
 			}), nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{
-				parse: func(request *sdkproto.Parse_Request, stream sdkproto.DRPCProvisioner_ParseStream) error {
+				parse: func(_ *provisionersdk.Session, _ *sdkproto.ParseRequest, _ <-chan struct{}) *sdkproto.ParseComplete {
 					closerMutex.Lock()
 					defer closerMutex.Unlock()
-					return closer.Close()
+					err := closer.Close()
+					c := &sdkproto.ParseComplete{}
+					if err != nil {
+						c.Error = err.Error()
+					}
+					return c
 				},
 			}),
 		})
@@ -167,31 +146,30 @@ func TestProvisionerd(t *testing.T) {
 		var (
 			completeChan = make(chan struct{})
 			completeOnce sync.Once
+			acq          = newAcquireOne(t, &proto.AcquiredJob{
+				JobId:       "test",
+				Provisioner: "someprovisioner",
+				TemplateSourceArchive: createTar(t, map[string]string{
+					"../../../etc/passwd": "content",
+				}),
+				Type: &proto.AcquiredJob_TemplateImport_{
+					TemplateImport: &proto.AcquiredJob_TemplateImport{
+						Metadata: &sdkproto.Metadata{},
+					},
+				},
+			})
 		)
 
 		closer := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
-					return &proto.AcquiredJob{
-						JobId:       "test",
-						Provisioner: "someprovisioner",
-						TemplateSourceArchive: createTar(t, map[string]string{
-							"../../../etc/passwd": "content",
-						}),
-						Type: &proto.AcquiredJob_TemplateImport_{
-							TemplateImport: &proto.AcquiredJob_TemplateImport{
-								Metadata: &sdkproto.Provision_Metadata{},
-							},
-						},
-					}, nil
-				},
-				updateJob: noopUpdateJob,
+				acquireJobWithCancel: acq.acquireWithCancel,
+				updateJob:            noopUpdateJob,
 				failJob: func(ctx context.Context, job *proto.FailedJob) (*proto.Empty, error) {
 					completeOnce.Do(func() { close(completeChan) })
 					return &proto.Empty{}, nil
 				},
 			}), nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{}),
 		})
 		require.Condition(t, closedWithin(completeChan, testutil.WaitShort))
@@ -211,8 +189,8 @@ func TestProvisionerd(t *testing.T) {
 
 		closer := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
-					return &proto.AcquiredJob{
+				acquireJobWithCancel: func(stream proto.DRPCProvisionerDaemon_AcquireJobWithCancelStream) error {
+					err := stream.Send(&proto.AcquiredJob{
 						JobId:       "test",
 						Provisioner: "someprovisioner",
 						TemplateSourceArchive: createTar(t, map[string]string{
@@ -220,10 +198,12 @@ func TestProvisionerd(t *testing.T) {
 						}),
 						Type: &proto.AcquiredJob_TemplateImport_{
 							TemplateImport: &proto.AcquiredJob_TemplateImport{
-								Metadata: &sdkproto.Provision_Metadata{},
+								Metadata: &sdkproto.Metadata{},
 							},
 						},
-					}, nil
+					})
+					assert.NoError(t, err)
+					return nil
 				},
 				updateJob: func(ctx context.Context, update *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error) {
 					completeOnce.Do(func() { close(completeChan) })
@@ -233,11 +213,15 @@ func TestProvisionerd(t *testing.T) {
 					return &proto.Empty{}, nil
 				},
 			}), nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{
-				parse: func(request *sdkproto.Parse_Request, stream sdkproto.DRPCProvisioner_ParseStream) error {
-					<-stream.Context().Done()
-					return nil
+				parse: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.ParseRequest,
+					cancelOrComplete <-chan struct{},
+				) *sdkproto.ParseComplete {
+					<-cancelOrComplete
+					return &sdkproto.ParseComplete{}
 				},
 			}),
 		})
@@ -252,37 +236,27 @@ func TestProvisionerd(t *testing.T) {
 			close(done)
 		})
 		var (
-			didComplete   atomic.Bool
-			didLog        atomic.Bool
-			didAcquireJob atomic.Bool
-			didDryRun     = atomic.NewBool(true)
-			didReadme     atomic.Bool
-			completeChan  = make(chan struct{})
-			completeOnce  sync.Once
+			didComplete atomic.Bool
+			didLog      atomic.Bool
+			didReadme   atomic.Bool
+			acq         = newAcquireOne(t, &proto.AcquiredJob{
+				JobId:       "test",
+				Provisioner: "someprovisioner",
+				TemplateSourceArchive: createTar(t, map[string]string{
+					"test.txt":                "content",
+					provisionersdk.ReadmeFile: "# A cool template 😎\n",
+				}),
+				Type: &proto.AcquiredJob_TemplateImport_{
+					TemplateImport: &proto.AcquiredJob_TemplateImport{
+						Metadata: &sdkproto.Metadata{},
+					},
+				},
+			})
 		)
 
 		closer := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
-					if !didAcquireJob.CAS(false, true) {
-						completeOnce.Do(func() { close(completeChan) })
-						return &proto.AcquiredJob{}, nil
-					}
-
-					return &proto.AcquiredJob{
-						JobId:       "test",
-						Provisioner: "someprovisioner",
-						TemplateSourceArchive: createTar(t, map[string]string{
-							"test.txt":        "content",
-							runner.ReadmeFile: "# A cool template 😎\n",
-						}),
-						Type: &proto.AcquiredJob_TemplateImport_{
-							TemplateImport: &proto.AcquiredJob_TemplateImport{
-								Metadata: &sdkproto.Provision_Metadata{},
-							},
-						},
-					}, nil
-				},
+				acquireJobWithCancel: acq.acquireWithCancel,
 				updateJob: func(ctx context.Context, update *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error) {
 					if len(update.Logs) > 0 {
 						didLog.Store(true)
@@ -297,65 +271,44 @@ func TestProvisionerd(t *testing.T) {
 					return &proto.Empty{}, nil
 				},
 			}), nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{
-				parse: func(request *sdkproto.Parse_Request, stream sdkproto.DRPCProvisioner_ParseStream) error {
-					data, err := os.ReadFile(filepath.Join(request.Directory, "test.txt"))
+				parse: func(
+					s *provisionersdk.Session,
+					_ *sdkproto.ParseRequest,
+					cancelOrComplete <-chan struct{},
+				) *sdkproto.ParseComplete {
+					data, err := os.ReadFile(filepath.Join(s.WorkDirectory, "test.txt"))
 					require.NoError(t, err)
 					require.Equal(t, "content", string(data))
-
-					err = stream.Send(&sdkproto.Parse_Response{
-						Type: &sdkproto.Parse_Response_Log{
-							Log: &sdkproto.Log{
-								Level:  sdkproto.LogLevel_INFO,
-								Output: "hello",
-							},
-						},
-					})
-					require.NoError(t, err)
-
-					err = stream.Send(&sdkproto.Parse_Response{
-						Type: &sdkproto.Parse_Response_Complete{
-							Complete: &sdkproto.Parse_Complete{},
-						},
-					})
-					require.NoError(t, err)
-					return nil
+					s.ProvisionLog(sdkproto.LogLevel_INFO, "hello")
+					return &sdkproto.ParseComplete{}
 				},
-				provision: func(stream sdkproto.DRPCProvisioner_ProvisionStream) error {
-					request, err := stream.Recv()
-					require.NoError(t, err)
-					if request.GetApply() != nil {
-						didDryRun.Store(false)
+				plan: func(
+					s *provisionersdk.Session,
+					_ *sdkproto.PlanRequest,
+					cancelOrComplete <-chan struct{},
+				) *sdkproto.PlanComplete {
+					s.ProvisionLog(sdkproto.LogLevel_INFO, "hello")
+					return &sdkproto.PlanComplete{
+						Resources: []*sdkproto.Resource{},
 					}
-					err = stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Log{
-							Log: &sdkproto.Log{
-								Level:  sdkproto.LogLevel_INFO,
-								Output: "hello",
-							},
-						},
-					})
-					require.NoError(t, err)
-
-					err = stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Complete{
-							Complete: &sdkproto.Provision_Complete{
-								Resources: []*sdkproto.Resource{},
-							},
-						},
-					})
-					require.NoError(t, err)
-					return nil
+				},
+				apply: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.ApplyRequest,
+					_ <-chan struct{},
+				) *sdkproto.ApplyComplete {
+					t.Error("dry run should not apply")
+					return &sdkproto.ApplyComplete{}
 				},
 			}),
 		})
 
-		require.Condition(t, closedWithin(completeChan, testutil.WaitShort))
+		require.Condition(t, closedWithin(acq.complete, testutil.WaitShort))
 		require.NoError(t, closer.Close())
 		assert.True(t, didLog.Load(), "should log some updates")
 		assert.True(t, didComplete.Load(), "should complete the job")
-		assert.True(t, didDryRun.Load(), "should be a dry run")
 	})
 
 	t.Run("TemplateDryRun", func(t *testing.T) {
@@ -365,36 +318,26 @@ func TestProvisionerd(t *testing.T) {
 			close(done)
 		})
 		var (
-			didComplete   atomic.Bool
-			didLog        atomic.Bool
-			didAcquireJob atomic.Bool
-			completeChan  = make(chan struct{})
-			completeOnce  sync.Once
-
-			metadata = &sdkproto.Provision_Metadata{}
+			didComplete atomic.Bool
+			didLog      atomic.Bool
+			metadata    = &sdkproto.Metadata{}
+			acq         = newAcquireOne(t, &proto.AcquiredJob{
+				JobId:       "test",
+				Provisioner: "someprovisioner",
+				TemplateSourceArchive: createTar(t, map[string]string{
+					"test.txt": "content",
+				}),
+				Type: &proto.AcquiredJob_TemplateDryRun_{
+					TemplateDryRun: &proto.AcquiredJob_TemplateDryRun{
+						Metadata: metadata,
+					},
+				},
+			})
 		)
 
 		closer := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
-					if !didAcquireJob.CAS(false, true) {
-						completeOnce.Do(func() { close(completeChan) })
-						return &proto.AcquiredJob{}, nil
-					}
-
-					return &proto.AcquiredJob{
-						JobId:       "test",
-						Provisioner: "someprovisioner",
-						TemplateSourceArchive: createTar(t, map[string]string{
-							"test.txt": "content",
-						}),
-						Type: &proto.AcquiredJob_TemplateDryRun_{
-							TemplateDryRun: &proto.AcquiredJob_TemplateDryRun{
-								Metadata: metadata,
-							},
-						},
-					}, nil
-				},
+				acquireJobWithCancel: acq.acquireWithCancel,
 				updateJob: func(ctx context.Context, update *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error) {
 					if len(update.Logs) == 0 {
 						t.Log("provisionerDaemonTestServer: no log messages")
@@ -412,23 +355,29 @@ func TestProvisionerd(t *testing.T) {
 					return &proto.Empty{}, nil
 				},
 			}), nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{
-				provision: func(stream sdkproto.DRPCProvisioner_ProvisionStream) error {
-					err := stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Complete{
-							Complete: &sdkproto.Provision_Complete{
-								Resources: []*sdkproto.Resource{},
-							},
-						},
-					})
-					require.NoError(t, err)
-					return nil
+				plan: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.PlanRequest,
+					_ <-chan struct{},
+				) *sdkproto.PlanComplete {
+					return &sdkproto.PlanComplete{
+						Resources: []*sdkproto.Resource{},
+					}
+				},
+				apply: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.ApplyRequest,
+					_ <-chan struct{},
+				) *sdkproto.ApplyComplete {
+					t.Error("dry run should not apply")
+					return &sdkproto.ApplyComplete{}
 				},
 			}),
 		})
 
-		require.Condition(t, closedWithin(completeChan, testutil.WaitShort))
+		require.Condition(t, closedWithin(acq.complete, testutil.WaitShort))
 		require.NoError(t, closer.Close())
 		assert.True(t, didLog.Load(), "should log some updates")
 		assert.True(t, didComplete.Load(), "should complete the job")
@@ -441,34 +390,25 @@ func TestProvisionerd(t *testing.T) {
 			close(done)
 		})
 		var (
-			didComplete   atomic.Bool
-			didLog        atomic.Bool
-			didAcquireJob atomic.Bool
-			completeChan  = make(chan struct{})
-			completeOnce  sync.Once
+			didComplete atomic.Bool
+			didLog      atomic.Bool
+			acq         = newAcquireOne(t, &proto.AcquiredJob{
+				JobId:       "test",
+				Provisioner: "someprovisioner",
+				TemplateSourceArchive: createTar(t, map[string]string{
+					"test.txt": "content",
+				}),
+				Type: &proto.AcquiredJob_WorkspaceBuild_{
+					WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
+						Metadata: &sdkproto.Metadata{},
+					},
+				},
+			})
 		)
 
 		closer := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
-					if !didAcquireJob.CAS(false, true) {
-						completeOnce.Do(func() { close(completeChan) })
-						return &proto.AcquiredJob{}, nil
-					}
-
-					return &proto.AcquiredJob{
-						JobId:       "test",
-						Provisioner: "someprovisioner",
-						TemplateSourceArchive: createTar(t, map[string]string{
-							"test.txt": "content",
-						}),
-						Type: &proto.AcquiredJob_WorkspaceBuild_{
-							WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
-								Metadata: &sdkproto.Provision_Metadata{},
-							},
-						},
-					}, nil
-				},
+				acquireJobWithCancel: acq.acquireWithCancel,
 				updateJob: func(ctx context.Context, update *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error) {
 					if len(update.Logs) != 0 {
 						didLog.Store(true)
@@ -480,30 +420,26 @@ func TestProvisionerd(t *testing.T) {
 					return &proto.Empty{}, nil
 				},
 			}), nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{
-				provision: func(stream sdkproto.DRPCProvisioner_ProvisionStream) error {
-					err := stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Log{
-							Log: &sdkproto.Log{
-								Level:  sdkproto.LogLevel_DEBUG,
-								Output: "wow",
-							},
-						},
-					})
-					require.NoError(t, err)
-
-					err = stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Complete{
-							Complete: &sdkproto.Provision_Complete{},
-						},
-					})
-					require.NoError(t, err)
-					return nil
+				plan: func(
+					s *provisionersdk.Session,
+					_ *sdkproto.PlanRequest,
+					cancelOrComplete <-chan struct{},
+				) *sdkproto.PlanComplete {
+					s.ProvisionLog(sdkproto.LogLevel_DEBUG, "wow")
+					return &sdkproto.PlanComplete{}
+				},
+				apply: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.ApplyRequest,
+					_ <-chan struct{},
+				) *sdkproto.ApplyComplete {
+					return &sdkproto.ApplyComplete{}
 				},
 			}),
 		})
-		require.Condition(t, closedWithin(completeChan, testutil.WaitShort))
+		require.Condition(t, closedWithin(acq.complete, testutil.WaitShort))
 		require.NoError(t, closer.Close())
 		assert.True(t, didLog.Load(), "should log some updates")
 		assert.True(t, didComplete.Load(), "should complete the job")
@@ -516,35 +452,26 @@ func TestProvisionerd(t *testing.T) {
 			close(done)
 		})
 		var (
-			didComplete   atomic.Bool
-			didLog        atomic.Bool
-			didAcquireJob atomic.Bool
-			didFail       atomic.Bool
-			completeChan  = make(chan struct{})
-			completeOnce  sync.Once
+			didComplete atomic.Bool
+			didLog      atomic.Bool
+			didFail     atomic.Bool
+			acq         = newAcquireOne(t, &proto.AcquiredJob{
+				JobId:       "test",
+				Provisioner: "someprovisioner",
+				TemplateSourceArchive: createTar(t, map[string]string{
+					"test.txt": "content",
+				}),
+				Type: &proto.AcquiredJob_WorkspaceBuild_{
+					WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
+						Metadata: &sdkproto.Metadata{},
+					},
+				},
+			})
 		)
 
 		closer := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
-					if !didAcquireJob.CAS(false, true) {
-						completeOnce.Do(func() { close(completeChan) })
-						return &proto.AcquiredJob{}, nil
-					}
-
-					return &proto.AcquiredJob{
-						JobId:       "test",
-						Provisioner: "someprovisioner",
-						TemplateSourceArchive: createTar(t, map[string]string{
-							"test.txt": "content",
-						}),
-						Type: &proto.AcquiredJob_WorkspaceBuild_{
-							WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
-								Metadata: &sdkproto.Provision_Metadata{},
-							},
-						},
-					}, nil
-				},
+				acquireJobWithCancel: acq.acquireWithCancel,
 				updateJob: func(ctx context.Context, update *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error) {
 					if len(update.Logs) != 0 {
 						didLog.Store(true)
@@ -565,42 +492,48 @@ func TestProvisionerd(t *testing.T) {
 					return &proto.Empty{}, nil
 				},
 			}), nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{
-				provision: func(stream sdkproto.DRPCProvisioner_ProvisionStream) error {
-					err := stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Log{
-							Log: &sdkproto.Log{
-								Level:  sdkproto.LogLevel_DEBUG,
-								Output: "wow",
+				plan: func(
+					s *provisionersdk.Session,
+					_ *sdkproto.PlanRequest,
+					cancelOrComplete <-chan struct{},
+				) *sdkproto.PlanComplete {
+					s.ProvisionLog(sdkproto.LogLevel_DEBUG, "wow")
+					return &sdkproto.PlanComplete{
+						Resources: []*sdkproto.Resource{
+							{
+								DailyCost: 10,
+							},
+							{
+								DailyCost: 15,
 							},
 						},
-					})
-					require.NoError(t, err)
-
-					err = stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Complete{
-							Complete: &sdkproto.Provision_Complete{
-								Resources: []*sdkproto.Resource{
-									{
-										DailyCost: 10,
-									},
-									{
-										DailyCost: 15,
-									},
-								},
+					}
+				},
+				apply: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.ApplyRequest,
+					_ <-chan struct{},
+				) *sdkproto.ApplyComplete {
+					t.Error("should not apply when resources exceed quota")
+					return &sdkproto.ApplyComplete{
+						Resources: []*sdkproto.Resource{
+							{
+								DailyCost: 10,
+							},
+							{
+								DailyCost: 15,
 							},
 						},
-					})
-					require.NoError(t, err)
-					return nil
+					}
 				},
 			}),
 		})
-		require.Condition(t, closedWithin(completeChan, testutil.WaitShort))
+		require.Condition(t, closedWithin(acq.complete, testutil.WaitShort))
 		require.NoError(t, closer.Close())
 		assert.True(t, didLog.Load(), "should log some updates")
-		assert.False(t, didComplete.Load(), "should complete the job")
+		assert.False(t, didComplete.Load(), "should not complete the job")
 		assert.True(t, didFail.Load(), "should fail the job")
 	})
 
@@ -611,53 +544,54 @@ func TestProvisionerd(t *testing.T) {
 			close(done)
 		})
 		var (
-			didFail       atomic.Bool
-			didAcquireJob atomic.Bool
-			completeChan  = make(chan struct{})
-			completeOnce  sync.Once
+			didFail atomic.Bool
+			acq     = newAcquireOne(t, &proto.AcquiredJob{
+				JobId:       "test",
+				Provisioner: "someprovisioner",
+				TemplateSourceArchive: createTar(t, map[string]string{
+					"test.txt": "content",
+				}),
+				Type: &proto.AcquiredJob_WorkspaceBuild_{
+					WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
+						Metadata: &sdkproto.Metadata{},
+					},
+				},
+			})
 		)
 
 		closer := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
-					if !didAcquireJob.CAS(false, true) {
-						completeOnce.Do(func() { close(completeChan) })
-						return &proto.AcquiredJob{}, nil
-					}
-
-					return &proto.AcquiredJob{
-						JobId:       "test",
-						Provisioner: "someprovisioner",
-						TemplateSourceArchive: createTar(t, map[string]string{
-							"test.txt": "content",
-						}),
-						Type: &proto.AcquiredJob_WorkspaceBuild_{
-							WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
-								Metadata: &sdkproto.Provision_Metadata{},
-							},
-						},
-					}, nil
-				},
-				updateJob: noopUpdateJob,
+				acquireJobWithCancel: acq.acquireWithCancel,
+				updateJob:            noopUpdateJob,
 				failJob: func(ctx context.Context, job *proto.FailedJob) (*proto.Empty, error) {
 					didFail.Store(true)
 					return &proto.Empty{}, nil
 				},
 			}), nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{
-				provision: func(stream sdkproto.DRPCProvisioner_ProvisionStream) error {
-					return stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Complete{
-							Complete: &sdkproto.Provision_Complete{
-								Error: "some error",
-							},
-						},
-					})
+				plan: func(
+					s *provisionersdk.Session,
+					_ *sdkproto.PlanRequest,
+					cancelOrComplete <-chan struct{},
+				) *sdkproto.PlanComplete {
+					return &sdkproto.PlanComplete{
+						Error: "some error",
+					}
+				},
+				apply: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.ApplyRequest,
+					_ <-chan struct{},
+				) *sdkproto.ApplyComplete {
+					t.Error("should not apply when plan errors")
+					return &sdkproto.ApplyComplete{
+						Error: "some error",
+					}
 				},
 			}),
 		})
-		require.Condition(t, closedWithin(completeChan, testutil.WaitShort))
+		require.Condition(t, closedWithin(acq.complete, testutil.WaitShort))
 		require.NoError(t, closer.Close())
 		assert.True(t, didFail.Load(), "should fail the job")
 	})
@@ -674,8 +608,8 @@ func TestProvisionerd(t *testing.T) {
 		completeChan := make(chan struct{})
 		server := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
-					return &proto.AcquiredJob{
+				acquireJobWithCancel: func(stream proto.DRPCProvisionerDaemon_AcquireJobWithCancelStream) error {
+					err := stream.Send(&proto.AcquiredJob{
 						JobId:       "test",
 						Provisioner: "someprovisioner",
 						TemplateSourceArchive: createTar(t, map[string]string{
@@ -683,10 +617,12 @@ func TestProvisionerd(t *testing.T) {
 						}),
 						Type: &proto.AcquiredJob_WorkspaceBuild_{
 							WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
-								Metadata: &sdkproto.Provision_Metadata{},
+								Metadata: &sdkproto.Metadata{},
 							},
 						},
-					}, nil
+					})
+					assert.NoError(t, err)
+					return nil
 				},
 				updateJob: func(ctx context.Context, update *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error) {
 					if len(update.Logs) > 0 {
@@ -710,33 +646,26 @@ func TestProvisionerd(t *testing.T) {
 					return &proto.Empty{}, nil
 				},
 			}), nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{
-				provision: func(stream sdkproto.DRPCProvisioner_ProvisionStream) error {
-					// Ignore the first provision message!
-					_, _ = stream.Recv()
-
-					err := stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Log{
-							Log: &sdkproto.Log{
-								Level:  sdkproto.LogLevel_DEBUG,
-								Output: "in progress",
-							},
-						},
-					})
-					require.NoError(t, err)
-
-					msg, err := stream.Recv()
-					require.NoError(t, err)
-					require.NotNil(t, msg.GetCancel())
-
-					return stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Complete{
-							Complete: &sdkproto.Provision_Complete{
-								Error: "some error",
-							},
-						},
-					})
+				plan: func(
+					s *provisionersdk.Session,
+					_ *sdkproto.PlanRequest,
+					canceledOrComplete <-chan struct{},
+				) *sdkproto.PlanComplete {
+					s.ProvisionLog(sdkproto.LogLevel_DEBUG, "in progress")
+					<-canceledOrComplete
+					return &sdkproto.PlanComplete{
+						Error: "some error",
+					}
+				},
+				apply: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.ApplyRequest,
+					_ <-chan struct{},
+				) *sdkproto.ApplyComplete {
+					t.Error("should not apply when shut down during plan")
+					return &sdkproto.ApplyComplete{}
 				},
 			}),
 		})
@@ -759,8 +688,8 @@ func TestProvisionerd(t *testing.T) {
 		completeChan := make(chan struct{})
 		server := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
-					return &proto.AcquiredJob{
+				acquireJobWithCancel: func(stream proto.DRPCProvisionerDaemon_AcquireJobWithCancelStream) error {
+					err := stream.Send(&proto.AcquiredJob{
 						JobId:       "test",
 						Provisioner: "someprovisioner",
 						TemplateSourceArchive: createTar(t, map[string]string{
@@ -768,10 +697,12 @@ func TestProvisionerd(t *testing.T) {
 						}),
 						Type: &proto.AcquiredJob_WorkspaceBuild_{
 							WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
-								Metadata: &sdkproto.Provision_Metadata{},
+								Metadata: &sdkproto.Metadata{},
 							},
 						},
-					}, nil
+					})
+					assert.NoError(t, err)
+					return nil
 				},
 				updateJob: func(ctx context.Context, update *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error) {
 					resp := &proto.UpdateJobResponse{}
@@ -803,38 +734,34 @@ func TestProvisionerd(t *testing.T) {
 					return &proto.Empty{}, nil
 				},
 			}), nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{
-				provision: func(stream sdkproto.DRPCProvisioner_ProvisionStream) error {
-					// Ignore the first provision message!
-					_, _ = stream.Recv()
-
-					err := stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Log{
-							Log: &sdkproto.Log{
-								Level:  sdkproto.LogLevel_DEBUG,
-								Output: "in progress",
-							},
-						},
-					})
-					require.NoError(t, err)
-
-					msg, err := stream.Recv()
-					require.NoError(t, err)
-					require.NotNil(t, msg.GetCancel())
-
-					return stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Complete{
-							Complete: &sdkproto.Provision_Complete{
-								Error: "some error",
-							},
-						},
-					})
+				plan: func(
+					s *provisionersdk.Session,
+					_ *sdkproto.PlanRequest,
+					canceledOrComplete <-chan struct{},
+				) *sdkproto.PlanComplete {
+					s.ProvisionLog(sdkproto.LogLevel_DEBUG, "in progress")
+					<-canceledOrComplete
+					return &sdkproto.PlanComplete{
+						Error: "some error",
+					}
+				},
+				apply: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.ApplyRequest,
+					_ <-chan struct{},
+				) *sdkproto.ApplyComplete {
+					t.Error("should not apply when shut down during plan")
+					return &sdkproto.ApplyComplete{}
 				},
 			}),
 		})
 		require.Condition(t, closedWithin(updateChan, testutil.WaitShort))
 		require.Condition(t, closedWithin(completeChan, testutil.WaitShort))
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+		require.NoError(t, server.Shutdown(ctx))
 		require.NoError(t, server.Close())
 	})
 
@@ -855,11 +782,8 @@ func TestProvisionerd(t *testing.T) {
 		)
 		server := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			client := createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
-					if second.Load() {
-						return &proto.AcquiredJob{}, nil
-					}
-					return &proto.AcquiredJob{
+				acquireJobWithCancel: func(stream proto.DRPCProvisionerDaemon_AcquireJobWithCancelStream) error {
+					job := &proto.AcquiredJob{
 						JobId:       "test",
 						Provisioner: "someprovisioner",
 						TemplateSourceArchive: createTar(t, map[string]string{
@@ -867,10 +791,18 @@ func TestProvisionerd(t *testing.T) {
 						}),
 						Type: &proto.AcquiredJob_WorkspaceBuild_{
 							WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
-								Metadata: &sdkproto.Provision_Metadata{},
+								Metadata: &sdkproto.Metadata{},
 							},
 						},
-					}, nil
+					}
+					if second.Load() {
+						job = &proto.AcquiredJob{}
+						_, err := stream.Recv()
+						assert.NoError(t, err)
+					}
+					err := stream.Send(job)
+					assert.NoError(t, err)
+					return nil
 				},
 				updateJob: func(ctx context.Context, update *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error) {
 					return &proto.UpdateJobResponse{}, nil
@@ -896,22 +828,31 @@ func TestProvisionerd(t *testing.T) {
 				}()
 			}
 			return client, nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{
-				provision: func(stream sdkproto.DRPCProvisioner_ProvisionStream) error {
-					// Ignore the first provision message!
-					_, _ = stream.Recv()
-					return stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Complete{
-							Complete: &sdkproto.Provision_Complete{
-								Error: "some error",
-							},
-						},
-					})
+				plan: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.PlanRequest,
+					_ <-chan struct{},
+				) *sdkproto.PlanComplete {
+					return &sdkproto.PlanComplete{
+						Error: "some error",
+					}
+				},
+				apply: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.ApplyRequest,
+					_ <-chan struct{},
+				) *sdkproto.ApplyComplete {
+					t.Error("should not apply when error during plan")
+					return &sdkproto.ApplyComplete{}
 				},
 			}),
 		})
 		require.Condition(t, closedWithin(completeChan, testutil.WaitShort))
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+		require.NoError(t, server.Shutdown(ctx))
 		require.NoError(t, server.Close())
 	})
 
@@ -932,12 +873,14 @@ func TestProvisionerd(t *testing.T) {
 		)
 		server := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			client := createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
+				acquireJobWithCancel: func(stream proto.DRPCProvisionerDaemon_AcquireJobWithCancelStream) error {
 					if second.Load() {
 						completeOnce.Do(func() { close(completeChan) })
-						return &proto.AcquiredJob{}, nil
+						_, err := stream.Recv()
+						assert.NoError(t, err)
+						return nil
 					}
-					return &proto.AcquiredJob{
+					job := &proto.AcquiredJob{
 						JobId:       "test",
 						Provisioner: "someprovisioner",
 						TemplateSourceArchive: createTar(t, map[string]string{
@@ -945,10 +888,13 @@ func TestProvisionerd(t *testing.T) {
 						}),
 						Type: &proto.AcquiredJob_WorkspaceBuild_{
 							WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
-								Metadata: &sdkproto.Provision_Metadata{},
+								Metadata: &sdkproto.Metadata{},
 							},
 						},
-					}, nil
+					}
+					err := stream.Send(job)
+					assert.NoError(t, err)
+					return nil
 				},
 				failJob: func(ctx context.Context, job *proto.FailedJob) (*proto.Empty, error) {
 					return nil, yamux.ErrSessionShutdown
@@ -975,20 +921,29 @@ func TestProvisionerd(t *testing.T) {
 				}()
 			}
 			return client, nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{
-				provision: func(stream sdkproto.DRPCProvisioner_ProvisionStream) error {
-					// Ignore the first provision message!
-					_, _ = stream.Recv()
-					return stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Complete{
-							Complete: &sdkproto.Provision_Complete{},
-						},
-					})
+				plan: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.PlanRequest,
+					_ <-chan struct{},
+				) *sdkproto.PlanComplete {
+					return &sdkproto.PlanComplete{}
+				},
+				apply: func(
+					_ *provisionersdk.Session,
+					_ *sdkproto.ApplyRequest,
+					_ <-chan struct{},
+				) *sdkproto.ApplyComplete {
+					return &sdkproto.ApplyComplete{}
 				},
 			}),
 		})
 		require.Condition(t, closedWithin(completeChan, testutil.WaitShort))
+		t.Log("completeChan closed")
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+		require.NoError(t, server.Shutdown(ctx))
 		require.NoError(t, server.Close())
 	})
 
@@ -1006,16 +961,20 @@ func TestProvisionerd(t *testing.T) {
 
 		server := createProvisionerd(t, func(ctx context.Context) (proto.DRPCProvisionerDaemonClient, error) {
 			return createProvisionerDaemonClient(t, done, provisionerDaemonTestServer{
-				acquireJob: func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error) {
+				acquireJobWithCancel: func(stream proto.DRPCProvisionerDaemon_AcquireJobWithCancelStream) error {
 					m.Lock()
 					defer m.Unlock()
 					logger.Info(ctx, "provisioner stage: AcquiredJob")
 					if len(ops) > 0 {
-						return &proto.AcquiredJob{}, nil
+						_, err := stream.Recv()
+						assert.NoError(t, err)
+						err = stream.Send(&proto.AcquiredJob{})
+						assert.NoError(t, err)
+						return nil
 					}
 					ops = append(ops, "AcquireJob")
 
-					return &proto.AcquiredJob{
+					err := stream.Send(&proto.AcquiredJob{
 						JobId:       "test",
 						Provisioner: "someprovisioner",
 						TemplateSourceArchive: createTar(t, map[string]string{
@@ -1023,10 +982,12 @@ func TestProvisionerd(t *testing.T) {
 						}),
 						Type: &proto.AcquiredJob_WorkspaceBuild_{
 							WorkspaceBuild: &proto.AcquiredJob_WorkspaceBuild{
-								Metadata: &sdkproto.Provision_Metadata{},
+								Metadata: &sdkproto.Metadata{},
 							},
 						},
-					}, nil
+					})
+					assert.NoError(t, err)
+					return nil
 				},
 				updateJob: func(ctx context.Context, update *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error) {
 					m.Lock()
@@ -1054,30 +1015,30 @@ func TestProvisionerd(t *testing.T) {
 					return &proto.Empty{}, nil
 				},
 			}), nil
-		}, provisionerd.Provisioners{
+		}, provisionerd.LocalProvisioners{
 			"someprovisioner": createProvisionerClient(t, done, provisionerTestServer{
-				provision: func(stream sdkproto.DRPCProvisioner_ProvisionStream) error {
-					err := stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Log{
-							Log: &sdkproto.Log{
-								Level:  sdkproto.LogLevel_DEBUG,
-								Output: "wow",
-							},
-						},
-					})
-					require.NoError(t, err)
-
-					err = stream.Send(&sdkproto.Provision_Response{
-						Type: &sdkproto.Provision_Response_Complete{
-							Complete: &sdkproto.Provision_Complete{},
-						},
-					})
-					require.NoError(t, err)
-					return nil
+				plan: func(
+					s *provisionersdk.Session,
+					_ *sdkproto.PlanRequest,
+					_ <-chan struct{},
+				) *sdkproto.PlanComplete {
+					s.ProvisionLog(sdkproto.LogLevel_DEBUG, "wow")
+					return &sdkproto.PlanComplete{}
+				},
+				apply: func(
+					s *provisionersdk.Session,
+					_ *sdkproto.ApplyRequest,
+					_ <-chan struct{},
+				) *sdkproto.ApplyComplete {
+					s.ProvisionLog(sdkproto.LogLevel_DEBUG, "wow")
+					return &sdkproto.ApplyComplete{}
 				},
 			}),
 		})
 		require.Condition(t, closedWithin(completeChan, testutil.WaitShort))
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+		require.NoError(t, server.Shutdown(ctx))
 		require.NoError(t, server.Close())
 		assert.Equal(t, ops[len(ops)-1], "CompleteJob")
 		assert.Contains(t, ops[0:len(ops)-1], "Log: Cleaning Up | ")
@@ -1105,15 +1066,16 @@ func createTar(t *testing.T, files map[string]string) []byte {
 }
 
 // Creates a provisionerd implementation with the provided dialer and provisioners.
-func createProvisionerd(t *testing.T, dialer provisionerd.Dialer, provisioners provisionerd.Provisioners) *provisionerd.Server {
+func createProvisionerd(t *testing.T, dialer provisionerd.Dialer, connector provisionerd.LocalProvisioners) *provisionerd.Server {
 	server := provisionerd.New(dialer, &provisionerd.Options{
-		Logger:          slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Named("provisionerd").Leveled(slog.LevelDebug),
-		JobPollInterval: 50 * time.Millisecond,
-		UpdateInterval:  50 * time.Millisecond,
-		Provisioners:    provisioners,
-		WorkDirectory:   t.TempDir(),
+		Logger:         slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Named("provisionerd").Leveled(slog.LevelDebug),
+		UpdateInterval: 50 * time.Millisecond,
+		Connector:      connector,
 	})
 	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+		_ = server.Shutdown(ctx)
 		_ = server.Close()
 	})
 	return server
@@ -1172,15 +1134,15 @@ func createProvisionerClient(t *testing.T, done <-chan struct{}, server provisio
 		_ = clientPipe.Close()
 		_ = serverPipe.Close()
 	})
-	mux := drpcmux.New()
-	err := sdkproto.DRPCRegisterProvisioner(mux, &server)
-	require.NoError(t, err)
-	srv := drpcserver.New(mux)
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	closed := make(chan struct{})
 	go func() {
 		defer close(closed)
-		_ = srv.Serve(ctx, serverPipe)
+		_ = provisionersdk.Serve(ctx, &server, &provisionersdk.ServeOptions{
+			Listener:      serverPipe,
+			Logger:        slogtest.Make(t, nil).Leveled(slog.LevelDebug).Named("test-provisioner"),
+			WorkDirectory: t.TempDir(),
+		})
 	}()
 	t.Cleanup(func() {
 		cancelFunc()
@@ -1200,30 +1162,45 @@ func createProvisionerClient(t *testing.T, done <-chan struct{}, server provisio
 }
 
 type provisionerTestServer struct {
-	parse     func(request *sdkproto.Parse_Request, stream sdkproto.DRPCProvisioner_ParseStream) error
-	provision func(stream sdkproto.DRPCProvisioner_ProvisionStream) error
+	parse func(s *provisionersdk.Session, r *sdkproto.ParseRequest, canceledOrComplete <-chan struct{}) *sdkproto.ParseComplete
+	plan  func(s *provisionersdk.Session, r *sdkproto.PlanRequest, canceledOrComplete <-chan struct{}) *sdkproto.PlanComplete
+	apply func(s *provisionersdk.Session, r *sdkproto.ApplyRequest, canceledOrComplete <-chan struct{}) *sdkproto.ApplyComplete
+}
+
+func (p *provisionerTestServer) Parse(s *provisionersdk.Session, r *sdkproto.ParseRequest, canceledOrComplete <-chan struct{}) *sdkproto.ParseComplete {
+	return p.parse(s, r, canceledOrComplete)
 }
 
-func (p *provisionerTestServer) Parse(request *sdkproto.Parse_Request, stream sdkproto.DRPCProvisioner_ParseStream) error {
-	return p.parse(request, stream)
+func (p *provisionerTestServer) Plan(s *provisionersdk.Session, r *sdkproto.PlanRequest, canceledOrComplete <-chan struct{}) *sdkproto.PlanComplete {
+	return p.plan(s, r, canceledOrComplete)
 }
 
-func (p *provisionerTestServer) Provision(stream sdkproto.DRPCProvisioner_ProvisionStream) error {
-	return p.provision(stream)
+func (p *provisionerTestServer) Apply(s *provisionersdk.Session, r *sdkproto.ApplyRequest, canceledOrComplete <-chan struct{}) *sdkproto.ApplyComplete {
+	return p.apply(s, r, canceledOrComplete)
 }
 
 // Fulfills the protobuf interface for a ProvisionerDaemon with
 // passable functions for dynamic functionality.
 type provisionerDaemonTestServer struct {
-	acquireJob  func(ctx context.Context, _ *proto.Empty) (*proto.AcquiredJob, error)
-	commitQuota func(ctx context.Context, com *proto.CommitQuotaRequest) (*proto.CommitQuotaResponse, error)
-	updateJob   func(ctx context.Context, update *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error)
-	failJob     func(ctx context.Context, job *proto.FailedJob) (*proto.Empty, error)
-	completeJob func(ctx context.Context, job *proto.CompletedJob) (*proto.Empty, error)
+	acquireJobWithCancel func(stream proto.DRPCProvisionerDaemon_AcquireJobWithCancelStream) error
+	commitQuota          func(ctx context.Context, com *proto.CommitQuotaRequest) (*proto.CommitQuotaResponse, error)
+	updateJob            func(ctx context.Context, update *proto.UpdateJobRequest) (*proto.UpdateJobResponse, error)
+	failJob              func(ctx context.Context, job *proto.FailedJob) (*proto.Empty, error)
+	completeJob          func(ctx context.Context, job *proto.CompletedJob) (*proto.Empty, error)
 }
 
-func (p *provisionerDaemonTestServer) AcquireJob(ctx context.Context, empty *proto.Empty) (*proto.AcquiredJob, error) {
-	return p.acquireJob(ctx, empty)
+func (*provisionerDaemonTestServer) AcquireJob(context.Context, *proto.Empty) (*proto.AcquiredJob, error) {
+	return nil, xerrors.New("deprecated!")
+}
+
+func (p *provisionerDaemonTestServer) AcquireJobWithCancel(stream proto.DRPCProvisionerDaemon_AcquireJobWithCancelStream) error {
+	if p.acquireJobWithCancel != nil {
+		return p.acquireJobWithCancel(stream)
+	}
+	// default behavior is to wait for cancel
+	_, _ = stream.Recv()
+	_ = stream.Send(&proto.AcquiredJob{})
+	return nil
 }
 
 func (p *provisionerDaemonTestServer) CommitQuota(ctx context.Context, com *proto.CommitQuotaRequest) (*proto.CommitQuotaResponse, error) {
@@ -1246,3 +1223,38 @@ func (p *provisionerDaemonTestServer) FailJob(ctx context.Context, job *proto.Fa
 func (p *provisionerDaemonTestServer) CompleteJob(ctx context.Context, job *proto.CompletedJob) (*proto.Empty, error) {
 	return p.completeJob(ctx, job)
 }
+
+// acquireOne provides a function that returns a single provisioner job, then subsequent calls block until canceled.
+// The complete channel is closed on the 2nd call.
+type acquireOne struct {
+	t        *testing.T
+	mu       sync.Mutex
+	job      *proto.AcquiredJob
+	called   int
+	complete chan struct{}
+}
+
+func newAcquireOne(t *testing.T, job *proto.AcquiredJob) *acquireOne {
+	return &acquireOne{
+		t:        t,
+		job:      job,
+		complete: make(chan struct{}),
+	}
+}
+
+func (a *acquireOne) acquireWithCancel(stream proto.DRPCProvisionerDaemon_AcquireJobWithCancelStream) error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.called++
+	if a.called == 2 {
+		close(a.complete)
+	}
+	if a.called > 1 {
+		_, _ = stream.Recv()
+		_ = stream.Send(&proto.AcquiredJob{})
+		return nil
+	}
+	err := stream.Send(a.job)
+	assert.NoError(a.t, err)
+	return nil
+}
diff --git a/provisionerd/runner/quota.go b/provisionerd/runner/quota.go
index d773721713e6c..26c7e0478ec2c 100644
--- a/provisionerd/runner/quota.go
+++ b/provisionerd/runner/quota.go
@@ -1,6 +1,6 @@
 package runner
 
-import "github.com/coder/coder/provisionersdk/proto"
+import "github.com/coder/coder/v2/provisionersdk/proto"
 
 func sumDailyCost(resources []*proto.Resource) int {
 	var sum int
diff --git a/provisionerd/runner/runner.go b/provisionerd/runner/runner.go
index e074800b03d36..0a529e20da8e0 100644
--- a/provisionerd/runner/runner.go
+++ b/provisionerd/runner/runner.go
@@ -1,15 +1,9 @@
 package runner
 
 import (
-	"archive/tar"
-	"bytes"
 	"context"
 	"errors"
 	"fmt"
-	"io"
-	"os"
-	"path"
-	"path/filepath"
 	"reflect"
 	"strings"
 	"sync"
@@ -18,7 +12,6 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/prometheus/client_golang/prometheus"
-	"github.com/spf13/afero"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
 	semconv "go.opentelemetry.io/otel/semconv/v1.14.0"
@@ -26,10 +19,10 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/coderd/util/ptr"
-	"github.com/coder/coder/provisionerd/proto"
-	sdkproto "github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/provisionerd/proto"
+	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 const (
@@ -54,14 +47,14 @@ type Runner struct {
 	sender              JobUpdater
 	quotaCommitter      QuotaCommitter
 	logger              slog.Logger
-	filesystem          afero.Fs
-	workDirectory       string
 	provisioner         sdkproto.DRPCProvisionerClient
 	lastUpdate          atomic.Pointer[time.Time]
 	updateInterval      time.Duration
 	forceCancelInterval time.Duration
 	logBufferInterval   time.Duration
 
+	// session is the provisioning session with the (possibly remote) provisioner
+	session sdkproto.DRPCProvisioner_SessionClient
 	// closed when the Runner is finished sending any updates/failed/complete.
 	done chan struct{}
 	// active as long as we are not canceled
@@ -108,8 +101,6 @@ type Options struct {
 	Updater             JobUpdater
 	QuotaCommitter      QuotaCommitter
 	Logger              slog.Logger
-	Filesystem          afero.Fs
-	WorkDirectory       string
 	Provisioner         sdkproto.DRPCProvisionerClient
 	UpdateInterval      time.Duration
 	ForceCancelInterval time.Duration
@@ -149,8 +140,6 @@ func New(
 		sender:              opts.Updater,
 		quotaCommitter:      opts.QuotaCommitter,
 		logger:              logger,
-		filesystem:          opts.Filesystem,
-		workDirectory:       opts.WorkDirectory,
 		provisioner:         opts.Provisioner,
 		updateInterval:      opts.UpdateInterval,
 		forceCancelInterval: opts.ForceCancelInterval,
@@ -386,6 +375,14 @@ func (r *Runner) doCleanFinish(ctx context.Context) {
 		r.setComplete(completedJob)
 	}()
 
+	var err error
+	r.session, err = r.provisioner.Session(ctx)
+	if err != nil {
+		failedJob = r.failedJobf("open session: %s", err)
+		return
+	}
+	defer r.session.Close()
+
 	defer func() {
 		ctx, span := r.startTrace(ctx, tracing.FuncName())
 		defer span.End()
@@ -396,23 +393,6 @@ func (r *Runner) doCleanFinish(ctx context.Context) {
 			Stage:     "Cleaning Up",
 			CreatedAt: time.Now().UnixMilli(),
 		})
-
-		// Cleanup the work directory after execution.
-		for attempt := 0; attempt < 5; attempt++ {
-			err := r.filesystem.RemoveAll(r.workDirectory)
-			if err != nil {
-				// On Windows, open files cannot be removed.
-				// When the provisioner daemon is shutting down,
-				// it may take a few milliseconds for processes to exit.
-				// See: https://github.com/golang/go/issues/50510
-				r.logger.Debug(ctx, "failed to clean work directory; trying again", slog.Error(err))
-				time.Sleep(250 * time.Millisecond)
-				continue
-			}
-			r.logger.Debug(ctx, "cleaned up work directory")
-			break
-		}
-
 		r.flushQueuedLogs(ctx)
 	}()
 
@@ -424,85 +404,19 @@ func (r *Runner) do(ctx context.Context) (*proto.CompletedJob, *proto.FailedJob)
 	ctx, span := r.startTrace(ctx, tracing.FuncName())
 	defer span.End()
 
-	err := r.filesystem.MkdirAll(r.workDirectory, 0o700)
-	if err != nil {
-		return nil, r.failedJobf("create work directory %q: %s", r.workDirectory, err)
-	}
-
 	r.queueLog(ctx, &proto.Log{
 		Source:    proto.LogSource_PROVISIONER_DAEMON,
 		Level:     sdkproto.LogLevel_INFO,
 		Stage:     "Setting up",
 		CreatedAt: time.Now().UnixMilli(),
 	})
-	if err != nil {
-		return nil, r.failedJobf("write log: %s", err)
-	}
 
-	r.logger.Info(ctx, "unpacking template source archive",
-		slog.F("size_bytes", len(r.job.TemplateSourceArchive)),
-	)
-
-	reader := tar.NewReader(bytes.NewBuffer(r.job.TemplateSourceArchive))
-	for {
-		header, err := reader.Next()
-		if err != nil {
-			if errors.Is(err, io.EOF) {
-				break
-			}
-			return nil, r.failedJobf("read template source archive: %s", err)
-		}
-		// #nosec
-		headerPath := filepath.Join(r.workDirectory, header.Name)
-		if !strings.HasPrefix(headerPath, filepath.Clean(r.workDirectory)) {
-			return nil, r.failedJobf("tar attempts to target relative upper directory")
-		}
-		mode := header.FileInfo().Mode()
-		if mode == 0 {
-			mode = 0o600
-		}
-		switch header.Typeflag {
-		case tar.TypeDir:
-			err = r.filesystem.MkdirAll(headerPath, mode)
-			if err != nil {
-				return nil, r.failedJobf("mkdir %q: %s", headerPath, err)
-			}
-			r.logger.Debug(context.Background(), "extracted directory", slog.F("path", headerPath))
-		case tar.TypeReg:
-			file, err := r.filesystem.OpenFile(headerPath, os.O_CREATE|os.O_RDWR, mode)
-			if err != nil {
-				return nil, r.failedJobf("create file %q (mode %s): %s", headerPath, mode, err)
-			}
-			// Max file size of 10MiB.
-			size, err := io.CopyN(file, reader, 10<<20)
-			if errors.Is(err, io.EOF) {
-				err = nil
-			}
-			if err != nil {
-				_ = file.Close()
-				return nil, r.failedJobf("copy file %q: %s", headerPath, err)
-			}
-			err = file.Close()
-			if err != nil {
-				return nil, r.failedJobf("close file %q: %s", headerPath, err)
-			}
-			r.logger.Debug(context.Background(), "extracted file",
-				slog.F("size_bytes", size),
-				slog.F("path", headerPath),
-				slog.F("mode", mode),
-			)
-		}
-	}
 	switch jobType := r.job.Type.(type) {
 	case *proto.AcquiredJob_TemplateImport_:
 		r.logger.Debug(context.Background(), "acquired job is template import",
 			slog.F("user_variable_values", redactVariableValues(jobType.TemplateImport.UserVariableValues)),
 		)
 
-		failedJob := r.runReadmeParse(ctx)
-		if failedJob != nil {
-			return nil, failedJob
-		}
 		return r.runTemplateImport(ctx)
 	case *proto.AcquiredJob_TemplateDryRun_:
 		r.logger.Debug(context.Background(), "acquired job is template dry-run",
@@ -525,6 +439,14 @@ func (r *Runner) do(ctx context.Context) (*proto.CompletedJob, *proto.FailedJob)
 	}
 }
 
+func (r *Runner) configure(config *sdkproto.Config) *proto.FailedJob {
+	err := r.session.Send(&sdkproto.Request{Type: &sdkproto.Request_Config{Config: config}})
+	if err != nil {
+		return r.failedJobf("send config: %s", err)
+	}
+	return nil
+}
+
 // heartbeatRoutine periodically sends updates on the job, which keeps coder server
 // from assuming the job is stalled, and allows the runner to learn if the job
 // has been canceled by the user.
@@ -577,44 +499,16 @@ func (r *Runner) heartbeatRoutine(ctx context.Context) {
 	}
 }
 
-// ReadmeFile is the location we look for to extract documentation from template
-// versions.
-const ReadmeFile = "README.md"
-
-func (r *Runner) runReadmeParse(ctx context.Context) *proto.FailedJob {
+func (r *Runner) runTemplateImport(ctx context.Context) (*proto.CompletedJob, *proto.FailedJob) {
 	ctx, span := r.startTrace(ctx, tracing.FuncName())
 	defer span.End()
 
-	fi, err := afero.ReadFile(r.filesystem, path.Join(r.workDirectory, ReadmeFile))
-	if err != nil {
-		r.queueLog(ctx, &proto.Log{
-			Source:    proto.LogSource_PROVISIONER_DAEMON,
-			Level:     sdkproto.LogLevel_DEBUG,
-			Stage:     "No README.md provided",
-			CreatedAt: time.Now().UnixMilli(),
-		})
-		return nil
-	}
-
-	_, err = r.update(ctx, &proto.UpdateJobRequest{
-		JobId: r.job.JobId,
-		Logs: []*proto.Log{{
-			Source:    proto.LogSource_PROVISIONER_DAEMON,
-			Level:     sdkproto.LogLevel_INFO,
-			Stage:     "Adding README.md...",
-			CreatedAt: time.Now().UnixMilli(),
-		}},
-		Readme: fi,
+	failedJob := r.configure(&sdkproto.Config{
+		TemplateSourceArchive: r.job.GetTemplateSourceArchive(),
 	})
-	if err != nil {
-		return r.failedJobf("write log: %s", err)
+	if failedJob != nil {
+		return nil, failedJob
 	}
-	return nil
-}
-
-func (r *Runner) runTemplateImport(ctx context.Context) (*proto.CompletedJob, *proto.FailedJob) {
-	ctx, span := r.startTrace(ctx, tracing.FuncName())
-	defer span.End()
 
 	// Parse parameters and update the job with the parameter specs
 	r.queueLog(ctx, &proto.Log{
@@ -623,7 +517,7 @@ func (r *Runner) runTemplateImport(ctx context.Context) (*proto.CompletedJob, *p
 		Stage:     "Parsing template parameters",
 		CreatedAt: time.Now().UnixMilli(),
 	})
-	templateVariables, err := r.runTemplateImportParse(ctx)
+	templateVariables, readme, err := r.runTemplateImportParse(ctx)
 	if err != nil {
 		return nil, r.failedJobf("run parse: %s", err)
 	}
@@ -634,6 +528,7 @@ func (r *Runner) runTemplateImport(ctx context.Context) (*proto.CompletedJob, *p
 		JobId:              r.job.JobId,
 		TemplateVariables:  templateVariables,
 		UserVariableValues: r.job.GetTemplateImport().GetUserVariableValues(),
+		Readme:             readme,
 	})
 	if err != nil {
 		return nil, r.failedJobf("update job: %s", err)
@@ -646,7 +541,7 @@ func (r *Runner) runTemplateImport(ctx context.Context) (*proto.CompletedJob, *p
 		Stage:     "Detecting persistent resources",
 		CreatedAt: time.Now().UnixMilli(),
 	})
-	startProvision, err := r.runTemplateImportProvision(ctx, updateResponse.VariableValues, &sdkproto.Provision_Metadata{
+	startProvision, err := r.runTemplateImportProvision(ctx, updateResponse.VariableValues, &sdkproto.Metadata{
 		CoderUrl:            r.job.GetTemplateImport().Metadata.CoderUrl,
 		WorkspaceTransition: sdkproto.WorkspaceTransition_START,
 	})
@@ -661,7 +556,7 @@ func (r *Runner) runTemplateImport(ctx context.Context) (*proto.CompletedJob, *p
 		Stage:     "Detecting ephemeral resources",
 		CreatedAt: time.Now().UnixMilli(),
 	})
-	stopProvision, err := r.runTemplateImportProvision(ctx, updateResponse.VariableValues, &sdkproto.Provision_Metadata{
+	stopProvision, err := r.runTemplateImportProvision(ctx, updateResponse.VariableValues, &sdkproto.Metadata{
 		CoderUrl:            r.job.GetTemplateImport().Metadata.CoderUrl,
 		WorkspaceTransition: sdkproto.WorkspaceTransition_STOP,
 	})
@@ -673,34 +568,33 @@ func (r *Runner) runTemplateImport(ctx context.Context) (*proto.CompletedJob, *p
 		JobId: r.job.JobId,
 		Type: &proto.CompletedJob_TemplateImport_{
 			TemplateImport: &proto.CompletedJob_TemplateImport{
-				StartResources:   startProvision.Resources,
-				StopResources:    stopProvision.Resources,
-				RichParameters:   startProvision.Parameters,
-				GitAuthProviders: startProvision.GitAuthProviders,
+				StartResources:        startProvision.Resources,
+				StopResources:         stopProvision.Resources,
+				RichParameters:        startProvision.Parameters,
+				ExternalAuthProviders: startProvision.ExternalAuthProviders,
 			},
 		},
 	}, nil
 }
 
-// Parses template variables and parameter schemas from source.
-func (r *Runner) runTemplateImportParse(ctx context.Context) ([]*sdkproto.TemplateVariable, error) {
+// Parses template variables and README from source.
+func (r *Runner) runTemplateImportParse(ctx context.Context) (
+	vars []*sdkproto.TemplateVariable, readme []byte, err error,
+) {
 	ctx, span := r.startTrace(ctx, tracing.FuncName())
 	defer span.End()
 
-	stream, err := r.provisioner.Parse(ctx, &sdkproto.Parse_Request{
-		Directory: r.workDirectory,
-	})
+	err = r.session.Send(&sdkproto.Request{Type: &sdkproto.Request_Parse{Parse: &sdkproto.ParseRequest{}}})
 	if err != nil {
-		return nil, xerrors.Errorf("parse source: %w", err)
+		return nil, nil, xerrors.Errorf("parse source: %w", err)
 	}
-	defer stream.Close()
 	for {
-		msg, err := stream.Recv()
+		msg, err := r.session.Recv()
 		if err != nil {
-			return nil, xerrors.Errorf("recv parse source: %w", err)
+			return nil, nil, xerrors.Errorf("recv parse source: %w", err)
 		}
 		switch msgType := msg.Type.(type) {
-		case *sdkproto.Parse_Response_Log:
+		case *sdkproto.Response_Log:
 			r.logger.Debug(context.Background(), "parse job logged",
 				slog.F("level", msgType.Log.Level),
 				slog.F("output", msgType.Log.Output),
@@ -713,35 +607,46 @@ func (r *Runner) runTemplateImportParse(ctx context.Context) ([]*sdkproto.Templa
 				Output:    msgType.Log.Output,
 				Stage:     "Parse parameters",
 			})
-		case *sdkproto.Parse_Response_Complete:
+		case *sdkproto.Response_Parse:
+			pc := msgType.Parse
 			r.logger.Debug(context.Background(), "parse complete",
-				slog.F("template_variables", msgType.Complete.TemplateVariables),
+				slog.F("template_variables", pc.TemplateVariables),
+				slog.F("readme_len", len(pc.Readme)),
+				slog.F("error", pc.Error),
 			)
+			if pc.Error != "" {
+				return nil, nil, xerrors.Errorf("parse error: %s", pc.Error)
+			}
 
-			return msgType.Complete.TemplateVariables, nil
+			return msgType.Parse.TemplateVariables, msgType.Parse.Readme, nil
 		default:
-			return nil, xerrors.Errorf("invalid message type %q received from provisioner",
+			return nil, nil, xerrors.Errorf("invalid message type %q received from provisioner",
 				reflect.TypeOf(msg.Type).String())
 		}
 	}
 }
 
 type templateImportProvision struct {
-	Resources        []*sdkproto.Resource
-	Parameters       []*sdkproto.RichParameter
-	GitAuthProviders []string
+	Resources             []*sdkproto.Resource
+	Parameters            []*sdkproto.RichParameter
+	ExternalAuthProviders []string
 }
 
 // Performs a dry-run provision when importing a template.
 // This is used to detect resources that would be provisioned for a workspace in various states.
 // It doesn't define values for rich parameters as they're unknown during template import.
-func (r *Runner) runTemplateImportProvision(ctx context.Context, variableValues []*sdkproto.VariableValue, metadata *sdkproto.Provision_Metadata) (*templateImportProvision, error) {
+func (r *Runner) runTemplateImportProvision(ctx context.Context, variableValues []*sdkproto.VariableValue, metadata *sdkproto.Metadata) (*templateImportProvision, error) {
 	return r.runTemplateImportProvisionWithRichParameters(ctx, variableValues, nil, metadata)
 }
 
 // Performs a dry-run provision with provided rich parameters.
 // This is used to detect resources that would be provisioned for a workspace in various states.
-func (r *Runner) runTemplateImportProvisionWithRichParameters(ctx context.Context, variableValues []*sdkproto.VariableValue, richParameterValues []*sdkproto.RichParameterValue, metadata *sdkproto.Provision_Metadata) (*templateImportProvision, error) {
+func (r *Runner) runTemplateImportProvisionWithRichParameters(
+	ctx context.Context,
+	variableValues []*sdkproto.VariableValue,
+	richParameterValues []*sdkproto.RichParameterValue,
+	metadata *sdkproto.Metadata,
+) (*templateImportProvision, error) {
 	ctx, span := r.startTrace(ctx, tracing.FuncName())
 	defer span.End()
 
@@ -754,46 +659,38 @@ func (r *Runner) runTemplateImportProvisionWithRichParameters(ctx context.Contex
 	}
 	// use the notStopped so that if we attempt to gracefully cancel, the stream will still be available for us
 	// to send the cancel to the provisioner
-	stream, err := r.provisioner.Provision(ctx)
+	err := r.session.Send(&sdkproto.Request{Type: &sdkproto.Request_Plan{Plan: &sdkproto.PlanRequest{
+		Metadata:            metadata,
+		RichParameterValues: richParameterValues,
+		VariableValues:      variableValues,
+	}}})
 	if err != nil {
-		return nil, xerrors.Errorf("provision: %w", err)
+		return nil, xerrors.Errorf("start provision: %w", err)
 	}
-	defer stream.Close()
+	nevermind := make(chan struct{})
+	defer close(nevermind)
 	go func() {
 		select {
+		case <-nevermind:
+			return
 		case <-r.notStopped.Done():
 			return
 		case <-r.notCanceled.Done():
-			_ = stream.Send(&sdkproto.Provision_Request{
-				Type: &sdkproto.Provision_Request_Cancel{
-					Cancel: &sdkproto.Provision_Cancel{},
+			_ = r.session.Send(&sdkproto.Request{
+				Type: &sdkproto.Request_Cancel{
+					Cancel: &sdkproto.CancelRequest{},
 				},
 			})
 		}
 	}()
-	err = stream.Send(&sdkproto.Provision_Request{
-		Type: &sdkproto.Provision_Request_Plan{
-			Plan: &sdkproto.Provision_Plan{
-				Config: &sdkproto.Provision_Config{
-					Directory: r.workDirectory,
-					Metadata:  metadata,
-				},
-				RichParameterValues: richParameterValues,
-				VariableValues:      variableValues,
-			},
-		},
-	})
-	if err != nil {
-		return nil, xerrors.Errorf("start provision: %w", err)
-	}
 
 	for {
-		msg, err := stream.Recv()
+		msg, err := r.session.Recv()
 		if err != nil {
 			return nil, xerrors.Errorf("recv import provision: %w", err)
 		}
 		switch msgType := msg.Type.(type) {
-		case *sdkproto.Provision_Response_Log:
+		case *sdkproto.Response_Log:
 			r.logger.Debug(context.Background(), "template import provision job logged",
 				slog.F("level", msgType.Log.Level),
 				slog.F("output", msgType.Log.Output),
@@ -805,25 +702,25 @@ func (r *Runner) runTemplateImportProvisionWithRichParameters(ctx context.Contex
 				Output:    msgType.Log.Output,
 				Stage:     stage,
 			})
-		case *sdkproto.Provision_Response_Complete:
-			if msgType.Complete.Error != "" {
+		case *sdkproto.Response_Plan:
+			c := msgType.Plan
+			if c.Error != "" {
 				r.logger.Info(context.Background(), "dry-run provision failure",
-					slog.F("error", msgType.Complete.Error),
+					slog.F("error", c.Error),
 				)
 
-				return nil, xerrors.New(msgType.Complete.Error)
+				return nil, xerrors.New(c.Error)
 			}
 
 			r.logger.Info(context.Background(), "parse dry-run provision successful",
-				slog.F("resource_count", len(msgType.Complete.Resources)),
-				slog.F("resources", msgType.Complete.Resources),
-				slog.F("state_length", len(msgType.Complete.State)),
+				slog.F("resource_count", len(c.Resources)),
+				slog.F("resources", c.Resources),
 			)
 
 			return &templateImportProvision{
-				Resources:        msgType.Complete.Resources,
-				Parameters:       msgType.Complete.Parameters,
-				GitAuthProviders: msgType.Complete.GitAuthProviders,
+				Resources:             c.Resources,
+				Parameters:            c.Parameters,
+				ExternalAuthProviders: c.ExternalAuthProviders,
 			}, nil
 		default:
 			return nil, xerrors.Errorf("invalid message type %q received from provisioner",
@@ -864,6 +761,13 @@ func (r *Runner) runTemplateDryRun(ctx context.Context) (*proto.CompletedJob, *p
 		metadata.WorkspaceOwnerId = id.String()
 	}
 
+	failedJob := r.configure(&sdkproto.Config{
+		TemplateSourceArchive: r.job.GetTemplateSourceArchive(),
+	})
+	if failedJob != nil {
+		return nil, failedJob
+	}
+
 	// Run the template import provision task since it's already a dry run.
 	provision, err := r.runTemplateImportProvisionWithRichParameters(ctx,
 		r.job.GetTemplateDryRun().GetVariableValues(),
@@ -884,41 +788,39 @@ func (r *Runner) runTemplateDryRun(ctx context.Context) (*proto.CompletedJob, *p
 	}, nil
 }
 
-func (r *Runner) buildWorkspace(ctx context.Context, stage string, req *sdkproto.Provision_Request) (
-	*sdkproto.Provision_Complete, *proto.FailedJob,
+func (r *Runner) buildWorkspace(ctx context.Context, stage string, req *sdkproto.Request) (
+	*sdkproto.Response, *proto.FailedJob,
 ) {
 	// use the notStopped so that if we attempt to gracefully cancel, the stream
 	// will still be available for us to send the cancel to the provisioner
-	stream, err := r.provisioner.Provision(ctx)
+	err := r.session.Send(req)
 	if err != nil {
-		return nil, r.failedWorkspaceBuildf("provision: %s", err)
+		return nil, r.failedWorkspaceBuildf("start provision: %s", err)
 	}
-	defer stream.Close()
+	nevermind := make(chan struct{})
+	defer close(nevermind)
 	go func() {
 		select {
+		case <-nevermind:
+			return
 		case <-r.notStopped.Done():
 			return
 		case <-r.notCanceled.Done():
-			_ = stream.Send(&sdkproto.Provision_Request{
-				Type: &sdkproto.Provision_Request_Cancel{
-					Cancel: &sdkproto.Provision_Cancel{},
+			_ = r.session.Send(&sdkproto.Request{
+				Type: &sdkproto.Request_Cancel{
+					Cancel: &sdkproto.CancelRequest{},
 				},
 			})
 		}
 	}()
 
-	err = stream.Send(req)
-	if err != nil {
-		return nil, r.failedWorkspaceBuildf("start provision: %s", err)
-	}
-
 	for {
-		msg, err := stream.Recv()
+		msg, err := r.session.Recv()
 		if err != nil {
 			return nil, r.failedWorkspaceBuildf("recv workspace provision: %s", err)
 		}
 		switch msgType := msg.Type.(type) {
-		case *sdkproto.Provision_Response_Log:
+		case *sdkproto.Response_Log:
 			r.logProvisionerJobLog(context.Background(), msgType.Log.Level, "workspace provisioner job logged",
 				slog.F("level", msgType.Log.Level),
 				slog.F("output", msgType.Log.Output),
@@ -932,39 +834,19 @@ func (r *Runner) buildWorkspace(ctx context.Context, stage string, req *sdkproto
 				Output:    msgType.Log.Output,
 				Stage:     stage,
 			})
-		case *sdkproto.Provision_Response_Complete:
-			if msgType.Complete.Error != "" {
-				r.logger.Warn(context.Background(), "provision failed; updating state",
-					slog.F("state_length", len(msgType.Complete.State)),
-					slog.F("error", msgType.Complete.Error),
-				)
-
-				return nil, &proto.FailedJob{
-					JobId: r.job.JobId,
-					Error: msgType.Complete.Error,
-					Type: &proto.FailedJob_WorkspaceBuild_{
-						WorkspaceBuild: &proto.FailedJob_WorkspaceBuild{
-							State: msgType.Complete.State,
-						},
-					},
-				}
-			}
-
-			r.logger.Info(context.Background(), "provision successful",
-				slog.F("resource_count", len(msgType.Complete.Resources)),
-				slog.F("resources", msgType.Complete.Resources),
-				slog.F("state_length", len(msgType.Complete.State)),
-			)
-			// Stop looping!
-			return msgType.Complete, nil
 		default:
-			return nil, r.failedWorkspaceBuildf("invalid message type %T received from provisioner", msg.Type)
+			// Stop looping!
+			return msg, nil
 		}
 	}
 }
 
 func (r *Runner) commitQuota(ctx context.Context, resources []*sdkproto.Resource) *proto.FailedJob {
 	cost := sumDailyCost(resources)
+	r.logger.Debug(ctx, "committing quota",
+		slog.F("resources", resources),
+		slog.F("cost", cost),
+	)
 	if cost == 0 {
 		return nil
 	}
@@ -1031,30 +913,53 @@ func (r *Runner) runWorkspaceBuild(ctx context.Context) (*proto.CompletedJob, *p
 		applyStage = "Destroying workspace"
 	}
 
-	config := &sdkproto.Provision_Config{
-		Directory: r.workDirectory,
-		Metadata:  r.job.GetWorkspaceBuild().Metadata,
-		State:     r.job.GetWorkspaceBuild().State,
-
-		ProvisionerLogLevel: r.job.GetWorkspaceBuild().LogLevel,
+	failedJob := r.configure(&sdkproto.Config{
+		TemplateSourceArchive: r.job.GetTemplateSourceArchive(),
+		State:                 r.job.GetWorkspaceBuild().State,
+		ProvisionerLogLevel:   r.job.GetWorkspaceBuild().LogLevel,
+	})
+	if failedJob != nil {
+		return nil, failedJob
 	}
 
-	completedPlan, failed := r.buildWorkspace(ctx, "Planning infrastructure", &sdkproto.Provision_Request{
-		Type: &sdkproto.Provision_Request_Plan{
-			Plan: &sdkproto.Provision_Plan{
-				Config:              config,
-				RichParameterValues: r.job.GetWorkspaceBuild().RichParameterValues,
-				VariableValues:      r.job.GetWorkspaceBuild().VariableValues,
-				GitAuthProviders:    r.job.GetWorkspaceBuild().GitAuthProviders,
+	resp, failed := r.buildWorkspace(ctx, "Planning infrastructure", &sdkproto.Request{
+		Type: &sdkproto.Request_Plan{
+			Plan: &sdkproto.PlanRequest{
+				Metadata:              r.job.GetWorkspaceBuild().Metadata,
+				RichParameterValues:   r.job.GetWorkspaceBuild().RichParameterValues,
+				VariableValues:        r.job.GetWorkspaceBuild().VariableValues,
+				ExternalAuthProviders: r.job.GetWorkspaceBuild().ExternalAuthProviders,
 			},
 		},
 	})
 	if failed != nil {
 		return nil, failed
 	}
+	planComplete := resp.GetPlan()
+	if planComplete == nil {
+		return nil, r.failedWorkspaceBuildf("invalid message type %T received from provisioner", resp.Type)
+	}
+	if planComplete.Error != "" {
+		r.logger.Warn(context.Background(), "plan request failed",
+			slog.F("error", planComplete.Error),
+		)
+
+		return nil, &proto.FailedJob{
+			JobId: r.job.JobId,
+			Error: planComplete.Error,
+			Type: &proto.FailedJob_WorkspaceBuild_{
+				WorkspaceBuild: &proto.FailedJob_WorkspaceBuild{},
+			},
+		}
+	}
+
+	r.logger.Info(context.Background(), "plan request successful",
+		slog.F("resource_count", len(planComplete.Resources)),
+		slog.F("resources", planComplete.Resources),
+	)
 	r.flushQueuedLogs(ctx)
 	if commitQuota {
-		failed = r.commitQuota(ctx, completedPlan.GetResources())
+		failed = r.commitQuota(ctx, planComplete.Resources)
 		r.flushQueuedLogs(ctx)
 		if failed != nil {
 			return nil, failed
@@ -1068,25 +973,50 @@ func (r *Runner) runWorkspaceBuild(ctx context.Context) (*proto.CompletedJob, *p
 		CreatedAt: time.Now().UnixMilli(),
 	})
 
-	completedApply, failed := r.buildWorkspace(ctx, applyStage, &sdkproto.Provision_Request{
-		Type: &sdkproto.Provision_Request_Apply{
-			Apply: &sdkproto.Provision_Apply{
-				Config: config,
-				Plan:   completedPlan.GetPlan(),
+	resp, failed = r.buildWorkspace(ctx, applyStage, &sdkproto.Request{
+		Type: &sdkproto.Request_Apply{
+			Apply: &sdkproto.ApplyRequest{
+				Metadata: r.job.GetWorkspaceBuild().Metadata,
 			},
 		},
 	})
 	if failed != nil {
 		return nil, failed
 	}
+	applyComplete := resp.GetApply()
+	if applyComplete == nil {
+		return nil, r.failedWorkspaceBuildf("invalid message type %T received from provisioner", resp.Type)
+	}
+	if applyComplete.Error != "" {
+		r.logger.Warn(context.Background(), "apply failed; updating state",
+			slog.F("error", applyComplete.Error),
+			slog.F("state_len", len(applyComplete.State)),
+		)
+
+		return nil, &proto.FailedJob{
+			JobId: r.job.JobId,
+			Error: applyComplete.Error,
+			Type: &proto.FailedJob_WorkspaceBuild_{
+				WorkspaceBuild: &proto.FailedJob_WorkspaceBuild{
+					State: applyComplete.State,
+				},
+			},
+		}
+	}
+
+	r.logger.Info(context.Background(), "apply successful",
+		slog.F("resource_count", len(applyComplete.Resources)),
+		slog.F("resources", applyComplete.Resources),
+		slog.F("state_len", len(applyComplete.State)),
+	)
 	r.flushQueuedLogs(ctx)
 
 	return &proto.CompletedJob{
 		JobId: r.job.JobId,
 		Type: &proto.CompletedJob_WorkspaceBuild_{
 			WorkspaceBuild: &proto.CompletedJob_WorkspaceBuild{
-				State:     completedApply.GetState(),
-				Resources: completedApply.GetResources(),
+				State:     applyComplete.State,
+				Resources: applyComplete.Resources,
 			},
 		},
 	}, nil
diff --git a/provisionersdk/agent.go b/provisionersdk/agent.go
index c14a93f1a2088..1a285577fabda 100644
--- a/provisionersdk/agent.go
+++ b/provisionersdk/agent.go
@@ -4,6 +4,8 @@ import (
 	_ "embed"
 	"fmt"
 	"strings"
+
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 var (
@@ -50,3 +52,15 @@ func AgentScriptEnv() map[string]string {
 	}
 	return env
 }
+
+// DefaultDisplayApps returns the default display applications to enable
+// if none are specified in a template.
+func DefaultDisplayApps() *proto.DisplayApps {
+	return &proto.DisplayApps{
+		Vscode:               true,
+		VscodeInsiders:       false,
+		WebTerminal:          true,
+		PortForwardingHelper: true,
+		SshHelper:            true,
+	}
+}
diff --git a/provisionersdk/agent_test.go b/provisionersdk/agent_test.go
index 305813719f6c9..c10127b03d5d1 100644
--- a/provisionersdk/agent_test.go
+++ b/provisionersdk/agent_test.go
@@ -20,7 +20,7 @@ import (
 	"github.com/go-chi/render"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/provisionersdk"
+	"github.com/coder/coder/v2/provisionersdk"
 )
 
 func TestAgentScript(t *testing.T) {
diff --git a/provisionersdk/archive.go b/provisionersdk/archive.go
index f54a0e76022af..df6eabc3b0c05 100644
--- a/provisionersdk/archive.go
+++ b/provisionersdk/archive.go
@@ -9,7 +9,7 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/util/xio"
+	"github.com/coder/coder/v2/coderd/util/xio"
 )
 
 const (
diff --git a/provisionersdk/archive_test.go b/provisionersdk/archive_test.go
index 034d886bc7116..abda7f6bb6d4a 100644
--- a/provisionersdk/archive_test.go
+++ b/provisionersdk/archive_test.go
@@ -10,7 +10,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/provisionersdk"
+	"github.com/coder/coder/v2/provisionersdk"
 )
 
 func TestTar(t *testing.T) {
diff --git a/provisionersdk/cleanup.go b/provisionersdk/cleanup.go
new file mode 100644
index 0000000000000..8f940546cb05c
--- /dev/null
+++ b/provisionersdk/cleanup.go
@@ -0,0 +1,53 @@
+package provisionersdk
+
+import (
+	"context"
+	"path/filepath"
+	"time"
+
+	"github.com/djherbis/times"
+	"github.com/spf13/afero"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+)
+
+// CleanStaleSessions browses the work directory searching for stale session
+// directories. Coder provisioner is supposed to remove them once after finishing the provisioning,
+// but there is a risk of keeping them in case of a failure.
+func CleanStaleSessions(ctx context.Context, workDirectory string, fs afero.Fs, now time.Time, logger slog.Logger) error {
+	entries, err := afero.ReadDir(fs, workDirectory)
+	if err != nil {
+		return xerrors.Errorf("can't read %q directory", workDirectory)
+	}
+
+	for _, fi := range entries {
+		dirName := fi.Name()
+
+		if fi.IsDir() && isValidSessionDir(dirName) {
+			sessionDirPath := filepath.Join(workDirectory, dirName)
+
+			accessTime := fi.ModTime() // fallback to modTime if accessTime is not available (afero)
+			if fi.Sys() != nil {
+				timeSpec := times.Get(fi)
+				accessTime = timeSpec.AccessTime()
+			}
+
+			if accessTime.Add(staleSessionRetention).After(now) {
+				continue
+			}
+
+			logger.Info(ctx, "remove stale session directory", slog.F("session_path", sessionDirPath))
+			err = fs.RemoveAll(sessionDirPath)
+			if err != nil {
+				return xerrors.Errorf("can't remove %q directory: %w", sessionDirPath, err)
+			}
+		}
+	}
+	return nil
+}
+
+func isValidSessionDir(dirName string) bool {
+	match, err := filepath.Match(sessionDirPrefix+"*", dirName)
+	return err == nil && match
+}
diff --git a/provisionersdk/cleanup_test.go b/provisionersdk/cleanup_test.go
new file mode 100644
index 0000000000000..cf0296cb05927
--- /dev/null
+++ b/provisionersdk/cleanup_test.go
@@ -0,0 +1,112 @@
+package provisionersdk_test
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/require"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/slogtest"
+
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/testutil"
+)
+
+const workDirectory = "/tmp/coder/provisioner-34/work"
+
+func TestStaleSessions(t *testing.T) {
+	t.Parallel()
+
+	prepare := func() (afero.Fs, time.Time, slog.Logger) {
+		fs := afero.NewMemMapFs()
+		now := time.Date(2023, time.June, 3, 4, 5, 6, 0, time.UTC)
+		logger := slogtest.Make(t, nil).
+			Leveled(slog.LevelDebug).
+			Named("cleanup-test")
+		return fs, now, logger
+	}
+
+	t.Run("all sessions are stale", func(t *testing.T) {
+		t.Parallel()
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+
+		fs, now, logger := prepare()
+
+		// given
+		first := provisionersdk.SessionDir(uuid.NewString())
+		addSessionFolder(t, fs, first, now.Add(-7*24*time.Hour))
+		second := provisionersdk.SessionDir(uuid.NewString())
+		addSessionFolder(t, fs, second, now.Add(-8*24*time.Hour))
+		third := provisionersdk.SessionDir(uuid.NewString())
+		addSessionFolder(t, fs, third, now.Add(-9*24*time.Hour))
+
+		// when
+		provisionersdk.CleanStaleSessions(ctx, workDirectory, fs, now, logger)
+
+		// then
+		entries, err := afero.ReadDir(fs, workDirectory)
+		require.NoError(t, err)
+		require.Empty(t, entries, "all session leftovers should be removed")
+	})
+
+	t.Run("one session is stale", func(t *testing.T) {
+		t.Parallel()
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+
+		fs, now, logger := prepare()
+
+		// given
+		first := provisionersdk.SessionDir(uuid.NewString())
+		addSessionFolder(t, fs, first, now.Add(-7*24*time.Hour))
+		second := provisionersdk.SessionDir(uuid.NewString())
+		addSessionFolder(t, fs, second, now.Add(-6*24*time.Hour))
+
+		// when
+		provisionersdk.CleanStaleSessions(ctx, workDirectory, fs, now, logger)
+
+		// then
+		entries, err := afero.ReadDir(fs, workDirectory)
+		require.NoError(t, err)
+		require.Len(t, entries, 1, "one session should be present")
+		require.Equal(t, second, entries[0].Name(), 1)
+	})
+
+	t.Run("no stale sessions", func(t *testing.T) {
+		t.Parallel()
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+
+		fs, now, logger := prepare()
+
+		// given
+		first := provisionersdk.SessionDir(uuid.NewString())
+		addSessionFolder(t, fs, first, now.Add(-6*24*time.Hour))
+		second := provisionersdk.SessionDir(uuid.NewString())
+		addSessionFolder(t, fs, second, now.Add(-5*24*time.Hour))
+
+		// when
+		provisionersdk.CleanStaleSessions(ctx, workDirectory, fs, now, logger)
+
+		// then
+		entries, err := afero.ReadDir(fs, workDirectory)
+		require.NoError(t, err)
+		require.Len(t, entries, 2, "both sessions should be present")
+	})
+}
+
+func addSessionFolder(t *testing.T, fs afero.Fs, sessionName string, accessTime time.Time) {
+	err := fs.MkdirAll(filepath.Join(workDirectory, sessionName), 0o755)
+	require.NoError(t, err, "can't create session folder")
+	fs.Chtimes(filepath.Join(workDirectory, sessionName), accessTime, accessTime)
+	require.NoError(t, err, "can't set times")
+}
diff --git a/provisionersdk/errors.go b/provisionersdk/errors.go
new file mode 100644
index 0000000000000..0dc66e6e6b301
--- /dev/null
+++ b/provisionersdk/errors.go
@@ -0,0 +1,19 @@
+package provisionersdk
+
+import (
+	"fmt"
+
+	"github.com/coder/coder/v2/provisionersdk/proto"
+)
+
+func ParseErrorf(format string, args ...any) *proto.ParseComplete {
+	return &proto.ParseComplete{Error: fmt.Sprintf(format, args...)}
+}
+
+func PlanErrorf(format string, args ...any) *proto.PlanComplete {
+	return &proto.PlanComplete{Error: fmt.Sprintf(format, args...)}
+}
+
+func ApplyErrorf(format string, args ...any) *proto.ApplyComplete {
+	return &proto.ApplyComplete{Error: fmt.Sprintf(format, args...)}
+}
diff --git a/provisionersdk/proto/provisioner.pb.go b/provisionersdk/proto/provisioner.pb.go
index 24281d4c252db..271801463d426 100644
--- a/provisionersdk/proto/provisioner.pb.go
+++ b/provisionersdk/proto/provisioner.pb.go
@@ -125,6 +125,7 @@ func (AppSharingLevel) EnumDescriptor() ([]byte, []int) {
 	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{1}
 }
 
+// WorkspaceTransition is the desired outcome of a build
 type WorkspaceTransition int32
 
 const (
@@ -765,7 +766,7 @@ func (x *InstanceIdentityAuth) GetInstanceId() string {
 	return ""
 }
 
-type GitAuthProvider struct {
+type ExternalAuthProvider struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -774,8 +775,8 @@ type GitAuthProvider struct {
 	AccessToken string `protobuf:"bytes,2,opt,name=access_token,json=accessToken,proto3" json:"access_token,omitempty"`
 }
 
-func (x *GitAuthProvider) Reset() {
-	*x = GitAuthProvider{}
+func (x *ExternalAuthProvider) Reset() {
+	*x = ExternalAuthProvider{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -783,13 +784,13 @@ func (x *GitAuthProvider) Reset() {
 	}
 }
 
-func (x *GitAuthProvider) String() string {
+func (x *ExternalAuthProvider) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*GitAuthProvider) ProtoMessage() {}
+func (*ExternalAuthProvider) ProtoMessage() {}
 
-func (x *GitAuthProvider) ProtoReflect() protoreflect.Message {
+func (x *ExternalAuthProvider) ProtoReflect() protoreflect.Message {
 	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -801,19 +802,19 @@ func (x *GitAuthProvider) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use GitAuthProvider.ProtoReflect.Descriptor instead.
-func (*GitAuthProvider) Descriptor() ([]byte, []int) {
+// Deprecated: Use ExternalAuthProvider.ProtoReflect.Descriptor instead.
+func (*ExternalAuthProvider) Descriptor() ([]byte, []int) {
 	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{8}
 }
 
-func (x *GitAuthProvider) GetId() string {
+func (x *ExternalAuthProvider) GetId() string {
 	if x != nil {
 		return x.Id
 	}
 	return ""
 }
 
-func (x *GitAuthProvider) GetAccessToken() string {
+func (x *ExternalAuthProvider) GetAccessToken() string {
 	if x != nil {
 		return x.AccessToken
 	}
@@ -826,14 +827,14 @@ type Agent struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Id              string            `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	Name            string            `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
-	Env             map[string]string `protobuf:"bytes,3,rep,name=env,proto3" json:"env,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-	StartupScript   string            `protobuf:"bytes,4,opt,name=startup_script,json=startupScript,proto3" json:"startup_script,omitempty"`
-	OperatingSystem string            `protobuf:"bytes,5,opt,name=operating_system,json=operatingSystem,proto3" json:"operating_system,omitempty"`
-	Architecture    string            `protobuf:"bytes,6,opt,name=architecture,proto3" json:"architecture,omitempty"`
-	Directory       string            `protobuf:"bytes,7,opt,name=directory,proto3" json:"directory,omitempty"`
-	Apps            []*App            `protobuf:"bytes,8,rep,name=apps,proto3" json:"apps,omitempty"`
+	Id   string            `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Name string            `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Env  map[string]string `protobuf:"bytes,3,rep,name=env,proto3" json:"env,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// Field 4 was startup_script, now removed.
+	OperatingSystem string `protobuf:"bytes,5,opt,name=operating_system,json=operatingSystem,proto3" json:"operating_system,omitempty"`
+	Architecture    string `protobuf:"bytes,6,opt,name=architecture,proto3" json:"architecture,omitempty"`
+	Directory       string `protobuf:"bytes,7,opt,name=directory,proto3" json:"directory,omitempty"`
+	Apps            []*App `protobuf:"bytes,8,rep,name=apps,proto3" json:"apps,omitempty"`
 	// Types that are assignable to Auth:
 	//
 	//	*Agent_Token
@@ -843,11 +844,11 @@ type Agent struct {
 	TroubleshootingUrl       string       `protobuf:"bytes,12,opt,name=troubleshooting_url,json=troubleshootingUrl,proto3" json:"troubleshooting_url,omitempty"`
 	MotdFile                 string       `protobuf:"bytes,13,opt,name=motd_file,json=motdFile,proto3" json:"motd_file,omitempty"`
 	// Field 14 was bool login_before_ready = 14, now removed.
-	StartupScriptTimeoutSeconds  int32             `protobuf:"varint,15,opt,name=startup_script_timeout_seconds,json=startupScriptTimeoutSeconds,proto3" json:"startup_script_timeout_seconds,omitempty"`
-	ShutdownScript               string            `protobuf:"bytes,16,opt,name=shutdown_script,json=shutdownScript,proto3" json:"shutdown_script,omitempty"`
-	ShutdownScriptTimeoutSeconds int32             `protobuf:"varint,17,opt,name=shutdown_script_timeout_seconds,json=shutdownScriptTimeoutSeconds,proto3" json:"shutdown_script_timeout_seconds,omitempty"`
-	Metadata                     []*Agent_Metadata `protobuf:"bytes,18,rep,name=metadata,proto3" json:"metadata,omitempty"`
-	StartupScriptBehavior        string            `protobuf:"bytes,19,opt,name=startup_script_behavior,json=startupScriptBehavior,proto3" json:"startup_script_behavior,omitempty"`
+	// Field 15, 16, 17 were related to scripts, which are now removed.
+	Metadata []*Agent_Metadata `protobuf:"bytes,18,rep,name=metadata,proto3" json:"metadata,omitempty"`
+	// Field 19 was startup_script_behavior, now removed.
+	DisplayApps *DisplayApps `protobuf:"bytes,20,opt,name=display_apps,json=displayApps,proto3" json:"display_apps,omitempty"`
+	Scripts     []*Script    `protobuf:"bytes,21,rep,name=scripts,proto3" json:"scripts,omitempty"`
 }
 
 func (x *Agent) Reset() {
@@ -903,13 +904,6 @@ func (x *Agent) GetEnv() map[string]string {
 	return nil
 }
 
-func (x *Agent) GetStartupScript() string {
-	if x != nil {
-		return x.StartupScript
-	}
-	return ""
-}
-
 func (x *Agent) GetOperatingSystem() string {
 	if x != nil {
 		return x.OperatingSystem
@@ -980,56 +974,233 @@ func (x *Agent) GetMotdFile() string {
 	return ""
 }
 
-func (x *Agent) GetStartupScriptTimeoutSeconds() int32 {
+func (x *Agent) GetMetadata() []*Agent_Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *Agent) GetDisplayApps() *DisplayApps {
 	if x != nil {
-		return x.StartupScriptTimeoutSeconds
+		return x.DisplayApps
 	}
-	return 0
+	return nil
+}
+
+func (x *Agent) GetScripts() []*Script {
+	if x != nil {
+		return x.Scripts
+	}
+	return nil
+}
+
+type isAgent_Auth interface {
+	isAgent_Auth()
+}
+
+type Agent_Token struct {
+	Token string `protobuf:"bytes,9,opt,name=token,proto3,oneof"`
+}
+
+type Agent_InstanceId struct {
+	InstanceId string `protobuf:"bytes,10,opt,name=instance_id,json=instanceId,proto3,oneof"`
+}
+
+func (*Agent_Token) isAgent_Auth() {}
+
+func (*Agent_InstanceId) isAgent_Auth() {}
+
+type DisplayApps struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Vscode               bool `protobuf:"varint,1,opt,name=vscode,proto3" json:"vscode,omitempty"`
+	VscodeInsiders       bool `protobuf:"varint,2,opt,name=vscode_insiders,json=vscodeInsiders,proto3" json:"vscode_insiders,omitempty"`
+	WebTerminal          bool `protobuf:"varint,3,opt,name=web_terminal,json=webTerminal,proto3" json:"web_terminal,omitempty"`
+	SshHelper            bool `protobuf:"varint,4,opt,name=ssh_helper,json=sshHelper,proto3" json:"ssh_helper,omitempty"`
+	PortForwardingHelper bool `protobuf:"varint,5,opt,name=port_forwarding_helper,json=portForwardingHelper,proto3" json:"port_forwarding_helper,omitempty"`
+}
+
+func (x *DisplayApps) Reset() {
+	*x = DisplayApps{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DisplayApps) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DisplayApps) ProtoMessage() {}
+
+func (x *DisplayApps) ProtoReflect() protoreflect.Message {
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DisplayApps.ProtoReflect.Descriptor instead.
+func (*DisplayApps) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *DisplayApps) GetVscode() bool {
+	if x != nil {
+		return x.Vscode
+	}
+	return false
+}
+
+func (x *DisplayApps) GetVscodeInsiders() bool {
+	if x != nil {
+		return x.VscodeInsiders
+	}
+	return false
+}
+
+func (x *DisplayApps) GetWebTerminal() bool {
+	if x != nil {
+		return x.WebTerminal
+	}
+	return false
+}
+
+func (x *DisplayApps) GetSshHelper() bool {
+	if x != nil {
+		return x.SshHelper
+	}
+	return false
+}
+
+func (x *DisplayApps) GetPortForwardingHelper() bool {
+	if x != nil {
+		return x.PortForwardingHelper
+	}
+	return false
+}
+
+// Script represents a script to be run on the workspace.
+type Script struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	DisplayName      string `protobuf:"bytes,1,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	Icon             string `protobuf:"bytes,2,opt,name=icon,proto3" json:"icon,omitempty"`
+	Script           string `protobuf:"bytes,3,opt,name=script,proto3" json:"script,omitempty"`
+	Cron             string `protobuf:"bytes,4,opt,name=cron,proto3" json:"cron,omitempty"`
+	StartBlocksLogin bool   `protobuf:"varint,5,opt,name=start_blocks_login,json=startBlocksLogin,proto3" json:"start_blocks_login,omitempty"`
+	RunOnStart       bool   `protobuf:"varint,6,opt,name=run_on_start,json=runOnStart,proto3" json:"run_on_start,omitempty"`
+	RunOnStop        bool   `protobuf:"varint,7,opt,name=run_on_stop,json=runOnStop,proto3" json:"run_on_stop,omitempty"`
+	TimeoutSeconds   int32  `protobuf:"varint,8,opt,name=timeout_seconds,json=timeoutSeconds,proto3" json:"timeout_seconds,omitempty"`
+	LogPath          string `protobuf:"bytes,9,opt,name=log_path,json=logPath,proto3" json:"log_path,omitempty"`
+}
+
+func (x *Script) Reset() {
+	*x = Script{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Script) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Script) ProtoMessage() {}
+
+func (x *Script) ProtoReflect() protoreflect.Message {
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
 }
 
-func (x *Agent) GetShutdownScript() string {
+// Deprecated: Use Script.ProtoReflect.Descriptor instead.
+func (*Script) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *Script) GetDisplayName() string {
 	if x != nil {
-		return x.ShutdownScript
+		return x.DisplayName
 	}
 	return ""
 }
 
-func (x *Agent) GetShutdownScriptTimeoutSeconds() int32 {
+func (x *Script) GetIcon() string {
 	if x != nil {
-		return x.ShutdownScriptTimeoutSeconds
+		return x.Icon
 	}
-	return 0
+	return ""
 }
 
-func (x *Agent) GetMetadata() []*Agent_Metadata {
+func (x *Script) GetScript() string {
 	if x != nil {
-		return x.Metadata
+		return x.Script
 	}
-	return nil
+	return ""
 }
 
-func (x *Agent) GetStartupScriptBehavior() string {
+func (x *Script) GetCron() string {
 	if x != nil {
-		return x.StartupScriptBehavior
+		return x.Cron
 	}
 	return ""
 }
 
-type isAgent_Auth interface {
-	isAgent_Auth()
+func (x *Script) GetStartBlocksLogin() bool {
+	if x != nil {
+		return x.StartBlocksLogin
+	}
+	return false
 }
 
-type Agent_Token struct {
-	Token string `protobuf:"bytes,9,opt,name=token,proto3,oneof"`
+func (x *Script) GetRunOnStart() bool {
+	if x != nil {
+		return x.RunOnStart
+	}
+	return false
 }
 
-type Agent_InstanceId struct {
-	InstanceId string `protobuf:"bytes,10,opt,name=instance_id,json=instanceId,proto3,oneof"`
+func (x *Script) GetRunOnStop() bool {
+	if x != nil {
+		return x.RunOnStop
+	}
+	return false
 }
 
-func (*Agent_Token) isAgent_Auth() {}
+func (x *Script) GetTimeoutSeconds() int32 {
+	if x != nil {
+		return x.TimeoutSeconds
+	}
+	return 0
+}
 
-func (*Agent_InstanceId) isAgent_Auth() {}
+func (x *Script) GetLogPath() string {
+	if x != nil {
+		return x.LogPath
+	}
+	return ""
+}
 
 // App represents a dev-accessible application on the workspace.
 type App struct {
@@ -1053,7 +1224,7 @@ type App struct {
 func (x *App) Reset() {
 	*x = App{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[10]
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1066,7 +1237,7 @@ func (x *App) String() string {
 func (*App) ProtoMessage() {}
 
 func (x *App) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[10]
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1079,7 +1250,7 @@ func (x *App) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use App.ProtoReflect.Descriptor instead.
 func (*App) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{10}
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *App) GetSlug() string {
@@ -1159,7 +1330,7 @@ type Healthcheck struct {
 func (x *Healthcheck) Reset() {
 	*x = Healthcheck{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[11]
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1172,7 +1343,7 @@ func (x *Healthcheck) String() string {
 func (*Healthcheck) ProtoMessage() {}
 
 func (x *Healthcheck) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[11]
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1185,7 +1356,7 @@ func (x *Healthcheck) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Healthcheck.ProtoReflect.Descriptor instead.
 func (*Healthcheck) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{11}
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *Healthcheck) GetUrl() string {
@@ -1228,7 +1399,7 @@ type Resource struct {
 func (x *Resource) Reset() {
 	*x = Resource{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[12]
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1241,7 +1412,7 @@ func (x *Resource) String() string {
 func (*Resource) ProtoMessage() {}
 
 func (x *Resource) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[12]
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1254,7 +1425,7 @@ func (x *Resource) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Resource.ProtoReflect.Descriptor instead.
 func (*Resource) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{12}
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *Resource) GetName() string {
@@ -1313,30 +1484,43 @@ func (x *Resource) GetDailyCost() int32 {
 	return 0
 }
 
-// Parse consumes source-code from a directory to produce inputs.
-type Parse struct {
+// Metadata is information about a workspace used in the execution of a build
+type Metadata struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
+
+	CoderUrl                      string              `protobuf:"bytes,1,opt,name=coder_url,json=coderUrl,proto3" json:"coder_url,omitempty"`
+	WorkspaceTransition           WorkspaceTransition `protobuf:"varint,2,opt,name=workspace_transition,json=workspaceTransition,proto3,enum=provisioner.WorkspaceTransition" json:"workspace_transition,omitempty"`
+	WorkspaceName                 string              `protobuf:"bytes,3,opt,name=workspace_name,json=workspaceName,proto3" json:"workspace_name,omitempty"`
+	WorkspaceOwner                string              `protobuf:"bytes,4,opt,name=workspace_owner,json=workspaceOwner,proto3" json:"workspace_owner,omitempty"`
+	WorkspaceId                   string              `protobuf:"bytes,5,opt,name=workspace_id,json=workspaceId,proto3" json:"workspace_id,omitempty"`
+	WorkspaceOwnerId              string              `protobuf:"bytes,6,opt,name=workspace_owner_id,json=workspaceOwnerId,proto3" json:"workspace_owner_id,omitempty"`
+	WorkspaceOwnerEmail           string              `protobuf:"bytes,7,opt,name=workspace_owner_email,json=workspaceOwnerEmail,proto3" json:"workspace_owner_email,omitempty"`
+	TemplateName                  string              `protobuf:"bytes,8,opt,name=template_name,json=templateName,proto3" json:"template_name,omitempty"`
+	TemplateVersion               string              `protobuf:"bytes,9,opt,name=template_version,json=templateVersion,proto3" json:"template_version,omitempty"`
+	WorkspaceOwnerOidcAccessToken string              `protobuf:"bytes,10,opt,name=workspace_owner_oidc_access_token,json=workspaceOwnerOidcAccessToken,proto3" json:"workspace_owner_oidc_access_token,omitempty"`
+	WorkspaceOwnerSessionToken    string              `protobuf:"bytes,11,opt,name=workspace_owner_session_token,json=workspaceOwnerSessionToken,proto3" json:"workspace_owner_session_token,omitempty"`
+	TemplateId                    string              `protobuf:"bytes,12,opt,name=template_id,json=templateId,proto3" json:"template_id,omitempty"`
 }
 
-func (x *Parse) Reset() {
-	*x = Parse{}
+func (x *Metadata) Reset() {
+	*x = Metadata{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[13]
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Parse) String() string {
+func (x *Metadata) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Parse) ProtoMessage() {}
+func (*Metadata) ProtoMessage() {}
 
-func (x *Parse) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[13]
+func (x *Metadata) ProtoReflect() protoreflect.Message {
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1347,158 +1531,125 @@ func (x *Parse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Parse.ProtoReflect.Descriptor instead.
-func (*Parse) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{13}
+// Deprecated: Use Metadata.ProtoReflect.Descriptor instead.
+func (*Metadata) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{15}
 }
 
-// Provision consumes source-code from a directory to produce resources.
-// Exactly one of Plan or Apply must be provided in a single session.
-type Provision struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *Provision) Reset() {
-	*x = Provision{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[14]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
+func (x *Metadata) GetCoderUrl() string {
+	if x != nil {
+		return x.CoderUrl
 	}
+	return ""
 }
 
-func (x *Provision) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Provision) ProtoMessage() {}
-
-func (x *Provision) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[14]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
+func (x *Metadata) GetWorkspaceTransition() WorkspaceTransition {
+	if x != nil {
+		return x.WorkspaceTransition
 	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Provision.ProtoReflect.Descriptor instead.
-func (*Provision) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{14}
+	return WorkspaceTransition_START
 }
 
-type Agent_Metadata struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Key         string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
-	Script      string `protobuf:"bytes,3,opt,name=script,proto3" json:"script,omitempty"`
-	Interval    int64  `protobuf:"varint,4,opt,name=interval,proto3" json:"interval,omitempty"`
-	Timeout     int64  `protobuf:"varint,5,opt,name=timeout,proto3" json:"timeout,omitempty"`
+func (x *Metadata) GetWorkspaceName() string {
+	if x != nil {
+		return x.WorkspaceName
+	}
+	return ""
 }
 
-func (x *Agent_Metadata) Reset() {
-	*x = Agent_Metadata{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[15]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
+func (x *Metadata) GetWorkspaceOwner() string {
+	if x != nil {
+		return x.WorkspaceOwner
 	}
+	return ""
 }
 
-func (x *Agent_Metadata) String() string {
-	return protoimpl.X.MessageStringOf(x)
+func (x *Metadata) GetWorkspaceId() string {
+	if x != nil {
+		return x.WorkspaceId
+	}
+	return ""
 }
 
-func (*Agent_Metadata) ProtoMessage() {}
-
-func (x *Agent_Metadata) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[15]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
+func (x *Metadata) GetWorkspaceOwnerId() string {
+	if x != nil {
+		return x.WorkspaceOwnerId
 	}
-	return mi.MessageOf(x)
+	return ""
 }
 
-// Deprecated: Use Agent_Metadata.ProtoReflect.Descriptor instead.
-func (*Agent_Metadata) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{9, 0}
+func (x *Metadata) GetWorkspaceOwnerEmail() string {
+	if x != nil {
+		return x.WorkspaceOwnerEmail
+	}
+	return ""
 }
 
-func (x *Agent_Metadata) GetKey() string {
+func (x *Metadata) GetTemplateName() string {
 	if x != nil {
-		return x.Key
+		return x.TemplateName
 	}
 	return ""
 }
 
-func (x *Agent_Metadata) GetDisplayName() string {
+func (x *Metadata) GetTemplateVersion() string {
 	if x != nil {
-		return x.DisplayName
+		return x.TemplateVersion
 	}
 	return ""
 }
 
-func (x *Agent_Metadata) GetScript() string {
+func (x *Metadata) GetWorkspaceOwnerOidcAccessToken() string {
 	if x != nil {
-		return x.Script
+		return x.WorkspaceOwnerOidcAccessToken
 	}
 	return ""
 }
 
-func (x *Agent_Metadata) GetInterval() int64 {
+func (x *Metadata) GetWorkspaceOwnerSessionToken() string {
 	if x != nil {
-		return x.Interval
+		return x.WorkspaceOwnerSessionToken
 	}
-	return 0
+	return ""
 }
 
-func (x *Agent_Metadata) GetTimeout() int64 {
+func (x *Metadata) GetTemplateId() string {
 	if x != nil {
-		return x.Timeout
+		return x.TemplateId
 	}
-	return 0
+	return ""
 }
 
-type Resource_Metadata struct {
+// Config represents execution configuration shared by all subsequent requests in the Session
+type Config struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Key       string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-	Value     string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
-	Sensitive bool   `protobuf:"varint,3,opt,name=sensitive,proto3" json:"sensitive,omitempty"`
-	IsNull    bool   `protobuf:"varint,4,opt,name=is_null,json=isNull,proto3" json:"is_null,omitempty"`
+	// template_source_archive is a tar of the template source files
+	TemplateSourceArchive []byte `protobuf:"bytes,1,opt,name=template_source_archive,json=templateSourceArchive,proto3" json:"template_source_archive,omitempty"`
+	// state is the provisioner state (if any)
+	State               []byte `protobuf:"bytes,2,opt,name=state,proto3" json:"state,omitempty"`
+	ProvisionerLogLevel string `protobuf:"bytes,3,opt,name=provisioner_log_level,json=provisionerLogLevel,proto3" json:"provisioner_log_level,omitempty"`
 }
 
-func (x *Resource_Metadata) Reset() {
-	*x = Resource_Metadata{}
+func (x *Config) Reset() {
+	*x = Config{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[17]
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Resource_Metadata) String() string {
+func (x *Config) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Resource_Metadata) ProtoMessage() {}
+func (*Config) ProtoMessage() {}
 
-func (x *Resource_Metadata) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[17]
+func (x *Config) ProtoReflect() protoreflect.Message {
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1509,64 +1660,56 @@ func (x *Resource_Metadata) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Resource_Metadata.ProtoReflect.Descriptor instead.
-func (*Resource_Metadata) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{12, 0}
-}
-
-func (x *Resource_Metadata) GetKey() string {
-	if x != nil {
-		return x.Key
-	}
-	return ""
+// Deprecated: Use Config.ProtoReflect.Descriptor instead.
+func (*Config) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{16}
 }
 
-func (x *Resource_Metadata) GetValue() string {
+func (x *Config) GetTemplateSourceArchive() []byte {
 	if x != nil {
-		return x.Value
+		return x.TemplateSourceArchive
 	}
-	return ""
+	return nil
 }
 
-func (x *Resource_Metadata) GetSensitive() bool {
+func (x *Config) GetState() []byte {
 	if x != nil {
-		return x.Sensitive
+		return x.State
 	}
-	return false
+	return nil
 }
 
-func (x *Resource_Metadata) GetIsNull() bool {
+func (x *Config) GetProvisionerLogLevel() string {
 	if x != nil {
-		return x.IsNull
+		return x.ProvisionerLogLevel
 	}
-	return false
+	return ""
 }
 
-type Parse_Request struct {
+// ParseRequest consumes source-code to produce inputs.
+type ParseRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
-
-	Directory string `protobuf:"bytes,1,opt,name=directory,proto3" json:"directory,omitempty"`
 }
 
-func (x *Parse_Request) Reset() {
-	*x = Parse_Request{}
+func (x *ParseRequest) Reset() {
+	*x = ParseRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[18]
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Parse_Request) String() string {
+func (x *ParseRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Parse_Request) ProtoMessage() {}
+func (*ParseRequest) ProtoMessage() {}
 
-func (x *Parse_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[18]
+func (x *ParseRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1577,43 +1720,39 @@ func (x *Parse_Request) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Parse_Request.ProtoReflect.Descriptor instead.
-func (*Parse_Request) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{13, 0}
+// Deprecated: Use ParseRequest.ProtoReflect.Descriptor instead.
+func (*ParseRequest) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{17}
 }
 
-func (x *Parse_Request) GetDirectory() string {
-	if x != nil {
-		return x.Directory
-	}
-	return ""
-}
-
-type Parse_Complete struct {
+// ParseComplete indicates a request to parse completed.
+type ParseComplete struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	TemplateVariables []*TemplateVariable `protobuf:"bytes,1,rep,name=template_variables,json=templateVariables,proto3" json:"template_variables,omitempty"`
+	Error             string              `protobuf:"bytes,1,opt,name=error,proto3" json:"error,omitempty"`
+	TemplateVariables []*TemplateVariable `protobuf:"bytes,2,rep,name=template_variables,json=templateVariables,proto3" json:"template_variables,omitempty"`
+	Readme            []byte              `protobuf:"bytes,3,opt,name=readme,proto3" json:"readme,omitempty"`
 }
 
-func (x *Parse_Complete) Reset() {
-	*x = Parse_Complete{}
+func (x *ParseComplete) Reset() {
+	*x = ParseComplete{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[19]
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[18]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Parse_Complete) String() string {
+func (x *ParseComplete) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Parse_Complete) ProtoMessage() {}
+func (*ParseComplete) ProtoMessage() {}
 
-func (x *Parse_Complete) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[19]
+func (x *ParseComplete) ProtoReflect() protoreflect.Message {
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[18]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1624,47 +1763,61 @@ func (x *Parse_Complete) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Parse_Complete.ProtoReflect.Descriptor instead.
-func (*Parse_Complete) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{13, 1}
+// Deprecated: Use ParseComplete.ProtoReflect.Descriptor instead.
+func (*ParseComplete) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{18}
 }
 
-func (x *Parse_Complete) GetTemplateVariables() []*TemplateVariable {
+func (x *ParseComplete) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
+func (x *ParseComplete) GetTemplateVariables() []*TemplateVariable {
 	if x != nil {
 		return x.TemplateVariables
 	}
 	return nil
 }
 
-type Parse_Response struct {
+func (x *ParseComplete) GetReadme() []byte {
+	if x != nil {
+		return x.Readme
+	}
+	return nil
+}
+
+// PlanRequest asks the provisioner to plan what resources & parameters it will create
+type PlanRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// Types that are assignable to Type:
-	//
-	//	*Parse_Response_Log
-	//	*Parse_Response_Complete
-	Type isParse_Response_Type `protobuf_oneof:"type"`
+	Metadata              *Metadata               `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	RichParameterValues   []*RichParameterValue   `protobuf:"bytes,2,rep,name=rich_parameter_values,json=richParameterValues,proto3" json:"rich_parameter_values,omitempty"`
+	VariableValues        []*VariableValue        `protobuf:"bytes,3,rep,name=variable_values,json=variableValues,proto3" json:"variable_values,omitempty"`
+	ExternalAuthProviders []*ExternalAuthProvider `protobuf:"bytes,4,rep,name=external_auth_providers,json=externalAuthProviders,proto3" json:"external_auth_providers,omitempty"`
 }
 
-func (x *Parse_Response) Reset() {
-	*x = Parse_Response{}
+func (x *PlanRequest) Reset() {
+	*x = PlanRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[20]
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[19]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Parse_Response) String() string {
+func (x *PlanRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Parse_Response) ProtoMessage() {}
+func (*PlanRequest) ProtoMessage() {}
 
-func (x *Parse_Response) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[20]
+func (x *PlanRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[19]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1675,83 +1828,68 @@ func (x *Parse_Response) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Parse_Response.ProtoReflect.Descriptor instead.
-func (*Parse_Response) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{13, 2}
+// Deprecated: Use PlanRequest.ProtoReflect.Descriptor instead.
+func (*PlanRequest) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{19}
 }
 
-func (m *Parse_Response) GetType() isParse_Response_Type {
-	if m != nil {
-		return m.Type
+func (x *PlanRequest) GetMetadata() *Metadata {
+	if x != nil {
+		return x.Metadata
 	}
 	return nil
 }
 
-func (x *Parse_Response) GetLog() *Log {
-	if x, ok := x.GetType().(*Parse_Response_Log); ok {
-		return x.Log
+func (x *PlanRequest) GetRichParameterValues() []*RichParameterValue {
+	if x != nil {
+		return x.RichParameterValues
 	}
 	return nil
 }
 
-func (x *Parse_Response) GetComplete() *Parse_Complete {
-	if x, ok := x.GetType().(*Parse_Response_Complete); ok {
-		return x.Complete
+func (x *PlanRequest) GetVariableValues() []*VariableValue {
+	if x != nil {
+		return x.VariableValues
 	}
 	return nil
 }
 
-type isParse_Response_Type interface {
-	isParse_Response_Type()
-}
-
-type Parse_Response_Log struct {
-	Log *Log `protobuf:"bytes,1,opt,name=log,proto3,oneof"`
-}
-
-type Parse_Response_Complete struct {
-	Complete *Parse_Complete `protobuf:"bytes,2,opt,name=complete,proto3,oneof"`
+func (x *PlanRequest) GetExternalAuthProviders() []*ExternalAuthProvider {
+	if x != nil {
+		return x.ExternalAuthProviders
+	}
+	return nil
 }
 
-func (*Parse_Response_Log) isParse_Response_Type() {}
-
-func (*Parse_Response_Complete) isParse_Response_Type() {}
-
-type Provision_Metadata struct {
+// PlanComplete indicates a request to plan completed.
+type PlanComplete struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	CoderUrl                      string              `protobuf:"bytes,1,opt,name=coder_url,json=coderUrl,proto3" json:"coder_url,omitempty"`
-	WorkspaceTransition           WorkspaceTransition `protobuf:"varint,2,opt,name=workspace_transition,json=workspaceTransition,proto3,enum=provisioner.WorkspaceTransition" json:"workspace_transition,omitempty"`
-	WorkspaceName                 string              `protobuf:"bytes,3,opt,name=workspace_name,json=workspaceName,proto3" json:"workspace_name,omitempty"`
-	WorkspaceOwner                string              `protobuf:"bytes,4,opt,name=workspace_owner,json=workspaceOwner,proto3" json:"workspace_owner,omitempty"`
-	WorkspaceId                   string              `protobuf:"bytes,5,opt,name=workspace_id,json=workspaceId,proto3" json:"workspace_id,omitempty"`
-	WorkspaceOwnerId              string              `protobuf:"bytes,6,opt,name=workspace_owner_id,json=workspaceOwnerId,proto3" json:"workspace_owner_id,omitempty"`
-	WorkspaceOwnerEmail           string              `protobuf:"bytes,7,opt,name=workspace_owner_email,json=workspaceOwnerEmail,proto3" json:"workspace_owner_email,omitempty"`
-	TemplateName                  string              `protobuf:"bytes,8,opt,name=template_name,json=templateName,proto3" json:"template_name,omitempty"`
-	TemplateVersion               string              `protobuf:"bytes,9,opt,name=template_version,json=templateVersion,proto3" json:"template_version,omitempty"`
-	WorkspaceOwnerOidcAccessToken string              `protobuf:"bytes,10,opt,name=workspace_owner_oidc_access_token,json=workspaceOwnerOidcAccessToken,proto3" json:"workspace_owner_oidc_access_token,omitempty"`
-	WorkspaceOwnerSessionToken    string              `protobuf:"bytes,11,opt,name=workspace_owner_session_token,json=workspaceOwnerSessionToken,proto3" json:"workspace_owner_session_token,omitempty"`
+	Error                 string           `protobuf:"bytes,1,opt,name=error,proto3" json:"error,omitempty"`
+	Resources             []*Resource      `protobuf:"bytes,2,rep,name=resources,proto3" json:"resources,omitempty"`
+	Parameters            []*RichParameter `protobuf:"bytes,3,rep,name=parameters,proto3" json:"parameters,omitempty"`
+	ExternalAuthProviders []string         `protobuf:"bytes,4,rep,name=external_auth_providers,json=externalAuthProviders,proto3" json:"external_auth_providers,omitempty"`
 }
 
-func (x *Provision_Metadata) Reset() {
-	*x = Provision_Metadata{}
+func (x *PlanComplete) Reset() {
+	*x = PlanComplete{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[21]
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[20]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Provision_Metadata) String() string {
+func (x *PlanComplete) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Provision_Metadata) ProtoMessage() {}
+func (*PlanComplete) ProtoMessage() {}
 
-func (x *Provision_Metadata) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[21]
+func (x *PlanComplete) ProtoReflect() protoreflect.Message {
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[20]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1762,103 +1900,103 @@ func (x *Provision_Metadata) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Provision_Metadata.ProtoReflect.Descriptor instead.
-func (*Provision_Metadata) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{14, 0}
+// Deprecated: Use PlanComplete.ProtoReflect.Descriptor instead.
+func (*PlanComplete) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{20}
 }
 
-func (x *Provision_Metadata) GetCoderUrl() string {
+func (x *PlanComplete) GetError() string {
 	if x != nil {
-		return x.CoderUrl
+		return x.Error
 	}
 	return ""
 }
 
-func (x *Provision_Metadata) GetWorkspaceTransition() WorkspaceTransition {
+func (x *PlanComplete) GetResources() []*Resource {
 	if x != nil {
-		return x.WorkspaceTransition
+		return x.Resources
 	}
-	return WorkspaceTransition_START
+	return nil
 }
 
-func (x *Provision_Metadata) GetWorkspaceName() string {
+func (x *PlanComplete) GetParameters() []*RichParameter {
 	if x != nil {
-		return x.WorkspaceName
+		return x.Parameters
 	}
-	return ""
+	return nil
 }
 
-func (x *Provision_Metadata) GetWorkspaceOwner() string {
+func (x *PlanComplete) GetExternalAuthProviders() []string {
 	if x != nil {
-		return x.WorkspaceOwner
+		return x.ExternalAuthProviders
 	}
-	return ""
+	return nil
 }
 
-func (x *Provision_Metadata) GetWorkspaceId() string {
-	if x != nil {
-		return x.WorkspaceId
-	}
-	return ""
-}
+// ApplyRequest asks the provisioner to apply the changes.  Apply MUST be preceded by a successful plan request/response
+// in the same Session.  The plan data is not transmitted over the wire and is cached by the provisioner in the Session.
+type ApplyRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
 
-func (x *Provision_Metadata) GetWorkspaceOwnerId() string {
-	if x != nil {
-		return x.WorkspaceOwnerId
-	}
-	return ""
+	Metadata *Metadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
 }
 
-func (x *Provision_Metadata) GetWorkspaceOwnerEmail() string {
-	if x != nil {
-		return x.WorkspaceOwnerEmail
+func (x *ApplyRequest) Reset() {
+	*x = ApplyRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
 	}
-	return ""
 }
 
-func (x *Provision_Metadata) GetTemplateName() string {
-	if x != nil {
-		return x.TemplateName
-	}
-	return ""
+func (x *ApplyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
 }
 
-func (x *Provision_Metadata) GetTemplateVersion() string {
-	if x != nil {
-		return x.TemplateVersion
+func (*ApplyRequest) ProtoMessage() {}
+
+func (x *ApplyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
 	}
-	return ""
+	return mi.MessageOf(x)
 }
 
-func (x *Provision_Metadata) GetWorkspaceOwnerOidcAccessToken() string {
-	if x != nil {
-		return x.WorkspaceOwnerOidcAccessToken
-	}
-	return ""
+// Deprecated: Use ApplyRequest.ProtoReflect.Descriptor instead.
+func (*ApplyRequest) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{21}
 }
 
-func (x *Provision_Metadata) GetWorkspaceOwnerSessionToken() string {
+func (x *ApplyRequest) GetMetadata() *Metadata {
 	if x != nil {
-		return x.WorkspaceOwnerSessionToken
+		return x.Metadata
 	}
-	return ""
+	return nil
 }
 
-// Config represents execution configuration shared by both Plan and
-// Apply commands.
-type Provision_Config struct {
+// ApplyComplete indicates a request to apply completed.
+type ApplyComplete struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Directory           string              `protobuf:"bytes,1,opt,name=directory,proto3" json:"directory,omitempty"`
-	State               []byte              `protobuf:"bytes,2,opt,name=state,proto3" json:"state,omitempty"`
-	Metadata            *Provision_Metadata `protobuf:"bytes,3,opt,name=metadata,proto3" json:"metadata,omitempty"`
-	ProvisionerLogLevel string              `protobuf:"bytes,4,opt,name=provisioner_log_level,json=provisionerLogLevel,proto3" json:"provisioner_log_level,omitempty"`
+	State                 []byte           `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`
+	Error                 string           `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
+	Resources             []*Resource      `protobuf:"bytes,3,rep,name=resources,proto3" json:"resources,omitempty"`
+	Parameters            []*RichParameter `protobuf:"bytes,4,rep,name=parameters,proto3" json:"parameters,omitempty"`
+	ExternalAuthProviders []string         `protobuf:"bytes,5,rep,name=external_auth_providers,json=externalAuthProviders,proto3" json:"external_auth_providers,omitempty"`
 }
 
-func (x *Provision_Config) Reset() {
-	*x = Provision_Config{}
+func (x *ApplyComplete) Reset() {
+	*x = ApplyComplete{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[22]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -1866,13 +2004,13 @@ func (x *Provision_Config) Reset() {
 	}
 }
 
-func (x *Provision_Config) String() string {
+func (x *ApplyComplete) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Provision_Config) ProtoMessage() {}
+func (*ApplyComplete) ProtoMessage() {}
 
-func (x *Provision_Config) ProtoReflect() protoreflect.Message {
+func (x *ApplyComplete) ProtoReflect() protoreflect.Message {
 	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[22]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -1884,52 +2022,55 @@ func (x *Provision_Config) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Provision_Config.ProtoReflect.Descriptor instead.
-func (*Provision_Config) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{14, 1}
+// Deprecated: Use ApplyComplete.ProtoReflect.Descriptor instead.
+func (*ApplyComplete) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{22}
 }
 
-func (x *Provision_Config) GetDirectory() string {
+func (x *ApplyComplete) GetState() []byte {
 	if x != nil {
-		return x.Directory
+		return x.State
+	}
+	return nil
+}
+
+func (x *ApplyComplete) GetError() string {
+	if x != nil {
+		return x.Error
 	}
 	return ""
 }
 
-func (x *Provision_Config) GetState() []byte {
+func (x *ApplyComplete) GetResources() []*Resource {
 	if x != nil {
-		return x.State
+		return x.Resources
 	}
 	return nil
 }
 
-func (x *Provision_Config) GetMetadata() *Provision_Metadata {
+func (x *ApplyComplete) GetParameters() []*RichParameter {
 	if x != nil {
-		return x.Metadata
+		return x.Parameters
 	}
 	return nil
 }
 
-func (x *Provision_Config) GetProvisionerLogLevel() string {
+func (x *ApplyComplete) GetExternalAuthProviders() []string {
 	if x != nil {
-		return x.ProvisionerLogLevel
+		return x.ExternalAuthProviders
 	}
-	return ""
+	return nil
 }
 
-type Provision_Plan struct {
+// CancelRequest requests that the previous request be canceled gracefully.
+type CancelRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
-
-	Config              *Provision_Config     `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
-	RichParameterValues []*RichParameterValue `protobuf:"bytes,3,rep,name=rich_parameter_values,json=richParameterValues,proto3" json:"rich_parameter_values,omitempty"`
-	VariableValues      []*VariableValue      `protobuf:"bytes,4,rep,name=variable_values,json=variableValues,proto3" json:"variable_values,omitempty"`
-	GitAuthProviders    []*GitAuthProvider    `protobuf:"bytes,5,rep,name=git_auth_providers,json=gitAuthProviders,proto3" json:"git_auth_providers,omitempty"`
 }
 
-func (x *Provision_Plan) Reset() {
-	*x = Provision_Plan{}
+func (x *CancelRequest) Reset() {
+	*x = CancelRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[23]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -1937,13 +2078,13 @@ func (x *Provision_Plan) Reset() {
 	}
 }
 
-func (x *Provision_Plan) String() string {
+func (x *CancelRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Provision_Plan) ProtoMessage() {}
+func (*CancelRequest) ProtoMessage() {}
 
-func (x *Provision_Plan) ProtoReflect() protoreflect.Message {
+func (x *CancelRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[23]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -1955,50 +2096,28 @@ func (x *Provision_Plan) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Provision_Plan.ProtoReflect.Descriptor instead.
-func (*Provision_Plan) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{14, 2}
-}
-
-func (x *Provision_Plan) GetConfig() *Provision_Config {
-	if x != nil {
-		return x.Config
-	}
-	return nil
-}
-
-func (x *Provision_Plan) GetRichParameterValues() []*RichParameterValue {
-	if x != nil {
-		return x.RichParameterValues
-	}
-	return nil
-}
-
-func (x *Provision_Plan) GetVariableValues() []*VariableValue {
-	if x != nil {
-		return x.VariableValues
-	}
-	return nil
-}
-
-func (x *Provision_Plan) GetGitAuthProviders() []*GitAuthProvider {
-	if x != nil {
-		return x.GitAuthProviders
-	}
-	return nil
+// Deprecated: Use CancelRequest.ProtoReflect.Descriptor instead.
+func (*CancelRequest) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{23}
 }
 
-type Provision_Apply struct {
+type Request struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Config *Provision_Config `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
-	Plan   []byte            `protobuf:"bytes,2,opt,name=plan,proto3" json:"plan,omitempty"`
+	// Types that are assignable to Type:
+	//
+	//	*Request_Config
+	//	*Request_Parse
+	//	*Request_Plan
+	//	*Request_Apply
+	//	*Request_Cancel
+	Type isRequest_Type `protobuf_oneof:"type"`
 }
 
-func (x *Provision_Apply) Reset() {
-	*x = Provision_Apply{}
+func (x *Request) Reset() {
+	*x = Request{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[24]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -2006,13 +2125,13 @@ func (x *Provision_Apply) Reset() {
 	}
 }
 
-func (x *Provision_Apply) String() string {
+func (x *Request) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Provision_Apply) ProtoMessage() {}
+func (*Request) ProtoMessage() {}
 
-func (x *Provision_Apply) ProtoReflect() protoreflect.Message {
+func (x *Request) ProtoReflect() protoreflect.Message {
 	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[24]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -2024,93 +2143,118 @@ func (x *Provision_Apply) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Provision_Apply.ProtoReflect.Descriptor instead.
-func (*Provision_Apply) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{14, 3}
+// Deprecated: Use Request.ProtoReflect.Descriptor instead.
+func (*Request) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{24}
 }
 
-func (x *Provision_Apply) GetConfig() *Provision_Config {
-	if x != nil {
+func (m *Request) GetType() isRequest_Type {
+	if m != nil {
+		return m.Type
+	}
+	return nil
+}
+
+func (x *Request) GetConfig() *Config {
+	if x, ok := x.GetType().(*Request_Config); ok {
 		return x.Config
 	}
 	return nil
 }
 
-func (x *Provision_Apply) GetPlan() []byte {
-	if x != nil {
+func (x *Request) GetParse() *ParseRequest {
+	if x, ok := x.GetType().(*Request_Parse); ok {
+		return x.Parse
+	}
+	return nil
+}
+
+func (x *Request) GetPlan() *PlanRequest {
+	if x, ok := x.GetType().(*Request_Plan); ok {
 		return x.Plan
 	}
 	return nil
 }
 
-type Provision_Cancel struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
+func (x *Request) GetApply() *ApplyRequest {
+	if x, ok := x.GetType().(*Request_Apply); ok {
+		return x.Apply
+	}
+	return nil
 }
 
-func (x *Provision_Cancel) Reset() {
-	*x = Provision_Cancel{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[25]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
+func (x *Request) GetCancel() *CancelRequest {
+	if x, ok := x.GetType().(*Request_Cancel); ok {
+		return x.Cancel
 	}
+	return nil
 }
 
-func (x *Provision_Cancel) String() string {
-	return protoimpl.X.MessageStringOf(x)
+type isRequest_Type interface {
+	isRequest_Type()
 }
 
-func (*Provision_Cancel) ProtoMessage() {}
+type Request_Config struct {
+	Config *Config `protobuf:"bytes,1,opt,name=config,proto3,oneof"`
+}
 
-func (x *Provision_Cancel) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[25]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
+type Request_Parse struct {
+	Parse *ParseRequest `protobuf:"bytes,2,opt,name=parse,proto3,oneof"`
 }
 
-// Deprecated: Use Provision_Cancel.ProtoReflect.Descriptor instead.
-func (*Provision_Cancel) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{14, 4}
+type Request_Plan struct {
+	Plan *PlanRequest `protobuf:"bytes,3,opt,name=plan,proto3,oneof"`
 }
 
-type Provision_Request struct {
+type Request_Apply struct {
+	Apply *ApplyRequest `protobuf:"bytes,4,opt,name=apply,proto3,oneof"`
+}
+
+type Request_Cancel struct {
+	Cancel *CancelRequest `protobuf:"bytes,5,opt,name=cancel,proto3,oneof"`
+}
+
+func (*Request_Config) isRequest_Type() {}
+
+func (*Request_Parse) isRequest_Type() {}
+
+func (*Request_Plan) isRequest_Type() {}
+
+func (*Request_Apply) isRequest_Type() {}
+
+func (*Request_Cancel) isRequest_Type() {}
+
+type Response struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
 	// Types that are assignable to Type:
 	//
-	//	*Provision_Request_Plan
-	//	*Provision_Request_Apply
-	//	*Provision_Request_Cancel
-	Type isProvision_Request_Type `protobuf_oneof:"type"`
+	//	*Response_Log
+	//	*Response_Parse
+	//	*Response_Plan
+	//	*Response_Apply
+	Type isResponse_Type `protobuf_oneof:"type"`
 }
 
-func (x *Provision_Request) Reset() {
-	*x = Provision_Request{}
+func (x *Response) Reset() {
+	*x = Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[26]
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[25]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Provision_Request) String() string {
+func (x *Response) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Provision_Request) ProtoMessage() {}
+func (*Response) ProtoMessage() {}
 
-func (x *Provision_Request) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[26]
+func (x *Response) ProtoReflect() protoreflect.Message {
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[25]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2121,91 +2265,103 @@ func (x *Provision_Request) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Provision_Request.ProtoReflect.Descriptor instead.
-func (*Provision_Request) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{14, 5}
+// Deprecated: Use Response.ProtoReflect.Descriptor instead.
+func (*Response) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{25}
 }
 
-func (m *Provision_Request) GetType() isProvision_Request_Type {
+func (m *Response) GetType() isResponse_Type {
 	if m != nil {
 		return m.Type
 	}
 	return nil
 }
 
-func (x *Provision_Request) GetPlan() *Provision_Plan {
-	if x, ok := x.GetType().(*Provision_Request_Plan); ok {
-		return x.Plan
+func (x *Response) GetLog() *Log {
+	if x, ok := x.GetType().(*Response_Log); ok {
+		return x.Log
 	}
 	return nil
 }
 
-func (x *Provision_Request) GetApply() *Provision_Apply {
-	if x, ok := x.GetType().(*Provision_Request_Apply); ok {
-		return x.Apply
+func (x *Response) GetParse() *ParseComplete {
+	if x, ok := x.GetType().(*Response_Parse); ok {
+		return x.Parse
 	}
 	return nil
 }
 
-func (x *Provision_Request) GetCancel() *Provision_Cancel {
-	if x, ok := x.GetType().(*Provision_Request_Cancel); ok {
-		return x.Cancel
+func (x *Response) GetPlan() *PlanComplete {
+	if x, ok := x.GetType().(*Response_Plan); ok {
+		return x.Plan
+	}
+	return nil
+}
+
+func (x *Response) GetApply() *ApplyComplete {
+	if x, ok := x.GetType().(*Response_Apply); ok {
+		return x.Apply
 	}
 	return nil
 }
 
-type isProvision_Request_Type interface {
-	isProvision_Request_Type()
+type isResponse_Type interface {
+	isResponse_Type()
+}
+
+type Response_Log struct {
+	Log *Log `protobuf:"bytes,1,opt,name=log,proto3,oneof"`
 }
 
-type Provision_Request_Plan struct {
-	Plan *Provision_Plan `protobuf:"bytes,1,opt,name=plan,proto3,oneof"`
+type Response_Parse struct {
+	Parse *ParseComplete `protobuf:"bytes,2,opt,name=parse,proto3,oneof"`
 }
 
-type Provision_Request_Apply struct {
-	Apply *Provision_Apply `protobuf:"bytes,2,opt,name=apply,proto3,oneof"`
+type Response_Plan struct {
+	Plan *PlanComplete `protobuf:"bytes,3,opt,name=plan,proto3,oneof"`
 }
 
-type Provision_Request_Cancel struct {
-	Cancel *Provision_Cancel `protobuf:"bytes,3,opt,name=cancel,proto3,oneof"`
+type Response_Apply struct {
+	Apply *ApplyComplete `protobuf:"bytes,4,opt,name=apply,proto3,oneof"`
 }
 
-func (*Provision_Request_Plan) isProvision_Request_Type() {}
+func (*Response_Log) isResponse_Type() {}
 
-func (*Provision_Request_Apply) isProvision_Request_Type() {}
+func (*Response_Parse) isResponse_Type() {}
 
-func (*Provision_Request_Cancel) isProvision_Request_Type() {}
+func (*Response_Plan) isResponse_Type() {}
 
-type Provision_Complete struct {
+func (*Response_Apply) isResponse_Type() {}
+
+type Agent_Metadata struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	State            []byte           `protobuf:"bytes,1,opt,name=state,proto3" json:"state,omitempty"`
-	Error            string           `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
-	Resources        []*Resource      `protobuf:"bytes,3,rep,name=resources,proto3" json:"resources,omitempty"`
-	Parameters       []*RichParameter `protobuf:"bytes,4,rep,name=parameters,proto3" json:"parameters,omitempty"`
-	GitAuthProviders []string         `protobuf:"bytes,5,rep,name=git_auth_providers,json=gitAuthProviders,proto3" json:"git_auth_providers,omitempty"`
-	Plan             []byte           `protobuf:"bytes,6,opt,name=plan,proto3" json:"plan,omitempty"`
+	Key         string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+	Script      string `protobuf:"bytes,3,opt,name=script,proto3" json:"script,omitempty"`
+	Interval    int64  `protobuf:"varint,4,opt,name=interval,proto3" json:"interval,omitempty"`
+	Timeout     int64  `protobuf:"varint,5,opt,name=timeout,proto3" json:"timeout,omitempty"`
 }
 
-func (x *Provision_Complete) Reset() {
-	*x = Provision_Complete{}
+func (x *Agent_Metadata) Reset() {
+	*x = Agent_Metadata{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[27]
+		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[26]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Provision_Complete) String() string {
+func (x *Agent_Metadata) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Provision_Complete) ProtoMessage() {}
+func (*Agent_Metadata) ProtoMessage() {}
 
-func (x *Provision_Complete) ProtoReflect() protoreflect.Message {
-	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[27]
+func (x *Agent_Metadata) ProtoReflect() protoreflect.Message {
+	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[26]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2216,67 +2372,59 @@ func (x *Provision_Complete) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Provision_Complete.ProtoReflect.Descriptor instead.
-func (*Provision_Complete) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{14, 6}
-}
-
-func (x *Provision_Complete) GetState() []byte {
-	if x != nil {
-		return x.State
-	}
-	return nil
+// Deprecated: Use Agent_Metadata.ProtoReflect.Descriptor instead.
+func (*Agent_Metadata) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{9, 0}
 }
 
-func (x *Provision_Complete) GetError() string {
+func (x *Agent_Metadata) GetKey() string {
 	if x != nil {
-		return x.Error
+		return x.Key
 	}
 	return ""
 }
 
-func (x *Provision_Complete) GetResources() []*Resource {
+func (x *Agent_Metadata) GetDisplayName() string {
 	if x != nil {
-		return x.Resources
+		return x.DisplayName
 	}
-	return nil
+	return ""
 }
 
-func (x *Provision_Complete) GetParameters() []*RichParameter {
+func (x *Agent_Metadata) GetScript() string {
 	if x != nil {
-		return x.Parameters
+		return x.Script
 	}
-	return nil
+	return ""
 }
 
-func (x *Provision_Complete) GetGitAuthProviders() []string {
+func (x *Agent_Metadata) GetInterval() int64 {
 	if x != nil {
-		return x.GitAuthProviders
+		return x.Interval
 	}
-	return nil
+	return 0
 }
 
-func (x *Provision_Complete) GetPlan() []byte {
+func (x *Agent_Metadata) GetTimeout() int64 {
 	if x != nil {
-		return x.Plan
+		return x.Timeout
 	}
-	return nil
+	return 0
 }
 
-type Provision_Response struct {
+type Resource_Metadata struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// Types that are assignable to Type:
-	//
-	//	*Provision_Response_Log
-	//	*Provision_Response_Complete
-	Type isProvision_Response_Type `protobuf_oneof:"type"`
+	Key       string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	Value     string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+	Sensitive bool   `protobuf:"varint,3,opt,name=sensitive,proto3" json:"sensitive,omitempty"`
+	IsNull    bool   `protobuf:"varint,4,opt,name=is_null,json=isNull,proto3" json:"is_null,omitempty"`
 }
 
-func (x *Provision_Response) Reset() {
-	*x = Provision_Response{}
+func (x *Resource_Metadata) Reset() {
+	*x = Resource_Metadata{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[28]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -2284,13 +2432,13 @@ func (x *Provision_Response) Reset() {
 	}
 }
 
-func (x *Provision_Response) String() string {
+func (x *Resource_Metadata) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Provision_Response) ProtoMessage() {}
+func (*Resource_Metadata) ProtoMessage() {}
 
-func (x *Provision_Response) ProtoReflect() protoreflect.Message {
+func (x *Resource_Metadata) ProtoReflect() protoreflect.Message {
 	mi := &file_provisionersdk_proto_provisioner_proto_msgTypes[28]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -2302,48 +2450,39 @@ func (x *Provision_Response) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Provision_Response.ProtoReflect.Descriptor instead.
-func (*Provision_Response) Descriptor() ([]byte, []int) {
-	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{14, 7}
+// Deprecated: Use Resource_Metadata.ProtoReflect.Descriptor instead.
+func (*Resource_Metadata) Descriptor() ([]byte, []int) {
+	return file_provisionersdk_proto_provisioner_proto_rawDescGZIP(), []int{14, 0}
 }
 
-func (m *Provision_Response) GetType() isProvision_Response_Type {
-	if m != nil {
-		return m.Type
+func (x *Resource_Metadata) GetKey() string {
+	if x != nil {
+		return x.Key
 	}
-	return nil
+	return ""
 }
 
-func (x *Provision_Response) GetLog() *Log {
-	if x, ok := x.GetType().(*Provision_Response_Log); ok {
-		return x.Log
+func (x *Resource_Metadata) GetValue() string {
+	if x != nil {
+		return x.Value
 	}
-	return nil
+	return ""
 }
 
-func (x *Provision_Response) GetComplete() *Provision_Complete {
-	if x, ok := x.GetType().(*Provision_Response_Complete); ok {
-		return x.Complete
+func (x *Resource_Metadata) GetSensitive() bool {
+	if x != nil {
+		return x.Sensitive
 	}
-	return nil
-}
-
-type isProvision_Response_Type interface {
-	isProvision_Response_Type()
-}
-
-type Provision_Response_Log struct {
-	Log *Log `protobuf:"bytes,1,opt,name=log,proto3,oneof"`
+	return false
 }
 
-type Provision_Response_Complete struct {
-	Complete *Provision_Complete `protobuf:"bytes,2,opt,name=complete,proto3,oneof"`
+func (x *Resource_Metadata) GetIsNull() bool {
+	if x != nil {
+		return x.IsNull
+	}
+	return false
 }
 
-func (*Provision_Response_Log) isProvision_Response_Type() {}
-
-func (*Provision_Response_Complete) isProvision_Response_Type() {}
-
 var File_provisionersdk_proto_provisioner_proto protoreflect.FileDescriptor
 
 var file_provisionersdk_proto_provisioner_proto_rawDesc = []byte{
@@ -2428,269 +2567,301 @@ var file_provisionersdk_proto_provisioner_proto_rawDesc = []byte{
 	0x74, 0x61, 0x6e, 0x63, 0x65, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x41, 0x75, 0x74,
 	0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x5f, 0x69, 0x64,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65,
-	0x49, 0x64, 0x22, 0x44, 0x0a, 0x0f, 0x47, 0x69, 0x74, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f,
-	0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61, 0x63, 0x63,
-	0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xeb, 0x07, 0x0a, 0x05, 0x41, 0x67, 0x65,
-	0x6e, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
-	0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2d, 0x0a, 0x03, 0x65, 0x6e, 0x76, 0x18, 0x03, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
-	0x72, 0x2e, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x76, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x03, 0x65, 0x6e, 0x76, 0x12, 0x25, 0x0a, 0x0e, 0x73, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70,
-	0x5f, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x73,
-	0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x53, 0x63, 0x72, 0x69, 0x70, 0x74, 0x12, 0x29, 0x0a, 0x10,
-	0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6e, 0x67, 0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6e,
-	0x67, 0x53, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x12, 0x22, 0x0a, 0x0c, 0x61, 0x72, 0x63, 0x68, 0x69,
-	0x74, 0x65, 0x63, 0x74, 0x75, 0x72, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61,
-	0x72, 0x63, 0x68, 0x69, 0x74, 0x65, 0x63, 0x74, 0x75, 0x72, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x64,
-	0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
-	0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x24, 0x0a, 0x04, 0x61, 0x70, 0x70,
-	0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73,
-	0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x70, 0x70, 0x52, 0x04, 0x61, 0x70, 0x70, 0x73, 0x12,
-	0x16, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00,
-	0x52, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x21, 0x0a, 0x0b, 0x69, 0x6e, 0x73, 0x74, 0x61,
-	0x6e, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0a,
-	0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x49, 0x64, 0x12, 0x3c, 0x0a, 0x1a, 0x63, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74,
-	0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x05, 0x52, 0x18,
-	0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d, 0x65, 0x6f, 0x75,
-	0x74, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x2f, 0x0a, 0x13, 0x74, 0x72, 0x6f, 0x75,
-	0x62, 0x6c, 0x65, 0x73, 0x68, 0x6f, 0x6f, 0x74, 0x69, 0x6e, 0x67, 0x5f, 0x75, 0x72, 0x6c, 0x18,
-	0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x74, 0x72, 0x6f, 0x75, 0x62, 0x6c, 0x65, 0x73, 0x68,
-	0x6f, 0x6f, 0x74, 0x69, 0x6e, 0x67, 0x55, 0x72, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x6f, 0x74,
-	0x64, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d, 0x6f,
-	0x74, 0x64, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x43, 0x0a, 0x1e, 0x73, 0x74, 0x61, 0x72, 0x74, 0x75,
-	0x70, 0x5f, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74,
-	0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x05, 0x52, 0x1b,
-	0x73, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x53, 0x63, 0x72, 0x69, 0x70, 0x74, 0x54, 0x69, 0x6d,
-	0x65, 0x6f, 0x75, 0x74, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x73,
-	0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x5f, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x18, 0x10,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x73, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x53, 0x63,
-	0x72, 0x69, 0x70, 0x74, 0x12, 0x45, 0x0a, 0x1f, 0x73, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e,
-	0x5f, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x5f,
-	0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x11, 0x20, 0x01, 0x28, 0x05, 0x52, 0x1c, 0x73,
-	0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x53, 0x63, 0x72, 0x69, 0x70, 0x74, 0x54, 0x69, 0x6d,
-	0x65, 0x6f, 0x75, 0x74, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x37, 0x0a, 0x08, 0x6d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x12, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e,
-	0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x67, 0x65, 0x6e,
-	0x74, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x12, 0x36, 0x0a, 0x17, 0x73, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x5f,
-	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x5f, 0x62, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x18,
-	0x13, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x73, 0x74, 0x61, 0x72, 0x74, 0x75, 0x70, 0x53, 0x63,
-	0x72, 0x69, 0x70, 0x74, 0x42, 0x65, 0x68, 0x61, 0x76, 0x69, 0x6f, 0x72, 0x1a, 0x8d, 0x01, 0x0a,
-	0x08, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x21, 0x0a, 0x0c, 0x64,
-	0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0b, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x16,
+	0x49, 0x64, 0x22, 0x49, 0x0a, 0x14, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75,
+	0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0b, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xc3, 0x06,
+	0x0a, 0x05, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2d, 0x0a, 0x03, 0x65,
+	0x6e, 0x76, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x76,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x03, 0x65, 0x6e, 0x76, 0x12, 0x29, 0x0a, 0x10, 0x6f, 0x70,
+	0x65, 0x72, 0x61, 0x74, 0x69, 0x6e, 0x67, 0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6e, 0x67, 0x53,
+	0x79, 0x73, 0x74, 0x65, 0x6d, 0x12, 0x22, 0x0a, 0x0c, 0x61, 0x72, 0x63, 0x68, 0x69, 0x74, 0x65,
+	0x63, 0x74, 0x75, 0x72, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61, 0x72, 0x63,
+	0x68, 0x69, 0x74, 0x65, 0x63, 0x74, 0x75, 0x72, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x64, 0x69, 0x72,
+	0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64, 0x69,
+	0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x24, 0x0a, 0x04, 0x61, 0x70, 0x70, 0x73, 0x18,
+	0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
+	0x6e, 0x65, 0x72, 0x2e, 0x41, 0x70, 0x70, 0x52, 0x04, 0x61, 0x70, 0x70, 0x73, 0x12, 0x16, 0x0a,
+	0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x05,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x21, 0x0a, 0x0b, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0a, 0x69, 0x6e,
+	0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x49, 0x64, 0x12, 0x3c, 0x0a, 0x1a, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x5f, 0x73,
+	0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x05, 0x52, 0x18, 0x63, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x53,
+	0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x12, 0x2f, 0x0a, 0x13, 0x74, 0x72, 0x6f, 0x75, 0x62, 0x6c,
+	0x65, 0x73, 0x68, 0x6f, 0x6f, 0x74, 0x69, 0x6e, 0x67, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x0c, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x12, 0x74, 0x72, 0x6f, 0x75, 0x62, 0x6c, 0x65, 0x73, 0x68, 0x6f, 0x6f,
+	0x74, 0x69, 0x6e, 0x67, 0x55, 0x72, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x6f, 0x74, 0x64, 0x5f,
+	0x66, 0x69, 0x6c, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d, 0x6f, 0x74, 0x64,
+	0x46, 0x69, 0x6c, 0x65, 0x12, 0x37, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x18, 0x12, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
+	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x3b, 0x0a,
+	0x0c, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x5f, 0x61, 0x70, 0x70, 0x73, 0x18, 0x14, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
+	0x72, 0x2e, 0x44, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x41, 0x70, 0x70, 0x73, 0x52, 0x0b, 0x64,
+	0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x41, 0x70, 0x70, 0x73, 0x12, 0x2d, 0x0a, 0x07, 0x73, 0x63,
+	0x72, 0x69, 0x70, 0x74, 0x73, 0x18, 0x15, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x53, 0x63, 0x72, 0x69, 0x70, 0x74,
+	0x52, 0x07, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x73, 0x1a, 0x8d, 0x01, 0x0a, 0x08, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x69, 0x73, 0x70,
+	0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b,
+	0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12,
+	0x18, 0x0a, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x1a, 0x36, 0x0a, 0x08, 0x45, 0x6e, 0x76,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x42, 0x06, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x4a, 0x04, 0x08, 0x0e, 0x10, 0x0f, 0x52,
+	0x12, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x62, 0x65, 0x66, 0x6f, 0x72, 0x65, 0x5f, 0x72, 0x65,
+	0x61, 0x64, 0x79, 0x22, 0xc6, 0x01, 0x0a, 0x0b, 0x44, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x41,
+	0x70, 0x70, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x76, 0x73, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x06, 0x76, 0x73, 0x63, 0x6f, 0x64, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x76,
+	0x73, 0x63, 0x6f, 0x64, 0x65, 0x5f, 0x69, 0x6e, 0x73, 0x69, 0x64, 0x65, 0x72, 0x73, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x76, 0x73, 0x63, 0x6f, 0x64, 0x65, 0x49, 0x6e, 0x73, 0x69,
+	0x64, 0x65, 0x72, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x77, 0x65, 0x62, 0x5f, 0x74, 0x65, 0x72, 0x6d,
+	0x69, 0x6e, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x77, 0x65, 0x62, 0x54,
+	0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x73, 0x68, 0x5f, 0x68,
+	0x65, 0x6c, 0x70, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x73, 0x73, 0x68,
+	0x48, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x12, 0x34, 0x0a, 0x16, 0x70, 0x6f, 0x72, 0x74, 0x5f, 0x66,
+	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x5f, 0x68, 0x65, 0x6c, 0x70, 0x65, 0x72,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x70, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77,
+	0x61, 0x72, 0x64, 0x69, 0x6e, 0x67, 0x48, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x22, 0x9f, 0x02, 0x0a,
+	0x06, 0x53, 0x63, 0x72, 0x69, 0x70, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x69, 0x73, 0x70, 0x6c,
+	0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64,
+	0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x63,
+	0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x69, 0x63, 0x6f, 0x6e, 0x12, 0x16,
 	0x0a, 0x06, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
-	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76,
-	0x61, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76,
-	0x61, 0x6c, 0x12, 0x18, 0x0a, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x03, 0x52, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x1a, 0x36, 0x0a, 0x08,
-	0x45, 0x6e, 0x76, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x3a, 0x02, 0x38, 0x01, 0x42, 0x06, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x68, 0x4a, 0x04, 0x08, 0x0e,
-	0x10, 0x0f, 0x52, 0x12, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x62, 0x65, 0x66, 0x6f, 0x72, 0x65,
-	0x5f, 0x72, 0x65, 0x61, 0x64, 0x79, 0x22, 0xb5, 0x02, 0x0a, 0x03, 0x41, 0x70, 0x70, 0x12, 0x12,
-	0x0a, 0x04, 0x73, 0x6c, 0x75, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x73, 0x6c,
-	0x75, 0x67, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61,
-	0x79, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12,
-	0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72,
-	0x6c, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x63, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x69, 0x63, 0x6f, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x75, 0x62, 0x64, 0x6f, 0x6d, 0x61,
-	0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x73, 0x75, 0x62, 0x64, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x12, 0x3a, 0x0a, 0x0b, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x63, 0x68, 0x65,
-	0x63, 0x6b, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x63, 0x68, 0x65,
-	0x63, 0x6b, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x12,
-	0x41, 0x0a, 0x0d, 0x73, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c,
-	0x18, 0x08, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1c, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
-	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x70, 0x70, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x4c,
-	0x65, 0x76, 0x65, 0x6c, 0x52, 0x0c, 0x73, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x4c, 0x65, 0x76,
-	0x65, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x18, 0x09,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x22, 0x59,
-	0x0a, 0x0b, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x10, 0x0a,
-	0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12,
-	0x1a, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x05, 0x52, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x1c, 0x0a, 0x09, 0x74,
-	0x68, 0x72, 0x65, 0x73, 0x68, 0x6f, 0x6c, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x09,
-	0x74, 0x68, 0x72, 0x65, 0x73, 0x68, 0x6f, 0x6c, 0x64, 0x22, 0xf1, 0x02, 0x0a, 0x08, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79,
-	0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x2a,
-	0x0a, 0x06, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12,
-	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x67, 0x65,
-	0x6e, 0x74, 0x52, 0x06, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x3a, 0x0a, 0x08, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x69, 0x64, 0x65, 0x18, 0x05,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x68, 0x69, 0x64, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x63,
-	0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x69, 0x63, 0x6f, 0x6e, 0x12, 0x23,
-	0x0a, 0x0d, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x54,
-	0x79, 0x70, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x64, 0x61, 0x69, 0x6c, 0x79, 0x5f, 0x63, 0x6f, 0x73,
-	0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x64, 0x61, 0x69, 0x6c, 0x79, 0x43, 0x6f,
-	0x73, 0x74, 0x1a, 0x69, 0x0a, 0x08, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x10,
-	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
-	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x65, 0x6e, 0x73, 0x69, 0x74,
-	0x69, 0x76, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x73, 0x65, 0x6e, 0x73, 0x69,
-	0x74, 0x69, 0x76, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x69, 0x73, 0x5f, 0x6e, 0x75, 0x6c, 0x6c, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x69, 0x73, 0x4e, 0x75, 0x6c, 0x6c, 0x22, 0x85, 0x02,
-	0x0a, 0x05, 0x50, 0x61, 0x72, 0x73, 0x65, 0x1a, 0x27, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79,
-	0x1a, 0x5e, 0x0a, 0x08, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x4c, 0x0a, 0x12,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x63, 0x72, 0x6f, 0x6e, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x63, 0x72, 0x6f, 0x6e, 0x12, 0x2c, 0x0a, 0x12, 0x73, 0x74,
+	0x61, 0x72, 0x74, 0x5f, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x73, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x73, 0x74, 0x61, 0x72, 0x74, 0x42, 0x6c, 0x6f,
+	0x63, 0x6b, 0x73, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x20, 0x0a, 0x0c, 0x72, 0x75, 0x6e, 0x5f,
+	0x6f, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a,
+	0x72, 0x75, 0x6e, 0x4f, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x1e, 0x0a, 0x0b, 0x72, 0x75,
+	0x6e, 0x5f, 0x6f, 0x6e, 0x5f, 0x73, 0x74, 0x6f, 0x70, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x09, 0x72, 0x75, 0x6e, 0x4f, 0x6e, 0x53, 0x74, 0x6f, 0x70, 0x12, 0x27, 0x0a, 0x0f, 0x74, 0x69,
+	0x6d, 0x65, 0x6f, 0x75, 0x74, 0x5f, 0x73, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x73, 0x18, 0x08, 0x20,
+	0x01, 0x28, 0x05, 0x52, 0x0e, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x53, 0x65, 0x63, 0x6f,
+	0x6e, 0x64, 0x73, 0x12, 0x19, 0x0a, 0x08, 0x6c, 0x6f, 0x67, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x6f, 0x67, 0x50, 0x61, 0x74, 0x68, 0x22, 0xb5,
+	0x02, 0x0a, 0x03, 0x41, 0x70, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x6c, 0x75, 0x67, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x73, 0x6c, 0x75, 0x67, 0x12, 0x21, 0x0a, 0x0c, 0x64, 0x69,
+	0x73, 0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0b, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a,
+	0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x63, 0x6f,
+	0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x69, 0x63, 0x6f, 0x6e, 0x12, 0x1c, 0x0a,
+	0x09, 0x73, 0x75, 0x62, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x09, 0x73, 0x75, 0x62, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x3a, 0x0a, 0x0b, 0x68,
+	0x65, 0x61, 0x6c, 0x74, 0x68, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x18, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x48,
+	0x65, 0x61, 0x6c, 0x74, 0x68, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x52, 0x0b, 0x68, 0x65, 0x61, 0x6c,
+	0x74, 0x68, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x41, 0x0a, 0x0d, 0x73, 0x68, 0x61, 0x72, 0x69,
+	0x6e, 0x67, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1c,
+	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x70, 0x70,
+	0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x0c, 0x73, 0x68,
+	0x61, 0x72, 0x69, 0x6e, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x78,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x65, 0x78,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x22, 0x59, 0x0a, 0x0b, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68,
+	0x63, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x76, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x76, 0x61, 0x6c, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x68, 0x72, 0x65, 0x73, 0x68, 0x6f, 0x6c, 0x64,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x74, 0x68, 0x72, 0x65, 0x73, 0x68, 0x6f, 0x6c,
+	0x64, 0x22, 0xf1, 0x02, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x2a, 0x0a, 0x06, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
+	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x61, 0x67, 0x65, 0x6e,
+	0x74, 0x73, 0x12, 0x3a, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x04,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x12,
+	0x0a, 0x04, 0x68, 0x69, 0x64, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x68, 0x69,
+	0x64, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x63, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x69, 0x63, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x69,
+	0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x64,
+	0x61, 0x69, 0x6c, 0x79, 0x5f, 0x63, 0x6f, 0x73, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x05, 0x52,
+	0x09, 0x64, 0x61, 0x69, 0x6c, 0x79, 0x43, 0x6f, 0x73, 0x74, 0x1a, 0x69, 0x0a, 0x08, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1c,
+	0x0a, 0x09, 0x73, 0x65, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x09, 0x73, 0x65, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x12, 0x17, 0x0a, 0x07,
+	0x69, 0x73, 0x5f, 0x6e, 0x75, 0x6c, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x69,
+	0x73, 0x4e, 0x75, 0x6c, 0x6c, 0x22, 0xcf, 0x04, 0x0a, 0x08, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x55, 0x72, 0x6c, 0x12,
+	0x53, 0x0a, 0x14, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x74, 0x72, 0x61,
+	0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e,
+	0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x57, 0x6f, 0x72, 0x6b,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x13, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x25, 0x0a, 0x0e, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x77, 0x6f,
+	0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x77,
+	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f,
+	0x77, 0x6e, 0x65, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x77, 0x6f, 0x72, 0x6b,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x2c, 0x0a, 0x12, 0x77, 0x6f, 0x72, 0x6b, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x10, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77,
+	0x6e, 0x65, 0x72, 0x49, 0x64, 0x12, 0x32, 0x0a, 0x15, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x07,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f,
+	0x77, 0x6e, 0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x65, 0x6d,
+	0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0c, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x29,
+	0x0a, 0x10, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61,
+	0x74, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x48, 0x0a, 0x21, 0x77, 0x6f, 0x72,
+	0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x6f, 0x69, 0x64,
+	0x63, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x0a,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x1d, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f,
+	0x77, 0x6e, 0x65, 0x72, 0x4f, 0x69, 0x64, 0x63, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x12, 0x41, 0x0a, 0x1d, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65,
+	0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74,
+	0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x1a, 0x77, 0x6f, 0x72, 0x6b,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61,
+	0x74, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x74, 0x65, 0x6d,
+	0x70, 0x6c, 0x61, 0x74, 0x65, 0x49, 0x64, 0x22, 0x8a, 0x01, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x36, 0x0a, 0x17, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x61, 0x72, 0x63, 0x68, 0x69, 0x76, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x15, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x53, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x41, 0x72, 0x63, 0x68, 0x69, 0x76, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74,
+	0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65,
+	0x12, 0x32, 0x0a, 0x15, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x5f,
+	0x6c, 0x6f, 0x67, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x13, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x4c,
+	0x65, 0x76, 0x65, 0x6c, 0x22, 0x0e, 0x0a, 0x0c, 0x50, 0x61, 0x72, 0x73, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x22, 0x8b, 0x01, 0x0a, 0x0d, 0x50, 0x61, 0x72, 0x73, 0x65, 0x43, 0x6f,
+	0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x4c, 0x0a, 0x12,
 	0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c,
-	0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
 	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x56,
 	0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x11, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74,
-	0x65, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03,
-	0x1a, 0x73, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x24, 0x0a, 0x03,
-	0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4c, 0x6f, 0x67, 0x48, 0x00, 0x52, 0x03, 0x6c,
-	0x6f, 0x67, 0x12, 0x39, 0x0a, 0x08, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x73, 0x65, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74,
-	0x65, 0x48, 0x00, 0x52, 0x08, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x42, 0x06, 0x0a,
-	0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x91, 0x0d, 0x0a, 0x09, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73,
-	0x69, 0x6f, 0x6e, 0x1a, 0xae, 0x04, 0x0a, 0x08, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x55, 0x72, 0x6c, 0x12, 0x53, 0x0a,
-	0x14, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x74, 0x72, 0x61, 0x6e, 0x73,
-	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70,
-	0x61, 0x63, 0x65, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x77,
-	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x25, 0x0a, 0x0e, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b,
-	0x73, 0x70, 0x61, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x77, 0x6f, 0x72,
-	0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0e, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e,
-	0x65, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f,
-	0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70,
-	0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x2c, 0x0a, 0x12, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
-	0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x10, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65,
-	0x72, 0x49, 0x64, 0x12, 0x32, 0x0a, 0x15, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65,
-	0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x07, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x13, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e,
-	0x65, 0x72, 0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x65, 0x6d, 0x70, 0x6c,
-	0x61, 0x74, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
-	0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x29, 0x0a, 0x10,
-	0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
-	0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65,
-	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x48, 0x0a, 0x21, 0x77, 0x6f, 0x72, 0x6b, 0x73,
-	0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x6f, 0x69, 0x64, 0x63, 0x5f,
-	0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x0a, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x1d, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e,
-	0x65, 0x72, 0x4f, 0x69, 0x64, 0x63, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65,
-	0x6e, 0x12, 0x41, 0x0a, 0x1d, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f,
-	0x77, 0x6e, 0x65, 0x72, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b,
-	0x65, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x1a, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70,
-	0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54,
-	0x6f, 0x6b, 0x65, 0x6e, 0x1a, 0xad, 0x01, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
-	0x1c, 0x0a, 0x09, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x09, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x14, 0x0a,
-	0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x73, 0x74,
-	0x61, 0x74, 0x65, 0x12, 0x3b, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
-	0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x4d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x12, 0x32, 0x0a, 0x15, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x5f,
-	0x6c, 0x6f, 0x67, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x13, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x4c,
-	0x65, 0x76, 0x65, 0x6c, 0x1a, 0xa9, 0x02, 0x0a, 0x04, 0x50, 0x6c, 0x61, 0x6e, 0x12, 0x35, 0x0a,
-	0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
-	0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x12, 0x53, 0x0a, 0x15, 0x72, 0x69, 0x63, 0x68, 0x5f, 0x70, 0x61, 0x72,
-	0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
-	0x72, 0x2e, 0x52, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x52, 0x13, 0x72, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65,
-	0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x43, 0x0a, 0x0f, 0x76, 0x61, 0x72,
-	0x69, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
-	0x2e, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e,
-	0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x4a,
-	0x0a, 0x12, 0x67, 0x69, 0x74, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x64, 0x65, 0x72, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70, 0x72, 0x6f,
-	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x47, 0x69, 0x74, 0x41, 0x75, 0x74, 0x68,
-	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x10, 0x67, 0x69, 0x74, 0x41, 0x75, 0x74,
-	0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03,
-	0x1a, 0x52, 0x0a, 0x05, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x12, 0x35, 0x0a, 0x06, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
-	0x6e, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x12, 0x12, 0x0a, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04,
-	0x70, 0x6c, 0x61, 0x6e, 0x1a, 0x08, 0x0a, 0x06, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x1a, 0xb3,
-	0x01, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x31, 0x0a, 0x04, 0x70, 0x6c,
-	0x61, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x2e, 0x50, 0x6c, 0x61, 0x6e, 0x48, 0x00, 0x52, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x12, 0x34, 0x0a,
-	0x05, 0x61, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69,
-	0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x48, 0x00, 0x52, 0x05, 0x61, 0x70,
-	0x70, 0x6c, 0x79, 0x12, 0x37, 0x0a, 0x06, 0x63, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
-	0x72, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x43, 0x61, 0x6e, 0x63,
-	0x65, 0x6c, 0x48, 0x00, 0x52, 0x06, 0x63, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x42, 0x06, 0x0a, 0x04,
-	0x74, 0x79, 0x70, 0x65, 0x1a, 0xe9, 0x01, 0x0a, 0x08, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74,
-	0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x33, 0x0a,
-	0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x73, 0x12, 0x3a, 0x0a, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73,
-	0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
-	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74,
-	0x65, 0x72, 0x52, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12, 0x2c,
-	0x0a, 0x12, 0x67, 0x69, 0x74, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x64, 0x65, 0x72, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x10, 0x67, 0x69, 0x74, 0x41,
-	0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x12, 0x12, 0x0a, 0x04,
-	0x70, 0x6c, 0x61, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x70, 0x6c, 0x61, 0x6e,
-	0x1a, 0x77, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x24, 0x0a, 0x03,
-	0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4c, 0x6f, 0x67, 0x48, 0x00, 0x52, 0x03, 0x6c,
-	0x6f, 0x67, 0x12, 0x3d, 0x0a, 0x08, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x2e, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d,
-	0x70, 0x6c, 0x65, 0x74, 0x65, 0x48, 0x00, 0x52, 0x08, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74,
-	0x65, 0x42, 0x06, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x2a, 0x3f, 0x0a, 0x08, 0x4c, 0x6f, 0x67,
-	0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x09, 0x0a, 0x05, 0x54, 0x52, 0x41, 0x43, 0x45, 0x10, 0x00,
-	0x12, 0x09, 0x0a, 0x05, 0x44, 0x45, 0x42, 0x55, 0x47, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x49,
-	0x4e, 0x46, 0x4f, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x57, 0x41, 0x52, 0x4e, 0x10, 0x03, 0x12,
-	0x09, 0x0a, 0x05, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x04, 0x2a, 0x3b, 0x0a, 0x0f, 0x41, 0x70,
-	0x70, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x09, 0x0a,
-	0x05, 0x4f, 0x57, 0x4e, 0x45, 0x52, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x41, 0x55, 0x54, 0x48,
-	0x45, 0x4e, 0x54, 0x49, 0x43, 0x41, 0x54, 0x45, 0x44, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x50,
-	0x55, 0x42, 0x4c, 0x49, 0x43, 0x10, 0x02, 0x2a, 0x37, 0x0a, 0x13, 0x57, 0x6f, 0x72, 0x6b, 0x73,
-	0x70, 0x61, 0x63, 0x65, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x09,
-	0x0a, 0x05, 0x53, 0x54, 0x41, 0x52, 0x54, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x53, 0x54, 0x4f,
-	0x50, 0x10, 0x01, 0x12, 0x0b, 0x0a, 0x07, 0x44, 0x45, 0x53, 0x54, 0x52, 0x4f, 0x59, 0x10, 0x02,
-	0x32, 0xa3, 0x01, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
-	0x12, 0x42, 0x0a, 0x05, 0x50, 0x61, 0x72, 0x73, 0x65, 0x12, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x73, 0x65, 0x2e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
-	0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x73, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x30, 0x01, 0x12, 0x50, 0x0a, 0x09, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
-	0x6e, 0x12, 0x1e, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
-	0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
-	0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x42, 0x2d, 0x5a, 0x2b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72,
-	0x2f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x73, 0x64, 0x6b, 0x2f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65,
+	0x61, 0x64, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x72, 0x65, 0x61, 0x64,
+	0x6d, 0x65, 0x22, 0xb5, 0x02, 0x0a, 0x0b, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x31, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x65, 0x72, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x53, 0x0a, 0x15, 0x72, 0x69, 0x63, 0x68, 0x5f, 0x70, 0x61,
+	0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x65, 0x72, 0x2e, 0x52, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x13, 0x72, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d,
+	0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x43, 0x0a, 0x0f, 0x76, 0x61,
+	0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
+	0x72, 0x2e, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52,
+	0x0e, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12,
+	0x59, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x75, 0x74, 0x68,
+	0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x21, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x45,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74,
+	0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x22, 0xcd, 0x01, 0x0a, 0x0c, 0x50,
+	0x6c, 0x61, 0x6e, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65,
+	0x72, 0x72, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f,
+	0x72, 0x12, 0x33, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x3a, 0x0a, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65,
+	0x74, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72,
+	0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x52, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65,
+	0x72, 0x73, 0x12, 0x36, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61,
+	0x75, 0x74, 0x68, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74,
+	0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x22, 0x41, 0x0a, 0x0c, 0x41, 0x70,
+	0x70, 0x6c, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x31, 0x0a, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70,
+	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xe4, 0x01,
+	0x0a, 0x0d, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x12,
+	0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05,
+	0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x33, 0x0a, 0x09, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15,
+	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x12, 0x3a, 0x0a, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x18, 0x04,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x65, 0x72, 0x2e, 0x52, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72,
+	0x52, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12, 0x36, 0x0a, 0x17,
+	0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x15, 0x65,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x73, 0x22, 0x0f, 0x0a, 0x0d, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x8c, 0x02, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x2d, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x48, 0x00, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x12, 0x31, 0x0a, 0x05, 0x70, 0x61, 0x72, 0x73, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x19, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61,
+	0x72, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x05, 0x70, 0x61,
+	0x72, 0x73, 0x65, 0x12, 0x2e, 0x0a, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x18, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
+	0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x04, 0x70,
+	0x6c, 0x61, 0x6e, 0x12, 0x31, 0x0a, 0x05, 0x61, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
+	0x2e, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52,
+	0x05, 0x61, 0x70, 0x70, 0x6c, 0x79, 0x12, 0x34, 0x0a, 0x06, 0x63, 0x61, 0x6e, 0x63, 0x65, 0x6c,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
+	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x48, 0x00, 0x52, 0x06, 0x63, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x42, 0x06, 0x0a, 0x04,
+	0x74, 0x79, 0x70, 0x65, 0x22, 0xd1, 0x01, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x24, 0x0a, 0x03, 0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10,
+	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4c, 0x6f, 0x67,
+	0x48, 0x00, 0x52, 0x03, 0x6c, 0x6f, 0x67, 0x12, 0x32, 0x0a, 0x05, 0x70, 0x61, 0x72, 0x73, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
+	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x73, 0x65, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65,
+	0x74, 0x65, 0x48, 0x00, 0x52, 0x05, 0x70, 0x61, 0x72, 0x73, 0x65, 0x12, 0x2f, 0x0a, 0x04, 0x70,
+	0x6c, 0x61, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x6c, 0x61, 0x6e, 0x43, 0x6f, 0x6d, 0x70,
+	0x6c, 0x65, 0x74, 0x65, 0x48, 0x00, 0x52, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x12, 0x32, 0x0a, 0x05,
+	0x61, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x43,
+	0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x48, 0x00, 0x52, 0x05, 0x61, 0x70, 0x70, 0x6c, 0x79,
+	0x42, 0x06, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x2a, 0x3f, 0x0a, 0x08, 0x4c, 0x6f, 0x67, 0x4c,
+	0x65, 0x76, 0x65, 0x6c, 0x12, 0x09, 0x0a, 0x05, 0x54, 0x52, 0x41, 0x43, 0x45, 0x10, 0x00, 0x12,
+	0x09, 0x0a, 0x05, 0x44, 0x45, 0x42, 0x55, 0x47, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x4e,
+	0x46, 0x4f, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x57, 0x41, 0x52, 0x4e, 0x10, 0x03, 0x12, 0x09,
+	0x0a, 0x05, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x04, 0x2a, 0x3b, 0x0a, 0x0f, 0x41, 0x70, 0x70,
+	0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x09, 0x0a, 0x05,
+	0x4f, 0x57, 0x4e, 0x45, 0x52, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x41, 0x55, 0x54, 0x48, 0x45,
+	0x4e, 0x54, 0x49, 0x43, 0x41, 0x54, 0x45, 0x44, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x50, 0x55,
+	0x42, 0x4c, 0x49, 0x43, 0x10, 0x02, 0x2a, 0x37, 0x0a, 0x13, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x09, 0x0a,
+	0x05, 0x53, 0x54, 0x41, 0x52, 0x54, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x53, 0x54, 0x4f, 0x50,
+	0x10, 0x01, 0x12, 0x0b, 0x0a, 0x07, 0x44, 0x45, 0x53, 0x54, 0x52, 0x4f, 0x59, 0x10, 0x02, 0x32,
+	0x49, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x12, 0x3a,
+	0x0a, 0x07, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x14, 0x2e, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x42, 0x30, 0x5a, 0x2e, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x63,
+	0x6f, 0x64, 0x65, 0x72, 0x2f, 0x76, 0x32, 0x2f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
+	0x6e, 0x65, 0x72, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -2719,64 +2890,67 @@ var file_provisionersdk_proto_provisioner_proto_goTypes = []interface{}{
 	(*VariableValue)(nil),        // 8: provisioner.VariableValue
 	(*Log)(nil),                  // 9: provisioner.Log
 	(*InstanceIdentityAuth)(nil), // 10: provisioner.InstanceIdentityAuth
-	(*GitAuthProvider)(nil),      // 11: provisioner.GitAuthProvider
+	(*ExternalAuthProvider)(nil), // 11: provisioner.ExternalAuthProvider
 	(*Agent)(nil),                // 12: provisioner.Agent
-	(*App)(nil),                  // 13: provisioner.App
-	(*Healthcheck)(nil),          // 14: provisioner.Healthcheck
-	(*Resource)(nil),             // 15: provisioner.Resource
-	(*Parse)(nil),                // 16: provisioner.Parse
-	(*Provision)(nil),            // 17: provisioner.Provision
-	(*Agent_Metadata)(nil),       // 18: provisioner.Agent.Metadata
-	nil,                          // 19: provisioner.Agent.EnvEntry
-	(*Resource_Metadata)(nil),    // 20: provisioner.Resource.Metadata
-	(*Parse_Request)(nil),        // 21: provisioner.Parse.Request
-	(*Parse_Complete)(nil),       // 22: provisioner.Parse.Complete
-	(*Parse_Response)(nil),       // 23: provisioner.Parse.Response
-	(*Provision_Metadata)(nil),   // 24: provisioner.Provision.Metadata
-	(*Provision_Config)(nil),     // 25: provisioner.Provision.Config
-	(*Provision_Plan)(nil),       // 26: provisioner.Provision.Plan
-	(*Provision_Apply)(nil),      // 27: provisioner.Provision.Apply
-	(*Provision_Cancel)(nil),     // 28: provisioner.Provision.Cancel
-	(*Provision_Request)(nil),    // 29: provisioner.Provision.Request
-	(*Provision_Complete)(nil),   // 30: provisioner.Provision.Complete
-	(*Provision_Response)(nil),   // 31: provisioner.Provision.Response
+	(*DisplayApps)(nil),          // 13: provisioner.DisplayApps
+	(*Script)(nil),               // 14: provisioner.Script
+	(*App)(nil),                  // 15: provisioner.App
+	(*Healthcheck)(nil),          // 16: provisioner.Healthcheck
+	(*Resource)(nil),             // 17: provisioner.Resource
+	(*Metadata)(nil),             // 18: provisioner.Metadata
+	(*Config)(nil),               // 19: provisioner.Config
+	(*ParseRequest)(nil),         // 20: provisioner.ParseRequest
+	(*ParseComplete)(nil),        // 21: provisioner.ParseComplete
+	(*PlanRequest)(nil),          // 22: provisioner.PlanRequest
+	(*PlanComplete)(nil),         // 23: provisioner.PlanComplete
+	(*ApplyRequest)(nil),         // 24: provisioner.ApplyRequest
+	(*ApplyComplete)(nil),        // 25: provisioner.ApplyComplete
+	(*CancelRequest)(nil),        // 26: provisioner.CancelRequest
+	(*Request)(nil),              // 27: provisioner.Request
+	(*Response)(nil),             // 28: provisioner.Response
+	(*Agent_Metadata)(nil),       // 29: provisioner.Agent.Metadata
+	nil,                          // 30: provisioner.Agent.EnvEntry
+	(*Resource_Metadata)(nil),    // 31: provisioner.Resource.Metadata
 }
 var file_provisionersdk_proto_provisioner_proto_depIdxs = []int32{
 	5,  // 0: provisioner.RichParameter.options:type_name -> provisioner.RichParameterOption
 	0,  // 1: provisioner.Log.level:type_name -> provisioner.LogLevel
-	19, // 2: provisioner.Agent.env:type_name -> provisioner.Agent.EnvEntry
-	13, // 3: provisioner.Agent.apps:type_name -> provisioner.App
-	18, // 4: provisioner.Agent.metadata:type_name -> provisioner.Agent.Metadata
-	14, // 5: provisioner.App.healthcheck:type_name -> provisioner.Healthcheck
-	1,  // 6: provisioner.App.sharing_level:type_name -> provisioner.AppSharingLevel
-	12, // 7: provisioner.Resource.agents:type_name -> provisioner.Agent
-	20, // 8: provisioner.Resource.metadata:type_name -> provisioner.Resource.Metadata
-	4,  // 9: provisioner.Parse.Complete.template_variables:type_name -> provisioner.TemplateVariable
-	9,  // 10: provisioner.Parse.Response.log:type_name -> provisioner.Log
-	22, // 11: provisioner.Parse.Response.complete:type_name -> provisioner.Parse.Complete
-	2,  // 12: provisioner.Provision.Metadata.workspace_transition:type_name -> provisioner.WorkspaceTransition
-	24, // 13: provisioner.Provision.Config.metadata:type_name -> provisioner.Provision.Metadata
-	25, // 14: provisioner.Provision.Plan.config:type_name -> provisioner.Provision.Config
-	7,  // 15: provisioner.Provision.Plan.rich_parameter_values:type_name -> provisioner.RichParameterValue
-	8,  // 16: provisioner.Provision.Plan.variable_values:type_name -> provisioner.VariableValue
-	11, // 17: provisioner.Provision.Plan.git_auth_providers:type_name -> provisioner.GitAuthProvider
-	25, // 18: provisioner.Provision.Apply.config:type_name -> provisioner.Provision.Config
-	26, // 19: provisioner.Provision.Request.plan:type_name -> provisioner.Provision.Plan
-	27, // 20: provisioner.Provision.Request.apply:type_name -> provisioner.Provision.Apply
-	28, // 21: provisioner.Provision.Request.cancel:type_name -> provisioner.Provision.Cancel
-	15, // 22: provisioner.Provision.Complete.resources:type_name -> provisioner.Resource
-	6,  // 23: provisioner.Provision.Complete.parameters:type_name -> provisioner.RichParameter
-	9,  // 24: provisioner.Provision.Response.log:type_name -> provisioner.Log
-	30, // 25: provisioner.Provision.Response.complete:type_name -> provisioner.Provision.Complete
-	21, // 26: provisioner.Provisioner.Parse:input_type -> provisioner.Parse.Request
-	29, // 27: provisioner.Provisioner.Provision:input_type -> provisioner.Provision.Request
-	23, // 28: provisioner.Provisioner.Parse:output_type -> provisioner.Parse.Response
-	31, // 29: provisioner.Provisioner.Provision:output_type -> provisioner.Provision.Response
-	28, // [28:30] is the sub-list for method output_type
-	26, // [26:28] is the sub-list for method input_type
-	26, // [26:26] is the sub-list for extension type_name
-	26, // [26:26] is the sub-list for extension extendee
-	0,  // [0:26] is the sub-list for field type_name
+	30, // 2: provisioner.Agent.env:type_name -> provisioner.Agent.EnvEntry
+	15, // 3: provisioner.Agent.apps:type_name -> provisioner.App
+	29, // 4: provisioner.Agent.metadata:type_name -> provisioner.Agent.Metadata
+	13, // 5: provisioner.Agent.display_apps:type_name -> provisioner.DisplayApps
+	14, // 6: provisioner.Agent.scripts:type_name -> provisioner.Script
+	16, // 7: provisioner.App.healthcheck:type_name -> provisioner.Healthcheck
+	1,  // 8: provisioner.App.sharing_level:type_name -> provisioner.AppSharingLevel
+	12, // 9: provisioner.Resource.agents:type_name -> provisioner.Agent
+	31, // 10: provisioner.Resource.metadata:type_name -> provisioner.Resource.Metadata
+	2,  // 11: provisioner.Metadata.workspace_transition:type_name -> provisioner.WorkspaceTransition
+	4,  // 12: provisioner.ParseComplete.template_variables:type_name -> provisioner.TemplateVariable
+	18, // 13: provisioner.PlanRequest.metadata:type_name -> provisioner.Metadata
+	7,  // 14: provisioner.PlanRequest.rich_parameter_values:type_name -> provisioner.RichParameterValue
+	8,  // 15: provisioner.PlanRequest.variable_values:type_name -> provisioner.VariableValue
+	11, // 16: provisioner.PlanRequest.external_auth_providers:type_name -> provisioner.ExternalAuthProvider
+	17, // 17: provisioner.PlanComplete.resources:type_name -> provisioner.Resource
+	6,  // 18: provisioner.PlanComplete.parameters:type_name -> provisioner.RichParameter
+	18, // 19: provisioner.ApplyRequest.metadata:type_name -> provisioner.Metadata
+	17, // 20: provisioner.ApplyComplete.resources:type_name -> provisioner.Resource
+	6,  // 21: provisioner.ApplyComplete.parameters:type_name -> provisioner.RichParameter
+	19, // 22: provisioner.Request.config:type_name -> provisioner.Config
+	20, // 23: provisioner.Request.parse:type_name -> provisioner.ParseRequest
+	22, // 24: provisioner.Request.plan:type_name -> provisioner.PlanRequest
+	24, // 25: provisioner.Request.apply:type_name -> provisioner.ApplyRequest
+	26, // 26: provisioner.Request.cancel:type_name -> provisioner.CancelRequest
+	9,  // 27: provisioner.Response.log:type_name -> provisioner.Log
+	21, // 28: provisioner.Response.parse:type_name -> provisioner.ParseComplete
+	23, // 29: provisioner.Response.plan:type_name -> provisioner.PlanComplete
+	25, // 30: provisioner.Response.apply:type_name -> provisioner.ApplyComplete
+	27, // 31: provisioner.Provisioner.Session:input_type -> provisioner.Request
+	28, // 32: provisioner.Provisioner.Session:output_type -> provisioner.Response
+	32, // [32:33] is the sub-list for method output_type
+	31, // [31:32] is the sub-list for method input_type
+	31, // [31:31] is the sub-list for extension type_name
+	31, // [31:31] is the sub-list for extension extendee
+	0,  // [0:31] is the sub-list for field type_name
 }
 
 func init() { file_provisionersdk_proto_provisioner_proto_init() }
@@ -2882,7 +3056,7 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 			}
 		}
 		file_provisionersdk_proto_provisioner_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GitAuthProvider); i {
+			switch v := v.(*ExternalAuthProvider); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2906,7 +3080,7 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 			}
 		}
 		file_provisionersdk_proto_provisioner_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*App); i {
+			switch v := v.(*DisplayApps); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2918,7 +3092,7 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 			}
 		}
 		file_provisionersdk_proto_provisioner_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Healthcheck); i {
+			switch v := v.(*Script); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2930,7 +3104,7 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 			}
 		}
 		file_provisionersdk_proto_provisioner_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Resource); i {
+			switch v := v.(*App); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2942,7 +3116,7 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 			}
 		}
 		file_provisionersdk_proto_provisioner_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Parse); i {
+			switch v := v.(*Healthcheck); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2954,7 +3128,7 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 			}
 		}
 		file_provisionersdk_proto_provisioner_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Provision); i {
+			switch v := v.(*Resource); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2966,7 +3140,7 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 			}
 		}
 		file_provisionersdk_proto_provisioner_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Agent_Metadata); i {
+			switch v := v.(*Metadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2977,8 +3151,8 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 				return nil
 			}
 		}
-		file_provisionersdk_proto_provisioner_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Resource_Metadata); i {
+		file_provisionersdk_proto_provisioner_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Config); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2989,8 +3163,8 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 				return nil
 			}
 		}
-		file_provisionersdk_proto_provisioner_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Parse_Request); i {
+		file_provisionersdk_proto_provisioner_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ParseRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3001,8 +3175,8 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 				return nil
 			}
 		}
-		file_provisionersdk_proto_provisioner_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Parse_Complete); i {
+		file_provisionersdk_proto_provisioner_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ParseComplete); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3013,8 +3187,8 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 				return nil
 			}
 		}
-		file_provisionersdk_proto_provisioner_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Parse_Response); i {
+		file_provisionersdk_proto_provisioner_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PlanRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3025,8 +3199,8 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 				return nil
 			}
 		}
-		file_provisionersdk_proto_provisioner_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Provision_Metadata); i {
+		file_provisionersdk_proto_provisioner_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PlanComplete); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3037,8 +3211,8 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 				return nil
 			}
 		}
-		file_provisionersdk_proto_provisioner_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Provision_Config); i {
+		file_provisionersdk_proto_provisioner_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ApplyRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3049,8 +3223,8 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 				return nil
 			}
 		}
-		file_provisionersdk_proto_provisioner_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Provision_Plan); i {
+		file_provisionersdk_proto_provisioner_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ApplyComplete); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3061,8 +3235,8 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 				return nil
 			}
 		}
-		file_provisionersdk_proto_provisioner_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Provision_Apply); i {
+		file_provisionersdk_proto_provisioner_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CancelRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3073,8 +3247,8 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 				return nil
 			}
 		}
-		file_provisionersdk_proto_provisioner_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Provision_Cancel); i {
+		file_provisionersdk_proto_provisioner_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Request); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3085,8 +3259,8 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 				return nil
 			}
 		}
-		file_provisionersdk_proto_provisioner_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Provision_Request); i {
+		file_provisionersdk_proto_provisioner_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Response); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3097,8 +3271,8 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 				return nil
 			}
 		}
-		file_provisionersdk_proto_provisioner_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Provision_Complete); i {
+		file_provisionersdk_proto_provisioner_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Agent_Metadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3110,7 +3284,7 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 			}
 		}
 		file_provisionersdk_proto_provisioner_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Provision_Response); i {
+			switch v := v.(*Resource_Metadata); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -3127,18 +3301,18 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 		(*Agent_Token)(nil),
 		(*Agent_InstanceId)(nil),
 	}
-	file_provisionersdk_proto_provisioner_proto_msgTypes[20].OneofWrappers = []interface{}{
-		(*Parse_Response_Log)(nil),
-		(*Parse_Response_Complete)(nil),
-	}
-	file_provisionersdk_proto_provisioner_proto_msgTypes[26].OneofWrappers = []interface{}{
-		(*Provision_Request_Plan)(nil),
-		(*Provision_Request_Apply)(nil),
-		(*Provision_Request_Cancel)(nil),
-	}
-	file_provisionersdk_proto_provisioner_proto_msgTypes[28].OneofWrappers = []interface{}{
-		(*Provision_Response_Log)(nil),
-		(*Provision_Response_Complete)(nil),
+	file_provisionersdk_proto_provisioner_proto_msgTypes[24].OneofWrappers = []interface{}{
+		(*Request_Config)(nil),
+		(*Request_Parse)(nil),
+		(*Request_Plan)(nil),
+		(*Request_Apply)(nil),
+		(*Request_Cancel)(nil),
+	}
+	file_provisionersdk_proto_provisioner_proto_msgTypes[25].OneofWrappers = []interface{}{
+		(*Response_Log)(nil),
+		(*Response_Parse)(nil),
+		(*Response_Plan)(nil),
+		(*Response_Apply)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
diff --git a/provisionersdk/proto/provisioner.proto b/provisionersdk/proto/provisioner.proto
index 2b581f9620ce7..1682d75f606e2 100644
--- a/provisionersdk/proto/provisioner.proto
+++ b/provisionersdk/proto/provisioner.proto
@@ -1,6 +1,6 @@
 
 syntax = "proto3";
-option go_package = "github.com/coder/coder/provisionersdk/proto";
+option go_package = "github.com/coder/coder/v2/provisionersdk/proto";
 
 package provisioner;
 
@@ -81,9 +81,9 @@ message InstanceIdentityAuth {
     string instance_id = 1;
 }
 
-message GitAuthProvider {
-	string id = 1;
-	string access_token = 2;
+message ExternalAuthProvider {
+    string id = 1;
+    string access_token = 2;
 }
 
 // Agent represents a running agent on the workspace.
@@ -101,7 +101,7 @@ message Agent {
     string id = 1;
     string name = 2;
     map<string, string> env = 3;
-    string startup_script = 4;
+	// Field 4 was startup_script, now removed.
     string operating_system = 5;
     string architecture = 6;
     string directory = 7;
@@ -110,15 +110,15 @@ message Agent {
         string token = 9;
         string instance_id = 10;
     }
-	int32 connection_timeout_seconds = 11;
-	string troubleshooting_url = 12;
-	string motd_file = 13;
-	// Field 14 was bool login_before_ready = 14, now removed.
-	int32 startup_script_timeout_seconds = 15;
-	string shutdown_script = 16;
-	int32 shutdown_script_timeout_seconds = 17;
+    int32 connection_timeout_seconds = 11;
+    string troubleshooting_url = 12;
+    string motd_file = 13;
+    // Field 14 was bool login_before_ready = 14, now removed.
+	// Field 15, 16, 17 were related to scripts, which are now removed.
     repeated Metadata metadata = 18;
-	string startup_script_behavior = 19;
+	// Field 19 was startup_script_behavior, now removed.
+    DisplayApps display_apps = 20;
+	repeated Script scripts = 21;
 }
 
 enum AppSharingLevel {
@@ -127,6 +127,27 @@ enum AppSharingLevel {
     PUBLIC = 2;
 }
 
+message DisplayApps {
+    bool vscode = 1;
+    bool vscode_insiders = 2;
+    bool web_terminal = 3;
+    bool ssh_helper = 4;
+    bool port_forwarding_helper = 5;
+}
+
+// Script represents a script to be run on the workspace.
+message Script {
+	string display_name = 1;
+	string icon = 2;
+	string script = 3;
+	string cron = 4;
+	bool start_blocks_login = 5;
+	bool run_on_start = 6;
+	bool run_on_stop = 7;
+	int32 timeout_seconds = 8;
+	string log_path = 9;
+}
+
 // App represents a dev-accessible application on the workspace.
 message App {
     // slug is the unique identifier for the app, usually the name from the
@@ -168,96 +189,112 @@ message Resource {
     int32 daily_cost = 8;
 }
 
-// Parse consumes source-code from a directory to produce inputs.
-message Parse {
-    message Request {
-        string directory = 1;
-    }
-    message Complete {
-		reserved 2;
-
-        repeated TemplateVariable template_variables = 1;
-    }
-    message Response {
-        oneof type {
-            Log log = 1;
-            Complete complete = 2;
-        }
-    }
-}
-
+// WorkspaceTransition is the desired outcome of a build
 enum WorkspaceTransition {
     START = 0;
     STOP = 1;
     DESTROY = 2;
 }
 
-// Provision consumes source-code from a directory to produce resources.
-// Exactly one of Plan or Apply must be provided in a single session.
-message Provision {
-    message Metadata {
-        string coder_url = 1;
-        WorkspaceTransition workspace_transition = 2;
-        string workspace_name = 3;
-        string workspace_owner = 4;
-        string workspace_id = 5;
-        string workspace_owner_id = 6;
-        string workspace_owner_email = 7;
-        string template_name = 8;
-        string template_version = 9;
-        string workspace_owner_oidc_access_token = 10;
-        string workspace_owner_session_token = 11;
-    }
+// Metadata is information about a workspace used in the execution of a build
+message Metadata {
+    string coder_url = 1;
+    WorkspaceTransition workspace_transition = 2;
+    string workspace_name = 3;
+    string workspace_owner = 4;
+    string workspace_id = 5;
+    string workspace_owner_id = 6;
+    string workspace_owner_email = 7;
+    string template_name = 8;
+    string template_version = 9;
+    string workspace_owner_oidc_access_token = 10;
+    string workspace_owner_session_token = 11;
+    string template_id = 12;
+}
 
-    // Config represents execution configuration shared by both Plan and
-    // Apply commands.
-    message Config {
-        string directory = 1;
-        bytes state = 2;
-        Metadata metadata = 3;
+// Config represents execution configuration shared by all subsequent requests in the Session
+message Config {
+    // template_source_archive is a tar of the template source files
+    bytes template_source_archive = 1;
+    // state is the provisioner state (if any)
+    bytes state = 2;
+    string provisioner_log_level = 3;
+}
 
-        string provisioner_log_level = 4;
-    }
+// ParseRequest consumes source-code to produce inputs.
+message ParseRequest {
+}
 
-    message Plan {
-        reserved 2;
+// ParseComplete indicates a request to parse completed.
+message ParseComplete {
+    string error = 1;
+    repeated TemplateVariable template_variables = 2;
+    bytes readme = 3;
+}
 
-        Config config = 1;
-        repeated RichParameterValue rich_parameter_values = 3;
-        repeated VariableValue variable_values = 4;
-        repeated GitAuthProvider git_auth_providers = 5;
-    }
+// PlanRequest asks the provisioner to plan what resources & parameters it will create
+message PlanRequest {
+    Metadata metadata = 1;
+    repeated RichParameterValue rich_parameter_values = 2;
+    repeated VariableValue variable_values = 3;
+    repeated ExternalAuthProvider external_auth_providers = 4;
+}
+
+// PlanComplete indicates a request to plan completed.
+message PlanComplete {
+    string error = 1;
+    repeated Resource resources = 2;
+    repeated RichParameter parameters = 3;
+    repeated string external_auth_providers = 4;
+}
 
-    message Apply {
+// ApplyRequest asks the provisioner to apply the changes.  Apply MUST be preceded by a successful plan request/response
+// in the same Session.  The plan data is not transmitted over the wire and is cached by the provisioner in the Session.
+message ApplyRequest {
+    Metadata metadata = 1;
+}
+
+// ApplyComplete indicates a request to apply completed.
+message ApplyComplete {
+    bytes state = 1;
+    string error = 2;
+    repeated Resource resources = 3;
+    repeated RichParameter parameters = 4;
+    repeated string external_auth_providers = 5;
+}
+
+// CancelRequest requests that the previous request be canceled gracefully.
+message CancelRequest {}
+
+message Request {
+    oneof type {
         Config config = 1;
-        bytes plan = 2;
+        ParseRequest parse = 2;
+        PlanRequest plan = 3;
+        ApplyRequest apply = 4;
+        CancelRequest cancel = 5;
     }
+}
 
-    message Cancel {}
-    message Request {
-        oneof type {
-            Plan plan = 1;
-            Apply apply = 2;
-            Cancel cancel = 3;
-        }
-    }
-    message Complete {
-        bytes state = 1;
-        string error = 2;
-        repeated Resource resources = 3;
-        repeated RichParameter parameters = 4;
-        repeated string git_auth_providers = 5;
-        bytes plan = 6;
-    }
-    message Response {
-        oneof type {
-            Log log = 1;
-            Complete complete = 2;
-        }
+message Response {
+    oneof type {
+        Log log = 1;
+        ParseComplete parse = 2;
+        PlanComplete plan = 3;
+        ApplyComplete apply = 4;
     }
 }
 
 service Provisioner {
-    rpc Parse(Parse.Request) returns (stream Parse.Response);
-    rpc Provision(stream Provision.Request) returns (stream Provision.Response);
+    // Session represents provisioning a single template import or workspace.  The daemon always sends Config followed
+    // by one of the requests (ParseRequest, PlanRequest, ApplyRequest).  The provisioner should respond with a stream
+    // of zero or more Logs, followed by the corresponding complete message (ParseComplete, PlanComplete,
+    // ApplyComplete).  The daemon may then send a new request.  A request to apply MUST be preceded by a request plan,
+    // and the provisioner should store the plan data on the Session after a successful plan, so that the daemon may
+    // request an apply.  If the daemon closes the Session without an apply, the plan data may be safely discarded.
+    //
+    // The daemon may send a CancelRequest, asynchronously to ask the provisioner to cancel the previous ParseRequest,
+    // PlanRequest, or ApplyRequest.  The provisioner MUST reply with a complete message corresponding to the request
+    // that was canceled.  If the provisioner has already completed the request, it may ignore the CancelRequest.
+    rpc Session(stream Request) returns (stream Response);
 }
diff --git a/provisionersdk/proto/provisioner_drpc.pb.go b/provisionersdk/proto/provisioner_drpc.pb.go
index d8b40060cd376..de310e779dcaa 100644
--- a/provisionersdk/proto/provisioner_drpc.pb.go
+++ b/provisionersdk/proto/provisioner_drpc.pb.go
@@ -38,8 +38,7 @@ func (drpcEncoding_File_provisionersdk_proto_provisioner_proto) JSONUnmarshal(bu
 type DRPCProvisionerClient interface {
 	DRPCConn() drpc.Conn
 
-	Parse(ctx context.Context, in *Parse_Request) (DRPCProvisioner_ParseClient, error)
-	Provision(ctx context.Context) (DRPCProvisioner_ProvisionClient, error)
+	Session(ctx context.Context) (DRPCProvisioner_SessionClient, error)
 }
 
 type drpcProvisionerClient struct {
@@ -52,123 +51,69 @@ func NewDRPCProvisionerClient(cc drpc.Conn) DRPCProvisionerClient {
 
 func (c *drpcProvisionerClient) DRPCConn() drpc.Conn { return c.cc }
 
-func (c *drpcProvisionerClient) Parse(ctx context.Context, in *Parse_Request) (DRPCProvisioner_ParseClient, error) {
-	stream, err := c.cc.NewStream(ctx, "/provisioner.Provisioner/Parse", drpcEncoding_File_provisionersdk_proto_provisioner_proto{})
+func (c *drpcProvisionerClient) Session(ctx context.Context) (DRPCProvisioner_SessionClient, error) {
+	stream, err := c.cc.NewStream(ctx, "/provisioner.Provisioner/Session", drpcEncoding_File_provisionersdk_proto_provisioner_proto{})
 	if err != nil {
 		return nil, err
 	}
-	x := &drpcProvisioner_ParseClient{stream}
-	if err := x.MsgSend(in, drpcEncoding_File_provisionersdk_proto_provisioner_proto{}); err != nil {
-		return nil, err
-	}
-	if err := x.CloseSend(); err != nil {
-		return nil, err
-	}
+	x := &drpcProvisioner_SessionClient{stream}
 	return x, nil
 }
 
-type DRPCProvisioner_ParseClient interface {
+type DRPCProvisioner_SessionClient interface {
 	drpc.Stream
-	Recv() (*Parse_Response, error)
+	Send(*Request) error
+	Recv() (*Response, error)
 }
 
-type drpcProvisioner_ParseClient struct {
+type drpcProvisioner_SessionClient struct {
 	drpc.Stream
 }
 
-func (x *drpcProvisioner_ParseClient) GetStream() drpc.Stream {
+func (x *drpcProvisioner_SessionClient) GetStream() drpc.Stream {
 	return x.Stream
 }
 
-func (x *drpcProvisioner_ParseClient) Recv() (*Parse_Response, error) {
-	m := new(Parse_Response)
-	if err := x.MsgRecv(m, drpcEncoding_File_provisionersdk_proto_provisioner_proto{}); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-func (x *drpcProvisioner_ParseClient) RecvMsg(m *Parse_Response) error {
-	return x.MsgRecv(m, drpcEncoding_File_provisionersdk_proto_provisioner_proto{})
-}
-
-func (c *drpcProvisionerClient) Provision(ctx context.Context) (DRPCProvisioner_ProvisionClient, error) {
-	stream, err := c.cc.NewStream(ctx, "/provisioner.Provisioner/Provision", drpcEncoding_File_provisionersdk_proto_provisioner_proto{})
-	if err != nil {
-		return nil, err
-	}
-	x := &drpcProvisioner_ProvisionClient{stream}
-	return x, nil
-}
-
-type DRPCProvisioner_ProvisionClient interface {
-	drpc.Stream
-	Send(*Provision_Request) error
-	Recv() (*Provision_Response, error)
-}
-
-type drpcProvisioner_ProvisionClient struct {
-	drpc.Stream
-}
-
-func (x *drpcProvisioner_ProvisionClient) GetStream() drpc.Stream {
-	return x.Stream
-}
-
-func (x *drpcProvisioner_ProvisionClient) Send(m *Provision_Request) error {
+func (x *drpcProvisioner_SessionClient) Send(m *Request) error {
 	return x.MsgSend(m, drpcEncoding_File_provisionersdk_proto_provisioner_proto{})
 }
 
-func (x *drpcProvisioner_ProvisionClient) Recv() (*Provision_Response, error) {
-	m := new(Provision_Response)
+func (x *drpcProvisioner_SessionClient) Recv() (*Response, error) {
+	m := new(Response)
 	if err := x.MsgRecv(m, drpcEncoding_File_provisionersdk_proto_provisioner_proto{}); err != nil {
 		return nil, err
 	}
 	return m, nil
 }
 
-func (x *drpcProvisioner_ProvisionClient) RecvMsg(m *Provision_Response) error {
+func (x *drpcProvisioner_SessionClient) RecvMsg(m *Response) error {
 	return x.MsgRecv(m, drpcEncoding_File_provisionersdk_proto_provisioner_proto{})
 }
 
 type DRPCProvisionerServer interface {
-	Parse(*Parse_Request, DRPCProvisioner_ParseStream) error
-	Provision(DRPCProvisioner_ProvisionStream) error
+	Session(DRPCProvisioner_SessionStream) error
 }
 
 type DRPCProvisionerUnimplementedServer struct{}
 
-func (s *DRPCProvisionerUnimplementedServer) Parse(*Parse_Request, DRPCProvisioner_ParseStream) error {
-	return drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
-}
-
-func (s *DRPCProvisionerUnimplementedServer) Provision(DRPCProvisioner_ProvisionStream) error {
+func (s *DRPCProvisionerUnimplementedServer) Session(DRPCProvisioner_SessionStream) error {
 	return drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
 }
 
 type DRPCProvisionerDescription struct{}
 
-func (DRPCProvisionerDescription) NumMethods() int { return 2 }
+func (DRPCProvisionerDescription) NumMethods() int { return 1 }
 
 func (DRPCProvisionerDescription) Method(n int) (string, drpc.Encoding, drpc.Receiver, interface{}, bool) {
 	switch n {
 	case 0:
-		return "/provisioner.Provisioner/Parse", drpcEncoding_File_provisionersdk_proto_provisioner_proto{},
+		return "/provisioner.Provisioner/Session", drpcEncoding_File_provisionersdk_proto_provisioner_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return nil, srv.(DRPCProvisionerServer).
-					Parse(
-						in1.(*Parse_Request),
-						&drpcProvisioner_ParseStream{in2.(drpc.Stream)},
+					Session(
+						&drpcProvisioner_SessionStream{in1.(drpc.Stream)},
 					)
-			}, DRPCProvisionerServer.Parse, true
-	case 1:
-		return "/provisioner.Provisioner/Provision", drpcEncoding_File_provisionersdk_proto_provisioner_proto{},
-			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
-				return nil, srv.(DRPCProvisionerServer).
-					Provision(
-						&drpcProvisioner_ProvisionStream{in1.(drpc.Stream)},
-					)
-			}, DRPCProvisionerServer.Provision, true
+			}, DRPCProvisionerServer.Session, true
 	default:
 		return "", nil, nil, nil, false
 	}
@@ -178,41 +123,28 @@ func DRPCRegisterProvisioner(mux drpc.Mux, impl DRPCProvisionerServer) error {
 	return mux.Register(impl, DRPCProvisionerDescription{})
 }
 
-type DRPCProvisioner_ParseStream interface {
-	drpc.Stream
-	Send(*Parse_Response) error
-}
-
-type drpcProvisioner_ParseStream struct {
-	drpc.Stream
-}
-
-func (x *drpcProvisioner_ParseStream) Send(m *Parse_Response) error {
-	return x.MsgSend(m, drpcEncoding_File_provisionersdk_proto_provisioner_proto{})
-}
-
-type DRPCProvisioner_ProvisionStream interface {
+type DRPCProvisioner_SessionStream interface {
 	drpc.Stream
-	Send(*Provision_Response) error
-	Recv() (*Provision_Request, error)
+	Send(*Response) error
+	Recv() (*Request, error)
 }
 
-type drpcProvisioner_ProvisionStream struct {
+type drpcProvisioner_SessionStream struct {
 	drpc.Stream
 }
 
-func (x *drpcProvisioner_ProvisionStream) Send(m *Provision_Response) error {
+func (x *drpcProvisioner_SessionStream) Send(m *Response) error {
 	return x.MsgSend(m, drpcEncoding_File_provisionersdk_proto_provisioner_proto{})
 }
 
-func (x *drpcProvisioner_ProvisionStream) Recv() (*Provision_Request, error) {
-	m := new(Provision_Request)
+func (x *drpcProvisioner_SessionStream) Recv() (*Request, error) {
+	m := new(Request)
 	if err := x.MsgRecv(m, drpcEncoding_File_provisionersdk_proto_provisioner_proto{}); err != nil {
 		return nil, err
 	}
 	return m, nil
 }
 
-func (x *drpcProvisioner_ProvisionStream) RecvMsg(m *Provision_Request) error {
+func (x *drpcProvisioner_SessionStream) RecvMsg(m *Request) error {
 	return x.MsgRecv(m, drpcEncoding_File_provisionersdk_proto_provisioner_proto{})
 }
diff --git a/provisionersdk/scripts/bootstrap_linux.sh b/provisionersdk/scripts/bootstrap_linux.sh
old mode 100644
new mode 100755
index abd91d163d0e0..faf4b4a9bbfac
--- a/provisionersdk/scripts/bootstrap_linux.sh
+++ b/provisionersdk/scripts/bootstrap_linux.sh
@@ -43,6 +43,47 @@ if ! chmod +x $BINARY_NAME; then
 	exit 1
 fi
 
+haslibcap2() {
+	command -v setcap /dev/null 2>&1
+	command -v capsh /dev/null 2>&1
+}
+printnetadminmissing() {
+	echo "The root user does not have CAP_NET_ADMIN permission. " + \
+		"If running in Docker, add the capability to the container for " + \
+		"improved network performance."
+	echo "This has security implications. See https://man7.org/linux/man-pages/man7/capabilities.7.html"
+}
+
+# Attempt to add CAP_NET_ADMIN to the agent binary. This allows us to increase
+# network buffers which improves network transfer speeds.
+if [ -n "${USE_CAP_NET_ADMIN:-}" ]; then
+	# If running as root, we do not need to do anything.
+	if [ "$(id -u)" -eq 0 ]; then
+		echo "Running as root, skipping setcap"
+		# Warn the user if root does not have CAP_NET_ADMIN.
+		if ! capsh --has-p=CAP_NET_ADMIN; then
+			printnetadminmissing
+		fi
+
+	# If not running as root, make sure we have sudo perms and the "setcap" +
+	# "capsh" binaries exist.
+	elif sudo -nl && haslibcap2; then
+		# Make sure the root user has CAP_NET_ADMIN.
+		if sudo -n capsh --has-p=CAP_NET_ADMIN; then
+			sudo -n setcap CAP_NET_ADMIN=+ep ./$BINARY_NAME || true
+		else
+			printnetadminmissing
+		fi
+
+	# If we are not running as root, cant sudo, and "setcap" does not exist, we
+	# cannot do anything.
+	else
+		echo "Unable to setcap agent binary. To enable improved network performance, " + \
+			"give the agent passwordless sudo permissions and the \"setcap\" + \"capsh\" binaries."
+		echo "This has security implications. See https://man7.org/linux/man-pages/man7/capabilities.7.html"
+	fi
+fi
+
 export CODER_AGENT_AUTH="${AUTH_TYPE}"
 export CODER_AGENT_URL="${ACCESS_URL}"
 exec ./$BINARY_NAME agent
diff --git a/provisionersdk/serve.go b/provisionersdk/serve.go
index cb1647a54d1ac..baa3cc1412051 100644
--- a/provisionersdk/serve.go
+++ b/provisionersdk/serve.go
@@ -10,26 +10,42 @@ import (
 	"github.com/hashicorp/yamux"
 	"github.com/valyala/fasthttp/fasthttputil"
 	"golang.org/x/xerrors"
+	"storj.io/drpc"
 	"storj.io/drpc/drpcmux"
 	"storj.io/drpc/drpcserver"
 
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/provisionersdk/proto"
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
 // ServeOptions are configurations to serve a provisioner.
 type ServeOptions struct {
-	// Conn specifies a custom transport to serve the dRPC connection.
+	// Listener serves multiple connections. Cannot be combined with Conn.
 	Listener net.Listener
+	// Conn is a single connection to serve. Cannot be combined with Listener.
+	Conn          drpc.Transport
+	Logger        slog.Logger
+	WorkDirectory string
+}
+
+type Server interface {
+	Parse(s *Session, r *proto.ParseRequest, canceledOrComplete <-chan struct{}) *proto.ParseComplete
+	Plan(s *Session, r *proto.PlanRequest, canceledOrComplete <-chan struct{}) *proto.PlanComplete
+	Apply(s *Session, r *proto.ApplyRequest, canceledOrComplete <-chan struct{}) *proto.ApplyComplete
 }
 
 // Serve starts a dRPC connection for the provisioner and transport provided.
-func Serve(ctx context.Context, server proto.DRPCProvisionerServer, options *ServeOptions) error {
+func Serve(ctx context.Context, server Server, options *ServeOptions) error {
 	if options == nil {
 		options = &ServeOptions{}
 	}
-	// Default to using stdio.
-	if options.Listener == nil {
+	if options.Listener != nil && options.Conn != nil {
+		return xerrors.New("specify Listener or Conn, not both")
+	}
+	// Default to using stdio with yamux as a Listener
+	if options.Listener == nil && options.Conn == nil {
 		config := yamux.DefaultConfig()
 		config.LogOutput = io.Discard
 		stdio, err := yamux.Server(&readWriteCloser{
@@ -45,19 +61,32 @@ func Serve(ctx context.Context, server proto.DRPCProvisionerServer, options *Ser
 		}()
 		options.Listener = stdio
 	}
+	if options.WorkDirectory == "" {
+		var err error
+		options.WorkDirectory, err = os.MkdirTemp("", "coderprovisioner")
+		if err != nil {
+			return xerrors.Errorf("failed to init temp work dir: %w", err)
+		}
+	}
 
 	// dRPC is a drop-in replacement for gRPC with less generated code, and faster transports.
 	// See: https://www.storj.io/blog/introducing-drpc-our-replacement-for-grpc
 	mux := drpcmux.New()
-	err := proto.DRPCRegisterProvisioner(mux, server)
+	ps := &protoServer{
+		server: server,
+		opts:   *options,
+	}
+	err := proto.DRPCRegisterProvisioner(mux, ps)
 	if err != nil {
 		return xerrors.Errorf("register provisioner: %w", err)
 	}
 	srv := drpcserver.New(&tracing.DRPCHandler{Handler: mux})
-	// Only serve a single connection on the transport.
-	// Transports are not multiplexed, and provisioners are
-	// short-lived processes that can be executed concurrently.
-	err = srv.Serve(ctx, options.Listener)
+
+	if options.Listener != nil {
+		err = srv.Serve(ctx, options.Listener)
+	} else if options.Conn != nil {
+		err = srv.ServeOne(ctx, options.Conn)
+	}
 	if err != nil {
 		if errors.Is(err, io.EOF) ||
 			errors.Is(err, context.Canceled) ||
diff --git a/provisionersdk/serve_test.go b/provisionersdk/serve_test.go
index 28c7f0dfe5ef5..7ebfeb6f9b169 100644
--- a/provisionersdk/serve_test.go
+++ b/provisionersdk/serve_test.go
@@ -2,15 +2,17 @@ package provisionersdk_test
 
 import (
 	"context"
+	"net"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/goleak"
-	"storj.io/drpc/drpcerr"
+	"storj.io/drpc/drpcconn"
 
-	"github.com/coder/coder/provisionersdk"
-	"github.com/coder/coder/provisionersdk/proto"
+	"github.com/coder/coder/v2/provisionersdk"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
@@ -19,7 +21,7 @@ func TestMain(m *testing.M) {
 
 func TestProvisionerSDK(t *testing.T) {
 	t.Parallel()
-	t.Run("Serve", func(t *testing.T) {
+	t.Run("ServeListener", func(t *testing.T) {
 		t.Parallel()
 		client, server := provisionersdk.MemTransportPipe()
 		defer client.Close()
@@ -28,17 +30,37 @@ func TestProvisionerSDK(t *testing.T) {
 		ctx, cancelFunc := context.WithCancel(context.Background())
 		defer cancelFunc()
 		go func() {
-			err := provisionersdk.Serve(ctx, &proto.DRPCProvisionerUnimplementedServer{}, &provisionersdk.ServeOptions{
-				Listener: server,
+			err := provisionersdk.Serve(ctx, unimplementedServer{}, &provisionersdk.ServeOptions{
+				Listener:      server,
+				WorkDirectory: t.TempDir(),
 			})
 			assert.NoError(t, err)
 		}()
 
 		api := proto.NewDRPCProvisionerClient(client)
-		stream, err := api.Parse(context.Background(), &proto.Parse_Request{})
+		s, err := api.Session(ctx)
 		require.NoError(t, err)
-		_, err = stream.Recv()
-		require.Equal(t, drpcerr.Unimplemented, int(drpcerr.Code(err)))
+		err = s.Send(&proto.Request{Type: &proto.Request_Config{Config: &proto.Config{}}})
+		require.NoError(t, err)
+
+		err = s.Send(&proto.Request{Type: &proto.Request_Parse{Parse: &proto.ParseRequest{}}})
+		require.NoError(t, err)
+		msg, err := s.Recv()
+		require.NoError(t, err)
+		require.Equal(t, "unimplemented", msg.GetParse().GetError())
+
+		err = s.Send(&proto.Request{Type: &proto.Request_Plan{Plan: &proto.PlanRequest{}}})
+		require.NoError(t, err)
+		msg, err = s.Recv()
+		require.NoError(t, err)
+		// Plan has no error so that we're allowed to run Apply
+		require.Equal(t, "", msg.GetPlan().GetError())
+
+		err = s.Send(&proto.Request{Type: &proto.Request_Apply{Apply: &proto.ApplyRequest{}}})
+		require.NoError(t, err)
+		msg, err = s.Recv()
+		require.NoError(t, err)
+		require.Equal(t, "unimplemented", msg.GetApply().GetError())
 	})
 
 	t.Run("ServeClosedPipe", func(t *testing.T) {
@@ -47,9 +69,79 @@ func TestProvisionerSDK(t *testing.T) {
 		_ = client.Close()
 		_ = server.Close()
 
-		err := provisionersdk.Serve(context.Background(), &proto.DRPCProvisionerUnimplementedServer{}, &provisionersdk.ServeOptions{
-			Listener: server,
+		err := provisionersdk.Serve(context.Background(), unimplementedServer{}, &provisionersdk.ServeOptions{
+			Listener:      server,
+			WorkDirectory: t.TempDir(),
 		})
 		require.NoError(t, err)
 	})
+
+	t.Run("ServeConn", func(t *testing.T) {
+		t.Parallel()
+		client, server := net.Pipe()
+		defer client.Close()
+		defer server.Close()
+
+		ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitMedium)
+		defer cancelFunc()
+		srvErr := make(chan error, 1)
+		go func() {
+			err := provisionersdk.Serve(ctx, unimplementedServer{}, &provisionersdk.ServeOptions{
+				Conn:          server,
+				WorkDirectory: t.TempDir(),
+			})
+			srvErr <- err
+		}()
+
+		api := proto.NewDRPCProvisionerClient(drpcconn.New(client))
+		s, err := api.Session(ctx)
+		require.NoError(t, err)
+		err = s.Send(&proto.Request{Type: &proto.Request_Config{Config: &proto.Config{}}})
+		require.NoError(t, err)
+
+		err = s.Send(&proto.Request{Type: &proto.Request_Parse{Parse: &proto.ParseRequest{}}})
+		require.NoError(t, err)
+		msg, err := s.Recv()
+		require.NoError(t, err)
+		require.Equal(t, "unimplemented", msg.GetParse().GetError())
+
+		err = s.Send(&proto.Request{Type: &proto.Request_Plan{Plan: &proto.PlanRequest{}}})
+		require.NoError(t, err)
+		msg, err = s.Recv()
+		require.NoError(t, err)
+		// Plan has no error so that we're allowed to run Apply
+		require.Equal(t, "", msg.GetPlan().GetError())
+
+		err = s.Send(&proto.Request{Type: &proto.Request_Apply{Apply: &proto.ApplyRequest{}}})
+		require.NoError(t, err)
+		msg, err = s.Recv()
+		require.NoError(t, err)
+		require.Equal(t, "unimplemented", msg.GetApply().GetError())
+
+		// Check provisioner closes when the connection does
+		err = s.Close()
+		require.NoError(t, err)
+		err = api.DRPCConn().Close()
+		require.NoError(t, err)
+		select {
+		case <-ctx.Done():
+			t.Fatal("timeout waiting for provisioner")
+		case err = <-srvErr:
+			require.NoError(t, err)
+		}
+	})
+}
+
+type unimplementedServer struct{}
+
+func (unimplementedServer) Parse(_ *provisionersdk.Session, _ *proto.ParseRequest, _ <-chan struct{}) *proto.ParseComplete {
+	return &proto.ParseComplete{Error: "unimplemented"}
+}
+
+func (unimplementedServer) Plan(_ *provisionersdk.Session, _ *proto.PlanRequest, _ <-chan struct{}) *proto.PlanComplete {
+	return &proto.PlanComplete{}
+}
+
+func (unimplementedServer) Apply(_ *provisionersdk.Session, _ *proto.ApplyRequest, _ <-chan struct{}) *proto.ApplyComplete {
+	return &proto.ApplyComplete{Error: "unimplemented"}
 }
diff --git a/provisionersdk/session.go b/provisionersdk/session.go
new file mode 100644
index 0000000000000..d4b2935b5d95a
--- /dev/null
+++ b/provisionersdk/session.go
@@ -0,0 +1,343 @@
+package provisionersdk
+
+import (
+	"archive/tar"
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/spf13/afero"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/provisionersdk/proto"
+)
+
+const (
+	// ReadmeFile is the location we look for to extract documentation from template versions.
+	ReadmeFile = "README.md"
+
+	sessionDirPrefix      = "Session"
+	staleSessionRetention = 7 * 24 * time.Hour
+)
+
+// protoServer is a wrapper that translates the dRPC protocol into a Session with method calls into the Server.
+type protoServer struct {
+	server Server
+	opts   ServeOptions
+}
+
+func (p *protoServer) Session(stream proto.DRPCProvisioner_SessionStream) error {
+	sessID := uuid.New().String()
+	s := &Session{
+		Logger: p.opts.Logger.With(slog.F("session_id", sessID)),
+		stream: stream,
+		server: p.server,
+	}
+
+	err := CleanStaleSessions(s.Context(), p.opts.WorkDirectory, afero.NewOsFs(), time.Now(), s.Logger)
+	if err != nil {
+		return xerrors.Errorf("unable to clean stale sessions %q: %w", s.WorkDirectory, err)
+	}
+
+	s.WorkDirectory = filepath.Join(p.opts.WorkDirectory, SessionDir(sessID))
+	err = os.MkdirAll(s.WorkDirectory, 0o700)
+	if err != nil {
+		return xerrors.Errorf("create work directory %q: %w", s.WorkDirectory, err)
+	}
+	defer func() {
+		var err error
+		// Cleanup the work directory after execution.
+		for attempt := 0; attempt < 5; attempt++ {
+			err = os.RemoveAll(s.WorkDirectory)
+			if err != nil {
+				// On Windows, open files cannot be removed.
+				// When the provisioner daemon is shutting down,
+				// it may take a few milliseconds for processes to exit.
+				// See: https://github.com/golang/go/issues/50510
+				s.Logger.Debug(s.Context(), "failed to clean work directory; trying again", slog.Error(err))
+				time.Sleep(250 * time.Millisecond)
+				continue
+			}
+			s.Logger.Debug(s.Context(), "cleaned up work directory")
+			return
+		}
+		s.Logger.Error(s.Context(), "failed to clean up work directory after multiple attempts",
+			slog.F("path", s.WorkDirectory), slog.Error(err))
+	}()
+	req, err := stream.Recv()
+	if err != nil {
+		return xerrors.Errorf("receive config: %w", err)
+	}
+	config := req.GetConfig()
+	if config == nil {
+		return xerrors.New("first request must be Config")
+	}
+	s.Config = config
+	if s.Config.ProvisionerLogLevel != "" {
+		s.logLevel = proto.LogLevel_value[strings.ToUpper(s.Config.ProvisionerLogLevel)]
+	}
+
+	err = s.extractArchive()
+	if err != nil {
+		return xerrors.Errorf("extract archive: %w", err)
+	}
+	return s.handleRequests()
+}
+
+func (s *Session) requestReader(done <-chan struct{}) <-chan *proto.Request {
+	ch := make(chan *proto.Request)
+	go func() {
+		defer close(ch)
+		for {
+			req, err := s.stream.Recv()
+			if err != nil {
+				s.Logger.Info(s.Context(), "recv done on Session", slog.Error(err))
+				return
+			}
+			select {
+			case ch <- req:
+				continue
+			case <-done:
+				return
+			}
+		}
+	}()
+	return ch
+}
+
+func (s *Session) handleRequests() error {
+	done := make(chan struct{})
+	defer close(done)
+	requests := s.requestReader(done)
+	planned := false
+	for req := range requests {
+		if req.GetCancel() != nil {
+			s.Logger.Warn(s.Context(), "ignoring cancel before request or after complete")
+			continue
+		}
+		resp := &proto.Response{}
+		if parse := req.GetParse(); parse != nil {
+			r := &request[*proto.ParseRequest, *proto.ParseComplete]{
+				req:      parse,
+				session:  s,
+				serverFn: s.server.Parse,
+				cancels:  requests,
+			}
+			complete, err := r.do()
+			if err != nil {
+				return err
+			}
+			// Handle README centrally, so that individual provisioners don't need to mess with it.
+			readme, err := os.ReadFile(filepath.Join(s.WorkDirectory, ReadmeFile))
+			if err == nil {
+				complete.Readme = readme
+			} else {
+				s.Logger.Debug(s.Context(), "failed to parse readme (missing ok)", slog.Error(err))
+			}
+			resp.Type = &proto.Response_Parse{Parse: complete}
+		}
+		if plan := req.GetPlan(); plan != nil {
+			r := &request[*proto.PlanRequest, *proto.PlanComplete]{
+				req:      plan,
+				session:  s,
+				serverFn: s.server.Plan,
+				cancels:  requests,
+			}
+			complete, err := r.do()
+			if err != nil {
+				return err
+			}
+			resp.Type = &proto.Response_Plan{Plan: complete}
+			if complete.Error == "" {
+				planned = true
+			}
+		}
+		if apply := req.GetApply(); apply != nil {
+			if !planned {
+				return xerrors.New("cannot apply before successful plan")
+			}
+			r := &request[*proto.ApplyRequest, *proto.ApplyComplete]{
+				req:      apply,
+				session:  s,
+				serverFn: s.server.Apply,
+				cancels:  requests,
+			}
+			complete, err := r.do()
+			if err != nil {
+				return err
+			}
+			resp.Type = &proto.Response_Apply{Apply: complete}
+		}
+		err := s.stream.Send(resp)
+		if err != nil {
+			return xerrors.Errorf("send response: %w", err)
+		}
+	}
+	return nil
+}
+
+type Session struct {
+	Logger        slog.Logger
+	WorkDirectory string
+	Config        *proto.Config
+
+	server   Server
+	stream   proto.DRPCProvisioner_SessionStream
+	logLevel int32
+}
+
+func (s *Session) Context() context.Context {
+	return s.stream.Context()
+}
+
+func (s *Session) extractArchive() error {
+	ctx := s.Context()
+
+	s.Logger.Info(ctx, "unpacking template source archive",
+		slog.F("size_bytes", len(s.Config.TemplateSourceArchive)),
+	)
+
+	reader := tar.NewReader(bytes.NewBuffer(s.Config.TemplateSourceArchive))
+	// for safety, nil out the reference on Config, since the reader now owns it.
+	s.Config.TemplateSourceArchive = nil
+	for {
+		header, err := reader.Next()
+		if err != nil {
+			if xerrors.Is(err, io.EOF) {
+				break
+			}
+			return xerrors.Errorf("read template source archive: %w", err)
+		}
+		// Security: don't untar absolute or relative paths, as this can allow a malicious tar to overwrite
+		// files outside the workdir.
+		if !filepath.IsLocal(header.Name) {
+			return xerrors.Errorf("refusing to extract to non-local path")
+		}
+		// nolint: gosec
+		headerPath := filepath.Join(s.WorkDirectory, header.Name)
+		if !strings.HasPrefix(headerPath, filepath.Clean(s.WorkDirectory)) {
+			return xerrors.New("tar attempts to target relative upper directory")
+		}
+		mode := header.FileInfo().Mode()
+		if mode == 0 {
+			mode = 0o600
+		}
+
+		// Always check for context cancellation before reading the next header.
+		// This is mainly important for unit tests, since a canceled context means
+		// the underlying directory is going to be deleted. There still exists
+		// the small race condition that the context is canceled after this, and
+		// before the disk write.
+		if ctx.Err() != nil {
+			return xerrors.Errorf("context canceled: %w", ctx.Err())
+		}
+		switch header.Typeflag {
+		case tar.TypeDir:
+			err = os.MkdirAll(headerPath, mode)
+			if err != nil {
+				return xerrors.Errorf("mkdir %q: %w", headerPath, err)
+			}
+			s.Logger.Debug(context.Background(), "extracted directory",
+				slog.F("path", headerPath),
+				slog.F("mode", fmt.Sprintf("%O", mode)))
+		case tar.TypeReg:
+			file, err := os.OpenFile(headerPath, os.O_CREATE|os.O_RDWR, mode)
+			if err != nil {
+				return xerrors.Errorf("create file %q (mode %s): %w", headerPath, mode, err)
+			}
+			// Max file size of 10MiB.
+			size, err := io.CopyN(file, reader, 10<<20)
+			if xerrors.Is(err, io.EOF) {
+				err = nil
+			}
+			if err != nil {
+				_ = file.Close()
+				return xerrors.Errorf("copy file %q: %w", headerPath, err)
+			}
+			err = file.Close()
+			if err != nil {
+				return xerrors.Errorf("close file %q: %s", headerPath, err)
+			}
+			s.Logger.Debug(context.Background(), "extracted file",
+				slog.F("size_bytes", size),
+				slog.F("path", headerPath),
+				slog.F("mode", mode),
+			)
+		}
+	}
+	return nil
+}
+
+func (s *Session) ProvisionLog(level proto.LogLevel, output string) {
+	if int32(level) < s.logLevel {
+		return
+	}
+
+	err := s.stream.Send(&proto.Response{Type: &proto.Response_Log{Log: &proto.Log{
+		Level:  level,
+		Output: output,
+	}}})
+	if err != nil {
+		s.Logger.Error(s.Context(), "failed to transmit log",
+			slog.F("level", level), slog.F("output", output))
+	}
+}
+
+type pRequest interface {
+	*proto.ParseRequest | *proto.PlanRequest | *proto.ApplyRequest
+}
+
+type pComplete interface {
+	*proto.ParseComplete | *proto.PlanComplete | *proto.ApplyComplete
+}
+
+// request processes a single request call to the Server and returns its complete result, while also processing cancel
+// requests from the daemon.  Provisioner implementations read from canceledOrComplete to be asynchronously informed
+// of cancel.
+type request[R pRequest, C pComplete] struct {
+	req      R
+	session  *Session
+	cancels  <-chan *proto.Request
+	serverFn func(*Session, R, <-chan struct{}) C
+}
+
+func (r *request[R, C]) do() (C, error) {
+	canceledOrComplete := make(chan struct{})
+	result := make(chan C)
+	go func() {
+		c := r.serverFn(r.session, r.req, canceledOrComplete)
+		result <- c
+	}()
+	select {
+	case req := <-r.cancels:
+		close(canceledOrComplete)
+		// wait for server to complete the request, even though we have canceled,
+		// so that we can't start a new request, and so that if the job was close
+		// to completion and the cancel was ignored, we return to complete.
+		c := <-result
+		// verify we got a cancel instead of another request or closed channel --- which is an error!
+		if req.GetCancel() != nil {
+			return c, nil
+		}
+		if req == nil {
+			return c, xerrors.New("got nil while old request still processing")
+		}
+		return c, xerrors.Errorf("got new request %T while old request still processing", req.Type)
+	case c := <-result:
+		close(canceledOrComplete)
+		return c, nil
+	}
+}
+
+// SessionDir returns the directory name with mandatory prefix.
+func SessionDir(sessID string) string {
+	return sessionDirPrefix + sessID
+}
diff --git a/provisionersdk/transport.go b/provisionersdk/transport.go
index aa54efb0f36ba..f5df895d64eaa 100644
--- a/provisionersdk/transport.go
+++ b/provisionersdk/transport.go
@@ -10,7 +10,7 @@ import (
 	"storj.io/drpc"
 	"storj.io/drpc/drpcconn"
 
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 const (
@@ -19,7 +19,7 @@ const (
 	MaxMessageSize = 4 << 20
 )
 
-// MultiplexedConn returns a multiplexed dRPC connection from a yamux session.
+// MultiplexedConn returns a multiplexed dRPC connection from a yamux Session.
 func MultiplexedConn(session *yamux.Session) drpc.Conn {
 	return &multiplexedDRPC{session}
 }
diff --git a/pty/ptytest/ptytest.go b/pty/ptytest/ptytest.go
index a319fbdc9c168..6ee737563d2d4 100644
--- a/pty/ptytest/ptytest.go
+++ b/pty/ptytest/ptytest.go
@@ -18,9 +18,9 @@ import (
 	"golang.org/x/exp/slices"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/pty"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/pty"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func New(t *testing.T, opts ...pty.Option) *PTY {
@@ -350,22 +350,28 @@ func (e *outExpecter) fatalf(reason string, format string, args ...interface{})
 type PTY struct {
 	outExpecter
 	pty.PTY
+	closeOnce sync.Once
+	closeErr  error
 }
 
 func (p *PTY) Close() error {
 	p.t.Helper()
-	pErr := p.PTY.Close()
-	if pErr != nil {
-		p.logf("PTY: Close failed: %v", pErr)
-	}
-	eErr := p.outExpecter.close("PTY close")
-	if eErr != nil {
-		p.logf("PTY: close expecter failed: %v", eErr)
-	}
-	if pErr != nil {
-		return pErr
-	}
-	return eErr
+	p.closeOnce.Do(func() {
+		pErr := p.PTY.Close()
+		if pErr != nil {
+			p.logf("PTY: Close failed: %v", pErr)
+		}
+		eErr := p.outExpecter.close("PTY close")
+		if eErr != nil {
+			p.logf("PTY: close expecter failed: %v", eErr)
+		}
+		if pErr != nil {
+			p.closeErr = pErr
+			return
+		}
+		p.closeErr = eErr
+	})
+	return p.closeErr
 }
 
 func (p *PTY) Attach(inv *clibase.Invocation) *PTY {
diff --git a/pty/ptytest/ptytest_test.go b/pty/ptytest/ptytest_test.go
index 1935c7b5162ff..5a2f11ba728d7 100644
--- a/pty/ptytest/ptytest_test.go
+++ b/pty/ptytest/ptytest_test.go
@@ -8,9 +8,9 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/pty/ptytest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/pty/ptytest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestPtytest(t *testing.T) {
diff --git a/pty/start_other_test.go b/pty/start_other_test.go
index e7a2a3d69e327..63b6a36e8cea7 100644
--- a/pty/start_other_test.go
+++ b/pty/start_other_test.go
@@ -12,8 +12,8 @@ import (
 	"go.uber.org/goleak"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/pty"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/pty"
+	"github.com/coder/coder/v2/pty/ptytest"
 )
 
 func TestMain(m *testing.M) {
@@ -54,7 +54,7 @@ func TestStart(t *testing.T) {
 				Height: 24,
 			},
 		}))
-		pty, ps := ptytest.Start(t, pty.Command("env"), opts)
+		pty, ps := ptytest.Start(t, pty.Command(`/bin/sh`, `-c`, `env | grep SSH_TTY`), opts)
 		pty.ExpectMatch("SSH_TTY=/dev/")
 		err := ps.Wait()
 		require.NoError(t, err)
diff --git a/pty/start_test.go b/pty/start_test.go
index 5f273428d2ea6..dd3c8564a0ab0 100644
--- a/pty/start_test.go
+++ b/pty/start_test.go
@@ -5,16 +5,14 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"strings"
 	"testing"
 	"time"
 
-	"github.com/hinshun/vt10x"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/pty"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/pty"
+	"github.com/coder/coder/v2/testutil"
 )
 
 // Test_Start_copy tests that we can use io.Copy() on command output
@@ -69,11 +67,11 @@ func Test_Start_truncation(t *testing.T) {
 	readDone := make(chan struct{})
 	go func() {
 		defer close(readDone)
-		// avoid buffered IO so that we can precisely control how many bytes to read.
+		terminalReader := testutil.NewTerminalReader(t, pc.OutputReader())
 		n := 1
 		for n <= countEnd {
 			want := fmt.Sprintf("%d", n)
-			err := readUntil(ctx, t, want, pc.OutputReader())
+			err := terminalReader.ReadUntilString(ctx, want)
 			assert.NoError(t, err, "want: %s", want)
 			if err != nil {
 				return
@@ -141,36 +139,3 @@ func Test_Start_cancel_context(t *testing.T) {
 		t.Error("cmd.Wait() timed out")
 	}
 }
-
-// readUntil reads one byte at a time until we either see the string we want, or the context expires
-func readUntil(ctx context.Context, t *testing.T, want string, r io.Reader) error {
-	// output can contain virtual terminal sequences, so we need to parse these
-	// to correctly interpret getting what we want.
-	term := vt10x.New(vt10x.WithSize(80, 80))
-	readErrs := make(chan error, 1)
-	for {
-		b := make([]byte, 1)
-		go func() {
-			_, err := r.Read(b)
-			readErrs <- err
-		}()
-		select {
-		case err := <-readErrs:
-			if err != nil {
-				t.Logf("err: %v\ngot: %v", err, term)
-				return err
-			}
-			term.Write(b)
-		case <-ctx.Done():
-			return ctx.Err()
-		}
-		got := term.String()
-		lines := strings.Split(got, "\n")
-		for _, line := range lines {
-			if strings.TrimSpace(line) == want {
-				t.Logf("want: %v\n got:%v", want, line)
-				return nil
-			}
-		}
-	}
-}
diff --git a/pty/start_windows_test.go b/pty/start_windows_test.go
index b0f862ea15caf..280639cafe3fc 100644
--- a/pty/start_windows_test.go
+++ b/pty/start_windows_test.go
@@ -8,8 +8,8 @@ import (
 	"os/exec"
 	"testing"
 
-	"github.com/coder/coder/pty"
-	"github.com/coder/coder/pty/ptytest"
+	"github.com/coder/coder/v2/pty"
+	"github.com/coder/coder/v2/pty/ptytest"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/goleak"
diff --git a/scaletest/agentconn/config.go b/scaletest/agentconn/config.go
index 1d5de5cf7a6e0..be40626248be6 100644
--- a/scaletest/agentconn/config.go
+++ b/scaletest/agentconn/config.go
@@ -6,7 +6,7 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpapi"
 )
 
 type ConnectionMode string
diff --git a/scaletest/agentconn/config_test.go b/scaletest/agentconn/config_test.go
index 29ccfbf9739c2..5f5cdf7c53da7 100644
--- a/scaletest/agentconn/config_test.go
+++ b/scaletest/agentconn/config_test.go
@@ -7,8 +7,8 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/scaletest/agentconn"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/scaletest/agentconn"
 )
 
 func Test_Config(t *testing.T) {
diff --git a/scaletest/agentconn/run.go b/scaletest/agentconn/run.go
index 6593e7c79b52c..cc942448ff6d4 100644
--- a/scaletest/agentconn/run.go
+++ b/scaletest/agentconn/run.go
@@ -15,10 +15,10 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/scaletest/harness"
-	"github.com/coder/coder/scaletest/loadtestutil"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/loadtestutil"
 )
 
 const defaultRequestTimeout = 5 * time.Second
diff --git a/scaletest/agentconn/run_test.go b/scaletest/agentconn/run_test.go
index 537244af76dcc..1ce4dc1e5d015 100644
--- a/scaletest/agentconn/run_test.go
+++ b/scaletest/agentconn/run_test.go
@@ -13,16 +13,14 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/scaletest/agentconn"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/scaletest/agentconn"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func Test_Runner(t *testing.T) {
@@ -231,10 +229,10 @@ func setupRunnerTest(t *testing.T) (client *codersdk.Client, agentID uuid.UUID)
 	authToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:         echo.ParseComplete,
-		ProvisionPlan: echo.ProvisionComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionPlan: echo.PlanComplete,
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "example",
 						Type: "aws_instance",
@@ -253,21 +251,12 @@ func setupRunnerTest(t *testing.T) (client *codersdk.Client, agentID uuid.UUID)
 	})
 
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: slogtest.Make(t, nil).Named("agent"),
-	})
-	t.Cleanup(func() {
-		_ = agentCloser.Close()
-	})
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
+	_ = agenttest.New(t, client.URL, authToken)
 	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 	return client, resources[0].Agents[0].ID
 }
diff --git a/scaletest/createworkspaces/config.go b/scaletest/createworkspaces/config.go
index e1e92fb6e86c0..579d9b5288418 100644
--- a/scaletest/createworkspaces/config.go
+++ b/scaletest/createworkspaces/config.go
@@ -4,10 +4,10 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/scaletest/agentconn"
-	"github.com/coder/coder/scaletest/reconnectingpty"
-	"github.com/coder/coder/scaletest/workspacebuild"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/scaletest/agentconn"
+	"github.com/coder/coder/v2/scaletest/reconnectingpty"
+	"github.com/coder/coder/v2/scaletest/workspacebuild"
 )
 
 type UserConfig struct {
diff --git a/scaletest/createworkspaces/config_test.go b/scaletest/createworkspaces/config_test.go
index 298c5efab79d4..6a3d9e8104624 100644
--- a/scaletest/createworkspaces/config_test.go
+++ b/scaletest/createworkspaces/config_test.go
@@ -7,12 +7,12 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/scaletest/agentconn"
-	"github.com/coder/coder/scaletest/createworkspaces"
-	"github.com/coder/coder/scaletest/reconnectingpty"
-	"github.com/coder/coder/scaletest/workspacebuild"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/scaletest/agentconn"
+	"github.com/coder/coder/v2/scaletest/createworkspaces"
+	"github.com/coder/coder/v2/scaletest/reconnectingpty"
+	"github.com/coder/coder/v2/scaletest/workspacebuild"
 )
 
 func Test_UserConfig(t *testing.T) {
diff --git a/scaletest/createworkspaces/run.go b/scaletest/createworkspaces/run.go
index dd5465041062f..6793475012194 100644
--- a/scaletest/createworkspaces/run.go
+++ b/scaletest/createworkspaces/run.go
@@ -12,14 +12,14 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
 
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/scaletest/agentconn"
-	"github.com/coder/coder/scaletest/harness"
-	"github.com/coder/coder/scaletest/loadtestutil"
-	"github.com/coder/coder/scaletest/reconnectingpty"
-	"github.com/coder/coder/scaletest/workspacebuild"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/scaletest/agentconn"
+	"github.com/coder/coder/v2/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/loadtestutil"
+	"github.com/coder/coder/v2/scaletest/reconnectingpty"
+	"github.com/coder/coder/v2/scaletest/workspacebuild"
 )
 
 type Runner struct {
@@ -176,13 +176,14 @@ resourceLoop:
 }
 
 // Cleanup implements Cleanable.
-func (r *Runner) Cleanup(ctx context.Context, id string) error {
+func (r *Runner) Cleanup(ctx context.Context, id string, logs io.Writer) error {
 	if r.cfg.NoCleanup {
+		_, _ = fmt.Fprintln(logs, "skipping cleanup")
 		return nil
 	}
 
 	if r.workspacebuildRunner != nil {
-		err := r.workspacebuildRunner.Cleanup(ctx, id)
+		err := r.workspacebuildRunner.Cleanup(ctx, id, logs)
 		if err != nil {
 			return xerrors.Errorf("cleanup workspace: %w", err)
 		}
@@ -191,6 +192,7 @@ func (r *Runner) Cleanup(ctx context.Context, id string) error {
 	if r.userID != uuid.Nil {
 		err := r.client.DeleteUser(ctx, r.userID)
 		if err != nil {
+			_, _ = fmt.Fprintf(logs, "failed to delete user %q: %v\n", r.userID.String(), err)
 			return xerrors.Errorf("delete user: %w", err)
 		}
 	}
diff --git a/scaletest/createworkspaces/run_test.go b/scaletest/createworkspaces/run_test.go
index ac9812dccf3ce..88e1e59cd9f37 100644
--- a/scaletest/createworkspaces/run_test.go
+++ b/scaletest/createworkspaces/run_test.go
@@ -13,18 +13,19 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/scaletest/agentconn"
-	"github.com/coder/coder/scaletest/createworkspaces"
-	"github.com/coder/coder/scaletest/reconnectingpty"
-	"github.com/coder/coder/scaletest/workspacebuild"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/util/ptr"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/scaletest/agentconn"
+	"github.com/coder/coder/v2/scaletest/createworkspaces"
+	"github.com/coder/coder/v2/scaletest/reconnectingpty"
+	"github.com/coder/coder/v2/scaletest/workspacebuild"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func Test_Runner(t *testing.T) {
@@ -33,6 +34,19 @@ func Test_Runner(t *testing.T) {
 		t.Skip("Race detector enabled, skipping time-sensitive test.")
 	}
 
+	testParameters := []*proto.RichParameter{
+		{
+			Name:         "foo",
+			DefaultValue: "baz",
+		},
+	}
+	testParameterValues := []codersdk.WorkspaceBuildParameter{
+		{
+			Name:  "foo",
+			Value: "baz",
+		},
+	}
+
 	t.Run("OK", func(t *testing.T) {
 		t.Parallel()
 
@@ -46,11 +60,19 @@ func Test_Runner(t *testing.T) {
 
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{
+			Parse: echo.ParseComplete,
+			ProvisionPlan: []*proto.Response{
+				{
+					Type: &proto.Response_Plan{
+						Plan: &proto.PlanComplete{
+							Parameters: testParameters,
+						},
+					},
+				},
+			},
+			ProvisionApply: []*proto.Response{
 				{
-					Type: &proto.Provision_Response_Log{
+					Type: &proto.Response_Log{
 						Log: &proto.Log{
 							Level:  proto.LogLevel_INFO,
 							Output: "hello from logs",
@@ -58,8 +80,8 @@ func Test_Runner(t *testing.T) {
 					},
 				},
 				{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
 							Resources: []*proto.Resource{
 								{
 									Name: "example",
@@ -82,11 +104,10 @@ func Test_Runner(t *testing.T) {
 			},
 		})
 
-		version = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		version = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 
-		closer := goEventuallyStartFakeAgent(ctx, t, client, authToken)
-		t.Cleanup(closer)
+		closerCh := goEventuallyStartFakeAgent(ctx, t, client, authToken)
 
 		const (
 			username = "scaletest-user"
@@ -101,7 +122,8 @@ func Test_Runner(t *testing.T) {
 			Workspace: workspacebuild.Config{
 				OrganizationID: user.OrganizationID,
 				Request: codersdk.CreateWorkspaceRequest{
-					TemplateID: template.ID,
+					TemplateID:          template.ID,
+					RichParameterValues: testParameterValues,
 				},
 			},
 			ReconnectingPTY: &reconnectingpty.Config{
@@ -124,6 +146,10 @@ func Test_Runner(t *testing.T) {
 		t.Log("Runner logs:\n\n" + logsStr)
 		require.NoError(t, err)
 
+		// Wait for the workspace agent to start.
+		closer := <-closerCh
+		t.Cleanup(func() { _ = closer.Close() })
+
 		// Ensure a user and workspace were created.
 		users, err := client.Users(ctx, codersdk.UsersRequest{})
 		require.NoError(t, err)
@@ -132,6 +158,13 @@ func Test_Runner(t *testing.T) {
 		require.NoError(t, err)
 		require.Len(t, workspaces.Workspaces, 1)
 
+		// Ensure the correct build parameters were used.
+		buildParams, err := client.WorkspaceBuildParameters(ctx, workspaces.Workspaces[0].LatestBuild.ID)
+		require.NoError(t, err)
+		require.Len(t, buildParams, 1)
+		require.Equal(t, testParameterValues[0].Name, buildParams[0].Name)
+		require.Equal(t, testParameterValues[0].Value, buildParams[0].Value)
+
 		// Look for strings in the logs.
 		require.Contains(t, logsStr, "Generating user password...")
 		require.Contains(t, logsStr, "Creating user:")
@@ -144,8 +177,13 @@ func Test_Runner(t *testing.T) {
 		require.Contains(t, logsStr, "Opening reconnecting PTY connection to agent")
 		require.Contains(t, logsStr, "Opening connection to workspace agent")
 
-		err = runner.Cleanup(ctx, "1")
+		cleanupLogs := bytes.NewBuffer(nil)
+		err = runner.Cleanup(ctx, "1", cleanupLogs)
 		require.NoError(t, err)
+		cleanupLogsStr := cleanupLogs.String()
+		require.Contains(t, cleanupLogsStr, "deleting workspace")
+		require.NotContains(t, cleanupLogsStr, "canceling workspace build") // The build should have already completed.
+		require.Contains(t, cleanupLogsStr, "Build succeeded!")
 
 		// Ensure the user and workspace were deleted.
 		users, err = client.Users(ctx, codersdk.UsersRequest{})
@@ -156,6 +194,147 @@ func Test_Runner(t *testing.T) {
 		require.Len(t, workspaces.Workspaces, 0)
 	})
 
+	t.Run("CleanupPendingBuild", func(t *testing.T) {
+		t.Parallel()
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		// need to include our own logger because the provisioner (rightly) drops error logs when we shut down the
+		// test with a build in progress.
+		logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
+		client := coderdtest.New(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: true,
+			Logger:                   &logger,
+		})
+		user := coderdtest.CreateFirstUser(t, client)
+
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse: echo.ParseComplete,
+			ProvisionPlan: []*proto.Response{
+				{
+					Type: &proto.Response_Plan{
+						Plan: &proto.PlanComplete{
+							Parameters: testParameters,
+						},
+					},
+				},
+			},
+			ProvisionApply: []*proto.Response{
+				{
+					Type: &proto.Response_Log{Log: &proto.Log{}}, // This provisioner job will never complete.
+				},
+			},
+		})
+
+		version = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID, func(request *codersdk.CreateTemplateRequest) {
+			request.AllowUserCancelWorkspaceJobs = ptr.Ref(true)
+		})
+
+		const (
+			username = "scaletest-user"
+			email    = "scaletest@test.coder.com"
+		)
+		runner := createworkspaces.NewRunner(client, createworkspaces.Config{
+			User: createworkspaces.UserConfig{
+				OrganizationID: user.OrganizationID,
+				Username:       username,
+				Email:          email,
+			},
+			Workspace: workspacebuild.Config{
+				OrganizationID: user.OrganizationID,
+				Request: codersdk.CreateWorkspaceRequest{
+					TemplateID:          template.ID,
+					RichParameterValues: testParameterValues,
+				},
+			},
+		})
+
+		cancelCtx, cancelFunc := context.WithCancel(ctx)
+		done := make(chan struct{})
+		logs := bytes.NewBuffer(nil)
+		go func() {
+			err := runner.Run(cancelCtx, "1", logs)
+			logsStr := logs.String()
+			t.Log("Runner logs:\n\n" + logsStr)
+			require.ErrorIs(t, err, context.Canceled)
+			close(done)
+		}()
+
+		// Wait for the workspace build job to be picked up.
+		require.Eventually(t, func() bool {
+			workspaces, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{})
+			if err != nil {
+				return false
+			}
+			if len(workspaces.Workspaces) == 0 {
+				return false
+			}
+
+			ws := workspaces.Workspaces[0]
+			t.Logf("checking build: %s | %s", ws.LatestBuild.Transition, ws.LatestBuild.Job.Status)
+			// There should be only one build at present.
+			if ws.LatestBuild.Transition != codersdk.WorkspaceTransitionStart {
+				t.Errorf("expected build transition %s, got %s", codersdk.WorkspaceTransitionStart, ws.LatestBuild.Transition)
+				return false
+			}
+			return ws.LatestBuild.Job.Status == codersdk.ProvisionerJobRunning
+		}, testutil.WaitShort, testutil.IntervalMedium)
+
+		cancelFunc()
+		<-done
+
+		// When we run the cleanup, it should be canceled
+		cleanupLogs := bytes.NewBuffer(nil)
+		cancelCtx, cancelFunc = context.WithCancel(ctx)
+		done = make(chan struct{})
+		go func() {
+			// This will return an error as the "delete" operation will never complete.
+			_ = runner.Cleanup(cancelCtx, "1", cleanupLogs)
+			close(done)
+		}()
+
+		// Ensure the job has been marked as deleted
+		require.Eventually(t, func() bool {
+			workspaces, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{})
+			if err != nil {
+				return false
+			}
+
+			if len(workspaces.Workspaces) == 0 {
+				return false
+			}
+
+			// There should be two builds
+			builds, err := client.WorkspaceBuilds(ctx, codersdk.WorkspaceBuildsRequest{
+				WorkspaceID: workspaces.Workspaces[0].ID,
+			})
+			if err != nil {
+				return false
+			}
+			for i, build := range builds {
+				t.Logf("checking build #%d: %s | %s", i, build.Transition, build.Job.Status)
+				// One of the builds should be for creating the workspace,
+				if build.Transition != codersdk.WorkspaceTransitionStart {
+					continue
+				}
+
+				// And it should be either failed (Echo returns an error when job is canceled), canceling, or canceled.
+				if build.Job.Status == codersdk.ProvisionerJobFailed ||
+					build.Job.Status == codersdk.ProvisionerJobCanceling ||
+					build.Job.Status == codersdk.ProvisionerJobCanceled {
+					return true
+				}
+			}
+			return false
+		}, testutil.WaitShort, testutil.IntervalMedium)
+		cancelFunc()
+		<-done
+		cleanupLogsStr := cleanupLogs.String()
+		require.Contains(t, cleanupLogsStr, "canceling workspace build")
+	})
+
 	t.Run("NoCleanup", func(t *testing.T) {
 		t.Parallel()
 
@@ -169,11 +348,19 @@ func Test_Runner(t *testing.T) {
 
 		authToken := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{
+			Parse: echo.ParseComplete,
+			ProvisionPlan: []*proto.Response{
+				{
+					Type: &proto.Response_Plan{
+						Plan: &proto.PlanComplete{
+							Parameters: testParameters,
+						},
+					},
+				},
+			},
+			ProvisionApply: []*proto.Response{
 				{
-					Type: &proto.Provision_Response_Log{
+					Type: &proto.Response_Log{
 						Log: &proto.Log{
 							Level:  proto.LogLevel_INFO,
 							Output: "hello from logs",
@@ -181,8 +368,8 @@ func Test_Runner(t *testing.T) {
 					},
 				},
 				{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
 							Resources: []*proto.Resource{
 								{
 									Name: "example",
@@ -205,11 +392,10 @@ func Test_Runner(t *testing.T) {
 			},
 		})
 
-		version = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		version = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 
-		closer := goEventuallyStartFakeAgent(ctx, t, client, authToken)
-		t.Cleanup(closer)
+		closeCh := goEventuallyStartFakeAgent(ctx, t, client, authToken)
 
 		const (
 			username = "scaletest-user"
@@ -225,7 +411,8 @@ func Test_Runner(t *testing.T) {
 			Workspace: workspacebuild.Config{
 				OrganizationID: user.OrganizationID,
 				Request: codersdk.CreateWorkspaceRequest{
-					TemplateID: template.ID,
+					TemplateID:          template.ID,
+					RichParameterValues: testParameterValues,
 				},
 			},
 			ReconnectingPTY: &reconnectingpty.Config{
@@ -248,6 +435,10 @@ func Test_Runner(t *testing.T) {
 		t.Log("Runner logs:\n\n" + logsStr)
 		require.NoError(t, err)
 
+		// Wait for the agent to start.
+		closer := <-closeCh
+		t.Cleanup(func() { _ = closer.Close() })
+
 		// Ensure a user and workspace were created.
 		users, err := client.Users(ctx, codersdk.UsersRequest{})
 		require.NoError(t, err)
@@ -256,6 +447,13 @@ func Test_Runner(t *testing.T) {
 		require.NoError(t, err)
 		require.Len(t, workspaces.Workspaces, 1)
 
+		// Ensure the correct build parameters were used.
+		buildParams, err := client.WorkspaceBuildParameters(ctx, workspaces.Workspaces[0].LatestBuild.ID)
+		require.NoError(t, err)
+		require.Len(t, buildParams, 1)
+		require.Equal(t, testParameterValues[0].Name, buildParams[0].Name)
+		require.Equal(t, testParameterValues[0].Value, buildParams[0].Value)
+
 		// Look for strings in the logs.
 		require.Contains(t, logsStr, "Generating user password...")
 		require.Contains(t, logsStr, "Creating user:")
@@ -268,7 +466,8 @@ func Test_Runner(t *testing.T) {
 		require.Contains(t, logsStr, "Opening reconnecting PTY connection to agent")
 		require.Contains(t, logsStr, "Opening connection to workspace agent")
 
-		err = runner.Cleanup(ctx, "1")
+		cleanupLogs := bytes.NewBuffer(nil)
+		err = runner.Cleanup(ctx, "1", cleanupLogs)
 		require.NoError(t, err)
 
 		// Ensure the user and workspace were not deleted.
@@ -294,12 +493,20 @@ func Test_Runner(t *testing.T) {
 		user := coderdtest.CreateFirstUser(t, client)
 
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
-			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{
+			Parse: echo.ParseComplete,
+			ProvisionPlan: []*proto.Response{
+				{
+					Type: &proto.Response_Plan{
+						Plan: &proto.PlanComplete{
+							Parameters: testParameters,
+						},
+					},
+				},
+			},
+			ProvisionApply: []*proto.Response{
 				{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
 							Error: "test error",
 						},
 					},
@@ -307,7 +514,7 @@ func Test_Runner(t *testing.T) {
 			},
 		})
 
-		version = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		version = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 
 		runner := createworkspaces.NewRunner(client, createworkspaces.Config{
@@ -319,7 +526,8 @@ func Test_Runner(t *testing.T) {
 			Workspace: workspacebuild.Config{
 				OrganizationID: user.OrganizationID,
 				Request: codersdk.CreateWorkspaceRequest{
-					TemplateID: template.ID,
+					TemplateID:          template.ID,
+					RichParameterValues: testParameterValues,
 				},
 			},
 		})
@@ -337,7 +545,7 @@ func Test_Runner(t *testing.T) {
 // listing workspaces until we find it, then wait for the build to
 // finish, then start the agents. It is the caller's responsibility to
 // call the returned function to stop the agents.
-func goEventuallyStartFakeAgent(ctx context.Context, t *testing.T, client *codersdk.Client, agentToken string) func() {
+func goEventuallyStartFakeAgent(ctx context.Context, t *testing.T, client *codersdk.Client, agentToken string) chan io.Closer {
 	t.Helper()
 	ch := make(chan io.Closer, 1) // Don't block.
 	go func() {
@@ -355,10 +563,10 @@ func goEventuallyStartFakeAgent(ctx context.Context, t *testing.T, client *coder
 				break
 			}
 
-			time.Sleep(100 * time.Millisecond)
+			time.Sleep(testutil.IntervalMedium)
 		}
 
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		agentClient := agentsdk.New(client.URL)
 		agentClient.SetSessionToken(agentToken)
@@ -367,13 +575,12 @@ func goEventuallyStartFakeAgent(ctx context.Context, t *testing.T, client *coder
 			Logger: slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).
 				Named("agent").Leveled(slog.LevelWarn),
 		})
-		coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+		resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+		assert.GreaterOrEqual(t, len(resources), 1, "workspace %s has no resources", workspace.ID.String())
+		assert.NotEmpty(t, resources[0].Agents, "workspace %s has no agents", workspace.ID.String())
+		agentID := resources[0].Agents[0].ID
+		t.Logf("agent %s is running for workspace %s", agentID.String(), workspace.ID.String())
 		ch <- agentCloser
 	}()
-	closeFunc := func() {
-		if closer, ok := <-ch; ok {
-			_ = closer.Close()
-		}
-	}
-	return closeFunc
+	return ch
 }
diff --git a/scaletest/dashboard/cache.go b/scaletest/dashboard/cache.go
deleted file mode 100644
index 2ac31ff22a525..0000000000000
--- a/scaletest/dashboard/cache.go
+++ /dev/null
@@ -1,97 +0,0 @@
-package dashboard
-
-import (
-	"context"
-	"math/rand"
-	"sync"
-
-	"github.com/coder/coder/codersdk"
-)
-
-type cache struct {
-	sync.RWMutex
-	workspaces []codersdk.Workspace
-	templates  []codersdk.Template
-	users      []codersdk.User
-}
-
-func (c *cache) fill(ctx context.Context, client *codersdk.Client) error {
-	c.Lock()
-	defer c.Unlock()
-	me, err := client.User(ctx, codersdk.Me)
-	if err != nil {
-		return err
-	}
-	ws, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{})
-	if err != nil {
-		return err
-	}
-	c.workspaces = ws.Workspaces
-	tpl, err := client.TemplatesByOrganization(ctx, me.OrganizationIDs[0])
-	if err != nil {
-		return err
-	}
-	c.templates = tpl
-	users, err := client.Users(ctx, codersdk.UsersRequest{})
-	if err != nil {
-		return err
-	}
-	c.users = users.Users
-	return nil
-}
-
-func (c *cache) setWorkspaces(ws []codersdk.Workspace) {
-	c.Lock()
-	c.workspaces = ws
-	c.Unlock()
-}
-
-func (c *cache) setTemplates(t []codersdk.Template) {
-	c.Lock()
-	c.templates = t
-	c.Unlock()
-}
-
-func (c *cache) randWorkspace() codersdk.Workspace {
-	c.RLock()
-	defer c.RUnlock()
-	if len(c.workspaces) == 0 {
-		return codersdk.Workspace{}
-	}
-	return pick(c.workspaces)
-}
-
-func (c *cache) randTemplate() codersdk.Template {
-	c.RLock()
-	defer c.RUnlock()
-	if len(c.templates) == 0 {
-		return codersdk.Template{}
-	}
-	return pick(c.templates)
-}
-
-func (c *cache) setUsers(u []codersdk.User) {
-	c.Lock()
-	c.users = u
-	c.Unlock()
-}
-
-func (c *cache) randUser() codersdk.User {
-	c.RLock()
-	defer c.RUnlock()
-	if len(c.users) == 0 {
-		return codersdk.User{}
-	}
-	return pick(c.users)
-}
-
-// pick chooses a random element from a slice.
-// If the slice is empty, it returns the zero value of the type.
-func pick[T any](s []T) T {
-	if len(s) == 0 {
-		var zero T
-		return zero
-	}
-	// nolint:gosec
-	return s[rand.Intn(len(s))]
-}
diff --git a/scaletest/dashboard/chromedp.go b/scaletest/dashboard/chromedp.go
new file mode 100644
index 0000000000000..d4d944a845071
--- /dev/null
+++ b/scaletest/dashboard/chromedp.go
@@ -0,0 +1,272 @@
+package dashboard
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/chromedp/cdproto/cdp"
+	"github.com/chromedp/cdproto/network"
+	"github.com/chromedp/chromedp"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/cryptorand"
+
+	"cdr.dev/slog"
+)
+
+// Action is just a function that does something.
+type Action func(ctx context.Context) error
+
+// Selector locates an element on a page.
+type Selector string
+
+// Target is a thing that can be clicked.
+type Target struct {
+	// Label is a human-readable label for the target.
+	Label Label
+	// ClickOn is the selector that locates the element to be clicked.
+	ClickOn Selector
+	// WaitFor is a selector that is expected to appear after the target is clicked.
+	WaitFor Selector
+}
+
+// Label identifies an action.
+type Label string
+
+var defaultTargets = []Target{
+	{
+		Label:   "workspace_list",
+		ClickOn: `nav a[href="/workspaces"]:not(.active)`,
+		WaitFor: `tr[role="button"][data-testid^="workspace-"]`,
+	},
+	{
+		Label:   "starter_templates",
+		ClickOn: `a[href="/starter-templates"]`,
+		WaitFor: `a[href^="/starter-templates/"]`,
+	},
+	{
+		Label:   "workspace_details",
+		ClickOn: `tr[role="button"][data-testid^="workspace-"]`,
+		WaitFor: `tr[role="button"][data-testid^="build-"]`,
+	},
+	{
+		Label:   "workspace_build_details",
+		ClickOn: `tr[role="button"][data-testid^="build-"]`,
+		WaitFor: `*[aria-label="Build details"]`,
+	},
+	{
+		Label:   "template_list",
+		ClickOn: `nav a[href="/templates"]:not(.active)`,
+		WaitFor: `tr[role="button"][data-testid^="template-"]`,
+	},
+	{
+		Label:   "template_docs",
+		ClickOn: `a[href^="/templates/"][href$="/docs"]:not([aria-current])`,
+		WaitFor: `#readme`,
+	},
+	{
+		Label:   "template_files",
+		ClickOn: `a[href^="/templates/"][href$="/docs"]:not([aria-current])`,
+		WaitFor: `.monaco-editor`,
+	},
+	{
+		Label:   "template_versions",
+		ClickOn: `a[href^="/templates/"][href$="/versions"]:not([aria-current])`,
+		WaitFor: `tr[role="button"][data-testid^="version-"]`,
+	},
+	{
+		Label:   "template_version_details",
+		ClickOn: `tr[role="button"][data-testid^="version-"]`,
+		WaitFor: `.monaco-editor`,
+	},
+	{
+		Label:   "user_list",
+		ClickOn: `nav a[href^="/users"]:not(.active)`,
+		WaitFor: `tr[data-testid^="user-"]`,
+	},
+}
+
+// clickRandomElement returns an action that will click an element from defaultTargets.
+// If no elements are found, an error is returned.
+// If more than one element is found, one is chosen at random.
+// The label of the clicked element is returned.
+func clickRandomElement(ctx context.Context, log slog.Logger, randIntn func(int) int, deadline time.Time) (Label, Action, error) {
+	var xpath Selector
+	var found bool
+	var err error
+	matches := make([]Target, 0)
+	for _, tgt := range defaultTargets {
+		xpath, found, err = randMatch(ctx, log, tgt.ClickOn, randIntn, deadline)
+		if err != nil {
+			return "", nil, xerrors.Errorf("find matches for %q: %w", tgt.ClickOn, err)
+		}
+		if !found {
+			continue
+		}
+		matches = append(matches, Target{
+			Label:   tgt.Label,
+			ClickOn: xpath,
+			WaitFor: tgt.WaitFor,
+		})
+	}
+
+	if len(matches) == 0 {
+		log.Debug(ctx, "no matches found this time")
+		return "", nil, xerrors.Errorf("no matches found")
+	}
+	match := pick(matches, randIntn)
+	act := func(actx context.Context) error {
+		log.Debug(ctx, "clicking", slog.F("label", match.Label), slog.F("xpath", match.ClickOn))
+		if err := runWithDeadline(ctx, deadline, chromedp.Click(match.ClickOn, chromedp.NodeReady)); err != nil {
+			log.Error(ctx, "click failed", slog.F("label", match.Label), slog.F("xpath", match.ClickOn), slog.Error(err))
+			return xerrors.Errorf("click %q: %w", match.ClickOn, err)
+		}
+		if err := runWithDeadline(ctx, deadline, chromedp.WaitReady(match.WaitFor)); err != nil {
+			log.Error(ctx, "wait failed", slog.F("label", match.Label), slog.F("xpath", match.WaitFor), slog.Error(err))
+			return xerrors.Errorf("wait for %q: %w", match.WaitFor, err)
+		}
+		return nil
+	}
+	return match.Label, act, nil
+}
+
+// randMatch returns a random match for the given selector.
+// The returned selector is the full XPath of the matched node.
+// If no matches are found, an error is returned.
+// If multiple matches are found, one is chosen at random.
+func randMatch(ctx context.Context, log slog.Logger, s Selector, randIntn func(int) int, deadline time.Time) (Selector, bool, error) {
+	var nodes []*cdp.Node
+	log.Debug(ctx, "getting nodes for selector", slog.F("selector", s))
+	if err := runWithDeadline(ctx, deadline, chromedp.Nodes(s, &nodes, chromedp.NodeReady, chromedp.AtLeast(0))); err != nil {
+		log.Debug(ctx, "failed to get nodes for selector", slog.F("selector", s), slog.Error(err))
+		return "", false, xerrors.Errorf("get nodes for selector %q: %w", s, err)
+	}
+	if len(nodes) == 0 {
+		log.Debug(ctx, "no nodes found for selector", slog.F("selector", s))
+		return "", false, nil
+	}
+	n := pick(nodes, randIntn)
+	log.Debug(ctx, "found node", slog.F("node", n.FullXPath()))
+	return Selector(n.FullXPath()), true, nil
+}
+
+func waitForWorkspacesPageLoaded(ctx context.Context, deadline time.Time) error {
+	return runWithDeadline(ctx, deadline, chromedp.WaitReady(`tbody.MuiTableBody-root`))
+}
+
+func runWithDeadline(ctx context.Context, deadline time.Time, acts ...chromedp.Action) error {
+	deadlineCtx, deadlineCancel := context.WithDeadline(ctx, deadline)
+	defer deadlineCancel()
+	c := chromedp.FromContext(ctx)
+	tasks := chromedp.Tasks(acts)
+	return tasks.Do(cdp.WithExecutor(deadlineCtx, c.Target))
+}
+
+// initChromeDPCtx initializes a chromedp context with the given session token cookie
+//
+//nolint:revive // yes, headless is a control flag
+func initChromeDPCtx(ctx context.Context, log slog.Logger, u *url.URL, sessionToken string, headless bool) (context.Context, context.CancelFunc, error) {
+	dir, err := os.MkdirTemp("", "scaletest-dashboard-*")
+	if err != nil {
+		return nil, nil, err
+	}
+
+	allocOpts := append(chromedp.DefaultExecAllocatorOptions[:],
+		chromedp.UserDataDir(dir),
+		chromedp.DisableGPU,
+	)
+
+	if !headless { // headless is the default
+		allocOpts = append(allocOpts, chromedp.Flag("headless", false))
+	}
+
+	allocCtx, allocCtxCancel := chromedp.NewExecAllocator(ctx, allocOpts...)
+	cdpCtx, cdpCancel := chromedp.NewContext(allocCtx)
+	cancelFunc := func() {
+		cdpCancel()
+		allocCtxCancel()
+		if err := os.RemoveAll(dir); err != nil {
+			log.Error(ctx, "failed to remove temp user data dir", slog.F("dir", dir), slog.Error(err))
+		}
+	}
+
+	// force a viewport size of 1024x768 so we don't go into mobile mode
+	if err := chromedp.Run(cdpCtx, chromedp.EmulateViewport(1024, 768)); err != nil {
+		cancelFunc()
+		allocCtxCancel()
+		return nil, nil, xerrors.Errorf("set viewport size: %w", err)
+	}
+
+	// set cookies
+	if err := setSessionTokenCookie(cdpCtx, sessionToken, u.Host); err != nil {
+		cancelFunc()
+		return nil, nil, xerrors.Errorf("set session token cookie: %w", err)
+	}
+
+	// visit main page
+	if err := visitMainPage(cdpCtx, u); err != nil {
+		cancelFunc()
+		return nil, nil, xerrors.Errorf("visit main page: %w", err)
+	}
+
+	return cdpCtx, cancelFunc, nil
+}
+
+func setSessionTokenCookie(ctx context.Context, token, domain string) error {
+	exp := cdp.TimeSinceEpoch(time.Now().Add(24 * time.Hour))
+	err := chromedp.Run(ctx, network.SetCookie("coder_session_token", token).
+		WithExpires(&exp).
+		WithDomain(domain).
+		WithHTTPOnly(false))
+	if err != nil {
+		return xerrors.Errorf("set coder_session_token cookie: %w", err)
+	}
+	return nil
+}
+
+func visitMainPage(ctx context.Context, u *url.URL) error {
+	return chromedp.Run(ctx, chromedp.Navigate(u.String()))
+}
+
+func Screenshot(ctx context.Context, name string) (string, error) {
+	var buf []byte
+	if err := chromedp.Run(ctx, chromedp.CaptureScreenshot(&buf)); err != nil {
+		return "", xerrors.Errorf("capture screenshot: %w", err)
+	}
+	randExt, err := cryptorand.String(4)
+	if err != nil {
+		// this should never happen
+		return "", xerrors.Errorf("generate random string: %w", err)
+	}
+	fname := fmt.Sprintf("scaletest-dashboard-%s-%s-%s.png", name, time.Now().Format("20060102-150405"), randExt)
+	pwd, err := os.Getwd()
+	if err != nil {
+		return "", xerrors.Errorf("get working directory: %w", err)
+	}
+	fpath := filepath.Join(pwd, fname)
+	f, err := os.OpenFile(fpath, os.O_CREATE|os.O_WRONLY, 0o644)
+	if err != nil {
+		return "", xerrors.Errorf("open file: %w", err)
+	}
+	defer f.Close()
+	if _, err := f.Write(buf); err != nil {
+		return "", xerrors.Errorf("write file: %w", err)
+	}
+
+	return fpath, nil
+}
+
+// pick chooses a random element from a slice.
+// If the slice is empty, it returns the zero value of the type.
+func pick[T any](s []T, randIntn func(int) int) T {
+	if len(s) == 0 {
+		var zero T
+		return zero
+	}
+	// nolint:gosec
+	return s[randIntn(len(s))]
+}
diff --git a/scaletest/dashboard/config.go b/scaletest/dashboard/config.go
index b269ee7119320..2bd72ccdf6cbc 100644
--- a/scaletest/dashboard/config.go
+++ b/scaletest/dashboard/config.go
@@ -1,37 +1,42 @@
 package dashboard
 
 import (
+	"context"
 	"time"
 
-	"golang.org/x/xerrors"
-
 	"cdr.dev/slog"
+
+	"golang.org/x/xerrors"
 )
 
 type Config struct {
-	// MinWait is the minimum interval between fetches.
-	MinWait time.Duration `json:"duration_min"`
-	// MaxWait is the maximum interval between fetches.
-	MaxWait time.Duration `json:"duration_max"`
+	// Interval is the minimum interval between fetches.
+	Interval time.Duration `json:"interval"`
+	// Jitter is the maximum interval between fetches.
+	Jitter time.Duration `json:"jitter"`
 	// Trace is whether to trace the requests.
 	Trace bool `json:"trace"`
 	// Logger is the logger to use.
 	Logger slog.Logger `json:"-"`
-	// RollTable is the set of actions to perform
-	RollTable RollTable `json:"roll_table"`
+	// Headless controls headless mode for chromedp.
+	Headless bool `json:"headless"`
+	// ActionFunc is a function that returns an action to run.
+	ActionFunc func(ctx context.Context, log slog.Logger, randIntn func(int) int, deadline time.Time) (Label, Action, error) `json:"-"`
+	// WaitLoaded is a function that waits for the page to be loaded.
+	WaitLoaded func(ctx context.Context, deadline time.Time) error
+	// Screenshot is a function that takes a screenshot.
+	Screenshot func(ctx context.Context, filename string) (string, error)
+	// RandIntn is a function that returns a random number between 0 and n-1.
+	RandIntn func(int) int `json:"-"`
 }
 
 func (c Config) Validate() error {
-	if c.MinWait <= 0 {
-		return xerrors.Errorf("validate duration_min: must be greater than zero")
-	}
-
-	if c.MaxWait <= 0 {
-		return xerrors.Errorf("validate duration_max: must be greater than zero")
+	if !(c.Interval > 0) {
+		return xerrors.Errorf("validate interval: must be greater than zero")
 	}
 
-	if c.MinWait > c.MaxWait {
-		return xerrors.Errorf("validate duration_min: must be less than duration_max")
+	if !(c.Jitter < c.Interval) {
+		return xerrors.Errorf("validate jitter: must be less than interval")
 	}
 
 	return nil
diff --git a/scaletest/dashboard/metrics.go b/scaletest/dashboard/metrics.go
index 513a319a07bae..bff752b8d4fd8 100644
--- a/scaletest/dashboard/metrics.go
+++ b/scaletest/dashboard/metrics.go
@@ -9,13 +9,11 @@ import (
 type Metrics interface {
 	ObserveDuration(action string, d time.Duration)
 	IncErrors(action string)
-	IncStatuses(action string, code string)
 }
 
 type PromMetrics struct {
 	durationSeconds *prometheus.HistogramVec
 	errors          *prometheus.CounterVec
-	statuses        *prometheus.CounterVec
 }
 
 func NewMetrics(reg prometheus.Registerer) *PromMetrics {
@@ -30,16 +28,10 @@ func NewMetrics(reg prometheus.Registerer) *PromMetrics {
 			Subsystem: "scaletest_dashboard",
 			Name:      "errors_total",
 		}, []string{"action"}),
-		statuses: prometheus.NewCounterVec(prometheus.CounterOpts{
-			Namespace: "coderd",
-			Subsystem: "scaletest_dashboard",
-			Name:      "statuses_total",
-		}, []string{"action", "code"}),
 	}
 
 	reg.MustRegister(m.durationSeconds)
 	reg.MustRegister(m.errors)
-	reg.MustRegister(m.statuses)
 	return m
 }
 
@@ -50,7 +42,3 @@ func (p *PromMetrics) ObserveDuration(action string, d time.Duration) {
 func (p *PromMetrics) IncErrors(action string) {
 	p.errors.WithLabelValues(action).Inc()
 }
-
-func (p *PromMetrics) IncStatuses(action string, code string) {
-	p.statuses.WithLabelValues(action, code).Inc()
-}
diff --git a/scaletest/dashboard/rolltable.go b/scaletest/dashboard/rolltable.go
deleted file mode 100644
index e237cf6983878..0000000000000
--- a/scaletest/dashboard/rolltable.go
+++ /dev/null
@@ -1,304 +0,0 @@
-package dashboard
-
-import (
-	"context"
-
-	"github.com/google/uuid"
-
-	"github.com/coder/coder/codersdk"
-)
-
-// DefaultActions is a table of actions to perform.
-// D&D nerds will feel right at home here :-)
-// Note that the order of the table is important!
-// Entries must be in ascending order.
-var DefaultActions RollTable = []RollTableEntry{
-	{0, fetchWorkspaces, "fetch workspaces"},
-	{1, fetchUsers, "fetch users"},
-	{2, fetchTemplates, "fetch templates"},
-	{3, authCheckAsOwner, "authcheck owner"},
-	{4, authCheckAsNonOwner, "authcheck not owner"},
-	{5, fetchAuditLog, "fetch audit log"},
-	{6, fetchActiveUsers, "fetch active users"},
-	{7, fetchSuspendedUsers, "fetch suspended users"},
-	{8, fetchTemplateVersion, "fetch template version"},
-	{9, fetchWorkspace, "fetch workspace"},
-	{10, fetchTemplate, "fetch template"},
-	{11, fetchUserByID, "fetch user by ID"},
-	{12, fetchUserByUsername, "fetch user by username"},
-	{13, fetchWorkspaceBuild, "fetch workspace build"},
-	{14, fetchDeploymentConfig, "fetch deployment config"},
-	{15, fetchWorkspaceQuotaForUser, "fetch workspace quota for user"},
-	{16, fetchDeploymentStats, "fetch deployment stats"},
-	{17, fetchWorkspaceLogs, "fetch workspace logs"},
-}
-
-// RollTable is a slice of rollTableEntry.
-type RollTable []RollTableEntry
-
-// RollTableEntry is an entry in the roll table.
-type RollTableEntry struct {
-	// Roll is the minimum number required to perform the action.
-	Roll int
-	// Fn is the function to call.
-	Fn func(ctx context.Context, p *Params) error
-	// Label is used for logging.
-	Label string
-}
-
-// choose returns the first entry in the table that is greater than or equal to n.
-func (r RollTable) choose(n int) RollTableEntry {
-	for _, entry := range r {
-		if entry.Roll >= n {
-			return entry
-		}
-	}
-	return RollTableEntry{}
-}
-
-// max returns the maximum roll in the table.
-// Important: this assumes that the table is sorted in ascending order.
-func (r RollTable) max() int {
-	return r[len(r)-1].Roll
-}
-
-// Params is a set of parameters to pass to the actions in a rollTable.
-type Params struct {
-	// client is the client to use for performing the action.
-	client *codersdk.Client
-	// me is the currently authenticated user. Lots of actions require this.
-	me codersdk.User
-	// For picking random resource IDs, we need to know what resources are
-	// present. We store them in a cache to avoid fetching them every time.
-	// This may seem counter-intuitive for load testing, but we want to avoid
-	// muddying results.
-	c *cache
-}
-
-// fetchWorkspaces fetches all workspaces.
-func fetchWorkspaces(ctx context.Context, p *Params) error {
-	ws, err := p.client.Workspaces(ctx, codersdk.WorkspaceFilter{})
-	if err != nil {
-		// store the workspaces for later use in case they change
-		p.c.setWorkspaces(ws.Workspaces)
-	}
-	return err
-}
-
-// fetchUsers fetches all users.
-func fetchUsers(ctx context.Context, p *Params) error {
-	users, err := p.client.Users(ctx, codersdk.UsersRequest{})
-	if err != nil {
-		p.c.setUsers(users.Users)
-	}
-	return err
-}
-
-// fetchActiveUsers fetches all active users
-func fetchActiveUsers(ctx context.Context, p *Params) error {
-	_, err := p.client.Users(ctx, codersdk.UsersRequest{
-		Status: codersdk.UserStatusActive,
-	})
-	return err
-}
-
-// fetchSuspendedUsers fetches all suspended users
-func fetchSuspendedUsers(ctx context.Context, p *Params) error {
-	_, err := p.client.Users(ctx, codersdk.UsersRequest{
-		Status: codersdk.UserStatusSuspended,
-	})
-	return err
-}
-
-// fetchTemplates fetches all templates.
-func fetchTemplates(ctx context.Context, p *Params) error {
-	templates, err := p.client.TemplatesByOrganization(ctx, p.me.OrganizationIDs[0])
-	if err != nil {
-		p.c.setTemplates(templates)
-	}
-	return err
-}
-
-// fetchTemplateBuild fetches a single template version at random.
-func fetchTemplateVersion(ctx context.Context, p *Params) error {
-	t := p.c.randTemplate()
-	_, err := p.client.TemplateVersion(ctx, t.ActiveVersionID)
-	return err
-}
-
-// fetchWorkspace fetches a single workspace at random.
-func fetchWorkspace(ctx context.Context, p *Params) error {
-	w := p.c.randWorkspace()
-	_, err := p.client.WorkspaceByOwnerAndName(ctx, w.OwnerName, w.Name, codersdk.WorkspaceOptions{})
-	return err
-}
-
-// fetchWorkspaceBuild fetches a single workspace build at random.
-func fetchWorkspaceBuild(ctx context.Context, p *Params) error {
-	w := p.c.randWorkspace()
-	_, err := p.client.WorkspaceBuild(ctx, w.LatestBuild.ID)
-	return err
-}
-
-// fetchTemplate fetches a single template at random.
-func fetchTemplate(ctx context.Context, p *Params) error {
-	t := p.c.randTemplate()
-	_, err := p.client.Template(ctx, t.ID)
-	return err
-}
-
-// fetchUserByID fetches a single user at random by ID.
-func fetchUserByID(ctx context.Context, p *Params) error {
-	u := p.c.randUser()
-	_, err := p.client.User(ctx, u.ID.String())
-	return err
-}
-
-// fetchUserByUsername fetches a single user at random by username.
-func fetchUserByUsername(ctx context.Context, p *Params) error {
-	u := p.c.randUser()
-	_, err := p.client.User(ctx, u.Username)
-	return err
-}
-
-// fetchDeploymentConfig fetches the deployment config.
-func fetchDeploymentConfig(ctx context.Context, p *Params) error {
-	_, err := p.client.DeploymentConfig(ctx)
-	return err
-}
-
-// fetchWorkspaceQuotaForUser fetches the workspace quota for a random user.
-func fetchWorkspaceQuotaForUser(ctx context.Context, p *Params) error {
-	u := p.c.randUser()
-	_, err := p.client.WorkspaceQuota(ctx, u.ID.String())
-	return err
-}
-
-// fetchDeploymentStats fetches the deployment stats.
-func fetchDeploymentStats(ctx context.Context, p *Params) error {
-	_, err := p.client.DeploymentStats(ctx)
-	return err
-}
-
-// fetchWorkspaceLogs fetches the logs for a random workspace.
-func fetchWorkspaceLogs(ctx context.Context, p *Params) error {
-	w := p.c.randWorkspace()
-	ch, closer, err := p.client.WorkspaceBuildLogsAfter(ctx, w.LatestBuild.ID, 0)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		_ = closer.Close()
-	}()
-	// Drain the channel.
-	for {
-		select {
-		case <-ctx.Done():
-			return ctx.Err()
-		case l, ok := <-ch:
-			if !ok {
-				return nil
-			}
-			_ = l
-		}
-	}
-}
-
-// fetchAuditLog fetches the audit log.
-// As not all users have access to the audit log, we check first.
-func fetchAuditLog(ctx context.Context, p *Params) error {
-	res, err := p.client.AuthCheck(ctx, codersdk.AuthorizationRequest{
-		Checks: map[string]codersdk.AuthorizationCheck{
-			"auditlog": {
-				Object: codersdk.AuthorizationObject{
-					ResourceType: codersdk.ResourceAuditLog,
-				},
-				Action: codersdk.ActionRead,
-			},
-		},
-	})
-	if err != nil {
-		return err
-	}
-	if !res["auditlog"] {
-		return nil // we are not authorized to read the audit log
-	}
-
-	// Fetch the first 25 audit log entries.
-	_, err = p.client.AuditLogs(ctx, codersdk.AuditLogsRequest{
-		Pagination: codersdk.Pagination{
-			Offset: 0,
-			Limit:  25,
-		},
-	})
-	return err
-}
-
-// authCheckAsOwner performs an auth check as the owner of a random
-// resource type and action.
-func authCheckAsOwner(ctx context.Context, p *Params) error {
-	_, err := p.client.AuthCheck(ctx, randAuthReq(
-		ownedBy(p.me.ID),
-		withAction(randAction()),
-		withObjType(randObjectType()),
-		inOrg(p.me.OrganizationIDs[0]),
-	))
-	return err
-}
-
-// authCheckAsNonOwner performs an auth check as a non-owner of a random
-// resource type and action.
-func authCheckAsNonOwner(ctx context.Context, p *Params) error {
-	_, err := p.client.AuthCheck(ctx, randAuthReq(
-		ownedBy(uuid.New()),
-		withAction(randAction()),
-		withObjType(randObjectType()),
-		inOrg(p.me.OrganizationIDs[0]),
-	))
-	return err
-}
-
-// nolint: gosec
-func randAuthReq(mut ...func(*codersdk.AuthorizationCheck)) codersdk.AuthorizationRequest {
-	var check codersdk.AuthorizationCheck
-	for _, m := range mut {
-		m(&check)
-	}
-	return codersdk.AuthorizationRequest{
-		Checks: map[string]codersdk.AuthorizationCheck{
-			"check": check,
-		},
-	}
-}
-
-func ownedBy(myID uuid.UUID) func(check *codersdk.AuthorizationCheck) {
-	return func(check *codersdk.AuthorizationCheck) {
-		check.Object.OwnerID = myID.String()
-	}
-}
-
-func inOrg(orgID uuid.UUID) func(check *codersdk.AuthorizationCheck) {
-	return func(check *codersdk.AuthorizationCheck) {
-		check.Object.OrganizationID = orgID.String()
-	}
-}
-
-func withObjType(objType codersdk.RBACResource) func(check *codersdk.AuthorizationCheck) {
-	return func(check *codersdk.AuthorizationCheck) {
-		check.Object.ResourceType = objType
-	}
-}
-
-func withAction(action string) func(check *codersdk.AuthorizationCheck) {
-	return func(check *codersdk.AuthorizationCheck) {
-		check.Action = action
-	}
-}
-
-func randAction() string {
-	return pick(codersdk.AllRBACActions)
-}
-
-func randObjectType() codersdk.RBACResource {
-	return pick(codersdk.AllRBACResources)
-}
diff --git a/scaletest/dashboard/rolltable_internal_test.go b/scaletest/dashboard/rolltable_internal_test.go
deleted file mode 100644
index 53b646df119d6..0000000000000
--- a/scaletest/dashboard/rolltable_internal_test.go
+++ /dev/null
@@ -1,17 +0,0 @@
-package dashboard
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func Test_allActions_ordering(t *testing.T) {
-	t.Parallel()
-
-	last := -1
-	for idx, entry := range DefaultActions {
-		require.Greater(t, entry.Roll, last, "roll table must be in ascending order, entry %d is out of order", idx)
-		last = entry.Roll
-	}
-}
diff --git a/scaletest/dashboard/run.go b/scaletest/dashboard/run.go
index 64c904177565e..0c80d98d59e1b 100644
--- a/scaletest/dashboard/run.go
+++ b/scaletest/dashboard/run.go
@@ -2,7 +2,7 @@ package dashboard
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"io"
 	"math/rand"
 	"time"
@@ -10,8 +10,8 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/scaletest/harness"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/scaletest/harness"
 )
 
 type Runner struct {
@@ -27,6 +27,18 @@ var (
 
 func NewRunner(client *codersdk.Client, metrics Metrics, cfg Config) *Runner {
 	client.Trace = cfg.Trace
+	if cfg.WaitLoaded == nil {
+		cfg.WaitLoaded = waitForWorkspacesPageLoaded
+	}
+	if cfg.ActionFunc == nil {
+		cfg.ActionFunc = clickRandomElement
+	}
+	if cfg.Screenshot == nil {
+		cfg.Screenshot = Screenshot
+	}
+	if cfg.RandIntn == nil {
+		cfg.RandIntn = rand.Intn
+	}
 	return &Runner{
 		client:  client,
 		cfg:     cfg,
@@ -35,97 +47,84 @@ func NewRunner(client *codersdk.Client, metrics Metrics, cfg Config) *Runner {
 }
 
 func (r *Runner) Run(ctx context.Context, _ string, _ io.Writer) error {
+	err := r.runUntilDeadlineExceeded(ctx)
+	// If the context deadline exceeded, don't return an error.
+	// This just means the test finished.
+	if err == nil || errors.Is(err, context.DeadlineExceeded) {
+		return nil
+	}
+	return err
+}
+
+func (r *Runner) runUntilDeadlineExceeded(ctx context.Context) error {
+	if r.client == nil {
+		return xerrors.Errorf("client is nil")
+	}
 	me, err := r.client.User(ctx, codersdk.Me)
 	if err != nil {
-		return err
+		return xerrors.Errorf("get scaletest user: %w", err)
 	}
+	//nolint:gocritic
+	r.cfg.Logger.Info(ctx, "running as user", slog.F("username", me.Username))
 	if len(me.OrganizationIDs) == 0 {
 		return xerrors.Errorf("user has no organizations")
 	}
 
-	c := &cache{}
-	if err := c.fill(ctx, r.client); err != nil {
-		return err
+	cdpCtx, cdpCancel, err := initChromeDPCtx(ctx, r.cfg.Logger, r.client.URL, r.client.SessionToken(), r.cfg.Headless)
+	if err != nil {
+		return xerrors.Errorf("init chromedp ctx: %w", err)
 	}
-
-	p := &Params{
-		client: r.client,
-		me:     me,
-		c:      c,
+	defer cdpCancel()
+	t := time.NewTicker(1) // First one should be immediate
+	defer t.Stop()
+	r.cfg.Logger.Info(ctx, "waiting for workspaces page to load")
+	loadWorkspacePageDeadline := time.Now().Add(r.cfg.Interval)
+	if err := r.cfg.WaitLoaded(cdpCtx, loadWorkspacePageDeadline); err != nil {
+		return xerrors.Errorf("wait for workspaces page to load: %w", err)
 	}
-	rolls := make(chan int)
-	go func() {
-		t := time.NewTicker(r.randWait())
-		defer t.Stop()
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-t.C:
-				rolls <- rand.Intn(r.cfg.RollTable.max() + 1) // nolint:gosec
-				t.Reset(r.randWait())
-			}
-		}
-	}()
-
 	for {
 		select {
-		case <-ctx.Done():
+		case <-cdpCtx.Done():
 			return nil
-		case n := <-rolls:
-			act := r.cfg.RollTable.choose(n)
-			go r.do(ctx, act, p)
+		case <-t.C:
+			var offset time.Duration
+			if r.cfg.Jitter > 0 {
+				offset = time.Duration(r.cfg.RandIntn(int(2*r.cfg.Jitter)) - int(r.cfg.Jitter))
+			}
+			wait := r.cfg.Interval + offset
+			actionCompleteByDeadline := time.Now().Add(wait)
+			t.Reset(wait)
+			l, act, err := r.cfg.ActionFunc(cdpCtx, r.cfg.Logger, r.cfg.RandIntn, actionCompleteByDeadline)
+			if err != nil {
+				r.cfg.Logger.Error(ctx, "calling ActionFunc", slog.Error(err))
+				sPath, sErr := r.cfg.Screenshot(cdpCtx, me.Username)
+				if sErr != nil {
+					r.cfg.Logger.Error(ctx, "screenshot failed", slog.Error(sErr))
+				}
+				r.cfg.Logger.Info(ctx, "screenshot saved", slog.F("path", sPath))
+				continue
+			}
+			start := time.Now()
+			err = act(cdpCtx)
+			elapsed := time.Since(start)
+			r.metrics.ObserveDuration(string(l), elapsed)
+			if err != nil {
+				r.metrics.IncErrors(string(l))
+				//nolint:gocritic
+				r.cfg.Logger.Error(ctx, "action failed", slog.F("label", l), slog.Error(err))
+				sPath, sErr := r.cfg.Screenshot(cdpCtx, me.Username+"-"+string(l))
+				if sErr != nil {
+					r.cfg.Logger.Error(ctx, "screenshot failed", slog.Error(sErr))
+				}
+				r.cfg.Logger.Info(ctx, "screenshot saved", slog.F("path", sPath))
+			} else {
+				//nolint:gocritic
+				r.cfg.Logger.Info(ctx, "action success", slog.F("label", l))
+			}
 		}
 	}
 }
 
-func (*Runner) Cleanup(_ context.Context, _ string) error {
+func (*Runner) Cleanup(_ context.Context, _ string, _ io.Writer) error {
 	return nil
 }
-
-func (r *Runner) do(ctx context.Context, act RollTableEntry, p *Params) {
-	select {
-	case <-ctx.Done():
-		r.cfg.Logger.Info(ctx, "context done, stopping")
-		return
-	default:
-		var errored bool
-		cancelCtx, cancel := context.WithTimeout(ctx, r.cfg.MaxWait)
-		defer cancel()
-		start := time.Now()
-		err := act.Fn(cancelCtx, p)
-		cancel()
-		elapsed := time.Since(start)
-		if err != nil {
-			errored = true
-			r.cfg.Logger.Error( //nolint:gocritic
-				ctx, "action failed",
-				slog.Error(err),
-				slog.F("action", act.Label),
-				slog.F("elapsed", elapsed),
-			)
-		} else {
-			r.cfg.Logger.Info(ctx, "completed successfully",
-				slog.F("action", act.Label),
-				slog.F("elapsed", elapsed),
-			)
-		}
-		codeLabel := "200"
-		if apiErr, ok := codersdk.AsError(err); ok {
-			codeLabel = fmt.Sprintf("%d", apiErr.StatusCode())
-		} else if xerrors.Is(err, context.Canceled) {
-			codeLabel = "timeout"
-		}
-		r.metrics.ObserveDuration(act.Label, elapsed)
-		r.metrics.IncStatuses(act.Label, codeLabel)
-		if errored {
-			r.metrics.IncErrors(act.Label)
-		}
-	}
-}
-
-func (r *Runner) randWait() time.Duration {
-	// nolint:gosec // This is not for cryptographic purposes. Chill, gosec. Chill.
-	wait := time.Duration(rand.Intn(int(r.cfg.MaxWait) - int(r.cfg.MinWait)))
-	return r.cfg.MinWait + wait
-}
diff --git a/scaletest/dashboard/run_test.go b/scaletest/dashboard/run_test.go
index d522ba1a6ec88..af9725e201085 100644
--- a/scaletest/dashboard/run_test.go
+++ b/scaletest/dashboard/run_test.go
@@ -2,19 +2,21 @@ package dashboard_test
 
 import (
 	"context"
+	"math/rand"
 	"runtime"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.org/x/xerrors"
 
+	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/scaletest/dashboard"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/scaletest/dashboard"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func Test_Run(t *testing.T) {
@@ -26,35 +28,50 @@ func Test_Run(t *testing.T) {
 		t.Skip("skipping test on Windows")
 	}
 
-	client := coderdtest.New(t, nil)
-	_ = coderdtest.CreateFirstUser(t, client)
-
-	successfulAction := func(context.Context, *dashboard.Params) error {
+	successAction := func(_ context.Context) error {
+		<-time.After(testutil.IntervalFast)
 		return nil
 	}
-	failingAction := func(context.Context, *dashboard.Params) error {
-		return xerrors.Errorf("failed")
-	}
-	hangingAction := func(ctx context.Context, _ *dashboard.Params) error {
-		<-ctx.Done()
-		return ctx.Err()
-	}
 
-	testActions := []dashboard.RollTableEntry{
-		{0, successfulAction, "succeeds"},
-		{1, failingAction, "fails"},
-		{2, hangingAction, "hangs"},
+	failAction := func(_ context.Context) error {
+		<-time.After(testutil.IntervalMedium)
+		return assert.AnError
 	}
 
+	//nolint: gosec // just for testing
+	rg := rand.New(rand.NewSource(0)) // deterministic for testing
+
+	client := coderdtest.New(t, nil)
+	_ = coderdtest.CreateFirstUser(t, client)
+
 	log := slogtest.Make(t, &slogtest.Options{
 		IgnoreErrors: true,
 	})
 	m := &testMetrics{}
+	var (
+		waitLoadedCalled atomic.Bool
+		screenshotCalled atomic.Bool
+	)
 	cfg := dashboard.Config{
-		MinWait:   time.Millisecond,
-		MaxWait:   10 * time.Millisecond,
-		Logger:    log,
-		RollTable: testActions,
+		Interval: 500 * time.Millisecond,
+		Jitter:   100 * time.Millisecond,
+		Logger:   log,
+		Headless: true,
+		WaitLoaded: func(_ context.Context, _ time.Time) error {
+			waitLoadedCalled.Store(true)
+			return nil
+		},
+		ActionFunc: func(_ context.Context, _ slog.Logger, rnd func(int) int, _ time.Time) (dashboard.Label, dashboard.Action, error) {
+			if rnd(2) == 0 {
+				return "fails", failAction, nil
+			}
+			return "succeeds", successAction, nil
+		},
+		Screenshot: func(_ context.Context, name string) (string, error) {
+			screenshotCalled.Store(true)
+			return "/fake/path/to/" + name + ".png", nil
+		},
+		RandIntn: rg.Intn,
 	}
 	r := dashboard.NewRunner(client, m, cfg)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
@@ -68,23 +85,14 @@ func Test_Run(t *testing.T) {
 	assert.True(t, ok)
 	require.NoError(t, err)
 
-	if assert.NotEmpty(t, m.ObservedDurations["succeeds"]) {
-		assert.NotZero(t, m.ObservedDurations["succeeds"][0])
+	for _, dur := range m.ObservedDurations["succeeds"] {
+		assert.NotZero(t, dur)
 	}
-
-	if assert.NotEmpty(t, m.ObservedDurations["fails"]) {
-		assert.NotZero(t, m.ObservedDurations["fails"][0])
-	}
-
-	if assert.NotEmpty(t, m.ObservedDurations["hangs"]) {
-		assert.GreaterOrEqual(t, m.ObservedDurations["hangs"][0], cfg.MaxWait.Seconds())
+	for _, dur := range m.ObservedDurations["fails"] {
+		assert.NotZero(t, dur)
 	}
 	assert.Zero(t, m.Errors["succeeds"])
 	assert.NotZero(t, m.Errors["fails"])
-	assert.NotZero(t, m.Errors["hangs"])
-	assert.NotEmpty(t, m.Statuses["succeeds"])
-	assert.NotEmpty(t, m.Statuses["fails"])
-	assert.NotEmpty(t, m.Statuses["hangs"])
 }
 
 type testMetrics struct {
diff --git a/scaletest/harness/harness.go b/scaletest/harness/harness.go
index bd99f5cfb9d80..493e12dac598b 100644
--- a/scaletest/harness/harness.go
+++ b/scaletest/harness/harness.go
@@ -8,7 +8,7 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/tracing"
+	"github.com/coder/coder/v2/coderd/tracing"
 )
 
 // TestHarness runs a bunch of registered test runs using the given execution
diff --git a/scaletest/harness/harness_test.go b/scaletest/harness/harness_test.go
index 5b0a9ba556fc7..10e1f87bd70b1 100644
--- a/scaletest/harness/harness_test.go
+++ b/scaletest/harness/harness_test.go
@@ -9,7 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/harness"
 )
 
 const testPanicMessage = "expected test panic"
@@ -112,7 +112,7 @@ func Test_TestHarness(t *testing.T) {
 				RunFn: func(_ context.Context, _ string, _ io.Writer) error {
 					return nil
 				},
-				CleanupFn: func(_ context.Context, _ string) error {
+				CleanupFn: func(_ context.Context, _ string, _ io.Writer) error {
 					panic(testPanicMessage)
 				},
 			})
@@ -150,7 +150,7 @@ func Test_TestHarness(t *testing.T) {
 				RunFn: func(_ context.Context, _ string, _ io.Writer) error {
 					return nil
 				},
-				CleanupFn: func(_ context.Context, _ string) error {
+				CleanupFn: func(_ context.Context, _ string, _ io.Writer) error {
 					return nil
 				},
 			})
@@ -295,7 +295,7 @@ func fakeTestFns(err, cleanupErr error) testFns {
 		RunFn: func(_ context.Context, _ string, _ io.Writer) error {
 			return err
 		},
-		CleanupFn: func(_ context.Context, _ string) error {
+		CleanupFn: func(_ context.Context, _ string, _ io.Writer) error {
 			return cleanupErr
 		},
 	}
diff --git a/scaletest/harness/results.go b/scaletest/harness/results.go
index 3bb1c02596688..a96212f9feb51 100644
--- a/scaletest/harness/results.go
+++ b/scaletest/harness/results.go
@@ -2,12 +2,16 @@ package harness
 
 import (
 	"bufio"
+	"encoding/json"
 	"fmt"
 	"io"
+	"sort"
 	"strings"
 	"time"
 
-	"github.com/coder/coder/coderd/httpapi"
+	"golang.org/x/exp/maps"
+
+	"github.com/coder/coder/v2/coderd/httpapi"
 )
 
 // Results is the full compiled results for a set of test runs.
@@ -33,6 +37,18 @@ type RunResult struct {
 	DurationMS int64            `json:"duration_ms"`
 }
 
+// MarshalJSON implements json.Marhshaler for RunResult.
+func (r RunResult) MarshalJSON() ([]byte, error) {
+	type alias RunResult
+	return json.Marshal(&struct {
+		alias
+		Error string `json:"error"`
+	}{
+		alias: alias(r),
+		Error: fmt.Sprintf("%+v", r.Error),
+	})
+}
+
 // Results returns the results of the test run. Panics if the test run is not
 // done yet.
 func (r *TestRun) Result() RunResult {
@@ -88,7 +104,10 @@ func (h *TestHarness) Results() Results {
 // PrintText prints the results as human-readable text to the given writer.
 func (r *Results) PrintText(w io.Writer) {
 	var totalDuration time.Duration
-	for _, run := range r.Runs {
+	keys := maps.Keys(r.Runs)
+	sort.Strings(keys)
+	for _, key := range keys {
+		run := r.Runs[key]
 		totalDuration += time.Duration(run.Duration)
 		if run.Error == nil {
 			continue
@@ -114,6 +133,10 @@ func (r *Results) PrintText(w io.Writer) {
 	}
 
 	_, _ = fmt.Fprintln(w, "\n\nTest results:")
+	if r.TotalRuns == 0 {
+		_, _ = fmt.Fprintln(w, "\tNo tests run")
+		return
+	}
 	_, _ = fmt.Fprintf(w, "\tPass:  %d\n", r.TotalPass)
 	_, _ = fmt.Fprintf(w, "\tFail:  %d\n", r.TotalFail)
 	_, _ = fmt.Fprintf(w, "\tTotal: %d\n", r.TotalRuns)
diff --git a/scaletest/harness/results_test.go b/scaletest/harness/results_test.go
index e52d5f2838ae0..65eea6c2c44f9 100644
--- a/scaletest/harness/results_test.go
+++ b/scaletest/harness/results_test.go
@@ -2,19 +2,34 @@ package harness_test
 
 import (
 	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/scaletest/harness"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/scaletest/harness"
 )
 
+type testError struct {
+	hidden error
+}
+
+func (e testError) Error() string {
+	return e.hidden.Error()
+}
+
 func Test_Results(t *testing.T) {
 	t.Parallel()
 
+	now := time.Date(2023, 10, 5, 12, 3, 56, 395813665, time.UTC)
 	results := harness.Results{
 		TotalRuns: 10,
 		TotalPass: 8,
@@ -26,7 +41,7 @@ func Test_Results(t *testing.T) {
 				ID:         "0",
 				Logs:       "test-0/0 log line 1\ntest-0/0 log line 2",
 				Error:      xerrors.New("test-0/0 error"),
-				StartedAt:  time.Now(),
+				StartedAt:  now,
 				Duration:   httpapi.Duration(time.Second),
 				DurationMS: 1000,
 			},
@@ -36,7 +51,17 @@ func Test_Results(t *testing.T) {
 				ID:         "1",
 				Logs:       "test-0/1 log line 1\ntest-0/1 log line 2",
 				Error:      nil,
-				StartedAt:  time.Now(),
+				StartedAt:  now.Add(333 * time.Millisecond),
+				Duration:   httpapi.Duration(time.Second),
+				DurationMS: 1000,
+			},
+			"test-0/2": {
+				FullID:     "test-0/2",
+				TestName:   "test-0",
+				ID:         "2",
+				Logs:       "test-0/2 log line 1\ntest-0/2 log line 2",
+				Error:      testError{hidden: xerrors.New("test-0/2 error")},
+				StartedAt:  now.Add(666 * time.Millisecond),
 				Duration:   httpapi.Duration(time.Second),
 				DurationMS: 1000,
 			},
@@ -45,7 +70,7 @@ func Test_Results(t *testing.T) {
 		ElapsedMS: 1000,
 	}
 
-	expected := `
+	wantText := `
 == FAIL: test-0/0
 
 	Error: test-0/0 error
@@ -53,6 +78,13 @@ func Test_Results(t *testing.T) {
 	Log:
 		test-0/0 log line 1
 
+== FAIL: test-0/2
+
+	Error: test-0/2 error
+
+	Log:
+		test-0/2 log line 1
+
 
 Test results:
 	Pass:  8
@@ -60,11 +92,63 @@ Test results:
 	Total: 10
 
 	Total duration: 1s
-	Avg. duration:  200ms
+	Avg. duration:  300ms
 `
+	wantJSON := `{
+	"total_runs": 10,
+	"total_pass": 8,
+	"total_fail": 2,
+	"elapsed": "1s",
+	"elapsed_ms": 1000,
+	"runs": {
+		"test-0/0": {
+			"full_id": "test-0/0",
+			"test_name": "test-0",
+			"id": "0",
+			"logs": "test-0/0 log line 1\ntest-0/0 log line 2",
+			"started_at": "2023-10-05T12:03:56.395813665Z",
+			"duration": "1s",
+			"duration_ms": 1000,
+			"error": "test-0/0 error:\n    github.com/coder/coder/v2/scaletest/harness_test.Test_Results\n        [working_directory]/results_test.go:43"
+		},
+		"test-0/1": {
+			"full_id": "test-0/1",
+			"test_name": "test-0",
+			"id": "1",
+			"logs": "test-0/1 log line 1\ntest-0/1 log line 2",
+			"started_at": "2023-10-05T12:03:56.728813665Z",
+			"duration": "1s",
+			"duration_ms": 1000,
+			"error": "\u003cnil\u003e"
+		},
+		"test-0/2": {
+			"full_id": "test-0/2",
+			"test_name": "test-0",
+			"id": "2",
+			"logs": "test-0/2 log line 1\ntest-0/2 log line 2",
+			"started_at": "2023-10-05T12:03:57.061813665Z",
+			"duration": "1s",
+			"duration_ms": 1000,
+			"error": "test-0/2 error"
+		}
+	}
+}
+`
+	wd, err := os.Getwd()
+	require.NoError(t, err)
+	wd = filepath.ToSlash(wd) // Hello there Windows, my friend...
+	wantJSON = strings.Replace(wantJSON, "[working_directory]", wd, 1)
 
 	out := bytes.NewBuffer(nil)
 	results.PrintText(out)
 
-	require.Equal(t, expected, out.String())
+	assert.Empty(t, cmp.Diff(wantText, out.String()), "text result does not match (-want +got)")
+
+	out.Reset()
+	enc := json.NewEncoder(out)
+	enc.SetIndent("", "\t")
+	err = enc.Encode(results)
+	require.NoError(t, err)
+
+	assert.Empty(t, cmp.Diff(wantJSON, out.String()), "JSON result does not match (-want +got)")
 }
diff --git a/scaletest/harness/run.go b/scaletest/harness/run.go
index 4ee4ee976c83b..00cdc0dbf1936 100644
--- a/scaletest/harness/run.go
+++ b/scaletest/harness/run.go
@@ -28,7 +28,7 @@ type Runnable interface {
 type Cleanable interface {
 	Runnable
 	// Cleanup should clean up any lingering resources from the test.
-	Cleanup(ctx context.Context, id string) error
+	Cleanup(ctx context.Context, id string, logs io.Writer) error
 }
 
 // AddRun creates a new *TestRun with the given name, ID and Runnable, adds it
@@ -131,7 +131,7 @@ func (r *TestRun) Cleanup(ctx context.Context) (err error) {
 		}
 	}()
 
-	err = c.Cleanup(ctx, r.id)
+	err = c.Cleanup(ctx, r.id, r.logs)
 	//nolint:revive // we use named returns because we mutate it in a defer
 	return
 }
diff --git a/scaletest/harness/run_test.go b/scaletest/harness/run_test.go
index a8e0932b6e979..7466e974352fa 100644
--- a/scaletest/harness/run_test.go
+++ b/scaletest/harness/run_test.go
@@ -9,14 +9,14 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/harness"
 )
 
 // testFns implements Runnable and Cleanable.
 type testFns struct {
 	RunFn func(ctx context.Context, id string, logs io.Writer) error
 	// CleanupFn is optional if no cleanup is required.
-	CleanupFn func(ctx context.Context, id string) error
+	CleanupFn func(ctx context.Context, id string, logs io.Writer) error
 }
 
 // Run implements Runnable.
@@ -25,12 +25,12 @@ func (fns testFns) Run(ctx context.Context, id string, logs io.Writer) error {
 }
 
 // Cleanup implements Cleanable.
-func (fns testFns) Cleanup(ctx context.Context, id string) error {
+func (fns testFns) Cleanup(ctx context.Context, id string, logs io.Writer) error {
 	if fns.CleanupFn == nil {
 		return nil
 	}
 
-	return fns.CleanupFn(ctx, id)
+	return fns.CleanupFn(ctx, id, logs)
 }
 
 func Test_TestRun(t *testing.T) {
@@ -49,7 +49,7 @@ func Test_TestRun(t *testing.T) {
 					atomic.AddInt64(&runCalled, 1)
 					return nil
 				},
-				CleanupFn: func(ctx context.Context, id string) error {
+				CleanupFn: func(ctx context.Context, id string, logs io.Writer) error {
 					atomic.AddInt64(&cleanupCalled, 1)
 					return nil
 				},
@@ -93,7 +93,7 @@ func Test_TestRun(t *testing.T) {
 				RunFn: func(ctx context.Context, id string, logs io.Writer) error {
 					return nil
 				},
-				CleanupFn: func(ctx context.Context, id string) error {
+				CleanupFn: func(ctx context.Context, id string, logs io.Writer) error {
 					atomic.AddInt64(&cleanupCalled, 1)
 					return nil
 				},
diff --git a/scaletest/harness/strategies_test.go b/scaletest/harness/strategies_test.go
index 909a3a8f39e5e..0858b5bf71da1 100644
--- a/scaletest/harness/strategies_test.go
+++ b/scaletest/harness/strategies_test.go
@@ -13,7 +13,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/harness"
 )
 
 //nolint:paralleltest // this tests uses timings to determine if it's working
diff --git a/scaletest/lib/coder_init.sh b/scaletest/lib/coder_init.sh
index c3b322e6c47a0..f8c905958ece4 100755
--- a/scaletest/lib/coder_init.sh
+++ b/scaletest/lib/coder_init.sh
@@ -20,7 +20,6 @@ ARCH="$(arch)"
 if [[ "$ARCH" == "x86_64" ]]; then
 	ARCH="amd64"
 fi
-PLATFORM="$(uname | tr '[:upper:]' '[:lower:]')"
 
 if [[ -f "${CONFIG_DIR}/coder.env" ]]; then
 	echo "Found existing coder.env in ${CONFIG_DIR}!"
@@ -29,8 +28,20 @@ if [[ -f "${CONFIG_DIR}/coder.env" ]]; then
 fi
 
 maybedryrun "$DRY_RUN" mkdir -p "${CONFIG_DIR}"
-echo "Fetching Coder CLI for first-time setup!"
-maybedryrun "$DRY_RUN" curl -fsSLk "${CODER_URL}/bin/coder-${PLATFORM}-${ARCH}" -o "${CONFIG_DIR}/coder"
+echo "Fetching Coder for first-time setup!"
+pod=$(kubectl get pods \
+	--namespace="${NAMESPACE}" \
+	--selector="app.kubernetes.io/name=coder,app.kubernetes.io/part-of=coder" \
+	--output="jsonpath='{.items[0].metadata.name}'")
+if [[ -z ${pod} ]]; then
+	log "Could not find coder pod!"
+	exit 1
+fi
+maybedryrun "$DRY_RUN" kubectl \
+	--namespace="${NAMESPACE}" \
+	cp \
+	--container=coder \
+	"${pod}:/opt/coder" "${CONFIG_DIR}/coder"
 maybedryrun "$DRY_RUN" chmod +x "${CONFIG_DIR}/coder"
 
 set +o pipefail
diff --git a/scaletest/placebo/config.go b/scaletest/placebo/config.go
index 501afb3961572..7d142b1d6b849 100644
--- a/scaletest/placebo/config.go
+++ b/scaletest/placebo/config.go
@@ -3,7 +3,7 @@ package placebo
 import (
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpapi"
 )
 
 type Config struct {
diff --git a/scaletest/placebo/config_test.go b/scaletest/placebo/config_test.go
index b814e251523e2..8e3a40000a02e 100644
--- a/scaletest/placebo/config_test.go
+++ b/scaletest/placebo/config_test.go
@@ -6,8 +6,8 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/scaletest/placebo"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/scaletest/placebo"
 )
 
 func Test_Config(t *testing.T) {
diff --git a/scaletest/placebo/run.go b/scaletest/placebo/run.go
index 8692d8feb30b0..71cf4209fb1e1 100644
--- a/scaletest/placebo/run.go
+++ b/scaletest/placebo/run.go
@@ -9,7 +9,7 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/harness"
 )
 
 type Runner struct {
diff --git a/scaletest/placebo/run_test.go b/scaletest/placebo/run_test.go
index 3b6a0b382a617..86aaf634846d3 100644
--- a/scaletest/placebo/run_test.go
+++ b/scaletest/placebo/run_test.go
@@ -9,8 +9,8 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/scaletest/placebo"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/scaletest/placebo"
 )
 
 func Test_Runner(t *testing.T) {
diff --git a/scaletest/reconnectingpty/config.go b/scaletest/reconnectingpty/config.go
index 924a3e885e635..c226bcc39ca45 100644
--- a/scaletest/reconnectingpty/config.go
+++ b/scaletest/reconnectingpty/config.go
@@ -6,8 +6,8 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 const (
diff --git a/scaletest/reconnectingpty/config_test.go b/scaletest/reconnectingpty/config_test.go
index 0c5200bfd7fe6..c6944e3268076 100644
--- a/scaletest/reconnectingpty/config_test.go
+++ b/scaletest/reconnectingpty/config_test.go
@@ -7,9 +7,9 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/scaletest/reconnectingpty"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/scaletest/reconnectingpty"
 )
 
 func Test_Config(t *testing.T) {
diff --git a/scaletest/reconnectingpty/run.go b/scaletest/reconnectingpty/run.go
index afded88eb0412..d9b01c8a4d82a 100644
--- a/scaletest/reconnectingpty/run.go
+++ b/scaletest/reconnectingpty/run.go
@@ -13,10 +13,10 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/scaletest/harness"
-	"github.com/coder/coder/scaletest/loadtestutil"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/loadtestutil"
 )
 
 type Runner struct {
diff --git a/scaletest/reconnectingpty/run_test.go b/scaletest/reconnectingpty/run_test.go
index 382a3718436f9..524e2172ab447 100644
--- a/scaletest/reconnectingpty/run_test.go
+++ b/scaletest/reconnectingpty/run_test.go
@@ -9,17 +9,14 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"cdr.dev/slog"
-	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/scaletest/reconnectingpty"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/scaletest/reconnectingpty"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func Test_Runner(t *testing.T) {
@@ -252,10 +249,10 @@ func setupRunnerTest(t *testing.T) (client *codersdk.Client, agentID uuid.UUID)
 	authToken := uuid.NewString()
 	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 		Parse:         echo.ParseComplete,
-		ProvisionPlan: echo.ProvisionComplete,
-		ProvisionApply: []*proto.Provision_Response{{
-			Type: &proto.Provision_Response_Complete{
-				Complete: &proto.Provision_Complete{
+		ProvisionPlan: echo.PlanComplete,
+		ProvisionApply: []*proto.Response{{
+			Type: &proto.Response_Apply{
+				Apply: &proto.ApplyComplete{
 					Resources: []*proto.Resource{{
 						Name: "example",
 						Type: "aws_instance",
@@ -274,21 +271,12 @@ func setupRunnerTest(t *testing.T) (client *codersdk.Client, agentID uuid.UUID)
 	})
 
 	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-	coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 	workspace := coderdtest.CreateWorkspace(t, client, user.OrganizationID, template.ID)
-	coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
-
-	agentClient := agentsdk.New(client.URL)
-	agentClient.SetSessionToken(authToken)
-	agentCloser := agent.New(agent.Options{
-		Client: agentClient,
-		Logger: slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Named("agent").Leveled(slog.LevelDebug),
-	})
-	t.Cleanup(func() {
-		_ = agentCloser.Close()
-	})
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
+	_ = agenttest.New(t, client.URL, authToken)
 	resources := coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
 	require.Eventually(t, func() bool {
 		t.Log("agent id", resources[0].Agents[0].ID)
diff --git a/scaletest/setup/scaletest-sa.yaml b/scaletest/setup/scaletest-sa.yaml
new file mode 100644
index 0000000000000..96d9747d84b3e
--- /dev/null
+++ b/scaletest/setup/scaletest-sa.yaml
@@ -0,0 +1,51 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: scaletest-sa
+  namespace: coder-big
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: scaletest-role
+  namespace: coder-big
+rules:
+  - apiGroups:
+      - ""
+    resources: ["*"]
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+      - deletecollection
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: scaletest-rolebinding
+  namespace: coder-big
+subjects:
+  - kind: ServiceAccount
+    name: scaletest-sa
+roleRef:
+  kind: Role
+  name: scaletest-role
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: coder-provisioner-podmonitor-rolebinding
+  namespace: coder-big
+subjects:
+  - kind: ServiceAccount
+    name: coder-provisioner
+roleRef:
+  kind: Role
+  name: coder-podmonitor
+---
+
diff --git a/scaletest/templates/scaletest-runner/Dockerfile b/scaletest/templates/scaletest-runner/Dockerfile
new file mode 100644
index 0000000000000..9aa016b534a17
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/Dockerfile
@@ -0,0 +1,36 @@
+# This image is used to run scaletest jobs and, although it is inside
+# the template directory, it is built separately and pushed to
+# gcr.io/coder-dev-1/scaletest-runner:latest.
+#
+# Future improvements will include versioning and including the version
+# in the template push.
+
+FROM codercom/enterprise-base:ubuntu
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+USER root
+
+# TODO(mafredri): Remove unneeded dependencies once we have a clear idea of what's needed.
+RUN wget --quiet -O /tmp/terraform.zip https://releases.hashicorp.com/terraform/1.5.7/terraform_1.5.7_linux_amd64.zip \
+	&& unzip /tmp/terraform.zip -d /usr/local/bin \
+	&& rm /tmp/terraform.zip \
+	&& terraform --version
+
+RUN wget --quiet -O /tmp/envsubst "https://github.com/a8m/envsubst/releases/download/v1.2.0/envsubst-$(uname -s)-$(uname -m)" \
+	&& chmod +x /tmp/envsubst \
+	&& mv /tmp/envsubst /usr/local/bin
+
+RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list \
+	&& curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key --keyring /usr/share/keyrings/cloud.google.gpg add - \
+	&& apt-get update \
+	&& apt-get install --yes \
+	google-cloud-cli \
+	jq \
+	kubectl \
+	zstd \
+	&& gcloud --version \
+	&& kubectl version --client \
+	&& rm -rf /var/lib/apt/lists/*
+
+USER coder
diff --git a/scaletest/templates/scaletest-runner/README.md b/scaletest/templates/scaletest-runner/README.md
new file mode 100644
index 0000000000000..6c048211e1ad4
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/README.md
@@ -0,0 +1,9 @@
+---
+name: Scaletest Runner
+description: Run a scaletest.
+tags: [local]
+---
+
+# Scaletest Runner
+
+Run a scaletest.
diff --git a/scaletest/templates/scaletest-runner/main.tf b/scaletest/templates/scaletest-runner/main.tf
new file mode 100644
index 0000000000000..9e46817a7dd6b
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/main.tf
@@ -0,0 +1,739 @@
+terraform {
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = "~> 0.12"
+    }
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~> 2.22"
+    }
+  }
+}
+
+resource "time_static" "start_time" {
+  # We con't set `count = data.coder_workspace.me.start_count` here because then
+  # we can't use this value in `locals`. The permission check is recreated on
+  # start, which will update the timestamp.
+  triggers = {
+    count : length(null_resource.permission_check)
+  }
+}
+
+resource "null_resource" "permission_check" {
+  count = data.coder_workspace.me.start_count
+
+  # Limit which users can create a workspace in this template.
+  # The "default" user and workspace are present because they are needed
+  # for the plan, and consequently, updating the template.
+  lifecycle {
+    precondition {
+      condition     = can(regex("^(default/default|scaletest/runner)$", "${data.coder_workspace.me.owner}/${data.coder_workspace.me.name}"))
+      error_message = "User and workspace name is not allowed, expected 'scaletest/runner'."
+    }
+  }
+}
+
+locals {
+  workspace_pod_name                             = "coder-scaletest-runner-${lower(data.coder_workspace.me.owner)}-${lower(data.coder_workspace.me.name)}"
+  workspace_pod_instance                         = "coder-workspace-${lower(data.coder_workspace.me.owner)}-${lower(data.coder_workspace.me.name)}"
+  workspace_pod_termination_grace_period_seconds = 5 * 60 * 60 # 5 hours (cleanup timeout).
+  service_account_name                           = "scaletest-sa"
+  cpu                                            = 16
+  memory                                         = 64
+  home_disk_size                                 = 10
+  scaletest_run_id                               = "scaletest-${replace(time_static.start_time.rfc3339, ":", "-")}"
+  scaletest_run_dir                              = "/home/coder/${local.scaletest_run_id}"
+  scaletest_run_start_time                       = time_static.start_time.rfc3339
+  grafana_url                                    = "https://stats.dev.c8s.io"
+  grafana_dashboard_uid                          = "qLVSTR-Vz"
+  grafana_dashboard_name                         = "coderv2-loadtest-dashboard"
+}
+
+data "coder_provisioner" "me" {
+}
+
+data "coder_workspace" "me" {
+}
+
+data "coder_parameter" "verbose" {
+  order       = 1
+  type        = "bool"
+  name        = "Verbose"
+  default     = false
+  description = "Show debug output."
+  mutable     = true
+  ephemeral   = true
+}
+
+data "coder_parameter" "dry_run" {
+  order       = 2
+  type        = "bool"
+  name        = "Dry-run"
+  default     = true
+  description = "Perform a dry-run to see what would happen."
+  mutable     = true
+  ephemeral   = true
+}
+
+data "coder_parameter" "repo_branch" {
+  order       = 3
+  type        = "string"
+  name        = "Branch"
+  default     = "main"
+  description = "Branch of coder/coder repo to check out (only useful for developing the runner)."
+  mutable     = true
+}
+
+data "coder_parameter" "comment" {
+  order       = 4
+  type        = "string"
+  name        = "Comment"
+  default     = ""
+  description = "Describe **what** you're testing and **why** you're testing it."
+  mutable     = true
+  ephemeral   = true
+}
+
+data "coder_parameter" "create_concurrency" {
+  order       = 10
+  type        = "number"
+  name        = "Create concurrency"
+  default     = 10
+  description = "The number of workspaces to create concurrently."
+  mutable     = true
+
+  # Setting zero = unlimited, but perhaps not a good idea,
+  # we can raise this limit instead.
+  validation {
+    min = 1
+    max = 100
+  }
+}
+
+data "coder_parameter" "job_concurrency" {
+  order       = 11
+  type        = "number"
+  name        = "Job concurrency"
+  default     = 0
+  description = "The number of concurrent jobs (e.g. when producing workspace traffic)."
+  mutable     = true
+
+  # Setting zero = unlimited, but perhaps not a good idea,
+  # we can raise this limit instead.
+  validation {
+    min = 0
+  }
+}
+
+data "coder_parameter" "cleanup_concurrency" {
+  order       = 12
+  type        = "number"
+  name        = "Cleanup concurrency"
+  default     = 10
+  description = "The number of concurrent cleanup jobs."
+  mutable     = true
+
+  # Setting zero = unlimited, but perhaps not a good idea,
+  # we can raise this limit instead.
+  validation {
+    min = 1
+    max = 100
+  }
+}
+
+data "coder_parameter" "cleanup_strategy" {
+  order       = 13
+  name        = "Cleanup strategy"
+  default     = "always"
+  description = "The strategy used to cleanup workspaces after the scaletest is complete."
+  mutable     = true
+  ephemeral   = true
+  option {
+    name        = "Always"
+    value       = "always"
+    description = "Automatically cleanup workspaces after the scaletest ends."
+  }
+  option {
+    name        = "On stop"
+    value       = "on_stop"
+    description = "Cleanup workspaces when the workspace is stopped."
+  }
+  option {
+    name        = "On success"
+    value       = "on_success"
+    description = "Automatically cleanup workspaces after the scaletest is complete if no error occurs."
+  }
+  option {
+    name        = "On error"
+    value       = "on_error"
+    description = "Automatically cleanup workspaces after the scaletest is complete if an error occurs."
+  }
+}
+
+
+data "coder_parameter" "workspace_template" {
+  order        = 20
+  name         = "workspace_template"
+  display_name = "Workspace Template"
+  description  = "The template used for workspace creation."
+  default      = "kubernetes-minimal"
+  icon         = "/emojis/1f4dc.png" # Scroll.
+  mutable      = true
+  option {
+    name        = "Minimal"
+    value       = "kubernetes-minimal" # Feather.
+    icon        = "/emojis/1fab6.png"
+    description = "Sized to fit approx. 32 per t2d-standard-8 instance."
+  }
+  option {
+    name        = "Small"
+    value       = "kubernetes-small"
+    icon        = "/emojis/1f42d.png" # Mouse.
+    description = "Provisions a small-sized workspace with no persistent storage."
+  }
+  option {
+    name        = "Medium"
+    value       = "kubernetes-medium"
+    icon        = "/emojis/1f436.png" # Dog.
+    description = "Provisions a medium-sized workspace with no persistent storage."
+  }
+  option {
+    name        = "Large"
+    value       = "kubernetes-large"
+    icon        = "/emojis/1f434.png" # Horse.
+    description = "Provisions a large-sized workspace with no persistent storage."
+  }
+}
+
+data "coder_parameter" "num_workspaces" {
+  order       = 21
+  type        = "number"
+  name        = "Number of workspaces to create"
+  default     = 100
+  description = "The scaletest suite will create this number of workspaces."
+  mutable     = true
+
+  validation {
+    min = 0
+    max = 1000
+  }
+}
+
+
+data "coder_parameter" "load_scenarios" {
+  order       = 22
+  name        = "Load Scenarios"
+  type        = "list(string)"
+  description = "The load scenarios to run."
+  mutable     = true
+  ephemeral   = true
+  default = jsonencode([
+    "SSH Traffic",
+    "Web Terminal Traffic",
+    "Dashboard Traffic",
+  ])
+}
+
+data "coder_parameter" "load_scenario_ssh_traffic_duration" {
+  order       = 23
+  name        = "SSH Traffic Duration"
+  type        = "number"
+  description = "The duration of the SSH traffic load scenario in minutes."
+  mutable     = true
+  default     = 30
+  validation {
+    min = 1
+    max = 1440 // 24 hours.
+  }
+}
+
+data "coder_parameter" "load_scenario_ssh_bytes_per_tick" {
+  order       = 24
+  name        = "SSH Bytes Per Tick"
+  type        = "number"
+  description = "The number of bytes to send per tick in the SSH traffic load scenario."
+  mutable     = true
+  default     = 1024
+  validation {
+    min = 1
+  }
+}
+
+data "coder_parameter" "load_scenario_ssh_tick_interval" {
+  order       = 25
+  name        = "SSH Tick Interval"
+  type        = "number"
+  description = "The number of milliseconds between each tick in the SSH traffic load scenario."
+  mutable     = true
+  default     = 100
+  validation {
+    min = 1
+  }
+}
+
+data "coder_parameter" "load_scenario_web_terminal_traffic_duration" {
+  order       = 26
+  name        = "Web Terminal Traffic Duration"
+  type        = "number"
+  description = "The duration of the web terminal traffic load scenario in minutes."
+  mutable     = true
+  default     = 30
+  validation {
+    min = 1
+    max = 1440 // 24 hours.
+  }
+}
+
+data "coder_parameter" "load_scenario_web_terminal_bytes_per_tick" {
+  order       = 27
+  name        = "Web Terminal Bytes Per Tick"
+  type        = "number"
+  description = "The number of bytes to send per tick in the web terminal traffic load scenario."
+  mutable     = true
+  default     = 1024
+  validation {
+    min = 1
+  }
+}
+
+data "coder_parameter" "load_scenario_web_terminal_tick_interval" {
+  order       = 28
+  name        = "Web Terminal Tick Interval"
+  type        = "number"
+  description = "The number of milliseconds between each tick in the web terminal traffic load scenario."
+  mutable     = true
+  default     = 100
+  validation {
+    min = 1
+  }
+}
+
+data "coder_parameter" "load_scenario_dashboard_traffic_duration" {
+  order       = 29
+  name        = "Dashboard Traffic Duration"
+  type        = "number"
+  description = "The duration of the dashboard traffic load scenario in minutes."
+  mutable     = true
+  default     = 30
+  validation {
+    min = 1
+    max = 1440 // 24 hours.
+  }
+}
+
+data "coder_parameter" "load_scenario_baseline_duration" {
+  order       = 26
+  name        = "Baseline Wait Duration"
+  type        = "number"
+  description = "The duration to wait before starting a load scenario in minutes."
+  mutable     = true
+  default     = 5
+  validation {
+    min = 0
+    max = 60
+  }
+}
+
+data "coder_parameter" "namespace" {
+  order       = 999
+  type        = "string"
+  name        = "Namespace"
+  default     = "coder-big"
+  description = "The Kubernetes namespace to create the scaletest runner resources in."
+}
+
+data "archive_file" "scripts_zip" {
+  type        = "zip"
+  output_path = "${path.module}/scripts.zip"
+  source_dir  = "${path.module}/scripts"
+}
+
+resource "coder_agent" "main" {
+  arch = data.coder_provisioner.me.arch
+  dir  = local.scaletest_run_dir
+  os   = "linux"
+  env = {
+    VERBOSE : data.coder_parameter.verbose.value ? "1" : "0",
+    DRY_RUN : data.coder_parameter.dry_run.value ? "1" : "0",
+    CODER_CONFIG_DIR : "/home/coder/.config/coderv2",
+    CODER_USER_TOKEN : data.coder_workspace.me.owner_session_token,
+    CODER_URL : data.coder_workspace.me.access_url,
+    CODER_USER : data.coder_workspace.me.owner,
+    CODER_WORKSPACE : data.coder_workspace.me.name,
+
+    # Global scaletest envs that may affect each `coder exp scaletest` invocation.
+    CODER_SCALETEST_PROMETHEUS_ADDRESS : "0.0.0.0:21112",
+    CODER_SCALETEST_PROMETHEUS_WAIT : "60s",
+    CODER_SCALETEST_CONCURRENCY : "${data.coder_parameter.job_concurrency.value}",
+    CODER_SCALETEST_CLEANUP_CONCURRENCY : "${data.coder_parameter.cleanup_concurrency.value}",
+
+    # Expose as params as well, for reporting (TODO(mafredri): refactor, only have one).
+    SCALETEST_PARAM_SCALETEST_CONCURRENCY : "${data.coder_parameter.job_concurrency.value}",
+    SCALETEST_PARAM_SCALETEST_CLEANUP_CONCURRENCY : "${data.coder_parameter.cleanup_concurrency.value}",
+
+    # Local envs passed as arguments to `coder exp scaletest` invocations.
+    SCALETEST_RUN_ID : local.scaletest_run_id,
+    SCALETEST_RUN_DIR : local.scaletest_run_dir,
+    SCALETEST_RUN_START_TIME : local.scaletest_run_start_time,
+
+    # Comment is a scaletest param, but we want to surface it separately from
+    # the rest, so we use a different name.
+    SCALETEST_COMMENT : data.coder_parameter.comment.value != "" ? data.coder_parameter.comment.value : "No comment provided",
+
+    SCALETEST_PARAM_TEMPLATE : data.coder_parameter.workspace_template.value,
+    SCALETEST_PARAM_REPO_BRANCH : data.coder_parameter.repo_branch.value,
+    SCALETEST_PARAM_NUM_WORKSPACES : data.coder_parameter.num_workspaces.value,
+    SCALETEST_PARAM_CREATE_CONCURRENCY : "${data.coder_parameter.create_concurrency.value}",
+    SCALETEST_PARAM_CLEANUP_STRATEGY : data.coder_parameter.cleanup_strategy.value,
+    SCALETEST_PARAM_LOAD_SCENARIOS : data.coder_parameter.load_scenarios.value,
+    SCALETEST_PARAM_LOAD_SCENARIO_SSH_TRAFFIC_DURATION : "${data.coder_parameter.load_scenario_ssh_traffic_duration.value}",
+    SCALETEST_PARAM_LOAD_SCENARIO_SSH_TRAFFIC_BYTES_PER_TICK : "${data.coder_parameter.load_scenario_ssh_bytes_per_tick.value}",
+    SCALETEST_PARAM_LOAD_SCENARIO_SSH_TRAFFIC_TICK_INTERVAL : "${data.coder_parameter.load_scenario_ssh_tick_interval.value}",
+    SCALETEST_PARAM_LOAD_SCENARIO_WEB_TERMINAL_TRAFFIC_DURATION : "${data.coder_parameter.load_scenario_web_terminal_traffic_duration.value}",
+    SCALETEST_PARAM_LOAD_SCENARIO_WEB_TERMINAL_TRAFFIC_BYTES_PER_TICK : "${data.coder_parameter.load_scenario_web_terminal_bytes_per_tick.value}",
+    SCALETEST_PARAM_LOAD_SCENARIO_WEB_TERMINAL_TRAFFIC_TICK_INTERVAL : "${data.coder_parameter.load_scenario_web_terminal_tick_interval.value}",
+    SCALETEST_PARAM_LOAD_SCENARIO_DASHBOARD_TRAFFIC_DURATION : "${data.coder_parameter.load_scenario_dashboard_traffic_duration.value}",
+    SCALETEST_PARAM_LOAD_SCENARIO_BASELINE_DURATION : "${data.coder_parameter.load_scenario_baseline_duration.value}",
+
+    GRAFANA_URL : local.grafana_url,
+
+    SCRIPTS_ZIP : filebase64(data.archive_file.scripts_zip.output_path),
+    SCRIPTS_DIR : "/tmp/scripts",
+  }
+  display_apps {
+    vscode     = false
+    ssh_helper = false
+  }
+  startup_script_timeout  = 86400
+  shutdown_script_timeout = 7200
+  startup_script_behavior = "blocking"
+  startup_script          = file("startup.sh")
+  shutdown_script         = file("shutdown.sh")
+
+  # IDEA(mafredri): It would be pretty cool to define metadata to expect JSON output, each field/item could become a separate metadata item.
+  # Scaletest metadata.
+  metadata {
+    display_name = "Scaletest status"
+    key          = "00_scaletest_status"
+    script       = file("metadata_status.sh")
+    interval     = 1
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Scaletest phase"
+    key          = "01_scaletest_phase"
+    script       = file("metadata_phase.sh")
+    interval     = 1
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Scaletest phase (previous)"
+    key          = "02_scaletest_previous_phase"
+    script       = file("metadata_previous_phase.sh")
+    interval     = 1
+    timeout      = 1
+  }
+
+  # Misc workspace metadata.
+  metadata {
+    display_name = "CPU Usage"
+    key          = "80_cpu_usage"
+    script       = "coder stat cpu"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "RAM Usage"
+    key          = "81_ram_usage"
+    script       = "coder stat mem"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Home Disk"
+    key          = "82_home_disk"
+    script       = "coder stat disk --path $${HOME}"
+    interval     = 60
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "CPU Usage (Host)"
+    key          = "83_cpu_usage_host"
+    script       = "coder stat cpu --host"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Memory Usage (Host)"
+    key          = "84_mem_usage_host"
+    script       = "coder stat mem --host"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Load Average (Host)"
+    key          = "85_load_host"
+    # Get load avg scaled by number of cores.
+    script   = <<-EOS
+      echo "`cat /proc/loadavg | awk '{ print $1 }'` `nproc`" | awk '{ printf "%0.2f", $1/$2 }'
+    EOS
+    interval = 60
+    timeout  = 1
+  }
+}
+
+module "code-server" {
+  source          = "https://registry.coder.com/modules/code-server"
+  agent_id        = coder_agent.main.id
+  install_version = "4.8.3"
+  folder          = local.scaletest_run_dir
+}
+
+module "filebrowser" {
+  source   = "https://registry.coder.com/modules/filebrowser"
+  agent_id = coder_agent.main.id
+  folder   = local.scaletest_run_dir
+}
+
+resource "coder_app" "grafana" {
+  agent_id     = coder_agent.main.id
+  slug         = "00-grafana"
+  display_name = "Grafana"
+  url          = "${local.grafana_url}/d/${local.grafana_dashboard_uid}/${local.grafana_dashboard_name}?orgId=1&from=${time_static.start_time.unix * 1000}&to=now"
+  icon         = "https://grafana.com/static/assets/img/fav32.png"
+  external     = true
+}
+
+resource "coder_app" "prometheus" {
+  agent_id     = coder_agent.main.id
+  slug         = "01-prometheus"
+  display_name = "Prometheus"
+  // https://stats.dev.c8s.io:9443/classic/graph?g0.range_input=2h&g0.end_input=2023-09-08%2015%3A58&g0.stacked=0&g0.expr=rate(pg_stat_database_xact_commit%7Bcluster%3D%22big%22%2Cdatname%3D%22big-coder%22%7D%5B1m%5D)&g0.tab=0
+  url      = "https://stats.dev.c8s.io:9443"
+  icon     = "https://prometheus.io/assets/favicons/favicon-32x32.png"
+  external = true
+}
+
+resource "coder_app" "manual_cleanup" {
+  agent_id     = coder_agent.main.id
+  slug         = "02-manual-cleanup"
+  display_name = "Manual cleanup"
+  icon         = "/emojis/1f9f9.png"
+  command      = "/tmp/scripts/cleanup.sh manual"
+}
+
+resource "kubernetes_persistent_volume_claim" "home" {
+  depends_on = [null_resource.permission_check]
+  metadata {
+    name      = "${local.workspace_pod_name}-home"
+    namespace = data.coder_parameter.namespace.value
+    labels = {
+      "app.kubernetes.io/name"     = "coder-pvc"
+      "app.kubernetes.io/instance" = "coder-pvc-${lower(data.coder_workspace.me.owner)}-${lower(data.coder_workspace.me.name)}"
+      "app.kubernetes.io/part-of"  = "coder"
+      // Coder specific labels.
+      "com.coder.resource"       = "true"
+      "com.coder.workspace.id"   = data.coder_workspace.me.id
+      "com.coder.workspace.name" = data.coder_workspace.me.name
+      "com.coder.user.id"        = data.coder_workspace.me.owner_id
+      "com.coder.user.username"  = data.coder_workspace.me.owner
+    }
+    annotations = {
+      "com.coder.user.email" = data.coder_workspace.me.owner_email
+    }
+  }
+  wait_until_bound = false
+  spec {
+    access_modes = ["ReadWriteOnce"]
+    resources {
+      requests = {
+        storage = "${local.home_disk_size}Gi"
+      }
+    }
+  }
+}
+
+resource "kubernetes_pod" "main" {
+  depends_on = [null_resource.permission_check]
+  count      = data.coder_workspace.me.start_count
+  metadata {
+    name      = local.workspace_pod_name
+    namespace = data.coder_parameter.namespace.value
+    labels = {
+      "app.kubernetes.io/name"     = "coder-workspace"
+      "app.kubernetes.io/instance" = local.workspace_pod_instance
+      "app.kubernetes.io/part-of"  = "coder"
+      // Coder specific labels.
+      "com.coder.resource"       = "true"
+      "com.coder.workspace.id"   = data.coder_workspace.me.id
+      "com.coder.workspace.name" = data.coder_workspace.me.name
+      "com.coder.user.id"        = data.coder_workspace.me.owner_id
+      "com.coder.user.username"  = data.coder_workspace.me.owner
+    }
+    annotations = {
+      "com.coder.user.email" = data.coder_workspace.me.owner_email
+    }
+  }
+  # Set the pod delete timeout to termination_grace_period_seconds + 1m.
+  timeouts {
+    delete = "${(local.workspace_pod_termination_grace_period_seconds + 120) / 60}s"
+  }
+  spec {
+    security_context {
+      run_as_user = "1000"
+      fs_group    = "1000"
+    }
+
+    # Allow this pod to perform scale tests.
+    service_account_name = local.service_account_name
+
+    # Allow the coder agent to perform graceful shutdown and cleanup of
+    # scaletest resources. We add an extra minute so ensure work
+    # completion is prioritized over timeout.
+    termination_grace_period_seconds = local.workspace_pod_termination_grace_period_seconds + 60
+
+    container {
+      name              = "dev"
+      image             = "gcr.io/coder-dev-1/scaletest-runner:latest"
+      image_pull_policy = "Always"
+      command           = ["sh", "-c", coder_agent.main.init_script]
+      security_context {
+        run_as_user = "1000"
+      }
+      env {
+        name  = "CODER_AGENT_TOKEN"
+        value = coder_agent.main.token
+      }
+      env {
+        name  = "CODER_AGENT_LOG_DIR"
+        value = "${local.scaletest_run_dir}/logs"
+      }
+      env {
+        name = "GRAFANA_API_TOKEN"
+        value_from {
+          secret_key_ref {
+            name = data.kubernetes_secret.grafana_editor_api_token.metadata[0].name
+            key  = "token"
+          }
+        }
+      }
+      env {
+        name = "SLACK_WEBHOOK_URL"
+        value_from {
+          secret_key_ref {
+            name = data.kubernetes_secret.slack_scaletest_notifications_webhook_url.metadata[0].name
+            key  = "url"
+          }
+        }
+      }
+      resources {
+        # Set requests and limits values such that we can do performant
+        # execution of `coder scaletest` commands.
+        requests = {
+          "cpu"    = "250m"
+          "memory" = "512Mi"
+        }
+        limits = {
+          "cpu"    = "${local.cpu}"
+          "memory" = "${local.memory}Gi"
+        }
+      }
+      volume_mount {
+        mount_path = "/home/coder"
+        name       = "home"
+        read_only  = false
+      }
+      port {
+        container_port = 21112
+        name           = "prometheus-http"
+        protocol       = "TCP"
+      }
+    }
+
+    volume {
+      name = "home"
+      persistent_volume_claim {
+        claim_name = kubernetes_persistent_volume_claim.home.metadata.0.name
+        read_only  = false
+      }
+    }
+
+    affinity {
+      pod_anti_affinity {
+        // This affinity attempts to spread out all workspace pods evenly across
+        // nodes.
+        preferred_during_scheduling_ignored_during_execution {
+          weight = 1
+          pod_affinity_term {
+            topology_key = "kubernetes.io/hostname"
+            label_selector {
+              match_expressions {
+                key      = "app.kubernetes.io/name"
+                operator = "In"
+                values   = ["coder-workspace"]
+              }
+            }
+          }
+        }
+      }
+      node_affinity {
+        required_during_scheduling_ignored_during_execution {
+          node_selector_term {
+            match_expressions {
+              key      = "cloud.google.com/gke-nodepool"
+              operator = "In"
+              values   = ["big-workspacetraffic"] # Avoid placing on the same nodes as scaletest workspaces.
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+data "kubernetes_secret" "grafana_editor_api_token" {
+  metadata {
+    name      = "grafana-editor-api-token"
+    namespace = data.coder_parameter.namespace.value
+  }
+}
+
+data "kubernetes_secret" "slack_scaletest_notifications_webhook_url" {
+  metadata {
+    name      = "slack-scaletest-notifications-webhook-url"
+    namespace = data.coder_parameter.namespace.value
+  }
+}
+
+resource "kubernetes_manifest" "pod_monitor" {
+  count = data.coder_workspace.me.start_count
+  manifest = {
+    apiVersion = "monitoring.coreos.com/v1"
+    kind       = "PodMonitor"
+    metadata = {
+      namespace = data.coder_parameter.namespace.value
+      name      = "podmonitor-${local.workspace_pod_name}"
+    }
+    spec = {
+      selector = {
+        matchLabels = {
+          "app.kubernetes.io/instance" : local.workspace_pod_instance
+        }
+      }
+      podMetricsEndpoints = [
+        {
+          port     = "prometheus-http"
+          interval = "15s"
+        }
+      ]
+    }
+  }
+}
diff --git a/scaletest/templates/scaletest-runner/metadata_phase.sh b/scaletest/templates/scaletest-runner/metadata_phase.sh
new file mode 100755
index 0000000000000..755a8ba084db7
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/metadata_phase.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# shellcheck disable=SC2153 source=scaletest/templates/scaletest-runner/scripts/lib.sh
+. "${SCRIPTS_DIR}/lib.sh"
+
+get_phase
diff --git a/scaletest/templates/scaletest-runner/metadata_previous_phase.sh b/scaletest/templates/scaletest-runner/metadata_previous_phase.sh
new file mode 100755
index 0000000000000..c858687b72ad8
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/metadata_previous_phase.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# shellcheck disable=SC2153 source=scaletest/templates/scaletest-runner/scripts/lib.sh
+. "${SCRIPTS_DIR}/lib.sh" 2>/dev/null || return
+
+get_previous_phase
diff --git a/scaletest/templates/scaletest-runner/metadata_status.sh b/scaletest/templates/scaletest-runner/metadata_status.sh
new file mode 100755
index 0000000000000..8ec45f0875c1d
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/metadata_status.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# shellcheck disable=SC2153 source=scaletest/templates/scaletest-runner/scripts/lib.sh
+. "${SCRIPTS_DIR}/lib.sh" 2>/dev/null || return
+
+get_status
diff --git a/scaletest/templates/scaletest-runner/scripts/cleanup.sh b/scaletest/templates/scaletest-runner/scripts/cleanup.sh
new file mode 100755
index 0000000000000..ecdd086d9a4e0
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/scripts/cleanup.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+set -euo pipefail
+
+[[ $VERBOSE == 1 ]] && set -x
+
+# shellcheck disable=SC2153 source=scaletest/templates/scaletest-runner/scripts/lib.sh
+. "${SCRIPTS_DIR}/lib.sh"
+
+event=${1:-}
+
+if [[ -z $event ]]; then
+	event=manual
+fi
+
+if [[ $event = manual ]]; then
+	echo -n 'WARNING: This will clean up all scaletest resources, continue? (y/n) '
+	read -r -n 1
+	if [[ $REPLY != [yY] ]]; then
+		echo $'\nAborting...'
+		exit 1
+	fi
+fi
+
+start_phase "Cleanup (${event})"
+coder exp scaletest cleanup \
+	--cleanup-job-timeout 2h \
+	--cleanup-timeout 5h |
+	tee "${SCALETEST_RESULTS_DIR}/cleanup-${event}.txt"
+end_phase
+
+if [[ $event != prepare ]]; then
+	start_phase "Scaling down provisioners..."
+	maybedryrun "$DRY_RUN" kubectl scale deployment/coder-provisioner --replicas 1
+	maybedryrun "$DRY_RUN" kubectl rollout status deployment/coder-provisioner
+fi
+
+if [[ $event = manual ]]; then
+	echo 'Press any key to continue...'
+	read -s -r -n 1
+fi
diff --git a/scaletest/templates/scaletest-runner/scripts/lib.sh b/scaletest/templates/scaletest-runner/scripts/lib.sh
new file mode 100644
index 0000000000000..868dd5c078d2e
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/scripts/lib.sh
@@ -0,0 +1,313 @@
+#!/bin/bash
+set -euo pipefail
+
+# Only source this script once, this env comes from sourcing
+# scripts/lib.sh from coder/coder below.
+if [[ ${SCRIPTS_LIB_IS_SOURCED:-0} == 1 ]]; then
+	return 0
+fi
+
+# Source scripts/lib.sh from coder/coder for common functions.
+# shellcheck source=scripts/lib.sh
+. "${HOME}/coder/scripts/lib.sh"
+
+# Make shellcheck happy.
+DRY_RUN=${DRY_RUN:-0}
+
+# Environment variables shared between scripts.
+SCALETEST_STATE_DIR="${SCALETEST_RUN_DIR}/state"
+SCALETEST_PHASE_FILE="${SCALETEST_STATE_DIR}/phase"
+# shellcheck disable=SC2034
+SCALETEST_RESULTS_DIR="${SCALETEST_RUN_DIR}/results"
+SCALETEST_LOGS_DIR="${SCALETEST_RUN_DIR}/logs"
+SCALETEST_PPROF_DIR="${SCALETEST_RUN_DIR}/pprof"
+# https://github.com/kubernetes/kubernetes/issues/72501 :-(
+SCALETEST_CODER_BINARY="/tmp/coder-full-${SCALETEST_RUN_ID}"
+
+mkdir -p "${SCALETEST_STATE_DIR}" "${SCALETEST_RESULTS_DIR}" "${SCALETEST_LOGS_DIR}" "${SCALETEST_PPROF_DIR}"
+
+coder() {
+	if [[ ! -x "${SCALETEST_CODER_BINARY}" ]]; then
+		log "Fetching full coder binary..."
+		fetch_coder_full
+	fi
+	maybedryrun "${DRY_RUN}" "${SCALETEST_CODER_BINARY}" "${@}"
+}
+
+show_json() {
+	maybedryrun "${DRY_RUN}" jq 'del(.. | .logs?)' "${1}"
+}
+
+set_status() {
+	dry_run=
+	if [[ ${DRY_RUN} == 1 ]]; then
+		dry_run=" (dry-run)"
+	fi
+	prev_status=$(get_status)
+	if [[ ${prev_status} != *"Not started"* ]]; then
+		annotate_grafana_end "status" "Status: ${prev_status}"
+	fi
+	echo "$(date -Ins) ${*}${dry_run}" >>"${SCALETEST_STATE_DIR}/status"
+
+	annotate_grafana "status" "Status: ${*}"
+
+	status_lower=$(tr '[:upper:]' '[:lower:]' <<<"${*}")
+	set_pod_status_annotation "${status_lower}"
+}
+lock_status() {
+	chmod 0440 "${SCALETEST_STATE_DIR}/status"
+}
+get_status() {
+	# Order of importance (reverse of creation).
+	if [[ -f "${SCALETEST_STATE_DIR}/status" ]]; then
+		tail -n1 "${SCALETEST_STATE_DIR}/status" | cut -d' ' -f2-
+	else
+		echo "Not started"
+	fi
+}
+
+phase_num=0
+start_phase() {
+	# This may be incremented from another script, so we read it every time.
+	if [[ -f "${SCALETEST_PHASE_FILE}" ]]; then
+		phase_num=$(grep -c START: "${SCALETEST_PHASE_FILE}")
+	fi
+	phase_num=$((phase_num + 1))
+	log "Start phase ${phase_num}: ${*}"
+	echo "$(date -Ins) START:${phase_num}: ${*}" >>"${SCALETEST_PHASE_FILE}"
+
+	GRAFANA_EXTRA_TAGS="${PHASE_TYPE:-phase-default}" annotate_grafana "phase" "Phase ${phase_num}: ${*}"
+}
+end_phase() {
+	phase=$(tail -n 1 "${SCALETEST_PHASE_FILE}" | grep "START:${phase_num}:" | cut -d' ' -f3-)
+	if [[ -z ${phase} ]]; then
+		log "BUG: Could not find start phase ${phase_num} in ${SCALETEST_PHASE_FILE}"
+		return 1
+	fi
+	log "End phase ${phase_num}: ${phase}"
+	echo "$(date -Ins) END:${phase_num}: ${phase}" >>"${SCALETEST_PHASE_FILE}"
+
+	GRAFANA_EXTRA_TAGS="${PHASE_TYPE:-phase-default}" GRAFANA_ADD_TAGS="${PHASE_ADD_TAGS:-}" annotate_grafana_end "phase" "Phase ${phase_num}: ${phase}"
+}
+get_phase() {
+	if [[ -f "${SCALETEST_PHASE_FILE}" ]]; then
+		phase_raw=$(tail -n1 "${SCALETEST_PHASE_FILE}")
+		phase=$(echo "${phase_raw}" | cut -d' ' -f3-)
+		if [[ ${phase_raw} == *"END:"* ]]; then
+			phase+=" [done]"
+		fi
+		echo "${phase}"
+	else
+		echo "None"
+	fi
+}
+get_previous_phase() {
+	if [[ -f "${SCALETEST_PHASE_FILE}" ]] && [[ $(grep -c START: "${SCALETEST_PHASE_FILE}") -gt 1 ]]; then
+		grep START: "${SCALETEST_PHASE_FILE}" | tail -n2 | head -n1 | cut -d' ' -f3-
+	else
+		echo "None"
+	fi
+}
+
+annotate_grafana() {
+	local tags=${1} text=${2} start=${3:-$(($(date +%s) * 1000))}
+	local json resp id
+
+	if [[ -z $tags ]]; then
+		tags="scaletest,runner"
+	else
+		tags="scaletest,runner,${tags}"
+	fi
+	if [[ -n ${GRAFANA_EXTRA_TAGS:-} ]]; then
+		tags="${tags},${GRAFANA_EXTRA_TAGS}"
+	fi
+
+	log "Annotating Grafana (start=${start}): ${text} [${tags}]"
+
+	json="$(
+		jq \
+			--argjson time "${start}" \
+			--arg text "${text}" \
+			--arg tags "${tags}" \
+			'{time: $time, tags: $tags | split(","), text: $text}' <<<'{}'
+	)"
+	if [[ ${DRY_RUN} == 1 ]]; then
+		echo "FAKEID:${tags}:${text}:${start}" >>"${SCALETEST_STATE_DIR}/grafana-annotations"
+		log "Would have annotated Grafana, data=${json}"
+		return 0
+	fi
+	if ! resp="$(
+		curl -sSL \
+			--insecure \
+			-H "Authorization: Bearer ${GRAFANA_API_TOKEN}" \
+			-H "Content-Type: application/json" \
+			-d "${json}" \
+			"${GRAFANA_URL}/api/annotations"
+	)"; then
+		# Don't abort scaletest just because we couldn't annotate Grafana.
+		log "Failed to annotate Grafana: ${resp}"
+		return 0
+	fi
+
+	if [[ $(jq -r '.message' <<<"${resp}") != "Annotation added" ]]; then
+		log "Failed to annotate Grafana: ${resp}"
+		return 0
+	fi
+
+	log "Grafana annotation added!"
+
+	id="$(jq -r '.id' <<<"${resp}")"
+	echo "${id}:${tags}:${text}:${start}" >>"${SCALETEST_STATE_DIR}/grafana-annotations"
+}
+annotate_grafana_end() {
+	local tags=${1} text=${2} start=${3:-} end=${4:-$(($(date +%s) * 1000))}
+	local id json resp
+
+	if [[ -z $tags ]]; then
+		tags="scaletest,runner"
+	else
+		tags="scaletest,runner,${tags}"
+	fi
+	if [[ -n ${GRAFANA_EXTRA_TAGS:-} ]]; then
+		tags="${tags},${GRAFANA_EXTRA_TAGS}"
+	fi
+
+	if ! id=$(grep ":${tags}:${text}:${start}" "${SCALETEST_STATE_DIR}/grafana-annotations" | sort -n | tail -n1 | cut -d: -f1); then
+		log "NOTICE: Could not find Grafana annotation to end: '${tags}:${text}:${start}', skipping..."
+		return 0
+	fi
+
+	log "Updating Grafana annotation (end=${end}): ${text} [${tags}, add=${GRAFANA_ADD_TAGS:-}]"
+
+	if [[ -n ${GRAFANA_ADD_TAGS:-} ]]; then
+		json="$(
+			jq -n \
+				--argjson timeEnd "${end}" \
+				--arg tags "${tags},${GRAFANA_ADD_TAGS}" \
+				'{timeEnd: $timeEnd, tags: $tags | split(",")}'
+		)"
+	else
+		json="$(
+			jq -n \
+				--argjson timeEnd "${end}" \
+				'{timeEnd: $timeEnd}'
+		)"
+	fi
+	if [[ ${DRY_RUN} == 1 ]]; then
+		log "Would have patched Grafana annotation: id=${id}, data=${json}"
+		return 0
+	fi
+	if ! resp="$(
+		curl -sSL \
+			--insecure \
+			-H "Authorization: Bearer ${GRAFANA_API_TOKEN}" \
+			-H "Content-Type: application/json" \
+			-X PATCH \
+			-d "${json}" \
+			"${GRAFANA_URL}/api/annotations/${id}"
+	)"; then
+		# Don't abort scaletest just because we couldn't annotate Grafana.
+		log "Failed to annotate Grafana end: ${resp}"
+		return 0
+	fi
+
+	if [[ $(jq -r '.message' <<<"${resp}") != "Annotation patched" ]]; then
+		log "Failed to annotate Grafana end: ${resp}"
+		return 0
+	fi
+
+	log "Grafana annotation patched!"
+}
+
+wait_baseline() {
+	s=${1:-2}
+	PHASE_TYPE="phase-wait" start_phase "Waiting ${s}m to establish baseline"
+	maybedryrun "$DRY_RUN" sleep $((s * 60))
+	PHASE_TYPE="phase-wait" end_phase
+}
+
+get_appearance() {
+	session_token=$CODER_USER_TOKEN
+	if [[ -f "${CODER_CONFIG_DIR}/session" ]]; then
+		session_token="$(<"${CODER_CONFIG_DIR}/session")"
+	fi
+	curl -sSL \
+		-H "Coder-Session-Token: ${session_token}" \
+		"${CODER_URL}/api/v2/appearance"
+}
+set_appearance() {
+	local json=$1 color=$2 message=$3
+
+	session_token=$CODER_USER_TOKEN
+	if [[ -f "${CODER_CONFIG_DIR}/session" ]]; then
+		session_token="$(<"${CODER_CONFIG_DIR}/session")"
+	fi
+	newjson="$(
+		jq \
+			--arg color "${color}" \
+			--arg message "${message}" \
+			'. | .service_banner.message |= $message | .service_banner.background_color |= $color' <<<"${json}"
+	)"
+	maybedryrun "${DRY_RUN}" curl -sSL \
+		-X PUT \
+		-H 'Content-Type: application/json' \
+		-H "Coder-Session-Token: ${session_token}" \
+		--data "${newjson}" \
+		"${CODER_URL}/api/v2/appearance"
+}
+
+namespace() {
+	cat /var/run/secrets/kubernetes.io/serviceaccount/namespace
+}
+coder_pods() {
+	kubectl get pods \
+		--namespace "$(namespace)" \
+		--selector "app.kubernetes.io/name=coder,app.kubernetes.io/part-of=coder" \
+		--output jsonpath='{.items[*].metadata.name}'
+}
+
+# fetch_coder_full fetches the full (non-slim) coder binary from one of the coder pods
+# running in the same namespace as the current pod.
+fetch_coder_full() {
+	if [[ -x "${SCALETEST_CODER_BINARY}" ]]; then
+		log "Full Coder binary already exists at ${SCALETEST_CODER_BINARY}"
+		return 0
+	fi
+	ns=$(namespace)
+	if [[ -z "${ns}" ]]; then
+		log "Could not determine namespace!"
+		return 1
+	fi
+	log "Namespace from serviceaccount token is ${ns}"
+	pods=$(coder_pods)
+	if [[ -z ${pods} ]]; then
+		log "Could not find coder pods!"
+		return 1
+	fi
+	pod=$(cut -d ' ' -f 1 <<<"${pods}")
+	if [[ -z ${pod} ]]; then
+		log "Could not find coder pod!"
+		return 1
+	fi
+	log "Fetching full Coder binary from ${pod}"
+	# We need --retries due to https://github.com/kubernetes/kubernetes/issues/60140 :(
+	maybedryrun "${DRY_RUN}" kubectl \
+		--namespace "${ns}" \
+		cp \
+		--container coder \
+		--retries 10 \
+		"${pod}:/opt/coder" "${SCALETEST_CODER_BINARY}"
+	maybedryrun "${DRY_RUN}" chmod +x "${SCALETEST_CODER_BINARY}"
+	log "Full Coder binary downloaded to ${SCALETEST_CODER_BINARY}"
+}
+
+# set_pod_status_annotation annotates the currently running pod with the key
+# com.coder.scaletest.status. It will overwrite the previous status.
+set_pod_status_annotation() {
+	if [[ $# -ne 1 ]]; then
+		log "BUG: Must specify an annotation value"
+		return 1
+	else
+		maybedryrun "${DRY_RUN}" kubectl --namespace "$(namespace)" annotate pod "$(hostname)" "com.coder.scaletest.status=$1" --overwrite
+	fi
+}
diff --git a/scaletest/templates/scaletest-runner/scripts/prepare.sh b/scaletest/templates/scaletest-runner/scripts/prepare.sh
new file mode 100755
index 0000000000000..e7e6c4d2a292a
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/scripts/prepare.sh
@@ -0,0 +1,65 @@
+#!/bin/bash
+set -euo pipefail
+
+[[ $VERBOSE == 1 ]] && set -x
+
+# shellcheck disable=SC2153 source=scaletest/templates/scaletest-runner/scripts/lib.sh
+. "${SCRIPTS_DIR}/lib.sh"
+
+mkdir -p "${SCALETEST_STATE_DIR}"
+mkdir -p "${SCALETEST_RESULTS_DIR}"
+
+log "Preparing scaletest workspace environment..."
+set_status Preparing
+
+log "Compressing previous run logs (if applicable)..."
+mkdir -p "${HOME}/archive"
+for dir in "${HOME}/scaletest-"*; do
+	if [[ ${dir} = "${SCALETEST_RUN_DIR}" ]]; then
+		continue
+	fi
+	if [[ -d ${dir} ]]; then
+		name="$(basename "${dir}")"
+		(
+			cd "$(dirname "${dir}")"
+			ZSTD_CLEVEL=12 maybedryrun "$DRY_RUN" tar --zstd -cf "${HOME}/archive/${name}.tar.zst" "${name}"
+		)
+		maybedryrun "$DRY_RUN" rm -rf "${dir}"
+	fi
+done
+
+log "Creating coder CLI token (needed for cleanup during shutdown)..."
+
+mkdir -p "${CODER_CONFIG_DIR}"
+echo -n "${CODER_URL}" >"${CODER_CONFIG_DIR}/url"
+
+set +x # Avoid logging the token.
+# Persist configuration for shutdown script too since the
+# owner token is invalidated immediately on workspace stop.
+export CODER_SESSION_TOKEN=${CODER_USER_TOKEN}
+coder tokens delete scaletest_runner >/dev/null 2>&1 || true
+# TODO(mafredri): Set TTL? This could interfere with delayed stop though.
+token=$(coder tokens create --name scaletest_runner)
+if [[ $DRY_RUN == 1 ]]; then
+	token=${CODER_SESSION_TOKEN}
+fi
+unset CODER_SESSION_TOKEN
+echo -n "${token}" >"${CODER_CONFIG_DIR}/session"
+[[ $VERBOSE == 1 ]] && set -x # Restore logging (if enabled).
+
+log "Cleaning up from previous runs (if applicable)..."
+"${SCRIPTS_DIR}/cleanup.sh" "prepare"
+
+log "Preparation complete!"
+
+PROVISIONER_REPLICA_COUNT="${SCALETEST_PARAM_CREATE_CONCURRENCY:-0}"
+if [[ "${PROVISIONER_REPLICA_COUNT}" -eq 0 ]]; then
+	# TODO(Cian): what is a good default value here?
+	echo "Setting PROVISIONER_REPLICA_COUNT to 10 since SCALETEST_PARAM_CREATE_CONCURRENCY is 0"
+	PROVISIONER_REPLICA_COUNT=10
+fi
+log "Scaling up provisioners to ${PROVISIONER_REPLICA_COUNT}..."
+maybedryrun "$DRY_RUN" kubectl scale deployment/coder-provisioner \
+	--replicas "${PROVISIONER_REPLICA_COUNT}"
+log "Waiting for provisioners to scale up..."
+maybedryrun "$DRY_RUN" kubectl rollout status deployment/coder-provisioner
diff --git a/scaletest/templates/scaletest-runner/scripts/report.sh b/scaletest/templates/scaletest-runner/scripts/report.sh
new file mode 100755
index 0000000000000..0c6a5059ba37d
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/scripts/report.sh
@@ -0,0 +1,109 @@
+#!/bin/bash
+set -euo pipefail
+
+[[ $VERBOSE == 1 ]] && set -x
+
+status=$1
+shift
+
+case "${status}" in
+started) ;;
+completed) ;;
+failed) ;;
+*)
+	echo "Unknown status: ${status}" >&2
+	exit 1
+	;;
+esac
+
+# shellcheck disable=SC2153 source=scaletest/templates/scaletest-runner/scripts/lib.sh
+. "${SCRIPTS_DIR}/lib.sh"
+
+# NOTE(mafredri): API returns HTML if we accidentally use `...//api` vs `.../api`.
+# https://github.com/coder/coder/issues/9877
+CODER_URL="${CODER_URL%/}"
+buildinfo="$(curl -sSL "${CODER_URL}/api/v2/buildinfo")"
+server_version="$(jq -r '.version' <<<"${buildinfo}")"
+server_version_commit="$(jq -r '.external_url' <<<"${buildinfo}")"
+
+# Since `coder show` doesn't support JSON output, we list the workspaces instead.
+# Use `command` here to bypass dry run.
+workspace_json="$(
+	command coder list --all --output json |
+		jq --arg workspace "${CODER_WORKSPACE}" --arg user "${CODER_USER}" 'map(select(.name == $workspace) | select(.owner_name == $user)) | .[0]'
+)"
+owner_name="$(jq -r '.latest_build.workspace_owner_name' <<<"${workspace_json}")"
+workspace_name="$(jq -r '.latest_build.workspace_name' <<<"${workspace_json}")"
+initiator_name="$(jq -r '.latest_build.initiator_name' <<<"${workspace_json}")"
+
+bullet='•'
+app_urls_raw="$(jq -r '.latest_build.resources[].agents[]?.apps | map(select(.external == true)) | .[] | .display_name, .url' <<<"${workspace_json}")"
+app_urls=()
+while read -r app_name; do
+	read -r app_url
+	bold=
+	if [[ ${status} != started ]] && [[ ${app_url} = *to=now* ]]; then
+		# Update Grafana URL with end stamp and make bold.
+		app_url="${app_url//to=now/to=$(($(date +%s) * 1000))}"
+		bold='*'
+	fi
+	app_urls+=("${bullet} ${bold}${app_name}${bold}: ${app_url}")
+done <<<"${app_urls_raw}"
+
+params=()
+header=
+
+case "${status}" in
+started)
+	created_at="$(jq -r '.latest_build.created_at' <<<"${workspace_json}")"
+	params=("${bullet} Options:")
+	while read -r param; do
+		params+=("    ${bullet} ${param}")
+	done <<<"$(jq -r '.latest_build.resources[].agents[]?.environment_variables | to_entries | map(select(.key | startswith("SCALETEST_PARAM_"))) | .[] | "`\(.key)`: `\(.value)`"' <<<"${workspace_json}")"
+
+	header="New scaletest started at \`${created_at}\` by \`${initiator_name}\` on ${CODER_URL} (<${server_version_commit}|\`${server_version}\`>)."
+	;;
+completed)
+	completed_at=$(date -Iseconds)
+	header="Scaletest completed at \`${completed_at}\` (started by \`${initiator_name}\`) on ${CODER_URL} (<${server_version_commit}|\`${server_version}\`>)."
+	;;
+failed)
+	failed_at=$(date -Iseconds)
+	header="Scaletest failed at \`${failed_at}\` (started by \`${initiator_name}\`) on ${CODER_URL} (<${server_version_commit}|\`${server_version}\`>)."
+	;;
+*)
+	echo "Unknown status: ${status}" >&2
+	exit 1
+	;;
+esac
+
+text_arr=(
+	"${header}"
+	""
+	"${bullet} *Comment:* ${SCALETEST_COMMENT}"
+	"${bullet} Workspace (runner): ${CODER_URL}/@${owner_name}/${workspace_name}"
+	"${bullet} Run ID: ${SCALETEST_RUN_ID}"
+	"${app_urls[@]}"
+	"${params[@]}"
+)
+
+text=
+for field in "${text_arr[@]}"; do
+	text+="${field}"$'\n'
+done
+
+json=$(
+	jq -n --arg text "${text}" '{
+		blocks: [
+			{
+				"type": "section",
+				"text": {
+					"type": "mrkdwn",
+					"text": $text
+				}
+			}
+		]
+	}'
+)
+
+maybedryrun "${DRY_RUN}" curl -X POST -H 'Content-type: application/json' --data "${json}" "${SLACK_WEBHOOK_URL}"
diff --git a/scaletest/templates/scaletest-runner/scripts/run.sh b/scaletest/templates/scaletest-runner/scripts/run.sh
new file mode 100755
index 0000000000000..584c80f81f15d
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/scripts/run.sh
@@ -0,0 +1,102 @@
+#!/bin/bash
+set -euo pipefail
+
+[[ $VERBOSE == 1 ]] && set -x
+
+# shellcheck disable=SC2153 source=scaletest/templates/scaletest-runner/scripts/lib.sh
+. "${SCRIPTS_DIR}/lib.sh"
+
+mapfile -t scaletest_load_scenarios < <(jq -r '. | join ("\n")' <<<"${SCALETEST_PARAM_LOAD_SCENARIOS}")
+export SCALETEST_PARAM_LOAD_SCENARIOS=("${scaletest_load_scenarios[@]}")
+
+log "Running scaletest..."
+set_status Running
+
+start_phase "Creating workspaces"
+coder exp scaletest create-workspaces \
+	--count "${SCALETEST_PARAM_NUM_WORKSPACES}" \
+	--template "${SCALETEST_PARAM_TEMPLATE}" \
+	--concurrency "${SCALETEST_PARAM_CREATE_CONCURRENCY}" \
+	--timeout 5h \
+	--job-timeout 5h \
+	--no-cleanup \
+	--output json:"${SCALETEST_RESULTS_DIR}/create-workspaces.json"
+show_json "${SCALETEST_RESULTS_DIR}/create-workspaces.json"
+end_phase
+
+wait_baseline "${SCALETEST_PARAM_LOAD_SCENARIO_BASELINE_DURATION}"
+
+declare -A failed=()
+for scenario in "${SCALETEST_PARAM_LOAD_SCENARIOS[@]}"; do
+	start_phase "Load scenario: ${scenario}"
+
+	set +e
+	status=0
+	case "${scenario}" in
+	"SSH Traffic")
+		coder exp scaletest workspace-traffic \
+			--ssh \
+			--bytes-per-tick "${SCALETEST_PARAM_LOAD_SCENARIO_SSH_TRAFFIC_BYTES_PER_TICK}" \
+			--tick-interval "${SCALETEST_PARAM_LOAD_SCENARIO_SSH_TRAFFIC_TICK_INTERVAL}ms" \
+			--timeout "${SCALETEST_PARAM_LOAD_SCENARIO_SSH_TRAFFIC_DURATION}m" \
+			--job-timeout "${SCALETEST_PARAM_LOAD_SCENARIO_SSH_TRAFFIC_DURATION}m30s" \
+			--output json:"${SCALETEST_RESULTS_DIR}/traffic-ssh.json"
+		status=$?
+		show_json "${SCALETEST_RESULTS_DIR}/traffic-ssh.json"
+		;;
+	"Web Terminal Traffic")
+		coder exp scaletest workspace-traffic \
+			--bytes-per-tick "${SCALETEST_PARAM_LOAD_SCENARIO_WEB_TERMINAL_TRAFFIC_BYTES_PER_TICK}" \
+			--tick-interval "${SCALETEST_PARAM_LOAD_SCENARIO_WEB_TERMINAL_TRAFFIC_TICK_INTERVAL}ms" \
+			--timeout "${SCALETEST_PARAM_LOAD_SCENARIO_WEB_TERMINAL_TRAFFIC_DURATION}m" \
+			--job-timeout "${SCALETEST_PARAM_LOAD_SCENARIO_WEB_TERMINAL_TRAFFIC_DURATION}m30s" \
+			--output json:"${SCALETEST_RESULTS_DIR}/traffic-web-terminal.json"
+		status=$?
+		show_json "${SCALETEST_RESULTS_DIR}/traffic-web-terminal.json"
+		;;
+	"Dashboard Traffic")
+		coder exp scaletest dashboard \
+			--timeout "${SCALETEST_PARAM_LOAD_SCENARIO_DASHBOARD_TRAFFIC_DURATION}m" \
+			--job-timeout "${SCALETEST_PARAM_LOAD_SCENARIO_DASHBOARD_TRAFFIC_DURATION}m30s" \
+			--output json:"${SCALETEST_RESULTS_DIR}/traffic-dashboard.json" \
+			>"${SCALETEST_RESULTS_DIR}/traffic-dashboard-output.log"
+		status=$?
+		show_json "${SCALETEST_RESULTS_DIR}/traffic-dashboard.json"
+		;;
+
+	# Debug scenarios, for testing the runner.
+	"debug:success")
+		maybedryrun "$DRY_RUN" sleep 10
+		status=0
+		;;
+	"debug:error")
+		maybedryrun "$DRY_RUN" sleep 10
+		status=1
+		;;
+
+	*)
+		log "WARNING: Unknown load scenario: ${scenario}, skipping..."
+		;;
+	esac
+	set -e
+	if ((status > 0)); then
+		log "Load scenario failed: ${scenario} (exit=${status})"
+		failed+=(["${scenario}"]="$status")
+		PHASE_ADD_TAGS=error end_phase
+	else
+		end_phase
+	fi
+
+	wait_baseline "${SCALETEST_PARAM_LOAD_SCENARIO_BASELINE_DURATION}"
+done
+
+if ((${#failed[@]} > 0)); then
+	log "Load scenarios failed: ${!failed[*]}"
+	for scenario in "${!failed[@]}"; do
+		log "  ${scenario}: exit=${failed[$scenario]}"
+	done
+	exit 1
+fi
+
+log "Scaletest complete!"
+set_status Complete
diff --git a/scaletest/templates/scaletest-runner/shutdown.sh b/scaletest/templates/scaletest-runner/shutdown.sh
new file mode 100755
index 0000000000000..d5c81366b1217
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/shutdown.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+set -e
+
+[[ $VERBOSE == 1 ]] && set -x
+
+# shellcheck disable=SC2153 source=scaletest/templates/scaletest-runner/scripts/lib.sh
+. "${SCRIPTS_DIR}/lib.sh"
+
+cleanup() {
+	coder tokens remove scaletest_runner >/dev/null 2>&1 || true
+	rm -f "${CODER_CONFIG_DIR}/session"
+}
+trap cleanup EXIT
+
+annotate_grafana "workspace" "Agent stopping..."
+
+"${SCRIPTS_DIR}/cleanup.sh" shutdown
+
+annotate_grafana_end "workspace" "Agent running"
+
+appearance_json="$(get_appearance)"
+service_banner_message=$(jq -r '.service_banner.message' <<<"${appearance_json}")
+service_banner_message="${service_banner_message/% | */}"
+service_banner_color="#4CD473" # Green.
+
+set_appearance "${appearance_json}" "${service_banner_color}" "${service_banner_message}"
diff --git a/scaletest/templates/scaletest-runner/startup.sh b/scaletest/templates/scaletest-runner/startup.sh
new file mode 100755
index 0000000000000..5375a8550ef8f
--- /dev/null
+++ b/scaletest/templates/scaletest-runner/startup.sh
@@ -0,0 +1,169 @@
+#!/bin/bash
+set -euo pipefail
+
+[[ $VERBOSE == 1 ]] && set -x
+
+# Unzip scripts and add to path.
+# shellcheck disable=SC2153
+echo "Extracting scaletest scripts into ${SCRIPTS_DIR}..."
+base64 -d <<<"${SCRIPTS_ZIP}" >/tmp/scripts.zip
+rm -rf "${SCRIPTS_DIR}" || true
+mkdir -p "${SCRIPTS_DIR}"
+unzip -o /tmp/scripts.zip -d "${SCRIPTS_DIR}"
+rm /tmp/scripts.zip
+
+echo "Cloning coder/coder repo..."
+if [[ ! -d "${HOME}/coder" ]]; then
+	git clone https://github.com/coder/coder.git "${HOME}/coder"
+fi
+(cd "${HOME}/coder" && git fetch -a && git checkout "${SCALETEST_PARAM_REPO_BRANCH}" && git pull)
+
+# Store the input parameters (for debugging).
+env | grep "^SCALETEST_" | sort >"${SCALETEST_RUN_DIR}/environ.txt"
+
+# shellcheck disable=SC2153 source=scaletest/templates/scaletest-runner/scripts/lib.sh
+. "${SCRIPTS_DIR}/lib.sh"
+
+appearance_json="$(get_appearance)"
+service_banner_message=$(jq -r '.service_banner.message' <<<"${appearance_json}")
+service_banner_message="${service_banner_message/% | */}"
+service_banner_color="#D65D0F" # Orange.
+
+annotate_grafana "workspace" "Agent running" # Ended in shutdown.sh.
+
+{
+	pids=()
+	ports=()
+	declare -A pods=()
+	next_port=6061
+	for pod in $(kubectl get pods -l app.kubernetes.io/name=coder -o jsonpath='{.items[*].metadata.name}'); do
+		maybedryrun "${DRY_RUN}" kubectl -n coder-big port-forward "${pod}" "${next_port}:6060" &
+		pids+=($!)
+		ports+=("${next_port}")
+		pods[${next_port}]="${pod}"
+		next_port=$((next_port + 1))
+	done
+
+	trap 'trap - EXIT; kill -INT "${pids[@]}"; exit 1' INT EXIT
+
+	while :; do
+		# Sleep for short periods of time so that we can exit quickly.
+		# This adds up to ~300 when accounting for profile and trace.
+		for ((i = 0; i < 285; i++)); do
+			sleep 1
+		done
+		log "Grabbing pprof dumps"
+		start="$(date +%s)"
+		annotate_grafana "pprof" "Grab pprof dumps (start=${start})"
+		for type in allocs block heap goroutine mutex 'profile?seconds=10' 'trace?seconds=5'; do
+			for port in "${ports[@]}"; do
+				tidy_type="${type//\?/_}"
+				tidy_type="${tidy_type//=/_}"
+				maybedryrun "${DRY_RUN}" curl -sSL --output "${SCALETEST_PPROF_DIR}/pprof-${tidy_type}-${pods[${port}]}-${start}.gz" "http://localhost:${port}/debug/pprof/${type}"
+			done
+		done
+		annotate_grafana_end "pprof" "Grab pprof dumps (start=${start})"
+	done
+} &
+pprof_pid=$!
+
+logs_gathered=0
+gather_logs() {
+	if ((logs_gathered == 1)); then
+		return
+	fi
+	logs_gathered=1
+
+	# Gather logs from all coderd and provisioner instances, and all workspaces.
+	annotate_grafana "logs" "Gather logs"
+	podsraw="$(
+		kubectl -n coder-big get pods -l app.kubernetes.io/name=coder -o name
+		kubectl -n coder-big get pods -l app.kubernetes.io/name=coder-provisioner -o name || true
+		kubectl -n coder-big get pods -l app.kubernetes.io/name=coder-workspace -o name | grep "^pod/scaletest-" || true
+	)"
+	mapfile -t pods <<<"${podsraw}"
+	for pod in "${pods[@]}"; do
+		pod_name="${pod#pod/}"
+		kubectl -n coder-big logs "${pod}" --since-time="${SCALETEST_RUN_START_TIME}" >"${SCALETEST_LOGS_DIR}/${pod_name}.txt"
+	done
+	annotate_grafana_end "logs" "Gather logs"
+}
+
+set_appearance "${appearance_json}" "${service_banner_color}" "${service_banner_message} | Scaletest running: [${CODER_USER}/${CODER_WORKSPACE}](${CODER_URL}/@${CODER_USER}/${CODER_WORKSPACE})!"
+
+# Show failure in the UI if script exits with error.
+on_exit() {
+	code=${?}
+	trap - ERR EXIT
+	set +e
+
+	kill -INT "${pprof_pid}"
+
+	message_color="#4CD473" # Green.
+	message_status=COMPLETE
+	if ((code > 0)); then
+		message_color="#D94A5D" # Red.
+		message_status=FAILED
+	fi
+
+	# In case the test failed before gathering logs, gather them before
+	# cleaning up, whilst the workspaces are still present.
+	gather_logs
+
+	case "${SCALETEST_PARAM_CLEANUP_STRATEGY}" in
+	on_stop)
+		# Handled by shutdown script.
+		;;
+	on_success)
+		if ((code == 0)); then
+			set_appearance "${appearance_json}" "${message_color}" "${service_banner_message} | Scaletest ${message_status}: [${CODER_USER}/${CODER_WORKSPACE}](${CODER_URL}/@${CODER_USER}/${CODER_WORKSPACE}), cleaning up..."
+			"${SCRIPTS_DIR}/cleanup.sh" "${SCALETEST_PARAM_CLEANUP_STRATEGY}"
+		fi
+		;;
+	on_error)
+		if ((code > 0)); then
+			set_appearance "${appearance_json}" "${message_color}" "${service_banner_message} | Scaletest ${message_status}: [${CODER_USER}/${CODER_WORKSPACE}](${CODER_URL}/@${CODER_USER}/${CODER_WORKSPACE}), cleaning up..."
+			"${SCRIPTS_DIR}/cleanup.sh" "${SCALETEST_PARAM_CLEANUP_STRATEGY}"
+		fi
+		;;
+	*)
+		set_appearance "${appearance_json}" "${message_color}" "${service_banner_message} | Scaletest ${message_status}: [${CODER_USER}/${CODER_WORKSPACE}](${CODER_URL}/@${CODER_USER}/${CODER_WORKSPACE}), cleaning up..."
+		"${SCRIPTS_DIR}/cleanup.sh" "${SCALETEST_PARAM_CLEANUP_STRATEGY}"
+		;;
+	esac
+
+	set_appearance "${appearance_json}" "${message_color}" "${service_banner_message} | Scaletest ${message_status}: [${CODER_USER}/${CODER_WORKSPACE}](${CODER_URL}/@${CODER_USER}/${CODER_WORKSPACE})!"
+
+	annotate_grafana_end "" "Start scaletest: ${SCALETEST_COMMENT}"
+
+	wait "${pprof_pid}"
+	exit "${code}"
+}
+trap on_exit EXIT
+
+on_err() {
+	code=${?}
+	trap - ERR
+	set +e
+
+	log "Scaletest failed!"
+	GRAFANA_EXTRA_TAGS=error set_status "Failed (exit=${code})"
+	"${SCRIPTS_DIR}/report.sh" failed
+	lock_status # Ensure we never rewrite the status after a failure.
+
+	exit "${code}"
+}
+trap on_err ERR
+
+# Pass session token since `prepare.sh` has not yet run.
+CODER_SESSION_TOKEN=$CODER_USER_TOKEN "${SCRIPTS_DIR}/report.sh" started
+annotate_grafana "" "Start scaletest: ${SCALETEST_COMMENT}"
+
+"${SCRIPTS_DIR}/prepare.sh"
+
+"${SCRIPTS_DIR}/run.sh"
+
+# Gather logs before ending the test.
+gather_logs
+
+"${SCRIPTS_DIR}/report.sh" completed
diff --git a/scaletest/terraform/coder.tf b/scaletest/terraform/coder.tf
deleted file mode 100644
index 55a9e7a35721e..0000000000000
--- a/scaletest/terraform/coder.tf
+++ /dev/null
@@ -1,418 +0,0 @@
-data "google_client_config" "default" {}
-
-locals {
-  coder_helm_repo    = "https://helm.coder.com/v2"
-  coder_helm_chart   = "coder"
-  coder_release_name = var.name
-  coder_namespace    = "coder-${var.name}"
-  coder_admin_email  = "admin@coder.com"
-  coder_admin_user   = "coder"
-  coder_address      = google_compute_address.coder.address
-  coder_url          = "http://${google_compute_address.coder.address}"
-}
-
-provider "kubernetes" {
-  host                   = "https://${google_container_cluster.primary.endpoint}"
-  cluster_ca_certificate = base64decode(google_container_cluster.primary.master_auth.0.cluster_ca_certificate)
-  token                  = data.google_client_config.default.access_token
-}
-
-provider "helm" {
-  kubernetes {
-    host                   = "https://${google_container_cluster.primary.endpoint}"
-    cluster_ca_certificate = base64decode(google_container_cluster.primary.master_auth.0.cluster_ca_certificate)
-    token                  = data.google_client_config.default.access_token
-  }
-}
-
-resource "null_resource" "coder_namespace" {
-  triggers = {
-    namespace       = local.coder_namespace
-    kubeconfig_path = local.cluster_kubeconfig_path
-  }
-  depends_on = [
-    google_container_node_pool.coder
-  ]
-  provisioner "local-exec" {
-    when    = create
-    command = <<EOF
-      KUBECONFIG=${self.triggers.kubeconfig_path} kubectl create namespace ${self.triggers.namespace}
-    EOF
-  }
-  provisioner "local-exec" {
-    when    = destroy
-    command = "true"
-  }
-}
-
-resource "random_password" "coder-postgres-password" {
-  length = 12
-}
-
-resource "random_password" "prometheus-postgres-password" {
-  length = 12
-}
-
-resource "kubernetes_secret" "coder-db" {
-  type = "Opaque"
-  metadata {
-    name      = "coder-db-url"
-    namespace = local.coder_namespace
-  }
-  depends_on = [null_resource.coder_namespace]
-  data = {
-    url = "postgres://${google_sql_user.coder.name}:${urlencode(random_password.coder-postgres-password.result)}@${google_sql_database_instance.db.private_ip_address}/${google_sql_database.coder.name}?sslmode=disable"
-  }
-}
-
-resource "helm_release" "coder-chart" {
-  repository = local.coder_helm_repo
-  chart      = local.coder_helm_chart
-  name       = local.coder_release_name
-  version    = var.coder_chart_version
-  namespace  = local.coder_namespace
-  depends_on = [
-    google_container_node_pool.coder,
-    null_resource.coder_namespace
-  ]
-  values = [<<EOF
-coder:
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: "cloud.google.com/gke-nodepool"
-            operator: "In"
-            values: ["${google_container_node_pool.coder.name}"]
-    podAntiAffinity:
-      preferredDuringSchedulingIgnoredDuringExecution:
-      - weight: 1
-        podAffinityTerm:
-          topologyKey: "kubernetes.io/hostname"
-          labelSelector:
-            matchExpressions:
-            - key:      "app.kubernetes.io/instance"
-              operator: "In"
-              values:   ["${local.coder_release_name}"]
-  env:
-    - name: "CODER_ACCESS_URL"
-      value: "${local.coder_url}"
-    - name: "CODER_CACHE_DIRECTORY"
-      value: "/tmp/coder"
-    - name: "CODER_ENABLE_TELEMETRY"
-      value: "false"
-    - name: "CODER_LOGGING_HUMAN"
-      value: "/dev/null"
-    - name: "CODER_LOGGING_STACKDRIVER"
-      value: "/dev/stderr"
-    - name: "CODER_PG_CONNECTION_URL"
-      valueFrom:
-        secretKeyRef:
-          name: "${kubernetes_secret.coder-db.metadata.0.name}"
-          key: url
-    - name: "CODER_PPROF_ENABLE"
-      value: "true"
-    - name: "CODER_PROMETHEUS_ENABLE"
-      value: "true"
-    - name: "CODER_PROMETHEUS_COLLECT_AGENT_STATS"
-      value: "true"
-    - name: "CODER_PROMETHEUS_COLLECT_DB_METRICS"
-      value: "true"
-    - name: "CODER_VERBOSE"
-      value: "true"
-    - name: "CODER_EXPERIMENTS"
-      value: "${var.coder_experiments}"
-    - name: "CODER_DANGEROUS_DISABLE_RATE_LIMITS"
-      value: "true"
-    # Disabling built-in provisioner daemons
-    - name: "CODER_PROVISIONER_DAEMONS"
-      value: "0"
-  image:
-    repo: ${var.coder_image_repo}
-    tag: ${var.coder_image_tag}
-  replicaCount: "${var.coder_replicas}"
-  resources:
-    requests:
-      cpu: "${var.coder_cpu_request}"
-      memory: "${var.coder_mem_request}"
-    limits:
-      cpu: "${var.coder_cpu_limit}"
-      memory: "${var.coder_mem_limit}"
-  securityContext:
-    readOnlyRootFilesystem: true
-  service:
-    enable: true
-    sessionAffinity: None
-    loadBalancerIP: "${local.coder_address}"
-  volumeMounts:
-  - mountPath: "/tmp"
-    name: cache
-    readOnly: false
-  volumes:
-  - emptyDir:
-      sizeLimit: 1024Mi
-    name: cache
-EOF
-  ]
-}
-
-resource "local_file" "kubernetes_template" {
-  filename = "${path.module}/../.coderv2/templates/kubernetes/main.tf"
-  content  = <<EOF
-    terraform {
-      required_providers {
-        coder = {
-          source  = "coder/coder"
-          version = "~> 0.7.0"
-        }
-        kubernetes = {
-          source  = "hashicorp/kubernetes"
-          version = "~> 2.18"
-        }
-      }
-    }
-
-    provider "coder" {}
-
-    provider "kubernetes" {
-      config_path = null # always use host
-    }
-
-    data "coder_workspace" "me" {}
-
-    resource "coder_agent" "main" {
-      os                     = "linux"
-      arch                   = "amd64"
-      startup_script_timeout = 180
-      startup_script         = ""
-    }
-
-    resource "kubernetes_pod" "main" {
-      count = data.coder_workspace.me.start_count
-      metadata {
-        name      = "coder-$${lower(data.coder_workspace.me.owner)}-$${lower(data.coder_workspace.me.name)}"
-        namespace = "${local.coder_namespace}"
-        labels = {
-          "app.kubernetes.io/name"     = "coder-workspace"
-          "app.kubernetes.io/instance" = "coder-workspace-$${lower(data.coder_workspace.me.owner)}-$${lower(data.coder_workspace.me.name)}"
-        }
-      }
-      spec {
-        security_context {
-          run_as_user = "1000"
-          fs_group    = "1000"
-        }
-        container {
-          name              = "dev"
-          image             = "${var.workspace_image}"
-          image_pull_policy = "Always"
-          command           = ["sh", "-c", coder_agent.main.init_script]
-          security_context {
-            run_as_user = "1000"
-          }
-          env {
-            name  = "CODER_AGENT_TOKEN"
-            value = coder_agent.main.token
-          }
-          resources {
-            requests = {
-              "cpu"    = "${var.workspace_cpu_request}"
-              "memory" = "${var.workspace_mem_request}"
-            }
-            limits = {
-              "cpu"    = "${var.workspace_cpu_limit}"
-              "memory" = "${var.workspace_mem_limit}"
-            }
-          }
-        }
-
-        affinity {
-          node_affinity {
-            required_during_scheduling_ignored_during_execution {
-              node_selector_term {
-                match_expressions {
-                  key = "cloud.google.com/gke-nodepool"
-                  operator = "In"
-                  values = ["${google_container_node_pool.workspaces.name}"]
-                }
-              }
-            }
-          }
-        }
-      }
-    }
-  EOF
-}
-
-# TODO(cian): Remove this when we have support in the Helm chart.
-# Ref: https://github.com/coder/coder/issues/8243
-resource "local_file" "provisionerd_deployment" {
-  filename = "${path.module}/../.coderv2/provisionerd-deployment.yaml"
-  content  = <<EOF
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app.kubernetes.io/instance: ${var.name}
-    app.kubernetes.io/name: provisionerd
-  name: provisionerd
-  namespace: ${local.coder_namespace}
-spec:
-  replicas: ${var.provisionerd_replicas}
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: ${var.name}
-      app.kubernetes.io/name: provisionerd
-  strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 25%
-    type: RollingUpdate
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        app.kubernetes.io/instance: ${var.name}
-        app.kubernetes.io/name: provisionerd
-    spec:
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: cloud.google.com/gke-nodepool
-                operator: In
-                values:
-                - ${google_container_node_pool.coder.name}
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - podAffinityTerm:
-              labelSelector:
-                matchExpressions:
-                - key: app.kubernetes.io/instance
-                  operator: In
-                  values:
-                  - ${var.name}
-              topologyKey: kubernetes.io/hostname
-            weight: 1
-      containers:
-      - args:
-        - server
-        command:
-        - /opt/coder
-        env:
-        - name: CODER_HTTP_ADDRESS
-          value: 0.0.0.0:8080
-        - name: CODER_PROMETHEUS_ADDRESS
-          value: 0.0.0.0:2112
-        - name: CODER_ACCESS_URL
-          value: ${local.coder_url}
-        - name: CODER_CACHE_DIRECTORY
-          value: /tmp/coder
-        - name: CODER_ENABLE_TELEMETRY
-          value: "false"
-        - name: CODER_LOGGING_HUMAN
-          value: /dev/null
-        - name: CODER_LOGGING_STACKDRIVER
-          value: /dev/stderr
-        - name: CODER_PG_CONNECTION_URL
-          valueFrom:
-            secretKeyRef:
-              key: url
-              name: coder-db-url
-        - name: CODER_PPROF_ENABLE
-          value: "true"
-        - name: CODER_PROMETHEUS_ENABLE
-          value: "true"
-        - name: CODER_PROMETHEUS_COLLECT_AGENT_STATS
-          value: "true"
-        - name: CODER_PROMETHEUS_COLLECT_DB_METRICS
-          value: "true"
-        - name: CODER_VERBOSE
-          value: "true"
-        - name: CODER_PROVISIONER_DAEMONS
-          value: "${var.provisionerd_concurrency}"
-        image: "${var.coder_image_repo}:${var.coder_image_tag}"
-        imagePullPolicy: IfNotPresent
-        lifecycle: {}
-        livenessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /api/v2/buildinfo
-            port: http
-            scheme: HTTP
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 1
-        name: provisionerd
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-        - containerPort: 2112
-          name: prometheus-http
-          protocol: TCP
-        readinessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /api/v2/buildinfo
-            port: http
-            scheme: HTTP
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 1
-        resources:
-          limits:
-            cpu: "${var.provisionerd_cpu_limit}"
-            memory: "${var.provisionerd_mem_limit}"
-          requests:
-            cpu: "${var.provisionerd_cpu_request}"
-            memory: "${var.provisionerd_mem_request}"
-        securityContext:
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          runAsGroup: 1000
-          runAsNonRoot: true
-          runAsUser: 1000
-          seccompProfile:
-            type: RuntimeDefault
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
-        - mountPath: /tmp
-          name: cache
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      serviceAccount: coder
-      serviceAccountName: coder
-      terminationGracePeriodSeconds: 60
-      volumes:
-      - emptyDir:
-          sizeLimit: 10Gi
-        name: cache
-    EOF
-}
-
-resource "null_resource" "provisionerd_deployment_apply" {
-  depends_on = [helm_release.coder-chart, local_file.provisionerd_deployment, null_resource.cluster_kubeconfig]
-  triggers = {
-    kubeconfig_path = local.cluster_kubeconfig_path
-    manifest_path   = local_file.provisionerd_deployment.filename
-  }
-  provisioner "local-exec" {
-    command = <<EOF
-      KUBECONFIG=${self.triggers.kubeconfig_path} kubectl apply -f ${self.triggers.manifest_path}
-    EOF
-  }
-}
-
-resource "local_file" "output_vars" {
-  filename = "${path.module}/../.coderv2/url"
-  content  = local.coder_url
-}
-
-output "coder_url" {
-  description = "URL of the Coder deployment"
-  value       = local.coder_url
-}
diff --git a/scaletest/terraform/gcp_db.tf b/scaletest/terraform/gcp_db.tf
deleted file mode 100644
index 8855d24f6d82b..0000000000000
--- a/scaletest/terraform/gcp_db.tf
+++ /dev/null
@@ -1,63 +0,0 @@
-resource "google_sql_database_instance" "db" {
-  name                = var.name
-  region              = var.region
-  database_version    = var.cloudsql_version
-  deletion_protection = false
-
-  depends_on = [google_service_networking_connection.private_vpc_connection]
-
-  settings {
-    tier              = var.cloudsql_tier
-    activation_policy = "ALWAYS"
-    availability_type = "ZONAL"
-
-    location_preference {
-      zone = var.zone
-    }
-
-    database_flags {
-      name  = "max_connections"
-      value = var.cloudsql_max_connections
-    }
-
-    ip_configuration {
-      ipv4_enabled    = false
-      private_network = google_compute_network.vpc.id
-    }
-
-    insights_config {
-      query_insights_enabled  = true
-      query_string_length     = 1024
-      record_application_tags = false
-      record_client_address   = false
-    }
-  }
-}
-
-resource "google_sql_database" "coder" {
-  project  = var.project_id
-  instance = google_sql_database_instance.db.id
-  name     = "${var.name}-coder"
-  # required for postgres, otherwise db fails to delete
-  deletion_policy = "ABANDON"
-}
-
-resource "google_sql_user" "coder" {
-  project  = var.project_id
-  instance = google_sql_database_instance.db.id
-  name     = "${var.name}-coder"
-  type     = "BUILT_IN"
-  password = random_password.coder-postgres-password.result
-  # required for postgres, otherwise user fails to delete
-  deletion_policy = "ABANDON"
-}
-
-resource "google_sql_user" "prometheus" {
-  project  = var.project_id
-  instance = google_sql_database_instance.db.id
-  name     = "${var.name}-prometheus"
-  type     = "BUILT_IN"
-  password = random_password.prometheus-postgres-password.result
-  # required for postgres, otherwise user fails to delete
-  deletion_policy = "ABANDON"
-}
diff --git a/scaletest/terraform/gcp_cluster.tf b/scaletest/terraform/infra/gcp_cluster.tf
similarity index 80%
rename from scaletest/terraform/gcp_cluster.tf
rename to scaletest/terraform/infra/gcp_cluster.tf
index d83ab99c8cb74..c37132c38071b 100644
--- a/scaletest/terraform/gcp_cluster.tf
+++ b/scaletest/terraform/infra/gcp_cluster.tf
@@ -3,7 +3,9 @@ data "google_compute_default_service_account" "default" {
 }
 
 locals {
-  cluster_kubeconfig_path = "${abspath(path.module)}/../.coderv2/${var.name}-cluster.kubeconfig"
+  abs_module_path         = abspath(path.module)
+  rel_kubeconfig_path     = "../../.coderv2/${var.name}-cluster.kubeconfig"
+  cluster_kubeconfig_path = abspath("${local.abs_module_path}/${local.rel_kubeconfig_path}")
 }
 
 resource "google_container_cluster" "primary" {
@@ -39,16 +41,25 @@ resource "google_container_cluster" "primary" {
   workload_identity_config {
     workload_pool = "${data.google_project.project.project_id}.svc.id.goog"
   }
+
+
+  lifecycle {
+    ignore_changes = [
+      maintenance_policy,
+      release_channel,
+      remove_default_node_pool
+    ]
+  }
 }
 
 resource "google_container_node_pool" "coder" {
-  name       = "${var.name}-coder"
-  location   = var.zone
-  project    = var.project_id
-  cluster    = google_container_cluster.primary.name
-  node_count = var.state == "stopped" ? 0 : var.nodepool_size_coder
-  management {
-    auto_upgrade = false
+  name     = "${var.name}-coder"
+  location = var.zone
+  project  = var.project_id
+  cluster  = google_container_cluster.primary.name
+  autoscaling {
+    min_node_count = 1
+    max_node_count = var.nodepool_size_coder
   }
   node_config {
     oauth_scopes = [
@@ -72,14 +83,20 @@ resource "google_container_node_pool" "coder" {
       disable-legacy-endpoints = "true"
     }
   }
+  lifecycle {
+    ignore_changes = [management[0].auto_repair, management[0].auto_upgrade, timeouts]
+  }
 }
 
 resource "google_container_node_pool" "workspaces" {
-  name       = "${var.name}-workspaces"
-  location   = var.zone
-  project    = var.project_id
-  cluster    = google_container_cluster.primary.name
-  node_count = var.state == "stopped" ? 0 : var.nodepool_size_workspaces
+  name     = "${var.name}-workspaces"
+  location = var.zone
+  project  = var.project_id
+  cluster  = google_container_cluster.primary.name
+  autoscaling {
+    min_node_count       = 0
+    total_max_node_count = var.nodepool_size_workspaces
+  }
   management {
     auto_upgrade = false
   }
@@ -105,6 +122,9 @@ resource "google_container_node_pool" "workspaces" {
       disable-legacy-endpoints = "true"
     }
   }
+  lifecycle {
+    ignore_changes = [management[0].auto_repair, management[0].auto_upgrade, timeouts]
+  }
 }
 
 resource "google_container_node_pool" "misc" {
@@ -138,6 +158,9 @@ resource "google_container_node_pool" "misc" {
       disable-legacy-endpoints = "true"
     }
   }
+  lifecycle {
+    ignore_changes = [management[0].auto_repair, management[0].auto_upgrade, timeouts]
+  }
 }
 
 resource "null_resource" "cluster_kubeconfig" {
diff --git a/scaletest/terraform/infra/gcp_db.tf b/scaletest/terraform/infra/gcp_db.tf
new file mode 100644
index 0000000000000..4d13b262c615f
--- /dev/null
+++ b/scaletest/terraform/infra/gcp_db.tf
@@ -0,0 +1,88 @@
+resource "google_sql_database_instance" "db" {
+  name                = var.name
+  region              = var.region
+  database_version    = var.cloudsql_version
+  deletion_protection = false
+
+  depends_on = [google_service_networking_connection.private_vpc_connection]
+
+  settings {
+    tier              = var.cloudsql_tier
+    activation_policy = "ALWAYS"
+    availability_type = "ZONAL"
+
+    location_preference {
+      zone = var.zone
+    }
+
+    database_flags {
+      name  = "max_connections"
+      value = var.cloudsql_max_connections
+    }
+
+    ip_configuration {
+      ipv4_enabled    = false
+      private_network = google_compute_network.vpc.id
+    }
+
+    insights_config {
+      query_insights_enabled  = true
+      query_string_length     = 1024
+      record_application_tags = false
+      record_client_address   = false
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [deletion_protection, timeouts]
+  }
+}
+
+resource "google_sql_database" "coder" {
+  project  = var.project_id
+  instance = google_sql_database_instance.db.id
+  name     = "${var.name}-coder"
+  # required for postgres, otherwise db fails to delete
+  deletion_policy = "ABANDON"
+  lifecycle {
+    ignore_changes = [deletion_policy]
+  }
+}
+
+resource "random_password" "coder-postgres-password" {
+  length = 12
+}
+
+resource "random_password" "prometheus-postgres-password" {
+  length = 12
+}
+
+resource "google_sql_user" "coder" {
+  project  = var.project_id
+  instance = google_sql_database_instance.db.id
+  name     = "${var.name}-coder"
+  type     = "BUILT_IN"
+  password = random_password.coder-postgres-password.result
+  # required for postgres, otherwise user fails to delete
+  deletion_policy = "ABANDON"
+  lifecycle {
+    ignore_changes = [deletion_policy, password]
+  }
+}
+
+resource "google_sql_user" "prometheus" {
+  project  = var.project_id
+  instance = google_sql_database_instance.db.id
+  name     = "${var.name}-prometheus"
+  type     = "BUILT_IN"
+  password = random_password.prometheus-postgres-password.result
+  # required for postgres, otherwise user fails to delete
+  deletion_policy = "ABANDON"
+  lifecycle {
+    ignore_changes = [deletion_policy, password]
+  }
+}
+
+locals {
+  coder_db_url = "postgres://${google_sql_user.coder.name}:${urlencode(random_password.coder-postgres-password.result)}@${google_sql_database_instance.db.private_ip_address}/${google_sql_database.coder.name}?sslmode=disable"
+}
diff --git a/scaletest/terraform/gcp_project.tf b/scaletest/terraform/infra/gcp_project.tf
similarity index 88%
rename from scaletest/terraform/gcp_project.tf
rename to scaletest/terraform/infra/gcp_project.tf
index c233042e66acb..1073a621c33e0 100644
--- a/scaletest/terraform/gcp_project.tf
+++ b/scaletest/terraform/infra/gcp_project.tf
@@ -1,8 +1,3 @@
-provider "google" {
-  region  = var.region
-  project = var.project_id
-}
-
 locals {
   project_apis = [
     "cloudtrace",
diff --git a/scaletest/terraform/gcp_vpc.tf b/scaletest/terraform/infra/gcp_vpc.tf
similarity index 97%
rename from scaletest/terraform/gcp_vpc.tf
rename to scaletest/terraform/infra/gcp_vpc.tf
index 7ed76a00235e9..b125c60cfd25a 100644
--- a/scaletest/terraform/gcp_vpc.tf
+++ b/scaletest/terraform/infra/gcp_vpc.tf
@@ -12,7 +12,7 @@ resource "google_compute_subnetwork" "subnet" {
   project       = var.project_id
   region        = var.region
   network       = google_compute_network.vpc.name
-  ip_cidr_range = "10.10.0.0/24"
+  ip_cidr_range = var.subnet_cidr
 }
 
 resource "google_compute_global_address" "sql_peering" {
diff --git a/scaletest/terraform/infra/main.tf b/scaletest/terraform/infra/main.tf
new file mode 100644
index 0000000000000..1724692b19f3a
--- /dev/null
+++ b/scaletest/terraform/infra/main.tf
@@ -0,0 +1,20 @@
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 4.36"
+    }
+
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.5"
+    }
+  }
+
+  required_version = "~> 1.5.0"
+}
+
+provider "google" {
+  region  = var.region
+  project = var.project_id
+}
diff --git a/scaletest/terraform/infra/outputs.tf b/scaletest/terraform/infra/outputs.tf
new file mode 100644
index 0000000000000..f5e619eca384d
--- /dev/null
+++ b/scaletest/terraform/infra/outputs.tf
@@ -0,0 +1,73 @@
+output "coder_db_url" {
+  description = "URL of the database for Coder."
+  value       = local.coder_db_url
+  sensitive   = true
+}
+
+output "coder_address" {
+  description = "IP address to use for the Coder service."
+  value       = google_compute_address.coder.address
+}
+
+output "kubernetes_kubeconfig_path" {
+  description = "Kubeconfig path."
+  value       = local.cluster_kubeconfig_path
+}
+
+output "kubernetes_nodepool_coder" {
+  description = "Name of the nodepool on which to run Coder."
+  value       = google_container_node_pool.coder.name
+}
+
+output "kubernetes_nodepool_misc" {
+  description = "Name of the nodepool on which to run everything else."
+  value       = google_container_node_pool.misc.name
+}
+
+output "kubernetes_nodepool_workspaces" {
+  description = "Name of the nodepool on which to run workspaces."
+  value       = google_container_node_pool.workspaces.name
+}
+
+output "prometheus_external_label_cluster" {
+  description = "Value for the Prometheus external label named cluster."
+  value       = google_container_cluster.primary.name
+}
+
+output "prometheus_postgres_dbname" {
+  description = "Name of the database for Prometheus to monitor."
+  value       = google_sql_database.coder.name
+}
+
+output "prometheus_postgres_host" {
+  description = "Hostname of the database for Prometheus to connect to."
+  value       = google_sql_database_instance.db.private_ip_address
+}
+
+output "prometheus_postgres_password" {
+  description = "Postgres password for Prometheus."
+  value       = random_password.prometheus-postgres-password.result
+  sensitive   = true
+}
+
+output "prometheus_postgres_user" {
+  description = "Postgres username for Prometheus."
+  value       = google_sql_user.prometheus.name
+}
+
+resource "local_file" "outputs" {
+  filename = "${path.module}/../../.coderv2/infra_outputs.tfvars"
+  content  = <<EOF
+  coder_db_url = "${local.coder_db_url}"
+  coder_address = "${google_compute_address.coder.address}"
+  kubernetes_kubeconfig_path = "${local.cluster_kubeconfig_path}"
+  kubernetes_nodepool_coder = "${google_container_node_pool.coder.name}"
+  kubernetes_nodepool_misc = "${google_container_node_pool.misc.name}"
+  kubernetes_nodepool_workspaces = "${google_container_node_pool.workspaces.name}"
+  prometheus_external_label_cluster = "${google_container_cluster.primary.name}"
+  prometheus_postgres_dbname = "${google_sql_database.coder.name}"
+  prometheus_postgres_host = "${google_sql_database_instance.db.private_ip_address}"
+  prometheus_postgres_password = "${random_password.prometheus-postgres-password.result}"
+  prometheus_postgres_user = "${google_sql_user.prometheus.name}"
+EOF
+}
diff --git a/scaletest/terraform/infra/vars.tf b/scaletest/terraform/infra/vars.tf
new file mode 100644
index 0000000000000..d9f5040918ba5
--- /dev/null
+++ b/scaletest/terraform/infra/vars.tf
@@ -0,0 +1,107 @@
+variable "state" {
+  description = "The state of the cluster. Valid values are 'started', and 'stopped'."
+  validation {
+    condition     = contains(["started", "stopped"], var.state)
+    error_message = "value must be one of 'started' or 'stopped'"
+  }
+  default = "started"
+}
+
+variable "project_id" {
+  description = "The project in which to provision resources"
+}
+
+variable "name" {
+  description = "Adds a prefix to resources."
+}
+
+variable "region" {
+  description = "GCP region in which to provision resources."
+  default     = "us-east1"
+}
+
+variable "zone" {
+  description = "GCP zone in which to provision resources."
+  default     = "us-east1-c"
+}
+
+variable "subnet_cidr" {
+  description = "CIDR range for the subnet."
+  default     = "10.200.0.0/24"
+}
+
+variable "k8s_version" {
+  description = "Kubernetes version to provision."
+  default     = "1.24"
+}
+
+variable "node_disk_size_gb" {
+  description = "Size of the root disk for cluster nodes."
+  default     = 100
+}
+
+variable "node_image_type" {
+  description = "Image type to use for cluster nodes."
+  default     = "cos_containerd"
+}
+
+// Preemptible nodes are way cheaper, but can be pulled out
+// from under you at any time. Caveat emptor.
+variable "node_preemptible" {
+  description = "Use preemptible nodes."
+  default     = false
+}
+
+// We create three nodepools:
+// - One for the Coder control plane
+// - One for workspaces
+// - One for everything else (for example, load generation)
+
+// These variables control the node pool dedicated to Coder.
+variable "nodepool_machine_type_coder" {
+  description = "Machine type to use for Coder control plane nodepool."
+  default     = "t2d-standard-4"
+}
+
+variable "nodepool_size_coder" {
+  description = "Number of cluster nodes for the Coder control plane nodepool."
+  default     = 1
+}
+
+// These variables control the node pool dedicated to workspaces.
+variable "nodepool_machine_type_workspaces" {
+  description = "Machine type to use for the workspaces nodepool."
+  default     = "t2d-standard-4"
+}
+
+variable "nodepool_size_workspaces" {
+  description = "Number of cluster nodes for the workspaces nodepool."
+  default     = 1
+}
+
+// These variables control the node pool for everything else.
+variable "nodepool_machine_type_misc" {
+  description = "Machine type to use for the misc nodepool."
+  default     = "t2d-standard-4"
+}
+
+variable "nodepool_size_misc" {
+  description = "Number of cluster nodes for the misc nodepool."
+  default     = 1
+}
+
+// These variables control the size of the database to be used by Coder.
+variable "cloudsql_version" {
+  description = "CloudSQL version to provision"
+  default     = "POSTGRES_14"
+}
+
+variable "cloudsql_tier" {
+  description = "CloudSQL database tier."
+  default     = "db-f1-micro"
+}
+
+variable "cloudsql_max_connections" {
+  description = "CloudSQL database max_connections"
+  default     = 500
+}
diff --git a/scaletest/terraform/k8s/cert-manager.tf b/scaletest/terraform/k8s/cert-manager.tf
new file mode 100644
index 0000000000000..cfcb324b3ea0b
--- /dev/null
+++ b/scaletest/terraform/k8s/cert-manager.tf
@@ -0,0 +1,67 @@
+# Terraform configuration for cert-manaer
+
+locals {
+  cert_manager_namespace                    = "cert-manager"
+  cert_manager_helm_repo                    = "https://charts.jetstack.io"
+  cert_manager_helm_chart                   = "cert-manager"
+  cert_manager_release_name                 = "cert-manager"
+  cert_manager_chart_version                = "1.12.2"
+  cloudflare_issuer_private_key_secret_name = "cloudflare-issuer-private-key"
+}
+
+resource "kubernetes_secret" "cloudflare-api-key" {
+  metadata {
+    name      = "cloudflare-api-key-secret"
+    namespace = local.cert_manager_namespace
+  }
+  data = {
+    api-token = var.cloudflare_api_token
+  }
+}
+
+resource "kubernetes_namespace" "cert-manager-namespace" {
+  metadata {
+    name = local.cert_manager_namespace
+  }
+}
+
+resource "helm_release" "cert-manager" {
+  repository = local.cert_manager_helm_repo
+  chart      = local.cert_manager_helm_chart
+  name       = local.cert_manager_release_name
+  namespace  = kubernetes_namespace.cert-manager-namespace.metadata.0.name
+  values = [<<EOF
+installCRDs: true
+EOF
+  ]
+}
+
+resource "kubernetes_manifest" "cloudflare-cluster-issuer" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "ClusterIssuer"
+    metadata = {
+      name = "cloudflare-issuer"
+    }
+    spec = {
+      acme = {
+        email = var.cloudflare_email
+        privateKeySecretRef = {
+          name = local.cloudflare_issuer_private_key_secret_name
+        }
+        solvers = [
+          {
+            dns01 = {
+              cloudflare = {
+                apiTokenSecretRef = {
+                  name = kubernetes_secret.cloudflare-api-key.metadata.0.name
+                  key  = "api-token"
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  }
+}
diff --git a/scaletest/terraform/k8s/coder.tf b/scaletest/terraform/k8s/coder.tf
new file mode 100644
index 0000000000000..401808c31308a
--- /dev/null
+++ b/scaletest/terraform/k8s/coder.tf
@@ -0,0 +1,376 @@
+data "google_client_config" "default" {}
+
+locals {
+  coder_url                 = var.coder_access_url
+  coder_admin_email         = "admin@coder.com"
+  coder_admin_user          = "coder"
+  coder_helm_repo           = "https://helm.coder.com/v2"
+  coder_helm_chart          = "coder"
+  coder_namespace           = "coder-${var.name}"
+  coder_release_name        = var.name
+  provisionerd_helm_chart   = "coder-provisioner"
+  provisionerd_release_name = "${var.name}-provisionerd"
+}
+
+resource "kubernetes_namespace" "coder_namespace" {
+  metadata {
+    name = local.coder_namespace
+  }
+  lifecycle {
+    ignore_changes = [timeouts, wait_for_default_service_account]
+  }
+}
+
+resource "random_password" "provisionerd_psk" {
+  length = 26
+}
+
+resource "kubernetes_secret" "coder-db" {
+  type = "Opaque"
+  metadata {
+    name      = "coder-db-url"
+    namespace = kubernetes_namespace.coder_namespace.metadata.0.name
+  }
+  data = {
+    url = var.coder_db_url
+  }
+  lifecycle {
+    ignore_changes = [timeouts, wait_for_service_account_token]
+  }
+}
+
+resource "kubernetes_secret" "provisionerd_psk" {
+  type = "Opaque"
+  metadata {
+    name      = "coder-provisioner-psk"
+    namespace = kubernetes_namespace.coder_namespace.metadata.0.name
+  }
+  data = {
+    psk = random_password.provisionerd_psk.result
+  }
+  lifecycle {
+    ignore_changes = [timeouts, wait_for_service_account_token]
+  }
+}
+
+# OIDC secret needs to be manually provisioned for now.
+data "kubernetes_secret" "coder_oidc" {
+  metadata {
+    namespace = kubernetes_namespace.coder_namespace.metadata.0.name
+    name      = "coder-oidc"
+  }
+}
+
+resource "kubernetes_manifest" "coder_certificate" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "${var.name}"
+      namespace = kubernetes_namespace.coder_namespace.metadata.0.name
+    }
+    spec = {
+      secretName = "${var.name}-tls"
+      dnsNames   = regex("https?://([^/]+)", local.coder_url)
+      issuerRef = {
+        name = kubernetes_manifest.cloudflare-cluster-issuer.manifest.metadata.name
+        kind = "ClusterIssuer"
+      }
+    }
+  }
+}
+
+data "kubernetes_secret" "coder_tls" {
+  metadata {
+    namespace = kubernetes_namespace.coder_namespace.metadata.0.name
+    name      = "${var.name}-tls"
+  }
+  depends_on = [kubernetes_manifest.coder_certificate]
+}
+
+resource "helm_release" "coder-chart" {
+  repository = local.coder_helm_repo
+  chart      = local.coder_helm_chart
+  name       = local.coder_release_name
+  version    = var.coder_chart_version
+  namespace  = kubernetes_namespace.coder_namespace.metadata.0.name
+  values = [<<EOF
+coder:
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: "cloud.google.com/gke-nodepool"
+            operator: "In"
+            values: ["${var.kubernetes_nodepool_coder}"]
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 1
+        podAffinityTerm:
+          topologyKey: "kubernetes.io/hostname"
+          labelSelector:
+            matchExpressions:
+            - key:      "app.kubernetes.io/instance"
+              operator: "In"
+              values:   ["${local.coder_release_name}"]
+  env:
+    - name: "CODER_ACCESS_URL"
+      value: "${local.coder_url}"
+    - name: "CODER_CACHE_DIRECTORY"
+      value: "/tmp/coder"
+    - name: "CODER_TELEMETRY_ENABLE"
+      value: "false"
+    - name: "CODER_LOGGING_HUMAN"
+      value: "/dev/null"
+    - name: "CODER_LOGGING_STACKDRIVER"
+      value: "/dev/stderr"
+    - name: "CODER_PG_CONNECTION_URL"
+      valueFrom:
+        secretKeyRef:
+          name: "${kubernetes_secret.coder-db.metadata.0.name}"
+          key: url
+    - name: "CODER_PPROF_ENABLE"
+      value: "true"
+    - name: "CODER_PROMETHEUS_ENABLE"
+      value: "true"
+    - name: "CODER_PROMETHEUS_COLLECT_AGENT_STATS"
+      value: "true"
+    - name: "CODER_PROMETHEUS_COLLECT_DB_METRICS"
+      value: "true"
+    - name: "CODER_VERBOSE"
+      value: "true"
+    - name: "CODER_EXPERIMENTS"
+      value: "${var.coder_experiments}"
+    - name: "CODER_DANGEROUS_DISABLE_RATE_LIMITS"
+      value: "true"
+    # Disabling built-in provisioner daemons
+    - name: "CODER_PROVISIONER_DAEMONS"
+      value: "0"
+    - name: CODER_PROVISIONER_DAEMON_PSK
+      valueFrom:
+        secretKeyRef:
+          key: psk
+          name: "${kubernetes_secret.provisionerd_psk.metadata.0.name}"
+    # Enable OIDC
+    - name: "CODER_OIDC_ISSUER_URL"
+      valueFrom:
+        secretKeyRef:
+          key: issuer-url
+          name: "${data.kubernetes_secret.coder_oidc.metadata.0.name}"
+    - name: "CODER_OIDC_EMAIL_DOMAIN"
+      valueFrom:
+        secretKeyRef:
+          key: email-domain
+          name: "${data.kubernetes_secret.coder_oidc.metadata.0.name}"
+    - name: "CODER_OIDC_CLIENT_ID"
+      valueFrom:
+        secretKeyRef:
+          key: client-id
+          name: "${data.kubernetes_secret.coder_oidc.metadata.0.name}"
+    - name: "CODER_OIDC_CLIENT_SECRET"
+      valueFrom:
+        secretKeyRef:
+          key: client-secret
+          name: "${data.kubernetes_secret.coder_oidc.metadata.0.name}"
+    # Send OTEL traces to the cluster-local collector to sample 10%
+    - name: "OTEL_EXPORTER_OTLP_ENDPOINT"
+      value: "http://${kubernetes_manifest.otel-collector.manifest.metadata.name}-collector.${kubernetes_namespace.coder_namespace.metadata.0.name}.svc.cluster.local:4317"
+    - name: "OTEL_TRACES_SAMPLER"
+      value: parentbased_traceidratio
+    - name: "OTEL_TRACES_SAMPLER_ARG"
+      value: "0.1"
+  image:
+    repo: ${var.coder_image_repo}
+    tag: ${var.coder_image_tag}
+  replicaCount: "${var.coder_replicas}"
+  resources:
+    requests:
+      cpu: "${var.coder_cpu_request}"
+      memory: "${var.coder_mem_request}"
+    limits:
+      cpu: "${var.coder_cpu_limit}"
+      memory: "${var.coder_mem_limit}"
+  securityContext:
+    readOnlyRootFilesystem: true
+  service:
+    enable: true
+    sessionAffinity: None
+    loadBalancerIP: "${var.coder_address}"
+  volumeMounts:
+  - mountPath: "/tmp"
+    name: cache
+    readOnly: false
+  volumes:
+  - emptyDir:
+      sizeLimit: 1024Mi
+    name: cache
+EOF
+  ]
+}
+
+resource "helm_release" "provisionerd-chart" {
+  repository = local.coder_helm_repo
+  chart      = local.provisionerd_helm_chart
+  name       = local.provisionerd_release_name
+  version    = var.provisionerd_chart_version
+  namespace  = kubernetes_namespace.coder_namespace.metadata.0.name
+  values = [<<EOF
+coder:
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: "cloud.google.com/gke-nodepool"
+            operator: "In"
+            values: ["${var.kubernetes_nodepool_coder}"]
+    podAntiAffinity:
+      preferredDuringSchedulingIgnoredDuringExecution:
+      - weight: 1
+        podAffinityTerm:
+          topologyKey: "kubernetes.io/hostname"
+          labelSelector:
+            matchExpressions:
+            - key:      "app.kubernetes.io/instance"
+              operator: "In"
+              values:   ["${local.coder_release_name}"]
+  env:
+    - name: "CODER_URL"
+      value: "${local.coder_url}"
+    - name: "CODER_VERBOSE"
+      value: "true"
+    - name: "CODER_CACHE_DIRECTORY"
+      value: "/tmp/coder"
+    - name: "CODER_TELEMETRY_ENABLE"
+      value: "false"
+    - name: "CODER_LOGGING_HUMAN"
+      value: "/dev/null"
+    - name: "CODER_LOGGING_STACKDRIVER"
+      value: "/dev/stderr"
+    - name: "CODER_PROMETHEUS_ENABLE"
+      value: "true"
+    - name: "CODER_PROVISIONERD_TAGS"
+      value = "socpe=organization"
+  image:
+    repo: ${var.provisionerd_image_repo}
+    tag: ${var.provisionerd_image_tag}
+  replicaCount: "${var.provisionerd_replicas}"
+  resources:
+    requests:
+      cpu: "${var.provisionerd_cpu_request}"
+      memory: "${var.provisionerd_mem_request}"
+    limits:
+      cpu: "${var.provisionerd_cpu_limit}"
+      memory: "${var.provisionerd_mem_limit}"
+  securityContext:
+    readOnlyRootFilesystem: true
+  volumeMounts:
+  - mountPath: "/tmp"
+    name: cache
+    readOnly: false
+  volumes:
+  - emptyDir:
+      sizeLimit: 1024Mi
+    name: cache
+EOF
+  ]
+}
+
+resource "local_file" "kubernetes_template" {
+  filename = "${path.module}/../.coderv2/templates/kubernetes/main.tf"
+  content  = <<EOF
+    terraform {
+      required_providers {
+        coder = {
+          source  = "coder/coder"
+          version = "~> 0.7.0"
+        }
+        kubernetes = {
+          source  = "hashicorp/kubernetes"
+          version = "~> 2.18"
+        }
+      }
+    }
+
+    provider "coder" {}
+
+    provider "kubernetes" {
+      config_path = null # always use host
+    }
+
+    data "coder_workspace" "me" {}
+
+    resource "coder_agent" "main" {
+      os                     = "linux"
+      arch                   = "amd64"
+      startup_script_timeout = 180
+      startup_script         = ""
+    }
+
+    resource "kubernetes_pod" "main" {
+      count = data.coder_workspace.me.start_count
+      metadata {
+        name      = "coder-$${lower(data.coder_workspace.me.owner)}-$${lower(data.coder_workspace.me.name)}"
+        namespace = "${local.coder_namespace}"
+        labels = {
+          "app.kubernetes.io/name"     = "coder-workspace"
+          "app.kubernetes.io/instance" = "coder-workspace-$${lower(data.coder_workspace.me.owner)}-$${lower(data.coder_workspace.me.name)}"
+        }
+      }
+      spec {
+        security_context {
+          run_as_user = "1000"
+          fs_group    = "1000"
+        }
+        container {
+          name              = "dev"
+          image             = "${var.workspace_image}"
+          image_pull_policy = "Always"
+          command           = ["sh", "-c", coder_agent.main.init_script]
+          security_context {
+            run_as_user = "1000"
+          }
+          env {
+            name  = "CODER_AGENT_TOKEN"
+            value = coder_agent.main.token
+          }
+          resources {
+            requests = {
+              "cpu"    = "${var.workspace_cpu_request}"
+              "memory" = "${var.workspace_mem_request}"
+            }
+            limits = {
+              "cpu"    = "${var.workspace_cpu_limit}"
+              "memory" = "${var.workspace_mem_limit}"
+            }
+          }
+        }
+
+        affinity {
+          node_affinity {
+            required_during_scheduling_ignored_during_execution {
+              node_selector_term {
+                match_expressions {
+                  key = "cloud.google.com/gke-nodepool"
+                  operator = "In"
+                  values = ["${var.kubernetes_nodepool_workspaces}"]
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  EOF
+}
+
+resource "local_file" "output_vars" {
+  filename = "${path.module}/../../.coderv2/url"
+  content  = local.coder_url
+}
+
+output "coder_url" {
+  description = "URL of the Coder deployment"
+  value       = local.coder_url
+}
diff --git a/scaletest/terraform/k8s/main.tf b/scaletest/terraform/k8s/main.tf
new file mode 100644
index 0000000000000..a5c8c1085a5ce
--- /dev/null
+++ b/scaletest/terraform/k8s/main.tf
@@ -0,0 +1,35 @@
+terraform {
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~> 2.20"
+    }
+
+    helm = {
+      source  = "hashicorp/helm"
+      version = "~> 2.9"
+    }
+
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.5"
+    }
+
+    tls = {
+      source  = "hashicorp/tls"
+      version = "~> 4.0"
+    }
+  }
+
+  required_version = "~> 1.5.0"
+}
+
+provider "kubernetes" {
+  config_path = var.kubernetes_kubeconfig_path
+}
+
+provider "helm" {
+  kubernetes {
+    config_path = var.kubernetes_kubeconfig_path
+  }
+}
diff --git a/scaletest/terraform/k8s/otel.tf b/scaletest/terraform/k8s/otel.tf
new file mode 100644
index 0000000000000..3b1657ee48cbc
--- /dev/null
+++ b/scaletest/terraform/k8s/otel.tf
@@ -0,0 +1,69 @@
+# Terraform configuration for OpenTelemetry Operator
+
+locals {
+  otel_namespace              = "opentelemetry-operator-system"
+  otel_operator_helm_repo     = "https://open-telemetry.github.io/opentelemetry-helm-charts"
+  otel_operator_helm_chart    = "opentelemtry-operator"
+  otel_operator_release_name  = "opentelemetry-operator"
+  otel_operator_chart_version = "0.34.1"
+}
+
+resource "kubernetes_namespace" "otel-namespace" {
+  metadata {
+    name = local.otel_namespace
+  }
+  lifecycle {
+    ignore_changes = [timeouts, wait_for_default_service_account]
+  }
+}
+
+resource "helm_release" "otel-operator" {
+  repository = local.otel_operator_helm_repo
+  chart      = local.otel_operator_helm_chart
+  name       = local.otel_operator_release_name
+  namespace  = kubernetes_namespace.otel-namespace.metadata.0.name
+  # Default values
+  values = []
+}
+
+resource "kubernetes_manifest" "otel-collector" {
+  manifest = {
+    apiVersion = "opentelemetry.io/v1alpha1"
+    kind       = "OpenTelemetryCollector"
+    metadata = {
+      namespace = kubernetes_namespace.coder_namespace.metadata.0.name
+      name      = "otel"
+    }
+    spec = {
+      config = jsonencode({
+        receivers = {
+          otlp = {
+            protocols : {
+              grpc : {}
+              http : {}
+            }
+          }
+        }
+        exporters = {
+          googlecloud = {
+            logging = {
+              loglevel = "debug"
+            }
+          }
+        }
+        service = {
+          pipelines = {
+            traces = {
+              receivers  = ["otlp"]
+              processors = []
+              exporters  = ["logging", "googlecloud"]
+            }
+          }
+        }
+        image    = "otel/open-telemetry-collector-contrib:latest"
+        mode     = "deployment"
+        replicas = 1
+      })
+    }
+  }
+}
diff --git a/scaletest/terraform/k8s/prometheus.tf b/scaletest/terraform/k8s/prometheus.tf
new file mode 100644
index 0000000000000..accf926727575
--- /dev/null
+++ b/scaletest/terraform/k8s/prometheus.tf
@@ -0,0 +1,173 @@
+locals {
+  prometheus_helm_repo             = "https://charts.bitnami.com/bitnami"
+  prometheus_helm_chart            = "kube-prometheus"
+  prometheus_exporter_helm_repo    = "https://prometheus-community.github.io/helm-charts"
+  prometheus_exporter_helm_chart   = "prometheus-postgres-exporter"
+  prometheus_release_name          = "prometheus"
+  prometheus_exporter_release_name = "prometheus-postgres-exporter"
+  prometheus_namespace             = "prometheus"
+  prometheus_remote_write_enabled  = var.prometheus_remote_write_password != ""
+}
+
+# Create a namespace to hold our Prometheus deployment.
+resource "kubernetes_namespace" "prometheus_namespace" {
+  metadata {
+    name = local.prometheus_namespace
+  }
+  lifecycle {
+    ignore_changes = [timeouts, wait_for_default_service_account]
+  }
+}
+
+# Create a secret to store the remote write key
+resource "kubernetes_secret" "prometheus-credentials" {
+  count = local.prometheus_remote_write_enabled ? 1 : 0
+  type  = "kubernetes.io/basic-auth"
+  metadata {
+    name      = "prometheus-credentials"
+    namespace = kubernetes_namespace.prometheus_namespace.metadata.0.name
+  }
+
+  data = {
+    username = var.prometheus_remote_write_user
+    password = var.prometheus_remote_write_password
+  }
+  lifecycle {
+    ignore_changes = [timeouts, wait_for_service_account_token]
+  }
+}
+
+# Install Prometheus using the Bitnami Prometheus helm chart.
+resource "helm_release" "prometheus-chart" {
+  repository = local.prometheus_helm_repo
+  chart      = local.prometheus_helm_chart
+  name       = local.prometheus_release_name
+  namespace  = kubernetes_namespace.prometheus_namespace.metadata.0.name
+  values = [<<EOF
+alertmanager:
+  enabled: false
+blackboxExporter:
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: "cloud.google.com/gke-nodepool"
+            operator: "In"
+            values: ["${var.kubernetes_nodepool_misc}"]
+operator:
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: "cloud.google.com/gke-nodepool"
+            operator: "In"
+            values: ["${var.kubernetes_nodepool_misc}"]
+prometheus:
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: "cloud.google.com/gke-nodepool"
+            operator: "In"
+            values: ["${var.kubernetes_nodepool_misc}"]
+  externalLabels:
+    cluster: "${var.prometheus_external_label_cluster}"
+  persistence:
+    enabled: true
+    storageClass: standard
+%{if local.prometheus_remote_write_enabled~}
+  remoteWrite:
+    - url: "${var.prometheus_remote_write_url}"
+      basicAuth:
+        username:
+          name: "${kubernetes_secret.prometheus-credentials[0].metadata[0].name}"
+          key: username
+        password:
+          name: "${kubernetes_secret.prometheus-credentials[0].metadata[0].name}"
+          key: password
+      tlsConfig:
+        insecureSkipVerify: ${var.prometheus_remote_write_insecure_skip_verify}
+      writeRelabelConfigs:
+        - sourceLabels: [__name__]
+          regex: "${var.prometheus_remote_write_metrics_regex}"
+          action: keep
+      metadataConfig:
+        sendInterval: "${var.prometheus_remote_write_send_interval}"
+%{endif~}
+  EOF
+  ]
+}
+
+resource "kubernetes_secret" "prometheus-postgres-password" {
+  type = "kubernetes.io/basic-auth"
+  metadata {
+    name      = "prometheus-postgres"
+    namespace = kubernetes_namespace.prometheus_namespace.metadata.0.name
+  }
+  data = {
+    username = var.prometheus_postgres_user
+    password = var.prometheus_postgres_password
+  }
+  lifecycle {
+    ignore_changes = [timeouts, wait_for_service_account_token]
+  }
+}
+
+# Install Prometheus Postgres exporter helm chart
+resource "helm_release" "prometheus-exporter-chart" {
+  depends_on = [helm_release.prometheus-chart]
+  repository = local.prometheus_exporter_helm_repo
+  chart      = local.prometheus_exporter_helm_chart
+  name       = local.prometheus_exporter_release_name
+  namespace  = local.prometheus_namespace
+  values = [<<EOF
+affinity:
+  nodeAffinity:
+  requiredDuringSchedulingIgnoredDuringExecution:
+    nodeSelectorTerms:
+    - matchExpressions:
+      - key: "cloud.google.com/gke-nodepool"
+        operator: "In"
+        values: ["${var.kubernetes_nodepool_misc}"]
+config:
+  datasource:
+    host: "${var.prometheus_postgres_host}"
+    user: "${var.prometheus_postgres_user}"
+    database: "${var.prometheus_postgres_dbname}"
+    passwordSecret:
+      name: "${kubernetes_secret.prometheus-postgres-password.metadata.0.name}"
+      key: password
+    autoDiscoverDatabases: true
+serviceMonitor:
+  enabled: true
+  EOF
+  ]
+}
+
+resource "kubernetes_manifest" "coder_monitoring" {
+  depends_on = [helm_release.prometheus-chart]
+  manifest = {
+    apiVersion = "monitoring.coreos.com/v1"
+    kind       = "PodMonitor"
+    metadata = {
+      namespace = kubernetes_namespace.coder_namespace.metadata.0.name
+      name      = "coder-monitoring"
+    }
+    spec = {
+      selector = {
+        matchLabels = {
+          "app.kubernetes.io/name" : "coder"
+        }
+      }
+      podMetricsEndpoints = [
+        {
+          port     = "prometheus-http"
+          interval = "30s"
+        }
+      ]
+    }
+  }
+}
diff --git a/scaletest/terraform/k8s/vars.tf b/scaletest/terraform/k8s/vars.tf
new file mode 100644
index 0000000000000..4ccd42bb4807c
--- /dev/null
+++ b/scaletest/terraform/k8s/vars.tf
@@ -0,0 +1,219 @@
+variable "state" {
+  description = "The state of the cluster. Valid values are 'started', and 'stopped'."
+  validation {
+    condition     = contains(["started", "stopped"], var.state)
+    error_message = "value must be one of 'started' or 'stopped'"
+  }
+  default = "started"
+}
+
+variable "name" {
+  description = "Adds a prefix to resources."
+}
+
+variable "kubernetes_kubeconfig_path" {
+  description = "Path to kubeconfig to use to provision resources."
+}
+
+variable "kubernetes_nodepool_coder" {
+  description = "Name of the nodepool on which to run Coder."
+}
+
+variable "kubernetes_nodepool_workspaces" {
+  description = "Name of the nodepool on which to run workspaces."
+}
+
+variable "kubernetes_nodepool_misc" {
+  description = "Name of the nodepool on which to run everything else."
+}
+
+// These variables control the Coder deployment.
+variable "coder_access_url" {
+  description = "Access URL for the Coder deployment."
+}
+variable "coder_replicas" {
+  description = "Number of Coder replicas to provision."
+  default     = 1
+}
+
+variable "coder_address" {
+  description = "IP address to use for Coder service."
+}
+
+variable "coder_db_url" {
+  description = "URL of the database for Coder to use."
+  sensitive   = true
+}
+
+// Ensure that requests allow for at least two replicas to be scheduled
+// on a single node temporarily, otherwise deployments may fail due to
+// lack of resources.
+variable "coder_cpu_request" {
+  description = "CPU request to allocate to Coder."
+  default     = "500m"
+}
+
+variable "coder_mem_request" {
+  description = "Memory request to allocate to Coder."
+  default     = "512Mi"
+}
+
+variable "coder_cpu_limit" {
+  description = "CPU limit to allocate to Coder."
+  default     = "1000m"
+}
+
+variable "coder_mem_limit" {
+  description = "Memory limit to allocate to Coder."
+  default     = "1024Mi"
+}
+
+// Allow independently scaling provisionerd resources
+variable "provisionerd_cpu_request" {
+  description = "CPU request to allocate to provisionerd."
+  default     = "100m"
+}
+
+variable "provisionerd_mem_request" {
+  description = "Memory request to allocate to provisionerd."
+  default     = "1Gi"
+}
+
+variable "provisionerd_cpu_limit" {
+  description = "CPU limit to allocate to provisionerd."
+  default     = "1000m"
+}
+
+variable "provisionerd_mem_limit" {
+  description = "Memory limit to allocate to provisionerd."
+  default     = "1Gi"
+}
+
+variable "provisionerd_replicas" {
+  description = "Number of Provisionerd replicas."
+  default     = 1
+}
+
+variable "provisionerd_chart_version" {
+  description = "Version of the Provisionerd Helm chart to install. Defaults to latest."
+  default     = null
+}
+
+variable "provisionerd_image_repo" {
+  description = "Repository to use for Provisionerd image."
+  default     = "ghcr.io/coder/coder"
+}
+
+variable "provisionerd_image_tag" {
+  description = "Tag to use for Provisionerd image."
+  default     = "latest"
+}
+
+variable "coder_chart_version" {
+  description = "Version of the Coder Helm chart to install. Defaults to latest."
+  default     = null
+}
+
+variable "coder_image_repo" {
+  description = "Repository to use for Coder image."
+  default     = "ghcr.io/coder/coder"
+}
+
+variable "coder_image_tag" {
+  description = "Tag to use for Coder image."
+  default     = "latest"
+}
+
+variable "coder_experiments" {
+  description = "Coder Experiments to enable."
+  default     = ""
+}
+
+// These variables control the default workspace template.
+variable "workspace_image" {
+  description = "Image and tag to use for workspaces."
+  default     = "docker.io/codercom/enterprise-minimal:ubuntu"
+}
+
+variable "workspace_cpu_request" {
+  description = "CPU request to allocate to workspaces."
+  default     = "100m"
+}
+
+variable "workspace_cpu_limit" {
+  description = "CPU limit to allocate to workspaces."
+  default     = "100m"
+}
+
+variable "workspace_mem_request" {
+  description = "Memory request to allocate to workspaces."
+  default     = "128Mi"
+}
+
+variable "workspace_mem_limit" {
+  description = "Memory limit to allocate to workspaces."
+  default     = "128Mi"
+}
+
+// These variables control the Prometheus deployment.
+variable "prometheus_external_label_cluster" {
+  description = "Value for the Prometheus external label named cluster."
+}
+
+variable "prometheus_postgres_dbname" {
+  description = "Database for Postgres to monitor."
+}
+
+variable "prometheus_postgres_host" {
+  description = "Database hostname for Prometheus."
+}
+
+variable "prometheus_postgres_password" {
+  description = "Postgres password for Prometheus."
+  sensitive   = true
+}
+
+variable "prometheus_postgres_user" {
+  description = "Postgres username for Prometheus."
+}
+
+variable "prometheus_remote_write_user" {
+  description = "Username for Prometheus remote write."
+  default     = ""
+}
+
+variable "prometheus_remote_write_password" {
+  description = "Password for Prometheus remote write."
+  default     = ""
+  sensitive   = true
+}
+
+variable "prometheus_remote_write_url" {
+  description = "URL for Prometheus remote write. Defaults to stats.dev.c8s.io."
+  default     = "https://stats.dev.c8s.io:9443/api/v1/write"
+}
+
+variable "prometheus_remote_write_insecure_skip_verify" {
+  description = "Skip TLS verification for Prometheus remote write."
+  default     = true
+}
+
+variable "prometheus_remote_write_metrics_regex" {
+  description = "Allowlist regex of metrics for Prometheus remote write."
+  default     = ".*"
+}
+
+variable "prometheus_remote_write_send_interval" {
+  description = "Prometheus remote write interval."
+  default     = "15s"
+}
+
+variable "cloudflare_api_token" {
+  description = "Cloudflare API token."
+  sensitive   = true
+}
+
+variable "cloudflare_email" {
+  description = "Cloudflare email address."
+  sensitive   = true
+}
diff --git a/scaletest/terraform/main.tf b/scaletest/terraform/main.tf
deleted file mode 100644
index c80478f513b64..0000000000000
--- a/scaletest/terraform/main.tf
+++ /dev/null
@@ -1,35 +0,0 @@
-terraform {
-  required_providers {
-    google = {
-      source  = "hashicorp/google"
-      version = "~> 4.36"
-    }
-
-    kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = "~> 2.20"
-    }
-
-    helm = {
-      source  = "hashicorp/helm"
-      version = "~> 2.9"
-    }
-
-    random = {
-      source  = "hashicorp/random"
-      version = "~> 3.5"
-    }
-
-    tls = {
-      source  = "hashicorp/tls"
-      version = "~> 4.0"
-    }
-
-    docker = {
-      source  = "kreuzwerker/docker"
-      version = "~> 3.0"
-    }
-  }
-
-  required_version = "~> 1.5.0"
-}
diff --git a/scaletest/terraform/prometheus.tf b/scaletest/terraform/prometheus.tf
deleted file mode 100644
index ade1289e38739..0000000000000
--- a/scaletest/terraform/prometheus.tf
+++ /dev/null
@@ -1,189 +0,0 @@
-locals {
-  prometheus_helm_repo             = "https://charts.bitnami.com/bitnami"
-  prometheus_helm_chart            = "kube-prometheus"
-  prometheus_exporter_helm_repo    = "https://prometheus-community.github.io/helm-charts"
-  prometheus_exporter_helm_chart   = "prometheus-postgres-exporter"
-  prometheus_release_name          = "prometheus"
-  prometheus_exporter_release_name = "prometheus-postgres-exporter"
-  prometheus_namespace             = "prometheus"
-  prometheus_remote_write_enabled  = var.prometheus_remote_write_password != ""
-}
-
-# Create a namespace to hold our Prometheus deployment.
-resource "null_resource" "prometheus_namespace" {
-  triggers = {
-    namespace       = local.prometheus_namespace
-    kubeconfig_path = local.cluster_kubeconfig_path
-  }
-  depends_on = [
-    google_container_node_pool.misc
-  ]
-  provisioner "local-exec" {
-    when    = create
-    command = <<EOF
-      KUBECONFIG=${self.triggers.kubeconfig_path} kubectl create namespace ${self.triggers.namespace}
-    EOF
-  }
-  provisioner "local-exec" {
-    when    = destroy
-    command = "true"
-  }
-}
-
-# Create a secret to store the remote write key
-resource "kubernetes_secret" "prometheus-credentials" {
-  count      = local.prometheus_remote_write_enabled ? 1 : 0
-  type       = "kubernetes.io/basic-auth"
-  depends_on = [null_resource.prometheus_namespace]
-  metadata {
-    name      = "prometheus-credentials"
-    namespace = local.prometheus_namespace
-  }
-
-  data = {
-    username = var.prometheus_remote_write_user
-    password = var.prometheus_remote_write_password
-  }
-}
-
-# Install Prometheus using the Bitnami Prometheus helm chart.
-resource "helm_release" "prometheus-chart" {
-  repository = local.prometheus_helm_repo
-  chart      = local.prometheus_helm_chart
-  name       = local.prometheus_release_name
-  namespace  = local.prometheus_namespace
-  depends_on = [null_resource.prometheus_namespace]
-  values = [<<EOF
-alertmanager:
-  enabled: false
-blackboxExporter:
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: "cloud.google.com/gke-nodepool"
-            operator: "In"
-            values: ["${google_container_node_pool.misc.name}"]
-operator:
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: "cloud.google.com/gke-nodepool"
-            operator: "In"
-            values: ["${google_container_node_pool.misc.name}"]
-prometheus:
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: "cloud.google.com/gke-nodepool"
-            operator: "In"
-            values: ["${google_container_node_pool.misc.name}"]
-  externalLabels:
-    cluster: "${google_container_cluster.primary.name}"
-  persistence:
-    enabled: true
-    storageClass: standard
-%{if local.prometheus_remote_write_enabled~}
-  remoteWrite:
-    - url: "${var.prometheus_remote_write_url}"
-      basicAuth:
-        username:
-          name: "${kubernetes_secret.prometheus-credentials[0].metadata[0].name}"
-          key: username
-        password:
-          name: "${kubernetes_secret.prometheus-credentials[0].metadata[0].name}"
-          key: password
-      tlsConfig:
-        insecureSkipVerify: ${var.prometheus_remote_write_insecure_skip_verify}
-      writeRelabelConfigs:
-        - sourceLabels: [__name__]
-          regex: "${var.prometheus_remote_write_metrics_regex}"
-          action: keep
-      metadataConfig:
-        sendInterval: "${var.prometheus_remote_write_send_interval}"
-%{endif~}
-  EOF
-  ]
-}
-
-resource "kubernetes_secret" "prometheus-postgres-password" {
-  type = "kubernetes.io/basic-auth"
-  metadata {
-    name      = "prometheus-postgres"
-    namespace = local.prometheus_namespace
-  }
-  depends_on = [null_resource.prometheus_namespace]
-  data = {
-    username = google_sql_user.prometheus.name
-    password = google_sql_user.prometheus.password
-  }
-}
-
-# Install Prometheus Postgres exporter helm chart
-resource "helm_release" "prometheus-exporter-chart" {
-  depends_on = [helm_release.prometheus-chart]
-  repository = local.prometheus_exporter_helm_repo
-  chart      = local.prometheus_exporter_helm_chart
-  name       = local.prometheus_exporter_release_name
-  namespace  = local.prometheus_namespace
-  values = [<<EOF
-affinity:
-  nodeAffinity:
-  requiredDuringSchedulingIgnoredDuringExecution:
-    nodeSelectorTerms:
-    - matchExpressions:
-      - key: "cloud.google.com/gke-nodepool"
-        operator: "In"
-        values: ["${google_container_node_pool.misc.name}"]
-config:
-  datasource:
-    host: "${google_sql_database_instance.db.private_ip_address}"
-    user: "${google_sql_user.prometheus.name}"
-    database: "${google_sql_database.coder.name}"
-    passwordSecret:
-      name: "${kubernetes_secret.prometheus-postgres-password.metadata.0.name}"
-      key: password
-    autoDiscoverDatabases: true
-serviceMonitor:
-  enabled: true
-  EOF
-  ]
-}
-
-# NOTE: this is created as a local file before being applied
-# as the kubernetes_manifest resource needs to be run separately
-# after creating a cluster, and we want this to be brought up
-# with a single command.
-resource "local_file" "coder-monitoring-manifest" {
-  filename   = "${path.module}/../.coderv2/coder-monitoring.yaml"
-  depends_on = [helm_release.prometheus-chart]
-  content    = <<EOF
-apiVersion: monitoring.coreos.com/v1
-kind: PodMonitor
-metadata:
-  namespace: ${local.coder_namespace}
-  name: coder-monitoring
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: coder
-  podMetricsEndpoints:
-  - port: prometheus-http
-    interval: 30s
-  EOF
-}
-
-resource "null_resource" "coder-monitoring-manifest_apply" {
-  provisioner "local-exec" {
-    working_dir = "${abspath(path.module)}/../.coderv2"
-    command     = <<EOF
-KUBECONFIG=${local.cluster_kubeconfig_path} kubectl apply -f ${abspath(local_file.coder-monitoring-manifest.filename)}
-    EOF
-  }
-  depends_on = [helm_release.prometheus-chart]
-}
diff --git a/scaletest/terraform/vars.tf b/scaletest/terraform/vars.tf
deleted file mode 100644
index aa404ee614684..0000000000000
--- a/scaletest/terraform/vars.tf
+++ /dev/null
@@ -1,239 +0,0 @@
-variable "state" {
-  description = "The state of the cluster. Valid values are 'started', and 'stopped'."
-  validation {
-    condition     = contains(["started", "stopped"], var.state)
-    error_message = "value must be one of 'started' or 'stopped'"
-  }
-  default = "started"
-}
-
-variable "project_id" {
-  description = "The project in which to provision resources"
-}
-
-variable "name" {
-  description = "Adds a prefix to resources."
-}
-
-variable "region" {
-  description = "GCP region in which to provision resources."
-  default     = "us-east1"
-}
-
-variable "zone" {
-  description = "GCP zone in which to provision resources."
-  default     = "us-east1-c"
-}
-
-variable "k8s_version" {
-  description = "Kubernetes vversion to provision."
-  default     = "1.24"
-}
-
-variable "node_disk_size_gb" {
-  description = "Size of the root disk for cluster nodes."
-  default     = 100
-}
-
-variable "node_image_type" {
-  description = "Image type to use for cluster nodes."
-  default     = "cos_containerd"
-}
-
-// Preemptible nodes are way cheaper, but can be pulled out
-// from under you at any time. Caveat emptor.
-variable "node_preemptible" {
-  description = "Use preemptible nodes."
-  default     = false
-}
-
-// We create three nodepools:
-// - One for the Coder control plane
-// - One for workspaces
-// - One for everything else (for example, load generation)
-
-// These variables control the node pool dedicated to Coder.
-variable "nodepool_machine_type_coder" {
-  description = "Machine type to use for Coder control plane nodepool."
-  default     = "t2d-standard-4"
-}
-
-variable "nodepool_size_coder" {
-  description = "Number of cluster nodes for the Coder control plane nodepool."
-  default     = 1
-}
-
-// These variables control the node pool dedicated to workspaces.
-variable "nodepool_machine_type_workspaces" {
-  description = "Machine type to use for the workspaces nodepool."
-  default     = "t2d-standard-4"
-}
-
-variable "nodepool_size_workspaces" {
-  description = "Number of cluster nodes for the workspaces nodepool."
-  default     = 1
-}
-
-// These variables control the node pool for everything else.
-variable "nodepool_machine_type_misc" {
-  description = "Machine type to use for the misc nodepool."
-  default     = "t2d-standard-4"
-}
-
-variable "nodepool_size_misc" {
-  description = "Number of cluster nodes for the misc nodepool."
-  default     = 1
-}
-
-// These variables control the size of the database to be used by Coder.
-variable "cloudsql_version" {
-  description = "CloudSQL version to provision"
-  default     = "POSTGRES_14"
-}
-
-variable "cloudsql_tier" {
-  description = "CloudSQL database tier."
-  default     = "db-f1-micro"
-}
-
-variable "cloudsql_max_connections" {
-  description = "CloudSQL database max_connections"
-  default     = 500
-}
-
-// These variables control the Coder deployment.
-variable "coder_replicas" {
-  description = "Number of Coder replicas to provision."
-  default     = 1
-}
-
-// Ensure that requests allow for at least two replicas to be scheduled
-// on a single node temporarily, otherwise deployments may fail due to
-// lack of resources.
-variable "coder_cpu_request" {
-  description = "CPU request to allocate to Coder."
-  default     = "500m"
-}
-
-variable "coder_mem_request" {
-  description = "Memory request to allocate to Coder."
-  default     = "512Mi"
-}
-
-variable "coder_cpu_limit" {
-  description = "CPU limit to allocate to Coder."
-  default     = "1000m"
-}
-
-variable "coder_mem_limit" {
-  description = "Memory limit to allocate to Coder."
-  default     = "1024Mi"
-}
-
-// Allow independently scaling provisionerd resources
-variable "provisionerd_cpu_request" {
-  description = "CPU request to allocate to provisionerd."
-  default     = "500m"
-}
-
-variable "provisionerd_mem_request" {
-  description = "Memory request to allocate to provisionerd."
-  default     = "512Mi"
-}
-
-variable "provisionerd_cpu_limit" {
-  description = "CPU limit to allocate to provisionerd."
-  default     = "1000m"
-}
-
-variable "provisionerd_mem_limit" {
-  description = "Memory limit to allocate to provisionerd."
-  default     = "1024Mi"
-}
-
-variable "provisionerd_replicas" {
-  description = "Number of Provisionerd replicas."
-  default     = 1
-}
-
-variable "provisionerd_concurrency" {
-  description = "Number of concurrent provisioner jobs per provisionerd instance."
-  default     = 3
-}
-
-variable "coder_chart_version" {
-  description = "Version of the Coder Helm chart to install. Defaults to latest."
-  default     = null
-}
-
-variable "coder_image_repo" {
-  description = "Repository to use for Coder image."
-  default     = "ghcr.io/coder/coder"
-}
-
-variable "coder_image_tag" {
-  description = "Tag to use for Coder image."
-  default     = "latest"
-}
-
-variable "coder_experiments" {
-  description = "Coder Experiments to enable."
-  default     = ""
-}
-
-// These variables control the default workspace template.
-variable "workspace_image" {
-  description = "Image and tag to use for workspaces."
-  default     = "docker.io/codercom/enterprise-minimal:ubuntu"
-}
-
-variable "workspace_cpu_request" {
-  description = "CPU request to allocate to workspaces."
-  default     = "100m"
-}
-
-variable "workspace_cpu_limit" {
-  description = "CPU limit to allocate to workspaces."
-  default     = "100m"
-}
-
-variable "workspace_mem_request" {
-  description = "Memory request to allocate to workspaces."
-  default     = "128Mi"
-}
-
-variable "workspace_mem_limit" {
-  description = "Memory limit to allocate to workspaces."
-  default     = "128Mi"
-}
-
-// These variables control the Prometheus deployment.
-variable "prometheus_remote_write_user" {
-  description = "Username for Prometheus remote write."
-  default     = ""
-}
-
-variable "prometheus_remote_write_password" {
-  description = "Password for Prometheus remote write."
-  default     = ""
-}
-
-variable "prometheus_remote_write_url" {
-  description = "URL for Prometheus remote write. Defaults to stats.dev.c8s.io."
-  default     = "https://stats.dev.c8s.io:9443/api/v1/write"
-}
-
-variable "prometheus_remote_write_insecure_skip_verify" {
-  description = "Skip TLS verification for Prometheus remote write."
-  default     = true
-}
-
-variable "prometheus_remote_write_metrics_regex" {
-  description = "Allowlist regex of metrics for Prometheus remote write."
-  default     = ".*"
-}
-
-variable "prometheus_remote_write_send_interval" {
-  description = "Prometheus remote write interval."
-  default     = "15s"
-}
diff --git a/scaletest/workspacebuild/config.go b/scaletest/workspacebuild/config.go
index e2c361d45bcb3..99211010168f1 100644
--- a/scaletest/workspacebuild/config.go
+++ b/scaletest/workspacebuild/config.go
@@ -4,7 +4,7 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 type Config struct {
diff --git a/scaletest/workspacebuild/config_test.go b/scaletest/workspacebuild/config_test.go
index 4efbddfe1f364..b9c427f104f3d 100644
--- a/scaletest/workspacebuild/config_test.go
+++ b/scaletest/workspacebuild/config_test.go
@@ -6,8 +6,8 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/scaletest/workspacebuild"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/scaletest/workspacebuild"
 )
 
 func Test_Config(t *testing.T) {
diff --git a/scaletest/workspacebuild/run.go b/scaletest/workspacebuild/run.go
index 166aaf1f1aa79..7d5046eabf78d 100644
--- a/scaletest/workspacebuild/run.go
+++ b/scaletest/workspacebuild/run.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"net/http"
 	"time"
 
 	"github.com/google/uuid"
@@ -12,11 +13,11 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
 
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/scaletest/harness"
-	"github.com/coder/coder/scaletest/loadtestutil"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/loadtestutil"
 )
 
 type Runner struct {
@@ -106,13 +107,42 @@ func NewCleanupRunner(client *codersdk.Client, workspaceID uuid.UUID) *CleanupRu
 
 // Run implements Runnable.
 func (r *CleanupRunner) Run(ctx context.Context, _ string, logs io.Writer) error {
+	ctx, span := tracing.StartSpan(ctx)
+	defer span.End()
+	logs = loadtestutil.NewSyncWriter(logs)
+	logger := slog.Make(sloghuman.Sink(logs)).Leveled(slog.LevelDebug)
 	if r.workspaceID == uuid.Nil {
 		return nil
 	}
-	ctx, span := tracing.StartSpan(ctx)
-	defer span.End()
+	logger.Info(ctx, "deleting workspace", slog.F("workspace_id", r.workspaceID))
+	r.client.SetLogger(logger)
+	r.client.SetLogBodies(true)
+
+	ws, err := r.client.Workspace(ctx, r.workspaceID)
+	if err != nil {
+		var sdkErr *codersdk.Error
+		if xerrors.As(err, &sdkErr) && sdkErr.StatusCode() == http.StatusNotFound {
+			logger.Info(ctx, "workspace not found, skipping delete", slog.F("workspace_id", r.workspaceID))
+			return nil
+		}
+		return err
+	}
+
+	build, err := r.client.WorkspaceBuild(ctx, ws.LatestBuild.ID)
+	if err == nil && build.Job.Status.Active() {
+		// mark the build as canceled
+		logger.Info(ctx, "canceling workspace build", slog.F("build_id", build.ID), slog.F("workspace_id", r.workspaceID))
+		if err = r.client.CancelWorkspaceBuild(ctx, build.ID); err == nil {
+			// Wait for the job to cancel before we delete it
+			_ = waitForBuild(ctx, logs, r.client, build.ID) // it will return a "build canceled" error
+		} else {
+			logger.Warn(ctx, "failed to cancel workspace build, attempting to delete anyway", slog.Error(err))
+		}
+	} else {
+		logger.Warn(ctx, "unable to lookup latest workspace build, attempting to delete anyway", slog.Error(err))
+	}
 
-	build, err := r.client.CreateWorkspaceBuild(ctx, r.workspaceID, codersdk.CreateWorkspaceBuildRequest{
+	build, err = r.client.CreateWorkspaceBuild(ctx, r.workspaceID, codersdk.CreateWorkspaceBuildRequest{
 		Transition: codersdk.WorkspaceTransitionDelete,
 	})
 	if err != nil {
@@ -128,12 +158,11 @@ func (r *CleanupRunner) Run(ctx context.Context, _ string, logs io.Writer) error
 }
 
 // Cleanup implements Cleanable by wrapping CleanupRunner.
-func (r *Runner) Cleanup(ctx context.Context, id string) error {
-	// TODO: capture these logs
+func (r *Runner) Cleanup(ctx context.Context, id string, w io.Writer) error {
 	return (&CleanupRunner{
 		client:      r.client,
 		workspaceID: r.workspaceID,
-	}).Run(ctx, id, io.Discard)
+	}).Run(ctx, id, w)
 }
 
 func waitForBuild(ctx context.Context, w io.Writer, client *codersdk.Client, buildID uuid.UUID) error {
diff --git a/scaletest/workspacebuild/run_test.go b/scaletest/workspacebuild/run_test.go
index 9a4fa9fdc4122..2ed5b09c0c9de 100644
--- a/scaletest/workspacebuild/run_test.go
+++ b/scaletest/workspacebuild/run_test.go
@@ -13,14 +13,14 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/scaletest/workspacebuild"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/scaletest/workspacebuild"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func Test_Runner(t *testing.T) {
@@ -45,10 +45,10 @@ func Test_Runner(t *testing.T) {
 		authToken3 := uuid.NewString()
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{
 				{
-					Type: &proto.Provision_Response_Log{
+					Type: &proto.Response_Log{
 						Log: &proto.Log{
 							Level:  proto.LogLevel_INFO,
 							Output: "hello from logs",
@@ -56,8 +56,8 @@ func Test_Runner(t *testing.T) {
 					},
 				},
 				{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
 							Resources: []*proto.Resource{
 								{
 									Name: "example1",
@@ -103,7 +103,7 @@ func Test_Runner(t *testing.T) {
 		})
 
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		// Since the runner creates the workspace on it's own, we have to keep
 		// listing workspaces until we find it, then wait for the build to
@@ -127,7 +127,7 @@ func Test_Runner(t *testing.T) {
 				time.Sleep(100 * time.Millisecond)
 			}
 
-			coderdtest.AwaitWorkspaceBuildJob(t, client, workspace.LatestBuild.ID)
+			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 			// Start the three agents.
 			for i, authToken := range []string{authToken1, authToken2, authToken3} {
@@ -177,10 +177,11 @@ func Test_Runner(t *testing.T) {
 		workspaces := res.Workspaces
 		require.Len(t, workspaces, 1)
 
-		coderdtest.AwaitWorkspaceBuildJob(t, client, workspaces[0].LatestBuild.ID)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspaces[0].LatestBuild.ID)
 		coderdtest.AwaitWorkspaceAgents(t, client, workspaces[0].ID)
 
-		err = runner.Cleanup(ctx, "1")
+		cleanupLogs := bytes.NewBuffer(nil)
+		err = runner.Cleanup(ctx, "1", cleanupLogs)
 		require.NoError(t, err)
 	})
 
@@ -199,11 +200,11 @@ func Test_Runner(t *testing.T) {
 
 		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
 			Parse:         echo.ParseComplete,
-			ProvisionPlan: echo.ProvisionComplete,
-			ProvisionApply: []*proto.Provision_Response{
+			ProvisionPlan: echo.PlanComplete,
+			ProvisionApply: []*proto.Response{
 				{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
 							Error: "test error",
 						},
 					},
@@ -212,7 +213,7 @@ func Test_Runner(t *testing.T) {
 		})
 
 		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-		coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 
 		runner := workspacebuild.NewRunner(client, workspacebuild.Config{
 			OrganizationID: user.OrganizationID,
diff --git a/scaletest/workspacetraffic/conn.go b/scaletest/workspacetraffic/conn.go
index 167164c5ef33f..2248ebc4786f8 100644
--- a/scaletest/workspacetraffic/conn.go
+++ b/scaletest/workspacetraffic/conn.go
@@ -5,7 +5,7 @@ import (
 	"io"
 	"sync"
 
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/codersdk"
 
 	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
@@ -19,7 +19,7 @@ func connectPTY(ctx context.Context, client *codersdk.Client, agentID, reconnect
 		Reconnect: reconnect,
 		Height:    25,
 		Width:     80,
-		Command:   "/bin/sh",
+		Command:   "sh",
 	})
 	if err != nil {
 		return nil, xerrors.Errorf("connect pty: %w", err)
diff --git a/scaletest/workspacetraffic/run.go b/scaletest/workspacetraffic/run.go
index db263ac90911e..d3fcd6033be25 100644
--- a/scaletest/workspacetraffic/run.go
+++ b/scaletest/workspacetraffic/run.go
@@ -13,11 +13,11 @@ import (
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
 
-	"github.com/coder/coder/coderd/tracing"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/cryptorand"
-	"github.com/coder/coder/scaletest/harness"
-	"github.com/coder/coder/scaletest/loadtestutil"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/loadtestutil"
 )
 
 type Runner struct {
@@ -169,7 +169,7 @@ func (r *Runner) Run(ctx context.Context, _ string, logs io.Writer) error {
 }
 
 // Cleanup does nothing, successfully.
-func (*Runner) Cleanup(context.Context, string) error {
+func (*Runner) Cleanup(context.Context, string, io.Writer) error {
 	return nil
 }
 
diff --git a/scaletest/workspacetraffic/run_test.go b/scaletest/workspacetraffic/run_test.go
index acea009ceacce..45e9c6c73a357 100644
--- a/scaletest/workspacetraffic/run_test.go
+++ b/scaletest/workspacetraffic/run_test.go
@@ -8,14 +8,15 @@ import (
 	"testing"
 	"time"
 
-	"github.com/coder/coder/agent"
-	"github.com/coder/coder/coderd/coderdtest"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/codersdk/agentsdk"
-	"github.com/coder/coder/provisioner/echo"
-	"github.com/coder/coder/provisionersdk/proto"
-	"github.com/coder/coder/scaletest/workspacetraffic"
-	"github.com/coder/coder/testutil"
+	"golang.org/x/exp/slices"
+
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/scaletest/workspacetraffic"
+	"github.com/coder/coder/v2/testutil"
 
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
@@ -31,6 +32,7 @@ func TestRun(t *testing.T) {
 		t.Skip("Race detector enabled, skipping time-sensitive test.")
 	}
 
+	//nolint:dupl
 	t.Run("PTY", func(t *testing.T) {
 		t.Parallel()
 		// We need to stand up an in-memory coderd and run a fake workspace.
@@ -41,10 +43,10 @@ func TestRun(t *testing.T) {
 			agentName = "agent"
 			version   = coderdtest.CreateTemplateVersion(t, client, firstUser.OrganizationID, &echo.Responses{
 				Parse:         echo.ParseComplete,
-				ProvisionPlan: echo.ProvisionComplete,
-				ProvisionApply: []*proto.Provision_Response{{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
+				ProvisionPlan: echo.PlanComplete,
+				ProvisionApply: []*proto.Response{{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
 							Resources: []*proto.Resource{{
 								Name: "example",
 								Type: "aws_instance",
@@ -62,29 +64,21 @@ func TestRun(t *testing.T) {
 				}},
 			})
 			template = coderdtest.CreateTemplate(t, client, firstUser.OrganizationID, version.ID)
-			_        = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			_        = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			// In order to be picked up as a scaletest workspace, the workspace must be named specifically
 			ws = coderdtest.CreateWorkspace(t, client, firstUser.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 				cwr.Name = "scaletest-test"
 			})
-			_ = coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+			_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		)
 
 		// We also need a running agent to run this test.
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(authToken)
-		agentCloser := agent.New(agent.Options{
-			Client: agentClient,
-		})
-
+		_ = agenttest.New(t, client.URL, authToken)
+		resources := coderdtest.AwaitWorkspaceAgents(t, client, ws.ID)
 		ctx, cancel := context.WithCancel(context.Background())
 		t.Cleanup(cancel)
-		t.Cleanup(func() {
-			_ = agentCloser.Close()
-		})
 
 		// Make sure the agent is connected before we go any further.
-		resources := coderdtest.AwaitWorkspaceAgents(t, client, ws.ID)
 		var agentID uuid.UUID
 		for _, res := range resources {
 			for _, agt := range res.Agents {
@@ -97,7 +91,6 @@ func TestRun(t *testing.T) {
 		var (
 			bytesPerTick = 1024
 			tickInterval = 1000 * time.Millisecond
-			cancelAfter  = 1500 * time.Millisecond
 			fudgeWrite   = 12 // The ReconnectingPTY payload incurs some overhead
 			readMetrics  = &testMetrics{}
 			writeMetrics = &testMetrics{}
@@ -113,12 +106,32 @@ func TestRun(t *testing.T) {
 		})
 
 		var logs strings.Builder
-		// Stop the test after one 'tick'. This will cause an EOF.
+
+		runDone := make(chan struct{})
 		go func() {
-			<-time.After(cancelAfter)
-			cancel()
+			defer close(runDone)
+			err := runner.Run(ctx, "", &logs)
+			assert.NoError(t, err, "unexpected error calling Run()")
 		}()
-		require.NoError(t, runner.Run(ctx, "", &logs), "unexpected error calling Run()")
+
+		gotMetrics := make(chan struct{})
+		go func() {
+			defer close(gotMetrics)
+			// Wait until we get some non-zero metrics before canceling.
+			assert.Eventually(t, func() bool {
+				readLatencies := readMetrics.Latencies()
+				writeLatencies := writeMetrics.Latencies()
+				return len(readLatencies) > 0 &&
+					len(writeLatencies) > 0 &&
+					slices.ContainsFunc(readLatencies, func(f float64) bool { return f > 0.0 }) &&
+					slices.ContainsFunc(writeLatencies, func(f float64) bool { return f > 0.0 })
+			}, testutil.WaitLong, testutil.IntervalMedium, "expected non-zero metrics")
+		}()
+
+		// Stop the test after we get some non-zero metrics.
+		<-gotMetrics
+		cancel()
+		<-runDone
 
 		t.Logf("read errors: %.0f\n", readMetrics.Errors())
 		t.Logf("write errors: %.0f\n", writeMetrics.Errors())
@@ -132,18 +145,13 @@ func TestRun(t *testing.T) {
 		assert.NotZero(t, readMetrics.Total())
 		// Latency should report non-zero values.
 		assert.NotEmpty(t, readMetrics.Latencies())
-		for _, l := range readMetrics.Latencies()[1:] { // skip the first one, which is always zero
-			assert.NotZero(t, l)
-		}
-		for _, l := range writeMetrics.Latencies()[1:] { // skip the first one, which is always zero
-			assert.NotZero(t, l)
-		}
 		assert.NotEmpty(t, writeMetrics.Latencies())
 		// Should not report any errors!
 		assert.Zero(t, readMetrics.Errors())
 		assert.Zero(t, writeMetrics.Errors())
 	})
 
+	//nolint:dupl
 	t.Run("SSH", func(t *testing.T) {
 		t.Parallel()
 		// We need to stand up an in-memory coderd and run a fake workspace.
@@ -154,10 +162,10 @@ func TestRun(t *testing.T) {
 			agentName = "agent"
 			version   = coderdtest.CreateTemplateVersion(t, client, firstUser.OrganizationID, &echo.Responses{
 				Parse:         echo.ParseComplete,
-				ProvisionPlan: echo.ProvisionComplete,
-				ProvisionApply: []*proto.Provision_Response{{
-					Type: &proto.Provision_Response_Complete{
-						Complete: &proto.Provision_Complete{
+				ProvisionPlan: echo.PlanComplete,
+				ProvisionApply: []*proto.Response{{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
 							Resources: []*proto.Resource{{
 								Name: "example",
 								Type: "aws_instance",
@@ -175,29 +183,22 @@ func TestRun(t *testing.T) {
 				}},
 			})
 			template = coderdtest.CreateTemplate(t, client, firstUser.OrganizationID, version.ID)
-			_        = coderdtest.AwaitTemplateVersionJob(t, client, version.ID)
+			_        = coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			// In order to be picked up as a scaletest workspace, the workspace must be named specifically
 			ws = coderdtest.CreateWorkspace(t, client, firstUser.OrganizationID, template.ID, func(cwr *codersdk.CreateWorkspaceRequest) {
 				cwr.Name = "scaletest-test"
 			})
-			_ = coderdtest.AwaitWorkspaceBuildJob(t, client, ws.LatestBuild.ID)
+			_ = coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		)
 
 		// We also need a running agent to run this test.
-		agentClient := agentsdk.New(client.URL)
-		agentClient.SetSessionToken(authToken)
-		agentCloser := agent.New(agent.Options{
-			Client: agentClient,
-		})
+		_ = agenttest.New(t, client.URL, authToken)
+		resources := coderdtest.AwaitWorkspaceAgents(t, client, ws.ID)
 
 		ctx, cancel := context.WithCancel(context.Background())
-		t.Cleanup(func() {
-			cancel()
-			_ = agentCloser.Close()
-		})
+		t.Cleanup(cancel)
 
 		// Make sure the agent is connected before we go any further.
-		resources := coderdtest.AwaitWorkspaceAgents(t, client, ws.ID)
 		var agentID uuid.UUID
 		for _, res := range resources {
 			for _, agt := range res.Agents {
@@ -210,7 +211,6 @@ func TestRun(t *testing.T) {
 		var (
 			bytesPerTick = 1024
 			tickInterval = 1000 * time.Millisecond
-			cancelAfter  = 1500 * time.Millisecond
 			fudgeWrite   = 2 // We send \r\n, which is two bytes
 			readMetrics  = &testMetrics{}
 			writeMetrics = &testMetrics{}
@@ -226,12 +226,32 @@ func TestRun(t *testing.T) {
 		})
 
 		var logs strings.Builder
-		// Stop the test after one 'tick'. This will cause an EOF.
+
+		runDone := make(chan struct{})
 		go func() {
-			<-time.After(cancelAfter)
-			cancel()
+			defer close(runDone)
+			err := runner.Run(ctx, "", &logs)
+			assert.NoError(t, err, "unexpected error calling Run()")
 		}()
-		require.NoError(t, runner.Run(ctx, "", &logs), "unexpected error calling Run()")
+
+		gotMetrics := make(chan struct{})
+		go func() {
+			defer close(gotMetrics)
+			// Wait until we get some non-zero metrics before canceling.
+			assert.Eventually(t, func() bool {
+				readLatencies := readMetrics.Latencies()
+				writeLatencies := writeMetrics.Latencies()
+				return len(readLatencies) > 0 &&
+					len(writeLatencies) > 0 &&
+					slices.ContainsFunc(readLatencies, func(f float64) bool { return f > 0.0 }) &&
+					slices.ContainsFunc(writeLatencies, func(f float64) bool { return f > 0.0 })
+			}, testutil.WaitLong, testutil.IntervalMedium, "expected non-zero metrics")
+		}()
+
+		// Stop the test after we get some non-zero metrics.
+		<-gotMetrics
+		cancel()
+		<-runDone
 
 		t.Logf("read errors: %.0f\n", readMetrics.Errors())
 		t.Logf("write errors: %.0f\n", writeMetrics.Errors())
@@ -245,12 +265,6 @@ func TestRun(t *testing.T) {
 		assert.NotZero(t, readMetrics.Total())
 		// Latency should report non-zero values.
 		assert.NotEmpty(t, readMetrics.Latencies())
-		for _, l := range readMetrics.Latencies()[1:] { // skip the first one, which is always zero
-			assert.NotZero(t, l)
-		}
-		for _, l := range writeMetrics.Latencies()[1:] { // skip the first one, which is always zero
-			assert.NotZero(t, l)
-		}
 		assert.NotEmpty(t, writeMetrics.Latencies())
 		// Should not report any errors!
 		assert.Zero(t, readMetrics.Errors())
diff --git a/scripts/Dockerfile.base b/scripts/Dockerfile.base
index 738b66f01090e..ed5caba3558fa 100644
--- a/scripts/Dockerfile.base
+++ b/scripts/Dockerfile.base
@@ -1,7 +1,7 @@
 # This is the base image used for Coder images. It's a multi-arch image that is
 # built in depot.dev for all supported architectures. Since it's built on real
 # hardware and not cross-compiled, it can have "RUN" commands.
-FROM alpine:3.18.2
+FROM alpine:3.18.4
 
 # We use a single RUN command to reduce the number of layers in the image.
 # NOTE: Keep the Terraform version in sync with minTerraformVersion and
@@ -10,14 +10,8 @@ RUN apk add --no-cache \
 		curl \
 		wget \
 		bash \
-		jq \
 		git \
-		# Fixes CVE-2023-3446 and CVE-2023-2975. Only necessary until Alpine 3.18.3.
-		openssl \
 		openssh-client && \
-	# Use the edge repo, since Terraform doesn't seem to be backported to 3.18.
-	apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community \
-		terraform=~1.5 && \
 	addgroup \
 		-g 1000 \
 		coder && \
@@ -28,7 +22,16 @@ RUN apk add --no-cache \
 		-u 1000 \
 		-G coder \
 		coder
-
+# Terraform was disabled in the edge repo due to a build issue.
+# https://gitlab.alpinelinux.org/alpine/aports/-/commit/f3e263d94cfac02d594bef83790c280e045eba35
+# Using wget for now. Note that busybox unzip doesn't support streaming.
+#
+# WARNING: Do not update to 1.6.x, as it is the first release licensed under BSL instead of MPL.
+RUN ARCH="$(arch)"; if [ "${ARCH}" == "x86_64" ]; then ARCH="amd64"; elif [ "${ARCH}" == "aarch64" ]; then ARCH="arm64"; fi; wget -O /tmp/terraform.zip "https://releases.hashicorp.com/terraform/1.5.7/terraform_1.5.7_linux_${ARCH}.zip" && \
+		busybox unzip /tmp/terraform.zip -d /usr/local/bin && \
+		rm -f /tmp/terraform.zip && \
+		chmod +x /usr/local/bin/terraform && \
+		terraform --version
 USER 1000:1000
 ENV HOME=/home/coder
 ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt
diff --git a/scripts/apidocgen/markdown-template/main.dot b/scripts/apidocgen/markdown-template/main.dot
index 5f41c18b64674..baaf531a9016c 100644
--- a/scripts/apidocgen/markdown-template/main.dot
+++ b/scripts/apidocgen/markdown-template/main.dot
@@ -53,7 +53,7 @@
 
 		const countUppercase = words[0].length - words[0].replace(/[A-Z]/g, '').length;
 		if (countUppercase > 1) {
-			let displayName = p.displayName.replace(/» \*\*additionalProperties\*\*/g, "It").replace("» ", "");
+			let displayName = p.displayName.replace(/» \*\*additionalProperties\*\*/g, "It").replace("» ", "").replace(/»/g, "");
 			displayName = displayName.charAt(0).toUpperCase() + displayName.replace(/_/g, " ").toLowerCase().slice(1);
 			description = displayName + " " + words.slice(1).join(' ');
 		}
diff --git a/scripts/apidocgen/markdown-template/security.def b/scripts/apidocgen/markdown-template/security.def
index aadaf424b97fd..e45d06abe9343 100644
--- a/scripts/apidocgen/markdown-template/security.def
+++ b/scripts/apidocgen/markdown-template/security.def
@@ -3,7 +3,7 @@
 
 Long-lived tokens can be generated to perform actions on behalf of your user account:
 
-```console
+```shell
 coder tokens create
 ```
 
diff --git a/scripts/apidocgen/postprocess/main.go b/scripts/apidocgen/postprocess/main.go
index 8441507fada5f..b1f7d43fa2ce5 100644
--- a/scripts/apidocgen/postprocess/main.go
+++ b/scripts/apidocgen/postprocess/main.go
@@ -24,13 +24,13 @@ const (
 
 Generate a token on your Coder deployment by visiting:
 
-` + "````sh" + `
+` + "````shell" + `
 https://coder.example.com/settings/tokens
 ` + "````" + `
 
 List your workspaces
 
-` + "````sh" + `
+` + "````shell" + `
 # CLI
 curl https://coder.example.com/api/v2/workspaces?q=owner:me \
 -H "Coder-Session-Token: <your-token>"
diff --git a/scripts/apitypings/main.go b/scripts/apitypings/main.go
index 3cf4b1fe79c11..cb842d601fbfa 100644
--- a/scripts/apitypings/main.go
+++ b/scripts/apitypings/main.go
@@ -15,6 +15,7 @@ import (
 	"text/template"
 
 	"github.com/fatih/structtag"
+	"golang.org/x/exp/slices"
 	"golang.org/x/text/cases"
 	"golang.org/x/text/language"
 	"golang.org/x/tools/go/packages"
@@ -22,21 +23,39 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
-	"github.com/coder/coder/coderd/util/slice"
+	"github.com/coder/coder/v2/coderd/util/slice"
 )
 
 var (
-	baseDirs = [...]string{"./codersdk", "./coderd/healthcheck"}
-	indent   = "  "
+	// baseDirs are the directories to introspect for types to generate.
+	baseDirs = [...]string{"./codersdk", "./coderd/healthcheck", "./coderd/healthcheck/derphealth"}
+	// externalTypes are types that are not in the baseDirs, but we want to
+	// support. These are usually types that are used in the baseDirs.
+	// Do not include things like "Database", as that would break the idea
+	// of splitting db and api types.
+	// Only include dirs that are client facing packages.
+	externalTypeDirs = [...]string{"./cli/clibase"}
+	indent           = "  "
 )
 
 func main() {
 	ctx := context.Background()
 	log := slog.Make(sloghuman.Sink(os.Stderr))
+
+	external := []*Generator{}
+	for _, dir := range externalTypeDirs {
+		extGen, err := ParseDirectory(ctx, log, dir)
+		if err != nil {
+			log.Fatal(ctx, fmt.Sprintf("parse external directory %s: %s", dir, err.Error()))
+		}
+		extGen.onlyOptIn = true
+		external = append(external, extGen)
+	}
+
 	_, _ = fmt.Print("// Code generated by 'make site/src/api/typesGenerated.ts'. DO NOT EDIT.\n\n")
 	for _, baseDir := range baseDirs {
 		_, _ = fmt.Printf("// The code below is generated from %s.\n\n", strings.TrimPrefix(baseDir, "./"))
-		output, err := Generate(baseDir)
+		output, err := Generate(baseDir, external...)
 		if err != nil {
 			log.Fatal(ctx, err.Error())
 		}
@@ -44,18 +63,40 @@ func main() {
 		// Just cat the output to a file to capture it
 		_, _ = fmt.Print(output, "\n\n")
 	}
+
+	for i, ext := range external {
+		var ts *TypescriptTypes
+		for {
+			var err error
+			start := len(ext.allowList)
+			ts, err = ext.generateAll()
+			if err != nil {
+				log.Fatal(ctx, fmt.Sprintf("generate external: %s", err.Error()))
+			}
+			if len(ext.allowList) != start {
+				// This is so dumb, but basically the allowList can grow, and if
+				// it does, we need to regenerate.
+				continue
+			}
+			break
+		}
+
+		dir := externalTypeDirs[i]
+		_, _ = fmt.Printf("// The code below is generated from %s.\n\n", strings.TrimPrefix(dir, "./"))
+		_, _ = fmt.Print(ts.String(), "\n\n")
+	}
 }
 
-func Generate(directory string) (string, error) {
+func Generate(directory string, externals ...*Generator) (string, error) {
 	ctx := context.Background()
 	log := slog.Make(sloghuman.Sink(os.Stderr))
-	codeBlocks, err := GenerateFromDirectory(ctx, log, directory)
+	gen, err := GenerateFromDirectory(ctx, log, directory, externals...)
 	if err != nil {
 		return "", err
 	}
 
 	// Just cat the output to a file to capture it
-	return codeBlocks.String(), nil
+	return gen.cachedResult.String(), nil
 }
 
 // TypescriptTypes holds all the code blocks created.
@@ -109,23 +150,34 @@ func (t TypescriptTypes) String() string {
 	return strings.TrimRight(s.String(), "\n")
 }
 
-// GenerateFromDirectory will return all the typescript code blocks for a directory
-func GenerateFromDirectory(ctx context.Context, log slog.Logger, directory string) (*TypescriptTypes, error) {
-	g := Generator{
-		log:      log,
-		builtins: make(map[string]string),
+func ParseDirectory(ctx context.Context, log slog.Logger, directory string, externals ...*Generator) (*Generator, error) {
+	g := &Generator{
+		log:       log,
+		builtins:  make(map[string]string),
+		externals: externals,
 	}
 	err := g.parsePackage(ctx, directory)
 	if err != nil {
 		return nil, xerrors.Errorf("parse package %q: %w", directory, err)
 	}
 
+	return g, nil
+}
+
+// GenerateFromDirectory will return all the typescript code blocks for a directory
+func GenerateFromDirectory(ctx context.Context, log slog.Logger, directory string, externals ...*Generator) (*Generator, error) {
+	g, err := ParseDirectory(ctx, log, directory, externals...)
+	if err != nil {
+		return nil, err
+	}
+
 	codeBlocks, err := g.generateAll()
 	if err != nil {
-		return nil, xerrors.Errorf("parse package %q: %w", directory, err)
+		return nil, xerrors.Errorf("generate package %q: %w", directory, err)
 	}
+	g.cachedResult = codeBlocks
 
-	return codeBlocks, nil
+	return g, nil
 }
 
 type Generator struct {
@@ -133,6 +185,16 @@ type Generator struct {
 	pkg *packages.Package
 	log slog.Logger
 
+	// allowList if set only generates types in the allow list.
+	// This is kinda a hack to get around the fact that external types
+	// only should generate referenced types, and multiple packages can
+	// reference the same external types.
+	onlyOptIn bool
+	allowList []string
+
+	// externals are other packages referenced. Optional
+	externals []*Generator
+
 	// builtins is kinda a hack to get around the fact that using builtin
 	// generic constraints is common. We want to support them even though
 	// they are external to our package.
@@ -141,6 +203,8 @@ type Generator struct {
 	// cannot be implemented in go. So they are a first class thing that we just
 	// have to make a static string for ¯\_(ツ)_/¯
 	builtins map[string]string
+
+	cachedResult *TypescriptTypes
 }
 
 // parsePackage takes a list of patterns such as a directory, and parses them.
@@ -180,6 +244,10 @@ func (g *Generator) generateAll() (*TypescriptTypes, error) {
 		AllowedTypes: make(map[string]struct{}),
 	}
 
+	for _, a := range g.allowList {
+		m.AllowedTypes[strings.TrimSpace(a)] = struct{}{}
+	}
+
 	// Look for comments that indicate to ignore a type for typescript generation.
 	ignoreRegex := regexp.MustCompile("@typescript-ignore[:]?(?P<ignored_types>.*)")
 	for _, file := range g.pkg.Syntax {
@@ -303,11 +371,16 @@ func (g *Generator) generateOne(m *Maps, obj types.Object) error {
 	}
 
 	// If we have allowed types, only allow those to be generated.
-	if _, ok := m.AllowedTypes[obj.Name()]; len(m.AllowedTypes) > 0 && !ok {
-		return nil
+	if _, ok := m.AllowedTypes[obj.Name()]; (len(m.AllowedTypes) > 0 || g.onlyOptIn) && !ok {
+		// Allow constants to pass through, they are only included if the enum
+		// is allowed.
+		_, ok := obj.(*types.Const)
+		if !ok {
+			return nil
+		}
 	}
 
-	objName := objName(obj)
+	objectName := objName(obj)
 
 	switch obj := obj.(type) {
 	// All named types are type declarations
@@ -322,13 +395,13 @@ func (g *Generator) generateOne(m *Maps, obj types.Object) error {
 			// Structs are obvious.
 			codeBlock, err := g.buildStruct(obj, underNamed)
 			if err != nil {
-				return xerrors.Errorf("generate %q: %w", objName, err)
+				return xerrors.Errorf("generate %q: %w", objectName, err)
 			}
-			m.Structs[objName] = codeBlock
+			m.Structs[objectName] = codeBlock
 		case *types.Basic:
 			// type <Name> string
 			// These are enums. Store to expand later.
-			m.Enums[objName] = obj
+			m.Enums[objectName] = obj
 		case *types.Map, *types.Array, *types.Slice:
 			// Declared maps that are not structs are still valid codersdk objects.
 			// Handle them custom by calling 'typescriptType' directly instead of
@@ -337,7 +410,7 @@ func (g *Generator) generateOne(m *Maps, obj types.Object) error {
 			// These are **NOT** enums, as a map in Go would never be used for an enum.
 			ts, err := g.typescriptType(obj.Type().Underlying())
 			if err != nil {
-				return xerrors.Errorf("(map) generate %q: %w", objName, err)
+				return xerrors.Errorf("(map) generate %q: %w", objectName, err)
 			}
 
 			var str strings.Builder
@@ -347,8 +420,8 @@ func (g *Generator) generateOne(m *Maps, obj types.Object) error {
 				_, _ = str.WriteRune('\n')
 			}
 			// Use similar output syntax to enums.
-			_, _ = str.WriteString(fmt.Sprintf("export type %s = %s\n", objName, ts.ValueType))
-			m.Structs[objName] = str.String()
+			_, _ = str.WriteString(fmt.Sprintf("export type %s = %s\n", objectName, ts.ValueType))
+			m.Structs[objectName] = str.String()
 		case *types.Interface:
 			// Interfaces are used as generics. Non-generic interfaces are
 			// not supported.
@@ -366,9 +439,9 @@ func (g *Generator) generateOne(m *Maps, obj types.Object) error {
 
 				block, err := g.buildUnion(obj, union)
 				if err != nil {
-					return xerrors.Errorf("generate union %q: %w", objName, err)
+					return xerrors.Errorf("generate union %q: %w", objectName, err)
 				}
-				m.Generics[objName] = block
+				m.Generics[objectName] = block
 			}
 		case *types.Signature:
 		// Ignore named functions.
@@ -383,13 +456,13 @@ func (g *Generator) generateOne(m *Maps, obj types.Object) error {
 	case *types.Const:
 		// We only care about named constant types, since they are enums
 		if named, ok := obj.Type().(*types.Named); ok {
-			name := named.Obj().Name()
-			m.EnumConsts[name] = append(m.EnumConsts[name], obj)
+			enumObjName := objName(named.Obj())
+			m.EnumConsts[enumObjName] = append(m.EnumConsts[enumObjName], obj)
 		}
 	case *types.Func:
 		// Noop
 	default:
-		_, _ = fmt.Println(objName)
+		_, _ = fmt.Println(objectName)
 	}
 	return nil
 }
@@ -655,8 +728,6 @@ type TypescriptType struct {
 // Eg:
 //
 //	[]byte returns "string"
-//
-//nolint:gocyclo
 func (g *Generator) typescriptType(ty types.Type) (TypescriptType, error) {
 	switch ty := ty.(type) {
 	case *types.Basic:
@@ -753,16 +824,29 @@ func (g *Generator) typescriptType(ty types.Type) (TypescriptType, error) {
 		n := ty
 
 		// These are external named types that we handle uniquely.
+		// This is unfortunate, but our current code assumes all defined
+		// types are enums, but these are really just basic primitives.
+		// We would need to add more logic to determine this, but for now
+		// just hard code them.
 		switch n.String() {
-		case "github.com/coder/coder/cli/clibase.String":
+		case "github.com/coder/coder/v2/cli/clibase.Regexp":
 			return TypescriptType{ValueType: "string"}, nil
-		case "github.com/coder/coder/cli/clibase.Strings":
+		case "github.com/coder/coder/v2/cli/clibase.HostPort":
+			// Custom marshal json to be a string
+			return TypescriptType{ValueType: "string"}, nil
+		case "github.com/coder/coder/v2/cli/clibase.StringArray":
 			return TypescriptType{ValueType: "string[]"}, nil
-		case "github.com/coder/coder/cli/clibase.Int64":
+		case "github.com/coder/coder/v2/cli/clibase.String":
+			return TypescriptType{ValueType: "string"}, nil
+		case "github.com/coder/coder/v2/cli/clibase.YAMLConfigPath":
+			return TypescriptType{ValueType: "string"}, nil
+		case "github.com/coder/coder/v2/cli/clibase.Strings":
+			return TypescriptType{ValueType: "string[]"}, nil
+		case "github.com/coder/coder/v2/cli/clibase.Int64":
 			return TypescriptType{ValueType: "number"}, nil
-		case "github.com/coder/coder/cli/clibase.Bool":
+		case "github.com/coder/coder/v2/cli/clibase.Bool":
 			return TypescriptType{ValueType: "boolean"}, nil
-		case "github.com/coder/coder/cli/clibase.Duration":
+		case "github.com/coder/coder/v2/cli/clibase.Duration":
 			return TypescriptType{ValueType: "number"}, nil
 		case "net/url.URL":
 			return TypescriptType{ValueType: "string"}, nil
@@ -773,7 +857,7 @@ func (g *Generator) typescriptType(ty types.Type) (TypescriptType, error) {
 			return TypescriptType{ValueType: "number"}, nil
 		case "database/sql.NullTime":
 			return TypescriptType{ValueType: "string", Optional: true}, nil
-		case "github.com/coder/coder/codersdk.NullTime":
+		case "github.com/coder/coder/v2/codersdk.NullTime":
 			return TypescriptType{ValueType: "string", Optional: true}, nil
 		case "github.com/google/uuid.NullUUID":
 			return TypescriptType{ValueType: "string", Optional: true}, nil
@@ -781,18 +865,46 @@ func (g *Generator) typescriptType(ty types.Type) (TypescriptType, error) {
 			return TypescriptType{ValueType: "string"}, nil
 		case "encoding/json.RawMessage":
 			return TypescriptType{ValueType: "Record<string, string>"}, nil
-		case "github.com/coder/coder/cli/clibase.URL":
+		case "github.com/coder/coder/v2/cli/clibase.URL":
 			return TypescriptType{ValueType: "string"}, nil
 		}
 
+		// Some hard codes are a bit trickier.
+		//nolint:gocritic,revive // I prefer the switch for extensibility later.
+		switch {
+		// Struct is a generic, so the type has generic constraints in the string.
+		case regexp.MustCompile(`github\.com/coder/coder/v2/cli/clibase.Struct\[.*\]`).MatchString(n.String()):
+			// The marshal json just marshals the underlying value.
+			str, ok := ty.Underlying().(*types.Struct)
+			if ok {
+				return g.typescriptType(str.Field(0).Type())
+			}
+		}
+
 		// Then see if the type is defined elsewhere. If it is, we can just
 		// put the objName as it will be defined in the typescript codeblock
 		// we generate.
 		objName := objName(n.Obj())
 		genericName := ""
 		genericTypes := make(map[string]string)
-		pkgName := n.Obj().Pkg().Name()
-		if obj := g.pkg.Types.Scope().Lookup(n.Obj().Name()); g.pkg.Name == pkgName && obj != nil {
+
+		obj, objGen, local := g.lookupNamedReference(n)
+		if obj != nil {
+			if g.onlyOptIn && !slices.Contains(g.allowList, n.Obj().Name()) {
+				// This is kludgy, but if we are an external package,
+				// we need to also include dependencies. There is no
+				// good way to return all extra types we need to include,
+				// so just add them to the allow list and hope the caller notices
+				// the slice grew...
+				g.allowList = append(g.allowList, n.Obj().Name())
+			}
+			if !local {
+				objGen.allowList = append(objGen.allowList, n.Obj().Name())
+				g.log.Debug(context.Background(), "found external type",
+					"name", objName,
+					"ext_pkg", objGen.pkg.String(),
+				)
+			}
 			// Sweet! Using other typescript types as fields. This could be an
 			// enum or another struct
 			if args := n.TypeArgs(); args != nil && args.Len() > 0 {
@@ -819,10 +931,13 @@ func (g *Generator) typescriptType(ty types.Type) (TypescriptType, error) {
 				genericName = objName + fmt.Sprintf("<%s>", strings.Join(genericNames, ", "))
 				objName += fmt.Sprintf("<%s>", strings.Join(genericConstraints, ", "))
 			}
+
+			cmt := ""
 			return TypescriptType{
-				GenericTypes: genericTypes,
-				GenericValue: genericName,
-				ValueType:    objName,
+				GenericTypes:  genericTypes,
+				GenericValue:  genericName,
+				ValueType:     objName,
+				AboveTypeLine: cmt,
 			}, nil
 		}
 
@@ -844,7 +959,10 @@ func (g *Generator) typescriptType(ty types.Type) (TypescriptType, error) {
 		if err != nil {
 			return TypescriptType{}, xerrors.Errorf("named underlying: %w", err)
 		}
-		ts.AboveTypeLine = indentedComment(fmt.Sprintf("This is likely an enum in an external package (%q)", n.String()))
+		if ts.AboveTypeLine == "" {
+			// If no comment exists explaining where this type comes from, add one.
+			ts.AboveTypeLine = indentedComment(fmt.Sprintf("This is likely an enum in an external package (%q)", n.String()))
+		}
 		return ts, nil
 	case *types.Pointer:
 		// Dereference pointers.
@@ -870,15 +988,14 @@ func (g *Generator) typescriptType(ty types.Type) (TypescriptType, error) {
 				),
 			}, nil
 		}
-		// All complex interfaces should be named. So if we get here, that means
-		// we are using anonymous interfaces. Which is just weird and not supported.
-		// Example:
-		//  type Foo struct {
-		//    Bar interface {
-		//      Baz() string
-		//    }
-		//  }
-		return TypescriptType{}, xerrors.New("only empty interface types are supported")
+
+		// Interfaces are difficult to determine the JSON type, so just return
+		// an 'any'.
+		return TypescriptType{
+			ValueType:     "any",
+			AboveTypeLine: indentedComment("eslint-disable-next-line @typescript-eslint/no-explicit-any -- Golang interface, unable to resolve type."),
+			Optional:      false,
+		}, nil
 	case *types.TypeParam:
 		_, ok := ty.Underlying().(*types.Interface)
 		if !ok {
@@ -930,6 +1047,22 @@ func (g *Generator) typescriptType(ty types.Type) (TypescriptType, error) {
 	return TypescriptType{}, xerrors.Errorf("unknown type: %s", ty.String())
 }
 
+func (g *Generator) lookupNamedReference(n *types.Named) (obj types.Object, generator *Generator, local bool) {
+	pkgName := n.Obj().Pkg().Name()
+
+	if obj := g.pkg.Types.Scope().Lookup(n.Obj().Name()); g.pkg.Name == pkgName && obj != nil {
+		return obj, g, true
+	}
+
+	for _, ext := range g.externals {
+		if obj := ext.pkg.Types.Scope().Lookup(n.Obj().Name()); ext.pkg.Name == pkgName && obj != nil {
+			return obj, ext, false
+		}
+	}
+
+	return nil, nil, false
+}
+
 // isBuiltIn returns the string for a builtin type that we want to support
 // if the name is a reserved builtin type. This is for types like 'comparable'.
 // These types are not implemented in golang, so we just have to hardcode it.
diff --git a/scripts/auditdocgen/main.go b/scripts/auditdocgen/main.go
index 761658048629b..694fdfc5329b8 100644
--- a/scripts/auditdocgen/main.go
+++ b/scripts/auditdocgen/main.go
@@ -11,7 +11,7 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/enterprise/audit"
+	"github.com/coder/coder/v2/enterprise/audit"
 )
 
 var (
diff --git a/scripts/build_go.sh b/scripts/build_go.sh
index 905738786149a..bf435477fcb3e 100755
--- a/scripts/build_go.sh
+++ b/scripts/build_go.sh
@@ -2,7 +2,7 @@
 
 # This script builds a single Go binary of Coder with the given parameters.
 #
-# Usage: ./build_go.sh [--version 1.2.3-devel+abcdef] [--os linux] [--arch amd64] [--output path/to/output] [--slim] [--agpl]
+# Usage: ./build_go.sh [--version 1.2.3-devel+abcdef] [--os linux] [--arch amd64] [--output path/to/output] [--slim] [--agpl] [--boringcrypto]
 #
 # Defaults to linux:amd64 with slim disabled, but can be controlled with GOOS,
 # GOARCH and CODER_SLIM_BUILD=1. If no version is specified, defaults to the
@@ -22,6 +22,9 @@
 #
 # If the --agpl parameter is specified, builds only the AGPL-licensed code (no
 # Coder enterprise features).
+#
+# If the --boringcrypto parameter is specified, builds use boringcrypto instead of
+# the standard go crypto libraries.
 
 set -euo pipefail
 # shellcheck source=scripts/lib.sh
@@ -34,8 +37,9 @@ slim="${CODER_SLIM_BUILD:-0}"
 sign_darwin="${CODER_SIGN_DARWIN:-0}"
 output_path=""
 agpl="${CODER_BUILD_AGPL:-0}"
+boringcrypto=${CODER_BUILD_BORINGCRYPTO:-0}
 
-args="$(getopt -o "" -l version:,os:,arch:,output:,slim,agpl,sign-darwin -- "$@")"
+args="$(getopt -o "" -l version:,os:,arch:,output:,slim,agpl,sign-darwin,boringcrypto -- "$@")"
 eval set -- "$args"
 while true; do
 	case "$1" in
@@ -68,6 +72,10 @@ while true; do
 		sign_darwin=1
 		shift
 		;;
+	--boringcrypto)
+		boringcrypto=1
+		shift
+		;;
 	--)
 		shift
 		break
@@ -96,18 +104,21 @@ fi
 ldflags=(
 	-s
 	-w
-	-X "'github.com/coder/coder/buildinfo.tag=$version'"
+	-X "'github.com/coder/coder/v2/buildinfo.tag=$version'"
 )
 
+# We use ts_omit_aws here because on Linux it prevents Tailscale from importing
+# github.com/aws/aws-sdk-go-v2/aws, which adds 7 MB to the binary.
+TS_EXTRA_SMALL="ts_omit_aws,ts_omit_bird,ts_omit_tap,ts_omit_kube"
 if [[ "$slim" == 0 ]]; then
-	build_args+=(-tags embed)
+	build_args+=(-tags "embed,$TS_EXTRA_SMALL")
 else
-	build_args+=(-tags slim)
+	build_args+=(-tags "slim,$TS_EXTRA_SMALL")
 fi
 if [[ "$agpl" == 1 ]]; then
 	# We don't use a tag to control AGPL because we don't want code to depend on
 	# a flag to control AGPL vs. enterprise behavior.
-	ldflags+=(-X "'github.com/coder/coder/buildinfo.agpl=true'")
+	ldflags+=(-X "'github.com/coder/coder/v2/buildinfo.agpl=true'")
 fi
 build_args+=(-ldflags "${ldflags[*]}")
 
@@ -137,7 +148,15 @@ cmd_path="./enterprise/cmd/coder"
 if [[ "$agpl" == 1 ]]; then
 	cmd_path="./cmd/coder"
 fi
-CGO_ENABLED=0 GOOS="$os" GOARCH="$arch" GOARM="$arm_version" go build \
+
+cgo=0
+goexp=""
+if [[ "$boringcrypto" == 1 ]]; then
+	cgo=1
+	goexp="boringcrypto"
+fi
+
+GOEXPERIMENT="$goexp" CGO_ENABLED="$cgo" GOOS="$os" GOARCH="$arch" GOARM="$arm_version" go build \
 	"${build_args[@]}" \
 	"$cmd_path" 1>&2
 
diff --git a/scripts/check_enterprise_imports.sh b/scripts/check_enterprise_imports.sh
index 321a48ab25f94..340453a62d239 100755
--- a/scripts/check_enterprise_imports.sh
+++ b/scripts/check_enterprise_imports.sh
@@ -13,7 +13,7 @@ find . -regex ".*\.go" |
 	grep -v "./enterprise" |
 	grep -v ./scripts/auditdocgen/ --include="*.go" |
 	grep -v ./scripts/clidocgen/ --include="*.go" |
-	xargs grep -n "github.com/coder/coder/enterprise"
+	xargs grep -n "github.com/coder/coder/v2/enterprise"
 # reverse the exit code because we want this script to fail if grep finds anything.
 status=$?
 set -e
diff --git a/scripts/check_site_icons.sh b/scripts/check_site_icons.sh
index 2d4406a4d321e..3ccd6b02cac41 100755
--- a/scripts/check_site_icons.sh
+++ b/scripts/check_site_icons.sh
@@ -16,6 +16,7 @@ exceptions=(
 	"do.png"
 	"gcp.png"
 	"k8s.png"
+	"ruby.png"
 )
 
 function is_exception() {
diff --git a/scripts/chocolatey/coder.nuspec b/scripts/chocolatey/coder.nuspec
new file mode 100644
index 0000000000000..65751f257e436
--- /dev/null
+++ b/scripts/chocolatey/coder.nuspec
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Read this before creating packages: https://docs.chocolatey.org/en-us/create/create-packages -->
+<!-- It is especially important to read the above link to understand additional requirements when publishing packages to the community feed aka dot org (https://community.chocolatey.org/packages). -->
+
+<!-- Test your packages in a test environment: https://github.com/chocolatey/chocolatey-test-environment -->
+<!-- Do not remove this test for UTF-8: if “Ω” doesn’t appear as greek uppercase omega letter enclosed in quotation marks, you should use an editor that supports UTF-8, not this one. -->
+<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
+  <metadata>
+    <!-- == PACKAGE SPECIFIC SECTION == -->
+    <!-- This section is about this package, although id and version have ties back to the software -->
+    <!-- id is lowercase and if you want a good separator for words, use '-', not '.'. Dots are only acceptable as suffixes for certain types of packages, e.g. .install, .portable, .extension, .template -->
+    <!-- If the software is cross-platform, attempt to use the same id as the debian/rpm package(s) if possible. -->
+    <id>coder</id>
+    <version>$version$</version>
+    <packageSourceUrl>https://github.com/coder/coder/blob/main/scripts/chocolatey</packageSourceUrl>
+    <!-- owners is a poor name for maintainers of the package. It sticks around by this name for compatibility reasons. It basically means you. -->
+    <owners>Coder Technologies\, Inc.</owners>
+    <!-- ============================== -->
+
+    <!-- == SOFTWARE SPECIFIC SECTION == -->
+    <!-- This section is about the software itself -->
+    <title>Coder (Install)</title>
+    <authors>Coder Technologies\, Inc.</authors>
+    <projectUrl>https://coder.com</projectUrl>
+    <iconUrl>https://github.com/coder/presskit/raw/main/logos/coder%20logo%20black%20square.png?raw=true</iconUrl>
+    <copyright>Coder Technologies, Inc.</copyright>
+    <licenseUrl>https://coder.com/legal/terms-of-service</licenseUrl>
+    <requireLicenseAcceptance>true</requireLicenseAcceptance>
+    <projectSourceUrl>https://github.com/coder/coder.git</projectSourceUrl>
+    <docsUrl>https://coder.com/docs/v2/latest</docsUrl>
+    <bugTrackerUrl>https://github.com/coder/coder/issues</bugTrackerUrl>
+    <tags>coder remote-dev terraform development</tags>
+    <summary>Remote development environments on your infrastructure provisioned with Terraform</summary>
+    <description>Remote development environments on your infrastructure provisioned with Terraform</description>
+  </metadata>
+  <files>
+    <file src="$binary_path$" target="tools/coder.exe" />
+  </files>
+</package>
diff --git a/scripts/ci-report/main.go b/scripts/ci-report/main.go
index 9e3ae7e39d6bb..9637af813e512 100644
--- a/scripts/ci-report/main.go
+++ b/scripts/ci-report/main.go
@@ -12,6 +12,8 @@ import (
 
 	"golang.org/x/exp/slices"
 	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/util/slice"
 )
 
 func main() {
@@ -161,9 +163,8 @@ func parseCIReport(report GotestsumReport) (CIReport, error) {
 	}
 	timeouts = timeoutsNorm
 
-	sortAZ := func(a, b string) bool { return a < b }
-	slices.SortFunc(packagesSortedByName, sortAZ)
-	slices.SortFunc(testSortedByName, sortAZ)
+	slices.SortFunc(packagesSortedByName, slice.Ascending[string])
+	slices.SortFunc(testSortedByName, slice.Ascending[string])
 
 	var rep CIReport
 
diff --git a/scripts/ci-report/testdata/ci-report_gotests-timeout.json.sample.golden b/scripts/ci-report/testdata/ci-report_gotests-timeout.json.sample.golden
index 5f7a8ce57e843..e5df1c70df6a4 100644
--- a/scripts/ci-report/testdata/ci-report_gotests-timeout.json.sample.golden
+++ b/scripts/ci-report/testdata/ci-report_gotests-timeout.json.sample.golden
@@ -1,38 +1,38 @@
 {
   "packages": [
     {
-      "name": "agent",
+      "name": "v2/agent",
       "time": 2.045,
       "fail": true,
       "num_failed": 1,
       "timeout": true,
-      "output": "panic: test timed out after 2s\nrunning tests:\n\tTestAgent_Session_TTY_Hushlogin (0s)\n\ngoroutine 411 [running]:\ntesting.(*M).startAlarm.func1()\n\t/usr/local/go/src/testing/testing.go:2241 +0x3b9\ncreated by time.goFunc\n\t/usr/local/go/src/time/sleep.go:176 +0x32\n\ngoroutine 1 [chan receive]:\ntesting.(*T).Run(0xc0004e1040, {0x16a5e92?, 0x535fa5?}, 0x17462c0)\n\t/usr/local/go/src/testing/testing.go:1630 +0x405\ntesting.runTests.func1(0x236db60?)\n\t/usr/local/go/src/testing/testing.go:2036 +0x45\ntesting.tRunner(0xc0004e1040, 0xc000589bb8)\n\t/usr/local/go/src/testing/testing.go:1576 +0x10b\ntesting.runTests(0xc000341a40?, {0x235c580, 0x21, 0x21}, {0x4182d0?, 0xc000589c78?, 0x236cb40?})\n\t/usr/local/go/src/testing/testing.go:2034 +0x489\ntesting.(*M).Run(0xc000341a40)\n\t/usr/local/go/src/testing/testing.go:1906 +0x63a\ngo.uber.org/goleak.VerifyTestMain({0x18f5540?, 0xc000341a40?}, {0x0, 0x0, 0x0})\n\t/home/mafredri/.local/go/pkg/mod/go.uber.org/goleak@v1.2.1/testmain.go:53 +0x6b\ngithub.com/coder/coder/agent_test.TestMain(...)\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:53\nmain.main()\n\t_testmain.go:115 +0x1e5\n\ngoroutine 9 [chan receive]:\ntesting.(*T).Parallel(0xc0004e11e0)\n\t/usr/local/go/src/testing/testing.go:1384 +0x225\ngithub.com/coder/coder/agent_test.TestAgent_SessionExec(0x0?)\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:188 +0x33\ntesting.tRunner(0xc0004e11e0, 0x1746298)\n\t/usr/local/go/src/testing/testing.go:1576 +0x10b\ncreated by testing.(*T).Run\n\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n\ngoroutine 10 [chan receive]:\ntesting.(*T).Parallel(0xc0004e1520)\n\t/usr/local/go/src/testing/testing.go:1384 +0x225\ngithub.com/coder/coder/agent_test.TestAgent_SessionTTYShell(0xc0004e1520)\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:213 +0x36\ntesting.tRunner(0xc0004e1520, 0x17462a8)\n\t/usr/local/go/src/testing/testing.go:1576 +0x10b\ncreated by testing.(*T).Run\n\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n\ngoroutine 11 [chan receive]:\ntesting.(*T).Parallel(0xc0004e1860)\n\t/usr/local/go/src/testing/testing.go:1384 +0x225\ngithub.com/coder/coder/agent_test.TestAgent_SessionTTYExitCode(0xc0004e1520?)\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:244 +0x36\ntesting.tRunner(0xc0004e1860, 0x17462a0)\n\t/usr/local/go/src/testing/testing.go:1576 +0x10b\ncreated by testing.(*T).Run\n\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n\ngoroutine 408 [runnable]:\nmath/big.nat.montgomery({0xc004aa4500?, 0x10?, 0x26?}, {0xc004aa4280?, 0x10?, 0x26?}, {0xc004aa4280?, 0x10?, 0x26?}, {0xc000732820, ...}, ...)\n\t/usr/local/go/src/math/big/nat.go:216 +0x565\nmath/big.nat.expNNMontgomery({0xc004aa4280, 0xc0003c2e70?, 0x26}, {0xc004a9adc0?, 0x21?, 0x24?}, {0xc004a9ac80, 0x10, 0x24?}, {0xc000732820, ...})\n\t/usr/local/go/src/math/big/nat.go:1271 +0xb1c\nmath/big.nat.expNN({0xc004aa4280?, 0x14?, 0x22c2900?}, {0xc004a9adc0?, 0x10, 0x14}, {0xc004a9ac80?, 0x10, 0x14?}, {0xc000732820, ...}, ...)\n\t/usr/local/go/src/math/big/nat.go:996 +0x3b1\nmath/big.nat.probablyPrimeMillerRabin({0xc000732820?, 0x10, 0x14}, 0x15, 0x1)\n\t/usr/local/go/src/math/big/prime.go:106 +0x5b8\nmath/big.(*Int).ProbablyPrime(0xc0047208c0, 0x14)\n\t/usr/local/go/src/math/big/prime.go:78 +0x225\ncrypto/rand.Prime({0x18f04c0, 0xc00007e020}, 0x400)\n\t/usr/local/go/src/crypto/rand/util.go:55 +0x1e5\ncrypto/rsa.GenerateMultiPrimeKey({0x18f04c0, 0xc00007e020}, 0x2, 0x800)\n\t/usr/local/go/src/crypto/rsa/rsa.go:369 +0x745\ncrypto/rsa.GenerateKey(...)\n\t/usr/local/go/src/crypto/rsa/rsa.go:264\ngithub.com/coder/coder/agent.(*agent).init(0xc00485eea0, {0x1902c20?, 0xc00485d770})\n\t/home/mafredri/src/coder/coder/agent/agent.go:810 +0x6c\ngithub.com/coder/coder/agent.New({{0x190cbc0, 0xc0005b7710}, {0x166d829, 0x4}, {0x166d829, 0x4}, 0x17461d8, {0x1907c90, 0xc000278280}, 0x45d964b800, ...})\n\t/home/mafredri/src/coder/coder/agent/agent.go:134 +0x549\ngithub.com/coder/coder/agent_test.setupAgent(0xc00485eb60, {0x0, {0x0, 0x0}, {0x0, 0x0, 0x0}, 0xc0005b8da0, 0x0, {0x0, ...}, ...}, ...)\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:1568 +0x63e\ngithub.com/coder/coder/agent_test.setupSSHSession(0xc00485eb60, {0x0, {0x0, 0x0}, {0x0, 0x0, 0x0}, 0x0, 0x0, {0x0, ...}, ...})\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:1524 +0xc5\ngithub.com/coder/coder/agent_test.TestAgent_Session_TTY_Hushlogin(0xc00485eb60)\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:330 +0x2fa\ntesting.tRunner(0xc00485eb60, 0x17462c0)\n\t/usr/local/go/src/testing/testing.go:1576 +0x10b\ncreated by testing.(*T).Run\n\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n\ngoroutine 409 [IO wait]:\ninternal/poll.runtime_pollWait(0x7f5230766628, 0x72)\n\t/usr/local/go/src/runtime/netpoll.go:306 +0x89\ninternal/poll.(*pollDesc).wait(0xc00475bf80?, 0xc0005ec5e2?, 0x0)\n\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32\ninternal/poll.(*pollDesc).waitRead(...)\n\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:89\ninternal/poll.(*FD).Accept(0xc00475bf80)\n\t/usr/local/go/src/internal/poll/fd_unix.go:614 +0x2bd\nnet.(*netFD).accept(0xc00475bf80)\n\t/usr/local/go/src/net/fd_unix.go:172 +0x35\nnet.(*TCPListener).accept(0xc00486ecd8)\n\t/usr/local/go/src/net/tcpsock_posix.go:148 +0x25\nnet.(*TCPListener).Accept(0xc00486ecd8)\n\t/usr/local/go/src/net/tcpsock.go:297 +0x3d\ncrypto/tls.(*listener).Accept(0xc00486ef18)\n\t/usr/local/go/src/crypto/tls/tls.go:66 +0x2d\nnet/http.(*Server).Serve(0xc00029da40, {0x18fefa0, 0xc00486ef18})\n\t/usr/local/go/src/net/http/server.go:3059 +0x385\nnet/http/httptest.(*Server).goServe.func1()\n\t/usr/local/go/src/net/http/httptest/server.go:310 +0x6a\ncreated by net/http/httptest.(*Server).goServe\n\t/usr/local/go/src/net/http/httptest/server.go:308 +0x6a\n\ngoroutine 410 [IO wait]:\ninternal/poll.runtime_pollWait(0x7f5230765908, 0x72)\n\t/usr/local/go/src/runtime/netpoll.go:306 +0x89\ninternal/poll.(*pollDesc).wait(0xc00043a300?, 0xc004880000?, 0x0)\n\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32\ninternal/poll.(*pollDesc).waitRead(...)\n\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:89\ninternal/poll.(*FD).ReadFromInet4(0xc00043a300, {0xc004880000, 0x10000, 0x10000}, 0x0?)\n\t/usr/local/go/src/internal/poll/fd_unix.go:250 +0x24f\nnet.(*netFD).readFromInet4(0xc00043a300, {0xc004880000?, 0x0?, 0x0?}, 0x0?)\n\t/usr/local/go/src/net/fd_posix.go:66 +0x29\nnet.(*UDPConn).readFrom(0x30?, {0xc004880000?, 0xc0005b7770?, 0x0?}, 0xc0005b7770)\n\t/usr/local/go/src/net/udpsock_posix.go:52 +0x1b8\nnet.(*UDPConn).readFromUDP(0xc000015a08, {0xc004880000?, 0x4102c7?, 0x10000?}, 0x13e45e0?)\n\t/usr/local/go/src/net/udpsock.go:149 +0x31\nnet.(*UDPConn).ReadFrom(0x59a?, {0xc004880000, 0x10000, 0x10000})\n\t/usr/local/go/src/net/udpsock.go:158 +0x50\ntailscale.com/net/stun/stuntest.runSTUN({0x1911ec0, 0xc00485eb60}, {0x1907f60, 0xc000015a08}, 0xc00481baa0, 0x17462c0?)\n\t/home/mafredri/.local/go/pkg/mod/github.com/coder/tailscale@v1.1.1-0.20230327205451-058fa46a3723/net/stun/stuntest/stuntest.go:59 +0xc6\ncreated by tailscale.com/net/stun/stuntest.ServeWithPacketListener\n\t/home/mafredri/.local/go/pkg/mod/github.com/coder/tailscale@v1.1.1-0.20230327205451-058fa46a3723/net/stun/stuntest/stuntest.go:47 +0x26a\n"
+      "output": "panic: test timed out after 2s\nrunning tests:\n\tTestAgent_Session_TTY_Hushlogin (0s)\n\ngoroutine 411 [running]:\ntesting.(*M).startAlarm.func1()\n\t/usr/local/go/src/testing/testing.go:2241 +0x3b9\ncreated by time.goFunc\n\t/usr/local/go/src/time/sleep.go:176 +0x32\n\ngoroutine 1 [chan receive]:\ntesting.(*T).Run(0xc0004e1040, {0x16a5e92?, 0x535fa5?}, 0x17462c0)\n\t/usr/local/go/src/testing/testing.go:1630 +0x405\ntesting.runTests.func1(0x236db60?)\n\t/usr/local/go/src/testing/testing.go:2036 +0x45\ntesting.tRunner(0xc0004e1040, 0xc000589bb8)\n\t/usr/local/go/src/testing/testing.go:1576 +0x10b\ntesting.runTests(0xc000341a40?, {0x235c580, 0x21, 0x21}, {0x4182d0?, 0xc000589c78?, 0x236cb40?})\n\t/usr/local/go/src/testing/testing.go:2034 +0x489\ntesting.(*M).Run(0xc000341a40)\n\t/usr/local/go/src/testing/testing.go:1906 +0x63a\ngo.uber.org/goleak.VerifyTestMain({0x18f5540?, 0xc000341a40?}, {0x0, 0x0, 0x0})\n\t/home/mafredri/.local/go/pkg/mod/go.uber.org/goleak@v1.2.1/testmain.go:53 +0x6b\ngithub.com/coder/coder/v2/agent_test.TestMain(...)\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:53\nmain.main()\n\t_testmain.go:115 +0x1e5\n\ngoroutine 9 [chan receive]:\ntesting.(*T).Parallel(0xc0004e11e0)\n\t/usr/local/go/src/testing/testing.go:1384 +0x225\ngithub.com/coder/coder/v2/agent_test.TestAgent_SessionExec(0x0?)\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:188 +0x33\ntesting.tRunner(0xc0004e11e0, 0x1746298)\n\t/usr/local/go/src/testing/testing.go:1576 +0x10b\ncreated by testing.(*T).Run\n\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n\ngoroutine 10 [chan receive]:\ntesting.(*T).Parallel(0xc0004e1520)\n\t/usr/local/go/src/testing/testing.go:1384 +0x225\ngithub.com/coder/coder/v2/agent_test.TestAgent_SessionTTYShell(0xc0004e1520)\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:213 +0x36\ntesting.tRunner(0xc0004e1520, 0x17462a8)\n\t/usr/local/go/src/testing/testing.go:1576 +0x10b\ncreated by testing.(*T).Run\n\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n\ngoroutine 11 [chan receive]:\ntesting.(*T).Parallel(0xc0004e1860)\n\t/usr/local/go/src/testing/testing.go:1384 +0x225\ngithub.com/coder/coder/v2/agent_test.TestAgent_SessionTTYExitCode(0xc0004e1520?)\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:244 +0x36\ntesting.tRunner(0xc0004e1860, 0x17462a0)\n\t/usr/local/go/src/testing/testing.go:1576 +0x10b\ncreated by testing.(*T).Run\n\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n\ngoroutine 408 [runnable]:\nmath/big.nat.montgomery({0xc004aa4500?, 0x10?, 0x26?}, {0xc004aa4280?, 0x10?, 0x26?}, {0xc004aa4280?, 0x10?, 0x26?}, {0xc000732820, ...}, ...)\n\t/usr/local/go/src/math/big/nat.go:216 +0x565\nmath/big.nat.expNNMontgomery({0xc004aa4280, 0xc0003c2e70?, 0x26}, {0xc004a9adc0?, 0x21?, 0x24?}, {0xc004a9ac80, 0x10, 0x24?}, {0xc000732820, ...})\n\t/usr/local/go/src/math/big/nat.go:1271 +0xb1c\nmath/big.nat.expNN({0xc004aa4280?, 0x14?, 0x22c2900?}, {0xc004a9adc0?, 0x10, 0x14}, {0xc004a9ac80?, 0x10, 0x14?}, {0xc000732820, ...}, ...)\n\t/usr/local/go/src/math/big/nat.go:996 +0x3b1\nmath/big.nat.probablyPrimeMillerRabin({0xc000732820?, 0x10, 0x14}, 0x15, 0x1)\n\t/usr/local/go/src/math/big/prime.go:106 +0x5b8\nmath/big.(*Int).ProbablyPrime(0xc0047208c0, 0x14)\n\t/usr/local/go/src/math/big/prime.go:78 +0x225\ncrypto/rand.Prime({0x18f04c0, 0xc00007e020}, 0x400)\n\t/usr/local/go/src/crypto/rand/util.go:55 +0x1e5\ncrypto/rsa.GenerateMultiPrimeKey({0x18f04c0, 0xc00007e020}, 0x2, 0x800)\n\t/usr/local/go/src/crypto/rsa/rsa.go:369 +0x745\ncrypto/rsa.GenerateKey(...)\n\t/usr/local/go/src/crypto/rsa/rsa.go:264\ngithub.com/coder/coder/v2/agent.(*agent).init(0xc00485eea0, {0x1902c20?, 0xc00485d770})\n\t/home/mafredri/src/coder/coder/agent/agent.go:810 +0x6c\ngithub.com/coder/coder/v2/agent.New({{0x190cbc0, 0xc0005b7710}, {0x166d829, 0x4}, {0x166d829, 0x4}, 0x17461d8, {0x1907c90, 0xc000278280}, 0x45d964b800, ...})\n\t/home/mafredri/src/coder/coder/agent/agent.go:134 +0x549\ngithub.com/coder/coder/v2/agent_test.setupAgent(0xc00485eb60, {0x0, {0x0, 0x0}, {0x0, 0x0, 0x0}, 0xc0005b8da0, 0x0, {0x0, ...}, ...}, ...)\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:1568 +0x63e\ngithub.com/coder/coder/v2/agent_test.setupSSHSession(0xc00485eb60, {0x0, {0x0, 0x0}, {0x0, 0x0, 0x0}, 0x0, 0x0, {0x0, ...}, ...})\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:1524 +0xc5\ngithub.com/coder/coder/v2/agent_test.TestAgent_Session_TTY_Hushlogin(0xc00485eb60)\n\t/home/mafredri/src/coder/coder/agent/agent_test.go:330 +0x2fa\ntesting.tRunner(0xc00485eb60, 0x17462c0)\n\t/usr/local/go/src/testing/testing.go:1576 +0x10b\ncreated by testing.(*T).Run\n\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n\ngoroutine 409 [IO wait]:\ninternal/poll.runtime_pollWait(0x7f5230766628, 0x72)\n\t/usr/local/go/src/runtime/netpoll.go:306 +0x89\ninternal/poll.(*pollDesc).wait(0xc00475bf80?, 0xc0005ec5e2?, 0x0)\n\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32\ninternal/poll.(*pollDesc).waitRead(...)\n\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:89\ninternal/poll.(*FD).Accept(0xc00475bf80)\n\t/usr/local/go/src/internal/poll/fd_unix.go:614 +0x2bd\nnet.(*netFD).accept(0xc00475bf80)\n\t/usr/local/go/src/net/fd_unix.go:172 +0x35\nnet.(*TCPListener).accept(0xc00486ecd8)\n\t/usr/local/go/src/net/tcpsock_posix.go:148 +0x25\nnet.(*TCPListener).Accept(0xc00486ecd8)\n\t/usr/local/go/src/net/tcpsock.go:297 +0x3d\ncrypto/tls.(*listener).Accept(0xc00486ef18)\n\t/usr/local/go/src/crypto/tls/tls.go:66 +0x2d\nnet/http.(*Server).Serve(0xc00029da40, {0x18fefa0, 0xc00486ef18})\n\t/usr/local/go/src/net/http/server.go:3059 +0x385\nnet/http/httptest.(*Server).goServe.func1()\n\t/usr/local/go/src/net/http/httptest/server.go:310 +0x6a\ncreated by net/http/httptest.(*Server).goServe\n\t/usr/local/go/src/net/http/httptest/server.go:308 +0x6a\n\ngoroutine 410 [IO wait]:\ninternal/poll.runtime_pollWait(0x7f5230765908, 0x72)\n\t/usr/local/go/src/runtime/netpoll.go:306 +0x89\ninternal/poll.(*pollDesc).wait(0xc00043a300?, 0xc004880000?, 0x0)\n\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32\ninternal/poll.(*pollDesc).waitRead(...)\n\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:89\ninternal/poll.(*FD).ReadFromInet4(0xc00043a300, {0xc004880000, 0x10000, 0x10000}, 0x0?)\n\t/usr/local/go/src/internal/poll/fd_unix.go:250 +0x24f\nnet.(*netFD).readFromInet4(0xc00043a300, {0xc004880000?, 0x0?, 0x0?}, 0x0?)\n\t/usr/local/go/src/net/fd_posix.go:66 +0x29\nnet.(*UDPConn).readFrom(0x30?, {0xc004880000?, 0xc0005b7770?, 0x0?}, 0xc0005b7770)\n\t/usr/local/go/src/net/udpsock_posix.go:52 +0x1b8\nnet.(*UDPConn).readFromUDP(0xc000015a08, {0xc004880000?, 0x4102c7?, 0x10000?}, 0x13e45e0?)\n\t/usr/local/go/src/net/udpsock.go:149 +0x31\nnet.(*UDPConn).ReadFrom(0x59a?, {0xc004880000, 0x10000, 0x10000})\n\t/usr/local/go/src/net/udpsock.go:158 +0x50\ntailscale.com/net/stun/stuntest.runSTUN({0x1911ec0, 0xc00485eb60}, {0x1907f60, 0xc000015a08}, 0xc00481baa0, 0x17462c0?)\n\t/home/mafredri/.local/go/pkg/mod/github.com/coder/tailscale@v1.1.1-0.20230327205451-058fa46a3723/net/stun/stuntest/stuntest.go:59 +0xc6\ncreated by tailscale.com/net/stun/stuntest.ServeWithPacketListener\n\t/home/mafredri/.local/go/pkg/mod/github.com/coder/tailscale@v1.1.1-0.20230327205451-058fa46a3723/net/stun/stuntest/stuntest.go:47 +0x26a\n"
     }
   ],
   "tests": [
     {
-      "package": "agent",
+      "package": "v2/agent",
       "name": "TestAgent_SessionExec",
       "time": 0,
       "fail": true,
       "output": "=== RUN   TestAgent_SessionExec\n=== PAUSE TestAgent_SessionExec\n"
     },
     {
-      "package": "agent",
+      "package": "v2/agent",
       "name": "TestAgent_SessionTTYExitCode",
       "time": 0,
       "fail": true,
       "output": "=== RUN   TestAgent_SessionTTYExitCode\n=== PAUSE TestAgent_SessionTTYExitCode\n"
     },
     {
-      "package": "agent",
+      "package": "v2/agent",
       "name": "TestAgent_SessionTTYShell",
       "time": 0,
       "fail": true,
       "output": "=== RUN   TestAgent_SessionTTYShell\n=== PAUSE TestAgent_SessionTTYShell\n"
     },
     {
-      "package": "agent",
+      "package": "v2/agent",
       "name": "TestAgent_Session_TTY_Hushlogin",
       "time": 0,
       "fail": true,
@@ -40,7 +40,7 @@
       "output": "=== RUN   TestAgent_Session_TTY_Hushlogin\n"
     },
     {
-      "package": "agent",
+      "package": "v2/agent",
       "name": "TestAgent_Session_TTY_MOTD",
       "time": 1.84
     }
diff --git a/scripts/ci-report/testdata/ci-report_gotests.json.sample.golden b/scripts/ci-report/testdata/ci-report_gotests.json.sample.golden
index e5c46507cc6cf..d71b4be63d67e 100644
--- a/scripts/ci-report/testdata/ci-report_gotests.json.sample.golden
+++ b/scripts/ci-report/testdata/ci-report_gotests.json.sample.golden
@@ -1,372 +1,372 @@
 {
   "packages": [
     {
-      "name": "agent",
+      "name": "v2/agent",
       "time": 4.341,
       "fail": true,
       "num_failed": 1
     },
     {
-      "name": "cli",
+      "name": "v2/cli",
       "time": 26.514,
       "fail": true,
       "num_failed": 7
     },
     {
-      "name": "cli/cliui",
+      "name": "v2/cli/cliui",
       "time": 0.037
     }
   ],
   "tests": [
     {
-      "package": "agent",
+      "package": "v2/agent",
       "name": "TestAgent_SessionExec",
       "time": 0.86
     },
     {
-      "package": "agent",
+      "package": "v2/agent",
       "name": "TestAgent_SessionTTYExitCode",
       "time": 0.88
     },
     {
-      "package": "agent",
+      "package": "v2/agent",
       "name": "TestAgent_SessionTTYShell",
       "time": 0.94
     },
     {
-      "package": "agent",
+      "package": "v2/agent",
       "name": "TestAgent_Session_TTY_FastCommandHasOutput",
       "time": 0.95,
       "fail": true,
-      "output": "=== RUN   TestAgent_Session_TTY_FastCommandHasOutput\n=== PAUSE TestAgent_Session_TTY_FastCommandHasOutput\n=== CONT  TestAgent_Session_TTY_FastCommandHasOutput\n    t.go:81: 2023-03-29 13:37:27.353 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n    t.go:81: 2023-03-29 13:37:27.353 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n    t.go:81: 2023-03-29 13:37:27.353 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:049e454260a62aa1\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n    t.go:81: 2023-03-29 13:37:27.356 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n    t.go:81: 2023-03-29 13:37:27.356 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 34688, \"DERPPort\": 43117, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:34ff526bdd502e84\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.358 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n    t.go:81: 2023-03-29 13:37:27.358 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n    t.go:81: 2023-03-29 13:37:27.358 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n    t.go:81: 2023-03-29 13:37:27.358 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.358191Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n    t.go:81: 2023-03-29 13:37:27.363 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n    t.go:81: 2023-03-29 13:37:27.368 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n    t.go:81: 2023-03-29 13:37:27.373 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n    t.go:81: 2023-03-29 13:37:27.386 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n    t.go:81: 2023-03-29 13:37:27.387 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n    t.go:81: 2023-03-29 13:37:27.387 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.358191Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.379813Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": []}}\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.379813Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": []}}\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n    t.go:81: 2023-03-29 13:37:27.441 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.513 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:58992 derp=1 derpdist=1v4:62ms\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:58992 (stun), 172.20.0.2:58992 (local)\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.514434952 +0000 UTC m=+4.154042177 Peers:[] LocalAddrs:[{Addr:127.0.0.1:58992 Type:stun} {Addr:172.20.0.2:58992 Type:local}] DERPs:0}\", \"err\": null}\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.514515Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.514515Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.515008199 +0000 UTC m=+4.154615430 Peers:[] LocalAddrs:[{Addr:127.0.0.1:58992 Type:stun} {Addr:172.20.0.2:58992 Type:local}] DERPs:1}\", \"err\": null}\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.062405899}}}\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.515155Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.062405899}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.515155Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.062405899}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.516 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:34848 derp=1 derpdist=1v4:65ms\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:34848 (stun), 172.20.0.2:34848 (local)\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.525526859 +0000 UTC m=+4.165134074 Peers:[] LocalAddrs:[{Addr:127.0.0.1:34848 Type:stun} {Addr:172.20.0.2:34848 Type:local}] DERPs:0}\", \"err\": null}\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.525972278 +0000 UTC m=+4.165579492 Peers:[] LocalAddrs:[{Addr:127.0.0.1:34848 Type:stun} {Addr:172.20.0.2:34848 Type:local}] DERPs:1}\", \"err\": null}\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.065420657}}}\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.5256Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.5256Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.526766Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.065420657}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.526766Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.065420657}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.535 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n    t.go:81: 2023-03-29 13:37:27.537 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:58992 derp=1 derpdist=1v4:5ms\n    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:34848 derp=1 derpdist=1v4:7ms\n    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.005291379}}}\n    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.578687Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.005291379}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.578687Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.005291379}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.00675754}}}\n    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.579606Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.00675754}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.579606Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.00675754}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n    t.go:81: 2023-03-29 13:37:27.580 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.580 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n    t.go:81: 2023-03-29 13:37:27.580 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.624 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [5WitN]  ...\n    t.go:81: 2023-03-29 13:37:27.625 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [5WitN] set to derp-1 (shared home)\n    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [5EOvJ] set to derp-1 (shared home)\n    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [5WitN] d:34ff526bdd502e84 now using 172.20.0.2:34848\n    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [5WitN]  ...\n    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [5WitN]  ...\n    t.go:81: 2023-03-29 13:37:27.627 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Created\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Updating endpoint\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Removing all allowedips\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Adding allowedip\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Updating persistent keepalive interval\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Starting\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Sending handshake initiation\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [5EOvJ] now active, reconfiguring WireGuard\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Created\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Updating endpoint\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Removing all allowedips\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Adding allowedip\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Updating persistent keepalive interval\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Starting\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Received handshake initiation\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Sending handshake response\n    t.go:81: 2023-03-29 13:37:27.630 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.630405833 +0000 UTC m=+4.270013057 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c}] LocalAddrs:[{Addr:127.0.0.1:34848 Type:stun} {Addr:172.20.0.2:34848 Type:local}] DERPs:1}\", \"err\": null}\n    t.go:81: 2023-03-29 13:37:27.631 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Received handshake response\n    t.go:81: 2023-03-29 13:37:27.631 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [5EOvJ] d:049e454260a62aa1 now using 172.20.0.2:58992\n    t.go:81: 2023-03-29 13:37:27.631 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.631481797 +0000 UTC m=+4.271089021 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:27.631305354 +0000 UTC NodeKey:nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f}] LocalAddrs:[{Addr:127.0.0.1:58992 Type:stun} {Addr:172.20.0.2:58992 Type:local}] DERPs:1}\", \"err\": null}\n    t.go:81: 2023-03-29 13:37:27.632 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [5WitN] d:34ff526bdd502e84 now using 127.0.0.1:34848\n    agent_test.go:400: \n        \tError Trace:\t/home/mafredri/src/coder/coder/agent/agent_test.go:400\n        \t            \t\t\t\t/home/mafredri/src/coder/coder/agent/agent_test.go:401\n        \tError:      \t\"\" does not contain \"wazzup\"\n        \tTest:       \tTestAgent_Session_TTY_FastCommandHasOutput\n        \tMessages:   \tshould output greeting\n    ptytest.go:83: 2023-03-29 13:37:27.648: cmd: closing tpty: close\n    ptytest.go:74: 2023-03-29 13:37:27.648: cmd: closing pty\n    ptytest.go:110: 2023-03-29 13:37:27.648: cmd: copy done: read /dev/ptmx: file already closed\n    ptytest.go:111: 2023-03-29 13:37:27.648: cmd: closing out\n    ptytest.go:113: 2023-03-29 13:37:27.648: cmd: closed out: read /dev/ptmx: file already closed\n    ptytest.go:76: 2023-03-29 13:37:27.648: cmd: closed pty: \u003cnil\u003e\n    ptytest.go:74: 2023-03-29 13:37:27.648: cmd: closing logw\n    ptytest.go:76: 2023-03-29 13:37:27.648: cmd: closed logw: \u003cnil\u003e\n    ptytest.go:74: 2023-03-29 13:37:27.648: cmd: closing logr\n    ptytest.go:76: 2023-03-29 13:37:27.648: cmd: closed logr: \u003cnil\u003e\n    ptytest.go:102: 2023-03-29 13:37:27.648: cmd: closed tpty\n    t.go:81: 2023-03-29 13:37:27.648 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n    t.go:81: 2023-03-29 13:37:27.648 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Stopping\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n    t.go:81: 2023-03-29 13:37:27.649 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d): sending disco ping to [5EOvJ]  ...\n    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Stopping\n    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n    stuntest.go:63: STUN server shutdown\n--- FAIL: TestAgent_Session_TTY_FastCommandHasOutput (0.95s)\n"
+      "output": "=== RUN   TestAgent_Session_TTY_FastCommandHasOutput\n=== PAUSE TestAgent_Session_TTY_FastCommandHasOutput\n=== CONT  TestAgent_Session_TTY_FastCommandHasOutput\n    t.go:81: 2023-03-29 13:37:27.353 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n    t.go:81: 2023-03-29 13:37:27.353 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n    t.go:81: 2023-03-29 13:37:27.353 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:049e454260a62aa1\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n    t.go:81: 2023-03-29 13:37:27.356 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n    t.go:81: 2023-03-29 13:37:27.356 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 34688, \"DERPPort\": 43117, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:34ff526bdd502e84\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.358 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n    t.go:81: 2023-03-29 13:37:27.358 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n    t.go:81: 2023-03-29 13:37:27.358 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n    t.go:81: 2023-03-29 13:37:27.358 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.358191Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n    t.go:81: 2023-03-29 13:37:27.363 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n    t.go:81: 2023-03-29 13:37:27.368 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n    t.go:81: 2023-03-29 13:37:27.373 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n    t.go:81: 2023-03-29 13:37:27.386 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n    t.go:81: 2023-03-29 13:37:27.387 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n    t.go:81: 2023-03-29 13:37:27.387 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.358191Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.379813Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": []}}\n    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.379813Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": []}}\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n    t.go:81: 2023-03-29 13:37:27.441 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n    t.go:81: 2023-03-29 13:37:27.513 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:58992 derp=1 derpdist=1v4:62ms\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:58992 (stun), 172.20.0.2:58992 (local)\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.514434952 +0000 UTC m=+4.154042177 Peers:[] LocalAddrs:[{Addr:127.0.0.1:58992 Type:stun} {Addr:172.20.0.2:58992 Type:local}] DERPs:0}\", \"err\": null}\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.514515Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.514515Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.515008199 +0000 UTC m=+4.154615430 Peers:[] LocalAddrs:[{Addr:127.0.0.1:58992 Type:stun} {Addr:172.20.0.2:58992 Type:local}] DERPs:1}\", \"err\": null}\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.062405899}}}\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.515155Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.062405899}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.515155Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.062405899}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.516 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:34848 derp=1 derpdist=1v4:65ms\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:34848 (stun), 172.20.0.2:34848 (local)\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.525526859 +0000 UTC m=+4.165134074 Peers:[] LocalAddrs:[{Addr:127.0.0.1:34848 Type:stun} {Addr:172.20.0.2:34848 Type:local}] DERPs:0}\", \"err\": null}\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.525972278 +0000 UTC m=+4.165579492 Peers:[] LocalAddrs:[{Addr:127.0.0.1:34848 Type:stun} {Addr:172.20.0.2:34848 Type:local}] DERPs:1}\", \"err\": null}\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.065420657}}}\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.5256Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.5256Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.526766Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.065420657}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.526766Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.065420657}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.535 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n    t.go:81: 2023-03-29 13:37:27.537 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:58992 derp=1 derpdist=1v4:5ms\n    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:34848 derp=1 derpdist=1v4:7ms\n    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.005291379}}}\n    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.578687Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.005291379}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.578687Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.005291379}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.00675754}}}\n    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.579606Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.00675754}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.579606Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.00675754}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n    t.go:81: 2023-03-29 13:37:27.580 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n    t.go:81: 2023-03-29 13:37:27.580 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n    t.go:81: 2023-03-29 13:37:27.580 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n    t.go:81: 2023-03-29 13:37:27.624 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [5WitN]  ...\n    t.go:81: 2023-03-29 13:37:27.625 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [5WitN] set to derp-1 (shared home)\n    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [5EOvJ] set to derp-1 (shared home)\n    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [5WitN] d:34ff526bdd502e84 now using 172.20.0.2:34848\n    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [5WitN]  ...\n    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [5WitN]  ...\n    t.go:81: 2023-03-29 13:37:27.627 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Created\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Updating endpoint\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Removing all allowedips\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Adding allowedip\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Updating persistent keepalive interval\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Starting\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Sending handshake initiation\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [5EOvJ] now active, reconfiguring WireGuard\n    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Created\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Updating endpoint\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Removing all allowedips\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Adding allowedip\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Updating persistent keepalive interval\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Starting\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Received handshake initiation\n    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Sending handshake response\n    t.go:81: 2023-03-29 13:37:27.630 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.630405833 +0000 UTC m=+4.270013057 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c}] LocalAddrs:[{Addr:127.0.0.1:34848 Type:stun} {Addr:172.20.0.2:34848 Type:local}] DERPs:1}\", \"err\": null}\n    t.go:81: 2023-03-29 13:37:27.631 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Received handshake response\n    t.go:81: 2023-03-29 13:37:27.631 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [5EOvJ] d:049e454260a62aa1 now using 172.20.0.2:58992\n    t.go:81: 2023-03-29 13:37:27.631 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.631481797 +0000 UTC m=+4.271089021 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:27.631305354 +0000 UTC NodeKey:nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f}] LocalAddrs:[{Addr:127.0.0.1:58992 Type:stun} {Addr:172.20.0.2:58992 Type:local}] DERPs:1}\", \"err\": null}\n    t.go:81: 2023-03-29 13:37:27.632 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [5WitN] d:34ff526bdd502e84 now using 127.0.0.1:34848\n    agent_test.go:400: \n        \tError Trace:\t/home/mafredri/src/coder/coder/agent/agent_test.go:400\n        \t            \t\t\t\t/home/mafredri/src/coder/coder/agent/agent_test.go:401\n        \tError:      \t\"\" does not contain \"wazzup\"\n        \tTest:       \tTestAgent_Session_TTY_FastCommandHasOutput\n        \tMessages:   \tshould output greeting\n    ptytest.go:83: 2023-03-29 13:37:27.648: cmd: closing tpty: close\n    ptytest.go:74: 2023-03-29 13:37:27.648: cmd: closing pty\n    ptytest.go:110: 2023-03-29 13:37:27.648: cmd: copy done: read /dev/ptmx: file already closed\n    ptytest.go:111: 2023-03-29 13:37:27.648: cmd: closing out\n    ptytest.go:113: 2023-03-29 13:37:27.648: cmd: closed out: read /dev/ptmx: file already closed\n    ptytest.go:76: 2023-03-29 13:37:27.648: cmd: closed pty: \u003cnil\u003e\n    ptytest.go:74: 2023-03-29 13:37:27.648: cmd: closing logw\n    ptytest.go:76: 2023-03-29 13:37:27.648: cmd: closed logw: \u003cnil\u003e\n    ptytest.go:74: 2023-03-29 13:37:27.648: cmd: closing logr\n    ptytest.go:76: 2023-03-29 13:37:27.648: cmd: closed logr: \u003cnil\u003e\n    ptytest.go:102: 2023-03-29 13:37:27.648: cmd: closed tpty\n    t.go:81: 2023-03-29 13:37:27.648 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n    t.go:81: 2023-03-29 13:37:27.648 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Stopping\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n    t.go:81: 2023-03-29 13:37:27.649 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d): sending disco ping to [5EOvJ]  ...\n    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Stopping\n    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n    stuntest.go:63: STUN server shutdown\n--- FAIL: TestAgent_Session_TTY_FastCommandHasOutput (0.95s)\n"
     },
     {
-      "package": "agent",
+      "package": "v2/agent",
       "name": "TestAgent_Session_TTY_HugeOutputIsNotLost",
       "time": 0,
       "skip": true
     },
     {
-      "package": "agent",
+      "package": "v2/agent",
       "name": "TestAgent_Session_TTY_Hushlogin",
       "time": 1.69
     },
     {
-      "package": "agent",
+      "package": "v2/agent",
       "name": "TestAgent_Session_TTY_MOTD",
       "time": 1.62
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer",
       "time": 0.05,
       "fail": true,
       "output": "=== RUN   TestServer\n--- FAIL: TestServer (0.05s)\n"
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/BuiltinPostgres",
       "time": 5.17
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/BuiltinPostgresURL",
       "time": 0.11
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/BuiltinPostgresURLRaw",
       "time": 0.11
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/CanListenUnspecifiedv4",
       "time": 0.6
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/CanListenUnspecifiedv6",
       "time": 0.63
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/DeprecatedAddress",
       "time": 0.06
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/DeprecatedAddress/HTTP",
       "time": 1.01
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/DeprecatedAddress/TLS",
       "time": 0.5
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/GitHubOAuth",
       "time": 1.01
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/LocalAccessURL",
       "time": 0.71
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/Logging",
       "time": 0
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/Logging/CreatesFile",
       "time": 0.69
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/Logging/Human",
       "time": 0.7
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/Logging/JSON",
       "time": 0.67
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/Logging/Multiple",
       "time": 13.24
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/Logging/Stackdriver",
       "time": 26.23
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/NoAddress",
       "time": 0
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/NoSchemeAccessURL",
       "time": 0
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/NoTLSAddress",
       "time": 0
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/NoWarningWithRemoteAccessURL",
       "time": 0.72
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/Production",
       "time": 0,
       "fail": true,
-      "output": "=== RUN   TestServer/Production\n    server_test.go:109: \n        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_test.go:109\n        \tError:      \tReceived unexpected error:\n        \t            \tcould not start resource:\n        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n        \t            \t    \n        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n        \t            \t    github.com/coder/coder/cli_test.TestServer.func1\n        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_test.go:108\n        \t            \t    testing.tRunner\n        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n        \t            \t    runtime.goexit\n        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n        \tTest:       \tTestServer/Production\n--- FAIL: TestServer/Production (0.00s)\n"
+      "output": "=== RUN   TestServer/Production\n    server_test.go:109: \n        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_test.go:109\n        \tError:      \tReceived unexpected error:\n        \t            \tcould not start resource:\n        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n        \t            \t    \n        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n        \t            \t    github.com/coder/coder/v2/cli_test.TestServer.func1\n        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_test.go:108\n        \t            \t    testing.tRunner\n        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n        \t            \t    runtime.goexit\n        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n        \tTest:       \tTestServer/Production\n--- FAIL: TestServer/Production (0.00s)\n"
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/Prometheus",
       "time": 1
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/RateLimit",
       "time": 0
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/RateLimit/Changed",
       "time": 1.07
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/RateLimit/Default",
       "time": 0.85
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/RateLimit/Disabled",
       "time": 1.02
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/RemoteAccessURL",
       "time": 0.92
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/Shutdown",
       "time": 0.05
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSAndHTTP",
       "time": 1.24
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSBadClientAuth",
       "time": 0
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSBadVersion",
       "time": 0
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSInvalid",
       "time": 0
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSInvalid/MismatchedCertAndKey",
       "time": 0
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSInvalid/MismatchedCount",
       "time": 0
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSInvalid/NoCert",
       "time": 0
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSInvalid/NoKey",
       "time": 0
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSRedirect",
       "time": 0.05
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSRedirect/NoHTTPListener",
       "time": 0.62
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSRedirect/NoRedirect",
       "time": 0.77
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSRedirect/NoRedirectWithWildcard",
       "time": 0.47
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSRedirect/NoTLSListener",
       "time": 0.59
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSRedirect/OK",
       "time": 1.06
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSValid",
       "time": 1.09
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TLSValidMultiple",
       "time": 1.23
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/Telemetry",
       "time": 1.09
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServer/TracerNoLeak",
       "time": 0.75
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServerCreateAdminUser",
       "time": 0,
       "fail": true,
       "output": "=== RUN   TestServerCreateAdminUser\n--- FAIL: TestServerCreateAdminUser (0.00s)\n"
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServerCreateAdminUser/Env",
       "time": 0,
       "fail": true,
-      "output": "=== RUN   TestServerCreateAdminUser/Env\n=== PAUSE TestServerCreateAdminUser/Env\n=== CONT  TestServerCreateAdminUser/Env\n    server_createadminuser_test.go:153: \n        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:153\n        \tError:      \tReceived unexpected error:\n        \t            \tcould not start resource:\n        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n        \t            \t    \n        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n        \t            \t    github.com/coder/coder/cli_test.TestServerCreateAdminUser.func3\n        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:152\n        \t            \t    testing.tRunner\n        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n        \t            \t    runtime.goexit\n        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n        \tTest:       \tTestServerCreateAdminUser/Env\n--- FAIL: TestServerCreateAdminUser/Env (0.00s)\n"
+      "output": "=== RUN   TestServerCreateAdminUser/Env\n=== PAUSE TestServerCreateAdminUser/Env\n=== CONT  TestServerCreateAdminUser/Env\n    server_createadminuser_test.go:153: \n        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:153\n        \tError:      \tReceived unexpected error:\n        \t            \tcould not start resource:\n        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n        \t            \t    \n        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n        \t            \t    github.com/coder/coder/v2/cli_test.TestServerCreateAdminUser.func3\n        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:152\n        \t            \t    testing.tRunner\n        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n        \t            \t    runtime.goexit\n        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n        \tTest:       \tTestServerCreateAdminUser/Env\n--- FAIL: TestServerCreateAdminUser/Env (0.00s)\n"
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServerCreateAdminUser/OK",
       "time": 0,
       "fail": true,
-      "output": "=== RUN   TestServerCreateAdminUser/OK\n=== PAUSE TestServerCreateAdminUser/OK\n=== CONT  TestServerCreateAdminUser/OK\n    server_createadminuser_test.go:87: \n        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:87\n        \tError:      \tReceived unexpected error:\n        \t            \tcould not start resource:\n        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n        \t            \t    \n        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n        \t            \t    github.com/coder/coder/cli_test.TestServerCreateAdminUser.func2\n        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:86\n        \t            \t    testing.tRunner\n        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n        \t            \t    runtime.goexit\n        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n        \tTest:       \tTestServerCreateAdminUser/OK\n--- FAIL: TestServerCreateAdminUser/OK (0.00s)\n"
+      "output": "=== RUN   TestServerCreateAdminUser/OK\n=== PAUSE TestServerCreateAdminUser/OK\n=== CONT  TestServerCreateAdminUser/OK\n    server_createadminuser_test.go:87: \n        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:87\n        \tError:      \tReceived unexpected error:\n        \t            \tcould not start resource:\n        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n        \t            \t    \n        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n        \t            \t    github.com/coder/coder/v2/cli_test.TestServerCreateAdminUser.func2\n        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:86\n        \t            \t    testing.tRunner\n        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n        \t            \t    runtime.goexit\n        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n        \tTest:       \tTestServerCreateAdminUser/OK\n--- FAIL: TestServerCreateAdminUser/OK (0.00s)\n"
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServerCreateAdminUser/Stdin",
       "time": 0,
       "fail": true,
-      "output": "=== RUN   TestServerCreateAdminUser/Stdin\n=== PAUSE TestServerCreateAdminUser/Stdin\n=== CONT  TestServerCreateAdminUser/Stdin\n    server_createadminuser_test.go:187: \n        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:187\n        \tError:      \tReceived unexpected error:\n        \t            \tcould not start resource:\n        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n        \t            \t    \n        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n        \t            \t    github.com/coder/coder/cli_test.TestServerCreateAdminUser.func4\n        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:186\n        \t            \t    testing.tRunner\n        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n        \t            \t    runtime.goexit\n        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n        \tTest:       \tTestServerCreateAdminUser/Stdin\n--- FAIL: TestServerCreateAdminUser/Stdin (0.00s)\n"
+      "output": "=== RUN   TestServerCreateAdminUser/Stdin\n=== PAUSE TestServerCreateAdminUser/Stdin\n=== CONT  TestServerCreateAdminUser/Stdin\n    server_createadminuser_test.go:187: \n        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:187\n        \tError:      \tReceived unexpected error:\n        \t            \tcould not start resource:\n        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n        \t            \t    \n        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n        \t            \t    github.com/coder/coder/v2/cli_test.TestServerCreateAdminUser.func4\n        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:186\n        \t            \t    testing.tRunner\n        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n        \t            \t    runtime.goexit\n        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n        \tTest:       \tTestServerCreateAdminUser/Stdin\n--- FAIL: TestServerCreateAdminUser/Stdin (0.00s)\n"
     },
     {
-      "package": "cli",
+      "package": "v2/cli",
       "name": "TestServerCreateAdminUser/Validates",
       "time": 0,
       "fail": true,
-      "output": "=== RUN   TestServerCreateAdminUser/Validates\n=== PAUSE TestServerCreateAdminUser/Validates\n=== CONT  TestServerCreateAdminUser/Validates\n    server_createadminuser_test.go:227: \n        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:227\n        \tError:      \tReceived unexpected error:\n        \t            \tcould not start resource:\n        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n        \t            \t    \n        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n        \t            \t    github.com/coder/coder/cli_test.TestServerCreateAdminUser.func5\n        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:226\n        \t            \t    testing.tRunner\n        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n        \t            \t    runtime.goexit\n        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n        \tTest:       \tTestServerCreateAdminUser/Validates\n--- FAIL: TestServerCreateAdminUser/Validates (0.00s)\n"
+      "output": "=== RUN   TestServerCreateAdminUser/Validates\n=== PAUSE TestServerCreateAdminUser/Validates\n=== CONT  TestServerCreateAdminUser/Validates\n    server_createadminuser_test.go:227: \n        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:227\n        \tError:      \tReceived unexpected error:\n        \t            \tcould not start resource:\n        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n        \t            \t    \n        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n        \t            \t    github.com/coder/coder/v2/cli_test.TestServerCreateAdminUser.func5\n        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:226\n        \t            \t    testing.tRunner\n        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n        \t            \t    runtime.goexit\n        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n        \tTest:       \tTestServerCreateAdminUser/Validates\n--- FAIL: TestServerCreateAdminUser/Validates (0.00s)\n"
     },
     {
-      "package": "cli/cliui",
+      "package": "v2/cli/cliui",
       "name": "TestGitAuth",
       "time": 0
     },
     {
-      "package": "cli/cliui",
+      "package": "v2/cli/cliui",
       "name": "TestPrompt",
       "time": 0
     },
     {
-      "package": "cli/cliui",
+      "package": "v2/cli/cliui",
       "name": "TestPrompt/BadJSON",
       "time": 0
     },
     {
-      "package": "cli/cliui",
+      "package": "v2/cli/cliui",
       "name": "TestPrompt/Confirm",
       "time": 0
     },
     {
-      "package": "cli/cliui",
+      "package": "v2/cli/cliui",
       "name": "TestPrompt/JSON",
       "time": 0
     },
     {
-      "package": "cli/cliui",
+      "package": "v2/cli/cliui",
       "name": "TestPrompt/MultilineJSON",
       "time": 0
     },
     {
-      "package": "cli/cliui",
+      "package": "v2/cli/cliui",
       "name": "TestPrompt/Skip",
       "time": 0
     },
     {
-      "package": "cli/cliui",
+      "package": "v2/cli/cliui",
       "name": "TestPrompt/Success",
       "time": 0
     }
diff --git a/scripts/ci-report/testdata/gotests-timeout.json.sample b/scripts/ci-report/testdata/gotests-timeout.json.sample
index 95e809612434d..d13c9dc37199c 100644
--- a/scripts/ci-report/testdata/gotests-timeout.json.sample
+++ b/scripts/ci-report/testdata/gotests-timeout.json.sample
@@ -1,382 +1,382 @@
-{"Time":"2023-03-29T13:59:30.419140864Z","Action":"start","Package":"github.com/coder/coder/agent"}
-{"Time":"2023-03-29T13:59:30.440137227Z","Action":"run","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec"}
-{"Time":"2023-03-29T13:59:30.440225617Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"=== RUN   TestAgent_SessionExec\n"}
-{"Time":"2023-03-29T13:59:30.440252351Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"=== PAUSE TestAgent_SessionExec\n"}
-{"Time":"2023-03-29T13:59:30.440264139Z","Action":"pause","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec"}
-{"Time":"2023-03-29T13:59:30.44029211Z","Action":"run","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell"}
-{"Time":"2023-03-29T13:59:30.440307898Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"=== RUN   TestAgent_SessionTTYShell\n"}
-{"Time":"2023-03-29T13:59:30.440330948Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"=== PAUSE TestAgent_SessionTTYShell\n"}
-{"Time":"2023-03-29T13:59:30.440340646Z","Action":"pause","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell"}
-{"Time":"2023-03-29T13:59:30.440351592Z","Action":"run","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode"}
-{"Time":"2023-03-29T13:59:30.440360503Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"=== RUN   TestAgent_SessionTTYExitCode\n"}
-{"Time":"2023-03-29T13:59:30.440373253Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"=== PAUSE TestAgent_SessionTTYExitCode\n"}
-{"Time":"2023-03-29T13:59:30.440389091Z","Action":"pause","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode"}
-{"Time":"2023-03-29T13:59:30.440406592Z","Action":"run","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD"}
-{"Time":"2023-03-29T13:59:30.440417518Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"=== RUN   TestAgent_Session_TTY_MOTD\n"}
-{"Time":"2023-03-29T13:59:30.68885571Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.688 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:59:30.688902548Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.688 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:59:30.688936919Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.688 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:59:30.688952573Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.688 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:59:30.688978288Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.688 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:59:30.689138933Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:59:30.689169612Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:59:30.689278237Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:59:30.689311927Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:59:30.689422904Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:59:30.689462324Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:59:30.689635363Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:1ad81e5115245108\n"}
-{"Time":"2023-03-29T13:59:30.689668719Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:59:30.689762323Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:59:30.689824046Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:59:30.689876569Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:59:30.689906309Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:59:30.689964141Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:59:30.690006177Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:59:30.690054052Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:59:30.690100827Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:59:30.690166644Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:59:30.690333879Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:59:30.69067189Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:59:30.690716053Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:59:30.690874768Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:59:30.690920653Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
-{"Time":"2023-03-29T13:59:30.691236077Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 55526, \"DERPPort\": 33325, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"/tmp/TestAgent_Session_TTY_MOTD2921078/001/motd\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
-{"Time":"2023-03-29T13:59:30.691266926Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
-{"Time":"2023-03-29T13:59:30.691645376Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:59:30.691681569Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:59:30.691697309Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:59:30.691834882Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:59:30.691894444Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:59:30.691990111Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:59:30.692037682Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:59:30.692117014Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:59:30.69217036Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:59:30.692223588Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:59:30.692269654Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:59:30.692436067Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:19af0f91ddbc2673\n"}
-{"Time":"2023-03-29T13:59:30.692486153Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:59:30.692600638Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:59:30.692643998Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:59:30.692706838Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:59:30.692750609Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:59:30.692799088Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:59:30.692845724Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:59:30.692892868Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:59:30.692943768Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:59:30.692994617Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:59:30.693130711Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.693 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:59:30.693421144Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.693 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:59:30.693467015Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.693 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:59:30.693571784Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.693 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
-{"Time":"2023-03-29T13:59:30.693599238Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.693 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
-{"Time":"2023-03-29T13:59:30.693798141Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.693 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.693596Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:59:30.699379222Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.699 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:59:30.702070777Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.701 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:59:30.702521256Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.702 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:59:30.705825444Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.705 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.690745Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:59:30.705969348Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.705 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:59:30.706047452Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.705 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:59:30.706117981Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.706 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:59:30.706167259Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.706 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:59:30.70672858Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.706 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:59:30.707193213Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.707 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:59:30.707713648Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.707 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:59:30.711327936Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.693596Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:59:30.711351236Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:59:30.711484437Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\n"}
-{"Time":"2023-03-29T13:59:30.711757724Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:59:30.711895059Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:59:30.712001206Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:59:30.712012787Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:59:30.712044402Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.712 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:59:30.712080254Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.712 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:59:30.712196969Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.712 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:59:30.712224408Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.712 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:59:30.712251498Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.712 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:59:30.713321731Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.690745Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:59:30.713345626Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:59:30.713438727Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
-{"Time":"2023-03-29T13:59:30.713542134Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:59:30.713653049Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:59:30.713794466Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:59:30.713831747Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:59:30.713873796Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:59:30.71391978Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:59:30.713976575Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:59:30.71401037Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:59:30.714059091Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.714 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:59:30.762911536Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.762 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:40423 derp=1 derpdist=1v4:2ms\n"}
-{"Time":"2023-03-29T13:59:30.763010472Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.762 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:59:30.763604178Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.763 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:40423 (stun), 172.20.0.2:40423 (local)\n"}
-{"Time":"2023-03-29T13:59:30.764002966Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.763 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:59:30.76358648 +0000 UTC m=+0.341643633 Peers:[] LocalAddrs:[{Addr:127.0.0.1:40423 Type:stun} {Addr:172.20.0.2:40423 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:59:30.764243833Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.764 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:51077 derp=1 derpdist=1v4:1ms\n"}
-{"Time":"2023-03-29T13:59:30.764368314Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.764 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:59:30.764813395Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.764 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:51077 (stun), 172.20.0.2:51077 (local)\n"}
-{"Time":"2023-03-29T13:59:30.765032404Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.764 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:59:30.764800711 +0000 UTC m=+0.342857833 Peers:[] LocalAddrs:[{Addr:127.0.0.1:51077 Type:stun} {Addr:172.20.0.2:51077 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:59:30.766066288Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.765 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:59:30.766178166Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.766 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:59:30.766459711Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.766 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:59:30.766177132 +0000 UTC m=+0.344234254 Peers:[] LocalAddrs:[{Addr:127.0.0.1:40423 Type:stun} {Addr:172.20.0.2:40423 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:59:30.766803271Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.766 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.001851767}}}\n"}
-{"Time":"2023-03-29T13:59:30.767031778Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.766 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.763989Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": [\"127.0.0.1:40423\", \"172.20.0.2:40423\"]}}\n"}
-{"Time":"2023-03-29T13:59:30.767745656Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.767 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.763989Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": [\"127.0.0.1:40423\", \"172.20.0.2:40423\"]}}\n"}
-{"Time":"2023-03-29T13:59:30.767803589Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.767 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:59:30.7681905Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.767 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:59:30.769269486Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.769 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:59:30.769423531Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.769 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:59:30.76964587Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.769 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:59:30.76985461Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.769 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.001439212}}}\n"}
-{"Time":"2023-03-29T13:59:30.770057617Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.769 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.765018Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:51077\", \"172.20.0.2:51077\"]}}\n"}
-{"Time":"2023-03-29T13:59:30.770543054Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.770 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.765018Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:51077\", \"172.20.0.2:51077\"]}}\n"}
-{"Time":"2023-03-29T13:59:30.770576926Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.770 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:59:30.770805865Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.770 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:59:30.771214469Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.771 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:59:30.771672983Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.771 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.77151Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.001851767}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": [\"127.0.0.1:40423\", \"172.20.0.2:40423\"]}}\n"}
-{"Time":"2023-03-29T13:59:30.77196162Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.771 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.77151Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.001851767}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": [\"127.0.0.1:40423\", \"172.20.0.2:40423\"]}}\n"}
-{"Time":"2023-03-29T13:59:30.772249568Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:59:30.772286673Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:59:30.772417712Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:59:30.772485685Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:59:30.772763889Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:59:30.772990304Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:59:30.772846286 +0000 UTC m=+0.350903351 Peers:[] LocalAddrs:[{Addr:127.0.0.1:51077 Type:stun} {Addr:172.20.0.2:51077 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:59:30.77305219Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.772974Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.001439212}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:51077\", \"172.20.0.2:51077\"]}}\n"}
-{"Time":"2023-03-29T13:59:30.773283722Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.773 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.772974Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.001439212}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:51077\", \"172.20.0.2:51077\"]}}\n"}
-{"Time":"2023-03-29T13:59:30.773486653Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.773 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:59:30.773528203Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.773 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:59:30.773629095Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.773 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:59:30.773696573Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.773 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:59:30.781245292Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.781 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:59:30.781769525Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.781 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:59:30.821304727Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.821 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:51077 derp=1 derpdist=1v4:4ms\n"}
-{"Time":"2023-03-29T13:59:30.823014931Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.822 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:40423 derp=1 derpdist=1v4:1ms\n"}
-{"Time":"2023-03-29T13:59:30.842118323Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.842 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [tUb7c]  ...\n"}
-{"Time":"2023-03-29T13:59:30.842325421Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.842 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [tUb7c] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:59:30.842743216Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.842 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [s78jr] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:59:30.842835058Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.842 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [tUb7c] d:19af0f91ddbc2673 now using 172.20.0.2:51077\n"}
-{"Time":"2023-03-29T13:59:30.842945452Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.842 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [tUb7c]  ...\n"}
-{"Time":"2023-03-29T13:59:30.843017307Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.842 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [tUb7c]  ...\n"}
-{"Time":"2023-03-29T13:59:30.843455848Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:59:30.843724102Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:59:30.843761613Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:59:30.843824129Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:59:30.843866119Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:59:30.843967657Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:59:30.843978436Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - Starting\n"}
-{"Time":"2023-03-29T13:59:30.844024904Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - Sending handshake initiation\n"}
-{"Time":"2023-03-29T13:59:30.844361886Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [s78jr] now active, reconfiguring WireGuard\n"}
-{"Time":"2023-03-29T13:59:30.84441357Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:59:30.844612597Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:59:30.844652368Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:59:30.844692139Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:59:30.844742198Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:59:30.844790446Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:59:30.844839046Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - Starting\n"}
-{"Time":"2023-03-29T13:59:30.845054904Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - Received handshake initiation\n"}
-{"Time":"2023-03-29T13:59:30.845091562Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.845 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - Sending handshake response\n"}
-{"Time":"2023-03-29T13:59:30.845575288Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.845 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:59:30.845411293 +0000 UTC m=+0.423468375 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359}] LocalAddrs:[{Addr:127.0.0.1:51077 Type:stun} {Addr:172.20.0.2:51077 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:59:30.846073274Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.846 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - Received handshake response\n"}
-{"Time":"2023-03-29T13:59:30.846152172Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.846 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [s78jr] d:1ad81e5115245108 now using 172.20.0.2:40423\n"}
-{"Time":"2023-03-29T13:59:30.846323335Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.846 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:59:30.846216257 +0000 UTC m=+0.424273332 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:59:30.846070709 +0000 UTC NodeKey:nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b}] LocalAddrs:[{Addr:127.0.0.1:40423 Type:stun} {Addr:172.20.0.2:40423 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:59:30.846820565Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.846 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [tUb7c] d:19af0f91ddbc2673 now using 127.0.0.1:51077\n"}
-{"Time":"2023-03-29T13:59:30.872225511Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    agent_test.go:298: 2023-03-29 13:59:30.872: cmd: stdin: \"exit 0\\r\"\n"}
-{"Time":"2023-03-29T13:59:30.872911108Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.872 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:51077 derp=1 derpdist=1v4:1ms\n"}
-{"Time":"2023-03-29T13:59:30.873619058Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.873 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.000537347}}}\n"}
-{"Time":"2023-03-29T13:59:30.873901772Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.873 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.873622Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000537347}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:51077\", \"172.20.0.2:51077\"]}}\n"}
-{"Time":"2023-03-29T13:59:30.874560964Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.874 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:40423 derp=1 derpdist=1v4:0s\n"}
-{"Time":"2023-03-29T13:59:30.875202519Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.874 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.873622Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000537347}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:51077\", \"172.20.0.2:51077\"]}}\n"}
-{"Time":"2023-03-29T13:59:30.875651396Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.875 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.0001832}}}\n"}
-{"Time":"2023-03-29T13:59:30.875737105Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.875 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.875642Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.0001832}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": [\"127.0.0.1:40423\", \"172.20.0.2:40423\"]}}\n"}
-{"Time":"2023-03-29T13:59:30.876040926Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.875 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.875642Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.0001832}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": [\"127.0.0.1:40423\", \"172.20.0.2:40423\"]}}\n"}
-{"Time":"2023-03-29T13:59:30.876278217Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:59:30.8763513Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:59:30.87651371Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:59:30.876622881Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:59:30.876654135Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - Sending keepalive packet\n"}
-{"Time":"2023-03-29T13:59:30.876695566Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:59:30.876878296Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:59:30.876944605Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:59:30.877050858Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:59:30.877194231Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.877 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:59:30.877218701Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.877 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - Sending keepalive packet\n"}
-{"Time":"2023-03-29T13:59:30.877269173Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.877 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:59:30.877353148Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:121: 2023-03-29 13:59:30.877: cmd: \"exit 0\"\n"}
-{"Time":"2023-03-29T13:59:30.877482007Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.877 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - Receiving keepalive packet\n"}
-{"Time":"2023-03-29T13:59:30.877522599Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.877 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - Receiving keepalive packet\n"}
-{"Time":"2023-03-29T13:59:31.212200169Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:31.212 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8): sending disco ping to [s78jr]  ...\n"}
-{"Time":"2023-03-29T13:59:31.711519305Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:31.711 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8): sending disco ping to [s78jr]  ...\n"}
-{"Time":"2023-03-29T13:59:32.2114982Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.211 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8): sending disco ping to [s78jr]  ...\n"}
-{"Time":"2023-03-29T13:59:32.277108499Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:83: 2023-03-29 13:59:32.277: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:59:32.277144197Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:74: 2023-03-29 13:59:32.277: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:59:32.277157734Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:110: 2023-03-29 13:59:32.277: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:59:32.277164721Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:111: 2023-03-29 13:59:32.277: cmd: closing out\n"}
-{"Time":"2023-03-29T13:59:32.2771729Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:113: 2023-03-29 13:59:32.277: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:59:32.277306699Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:76: 2023-03-29 13:59:32.277: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:59:32.277350733Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:74: 2023-03-29 13:59:32.277: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:59:32.277374575Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:76: 2023-03-29 13:59:32.277: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:59:32.277394938Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:74: 2023-03-29 13:59:32.277: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:59:32.277415507Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:76: 2023-03-29 13:59:32.277: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:59:32.277434743Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:102: 2023-03-29 13:59:32.277: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:59:32.277579778Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
-{"Time":"2023-03-29T13:59:32.277611563Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 2s\n"}
-{"Time":"2023-03-29T13:59:32.277638668Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:59:32.277693383Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:59:32.277732009Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:59:32.277947928Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:59:32.277973674Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:59:32.278017899Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:59:32.278057207Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - Stopping\n"}
-{"Time":"2023-03-29T13:59:32.278134475Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:59:32.278241902Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:59:32.278284628Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
-{"Time":"2023-03-29T13:59:32.278337186Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
-{"Time":"2023-03-29T13:59:32.27868397Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 2s\n"}
-{"Time":"2023-03-29T13:59:32.278698095Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:59:32.278769886Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:59:32.278808018Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:59:32.278879735Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:59:32.278965521Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8): sending disco ping to [s78jr]  ...\n"}
-{"Time":"2023-03-29T13:59:32.279089367Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.279 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:59:32.279122263Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.279 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:59:32.279168949Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.279 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - Stopping\n"}
-{"Time":"2023-03-29T13:59:32.279275932Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.279 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:59:32.279696417Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    stuntest.go:63: STUN server shutdown\n"}
-{"Time":"2023-03-29T13:59:32.279872392Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"--- PASS: TestAgent_Session_TTY_MOTD (1.84s)\n"}
-{"Time":"2023-03-29T13:59:32.279886475Z","Action":"pass","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Elapsed":1.84}
-{"Time":"2023-03-29T13:59:32.27989796Z","Action":"run","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin"}
-{"Time":"2023-03-29T13:59:32.279902938Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"=== RUN   TestAgent_Session_TTY_Hushlogin\n"}
-{"Time":"2023-03-29T13:59:32.457943185Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"panic: test timed out after 2s\n"}
-{"Time":"2023-03-29T13:59:32.45796911Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"running tests:\n"}
-{"Time":"2023-03-29T13:59:32.457977422Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\tTestAgent_Session_TTY_Hushlogin (0s)\n"}
-{"Time":"2023-03-29T13:59:32.457982677Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
-{"Time":"2023-03-29T13:59:32.457987323Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 411 [running]:\n"}
-{"Time":"2023-03-29T13:59:32.457991361Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.(*M).startAlarm.func1()\n"}
-{"Time":"2023-03-29T13:59:32.457995716Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:2241 +0x3b9\n"}
-{"Time":"2023-03-29T13:59:32.4580029Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by time.goFunc\n"}
-{"Time":"2023-03-29T13:59:32.458007365Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/time/sleep.go:176 +0x32\n"}
-{"Time":"2023-03-29T13:59:32.45801203Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
-{"Time":"2023-03-29T13:59:32.45801607Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 1 [chan receive]:\n"}
-{"Time":"2023-03-29T13:59:32.458020121Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.(*T).Run(0xc0004e1040, {0x16a5e92?, 0x535fa5?}, 0x17462c0)\n"}
-{"Time":"2023-03-29T13:59:32.458024235Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1630 +0x405\n"}
-{"Time":"2023-03-29T13:59:32.458028654Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.runTests.func1(0x236db60?)\n"}
-{"Time":"2023-03-29T13:59:32.45803313Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:2036 +0x45\n"}
-{"Time":"2023-03-29T13:59:32.458037122Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.tRunner(0xc0004e1040, 0xc000589bb8)\n"}
-{"Time":"2023-03-29T13:59:32.458041079Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1576 +0x10b\n"}
-{"Time":"2023-03-29T13:59:32.45804729Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.runTests(0xc000341a40?, {0x235c580, 0x21, 0x21}, {0x4182d0?, 0xc000589c78?, 0x236cb40?})\n"}
-{"Time":"2023-03-29T13:59:32.458051787Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:2034 +0x489\n"}
-{"Time":"2023-03-29T13:59:32.458055836Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.(*M).Run(0xc000341a40)\n"}
-{"Time":"2023-03-29T13:59:32.458059703Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1906 +0x63a\n"}
-{"Time":"2023-03-29T13:59:32.458066931Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"go.uber.org/goleak.VerifyTestMain({0x18f5540?, 0xc000341a40?}, {0x0, 0x0, 0x0})\n"}
-{"Time":"2023-03-29T13:59:32.458071333Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/.local/go/pkg/mod/go.uber.org/goleak@v1.2.1/testmain.go:53 +0x6b\n"}
-{"Time":"2023-03-29T13:59:32.458075235Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/agent_test.TestMain(...)\n"}
-{"Time":"2023-03-29T13:59:32.458081052Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:53\n"}
-{"Time":"2023-03-29T13:59:32.45808506Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"main.main()\n"}
-{"Time":"2023-03-29T13:59:32.458088903Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t_testmain.go:115 +0x1e5\n"}
-{"Time":"2023-03-29T13:59:32.458094468Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
-{"Time":"2023-03-29T13:59:32.458102106Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 9 [chan receive]:\n"}
-{"Time":"2023-03-29T13:59:32.45810621Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.(*T).Parallel(0xc0004e11e0)\n"}
-{"Time":"2023-03-29T13:59:32.45811231Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1384 +0x225\n"}
-{"Time":"2023-03-29T13:59:32.458116485Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/agent_test.TestAgent_SessionExec(0x0?)\n"}
-{"Time":"2023-03-29T13:59:32.458120426Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:188 +0x33\n"}
-{"Time":"2023-03-29T13:59:32.458126141Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.tRunner(0xc0004e11e0, 0x1746298)\n"}
-{"Time":"2023-03-29T13:59:32.458130428Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1576 +0x10b\n"}
-{"Time":"2023-03-29T13:59:32.458135189Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by testing.(*T).Run\n"}
-{"Time":"2023-03-29T13:59:32.458144082Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n"}
-{"Time":"2023-03-29T13:59:32.458150718Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
-{"Time":"2023-03-29T13:59:32.458156738Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 10 [chan receive]:\n"}
-{"Time":"2023-03-29T13:59:32.458165162Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.(*T).Parallel(0xc0004e1520)\n"}
-{"Time":"2023-03-29T13:59:32.458171886Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1384 +0x225\n"}
-{"Time":"2023-03-29T13:59:32.458178556Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/agent_test.TestAgent_SessionTTYShell(0xc0004e1520)\n"}
-{"Time":"2023-03-29T13:59:32.458182782Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:213 +0x36\n"}
-{"Time":"2023-03-29T13:59:32.458188646Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.tRunner(0xc0004e1520, 0x17462a8)\n"}
-{"Time":"2023-03-29T13:59:32.458192664Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1576 +0x10b\n"}
-{"Time":"2023-03-29T13:59:32.458196426Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by testing.(*T).Run\n"}
-{"Time":"2023-03-29T13:59:32.458200247Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n"}
-{"Time":"2023-03-29T13:59:32.458204698Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
-{"Time":"2023-03-29T13:59:32.458208395Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 11 [chan receive]:\n"}
-{"Time":"2023-03-29T13:59:32.458215562Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.(*T).Parallel(0xc0004e1860)\n"}
-{"Time":"2023-03-29T13:59:32.458219487Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1384 +0x225\n"}
-{"Time":"2023-03-29T13:59:32.458223369Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/agent_test.TestAgent_SessionTTYExitCode(0xc0004e1520?)\n"}
-{"Time":"2023-03-29T13:59:32.458228633Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:244 +0x36\n"}
-{"Time":"2023-03-29T13:59:32.458234377Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.tRunner(0xc0004e1860, 0x17462a0)\n"}
-{"Time":"2023-03-29T13:59:32.458238258Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1576 +0x10b\n"}
-{"Time":"2023-03-29T13:59:32.458242179Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by testing.(*T).Run\n"}
-{"Time":"2023-03-29T13:59:32.458246008Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n"}
-{"Time":"2023-03-29T13:59:32.458249635Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
-{"Time":"2023-03-29T13:59:32.45825516Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 408 [runnable]:\n"}
-{"Time":"2023-03-29T13:59:32.458282465Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"math/big.nat.montgomery({0xc004aa4500?, 0x10?, 0x26?}, {0xc004aa4280?, 0x10?, 0x26?}, {0xc004aa4280?, 0x10?, 0x26?}, {0xc000732820, ...}, ...)\n"}
-{"Time":"2023-03-29T13:59:32.458291741Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/math/big/nat.go:216 +0x565\n"}
-{"Time":"2023-03-29T13:59:32.458330298Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"math/big.nat.expNNMontgomery({0xc004aa4280, 0xc0003c2e70?, 0x26}, {0xc004a9adc0?, 0x21?, 0x24?}, {0xc004a9ac80, 0x10, 0x24?}, {0xc000732820, ...})\n"}
-{"Time":"2023-03-29T13:59:32.458336764Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/math/big/nat.go:1271 +0xb1c\n"}
-{"Time":"2023-03-29T13:59:32.458384114Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"math/big.nat.expNN({0xc004aa4280?, 0x14?, 0x22c2900?}, {0xc004a9adc0?, 0x10, 0x14}, {0xc004a9ac80?, 0x10, 0x14?}, {0xc000732820, ...}, ...)\n"}
-{"Time":"2023-03-29T13:59:32.458393699Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/math/big/nat.go:996 +0x3b1\n"}
-{"Time":"2023-03-29T13:59:32.458403406Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"math/big.nat.probablyPrimeMillerRabin({0xc000732820?, 0x10, 0x14}, 0x15, 0x1)\n"}
-{"Time":"2023-03-29T13:59:32.458413208Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/math/big/prime.go:106 +0x5b8\n"}
-{"Time":"2023-03-29T13:59:32.458420936Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"math/big.(*Int).ProbablyPrime(0xc0047208c0, 0x14)\n"}
-{"Time":"2023-03-29T13:59:32.458424869Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/math/big/prime.go:78 +0x225\n"}
-{"Time":"2023-03-29T13:59:32.458430384Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"crypto/rand.Prime({0x18f04c0, 0xc00007e020}, 0x400)\n"}
-{"Time":"2023-03-29T13:59:32.45843919Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/crypto/rand/util.go:55 +0x1e5\n"}
-{"Time":"2023-03-29T13:59:32.45845888Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"crypto/rsa.GenerateMultiPrimeKey({0x18f04c0, 0xc00007e020}, 0x2, 0x800)\n"}
-{"Time":"2023-03-29T13:59:32.458469074Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/crypto/rsa/rsa.go:369 +0x745\n"}
-{"Time":"2023-03-29T13:59:32.458474102Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"crypto/rsa.GenerateKey(...)\n"}
-{"Time":"2023-03-29T13:59:32.45847985Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/crypto/rsa/rsa.go:264\n"}
-{"Time":"2023-03-29T13:59:32.458483767Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/agent.(*agent).init(0xc00485eea0, {0x1902c20?, 0xc00485d770})\n"}
-{"Time":"2023-03-29T13:59:32.458489397Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent.go:810 +0x6c\n"}
-{"Time":"2023-03-29T13:59:32.458522193Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/agent.New({{0x190cbc0, 0xc0005b7710}, {0x166d829, 0x4}, {0x166d829, 0x4}, 0x17461d8, {0x1907c90, 0xc000278280}, 0x45d964b800, ...})\n"}
-{"Time":"2023-03-29T13:59:32.458531042Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent.go:134 +0x549\n"}
-{"Time":"2023-03-29T13:59:32.458565925Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/agent_test.setupAgent(0xc00485eb60, {0x0, {0x0, 0x0}, {0x0, 0x0, 0x0}, 0xc0005b8da0, 0x0, {0x0, ...}, ...}, ...)\n"}
-{"Time":"2023-03-29T13:59:32.458576217Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:1568 +0x63e\n"}
-{"Time":"2023-03-29T13:59:32.458605192Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/agent_test.setupSSHSession(0xc00485eb60, {0x0, {0x0, 0x0}, {0x0, 0x0, 0x0}, 0x0, 0x0, {0x0, ...}, ...})\n"}
-{"Time":"2023-03-29T13:59:32.458614801Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:1524 +0xc5\n"}
-{"Time":"2023-03-29T13:59:32.458625161Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/agent_test.TestAgent_Session_TTY_Hushlogin(0xc00485eb60)\n"}
-{"Time":"2023-03-29T13:59:32.458630015Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:330 +0x2fa\n"}
-{"Time":"2023-03-29T13:59:32.458635887Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.tRunner(0xc00485eb60, 0x17462c0)\n"}
-{"Time":"2023-03-29T13:59:32.458639744Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1576 +0x10b\n"}
-{"Time":"2023-03-29T13:59:32.458643595Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by testing.(*T).Run\n"}
-{"Time":"2023-03-29T13:59:32.458649393Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n"}
-{"Time":"2023-03-29T13:59:32.458653156Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
-{"Time":"2023-03-29T13:59:32.458657314Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 409 [IO wait]:\n"}
-{"Time":"2023-03-29T13:59:32.458662763Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.runtime_pollWait(0x7f5230766628, 0x72)\n"}
-{"Time":"2023-03-29T13:59:32.458668522Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/runtime/netpoll.go:306 +0x89\n"}
-{"Time":"2023-03-29T13:59:32.45867585Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.(*pollDesc).wait(0xc00475bf80?, 0xc0005ec5e2?, 0x0)\n"}
-{"Time":"2023-03-29T13:59:32.458681918Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32\n"}
-{"Time":"2023-03-29T13:59:32.458688307Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.(*pollDesc).waitRead(...)\n"}
-{"Time":"2023-03-29T13:59:32.458708219Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:89\n"}
-{"Time":"2023-03-29T13:59:32.458712856Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.(*FD).Accept(0xc00475bf80)\n"}
-{"Time":"2023-03-29T13:59:32.458717364Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/internal/poll/fd_unix.go:614 +0x2bd\n"}
-{"Time":"2023-03-29T13:59:32.458721204Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*netFD).accept(0xc00475bf80)\n"}
-{"Time":"2023-03-29T13:59:32.458727021Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/fd_unix.go:172 +0x35\n"}
-{"Time":"2023-03-29T13:59:32.458731155Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*TCPListener).accept(0xc00486ecd8)\n"}
-{"Time":"2023-03-29T13:59:32.458737943Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/tcpsock_posix.go:148 +0x25\n"}
-{"Time":"2023-03-29T13:59:32.458744974Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*TCPListener).Accept(0xc00486ecd8)\n"}
-{"Time":"2023-03-29T13:59:32.458752245Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/tcpsock.go:297 +0x3d\n"}
-{"Time":"2023-03-29T13:59:32.458758039Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"crypto/tls.(*listener).Accept(0xc00486ef18)\n"}
-{"Time":"2023-03-29T13:59:32.458763674Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/crypto/tls/tls.go:66 +0x2d\n"}
-{"Time":"2023-03-29T13:59:32.458770104Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net/http.(*Server).Serve(0xc00029da40, {0x18fefa0, 0xc00486ef18})\n"}
-{"Time":"2023-03-29T13:59:32.458778229Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/http/server.go:3059 +0x385\n"}
-{"Time":"2023-03-29T13:59:32.45878539Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net/http/httptest.(*Server).goServe.func1()\n"}
-{"Time":"2023-03-29T13:59:32.458793477Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/http/httptest/server.go:310 +0x6a\n"}
-{"Time":"2023-03-29T13:59:32.458797511Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by net/http/httptest.(*Server).goServe\n"}
-{"Time":"2023-03-29T13:59:32.458801374Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/http/httptest/server.go:308 +0x6a\n"}
-{"Time":"2023-03-29T13:59:32.458805093Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
-{"Time":"2023-03-29T13:59:32.458810472Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 410 [IO wait]:\n"}
-{"Time":"2023-03-29T13:59:32.458814744Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.runtime_pollWait(0x7f5230765908, 0x72)\n"}
-{"Time":"2023-03-29T13:59:32.458819038Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/runtime/netpoll.go:306 +0x89\n"}
-{"Time":"2023-03-29T13:59:32.458824589Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.(*pollDesc).wait(0xc00043a300?, 0xc004880000?, 0x0)\n"}
-{"Time":"2023-03-29T13:59:32.458830327Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32\n"}
-{"Time":"2023-03-29T13:59:32.458835463Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.(*pollDesc).waitRead(...)\n"}
-{"Time":"2023-03-29T13:59:32.458840944Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:89\n"}
-{"Time":"2023-03-29T13:59:32.458850643Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.(*FD).ReadFromInet4(0xc00043a300, {0xc004880000, 0x10000, 0x10000}, 0x0?)\n"}
-{"Time":"2023-03-29T13:59:32.458859626Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/internal/poll/fd_unix.go:250 +0x24f\n"}
-{"Time":"2023-03-29T13:59:32.458872383Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*netFD).readFromInet4(0xc00043a300, {0xc004880000?, 0x0?, 0x0?}, 0x0?)\n"}
-{"Time":"2023-03-29T13:59:32.458879419Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/fd_posix.go:66 +0x29\n"}
-{"Time":"2023-03-29T13:59:32.458901901Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*UDPConn).readFrom(0x30?, {0xc004880000?, 0xc0005b7770?, 0x0?}, 0xc0005b7770)\n"}
-{"Time":"2023-03-29T13:59:32.458908829Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/udpsock_posix.go:52 +0x1b8\n"}
-{"Time":"2023-03-29T13:59:32.458922969Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*UDPConn).readFromUDP(0xc000015a08, {0xc004880000?, 0x4102c7?, 0x10000?}, 0x13e45e0?)\n"}
-{"Time":"2023-03-29T13:59:32.458928418Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/udpsock.go:149 +0x31\n"}
-{"Time":"2023-03-29T13:59:32.458942888Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*UDPConn).ReadFrom(0x59a?, {0xc004880000, 0x10000, 0x10000})\n"}
-{"Time":"2023-03-29T13:59:32.45894865Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/udpsock.go:158 +0x50\n"}
-{"Time":"2023-03-29T13:59:32.458972992Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"tailscale.com/net/stun/stuntest.runSTUN({0x1911ec0, 0xc00485eb60}, {0x1907f60, 0xc000015a08}, 0xc00481baa0, 0x17462c0?)\n"}
-{"Time":"2023-03-29T13:59:32.458979652Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/.local/go/pkg/mod/github.com/coder/tailscale@v1.1.1-0.20230327205451-058fa46a3723/net/stun/stuntest/stuntest.go:59 +0xc6\n"}
-{"Time":"2023-03-29T13:59:32.458988938Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by tailscale.com/net/stun/stuntest.ServeWithPacketListener\n"}
-{"Time":"2023-03-29T13:59:32.458996325Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/.local/go/pkg/mod/github.com/coder/tailscale@v1.1.1-0.20230327205451-058fa46a3723/net/stun/stuntest/stuntest.go:47 +0x26a\n"}
-{"Time":"2023-03-29T13:59:32.464073774Z","Action":"output","Package":"github.com/coder/coder/agent","Output":"FAIL\tgithub.com/coder/coder/agent\t2.045s\n"}
-{"Time":"2023-03-29T13:59:32.464093085Z","Action":"fail","Package":"github.com/coder/coder/agent","Elapsed":2.045}
+{"Time":"2023-03-29T13:59:30.419140864Z","Action":"start","Package":"github.com/coder/coder/v2/agent"}
+{"Time":"2023-03-29T13:59:30.440137227Z","Action":"run","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec"}
+{"Time":"2023-03-29T13:59:30.440225617Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"=== RUN   TestAgent_SessionExec\n"}
+{"Time":"2023-03-29T13:59:30.440252351Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"=== PAUSE TestAgent_SessionExec\n"}
+{"Time":"2023-03-29T13:59:30.440264139Z","Action":"pause","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec"}
+{"Time":"2023-03-29T13:59:30.44029211Z","Action":"run","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell"}
+{"Time":"2023-03-29T13:59:30.440307898Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"=== RUN   TestAgent_SessionTTYShell\n"}
+{"Time":"2023-03-29T13:59:30.440330948Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"=== PAUSE TestAgent_SessionTTYShell\n"}
+{"Time":"2023-03-29T13:59:30.440340646Z","Action":"pause","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell"}
+{"Time":"2023-03-29T13:59:30.440351592Z","Action":"run","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode"}
+{"Time":"2023-03-29T13:59:30.440360503Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"=== RUN   TestAgent_SessionTTYExitCode\n"}
+{"Time":"2023-03-29T13:59:30.440373253Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"=== PAUSE TestAgent_SessionTTYExitCode\n"}
+{"Time":"2023-03-29T13:59:30.440389091Z","Action":"pause","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode"}
+{"Time":"2023-03-29T13:59:30.440406592Z","Action":"run","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD"}
+{"Time":"2023-03-29T13:59:30.440417518Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"=== RUN   TestAgent_Session_TTY_MOTD\n"}
+{"Time":"2023-03-29T13:59:30.68885571Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.688 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:59:30.688902548Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.688 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:59:30.688936919Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.688 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:59:30.688952573Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.688 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:59:30.688978288Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.688 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:59:30.689138933Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:59:30.689169612Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:59:30.689278237Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:59:30.689311927Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:59:30.689422904Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:59:30.689462324Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:59:30.689635363Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:1ad81e5115245108\n"}
+{"Time":"2023-03-29T13:59:30.689668719Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:59:30.689762323Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:59:30.689824046Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:59:30.689876569Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:59:30.689906309Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:59:30.689964141Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:59:30.690006177Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:59:30.690054052Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.689 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:59:30.690100827Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:59:30.690166644Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:59:30.690333879Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:59:30.69067189Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:59:30.690716053Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:59:30.690874768Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:59:30.690920653Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
+{"Time":"2023-03-29T13:59:30.691236077Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.690 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 55526, \"DERPPort\": 33325, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"/tmp/TestAgent_Session_TTY_MOTD2921078/001/motd\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
+{"Time":"2023-03-29T13:59:30.691266926Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
+{"Time":"2023-03-29T13:59:30.691645376Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:59:30.691681569Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:59:30.691697309Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:59:30.691834882Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:59:30.691894444Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:59:30.691990111Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:59:30.692037682Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.691 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:59:30.692117014Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:59:30.69217036Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:59:30.692223588Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:59:30.692269654Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:59:30.692436067Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:19af0f91ddbc2673\n"}
+{"Time":"2023-03-29T13:59:30.692486153Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:59:30.692600638Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:59:30.692643998Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:59:30.692706838Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:59:30.692750609Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:59:30.692799088Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:59:30.692845724Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:59:30.692892868Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:59:30.692943768Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:59:30.692994617Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.692 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:59:30.693130711Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.693 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:59:30.693421144Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.693 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:59:30.693467015Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.693 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:59:30.693571784Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.693 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
+{"Time":"2023-03-29T13:59:30.693599238Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.693 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
+{"Time":"2023-03-29T13:59:30.693798141Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.693 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.693596Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:59:30.699379222Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.699 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:59:30.702070777Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.701 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:59:30.702521256Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.702 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:59:30.705825444Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.705 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.690745Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:59:30.705969348Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.705 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:59:30.706047452Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.705 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:59:30.706117981Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.706 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:59:30.706167259Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.706 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:59:30.70672858Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.706 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:59:30.707193213Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.707 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:59:30.707713648Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.707 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:59:30.711327936Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.693596Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:59:30.711351236Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:59:30.711484437Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\n"}
+{"Time":"2023-03-29T13:59:30.711757724Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:59:30.711895059Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:59:30.712001206Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:59:30.712012787Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.711 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:59:30.712044402Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.712 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:59:30.712080254Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.712 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:59:30.712196969Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.712 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:59:30.712224408Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.712 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:59:30.712251498Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.712 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:59:30.713321731Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.690745Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:59:30.713345626Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:59:30.713438727Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
+{"Time":"2023-03-29T13:59:30.713542134Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:59:30.713653049Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:59:30.713794466Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:59:30.713831747Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:59:30.713873796Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:59:30.71391978Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:59:30.713976575Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:59:30.71401037Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.713 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:59:30.714059091Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.714 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:59:30.762911536Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.762 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:40423 derp=1 derpdist=1v4:2ms\n"}
+{"Time":"2023-03-29T13:59:30.763010472Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.762 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:59:30.763604178Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.763 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:40423 (stun), 172.20.0.2:40423 (local)\n"}
+{"Time":"2023-03-29T13:59:30.764002966Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.763 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:59:30.76358648 +0000 UTC m=+0.341643633 Peers:[] LocalAddrs:[{Addr:127.0.0.1:40423 Type:stun} {Addr:172.20.0.2:40423 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:59:30.764243833Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.764 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:51077 derp=1 derpdist=1v4:1ms\n"}
+{"Time":"2023-03-29T13:59:30.764368314Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.764 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:59:30.764813395Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.764 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:51077 (stun), 172.20.0.2:51077 (local)\n"}
+{"Time":"2023-03-29T13:59:30.765032404Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.764 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:59:30.764800711 +0000 UTC m=+0.342857833 Peers:[] LocalAddrs:[{Addr:127.0.0.1:51077 Type:stun} {Addr:172.20.0.2:51077 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:59:30.766066288Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.765 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:59:30.766178166Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.766 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:59:30.766459711Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.766 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:59:30.766177132 +0000 UTC m=+0.344234254 Peers:[] LocalAddrs:[{Addr:127.0.0.1:40423 Type:stun} {Addr:172.20.0.2:40423 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:59:30.766803271Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.766 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.001851767}}}\n"}
+{"Time":"2023-03-29T13:59:30.767031778Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.766 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.763989Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": [\"127.0.0.1:40423\", \"172.20.0.2:40423\"]}}\n"}
+{"Time":"2023-03-29T13:59:30.767745656Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.767 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.763989Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": [\"127.0.0.1:40423\", \"172.20.0.2:40423\"]}}\n"}
+{"Time":"2023-03-29T13:59:30.767803589Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.767 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:59:30.7681905Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.767 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:59:30.769269486Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.769 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:59:30.769423531Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.769 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:59:30.76964587Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.769 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:59:30.76985461Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.769 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.001439212}}}\n"}
+{"Time":"2023-03-29T13:59:30.770057617Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.769 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.765018Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:51077\", \"172.20.0.2:51077\"]}}\n"}
+{"Time":"2023-03-29T13:59:30.770543054Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.770 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.765018Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:51077\", \"172.20.0.2:51077\"]}}\n"}
+{"Time":"2023-03-29T13:59:30.770576926Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.770 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:59:30.770805865Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.770 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:59:30.771214469Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.771 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:59:30.771672983Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.771 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.77151Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.001851767}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": [\"127.0.0.1:40423\", \"172.20.0.2:40423\"]}}\n"}
+{"Time":"2023-03-29T13:59:30.77196162Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.771 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.77151Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.001851767}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": [\"127.0.0.1:40423\", \"172.20.0.2:40423\"]}}\n"}
+{"Time":"2023-03-29T13:59:30.772249568Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:59:30.772286673Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:59:30.772417712Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:59:30.772485685Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:59:30.772763889Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:59:30.772990304Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:59:30.772846286 +0000 UTC m=+0.350903351 Peers:[] LocalAddrs:[{Addr:127.0.0.1:51077 Type:stun} {Addr:172.20.0.2:51077 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:59:30.77305219Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.772 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.772974Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.001439212}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:51077\", \"172.20.0.2:51077\"]}}\n"}
+{"Time":"2023-03-29T13:59:30.773283722Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.773 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.772974Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.001439212}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:51077\", \"172.20.0.2:51077\"]}}\n"}
+{"Time":"2023-03-29T13:59:30.773486653Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.773 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:59:30.773528203Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.773 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:59:30.773629095Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.773 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:59:30.773696573Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.773 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:59:30.781245292Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.781 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:59:30.781769525Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.781 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:59:30.821304727Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.821 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:51077 derp=1 derpdist=1v4:4ms\n"}
+{"Time":"2023-03-29T13:59:30.823014931Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.822 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:40423 derp=1 derpdist=1v4:1ms\n"}
+{"Time":"2023-03-29T13:59:30.842118323Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.842 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [tUb7c]  ...\n"}
+{"Time":"2023-03-29T13:59:30.842325421Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.842 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [tUb7c] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:59:30.842743216Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.842 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [s78jr] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:59:30.842835058Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.842 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [tUb7c] d:19af0f91ddbc2673 now using 172.20.0.2:51077\n"}
+{"Time":"2023-03-29T13:59:30.842945452Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.842 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [tUb7c]  ...\n"}
+{"Time":"2023-03-29T13:59:30.843017307Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.842 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [tUb7c]  ...\n"}
+{"Time":"2023-03-29T13:59:30.843455848Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:59:30.843724102Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:59:30.843761613Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:59:30.843824129Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:59:30.843866119Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:59:30.843967657Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:59:30.843978436Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - Starting\n"}
+{"Time":"2023-03-29T13:59:30.844024904Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.843 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - Sending handshake initiation\n"}
+{"Time":"2023-03-29T13:59:30.844361886Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [s78jr] now active, reconfiguring WireGuard\n"}
+{"Time":"2023-03-29T13:59:30.84441357Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:59:30.844612597Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:59:30.844652368Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:59:30.844692139Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:59:30.844742198Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:59:30.844790446Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:59:30.844839046Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - Starting\n"}
+{"Time":"2023-03-29T13:59:30.845054904Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.844 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - Received handshake initiation\n"}
+{"Time":"2023-03-29T13:59:30.845091562Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.845 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - Sending handshake response\n"}
+{"Time":"2023-03-29T13:59:30.845575288Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.845 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:59:30.845411293 +0000 UTC m=+0.423468375 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359}] LocalAddrs:[{Addr:127.0.0.1:51077 Type:stun} {Addr:172.20.0.2:51077 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:59:30.846073274Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.846 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - Received handshake response\n"}
+{"Time":"2023-03-29T13:59:30.846152172Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.846 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [s78jr] d:1ad81e5115245108 now using 172.20.0.2:40423\n"}
+{"Time":"2023-03-29T13:59:30.846323335Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.846 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:59:30.846216257 +0000 UTC m=+0.424273332 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:59:30.846070709 +0000 UTC NodeKey:nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b}] LocalAddrs:[{Addr:127.0.0.1:40423 Type:stun} {Addr:172.20.0.2:40423 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:59:30.846820565Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.846 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [tUb7c] d:19af0f91ddbc2673 now using 127.0.0.1:51077\n"}
+{"Time":"2023-03-29T13:59:30.872225511Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    agent_test.go:298: 2023-03-29 13:59:30.872: cmd: stdin: \"exit 0\\r\"\n"}
+{"Time":"2023-03-29T13:59:30.872911108Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.872 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:51077 derp=1 derpdist=1v4:1ms\n"}
+{"Time":"2023-03-29T13:59:30.873619058Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.873 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.000537347}}}\n"}
+{"Time":"2023-03-29T13:59:30.873901772Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.873 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.873622Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000537347}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:51077\", \"172.20.0.2:51077\"]}}\n"}
+{"Time":"2023-03-29T13:59:30.874560964Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.874 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:40423 derp=1 derpdist=1v4:0s\n"}
+{"Time":"2023-03-29T13:59:30.875202519Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.874 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 7662552826698250063, \"as_of\": \"2023-03-29T13:59:30.873622Z\", \"key\": \"nodekey:b546fb7238fa44f6eb2eca16d2f6bc594b0fddda4dec86205f89af643b13b37b\", \"disco\": \"discokey:19af0f91ddbc267311e247d5dcefbf2c73a92431c7efac1902ced549bc2fd71c\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000537347}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:51077\", \"172.20.0.2:51077\"]}}\n"}
+{"Time":"2023-03-29T13:59:30.875651396Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.875 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.0001832}}}\n"}
+{"Time":"2023-03-29T13:59:30.875737105Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.875 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.875642Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.0001832}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": [\"127.0.0.1:40423\", \"172.20.0.2:40423\"]}}\n"}
+{"Time":"2023-03-29T13:59:30.876040926Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.875 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 3088035564585519863, \"as_of\": \"2023-03-29T13:59:30.875642Z\", \"key\": \"nodekey:b3bf23adfe2e0f25fd088299b4fedb0da1a938fc36d2c925b85332f4cf681359\", \"disco\": \"discokey:1ad81e511524510849b5f4d4d0c86a4ff083af67002259e793939de53bc1c421\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.0001832}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8/128\"], \"endpoints\": [\"127.0.0.1:40423\", \"172.20.0.2:40423\"]}}\n"}
+{"Time":"2023-03-29T13:59:30.876278217Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:59:30.8763513Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:59:30.87651371Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:59:30.876622881Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:59:30.876654135Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - Sending keepalive packet\n"}
+{"Time":"2023-03-29T13:59:30.876695566Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:59:30.876878296Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:59:30.876944605Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:59:30.877050858Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.876 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:59:30.877194231Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.877 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:59:30.877218701Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.877 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - Sending keepalive packet\n"}
+{"Time":"2023-03-29T13:59:30.877269173Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.877 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:59:30.877353148Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:121: 2023-03-29 13:59:30.877: cmd: \"exit 0\"\n"}
+{"Time":"2023-03-29T13:59:30.877482007Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.877 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - Receiving keepalive packet\n"}
+{"Time":"2023-03-29T13:59:30.877522599Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:30.877 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - Receiving keepalive packet\n"}
+{"Time":"2023-03-29T13:59:31.212200169Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:31.212 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8): sending disco ping to [s78jr]  ...\n"}
+{"Time":"2023-03-29T13:59:31.711519305Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:31.711 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8): sending disco ping to [s78jr]  ...\n"}
+{"Time":"2023-03-29T13:59:32.2114982Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.211 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8): sending disco ping to [s78jr]  ...\n"}
+{"Time":"2023-03-29T13:59:32.277108499Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:83: 2023-03-29 13:59:32.277: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:59:32.277144197Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:74: 2023-03-29 13:59:32.277: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:59:32.277157734Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:110: 2023-03-29 13:59:32.277: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:59:32.277164721Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:111: 2023-03-29 13:59:32.277: cmd: closing out\n"}
+{"Time":"2023-03-29T13:59:32.2771729Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:113: 2023-03-29 13:59:32.277: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:59:32.277306699Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:76: 2023-03-29 13:59:32.277: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:59:32.277350733Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:74: 2023-03-29 13:59:32.277: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:59:32.277374575Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:76: 2023-03-29 13:59:32.277: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:59:32.277394938Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:74: 2023-03-29 13:59:32.277: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:59:32.277415507Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:76: 2023-03-29 13:59:32.277: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:59:32.277434743Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:102: 2023-03-29 13:59:32.277: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:59:32.277579778Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
+{"Time":"2023-03-29T13:59:32.277611563Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 2s\n"}
+{"Time":"2023-03-29T13:59:32.277638668Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:59:32.277693383Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:59:32.277732009Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:59:32.277947928Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:59:32.277973674Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:59:32.278017899Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.277 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:59:32.278057207Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [tUb7c] - Stopping\n"}
+{"Time":"2023-03-29T13:59:32.278134475Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:59:32.278241902Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:59:32.278284628Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
+{"Time":"2023-03-29T13:59:32.278337186Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
+{"Time":"2023-03-29T13:59:32.27868397Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 2s\n"}
+{"Time":"2023-03-29T13:59:32.278698095Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:59:32.278769886Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:59:32.278808018Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:59:32.278879735Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:59:32.278965521Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.278 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4574:9c80:638b:7d8b:1bd8): sending disco ping to [s78jr]  ...\n"}
+{"Time":"2023-03-29T13:59:32.279089367Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.279 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:59:32.279122263Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.279 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:59:32.279168949Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.279 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [s78jr] - Stopping\n"}
+{"Time":"2023-03-29T13:59:32.279275932Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:59:32.279 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:59:32.279696417Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    stuntest.go:63: STUN server shutdown\n"}
+{"Time":"2023-03-29T13:59:32.279872392Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"--- PASS: TestAgent_Session_TTY_MOTD (1.84s)\n"}
+{"Time":"2023-03-29T13:59:32.279886475Z","Action":"pass","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Elapsed":1.84}
+{"Time":"2023-03-29T13:59:32.27989796Z","Action":"run","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin"}
+{"Time":"2023-03-29T13:59:32.279902938Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"=== RUN   TestAgent_Session_TTY_Hushlogin\n"}
+{"Time":"2023-03-29T13:59:32.457943185Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"panic: test timed out after 2s\n"}
+{"Time":"2023-03-29T13:59:32.45796911Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"running tests:\n"}
+{"Time":"2023-03-29T13:59:32.457977422Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\tTestAgent_Session_TTY_Hushlogin (0s)\n"}
+{"Time":"2023-03-29T13:59:32.457982677Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
+{"Time":"2023-03-29T13:59:32.457987323Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 411 [running]:\n"}
+{"Time":"2023-03-29T13:59:32.457991361Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.(*M).startAlarm.func1()\n"}
+{"Time":"2023-03-29T13:59:32.457995716Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:2241 +0x3b9\n"}
+{"Time":"2023-03-29T13:59:32.4580029Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by time.goFunc\n"}
+{"Time":"2023-03-29T13:59:32.458007365Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/time/sleep.go:176 +0x32\n"}
+{"Time":"2023-03-29T13:59:32.45801203Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
+{"Time":"2023-03-29T13:59:32.45801607Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 1 [chan receive]:\n"}
+{"Time":"2023-03-29T13:59:32.458020121Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.(*T).Run(0xc0004e1040, {0x16a5e92?, 0x535fa5?}, 0x17462c0)\n"}
+{"Time":"2023-03-29T13:59:32.458024235Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1630 +0x405\n"}
+{"Time":"2023-03-29T13:59:32.458028654Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.runTests.func1(0x236db60?)\n"}
+{"Time":"2023-03-29T13:59:32.45803313Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:2036 +0x45\n"}
+{"Time":"2023-03-29T13:59:32.458037122Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.tRunner(0xc0004e1040, 0xc000589bb8)\n"}
+{"Time":"2023-03-29T13:59:32.458041079Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1576 +0x10b\n"}
+{"Time":"2023-03-29T13:59:32.45804729Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.runTests(0xc000341a40?, {0x235c580, 0x21, 0x21}, {0x4182d0?, 0xc000589c78?, 0x236cb40?})\n"}
+{"Time":"2023-03-29T13:59:32.458051787Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:2034 +0x489\n"}
+{"Time":"2023-03-29T13:59:32.458055836Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.(*M).Run(0xc000341a40)\n"}
+{"Time":"2023-03-29T13:59:32.458059703Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1906 +0x63a\n"}
+{"Time":"2023-03-29T13:59:32.458066931Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"go.uber.org/goleak.VerifyTestMain({0x18f5540?, 0xc000341a40?}, {0x0, 0x0, 0x0})\n"}
+{"Time":"2023-03-29T13:59:32.458071333Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/.local/go/pkg/mod/go.uber.org/goleak@v1.2.1/testmain.go:53 +0x6b\n"}
+{"Time":"2023-03-29T13:59:32.458075235Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/v2/agent_test.TestMain(...)\n"}
+{"Time":"2023-03-29T13:59:32.458081052Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:53\n"}
+{"Time":"2023-03-29T13:59:32.45808506Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"main.main()\n"}
+{"Time":"2023-03-29T13:59:32.458088903Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t_testmain.go:115 +0x1e5\n"}
+{"Time":"2023-03-29T13:59:32.458094468Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
+{"Time":"2023-03-29T13:59:32.458102106Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 9 [chan receive]:\n"}
+{"Time":"2023-03-29T13:59:32.45810621Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.(*T).Parallel(0xc0004e11e0)\n"}
+{"Time":"2023-03-29T13:59:32.45811231Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1384 +0x225\n"}
+{"Time":"2023-03-29T13:59:32.458116485Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/v2/agent_test.TestAgent_SessionExec(0x0?)\n"}
+{"Time":"2023-03-29T13:59:32.458120426Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:188 +0x33\n"}
+{"Time":"2023-03-29T13:59:32.458126141Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.tRunner(0xc0004e11e0, 0x1746298)\n"}
+{"Time":"2023-03-29T13:59:32.458130428Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1576 +0x10b\n"}
+{"Time":"2023-03-29T13:59:32.458135189Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by testing.(*T).Run\n"}
+{"Time":"2023-03-29T13:59:32.458144082Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n"}
+{"Time":"2023-03-29T13:59:32.458150718Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
+{"Time":"2023-03-29T13:59:32.458156738Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 10 [chan receive]:\n"}
+{"Time":"2023-03-29T13:59:32.458165162Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.(*T).Parallel(0xc0004e1520)\n"}
+{"Time":"2023-03-29T13:59:32.458171886Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1384 +0x225\n"}
+{"Time":"2023-03-29T13:59:32.458178556Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/v2/agent_test.TestAgent_SessionTTYShell(0xc0004e1520)\n"}
+{"Time":"2023-03-29T13:59:32.458182782Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:213 +0x36\n"}
+{"Time":"2023-03-29T13:59:32.458188646Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.tRunner(0xc0004e1520, 0x17462a8)\n"}
+{"Time":"2023-03-29T13:59:32.458192664Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1576 +0x10b\n"}
+{"Time":"2023-03-29T13:59:32.458196426Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by testing.(*T).Run\n"}
+{"Time":"2023-03-29T13:59:32.458200247Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n"}
+{"Time":"2023-03-29T13:59:32.458204698Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
+{"Time":"2023-03-29T13:59:32.458208395Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 11 [chan receive]:\n"}
+{"Time":"2023-03-29T13:59:32.458215562Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.(*T).Parallel(0xc0004e1860)\n"}
+{"Time":"2023-03-29T13:59:32.458219487Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1384 +0x225\n"}
+{"Time":"2023-03-29T13:59:32.458223369Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/v2/agent_test.TestAgent_SessionTTYExitCode(0xc0004e1520?)\n"}
+{"Time":"2023-03-29T13:59:32.458228633Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:244 +0x36\n"}
+{"Time":"2023-03-29T13:59:32.458234377Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.tRunner(0xc0004e1860, 0x17462a0)\n"}
+{"Time":"2023-03-29T13:59:32.458238258Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1576 +0x10b\n"}
+{"Time":"2023-03-29T13:59:32.458242179Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by testing.(*T).Run\n"}
+{"Time":"2023-03-29T13:59:32.458246008Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n"}
+{"Time":"2023-03-29T13:59:32.458249635Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
+{"Time":"2023-03-29T13:59:32.45825516Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 408 [runnable]:\n"}
+{"Time":"2023-03-29T13:59:32.458282465Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"math/big.nat.montgomery({0xc004aa4500?, 0x10?, 0x26?}, {0xc004aa4280?, 0x10?, 0x26?}, {0xc004aa4280?, 0x10?, 0x26?}, {0xc000732820, ...}, ...)\n"}
+{"Time":"2023-03-29T13:59:32.458291741Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/math/big/nat.go:216 +0x565\n"}
+{"Time":"2023-03-29T13:59:32.458330298Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"math/big.nat.expNNMontgomery({0xc004aa4280, 0xc0003c2e70?, 0x26}, {0xc004a9adc0?, 0x21?, 0x24?}, {0xc004a9ac80, 0x10, 0x24?}, {0xc000732820, ...})\n"}
+{"Time":"2023-03-29T13:59:32.458336764Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/math/big/nat.go:1271 +0xb1c\n"}
+{"Time":"2023-03-29T13:59:32.458384114Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"math/big.nat.expNN({0xc004aa4280?, 0x14?, 0x22c2900?}, {0xc004a9adc0?, 0x10, 0x14}, {0xc004a9ac80?, 0x10, 0x14?}, {0xc000732820, ...}, ...)\n"}
+{"Time":"2023-03-29T13:59:32.458393699Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/math/big/nat.go:996 +0x3b1\n"}
+{"Time":"2023-03-29T13:59:32.458403406Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"math/big.nat.probablyPrimeMillerRabin({0xc000732820?, 0x10, 0x14}, 0x15, 0x1)\n"}
+{"Time":"2023-03-29T13:59:32.458413208Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/math/big/prime.go:106 +0x5b8\n"}
+{"Time":"2023-03-29T13:59:32.458420936Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"math/big.(*Int).ProbablyPrime(0xc0047208c0, 0x14)\n"}
+{"Time":"2023-03-29T13:59:32.458424869Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/math/big/prime.go:78 +0x225\n"}
+{"Time":"2023-03-29T13:59:32.458430384Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"crypto/rand.Prime({0x18f04c0, 0xc00007e020}, 0x400)\n"}
+{"Time":"2023-03-29T13:59:32.45843919Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/crypto/rand/util.go:55 +0x1e5\n"}
+{"Time":"2023-03-29T13:59:32.45845888Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"crypto/rsa.GenerateMultiPrimeKey({0x18f04c0, 0xc00007e020}, 0x2, 0x800)\n"}
+{"Time":"2023-03-29T13:59:32.458469074Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/crypto/rsa/rsa.go:369 +0x745\n"}
+{"Time":"2023-03-29T13:59:32.458474102Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"crypto/rsa.GenerateKey(...)\n"}
+{"Time":"2023-03-29T13:59:32.45847985Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/crypto/rsa/rsa.go:264\n"}
+{"Time":"2023-03-29T13:59:32.458483767Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/v2/agent.(*agent).init(0xc00485eea0, {0x1902c20?, 0xc00485d770})\n"}
+{"Time":"2023-03-29T13:59:32.458489397Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent.go:810 +0x6c\n"}
+{"Time":"2023-03-29T13:59:32.458522193Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/v2/agent.New({{0x190cbc0, 0xc0005b7710}, {0x166d829, 0x4}, {0x166d829, 0x4}, 0x17461d8, {0x1907c90, 0xc000278280}, 0x45d964b800, ...})\n"}
+{"Time":"2023-03-29T13:59:32.458531042Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent.go:134 +0x549\n"}
+{"Time":"2023-03-29T13:59:32.458565925Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/v2/agent_test.setupAgent(0xc00485eb60, {0x0, {0x0, 0x0}, {0x0, 0x0, 0x0}, 0xc0005b8da0, 0x0, {0x0, ...}, ...}, ...)\n"}
+{"Time":"2023-03-29T13:59:32.458576217Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:1568 +0x63e\n"}
+{"Time":"2023-03-29T13:59:32.458605192Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/v2/agent_test.setupSSHSession(0xc00485eb60, {0x0, {0x0, 0x0}, {0x0, 0x0, 0x0}, 0x0, 0x0, {0x0, ...}, ...})\n"}
+{"Time":"2023-03-29T13:59:32.458614801Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:1524 +0xc5\n"}
+{"Time":"2023-03-29T13:59:32.458625161Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"github.com/coder/coder/v2/agent_test.TestAgent_Session_TTY_Hushlogin(0xc00485eb60)\n"}
+{"Time":"2023-03-29T13:59:32.458630015Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/src/coder/coder/agent/agent_test.go:330 +0x2fa\n"}
+{"Time":"2023-03-29T13:59:32.458635887Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"testing.tRunner(0xc00485eb60, 0x17462c0)\n"}
+{"Time":"2023-03-29T13:59:32.458639744Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1576 +0x10b\n"}
+{"Time":"2023-03-29T13:59:32.458643595Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by testing.(*T).Run\n"}
+{"Time":"2023-03-29T13:59:32.458649393Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/testing/testing.go:1629 +0x3ea\n"}
+{"Time":"2023-03-29T13:59:32.458653156Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
+{"Time":"2023-03-29T13:59:32.458657314Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 409 [IO wait]:\n"}
+{"Time":"2023-03-29T13:59:32.458662763Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.runtime_pollWait(0x7f5230766628, 0x72)\n"}
+{"Time":"2023-03-29T13:59:32.458668522Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/runtime/netpoll.go:306 +0x89\n"}
+{"Time":"2023-03-29T13:59:32.45867585Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.(*pollDesc).wait(0xc00475bf80?, 0xc0005ec5e2?, 0x0)\n"}
+{"Time":"2023-03-29T13:59:32.458681918Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32\n"}
+{"Time":"2023-03-29T13:59:32.458688307Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.(*pollDesc).waitRead(...)\n"}
+{"Time":"2023-03-29T13:59:32.458708219Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:89\n"}
+{"Time":"2023-03-29T13:59:32.458712856Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.(*FD).Accept(0xc00475bf80)\n"}
+{"Time":"2023-03-29T13:59:32.458717364Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/internal/poll/fd_unix.go:614 +0x2bd\n"}
+{"Time":"2023-03-29T13:59:32.458721204Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*netFD).accept(0xc00475bf80)\n"}
+{"Time":"2023-03-29T13:59:32.458727021Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/fd_unix.go:172 +0x35\n"}
+{"Time":"2023-03-29T13:59:32.458731155Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*TCPListener).accept(0xc00486ecd8)\n"}
+{"Time":"2023-03-29T13:59:32.458737943Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/tcpsock_posix.go:148 +0x25\n"}
+{"Time":"2023-03-29T13:59:32.458744974Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*TCPListener).Accept(0xc00486ecd8)\n"}
+{"Time":"2023-03-29T13:59:32.458752245Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/tcpsock.go:297 +0x3d\n"}
+{"Time":"2023-03-29T13:59:32.458758039Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"crypto/tls.(*listener).Accept(0xc00486ef18)\n"}
+{"Time":"2023-03-29T13:59:32.458763674Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/crypto/tls/tls.go:66 +0x2d\n"}
+{"Time":"2023-03-29T13:59:32.458770104Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net/http.(*Server).Serve(0xc00029da40, {0x18fefa0, 0xc00486ef18})\n"}
+{"Time":"2023-03-29T13:59:32.458778229Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/http/server.go:3059 +0x385\n"}
+{"Time":"2023-03-29T13:59:32.45878539Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net/http/httptest.(*Server).goServe.func1()\n"}
+{"Time":"2023-03-29T13:59:32.458793477Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/http/httptest/server.go:310 +0x6a\n"}
+{"Time":"2023-03-29T13:59:32.458797511Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by net/http/httptest.(*Server).goServe\n"}
+{"Time":"2023-03-29T13:59:32.458801374Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/http/httptest/server.go:308 +0x6a\n"}
+{"Time":"2023-03-29T13:59:32.458805093Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\n"}
+{"Time":"2023-03-29T13:59:32.458810472Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"goroutine 410 [IO wait]:\n"}
+{"Time":"2023-03-29T13:59:32.458814744Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.runtime_pollWait(0x7f5230765908, 0x72)\n"}
+{"Time":"2023-03-29T13:59:32.458819038Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/runtime/netpoll.go:306 +0x89\n"}
+{"Time":"2023-03-29T13:59:32.458824589Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.(*pollDesc).wait(0xc00043a300?, 0xc004880000?, 0x0)\n"}
+{"Time":"2023-03-29T13:59:32.458830327Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:84 +0x32\n"}
+{"Time":"2023-03-29T13:59:32.458835463Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.(*pollDesc).waitRead(...)\n"}
+{"Time":"2023-03-29T13:59:32.458840944Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/internal/poll/fd_poll_runtime.go:89\n"}
+{"Time":"2023-03-29T13:59:32.458850643Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"internal/poll.(*FD).ReadFromInet4(0xc00043a300, {0xc004880000, 0x10000, 0x10000}, 0x0?)\n"}
+{"Time":"2023-03-29T13:59:32.458859626Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/internal/poll/fd_unix.go:250 +0x24f\n"}
+{"Time":"2023-03-29T13:59:32.458872383Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*netFD).readFromInet4(0xc00043a300, {0xc004880000?, 0x0?, 0x0?}, 0x0?)\n"}
+{"Time":"2023-03-29T13:59:32.458879419Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/fd_posix.go:66 +0x29\n"}
+{"Time":"2023-03-29T13:59:32.458901901Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*UDPConn).readFrom(0x30?, {0xc004880000?, 0xc0005b7770?, 0x0?}, 0xc0005b7770)\n"}
+{"Time":"2023-03-29T13:59:32.458908829Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/udpsock_posix.go:52 +0x1b8\n"}
+{"Time":"2023-03-29T13:59:32.458922969Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*UDPConn).readFromUDP(0xc000015a08, {0xc004880000?, 0x4102c7?, 0x10000?}, 0x13e45e0?)\n"}
+{"Time":"2023-03-29T13:59:32.458928418Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/udpsock.go:149 +0x31\n"}
+{"Time":"2023-03-29T13:59:32.458942888Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"net.(*UDPConn).ReadFrom(0x59a?, {0xc004880000, 0x10000, 0x10000})\n"}
+{"Time":"2023-03-29T13:59:32.45894865Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/usr/local/go/src/net/udpsock.go:158 +0x50\n"}
+{"Time":"2023-03-29T13:59:32.458972992Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"tailscale.com/net/stun/stuntest.runSTUN({0x1911ec0, 0xc00485eb60}, {0x1907f60, 0xc000015a08}, 0xc00481baa0, 0x17462c0?)\n"}
+{"Time":"2023-03-29T13:59:32.458979652Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/.local/go/pkg/mod/github.com/coder/tailscale@v1.1.1-0.20230327205451-058fa46a3723/net/stun/stuntest/stuntest.go:59 +0xc6\n"}
+{"Time":"2023-03-29T13:59:32.458988938Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"created by tailscale.com/net/stun/stuntest.ServeWithPacketListener\n"}
+{"Time":"2023-03-29T13:59:32.458996325Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"\t/home/mafredri/.local/go/pkg/mod/github.com/coder/tailscale@v1.1.1-0.20230327205451-058fa46a3723/net/stun/stuntest/stuntest.go:47 +0x26a\n"}
+{"Time":"2023-03-29T13:59:32.464073774Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Output":"FAIL\tgithub.com/coder/coder/v2/agent\t2.045s\n"}
+{"Time":"2023-03-29T13:59:32.464093085Z","Action":"fail","Package":"github.com/coder/coder/v2/agent","Elapsed":2.045}
diff --git a/scripts/ci-report/testdata/gotests.json.sample b/scripts/ci-report/testdata/gotests.json.sample
index 245facbfb8c8e..63f19aa1c7ba7 100644
--- a/scripts/ci-report/testdata/gotests.json.sample
+++ b/scripts/ci-report/testdata/gotests.json.sample
@@ -1,2922 +1,2922 @@
-{"Time":"2023-03-29T13:37:23.355347397Z","Action":"start","Package":"github.com/coder/coder/agent"}
-{"Time":"2023-03-29T13:37:23.381695238Z","Action":"run","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec"}
-{"Time":"2023-03-29T13:37:23.38177342Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"=== RUN   TestAgent_SessionExec\n"}
-{"Time":"2023-03-29T13:37:23.381791755Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"=== PAUSE TestAgent_SessionExec\n"}
-{"Time":"2023-03-29T13:37:23.381805147Z","Action":"pause","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec"}
-{"Time":"2023-03-29T13:37:23.381827974Z","Action":"run","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell"}
-{"Time":"2023-03-29T13:37:23.381835977Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"=== RUN   TestAgent_SessionTTYShell\n"}
-{"Time":"2023-03-29T13:37:23.381850018Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"=== PAUSE TestAgent_SessionTTYShell\n"}
-{"Time":"2023-03-29T13:37:23.381857444Z","Action":"pause","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell"}
-{"Time":"2023-03-29T13:37:23.381868815Z","Action":"run","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode"}
-{"Time":"2023-03-29T13:37:23.381876252Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"=== RUN   TestAgent_SessionTTYExitCode\n"}
-{"Time":"2023-03-29T13:37:23.381885049Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"=== PAUSE TestAgent_SessionTTYExitCode\n"}
-{"Time":"2023-03-29T13:37:23.381896641Z","Action":"pause","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode"}
-{"Time":"2023-03-29T13:37:23.381914968Z","Action":"run","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD"}
-{"Time":"2023-03-29T13:37:23.381930694Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"=== RUN   TestAgent_Session_TTY_MOTD\n"}
-{"Time":"2023-03-29T13:37:23.459584829Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:37:23.45962803Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:37:23.459637144Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:37:23.459709589Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:37:23.459766441Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:37:23.459896565Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:23.45992711Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:23.460013936Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:23.460047337Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:23.460151722Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:23.460178571Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:23.460311639Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:07ad6d06cd8b5ff2\n"}
-{"Time":"2023-03-29T13:37:23.460356174Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:37:23.460498076Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:37:23.460536017Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:37:23.460590141Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:37:23.460620636Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:37:23.460662149Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:37:23.460698929Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:37:23.460733289Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:23.460789117Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:37:23.460856196Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:37:23.460986291Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:37:23.46141926Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.461 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:23.461506329Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.461 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:37:23.461608094Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.461 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:23.46164708Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.461 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
-{"Time":"2023-03-29T13:37:23.461997997Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.461 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 48127, \"DERPPort\": 44839, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"/tmp/TestAgent_Session_TTY_MOTD1157664819/001/motd\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
-{"Time":"2023-03-29T13:37:23.462041275Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.461 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
-{"Time":"2023-03-29T13:37:23.462418253Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:37:23.46244618Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:37:23.462489007Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:37:23.462532307Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:37:23.462584588Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:37:23.462669431Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:23.462699701Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:23.46277017Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:23.46280348Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:23.46284612Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:23.462890638Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:23.463014252Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:8ac4cc2c7460d56f\n"}
-{"Time":"2023-03-29T13:37:23.463040585Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:37:23.463167416Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:37:23.463228086Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:37:23.463265117Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:37:23.463307341Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:37:23.463345133Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:37:23.463380146Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:37:23.463437865Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:23.463474458Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:37:23.463513083Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:37:23.463651429Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:37:23.463966826Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:23.463992242Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:37:23.464079789Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.464 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
-{"Time":"2023-03-29T13:37:23.464100162Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.464 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
-{"Time":"2023-03-29T13:37:23.464314405Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.464 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.464098Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:23.470436775Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.470 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:37:23.473142737Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.473 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:37:23.473905461Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.473 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:37:23.476012898Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.475 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.4615Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:23.476335333Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.476 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:23.476591432Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.476 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:37:23.476641778Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.476 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:37:23.476677236Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.476 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:37:23.47834267Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.478 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:37:23.478773607Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.478 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:37:23.479289417Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.479 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:37:23.484191154Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.484 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.4615Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:23.484233027Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.484 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:23.484426557Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.484 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
-{"Time":"2023-03-29T13:37:23.484790305Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.484 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:37:23.484946523Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.484 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:37:23.485230922Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:37:23.485304276Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:23.485410816Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:37:23.485506941Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:37:23.485747079Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:37:23.485857203Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:37:23.485942868Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:23.486354495Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.486 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.464098Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:23.486406209Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.486 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:23.486580191Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.486 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\n"}
-{"Time":"2023-03-29T13:37:23.486731116Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.486 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:37:23.486910536Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.486 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:37:23.48721125Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:37:23.487271545Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:23.487362767Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:37:23.487505661Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:37:23.48757023Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:37:23.487687075Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:37:23.487755179Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:23.533579774Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.533 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:41471 derp=1 derpdist=1v4:5ms\n"}
-{"Time":"2023-03-29T13:37:23.533653394Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.533 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:23.534036522Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.533 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:41471 (stun), 172.20.0.2:41471 (local)\n"}
-{"Time":"2023-03-29T13:37:23.534320881Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.534 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:23.534012576 +0000 UTC m=+0.173619877 Peers:[] LocalAddrs:[{Addr:127.0.0.1:41471 Type:stun} {Addr:172.20.0.2:41471 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:23.534485142Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:34768 derp=1 derpdist=1v4:4ms\n"}
-{"Time":"2023-03-29T13:37:23.534597588Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:23.534893919Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:34768 (stun), 172.20.0.2:34768 (local)\n"}
-{"Time":"2023-03-29T13:37:23.535056614Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.534 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:23.534872863 +0000 UTC m=+0.174480149 Peers:[] LocalAddrs:[{Addr:127.0.0.1:34768 Type:stun} {Addr:172.20.0.2:34768 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:23.535722359Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.535 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:37:23.535840193Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.535 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:37:23.53601927Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.535 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:23.535826298 +0000 UTC m=+0.175433549 Peers:[] LocalAddrs:[{Addr:127.0.0.1:41471 Type:stun} {Addr:172.20.0.2:41471 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:23.536284979Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.536 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.004534057}}}\n"}
-{"Time":"2023-03-29T13:37:23.536457311Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.536 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.5343Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": [\"127.0.0.1:41471\", \"172.20.0.2:41471\"]}}\n"}
-{"Time":"2023-03-29T13:37:23.536888005Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.536 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.5343Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": [\"127.0.0.1:41471\", \"172.20.0.2:41471\"]}}\n"}
-{"Time":"2023-03-29T13:37:23.536962253Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.536 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:23.537168204Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.537 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:23.537809136Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.537 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:23.537959175Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.537 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:37:23.538044116Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.537 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:37:23.538236588Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.538 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:23.538043332 +0000 UTC m=+0.177650587 Peers:[] LocalAddrs:[{Addr:127.0.0.1:34768 Type:stun} {Addr:172.20.0.2:34768 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:23.538347057Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.538 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.004475683}}}\n"}
-{"Time":"2023-03-29T13:37:23.538488084Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.538 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.535038Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34768\", \"172.20.0.2:34768\"]}}\n"}
-{"Time":"2023-03-29T13:37:23.538915728Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.538 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.535038Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34768\", \"172.20.0.2:34768\"]}}\n"}
-{"Time":"2023-03-29T13:37:23.538974002Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.538 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:23.539154829Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.539 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:23.539540545Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.539 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:23.539953465Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.539 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.539778Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.004534057}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": [\"127.0.0.1:41471\", \"172.20.0.2:41471\"]}}\n"}
-{"Time":"2023-03-29T13:37:23.540373922Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.540 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.539778Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.004534057}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": [\"127.0.0.1:41471\", \"172.20.0.2:41471\"]}}\n"}
-{"Time":"2023-03-29T13:37:23.540832675Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.540 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:23.540920246Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.540 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:23.541080962Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.541 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:37:23.541207198Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.541 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:23.541540025Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.541 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:23.541869031Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.541 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.541715Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.004475683}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34768\", \"172.20.0.2:34768\"]}}\n"}
-{"Time":"2023-03-29T13:37:23.542270097Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.542 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.541715Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.004475683}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34768\", \"172.20.0.2:34768\"]}}\n"}
-{"Time":"2023-03-29T13:37:23.542592821Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.542 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:23.542683196Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.542 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:23.542867815Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.542 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:37:23.542985478Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.542 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:23.55226213Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.552 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:37:23.552392256Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.552 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:37:23.589932282Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.589 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:34768 derp=1 derpdist=1v4:4ms\n"}
-{"Time":"2023-03-29T13:37:23.591567427Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.591 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:41471 derp=1 derpdist=1v4:2ms\n"}
-{"Time":"2023-03-29T13:37:23.598751818Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.598 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [0x7ra]  ...\n"}
-{"Time":"2023-03-29T13:37:23.598954894Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.598 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [0x7ra] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:37:23.599390218Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.599 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [vT+Vd] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:37:23.599516651Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.599 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [0x7ra] d:8ac4cc2c7460d56f now using 172.20.0.2:34768\n"}
-{"Time":"2023-03-29T13:37:23.599643596Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.599 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [0x7ra]  ...\n"}
-{"Time":"2023-03-29T13:37:23.59972717Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.599 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [0x7ra]  ...\n"}
-{"Time":"2023-03-29T13:37:23.600132385Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:23.600385251Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:37:23.600423261Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:37:23.600476824Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:37:23.600511572Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:37:23.600547765Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:23.600583838Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - Starting\n"}
-{"Time":"2023-03-29T13:37:23.600650591Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - Sending handshake initiation\n"}
-{"Time":"2023-03-29T13:37:23.601044073Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [vT+Vd] now active, reconfiguring WireGuard\n"}
-{"Time":"2023-03-29T13:37:23.601107152Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:23.601327676Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:37:23.601369666Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:37:23.601396751Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:37:23.601460927Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:37:23.601495639Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:23.601526183Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - Starting\n"}
-{"Time":"2023-03-29T13:37:23.60175503Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - Received handshake initiation\n"}
-{"Time":"2023-03-29T13:37:23.601775856Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - Sending handshake response\n"}
-{"Time":"2023-03-29T13:37:23.602280259Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.602 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:23.602127595 +0000 UTC m=+0.241734812 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33}] LocalAddrs:[{Addr:127.0.0.1:34768 Type:stun} {Addr:172.20.0.2:34768 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:23.602838109Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.602 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - Received handshake response\n"}
-{"Time":"2023-03-29T13:37:23.602930775Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.602 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [vT+Vd] d:07ad6d06cd8b5ff2 now using 172.20.0.2:41471\n"}
-{"Time":"2023-03-29T13:37:23.603134941Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.602 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:23.602980142 +0000 UTC m=+0.242587360 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:23.602828352 +0000 UTC NodeKey:nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229}] LocalAddrs:[{Addr:127.0.0.1:41471 Type:stun} {Addr:172.20.0.2:41471 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:23.603731388Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.603 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [0x7ra] d:8ac4cc2c7460d56f now using 127.0.0.1:34768\n"}
-{"Time":"2023-03-29T13:37:23.629049874Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    agent_test.go:298: 2023-03-29 13:37:23.628: cmd: stdin: \"exit 0\\r\"\n"}
-{"Time":"2023-03-29T13:37:23.62993175Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:121: 2023-03-29 13:37:23.629: cmd: \"exit 0\"\n"}
-{"Time":"2023-03-29T13:37:23.643243989Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.643 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:34768 derp=1 derpdist=1v4:1ms\n"}
-{"Time":"2023-03-29T13:37:23.643873931Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.643 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:41471 derp=1 derpdist=1v4:0s\n"}
-{"Time":"2023-03-29T13:37:23.644469186Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.644 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.000547591}}}\n"}
-{"Time":"2023-03-29T13:37:23.644715274Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.644 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.644461Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000547591}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34768\", \"172.20.0.2:34768\"]}}\n"}
-{"Time":"2023-03-29T13:37:23.645390624Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.645 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.644461Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000547591}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34768\", \"172.20.0.2:34768\"]}}\n"}
-{"Time":"2023-03-29T13:37:23.64591875Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.645 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:23.646145075Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.645 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:23.646400847Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.646 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:23.646730863Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.646 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:23.646828936Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.646 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - Sending keepalive packet\n"}
-{"Time":"2023-03-29T13:37:23.646930238Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.646 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:23.647158211Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.646 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.000154898}}}\n"}
-{"Time":"2023-03-29T13:37:23.647376125Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.647 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.64715Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000154898}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": [\"127.0.0.1:41471\", \"172.20.0.2:41471\"]}}\n"}
-{"Time":"2023-03-29T13:37:23.648003118Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.647 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.64715Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000154898}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": [\"127.0.0.1:41471\", \"172.20.0.2:41471\"]}}\n"}
-{"Time":"2023-03-29T13:37:23.648256172Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:23.648338509Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:23.648471344Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:23.648609559Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:23.648638814Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - Sending keepalive packet\n"}
-{"Time":"2023-03-29T13:37:23.648721589Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:23.648895668Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - Receiving keepalive packet\n"}
-{"Time":"2023-03-29T13:37:23.648944175Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - Receiving keepalive packet\n"}
-{"Time":"2023-03-29T13:37:23.983374775Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.983 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775): sending disco ping to [vT+Vd]  ...\n"}
-{"Time":"2023-03-29T13:37:24.483975661Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.483 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775): sending disco ping to [vT+Vd]  ...\n"}
-{"Time":"2023-03-29T13:37:24.983883086Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.983 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775): sending disco ping to [vT+Vd]  ...\n"}
-{"Time":"2023-03-29T13:37:24.997284571Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:83: 2023-03-29 13:37:24.997: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:24.997307935Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:74: 2023-03-29 13:37:24.997: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:24.997315409Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:110: 2023-03-29 13:37:24.997: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:24.997319364Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:111: 2023-03-29 13:37:24.997: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:24.997323588Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:113: 2023-03-29 13:37:24.997: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:24.997370156Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:76: 2023-03-29 13:37:24.997: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:24.997381692Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:74: 2023-03-29 13:37:24.997: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:24.997385034Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:76: 2023-03-29 13:37:24.997: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:24.997389205Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:74: 2023-03-29 13:37:24.997: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:24.997393753Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:76: 2023-03-29 13:37:24.997: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:24.997405892Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:102: 2023-03-29 13:37:24.997: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:24.997490606Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
-{"Time":"2023-03-29T13:37:24.997723999Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 1s\n"}
-{"Time":"2023-03-29T13:37:24.997783062Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:37:24.997839084Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:37:24.997864344Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:37:24.997932377Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:37:24.998046302Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:37:24.998086112Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:37:24.998136192Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - Stopping\n"}
-{"Time":"2023-03-29T13:37:24.998214902Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:37:24.998405401Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:37:24.998453108Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
-{"Time":"2023-03-29T13:37:24.998545966Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
-{"Time":"2023-03-29T13:37:24.998863807Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 1s\n"}
-{"Time":"2023-03-29T13:37:24.998907983Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:37:24.998974565Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:37:24.999012856Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:37:24.999084066Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.999 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:37:24.999163662Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.999 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775): sending disco ping to [vT+Vd]  ...\n"}
-{"Time":"2023-03-29T13:37:24.999281214Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.999 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:37:24.999322797Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.999 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:37:24.999367964Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.999 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - Stopping\n"}
-{"Time":"2023-03-29T13:37:24.999477141Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.999 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:37:24.999790842Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    stuntest.go:63: STUN server shutdown\n"}
-{"Time":"2023-03-29T13:37:24.999978482Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"--- PASS: TestAgent_Session_TTY_MOTD (1.62s)\n"}
-{"Time":"2023-03-29T13:37:24.999989636Z","Action":"pass","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_MOTD","Elapsed":1.62}
-{"Time":"2023-03-29T13:37:25.000001861Z","Action":"run","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin"}
-{"Time":"2023-03-29T13:37:25.000006766Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"=== RUN   TestAgent_Session_TTY_Hushlogin\n"}
-{"Time":"2023-03-29T13:37:25.061523057Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:37:25.061562172Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:37:25.061580317Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:37:25.061650184Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:37:25.061692748Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:37:25.061779714Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:25.061825894Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:25.0619026Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:25.061948469Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:25.061997351Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:25.062034009Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:25.062159882Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:de63960686d4d969\n"}
-{"Time":"2023-03-29T13:37:25.062211517Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:37:25.062292207Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:37:25.062336748Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:37:25.062378334Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:37:25.062420493Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:37:25.06246598Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:37:25.062509064Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:37:25.0625467Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:25.062582098Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:37:25.062621581Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:37:25.062741251Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:37:25.063047606Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:25.063098481Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:37:25.063228621Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:25.063275399Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
-{"Time":"2023-03-29T13:37:25.063394952Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 48719, \"DERPPort\": 45121, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"/tmp/TestAgent_Session_TTY_Hushlogin1510664063/001/motd\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
-{"Time":"2023-03-29T13:37:25.063449256Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
-{"Time":"2023-03-29T13:37:25.063787886Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:37:25.063828837Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:37:25.063873191Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:37:25.063920593Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:37:25.063972721Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:37:25.064056998Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:25.064104109Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:25.064172955Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:25.064220262Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:25.064265054Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:25.064311842Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:25.064424792Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:a2fa54a4398f4b14\n"}
-{"Time":"2023-03-29T13:37:25.064460776Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:37:25.064519398Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:37:25.064564764Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:37:25.064610015Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:37:25.064649665Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:37:25.064697586Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:37:25.064733375Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:37:25.06476809Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:25.064817752Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:37:25.064858351Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:37:25.064968632Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:37:25.065284782Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.065 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:25.065331529Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.065 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:37:25.065409197Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.065 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
-{"Time":"2023-03-29T13:37:25.065446163Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.065 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
-{"Time":"2023-03-29T13:37:25.065532991Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.065 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.065442Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:25.065984331Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.065 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:37:25.066385592Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.066 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:37:25.066774463Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.066 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:37:25.067577596Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.067 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.063134Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:25.067723294Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.067 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:25.067791082Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.067 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:37:25.067853127Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.067 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:37:25.067910376Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.067 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:37:25.0683366Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.068 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:37:25.07002731Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.069 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:37:25.071537156Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.071 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:37:25.073373256Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.065442Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:25.073396962Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:25.073480235Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\n"}
-{"Time":"2023-03-29T13:37:25.073564836Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:37:25.073671864Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:37:25.07378875Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:37:25.073820206Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:25.073854357Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:37:25.073896565Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:37:25.073931707Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:37:25.073965714Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:37:25.074005901Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:25.074880124Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.074 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.063134Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:25.074899766Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.074 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:25.074982929Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.074 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
-{"Time":"2023-03-29T13:37:25.075048527Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:37:25.075142259Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:37:25.075263679Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:37:25.075295728Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:25.075336116Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:37:25.075375372Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:37:25.075421587Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:37:25.075466864Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:37:25.075504912Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:25.117000024Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.116 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:25.124882906Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.124 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:60850 derp=1 derpdist=1v4:1ms\n"}
-{"Time":"2023-03-29T13:37:25.125053667Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.124 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:25.12561266Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.125 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:60850 (stun), 172.20.0.2:60850 (local)\n"}
-{"Time":"2023-03-29T13:37:25.125905661Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.125 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:25.125569748 +0000 UTC m=+1.765177074 Peers:[] LocalAddrs:[{Addr:127.0.0.1:60850 Type:stun} {Addr:172.20.0.2:60850 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:25.126844264Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.126 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:58304 derp=1 derpdist=1v4:1ms\n"}
-{"Time":"2023-03-29T13:37:25.127005238Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.126 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:25.127513222Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.127 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:58304 (stun), 172.20.0.2:58304 (local)\n"}
-{"Time":"2023-03-29T13:37:25.127757541Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.127 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:25.127481783 +0000 UTC m=+1.767089103 Peers:[] LocalAddrs:[{Addr:127.0.0.1:58304 Type:stun} {Addr:172.20.0.2:58304 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:25.128599916Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.128 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:37:25.128762101Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.128 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:37:25.129009957Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.128 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:25.12872419 +0000 UTC m=+1.768331474 Peers:[] LocalAddrs:[{Addr:127.0.0.1:60850 Type:stun} {Addr:172.20.0.2:60850 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:25.129209925Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.128 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.000985407}}}\n"}
-{"Time":"2023-03-29T13:37:25.129460508Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.129 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.125849Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:60850\", \"172.20.0.2:60850\"]}}\n"}
-{"Time":"2023-03-29T13:37:25.130127324Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.129 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.125849Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:60850\", \"172.20.0.2:60850\"]}}\n"}
-{"Time":"2023-03-29T13:37:25.130232734Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.130 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:25.13055158Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.130 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:25.131114968Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.130 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:37:25.131240194Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.131 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:37:25.131519421Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.131 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:25.131235659 +0000 UTC m=+1.770842948 Peers:[] LocalAddrs:[{Addr:127.0.0.1:58304 Type:stun} {Addr:172.20.0.2:58304 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:25.131694593Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.131 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.001250656}}}\n"}
-{"Time":"2023-03-29T13:37:25.131999693Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.131 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.127736Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": [\"127.0.0.1:58304\", \"172.20.0.2:58304\"]}}\n"}
-{"Time":"2023-03-29T13:37:25.132733057Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.132 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:25.133220162Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.132 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.132982Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000985407}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:60850\", \"172.20.0.2:60850\"]}}\n"}
-{"Time":"2023-03-29T13:37:25.133869838Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.133 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.132982Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000985407}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:60850\", \"172.20.0.2:60850\"]}}\n"}
-{"Time":"2023-03-29T13:37:25.134272814Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.134 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:25.134404044Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.134 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:25.134672632Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.134 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.134517Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.001250656}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": [\"127.0.0.1:58304\", \"172.20.0.2:58304\"]}}\n"}
-{"Time":"2023-03-29T13:37:25.134983325Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.134 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.127736Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": [\"127.0.0.1:58304\", \"172.20.0.2:58304\"]}}\n"}
-{"Time":"2023-03-29T13:37:25.135024699Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.134 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:25.135198837Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.135 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:25.135284701Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.135 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:25.135438825Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.135 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:37:25.135566373Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.135 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:25.135876201Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.135 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.134517Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.001250656}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": [\"127.0.0.1:58304\", \"172.20.0.2:58304\"]}}\n"}
-{"Time":"2023-03-29T13:37:25.136046662Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.136 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:25.136091872Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.136 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:25.136196604Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.136 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:37:25.136258441Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.136 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:25.143831824Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.143 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:37:25.143963014Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.143 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:37:25.181560631Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.181 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:60850 derp=1 derpdist=1v4:10ms\n"}
-{"Time":"2023-03-29T13:37:25.182840653Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.182 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:58304 derp=1 derpdist=1v4:8ms\n"}
-{"Time":"2023-03-29T13:37:25.197904655Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.197 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [0LjuK]  ...\n"}
-{"Time":"2023-03-29T13:37:25.198311943Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.198 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [0LjuK] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:37:25.199139623Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.199 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [S1KIY] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:37:25.199333828Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.199 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [0LjuK] d:a2fa54a4398f4b14 now using 172.20.0.2:60850\n"}
-{"Time":"2023-03-29T13:37:25.199614502Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.199 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [0LjuK]  ...\n"}
-{"Time":"2023-03-29T13:37:25.199798383Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.199 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [0LjuK]  ...\n"}
-{"Time":"2023-03-29T13:37:25.200531317Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.200 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:25.20096595Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.200 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:37:25.201076837Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.200 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:37:25.201187536Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.201 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:37:25.201294507Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.201 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:37:25.201406637Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.201 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:25.20154342Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.201 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - Starting\n"}
-{"Time":"2023-03-29T13:37:25.201642014Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.201 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - Sending handshake initiation\n"}
-{"Time":"2023-03-29T13:37:25.202494139Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.202 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [S1KIY] now active, reconfiguring WireGuard\n"}
-{"Time":"2023-03-29T13:37:25.202613281Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.202 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:25.203067239Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.202 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:37:25.203194112Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.203 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:37:25.203305469Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.203 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:37:25.203432836Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.203 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:37:25.203643635Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.203 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:25.203694677Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.203 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - Starting\n"}
-{"Time":"2023-03-29T13:37:25.204047455Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.203 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - Received handshake initiation\n"}
-{"Time":"2023-03-29T13:37:25.20407267Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.204 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - Sending handshake response\n"}
-{"Time":"2023-03-29T13:37:25.204499058Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.204 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:25.204364109 +0000 UTC m=+1.843971335 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262}] LocalAddrs:[{Addr:127.0.0.1:60850 Type:stun} {Addr:172.20.0.2:60850 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:25.204985233Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.204 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - Received handshake response\n"}
-{"Time":"2023-03-29T13:37:25.205043968Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.204 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [S1KIY] d:de63960686d4d969 now using 172.20.0.2:58304\n"}
-{"Time":"2023-03-29T13:37:25.205186973Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.205 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:25.205077383 +0000 UTC m=+1.844684599 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:25.204972346 +0000 UTC NodeKey:nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c}] LocalAddrs:[{Addr:127.0.0.1:58304 Type:stun} {Addr:172.20.0.2:58304 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:25.205653441Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.205 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [0LjuK] d:a2fa54a4398f4b14 now using 127.0.0.1:60850\n"}
-{"Time":"2023-03-29T13:37:25.228059809Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    agent_test.go:344: 2023-03-29 13:37:25.227: cmd: stdin: \"exit 0\\r\"\n"}
-{"Time":"2023-03-29T13:37:25.228276231Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:121: 2023-03-29 13:37:25.228: cmd: \"exit 0\"\n"}
-{"Time":"2023-03-29T13:37:25.235085539Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.235 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:58304 derp=1 derpdist=1v4:0s\n"}
-{"Time":"2023-03-29T13:37:25.235327678Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.235 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:60850 derp=1 derpdist=1v4:0s\n"}
-{"Time":"2023-03-29T13:37:25.235573892Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.235 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.000235695}}}\n"}
-{"Time":"2023-03-29T13:37:25.235627639Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.235 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.235549Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000235695}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": [\"127.0.0.1:58304\", \"172.20.0.2:58304\"]}}\n"}
-{"Time":"2023-03-29T13:37:25.235912714Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.235 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.235549Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000235695}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": [\"127.0.0.1:58304\", \"172.20.0.2:58304\"]}}\n"}
-{"Time":"2023-03-29T13:37:25.2361447Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:25.236185457Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:25.23632231Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:25.2364646Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:25.23648571Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - Sending keepalive packet\n"}
-{"Time":"2023-03-29T13:37:25.236535173Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:25.236646389Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.000124794}}}\n"}
-{"Time":"2023-03-29T13:37:25.236691145Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.236616Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000124794}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:60850\", \"172.20.0.2:60850\"]}}\n"}
-{"Time":"2023-03-29T13:37:25.236953136Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.236616Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000124794}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:60850\", \"172.20.0.2:60850\"]}}\n"}
-{"Time":"2023-03-29T13:37:25.237148814Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:25.23717419Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:25.23729907Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:25.237442993Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:25.237465362Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - Sending keepalive packet\n"}
-{"Time":"2023-03-29T13:37:25.23748091Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:25.237621079Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - Receiving keepalive packet\n"}
-{"Time":"2023-03-29T13:37:25.237646187Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - Receiving keepalive packet\n"}
-{"Time":"2023-03-29T13:37:25.57358248Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.573 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7): sending disco ping to [S1KIY]  ...\n"}
-{"Time":"2023-03-29T13:37:26.073909695Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.073 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7): sending disco ping to [S1KIY]  ...\n"}
-{"Time":"2023-03-29T13:37:26.573442313Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.573 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7): sending disco ping to [S1KIY]  ...\n"}
-{"Time":"2023-03-29T13:37:26.685974077Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:83: 2023-03-29 13:37:26.685: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:26.686024343Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:74: 2023-03-29 13:37:26.685: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:26.686044434Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:110: 2023-03-29 13:37:26.685: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:26.686057034Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:111: 2023-03-29 13:37:26.685: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:26.686068789Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:113: 2023-03-29 13:37:26.685: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:26.686157867Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:76: 2023-03-29 13:37:26.686: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:26.686173026Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:74: 2023-03-29 13:37:26.686: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:26.686188025Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:76: 2023-03-29 13:37:26.686: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:26.686198978Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:74: 2023-03-29 13:37:26.686: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:26.686213128Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:76: 2023-03-29 13:37:26.686: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:26.686224275Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:102: 2023-03-29 13:37:26.686: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:26.686399517Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
-{"Time":"2023-03-29T13:37:26.686631954Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 2s\n"}
-{"Time":"2023-03-29T13:37:26.686672029Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:37:26.686752993Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:37:26.686793215Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:37:26.686883059Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:37:26.687010573Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:37:26.687040046Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:37:26.687106628Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - Stopping\n"}
-{"Time":"2023-03-29T13:37:26.687190751Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:37:26.68730229Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:37:26.687319022Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
-{"Time":"2023-03-29T13:37:26.68739086Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
-{"Time":"2023-03-29T13:37:26.687791287Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 2s\n"}
-{"Time":"2023-03-29T13:37:26.687807566Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:37:26.687907277Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:37:26.687956258Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:37:26.68802861Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:37:26.688112368Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.688 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7): sending disco ping to [S1KIY]  ...\n"}
-{"Time":"2023-03-29T13:37:26.688253692Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.688 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:37:26.688318345Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.688 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:37:26.688366659Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.688 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - Stopping\n"}
-{"Time":"2023-03-29T13:37:26.688473063Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.688 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:37:26.688794731Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    stuntest.go:63: STUN server shutdown\n"}
-{"Time":"2023-03-29T13:37:26.688993708Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"--- PASS: TestAgent_Session_TTY_Hushlogin (1.69s)\n"}
-{"Time":"2023-03-29T13:37:26.689005169Z","Action":"pass","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_Hushlogin","Elapsed":1.69}
-{"Time":"2023-03-29T13:37:26.689017486Z","Action":"run","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput"}
-{"Time":"2023-03-29T13:37:26.689022846Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"=== RUN   TestAgent_Session_TTY_FastCommandHasOutput\n"}
-{"Time":"2023-03-29T13:37:26.689031231Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"=== PAUSE TestAgent_Session_TTY_FastCommandHasOutput\n"}
-{"Time":"2023-03-29T13:37:26.689049237Z","Action":"pause","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput"}
-{"Time":"2023-03-29T13:37:26.689055783Z","Action":"run","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost"}
-{"Time":"2023-03-29T13:37:26.689060673Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost","Output":"=== RUN   TestAgent_Session_TTY_HugeOutputIsNotLost\n"}
-{"Time":"2023-03-29T13:37:26.689069084Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost","Output":"=== PAUSE TestAgent_Session_TTY_HugeOutputIsNotLost\n"}
-{"Time":"2023-03-29T13:37:26.689074026Z","Action":"pause","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost"}
-{"Time":"2023-03-29T13:37:26.689083532Z","Action":"cont","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec"}
-{"Time":"2023-03-29T13:37:26.689090279Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"=== CONT  TestAgent_SessionExec\n"}
-{"Time":"2023-03-29T13:37:26.703787142Z","Action":"cont","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost"}
-{"Time":"2023-03-29T13:37:26.703825656Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost","Output":"=== CONT  TestAgent_Session_TTY_HugeOutputIsNotLost\n"}
-{"Time":"2023-03-29T13:37:26.703839698Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost","Output":"    agent_test.go:413: This test proves we have a bug where parts of large output on a PTY can be lost after the command exits, skipped to avoid test failures.\n"}
-{"Time":"2023-03-29T13:37:26.703868206Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost","Output":"--- SKIP: TestAgent_Session_TTY_HugeOutputIsNotLost (0.00s)\n"}
-{"Time":"2023-03-29T13:37:26.70388799Z","Action":"skip","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost","Elapsed":0}
-{"Time":"2023-03-29T13:37:26.703900175Z","Action":"cont","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput"}
-{"Time":"2023-03-29T13:37:26.703908033Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"=== CONT  TestAgent_Session_TTY_FastCommandHasOutput\n"}
-{"Time":"2023-03-29T13:37:26.723935151Z","Action":"cont","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode"}
-{"Time":"2023-03-29T13:37:26.723957967Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"=== CONT  TestAgent_SessionTTYExitCode\n"}
-{"Time":"2023-03-29T13:37:26.744050676Z","Action":"cont","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell"}
-{"Time":"2023-03-29T13:37:26.744073511Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"=== CONT  TestAgent_SessionTTYShell\n"}
-{"Time":"2023-03-29T13:37:26.975908391Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.975 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:37:26.975935102Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.975 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:37:26.975941463Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.975 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:37:26.975992643Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.975 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:37:26.976027672Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.975 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:37:26.976097148Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:26.976137127Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:26.976202552Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:26.976237559Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:26.976273529Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:26.976300958Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:26.976417909Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:17b5066de479f458\n"}
-{"Time":"2023-03-29T13:37:26.976445133Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:37:26.976529694Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:37:26.976575591Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:37:26.976603915Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:37:26.976641835Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:37:26.97666441Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:37:26.976690087Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:37:26.97672446Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:26.976749123Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:37:26.976786013Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:37:26.976893189Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:37:26.977219957Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.977 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:26.977264288Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.977 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:37:26.977393997Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.977 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.015978257Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.015 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
-{"Time":"2023-03-29T13:37:27.016072388Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.015 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 55109, \"DERPPort\": 34655, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
-{"Time":"2023-03-29T13:37:27.016101997Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
-{"Time":"2023-03-29T13:37:27.016454205Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:37:27.016484809Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:37:27.016527444Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:37:27.016579577Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:37:27.016616504Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:37:27.01670613Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.016736272Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.016795884Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.01683051Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.016869184Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.016901207Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.017009443Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:e6f05f1260bbd611\n"}
-{"Time":"2023-03-29T13:37:27.017032499Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:37:27.017087268Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:37:27.017133219Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:37:27.017166541Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:37:27.017198439Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:37:27.017231784Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.017255027Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:37:27.017285867Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.017313159Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:37:27.017341323Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:37:27.017453136Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:37:27.017777899Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.01781684Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:37:27.017877499Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
-{"Time":"2023-03-29T13:37:27.017903073Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
-{"Time":"2023-03-29T13:37:27.017983662Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.017904Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.018477038Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.018 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:37:27.018878036Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.018 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:37:27.019251435Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.019 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:37:27.020053918Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.019 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:26.977307Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.020198673Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.020 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.020242577Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.020 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:37:27.020285833Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.020 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:37:27.020317905Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.020 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:37:27.036521314Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.036 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:37:27.036924425Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.036 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:37:27.037332816Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.037 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:37:27.03841778Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.017904Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.038434547Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.03852175Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\n"}
-{"Time":"2023-03-29T13:37:27.038608926Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:37:27.038696362Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:37:27.038810178Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:37:27.038824686Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.038858134Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:37:27.038891063Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:37:27.038924242Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:37:27.038937309Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:37:27.038976455Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.039988711Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.039 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:26.977307Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.040010425Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.039 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.040059771Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
-{"Time":"2023-03-29T13:37:27.040126554Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:37:27.040195696Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:37:27.040300593Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:37:27.040315089Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.040342986Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:37:27.040371935Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:37:27.040410694Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:37:27.040423938Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:37:27.040453889Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.096588631Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.096 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n"}
-{"Time":"2023-03-29T13:37:27.096797479Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.096 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.097032423Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.096 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.09709667Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.097 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n"}
-{"Time":"2023-03-29T13:37:27.12109969Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:37:27.121135169Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:37:27.121150972Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:37:27.121167311Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:37:27.121216222Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:37:27.121292057Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.12132273Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.121381219Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.121408684Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.121435744Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.121461695Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.121594822Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:c7f1bea9d6ff269c\n"}
-{"Time":"2023-03-29T13:37:27.121620573Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:37:27.121655676Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:37:27.121730239Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:37:27.121756777Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:37:27.121781901Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:37:27.121808996Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.121833529Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:37:27.121858413Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.121888455Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:37:27.121913023Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:37:27.122044906Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:37:27.12234719Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.122 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.122375547Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.122 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:37:27.122495597Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.122 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.136791704Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.136 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.136826981Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.136 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
-{"Time":"2023-03-29T13:37:27.13694108Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.136 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 48864, \"DERPPort\": 33963, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
-{"Time":"2023-03-29T13:37:27.136979053Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.136 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
-{"Time":"2023-03-29T13:37:27.137291589Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:37:27.137308609Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:37:27.13732063Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:37:27.137373985Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:37:27.137407965Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:37:27.137495219Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.137519229Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.137572028Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.137602411Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.137622846Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.137667976Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.137770053Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:59083cba13956f00\n"}
-{"Time":"2023-03-29T13:37:27.137794544Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:37:27.137898354Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:37:27.137934758Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:37:27.137955272Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:37:27.138002548Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:37:27.138024513Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.138043252Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:37:27.138068121Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.138095784Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:37:27.138122918Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:37:27.138231919Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:37:27.138531438Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.138556077Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:37:27.138636819Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
-{"Time":"2023-03-29T13:37:27.138658918Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
-{"Time":"2023-03-29T13:37:27.138754966Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.138663Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.139212045Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.139 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:37:27.139609965Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.139 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:37:27.141001091Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.140 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:37:27.143964866Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.143 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.122393Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.144498996Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.144 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.144562824Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.144 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:37:27.144649797Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.144 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:37:27.144702964Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.144 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:37:27.147050678Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.146 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:37:27.152240491Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.152 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:37:27.157654353Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.157 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:37:27.16338877Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.163 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.16375523Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.163 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.138663Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.163780585Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.163 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.163864424Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.163 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\n"}
-{"Time":"2023-03-29T13:37:27.163963441Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.163 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:37:27.164079841Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:37:27.164217744Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:37:27.164235438Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.16424974Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:37:27.164316222Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:37:27.164338403Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:37:27.164386486Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:37:27.1644261Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.165498628Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.122393Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.165527893Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.16555513Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
-{"Time":"2023-03-29T13:37:27.165643091Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:37:27.165737176Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:37:27.165892091Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:37:27.165909805Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.165924292Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:37:27.165977872Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:37:27.166008015Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:37:27.166054821Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.166 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:37:27.166085097Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.166 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.187154465Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.187 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.247520351Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.247 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.247693682Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.247 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n"}
-{"Time":"2023-03-29T13:37:27.247900828Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.247 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n"}
-{"Time":"2023-03-29T13:37:27.248074095Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.248 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.248118748Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.248 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.267591238Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.267 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.327992838Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.327 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n"}
-{"Time":"2023-03-29T13:37:27.328026983Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.327 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:59384 derp=1 derpdist=1v4:83ms\n"}
-{"Time":"2023-03-29T13:37:27.328082537Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.328 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.328318974Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.328 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:59384 (stun), 172.20.0.2:59384 (local)\n"}
-{"Time":"2023-03-29T13:37:27.328415723Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.328 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.328311263 +0000 UTC m=+3.967918487 Peers:[] LocalAddrs:[{Addr:127.0.0.1:59384 Type:stun} {Addr:172.20.0.2:59384 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.331309331Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:37:27.331346835Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:37:27.331498355Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.331349704 +0000 UTC m=+3.970956931 Peers:[] LocalAddrs:[{Addr:127.0.0.1:59384 Type:stun} {Addr:172.20.0.2:59384 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.331576885Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.083211738}}}\n"}
-{"Time":"2023-03-29T13:37:27.331699503Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:27.328409Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": [\"127.0.0.1:59384\", \"172.20.0.2:59384\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.331945606Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:27.328409Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": [\"127.0.0.1:59384\", \"172.20.0.2:59384\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.33196728Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.332108335Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.332 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.332325739Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.332 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.332542999Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.332 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:27.332444Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.083211738}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": [\"127.0.0.1:59384\", \"172.20.0.2:59384\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.332790784Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.332 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:27.332444Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.083211738}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": [\"127.0.0.1:59384\", \"172.20.0.2:59384\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.333024686Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.332 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.333062782Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.333 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.333182232Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.333 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.333249208Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.333 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.348154607Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.348 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.353941907Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.353 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:37:27.353956013Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.353 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:37:27.353983717Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.353 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:37:27.354104135Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:37:27.354170721Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:37:27.354248787Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.354272858Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.35432815Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.354379756Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.354437701Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.354522443Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.35465091Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:049e454260a62aa1\n"}
-{"Time":"2023-03-29T13:37:27.354686785Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:37:27.354820076Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:37:27.35484141Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:37:27.354884035Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:37:27.354900747Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:37:27.354943262Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.354962224Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:37:27.354997734Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.355013636Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:37:27.355062521Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:37:27.355172916Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:37:27.355579603Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n"}
-{"Time":"2023-03-29T13:37:27.355609674Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:45837 derp=1 derpdist=1v4:83ms\n"}
-{"Time":"2023-03-29T13:37:27.35566873Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.355827579Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:45837 (stun), 172.20.0.2:45837 (local)\n"}
-{"Time":"2023-03-29T13:37:27.355913155Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.355809216 +0000 UTC m=+3.995416428 Peers:[] LocalAddrs:[{Addr:127.0.0.1:45837 Type:stun} {Addr:172.20.0.2:45837 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.356261459Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
-{"Time":"2023-03-29T13:37:27.356354227Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 34688, \"DERPPort\": 43117, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
-{"Time":"2023-03-29T13:37:27.35638277Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
-{"Time":"2023-03-29T13:37:27.356686207Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:37:27.356708299Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:37:27.356723833Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:37:27.356833939Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:37:27.356850125Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:37:27.356945712Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.356968923Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.357036251Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.357070033Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.35711526Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.357134582Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.357249522Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:34ff526bdd502e84\n"}
-{"Time":"2023-03-29T13:37:27.35727419Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:37:27.35742285Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:37:27.357459674Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:37:27.357483314Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:37:27.357523236Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:37:27.357548281Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.357567638Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:37:27.357589503Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.357626515Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:37:27.357652913Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:37:27.357769486Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:37:27.358036076Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.358075196Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.358 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:37:27.358178009Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.358 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
-{"Time":"2023-03-29T13:37:27.358202627Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.358 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
-{"Time":"2023-03-29T13:37:27.358298603Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.358 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.358191Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.363703025Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.363 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:37:27.368878553Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.368 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:37:27.374094674Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.373 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:37:27.379724421Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.379782057Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:37:27.379915271Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.37996992Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:37:27.380020183Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:37:27.380128212Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.380012238 +0000 UTC m=+4.019619457 Peers:[] LocalAddrs:[{Addr:127.0.0.1:45837 Type:stun} {Addr:172.20.0.2:45837 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.380193848Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.082795986}}}\n"}
-{"Time":"2023-03-29T13:37:27.380276172Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.355895Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:45837\", \"172.20.0.2:45837\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.38052742Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.355895Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:45837\", \"172.20.0.2:45837\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.380550207Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.380665436Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.380879187Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:37:27.380925379Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:37:27.380952567Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:37:27.386338613Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.386 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:37:27.387267029Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.387 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:37:27.387774697Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.387 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:37:27.389160607Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.358191Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.389186972Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.389275389Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\n"}
-{"Time":"2023-03-29T13:37:27.389397112Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:37:27.38946191Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:37:27.389582352Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:37:27.389605243Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.389634845Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:37:27.389680241Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:37:27.389711656Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:37:27.389725148Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:37:27.389767299Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.389833677Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.379813Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.390055453Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.379813Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.390076169Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.390126429Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
-{"Time":"2023-03-29T13:37:27.390188645Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:37:27.39025637Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:37:27.390371704Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:37:27.39038785Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.390406815Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:37:27.390435981Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:37:27.390450102Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:37:27.39048039Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:37:27.390509523Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.390585223Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.390644997Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.39085229Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.390753Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.082795986}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:45837\", \"172.20.0.2:45837\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.391046642Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.390753Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.082795986}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:45837\", \"172.20.0.2:45837\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.391253711Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.391 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.391294825Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.391 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.391387255Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.391 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.391491088Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.391 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.408305611Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.408 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:37:27.408340875Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.408 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:37:27.408352182Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.408 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:37:27.408381704Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.408 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:37:27.41114267Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.411 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.41133032Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.411 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n"}
-{"Time":"2023-03-29T13:37:27.411379291Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.411 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:35595 derp=1 derpdist=1v4:84ms\n"}
-{"Time":"2023-03-29T13:37:27.411463359Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.411 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.411622433Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.411 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:35595 (stun), 172.20.0.2:35595 (local)\n"}
-{"Time":"2023-03-29T13:37:27.411704928Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.411 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.411617207 +0000 UTC m=+4.051224425 Peers:[] LocalAddrs:[{Addr:127.0.0.1:35595 Type:stun} {Addr:172.20.0.2:35595 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.412030111Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.411 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
-{"Time":"2023-03-29T13:37:27.412110894Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 51906, \"DERPPort\": 41275, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
-{"Time":"2023-03-29T13:37:27.41214998Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
-{"Time":"2023-03-29T13:37:27.412464057Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
-{"Time":"2023-03-29T13:37:27.412485841Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
-{"Time":"2023-03-29T13:37:27.412515514Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
-{"Time":"2023-03-29T13:37:27.412564627Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
-{"Time":"2023-03-29T13:37:27.412620272Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:37:27.412695891Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.412734645Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.412796459Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.41282973Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.412882896Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.412921148Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.413034159Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:cc502d2065d3910d\n"}
-{"Time":"2023-03-29T13:37:27.413066135Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:37:27.413142789Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:37:27.413196003Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:37:27.413234614Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:37:27.413259313Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:37:27.413291621Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.413317957Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:37:27.413346325Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.413369117Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:37:27.413402783Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:37:27.413518268Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:37:27.413809664Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.413845445Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:37:27.413910962Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
-{"Time":"2023-03-29T13:37:27.413937365Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
-{"Time":"2023-03-29T13:37:27.414017708Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.413933Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.414064655Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:37:27.414111814Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:37:27.414189184Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.414107708 +0000 UTC m=+4.053714921 Peers:[] LocalAddrs:[{Addr:127.0.0.1:35595 Type:stun} {Addr:172.20.0.2:35595 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.414245907Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.083765437}}}\n"}
-{"Time":"2023-03-29T13:37:27.414312155Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.4117Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:35595\", \"172.20.0.2:35595\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.414517803Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.4117Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:35595\", \"172.20.0.2:35595\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.414535126Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.414623995Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.414849045Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:37:27.414905554Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
-{"Time":"2023-03-29T13:37:27.414936416Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:37:27.415525692Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.415 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:37:27.416019712Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.415 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:37:27.416475957Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.416 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:37:27.419029132Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.418 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.419447399Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.419 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.419321Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.083765437}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:35595\", \"172.20.0.2:35595\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.42011877Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.420 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.419321Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.083765437}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:35595\", \"172.20.0.2:35595\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.420376019Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.420 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.420736563Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.420 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.42087992Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.420 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.420979406Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.420 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.422951198Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.422 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n"}
-{"Time":"2023-03-29T13:37:27.42298967Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.422 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:51685 derp=1 derpdist=1v4:84ms\n"}
-{"Time":"2023-03-29T13:37:27.423073917Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.423 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.423298046Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.423 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:51685 (stun), 172.20.0.2:51685 (local)\n"}
-{"Time":"2023-03-29T13:37:27.423385945Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.423 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.423272543 +0000 UTC m=+4.062879776 Peers:[] LocalAddrs:[{Addr:127.0.0.1:51685 Type:stun} {Addr:172.20.0.2:51685 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.424393184Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.424 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:37:27.424445676Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.424 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:37:27.424603665Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.424 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.424442129 +0000 UTC m=+4.064049348 Peers:[] LocalAddrs:[{Addr:127.0.0.1:51685 Type:stun} {Addr:172.20.0.2:51685 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.424655158Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.424 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.084146852}}}\n"}
-{"Time":"2023-03-29T13:37:27.424762683Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.424 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.423371Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": [\"127.0.0.1:51685\", \"172.20.0.2:51685\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.425045855Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.424 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.423371Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": [\"127.0.0.1:51685\", \"172.20.0.2:51685\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.425065382Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.425 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.425204191Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.425 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.425429938Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.425 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.425622509Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.425 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.425514Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.084146852}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": [\"127.0.0.1:51685\", \"172.20.0.2:51685\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.425845165Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.425 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.425514Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.084146852}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": [\"127.0.0.1:51685\", \"172.20.0.2:51685\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.426046304Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.425 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.426095567Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.426 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.426917109Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.426 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.426975294Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.426 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.427132044Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.427 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:59384 derp=1 derpdist=1v4:95ms\n"}
-{"Time":"2023-03-29T13:37:27.427810726Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.408 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
-{"Time":"2023-03-29T13:37:27.427890723Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.427 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.427915145Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.427 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.42800586Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.427 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.428030074Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.427 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.428084359Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.428115313Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
-{"Time":"2023-03-29T13:37:27.428260646Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:9c9ea8075f682592\n"}
-{"Time":"2023-03-29T13:37:27.428283953Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
-{"Time":"2023-03-29T13:37:27.428422249Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
-{"Time":"2023-03-29T13:37:27.428458364Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
-{"Time":"2023-03-29T13:37:27.428479111Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
-{"Time":"2023-03-29T13:37:27.428530647Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
-{"Time":"2023-03-29T13:37:27.428549605Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.428596203Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
-{"Time":"2023-03-29T13:37:27.428629468Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.42866001Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
-{"Time":"2023-03-29T13:37:27.428692965Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
-{"Time":"2023-03-29T13:37:27.42881653Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
-{"Time":"2023-03-29T13:37:27.430284733Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.430 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.094731332}}}\n"}
-{"Time":"2023-03-29T13:37:27.430366553Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.430 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:27.430277Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.094731332}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": [\"127.0.0.1:59384\", \"172.20.0.2:59384\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.430637096Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.430 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:27.430277Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.094731332}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": [\"127.0.0.1:59384\", \"172.20.0.2:59384\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.430871537Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.430 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.430971821Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.430 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:45837 derp=1 derpdist=1v4:37ms\n"}
-{"Time":"2023-03-29T13:37:27.436731495Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.436 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
-{"Time":"2023-03-29T13:37:27.441948864Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.441 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n"}
-{"Time":"2023-03-29T13:37:27.442143804Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.442 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
-{"Time":"2023-03-29T13:37:27.447325985Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.447 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
-{"Time":"2023-03-29T13:37:27.452941046Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.452 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.452978923Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.452 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
-{"Time":"2023-03-29T13:37:27.453138084Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.453213493Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.453354362Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.45343882Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.037239154}}}\n"}
-{"Time":"2023-03-29T13:37:27.453524949Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.453418Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.037239154}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:45837\", \"172.20.0.2:45837\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.453796409Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.453418Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.037239154}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:45837\", \"172.20.0.2:45837\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.454022251Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.454053656Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.454164006Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.454402409Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.454452969Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n"}
-{"Time":"2023-03-29T13:37:27.454661334Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.455180586Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.413933Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.45520381Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.455291748Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\n"}
-{"Time":"2023-03-29T13:37:27.455371391Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:37:27.45558374Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:37:27.455722626Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:37:27.455744892Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.455759263Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:37:27.455811196Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:37:27.455851745Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:37:27.455887337Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:37:27.45593531Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.456026705Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.453Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.456257727Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.453Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": []}}\n"}
-{"Time":"2023-03-29T13:37:27.456275526Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.456348245Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
-{"Time":"2023-03-29T13:37:27.456430865Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
-{"Time":"2023-03-29T13:37:27.456533237Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
-{"Time":"2023-03-29T13:37:27.456666838Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
-{"Time":"2023-03-29T13:37:27.456681257Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.456709567Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
-{"Time":"2023-03-29T13:37:27.456736103Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
-{"Time":"2023-03-29T13:37:27.456785483Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
-{"Time":"2023-03-29T13:37:27.456811479Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
-{"Time":"2023-03-29T13:37:27.456866526Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.456945718Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.457035437Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n"}
-{"Time":"2023-03-29T13:37:27.490404055Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.490 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:35595 derp=1 derpdist=1v4:45ms\n"}
-{"Time":"2023-03-29T13:37:27.490957872Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.490 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:57709 derp=1 derpdist=1v4:31ms\n"}
-{"Time":"2023-03-29T13:37:27.491013794Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.490 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.491185914Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.491 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:57709 (stun), 172.20.0.2:57709 (local)\n"}
-{"Time":"2023-03-29T13:37:27.491295468Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.491 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.491174325 +0000 UTC m=+4.130781564 Peers:[] LocalAddrs:[{Addr:127.0.0.1:57709 Type:stun} {Addr:172.20.0.2:57709 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.491675303Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.491 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.045323829}}}\n"}
-{"Time":"2023-03-29T13:37:27.491767926Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.491 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.491649Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.045323829}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:35595\", \"172.20.0.2:35595\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.492071167Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.491 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.491649Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.045323829}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:35595\", \"172.20.0.2:35595\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.492303429Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.492381183Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.492509729Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.492832285Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:37:27.492955047Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:37:27.493041705Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.492824353 +0000 UTC m=+4.132431585 Peers:[] LocalAddrs:[{Addr:127.0.0.1:57709 Type:stun} {Addr:172.20.0.2:57709 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.493059245Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.031410894}}}\n"}
-{"Time":"2023-03-29T13:37:27.493174012Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.493 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.491286Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:57709\", \"172.20.0.2:57709\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.493508739Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.493 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.491286Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:57709\", \"172.20.0.2:57709\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.493558301Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.493 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.493658522Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.493 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.493954418Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.493 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.49414611Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.494 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.494032Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.031410894}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:57709\", \"172.20.0.2:57709\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.494394917Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.494 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.494032Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.031410894}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:57709\", \"172.20.0.2:57709\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.494635514Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.494 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.494676622Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.494 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.494780288Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.494 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.494840889Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.494 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.495169992Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.495 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:59384 derp=1 derpdist=1v4:64ms\n"}
-{"Time":"2023-03-29T13:37:27.497129169Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.497 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [XHSZg]  ...\n"}
-{"Time":"2023-03-29T13:37:27.497196731Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.497 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:51685 derp=1 derpdist=1v4:71ms\n"}
-{"Time":"2023-03-29T13:37:27.498816504Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.498 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for [XHSZg]\n"}
-{"Time":"2023-03-29T13:37:27.498899237Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.498 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:37:27.498921801Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.498 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [XHSZg] set to derp-1 (their home)\n"}
-{"Time":"2023-03-29T13:37:27.499047332Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.498 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.498914775 +0000 UTC m=+4.138522011 Peers:[] LocalAddrs:[] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.499167908Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.499 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.070836569}}}\n"}
-{"Time":"2023-03-29T13:37:27.499241573Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.499 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.499162Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.070836569}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": [\"127.0.0.1:51685\", \"172.20.0.2:51685\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.49953116Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.499 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.499162Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.070836569}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": [\"127.0.0.1:51685\", \"172.20.0.2:51685\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.499756959Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.499 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.499820527Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.499 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.499954778Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.499 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.500094938Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.500 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.508017322Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.507 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:51993 derp=1 derpdist=1v4:48ms\n"}
-{"Time":"2023-03-29T13:37:27.50805261Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.507 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.508212683Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.508 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:51993 (stun), 172.20.0.2:51993 (local)\n"}
-{"Time":"2023-03-29T13:37:27.508285157Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.508 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.50819775 +0000 UTC m=+4.147804976 Peers:[] LocalAddrs:[{Addr:127.0.0.1:51993 Type:stun} {Addr:172.20.0.2:51993 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.51148228Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.511 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.047681075}}}\n"}
-{"Time":"2023-03-29T13:37:27.511561169Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.511 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.50828Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": [\"127.0.0.1:51993\", \"172.20.0.2:51993\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.511646171Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.511 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [64qRi]  ...\n"}
-{"Time":"2023-03-29T13:37:27.512004191Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.511 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.50828Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": [\"127.0.0.1:51993\", \"172.20.0.2:51993\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.512026173Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.511 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.512131402Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.512 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.512284203Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.512 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [64qRi] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:37:27.512446305Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.512 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.512355Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.047681075}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": [\"127.0.0.1:51993\", \"172.20.0.2:51993\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.512694091Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.512 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.512355Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.047681075}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": [\"127.0.0.1:51993\", \"172.20.0.2:51993\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.512945734Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.512 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.512982501Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.512 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.513074208Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.513 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.513149912Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.513 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.513458516Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.513 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
-{"Time":"2023-03-29T13:37:27.513601111Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.513 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:37:27.514167854Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n"}
-{"Time":"2023-03-29T13:37:27.514216037Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:58992 derp=1 derpdist=1v4:62ms\n"}
-{"Time":"2023-03-29T13:37:27.514270704Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.51443958Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:58992 (stun), 172.20.0.2:58992 (local)\n"}
-{"Time":"2023-03-29T13:37:27.514519618Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.514434952 +0000 UTC m=+4.154042177 Peers:[] LocalAddrs:[{Addr:127.0.0.1:58992 Type:stun} {Addr:172.20.0.2:58992 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.514591409Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.514515Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.514811275Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.514515Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.514831215Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.514927532Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.514969002Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:37:27.51501Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:37:27.515094247Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.515008199 +0000 UTC m=+4.154615430 Peers:[] LocalAddrs:[{Addr:127.0.0.1:58992 Type:stun} {Addr:172.20.0.2:58992 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.515144167Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.062405899}}}\n"}
-{"Time":"2023-03-29T13:37:27.515231182Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.515155Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.062405899}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.515477352Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.515155Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.062405899}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.5157436Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.515810118Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.515944355Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.51603017Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.516114674Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.516 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.520145614Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.520 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [64qRi] d:e6f05f1260bbd611 now using 172.20.0.2:45837\n"}
-{"Time":"2023-03-29T13:37:27.520236787Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.520 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [64qRi]  ...\n"}
-{"Time":"2023-03-29T13:37:27.520381164Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.520 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:37:27.523889233Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.523 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [64qRi]  ...\n"}
-{"Time":"2023-03-29T13:37:27.524071718Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.524 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:37:27.525270748Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n"}
-{"Time":"2023-03-29T13:37:27.525326669Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:34848 derp=1 derpdist=1v4:65ms\n"}
-{"Time":"2023-03-29T13:37:27.525374168Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.525530241Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:34848 (stun), 172.20.0.2:34848 (local)\n"}
-{"Time":"2023-03-29T13:37:27.525639565Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.525526859 +0000 UTC m=+4.165134074 Peers:[] LocalAddrs:[{Addr:127.0.0.1:34848 Type:stun} {Addr:172.20.0.2:34848 Type:local}] DERPs:0}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.525953664Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
-{"Time":"2023-03-29T13:37:27.525977204Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
-{"Time":"2023-03-29T13:37:27.526067972Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.525972278 +0000 UTC m=+4.165579492 Peers:[] LocalAddrs:[{Addr:127.0.0.1:34848 Type:stun} {Addr:172.20.0.2:34848 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.526107105Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.065420657}}}\n"}
-{"Time":"2023-03-29T13:37:27.526188976Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.5256Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.526396168Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.5256Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.526422378Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.526517317Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.526687969Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
-{"Time":"2023-03-29T13:37:27.526875114Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.526766Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.065420657}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.527145691Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.526766Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.065420657}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.527368061Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.527462668Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.527579879Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.52765384Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.531819508Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.531 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:37:27.532053362Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.532237504Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:37:27.5322919Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:37:27.532342787Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:37:27.532383163Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:37:27.532430032Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:27.532468962Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - Starting\n"}
-{"Time":"2023-03-29T13:37:27.532522407Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - Sending handshake initiation\n"}
-{"Time":"2023-03-29T13:37:27.53317143Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.533 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:37:27.533306241Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.533 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:37:27.534331952Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [dv8u3] now active, reconfiguring WireGuard\n"}
-{"Time":"2023-03-29T13:37:27.534386848Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.53460606Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:37:27.534650003Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:37:27.53470262Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:37:27.534744335Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:37:27.534797239Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:27.534834361Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - Starting\n"}
-{"Time":"2023-03-29T13:37:27.535064975Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.535 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - Received handshake initiation\n"}
-{"Time":"2023-03-29T13:37:27.535101365Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.535 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - Sending handshake response\n"}
-{"Time":"2023-03-29T13:37:27.535486164Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.535 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [dv8u3] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:37:27.535646633Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.535 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.535517538 +0000 UTC m=+4.175124762 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370}] LocalAddrs:[{Addr:127.0.0.1:45837 Type:stun} {Addr:172.20.0.2:45837 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.535973095Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.535 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:37:27.536642888Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.536 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - Received handshake response\n"}
-{"Time":"2023-03-29T13:37:27.536713027Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.536 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [dv8u3] d:17b5066de479f458 now using 172.20.0.2:59384\n"}
-{"Time":"2023-03-29T13:37:27.536917351Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.536 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.536783767 +0000 UTC m=+4.176390982 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:27.536635319 +0000 UTC NodeKey:nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24}] LocalAddrs:[{Addr:127.0.0.1:59384 Type:stun} {Addr:172.20.0.2:59384 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.53763406Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.537 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
-{"Time":"2023-03-29T13:37:27.538314662Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.538 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4781:bb82:1540:3954:6a8): sending disco ping to [dv8u3]  ...\n"}
-{"Time":"2023-03-29T13:37:27.542696821Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.542 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:35595 derp=1 derpdist=1v4:9ms\n"}
-{"Time":"2023-03-29T13:37:27.545658947Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.545 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:57709 derp=1 derpdist=1v4:15ms\n"}
-{"Time":"2023-03-29T13:37:27.546526665Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.546 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.014798468}}}\n"}
-{"Time":"2023-03-29T13:37:27.546624395Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.546 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.546513Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.014798468}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:57709\", \"172.20.0.2:57709\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.546899956Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.546 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.546513Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.014798468}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:57709\", \"172.20.0.2:57709\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.547131568Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.547 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.547206358Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.547 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.547317822Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.547 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.548159459Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
-{"Time":"2023-03-29T13:37:27.548281455Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
-{"Time":"2023-03-29T13:37:27.548330701Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:37:27.548397336Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.548439957Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:37:27.548494794Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:37:27.548600181Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.548645011Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.548694237Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - Stopping\n"}
-{"Time":"2023-03-29T13:37:27.548765909Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:37:27.548840457Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:37:27.548886886Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
-{"Time":"2023-03-29T13:37:27.548943901Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
-{"Time":"2023-03-29T13:37:27.549285716Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
-{"Time":"2023-03-29T13:37:27.549325844Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:37:27.549397271Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.549434623Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:37:27.549486154Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:37:27.549569105Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4781:bb82:1540:3954:6a8): sending disco ping to [dv8u3]  ...\n"}
-{"Time":"2023-03-29T13:37:27.54967718Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.549720977Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.549763197Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - Stopping\n"}
-{"Time":"2023-03-29T13:37:27.549846472Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:37:27.55012971Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"    stuntest.go:63: STUN server shutdown\n"}
-{"Time":"2023-03-29T13:37:27.55014656Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Output":"--- PASS: TestAgent_SessionExec (0.86s)\n"}
-{"Time":"2023-03-29T13:37:27.562749894Z","Action":"pass","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionExec","Elapsed":0.86}
-{"Time":"2023-03-29T13:37:27.562803065Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.562 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:51993 derp=1 derpdist=1v4:8ms\n"}
-{"Time":"2023-03-29T13:37:27.563392796Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.563 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [XHSZg]  ...\n"}
-{"Time":"2023-03-29T13:37:27.563801502Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.563 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.008279639}}}\n"}
-{"Time":"2023-03-29T13:37:27.56407208Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.563 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.563776Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.008279639}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": [\"127.0.0.1:51993\", \"172.20.0.2:51993\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.564819316Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.564 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.563776Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.008279639}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": [\"127.0.0.1:51993\", \"172.20.0.2:51993\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.565650461Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.565 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.565870529Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.565 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.566173208Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.566 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.567328308Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.567 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [V4gBN] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:37:27.567693064Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.567 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [XHSZg] d:cc502d2065d3910d now using 127.0.0.1:57709\n"}
-{"Time":"2023-03-29T13:37:27.567994501Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.567 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [XHSZg]  ...\n"}
-{"Time":"2023-03-29T13:37:27.568226707Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.568 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [XHSZg]  ...\n"}
-{"Time":"2023-03-29T13:37:27.56908417Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.568 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.569629095Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.569 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:37:27.569764065Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.569 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:37:27.569899377Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.569 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:37:27.570050145Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.569 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:37:27.57018252Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.570 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:27.570302009Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.570 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - Starting\n"}
-{"Time":"2023-03-29T13:37:27.570580746Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.570 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - Sending keepalive packet\n"}
-{"Time":"2023-03-29T13:37:27.570704044Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.570 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - Sending handshake initiation\n"}
-{"Time":"2023-03-29T13:37:27.571723295Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.571 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [V4gBN] now active, reconfiguring WireGuard\n"}
-{"Time":"2023-03-29T13:37:27.571754224Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.571 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.571960017Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.571 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:37:27.5720063Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.571 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:37:27.572053253Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:37:27.572098018Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:37:27.572143378Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:27.572182651Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - Starting\n"}
-{"Time":"2023-03-29T13:37:27.572412769Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - Received handshake initiation\n"}
-{"Time":"2023-03-29T13:37:27.57244765Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - Sending handshake response\n"}
-{"Time":"2023-03-29T13:37:27.572888396Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.57276895 +0000 UTC m=+4.212376174 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00}] LocalAddrs:[{Addr:127.0.0.1:57709 Type:stun} {Addr:172.20.0.2:57709 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.573422095Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.573 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - Received handshake response\n"}
-{"Time":"2023-03-29T13:37:27.573505226Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.573 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [V4gBN] d:9c9ea8075f682592 now using 172.20.0.2:51993\n"}
-{"Time":"2023-03-29T13:37:27.573673421Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.573 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.573556739 +0000 UTC m=+4.213163954 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:27.573422752 +0000 UTC NodeKey:nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907}] LocalAddrs:[{Addr:127.0.0.1:51993 Type:stun} {Addr:172.20.0.2:51993 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.574036177Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.573 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - Receiving keepalive packet\n"}
-{"Time":"2023-03-29T13:37:27.578151189Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:58992 derp=1 derpdist=1v4:5ms\n"}
-{"Time":"2023-03-29T13:37:27.578464111Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:34848 derp=1 derpdist=1v4:7ms\n"}
-{"Time":"2023-03-29T13:37:27.578697845Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.005291379}}}\n"}
-{"Time":"2023-03-29T13:37:27.578788271Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.578687Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.005291379}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.579040964Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.578687Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.005291379}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.579269912Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.579338921Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.579486192Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.579615554Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.00675754}}}\n"}
-{"Time":"2023-03-29T13:37:27.579715409Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.579606Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.00675754}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.580015856Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.579606Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.00675754}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n"}
-{"Time":"2023-03-29T13:37:27.580200069Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.580 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
-{"Time":"2023-03-29T13:37:27.580263003Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.580 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
-{"Time":"2023-03-29T13:37:27.580357379Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.580 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
-{"Time":"2023-03-29T13:37:27.584912838Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.584 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:836\u003e\t(*agent).init.func2\tssh session returned\t{\"error\": \"exit status 127\"}\n"}
-{"Time":"2023-03-29T13:37:27.585085871Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.585 [WARN]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:1119\u003e\t(*agent).handleSSHSession.func2\tfailed to resize tty ...\n"}
-{"Time":"2023-03-29T13:37:27.58510059Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"        \"error\": pty: closed:\n"}
-{"Time":"2023-03-29T13:37:27.585107445Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"                     github.com/coder/coder/pty.(*otherPty).Close\n"}
-{"Time":"2023-03-29T13:37:27.585113814Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"                         /home/mafredri/src/coder/coder/pty/pty_other.go:134\n"}
-{"Time":"2023-03-29T13:37:27.585512242Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:83: 2023-03-29 13:37:27.585: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:27.585526871Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:74: 2023-03-29 13:37:27.585: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:27.58556302Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:110: 2023-03-29 13:37:27.585: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:27.585579238Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:111: 2023-03-29 13:37:27.585: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:27.585599261Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:113: 2023-03-29 13:37:27.585: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:27.58566446Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:76: 2023-03-29 13:37:27.585: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:27.585677492Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:74: 2023-03-29 13:37:27.585: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:27.585682384Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:76: 2023-03-29 13:37:27.585: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:27.585699939Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:74: 2023-03-29 13:37:27.585: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:27.58570508Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:76: 2023-03-29 13:37:27.585: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:27.585722893Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:102: 2023-03-29 13:37:27.585: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:27.585976831Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.585 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
-{"Time":"2023-03-29T13:37:27.586016625Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.585 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:37:27.586092293Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.586133054Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:37:27.586200024Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:37:27.586329617Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.586371206Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.586499602Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - Stopping\n"}
-{"Time":"2023-03-29T13:37:27.586608393Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:37:27.58672256Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:37:27.586761915Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
-{"Time":"2023-03-29T13:37:27.586833422Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
-{"Time":"2023-03-29T13:37:27.5869144Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
-{"Time":"2023-03-29T13:37:27.58723746Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.587 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
-{"Time":"2023-03-29T13:37:27.58728708Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.587 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:37:27.587374552Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.587 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.587490464Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.587 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4743:8dab:c855:f633:532): sending disco ping to [V4gBN]  ...\n"}
-{"Time":"2023-03-29T13:37:27.587617597Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.587 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.598290287Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.598 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:57709 derp=1 derpdist=1v4:3ms\n"}
-{"Time":"2023-03-29T13:37:27.598667071Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.598 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.598735879Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.598 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:37:27.598824991Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.598 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:37:27.598917706Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.598 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - Stopping\n"}
-{"Time":"2023-03-29T13:37:27.599077451Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.599 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:37:27.599268425Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    stuntest.go:63: STUN server shutdown\n"}
-{"Time":"2023-03-29T13:37:27.599297466Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Output":"--- PASS: TestAgent_SessionTTYExitCode (0.88s)\n"}
-{"Time":"2023-03-29T13:37:27.624884929Z","Action":"pass","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYExitCode","Elapsed":0.88}
-{"Time":"2023-03-29T13:37:27.624923874Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.624 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [5WitN]  ...\n"}
-{"Time":"2023-03-29T13:37:27.625357585Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.625 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [5WitN] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:37:27.626340882Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [5EOvJ] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:37:27.626577093Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [5WitN] d:34ff526bdd502e84 now using 172.20.0.2:34848\n"}
-{"Time":"2023-03-29T13:37:27.626873494Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [5WitN]  ...\n"}
-{"Time":"2023-03-29T13:37:27.627094808Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [5WitN]  ...\n"}
-{"Time":"2023-03-29T13:37:27.627846604Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.627 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.628133034Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:37:27.628178673Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:37:27.628231143Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:37:27.628273924Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:37:27.628326843Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:27.628365041Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Starting\n"}
-{"Time":"2023-03-29T13:37:27.628423532Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Sending handshake initiation\n"}
-{"Time":"2023-03-29T13:37:27.62897967Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [5EOvJ] now active, reconfiguring WireGuard\n"}
-{"Time":"2023-03-29T13:37:27.62904036Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.629335987Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:37:27.629378533Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:37:27.629437221Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:37:27.629484031Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:37:27.629528288Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:27.629564272Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Starting\n"}
-{"Time":"2023-03-29T13:37:27.629899772Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Received handshake initiation\n"}
-{"Time":"2023-03-29T13:37:27.629937538Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Sending handshake response\n"}
-{"Time":"2023-03-29T13:37:27.630550619Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.630 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.630405833 +0000 UTC m=+4.270013057 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c}] LocalAddrs:[{Addr:127.0.0.1:34848 Type:stun} {Addr:172.20.0.2:34848 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.631298672Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.631 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Received handshake response\n"}
-{"Time":"2023-03-29T13:37:27.631395745Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.631 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [5EOvJ] d:049e454260a62aa1 now using 172.20.0.2:58992\n"}
-{"Time":"2023-03-29T13:37:27.631619667Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.631 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.631481797 +0000 UTC m=+4.271089021 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:27.631305354 +0000 UTC NodeKey:nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f}] LocalAddrs:[{Addr:127.0.0.1:58992 Type:stun} {Addr:172.20.0.2:58992 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.632260898Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.632 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [5WitN] d:34ff526bdd502e84 now using 127.0.0.1:34848\n"}
-{"Time":"2023-03-29T13:37:27.637293337Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.637 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [Xlu3R]  ...\n"}
-{"Time":"2023-03-29T13:37:27.637491883Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.637 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [Xlu3R] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:37:27.638607677Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.638 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [uWfac] set to derp-1 (shared home)\n"}
-{"Time":"2023-03-29T13:37:27.6387189Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.638 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [Xlu3R] d:59083cba13956f00 now using 172.20.0.2:35595\n"}
-{"Time":"2023-03-29T13:37:27.638794177Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.638 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [Xlu3R]  ...\n"}
-{"Time":"2023-03-29T13:37:27.638932756Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.638 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [Xlu3R]  ...\n"}
-{"Time":"2023-03-29T13:37:27.639446274Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.639629272Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:37:27.639676449Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:37:27.639710523Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:37:27.639738112Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:37:27.639767671Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:27.639792041Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - Starting\n"}
-{"Time":"2023-03-29T13:37:27.639832214Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - Sending handshake initiation\n"}
-{"Time":"2023-03-29T13:37:27.640359836Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [uWfac] now active, reconfiguring WireGuard\n"}
-{"Time":"2023-03-29T13:37:27.640405214Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
-{"Time":"2023-03-29T13:37:27.640596752Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - UAPI: Created\n"}
-{"Time":"2023-03-29T13:37:27.64062514Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - UAPI: Updating endpoint\n"}
-{"Time":"2023-03-29T13:37:27.640660936Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - UAPI: Removing all allowedips\n"}
-{"Time":"2023-03-29T13:37:27.640688925Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - UAPI: Adding allowedip\n"}
-{"Time":"2023-03-29T13:37:27.640721293Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - UAPI: Updating persistent keepalive interval\n"}
-{"Time":"2023-03-29T13:37:27.640745599Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - Starting\n"}
-{"Time":"2023-03-29T13:37:27.640964666Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - Received handshake initiation\n"}
-{"Time":"2023-03-29T13:37:27.640987155Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - Sending handshake response\n"}
-{"Time":"2023-03-29T13:37:27.641427103Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.641 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.641327519 +0000 UTC m=+4.280934743 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e}] LocalAddrs:[{Addr:127.0.0.1:35595 Type:stun} {Addr:172.20.0.2:35595 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.642337602Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.642 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - Received handshake response\n"}
-{"Time":"2023-03-29T13:37:27.642405776Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.642 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [uWfac] d:c7f1bea9d6ff269c now using 172.20.0.2:51685\n"}
-{"Time":"2023-03-29T13:37:27.642612703Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.642 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.64250087 +0000 UTC m=+4.282108085 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:27.642336966 +0000 UTC NodeKey:nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56}] LocalAddrs:[{Addr:127.0.0.1:51685 Type:stun} {Addr:172.20.0.2:51685 Type:local}] DERPs:1}\", \"err\": null}\n"}
-{"Time":"2023-03-29T13:37:27.64326778Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.643 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [Xlu3R] d:59083cba13956f00 now using 127.0.0.1:35595\n"}
-{"Time":"2023-03-29T13:37:27.648583243Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    agent_test.go:400: \n"}
-{"Time":"2023-03-29T13:37:27.648599647Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"        \tError Trace:\t/home/mafredri/src/coder/coder/agent/agent_test.go:400\n"}
-{"Time":"2023-03-29T13:37:27.648605577Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"        \t            \t\t\t\t/home/mafredri/src/coder/coder/agent/agent_test.go:401\n"}
-{"Time":"2023-03-29T13:37:27.648610117Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"        \tError:      \t\"\" does not contain \"wazzup\"\n"}
-{"Time":"2023-03-29T13:37:27.648616547Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"        \tTest:       \tTestAgent_Session_TTY_FastCommandHasOutput\n"}
-{"Time":"2023-03-29T13:37:27.648621257Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"        \tMessages:   \tshould output greeting\n"}
-{"Time":"2023-03-29T13:37:27.648628226Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:83: 2023-03-29 13:37:27.648: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:27.648632598Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:74: 2023-03-29 13:37:27.648: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:27.648669381Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:110: 2023-03-29 13:37:27.648: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:27.648676209Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:111: 2023-03-29 13:37:27.648: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:27.64868565Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:113: 2023-03-29 13:37:27.648: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:27.648725455Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:76: 2023-03-29 13:37:27.648: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:27.648735417Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:74: 2023-03-29 13:37:27.648: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:27.648742887Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:76: 2023-03-29 13:37:27.648: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:27.648755628Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:74: 2023-03-29 13:37:27.648: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:27.648763111Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:76: 2023-03-29 13:37:27.648: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:27.648781723Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:102: 2023-03-29 13:37:27.648: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:27.64898407Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.648 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
-{"Time":"2023-03-29T13:37:27.64901264Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.648 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:37:27.649065867Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.649092046Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:37:27.649138332Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:37:27.649234264Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.649272903Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.649300503Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Stopping\n"}
-{"Time":"2023-03-29T13:37:27.649378408Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:37:27.649434677Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
-{"Time":"2023-03-29T13:37:27.649514069Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:37:27.649551066Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
-{"Time":"2023-03-29T13:37:27.649591609Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
-{"Time":"2023-03-29T13:37:27.649899898Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
-{"Time":"2023-03-29T13:37:27.649921785Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:37:27.649976578Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.650005597Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:37:27.650053977Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:37:27.650112159Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d): sending disco ping to [5EOvJ]  ...\n"}
-{"Time":"2023-03-29T13:37:27.650212974Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.650252149Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.650280078Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Stopping\n"}
-{"Time":"2023-03-29T13:37:27.650357784Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:37:27.650618927Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    stuntest.go:63: STUN server shutdown\n"}
-{"Time":"2023-03-29T13:37:27.650634125Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"--- FAIL: TestAgent_Session_TTY_FastCommandHasOutput (0.95s)\n"}
-{"Time":"2023-03-29T13:37:27.674793681Z","Action":"fail","Package":"github.com/coder/coder/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Elapsed":0.95}
-{"Time":"2023-03-29T13:37:27.674817479Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.674 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805): sending disco ping to [uWfac]  ...\n"}
-{"Time":"2023-03-29T13:37:27.675734168Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    agent_test.go:235: 2023-03-29 13:37:27.675: cmd: peeked 1/1 bytes = \"$\"\n"}
-{"Time":"2023-03-29T13:37:27.675774216Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    agent_test.go:236: 2023-03-29 13:37:27.675: cmd: stdin: \"echo test\\r\"\n"}
-{"Time":"2023-03-29T13:37:27.676191344Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:121: 2023-03-29 13:37:27.676: cmd: \"$ echo test\"\n"}
-{"Time":"2023-03-29T13:37:27.676273026Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    agent_test.go:237: 2023-03-29 13:37:27.676: cmd: matched \"test\" = \"$ echo test\"\n"}
-{"Time":"2023-03-29T13:37:27.676308536Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    agent_test.go:238: 2023-03-29 13:37:27.676: cmd: stdin: \"exit\\r\"\n"}
-{"Time":"2023-03-29T13:37:27.676642013Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:121: 2023-03-29 13:37:27.676: cmd: \"exit\"\n"}
-{"Time":"2023-03-29T13:37:27.67773278Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:121: 2023-03-29 13:37:27.677: cmd: \"echo test\\r\"\n"}
-{"Time":"2023-03-29T13:37:27.677752958Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:121: 2023-03-29 13:37:27.677: cmd: \"exit\\r\"\n"}
-{"Time":"2023-03-29T13:37:27.67778936Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:121: 2023-03-29 13:37:27.677: cmd: \"test\\r\"\n"}
-{"Time":"2023-03-29T13:37:27.678126711Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:83: 2023-03-29 13:37:27.678: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:27.678143306Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:74: 2023-03-29 13:37:27.678: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:27.678200486Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:110: 2023-03-29 13:37:27.678: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:27.678223246Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:111: 2023-03-29 13:37:27.678: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:27.678238993Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:113: 2023-03-29 13:37:27.678: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:27.678305772Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:76: 2023-03-29 13:37:27.678: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:27.678359399Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:74: 2023-03-29 13:37:27.678: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:27.678373082Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:76: 2023-03-29 13:37:27.678: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:27.678387877Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:74: 2023-03-29 13:37:27.678: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:27.678398091Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:76: 2023-03-29 13:37:27.678: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:27.678444105Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:121: 2023-03-29 13:37:27.678: cmd: \"$ \"\n"}
-{"Time":"2023-03-29T13:37:27.67847139Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:102: 2023-03-29 13:37:27.678: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:27.67876363Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.678 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
-{"Time":"2023-03-29T13:37:27.678920913Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.678 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
-{"Time":"2023-03-29T13:37:27.678978615Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.678 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:37:27.679093854Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.67916374Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:37:27.679261738Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:37:27.679498576Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.679558488Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.679635937Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - Stopping\n"}
-{"Time":"2023-03-29T13:37:27.679772893Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:37:27.679951878Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
-{"Time":"2023-03-29T13:37:27.680029583Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
-{"Time":"2023-03-29T13:37:27.680147794Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.680 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
-{"Time":"2023-03-29T13:37:27.680759898Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.680 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
-{"Time":"2023-03-29T13:37:27.68081749Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.680 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
-{"Time":"2023-03-29T13:37:27.680933631Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.680 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
-{"Time":"2023-03-29T13:37:27.681009542Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.680 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
-{"Time":"2023-03-29T13:37:27.681106332Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.681 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
-{"Time":"2023-03-29T13:37:27.681249372Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.681 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805): sending disco ping to [uWfac]  ...\n"}
-{"Time":"2023-03-29T13:37:27.681454735Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.681 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.681540218Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.681 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
-{"Time":"2023-03-29T13:37:27.68161487Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.681 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - Stopping\n"}
-{"Time":"2023-03-29T13:37:27.681781085Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.681 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
-{"Time":"2023-03-29T13:37:27.682219467Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"    stuntest.go:63: STUN server shutdown\n"}
-{"Time":"2023-03-29T13:37:27.682247508Z","Action":"output","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Output":"--- PASS: TestAgent_SessionTTYShell (0.94s)\n"}
-{"Time":"2023-03-29T13:37:27.682263381Z","Action":"pass","Package":"github.com/coder/coder/agent","Test":"TestAgent_SessionTTYShell","Elapsed":0.94}
-{"Time":"2023-03-29T13:37:27.682278577Z","Action":"output","Package":"github.com/coder/coder/agent","Output":"FAIL\n"}
-{"Time":"2023-03-29T13:37:27.696326667Z","Action":"output","Package":"github.com/coder/coder/agent","Output":"FAIL\tgithub.com/coder/coder/agent\t4.341s\n"}
-{"Time":"2023-03-29T13:37:27.696360103Z","Action":"fail","Package":"github.com/coder/coder/agent","Elapsed":4.341}
-{"Time":"2023-03-29T13:37:32.643934624Z","Action":"start","Package":"github.com/coder/coder/cli"}
-{"Time":"2023-03-29T13:37:32.790842698Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser"}
-{"Time":"2023-03-29T13:37:32.79088125Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser","Output":"=== RUN   TestServerCreateAdminUser\n"}
-{"Time":"2023-03-29T13:37:32.792730073Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK"}
-{"Time":"2023-03-29T13:37:32.792739078Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"=== RUN   TestServerCreateAdminUser/OK\n"}
-{"Time":"2023-03-29T13:37:32.792745576Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"=== PAUSE TestServerCreateAdminUser/OK\n"}
-{"Time":"2023-03-29T13:37:32.79274818Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK"}
-{"Time":"2023-03-29T13:37:32.79275173Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env"}
-{"Time":"2023-03-29T13:37:32.792754236Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"=== RUN   TestServerCreateAdminUser/Env\n"}
-{"Time":"2023-03-29T13:37:32.792759492Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"=== PAUSE TestServerCreateAdminUser/Env\n"}
-{"Time":"2023-03-29T13:37:32.792763227Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env"}
-{"Time":"2023-03-29T13:37:32.792767605Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin"}
-{"Time":"2023-03-29T13:37:32.792772306Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"=== RUN   TestServerCreateAdminUser/Stdin\n"}
-{"Time":"2023-03-29T13:37:32.792778719Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"=== PAUSE TestServerCreateAdminUser/Stdin\n"}
-{"Time":"2023-03-29T13:37:32.792781324Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin"}
-{"Time":"2023-03-29T13:37:32.792785642Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates"}
-{"Time":"2023-03-29T13:37:32.792788132Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"=== RUN   TestServerCreateAdminUser/Validates\n"}
-{"Time":"2023-03-29T13:37:32.792833072Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"=== PAUSE TestServerCreateAdminUser/Validates\n"}
-{"Time":"2023-03-29T13:37:32.792839332Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates"}
-{"Time":"2023-03-29T13:37:32.792849881Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK"}
-{"Time":"2023-03-29T13:37:32.79285277Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"=== CONT  TestServerCreateAdminUser/OK\n"}
-{"Time":"2023-03-29T13:37:32.794003473Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"    server_createadminuser_test.go:87: \n"}
-{"Time":"2023-03-29T13:37:32.794008803Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:87\n"}
-{"Time":"2023-03-29T13:37:32.794012119Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \tError:      \tReceived unexpected error:\n"}
-{"Time":"2023-03-29T13:37:32.794014928Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \tcould not start resource:\n"}
-{"Time":"2023-03-29T13:37:32.794017745Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n"}
-{"Time":"2023-03-29T13:37:32.794020968Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n"}
-{"Time":"2023-03-29T13:37:32.794025025Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n"}
-{"Time":"2023-03-29T13:37:32.794028396Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    \n"}
-{"Time":"2023-03-29T13:37:32.794031694Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n"}
-{"Time":"2023-03-29T13:37:32.794034996Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n"}
-{"Time":"2023-03-29T13:37:32.794038934Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n"}
-{"Time":"2023-03-29T13:37:32.794042353Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n"}
-{"Time":"2023-03-29T13:37:32.794045324Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    github.com/coder/coder/cli_test.TestServerCreateAdminUser.func2\n"}
-{"Time":"2023-03-29T13:37:32.794048191Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:86\n"}
-{"Time":"2023-03-29T13:37:32.794051013Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    testing.tRunner\n"}
-{"Time":"2023-03-29T13:37:32.794053771Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n"}
-{"Time":"2023-03-29T13:37:32.794056664Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    runtime.goexit\n"}
-{"Time":"2023-03-29T13:37:32.794060193Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n"}
-{"Time":"2023-03-29T13:37:32.79406303Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \tTest:       \tTestServerCreateAdminUser/OK\n"}
-{"Time":"2023-03-29T13:37:32.79407275Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Output":"--- FAIL: TestServerCreateAdminUser/OK (0.00s)\n"}
-{"Time":"2023-03-29T13:37:32.794075922Z","Action":"fail","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/OK","Elapsed":0}
-{"Time":"2023-03-29T13:37:32.794079842Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates"}
-{"Time":"2023-03-29T13:37:32.794082413Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"=== CONT  TestServerCreateAdminUser/Validates\n"}
-{"Time":"2023-03-29T13:37:32.795185256Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"    server_createadminuser_test.go:227: \n"}
-{"Time":"2023-03-29T13:37:32.795189907Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:227\n"}
-{"Time":"2023-03-29T13:37:32.795192879Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \tError:      \tReceived unexpected error:\n"}
-{"Time":"2023-03-29T13:37:32.795195707Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \tcould not start resource:\n"}
-{"Time":"2023-03-29T13:37:32.795198569Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n"}
-{"Time":"2023-03-29T13:37:32.795203724Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n"}
-{"Time":"2023-03-29T13:37:32.795206991Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n"}
-{"Time":"2023-03-29T13:37:32.795209975Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    \n"}
-{"Time":"2023-03-29T13:37:32.795212879Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n"}
-{"Time":"2023-03-29T13:37:32.79521788Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n"}
-{"Time":"2023-03-29T13:37:32.795223388Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n"}
-{"Time":"2023-03-29T13:37:32.795228236Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n"}
-{"Time":"2023-03-29T13:37:32.795231388Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    github.com/coder/coder/cli_test.TestServerCreateAdminUser.func5\n"}
-{"Time":"2023-03-29T13:37:32.795234339Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:226\n"}
-{"Time":"2023-03-29T13:37:32.795237524Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    testing.tRunner\n"}
-{"Time":"2023-03-29T13:37:32.795240439Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n"}
-{"Time":"2023-03-29T13:37:32.795243318Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    runtime.goexit\n"}
-{"Time":"2023-03-29T13:37:32.795246653Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n"}
-{"Time":"2023-03-29T13:37:32.795249486Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \tTest:       \tTestServerCreateAdminUser/Validates\n"}
-{"Time":"2023-03-29T13:37:32.795256993Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Output":"--- FAIL: TestServerCreateAdminUser/Validates (0.00s)\n"}
-{"Time":"2023-03-29T13:37:32.795260148Z","Action":"fail","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Validates","Elapsed":0}
-{"Time":"2023-03-29T13:37:32.795262834Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin"}
-{"Time":"2023-03-29T13:37:32.795265403Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"=== CONT  TestServerCreateAdminUser/Stdin\n"}
-{"Time":"2023-03-29T13:37:32.795769577Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"    server_createadminuser_test.go:187: \n"}
-{"Time":"2023-03-29T13:37:32.795774301Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:187\n"}
-{"Time":"2023-03-29T13:37:32.795777433Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \tError:      \tReceived unexpected error:\n"}
-{"Time":"2023-03-29T13:37:32.795782206Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \tcould not start resource:\n"}
-{"Time":"2023-03-29T13:37:32.795787591Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n"}
-{"Time":"2023-03-29T13:37:32.795793763Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n"}
-{"Time":"2023-03-29T13:37:32.795796926Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n"}
-{"Time":"2023-03-29T13:37:32.795799647Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    \n"}
-{"Time":"2023-03-29T13:37:32.795802415Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n"}
-{"Time":"2023-03-29T13:37:32.795805244Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n"}
-{"Time":"2023-03-29T13:37:32.795808186Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n"}
-{"Time":"2023-03-29T13:37:32.79581094Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n"}
-{"Time":"2023-03-29T13:37:32.795813828Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    github.com/coder/coder/cli_test.TestServerCreateAdminUser.func4\n"}
-{"Time":"2023-03-29T13:37:32.79581676Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:186\n"}
-{"Time":"2023-03-29T13:37:32.795819484Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    testing.tRunner\n"}
-{"Time":"2023-03-29T13:37:32.795822305Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n"}
-{"Time":"2023-03-29T13:37:32.795826355Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    runtime.goexit\n"}
-{"Time":"2023-03-29T13:37:32.795829152Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n"}
-{"Time":"2023-03-29T13:37:32.795832058Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \tTest:       \tTestServerCreateAdminUser/Stdin\n"}
-{"Time":"2023-03-29T13:37:32.795846761Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"--- FAIL: TestServerCreateAdminUser/Stdin (0.00s)\n"}
-{"Time":"2023-03-29T13:37:32.79585045Z","Action":"fail","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Stdin","Elapsed":0}
-{"Time":"2023-03-29T13:37:32.795853001Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env"}
-{"Time":"2023-03-29T13:37:32.795855433Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"=== CONT  TestServerCreateAdminUser/Env\n"}
-{"Time":"2023-03-29T13:37:32.796339444Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"    server_createadminuser_test.go:153: \n"}
-{"Time":"2023-03-29T13:37:32.796345738Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:153\n"}
-{"Time":"2023-03-29T13:37:32.796349118Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \tError:      \tReceived unexpected error:\n"}
-{"Time":"2023-03-29T13:37:32.796351839Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \tcould not start resource:\n"}
-{"Time":"2023-03-29T13:37:32.796354772Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n"}
-{"Time":"2023-03-29T13:37:32.796357683Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n"}
-{"Time":"2023-03-29T13:37:32.796360546Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n"}
-{"Time":"2023-03-29T13:37:32.79636323Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    \n"}
-{"Time":"2023-03-29T13:37:32.796366079Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n"}
-{"Time":"2023-03-29T13:37:32.796368987Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n"}
-{"Time":"2023-03-29T13:37:32.79637254Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n"}
-{"Time":"2023-03-29T13:37:32.79637535Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n"}
-{"Time":"2023-03-29T13:37:32.796378207Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    github.com/coder/coder/cli_test.TestServerCreateAdminUser.func3\n"}
-{"Time":"2023-03-29T13:37:32.796381015Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:152\n"}
-{"Time":"2023-03-29T13:37:32.796383831Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    testing.tRunner\n"}
-{"Time":"2023-03-29T13:37:32.796386544Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n"}
-{"Time":"2023-03-29T13:37:32.796389783Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    runtime.goexit\n"}
-{"Time":"2023-03-29T13:37:32.796394885Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n"}
-{"Time":"2023-03-29T13:37:32.796400461Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \tTest:       \tTestServerCreateAdminUser/Env\n"}
-{"Time":"2023-03-29T13:37:32.796405793Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Output":"--- FAIL: TestServerCreateAdminUser/Env (0.00s)\n"}
-{"Time":"2023-03-29T13:37:32.796409018Z","Action":"fail","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser/Env","Elapsed":0}
-{"Time":"2023-03-29T13:37:32.796411751Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser","Output":"--- FAIL: TestServerCreateAdminUser (0.00s)\n"}
-{"Time":"2023-03-29T13:37:32.796414761Z","Action":"fail","Package":"github.com/coder/coder/cli","Test":"TestServerCreateAdminUser","Elapsed":0}
-{"Time":"2023-03-29T13:37:32.796417599Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer"}
-{"Time":"2023-03-29T13:37:32.796420175Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer","Output":"=== RUN   TestServer\n"}
-{"Time":"2023-03-29T13:37:32.796424448Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/Production"}
-{"Time":"2023-03-29T13:37:32.796426853Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"=== RUN   TestServer/Production\n"}
-{"Time":"2023-03-29T13:37:32.797198344Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"    server_test.go:109: \n"}
-{"Time":"2023-03-29T13:37:32.797204437Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_test.go:109\n"}
-{"Time":"2023-03-29T13:37:32.797207471Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \tError:      \tReceived unexpected error:\n"}
-{"Time":"2023-03-29T13:37:32.797210203Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \tcould not start resource:\n"}
-{"Time":"2023-03-29T13:37:32.797213234Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n"}
-{"Time":"2023-03-29T13:37:32.797216169Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n"}
-{"Time":"2023-03-29T13:37:32.797219132Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n"}
-{"Time":"2023-03-29T13:37:32.797221978Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t    \n"}
-{"Time":"2023-03-29T13:37:32.797224749Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n"}
-{"Time":"2023-03-29T13:37:32.797227673Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n"}
-{"Time":"2023-03-29T13:37:32.797230597Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t    github.com/coder/coder/coderd/database/postgres.Open\n"}
-{"Time":"2023-03-29T13:37:32.797234931Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n"}
-{"Time":"2023-03-29T13:37:32.797243511Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t    github.com/coder/coder/cli_test.TestServer.func1\n"}
-{"Time":"2023-03-29T13:37:32.797248163Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_test.go:108\n"}
-{"Time":"2023-03-29T13:37:32.79725113Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t    testing.tRunner\n"}
-{"Time":"2023-03-29T13:37:32.797253983Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n"}
-{"Time":"2023-03-29T13:37:32.797257318Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t    runtime.goexit\n"}
-{"Time":"2023-03-29T13:37:32.797261252Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n"}
-{"Time":"2023-03-29T13:37:32.797266495Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"        \tTest:       \tTestServer/Production\n"}
-{"Time":"2023-03-29T13:37:32.797274297Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Output":"--- FAIL: TestServer/Production (0.00s)\n"}
-{"Time":"2023-03-29T13:37:32.797277522Z","Action":"fail","Package":"github.com/coder/coder/cli","Test":"TestServer/Production","Elapsed":0}
-{"Time":"2023-03-29T13:37:32.797280535Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres"}
-{"Time":"2023-03-29T13:37:32.797283019Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"=== RUN   TestServer/BuiltinPostgres\n"}
-{"Time":"2023-03-29T13:37:32.797286137Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"=== PAUSE TestServer/BuiltinPostgres\n"}
-{"Time":"2023-03-29T13:37:32.797288614Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres"}
-{"Time":"2023-03-29T13:37:32.797294343Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL"}
-{"Time":"2023-03-29T13:37:32.797296802Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"=== RUN   TestServer/BuiltinPostgresURL\n"}
-{"Time":"2023-03-29T13:37:32.797299815Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"=== PAUSE TestServer/BuiltinPostgresURL\n"}
-{"Time":"2023-03-29T13:37:32.797302293Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL"}
-{"Time":"2023-03-29T13:37:32.797306699Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw"}
-{"Time":"2023-03-29T13:37:32.797309403Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"=== RUN   TestServer/BuiltinPostgresURLRaw\n"}
-{"Time":"2023-03-29T13:37:32.79731478Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"=== PAUSE TestServer/BuiltinPostgresURLRaw\n"}
-{"Time":"2023-03-29T13:37:32.797319293Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw"}
-{"Time":"2023-03-29T13:37:32.797324667Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL"}
-{"Time":"2023-03-29T13:37:32.797328467Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"=== RUN   TestServer/LocalAccessURL\n"}
-{"Time":"2023-03-29T13:37:32.797331431Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"=== PAUSE TestServer/LocalAccessURL\n"}
-{"Time":"2023-03-29T13:37:32.797333768Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL"}
-{"Time":"2023-03-29T13:37:32.797341584Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL"}
-{"Time":"2023-03-29T13:37:32.797345334Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"=== RUN   TestServer/RemoteAccessURL\n"}
-{"Time":"2023-03-29T13:37:32.79737723Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"=== PAUSE TestServer/RemoteAccessURL\n"}
-{"Time":"2023-03-29T13:37:32.797380853Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL"}
-{"Time":"2023-03-29T13:37:32.797385247Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL"}
-{"Time":"2023-03-29T13:37:32.797387813Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"=== RUN   TestServer/NoWarningWithRemoteAccessURL\n"}
-{"Time":"2023-03-29T13:37:32.797405636Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"=== PAUSE TestServer/NoWarningWithRemoteAccessURL\n"}
-{"Time":"2023-03-29T13:37:32.797408839Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL"}
-{"Time":"2023-03-29T13:37:32.797426981Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/NoSchemeAccessURL"}
-{"Time":"2023-03-29T13:37:32.797430439Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoSchemeAccessURL","Output":"=== RUN   TestServer/NoSchemeAccessURL\n"}
-{"Time":"2023-03-29T13:37:32.797434847Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoSchemeAccessURL","Output":"=== PAUSE TestServer/NoSchemeAccessURL\n"}
-{"Time":"2023-03-29T13:37:32.797437343Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/NoSchemeAccessURL"}
-{"Time":"2023-03-29T13:37:32.797445885Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadVersion"}
-{"Time":"2023-03-29T13:37:32.797448325Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadVersion","Output":"=== RUN   TestServer/TLSBadVersion\n"}
-{"Time":"2023-03-29T13:37:32.797466497Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadVersion","Output":"=== PAUSE TestServer/TLSBadVersion\n"}
-{"Time":"2023-03-29T13:37:32.797471662Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadVersion"}
-{"Time":"2023-03-29T13:37:32.797476114Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadClientAuth"}
-{"Time":"2023-03-29T13:37:32.797478506Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadClientAuth","Output":"=== RUN   TestServer/TLSBadClientAuth\n"}
-{"Time":"2023-03-29T13:37:32.797495642Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadClientAuth","Output":"=== PAUSE TestServer/TLSBadClientAuth\n"}
-{"Time":"2023-03-29T13:37:32.79750134Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadClientAuth"}
-{"Time":"2023-03-29T13:37:32.797508036Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid"}
-{"Time":"2023-03-29T13:37:32.797510579Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid","Output":"=== RUN   TestServer/TLSInvalid\n"}
-{"Time":"2023-03-29T13:37:32.797525872Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid","Output":"=== PAUSE TestServer/TLSInvalid\n"}
-{"Time":"2023-03-29T13:37:32.797528971Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid"}
-{"Time":"2023-03-29T13:37:32.797533231Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid"}
-{"Time":"2023-03-29T13:37:32.797535658Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"=== RUN   TestServer/TLSValid\n"}
-{"Time":"2023-03-29T13:37:32.797552494Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"=== PAUSE TestServer/TLSValid\n"}
-{"Time":"2023-03-29T13:37:32.797556455Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid"}
-{"Time":"2023-03-29T13:37:32.797560606Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple"}
-{"Time":"2023-03-29T13:37:32.797563041Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"=== RUN   TestServer/TLSValidMultiple\n"}
-{"Time":"2023-03-29T13:37:32.797579028Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"=== PAUSE TestServer/TLSValidMultiple\n"}
-{"Time":"2023-03-29T13:37:32.797582214Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple"}
-{"Time":"2023-03-29T13:37:32.797586334Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP"}
-{"Time":"2023-03-29T13:37:32.797588893Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"=== RUN   TestServer/TLSAndHTTP\n"}
-{"Time":"2023-03-29T13:37:32.797623711Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"=== PAUSE TestServer/TLSAndHTTP\n"}
-{"Time":"2023-03-29T13:37:32.797626474Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP"}
-{"Time":"2023-03-29T13:37:32.797631971Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect"}
-{"Time":"2023-03-29T13:37:32.797634471Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect","Output":"=== RUN   TestServer/TLSRedirect\n"}
-{"Time":"2023-03-29T13:37:32.797650491Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect","Output":"=== PAUSE TestServer/TLSRedirect\n"}
-{"Time":"2023-03-29T13:37:32.797654521Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect"}
-{"Time":"2023-03-29T13:37:32.797659191Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4"}
-{"Time":"2023-03-29T13:37:32.797661727Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"=== RUN   TestServer/CanListenUnspecifiedv4\n"}
-{"Time":"2023-03-29T13:37:32.797677081Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"=== PAUSE TestServer/CanListenUnspecifiedv4\n"}
-{"Time":"2023-03-29T13:37:32.797679898Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4"}
-{"Time":"2023-03-29T13:37:32.797685398Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6"}
-{"Time":"2023-03-29T13:37:32.797688055Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"=== RUN   TestServer/CanListenUnspecifiedv6\n"}
-{"Time":"2023-03-29T13:37:32.797706704Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"=== PAUSE TestServer/CanListenUnspecifiedv6\n"}
-{"Time":"2023-03-29T13:37:32.797710667Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6"}
-{"Time":"2023-03-29T13:37:32.797714823Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/NoAddress"}
-{"Time":"2023-03-29T13:37:32.797717235Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoAddress","Output":"=== RUN   TestServer/NoAddress\n"}
-{"Time":"2023-03-29T13:37:32.797732629Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoAddress","Output":"=== PAUSE TestServer/NoAddress\n"}
-{"Time":"2023-03-29T13:37:32.797735715Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/NoAddress"}
-{"Time":"2023-03-29T13:37:32.797739744Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/NoTLSAddress"}
-{"Time":"2023-03-29T13:37:32.797742309Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoTLSAddress","Output":"=== RUN   TestServer/NoTLSAddress\n"}
-{"Time":"2023-03-29T13:37:32.797754504Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoTLSAddress","Output":"=== PAUSE TestServer/NoTLSAddress\n"}
-{"Time":"2023-03-29T13:37:32.797757251Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/NoTLSAddress"}
-{"Time":"2023-03-29T13:37:32.797762513Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress"}
-{"Time":"2023-03-29T13:37:32.797764941Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress","Output":"=== RUN   TestServer/DeprecatedAddress\n"}
-{"Time":"2023-03-29T13:37:32.797791112Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress","Output":"=== PAUSE TestServer/DeprecatedAddress\n"}
-{"Time":"2023-03-29T13:37:32.797794156Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress"}
-{"Time":"2023-03-29T13:37:32.797818478Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown"}
-{"Time":"2023-03-29T13:37:32.797821565Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown","Output":"=== RUN   TestServer/Shutdown\n"}
-{"Time":"2023-03-29T13:37:32.799148069Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerShutdown1335635398/002 server --in-memory --http-address :0 --access-url http://example.com --provisioner-daemons 1 --cache-dir /tmp/TestServerShutdown1335635398/001\n"}
-{"Time":"2023-03-29T13:37:32.799996289Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:39611\n"}
-{"Time":"2023-03-29T13:37:32.803857037Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
-{"Time":"2023-03-29T13:37:32.820483862Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:32.840616097Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:32.840652908Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:32.840837548Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:32.840996757Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:32.841130055Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:32.843139909Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown","Output":"--- PASS: TestServer/Shutdown (0.05s)\n"}
-{"Time":"2023-03-29T13:37:32.843152696Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/Shutdown","Elapsed":0.05}
-{"Time":"2023-03-29T13:37:32.843181686Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak"}
-{"Time":"2023-03-29T13:37:32.843185961Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"=== RUN   TestServer/TracerNoLeak\n"}
-{"Time":"2023-03-29T13:37:32.84324137Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"=== PAUSE TestServer/TracerNoLeak\n"}
-{"Time":"2023-03-29T13:37:32.843248162Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak"}
-{"Time":"2023-03-29T13:37:32.84327344Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry"}
-{"Time":"2023-03-29T13:37:32.843276473Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"=== RUN   TestServer/Telemetry\n"}
-{"Time":"2023-03-29T13:37:32.843298273Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"=== PAUSE TestServer/Telemetry\n"}
-{"Time":"2023-03-29T13:37:32.843301329Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry"}
-{"Time":"2023-03-29T13:37:32.843328619Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus"}
-{"Time":"2023-03-29T13:37:32.843332448Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"=== RUN   TestServer/Prometheus\n"}
-{"Time":"2023-03-29T13:37:32.843360436Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"=== PAUSE TestServer/Prometheus\n"}
-{"Time":"2023-03-29T13:37:32.843363322Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus"}
-{"Time":"2023-03-29T13:37:32.843393432Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth"}
-{"Time":"2023-03-29T13:37:32.843398556Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"=== RUN   TestServer/GitHubOAuth\n"}
-{"Time":"2023-03-29T13:37:32.843457011Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"=== PAUSE TestServer/GitHubOAuth\n"}
-{"Time":"2023-03-29T13:37:32.843461316Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth"}
-{"Time":"2023-03-29T13:37:32.843486876Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit"}
-{"Time":"2023-03-29T13:37:32.84349017Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit","Output":"=== RUN   TestServer/RateLimit\n"}
-{"Time":"2023-03-29T13:37:32.843512128Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit","Output":"=== PAUSE TestServer/RateLimit\n"}
-{"Time":"2023-03-29T13:37:32.843515107Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit"}
-{"Time":"2023-03-29T13:37:32.843530012Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging"}
-{"Time":"2023-03-29T13:37:32.843532716Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging","Output":"=== RUN   TestServer/Logging\n"}
-{"Time":"2023-03-29T13:37:32.843562048Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging","Output":"=== PAUSE TestServer/Logging\n"}
-{"Time":"2023-03-29T13:37:32.843565639Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging"}
-{"Time":"2023-03-29T13:37:32.843591297Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres"}
-{"Time":"2023-03-29T13:37:32.843594335Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"=== CONT  TestServer/BuiltinPostgres\n"}
-{"Time":"2023-03-29T13:37:32.845419328Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerBuiltinPostgres1969653008/002 server --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerBuiltinPostgres1969653008/001\n"}
-{"Time":"2023-03-29T13:37:32.846522439Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Using built-in PostgreSQL (/tmp/TestServerBuiltinPostgres1969653008/002/postgres)\n"}
-{"Time":"2023-03-29T13:37:32.847782539Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging"}
-{"Time":"2023-03-29T13:37:32.847787939Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging","Output":"=== CONT  TestServer/Logging\n"}
-{"Time":"2023-03-29T13:37:32.847793104Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile"}
-{"Time":"2023-03-29T13:37:32.847797472Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"=== RUN   TestServer/Logging/CreatesFile\n"}
-{"Time":"2023-03-29T13:37:32.847809954Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"=== PAUSE TestServer/Logging/CreatesFile\n"}
-{"Time":"2023-03-29T13:37:32.847814894Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile"}
-{"Time":"2023-03-29T13:37:32.847821007Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human"}
-{"Time":"2023-03-29T13:37:32.847823557Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"=== RUN   TestServer/Logging/Human\n"}
-{"Time":"2023-03-29T13:37:32.847827971Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"=== PAUSE TestServer/Logging/Human\n"}
-{"Time":"2023-03-29T13:37:32.847830572Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human"}
-{"Time":"2023-03-29T13:37:32.847846314Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON"}
-{"Time":"2023-03-29T13:37:32.847849769Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"=== RUN   TestServer/Logging/JSON\n"}
-{"Time":"2023-03-29T13:37:32.847855516Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"=== PAUSE TestServer/Logging/JSON\n"}
-{"Time":"2023-03-29T13:37:32.847858116Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON"}
-{"Time":"2023-03-29T13:37:32.847862399Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver"}
-{"Time":"2023-03-29T13:37:32.847864919Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"=== RUN   TestServer/Logging/Stackdriver\n"}
-{"Time":"2023-03-29T13:37:32.847879575Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"=== PAUSE TestServer/Logging/Stackdriver\n"}
-{"Time":"2023-03-29T13:37:32.847884818Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver"}
-{"Time":"2023-03-29T13:37:32.847891759Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple"}
-{"Time":"2023-03-29T13:37:32.847894796Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"=== RUN   TestServer/Logging/Multiple\n"}
-{"Time":"2023-03-29T13:37:32.847919729Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"=== PAUSE TestServer/Logging/Multiple\n"}
-{"Time":"2023-03-29T13:37:32.847922769Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple"}
-{"Time":"2023-03-29T13:37:32.847927067Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile"}
-{"Time":"2023-03-29T13:37:32.847929708Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"=== CONT  TestServer/Logging/CreatesFile\n"}
-{"Time":"2023-03-29T13:37:32.848797106Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerLoggingCreatesFile2700332728/002 server --verbose --in-memory --http-address :0 --access-url http://example.com --log-human /tmp/TestServerLoggingCreatesFile2700332728/001/coder-logging-test-2490710733\n"}
-{"Time":"2023-03-29T13:37:32.849489309Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:46231\n"}
-{"Time":"2023-03-29T13:37:32.849644524Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit"}
-{"Time":"2023-03-29T13:37:32.849648931Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit","Output":"=== CONT  TestServer/RateLimit\n"}
-{"Time":"2023-03-29T13:37:32.849654201Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default"}
-{"Time":"2023-03-29T13:37:32.849658963Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"=== RUN   TestServer/RateLimit/Default\n"}
-{"Time":"2023-03-29T13:37:32.849673813Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"=== PAUSE TestServer/RateLimit/Default\n"}
-{"Time":"2023-03-29T13:37:32.849676949Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default"}
-{"Time":"2023-03-29T13:37:32.849690853Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed"}
-{"Time":"2023-03-29T13:37:32.849694907Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"=== RUN   TestServer/RateLimit/Changed\n"}
-{"Time":"2023-03-29T13:37:32.849700056Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"=== PAUSE TestServer/RateLimit/Changed\n"}
-{"Time":"2023-03-29T13:37:32.849702697Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed"}
-{"Time":"2023-03-29T13:37:32.849706931Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled"}
-{"Time":"2023-03-29T13:37:32.849709323Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"=== RUN   TestServer/RateLimit/Disabled\n"}
-{"Time":"2023-03-29T13:37:32.849713561Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"=== PAUSE TestServer/RateLimit/Disabled\n"}
-{"Time":"2023-03-29T13:37:32.849716093Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled"}
-{"Time":"2023-03-29T13:37:32.849720102Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default"}
-{"Time":"2023-03-29T13:37:32.849722411Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"=== CONT  TestServer/RateLimit/Default\n"}
-{"Time":"2023-03-29T13:37:32.850485755Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerRateLimitDefault1881118474/001 server --in-memory --http-address :0 --access-url http://example.com\n"}
-{"Time":"2023-03-29T13:37:32.851011889Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:38127\n"}
-{"Time":"2023-03-29T13:37:32.851175576Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth"}
-{"Time":"2023-03-29T13:37:32.851180015Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"=== CONT  TestServer/GitHubOAuth\n"}
-{"Time":"2023-03-29T13:37:32.851983967Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerGitHubOAuth724593823/001 server --in-memory --http-address :0 --access-url http://example.com --oauth2-github-allow-everyone --oauth2-github-client-id fake --oauth2-github-client-secret fake --oauth2-github-enterprise-base-url https://fake-url.com\n"}
-{"Time":"2023-03-29T13:37:32.852521551Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:33313\n"}
-{"Time":"2023-03-29T13:37:32.852663734Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus"}
-{"Time":"2023-03-29T13:37:32.852668353Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"=== CONT  TestServer/Prometheus\n"}
-{"Time":"2023-03-29T13:37:32.853556318Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerPrometheus2050744846/002 server --in-memory --http-address :0 --access-url http://example.com --provisioner-daemons 1 --prometheus-enable --prometheus-address :37569 --cache-dir /tmp/TestServerPrometheus2050744846/001\n"}
-{"Time":"2023-03-29T13:37:32.854050354Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:38381\n"}
-{"Time":"2023-03-29T13:37:32.854220704Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry"}
-{"Time":"2023-03-29T13:37:32.854225473Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"=== CONT  TestServer/Telemetry\n"}
-{"Time":"2023-03-29T13:37:32.855113604Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTelemetry4206954660/002 server --in-memory --http-address :0 --access-url http://example.com --telemetry --telemetry-url http://127.0.0.1:46805 --cache-dir /tmp/TestServerTelemetry4206954660/001\n"}
-{"Time":"2023-03-29T13:37:32.855607409Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:46851\n"}
-{"Time":"2023-03-29T13:37:32.855759635Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak"}
-{"Time":"2023-03-29T13:37:32.85576445Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"=== CONT  TestServer/TracerNoLeak\n"}
-{"Time":"2023-03-29T13:37:32.856575033Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTracerNoLeak127485117/002 server --in-memory --http-address :0 --access-url http://example.com --trace=true --cache-dir /tmp/TestServerTracerNoLeak127485117/001\n"}
-{"Time":"2023-03-29T13:37:32.859583574Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress"}
-{"Time":"2023-03-29T13:37:32.859590623Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress","Output":"=== CONT  TestServer/DeprecatedAddress\n"}
-{"Time":"2023-03-29T13:37:32.859595635Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP"}
-{"Time":"2023-03-29T13:37:32.859598523Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"=== RUN   TestServer/DeprecatedAddress/HTTP\n"}
-{"Time":"2023-03-29T13:37:32.860822192Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/NoTLSAddress"}
-{"Time":"2023-03-29T13:37:32.860826569Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoTLSAddress","Output":"=== CONT  TestServer/NoTLSAddress\n"}
-{"Time":"2023-03-29T13:37:32.861575027Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoTLSAddress","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerNoTLSAddress2369561878/001 server --in-memory --tls-enable=true --tls-address \n"}
-{"Time":"2023-03-29T13:37:32.861999568Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoTLSAddress","Output":"--- PASS: TestServer/NoTLSAddress (0.00s)\n"}
-{"Time":"2023-03-29T13:37:32.863329199Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/NoTLSAddress","Elapsed":0}
-{"Time":"2023-03-29T13:37:32.863344025Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/NoAddress"}
-{"Time":"2023-03-29T13:37:32.863348554Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoAddress","Output":"=== CONT  TestServer/NoAddress\n"}
-{"Time":"2023-03-29T13:37:32.864056037Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoAddress","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerNoAddress3728350894/001 server --in-memory --http-address :80 --tls-enable=false --tls-address \n"}
-{"Time":"2023-03-29T13:37:32.864465815Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoAddress","Output":"--- PASS: TestServer/NoAddress (0.00s)\n"}
-{"Time":"2023-03-29T13:37:32.865769258Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/NoAddress","Elapsed":0}
-{"Time":"2023-03-29T13:37:32.865776672Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6"}
-{"Time":"2023-03-29T13:37:32.865779982Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"=== CONT  TestServer/CanListenUnspecifiedv6\n"}
-{"Time":"2023-03-29T13:37:32.866452947Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerCanListenUnspecifiedv63515544106/001 server --in-memory --http-address [::]:0 --access-url http://example.com\n"}
-{"Time":"2023-03-29T13:37:32.86788654Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4"}
-{"Time":"2023-03-29T13:37:32.867892077Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"=== CONT  TestServer/CanListenUnspecifiedv4\n"}
-{"Time":"2023-03-29T13:37:32.868594181Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerCanListenUnspecifiedv43698525072/001 server --in-memory --http-address 0.0.0.0:0 --access-url http://example.com\n"}
-{"Time":"2023-03-29T13:37:32.87981375Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect"}
-{"Time":"2023-03-29T13:37:32.879832688Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect","Output":"=== CONT  TestServer/TLSRedirect\n"}
-{"Time":"2023-03-29T13:37:32.879840427Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK"}
-{"Time":"2023-03-29T13:37:32.879843579Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"=== RUN   TestServer/TLSRedirect/OK\n"}
-{"Time":"2023-03-29T13:37:32.879847493Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"=== PAUSE TestServer/TLSRedirect/OK\n"}
-{"Time":"2023-03-29T13:37:32.879850007Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK"}
-{"Time":"2023-03-29T13:37:32.879858919Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect"}
-{"Time":"2023-03-29T13:37:32.87986153Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"=== RUN   TestServer/TLSRedirect/NoRedirect\n"}
-{"Time":"2023-03-29T13:37:32.879868217Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"=== PAUSE TestServer/TLSRedirect/NoRedirect\n"}
-{"Time":"2023-03-29T13:37:32.879871031Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect"}
-{"Time":"2023-03-29T13:37:32.879882319Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard"}
-{"Time":"2023-03-29T13:37:32.879885302Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"=== RUN   TestServer/TLSRedirect/NoRedirectWithWildcard\n"}
-{"Time":"2023-03-29T13:37:32.879901278Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"=== PAUSE TestServer/TLSRedirect/NoRedirectWithWildcard\n"}
-{"Time":"2023-03-29T13:37:32.879904339Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard"}
-{"Time":"2023-03-29T13:37:32.879917091Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener"}
-{"Time":"2023-03-29T13:37:32.879920112Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"=== RUN   TestServer/TLSRedirect/NoTLSListener\n"}
-{"Time":"2023-03-29T13:37:32.881385273Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP"}
-{"Time":"2023-03-29T13:37:32.881392419Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"=== CONT  TestServer/TLSAndHTTP\n"}
-{"Time":"2023-03-29T13:37:32.883317205Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSAndHTTP1565439063/003 server --in-memory --http-address :0 --access-url https://example.com --tls-enable --tls-redirect-http-to-https=false --tls-address :0 --tls-cert-file /tmp/TestServerTLSAndHTTP1565439063/001/1540336369 --tls-key-file /tmp/TestServerTLSAndHTTP1565439063/001/228555534 --cache-dir /tmp/TestServerTLSAndHTTP1565439063/002\n"}
-{"Time":"2023-03-29T13:37:32.886709195Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple"}
-{"Time":"2023-03-29T13:37:32.886720913Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"=== CONT  TestServer/TLSValidMultiple\n"}
-{"Time":"2023-03-29T13:37:32.888650035Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSValidMultiple3077156975/004 server --in-memory --http-address  --access-url https://example.com --tls-enable --tls-address :0 --tls-cert-file /tmp/TestServerTLSValidMultiple3077156975/001/3448842699 --tls-key-file /tmp/TestServerTLSValidMultiple3077156975/001/3382329005 --tls-cert-file /tmp/TestServerTLSValidMultiple3077156975/002/610618616 --tls-key-file /tmp/TestServerTLSValidMultiple3077156975/002/3728409390 --cache-dir /tmp/TestServerTLSValidMultiple3077156975/003\n"}
-{"Time":"2023-03-29T13:37:32.889032741Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid"}
-{"Time":"2023-03-29T13:37:32.889040091Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"=== CONT  TestServer/TLSValid\n"}
-{"Time":"2023-03-29T13:37:32.890094104Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSValid1911968885/003 server --in-memory --http-address  --access-url https://example.com --tls-enable --tls-address :0 --tls-cert-file /tmp/TestServerTLSValid1911968885/001/91528180 --tls-key-file /tmp/TestServerTLSValid1911968885/001/1223943395 --cache-dir /tmp/TestServerTLSValid1911968885/002\n"}
-{"Time":"2023-03-29T13:37:32.890711151Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: Started TLS/HTTPS listener at https://[::]:38747\n"}
-{"Time":"2023-03-29T13:37:32.893432414Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid"}
-{"Time":"2023-03-29T13:37:32.893439577Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid","Output":"=== CONT  TestServer/TLSInvalid\n"}
-{"Time":"2023-03-29T13:37:32.895534213Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoCert"}
-{"Time":"2023-03-29T13:37:32.895540534Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"=== RUN   TestServer/TLSInvalid/NoCert\n"}
-{"Time":"2023-03-29T13:37:32.895545749Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"=== PAUSE TestServer/TLSInvalid/NoCert\n"}
-{"Time":"2023-03-29T13:37:32.895548511Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoCert"}
-{"Time":"2023-03-29T13:37:32.89555469Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoKey"}
-{"Time":"2023-03-29T13:37:32.895559989Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"=== RUN   TestServer/TLSInvalid/NoKey\n"}
-{"Time":"2023-03-29T13:37:32.895564748Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"=== PAUSE TestServer/TLSInvalid/NoKey\n"}
-{"Time":"2023-03-29T13:37:32.895567562Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoKey"}
-{"Time":"2023-03-29T13:37:32.895571832Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCount"}
-{"Time":"2023-03-29T13:37:32.895574371Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"=== RUN   TestServer/TLSInvalid/MismatchedCount\n"}
-{"Time":"2023-03-29T13:37:32.895579082Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"=== PAUSE TestServer/TLSInvalid/MismatchedCount\n"}
-{"Time":"2023-03-29T13:37:32.895581688Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCount"}
-{"Time":"2023-03-29T13:37:32.895586121Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey"}
-{"Time":"2023-03-29T13:37:32.895588766Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"=== RUN   TestServer/TLSInvalid/MismatchedCertAndKey\n"}
-{"Time":"2023-03-29T13:37:32.895593302Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"=== PAUSE TestServer/TLSInvalid/MismatchedCertAndKey\n"}
-{"Time":"2023-03-29T13:37:32.895595797Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey"}
-{"Time":"2023-03-29T13:37:32.895598709Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoCert"}
-{"Time":"2023-03-29T13:37:32.895601189Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"=== CONT  TestServer/TLSInvalid/NoCert\n"}
-{"Time":"2023-03-29T13:37:32.896383938Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSInvalidNoCert155343146/002 server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidNoCert155343146/001 --tls-enable --tls-key-file /tmp/TestServerTLSInvalid1610620518/001/1816833089\n"}
-{"Time":"2023-03-29T13:37:32.896712838Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:41521\n"}
-{"Time":"2023-03-29T13:37:32.896777738Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"    server_test.go:344: args: [server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidNoCert155343146/001 --tls-enable --tls-key-file /tmp/TestServerTLSInvalid1610620518/001/1816833089]\n"}
-{"Time":"2023-03-29T13:37:32.896926023Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"--- PASS: TestServer/TLSInvalid/NoCert (0.00s)\n"}
-{"Time":"2023-03-29T13:37:32.896932574Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoCert","Elapsed":0}
-{"Time":"2023-03-29T13:37:32.896936656Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadClientAuth"}
-{"Time":"2023-03-29T13:37:32.896939204Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadClientAuth","Output":"=== CONT  TestServer/TLSBadClientAuth\n"}
-{"Time":"2023-03-29T13:37:32.897600801Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadClientAuth","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSBadClientAuth2976087810/002 server --in-memory --http-address  --access-url http://example.com --tls-enable --tls-address :0 --tls-client-auth something --cache-dir /tmp/TestServerTLSBadClientAuth2976087810/001\n"}
-{"Time":"2023-03-29T13:37:32.897994004Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadClientAuth","Output":"--- PASS: TestServer/TLSBadClientAuth (0.00s)\n"}
-{"Time":"2023-03-29T13:37:32.898002196Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadClientAuth","Elapsed":0}
-{"Time":"2023-03-29T13:37:32.89800515Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadVersion"}
-{"Time":"2023-03-29T13:37:32.898008134Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadVersion","Output":"=== CONT  TestServer/TLSBadVersion\n"}
-{"Time":"2023-03-29T13:37:32.898635976Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadVersion","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSBadVersion2460276843/002 server --in-memory --http-address  --access-url http://example.com --tls-enable --tls-address :0 --tls-min-version tls9 --cache-dir /tmp/TestServerTLSBadVersion2460276843/001\n"}
-{"Time":"2023-03-29T13:37:32.899017393Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadVersion","Output":"--- PASS: TestServer/TLSBadVersion (0.00s)\n"}
-{"Time":"2023-03-29T13:37:32.899025249Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSBadVersion","Elapsed":0}
-{"Time":"2023-03-29T13:37:32.899028489Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/NoSchemeAccessURL"}
-{"Time":"2023-03-29T13:37:32.899031117Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoSchemeAccessURL","Output":"=== CONT  TestServer/NoSchemeAccessURL\n"}
-{"Time":"2023-03-29T13:37:32.899735022Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoSchemeAccessURL","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerNoSchemeAccessURL3227162288/002 server --in-memory --http-address :0 --access-url google.com --cache-dir /tmp/TestServerNoSchemeAccessURL3227162288/001\n"}
-{"Time":"2023-03-29T13:37:32.900078052Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoSchemeAccessURL","Output":"--- PASS: TestServer/NoSchemeAccessURL (0.00s)\n"}
-{"Time":"2023-03-29T13:37:32.900133291Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/NoSchemeAccessURL","Elapsed":0}
-{"Time":"2023-03-29T13:37:32.900136928Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL"}
-{"Time":"2023-03-29T13:37:32.900139387Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"=== CONT  TestServer/NoWarningWithRemoteAccessURL\n"}
-{"Time":"2023-03-29T13:37:32.900802695Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerNoWarningWithRemoteAccessURL2261451002/002 server --in-memory --http-address :0 --access-url https://google.com --cache-dir /tmp/TestServerNoWarningWithRemoteAccessURL2261451002/001\n"}
-{"Time":"2023-03-29T13:37:32.901428258Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL"}
-{"Time":"2023-03-29T13:37:32.901434866Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"=== CONT  TestServer/RemoteAccessURL\n"}
-{"Time":"2023-03-29T13:37:32.902088159Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerRemoteAccessURL917985260/002 server --in-memory --http-address :0 --access-url https://foobarbaz.mydomain --cache-dir /tmp/TestServerRemoteAccessURL917985260/001\n"}
-{"Time":"2023-03-29T13:37:32.904875871Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL"}
-{"Time":"2023-03-29T13:37:32.90488445Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"=== CONT  TestServer/LocalAccessURL\n"}
-{"Time":"2023-03-29T13:37:32.905523425Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerLocalAccessURL3554694382/002 server --in-memory --http-address :0 --access-url http://localhost:3000/ --cache-dir /tmp/TestServerLocalAccessURL3554694382/001\n"}
-{"Time":"2023-03-29T13:37:32.909203431Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw"}
-{"Time":"2023-03-29T13:37:32.909214782Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"=== CONT  TestServer/BuiltinPostgresURLRaw\n"}
-{"Time":"2023-03-29T13:37:32.90987112Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerBuiltinPostgresURLRaw2301128244/001 server postgres-builtin-url --raw-url\n"}
-{"Time":"2023-03-29T13:37:32.910387857Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL"}
-{"Time":"2023-03-29T13:37:32.910393909Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"=== CONT  TestServer/BuiltinPostgresURL\n"}
-{"Time":"2023-03-29T13:37:32.911031385Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerBuiltinPostgresURL2022412164/001 server postgres-builtin-url\n"}
-{"Time":"2023-03-29T13:37:32.911696996Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple"}
-{"Time":"2023-03-29T13:37:32.911705024Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"=== CONT  TestServer/Logging/Multiple\n"}
-{"Time":"2023-03-29T13:37:32.912435053Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerLoggingMultiple1018156314/004 server --verbose --in-memory --http-address :0 --access-url http://example.com --log-human /tmp/TestServerLoggingMultiple1018156314/001/coder-logging-test-2240709984 --log-json /tmp/TestServerLoggingMultiple1018156314/002/coder-logging-test-2164710923 --log-stackdriver /tmp/TestServerLoggingMultiple1018156314/003/coder-logging-test-3557853095\n"}
-{"Time":"2023-03-29T13:37:32.912514796Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver"}
-{"Time":"2023-03-29T13:37:32.912520309Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"=== CONT  TestServer/Logging/Stackdriver\n"}
-{"Time":"2023-03-29T13:37:32.913204422Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerLoggingStackdriver1654522233/002 server --verbose --in-memory --http-address :0 --access-url http://example.com --log-stackdriver /tmp/TestServerLoggingStackdriver1654522233/001/coder-logging-test-3531177805\n"}
-{"Time":"2023-03-29T13:37:32.913286393Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON"}
-{"Time":"2023-03-29T13:37:32.913292549Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"=== CONT  TestServer/Logging/JSON\n"}
-{"Time":"2023-03-29T13:37:32.913937207Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerLoggingJSON1509288451/002 server --verbose --in-memory --http-address :0 --access-url http://example.com --log-json /tmp/TestServerLoggingJSON1509288451/001/coder-logging-test-115410787\n"}
-{"Time":"2023-03-29T13:37:32.913982029Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human"}
-{"Time":"2023-03-29T13:37:32.913985447Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"=== CONT  TestServer/Logging/Human\n"}
-{"Time":"2023-03-29T13:37:32.914664441Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerLoggingHuman1910502850/002 server --verbose --in-memory --http-address :0 --access-url http://example.com --log-human /tmp/TestServerLoggingHuman1910502850/001/coder-logging-test-2040592756\n"}
-{"Time":"2023-03-29T13:37:32.915201663Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:42891\n"}
-{"Time":"2023-03-29T13:37:32.915334373Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled"}
-{"Time":"2023-03-29T13:37:32.91533902Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"=== CONT  TestServer/RateLimit/Disabled\n"}
-{"Time":"2023-03-29T13:37:32.915962046Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerRateLimitDisabled1912095220/001 server --in-memory --http-address :0 --access-url http://example.com --api-rate-limit -1\n"}
-{"Time":"2023-03-29T13:37:32.916390927Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:35065\n"}
-{"Time":"2023-03-29T13:37:32.917528951Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:32.917 [WARN]\t\u003cgithub.com/coder/coder/cli/server.go:310\u003e\t(*RootCmd).Server.func1\tstart telemetry exporter ...\n"}
-{"Time":"2023-03-29T13:37:32.917535354Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"          \"error\": default exporter:\n"}
-{"Time":"2023-03-29T13:37:32.917538568Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"                       github.com/coder/coder/coderd/tracing.TracerProvider\n"}
-{"Time":"2023-03-29T13:37:32.917543903Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"                           /home/mafredri/src/coder/coder/coderd/tracing/exporter.go:51\n"}
-{"Time":"2023-03-29T13:37:32.917547458Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"                     - create otlp exporter:\n"}
-{"Time":"2023-03-29T13:37:32.917552386Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"                       github.com/coder/coder/coderd/tracing.DefaultExporter\n"}
-{"Time":"2023-03-29T13:37:32.917557328Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"                           /home/mafredri/src/coder/coder/coderd/tracing/exporter.go:109\n"}
-{"Time":"2023-03-29T13:37:32.917562236Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"                     - context canceled\n"}
-{"Time":"2023-03-29T13:37:32.917576569Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:42093\n"}
-{"Time":"2023-03-29T13:37:32.917619611Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stderr: \u001b[1;mWARN: \u001b[0mThe access URL  \u001b[;mhttp://example.com\u001b[0m  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\n"}
-{"Time":"2023-03-29T13:37:32.917642615Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
-{"Time":"2023-03-29T13:37:32.920130044Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:32.920155751Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:32.920178993Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:32.920200709Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:32.920249847Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"=== PAUSE TestServer/DeprecatedAddress/HTTP\n"}
-{"Time":"2023-03-29T13:37:32.92025399Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP"}
-{"Time":"2023-03-29T13:37:32.920269801Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS"}
-{"Time":"2023-03-29T13:37:32.920274896Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"=== RUN   TestServer/DeprecatedAddress/TLS\n"}
-{"Time":"2023-03-29T13:37:32.920279669Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"=== PAUSE TestServer/DeprecatedAddress/TLS\n"}
-{"Time":"2023-03-29T13:37:32.920282197Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS"}
-{"Time":"2023-03-29T13:37:32.92570047Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"=== PAUSE TestServer/TLSRedirect/NoTLSListener\n"}
-{"Time":"2023-03-29T13:37:32.92570807Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener"}
-{"Time":"2023-03-29T13:37:32.925713393Z","Action":"run","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener"}
-{"Time":"2023-03-29T13:37:32.92571595Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"=== RUN   TestServer/TLSRedirect/NoHTTPListener\n"}
-{"Time":"2023-03-29T13:37:32.925720434Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"=== PAUSE TestServer/TLSRedirect/NoHTTPListener\n"}
-{"Time":"2023-03-29T13:37:32.925722986Z","Action":"pause","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener"}
-{"Time":"2023-03-29T13:37:32.92724642Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.927: cmd: \"Started HTTP listener at http://[::]:39671\"\n"}
-{"Time":"2023-03-29T13:37:32.927965116Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.927: cmd: \"Started HTTP listener at http://[::]:42445\"\n"}
-{"Time":"2023-03-29T13:37:32.928006932Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.927: cmd: \"WARN: The access URL  http://localhost:3000/  isn't externally reachable, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\"\n"}
-{"Time":"2023-03-29T13:37:32.928023919Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.928: cmd: \"                                                                                                                                                                                                       \\r\"\n"}
-{"Time":"2023-03-29T13:37:32.92802928Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.928: cmd: \"                                       \"\n"}
-{"Time":"2023-03-29T13:37:32.928042009Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.928: cmd: \"View the Web UI: http://localhost:3000/\\r\"\n"}
-{"Time":"2023-03-29T13:37:32.928061275Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.928: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:32.928077795Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.928: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:32.973554406Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    server_test.go:173: 2023-03-29 13:37:32.973: cmd: matched newline = \"postgres://coder@localhost:43211/coder?sslmode=disable\u0026password=Xha7Pt7Mcuv0IlkT\"\n"}
-{"Time":"2023-03-29T13:37:32.973585539Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:83: 2023-03-29 13:37:32.973: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:32.973602051Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:74: 2023-03-29 13:37:32.973: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:32.973653232Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:110: 2023-03-29 13:37:32.973: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:32.973673734Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:111: 2023-03-29 13:37:32.973: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:32.973681952Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:113: 2023-03-29 13:37:32.973: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:32.973745487Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:76: 2023-03-29 13:37:32.973: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:32.973755467Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:74: 2023-03-29 13:37:32.973: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:32.973767632Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:76: 2023-03-29 13:37:32.973: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:32.973787295Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:74: 2023-03-29 13:37:32.973: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:32.973794335Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:76: 2023-03-29 13:37:32.973: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:32.973897477Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    server_test.go:161: 2023-03-29 13:37:32.973: cmd: matched \"psql\" = \" psql\"\n"}
-{"Time":"2023-03-29T13:37:32.973911816Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:83: 2023-03-29 13:37:32.973: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:32.97395369Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:74: 2023-03-29 13:37:32.973: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:32.973977688Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:110: 2023-03-29 13:37:32.973: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:32.973985059Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:111: 2023-03-29 13:37:32.973: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:32.974011895Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:113: 2023-03-29 13:37:32.973: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:32.974059281Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:76: 2023-03-29 13:37:32.974: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:32.974066822Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:74: 2023-03-29 13:37:32.974: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:32.974073474Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:76: 2023-03-29 13:37:32.974: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:32.974079891Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:74: 2023-03-29 13:37:32.974: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:32.974111815Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:76: 2023-03-29 13:37:32.974: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:32.976190183Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:32.976 [DEBUG]\t\u003cgithub.com/coder/coder/cli/server.go:260\u003e\t(*RootCmd).Server.func1\tstarted debug logging\n"}
-{"Time":"2023-03-29T13:37:32.976499482Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:45725\n"}
-{"Time":"2023-03-29T13:37:32.977583615Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:32.977594677Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed"}
-{"Time":"2023-03-29T13:37:32.977598319Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"=== CONT  TestServer/RateLimit/Changed\n"}
-{"Time":"2023-03-29T13:37:32.979536902Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerRateLimitChanged2140102987/001 server --in-memory --http-address :0 --access-url http://example.com --api-rate-limit 100\n"}
-{"Time":"2023-03-29T13:37:32.981248381Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:45133\n"}
-{"Time":"2023-03-29T13:37:32.982290561Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:32.982: cmd: \"Started HTTP listener at http://0.0.0.0:37181\"\n"}
-{"Time":"2023-03-29T13:37:32.982961159Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    server_test.go:718: 2023-03-29 13:37:32.982: cmd: matched \"Started HTTP listener\" = \"Started HTTP listener\"\n"}
-{"Time":"2023-03-29T13:37:32.983105329Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    server_test.go:719: 2023-03-29 13:37:32.983: cmd: matched \"http://0.0.0.0:\" = \" at http://0.0.0.0:\"\n"}
-{"Time":"2023-03-29T13:37:32.983250515Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:32.983: cmd: \"Started HTTP listener at http://[::]:33561\"\n"}
-{"Time":"2023-03-29T13:37:32.984671213Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    server_test.go:738: 2023-03-29 13:37:32.983: cmd: matched \"Started HTTP listener at\" = \"Started HTTP listener at\"\n"}
-{"Time":"2023-03-29T13:37:32.984712571Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    server_test.go:739: 2023-03-29 13:37:32.983: cmd: matched \"http://[::]:\" = \" http://[::]:\"\n"}
-{"Time":"2023-03-29T13:37:32.984733017Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
-{"Time":"2023-03-29T13:37:32.996108891Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:32.996314264Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
-{"Time":"2023-03-29T13:37:33.00125555Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:33.001437292Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
-{"Time":"2023-03-29T13:37:33.002347544Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
-{"Time":"2023-03-29T13:37:33.00471704Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:33.004816922Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stderr: \u001b[1;mWARN: \u001b[0mThe access URL  \u001b[;mhttp://example.com\u001b[0m  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\n"}
-{"Time":"2023-03-29T13:37:33.004828798Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
-{"Time":"2023-03-29T13:37:33.008304441Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:33.008334151Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:33.008344183Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:33.008351448Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:33.008401366Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 3...\n"}
-{"Time":"2023-03-29T13:37:33.00852168Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 3\n"}
-{"Time":"2023-03-29T13:37:33.008558749Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP"}
-{"Time":"2023-03-29T13:37:33.008572474Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"=== CONT  TestServer/DeprecatedAddress/HTTP\n"}
-{"Time":"2023-03-29T13:37:33.009297224Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerDeprecatedAddressHTTP1174595269/002 server --in-memory --address :0 --access-url http://example.com --cache-dir /tmp/TestServerDeprecatedAddressHTTP1174595269/001\n"}
-{"Time":"2023-03-29T13:37:33.011200842Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    server_test.go:196: 2023-03-29 13:37:33.011: cmd: matched \"this may cause unexpected problems when creating workspaces\" = \"Started HTTP listener at http://[::]:42445\\r\\nWARN: The access URL  http://localhost:3000/  isn't externally reachable, this may cause unexpected problems when creating workspaces\"\n"}
-{"Time":"2023-03-29T13:37:33.011256139Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    server_test.go:197: 2023-03-29 13:37:33.011: cmd: matched \"View the Web UI: http://localhost:3000/\" = \". Generate a unique *.try.coder.app URL by not specifying an access URL.\\r\\n                                                                                                                                                                                                       \\r\\r\\n                                       \\r\\nView the Web UI: http://localhost:3000/\"\n"}
-{"Time":"2023-03-29T13:37:33.011375838Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: \u001b[1;mWARN: \u001b[0mThe access URL  \u001b[;mhttp://example.com\u001b[0m  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\n"}
-{"Time":"2023-03-29T13:37:33.01139606Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
-{"Time":"2023-03-29T13:37:33.013674142Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:33.013696745Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:33.013708678Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:33.013717271Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:33.013756177Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 3...\n"}
-{"Time":"2023-03-29T13:37:33.013807024Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:33.013 [DEBUG]\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:553\u003e\t(*Server).closeWithError\tclosing server with error\t{\"error\": null}\n"}
-{"Time":"2023-03-29T13:37:33.013861318Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 3\n"}
-{"Time":"2023-03-29T13:37:33.014354405Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:121: 2023-03-29 13:37:33.014: cmd: \"postgres://coder@localhost:43211/coder?sslmode=disable\u0026password=Xha7Pt7Mcuv0IlkT\"\n"}
-{"Time":"2023-03-29T13:37:33.014367303Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:102: 2023-03-29 13:37:33.014: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:33.01451535Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"--- PASS: TestServer/BuiltinPostgresURLRaw (0.11s)\n"}
-{"Time":"2023-03-29T13:37:33.014525519Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURLRaw","Elapsed":0.11}
-{"Time":"2023-03-29T13:37:33.014534922Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK"}
-{"Time":"2023-03-29T13:37:33.014543883Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"=== CONT  TestServer/TLSRedirect/OK\n"}
-{"Time":"2023-03-29T13:37:33.01571179Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSRedirectOK4195649967/003 server --in-memory --cache-dir /tmp/TestServerTLSRedirectOK4195649967/002 --http-address :0 --tls-enable --tls-address :0 --tls-cert-file /tmp/TestServerTLSRedirectOK4195649967/001/1898764516 --tls-key-file /tmp/TestServerTLSRedirectOK4195649967/001/3656697468 --wildcard-access-url *.example.com --access-url https://example.com --redirect-to-access-url\n"}
-{"Time":"2023-03-29T13:37:33.015887089Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.015: cmd: \" psql \\\"postgres://coder@localhost:43265/coder?sslmode=disable\u0026password=qZX0YVm9trLHmHzY\\\" \"\n"}
-{"Time":"2023-03-29T13:37:33.015903823Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:102: 2023-03-29 13:37:33.015: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:33.016045291Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Output":"--- PASS: TestServer/BuiltinPostgresURL (0.11s)\n"}
-{"Time":"2023-03-29T13:37:33.01632566Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgresURL","Elapsed":0.11}
-{"Time":"2023-03-29T13:37:33.016345189Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:33.022419375Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
-{"Time":"2023-03-29T13:37:33.099478164Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:33.138846249Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:121: 2023-03-29 13:37:33.137: cmd: \"Started TLS/HTTPS listener at https://[::]:46747\"\n"}
-{"Time":"2023-03-29T13:37:33.138887737Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 1...\n"}
-{"Time":"2023-03-29T13:37:33.138894754Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 1\n"}
-{"Time":"2023-03-29T13:37:33.138900199Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 2...\n"}
-{"Time":"2023-03-29T13:37:33.138905607Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 2\n"}
-{"Time":"2023-03-29T13:37:33.138911333Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:33.141820899Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:33.140 [DEBUG]\t(coderd.metrics_cache)\t\u003cgithub.com/coder/coder/coderd/metricscache/metricscache.go:272\u003e\t(*Cache).run\tdeployment stats metrics refreshed\t{\"took\": \"23.786µs\", \"interval\": \"30s\"}\n"}
-{"Time":"2023-03-29T13:37:33.141862791Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:33.141 [DEBUG]\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:200\u003e\t(*Server).connect\tconnected\n"}
-{"Time":"2023-03-29T13:37:33.141871378Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:33.141 [DEBUG]\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:200\u003e\t(*Server).connect\tconnected\n"}
-{"Time":"2023-03-29T13:37:33.14187713Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 1...\n"}
-{"Time":"2023-03-29T13:37:33.141883292Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:33.141 [DEBUG]\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:553\u003e\t(*Server).closeWithError\tclosing server with error\t{\"error\": null}\n"}
-{"Time":"2023-03-29T13:37:33.141893432Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 1\n"}
-{"Time":"2023-03-29T13:37:33.141898548Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 2...\n"}
-{"Time":"2023-03-29T13:37:33.141959656Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:33.141 [DEBUG]\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:553\u003e\t(*Server).closeWithError\tclosing server with error\t{\"error\": null}\n"}
-{"Time":"2023-03-29T13:37:33.142091685Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 2\n"}
-{"Time":"2023-03-29T13:37:33.142184362Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:33.142408919Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stderr: \u001b[1;mWARN: \u001b[0mThe access URL  \u001b[;mhttp://example.com\u001b[0m  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\n"}
-{"Time":"2023-03-29T13:37:33.142501883Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
-{"Time":"2023-03-29T13:37:33.147218812Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:33.147251166Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:33.14725864Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:33.147298554Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:33.147355456Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 3...\n"}
-{"Time":"2023-03-29T13:37:33.14745485Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 3\n"}
-{"Time":"2023-03-29T13:37:33.148482198Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey"}
-{"Time":"2023-03-29T13:37:33.148502985Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"=== CONT  TestServer/TLSInvalid/MismatchedCertAndKey\n"}
-{"Time":"2023-03-29T13:37:33.149452866Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSInvalidMismatchedCertAndKey978167281/002 server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidMismatchedCertAndKey978167281/001 --tls-enable --tls-cert-file /tmp/TestServerTLSInvalid1610620518/001/3088514081 --tls-key-file /tmp/TestServerTLSInvalid1610620518/002/2775674587\n"}
-{"Time":"2023-03-29T13:37:33.149984351Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:38873\n"}
-{"Time":"2023-03-29T13:37:33.150363114Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"    server_test.go:344: args: [server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidMismatchedCertAndKey978167281/001 --tls-enable --tls-cert-file /tmp/TestServerTLSInvalid1610620518/001/3088514081 --tls-key-file /tmp/TestServerTLSInvalid1610620518/002/2775674587]\n"}
-{"Time":"2023-03-29T13:37:33.150581402Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"--- PASS: TestServer/TLSInvalid/MismatchedCertAndKey (0.00s)\n"}
-{"Time":"2023-03-29T13:37:33.15059771Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Elapsed":0}
-{"Time":"2023-03-29T13:37:33.150605526Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCount"}
-{"Time":"2023-03-29T13:37:33.150609996Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"=== CONT  TestServer/TLSInvalid/MismatchedCount\n"}
-{"Time":"2023-03-29T13:37:33.151854633Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSInvalidMismatchedCount803880522/002 server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidMismatchedCount803880522/001 --tls-enable --tls-cert-file /tmp/TestServerTLSInvalid1610620518/001/3088514081 --tls-key-file /tmp/TestServerTLSInvalid1610620518/001/1816833089 --tls-cert-file /tmp/TestServerTLSInvalid1610620518/002/3269350839\n"}
-{"Time":"2023-03-29T13:37:33.152410162Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:37839\n"}
-{"Time":"2023-03-29T13:37:33.15252017Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"    server_test.go:344: args: [server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidMismatchedCount803880522/001 --tls-enable --tls-cert-file /tmp/TestServerTLSInvalid1610620518/001/3088514081 --tls-key-file /tmp/TestServerTLSInvalid1610620518/001/1816833089 --tls-cert-file /tmp/TestServerTLSInvalid1610620518/002/3269350839]\n"}
-{"Time":"2023-03-29T13:37:33.152732054Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"--- PASS: TestServer/TLSInvalid/MismatchedCount (0.00s)\n"}
-{"Time":"2023-03-29T13:37:33.152746399Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Elapsed":0}
-{"Time":"2023-03-29T13:37:33.152754347Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoKey"}
-{"Time":"2023-03-29T13:37:33.152758935Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"=== CONT  TestServer/TLSInvalid/NoKey\n"}
-{"Time":"2023-03-29T13:37:33.153794977Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSInvalidNoKey281486761/002 server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidNoKey281486761/001 --tls-enable --tls-cert-file /tmp/TestServerTLSInvalid1610620518/001/3088514081\n"}
-{"Time":"2023-03-29T13:37:33.154207106Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:43607\n"}
-{"Time":"2023-03-29T13:37:33.15427222Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"    server_test.go:344: args: [server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidNoKey281486761/001 --tls-enable --tls-cert-file /tmp/TestServerTLSInvalid1610620518/001/3088514081]\n"}
-{"Time":"2023-03-29T13:37:33.154468443Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"--- PASS: TestServer/TLSInvalid/NoKey (0.00s)\n"}
-{"Time":"2023-03-29T13:37:33.154623549Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid/NoKey","Elapsed":0}
-{"Time":"2023-03-29T13:37:33.154633176Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid","Output":"--- PASS: TestServer/TLSInvalid (0.00s)\n"}
-{"Time":"2023-03-29T13:37:33.154761857Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSInvalid","Elapsed":0}
-{"Time":"2023-03-29T13:37:33.154770493Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.154: cmd: \"WARN: The access URL  http://example.com  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\"\n"}
-{"Time":"2023-03-29T13:37:33.439719632Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"                                                                                                                                                                                              \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.43976961Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"                                   \"\n"}
-{"Time":"2023-03-29T13:37:33.439791036Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"View the Web UI: http://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.439807711Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.43982432Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.439851264Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:33.439869598Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:33.439886994Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.439905518Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:33.439924649Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.439941905Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:83: 2023-03-29 13:37:33.439: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:33.4399588Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:74: 2023-03-29 13:37:33.439: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:33.440230934Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:33.440: cmd: \"Started HTTP listener at http://[::]:45645\"\n"}
-{"Time":"2023-03-29T13:37:33.440246712Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:33.440: cmd: \"Started TLS/HTTPS listener at https://[::]:33779\"\n"}
-{"Time":"2023-03-29T13:37:33.440251896Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    server_test.go:634: 2023-03-29 13:37:33.440: cmd: matched \"Started HTTP listener at\" = \"Started HTTP listener at\"\n"}
-{"Time":"2023-03-29T13:37:33.440278535Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    server_test.go:635: 2023-03-29 13:37:33.440: cmd: ReadLine ctx has no deadline, using 10s\n"}
-{"Time":"2023-03-29T13:37:33.440295931Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    server_test.go:635: 2023-03-29 13:37:33.440: cmd: matched newline = \" http://[::]:45645\"\n"}
-{"Time":"2023-03-29T13:37:33.440327613Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    server_test.go:641: 2023-03-29 13:37:33.440: cmd: matched \"Started TLS/HTTPS listener at\" = \"Started TLS/HTTPS listener at\"\n"}
-{"Time":"2023-03-29T13:37:33.440339171Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    server_test.go:642: 2023-03-29 13:37:33.440: cmd: ReadLine ctx has no deadline, using 10s\n"}
-{"Time":"2023-03-29T13:37:33.440353544Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    server_test.go:642: 2023-03-29 13:37:33.440: cmd: matched newline = \" https://[::]:33779\"\n"}
-{"Time":"2023-03-29T13:37:33.462318671Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.155: cmd: \"WARN: Redirect HTTP to HTTPS is deprecated, please use Redirect to Access URL instead.\"\n"}
-{"Time":"2023-03-29T13:37:33.462349606Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"                                                                                \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.462356521Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"Started HTTP listener at http://[::]:38281\"\n"}
-{"Time":"2023-03-29T13:37:33.462372929Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"WARN: --tls-redirect-http-to-https is deprecated, please use --redirect-to-access-url instead\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.462395287Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"Started TLS/HTTPS listener at https://[::]:37895\"\n"}
-{"Time":"2023-03-29T13:37:33.46242925Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"                                    \"\n"}
-{"Time":"2023-03-29T13:37:33.462438148Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"View the Web UI: https://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.462469497Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.462484536Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.462637037Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:76: 2023-03-29 13:37:33.462: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.462649797Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:33.462659463Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.462670357Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:33.462694313Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.462718576Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:110: 2023-03-29 13:37:33.462: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:33.46272687Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:111: 2023-03-29 13:37:33.462: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:33.462736639Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:113: 2023-03-29 13:37:33.462: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:33.462758116Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:74: 2023-03-29 13:37:33.462: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:33.462768617Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:76: 2023-03-29 13:37:33.462: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.462788026Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:74: 2023-03-29 13:37:33.462: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:33.462795774Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:76: 2023-03-29 13:37:33.462: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.462816156Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:102: 2023-03-29 13:37:33.462: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:33.462931778Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"--- PASS: TestServer/CanListenUnspecifiedv4 (0.60s)\n"}
-{"Time":"2023-03-29T13:37:33.462940935Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv4","Elapsed":0.6}
-{"Time":"2023-03-29T13:37:33.462948149Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener"}
-{"Time":"2023-03-29T13:37:33.462952114Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"=== CONT  TestServer/TLSRedirect/NoHTTPListener\n"}
-{"Time":"2023-03-29T13:37:33.464080755Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSRedirectNoHTTPListener857312755/003 server --in-memory --cache-dir /tmp/TestServerTLSRedirectNoHTTPListener857312755/002 --http-address  --tls-enable --tls-address :0 --tls-cert-file /tmp/TestServerTLSRedirectNoHTTPListener857312755/001/774178655 --tls-key-file /tmp/TestServerTLSRedirectNoHTTPListener857312755/001/2109956146 --wildcard-access-url *.example.com --access-url https://example.com\n"}
-{"Time":"2023-03-29T13:37:33.464227163Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:33.464: cmd: \"                                    \"\n"}
-{"Time":"2023-03-29T13:37:33.464240384Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:33.464: cmd: \"View the Web UI: https://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.464252515Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:33.464: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.46428589Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:33.464: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.472563896Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.155: cmd: \"WARN: The access URL  http://example.com  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\"\n"}
-{"Time":"2023-03-29T13:37:33.472612391Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                                                                                                                                                                                              \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.47263698Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                                   \"\n"}
-{"Time":"2023-03-29T13:37:33.472648847Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"View the Web UI: http://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.472703374Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.472714667Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.473028818Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:33.473041801Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:33.473048085Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.473053454Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:33.47305943Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.473064898Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:33.473070019Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.473075028Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:33.473080237Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.47308794Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    server_test.go:488: 2023-03-29 13:37:33.472: cmd: matched \"Started HTTP listener at\" = \"WARN: Redirect HTTP to HTTPS is deprecated, please use Redirect to Access URL instead.\\r\\n                                                                                \\r\\r\\nStarted HTTP listener at\"\n"}
-{"Time":"2023-03-29T13:37:33.473094939Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    server_test.go:489: 2023-03-29 13:37:33.472: cmd: ReadLine ctx has no deadline, using 10s\n"}
-{"Time":"2023-03-29T13:37:33.473099786Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    server_test.go:489: 2023-03-29 13:37:33.472: cmd: matched newline = \" http://[::]:38281\"\n"}
-{"Time":"2023-03-29T13:37:33.473628418Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    server_test.go:493: 2023-03-29 13:37:33.473: cmd: matched \"Started TLS/HTTPS listener at \" = \"WARN: --tls-redirect-http-to-https is deprecated, please use --redirect-to-access-url instead\\r\\r\\nStarted TLS/HTTPS listener at \"\n"}
-{"Time":"2023-03-29T13:37:33.473644808Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    server_test.go:494: 2023-03-29 13:37:33.473: cmd: ReadLine ctx has no deadline, using 10s\n"}
-{"Time":"2023-03-29T13:37:33.47365119Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    server_test.go:494: 2023-03-29 13:37:33.473: cmd: matched newline = \"https://[::]:37895\"\n"}
-{"Time":"2023-03-29T13:37:33.475250161Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:33.475281933Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:33.490892952Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
-{"Time":"2023-03-29T13:37:33.492145943Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:83: 2023-03-29 13:37:33.491: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:33.492183748Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:74: 2023-03-29 13:37:33.491: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:33.492192673Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:110: 2023-03-29 13:37:33.492: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:33.492199945Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:111: 2023-03-29 13:37:33.492: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:33.492206118Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:113: 2023-03-29 13:37:33.492: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:33.492296422Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:76: 2023-03-29 13:37:33.492: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.492316694Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:74: 2023-03-29 13:37:33.492: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:33.49232562Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:76: 2023-03-29 13:37:33.492: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.492355439Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:74: 2023-03-29 13:37:33.492: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:33.492364574Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:76: 2023-03-29 13:37:33.492: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.49240481Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:102: 2023-03-29 13:37:33.492: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:33.495511552Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"--- PASS: TestServer/CanListenUnspecifiedv6 (0.63s)\n"}
-{"Time":"2023-03-29T13:37:33.495557907Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/CanListenUnspecifiedv6","Elapsed":0.63}
-{"Time":"2023-03-29T13:37:33.495569713Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener"}
-{"Time":"2023-03-29T13:37:33.495575692Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"=== CONT  TestServer/TLSRedirect/NoTLSListener\n"}
-{"Time":"2023-03-29T13:37:33.495582515Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSRedirectNoTLSListener2050465310/003 server --in-memory --cache-dir /tmp/TestServerTLSRedirectNoTLSListener2050465310/002 --http-address :0 --access-url https://example.com\n"}
-{"Time":"2023-03-29T13:37:33.514163923Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:33.51646695Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: View the Web UI: https://example.com\n"}
-{"Time":"2023-03-29T13:37:33.532093856Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:33.532820236Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:33.533254024Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:33.533887464Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Output":"--- PASS: TestServer/Logging/CreatesFile (0.69s)\n"}
-{"Time":"2023-03-29T13:37:33.580391994Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/CreatesFile","Elapsed":0.69}
-{"Time":"2023-03-29T13:37:33.580437708Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.194: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:33.580458446Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:33.580471806Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.58048911Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:33.580504524Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.580522972Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:33.5805328Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.580555757Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:33.580587561Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.580846451Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Output":"--- PASS: TestServer/Logging/JSON (0.67s)\n"}
-{"Time":"2023-03-29T13:37:33.580862096Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/JSON","Elapsed":0.67}
-{"Time":"2023-03-29T13:37:33.580868926Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect"}
-{"Time":"2023-03-29T13:37:33.580873653Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"=== CONT  TestServer/TLSRedirect/NoRedirect\n"}
-{"Time":"2023-03-29T13:37:33.582048889Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSRedirectNoRedirect2668740580/003 server --in-memory --cache-dir /tmp/TestServerTLSRedirectNoRedirect2668740580/002 --http-address :0 --tls-enable --tls-address :0 --tls-cert-file /tmp/TestServerTLSRedirectNoRedirect2668740580/001/1517171254 --tls-key-file /tmp/TestServerTLSRedirectNoRedirect2668740580/001/1491051903 --wildcard-access-url *.example.com --access-url https://example.com\n"}
-{"Time":"2023-03-29T13:37:33.582187252Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard"}
-{"Time":"2023-03-29T13:37:33.582197387Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"=== CONT  TestServer/TLSRedirect/NoRedirectWithWildcard\n"}
-{"Time":"2023-03-29T13:37:33.583144917Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSRedirectNoRedirectWithWildcard3241718280/003 server --in-memory --cache-dir /tmp/TestServerTLSRedirectNoRedirectWithWildcard3241718280/002 --http-address  --tls-enable --tls-address :0 --tls-cert-file /tmp/TestServerTLSRedirectNoRedirectWithWildcard3241718280/001/2297363344 --tls-key-file /tmp/TestServerTLSRedirectNoRedirectWithWildcard3241718280/001/3868867528 --wildcard-access-url *.example.com --access-url https://example.com --redirect-to-access-url\n"}
-{"Time":"2023-03-29T13:37:33.609797366Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Output":"--- PASS: TestServer/TracerNoLeak (0.75s)\n"}
-{"Time":"2023-03-29T13:37:33.610858133Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TracerNoLeak","Elapsed":0.75}
-{"Time":"2023-03-29T13:37:33.6108818Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.202: cmd: \"WARN: Address is deprecated, please use HTTP Address and TLS Address instead.\"\n"}
-{"Time":"2023-03-29T13:37:33.610892881Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.610: cmd: \"                                                                       \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.610900074Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.610: cmd: \"Started HTTP listener at http://[::]:32777\"\n"}
-{"Time":"2023-03-29T13:37:33.610935322Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.610: cmd: \"                                   \"\n"}
-{"Time":"2023-03-29T13:37:33.610944309Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.610: cmd: \"View the Web UI: http://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.610972945Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.610: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.610991889Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.610: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.61104088Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:83: 2023-03-29 13:37:33.611: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:33.611050128Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.611: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:33.611098802Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:110: 2023-03-29 13:37:33.611: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:33.611114878Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:111: 2023-03-29 13:37:33.611: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:33.611120793Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:113: 2023-03-29 13:37:33.611: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:33.611180989Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.611: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.611193294Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.611: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:33.611200866Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.611: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.611204553Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.611: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:33.611207462Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.611: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.611215565Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:102: 2023-03-29 13:37:33.611: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:33.611336071Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Output":"--- PASS: TestServer/LocalAccessURL (0.71s)\n"}
-{"Time":"2023-03-29T13:37:33.613044416Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/LocalAccessURL","Elapsed":0.71}
-{"Time":"2023-03-29T13:37:33.613054355Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 1...\n"}
-{"Time":"2023-03-29T13:37:33.613144221Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 1\n"}
-{"Time":"2023-03-29T13:37:33.613176406Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    server_test.go:799: 2023-03-29 13:37:33.613: cmd: matched \"is deprecated\" = \"WARN: Address is deprecated\"\n"}
-{"Time":"2023-03-29T13:37:33.613666866Z","Action":"cont","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS"}
-{"Time":"2023-03-29T13:37:33.613682333Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"=== CONT  TestServer/DeprecatedAddress/TLS\n"}
-{"Time":"2023-03-29T13:37:33.614665673Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerDeprecatedAddressTLS1194868532/003 server --in-memory --address :0 --access-url https://example.com --tls-enable --tls-cert-file /tmp/TestServerDeprecatedAddressTLS1194868532/001/3357512070 --tls-key-file /tmp/TestServerDeprecatedAddressTLS1194868532/001/2886385591 --cache-dir /tmp/TestServerDeprecatedAddressTLS1194868532/002\n"}
-{"Time":"2023-03-29T13:37:33.614774341Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 2...\n"}
-{"Time":"2023-03-29T13:37:33.614835489Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 2\n"}
-{"Time":"2023-03-29T13:37:33.614847064Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:33.615151651Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.251: cmd: \"Started HTTP listener at http://[::]:46789\"\n"}
-{"Time":"2023-03-29T13:37:33.615187666Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.615: cmd: \"WARN: The access URL  https://foobarbaz.mydomain  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\"\n"}
-{"Time":"2023-03-29T13:37:33.615200461Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.615: cmd: \"                                                                                                                                                                                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.615214043Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.615: cmd: \"                                           \"\n"}
-{"Time":"2023-03-29T13:37:33.615230151Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.615: cmd: \"View the Web UI: https://foobarbaz.mydomain\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.615243576Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.615: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.61525094Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.615: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.616015109Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:33.617106937Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:121: 2023-03-29 13:37:33.251: cmd: \"                                    \"\n"}
-{"Time":"2023-03-29T13:37:33.617129585Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:121: 2023-03-29 13:37:33.617: cmd: \"View the Web UI: https://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.617140564Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:121: 2023-03-29 13:37:33.617: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.617159456Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:121: 2023-03-29 13:37:33.617: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.617293213Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    server_test.go:219: 2023-03-29 13:37:33.617: cmd: matched \"this may cause unexpected problems when creating workspaces\" = \"Started HTTP listener at http://[::]:46789\\r\\nWARN: The access URL  https://foobarbaz.mydomain  could not be resolved, this may cause unexpected problems when creating workspaces\"\n"}
-{"Time":"2023-03-29T13:37:33.617419153Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    server_test.go:220: 2023-03-29 13:37:33.617: cmd: matched \"View the Web UI: https://foobarbaz.mydomain\" = \". Generate a unique *.try.coder.app URL by not specifying an access URL.\\r\\n                                                                                                                                                                                                      \\r\\r\\n                                           \\r\\nView the Web UI: https://foobarbaz.mydomain\"\n"}
-{"Time":"2023-03-29T13:37:33.617702539Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Output":"--- PASS: TestServer/Logging/Human (0.70s)\n"}
-{"Time":"2023-03-29T13:37:33.617717314Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Human","Elapsed":0.7}
-{"Time":"2023-03-29T13:37:33.617728397Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.346: cmd: \"                                   \"\n"}
-{"Time":"2023-03-29T13:37:33.617738582Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.617: cmd: \"View the Web UI: https://google.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.617745792Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.617: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.617755568Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.617: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.617776141Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    server_test.go:238: 2023-03-29 13:37:33.617: cmd: matched \"View the Web UI: https://google.com\" = \"Started HTTP listener at http://[::]:39671\\r\\n                                   \\r\\nView the Web UI: https://google.com\"\n"}
-{"Time":"2023-03-29T13:37:33.618700109Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:83: 2023-03-29 13:37:33.618: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:33.618717448Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.618: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:33.618729015Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:110: 2023-03-29 13:37:33.618: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:33.618738942Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:111: 2023-03-29 13:37:33.618: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:33.618748331Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:113: 2023-03-29 13:37:33.618: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:33.618809556Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.618: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.618823389Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.618: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:33.618833326Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.618: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.618840112Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.618: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:33.61884905Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.618: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.618860551Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:102: 2023-03-29 13:37:33.618: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:33.618993236Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"--- PASS: TestServer/NoWarningWithRemoteAccessURL (0.72s)\n"}
-{"Time":"2023-03-29T13:37:33.620193889Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Elapsed":0.72}
-{"Time":"2023-03-29T13:37:33.620216262Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:33.620558208Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.620: cmd: \"Started TLS/HTTPS listener at https://[::]:40599\"\n"}
-{"Time":"2023-03-29T13:37:33.62057844Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.620: cmd: \"                                    \"\n"}
-{"Time":"2023-03-29T13:37:33.620586258Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.620: cmd: \"View the Web UI: https://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.620613734Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    server_test.go:641: 2023-03-29 13:37:33.620: cmd: matched \"Started TLS/HTTPS listener at\" = \"Started TLS/HTTPS listener at\"\n"}
-{"Time":"2023-03-29T13:37:33.620652863Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    server_test.go:642: 2023-03-29 13:37:33.620: cmd: ReadLine ctx has no deadline, using 10s\n"}
-{"Time":"2023-03-29T13:37:33.620669386Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    server_test.go:642: 2023-03-29 13:37:33.620: cmd: matched newline = \" https://[::]:40599\"\n"}
-{"Time":"2023-03-29T13:37:33.623941782Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:33.634109465Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.634: cmd: \"Started HTTP listener at http://[::]:44615\"\n"}
-{"Time":"2023-03-29T13:37:33.6341392Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    server_test.go:634: 2023-03-29 13:37:33.634: cmd: matched \"Started HTTP listener at\" = \"Started HTTP listener at\"\n"}
-{"Time":"2023-03-29T13:37:33.634159059Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    server_test.go:635: 2023-03-29 13:37:33.634: cmd: ReadLine ctx has no deadline, using 10s\n"}
-{"Time":"2023-03-29T13:37:33.634168084Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    server_test.go:635: 2023-03-29 13:37:33.634: cmd: matched newline = \" http://[::]:44615\"\n"}
-{"Time":"2023-03-29T13:37:33.639592274Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.639: cmd: \"WARN: Address is deprecated, please use HTTP Address and TLS Address instead.\"\n"}
-{"Time":"2023-03-29T13:37:33.639622715Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.639: cmd: \"                                                                       \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.639633384Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.639: cmd: \"Started TLS/HTTPS listener at https://[::]:44869\"\n"}
-{"Time":"2023-03-29T13:37:33.642427153Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.642: cmd: \"Started TLS/HTTPS listener at https://[::]:43889\"\n"}
-{"Time":"2023-03-29T13:37:33.642448651Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.642: cmd: \"                                    \"\n"}
-{"Time":"2023-03-29T13:37:33.642456925Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.642: cmd: \"View the Web UI: https://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.642468331Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    server_test.go:641: 2023-03-29 13:37:33.642: cmd: matched \"Started TLS/HTTPS listener at\" = \"Started TLS/HTTPS listener at\"\n"}
-{"Time":"2023-03-29T13:37:33.642477804Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    server_test.go:642: 2023-03-29 13:37:33.642: cmd: ReadLine ctx has no deadline, using 10s\n"}
-{"Time":"2023-03-29T13:37:33.642487898Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    server_test.go:642: 2023-03-29 13:37:33.642: cmd: matched newline = \" https://[::]:43889\"\n"}
-{"Time":"2023-03-29T13:37:33.646526946Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:33.646: cmd: \"Started HTTP listener at http://[::]:33323\"\n"}
-{"Time":"2023-03-29T13:37:33.646552176Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:33.646: cmd: \"Started TLS/HTTPS listener at https://[::]:36951\"\n"}
-{"Time":"2023-03-29T13:37:33.64656429Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:33.646: cmd: \"                                    \"\n"}
-{"Time":"2023-03-29T13:37:33.646572476Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:33.646: cmd: \"View the Web UI: https://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.646580011Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    server_test.go:634: 2023-03-29 13:37:33.646: cmd: matched \"Started HTTP listener at\" = \"Started HTTP listener at\"\n"}
-{"Time":"2023-03-29T13:37:33.646591361Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    server_test.go:635: 2023-03-29 13:37:33.646: cmd: ReadLine ctx has no deadline, using 10s\n"}
-{"Time":"2023-03-29T13:37:33.646616475Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    server_test.go:635: 2023-03-29 13:37:33.646: cmd: matched newline = \" http://[::]:33323\"\n"}
-{"Time":"2023-03-29T13:37:33.646662584Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    server_test.go:641: 2023-03-29 13:37:33.646: cmd: matched \"Started TLS/HTTPS listener at\" = \"Started TLS/HTTPS listener at\"\n"}
-{"Time":"2023-03-29T13:37:33.646681881Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    server_test.go:642: 2023-03-29 13:37:33.646: cmd: ReadLine ctx has no deadline, using 10s\n"}
-{"Time":"2023-03-29T13:37:33.646699362Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    server_test.go:642: 2023-03-29 13:37:33.646: cmd: matched newline = \" https://[::]:36951\"\n"}
-{"Time":"2023-03-29T13:37:33.648933788Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP coderd_api_active_users_duration_hour The number of users that have been active within the last hour.\n"}
-{"Time":"2023-03-29T13:37:33.648967031Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE coderd_api_active_users_duration_hour gauge\n"}
-{"Time":"2023-03-29T13:37:33.648980231Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP coderd_api_concurrent_requests The number of concurrent API requests.\n"}
-{"Time":"2023-03-29T13:37:33.649053919Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE coderd_api_concurrent_requests gauge\n"}
-{"Time":"2023-03-29T13:37:33.649069592Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_api_concurrent_requests 0\n"}
-{"Time":"2023-03-29T13:37:33.649078578Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP coderd_api_concurrent_websockets The total number of concurrent API websockets.\n"}
-{"Time":"2023-03-29T13:37:33.64908451Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE coderd_api_concurrent_websockets gauge\n"}
-{"Time":"2023-03-29T13:37:33.64908947Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_api_concurrent_websockets 0\n"}
-{"Time":"2023-03-29T13:37:33.649096688Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP coderd_api_workspace_latest_build_total The latest workspace builds with a status.\n"}
-{"Time":"2023-03-29T13:37:33.649103792Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE coderd_api_workspace_latest_build_total gauge\n"}
-{"Time":"2023-03-29T13:37:33.649110998Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP coderd_authz_authorize_duration_seconds Duration of the 'Authorize' call in seconds. Only counts calls that succeed.\n"}
-{"Time":"2023-03-29T13:37:33.649125082Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE coderd_authz_authorize_duration_seconds histogram\n"}
-{"Time":"2023-03-29T13:37:33.649136372Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.0005\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649158836Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.001\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649167411Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.002\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649174438Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.003\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649184378Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.005\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649205265Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.01\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649213251Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.02\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649222908Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.035\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649235415Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.05\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649253778Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.075\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649261752Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.1\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649271274Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.25\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649292314Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.75\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649300333Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"1\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649310057Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"+Inf\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649320729Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_sum{allowed=\"true\"} 0.002876051\n"}
-{"Time":"2023-03-29T13:37:33.649345041Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_count{allowed=\"true\"} 2\n"}
-{"Time":"2023-03-29T13:37:33.649356377Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP coderd_authz_prepare_authorize_duration_seconds Duration of the 'PrepareAuthorize' call in seconds.\n"}
-{"Time":"2023-03-29T13:37:33.649363746Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE coderd_authz_prepare_authorize_duration_seconds histogram\n"}
-{"Time":"2023-03-29T13:37:33.649370497Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.0005\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649391953Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.001\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649399779Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.002\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649410888Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.003\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649428841Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.005\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649438526Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.01\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649445746Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.02\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.64947999Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.035\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649486523Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.05\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649643599Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.075\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649652811Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.1\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649659776Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.25\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649677202Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.75\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.649684812Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"1\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.64970109Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"+Inf\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.64971819Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_sum 0\n"}
-{"Time":"2023-03-29T13:37:33.649725513Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_count 0\n"}
-{"Time":"2023-03-29T13:37:33.649741363Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_gc_duration_seconds A summary of the pause duration of garbage collection cycles.\n"}
-{"Time":"2023-03-29T13:37:33.649751815Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_gc_duration_seconds summary\n"}
-{"Time":"2023-03-29T13:37:33.649770366Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds{quantile=\"0\"} 1.6651e-05\n"}
-{"Time":"2023-03-29T13:37:33.649779436Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds{quantile=\"0.25\"} 3.0073e-05\n"}
-{"Time":"2023-03-29T13:37:33.649795479Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds{quantile=\"0.5\"} 3.3851e-05\n"}
-{"Time":"2023-03-29T13:37:33.649803042Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds{quantile=\"0.75\"} 5.0874e-05\n"}
-{"Time":"2023-03-29T13:37:33.649822842Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds{quantile=\"1\"} 0.000164674\n"}
-{"Time":"2023-03-29T13:37:33.649830516Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds_sum 0.000461803\n"}
-{"Time":"2023-03-29T13:37:33.64984149Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds_count 9\n"}
-{"Time":"2023-03-29T13:37:33.649859074Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_goroutines Number of goroutines that currently exist.\n"}
-{"Time":"2023-03-29T13:37:33.649876364Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_goroutines gauge\n"}
-{"Time":"2023-03-29T13:37:33.649883909Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_goroutines 400\n"}
-{"Time":"2023-03-29T13:37:33.649893852Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_info Information about the Go environment.\n"}
-{"Time":"2023-03-29T13:37:33.649915539Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_info gauge\n"}
-{"Time":"2023-03-29T13:37:33.649923065Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_info{version=\"go1.20\"} 1\n"}
-{"Time":"2023-03-29T13:37:33.649934513Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_alloc_bytes Number of bytes allocated and still in use.\n"}
-{"Time":"2023-03-29T13:37:33.64994537Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_alloc_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.649964236Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_alloc_bytes 4.4139992e+07\n"}
-{"Time":"2023-03-29T13:37:33.649974501Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_alloc_bytes_total Total number of bytes allocated, even if freed.\n"}
-{"Time":"2023-03-29T13:37:33.649985399Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_alloc_bytes_total counter\n"}
-{"Time":"2023-03-29T13:37:33.650002195Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_alloc_bytes_total 1.07033304e+08\n"}
-{"Time":"2023-03-29T13:37:33.650019066Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_buck_hash_sys_bytes Number of bytes used by the profiling bucket hash table.\n"}
-{"Time":"2023-03-29T13:37:33.650026662Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_buck_hash_sys_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650037208Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_buck_hash_sys_bytes 1.487772e+06\n"}
-{"Time":"2023-03-29T13:37:33.650056379Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_frees_total Total number of frees.\n"}
-{"Time":"2023-03-29T13:37:33.650063678Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_frees_total counter\n"}
-{"Time":"2023-03-29T13:37:33.650079718Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_frees_total 341416\n"}
-{"Time":"2023-03-29T13:37:33.650087192Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_gc_sys_bytes Number of bytes used for garbage collection system metadata.\n"}
-{"Time":"2023-03-29T13:37:33.65010648Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_gc_sys_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650113893Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_gc_sys_bytes 9.376592e+06\n"}
-{"Time":"2023-03-29T13:37:33.650132561Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_heap_alloc_bytes Number of heap bytes allocated and still in use.\n"}
-{"Time":"2023-03-29T13:37:33.650140278Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_heap_alloc_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650152649Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_heap_alloc_bytes 4.4139992e+07\n"}
-{"Time":"2023-03-29T13:37:33.650314526Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_heap_idle_bytes Number of heap bytes waiting to be used.\n"}
-{"Time":"2023-03-29T13:37:33.650323426Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_heap_idle_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650332952Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_heap_idle_bytes 4.481024e+06\n"}
-{"Time":"2023-03-29T13:37:33.65035073Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_heap_inuse_bytes Number of heap bytes that are in use.\n"}
-{"Time":"2023-03-29T13:37:33.650358078Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_heap_inuse_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650374519Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_heap_inuse_bytes 4.6473216e+07\n"}
-{"Time":"2023-03-29T13:37:33.650392405Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_heap_objects Number of allocated objects.\n"}
-{"Time":"2023-03-29T13:37:33.650400167Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_heap_objects gauge\n"}
-{"Time":"2023-03-29T13:37:33.650411Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_heap_objects 198877\n"}
-{"Time":"2023-03-29T13:37:33.650427198Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_heap_released_bytes Number of heap bytes released to OS.\n"}
-{"Time":"2023-03-29T13:37:33.650443875Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_heap_released_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.6504512Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_heap_released_bytes 172032\n"}
-{"Time":"2023-03-29T13:37:33.650466769Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_heap_sys_bytes Number of heap bytes obtained from system.\n"}
-{"Time":"2023-03-29T13:37:33.650476593Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_heap_sys_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650493555Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_heap_sys_bytes 5.095424e+07\n"}
-{"Time":"2023-03-29T13:37:33.650501064Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_last_gc_time_seconds Number of seconds since 1970 of last garbage collection.\n"}
-{"Time":"2023-03-29T13:37:33.650517983Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_last_gc_time_seconds gauge\n"}
-{"Time":"2023-03-29T13:37:33.650530998Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_last_gc_time_seconds 1.680097053302355e+09\n"}
-{"Time":"2023-03-29T13:37:33.65054228Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_lookups_total Total number of pointer lookups.\n"}
-{"Time":"2023-03-29T13:37:33.650552934Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_lookups_total counter\n"}
-{"Time":"2023-03-29T13:37:33.650563901Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_lookups_total 0\n"}
-{"Time":"2023-03-29T13:37:33.650584173Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_mallocs_total Total number of mallocs.\n"}
-{"Time":"2023-03-29T13:37:33.650591833Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_mallocs_total counter\n"}
-{"Time":"2023-03-29T13:37:33.650607986Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_mallocs_total 540293\n"}
-{"Time":"2023-03-29T13:37:33.650615529Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_mcache_inuse_bytes Number of bytes in use by mcache structures.\n"}
-{"Time":"2023-03-29T13:37:33.650641182Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_mcache_inuse_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650649185Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_mcache_inuse_bytes 1200\n"}
-{"Time":"2023-03-29T13:37:33.650655792Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_mcache_sys_bytes Number of bytes used for mcache structures obtained from system.\n"}
-{"Time":"2023-03-29T13:37:33.650675584Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_mcache_sys_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650682964Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_mcache_sys_bytes 15600\n"}
-{"Time":"2023-03-29T13:37:33.650699492Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_mspan_inuse_bytes Number of bytes in use by mspan structures.\n"}
-{"Time":"2023-03-29T13:37:33.65070695Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_mspan_inuse_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650725284Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_mspan_inuse_bytes 415680\n"}
-{"Time":"2023-03-29T13:37:33.650732919Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_mspan_sys_bytes Number of bytes used for mspan structures obtained from system.\n"}
-{"Time":"2023-03-29T13:37:33.650742233Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_mspan_sys_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650753796Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_mspan_sys_bytes 440640\n"}
-{"Time":"2023-03-29T13:37:33.650773086Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_next_gc_bytes Number of heap bytes when next garbage collection will take place.\n"}
-{"Time":"2023-03-29T13:37:33.650780844Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_next_gc_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650791619Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_next_gc_bytes 5.744056e+07\n"}
-{"Time":"2023-03-29T13:37:33.650939729Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_other_sys_bytes Number of bytes used for other system allocations.\n"}
-{"Time":"2023-03-29T13:37:33.650948462Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_other_sys_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650960125Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_other_sys_bytes 407532\n"}
-{"Time":"2023-03-29T13:37:33.65097098Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_stack_inuse_bytes Number of bytes in use by the stack allocator.\n"}
-{"Time":"2023-03-29T13:37:33.650989112Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_stack_inuse_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.650999328Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_stack_inuse_bytes 3.506176e+06\n"}
-{"Time":"2023-03-29T13:37:33.651015975Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_stack_sys_bytes Number of bytes obtained from system for stack allocator.\n"}
-{"Time":"2023-03-29T13:37:33.651023745Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_stack_sys_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.651042622Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_stack_sys_bytes 3.506176e+06\n"}
-{"Time":"2023-03-29T13:37:33.651050141Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_sys_bytes Number of bytes obtained from system.\n"}
-{"Time":"2023-03-29T13:37:33.651066559Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_sys_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.65107676Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_sys_bytes 6.6188552e+07\n"}
-{"Time":"2023-03-29T13:37:33.651096334Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_threads Number of OS threads created.\n"}
-{"Time":"2023-03-29T13:37:33.651104041Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_threads gauge\n"}
-{"Time":"2023-03-29T13:37:33.651114838Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_threads 11\n"}
-{"Time":"2023-03-29T13:37:33.651133818Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_cpu_seconds_total Total user and system CPU time spent in seconds.\n"}
-{"Time":"2023-03-29T13:37:33.651141836Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_cpu_seconds_total counter\n"}
-{"Time":"2023-03-29T13:37:33.651152615Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_cpu_seconds_total 0.47\n"}
-{"Time":"2023-03-29T13:37:33.651169215Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_max_fds Maximum number of open file descriptors.\n"}
-{"Time":"2023-03-29T13:37:33.651188139Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_max_fds gauge\n"}
-{"Time":"2023-03-29T13:37:33.651196288Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_max_fds 1.048576e+06\n"}
-{"Time":"2023-03-29T13:37:33.651207299Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_open_fds Number of open file descriptors.\n"}
-{"Time":"2023-03-29T13:37:33.651218057Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_open_fds gauge\n"}
-{"Time":"2023-03-29T13:37:33.651236861Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_open_fds 144\n"}
-{"Time":"2023-03-29T13:37:33.651248494Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_resident_memory_bytes Resident memory size in bytes.\n"}
-{"Time":"2023-03-29T13:37:33.651257364Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_resident_memory_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.651280196Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_resident_memory_bytes 1.14364416e+08\n"}
-{"Time":"2023-03-29T13:37:33.65128834Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_start_time_seconds Start time of the process since unix epoch in seconds.\n"}
-{"Time":"2023-03-29T13:37:33.651296824Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_start_time_seconds gauge\n"}
-{"Time":"2023-03-29T13:37:33.651307674Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_start_time_seconds 1.68009705209e+09\n"}
-{"Time":"2023-03-29T13:37:33.651326547Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_virtual_memory_bytes Virtual memory size in bytes.\n"}
-{"Time":"2023-03-29T13:37:33.651334348Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_virtual_memory_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.651345305Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_virtual_memory_bytes 1.4835712e+09\n"}
-{"Time":"2023-03-29T13:37:33.651361504Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_virtual_memory_max_bytes Maximum amount of virtual memory available in bytes.\n"}
-{"Time":"2023-03-29T13:37:33.651378854Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_virtual_memory_max_bytes gauge\n"}
-{"Time":"2023-03-29T13:37:33.651386339Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_virtual_memory_max_bytes 1.8446744073709552e+19\n"}
-{"Time":"2023-03-29T13:37:33.651397458Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP promhttp_metric_handler_requests_in_flight Current number of scrapes being served.\n"}
-{"Time":"2023-03-29T13:37:33.65149956Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE promhttp_metric_handler_requests_in_flight gauge\n"}
-{"Time":"2023-03-29T13:37:33.65150712Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned promhttp_metric_handler_requests_in_flight 1\n"}
-{"Time":"2023-03-29T13:37:33.651512875Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP promhttp_metric_handler_requests_total Total number of scrapes by HTTP status code.\n"}
-{"Time":"2023-03-29T13:37:33.651517405Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE promhttp_metric_handler_requests_total counter\n"}
-{"Time":"2023-03-29T13:37:33.651608377Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned promhttp_metric_handler_requests_total{code=\"200\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.651617771Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned promhttp_metric_handler_requests_total{code=\"500\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.651624722Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned promhttp_metric_handler_requests_total{code=\"503\"} 0\n"}
-{"Time":"2023-03-29T13:37:33.653302095Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:33.687811194Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.687: cmd: \"                                    \"\n"}
-{"Time":"2023-03-29T13:37:33.68784324Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.687: cmd: \"View the Web UI: https://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.687847743Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.687: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.687859388Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.687: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.69314768Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    server_test.go:829: 2023-03-29 13:37:33.690: cmd: matched \"is deprecated\" = \"WARN: Address is deprecated\"\n"}
-{"Time":"2023-03-29T13:37:33.699837388Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:33.700125946Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:33.700416667Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:33.701833349Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Output":"--- PASS: TestServer/RateLimit/Default (0.85s)\n"}
-{"Time":"2023-03-29T13:37:33.792395824Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Default","Elapsed":0.85}
-{"Time":"2023-03-29T13:37:33.792432021Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:33.792443805Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:33.796165422Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:83: 2023-03-29 13:37:33.795: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:33.796198633Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.796: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:33.797173408Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:33.797427041Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:33.79757722Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:33.797913033Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:33.797928952Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:33.803483718Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:33.803533703Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:33.803541349Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:33.803549183Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.80355496Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:33.803560722Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.803565907Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:33.803571719Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.803577128Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:33.803582995Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.803588238Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:110: 2023-03-29 13:37:33.799: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:33.803593211Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:111: 2023-03-29 13:37:33.799: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:33.803598107Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:113: 2023-03-29 13:37:33.799: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:33.807382663Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.807: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.807425699Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.807: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.812449918Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:33.812: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.812479278Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:33.812: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.81249279Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.812: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.812540743Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.812: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.81937956Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.819: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.819501503Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.819: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:33.819519256Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.819: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.819527309Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.819: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:33.819534022Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.819: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:33.819605916Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:102: 2023-03-29 13:37:33.819: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:33.819682321Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Output":"--- PASS: TestServer/RemoteAccessURL (0.92s)\n"}
-{"Time":"2023-03-29T13:37:33.819757496Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/RemoteAccessURL","Elapsed":0.92}
-{"Time":"2023-03-29T13:37:33.819772079Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.819: cmd: \"                                    \"\n"}
-{"Time":"2023-03-29T13:37:33.819781749Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.819: cmd: \"View the Web UI: https://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.819797518Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.819: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:33.819813792Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.819: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:33.851914311Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:33.85194979Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:33.852148613Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Output":"--- PASS: TestServer/Prometheus (1.00s)\n"}
-{"Time":"2023-03-29T13:37:33.855235903Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/Prometheus","Elapsed":1}
-{"Time":"2023-03-29T13:37:33.855263447Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:33.855284404Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:33.855351311Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:33.85648797Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Output":"--- PASS: TestServer/GitHubOAuth (1.01s)\n"}
-{"Time":"2023-03-29T13:37:33.898898347Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/GitHubOAuth","Elapsed":1.01}
-{"Time":"2023-03-29T13:37:33.898943644Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:33.898966965Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:33.899910542Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:33.899951915Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:33.899979591Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:33.931576217Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:33.931632315Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:33.932359012Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Output":"--- PASS: TestServer/RateLimit/Disabled (1.02s)\n"}
-{"Time":"2023-03-29T13:37:33.932605839Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Disabled","Elapsed":1.02}
-{"Time":"2023-03-29T13:37:33.932638521Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:33.944423479Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.944: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:33.944456273Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.944: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:33.944471028Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.944: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.944486505Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.944: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:33.944506728Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.944: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.948894392Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:33.949085454Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Output":"--- PASS: TestServer/Telemetry (1.09s)\n"}
-{"Time":"2023-03-29T13:37:33.973592223Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/Telemetry","Elapsed":1.09}
-{"Time":"2023-03-29T13:37:33.973627583Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:33.982109361Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Output":"--- PASS: TestServer/TLSValid (1.09s)\n"}
-{"Time":"2023-03-29T13:37:33.982145968Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValid","Elapsed":1.09}
-{"Time":"2023-03-29T13:37:33.982166462Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:83: 2023-03-29 13:37:33.982: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:33.982185903Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:74: 2023-03-29 13:37:33.982: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:33.983908041Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.983: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:33.983932298Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.983: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.983950164Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.983: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:33.983971383Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.983: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.983987252Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:110: 2023-03-29 13:37:33.983: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:33.984001811Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:111: 2023-03-29 13:37:33.983: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:33.984029981Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:113: 2023-03-29 13:37:33.983: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:33.999767444Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.999: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:33.999792066Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.999: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:33.999806103Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.999: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:33.999825199Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.999: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:33.999838052Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.999: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.000132942Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:34.000152725Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:34.013522575Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:76: 2023-03-29 13:37:34.013: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.013539719Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:74: 2023-03-29 13:37:34.013: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:34.013545396Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:76: 2023-03-29 13:37:34.013: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.013549166Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:74: 2023-03-29 13:37:34.013: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:34.013552799Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:76: 2023-03-29 13:37:34.013: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.013557098Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:102: 2023-03-29 13:37:34.013: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:34.013685528Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"--- PASS: TestServer/DeprecatedAddress/HTTP (1.01s)\n"}
-{"Time":"2023-03-29T13:37:34.024907745Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/HTTP","Elapsed":1.01}
-{"Time":"2023-03-29T13:37:34.024925201Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:83: 2023-03-29 13:37:34.024: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:34.024929754Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:74: 2023-03-29 13:37:34.024: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:34.037436741Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:34.046649783Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:34.046: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:34.04666228Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:34.046: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.046671065Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:34.046: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:34.046674499Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:34.046: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.046678741Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:110: 2023-03-29 13:37:34.046: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.046682976Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:111: 2023-03-29 13:37:34.046: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:34.046687631Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:113: 2023-03-29 13:37:34.046: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.048234545Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:34.048465929Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:76: 2023-03-29 13:37:34.048: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.048473751Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:74: 2023-03-29 13:37:34.048: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:34.04848652Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:76: 2023-03-29 13:37:34.048: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.048494431Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:74: 2023-03-29 13:37:34.048: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:34.0485018Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:76: 2023-03-29 13:37:34.048: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.048515549Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:102: 2023-03-29 13:37:34.048: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:34.048685756Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"--- PASS: TestServer/TLSRedirect/NoRedirectWithWildcard (0.47s)\n"}
-{"Time":"2023-03-29T13:37:34.049232577Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Elapsed":0.47}
-{"Time":"2023-03-29T13:37:34.049241005Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:34.049926527Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Output":"--- PASS: TestServer/RateLimit/Changed (1.07s)\n"}
-{"Time":"2023-03-29T13:37:34.049934686Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit/Changed","Elapsed":1.07}
-{"Time":"2023-03-29T13:37:34.049940803Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit","Output":"--- PASS: TestServer/RateLimit (0.00s)\n"}
-{"Time":"2023-03-29T13:37:34.050192839Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/RateLimit","Elapsed":0}
-{"Time":"2023-03-29T13:37:34.05020025Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:83: 2023-03-29 13:37:34.050: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:34.050204931Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:74: 2023-03-29 13:37:34.050: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:34.050237731Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:83: 2023-03-29 13:37:34.050: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:34.050243867Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:74: 2023-03-29 13:37:34.050: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:34.05027121Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:83: 2023-03-29 13:37:34.050: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:34.050278957Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:74: 2023-03-29 13:37:34.050: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:34.051736931Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:34.05174611Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:34.051751453Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.051758881Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:34.051780431Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.05178826Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:34.051870799Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.051881957Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:34.051887542Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.05189248Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:110: 2023-03-29 13:37:34.051: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.05189708Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:111: 2023-03-29 13:37:34.051: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:34.05190198Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:113: 2023-03-29 13:37:34.051: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.051911515Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:34.051922383Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:34.051927984Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.051938866Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:34.051946554Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.051962503Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:34.051971415Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.0519782Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:34.051987362Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.052007059Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:110: 2023-03-29 13:37:34.051: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.052015346Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:111: 2023-03-29 13:37:34.052: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:34.052021784Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:113: 2023-03-29 13:37:34.052: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.052400141Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:34.052410137Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:34.052420866Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.052427625Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:34.052440372Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.052448298Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:34.052457892Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.052465595Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:34.052483713Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.052491345Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:110: 2023-03-29 13:37:34.052: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.052498064Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:111: 2023-03-29 13:37:34.052: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:34.052506921Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:113: 2023-03-29 13:37:34.052: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.078632301Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:76: 2023-03-29 13:37:34.078: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.07865445Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:74: 2023-03-29 13:37:34.078: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:34.078658395Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:76: 2023-03-29 13:37:34.078: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.078664194Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:74: 2023-03-29 13:37:34.078: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:34.078667573Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:76: 2023-03-29 13:37:34.078: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.078670569Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:102: 2023-03-29 13:37:34.078: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:34.078838607Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Output":"--- PASS: TestServer/TLSRedirect/OK (1.06s)\n"}
-{"Time":"2023-03-29T13:37:34.078885902Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/OK","Elapsed":1.06}
-{"Time":"2023-03-29T13:37:34.078892321Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:76: 2023-03-29 13:37:34.078: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.078897167Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:74: 2023-03-29 13:37:34.078: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:34.078901364Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:76: 2023-03-29 13:37:34.078: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.078912845Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:74: 2023-03-29 13:37:34.078: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:34.078917725Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:76: 2023-03-29 13:37:34.078: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.07894293Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:102: 2023-03-29 13:37:34.078: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:34.079092731Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"--- PASS: TestServer/TLSRedirect/NoHTTPListener (0.62s)\n"}
-{"Time":"2023-03-29T13:37:34.079144047Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Elapsed":0.62}
-{"Time":"2023-03-29T13:37:34.079152217Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:76: 2023-03-29 13:37:34.079: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.079158662Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:74: 2023-03-29 13:37:34.079: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:34.079162915Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:76: 2023-03-29 13:37:34.079: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.079168988Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:74: 2023-03-29 13:37:34.079: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:34.079178829Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:76: 2023-03-29 13:37:34.079: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.079196269Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:102: 2023-03-29 13:37:34.079: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:34.079336643Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"--- PASS: TestServer/TLSRedirect/NoTLSListener (0.59s)\n"}
-{"Time":"2023-03-29T13:37:34.091089368Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Elapsed":0.59}
-{"Time":"2023-03-29T13:37:34.091112345Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:83: 2023-03-29 13:37:34.091: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:34.091119428Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:74: 2023-03-29 13:37:34.091: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:34.115772917Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:34.115801947Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:34.11581297Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.115819506Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:34.115824758Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.115830066Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:34.11583724Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.115844144Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:34.115860103Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.115888103Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:110: 2023-03-29 13:37:34.115: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.115903904Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:111: 2023-03-29 13:37:34.115: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:34.115919206Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:113: 2023-03-29 13:37:34.115: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.115976431Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:34.115986313Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:34.115997881Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.11602101Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:34.116029108Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:34.116: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.116476692Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:76: 2023-03-29 13:37:34.116: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.116491796Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:74: 2023-03-29 13:37:34.116: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:34.116497774Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:76: 2023-03-29 13:37:34.116: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.116504918Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:74: 2023-03-29 13:37:34.116: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:34.1165175Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:76: 2023-03-29 13:37:34.116: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.116539123Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:102: 2023-03-29 13:37:34.116: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:34.116717402Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Output":"--- PASS: TestServer/TLSAndHTTP (1.24s)\n"}
-{"Time":"2023-03-29T13:37:34.117404728Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSAndHTTP","Elapsed":1.24}
-{"Time":"2023-03-29T13:37:34.117418357Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:83: 2023-03-29 13:37:34.117: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:34.117441857Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:74: 2023-03-29 13:37:34.117: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:34.117475322Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:110: 2023-03-29 13:37:34.117: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.117484444Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:111: 2023-03-29 13:37:34.117: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:34.117494423Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:113: 2023-03-29 13:37:34.117: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.11754208Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:76: 2023-03-29 13:37:34.117: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.117551844Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:74: 2023-03-29 13:37:34.117: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:34.117570608Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:76: 2023-03-29 13:37:34.117: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.117578465Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:74: 2023-03-29 13:37:34.117: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:34.117597311Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:76: 2023-03-29 13:37:34.117: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.117616074Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:102: 2023-03-29 13:37:34.117: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:34.11776518Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"--- PASS: TestServer/DeprecatedAddress/TLS (0.50s)\n"}
-{"Time":"2023-03-29T13:37:34.117776019Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress/TLS","Elapsed":0.5}
-{"Time":"2023-03-29T13:37:34.117782763Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress","Output":"--- PASS: TestServer/DeprecatedAddress (0.06s)\n"}
-{"Time":"2023-03-29T13:37:34.117841805Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/DeprecatedAddress","Elapsed":0.06}
-{"Time":"2023-03-29T13:37:34.117849931Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:83: 2023-03-29 13:37:34.117: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:34.117859828Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:74: 2023-03-29 13:37:34.117: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:34.118127485Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:83: 2023-03-29 13:37:34.118: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:34.118138813Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:74: 2023-03-29 13:37:34.118: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:34.118170526Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:110: 2023-03-29 13:37:34.118: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.11817918Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:111: 2023-03-29 13:37:34.118: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:34.118194579Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:113: 2023-03-29 13:37:34.118: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.11825734Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:76: 2023-03-29 13:37:34.118: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.118277979Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:74: 2023-03-29 13:37:34.118: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:34.118286381Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:76: 2023-03-29 13:37:34.118: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.118291513Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:74: 2023-03-29 13:37:34.118: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:34.118295899Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:76: 2023-03-29 13:37:34.118: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.11830286Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:102: 2023-03-29 13:37:34.118: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:34.118448813Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Output":"--- PASS: TestServer/TLSValidMultiple (1.23s)\n"}
-{"Time":"2023-03-29T13:37:34.118485143Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSValidMultiple","Elapsed":1.23}
-{"Time":"2023-03-29T13:37:34.118492964Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:34.118500337Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:34.118505085Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.118511668Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:34.118536832Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.118542137Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:34.118548654Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.118562305Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:34.118568736Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:34.1185733Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:110: 2023-03-29 13:37:34.118: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.118577677Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:111: 2023-03-29 13:37:34.118: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:34.118583972Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:113: 2023-03-29 13:37:34.118: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:34.347394026Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:76: 2023-03-29 13:37:34.347: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.347481519Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:74: 2023-03-29 13:37:34.347: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:34.347503045Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:76: 2023-03-29 13:37:34.347: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.347521875Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:74: 2023-03-29 13:37:34.347: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:34.347538956Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:76: 2023-03-29 13:37:34.347: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:34.347563965Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:102: 2023-03-29 13:37:34.347: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:34.347597239Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"--- PASS: TestServer/TLSRedirect/NoRedirect (0.77s)\n"}
-{"Time":"2023-03-29T13:37:34.347618369Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect/NoRedirect","Elapsed":0.77}
-{"Time":"2023-03-29T13:37:34.347639094Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect","Output":"--- PASS: TestServer/TLSRedirect (0.05s)\n"}
-{"Time":"2023-03-29T13:37:37.495996215Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/TLSRedirect","Elapsed":0.05}
-{"Time":"2023-03-29T13:37:37.496041088Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:42403\n"}
-{"Time":"2023-03-29T13:37:37.497561163Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
-{"Time":"2023-03-29T13:37:37.854158017Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
-{"Time":"2023-03-29T13:37:37.871207973Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
-{"Time":"2023-03-29T13:37:37.871239014Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
-{"Time":"2023-03-29T13:37:37.871296925Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
-{"Time":"2023-03-29T13:37:37.871384307Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
-{"Time":"2023-03-29T13:37:37.871872118Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
-{"Time":"2023-03-29T13:37:37.872659674Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Stopping built-in PostgreSQL...\n"}
-{"Time":"2023-03-29T13:37:37.974547475Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Stopped built-in PostgreSQL\n"}
-{"Time":"2023-03-29T13:37:38.01812179Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Output":"--- PASS: TestServer/BuiltinPostgres (5.17s)\n"}
-{"Time":"2023-03-29T13:37:46.072262917Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/BuiltinPostgres","Elapsed":5.17}
-{"Time":"2023-03-29T13:37:46.072311252Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.072: cmd: \"Started HTTP listener at http://[::]:35645\"\n"}
-{"Time":"2023-03-29T13:37:46.072335279Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.072: cmd: \"WARN: The access URL  http://example.com  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\"\n"}
-{"Time":"2023-03-29T13:37:46.07241558Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.072: cmd: \"                                                                                                                                                                                              \\r\"\n"}
-{"Time":"2023-03-29T13:37:46.072459905Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.072: cmd: \"                                   \"\n"}
-{"Time":"2023-03-29T13:37:46.07251014Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.072: cmd: \"View the Web UI: http://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:46.072679873Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    server_test.go:1240: 2023-03-29 13:37:46.072: cmd: matched \"Started HTTP listener at\" = \"Started HTTP listener at\"\n"}
-{"Time":"2023-03-29T13:37:46.078543671Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:46.078573522Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:46.07859364Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:46.07861453Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"ERROR: Unexpected error, shutting down server: context deadline exceeded\"\n"}
-{"Time":"2023-03-29T13:37:46.078631014Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                                                 \\r\"\n"}
-{"Time":"2023-03-29T13:37:46.078647037Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:46.078658003Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:46.078668373Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:46.078678662Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:46.078702364Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Shutting down provisioner daemon 3...\"\n"}
-{"Time":"2023-03-29T13:37:46.078719655Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                     \\r\"\n"}
-{"Time":"2023-03-29T13:37:46.078730465Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Gracefully shut down provisioner daemon 3\"\n"}
-{"Time":"2023-03-29T13:37:46.078744589Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                         \\r\"\n"}
-{"Time":"2023-03-29T13:37:46.078763734Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Shutting down provisioner daemon 1...\"\n"}
-{"Time":"2023-03-29T13:37:46.07878276Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                     \\r\"\n"}
-{"Time":"2023-03-29T13:37:46.078801865Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Gracefully shut down provisioner daemon 1\"\n"}
-{"Time":"2023-03-29T13:37:46.07881665Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                         \\r\"\n"}
-{"Time":"2023-03-29T13:37:46.078826759Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Shutting down provisioner daemon 2...\"\n"}
-{"Time":"2023-03-29T13:37:46.078840612Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                     \\r\"\n"}
-{"Time":"2023-03-29T13:37:46.07885439Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Gracefully shut down provisioner daemon 2\"\n"}
-{"Time":"2023-03-29T13:37:46.07887537Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                         \\r\"\n"}
-{"Time":"2023-03-29T13:37:46.081392321Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.081: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:46.081408574Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.081: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:46.081421854Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.081: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:46.081431192Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.081: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:46.081449657Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.081: cmd: \"WARN: Graceful shutdown timed out\\r\"\n"}
-{"Time":"2023-03-29T13:37:46.14910839Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:83: 2023-03-29 13:37:46.149: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:46.149142371Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:74: 2023-03-29 13:37:46.149: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:46.149157567Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:110: 2023-03-29 13:37:46.149: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:46.149166448Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:111: 2023-03-29 13:37:46.149: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:46.149175898Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:113: 2023-03-29 13:37:46.149: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:46.149187205Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:76: 2023-03-29 13:37:46.149: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:46.14919623Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:74: 2023-03-29 13:37:46.149: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:46.149207373Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:76: 2023-03-29 13:37:46.149: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:46.149215685Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:74: 2023-03-29 13:37:46.149: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:46.149223347Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:76: 2023-03-29 13:37:46.149: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:46.149234369Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:102: 2023-03-29 13:37:46.149: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:46.149426722Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Output":"--- PASS: TestServer/Logging/Multiple (13.24s)\n"}
-{"Time":"2023-03-29T13:37:59.1117031Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Multiple","Elapsed":13.24}
-{"Time":"2023-03-29T13:37:59.111755068Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.111: cmd: \"2023-03-29 13:37:59.110 [DEBUG]\\t\u003cgithub.com/coder/coder/cli/server.go:260\u003e\\t(*RootCmd).Server.func1\\tstarted debug logging\"\n"}
-{"Time":"2023-03-29T13:37:59.111775176Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.111: cmd: \"Started HTTP listener at http://[::]:40007\"\n"}
-{"Time":"2023-03-29T13:37:59.111795675Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    server_test.go:1204: 2023-03-29 13:37:59.111: cmd: matched \"Started HTTP listener at\" = \"2023-03-29 13:37:59.110 [DEBUG]\\t\u003cgithub.com/coder/coder/cli/server.go:260\u003e\\t(*RootCmd).Server.func1\\tstarted debug logging\\r\\nStarted HTTP listener at\"\n"}
-{"Time":"2023-03-29T13:37:59.123488003Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.123: cmd: \"                                   \"\n"}
-{"Time":"2023-03-29T13:37:59.123536759Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.123: cmd: \"View the Web UI: http://example.com\\r\"\n"}
-{"Time":"2023-03-29T13:37:59.123550652Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.123: cmd: \"                                                                \"\n"}
-{"Time":"2023-03-29T13:37:59.123559998Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.123: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
-{"Time":"2023-03-29T13:37:59.144165093Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.123 [DEBUG]\\t(coderd.metrics_cache)\\t\u003cgithub.com/coder/coder/coderd/metricscache/metricscache.go:272\u003e\\t(*Cache).run\\tdeployment stats metrics refreshed\\t{\\\"took\\\": \\\"20.37µs\\\", \\\"interval\\\": \\\"30s\\\"}\"\n"}
-{"Time":"2023-03-29T13:37:59.144212142Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.139 [DEBUG]\\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:200\u003e\\t(*Server).connect\\tconnected\"\n"}
-{"Time":"2023-03-29T13:37:59.1442281Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.139 [DEBUG]\\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:200\u003e\\t(*Server).connect\\tconnected\"\n"}
-{"Time":"2023-03-29T13:37:59.14427036Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.139 [DEBUG]\\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:200\u003e\\t(*Server).connect\\tconnected\"\n"}
-{"Time":"2023-03-29T13:37:59.14428344Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.143 [DEBUG]\\t(coderd.metrics_cache)\\t\u003cgithub.com/coder/coder/coderd/metricscache/metricscache.go:272\u003e\\t(*Cache).run\\ttemplate daus metrics refreshed\\t{\\\"took\\\": \\\"3.61474ms\\\", \\\"interval\\\": \\\"1h0m0s\\\"}\"\n"}
-{"Time":"2023-03-29T13:37:59.14429578Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
-{"Time":"2023-03-29T13:37:59.14430588Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Shutting down API server...\"\n"}
-{"Time":"2023-03-29T13:37:59.144315009Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                           \\r\"\n"}
-{"Time":"2023-03-29T13:37:59.144324164Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Gracefully shut down API server\"\n"}
-{"Time":"2023-03-29T13:37:59.144339556Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                               \\r\"\n"}
-{"Time":"2023-03-29T13:37:59.144624294Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Shutting down provisioner daemon 1...\"\n"}
-{"Time":"2023-03-29T13:37:59.144639861Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                     \\r\"\n"}
-{"Time":"2023-03-29T13:37:59.14465833Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.144 [DEBUG]\\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:553\u003e\\t(*Server).closeWithError\\tclosing server with error\\t{\\\"error\\\": null}\"\n"}
-{"Time":"2023-03-29T13:37:59.14468626Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Gracefully shut down provisioner daemon 1\"\n"}
-{"Time":"2023-03-29T13:37:59.144695878Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                         \\r\"\n"}
-{"Time":"2023-03-29T13:37:59.144705145Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Shutting down provisioner daemon 2...\"\n"}
-{"Time":"2023-03-29T13:37:59.144718072Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                     \\r\"\n"}
-{"Time":"2023-03-29T13:37:59.144727731Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.144 [DEBUG]\\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:553\u003e\\t(*Server).closeWithError\\tclosing server with error\\t{\\\"error\\\": null}\"\n"}
-{"Time":"2023-03-29T13:37:59.144750279Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Gracefully shut down provisioner daemon 2\"\n"}
-{"Time":"2023-03-29T13:37:59.144764838Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                         \\r\"\n"}
-{"Time":"2023-03-29T13:37:59.14477793Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Shutting down provisioner daemon 3...\"\n"}
-{"Time":"2023-03-29T13:37:59.144787313Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                     \\r\"\n"}
-{"Time":"2023-03-29T13:37:59.144797136Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.144 [DEBUG]\\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:553\u003e\\t(*Server).closeWithError\\tclosing server with error\\t{\\\"error\\\": null}\"\n"}
-{"Time":"2023-03-29T13:37:59.144810893Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Gracefully shut down provisioner daemon 3\"\n"}
-{"Time":"2023-03-29T13:37:59.144821417Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                         \\r\"\n"}
-{"Time":"2023-03-29T13:37:59.144842079Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Waiting for WebSocket connections to close...\"\n"}
-{"Time":"2023-03-29T13:37:59.144855916Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                             \\r\"\n"}
-{"Time":"2023-03-29T13:37:59.144867744Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Done waiting for WebSocket connections\"\n"}
-{"Time":"2023-03-29T13:37:59.14488065Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                      \\r\"\n"}
-{"Time":"2023-03-29T13:37:59.146012139Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:83: 2023-03-29 13:37:59.145: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:37:59.146025303Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:74: 2023-03-29 13:37:59.145: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:37:59.14606956Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:110: 2023-03-29 13:37:59.146: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:59.146083103Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:111: 2023-03-29 13:37:59.146: cmd: closing out\n"}
-{"Time":"2023-03-29T13:37:59.146095911Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:113: 2023-03-29 13:37:59.146: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:37:59.146143558Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:76: 2023-03-29 13:37:59.146: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:59.146156843Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:74: 2023-03-29 13:37:59.146: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:37:59.146169893Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:76: 2023-03-29 13:37:59.146: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:59.146182763Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:74: 2023-03-29 13:37:59.146: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:37:59.146191645Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:76: 2023-03-29 13:37:59.146: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:37:59.146205122Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:102: 2023-03-29 13:37:59.146: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:37:59.146368404Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Output":"--- PASS: TestServer/Logging/Stackdriver (26.23s)\n"}
-{"Time":"2023-03-29T13:37:59.146391543Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging/Stackdriver","Elapsed":26.23}
-{"Time":"2023-03-29T13:37:59.146412558Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging","Output":"--- PASS: TestServer/Logging (0.00s)\n"}
-{"Time":"2023-03-29T13:37:59.146438143Z","Action":"pass","Package":"github.com/coder/coder/cli","Test":"TestServer/Logging","Elapsed":0}
-{"Time":"2023-03-29T13:37:59.1464552Z","Action":"output","Package":"github.com/coder/coder/cli","Test":"TestServer","Output":"--- FAIL: TestServer (0.05s)\n"}
-{"Time":"2023-03-29T13:37:59.146474821Z","Action":"fail","Package":"github.com/coder/coder/cli","Test":"TestServer","Elapsed":0.05}
-{"Time":"2023-03-29T13:37:59.146491309Z","Action":"output","Package":"github.com/coder/coder/cli","Output":"FAIL\n"}
-{"Time":"2023-03-29T13:37:59.158021068Z","Action":"output","Package":"github.com/coder/coder/cli","Output":"FAIL\tgithub.com/coder/coder/cli\t26.514s\n"}
-{"Time":"2023-03-29T13:37:59.158054855Z","Action":"fail","Package":"github.com/coder/coder/cli","Elapsed":26.514}
-{"Time":"2023-03-29T13:38:02.724238056Z","Action":"start","Package":"github.com/coder/coder/cli/cliui"}
-{"Time":"2023-03-29T13:38:02.754440648Z","Action":"run","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth"}
-{"Time":"2023-03-29T13:38:02.75448054Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"=== RUN   TestGitAuth\n"}
-{"Time":"2023-03-29T13:38:02.754486705Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"=== PAUSE TestGitAuth\n"}
-{"Time":"2023-03-29T13:38:02.754490044Z","Action":"pause","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth"}
-{"Time":"2023-03-29T13:38:02.754493443Z","Action":"run","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt"}
-{"Time":"2023-03-29T13:38:02.754496272Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt","Output":"=== RUN   TestPrompt\n"}
-{"Time":"2023-03-29T13:38:02.754504892Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt","Output":"=== PAUSE TestPrompt\n"}
-{"Time":"2023-03-29T13:38:02.754507539Z","Action":"pause","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt"}
-{"Time":"2023-03-29T13:38:02.754510534Z","Action":"cont","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth"}
-{"Time":"2023-03-29T13:38:02.754514471Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"=== CONT  TestGitAuth\n"}
-{"Time":"2023-03-29T13:38:02.754642422Z","Action":"cont","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt"}
-{"Time":"2023-03-29T13:38:02.754653067Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt","Output":"=== CONT  TestPrompt\n"}
-{"Time":"2023-03-29T13:38:02.754658206Z","Action":"run","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success"}
-{"Time":"2023-03-29T13:38:02.754660941Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"=== RUN   TestPrompt/Success\n"}
-{"Time":"2023-03-29T13:38:02.754664503Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"=== PAUSE TestPrompt/Success\n"}
-{"Time":"2023-03-29T13:38:02.754666941Z","Action":"pause","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success"}
-{"Time":"2023-03-29T13:38:02.754671476Z","Action":"run","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm"}
-{"Time":"2023-03-29T13:38:02.754673908Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"=== RUN   TestPrompt/Confirm\n"}
-{"Time":"2023-03-29T13:38:02.754676919Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"=== PAUSE TestPrompt/Confirm\n"}
-{"Time":"2023-03-29T13:38:02.754683157Z","Action":"pause","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm"}
-{"Time":"2023-03-29T13:38:02.754688172Z","Action":"run","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip"}
-{"Time":"2023-03-29T13:38:02.754690617Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"=== RUN   TestPrompt/Skip\n"}
-{"Time":"2023-03-29T13:38:02.754693754Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"=== PAUSE TestPrompt/Skip\n"}
-{"Time":"2023-03-29T13:38:02.754696128Z","Action":"pause","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip"}
-{"Time":"2023-03-29T13:38:02.754700672Z","Action":"run","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON"}
-{"Time":"2023-03-29T13:38:02.754703008Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"=== RUN   TestPrompt/JSON\n"}
-{"Time":"2023-03-29T13:38:02.754718094Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"=== PAUSE TestPrompt/JSON\n"}
-{"Time":"2023-03-29T13:38:02.754723349Z","Action":"pause","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON"}
-{"Time":"2023-03-29T13:38:02.754728958Z","Action":"run","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON"}
-{"Time":"2023-03-29T13:38:02.754731492Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"=== RUN   TestPrompt/BadJSON\n"}
-{"Time":"2023-03-29T13:38:02.754734435Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"=== PAUSE TestPrompt/BadJSON\n"}
-{"Time":"2023-03-29T13:38:02.754736902Z","Action":"pause","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON"}
-{"Time":"2023-03-29T13:38:02.754748953Z","Action":"run","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON"}
-{"Time":"2023-03-29T13:38:02.754751439Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"=== RUN   TestPrompt/MultilineJSON\n"}
-{"Time":"2023-03-29T13:38:02.754755982Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"=== PAUSE TestPrompt/MultilineJSON\n"}
-{"Time":"2023-03-29T13:38:02.754760728Z","Action":"pause","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON"}
-{"Time":"2023-03-29T13:38:02.754764892Z","Action":"cont","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success"}
-{"Time":"2023-03-29T13:38:02.754767252Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"=== CONT  TestPrompt/Success\n"}
-{"Time":"2023-03-29T13:38:02.754976869Z","Action":"cont","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON"}
-{"Time":"2023-03-29T13:38:02.754982653Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"=== CONT  TestPrompt/MultilineJSON\n"}
-{"Time":"2023-03-29T13:38:02.755108229Z","Action":"cont","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON"}
-{"Time":"2023-03-29T13:38:02.755113844Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"=== CONT  TestPrompt/BadJSON\n"}
-{"Time":"2023-03-29T13:38:02.755212757Z","Action":"cont","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON"}
-{"Time":"2023-03-29T13:38:02.755218041Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"=== CONT  TestPrompt/JSON\n"}
-{"Time":"2023-03-29T13:38:02.755315155Z","Action":"cont","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip"}
-{"Time":"2023-03-29T13:38:02.755318778Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"=== CONT  TestPrompt/Skip\n"}
-{"Time":"2023-03-29T13:38:02.755513491Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:83: 2023-03-29 13:38:02.755: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:38:02.755529621Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:74: 2023-03-29 13:38:02.755: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:38:02.755596722Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:76: 2023-03-29 13:38:02.755: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.755601928Z","Action":"cont","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm"}
-{"Time":"2023-03-29T13:38:02.755604522Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"=== CONT  TestPrompt/Confirm\n"}
-{"Time":"2023-03-29T13:38:02.756154509Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:110: 2023-03-29 13:38:02.756: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.756161274Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:111: 2023-03-29 13:38:02.756: cmd: closing out\n"}
-{"Time":"2023-03-29T13:38:02.756179269Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:113: 2023-03-29 13:38:02.756: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.756195571Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:74: 2023-03-29 13:38:02.756: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:38:02.75620977Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:76: 2023-03-29 13:38:02.756: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.756222494Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:74: 2023-03-29 13:38:02.756: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:38:02.756250235Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:76: 2023-03-29 13:38:02.756: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.756263435Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:102: 2023-03-29 13:38:02.756: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:38:02.75631973Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:83: 2023-03-29 13:38:02.756: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:38:02.756334455Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:74: 2023-03-29 13:38:02.756: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:38:02.756398184Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:76: 2023-03-29 13:38:02.756: cmd: closed pty: pty: closed\n"}
-{"Time":"2023-03-29T13:38:02.75641208Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:74: 2023-03-29 13:38:02.756: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:38:02.756425561Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:76: 2023-03-29 13:38:02.756: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.756442572Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:74: 2023-03-29 13:38:02.756: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:38:02.756457245Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:76: 2023-03-29 13:38:02.756: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.756473084Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:102: 2023-03-29 13:38:02.756: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:38:02.756487964Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Output":"--- PASS: TestPrompt/Skip (0.00s)\n"}
-{"Time":"2023-03-29T13:38:02.756674486Z","Action":"pass","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Skip","Elapsed":0}
-{"Time":"2023-03-29T13:38:02.756683362Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    prompt_test.go:51: 2023-03-29 13:38:02.756: cmd: matched \"Example\" = \"\u003e Example\"\n"}
-{"Time":"2023-03-29T13:38:02.756700414Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    prompt_test.go:52: 2023-03-29 13:38:02.756: cmd: stdin: \"yes\\r\"\n"}
-{"Time":"2023-03-29T13:38:02.756759525Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    prompt_test.go:108: 2023-03-29 13:38:02.756: cmd: matched \"Example\" = \"\u003e Example\"\n"}
-{"Time":"2023-03-29T13:38:02.75678767Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    prompt_test.go:109: 2023-03-29 13:38:02.756: cmd: stdin: \"{}\\r\"\n"}
-{"Time":"2023-03-29T13:38:02.756838147Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    prompt_test.go:124: 2023-03-29 13:38:02.756: cmd: matched \"Example\" = \"\u003e Example\"\n"}
-{"Time":"2023-03-29T13:38:02.756862647Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    prompt_test.go:125: 2023-03-29 13:38:02.756: cmd: stdin: \"{a\\r\"\n"}
-{"Time":"2023-03-29T13:38:02.756932142Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    prompt_test.go:140: 2023-03-29 13:38:02.756: cmd: matched \"Example\" = \"\u003e Example\"\n"}
-{"Time":"2023-03-29T13:38:02.756958031Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    prompt_test.go:141: 2023-03-29 13:38:02.756: cmd: stdin: \"{\\n\\\"test\\\": \\\"wow\\\"\\n}\\r\"\n"}
-{"Time":"2023-03-29T13:38:02.757013878Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:121: 2023-03-29 13:38:02.756: cmd: \"You must authenticate with GitHub to create a workspace with this template. Visit:\"\n"}
-{"Time":"2023-03-29T13:38:02.757025551Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\"\n"}
-{"Time":"2023-03-29T13:38:02.757047114Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\\thttps://example.com/gitauth/github?redirect=%2Fgitauth%3Fnotify\"\n"}
-{"Time":"2023-03-29T13:38:02.757065197Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\"\n"}
-{"Time":"2023-03-29T13:38:02.757096029Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\\r\\r⠈⠁ Waiting for Git authentication...\\rSuccessfully authenticated with GitHub!\"\n"}
-{"Time":"2023-03-29T13:38:02.757108294Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\"\n"}
-{"Time":"2023-03-29T13:38:02.757140128Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    gitauth_test.go:53: 2023-03-29 13:38:02.757: cmd: matched \"You must authenticate with\" = \"You must authenticate with\"\n"}
-{"Time":"2023-03-29T13:38:02.757190596Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    gitauth_test.go:54: 2023-03-29 13:38:02.757: cmd: matched \"https://example.com/gitauth/github\" = \" GitHub to create a workspace with this template. Visit:\\r\\n\\r\\n\\thttps://example.com/gitauth/github\"\n"}
-{"Time":"2023-03-29T13:38:02.757264811Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    gitauth_test.go:55: 2023-03-29 13:38:02.757: cmd: matched \"Successfully authenticated with GitHub\" = \"?redirect=%2Fgitauth%3Fnotify\\r\\n\\r\\n\\r\\r⠈⠁ Waiting for Git authentication...\\rSuccessfully authenticated with GitHub\"\n"}
-{"Time":"2023-03-29T13:38:02.757294284Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:83: 2023-03-29 13:38:02.757: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:38:02.757307619Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:74: 2023-03-29 13:38:02.757: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:38:02.757350699Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:110: 2023-03-29 13:38:02.757: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.757369646Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:111: 2023-03-29 13:38:02.757: cmd: closing out\n"}
-{"Time":"2023-03-29T13:38:02.757388269Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:113: 2023-03-29 13:38:02.757: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.757437516Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:76: 2023-03-29 13:38:02.757: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.7574545Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:74: 2023-03-29 13:38:02.757: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:38:02.757468757Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:76: 2023-03-29 13:38:02.757: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.757483649Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:74: 2023-03-29 13:38:02.757: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:38:02.757496041Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:76: 2023-03-29 13:38:02.757: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.757513203Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:102: 2023-03-29 13:38:02.757: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:38:02.757518992Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Output":"--- PASS: TestGitAuth (0.00s)\n"}
-{"Time":"2023-03-29T13:38:02.75757314Z","Action":"pass","Package":"github.com/coder/coder/cli/cliui","Test":"TestGitAuth","Elapsed":0}
-{"Time":"2023-03-29T13:38:02.757576987Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    prompt_test.go:34: 2023-03-29 13:38:02.757: cmd: matched \"Example\" = \"\u003e Example\"\n"}
-{"Time":"2023-03-29T13:38:02.757605985Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    prompt_test.go:35: 2023-03-29 13:38:02.757: cmd: stdin: \"hello\\r\"\n"}
-{"Time":"2023-03-29T13:38:02.757679461Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\u003e Example hello\"\n"}
-{"Time":"2023-03-29T13:38:02.757731096Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:83: 2023-03-29 13:38:02.757: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:38:02.757745488Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:74: 2023-03-29 13:38:02.757: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:38:02.757786052Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:110: 2023-03-29 13:38:02.757: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.757793961Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:111: 2023-03-29 13:38:02.757: cmd: closing out\n"}
-{"Time":"2023-03-29T13:38:02.757809024Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:113: 2023-03-29 13:38:02.757: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.757853587Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:76: 2023-03-29 13:38:02.757: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.757869751Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:74: 2023-03-29 13:38:02.757: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:38:02.757888281Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:76: 2023-03-29 13:38:02.757: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.757896143Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:74: 2023-03-29 13:38:02.757: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:38:02.757912615Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:76: 2023-03-29 13:38:02.757: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.757929309Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:102: 2023-03-29 13:38:02.757: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:38:02.757934794Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Output":"--- PASS: TestPrompt/Success (0.00s)\n"}
-{"Time":"2023-03-29T13:38:02.757963355Z","Action":"pass","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Success","Elapsed":0}
-{"Time":"2023-03-29T13:38:02.757966707Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\u003e Example {\"\n"}
-{"Time":"2023-03-29T13:38:02.757981822Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\\\"test\\\": \\\"wow\\\"\"\n"}
-{"Time":"2023-03-29T13:38:02.757994456Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"}\"\n"}
-{"Time":"2023-03-29T13:38:02.75807554Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:83: 2023-03-29 13:38:02.758: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:38:02.758091845Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:38:02.758122927Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:110: 2023-03-29 13:38:02.758: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.758135875Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:111: 2023-03-29 13:38:02.758: cmd: closing out\n"}
-{"Time":"2023-03-29T13:38:02.758148587Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:113: 2023-03-29 13:38:02.758: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.758193703Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.758208689Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:38:02.75822251Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.758236906Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:38:02.758250264Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.758266392Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:102: 2023-03-29 13:38:02.758: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:38:02.758271916Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"--- PASS: TestPrompt/MultilineJSON (0.00s)\n"}
-{"Time":"2023-03-29T13:38:02.758311206Z","Action":"pass","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/MultilineJSON","Elapsed":0}
-{"Time":"2023-03-29T13:38:02.758314623Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:121: 2023-03-29 13:38:02.758: cmd: \"\u003e Example {a\"\n"}
-{"Time":"2023-03-29T13:38:02.75836333Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:83: 2023-03-29 13:38:02.758: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:38:02.758378803Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:38:02.758418274Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:110: 2023-03-29 13:38:02.758: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.758425803Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:111: 2023-03-29 13:38:02.758: cmd: closing out\n"}
-{"Time":"2023-03-29T13:38:02.75844102Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:113: 2023-03-29 13:38:02.758: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.758482492Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.758498572Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:38:02.758513045Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.758526569Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:38:02.75853994Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.758557098Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:102: 2023-03-29 13:38:02.758: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:38:02.758562364Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Output":"--- PASS: TestPrompt/BadJSON (0.00s)\n"}
-{"Time":"2023-03-29T13:38:02.758589722Z","Action":"pass","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/BadJSON","Elapsed":0}
-{"Time":"2023-03-29T13:38:02.758593068Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:121: 2023-03-29 13:38:02.758: cmd: \"\u003e Example {}\"\n"}
-{"Time":"2023-03-29T13:38:02.758640512Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:83: 2023-03-29 13:38:02.758: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:38:02.75865573Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:38:02.75868581Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:110: 2023-03-29 13:38:02.758: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.758697594Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:111: 2023-03-29 13:38:02.758: cmd: closing out\n"}
-{"Time":"2023-03-29T13:38:02.758712004Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:113: 2023-03-29 13:38:02.758: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.758753059Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.758789238Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:38:02.75880265Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.758821412Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:38:02.758835398Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.758851842Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:102: 2023-03-29 13:38:02.758: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:38:02.758857116Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Output":"--- PASS: TestPrompt/JSON (0.00s)\n"}
-{"Time":"2023-03-29T13:38:02.758897163Z","Action":"pass","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/JSON","Elapsed":0}
-{"Time":"2023-03-29T13:38:02.758900525Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:121: 2023-03-29 13:38:02.758: cmd: \"\u003e Example (yes/no) yes\"\n"}
-{"Time":"2023-03-29T13:38:02.758967291Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:83: 2023-03-29 13:38:02.758: cmd: closing tpty: close\n"}
-{"Time":"2023-03-29T13:38:02.758981151Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing pty\n"}
-{"Time":"2023-03-29T13:38:02.759023005Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:110: 2023-03-29 13:38:02.758: cmd: copy done: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.759035878Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:111: 2023-03-29 13:38:02.759: cmd: closing out\n"}
-{"Time":"2023-03-29T13:38:02.759048644Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:113: 2023-03-29 13:38:02.759: cmd: closed out: read /dev/ptmx: file already closed\n"}
-{"Time":"2023-03-29T13:38:02.759094323Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:76: 2023-03-29 13:38:02.759: cmd: closed pty: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.759115364Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:74: 2023-03-29 13:38:02.759: cmd: closing logw\n"}
-{"Time":"2023-03-29T13:38:02.75913071Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:76: 2023-03-29 13:38:02.759: cmd: closed logw: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.759144071Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:74: 2023-03-29 13:38:02.759: cmd: closing logr\n"}
-{"Time":"2023-03-29T13:38:02.75915741Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:76: 2023-03-29 13:38:02.759: cmd: closed logr: \u003cnil\u003e\n"}
-{"Time":"2023-03-29T13:38:02.759174685Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:102: 2023-03-29 13:38:02.759: cmd: closed tpty\n"}
-{"Time":"2023-03-29T13:38:02.759180019Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Output":"--- PASS: TestPrompt/Confirm (0.00s)\n"}
-{"Time":"2023-03-29T13:38:02.759187539Z","Action":"pass","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt/Confirm","Elapsed":0}
-{"Time":"2023-03-29T13:38:02.75919072Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt","Output":"--- PASS: TestPrompt (0.00s)\n"}
-{"Time":"2023-03-29T13:38:02.759194742Z","Action":"pass","Package":"github.com/coder/coder/cli/cliui","Test":"TestPrompt","Elapsed":0}
-{"Time":"2023-03-29T13:38:02.759198362Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Output":"PASS\n"}
-{"Time":"2023-03-29T13:38:02.761021961Z","Action":"output","Package":"github.com/coder/coder/cli/cliui","Output":"ok  \tgithub.com/coder/coder/cli/cliui\t0.037s\n"}
-{"Time":"2023-03-29T13:38:02.761046557Z","Action":"pass","Package":"github.com/coder/coder/cli/cliui","Elapsed":0.037}
+{"Time":"2023-03-29T13:37:23.355347397Z","Action":"start","Package":"github.com/coder/coder/v2/agent"}
+{"Time":"2023-03-29T13:37:23.381695238Z","Action":"run","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec"}
+{"Time":"2023-03-29T13:37:23.38177342Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"=== RUN   TestAgent_SessionExec\n"}
+{"Time":"2023-03-29T13:37:23.381791755Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"=== PAUSE TestAgent_SessionExec\n"}
+{"Time":"2023-03-29T13:37:23.381805147Z","Action":"pause","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec"}
+{"Time":"2023-03-29T13:37:23.381827974Z","Action":"run","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell"}
+{"Time":"2023-03-29T13:37:23.381835977Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"=== RUN   TestAgent_SessionTTYShell\n"}
+{"Time":"2023-03-29T13:37:23.381850018Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"=== PAUSE TestAgent_SessionTTYShell\n"}
+{"Time":"2023-03-29T13:37:23.381857444Z","Action":"pause","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell"}
+{"Time":"2023-03-29T13:37:23.381868815Z","Action":"run","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode"}
+{"Time":"2023-03-29T13:37:23.381876252Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"=== RUN   TestAgent_SessionTTYExitCode\n"}
+{"Time":"2023-03-29T13:37:23.381885049Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"=== PAUSE TestAgent_SessionTTYExitCode\n"}
+{"Time":"2023-03-29T13:37:23.381896641Z","Action":"pause","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode"}
+{"Time":"2023-03-29T13:37:23.381914968Z","Action":"run","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD"}
+{"Time":"2023-03-29T13:37:23.381930694Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"=== RUN   TestAgent_Session_TTY_MOTD\n"}
+{"Time":"2023-03-29T13:37:23.459584829Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:37:23.45962803Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:37:23.459637144Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:37:23.459709589Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:37:23.459766441Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:37:23.459896565Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:23.45992711Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:23.460013936Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.459 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:23.460047337Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:23.460151722Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:23.460178571Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:23.460311639Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:07ad6d06cd8b5ff2\n"}
+{"Time":"2023-03-29T13:37:23.460356174Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:37:23.460498076Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:37:23.460536017Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:37:23.460590141Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:37:23.460620636Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:37:23.460662149Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:37:23.460698929Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:37:23.460733289Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:23.460789117Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:37:23.460856196Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:37:23.460986291Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.460 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:37:23.46141926Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.461 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:23.461506329Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.461 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:37:23.461608094Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.461 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:23.46164708Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.461 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
+{"Time":"2023-03-29T13:37:23.461997997Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.461 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 48127, \"DERPPort\": 44839, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"/tmp/TestAgent_Session_TTY_MOTD1157664819/001/motd\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
+{"Time":"2023-03-29T13:37:23.462041275Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.461 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
+{"Time":"2023-03-29T13:37:23.462418253Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:37:23.46244618Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:37:23.462489007Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:37:23.462532307Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:37:23.462584588Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:37:23.462669431Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:23.462699701Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:23.46277017Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:23.46280348Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:23.46284612Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:23.462890638Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:23.463014252Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.462 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:8ac4cc2c7460d56f\n"}
+{"Time":"2023-03-29T13:37:23.463040585Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:37:23.463167416Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:37:23.463228086Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:37:23.463265117Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:37:23.463307341Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:37:23.463345133Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:37:23.463380146Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:37:23.463437865Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:23.463474458Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:37:23.463513083Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:37:23.463651429Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:37:23.463966826Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:23.463992242Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.463 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:37:23.464079789Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.464 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
+{"Time":"2023-03-29T13:37:23.464100162Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.464 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
+{"Time":"2023-03-29T13:37:23.464314405Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.464 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.464098Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:23.470436775Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.470 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:37:23.473142737Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.473 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:37:23.473905461Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.473 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:37:23.476012898Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.475 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.4615Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:23.476335333Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.476 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:23.476591432Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.476 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:37:23.476641778Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.476 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:37:23.476677236Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.476 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:37:23.47834267Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.478 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:37:23.478773607Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.478 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:37:23.479289417Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.479 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:37:23.484191154Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.484 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.4615Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:23.484233027Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.484 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:23.484426557Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.484 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
+{"Time":"2023-03-29T13:37:23.484790305Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.484 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:37:23.484946523Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.484 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:37:23.485230922Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:37:23.485304276Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:23.485410816Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:37:23.485506941Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:37:23.485747079Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:37:23.485857203Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:37:23.485942868Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.485 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:23.486354495Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.486 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.464098Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:23.486406209Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.486 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:23.486580191Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.486 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\n"}
+{"Time":"2023-03-29T13:37:23.486731116Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.486 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:37:23.486910536Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.486 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:37:23.48721125Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:37:23.487271545Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:23.487362767Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:37:23.487505661Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:37:23.48757023Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:37:23.487687075Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:37:23.487755179Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.487 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:23.533579774Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.533 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:41471 derp=1 derpdist=1v4:5ms\n"}
+{"Time":"2023-03-29T13:37:23.533653394Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.533 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:23.534036522Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.533 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:41471 (stun), 172.20.0.2:41471 (local)\n"}
+{"Time":"2023-03-29T13:37:23.534320881Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.534 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:23.534012576 +0000 UTC m=+0.173619877 Peers:[] LocalAddrs:[{Addr:127.0.0.1:41471 Type:stun} {Addr:172.20.0.2:41471 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:23.534485142Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:34768 derp=1 derpdist=1v4:4ms\n"}
+{"Time":"2023-03-29T13:37:23.534597588Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:23.534893919Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:34768 (stun), 172.20.0.2:34768 (local)\n"}
+{"Time":"2023-03-29T13:37:23.535056614Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.534 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:23.534872863 +0000 UTC m=+0.174480149 Peers:[] LocalAddrs:[{Addr:127.0.0.1:34768 Type:stun} {Addr:172.20.0.2:34768 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:23.535722359Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.535 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:37:23.535840193Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.535 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:37:23.53601927Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.535 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:23.535826298 +0000 UTC m=+0.175433549 Peers:[] LocalAddrs:[{Addr:127.0.0.1:41471 Type:stun} {Addr:172.20.0.2:41471 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:23.536284979Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.536 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.004534057}}}\n"}
+{"Time":"2023-03-29T13:37:23.536457311Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.536 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.5343Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": [\"127.0.0.1:41471\", \"172.20.0.2:41471\"]}}\n"}
+{"Time":"2023-03-29T13:37:23.536888005Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.536 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.5343Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": [\"127.0.0.1:41471\", \"172.20.0.2:41471\"]}}\n"}
+{"Time":"2023-03-29T13:37:23.536962253Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.536 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:23.537168204Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.537 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:23.537809136Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.537 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:23.537959175Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.537 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:37:23.538044116Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.537 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:37:23.538236588Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.538 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:23.538043332 +0000 UTC m=+0.177650587 Peers:[] LocalAddrs:[{Addr:127.0.0.1:34768 Type:stun} {Addr:172.20.0.2:34768 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:23.538347057Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.538 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.004475683}}}\n"}
+{"Time":"2023-03-29T13:37:23.538488084Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.538 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.535038Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34768\", \"172.20.0.2:34768\"]}}\n"}
+{"Time":"2023-03-29T13:37:23.538915728Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.538 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.535038Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34768\", \"172.20.0.2:34768\"]}}\n"}
+{"Time":"2023-03-29T13:37:23.538974002Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.538 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:23.539154829Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.539 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:23.539540545Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.539 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:23.539953465Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.539 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.539778Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.004534057}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": [\"127.0.0.1:41471\", \"172.20.0.2:41471\"]}}\n"}
+{"Time":"2023-03-29T13:37:23.540373922Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.540 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.539778Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.004534057}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": [\"127.0.0.1:41471\", \"172.20.0.2:41471\"]}}\n"}
+{"Time":"2023-03-29T13:37:23.540832675Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.540 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:23.540920246Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.540 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:23.541080962Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.541 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:37:23.541207198Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.541 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:23.541540025Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.541 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:23.541869031Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.541 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.541715Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.004475683}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34768\", \"172.20.0.2:34768\"]}}\n"}
+{"Time":"2023-03-29T13:37:23.542270097Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.542 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.541715Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.004475683}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34768\", \"172.20.0.2:34768\"]}}\n"}
+{"Time":"2023-03-29T13:37:23.542592821Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.542 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:23.542683196Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.542 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:23.542867815Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.542 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:37:23.542985478Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.542 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:23.55226213Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.552 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:37:23.552392256Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.552 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:37:23.589932282Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.589 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:34768 derp=1 derpdist=1v4:4ms\n"}
+{"Time":"2023-03-29T13:37:23.591567427Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.591 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:41471 derp=1 derpdist=1v4:2ms\n"}
+{"Time":"2023-03-29T13:37:23.598751818Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.598 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [0x7ra]  ...\n"}
+{"Time":"2023-03-29T13:37:23.598954894Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.598 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [0x7ra] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:37:23.599390218Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.599 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [vT+Vd] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:37:23.599516651Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.599 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [0x7ra] d:8ac4cc2c7460d56f now using 172.20.0.2:34768\n"}
+{"Time":"2023-03-29T13:37:23.599643596Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.599 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [0x7ra]  ...\n"}
+{"Time":"2023-03-29T13:37:23.59972717Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.599 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [0x7ra]  ...\n"}
+{"Time":"2023-03-29T13:37:23.600132385Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:23.600385251Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:37:23.600423261Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:37:23.600476824Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:37:23.600511572Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:37:23.600547765Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:23.600583838Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - Starting\n"}
+{"Time":"2023-03-29T13:37:23.600650591Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - Sending handshake initiation\n"}
+{"Time":"2023-03-29T13:37:23.601044073Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.600 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [vT+Vd] now active, reconfiguring WireGuard\n"}
+{"Time":"2023-03-29T13:37:23.601107152Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:23.601327676Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:37:23.601369666Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:37:23.601396751Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:37:23.601460927Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:37:23.601495639Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:23.601526183Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - Starting\n"}
+{"Time":"2023-03-29T13:37:23.60175503Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - Received handshake initiation\n"}
+{"Time":"2023-03-29T13:37:23.601775856Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.601 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - Sending handshake response\n"}
+{"Time":"2023-03-29T13:37:23.602280259Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.602 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:23.602127595 +0000 UTC m=+0.241734812 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33}] LocalAddrs:[{Addr:127.0.0.1:34768 Type:stun} {Addr:172.20.0.2:34768 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:23.602838109Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.602 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - Received handshake response\n"}
+{"Time":"2023-03-29T13:37:23.602930775Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.602 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [vT+Vd] d:07ad6d06cd8b5ff2 now using 172.20.0.2:41471\n"}
+{"Time":"2023-03-29T13:37:23.603134941Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.602 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:23.602980142 +0000 UTC m=+0.242587360 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:23.602828352 +0000 UTC NodeKey:nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229}] LocalAddrs:[{Addr:127.0.0.1:41471 Type:stun} {Addr:172.20.0.2:41471 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:23.603731388Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.603 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [0x7ra] d:8ac4cc2c7460d56f now using 127.0.0.1:34768\n"}
+{"Time":"2023-03-29T13:37:23.629049874Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    agent_test.go:298: 2023-03-29 13:37:23.628: cmd: stdin: \"exit 0\\r\"\n"}
+{"Time":"2023-03-29T13:37:23.62993175Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:121: 2023-03-29 13:37:23.629: cmd: \"exit 0\"\n"}
+{"Time":"2023-03-29T13:37:23.643243989Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.643 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:34768 derp=1 derpdist=1v4:1ms\n"}
+{"Time":"2023-03-29T13:37:23.643873931Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.643 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:41471 derp=1 derpdist=1v4:0s\n"}
+{"Time":"2023-03-29T13:37:23.644469186Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.644 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.000547591}}}\n"}
+{"Time":"2023-03-29T13:37:23.644715274Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.644 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.644461Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000547591}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34768\", \"172.20.0.2:34768\"]}}\n"}
+{"Time":"2023-03-29T13:37:23.645390624Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.645 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 5764434400100518555, \"as_of\": \"2023-03-29T13:37:23.644461Z\", \"key\": \"nodekey:d31eeb68b6968cc6779e62454901fb98bcacab1dcb46e15bec2b92205cc82229\", \"disco\": \"discokey:8ac4cc2c7460d56ffcd8064d64a7752b43475c7244a316f626b321097e07630f\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000547591}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34768\", \"172.20.0.2:34768\"]}}\n"}
+{"Time":"2023-03-29T13:37:23.64591875Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.645 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:23.646145075Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.645 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:23.646400847Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.646 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:23.646730863Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.646 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:23.646828936Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.646 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - Sending keepalive packet\n"}
+{"Time":"2023-03-29T13:37:23.646930238Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.646 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:23.647158211Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.646 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.000154898}}}\n"}
+{"Time":"2023-03-29T13:37:23.647376125Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.647 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.64715Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000154898}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": [\"127.0.0.1:41471\", \"172.20.0.2:41471\"]}}\n"}
+{"Time":"2023-03-29T13:37:23.648003118Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.647 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 3370308278017414080, \"as_of\": \"2023-03-29T13:37:23.64715Z\", \"key\": \"nodekey:bd3f9574e34fe33bab67dc45e49054f84d69e7c686af37bb2556989a8e6e9b33\", \"disco\": \"discokey:07ad6d06cd8b5ff2fd2b25fcd8f253332fd46d9820c6e0a670d9302db2d21411\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000154898}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775/128\"], \"endpoints\": [\"127.0.0.1:41471\", \"172.20.0.2:41471\"]}}\n"}
+{"Time":"2023-03-29T13:37:23.648256172Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:23.648338509Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:23.648471344Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:23.648609559Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:23.648638814Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - Sending keepalive packet\n"}
+{"Time":"2023-03-29T13:37:23.648721589Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:23.648895668Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - Receiving keepalive packet\n"}
+{"Time":"2023-03-29T13:37:23.648944175Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.648 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - Receiving keepalive packet\n"}
+{"Time":"2023-03-29T13:37:23.983374775Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:23.983 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775): sending disco ping to [vT+Vd]  ...\n"}
+{"Time":"2023-03-29T13:37:24.483975661Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.483 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775): sending disco ping to [vT+Vd]  ...\n"}
+{"Time":"2023-03-29T13:37:24.983883086Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.983 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775): sending disco ping to [vT+Vd]  ...\n"}
+{"Time":"2023-03-29T13:37:24.997284571Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:83: 2023-03-29 13:37:24.997: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:24.997307935Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:74: 2023-03-29 13:37:24.997: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:24.997315409Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:110: 2023-03-29 13:37:24.997: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:24.997319364Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:111: 2023-03-29 13:37:24.997: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:24.997323588Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:113: 2023-03-29 13:37:24.997: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:24.997370156Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:76: 2023-03-29 13:37:24.997: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:24.997381692Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:74: 2023-03-29 13:37:24.997: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:24.997385034Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:76: 2023-03-29 13:37:24.997: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:24.997389205Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:74: 2023-03-29 13:37:24.997: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:24.997393753Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:76: 2023-03-29 13:37:24.997: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:24.997405892Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    ptytest.go:102: 2023-03-29 13:37:24.997: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:24.997490606Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
+{"Time":"2023-03-29T13:37:24.997723999Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 1s\n"}
+{"Time":"2023-03-29T13:37:24.997783062Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:37:24.997839084Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:37:24.997864344Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:37:24.997932377Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:37:24.998046302Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.997 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:37:24.998086112Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:37:24.998136192Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0x7ra] - Stopping\n"}
+{"Time":"2023-03-29T13:37:24.998214902Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:37:24.998405401Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:37:24.998453108Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
+{"Time":"2023-03-29T13:37:24.998545966Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
+{"Time":"2023-03-29T13:37:24.998863807Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 1s\n"}
+{"Time":"2023-03-29T13:37:24.998907983Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:37:24.998974565Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:37:24.999012856Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.998 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:37:24.999084066Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.999 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:37:24.999163662Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.999 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4aeb:931f:72d2:b3f9:2775): sending disco ping to [vT+Vd]  ...\n"}
+{"Time":"2023-03-29T13:37:24.999281214Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.999 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:37:24.999322797Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.999 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:37:24.999367964Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.999 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [vT+Vd] - Stopping\n"}
+{"Time":"2023-03-29T13:37:24.999477141Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    t.go:81: 2023-03-29 13:37:24.999 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:37:24.999790842Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"    stuntest.go:63: STUN server shutdown\n"}
+{"Time":"2023-03-29T13:37:24.999978482Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Output":"--- PASS: TestAgent_Session_TTY_MOTD (1.62s)\n"}
+{"Time":"2023-03-29T13:37:24.999989636Z","Action":"pass","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_MOTD","Elapsed":1.62}
+{"Time":"2023-03-29T13:37:25.000001861Z","Action":"run","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin"}
+{"Time":"2023-03-29T13:37:25.000006766Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"=== RUN   TestAgent_Session_TTY_Hushlogin\n"}
+{"Time":"2023-03-29T13:37:25.061523057Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:37:25.061562172Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:37:25.061580317Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:37:25.061650184Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:37:25.061692748Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:37:25.061779714Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:25.061825894Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:25.0619026Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:25.061948469Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:25.061997351Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:25.062034009Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.061 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:25.062159882Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:de63960686d4d969\n"}
+{"Time":"2023-03-29T13:37:25.062211517Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:37:25.062292207Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:37:25.062336748Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:37:25.062378334Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:37:25.062420493Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:37:25.06246598Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:37:25.062509064Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:37:25.0625467Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:25.062582098Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:37:25.062621581Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:37:25.062741251Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.062 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:37:25.063047606Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:25.063098481Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:37:25.063228621Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:25.063275399Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
+{"Time":"2023-03-29T13:37:25.063394952Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 48719, \"DERPPort\": 45121, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"/tmp/TestAgent_Session_TTY_Hushlogin1510664063/001/motd\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
+{"Time":"2023-03-29T13:37:25.063449256Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
+{"Time":"2023-03-29T13:37:25.063787886Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:37:25.063828837Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:37:25.063873191Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:37:25.063920593Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:37:25.063972721Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.063 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:37:25.064056998Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:25.064104109Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:25.064172955Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:25.064220262Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:25.064265054Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:25.064311842Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:25.064424792Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:a2fa54a4398f4b14\n"}
+{"Time":"2023-03-29T13:37:25.064460776Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:37:25.064519398Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:37:25.064564764Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:37:25.064610015Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:37:25.064649665Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:37:25.064697586Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:37:25.064733375Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:37:25.06476809Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:25.064817752Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:37:25.064858351Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:37:25.064968632Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.064 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:37:25.065284782Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.065 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:25.065331529Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.065 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:37:25.065409197Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.065 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
+{"Time":"2023-03-29T13:37:25.065446163Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.065 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
+{"Time":"2023-03-29T13:37:25.065532991Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.065 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.065442Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:25.065984331Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.065 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:37:25.066385592Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.066 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:37:25.066774463Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.066 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:37:25.067577596Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.067 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.063134Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:25.067723294Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.067 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:25.067791082Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.067 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:37:25.067853127Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.067 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:37:25.067910376Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.067 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:37:25.0683366Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.068 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:37:25.07002731Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.069 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:37:25.071537156Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.071 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:37:25.073373256Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.065442Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:25.073396962Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:25.073480235Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\n"}
+{"Time":"2023-03-29T13:37:25.073564836Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:37:25.073671864Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:37:25.07378875Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:37:25.073820206Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:25.073854357Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:37:25.073896565Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:37:25.073931707Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:37:25.073965714Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:37:25.074005901Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.073 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:25.074880124Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.074 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.063134Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:25.074899766Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.074 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:25.074982929Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.074 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
+{"Time":"2023-03-29T13:37:25.075048527Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:37:25.075142259Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:37:25.075263679Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:37:25.075295728Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:25.075336116Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:37:25.075375372Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:37:25.075421587Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:37:25.075466864Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:37:25.075504912Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.075 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:25.117000024Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.116 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:25.124882906Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.124 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:60850 derp=1 derpdist=1v4:1ms\n"}
+{"Time":"2023-03-29T13:37:25.125053667Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.124 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:25.12561266Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.125 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:60850 (stun), 172.20.0.2:60850 (local)\n"}
+{"Time":"2023-03-29T13:37:25.125905661Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.125 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:25.125569748 +0000 UTC m=+1.765177074 Peers:[] LocalAddrs:[{Addr:127.0.0.1:60850 Type:stun} {Addr:172.20.0.2:60850 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:25.126844264Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.126 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:58304 derp=1 derpdist=1v4:1ms\n"}
+{"Time":"2023-03-29T13:37:25.127005238Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.126 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:25.127513222Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.127 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:58304 (stun), 172.20.0.2:58304 (local)\n"}
+{"Time":"2023-03-29T13:37:25.127757541Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.127 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:25.127481783 +0000 UTC m=+1.767089103 Peers:[] LocalAddrs:[{Addr:127.0.0.1:58304 Type:stun} {Addr:172.20.0.2:58304 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:25.128599916Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.128 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:37:25.128762101Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.128 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:37:25.129009957Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.128 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:25.12872419 +0000 UTC m=+1.768331474 Peers:[] LocalAddrs:[{Addr:127.0.0.1:60850 Type:stun} {Addr:172.20.0.2:60850 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:25.129209925Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.128 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.000985407}}}\n"}
+{"Time":"2023-03-29T13:37:25.129460508Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.129 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.125849Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:60850\", \"172.20.0.2:60850\"]}}\n"}
+{"Time":"2023-03-29T13:37:25.130127324Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.129 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.125849Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:60850\", \"172.20.0.2:60850\"]}}\n"}
+{"Time":"2023-03-29T13:37:25.130232734Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.130 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:25.13055158Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.130 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:25.131114968Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.130 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:37:25.131240194Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.131 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:37:25.131519421Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.131 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:25.131235659 +0000 UTC m=+1.770842948 Peers:[] LocalAddrs:[{Addr:127.0.0.1:58304 Type:stun} {Addr:172.20.0.2:58304 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:25.131694593Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.131 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.001250656}}}\n"}
+{"Time":"2023-03-29T13:37:25.131999693Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.131 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.127736Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": [\"127.0.0.1:58304\", \"172.20.0.2:58304\"]}}\n"}
+{"Time":"2023-03-29T13:37:25.132733057Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.132 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:25.133220162Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.132 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.132982Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000985407}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:60850\", \"172.20.0.2:60850\"]}}\n"}
+{"Time":"2023-03-29T13:37:25.133869838Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.133 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.132982Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000985407}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:60850\", \"172.20.0.2:60850\"]}}\n"}
+{"Time":"2023-03-29T13:37:25.134272814Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.134 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:25.134404044Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.134 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:25.134672632Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.134 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.134517Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.001250656}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": [\"127.0.0.1:58304\", \"172.20.0.2:58304\"]}}\n"}
+{"Time":"2023-03-29T13:37:25.134983325Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.134 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.127736Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": [\"127.0.0.1:58304\", \"172.20.0.2:58304\"]}}\n"}
+{"Time":"2023-03-29T13:37:25.135024699Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.134 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:25.135198837Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.135 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:25.135284701Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.135 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:25.135438825Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.135 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:37:25.135566373Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.135 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:25.135876201Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.135 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.134517Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.001250656}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": [\"127.0.0.1:58304\", \"172.20.0.2:58304\"]}}\n"}
+{"Time":"2023-03-29T13:37:25.136046662Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.136 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:25.136091872Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.136 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:25.136196604Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.136 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:37:25.136258441Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.136 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:25.143831824Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.143 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:37:25.143963014Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.143 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:37:25.181560631Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.181 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:60850 derp=1 derpdist=1v4:10ms\n"}
+{"Time":"2023-03-29T13:37:25.182840653Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.182 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:58304 derp=1 derpdist=1v4:8ms\n"}
+{"Time":"2023-03-29T13:37:25.197904655Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.197 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [0LjuK]  ...\n"}
+{"Time":"2023-03-29T13:37:25.198311943Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.198 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [0LjuK] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:37:25.199139623Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.199 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [S1KIY] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:37:25.199333828Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.199 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [0LjuK] d:a2fa54a4398f4b14 now using 172.20.0.2:60850\n"}
+{"Time":"2023-03-29T13:37:25.199614502Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.199 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [0LjuK]  ...\n"}
+{"Time":"2023-03-29T13:37:25.199798383Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.199 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [0LjuK]  ...\n"}
+{"Time":"2023-03-29T13:37:25.200531317Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.200 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:25.20096595Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.200 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:37:25.201076837Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.200 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:37:25.201187536Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.201 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:37:25.201294507Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.201 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:37:25.201406637Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.201 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:25.20154342Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.201 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - Starting\n"}
+{"Time":"2023-03-29T13:37:25.201642014Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.201 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - Sending handshake initiation\n"}
+{"Time":"2023-03-29T13:37:25.202494139Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.202 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [S1KIY] now active, reconfiguring WireGuard\n"}
+{"Time":"2023-03-29T13:37:25.202613281Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.202 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:25.203067239Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.202 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:37:25.203194112Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.203 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:37:25.203305469Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.203 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:37:25.203432836Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.203 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:37:25.203643635Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.203 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:25.203694677Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.203 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - Starting\n"}
+{"Time":"2023-03-29T13:37:25.204047455Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.203 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - Received handshake initiation\n"}
+{"Time":"2023-03-29T13:37:25.20407267Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.204 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - Sending handshake response\n"}
+{"Time":"2023-03-29T13:37:25.204499058Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.204 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:25.204364109 +0000 UTC m=+1.843971335 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262}] LocalAddrs:[{Addr:127.0.0.1:60850 Type:stun} {Addr:172.20.0.2:60850 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:25.204985233Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.204 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - Received handshake response\n"}
+{"Time":"2023-03-29T13:37:25.205043968Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.204 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [S1KIY] d:de63960686d4d969 now using 172.20.0.2:58304\n"}
+{"Time":"2023-03-29T13:37:25.205186973Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.205 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:25.205077383 +0000 UTC m=+1.844684599 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:25.204972346 +0000 UTC NodeKey:nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c}] LocalAddrs:[{Addr:127.0.0.1:58304 Type:stun} {Addr:172.20.0.2:58304 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:25.205653441Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.205 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [0LjuK] d:a2fa54a4398f4b14 now using 127.0.0.1:60850\n"}
+{"Time":"2023-03-29T13:37:25.228059809Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    agent_test.go:344: 2023-03-29 13:37:25.227: cmd: stdin: \"exit 0\\r\"\n"}
+{"Time":"2023-03-29T13:37:25.228276231Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:121: 2023-03-29 13:37:25.228: cmd: \"exit 0\"\n"}
+{"Time":"2023-03-29T13:37:25.235085539Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.235 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:58304 derp=1 derpdist=1v4:0s\n"}
+{"Time":"2023-03-29T13:37:25.235327678Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.235 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:60850 derp=1 derpdist=1v4:0s\n"}
+{"Time":"2023-03-29T13:37:25.235573892Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.235 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.000235695}}}\n"}
+{"Time":"2023-03-29T13:37:25.235627639Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.235 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.235549Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000235695}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": [\"127.0.0.1:58304\", \"172.20.0.2:58304\"]}}\n"}
+{"Time":"2023-03-29T13:37:25.235912714Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.235 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2479211229855255143, \"as_of\": \"2023-03-29T13:37:25.235549Z\", \"key\": \"nodekey:4b52886038d0b10509d4ba999d1a1ad8721795e419e104079b9b0d4334ccf262\", \"disco\": \"discokey:de63960686d4d9696035b3395ad51c334b1b6762f27929160b70e330e59fc955\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000235695}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7/128\"], \"endpoints\": [\"127.0.0.1:58304\", \"172.20.0.2:58304\"]}}\n"}
+{"Time":"2023-03-29T13:37:25.2361447Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:25.236185457Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:25.23632231Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:25.2364646Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:25.23648571Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - Sending keepalive packet\n"}
+{"Time":"2023-03-29T13:37:25.236535173Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:25.236646389Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.000124794}}}\n"}
+{"Time":"2023-03-29T13:37:25.236691145Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.236616Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000124794}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:60850\", \"172.20.0.2:60850\"]}}\n"}
+{"Time":"2023-03-29T13:37:25.236953136Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.236 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2366729466453183316, \"as_of\": \"2023-03-29T13:37:25.236616Z\", \"key\": \"nodekey:d0b8ee28a0ee87a0b3a9c4e4d551d52d6abae50aac6b29587f8aaaecaf92dc1c\", \"disco\": \"discokey:a2fa54a4398f4b14ed94f97af08fb0c8f1a7276aa663caf7d25542e565ef4f28\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.000124794}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:60850\", \"172.20.0.2:60850\"]}}\n"}
+{"Time":"2023-03-29T13:37:25.237148814Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:25.23717419Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:25.23729907Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:25.237442993Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:25.237465362Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - Sending keepalive packet\n"}
+{"Time":"2023-03-29T13:37:25.23748091Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:25.237621079Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - Receiving keepalive packet\n"}
+{"Time":"2023-03-29T13:37:25.237646187Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.237 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - Receiving keepalive packet\n"}
+{"Time":"2023-03-29T13:37:25.57358248Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:25.573 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7): sending disco ping to [S1KIY]  ...\n"}
+{"Time":"2023-03-29T13:37:26.073909695Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.073 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7): sending disco ping to [S1KIY]  ...\n"}
+{"Time":"2023-03-29T13:37:26.573442313Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.573 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7): sending disco ping to [S1KIY]  ...\n"}
+{"Time":"2023-03-29T13:37:26.685974077Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:83: 2023-03-29 13:37:26.685: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:26.686024343Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:74: 2023-03-29 13:37:26.685: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:26.686044434Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:110: 2023-03-29 13:37:26.685: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:26.686057034Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:111: 2023-03-29 13:37:26.685: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:26.686068789Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:113: 2023-03-29 13:37:26.685: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:26.686157867Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:76: 2023-03-29 13:37:26.686: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:26.686173026Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:74: 2023-03-29 13:37:26.686: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:26.686188025Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:76: 2023-03-29 13:37:26.686: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:26.686198978Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:74: 2023-03-29 13:37:26.686: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:26.686213128Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:76: 2023-03-29 13:37:26.686: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:26.686224275Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    ptytest.go:102: 2023-03-29 13:37:26.686: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:26.686399517Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
+{"Time":"2023-03-29T13:37:26.686631954Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 2s\n"}
+{"Time":"2023-03-29T13:37:26.686672029Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:37:26.686752993Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:37:26.686793215Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:37:26.686883059Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:37:26.687010573Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:37:26.687040046Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.686 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:37:26.687106628Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [0LjuK] - Stopping\n"}
+{"Time":"2023-03-29T13:37:26.687190751Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:37:26.68730229Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:37:26.687319022Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
+{"Time":"2023-03-29T13:37:26.68739086Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
+{"Time":"2023-03-29T13:37:26.687791287Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 2s\n"}
+{"Time":"2023-03-29T13:37:26.687807566Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:37:26.687907277Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:37:26.687956258Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:37:26.68802861Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.687 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:37:26.688112368Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.688 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4c72:9ce3:62e1:7385:dec7): sending disco ping to [S1KIY]  ...\n"}
+{"Time":"2023-03-29T13:37:26.688253692Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.688 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:37:26.688318345Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.688 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:37:26.688366659Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.688 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [S1KIY] - Stopping\n"}
+{"Time":"2023-03-29T13:37:26.688473063Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    t.go:81: 2023-03-29 13:37:26.688 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:37:26.688794731Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"    stuntest.go:63: STUN server shutdown\n"}
+{"Time":"2023-03-29T13:37:26.688993708Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Output":"--- PASS: TestAgent_Session_TTY_Hushlogin (1.69s)\n"}
+{"Time":"2023-03-29T13:37:26.689005169Z","Action":"pass","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_Hushlogin","Elapsed":1.69}
+{"Time":"2023-03-29T13:37:26.689017486Z","Action":"run","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput"}
+{"Time":"2023-03-29T13:37:26.689022846Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"=== RUN   TestAgent_Session_TTY_FastCommandHasOutput\n"}
+{"Time":"2023-03-29T13:37:26.689031231Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"=== PAUSE TestAgent_Session_TTY_FastCommandHasOutput\n"}
+{"Time":"2023-03-29T13:37:26.689049237Z","Action":"pause","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput"}
+{"Time":"2023-03-29T13:37:26.689055783Z","Action":"run","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost"}
+{"Time":"2023-03-29T13:37:26.689060673Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost","Output":"=== RUN   TestAgent_Session_TTY_HugeOutputIsNotLost\n"}
+{"Time":"2023-03-29T13:37:26.689069084Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost","Output":"=== PAUSE TestAgent_Session_TTY_HugeOutputIsNotLost\n"}
+{"Time":"2023-03-29T13:37:26.689074026Z","Action":"pause","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost"}
+{"Time":"2023-03-29T13:37:26.689083532Z","Action":"cont","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec"}
+{"Time":"2023-03-29T13:37:26.689090279Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"=== CONT  TestAgent_SessionExec\n"}
+{"Time":"2023-03-29T13:37:26.703787142Z","Action":"cont","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost"}
+{"Time":"2023-03-29T13:37:26.703825656Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost","Output":"=== CONT  TestAgent_Session_TTY_HugeOutputIsNotLost\n"}
+{"Time":"2023-03-29T13:37:26.703839698Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost","Output":"    agent_test.go:413: This test proves we have a bug where parts of large output on a PTY can be lost after the command exits, skipped to avoid test failures.\n"}
+{"Time":"2023-03-29T13:37:26.703868206Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost","Output":"--- SKIP: TestAgent_Session_TTY_HugeOutputIsNotLost (0.00s)\n"}
+{"Time":"2023-03-29T13:37:26.70388799Z","Action":"skip","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_HugeOutputIsNotLost","Elapsed":0}
+{"Time":"2023-03-29T13:37:26.703900175Z","Action":"cont","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput"}
+{"Time":"2023-03-29T13:37:26.703908033Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"=== CONT  TestAgent_Session_TTY_FastCommandHasOutput\n"}
+{"Time":"2023-03-29T13:37:26.723935151Z","Action":"cont","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode"}
+{"Time":"2023-03-29T13:37:26.723957967Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"=== CONT  TestAgent_SessionTTYExitCode\n"}
+{"Time":"2023-03-29T13:37:26.744050676Z","Action":"cont","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell"}
+{"Time":"2023-03-29T13:37:26.744073511Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"=== CONT  TestAgent_SessionTTYShell\n"}
+{"Time":"2023-03-29T13:37:26.975908391Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.975 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:37:26.975935102Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.975 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:37:26.975941463Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.975 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:37:26.975992643Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.975 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:37:26.976027672Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.975 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:37:26.976097148Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:26.976137127Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:26.976202552Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:26.976237559Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:26.976273529Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:26.976300958Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:26.976417909Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:17b5066de479f458\n"}
+{"Time":"2023-03-29T13:37:26.976445133Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:37:26.976529694Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:37:26.976575591Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:37:26.976603915Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:37:26.976641835Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:37:26.97666441Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:37:26.976690087Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:37:26.97672446Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:26.976749123Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:37:26.976786013Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:37:26.976893189Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.976 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:37:26.977219957Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.977 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:26.977264288Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.977 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:37:26.977393997Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:26.977 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.015978257Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.015 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
+{"Time":"2023-03-29T13:37:27.016072388Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.015 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 55109, \"DERPPort\": 34655, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
+{"Time":"2023-03-29T13:37:27.016101997Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
+{"Time":"2023-03-29T13:37:27.016454205Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:37:27.016484809Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:37:27.016527444Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:37:27.016579577Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:37:27.016616504Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:37:27.01670613Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.016736272Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.016795884Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.01683051Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.016869184Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.016901207Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.017009443Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.016 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:e6f05f1260bbd611\n"}
+{"Time":"2023-03-29T13:37:27.017032499Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:37:27.017087268Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:37:27.017133219Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:37:27.017166541Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:37:27.017198439Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:37:27.017231784Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.017255027Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:37:27.017285867Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.017313159Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:37:27.017341323Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:37:27.017453136Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:37:27.017777899Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.01781684Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:37:27.017877499Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
+{"Time":"2023-03-29T13:37:27.017903073Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
+{"Time":"2023-03-29T13:37:27.017983662Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.017 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.017904Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.018477038Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.018 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:37:27.018878036Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.018 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:37:27.019251435Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.019 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:37:27.020053918Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.019 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:26.977307Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.020198673Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.020 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.020242577Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.020 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:37:27.020285833Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.020 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:37:27.020317905Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.020 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:37:27.036521314Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.036 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:37:27.036924425Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.036 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:37:27.037332816Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.037 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:37:27.03841778Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.017904Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.038434547Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.03852175Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\n"}
+{"Time":"2023-03-29T13:37:27.038608926Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:37:27.038696362Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:37:27.038810178Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:37:27.038824686Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.038858134Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:37:27.038891063Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:37:27.038924242Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:37:27.038937309Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:37:27.038976455Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.038 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.039988711Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.039 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:26.977307Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.040010425Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.039 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.040059771Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
+{"Time":"2023-03-29T13:37:27.040126554Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:37:27.040195696Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:37:27.040300593Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:37:27.040315089Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.040342986Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:37:27.040371935Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:37:27.040410694Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:37:27.040423938Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:37:27.040453889Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.040 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.096588631Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.096 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n"}
+{"Time":"2023-03-29T13:37:27.096797479Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.096 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.097032423Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.096 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.09709667Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.097 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n"}
+{"Time":"2023-03-29T13:37:27.12109969Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:37:27.121135169Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:37:27.121150972Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:37:27.121167311Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:37:27.121216222Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:37:27.121292057Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.12132273Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.121381219Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.121408684Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.121435744Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.121461695Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.121594822Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:c7f1bea9d6ff269c\n"}
+{"Time":"2023-03-29T13:37:27.121620573Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:37:27.121655676Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:37:27.121730239Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:37:27.121756777Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:37:27.121781901Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:37:27.121808996Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.121833529Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:37:27.121858413Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.121888455Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:37:27.121913023Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:37:27.122044906Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.121 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:37:27.12234719Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.122 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.122375547Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.122 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:37:27.122495597Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.122 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.136791704Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.136 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.136826981Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.136 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
+{"Time":"2023-03-29T13:37:27.13694108Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.136 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 48864, \"DERPPort\": 33963, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
+{"Time":"2023-03-29T13:37:27.136979053Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.136 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
+{"Time":"2023-03-29T13:37:27.137291589Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:37:27.137308609Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:37:27.13732063Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:37:27.137373985Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:37:27.137407965Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:37:27.137495219Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.137519229Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.137572028Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.137602411Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.137622846Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.137667976Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.137770053Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:59083cba13956f00\n"}
+{"Time":"2023-03-29T13:37:27.137794544Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:37:27.137898354Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:37:27.137934758Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:37:27.137955272Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:37:27.138002548Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:37:27.138024513Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.137 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.138043252Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:37:27.138068121Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.138095784Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:37:27.138122918Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:37:27.138231919Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:37:27.138531438Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.138556077Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:37:27.138636819Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
+{"Time":"2023-03-29T13:37:27.138658918Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
+{"Time":"2023-03-29T13:37:27.138754966Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.138 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.138663Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.139212045Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.139 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:37:27.139609965Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.139 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:37:27.141001091Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.140 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:37:27.143964866Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.143 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.122393Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.144498996Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.144 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.144562824Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.144 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:37:27.144649797Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.144 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:37:27.144702964Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.144 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:37:27.147050678Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.146 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:37:27.152240491Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.152 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:37:27.157654353Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.157 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:37:27.16338877Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.163 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.16375523Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.163 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.138663Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.163780585Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.163 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.163864424Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.163 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\n"}
+{"Time":"2023-03-29T13:37:27.163963441Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.163 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:37:27.164079841Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:37:27.164217744Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:37:27.164235438Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.16424974Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:37:27.164316222Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:37:27.164338403Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:37:27.164386486Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:37:27.1644261Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.164 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.165498628Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.122393Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.165527893Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.16555513Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
+{"Time":"2023-03-29T13:37:27.165643091Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:37:27.165737176Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:37:27.165892091Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:37:27.165909805Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.165924292Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:37:27.165977872Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:37:27.166008015Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.165 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:37:27.166054821Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.166 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:37:27.166085097Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.166 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.187154465Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.187 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.247520351Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.247 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.247693682Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.247 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n"}
+{"Time":"2023-03-29T13:37:27.247900828Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.247 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n"}
+{"Time":"2023-03-29T13:37:27.248074095Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.248 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.248118748Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.248 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.267591238Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.267 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.327992838Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.327 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n"}
+{"Time":"2023-03-29T13:37:27.328026983Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.327 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:59384 derp=1 derpdist=1v4:83ms\n"}
+{"Time":"2023-03-29T13:37:27.328082537Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.328 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.328318974Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.328 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:59384 (stun), 172.20.0.2:59384 (local)\n"}
+{"Time":"2023-03-29T13:37:27.328415723Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.328 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.328311263 +0000 UTC m=+3.967918487 Peers:[] LocalAddrs:[{Addr:127.0.0.1:59384 Type:stun} {Addr:172.20.0.2:59384 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.331309331Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:37:27.331346835Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:37:27.331498355Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.331349704 +0000 UTC m=+3.970956931 Peers:[] LocalAddrs:[{Addr:127.0.0.1:59384 Type:stun} {Addr:172.20.0.2:59384 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.331576885Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.083211738}}}\n"}
+{"Time":"2023-03-29T13:37:27.331699503Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:27.328409Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": [\"127.0.0.1:59384\", \"172.20.0.2:59384\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.331945606Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:27.328409Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": [\"127.0.0.1:59384\", \"172.20.0.2:59384\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.33196728Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.331 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.332108335Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.332 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.332325739Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.332 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.332542999Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.332 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:27.332444Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.083211738}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": [\"127.0.0.1:59384\", \"172.20.0.2:59384\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.332790784Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.332 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:27.332444Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.083211738}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": [\"127.0.0.1:59384\", \"172.20.0.2:59384\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.333024686Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.332 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.333062782Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.333 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.333182232Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.333 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.333249208Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.333 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.348154607Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.348 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.353941907Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.353 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:37:27.353956013Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.353 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:37:27.353983717Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.353 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:37:27.354104135Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:37:27.354170721Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:37:27.354248787Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.354272858Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.35432815Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.354379756Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.354437701Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.354522443Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.35465091Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:049e454260a62aa1\n"}
+{"Time":"2023-03-29T13:37:27.354686785Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:37:27.354820076Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:37:27.35484141Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:37:27.354884035Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:37:27.354900747Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:37:27.354943262Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.354962224Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:37:27.354997734Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.355013636Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.354 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:37:27.355062521Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:37:27.355172916Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:37:27.355579603Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n"}
+{"Time":"2023-03-29T13:37:27.355609674Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:45837 derp=1 derpdist=1v4:83ms\n"}
+{"Time":"2023-03-29T13:37:27.35566873Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.355827579Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:45837 (stun), 172.20.0.2:45837 (local)\n"}
+{"Time":"2023-03-29T13:37:27.355913155Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.355 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.355809216 +0000 UTC m=+3.995416428 Peers:[] LocalAddrs:[{Addr:127.0.0.1:45837 Type:stun} {Addr:172.20.0.2:45837 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.356261459Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
+{"Time":"2023-03-29T13:37:27.356354227Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 34688, \"DERPPort\": 43117, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
+{"Time":"2023-03-29T13:37:27.35638277Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
+{"Time":"2023-03-29T13:37:27.356686207Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:37:27.356708299Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:37:27.356723833Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:37:27.356833939Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:37:27.356850125Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:37:27.356945712Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.356968923Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.357036251Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.356 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.357070033Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.35711526Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.357134582Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.357249522Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:34ff526bdd502e84\n"}
+{"Time":"2023-03-29T13:37:27.35727419Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:37:27.35742285Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:37:27.357459674Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:37:27.357483314Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:37:27.357523236Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:37:27.357548281Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.357567638Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:37:27.357589503Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.357626515Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:37:27.357652913Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:37:27.357769486Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:37:27.358036076Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.357 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.358075196Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.358 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:37:27.358178009Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.358 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
+{"Time":"2023-03-29T13:37:27.358202627Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.358 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
+{"Time":"2023-03-29T13:37:27.358298603Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.358 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.358191Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.363703025Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.363 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:37:27.368878553Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.368 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:37:27.374094674Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.373 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:37:27.379724421Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.379782057Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:37:27.379915271Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.37996992Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:37:27.380020183Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.379 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:37:27.380128212Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.380012238 +0000 UTC m=+4.019619457 Peers:[] LocalAddrs:[{Addr:127.0.0.1:45837 Type:stun} {Addr:172.20.0.2:45837 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.380193848Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.082795986}}}\n"}
+{"Time":"2023-03-29T13:37:27.380276172Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.355895Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:45837\", \"172.20.0.2:45837\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.38052742Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.355895Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:45837\", \"172.20.0.2:45837\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.380550207Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.380665436Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.380879187Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:37:27.380925379Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:37:27.380952567Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.380 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:37:27.386338613Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.386 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:37:27.387267029Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.387 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:37:27.387774697Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.387 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:37:27.389160607Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.358191Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.389186972Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.389275389Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\n"}
+{"Time":"2023-03-29T13:37:27.389397112Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:37:27.38946191Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:37:27.389582352Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:37:27.389605243Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.389634845Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:37:27.389680241Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:37:27.389711656Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:37:27.389725148Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:37:27.389767299Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.389833677Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.379813Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.390055453Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.389 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.379813Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.390076169Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.390126429Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
+{"Time":"2023-03-29T13:37:27.390188645Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:37:27.39025637Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:37:27.390371704Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:37:27.39038785Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.390406815Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:37:27.390435981Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:37:27.390450102Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:37:27.39048039Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:37:27.390509523Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.390585223Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.390644997Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.39085229Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.390753Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.082795986}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:45837\", \"172.20.0.2:45837\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.391046642Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.390 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.390753Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.082795986}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:45837\", \"172.20.0.2:45837\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.391253711Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.391 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.391294825Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.391 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.391387255Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.391 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.391491088Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.391 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.408305611Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.408 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:37:27.408340875Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.408 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:37:27.408352182Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.408 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:37:27.408381704Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.408 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:37:27.41114267Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.411 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.41133032Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.411 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n"}
+{"Time":"2023-03-29T13:37:27.411379291Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.411 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:35595 derp=1 derpdist=1v4:84ms\n"}
+{"Time":"2023-03-29T13:37:27.411463359Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.411 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.411622433Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.411 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:35595 (stun), 172.20.0.2:35595 (local)\n"}
+{"Time":"2023-03-29T13:37:27.411704928Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.411 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.411617207 +0000 UTC m=+4.051224425 Peers:[] LocalAddrs:[{Addr:127.0.0.1:35595 Type:stun} {Addr:172.20.0.2:35595 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.412030111Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.411 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:188\u003e\t(*agent).runLoop\tconnecting to coderd\n"}
+{"Time":"2023-03-29T13:37:27.412110894Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:286\u003e\t(*agent).run\tfetched metadata\t{\"metadata\": {\"git_auth_configs\": 0, \"vscode_port_proxy_uri\": \"\", \"apps\": null, \"derpmap\": {\"Regions\": {\"1\": {\"EmbeddedRelay\": false, \"RegionID\": 1, \"RegionCode\": \"test\", \"RegionName\": \"Test\", \"Nodes\": [{\"Name\": \"t2\", \"RegionID\": 1, \"HostName\": \"\", \"IPv4\": \"127.0.0.1\", \"IPv6\": \"none\", \"STUNPort\": 51906, \"DERPPort\": 41275, \"InsecureForTests\": true}]}}}, \"environment_variables\": null, \"startup_script\": \"\", \"startup_script_timeout\": 0, \"directory\": \"\", \"motd_file\": \"\", \"shutdown_script\": \"\", \"shutdown_script_timeout\": 0}}\n"}
+{"Time":"2023-03-29T13:37:27.41214998Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"starting\", \"last\": \"\"}\n"}
+{"Time":"2023-03-29T13:37:27.412464057Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:270\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) tun device\n"}
+{"Time":"2023-03-29T13:37:27.412485841Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:274\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) OS network configurator\n"}
+{"Time":"2023-03-29T13:37:27.412515514Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:278\u003e\tNewUserspaceEngine\t[v1] using fake (no-op) DNS configurator\n"}
+{"Time":"2023-03-29T13:37:27.412564627Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: using dns.noopManager\n"}
+{"Time":"2023-03-29T13:37:27.412620272Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:37:27.412695891Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.412734645Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.412796459Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.41282973Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.412882896Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.412921148Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.413034159Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.412 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:cc502d2065d3910d\n"}
+{"Time":"2023-03-29T13:37:27.413066135Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:37:27.413142789Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:37:27.413196003Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:37:27.413234614Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:37:27.413259313Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:37:27.413291621Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.413317957Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:37:27.413346325Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.413369117Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:37:27.413402783Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:37:27.413518268Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:37:27.413809664Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.413845445Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:37:27.413910962Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:402\u003e\t(*agent).run\trunning tailnet connection coordinator\n"}
+{"Time":"2023-03-29T13:37:27.413937365Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:620\u003e\t(*agent).runCoordinator\tconnected to coordination endpoint\n"}
+{"Time":"2023-03-29T13:37:27.414017708Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.413 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.413933Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.414064655Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:37:27.414111814Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:37:27.414189184Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.414107708 +0000 UTC m=+4.053714921 Peers:[] LocalAddrs:[{Addr:127.0.0.1:35595 Type:stun} {Addr:172.20.0.2:35595 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.414245907Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.083765437}}}\n"}
+{"Time":"2023-03-29T13:37:27.414312155Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.4117Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:35595\", \"172.20.0.2:35595\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.414517803Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.4117Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:35595\", \"172.20.0.2:35595\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.414535126Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.414623995Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.414849045Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:37:27.414905554Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"ready\", \"last\": \"starting\"}\n"}
+{"Time":"2023-03-29T13:37:27.414936416Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.414 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:37:27.415525692Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.415 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:37:27.416019712Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.415 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:37:27.416475957Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.416 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:37:27.419029132Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.418 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.419447399Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.419 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.419321Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.083765437}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:35595\", \"172.20.0.2:35595\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.42011877Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.420 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.419321Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.083765437}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:35595\", \"172.20.0.2:35595\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.420376019Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.420 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.420736563Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.420 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.42087992Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.420 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.420979406Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.420 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.422951198Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.422 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n"}
+{"Time":"2023-03-29T13:37:27.42298967Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.422 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:51685 derp=1 derpdist=1v4:84ms\n"}
+{"Time":"2023-03-29T13:37:27.423073917Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.423 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.423298046Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.423 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:51685 (stun), 172.20.0.2:51685 (local)\n"}
+{"Time":"2023-03-29T13:37:27.423385945Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.423 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.423272543 +0000 UTC m=+4.062879776 Peers:[] LocalAddrs:[{Addr:127.0.0.1:51685 Type:stun} {Addr:172.20.0.2:51685 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.424393184Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.424 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:37:27.424445676Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.424 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:37:27.424603665Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.424 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.424442129 +0000 UTC m=+4.064049348 Peers:[] LocalAddrs:[{Addr:127.0.0.1:51685 Type:stun} {Addr:172.20.0.2:51685 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.424655158Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.424 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.084146852}}}\n"}
+{"Time":"2023-03-29T13:37:27.424762683Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.424 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.423371Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": [\"127.0.0.1:51685\", \"172.20.0.2:51685\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.425045855Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.424 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.423371Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": [\"127.0.0.1:51685\", \"172.20.0.2:51685\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.425065382Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.425 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.425204191Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.425 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.425429938Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.425 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.425622509Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.425 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.425514Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.084146852}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": [\"127.0.0.1:51685\", \"172.20.0.2:51685\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.425845165Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.425 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.425514Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.084146852}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": [\"127.0.0.1:51685\", \"172.20.0.2:51685\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.426046304Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.425 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.426095567Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.426 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.426917109Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.426 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.426975294Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.426 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.427132044Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.427 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:59384 derp=1 derpdist=1v4:95ms\n"}
+{"Time":"2023-03-29T13:37:27.427810726Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.408 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:334\u003e\tNewUserspaceEngine\tlink state: interfaces.State{defaultRoute=eth0 ifs={eth0:[172.20.0.2/16]} v4=true v6=false}\n"}
+{"Time":"2023-03-29T13:37:27.427890723Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.427 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.427915145Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.427 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.42800586Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.427 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:306\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP read buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.428030074Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.427 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock_linux.go:310\u003e\ttrySetSocketBuffer.func1\tmagicsock: failed to force-set UDP write buffer size to 7340032: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.428084359Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:666\u003e\tNewConn\t[v1] couldn't create raw v4 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.428115313Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:672\u003e\tNewConn\t[v1] couldn't create raw v6 disco listener, using regular listener instead: raw disco listening disabled, SO_MARK unavailable\n"}
+{"Time":"2023-03-29T13:37:27.428260646Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1056\u003e\t(*Conn).DiscoPublicKey\tmagicsock: disco key = d:9c9ea8075f682592\n"}
+{"Time":"2023-03-29T13:37:27.428283953Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:412\u003e\tNewUserspaceEngine\tCreating WireGuard device...\n"}
+{"Time":"2023-03-29T13:37:27.428422249Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:437\u003e\tNewUserspaceEngine\tBringing WireGuard device up...\n"}
+{"Time":"2023-03-29T13:37:27.428458364Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] UDP bind has been updated\n"}
+{"Time":"2023-03-29T13:37:27.428479111Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Interface state was Down, requested Up, now Up\n"}
+{"Time":"2023-03-29T13:37:27.428530647Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:441\u003e\tNewUserspaceEngine\tBringing router up...\n"}
+{"Time":"2023-03-29T13:37:27.428549605Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:21\u003e\tfakeRouter.Up\t[v1] warning: fakeRouter.Up: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.428596203Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:449\u003e\tNewUserspaceEngine\tClearing router settings...\n"}
+{"Time":"2023-03-29T13:37:27.428629468Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.42866001Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:453\u003e\tNewUserspaceEngine\tStarting link monitor...\n"}
+{"Time":"2023-03-29T13:37:27.428692965Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:456\u003e\tNewUserspaceEngine\tEngine created.\n"}
+{"Time":"2023-03-29T13:37:27.42881653Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.428 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2444\u003e\t(*Conn).SetPrivateKey\tmagicsock: SetPrivateKey called (init)\n"}
+{"Time":"2023-03-29T13:37:27.430284733Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.430 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.094731332}}}\n"}
+{"Time":"2023-03-29T13:37:27.430366553Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.430 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:27.430277Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.094731332}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": [\"127.0.0.1:59384\", \"172.20.0.2:59384\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.430637096Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.430 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6193178684101620604, \"as_of\": \"2023-03-29T13:37:27.430277Z\", \"key\": \"nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370\", \"disco\": \"discokey:17b5066de479f45868013352cba173846e33492e64258b47a5e823c1746f8449\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.094731332}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4781:bb82:1540:3954:6a8/128\"], \"endpoints\": [\"127.0.0.1:59384\", \"172.20.0.2:59384\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.430871537Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.430 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.430971821Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.430 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:45837 derp=1 derpdist=1v4:37ms\n"}
+{"Time":"2023-03-29T13:37:27.436731495Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.436 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - started\n"}
+{"Time":"2023-03-29T13:37:27.441948864Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.441 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n"}
+{"Time":"2023-03-29T13:37:27.442143804Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.442 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - started\n"}
+{"Time":"2023-03-29T13:37:27.447325985Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.447 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:58\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - started\n"}
+{"Time":"2023-03-29T13:37:27.452941046Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.452 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:187\u003e\tNewConn\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.452978923Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.452 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 0 peers\n"}
+{"Time":"2023-03-29T13:37:27.453138084Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.453213493Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.453354362Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.45343882Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.037239154}}}\n"}
+{"Time":"2023-03-29T13:37:27.453524949Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.453418Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.037239154}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:45837\", \"172.20.0.2:45837\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.453796409Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 1396496777246732951, \"as_of\": \"2023-03-29T13:37:27.453418Z\", \"key\": \"nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24\", \"disco\": \"discokey:e6f05f1260bbd61182192a11c1541a28ccace412e36cdb487e15a598d8327a73\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.037239154}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:45837\", \"172.20.0.2:45837\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.454022251Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.453 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.454053656Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.454164006Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.454402409Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.454452969Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: netcheck: UDP is blocked, trying HTTPS\n"}
+{"Time":"2023-03-29T13:37:27.454661334Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.454 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.455180586Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.413933Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.45520381Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.455291748Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\n"}
+{"Time":"2023-03-29T13:37:27.455371391Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:37:27.45558374Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:37:27.455722626Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:37:27.455744892Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.455759263Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:37:27.455811196Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:37:27.455851745Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:37:27.455887337Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:37:27.45593531Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.456026705Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.455 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.453Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.456257727Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.453Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": []}}\n"}
+{"Time":"2023-03-29T13:37:27.456275526Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.456348245Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.netstack)\t\u003ctailscale.com/wgengine/netstack/netstack.go:367\u003e\t(*Impl).updateIPs\t[v2] netstack: registered IP fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\n"}
+{"Time":"2023-03-29T13:37:27.456430865Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/0 peers)\n"}
+{"Time":"2023-03-29T13:37:27.456533237Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] UAPI: Updating private key\n"}
+{"Time":"2023-03-29T13:37:27.456666838Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:921\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring router\n"}
+{"Time":"2023-03-29T13:37:27.456681257Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:26\u003e\tfakeRouter.Set\t[v1] warning: fakeRouter.Set: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.456709567Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:931\u003e\t(*userspaceEngine).Reconfig\twgengine: Reconfig: configuring DNS\n"}
+{"Time":"2023-03-29T13:37:27.456736103Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Set: {DefaultResolvers:[] Routes:{} SearchDomains:[] Hosts:0}\n"}
+{"Time":"2023-03-29T13:37:27.456785483Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: Resolvercfg: {Routes:{} Hosts:0 LocalDomains:[]}\n"}
+{"Time":"2023-03-29T13:37:27.456811479Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/net/dns/logger.go:98\u003e\tNewManager.func1\tdns: OScfg: {Nameservers:[] SearchDomains:[] MatchDomains:[] Hosts:[]}\n"}
+{"Time":"2023-03-29T13:37:27.456866526Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.456945718Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.457035437Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.456 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] measureAllICMPLatency: listen ip4:icmp 0.0.0.0: socket: operation not permitted\n"}
+{"Time":"2023-03-29T13:37:27.490404055Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.490 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:35595 derp=1 derpdist=1v4:45ms\n"}
+{"Time":"2023-03-29T13:37:27.490957872Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.490 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:57709 derp=1 derpdist=1v4:31ms\n"}
+{"Time":"2023-03-29T13:37:27.491013794Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.490 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.491185914Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.491 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:57709 (stun), 172.20.0.2:57709 (local)\n"}
+{"Time":"2023-03-29T13:37:27.491295468Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.491 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.491174325 +0000 UTC m=+4.130781564 Peers:[] LocalAddrs:[{Addr:127.0.0.1:57709 Type:stun} {Addr:172.20.0.2:57709 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.491675303Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.491 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.045323829}}}\n"}
+{"Time":"2023-03-29T13:37:27.491767926Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.491 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.491649Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.045323829}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:35595\", \"172.20.0.2:35595\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.492071167Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.491 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6125567726523641784, \"as_of\": \"2023-03-29T13:37:27.491649Z\", \"key\": \"nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56\", \"disco\": \"discokey:59083cba13956f00814aa780f8a19b58ddd40f9ae6f940398e509d2f2c79076e\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.045323829}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:35595\", \"172.20.0.2:35595\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.492303429Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.492381183Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.492509729Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.492832285Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:37:27.492955047Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:37:27.493041705Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.492824353 +0000 UTC m=+4.132431585 Peers:[] LocalAddrs:[{Addr:127.0.0.1:57709 Type:stun} {Addr:172.20.0.2:57709 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.493059245Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.492 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.031410894}}}\n"}
+{"Time":"2023-03-29T13:37:27.493174012Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.493 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.491286Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:57709\", \"172.20.0.2:57709\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.493508739Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.493 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.491286Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:57709\", \"172.20.0.2:57709\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.493558301Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.493 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.493658522Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.493 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.493954418Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.493 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.49414611Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.494 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.494032Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.031410894}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:57709\", \"172.20.0.2:57709\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.494394917Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.494 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.494032Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.031410894}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:57709\", \"172.20.0.2:57709\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.494635514Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.494 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.494676622Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.494 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.494780288Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.494 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.494840889Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.494 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.495169992Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.495 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:59384 derp=1 derpdist=1v4:64ms\n"}
+{"Time":"2023-03-29T13:37:27.497129169Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.497 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [XHSZg]  ...\n"}
+{"Time":"2023-03-29T13:37:27.497196731Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.497 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:51685 derp=1 derpdist=1v4:71ms\n"}
+{"Time":"2023-03-29T13:37:27.498816504Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.498 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for [XHSZg]\n"}
+{"Time":"2023-03-29T13:37:27.498899237Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.498 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:37:27.498921801Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.498 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [XHSZg] set to derp-1 (their home)\n"}
+{"Time":"2023-03-29T13:37:27.499047332Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.498 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.498914775 +0000 UTC m=+4.138522011 Peers:[] LocalAddrs:[] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.499167908Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.499 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.070836569}}}\n"}
+{"Time":"2023-03-29T13:37:27.499241573Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.499 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.499162Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.070836569}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": [\"127.0.0.1:51685\", \"172.20.0.2:51685\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.49953116Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.499 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 918863977196614381, \"as_of\": \"2023-03-29T13:37:27.499162Z\", \"key\": \"nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e\", \"disco\": \"discokey:c7f1bea9d6ff269c8662c153c39a3d92f57c567590b806c16bf693226039c84b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.070836569}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805/128\"], \"endpoints\": [\"127.0.0.1:51685\", \"172.20.0.2:51685\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.499756959Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.499 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.499820527Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.499 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.499954778Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.499 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.500094938Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.500 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.508017322Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.507 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:51993 derp=1 derpdist=1v4:48ms\n"}
+{"Time":"2023-03-29T13:37:27.50805261Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.507 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.508212683Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.508 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:51993 (stun), 172.20.0.2:51993 (local)\n"}
+{"Time":"2023-03-29T13:37:27.508285157Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.508 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.50819775 +0000 UTC m=+4.147804976 Peers:[] LocalAddrs:[{Addr:127.0.0.1:51993 Type:stun} {Addr:172.20.0.2:51993 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.51148228Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.511 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.047681075}}}\n"}
+{"Time":"2023-03-29T13:37:27.511561169Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.511 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.50828Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": [\"127.0.0.1:51993\", \"172.20.0.2:51993\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.511646171Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.511 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [64qRi]  ...\n"}
+{"Time":"2023-03-29T13:37:27.512004191Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.511 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.50828Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": [\"127.0.0.1:51993\", \"172.20.0.2:51993\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.512026173Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.511 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.512131402Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.512 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.512284203Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.512 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [64qRi] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:37:27.512446305Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.512 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.512355Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.047681075}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": [\"127.0.0.1:51993\", \"172.20.0.2:51993\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.512694091Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.512 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.512355Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.047681075}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": [\"127.0.0.1:51993\", \"172.20.0.2:51993\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.512945734Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.512 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.512982501Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.512 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.513074208Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.513 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.513149912Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.513 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.513458516Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.513 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1241\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): no matching peer\n"}
+{"Time":"2023-03-29T13:37:27.513601111Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.513 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:37:27.514167854Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n"}
+{"Time":"2023-03-29T13:37:27.514216037Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:58992 derp=1 derpdist=1v4:62ms\n"}
+{"Time":"2023-03-29T13:37:27.514270704Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.51443958Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:58992 (stun), 172.20.0.2:58992 (local)\n"}
+{"Time":"2023-03-29T13:37:27.514519618Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.514434952 +0000 UTC m=+4.154042177 Peers:[] LocalAddrs:[{Addr:127.0.0.1:58992 Type:stun} {Addr:172.20.0.2:58992 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.514591409Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.514515Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.514811275Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.514515Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.514831215Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.514927532Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.514969002Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:37:27.51501Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.514 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:37:27.515094247Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.515008199 +0000 UTC m=+4.154615430 Peers:[] LocalAddrs:[{Addr:127.0.0.1:58992 Type:stun} {Addr:172.20.0.2:58992 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.515144167Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.062405899}}}\n"}
+{"Time":"2023-03-29T13:37:27.515231182Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.515155Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.062405899}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.515477352Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.515155Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.062405899}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.5157436Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.515810118Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.515944355Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.51603017Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.515 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.516114674Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.516 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.520145614Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.520 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [64qRi] d:e6f05f1260bbd611 now using 172.20.0.2:45837\n"}
+{"Time":"2023-03-29T13:37:27.520236787Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.520 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [64qRi]  ...\n"}
+{"Time":"2023-03-29T13:37:27.520381164Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.520 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:37:27.523889233Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.523 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [64qRi]  ...\n"}
+{"Time":"2023-03-29T13:37:27.524071718Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.524 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:37:27.525270748Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] netcheck: measuring HTTPS latency of test (1): unexpected status code: 426 (426 Upgrade Required)\n"}
+{"Time":"2023-03-29T13:37:27.525326669Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest=false hair= portmap= v4a=127.0.0.1:34848 derp=1 derpdist=1v4:65ms\n"}
+{"Time":"2023-03-29T13:37:27.525374168Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1092\u003e\t(*Conn).setNearestDERP\tmagicsock: home is now derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.525530241Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2759\u003e\t(*Conn).logEndpointChange\tmagicsock: endpoints changed: 127.0.0.1:34848 (stun), 172.20.0.2:34848 (local)\n"}
+{"Time":"2023-03-29T13:37:27.525639565Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.525526859 +0000 UTC m=+4.165134074 Peers:[] LocalAddrs:[{Addr:127.0.0.1:34848 Type:stun} {Addr:172.20.0.2:34848 Type:local}] DERPs:0}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.525953664Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1480\u003e\t(*Conn).derpWriteChanOfAddr\tmagicsock: adding connection to derp-1 for home-keep-alive\n"}
+{"Time":"2023-03-29T13:37:27.525977204Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 1 active derp conns: derp-1=cr0s,wr0s\n"}
+{"Time":"2023-03-29T13:37:27.526067972Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.525 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.525972278 +0000 UTC m=+4.165579492 Peers:[] LocalAddrs:[{Addr:127.0.0.1:34848 Type:stun} {Addr:172.20.0.2:34848 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.526107105Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": false, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.065420657}}}\n"}
+{"Time":"2023-03-29T13:37:27.526188976Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.5256Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.526396168Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:423\u003e\t(*Conn).UpdateNodes\tno preferred DERP, skipping node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.5256Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 0, \"derp_latency\": null, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.526422378Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.526517317Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.526687969Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/derp/derphttp/derphttp_client.go:401\u003e\t(*Client).connect\tderphttp.Client.Connect: connecting to derp-1 (test)\n"}
+{"Time":"2023-03-29T13:37:27.526875114Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.526 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.526766Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.065420657}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.527145691Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.526766Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.065420657}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.527368061Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.527462668Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.527579879Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 0/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.52765384Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.527 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.531819508Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.531 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:37:27.532053362Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.532237504Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:37:27.5322919Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:37:27.532342787Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:37:27.532383163Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:37:27.532430032Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:27.532468962Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - Starting\n"}
+{"Time":"2023-03-29T13:37:27.532522407Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.532 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - Sending handshake initiation\n"}
+{"Time":"2023-03-29T13:37:27.53317143Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.533 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:37:27.533306241Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.533 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:37:27.534331952Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [dv8u3] now active, reconfiguring WireGuard\n"}
+{"Time":"2023-03-29T13:37:27.534386848Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.53460606Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:37:27.534650003Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:37:27.53470262Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:37:27.534744335Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:37:27.534797239Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:27.534834361Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.534 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - Starting\n"}
+{"Time":"2023-03-29T13:37:27.535064975Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.535 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - Received handshake initiation\n"}
+{"Time":"2023-03-29T13:37:27.535101365Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.535 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - Sending handshake response\n"}
+{"Time":"2023-03-29T13:37:27.535486164Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.535 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [dv8u3] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:37:27.535646633Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.535 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.535517538 +0000 UTC m=+4.175124762 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:76ff2edcacaac78382de86ce14dcf7d1464d8bff76ab14412a1c18ef29aa9370}] LocalAddrs:[{Addr:127.0.0.1:45837 Type:stun} {Addr:172.20.0.2:45837 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.535973095Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.535 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:37:27.536642888Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.536 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - Received handshake response\n"}
+{"Time":"2023-03-29T13:37:27.536713027Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.536 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [dv8u3] d:17b5066de479f458 now using 172.20.0.2:59384\n"}
+{"Time":"2023-03-29T13:37:27.536917351Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.536 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.536783767 +0000 UTC m=+4.176390982 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:27.536635319 +0000 UTC NodeKey:nodekey:eb8a91888d02040ddaee61afa4ae8d03bd6c35ddf3f76edcaa5bde89743e5c24}] LocalAddrs:[{Addr:127.0.0.1:59384 Type:stun} {Addr:172.20.0.2:59384 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.53763406Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.537 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1705\u003e\t(*Conn).runDerpReader\tmagicsock: derp-1 connected; connGen=1\n"}
+{"Time":"2023-03-29T13:37:27.538314662Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.538 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4781:bb82:1540:3954:6a8): sending disco ping to [dv8u3]  ...\n"}
+{"Time":"2023-03-29T13:37:27.542696821Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.542 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:35595 derp=1 derpdist=1v4:9ms\n"}
+{"Time":"2023-03-29T13:37:27.545658947Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.545 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:57709 derp=1 derpdist=1v4:15ms\n"}
+{"Time":"2023-03-29T13:37:27.546526665Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.546 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.014798468}}}\n"}
+{"Time":"2023-03-29T13:37:27.546624395Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.546 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.546513Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.014798468}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:57709\", \"172.20.0.2:57709\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.546899956Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.546 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 4984932330222696591, \"as_of\": \"2023-03-29T13:37:27.546513Z\", \"key\": \"nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907\", \"disco\": \"discokey:cc502d2065d3910d659fc206b5c1b833cc8721e43ccd43ed245fc56e1d9d6219\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.014798468}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:57709\", \"172.20.0.2:57709\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.547131568Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.547 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.547206358Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.547 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.547317822Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.547 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.548159459Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
+{"Time":"2023-03-29T13:37:27.548281455Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
+{"Time":"2023-03-29T13:37:27.548330701Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:37:27.548397336Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.548439957Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:37:27.548494794Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:37:27.548600181Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.548645011Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.548694237Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [64qRi] - Stopping\n"}
+{"Time":"2023-03-29T13:37:27.548765909Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:37:27.548840457Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:37:27.548886886Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
+{"Time":"2023-03-29T13:37:27.548943901Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.548 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
+{"Time":"2023-03-29T13:37:27.549285716Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
+{"Time":"2023-03-29T13:37:27.549325844Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:37:27.549397271Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.549434623Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:37:27.549486154Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:37:27.549569105Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4781:bb82:1540:3954:6a8): sending disco ping to [dv8u3]  ...\n"}
+{"Time":"2023-03-29T13:37:27.54967718Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.549720977Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.549763197Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [dv8u3] - Stopping\n"}
+{"Time":"2023-03-29T13:37:27.549846472Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    t.go:81: 2023-03-29 13:37:27.549 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:37:27.55012971Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"    stuntest.go:63: STUN server shutdown\n"}
+{"Time":"2023-03-29T13:37:27.55014656Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Output":"--- PASS: TestAgent_SessionExec (0.86s)\n"}
+{"Time":"2023-03-29T13:37:27.562749894Z","Action":"pass","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionExec","Elapsed":0.86}
+{"Time":"2023-03-29T13:37:27.562803065Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.562 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:51993 derp=1 derpdist=1v4:8ms\n"}
+{"Time":"2023-03-29T13:37:27.563392796Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.563 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [XHSZg]  ...\n"}
+{"Time":"2023-03-29T13:37:27.563801502Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.563 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.008279639}}}\n"}
+{"Time":"2023-03-29T13:37:27.56407208Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.563 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.563776Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.008279639}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": [\"127.0.0.1:51993\", \"172.20.0.2:51993\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.564819316Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.564 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 3791438885238154126, \"as_of\": \"2023-03-29T13:37:27.563776Z\", \"key\": \"nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00\", \"disco\": \"discokey:9c9ea8075f682592f7a084f08ca03fcad41aea85a44de470f32d96f1067b8a60\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.008279639}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4743:8dab:c855:f633:532/128\"], \"endpoints\": [\"127.0.0.1:51993\", \"172.20.0.2:51993\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.565650461Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.565 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.565870529Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.565 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.566173208Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.566 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.567328308Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.567 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [V4gBN] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:37:27.567693064Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.567 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [XHSZg] d:cc502d2065d3910d now using 127.0.0.1:57709\n"}
+{"Time":"2023-03-29T13:37:27.567994501Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.567 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [XHSZg]  ...\n"}
+{"Time":"2023-03-29T13:37:27.568226707Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.568 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [XHSZg]  ...\n"}
+{"Time":"2023-03-29T13:37:27.56908417Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.568 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.569629095Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.569 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:37:27.569764065Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.569 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:37:27.569899377Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.569 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:37:27.570050145Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.569 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:37:27.57018252Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.570 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:27.570302009Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.570 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - Starting\n"}
+{"Time":"2023-03-29T13:37:27.570580746Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.570 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - Sending keepalive packet\n"}
+{"Time":"2023-03-29T13:37:27.570704044Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.570 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - Sending handshake initiation\n"}
+{"Time":"2023-03-29T13:37:27.571723295Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.571 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [V4gBN] now active, reconfiguring WireGuard\n"}
+{"Time":"2023-03-29T13:37:27.571754224Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.571 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.571960017Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.571 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:37:27.5720063Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.571 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:37:27.572053253Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:37:27.572098018Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:37:27.572143378Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:27.572182651Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - Starting\n"}
+{"Time":"2023-03-29T13:37:27.572412769Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - Received handshake initiation\n"}
+{"Time":"2023-03-29T13:37:27.57244765Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - Sending handshake response\n"}
+{"Time":"2023-03-29T13:37:27.572888396Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.572 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.57276895 +0000 UTC m=+4.212376174 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:57880137ed805a8c0fd7b29e835a3cd85d87c32c890d3b0f6ed3fc8620837c00}] LocalAddrs:[{Addr:127.0.0.1:57709 Type:stun} {Addr:172.20.0.2:57709 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.573422095Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.573 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - Received handshake response\n"}
+{"Time":"2023-03-29T13:37:27.573505226Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.573 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [V4gBN] d:9c9ea8075f682592 now using 172.20.0.2:51993\n"}
+{"Time":"2023-03-29T13:37:27.573673421Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.573 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.573556739 +0000 UTC m=+4.213163954 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:27.573422752 +0000 UTC NodeKey:nodekey:5c74998353a1ae2dd2b8ee0de399386279c035b2b3d95bd245ba4820d0403907}] LocalAddrs:[{Addr:127.0.0.1:51993 Type:stun} {Addr:172.20.0.2:51993 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.574036177Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.573 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - Receiving keepalive packet\n"}
+{"Time":"2023-03-29T13:37:27.578151189Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:58992 derp=1 derpdist=1v4:5ms\n"}
+{"Time":"2023-03-29T13:37:27.578464111Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:34848 derp=1 derpdist=1v4:7ms\n"}
+{"Time":"2023-03-29T13:37:27.578697845Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.005291379}}}\n"}
+{"Time":"2023-03-29T13:37:27.578788271Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.578687Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.005291379}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.579040964Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.578 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 6959219245254193963, \"as_of\": \"2023-03-29T13:37:27.578687Z\", \"key\": \"nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c\", \"disco\": \"discokey:049e454260a62aa19c35b82499dc35811a5aad44ef612f238808cae15d5c5b55\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.005291379}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d/128\"], \"endpoints\": [\"127.0.0.1:58992\", \"172.20.0.2:58992\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.579269912Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.579338921Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.579486192Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.579615554Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:246\u003e\tNewConn.func7\tnetinfo callback\t{\"netinfo\": {\"MappingVariesByDestIP\": null, \"HairPinning\": null, \"WorkingIPv6\": false, \"OSHasIPv6\": false, \"WorkingUDP\": true, \"WorkingICMPv4\": false, \"UPnP\": false, \"PMP\": false, \"PCP\": false, \"PreferredDERP\": 1, \"DERPLatency\": {\"1-v4\": 0.00675754}}}\n"}
+{"Time":"2023-03-29T13:37:27.579715409Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:642\u003e\t(*Conn).sendNode.func1\tsending node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.579606Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.00675754}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.580015856Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.579 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:426\u003e\t(*Conn).UpdateNodes\tadding node\t{\"node\": {\"id\": 2689903771435529409, \"as_of\": \"2023-03-29T13:37:27.579606Z\", \"key\": \"nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f\", \"disco\": \"discokey:34ff526bdd502e84533e42919465a676d8fa64abda3b4f5943a8c9aa6fd0253b\", \"preferred_derp\": 1, \"derp_latency\": {\"1-v4\": 0.00675754}, \"derp_forced_websockets\": {}, \"addresses\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"allowed_ips\": [\"fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4/128\"], \"endpoints\": [\"127.0.0.1:34848\", \"172.20.0.2:34848\"]}}\n"}
+{"Time":"2023-03-29T13:37:27.580200069Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.580 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:454\u003e\t(*Conn).UpdateNodes\tupdating network map\n"}
+{"Time":"2023-03-29T13:37:27.580263003Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.580 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2578\u003e\t(*Conn).SetNetworkMap\t[v1] magicsock: got updated network map; 1 peers\n"}
+{"Time":"2023-03-29T13:37:27.580357379Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.580 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:967\u003e\t(*userspaceEngine).Reconfig\t[v1] wgengine: Reconfig done\n"}
+{"Time":"2023-03-29T13:37:27.584912838Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.584 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:836\u003e\t(*agent).init.func2\tssh session returned\t{\"error\": \"exit status 127\"}\n"}
+{"Time":"2023-03-29T13:37:27.585085871Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.585 [WARN]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:1119\u003e\t(*agent).handleSSHSession.func2\tfailed to resize tty ...\n"}
+{"Time":"2023-03-29T13:37:27.58510059Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"        \"error\": pty: closed:\n"}
+{"Time":"2023-03-29T13:37:27.585107445Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"                     github.com/coder/coder/pty.(*otherPty).Close\n"}
+{"Time":"2023-03-29T13:37:27.585113814Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"                         /home/mafredri/src/coder/coder/pty/pty_other.go:134\n"}
+{"Time":"2023-03-29T13:37:27.585512242Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:83: 2023-03-29 13:37:27.585: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:27.585526871Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:74: 2023-03-29 13:37:27.585: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:27.58556302Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:110: 2023-03-29 13:37:27.585: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:27.585579238Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:111: 2023-03-29 13:37:27.585: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:27.585599261Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:113: 2023-03-29 13:37:27.585: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:27.58566446Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:76: 2023-03-29 13:37:27.585: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:27.585677492Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:74: 2023-03-29 13:37:27.585: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:27.585682384Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:76: 2023-03-29 13:37:27.585: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:27.585699939Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:74: 2023-03-29 13:37:27.585: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:27.58570508Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:76: 2023-03-29 13:37:27.585: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:27.585722893Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    ptytest.go:102: 2023-03-29 13:37:27.585: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:27.585976831Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.585 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
+{"Time":"2023-03-29T13:37:27.586016625Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.585 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:37:27.586092293Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.586133054Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:37:27.586200024Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:37:27.586329617Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.586371206Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.586499602Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [XHSZg] - Stopping\n"}
+{"Time":"2023-03-29T13:37:27.586608393Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:37:27.58672256Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:37:27.586761915Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
+{"Time":"2023-03-29T13:37:27.586833422Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
+{"Time":"2023-03-29T13:37:27.5869144Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.586 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
+{"Time":"2023-03-29T13:37:27.58723746Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.587 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
+{"Time":"2023-03-29T13:37:27.58728708Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.587 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:37:27.587374552Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.587 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.587490464Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.587 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4743:8dab:c855:f633:532): sending disco ping to [V4gBN]  ...\n"}
+{"Time":"2023-03-29T13:37:27.587617597Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.587 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.598290287Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.598 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/logger.go:98\u003e\tNewConn.func6\tnetcheck: [v1] report: udp=true v6=false v6os=false mapvarydest= hair= portmap= v4a=127.0.0.1:57709 derp=1 derpdist=1v4:3ms\n"}
+{"Time":"2023-03-29T13:37:27.598667071Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.598 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.598735879Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.598 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:37:27.598824991Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.598 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:37:27.598917706Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.598 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [V4gBN] - Stopping\n"}
+{"Time":"2023-03-29T13:37:27.599077451Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    t.go:81: 2023-03-29 13:37:27.599 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:37:27.599268425Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"    stuntest.go:63: STUN server shutdown\n"}
+{"Time":"2023-03-29T13:37:27.599297466Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Output":"--- PASS: TestAgent_SessionTTYExitCode (0.88s)\n"}
+{"Time":"2023-03-29T13:37:27.624884929Z","Action":"pass","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYExitCode","Elapsed":0.88}
+{"Time":"2023-03-29T13:37:27.624923874Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.624 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [5WitN]  ...\n"}
+{"Time":"2023-03-29T13:37:27.625357585Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.625 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [5WitN] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:37:27.626340882Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [5EOvJ] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:37:27.626577093Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [5WitN] d:34ff526bdd502e84 now using 172.20.0.2:34848\n"}
+{"Time":"2023-03-29T13:37:27.626873494Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [5WitN]  ...\n"}
+{"Time":"2023-03-29T13:37:27.627094808Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.626 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [5WitN]  ...\n"}
+{"Time":"2023-03-29T13:37:27.627846604Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.627 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.628133034Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:37:27.628178673Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:37:27.628231143Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:37:27.628273924Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:37:27.628326843Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:27.628365041Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Starting\n"}
+{"Time":"2023-03-29T13:37:27.628423532Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Sending handshake initiation\n"}
+{"Time":"2023-03-29T13:37:27.62897967Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [5EOvJ] now active, reconfiguring WireGuard\n"}
+{"Time":"2023-03-29T13:37:27.62904036Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.628 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.629335987Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:37:27.629378533Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:37:27.629437221Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:37:27.629484031Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:37:27.629528288Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:27.629564272Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Starting\n"}
+{"Time":"2023-03-29T13:37:27.629899772Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Received handshake initiation\n"}
+{"Time":"2023-03-29T13:37:27.629937538Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.629 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Sending handshake response\n"}
+{"Time":"2023-03-29T13:37:27.630550619Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.630 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.630405833 +0000 UTC m=+4.270013057 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:e443af25902d57edd4bf0b663849e6cb06390f7b80e6ab179dbd5deabea10e0c}] LocalAddrs:[{Addr:127.0.0.1:34848 Type:stun} {Addr:172.20.0.2:34848 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.631298672Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.631 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Received handshake response\n"}
+{"Time":"2023-03-29T13:37:27.631395745Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.631 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [5EOvJ] d:049e454260a62aa1 now using 172.20.0.2:58992\n"}
+{"Time":"2023-03-29T13:37:27.631619667Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.631 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.631481797 +0000 UTC m=+4.271089021 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:27.631305354 +0000 UTC NodeKey:nodekey:e568ad36a49b4d60323fc0207eded97153e72170c491f74a8942ac38e9dd541f}] LocalAddrs:[{Addr:127.0.0.1:58992 Type:stun} {Addr:172.20.0.2:58992 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.632260898Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.632 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [5WitN] d:34ff526bdd502e84 now using 127.0.0.1:34848\n"}
+{"Time":"2023-03-29T13:37:27.637293337Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.637 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [Xlu3R]  ...\n"}
+{"Time":"2023-03-29T13:37:27.637491883Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.637 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [Xlu3R] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:37:27.638607677Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.638 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:1599\u003e\t(*Conn).setPeerLastDerpLocked\t[v1] magicsock: derp route for [uWfac] set to derp-1 (shared home)\n"}
+{"Time":"2023-03-29T13:37:27.6387189Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.638 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [Xlu3R] d:59083cba13956f00 now using 172.20.0.2:35595\n"}
+{"Time":"2023-03-29T13:37:27.638794177Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.638 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [Xlu3R]  ...\n"}
+{"Time":"2023-03-29T13:37:27.638932756Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.638 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:49d6:b259:b7ac:b1b2:48f4): sending disco ping to [Xlu3R]  ...\n"}
+{"Time":"2023-03-29T13:37:27.639446274Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.639629272Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:37:27.639676449Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:37:27.639710523Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:37:27.639738112Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:37:27.639767671Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:27.639792041Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - Starting\n"}
+{"Time":"2023-03-29T13:37:27.639832214Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.639 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - Sending handshake initiation\n"}
+{"Time":"2023-03-29T13:37:27.640359836Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:584\u003e\t(*userspaceEngine).noteRecvActivity\twgengine: idle peer [uWfac] now active, reconfiguring WireGuard\n"}
+{"Time":"2023-03-29T13:37:27.640405214Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:706\u003e\t(*userspaceEngine).maybeReconfigWireguardLocked\twgengine: Reconfig: configuring userspace WireGuard config (with 1/1 peers)\n"}
+{"Time":"2023-03-29T13:37:27.640596752Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - UAPI: Created\n"}
+{"Time":"2023-03-29T13:37:27.64062514Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - UAPI: Updating endpoint\n"}
+{"Time":"2023-03-29T13:37:27.640660936Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - UAPI: Removing all allowedips\n"}
+{"Time":"2023-03-29T13:37:27.640688925Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - UAPI: Adding allowedip\n"}
+{"Time":"2023-03-29T13:37:27.640721293Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - UAPI: Updating persistent keepalive interval\n"}
+{"Time":"2023-03-29T13:37:27.640745599Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - Starting\n"}
+{"Time":"2023-03-29T13:37:27.640964666Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - Received handshake initiation\n"}
+{"Time":"2023-03-29T13:37:27.640987155Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.640 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - Sending handshake response\n"}
+{"Time":"2023-03-29T13:37:27.641427103Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.641 [DEBUG]\t(agent.tailnet)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.641327519 +0000 UTC m=+4.280934743 Peers:[{TxBytes:92 RxBytes:148 LastHandshake:1970-01-01 00:00:00 +0000 UTC NodeKey:nodekey:b967da7372e7aa1e4ed1fc6f032437dfe7a6e1a0d465cd04c9adf77d69ee2a1e}] LocalAddrs:[{Addr:127.0.0.1:35595 Type:stun} {Addr:172.20.0.2:35595 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.642337602Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.642 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - Received handshake response\n"}
+{"Time":"2023-03-29T13:37:27.642405776Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.642 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [uWfac] d:c7f1bea9d6ff269c now using 172.20.0.2:51685\n"}
+{"Time":"2023-03-29T13:37:27.642612703Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.642 [DEBUG]\t(client)\t\u003cgithub.com/coder/coder/tailnet/conn.go:225\u003e\tNewConn.func6\twireguard status\t{\"status\": \"\\u0026{AsOf:2023-03-29 13:37:27.64250087 +0000 UTC m=+4.282108085 Peers:[{TxBytes:148 RxBytes:92 LastHandshake:2023-03-29 13:37:27.642336966 +0000 UTC NodeKey:nodekey:5e5bb74471183bca142348628f8e5cb431c9b3367f0fe15605a03a1721343e56}] LocalAddrs:[{Addr:127.0.0.1:51685 Type:stun} {Addr:172.20.0.2:51685 Type:local}] DERPs:1}\", \"err\": null}\n"}
+{"Time":"2023-03-29T13:37:27.64326778Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.643 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:4387\u003e\t(*endpoint).handlePongConnLocked\tmagicsock: disco: node [Xlu3R] d:59083cba13956f00 now using 127.0.0.1:35595\n"}
+{"Time":"2023-03-29T13:37:27.648583243Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    agent_test.go:400: \n"}
+{"Time":"2023-03-29T13:37:27.648599647Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"        \tError Trace:\t/home/mafredri/src/coder/coder/agent/agent_test.go:400\n"}
+{"Time":"2023-03-29T13:37:27.648605577Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"        \t            \t\t\t\t/home/mafredri/src/coder/coder/agent/agent_test.go:401\n"}
+{"Time":"2023-03-29T13:37:27.648610117Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"        \tError:      \t\"\" does not contain \"wazzup\"\n"}
+{"Time":"2023-03-29T13:37:27.648616547Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"        \tTest:       \tTestAgent_Session_TTY_FastCommandHasOutput\n"}
+{"Time":"2023-03-29T13:37:27.648621257Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"        \tMessages:   \tshould output greeting\n"}
+{"Time":"2023-03-29T13:37:27.648628226Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:83: 2023-03-29 13:37:27.648: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:27.648632598Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:74: 2023-03-29 13:37:27.648: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:27.648669381Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:110: 2023-03-29 13:37:27.648: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:27.648676209Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:111: 2023-03-29 13:37:27.648: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:27.64868565Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:113: 2023-03-29 13:37:27.648: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:27.648725455Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:76: 2023-03-29 13:37:27.648: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:27.648735417Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:74: 2023-03-29 13:37:27.648: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:27.648742887Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:76: 2023-03-29 13:37:27.648: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:27.648755628Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:74: 2023-03-29 13:37:27.648: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:27.648763111Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:76: 2023-03-29 13:37:27.648: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:27.648781723Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    ptytest.go:102: 2023-03-29 13:37:27.648: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:27.64898407Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.648 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
+{"Time":"2023-03-29T13:37:27.64901264Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.648 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:37:27.649065867Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.649092046Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:37:27.649138332Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:37:27.649234264Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.649272903Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.649300503Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5WitN] - Stopping\n"}
+{"Time":"2023-03-29T13:37:27.649378408Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:37:27.649434677Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
+{"Time":"2023-03-29T13:37:27.649514069Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:37:27.649551066Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
+{"Time":"2023-03-29T13:37:27.649591609Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
+{"Time":"2023-03-29T13:37:27.649899898Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
+{"Time":"2023-03-29T13:37:27.649921785Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:37:27.649976578Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.650005597Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.649 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:37:27.650053977Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:37:27.650112159Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4d67:9e5c:abb:531:b55d): sending disco ping to [5EOvJ]  ...\n"}
+{"Time":"2023-03-29T13:37:27.650212974Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.650252149Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.650280078Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [5EOvJ] - Stopping\n"}
+{"Time":"2023-03-29T13:37:27.650357784Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    t.go:81: 2023-03-29 13:37:27.650 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:37:27.650618927Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"    stuntest.go:63: STUN server shutdown\n"}
+{"Time":"2023-03-29T13:37:27.650634125Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Output":"--- FAIL: TestAgent_Session_TTY_FastCommandHasOutput (0.95s)\n"}
+{"Time":"2023-03-29T13:37:27.674793681Z","Action":"fail","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_Session_TTY_FastCommandHasOutput","Elapsed":0.95}
+{"Time":"2023-03-29T13:37:27.674817479Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.674 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805): sending disco ping to [uWfac]  ...\n"}
+{"Time":"2023-03-29T13:37:27.675734168Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    agent_test.go:235: 2023-03-29 13:37:27.675: cmd: peeked 1/1 bytes = \"$\"\n"}
+{"Time":"2023-03-29T13:37:27.675774216Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    agent_test.go:236: 2023-03-29 13:37:27.675: cmd: stdin: \"echo test\\r\"\n"}
+{"Time":"2023-03-29T13:37:27.676191344Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:121: 2023-03-29 13:37:27.676: cmd: \"$ echo test\"\n"}
+{"Time":"2023-03-29T13:37:27.676273026Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    agent_test.go:237: 2023-03-29 13:37:27.676: cmd: matched \"test\" = \"$ echo test\"\n"}
+{"Time":"2023-03-29T13:37:27.676308536Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    agent_test.go:238: 2023-03-29 13:37:27.676: cmd: stdin: \"exit\\r\"\n"}
+{"Time":"2023-03-29T13:37:27.676642013Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:121: 2023-03-29 13:37:27.676: cmd: \"exit\"\n"}
+{"Time":"2023-03-29T13:37:27.67773278Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:121: 2023-03-29 13:37:27.677: cmd: \"echo test\\r\"\n"}
+{"Time":"2023-03-29T13:37:27.677752958Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:121: 2023-03-29 13:37:27.677: cmd: \"exit\\r\"\n"}
+{"Time":"2023-03-29T13:37:27.67778936Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:121: 2023-03-29 13:37:27.677: cmd: \"test\\r\"\n"}
+{"Time":"2023-03-29T13:37:27.678126711Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:83: 2023-03-29 13:37:27.678: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:27.678143306Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:74: 2023-03-29 13:37:27.678: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:27.678200486Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:110: 2023-03-29 13:37:27.678: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:27.678223246Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:111: 2023-03-29 13:37:27.678: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:27.678238993Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:113: 2023-03-29 13:37:27.678: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:27.678305772Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:76: 2023-03-29 13:37:27.678: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:27.678359399Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:74: 2023-03-29 13:37:27.678: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:27.678373082Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:76: 2023-03-29 13:37:27.678: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:27.678387877Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:74: 2023-03-29 13:37:27.678: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:27.678398091Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:76: 2023-03-29 13:37:27.678: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:27.678444105Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:121: 2023-03-29 13:37:27.678: cmd: \"$ \"\n"}
+{"Time":"2023-03-29T13:37:27.67847139Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    ptytest.go:102: 2023-03-29 13:37:27.678: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:27.67876363Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.678 [INFO]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:201\u003e\t(*agent).runLoop\tdisconnected from coderd\n"}
+{"Time":"2023-03-29T13:37:27.678920913Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.678 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
+{"Time":"2023-03-29T13:37:27.678978615Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.678 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:37:27.679093854Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.67916374Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:37:27.679261738Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:37:27.679498576Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.679558488Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.679635937Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [Xlu3R] - Stopping\n"}
+{"Time":"2023-03-29T13:37:27.679772893Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(client.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:37:27.679951878Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"shutting_down\", \"last\": \"ready\"}\n"}
+{"Time":"2023-03-29T13:37:27.680029583Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.679 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:263\u003e\t(*agent).setLifecycle\tset lifecycle state\t{\"state\": \"off\", \"last\": \"shutting_down\"}\n"}
+{"Time":"2023-03-29T13:37:27.680147794Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.680 [DEBUG]\t(agent)\t\u003cgithub.com/coder/coder/v2/agent/agent.go:229\u003e\t(*agent).reportLifecycleLoop\treporting lifecycle state\t{\"state\": \"off\"}\n"}
+{"Time":"2023-03-29T13:37:27.680759898Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.680 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2736\u003e\t(*Conn).closeDerpLocked\tmagicsock: closing connection to derp-1 (conn-close), age 0s\n"}
+{"Time":"2023-03-29T13:37:27.68081749Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.680 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/magicsock/magicsock.go:2747\u003e\t(*Conn).logActiveDerpLocked\tmagicsock: 0 active derp conns\n"}
+{"Time":"2023-03-29T13:37:27.680933631Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.680 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/router/router_fake.go:31\u003e\tfakeRouter.Close\t[v1] warning: fakeRouter.Close: not implemented.\n"}
+{"Time":"2023-03-29T13:37:27.681009542Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.680 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closing\n"}
+{"Time":"2023-03-29T13:37:27.681106332Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.681 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming receiveDERP - stopped\n"}
+{"Time":"2023-03-29T13:37:27.681249372Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.681 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/userspace.go:1254\u003e\t(*userspaceEngine).Ping\tping(fd7a:115c:a1e0:4341:84c0:6b1c:81d1:5805): sending disco ping to [uWfac]  ...\n"}
+{"Time":"2023-03-29T13:37:27.681454735Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.681 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v6 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.681540218Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.681 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Routine: receive incoming v4 - stopped\n"}
+{"Time":"2023-03-29T13:37:27.68161487Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.681 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] [uWfac] - Stopping\n"}
+{"Time":"2023-03-29T13:37:27.681781085Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    t.go:81: 2023-03-29 13:37:27.681 [DEBUG]\t(agent.tailnet.wgengine)\t\u003ctailscale.com/wgengine/wglog/wglog.go:81\u003e\tNewLogger.func1\twg: [v2] Device closed\n"}
+{"Time":"2023-03-29T13:37:27.682219467Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"    stuntest.go:63: STUN server shutdown\n"}
+{"Time":"2023-03-29T13:37:27.682247508Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Output":"--- PASS: TestAgent_SessionTTYShell (0.94s)\n"}
+{"Time":"2023-03-29T13:37:27.682263381Z","Action":"pass","Package":"github.com/coder/coder/v2/agent","Test":"TestAgent_SessionTTYShell","Elapsed":0.94}
+{"Time":"2023-03-29T13:37:27.682278577Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Output":"FAIL\n"}
+{"Time":"2023-03-29T13:37:27.696326667Z","Action":"output","Package":"github.com/coder/coder/v2/agent","Output":"FAIL\tgithub.com/coder/coder/v2/agent\t4.341s\n"}
+{"Time":"2023-03-29T13:37:27.696360103Z","Action":"fail","Package":"github.com/coder/coder/v2/agent","Elapsed":4.341}
+{"Time":"2023-03-29T13:37:32.643934624Z","Action":"start","Package":"github.com/coder/coder/v2/cli"}
+{"Time":"2023-03-29T13:37:32.790842698Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser"}
+{"Time":"2023-03-29T13:37:32.79088125Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser","Output":"=== RUN   TestServerCreateAdminUser\n"}
+{"Time":"2023-03-29T13:37:32.792730073Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK"}
+{"Time":"2023-03-29T13:37:32.792739078Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"=== RUN   TestServerCreateAdminUser/OK\n"}
+{"Time":"2023-03-29T13:37:32.792745576Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"=== PAUSE TestServerCreateAdminUser/OK\n"}
+{"Time":"2023-03-29T13:37:32.79274818Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK"}
+{"Time":"2023-03-29T13:37:32.79275173Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env"}
+{"Time":"2023-03-29T13:37:32.792754236Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"=== RUN   TestServerCreateAdminUser/Env\n"}
+{"Time":"2023-03-29T13:37:32.792759492Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"=== PAUSE TestServerCreateAdminUser/Env\n"}
+{"Time":"2023-03-29T13:37:32.792763227Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env"}
+{"Time":"2023-03-29T13:37:32.792767605Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin"}
+{"Time":"2023-03-29T13:37:32.792772306Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"=== RUN   TestServerCreateAdminUser/Stdin\n"}
+{"Time":"2023-03-29T13:37:32.792778719Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"=== PAUSE TestServerCreateAdminUser/Stdin\n"}
+{"Time":"2023-03-29T13:37:32.792781324Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin"}
+{"Time":"2023-03-29T13:37:32.792785642Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates"}
+{"Time":"2023-03-29T13:37:32.792788132Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"=== RUN   TestServerCreateAdminUser/Validates\n"}
+{"Time":"2023-03-29T13:37:32.792833072Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"=== PAUSE TestServerCreateAdminUser/Validates\n"}
+{"Time":"2023-03-29T13:37:32.792839332Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates"}
+{"Time":"2023-03-29T13:37:32.792849881Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK"}
+{"Time":"2023-03-29T13:37:32.79285277Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"=== CONT  TestServerCreateAdminUser/OK\n"}
+{"Time":"2023-03-29T13:37:32.794003473Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"    server_createadminuser_test.go:87: \n"}
+{"Time":"2023-03-29T13:37:32.794008803Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:87\n"}
+{"Time":"2023-03-29T13:37:32.794012119Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \tError:      \tReceived unexpected error:\n"}
+{"Time":"2023-03-29T13:37:32.794014928Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \tcould not start resource:\n"}
+{"Time":"2023-03-29T13:37:32.794017745Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n"}
+{"Time":"2023-03-29T13:37:32.794020968Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n"}
+{"Time":"2023-03-29T13:37:32.794025025Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n"}
+{"Time":"2023-03-29T13:37:32.794028396Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    \n"}
+{"Time":"2023-03-29T13:37:32.794031694Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n"}
+{"Time":"2023-03-29T13:37:32.794034996Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n"}
+{"Time":"2023-03-29T13:37:32.794038934Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n"}
+{"Time":"2023-03-29T13:37:32.794042353Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n"}
+{"Time":"2023-03-29T13:37:32.794045324Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    github.com/coder/coder/v2/cli_test.TestServerCreateAdminUser.func2\n"}
+{"Time":"2023-03-29T13:37:32.794048191Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:86\n"}
+{"Time":"2023-03-29T13:37:32.794051013Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    testing.tRunner\n"}
+{"Time":"2023-03-29T13:37:32.794053771Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n"}
+{"Time":"2023-03-29T13:37:32.794056664Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    runtime.goexit\n"}
+{"Time":"2023-03-29T13:37:32.794060193Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n"}
+{"Time":"2023-03-29T13:37:32.79406303Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"        \tTest:       \tTestServerCreateAdminUser/OK\n"}
+{"Time":"2023-03-29T13:37:32.79407275Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Output":"--- FAIL: TestServerCreateAdminUser/OK (0.00s)\n"}
+{"Time":"2023-03-29T13:37:32.794075922Z","Action":"fail","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/OK","Elapsed":0}
+{"Time":"2023-03-29T13:37:32.794079842Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates"}
+{"Time":"2023-03-29T13:37:32.794082413Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"=== CONT  TestServerCreateAdminUser/Validates\n"}
+{"Time":"2023-03-29T13:37:32.795185256Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"    server_createadminuser_test.go:227: \n"}
+{"Time":"2023-03-29T13:37:32.795189907Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:227\n"}
+{"Time":"2023-03-29T13:37:32.795192879Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \tError:      \tReceived unexpected error:\n"}
+{"Time":"2023-03-29T13:37:32.795195707Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \tcould not start resource:\n"}
+{"Time":"2023-03-29T13:37:32.795198569Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n"}
+{"Time":"2023-03-29T13:37:32.795203724Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n"}
+{"Time":"2023-03-29T13:37:32.795206991Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n"}
+{"Time":"2023-03-29T13:37:32.795209975Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    \n"}
+{"Time":"2023-03-29T13:37:32.795212879Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n"}
+{"Time":"2023-03-29T13:37:32.79521788Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n"}
+{"Time":"2023-03-29T13:37:32.795223388Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n"}
+{"Time":"2023-03-29T13:37:32.795228236Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n"}
+{"Time":"2023-03-29T13:37:32.795231388Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    github.com/coder/coder/v2/cli_test.TestServerCreateAdminUser.func5\n"}
+{"Time":"2023-03-29T13:37:32.795234339Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:226\n"}
+{"Time":"2023-03-29T13:37:32.795237524Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    testing.tRunner\n"}
+{"Time":"2023-03-29T13:37:32.795240439Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n"}
+{"Time":"2023-03-29T13:37:32.795243318Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    runtime.goexit\n"}
+{"Time":"2023-03-29T13:37:32.795246653Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n"}
+{"Time":"2023-03-29T13:37:32.795249486Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"        \tTest:       \tTestServerCreateAdminUser/Validates\n"}
+{"Time":"2023-03-29T13:37:32.795256993Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Output":"--- FAIL: TestServerCreateAdminUser/Validates (0.00s)\n"}
+{"Time":"2023-03-29T13:37:32.795260148Z","Action":"fail","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Validates","Elapsed":0}
+{"Time":"2023-03-29T13:37:32.795262834Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin"}
+{"Time":"2023-03-29T13:37:32.795265403Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"=== CONT  TestServerCreateAdminUser/Stdin\n"}
+{"Time":"2023-03-29T13:37:32.795769577Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"    server_createadminuser_test.go:187: \n"}
+{"Time":"2023-03-29T13:37:32.795774301Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:187\n"}
+{"Time":"2023-03-29T13:37:32.795777433Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \tError:      \tReceived unexpected error:\n"}
+{"Time":"2023-03-29T13:37:32.795782206Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \tcould not start resource:\n"}
+{"Time":"2023-03-29T13:37:32.795787591Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n"}
+{"Time":"2023-03-29T13:37:32.795793763Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n"}
+{"Time":"2023-03-29T13:37:32.795796926Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n"}
+{"Time":"2023-03-29T13:37:32.795799647Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    \n"}
+{"Time":"2023-03-29T13:37:32.795802415Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n"}
+{"Time":"2023-03-29T13:37:32.795805244Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n"}
+{"Time":"2023-03-29T13:37:32.795808186Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n"}
+{"Time":"2023-03-29T13:37:32.79581094Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n"}
+{"Time":"2023-03-29T13:37:32.795813828Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    github.com/coder/coder/v2/cli_test.TestServerCreateAdminUser.func4\n"}
+{"Time":"2023-03-29T13:37:32.79581676Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:186\n"}
+{"Time":"2023-03-29T13:37:32.795819484Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    testing.tRunner\n"}
+{"Time":"2023-03-29T13:37:32.795822305Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n"}
+{"Time":"2023-03-29T13:37:32.795826355Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    runtime.goexit\n"}
+{"Time":"2023-03-29T13:37:32.795829152Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n"}
+{"Time":"2023-03-29T13:37:32.795832058Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"        \tTest:       \tTestServerCreateAdminUser/Stdin\n"}
+{"Time":"2023-03-29T13:37:32.795846761Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Output":"--- FAIL: TestServerCreateAdminUser/Stdin (0.00s)\n"}
+{"Time":"2023-03-29T13:37:32.79585045Z","Action":"fail","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Stdin","Elapsed":0}
+{"Time":"2023-03-29T13:37:32.795853001Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env"}
+{"Time":"2023-03-29T13:37:32.795855433Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"=== CONT  TestServerCreateAdminUser/Env\n"}
+{"Time":"2023-03-29T13:37:32.796339444Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"    server_createadminuser_test.go:153: \n"}
+{"Time":"2023-03-29T13:37:32.796345738Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:153\n"}
+{"Time":"2023-03-29T13:37:32.796349118Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \tError:      \tReceived unexpected error:\n"}
+{"Time":"2023-03-29T13:37:32.796351839Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \tcould not start resource:\n"}
+{"Time":"2023-03-29T13:37:32.796354772Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n"}
+{"Time":"2023-03-29T13:37:32.796357683Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n"}
+{"Time":"2023-03-29T13:37:32.796360546Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n"}
+{"Time":"2023-03-29T13:37:32.79636323Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    \n"}
+{"Time":"2023-03-29T13:37:32.796366079Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n"}
+{"Time":"2023-03-29T13:37:32.796368987Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n"}
+{"Time":"2023-03-29T13:37:32.79637254Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n"}
+{"Time":"2023-03-29T13:37:32.79637535Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n"}
+{"Time":"2023-03-29T13:37:32.796378207Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    github.com/coder/coder/v2/cli_test.TestServerCreateAdminUser.func3\n"}
+{"Time":"2023-03-29T13:37:32.796381015Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_createadminuser_test.go:152\n"}
+{"Time":"2023-03-29T13:37:32.796383831Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    testing.tRunner\n"}
+{"Time":"2023-03-29T13:37:32.796386544Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n"}
+{"Time":"2023-03-29T13:37:32.796389783Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    runtime.goexit\n"}
+{"Time":"2023-03-29T13:37:32.796394885Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n"}
+{"Time":"2023-03-29T13:37:32.796400461Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"        \tTest:       \tTestServerCreateAdminUser/Env\n"}
+{"Time":"2023-03-29T13:37:32.796405793Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Output":"--- FAIL: TestServerCreateAdminUser/Env (0.00s)\n"}
+{"Time":"2023-03-29T13:37:32.796409018Z","Action":"fail","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser/Env","Elapsed":0}
+{"Time":"2023-03-29T13:37:32.796411751Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser","Output":"--- FAIL: TestServerCreateAdminUser (0.00s)\n"}
+{"Time":"2023-03-29T13:37:32.796414761Z","Action":"fail","Package":"github.com/coder/coder/v2/cli","Test":"TestServerCreateAdminUser","Elapsed":0}
+{"Time":"2023-03-29T13:37:32.796417599Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer"}
+{"Time":"2023-03-29T13:37:32.796420175Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer","Output":"=== RUN   TestServer\n"}
+{"Time":"2023-03-29T13:37:32.796424448Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production"}
+{"Time":"2023-03-29T13:37:32.796426853Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"=== RUN   TestServer/Production\n"}
+{"Time":"2023-03-29T13:37:32.797198344Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"    server_test.go:109: \n"}
+{"Time":"2023-03-29T13:37:32.797204437Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \tError Trace:\t/home/mafredri/src/coder/coder/cli/server_test.go:109\n"}
+{"Time":"2023-03-29T13:37:32.797207471Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \tError:      \tReceived unexpected error:\n"}
+{"Time":"2023-03-29T13:37:32.797210203Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \tcould not start resource:\n"}
+{"Time":"2023-03-29T13:37:32.797213234Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n"}
+{"Time":"2023-03-29T13:37:32.797216169Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t        /home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:113\n"}
+{"Time":"2023-03-29T13:37:32.797219132Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t  - dial unix /var/run/docker.sock: connect: no such file or directory\n"}
+{"Time":"2023-03-29T13:37:32.797221978Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t    \n"}
+{"Time":"2023-03-29T13:37:32.797224749Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t    github.com/ory/dockertest/v3.(*Pool).RunWithOptions\n"}
+{"Time":"2023-03-29T13:37:32.797227673Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t    \t/home/mafredri/.local/go/pkg/mod/github.com/ory/dockertest/v3@v3.9.1/dockertest.go:413\n"}
+{"Time":"2023-03-29T13:37:32.797230597Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t    github.com/coder/coder/v2/coderd/database/postgres.Open\n"}
+{"Time":"2023-03-29T13:37:32.797234931Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/coderd/database/postgres/postgres.go:77\n"}
+{"Time":"2023-03-29T13:37:32.797243511Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t    github.com/coder/coder/v2/cli_test.TestServer.func1\n"}
+{"Time":"2023-03-29T13:37:32.797248163Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t    \t/home/mafredri/src/coder/coder/cli/server_test.go:108\n"}
+{"Time":"2023-03-29T13:37:32.79725113Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t    testing.tRunner\n"}
+{"Time":"2023-03-29T13:37:32.797253983Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t    \t/usr/local/go/src/testing/testing.go:1576\n"}
+{"Time":"2023-03-29T13:37:32.797257318Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t    runtime.goexit\n"}
+{"Time":"2023-03-29T13:37:32.797261252Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \t            \t    \t/usr/local/go/src/runtime/asm_amd64.s:1598\n"}
+{"Time":"2023-03-29T13:37:32.797266495Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"        \tTest:       \tTestServer/Production\n"}
+{"Time":"2023-03-29T13:37:32.797274297Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Output":"--- FAIL: TestServer/Production (0.00s)\n"}
+{"Time":"2023-03-29T13:37:32.797277522Z","Action":"fail","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Production","Elapsed":0}
+{"Time":"2023-03-29T13:37:32.797280535Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres"}
+{"Time":"2023-03-29T13:37:32.797283019Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"=== RUN   TestServer/BuiltinPostgres\n"}
+{"Time":"2023-03-29T13:37:32.797286137Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"=== PAUSE TestServer/BuiltinPostgres\n"}
+{"Time":"2023-03-29T13:37:32.797288614Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres"}
+{"Time":"2023-03-29T13:37:32.797294343Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL"}
+{"Time":"2023-03-29T13:37:32.797296802Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"=== RUN   TestServer/BuiltinPostgresURL\n"}
+{"Time":"2023-03-29T13:37:32.797299815Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"=== PAUSE TestServer/BuiltinPostgresURL\n"}
+{"Time":"2023-03-29T13:37:32.797302293Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL"}
+{"Time":"2023-03-29T13:37:32.797306699Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw"}
+{"Time":"2023-03-29T13:37:32.797309403Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"=== RUN   TestServer/BuiltinPostgresURLRaw\n"}
+{"Time":"2023-03-29T13:37:32.79731478Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"=== PAUSE TestServer/BuiltinPostgresURLRaw\n"}
+{"Time":"2023-03-29T13:37:32.797319293Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw"}
+{"Time":"2023-03-29T13:37:32.797324667Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL"}
+{"Time":"2023-03-29T13:37:32.797328467Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"=== RUN   TestServer/LocalAccessURL\n"}
+{"Time":"2023-03-29T13:37:32.797331431Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"=== PAUSE TestServer/LocalAccessURL\n"}
+{"Time":"2023-03-29T13:37:32.797333768Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL"}
+{"Time":"2023-03-29T13:37:32.797341584Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL"}
+{"Time":"2023-03-29T13:37:32.797345334Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"=== RUN   TestServer/RemoteAccessURL\n"}
+{"Time":"2023-03-29T13:37:32.79737723Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"=== PAUSE TestServer/RemoteAccessURL\n"}
+{"Time":"2023-03-29T13:37:32.797380853Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL"}
+{"Time":"2023-03-29T13:37:32.797385247Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL"}
+{"Time":"2023-03-29T13:37:32.797387813Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"=== RUN   TestServer/NoWarningWithRemoteAccessURL\n"}
+{"Time":"2023-03-29T13:37:32.797405636Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"=== PAUSE TestServer/NoWarningWithRemoteAccessURL\n"}
+{"Time":"2023-03-29T13:37:32.797408839Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL"}
+{"Time":"2023-03-29T13:37:32.797426981Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoSchemeAccessURL"}
+{"Time":"2023-03-29T13:37:32.797430439Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoSchemeAccessURL","Output":"=== RUN   TestServer/NoSchemeAccessURL\n"}
+{"Time":"2023-03-29T13:37:32.797434847Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoSchemeAccessURL","Output":"=== PAUSE TestServer/NoSchemeAccessURL\n"}
+{"Time":"2023-03-29T13:37:32.797437343Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoSchemeAccessURL"}
+{"Time":"2023-03-29T13:37:32.797445885Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadVersion"}
+{"Time":"2023-03-29T13:37:32.797448325Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadVersion","Output":"=== RUN   TestServer/TLSBadVersion\n"}
+{"Time":"2023-03-29T13:37:32.797466497Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadVersion","Output":"=== PAUSE TestServer/TLSBadVersion\n"}
+{"Time":"2023-03-29T13:37:32.797471662Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadVersion"}
+{"Time":"2023-03-29T13:37:32.797476114Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadClientAuth"}
+{"Time":"2023-03-29T13:37:32.797478506Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadClientAuth","Output":"=== RUN   TestServer/TLSBadClientAuth\n"}
+{"Time":"2023-03-29T13:37:32.797495642Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadClientAuth","Output":"=== PAUSE TestServer/TLSBadClientAuth\n"}
+{"Time":"2023-03-29T13:37:32.79750134Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadClientAuth"}
+{"Time":"2023-03-29T13:37:32.797508036Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid"}
+{"Time":"2023-03-29T13:37:32.797510579Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid","Output":"=== RUN   TestServer/TLSInvalid\n"}
+{"Time":"2023-03-29T13:37:32.797525872Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid","Output":"=== PAUSE TestServer/TLSInvalid\n"}
+{"Time":"2023-03-29T13:37:32.797528971Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid"}
+{"Time":"2023-03-29T13:37:32.797533231Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid"}
+{"Time":"2023-03-29T13:37:32.797535658Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"=== RUN   TestServer/TLSValid\n"}
+{"Time":"2023-03-29T13:37:32.797552494Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"=== PAUSE TestServer/TLSValid\n"}
+{"Time":"2023-03-29T13:37:32.797556455Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid"}
+{"Time":"2023-03-29T13:37:32.797560606Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple"}
+{"Time":"2023-03-29T13:37:32.797563041Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"=== RUN   TestServer/TLSValidMultiple\n"}
+{"Time":"2023-03-29T13:37:32.797579028Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"=== PAUSE TestServer/TLSValidMultiple\n"}
+{"Time":"2023-03-29T13:37:32.797582214Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple"}
+{"Time":"2023-03-29T13:37:32.797586334Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP"}
+{"Time":"2023-03-29T13:37:32.797588893Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"=== RUN   TestServer/TLSAndHTTP\n"}
+{"Time":"2023-03-29T13:37:32.797623711Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"=== PAUSE TestServer/TLSAndHTTP\n"}
+{"Time":"2023-03-29T13:37:32.797626474Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP"}
+{"Time":"2023-03-29T13:37:32.797631971Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect"}
+{"Time":"2023-03-29T13:37:32.797634471Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect","Output":"=== RUN   TestServer/TLSRedirect\n"}
+{"Time":"2023-03-29T13:37:32.797650491Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect","Output":"=== PAUSE TestServer/TLSRedirect\n"}
+{"Time":"2023-03-29T13:37:32.797654521Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect"}
+{"Time":"2023-03-29T13:37:32.797659191Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4"}
+{"Time":"2023-03-29T13:37:32.797661727Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"=== RUN   TestServer/CanListenUnspecifiedv4\n"}
+{"Time":"2023-03-29T13:37:32.797677081Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"=== PAUSE TestServer/CanListenUnspecifiedv4\n"}
+{"Time":"2023-03-29T13:37:32.797679898Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4"}
+{"Time":"2023-03-29T13:37:32.797685398Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6"}
+{"Time":"2023-03-29T13:37:32.797688055Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"=== RUN   TestServer/CanListenUnspecifiedv6\n"}
+{"Time":"2023-03-29T13:37:32.797706704Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"=== PAUSE TestServer/CanListenUnspecifiedv6\n"}
+{"Time":"2023-03-29T13:37:32.797710667Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6"}
+{"Time":"2023-03-29T13:37:32.797714823Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoAddress"}
+{"Time":"2023-03-29T13:37:32.797717235Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoAddress","Output":"=== RUN   TestServer/NoAddress\n"}
+{"Time":"2023-03-29T13:37:32.797732629Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoAddress","Output":"=== PAUSE TestServer/NoAddress\n"}
+{"Time":"2023-03-29T13:37:32.797735715Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoAddress"}
+{"Time":"2023-03-29T13:37:32.797739744Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoTLSAddress"}
+{"Time":"2023-03-29T13:37:32.797742309Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoTLSAddress","Output":"=== RUN   TestServer/NoTLSAddress\n"}
+{"Time":"2023-03-29T13:37:32.797754504Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoTLSAddress","Output":"=== PAUSE TestServer/NoTLSAddress\n"}
+{"Time":"2023-03-29T13:37:32.797757251Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoTLSAddress"}
+{"Time":"2023-03-29T13:37:32.797762513Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress"}
+{"Time":"2023-03-29T13:37:32.797764941Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress","Output":"=== RUN   TestServer/DeprecatedAddress\n"}
+{"Time":"2023-03-29T13:37:32.797791112Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress","Output":"=== PAUSE TestServer/DeprecatedAddress\n"}
+{"Time":"2023-03-29T13:37:32.797794156Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress"}
+{"Time":"2023-03-29T13:37:32.797818478Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown"}
+{"Time":"2023-03-29T13:37:32.797821565Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown","Output":"=== RUN   TestServer/Shutdown\n"}
+{"Time":"2023-03-29T13:37:32.799148069Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerShutdown1335635398/002 server --in-memory --http-address :0 --access-url http://example.com --provisioner-daemons 1 --cache-dir /tmp/TestServerShutdown1335635398/001\n"}
+{"Time":"2023-03-29T13:37:32.799996289Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:39611\n"}
+{"Time":"2023-03-29T13:37:32.803857037Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
+{"Time":"2023-03-29T13:37:32.820483862Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:32.840616097Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:32.840652908Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:32.840837548Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:32.840996757Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:32.841130055Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:32.843139909Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown","Output":"--- PASS: TestServer/Shutdown (0.05s)\n"}
+{"Time":"2023-03-29T13:37:32.843152696Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Shutdown","Elapsed":0.05}
+{"Time":"2023-03-29T13:37:32.843181686Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak"}
+{"Time":"2023-03-29T13:37:32.843185961Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"=== RUN   TestServer/TracerNoLeak\n"}
+{"Time":"2023-03-29T13:37:32.84324137Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"=== PAUSE TestServer/TracerNoLeak\n"}
+{"Time":"2023-03-29T13:37:32.843248162Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak"}
+{"Time":"2023-03-29T13:37:32.84327344Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry"}
+{"Time":"2023-03-29T13:37:32.843276473Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"=== RUN   TestServer/Telemetry\n"}
+{"Time":"2023-03-29T13:37:32.843298273Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"=== PAUSE TestServer/Telemetry\n"}
+{"Time":"2023-03-29T13:37:32.843301329Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry"}
+{"Time":"2023-03-29T13:37:32.843328619Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus"}
+{"Time":"2023-03-29T13:37:32.843332448Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"=== RUN   TestServer/Prometheus\n"}
+{"Time":"2023-03-29T13:37:32.843360436Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"=== PAUSE TestServer/Prometheus\n"}
+{"Time":"2023-03-29T13:37:32.843363322Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus"}
+{"Time":"2023-03-29T13:37:32.843393432Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth"}
+{"Time":"2023-03-29T13:37:32.843398556Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"=== RUN   TestServer/GitHubOAuth\n"}
+{"Time":"2023-03-29T13:37:32.843457011Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"=== PAUSE TestServer/GitHubOAuth\n"}
+{"Time":"2023-03-29T13:37:32.843461316Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth"}
+{"Time":"2023-03-29T13:37:32.843486876Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit"}
+{"Time":"2023-03-29T13:37:32.84349017Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit","Output":"=== RUN   TestServer/RateLimit\n"}
+{"Time":"2023-03-29T13:37:32.843512128Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit","Output":"=== PAUSE TestServer/RateLimit\n"}
+{"Time":"2023-03-29T13:37:32.843515107Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit"}
+{"Time":"2023-03-29T13:37:32.843530012Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging"}
+{"Time":"2023-03-29T13:37:32.843532716Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging","Output":"=== RUN   TestServer/Logging\n"}
+{"Time":"2023-03-29T13:37:32.843562048Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging","Output":"=== PAUSE TestServer/Logging\n"}
+{"Time":"2023-03-29T13:37:32.843565639Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging"}
+{"Time":"2023-03-29T13:37:32.843591297Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres"}
+{"Time":"2023-03-29T13:37:32.843594335Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"=== CONT  TestServer/BuiltinPostgres\n"}
+{"Time":"2023-03-29T13:37:32.845419328Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerBuiltinPostgres1969653008/002 server --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerBuiltinPostgres1969653008/001\n"}
+{"Time":"2023-03-29T13:37:32.846522439Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Using built-in PostgreSQL (/tmp/TestServerBuiltinPostgres1969653008/002/postgres)\n"}
+{"Time":"2023-03-29T13:37:32.847782539Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging"}
+{"Time":"2023-03-29T13:37:32.847787939Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging","Output":"=== CONT  TestServer/Logging\n"}
+{"Time":"2023-03-29T13:37:32.847793104Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile"}
+{"Time":"2023-03-29T13:37:32.847797472Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"=== RUN   TestServer/Logging/CreatesFile\n"}
+{"Time":"2023-03-29T13:37:32.847809954Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"=== PAUSE TestServer/Logging/CreatesFile\n"}
+{"Time":"2023-03-29T13:37:32.847814894Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile"}
+{"Time":"2023-03-29T13:37:32.847821007Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human"}
+{"Time":"2023-03-29T13:37:32.847823557Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"=== RUN   TestServer/Logging/Human\n"}
+{"Time":"2023-03-29T13:37:32.847827971Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"=== PAUSE TestServer/Logging/Human\n"}
+{"Time":"2023-03-29T13:37:32.847830572Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human"}
+{"Time":"2023-03-29T13:37:32.847846314Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON"}
+{"Time":"2023-03-29T13:37:32.847849769Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"=== RUN   TestServer/Logging/JSON\n"}
+{"Time":"2023-03-29T13:37:32.847855516Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"=== PAUSE TestServer/Logging/JSON\n"}
+{"Time":"2023-03-29T13:37:32.847858116Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON"}
+{"Time":"2023-03-29T13:37:32.847862399Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver"}
+{"Time":"2023-03-29T13:37:32.847864919Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"=== RUN   TestServer/Logging/Stackdriver\n"}
+{"Time":"2023-03-29T13:37:32.847879575Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"=== PAUSE TestServer/Logging/Stackdriver\n"}
+{"Time":"2023-03-29T13:37:32.847884818Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver"}
+{"Time":"2023-03-29T13:37:32.847891759Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple"}
+{"Time":"2023-03-29T13:37:32.847894796Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"=== RUN   TestServer/Logging/Multiple\n"}
+{"Time":"2023-03-29T13:37:32.847919729Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"=== PAUSE TestServer/Logging/Multiple\n"}
+{"Time":"2023-03-29T13:37:32.847922769Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple"}
+{"Time":"2023-03-29T13:37:32.847927067Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile"}
+{"Time":"2023-03-29T13:37:32.847929708Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"=== CONT  TestServer/Logging/CreatesFile\n"}
+{"Time":"2023-03-29T13:37:32.848797106Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerLoggingCreatesFile2700332728/002 server --verbose --in-memory --http-address :0 --access-url http://example.com --log-human /tmp/TestServerLoggingCreatesFile2700332728/001/coder-logging-test-2490710733\n"}
+{"Time":"2023-03-29T13:37:32.849489309Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:46231\n"}
+{"Time":"2023-03-29T13:37:32.849644524Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit"}
+{"Time":"2023-03-29T13:37:32.849648931Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit","Output":"=== CONT  TestServer/RateLimit\n"}
+{"Time":"2023-03-29T13:37:32.849654201Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default"}
+{"Time":"2023-03-29T13:37:32.849658963Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"=== RUN   TestServer/RateLimit/Default\n"}
+{"Time":"2023-03-29T13:37:32.849673813Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"=== PAUSE TestServer/RateLimit/Default\n"}
+{"Time":"2023-03-29T13:37:32.849676949Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default"}
+{"Time":"2023-03-29T13:37:32.849690853Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed"}
+{"Time":"2023-03-29T13:37:32.849694907Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"=== RUN   TestServer/RateLimit/Changed\n"}
+{"Time":"2023-03-29T13:37:32.849700056Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"=== PAUSE TestServer/RateLimit/Changed\n"}
+{"Time":"2023-03-29T13:37:32.849702697Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed"}
+{"Time":"2023-03-29T13:37:32.849706931Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled"}
+{"Time":"2023-03-29T13:37:32.849709323Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"=== RUN   TestServer/RateLimit/Disabled\n"}
+{"Time":"2023-03-29T13:37:32.849713561Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"=== PAUSE TestServer/RateLimit/Disabled\n"}
+{"Time":"2023-03-29T13:37:32.849716093Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled"}
+{"Time":"2023-03-29T13:37:32.849720102Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default"}
+{"Time":"2023-03-29T13:37:32.849722411Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"=== CONT  TestServer/RateLimit/Default\n"}
+{"Time":"2023-03-29T13:37:32.850485755Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerRateLimitDefault1881118474/001 server --in-memory --http-address :0 --access-url http://example.com\n"}
+{"Time":"2023-03-29T13:37:32.851011889Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:38127\n"}
+{"Time":"2023-03-29T13:37:32.851175576Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth"}
+{"Time":"2023-03-29T13:37:32.851180015Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"=== CONT  TestServer/GitHubOAuth\n"}
+{"Time":"2023-03-29T13:37:32.851983967Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerGitHubOAuth724593823/001 server --in-memory --http-address :0 --access-url http://example.com --oauth2-github-allow-everyone --oauth2-github-client-id fake --oauth2-github-client-secret fake --oauth2-github-enterprise-base-url https://fake-url.com\n"}
+{"Time":"2023-03-29T13:37:32.852521551Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:33313\n"}
+{"Time":"2023-03-29T13:37:32.852663734Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus"}
+{"Time":"2023-03-29T13:37:32.852668353Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"=== CONT  TestServer/Prometheus\n"}
+{"Time":"2023-03-29T13:37:32.853556318Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerPrometheus2050744846/002 server --in-memory --http-address :0 --access-url http://example.com --provisioner-daemons 1 --prometheus-enable --prometheus-address :37569 --cache-dir /tmp/TestServerPrometheus2050744846/001\n"}
+{"Time":"2023-03-29T13:37:32.854050354Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:38381\n"}
+{"Time":"2023-03-29T13:37:32.854220704Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry"}
+{"Time":"2023-03-29T13:37:32.854225473Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"=== CONT  TestServer/Telemetry\n"}
+{"Time":"2023-03-29T13:37:32.855113604Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTelemetry4206954660/002 server --in-memory --http-address :0 --access-url http://example.com --telemetry --telemetry-url http://127.0.0.1:46805 --cache-dir /tmp/TestServerTelemetry4206954660/001\n"}
+{"Time":"2023-03-29T13:37:32.855607409Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:46851\n"}
+{"Time":"2023-03-29T13:37:32.855759635Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak"}
+{"Time":"2023-03-29T13:37:32.85576445Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"=== CONT  TestServer/TracerNoLeak\n"}
+{"Time":"2023-03-29T13:37:32.856575033Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTracerNoLeak127485117/002 server --in-memory --http-address :0 --access-url http://example.com --trace=true --cache-dir /tmp/TestServerTracerNoLeak127485117/001\n"}
+{"Time":"2023-03-29T13:37:32.859583574Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress"}
+{"Time":"2023-03-29T13:37:32.859590623Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress","Output":"=== CONT  TestServer/DeprecatedAddress\n"}
+{"Time":"2023-03-29T13:37:32.859595635Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP"}
+{"Time":"2023-03-29T13:37:32.859598523Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"=== RUN   TestServer/DeprecatedAddress/HTTP\n"}
+{"Time":"2023-03-29T13:37:32.860822192Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoTLSAddress"}
+{"Time":"2023-03-29T13:37:32.860826569Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoTLSAddress","Output":"=== CONT  TestServer/NoTLSAddress\n"}
+{"Time":"2023-03-29T13:37:32.861575027Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoTLSAddress","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerNoTLSAddress2369561878/001 server --in-memory --tls-enable=true --tls-address \n"}
+{"Time":"2023-03-29T13:37:32.861999568Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoTLSAddress","Output":"--- PASS: TestServer/NoTLSAddress (0.00s)\n"}
+{"Time":"2023-03-29T13:37:32.863329199Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoTLSAddress","Elapsed":0}
+{"Time":"2023-03-29T13:37:32.863344025Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoAddress"}
+{"Time":"2023-03-29T13:37:32.863348554Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoAddress","Output":"=== CONT  TestServer/NoAddress\n"}
+{"Time":"2023-03-29T13:37:32.864056037Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoAddress","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerNoAddress3728350894/001 server --in-memory --http-address :80 --tls-enable=false --tls-address \n"}
+{"Time":"2023-03-29T13:37:32.864465815Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoAddress","Output":"--- PASS: TestServer/NoAddress (0.00s)\n"}
+{"Time":"2023-03-29T13:37:32.865769258Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoAddress","Elapsed":0}
+{"Time":"2023-03-29T13:37:32.865776672Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6"}
+{"Time":"2023-03-29T13:37:32.865779982Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"=== CONT  TestServer/CanListenUnspecifiedv6\n"}
+{"Time":"2023-03-29T13:37:32.866452947Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerCanListenUnspecifiedv63515544106/001 server --in-memory --http-address [::]:0 --access-url http://example.com\n"}
+{"Time":"2023-03-29T13:37:32.86788654Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4"}
+{"Time":"2023-03-29T13:37:32.867892077Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"=== CONT  TestServer/CanListenUnspecifiedv4\n"}
+{"Time":"2023-03-29T13:37:32.868594181Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerCanListenUnspecifiedv43698525072/001 server --in-memory --http-address 0.0.0.0:0 --access-url http://example.com\n"}
+{"Time":"2023-03-29T13:37:32.87981375Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect"}
+{"Time":"2023-03-29T13:37:32.879832688Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect","Output":"=== CONT  TestServer/TLSRedirect\n"}
+{"Time":"2023-03-29T13:37:32.879840427Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK"}
+{"Time":"2023-03-29T13:37:32.879843579Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"=== RUN   TestServer/TLSRedirect/OK\n"}
+{"Time":"2023-03-29T13:37:32.879847493Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"=== PAUSE TestServer/TLSRedirect/OK\n"}
+{"Time":"2023-03-29T13:37:32.879850007Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK"}
+{"Time":"2023-03-29T13:37:32.879858919Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect"}
+{"Time":"2023-03-29T13:37:32.87986153Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"=== RUN   TestServer/TLSRedirect/NoRedirect\n"}
+{"Time":"2023-03-29T13:37:32.879868217Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"=== PAUSE TestServer/TLSRedirect/NoRedirect\n"}
+{"Time":"2023-03-29T13:37:32.879871031Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect"}
+{"Time":"2023-03-29T13:37:32.879882319Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard"}
+{"Time":"2023-03-29T13:37:32.879885302Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"=== RUN   TestServer/TLSRedirect/NoRedirectWithWildcard\n"}
+{"Time":"2023-03-29T13:37:32.879901278Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"=== PAUSE TestServer/TLSRedirect/NoRedirectWithWildcard\n"}
+{"Time":"2023-03-29T13:37:32.879904339Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard"}
+{"Time":"2023-03-29T13:37:32.879917091Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener"}
+{"Time":"2023-03-29T13:37:32.879920112Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"=== RUN   TestServer/TLSRedirect/NoTLSListener\n"}
+{"Time":"2023-03-29T13:37:32.881385273Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP"}
+{"Time":"2023-03-29T13:37:32.881392419Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"=== CONT  TestServer/TLSAndHTTP\n"}
+{"Time":"2023-03-29T13:37:32.883317205Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSAndHTTP1565439063/003 server --in-memory --http-address :0 --access-url https://example.com --tls-enable --tls-redirect-http-to-https=false --tls-address :0 --tls-cert-file /tmp/TestServerTLSAndHTTP1565439063/001/1540336369 --tls-key-file /tmp/TestServerTLSAndHTTP1565439063/001/228555534 --cache-dir /tmp/TestServerTLSAndHTTP1565439063/002\n"}
+{"Time":"2023-03-29T13:37:32.886709195Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple"}
+{"Time":"2023-03-29T13:37:32.886720913Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"=== CONT  TestServer/TLSValidMultiple\n"}
+{"Time":"2023-03-29T13:37:32.888650035Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSValidMultiple3077156975/004 server --in-memory --http-address  --access-url https://example.com --tls-enable --tls-address :0 --tls-cert-file /tmp/TestServerTLSValidMultiple3077156975/001/3448842699 --tls-key-file /tmp/TestServerTLSValidMultiple3077156975/001/3382329005 --tls-cert-file /tmp/TestServerTLSValidMultiple3077156975/002/610618616 --tls-key-file /tmp/TestServerTLSValidMultiple3077156975/002/3728409390 --cache-dir /tmp/TestServerTLSValidMultiple3077156975/003\n"}
+{"Time":"2023-03-29T13:37:32.889032741Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid"}
+{"Time":"2023-03-29T13:37:32.889040091Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"=== CONT  TestServer/TLSValid\n"}
+{"Time":"2023-03-29T13:37:32.890094104Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSValid1911968885/003 server --in-memory --http-address  --access-url https://example.com --tls-enable --tls-address :0 --tls-cert-file /tmp/TestServerTLSValid1911968885/001/91528180 --tls-key-file /tmp/TestServerTLSValid1911968885/001/1223943395 --cache-dir /tmp/TestServerTLSValid1911968885/002\n"}
+{"Time":"2023-03-29T13:37:32.890711151Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: Started TLS/HTTPS listener at https://[::]:38747\n"}
+{"Time":"2023-03-29T13:37:32.893432414Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid"}
+{"Time":"2023-03-29T13:37:32.893439577Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid","Output":"=== CONT  TestServer/TLSInvalid\n"}
+{"Time":"2023-03-29T13:37:32.895534213Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoCert"}
+{"Time":"2023-03-29T13:37:32.895540534Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"=== RUN   TestServer/TLSInvalid/NoCert\n"}
+{"Time":"2023-03-29T13:37:32.895545749Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"=== PAUSE TestServer/TLSInvalid/NoCert\n"}
+{"Time":"2023-03-29T13:37:32.895548511Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoCert"}
+{"Time":"2023-03-29T13:37:32.89555469Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoKey"}
+{"Time":"2023-03-29T13:37:32.895559989Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"=== RUN   TestServer/TLSInvalid/NoKey\n"}
+{"Time":"2023-03-29T13:37:32.895564748Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"=== PAUSE TestServer/TLSInvalid/NoKey\n"}
+{"Time":"2023-03-29T13:37:32.895567562Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoKey"}
+{"Time":"2023-03-29T13:37:32.895571832Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCount"}
+{"Time":"2023-03-29T13:37:32.895574371Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"=== RUN   TestServer/TLSInvalid/MismatchedCount\n"}
+{"Time":"2023-03-29T13:37:32.895579082Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"=== PAUSE TestServer/TLSInvalid/MismatchedCount\n"}
+{"Time":"2023-03-29T13:37:32.895581688Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCount"}
+{"Time":"2023-03-29T13:37:32.895586121Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey"}
+{"Time":"2023-03-29T13:37:32.895588766Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"=== RUN   TestServer/TLSInvalid/MismatchedCertAndKey\n"}
+{"Time":"2023-03-29T13:37:32.895593302Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"=== PAUSE TestServer/TLSInvalid/MismatchedCertAndKey\n"}
+{"Time":"2023-03-29T13:37:32.895595797Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey"}
+{"Time":"2023-03-29T13:37:32.895598709Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoCert"}
+{"Time":"2023-03-29T13:37:32.895601189Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"=== CONT  TestServer/TLSInvalid/NoCert\n"}
+{"Time":"2023-03-29T13:37:32.896383938Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSInvalidNoCert155343146/002 server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidNoCert155343146/001 --tls-enable --tls-key-file /tmp/TestServerTLSInvalid1610620518/001/1816833089\n"}
+{"Time":"2023-03-29T13:37:32.896712838Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:41521\n"}
+{"Time":"2023-03-29T13:37:32.896777738Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"    server_test.go:344: args: [server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidNoCert155343146/001 --tls-enable --tls-key-file /tmp/TestServerTLSInvalid1610620518/001/1816833089]\n"}
+{"Time":"2023-03-29T13:37:32.896926023Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoCert","Output":"--- PASS: TestServer/TLSInvalid/NoCert (0.00s)\n"}
+{"Time":"2023-03-29T13:37:32.896932574Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoCert","Elapsed":0}
+{"Time":"2023-03-29T13:37:32.896936656Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadClientAuth"}
+{"Time":"2023-03-29T13:37:32.896939204Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadClientAuth","Output":"=== CONT  TestServer/TLSBadClientAuth\n"}
+{"Time":"2023-03-29T13:37:32.897600801Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadClientAuth","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSBadClientAuth2976087810/002 server --in-memory --http-address  --access-url http://example.com --tls-enable --tls-address :0 --tls-client-auth something --cache-dir /tmp/TestServerTLSBadClientAuth2976087810/001\n"}
+{"Time":"2023-03-29T13:37:32.897994004Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadClientAuth","Output":"--- PASS: TestServer/TLSBadClientAuth (0.00s)\n"}
+{"Time":"2023-03-29T13:37:32.898002196Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadClientAuth","Elapsed":0}
+{"Time":"2023-03-29T13:37:32.89800515Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadVersion"}
+{"Time":"2023-03-29T13:37:32.898008134Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadVersion","Output":"=== CONT  TestServer/TLSBadVersion\n"}
+{"Time":"2023-03-29T13:37:32.898635976Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadVersion","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSBadVersion2460276843/002 server --in-memory --http-address  --access-url http://example.com --tls-enable --tls-address :0 --tls-min-version tls9 --cache-dir /tmp/TestServerTLSBadVersion2460276843/001\n"}
+{"Time":"2023-03-29T13:37:32.899017393Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadVersion","Output":"--- PASS: TestServer/TLSBadVersion (0.00s)\n"}
+{"Time":"2023-03-29T13:37:32.899025249Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSBadVersion","Elapsed":0}
+{"Time":"2023-03-29T13:37:32.899028489Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoSchemeAccessURL"}
+{"Time":"2023-03-29T13:37:32.899031117Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoSchemeAccessURL","Output":"=== CONT  TestServer/NoSchemeAccessURL\n"}
+{"Time":"2023-03-29T13:37:32.899735022Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoSchemeAccessURL","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerNoSchemeAccessURL3227162288/002 server --in-memory --http-address :0 --access-url google.com --cache-dir /tmp/TestServerNoSchemeAccessURL3227162288/001\n"}
+{"Time":"2023-03-29T13:37:32.900078052Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoSchemeAccessURL","Output":"--- PASS: TestServer/NoSchemeAccessURL (0.00s)\n"}
+{"Time":"2023-03-29T13:37:32.900133291Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoSchemeAccessURL","Elapsed":0}
+{"Time":"2023-03-29T13:37:32.900136928Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL"}
+{"Time":"2023-03-29T13:37:32.900139387Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"=== CONT  TestServer/NoWarningWithRemoteAccessURL\n"}
+{"Time":"2023-03-29T13:37:32.900802695Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerNoWarningWithRemoteAccessURL2261451002/002 server --in-memory --http-address :0 --access-url https://google.com --cache-dir /tmp/TestServerNoWarningWithRemoteAccessURL2261451002/001\n"}
+{"Time":"2023-03-29T13:37:32.901428258Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL"}
+{"Time":"2023-03-29T13:37:32.901434866Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"=== CONT  TestServer/RemoteAccessURL\n"}
+{"Time":"2023-03-29T13:37:32.902088159Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerRemoteAccessURL917985260/002 server --in-memory --http-address :0 --access-url https://foobarbaz.mydomain --cache-dir /tmp/TestServerRemoteAccessURL917985260/001\n"}
+{"Time":"2023-03-29T13:37:32.904875871Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL"}
+{"Time":"2023-03-29T13:37:32.90488445Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"=== CONT  TestServer/LocalAccessURL\n"}
+{"Time":"2023-03-29T13:37:32.905523425Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerLocalAccessURL3554694382/002 server --in-memory --http-address :0 --access-url http://localhost:3000/ --cache-dir /tmp/TestServerLocalAccessURL3554694382/001\n"}
+{"Time":"2023-03-29T13:37:32.909203431Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw"}
+{"Time":"2023-03-29T13:37:32.909214782Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"=== CONT  TestServer/BuiltinPostgresURLRaw\n"}
+{"Time":"2023-03-29T13:37:32.90987112Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerBuiltinPostgresURLRaw2301128244/001 server postgres-builtin-url --raw-url\n"}
+{"Time":"2023-03-29T13:37:32.910387857Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL"}
+{"Time":"2023-03-29T13:37:32.910393909Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"=== CONT  TestServer/BuiltinPostgresURL\n"}
+{"Time":"2023-03-29T13:37:32.911031385Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerBuiltinPostgresURL2022412164/001 server postgres-builtin-url\n"}
+{"Time":"2023-03-29T13:37:32.911696996Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple"}
+{"Time":"2023-03-29T13:37:32.911705024Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"=== CONT  TestServer/Logging/Multiple\n"}
+{"Time":"2023-03-29T13:37:32.912435053Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerLoggingMultiple1018156314/004 server --verbose --in-memory --http-address :0 --access-url http://example.com --log-human /tmp/TestServerLoggingMultiple1018156314/001/coder-logging-test-2240709984 --log-json /tmp/TestServerLoggingMultiple1018156314/002/coder-logging-test-2164710923 --log-stackdriver /tmp/TestServerLoggingMultiple1018156314/003/coder-logging-test-3557853095\n"}
+{"Time":"2023-03-29T13:37:32.912514796Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver"}
+{"Time":"2023-03-29T13:37:32.912520309Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"=== CONT  TestServer/Logging/Stackdriver\n"}
+{"Time":"2023-03-29T13:37:32.913204422Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerLoggingStackdriver1654522233/002 server --verbose --in-memory --http-address :0 --access-url http://example.com --log-stackdriver /tmp/TestServerLoggingStackdriver1654522233/001/coder-logging-test-3531177805\n"}
+{"Time":"2023-03-29T13:37:32.913286393Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON"}
+{"Time":"2023-03-29T13:37:32.913292549Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"=== CONT  TestServer/Logging/JSON\n"}
+{"Time":"2023-03-29T13:37:32.913937207Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerLoggingJSON1509288451/002 server --verbose --in-memory --http-address :0 --access-url http://example.com --log-json /tmp/TestServerLoggingJSON1509288451/001/coder-logging-test-115410787\n"}
+{"Time":"2023-03-29T13:37:32.913982029Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human"}
+{"Time":"2023-03-29T13:37:32.913985447Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"=== CONT  TestServer/Logging/Human\n"}
+{"Time":"2023-03-29T13:37:32.914664441Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerLoggingHuman1910502850/002 server --verbose --in-memory --http-address :0 --access-url http://example.com --log-human /tmp/TestServerLoggingHuman1910502850/001/coder-logging-test-2040592756\n"}
+{"Time":"2023-03-29T13:37:32.915201663Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:42891\n"}
+{"Time":"2023-03-29T13:37:32.915334373Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled"}
+{"Time":"2023-03-29T13:37:32.91533902Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"=== CONT  TestServer/RateLimit/Disabled\n"}
+{"Time":"2023-03-29T13:37:32.915962046Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerRateLimitDisabled1912095220/001 server --in-memory --http-address :0 --access-url http://example.com --api-rate-limit -1\n"}
+{"Time":"2023-03-29T13:37:32.916390927Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:35065\n"}
+{"Time":"2023-03-29T13:37:32.917528951Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:32.917 [WARN]\t\u003cgithub.com/coder/coder/v2/cli/server.go:310\u003e\t(*RootCmd).Server.func1\tstart telemetry exporter ...\n"}
+{"Time":"2023-03-29T13:37:32.917535354Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"          \"error\": default exporter:\n"}
+{"Time":"2023-03-29T13:37:32.917538568Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"                       github.com/coder/coder/v2/coderd/tracing.TracerProvider\n"}
+{"Time":"2023-03-29T13:37:32.917543903Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"                           /home/mafredri/src/coder/coder/coderd/tracing/exporter.go:51\n"}
+{"Time":"2023-03-29T13:37:32.917547458Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"                     - create otlp exporter:\n"}
+{"Time":"2023-03-29T13:37:32.917552386Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"                       github.com/coder/coder/v2/coderd/tracing.DefaultExporter\n"}
+{"Time":"2023-03-29T13:37:32.917557328Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"                           /home/mafredri/src/coder/coder/coderd/tracing/exporter.go:109\n"}
+{"Time":"2023-03-29T13:37:32.917562236Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"                     - context canceled\n"}
+{"Time":"2023-03-29T13:37:32.917576569Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:42093\n"}
+{"Time":"2023-03-29T13:37:32.917619611Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stderr: \u001b[1;mWARN: \u001b[0mThe access URL  \u001b[;mhttp://example.com\u001b[0m  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\n"}
+{"Time":"2023-03-29T13:37:32.917642615Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
+{"Time":"2023-03-29T13:37:32.920130044Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:32.920155751Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:32.920178993Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:32.920200709Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:32.920249847Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"=== PAUSE TestServer/DeprecatedAddress/HTTP\n"}
+{"Time":"2023-03-29T13:37:32.92025399Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP"}
+{"Time":"2023-03-29T13:37:32.920269801Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS"}
+{"Time":"2023-03-29T13:37:32.920274896Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"=== RUN   TestServer/DeprecatedAddress/TLS\n"}
+{"Time":"2023-03-29T13:37:32.920279669Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"=== PAUSE TestServer/DeprecatedAddress/TLS\n"}
+{"Time":"2023-03-29T13:37:32.920282197Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS"}
+{"Time":"2023-03-29T13:37:32.92570047Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"=== PAUSE TestServer/TLSRedirect/NoTLSListener\n"}
+{"Time":"2023-03-29T13:37:32.92570807Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener"}
+{"Time":"2023-03-29T13:37:32.925713393Z","Action":"run","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener"}
+{"Time":"2023-03-29T13:37:32.92571595Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"=== RUN   TestServer/TLSRedirect/NoHTTPListener\n"}
+{"Time":"2023-03-29T13:37:32.925720434Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"=== PAUSE TestServer/TLSRedirect/NoHTTPListener\n"}
+{"Time":"2023-03-29T13:37:32.925722986Z","Action":"pause","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener"}
+{"Time":"2023-03-29T13:37:32.92724642Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.927: cmd: \"Started HTTP listener at http://[::]:39671\"\n"}
+{"Time":"2023-03-29T13:37:32.927965116Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.927: cmd: \"Started HTTP listener at http://[::]:42445\"\n"}
+{"Time":"2023-03-29T13:37:32.928006932Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.927: cmd: \"WARN: The access URL  http://localhost:3000/  isn't externally reachable, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\"\n"}
+{"Time":"2023-03-29T13:37:32.928023919Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.928: cmd: \"                                                                                                                                                                                                       \\r\"\n"}
+{"Time":"2023-03-29T13:37:32.92802928Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.928: cmd: \"                                       \"\n"}
+{"Time":"2023-03-29T13:37:32.928042009Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.928: cmd: \"View the Web UI: http://localhost:3000/\\r\"\n"}
+{"Time":"2023-03-29T13:37:32.928061275Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.928: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:32.928077795Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:32.928: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:32.973554406Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    server_test.go:173: 2023-03-29 13:37:32.973: cmd: matched newline = \"postgres://coder@localhost:43211/coder?sslmode=disable\u0026password=Xha7Pt7Mcuv0IlkT\"\n"}
+{"Time":"2023-03-29T13:37:32.973585539Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:83: 2023-03-29 13:37:32.973: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:32.973602051Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:74: 2023-03-29 13:37:32.973: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:32.973653232Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:110: 2023-03-29 13:37:32.973: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:32.973673734Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:111: 2023-03-29 13:37:32.973: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:32.973681952Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:113: 2023-03-29 13:37:32.973: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:32.973745487Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:76: 2023-03-29 13:37:32.973: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:32.973755467Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:74: 2023-03-29 13:37:32.973: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:32.973767632Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:76: 2023-03-29 13:37:32.973: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:32.973787295Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:74: 2023-03-29 13:37:32.973: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:32.973794335Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:76: 2023-03-29 13:37:32.973: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:32.973897477Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    server_test.go:161: 2023-03-29 13:37:32.973: cmd: matched \"psql\" = \" psql\"\n"}
+{"Time":"2023-03-29T13:37:32.973911816Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:83: 2023-03-29 13:37:32.973: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:32.97395369Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:74: 2023-03-29 13:37:32.973: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:32.973977688Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:110: 2023-03-29 13:37:32.973: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:32.973985059Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:111: 2023-03-29 13:37:32.973: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:32.974011895Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:113: 2023-03-29 13:37:32.973: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:32.974059281Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:76: 2023-03-29 13:37:32.974: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:32.974066822Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:74: 2023-03-29 13:37:32.974: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:32.974073474Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:76: 2023-03-29 13:37:32.974: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:32.974079891Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:74: 2023-03-29 13:37:32.974: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:32.974111815Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:76: 2023-03-29 13:37:32.974: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:32.976190183Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:32.976 [DEBUG]\t\u003cgithub.com/coder/coder/v2/cli/server.go:260\u003e\t(*RootCmd).Server.func1\tstarted debug logging\n"}
+{"Time":"2023-03-29T13:37:32.976499482Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:45725\n"}
+{"Time":"2023-03-29T13:37:32.977583615Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:32.977594677Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed"}
+{"Time":"2023-03-29T13:37:32.977598319Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"=== CONT  TestServer/RateLimit/Changed\n"}
+{"Time":"2023-03-29T13:37:32.979536902Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerRateLimitChanged2140102987/001 server --in-memory --http-address :0 --access-url http://example.com --api-rate-limit 100\n"}
+{"Time":"2023-03-29T13:37:32.981248381Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:45133\n"}
+{"Time":"2023-03-29T13:37:32.982290561Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:32.982: cmd: \"Started HTTP listener at http://0.0.0.0:37181\"\n"}
+{"Time":"2023-03-29T13:37:32.982961159Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    server_test.go:718: 2023-03-29 13:37:32.982: cmd: matched \"Started HTTP listener\" = \"Started HTTP listener\"\n"}
+{"Time":"2023-03-29T13:37:32.983105329Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    server_test.go:719: 2023-03-29 13:37:32.983: cmd: matched \"http://0.0.0.0:\" = \" at http://0.0.0.0:\"\n"}
+{"Time":"2023-03-29T13:37:32.983250515Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:32.983: cmd: \"Started HTTP listener at http://[::]:33561\"\n"}
+{"Time":"2023-03-29T13:37:32.984671213Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    server_test.go:738: 2023-03-29 13:37:32.983: cmd: matched \"Started HTTP listener at\" = \"Started HTTP listener at\"\n"}
+{"Time":"2023-03-29T13:37:32.984712571Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    server_test.go:739: 2023-03-29 13:37:32.983: cmd: matched \"http://[::]:\" = \" http://[::]:\"\n"}
+{"Time":"2023-03-29T13:37:32.984733017Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
+{"Time":"2023-03-29T13:37:32.996108891Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:32.996314264Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
+{"Time":"2023-03-29T13:37:33.00125555Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:33.001437292Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
+{"Time":"2023-03-29T13:37:33.002347544Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
+{"Time":"2023-03-29T13:37:33.00471704Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:33.004816922Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stderr: \u001b[1;mWARN: \u001b[0mThe access URL  \u001b[;mhttp://example.com\u001b[0m  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\n"}
+{"Time":"2023-03-29T13:37:33.004828798Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
+{"Time":"2023-03-29T13:37:33.008304441Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:33.008334151Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:33.008344183Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:33.008351448Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:33.008401366Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 3...\n"}
+{"Time":"2023-03-29T13:37:33.00852168Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 3\n"}
+{"Time":"2023-03-29T13:37:33.008558749Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP"}
+{"Time":"2023-03-29T13:37:33.008572474Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"=== CONT  TestServer/DeprecatedAddress/HTTP\n"}
+{"Time":"2023-03-29T13:37:33.009297224Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerDeprecatedAddressHTTP1174595269/002 server --in-memory --address :0 --access-url http://example.com --cache-dir /tmp/TestServerDeprecatedAddressHTTP1174595269/001\n"}
+{"Time":"2023-03-29T13:37:33.011200842Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    server_test.go:196: 2023-03-29 13:37:33.011: cmd: matched \"this may cause unexpected problems when creating workspaces\" = \"Started HTTP listener at http://[::]:42445\\r\\nWARN: The access URL  http://localhost:3000/  isn't externally reachable, this may cause unexpected problems when creating workspaces\"\n"}
+{"Time":"2023-03-29T13:37:33.011256139Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    server_test.go:197: 2023-03-29 13:37:33.011: cmd: matched \"View the Web UI: http://localhost:3000/\" = \". Generate a unique *.try.coder.app URL by not specifying an access URL.\\r\\n                                                                                                                                                                                                       \\r\\r\\n                                       \\r\\nView the Web UI: http://localhost:3000/\"\n"}
+{"Time":"2023-03-29T13:37:33.011375838Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: \u001b[1;mWARN: \u001b[0mThe access URL  \u001b[;mhttp://example.com\u001b[0m  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\n"}
+{"Time":"2023-03-29T13:37:33.01139606Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
+{"Time":"2023-03-29T13:37:33.013674142Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:33.013696745Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:33.013708678Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:33.013717271Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:33.013756177Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 3...\n"}
+{"Time":"2023-03-29T13:37:33.013807024Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:33.013 [DEBUG]\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:553\u003e\t(*Server).closeWithError\tclosing server with error\t{\"error\": null}\n"}
+{"Time":"2023-03-29T13:37:33.013861318Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 3\n"}
+{"Time":"2023-03-29T13:37:33.014354405Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:121: 2023-03-29 13:37:33.014: cmd: \"postgres://coder@localhost:43211/coder?sslmode=disable\u0026password=Xha7Pt7Mcuv0IlkT\"\n"}
+{"Time":"2023-03-29T13:37:33.014367303Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"    ptytest.go:102: 2023-03-29 13:37:33.014: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:33.01451535Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Output":"--- PASS: TestServer/BuiltinPostgresURLRaw (0.11s)\n"}
+{"Time":"2023-03-29T13:37:33.014525519Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURLRaw","Elapsed":0.11}
+{"Time":"2023-03-29T13:37:33.014534922Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK"}
+{"Time":"2023-03-29T13:37:33.014543883Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"=== CONT  TestServer/TLSRedirect/OK\n"}
+{"Time":"2023-03-29T13:37:33.01571179Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSRedirectOK4195649967/003 server --in-memory --cache-dir /tmp/TestServerTLSRedirectOK4195649967/002 --http-address :0 --tls-enable --tls-address :0 --tls-cert-file /tmp/TestServerTLSRedirectOK4195649967/001/1898764516 --tls-key-file /tmp/TestServerTLSRedirectOK4195649967/001/3656697468 --wildcard-access-url *.example.com --access-url https://example.com --redirect-to-access-url\n"}
+{"Time":"2023-03-29T13:37:33.015887089Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.015: cmd: \" psql \\\"postgres://coder@localhost:43265/coder?sslmode=disable\u0026password=qZX0YVm9trLHmHzY\\\" \"\n"}
+{"Time":"2023-03-29T13:37:33.015903823Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"    ptytest.go:102: 2023-03-29 13:37:33.015: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:33.016045291Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Output":"--- PASS: TestServer/BuiltinPostgresURL (0.11s)\n"}
+{"Time":"2023-03-29T13:37:33.01632566Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgresURL","Elapsed":0.11}
+{"Time":"2023-03-29T13:37:33.016345189Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:33.022419375Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
+{"Time":"2023-03-29T13:37:33.099478164Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:33.138846249Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:121: 2023-03-29 13:37:33.137: cmd: \"Started TLS/HTTPS listener at https://[::]:46747\"\n"}
+{"Time":"2023-03-29T13:37:33.138887737Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 1...\n"}
+{"Time":"2023-03-29T13:37:33.138894754Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 1\n"}
+{"Time":"2023-03-29T13:37:33.138900199Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 2...\n"}
+{"Time":"2023-03-29T13:37:33.138905607Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 2\n"}
+{"Time":"2023-03-29T13:37:33.138911333Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:33.141820899Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:33.140 [DEBUG]\t(coderd.metrics_cache)\t\u003cgithub.com/coder/coder/v2/coderd/metricscache/metricscache.go:272\u003e\t(*Cache).run\tdeployment stats metrics refreshed\t{\"took\": \"23.786µs\", \"interval\": \"30s\"}\n"}
+{"Time":"2023-03-29T13:37:33.141862791Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:33.141 [DEBUG]\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:200\u003e\t(*Server).connect\tconnected\n"}
+{"Time":"2023-03-29T13:37:33.141871378Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:33.141 [DEBUG]\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:200\u003e\t(*Server).connect\tconnected\n"}
+{"Time":"2023-03-29T13:37:33.14187713Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 1...\n"}
+{"Time":"2023-03-29T13:37:33.141883292Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:33.141 [DEBUG]\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:553\u003e\t(*Server).closeWithError\tclosing server with error\t{\"error\": null}\n"}
+{"Time":"2023-03-29T13:37:33.141893432Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 1\n"}
+{"Time":"2023-03-29T13:37:33.141898548Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 2...\n"}
+{"Time":"2023-03-29T13:37:33.141959656Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stderr: 2023-03-29 13:37:33.141 [DEBUG]\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:553\u003e\t(*Server).closeWithError\tclosing server with error\t{\"error\": null}\n"}
+{"Time":"2023-03-29T13:37:33.142091685Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 2\n"}
+{"Time":"2023-03-29T13:37:33.142184362Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:33.142408919Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stderr: \u001b[1;mWARN: \u001b[0mThe access URL  \u001b[;mhttp://example.com\u001b[0m  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\n"}
+{"Time":"2023-03-29T13:37:33.142501883Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
+{"Time":"2023-03-29T13:37:33.147218812Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:33.147251166Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:33.14725864Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:33.147298554Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:33.147355456Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 3...\n"}
+{"Time":"2023-03-29T13:37:33.14745485Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 3\n"}
+{"Time":"2023-03-29T13:37:33.148482198Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey"}
+{"Time":"2023-03-29T13:37:33.148502985Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"=== CONT  TestServer/TLSInvalid/MismatchedCertAndKey\n"}
+{"Time":"2023-03-29T13:37:33.149452866Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSInvalidMismatchedCertAndKey978167281/002 server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidMismatchedCertAndKey978167281/001 --tls-enable --tls-cert-file /tmp/TestServerTLSInvalid1610620518/001/3088514081 --tls-key-file /tmp/TestServerTLSInvalid1610620518/002/2775674587\n"}
+{"Time":"2023-03-29T13:37:33.149984351Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:38873\n"}
+{"Time":"2023-03-29T13:37:33.150363114Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"    server_test.go:344: args: [server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidMismatchedCertAndKey978167281/001 --tls-enable --tls-cert-file /tmp/TestServerTLSInvalid1610620518/001/3088514081 --tls-key-file /tmp/TestServerTLSInvalid1610620518/002/2775674587]\n"}
+{"Time":"2023-03-29T13:37:33.150581402Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Output":"--- PASS: TestServer/TLSInvalid/MismatchedCertAndKey (0.00s)\n"}
+{"Time":"2023-03-29T13:37:33.15059771Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCertAndKey","Elapsed":0}
+{"Time":"2023-03-29T13:37:33.150605526Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCount"}
+{"Time":"2023-03-29T13:37:33.150609996Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"=== CONT  TestServer/TLSInvalid/MismatchedCount\n"}
+{"Time":"2023-03-29T13:37:33.151854633Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSInvalidMismatchedCount803880522/002 server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidMismatchedCount803880522/001 --tls-enable --tls-cert-file /tmp/TestServerTLSInvalid1610620518/001/3088514081 --tls-key-file /tmp/TestServerTLSInvalid1610620518/001/1816833089 --tls-cert-file /tmp/TestServerTLSInvalid1610620518/002/3269350839\n"}
+{"Time":"2023-03-29T13:37:33.152410162Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:37839\n"}
+{"Time":"2023-03-29T13:37:33.15252017Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"    server_test.go:344: args: [server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidMismatchedCount803880522/001 --tls-enable --tls-cert-file /tmp/TestServerTLSInvalid1610620518/001/3088514081 --tls-key-file /tmp/TestServerTLSInvalid1610620518/001/1816833089 --tls-cert-file /tmp/TestServerTLSInvalid1610620518/002/3269350839]\n"}
+{"Time":"2023-03-29T13:37:33.152732054Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Output":"--- PASS: TestServer/TLSInvalid/MismatchedCount (0.00s)\n"}
+{"Time":"2023-03-29T13:37:33.152746399Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/MismatchedCount","Elapsed":0}
+{"Time":"2023-03-29T13:37:33.152754347Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoKey"}
+{"Time":"2023-03-29T13:37:33.152758935Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"=== CONT  TestServer/TLSInvalid/NoKey\n"}
+{"Time":"2023-03-29T13:37:33.153794977Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSInvalidNoKey281486761/002 server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidNoKey281486761/001 --tls-enable --tls-cert-file /tmp/TestServerTLSInvalid1610620518/001/3088514081\n"}
+{"Time":"2023-03-29T13:37:33.154207106Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:43607\n"}
+{"Time":"2023-03-29T13:37:33.15427222Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"    server_test.go:344: args: [server --in-memory --http-address :0 --access-url http://example.com --cache-dir /tmp/TestServerTLSInvalidNoKey281486761/001 --tls-enable --tls-cert-file /tmp/TestServerTLSInvalid1610620518/001/3088514081]\n"}
+{"Time":"2023-03-29T13:37:33.154468443Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoKey","Output":"--- PASS: TestServer/TLSInvalid/NoKey (0.00s)\n"}
+{"Time":"2023-03-29T13:37:33.154623549Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid/NoKey","Elapsed":0}
+{"Time":"2023-03-29T13:37:33.154633176Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid","Output":"--- PASS: TestServer/TLSInvalid (0.00s)\n"}
+{"Time":"2023-03-29T13:37:33.154761857Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSInvalid","Elapsed":0}
+{"Time":"2023-03-29T13:37:33.154770493Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.154: cmd: \"WARN: The access URL  http://example.com  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\"\n"}
+{"Time":"2023-03-29T13:37:33.439719632Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"                                                                                                                                                                                              \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.43976961Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"                                   \"\n"}
+{"Time":"2023-03-29T13:37:33.439791036Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"View the Web UI: http://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.439807711Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.43982432Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.439851264Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:33.439869598Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:33.439886994Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.439905518Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:33.439924649Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.439: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.439941905Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:83: 2023-03-29 13:37:33.439: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:33.4399588Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:74: 2023-03-29 13:37:33.439: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:33.440230934Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:33.440: cmd: \"Started HTTP listener at http://[::]:45645\"\n"}
+{"Time":"2023-03-29T13:37:33.440246712Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:33.440: cmd: \"Started TLS/HTTPS listener at https://[::]:33779\"\n"}
+{"Time":"2023-03-29T13:37:33.440251896Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    server_test.go:634: 2023-03-29 13:37:33.440: cmd: matched \"Started HTTP listener at\" = \"Started HTTP listener at\"\n"}
+{"Time":"2023-03-29T13:37:33.440278535Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    server_test.go:635: 2023-03-29 13:37:33.440: cmd: ReadLine ctx has no deadline, using 10s\n"}
+{"Time":"2023-03-29T13:37:33.440295931Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    server_test.go:635: 2023-03-29 13:37:33.440: cmd: matched newline = \" http://[::]:45645\"\n"}
+{"Time":"2023-03-29T13:37:33.440327613Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    server_test.go:641: 2023-03-29 13:37:33.440: cmd: matched \"Started TLS/HTTPS listener at\" = \"Started TLS/HTTPS listener at\"\n"}
+{"Time":"2023-03-29T13:37:33.440339171Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    server_test.go:642: 2023-03-29 13:37:33.440: cmd: ReadLine ctx has no deadline, using 10s\n"}
+{"Time":"2023-03-29T13:37:33.440353544Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    server_test.go:642: 2023-03-29 13:37:33.440: cmd: matched newline = \" https://[::]:33779\"\n"}
+{"Time":"2023-03-29T13:37:33.462318671Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.155: cmd: \"WARN: Redirect HTTP to HTTPS is deprecated, please use Redirect to Access URL instead.\"\n"}
+{"Time":"2023-03-29T13:37:33.462349606Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"                                                                                \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.462356521Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"Started HTTP listener at http://[::]:38281\"\n"}
+{"Time":"2023-03-29T13:37:33.462372929Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"WARN: --tls-redirect-http-to-https is deprecated, please use --redirect-to-access-url instead\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.462395287Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"Started TLS/HTTPS listener at https://[::]:37895\"\n"}
+{"Time":"2023-03-29T13:37:33.46242925Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"                                    \"\n"}
+{"Time":"2023-03-29T13:37:33.462438148Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"View the Web UI: https://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.462469497Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.462484536Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.462637037Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:76: 2023-03-29 13:37:33.462: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.462649797Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:33.462659463Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.462670357Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:33.462694313Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:121: 2023-03-29 13:37:33.462: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.462718576Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:110: 2023-03-29 13:37:33.462: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:33.46272687Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:111: 2023-03-29 13:37:33.462: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:33.462736639Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:113: 2023-03-29 13:37:33.462: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:33.462758116Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:74: 2023-03-29 13:37:33.462: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:33.462768617Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:76: 2023-03-29 13:37:33.462: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.462788026Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:74: 2023-03-29 13:37:33.462: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:33.462795774Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:76: 2023-03-29 13:37:33.462: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.462816156Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"    ptytest.go:102: 2023-03-29 13:37:33.462: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:33.462931778Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Output":"--- PASS: TestServer/CanListenUnspecifiedv4 (0.60s)\n"}
+{"Time":"2023-03-29T13:37:33.462940935Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv4","Elapsed":0.6}
+{"Time":"2023-03-29T13:37:33.462948149Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener"}
+{"Time":"2023-03-29T13:37:33.462952114Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"=== CONT  TestServer/TLSRedirect/NoHTTPListener\n"}
+{"Time":"2023-03-29T13:37:33.464080755Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSRedirectNoHTTPListener857312755/003 server --in-memory --cache-dir /tmp/TestServerTLSRedirectNoHTTPListener857312755/002 --http-address  --tls-enable --tls-address :0 --tls-cert-file /tmp/TestServerTLSRedirectNoHTTPListener857312755/001/774178655 --tls-key-file /tmp/TestServerTLSRedirectNoHTTPListener857312755/001/2109956146 --wildcard-access-url *.example.com --access-url https://example.com\n"}
+{"Time":"2023-03-29T13:37:33.464227163Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:33.464: cmd: \"                                    \"\n"}
+{"Time":"2023-03-29T13:37:33.464240384Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:33.464: cmd: \"View the Web UI: https://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.464252515Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:33.464: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.46428589Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:33.464: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.472563896Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.155: cmd: \"WARN: The access URL  http://example.com  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\"\n"}
+{"Time":"2023-03-29T13:37:33.472612391Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                                                                                                                                                                                              \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.47263698Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                                   \"\n"}
+{"Time":"2023-03-29T13:37:33.472648847Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"View the Web UI: http://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.472703374Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.472714667Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.473028818Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:33.473041801Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:33.473048085Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.473053454Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:33.47305943Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.473064898Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:33.473070019Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.473075028Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:33.473080237Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:121: 2023-03-29 13:37:33.472: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.47308794Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    server_test.go:488: 2023-03-29 13:37:33.472: cmd: matched \"Started HTTP listener at\" = \"WARN: Redirect HTTP to HTTPS is deprecated, please use Redirect to Access URL instead.\\r\\n                                                                                \\r\\r\\nStarted HTTP listener at\"\n"}
+{"Time":"2023-03-29T13:37:33.473094939Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    server_test.go:489: 2023-03-29 13:37:33.472: cmd: ReadLine ctx has no deadline, using 10s\n"}
+{"Time":"2023-03-29T13:37:33.473099786Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    server_test.go:489: 2023-03-29 13:37:33.472: cmd: matched newline = \" http://[::]:38281\"\n"}
+{"Time":"2023-03-29T13:37:33.473628418Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    server_test.go:493: 2023-03-29 13:37:33.473: cmd: matched \"Started TLS/HTTPS listener at \" = \"WARN: --tls-redirect-http-to-https is deprecated, please use --redirect-to-access-url instead\\r\\r\\nStarted TLS/HTTPS listener at \"\n"}
+{"Time":"2023-03-29T13:37:33.473644808Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    server_test.go:494: 2023-03-29 13:37:33.473: cmd: ReadLine ctx has no deadline, using 10s\n"}
+{"Time":"2023-03-29T13:37:33.47365119Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    server_test.go:494: 2023-03-29 13:37:33.473: cmd: matched newline = \"https://[::]:37895\"\n"}
+{"Time":"2023-03-29T13:37:33.475250161Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:33.475281933Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:33.490892952Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
+{"Time":"2023-03-29T13:37:33.492145943Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:83: 2023-03-29 13:37:33.491: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:33.492183748Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:74: 2023-03-29 13:37:33.491: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:33.492192673Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:110: 2023-03-29 13:37:33.492: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:33.492199945Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:111: 2023-03-29 13:37:33.492: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:33.492206118Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:113: 2023-03-29 13:37:33.492: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:33.492296422Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:76: 2023-03-29 13:37:33.492: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.492316694Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:74: 2023-03-29 13:37:33.492: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:33.49232562Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:76: 2023-03-29 13:37:33.492: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.492355439Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:74: 2023-03-29 13:37:33.492: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:33.492364574Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:76: 2023-03-29 13:37:33.492: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.49240481Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"    ptytest.go:102: 2023-03-29 13:37:33.492: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:33.495511552Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Output":"--- PASS: TestServer/CanListenUnspecifiedv6 (0.63s)\n"}
+{"Time":"2023-03-29T13:37:33.495557907Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/CanListenUnspecifiedv6","Elapsed":0.63}
+{"Time":"2023-03-29T13:37:33.495569713Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener"}
+{"Time":"2023-03-29T13:37:33.495575692Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"=== CONT  TestServer/TLSRedirect/NoTLSListener\n"}
+{"Time":"2023-03-29T13:37:33.495582515Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSRedirectNoTLSListener2050465310/003 server --in-memory --cache-dir /tmp/TestServerTLSRedirectNoTLSListener2050465310/002 --http-address :0 --access-url https://example.com\n"}
+{"Time":"2023-03-29T13:37:33.514163923Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:33.51646695Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: View the Web UI: https://example.com\n"}
+{"Time":"2023-03-29T13:37:33.532093856Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:33.532820236Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:33.533254024Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:33.533887464Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Output":"--- PASS: TestServer/Logging/CreatesFile (0.69s)\n"}
+{"Time":"2023-03-29T13:37:33.580391994Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/CreatesFile","Elapsed":0.69}
+{"Time":"2023-03-29T13:37:33.580437708Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.194: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:33.580458446Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:33.580471806Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.58048911Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:33.580504524Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.580522972Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:33.5805328Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.580555757Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:33.580587561Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.580: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.580846451Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Output":"--- PASS: TestServer/Logging/JSON (0.67s)\n"}
+{"Time":"2023-03-29T13:37:33.580862096Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/JSON","Elapsed":0.67}
+{"Time":"2023-03-29T13:37:33.580868926Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect"}
+{"Time":"2023-03-29T13:37:33.580873653Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"=== CONT  TestServer/TLSRedirect/NoRedirect\n"}
+{"Time":"2023-03-29T13:37:33.582048889Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSRedirectNoRedirect2668740580/003 server --in-memory --cache-dir /tmp/TestServerTLSRedirectNoRedirect2668740580/002 --http-address :0 --tls-enable --tls-address :0 --tls-cert-file /tmp/TestServerTLSRedirectNoRedirect2668740580/001/1517171254 --tls-key-file /tmp/TestServerTLSRedirectNoRedirect2668740580/001/1491051903 --wildcard-access-url *.example.com --access-url https://example.com\n"}
+{"Time":"2023-03-29T13:37:33.582187252Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard"}
+{"Time":"2023-03-29T13:37:33.582197387Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"=== CONT  TestServer/TLSRedirect/NoRedirectWithWildcard\n"}
+{"Time":"2023-03-29T13:37:33.583144917Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerTLSRedirectNoRedirectWithWildcard3241718280/003 server --in-memory --cache-dir /tmp/TestServerTLSRedirectNoRedirectWithWildcard3241718280/002 --http-address  --tls-enable --tls-address :0 --tls-cert-file /tmp/TestServerTLSRedirectNoRedirectWithWildcard3241718280/001/2297363344 --tls-key-file /tmp/TestServerTLSRedirectNoRedirectWithWildcard3241718280/001/3868867528 --wildcard-access-url *.example.com --access-url https://example.com --redirect-to-access-url\n"}
+{"Time":"2023-03-29T13:37:33.609797366Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Output":"--- PASS: TestServer/TracerNoLeak (0.75s)\n"}
+{"Time":"2023-03-29T13:37:33.610858133Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TracerNoLeak","Elapsed":0.75}
+{"Time":"2023-03-29T13:37:33.6108818Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.202: cmd: \"WARN: Address is deprecated, please use HTTP Address and TLS Address instead.\"\n"}
+{"Time":"2023-03-29T13:37:33.610892881Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.610: cmd: \"                                                                       \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.610900074Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.610: cmd: \"Started HTTP listener at http://[::]:32777\"\n"}
+{"Time":"2023-03-29T13:37:33.610935322Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.610: cmd: \"                                   \"\n"}
+{"Time":"2023-03-29T13:37:33.610944309Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.610: cmd: \"View the Web UI: http://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.610972945Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.610: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.610991889Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.610: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.61104088Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:83: 2023-03-29 13:37:33.611: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:33.611050128Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.611: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:33.611098802Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:110: 2023-03-29 13:37:33.611: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:33.611114878Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:111: 2023-03-29 13:37:33.611: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:33.611120793Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:113: 2023-03-29 13:37:33.611: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:33.611180989Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.611: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.611193294Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.611: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:33.611200866Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.611: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.611204553Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.611: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:33.611207462Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.611: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.611215565Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"    ptytest.go:102: 2023-03-29 13:37:33.611: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:33.611336071Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Output":"--- PASS: TestServer/LocalAccessURL (0.71s)\n"}
+{"Time":"2023-03-29T13:37:33.613044416Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/LocalAccessURL","Elapsed":0.71}
+{"Time":"2023-03-29T13:37:33.613054355Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 1...\n"}
+{"Time":"2023-03-29T13:37:33.613144221Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 1\n"}
+{"Time":"2023-03-29T13:37:33.613176406Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    server_test.go:799: 2023-03-29 13:37:33.613: cmd: matched \"is deprecated\" = \"WARN: Address is deprecated\"\n"}
+{"Time":"2023-03-29T13:37:33.613666866Z","Action":"cont","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS"}
+{"Time":"2023-03-29T13:37:33.613682333Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"=== CONT  TestServer/DeprecatedAddress/TLS\n"}
+{"Time":"2023-03-29T13:37:33.614665673Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    clitest.go:67: invoking command: coder --global-config /tmp/TestServerDeprecatedAddressTLS1194868532/003 server --in-memory --address :0 --access-url https://example.com --tls-enable --tls-cert-file /tmp/TestServerDeprecatedAddressTLS1194868532/001/3357512070 --tls-key-file /tmp/TestServerDeprecatedAddressTLS1194868532/001/2886385591 --cache-dir /tmp/TestServerDeprecatedAddressTLS1194868532/002\n"}
+{"Time":"2023-03-29T13:37:33.614774341Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Shutting down provisioner daemon 2...\n"}
+{"Time":"2023-03-29T13:37:33.614835489Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Gracefully shut down provisioner daemon 2\n"}
+{"Time":"2023-03-29T13:37:33.614847064Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:33.615151651Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.251: cmd: \"Started HTTP listener at http://[::]:46789\"\n"}
+{"Time":"2023-03-29T13:37:33.615187666Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.615: cmd: \"WARN: The access URL  https://foobarbaz.mydomain  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\"\n"}
+{"Time":"2023-03-29T13:37:33.615200461Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.615: cmd: \"                                                                                                                                                                                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.615214043Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.615: cmd: \"                                           \"\n"}
+{"Time":"2023-03-29T13:37:33.615230151Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.615: cmd: \"View the Web UI: https://foobarbaz.mydomain\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.615243576Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.615: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.61525094Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.615: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.616015109Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:33.617106937Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:121: 2023-03-29 13:37:33.251: cmd: \"                                    \"\n"}
+{"Time":"2023-03-29T13:37:33.617129585Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:121: 2023-03-29 13:37:33.617: cmd: \"View the Web UI: https://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.617140564Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:121: 2023-03-29 13:37:33.617: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.617159456Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:121: 2023-03-29 13:37:33.617: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.617293213Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    server_test.go:219: 2023-03-29 13:37:33.617: cmd: matched \"this may cause unexpected problems when creating workspaces\" = \"Started HTTP listener at http://[::]:46789\\r\\nWARN: The access URL  https://foobarbaz.mydomain  could not be resolved, this may cause unexpected problems when creating workspaces\"\n"}
+{"Time":"2023-03-29T13:37:33.617419153Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    server_test.go:220: 2023-03-29 13:37:33.617: cmd: matched \"View the Web UI: https://foobarbaz.mydomain\" = \". Generate a unique *.try.coder.app URL by not specifying an access URL.\\r\\n                                                                                                                                                                                                      \\r\\r\\n                                           \\r\\nView the Web UI: https://foobarbaz.mydomain\"\n"}
+{"Time":"2023-03-29T13:37:33.617702539Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Output":"--- PASS: TestServer/Logging/Human (0.70s)\n"}
+{"Time":"2023-03-29T13:37:33.617717314Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Human","Elapsed":0.7}
+{"Time":"2023-03-29T13:37:33.617728397Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.346: cmd: \"                                   \"\n"}
+{"Time":"2023-03-29T13:37:33.617738582Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.617: cmd: \"View the Web UI: https://google.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.617745792Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.617: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.617755568Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.617: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.617776141Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    server_test.go:238: 2023-03-29 13:37:33.617: cmd: matched \"View the Web UI: https://google.com\" = \"Started HTTP listener at http://[::]:39671\\r\\n                                   \\r\\nView the Web UI: https://google.com\"\n"}
+{"Time":"2023-03-29T13:37:33.618700109Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:83: 2023-03-29 13:37:33.618: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:33.618717448Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.618: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:33.618729015Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:110: 2023-03-29 13:37:33.618: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:33.618738942Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:111: 2023-03-29 13:37:33.618: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:33.618748331Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:113: 2023-03-29 13:37:33.618: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:33.618809556Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.618: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.618823389Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.618: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:33.618833326Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.618: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.618840112Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.618: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:33.61884905Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.618: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.618860551Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"    ptytest.go:102: 2023-03-29 13:37:33.618: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:33.618993236Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Output":"--- PASS: TestServer/NoWarningWithRemoteAccessURL (0.72s)\n"}
+{"Time":"2023-03-29T13:37:33.620193889Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/NoWarningWithRemoteAccessURL","Elapsed":0.72}
+{"Time":"2023-03-29T13:37:33.620216262Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:33.620558208Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.620: cmd: \"Started TLS/HTTPS listener at https://[::]:40599\"\n"}
+{"Time":"2023-03-29T13:37:33.62057844Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.620: cmd: \"                                    \"\n"}
+{"Time":"2023-03-29T13:37:33.620586258Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.620: cmd: \"View the Web UI: https://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.620613734Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    server_test.go:641: 2023-03-29 13:37:33.620: cmd: matched \"Started TLS/HTTPS listener at\" = \"Started TLS/HTTPS listener at\"\n"}
+{"Time":"2023-03-29T13:37:33.620652863Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    server_test.go:642: 2023-03-29 13:37:33.620: cmd: ReadLine ctx has no deadline, using 10s\n"}
+{"Time":"2023-03-29T13:37:33.620669386Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    server_test.go:642: 2023-03-29 13:37:33.620: cmd: matched newline = \" https://[::]:40599\"\n"}
+{"Time":"2023-03-29T13:37:33.623941782Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:33.634109465Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.634: cmd: \"Started HTTP listener at http://[::]:44615\"\n"}
+{"Time":"2023-03-29T13:37:33.6341392Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    server_test.go:634: 2023-03-29 13:37:33.634: cmd: matched \"Started HTTP listener at\" = \"Started HTTP listener at\"\n"}
+{"Time":"2023-03-29T13:37:33.634159059Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    server_test.go:635: 2023-03-29 13:37:33.634: cmd: ReadLine ctx has no deadline, using 10s\n"}
+{"Time":"2023-03-29T13:37:33.634168084Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    server_test.go:635: 2023-03-29 13:37:33.634: cmd: matched newline = \" http://[::]:44615\"\n"}
+{"Time":"2023-03-29T13:37:33.639592274Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.639: cmd: \"WARN: Address is deprecated, please use HTTP Address and TLS Address instead.\"\n"}
+{"Time":"2023-03-29T13:37:33.639622715Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.639: cmd: \"                                                                       \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.639633384Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.639: cmd: \"Started TLS/HTTPS listener at https://[::]:44869\"\n"}
+{"Time":"2023-03-29T13:37:33.642427153Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.642: cmd: \"Started TLS/HTTPS listener at https://[::]:43889\"\n"}
+{"Time":"2023-03-29T13:37:33.642448651Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.642: cmd: \"                                    \"\n"}
+{"Time":"2023-03-29T13:37:33.642456925Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.642: cmd: \"View the Web UI: https://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.642468331Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    server_test.go:641: 2023-03-29 13:37:33.642: cmd: matched \"Started TLS/HTTPS listener at\" = \"Started TLS/HTTPS listener at\"\n"}
+{"Time":"2023-03-29T13:37:33.642477804Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    server_test.go:642: 2023-03-29 13:37:33.642: cmd: ReadLine ctx has no deadline, using 10s\n"}
+{"Time":"2023-03-29T13:37:33.642487898Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    server_test.go:642: 2023-03-29 13:37:33.642: cmd: matched newline = \" https://[::]:43889\"\n"}
+{"Time":"2023-03-29T13:37:33.646526946Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:33.646: cmd: \"Started HTTP listener at http://[::]:33323\"\n"}
+{"Time":"2023-03-29T13:37:33.646552176Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:33.646: cmd: \"Started TLS/HTTPS listener at https://[::]:36951\"\n"}
+{"Time":"2023-03-29T13:37:33.64656429Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:33.646: cmd: \"                                    \"\n"}
+{"Time":"2023-03-29T13:37:33.646572476Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:33.646: cmd: \"View the Web UI: https://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.646580011Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    server_test.go:634: 2023-03-29 13:37:33.646: cmd: matched \"Started HTTP listener at\" = \"Started HTTP listener at\"\n"}
+{"Time":"2023-03-29T13:37:33.646591361Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    server_test.go:635: 2023-03-29 13:37:33.646: cmd: ReadLine ctx has no deadline, using 10s\n"}
+{"Time":"2023-03-29T13:37:33.646616475Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    server_test.go:635: 2023-03-29 13:37:33.646: cmd: matched newline = \" http://[::]:33323\"\n"}
+{"Time":"2023-03-29T13:37:33.646662584Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    server_test.go:641: 2023-03-29 13:37:33.646: cmd: matched \"Started TLS/HTTPS listener at\" = \"Started TLS/HTTPS listener at\"\n"}
+{"Time":"2023-03-29T13:37:33.646681881Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    server_test.go:642: 2023-03-29 13:37:33.646: cmd: ReadLine ctx has no deadline, using 10s\n"}
+{"Time":"2023-03-29T13:37:33.646699362Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    server_test.go:642: 2023-03-29 13:37:33.646: cmd: matched newline = \" https://[::]:36951\"\n"}
+{"Time":"2023-03-29T13:37:33.648933788Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP coderd_api_active_users_duration_hour The number of users that have been active within the last hour.\n"}
+{"Time":"2023-03-29T13:37:33.648967031Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE coderd_api_active_users_duration_hour gauge\n"}
+{"Time":"2023-03-29T13:37:33.648980231Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP coderd_api_concurrent_requests The number of concurrent API requests.\n"}
+{"Time":"2023-03-29T13:37:33.649053919Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE coderd_api_concurrent_requests gauge\n"}
+{"Time":"2023-03-29T13:37:33.649069592Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_api_concurrent_requests 0\n"}
+{"Time":"2023-03-29T13:37:33.649078578Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP coderd_api_concurrent_websockets The total number of concurrent API websockets.\n"}
+{"Time":"2023-03-29T13:37:33.64908451Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE coderd_api_concurrent_websockets gauge\n"}
+{"Time":"2023-03-29T13:37:33.64908947Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_api_concurrent_websockets 0\n"}
+{"Time":"2023-03-29T13:37:33.649096688Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP coderd_api_workspace_latest_build_total The latest workspace builds with a status.\n"}
+{"Time":"2023-03-29T13:37:33.649103792Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE coderd_api_workspace_latest_build_total gauge\n"}
+{"Time":"2023-03-29T13:37:33.649110998Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP coderd_authz_authorize_duration_seconds Duration of the 'Authorize' call in seconds. Only counts calls that succeed.\n"}
+{"Time":"2023-03-29T13:37:33.649125082Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE coderd_authz_authorize_duration_seconds histogram\n"}
+{"Time":"2023-03-29T13:37:33.649136372Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.0005\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649158836Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.001\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649167411Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.002\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649174438Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.003\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649184378Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.005\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649205265Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.01\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649213251Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.02\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649222908Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.035\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649235415Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.05\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649253778Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.075\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649261752Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.1\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649271274Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.25\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649292314Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"0.75\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649300333Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"1\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649310057Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_bucket{allowed=\"true\",le=\"+Inf\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649320729Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_sum{allowed=\"true\"} 0.002876051\n"}
+{"Time":"2023-03-29T13:37:33.649345041Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_authorize_duration_seconds_count{allowed=\"true\"} 2\n"}
+{"Time":"2023-03-29T13:37:33.649356377Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP coderd_authz_prepare_authorize_duration_seconds Duration of the 'PrepareAuthorize' call in seconds.\n"}
+{"Time":"2023-03-29T13:37:33.649363746Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE coderd_authz_prepare_authorize_duration_seconds histogram\n"}
+{"Time":"2023-03-29T13:37:33.649370497Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.0005\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649391953Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.001\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649399779Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.002\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649410888Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.003\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649428841Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.005\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649438526Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.01\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649445746Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.02\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.64947999Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.035\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649486523Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.05\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649643599Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.075\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649652811Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.1\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649659776Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.25\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649677202Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"0.75\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.649684812Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"1\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.64970109Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_bucket{le=\"+Inf\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.64971819Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_sum 0\n"}
+{"Time":"2023-03-29T13:37:33.649725513Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned coderd_authz_prepare_authorize_duration_seconds_count 0\n"}
+{"Time":"2023-03-29T13:37:33.649741363Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_gc_duration_seconds A summary of the pause duration of garbage collection cycles.\n"}
+{"Time":"2023-03-29T13:37:33.649751815Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_gc_duration_seconds summary\n"}
+{"Time":"2023-03-29T13:37:33.649770366Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds{quantile=\"0\"} 1.6651e-05\n"}
+{"Time":"2023-03-29T13:37:33.649779436Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds{quantile=\"0.25\"} 3.0073e-05\n"}
+{"Time":"2023-03-29T13:37:33.649795479Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds{quantile=\"0.5\"} 3.3851e-05\n"}
+{"Time":"2023-03-29T13:37:33.649803042Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds{quantile=\"0.75\"} 5.0874e-05\n"}
+{"Time":"2023-03-29T13:37:33.649822842Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds{quantile=\"1\"} 0.000164674\n"}
+{"Time":"2023-03-29T13:37:33.649830516Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds_sum 0.000461803\n"}
+{"Time":"2023-03-29T13:37:33.64984149Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_gc_duration_seconds_count 9\n"}
+{"Time":"2023-03-29T13:37:33.649859074Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_goroutines Number of goroutines that currently exist.\n"}
+{"Time":"2023-03-29T13:37:33.649876364Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_goroutines gauge\n"}
+{"Time":"2023-03-29T13:37:33.649883909Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_goroutines 400\n"}
+{"Time":"2023-03-29T13:37:33.649893852Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_info Information about the Go environment.\n"}
+{"Time":"2023-03-29T13:37:33.649915539Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_info gauge\n"}
+{"Time":"2023-03-29T13:37:33.649923065Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_info{version=\"go1.20\"} 1\n"}
+{"Time":"2023-03-29T13:37:33.649934513Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_alloc_bytes Number of bytes allocated and still in use.\n"}
+{"Time":"2023-03-29T13:37:33.64994537Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_alloc_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.649964236Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_alloc_bytes 4.4139992e+07\n"}
+{"Time":"2023-03-29T13:37:33.649974501Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_alloc_bytes_total Total number of bytes allocated, even if freed.\n"}
+{"Time":"2023-03-29T13:37:33.649985399Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_alloc_bytes_total counter\n"}
+{"Time":"2023-03-29T13:37:33.650002195Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_alloc_bytes_total 1.07033304e+08\n"}
+{"Time":"2023-03-29T13:37:33.650019066Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_buck_hash_sys_bytes Number of bytes used by the profiling bucket hash table.\n"}
+{"Time":"2023-03-29T13:37:33.650026662Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_buck_hash_sys_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650037208Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_buck_hash_sys_bytes 1.487772e+06\n"}
+{"Time":"2023-03-29T13:37:33.650056379Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_frees_total Total number of frees.\n"}
+{"Time":"2023-03-29T13:37:33.650063678Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_frees_total counter\n"}
+{"Time":"2023-03-29T13:37:33.650079718Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_frees_total 341416\n"}
+{"Time":"2023-03-29T13:37:33.650087192Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_gc_sys_bytes Number of bytes used for garbage collection system metadata.\n"}
+{"Time":"2023-03-29T13:37:33.65010648Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_gc_sys_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650113893Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_gc_sys_bytes 9.376592e+06\n"}
+{"Time":"2023-03-29T13:37:33.650132561Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_heap_alloc_bytes Number of heap bytes allocated and still in use.\n"}
+{"Time":"2023-03-29T13:37:33.650140278Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_heap_alloc_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650152649Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_heap_alloc_bytes 4.4139992e+07\n"}
+{"Time":"2023-03-29T13:37:33.650314526Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_heap_idle_bytes Number of heap bytes waiting to be used.\n"}
+{"Time":"2023-03-29T13:37:33.650323426Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_heap_idle_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650332952Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_heap_idle_bytes 4.481024e+06\n"}
+{"Time":"2023-03-29T13:37:33.65035073Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_heap_inuse_bytes Number of heap bytes that are in use.\n"}
+{"Time":"2023-03-29T13:37:33.650358078Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_heap_inuse_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650374519Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_heap_inuse_bytes 4.6473216e+07\n"}
+{"Time":"2023-03-29T13:37:33.650392405Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_heap_objects Number of allocated objects.\n"}
+{"Time":"2023-03-29T13:37:33.650400167Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_heap_objects gauge\n"}
+{"Time":"2023-03-29T13:37:33.650411Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_heap_objects 198877\n"}
+{"Time":"2023-03-29T13:37:33.650427198Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_heap_released_bytes Number of heap bytes released to OS.\n"}
+{"Time":"2023-03-29T13:37:33.650443875Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_heap_released_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.6504512Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_heap_released_bytes 172032\n"}
+{"Time":"2023-03-29T13:37:33.650466769Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_heap_sys_bytes Number of heap bytes obtained from system.\n"}
+{"Time":"2023-03-29T13:37:33.650476593Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_heap_sys_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650493555Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_heap_sys_bytes 5.095424e+07\n"}
+{"Time":"2023-03-29T13:37:33.650501064Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_last_gc_time_seconds Number of seconds since 1970 of last garbage collection.\n"}
+{"Time":"2023-03-29T13:37:33.650517983Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_last_gc_time_seconds gauge\n"}
+{"Time":"2023-03-29T13:37:33.650530998Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_last_gc_time_seconds 1.680097053302355e+09\n"}
+{"Time":"2023-03-29T13:37:33.65054228Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_lookups_total Total number of pointer lookups.\n"}
+{"Time":"2023-03-29T13:37:33.650552934Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_lookups_total counter\n"}
+{"Time":"2023-03-29T13:37:33.650563901Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_lookups_total 0\n"}
+{"Time":"2023-03-29T13:37:33.650584173Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_mallocs_total Total number of mallocs.\n"}
+{"Time":"2023-03-29T13:37:33.650591833Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_mallocs_total counter\n"}
+{"Time":"2023-03-29T13:37:33.650607986Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_mallocs_total 540293\n"}
+{"Time":"2023-03-29T13:37:33.650615529Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_mcache_inuse_bytes Number of bytes in use by mcache structures.\n"}
+{"Time":"2023-03-29T13:37:33.650641182Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_mcache_inuse_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650649185Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_mcache_inuse_bytes 1200\n"}
+{"Time":"2023-03-29T13:37:33.650655792Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_mcache_sys_bytes Number of bytes used for mcache structures obtained from system.\n"}
+{"Time":"2023-03-29T13:37:33.650675584Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_mcache_sys_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650682964Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_mcache_sys_bytes 15600\n"}
+{"Time":"2023-03-29T13:37:33.650699492Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_mspan_inuse_bytes Number of bytes in use by mspan structures.\n"}
+{"Time":"2023-03-29T13:37:33.65070695Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_mspan_inuse_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650725284Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_mspan_inuse_bytes 415680\n"}
+{"Time":"2023-03-29T13:37:33.650732919Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_mspan_sys_bytes Number of bytes used for mspan structures obtained from system.\n"}
+{"Time":"2023-03-29T13:37:33.650742233Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_mspan_sys_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650753796Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_mspan_sys_bytes 440640\n"}
+{"Time":"2023-03-29T13:37:33.650773086Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_next_gc_bytes Number of heap bytes when next garbage collection will take place.\n"}
+{"Time":"2023-03-29T13:37:33.650780844Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_next_gc_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650791619Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_next_gc_bytes 5.744056e+07\n"}
+{"Time":"2023-03-29T13:37:33.650939729Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_other_sys_bytes Number of bytes used for other system allocations.\n"}
+{"Time":"2023-03-29T13:37:33.650948462Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_other_sys_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650960125Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_other_sys_bytes 407532\n"}
+{"Time":"2023-03-29T13:37:33.65097098Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_stack_inuse_bytes Number of bytes in use by the stack allocator.\n"}
+{"Time":"2023-03-29T13:37:33.650989112Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_stack_inuse_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.650999328Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_stack_inuse_bytes 3.506176e+06\n"}
+{"Time":"2023-03-29T13:37:33.651015975Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_stack_sys_bytes Number of bytes obtained from system for stack allocator.\n"}
+{"Time":"2023-03-29T13:37:33.651023745Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_stack_sys_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.651042622Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_stack_sys_bytes 3.506176e+06\n"}
+{"Time":"2023-03-29T13:37:33.651050141Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_memstats_sys_bytes Number of bytes obtained from system.\n"}
+{"Time":"2023-03-29T13:37:33.651066559Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_memstats_sys_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.65107676Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_memstats_sys_bytes 6.6188552e+07\n"}
+{"Time":"2023-03-29T13:37:33.651096334Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP go_threads Number of OS threads created.\n"}
+{"Time":"2023-03-29T13:37:33.651104041Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE go_threads gauge\n"}
+{"Time":"2023-03-29T13:37:33.651114838Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned go_threads 11\n"}
+{"Time":"2023-03-29T13:37:33.651133818Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_cpu_seconds_total Total user and system CPU time spent in seconds.\n"}
+{"Time":"2023-03-29T13:37:33.651141836Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_cpu_seconds_total counter\n"}
+{"Time":"2023-03-29T13:37:33.651152615Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_cpu_seconds_total 0.47\n"}
+{"Time":"2023-03-29T13:37:33.651169215Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_max_fds Maximum number of open file descriptors.\n"}
+{"Time":"2023-03-29T13:37:33.651188139Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_max_fds gauge\n"}
+{"Time":"2023-03-29T13:37:33.651196288Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_max_fds 1.048576e+06\n"}
+{"Time":"2023-03-29T13:37:33.651207299Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_open_fds Number of open file descriptors.\n"}
+{"Time":"2023-03-29T13:37:33.651218057Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_open_fds gauge\n"}
+{"Time":"2023-03-29T13:37:33.651236861Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_open_fds 144\n"}
+{"Time":"2023-03-29T13:37:33.651248494Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_resident_memory_bytes Resident memory size in bytes.\n"}
+{"Time":"2023-03-29T13:37:33.651257364Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_resident_memory_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.651280196Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_resident_memory_bytes 1.14364416e+08\n"}
+{"Time":"2023-03-29T13:37:33.65128834Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_start_time_seconds Start time of the process since unix epoch in seconds.\n"}
+{"Time":"2023-03-29T13:37:33.651296824Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_start_time_seconds gauge\n"}
+{"Time":"2023-03-29T13:37:33.651307674Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_start_time_seconds 1.68009705209e+09\n"}
+{"Time":"2023-03-29T13:37:33.651326547Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_virtual_memory_bytes Virtual memory size in bytes.\n"}
+{"Time":"2023-03-29T13:37:33.651334348Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_virtual_memory_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.651345305Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_virtual_memory_bytes 1.4835712e+09\n"}
+{"Time":"2023-03-29T13:37:33.651361504Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP process_virtual_memory_max_bytes Maximum amount of virtual memory available in bytes.\n"}
+{"Time":"2023-03-29T13:37:33.651378854Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE process_virtual_memory_max_bytes gauge\n"}
+{"Time":"2023-03-29T13:37:33.651386339Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned process_virtual_memory_max_bytes 1.8446744073709552e+19\n"}
+{"Time":"2023-03-29T13:37:33.651397458Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP promhttp_metric_handler_requests_in_flight Current number of scrapes being served.\n"}
+{"Time":"2023-03-29T13:37:33.65149956Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE promhttp_metric_handler_requests_in_flight gauge\n"}
+{"Time":"2023-03-29T13:37:33.65150712Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned promhttp_metric_handler_requests_in_flight 1\n"}
+{"Time":"2023-03-29T13:37:33.651512875Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # HELP promhttp_metric_handler_requests_total Total number of scrapes by HTTP status code.\n"}
+{"Time":"2023-03-29T13:37:33.651517405Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned # TYPE promhttp_metric_handler_requests_total counter\n"}
+{"Time":"2023-03-29T13:37:33.651608377Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned promhttp_metric_handler_requests_total{code=\"200\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.651617771Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned promhttp_metric_handler_requests_total{code=\"500\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.651624722Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    server_test.go:981: scanned promhttp_metric_handler_requests_total{code=\"503\"} 0\n"}
+{"Time":"2023-03-29T13:37:33.653302095Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:33.687811194Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.687: cmd: \"                                    \"\n"}
+{"Time":"2023-03-29T13:37:33.68784324Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.687: cmd: \"View the Web UI: https://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.687847743Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.687: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.687859388Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.687: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.69314768Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    server_test.go:829: 2023-03-29 13:37:33.690: cmd: matched \"is deprecated\" = \"WARN: Address is deprecated\"\n"}
+{"Time":"2023-03-29T13:37:33.699837388Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:33.700125946Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:33.700416667Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:33.701833349Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Output":"--- PASS: TestServer/RateLimit/Default (0.85s)\n"}
+{"Time":"2023-03-29T13:37:33.792395824Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Default","Elapsed":0.85}
+{"Time":"2023-03-29T13:37:33.792432021Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:33.792443805Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:33.796165422Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:83: 2023-03-29 13:37:33.795: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:33.796198633Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.796: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:33.797173408Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:33.797427041Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:33.79757722Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:33.797913033Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:33.797928952Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:33.803483718Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:33.803533703Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:33.803541349Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:33.803549183Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.80355496Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:33.803560722Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.803565907Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:33.803571719Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.803577128Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:33.803582995Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:121: 2023-03-29 13:37:33.799: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.803588238Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:110: 2023-03-29 13:37:33.799: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:33.803593211Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:111: 2023-03-29 13:37:33.799: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:33.803598107Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:113: 2023-03-29 13:37:33.799: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:33.807382663Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.807: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.807425699Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:33.807: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.812449918Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:33.812: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.812479278Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:33.812: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.81249279Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.812: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.812540743Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.812: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.81937956Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.819: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.819501503Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.819: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:33.819519256Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.819: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.819527309Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:74: 2023-03-29 13:37:33.819: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:33.819534022Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:76: 2023-03-29 13:37:33.819: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:33.819605916Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"    ptytest.go:102: 2023-03-29 13:37:33.819: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:33.819682321Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Output":"--- PASS: TestServer/RemoteAccessURL (0.92s)\n"}
+{"Time":"2023-03-29T13:37:33.819757496Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RemoteAccessURL","Elapsed":0.92}
+{"Time":"2023-03-29T13:37:33.819772079Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.819: cmd: \"                                    \"\n"}
+{"Time":"2023-03-29T13:37:33.819781749Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.819: cmd: \"View the Web UI: https://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.819797518Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.819: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:33.819813792Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:33.819: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:33.851914311Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:33.85194979Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:33.852148613Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Output":"--- PASS: TestServer/Prometheus (1.00s)\n"}
+{"Time":"2023-03-29T13:37:33.855235903Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Prometheus","Elapsed":1}
+{"Time":"2023-03-29T13:37:33.855263447Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:33.855284404Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:33.855351311Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:33.85648797Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Output":"--- PASS: TestServer/GitHubOAuth (1.01s)\n"}
+{"Time":"2023-03-29T13:37:33.898898347Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/GitHubOAuth","Elapsed":1.01}
+{"Time":"2023-03-29T13:37:33.898943644Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:33.898966965Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:33.899910542Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:33.899951915Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:33.899979591Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:33.931576217Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:33.931632315Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:33.932359012Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Output":"--- PASS: TestServer/RateLimit/Disabled (1.02s)\n"}
+{"Time":"2023-03-29T13:37:33.932605839Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Disabled","Elapsed":1.02}
+{"Time":"2023-03-29T13:37:33.932638521Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:33.944423479Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.944: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:33.944456273Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.944: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:33.944471028Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.944: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.944486505Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.944: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:33.944506728Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.944: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.948894392Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:33.949085454Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Output":"--- PASS: TestServer/Telemetry (1.09s)\n"}
+{"Time":"2023-03-29T13:37:33.973592223Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Telemetry","Elapsed":1.09}
+{"Time":"2023-03-29T13:37:33.973627583Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:33.982109361Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Output":"--- PASS: TestServer/TLSValid (1.09s)\n"}
+{"Time":"2023-03-29T13:37:33.982145968Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValid","Elapsed":1.09}
+{"Time":"2023-03-29T13:37:33.982166462Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:83: 2023-03-29 13:37:33.982: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:33.982185903Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:74: 2023-03-29 13:37:33.982: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:33.983908041Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.983: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:33.983932298Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.983: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.983950164Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.983: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:33.983971383Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:33.983: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.983987252Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:110: 2023-03-29 13:37:33.983: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:33.984001811Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:111: 2023-03-29 13:37:33.983: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:33.984029981Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:113: 2023-03-29 13:37:33.983: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:33.999767444Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.999: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:33.999792066Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.999: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:33.999806103Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.999: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:33.999825199Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.999: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:33.999838052Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:33.999: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.000132942Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:34.000152725Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:34.013522575Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:76: 2023-03-29 13:37:34.013: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.013539719Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:74: 2023-03-29 13:37:34.013: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:34.013545396Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:76: 2023-03-29 13:37:34.013: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.013549166Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:74: 2023-03-29 13:37:34.013: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:34.013552799Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:76: 2023-03-29 13:37:34.013: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.013557098Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"    ptytest.go:102: 2023-03-29 13:37:34.013: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:34.013685528Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Output":"--- PASS: TestServer/DeprecatedAddress/HTTP (1.01s)\n"}
+{"Time":"2023-03-29T13:37:34.024907745Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/HTTP","Elapsed":1.01}
+{"Time":"2023-03-29T13:37:34.024925201Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:83: 2023-03-29 13:37:34.024: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:34.024929754Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:74: 2023-03-29 13:37:34.024: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:34.037436741Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:34.046649783Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:34.046: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:34.04666228Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:34.046: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.046671065Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:34.046: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:34.046674499Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:121: 2023-03-29 13:37:34.046: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.046678741Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:110: 2023-03-29 13:37:34.046: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.046682976Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:111: 2023-03-29 13:37:34.046: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:34.046687631Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:113: 2023-03-29 13:37:34.046: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.048234545Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:34.048465929Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:76: 2023-03-29 13:37:34.048: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.048473751Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:74: 2023-03-29 13:37:34.048: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:34.04848652Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:76: 2023-03-29 13:37:34.048: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.048494431Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:74: 2023-03-29 13:37:34.048: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:34.0485018Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:76: 2023-03-29 13:37:34.048: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.048515549Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"    ptytest.go:102: 2023-03-29 13:37:34.048: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:34.048685756Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Output":"--- PASS: TestServer/TLSRedirect/NoRedirectWithWildcard (0.47s)\n"}
+{"Time":"2023-03-29T13:37:34.049232577Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirectWithWildcard","Elapsed":0.47}
+{"Time":"2023-03-29T13:37:34.049241005Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:34.049926527Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Output":"--- PASS: TestServer/RateLimit/Changed (1.07s)\n"}
+{"Time":"2023-03-29T13:37:34.049934686Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit/Changed","Elapsed":1.07}
+{"Time":"2023-03-29T13:37:34.049940803Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit","Output":"--- PASS: TestServer/RateLimit (0.00s)\n"}
+{"Time":"2023-03-29T13:37:34.050192839Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/RateLimit","Elapsed":0}
+{"Time":"2023-03-29T13:37:34.05020025Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:83: 2023-03-29 13:37:34.050: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:34.050204931Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:74: 2023-03-29 13:37:34.050: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:34.050237731Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:83: 2023-03-29 13:37:34.050: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:34.050243867Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:74: 2023-03-29 13:37:34.050: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:34.05027121Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:83: 2023-03-29 13:37:34.050: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:34.050278957Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:74: 2023-03-29 13:37:34.050: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:34.051736931Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:34.05174611Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:34.051751453Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.051758881Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:34.051780431Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.05178826Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:34.051870799Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.051881957Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:34.051887542Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.05189248Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:110: 2023-03-29 13:37:34.051: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.05189708Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:111: 2023-03-29 13:37:34.051: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:34.05190198Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:113: 2023-03-29 13:37:34.051: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.051911515Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:34.051922383Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:34.051927984Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.051938866Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:34.051946554Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.051962503Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:34.051971415Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.0519782Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:34.051987362Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.051: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.052007059Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:110: 2023-03-29 13:37:34.051: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.052015346Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:111: 2023-03-29 13:37:34.052: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:34.052021784Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:113: 2023-03-29 13:37:34.052: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.052400141Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:34.052410137Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:34.052420866Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.052427625Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:34.052440372Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.052448298Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:34.052457892Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.052465595Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:34.052483713Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:121: 2023-03-29 13:37:34.052: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.052491345Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:110: 2023-03-29 13:37:34.052: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.052498064Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:111: 2023-03-29 13:37:34.052: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:34.052506921Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:113: 2023-03-29 13:37:34.052: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.078632301Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:76: 2023-03-29 13:37:34.078: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.07865445Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:74: 2023-03-29 13:37:34.078: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:34.078658395Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:76: 2023-03-29 13:37:34.078: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.078664194Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:74: 2023-03-29 13:37:34.078: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:34.078667573Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:76: 2023-03-29 13:37:34.078: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.078670569Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"    ptytest.go:102: 2023-03-29 13:37:34.078: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:34.078838607Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Output":"--- PASS: TestServer/TLSRedirect/OK (1.06s)\n"}
+{"Time":"2023-03-29T13:37:34.078885902Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/OK","Elapsed":1.06}
+{"Time":"2023-03-29T13:37:34.078892321Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:76: 2023-03-29 13:37:34.078: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.078897167Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:74: 2023-03-29 13:37:34.078: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:34.078901364Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:76: 2023-03-29 13:37:34.078: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.078912845Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:74: 2023-03-29 13:37:34.078: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:34.078917725Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:76: 2023-03-29 13:37:34.078: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.07894293Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"    ptytest.go:102: 2023-03-29 13:37:34.078: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:34.079092731Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Output":"--- PASS: TestServer/TLSRedirect/NoHTTPListener (0.62s)\n"}
+{"Time":"2023-03-29T13:37:34.079144047Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoHTTPListener","Elapsed":0.62}
+{"Time":"2023-03-29T13:37:34.079152217Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:76: 2023-03-29 13:37:34.079: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.079158662Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:74: 2023-03-29 13:37:34.079: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:34.079162915Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:76: 2023-03-29 13:37:34.079: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.079168988Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:74: 2023-03-29 13:37:34.079: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:34.079178829Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:76: 2023-03-29 13:37:34.079: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.079196269Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"    ptytest.go:102: 2023-03-29 13:37:34.079: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:34.079336643Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Output":"--- PASS: TestServer/TLSRedirect/NoTLSListener (0.59s)\n"}
+{"Time":"2023-03-29T13:37:34.091089368Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoTLSListener","Elapsed":0.59}
+{"Time":"2023-03-29T13:37:34.091112345Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:83: 2023-03-29 13:37:34.091: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:34.091119428Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:74: 2023-03-29 13:37:34.091: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:34.115772917Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:34.115801947Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:34.11581297Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.115819506Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:34.115824758Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.115830066Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:34.11583724Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.115844144Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:34.115860103Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.115888103Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:110: 2023-03-29 13:37:34.115: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.115903904Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:111: 2023-03-29 13:37:34.115: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:34.115919206Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:113: 2023-03-29 13:37:34.115: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.115976431Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:34.115986313Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:34.115997881Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.11602101Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:34.115: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:34.116029108Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:121: 2023-03-29 13:37:34.116: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.116476692Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:76: 2023-03-29 13:37:34.116: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.116491796Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:74: 2023-03-29 13:37:34.116: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:34.116497774Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:76: 2023-03-29 13:37:34.116: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.116504918Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:74: 2023-03-29 13:37:34.116: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:34.1165175Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:76: 2023-03-29 13:37:34.116: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.116539123Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"    ptytest.go:102: 2023-03-29 13:37:34.116: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:34.116717402Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Output":"--- PASS: TestServer/TLSAndHTTP (1.24s)\n"}
+{"Time":"2023-03-29T13:37:34.117404728Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSAndHTTP","Elapsed":1.24}
+{"Time":"2023-03-29T13:37:34.117418357Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:83: 2023-03-29 13:37:34.117: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:34.117441857Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:74: 2023-03-29 13:37:34.117: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:34.117475322Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:110: 2023-03-29 13:37:34.117: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.117484444Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:111: 2023-03-29 13:37:34.117: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:34.117494423Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:113: 2023-03-29 13:37:34.117: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.11754208Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:76: 2023-03-29 13:37:34.117: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.117551844Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:74: 2023-03-29 13:37:34.117: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:34.117570608Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:76: 2023-03-29 13:37:34.117: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.117578465Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:74: 2023-03-29 13:37:34.117: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:34.117597311Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:76: 2023-03-29 13:37:34.117: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.117616074Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"    ptytest.go:102: 2023-03-29 13:37:34.117: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:34.11776518Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Output":"--- PASS: TestServer/DeprecatedAddress/TLS (0.50s)\n"}
+{"Time":"2023-03-29T13:37:34.117776019Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress/TLS","Elapsed":0.5}
+{"Time":"2023-03-29T13:37:34.117782763Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress","Output":"--- PASS: TestServer/DeprecatedAddress (0.06s)\n"}
+{"Time":"2023-03-29T13:37:34.117841805Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/DeprecatedAddress","Elapsed":0.06}
+{"Time":"2023-03-29T13:37:34.117849931Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:83: 2023-03-29 13:37:34.117: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:34.117859828Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:74: 2023-03-29 13:37:34.117: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:34.118127485Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:83: 2023-03-29 13:37:34.118: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:34.118138813Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:74: 2023-03-29 13:37:34.118: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:34.118170526Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:110: 2023-03-29 13:37:34.118: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.11817918Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:111: 2023-03-29 13:37:34.118: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:34.118194579Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:113: 2023-03-29 13:37:34.118: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.11825734Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:76: 2023-03-29 13:37:34.118: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.118277979Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:74: 2023-03-29 13:37:34.118: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:34.118286381Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:76: 2023-03-29 13:37:34.118: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.118291513Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:74: 2023-03-29 13:37:34.118: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:34.118295899Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:76: 2023-03-29 13:37:34.118: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.11830286Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"    ptytest.go:102: 2023-03-29 13:37:34.118: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:34.118448813Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Output":"--- PASS: TestServer/TLSValidMultiple (1.23s)\n"}
+{"Time":"2023-03-29T13:37:34.118485143Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSValidMultiple","Elapsed":1.23}
+{"Time":"2023-03-29T13:37:34.118492964Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:34.118500337Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:34.118505085Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.118511668Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:34.118536832Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.118542137Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:34.118548654Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.118562305Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:34.118568736Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:121: 2023-03-29 13:37:34.118: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:34.1185733Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:110: 2023-03-29 13:37:34.118: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.118577677Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:111: 2023-03-29 13:37:34.118: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:34.118583972Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:113: 2023-03-29 13:37:34.118: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:34.347394026Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:76: 2023-03-29 13:37:34.347: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.347481519Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:74: 2023-03-29 13:37:34.347: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:34.347503045Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:76: 2023-03-29 13:37:34.347: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.347521875Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:74: 2023-03-29 13:37:34.347: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:34.347538956Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:76: 2023-03-29 13:37:34.347: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:34.347563965Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"    ptytest.go:102: 2023-03-29 13:37:34.347: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:34.347597239Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Output":"--- PASS: TestServer/TLSRedirect/NoRedirect (0.77s)\n"}
+{"Time":"2023-03-29T13:37:34.347618369Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect/NoRedirect","Elapsed":0.77}
+{"Time":"2023-03-29T13:37:34.347639094Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect","Output":"--- PASS: TestServer/TLSRedirect (0.05s)\n"}
+{"Time":"2023-03-29T13:37:37.495996215Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/TLSRedirect","Elapsed":0.05}
+{"Time":"2023-03-29T13:37:37.496041088Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Started HTTP listener at http://[::]:42403\n"}
+{"Time":"2023-03-29T13:37:37.497561163Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: View the Web UI: http://example.com\n"}
+{"Time":"2023-03-29T13:37:37.854158017Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: ==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\n"}
+{"Time":"2023-03-29T13:37:37.871207973Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: \u001b[1mInterrupt caught, gracefully exiting. Use ctrl+\\ to force quit\u001b[0m\n"}
+{"Time":"2023-03-29T13:37:37.871239014Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Shutting down API server...\n"}
+{"Time":"2023-03-29T13:37:37.871296925Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Gracefully shut down API server\n"}
+{"Time":"2023-03-29T13:37:37.871384307Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Waiting for WebSocket connections to close...\n"}
+{"Time":"2023-03-29T13:37:37.871872118Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Done waiting for WebSocket connections\n"}
+{"Time":"2023-03-29T13:37:37.872659674Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Stopping built-in PostgreSQL...\n"}
+{"Time":"2023-03-29T13:37:37.974547475Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"    clitest.go:50: stdout: Stopped built-in PostgreSQL\n"}
+{"Time":"2023-03-29T13:37:38.01812179Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Output":"--- PASS: TestServer/BuiltinPostgres (5.17s)\n"}
+{"Time":"2023-03-29T13:37:46.072262917Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/BuiltinPostgres","Elapsed":5.17}
+{"Time":"2023-03-29T13:37:46.072311252Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.072: cmd: \"Started HTTP listener at http://[::]:35645\"\n"}
+{"Time":"2023-03-29T13:37:46.072335279Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.072: cmd: \"WARN: The access URL  http://example.com  could not be resolved, this may cause unexpected problems when creating workspaces. Generate a unique *.try.coder.app URL by not specifying an access URL.\"\n"}
+{"Time":"2023-03-29T13:37:46.07241558Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.072: cmd: \"                                                                                                                                                                                              \\r\"\n"}
+{"Time":"2023-03-29T13:37:46.072459905Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.072: cmd: \"                                   \"\n"}
+{"Time":"2023-03-29T13:37:46.07251014Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.072: cmd: \"View the Web UI: http://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:46.072679873Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    server_test.go:1240: 2023-03-29 13:37:46.072: cmd: matched \"Started HTTP listener at\" = \"Started HTTP listener at\"\n"}
+{"Time":"2023-03-29T13:37:46.078543671Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:46.078573522Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:46.07859364Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:46.07861453Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"ERROR: Unexpected error, shutting down server: context deadline exceeded\"\n"}
+{"Time":"2023-03-29T13:37:46.078631014Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                                                 \\r\"\n"}
+{"Time":"2023-03-29T13:37:46.078647037Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:46.078658003Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:46.078668373Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:46.078678662Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:46.078702364Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Shutting down provisioner daemon 3...\"\n"}
+{"Time":"2023-03-29T13:37:46.078719655Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                     \\r\"\n"}
+{"Time":"2023-03-29T13:37:46.078730465Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Gracefully shut down provisioner daemon 3\"\n"}
+{"Time":"2023-03-29T13:37:46.078744589Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                         \\r\"\n"}
+{"Time":"2023-03-29T13:37:46.078763734Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Shutting down provisioner daemon 1...\"\n"}
+{"Time":"2023-03-29T13:37:46.07878276Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                     \\r\"\n"}
+{"Time":"2023-03-29T13:37:46.078801865Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Gracefully shut down provisioner daemon 1\"\n"}
+{"Time":"2023-03-29T13:37:46.07881665Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                         \\r\"\n"}
+{"Time":"2023-03-29T13:37:46.078826759Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Shutting down provisioner daemon 2...\"\n"}
+{"Time":"2023-03-29T13:37:46.078840612Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                     \\r\"\n"}
+{"Time":"2023-03-29T13:37:46.07885439Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"Gracefully shut down provisioner daemon 2\"\n"}
+{"Time":"2023-03-29T13:37:46.07887537Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.078: cmd: \"                                         \\r\"\n"}
+{"Time":"2023-03-29T13:37:46.081392321Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.081: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:46.081408574Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.081: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:46.081421854Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.081: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:46.081431192Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.081: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:46.081449657Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:121: 2023-03-29 13:37:46.081: cmd: \"WARN: Graceful shutdown timed out\\r\"\n"}
+{"Time":"2023-03-29T13:37:46.14910839Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:83: 2023-03-29 13:37:46.149: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:46.149142371Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:74: 2023-03-29 13:37:46.149: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:46.149157567Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:110: 2023-03-29 13:37:46.149: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:46.149166448Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:111: 2023-03-29 13:37:46.149: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:46.149175898Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:113: 2023-03-29 13:37:46.149: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:46.149187205Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:76: 2023-03-29 13:37:46.149: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:46.14919623Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:74: 2023-03-29 13:37:46.149: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:46.149207373Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:76: 2023-03-29 13:37:46.149: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:46.149215685Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:74: 2023-03-29 13:37:46.149: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:46.149223347Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:76: 2023-03-29 13:37:46.149: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:46.149234369Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"    ptytest.go:102: 2023-03-29 13:37:46.149: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:46.149426722Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Output":"--- PASS: TestServer/Logging/Multiple (13.24s)\n"}
+{"Time":"2023-03-29T13:37:59.1117031Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Multiple","Elapsed":13.24}
+{"Time":"2023-03-29T13:37:59.111755068Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.111: cmd: \"2023-03-29 13:37:59.110 [DEBUG]\\t\u003cgithub.com/coder/coder/v2/cli/server.go:260\u003e\\t(*RootCmd).Server.func1\\tstarted debug logging\"\n"}
+{"Time":"2023-03-29T13:37:59.111775176Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.111: cmd: \"Started HTTP listener at http://[::]:40007\"\n"}
+{"Time":"2023-03-29T13:37:59.111795675Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    server_test.go:1204: 2023-03-29 13:37:59.111: cmd: matched \"Started HTTP listener at\" = \"2023-03-29 13:37:59.110 [DEBUG]\\t\u003cgithub.com/coder/coder/v2/cli/server.go:260\u003e\\t(*RootCmd).Server.func1\\tstarted debug logging\\r\\nStarted HTTP listener at\"\n"}
+{"Time":"2023-03-29T13:37:59.123488003Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.123: cmd: \"                                   \"\n"}
+{"Time":"2023-03-29T13:37:59.123536759Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.123: cmd: \"View the Web UI: http://example.com\\r\"\n"}
+{"Time":"2023-03-29T13:37:59.123550652Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.123: cmd: \"                                                                \"\n"}
+{"Time":"2023-03-29T13:37:59.123559998Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.123: cmd: \"==\u003e Logs will stream in below (press ctrl+c to gracefully exit):\\r\"\n"}
+{"Time":"2023-03-29T13:37:59.144165093Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.123 [DEBUG]\\t(coderd.metrics_cache)\\t\u003cgithub.com/coder/coder/v2/coderd/metricscache/metricscache.go:272\u003e\\t(*Cache).run\\tdeployment stats metrics refreshed\\t{\\\"took\\\": \\\"20.37µs\\\", \\\"interval\\\": \\\"30s\\\"}\"\n"}
+{"Time":"2023-03-29T13:37:59.144212142Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.139 [DEBUG]\\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:200\u003e\\t(*Server).connect\\tconnected\"\n"}
+{"Time":"2023-03-29T13:37:59.1442281Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.139 [DEBUG]\\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:200\u003e\\t(*Server).connect\\tconnected\"\n"}
+{"Time":"2023-03-29T13:37:59.14427036Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.139 [DEBUG]\\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:200\u003e\\t(*Server).connect\\tconnected\"\n"}
+{"Time":"2023-03-29T13:37:59.14428344Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.143 [DEBUG]\\t(coderd.metrics_cache)\\t\u003cgithub.com/coder/coder/v2/coderd/metricscache/metricscache.go:272\u003e\\t(*Cache).run\\ttemplate daus metrics refreshed\\t{\\\"took\\\": \\\"3.61474ms\\\", \\\"interval\\\": \\\"1h0m0s\\\"}\"\n"}
+{"Time":"2023-03-29T13:37:59.14429578Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Interrupt caught, gracefully exiting. Use ctrl+\\\\ to force quit\"\n"}
+{"Time":"2023-03-29T13:37:59.14430588Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Shutting down API server...\"\n"}
+{"Time":"2023-03-29T13:37:59.144315009Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                           \\r\"\n"}
+{"Time":"2023-03-29T13:37:59.144324164Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Gracefully shut down API server\"\n"}
+{"Time":"2023-03-29T13:37:59.144339556Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                               \\r\"\n"}
+{"Time":"2023-03-29T13:37:59.144624294Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Shutting down provisioner daemon 1...\"\n"}
+{"Time":"2023-03-29T13:37:59.144639861Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                     \\r\"\n"}
+{"Time":"2023-03-29T13:37:59.14465833Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.144 [DEBUG]\\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:553\u003e\\t(*Server).closeWithError\\tclosing server with error\\t{\\\"error\\\": null}\"\n"}
+{"Time":"2023-03-29T13:37:59.14468626Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Gracefully shut down provisioner daemon 1\"\n"}
+{"Time":"2023-03-29T13:37:59.144695878Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                         \\r\"\n"}
+{"Time":"2023-03-29T13:37:59.144705145Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Shutting down provisioner daemon 2...\"\n"}
+{"Time":"2023-03-29T13:37:59.144718072Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                     \\r\"\n"}
+{"Time":"2023-03-29T13:37:59.144727731Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.144 [DEBUG]\\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:553\u003e\\t(*Server).closeWithError\\tclosing server with error\\t{\\\"error\\\": null}\"\n"}
+{"Time":"2023-03-29T13:37:59.144750279Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Gracefully shut down provisioner daemon 2\"\n"}
+{"Time":"2023-03-29T13:37:59.144764838Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                         \\r\"\n"}
+{"Time":"2023-03-29T13:37:59.14477793Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Shutting down provisioner daemon 3...\"\n"}
+{"Time":"2023-03-29T13:37:59.144787313Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                     \\r\"\n"}
+{"Time":"2023-03-29T13:37:59.144797136Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"2023-03-29 13:37:59.144 [DEBUG]\\t\u003cgithub.com/coder/coder/provisionerd/provisionerd.go:553\u003e\\t(*Server).closeWithError\\tclosing server with error\\t{\\\"error\\\": null}\"\n"}
+{"Time":"2023-03-29T13:37:59.144810893Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Gracefully shut down provisioner daemon 3\"\n"}
+{"Time":"2023-03-29T13:37:59.144821417Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                         \\r\"\n"}
+{"Time":"2023-03-29T13:37:59.144842079Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Waiting for WebSocket connections to close...\"\n"}
+{"Time":"2023-03-29T13:37:59.144855916Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                             \\r\"\n"}
+{"Time":"2023-03-29T13:37:59.144867744Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"Done waiting for WebSocket connections\"\n"}
+{"Time":"2023-03-29T13:37:59.14488065Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:121: 2023-03-29 13:37:59.144: cmd: \"                                      \\r\"\n"}
+{"Time":"2023-03-29T13:37:59.146012139Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:83: 2023-03-29 13:37:59.145: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:37:59.146025303Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:74: 2023-03-29 13:37:59.145: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:37:59.14606956Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:110: 2023-03-29 13:37:59.146: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:59.146083103Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:111: 2023-03-29 13:37:59.146: cmd: closing out\n"}
+{"Time":"2023-03-29T13:37:59.146095911Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:113: 2023-03-29 13:37:59.146: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:37:59.146143558Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:76: 2023-03-29 13:37:59.146: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:59.146156843Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:74: 2023-03-29 13:37:59.146: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:37:59.146169893Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:76: 2023-03-29 13:37:59.146: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:59.146182763Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:74: 2023-03-29 13:37:59.146: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:37:59.146191645Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:76: 2023-03-29 13:37:59.146: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:37:59.146205122Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"    ptytest.go:102: 2023-03-29 13:37:59.146: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:37:59.146368404Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Output":"--- PASS: TestServer/Logging/Stackdriver (26.23s)\n"}
+{"Time":"2023-03-29T13:37:59.146391543Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging/Stackdriver","Elapsed":26.23}
+{"Time":"2023-03-29T13:37:59.146412558Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging","Output":"--- PASS: TestServer/Logging (0.00s)\n"}
+{"Time":"2023-03-29T13:37:59.146438143Z","Action":"pass","Package":"github.com/coder/coder/v2/cli","Test":"TestServer/Logging","Elapsed":0}
+{"Time":"2023-03-29T13:37:59.1464552Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Test":"TestServer","Output":"--- FAIL: TestServer (0.05s)\n"}
+{"Time":"2023-03-29T13:37:59.146474821Z","Action":"fail","Package":"github.com/coder/coder/v2/cli","Test":"TestServer","Elapsed":0.05}
+{"Time":"2023-03-29T13:37:59.146491309Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Output":"FAIL\n"}
+{"Time":"2023-03-29T13:37:59.158021068Z","Action":"output","Package":"github.com/coder/coder/v2/cli","Output":"FAIL\tgithub.com/coder/coder/v2/cli\t26.514s\n"}
+{"Time":"2023-03-29T13:37:59.158054855Z","Action":"fail","Package":"github.com/coder/coder/v2/cli","Elapsed":26.514}
+{"Time":"2023-03-29T13:38:02.724238056Z","Action":"start","Package":"github.com/coder/coder/v2/cli/cliui"}
+{"Time":"2023-03-29T13:38:02.754440648Z","Action":"run","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth"}
+{"Time":"2023-03-29T13:38:02.75448054Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"=== RUN   TestGitAuth\n"}
+{"Time":"2023-03-29T13:38:02.754486705Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"=== PAUSE TestGitAuth\n"}
+{"Time":"2023-03-29T13:38:02.754490044Z","Action":"pause","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth"}
+{"Time":"2023-03-29T13:38:02.754493443Z","Action":"run","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt"}
+{"Time":"2023-03-29T13:38:02.754496272Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt","Output":"=== RUN   TestPrompt\n"}
+{"Time":"2023-03-29T13:38:02.754504892Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt","Output":"=== PAUSE TestPrompt\n"}
+{"Time":"2023-03-29T13:38:02.754507539Z","Action":"pause","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt"}
+{"Time":"2023-03-29T13:38:02.754510534Z","Action":"cont","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth"}
+{"Time":"2023-03-29T13:38:02.754514471Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"=== CONT  TestGitAuth\n"}
+{"Time":"2023-03-29T13:38:02.754642422Z","Action":"cont","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt"}
+{"Time":"2023-03-29T13:38:02.754653067Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt","Output":"=== CONT  TestPrompt\n"}
+{"Time":"2023-03-29T13:38:02.754658206Z","Action":"run","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success"}
+{"Time":"2023-03-29T13:38:02.754660941Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"=== RUN   TestPrompt/Success\n"}
+{"Time":"2023-03-29T13:38:02.754664503Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"=== PAUSE TestPrompt/Success\n"}
+{"Time":"2023-03-29T13:38:02.754666941Z","Action":"pause","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success"}
+{"Time":"2023-03-29T13:38:02.754671476Z","Action":"run","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm"}
+{"Time":"2023-03-29T13:38:02.754673908Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"=== RUN   TestPrompt/Confirm\n"}
+{"Time":"2023-03-29T13:38:02.754676919Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"=== PAUSE TestPrompt/Confirm\n"}
+{"Time":"2023-03-29T13:38:02.754683157Z","Action":"pause","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm"}
+{"Time":"2023-03-29T13:38:02.754688172Z","Action":"run","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip"}
+{"Time":"2023-03-29T13:38:02.754690617Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"=== RUN   TestPrompt/Skip\n"}
+{"Time":"2023-03-29T13:38:02.754693754Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"=== PAUSE TestPrompt/Skip\n"}
+{"Time":"2023-03-29T13:38:02.754696128Z","Action":"pause","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip"}
+{"Time":"2023-03-29T13:38:02.754700672Z","Action":"run","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON"}
+{"Time":"2023-03-29T13:38:02.754703008Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"=== RUN   TestPrompt/JSON\n"}
+{"Time":"2023-03-29T13:38:02.754718094Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"=== PAUSE TestPrompt/JSON\n"}
+{"Time":"2023-03-29T13:38:02.754723349Z","Action":"pause","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON"}
+{"Time":"2023-03-29T13:38:02.754728958Z","Action":"run","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON"}
+{"Time":"2023-03-29T13:38:02.754731492Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"=== RUN   TestPrompt/BadJSON\n"}
+{"Time":"2023-03-29T13:38:02.754734435Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"=== PAUSE TestPrompt/BadJSON\n"}
+{"Time":"2023-03-29T13:38:02.754736902Z","Action":"pause","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON"}
+{"Time":"2023-03-29T13:38:02.754748953Z","Action":"run","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON"}
+{"Time":"2023-03-29T13:38:02.754751439Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"=== RUN   TestPrompt/MultilineJSON\n"}
+{"Time":"2023-03-29T13:38:02.754755982Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"=== PAUSE TestPrompt/MultilineJSON\n"}
+{"Time":"2023-03-29T13:38:02.754760728Z","Action":"pause","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON"}
+{"Time":"2023-03-29T13:38:02.754764892Z","Action":"cont","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success"}
+{"Time":"2023-03-29T13:38:02.754767252Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"=== CONT  TestPrompt/Success\n"}
+{"Time":"2023-03-29T13:38:02.754976869Z","Action":"cont","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON"}
+{"Time":"2023-03-29T13:38:02.754982653Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"=== CONT  TestPrompt/MultilineJSON\n"}
+{"Time":"2023-03-29T13:38:02.755108229Z","Action":"cont","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON"}
+{"Time":"2023-03-29T13:38:02.755113844Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"=== CONT  TestPrompt/BadJSON\n"}
+{"Time":"2023-03-29T13:38:02.755212757Z","Action":"cont","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON"}
+{"Time":"2023-03-29T13:38:02.755218041Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"=== CONT  TestPrompt/JSON\n"}
+{"Time":"2023-03-29T13:38:02.755315155Z","Action":"cont","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip"}
+{"Time":"2023-03-29T13:38:02.755318778Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"=== CONT  TestPrompt/Skip\n"}
+{"Time":"2023-03-29T13:38:02.755513491Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:83: 2023-03-29 13:38:02.755: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:38:02.755529621Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:74: 2023-03-29 13:38:02.755: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:38:02.755596722Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:76: 2023-03-29 13:38:02.755: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.755601928Z","Action":"cont","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm"}
+{"Time":"2023-03-29T13:38:02.755604522Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"=== CONT  TestPrompt/Confirm\n"}
+{"Time":"2023-03-29T13:38:02.756154509Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:110: 2023-03-29 13:38:02.756: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.756161274Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:111: 2023-03-29 13:38:02.756: cmd: closing out\n"}
+{"Time":"2023-03-29T13:38:02.756179269Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:113: 2023-03-29 13:38:02.756: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.756195571Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:74: 2023-03-29 13:38:02.756: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:38:02.75620977Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:76: 2023-03-29 13:38:02.756: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.756222494Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:74: 2023-03-29 13:38:02.756: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:38:02.756250235Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:76: 2023-03-29 13:38:02.756: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.756263435Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:102: 2023-03-29 13:38:02.756: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:38:02.75631973Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:83: 2023-03-29 13:38:02.756: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:38:02.756334455Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:74: 2023-03-29 13:38:02.756: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:38:02.756398184Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:76: 2023-03-29 13:38:02.756: cmd: closed pty: pty: closed\n"}
+{"Time":"2023-03-29T13:38:02.75641208Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:74: 2023-03-29 13:38:02.756: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:38:02.756425561Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:76: 2023-03-29 13:38:02.756: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.756442572Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:74: 2023-03-29 13:38:02.756: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:38:02.756457245Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:76: 2023-03-29 13:38:02.756: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.756473084Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"    ptytest.go:102: 2023-03-29 13:38:02.756: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:38:02.756487964Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Output":"--- PASS: TestPrompt/Skip (0.00s)\n"}
+{"Time":"2023-03-29T13:38:02.756674486Z","Action":"pass","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Skip","Elapsed":0}
+{"Time":"2023-03-29T13:38:02.756683362Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    prompt_test.go:51: 2023-03-29 13:38:02.756: cmd: matched \"Example\" = \"\u003e Example\"\n"}
+{"Time":"2023-03-29T13:38:02.756700414Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    prompt_test.go:52: 2023-03-29 13:38:02.756: cmd: stdin: \"yes\\r\"\n"}
+{"Time":"2023-03-29T13:38:02.756759525Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    prompt_test.go:108: 2023-03-29 13:38:02.756: cmd: matched \"Example\" = \"\u003e Example\"\n"}
+{"Time":"2023-03-29T13:38:02.75678767Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    prompt_test.go:109: 2023-03-29 13:38:02.756: cmd: stdin: \"{}\\r\"\n"}
+{"Time":"2023-03-29T13:38:02.756838147Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    prompt_test.go:124: 2023-03-29 13:38:02.756: cmd: matched \"Example\" = \"\u003e Example\"\n"}
+{"Time":"2023-03-29T13:38:02.756862647Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    prompt_test.go:125: 2023-03-29 13:38:02.756: cmd: stdin: \"{a\\r\"\n"}
+{"Time":"2023-03-29T13:38:02.756932142Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    prompt_test.go:140: 2023-03-29 13:38:02.756: cmd: matched \"Example\" = \"\u003e Example\"\n"}
+{"Time":"2023-03-29T13:38:02.756958031Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    prompt_test.go:141: 2023-03-29 13:38:02.756: cmd: stdin: \"{\\n\\\"test\\\": \\\"wow\\\"\\n}\\r\"\n"}
+{"Time":"2023-03-29T13:38:02.757013878Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:121: 2023-03-29 13:38:02.756: cmd: \"You must authenticate with GitHub to create a workspace with this template. Visit:\"\n"}
+{"Time":"2023-03-29T13:38:02.757025551Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\"\n"}
+{"Time":"2023-03-29T13:38:02.757047114Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\\thttps://example.com/gitauth/github?redirect=%2Fgitauth%3Fnotify\"\n"}
+{"Time":"2023-03-29T13:38:02.757065197Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\"\n"}
+{"Time":"2023-03-29T13:38:02.757096029Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\\r\\r⠈⠁ Waiting for Git authentication...\\rSuccessfully authenticated with GitHub!\"\n"}
+{"Time":"2023-03-29T13:38:02.757108294Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\"\n"}
+{"Time":"2023-03-29T13:38:02.757140128Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    gitauth_test.go:53: 2023-03-29 13:38:02.757: cmd: matched \"You must authenticate with\" = \"You must authenticate with\"\n"}
+{"Time":"2023-03-29T13:38:02.757190596Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    gitauth_test.go:54: 2023-03-29 13:38:02.757: cmd: matched \"https://example.com/gitauth/github\" = \" GitHub to create a workspace with this template. Visit:\\r\\n\\r\\n\\thttps://example.com/gitauth/github\"\n"}
+{"Time":"2023-03-29T13:38:02.757264811Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    gitauth_test.go:55: 2023-03-29 13:38:02.757: cmd: matched \"Successfully authenticated with GitHub\" = \"?redirect=%2Fgitauth%3Fnotify\\r\\n\\r\\n\\r\\r⠈⠁ Waiting for Git authentication...\\rSuccessfully authenticated with GitHub\"\n"}
+{"Time":"2023-03-29T13:38:02.757294284Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:83: 2023-03-29 13:38:02.757: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:38:02.757307619Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:74: 2023-03-29 13:38:02.757: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:38:02.757350699Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:110: 2023-03-29 13:38:02.757: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.757369646Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:111: 2023-03-29 13:38:02.757: cmd: closing out\n"}
+{"Time":"2023-03-29T13:38:02.757388269Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:113: 2023-03-29 13:38:02.757: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.757437516Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:76: 2023-03-29 13:38:02.757: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.7574545Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:74: 2023-03-29 13:38:02.757: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:38:02.757468757Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:76: 2023-03-29 13:38:02.757: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.757483649Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:74: 2023-03-29 13:38:02.757: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:38:02.757496041Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:76: 2023-03-29 13:38:02.757: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.757513203Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"    ptytest.go:102: 2023-03-29 13:38:02.757: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:38:02.757518992Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Output":"--- PASS: TestGitAuth (0.00s)\n"}
+{"Time":"2023-03-29T13:38:02.75757314Z","Action":"pass","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestGitAuth","Elapsed":0}
+{"Time":"2023-03-29T13:38:02.757576987Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    prompt_test.go:34: 2023-03-29 13:38:02.757: cmd: matched \"Example\" = \"\u003e Example\"\n"}
+{"Time":"2023-03-29T13:38:02.757605985Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    prompt_test.go:35: 2023-03-29 13:38:02.757: cmd: stdin: \"hello\\r\"\n"}
+{"Time":"2023-03-29T13:38:02.757679461Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\u003e Example hello\"\n"}
+{"Time":"2023-03-29T13:38:02.757731096Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:83: 2023-03-29 13:38:02.757: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:38:02.757745488Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:74: 2023-03-29 13:38:02.757: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:38:02.757786052Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:110: 2023-03-29 13:38:02.757: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.757793961Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:111: 2023-03-29 13:38:02.757: cmd: closing out\n"}
+{"Time":"2023-03-29T13:38:02.757809024Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:113: 2023-03-29 13:38:02.757: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.757853587Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:76: 2023-03-29 13:38:02.757: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.757869751Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:74: 2023-03-29 13:38:02.757: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:38:02.757888281Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:76: 2023-03-29 13:38:02.757: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.757896143Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:74: 2023-03-29 13:38:02.757: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:38:02.757912615Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:76: 2023-03-29 13:38:02.757: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.757929309Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"    ptytest.go:102: 2023-03-29 13:38:02.757: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:38:02.757934794Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Output":"--- PASS: TestPrompt/Success (0.00s)\n"}
+{"Time":"2023-03-29T13:38:02.757963355Z","Action":"pass","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Success","Elapsed":0}
+{"Time":"2023-03-29T13:38:02.757966707Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\u003e Example {\"\n"}
+{"Time":"2023-03-29T13:38:02.757981822Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"\\\"test\\\": \\\"wow\\\"\"\n"}
+{"Time":"2023-03-29T13:38:02.757994456Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:121: 2023-03-29 13:38:02.757: cmd: \"}\"\n"}
+{"Time":"2023-03-29T13:38:02.75807554Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:83: 2023-03-29 13:38:02.758: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:38:02.758091845Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:38:02.758122927Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:110: 2023-03-29 13:38:02.758: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.758135875Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:111: 2023-03-29 13:38:02.758: cmd: closing out\n"}
+{"Time":"2023-03-29T13:38:02.758148587Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:113: 2023-03-29 13:38:02.758: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.758193703Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.758208689Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:38:02.75822251Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.758236906Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:38:02.758250264Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.758266392Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"    ptytest.go:102: 2023-03-29 13:38:02.758: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:38:02.758271916Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Output":"--- PASS: TestPrompt/MultilineJSON (0.00s)\n"}
+{"Time":"2023-03-29T13:38:02.758311206Z","Action":"pass","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/MultilineJSON","Elapsed":0}
+{"Time":"2023-03-29T13:38:02.758314623Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:121: 2023-03-29 13:38:02.758: cmd: \"\u003e Example {a\"\n"}
+{"Time":"2023-03-29T13:38:02.75836333Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:83: 2023-03-29 13:38:02.758: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:38:02.758378803Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:38:02.758418274Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:110: 2023-03-29 13:38:02.758: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.758425803Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:111: 2023-03-29 13:38:02.758: cmd: closing out\n"}
+{"Time":"2023-03-29T13:38:02.75844102Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:113: 2023-03-29 13:38:02.758: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.758482492Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.758498572Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:38:02.758513045Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.758526569Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:38:02.75853994Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.758557098Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"    ptytest.go:102: 2023-03-29 13:38:02.758: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:38:02.758562364Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Output":"--- PASS: TestPrompt/BadJSON (0.00s)\n"}
+{"Time":"2023-03-29T13:38:02.758589722Z","Action":"pass","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/BadJSON","Elapsed":0}
+{"Time":"2023-03-29T13:38:02.758593068Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:121: 2023-03-29 13:38:02.758: cmd: \"\u003e Example {}\"\n"}
+{"Time":"2023-03-29T13:38:02.758640512Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:83: 2023-03-29 13:38:02.758: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:38:02.75865573Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:38:02.75868581Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:110: 2023-03-29 13:38:02.758: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.758697594Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:111: 2023-03-29 13:38:02.758: cmd: closing out\n"}
+{"Time":"2023-03-29T13:38:02.758712004Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:113: 2023-03-29 13:38:02.758: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.758753059Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.758789238Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:38:02.75880265Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.758821412Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:38:02.758835398Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:76: 2023-03-29 13:38:02.758: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.758851842Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"    ptytest.go:102: 2023-03-29 13:38:02.758: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:38:02.758857116Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Output":"--- PASS: TestPrompt/JSON (0.00s)\n"}
+{"Time":"2023-03-29T13:38:02.758897163Z","Action":"pass","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/JSON","Elapsed":0}
+{"Time":"2023-03-29T13:38:02.758900525Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:121: 2023-03-29 13:38:02.758: cmd: \"\u003e Example (yes/no) yes\"\n"}
+{"Time":"2023-03-29T13:38:02.758967291Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:83: 2023-03-29 13:38:02.758: cmd: closing tpty: close\n"}
+{"Time":"2023-03-29T13:38:02.758981151Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:74: 2023-03-29 13:38:02.758: cmd: closing pty\n"}
+{"Time":"2023-03-29T13:38:02.759023005Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:110: 2023-03-29 13:38:02.758: cmd: copy done: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.759035878Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:111: 2023-03-29 13:38:02.759: cmd: closing out\n"}
+{"Time":"2023-03-29T13:38:02.759048644Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:113: 2023-03-29 13:38:02.759: cmd: closed out: read /dev/ptmx: file already closed\n"}
+{"Time":"2023-03-29T13:38:02.759094323Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:76: 2023-03-29 13:38:02.759: cmd: closed pty: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.759115364Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:74: 2023-03-29 13:38:02.759: cmd: closing logw\n"}
+{"Time":"2023-03-29T13:38:02.75913071Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:76: 2023-03-29 13:38:02.759: cmd: closed logw: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.759144071Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:74: 2023-03-29 13:38:02.759: cmd: closing logr\n"}
+{"Time":"2023-03-29T13:38:02.75915741Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:76: 2023-03-29 13:38:02.759: cmd: closed logr: \u003cnil\u003e\n"}
+{"Time":"2023-03-29T13:38:02.759174685Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"    ptytest.go:102: 2023-03-29 13:38:02.759: cmd: closed tpty\n"}
+{"Time":"2023-03-29T13:38:02.759180019Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Output":"--- PASS: TestPrompt/Confirm (0.00s)\n"}
+{"Time":"2023-03-29T13:38:02.759187539Z","Action":"pass","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt/Confirm","Elapsed":0}
+{"Time":"2023-03-29T13:38:02.75919072Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt","Output":"--- PASS: TestPrompt (0.00s)\n"}
+{"Time":"2023-03-29T13:38:02.759194742Z","Action":"pass","Package":"github.com/coder/coder/v2/cli/cliui","Test":"TestPrompt","Elapsed":0}
+{"Time":"2023-03-29T13:38:02.759198362Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Output":"PASS\n"}
+{"Time":"2023-03-29T13:38:02.761021961Z","Action":"output","Package":"github.com/coder/coder/v2/cli/cliui","Output":"ok  \tgithub.com/coder/coder/v2/cli/cliui\t0.037s\n"}
+{"Time":"2023-03-29T13:38:02.761046557Z","Action":"pass","Package":"github.com/coder/coder/v2/cli/cliui","Elapsed":0.037}
diff --git a/scripts/clidocgen/gen.go b/scripts/clidocgen/gen.go
index ac50b511ca134..98fdb388c23ea 100644
--- a/scripts/clidocgen/gen.go
+++ b/scripts/clidocgen/gen.go
@@ -12,8 +12,8 @@ import (
 
 	"github.com/acarl005/stripansi"
 
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/cli/clibase"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/cli/clibase"
 	"github.com/coder/flog"
 )
 
diff --git a/scripts/clidocgen/main.go b/scripts/clidocgen/main.go
index 7d6f6d9c7f7b2..961797b02d0ab 100644
--- a/scripts/clidocgen/main.go
+++ b/scripts/clidocgen/main.go
@@ -7,8 +7,8 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/coder/coder/cli/clibase"
-	"github.com/coder/coder/enterprise/cli"
+	"github.com/coder/coder/v2/cli/clibase"
+	"github.com/coder/coder/v2/enterprise/cli"
 	"github.com/coder/flog"
 )
 
diff --git a/scripts/coder-dev.sh b/scripts/coder-dev.sh
index 29072a60f7903..69696351ea05a 100755
--- a/scripts/coder-dev.sh
+++ b/scripts/coder-dev.sh
@@ -17,6 +17,9 @@ fi
 if [[ ${1:-} == wsproxy ]] && [[ ${2:-} == server ]]; then
 	BINARY_TYPE=coder
 fi
+if [[ ${1:-} == exp ]] && [[ ${2:-} == scaletest ]]; then
+	BINARY_TYPE=coder
+fi
 RELATIVE_BINARY_PATH="build/${BINARY_TYPE}_${GOOS}_${GOARCH}"
 
 # To preserve the CWD when running the binary, we need to use pushd and popd to
diff --git a/scripts/dbgen/main.go b/scripts/dbgen/main.go
index 8a7976e32154b..54b104d04f718 100644
--- a/scripts/dbgen/main.go
+++ b/scripts/dbgen/main.go
@@ -53,11 +53,11 @@ func run() error {
 	}
 	databasePath := filepath.Join(localPath, "..", "..", "..", "coderd", "database")
 
-	err = orderAndStubDatabaseFunctions(filepath.Join(databasePath, "dbfake", "dbfake.go"), "q", "FakeQuerier", func(params stubParams) string {
+	err = orderAndStubDatabaseFunctions(filepath.Join(databasePath, "dbmem", "dbmem.go"), "q", "FakeQuerier", func(params stubParams) string {
 		return `panic("not implemented")`
 	})
 	if err != nil {
-		return xerrors.Errorf("stub dbfake: %w", err)
+		return xerrors.Errorf("stub dbmem: %w", err)
 	}
 
 	err = orderAndStubDatabaseFunctions(filepath.Join(databasePath, "dbmetrics", "dbmetrics.go"), "m", "metricsStore", func(params stubParams) string {
@@ -84,6 +84,11 @@ return %s
 		return xerrors.Errorf("generate unique constraints: %w", err)
 	}
 
+	err = generateForeignKeyConstraints()
+	if err != nil {
+		return xerrors.Errorf("generate foreign key constraints: %w", err)
+	}
+
 	return nil
 }
 
@@ -111,7 +116,7 @@ func generateUniqueConstraints() error {
 		case line == "":
 		case strings.HasSuffix(line, ";"):
 			query += line
-			if strings.Contains(query, "UNIQUE") {
+			if strings.Contains(query, "UNIQUE") || strings.Contains(query, "PRIMARY KEY") {
 				uniqueConstraints = append(uniqueConstraints, query)
 			}
 			query = ""
@@ -125,7 +130,7 @@ func generateUniqueConstraints() error {
 
 	s := &bytes.Buffer{}
 
-	_, _ = fmt.Fprint(s, `// Code generated by gen/enum. DO NOT EDIT.
+	_, _ = fmt.Fprint(s, `// Code generated by scripts/dbgen/main.go. DO NOT EDIT.
 package database
 `)
 	_, _ = fmt.Fprint(s, `
@@ -160,6 +165,78 @@ const (
 	return os.WriteFile(outputPath, data, 0o600)
 }
 
+// generateForeignKeyConstraints generates the ForeignKeyConstraint enum.
+func generateForeignKeyConstraints() error {
+	localPath, err := localFilePath()
+	if err != nil {
+		return err
+	}
+	databasePath := filepath.Join(localPath, "..", "..", "..", "coderd", "database")
+
+	dump, err := os.Open(filepath.Join(databasePath, "dump.sql"))
+	if err != nil {
+		return err
+	}
+	defer dump.Close()
+
+	var foreignKeyConstraints []string
+	dumpScanner := bufio.NewScanner(dump)
+	query := ""
+	for dumpScanner.Scan() {
+		line := strings.TrimSpace(dumpScanner.Text())
+		switch {
+		case strings.HasPrefix(line, "--"):
+		case line == "":
+		case strings.HasSuffix(line, ";"):
+			query += line
+			if strings.Contains(query, "FOREIGN KEY") {
+				foreignKeyConstraints = append(foreignKeyConstraints, query)
+			}
+			query = ""
+		default:
+			query += line + " "
+		}
+	}
+
+	if err := dumpScanner.Err(); err != nil {
+		return err
+	}
+
+	s := &bytes.Buffer{}
+
+	_, _ = fmt.Fprint(s, `// Code generated by scripts/dbgen/main.go. DO NOT EDIT.
+package database
+`)
+	_, _ = fmt.Fprint(s, `
+// ForeignKeyConstraint represents a named foreign key constraint on a table.
+type ForeignKeyConstraint string
+
+// ForeignKeyConstraint enums.
+const (
+`)
+	for _, query := range foreignKeyConstraints {
+		name := ""
+		switch {
+		case strings.Contains(query, "ALTER TABLE") && strings.Contains(query, "ADD CONSTRAINT"):
+			name = strings.Split(query, " ")[6]
+		default:
+			return xerrors.Errorf("unknown foreign key constraint format: %s", query)
+		}
+		_, _ = fmt.Fprintf(s, "\tForeignKey%s ForeignKeyConstraint = %q // %s\n", nameFromSnakeCase(name), name, query)
+	}
+	_, _ = fmt.Fprint(s, ")\n")
+
+	outputPath := filepath.Join(databasePath, "foreign_key_constraint.go")
+
+	data, err := imports.Process(outputPath, s.Bytes(), &imports.Options{
+		Comments: true,
+	})
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(outputPath, data, 0o600)
+}
+
 type stubParams struct {
 	FuncName   string
 	Parameters string
@@ -180,13 +257,13 @@ func orderAndStubDatabaseFunctions(filePath, receiver, structName string, stub f
 
 	contents, err := os.ReadFile(filePath)
 	if err != nil {
-		return xerrors.Errorf("read dbfake: %w", err)
+		return xerrors.Errorf("read dbmem: %w", err)
 	}
 
 	// Required to preserve imports!
 	f, err := decorator.NewDecoratorWithImports(token.NewFileSet(), packageName, goast.New()).Parse(contents)
 	if err != nil {
-		return xerrors.Errorf("parse dbfake: %w", err)
+		return xerrors.Errorf("parse dbmem: %w", err)
 	}
 
 	pointer := false
@@ -221,8 +298,8 @@ func orderAndStubDatabaseFunctions(filePath, receiver, structName string, stub f
 	for _, fn := range funcs {
 		var bodyStmts []dst.Stmt
 
-		// Add input validation, only relevant for dbfake.
-		if strings.Contains(filePath, "dbfake") && len(fn.Func.Params.List) == 2 && fn.Func.Params.List[1].Names[0].Name == "arg" {
+		// Add input validation, only relevant for dbmem.
+		if strings.Contains(filePath, "dbmem") && len(fn.Func.Params.List) == 2 && fn.Func.Params.List[1].Names[0].Name == "arg" {
 			/*
 				err := validateDatabaseType(arg)
 				if err != nil {
@@ -526,7 +603,7 @@ func loadInterfaceFuncs(f *dst.File, interfaceName string) ([]querierFunction, e
 				if !ident.IsExported() {
 					continue
 				}
-				ident.Path = "github.com/coder/coder/coderd/database"
+				ident.Path = "github.com/coder/coder/v2/coderd/database"
 			}
 		}
 
@@ -560,6 +637,14 @@ func nameFromSnakeCase(s string) string {
 			ret += "JWT"
 		case "idx":
 			ret += "Index"
+		case "api":
+			ret += "API"
+		case "uuid":
+			ret += "UUID"
+		case "gitsshkeys":
+			ret += "GitSSHKeys"
+		case "fkey":
+			// ignore
 		default:
 			ret += strings.Title(ss)
 		}
diff --git a/scripts/deploy-pr.sh b/scripts/deploy-pr.sh
index 84ee6ed6266f4..e852368fd8bbe 100755
--- a/scripts/deploy-pr.sh
+++ b/scripts/deploy-pr.sh
@@ -1,21 +1,26 @@
 #!/usr/bin/env bash
-# Usage: ./deploy-pr.sh  [--skip-build -s] [--dry-run -n] [--yes -y]
+# Usage: ./deploy-pr.sh [--dry-run -n] [--yes -y] [--experiments -e <experiments>] [--build -b] [--deploy -d]
 # deploys the current branch to a PR environment and posts login credentials to
 # [#pr-deployments](https://codercom.slack.com/archives/C05DNE982E8) Slack channel
 
 set -euo pipefail
 
 # default settings
-skipBuild=false
 dryRun=false
 confirm=true
+build=false
+deploy=false
 experiments=""
 
 # parse arguments
 while (("$#")); do
 	case "$1" in
-	-s | --skip-build)
-		skipBuild=true
+	-b | --build)
+		build=true
+		shift
+		;;
+	-d | --deploy)
+		deploy=true
 		shift
 		;;
 	-n | --dry-run)
@@ -63,30 +68,20 @@ fi
 branchName=$(gh pr view --json headRefName | jq -r .headRefName)
 prNumber=$(gh pr view --json number | jq -r .number)
 
-if $skipBuild; then
-	#check if the image exists
-	foundTag=$(curl -fsSL https://github.com/coder/coder/pkgs/container/coder-preview | grep -o "$prNumber" | head -n 1) || true
-	echo "foundTag is: '${foundTag}'"
-	if [[ -z "${foundTag}" ]]; then
-		echo "Image not found"
-		echo "${prNumber} tag not found in ghcr.io/coder/coder-preview"
-		echo "Please remove --skip-build and try again"
-		exit 1
-	fi
-fi
-
-if $dryRun; then
+if [[ "$dryRun" = true ]]; then
 	echo "dry run"
 	echo "branchName: ${branchName}"
 	echo "prNumber: ${prNumber}"
-	echo "skipBuild: ${skipBuild}"
 	echo "experiments: ${experiments}"
+	echo "build: ${build}"
+	echo "deploy: ${deploy}"
 	exit 0
 fi
 
 echo "branchName: ${branchName}"
 echo "prNumber: ${prNumber}"
-echo "skipBuild: ${skipBuild}"
 echo "experiments: ${experiments}"
+echo "build: ${build}"
+echo "deploy: ${deploy}"
 
-gh workflow run pr-deploy.yaml --ref "${branchName}" -f "pr_number=${prNumber}" -f "skip_build=${skipBuild}" -f "experiments=${experiments}"
+gh workflow run pr-deploy.yaml --ref "${branchName}" -f "pr_number=${prNumber}" -f "experiments=${experiments}" -f "build=${build}" -f "deploy=${deploy}"
diff --git a/scripts/dev-oidc.sh b/scripts/dev-oidc.sh
new file mode 100755
index 0000000000000..017c7f07c646d
--- /dev/null
+++ b/scripts/dev-oidc.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+
+SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
+# shellcheck source=scripts/lib.sh
+source "${SCRIPT_DIR}/lib.sh"
+
+# Allow toggling verbose output
+[[ -n ${VERBOSE:-} ]] && set -x
+set -euo pipefail
+
+KEYCLOAK_VERSION="${KEYCLOAK_VERSION:-22.0}"
+
+cat <<EOF >/tmp/example-realm.json
+{
+  "realm": "coder",
+  "enabled": true,
+  "sslRequired": "none",
+  "registrationAllowed": true,
+  "privateKey": "MIICXAIBAAKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQABAoGAfmO8gVhyBxdqlxmIuglbz8bcjQbhXJLR2EoS8ngTXmN1bo2L90M0mUKSdc7qF10LgETBzqL8jYlQIbt+e6TH8fcEpKCjUlyq0Mf/vVbfZSNaVycY13nTzo27iPyWQHK5NLuJzn1xvxxrUeXI6A2WFpGEBLbHjwpx5WQG9A+2scECQQDvdn9NE75HPTVPxBqsEd2z10TKkl9CZxu10Qby3iQQmWLEJ9LNmy3acvKrE3gMiYNWb6xHPKiIqOR1as7L24aTAkEAtyvQOlCvr5kAjVqrEKXalj0Tzewjweuxc0pskvArTI2Oo070h65GpoIKLc9jf+UA69cRtquwP93aZKtW06U8dQJAF2Y44ks/mK5+eyDqik3koCI08qaC8HYq2wVl7G2QkJ6sbAaILtcvD92ToOvyGyeE0flvmDZxMYlvaZnaQ0lcSQJBAKZU6umJi3/xeEbkJqMfeLclD27XGEFoPeNrmdx0q10Azp4NfJAY+Z8KRyQCR2BEG+oNitBOZ+YXF9KCpH3cdmECQHEigJhYg+ykOvr1aiZUMFT72HU0jnmQe2FVekuG+LJUt2Tm7GtMjTFoGpf0JwrVuZN39fOYAlo+nTixgeW7X8Y=",
+  "publicKey": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
+  "requiredCredentials": ["password"],
+  "users": [
+    {
+      "username": "oidcuser",
+      "email": "oidcuser@coder.com",
+      "emailVerified": true,
+      "enabled": true,
+      "credentials": [
+        {
+          "type": "password",
+          "value": "password"
+        }
+      ],
+      "clientRoles": {
+        "realm-management": ["realm-admin"],
+        "account": ["manage-account"]
+      }
+    }
+  ],
+  "clients": [
+    {
+      "clientId": "coder",
+      "directAccessGrantsEnabled": true,
+      "enabled": true,
+      "fullScopeAllowed": true,
+      "baseUrl": "/coder",
+      "redirectUris": ["*"],
+      "secret": "coder"
+    }
+  ]
+}
+EOF
+
+echo '== Starting Keycloak'
+docker rm -f keycloak || true
+# Start Keycloak
+docker run --rm -d \
+	--name keycloak \
+	-p 9080:8080 \
+	-e KEYCLOAK_ADMIN=admin \
+	-e KEYCLOAK_ADMIN_PASSWORD=password \
+	-v /tmp/example-realm.json:/opt/keycloak/data/import/example-realm.json \
+	"quay.io/keycloak/keycloak:${KEYCLOAK_VERSION}" \
+	start-dev \
+	--import-realm
+
+echo '== Waiting for keycloak to become ready'
+# Start the timeout in the background so interrupting this script
+# doesn't hang for 60s.
+timeout 60s bash -c 'until curl -s --fail http://localhost:9080/realms/coder/.well-known/openid-configuration > /dev/null 2>&1; do sleep 0.5; done' ||
+	fatal 'Keycloak did not become ready in time' &
+wait $!
+
+echo '== Starting Coder'
+hostname=$(hostname -f)
+export CODER_OIDC_ISSUER_URL="http://${hostname}:9080/realms/coder"
+export CODER_OIDC_CLIENT_ID=coder
+export CODER_OIDC_CLIENT_SECRET=coder
+export CODER_DEV_ACCESS_URL="http://${hostname}:8080"
+
+exec "${SCRIPT_DIR}/develop.sh" "$@"
diff --git a/scripts/develop.sh b/scripts/develop.sh
index 671c46a0bd5cc..39f81c2951bc4 100755
--- a/scripts/develop.sh
+++ b/scripts/develop.sh
@@ -13,14 +13,19 @@ source "${SCRIPT_DIR}/lib.sh"
 [[ -n ${VERBOSE:-} ]] && set -x
 set -euo pipefail
 
+CODER_DEV_ACCESS_URL="${CODER_DEV_ACCESS_URL:-http://127.0.0.1:3000}"
 DEFAULT_PASSWORD="SomeSecurePassword!"
 password="${CODER_DEV_ADMIN_PASSWORD:-${DEFAULT_PASSWORD}}"
 use_proxy=0
 
-args="$(getopt -o "" -l use-proxy,agpl,password: -- "$@")"
+args="$(getopt -o "" -l access-url:,use-proxy,agpl,password: -- "$@")"
 eval set -- "$args"
 while true; do
 	case "$1" in
+	--access-url)
+		CODER_DEV_ACCESS_URL="$2"
+		shift 2
+		;;
 	--agpl)
 		export CODER_BUILD_AGPL=1
 		shift
@@ -131,7 +136,7 @@ fatal() {
 	trap 'fatal "Script encountered an error"' ERR
 
 	cdroot
-	start_cmd API "" "${CODER_DEV_SHIM}" server --http-address 0.0.0.0:3000 --swagger-enable --access-url "http://127.0.0.1:3000" --dangerous-allow-cors-requests=true --experiments "*,moons" "$@"
+	start_cmd API "" "${CODER_DEV_SHIM}" server --http-address 0.0.0.0:3000 --swagger-enable --access-url "${CODER_DEV_ACCESS_URL}" --dangerous-allow-cors-requests=true "$@"
 
 	echo '== Waiting for Coder to become ready'
 	# Start the timeout in the background so interrupting this script
diff --git a/scripts/examplegen/main.go b/scripts/examplegen/main.go
new file mode 100644
index 0000000000000..5106bf0a50390
--- /dev/null
+++ b/scripts/examplegen/main.go
@@ -0,0 +1,144 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"go/parser"
+	"go/token"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"github.com/gohugoio/hugo/parser/pageparser"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/codersdk"
+)
+
+const (
+	examplesDir = "examples"
+	examplesSrc = "examples.go"
+)
+
+func main() {
+	if err := run(); err != nil {
+		panic(err)
+	}
+}
+
+func run() error {
+	fset := token.NewFileSet()
+	src, err := parser.ParseFile(fset, filepath.Join(examplesDir, examplesSrc), nil, parser.ParseComments)
+	if err != nil {
+		return err
+	}
+
+	var paths []string
+	for _, comment := range src.Comments {
+		for _, line := range comment.List {
+			if s, ok := parseEmbedTag(line.Text); ok && !strings.HasSuffix(s, ".json") {
+				paths = append(paths, s)
+			}
+		}
+	}
+
+	var examples []codersdk.TemplateExample
+	files := os.DirFS(examplesDir)
+	for _, name := range paths {
+		dir, err := fs.Stat(files, name)
+		if err != nil {
+			return err
+		}
+		if !dir.IsDir() {
+			continue
+		}
+		exampleID := dir.Name()
+		// Each one of these is a example!
+		readme, err := fs.ReadFile(files, path.Join(name, "README.md"))
+		if err != nil {
+			return xerrors.Errorf("example %q does not contain README.md", exampleID)
+		}
+
+		frontMatter, err := pageparser.ParseFrontMatterAndContent(bytes.NewReader(readme))
+		if err != nil {
+			return xerrors.Errorf("parse example %q front matter: %w", exampleID, err)
+		}
+
+		nameRaw, exists := frontMatter.FrontMatter["name"]
+		if !exists {
+			return xerrors.Errorf("example %q front matter does not contain name", exampleID)
+		}
+
+		name, valid := nameRaw.(string)
+		if !valid {
+			return xerrors.Errorf("example %q name isn't a string", exampleID)
+		}
+
+		descriptionRaw, exists := frontMatter.FrontMatter["description"]
+		if !exists {
+			return xerrors.Errorf("example %q front matter does not contain name", exampleID)
+		}
+
+		description, valid := descriptionRaw.(string)
+		if !valid {
+			return xerrors.Errorf("example %q description isn't a string", exampleID)
+		}
+
+		tags := []string{}
+		tagsRaw, exists := frontMatter.FrontMatter["tags"]
+		if exists {
+			tagsI, valid := tagsRaw.([]interface{})
+			if !valid {
+				return xerrors.Errorf("example %q tags isn't a slice: type %T", exampleID, tagsRaw)
+			}
+			for _, tagI := range tagsI {
+				tag, valid := tagI.(string)
+				if !valid {
+					return xerrors.Errorf("example %q tag isn't a string: type %T", exampleID, tagI)
+				}
+				tags = append(tags, tag)
+			}
+		}
+
+		var icon string
+		iconRaw, exists := frontMatter.FrontMatter["icon"]
+		if exists {
+			icon, valid = iconRaw.(string)
+			if !valid {
+				return xerrors.Errorf("example %q icon isn't a string", exampleID)
+			}
+		}
+
+		examples = append(examples, codersdk.TemplateExample{
+			ID:          exampleID,
+			Name:        name,
+			Description: description,
+			Icon:        icon,
+			Tags:        tags,
+			Markdown:    string(frontMatter.Content),
+
+			// URL is set by examples/examples.go.
+		})
+	}
+
+	w := os.Stdout
+
+	_, err = fmt.Fprint(w, "// Code generated by examplegen. DO NOT EDIT.\n")
+	if err != nil {
+		return err
+	}
+
+	enc := json.NewEncoder(os.Stdout)
+	enc.SetIndent("", "  ")
+	return enc.Encode(examples)
+}
+
+func parseEmbedTag(s string) (string, bool) {
+	if !strings.HasPrefix(s, "//go:embed") {
+		return "", false
+	}
+	return strings.TrimSpace(strings.TrimPrefix(s, "//go:embed")), true
+}
diff --git a/scripts/gensite/generateIconList.go b/scripts/gensite/generateIconList.go
new file mode 100644
index 0000000000000..ec3f91c1abd16
--- /dev/null
+++ b/scripts/gensite/generateIconList.go
@@ -0,0 +1,60 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+)
+
+func generateIconList(path string) int {
+	if path == "" {
+		return 0 // skip
+	}
+
+	files, err := os.ReadDir("site/static/icon/")
+	if err != nil {
+		_, _ = fmt.Println("failed to read site/static/icon/ directory")
+		_, _ = fmt.Println("err:", err.Error())
+		return 71 // OSERR
+	}
+
+	icons := make([]string, len(files))
+	i := 0
+	for _, file := range files {
+		if !file.Type().IsRegular() {
+			continue
+		}
+
+		icons[i] = file.Name()
+		i++
+	}
+	icons = icons[:i]
+
+	outputFile, err := os.Create(path)
+	if err != nil {
+		_, _ = fmt.Println("failed to create file")
+		_, _ = fmt.Println("err:", err.Error())
+		return 73 // CANTCREAT
+	}
+	defer outputFile.Close()
+
+	iconsJSON, err := json.Marshal(icons)
+	if err != nil {
+		_, _ = fmt.Println("failed to serialize JSON")
+		_, _ = fmt.Println("err:", err.Error())
+		return 70 // SOFTWARE
+	}
+
+	written, err := outputFile.Write(iconsJSON)
+	if err != nil || written != len(iconsJSON) {
+		_, _ = fmt.Println("failed to write JSON")
+		if err != nil {
+			_, _ = fmt.Println("err:", err.Error())
+		}
+		return 74 // IOERR
+	}
+
+	_, _ = fmt.Println(green.Sprintf("==>"), path)
+
+	return 0
+}
diff --git a/scripts/gensite/main.go b/scripts/gensite/main.go
new file mode 100644
index 0000000000000..9b30f9224bd84
--- /dev/null
+++ b/scripts/gensite/main.go
@@ -0,0 +1,19 @@
+package main
+
+import (
+	"flag"
+	"os"
+
+	"github.com/fatih/color"
+)
+
+var green = color.New(color.FgGreen).Add(color.Bold)
+
+func main() {
+	var iconsPath string
+	flag.StringVar(&iconsPath, "icons", "", "the path to place icons.json at")
+	flag.Parse()
+
+	status := generateIconList(iconsPath)
+	os.Exit(status)
+}
diff --git a/scripts/helm.sh b/scripts/helm.sh
index 33b556f0100a1..fa3283b1ac4bb 100755
--- a/scripts/helm.sh
+++ b/scripts/helm.sh
@@ -4,15 +4,14 @@
 # .tgz file at the specified path, and may optionally push it to the Coder OSS
 # repo.
 #
-# ./helm.sh [--version 1.2.3] [--output path/to/coder.tgz] [--push]
+# ./helm.sh [--version 1.2.3] [--chart coder|provisioner] [--output path/to/coder.tgz]
 #
 # If no version is specified, defaults to the version from ./version.sh.
 #
-# If no output path is specified, defaults to
-# "$repo_root/build/coder_helm_$version.tgz".
+# If no chart is specified, defaults to 'coder'
 #
-# If the --push parameter is specified, the resulting artifact will be published
-# to the Coder OSS repo. This requires `gsutil` to be installed and configured.
+# If no output path is specified, defaults to
+# "$repo_root/build/$chart_helm_$version.tgz".
 
 set -euo pipefail
 # shellcheck source=scripts/lib.sh
@@ -20,9 +19,9 @@ source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 version=""
 output_path=""
-push=0
+chart=""
 
-args="$(getopt -o "" -l version:,output:,push -- "$@")"
+args="$(getopt -o "" -l version:,chart:,output:,push -- "$@")"
 eval set -- "$args"
 while true; do
 	case "$1" in
@@ -30,14 +29,14 @@ while true; do
 		version="$2"
 		shift 2
 		;;
+	--chart)
+		chart="$2"
+		shift 2
+		;;
 	--output)
 		output_path="$(realpath "$2")"
 		shift 2
 		;;
-	--push)
-		push="1"
-		shift
-		;;
 	--)
 		shift
 		break
@@ -54,10 +53,17 @@ if [[ "$version" == "" ]]; then
 	version="$(execrelative ./version.sh)"
 fi
 
+if [[ "$chart" == "" ]]; then
+	chart="coder"
+fi
+if ! [[ "$chart" =~ ^(coder|provisioner)$ ]]; then
+	error "--chart value must be one of (coder, provisioner)"
+fi
+
 if [[ "$output_path" == "" ]]; then
 	cdroot
 	mkdir -p build
-	output_path="$(realpath "build/coder_helm_$version.tgz")"
+	output_path="$(realpath "build/${chart}_helm_${version}.tgz")"
 fi
 
 # Check dependencies
@@ -69,8 +75,10 @@ cdroot
 temp_dir="$(mktemp -d)"
 
 cdroot
-cd ./helm
-log "--- Packaging helm chart for version $version ($output_path)"
+cd "./helm/${chart}"
+log "--- Updating dependencies"
+helm dependency update .
+log "--- Packaging helm chart $chart for version $version ($output_path)"
 helm package \
 	--version "$version" \
 	--app-version "$version" \
@@ -80,8 +88,3 @@ helm package \
 log "Moving helm chart to $output_path"
 cp "$temp_dir"/*.tgz "$output_path"
 rm -rf "$temp_dir"
-
-if [[ "$push" == 1 ]]; then
-	log "--- Publishing helm chart..."
-	# TODO: figure out how/where we want to publish the helm chart
-fi
diff --git a/scripts/linux-pkg/coder.service b/scripts/linux-pkg/coder.service
index 4ff2cc260a9bf..32246491880d4 100644
--- a/scripts/linux-pkg/coder.service
+++ b/scripts/linux-pkg/coder.service
@@ -4,7 +4,7 @@ Documentation=https://coder.com/docs/coder-oss
 Requires=network-online.target
 After=network-online.target
 ConditionFileNotEmpty=/etc/coder.d/coder.env
-StartLimitIntervalSec=60
+StartLimitIntervalSec=10
 StartLimitBurst=3
 
 [Service]
diff --git a/scripts/metricsdocgen/main.go b/scripts/metricsdocgen/main.go
index fbeb148715c54..8589653172005 100644
--- a/scripts/metricsdocgen/main.go
+++ b/scripts/metricsdocgen/main.go
@@ -56,13 +56,13 @@ func main() {
 	}
 }
 
-func readMetrics() ([]dto.MetricFamily, error) {
+func readMetrics() ([]*dto.MetricFamily, error) {
 	f, err := os.Open(metricsFile)
 	if err != nil {
 		return nil, xerrors.New("can't open metrics file")
 	}
 
-	var metrics []dto.MetricFamily
+	var metrics []*dto.MetricFamily
 
 	decoder := expfmt.NewDecoder(f, expfmt.FmtProtoText)
 	for {
@@ -73,7 +73,7 @@ func readMetrics() ([]dto.MetricFamily, error) {
 		} else if err != nil {
 			return nil, err
 		}
-		metrics = append(metrics, m)
+		metrics = append(metrics, &m)
 	}
 
 	sort.Slice(metrics, func(i, j int) bool {
@@ -90,7 +90,7 @@ func readPrometheusDoc() ([]byte, error) {
 	return doc, nil
 }
 
-func updatePrometheusDoc(doc []byte, metricFamilies []dto.MetricFamily) ([]byte, error) {
+func updatePrometheusDoc(doc []byte, metricFamilies []*dto.MetricFamily) ([]byte, error) {
 	i := bytes.Index(doc, generatorPrefix)
 	if i < 0 {
 		return nil, xerrors.New("generator prefix tag not found")
diff --git a/scripts/migrate-ci/main.go b/scripts/migrate-ci/main.go
index 636067cf8dd9e..918fee8176e1f 100644
--- a/scripts/migrate-ci/main.go
+++ b/scripts/migrate-ci/main.go
@@ -4,8 +4,8 @@ import (
 	"database/sql"
 	"fmt"
 
-	"github.com/coder/coder/coderd/database/migrations"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd/database/migrations"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
 func main() {
diff --git a/scripts/rbacgen/main.go b/scripts/rbacgen/main.go
index ee06a49f21c31..d237227f693dc 100644
--- a/scripts/rbacgen/main.go
+++ b/scripts/rbacgen/main.go
@@ -81,7 +81,7 @@ func allResources(pkg *packages.Package) []string {
 	names := pkg.Types.Scope().Names()
 	for _, name := range names {
 		obj, ok := pkg.Types.Scope().Lookup(name).(*types.Var)
-		if ok && obj.Type().String() == "github.com/coder/coder/coderd/rbac.Object" {
+		if ok && obj.Type().String() == "github.com/coder/coder/v2/coderd/rbac.Object" {
 			resources = append(resources, obj.Name())
 		}
 	}
diff --git a/scripts/release/check_commit_metadata.sh b/scripts/release/check_commit_metadata.sh
index 7ad78992d0e0c..02a39525365d4 100755
--- a/scripts/release/check_commit_metadata.sh
+++ b/scripts/release/check_commit_metadata.sh
@@ -82,16 +82,20 @@ main() {
 			--json mergeCommit,labels,author \
 			--jq '.[] | "\( .mergeCommit.oid ) author:\( .author.login ) labels:\(["label:\( .labels[].name )"] | join(" "))"'
 	)"
-	mapfile -t pr_metadata_raw <<<"$pr_list_out"
+
 	declare -A authors labels
-	for entry in "${pr_metadata_raw[@]}"; do
-		commit_sha_long=${entry%% *}
-		commit_author=${entry#* author:}
-		commit_author=${commit_author%% *}
-		authors[$commit_sha_long]=$commit_author
-		all_labels=${entry#* labels:}
-		labels[$commit_sha_long]=$all_labels
-	done
+	if [[ -n $pr_list_out ]]; then
+		mapfile -t pr_metadata_raw <<<"$pr_list_out"
+
+		for entry in "${pr_metadata_raw[@]}"; do
+			commit_sha_long=${entry%% *}
+			commit_author=${entry#* author:}
+			commit_author=${commit_author%% *}
+			authors[$commit_sha_long]=$commit_author
+			all_labels=${entry#* labels:}
+			labels[$commit_sha_long]=$all_labels
+		done
+	fi
 
 	for commit in "${commits[@]}"; do
 		mapfile -d ' ' -t parts <<<"$commit"
diff --git a/scripts/rules.go b/scripts/rules.go
index 20d0c43f7b883..b21830bcee74b 100644
--- a/scripts/rules.go
+++ b/scripts/rules.go
@@ -29,7 +29,7 @@ import (
 // explaining why it's ok and a nolint.
 func dbauthzAuthorizationContext(m dsl.Matcher) {
 	m.Import("context")
-	m.Import("github.com/coder/coder/coderd/database/dbauthz")
+	m.Import("github.com/coder/coder/v2/coderd/database/dbauthz")
 
 	m.Match(
 		`dbauthz.$f($c)`,
@@ -43,6 +43,28 @@ func dbauthzAuthorizationContext(m dsl.Matcher) {
 		Report("Using '$f' is dangerous and should be accompanied by a comment explaining why it's ok and a nolint.")
 }
 
+// testingWithOwnerUser is a lint rule that detects potential permission bugs.
+// Calling clitest.SetupConfig with a client authenticated as the Owner user
+// can be a problem, since the CLI will be operating as that user and we may
+// miss permission bugs.
+//
+//nolint:unused,deadcode,varnamelen
+func testingWithOwnerUser(m dsl.Matcher) {
+	m.Import("testing")
+	m.Import("github.com/coder/coder/v2/cli/clitest")
+
+	m.Match(`
+	$_ := coderdtest.CreateFirstUser($t, $client)
+	$*_
+	clitest.$SetupConfig($t, $client, $_)
+	`).
+		Where(m["t"].Type.Implements("testing.TB") &&
+			m["SetupConfig"].Text.Matches("^SetupConfig$") &&
+			m.File().Name.Matches(`_test\.go$`)).
+		At(m["SetupConfig"]).
+		Report(`The CLI will be operating as the owner user, which has unrestricted permissions. Consider creating a different user.`)
+}
+
 // Use xerrors everywhere! It provides additional stacktrace info!
 //
 //nolint:unused,deadcode,varnamelen
@@ -51,8 +73,12 @@ func xerrors(m dsl.Matcher) {
 	m.Import("fmt")
 	m.Import("golang.org/x/xerrors")
 
-	m.Match("fmt.Errorf($*args)").
-		Suggest("xerrors.New($args)").
+	m.Match("fmt.Errorf($arg)").
+		Suggest("xerrors.New($arg)").
+		Report("Use xerrors to provide additional stacktrace information!")
+
+	m.Match("fmt.Errorf($arg1, $*args)").
+		Suggest("xerrors.Errorf($arg1, $args)").
 		Report("Use xerrors to provide additional stacktrace information!")
 
 	m.Match("errors.$_($msg)").
@@ -65,10 +91,10 @@ func xerrors(m dsl.Matcher) {
 //
 //nolint:unused,deadcode,varnamelen
 func databaseImport(m dsl.Matcher) {
-	m.Import("github.com/coder/coder/coderd/database")
+	m.Import("github.com/coder/coder/v2/coderd/database")
 	m.Match("database.$_").
 		Report("Do not import any database types into codersdk").
-		Where(m.File().PkgPath.Matches("github.com/coder/coder/codersdk"))
+		Where(m.File().PkgPath.Matches("github.com/coder/coder/v2/codersdk"))
 }
 
 // doNotCallTFailNowInsideGoroutine enforces not calling t.FailNow or
@@ -118,7 +144,7 @@ func doNotCallTFailNowInsideGoroutine(m dsl.Matcher) {
 func useStandardTimeoutsAndDelaysInTests(m dsl.Matcher) {
 	m.Import("github.com/stretchr/testify/require")
 	m.Import("github.com/stretchr/testify/assert")
-	m.Import("github.com/coder/coder/testutil")
+	m.Import("github.com/coder/coder/v2/testutil")
 
 	m.Match(`context.WithTimeout($ctx, $duration)`).
 		Where(m.File().Imports("testing") && !m.File().PkgPath.Matches("testutil$") && !m["duration"].Text.Matches("^testutil\\.")).
@@ -199,7 +225,7 @@ func InTx(m dsl.Matcher) {
 // and ends with punctuation.
 // There are ways around the linter, but this should work in the common cases.
 func HttpAPIErrorMessage(m dsl.Matcher) {
-	m.Import("github.com/coder/coder/coderd/httpapi")
+	m.Import("github.com/coder/coder/v2/coderd/httpapi")
 
 	isNotProperError := func(v dsl.Var) bool {
 		return v.Type.Is("string") &&
@@ -232,7 +258,7 @@ func HttpAPIErrorMessage(m dsl.Matcher) {
 // HttpAPIReturn will report a linter violation if the http function is not
 // returned after writing a response to the client.
 func HttpAPIReturn(m dsl.Matcher) {
-	m.Import("github.com/coder/coder/coderd/httpapi")
+	m.Import("github.com/coder/coder/v2/coderd/httpapi")
 
 	// Manually enumerate the httpapi function rather then a 'Where' condition
 	// as this is a bit more efficient.
@@ -391,3 +417,16 @@ func slogError(m dsl.Matcher) {
 		Where(m["name"].Const && m["value"].Type.Is("error") && !m["name"].Text.Matches(`^"internal_error"$`)).
 		Report(`Error should be logged using "slog.Error" instead.`)
 }
+
+// withTimezoneUTC ensures that we don't just sprinkle dbtestutil.WithTimezone("UTC") about
+// to work around real timezone bugs in our code.
+//
+//nolint:unused,deadcode,varnamelen
+func withTimezoneUTC(m dsl.Matcher) {
+	m.Match(
+		`dbtestutil.WithTimezone($tz)`,
+	).Where(
+		m["tz"].Text.Matches(`[uU][tT][cC]"$`),
+	).Report(`Setting database timezone to UTC may mask timezone-related bugs.`).
+		At(m["tz"])
+}
diff --git a/site/.eslintignore b/site/.eslintignore
index 46023d091348a..4909d9bf919d2 100644
--- a/site/.eslintignore
+++ b/site/.eslintignore
@@ -33,14 +33,13 @@ e2e/states/*.json
 e2e/.auth.json
 playwright-report/*
 .swc
-dist/
 
 # Make target for updating golden files (any dir).
 .gen-golden
 
 # Build
-../build/
-../dist/
+build/
+dist/
 out/
 
 # Bundle analysis
@@ -64,10 +63,19 @@ stats/
 .././scaletest/terraform/.terraform.lock.hcl
 ../scaletest/terraform/secrets.tfvars
 .terraform.tfstate.*
+
+# Nix
+result
+
+# Data dumps from unit tests
+**/*.test.sql
+
+# Filebrowser.db
+**/filebrowser.db
 # .prettierignore.include:
 # Helm templates contain variables that are invalid YAML and can't be formatted
 # by Prettier.
-../helm/templates/*.yaml
+../helm/**/templates/*.yaml
 
 # Terraform state files used in tests, these are automatically generated.
 # Example: provisioner/terraform/testdata/instance-id/instance-id.tfstate.json
@@ -80,3 +88,6 @@ stats/
 e2e/provisionerGenerated.ts
 
 **/pnpm-lock.yaml
+
+# Ignore generated JSON (e.g. examples/examples.gen.json).
+**/*.gen.json
diff --git a/site/.eslintrc.yaml b/site/.eslintrc.yaml
index f7eb30901c5a0..018bf9043d72e 100644
--- a/site/.eslintrc.yaml
+++ b/site/.eslintrc.yaml
@@ -91,6 +91,9 @@ rules:
     - allowSingleExtends: true
   "brace-style": "off"
   "curly": ["error", "all"]
+  "eslint-comments/disable-enable-pair":
+    - error
+    - allowWholeFile: true
   "eslint-comments/require-description": "error"
   eqeqeq: error
   import/default: "off"
@@ -132,6 +135,10 @@ rules:
           message:
             "You should use the Alert component provided on
             components/Alert/Alert"
+        - name: "@mui/material/Popover"
+          message:
+            "You should use the Popover component provided on
+            components/Popover/Popover"
   no-unused-vars: "off"
   "object-curly-spacing": "off"
   react-hooks/exhaustive-deps: warn
@@ -156,6 +163,7 @@ rules:
   # https://reactjs.org/blog/2020/09/22/introducing-the-new-jsx-transform.html#eslint
   react/jsx-key: error
   react/jsx-uses-react: "off"
+  react/no-unknown-property: ["error", { ignore: ["css"] }]
   react/react-in-jsx-scope: "off"
   "unicorn/explicit-length-check": "error"
   # https://github.com/jsx-eslint/eslint-plugin-react/issues/2628#issuecomment-984160944
diff --git a/site/.prettierignore b/site/.prettierignore
index 46023d091348a..4909d9bf919d2 100644
--- a/site/.prettierignore
+++ b/site/.prettierignore
@@ -33,14 +33,13 @@ e2e/states/*.json
 e2e/.auth.json
 playwright-report/*
 .swc
-dist/
 
 # Make target for updating golden files (any dir).
 .gen-golden
 
 # Build
-../build/
-../dist/
+build/
+dist/
 out/
 
 # Bundle analysis
@@ -64,10 +63,19 @@ stats/
 .././scaletest/terraform/.terraform.lock.hcl
 ../scaletest/terraform/secrets.tfvars
 .terraform.tfstate.*
+
+# Nix
+result
+
+# Data dumps from unit tests
+**/*.test.sql
+
+# Filebrowser.db
+**/filebrowser.db
 # .prettierignore.include:
 # Helm templates contain variables that are invalid YAML and can't be formatted
 # by Prettier.
-../helm/templates/*.yaml
+../helm/**/templates/*.yaml
 
 # Terraform state files used in tests, these are automatically generated.
 # Example: provisioner/terraform/testdata/instance-id/instance-id.tfstate.json
@@ -80,3 +88,6 @@ stats/
 e2e/provisionerGenerated.ts
 
 **/pnpm-lock.yaml
+
+# Ignore generated JSON (e.g. examples/examples.gen.json).
+**/*.gen.json
diff --git a/site/.prettierrc.yaml b/site/.prettierrc.yaml
index 00ada8c6db07c..036d5d5f73ada 100644
--- a/site/.prettierrc.yaml
+++ b/site/.prettierrc.yaml
@@ -2,19 +2,19 @@
 
 # This config file is used in conjunction with `.editorconfig` to specify
 # formatting for prettier-supported files. See `.editorconfig` and
-# `site/.editorconfig`for whitespace formatting options.
+# `site/.editorconfig` for whitespace formatting options.
 printWidth: 80
-semi: false
+proseWrap: always
 trailingComma: all
 useTabs: false
 tabWidth: 2
 overrides:
   - files:
       - ../README.md
+      - ../docs/api/**/*.md
+      - ../docs/cli/**/*.md
+      - ../docs/changelogs/*.md
+      - ../.github/**/*.{yaml,yml,toml}
+      - ../scripts/**/*.{yaml,yml,toml}
     options:
       proseWrap: preserve
-  - files:
-      - ./**/*.yaml
-      - ./**/*.yml
-    options:
-      proseWrap: always
diff --git a/site/.storybook/main.js b/site/.storybook/main.js
index f22249ddbfe83..172d61b22a595 100644
--- a/site/.storybook/main.js
+++ b/site/.storybook/main.js
@@ -1,3 +1,6 @@
+import turbosnap from "vite-plugin-turbosnap";
+import { mergeConfig } from "vite";
+
 module.exports = {
   stories: ["../src/**/*.stories.tsx"],
   addons: [
@@ -11,4 +14,17 @@ module.exports = {
     name: "@storybook/react-vite",
     options: {},
   },
-}
+  async viteFinal(config, { configType }) {
+    config.plugins = config.plugins || [];
+    // return the customized config
+    if (configType === "PRODUCTION") {
+      // ignore @ts-ignore because it's not in the vite types yet
+      config.plugins.push(
+        turbosnap({
+          rootDir: config.root || "",
+        }),
+      );
+    }
+    return config;
+  },
+};
diff --git a/site/.storybook/preview.jsx b/site/.storybook/preview.jsx
index 371a5007ab9d4..212abbc82cf39 100644
--- a/site/.storybook/preview.jsx
+++ b/site/.storybook/preview.jsx
@@ -1,19 +1,24 @@
-import CssBaseline from "@mui/material/CssBaseline"
-import { StyledEngineProvider, ThemeProvider } from "@mui/material/styles"
-import { withRouter } from "storybook-addon-react-router-v6"
-import { HelmetProvider } from "react-helmet-async"
-import { dark } from "../src/theme"
-import "../src/theme/globalFonts"
-import "../src/i18n"
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
+import CssBaseline from "@mui/material/CssBaseline";
+import {
+  StyledEngineProvider,
+  ThemeProvider as MuiThemeProvider,
+} from "@mui/material/styles";
+import { ThemeProvider as EmotionThemeProvider } from "@emotion/react";
+import { withRouter } from "storybook-addon-react-router-v6";
+import { HelmetProvider } from "react-helmet-async";
+import { dark } from "theme";
+import "theme/globalFonts";
+import { QueryClient, QueryClientProvider } from "react-query";
 
 export const decorators = [
   (Story) => (
     <StyledEngineProvider injectFirst>
-      <ThemeProvider theme={dark}>
-        <CssBaseline />
-        <Story />
-      </ThemeProvider>
+      <MuiThemeProvider theme={dark}>
+        <EmotionThemeProvider theme={dark}>
+          <CssBaseline />
+          <Story />
+        </EmotionThemeProvider>
+      </MuiThemeProvider>
     </StyledEngineProvider>
   ),
   withRouter,
@@ -22,16 +27,16 @@ export const decorators = [
       <HelmetProvider>
         <Story />
       </HelmetProvider>
-    )
+    );
   },
   (Story) => {
     return (
       <QueryClientProvider client={new QueryClient()}>
         <Story />
       </QueryClientProvider>
-    )
+    );
   },
-]
+];
 
 export const parameters = {
   actions: {
@@ -44,4 +49,4 @@ export const parameters = {
       date: /Date$/,
     },
   },
-}
+};
diff --git a/site/e2e/constants.ts b/site/e2e/constants.ts
index 98036d6fe73d5..f75af482c7917 100644
--- a/site/e2e/constants.ts
+++ b/site/e2e/constants.ts
@@ -1,10 +1,12 @@
 // Default port from the server
-export const defaultPort = 3000
+export const defaultPort = 3000;
+export const prometheusPort = 2114;
+export const pprofPort = 6061;
 
 // Credentials for the first user
-export const username = "admin"
-export const password = "SomeSecurePassword!"
-export const email = "admin@coder.com"
+export const username = "admin";
+export const password = "SomeSecurePassword!";
+export const email = "admin@coder.com";
 
 export const gitAuth = {
   deviceProvider: "device",
@@ -20,4 +22,4 @@ export const gitAuth = {
   codePath: "/code",
   validatePath: "/validate",
   installationsPath: "/installations",
-}
+};
diff --git a/site/e2e/global.setup.ts b/site/e2e/global.setup.ts
index 1da306c5c36cd..06ff0ff117bc9 100644
--- a/site/e2e/global.setup.ts
+++ b/site/e2e/global.setup.ts
@@ -1,18 +1,19 @@
-import { test, expect } from "@playwright/test"
-import * as constants from "./constants"
-import { STORAGE_STATE } from "./playwright.config"
-import { Language } from "../src/components/CreateUserForm/CreateUserForm"
+import { test, expect } from "@playwright/test";
+import * as constants from "./constants";
+import { STORAGE_STATE } from "./playwright.config";
+import { Language } from "pages/CreateUserPage/CreateUserForm";
 
 test("create first user", async ({ page }) => {
-  await page.goto("/", { waitUntil: "networkidle" })
+  await page.goto("/", { waitUntil: "domcontentloaded" });
 
-  await page.getByLabel(Language.usernameLabel).fill(constants.username)
-  await page.getByLabel(Language.emailLabel).fill(constants.email)
-  await page.getByLabel(Language.passwordLabel).fill(constants.password)
-  await page.getByTestId("trial").click()
-  await page.getByTestId("create").click()
+  await page.getByLabel(Language.usernameLabel).fill(constants.username);
+  await page.getByLabel(Language.emailLabel).fill(constants.email);
+  await page.getByLabel(Language.passwordLabel).fill(constants.password);
+  await page.getByTestId("trial").click();
+  await page.getByTestId("create").click();
 
-  await expect(page).toHaveURL("/workspaces")
+  await expect(page).toHaveURL(/\/workspaces.*/);
+  await page.context().storageState({ path: STORAGE_STATE });
 
-  await page.context().storageState({ path: STORAGE_STATE })
-})
+  await page.getByTestId("button-select-template").isVisible();
+});
diff --git a/site/e2e/helpers.ts b/site/e2e/helpers.ts
index dfbd5f99896a2..1e54d84b8082b 100644
--- a/site/e2e/helpers.ts
+++ b/site/e2e/helpers.ts
@@ -1,40 +1,115 @@
-import { expect, Page } from "@playwright/test"
-import { spawn } from "child_process"
-import { randomUUID } from "crypto"
-import path from "path"
-import express from "express"
-import { TarWriter } from "utils/tar"
+import { expect, Page } from "@playwright/test";
+import { ChildProcess, exec, spawn } from "child_process";
+import { randomUUID } from "crypto";
+import path from "path";
+import express from "express";
+import { TarWriter } from "utils/tar";
 import {
   Agent,
   App,
   AppSharingLevel,
-  Parse_Complete,
-  Parse_Response,
-  Provision_Complete,
-  Provision_Response,
+  Response,
+  ParseComplete,
+  PlanComplete,
+  ApplyComplete,
   Resource,
-} from "./provisionerGenerated"
-import { port } from "./playwright.config"
-import * as ssh from "ssh2"
-import { Duplex } from "stream"
+  RichParameter,
+} from "./provisionerGenerated";
+import { prometheusPort, pprofPort } from "./constants";
+import { port } from "./playwright.config";
+import * as ssh from "ssh2";
+import { Duplex } from "stream";
+import { WorkspaceBuildParameter } from "api/typesGenerated";
+import axios from "axios";
 
 // createWorkspace creates a workspace for a template.
 // It does not wait for it to be running, but it does navigate to the page.
 export const createWorkspace = async (
   page: Page,
   templateName: string,
+  richParameters: RichParameter[] = [],
+  buildParameters: WorkspaceBuildParameter[] = [],
 ): Promise<string> => {
   await page.goto("/templates/" + templateName + "/workspace", {
-    waitUntil: "networkidle",
-  })
-  const name = randomName()
-  await page.getByLabel("name").fill(name)
-  await page.getByTestId("form-submit").click()
-
-  await expect(page).toHaveURL("/@admin/" + name)
-  await page.getByTestId("build-status").isVisible()
-  return name
-}
+    waitUntil: "domcontentloaded",
+  });
+  await expect(page).toHaveURL("/templates/" + templateName + "/workspace");
+
+  const name = randomName();
+  await page.getByLabel("name").fill(name);
+
+  await fillParameters(page, richParameters, buildParameters);
+  await page.getByTestId("form-submit").click();
+
+  await expect(page).toHaveURL("/@admin/" + name);
+
+  await page.waitForSelector(
+    "span[data-testid='build-status'] >> text=Running",
+    {
+      state: "visible",
+    },
+  );
+  return name;
+};
+
+export const verifyParameters = async (
+  page: Page,
+  workspaceName: string,
+  richParameters: RichParameter[],
+  expectedBuildParameters: WorkspaceBuildParameter[],
+) => {
+  await page.goto("/@admin/" + workspaceName + "/settings/parameters", {
+    waitUntil: "domcontentloaded",
+  });
+  await expect(page).toHaveURL(
+    "/@admin/" + workspaceName + "/settings/parameters",
+  );
+
+  for (const buildParameter of expectedBuildParameters) {
+    const richParameter = richParameters.find(
+      (richParam) => richParam.name === buildParameter.name,
+    );
+    if (!richParameter) {
+      throw new Error(
+        "build parameter is expected to be present in rich parameter schema",
+      );
+    }
+
+    const parameterLabel = await page.waitForSelector(
+      "[data-testid='parameter-field-" + richParameter.name + "']",
+      { state: "visible" },
+    );
+
+    const muiDisabled = richParameter.mutable ? "" : ".Mui-disabled";
+
+    if (richParameter.type === "bool") {
+      const parameterField = await parameterLabel.waitForSelector(
+        "[data-testid='parameter-field-bool'] .MuiRadio-root.Mui-checked" +
+          muiDisabled +
+          " input",
+      );
+      const value = await parameterField.inputValue();
+      expect(value).toEqual(buildParameter.value);
+    } else if (richParameter.options.length > 0) {
+      const parameterField = await parameterLabel.waitForSelector(
+        "[data-testid='parameter-field-options'] .MuiRadio-root.Mui-checked" +
+          muiDisabled +
+          " input",
+      );
+      const value = await parameterField.inputValue();
+      expect(value).toEqual(buildParameter.value);
+    } else if (richParameter.type === "list(string)") {
+      throw new Error("not implemented yet"); // FIXME
+    } else {
+      // text or number
+      const parameterField = await parameterLabel.waitForSelector(
+        "[data-testid='parameter-field-text'] input" + muiDisabled,
+      );
+      const value = await parameterField.inputValue();
+      expect(value).toEqual(buildParameter.value);
+    }
+  }
+};
 
 // createTemplate navigates to the /templates/new page and uploads a template
 // with the resources provided in the responses argument.
@@ -45,72 +120,123 @@ export const createTemplate = async (
   // Required to have templates submit their provisioner type as echo!
   await page.addInitScript({
     content: "window.playwright = true",
-  })
-  await page.goto("/templates/new", { waitUntil: "networkidle" })
+  });
+
+  await page.goto("/templates/new", { waitUntil: "domcontentloaded" });
+  await expect(page).toHaveURL("/templates/new");
+
   await page.getByTestId("file-upload").setInputFiles({
     buffer: await createTemplateVersionTar(responses),
     mimeType: "application/x-tar",
     name: "template.tar",
-  })
-  const name = randomName()
-  await page.getByLabel("Name *").fill(name)
-  await page.getByTestId("form-submit").click()
+  });
+  const name = randomName();
+  await page.getByLabel("Name *").fill(name);
+  await page.getByTestId("form-submit").click();
   await expect(page).toHaveURL("/templates/" + name, {
     timeout: 30000,
-  })
-  return name
-}
+  });
+  return name;
+};
 
 // sshIntoWorkspace spawns a Coder SSH process and a client connected to it.
 export const sshIntoWorkspace = async (
   page: Page,
   workspace: string,
+  binaryPath = "go",
+  binaryArgs: string[] = [],
 ): Promise<ssh.Client> => {
-  const sessionToken = await findSessionToken(page)
+  if (binaryPath === "go") {
+    binaryArgs = ["run", coderMainPath()];
+  }
+  const sessionToken = await findSessionToken(page);
   return new Promise<ssh.Client>((resolve, reject) => {
-    const cp = spawn(
-      "go",
-      ["run", coderMainPath(), "ssh", "--stdio", workspace],
-      {
-        env: {
-          ...process.env,
-          CODER_SESSION_TOKEN: sessionToken,
-          CODER_URL: "http://localhost:3000",
-        },
+    const cp = spawn(binaryPath, [...binaryArgs, "ssh", "--stdio", workspace], {
+      env: {
+        ...process.env,
+        CODER_SESSION_TOKEN: sessionToken,
+        CODER_URL: "http://localhost:3000",
       },
-    )
-    cp.on("error", (err) => reject(err))
+    });
+    cp.on("error", (err) => reject(err));
     const proxyStream = new Duplex({
       read: (size) => {
-        return cp.stdout.read(Math.min(size, cp.stdout.readableLength))
+        return cp.stdout.read(Math.min(size, cp.stdout.readableLength));
       },
       write: cp.stdin.write.bind(cp.stdin),
-    })
+    });
     // eslint-disable-next-line no-console -- Helpful for debugging
-    cp.stderr.on("data", (data) => console.log(data.toString()))
+    cp.stderr.on("data", (data) => console.log(data.toString()));
     cp.stdout.on("readable", (...args) => {
-      proxyStream.emit("readable", ...args)
+      proxyStream.emit("readable", ...args);
       if (cp.stdout.readableLength > 0) {
-        proxyStream.emit("data", cp.stdout.read())
+        proxyStream.emit("data", cp.stdout.read());
       }
-    })
-    const client = new ssh.Client()
+    });
+    const client = new ssh.Client();
     client.connect({
       sock: proxyStream,
       username: "coder",
-    })
-    client.on("error", (err) => reject(err))
+    });
+    client.on("error", (err) => reject(err));
     client.on("ready", () => {
-      resolve(client)
-    })
-  })
-}
+      resolve(client);
+    });
+  });
+};
+
+export const stopWorkspace = async (page: Page, workspaceName: string) => {
+  await page.goto("/@admin/" + workspaceName, {
+    waitUntil: "domcontentloaded",
+  });
+  await expect(page).toHaveURL("/@admin/" + workspaceName);
+
+  await page.getByTestId("workspace-stop-button").click();
+
+  await page.waitForSelector(
+    "span[data-testid='build-status'] >> text=Stopped",
+    {
+      state: "visible",
+    },
+  );
+};
+
+export const buildWorkspaceWithParameters = async (
+  page: Page,
+  workspaceName: string,
+  richParameters: RichParameter[] = [],
+  buildParameters: WorkspaceBuildParameter[] = [],
+  confirm: boolean = false,
+) => {
+  await page.goto("/@admin/" + workspaceName, {
+    waitUntil: "domcontentloaded",
+  });
+  await expect(page).toHaveURL("/@admin/" + workspaceName);
+
+  await page.getByTestId("build-parameters-button").click();
+
+  await fillParameters(page, richParameters, buildParameters);
+  await page.getByTestId("build-parameters-submit").click();
+  if (confirm) {
+    await page.getByTestId("confirm-button").click();
+  }
+
+  await page.waitForSelector(
+    "span[data-testid='build-status'] >> text=Running",
+    {
+      state: "visible",
+    },
+  );
+};
 
 // startAgent runs the coder agent with the provided token.
 // It awaits the agent to be ready before returning.
-export const startAgent = async (page: Page, token: string): Promise<void> => {
-  return startAgentWithCommand(page, token, "go", "run", coderMainPath())
-}
+export const startAgent = async (
+  page: Page,
+  token: string,
+): Promise<ChildProcess> => {
+  return startAgentWithCommand(page, token, "go", "run", coderMainPath());
+};
 
 // downloadCoderVersion downloads the version provided into a temporary dir and
 // caches it so subsequent calls are fast.
@@ -118,38 +244,30 @@ export const downloadCoderVersion = async (
   version: string,
 ): Promise<string> => {
   if (version.startsWith("v")) {
-    version = version.slice(1)
+    version = version.slice(1);
   }
 
-  const binaryName = "coder-e2e-" + version
-  const tempDir = "/tmp"
+  const binaryName = "coder-e2e-" + version;
+  const tempDir = "/tmp/coder-e2e-cache";
   // The install script adds `./bin` automatically to the path :shrug:
-  const binaryPath = path.join(tempDir, "bin", binaryName)
+  const binaryPath = path.join(tempDir, "bin", binaryName);
 
   const exists = await new Promise<boolean>((resolve) => {
-    const cp = spawn(binaryPath, ["version"])
+    const cp = spawn(binaryPath, ["version"]);
     cp.on("close", (code) => {
-      resolve(code === 0)
-    })
-    cp.on("error", () => resolve(false))
-  })
+      resolve(code === 0);
+    });
+    cp.on("error", () => resolve(false));
+  });
   if (exists) {
-    return binaryPath
+    return binaryPath;
   }
 
-  // Runs our public install script using our options to
-  // install the binary!
+  // Run our official install script to install the binary
   await new Promise<void>((resolve, reject) => {
-    const cp = spawn("sh", [
-      "-c",
+    const cp = spawn(
+      path.join(__dirname, "../../install.sh"),
       [
-        "curl",
-        "-L",
-        "https://coder.com/install.sh",
-        "|",
-        "sh",
-        "-s",
-        "--",
         "--version",
         version,
         "--method",
@@ -158,45 +276,93 @@ export const downloadCoderVersion = async (
         tempDir,
         "--binary-name",
         binaryName,
-      ].join(" "),
-    ])
+      ],
+      {
+        env: {
+          ...process.env,
+          XDG_CACHE_HOME: "/tmp/coder-e2e-cache",
+          TRACE: "1", // tells install.sh to `set -x`, helpful if something goes wrong
+        },
+      },
+    );
     // eslint-disable-next-line no-console -- Needed for debugging
-    cp.stderr.on("data", (data) => console.log(data.toString()))
+    cp.stderr.on("data", (data) => console.error(data.toString()));
+    // eslint-disable-next-line no-console -- Needed for debugging
+    cp.stdout.on("data", (data) => console.log(data.toString()));
     cp.on("close", (code) => {
       if (code === 0) {
-        resolve()
+        resolve();
       } else {
-        reject(new Error("curl failed with code " + code))
+        reject(new Error("install.sh failed with code " + code));
       }
-    })
-  })
-  return binaryPath
-}
+    });
+  });
+  return binaryPath;
+};
 
 export const startAgentWithCommand = async (
   page: Page,
   token: string,
   command: string,
   ...args: string[]
-): Promise<void> => {
+): Promise<ChildProcess> => {
   const cp = spawn(command, [...args, "agent", "--no-reap"], {
     env: {
       ...process.env,
       CODER_AGENT_URL: "http://localhost:" + port,
       CODER_AGENT_TOKEN: token,
+      CODER_AGENT_PPROF_ADDRESS: "127.0.0.1:" + pprofPort,
+      CODER_AGENT_PROMETHEUS_ADDRESS: "127.0.0.1:" + prometheusPort,
     },
-  })
-  let buffer = Buffer.of()
+  });
+  cp.stdout.on("data", (data: Buffer) => {
+    // eslint-disable-next-line no-console -- Log agent activity
+    console.log(
+      `[agent] [stdout] [onData] ${data.toString().replace(/\n$/g, "")}`,
+    );
+  });
   cp.stderr.on("data", (data: Buffer) => {
-    buffer = Buffer.concat([buffer, data])
-  })
-  try {
-    await page.getByTestId("agent-status-ready").isVisible()
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- The error is a string
-  } catch (ex: any) {
-    throw new Error(ex.toString() + "\n" + buffer.toString())
+    // eslint-disable-next-line no-console -- Log agent activity
+    console.log(
+      `[agent] [stderr] [onData] ${data.toString().replace(/\n$/g, "")}`,
+    );
+  });
+
+  await page.getByTestId("agent-status-ready").waitFor({ state: "visible" });
+  return cp;
+};
+
+export const stopAgent = async (cp: ChildProcess, goRun: boolean = true) => {
+  // When the web server is started with `go run`, it spawns a child process with coder server.
+  // `pkill -P` terminates child processes belonging the same group as `go run`.
+  // The command `kill` is used to terminate a web server started as a standalone binary.
+  exec(goRun ? `pkill -P ${cp.pid}` : `kill ${cp.pid}`, (error) => {
+    if (error) {
+      throw new Error(`exec error: ${JSON.stringify(error)}`);
+    }
+  });
+  await waitUntilUrlIsNotResponding("http://localhost:" + prometheusPort);
+};
+
+const waitUntilUrlIsNotResponding = async (url: string) => {
+  const maxRetries = 30;
+  const retryIntervalMs = 1000;
+  let retries = 0;
+
+  while (retries < maxRetries) {
+    try {
+      await axios.get(url);
+    } catch (error) {
+      return;
+    }
+
+    retries++;
+    await new Promise((resolve) => setTimeout(resolve, retryIntervalMs));
   }
-}
+  throw new Error(
+    `URL ${url} is still responding after ${maxRetries * retryIntervalMs}ms`,
+  );
+};
 
 const coderMainPath = (): string => {
   return path.join(
@@ -207,8 +373,8 @@ const coderMainPath = (): string => {
     "cmd",
     "coder",
     "main.go",
-  )
-}
+  );
+};
 
 // Allows users to more easily define properties they want for agents and resources!
 type RecursivePartial<T> = {
@@ -216,16 +382,16 @@ type RecursivePartial<T> = {
     ? RecursivePartial<U>[]
     : T[P] extends object | undefined
     ? RecursivePartial<T[P]>
-    : T[P]
-}
+    : T[P];
+};
 
 interface EchoProvisionerResponses {
   // parse is for observing any Terraform variables
-  parse?: RecursivePartial<Parse_Response>[]
+  parse?: RecursivePartial<Response>[];
   // plan occurs when the template is imported
-  plan?: RecursivePartial<Provision_Response>[]
+  plan?: RecursivePartial<Response>[];
   // apply occurs when the workspace is built
-  apply?: RecursivePartial<Provision_Response>[]
+  apply?: RecursivePartial<Response>[];
 }
 
 // createTemplateVersionTar consumes a series of echo provisioner protobufs and
@@ -234,160 +400,360 @@ const createTemplateVersionTar = async (
   responses?: EchoProvisionerResponses,
 ): Promise<Buffer> => {
   if (!responses) {
-    responses = {}
+    responses = {};
   }
   if (!responses.parse) {
-    responses.parse = [{}]
+    responses.parse = [
+      {
+        parse: {},
+      },
+    ];
   }
   if (!responses.apply) {
-    responses.apply = [{}]
+    responses.apply = [
+      {
+        apply: {},
+      },
+    ];
   }
   if (!responses.plan) {
-    responses.plan = responses.apply
+    responses.plan = responses.apply.map((response) => {
+      if (response.log) {
+        return response;
+      }
+      return {
+        plan: {
+          error: response.apply?.error ?? "",
+          resources: response.apply?.resources ?? [],
+          parameters: response.apply?.parameters ?? [],
+          externalAuthProviders: response.apply?.externalAuthProviders ?? [],
+        },
+      };
+    });
   }
 
-  const tar = new TarWriter()
+  const tar = new TarWriter();
   responses.parse.forEach((response, index) => {
-    response.complete = {
+    response.parse = {
       templateVariables: [],
-      ...response.complete,
-    } as Parse_Complete
+      error: "",
+      readme: new Uint8Array(),
+      ...response.parse,
+    } as ParseComplete;
     tar.addFile(
       `${index}.parse.protobuf`,
-      Parse_Response.encode(response as Parse_Response).finish(),
-    )
-  })
-
-  const fillProvisionResponse = (
-    response: RecursivePartial<Provision_Response>,
-  ) => {
-    response.complete = {
+      Response.encode(response as Response).finish(),
+    );
+  });
+
+  const fillResource = (resource: RecursivePartial<Resource>) => {
+    if (resource.agents) {
+      resource.agents = resource.agents?.map(
+        (agent: RecursivePartial<Agent>) => {
+          if (agent.apps) {
+            agent.apps = agent.apps?.map((app: RecursivePartial<App>) => {
+              return {
+                command: "",
+                displayName: "example",
+                external: false,
+                icon: "",
+                sharingLevel: AppSharingLevel.PUBLIC,
+                slug: "example",
+                subdomain: false,
+                url: "",
+                ...app,
+              } as App;
+            });
+          }
+          return {
+            apps: [],
+            architecture: "amd64",
+            connectionTimeoutSeconds: 300,
+            directory: "",
+            env: {},
+            id: randomUUID(),
+            metadata: [],
+            scripts: [],
+            motdFile: "",
+            name: "dev",
+            operatingSystem: "linux",
+            shutdownScript: "",
+            shutdownScriptTimeoutSeconds: 0,
+            startupScript: "",
+            startupScriptBehavior: "",
+            startupScriptTimeoutSeconds: 300,
+            troubleshootingUrl: "",
+            token: randomUUID(),
+            ...agent,
+          } as Agent;
+        },
+      );
+    }
+    return {
+      agents: [],
+      dailyCost: 0,
+      hide: false,
+      icon: "",
+      instanceType: "",
+      metadata: [],
+      name: "dev",
+      type: "echo",
+      ...resource,
+    } as Resource;
+  };
+
+  responses.apply.forEach((response, index) => {
+    response.apply = {
       error: "",
       state: new Uint8Array(),
       resources: [],
       parameters: [],
-      gitAuthProviders: [],
-      plan: new Uint8Array(),
-      ...response.complete,
-    } as Provision_Complete
-    response.complete.resources = response.complete.resources?.map(
-      (resource) => {
-        if (resource.agents) {
-          resource.agents = resource.agents?.map((agent) => {
-            if (agent.apps) {
-              agent.apps = agent.apps?.map((app) => {
-                return {
-                  command: "",
-                  displayName: "example",
-                  external: false,
-                  icon: "",
-                  sharingLevel: AppSharingLevel.PUBLIC,
-                  slug: "example",
-                  subdomain: false,
-                  url: "",
-                  ...app,
-                } as App
-              })
-            }
-            return {
-              apps: [],
-              architecture: "amd64",
-              connectionTimeoutSeconds: 300,
-              directory: "",
-              env: {},
-              id: randomUUID(),
-              metadata: [],
-              motdFile: "",
-              name: "dev",
-              operatingSystem: "linux",
-              shutdownScript: "",
-              shutdownScriptTimeoutSeconds: 0,
-              startupScript: "",
-              startupScriptBehavior: "",
-              startupScriptTimeoutSeconds: 300,
-              troubleshootingUrl: "",
-              token: randomUUID(),
-              ...agent,
-            } as Agent
-          })
-        }
-        return {
-          agents: [],
-          dailyCost: 0,
-          hide: false,
-          icon: "",
-          instanceType: "",
-          metadata: [],
-          name: "dev",
-          type: "echo",
-          ...resource,
-        } as Resource
-      },
-    )
-  }
-
-  responses.apply.forEach((response, index) => {
-    fillProvisionResponse(response)
+      externalAuthProviders: [],
+      ...response.apply,
+    } as ApplyComplete;
+    response.apply.resources = response.apply.resources?.map(fillResource);
 
     tar.addFile(
-      `${index}.provision.apply.protobuf`,
-      Provision_Response.encode(response as Provision_Response).finish(),
-    )
-  })
+      `${index}.apply.protobuf`,
+      Response.encode(response as Response).finish(),
+    );
+  });
   responses.plan.forEach((response, index) => {
-    fillProvisionResponse(response)
+    response.plan = {
+      error: "",
+      resources: [],
+      parameters: [],
+      externalAuthProviders: [],
+      ...response.plan,
+    } as PlanComplete;
+    response.plan.resources = response.plan.resources?.map(fillResource);
 
     tar.addFile(
-      `${index}.provision.plan.protobuf`,
-      Provision_Response.encode(response as Provision_Response).finish(),
-    )
-  })
-  const tarFile = await tar.write()
+      `${index}.plan.protobuf`,
+      Response.encode(response as Response).finish(),
+    );
+  });
+  const tarFile = await tar.write();
   return Buffer.from(
     tarFile instanceof Blob ? await tarFile.arrayBuffer() : tarFile,
-  )
-}
+  );
+};
 
 const randomName = () => {
-  return randomUUID().slice(0, 8)
-}
+  return randomUUID().slice(0, 8);
+};
 
 // Awaiter is a helper that allows you to wait for a callback to be called.
 // It is useful for waiting for events to occur.
 export class Awaiter {
-  private promise: Promise<void>
-  private callback?: () => void
+  private promise: Promise<void>;
+  private callback?: () => void;
 
   constructor() {
-    this.promise = new Promise((r) => (this.callback = r))
+    this.promise = new Promise((r) => (this.callback = r));
   }
 
   public done(): void {
     if (this.callback) {
-      this.callback()
+      this.callback();
     } else {
-      this.promise = Promise.resolve()
+      this.promise = Promise.resolve();
     }
   }
 
   public wait(): Promise<void> {
-    return this.promise
+    return this.promise;
   }
 }
 
 export const createServer = async (
   port: number,
 ): Promise<ReturnType<typeof express>> => {
-  const e = express()
-  await new Promise<void>((r) => e.listen(port, r))
-  return e
-}
+  const e = express();
+  // We need to specify the local IP address as the web server
+  // tends to fail with IPv6 related error:
+  // listen EADDRINUSE: address already in use :::50516
+  await new Promise<void>((r) => e.listen(port, "0.0.0.0", r));
+  return e;
+};
 
 const findSessionToken = async (page: Page): Promise<string> => {
-  const cookies = await page.context().cookies()
-  const sessionCookie = cookies.find((c) => c.name === "coder_session_token")
+  const cookies = await page.context().cookies();
+  const sessionCookie = cookies.find((c) => c.name === "coder_session_token");
   if (!sessionCookie) {
-    throw new Error("session token not found")
+    throw new Error("session token not found");
   }
-  return sessionCookie.value
-}
+  return sessionCookie.value;
+};
+
+export const echoResponsesWithParameters = (
+  richParameters: RichParameter[],
+): EchoProvisionerResponses => {
+  return {
+    parse: [
+      {
+        parse: {},
+      },
+    ],
+    plan: [
+      {
+        plan: {
+          parameters: richParameters,
+        },
+      },
+    ],
+    apply: [
+      {
+        apply: {
+          resources: [
+            {
+              name: "example",
+            },
+          ],
+        },
+      },
+    ],
+  };
+};
+
+export const fillParameters = async (
+  page: Page,
+  richParameters: RichParameter[] = [],
+  buildParameters: WorkspaceBuildParameter[] = [],
+) => {
+  for (const buildParameter of buildParameters) {
+    const richParameter = richParameters.find(
+      (richParam) => richParam.name === buildParameter.name,
+    );
+    if (!richParameter) {
+      throw new Error(
+        "build parameter is expected to be present in rich parameter schema",
+      );
+    }
+
+    const parameterLabel = await page.waitForSelector(
+      "[data-testid='parameter-field-" + richParameter.name + "']",
+      { state: "visible" },
+    );
+
+    if (richParameter.type === "bool") {
+      const parameterField = await parameterLabel.waitForSelector(
+        "[data-testid='parameter-field-bool'] .MuiRadio-root input[value='" +
+          buildParameter.value +
+          "']",
+      );
+      await parameterField.check();
+    } else if (richParameter.options.length > 0) {
+      const parameterField = await parameterLabel.waitForSelector(
+        "[data-testid='parameter-field-options'] .MuiRadio-root input[value='" +
+          buildParameter.value +
+          "']",
+      );
+      await parameterField.check();
+    } else if (richParameter.type === "list(string)") {
+      throw new Error("not implemented yet"); // FIXME
+    } else {
+      // text or number
+      const parameterField = await parameterLabel.waitForSelector(
+        "[data-testid='parameter-field-text'] input",
+      );
+      await parameterField.fill(buildParameter.value);
+    }
+  }
+};
+
+export const updateTemplate = async (
+  page: Page,
+  templateName: string,
+  responses?: EchoProvisionerResponses,
+) => {
+  const tarball = await createTemplateVersionTar(responses);
+
+  const sessionToken = await findSessionToken(page);
+  const child = spawn(
+    "go",
+    [
+      "run",
+      coderMainPath(),
+      "templates",
+      "push",
+      "--test.provisioner",
+      "echo",
+      "-y",
+      "-d",
+      "-",
+      templateName,
+    ],
+    {
+      env: {
+        ...process.env,
+        CODER_SESSION_TOKEN: sessionToken,
+        CODER_URL: "http://localhost:3000",
+      },
+    },
+  );
+
+  const uploaded = new Awaiter();
+  child.on("exit", (code) => {
+    if (code === 0) {
+      uploaded.done();
+      return;
+    }
+
+    throw new Error(`coder templates push failed with code ${code}`);
+  });
+
+  child.stdin.write(tarball);
+  child.stdin.end();
+
+  await uploaded.wait();
+};
+
+export const updateWorkspace = async (
+  page: Page,
+  workspaceName: string,
+  richParameters: RichParameter[] = [],
+  buildParameters: WorkspaceBuildParameter[] = [],
+) => {
+  await page.goto("/@admin/" + workspaceName, {
+    waitUntil: "domcontentloaded",
+  });
+  await expect(page).toHaveURL("/@admin/" + workspaceName);
+
+  await page.getByTestId("workspace-update-button").click();
+  await page.getByTestId("confirm-button").click();
+
+  await fillParameters(page, richParameters, buildParameters);
+  await page.getByTestId("form-submit").click();
+
+  await page.waitForSelector(
+    "span[data-testid='build-status'] >> text=Running",
+    {
+      state: "visible",
+    },
+  );
+};
+
+export const updateWorkspaceParameters = async (
+  page: Page,
+  workspaceName: string,
+  richParameters: RichParameter[] = [],
+  buildParameters: WorkspaceBuildParameter[] = [],
+) => {
+  await page.goto("/@admin/" + workspaceName + "/settings/parameters", {
+    waitUntil: "domcontentloaded",
+  });
+  await expect(page).toHaveURL(
+    "/@admin/" + workspaceName + "/settings/parameters",
+  );
+
+  await fillParameters(page, richParameters, buildParameters);
+  await page.getByTestId("form-submit").click();
+
+  await page.waitForSelector(
+    "span[data-testid='build-status'] >> text=Running",
+    {
+      state: "visible",
+    },
+  );
+};
diff --git a/site/e2e/hooks.ts b/site/e2e/hooks.ts
new file mode 100644
index 0000000000000..cd5847ba967de
--- /dev/null
+++ b/site/e2e/hooks.ts
@@ -0,0 +1,53 @@
+import { Page } from "@playwright/test";
+
+export const beforeCoderTest = async (page: Page) => {
+  // eslint-disable-next-line no-console -- Show everything that was printed with console.log()
+  page.on("console", (msg) => console.log("[onConsole] " + msg.text()));
+
+  page.on("request", (request) => {
+    if (!isApiCall(request.url())) {
+      return;
+    }
+
+    // eslint-disable-next-line no-console -- Log HTTP requests for debugging purposes
+    console.log(
+      `[onRequest] method=${request.method()} url=${request.url()} postData=${
+        request.postData() ? request.postData() : ""
+      }`,
+    );
+  });
+  page.on("response", async (response) => {
+    if (!isApiCall(response.url())) {
+      return;
+    }
+
+    const shouldLogResponse =
+      !response.url().endsWith("/api/v2/deployment/config") &&
+      !response.url().endsWith("/api/v2/debug/health");
+
+    let responseText = "";
+    try {
+      if (shouldLogResponse) {
+        const buffer = await response.body();
+        responseText = buffer.toString("utf-8");
+        responseText = responseText.replace(/\n$/g, "");
+      } else {
+        responseText = "skipped...";
+      }
+    } catch (error) {
+      responseText = "not_available";
+    }
+
+    // eslint-disable-next-line no-console -- Log HTTP requests for debugging purposes
+    console.log(
+      `[onResponse] url=${response.url()} status=${response.status()} body=${responseText}`,
+    );
+  });
+};
+
+const isApiCall = (urlString: string): boolean => {
+  const url = new URL(urlString);
+  const apiPath = "/api/v2";
+
+  return url.pathname.startsWith(apiPath);
+};
diff --git a/site/e2e/parameters.ts b/site/e2e/parameters.ts
new file mode 100644
index 0000000000000..c1477fad4c59e
--- /dev/null
+++ b/site/e2e/parameters.ts
@@ -0,0 +1,156 @@
+import { RichParameter } from "./provisionerGenerated";
+
+// Rich parameters
+
+const emptyParameter: RichParameter = {
+  name: "",
+  description: "",
+  type: "",
+  mutable: false,
+  defaultValue: "",
+  icon: "",
+  options: [],
+  validationRegex: "",
+  validationError: "",
+  validationMin: undefined,
+  validationMax: undefined,
+  validationMonotonic: "",
+  required: false,
+  displayName: "",
+  order: 0,
+  ephemeral: false,
+};
+
+// firstParameter is mutable string with a default value (parameter value not required).
+export const firstParameter: RichParameter = {
+  ...emptyParameter,
+
+  name: "first_parameter",
+  displayName: "First parameter",
+  type: "number",
+  description: "This is first parameter.",
+  icon: "/emojis/1f310.png",
+  defaultValue: "123",
+  mutable: true,
+  order: 1,
+};
+
+// secondParameter is immutable string with a default value (parameter value not required).
+export const secondParameter: RichParameter = {
+  ...emptyParameter,
+
+  name: "second_parameter",
+  displayName: "Second parameter",
+  type: "string",
+  description: "This is second parameter.",
+  defaultValue: "abc",
+  order: 2,
+};
+
+// thirdParameter is mutable string with an empty default value (parameter value not required).
+export const thirdParameter: RichParameter = {
+  ...emptyParameter,
+
+  name: "third_parameter",
+  type: "string",
+  description: "This is third parameter.",
+  defaultValue: "",
+  mutable: true,
+  order: 3,
+};
+
+// fourthParameter is immutable boolean with a default "true" value (parameter value not required).
+export const fourthParameter: RichParameter = {
+  ...emptyParameter,
+
+  name: "fourth_parameter",
+  type: "bool",
+  description: "This is fourth parameter.",
+  defaultValue: "true",
+  order: 3,
+};
+
+// fifthParameter is immutable "string with options", with a default option selected (parameter value not required).
+export const fifthParameter: RichParameter = {
+  ...emptyParameter,
+
+  name: "fifth_parameter",
+  displayName: "Fifth parameter",
+  type: "string",
+  options: [
+    {
+      name: "ABC",
+      description: "This is ABC",
+      value: "abc",
+      icon: "",
+    },
+    {
+      name: "DEF",
+      description: "This is DEF",
+      value: "def",
+      icon: "",
+    },
+    {
+      name: "GHI",
+      description: "This is GHI",
+      value: "ghi",
+      icon: "",
+    },
+  ],
+  description: "This is fifth parameter.",
+  defaultValue: "def",
+  order: 3,
+};
+
+// sixthParameter is mutable string without a default value (parameter value is required).
+export const sixthParameter: RichParameter = {
+  ...emptyParameter,
+
+  name: "sixth_parameter",
+  displayName: "Sixth parameter",
+  type: "number",
+  description: "This is sixth parameter.",
+  icon: "/emojis/1f310.png",
+  required: true,
+  mutable: true,
+  order: 1,
+};
+
+// seventhParameter is immutable string without a default value (parameter value is required).
+export const seventhParameter: RichParameter = {
+  ...emptyParameter,
+
+  name: "seventh_parameter",
+  displayName: "Seventh parameter",
+  type: "string",
+  description: "This is seventh parameter.",
+  required: true,
+  order: 1,
+};
+
+// Build options
+
+export const firstBuildOption: RichParameter = {
+  ...emptyParameter,
+
+  name: "first_build_option",
+  displayName: "First build option",
+  type: "string",
+  description: "This is first build option.",
+  icon: "/emojis/1f310.png",
+  defaultValue: "ABCDEF",
+  mutable: true,
+  ephemeral: true,
+};
+
+export const secondBuildOption: RichParameter = {
+  ...emptyParameter,
+
+  name: "second_build_option",
+  displayName: "Second build option",
+  type: "bool",
+  description: "This is second build option.",
+  defaultValue: "false",
+  mutable: true,
+  ephemeral: true,
+};
diff --git a/site/e2e/playwright.config.ts b/site/e2e/playwright.config.ts
index 0ff9a6fe74622..dcd82a6dfd999 100644
--- a/site/e2e/playwright.config.ts
+++ b/site/e2e/playwright.config.ts
@@ -1,18 +1,18 @@
-import { defineConfig } from "@playwright/test"
-import path from "path"
-import { defaultPort, gitAuth } from "./constants"
+import { defineConfig } from "@playwright/test";
+import path from "path";
+import { defaultPort, gitAuth } from "./constants";
 
 export const port = process.env.CODER_E2E_PORT
   ? Number(process.env.CODER_E2E_PORT)
-  : defaultPort
+  : defaultPort;
 
-const coderMain = path.join(__dirname, "../../enterprise/cmd/coder/main.go")
+const coderMain = path.join(__dirname, "../../enterprise/cmd/coder");
 
-export const STORAGE_STATE = path.join(__dirname, ".auth.json")
+export const STORAGE_STATE = path.join(__dirname, ".auth.json");
 
 const localURL = (port: number, path: string): string => {
-  return `http://localhost:${port}${path}`
-}
+  return `http://localhost:${port}${path}`;
+};
 
 export default defineConfig({
   projects: [
@@ -27,22 +27,30 @@ export default defineConfig({
       use: {
         storageState: STORAGE_STATE,
       },
+      timeout: 60000,
     },
   ],
+  reporter: [["./reporter.ts"]],
   use: {
     baseURL: `http://localhost:${port}`,
     video: "retain-on-failure",
+    launchOptions: {
+      args: ["--disable-webgl"],
+    },
   },
   webServer: {
+    url: `http://localhost:${port}/api/v2/deployment/config`,
     command:
       `go run -tags embed ${coderMain} server ` +
       `--global-config $(mktemp -d -t e2e-XXXXXXXXXX) ` +
       `--access-url=http://localhost:${port} ` +
       `--http-address=localhost:${port} ` +
       `--in-memory --telemetry=false ` +
+      `--dangerous-disable-rate-limits ` +
       `--provisioner-daemons 10 ` +
       `--provisioner-daemons-echo ` +
-      `--provisioner-daemon-poll-interval 50ms`,
+      `--web-terminal-renderer=dom ` +
+      `--pprof-enable`,
     env: {
       ...process.env,
 
@@ -50,6 +58,7 @@ export default defineConfig({
       CODER_GITAUTH_0_ID: gitAuth.deviceProvider,
       CODER_GITAUTH_0_TYPE: "github",
       CODER_GITAUTH_0_CLIENT_ID: "client",
+      CODER_GITAUTH_0_CLIENT_SECRET: "secret",
       CODER_GITAUTH_0_DEVICE_FLOW: "true",
       CODER_GITAUTH_0_APP_INSTALL_URL:
         "https://github.com/apps/coder/installations/new",
@@ -85,7 +94,6 @@ export default defineConfig({
         gitAuth.validatePath,
       ),
     },
-    port,
     reuseExistingServer: false,
   },
-})
+});
diff --git a/site/e2e/pom/BasePom.ts b/site/e2e/pom/BasePom.ts
index 69641c6b2ee8f..771181ed5eec1 100644
--- a/site/e2e/pom/BasePom.ts
+++ b/site/e2e/pom/BasePom.ts
@@ -1,17 +1,17 @@
-import { Page } from "@playwright/test"
+import { Page } from "@playwright/test";
 
 export abstract class BasePom {
-  protected readonly baseURL: string | undefined
-  protected readonly path: string
-  protected readonly page: Page
+  protected readonly baseURL: string | undefined;
+  protected readonly path: string;
+  protected readonly page: Page;
 
   constructor(baseURL: string | undefined, path: string, page: Page) {
-    this.baseURL = baseURL
-    this.path = path
-    this.page = page
+    this.baseURL = baseURL;
+    this.path = path;
+    this.page = page;
   }
 
   get url(): string {
-    return this.baseURL + this.path
+    return this.baseURL + this.path;
   }
 }
diff --git a/site/e2e/pom/SignInPage.ts b/site/e2e/pom/SignInPage.ts
index 362674588f6c0..9b24793f9a748 100644
--- a/site/e2e/pom/SignInPage.ts
+++ b/site/e2e/pom/SignInPage.ts
@@ -1,17 +1,17 @@
-import { Page } from "@playwright/test"
-import { BasePom } from "./BasePom"
+import { Page } from "@playwright/test";
+import { BasePom } from "./BasePom";
 
 export class SignInPage extends BasePom {
   constructor(baseURL: string | undefined, page: Page) {
-    super(baseURL, "/login", page)
+    super(baseURL, "/login", page);
   }
 
   async submitBuiltInAuthentication(
     email: string,
     password: string,
   ): Promise<void> {
-    await this.page.fill("text=Email", email)
-    await this.page.fill("text=Password", password)
-    await this.page.click('button:has-text("Sign In")')
+    await this.page.fill("text=Email", email);
+    await this.page.fill("text=Password", password);
+    await this.page.click('button:has-text("Sign In")');
   }
 }
diff --git a/site/e2e/pom/WorkspacesPage.ts b/site/e2e/pom/WorkspacesPage.ts
index 33f2dd38f1b52..9c2bae81d2d8e 100644
--- a/site/e2e/pom/WorkspacesPage.ts
+++ b/site/e2e/pom/WorkspacesPage.ts
@@ -1,8 +1,8 @@
-import { Page } from "@playwright/test"
-import { BasePom } from "./BasePom"
+import { Page } from "@playwright/test";
+import { BasePom } from "./BasePom";
 
 export class WorkspacesPage extends BasePom {
   constructor(baseURL: string | undefined, page: Page, params?: string) {
-    super(baseURL, `/workspaces${params && params}`, page)
+    super(baseURL, `/workspaces${params && params}`, page);
   }
 }
diff --git a/site/e2e/pom/index.ts b/site/e2e/pom/index.ts
index b050895f83720..3fbca5e88f88a 100644
--- a/site/e2e/pom/index.ts
+++ b/site/e2e/pom/index.ts
@@ -1,2 +1,2 @@
-export * from "./SignInPage"
-export * from "./WorkspacesPage"
+export * from "./SignInPage";
+export * from "./WorkspacesPage";
diff --git a/site/e2e/provisionerGenerated.ts b/site/e2e/provisionerGenerated.ts
index 6acdde763f32c..5ad3fb645ad47 100644
--- a/site/e2e/provisionerGenerated.ts
+++ b/site/e2e/provisionerGenerated.ts
@@ -1,8 +1,8 @@
 /* eslint-disable */
-import * as _m0 from "protobufjs/minimal"
-import { Observable } from "rxjs"
+import * as _m0 from "protobufjs/minimal";
+import { Observable } from "rxjs";
 
-export const protobufPackage = "provisioner"
+export const protobufPackage = "provisioner";
 
 /** LogLevel represents severity of the log. */
 export enum LogLevel {
@@ -21,6 +21,7 @@ export enum AppSharingLevel {
   UNRECOGNIZED = -1,
 }
 
+/** WorkspaceTransition is the desired outcome of a build */
 export enum WorkspaceTransition {
   START = 0,
   STOP = 1,
@@ -33,102 +34,128 @@ export interface Empty {}
 
 /** TemplateVariable represents a Terraform variable. */
 export interface TemplateVariable {
-  name: string
-  description: string
-  type: string
-  defaultValue: string
-  required: boolean
-  sensitive: boolean
+  name: string;
+  description: string;
+  type: string;
+  defaultValue: string;
+  required: boolean;
+  sensitive: boolean;
 }
 
 /** RichParameterOption represents a singular option that a parameter may expose. */
 export interface RichParameterOption {
-  name: string
-  description: string
-  value: string
-  icon: string
+  name: string;
+  description: string;
+  value: string;
+  icon: string;
 }
 
 /** RichParameter represents a variable that is exposed. */
 export interface RichParameter {
-  name: string
-  description: string
-  type: string
-  mutable: boolean
-  defaultValue: string
-  icon: string
-  options: RichParameterOption[]
-  validationRegex: string
-  validationError: string
-  validationMin?: number | undefined
-  validationMax?: number | undefined
-  validationMonotonic: string
-  required: boolean
-  displayName: string
+  name: string;
+  description: string;
+  type: string;
+  mutable: boolean;
+  defaultValue: string;
+  icon: string;
+  options: RichParameterOption[];
+  validationRegex: string;
+  validationError: string;
+  validationMin?: number | undefined;
+  validationMax?: number | undefined;
+  validationMonotonic: string;
+  required: boolean;
+  /** legacy_variable_name was removed (= 14) */
+  displayName: string;
+  order: number;
+  ephemeral: boolean;
 }
 
 /** RichParameterValue holds the key/value mapping of a parameter. */
 export interface RichParameterValue {
-  name: string
-  value: string
+  name: string;
+  value: string;
 }
 
 /** VariableValue holds the key/value mapping of a Terraform variable. */
 export interface VariableValue {
-  name: string
-  value: string
-  sensitive: boolean
+  name: string;
+  value: string;
+  sensitive: boolean;
 }
 
 /** Log represents output from a request. */
 export interface Log {
-  level: LogLevel
-  output: string
+  level: LogLevel;
+  output: string;
 }
 
 export interface InstanceIdentityAuth {
-  instanceId: string
+  instanceId: string;
 }
 
-export interface GitAuthProvider {
-  id: string
-  accessToken: string
+export interface ExternalAuthProvider {
+  id: string;
+  accessToken: string;
 }
 
 /** Agent represents a running agent on the workspace. */
 export interface Agent {
-  id: string
-  name: string
-  env: { [key: string]: string }
-  startupScript: string
-  operatingSystem: string
-  architecture: string
-  directory: string
-  apps: App[]
-  token?: string | undefined
-  instanceId?: string | undefined
-  connectionTimeoutSeconds: number
-  troubleshootingUrl: string
-  motdFile: string
-  /** Field 14 was bool login_before_ready = 14, now removed. */
-  startupScriptTimeoutSeconds: number
-  shutdownScript: string
-  shutdownScriptTimeoutSeconds: number
-  metadata: Agent_Metadata[]
-  startupScriptBehavior: string
+  id: string;
+  name: string;
+  env: { [key: string]: string };
+  /** Field 4 was startup_script, now removed. */
+  operatingSystem: string;
+  architecture: string;
+  directory: string;
+  apps: App[];
+  token?: string | undefined;
+  instanceId?: string | undefined;
+  connectionTimeoutSeconds: number;
+  troubleshootingUrl: string;
+  motdFile: string;
+  /**
+   * Field 14 was bool login_before_ready = 14, now removed.
+   * Field 15, 16, 17 were related to scripts, which are now removed.
+   */
+  metadata: Agent_Metadata[];
+  /** Field 19 was startup_script_behavior, now removed. */
+  displayApps: DisplayApps | undefined;
+  scripts: Script[];
 }
 
 export interface Agent_Metadata {
-  key: string
-  displayName: string
-  script: string
-  interval: number
-  timeout: number
+  key: string;
+  displayName: string;
+  script: string;
+  interval: number;
+  timeout: number;
 }
 
 export interface Agent_EnvEntry {
-  key: string
-  value: string
+  key: string;
+  value: string;
+}
+
+export interface DisplayApps {
+  vscode: boolean;
+  vscodeInsiders: boolean;
+  webTerminal: boolean;
+  sshHelper: boolean;
+  portForwardingHelper: boolean;
+}
+
+/** Script represents a script to be run on the workspace. */
+export interface Script {
+  displayName: string;
+  icon: string;
+  script: string;
+  cron: string;
+  startBlocksLogin: boolean;
+  runOnStart: boolean;
+  runOnStop: boolean;
+  timeoutSeconds: number;
+  logPath: string;
 }
 
 /** App represents a dev-accessible application on the workspace. */
@@ -137,129 +164,134 @@ export interface App {
    * slug is the unique identifier for the app, usually the name from the
    * template. It must be URL-safe and hostname-safe.
    */
-  slug: string
-  displayName: string
-  command: string
-  url: string
-  icon: string
-  subdomain: boolean
-  healthcheck: Healthcheck | undefined
-  sharingLevel: AppSharingLevel
-  external: boolean
+  slug: string;
+  displayName: string;
+  command: string;
+  url: string;
+  icon: string;
+  subdomain: boolean;
+  healthcheck: Healthcheck | undefined;
+  sharingLevel: AppSharingLevel;
+  external: boolean;
 }
 
 /** Healthcheck represents configuration for checking for app readiness. */
 export interface Healthcheck {
-  url: string
-  interval: number
-  threshold: number
+  url: string;
+  interval: number;
+  threshold: number;
 }
 
 /** Resource represents created infrastructure. */
 export interface Resource {
-  name: string
-  type: string
-  agents: Agent[]
-  metadata: Resource_Metadata[]
-  hide: boolean
-  icon: string
-  instanceType: string
-  dailyCost: number
+  name: string;
+  type: string;
+  agents: Agent[];
+  metadata: Resource_Metadata[];
+  hide: boolean;
+  icon: string;
+  instanceType: string;
+  dailyCost: number;
 }
 
 export interface Resource_Metadata {
-  key: string
-  value: string
-  sensitive: boolean
-  isNull: boolean
-}
-
-/** Parse consumes source-code from a directory to produce inputs. */
-export interface Parse {}
-
-export interface Parse_Request {
-  directory: string
-}
-
-export interface Parse_Complete {
-  templateVariables: TemplateVariable[]
-}
-
-export interface Parse_Response {
-  log?: Log | undefined
-  complete?: Parse_Complete | undefined
+  key: string;
+  value: string;
+  sensitive: boolean;
+  isNull: boolean;
+}
+
+/** Metadata is information about a workspace used in the execution of a build */
+export interface Metadata {
+  coderUrl: string;
+  workspaceTransition: WorkspaceTransition;
+  workspaceName: string;
+  workspaceOwner: string;
+  workspaceId: string;
+  workspaceOwnerId: string;
+  workspaceOwnerEmail: string;
+  templateName: string;
+  templateVersion: string;
+  workspaceOwnerOidcAccessToken: string;
+  workspaceOwnerSessionToken: string;
+  templateId: string;
+}
+
+/** Config represents execution configuration shared by all subsequent requests in the Session */
+export interface Config {
+  /** template_source_archive is a tar of the template source files */
+  templateSourceArchive: Uint8Array;
+  /** state is the provisioner state (if any) */
+  state: Uint8Array;
+  provisionerLogLevel: string;
+}
+
+/** ParseRequest consumes source-code to produce inputs. */
+export interface ParseRequest {}
+
+/** ParseComplete indicates a request to parse completed. */
+export interface ParseComplete {
+  error: string;
+  templateVariables: TemplateVariable[];
+  readme: Uint8Array;
+}
+
+/** PlanRequest asks the provisioner to plan what resources & parameters it will create */
+export interface PlanRequest {
+  metadata: Metadata | undefined;
+  richParameterValues: RichParameterValue[];
+  variableValues: VariableValue[];
+  externalAuthProviders: ExternalAuthProvider[];
+}
+
+/** PlanComplete indicates a request to plan completed. */
+export interface PlanComplete {
+  error: string;
+  resources: Resource[];
+  parameters: RichParameter[];
+  externalAuthProviders: string[];
 }
 
 /**
- * Provision consumes source-code from a directory to produce resources.
- * Exactly one of Plan or Apply must be provided in a single session.
+ * ApplyRequest asks the provisioner to apply the changes.  Apply MUST be preceded by a successful plan request/response
+ * in the same Session.  The plan data is not transmitted over the wire and is cached by the provisioner in the Session.
  */
-export interface Provision {}
-
-export interface Provision_Metadata {
-  coderUrl: string
-  workspaceTransition: WorkspaceTransition
-  workspaceName: string
-  workspaceOwner: string
-  workspaceId: string
-  workspaceOwnerId: string
-  workspaceOwnerEmail: string
-  templateName: string
-  templateVersion: string
-  workspaceOwnerOidcAccessToken: string
-  workspaceOwnerSessionToken: string
+export interface ApplyRequest {
+  metadata: Metadata | undefined;
 }
 
-/**
- * Config represents execution configuration shared by both Plan and
- * Apply commands.
- */
-export interface Provision_Config {
-  directory: string
-  state: Uint8Array
-  metadata: Provision_Metadata | undefined
-  provisionerLogLevel: string
+/** ApplyComplete indicates a request to apply completed. */
+export interface ApplyComplete {
+  state: Uint8Array;
+  error: string;
+  resources: Resource[];
+  parameters: RichParameter[];
+  externalAuthProviders: string[];
 }
 
-export interface Provision_Plan {
-  config: Provision_Config | undefined
-  richParameterValues: RichParameterValue[]
-  variableValues: VariableValue[]
-  gitAuthProviders: GitAuthProvider[]
-}
+/** CancelRequest requests that the previous request be canceled gracefully. */
+export interface CancelRequest {}
 
-export interface Provision_Apply {
-  config: Provision_Config | undefined
-  plan: Uint8Array
+export interface Request {
+  config?: Config | undefined;
+  parse?: ParseRequest | undefined;
+  plan?: PlanRequest | undefined;
+  apply?: ApplyRequest | undefined;
+  cancel?: CancelRequest | undefined;
 }
 
-export interface Provision_Cancel {}
-
-export interface Provision_Request {
-  plan?: Provision_Plan | undefined
-  apply?: Provision_Apply | undefined
-  cancel?: Provision_Cancel | undefined
-}
-
-export interface Provision_Complete {
-  state: Uint8Array
-  error: string
-  resources: Resource[]
-  parameters: RichParameter[]
-  gitAuthProviders: string[]
-  plan: Uint8Array
-}
-
-export interface Provision_Response {
-  log?: Log | undefined
-  complete?: Provision_Complete | undefined
+export interface Response {
+  log?: Log | undefined;
+  parse?: ParseComplete | undefined;
+  plan?: PlanComplete | undefined;
+  apply?: ApplyComplete | undefined;
 }
 
 export const Empty = {
   encode(_: Empty, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
-    return writer
+    return writer;
   },
-}
+};
 
 export const TemplateVariable = {
   encode(
@@ -267,26 +299,26 @@ export const TemplateVariable = {
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.name !== "") {
-      writer.uint32(10).string(message.name)
+      writer.uint32(10).string(message.name);
     }
     if (message.description !== "") {
-      writer.uint32(18).string(message.description)
+      writer.uint32(18).string(message.description);
     }
     if (message.type !== "") {
-      writer.uint32(26).string(message.type)
+      writer.uint32(26).string(message.type);
     }
     if (message.defaultValue !== "") {
-      writer.uint32(34).string(message.defaultValue)
+      writer.uint32(34).string(message.defaultValue);
     }
     if (message.required === true) {
-      writer.uint32(40).bool(message.required)
+      writer.uint32(40).bool(message.required);
     }
     if (message.sensitive === true) {
-      writer.uint32(48).bool(message.sensitive)
+      writer.uint32(48).bool(message.sensitive);
     }
-    return writer
+    return writer;
   },
-}
+};
 
 export const RichParameterOption = {
   encode(
@@ -294,20 +326,20 @@ export const RichParameterOption = {
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.name !== "") {
-      writer.uint32(10).string(message.name)
+      writer.uint32(10).string(message.name);
     }
     if (message.description !== "") {
-      writer.uint32(18).string(message.description)
+      writer.uint32(18).string(message.description);
     }
     if (message.value !== "") {
-      writer.uint32(26).string(message.value)
+      writer.uint32(26).string(message.value);
     }
     if (message.icon !== "") {
-      writer.uint32(34).string(message.icon)
+      writer.uint32(34).string(message.icon);
     }
-    return writer
+    return writer;
   },
-}
+};
 
 export const RichParameter = {
   encode(
@@ -315,50 +347,56 @@ export const RichParameter = {
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.name !== "") {
-      writer.uint32(10).string(message.name)
+      writer.uint32(10).string(message.name);
     }
     if (message.description !== "") {
-      writer.uint32(18).string(message.description)
+      writer.uint32(18).string(message.description);
     }
     if (message.type !== "") {
-      writer.uint32(26).string(message.type)
+      writer.uint32(26).string(message.type);
     }
     if (message.mutable === true) {
-      writer.uint32(32).bool(message.mutable)
+      writer.uint32(32).bool(message.mutable);
     }
     if (message.defaultValue !== "") {
-      writer.uint32(42).string(message.defaultValue)
+      writer.uint32(42).string(message.defaultValue);
     }
     if (message.icon !== "") {
-      writer.uint32(50).string(message.icon)
+      writer.uint32(50).string(message.icon);
     }
     for (const v of message.options) {
-      RichParameterOption.encode(v!, writer.uint32(58).fork()).ldelim()
+      RichParameterOption.encode(v!, writer.uint32(58).fork()).ldelim();
     }
     if (message.validationRegex !== "") {
-      writer.uint32(66).string(message.validationRegex)
+      writer.uint32(66).string(message.validationRegex);
     }
     if (message.validationError !== "") {
-      writer.uint32(74).string(message.validationError)
+      writer.uint32(74).string(message.validationError);
     }
     if (message.validationMin !== undefined) {
-      writer.uint32(80).int32(message.validationMin)
+      writer.uint32(80).int32(message.validationMin);
     }
     if (message.validationMax !== undefined) {
-      writer.uint32(88).int32(message.validationMax)
+      writer.uint32(88).int32(message.validationMax);
     }
     if (message.validationMonotonic !== "") {
-      writer.uint32(98).string(message.validationMonotonic)
+      writer.uint32(98).string(message.validationMonotonic);
     }
     if (message.required === true) {
-      writer.uint32(104).bool(message.required)
+      writer.uint32(104).bool(message.required);
     }
     if (message.displayName !== "") {
-      writer.uint32(122).string(message.displayName)
+      writer.uint32(122).string(message.displayName);
+    }
+    if (message.order !== 0) {
+      writer.uint32(128).int32(message.order);
     }
-    return writer
+    if (message.ephemeral === true) {
+      writer.uint32(136).bool(message.ephemeral);
+    }
+    return writer;
   },
-}
+};
 
 export const RichParameterValue = {
   encode(
@@ -366,14 +404,14 @@ export const RichParameterValue = {
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.name !== "") {
-      writer.uint32(10).string(message.name)
+      writer.uint32(10).string(message.name);
     }
     if (message.value !== "") {
-      writer.uint32(18).string(message.value)
+      writer.uint32(18).string(message.value);
     }
-    return writer
+    return writer;
   },
-}
+};
 
 export const VariableValue = {
   encode(
@@ -381,29 +419,29 @@ export const VariableValue = {
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.name !== "") {
-      writer.uint32(10).string(message.name)
+      writer.uint32(10).string(message.name);
     }
     if (message.value !== "") {
-      writer.uint32(18).string(message.value)
+      writer.uint32(18).string(message.value);
     }
     if (message.sensitive === true) {
-      writer.uint32(24).bool(message.sensitive)
+      writer.uint32(24).bool(message.sensitive);
     }
-    return writer
+    return writer;
   },
-}
+};
 
 export const Log = {
   encode(message: Log, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
     if (message.level !== 0) {
-      writer.uint32(8).int32(message.level)
+      writer.uint32(8).int32(message.level);
     }
     if (message.output !== "") {
-      writer.uint32(18).string(message.output)
+      writer.uint32(18).string(message.output);
     }
-    return writer
+    return writer;
   },
-}
+};
 
 export const InstanceIdentityAuth = {
   encode(
@@ -411,89 +449,83 @@ export const InstanceIdentityAuth = {
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.instanceId !== "") {
-      writer.uint32(10).string(message.instanceId)
+      writer.uint32(10).string(message.instanceId);
     }
-    return writer
+    return writer;
   },
-}
+};
 
-export const GitAuthProvider = {
+export const ExternalAuthProvider = {
   encode(
-    message: GitAuthProvider,
+    message: ExternalAuthProvider,
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.id !== "") {
-      writer.uint32(10).string(message.id)
+      writer.uint32(10).string(message.id);
     }
     if (message.accessToken !== "") {
-      writer.uint32(18).string(message.accessToken)
+      writer.uint32(18).string(message.accessToken);
     }
-    return writer
+    return writer;
   },
-}
+};
 
 export const Agent = {
   encode(message: Agent, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
     if (message.id !== "") {
-      writer.uint32(10).string(message.id)
+      writer.uint32(10).string(message.id);
     }
     if (message.name !== "") {
-      writer.uint32(18).string(message.name)
+      writer.uint32(18).string(message.name);
     }
     Object.entries(message.env).forEach(([key, value]) => {
       Agent_EnvEntry.encode(
         { key: key as any, value },
         writer.uint32(26).fork(),
-      ).ldelim()
-    })
-    if (message.startupScript !== "") {
-      writer.uint32(34).string(message.startupScript)
-    }
+      ).ldelim();
+    });
     if (message.operatingSystem !== "") {
-      writer.uint32(42).string(message.operatingSystem)
+      writer.uint32(42).string(message.operatingSystem);
     }
     if (message.architecture !== "") {
-      writer.uint32(50).string(message.architecture)
+      writer.uint32(50).string(message.architecture);
     }
     if (message.directory !== "") {
-      writer.uint32(58).string(message.directory)
+      writer.uint32(58).string(message.directory);
     }
     for (const v of message.apps) {
-      App.encode(v!, writer.uint32(66).fork()).ldelim()
+      App.encode(v!, writer.uint32(66).fork()).ldelim();
     }
     if (message.token !== undefined) {
-      writer.uint32(74).string(message.token)
+      writer.uint32(74).string(message.token);
     }
     if (message.instanceId !== undefined) {
-      writer.uint32(82).string(message.instanceId)
+      writer.uint32(82).string(message.instanceId);
     }
     if (message.connectionTimeoutSeconds !== 0) {
-      writer.uint32(88).int32(message.connectionTimeoutSeconds)
+      writer.uint32(88).int32(message.connectionTimeoutSeconds);
     }
     if (message.troubleshootingUrl !== "") {
-      writer.uint32(98).string(message.troubleshootingUrl)
+      writer.uint32(98).string(message.troubleshootingUrl);
     }
     if (message.motdFile !== "") {
-      writer.uint32(106).string(message.motdFile)
-    }
-    if (message.startupScriptTimeoutSeconds !== 0) {
-      writer.uint32(120).int32(message.startupScriptTimeoutSeconds)
-    }
-    if (message.shutdownScript !== "") {
-      writer.uint32(130).string(message.shutdownScript)
-    }
-    if (message.shutdownScriptTimeoutSeconds !== 0) {
-      writer.uint32(136).int32(message.shutdownScriptTimeoutSeconds)
+      writer.uint32(106).string(message.motdFile);
     }
     for (const v of message.metadata) {
-      Agent_Metadata.encode(v!, writer.uint32(146).fork()).ldelim()
+      Agent_Metadata.encode(v!, writer.uint32(146).fork()).ldelim();
     }
-    if (message.startupScriptBehavior !== "") {
-      writer.uint32(154).string(message.startupScriptBehavior)
+    if (message.displayApps !== undefined) {
+      DisplayApps.encode(
+        message.displayApps,
+        writer.uint32(162).fork(),
+      ).ldelim();
     }
-    return writer
+    for (const v of message.scripts) {
+      Script.encode(v!, writer.uint32(170).fork()).ldelim();
+    }
+    return writer;
   },
-}
+};
 
 export const Agent_Metadata = {
   encode(
@@ -501,23 +533,23 @@ export const Agent_Metadata = {
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.key !== "") {
-      writer.uint32(10).string(message.key)
+      writer.uint32(10).string(message.key);
     }
     if (message.displayName !== "") {
-      writer.uint32(18).string(message.displayName)
+      writer.uint32(18).string(message.displayName);
     }
     if (message.script !== "") {
-      writer.uint32(26).string(message.script)
+      writer.uint32(26).string(message.script);
     }
     if (message.interval !== 0) {
-      writer.uint32(32).int64(message.interval)
+      writer.uint32(32).int64(message.interval);
     }
     if (message.timeout !== 0) {
-      writer.uint32(40).int64(message.timeout)
+      writer.uint32(40).int64(message.timeout);
     }
-    return writer
+    return writer;
   },
-}
+};
 
 export const Agent_EnvEntry = {
   encode(
@@ -525,47 +557,110 @@ export const Agent_EnvEntry = {
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.key !== "") {
-      writer.uint32(10).string(message.key)
+      writer.uint32(10).string(message.key);
     }
     if (message.value !== "") {
-      writer.uint32(18).string(message.value)
+      writer.uint32(18).string(message.value);
     }
-    return writer
+    return writer;
   },
-}
+};
+
+export const DisplayApps = {
+  encode(
+    message: DisplayApps,
+    writer: _m0.Writer = _m0.Writer.create(),
+  ): _m0.Writer {
+    if (message.vscode === true) {
+      writer.uint32(8).bool(message.vscode);
+    }
+    if (message.vscodeInsiders === true) {
+      writer.uint32(16).bool(message.vscodeInsiders);
+    }
+    if (message.webTerminal === true) {
+      writer.uint32(24).bool(message.webTerminal);
+    }
+    if (message.sshHelper === true) {
+      writer.uint32(32).bool(message.sshHelper);
+    }
+    if (message.portForwardingHelper === true) {
+      writer.uint32(40).bool(message.portForwardingHelper);
+    }
+    return writer;
+  },
+};
+
+export const Script = {
+  encode(
+    message: Script,
+    writer: _m0.Writer = _m0.Writer.create(),
+  ): _m0.Writer {
+    if (message.displayName !== "") {
+      writer.uint32(10).string(message.displayName);
+    }
+    if (message.icon !== "") {
+      writer.uint32(18).string(message.icon);
+    }
+    if (message.script !== "") {
+      writer.uint32(26).string(message.script);
+    }
+    if (message.cron !== "") {
+      writer.uint32(34).string(message.cron);
+    }
+    if (message.startBlocksLogin === true) {
+      writer.uint32(40).bool(message.startBlocksLogin);
+    }
+    if (message.runOnStart === true) {
+      writer.uint32(48).bool(message.runOnStart);
+    }
+    if (message.runOnStop === true) {
+      writer.uint32(56).bool(message.runOnStop);
+    }
+    if (message.timeoutSeconds !== 0) {
+      writer.uint32(64).int32(message.timeoutSeconds);
+    }
+    if (message.logPath !== "") {
+      writer.uint32(74).string(message.logPath);
+    }
+    return writer;
+  },
+};
 
 export const App = {
   encode(message: App, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
     if (message.slug !== "") {
-      writer.uint32(10).string(message.slug)
+      writer.uint32(10).string(message.slug);
     }
     if (message.displayName !== "") {
-      writer.uint32(18).string(message.displayName)
+      writer.uint32(18).string(message.displayName);
     }
     if (message.command !== "") {
-      writer.uint32(26).string(message.command)
+      writer.uint32(26).string(message.command);
     }
     if (message.url !== "") {
-      writer.uint32(34).string(message.url)
+      writer.uint32(34).string(message.url);
     }
     if (message.icon !== "") {
-      writer.uint32(42).string(message.icon)
+      writer.uint32(42).string(message.icon);
     }
     if (message.subdomain === true) {
-      writer.uint32(48).bool(message.subdomain)
+      writer.uint32(48).bool(message.subdomain);
     }
     if (message.healthcheck !== undefined) {
-      Healthcheck.encode(message.healthcheck, writer.uint32(58).fork()).ldelim()
+      Healthcheck.encode(
+        message.healthcheck,
+        writer.uint32(58).fork(),
+      ).ldelim();
     }
     if (message.sharingLevel !== 0) {
-      writer.uint32(64).int32(message.sharingLevel)
+      writer.uint32(64).int32(message.sharingLevel);
     }
     if (message.external === true) {
-      writer.uint32(72).bool(message.external)
+      writer.uint32(72).bool(message.external);
     }
-    return writer
+    return writer;
   },
-}
+};
 
 export const Healthcheck = {
   encode(
@@ -573,17 +668,17 @@ export const Healthcheck = {
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.url !== "") {
-      writer.uint32(10).string(message.url)
+      writer.uint32(10).string(message.url);
     }
     if (message.interval !== 0) {
-      writer.uint32(16).int32(message.interval)
+      writer.uint32(16).int32(message.interval);
     }
     if (message.threshold !== 0) {
-      writer.uint32(24).int32(message.threshold)
+      writer.uint32(24).int32(message.threshold);
     }
-    return writer
+    return writer;
   },
-}
+};
 
 export const Resource = {
   encode(
@@ -591,32 +686,32 @@ export const Resource = {
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.name !== "") {
-      writer.uint32(10).string(message.name)
+      writer.uint32(10).string(message.name);
     }
     if (message.type !== "") {
-      writer.uint32(18).string(message.type)
+      writer.uint32(18).string(message.type);
     }
     for (const v of message.agents) {
-      Agent.encode(v!, writer.uint32(26).fork()).ldelim()
+      Agent.encode(v!, writer.uint32(26).fork()).ldelim();
     }
     for (const v of message.metadata) {
-      Resource_Metadata.encode(v!, writer.uint32(34).fork()).ldelim()
+      Resource_Metadata.encode(v!, writer.uint32(34).fork()).ldelim();
     }
     if (message.hide === true) {
-      writer.uint32(40).bool(message.hide)
+      writer.uint32(40).bool(message.hide);
     }
     if (message.icon !== "") {
-      writer.uint32(50).string(message.icon)
+      writer.uint32(50).string(message.icon);
     }
     if (message.instanceType !== "") {
-      writer.uint32(58).string(message.instanceType)
+      writer.uint32(58).string(message.instanceType);
     }
     if (message.dailyCost !== 0) {
-      writer.uint32(64).int32(message.dailyCost)
+      writer.uint32(64).int32(message.dailyCost);
     }
-    return writer
+    return writer;
   },
-}
+};
 
 export const Resource_Metadata = {
   encode(
@@ -624,249 +719,255 @@ export const Resource_Metadata = {
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.key !== "") {
-      writer.uint32(10).string(message.key)
+      writer.uint32(10).string(message.key);
     }
     if (message.value !== "") {
-      writer.uint32(18).string(message.value)
+      writer.uint32(18).string(message.value);
     }
     if (message.sensitive === true) {
-      writer.uint32(24).bool(message.sensitive)
+      writer.uint32(24).bool(message.sensitive);
     }
     if (message.isNull === true) {
-      writer.uint32(32).bool(message.isNull)
+      writer.uint32(32).bool(message.isNull);
     }
-    return writer
+    return writer;
   },
-}
+};
 
-export const Parse = {
-  encode(_: Parse, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
-    return writer
-  },
-}
-
-export const Parse_Request = {
+export const Metadata = {
   encode(
-    message: Parse_Request,
-    writer: _m0.Writer = _m0.Writer.create(),
-  ): _m0.Writer {
-    if (message.directory !== "") {
-      writer.uint32(10).string(message.directory)
-    }
-    return writer
-  },
-}
-
-export const Parse_Complete = {
-  encode(
-    message: Parse_Complete,
-    writer: _m0.Writer = _m0.Writer.create(),
-  ): _m0.Writer {
-    for (const v of message.templateVariables) {
-      TemplateVariable.encode(v!, writer.uint32(10).fork()).ldelim()
-    }
-    return writer
-  },
-}
-
-export const Parse_Response = {
-  encode(
-    message: Parse_Response,
-    writer: _m0.Writer = _m0.Writer.create(),
-  ): _m0.Writer {
-    if (message.log !== undefined) {
-      Log.encode(message.log, writer.uint32(10).fork()).ldelim()
-    }
-    if (message.complete !== undefined) {
-      Parse_Complete.encode(message.complete, writer.uint32(18).fork()).ldelim()
-    }
-    return writer
-  },
-}
-
-export const Provision = {
-  encode(_: Provision, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
-    return writer
-  },
-}
-
-export const Provision_Metadata = {
-  encode(
-    message: Provision_Metadata,
+    message: Metadata,
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.coderUrl !== "") {
-      writer.uint32(10).string(message.coderUrl)
+      writer.uint32(10).string(message.coderUrl);
     }
     if (message.workspaceTransition !== 0) {
-      writer.uint32(16).int32(message.workspaceTransition)
+      writer.uint32(16).int32(message.workspaceTransition);
     }
     if (message.workspaceName !== "") {
-      writer.uint32(26).string(message.workspaceName)
+      writer.uint32(26).string(message.workspaceName);
     }
     if (message.workspaceOwner !== "") {
-      writer.uint32(34).string(message.workspaceOwner)
+      writer.uint32(34).string(message.workspaceOwner);
     }
     if (message.workspaceId !== "") {
-      writer.uint32(42).string(message.workspaceId)
+      writer.uint32(42).string(message.workspaceId);
     }
     if (message.workspaceOwnerId !== "") {
-      writer.uint32(50).string(message.workspaceOwnerId)
+      writer.uint32(50).string(message.workspaceOwnerId);
     }
     if (message.workspaceOwnerEmail !== "") {
-      writer.uint32(58).string(message.workspaceOwnerEmail)
+      writer.uint32(58).string(message.workspaceOwnerEmail);
     }
     if (message.templateName !== "") {
-      writer.uint32(66).string(message.templateName)
+      writer.uint32(66).string(message.templateName);
     }
     if (message.templateVersion !== "") {
-      writer.uint32(74).string(message.templateVersion)
+      writer.uint32(74).string(message.templateVersion);
     }
     if (message.workspaceOwnerOidcAccessToken !== "") {
-      writer.uint32(82).string(message.workspaceOwnerOidcAccessToken)
+      writer.uint32(82).string(message.workspaceOwnerOidcAccessToken);
     }
     if (message.workspaceOwnerSessionToken !== "") {
-      writer.uint32(90).string(message.workspaceOwnerSessionToken)
+      writer.uint32(90).string(message.workspaceOwnerSessionToken);
+    }
+    if (message.templateId !== "") {
+      writer.uint32(98).string(message.templateId);
     }
-    return writer
+    return writer;
   },
-}
+};
 
-export const Provision_Config = {
+export const Config = {
   encode(
-    message: Provision_Config,
+    message: Config,
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
-    if (message.directory !== "") {
-      writer.uint32(10).string(message.directory)
+    if (message.templateSourceArchive.length !== 0) {
+      writer.uint32(10).bytes(message.templateSourceArchive);
     }
     if (message.state.length !== 0) {
-      writer.uint32(18).bytes(message.state)
-    }
-    if (message.metadata !== undefined) {
-      Provision_Metadata.encode(
-        message.metadata,
-        writer.uint32(26).fork(),
-      ).ldelim()
+      writer.uint32(18).bytes(message.state);
     }
     if (message.provisionerLogLevel !== "") {
-      writer.uint32(34).string(message.provisionerLogLevel)
+      writer.uint32(26).string(message.provisionerLogLevel);
     }
-    return writer
+    return writer;
   },
-}
+};
 
-export const Provision_Plan = {
+export const ParseRequest = {
   encode(
-    message: Provision_Plan,
+    _: ParseRequest,
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
-    if (message.config !== undefined) {
-      Provision_Config.encode(message.config, writer.uint32(10).fork()).ldelim()
-    }
-    for (const v of message.richParameterValues) {
-      RichParameterValue.encode(v!, writer.uint32(26).fork()).ldelim()
+    return writer;
+  },
+};
+
+export const ParseComplete = {
+  encode(
+    message: ParseComplete,
+    writer: _m0.Writer = _m0.Writer.create(),
+  ): _m0.Writer {
+    if (message.error !== "") {
+      writer.uint32(10).string(message.error);
     }
-    for (const v of message.variableValues) {
-      VariableValue.encode(v!, writer.uint32(34).fork()).ldelim()
+    for (const v of message.templateVariables) {
+      TemplateVariable.encode(v!, writer.uint32(18).fork()).ldelim();
     }
-    for (const v of message.gitAuthProviders) {
-      GitAuthProvider.encode(v!, writer.uint32(42).fork()).ldelim()
+    if (message.readme.length !== 0) {
+      writer.uint32(26).bytes(message.readme);
     }
-    return writer
+    return writer;
   },
-}
+};
 
-export const Provision_Apply = {
+export const PlanRequest = {
   encode(
-    message: Provision_Apply,
+    message: PlanRequest,
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
-    if (message.config !== undefined) {
-      Provision_Config.encode(message.config, writer.uint32(10).fork()).ldelim()
+    if (message.metadata !== undefined) {
+      Metadata.encode(message.metadata, writer.uint32(10).fork()).ldelim();
+    }
+    for (const v of message.richParameterValues) {
+      RichParameterValue.encode(v!, writer.uint32(18).fork()).ldelim();
+    }
+    for (const v of message.variableValues) {
+      VariableValue.encode(v!, writer.uint32(26).fork()).ldelim();
     }
-    if (message.plan.length !== 0) {
-      writer.uint32(18).bytes(message.plan)
+    for (const v of message.externalAuthProviders) {
+      ExternalAuthProvider.encode(v!, writer.uint32(34).fork()).ldelim();
     }
-    return writer
+    return writer;
   },
-}
+};
 
-export const Provision_Cancel = {
+export const PlanComplete = {
   encode(
-    _: Provision_Cancel,
+    message: PlanComplete,
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
-    return writer
+    if (message.error !== "") {
+      writer.uint32(10).string(message.error);
+    }
+    for (const v of message.resources) {
+      Resource.encode(v!, writer.uint32(18).fork()).ldelim();
+    }
+    for (const v of message.parameters) {
+      RichParameter.encode(v!, writer.uint32(26).fork()).ldelim();
+    }
+    for (const v of message.externalAuthProviders) {
+      writer.uint32(34).string(v!);
+    }
+    return writer;
   },
-}
+};
 
-export const Provision_Request = {
+export const ApplyRequest = {
   encode(
-    message: Provision_Request,
+    message: ApplyRequest,
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
-    if (message.plan !== undefined) {
-      Provision_Plan.encode(message.plan, writer.uint32(10).fork()).ldelim()
-    }
-    if (message.apply !== undefined) {
-      Provision_Apply.encode(message.apply, writer.uint32(18).fork()).ldelim()
-    }
-    if (message.cancel !== undefined) {
-      Provision_Cancel.encode(message.cancel, writer.uint32(26).fork()).ldelim()
+    if (message.metadata !== undefined) {
+      Metadata.encode(message.metadata, writer.uint32(10).fork()).ldelim();
     }
-    return writer
+    return writer;
   },
-}
+};
 
-export const Provision_Complete = {
+export const ApplyComplete = {
   encode(
-    message: Provision_Complete,
+    message: ApplyComplete,
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.state.length !== 0) {
-      writer.uint32(10).bytes(message.state)
+      writer.uint32(10).bytes(message.state);
     }
     if (message.error !== "") {
-      writer.uint32(18).string(message.error)
+      writer.uint32(18).string(message.error);
     }
     for (const v of message.resources) {
-      Resource.encode(v!, writer.uint32(26).fork()).ldelim()
+      Resource.encode(v!, writer.uint32(26).fork()).ldelim();
     }
     for (const v of message.parameters) {
-      RichParameter.encode(v!, writer.uint32(34).fork()).ldelim()
+      RichParameter.encode(v!, writer.uint32(34).fork()).ldelim();
+    }
+    for (const v of message.externalAuthProviders) {
+      writer.uint32(42).string(v!);
+    }
+    return writer;
+  },
+};
+
+export const CancelRequest = {
+  encode(
+    _: CancelRequest,
+    writer: _m0.Writer = _m0.Writer.create(),
+  ): _m0.Writer {
+    return writer;
+  },
+};
+
+export const Request = {
+  encode(
+    message: Request,
+    writer: _m0.Writer = _m0.Writer.create(),
+  ): _m0.Writer {
+    if (message.config !== undefined) {
+      Config.encode(message.config, writer.uint32(10).fork()).ldelim();
     }
-    for (const v of message.gitAuthProviders) {
-      writer.uint32(42).string(v!)
+    if (message.parse !== undefined) {
+      ParseRequest.encode(message.parse, writer.uint32(18).fork()).ldelim();
     }
-    if (message.plan.length !== 0) {
-      writer.uint32(50).bytes(message.plan)
+    if (message.plan !== undefined) {
+      PlanRequest.encode(message.plan, writer.uint32(26).fork()).ldelim();
+    }
+    if (message.apply !== undefined) {
+      ApplyRequest.encode(message.apply, writer.uint32(34).fork()).ldelim();
     }
-    return writer
+    if (message.cancel !== undefined) {
+      CancelRequest.encode(message.cancel, writer.uint32(42).fork()).ldelim();
+    }
+    return writer;
   },
-}
+};
 
-export const Provision_Response = {
+export const Response = {
   encode(
-    message: Provision_Response,
+    message: Response,
     writer: _m0.Writer = _m0.Writer.create(),
   ): _m0.Writer {
     if (message.log !== undefined) {
-      Log.encode(message.log, writer.uint32(10).fork()).ldelim()
+      Log.encode(message.log, writer.uint32(10).fork()).ldelim();
+    }
+    if (message.parse !== undefined) {
+      ParseComplete.encode(message.parse, writer.uint32(18).fork()).ldelim();
+    }
+    if (message.plan !== undefined) {
+      PlanComplete.encode(message.plan, writer.uint32(26).fork()).ldelim();
     }
-    if (message.complete !== undefined) {
-      Provision_Complete.encode(
-        message.complete,
-        writer.uint32(18).fork(),
-      ).ldelim()
+    if (message.apply !== undefined) {
+      ApplyComplete.encode(message.apply, writer.uint32(34).fork()).ldelim();
     }
-    return writer
+    return writer;
   },
-}
+};
 
 export interface Provisioner {
-  Parse(request: Parse_Request): Observable<Parse_Response>
-  Provision(
-    request: Observable<Provision_Request>,
-  ): Observable<Provision_Response>
+  /**
+   * Session represents provisioning a single template import or workspace.  The daemon always sends Config followed
+   * by one of the requests (ParseRequest, PlanRequest, ApplyRequest).  The provisioner should respond with a stream
+   * of zero or more Logs, followed by the corresponding complete message (ParseComplete, PlanComplete,
+   * ApplyComplete).  The daemon may then send a new request.  A request to apply MUST be preceded by a request plan,
+   * and the provisioner should store the plan data on the Session after a successful plan, so that the daemon may
+   * request an apply.  If the daemon closes the Session without an apply, the plan data may be safely discarded.
+   *
+   * The daemon may send a CancelRequest, asynchronously to ask the provisioner to cancel the previous ParseRequest,
+   * PlanRequest, or ApplyRequest.  The provisioner MUST reply with a complete message corresponding to the request
+   * that was canceled.  If the provisioner has already completed the request, it may ignore the CancelRequest.
+   */
+  Session(request: Observable<Request>): Observable<Response>;
 }
diff --git a/site/e2e/reporter.ts b/site/e2e/reporter.ts
new file mode 100644
index 0000000000000..6be742b02bb55
--- /dev/null
+++ b/site/e2e/reporter.ts
@@ -0,0 +1,147 @@
+/* eslint-disable no-console -- Logging is sort of the whole point here */
+import * as fs from "fs/promises";
+import type {
+  FullConfig,
+  Suite,
+  TestCase,
+  TestResult,
+  FullResult,
+  Reporter,
+  TestError,
+} from "@playwright/test/reporter";
+import axios from "axios";
+import type { Writable } from "stream";
+
+class CoderReporter implements Reporter {
+  config: FullConfig | null = null;
+  testOutput = new Map<string, Array<[Writable, string]>>();
+  passedCount = 0;
+  failedTests: TestCase[] = [];
+  timedOutTests: TestCase[] = [];
+
+  onBegin(config: FullConfig, suite: Suite) {
+    this.config = config;
+    console.log(`==> Running ${suite.allTests().length} tests`);
+  }
+
+  onTestBegin(test: TestCase) {
+    this.testOutput.set(test.id, []);
+    console.log(`==> Starting test ${test.title}`);
+  }
+
+  onStdOut(chunk: string, test?: TestCase, _?: TestResult): void {
+    if (!test) {
+      for (const line of filteredServerLogLines(chunk)) {
+        console.log(`[stdout] ${line}`);
+      }
+      return;
+    }
+    this.testOutput.get(test.id)!.push([process.stdout, chunk]);
+  }
+
+  onStdErr(chunk: string, test?: TestCase, _?: TestResult): void {
+    if (!test) {
+      for (const line of filteredServerLogLines(chunk)) {
+        console.error(`[stderr] ${line}`);
+      }
+      return;
+    }
+    this.testOutput.get(test.id)!.push([process.stderr, chunk]);
+  }
+
+  async onTestEnd(test: TestCase, result: TestResult) {
+    console.log(`==> Finished test ${test.title}: ${result.status}`);
+
+    if (result.status === "passed") {
+      this.passedCount++;
+    }
+
+    if (result.status === "failed") {
+      this.failedTests.push(test);
+    }
+
+    if (result.status === "timedOut") {
+      this.timedOutTests.push(test);
+    }
+
+    const fsTestTitle = test.title.replaceAll(" ", "-");
+    const outputFile = `test-results/debug-pprof-goroutine-${fsTestTitle}.txt`;
+    await exportDebugPprof(outputFile);
+
+    if (result.status !== "passed") {
+      console.log(`Data from pprof has been saved to ${outputFile}`);
+      console.log("==> Output");
+      const output = this.testOutput.get(test.id)!;
+      for (const [target, chunk] of output) {
+        target.write(`${chunk.replace(/\n$/g, "")}\n`);
+      }
+
+      if (result.errors.length > 0) {
+        console.log("==> Errors");
+        for (const error of result.errors) {
+          reportError(error);
+        }
+      }
+
+      if (result.attachments.length > 0) {
+        console.log("==> Attachments");
+        for (const attachment of result.attachments) {
+          console.log(attachment);
+        }
+      }
+    }
+    this.testOutput.delete(test.id);
+  }
+
+  onEnd(result: FullResult) {
+    console.log(`==> Tests ${result.status}`);
+    console.log(`${this.passedCount} passed`);
+    if (this.failedTests.length > 0) {
+      console.log(`${this.failedTests.length} failed`);
+      for (const test of this.failedTests) {
+        console.log(`  ${test.location.file} › ${test.title}`);
+      }
+    }
+    if (this.timedOutTests.length > 0) {
+      console.log(`${this.timedOutTests.length} timed out`);
+      for (const test of this.timedOutTests) {
+        console.log(`  ${test.location.file} › ${test.title}`);
+      }
+    }
+  }
+}
+
+const shouldPrintLine = (line: string) =>
+  ["  error=EOF", "coderd: audit_log"].every((noise) => !line.includes(noise));
+
+const filteredServerLogLines = (chunk: string): string[] =>
+  chunk.trimEnd().split("\n").filter(shouldPrintLine);
+
+const exportDebugPprof = async (outputFile: string) => {
+  const response = await axios.get(
+    "http://127.0.0.1:6060/debug/pprof/goroutine?debug=1",
+  );
+  if (response.status !== 200) {
+    throw new Error(`Error: Received status code ${response.status}`);
+  }
+
+  await fs.writeFile(outputFile, response.data);
+};
+
+const reportError = (error: TestError) => {
+  if (error.location) {
+    console.log(`${error.location.file}:${error.location.line}:`);
+  }
+  if (error.snippet) {
+    console.log(error.snippet);
+  }
+
+  if (error.message) {
+    console.log(error.message);
+  } else {
+    console.log(error);
+  }
+};
+
+// eslint-disable-next-line no-unused-vars -- Playwright config uses it
+export default CoderReporter;
diff --git a/site/e2e/tests/app.spec.ts b/site/e2e/tests/app.spec.ts
index b3646fbac1caa..24f893a4e64b6 100644
--- a/site/e2e/tests/app.spec.ts
+++ b/site/e2e/tests/app.spec.ts
@@ -1,26 +1,35 @@
-import { test } from "@playwright/test"
-import { randomUUID } from "crypto"
-import * as http from "http"
-import { createTemplate, createWorkspace, startAgent } from "../helpers"
+import { test } from "@playwright/test";
+import { randomUUID } from "crypto";
+import * as http from "http";
+import {
+  createTemplate,
+  createWorkspace,
+  startAgent,
+  stopAgent,
+  stopWorkspace,
+} from "../helpers";
+import { beforeCoderTest } from "../hooks";
+
+test.beforeEach(async ({ page }) => await beforeCoderTest(page));
 
 test("app", async ({ context, page }) => {
-  const appContent = "Hello World"
-  const token = randomUUID()
+  const appContent = "Hello World";
+  const token = randomUUID();
   const srv = http
     .createServer((req, res) => {
-      res.writeHead(200, { "Content-Type": "text/plain" })
-      res.end(appContent)
+      res.writeHead(200, { "Content-Type": "text/plain" });
+      res.end(appContent);
     })
-    .listen(0)
-  const addr = srv.address()
+    .listen(0);
+  const addr = srv.address();
   if (typeof addr !== "object" || !addr) {
-    throw new Error("Expected addr to be an object")
+    throw new Error("Expected addr to be an object");
   }
-  const appName = "test-app"
+  const appName = "test-app";
   const template = await createTemplate(page, {
     apply: [
       {
-        complete: {
+        apply: {
           resources: [
             {
               agents: [
@@ -39,14 +48,17 @@ test("app", async ({ context, page }) => {
         },
       },
     ],
-  })
-  await createWorkspace(page, template)
-  await startAgent(page, token)
+  });
+  const workspaceName = await createWorkspace(page, template);
+  const agent = await startAgent(page, token);
 
   // Wait for the web terminal to open in a new tab
-  const pagePromise = context.waitForEvent("page")
-  await page.getByText(appName).click()
-  const app = await pagePromise
-  await app.waitForLoadState("networkidle")
-  await app.getByText(appContent).isVisible()
-})
+  const pagePromise = context.waitForEvent("page");
+  await page.getByText(appName).click();
+  const app = await pagePromise;
+  await app.waitForLoadState("domcontentloaded");
+  await app.getByText(appContent).isVisible();
+
+  await stopWorkspace(page, workspaceName);
+  await stopAgent(agent);
+});
diff --git a/site/e2e/tests/createWorkspace.spec.ts b/site/e2e/tests/createWorkspace.spec.ts
index 3317691300f5f..d7cec29a90aa3 100644
--- a/site/e2e/tests/createWorkspace.spec.ts
+++ b/site/e2e/tests/createWorkspace.spec.ts
@@ -1,11 +1,30 @@
-import { test } from "@playwright/test"
-import { createTemplate, createWorkspace } from "../helpers"
+import { test, expect } from "@playwright/test";
+import {
+  createTemplate,
+  createWorkspace,
+  echoResponsesWithParameters,
+  verifyParameters,
+} from "../helpers";
+
+import {
+  secondParameter,
+  fourthParameter,
+  fifthParameter,
+  firstParameter,
+  thirdParameter,
+  seventhParameter,
+  sixthParameter,
+} from "../parameters";
+import { RichParameter } from "../provisionerGenerated";
+import { beforeCoderTest } from "../hooks";
+
+test.beforeEach(async ({ page }) => await beforeCoderTest(page));
 
 test("create workspace", async ({ page }) => {
   const template = await createTemplate(page, {
     apply: [
       {
-        complete: {
+        apply: {
           resources: [
             {
               name: "example",
@@ -14,6 +33,111 @@ test("create workspace", async ({ page }) => {
         },
       },
     ],
-  })
-  await createWorkspace(page, template)
-})
+  });
+  await createWorkspace(page, template);
+});
+
+test("create workspace with default immutable parameters", async ({ page }) => {
+  const richParameters: RichParameter[] = [
+    secondParameter,
+    fourthParameter,
+    fifthParameter,
+  ];
+  const template = await createTemplate(
+    page,
+    echoResponsesWithParameters(richParameters),
+  );
+  const workspaceName = await createWorkspace(page, template);
+  await verifyParameters(page, workspaceName, richParameters, [
+    { name: secondParameter.name, value: secondParameter.defaultValue },
+    { name: fourthParameter.name, value: fourthParameter.defaultValue },
+    { name: fifthParameter.name, value: fifthParameter.defaultValue },
+  ]);
+});
+
+test("create workspace with default mutable parameters", async ({ page }) => {
+  const richParameters: RichParameter[] = [firstParameter, thirdParameter];
+  const template = await createTemplate(
+    page,
+    echoResponsesWithParameters(richParameters),
+  );
+  const workspaceName = await createWorkspace(page, template);
+  await verifyParameters(page, workspaceName, richParameters, [
+    { name: firstParameter.name, value: firstParameter.defaultValue },
+    { name: thirdParameter.name, value: thirdParameter.defaultValue },
+  ]);
+});
+
+test("create workspace with default and required parameters", async ({
+  page,
+}) => {
+  const richParameters: RichParameter[] = [
+    secondParameter,
+    fourthParameter,
+    sixthParameter,
+    seventhParameter,
+  ];
+  const buildParameters = [
+    { name: sixthParameter.name, value: "12345" },
+    { name: seventhParameter.name, value: "abcdef" },
+  ];
+  const template = await createTemplate(
+    page,
+    echoResponsesWithParameters(richParameters),
+  );
+  const workspaceName = await createWorkspace(
+    page,
+    template,
+    richParameters,
+    buildParameters,
+  );
+  await verifyParameters(page, workspaceName, richParameters, [
+    // user values:
+    ...buildParameters,
+    // default values:
+    { name: secondParameter.name, value: secondParameter.defaultValue },
+    { name: fourthParameter.name, value: fourthParameter.defaultValue },
+  ]);
+});
+
+test("create workspace and overwrite default parameters", async ({ page }) => {
+  const richParameters: RichParameter[] = [secondParameter, fourthParameter];
+  const buildParameters = [
+    { name: secondParameter.name, value: "AAAAA" },
+    { name: fourthParameter.name, value: "false" },
+  ];
+  const template = await createTemplate(
+    page,
+    echoResponsesWithParameters(richParameters),
+  );
+
+  const workspaceName = await createWorkspace(
+    page,
+    template,
+    richParameters,
+    buildParameters,
+  );
+  await verifyParameters(page, workspaceName, richParameters, buildParameters);
+});
+
+test("create workspace with disable_param search params", async ({ page }) => {
+  const richParameters: RichParameter[] = [
+    firstParameter, // mutable
+    secondParameter, //immutable
+  ];
+
+  const templateName = await createTemplate(
+    page,
+    echoResponsesWithParameters(richParameters),
+  );
+
+  await page.goto(
+    `/templates/${templateName}/workspace?disable_params=first_parameter,second_parameter`,
+    {
+      waitUntil: "domcontentloaded",
+    },
+  );
+
+  await expect(page.getByLabel(/First parameter/i)).toBeDisabled();
+  await expect(page.getByLabel(/Second parameter/i)).toBeDisabled();
+});
diff --git a/site/e2e/tests/externalAuth.spec.ts b/site/e2e/tests/externalAuth.spec.ts
new file mode 100644
index 0000000000000..5480ad4b5988f
--- /dev/null
+++ b/site/e2e/tests/externalAuth.spec.ts
@@ -0,0 +1,143 @@
+import { test } from "@playwright/test";
+import { gitAuth } from "../constants";
+import { Endpoints } from "@octokit/types";
+import { ExternalAuthDevice } from "api/typesGenerated";
+import { Awaiter, createServer } from "../helpers";
+import { beforeCoderTest } from "../hooks";
+
+test.beforeEach(async ({ page }) => await beforeCoderTest(page));
+
+// Ensures that a Git auth provider with the device flow functions and completes!
+test("external auth device", async ({ page }) => {
+  const device: ExternalAuthDevice = {
+    device_code: "1234",
+    user_code: "1234-5678",
+    expires_in: 900,
+    interval: 1,
+    verification_uri: "",
+  };
+
+  // Start a server to mock the GitHub API.
+  const srv = await createServer(gitAuth.devicePort);
+  srv.use(gitAuth.validatePath, (req, res) => {
+    res.write(JSON.stringify(ghUser));
+    res.end();
+  });
+  srv.use(gitAuth.codePath, (req, res) => {
+    res.write(JSON.stringify(device));
+    res.end();
+  });
+  srv.use(gitAuth.installationsPath, (req, res) => {
+    res.write(JSON.stringify(ghInstall));
+    res.end();
+  });
+
+  const token = {
+    access_token: "",
+    error: "authorization_pending",
+    error_description: "",
+  };
+  // First we send a result from the API that the token hasn't been
+  // authorized yet to ensure the UI reacts properly.
+  const sentPending = new Awaiter();
+  srv.use(gitAuth.tokenPath, (req, res) => {
+    res.write(JSON.stringify(token));
+    res.end();
+    sentPending.done();
+  });
+
+  await page.goto(`/external-auth/${gitAuth.deviceProvider}`, {
+    waitUntil: "domcontentloaded",
+  });
+  await page.getByText(device.user_code).isVisible();
+  await sentPending.wait();
+  // Update the token to be valid and ensure the UI updates!
+  token.error = "";
+  token.access_token = "hello-world";
+  await page.waitForSelector("text=1 organization authorized");
+});
+
+test("external auth web", async ({ baseURL, page }) => {
+  const srv = await createServer(gitAuth.webPort);
+  // The GitHub validate endpoint returns the currently authenticated user!
+  srv.use(gitAuth.validatePath, (req, res) => {
+    res.write(JSON.stringify(ghUser));
+    res.end();
+  });
+  srv.use(gitAuth.tokenPath, (req, res) => {
+    res.write(JSON.stringify({ access_token: "hello-world" }));
+    res.end();
+  });
+  srv.use(gitAuth.authPath, (req, res) => {
+    res.redirect(
+      `${baseURL}/external-auth/${gitAuth.webProvider}/callback?code=1234&state=` +
+        req.query.state,
+    );
+  });
+  await page.goto(`/external-auth/${gitAuth.webProvider}`, {
+    waitUntil: "domcontentloaded",
+  });
+  // This endpoint doesn't have the installations URL set intentionally!
+  await page.waitForSelector("text=You've authenticated with GitHub!");
+});
+
+const ghUser: Endpoints["GET /user"]["response"]["data"] = {
+  login: "kylecarbs",
+  id: 7122116,
+  node_id: "MDQ6VXNlcjcxMjIxMTY=",
+  avatar_url: "https://avatars.githubusercontent.com/u/7122116?v=4",
+  gravatar_id: "",
+  url: "https://api.github.com/users/kylecarbs",
+  html_url: "https://github.com/kylecarbs",
+  followers_url: "https://api.github.com/users/kylecarbs/followers",
+  following_url:
+    "https://api.github.com/users/kylecarbs/following{/other_user}",
+  gists_url: "https://api.github.com/users/kylecarbs/gists{/gist_id}",
+  starred_url: "https://api.github.com/users/kylecarbs/starred{/owner}{/repo}",
+  subscriptions_url: "https://api.github.com/users/kylecarbs/subscriptions",
+  organizations_url: "https://api.github.com/users/kylecarbs/orgs",
+  repos_url: "https://api.github.com/users/kylecarbs/repos",
+  events_url: "https://api.github.com/users/kylecarbs/events{/privacy}",
+  received_events_url: "https://api.github.com/users/kylecarbs/received_events",
+  type: "User",
+  site_admin: false,
+  name: "Kyle Carberry",
+  company: "@coder",
+  blog: "https://carberry.com",
+  location: "Austin, TX",
+  email: "kyle@carberry.com",
+  hireable: null,
+  bio: "hey there",
+  twitter_username: "kylecarbs",
+  public_repos: 52,
+  public_gists: 9,
+  followers: 208,
+  following: 31,
+  created_at: "2014-04-01T02:24:41Z",
+  updated_at: "2023-06-26T13:03:09Z",
+};
+
+const ghInstall: Endpoints["GET /user/installations"]["response"]["data"] = {
+  installations: [
+    {
+      id: 1,
+      access_tokens_url: "",
+      account: ghUser,
+      app_id: 1,
+      app_slug: "coder",
+      created_at: "2014-04-01T02:24:41Z",
+      events: [],
+      html_url: "",
+      permissions: {},
+      repositories_url: "",
+      repository_selection: "all",
+      single_file_name: "",
+      suspended_at: null,
+      suspended_by: null,
+      target_id: 1,
+      target_type: "",
+      updated_at: "2023-06-26T13:03:09Z",
+    },
+  ],
+  total_count: 1,
+};
diff --git a/site/e2e/tests/gitAuth.spec.ts b/site/e2e/tests/gitAuth.spec.ts
deleted file mode 100644
index ab5659f92103b..0000000000000
--- a/site/e2e/tests/gitAuth.spec.ts
+++ /dev/null
@@ -1,140 +0,0 @@
-import { test } from "@playwright/test"
-import { gitAuth } from "../constants"
-import { Endpoints } from "@octokit/types"
-import { GitAuthDevice } from "api/typesGenerated"
-import { Awaiter, createServer } from "../helpers"
-
-// Ensures that a Git auth provider with the device flow functions and completes!
-test("git auth device", async ({ page }) => {
-  const device: GitAuthDevice = {
-    device_code: "1234",
-    user_code: "1234-5678",
-    expires_in: 900,
-    interval: 1,
-    verification_uri: "",
-  }
-
-  // Start a server to mock the GitHub API.
-  const srv = await createServer(gitAuth.devicePort)
-  srv.use(gitAuth.validatePath, (req, res) => {
-    res.write(JSON.stringify(ghUser))
-    res.end()
-  })
-  srv.use(gitAuth.codePath, (req, res) => {
-    res.write(JSON.stringify(device))
-    res.end()
-  })
-  srv.use(gitAuth.installationsPath, (req, res) => {
-    res.write(JSON.stringify(ghInstall))
-    res.end()
-  })
-
-  const token = {
-    access_token: "",
-    error: "authorization_pending",
-    error_description: "",
-  }
-  // First we send a result from the API that the token hasn't been
-  // authorized yet to ensure the UI reacts properly.
-  const sentPending = new Awaiter()
-  srv.use(gitAuth.tokenPath, (req, res) => {
-    res.write(JSON.stringify(token))
-    res.end()
-    sentPending.done()
-  })
-
-  await page.goto(`/gitauth/${gitAuth.deviceProvider}`, {
-    waitUntil: "networkidle",
-  })
-  await page.getByText(device.user_code).isVisible()
-  await sentPending.wait()
-  // Update the token to be valid and ensure the UI updates!
-  token.error = ""
-  token.access_token = "hello-world"
-  await page.waitForSelector("text=1 organization authorized")
-})
-
-test("git auth web", async ({ baseURL, page }) => {
-  const srv = await createServer(gitAuth.webPort)
-  // The GitHub validate endpoint returns the currently authenticated user!
-  srv.use(gitAuth.validatePath, (req, res) => {
-    res.write(JSON.stringify(ghUser))
-    res.end()
-  })
-  srv.use(gitAuth.tokenPath, (req, res) => {
-    res.write(JSON.stringify({ access_token: "hello-world" }))
-    res.end()
-  })
-  srv.use(gitAuth.authPath, (req, res) => {
-    res.redirect(
-      `${baseURL}/gitauth/${gitAuth.webProvider}/callback?code=1234&state=` +
-        req.query.state,
-    )
-  })
-  await page.goto(`/gitauth/${gitAuth.webProvider}`, {
-    waitUntil: "networkidle",
-  })
-  // This endpoint doesn't have the installations URL set intentionally!
-  await page.waitForSelector("text=You've authenticated with GitHub!")
-})
-
-const ghUser: Endpoints["GET /user"]["response"]["data"] = {
-  login: "kylecarbs",
-  id: 7122116,
-  node_id: "MDQ6VXNlcjcxMjIxMTY=",
-  avatar_url: "https://avatars.githubusercontent.com/u/7122116?v=4",
-  gravatar_id: "",
-  url: "https://api.github.com/users/kylecarbs",
-  html_url: "https://github.com/kylecarbs",
-  followers_url: "https://api.github.com/users/kylecarbs/followers",
-  following_url:
-    "https://api.github.com/users/kylecarbs/following{/other_user}",
-  gists_url: "https://api.github.com/users/kylecarbs/gists{/gist_id}",
-  starred_url: "https://api.github.com/users/kylecarbs/starred{/owner}{/repo}",
-  subscriptions_url: "https://api.github.com/users/kylecarbs/subscriptions",
-  organizations_url: "https://api.github.com/users/kylecarbs/orgs",
-  repos_url: "https://api.github.com/users/kylecarbs/repos",
-  events_url: "https://api.github.com/users/kylecarbs/events{/privacy}",
-  received_events_url: "https://api.github.com/users/kylecarbs/received_events",
-  type: "User",
-  site_admin: false,
-  name: "Kyle Carberry",
-  company: "@coder",
-  blog: "https://carberry.com",
-  location: "Austin, TX",
-  email: "kyle@carberry.com",
-  hireable: null,
-  bio: "hey there",
-  twitter_username: "kylecarbs",
-  public_repos: 52,
-  public_gists: 9,
-  followers: 208,
-  following: 31,
-  created_at: "2014-04-01T02:24:41Z",
-  updated_at: "2023-06-26T13:03:09Z",
-}
-
-const ghInstall: Endpoints["GET /user/installations"]["response"]["data"] = {
-  installations: [
-    {
-      id: 1,
-      access_tokens_url: "",
-      account: ghUser,
-      app_id: 1,
-      app_slug: "coder",
-      created_at: "2014-04-01T02:24:41Z",
-      events: [],
-      html_url: "",
-      permissions: {},
-      repositories_url: "",
-      repository_selection: "all",
-      single_file_name: "",
-      suspended_at: null,
-      suspended_by: null,
-      target_id: 1,
-      target_type: "",
-      updated_at: "2023-06-26T13:03:09Z",
-    },
-  ],
-  total_count: 1,
-}
diff --git a/site/e2e/tests/listTemplates.spec.ts b/site/e2e/tests/listTemplates.spec.ts
index e00b1e5d24cf5..922d7215b74ad 100644
--- a/site/e2e/tests/listTemplates.spec.ts
+++ b/site/e2e/tests/listTemplates.spec.ts
@@ -1,6 +1,9 @@
-import { test, expect } from "@playwright/test"
+import { test, expect } from "@playwright/test";
+import { beforeCoderTest } from "../hooks";
+
+test.beforeEach(async ({ page }) => await beforeCoderTest(page));
 
 test("list templates", async ({ page, baseURL }) => {
-  await page.goto(`${baseURL}/templates`, { waitUntil: "networkidle" })
-  await expect(page).toHaveTitle("Templates - Coder")
-})
+  await page.goto(`${baseURL}/templates`, { waitUntil: "domcontentloaded" });
+  await expect(page).toHaveTitle("Templates - Coder");
+});
diff --git a/site/e2e/tests/outdatedAgent.spec.ts b/site/e2e/tests/outdatedAgent.spec.ts
index 2b88ea71110df..835ecfd82ceb2 100644
--- a/site/e2e/tests/outdatedAgent.spec.ts
+++ b/site/e2e/tests/outdatedAgent.spec.ts
@@ -1,21 +1,26 @@
-import { test } from "@playwright/test"
-import { randomUUID } from "crypto"
+import { test } from "@playwright/test";
+import { randomUUID } from "crypto";
 import {
   createTemplate,
   createWorkspace,
   downloadCoderVersion,
   sshIntoWorkspace,
   startAgentWithCommand,
-} from "../helpers"
+  stopAgent,
+  stopWorkspace,
+} from "../helpers";
+import { beforeCoderTest } from "../hooks";
 
-const agentVersion = "v0.14.0"
+const agentVersion = "v0.14.0";
+
+test.beforeEach(async ({ page }) => await beforeCoderTest(page));
 
 test("ssh with agent " + agentVersion, async ({ page }) => {
-  const token = randomUUID()
+  const token = randomUUID();
   const template = await createTemplate(page, {
     apply: [
       {
-        complete: {
+        apply: {
           resources: [
             {
               agents: [
@@ -28,25 +33,28 @@ test("ssh with agent " + agentVersion, async ({ page }) => {
         },
       },
     ],
-  })
-  const workspace = await createWorkspace(page, template)
-  const binaryPath = await downloadCoderVersion(agentVersion)
-  await startAgentWithCommand(page, token, binaryPath)
+  });
+  const workspaceName = await createWorkspace(page, template);
+  const binaryPath = await downloadCoderVersion(agentVersion);
+  const agent = await startAgentWithCommand(page, token, binaryPath);
 
-  const client = await sshIntoWorkspace(page, workspace)
+  const client = await sshIntoWorkspace(page, workspaceName);
   await new Promise<void>((resolve, reject) => {
     // We just exec a command to be certain the agent is running!
     client.exec("exit 0", (err, stream) => {
       if (err) {
-        return reject(err)
+        return reject(err);
       }
       stream.on("exit", (code) => {
         if (code !== 0) {
-          return reject(new Error(`Command exited with code ${code}`))
+          return reject(new Error(`Command exited with code ${code}`));
         }
-        client.end()
-        resolve()
-      })
-    })
-  })
-})
+        client.end();
+        resolve();
+      });
+    });
+  });
+
+  await stopWorkspace(page, workspaceName);
+  await stopAgent(agent, false);
+});
diff --git a/site/e2e/tests/outdatedCLI.spec.ts b/site/e2e/tests/outdatedCLI.spec.ts
new file mode 100644
index 0000000000000..ae763ca2fff34
--- /dev/null
+++ b/site/e2e/tests/outdatedCLI.spec.ts
@@ -0,0 +1,60 @@
+import { test } from "@playwright/test";
+import { randomUUID } from "crypto";
+import {
+  createTemplate,
+  createWorkspace,
+  downloadCoderVersion,
+  sshIntoWorkspace,
+  startAgent,
+  stopAgent,
+  stopWorkspace,
+} from "../helpers";
+import { beforeCoderTest } from "../hooks";
+
+const clientVersion = "v0.14.0";
+
+test.beforeEach(async ({ page }) => await beforeCoderTest(page));
+
+test("ssh with client " + clientVersion, async ({ page }) => {
+  const token = randomUUID();
+  const template = await createTemplate(page, {
+    apply: [
+      {
+        apply: {
+          resources: [
+            {
+              agents: [
+                {
+                  token,
+                },
+              ],
+            },
+          ],
+        },
+      },
+    ],
+  });
+  const workspaceName = await createWorkspace(page, template);
+  const agent = await startAgent(page, token);
+  const binaryPath = await downloadCoderVersion(clientVersion);
+
+  const client = await sshIntoWorkspace(page, workspaceName, binaryPath);
+  await new Promise<void>((resolve, reject) => {
+    // We just exec a command to be certain the agent is running!
+    client.exec("exit 0", (err, stream) => {
+      if (err) {
+        return reject(err);
+      }
+      stream.on("exit", (code) => {
+        if (code !== 0) {
+          return reject(new Error(`Command exited with code ${code}`));
+        }
+        client.end();
+        resolve();
+      });
+    });
+  });
+
+  await stopWorkspace(page, workspaceName);
+  await stopAgent(agent);
+});
diff --git a/site/e2e/tests/restartWorkspace.spec.ts b/site/e2e/tests/restartWorkspace.spec.ts
new file mode 100644
index 0000000000000..3d8fb704b699d
--- /dev/null
+++ b/site/e2e/tests/restartWorkspace.spec.ts
@@ -0,0 +1,48 @@
+import { test } from "@playwright/test";
+import {
+  buildWorkspaceWithParameters,
+  createTemplate,
+  createWorkspace,
+  echoResponsesWithParameters,
+  verifyParameters,
+} from "../helpers";
+
+import { firstBuildOption, secondBuildOption } from "../parameters";
+import { RichParameter } from "../provisionerGenerated";
+import { beforeCoderTest } from "../hooks";
+
+test.beforeEach(async ({ page }) => await beforeCoderTest(page));
+
+test("restart workspace with ephemeral parameters", async ({ page }) => {
+  const richParameters: RichParameter[] = [firstBuildOption, secondBuildOption];
+  const template = await createTemplate(
+    page,
+    echoResponsesWithParameters(richParameters),
+  );
+  const workspaceName = await createWorkspace(page, template);
+
+  // Verify that build options are default (not selected).
+  await verifyParameters(page, workspaceName, richParameters, [
+    { name: firstBuildOption.name, value: firstBuildOption.defaultValue },
+    { name: secondBuildOption.name, value: secondBuildOption.defaultValue },
+  ]);
+
+  // Now, restart the workspace with ephemeral parameters selected.
+  const buildParameters = [
+    { name: firstBuildOption.name, value: "AAAAA" },
+    { name: secondBuildOption.name, value: "true" },
+  ];
+  await buildWorkspaceWithParameters(
+    page,
+    workspaceName,
+    richParameters,
+    buildParameters,
+    true,
+  );
+
+  // Verify that build options are default (not selected).
+  await verifyParameters(page, workspaceName, richParameters, [
+    { name: firstBuildOption.name, value: firstBuildOption.defaultValue },
+    { name: secondBuildOption.name, value: secondBuildOption.defaultValue },
+  ]);
+});
diff --git a/site/e2e/tests/startWorkspace.spec.ts b/site/e2e/tests/startWorkspace.spec.ts
new file mode 100644
index 0000000000000..ec22cda01d0c9
--- /dev/null
+++ b/site/e2e/tests/startWorkspace.spec.ts
@@ -0,0 +1,49 @@
+import { test } from "@playwright/test";
+import {
+  buildWorkspaceWithParameters,
+  createTemplate,
+  createWorkspace,
+  echoResponsesWithParameters,
+  stopWorkspace,
+  verifyParameters,
+} from "../helpers";
+
+import { firstBuildOption, secondBuildOption } from "../parameters";
+import { RichParameter } from "../provisionerGenerated";
+
+test("start workspace with ephemeral parameters", async ({ page }) => {
+  const richParameters: RichParameter[] = [firstBuildOption, secondBuildOption];
+  const template = await createTemplate(
+    page,
+    echoResponsesWithParameters(richParameters),
+  );
+  const workspaceName = await createWorkspace(page, template);
+
+  // Verify that build options are default (not selected).
+  await verifyParameters(page, workspaceName, richParameters, [
+    { name: firstBuildOption.name, value: firstBuildOption.defaultValue },
+    { name: secondBuildOption.name, value: secondBuildOption.defaultValue },
+  ]);
+
+  // Stop the workspace
+  await stopWorkspace(page, workspaceName);
+
+  // Now, start the workspace with ephemeral parameters selected.
+  const buildParameters = [
+    { name: firstBuildOption.name, value: "AAAAA" },
+    { name: secondBuildOption.name, value: "true" },
+  ];
+
+  await buildWorkspaceWithParameters(
+    page,
+    workspaceName,
+    richParameters,
+    buildParameters,
+  );
+
+  // Verify that build options are default (not selected).
+  await verifyParameters(page, workspaceName, richParameters, [
+    { name: firstBuildOption.name, value: firstBuildOption.defaultValue },
+    { name: secondBuildOption.name, value: secondBuildOption.defaultValue },
+  ]);
+});
diff --git a/site/e2e/tests/updateWorkspace.spec.ts b/site/e2e/tests/updateWorkspace.spec.ts
new file mode 100644
index 0000000000000..b8e3d51d453b8
--- /dev/null
+++ b/site/e2e/tests/updateWorkspace.spec.ts
@@ -0,0 +1,134 @@
+import { test } from "@playwright/test";
+
+import {
+  createTemplate,
+  createWorkspace,
+  echoResponsesWithParameters,
+  updateTemplate,
+  updateWorkspace,
+  updateWorkspaceParameters,
+  verifyParameters,
+} from "../helpers";
+
+import {
+  fifthParameter,
+  firstParameter,
+  secondParameter,
+  sixthParameter,
+  secondBuildOption,
+} from "../parameters";
+import { RichParameter } from "../provisionerGenerated";
+import { beforeCoderTest } from "../hooks";
+
+test.beforeEach(async ({ page }) => await beforeCoderTest(page));
+
+test("update workspace, new optional, immutable parameter added", async ({
+  page,
+}) => {
+  const richParameters: RichParameter[] = [firstParameter, secondParameter];
+  const template = await createTemplate(
+    page,
+    echoResponsesWithParameters(richParameters),
+  );
+
+  const workspaceName = await createWorkspace(page, template);
+
+  // Verify that parameter values are default.
+  await verifyParameters(page, workspaceName, richParameters, [
+    { name: firstParameter.name, value: firstParameter.defaultValue },
+    { name: secondParameter.name, value: secondParameter.defaultValue },
+  ]);
+
+  // Push updated template.
+  const updatedRichParameters = [...richParameters, fifthParameter];
+  await updateTemplate(
+    page,
+    template,
+    echoResponsesWithParameters(updatedRichParameters),
+  );
+
+  // Now, update the workspace, and select the value for immutable parameter.
+  await updateWorkspace(page, workspaceName, updatedRichParameters, [
+    { name: fifthParameter.name, value: fifthParameter.options[0].value },
+  ]);
+
+  // Verify parameter values.
+  await verifyParameters(page, workspaceName, updatedRichParameters, [
+    { name: firstParameter.name, value: firstParameter.defaultValue },
+    { name: secondParameter.name, value: secondParameter.defaultValue },
+    { name: fifthParameter.name, value: fifthParameter.options[0].value },
+  ]);
+});
+
+test("update workspace, new required, mutable parameter added", async ({
+  page,
+}) => {
+  const richParameters: RichParameter[] = [firstParameter, secondParameter];
+  const template = await createTemplate(
+    page,
+    echoResponsesWithParameters(richParameters),
+  );
+
+  const workspaceName = await createWorkspace(page, template);
+
+  // Verify that parameter values are default.
+  await verifyParameters(page, workspaceName, richParameters, [
+    { name: firstParameter.name, value: firstParameter.defaultValue },
+    { name: secondParameter.name, value: secondParameter.defaultValue },
+  ]);
+
+  // Push updated template.
+  const updatedRichParameters = [...richParameters, sixthParameter];
+  await updateTemplate(
+    page,
+    template,
+    echoResponsesWithParameters(updatedRichParameters),
+  );
+
+  // Now, update the workspace, and provide the parameter value.
+  const buildParameters = [{ name: sixthParameter.name, value: "99" }];
+  await updateWorkspace(
+    page,
+    workspaceName,
+    updatedRichParameters,
+    buildParameters,
+  );
+
+  // Verify parameter values.
+  await verifyParameters(page, workspaceName, updatedRichParameters, [
+    { name: firstParameter.name, value: firstParameter.defaultValue },
+    { name: secondParameter.name, value: secondParameter.defaultValue },
+    ...buildParameters,
+  ]);
+});
+
+test("update workspace with ephemeral parameter enabled", async ({ page }) => {
+  const richParameters: RichParameter[] = [firstParameter, secondBuildOption];
+  const template = await createTemplate(
+    page,
+    echoResponsesWithParameters(richParameters),
+  );
+
+  const workspaceName = await createWorkspace(page, template);
+
+  // Verify that parameter values are default.
+  await verifyParameters(page, workspaceName, richParameters, [
+    { name: firstParameter.name, value: firstParameter.defaultValue },
+    { name: secondBuildOption.name, value: secondBuildOption.defaultValue },
+  ]);
+
+  // Now, update the workspace, and select the value for ephemeral parameter.
+  const buildParameters = [{ name: secondBuildOption.name, value: "true" }];
+  await updateWorkspaceParameters(
+    page,
+    workspaceName,
+    richParameters,
+    buildParameters,
+  );
+
+  // Verify that parameter values are default.
+  await verifyParameters(page, workspaceName, richParameters, [
+    { name: firstParameter.name, value: firstParameter.defaultValue },
+    { name: secondBuildOption.name, value: secondBuildOption.defaultValue },
+  ]);
+});
diff --git a/site/e2e/tests/webTerminal.spec.ts b/site/e2e/tests/webTerminal.spec.ts
index 492634b293a3e..51d4236862866 100644
--- a/site/e2e/tests/webTerminal.spec.ts
+++ b/site/e2e/tests/webTerminal.spec.ts
@@ -1,18 +1,29 @@
-import { test } from "@playwright/test"
-import { createTemplate, createWorkspace, startAgent } from "../helpers"
-import { randomUUID } from "crypto"
+import { test } from "@playwright/test";
+import {
+  createTemplate,
+  createWorkspace,
+  startAgent,
+  stopAgent,
+} from "../helpers";
+import { randomUUID } from "crypto";
+import { beforeCoderTest } from "../hooks";
+
+test.beforeEach(async ({ page }) => await beforeCoderTest(page));
 
 test("web terminal", async ({ context, page }) => {
-  const token = randomUUID()
+  const token = randomUUID();
   const template = await createTemplate(page, {
     apply: [
       {
-        complete: {
+        apply: {
           resources: [
             {
               agents: [
                 {
                   token,
+                  displayApps: {
+                    webTerminal: true,
+                  },
                 },
               ],
             },
@@ -20,28 +31,44 @@ test("web terminal", async ({ context, page }) => {
         },
       },
     ],
-  })
-  await createWorkspace(page, template)
-  await startAgent(page, token)
+  });
+  await createWorkspace(page, template);
+  const agent = await startAgent(page, token);
 
   // Wait for the web terminal to open in a new tab
-  const pagePromise = context.waitForEvent("page")
-  await page.getByTestId("terminal").click()
-  const terminal = await pagePromise
-  await terminal.waitForLoadState("networkidle")
+  const pagePromise = context.waitForEvent("page");
+  await page.getByTestId("terminal").click();
+  const terminal = await pagePromise;
+  await terminal.waitForLoadState("domcontentloaded");
+
+  await terminal.waitForSelector("div.xterm-rows", {
+    state: "visible",
+  });
+
+  // Workaround: delay next steps as "div.xterm-rows" can be recreated/reattached
+  // after a couple of milliseconds.
+  await terminal.waitForTimeout(2000);
 
   // Ensure that we can type in it
-  await terminal.keyboard.type("echo hello")
-  await terminal.keyboard.press("Enter")
-
-  const locator = terminal.locator("text=hello")
-
-  for (let i = 0; i < 10; i++) {
-    const items = await locator.all()
-    // Make sure the text came back
-    if (items.length === 2) {
-      break
-    }
-    await new Promise((r) => setTimeout(r, 250))
+  await terminal.keyboard.type("echo he${justabreak}llo123456");
+  await terminal.keyboard.press("Enter");
+
+  // Check if "echo" command was executed
+  // try-catch is used temporarily to find the root cause: https://github.com/coder/coder/actions/runs/6176958762/job/16767089943
+  try {
+    await terminal.waitForSelector(
+      'div.xterm-rows div:text-matches("hello123456")',
+      {
+        state: "visible",
+        timeout: 10 * 1000,
+      },
+    );
+  } catch (error) {
+    const pageContent = await terminal.content();
+    // eslint-disable-next-line no-console -- Let's see what is inside of xterm-rows
+    console.log("Unable to find echoed text:", pageContent);
+    throw error;
   }
-})
+
+  await stopAgent(agent);
+});
diff --git a/site/index.html b/site/index.html
index 92801202a5d88..f02d25b77762a 100644
--- a/site/index.html
+++ b/site/index.html
@@ -10,9 +10,10 @@
 
 <head>
   <meta charset="utf-8" />
+  <title>Coder</title>
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="theme-color" content="#17172E" />
-  <meta name="application-name" content="Coder" />
+  <meta name="application-name" content="{{ .ApplicationName }}" />
   <meta property="og:type" content="website" />
   <meta property="csrf-token" content="{{ .CSRF.Token }}" />
   <meta property="build-info" content="{{ .BuildInfo }}" />
@@ -22,22 +23,45 @@
   <meta property="experiments" content="{{ .Experiments }}" />
   <meta property="regions" content="{{ .Regions }}" />
   <meta property="docs-url" content="{{ .DocsURL }}" />
+  <meta property="logo-url" content="{{ .LogoURL }}" />
   <!-- We need to set data-react-helmet to be able to override it in the workspace page -->
   <link
     rel="alternate icon"
     type="image/png"
-    href="/favicons/favicon.png"
+    href="/favicons/favicon-light.png"
+    media="(prefers-color-scheme: dark)"
     data-react-helmet="true"
   />
   <link
     rel="icon"
     type="image/svg+xml"
-    href="/favicons/favicon.svg"
+    href="/favicons/favicon-light.svg"
+    media="(prefers-color-scheme: dark)"
     data-react-helmet="true"
   />
+  <link
+    rel="alternate icon"
+    type="image/png"
+    href="/favicons/favicon-dark.png"
+    media="(prefers-color-scheme: light)"
+    data-react-helmet="true"
+  />
+  <link
+    rel="icon"
+    type="image/svg+xml"
+    href="/favicons/favicon-dark.svg"
+    media="(prefers-color-scheme: light)"
+    data-react-helmet="true"
+  />
+  <style>
+    html,
+    body {
+      background-color: hsl(0, 0%, 1%);
+    }
+  </style>
 </head>
 
 <body>
   <div id="root"></div>
-  <script type="module" src="./src/Main.tsx"></script>
+  <script type="module" src="./src/index.tsx"></script>
 </body>
diff --git a/site/jest-runner-eslint.config.js b/site/jest-runner-eslint.config.js
index b009f17201f6b..5eda6aa9bd508 100644
--- a/site/jest-runner-eslint.config.js
+++ b/site/jest-runner-eslint.config.js
@@ -1,5 +1,5 @@
 // Toggle eslint --fix by specifying the `FIX` env.
-const fix = !!process.env.FIX
+const fix = !!process.env.FIX;
 
 module.exports = {
   cliOptions: {
@@ -10,4 +10,4 @@ module.exports = {
     resolvePluginsRelativeTo: ".",
     maxWarnings: 0,
   },
-}
+};
diff --git a/site/jest.config.ts b/site/jest.config.ts
index a732cb78be3cd..de1f518e97563 100644
--- a/site/jest.config.ts
+++ b/site/jest.config.ts
@@ -16,6 +16,7 @@ module.exports = {
               transform: {
                 react: {
                   runtime: "automatic",
+                  importSource: "@emotion/react",
                 },
               },
               experimental: {
@@ -67,4 +68,4 @@ module.exports = {
     "!<rootDir>/out/**/*.*",
     "!<rootDir>/storybook-static/**/*.*",
   ],
-}
+};
diff --git a/site/jest.setup.ts b/site/jest.setup.ts
index 3ecf3711a22df..2a17c9dc9a62b 100644
--- a/site/jest.setup.ts
+++ b/site/jest.setup.ts
@@ -1,16 +1,16 @@
-import "@testing-library/jest-dom"
-import { cleanup } from "@testing-library/react"
-import crypto from "crypto"
-import { server } from "./src/testHelpers/server"
-import "jest-location-mock"
-import { TextEncoder, TextDecoder } from "util"
-import { Blob } from "buffer"
-import jestFetchMock from "jest-fetch-mock"
-import { ProxyLatencyReport } from "contexts/useProxyLatency"
-import { Region } from "api/typesGenerated"
-import { useMemo } from "react"
+import "@testing-library/jest-dom";
+import { cleanup } from "@testing-library/react";
+import crypto from "crypto";
+import { server } from "testHelpers/server";
+import "jest-location-mock";
+import { TextEncoder, TextDecoder } from "util";
+import { Blob } from "buffer";
+import jestFetchMock from "jest-fetch-mock";
+import { ProxyLatencyReport } from "contexts/useProxyLatency";
+import { Region } from "api/typesGenerated";
+import { useMemo } from "react";
 
-jestFetchMock.enableMocks()
+jestFetchMock.enableMocks();
 
 // useProxyLatency does some http requests to determine latency.
 // This would fail unit testing, or at least make it very slow with
@@ -21,7 +21,7 @@ jest.mock("contexts/useProxyLatency", () => ({
     // Mocking the hook with a hook.
     const proxyLatencies = useMemo(() => {
       if (!proxies) {
-        return {} as Record<string, ProxyLatencyReport>
+        return {} as Record<string, ProxyLatencyReport>;
       }
       return proxies.reduce(
         (acc, proxy) => {
@@ -31,49 +31,50 @@ jest.mock("contexts/useProxyLatency", () => ({
             // If you make this random it could break stories.
             latencyMS: 8,
             at: new Date(),
-          }
-          return acc
+          };
+          return acc;
         },
         {} as Record<string, ProxyLatencyReport>,
-      )
-    }, [proxies])
+      );
+    }, [proxies]);
 
-    return { proxyLatencies, refetch: jest.fn() }
+    return { proxyLatencies, refetch: jest.fn() };
   },
-}))
+}));
 
-global.TextEncoder = TextEncoder
+global.TextEncoder = TextEncoder;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Polyfill for jsdom
-global.TextDecoder = TextDecoder as any
+global.TextDecoder = TextDecoder as any;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Polyfill for jsdom
-global.Blob = Blob as any
+global.Blob = Blob as any;
+global.scrollTo = jest.fn();
 
 // Polyfill the getRandomValues that is used on utils/random.ts
 Object.defineProperty(global.self, "crypto", {
   value: {
     getRandomValues: function (buffer: Buffer) {
-      return crypto.randomFillSync(buffer)
+      return crypto.randomFillSync(buffer);
     },
   },
-})
+});
 
 // Establish API mocking before all tests through MSW.
 beforeAll(() =>
   server.listen({
     onUnhandledRequest: "warn",
   }),
-)
+);
 
 // Reset any request handlers that we may add during the tests,
 // so they don't affect other tests.
 afterEach(() => {
-  cleanup()
-  server.resetHandlers()
-  jest.clearAllMocks()
-})
+  cleanup();
+  server.resetHandlers();
+  jest.clearAllMocks();
+});
 
 // Clean up after the tests are finished.
-afterAll(() => server.close())
+afterAll(() => server.close());
 
 // This is needed because we are compiling under `--isolatedModules`
-export {}
+export {};
diff --git a/site/package.json b/site/package.json
index 538e158218292..1b9943b56e040 100644
--- a/site/package.json
+++ b/site/package.json
@@ -10,16 +10,15 @@
     "check:all": "pnpm format:check && pnpm lint && pnpm test",
     "chromatic": "chromatic",
     "dev": "vite",
-    "format:check": "pnpm exec prettier --cache --check '../**/*.{css,html,js,json,jsx,md,ts,tsx,yaml,yml}'",
-    "format:types": "pnpm exec prettier --cache --write './src/api/typesGenerated.ts'",
-    "format:write": "pnpm exec prettier --cache --write '../**/*.{css,html,js,json,jsx,md,ts,tsx,yaml,yml}'",
-    "format:write:only": "pnpm exec prettier --write",
+    "format:check": "prettier --cache --check '../**/*.{css,html,js,json,jsx,md,ts,tsx,yaml,yml}'",
+    "format:write": "prettier --cache --write '../**/*.{css,html,js,json,jsx,md,ts,tsx,yaml,yml}'",
+    "format:write:only": "prettier --cache --write",
     "lint": "pnpm typegen && pnpm run lint:types && pnpm exec jest --selectProjects lint",
     "lint:fix": "FIX=true pnpm lint",
     "lint:types": "tsc --noEmit",
     "playwright:install": "playwright install --with-deps chromium",
     "playwright:test": "playwright test --config=e2e/playwright.config.ts",
-    "gen:provisioner": "protoc --plugin=./node_modules/.bin/protoc-gen-ts-proto --ts_proto_out=./e2e/ --ts_proto_opt=outputJsonMethods=false,outputEncodeMethods=encode-no-creation,outputClientImpl=false,nestJs=false,outputPartialMethods=false,fileSuffix=Generated,suffix=hey -I ../provisionersdk/proto ../provisionersdk/proto/provisioner.proto && prettier --cache --write './e2e/provisionerGenerated.ts'",
+    "gen:provisioner": "protoc --plugin=./node_modules/.bin/protoc-gen-ts_proto --ts_proto_out=./e2e/ --ts_proto_opt=outputJsonMethods=false,outputEncodeMethods=encode-no-creation,outputClientImpl=false,nestJs=false,outputPartialMethods=false,fileSuffix=Generated,suffix=hey -I ../provisionersdk/proto ../provisionersdk/proto/provisioner.proto && pnpm exec prettier --ignore-path '/dev/null' --cache --write './e2e/provisionerGenerated.ts'",
     "storybook": "STORYBOOK=true storybook dev -p 6006",
     "storybook:build": "storybook build",
     "test": "jest --selectProjects test",
@@ -32,7 +31,8 @@
   },
   "dependencies": {
     "@emoji-mart/data": "1.1.2",
-    "@emoji-mart/react": "1.0.1",
+    "@emoji-mart/react": "1.1.1",
+    "@emotion/css": "11.11.2",
     "@emotion/react": "11.11.1",
     "@emotion/styled": "11.11.0",
     "@fastly/performance-observer-polyfill": "2.0.0",
@@ -44,45 +44,41 @@
     "@mui/material": "5.14.0",
     "@mui/styles": "5.14.0",
     "@mui/system": "5.14.0",
-    "@tanstack/react-query": "4.32.0",
-    "@types/color-convert": "2.0.0",
-    "@types/lodash": "4.14.196",
-    "@types/react-color": "3.0.6",
-    "@types/semver": "7.5.0",
-    "@vitejs/plugin-react": "4.0.1",
+    "@mui/utils": "5.14.11",
+    "@vitejs/plugin-react": "4.1.0",
     "@xstate/inspect": "0.8.0",
     "@xstate/react": "3.2.1",
     "ansi-to-html": "0.7.2",
-    "axios": "1.3.4",
+    "axios": "1.5.0",
     "canvas": "2.11.0",
-    "chart.js": "3.9.1",
+    "chart.js": "4.4.0",
     "chartjs-adapter-date-fns": "3.0.0",
+    "chartjs-plugin-annotation": "3.0.1",
     "chroma-js": "2.4.2",
     "color-convert": "2.0.1",
-    "cron-parser": "4.7.0",
-    "cronstrue": "2.28.0",
+    "cron-parser": "4.9.0",
+    "cronstrue": "2.32.0",
     "date-fns": "2.30.0",
     "dayjs": "1.11.4",
     "emoji-mart": "5.4.0",
-    "eslint-plugin-testing-library": "5.11.0",
+    "eslint-plugin-testing-library": "6.0.1",
     "eventsourcemock": "2.0.0",
     "formik": "2.4.1",
     "front-matter": "4.0.2",
-    "i18next": "22.5.0",
     "jest-environment-jsdom": "29.5.0",
     "lodash": "4.17.21",
-    "monaco-editor": "0.40.0",
+    "monaco-editor": "0.43.0",
     "pretty-bytes": "6.1.0",
     "react": "18.2.0",
     "react-chartjs-2": "5.2.0",
     "react-color": "2.19.3",
     "react-confetti": "6.1.0",
+    "react-date-range": "1.4.0",
     "react-dom": "18.2.0",
-    "react-headless-tabs": "6.0.3",
     "react-helmet-async": "1.3.0",
-    "react-i18next": "12.2.2",
-    "react-markdown": "8.0.3",
-    "react-router-dom": "6.14.1",
+    "react-markdown": "8.0.7",
+    "react-query": "npm:@tanstack/react-query@4.35.3",
+    "react-router-dom": "6.16.0",
     "react-syntax-highlighter": "15.5.0",
     "react-use": "17.4.0",
     "react-virtualized-auto-sizer": "1.0.20",
@@ -90,60 +86,67 @@
     "remark-gfm": "3.0.1",
     "rollup-plugin-visualizer": "5.9.0",
     "semver": "7.5.3",
-    "sourcemapped-stacktrace": "1.1.11",
+    "ts-proto": "1.159.1",
     "ts-prune": "0.10.3",
     "tzdata": "1.0.30",
     "ua-parser-js": "1.0.33",
+    "ufuzzy": "npm:@leeoniya/ufuzzy@1.0.10",
     "unique-names-generator": "4.7.1",
     "uuid": "9.0.0",
     "vite": "4.4.2",
     "xstate": "4.38.1",
-    "xterm": "5.2.1",
-    "xterm-addon-canvas": "0.4.0",
-    "xterm-addon-fit": "0.7.0",
-    "xterm-addon-web-links": "0.8.0",
-    "yup": "1.2.0"
+    "xterm": "5.2.0",
+    "xterm-addon-canvas": "0.5.0",
+    "xterm-addon-fit": "0.8.0",
+    "xterm-addon-unicode11": "0.6.0",
+    "xterm-addon-web-links": "0.9.0",
+    "xterm-addon-webgl": "0.16.0",
+    "yup": "1.3.2"
   },
   "devDependencies": {
-    "@octokit/types": "11.1.0",
-    "@playwright/test": "1.36.0",
-    "@storybook/addon-actions": "7.2.0",
-    "@storybook/addon-essentials": "7.2.0",
-    "@storybook/addon-links": "7.2.0",
-    "@storybook/addon-mdx-gfm": "7.2.0",
-    "@storybook/react": "7.2.0",
-    "@storybook/react-vite": "7.2.0",
+    "@octokit/types": "12.0.0",
+    "@playwright/test": "1.38.0",
+    "@storybook/addon-actions": "7.4.0",
+    "@storybook/addon-essentials": "7.4.0",
+    "@storybook/addon-links": "7.4.0",
+    "@storybook/addon-mdx-gfm": "7.4.0",
+    "@storybook/react": "7.4.0",
+    "@storybook/react-vite": "7.4.0",
     "@swc/core": "1.3.38",
     "@swc/jest": "0.2.24",
-    "@testing-library/jest-dom": "5.17.0",
+    "@testing-library/jest-dom": "6.1.2",
     "@testing-library/react": "14.0.0",
     "@testing-library/react-hooks": "8.0.1",
-    "@testing-library/user-event": "14.4.3",
+    "@testing-library/user-event": "14.5.1",
     "@types/chroma-js": "2.4.0",
+    "@types/color-convert": "2.0.0",
     "@types/express": "4.17.17",
     "@types/jest": "29.5.2",
-    "@types/node": "18.17.0",
+    "@types/lodash": "4.14.196",
+    "@types/node": "18.18.1",
     "@types/react": "18.2.6",
+    "@types/react-color": "3.0.6",
+    "@types/react-date-range": "1.4.4",
     "@types/react-dom": "18.2.4",
     "@types/react-helmet": "6.1.5",
     "@types/react-syntax-highlighter": "15.5.5",
     "@types/react-virtualized-auto-sizer": "1.0.1",
     "@types/react-window": "1.8.5",
+    "@types/semver": "7.5.0",
     "@types/ssh2": "1.11.13",
-    "@types/testing-library__jest-dom": "5.14.9",
     "@types/ua-parser-js": "0.7.36",
     "@types/uuid": "9.0.2",
-    "@typescript-eslint/eslint-plugin": "6.2.1",
-    "@typescript-eslint/parser": "6.2.1",
+    "@typescript-eslint/eslint-plugin": "6.7.0",
+    "@typescript-eslint/parser": "6.7.0",
     "@xstate/cli": "0.5.2",
-    "chromatic": "6.20.0",
-    "eslint": "8.46.0",
-    "eslint-config-prettier": "8.9.0",
-    "eslint-import-resolver-typescript": "3.5.5",
-    "eslint-plugin-compat": "4.1.4",
+    "chromatic": "7.2.0",
+    "eslint": "8.50.0",
+    "eslint-config-prettier": "9.0.0",
+    "eslint-import-resolver-typescript": "3.6.0",
+    "eslint-plugin-compat": "4.2.0",
     "eslint-plugin-eslint-comments": "3.2.0",
     "eslint-plugin-import": "2.28.0",
-    "eslint-plugin-jest": "27.2.2",
+    "eslint-plugin-jest": "27.4.0",
     "eslint-plugin-jsx-a11y": "6.7.1",
     "eslint-plugin-react": "7.33.0",
     "eslint-plugin-react-hooks": "4.6.0",
@@ -151,26 +154,24 @@
     "eslint-plugin-unicorn": "48.0.0",
     "express": "4.18.2",
     "jest": "29.6.2",
-    "jest-canvas-mock": "2.4.0",
+    "jest-canvas-mock": "2.5.2",
     "jest-fetch-mock": "3.0.3",
-    "jest-location-mock": "1.0.9",
+    "jest-location-mock": "2.0.0",
     "jest-runner-eslint": "2.1.0",
-    "jest-websocket-mock": "2.4.0",
+    "jest-websocket-mock": "2.5.0",
     "jest_workaround": "0.1.14",
-    "just-debounce-it": "3.2.0",
-    "msw": "1.2.2",
+    "msw": "1.3.0",
     "prettier": "3.0.0",
     "protobufjs": "7.2.4",
-    "resize-observer": "1.0.4",
     "rxjs": "7.8.1",
     "ssh2": "1.14.0",
-    "storybook": "7.2.0",
+    "storybook": "7.4.0",
     "storybook-addon-react-router-v6": "2.0.0",
     "storybook-react-context": "0.6.0",
     "ts-node": "10.9.1",
-    "ts-proto": "1.156.0",
-    "typescript": "5.1.6",
-    "vite-plugin-checker": "0.6.0"
+    "typescript": "5.2.2",
+    "vite-plugin-checker": "0.6.0",
+    "vite-plugin-turbosnap": "1.0.2"
   },
   "browserslist": [
     "chrome 66",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index abb876c024c61..a16f6a47b29b7 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -13,8 +13,11 @@ dependencies:
     specifier: 1.1.2
     version: 1.1.2
   '@emoji-mart/react':
-    specifier: 1.0.1
-    version: 1.0.1(emoji-mart@5.4.0)(react@18.2.0)
+    specifier: 1.1.1
+    version: 1.1.1(emoji-mart@5.4.0)(react@18.2.0)
+  '@emotion/css':
+    specifier: 11.11.2
+    version: 11.11.2
   '@emotion/react':
     specifier: 11.11.1
     version: 11.11.1(@types/react@18.2.6)(react@18.2.0)
@@ -32,7 +35,7 @@ dependencies:
     version: 5.0.2
   '@monaco-editor/react':
     specifier: 4.5.0
-    version: 4.5.0(monaco-editor@0.40.0)(react-dom@18.2.0)(react@18.2.0)
+    version: 4.5.0(monaco-editor@0.43.0)(react-dom@18.2.0)(react@18.2.0)
   '@mui/icons-material':
     specifier: 5.14.0
     version: 5.14.0(@mui/material@5.14.0)(@types/react@18.2.6)(react@18.2.0)
@@ -48,27 +51,15 @@ dependencies:
   '@mui/system':
     specifier: 5.14.0
     version: 5.14.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react@18.2.0)
-  '@tanstack/react-query':
-    specifier: 4.32.0
-    version: 4.32.0(react-dom@18.2.0)(react@18.2.0)
-  '@types/color-convert':
-    specifier: 2.0.0
-    version: 2.0.0
-  '@types/lodash':
-    specifier: 4.14.196
-    version: 4.14.196
-  '@types/react-color':
-    specifier: 3.0.6
-    version: 3.0.6
-  '@types/semver':
-    specifier: 7.5.0
-    version: 7.5.0
+  '@mui/utils':
+    specifier: 5.14.11
+    version: 5.14.11(@types/react@18.2.6)(react@18.2.0)
   '@vitejs/plugin-react':
-    specifier: 4.0.1
-    version: 4.0.1(vite@4.4.2)
+    specifier: 4.1.0
+    version: 4.1.0(vite@4.4.2)
   '@xstate/inspect':
     specifier: 0.8.0
-    version: 0.8.0(ws@8.13.0)(xstate@4.38.1)
+    version: 0.8.0(ws@8.14.2)(xstate@4.38.1)
   '@xstate/react':
     specifier: 3.2.1
     version: 3.2.1(@types/react@18.2.6)(react@18.2.0)(xstate@4.38.1)
@@ -76,17 +67,20 @@ dependencies:
     specifier: 0.7.2
     version: 0.7.2
   axios:
-    specifier: 1.3.4
-    version: 1.3.4
+    specifier: 1.5.0
+    version: 1.5.0
   canvas:
     specifier: 2.11.0
     version: 2.11.0
   chart.js:
-    specifier: 3.9.1
-    version: 3.9.1
+    specifier: 4.4.0
+    version: 4.4.0
   chartjs-adapter-date-fns:
     specifier: 3.0.0
-    version: 3.0.0(chart.js@3.9.1)(date-fns@2.30.0)
+    version: 3.0.0(chart.js@4.4.0)(date-fns@2.30.0)
+  chartjs-plugin-annotation:
+    specifier: 3.0.1
+    version: 3.0.1(chart.js@4.4.0)
   chroma-js:
     specifier: 2.4.2
     version: 2.4.2
@@ -94,11 +88,11 @@ dependencies:
     specifier: 2.0.1
     version: 2.0.1
   cron-parser:
-    specifier: 4.7.0
-    version: 4.7.0
+    specifier: 4.9.0
+    version: 4.9.0
   cronstrue:
-    specifier: 2.28.0
-    version: 2.28.0
+    specifier: 2.32.0
+    version: 2.32.0
   date-fns:
     specifier: 2.30.0
     version: 2.30.0
@@ -109,8 +103,8 @@ dependencies:
     specifier: 5.4.0
     version: 5.4.0
   eslint-plugin-testing-library:
-    specifier: 5.11.0
-    version: 5.11.0(eslint@8.46.0)(typescript@5.1.6)
+    specifier: 6.0.1
+    version: 6.0.1(eslint@8.50.0)(typescript@5.2.2)
   eventsourcemock:
     specifier: 2.0.0
     version: 2.0.0
@@ -120,9 +114,6 @@ dependencies:
   front-matter:
     specifier: 4.0.2
     version: 4.0.2
-  i18next:
-    specifier: 22.5.0
-    version: 22.5.0
   jest-environment-jsdom:
     specifier: 29.5.0
     version: 29.5.0(canvas@2.11.0)
@@ -130,8 +121,8 @@ dependencies:
     specifier: 4.17.21
     version: 4.17.21
   monaco-editor:
-    specifier: 0.40.0
-    version: 0.40.0
+    specifier: 0.43.0
+    version: 0.43.0
   pretty-bytes:
     specifier: 6.1.0
     version: 6.1.0
@@ -140,31 +131,31 @@ dependencies:
     version: 18.2.0
   react-chartjs-2:
     specifier: 5.2.0
-    version: 5.2.0(chart.js@3.9.1)(react@18.2.0)
+    version: 5.2.0(chart.js@4.4.0)(react@18.2.0)
   react-color:
     specifier: 2.19.3
     version: 2.19.3(react@18.2.0)
   react-confetti:
     specifier: 6.1.0
     version: 6.1.0(react@18.2.0)
+  react-date-range:
+    specifier: 1.4.0
+    version: 1.4.0(date-fns@2.30.0)(react@18.2.0)
   react-dom:
     specifier: 18.2.0
     version: 18.2.0(react@18.2.0)
-  react-headless-tabs:
-    specifier: 6.0.3
-    version: 6.0.3(react-dom@18.2.0)(react@18.2.0)
   react-helmet-async:
     specifier: 1.3.0
     version: 1.3.0(react-dom@18.2.0)(react@18.2.0)
-  react-i18next:
-    specifier: 12.2.2
-    version: 12.2.2(i18next@22.5.0)(react-dom@18.2.0)(react@18.2.0)
   react-markdown:
-    specifier: 8.0.3
-    version: 8.0.3(@types/react@18.2.6)(react@18.2.0)
+    specifier: 8.0.7
+    version: 8.0.7(@types/react@18.2.6)(react@18.2.0)
+  react-query:
+    specifier: npm:@tanstack/react-query@4.35.3
+    version: /@tanstack/react-query@4.35.3(react-dom@18.2.0)(react@18.2.0)
   react-router-dom:
-    specifier: 6.14.1
-    version: 6.14.1(react-dom@18.2.0)(react@18.2.0)
+    specifier: 6.16.0
+    version: 6.16.0(react-dom@18.2.0)(react@18.2.0)
   react-syntax-highlighter:
     specifier: 15.5.0
     version: 15.5.0(react@18.2.0)
@@ -186,9 +177,9 @@ dependencies:
   semver:
     specifier: 7.5.3
     version: 7.5.3
-  sourcemapped-stacktrace:
-    specifier: 1.1.11
-    version: 1.1.11
+  ts-proto:
+    specifier: 1.159.1
+    version: 1.159.1
   ts-prune:
     specifier: 0.10.3
     version: 0.10.3
@@ -198,6 +189,9 @@ dependencies:
   ua-parser-js:
     specifier: 1.0.33
     version: 1.0.33
+  ufuzzy:
+    specifier: npm:@leeoniya/ufuzzy@1.0.10
+    version: /@leeoniya/ufuzzy@1.0.10
   unique-names-generator:
     specifier: 4.7.1
     version: 4.7.1
@@ -206,51 +200,57 @@ dependencies:
     version: 9.0.0
   vite:
     specifier: 4.4.2
-    version: 4.4.2(@types/node@18.17.0)
+    version: 4.4.2(@types/node@18.18.1)
   xstate:
     specifier: 4.38.1
     version: 4.38.1
   xterm:
-    specifier: 5.2.1
-    version: 5.2.1
+    specifier: 5.2.0
+    version: 5.2.0
   xterm-addon-canvas:
-    specifier: 0.4.0
-    version: 0.4.0(xterm@5.2.1)
+    specifier: 0.5.0
+    version: 0.5.0(xterm@5.2.0)
   xterm-addon-fit:
-    specifier: 0.7.0
-    version: 0.7.0(xterm@5.2.1)
-  xterm-addon-web-links:
     specifier: 0.8.0
-    version: 0.8.0(xterm@5.2.1)
+    version: 0.8.0(xterm@5.2.0)
+  xterm-addon-unicode11:
+    specifier: 0.6.0
+    version: 0.6.0(xterm@5.2.0)
+  xterm-addon-web-links:
+    specifier: 0.9.0
+    version: 0.9.0(xterm@5.2.0)
+  xterm-addon-webgl:
+    specifier: 0.16.0
+    version: 0.16.0(xterm@5.2.0)
   yup:
-    specifier: 1.2.0
-    version: 1.2.0
+    specifier: 1.3.2
+    version: 1.3.2
 
 devDependencies:
   '@octokit/types':
-    specifier: 11.1.0
-    version: 11.1.0
+    specifier: 12.0.0
+    version: 12.0.0
   '@playwright/test':
-    specifier: 1.36.0
-    version: 1.36.0
+    specifier: 1.38.0
+    version: 1.38.0
   '@storybook/addon-actions':
-    specifier: 7.2.0
-    version: 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+    specifier: 7.4.0
+    version: 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
   '@storybook/addon-essentials':
-    specifier: 7.2.0
-    version: 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+    specifier: 7.4.0
+    version: 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
   '@storybook/addon-links':
-    specifier: 7.2.0
-    version: 7.2.0(react-dom@18.2.0)(react@18.2.0)
+    specifier: 7.4.0
+    version: 7.4.0(react-dom@18.2.0)(react@18.2.0)
   '@storybook/addon-mdx-gfm':
-    specifier: 7.2.0
-    version: 7.2.0
+    specifier: 7.4.0
+    version: 7.4.0
   '@storybook/react':
-    specifier: 7.2.0
-    version: 7.2.0(react-dom@18.2.0)(react@18.2.0)(typescript@5.1.6)
+    specifier: 7.4.0
+    version: 7.4.0(react-dom@18.2.0)(react@18.2.0)(typescript@5.2.2)
   '@storybook/react-vite':
-    specifier: 7.2.0
-    version: 7.2.0(react-dom@18.2.0)(react@18.2.0)(typescript@5.1.6)(vite@4.4.2)
+    specifier: 7.4.0
+    version: 7.4.0(react-dom@18.2.0)(react@18.2.0)(typescript@5.2.2)(vite@4.4.2)
   '@swc/core':
     specifier: 1.3.38
     version: 1.3.38
@@ -258,8 +258,8 @@ devDependencies:
     specifier: 0.2.24
     version: 0.2.24(@swc/core@1.3.38)
   '@testing-library/jest-dom':
-    specifier: 5.17.0
-    version: 5.17.0
+    specifier: 6.1.2
+    version: 6.1.2(@types/jest@29.5.2)(jest@29.6.2)
   '@testing-library/react':
     specifier: 14.0.0
     version: 14.0.0(react-dom@18.2.0)(react@18.2.0)
@@ -267,23 +267,35 @@ devDependencies:
     specifier: 8.0.1
     version: 8.0.1(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
   '@testing-library/user-event':
-    specifier: 14.4.3
-    version: 14.4.3(@testing-library/dom@9.3.1)
+    specifier: 14.5.1
+    version: 14.5.1(@testing-library/dom@9.3.3)
   '@types/chroma-js':
     specifier: 2.4.0
     version: 2.4.0
+  '@types/color-convert':
+    specifier: 2.0.0
+    version: 2.0.0
   '@types/express':
     specifier: 4.17.17
     version: 4.17.17
   '@types/jest':
     specifier: 29.5.2
     version: 29.5.2
+  '@types/lodash':
+    specifier: 4.14.196
+    version: 4.14.196
   '@types/node':
-    specifier: 18.17.0
-    version: 18.17.0
+    specifier: 18.18.1
+    version: 18.18.1
   '@types/react':
     specifier: 18.2.6
     version: 18.2.6
+  '@types/react-color':
+    specifier: 3.0.6
+    version: 3.0.6
+  '@types/react-date-range':
+    specifier: 1.4.4
+    version: 1.4.4
   '@types/react-dom':
     specifier: 18.2.4
     version: 18.2.4
@@ -299,12 +311,12 @@ devDependencies:
   '@types/react-window':
     specifier: 1.8.5
     version: 1.8.5
+  '@types/semver':
+    specifier: 7.5.0
+    version: 7.5.0
   '@types/ssh2':
     specifier: 1.11.13
     version: 1.11.13
-  '@types/testing-library__jest-dom':
-    specifier: 5.14.9
-    version: 5.14.9
   '@types/ua-parser-js':
     specifier: 0.7.36
     version: 0.7.36
@@ -312,92 +324,86 @@ devDependencies:
     specifier: 9.0.2
     version: 9.0.2
   '@typescript-eslint/eslint-plugin':
-    specifier: 6.2.1
-    version: 6.2.1(@typescript-eslint/parser@6.2.1)(eslint@8.46.0)(typescript@5.1.6)
+    specifier: 6.7.0
+    version: 6.7.0(@typescript-eslint/parser@6.7.0)(eslint@8.50.0)(typescript@5.2.2)
   '@typescript-eslint/parser':
-    specifier: 6.2.1
-    version: 6.2.1(eslint@8.46.0)(typescript@5.1.6)
+    specifier: 6.7.0
+    version: 6.7.0(eslint@8.50.0)(typescript@5.2.2)
   '@xstate/cli':
     specifier: 0.5.2
     version: 0.5.2
   chromatic:
-    specifier: 6.20.0
-    version: 6.20.0
+    specifier: 7.2.0
+    version: 7.2.0
   eslint:
-    specifier: 8.46.0
-    version: 8.46.0
+    specifier: 8.50.0
+    version: 8.50.0
   eslint-config-prettier:
-    specifier: 8.9.0
-    version: 8.9.0(eslint@8.46.0)
+    specifier: 9.0.0
+    version: 9.0.0(eslint@8.50.0)
   eslint-import-resolver-typescript:
-    specifier: 3.5.5
-    version: 3.5.5(@typescript-eslint/parser@6.2.1)(eslint-plugin-import@2.28.0)(eslint@8.46.0)
+    specifier: 3.6.0
+    version: 3.6.0(@typescript-eslint/parser@6.7.0)(eslint-plugin-import@2.28.0)(eslint@8.50.0)
   eslint-plugin-compat:
-    specifier: 4.1.4
-    version: 4.1.4(eslint@8.46.0)
+    specifier: 4.2.0
+    version: 4.2.0(eslint@8.50.0)
   eslint-plugin-eslint-comments:
     specifier: 3.2.0
-    version: 3.2.0(eslint@8.46.0)
+    version: 3.2.0(eslint@8.50.0)
   eslint-plugin-import:
     specifier: 2.28.0
-    version: 2.28.0(@typescript-eslint/parser@6.2.1)(eslint-import-resolver-typescript@3.5.5)(eslint@8.46.0)
+    version: 2.28.0(@typescript-eslint/parser@6.7.0)(eslint-import-resolver-typescript@3.6.0)(eslint@8.50.0)
   eslint-plugin-jest:
-    specifier: 27.2.2
-    version: 27.2.2(@typescript-eslint/eslint-plugin@6.2.1)(eslint@8.46.0)(jest@29.6.2)(typescript@5.1.6)
+    specifier: 27.4.0
+    version: 27.4.0(@typescript-eslint/eslint-plugin@6.7.0)(eslint@8.50.0)(jest@29.6.2)(typescript@5.2.2)
   eslint-plugin-jsx-a11y:
     specifier: 6.7.1
-    version: 6.7.1(eslint@8.46.0)
+    version: 6.7.1(eslint@8.50.0)
   eslint-plugin-react:
     specifier: 7.33.0
-    version: 7.33.0(eslint@8.46.0)
+    version: 7.33.0(eslint@8.50.0)
   eslint-plugin-react-hooks:
     specifier: 4.6.0
-    version: 4.6.0(eslint@8.46.0)
+    version: 4.6.0(eslint@8.50.0)
   eslint-plugin-storybook:
     specifier: 0.6.12
-    version: 0.6.12(eslint@8.46.0)(typescript@5.1.6)
+    version: 0.6.12(eslint@8.50.0)(typescript@5.2.2)
   eslint-plugin-unicorn:
     specifier: 48.0.0
-    version: 48.0.0(eslint@8.46.0)
+    version: 48.0.0(eslint@8.50.0)
   express:
     specifier: 4.18.2
     version: 4.18.2
   jest:
     specifier: 29.6.2
-    version: 29.6.2(@types/node@18.17.0)(ts-node@10.9.1)
+    version: 29.6.2(@types/node@18.18.1)(ts-node@10.9.1)
   jest-canvas-mock:
-    specifier: 2.4.0
-    version: 2.4.0
+    specifier: 2.5.2
+    version: 2.5.2
   jest-fetch-mock:
     specifier: 3.0.3
     version: 3.0.3
   jest-location-mock:
-    specifier: 1.0.9
-    version: 1.0.9
+    specifier: 2.0.0
+    version: 2.0.0
   jest-runner-eslint:
     specifier: 2.1.0
-    version: 2.1.0(eslint@8.46.0)(jest@29.6.2)
+    version: 2.1.0(eslint@8.50.0)(jest@29.6.2)
   jest-websocket-mock:
-    specifier: 2.4.0
-    version: 2.4.0
+    specifier: 2.5.0
+    version: 2.5.0
   jest_workaround:
     specifier: 0.1.14
     version: 0.1.14(@swc/core@1.3.38)(@swc/jest@0.2.24)
-  just-debounce-it:
-    specifier: 3.2.0
-    version: 3.2.0
   msw:
-    specifier: 1.2.2
-    version: 1.2.2(typescript@5.1.6)
+    specifier: 1.3.0
+    version: 1.3.0(typescript@5.2.2)
   prettier:
     specifier: 3.0.0
     version: 3.0.0
   protobufjs:
     specifier: 7.2.4
     version: 7.2.4
-  resize-observer:
-    specifier: 1.0.4
-    version: 1.0.4
   rxjs:
     specifier: 7.8.1
     version: 7.8.1
@@ -405,26 +411,26 @@ devDependencies:
     specifier: 1.14.0
     version: 1.14.0
   storybook:
-    specifier: 7.2.0
-    version: 7.2.0
+    specifier: 7.4.0
+    version: 7.4.0
   storybook-addon-react-router-v6:
     specifier: 2.0.0
-    version: 2.0.0(@storybook/blocks@7.2.0)(@storybook/channels@7.2.0)(@storybook/components@7.2.0)(@storybook/core-events@7.2.0)(@storybook/manager-api@7.2.0)(@storybook/preview-api@7.2.0)(@storybook/theming@7.2.0)(react-dom@18.2.0)(react-router-dom@6.14.1)(react-router@6.14.2)(react@18.2.0)
+    version: 2.0.0(@storybook/blocks@7.4.5)(@storybook/channels@7.4.5)(@storybook/components@7.4.5)(@storybook/core-events@7.4.5)(@storybook/manager-api@7.4.5)(@storybook/preview-api@7.4.5)(@storybook/theming@7.4.5)(react-dom@18.2.0)(react-router-dom@6.16.0)(react-router@6.16.0)(react@18.2.0)
   storybook-react-context:
     specifier: 0.6.0
     version: 0.6.0(react-dom@18.2.0)
   ts-node:
     specifier: 10.9.1
-    version: 10.9.1(@swc/core@1.3.38)(@types/node@18.17.0)(typescript@5.1.6)
-  ts-proto:
-    specifier: 1.156.0
-    version: 1.156.0
+    version: 10.9.1(@swc/core@1.3.38)(@types/node@18.18.1)(typescript@5.2.2)
   typescript:
-    specifier: 5.1.6
-    version: 5.1.6
+    specifier: 5.2.2
+    version: 5.2.2
   vite-plugin-checker:
     specifier: 0.6.0
-    version: 0.6.0(eslint@8.46.0)(typescript@5.1.6)(vite@4.4.2)
+    version: 0.6.0(eslint@8.50.0)(typescript@5.2.2)(vite@4.4.2)
+  vite-plugin-turbosnap:
+    specifier: 1.0.2
+    version: 1.0.2
 
 packages:
 
@@ -432,8 +438,8 @@ packages:
     resolution: {integrity: sha512-1Yjs2SvM8TflER/OD3cOjhWWOZb58A2t7wpE2S9XfBYTiIl+XFhQG2bjy4Pu1I+EAlCNUzRDYDdFwFYUKvXcIA==}
     engines: {node: '>=0.10.0'}
 
-  /@adobe/css-tools@4.2.0:
-    resolution: {integrity: sha512-E09FiIft46CmH5Qnjb0wsW54/YQd69LsxeKUOWawmws1XWvyFGURnAChH0mlr7YPFR1ofwvUQfcL0J3lMxXqPA==}
+  /@adobe/css-tools@4.3.1:
+    resolution: {integrity: sha512-/62yikz7NLScCGAAST5SHdnjaDJQBDq0M2muyRTpf2VQhw6StBg2ALiu73zSJQ4fMVLA+0uBhBHAle7Wg+2kSg==}
     dev: true
 
   /@ampproject/remapping@2.2.1:
@@ -441,7 +447,7 @@ packages:
     engines: {node: '>=6.0.0'}
     dependencies:
       '@jridgewell/gen-mapping': 0.3.3
-      '@jridgewell/trace-mapping': 0.3.18
+      '@jridgewell/trace-mapping': 0.3.19
 
   /@aw-web-design/x-default-browser@1.4.126:
     resolution: {integrity: sha512-Xk1sIhyNC/esHGGVjL/niHLowM0csl/kFO5uawBy4IrWwy0o1G8LGt3jP6nmWGz+USxeeqbihAmp/oVZju6wug==}
@@ -450,30 +456,61 @@ packages:
       default-browser-id: 3.0.0
     dev: true
 
+  /@babel/code-frame@7.22.13:
+    resolution: {integrity: sha512-XktuhWlJ5g+3TJXc5upd9Ks1HutSArik6jf2eAjYFyIOf4ej3RN+184cZbzDvbPnuTJIUhPKKJE3cIsYTiAT3w==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/highlight': 7.22.13
+      chalk: 2.4.2
+
   /@babel/code-frame@7.22.5:
     resolution: {integrity: sha512-Xmwn266vad+6DAqEB2A6V/CcZVp62BbwVmcOJc2RPuwih1kw02TjQvWVWlcKGbBPd+8/0V5DEkOcizRGYsspYQ==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/highlight': 7.22.5
+      '@babel/highlight': 7.22.13
+    dev: true
 
   /@babel/compat-data@7.22.9:
     resolution: {integrity: sha512-5UamI7xkUcJ3i9qVDS+KFDEK8/7oJ55/sJMB1Ge7IEapr7KfdfV/HErR+koZwOfd+SgtFKOKRhRakdg++DcJpQ==}
     engines: {node: '>=6.9.0'}
 
+  /@babel/core@7.22.11:
+    resolution: {integrity: sha512-lh7RJrtPdhibbxndr6/xx0w8+CVlY5FJZiaSz908Fpy+G0xkBFTvwLcKJFF4PJxVfGhVWNebikpWGnOoC71juQ==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@ampproject/remapping': 2.2.1
+      '@babel/code-frame': 7.22.13
+      '@babel/generator': 7.23.0
+      '@babel/helper-compilation-targets': 7.22.10
+      '@babel/helper-module-transforms': 7.22.9(@babel/core@7.22.11)
+      '@babel/helpers': 7.22.11
+      '@babel/parser': 7.23.0
+      '@babel/template': 7.22.15
+      '@babel/traverse': 7.23.2
+      '@babel/types': 7.23.0
+      convert-source-map: 1.9.0
+      debug: 4.3.4
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 7.5.3
+    transitivePeerDependencies:
+      - supports-color
+    dev: true
+
   /@babel/core@7.22.9:
     resolution: {integrity: sha512-G2EgeufBcYw27U4hhoIwFcgc1XU7TlXJ3mv04oOv1WCuo900U/anZSPzEqNjwdjgffkk2Gs0AN0dW1CKVLcG7w==}
     engines: {node: '>=6.9.0'}
     dependencies:
       '@ampproject/remapping': 2.2.1
-      '@babel/code-frame': 7.22.5
-      '@babel/generator': 7.22.9
-      '@babel/helper-compilation-targets': 7.22.9(@babel/core@7.22.9)
+      '@babel/code-frame': 7.22.13
+      '@babel/generator': 7.23.0
+      '@babel/helper-compilation-targets': 7.22.10
       '@babel/helper-module-transforms': 7.22.9(@babel/core@7.22.9)
-      '@babel/helpers': 7.22.6
-      '@babel/parser': 7.22.7
-      '@babel/template': 7.22.5
-      '@babel/traverse': 7.22.8
-      '@babel/types': 7.22.5
+      '@babel/helpers': 7.22.11
+      '@babel/parser': 7.23.0
+      '@babel/template': 7.22.15
+      '@babel/traverse': 7.23.2
+      '@babel/types': 7.23.0
       convert-source-map: 1.9.0
       debug: 4.3.4
       gensync: 1.0.0-beta.2
@@ -481,117 +518,186 @@ packages:
       semver: 7.5.3
     transitivePeerDependencies:
       - supports-color
+    dev: true
 
-  /@babel/generator@7.22.9:
-    resolution: {integrity: sha512-KtLMbmicyuK2Ak/FTCJVbDnkN1SlT8/kceFTiuDiiRUUSMnHMidxSCdG4ndkTOHHpoomWe/4xkvHkEOncwjYIw==}
+  /@babel/core@7.23.0:
+    resolution: {integrity: sha512-97z/ju/Jy1rZmDxybphrBuI+jtJjFVoz7Mr9yUQVVVi+DNZE333uFQeMOqcCIy1x3WYBIbWftUSLmbNXNT7qFQ==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/types': 7.22.5
+      '@ampproject/remapping': 2.2.1
+      '@babel/code-frame': 7.22.13
+      '@babel/generator': 7.23.0
+      '@babel/helper-compilation-targets': 7.22.15
+      '@babel/helper-module-transforms': 7.23.0(@babel/core@7.23.0)
+      '@babel/helpers': 7.23.1
+      '@babel/parser': 7.23.0
+      '@babel/template': 7.22.15
+      '@babel/traverse': 7.23.2
+      '@babel/types': 7.23.0
+      convert-source-map: 2.0.0
+      debug: 4.3.4
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 7.5.3
+    transitivePeerDependencies:
+      - supports-color
+
+  /@babel/generator@7.23.0:
+    resolution: {integrity: sha512-lN85QRR+5IbYrMWM6Y4pE/noaQtg4pNiqeNGX60eqOfo6gtEj6uw/JagelB8vVztSd7R6M5n1+PQkDbHbBRU4g==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/types': 7.23.0
       '@jridgewell/gen-mapping': 0.3.3
-      '@jridgewell/trace-mapping': 0.3.18
+      '@jridgewell/trace-mapping': 0.3.19
       jsesc: 2.5.2
 
   /@babel/helper-annotate-as-pure@7.22.5:
     resolution: {integrity: sha512-LvBTxu8bQSQkcyKOU+a1btnNFQ1dMAd0R6PyW3arXes06F6QLWLIrd681bxRPIXlrMGR3XYnW9JyML7dP3qgxg==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
     dev: true
 
-  /@babel/helper-builder-binary-assignment-operator-visitor@7.22.5:
-    resolution: {integrity: sha512-m1EP3lVOPptR+2DwD125gziZNcmoNSHGmJROKoy87loWUQyJaVXDgpmruWqDARZSmtYQ+Dl25okU8+qhVzuykw==}
+  /@babel/helper-builder-binary-assignment-operator-visitor@7.22.10:
+    resolution: {integrity: sha512-Av0qubwDQxC56DoUReVDeLfMEjYYSN1nZrTUrWkXd7hpU73ymRANkbuDm3yni9npkn+RXy9nNbEJZEzXr7xrfQ==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
     dev: true
 
-  /@babel/helper-compilation-targets@7.22.9(@babel/core@7.22.9):
-    resolution: {integrity: sha512-7qYrNM6HjpnPHJbopxmb8hSPoZ0gsX8IvUS32JGVoy+pU9e5N0nLr1VjJoR6kA4d9dmGLxNYOjeB8sUDal2WMw==}
+  /@babel/helper-compilation-targets@7.22.10:
+    resolution: {integrity: sha512-JMSwHD4J7SLod0idLq5PKgI+6g/hLD/iuWBq08ZX49xE14VpVEojJ5rHWptpirV2j020MvypRLAXAO50igCJ5Q==}
     engines: {node: '>=6.9.0'}
-    peerDependencies:
-      '@babel/core': ^7.0.0
     dependencies:
       '@babel/compat-data': 7.22.9
-      '@babel/core': 7.22.9
       '@babel/helper-validator-option': 7.22.5
-      browserslist: 4.21.9
+      browserslist: 4.21.10
       lru-cache: 5.1.1
       semver: 7.5.3
+    dev: true
 
-  /@babel/helper-create-class-features-plugin@7.22.9(@babel/core@7.22.9):
-    resolution: {integrity: sha512-Pwyi89uO4YrGKxL/eNJ8lfEH55DnRloGPOseaA8NFNL6jAUnn+KccaISiFazCj5IolPPDjGSdzQzXVzODVRqUQ==}
+  /@babel/helper-compilation-targets@7.22.15:
+    resolution: {integrity: sha512-y6EEzULok0Qvz8yyLkCvVX+02ic+By2UdOhylwUOvOn9dvYc9mKICJuuU1n1XBI02YWsNsnrY1kc6DVbjcXbtw==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/compat-data': 7.22.9
+      '@babel/helper-validator-option': 7.22.15
+      browserslist: 4.21.10
+      lru-cache: 5.1.1
+      semver: 7.5.3
+
+  /@babel/helper-create-class-features-plugin@7.22.11(@babel/core@7.22.11):
+    resolution: {integrity: sha512-y1grdYL4WzmUDBRGK0pDbIoFd7UZKoDurDzWEoNMYoj1EL+foGRQNyPWDcC+YyegN5y1DUsFFmzjGijB3nSVAQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
+      '@babel/helper-annotate-as-pure': 7.22.5
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-function-name': 7.23.0
+      '@babel/helper-member-expression-to-functions': 7.22.5
+      '@babel/helper-optimise-call-expression': 7.22.5
+      '@babel/helper-replace-supers': 7.22.9(@babel/core@7.23.0)
+      '@babel/helper-skip-transparent-expression-wrappers': 7.22.5
+      '@babel/helper-split-export-declaration': 7.22.6
+      semver: 7.5.3
+    dev: true
+
+  /@babel/helper-create-class-features-plugin@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-y1grdYL4WzmUDBRGK0pDbIoFd7UZKoDurDzWEoNMYoj1EL+foGRQNyPWDcC+YyegN5y1DUsFFmzjGijB3nSVAQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+    dependencies:
+      '@babel/core': 7.23.0
       '@babel/helper-annotate-as-pure': 7.22.5
-      '@babel/helper-environment-visitor': 7.22.5
-      '@babel/helper-function-name': 7.22.5
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-function-name': 7.23.0
       '@babel/helper-member-expression-to-functions': 7.22.5
       '@babel/helper-optimise-call-expression': 7.22.5
-      '@babel/helper-replace-supers': 7.22.9(@babel/core@7.22.9)
+      '@babel/helper-replace-supers': 7.22.9(@babel/core@7.23.0)
       '@babel/helper-skip-transparent-expression-wrappers': 7.22.5
       '@babel/helper-split-export-declaration': 7.22.6
       semver: 7.5.3
     dev: true
 
-  /@babel/helper-create-regexp-features-plugin@7.22.9(@babel/core@7.22.9):
+  /@babel/helper-create-regexp-features-plugin@7.22.9(@babel/core@7.23.0):
     resolution: {integrity: sha512-+svjVa/tFwsNSG4NEy1h85+HQ5imbT92Q5/bgtS7P0GTQlP8WuFdqsiABmQouhiFGyV66oGxZFpeYHza1rNsKw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-annotate-as-pure': 7.22.5
       regexpu-core: 5.3.2
       semver: 7.5.3
     dev: true
 
-  /@babel/helper-define-polyfill-provider@0.4.2(@babel/core@7.22.9):
+  /@babel/helper-define-polyfill-provider@0.4.2(@babel/core@7.23.0):
     resolution: {integrity: sha512-k0qnnOqHn5dK9pZpfD5XXZ9SojAITdCKRn2Lp6rnDGzIbaP0rHyMPk/4wsSxVBVz4RfN0q6VpXWP2pDGIoQ7hw==}
     peerDependencies:
       '@babel/core': ^7.4.0 || ^8.0.0-0 <8.0.0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-compilation-targets': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-compilation-targets': 7.22.10
       '@babel/helper-plugin-utils': 7.22.5
       debug: 4.3.4
       lodash.debounce: 4.0.8
-      resolve: 1.22.3
+      resolve: 1.22.4
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /@babel/helper-environment-visitor@7.22.5:
-    resolution: {integrity: sha512-XGmhECfVA/5sAt+H+xpSg0mfrHq6FzNr9Oxh7PSEBBRUb/mL7Kz3NICXb194rCqAEdxkhPT1a88teizAFyvk8Q==}
+  /@babel/helper-environment-visitor@7.22.20:
+    resolution: {integrity: sha512-zfedSIzFhat/gFhWfHtgWvlec0nqB9YEIVrpuwjruLlXfUSnA8cJB0miHKwqDnQ7d32aKo2xt88/xZptwxbfhA==}
     engines: {node: '>=6.9.0'}
 
-  /@babel/helper-function-name@7.22.5:
-    resolution: {integrity: sha512-wtHSq6jMRE3uF2otvfuD3DIvVhOsSNshQl0Qrd7qC9oQJzHvOL4qQXlQn2916+CXGywIjpGuIkoyZRRxHPiNQQ==}
+  /@babel/helper-function-name@7.23.0:
+    resolution: {integrity: sha512-OErEqsrxjZTJciZ4Oo+eoZqeW9UIiOcuYKRJA4ZAgV9myA+pOXhhmpfNCKjEH/auVfEYVFJ6y1Tc4r0eIApqiw==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/template': 7.22.5
-      '@babel/types': 7.22.5
+      '@babel/template': 7.22.15
+      '@babel/types': 7.23.0
 
   /@babel/helper-hoist-variables@7.22.5:
     resolution: {integrity: sha512-wGjk9QZVzvknA6yKIUURb8zY3grXCcOZt+/7Wcy8O2uctxhplmUPkOdlgoNhmdVee2c92JXbf1xpMtVNbfoxRw==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
 
   /@babel/helper-member-expression-to-functions@7.22.5:
     resolution: {integrity: sha512-aBiH1NKMG0H2cGZqspNvsaBe6wNGjbJjuLy29aU+eDZjSbbN53BaxlpB02xm9v34pLTZ1nIQPFYn2qMZoa5BQQ==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
     dev: true
 
+  /@babel/helper-module-imports@7.22.15:
+    resolution: {integrity: sha512-0pYVBnDKZO2fnSPCrgM/6WMc7eS20Fbok+0r88fp+YtWVLZrp4CkafFGIp+W0VKw4a22sgebPT99y+FDNMdP4w==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/types': 7.23.0
+
   /@babel/helper-module-imports@7.22.5:
     resolution: {integrity: sha512-8Dl6+HD/cKifutF5qGd/8ZJi84QeAKh+CEe1sBzz8UayBBGg1dAIJrdHOcOM5b2MpzWL2yuotJTtGjETq0qjXg==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
+
+  /@babel/helper-module-transforms@7.22.9(@babel/core@7.22.11):
+    resolution: {integrity: sha512-t+WA2Xn5K+rTeGtC8jCsdAH52bjggG5TKRuRrAGNM/mjIbO4GxvlLMFOEz9wXY5I2XQ60PMFsAG2WIcG82dQMQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+    dependencies:
+      '@babel/core': 7.22.11
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-module-imports': 7.22.5
+      '@babel/helper-simple-access': 7.22.5
+      '@babel/helper-split-export-declaration': 7.22.6
+      '@babel/helper-validator-identifier': 7.22.20
+    dev: true
 
   /@babel/helper-module-transforms@7.22.9(@babel/core@7.22.9):
     resolution: {integrity: sha512-t+WA2Xn5K+rTeGtC8jCsdAH52bjggG5TKRuRrAGNM/mjIbO4GxvlLMFOEz9wXY5I2XQ60PMFsAG2WIcG82dQMQ==}
@@ -600,43 +706,71 @@ packages:
       '@babel/core': ^7.0.0
     dependencies:
       '@babel/core': 7.22.9
-      '@babel/helper-environment-visitor': 7.22.5
+      '@babel/helper-environment-visitor': 7.22.20
       '@babel/helper-module-imports': 7.22.5
       '@babel/helper-simple-access': 7.22.5
       '@babel/helper-split-export-declaration': 7.22.6
-      '@babel/helper-validator-identifier': 7.22.5
+      '@babel/helper-validator-identifier': 7.22.20
+    dev: true
+
+  /@babel/helper-module-transforms@7.22.9(@babel/core@7.23.0):
+    resolution: {integrity: sha512-t+WA2Xn5K+rTeGtC8jCsdAH52bjggG5TKRuRrAGNM/mjIbO4GxvlLMFOEz9wXY5I2XQ60PMFsAG2WIcG82dQMQ==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+    dependencies:
+      '@babel/core': 7.23.0
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-module-imports': 7.22.5
+      '@babel/helper-simple-access': 7.22.5
+      '@babel/helper-split-export-declaration': 7.22.6
+      '@babel/helper-validator-identifier': 7.22.20
+    dev: true
+
+  /@babel/helper-module-transforms@7.23.0(@babel/core@7.23.0):
+    resolution: {integrity: sha512-WhDWw1tdrlT0gMgUJSlX0IQvoO1eN279zrAUbVB+KpV2c3Tylz8+GnKOLllCS6Z/iZQEyVYxhZVUdPTqs2YYPw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+    dependencies:
+      '@babel/core': 7.23.0
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-module-imports': 7.22.15
+      '@babel/helper-simple-access': 7.22.5
+      '@babel/helper-split-export-declaration': 7.22.6
+      '@babel/helper-validator-identifier': 7.22.20
 
   /@babel/helper-optimise-call-expression@7.22.5:
     resolution: {integrity: sha512-HBwaojN0xFRx4yIvpwGqxiV2tUfl7401jlok564NgB9EHS1y6QT17FmKWm4ztqjeVdXLuC4fSvHc5ePpQjoTbw==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
     dev: true
 
   /@babel/helper-plugin-utils@7.22.5:
     resolution: {integrity: sha512-uLls06UVKgFG9QD4OeFYLEGteMIAa5kpTPcFL28yuCIIzsf6ZyKZMllKVOCZFhiZ5ptnwX4mtKdWCBE/uT4amg==}
     engines: {node: '>=6.9.0'}
 
-  /@babel/helper-remap-async-to-generator@7.22.9(@babel/core@7.22.9):
+  /@babel/helper-remap-async-to-generator@7.22.9(@babel/core@7.23.0):
     resolution: {integrity: sha512-8WWC4oR4Px+tr+Fp0X3RHDVfINGpF3ad1HIbrc8A77epiR6eMMc6jsgozkzT2uDiOOdoS9cLIQ+XD2XvI2WSmQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-annotate-as-pure': 7.22.5
-      '@babel/helper-environment-visitor': 7.22.5
-      '@babel/helper-wrap-function': 7.22.9
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-wrap-function': 7.22.10
     dev: true
 
-  /@babel/helper-replace-supers@7.22.9(@babel/core@7.22.9):
+  /@babel/helper-replace-supers@7.22.9(@babel/core@7.23.0):
     resolution: {integrity: sha512-LJIKvvpgPOPUThdYqcX6IXRuIcTkcAub0IaDRGCZH0p5GPUp7PhRU9QVgFcDDd51BaPkk77ZjqFwh6DZTAEmGg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-environment-visitor': 7.22.5
+      '@babel/core': 7.23.0
+      '@babel/helper-environment-visitor': 7.22.20
       '@babel/helper-member-expression-to-functions': 7.22.5
       '@babel/helper-optimise-call-expression': 7.22.5
     dev: true
@@ -645,1062 +779,1295 @@ packages:
     resolution: {integrity: sha512-n0H99E/K+Bika3++WNL17POvo4rKWZ7lZEp1Q+fStVbUi8nxPQEBOlTmCOxW/0JsS56SKKQ+ojAe2pHKJHN35w==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
 
   /@babel/helper-skip-transparent-expression-wrappers@7.22.5:
     resolution: {integrity: sha512-tK14r66JZKiC43p8Ki33yLBVJKlQDFoA8GYN67lWCDCqoL6EMMSuM9b+Iff2jHaM/RRFYl7K+iiru7hbRqNx8Q==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
     dev: true
 
   /@babel/helper-split-export-declaration@7.22.6:
     resolution: {integrity: sha512-AsUnxuLhRYsisFiaJwvp1QF+I3KjD5FOxut14q/GzovUe6orHLesW2C7d754kRm53h5gqrz6sFl6sxc4BVtE/g==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
 
   /@babel/helper-string-parser@7.22.5:
     resolution: {integrity: sha512-mM4COjgZox8U+JcXQwPijIZLElkgEpO5rsERVDJTc2qfCDfERyob6k5WegS14SX18IIjv+XD+GrqNumY5JRCDw==}
     engines: {node: '>=6.9.0'}
 
+  /@babel/helper-validator-identifier@7.22.20:
+    resolution: {integrity: sha512-Y4OZ+ytlatR8AI+8KZfKuL5urKp7qey08ha31L8b3BwewJAoJamTzyvxPR/5D+KkdJCGPq/+8TukHBlY10FX9A==}
+    engines: {node: '>=6.9.0'}
+
   /@babel/helper-validator-identifier@7.22.5:
     resolution: {integrity: sha512-aJXu+6lErq8ltp+JhkJUfk1MTGyuA4v7f3pA+BJ5HLfNC6nAQ0Cpi9uOquUj8Hehg0aUiHzWQbOVJGao6ztBAQ==}
     engines: {node: '>=6.9.0'}
+    dev: true
+
+  /@babel/helper-validator-option@7.22.15:
+    resolution: {integrity: sha512-bMn7RmyFjY/mdECUbgn9eoSY4vqvacUnS9i9vGAGttgFWesO6B4CYWA7XlpbWgBt71iv/hfbPlynohStqnu5hA==}
+    engines: {node: '>=6.9.0'}
 
   /@babel/helper-validator-option@7.22.5:
     resolution: {integrity: sha512-R3oB6xlIVKUnxNUxbmgq7pKjxpru24zlimpE8WK47fACIlM0II/Hm1RS8IaOI7NgCr6LNS+jl5l75m20npAziw==}
     engines: {node: '>=6.9.0'}
+    dev: true
 
-  /@babel/helper-wrap-function@7.22.9:
-    resolution: {integrity: sha512-sZ+QzfauuUEfxSEjKFmi3qDSHgLsTPK/pEpoD/qonZKOtTPTLbf59oabPQ4rKekt9lFcj/hTZaOhWwFYrgjk+Q==}
+  /@babel/helper-wrap-function@7.22.10:
+    resolution: {integrity: sha512-OnMhjWjuGYtdoO3FmsEFWvBStBAe2QOgwOLsLNDjN+aaiMD8InJk1/O3HSD8lkqTjCgg5YI34Tz15KNNA3p+nQ==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/helper-function-name': 7.22.5
-      '@babel/template': 7.22.5
-      '@babel/types': 7.22.5
+      '@babel/helper-function-name': 7.23.0
+      '@babel/template': 7.22.15
+      '@babel/types': 7.23.0
     dev: true
 
-  /@babel/helpers@7.22.6:
-    resolution: {integrity: sha512-YjDs6y/fVOYFV8hAf1rxd1QvR9wJe1pDBZ2AREKq/SDayfPzgk0PBnVuTCE5X1acEpMMNOVUqoe+OwiZGJ+OaA==}
+  /@babel/helpers@7.22.11:
+    resolution: {integrity: sha512-vyOXC8PBWaGc5h7GMsNx68OH33cypkEDJCHvYVVgVbbxJDROYVtexSk0gK5iCF1xNjRIN2s8ai7hwkWDq5szWg==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/template': 7.22.5
-      '@babel/traverse': 7.22.8
-      '@babel/types': 7.22.5
+      '@babel/template': 7.22.15
+      '@babel/traverse': 7.23.2
+      '@babel/types': 7.23.0
     transitivePeerDependencies:
       - supports-color
+    dev: true
 
-  /@babel/highlight@7.22.5:
-    resolution: {integrity: sha512-BSKlD1hgnedS5XRnGOljZawtag7H1yPfQp0tdNJCHoH6AZ+Pcm9VvkrK59/Yy593Ypg0zMxH2BxD1VPYUQ7UIw==}
+  /@babel/helpers@7.23.1:
+    resolution: {integrity: sha512-chNpneuK18yW5Oxsr+t553UZzzAs3aZnFm4bxhebsNTeshrC95yA7l5yl7GBAG+JG1rF0F7zzD2EixK9mWSDoA==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/helper-validator-identifier': 7.22.5
+      '@babel/template': 7.22.15
+      '@babel/traverse': 7.23.2
+      '@babel/types': 7.23.0
+    transitivePeerDependencies:
+      - supports-color
+
+  /@babel/highlight@7.22.13:
+    resolution: {integrity: sha512-C/BaXcnnvBCmHTpz/VGZ8jgtE2aYlW4hxDhseJAWZb7gqGM/qtCK6iZUb0TyKFf7BOUsBH7Q7fkRsDRhg1XklQ==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/helper-validator-identifier': 7.22.20
       chalk: 2.4.2
       js-tokens: 4.0.0
 
-  /@babel/parser@7.22.7:
-    resolution: {integrity: sha512-7NF8pOkHP5o2vpmGgNGcfAeCvOYhGLyA3Z4eBQkT1RJlWu47n63bCs93QfJ2hIAFCil7L5P2IWhs1oToVgrL0Q==}
+  /@babel/parser@7.23.0:
+    resolution: {integrity: sha512-vvPKKdMemU85V9WE/l5wZEmImpCtLqbnTvqDS2U1fJ96KrxoW7KrXhNsNCblQlg8Ck4b85yxdTyelsMUgFUXiw==}
     engines: {node: '>=6.0.0'}
     hasBin: true
     dependencies:
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
 
-  /@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-NP1M5Rf+u2Gw9qfSO4ihjcTGW5zXTi36ITLd4/EoAcEhIZ0yjMqmftDNl3QC19CX7olhrjpyU454g/2W7X0jvQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-31Bb65aZaUwqCbWMnZPduIZxCBngHFlzyN6Dq6KAJjtx+lx6ohKHubc61OomYi7XwVD4Ol0XCVz4h+pYFR048g==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.13.0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
       '@babel/helper-skip-transparent-expression-wrappers': 7.22.5
-      '@babel/plugin-transform-optional-chaining': 7.22.6(@babel/core@7.22.9)
+      '@babel/plugin-transform-optional-chaining': 7.22.12(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-proposal-class-properties@7.18.6(@babel/core@7.22.9):
+  /@babel/plugin-proposal-class-properties@7.18.6(@babel/core@7.22.11):
     resolution: {integrity: sha512-cumfXOF0+nzZrrN8Rf0t7M+tF6sZc7vhQwYQck9q1/5w2OExlD+b4v4RpMJFaV1Z7WcDRgO6FqvxqxGlwo+RHQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-create-class-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.22.11
+      '@babel/helper-create-class-features-plugin': 7.22.11(@babel/core@7.22.11)
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-proposal-nullish-coalescing-operator@7.18.6(@babel/core@7.22.9):
+  /@babel/plugin-proposal-nullish-coalescing-operator@7.18.6(@babel/core@7.22.11):
     resolution: {integrity: sha512-wQxQzxYeJqHcfppzBDnm1yAY0jSRkUXR2z8RePZYrKwMKgMlE8+Z6LUno+bd6LvbGh8Gltvy74+9pIYkr+XkKA==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.22.9)
+      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.22.11)
     dev: true
 
-  /@babel/plugin-proposal-optional-chaining@7.21.0(@babel/core@7.22.9):
+  /@babel/plugin-proposal-optional-chaining@7.21.0(@babel/core@7.22.11):
     resolution: {integrity: sha512-p4zeefM72gpmEe2fkUr/OnOXpWEf8nAgk7ZYVqqfFiyIG7oFfVZcCrU64hWn5xp4tQ9LkV4bTIa5rD0KANpKNA==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
       '@babel/helper-skip-transparent-expression-wrappers': 7.22.5
-      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.22.9)
+      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.22.11)
     dev: true
 
-  /@babel/plugin-proposal-private-property-in-object@7.21.0-placeholder-for-preset-env.2(@babel/core@7.22.9):
+  /@babel/plugin-proposal-private-property-in-object@7.21.0-placeholder-for-preset-env.2(@babel/core@7.23.0):
     resolution: {integrity: sha512-SOSkfJDddaM7mak6cPEpswyTRnuRltl429hMraQEglW+OkovnCzsiszTmsrlY//qLFjCpQDFRvjdm2wA5pPm9w==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
     dev: true
 
-  /@babel/plugin-proposal-unicode-property-regex@7.18.6(@babel/core@7.22.9):
-    resolution: {integrity: sha512-2BShG/d5yoZyXZfVePH91urL5wTG6ASZU9M4o03lKK8u8UW1y08OMttBSOADTcJrnPMpvDXRG3G8fyLh4ovs8w==}
-    engines: {node: '>=4'}
+  /@babel/plugin-syntax-async-generators@7.8.4(@babel/core@7.22.11):
+    resolution: {integrity: sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-async-generators@7.8.4(@babel/core@7.22.9):
+  /@babel/plugin-syntax-async-generators@7.8.4(@babel/core@7.23.0):
     resolution: {integrity: sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-bigint@7.8.3(@babel/core@7.22.9):
+  /@babel/plugin-syntax-bigint@7.8.3(@babel/core@7.22.11):
     resolution: {integrity: sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-class-properties@7.12.13(@babel/core@7.22.9):
+  /@babel/plugin-syntax-class-properties@7.12.13(@babel/core@7.22.11):
     resolution: {integrity: sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-class-static-block@7.14.5(@babel/core@7.22.9):
+  /@babel/plugin-syntax-class-properties@7.12.13(@babel/core@7.23.0):
+    resolution: {integrity: sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
+      '@babel/helper-plugin-utils': 7.22.5
+    dev: true
+
+  /@babel/plugin-syntax-class-static-block@7.14.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-dynamic-import@7.8.3(@babel/core@7.22.9):
+  /@babel/plugin-syntax-dynamic-import@7.8.3(@babel/core@7.23.0):
     resolution: {integrity: sha512-5gdGbFon+PszYzqs83S3E5mpi7/y/8M9eC90MRTZfduQOYW76ig6SOSPNe41IG5LoP3FGBn2N0RjVDSQiS94kQ==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-export-namespace-from@7.8.3(@babel/core@7.22.9):
+  /@babel/plugin-syntax-export-namespace-from@7.8.3(@babel/core@7.23.0):
     resolution: {integrity: sha512-MXf5laXo6c1IbEbegDmzGPwGNTsHZmEy6QGznu5Sh2UCWvueywb2ee+CCE4zQiZstxU9BMoQO9i6zUFSY0Kj0Q==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-flow@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-syntax-flow@7.22.5(@babel/core@7.22.11):
     resolution: {integrity: sha512-9RdCl0i+q0QExayk2nOS7853w08yLucnnPML6EN9S8fgMPVtdLDCdx/cOQ/i44Lb9UeQX9A35yaqBBOMMZxPxQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-import-assertions@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-syntax-import-assertions@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-rdV97N7KqsRzeNGoWUOK6yUsWarLjE5Su/Snk9IYPU9CwkWHs4t+rTGOvffTR8XGkJMTAdLfO0xVnXm8wugIJg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-import-attributes@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-syntax-import-attributes@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-KwvoWDeNKPETmozyFE0P2rOLqh39EoQHNjqizrI5B8Vt0ZNS7M56s7dAiAqbYfiAYOuIzIh96z3iR2ktgu3tEg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-import-meta@7.10.4(@babel/core@7.22.9):
+  /@babel/plugin-syntax-import-meta@7.10.4(@babel/core@7.22.11):
     resolution: {integrity: sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
+      '@babel/helper-plugin-utils': 7.22.5
+    dev: true
+
+  /@babel/plugin-syntax-import-meta@7.10.4(@babel/core@7.23.0):
+    resolution: {integrity: sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-json-strings@7.8.3(@babel/core@7.22.9):
+  /@babel/plugin-syntax-json-strings@7.8.3(@babel/core@7.22.11):
     resolution: {integrity: sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-jsx@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-syntax-json-strings@7.8.3(@babel/core@7.23.0):
+    resolution: {integrity: sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
+      '@babel/helper-plugin-utils': 7.22.5
+    dev: true
+
+  /@babel/plugin-syntax-jsx@7.22.5(@babel/core@7.22.11):
     resolution: {integrity: sha512-gvyP4hZrgrs/wWMaocvxZ44Hw0b3W8Pe+cMxc8V1ULQ07oh8VNbIRaoD1LRZVTvD+0nieDKjfgKg89sD7rrKrg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-logical-assignment-operators@7.10.4(@babel/core@7.22.9):
+  /@babel/plugin-syntax-logical-assignment-operators@7.10.4(@babel/core@7.22.11):
     resolution: {integrity: sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-nullish-coalescing-operator@7.8.3(@babel/core@7.22.9):
+  /@babel/plugin-syntax-logical-assignment-operators@7.10.4(@babel/core@7.23.0):
+    resolution: {integrity: sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
+      '@babel/helper-plugin-utils': 7.22.5
+    dev: true
+
+  /@babel/plugin-syntax-nullish-coalescing-operator@7.8.3(@babel/core@7.22.11):
     resolution: {integrity: sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
+      '@babel/helper-plugin-utils': 7.22.5
+    dev: true
+
+  /@babel/plugin-syntax-nullish-coalescing-operator@7.8.3(@babel/core@7.23.0):
+    resolution: {integrity: sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-numeric-separator@7.10.4(@babel/core@7.22.9):
+  /@babel/plugin-syntax-numeric-separator@7.10.4(@babel/core@7.22.11):
     resolution: {integrity: sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
+      '@babel/helper-plugin-utils': 7.22.5
+    dev: true
+
+  /@babel/plugin-syntax-numeric-separator@7.10.4(@babel/core@7.23.0):
+    resolution: {integrity: sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-object-rest-spread@7.8.3(@babel/core@7.22.9):
+  /@babel/plugin-syntax-object-rest-spread@7.8.3(@babel/core@7.22.11):
     resolution: {integrity: sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
+      '@babel/helper-plugin-utils': 7.22.5
+    dev: true
+
+  /@babel/plugin-syntax-object-rest-spread@7.8.3(@babel/core@7.23.0):
+    resolution: {integrity: sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-optional-catch-binding@7.8.3(@babel/core@7.22.9):
+  /@babel/plugin-syntax-optional-catch-binding@7.8.3(@babel/core@7.22.11):
     resolution: {integrity: sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
+      '@babel/helper-plugin-utils': 7.22.5
+    dev: true
+
+  /@babel/plugin-syntax-optional-catch-binding@7.8.3(@babel/core@7.23.0):
+    resolution: {integrity: sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-optional-chaining@7.8.3(@babel/core@7.22.9):
+  /@babel/plugin-syntax-optional-chaining@7.8.3(@babel/core@7.22.11):
     resolution: {integrity: sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-private-property-in-object@7.14.5(@babel/core@7.22.9):
+  /@babel/plugin-syntax-optional-chaining@7.8.3(@babel/core@7.23.0):
+    resolution: {integrity: sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
+      '@babel/helper-plugin-utils': 7.22.5
+    dev: true
+
+  /@babel/plugin-syntax-private-property-in-object@7.14.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-top-level-await@7.14.5(@babel/core@7.22.9):
+  /@babel/plugin-syntax-top-level-await@7.14.5(@babel/core@7.22.11):
     resolution: {integrity: sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
+      '@babel/helper-plugin-utils': 7.22.5
+    dev: true
+
+  /@babel/plugin-syntax-top-level-await@7.14.5(@babel/core@7.23.0):
+    resolution: {integrity: sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-typescript@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-syntax-typescript@7.22.5(@babel/core@7.22.11):
     resolution: {integrity: sha512-1mS2o03i7t1c6VzH6fdQ3OA8tcEIxwG18zIPRp+UY1Ihv6W+XZzBCVxExF9upussPXJ0xE9XRHwMoNs1ep/nRQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-syntax-unicode-sets-regex@7.18.6(@babel/core@7.22.9):
+  /@babel/plugin-syntax-unicode-sets-regex@7.18.6(@babel/core@7.23.0):
     resolution: {integrity: sha512-727YkEAPwSIQTv5im8QHz3upqp92JTWhidIC81Tdx4VJYIte/VndKf1qKrfnnhPLiPghStWfvC/iFaMCQu7Nqg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-arrow-functions@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-arrow-functions@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-26lTNXoVRdAnsaDXPpvCNUq+OVWEVC6bx7Vvz9rC53F2bagUWW4u4ii2+h8Fejfh7RYqPxn+libeFBBck9muEw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-async-generator-functions@7.22.7(@babel/core@7.22.9):
-    resolution: {integrity: sha512-7HmE7pk/Fmke45TODvxvkxRMV9RazV+ZZzhOL9AG8G29TLrr3jkjwF7uJfxZ30EoXpO+LJkq4oA8NjO2DTnEDg==}
+  /@babel/plugin-transform-async-generator-functions@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-0pAlmeRJn6wU84zzZsEOx1JV1Jf8fqO9ok7wofIJwUnplYo247dcd24P+cMJht7ts9xkzdtB0EPHmOb7F+KzXw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-environment-visitor': 7.22.5
+      '@babel/core': 7.23.0
+      '@babel/helper-environment-visitor': 7.22.20
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/helper-remap-async-to-generator': 7.22.9(@babel/core@7.22.9)
-      '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.22.9)
+      '@babel/helper-remap-async-to-generator': 7.22.9(@babel/core@7.23.0)
+      '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-async-to-generator@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-async-to-generator@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-b1A8D8ZzE/VhNDoV1MSJTnpKkCG5bJo+19R4o4oy03zM7ws8yEMK755j61Dc3EyvdysbqH5BOOTquJ7ZX9C6vQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-module-imports': 7.22.5
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/helper-remap-async-to-generator': 7.22.9(@babel/core@7.22.9)
+      '@babel/helper-remap-async-to-generator': 7.22.9(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-block-scoped-functions@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-block-scoped-functions@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-tdXZ2UdknEKQWKJP1KMNmuF5Lx3MymtMN/pvA+p/VEkhK8jVcQ1fzSy8KM9qRYhAf2/lV33hoMPKI/xaI9sADA==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-block-scoping@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-EcACl1i5fSQ6bt+YGuU/XGCeZKStLmyVGytWkpyhCLeQVA0eu6Wtiw92V+I1T/hnezUv7j74dA/Ro69gWcU+hg==}
+  /@babel/plugin-transform-block-scoping@7.22.10(@babel/core@7.23.0):
+    resolution: {integrity: sha512-1+kVpGAOOI1Albt6Vse7c8pHzcZQdQKW+wJH+g8mCaszOdDVwRXa/slHPqIw+oJAJANTKDMuM2cBdV0Dg618Vg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-class-properties@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-class-properties@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-nDkQ0NfkOhPTq8YCLiWNxp1+f9fCobEjCb0n8WdbNUBc4IB5V7P1QnX9IjpSoquKrXF5SKojHleVNs2vGeHCHQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-create-class-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-create-class-features-plugin': 7.22.11(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-class-static-block@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-SPToJ5eYZLxlnp1UzdARpOGeC2GbHvr9d/UV0EukuVx8atktg194oe+C5BqQ8jRTkgLRVOPYeXRSBg1IlMoVRA==}
+  /@babel/plugin-transform-class-static-block@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-GMM8gGmqI7guS/llMFk1bJDkKfn3v3C4KHK9Yg1ey5qcHcOlKb0QvcMrgzvxo+T03/4szNh5lghY+fEC98Kq9g==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.12.0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-create-class-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-create-class-features-plugin': 7.22.11(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-class-static-block': 7.14.5(@babel/core@7.22.9)
+      '@babel/plugin-syntax-class-static-block': 7.14.5(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-classes@7.22.6(@babel/core@7.22.9):
+  /@babel/plugin-transform-classes@7.22.6(@babel/core@7.23.0):
     resolution: {integrity: sha512-58EgM6nuPNG6Py4Z3zSuu0xWu2VfodiMi72Jt5Kj2FECmaYk1RrTXA45z6KBFsu9tRgwQDwIiY4FXTt+YsSFAQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-annotate-as-pure': 7.22.5
-      '@babel/helper-compilation-targets': 7.22.9(@babel/core@7.22.9)
-      '@babel/helper-environment-visitor': 7.22.5
-      '@babel/helper-function-name': 7.22.5
+      '@babel/helper-compilation-targets': 7.22.10
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-function-name': 7.23.0
       '@babel/helper-optimise-call-expression': 7.22.5
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/helper-replace-supers': 7.22.9(@babel/core@7.22.9)
+      '@babel/helper-replace-supers': 7.22.9(@babel/core@7.23.0)
       '@babel/helper-split-export-declaration': 7.22.6
       globals: 11.12.0
     dev: true
 
-  /@babel/plugin-transform-computed-properties@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-computed-properties@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-4GHWBgRf0krxPX+AaPtgBAlTgTeZmqDynokHOX7aqqAB4tHs3U2Y02zH6ETFdLZGcg9UQSD1WCmkVrE9ErHeOg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/template': 7.22.5
+      '@babel/template': 7.22.15
     dev: true
 
-  /@babel/plugin-transform-destructuring@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-GfqcFuGW8vnEqTUBM7UtPd5A4q797LTvvwKxXTgRsFjoqaJiEg9deBG6kWeQYkVEL569NpnmpC0Pkr/8BLKGnQ==}
+  /@babel/plugin-transform-destructuring@7.22.10(@babel/core@7.23.0):
+    resolution: {integrity: sha512-dPJrL0VOyxqLM9sritNbMSGx/teueHF/htMKrPT7DNxccXxRDPYqlgPFFdr8u+F+qUZOkZoXue/6rL5O5GduEw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-dotall-regex@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-dotall-regex@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-5/Yk9QxCQCl+sOIB1WelKnVRxTJDSAIxtJLL2/pqL14ZVlbH0fUQUZa/T5/UnQtBNgghR7mfB8ERBKyKPCi7Vw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-duplicate-keys@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-duplicate-keys@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-dEnYD+9BBgld5VBXHnF/DbYGp3fqGMsyxKbtD1mDyIA7AkTSpKXFhCVuj/oQVOoALfBs77DudA0BE4d5mcpmqw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-dynamic-import@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-0MC3ppTB1AMxd8fXjSrbPa7LT9hrImt+/fcj+Pg5YMD7UQyWp/02+JWpdnCymmsXwIx5Z+sYn1bwCn4ZJNvhqQ==}
+  /@babel/plugin-transform-dynamic-import@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-g/21plo58sfteWjaO0ZNVb+uEOkJNjAaHhbejrnBmu011l/eNDScmkbjCC3l4FKb10ViaGU4aOkFznSu2zRHgA==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-dynamic-import': 7.8.3(@babel/core@7.22.9)
+      '@babel/plugin-syntax-dynamic-import': 7.8.3(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-exponentiation-operator@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-exponentiation-operator@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-vIpJFNM/FjZ4rh1myqIya9jXwrwwgFRHPjT3DkUA9ZLHuzox8jiXkOLvwm1H+PQIP3CqfC++WPKeuDi0Sjdj1g==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-builder-binary-assignment-operator-visitor': 7.22.5
+      '@babel/core': 7.23.0
+      '@babel/helper-builder-binary-assignment-operator-visitor': 7.22.10
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-export-namespace-from@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-X4hhm7FRnPgd4nDA4b/5V280xCx6oL7Oob5+9qVS5C13Zq4bh1qq7LU0GgRU6b5dBWBvhGaXYVB4AcN6+ol6vg==}
+  /@babel/plugin-transform-export-namespace-from@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-xa7aad7q7OiT8oNZ1mU7NrISjlSkVdMbNxn9IuLZyL9AJEhs1Apba3I+u5riX1dIkdptP5EKDG5XDPByWxtehw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-export-namespace-from': 7.8.3(@babel/core@7.22.9)
+      '@babel/plugin-syntax-export-namespace-from': 7.8.3(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-flow-strip-types@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-flow-strip-types@7.22.5(@babel/core@7.22.11):
     resolution: {integrity: sha512-tujNbZdxdG0/54g/oua8ISToaXTFBf8EnSb5PgQSciIXWOWKX3S4+JR7ZE9ol8FZwf9kxitzkGQ+QWeov/mCiA==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-flow': 7.22.5(@babel/core@7.22.9)
+      '@babel/plugin-syntax-flow': 7.22.5(@babel/core@7.22.11)
     dev: true
 
-  /@babel/plugin-transform-for-of@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-for-of@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-3kxQjX1dU9uudwSshyLeEipvrLjBCVthCgeTp6CzE/9JYrlAIaeekVxRpCWsDDfYTfRZRoCeZatCQvwo+wvK8A==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-function-name@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-function-name@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-UIzQNMS0p0HHiQm3oelztj+ECwFnj+ZRV4KnguvlsD2of1whUeM6o7wGNj6oLwcDoAXQ8gEqfgC24D+VdIcevg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-compilation-targets': 7.22.9(@babel/core@7.22.9)
-      '@babel/helper-function-name': 7.22.5
+      '@babel/core': 7.23.0
+      '@babel/helper-compilation-targets': 7.22.10
+      '@babel/helper-function-name': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-json-strings@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-DuCRB7fu8MyTLbEQd1ew3R85nx/88yMoqo2uPSjevMj3yoN7CDM8jkgrY0wmVxfJZyJ/B9fE1iq7EQppWQmR5A==}
+  /@babel/plugin-transform-json-strings@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-CxT5tCqpA9/jXFlme9xIBCc5RPtdDq3JpkkhgHQqtDdiTnTI0jtZ0QzXhr5DILeYifDPp2wvY2ad+7+hLMW5Pw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.22.9)
+      '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-literals@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-literals@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-fTLj4D79M+mepcw3dgFBTIDYpbcB9Sm0bpm4ppXPaO+U+PKFFyV9MGRvS0gvGw62sd10kT5lRMKXAADb9pWy8g==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-logical-assignment-operators@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-MQQOUW1KL8X0cDWfbwYP+TbVbZm16QmQXJQ+vndPtH/BoO0lOKpVoEDMI7+PskYxH+IiE0tS8xZye0qr1lGzSA==}
+  /@babel/plugin-transform-logical-assignment-operators@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-qQwRTP4+6xFCDV5k7gZBF3C31K34ut0tbEcTKxlX/0KXxm9GLcO14p570aWxFvVzx6QAfPgq7gaeIHXJC8LswQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.22.9)
+      '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-member-expression-literals@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-member-expression-literals@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-RZEdkNtzzYCFl9SE9ATaUMTj2hqMb4StarOJLrZRbqqU4HSBE7UlBw9WBWQiDzrJZJdUWiMTVDI6Gv/8DPvfew==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-modules-amd@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-modules-amd@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-R+PTfLTcYEmb1+kK7FNkhQ1gP4KgjpSO6HfH9+f8/yfp2Nt3ggBjiVpRwmwTlfqZLafYKJACy36yDXlEmI9HjQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-module-transforms': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-module-transforms': 7.22.9(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-modules-commonjs@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-B4pzOXj+ONRmuaQTg05b3y/4DuFz3WcCNAXPLb2Q0GT0TrGKGxNKV4jwsXts+StaM0LQczZbOpj8o1DLPDJIiA==}
+  /@babel/plugin-transform-modules-commonjs@7.22.11(@babel/core@7.22.11):
+    resolution: {integrity: sha512-o2+bg7GDS60cJMgz9jWqRUsWkMzLCxp+jFDeDUT5sjRlAxcJWZ2ylNdI7QQ2+CH5hWu7OnN+Cv3htt7AkSf96g==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-module-transforms': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.22.11
+      '@babel/helper-module-transforms': 7.22.9(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
       '@babel/helper-simple-access': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-modules-systemjs@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-emtEpoaTMsOs6Tzz+nbmcePl6AKVtS1yC4YNAeMun9U8YCsgadPNxnOPQ8GhHFB2qdx+LZu9LgoC0Lthuu05DQ==}
+  /@babel/plugin-transform-modules-commonjs@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-o2+bg7GDS60cJMgz9jWqRUsWkMzLCxp+jFDeDUT5sjRlAxcJWZ2ylNdI7QQ2+CH5hWu7OnN+Cv3htt7AkSf96g==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
+      '@babel/helper-module-transforms': 7.22.9(@babel/core@7.23.0)
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-simple-access': 7.22.5
+    dev: true
+
+  /@babel/plugin-transform-modules-systemjs@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-rIqHmHoMEOhI3VkVf5jQ15l539KrwhzqcBO6wdCNWPWc/JWt9ILNYNUssbRpeq0qWns8svuw8LnMNCvWBIJ8wA==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
       '@babel/helper-hoist-variables': 7.22.5
-      '@babel/helper-module-transforms': 7.22.9(@babel/core@7.22.9)
+      '@babel/helper-module-transforms': 7.22.9(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/helper-validator-identifier': 7.22.5
+      '@babel/helper-validator-identifier': 7.22.20
     dev: true
 
-  /@babel/plugin-transform-modules-umd@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-modules-umd@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-+S6kzefN/E1vkSsKx8kmQuqeQsvCKCd1fraCM7zXm4SFoggI099Tr4G8U81+5gtMdUeMQ4ipdQffbKLX0/7dBQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-module-transforms': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-module-transforms': 7.22.9(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-named-capturing-groups-regex@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-named-capturing-groups-regex@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-YgLLKmS3aUBhHaxp5hi1WJTgOUb/NCuDHzGT9z9WTt3YG+CPRhJs6nprbStx6DnWM4dh6gt7SU3sZodbZ08adQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-new-target@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-new-target@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-AsF7K0Fx/cNKVyk3a+DW0JLo+Ua598/NxMRvxDnkpCIGFh43+h/v2xyhRUYf6oD8gE4QtL83C7zZVghMjHd+iw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-nullish-coalescing-operator@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-6CF8g6z1dNYZ/VXok5uYkkBBICHZPiGEl7oDnAx2Mt1hlHVHOSIKWJaXHjQJA5VB43KZnXZDIexMchY4y2PGdA==}
+  /@babel/plugin-transform-nullish-coalescing-operator@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-YZWOw4HxXrotb5xsjMJUDlLgcDXSfO9eCmdl1bgW4+/lAGdkjaEvOnQ4p5WKKdUgSzO39dgPl0pTnfxm0OAXcg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.22.9)
+      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-numeric-separator@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-NbslED1/6M+sXiwwtcAB/nieypGw02Ejf4KtDeMkCEpP6gWFMX1wI9WKYua+4oBneCCEmulOkRpwywypVZzs/g==}
+  /@babel/plugin-transform-numeric-separator@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-3dzU4QGPsILdJbASKhF/V2TVP+gJya1PsueQCxIPCEcerqF21oEcrob4mzjsp2Py/1nLfF5m+xYNMDpmA8vffg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.22.9)
+      '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-object-rest-spread@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-Kk3lyDmEslH9DnvCDA1s1kkd3YWQITiBOHngOtDL9Pt6BZjzqb6hiOlb8VfjiiQJ2unmegBqZu0rx5RxJb5vmQ==}
+  /@babel/plugin-transform-object-rest-spread@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-nX8cPFa6+UmbepISvlf5jhQyaC7ASs/7UxHmMkuJ/k5xSHvDPPaibMo+v3TXwU/Pjqhep/nFNpd3zn4YR59pnw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
       '@babel/compat-data': 7.22.9
-      '@babel/core': 7.22.9
-      '@babel/helper-compilation-targets': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-compilation-targets': 7.22.10
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-transform-parameters': 7.22.5(@babel/core@7.22.9)
+      '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-transform-parameters': 7.22.5(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-object-super@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-object-super@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-klXqyaT9trSjIUrcsYIfETAzmOEZL3cBYqOYLJxBHfMFFggmXOv+NYSX/Jbs9mzMVESw/WycLFPRx8ba/b2Ipw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/helper-replace-supers': 7.22.9(@babel/core@7.22.9)
+      '@babel/helper-replace-supers': 7.22.9(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-optional-catch-binding@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-pH8orJahy+hzZje5b8e2QIlBWQvGpelS76C63Z+jhZKsmzfNaPQ+LaW6dcJ9bxTpo1mtXbgHwy765Ro3jftmUg==}
+  /@babel/plugin-transform-optional-catch-binding@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-rli0WxesXUeCJnMYhzAglEjLWVDF6ahb45HuprcmQuLidBJFWjNnOzssk2kuc6e33FlLaiZhG/kUIzUMWdBKaQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.22.9)
+      '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-optional-chaining@7.22.6(@babel/core@7.22.9):
-    resolution: {integrity: sha512-Vd5HiWml0mDVtcLHIoEU5sw6HOUW/Zk0acLs/SAeuLzkGNOPc9DB4nkUajemhCmTIz3eiaKREZn2hQQqF79YTg==}
+  /@babel/plugin-transform-optional-chaining@7.22.12(@babel/core@7.23.0):
+    resolution: {integrity: sha512-7XXCVqZtyFWqjDsYDY4T45w4mlx1rf7aOgkc/Ww76xkgBiOlmjPkx36PBLHa1k1rwWvVgYMPsbuVnIamx2ZQJw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
       '@babel/helper-skip-transparent-expression-wrappers': 7.22.5
-      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.22.9)
+      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-parameters@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-parameters@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-AVkFUBurORBREOmHRKo06FjHYgjrabpdqRSwq6+C7R5iTCZOsM4QbcB27St0a4U6fffyAOqh3s/qEfybAhfivg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-private-methods@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-private-methods@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-PPjh4gyrQnGe97JTalgRGMuU4icsZFnWkzicB/fUtzlKUqvsWBKEpPPfr5a2JiyirZkHxnAqkQMO5Z5B2kK3fA==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-create-class-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-create-class-features-plugin': 7.22.11(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-private-property-in-object@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-/9xnaTTJcVoBtSSmrVyhtSvO3kbqS2ODoh2juEU72c3aYonNF0OMGiaz2gjukyKM2wBBYJP38S4JiE0Wfb5VMQ==}
+  /@babel/plugin-transform-private-property-in-object@7.22.11(@babel/core@7.23.0):
+    resolution: {integrity: sha512-sSCbqZDBKHetvjSwpyWzhuHkmW5RummxJBVbYLkGkaiTOWGxml7SXt0iWa03bzxFIx7wOj3g/ILRd0RcJKBeSQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-annotate-as-pure': 7.22.5
-      '@babel/helper-create-class-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/helper-create-class-features-plugin': 7.22.11(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-private-property-in-object': 7.14.5(@babel/core@7.22.9)
+      '@babel/plugin-syntax-private-property-in-object': 7.14.5(@babel/core@7.23.0)
     dev: true
 
-  /@babel/plugin-transform-property-literals@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-property-literals@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-TiOArgddK3mK/x1Qwf5hay2pxI6wCZnvQqrFSqbtg1GLl2JcNMitVH/YnqjP+M31pLUeTfzY1HAXFDnUBV30rQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-react-jsx-self@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-react-jsx-self@7.22.5(@babel/core@7.22.11):
     resolution: {integrity: sha512-nTh2ogNUtxbiSbxaT4Ds6aXnXEipHweN9YRgOX/oNXdf0cCrGn/+2LozFa3lnPV5D90MkjhgckCPBrsoSc1a7g==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
+      '@babel/helper-plugin-utils': 7.22.5
+    dev: true
+
+  /@babel/plugin-transform-react-jsx-self@7.22.5(@babel/core@7.23.0):
+    resolution: {integrity: sha512-nTh2ogNUtxbiSbxaT4Ds6aXnXEipHweN9YRgOX/oNXdf0cCrGn/+2LozFa3lnPV5D90MkjhgckCPBrsoSc1a7g==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
+    dev: false
 
-  /@babel/plugin-transform-react-jsx-source@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-react-jsx-source@7.22.5(@babel/core@7.22.11):
     resolution: {integrity: sha512-yIiRO6yobeEIaI0RTbIr8iAK9FcBHLtZq0S89ZPjDLQXBA4xvghaKqI0etp/tF3htTM0sazJKKLz9oEiGRtu7w==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
+    dev: true
 
-  /@babel/plugin-transform-regenerator@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-rR7KePOE7gfEtNTh9Qw+iO3Q/e4DEsoQ+hdvM6QUDH7JRJ5qxq5AA52ZzBWbI5i9lfNuvySgOGP8ZN7LAmaiPw==}
+  /@babel/plugin-transform-react-jsx-source@7.22.5(@babel/core@7.23.0):
+    resolution: {integrity: sha512-yIiRO6yobeEIaI0RTbIr8iAK9FcBHLtZq0S89ZPjDLQXBA4xvghaKqI0etp/tF3htTM0sazJKKLz9oEiGRtu7w==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
-      regenerator-transform: 0.15.1
+    dev: false
+
+  /@babel/plugin-transform-regenerator@7.22.10(@babel/core@7.23.0):
+    resolution: {integrity: sha512-F28b1mDt8KcT5bUyJc/U9nwzw6cV+UmTeRlXYIl2TNqMMJif0Jeey9/RQ3C4NOd2zp0/TRsDns9ttj2L523rsw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/core': 7.23.0
+      '@babel/helper-plugin-utils': 7.22.5
+      regenerator-transform: 0.15.2
     dev: true
 
-  /@babel/plugin-transform-reserved-words@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-reserved-words@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-DTtGKFRQUDm8svigJzZHzb/2xatPc6TzNvAIJ5GqOKDsGFYgAskjRulbR/vGsPKq3OPqtexnz327qYpP57RFyA==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-shorthand-properties@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-shorthand-properties@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-vM4fq9IXHscXVKzDv5itkO1X52SmdFBFcMIBZ2FRn2nqVYqw6dBexUgMvAjHW+KXpPPViD/Yo3GrDEBaRC0QYA==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-spread@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-spread@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-5ZzDQIGyvN4w8+dMmpohL6MBo+l2G7tfC/O2Dg7/hjpgeWvUx8FzfeOKxGog9IimPa4YekaQ9PlDqTLOljkcxg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
       '@babel/helper-skip-transparent-expression-wrappers': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-sticky-regex@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-sticky-regex@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-zf7LuNpHG0iEeiyCNwX4j3gDg1jgt1k3ZdXBKbZSoA3BbGQGvMiSvfbZRR3Dr3aeJe3ooWFZxOOG3IRStYp2Bw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-template-literals@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-template-literals@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-5ciOehRNf+EyUeewo8NkbQiUs4d6ZxiHo6BcBcnFlgiJfu16q0bQUw9Jvo0b0gBKFG1SMhDSjeKXSYuJLeFSMA==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-typeof-symbol@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-typeof-symbol@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-bYkI5lMzL4kPii4HHEEChkD0rkc+nvnlR6+o/qdqR6zrm0Sv/nodmyLhlq2DO0YKLUNd2VePmPRjJXSBh9OIdA==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-typescript@7.22.9(@babel/core@7.22.9):
-    resolution: {integrity: sha512-BnVR1CpKiuD0iobHPaM1iLvcwPYN2uVFAqoLVSpEDKWuOikoCv5HbKLxclhKYUXlWkX86DoZGtqI4XhbOsyrMg==}
+  /@babel/plugin-transform-typescript@7.22.11(@babel/core@7.22.11):
+    resolution: {integrity: sha512-0E4/L+7gfvHub7wsbTv03oRtD69X31LByy44fGmFzbZScpupFByMcgCJ0VbBTkzyjSJKuRoGN8tcijOWKTmqOA==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-annotate-as-pure': 7.22.5
-      '@babel/helper-create-class-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/helper-create-class-features-plugin': 7.22.11(@babel/core@7.22.11)
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-syntax-typescript': 7.22.5(@babel/core@7.22.9)
+      '@babel/plugin-syntax-typescript': 7.22.5(@babel/core@7.22.11)
     dev: true
 
-  /@babel/plugin-transform-unicode-escapes@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-biEmVg1IYB/raUO5wT1tgfacCef15Fbzhkx493D3urBI++6hpJ+RFG4SrWMn0NEZLfvilqKf3QDrRVZHo08FYg==}
+  /@babel/plugin-transform-unicode-escapes@7.22.10(@babel/core@7.23.0):
+    resolution: {integrity: sha512-lRfaRKGZCBqDlRU3UIFovdp9c9mEvlylmpod0/OatICsSfuQ9YFthRo1tpTkGsklEefZdqlEFdY4A2dwTb6ohg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-unicode-property-regex@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-unicode-property-regex@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-HCCIb+CbJIAE6sXn5CjFQXMwkCClcOfPCzTlilJ8cUatfzwHlWQkbtV0zD338u9dZskwvuOYTuuaMaA8J5EI5A==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-unicode-regex@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-unicode-regex@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-028laaOKptN5vHJf9/Arr/HiJekMd41hOEZYvNsrsXqJ7YPYuX2bQxh31fkZzGmq3YqHRJzYFFAVYvKfMPKqyg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/plugin-transform-unicode-sets-regex@7.22.5(@babel/core@7.22.9):
+  /@babel/plugin-transform-unicode-sets-regex@7.22.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-lhMfi4FC15j13eKrh3DnYHjpGj6UKQHtNKTbtc1igvAhRy4+kLhV07OpLcsN0VgDEw/MjAvJO4BdMJsHwMhzCg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-create-regexp-features-plugin': 7.22.9(@babel/core@7.23.0)
       '@babel/helper-plugin-utils': 7.22.5
     dev: true
 
-  /@babel/preset-env@7.22.9(@babel/core@7.22.9):
-    resolution: {integrity: sha512-wNi5H/Emkhll/bqPjsjQorSykrlfY5OWakd6AulLvMEytpKasMVUpVy8RL4qBIBs5Ac6/5i0/Rv0b/Fg6Eag/g==}
+  /@babel/preset-env@7.22.14(@babel/core@7.22.11):
+    resolution: {integrity: sha512-daodMIoVo+ol/g+//c/AH+szBkFj4STQUikvBijRGL72Ph+w+AMTSh55DUETe8KJlPlDT1k/mp7NBfOuiWmoig==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
       '@babel/compat-data': 7.22.9
-      '@babel/core': 7.22.9
-      '@babel/helper-compilation-targets': 7.22.9(@babel/core@7.22.9)
+      '@babel/core': 7.22.11
+      '@babel/helper-compilation-targets': 7.22.10
+      '@babel/helper-plugin-utils': 7.22.5
+      '@babel/helper-validator-option': 7.22.5
+      '@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-proposal-private-property-in-object': 7.21.0-placeholder-for-preset-env.2(@babel/core@7.23.0)
+      '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.23.0)
+      '@babel/plugin-syntax-class-properties': 7.12.13(@babel/core@7.23.0)
+      '@babel/plugin-syntax-class-static-block': 7.14.5(@babel/core@7.23.0)
+      '@babel/plugin-syntax-dynamic-import': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-export-namespace-from': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-import-assertions': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-syntax-import-attributes': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-syntax-import-meta': 7.10.4(@babel/core@7.23.0)
+      '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.23.0)
+      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.23.0)
+      '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-private-property-in-object': 7.14.5(@babel/core@7.23.0)
+      '@babel/plugin-syntax-top-level-await': 7.14.5(@babel/core@7.23.0)
+      '@babel/plugin-syntax-unicode-sets-regex': 7.18.6(@babel/core@7.23.0)
+      '@babel/plugin-transform-arrow-functions': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-async-generator-functions': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-async-to-generator': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-block-scoped-functions': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-block-scoping': 7.22.10(@babel/core@7.23.0)
+      '@babel/plugin-transform-class-properties': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-class-static-block': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-classes': 7.22.6(@babel/core@7.23.0)
+      '@babel/plugin-transform-computed-properties': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-destructuring': 7.22.10(@babel/core@7.23.0)
+      '@babel/plugin-transform-dotall-regex': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-duplicate-keys': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-dynamic-import': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-exponentiation-operator': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-export-namespace-from': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-for-of': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-function-name': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-json-strings': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-literals': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-logical-assignment-operators': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-member-expression-literals': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-modules-amd': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-modules-commonjs': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-modules-systemjs': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-modules-umd': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-named-capturing-groups-regex': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-new-target': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-nullish-coalescing-operator': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-numeric-separator': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-object-rest-spread': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-object-super': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-optional-catch-binding': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-optional-chaining': 7.22.12(@babel/core@7.23.0)
+      '@babel/plugin-transform-parameters': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-private-methods': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-private-property-in-object': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-property-literals': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-regenerator': 7.22.10(@babel/core@7.23.0)
+      '@babel/plugin-transform-reserved-words': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-shorthand-properties': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-spread': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-sticky-regex': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-template-literals': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-typeof-symbol': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-unicode-escapes': 7.22.10(@babel/core@7.23.0)
+      '@babel/plugin-transform-unicode-property-regex': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-unicode-regex': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-unicode-sets-regex': 7.22.5(@babel/core@7.23.0)
+      '@babel/preset-modules': 0.1.6-no-external-plugins(@babel/core@7.23.0)
+      '@babel/types': 7.23.0
+      babel-plugin-polyfill-corejs2: 0.4.5(@babel/core@7.23.0)
+      babel-plugin-polyfill-corejs3: 0.8.3(@babel/core@7.23.0)
+      babel-plugin-polyfill-regenerator: 0.5.2(@babel/core@7.23.0)
+      core-js-compat: 3.32.1
+      semver: 7.5.3
+    transitivePeerDependencies:
+      - supports-color
+    dev: true
+
+  /@babel/preset-env@7.22.14(@babel/core@7.23.0):
+    resolution: {integrity: sha512-daodMIoVo+ol/g+//c/AH+szBkFj4STQUikvBijRGL72Ph+w+AMTSh55DUETe8KJlPlDT1k/mp7NBfOuiWmoig==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+    dependencies:
+      '@babel/compat-data': 7.22.9
+      '@babel/core': 7.23.0
+      '@babel/helper-compilation-targets': 7.22.10
       '@babel/helper-plugin-utils': 7.22.5
       '@babel/helper-validator-option': 7.22.5
-      '@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-proposal-private-property-in-object': 7.21.0-placeholder-for-preset-env.2(@babel/core@7.22.9)
-      '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.22.9)
-      '@babel/plugin-syntax-class-properties': 7.12.13(@babel/core@7.22.9)
-      '@babel/plugin-syntax-class-static-block': 7.14.5(@babel/core@7.22.9)
-      '@babel/plugin-syntax-dynamic-import': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-export-namespace-from': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-import-assertions': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-syntax-import-attributes': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-syntax-import-meta': 7.10.4(@babel/core@7.22.9)
-      '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.22.9)
-      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.22.9)
-      '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-private-property-in-object': 7.14.5(@babel/core@7.22.9)
-      '@babel/plugin-syntax-top-level-await': 7.14.5(@babel/core@7.22.9)
-      '@babel/plugin-syntax-unicode-sets-regex': 7.18.6(@babel/core@7.22.9)
-      '@babel/plugin-transform-arrow-functions': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-async-generator-functions': 7.22.7(@babel/core@7.22.9)
-      '@babel/plugin-transform-async-to-generator': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-block-scoped-functions': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-block-scoping': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-class-properties': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-class-static-block': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-classes': 7.22.6(@babel/core@7.22.9)
-      '@babel/plugin-transform-computed-properties': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-destructuring': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-dotall-regex': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-duplicate-keys': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-dynamic-import': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-exponentiation-operator': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-export-namespace-from': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-for-of': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-function-name': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-json-strings': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-literals': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-logical-assignment-operators': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-member-expression-literals': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-modules-amd': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-modules-commonjs': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-modules-systemjs': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-modules-umd': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-named-capturing-groups-regex': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-new-target': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-nullish-coalescing-operator': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-numeric-separator': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-object-rest-spread': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-object-super': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-optional-catch-binding': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-optional-chaining': 7.22.6(@babel/core@7.22.9)
-      '@babel/plugin-transform-parameters': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-private-methods': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-private-property-in-object': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-property-literals': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-regenerator': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-reserved-words': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-shorthand-properties': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-spread': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-sticky-regex': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-template-literals': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-typeof-symbol': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-unicode-escapes': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-unicode-property-regex': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-unicode-regex': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-unicode-sets-regex': 7.22.5(@babel/core@7.22.9)
-      '@babel/preset-modules': 0.1.6(@babel/core@7.22.9)
-      '@babel/types': 7.22.5
-      babel-plugin-polyfill-corejs2: 0.4.5(@babel/core@7.22.9)
-      babel-plugin-polyfill-corejs3: 0.8.3(@babel/core@7.22.9)
-      babel-plugin-polyfill-regenerator: 0.5.2(@babel/core@7.22.9)
-      core-js-compat: 3.32.0
+      '@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-proposal-private-property-in-object': 7.21.0-placeholder-for-preset-env.2(@babel/core@7.23.0)
+      '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.23.0)
+      '@babel/plugin-syntax-class-properties': 7.12.13(@babel/core@7.23.0)
+      '@babel/plugin-syntax-class-static-block': 7.14.5(@babel/core@7.23.0)
+      '@babel/plugin-syntax-dynamic-import': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-export-namespace-from': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-import-assertions': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-syntax-import-attributes': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-syntax-import-meta': 7.10.4(@babel/core@7.23.0)
+      '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.23.0)
+      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.23.0)
+      '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.23.0)
+      '@babel/plugin-syntax-private-property-in-object': 7.14.5(@babel/core@7.23.0)
+      '@babel/plugin-syntax-top-level-await': 7.14.5(@babel/core@7.23.0)
+      '@babel/plugin-syntax-unicode-sets-regex': 7.18.6(@babel/core@7.23.0)
+      '@babel/plugin-transform-arrow-functions': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-async-generator-functions': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-async-to-generator': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-block-scoped-functions': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-block-scoping': 7.22.10(@babel/core@7.23.0)
+      '@babel/plugin-transform-class-properties': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-class-static-block': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-classes': 7.22.6(@babel/core@7.23.0)
+      '@babel/plugin-transform-computed-properties': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-destructuring': 7.22.10(@babel/core@7.23.0)
+      '@babel/plugin-transform-dotall-regex': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-duplicate-keys': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-dynamic-import': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-exponentiation-operator': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-export-namespace-from': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-for-of': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-function-name': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-json-strings': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-literals': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-logical-assignment-operators': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-member-expression-literals': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-modules-amd': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-modules-commonjs': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-modules-systemjs': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-modules-umd': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-named-capturing-groups-regex': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-new-target': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-nullish-coalescing-operator': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-numeric-separator': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-object-rest-spread': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-object-super': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-optional-catch-binding': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-optional-chaining': 7.22.12(@babel/core@7.23.0)
+      '@babel/plugin-transform-parameters': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-private-methods': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-private-property-in-object': 7.22.11(@babel/core@7.23.0)
+      '@babel/plugin-transform-property-literals': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-regenerator': 7.22.10(@babel/core@7.23.0)
+      '@babel/plugin-transform-reserved-words': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-shorthand-properties': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-spread': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-sticky-regex': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-template-literals': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-typeof-symbol': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-unicode-escapes': 7.22.10(@babel/core@7.23.0)
+      '@babel/plugin-transform-unicode-property-regex': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-unicode-regex': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-unicode-sets-regex': 7.22.5(@babel/core@7.23.0)
+      '@babel/preset-modules': 0.1.6-no-external-plugins(@babel/core@7.23.0)
+      '@babel/types': 7.23.0
+      babel-plugin-polyfill-corejs2: 0.4.5(@babel/core@7.23.0)
+      babel-plugin-polyfill-corejs3: 0.8.3(@babel/core@7.23.0)
+      babel-plugin-polyfill-regenerator: 0.5.2(@babel/core@7.23.0)
+      core-js-compat: 3.32.1
       semver: 7.5.3
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /@babel/preset-flow@7.22.5(@babel/core@7.22.9):
+  /@babel/preset-flow@7.22.5(@babel/core@7.22.11):
     resolution: {integrity: sha512-ta2qZ+LSiGCrP5pgcGt8xMnnkXQrq8Sa4Ulhy06BOlF5QbLw9q5hIx7bn5MrsvyTGAfh6kTOo07Q+Pfld/8Y5Q==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
       '@babel/helper-validator-option': 7.22.5
-      '@babel/plugin-transform-flow-strip-types': 7.22.5(@babel/core@7.22.9)
+      '@babel/plugin-transform-flow-strip-types': 7.22.5(@babel/core@7.22.11)
     dev: true
 
-  /@babel/preset-modules@0.1.6(@babel/core@7.22.9):
-    resolution: {integrity: sha512-ID2yj6K/4lKfhuU3+EX4UvNbIt7eACFbHmNUjzA+ep+B5971CknnA/9DEWKbRokfbbtblxxxXFJJrH47UEAMVg==}
+  /@babel/preset-modules@0.1.6-no-external-plugins(@babel/core@7.23.0):
+    resolution: {integrity: sha512-HrcgcIESLm9aIR842yhJ5RWan/gebQUJ6E/E5+rf0y9o6oj7w0Br+sWuL6kEQ/o/AdfvR1Je9jG18/gnpwjEyA==}
     peerDependencies:
       '@babel/core': ^7.0.0-0 || ^8.0.0-0 <8.0.0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.23.0
       '@babel/helper-plugin-utils': 7.22.5
-      '@babel/plugin-proposal-unicode-property-regex': 7.18.6(@babel/core@7.22.9)
-      '@babel/plugin-transform-dotall-regex': 7.22.5(@babel/core@7.22.9)
-      '@babel/types': 7.22.5
+      '@babel/types': 7.23.0
       esutils: 2.0.3
     dev: true
 
-  /@babel/preset-typescript@7.22.5(@babel/core@7.22.9):
-    resolution: {integrity: sha512-YbPaal9LxztSGhmndR46FmAbkJ/1fAsw293tSU+I5E5h+cnJ3d4GTwyUgGYmOXJYdGA+uNePle4qbaRzj2NISQ==}
+  /@babel/preset-typescript@7.22.11(@babel/core@7.22.11):
+    resolution: {integrity: sha512-tWY5wyCZYBGY7IlalfKI1rLiGlIfnwsRHZqlky0HVv8qviwQ1Uo/05M6+s+TcTCVa6Bmoo2uJW5TMFX6Wa4qVg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@babel/helper-plugin-utils': 7.22.5
       '@babel/helper-validator-option': 7.22.5
-      '@babel/plugin-syntax-jsx': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-modules-commonjs': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-typescript': 7.22.9(@babel/core@7.22.9)
+      '@babel/plugin-syntax-jsx': 7.22.5(@babel/core@7.22.11)
+      '@babel/plugin-transform-modules-commonjs': 7.22.11(@babel/core@7.22.11)
+      '@babel/plugin-transform-typescript': 7.22.11(@babel/core@7.22.11)
     dev: true
 
-  /@babel/register@7.22.5(@babel/core@7.22.9):
+  /@babel/register@7.22.5(@babel/core@7.22.11):
     resolution: {integrity: sha512-vV6pm/4CijSQ8Y47RH5SopXzursN35RQINfGJkmOlcpAtGuf94miFvIPhCKGQN7WGIcsgG1BHEX2KVdTYwTwUQ==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       clone-deep: 4.0.1
       find-cache-dir: 2.1.0
       make-dir: 2.1.0
@@ -1712,43 +2079,63 @@ packages:
     resolution: {integrity: sha512-x/rqGMdzj+fWZvCOYForTghzbtqPDZ5gPwaoNGHdgDfF2QA/XZbCBp4Moo5scrkAMPhB7z26XM/AaHuIJdgauA==}
     dev: true
 
+  /@babel/runtime@7.22.11:
+    resolution: {integrity: sha512-ee7jVNlWN09+KftVOu9n7S8gQzD/Z6hN/I8VBRXW4P1+Xe7kJGXMwu8vds4aGIMHZnNbdpSWCfZZtinytpcAvA==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      regenerator-runtime: 0.14.0
+    dev: true
+
+  /@babel/runtime@7.22.15:
+    resolution: {integrity: sha512-T0O+aa+4w0u06iNmapipJXMV4HoUir03hpx3/YqXXhu9xim3w+dVphjFWl1OH8NbZHw5Lbm9k45drDkgq2VNNA==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      regenerator-runtime: 0.14.0
+    dev: true
+
   /@babel/runtime@7.22.6:
     resolution: {integrity: sha512-wDb5pWm4WDdF6LFUde3Jl8WzPA+3ZbxYqkC6xAXuD3irdEHN1k0NfTRrJD8ZD378SJ61miMLCqIOXYhd8x+AJQ==}
     engines: {node: '>=6.9.0'}
     dependencies:
       regenerator-runtime: 0.13.11
 
-  /@babel/template@7.22.5:
-    resolution: {integrity: sha512-X7yV7eiwAxdj9k94NEylvbVHLiVG1nvzCV2EAowhxLTwODV1jl9UzZ48leOC0sH7OnuHrIkllaBgneUykIcZaw==}
+  /@babel/runtime@7.23.1:
+    resolution: {integrity: sha512-hC2v6p8ZSI/W0HUzh3V8C5g+NwSKzKPtJwSpTjwl0o297GP9+ZLQSkdvHz46CM3LqyoXxq+5G9komY+eSqSO0g==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/code-frame': 7.22.5
-      '@babel/parser': 7.22.7
-      '@babel/types': 7.22.5
+      regenerator-runtime: 0.14.0
 
-  /@babel/traverse@7.22.8:
-    resolution: {integrity: sha512-y6LPR+wpM2I3qJrsheCTwhIinzkETbplIgPBbwvqPKc+uljeA5gP+3nP8irdYt1mjQaDnlIcG+dw8OjAco4GXw==}
+  /@babel/template@7.22.15:
+    resolution: {integrity: sha512-QPErUVm4uyJa60rkI73qneDacvdvzxshT3kksGqlGWYdOTIUOwJ7RDUL8sGqslY1uXWSL6xMFKEXDS3ox2uF0w==}
     engines: {node: '>=6.9.0'}
     dependencies:
-      '@babel/code-frame': 7.22.5
-      '@babel/generator': 7.22.9
-      '@babel/helper-environment-visitor': 7.22.5
-      '@babel/helper-function-name': 7.22.5
+      '@babel/code-frame': 7.22.13
+      '@babel/parser': 7.23.0
+      '@babel/types': 7.23.0
+
+  /@babel/traverse@7.23.2:
+    resolution: {integrity: sha512-azpe59SQ48qG6nu2CzcMLbxUudtN+dOM9kDbUqGq3HXUJRlo7i8fvPoxQUzYgLZ4cMVmuZgm8vvBpNeRhd6XSw==}
+    engines: {node: '>=6.9.0'}
+    dependencies:
+      '@babel/code-frame': 7.22.13
+      '@babel/generator': 7.23.0
+      '@babel/helper-environment-visitor': 7.22.20
+      '@babel/helper-function-name': 7.23.0
       '@babel/helper-hoist-variables': 7.22.5
       '@babel/helper-split-export-declaration': 7.22.6
-      '@babel/parser': 7.22.7
-      '@babel/types': 7.22.5
+      '@babel/parser': 7.23.0
+      '@babel/types': 7.23.0
       debug: 4.3.4
       globals: 11.12.0
     transitivePeerDependencies:
       - supports-color
 
-  /@babel/types@7.22.5:
-    resolution: {integrity: sha512-zo3MIHGOkPOfoRXitsgHLjEXmlDaD/5KU1Uzuc9GNiZPhSqVxVRtxuPaSBZDsYZ9qV88AjtMtWW7ww98loJ9KA==}
+  /@babel/types@7.23.0:
+    resolution: {integrity: sha512-0oIyUfKoI3mSqMvsxBdclDwxXKXAUA8v/apZbc+iSyARYou1o8ZGDxbUYyLFoW2arqS2jDGqJuZvv1d/io1axg==}
     engines: {node: '>=6.9.0'}
     dependencies:
       '@babel/helper-string-parser': 7.22.5
-      '@babel/helper-validator-identifier': 7.22.5
+      '@babel/helper-validator-identifier': 7.22.20
       to-fast-properties: 2.0.0
 
   /@base2/pretty-print-object@1.0.1:
@@ -1782,8 +2169,8 @@ packages:
     resolution: {integrity: sha512-1HP8BxD2azjqWJvxIaWAMyTySeZY0Osr83ukYjltPVkNXeJvTz7yDrPLBtnrD5uqJ3tg4CcLuuBW09wahqL/fg==}
     dev: false
 
-  /@emoji-mart/react@1.0.1(emoji-mart@5.4.0)(react@18.2.0):
-    resolution: {integrity: sha512-ALhLD96BOL5w+a4NI5NpmfqfF1aVjjj2qJE0dLst/OhjBfVmpteWNgn/h8LZy9ulU6AnbeS+13KnPFzDjCvRRw==}
+  /@emoji-mart/react@1.1.1(emoji-mart@5.4.0)(react@18.2.0):
+    resolution: {integrity: sha512-NMlFNeWgv1//uPsvLxvGQoIerPuVdXwK/EUek8OOkJ6wVOWPUizRBJU0hDqWZCOROVpfBgCemaC3m6jDOXi03g==}
     peerDependencies:
       emoji-mart: ^5.2
       react: ^16.8 || ^17 || ^18
@@ -1796,7 +2183,7 @@ packages:
     resolution: {integrity: sha512-m4HEDZleaaCH+XgDDsPF15Ht6wTLsgDTeR3WYj9Q/k76JtWhrJjcP4+/XlG8LGT/Rol9qUfOIztXeA84ATpqPQ==}
     dependencies:
       '@babel/helper-module-imports': 7.22.5
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@emotion/hash': 0.9.1
       '@emotion/memoize': 0.8.1
       '@emotion/serialize': 1.1.2
@@ -1818,6 +2205,16 @@ packages:
       stylis: 4.2.0
     dev: false
 
+  /@emotion/css@11.11.2:
+    resolution: {integrity: sha512-VJxe1ucoMYMS7DkiMdC2T7PWNbrEI0a39YRiyDvK2qq4lXwjRbVP/z4lpG+odCsRzadlR+1ywwrTzhdm5HNdew==}
+    dependencies:
+      '@emotion/babel-plugin': 11.11.0
+      '@emotion/cache': 11.11.0
+      '@emotion/serialize': 1.1.2
+      '@emotion/sheet': 1.2.2
+      '@emotion/utils': 1.2.1
+    dev: false
+
   /@emotion/hash@0.9.1:
     resolution: {integrity: sha512-gJB6HLm5rYwSLI6PQa+X1t5CFGrv1J1TWG+sOyMCeKz2ojaj6Fnl/rZEspogG+cvqbt4AE/2eIyD2QfLKTBNlQ==}
     dev: false
@@ -1915,6 +2312,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/android-arm64@0.18.20:
+    resolution: {integrity: sha512-Nz4rJcchGDtENV0eMKUNa6L12zz2zBDXuhj/Vjh18zGqB44Bi7MBMSXjgunJgjRhCmKOjnPuZp4Mb6OKqtMHLQ==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [android]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/android-arm@0.18.17:
     resolution: {integrity: sha512-wHsmJG/dnL3OkpAcwbgoBTTMHVi4Uyou3F5mf58ZtmUyIKfcdA7TROav/6tCzET4A3QW2Q2FC+eFneMU+iyOxg==}
     engines: {node: '>=12'}
@@ -1923,6 +2329,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/android-arm@0.18.20:
+    resolution: {integrity: sha512-fyi7TDI/ijKKNZTUJAQqiG5T7YjJXgnzkURqmGj13C6dCqckZBLdl4h7bkhHt/t0WP+zO9/zwroDvANaOqO5Sw==}
+    engines: {node: '>=12'}
+    cpu: [arm]
+    os: [android]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/android-x64@0.18.17:
     resolution: {integrity: sha512-O+FeWB/+xya0aLg23hHEM2E3hbfwZzjqumKMSIqcHbNvDa+dza2D0yLuymRBQQnC34CWrsJUXyH2MG5VnLd6uw==}
     engines: {node: '>=12'}
@@ -1931,6 +2346,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/android-x64@0.18.20:
+    resolution: {integrity: sha512-8GDdlePJA8D6zlZYJV/jnrRAi6rOiNaCC/JclcXpB+KIuvfBN4owLtgzY2bsxnx666XjJx2kDPUmnTtR8qKQUg==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [android]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/darwin-arm64@0.18.17:
     resolution: {integrity: sha512-M9uJ9VSB1oli2BE/dJs3zVr9kcCBBsE883prage1NWz6pBS++1oNn/7soPNS3+1DGj0FrkSvnED4Bmlu1VAE9g==}
     engines: {node: '>=12'}
@@ -1939,6 +2363,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/darwin-arm64@0.18.20:
+    resolution: {integrity: sha512-bxRHW5kHU38zS2lPTPOyuyTm+S+eobPUnTNkdJEfAddYgEcll4xkT8DB9d2008DtTbl7uJag2HuE5NZAZgnNEA==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [darwin]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/darwin-x64@0.18.17:
     resolution: {integrity: sha512-XDre+J5YeIJDMfp3n0279DFNrGCXlxOuGsWIkRb1NThMZ0BsrWXoTg23Jer7fEXQ9Ye5QjrvXpxnhzl3bHtk0g==}
     engines: {node: '>=12'}
@@ -1947,6 +2380,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/darwin-x64@0.18.20:
+    resolution: {integrity: sha512-pc5gxlMDxzm513qPGbCbDukOdsGtKhfxD1zJKXjCCcU7ju50O7MeAZ8c4krSJcOIJGFR+qx21yMMVYwiQvyTyQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [darwin]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/freebsd-arm64@0.18.17:
     resolution: {integrity: sha512-cjTzGa3QlNfERa0+ptykyxs5A6FEUQQF0MuilYXYBGdBxD3vxJcKnzDlhDCa1VAJCmAxed6mYhA2KaJIbtiNuQ==}
     engines: {node: '>=12'}
@@ -1955,6 +2397,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/freebsd-arm64@0.18.20:
+    resolution: {integrity: sha512-yqDQHy4QHevpMAaxhhIwYPMv1NECwOvIpGCZkECn8w2WFHXjEwrBn3CeNIYsibZ/iZEUemj++M26W3cNR5h+Tw==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [freebsd]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/freebsd-x64@0.18.17:
     resolution: {integrity: sha512-sOxEvR8d7V7Kw8QqzxWc7bFfnWnGdaFBut1dRUYtu+EIRXefBc/eIsiUiShnW0hM3FmQ5Zf27suDuHsKgZ5QrA==}
     engines: {node: '>=12'}
@@ -1963,6 +2414,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/freebsd-x64@0.18.20:
+    resolution: {integrity: sha512-tgWRPPuQsd3RmBZwarGVHZQvtzfEBOreNuxEMKFcd5DaDn2PbBxfwLcj4+aenoh7ctXcbXmOQIn8HI6mCSw5MQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [freebsd]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/linux-arm64@0.18.17:
     resolution: {integrity: sha512-c9w3tE7qA3CYWjT+M3BMbwMt+0JYOp3vCMKgVBrCl1nwjAlOMYzEo+gG7QaZ9AtqZFj5MbUc885wuBBmu6aADQ==}
     engines: {node: '>=12'}
@@ -1971,6 +2431,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/linux-arm64@0.18.20:
+    resolution: {integrity: sha512-2YbscF+UL7SQAVIpnWvYwM+3LskyDmPhe31pE7/aoTMFKKzIc9lLbyGUpmmb8a8AixOL61sQ/mFh3jEjHYFvdA==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/linux-arm@0.18.17:
     resolution: {integrity: sha512-2d3Lw6wkwgSLC2fIvXKoMNGVaeY8qdN0IC3rfuVxJp89CRfA3e3VqWifGDfuakPmp90+ZirmTfye1n4ncjv2lg==}
     engines: {node: '>=12'}
@@ -1979,6 +2448,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/linux-arm@0.18.20:
+    resolution: {integrity: sha512-/5bHkMWnq1EgKr1V+Ybz3s1hWXok7mDFUMQ4cG10AfW3wL02PSZi5kFpYKrptDsgb2WAJIvRcDm+qIvXf/apvg==}
+    engines: {node: '>=12'}
+    cpu: [arm]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/linux-ia32@0.18.17:
     resolution: {integrity: sha512-1DS9F966pn5pPnqXYz16dQqWIB0dmDfAQZd6jSSpiT9eX1NzKh07J6VKR3AoXXXEk6CqZMojiVDSZi1SlmKVdg==}
     engines: {node: '>=12'}
@@ -1987,6 +2465,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/linux-ia32@0.18.20:
+    resolution: {integrity: sha512-P4etWwq6IsReT0E1KHU40bOnzMHoH73aXp96Fs8TIT6z9Hu8G6+0SHSw9i2isWrD2nbx2qo5yUqACgdfVGx7TA==}
+    engines: {node: '>=12'}
+    cpu: [ia32]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/linux-loong64@0.18.17:
     resolution: {integrity: sha512-EvLsxCk6ZF0fpCB6w6eOI2Fc8KW5N6sHlIovNe8uOFObL2O+Mr0bflPHyHwLT6rwMg9r77WOAWb2FqCQrVnwFg==}
     engines: {node: '>=12'}
@@ -1995,6 +2482,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/linux-loong64@0.18.20:
+    resolution: {integrity: sha512-nXW8nqBTrOpDLPgPY9uV+/1DjxoQ7DoB2N8eocyq8I9XuqJ7BiAMDMf9n1xZM9TgW0J8zrquIb/A7s3BJv7rjg==}
+    engines: {node: '>=12'}
+    cpu: [loong64]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/linux-mips64el@0.18.17:
     resolution: {integrity: sha512-e0bIdHA5p6l+lwqTE36NAW5hHtw2tNRmHlGBygZC14QObsA3bD4C6sXLJjvnDIjSKhW1/0S3eDy+QmX/uZWEYQ==}
     engines: {node: '>=12'}
@@ -2003,6 +2499,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/linux-mips64el@0.18.20:
+    resolution: {integrity: sha512-d5NeaXZcHp8PzYy5VnXV3VSd2D328Zb+9dEq5HE6bw6+N86JVPExrA6O68OPwobntbNJ0pzCpUFZTo3w0GyetQ==}
+    engines: {node: '>=12'}
+    cpu: [mips64el]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/linux-ppc64@0.18.17:
     resolution: {integrity: sha512-BAAilJ0M5O2uMxHYGjFKn4nJKF6fNCdP1E0o5t5fvMYYzeIqy2JdAP88Az5LHt9qBoUa4tDaRpfWt21ep5/WqQ==}
     engines: {node: '>=12'}
@@ -2011,6 +2516,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/linux-ppc64@0.18.20:
+    resolution: {integrity: sha512-WHPyeScRNcmANnLQkq6AfyXRFr5D6N2sKgkFo2FqguP44Nw2eyDlbTdZwd9GYk98DZG9QItIiTlFLHJHjxP3FA==}
+    engines: {node: '>=12'}
+    cpu: [ppc64]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/linux-riscv64@0.18.17:
     resolution: {integrity: sha512-Wh/HW2MPnC3b8BqRSIme/9Zhab36PPH+3zam5pqGRH4pE+4xTrVLx2+XdGp6fVS3L2x+DrsIcsbMleex8fbE6g==}
     engines: {node: '>=12'}
@@ -2019,6 +2533,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/linux-riscv64@0.18.20:
+    resolution: {integrity: sha512-WSxo6h5ecI5XH34KC7w5veNnKkju3zBRLEQNY7mv5mtBmrP/MjNBCAlsM2u5hDBlS3NGcTQpoBvRzqBcRtpq1A==}
+    engines: {node: '>=12'}
+    cpu: [riscv64]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/linux-s390x@0.18.17:
     resolution: {integrity: sha512-j/34jAl3ul3PNcK3pfI0NSlBANduT2UO5kZ7FCaK33XFv3chDhICLY8wJJWIhiQ+YNdQ9dxqQctRg2bvrMlYgg==}
     engines: {node: '>=12'}
@@ -2027,6 +2550,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/linux-s390x@0.18.20:
+    resolution: {integrity: sha512-+8231GMs3mAEth6Ja1iK0a1sQ3ohfcpzpRLH8uuc5/KVDFneH6jtAJLFGafpzpMRO6DzJ6AvXKze9LfFMrIHVQ==}
+    engines: {node: '>=12'}
+    cpu: [s390x]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/linux-x64@0.18.17:
     resolution: {integrity: sha512-QM50vJ/y+8I60qEmFxMoxIx4de03pGo2HwxdBeFd4nMh364X6TIBZ6VQ5UQmPbQWUVWHWws5MmJXlHAXvJEmpQ==}
     engines: {node: '>=12'}
@@ -2035,6 +2567,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/linux-x64@0.18.20:
+    resolution: {integrity: sha512-UYqiqemphJcNsFEskc73jQ7B9jgwjWrSayxawS6UVFZGWrAAtkzjxSqnoclCXxWtfwLdzU+vTpcNYhpn43uP1w==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [linux]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/netbsd-x64@0.18.17:
     resolution: {integrity: sha512-/jGlhWR7Sj9JPZHzXyyMZ1RFMkNPjC6QIAan0sDOtIo2TYk3tZn5UDrkE0XgsTQCxWTTOcMPf9p6Rh2hXtl5TQ==}
     engines: {node: '>=12'}
@@ -2043,6 +2584,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/netbsd-x64@0.18.20:
+    resolution: {integrity: sha512-iO1c++VP6xUBUmltHZoMtCUdPlnPGdBom6IrO4gyKPFFVBKioIImVooR5I83nTew5UOYrk3gIJhbZh8X44y06A==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [netbsd]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/openbsd-x64@0.18.17:
     resolution: {integrity: sha512-rSEeYaGgyGGf4qZM2NonMhMOP/5EHp4u9ehFiBrg7stH6BYEEjlkVREuDEcQ0LfIl53OXLxNbfuIj7mr5m29TA==}
     engines: {node: '>=12'}
@@ -2051,6 +2601,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/openbsd-x64@0.18.20:
+    resolution: {integrity: sha512-e5e4YSsuQfX4cxcygw/UCPIEP6wbIL+se3sxPdCiMbFLBWu0eiZOJ7WoD+ptCLrmjZBK1Wk7I6D/I3NglUGOxg==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [openbsd]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/sunos-x64@0.18.17:
     resolution: {integrity: sha512-Y7ZBbkLqlSgn4+zot4KUNYst0bFoO68tRgI6mY2FIM+b7ZbyNVtNbDP5y8qlu4/knZZ73fgJDlXID+ohY5zt5g==}
     engines: {node: '>=12'}
@@ -2059,6 +2618,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/sunos-x64@0.18.20:
+    resolution: {integrity: sha512-kDbFRFp0YpTQVVrqUd5FTYmWo45zGaXe0X8E1G/LKFC0v8x0vWrhOWSLITcCn63lmZIxfOMXtCfti/RxN/0wnQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [sunos]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/win32-arm64@0.18.17:
     resolution: {integrity: sha512-bwPmTJsEQcbZk26oYpc4c/8PvTY3J5/QK8jM19DVlEsAB41M39aWovWoHtNm78sd6ip6prilxeHosPADXtEJFw==}
     engines: {node: '>=12'}
@@ -2067,6 +2635,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/win32-arm64@0.18.20:
+    resolution: {integrity: sha512-ddYFR6ItYgoaq4v4JmQQaAI5s7npztfV4Ag6NrhiaW0RrnOXqBkgwZLofVTlq1daVTQNhtI5oieTvkRPfZrePg==}
+    engines: {node: '>=12'}
+    cpu: [arm64]
+    os: [win32]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/win32-ia32@0.18.17:
     resolution: {integrity: sha512-H/XaPtPKli2MhW+3CQueo6Ni3Avggi6hP/YvgkEe1aSaxw+AeO8MFjq8DlgfTd9Iz4Yih3QCZI6YLMoyccnPRg==}
     engines: {node: '>=12'}
@@ -2075,6 +2652,15 @@ packages:
     requiresBuild: true
     optional: true
 
+  /@esbuild/win32-ia32@0.18.20:
+    resolution: {integrity: sha512-Wv7QBi3ID/rROT08SABTS7eV4hX26sVduqDOTe1MvGMjNd3EjOz4b7zeexIR62GTIEKrfJXKL9LFxTYgkyeu7g==}
+    engines: {node: '>=12'}
+    cpu: [ia32]
+    os: [win32]
+    requiresBuild: true
+    dev: true
+    optional: true
+
   /@esbuild/win32-x64@0.18.17:
     resolution: {integrity: sha512-fGEb8f2BSA3CW7riJVurug65ACLuQAzKq0SSqkY2b2yHHH0MzDfbLyKIGzHwOI/gkHcxM/leuSW6D5w/LMNitA==}
     engines: {node: '>=12'}
@@ -2083,27 +2669,41 @@ packages:
     requiresBuild: true
     optional: true
 
-  /@eslint-community/eslint-utils@4.4.0(eslint@8.46.0):
+  /@esbuild/win32-x64@0.18.20:
+    resolution: {integrity: sha512-kTdfRcSiDfQca/y9QIkng02avJ+NCaQvrMejlsB3RRv5sE9rRoeBPISaZpKxHELzRxZyLvNts1P27W3wV+8geQ==}
+    engines: {node: '>=12'}
+    cpu: [x64]
+    os: [win32]
+    requiresBuild: true
+    dev: true
+    optional: true
+
+  /@eslint-community/eslint-utils@4.4.0(eslint@8.50.0):
     resolution: {integrity: sha512-1/sA4dwrzBAyeUoQ6oxahHKmrZvsnLCg4RfxW3ZFGGmQkSNQPFNLV9CUEFQP1x9EYXHTo5p6xdhZM1Ne9p/AfA==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     peerDependencies:
       eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
     dependencies:
-      eslint: 8.46.0
-      eslint-visitor-keys: 3.4.2
+      eslint: 8.50.0
+      eslint-visitor-keys: 3.4.3
+
+  /@eslint-community/regexpp@4.8.1:
+    resolution: {integrity: sha512-PWiOzLIUAjN/w5K17PoF4n6sKBw0gqLHPhywmYHP4t1VFQQVYeb1yWsJwnMVEMl3tUHME7X/SJPZLmtG7XBDxQ==}
+    engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
+    dev: true
 
-  /@eslint-community/regexpp@4.6.2:
-    resolution: {integrity: sha512-pPTNuaAG3QMH+buKyBIGJs3g/S5y0caxw0ygM3YyE6yJFySwiGGSzA+mM3KJ8QQvzeLh3blwgSonkFjgQdxzMw==}
+  /@eslint-community/regexpp@4.9.0:
+    resolution: {integrity: sha512-zJmuCWj2VLBt4c25CfBIbMZLGLyhkvs7LznyVX5HfpzeocThgIj5XQK4L+g3U36mMcx8bPMhGyPpwCATamC4jQ==}
     engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
 
-  /@eslint/eslintrc@2.1.1:
-    resolution: {integrity: sha512-9t7ZA7NGGK8ckelF0PQCfcxIUzs1Md5rrO6U/c+FIQNanea5UZC0wqKXH4vHBccmu4ZJgZ2idtPeW7+Q2npOEA==}
+  /@eslint/eslintrc@2.1.2:
+    resolution: {integrity: sha512-+wvgpDsrB1YqAMdEUCcnTlpfVBH7Vqn6A/NT3D8WVXFIaKMlErPIZT3oCIAVCOtarRpMtelZLqJeU3t7WY6X6g==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     dependencies:
       ajv: 6.12.6
       debug: 4.3.4
       espree: 9.6.1
-      globals: 13.20.0
+      globals: 13.22.0
       ignore: 5.2.4
       import-fresh: 3.3.0
       js-yaml: 4.1.0
@@ -2112,8 +2712,8 @@ packages:
     transitivePeerDependencies:
       - supports-color
 
-  /@eslint/js@8.46.0:
-    resolution: {integrity: sha512-a8TLtmPi8xzPkCbp/OGFUo5yhRkHM2Ko9kOWP4znJr0WAhWyThaw3PnwX4vOTWOAMsV2uRt32PPDcEz63esSaA==}
+  /@eslint/js@8.50.0:
+    resolution: {integrity: sha512-NCC3zz2+nvYd+Ckfh87rA47zfu2QsQpvc6k1yzTk+b9KzRj0wkGa8LSoGOXN6Zv4lRf/EIoZ80biDh9HOI+RNQ==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
 
   /@fal-works/esbuild-plugin-global-externals@2.1.2:
@@ -2139,8 +2739,8 @@ packages:
       '@floating-ui/utils': 0.1.1
     dev: true
 
-  /@floating-ui/react-dom@2.0.1(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-rZtAmSht4Lry6gdhAJDrCp/6rKN7++JnL1/Anbr/DdeyYXQPxvg/ivrbYvJulbRf4vL8b212suwMM2lxbv+RQA==}
+  /@floating-ui/react-dom@2.0.2(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-5qhlDvjaLmAst/rKb3VdlCinwTF4EYMiVxuuc/HVUjs46W0zgtbMmAZ1UTsDrRTxRmUEzl92mOtWbeeXL26lSQ==}
     peerDependencies:
       react: '>=16.8.0'
       react-dom: '>=16.8.0'
@@ -2162,8 +2762,8 @@ packages:
     resolution: {integrity: sha512-pQ1ms5nbprD+7Dnu5h0T9XOSJi5pvOanLCxi6mA9/5wclXFkkzvZo31ddoD8/Urncx11967qTnvGglPeWEOT+Q==}
     dev: false
 
-  /@humanwhocodes/config-array@0.11.10:
-    resolution: {integrity: sha512-KVVjQmNUepDVGXNuoRRdmmEjruj0KfiGSbS8LVc12LMsWDQzRXJ0qdhN8L8uUigKpfEHRhlaQFY0ib1tnUbNeQ==}
+  /@humanwhocodes/config-array@0.11.11:
+    resolution: {integrity: sha512-N2brEuAadi0CcdeMXUkhbZB84eskAc8MEX1By6qEchoVywSgXPIjou4rYsl0V3Hj0ZnuGycGCjdNgockbzeWNA==}
     engines: {node: '>=10.10.0'}
     dependencies:
       '@humanwhocodes/object-schema': 1.2.1
@@ -2224,10 +2824,10 @@ packages:
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
       '@jest/types': 29.6.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       chalk: 4.1.2
       jest-message-util: 29.6.2
-      jest-util: 29.6.2
+      jest-util: 29.6.3
       slash: 3.0.0
     dev: true
 
@@ -2243,25 +2843,25 @@ packages:
       '@jest/console': 29.6.2
       '@jest/reporters': 29.6.2
       '@jest/test-result': 29.6.2
-      '@jest/transform': 29.6.2
+      '@jest/transform': 29.6.4
       '@jest/types': 29.6.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       ansi-escapes: 4.3.2
       chalk: 4.1.2
       ci-info: 3.8.0
       exit: 0.1.2
       graceful-fs: 4.2.11
       jest-changed-files: 29.5.0
-      jest-config: 29.6.2(@types/node@18.17.0)(ts-node@10.9.1)
-      jest-haste-map: 29.6.2
+      jest-config: 29.6.2(@types/node@18.18.1)(ts-node@10.9.1)
+      jest-haste-map: 29.6.4
       jest-message-util: 29.6.2
-      jest-regex-util: 29.4.3
+      jest-regex-util: 29.6.3
       jest-resolve: 29.6.2
       jest-resolve-dependencies: 29.6.2
       jest-runner: 29.6.2
       jest-runtime: 29.6.2
       jest-snapshot: 29.6.2
-      jest-util: 29.6.2
+      jest-util: 29.6.3
       jest-validate: 29.6.2
       jest-watcher: 29.6.2
       micromatch: 4.0.5
@@ -2287,7 +2887,7 @@ packages:
     dependencies:
       '@jest/fake-timers': 29.6.2
       '@jest/types': 29.6.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       jest-mock: 29.6.2
 
   /@jest/expect-utils@29.6.2:
@@ -2313,7 +2913,7 @@ packages:
     dependencies:
       '@jest/types': 29.6.1
       '@sinonjs/fake-timers': 10.3.0
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       jest-message-util: 29.6.2
       jest-mock: 29.6.2
       jest-util: 29.6.2
@@ -2342,10 +2942,10 @@ packages:
       '@bcoe/v8-coverage': 0.2.3
       '@jest/console': 29.6.2
       '@jest/test-result': 29.6.2
-      '@jest/transform': 29.6.2
+      '@jest/transform': 29.6.4
       '@jest/types': 29.6.1
-      '@jridgewell/trace-mapping': 0.3.18
-      '@types/node': 18.17.0
+      '@jridgewell/trace-mapping': 0.3.19
+      '@types/node': 18.18.1
       chalk: 4.1.2
       collect-v8-coverage: 1.0.2
       exit: 0.1.2
@@ -2357,8 +2957,8 @@ packages:
       istanbul-lib-source-maps: 4.0.1
       istanbul-reports: 3.1.6
       jest-message-util: 29.6.2
-      jest-util: 29.6.2
-      jest-worker: 29.6.2
+      jest-util: 29.6.3
+      jest-worker: 29.6.4
       slash: 3.0.0
       string-length: 4.0.2
       strip-ansi: 6.0.1
@@ -2367,15 +2967,8 @@ packages:
       - supports-color
     dev: true
 
-  /@jest/schemas@28.1.3:
-    resolution: {integrity: sha512-/l/VWsdt/aBXgjshLWOFyFt3IVdYypu5y2Wn2rOO1un6nkqIn8SLXzgIMYXFyYsRWDyF5EthmKJMIdJvk08grg==}
-    engines: {node: ^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0}
-    dependencies:
-      '@sinclair/typebox': 0.24.51
-    dev: true
-
-  /@jest/schemas@29.6.0:
-    resolution: {integrity: sha512-rxLjXyJBTL4LQeJW3aKo0M/+GkCOXsO+8i9Iu7eDb6KwtP65ayoDsitrdPBtujxQ88k4wI2FNYfa6TOGwSn6cQ==}
+  /@jest/schemas@29.6.3:
+    resolution: {integrity: sha512-mo5j5X+jIZmJQveBKeS/clAueipV7KgiX1vMgCxam1RNYiqE1w62n0/tJJnHtjW8ZHcQco5gY85jA3mi0L+nSA==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
       '@sinclair/typebox': 0.27.8
@@ -2384,7 +2977,7 @@ packages:
     resolution: {integrity: sha512-oA+I2SHHQGxDCZpbrsCQSoMLb3Bz547JnM+jUr9qEbuw0vQlWZfpPS7CO9J7XiwKicEz9OFn/IYoLkkiUD7bzA==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
-      '@jridgewell/trace-mapping': 0.3.18
+      '@jridgewell/trace-mapping': 0.3.19
       callsites: 3.1.0
       graceful-fs: 4.2.11
     dev: true
@@ -2405,25 +2998,25 @@ packages:
     dependencies:
       '@jest/test-result': 29.6.2
       graceful-fs: 4.2.11
-      jest-haste-map: 29.6.2
+      jest-haste-map: 29.6.4
       slash: 3.0.0
     dev: true
 
-  /@jest/transform@29.6.2:
-    resolution: {integrity: sha512-ZqCqEISr58Ce3U+buNFJYUktLJZOggfyvR+bZMaiV1e8B1SIvJbwZMrYz3gx/KAPn9EXmOmN+uB08yLCjWkQQg==}
+  /@jest/transform@29.6.4:
+    resolution: {integrity: sha512-8thgRSiXUqtr/pPGY/OsyHuMjGyhVnWrFAwoxmIemlBuiMyU1WFs0tXoNxzcr4A4uErs/ABre76SGmrr5ab/AA==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
-      '@babel/core': 7.22.9
-      '@jest/types': 29.6.1
-      '@jridgewell/trace-mapping': 0.3.18
+      '@babel/core': 7.22.11
+      '@jest/types': 29.6.3
+      '@jridgewell/trace-mapping': 0.3.19
       babel-plugin-istanbul: 6.1.1
       chalk: 4.1.2
       convert-source-map: 2.0.0
       fast-json-stable-stringify: 2.1.0
       graceful-fs: 4.2.11
-      jest-haste-map: 29.6.2
-      jest-regex-util: 29.4.3
-      jest-util: 29.6.2
+      jest-haste-map: 29.6.4
+      jest-regex-util: 29.6.3
+      jest-util: 29.6.3
       micromatch: 4.0.5
       pirates: 4.0.6
       slash: 3.0.0
@@ -2438,7 +3031,7 @@ packages:
     dependencies:
       '@types/istanbul-lib-coverage': 2.0.4
       '@types/istanbul-reports': 3.0.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       '@types/yargs': 16.0.5
       chalk: 4.1.2
     dev: true
@@ -2447,14 +3040,25 @@ packages:
     resolution: {integrity: sha512-tPKQNMPuXgvdOn2/Lg9HNfUvjYVGolt04Hp03f5hAk878uwOLikN+JzeLY0HcVgKgFl9Hs3EIqpu3WX27XNhnw==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
-      '@jest/schemas': 29.6.0
+      '@jest/schemas': 29.6.3
+      '@types/istanbul-lib-coverage': 2.0.4
+      '@types/istanbul-reports': 3.0.1
+      '@types/node': 18.18.1
+      '@types/yargs': 17.0.24
+      chalk: 4.1.2
+
+  /@jest/types@29.6.3:
+    resolution: {integrity: sha512-u3UPsIilWKOM3F9CXtrG8LEJmNxwoCQC/XVj4IKYXvvpx7QIi/Kg1LI5uDmDpKlac62NUtX7eLjRh+jVZcLOzw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    dependencies:
+      '@jest/schemas': 29.6.3
       '@types/istanbul-lib-coverage': 2.0.4
       '@types/istanbul-reports': 3.0.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       '@types/yargs': 17.0.24
       chalk: 4.1.2
 
-  /@joshwooding/vite-plugin-react-docgen-typescript@0.2.1(typescript@5.1.6)(vite@4.4.2):
+  /@joshwooding/vite-plugin-react-docgen-typescript@0.2.1(typescript@5.2.2)(vite@4.4.2):
     resolution: {integrity: sha512-ou4ZJSXMMWHqGS4g8uNRbC5TiTWxAgQZiVucoUrOCWuPrTbkpJbmVyIi9jU72SBry7gQtuMEDp4YR8EEXAg7VQ==}
     peerDependencies:
       typescript: '>= 4.3.x'
@@ -2466,9 +3070,9 @@ packages:
       glob: 7.2.3
       glob-promise: 4.2.2(glob@7.2.3)
       magic-string: 0.27.0
-      react-docgen-typescript: 2.2.2(typescript@5.1.6)
-      typescript: 5.1.6
-      vite: 4.4.2(@types/node@18.17.0)
+      react-docgen-typescript: 2.2.2(typescript@5.2.2)
+      typescript: 5.2.2
+      vite: 4.4.2(@types/node@18.18.1)
     dev: true
 
   /@jridgewell/gen-mapping@0.3.3:
@@ -2477,32 +3081,29 @@ packages:
     dependencies:
       '@jridgewell/set-array': 1.1.2
       '@jridgewell/sourcemap-codec': 1.4.15
-      '@jridgewell/trace-mapping': 0.3.18
+      '@jridgewell/trace-mapping': 0.3.19
 
-  /@jridgewell/resolve-uri@3.1.0:
-    resolution: {integrity: sha512-F2msla3tad+Mfht5cJq7LSXcdudKTWCVYUgw6pLFOOHSTtZlj6SWNYAp+AhuqLmWdBO2X5hPrLcu8cVP8fy28w==}
+  /@jridgewell/resolve-uri@3.1.1:
+    resolution: {integrity: sha512-dSYZh7HhCDtCKm4QakX0xFpsRDqjjtZf/kjI/v3T3Nwt5r8/qz/M19F9ySyOqU94SXBmeG9ttTul+YnR4LOxFA==}
     engines: {node: '>=6.0.0'}
 
   /@jridgewell/set-array@1.1.2:
     resolution: {integrity: sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==}
     engines: {node: '>=6.0.0'}
 
-  /@jridgewell/sourcemap-codec@1.4.14:
-    resolution: {integrity: sha512-XPSJHWmi394fuUuzDnGz1wiKqWfo1yXecHQMRf2l6hztTO+nPru658AyDngaBe7isIxEkRsPR3FZh+s7iVa4Uw==}
-
   /@jridgewell/sourcemap-codec@1.4.15:
     resolution: {integrity: sha512-eF2rxCRulEKXHTRiDrDy6erMYWqNw4LPdQ8UQA4huuxaQsVeRPFl2oM8oDGxMFhJUWZf9McpLtJasDDZb/Bpeg==}
 
-  /@jridgewell/trace-mapping@0.3.18:
-    resolution: {integrity: sha512-w+niJYzMHdd7USdiH2U6869nqhD2nbfZXND5Yp93qIbEmnDNk7PD48o+YchRVpzMU7M6jVCbenTR7PA1FLQ9pA==}
+  /@jridgewell/trace-mapping@0.3.19:
+    resolution: {integrity: sha512-kf37QtfW+Hwx/buWGMPcR60iF9ziHa6r/CZJIHbmcm4+0qrXiVdxegAH0F6yddEVQ7zdkjcGCgCzUu+BcbhQxw==}
     dependencies:
-      '@jridgewell/resolve-uri': 3.1.0
-      '@jridgewell/sourcemap-codec': 1.4.14
+      '@jridgewell/resolve-uri': 3.1.1
+      '@jridgewell/sourcemap-codec': 1.4.15
 
   /@jridgewell/trace-mapping@0.3.9:
     resolution: {integrity: sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==}
     dependencies:
-      '@jridgewell/resolve-uri': 3.1.0
+      '@jridgewell/resolve-uri': 3.1.1
       '@jridgewell/sourcemap-codec': 1.4.15
     dev: true
 
@@ -2510,6 +3111,14 @@ packages:
     resolution: {integrity: sha512-dfLbk+PwWvFzSxwk3n5ySL0hfBog779o8h68wK/7/APo/7cgyWp5jcXockbxdk5kFRkbeXWm4Fbi9FrdN381sA==}
     dev: true
 
+  /@kurkle/color@0.3.2:
+    resolution: {integrity: sha512-fuscdXJ9G1qb7W8VdHi+IwRqij3lBkosAm4ydQtEmbY58OzHXqQhvlxqEkoz0yssNVn38bcpRWgA9PP+OGoisw==}
+    dev: false
+
+  /@leeoniya/ufuzzy@1.0.10:
+    resolution: {integrity: sha512-OR1yiyN8cKBn5UiHjKHUl0LcrTQt4vZPUpIf96qIIZVLxgd4xyASuRvTZ3tjbWvuyQAMgvKsq61Nwu131YyHnA==}
+    dev: false
+
   /@mapbox/node-pre-gyp@1.0.11:
     resolution: {integrity: sha512-Yhlar6v9WQgUp/He7BdgzOz8lqMQ8sU+jkCq7Wx8Myc5YFJLbEe7lgui/V7G1qB1DJykHSGwreceSaD60Y0PUQ==}
     hasBin: true
@@ -2517,7 +3126,7 @@ packages:
       detect-libc: 2.0.2
       https-proxy-agent: 5.0.1
       make-dir: 3.1.0
-      node-fetch: 2.6.12
+      node-fetch: 2.7.0
       nopt: 5.0.0
       npmlog: 5.0.1
       rimraf: 3.0.2
@@ -2528,8 +3137,8 @@ packages:
       - supports-color
     dev: false
 
-  /@mdn/browser-compat-data@5.3.6:
-    resolution: {integrity: sha512-sDz0Yjj8m+VTWPiC0TF28rLMCDS2fJTZZmDpFMx5Y0H4NVGzqOs30l4pV8Tpexen4GyT+wYCNjedY8pTNjiW7Q==}
+  /@mdn/browser-compat-data@5.3.14:
+    resolution: {integrity: sha512-Y9XQrphVcE6u9xMm+gIqN86opbU/5s2W1pdPyKRyFV5B7+2jWM2gLI5JpfhZncaoDKvhy6FYwK04aCz5UM/bTQ==}
     dev: true
 
   /@mdx-js/react@2.3.0(react@18.2.0):
@@ -2537,29 +3146,29 @@ packages:
     peerDependencies:
       react: '>=16'
     dependencies:
-      '@types/mdx': 2.0.5
+      '@types/mdx': 2.0.7
       '@types/react': 18.2.6
       react: 18.2.0
     dev: true
 
-  /@monaco-editor/loader@1.3.3(monaco-editor@0.40.0):
+  /@monaco-editor/loader@1.3.3(monaco-editor@0.43.0):
     resolution: {integrity: sha512-6KKF4CTzcJiS8BJwtxtfyYt9shBiEv32ateQ9T4UVogwn4HM/uPo9iJd2Dmbkpz8CM6Y0PDUpjnZzCwC+eYo2Q==}
     peerDependencies:
       monaco-editor: '>= 0.21.0 < 1'
     dependencies:
-      monaco-editor: 0.40.0
+      monaco-editor: 0.43.0
       state-local: 1.0.7
     dev: false
 
-  /@monaco-editor/react@4.5.0(monaco-editor@0.40.0)(react-dom@18.2.0)(react@18.2.0):
+  /@monaco-editor/react@4.5.0(monaco-editor@0.43.0)(react-dom@18.2.0)(react@18.2.0):
     resolution: {integrity: sha512-VJMkp5Fe1+w8pLEq8tZPHZKu8zDXQIA1FtiDTSNccg1D3wg1YIZaH2es2Qpvop1k62g3c/YySRb3bnGXu2XwYQ==}
     peerDependencies:
       monaco-editor: '>= 0.25.0 < 1'
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
     dependencies:
-      '@monaco-editor/loader': 1.3.3(monaco-editor@0.40.0)
-      monaco-editor: 0.40.0
+      '@monaco-editor/loader': 1.3.3(monaco-editor@0.43.0)
+      monaco-editor: 0.43.0
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
     dev: false
@@ -2580,7 +3189,7 @@ packages:
       '@types/debug': 4.1.8
       '@xmldom/xmldom': 0.8.10
       debug: 4.3.4
-      headers-polyfill: 3.1.2
+      headers-polyfill: 3.2.3
       outvariant: 1.4.0
       strict-event-emitter: 0.2.8
       web-encoding: 1.1.5
@@ -2599,10 +3208,10 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@emotion/is-prop-valid': 1.2.1
       '@mui/types': 7.2.4(@types/react@18.2.6)
-      '@mui/utils': 5.14.3(react@18.2.0)
+      '@mui/utils': 5.14.11(@types/react@18.2.6)(react@18.2.0)
       '@popperjs/core': 2.11.8
       '@types/react': 18.2.6
       clsx: 1.2.1
@@ -2623,10 +3232,10 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@emotion/is-prop-valid': 1.2.1
       '@mui/types': 7.2.4(@types/react@18.2.6)
-      '@mui/utils': 5.14.3(react@18.2.0)
+      '@mui/utils': 5.14.11(@types/react@18.2.6)(react@18.2.0)
       '@popperjs/core': 2.11.8
       '@types/react': 18.2.6
       clsx: 1.2.1
@@ -2682,7 +3291,7 @@ packages:
       '@mui/material': 5.14.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
       '@mui/system': 5.14.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react@18.2.0)
       '@mui/types': 7.2.4(@types/react@18.2.6)
-      '@mui/utils': 5.14.1(react@18.2.0)
+      '@mui/utils': 5.14.11(@types/react@18.2.6)(react@18.2.0)
       '@types/react': 18.2.6
       clsx: 1.2.1
       prop-types: 15.8.1
@@ -2715,7 +3324,7 @@ packages:
       '@mui/core-downloads-tracker': 5.14.2
       '@mui/system': 5.14.0(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(@types/react@18.2.6)(react@18.2.0)
       '@mui/types': 7.2.4(@types/react@18.2.6)
-      '@mui/utils': 5.14.1(react@18.2.0)
+      '@mui/utils': 5.14.11(@types/react@18.2.6)(react@18.2.0)
       '@types/react': 18.2.6
       '@types/react-transition-group': 4.4.6
       clsx: 1.2.1
@@ -2737,8 +3346,8 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
-      '@mui/utils': 5.14.3(react@18.2.0)
+      '@babel/runtime': 7.23.1
+      '@mui/utils': 5.14.11(@types/react@18.2.6)(react@18.2.0)
       '@types/react': 18.2.6
       prop-types: 15.8.1
       react: 18.2.0
@@ -2757,7 +3366,7 @@ packages:
       '@emotion/styled':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@emotion/cache': 11.11.0
       '@emotion/react': 11.11.1(@types/react@18.2.6)(react@18.2.0)
       '@emotion/styled': 11.11.0(@emotion/react@11.11.1)(@types/react@18.2.6)(react@18.2.0)
@@ -2780,7 +3389,7 @@ packages:
       '@emotion/hash': 0.9.1
       '@mui/private-theming': 5.13.7(@types/react@18.2.6)(react@18.2.0)
       '@mui/types': 7.2.4(@types/react@18.2.6)
-      '@mui/utils': 5.14.1(react@18.2.0)
+      '@mui/utils': 5.14.11(@types/react@18.2.6)(react@18.2.0)
       '@types/react': 18.2.6
       clsx: 1.2.1
       csstype: 3.1.2
@@ -2819,7 +3428,7 @@ packages:
       '@mui/private-theming': 5.13.7(@types/react@18.2.6)(react@18.2.0)
       '@mui/styled-engine': 5.13.2(@emotion/react@11.11.1)(@emotion/styled@11.11.0)(react@18.2.0)
       '@mui/types': 7.2.4(@types/react@18.2.6)
-      '@mui/utils': 5.14.3(react@18.2.0)
+      '@mui/utils': 5.14.11(@types/react@18.2.6)(react@18.2.0)
       '@types/react': 18.2.6
       clsx: 1.2.1
       csstype: 3.1.2
@@ -2838,29 +3447,19 @@ packages:
       '@types/react': 18.2.6
     dev: false
 
-  /@mui/utils@5.14.1(react@18.2.0):
-    resolution: {integrity: sha512-39KHKK2JeqRmuUcLDLwM+c2XfVC136C5/yUyQXmO2PVbOb2Bol4KxtkssEqCbTwg87PSCG3f1Tb0keRsK7cVGw==}
-    engines: {node: '>=12.0.0'}
-    peerDependencies:
-      react: ^17.0.0 || ^18.0.0
-    dependencies:
-      '@babel/runtime': 7.22.6
-      '@types/prop-types': 15.7.5
-      '@types/react-is': 18.2.1
-      prop-types: 15.8.1
-      react: 18.2.0
-      react-is: 18.2.0
-    dev: false
-
-  /@mui/utils@5.14.3(react@18.2.0):
-    resolution: {integrity: sha512-gZ6Etw+ppO43GYc1HFZSLjwd4DoZoa+RrYTD25wQLfzcSoPjVoC/zZqA2Lkq0zjgwGBQOSxKZI6jfp9uXR+kgw==}
+  /@mui/utils@5.14.11(@types/react@18.2.6)(react@18.2.0):
+    resolution: {integrity: sha512-fmkIiCPKyDssYrJ5qk+dime1nlO3dmWfCtaPY/uVBqCRMBZ11JhddB9m8sjI2mgqQQwRJG5bq3biaosNdU/s4Q==}
     engines: {node: '>=12.0.0'}
     peerDependencies:
+      '@types/react': ^17.0.0 || ^18.0.0
       react: ^17.0.0 || ^18.0.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@types/prop-types': 15.7.5
-      '@types/react-is': 18.2.1
+      '@types/react': 18.2.6
       prop-types: 15.8.1
       react: 18.2.0
       react-is: 18.2.0
@@ -2892,14 +3491,14 @@ packages:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.15.0
 
-  /@octokit/openapi-types@18.0.0:
-    resolution: {integrity: sha512-V8GImKs3TeQRxRtXFpG2wl19V7444NIOTDF24AWuIbmNaNYOQMWRbjcGDXV5B+0n887fgDcuMNOmlul+k+oJtw==}
+  /@octokit/openapi-types@19.0.0:
+    resolution: {integrity: sha512-PclQ6JGMTE9iUStpzMkwLCISFn/wDeRjkZFIKALpvJQNBGwDoYYi2fFvuHwssoQ1rXI5mfh6jgTgWuddeUzfWw==}
     dev: true
 
-  /@octokit/types@11.1.0:
-    resolution: {integrity: sha512-Fz0+7GyLm/bHt8fwEqgvRBWwIV1S6wRRyq+V6exRKLVWaKGsuy6H9QFYeBVDV7rK6fO3XwHgQOPxv+cLj2zpXQ==}
+  /@octokit/types@12.0.0:
+    resolution: {integrity: sha512-EzD434aHTFifGudYAygnFlS1Tl6KhbTynEWELQXIbTY8Msvb5nEqTZIm7sbPEt4mQYLZwu3zPKVdeIrw0g7ovg==}
     dependencies:
-      '@octokit/openapi-types': 18.0.0
+      '@octokit/openapi-types': 19.0.0
     dev: true
 
   /@open-draft/until@1.0.3:
@@ -2908,32 +3507,17 @@ packages:
 
   /@pkgjs/parseargs@0.11.0:
     resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==}
-    engines: {node: '>=14'}
-    requiresBuild: true
-    dev: true
-    optional: true
-
-  /@pkgr/utils@2.4.2:
-    resolution: {integrity: sha512-POgTXhjrTfbTV63DiFXav4lBHiICLKKwDeaKn9Nphwj7WH6m0hMMCaJkMyRWjgtPFyRKRVoMXXjczsTQRDEhYw==}
-    engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
-    dependencies:
-      cross-spawn: 7.0.3
-      fast-glob: 3.3.1
-      is-glob: 4.0.3
-      open: 9.1.0
-      picocolors: 1.0.0
-      tslib: 2.6.1
+    engines: {node: '>=14'}
+    requiresBuild: true
     dev: true
+    optional: true
 
-  /@playwright/test@1.36.0:
-    resolution: {integrity: sha512-yN+fvMYtiyLFDCQos+lWzoX4XW3DNuaxjBu68G0lkgLgC6BP+m/iTxJQoSicz/x2G5EsrqlZTqTIP9sTgLQerg==}
+  /@playwright/test@1.38.0:
+    resolution: {integrity: sha512-xis/RXXsLxwThKnlIXouxmIvvT3zvQj1JE39GsNieMUrMpb3/GySHDh2j8itCG22qKVD4MYLBp7xB73cUW/UUw==}
     engines: {node: '>=16'}
     hasBin: true
     dependencies:
-      '@types/node': 20.4.5
-      playwright-core: 1.36.0
-    optionalDependencies:
-      fsevents: 2.3.2
+      playwright: 1.38.0
     dev: true
 
   /@popperjs/core@2.11.8:
@@ -2942,57 +3526,47 @@ packages:
 
   /@protobufjs/aspromise@1.1.2:
     resolution: {integrity: sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==}
-    dev: true
 
   /@protobufjs/base64@1.1.2:
     resolution: {integrity: sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==}
-    dev: true
 
   /@protobufjs/codegen@2.0.4:
     resolution: {integrity: sha512-YyFaikqM5sH0ziFZCN3xDC7zeGaB/d0IUb9CATugHWbd1FRFwWwt4ld4OYMPWu5a3Xe01mGAULCdqhMlPl29Jg==}
-    dev: true
 
   /@protobufjs/eventemitter@1.1.0:
     resolution: {integrity: sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q==}
-    dev: true
 
   /@protobufjs/fetch@1.1.0:
     resolution: {integrity: sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==}
     dependencies:
       '@protobufjs/aspromise': 1.1.2
       '@protobufjs/inquire': 1.1.0
-    dev: true
 
   /@protobufjs/float@1.0.2:
     resolution: {integrity: sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==}
-    dev: true
 
   /@protobufjs/inquire@1.1.0:
     resolution: {integrity: sha512-kdSefcPdruJiFMVSbn801t4vFK7KB/5gd2fYvrxhuJYg8ILrmn9SKSX2tZdV6V+ksulWqS7aXjBcRXl3wHoD9Q==}
-    dev: true
 
   /@protobufjs/path@1.1.2:
     resolution: {integrity: sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==}
-    dev: true
 
   /@protobufjs/pool@1.1.0:
     resolution: {integrity: sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==}
-    dev: true
 
   /@protobufjs/utf8@1.1.0:
     resolution: {integrity: sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw==}
-    dev: true
 
   /@radix-ui/number@1.0.1:
     resolution: {integrity: sha512-T5gIdVO2mmPW3NNhjNgEP3cqMXjXL9UbO0BzWcXfvdBs+BohbQxvd/K5hSVKmn9/lbTdsQVKbUcP5WLCwvUbBg==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
     dev: true
 
   /@radix-ui/primitive@1.0.1:
     resolution: {integrity: sha512-yQ8oGX2GVsEYMWGxcovu1uGWPCxV5BFfeeYxqPmuAzUyLT9qmaMXSAhXpb0WrspIeqYzdJpkh2vHModJPgRIaw==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
     dev: true
 
   /@radix-ui/react-arrow@1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
@@ -3008,7 +3582,7 @@ packages:
       '@types/react-dom':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/react-primitive': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
       '@types/react': 18.2.6
       '@types/react-dom': 18.2.4
@@ -3029,7 +3603,7 @@ packages:
       '@types/react-dom':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/react-compose-refs': 1.0.1(@types/react@18.2.6)(react@18.2.0)
       '@radix-ui/react-context': 1.0.1(@types/react@18.2.6)(react@18.2.0)
       '@radix-ui/react-primitive': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
@@ -3049,7 +3623,7 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@types/react': 18.2.6
       react: 18.2.0
     dev: true
@@ -3063,7 +3637,7 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@types/react': 18.2.6
       react: 18.2.0
     dev: true
@@ -3077,7 +3651,7 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@types/react': 18.2.6
       react: 18.2.0
     dev: true
@@ -3095,7 +3669,7 @@ packages:
       '@types/react-dom':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/primitive': 1.0.1
       '@radix-ui/react-compose-refs': 1.0.1(@types/react@18.2.6)(react@18.2.0)
       '@radix-ui/react-primitive': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
@@ -3116,7 +3690,7 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@types/react': 18.2.6
       react: 18.2.0
     dev: true
@@ -3134,7 +3708,7 @@ packages:
       '@types/react-dom':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/react-compose-refs': 1.0.1(@types/react@18.2.6)(react@18.2.0)
       '@radix-ui/react-primitive': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
       '@radix-ui/react-use-callback-ref': 1.0.1(@types/react@18.2.6)(react@18.2.0)
@@ -3153,7 +3727,7 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/react-use-layout-effect': 1.0.1(@types/react@18.2.6)(react@18.2.0)
       '@types/react': 18.2.6
       react: 18.2.0
@@ -3172,8 +3746,8 @@ packages:
       '@types/react-dom':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
-      '@floating-ui/react-dom': 2.0.1(react-dom@18.2.0)(react@18.2.0)
+      '@babel/runtime': 7.23.1
+      '@floating-ui/react-dom': 2.0.2(react-dom@18.2.0)(react@18.2.0)
       '@radix-ui/react-arrow': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
       '@radix-ui/react-compose-refs': 1.0.1(@types/react@18.2.6)(react@18.2.0)
       '@radix-ui/react-context': 1.0.1(@types/react@18.2.6)(react@18.2.0)
@@ -3202,7 +3776,7 @@ packages:
       '@types/react-dom':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/react-primitive': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
       '@types/react': 18.2.6
       '@types/react-dom': 18.2.4
@@ -3223,7 +3797,7 @@ packages:
       '@types/react-dom':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/react-slot': 1.0.2(@types/react@18.2.6)(react@18.2.0)
       '@types/react': 18.2.6
       '@types/react-dom': 18.2.4
@@ -3231,6 +3805,35 @@ packages:
       react-dom: 18.2.0(react@18.2.0)
     dev: true
 
+  /@radix-ui/react-roving-focus@1.0.4(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-2mUg5Mgcu001VkGy+FfzZyzbmuUWzgWkj3rvv4yu+mLw03+mTzbxZHvfcGyFp2b8EkQeMkpRQ5FiA2Vr2O6TeQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0
+      react-dom: ^16.8 || ^17.0 || ^18.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.23.1
+      '@radix-ui/primitive': 1.0.1
+      '@radix-ui/react-collection': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@radix-ui/react-compose-refs': 1.0.1(@types/react@18.2.6)(react@18.2.0)
+      '@radix-ui/react-context': 1.0.1(@types/react@18.2.6)(react@18.2.0)
+      '@radix-ui/react-direction': 1.0.1(@types/react@18.2.6)(react@18.2.0)
+      '@radix-ui/react-id': 1.0.1(@types/react@18.2.6)(react@18.2.0)
+      '@radix-ui/react-primitive': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@radix-ui/react-use-callback-ref': 1.0.1(@types/react@18.2.6)(react@18.2.0)
+      '@radix-ui/react-use-controllable-state': 1.0.1(@types/react@18.2.6)(react@18.2.0)
+      '@types/react': 18.2.6
+      '@types/react-dom': 18.2.4
+      react: 18.2.0
+      react-dom: 18.2.0(react@18.2.0)
+    dev: true
+
   /@radix-ui/react-select@1.2.2(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
     resolution: {integrity: sha512-zI7McXr8fNaSrUY9mZe4x/HC0jTLY9fWNhO1oLWYMQGDXuV4UCivIGTxwioSzO0ZCYX9iSLyWmAh/1TOmX3Cnw==}
     peerDependencies:
@@ -3244,7 +3847,7 @@ packages:
       '@types/react-dom':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/number': 1.0.1
       '@radix-ui/primitive': 1.0.1
       '@radix-ui/react-collection': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
@@ -3272,6 +3875,27 @@ packages:
       react-remove-scroll: 2.5.5(@types/react@18.2.6)(react@18.2.0)
     dev: true
 
+  /@radix-ui/react-separator@1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-itYmTy/kokS21aiV5+Z56MZB54KrhPgn6eHDKkFeOLR34HMN2s8PaN47qZZAGnvupcjxHaFZnW4pQEh0BvvVuw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0
+      react-dom: ^16.8 || ^17.0 || ^18.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.23.1
+      '@radix-ui/react-primitive': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@types/react': 18.2.6
+      '@types/react-dom': 18.2.4
+      react: 18.2.0
+      react-dom: 18.2.0(react@18.2.0)
+    dev: true
+
   /@radix-ui/react-slot@1.0.2(@types/react@18.2.6)(react@18.2.0):
     resolution: {integrity: sha512-YeTpuq4deV+6DusvVUW4ivBgnkHwECUu0BiN43L5UCDFgdhsRUWAghhTF5MbvNTPzmiFOx90asDSUjWuCNapwg==}
     peerDependencies:
@@ -3281,12 +3905,89 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/react-compose-refs': 1.0.1(@types/react@18.2.6)(react@18.2.0)
       '@types/react': 18.2.6
       react: 18.2.0
     dev: true
 
+  /@radix-ui/react-toggle-group@1.0.4(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-Uaj/M/cMyiyT9Bx6fOZO0SAG4Cls0GptBWiBmBxofmDbNVnYYoyRWj/2M/6VCi/7qcXFWnHhRUfdfZFvvkuu8A==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0
+      react-dom: ^16.8 || ^17.0 || ^18.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.23.1
+      '@radix-ui/primitive': 1.0.1
+      '@radix-ui/react-context': 1.0.1(@types/react@18.2.6)(react@18.2.0)
+      '@radix-ui/react-direction': 1.0.1(@types/react@18.2.6)(react@18.2.0)
+      '@radix-ui/react-primitive': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@radix-ui/react-roving-focus': 1.0.4(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@radix-ui/react-toggle': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@radix-ui/react-use-controllable-state': 1.0.1(@types/react@18.2.6)(react@18.2.0)
+      '@types/react': 18.2.6
+      '@types/react-dom': 18.2.4
+      react: 18.2.0
+      react-dom: 18.2.0(react@18.2.0)
+    dev: true
+
+  /@radix-ui/react-toggle@1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-Pkqg3+Bc98ftZGsl60CLANXQBBQ4W3mTFS9EJvNxKMZ7magklKV69/id1mlAlOFDDfHvlCms0fx8fA4CMKDJHg==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0
+      react-dom: ^16.8 || ^17.0 || ^18.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.23.1
+      '@radix-ui/primitive': 1.0.1
+      '@radix-ui/react-primitive': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@radix-ui/react-use-controllable-state': 1.0.1(@types/react@18.2.6)(react@18.2.0)
+      '@types/react': 18.2.6
+      '@types/react-dom': 18.2.4
+      react: 18.2.0
+      react-dom: 18.2.0(react@18.2.0)
+    dev: true
+
+  /@radix-ui/react-toolbar@1.0.4(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-tBgmM/O7a07xbaEkYJWYTXkIdU/1pW4/KZORR43toC/4XWyBCURK0ei9kMUdp+gTPPKBgYLxXmRSH1EVcIDp8Q==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^16.8 || ^17.0 || ^18.0
+      react-dom: ^16.8 || ^17.0 || ^18.0
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+    dependencies:
+      '@babel/runtime': 7.23.1
+      '@radix-ui/primitive': 1.0.1
+      '@radix-ui/react-context': 1.0.1(@types/react@18.2.6)(react@18.2.0)
+      '@radix-ui/react-direction': 1.0.1(@types/react@18.2.6)(react@18.2.0)
+      '@radix-ui/react-primitive': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@radix-ui/react-roving-focus': 1.0.4(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@radix-ui/react-separator': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@radix-ui/react-toggle-group': 1.0.4(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@types/react': 18.2.6
+      '@types/react-dom': 18.2.4
+      react: 18.2.0
+      react-dom: 18.2.0(react@18.2.0)
+    dev: true
+
   /@radix-ui/react-use-callback-ref@1.0.1(@types/react@18.2.6)(react@18.2.0):
     resolution: {integrity: sha512-D94LjX4Sp0xJFVaoQOd3OO9k7tpBYNOXdVhkltUbGv2Qb9OXdrg/CpsjlZv7ia14Sylv398LswWBVVu5nqKzAQ==}
     peerDependencies:
@@ -3296,7 +3997,7 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@types/react': 18.2.6
       react: 18.2.0
     dev: true
@@ -3310,7 +4011,7 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/react-use-callback-ref': 1.0.1(@types/react@18.2.6)(react@18.2.0)
       '@types/react': 18.2.6
       react: 18.2.0
@@ -3325,7 +4026,7 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/react-use-callback-ref': 1.0.1(@types/react@18.2.6)(react@18.2.0)
       '@types/react': 18.2.6
       react: 18.2.0
@@ -3340,7 +4041,7 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@types/react': 18.2.6
       react: 18.2.0
     dev: true
@@ -3354,7 +4055,7 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@types/react': 18.2.6
       react: 18.2.0
     dev: true
@@ -3368,7 +4069,7 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/rect': 1.0.1
       '@types/react': 18.2.6
       react: 18.2.0
@@ -3383,7 +4084,7 @@ packages:
       '@types/react':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/react-use-layout-effect': 1.0.1(@types/react@18.2.6)(react@18.2.0)
       '@types/react': 18.2.6
       react: 18.2.0
@@ -3402,7 +4103,7 @@ packages:
       '@types/react-dom':
         optional: true
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       '@radix-ui/react-primitive': 1.0.3(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
       '@types/react': 18.2.6
       '@types/react-dom': 18.2.4
@@ -3413,20 +4114,15 @@ packages:
   /@radix-ui/rect@1.0.1:
     resolution: {integrity: sha512-fyrgCaedtvMg9NK3en0pnOYJdtfwxUcNolezkNPUsoX57X8oQk+NkqcvzHXD2uKNij6GXmWU9NDru2IWjrO4BQ==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
     dev: true
 
-  /@remix-run/router@1.7.1:
-    resolution: {integrity: sha512-bgVQM4ZJ2u2CM8k1ey70o1ePFXsEzYVZoWghh6WjM8p59jQ7HxzbHW4SbnWFG7V9ig9chLawQxDTZ3xzOF8MkQ==}
-    engines: {node: '>=14'}
-
-  /@remix-run/router@1.7.2:
-    resolution: {integrity: sha512-7Lcn7IqGMV+vizMPoEl5F0XDshcdDYtMI6uJLQdQz5CfZAwy3vvGKYSUk789qndt5dEC4HfSjviSYlSoHGL2+A==}
-    engines: {node: '>=14'}
-    dev: true
+  /@remix-run/router@1.9.0:
+    resolution: {integrity: sha512-bV63itrKBC0zdT27qYm6SDZHlkXwFL1xMBuhkn+X7l0+IIhNaH5wuuvZKp6eKhCD4KFhujhfhCT1YxXW6esUIA==}
+    engines: {node: '>=14.0.0'}
 
-  /@rollup/pluginutils@5.0.2:
-    resolution: {integrity: sha512-pTd9rIsP92h+B6wWwFbW8RkZv4hiR/xKsqre4SIuAOaOEQRxi0lqLke9k2/7WegC85GgUs9pjmOjCUi3In4vwA==}
+  /@rollup/pluginutils@5.0.4:
+    resolution: {integrity: sha512-0KJnIoRI8A+a1dqOYLxH8vBf8bphDmty5QvIm2hqm7oFCFYKCAZWWd2hXgMibaPsNDhI0AtpYfQZJG47pt/k4g==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
       rollup: ^1.20.0||^2.0.0||^3.0.0
@@ -3439,10 +4135,6 @@ packages:
       picomatch: 2.3.1
     dev: true
 
-  /@sinclair/typebox@0.24.51:
-    resolution: {integrity: sha512-1P1OROm/rdubP5aFDSZQILU0vrLCJ4fvHt6EoqHEM+2D/G5MK3bIaymUKLit8Js9gbns5UyJnkP/TZROLw4tUA==}
-    dev: true
-
   /@sinclair/typebox@0.27.8:
     resolution: {integrity: sha512-+Fj43pSMwJs4KRrH/938Uf+uAELIgVBmQzg/q1YG10djyfA3TnrU8N8XzqCh/okZdszqBQTZf96idMfE5lnwTA==}
 
@@ -3456,8 +4148,8 @@ packages:
     dependencies:
       '@sinonjs/commons': 3.0.0
 
-  /@storybook/addon-actions@7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-N591y7SARPzV3W41mtdutxg1shLA3vCBDC9yxWyMW6wpUn8vAkuTp1HZDlMa7bYwxzco4/qmJs+ddE/7pQTT6w==}
+  /@storybook/addon-actions@7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-0lHLLUlrGE7CBFrfmAXrBKu7fUIsiQlnNekuE3cIAjSgVR481bJEzYHUUoMATqpPC4GGErBdP1CZxVDDwWV8jA==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
@@ -3467,14 +4159,14 @@ packages:
       react-dom:
         optional: true
     dependencies:
-      '@storybook/client-logger': 7.2.0
-      '@storybook/components': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/core-events': 7.2.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/components': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/core-events': 7.4.0
       '@storybook/global': 5.0.0
-      '@storybook/manager-api': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/preview-api': 7.2.0
-      '@storybook/theming': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/types': 7.2.0
+      '@storybook/manager-api': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/preview-api': 7.4.0
+      '@storybook/theming': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/types': 7.4.0
       dequal: 2.0.3
       lodash: 4.17.21
       polished: 4.2.2
@@ -3482,7 +4174,7 @@ packages:
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
       react-inspector: 6.0.2(react@18.2.0)
-      telejson: 7.1.0
+      telejson: 7.2.0
       ts-dedent: 2.2.0
       uuid: 9.0.0
     transitivePeerDependencies:
@@ -3490,8 +4182,8 @@ packages:
       - '@types/react-dom'
     dev: true
 
-  /@storybook/addon-backgrounds@7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-w7XbnOB55p/IyrOyF1NyRpm3tOWYGFgudVkOab+SyTKzeI7A1ovQUrDjy/7O4+Ehg6PxBBUWv9le/UqSnExmmA==}
+  /@storybook/addon-backgrounds@7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-cEO/Tp/eRE+5bf1FGN4wKLqLDBv3EYp9enJyXV7B3cFdciqtoE7VJPZuFZkzjJN1rRcOKSZp8g5agsx+x9uNGQ==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
@@ -3501,14 +4193,14 @@ packages:
       react-dom:
         optional: true
     dependencies:
-      '@storybook/client-logger': 7.2.0
-      '@storybook/components': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/core-events': 7.2.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/components': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/core-events': 7.4.0
       '@storybook/global': 5.0.0
-      '@storybook/manager-api': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/preview-api': 7.2.0
-      '@storybook/theming': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/types': 7.2.0
+      '@storybook/manager-api': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/preview-api': 7.4.0
+      '@storybook/theming': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/types': 7.4.0
       memoizerific: 1.11.3
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
@@ -3518,8 +4210,8 @@ packages:
       - '@types/react-dom'
     dev: true
 
-  /@storybook/addon-controls@7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-el9LCoIR4EH5T6yfNLbpDKtoE031A+mRwoySVqiHYdHoMZyorBnBwkkmC2oNgOEvAFER9S8CLBfiJu+1FKIg6w==}
+  /@storybook/addon-controls@7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-tYDfqpTR+c9y4kElmr3aWNHPot6kYd+nruYb697LpkCdy4lFErqSo0mhvPyZfMZp2KEajfp6YJAurhQWbvbj/A==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
@@ -3529,15 +4221,16 @@ packages:
       react-dom:
         optional: true
     dependencies:
-      '@storybook/blocks': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/client-logger': 7.2.0
-      '@storybook/components': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/core-common': 7.2.0
-      '@storybook/manager-api': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/node-logger': 7.2.0
-      '@storybook/preview-api': 7.2.0
-      '@storybook/theming': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/types': 7.2.0
+      '@storybook/blocks': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/client-logger': 7.4.0
+      '@storybook/components': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/core-common': 7.4.0
+      '@storybook/core-events': 7.4.0
+      '@storybook/manager-api': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/node-logger': 7.4.0
+      '@storybook/preview-api': 7.4.0
+      '@storybook/theming': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/types': 7.4.0
       lodash: 4.17.21
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
@@ -3549,27 +4242,27 @@ packages:
       - supports-color
     dev: true
 
-  /@storybook/addon-docs@7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-QXScPt5HhKvNllFCBlq5Gr7reNnaBGJZmOzw1QypzKSkIdx18WtKKOppxa5AwETXFnJ8XSjwcuLzZ+q5RUNiww==}
+  /@storybook/addon-docs@7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-LJE92LUeVTgi8W4tLBEbSvCqF54snmBfTFCr46vhCFov2CE2VBgEvIX1XT3dfUgYUOtPu3RXR2C89fYgU6VYZw==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
     dependencies:
-      '@jest/transform': 29.6.2
+      '@jest/transform': 29.6.4
       '@mdx-js/react': 2.3.0(react@18.2.0)
-      '@storybook/blocks': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/client-logger': 7.2.0
-      '@storybook/components': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/csf-plugin': 7.2.0
-      '@storybook/csf-tools': 7.2.0
+      '@storybook/blocks': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/client-logger': 7.4.0
+      '@storybook/components': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/csf-plugin': 7.4.0
+      '@storybook/csf-tools': 7.4.0
       '@storybook/global': 5.0.0
       '@storybook/mdx2-csf': 1.1.0
-      '@storybook/node-logger': 7.2.0
-      '@storybook/postinstall': 7.2.0
-      '@storybook/preview-api': 7.2.0
-      '@storybook/react-dom-shim': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/theming': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/types': 7.2.0
+      '@storybook/node-logger': 7.4.0
+      '@storybook/postinstall': 7.4.0
+      '@storybook/preview-api': 7.4.0
+      '@storybook/react-dom-shim': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/theming': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/types': 7.4.0
       fs-extra: 11.1.1
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
@@ -3583,25 +4276,25 @@ packages:
       - supports-color
     dev: true
 
-  /@storybook/addon-essentials@7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-dROgcW2v3RIzg3CyG0apIQj5IMiE6e3eFtsED9hjH1nQMkvbICORKRvOino762xLp/p2fnTvvNf3uTEhFp+qSw==}
+  /@storybook/addon-essentials@7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-nZmNM9AKw2JXxnYUXyFKLeUF/cL7Z9E1WTeZyOFTDtU2aITRt8+LvaepwjchtPqu2B0GcQxLB5FRDdhy0I19nw==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
     dependencies:
-      '@storybook/addon-actions': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/addon-backgrounds': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/addon-controls': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/addon-docs': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/addon-highlight': 7.2.0
-      '@storybook/addon-measure': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/addon-outline': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/addon-toolbars': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/addon-viewport': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/core-common': 7.2.0
-      '@storybook/manager-api': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/node-logger': 7.2.0
-      '@storybook/preview-api': 7.2.0
+      '@storybook/addon-actions': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/addon-backgrounds': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/addon-controls': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/addon-docs': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/addon-highlight': 7.4.0
+      '@storybook/addon-measure': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/addon-outline': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/addon-toolbars': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/addon-viewport': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/core-common': 7.4.0
+      '@storybook/manager-api': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/node-logger': 7.4.0
+      '@storybook/preview-api': 7.4.0
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
       ts-dedent: 2.2.0
@@ -3612,16 +4305,16 @@ packages:
       - supports-color
     dev: true
 
-  /@storybook/addon-highlight@7.2.0:
-    resolution: {integrity: sha512-2/pehtDjfIdTEx3i4RKjtNPOjPXcAm5nn7PlArvuf7Cd63KExUTqEMXe7scIiaYMjQGABYmGLqqrfgdEsg1oxQ==}
+  /@storybook/addon-highlight@7.4.0:
+    resolution: {integrity: sha512-kpYSb3oXI9t/1+aRJhToDZ0/1W4mu+SzTBfv9Bl2d/DogEkFzgJricoy5LtvS5EpcXUmKO1FJsw/DCm9buSL2g==}
     dependencies:
-      '@storybook/core-events': 7.2.0
+      '@storybook/core-events': 7.4.0
       '@storybook/global': 5.0.0
-      '@storybook/preview-api': 7.2.0
+      '@storybook/preview-api': 7.4.0
     dev: true
 
-  /@storybook/addon-links@7.2.0(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-IEeYuiS5Aq44Z/RmsaTBQkn5dpZIeh9VjPRz2cwM0cYfMAs1A0j0W3j8ZUtF5Rlg/3Pu4lUIhcxLcxcI1vJRlQ==}
+  /@storybook/addon-links@7.4.0(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-lFj8fiokWKk3jx5YUQ4anQo1uCNDMP1y6nJ/92Y85vnOd1vJr3w4GlLy8eOWMABRE33AKLI5Yp6wcpWZDe7hhQ==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
@@ -3631,32 +4324,32 @@ packages:
       react-dom:
         optional: true
     dependencies:
-      '@storybook/client-logger': 7.2.0
-      '@storybook/core-events': 7.2.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/core-events': 7.4.0
       '@storybook/csf': 0.1.1
       '@storybook/global': 5.0.0
-      '@storybook/manager-api': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/preview-api': 7.2.0
-      '@storybook/router': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/types': 7.2.0
+      '@storybook/manager-api': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/preview-api': 7.4.0
+      '@storybook/router': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/types': 7.4.0
       prop-types: 15.8.1
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
       ts-dedent: 2.2.0
     dev: true
 
-  /@storybook/addon-mdx-gfm@7.2.0:
-    resolution: {integrity: sha512-KMcioMUAlyd3KOcHeCqa3cSxO44f7EqTKgmmHkV1H/Mnr7LWWknHsIu1KQBnCvAEi0rKQFjy8czptyT/zYL2sQ==}
+  /@storybook/addon-mdx-gfm@7.4.0:
+    resolution: {integrity: sha512-u4/9jMlfDVsnW0Ker3ckQDKLWYPn5GTalgHTphHTDGdnmL0OhsyvkF8cuSk55XA5G1L6IG4oOeFsGRqyIKcMQA==}
     dependencies:
-      '@storybook/node-logger': 7.2.0
+      '@storybook/node-logger': 7.4.0
       remark-gfm: 3.0.1
       ts-dedent: 2.2.0
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /@storybook/addon-measure@7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-Urw6wub+hjOLelTKIuaxv2HsCSlqjE6HQDExETFCy1wY9/g99vPUOBq6HTZr6aRqWg+IjC48iUFWoRMcok6PsA==}
+  /@storybook/addon-measure@7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-8YjBqm6jPOBgkRn9YnJkLN0+ghgJiukdHOa0VB3qhiT+oww4ZOZ7mc2aQRwXQoFb05UbVVG9UNxE7lhyTyaG2w==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
@@ -3666,13 +4359,13 @@ packages:
       react-dom:
         optional: true
     dependencies:
-      '@storybook/client-logger': 7.2.0
-      '@storybook/components': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/core-events': 7.2.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/components': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/core-events': 7.4.0
       '@storybook/global': 5.0.0
-      '@storybook/manager-api': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/preview-api': 7.2.0
-      '@storybook/types': 7.2.0
+      '@storybook/manager-api': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/preview-api': 7.4.0
+      '@storybook/types': 7.4.0
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
       tiny-invariant: 1.3.1
@@ -3681,8 +4374,8 @@ packages:
       - '@types/react-dom'
     dev: true
 
-  /@storybook/addon-outline@7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-pP9Umngd8OsmVYAhRQqY4HGgTeQK63tZeNDOSdB5Jab4f6wDrdHUn6OMo0Hsfzw65g7mSQmEexnxbq1DrgKU1Q==}
+  /@storybook/addon-outline@7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-CCAWFC3bfkmYPzFjOemfH/kjpqJOHt+SdJgBKmwujDy+zum0DHlUL/7rd+U32cEpezCA8bapd0hlWn59C4agHQ==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
@@ -3692,13 +4385,13 @@ packages:
       react-dom:
         optional: true
     dependencies:
-      '@storybook/client-logger': 7.2.0
-      '@storybook/components': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/core-events': 7.2.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/components': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/core-events': 7.4.0
       '@storybook/global': 5.0.0
-      '@storybook/manager-api': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/preview-api': 7.2.0
-      '@storybook/types': 7.2.0
+      '@storybook/manager-api': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/preview-api': 7.4.0
+      '@storybook/types': 7.4.0
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
       ts-dedent: 2.2.0
@@ -3707,8 +4400,8 @@ packages:
       - '@types/react-dom'
     dev: true
 
-  /@storybook/addon-toolbars@7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-bLWb6ZixaK1mfXuuBD06wdmqd+BbMubTmsjzFBFtc/7zJT10tRduyw8iMHIsAWwrjzeXauyo2NUeXmop0Xm1Uw==}
+  /@storybook/addon-toolbars@7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-00PDLchlQXI3ZClQHU0YQBfikAAxHOhVNv2QKW54yFKmxPl+P2c/VIeir9LcPhA04smKrJTD1u+Nszd66A9xAA==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
@@ -3718,11 +4411,11 @@ packages:
       react-dom:
         optional: true
     dependencies:
-      '@storybook/client-logger': 7.2.0
-      '@storybook/components': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/manager-api': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/preview-api': 7.2.0
-      '@storybook/theming': 7.2.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/client-logger': 7.4.0
+      '@storybook/components': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/manager-api': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/preview-api': 7.4.0
+      '@storybook/theming': 7.4.0(react-dom@18.2.0)(react@18.2.0)
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
     transitivePeerDependencies:
@@ -3730,8 +4423,8 @@ packages:
       - '@types/react-dom'
     dev: true
 
-  /@storybook/addon-viewport@7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-CJib9jGM7Tzo4aBkxUWX8hJz12eaKmpsCLEFyypJn60gupN9TUckOBSdU2ShnjkKcG05hLbgnAoXHlgmLobyVQ==}
+  /@storybook/addon-viewport@7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-Bfoilf9eJV/C7tR8XHDxz3h8JlZ+iggoESp2Tc0bW9tlRvz+PsCqeyHhF/IgHY+gLnPal2PkK/PIM+ruO45HXA==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
@@ -3741,13 +4434,13 @@ packages:
       react-dom:
         optional: true
     dependencies:
-      '@storybook/client-logger': 7.2.0
-      '@storybook/components': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/core-events': 7.2.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/components': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/core-events': 7.4.0
       '@storybook/global': 5.0.0
-      '@storybook/manager-api': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/preview-api': 7.2.0
-      '@storybook/theming': 7.2.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/manager-api': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/preview-api': 7.4.0
+      '@storybook/theming': 7.4.0(react-dom@18.2.0)(react@18.2.0)
       memoizerific: 1.11.3
       prop-types: 15.8.1
       react: 18.2.0
@@ -3805,35 +4498,73 @@ packages:
       util-deprecate: 1.0.2
     dev: true
 
-  /@storybook/blocks@7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-QbRw4lszmkxD86+murh0rJWa2rf9fEhI3vP3BSD+Ta6YgLHt+T94l0K5uQpESs8DRWHFGe5kT33hcAXHIpBqPA==}
+  /@storybook/blocks@7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-YQznNjJm+l32fCfPxrZso9+MbcyG0pWZSpx3RKI1+pxDMsAs4mbXsIw4//jKfjoDP/6/Cz/FJcSx8LT7i4BJ2w==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+    dependencies:
+      '@storybook/channels': 7.4.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/components': 7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/core-events': 7.4.0
+      '@storybook/csf': 0.1.1
+      '@storybook/docs-tools': 7.4.0
+      '@storybook/global': 5.0.0
+      '@storybook/manager-api': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/preview-api': 7.4.0
+      '@storybook/theming': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/types': 7.4.0
+      '@types/lodash': 4.14.196
+      color-convert: 2.0.1
+      dequal: 2.0.3
+      lodash: 4.17.21
+      markdown-to-jsx: 7.3.2(react@18.2.0)
+      memoizerific: 1.11.3
+      polished: 4.2.2
+      react: 18.2.0
+      react-colorful: 5.6.1(react-dom@18.2.0)(react@18.2.0)
+      react-dom: 18.2.0(react@18.2.0)
+      telejson: 7.2.0
+      tocbot: 4.21.1
+      ts-dedent: 2.2.0
+      util-deprecate: 1.0.2
+    transitivePeerDependencies:
+      - '@types/react'
+      - '@types/react-dom'
+      - encoding
+      - supports-color
+    dev: true
+
+  /@storybook/blocks@7.4.5(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-FhAIkCT2HrzJcKsC3mL5+uG3GrbS23mYAT1h3iyPjCliZzxfCCI9UCMUXqYx4Z/FmAGJgpsQQXiBFZuoTHO9aQ==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
     dependencies:
-      '@storybook/channels': 7.2.0
-      '@storybook/client-logger': 7.2.0
-      '@storybook/components': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/core-events': 7.2.0
+      '@storybook/channels': 7.4.5
+      '@storybook/client-logger': 7.4.5
+      '@storybook/components': 7.4.5(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/core-events': 7.4.5
       '@storybook/csf': 0.1.1
-      '@storybook/docs-tools': 7.2.0
+      '@storybook/docs-tools': 7.4.5
       '@storybook/global': 5.0.0
-      '@storybook/manager-api': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/preview-api': 7.2.0
-      '@storybook/theming': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/types': 7.2.0
+      '@storybook/manager-api': 7.4.5(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/preview-api': 7.4.5
+      '@storybook/theming': 7.4.5(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/types': 7.4.5
       '@types/lodash': 4.14.196
       color-convert: 2.0.1
       dequal: 2.0.3
       lodash: 4.17.21
-      markdown-to-jsx: 7.2.1(react@18.2.0)
+      markdown-to-jsx: 7.3.2(react@18.2.0)
       memoizerific: 1.11.3
       polished: 4.2.2
       react: 18.2.0
       react-colorful: 5.6.1(react-dom@18.2.0)(react@18.2.0)
       react-dom: 18.2.0(react@18.2.0)
-      telejson: 7.1.0
-      tocbot: 4.21.0
+      telejson: 7.2.0
+      tocbot: 4.21.1
       ts-dedent: 2.2.0
       util-deprecate: 1.0.2
     transitivePeerDependencies:
@@ -3843,19 +4574,19 @@ packages:
       - supports-color
     dev: true
 
-  /@storybook/builder-manager@7.2.0:
-    resolution: {integrity: sha512-WGenq08db5mmlMTQ3dFsZD1tNYx43vjgbDJOeABUJ8pyTDZ0WPT6lfRWn9D2qzG1Sie4bkv2FyJdlc/AfM7SIQ==}
+  /@storybook/builder-manager@7.4.0:
+    resolution: {integrity: sha512-4fuxVzBIBbZh2aVBizSOU5EJ8b74IhR6x2TAZjifZZf5Gdxgfgio8sAyrrd/C78vrFOFhFEgmQhMqZRuCLHxvQ==}
     dependencies:
       '@fal-works/esbuild-plugin-global-externals': 2.1.2
-      '@storybook/core-common': 7.2.0
-      '@storybook/manager': 7.2.0
-      '@storybook/node-logger': 7.2.0
+      '@storybook/core-common': 7.4.0
+      '@storybook/manager': 7.4.0
+      '@storybook/node-logger': 7.4.0
       '@types/ejs': 3.1.2
       '@types/find-cache-dir': 3.2.1
-      '@yarnpkg/esbuild-plugin-pnp': 3.0.0-rc.15(esbuild@0.18.17)
+      '@yarnpkg/esbuild-plugin-pnp': 3.0.0-rc.15(esbuild@0.18.20)
       browser-assert: 1.2.1
       ejs: 3.1.9
-      esbuild: 0.18.17
+      esbuild: 0.18.20
       esbuild-plugin-alias: 0.2.1
       express: 4.18.2
       find-cache-dir: 3.3.2
@@ -3867,8 +4598,8 @@ packages:
       - supports-color
     dev: true
 
-  /@storybook/builder-vite@7.2.0(typescript@5.1.6)(vite@4.4.2):
-    resolution: {integrity: sha512-YmTtyIMxWKaFOsJaLU5rGHukvt37LjVvW6QEAEK1Clbl1f3QUNSEGJwVYLRYO7xQvhymBF4JMa8N5NSc1+xSEQ==}
+  /@storybook/builder-vite@7.4.0(typescript@5.2.2)(vite@4.4.2):
+    resolution: {integrity: sha512-2hE+Q5zoSFQvmiPKsRaZWUX5v6vRaSp0+kgZo3EOg0DvAACiC/Cd+sdnv7wxigvSnVRMbWvBVguPyePRjke8KA==}
     peerDependencies:
       '@preact/preset-vite': '*'
       typescript: '>= 4.3.x'
@@ -3882,27 +4613,27 @@ packages:
       vite-plugin-glimmerx:
         optional: true
     dependencies:
-      '@storybook/channels': 7.2.0
-      '@storybook/client-logger': 7.2.0
-      '@storybook/core-common': 7.2.0
-      '@storybook/csf-plugin': 7.2.0
+      '@storybook/channels': 7.4.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/core-common': 7.4.0
+      '@storybook/csf-plugin': 7.4.0
       '@storybook/mdx2-csf': 1.1.0
-      '@storybook/node-logger': 7.2.0
-      '@storybook/preview': 7.2.0
-      '@storybook/preview-api': 7.2.0
-      '@storybook/types': 7.2.0
+      '@storybook/node-logger': 7.4.0
+      '@storybook/preview': 7.4.0
+      '@storybook/preview-api': 7.4.0
+      '@storybook/types': 7.4.0
       '@types/find-cache-dir': 3.2.1
       browser-assert: 1.2.1
       es-module-lexer: 0.9.3
       express: 4.18.2
       find-cache-dir: 3.3.2
       fs-extra: 11.1.1
-      magic-string: 0.30.1
+      magic-string: 0.30.3
       remark-external-links: 8.0.0
       remark-slug: 6.1.0
-      rollup: 3.26.3
-      typescript: 5.1.6
-      vite: 4.4.2(@types/node@18.17.0)
+      rollup: 3.28.1
+      typescript: 5.2.2
+      vite: 4.4.2(@types/node@18.18.1)
     transitivePeerDependencies:
       - encoding
       - supports-color
@@ -3916,32 +4647,43 @@ packages:
       util-deprecate: 1.0.2
     dev: true
 
-  /@storybook/channels@7.2.0:
-    resolution: {integrity: sha512-2W0tnfmyPQc3TES1NgFOzrmnzVkxqEYGqWYOYQkwgumC+FIDIktW02eIP8JlxuStEx4oIMuB8YF3euRNZqHSgA==}
+  /@storybook/channels@7.4.0:
+    resolution: {integrity: sha512-/1CU0s3npFumzVHLGeubSyPs21O3jNqtSppOjSB9iDTyV2GtQrjh5ntVwebfKpCkUSitx3x7TkCb9dylpEZ8+w==}
+    dependencies:
+      '@storybook/client-logger': 7.4.0
+      '@storybook/core-events': 7.4.0
+      '@storybook/global': 5.0.0
+      qs: 6.11.2
+      telejson: 7.2.0
+      tiny-invariant: 1.3.1
+    dev: true
+
+  /@storybook/channels@7.4.5:
+    resolution: {integrity: sha512-zWPZn4CxPFXsrrSRQ9JD8GmTeWeFYgr3sTBpe23hnhYookCXVNJ6AcaXogrT9b2ALfbB6MiFDbZIHHTgIgbWpg==}
     dependencies:
-      '@storybook/client-logger': 7.2.0
-      '@storybook/core-events': 7.2.0
+      '@storybook/client-logger': 7.4.5
+      '@storybook/core-events': 7.4.5
       '@storybook/global': 5.0.0
       qs: 6.11.2
-      telejson: 7.1.0
+      telejson: 7.2.0
       tiny-invariant: 1.3.1
     dev: true
 
-  /@storybook/cli@7.2.0:
-    resolution: {integrity: sha512-0RxleuwhSbREr5FxNu/N+TIK4CZJDVDDXCGTpXnRZrA4phzUIhrkG/9wDfW/jo3GHfyKa8PE1mYkqtvG3J3rVQ==}
+  /@storybook/cli@7.4.0:
+    resolution: {integrity: sha512-yn27cn3LzhTqpEVX6CzUz13KTJ3jPLA2eM4bO1t7SYUqpDlzw3lET9DIcYIaUAIiL+0r2Js3jW2BsyN/5KmO5w==}
     hasBin: true
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/preset-env': 7.22.9(@babel/core@7.22.9)
-      '@babel/types': 7.22.5
+      '@babel/core': 7.22.11
+      '@babel/preset-env': 7.22.14(@babel/core@7.23.0)
+      '@babel/types': 7.23.0
       '@ndelangen/get-tarball': 3.0.9
-      '@storybook/codemod': 7.2.0
-      '@storybook/core-common': 7.2.0
-      '@storybook/core-server': 7.2.0
-      '@storybook/csf-tools': 7.2.0
-      '@storybook/node-logger': 7.2.0
-      '@storybook/telemetry': 7.2.0
-      '@storybook/types': 7.2.0
+      '@storybook/codemod': 7.4.0
+      '@storybook/core-common': 7.4.0
+      '@storybook/core-server': 7.4.0
+      '@storybook/csf-tools': 7.4.0
+      '@storybook/node-logger': 7.4.0
+      '@storybook/telemetry': 7.4.0
+      '@storybook/types': 7.4.0
       '@types/semver': 7.5.0
       '@yarnpkg/fslib': 2.10.3
       '@yarnpkg/libzip': 2.3.0
@@ -3958,7 +4700,7 @@ packages:
       get-port: 5.1.1
       giget: 1.1.2
       globby: 11.1.0
-      jscodeshift: 0.14.0(@babel/preset-env@7.22.9)
+      jscodeshift: 0.14.0(@babel/preset-env@7.22.14)
       leven: 3.1.0
       ora: 5.4.1
       prettier: 2.8.8
@@ -3985,45 +4727,52 @@ packages:
       global: 4.4.0
     dev: true
 
-  /@storybook/client-logger@7.2.0:
-    resolution: {integrity: sha512-e31snLKvP2h/BBl+DXR/pM/CI8uvDU89BujHniK3ttJNynjOpJmHp0SgxOKnlRXpOaau9jKKoLVMegi/BgIYpA==}
+  /@storybook/client-logger@7.4.0:
+    resolution: {integrity: sha512-4pBnf7+df1wXEVcF1civqxbrtccGGHQkfWQkJo49s53RXvF7SRTcif6XTx0V3cQV0v7I1C5mmLm0LNlmjPRP1Q==}
     dependencies:
       '@storybook/global': 5.0.0
     dev: true
 
-  /@storybook/codemod@7.2.0:
-    resolution: {integrity: sha512-CxsGogfqTZzEa4QLRnywbH1fSa9MV/KKLnyDOlUnUv6GLHC9IRQAxeXrum9RJOkAhVMl1hBvBBgsPcBu7AnHUQ==}
+  /@storybook/client-logger@7.4.5:
+    resolution: {integrity: sha512-Bn6eTAjhPDUfLpvuxhKkpDpOtkadfkSmkBNBZRu3r0Dzk2J1nNyKV5K6D8dOU4PFVof4z/gXYj5bktT29jKsmw==}
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/preset-env': 7.22.9(@babel/core@7.22.9)
-      '@babel/types': 7.22.5
+      '@storybook/global': 5.0.0
+    dev: true
+
+  /@storybook/codemod@7.4.0:
+    resolution: {integrity: sha512-XqNhv5bec+L7TJ5tXdsMalmJazwaFMVVxoNlnb0f9zKhovAEF2F6hl6+Pnd2avRomH9+1q7EM+GwrTCAvzAfzg==}
+    dependencies:
+      '@babel/core': 7.22.11
+      '@babel/preset-env': 7.22.14(@babel/core@7.22.11)
+      '@babel/types': 7.23.0
       '@storybook/csf': 0.1.1
-      '@storybook/csf-tools': 7.2.0
-      '@storybook/node-logger': 7.2.0
-      '@storybook/types': 7.2.0
+      '@storybook/csf-tools': 7.4.0
+      '@storybook/node-logger': 7.4.0
+      '@storybook/types': 7.4.0
       '@types/cross-spawn': 6.0.2
       cross-spawn: 7.0.3
       globby: 11.1.0
-      jscodeshift: 0.14.0(@babel/preset-env@7.22.9)
+      jscodeshift: 0.14.0(@babel/preset-env@7.22.14)
       lodash: 4.17.21
       prettier: 2.8.8
-      recast: 0.23.3
+      recast: 0.23.4
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /@storybook/components@7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-PVHWtGrd+BGI4EOMnCZCotakwSxBr1a9YwmK5z89sD55wljkhn/qoHRYs+QZDVS2fAnegsmI8CcwplAdN1hs8w==}
+  /@storybook/components@7.4.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-GGnQrI4NXwri/PqNjhO1vNv4tC7RBjY87ce9WHBq1ueat3kBakdqV97NzScoldXarkkKK6grBqmhw9jE5PfzhQ==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
     dependencies:
       '@radix-ui/react-select': 1.2.2(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/client-logger': 7.2.0
+      '@radix-ui/react-toolbar': 1.0.4(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/client-logger': 7.4.0
       '@storybook/csf': 0.1.1
       '@storybook/global': 5.0.0
-      '@storybook/theming': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/types': 7.2.0
+      '@storybook/theming': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/types': 7.4.0
       memoizerific: 1.11.3
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
@@ -4034,33 +4783,87 @@ packages:
       - '@types/react-dom'
     dev: true
 
-  /@storybook/core-client@7.2.0:
-    resolution: {integrity: sha512-U/5BAGGI9HIO1RHetQR0V4a9ISWDRlcik8mQhOVVcvd6eMkyS9O8r3unVaXTjjAUQvDsP2il89fV6bkouJBfKA==}
+  /@storybook/components@7.4.5(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-boskkfvMBB8CFYY9+1ofFNyKrdWXTY/ghzt7oK80dz6f2Eseo/WXK3OsCdCq5vWbLRCdbgJ8zXG8pAFi4yBsxA==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+    dependencies:
+      '@radix-ui/react-select': 1.2.2(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@radix-ui/react-toolbar': 1.0.4(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/client-logger': 7.4.5
+      '@storybook/csf': 0.1.1
+      '@storybook/global': 5.0.0
+      '@storybook/theming': 7.4.5(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/types': 7.4.5
+      memoizerific: 1.11.3
+      react: 18.2.0
+      react-dom: 18.2.0(react@18.2.0)
+      use-resize-observer: 9.1.0(react-dom@18.2.0)(react@18.2.0)
+      util-deprecate: 1.0.2
+    transitivePeerDependencies:
+      - '@types/react'
+      - '@types/react-dom'
+    dev: true
+
+  /@storybook/core-client@7.4.0:
+    resolution: {integrity: sha512-AhysJS2HnydB8Jc+BMVzK5VLHa1liJjxroNsd+ZTgGUhD7R8wvozrswQgY4MLFtcaLwN/wDWlK2YavSBqmc94Q==}
     dependencies:
-      '@storybook/client-logger': 7.2.0
-      '@storybook/preview-api': 7.2.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/preview-api': 7.4.0
     dev: true
 
-  /@storybook/core-common@7.2.0:
-    resolution: {integrity: sha512-+/6oQno7GtuhKbvFGjPyZpFfZCps/tNHA/FKs3y3N+N/ZAw2If9HL1jKSmmzgDkQ49F1hVDgsM/TpIGqT+4wTQ==}
+  /@storybook/core-common@7.4.0:
+    resolution: {integrity: sha512-QKrBL46ZFdfTjlZE3f7b59Q5+frOHWIJ64sC9BZ2PHkZkGjFeYRDdJJ6EHLYBb+nToynl33dYN1GQz+hQn2vww==}
     dependencies:
-      '@storybook/node-logger': 7.2.0
-      '@storybook/types': 7.2.0
+      '@storybook/node-logger': 7.4.0
+      '@storybook/types': 7.4.0
       '@types/find-cache-dir': 3.2.1
-      '@types/node': 16.18.39
+      '@types/node': 16.18.55
       '@types/node-fetch': 2.6.4
       '@types/pretty-hrtime': 1.0.1
       chalk: 4.1.2
-      esbuild: 0.18.17
-      esbuild-register: 3.4.2(esbuild@0.18.17)
+      esbuild: 0.18.20
+      esbuild-register: 3.4.2(esbuild@0.18.20)
+      file-system-cache: 2.3.0
+      find-cache-dir: 3.3.2
+      find-up: 5.0.0
+      fs-extra: 11.1.1
+      glob: 10.3.4
+      handlebars: 4.7.8
+      lazy-universal-dotenv: 4.0.0
+      node-fetch: 2.7.0
+      picomatch: 2.3.1
+      pkg-dir: 5.0.0
+      pretty-hrtime: 1.0.3
+      resolve-from: 5.0.0
+      ts-dedent: 2.2.0
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+    dev: true
+
+  /@storybook/core-common@7.4.5:
+    resolution: {integrity: sha512-c4pBuILMD4YhSpJ+QpKtsUZpK+/rfolwOvzXfJwlN5EpYzMz6FjVR/LyX0cCT2YLI3X5YWRoCdvMxy5Aeryb8g==}
+    dependencies:
+      '@storybook/core-events': 7.4.5
+      '@storybook/node-logger': 7.4.5
+      '@storybook/types': 7.4.5
+      '@types/find-cache-dir': 3.2.1
+      '@types/node': 16.18.55
+      '@types/node-fetch': 2.6.6
+      '@types/pretty-hrtime': 1.0.1
+      chalk: 4.1.2
+      esbuild: 0.18.20
+      esbuild-register: 3.5.0(esbuild@0.18.20)
       file-system-cache: 2.3.0
       find-cache-dir: 3.3.2
       find-up: 5.0.0
       fs-extra: 11.1.1
-      glob: 10.3.3
-      handlebars: 4.7.7
+      glob: 10.3.10
+      handlebars: 4.7.8
       lazy-universal-dotenv: 4.0.0
-      node-fetch: 2.6.12
+      node-fetch: 2.7.0
       picomatch: 2.3.1
       pkg-dir: 5.0.0
       pretty-hrtime: 1.0.3
@@ -4077,30 +4880,38 @@ packages:
       core-js: 3.32.0
     dev: true
 
-  /@storybook/core-events@7.2.0:
-    resolution: {integrity: sha512-Y1o8vGBnbZ/bYsukPiK33CHURSob3tywg8WRtAuwWnDaZiM9IXgkEHbOK1zfkPTnz2gSXEX19KlpTmMxm0W//w==}
+  /@storybook/core-events@7.4.0:
+    resolution: {integrity: sha512-JavEo4dw7TQdF5pSKjk4RtqLgsG2R/eWRI8vZ3ANKa0ploGAnQR/eMTfSxf6TUH3ElBWLJhi+lvUCkKXPQD+dw==}
+    dependencies:
+      ts-dedent: 2.2.0
+    dev: true
+
+  /@storybook/core-events@7.4.5:
+    resolution: {integrity: sha512-Jzy/adSC95saYCZlgXE5j7jmiMLAXYpnBFBxEtBdXwSWEBb0zt21n1nyWBEAv9s/k2gqDXlPHKHeL5Mn6y40zA==}
+    dependencies:
+      ts-dedent: 2.2.0
     dev: true
 
-  /@storybook/core-server@7.2.0:
-    resolution: {integrity: sha512-sVdx8lLVJ99dok1SX4Tl6SHMI4UroKxNoJuJ/Ie29YksYHJuzDo9pP1SpkdWtqIeS4AngqeB1iLi+wB6nZneJQ==}
+  /@storybook/core-server@7.4.0:
+    resolution: {integrity: sha512-AcbfXatHVx1by4R2CiPIMgjQlOL3sUbVarkhmgUcL0AWT0zC0SCQWUZdo22en+jZhAraazgXyLGNCVP7A+6Tqg==}
     dependencies:
       '@aw-web-design/x-default-browser': 1.4.126
       '@discoveryjs/json-ext': 0.5.7
-      '@storybook/builder-manager': 7.2.0
-      '@storybook/channels': 7.2.0
-      '@storybook/core-common': 7.2.0
-      '@storybook/core-events': 7.2.0
+      '@storybook/builder-manager': 7.4.0
+      '@storybook/channels': 7.4.0
+      '@storybook/core-common': 7.4.0
+      '@storybook/core-events': 7.4.0
       '@storybook/csf': 0.1.1
-      '@storybook/csf-tools': 7.2.0
+      '@storybook/csf-tools': 7.4.0
       '@storybook/docs-mdx': 0.1.0
       '@storybook/global': 5.0.0
-      '@storybook/manager': 7.2.0
-      '@storybook/node-logger': 7.2.0
-      '@storybook/preview-api': 7.2.0
-      '@storybook/telemetry': 7.2.0
-      '@storybook/types': 7.2.0
+      '@storybook/manager': 7.4.0
+      '@storybook/node-logger': 7.4.0
+      '@storybook/preview-api': 7.4.0
+      '@storybook/telemetry': 7.4.0
+      '@storybook/types': 7.4.0
       '@types/detect-port': 1.3.3
-      '@types/node': 16.18.39
+      '@types/node': 16.18.55
       '@types/pretty-hrtime': 1.0.1
       '@types/semver': 7.5.0
       better-opn: 3.0.2
@@ -4119,7 +4930,7 @@ packages:
       read-pkg-up: 7.0.1
       semver: 7.5.3
       serve-favicon: 2.5.0
-      telejson: 7.1.0
+      telejson: 7.2.0
       tiny-invariant: 1.3.1
       ts-dedent: 2.2.0
       util: 0.12.5
@@ -4133,27 +4944,26 @@ packages:
       - utf-8-validate
     dev: true
 
-  /@storybook/csf-plugin@7.2.0:
-    resolution: {integrity: sha512-UwRclUzBLQU6vhfR56QNOZZPz0d94rnMw9nRT62XZiYIFbBPOpHEDpU5iRk+liM2Uj4LaicV2mFpycTwW0oHsg==}
+  /@storybook/csf-plugin@7.4.0:
+    resolution: {integrity: sha512-X1L3l/dpz2UYjCEQlFLkW7w1A13pmzDZpJ0lotkV79PALlakMXBeoX3I2E0VMjJATV8wC9RSj56COBAs6HsPeg==}
     dependencies:
-      '@storybook/csf-tools': 7.2.0
+      '@storybook/csf-tools': 7.4.0
       unplugin: 1.4.0
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /@storybook/csf-tools@7.2.0:
-    resolution: {integrity: sha512-ZxtztnaZKg6l7nKiRetvArUI4hu5OKYQ+Y3wtwTHfy34KEHiuxUwq+pJKm64IDB1wkR2QKrYhFlGwcmSyvTnWQ==}
+  /@storybook/csf-tools@7.4.0:
+    resolution: {integrity: sha512-bKyOmWPyvT50Neq2wCRr2PmVGLVVm6pOw8WL5t5jueD8sRRzo9QdfhEkqmuSyqdsBdt3SiJKL5oA6dqY5Vl9ww==}
     dependencies:
-      '@babel/generator': 7.22.9
-      '@babel/parser': 7.22.7
-      '@babel/traverse': 7.22.8
-      '@babel/types': 7.22.5
+      '@babel/generator': 7.23.0
+      '@babel/parser': 7.23.0
+      '@babel/traverse': 7.23.2
+      '@babel/types': 7.23.0
       '@storybook/csf': 0.1.1
-      '@storybook/types': 7.2.0
+      '@storybook/types': 7.4.0
       fs-extra: 11.1.1
-      prettier: 2.8.8
-      recast: 0.23.3
+      recast: 0.23.4
       ts-dedent: 2.2.0
     transitivePeerDependencies:
       - supports-color
@@ -4181,12 +4991,26 @@ packages:
     resolution: {integrity: sha512-JDaBR9lwVY4eSH5W8EGHrhODjygPd6QImRbwjAuJNEnY0Vw4ie3bPkeGfnacB3OBW6u/agqPv2aRlR46JcAQLg==}
     dev: true
 
-  /@storybook/docs-tools@7.2.0:
-    resolution: {integrity: sha512-VsgctKraxsw4xXQ44dXqQEi7jooUOgXqcbqru0+HeYznc/FnxXZNl+YgYrl28uOxhnSI6x/tMJs0Cd4YgmmHwA==}
+  /@storybook/docs-tools@7.4.0:
+    resolution: {integrity: sha512-DzXmt4JorAOePoS+sjQznf8jLPI9D5mdB1eSXjfvmGBQyyehKTZv5+TXuxYvT3iPN4rW4OPrIrQCSIrbULFdwA==}
+    dependencies:
+      '@storybook/core-common': 7.4.0
+      '@storybook/preview-api': 7.4.0
+      '@storybook/types': 7.4.0
+      '@types/doctrine': 0.0.3
+      doctrine: 3.0.0
+      lodash: 4.17.21
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+    dev: true
+
+  /@storybook/docs-tools@7.4.5:
+    resolution: {integrity: sha512-ctK+yGb2nvWISSvCCzj3ZhDaAb7I2BLjbxuBGTyNPvl4V9UQ9LBYzdJwR50q+DfscxdwSHMSOE/0OnzmJdaSJA==}
     dependencies:
-      '@storybook/core-common': 7.2.0
-      '@storybook/preview-api': 7.2.0
-      '@storybook/types': 7.2.0
+      '@storybook/core-common': 7.4.5
+      '@storybook/preview-api': 7.4.5
+      '@storybook/types': 7.4.5
       '@types/doctrine': 0.0.3
       doctrine: 3.0.0
       lodash: 4.17.21
@@ -4199,20 +5023,45 @@ packages:
     resolution: {integrity: sha512-FcOqPAXACP0I3oJ/ws6/rrPT9WGhu915Cg8D02a9YxLo0DE9zI+a9A5gRGvmQ09fiWPukqI8ZAEoQEdWUKMQdQ==}
     dev: true
 
-  /@storybook/manager-api@7.2.0(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-sKaG+VBS8wXGaT+vEihK/2VXJwShhFVOsvOd81vfaM97btik0IhCEHtV7VCNW2lDidIGw7u2DX7QO0tav/Qf1w==}
+  /@storybook/manager-api@7.4.0(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-sBfkkt0eZGTozeKrbzMtWLEOQrgqdk24OUJlkc2IDaucR1CBNjoCMjNeYg7cLDw0rXE8W3W3AdWtJnfsUbLMAQ==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+    dependencies:
+      '@storybook/channels': 7.4.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/core-events': 7.4.0
+      '@storybook/csf': 0.1.1
+      '@storybook/global': 5.0.0
+      '@storybook/router': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/theming': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/types': 7.4.0
+      dequal: 2.0.3
+      lodash: 4.17.21
+      memoizerific: 1.11.3
+      react: 18.2.0
+      react-dom: 18.2.0(react@18.2.0)
+      semver: 7.5.3
+      store2: 2.14.2
+      telejson: 7.2.0
+      ts-dedent: 2.2.0
+    dev: true
+
+  /@storybook/manager-api@7.4.5(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-8Hdh5Tutet8xRy2fAknczfvpshz09eVnLd8m34vcFceUOYvEnvDbWerufhlEzovsF4v7U32uqbDHKdKTamWEQQ==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
     dependencies:
-      '@storybook/channels': 7.2.0
-      '@storybook/client-logger': 7.2.0
-      '@storybook/core-events': 7.2.0
+      '@storybook/channels': 7.4.5
+      '@storybook/client-logger': 7.4.5
+      '@storybook/core-events': 7.4.5
       '@storybook/csf': 0.1.1
       '@storybook/global': 5.0.0
-      '@storybook/router': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/theming': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/types': 7.2.0
+      '@storybook/router': 7.4.5(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/theming': 7.4.5(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/types': 7.4.5
       dequal: 2.0.3
       lodash: 4.17.21
       memoizerific: 1.11.3
@@ -4220,36 +5069,59 @@ packages:
       react-dom: 18.2.0(react@18.2.0)
       semver: 7.5.3
       store2: 2.14.2
-      telejson: 7.1.0
+      telejson: 7.2.0
       ts-dedent: 2.2.0
     dev: true
 
-  /@storybook/manager@7.2.0:
-    resolution: {integrity: sha512-XwKjEA0p8f8rsv5XBXcmGrE4MNMlq/+wazQLyxWUyW3iMiYI0px0QjrQPnEGjOUasyLA+sRGrhy0gJ2Z9/XowQ==}
+  /@storybook/manager@7.4.0:
+    resolution: {integrity: sha512-uOSdPBEBKg8WORUZ5HKHb4KnKcTyA5j5Q8MWy/NBaRd22JR3fQkZiKuHer9WJIOQTU+fb6KDmzhZbCTKg5Euog==}
     dev: true
 
   /@storybook/mdx2-csf@1.1.0:
     resolution: {integrity: sha512-TXJJd5RAKakWx4BtpwvSNdgTDkKM6RkXU8GK34S/LhidQ5Pjz3wcnqb0TxEkfhK/ztbP8nKHqXFwLfa2CYkvQw==}
     dev: true
 
-  /@storybook/node-logger@7.2.0:
-    resolution: {integrity: sha512-rQTmw3oSaeenUCOxOa/8+ZtxDxNPhHIURv2Qpr/q5JkcDf13I6HimqVRxeccU+g3Bq/ueceOXMcAuoH4oewtUw==}
+  /@storybook/node-logger@7.4.0:
+    resolution: {integrity: sha512-tWSWkYyAvp6SxjIBaTklg29avzv/3Lv4c0dOG2o5tz79PyZkq9v6sQtwLLoI8EJA9Mo8Z08vaJp8NZyDQ9RCuA==}
+    dev: true
+
+  /@storybook/node-logger@7.4.5:
+    resolution: {integrity: sha512-fJSykphbryuEYj1qihbaTH5oOzD4NkptRxyf2uyBrpgkr5tCTq9d7GHheqaBuIdi513dsjlcIR7z5iHxW7ZD+Q==}
     dev: true
 
-  /@storybook/postinstall@7.2.0:
-    resolution: {integrity: sha512-E/hhZmbo0G7sv/Wq4dW9b27+n9883DY8Md3ju8AVB3Q1DPvKClmgpA6MRbEJtcj0Qh8LgPOnrbxfLsVbJwHpTg==}
+  /@storybook/postinstall@7.4.0:
+    resolution: {integrity: sha512-ZVBZggqkuj7ysfuHSCd/J7ovWV06zY9uWf+VU+Zw7ZeojDT8QHFrCurPsN7D9679j9vRU1/kSzqvAiStALS33g==}
     dev: true
 
-  /@storybook/preview-api@7.2.0:
-    resolution: {integrity: sha512-mZ125UbIO27OrQe8/PjLL2IYAV/+sFjyqmo+HO1Lae3KocCVQQTfGWzuyxuXqntC85PaMr9L6ZkxeecET+Wdqw==}
+  /@storybook/preview-api@7.4.0:
+    resolution: {integrity: sha512-ndXO0Nx+eE7ktVE4EqHpQZ0guX7yYBdruDdJ7B739C0+OoPWsJN7jAzUqq0NXaBcYrdaU5gTy+KnWJUt8R+OyA==}
     dependencies:
-      '@storybook/channels': 7.2.0
-      '@storybook/client-logger': 7.2.0
-      '@storybook/core-events': 7.2.0
+      '@storybook/channels': 7.4.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/core-events': 7.4.0
       '@storybook/csf': 0.1.1
       '@storybook/global': 5.0.0
-      '@storybook/types': 7.2.0
-      '@types/qs': 6.9.7
+      '@storybook/types': 7.4.0
+      '@types/qs': 6.9.8
+      dequal: 2.0.3
+      lodash: 4.17.21
+      memoizerific: 1.11.3
+      qs: 6.11.2
+      synchronous-promise: 2.0.17
+      ts-dedent: 2.2.0
+      util-deprecate: 1.0.2
+    dev: true
+
+  /@storybook/preview-api@7.4.5:
+    resolution: {integrity: sha512-6xXQZPyilkGVddfZBI7tMbMMgOyIoZTYgTnwSPTMsXxO0f0TvtNDmGdwhn0I1nREHKfiQGpcQe6gwddEMnGtSg==}
+    dependencies:
+      '@storybook/channels': 7.4.5
+      '@storybook/client-logger': 7.4.5
+      '@storybook/core-events': 7.4.5
+      '@storybook/csf': 0.1.1
+      '@storybook/global': 5.0.0
+      '@storybook/types': 7.4.5
+      '@types/qs': 6.9.8
       dequal: 2.0.3
       lodash: 4.17.21
       memoizerific: 1.11.3
@@ -4259,12 +5131,12 @@ packages:
       util-deprecate: 1.0.2
     dev: true
 
-  /@storybook/preview@7.2.0:
-    resolution: {integrity: sha512-x3pOQFvVqJgfjC2Wt5AKyyym1031m6crl+lmxsDUtcenEhFazJ5iVLzlB5x4p+98QMkblHPqsx8JUMbAALV8Xw==}
+  /@storybook/preview@7.4.0:
+    resolution: {integrity: sha512-R4LMTvUrVAbcUetRbAXpY3frkwD0eysqHrByiR73040+ngzDwtZOBAy0JfO3jw3WrWv2dn3kWlao5aEwVc9Exw==}
     dev: true
 
-  /@storybook/react-dom-shim@7.2.0(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-RIMFraxxpZmqIWCsOye/jPno7L867SbgXCaLAZMd/Kok9QI3nuV++lfaEY8hK5nMy8D/Q8OkMLss/mIlflvkKg==}
+  /@storybook/react-dom-shim@7.4.0(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-TLpb8a2hnWJoRLqoXpMADh82BFfRZll6JI2Waf1FjnvJ4SF9eS0zBbxybrjW3lFAHWy2XJi+rwcK8FiPj0iBoQ==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
@@ -4273,25 +5145,25 @@ packages:
       react-dom: 18.2.0(react@18.2.0)
     dev: true
 
-  /@storybook/react-vite@7.2.0(react-dom@18.2.0)(react@18.2.0)(typescript@5.1.6)(vite@4.4.2):
-    resolution: {integrity: sha512-I5MGIyMcEhOy00jTWehqb4T8zLqm1VWWUGU9EU26/J0AV4RB8HSWUZBbWXjbGtQI4SYZpX0GcMVObaVmXytFLw==}
+  /@storybook/react-vite@7.4.0(react-dom@18.2.0)(react@18.2.0)(typescript@5.2.2)(vite@4.4.2):
+    resolution: {integrity: sha512-ps1FUyD2j0plCSprBI8z6RvavMvcDarIMFNofV48vSjVFzenRmgJfSbYywTnw7NusplJyZlYqldHreDzwVX1dQ==}
     engines: {node: '>=16'}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
       vite: ^3.0.0 || ^4.0.0
     dependencies:
-      '@joshwooding/vite-plugin-react-docgen-typescript': 0.2.1(typescript@5.1.6)(vite@4.4.2)
-      '@rollup/pluginutils': 5.0.2
-      '@storybook/builder-vite': 7.2.0(typescript@5.1.6)(vite@4.4.2)
-      '@storybook/react': 7.2.0(react-dom@18.2.0)(react@18.2.0)(typescript@5.1.6)
+      '@joshwooding/vite-plugin-react-docgen-typescript': 0.2.1(typescript@5.2.2)(vite@4.4.2)
+      '@rollup/pluginutils': 5.0.4
+      '@storybook/builder-vite': 7.4.0(typescript@5.2.2)(vite@4.4.2)
+      '@storybook/react': 7.4.0(react-dom@18.2.0)(react@18.2.0)(typescript@5.2.2)
       '@vitejs/plugin-react': 3.1.0(vite@4.4.2)
       ast-types: 0.14.2
-      magic-string: 0.30.1
+      magic-string: 0.30.3
       react: 18.2.0
       react-docgen: 6.0.0-alpha.3
       react-dom: 18.2.0(react@18.2.0)
-      vite: 4.4.2(@types/node@18.17.0)
+      vite: 4.4.2(@types/node@18.18.1)
     transitivePeerDependencies:
       - '@preact/preset-vite'
       - encoding
@@ -4301,8 +5173,8 @@ packages:
       - vite-plugin-glimmerx
     dev: true
 
-  /@storybook/react@7.2.0(react-dom@18.2.0)(react@18.2.0)(typescript@5.1.6):
-    resolution: {integrity: sha512-GF4mwewcQm4Pvool39d0O6TP2vQ82BEEeiyRKo4OsUNqoNid+mliyc3ojWSSrbNEeo6c1jl40aRnXwxQ1DWRdg==}
+  /@storybook/react@7.4.0(react-dom@18.2.0)(react@18.2.0)(typescript@5.2.2):
+    resolution: {integrity: sha512-QWsFw/twsNkcWI6brW06sugQQ5dV+fJm4IrEeI28cA4cBHK9G9HKOwCHoXDUWikzZx48XYMpNfs/WyIkuGmEqg==}
     engines: {node: '>=16.0.0'}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
@@ -4312,16 +5184,16 @@ packages:
       typescript:
         optional: true
     dependencies:
-      '@storybook/client-logger': 7.2.0
-      '@storybook/core-client': 7.2.0
-      '@storybook/docs-tools': 7.2.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/core-client': 7.4.0
+      '@storybook/docs-tools': 7.4.0
       '@storybook/global': 5.0.0
-      '@storybook/preview-api': 7.2.0
-      '@storybook/react-dom-shim': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/types': 7.2.0
+      '@storybook/preview-api': 7.4.0
+      '@storybook/react-dom-shim': 7.4.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/types': 7.4.0
       '@types/escodegen': 0.0.6
       '@types/estree': 0.0.51
-      '@types/node': 16.18.39
+      '@types/node': 16.18.55
       acorn: 7.4.1
       acorn-jsx: 5.3.2(acorn@7.4.1)
       acorn-walk: 7.2.0
@@ -4334,7 +5206,7 @@ packages:
       react-element-to-jsx-string: 15.0.0(react-dom@18.2.0)(react@18.2.0)
       ts-dedent: 2.2.0
       type-fest: 2.19.0
-      typescript: 5.1.6
+      typescript: 5.2.2
       util-deprecate: 1.0.2
     transitivePeerDependencies:
       - encoding
@@ -4356,13 +5228,26 @@ packages:
       regenerator-runtime: 0.13.11
     dev: true
 
-  /@storybook/router@7.2.0(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-8QQ3qzNKy75QSVY4JhtYJI/EBLAepTkMpOcbdvgufFWOwTm/s9N5VlGpVctHYNf+vvNpX+YndVoMGAU7bdn8EQ==}
+  /@storybook/router@7.4.0(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-IATdtFL5C3ryjNQSwaQfrmiOZiVFoVNMevMoBGDC++g0laSW40TGiNK6fUjUDBKuOgbuDt4Svfbl29k21GefEg==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+    dependencies:
+      '@storybook/client-logger': 7.4.0
+      memoizerific: 1.11.3
+      qs: 6.11.2
+      react: 18.2.0
+      react-dom: 18.2.0(react@18.2.0)
+    dev: true
+
+  /@storybook/router@7.4.5(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-IM4IhiPiXsx3FAUeUOAB47uiuUS8Yd37VQcNlXLBO28GgHoTSYOrjS+VTGLIV5cAGKr8+H5pFB+q35BnlFUpkQ==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
     dependencies:
-      '@storybook/client-logger': 7.2.0
+      '@storybook/client-logger': 7.4.5
       memoizerific: 1.11.3
       qs: 6.11.2
       react: 18.2.0
@@ -4378,12 +5263,12 @@ packages:
       find-up: 4.1.0
     dev: true
 
-  /@storybook/telemetry@7.2.0:
-    resolution: {integrity: sha512-gegHa1SGXjA21+aRP8s3ADWs12aSq13umChwOxn8QFQiH9goChmPKpwhx+rNY3tkuFHTrzvZJotsE/FI5dLaUA==}
+  /@storybook/telemetry@7.4.0:
+    resolution: {integrity: sha512-oxCB3kIbpiDWuXEtQhk/j6t1/h0KKWAuvxmcwGPxwhEvj/uNtoM+f1qhoDID9waxNo4AccU9Px+1ZJQ+2ejcDg==}
     dependencies:
-      '@storybook/client-logger': 7.2.0
-      '@storybook/core-common': 7.2.0
-      '@storybook/csf-tools': 7.2.0
+      '@storybook/client-logger': 7.4.0
+      '@storybook/core-common': 7.4.0
+      '@storybook/csf-tools': 7.4.0
       chalk: 4.1.2
       detect-package-manager: 2.0.1
       fetch-retry: 5.0.6
@@ -4408,25 +5293,49 @@ packages:
       regenerator-runtime: 0.13.11
     dev: true
 
-  /@storybook/theming@7.2.0(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-E/nFqZuHnR1HK/jXwlPzLnmbIDxWg4cbSkX3sfTbsDd1h7YhxbouheYSuSPqVDjk+3F87Tv2CP+cZUKDkPd3pQ==}
+  /@storybook/theming@7.4.0(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-eLjEf6G3cqlegfutF/iUrec9LrUjKDj7K4ZhGdACWrf7bQcODs99EK62e9/d8GNKr4b+QMSEuM6XNGaqdPnuzQ==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0
+      react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
+    dependencies:
+      '@emotion/use-insertion-effect-with-fallbacks': 1.0.1(react@18.2.0)
+      '@storybook/client-logger': 7.4.0
+      '@storybook/global': 5.0.0
+      memoizerific: 1.11.3
+      react: 18.2.0
+      react-dom: 18.2.0(react@18.2.0)
+    dev: true
+
+  /@storybook/theming@7.4.5(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-QSIJDIMzOegzlhubIBaYIovf4mlf+AVL0SmQOskPS8GZ6s9t77yUUI6gZTEjO+S4eB3djXRsfTTijQ8+z4XmRA==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
     dependencies:
       '@emotion/use-insertion-effect-with-fallbacks': 1.0.1(react@18.2.0)
-      '@storybook/client-logger': 7.2.0
+      '@storybook/client-logger': 7.4.5
       '@storybook/global': 5.0.0
       memoizerific: 1.11.3
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
     dev: true
 
-  /@storybook/types@7.2.0:
-    resolution: {integrity: sha512-jwoA/TIp+U8Vz868aQT+XfoAw6qFrtn2HbZlTfwNWZsUhPFlMsGrwIVEpWqBWIoe6WITU/lNw3BuRmxul+wvAQ==}
+  /@storybook/types@7.4.0:
+    resolution: {integrity: sha512-XyzYkmeklywxvElPrIWLczi/PWtEdgTL6ToT3++FVxptsC2LZKS3Ue+sBcQ9xRZhkRemw4HQHwed5EW3dO8yUg==}
+    dependencies:
+      '@storybook/channels': 7.4.0
+      '@types/babel__core': 7.20.2
+      '@types/express': 4.17.17
+      '@types/react': 16.14.46
+      file-system-cache: 2.3.0
+    dev: true
+
+  /@storybook/types@7.4.5:
+    resolution: {integrity: sha512-DTWFNjfRTpncjufDoUs0QnNkgHG2qThGKWL1D6sO18cYI02zWPyHWD8/cbqlvtT7XIGe3s1iUEfCTdU5GcwWBA==}
     dependencies:
-      '@storybook/channels': 7.2.0
-      '@types/babel__core': 7.20.1
+      '@storybook/channels': 7.4.5
+      '@types/babel__core': 7.20.2
       '@types/express': 4.17.17
       file-system-cache: 2.3.0
     dev: true
@@ -4549,12 +5458,12 @@ packages:
       jsonc-parser: 3.2.0
     dev: true
 
-  /@tanstack/query-core@4.32.0:
-    resolution: {integrity: sha512-ei4IYwL2kmlKSlCw9WgvV7PpXi0MiswVwfQRxawhJA690zWO3dU49igaQ/UMTl+Jy9jj9dK5IKAYvbX7kUvviQ==}
+  /@tanstack/query-core@4.35.3:
+    resolution: {integrity: sha512-PS+WEjd9wzKTyNjjQymvcOe1yg8f3wYc6mD+vb6CKyZAKvu4sIJwryfqfBULITKCla7P9C4l5e9RXePHvZOZeQ==}
     dev: false
 
-  /@tanstack/react-query@4.32.0(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-B8WUMcByYAH9500ENejDCATOmEZhqjtS9wsfiQ3BNa+s+yAynY8SESI8WWHhSqUmjd0pmCSFRP6BOUGSda3QXA==}
+  /@tanstack/react-query@4.35.3(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-UgTPioip/rGG3EQilXfA2j4BJkhEQsR+KAbF+KIuvQ7j4MkgnTCJF01SfRpIRNtQTlEfz/+IL7+jP8WA8bFbsw==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0
@@ -4565,7 +5474,7 @@ packages:
       react-native:
         optional: true
     dependencies:
-      '@tanstack/query-core': 4.32.0
+      '@tanstack/query-core': 4.35.3
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
       use-sync-external-store: 1.2.0(react@18.2.0)
@@ -4575,8 +5484,8 @@ packages:
     resolution: {integrity: sha512-0DGPd9AR3+iDTjGoMpxIkAsUihHZ3Ai6CneU6bRRrffXMgzCdlNk43jTrD2/5LT6CBb3MWTP8v510JzYtahD2w==}
     engines: {node: '>=14'}
     dependencies:
-      '@babel/code-frame': 7.22.5
-      '@babel/runtime': 7.22.6
+      '@babel/code-frame': 7.22.13
+      '@babel/runtime': 7.23.1
       '@types/aria-query': 5.0.1
       aria-query: 5.1.3
       chalk: 4.1.2
@@ -4585,17 +5494,46 @@ packages:
       pretty-format: 27.5.1
     dev: true
 
-  /@testing-library/jest-dom@5.17.0:
-    resolution: {integrity: sha512-ynmNeT7asXyH3aSVv4vvX4Rb+0qjOhdNHnO/3vuZNqPmhDpV/+rCSGwQ7bLcmU2cJ4dvoheIO85LQj0IbJHEtg==}
-    engines: {node: '>=8', npm: '>=6', yarn: '>=1'}
+  /@testing-library/dom@9.3.3:
+    resolution: {integrity: sha512-fB0R+fa3AUqbLHWyxXa2kGVtf1Fe1ZZFr0Zp6AIbIAzXb2mKbEXl+PCQNUOaq5lbTab5tfctfXRNsWXxa2f7Aw==}
+    engines: {node: '>=14'}
     dependencies:
-      '@adobe/css-tools': 4.2.0
-      '@babel/runtime': 7.22.6
-      '@types/testing-library__jest-dom': 5.14.9
+      '@babel/code-frame': 7.22.13
+      '@babel/runtime': 7.23.1
+      '@types/aria-query': 5.0.2
+      aria-query: 5.1.3
+      chalk: 4.1.2
+      dom-accessibility-api: 0.5.16
+      lz-string: 1.5.0
+      pretty-format: 27.5.1
+    dev: true
+
+  /@testing-library/jest-dom@6.1.2(@types/jest@29.5.2)(jest@29.6.2):
+    resolution: {integrity: sha512-NP9jl1Q2qDDtx+cqogowtQtmgD2OVs37iMSIsTv5eN5ETRkf26Kj6ugVwA93/gZzzFWQAsgkKkcftDe91BJCkQ==}
+    engines: {node: '>=14', npm: '>=6', yarn: '>=1'}
+    peerDependencies:
+      '@jest/globals': '>= 28'
+      '@types/jest': '>= 28'
+      jest: '>= 28'
+      vitest: '>= 0.32'
+    peerDependenciesMeta:
+      '@jest/globals':
+        optional: true
+      '@types/jest':
+        optional: true
+      jest:
+        optional: true
+      vitest:
+        optional: true
+    dependencies:
+      '@adobe/css-tools': 4.3.1
+      '@babel/runtime': 7.22.11
+      '@types/jest': 29.5.2
       aria-query: 5.3.0
       chalk: 3.0.0
       css.escape: 1.5.1
       dom-accessibility-api: 0.5.16
+      jest: 29.6.2(@types/node@18.18.1)(ts-node@10.9.1)
       lodash: 4.17.21
       redent: 3.0.0
     dev: true
@@ -4637,13 +5575,13 @@ packages:
       react-dom: 18.2.0(react@18.2.0)
     dev: true
 
-  /@testing-library/user-event@14.4.3(@testing-library/dom@9.3.1):
-    resolution: {integrity: sha512-kCUc5MEwaEMakkO5x7aoD+DLi02ehmEM2QCGWvNqAS1dV/fAvORWEjnjsEIvml59M7Y5kCkWN6fCCyPOe8OL6Q==}
+  /@testing-library/user-event@14.5.1(@testing-library/dom@9.3.3):
+    resolution: {integrity: sha512-UCcUKrUYGj7ClomOo2SpNVvx4/fkd/2BbIHDCle8A0ax+P3bU7yJwDBDrS6ZwdTMARWTGODX1hEsCcO+7beJjg==}
     engines: {node: '>=12', npm: '>=6'}
     peerDependencies:
       '@testing-library/dom': '>=7.21.4'
     dependencies:
-      '@testing-library/dom': 9.3.1
+      '@testing-library/dom': 9.3.3
     dev: true
 
   /@tootallnate/once@2.0.0:
@@ -4680,40 +5618,40 @@ packages:
     resolution: {integrity: sha512-XTIieEY+gvJ39ChLcB4If5zHtPxt3Syj5rgZR+e1ctpmK8NjPf0zFqsz4JpLJT0xla9GFDKjy8Cpu331nrmE1Q==}
     dev: true
 
-  /@types/babel__core@7.20.1:
-    resolution: {integrity: sha512-aACu/U/omhdk15O4Nfb+fHgH/z3QsfQzpnvRZhYhThms83ZnAOZz7zZAWO7mn2yyNQaA4xTO8GLK3uqFU4bYYw==}
-    dependencies:
-      '@babel/parser': 7.22.7
-      '@babel/types': 7.22.5
-      '@types/babel__generator': 7.6.4
-      '@types/babel__template': 7.4.1
-      '@types/babel__traverse': 7.20.1
+  /@types/aria-query@5.0.2:
+    resolution: {integrity: sha512-PHKZuMN+K5qgKIWhBodXzQslTo5P+K/6LqeKXS6O/4liIDdZqaX5RXrCK++LAw+y/nptN48YmUMFiQHRSWYwtQ==}
     dev: true
 
-  /@types/babel__generator@7.6.4:
-    resolution: {integrity: sha512-tFkciB9j2K755yrTALxD44McOrk+gfpIpvC3sxHjRawj6PfnQxrse4Clq5y/Rq+G3mrBurMax/lG8Qn2t9mSsg==}
+  /@types/babel__core@7.20.2:
+    resolution: {integrity: sha512-pNpr1T1xLUc2l3xJKuPtsEky3ybxN3m4fJkknfIpTCTfIZCDW57oAg+EfCgIIp2rvCe0Wn++/FfodDS4YXxBwA==}
     dependencies:
-      '@babel/types': 7.22.5
-    dev: true
+      '@babel/parser': 7.23.0
+      '@babel/types': 7.23.0
+      '@types/babel__generator': 7.6.5
+      '@types/babel__template': 7.4.2
+      '@types/babel__traverse': 7.20.2
 
-  /@types/babel__template@7.4.1:
-    resolution: {integrity: sha512-azBFKemX6kMg5Io+/rdGT0dkGreboUVR0Cdm3fz9QJWpaQGJRQXl7C+6hOTCZcMll7KFyEQpgbYI2lHdsS4U7g==}
+  /@types/babel__generator@7.6.5:
+    resolution: {integrity: sha512-h9yIuWbJKdOPLJTbmSpPzkF67e659PbQDba7ifWm5BJ8xTv+sDmS7rFmywkWOvXedGTivCdeGSIIX8WLcRTz8w==}
     dependencies:
-      '@babel/parser': 7.22.7
-      '@babel/types': 7.22.5
-    dev: true
+      '@babel/types': 7.23.0
 
-  /@types/babel__traverse@7.20.1:
-    resolution: {integrity: sha512-MitHFXnhtgwsGZWtT68URpOvLN4EREih1u3QtQiN4VdAxWKRVvGCSvw/Qth0M0Qq3pJpnGOu5JaM/ydK7OGbqg==}
+  /@types/babel__template@7.4.2:
+    resolution: {integrity: sha512-/AVzPICMhMOMYoSx9MoKpGDKdBRsIXMNByh1PXSZoa+v6ZoLa8xxtsT/uLQ/NJm0XVAWl/BvId4MlDeXJaeIZQ==}
     dependencies:
-      '@babel/types': 7.22.5
-    dev: true
+      '@babel/parser': 7.23.0
+      '@babel/types': 7.23.0
+
+  /@types/babel__traverse@7.20.2:
+    resolution: {integrity: sha512-ojlGK1Hsfce93J0+kn3H5R73elidKUaZonirN33GSmgTUMpzI/MIFfSpF3haANe3G1bEBS9/9/QEqwTzwqFsKw==}
+    dependencies:
+      '@babel/types': 7.23.0
 
   /@types/body-parser@1.19.2:
     resolution: {integrity: sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==}
     dependencies:
       '@types/connect': 3.4.35
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
     dev: true
 
   /@types/chroma-js@2.4.0:
@@ -4724,16 +5662,16 @@ packages:
     resolution: {integrity: sha512-m7GG7IKKGuJUXvkZ1qqG3ChccdIM/qBBo913z+Xft0nKCX4hAU/IxKwZBU4cpRZ7GS5kV4vOblUkILtSShCPXQ==}
     dependencies:
       '@types/color-name': 1.1.1
-    dev: false
+    dev: true
 
   /@types/color-name@1.1.1:
     resolution: {integrity: sha512-rr+OQyAjxze7GgWrSaJwydHStIhHq2lvY3BOC2Mj7KnzI7XK0Uw1TOOdI9lDoajEbSWLiYgoo4f1R51erQfhPQ==}
-    dev: false
+    dev: true
 
   /@types/connect@3.4.35:
     resolution: {integrity: sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==}
     dependencies:
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
     dev: true
 
   /@types/cookie@0.4.1:
@@ -4743,7 +5681,7 @@ packages:
   /@types/cross-spawn@6.0.2:
     resolution: {integrity: sha512-KuwNhp3eza+Rhu8IFI5HUXRP0LIhqH5cAjubUvGXXthh4YYBuP2ntwEX+Cz8GJoZUHlKo247wPWOfA9LYEq4cw==}
     dependencies:
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
     dev: true
 
   /@types/debug@4.1.8:
@@ -4782,7 +5720,7 @@ packages:
   /@types/express-serve-static-core@4.17.35:
     resolution: {integrity: sha512-wALWQwrgiB2AWTT91CB62b6Yt0sNHpznUXeZEcnPU3DRdlDIz74x8Qg1UUYKSVFi+va5vKOLYRBI1bRKiLLKIg==}
     dependencies:
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       '@types/qs': 6.9.7
       '@types/range-parser': 1.2.4
       '@types/send': 0.17.1
@@ -4805,19 +5743,19 @@ packages:
     resolution: {integrity: sha512-ZUxbzKl0IfJILTS6t7ip5fQQM/J3TJYubDm3nMbgubNNYS62eXeUpoLUC8/7fJNiFYHTrGPQn7hspDUzIHX3UA==}
     dependencies:
       '@types/minimatch': 5.1.2
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
     dev: true
 
   /@types/graceful-fs@4.1.6:
     resolution: {integrity: sha512-Sig0SNORX9fdW+bQuTEovKj3uHcUL6LQKbCrrqb1X7J6/ReAbhCXRAhc+SMejhLELFj2QcyuxmUooZ4bt5ReSw==}
     dependencies:
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
     dev: true
 
   /@types/hast@2.3.5:
     resolution: {integrity: sha512-SvQi0L/lNpThgPoleH53cdjB3y9zpLlVjRbqB3rH8hx1jiRSBGAhyjV3H+URFjNVRqt2EdYNrbZE5IsGlNfpRg==}
     dependencies:
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
     dev: false
 
   /@types/http-errors@2.0.1:
@@ -4859,13 +5797,17 @@ packages:
   /@types/jsdom@20.0.1:
     resolution: {integrity: sha512-d0r18sZPmMQr1eG35u12FZfhIXNrnsPU/g5wvRKCUf/tOGilKKwYMYGqh33BNR6ba+2gkHw1EUiHoN3mn7E5IQ==}
     dependencies:
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       '@types/tough-cookie': 4.0.2
       parse5: 7.1.2
     dev: false
 
   /@types/json-schema@7.0.12:
     resolution: {integrity: sha512-Hr5Jfhc9eYOQNPYO5WLDq/n4jqijdHNlDXjuAQkkt+mWdQR+XJToOHrsD4cPaMXpn6KO7y2+wM8AZEs8VpBLVA==}
+    dev: true
+
+  /@types/json-schema@7.0.13:
+    resolution: {integrity: sha512-RbSSoHliUbnXj3ny0CNFOoxrIDV6SUGyStHsvDqosw6CkdPV8TtWGlfecuK4ToyMEAql6pzNxgCFKanovUzlgQ==}
 
   /@types/json5@0.0.29:
     resolution: {integrity: sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==}
@@ -4873,14 +5815,15 @@ packages:
 
   /@types/lodash@4.14.196:
     resolution: {integrity: sha512-22y3o88f4a94mKljsZcanlNWPzO0uBsBdzLAngf2tp533LzZcQzb6+eZPJ+vCTt+bqF2XnvT9gejTLsAcJAJyQ==}
+    dev: true
 
   /@types/mdast@3.0.12:
     resolution: {integrity: sha512-DT+iNIRNX884cx0/Q1ja7NyUPpZuv0KPyL5rGNxm1WC1OtHstl7n4Jb7nk+xacNShQMbczJjt8uFzznpp6kYBg==}
     dependencies:
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
 
-  /@types/mdx@2.0.5:
-    resolution: {integrity: sha512-76CqzuD6Q7LC+AtbPqrvD9AqsN0k8bsYo2bM2J8pmNldP1aIPAbzUQ7QbobyXL4eLr1wK5x8FZFe8eF/ubRuBg==}
+  /@types/mdx@2.0.7:
+    resolution: {integrity: sha512-BG4tyr+4amr3WsSEmHn/fXPqaCba/AYZ7dsaQTiavihQunHSIxk+uAtqsjvicNpyHN6cm+B9RVrUOtW9VzIKHw==}
     dev: true
 
   /@types/mime-types@2.1.1:
@@ -4905,23 +5848,23 @@ packages:
   /@types/node-fetch@2.6.4:
     resolution: {integrity: sha512-1ZX9fcN4Rvkvgv4E6PAY5WXUFWFcRWxZa3EW83UjycOB9ljJCedb2CupIP4RZMEwF/M3eTcCihbBRgwtGbg5Rg==}
     dependencies:
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       form-data: 3.0.1
     dev: true
 
-  /@types/node@16.18.39:
-    resolution: {integrity: sha512-8q9ZexmdYYyc5/cfujaXb4YOucpQxAV4RMG0himLyDUOEr8Mr79VrqsFI+cQ2M2h89YIuy95lbxuYjxT4Hk4kQ==}
+  /@types/node-fetch@2.6.6:
+    resolution: {integrity: sha512-95X8guJYhfqiuVVhRFxVQcf4hW/2bCuoPwDasMf/531STFoNoWTT7YDnWdXHEZKqAGUigmpG31r2FE70LwnzJw==}
+    dependencies:
+      '@types/node': 18.18.1
+      form-data: 4.0.0
     dev: true
 
-  /@types/node@18.17.0:
-    resolution: {integrity: sha512-GXZxEtOxYGFchyUzxvKI14iff9KZ2DI+A6a37o6EQevtg6uO9t+aUZKcaC1Te5Ng1OnLM7K9NVVj+FbecD9cJg==}
-
-  /@types/node@18.17.1:
-    resolution: {integrity: sha512-xlR1jahfizdplZYRU59JlUx9uzF1ARa8jbhM11ccpCJya8kvos5jwdm2ZAgxSCwOl0fq21svP18EVwPBXMQudw==}
+  /@types/node@16.18.55:
+    resolution: {integrity: sha512-Y1zz/LIuJek01+hlPNzzXQhmq/Z2BCP96j18MSXC0S0jSu/IG4FFxmBs7W4/lI2vPJ7foVfEB0hUVtnOjnCiTg==}
     dev: true
 
-  /@types/node@20.4.5:
-    resolution: {integrity: sha512-rt40Nk13II9JwQBdeYqmbn2Q6IVTA5uPhvSO+JVqdXw/6/4glI6oR9ezty/A9Hg5u7JH4OmYmuQ+XvjKm0Datg==}
+  /@types/node@18.18.1:
+    resolution: {integrity: sha512-3G42sxmm0fF2+Vtb9TJQpnjmP+uKlWvFa8KoEGquh4gqRmoUG/N0ufuhikw6HEsdG2G2oIKhog1GCTfz9v5NdQ==}
 
   /@types/normalize-package-data@2.4.1:
     resolution: {integrity: sha512-Gj7cI7z+98M282Tqmp2K5EIsoouUEzbBJhQQzDE3jSIRk6r9gsz0oUokqIUR4u1R3dMHo0pDHM7sNOHyhulypw==}
@@ -4941,6 +5884,10 @@ packages:
     resolution: {integrity: sha512-FGa1F62FT09qcrueBA6qYTrJPVDzah9a+493+o2PCXsesWHIn27G98TsSMs3WPNbZIEj4+VJf6saSFpvD+3Zsw==}
     dev: true
 
+  /@types/qs@6.9.8:
+    resolution: {integrity: sha512-u95svzDlTysU5xecFNTgfFG5RUWu1A9P0VzgpcIiGZA9iraHOdSzcxMxQ55DyeRaGCSxQi7LxXDI4rzq/MYfdg==}
+    dev: true
+
   /@types/range-parser@1.2.4:
     resolution: {integrity: sha512-EEhsLsD6UsDM1yFhAvy0Cjr6VwmpMWqFBCb9w07wVugF7w9nfajxLuVmngTIpgS6svCnm6Vaw+MZhoDCKnOfsw==}
     dev: true
@@ -4950,7 +5897,14 @@ packages:
     dependencies:
       '@types/react': 18.2.6
       '@types/reactcss': 1.2.6
-    dev: false
+    dev: true
+
+  /@types/react-date-range@1.4.4:
+    resolution: {integrity: sha512-9Y9NyNgaCsEVN/+O4HKuxzPbVjRVBGdOKRxMDcsTRWVG62lpYgnxefNckTXDWup8FvczoqPW0+ESZR6R1yymDg==}
+    dependencies:
+      '@types/react': 18.2.6
+      date-fns: 2.30.0
+    dev: true
 
   /@types/react-dom@18.2.4:
     resolution: {integrity: sha512-G2mHoTMTL4yoydITgOGwWdWMVd8sNgyEP85xVmMKAPUBwQWm9wBPQUmvbeF4V3WBY1P7mmL4BkjQ0SqUpf1snw==}
@@ -4964,12 +5918,6 @@ packages:
       '@types/react': 18.2.6
     dev: true
 
-  /@types/react-is@18.2.1:
-    resolution: {integrity: sha512-wyUkmaaSZEzFZivD8F2ftSyAfk6L+DfFliVj/mYdOXbVjRcS87fQJLTnhk6dRZPuJjI+9g6RZJO4PNCngUrmyw==}
-    dependencies:
-      '@types/react': 18.2.6
-    dev: false
-
   /@types/react-syntax-highlighter@15.5.5:
     resolution: {integrity: sha512-QH3JZQXa2usAvJvSsdSUJ4Yu4j8ReuZpgRrEW+XP+Rmosbn425YshW9iGEb/pAARm8496axHhHUPRH3UmTiB6A==}
     dependencies:
@@ -4994,6 +5942,14 @@ packages:
       '@types/react': 18.2.6
     dev: true
 
+  /@types/react@16.14.46:
+    resolution: {integrity: sha512-Am4pyXMrr6cWWw/TN3oqHtEZl0j+G6Up/O8m65+xF/3ZaUgkv1GAtTPWw4yNRmH0HJXmur6xKCKoMo3rBGynuw==}
+    dependencies:
+      '@types/prop-types': 15.7.5
+      '@types/scheduler': 0.16.3
+      csstype: 3.1.2
+    dev: true
+
   /@types/react@18.2.6:
     resolution: {integrity: sha512-wRZClXn//zxCFW+ye/D2qY65UsYP1Fpex2YXorHc8awoNamkMZSvBxwxdYVInsHOZZd2Ppq8isnSzJL5Mpf8OA==}
     dependencies:
@@ -5005,7 +5961,7 @@ packages:
     resolution: {integrity: sha512-qaIzpCuXNWomGR1Xq8SCFTtF4v8V27Y6f+b9+bzHiv087MylI/nTCqqdChNeWS7tslgROmYB7yeiruWX7WnqNg==}
     dependencies:
       '@types/react': 18.2.6
-    dev: false
+    dev: true
 
   /@types/scheduler@0.16.3:
     resolution: {integrity: sha512-5cJ8CB4yAx7BH1oMvdU0Jh9lrEXyPkar6F9G/ERswkCuvP4KQZfZkSjcMbAICCpQTN4OuZn8tz0HiKv9TGZgrQ==}
@@ -5017,7 +5973,7 @@ packages:
     resolution: {integrity: sha512-Cwo8LE/0rnvX7kIIa3QHCkcuF21c05Ayb0ZfxPiv0W8VRiZiNW/WuRupHKpqqGVGf7SUA44QSOUKaEd9lIrd/Q==}
     dependencies:
       '@types/mime': 1.3.2
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
     dev: true
 
   /@types/serve-static@1.15.2:
@@ -5025,30 +5981,24 @@ packages:
     dependencies:
       '@types/http-errors': 2.0.1
       '@types/mime': 3.0.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
     dev: true
 
   /@types/set-cookie-parser@2.4.3:
     resolution: {integrity: sha512-7QhnH7bi+6KAhBB+Auejz1uV9DHiopZqu7LfR/5gZZTkejJV5nYeZZpgfFoE0N8aDsXuiYpfKyfyMatCwQhyTQ==}
     dependencies:
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
     dev: true
 
   /@types/ssh2@1.11.13:
     resolution: {integrity: sha512-08WbG68HvQ2YVi74n2iSUnYHYpUdFc/s2IsI0BHBdJwaqYJpWlVv9elL0tYShTv60yr0ObdxJR5NrCRiGJ/0CQ==}
     dependencies:
-      '@types/node': 18.17.1
+      '@types/node': 18.18.1
     dev: true
 
   /@types/stack-utils@2.0.1:
     resolution: {integrity: sha512-Hl219/BT5fLAaz6NDkSuhzasy49dwQS/DSdu4MdggFB8zcXv7vflBI3xp7FEmkmdDkBUI2bPUNeMttp2knYdxw==}
 
-  /@types/testing-library__jest-dom@5.14.9:
-    resolution: {integrity: sha512-FSYhIjFlfOpGSRyVoMBMuS3ws5ehFQODymf3vlI7U1K8c7PHwWwFY7VREfmsuzHSOnoKs/9/Y983ayOs7eRzqw==}
-    dependencies:
-      '@types/jest': 29.5.2
-    dev: true
-
   /@types/tough-cookie@4.0.2:
     resolution: {integrity: sha512-Q5vtl1W5ue16D+nIaW8JWebSSraJVlK+EthKn7e7UcD4KWsaSJ8BqGPXNaPghgtcn/fhvrN17Tv8ksUsQpiplw==}
     dev: false
@@ -5057,8 +6007,8 @@ packages:
     resolution: {integrity: sha512-N1rW+njavs70y2cApeIw1vLMYXRwfBy+7trgavGuuTfOd7j1Yh7QTRc/yqsPl6ncokt72ZXuxEU0PiCp9bSwNQ==}
     dev: true
 
-  /@types/unist@2.0.7:
-    resolution: {integrity: sha512-cputDpIbFgLUaGQn6Vqg3/YsJwxUwHLO13v3i5ouxT4lat0khip9AEWxtERujXV9wxIB1EyF97BSJFt6vpdI8g==}
+  /@types/unist@2.0.8:
+    resolution: {integrity: sha512-d0XxK3YTObnWVp6rZuev3c49+j4Lo8g4L1ZRm9z5L0xpoZycUPshHgczK5gsUMaZOstjVYYi09p5gYvUtfChYw==}
 
   /@types/uuid@9.0.2:
     resolution: {integrity: sha512-kNnC1GFBLuhImSnV7w4njQkUiJi0ZXUycu1rUaouPqiKlXkh77JKgdRnTAp1x5eBwcIwbtI+3otwzuIDEuDoxQ==}
@@ -5082,8 +6032,8 @@ packages:
     dependencies:
       '@types/yargs-parser': 21.0.0
 
-  /@typescript-eslint/eslint-plugin@6.2.1(@typescript-eslint/parser@6.2.1)(eslint@8.46.0)(typescript@5.1.6):
-    resolution: {integrity: sha512-iZVM/ALid9kO0+I81pnp1xmYiFyqibAHzrqX4q5YvvVEyJqY+e6rfTXSCsc2jUxGNqJqTfFSSij/NFkZBiBzLw==}
+  /@typescript-eslint/eslint-plugin@6.7.0(@typescript-eslint/parser@6.7.0)(eslint@8.50.0)(typescript@5.2.2):
+    resolution: {integrity: sha512-gUqtknHm0TDs1LhY12K2NA3Rmlmp88jK9Tx8vGZMfHeNMLE3GH2e9TRub+y+SOjuYgtOmok+wt1AyDPZqxbNag==}
     engines: {node: ^16.0.0 || >=18.0.0}
     peerDependencies:
       '@typescript-eslint/parser': ^6.0.0 || ^6.0.0-alpha
@@ -5093,27 +6043,26 @@ packages:
       typescript:
         optional: true
     dependencies:
-      '@eslint-community/regexpp': 4.6.2
-      '@typescript-eslint/parser': 6.2.1(eslint@8.46.0)(typescript@5.1.6)
-      '@typescript-eslint/scope-manager': 6.2.1
-      '@typescript-eslint/type-utils': 6.2.1(eslint@8.46.0)(typescript@5.1.6)
-      '@typescript-eslint/utils': 6.2.1(eslint@8.46.0)(typescript@5.1.6)
-      '@typescript-eslint/visitor-keys': 6.2.1
+      '@eslint-community/regexpp': 4.8.1
+      '@typescript-eslint/parser': 6.7.0(eslint@8.50.0)(typescript@5.2.2)
+      '@typescript-eslint/scope-manager': 6.7.0
+      '@typescript-eslint/type-utils': 6.7.0(eslint@8.50.0)(typescript@5.2.2)
+      '@typescript-eslint/utils': 6.7.0(eslint@8.50.0)(typescript@5.2.2)
+      '@typescript-eslint/visitor-keys': 6.7.0
       debug: 4.3.4
-      eslint: 8.46.0
+      eslint: 8.50.0
       graphemer: 1.4.0
       ignore: 5.2.4
       natural-compare: 1.4.0
-      natural-compare-lite: 1.4.0
       semver: 7.5.3
-      ts-api-utils: 1.0.1(typescript@5.1.6)
-      typescript: 5.1.6
+      ts-api-utils: 1.0.3(typescript@5.2.2)
+      typescript: 5.2.2
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /@typescript-eslint/parser@6.2.1(eslint@8.46.0)(typescript@5.1.6):
-    resolution: {integrity: sha512-Ld+uL1kYFU8e6btqBFpsHkwQ35rw30IWpdQxgOqOh4NfxSDH6uCkah1ks8R/RgQqI5hHPXMaLy9fbFseIe+dIg==}
+  /@typescript-eslint/parser@6.7.0(eslint@8.50.0)(typescript@5.2.2):
+    resolution: {integrity: sha512-jZKYwqNpNm5kzPVP5z1JXAuxjtl2uG+5NpaMocFPTNC2EdYIgbXIPImObOkhbONxtFTTdoZstLZefbaK+wXZng==}
     engines: {node: ^16.0.0 || >=18.0.0}
     peerDependencies:
       eslint: ^7.0.0 || ^8.0.0
@@ -5122,13 +6071,13 @@ packages:
       typescript:
         optional: true
     dependencies:
-      '@typescript-eslint/scope-manager': 6.2.1
-      '@typescript-eslint/types': 6.2.1
-      '@typescript-eslint/typescript-estree': 6.2.1(typescript@5.1.6)
-      '@typescript-eslint/visitor-keys': 6.2.1
+      '@typescript-eslint/scope-manager': 6.7.0
+      '@typescript-eslint/types': 6.7.0
+      '@typescript-eslint/typescript-estree': 6.7.0(typescript@5.2.2)
+      '@typescript-eslint/visitor-keys': 6.7.0
       debug: 4.3.4
-      eslint: 8.46.0
-      typescript: 5.1.6
+      eslint: 8.50.0
+      typescript: 5.2.2
     transitivePeerDependencies:
       - supports-color
     dev: true
@@ -5140,16 +6089,16 @@ packages:
       '@typescript-eslint/types': 5.62.0
       '@typescript-eslint/visitor-keys': 5.62.0
 
-  /@typescript-eslint/scope-manager@6.2.1:
-    resolution: {integrity: sha512-UCqBF9WFqv64xNsIEPfBtenbfodPXsJ3nPAr55mGPkQIkiQvgoWNo+astj9ZUfJfVKiYgAZDMnM6dIpsxUMp3Q==}
+  /@typescript-eslint/scope-manager@6.7.0:
+    resolution: {integrity: sha512-lAT1Uau20lQyjoLUQ5FUMSX/dS07qux9rYd5FGzKz/Kf8W8ccuvMyldb8hadHdK/qOI7aikvQWqulnEq2nCEYA==}
     engines: {node: ^16.0.0 || >=18.0.0}
     dependencies:
-      '@typescript-eslint/types': 6.2.1
-      '@typescript-eslint/visitor-keys': 6.2.1
+      '@typescript-eslint/types': 6.7.0
+      '@typescript-eslint/visitor-keys': 6.7.0
     dev: true
 
-  /@typescript-eslint/type-utils@6.2.1(eslint@8.46.0)(typescript@5.1.6):
-    resolution: {integrity: sha512-fTfCgomBMIgu2Dh2Or3gMYgoNAnQm3RLtRp+jP7A8fY+LJ2+9PNpi5p6QB5C4RSP+U3cjI0vDlI3mspAkpPVbQ==}
+  /@typescript-eslint/type-utils@6.7.0(eslint@8.50.0)(typescript@5.2.2):
+    resolution: {integrity: sha512-f/QabJgDAlpSz3qduCyQT0Fw7hHpmhOzY/Rv6zO3yO+HVIdPfIWhrQoAyG+uZVtWAIS85zAyzgAFfyEr+MgBpg==}
     engines: {node: ^16.0.0 || >=18.0.0}
     peerDependencies:
       eslint: ^7.0.0 || ^8.0.0
@@ -5158,12 +6107,12 @@ packages:
       typescript:
         optional: true
     dependencies:
-      '@typescript-eslint/typescript-estree': 6.2.1(typescript@5.1.6)
-      '@typescript-eslint/utils': 6.2.1(eslint@8.46.0)(typescript@5.1.6)
+      '@typescript-eslint/typescript-estree': 6.7.0(typescript@5.2.2)
+      '@typescript-eslint/utils': 6.7.0(eslint@8.50.0)(typescript@5.2.2)
       debug: 4.3.4
-      eslint: 8.46.0
-      ts-api-utils: 1.0.1(typescript@5.1.6)
-      typescript: 5.1.6
+      eslint: 8.50.0
+      ts-api-utils: 1.0.3(typescript@5.2.2)
+      typescript: 5.2.2
     transitivePeerDependencies:
       - supports-color
     dev: true
@@ -5172,12 +6121,12 @@ packages:
     resolution: {integrity: sha512-87NVngcbVXUahrRTqIK27gD2t5Cu1yuCXxbLcFtCzZGlfyVWWh8mLHkoxzjsB6DDNnvdL+fW8MiwPEJyGJQDgQ==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
 
-  /@typescript-eslint/types@6.2.1:
-    resolution: {integrity: sha512-528bGcoelrpw+sETlyM91k51Arl2ajbNT9L4JwoXE2dvRe1yd8Q64E4OL7vHYw31mlnVsf+BeeLyAZUEQtqahQ==}
+  /@typescript-eslint/types@6.7.0:
+    resolution: {integrity: sha512-ihPfvOp7pOcN/ysoj0RpBPOx3HQTJTrIN8UZK+WFd3/iDeFHHqeyYxa4hQk4rMhsz9H9mXpR61IzwlBVGXtl9Q==}
     engines: {node: ^16.0.0 || >=18.0.0}
     dev: true
 
-  /@typescript-eslint/typescript-estree@5.62.0(typescript@5.1.6):
+  /@typescript-eslint/typescript-estree@5.62.0(typescript@5.2.2):
     resolution: {integrity: sha512-CmcQ6uY7b9y694lKdRB8FEel7JbU/40iSAPomu++SjLMntB+2Leay2LO6i8VnJk58MtE9/nQSFIH6jpyRWyYzA==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     peerDependencies:
@@ -5192,13 +6141,13 @@ packages:
       globby: 11.1.0
       is-glob: 4.0.3
       semver: 7.5.3
-      tsutils: 3.21.0(typescript@5.1.6)
-      typescript: 5.1.6
+      tsutils: 3.21.0(typescript@5.2.2)
+      typescript: 5.2.2
     transitivePeerDependencies:
       - supports-color
 
-  /@typescript-eslint/typescript-estree@6.2.1(typescript@5.1.6):
-    resolution: {integrity: sha512-G+UJeQx9AKBHRQBpmvr8T/3K5bJa485eu+4tQBxFq0KoT22+jJyzo1B50JDT9QdC1DEmWQfdKsa8ybiNWYsi0Q==}
+  /@typescript-eslint/typescript-estree@6.7.0(typescript@5.2.2):
+    resolution: {integrity: sha512-dPvkXj3n6e9yd/0LfojNU8VMUGHWiLuBZvbM6V6QYD+2qxqInE7J+J/ieY2iGwR9ivf/R/haWGkIj04WVUeiSQ==}
     engines: {node: ^16.0.0 || >=18.0.0}
     peerDependencies:
       typescript: '*'
@@ -5206,50 +6155,50 @@ packages:
       typescript:
         optional: true
     dependencies:
-      '@typescript-eslint/types': 6.2.1
-      '@typescript-eslint/visitor-keys': 6.2.1
+      '@typescript-eslint/types': 6.7.0
+      '@typescript-eslint/visitor-keys': 6.7.0
       debug: 4.3.4
       globby: 11.1.0
       is-glob: 4.0.3
       semver: 7.5.3
-      ts-api-utils: 1.0.1(typescript@5.1.6)
-      typescript: 5.1.6
+      ts-api-utils: 1.0.3(typescript@5.2.2)
+      typescript: 5.2.2
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /@typescript-eslint/utils@5.62.0(eslint@8.46.0)(typescript@5.1.6):
+  /@typescript-eslint/utils@5.62.0(eslint@8.50.0)(typescript@5.2.2):
     resolution: {integrity: sha512-n8oxjeb5aIbPFEtmQxQYOLI0i9n5ySBEY/ZEHHZqKQSFnxio1rv6dthascc9dLuwrL0RC5mPCxB7vnAVGAYWAQ==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     peerDependencies:
       eslint: ^6.0.0 || ^7.0.0 || ^8.0.0
     dependencies:
-      '@eslint-community/eslint-utils': 4.4.0(eslint@8.46.0)
-      '@types/json-schema': 7.0.12
+      '@eslint-community/eslint-utils': 4.4.0(eslint@8.50.0)
+      '@types/json-schema': 7.0.13
       '@types/semver': 7.5.0
       '@typescript-eslint/scope-manager': 5.62.0
       '@typescript-eslint/types': 5.62.0
-      '@typescript-eslint/typescript-estree': 5.62.0(typescript@5.1.6)
-      eslint: 8.46.0
+      '@typescript-eslint/typescript-estree': 5.62.0(typescript@5.2.2)
+      eslint: 8.50.0
       eslint-scope: 5.1.1
       semver: 7.5.3
     transitivePeerDependencies:
       - supports-color
       - typescript
 
-  /@typescript-eslint/utils@6.2.1(eslint@8.46.0)(typescript@5.1.6):
-    resolution: {integrity: sha512-eBIXQeupYmxVB6S7x+B9SdBeB6qIdXKjgQBge2J+Ouv8h9Cxm5dHf/gfAZA6dkMaag+03HdbVInuXMmqFB/lKQ==}
+  /@typescript-eslint/utils@6.7.0(eslint@8.50.0)(typescript@5.2.2):
+    resolution: {integrity: sha512-MfCq3cM0vh2slSikQYqK2Gq52gvOhe57vD2RM3V4gQRZYX4rDPnKLu5p6cm89+LJiGlwEXU8hkYxhqqEC/V3qA==}
     engines: {node: ^16.0.0 || >=18.0.0}
     peerDependencies:
       eslint: ^7.0.0 || ^8.0.0
     dependencies:
-      '@eslint-community/eslint-utils': 4.4.0(eslint@8.46.0)
+      '@eslint-community/eslint-utils': 4.4.0(eslint@8.50.0)
       '@types/json-schema': 7.0.12
       '@types/semver': 7.5.0
-      '@typescript-eslint/scope-manager': 6.2.1
-      '@typescript-eslint/types': 6.2.1
-      '@typescript-eslint/typescript-estree': 6.2.1(typescript@5.1.6)
-      eslint: 8.46.0
+      '@typescript-eslint/scope-manager': 6.7.0
+      '@typescript-eslint/types': 6.7.0
+      '@typescript-eslint/typescript-estree': 6.7.0(typescript@5.2.2)
+      eslint: 8.50.0
       semver: 7.5.3
     transitivePeerDependencies:
       - supports-color
@@ -5261,14 +6210,14 @@ packages:
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     dependencies:
       '@typescript-eslint/types': 5.62.0
-      eslint-visitor-keys: 3.4.2
+      eslint-visitor-keys: 3.4.3
 
-  /@typescript-eslint/visitor-keys@6.2.1:
-    resolution: {integrity: sha512-iTN6w3k2JEZ7cyVdZJTVJx2Lv7t6zFA8DCrJEHD2mwfc16AEvvBWVhbFh34XyG2NORCd0viIgQY1+u7kPI0WpA==}
+  /@typescript-eslint/visitor-keys@6.7.0:
+    resolution: {integrity: sha512-/C1RVgKFDmGMcVGeD8HjKv2bd72oI1KxQDeY8uc66gw9R0OK0eMq48cA+jv9/2Ag6cdrsUGySm1yzYmfz0hxwQ==}
     engines: {node: ^16.0.0 || >=18.0.0}
     dependencies:
-      '@typescript-eslint/types': 6.2.1
-      eslint-visitor-keys: 3.4.2
+      '@typescript-eslint/types': 6.7.0
+      eslint-visitor-keys: 3.4.3
     dev: true
 
   /@vitejs/plugin-react@3.1.0(vite@4.4.2):
@@ -5277,27 +6226,28 @@ packages:
     peerDependencies:
       vite: ^4.1.0-beta.0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/plugin-transform-react-jsx-self': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-react-jsx-source': 7.22.5(@babel/core@7.22.9)
+      '@babel/core': 7.22.11
+      '@babel/plugin-transform-react-jsx-self': 7.22.5(@babel/core@7.22.11)
+      '@babel/plugin-transform-react-jsx-source': 7.22.5(@babel/core@7.22.11)
       magic-string: 0.27.0
       react-refresh: 0.14.0
-      vite: 4.4.2(@types/node@18.17.0)
+      vite: 4.4.2(@types/node@18.18.1)
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /@vitejs/plugin-react@4.0.1(vite@4.4.2):
-    resolution: {integrity: sha512-g25lL98essfeSj43HJ0o4DMp0325XK0ITkxpgChzJU/CyemgyChtlxfnRbjfwxDGCTRxTiXtQAsdebQXKMRSOA==}
+  /@vitejs/plugin-react@4.1.0(vite@4.4.2):
+    resolution: {integrity: sha512-rM0SqazU9iqPUraQ2JlIvReeaxOoRj6n+PzB1C0cBzIbd8qP336nC39/R9yPi3wVcah7E7j/kdU1uCUqMEU4OQ==}
     engines: {node: ^14.18.0 || >=16.0.0}
     peerDependencies:
       vite: ^4.2.0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/plugin-transform-react-jsx-self': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-transform-react-jsx-source': 7.22.5(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/plugin-transform-react-jsx-self': 7.22.5(@babel/core@7.23.0)
+      '@babel/plugin-transform-react-jsx-source': 7.22.5(@babel/core@7.23.0)
+      '@types/babel__core': 7.20.2
       react-refresh: 0.14.0
-      vite: 4.4.2(@types/node@18.17.0)
+      vite: 4.4.2(@types/node@18.18.1)
     transitivePeerDependencies:
       - supports-color
     dev: false
@@ -5326,7 +6276,7 @@ packages:
       - supports-color
     dev: true
 
-  /@xstate/inspect@0.8.0(ws@8.13.0)(xstate@4.38.1):
+  /@xstate/inspect@0.8.0(ws@8.14.2)(xstate@4.38.1):
     resolution: {integrity: sha512-wSkFeOnp+7dhn+zTThO0M4D2FEqZN9lGIWowJu5JLa2ojjtlzRwK8SkjcHZ4rLX8VnMev7kGjgQLrGs8kxy+hw==}
     peerDependencies:
       '@types/ws': ^8.0.0
@@ -5337,7 +6287,7 @@ packages:
         optional: true
     dependencies:
       fast-safe-stringify: 2.1.1
-      ws: 8.13.0
+      ws: 8.14.2
       xstate: 4.38.1
     dev: false
 
@@ -5346,10 +6296,10 @@ packages:
     peerDependencies:
       xstate: ^4
     dependencies:
-      '@babel/parser': 7.22.7
-      '@babel/traverse': 7.22.8
-      '@babel/types': 7.22.5
-      recast: 0.23.3
+      '@babel/parser': 7.23.0
+      '@babel/traverse': 7.23.2
+      '@babel/types': 7.23.0
+      recast: 0.23.4
       xstate: 4.38.2
     transitivePeerDependencies:
       - supports-color
@@ -5386,14 +6336,14 @@ packages:
       - supports-color
     dev: true
 
-  /@yarnpkg/esbuild-plugin-pnp@3.0.0-rc.15(esbuild@0.18.17):
+  /@yarnpkg/esbuild-plugin-pnp@3.0.0-rc.15(esbuild@0.18.20):
     resolution: {integrity: sha512-kYzDJO5CA9sy+on/s2aIW0411AklfCi8Ck/4QDivOqsMKpStZA2SsR+X27VTggGwpStWaLrjJcDcdDMowtG8MA==}
     engines: {node: '>=14.15.0'}
     peerDependencies:
       esbuild: '>=0.10.0'
     dependencies:
-      esbuild: 0.18.17
-      tslib: 2.6.1
+      esbuild: 0.18.20
+      tslib: 2.6.2
     dev: true
 
   /@yarnpkg/fslib@2.10.3:
@@ -5595,7 +6545,7 @@ packages:
     resolution: {integrity: sha512-xcLxITLe2HYa1cnYnwCjkOO1PqUHQpozB8x9AR0OgWN2woOBi5kSDVxKfd0b7sb1hw5qFeJhXm9H1nu3xSfLeQ==}
     engines: {node: '>=10'}
     dependencies:
-      tslib: 2.6.1
+      tslib: 2.6.2
     dev: true
 
   /aria-query@5.1.3:
@@ -5707,7 +6657,7 @@ packages:
   /ast-metadata-inferer@0.8.0:
     resolution: {integrity: sha512-jOMKcHht9LxYIEQu+RVd22vtgrPaVCtDRQ/16IGmurdzxvYbDd5ynxjnyrzLnieG96eTcAyaoj/wN/4/1FyyeA==}
     dependencies:
-      '@mdn/browser-compat-data': 5.3.6
+      '@mdn/browser-compat-data': 5.3.14
     dev: true
 
   /ast-types-flow@0.0.7:
@@ -5718,21 +6668,21 @@ packages:
     resolution: {integrity: sha512-O0yuUDnZeQDL+ncNGlJ78BiO4jnYI3bvMsD5prT0/nsgijG/LpNBIr63gTjVTNsiGkgQhiyCShTgxt8oXOrklA==}
     engines: {node: '>=4'}
     dependencies:
-      tslib: 2.6.1
+      tslib: 2.6.2
     dev: true
 
   /ast-types@0.15.2:
     resolution: {integrity: sha512-c27loCv9QkZinsa5ProX751khO9DJl/AcB5c2KNtA6NRvHKS0PgLfcftz72KVq504vB0Gku5s2kUZzDBvQWvHg==}
     engines: {node: '>=4'}
     dependencies:
-      tslib: 2.6.1
+      tslib: 2.6.2
     dev: true
 
   /ast-types@0.16.1:
     resolution: {integrity: sha512-6t10qk83GOG8p0vKmaCr8eiilZwO171AvbROMtvvNiwrTly62t+7XkA8RdIIVbpMhCASAsxgAzdRSwh6nw/5Dg==}
     engines: {node: '>=4'}
     dependencies:
-      tslib: 2.6.1
+      tslib: 2.6.2
     dev: true
 
   /async-limiter@1.0.1:
@@ -5756,8 +6706,8 @@ packages:
     engines: {node: '>=4'}
     dev: true
 
-  /axios@1.3.4:
-    resolution: {integrity: sha512-toYm+Bsyl6VC5wSkfkbbNB6ROv7KY93PEBBL6xyDczaIHasAiv4wPqQ/c4RjoQzipxRD2W5g21cOqQulZ7rHwQ==}
+  /axios@1.5.0:
+    resolution: {integrity: sha512-D4DdjDo5CY50Qms0qGQTTw6Q44jl7zRwY7bthds06pUGfChBCTcQs+N743eFWGEd6pRTMd6A+I87aWyFV5wiZQ==}
     dependencies:
       follow-redirects: 1.15.2
       form-data: 4.0.0
@@ -5772,25 +6722,25 @@ packages:
       dequal: 2.0.3
     dev: true
 
-  /babel-core@7.0.0-bridge.0(@babel/core@7.22.9):
+  /babel-core@7.0.0-bridge.0(@babel/core@7.22.11):
     resolution: {integrity: sha512-poPX9mZH/5CSanm50Q+1toVci6pv5KSRv/5TWCwtzQS5XEwn40BcCrgIeMFWP9CKKIniKXNxoIOnOq4VVlGXhg==}
     peerDependencies:
       '@babel/core': ^7.0.0-0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
     dev: true
 
-  /babel-jest@29.6.2(@babel/core@7.22.9):
+  /babel-jest@29.6.2(@babel/core@7.22.11):
     resolution: {integrity: sha512-BYCzImLos6J3BH/+HvUCHG1dTf2MzmAB4jaVxHV+29RZLjR29XuYTmsf2sdDwkrb+FczkGo3kOhE7ga6sI0P4A==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     peerDependencies:
       '@babel/core': ^7.8.0
     dependencies:
-      '@babel/core': 7.22.9
-      '@jest/transform': 29.6.2
-      '@types/babel__core': 7.20.1
+      '@babel/core': 7.22.11
+      '@jest/transform': 29.6.4
+      '@types/babel__core': 7.20.2
       babel-plugin-istanbul: 6.1.1
-      babel-preset-jest: 29.5.0(@babel/core@7.22.9)
+      babel-preset-jest: 29.5.0(@babel/core@7.22.11)
       chalk: 4.1.2
       graceful-fs: 4.2.11
       slash: 3.0.0
@@ -5815,86 +6765,86 @@ packages:
     resolution: {integrity: sha512-zSuuuAlTMT4mzLj2nPnUm6fsE6270vdOfnpbJ+RmruU75UhLFvL0N2NgI7xpeS7NaB6hGqmd5pVpGTDYvi4Q3w==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
-      '@babel/template': 7.22.5
-      '@babel/types': 7.22.5
-      '@types/babel__core': 7.20.1
-      '@types/babel__traverse': 7.20.1
+      '@babel/template': 7.22.15
+      '@babel/types': 7.23.0
+      '@types/babel__core': 7.20.2
+      '@types/babel__traverse': 7.20.2
     dev: true
 
   /babel-plugin-macros@3.1.0:
     resolution: {integrity: sha512-Cg7TFGpIr01vOQNODXOOaGz2NpCU5gl8x1qJFbb6hbZxR7XrcE2vtbAsTAbJ7/xwJtUuJEw8K8Zr/AE0LHlesg==}
     engines: {node: '>=10', npm: '>=6'}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       cosmiconfig: 7.1.0
-      resolve: 1.22.3
+      resolve: 1.22.4
     dev: false
 
-  /babel-plugin-polyfill-corejs2@0.4.5(@babel/core@7.22.9):
+  /babel-plugin-polyfill-corejs2@0.4.5(@babel/core@7.23.0):
     resolution: {integrity: sha512-19hwUH5FKl49JEsvyTcoHakh6BE0wgXLLptIyKZ3PijHc/Ci521wygORCUCCred+E/twuqRyAkE02BAWPmsHOg==}
     peerDependencies:
       '@babel/core': ^7.4.0 || ^8.0.0-0 <8.0.0
     dependencies:
       '@babel/compat-data': 7.22.9
-      '@babel/core': 7.22.9
-      '@babel/helper-define-polyfill-provider': 0.4.2(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-define-polyfill-provider': 0.4.2(@babel/core@7.23.0)
       semver: 7.5.3
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /babel-plugin-polyfill-corejs3@0.8.3(@babel/core@7.22.9):
+  /babel-plugin-polyfill-corejs3@0.8.3(@babel/core@7.23.0):
     resolution: {integrity: sha512-z41XaniZL26WLrvjy7soabMXrfPWARN25PZoriDEiLMxAp50AUW3t35BGQUMg5xK3UrpVTtagIDklxYa+MhiNA==}
     peerDependencies:
       '@babel/core': ^7.4.0 || ^8.0.0-0 <8.0.0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-define-polyfill-provider': 0.4.2(@babel/core@7.22.9)
-      core-js-compat: 3.32.0
+      '@babel/core': 7.23.0
+      '@babel/helper-define-polyfill-provider': 0.4.2(@babel/core@7.23.0)
+      core-js-compat: 3.32.1
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /babel-plugin-polyfill-regenerator@0.5.2(@babel/core@7.22.9):
+  /babel-plugin-polyfill-regenerator@0.5.2(@babel/core@7.23.0):
     resolution: {integrity: sha512-tAlOptU0Xj34V1Y2PNTL4Y0FOJMDB6bZmoW39FeCQIhigGLkqu3Fj6uiXpxIf6Ij274ENdYx64y6Au+ZKlb1IA==}
     peerDependencies:
       '@babel/core': ^7.4.0 || ^8.0.0-0 <8.0.0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/helper-define-polyfill-provider': 0.4.2(@babel/core@7.22.9)
+      '@babel/core': 7.23.0
+      '@babel/helper-define-polyfill-provider': 0.4.2(@babel/core@7.23.0)
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /babel-preset-current-node-syntax@1.0.1(@babel/core@7.22.9):
+  /babel-preset-current-node-syntax@1.0.1(@babel/core@7.22.11):
     resolution: {integrity: sha512-M7LQ0bxarkxQoN+vz5aJPsLBn77n8QgTFmo8WK0/44auK2xlCXrYcUxHFxgU7qW5Yzw/CjmLRK2uJzaCd7LvqQ==}
     peerDependencies:
       '@babel/core': ^7.0.0
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.22.9)
-      '@babel/plugin-syntax-bigint': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-class-properties': 7.12.13(@babel/core@7.22.9)
-      '@babel/plugin-syntax-import-meta': 7.10.4(@babel/core@7.22.9)
-      '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.22.9)
-      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.22.9)
-      '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.22.9)
-      '@babel/plugin-syntax-top-level-await': 7.14.5(@babel/core@7.22.9)
-    dev: true
-
-  /babel-preset-jest@29.5.0(@babel/core@7.22.9):
+      '@babel/core': 7.22.11
+      '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.22.11)
+      '@babel/plugin-syntax-bigint': 7.8.3(@babel/core@7.22.11)
+      '@babel/plugin-syntax-class-properties': 7.12.13(@babel/core@7.22.11)
+      '@babel/plugin-syntax-import-meta': 7.10.4(@babel/core@7.22.11)
+      '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.22.11)
+      '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.22.11)
+      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.22.11)
+      '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.22.11)
+      '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.22.11)
+      '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.22.11)
+      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.22.11)
+      '@babel/plugin-syntax-top-level-await': 7.14.5(@babel/core@7.22.11)
+    dev: true
+
+  /babel-preset-jest@29.5.0(@babel/core@7.22.11):
     resolution: {integrity: sha512-JOMloxOqdiBSxMAzjRaH023/vvcaSaec49zvg+2LmNsktC7ei39LTJGw02J+9uUtTZUq6xbLyJ4dxe9sSmIuAg==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     peerDependencies:
       '@babel/core': ^7.0.0
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       babel-plugin-jest-hoist: 29.5.0
-      babel-preset-current-node-syntax: 1.0.1(@babel/core@7.22.9)
+      babel-preset-current-node-syntax: 1.0.1(@babel/core@7.22.11)
     dev: true
 
   /bail@2.0.2:
@@ -5993,15 +6943,15 @@ packages:
       pako: 0.2.9
     dev: true
 
-  /browserslist@4.21.9:
-    resolution: {integrity: sha512-M0MFoZzbUrRU4KNfCrDLnvyE7gub+peetoTid3TBIqtunaDJyXlwhakT+/VkvSXcfIzFfK/nkCs4nmyTmxdNSg==}
+  /browserslist@4.21.10:
+    resolution: {integrity: sha512-bipEBdZfVH5/pwrvqc+Ub0kUPVfGUhlKxbvfD+z1BDnPEO/X98ruXGA1WP5ASpAFKan7Qr6j736IacbZQuAlKQ==}
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
     dependencies:
-      caniuse-lite: 1.0.30001517
-      electron-to-chromium: 1.4.474
+      caniuse-lite: 1.0.30001524
+      electron-to-chromium: 1.4.505
       node-releases: 2.0.13
-      update-browserslist-db: 1.0.11(browserslist@4.21.9)
+      update-browserslist-db: 1.0.11(browserslist@4.21.10)
 
   /bser@2.1.1:
     resolution: {integrity: sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==}
@@ -6036,13 +6986,6 @@ packages:
     engines: {node: '>=6'}
     dev: true
 
-  /bundle-name@3.0.0:
-    resolution: {integrity: sha512-PKA4BeSvBpQKQ8iPOGCSiell+N8P+Tf1DlwqmYhpe2gAhKPHn8EYOxVT+ShuGmhg8lN8XiSlS80yiExKXrURlw==}
-    engines: {node: '>=12'}
-    dependencies:
-      run-applescript: 5.0.0
-    dev: true
-
   /bytes@3.0.0:
     resolution: {integrity: sha512-pMhOfFDPiv9t5jjIXkHosWmkSyQbvsgEVNkz0ERHbuLh2T/7j4Mqqpz523Fe8MVY89KC6Sh/QfS2sM+SjgFDcw==}
     engines: {node: '>= 0.8'}
@@ -6093,8 +7036,8 @@ packages:
     engines: {node: '>=10'}
     dev: true
 
-  /caniuse-lite@1.0.30001517:
-    resolution: {integrity: sha512-Vdhm5S11DaFVLlyiKu4hiUTkpZu+y1KA/rZZqVQfOD5YdDT/eQKlkt7NaE0WGOFgX32diqt9MiP9CAiFeRklaA==}
+  /caniuse-lite@1.0.30001524:
+    resolution: {integrity: sha512-Jj917pJtYg9HSJBF95HVX3Cdr89JUyLT4IZ8SvM5aDRni95swKgYi3TgYLH5hnGfPE/U1dg6IfZ50UsIlLkwSA==}
 
   /canvas@2.11.0:
     resolution: {integrity: sha512-bdTjFexjKJEwtIo0oRx8eD4G2yWoUOXP9lj279jmQ2zMnTQhT8C3512OKz3s+ZOaQlLbE7TuVvRDYDB3Llyy5g==}
@@ -6112,7 +7055,7 @@ packages:
   /case-anything@2.1.13:
     resolution: {integrity: sha512-zlOQ80VrQ2Ue+ymH5OuM/DlDq64mEm+B9UTdHULv5osUMD6HalNTblf2b1u/m6QecjsnOkBpqVZ+XPwIVsy7Ng==}
     engines: {node: '>=12.13'}
-    dev: true
+    dev: false
 
   /ccount@2.0.1:
     resolution: {integrity: sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==}
@@ -6133,14 +7076,6 @@ packages:
       supports-color: 7.2.0
     dev: true
 
-  /chalk@4.1.1:
-    resolution: {integrity: sha512-diHzdDKxcU+bAsUboHLPEDQiw0qEe0qd7SYUn3HgcFlWgbDcfLGswOHYeGrHKzG9z6UYf01d9VFMfZxPM1xZSg==}
-    engines: {node: '>=10'}
-    dependencies:
-      ansi-styles: 4.3.0
-      supports-color: 7.2.0
-    dev: true
-
   /chalk@4.1.2:
     resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
     engines: {node: '>=10'}
@@ -6172,20 +7107,31 @@ packages:
     resolution: {integrity: sha512-mT8iDcrh03qDGRRmoA2hmBJnxpllMR+0/0qlzjqZES6NdiWDcZkCNAk4rPFZ9Q85r27unkiNNg8ZOiwZXBHwcA==}
     dev: true
 
-  /chart.js@3.9.1:
-    resolution: {integrity: sha512-Ro2JbLmvg83gXF5F4sniaQ+lTbSv18E+TIf2cOeiH1Iqd2PGFOtem+DUufMZsCJwFE7ywPOpfXFBwRTGq7dh6w==}
+  /chart.js@4.4.0:
+    resolution: {integrity: sha512-vQEj6d+z0dcsKLlQvbKIMYFHd3t8W/7L2vfJIbYcfyPcRx92CsHqECpueN8qVGNlKyDcr5wBrYAYKnfu/9Q1hQ==}
+    engines: {pnpm: '>=7'}
+    dependencies:
+      '@kurkle/color': 0.3.2
     dev: false
 
-  /chartjs-adapter-date-fns@3.0.0(chart.js@3.9.1)(date-fns@2.30.0):
+  /chartjs-adapter-date-fns@3.0.0(chart.js@4.4.0)(date-fns@2.30.0):
     resolution: {integrity: sha512-Rs3iEB3Q5pJ973J93OBTpnP7qoGwvq3nUnoMdtxO+9aoJof7UFcRbWcIDteXuYd1fgAvct/32T9qaLyLuZVwCg==}
     peerDependencies:
       chart.js: '>=2.8.0'
       date-fns: '>=2.0.0'
     dependencies:
-      chart.js: 3.9.1
+      chart.js: 4.4.0
       date-fns: 2.30.0
     dev: false
 
+  /chartjs-plugin-annotation@3.0.1(chart.js@4.4.0):
+    resolution: {integrity: sha512-hlIrXXKqSDgb+ZjVYHefmlZUXK8KbkCPiynSVrTb/HjTMkT62cOInaT1NTQCKtxKKOm9oHp958DY3RTAFKtkHg==}
+    peerDependencies:
+      chart.js: '>=4.0.0'
+    dependencies:
+      chart.js: 4.4.0
+    dev: false
+
   /chokidar@3.5.3:
     resolution: {integrity: sha512-Dr3sfKRP6oTcjf2JmUmFJfeVMvXBdegxB0iVQ5eb2V10uFJUCAS8OByZdVAyVb8xXNz3GjjTgj9kLWsZTqE6kw==}
     engines: {node: '>= 8.10.0'}
@@ -6198,7 +7144,7 @@ packages:
       normalize-path: 3.0.0
       readdirp: 3.6.0
     optionalDependencies:
-      fsevents: 2.3.2
+      fsevents: 2.3.3
     dev: true
 
   /chownr@1.1.4:
@@ -6213,8 +7159,8 @@ packages:
     resolution: {integrity: sha512-U9eDw6+wt7V8z5NncY2jJfZa+hUH8XEj8FQHgFJTrUFnJfXYf4Ml4adI2vXZOjqRDpFWtYVWypDfZwnJ+HIR4A==}
     dev: false
 
-  /chromatic@6.20.0:
-    resolution: {integrity: sha512-PN00MNAg++kXl9HM4JgTHJAMiJQ+nZYhtmKF+viZ6N//CLN5sZrHK5x5TSj/0z/cMhx2gGtbwgRhLHGGqxpj5w==}
+  /chromatic@7.2.0:
+    resolution: {integrity: sha512-EbuvmsM6XAVFC4EQpqR2AT2PaXY4IS8qWxxg6N10AhpRulfX2b2AtW1hUc88cCosRyztd6esxkBdj3FSKR7zVw==}
     hasBin: true
     dev: true
 
@@ -6226,6 +7172,10 @@ packages:
     resolution: {integrity: sha512-0TNiGstbQmCFwt4akjjBg5pLRTSyj/PkWQ1ZoO2zntmg9yLqSRxwEa4iCfQLGjqhiqBfOJa7W/E8wfGrTDmlZQ==}
     dev: true
 
+  /classnames@2.3.2:
+    resolution: {integrity: sha512-CSbhY4cFEJRe6/GQzIk5qXZ4Jeg5pcsP7b5peFSDpffpe1cqjASH/n9UTjBwOp6XpMSTwQ8Za2K5V02ueA7Tmw==}
+    dev: false
+
   /clean-regexp@1.0.0:
     resolution: {integrity: sha512-GfisEZEJvzKrmGWkvfhgzcz/BllN1USeqD2V6tg14OAOgaCD2Z/PUEuxnAZ/nPvmaHRG7a8y77p1T/IRQ4D1Hw==}
     engines: {node: '>=4'}
@@ -6425,7 +7375,6 @@ packages:
 
   /convert-source-map@2.0.0:
     resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
-    dev: true
 
   /cookie-signature@1.0.6:
     resolution: {integrity: sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==}
@@ -6447,10 +7396,10 @@ packages:
       toggle-selection: 1.0.6
     dev: false
 
-  /core-js-compat@3.32.0:
-    resolution: {integrity: sha512-7a9a3D1k4UCVKnLhrgALyFcP7YCsLOQIxPd0dKjf/6GuPcgyiGP70ewWdCGrSK7evyhymi0qO4EqCmSJofDeYw==}
+  /core-js-compat@3.32.1:
+    resolution: {integrity: sha512-GSvKDv4wE0bPnQtjklV101juQ85g6H3rm5PDP20mqlS5j0kXF3pP97YvAu5hl+uFHqMictp3b2VxOHljWMAtuA==}
     dependencies:
-      browserslist: 4.21.9
+      browserslist: 4.21.10
     dev: true
 
   /core-js@3.32.0:
@@ -6472,13 +7421,13 @@ packages:
       path-type: 4.0.0
       yaml: 1.10.2
 
-  /cpu-features@0.0.8:
-    resolution: {integrity: sha512-BbHBvtYhUhksqTjr6bhNOjGgMnhwhGTQmOoZGD+K7BCaQDCuZl/Ve1ZxUSMRwVC4D/rkCPQ2MAIeYzrWyK7eEg==}
+  /cpu-features@0.0.9:
+    resolution: {integrity: sha512-AKjgn2rP2yJyfbepsmLfiYcmtNn/2eUvocUyM/09yB0YDiz39HteK/5/T4Onf0pmdYDMgkBoGvRLvEguzyL7wQ==}
     engines: {node: '>=10.0.0'}
     requiresBuild: true
     dependencies:
       buildcheck: 0.0.6
-      nan: 2.17.0
+      nan: 2.18.0
     dev: true
     optional: true
 
@@ -6503,22 +7452,22 @@ packages:
     resolution: {integrity: sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==}
     dev: true
 
-  /cron-parser@4.7.0:
-    resolution: {integrity: sha512-BdAELR+MCT2ZWsIBhZKDuUqIUCBjHHulPJnm53OfdRLA4EWBjva3R+KM5NeidJuGsNXdEcZkjC7SCnkW5rAFSA==}
+  /cron-parser@4.9.0:
+    resolution: {integrity: sha512-p0SaNjrHOnQeR8/VnfGbmg9te2kfyYSQ7Sc/j/6DtPL3JQvKxmjO9TSjNFpujqV3vEYYBvNNvXSxzyksBWAx1Q==}
     engines: {node: '>=12.0.0'}
     dependencies:
       luxon: 3.3.0
     dev: false
 
-  /cronstrue@2.28.0:
-    resolution: {integrity: sha512-yByAR5on9i/p26djiSve4l29/AJkjCFDgopq+3gUVrQh2xgb3KKScofwkpf5XcRhuWAX0u0EuEK2nltB5hV1jQ==}
+  /cronstrue@2.32.0:
+    resolution: {integrity: sha512-dmNflOCNJL6lZEj0dp2YhGIPY83VTjFue6d9feFhnNtrER6mAjBrUvSgK95j3IB/xNGpLjaZDIDG6ACKTZr9Yw==}
     hasBin: true
     dev: false
 
   /cross-fetch@3.1.8:
     resolution: {integrity: sha512-cvA+JwZoU0Xq+h6WkMvAUqPEYy92Obet6UdKLfW60qn99ftItKjB5T+BkyWOFWe2pUyfQ+IJHmpOTznqk1M6Kg==}
     dependencies:
-      node-fetch: 2.6.12
+      node-fetch: 2.7.0
     transitivePeerDependencies:
       - encoding
     dev: true
@@ -6553,7 +7502,7 @@ packages:
   /css-vendor@2.0.8:
     resolution: {integrity: sha512-x9Aq0XTInxrkuFeHKbYC7zWY8ai7qJ04Kxd9MnvbC1uO5DagxoHQjm4JvG+vCdXOoFtCjbL2XSZfxmoYa9uQVQ==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       is-in-browser: 1.1.3
     dev: false
 
@@ -6601,7 +7550,6 @@ packages:
     engines: {node: '>=0.11'}
     dependencies:
       '@babel/runtime': 7.22.6
-    dev: false
 
   /dayjs@1.11.4:
     resolution: {integrity: sha512-Zj/lPM5hOvQ1Bf7uAvewDaUcsJoI6JmNqmHhHl3nyumwe0XHwt8sWdOVAPACJzCebL8gQCi+K49w7iKWnGwX9g==}
@@ -6709,16 +7657,6 @@ packages:
       untildify: 4.0.0
     dev: true
 
-  /default-browser@4.0.0:
-    resolution: {integrity: sha512-wX5pXO1+BrhMkSbROFsyxUm0i/cJEScyNhA4PPxc41ICuv05ZZB/MX28s8aZx6xjmatvebIapF6hLEKEcpneUA==}
-    engines: {node: '>=14.16'}
-    dependencies:
-      bundle-name: 3.0.0
-      default-browser-id: 3.0.0
-      execa: 7.2.0
-      titleize: 3.0.0
-    dev: true
-
   /defaults@1.0.4:
     resolution: {integrity: sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==}
     dependencies:
@@ -6729,11 +7667,6 @@ packages:
     resolution: {integrity: sha512-Ds09qNh8yw3khSjiJjiUInaGX9xlqZDY7JVryGxdxV7NPeuqQfplOpQ66yJFZut3jLa5zOwkXw1g9EI2uKh4Og==}
     engines: {node: '>=8'}
 
-  /define-lazy-prop@3.0.0:
-    resolution: {integrity: sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg==}
-    engines: {node: '>=12'}
-    dev: true
-
   /define-properties@1.2.0:
     resolution: {integrity: sha512-xvqAVKGfT1+UAvPwKTVw/njhdQ8ZhXK4lI0bCIuCMrp2up9nPnaDftrLtmpTazqd1o+UY4zgzU+avtMbDP+ldA==}
     engines: {node: '>= 0.4'}
@@ -6791,7 +7724,7 @@ packages:
     resolution: {integrity: sha512-pGjwhsmsp4kL2RTz08wcOlGN83otlqHeD/Z5T8GXZB+/YcpQ/dgo+lbU8ZsGxV0HIvqqxo9l7mqYwyYMD9bKDg==}
     engines: {node: '>=0.10'}
     hasBin: true
-    dev: true
+    dev: false
 
   /detect-libc@2.0.2:
     resolution: {integrity: sha512-UX6sGumvvqSaXgdKGUsgZWqcUyIXZ/vZTrlRT/iobiKhGL0zL4d3osHj3uqllWJK+i+sixDS/3COVEOFbupFyw==}
@@ -6824,21 +7757,16 @@ packages:
       - supports-color
     dev: true
 
-  /diff-sequences@27.5.1:
-    resolution: {integrity: sha512-k1gCAXAsNgLwEL+Y8Wvl+M6oEFj5bgazfZULpS5CneoPPXRaCCW7dm+q21Ky2VEE5X+VeRDBVg1Pcvvsr4TtNQ==}
-    engines: {node: ^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0}
-    dev: true
-
-  /diff-sequences@28.1.1:
-    resolution: {integrity: sha512-FU0iFaH/E23a+a718l8Qa/19bF9p06kgE0KipMOMadwa3SjnaElKzPaUC0vnibs6/B/9ni97s61mcejk8W1fQw==}
-    engines: {node: ^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0}
-    dev: true
-
   /diff-sequences@29.4.3:
     resolution: {integrity: sha512-ofrBgwpPhCD85kMKtE9RYFFq6OC1A89oW2vvgWZNCwxrUpRUILopY7lsYyMDSjc8g6U6aiO0Qubg6r4Wgt5ZnA==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dev: true
 
+  /diff-sequences@29.6.3:
+    resolution: {integrity: sha512-EjePK1srD3P08o2j4f0ExnylqRs5B9tJjcp9t1krH2qRi8CCdsYfwe9JgSLurFBWwq4uOlipzfk5fHNvwFKr8Q==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    dev: true
+
   /diff@4.0.2:
     resolution: {integrity: sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==}
     engines: {node: '>=0.3.1'}
@@ -6874,7 +7802,7 @@ packages:
   /dom-helpers@5.2.1:
     resolution: {integrity: sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       csstype: 3.1.2
     dev: false
 
@@ -6906,11 +7834,11 @@ packages:
     engines: {node: '>=12'}
     dev: true
 
-  /dprint-node@1.0.7:
-    resolution: {integrity: sha512-NTZOW9A7ipb0n7z7nC3wftvsbceircwVHSgzobJsEQa+7RnOMbhrfX5IflA6CtC4GA63DSAiHYXa4JKEy9F7cA==}
+  /dprint-node@1.0.8:
+    resolution: {integrity: sha512-iVKnUtYfGrYcW1ZAlfR/F59cUVL8QIhWoBJoSjkkdua/dkWIgjZfiLMeTjiB06X0ZLkQ0M2C1VbUj/CxkIf1zg==}
     dependencies:
       detect-libc: 1.0.3
-    dev: true
+    dev: false
 
   /duplexify@3.7.1:
     resolution: {integrity: sha512-07z8uv2wMyS51kKhD1KsdXJg5WQ6t93RneqRxUHnskXVtlYYkLqM0gqStQZ3pj073g687jPCHrqNfCzawLYh5g==}
@@ -6937,8 +7865,8 @@ packages:
       jake: 10.8.7
     dev: true
 
-  /electron-to-chromium@1.4.474:
-    resolution: {integrity: sha512-GsFT9gtxkFMkpHf13UeN/RFbWdLQVs4DMxA1aQv4xdUAT2qyXEoAQ0hodl2sUvWmztOlicM1UYnNPcoMdzQB5A==}
+  /electron-to-chromium@1.4.505:
+    resolution: {integrity: sha512-0A50eL5BCCKdxig2SsCXhpuztnB9PfUgRMojj5tMvt8O54lbwz3t6wNgnpiTRosw5QjlJB7ixhVyeg8daLQwSQ==}
 
   /emittery@0.13.1:
     resolution: {integrity: sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==}
@@ -7096,13 +8024,24 @@ packages:
     resolution: {integrity: sha512-jyfL/pwPqaFXyKnj8lP8iLk6Z0m099uXR45aSN8Av1XD4vhvQutxxPzgA2bTcAwQpa1zCXDcWOlhFgyP3GKqhQ==}
     dev: true
 
-  /esbuild-register@3.4.2(esbuild@0.18.17):
+  /esbuild-register@3.4.2(esbuild@0.18.20):
     resolution: {integrity: sha512-kG/XyTDyz6+YDuyfB9ZoSIOOmgyFCH+xPRtsCa8W85HLRV5Csp+o3jWVbOSHgSLfyLc5DmP+KFDNwty4mEjC+Q==}
     peerDependencies:
       esbuild: '>=0.12 <1'
     dependencies:
       debug: 4.3.4
-      esbuild: 0.18.17
+      esbuild: 0.18.20
+    transitivePeerDependencies:
+      - supports-color
+    dev: true
+
+  /esbuild-register@3.5.0(esbuild@0.18.20):
+    resolution: {integrity: sha512-+4G/XmakeBAsvJuDugJvtyF1x+XJT4FMocynNpxrvEBViirpfUn2PgNpCHedfWhF4WokNsO/OvMKrmJOIJsI5A==}
+    peerDependencies:
+      esbuild: '>=0.12 <1'
+    dependencies:
+      debug: 4.3.4
+      esbuild: 0.18.20
     transitivePeerDependencies:
       - supports-color
     dev: true
@@ -7136,6 +8075,36 @@ packages:
       '@esbuild/win32-ia32': 0.18.17
       '@esbuild/win32-x64': 0.18.17
 
+  /esbuild@0.18.20:
+    resolution: {integrity: sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA==}
+    engines: {node: '>=12'}
+    hasBin: true
+    requiresBuild: true
+    optionalDependencies:
+      '@esbuild/android-arm': 0.18.20
+      '@esbuild/android-arm64': 0.18.20
+      '@esbuild/android-x64': 0.18.20
+      '@esbuild/darwin-arm64': 0.18.20
+      '@esbuild/darwin-x64': 0.18.20
+      '@esbuild/freebsd-arm64': 0.18.20
+      '@esbuild/freebsd-x64': 0.18.20
+      '@esbuild/linux-arm': 0.18.20
+      '@esbuild/linux-arm64': 0.18.20
+      '@esbuild/linux-ia32': 0.18.20
+      '@esbuild/linux-loong64': 0.18.20
+      '@esbuild/linux-mips64el': 0.18.20
+      '@esbuild/linux-ppc64': 0.18.20
+      '@esbuild/linux-riscv64': 0.18.20
+      '@esbuild/linux-s390x': 0.18.20
+      '@esbuild/linux-x64': 0.18.20
+      '@esbuild/netbsd-x64': 0.18.20
+      '@esbuild/openbsd-x64': 0.18.20
+      '@esbuild/sunos-x64': 0.18.20
+      '@esbuild/win32-arm64': 0.18.20
+      '@esbuild/win32-ia32': 0.18.20
+      '@esbuild/win32-x64': 0.18.20
+    dev: true
+
   /escalade@3.1.1:
     resolution: {integrity: sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==}
     engines: {node: '>=6'}
@@ -7171,27 +8140,27 @@ packages:
     optionalDependencies:
       source-map: 0.6.1
 
-  /eslint-config-prettier@8.9.0(eslint@8.46.0):
-    resolution: {integrity: sha512-+sbni7NfVXnOpnRadUA8S28AUlsZt9GjgFvABIRL9Hkn8KqNzOp+7Lw4QWtrwn20KzU3wqu1QoOj2m+7rKRqkA==}
+  /eslint-config-prettier@9.0.0(eslint@8.50.0):
+    resolution: {integrity: sha512-IcJsTkJae2S35pRsRAwoCE+925rJJStOdkKnLVgtE+tEpqU0EVVM7OqrwxqgptKdX29NUwC82I5pXsGFIgSevw==}
     hasBin: true
     peerDependencies:
       eslint: '>=7.0.0'
     dependencies:
-      eslint: 8.46.0
+      eslint: 8.50.0
     dev: true
 
   /eslint-import-resolver-node@0.3.7:
     resolution: {integrity: sha512-gozW2blMLJCeFpBwugLTGyvVjNoeo1knonXAcatC6bjPBZitotxdWf7Gimr25N4c0AAOo4eOUfaG82IJPDpqCA==}
     dependencies:
       debug: 3.2.7
-      is-core-module: 2.12.1
-      resolve: 1.22.3
+      is-core-module: 2.13.0
+      resolve: 1.22.4
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /eslint-import-resolver-typescript@3.5.5(@typescript-eslint/parser@6.2.1)(eslint-plugin-import@2.28.0)(eslint@8.46.0):
-    resolution: {integrity: sha512-TdJqPHs2lW5J9Zpe17DZNQuDnox4xo2o+0tE7Pggain9Rbc19ik8kFtXdxZ250FVx2kF4vlt2RSf4qlUpG7bhw==}
+  /eslint-import-resolver-typescript@3.6.0(@typescript-eslint/parser@6.7.0)(eslint-plugin-import@2.28.0)(eslint@8.50.0):
+    resolution: {integrity: sha512-QTHR9ddNnn35RTxlaEnx2gCxqFlF2SEN0SE2d17SqwyM7YOSI2GHWRYp5BiRkObTUNYPupC/3Fq2a0PpT+EKpg==}
     engines: {node: ^14.18.0 || >=16.0.0}
     peerDependencies:
       eslint: '*'
@@ -7199,14 +8168,13 @@ packages:
     dependencies:
       debug: 4.3.4
       enhanced-resolve: 5.15.0
-      eslint: 8.46.0
-      eslint-module-utils: 2.8.0(@typescript-eslint/parser@6.2.1)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.46.0)
-      eslint-plugin-import: 2.28.0(@typescript-eslint/parser@6.2.1)(eslint-import-resolver-typescript@3.5.5)(eslint@8.46.0)
-      get-tsconfig: 4.6.2
-      globby: 13.2.2
-      is-core-module: 2.12.1
+      eslint: 8.50.0
+      eslint-module-utils: 2.8.0(@typescript-eslint/parser@6.7.0)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.6.0)(eslint@8.50.0)
+      eslint-plugin-import: 2.28.0(@typescript-eslint/parser@6.7.0)(eslint-import-resolver-typescript@3.6.0)(eslint@8.50.0)
+      fast-glob: 3.3.1
+      get-tsconfig: 4.7.0
+      is-core-module: 2.13.0
       is-glob: 4.0.3
-      synckit: 0.8.5
     transitivePeerDependencies:
       - '@typescript-eslint/parser'
       - eslint-import-resolver-node
@@ -7214,7 +8182,7 @@ packages:
       - supports-color
     dev: true
 
-  /eslint-module-utils@2.8.0(@typescript-eslint/parser@6.2.1)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.46.0):
+  /eslint-module-utils@2.8.0(@typescript-eslint/parser@6.7.0)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.6.0)(eslint@8.50.0):
     resolution: {integrity: sha512-aWajIYfsqCKRDgUfjEXNN/JlrzauMuSEy5sbd7WXbtW3EH6A6MpwEh42c7qD+MqQo9QMJ6fWLAeIJynx0g6OAw==}
     engines: {node: '>=4'}
     peerDependencies:
@@ -7235,44 +8203,43 @@ packages:
       eslint-import-resolver-webpack:
         optional: true
     dependencies:
-      '@typescript-eslint/parser': 6.2.1(eslint@8.46.0)(typescript@5.1.6)
+      '@typescript-eslint/parser': 6.7.0(eslint@8.50.0)(typescript@5.2.2)
       debug: 3.2.7
-      eslint: 8.46.0
+      eslint: 8.50.0
       eslint-import-resolver-node: 0.3.7
-      eslint-import-resolver-typescript: 3.5.5(@typescript-eslint/parser@6.2.1)(eslint-plugin-import@2.28.0)(eslint@8.46.0)
+      eslint-import-resolver-typescript: 3.6.0(@typescript-eslint/parser@6.7.0)(eslint-plugin-import@2.28.0)(eslint@8.50.0)
     transitivePeerDependencies:
       - supports-color
     dev: true
 
-  /eslint-plugin-compat@4.1.4(eslint@8.46.0):
-    resolution: {integrity: sha512-RxySWBmzfIROLFKgeJBJue2BU/6vM2KJWXWAUq+oW4QtrsZXRxbjgxmO1OfF3sHcRuuIenTS/wgo3GyUWZF24w==}
+  /eslint-plugin-compat@4.2.0(eslint@8.50.0):
+    resolution: {integrity: sha512-RDKSYD0maWy5r7zb5cWQS+uSPc26mgOzdORJ8hxILmWM7S/Ncwky7BcAtXVY5iRbKjBdHsWU8Yg7hfoZjtkv7w==}
     engines: {node: '>=14.x'}
     peerDependencies:
       eslint: ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
     dependencies:
-      '@mdn/browser-compat-data': 5.3.6
-      '@tsconfig/node14': 1.0.3
+      '@mdn/browser-compat-data': 5.3.14
       ast-metadata-inferer: 0.8.0
-      browserslist: 4.21.9
-      caniuse-lite: 1.0.30001517
-      eslint: 8.46.0
+      browserslist: 4.21.10
+      caniuse-lite: 1.0.30001524
+      eslint: 8.50.0
       find-up: 5.0.0
       lodash.memoize: 4.1.2
       semver: 7.5.3
     dev: true
 
-  /eslint-plugin-eslint-comments@3.2.0(eslint@8.46.0):
+  /eslint-plugin-eslint-comments@3.2.0(eslint@8.50.0):
     resolution: {integrity: sha512-0jkOl0hfojIHHmEHgmNdqv4fmh7300NdpA9FFpF7zaoLvB/QeXOGNLIo86oAveJFrfB1p05kC8hpEMHM8DwWVQ==}
     engines: {node: '>=6.5.0'}
     peerDependencies:
       eslint: '>=4.19.1'
     dependencies:
       escape-string-regexp: 1.0.5
-      eslint: 8.46.0
+      eslint: 8.50.0
       ignore: 5.2.4
     dev: true
 
-  /eslint-plugin-import@2.28.0(@typescript-eslint/parser@6.2.1)(eslint-import-resolver-typescript@3.5.5)(eslint@8.46.0):
+  /eslint-plugin-import@2.28.0(@typescript-eslint/parser@6.7.0)(eslint-import-resolver-typescript@3.6.0)(eslint@8.50.0):
     resolution: {integrity: sha512-B8s/n+ZluN7sxj9eUf7/pRFERX0r5bnFA2dCaLHy2ZeaQEAz0k+ZZkFWRFHJAqxfxQDx6KLv9LeIki7cFdwW+Q==}
     engines: {node: '>=4'}
     peerDependencies:
@@ -7282,16 +8249,16 @@ packages:
       '@typescript-eslint/parser':
         optional: true
     dependencies:
-      '@typescript-eslint/parser': 6.2.1(eslint@8.46.0)(typescript@5.1.6)
+      '@typescript-eslint/parser': 6.7.0(eslint@8.50.0)(typescript@5.2.2)
       array-includes: 3.1.6
       array.prototype.findlastindex: 1.2.2
       array.prototype.flat: 1.3.1
       array.prototype.flatmap: 1.3.1
       debug: 3.2.7
       doctrine: 2.1.0
-      eslint: 8.46.0
+      eslint: 8.50.0
       eslint-import-resolver-node: 0.3.7
-      eslint-module-utils: 2.8.0(@typescript-eslint/parser@6.2.1)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.5.5)(eslint@8.46.0)
+      eslint-module-utils: 2.8.0(@typescript-eslint/parser@6.7.0)(eslint-import-resolver-node@0.3.7)(eslint-import-resolver-typescript@3.6.0)(eslint@8.50.0)
       has: 1.0.3
       is-core-module: 2.12.1
       is-glob: 4.0.3
@@ -7308,11 +8275,11 @@ packages:
       - supports-color
     dev: true
 
-  /eslint-plugin-jest@27.2.2(@typescript-eslint/eslint-plugin@6.2.1)(eslint@8.46.0)(jest@29.6.2)(typescript@5.1.6):
-    resolution: {integrity: sha512-euzbp06F934Z7UDl5ZUaRPLAc9MKjh0rMPERrHT7UhlCEwgb25kBj37TvMgWeHZVkR5I9CayswrpoaqZU1RImw==}
+  /eslint-plugin-jest@27.4.0(@typescript-eslint/eslint-plugin@6.7.0)(eslint@8.50.0)(jest@29.6.2)(typescript@5.2.2):
+    resolution: {integrity: sha512-ukVeKmMPAUA5SWjHenvyyXnirKfHKMdOsTZdn5tZx5EW05HGVQwBohigjFZGGj3zuv1cV6hc82FvWv6LdIbkgg==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     peerDependencies:
-      '@typescript-eslint/eslint-plugin': ^5.0.0
+      '@typescript-eslint/eslint-plugin': ^5.0.0 || ^6.0.0
       eslint: ^7.0.0 || ^8.0.0
       jest: '*'
     peerDependenciesMeta:
@@ -7321,16 +8288,16 @@ packages:
       jest:
         optional: true
     dependencies:
-      '@typescript-eslint/eslint-plugin': 6.2.1(@typescript-eslint/parser@6.2.1)(eslint@8.46.0)(typescript@5.1.6)
-      '@typescript-eslint/utils': 5.62.0(eslint@8.46.0)(typescript@5.1.6)
-      eslint: 8.46.0
-      jest: 29.6.2(@types/node@18.17.0)(ts-node@10.9.1)
+      '@typescript-eslint/eslint-plugin': 6.7.0(@typescript-eslint/parser@6.7.0)(eslint@8.50.0)(typescript@5.2.2)
+      '@typescript-eslint/utils': 5.62.0(eslint@8.50.0)(typescript@5.2.2)
+      eslint: 8.50.0
+      jest: 29.6.2(@types/node@18.18.1)(ts-node@10.9.1)
     transitivePeerDependencies:
       - supports-color
       - typescript
     dev: true
 
-  /eslint-plugin-jsx-a11y@6.7.1(eslint@8.46.0):
+  /eslint-plugin-jsx-a11y@6.7.1(eslint@8.50.0):
     resolution: {integrity: sha512-63Bog4iIethyo8smBklORknVjB0T2dwB8Mr/hIC+fBS0uyHdYYpzM/Ed+YC8VxTjlXHEWFOdmgwcDn1U2L9VCA==}
     engines: {node: '>=4.0'}
     peerDependencies:
@@ -7345,7 +8312,7 @@ packages:
       axobject-query: 3.2.1
       damerau-levenshtein: 1.0.8
       emoji-regex: 9.2.2
-      eslint: 8.46.0
+      eslint: 8.50.0
       has: 1.0.3
       jsx-ast-utils: 3.3.4
       language-tags: 1.0.5
@@ -7355,16 +8322,16 @@ packages:
       semver: 7.5.3
     dev: true
 
-  /eslint-plugin-react-hooks@4.6.0(eslint@8.46.0):
+  /eslint-plugin-react-hooks@4.6.0(eslint@8.50.0):
     resolution: {integrity: sha512-oFc7Itz9Qxh2x4gNHStv3BqJq54ExXmfC+a1NjAta66IAN87Wu0R/QArgIS9qKzX3dXKPI9H5crl9QchNMY9+g==}
     engines: {node: '>=10'}
     peerDependencies:
       eslint: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0
     dependencies:
-      eslint: 8.46.0
+      eslint: 8.50.0
     dev: true
 
-  /eslint-plugin-react@7.33.0(eslint@8.46.0):
+  /eslint-plugin-react@7.33.0(eslint@8.50.0):
     resolution: {integrity: sha512-qewL/8P34WkY8jAqdQxsiL82pDUeT7nhs8IsuXgfgnsEloKCT4miAV9N9kGtx7/KM9NH/NCGUE7Edt9iGxLXFw==}
     engines: {node: '>=4'}
     peerDependencies:
@@ -7374,7 +8341,7 @@ packages:
       array.prototype.flatmap: 1.3.1
       array.prototype.tosorted: 1.1.1
       doctrine: 2.1.0
-      eslint: 8.46.0
+      eslint: 8.50.0
       estraverse: 5.3.0
       jsx-ast-utils: 3.3.4
       minimatch: 3.1.2
@@ -7388,15 +8355,15 @@ packages:
       string.prototype.matchall: 4.0.8
     dev: true
 
-  /eslint-plugin-storybook@0.6.12(eslint@8.46.0)(typescript@5.1.6):
+  /eslint-plugin-storybook@0.6.12(eslint@8.50.0)(typescript@5.2.2):
     resolution: {integrity: sha512-XbIvrq6hNVG6rpdBr+eBw63QhOMLpZneQVSooEDow8aQCWGCk/5vqtap1yxpVydNfSxi3S/3mBBRLQqKUqQRww==}
     engines: {node: 12.x || 14.x || >= 16}
     peerDependencies:
       eslint: '>=6'
     dependencies:
       '@storybook/csf': 0.0.1
-      '@typescript-eslint/utils': 5.62.0(eslint@8.46.0)(typescript@5.1.6)
-      eslint: 8.46.0
+      '@typescript-eslint/utils': 5.62.0(eslint@8.50.0)(typescript@5.2.2)
+      eslint: 8.50.0
       requireindex: 1.2.0
       ts-dedent: 2.2.0
     transitivePeerDependencies:
@@ -7404,30 +8371,30 @@ packages:
       - typescript
     dev: true
 
-  /eslint-plugin-testing-library@5.11.0(eslint@8.46.0)(typescript@5.1.6):
-    resolution: {integrity: sha512-ELY7Gefo+61OfXKlQeXNIDVVLPcvKTeiQOoMZG9TeuWa7Ln4dUNRv8JdRWBQI9Mbb427XGlVB1aa1QPZxBJM8Q==}
+  /eslint-plugin-testing-library@6.0.1(eslint@8.50.0)(typescript@5.2.2):
+    resolution: {integrity: sha512-CEYtjpcF3hAaQtYsTZqciR7s5z+T0LCMTwJeW+pz6kBnGtc866wAKmhaiK2Gsjc2jWNP7Gt6zhNr2DE1ZW4e+g==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0, npm: '>=6'}
     peerDependencies:
       eslint: ^7.5.0 || ^8.0.0
     dependencies:
-      '@typescript-eslint/utils': 5.62.0(eslint@8.46.0)(typescript@5.1.6)
-      eslint: 8.46.0
+      '@typescript-eslint/utils': 5.62.0(eslint@8.50.0)(typescript@5.2.2)
+      eslint: 8.50.0
     transitivePeerDependencies:
       - supports-color
       - typescript
     dev: false
 
-  /eslint-plugin-unicorn@48.0.0(eslint@8.46.0):
+  /eslint-plugin-unicorn@48.0.0(eslint@8.50.0):
     resolution: {integrity: sha512-8fk/v3p1ro34JSVDBEmtOq6EEQRpMR0iTir79q69KnXFZ6DJyPkT3RAi+ZoTqhQMdDSpGh8BGR68ne1sP5cnAA==}
     engines: {node: '>=16'}
     peerDependencies:
       eslint: '>=8.44.0'
     dependencies:
       '@babel/helper-validator-identifier': 7.22.5
-      '@eslint-community/eslint-utils': 4.4.0(eslint@8.46.0)
+      '@eslint-community/eslint-utils': 4.4.0(eslint@8.50.0)
       ci-info: 3.8.0
       clean-regexp: 1.0.0
-      eslint: 8.46.0
+      eslint: 8.50.0
       esquery: 1.5.0
       indent-string: 4.0.0
       is-builtin-module: 3.2.1
@@ -7455,20 +8422,20 @@ packages:
       esrecurse: 4.3.0
       estraverse: 5.3.0
 
-  /eslint-visitor-keys@3.4.2:
-    resolution: {integrity: sha512-8drBzUEyZ2llkpCA67iYrgEssKDUu68V8ChqqOfFupIaG/LCVPUT+CoGJpT77zJprs4T/W7p07LP7zAIMuweVw==}
+  /eslint-visitor-keys@3.4.3:
+    resolution: {integrity: sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
 
-  /eslint@8.46.0:
-    resolution: {integrity: sha512-cIO74PvbW0qU8e0mIvk5IV3ToWdCq5FYG6gWPHHkx6gNdjlbAYvtfHmlCMXxjcoVaIdwy/IAt3+mDkZkfvb2Dg==}
+  /eslint@8.50.0:
+    resolution: {integrity: sha512-FOnOGSuFuFLv/Sa+FDVRZl4GGVAAFFi8LecRsI5a1tMO5HIE8nCm4ivAlzt4dT3ol/PaaGC0rJEEXQmHJBGoOg==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     hasBin: true
     dependencies:
-      '@eslint-community/eslint-utils': 4.4.0(eslint@8.46.0)
-      '@eslint-community/regexpp': 4.6.2
-      '@eslint/eslintrc': 2.1.1
-      '@eslint/js': 8.46.0
-      '@humanwhocodes/config-array': 0.11.10
+      '@eslint-community/eslint-utils': 4.4.0(eslint@8.50.0)
+      '@eslint-community/regexpp': 4.9.0
+      '@eslint/eslintrc': 2.1.2
+      '@eslint/js': 8.50.0
+      '@humanwhocodes/config-array': 0.11.11
       '@humanwhocodes/module-importer': 1.0.1
       '@nodelib/fs.walk': 1.2.8
       ajv: 6.12.6
@@ -7478,7 +8445,7 @@ packages:
       doctrine: 3.0.0
       escape-string-regexp: 4.0.0
       eslint-scope: 7.2.2
-      eslint-visitor-keys: 3.4.2
+      eslint-visitor-keys: 3.4.3
       espree: 9.6.1
       esquery: 1.5.0
       esutils: 2.0.3
@@ -7486,7 +8453,7 @@ packages:
       file-entry-cache: 6.0.1
       find-up: 5.0.0
       glob-parent: 6.0.2
-      globals: 13.20.0
+      globals: 13.22.0
       graphemer: 1.4.0
       ignore: 5.2.4
       imurmurhash: 0.1.4
@@ -7510,7 +8477,7 @@ packages:
     dependencies:
       acorn: 8.10.0
       acorn-jsx: 5.3.2(acorn@8.10.0)
-      eslint-visitor-keys: 3.4.2
+      eslint-visitor-keys: 3.4.3
 
   /esprima@4.0.1:
     resolution: {integrity: sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==}
@@ -7541,8 +8508,8 @@ packages:
     resolution: {integrity: sha512-YNF+mZ/Wu2FU/gvmzuWtYc8rloubL7wfXCTgouFrnjGVXPA/EeYYA7pupXWrb3Iv1cTBeSSxxJIbK23l4MRNqg==}
     engines: {node: '>=8.3.0'}
     dependencies:
-      '@babel/traverse': 7.22.8
-      '@babel/types': 7.22.5
+      '@babel/traverse': 7.23.2
+      '@babel/types': 7.23.0
       c8: 7.14.0
     transitivePeerDependencies:
       - supports-color
@@ -7585,21 +8552,6 @@ packages:
       strip-final-newline: 2.0.0
     dev: true
 
-  /execa@7.2.0:
-    resolution: {integrity: sha512-UduyVP7TLB5IcAQl+OzLyLcS/l32W/GLg+AhHJ+ow40FOk2U3SAllPwR44v4vmdFwIWqpdwxxpQbF1n5ta9seA==}
-    engines: {node: ^14.18.0 || ^16.14.0 || >=18.0.0}
-    dependencies:
-      cross-spawn: 7.0.3
-      get-stream: 6.0.1
-      human-signals: 4.3.1
-      is-stream: 3.0.0
-      merge-stream: 2.0.0
-      npm-run-path: 5.1.0
-      onetime: 6.0.0
-      signal-exit: 3.0.7
-      strip-final-newline: 3.0.0
-    dev: true
-
   /exit@0.1.2:
     resolution: {integrity: sha512-Zk/eNKV2zbjpKzrsQ+n1G6poVbErQxJ0LBOJXaKZ1EViLzH+hrLu9cdXI4zw9dBQJslwBEpbQ2P1oS7nDxs6jQ==}
     engines: {node: '>= 0.8.0'}
@@ -7610,11 +8562,11 @@ packages:
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
       '@jest/expect-utils': 29.6.2
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       jest-get-type: 29.4.3
       jest-matcher-utils: 29.6.2
       jest-message-util: 29.6.2
-      jest-util: 29.6.2
+      jest-util: 29.6.3
     dev: true
 
   /express@4.18.2:
@@ -7753,7 +8705,7 @@ packages:
     resolution: {integrity: sha512-7Gps/XWymbLk2QLYK4NzpMOrYjMhdIxXuIvy2QBsLE6ljuodKvdkWs/cpyJJ3CVIVpH0Oi1Hvg1ovbMzLdFBBg==}
     engines: {node: ^10.12.0 || >=12.0.0}
     dependencies:
-      flat-cache: 3.0.4
+      flat-cache: 3.1.0
 
   /file-system-cache@2.3.0:
     resolution: {integrity: sha512-l4DMNdsIPsVnKrgEXbJwDJsA5mB8rGwHYERMgqQx/xAUtChPJMre1bXBzDEqqVbWv9AIbFezXMxeEkZDSrXUOQ==}
@@ -7833,18 +8785,19 @@ packages:
       locate-path: 6.0.0
       path-exists: 4.0.0
 
-  /flat-cache@3.0.4:
-    resolution: {integrity: sha512-dm9s5Pw7Jc0GvMYbshN6zchCA9RgQlzzEZX3vylR9IqFfS8XciblUXOKfW6SiuJ0e13eDYZoZV5wdrev7P3Nwg==}
-    engines: {node: ^10.12.0 || >=12.0.0}
+  /flat-cache@3.1.0:
+    resolution: {integrity: sha512-OHx4Qwrrt0E4jEIcI5/Xb+f+QmJYNj2rrK8wiIdQOIrB9WrrJL8cjZvXdXuBTkkEwEqLycb5BeZDV1o2i9bTew==}
+    engines: {node: '>=12.0.0'}
     dependencies:
-      flatted: 3.2.7
+      flatted: 3.2.9
+      keyv: 4.5.3
       rimraf: 3.0.2
 
-  /flatted@3.2.7:
-    resolution: {integrity: sha512-5nqDSxl8nn5BSNxyR3n4I6eDmbolI6WT+QqR547RwxQapgjQBmtktdP+HTBb/a/zLsbzERTONyUB5pefh5TtjQ==}
+  /flatted@3.2.9:
+    resolution: {integrity: sha512-36yxDn5H7OFZQla0/jFJmbIKTdZAQHngCedGxiMmpNfEZM0sdEeT+WczLQrjK6D7o2aiyLYDnkw0R3JK0Qv1RQ==}
 
-  /flow-parser@0.213.1:
-    resolution: {integrity: sha512-l+vyZO6hrWG60DredryA8mq62fK9vxL6/RR13HA/aVLBNh9No/wEJsKI+CJqPRkF4CIRUfcJQBeaMXSKcncxUQ==}
+  /flow-parser@0.215.1:
+    resolution: {integrity: sha512-qq3rdRToqwesrddyXf+Ml8Tuf7TdoJS+EMbJgC6fHAVoBCXjb4mHelNd3J+jD8ts0bSHX81FG3LN7Qn/dcl6pA==}
     engines: {node: '>=0.4.0'}
     dev: true
 
@@ -7877,7 +8830,7 @@ packages:
     engines: {node: '>=14'}
     dependencies:
       cross-spawn: 7.0.3
-      signal-exit: 4.0.2
+      signal-exit: 4.1.0
     dev: true
 
   /form-data@3.0.1:
@@ -7896,7 +8849,6 @@ packages:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       mime-types: 2.1.35
-    dev: false
 
   /format@0.2.2:
     resolution: {integrity: sha512-wzsgA6WOq+09wrU1tsJ09udeR/YZRaeArL9e1wPbFg3GG2yDnC2ldKpxs4xunpFF9DgqCqOIra3bc1HWrJ37Ww==}
@@ -7961,6 +8913,14 @@ packages:
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
     os: [darwin]
     requiresBuild: true
+    dev: true
+    optional: true
+
+  /fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+    requiresBuild: true
     optional: true
 
   /function-bind@1.1.1:
@@ -8045,8 +9005,8 @@ packages:
       get-intrinsic: 1.2.1
     dev: true
 
-  /get-tsconfig@4.6.2:
-    resolution: {integrity: sha512-E5XrT4CbbXcXWy+1jChlZmrmCwd5KGx502kDCXJJ7y898TtWW9FwoG5HfOLVRKmlmDGkWN2HM9Ho+/Y8F0sJDg==}
+  /get-tsconfig@4.7.0:
+    resolution: {integrity: sha512-pmjiZ7xtB8URYm74PlGJozDNyhvsVLUcpBa8DZBG3bWHwaHa9bPiRpiSfovw+fjhwONSCWKRyk+JQHEGZmMrzw==}
     dependencies:
       resolve-pkg-maps: 1.0.0
     dev: true
@@ -8059,7 +9019,7 @@ packages:
       defu: 6.1.2
       https-proxy-agent: 5.0.1
       mri: 1.2.0
-      node-fetch-native: 1.2.0
+      node-fetch-native: 1.4.0
       pathe: 1.1.1
       tar: 6.1.15
     transitivePeerDependencies:
@@ -8096,15 +9056,27 @@ packages:
     resolution: {integrity: sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==}
     dev: true
 
-  /glob@10.3.3:
-    resolution: {integrity: sha512-92vPiMb/iqpmEgsOoIDvTjc50wf9CCCvMzsi6W0JLPeUKE8TWP1a73PgqSrqy7iAZxaSD1YdzU7QZR5LF51MJw==}
+  /glob@10.3.10:
+    resolution: {integrity: sha512-fa46+tv1Ak0UPK1TOy/pZrIybNNt4HCv7SDzwyfiOZkvZLEbjsZkJBPtDHVshZjbecAoAGSC20MjLDG/qr679g==}
+    engines: {node: '>=16 || 14 >=14.17'}
+    hasBin: true
+    dependencies:
+      foreground-child: 3.1.1
+      jackspeak: 2.3.6
+      minimatch: 9.0.3
+      minipass: 7.0.4
+      path-scurry: 1.10.1
+    dev: true
+
+  /glob@10.3.4:
+    resolution: {integrity: sha512-6LFElP3A+i/Q8XQKEvZjkEWEOTgAIALR9AO2rwT8bgPhDd1anmqDJDZ6lLddI4ehxxxR1S5RIqKe1uapMQfYaQ==}
     engines: {node: '>=16 || 14 >=14.17'}
     hasBin: true
     dependencies:
       foreground-child: 3.1.1
-      jackspeak: 2.2.2
+      jackspeak: 2.3.1
       minimatch: 9.0.3
-      minipass: 7.0.2
+      minipass: 7.0.3
       path-scurry: 1.10.1
     dev: true
 
@@ -8129,8 +9101,8 @@ packages:
     resolution: {integrity: sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==}
     engines: {node: '>=4'}
 
-  /globals@13.20.0:
-    resolution: {integrity: sha512-Qg5QtVkCy/kv3FUSlu4ukeZDVf9ee0iXLAUYX13gbR17bnejFTzr4iS9bY7kwCf1NztRNm1t91fjOiyx4CSwPQ==}
+  /globals@13.22.0:
+    resolution: {integrity: sha512-H1Ddc/PbZHTDVJSnj8kWptIRSD6AM3pK+mKytuIVF4uoBV7rshFlhhvA58ceJ5wp3Er58w6zj7bykMpYXt3ETw==}
     engines: {node: '>=8'}
     dependencies:
       type-fest: 0.20.2
@@ -8153,17 +9125,6 @@ packages:
       merge2: 1.4.1
       slash: 3.0.0
 
-  /globby@13.2.2:
-    resolution: {integrity: sha512-Y1zNGV+pzQdh7H39l9zgB4PJqjRNqydvdYCDG4HFXM4XuvSaQQlEc91IU1yALL8gUTDomgBAfz3XJdmUS+oo0w==}
-    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
-    dependencies:
-      dir-glob: 3.0.1
-      fast-glob: 3.3.1
-      ignore: 5.2.4
-      merge2: 1.4.1
-      slash: 4.0.0
-    dev: true
-
   /gopd@1.0.1:
     resolution: {integrity: sha512-d65bNlIadxvpb/A2abVdlqKqV563juRnZ1Wtk6s1sIR8uNsXR70xqIzVqxVf1eTqDunwT2MkczEeaezCKTZhwA==}
     dependencies:
@@ -8193,8 +9154,8 @@ packages:
       through2: 2.0.5
     dev: true
 
-  /handlebars@4.7.7:
-    resolution: {integrity: sha512-aAcXm5OAfE/8IXkcZvCepKU3VzW1/39Fb5ZuqMtgI/hT8X2YgoMvBY5dLhq/cpOvw7Lk1nK/UF71aLG/ZnVYRA==}
+  /handlebars@4.7.8:
+    resolution: {integrity: sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==}
     engines: {node: '>=0.4.7'}
     hasBin: true
     dependencies:
@@ -8269,8 +9230,8 @@ packages:
       space-separated-tokens: 1.1.5
     dev: false
 
-  /headers-polyfill@3.1.2:
-    resolution: {integrity: sha512-tWCK4biJ6hcLqTviLXVR9DTRfYGQMXEIUj3gwJ2rZ5wO/at3XtkI4g8mCvFdUF9l1KMBNCfmNAdnahm1cgavQA==}
+  /headers-polyfill@3.2.3:
+    resolution: {integrity: sha512-oj6MO8sdFQ9gQQedSVdMGh96suxTNp91vPQu7C4qx/57FqYsA5TiNr92nhIZwVQq8zygn4nu3xS1aEqpakGqdw==}
     dev: true
 
   /highlight.js@10.7.3:
@@ -8298,12 +9259,6 @@ packages:
     resolution: {integrity: sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==}
     dev: true
 
-  /html-parse-stringify@3.0.1:
-    resolution: {integrity: sha512-KknJ50kTInJ7qIScF3jeaFRpMpE8/lfiTdzf/twXyPBLAGrLRTmkz3AdTnKeh40X8k9L2fdYwEp/42WGXIRGcg==}
-    dependencies:
-      void-elements: 3.1.0
-    dev: false
-
   /html-tags@3.3.1:
     resolution: {integrity: sha512-ztqyC3kLto0e9WbNp0aeP+M3kTt+nbaIveGmUxAtZa+8iFgKLUOD4YKM5j+f3QD89bra7UeumolZHKuOXnTmeQ==}
     engines: {node: '>=8'}
@@ -8355,21 +9310,10 @@ packages:
     engines: {node: '>=10.17.0'}
     dev: true
 
-  /human-signals@4.3.1:
-    resolution: {integrity: sha512-nZXjEF2nbo7lIw3mgYjItAfgQXog3OjJogSbKa2CQIIvSGWcKgeJnQlNXip6NglNzYH45nSRiEVimMvYL8DDqQ==}
-    engines: {node: '>=14.18.0'}
-    dev: true
-
   /hyphenate-style-name@1.0.4:
     resolution: {integrity: sha512-ygGZLjmXfPHj+ZWh6LwbC37l43MhfztxetbFCoYTM2VjkIUpeHgSNn7QIyVFj7YQ1Wl9Cbw5sholVJPzWvC2MQ==}
     dev: false
 
-  /i18next@22.5.0:
-    resolution: {integrity: sha512-sqWuJFj+wJAKQP2qBQ+b7STzxZNUmnSxrehBCCj9vDOW9RDYPfqCaK1Hbh2frNYQuPziz6O2CGoJPwtzY3vAYA==}
-    dependencies:
-      '@babel/runtime': 7.22.6
-    dev: false
-
   /iconv-lite@0.4.24:
     resolution: {integrity: sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==}
     engines: {node: '>=0.10.0'}
@@ -8557,6 +9501,12 @@ packages:
     resolution: {integrity: sha512-Q4ZuBAe2FUsKtyQJoQHlvP8OvBERxO3jEmy1I7hcRXcJBGGHFh/aJBswbXuS9sgrDH2QUO8ilkwNPHvHMd8clg==}
     dependencies:
       has: 1.0.3
+    dev: true
+
+  /is-core-module@2.13.0:
+    resolution: {integrity: sha512-Z7dk6Qo8pOCp3l4tsX2C5ZVas4V+UxwQodwZhLopL91TX8UyyHEXafPcyoeeWuLrwzHcr3igO78wNLwHJHsMCQ==}
+    dependencies:
+      has: 1.0.3
 
   /is-date-object@1.0.5:
     resolution: {integrity: sha512-9YQaSxsAiSwcvS33MBk3wTCVnWK+HhF8VZR2jRxehM16QcVOdHqPn4VPHmRK4lSr38n9JriurInLcP90xsYNfQ==}
@@ -8578,12 +9528,6 @@ packages:
     engines: {node: '>=8'}
     hasBin: true
 
-  /is-docker@3.0.0:
-    resolution: {integrity: sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==}
-    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
-    hasBin: true
-    dev: true
-
   /is-extglob@2.1.1:
     resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
     engines: {node: '>=0.10.0'}
@@ -8627,14 +9571,6 @@ packages:
     resolution: {integrity: sha512-FeXIBgG/CPGd/WUxuEyvgGTEfwiG9Z4EKGxjNMRqviiIIfsmgrpnHLffEDdwUHqNva1VEW91o3xBT/m8Elgl9g==}
     dev: false
 
-  /is-inside-container@1.0.0:
-    resolution: {integrity: sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA==}
-    engines: {node: '>=14.16'}
-    hasBin: true
-    dependencies:
-      is-docker: 3.0.0
-    dev: true
-
   /is-interactive@1.0.0:
     resolution: {integrity: sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==}
     engines: {node: '>=8'}
@@ -8729,11 +9665,6 @@ packages:
     engines: {node: '>=8'}
     dev: true
 
-  /is-stream@3.0.0:
-    resolution: {integrity: sha512-LnQR4bZ9IADDRSkvpqMGvt/tEJWclzklNgSw48V5EAaAeDd6qGvN8ei6k5p0tvxSR171VmGyHuTiAOfxAbr8kA==}
-    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
-    dev: true
-
   /is-string@1.0.7:
     resolution: {integrity: sha512-tE2UXzivje6ofPW7l23cjDOMa09gb7xlAqG6jG5ej6uPV32TlWP3NKPigtaGeHNu9fohccRYvIiZMfOOnOYUtg==}
     engines: {node: '>= 0.4'}
@@ -8813,8 +9744,8 @@ packages:
     resolution: {integrity: sha512-pzqtp31nLv/XFOzXGuvhCb8qhjmTVo5vjVk19XE4CRlSWz0KoeJ3bw9XsA7nOp9YBf4qHjwBxkDzKcME/J29Yg==}
     engines: {node: '>=8'}
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/parser': 7.22.7
+      '@babel/core': 7.22.11
+      '@babel/parser': 7.23.0
       '@istanbuljs/schema': 0.1.3
       istanbul-lib-coverage: 3.2.0
       semver: 7.5.3
@@ -8850,8 +9781,17 @@ packages:
       istanbul-lib-report: 3.0.1
     dev: true
 
-  /jackspeak@2.2.2:
-    resolution: {integrity: sha512-mgNtVv4vUuaKA97yxUHoA3+FkuhtxkjdXEWOyB/N76fjy0FjezEt34oy3epBtvCvS+7DyKwqCFWx/oJLV5+kCg==}
+  /jackspeak@2.3.1:
+    resolution: {integrity: sha512-4iSY3Bh1Htv+kLhiiZunUhQ+OYXIn0ze3ulq8JeWrFKmhPAJSySV2+kdtRh2pGcCeF0s6oR8Oc+pYZynJj4t8A==}
+    engines: {node: '>=14'}
+    dependencies:
+      '@isaacs/cliui': 8.0.2
+    optionalDependencies:
+      '@pkgjs/parseargs': 0.11.0
+    dev: true
+
+  /jackspeak@2.3.6:
+    resolution: {integrity: sha512-N3yCS/NegsOBokc8GAdM8UcmfsKiSS8cipheD/nivzr700H+nsMOxJjQnvwOcRYVuFkdH0wGUvW2WbXGmrZGbQ==}
     engines: {node: '>=14'}
     dependencies:
       '@isaacs/cliui': 8.0.2
@@ -8870,8 +9810,8 @@ packages:
       minimatch: 3.1.2
     dev: true
 
-  /jest-canvas-mock@2.4.0:
-    resolution: {integrity: sha512-mmMpZzpmLzn5vepIaHk5HoH3Ka4WykbSoLuG/EKoJd0x0ID/t+INo1l8ByfcUJuDM+RIsL4QDg/gDnBbrj2/IQ==}
+  /jest-canvas-mock@2.5.2:
+    resolution: {integrity: sha512-vgnpPupjOL6+L5oJXzxTxFrlGEIbHdZqFU+LFNdtLxZ3lRDCl17FlTMM7IatoRQkrcyOTMlDinjUguqmQ6bR2A==}
     dependencies:
       cssfontparser: 1.2.1
       moo-color: 1.0.3
@@ -8893,7 +9833,7 @@ packages:
       '@jest/expect': 29.6.2
       '@jest/test-result': 29.6.2
       '@jest/types': 29.6.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       chalk: 4.1.2
       co: 4.6.0
       dedent: 1.3.0
@@ -8903,7 +9843,7 @@ packages:
       jest-message-util: 29.6.2
       jest-runtime: 29.6.2
       jest-snapshot: 29.6.2
-      jest-util: 29.6.2
+      jest-util: 29.6.3
       p-limit: 3.1.0
       pretty-format: 29.6.2
       pure-rand: 6.0.2
@@ -8914,7 +9854,7 @@ packages:
       - supports-color
     dev: true
 
-  /jest-cli@29.6.2(@types/node@18.17.0)(ts-node@10.9.1):
+  /jest-cli@29.6.2(@types/node@18.18.1)(ts-node@10.9.1):
     resolution: {integrity: sha512-TT6O247v6dCEX2UGHGyflMpxhnrL0DNqP2fRTKYm3nJJpCTfXX3GCMQPGFjXDoj0i5/Blp3jriKXFgdfmbYB6Q==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     hasBin: true
@@ -8931,8 +9871,8 @@ packages:
       exit: 0.1.2
       graceful-fs: 4.2.11
       import-local: 3.1.0
-      jest-config: 29.6.2(@types/node@18.17.0)(ts-node@10.9.1)
-      jest-util: 29.6.2
+      jest-config: 29.6.2(@types/node@18.18.1)(ts-node@10.9.1)
+      jest-util: 29.6.3
       jest-validate: 29.6.2
       prompts: 2.4.2
       yargs: 17.7.2
@@ -8943,7 +9883,7 @@ packages:
       - ts-node
     dev: true
 
-  /jest-config@29.6.2(@types/node@18.17.0)(ts-node@10.9.1):
+  /jest-config@29.6.2(@types/node@18.18.1)(ts-node@10.9.1):
     resolution: {integrity: sha512-VxwFOC8gkiJbuodG9CPtMRjBUNZEHxwfQXmIudSTzFWxaci3Qub1ddTRbFNQlD/zUeaifLndh/eDccFX4wCMQw==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     peerDependencies:
@@ -8955,11 +9895,11 @@ packages:
       ts-node:
         optional: true
     dependencies:
-      '@babel/core': 7.22.9
+      '@babel/core': 7.22.11
       '@jest/test-sequencer': 29.6.2
       '@jest/types': 29.6.1
-      '@types/node': 18.17.0
-      babel-jest: 29.6.2(@babel/core@7.22.9)
+      '@types/node': 18.18.1
+      babel-jest: 29.6.2(@babel/core@7.22.11)
       chalk: 4.1.2
       ci-info: 3.8.0
       deepmerge: 4.3.1
@@ -8968,42 +9908,22 @@ packages:
       jest-circus: 29.6.2
       jest-environment-node: 29.6.2
       jest-get-type: 29.4.3
-      jest-regex-util: 29.4.3
+      jest-regex-util: 29.6.3
       jest-resolve: 29.6.2
       jest-runner: 29.6.2
-      jest-util: 29.6.2
+      jest-util: 29.6.3
       jest-validate: 29.6.2
       micromatch: 4.0.5
       parse-json: 5.2.0
       pretty-format: 29.6.2
       slash: 3.0.0
       strip-json-comments: 3.1.1
-      ts-node: 10.9.1(@swc/core@1.3.38)(@types/node@18.17.0)(typescript@5.1.6)
+      ts-node: 10.9.1(@swc/core@1.3.38)(@types/node@18.18.1)(typescript@5.2.2)
     transitivePeerDependencies:
       - babel-plugin-macros
       - supports-color
     dev: true
 
-  /jest-diff@27.5.1:
-    resolution: {integrity: sha512-m0NvkX55LDt9T4mctTEgnZk3fmEg3NRYutvMPWM/0iPnkFj2wIeF45O1718cMSOFO1vINkqmxqD8vE37uTEbqw==}
-    engines: {node: ^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0}
-    dependencies:
-      chalk: 4.1.2
-      diff-sequences: 27.5.1
-      jest-get-type: 27.5.1
-      pretty-format: 27.5.1
-    dev: true
-
-  /jest-diff@28.1.3:
-    resolution: {integrity: sha512-8RqP1B/OXzjjTWkqMX67iqgwBVJRgCyKD3L9nq+6ZqJMdvjE8RgHktqZ6jNrkdMT+dJuYNI3rhQpxaz7drJHfw==}
-    engines: {node: ^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0}
-    dependencies:
-      chalk: 4.1.2
-      diff-sequences: 28.1.1
-      jest-get-type: 28.0.2
-      pretty-format: 28.1.3
-    dev: true
-
   /jest-diff@29.6.2:
     resolution: {integrity: sha512-t+ST7CB9GX5F2xKwhwCf0TAR17uNDiaPTZnVymP9lw0lssa9vG+AFyDZoeIHStU3WowFFwT+ky+er0WVl2yGhA==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
@@ -9014,6 +9934,16 @@ packages:
       pretty-format: 29.6.2
     dev: true
 
+  /jest-diff@29.7.0:
+    resolution: {integrity: sha512-LMIgiIrhigmPrs03JHpxUh2yISK3vLFPkAodPeo0+BuF7wA2FoQbkEg1u8gBYBThncu7e1oEDUfIXVuTqLRUjw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    dependencies:
+      chalk: 4.1.2
+      diff-sequences: 29.6.3
+      jest-get-type: 29.6.3
+      pretty-format: 29.7.0
+    dev: true
+
   /jest-docblock@29.4.3:
     resolution: {integrity: sha512-fzdTftThczeSD9nZ3fzA/4KkHtnmllawWrXO69vtI+L9WjEIuXWs4AmyME7lN5hU7dB0sHhuPfcKofRsUb/2Fg==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
@@ -9028,7 +9958,7 @@ packages:
       '@jest/types': 29.6.1
       chalk: 4.1.2
       jest-get-type: 29.4.3
-      jest-util: 29.6.2
+      jest-util: 29.6.3
       pretty-format: 29.6.2
     dev: true
 
@@ -9045,7 +9975,7 @@ packages:
       '@jest/fake-timers': 29.6.2
       '@jest/types': 29.6.1
       '@types/jsdom': 20.0.1
-      '@types/node': 20.4.5
+      '@types/node': 18.18.1
       canvas: 2.11.0
       jest-mock: 29.6.2
       jest-util: 29.6.2
@@ -9063,9 +9993,9 @@ packages:
       '@jest/environment': 29.6.2
       '@jest/fake-timers': 29.6.2
       '@jest/types': 29.6.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       jest-mock: 29.6.2
-      jest-util: 29.6.2
+      jest-util: 29.6.3
     dev: true
 
   /jest-fetch-mock@3.0.3:
@@ -9077,38 +10007,33 @@ packages:
       - encoding
     dev: true
 
-  /jest-get-type@27.5.1:
-    resolution: {integrity: sha512-2KY95ksYSaK7DMBWQn6dQz3kqAf3BB64y2udeG+hv4KfSOb9qwcYQstTJc1KCbsix+wLZWZYN8t7nwX3GOBLRw==}
-    engines: {node: ^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0}
-    dev: true
-
-  /jest-get-type@28.0.2:
-    resolution: {integrity: sha512-ioj2w9/DxSYHfOm5lJKCdcAmPJzQXmbM/Url3rhlghrPvT3tt+7a/+oXc9azkKmLvoiXjtV83bEWqi+vs5nlPA==}
-    engines: {node: ^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0}
-    dev: true
-
   /jest-get-type@29.4.3:
     resolution: {integrity: sha512-J5Xez4nRRMjk8emnTpWrlkyb9pfRQQanDrvWHhsR1+VUfbwxi30eVcZFlcdGInRibU4G5LwHXpI7IRHU0CY+gg==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dev: true
 
-  /jest-haste-map@29.6.2:
-    resolution: {integrity: sha512-+51XleTDAAysvU8rT6AnS1ZJ+WHVNqhj1k6nTvN2PYP+HjU3kqlaKQ1Lnw3NYW3bm2r8vq82X0Z1nDDHZMzHVA==}
+  /jest-get-type@29.6.3:
+    resolution: {integrity: sha512-zrteXnqYxfQh7l5FHyL38jL39di8H8rHoecLH3JNxH3BwOrBsNeabdap5e0I23lD4HHI8W5VFBZqG4Eaq5LNcw==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    dev: true
+
+  /jest-haste-map@29.6.4:
+    resolution: {integrity: sha512-12Ad+VNTDHxKf7k+M65sviyynRoZYuL1/GTuhEVb8RYsNSNln71nANRb/faSyWvx0j+gHcivChXHIoMJrGYjog==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
-      '@jest/types': 29.6.1
+      '@jest/types': 29.6.3
       '@types/graceful-fs': 4.1.6
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       anymatch: 3.1.3
       fb-watchman: 2.0.2
       graceful-fs: 4.2.11
-      jest-regex-util: 29.4.3
-      jest-util: 29.6.2
-      jest-worker: 29.6.2
+      jest-regex-util: 29.6.3
+      jest-util: 29.6.3
+      jest-worker: 29.6.4
       micromatch: 4.0.5
       walker: 1.0.8
     optionalDependencies:
-      fsevents: 2.3.2
+      fsevents: 2.3.3
     dev: true
 
   /jest-leak-detector@29.6.2:
@@ -9119,12 +10044,12 @@ packages:
       pretty-format: 29.6.2
     dev: true
 
-  /jest-location-mock@1.0.9:
-    resolution: {integrity: sha512-DN/v7Zsa3N4uGgWTCrMrPPxhZORr/4N5gi+u7Tk6sLdORYplrC0//wfFN5FOtx4ZdQzDVfY6rLa4d+wfTKzQHw==}
-    engines: {node: '>=10.0.0'}
+  /jest-location-mock@2.0.0:
+    resolution: {integrity: sha512-loakfclgY/y65/2i4s0fcdlZY3hRPfwNnmzRsGFQYQryiaow2DEIGTLXIPI8cAO1Is36xsVLVkIzgvhQ+FXHdw==}
+    engines: {node: ^16.10.0 || >=18.0.0}
     dependencies:
       '@jedmao/location': 3.0.0
-      jest-diff: 27.5.1
+      jest-diff: 29.7.0
     dev: true
 
   /jest-matcher-utils@29.6.2:
@@ -9141,8 +10066,8 @@ packages:
     resolution: {integrity: sha512-vnIGYEjoPSuRqV8W9t+Wow95SDp6KPX2Uf7EoeG9G99J2OVh7OSwpS4B6J0NfpEIpfkBNHlBZpA2rblEuEFhZQ==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
-      '@babel/code-frame': 7.22.5
-      '@jest/types': 29.6.1
+      '@babel/code-frame': 7.22.13
+      '@jest/types': 29.6.3
       '@types/stack-utils': 2.0.1
       chalk: 4.1.2
       graceful-fs: 4.2.11
@@ -9156,7 +10081,7 @@ packages:
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
       '@jest/types': 29.6.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       jest-util: 29.6.2
 
   /jest-pnp-resolver@1.2.3(jest-resolve@29.6.2):
@@ -9171,8 +10096,8 @@ packages:
       jest-resolve: 29.6.2
     dev: true
 
-  /jest-regex-util@29.4.3:
-    resolution: {integrity: sha512-O4FglZaMmWXbGHSQInfXewIsd1LMn9p3ZXB/6r4FOkyhX2/iP/soMG98jGvk/A3HAN78+5VWcBGO0BJAPRh4kg==}
+  /jest-regex-util@29.6.3:
+    resolution: {integrity: sha512-KJJBsRCyyLNWCNBOvZyRDnAIfUiRJ8v+hOBQYGn8gDyF3UegwiP4gwRR3/SDa42g1YbVycTidUF3rKjyLFDWbg==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dev: true
 
@@ -9180,7 +10105,7 @@ packages:
     resolution: {integrity: sha512-LGqjDWxg2fuQQm7ypDxduLu/m4+4Lb4gczc13v51VMZbVP5tSBILqVx8qfWcsdP8f0G7aIqByIALDB0R93yL+w==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
-      jest-regex-util: 29.4.3
+      jest-regex-util: 29.6.3
       jest-snapshot: 29.6.2
     transitivePeerDependencies:
       - supports-color
@@ -9192,16 +10117,16 @@ packages:
     dependencies:
       chalk: 4.1.2
       graceful-fs: 4.2.11
-      jest-haste-map: 29.6.2
+      jest-haste-map: 29.6.4
       jest-pnp-resolver: 1.2.3(jest-resolve@29.6.2)
-      jest-util: 29.6.2
+      jest-util: 29.6.3
       jest-validate: 29.6.2
-      resolve: 1.22.3
+      resolve: 1.22.4
       resolve.exports: 2.0.2
       slash: 3.0.0
     dev: true
 
-  /jest-runner-eslint@2.1.0(eslint@8.46.0)(jest@29.6.2):
+  /jest-runner-eslint@2.1.0(eslint@8.50.0)(jest@29.6.2):
     resolution: {integrity: sha512-5gQOLej+HLDNzxrqOxg+l/ZY6hAHYhzO7gs3eOR+PQz14wpDuLDIivn+xJ8uwHW2tYM/37NGskqwBe5RbbJPEw==}
     engines: {node: ^12.13.0 || ^14.15.0 || ^16.10.0 || >=18.0.0}
     peerDependencies:
@@ -9212,8 +10137,8 @@ packages:
       cosmiconfig: 7.1.0
       create-jest-runner: 0.11.2
       dot-prop: 6.0.1
-      eslint: 8.46.0
-      jest: 29.6.2(@types/node@18.17.0)(ts-node@10.9.1)
+      eslint: 8.50.0
+      jest: 29.6.2(@types/node@18.18.1)(ts-node@10.9.1)
     transitivePeerDependencies:
       - '@jest/test-result'
       - jest-runner
@@ -9226,22 +10151,22 @@ packages:
       '@jest/console': 29.6.2
       '@jest/environment': 29.6.2
       '@jest/test-result': 29.6.2
-      '@jest/transform': 29.6.2
+      '@jest/transform': 29.6.4
       '@jest/types': 29.6.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       chalk: 4.1.2
       emittery: 0.13.1
       graceful-fs: 4.2.11
       jest-docblock: 29.4.3
       jest-environment-node: 29.6.2
-      jest-haste-map: 29.6.2
+      jest-haste-map: 29.6.4
       jest-leak-detector: 29.6.2
       jest-message-util: 29.6.2
       jest-resolve: 29.6.2
       jest-runtime: 29.6.2
-      jest-util: 29.6.2
+      jest-util: 29.6.3
       jest-watcher: 29.6.2
-      jest-worker: 29.6.2
+      jest-worker: 29.6.4
       p-limit: 3.1.0
       source-map-support: 0.5.13
     transitivePeerDependencies:
@@ -9257,21 +10182,21 @@ packages:
       '@jest/globals': 29.6.2
       '@jest/source-map': 29.6.0
       '@jest/test-result': 29.6.2
-      '@jest/transform': 29.6.2
+      '@jest/transform': 29.6.4
       '@jest/types': 29.6.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       chalk: 4.1.2
       cjs-module-lexer: 1.2.3
       collect-v8-coverage: 1.0.2
       glob: 7.2.3
       graceful-fs: 4.2.11
-      jest-haste-map: 29.6.2
+      jest-haste-map: 29.6.4
       jest-message-util: 29.6.2
       jest-mock: 29.6.2
-      jest-regex-util: 29.4.3
+      jest-regex-util: 29.6.3
       jest-resolve: 29.6.2
       jest-snapshot: 29.6.2
-      jest-util: 29.6.2
+      jest-util: 29.6.3
       slash: 3.0.0
       strip-bom: 4.0.0
     transitivePeerDependencies:
@@ -9282,15 +10207,15 @@ packages:
     resolution: {integrity: sha512-1OdjqvqmRdGNvWXr/YZHuyhh5DeaLp1p/F8Tht/MrMw4Kr1Uu/j4lRG+iKl1DAqUJDWxtQBMk41Lnf/JETYBRA==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/generator': 7.22.9
-      '@babel/plugin-syntax-jsx': 7.22.5(@babel/core@7.22.9)
-      '@babel/plugin-syntax-typescript': 7.22.5(@babel/core@7.22.9)
-      '@babel/types': 7.22.5
+      '@babel/core': 7.22.11
+      '@babel/generator': 7.23.0
+      '@babel/plugin-syntax-jsx': 7.22.5(@babel/core@7.22.11)
+      '@babel/plugin-syntax-typescript': 7.22.5(@babel/core@7.22.11)
+      '@babel/types': 7.23.0
       '@jest/expect-utils': 29.6.2
-      '@jest/transform': 29.6.2
+      '@jest/transform': 29.6.4
       '@jest/types': 29.6.1
-      babel-preset-current-node-syntax: 1.0.1(@babel/core@7.22.9)
+      babel-preset-current-node-syntax: 1.0.1(@babel/core@7.22.11)
       chalk: 4.1.2
       expect: 29.6.2
       graceful-fs: 4.2.11
@@ -9298,7 +10223,7 @@ packages:
       jest-get-type: 29.4.3
       jest-matcher-utils: 29.6.2
       jest-message-util: 29.6.2
-      jest-util: 29.6.2
+      jest-util: 29.6.3
       natural-compare: 1.4.0
       pretty-format: 29.6.2
       semver: 7.5.3
@@ -9311,11 +10236,23 @@ packages:
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
       '@jest/types': 29.6.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
+      chalk: 4.1.2
+      ci-info: 3.8.0
+      graceful-fs: 4.2.11
+      picomatch: 2.3.1
+
+  /jest-util@29.6.3:
+    resolution: {integrity: sha512-QUjna/xSy4B32fzcKTSz1w7YYzgiHrjjJjevdRf61HYk998R5vVMMNmrHESYZVDS5DSWs+1srPLPKxXPkeSDOA==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+    dependencies:
+      '@jest/types': 29.6.3
+      '@types/node': 18.18.1
       chalk: 4.1.2
       ci-info: 3.8.0
       graceful-fs: 4.2.11
       picomatch: 2.3.1
+    dev: true
 
   /jest-validate@29.6.2:
     resolution: {integrity: sha512-vGz0yMN5fUFRRbpJDPwxMpgSXW1LDKROHfBopAvDcmD6s+B/s8WJrwi+4bfH4SdInBA5C3P3BI19dBtKzx1Arg==}
@@ -9335,41 +10272,41 @@ packages:
     dependencies:
       '@jest/test-result': 29.6.2
       '@jest/types': 29.6.1
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       ansi-escapes: 4.3.2
       chalk: 4.1.2
       emittery: 0.13.1
-      jest-util: 29.6.2
+      jest-util: 29.6.3
       string-length: 4.0.2
     dev: true
 
-  /jest-websocket-mock@2.4.0:
-    resolution: {integrity: sha512-AOwyuRw6fgROXHxMOiTDl1/T4dh3fV4jDquha5N0csS/PNp742HeTZWPAuKppVRSQ8s3fUGgJHoyZT9JDO0hMA==}
+  /jest-websocket-mock@2.5.0:
+    resolution: {integrity: sha512-a+UJGfowNIWvtIKIQBHoEWIUqRxxQHFx4CXT+R5KxxKBtEQ5rS3pPOV/5299sHzqbmeCzxxY5qE4+yfXePePig==}
     dependencies:
-      jest-diff: 28.1.3
-      mock-socket: 9.2.1
+      jest-diff: 29.6.2
+      mock-socket: 9.3.1
     dev: true
 
   /jest-worker@28.1.3:
     resolution: {integrity: sha512-CqRA220YV/6jCo8VWvAt1KKx6eek1VIHMPeLEbpcfSfkEeWyBNppynM/o6q+Wmw+sOhos2ml34wZbSX3G13//g==}
     engines: {node: ^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0}
     dependencies:
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       merge-stream: 2.0.0
       supports-color: 8.1.1
     dev: true
 
-  /jest-worker@29.6.2:
-    resolution: {integrity: sha512-l3ccBOabTdkng8I/ORCkADz4eSMKejTYv1vB/Z83UiubqhC1oQ5Li6dWCyqOIvSifGjUBxuvxvlm6KGK2DtuAQ==}
+  /jest-worker@29.6.4:
+    resolution: {integrity: sha512-6dpvFV4WjcWbDVGgHTWo/aupl8/LbBx2NSKfiwqf79xC/yeJjKHT1+StcKy/2KTmW16hE68ccKVOtXf+WZGz7Q==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
-      '@types/node': 18.17.0
-      jest-util: 29.6.2
+      '@types/node': 18.18.1
+      jest-util: 29.6.3
       merge-stream: 2.0.0
       supports-color: 8.1.1
     dev: true
 
-  /jest@29.6.2(@types/node@18.17.0)(ts-node@10.9.1):
+  /jest@29.6.2(@types/node@18.18.1)(ts-node@10.9.1):
     resolution: {integrity: sha512-8eQg2mqFbaP7CwfsTpCxQ+sHzw1WuNWL5UUvjnWP4hx2riGz9fPSzYOaU5q8/GqWn1TfgZIVTqYJygbGbWAANg==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     hasBin: true
@@ -9382,7 +10319,7 @@ packages:
       '@jest/core': 29.6.2(ts-node@10.9.1)
       '@jest/types': 29.6.1
       import-local: 3.1.0
-      jest-cli: 29.6.2(@types/node@18.17.0)(ts-node@10.9.1)
+      jest-cli: 29.6.2(@types/node@18.18.1)(ts-node@10.9.1)
     transitivePeerDependencies:
       - '@types/node'
       - babel-plugin-macros
@@ -9425,25 +10362,25 @@ packages:
     dependencies:
       argparse: 2.0.1
 
-  /jscodeshift@0.14.0(@babel/preset-env@7.22.9):
+  /jscodeshift@0.14.0(@babel/preset-env@7.22.14):
     resolution: {integrity: sha512-7eCC1knD7bLUPuSCwXsMZUH51O8jIcoVyKtI6P0XM0IVzlGjckPy3FIwQlorzbN0Sg79oK+RlohN32Mqf/lrYA==}
     hasBin: true
     peerDependencies:
       '@babel/preset-env': ^7.1.6
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/parser': 7.22.7
-      '@babel/plugin-proposal-class-properties': 7.18.6(@babel/core@7.22.9)
-      '@babel/plugin-proposal-nullish-coalescing-operator': 7.18.6(@babel/core@7.22.9)
-      '@babel/plugin-proposal-optional-chaining': 7.21.0(@babel/core@7.22.9)
-      '@babel/plugin-transform-modules-commonjs': 7.22.5(@babel/core@7.22.9)
-      '@babel/preset-env': 7.22.9(@babel/core@7.22.9)
-      '@babel/preset-flow': 7.22.5(@babel/core@7.22.9)
-      '@babel/preset-typescript': 7.22.5(@babel/core@7.22.9)
-      '@babel/register': 7.22.5(@babel/core@7.22.9)
-      babel-core: 7.0.0-bridge.0(@babel/core@7.22.9)
+      '@babel/core': 7.22.11
+      '@babel/parser': 7.23.0
+      '@babel/plugin-proposal-class-properties': 7.18.6(@babel/core@7.22.11)
+      '@babel/plugin-proposal-nullish-coalescing-operator': 7.18.6(@babel/core@7.22.11)
+      '@babel/plugin-proposal-optional-chaining': 7.21.0(@babel/core@7.22.11)
+      '@babel/plugin-transform-modules-commonjs': 7.22.11(@babel/core@7.22.11)
+      '@babel/preset-env': 7.22.14(@babel/core@7.22.11)
+      '@babel/preset-flow': 7.22.5(@babel/core@7.22.11)
+      '@babel/preset-typescript': 7.22.11(@babel/core@7.22.11)
+      '@babel/register': 7.22.5(@babel/core@7.22.11)
+      babel-core: 7.0.0-bridge.0(@babel/core@7.22.11)
       chalk: 4.1.2
-      flow-parser: 0.213.1
+      flow-parser: 0.215.1
       graceful-fs: 4.2.11
       micromatch: 4.0.5
       neo-async: 2.6.2
@@ -9513,6 +10450,9 @@ packages:
     hasBin: true
     dev: true
 
+  /json-buffer@3.0.1:
+    resolution: {integrity: sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==}
+
   /json-parse-even-better-errors@2.3.1:
     resolution: {integrity: sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==}
 
@@ -9549,7 +10489,7 @@ packages:
   /jss-plugin-camel-case@10.10.0:
     resolution: {integrity: sha512-z+HETfj5IYgFxh1wJnUAU8jByI48ED+v0fuTuhKrPR+pRBYS2EDwbusU8aFOpCdYhtRc9zhN+PJ7iNE8pAWyPw==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       hyphenate-style-name: 1.0.4
       jss: 10.10.0
     dev: false
@@ -9557,21 +10497,21 @@ packages:
   /jss-plugin-default-unit@10.10.0:
     resolution: {integrity: sha512-SvpajxIECi4JDUbGLefvNckmI+c2VWmP43qnEy/0eiwzRUsafg5DVSIWSzZe4d2vFX1u9nRDP46WCFV/PXVBGQ==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       jss: 10.10.0
     dev: false
 
   /jss-plugin-global@10.10.0:
     resolution: {integrity: sha512-icXEYbMufiNuWfuazLeN+BNJO16Ge88OcXU5ZDC2vLqElmMybA31Wi7lZ3lf+vgufRocvPj8443irhYRgWxP+A==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       jss: 10.10.0
     dev: false
 
   /jss-plugin-nested@10.10.0:
     resolution: {integrity: sha512-9R4JHxxGgiZhurDo3q7LdIiDEgtA1bTGzAbhSPyIOWb7ZubrjQe8acwhEQ6OEKydzpl8XHMtTnEwHXCARLYqYA==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       jss: 10.10.0
       tiny-warning: 1.0.3
     dev: false
@@ -9579,14 +10519,14 @@ packages:
   /jss-plugin-props-sort@10.10.0:
     resolution: {integrity: sha512-5VNJvQJbnq/vRfje6uZLe/FyaOpzP/IH1LP+0fr88QamVrGJa0hpRRyAa0ea4U/3LcorJfBFVyC4yN2QC73lJg==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       jss: 10.10.0
     dev: false
 
   /jss-plugin-rule-value-function@10.10.0:
     resolution: {integrity: sha512-uEFJFgaCtkXeIPgki8ICw3Y7VMkL9GEan6SqmT9tqpwM+/t+hxfMUdU4wQ0MtOiMNWhwnckBV0IebrKcZM9C0g==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       jss: 10.10.0
       tiny-warning: 1.0.3
     dev: false
@@ -9594,7 +10534,7 @@ packages:
   /jss-plugin-vendor-prefixer@10.10.0:
     resolution: {integrity: sha512-UY/41WumgjW8r1qMCO8l1ARg7NHnfRVWRhZ2E2m0DMYsr2DD91qIXLyNhiX83hHswR7Wm4D+oDYNC1zWCJWtqg==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       css-vendor: 2.0.8
       jss: 10.10.0
     dev: false
@@ -9602,7 +10542,7 @@ packages:
   /jss@10.10.0:
     resolution: {integrity: sha512-cqsOTS7jqPsPMjtKYDUpdFC0AbhYFLTcuGRqymgmdJIeQ8cH7+AgX7YSgQy79wXloZq2VvATYxUOUQEvS1V/Zw==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       csstype: 3.1.2
       is-in-browser: 1.1.3
       tiny-warning: 1.0.3
@@ -9618,9 +10558,10 @@ packages:
       object.values: 1.1.6
     dev: true
 
-  /just-debounce-it@3.2.0:
-    resolution: {integrity: sha512-WXzwLL0745uNuedrCsCs3rpmfD6DBaf7uuVwaq98/8dafURfgQaBsSpjiPp5+CW6Vjltwy9cOGI6qE71b3T8iQ==}
-    dev: true
+  /keyv@4.5.3:
+    resolution: {integrity: sha512-QCiSav9WaX1PgETJ+SpNnx2PRRapJ/oRSXM4VO5OGYGSjrxbKPVFVhB3l2OCbLCk329N8qyAtsJjSjvVBWzEug==}
+    dependencies:
+      json-buffer: 3.0.1
 
   /kind-of@6.0.3:
     resolution: {integrity: sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==}
@@ -9723,7 +10664,6 @@ packages:
 
   /long@5.2.3:
     resolution: {integrity: sha512-lcHwpNoggQTObv5apGNCTdJrO69eHOZMi4BNC+rTLER8iHAqGrUVeLh/irVIM7zTw2bOXA8T6uNPeujwOLg/2Q==}
-    dev: true
 
   /longest-streak@3.1.0:
     resolution: {integrity: sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==}
@@ -9741,8 +10681,8 @@ packages:
       highlight.js: 10.7.3
     dev: false
 
-  /lru-cache@10.0.0:
-    resolution: {integrity: sha512-svTf/fzsKHffP42sujkO/Rjs37BCIsQVRCeNYIm9WN8rgT7ffoUnRtZCqU+6BqcSBdv8gwJeTz8knJpgACeQMw==}
+  /lru-cache@10.0.1:
+    resolution: {integrity: sha512-IJ4uwUTi2qCccrioU6g9g/5rvvVl13bsdczUUcqbciD9iLr095yj8DQKdObriEvuNSx325N1rV1O0sJFszx75g==}
     engines: {node: 14 || >=16.14}
     dev: true
 
@@ -9774,8 +10714,8 @@ packages:
       '@jridgewell/sourcemap-codec': 1.4.15
     dev: true
 
-  /magic-string@0.30.1:
-    resolution: {integrity: sha512-mbVKXPmS0z0G4XqFDCTllmDQ6coZzn94aMlb0o/A4HEHJCKcanlDZwYJgwnkmgD3jyWhUgj9VsPrfd972yPffA==}
+  /magic-string@0.30.3:
+    resolution: {integrity: sha512-B7xGbll2fG/VjP+SWg4sX3JynwIU0mjoTc6MPpKNuIvftk6u6vqhDnk1R80b8C2GBR6ywqy+1DcKBrevBg+bmw==}
     engines: {node: '>=12'}
     dependencies:
       '@jridgewell/sourcemap-codec': 1.4.15
@@ -9819,8 +10759,8 @@ packages:
   /markdown-table@3.0.3:
     resolution: {integrity: sha512-Z1NL3Tb1M9wH4XESsCDEksWoKTdlUafKc4pt0GRwjUyXaCFZ+dc3g2erqB6zm3szA2IUSi7VnPI+o/9jnxh9hw==}
 
-  /markdown-to-jsx@7.2.1(react@18.2.0):
-    resolution: {integrity: sha512-9HrdzBAo0+sFz9ZYAGT5fB8ilzTW+q6lPocRxrIesMO+aB40V9MgFfbfMXxlGjf22OpRy+IXlvVaQenicdpgbg==}
+  /markdown-to-jsx@7.3.2(react@18.2.0):
+    resolution: {integrity: sha512-B+28F5ucp83aQm+OxNrPkS8z0tMKaeHiy0lHJs3LqCyDQFtWuenaIrkaVTgAm1pf1AU85LXltva86hlaT17i8Q==}
     engines: {node: '>= 10'}
     peerDependencies:
       react: '>= 0.14.0'
@@ -9842,7 +10782,7 @@ packages:
     resolution: {integrity: sha512-8SVPMuHqlPME/z3gqVwWY4zVXn8lqKv/pAhC57FuJ40ImXyBpmO5ukh98zB2v7Blql2FiHjHv9LVztSIqjY+MA==}
     dependencies:
       '@types/mdast': 3.0.12
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
       unist-util-visit: 4.1.2
     dev: false
 
@@ -9858,7 +10798,7 @@ packages:
     resolution: {integrity: sha512-4xTO/M8c82qBcnQc1tgpNtubGUW/Y1tBQ1B0i5CtSoelOLKFYlElIr3bvgREYYO5iRqbMY1YuqZng0GVOI8Qww==}
     dependencies:
       '@types/mdast': 3.0.12
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
       decode-named-character-reference: 1.0.2
       mdast-util-to-string: 3.2.0
       micromark: 3.2.0
@@ -9945,7 +10885,7 @@ packages:
     resolution: {integrity: sha512-bbv7TPv/WC49thZPg3jXuqzuvI45IL2EVAr/KxF0BSdHsU0ceFHOmwQn6evxAh1GaoK/6GQ1wp4R4oW2+LFL/A==}
     dependencies:
       '@types/mdast': 3.0.12
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
       longest-streak: 3.1.0
       mdast-util-phrasing: 3.0.1
       mdast-util-to-string: 3.2.0
@@ -10251,11 +11191,6 @@ packages:
     engines: {node: '>=6'}
     dev: true
 
-  /mimic-fn@4.0.0:
-    resolution: {integrity: sha512-vqiC06CuhBTUdZH+RYl8sFrL096vA45Ok5ISO6sE/Mr1jRbGH4Csnhi8f3wKVl7x8mO4Au7Ir9D3Oyv1VYMFJw==}
-    engines: {node: '>=12'}
-    dev: true
-
   /mimic-response@2.1.0:
     resolution: {integrity: sha512-wXqjST+SLt7R009ySCglWBCFpjUygmCIfD790/kVbiGmUgfYGuB14PiTd5DwVxSV4NcYHjzMkoj5LjQZwTQLEA==}
     engines: {node: '>=8'}
@@ -10305,8 +11240,13 @@ packages:
     resolution: {integrity: sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==}
     engines: {node: '>=8'}
 
-  /minipass@7.0.2:
-    resolution: {integrity: sha512-eL79dXrE1q9dBbDCLg7xfn/vl7MS4F1gvJAgjJrQli/jbQWdUttuVawphqpffoIYfRdq78LHx6GP4bU/EQ2ATA==}
+  /minipass@7.0.3:
+    resolution: {integrity: sha512-LhbbwCfz3vsb12j/WkWQPZfKTsgqIe1Nf/ti1pKjYESGLHIVjWU96G9/ljLH4F9mWNVhlQOm0VySdAWzf05dpg==}
+    engines: {node: '>=16 || 14 >=14.17'}
+    dev: true
+
+  /minipass@7.0.4:
+    resolution: {integrity: sha512-jYofLM5Dam9279rdkWzqHozUo4ybjdZmCsDHePy5V/PbBcVMiSZR97gmAy45aqi8CK1lG2ECd356FU86avfwUQ==}
     engines: {node: '>=16 || 14 >=14.17'}
     dev: true
 
@@ -10333,13 +11273,13 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
-  /mock-socket@9.2.1:
-    resolution: {integrity: sha512-aw9F9T9G2zpGipLLhSNh6ZpgUyUl4frcVmRN08uE1NWPWg43Wx6+sGPDbQ7E5iFZZDJW5b5bypMeAEHqTbIFag==}
+  /mock-socket@9.3.1:
+    resolution: {integrity: sha512-qxBgB7Qa2sEQgHFjj0dSigq7fX4k6Saisd5Nelwp2q8mlbAFh5dHV9JTTlF8viYJLSSWgMCZFUom8PJcMNBoJw==}
     engines: {node: '>= 8'}
     dev: true
 
-  /monaco-editor@0.40.0:
-    resolution: {integrity: sha512-1wymccLEuFSMBvCk/jT1YDW/GuxMLYwnFwF9CDyYCxoTw2Pt379J3FUhwy9c43j51JdcxVPjwk0jm0EVDsBS2g==}
+  /monaco-editor@0.43.0:
+    resolution: {integrity: sha512-cnoqwQi/9fml2Szamv1XbSJieGJ1Dc8tENVMD26Kcfl7xGQWp7OBKMjlwKVGYFJ3/AXJjSOGvcqK7Ry/j9BM1Q==}
     dev: false
 
   /moo-color@1.0.3:
@@ -10367,13 +11307,13 @@ packages:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
     dev: true
 
-  /msw@1.2.2(typescript@5.1.6):
-    resolution: {integrity: sha512-GsW3PE/Es/a1tYThXcM8YHOZ1S1MtivcS3He/LQbbTCx3rbWJYCtWD5XXyJ53KlNPT7O1VI9sCW3xMtgFe8XpQ==}
+  /msw@1.3.0(typescript@5.2.2):
+    resolution: {integrity: sha512-nnWAZlQyQOKeYRblCpseT1kSPt1aF5e/jHz1hn/18IxbsMFreSVV1cJriT0uV+YG6+wvwFRMHXU3zVuMvuwERQ==}
     engines: {node: '>=14'}
     hasBin: true
     requiresBuild: true
     peerDependencies:
-      typescript: '>= 4.4.x <= 5.1.x'
+      typescript: '>= 4.4.x <= 5.2.x'
     peerDependenciesMeta:
       typescript:
         optional: true
@@ -10383,20 +11323,20 @@ packages:
       '@open-draft/until': 1.0.3
       '@types/cookie': 0.4.1
       '@types/js-levenshtein': 1.1.1
-      chalk: 4.1.1
+      chalk: 4.1.2
       chokidar: 3.5.3
       cookie: 0.4.2
       graphql: 16.7.1
-      headers-polyfill: 3.1.2
+      headers-polyfill: 3.2.3
       inquirer: 8.2.5
       is-node-process: 1.2.0
       js-levenshtein: 1.1.6
-      node-fetch: 2.6.12
+      node-fetch: 2.7.0
       outvariant: 1.4.0
       path-to-regexp: 6.2.1
       strict-event-emitter: 0.4.6
       type-fest: 2.19.0
-      typescript: 5.1.6
+      typescript: 5.2.2
       yargs: 17.7.2
     transitivePeerDependencies:
       - encoding
@@ -10409,6 +11349,13 @@ packages:
 
   /nan@2.17.0:
     resolution: {integrity: sha512-2ZTgtl0nJsO0KQCjEpxcIr5D+Yv90plTitZt9JBfQvVJDS5seMl3FOvsh3+9CoYWXf/1l5OaZzzF6nDm4cagaQ==}
+    dev: false
+
+  /nan@2.18.0:
+    resolution: {integrity: sha512-W7tfG7vMOGtD30sHoZSSc/JVYiyDPEyQVso/Zz+/uQd0B0L46gtC+pHha5FFMRpil6fm/AoEcRWyOVi4+E/f8w==}
+    requiresBuild: true
+    dev: true
+    optional: true
 
   /nano-css@5.3.5(react-dom@18.2.0)(react@18.2.0):
     resolution: {integrity: sha512-vSB9X12bbNu4ALBu7nigJgRViZ6ja3OU7CeuiV1zMIbXOdmkLahgtPmh3GBOlDxbKY0CitqlPdOReGlBLSp+yg==}
@@ -10433,10 +11380,6 @@ packages:
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
-  /natural-compare-lite@1.4.0:
-    resolution: {integrity: sha512-Tj+HTDSJJKaZnfiuw+iaF9skdPpTo2GtEly5JHnWV/hfv2Qj/9RKsGISQtLh2ox3l5EAGw487hnBee0sIJ6v2g==}
-    dev: true
-
   /natural-compare@1.4.0:
     resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
 
@@ -10456,12 +11399,12 @@ packages:
       minimatch: 3.1.2
     dev: true
 
-  /node-fetch-native@1.2.0:
-    resolution: {integrity: sha512-5IAMBTl9p6PaAjYCnMv5FmqIF6GcZnawAVnzaCG0rX2aYZJ4CxEkZNtVPuTRug7fL7wyM5BQYTlAzcyMPi6oTQ==}
+  /node-fetch-native@1.4.0:
+    resolution: {integrity: sha512-F5kfEj95kX8tkDhUCYdV8dg3/8Olx/94zB8+ZNthFs6Bz31UpUi8Xh40TN3thLwXgrwXry1pEg9lJ++tLWTcqA==}
     dev: true
 
-  /node-fetch@2.6.12:
-    resolution: {integrity: sha512-C/fGU2E8ToujUivIO0H+tpQ6HWo4eEmchoPIoXtxCrVghxdKq+QOHqEZW7tuP3KlV3bC8FRMO5nMCC7Zm1VP6g==}
+  /node-fetch@2.7.0:
+    resolution: {integrity: sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==}
     engines: {node: 4.x || >=6.0.0}
     peerDependencies:
       encoding: ^0.1.0
@@ -10490,7 +11433,7 @@ packages:
     resolution: {integrity: sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==}
     dependencies:
       hosted-git-info: 2.8.9
-      resolve: 1.22.3
+      resolve: 1.22.4
       semver: 7.5.3
       validate-npm-package-license: 3.0.4
     dev: true
@@ -10507,13 +11450,6 @@ packages:
       path-key: 3.1.1
     dev: true
 
-  /npm-run-path@5.1.0:
-    resolution: {integrity: sha512-sJOdmRGrY2sjNTRMbSvluQqg+8X7ZK61yvzBEIDhz4f8z1TZFYABsqjjCBd/0PUNE9M6QDgHJXQkGUEm7Q+l9Q==}
-    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
-    dependencies:
-      path-key: 4.0.0
-    dev: true
-
   /npmlog@5.0.1:
     resolution: {integrity: sha512-AqZtDUWOMKs1G/8lwylVjrdYgqA4d9nu8hc+0gzRxlDb1I10+FHBGMXs6aiQHFdCUUlqH99MUMuLfzWDNDtfxw==}
     dependencies:
@@ -10625,13 +11561,6 @@ packages:
       mimic-fn: 2.1.0
     dev: true
 
-  /onetime@6.0.0:
-    resolution: {integrity: sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ==}
-    engines: {node: '>=12'}
-    dependencies:
-      mimic-fn: 4.0.0
-    dev: true
-
   /open@8.4.2:
     resolution: {integrity: sha512-7x81NCL719oNbsq/3mh+hVrAWmFuEYUqrq/Iw3kUzH8ReypT9QQ0BLoJS7/G9k6N81XjW4qHWtjWwe/9eLy1EQ==}
     engines: {node: '>=12'}
@@ -10640,16 +11569,6 @@ packages:
       is-docker: 2.2.1
       is-wsl: 2.2.0
 
-  /open@9.1.0:
-    resolution: {integrity: sha512-OS+QTnw1/4vrf+9hh1jc1jnYjzSG4ttTBB8UxOwAnInG3Uo4ssetzC1ihqaIHjLJnA5GGlRl6QlZXOTQhRBUvg==}
-    engines: {node: '>=14.16'}
-    dependencies:
-      default-browser: 4.0.0
-      define-lazy-prop: 3.0.0
-      is-inside-container: 1.0.0
-      is-wsl: 2.2.0
-    dev: true
-
   /optionator@0.9.3:
     resolution: {integrity: sha512-JjCoypp+jKn1ttEFExxhetCKeJt9zhAgAve5FXHixTvFDW/5aEktX9bufBKLRRMdU7bNtpLfcGu94B3cdEJgjg==}
     engines: {node: '>= 0.8.0'}
@@ -10755,7 +11674,7 @@ packages:
     resolution: {integrity: sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==}
     engines: {node: '>=8'}
     dependencies:
-      '@babel/code-frame': 7.22.5
+      '@babel/code-frame': 7.22.13
       error-ex: 1.3.2
       json-parse-even-better-errors: 2.3.1
       lines-and-columns: 1.2.4
@@ -10792,11 +11711,6 @@ packages:
     resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
     engines: {node: '>=8'}
 
-  /path-key@4.0.0:
-    resolution: {integrity: sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ==}
-    engines: {node: '>=12'}
-    dev: true
-
   /path-parse@1.0.7:
     resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
 
@@ -10804,8 +11718,8 @@ packages:
     resolution: {integrity: sha512-MkhCqzzBEpPvxxQ71Md0b1Kk51W01lrYvlMzSUaIzNsODdd7mqhiimSZlr+VegAz5Z6Vzt9Xg2ttE//XBhH3EQ==}
     engines: {node: '>=16 || 14 >=14.17'}
     dependencies:
-      lru-cache: 10.0.0
-      minipass: 7.0.2
+      lru-cache: 10.0.1
+      minipass: 7.0.3
     dev: true
 
   /path-to-regexp@0.1.7:
@@ -10874,10 +11788,20 @@ packages:
       find-up: 5.0.0
     dev: true
 
-  /playwright-core@1.36.0:
-    resolution: {integrity: sha512-7RTr8P6YJPAqB+8j5ATGHqD6LvLLM39sYVNsslh78g8QeLcBs5750c6+msjrHUwwGt+kEbczBj1XB22WMwn+WA==}
+  /playwright-core@1.38.0:
+    resolution: {integrity: sha512-f8z1y8J9zvmHoEhKgspmCvOExF2XdcxMW8jNRuX4vkQFrzV4MlZ55iwb5QeyiFQgOFCUolXiRHgpjSEnqvO48g==}
+    engines: {node: '>=16'}
+    hasBin: true
+    dev: true
+
+  /playwright@1.38.0:
+    resolution: {integrity: sha512-fJGw+HO0YY+fU/F1N57DMO+TmXHTrmr905J05zwAQE9xkuwP/QLDk63rVhmyxh03dYnEhnRbsdbH9B0UVVRB3A==}
     engines: {node: '>=16'}
     hasBin: true
+    dependencies:
+      playwright-core: 1.38.0
+    optionalDependencies:
+      fsevents: 2.3.2
     dev: true
 
   /pluralize@8.0.0:
@@ -10889,11 +11813,11 @@ packages:
     resolution: {integrity: sha512-Sz2Lkdxz6F2Pgnpi9U5Ng/WdWAUZxmHrNPoVlm3aAemxoy2Qy7LGjQg4uf8qKelDAUW94F4np3iH2YPf2qefcQ==}
     engines: {node: '>=10'}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.22.15
     dev: true
 
-  /postcss@8.4.27:
-    resolution: {integrity: sha512-gY/ACJtJPSmUFPDCHtX78+01fHa64FaU4zaaWfuh1MhGJISufJAH4cun6k/8fwsHYeK4UQmENQK+tRLCFJE8JQ==}
+  /postcss@8.4.31:
+    resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==}
     engines: {node: ^10 || ^12 || >=14}
     dependencies:
       nanoid: 3.3.6
@@ -10930,23 +11854,22 @@ packages:
       react-is: 17.0.2
     dev: true
 
-  /pretty-format@28.1.3:
-    resolution: {integrity: sha512-8gFb/To0OmxHR9+ZTb14Df2vNxdGCX8g1xWGUTqUw5TiZvcQf5sHKObd5UcPyLLyowNwDAMTF3XWOG1B6mxl1Q==}
-    engines: {node: ^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0}
+  /pretty-format@29.6.2:
+    resolution: {integrity: sha512-1q0oC8eRveTg5nnBEWMXAU2qpv65Gnuf2eCQzSjxpWFkPaPARwqZZDGuNE0zPAZfTCHzIk3A8dIjwlQKKLphyg==}
+    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
-      '@jest/schemas': 28.1.3
-      ansi-regex: 5.0.1
+      '@jest/schemas': 29.6.3
       ansi-styles: 5.2.0
       react-is: 18.2.0
-    dev: true
 
-  /pretty-format@29.6.2:
-    resolution: {integrity: sha512-1q0oC8eRveTg5nnBEWMXAU2qpv65Gnuf2eCQzSjxpWFkPaPARwqZZDGuNE0zPAZfTCHzIk3A8dIjwlQKKLphyg==}
+  /pretty-format@29.7.0:
+    resolution: {integrity: sha512-Pdlw/oPxN+aXdmM9R00JVC9WVFoCLTKJvDVLgmJ+qAffBMxsV85l/Lu7sNx4zSzPyoL2euImuEwHhOXdEgNFZQ==}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
     dependencies:
-      '@jest/schemas': 29.6.0
+      '@jest/schemas': 29.6.3
       ansi-styles: 5.2.0
       react-is: 18.2.0
+    dev: true
 
   /pretty-hrtime@1.0.3:
     resolution: {integrity: sha512-66hKPCr+72mlfiSjlEB1+45IjXSqvVAIy6mocupoww4tBFE9R9IhwwUGoI4G++Tc9Aq+2rxOt0RFU6gPcrte0A==}
@@ -11025,9 +11948,8 @@ packages:
       '@protobufjs/path': 1.1.2
       '@protobufjs/pool': 1.1.0
       '@protobufjs/utf8': 1.1.0
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       long: 5.2.3
-    dev: true
 
   /proxy-addr@2.0.7:
     resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
@@ -11134,13 +12056,13 @@ packages:
       unpipe: 1.0.0
     dev: true
 
-  /react-chartjs-2@5.2.0(chart.js@3.9.1)(react@18.2.0):
+  /react-chartjs-2@5.2.0(chart.js@4.4.0)(react@18.2.0):
     resolution: {integrity: sha512-98iN5aguJyVSxp5U3CblRLH67J8gkfyGNbiK3c+l1QI/G4irHMPQw44aEPmjVag+YKTyQ260NcF82GTQ3bdscA==}
     peerDependencies:
       chart.js: ^4.1.1
       react: ^16.8.0 || ^17.0.0 || ^18.0.0
     dependencies:
-      chart.js: 3.9.1
+      chart.js: 4.4.0
       react: 18.2.0
     dev: false
 
@@ -11179,12 +12101,26 @@ packages:
       tween-functions: 1.2.0
     dev: false
 
-  /react-docgen-typescript@2.2.2(typescript@5.1.6):
+  /react-date-range@1.4.0(date-fns@2.30.0)(react@18.2.0):
+    resolution: {integrity: sha512-+9t0HyClbCqw1IhYbpWecjsiaftCeRN5cdhsi9v06YdimwyMR2yYHWcgVn3URwtN/txhqKpEZB6UX1fHpvK76w==}
+    peerDependencies:
+      date-fns: 2.0.0-alpha.7 || >=2.0.0
+      react: ^0.14 || ^15.0.0-rc || >=15.0
+    dependencies:
+      classnames: 2.3.2
+      date-fns: 2.30.0
+      prop-types: 15.8.1
+      react: 18.2.0
+      react-list: 0.8.17(react@18.2.0)
+      shallow-equal: 1.2.1
+    dev: false
+
+  /react-docgen-typescript@2.2.2(typescript@5.2.2):
     resolution: {integrity: sha512-tvg2ZtOpOi6QDwsb3GZhOjDkkX0h8Z2gipvTg6OVMUyoYoURhEiRNePT8NZItTVCDh39JJHnLdfCOkzoLbFnTg==}
     peerDependencies:
       typescript: '>= 4.3.x'
     dependencies:
-      typescript: 5.1.6
+      typescript: 5.2.2
     dev: true
 
   /react-docgen@6.0.0-alpha.3:
@@ -11192,15 +12128,15 @@ packages:
     engines: {node: '>=12.0.0'}
     hasBin: true
     dependencies:
-      '@babel/core': 7.22.9
-      '@babel/generator': 7.22.9
+      '@babel/core': 7.22.11
+      '@babel/generator': 7.23.0
       ast-types: 0.14.2
       commander: 2.20.3
       doctrine: 3.0.0
       estree-to-babel: 3.2.1
       neo-async: 2.6.2
       node-dir: 0.1.17
-      resolve: 1.22.3
+      resolve: 1.22.4
       strip-indent: 3.0.0
     transitivePeerDependencies:
       - supports-color
@@ -11234,7 +12170,7 @@ packages:
     peerDependencies:
       react: '>=16.13.1'
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       react: 18.2.0
     dev: true
 
@@ -11246,16 +12182,6 @@ packages:
     resolution: {integrity: sha512-nsO+KSNgo1SbJqJEYRE9ERzo7YtYbou/OqjSQKxV7jcKox7+usiUVZOAC+XnDOABXggQTno0Y1CpVnuWEc1boQ==}
     dev: false
 
-  /react-headless-tabs@6.0.3(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-VBkN/P1Mpc/4WPcbl0Is+LvVzlqjWxX3G6kOxGQZX63zKaVpU0WP5NBS43JqqgZTG7nJ3JMYTHVXe79uTmRg7w==}
-    peerDependencies:
-      react: '>=16.8'
-      react-dom: '>=16.8'
-    dependencies:
-      react: 18.2.0
-      react-dom: 18.2.0(react@18.2.0)
-    dev: false
-
   /react-helmet-async@1.3.0(react-dom@18.2.0)(react@18.2.0):
     resolution: {integrity: sha512-9jZ57/dAn9t3q6hneQS0wukqC2ENOBgMNVEhb/ZG9ZSxUetzVIw4iAmEU38IaVg3QGYauQPhSeUTuIUtFglWpg==}
     peerDependencies:
@@ -11271,26 +12197,6 @@ packages:
       shallowequal: 1.1.0
     dev: false
 
-  /react-i18next@12.2.2(i18next@22.5.0)(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-KBB6buBmVKXUWNxXHdnthp+38gPyBT46hJCAIQ8rX19NFL/m2ahte2KARfIDf2tMnSAL7wwck6eDOd/9zn6aFg==}
-    peerDependencies:
-      i18next: '>= 19.0.0'
-      react: '>= 16.8.0'
-      react-dom: '*'
-      react-native: '*'
-    peerDependenciesMeta:
-      react-dom:
-        optional: true
-      react-native:
-        optional: true
-    dependencies:
-      '@babel/runtime': 7.22.6
-      html-parse-stringify: 3.0.1
-      i18next: 22.5.0
-      react: 18.2.0
-      react-dom: 18.2.0(react@18.2.0)
-    dev: false
-
   /react-inspector@6.0.2(react@18.2.0):
     resolution: {integrity: sha512-x+b7LxhmHXjHoU/VrFAzw5iutsILRoYyDq97EDYdFpPLcvqtEzk4ZSZSQjnFPbr5T57tLXnHcqFYoN1pI6u8uQ==}
     peerDependencies:
@@ -11313,8 +12219,17 @@ packages:
   /react-is@18.2.0:
     resolution: {integrity: sha512-xWGDIW6x921xtzPkhiULtthJHoJvBbF3q26fzloPCK0hsvxtPVelvftw3zjbHWSkR2km9Z+4uxbDDK/6Zw9B8w==}
 
-  /react-markdown@8.0.3(@types/react@18.2.6)(react@18.2.0):
-    resolution: {integrity: sha512-We36SfqaKoVNpN1QqsZwWSv/OZt5J15LNgTLWynwAN5b265hrQrsjMtlRNwUvS+YyR3yDM8HpTNc4pK9H/Gc0A==}
+  /react-list@0.8.17(react@18.2.0):
+    resolution: {integrity: sha512-pgmzGi0G5uGrdHzMhgO7KR1wx5ZXVvI3SsJUmkblSAKtewIhMwbQiMuQiTE83ozo04BQJbe0r3WIWzSO0dR1xg==}
+    peerDependencies:
+      react: 0.14 || 15 - 18
+    dependencies:
+      prop-types: 15.8.1
+      react: 18.2.0
+    dev: false
+
+  /react-markdown@8.0.7(@types/react@18.2.6)(react@18.2.0):
+    resolution: {integrity: sha512-bvWbzG4MtOU62XqBx3Xx+zB2raaFFsq4mYiAzfjXJMEz2sixgeAfraA3tvzULF02ZdOMUOKTBFFaZJDDrq+BJQ==}
     peerDependencies:
       '@types/react': '>=16'
       react: '>=16'
@@ -11322,7 +12237,7 @@ packages:
       '@types/hast': 2.3.5
       '@types/prop-types': 15.7.5
       '@types/react': 18.2.6
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
       comma-separated-tokens: 2.0.3
       hast-util-whitespace: 2.0.1
       prop-types: 15.8.1
@@ -11332,7 +12247,7 @@ packages:
       remark-parse: 10.0.2
       remark-rehype: 10.1.0
       space-separated-tokens: 2.0.2
-      style-to-object: 0.3.0
+      style-to-object: 0.4.2
       unified: 10.1.2
       unist-util-visit: 4.1.2
       vfile: 5.3.7
@@ -11357,7 +12272,7 @@ packages:
       '@types/react': 18.2.6
       react: 18.2.0
       react-style-singleton: 2.2.1(@types/react@18.2.6)(react@18.2.0)
-      tslib: 2.6.1
+      tslib: 2.6.2
     dev: true
 
   /react-remove-scroll@2.5.5(@types/react@18.2.6)(react@18.2.0):
@@ -11374,41 +12289,31 @@ packages:
       react: 18.2.0
       react-remove-scroll-bar: 2.3.4(@types/react@18.2.6)(react@18.2.0)
       react-style-singleton: 2.2.1(@types/react@18.2.6)(react@18.2.0)
-      tslib: 2.6.1
+      tslib: 2.6.2
       use-callback-ref: 1.3.0(@types/react@18.2.6)(react@18.2.0)
       use-sidecar: 1.1.2(@types/react@18.2.6)(react@18.2.0)
     dev: true
 
-  /react-router-dom@6.14.1(react-dom@18.2.0)(react@18.2.0):
-    resolution: {integrity: sha512-ssF6M5UkQjHK70fgukCJyjlda0Dgono2QGwqGvuk7D+EDGHdacEN3Yke2LTMjkrpHuFwBfDFsEjGVXBDmL+bWw==}
-    engines: {node: '>=14'}
+  /react-router-dom@6.16.0(react-dom@18.2.0)(react@18.2.0):
+    resolution: {integrity: sha512-aTfBLv3mk/gaKLxgRDUPbPw+s4Y/O+ma3rEN1u8EgEpLpPe6gNjIsWt9rxushMHHMb7mSwxRGdGlGdvmFsyPIg==}
+    engines: {node: '>=14.0.0'}
     peerDependencies:
       react: '>=16.8'
       react-dom: '>=16.8'
     dependencies:
-      '@remix-run/router': 1.7.1
+      '@remix-run/router': 1.9.0
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
-      react-router: 6.14.1(react@18.2.0)
-
-  /react-router@6.14.1(react@18.2.0):
-    resolution: {integrity: sha512-U4PfgvG55LdvbQjg5Y9QRWyVxIdO1LlpYT7x+tMAxd9/vmiPuJhIwdxZuIQLN/9e3O4KFDHYfR9gzGeYMasW8g==}
-    engines: {node: '>=14'}
-    peerDependencies:
-      react: '>=16.8'
-    dependencies:
-      '@remix-run/router': 1.7.1
-      react: 18.2.0
+      react-router: 6.16.0(react@18.2.0)
 
-  /react-router@6.14.2(react@18.2.0):
-    resolution: {integrity: sha512-09Zss2dE2z+T1D03IheqAFtK4UzQyX8nFPWx6jkwdYzGLXd5ie06A6ezS2fO6zJfEb/SpG6UocN2O1hfD+2urQ==}
-    engines: {node: '>=14'}
+  /react-router@6.16.0(react@18.2.0):
+    resolution: {integrity: sha512-VT4Mmc4jj5YyjpOi5jOf0I+TYzGpvzERy4ckNSvSh2RArv8LLoCxlsZ2D+tc7zgjxcY34oTz2hZaeX5RVprKqA==}
+    engines: {node: '>=14.0.0'}
     peerDependencies:
       react: '>=16.8'
     dependencies:
-      '@remix-run/router': 1.7.2
+      '@remix-run/router': 1.9.0
       react: 18.2.0
-    dev: true
 
   /react-style-singleton@2.2.1(@types/react@18.2.6)(react@18.2.0):
     resolution: {integrity: sha512-ZWj0fHEMyWkHzKYUr2Bs/4zU6XLmq9HsgBURm7g5pAVfyn49DgUiNgY2d4lXRlYSiCif9YBGpQleewkcqddc7g==}
@@ -11424,7 +12329,7 @@ packages:
       get-nonce: 1.0.1
       invariant: 2.2.4
       react: 18.2.0
-      tslib: 2.6.1
+      tslib: 2.6.2
     dev: true
 
   /react-syntax-highlighter@15.5.0(react@18.2.0):
@@ -11446,7 +12351,7 @@ packages:
       react: '>=16.6.0'
       react-dom: '>=16.6.0'
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
       dom-helpers: 5.2.1
       loose-envify: 1.4.0
       prop-types: 15.8.1
@@ -11587,18 +12492,18 @@ packages:
       ast-types: 0.15.2
       esprima: 4.0.1
       source-map: 0.6.1
-      tslib: 2.6.1
+      tslib: 2.6.2
     dev: true
 
-  /recast@0.23.3:
-    resolution: {integrity: sha512-HbCVFh2ANP6a09nzD4lx7XthsxMOJWKX5pIcUwtLrmeEIl3I0DwjCoVXDE0Aobk+7k/mS3H50FK4iuYArpcT6Q==}
+  /recast@0.23.4:
+    resolution: {integrity: sha512-qtEDqIZGVcSZCHniWwZWbRy79Dc6Wp3kT/UmDA2RJKBPg7+7k51aQBZirHmUGn5uvHf2rg8DkjizrN26k61ATw==}
     engines: {node: '>= 4'}
     dependencies:
       assert: 2.0.0
       ast-types: 0.16.1
       esprima: 4.0.1
       source-map: 0.6.1
-      tslib: 2.6.1
+      tslib: 2.6.2
     dev: true
 
   /redent@3.0.0:
@@ -11631,10 +12536,13 @@ packages:
   /regenerator-runtime@0.13.11:
     resolution: {integrity: sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg==}
 
-  /regenerator-transform@0.15.1:
-    resolution: {integrity: sha512-knzmNAcuyxV+gQCufkYcvOqX/qIIfHLv0u5x79kRxuGojfYVky1f15TzZEu2Avte8QGepvUNTnLskf8E6X6Vyg==}
+  /regenerator-runtime@0.14.0:
+    resolution: {integrity: sha512-srw17NI0TUWHuGa5CFGGmhfNIeja30WMBfbslPNhf6JrqQlLN5gcrvig1oqPxiVaXb0oW0XRKtH6Nngs5lKCIA==}
+
+  /regenerator-transform@0.15.2:
+    resolution: {integrity: sha512-hfMp2BoF0qOk3uc5V20ALGDS2ddjQaLrdl7xrGXvAIow7qeWRM2VA2HuCHkUKk9slq3VwEwLNK3DFBqDfPGYtg==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
     dev: true
 
   /regexp-tree@0.1.27:
@@ -11741,10 +12649,6 @@ packages:
     resolution: {integrity: sha512-LwZrotdHOo12nQuZlHEmtuXdqGoOD0OhaxopaNFxWzInpEgaLWoVuAMbTzixuosCx2nEG58ngzW3vxdWoxIgdg==}
     dev: false
 
-  /resize-observer@1.0.4:
-    resolution: {integrity: sha512-AQ2MdkWTng9d6JtjHvljiQR949qdae91pjSNugGGeOFzKIuLHvoZIYhUTjePla5hCFDwQHrnkciAIzjzdsTZew==}
-    dev: true
-
   /resolve-cwd@3.0.0:
     resolution: {integrity: sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==}
     engines: {node: '>=8'}
@@ -11774,7 +12678,16 @@ packages:
     resolution: {integrity: sha512-P8ur/gp/AmbEzjr729bZnLjXK5Z+4P0zhIJgBgzqRih7hL7BOukHGtSTA3ACMY467GRFz3duQsi0bDZdR7DKdw==}
     hasBin: true
     dependencies:
-      is-core-module: 2.12.1
+      is-core-module: 2.13.0
+      path-parse: 1.0.7
+      supports-preserve-symlinks-flag: 1.0.0
+    dev: true
+
+  /resolve@1.22.4:
+    resolution: {integrity: sha512-PXNdCiPqDqeUou+w1C2eTQbNfxKSuMxqTCuvlmmMsk1NWHL5fRrhY6Pl0qEYYc6+QqGClco1Qj8XnjPego4wfg==}
+    hasBin: true
+    dependencies:
+      is-core-module: 2.13.0
       path-parse: 1.0.7
       supports-preserve-symlinks-flag: 1.0.0
 
@@ -11782,7 +12695,7 @@ packages:
     resolution: {integrity: sha512-iMDbmAWtfU+MHpxt/I5iWI7cY6YVEZUQ3MBgPQ++XD1PELuJHIl82xBmObyP2KyQmkNB2dsqF7seoQQiAn5yDQ==}
     hasBin: true
     dependencies:
-      is-core-module: 2.12.1
+      is-core-module: 2.13.0
       path-parse: 1.0.7
       supports-preserve-symlinks-flag: 1.0.0
     dev: true
@@ -11840,21 +12753,22 @@ packages:
     engines: {node: '>=14.18.0', npm: '>=8.0.0'}
     hasBin: true
     optionalDependencies:
-      fsevents: 2.3.2
+      fsevents: 2.3.3
+
+  /rollup@3.28.1:
+    resolution: {integrity: sha512-R9OMQmIHJm9znrU3m3cpE8uhN0fGdXiawME7aZIpQqvpS/85+Vt1Hq1/yVIcYfOmaQiHjvXkQAoJukvLpau6Yw==}
+    engines: {node: '>=14.18.0', npm: '>=8.0.0'}
+    hasBin: true
+    optionalDependencies:
+      fsevents: 2.3.3
+    dev: true
 
   /rtl-css-js@1.16.1:
     resolution: {integrity: sha512-lRQgou1mu19e+Ya0LsTvKrVJ5TYUbqCVPAiImX3UfLTenarvPUl1QFdvu5Z3PYmHT9RCcwIfbjRQBntExyj3Zg==}
     dependencies:
-      '@babel/runtime': 7.22.6
+      '@babel/runtime': 7.23.1
     dev: false
 
-  /run-applescript@5.0.0:
-    resolution: {integrity: sha512-XcT5rBksx1QdIhlFOCtgZkB99ZEouFZ1E2Kc2LHqNW13U3/74YGdkQRmThTwxy4QIyookibDKYZOPqX//6BlAg==}
-    engines: {node: '>=12'}
-    dependencies:
-      execa: 5.1.1
-    dev: true
-
   /run-async@2.4.1:
     resolution: {integrity: sha512-tvVnVv01b8c1RrA6Ep7JkStj85Guv/YrMcwqYQnwjsAS2cTmmPGBBjAjpCW7RrSodNSoE2/qg9O4bceNvUuDgQ==}
     engines: {node: '>=0.12.0'}
@@ -11868,7 +12782,7 @@ packages:
   /rxjs@7.8.1:
     resolution: {integrity: sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg==}
     dependencies:
-      tslib: 2.6.1
+      tslib: 2.6.2
     dev: true
 
   /sade@1.8.1:
@@ -12001,6 +12915,10 @@ packages:
       kind-of: 6.0.3
     dev: true
 
+  /shallow-equal@1.2.1:
+    resolution: {integrity: sha512-S4vJDjHHMBaiZuT9NPb616CSmLf618jawtv3sufLl6ivK8WocjAo58cXwbRV1cgqxH0Qbv+iUt6m05eqEa2IRA==}
+    dev: false
+
   /shallowequal@1.1.0:
     resolution: {integrity: sha512-y0m1JoUZSlPAjXVtPPW70aZWfIL/dSP7AFkRnniLCrK/8MDKog3TySTBmckD+RObVxH0v4Tox67+F14PdED2oQ==}
     dev: false
@@ -12026,8 +12944,8 @@ packages:
   /signal-exit@3.0.7:
     resolution: {integrity: sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==}
 
-  /signal-exit@4.0.2:
-    resolution: {integrity: sha512-MY2/qGx4enyjprQnFaZsHib3Yadh3IXyV2C321GY0pjGfVBu4un0uDJkwgdxqO+Rdx8JMT8IfJIRwbYVz3Ob3Q==}
+  /signal-exit@4.1.0:
+    resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
     engines: {node: '>=14'}
     dev: true
 
@@ -12058,11 +12976,6 @@ packages:
     resolution: {integrity: sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==}
     engines: {node: '>=8'}
 
-  /slash@4.0.0:
-    resolution: {integrity: sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==}
-    engines: {node: '>=12'}
-    dev: true
-
   /source-map-js@1.0.2:
     resolution: {integrity: sha512-R0XvVJ9WusLiqTCEiGCmICCMplcCkIwwR11mOSD9CR5u+IXYdiseeEuXCVAjS54zqwkLcPNnmU4OeJ6tUrWhDw==}
     engines: {node: '>=0.10.0'}
@@ -12105,12 +13018,6 @@ packages:
     deprecated: Please use @jridgewell/sourcemap-codec instead
     dev: false
 
-  /sourcemapped-stacktrace@1.1.11:
-    resolution: {integrity: sha512-O0pcWjJqzQFVsisPlPXuNawJHHg9N9UgpJ/aDmvi9+vnS3x1C0NhwkVFzzZ1VN0Xo+bekyweoqYvBw5ZBKiNnQ==}
-    dependencies:
-      source-map: 0.5.6
-    dev: false
-
   /space-separated-tokens@1.1.5:
     resolution: {integrity: sha512-q/JSVd1Lptzhf5bkYm4ob4iWPjx0KiRe3sRFBNrVqbJkFaBm5vbbowy1mymoPNLRa52+oadOhJ+K49wsSeSjTA==}
 
@@ -12151,8 +13058,8 @@ packages:
       asn1: 0.2.6
       bcrypt-pbkdf: 1.0.2
     optionalDependencies:
-      cpu-features: 0.0.8
-      nan: 2.17.0
+      cpu-features: 0.0.9
+      nan: 2.18.0
     dev: true
 
   /stack-generator@2.0.10:
@@ -12206,7 +13113,7 @@ packages:
     resolution: {integrity: sha512-siT1RiqlfQnGqgT/YzXVUNsom9S0H1OX+dpdGN1xkyYATo4I6sep5NmsRD/40s3IIOvlCq6akxkqG82urIZW1w==}
     dev: true
 
-  /storybook-addon-react-router-v6@2.0.0(@storybook/blocks@7.2.0)(@storybook/channels@7.2.0)(@storybook/components@7.2.0)(@storybook/core-events@7.2.0)(@storybook/manager-api@7.2.0)(@storybook/preview-api@7.2.0)(@storybook/theming@7.2.0)(react-dom@18.2.0)(react-router-dom@6.14.1)(react-router@6.14.2)(react@18.2.0):
+  /storybook-addon-react-router-v6@2.0.0(@storybook/blocks@7.4.5)(@storybook/channels@7.4.5)(@storybook/components@7.4.5)(@storybook/core-events@7.4.5)(@storybook/manager-api@7.4.5)(@storybook/preview-api@7.4.5)(@storybook/theming@7.4.5)(react-dom@18.2.0)(react-router-dom@6.16.0)(react-router@6.16.0)(react@18.2.0):
     resolution: {integrity: sha512-M+PR7rdacFDwUCQZRBJVnzyEOqHrDVrTqN8ufqo+TuXxk33QZvb3QeZuo0d2UTYctgA1GY74EX9RJCEXZpv6VQ==}
     peerDependencies:
       '@storybook/blocks': ^7.0.0
@@ -12226,18 +13133,18 @@ packages:
       react-dom:
         optional: true
     dependencies:
-      '@storybook/blocks': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/channels': 7.2.0
-      '@storybook/components': 7.2.0(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/core-events': 7.2.0
-      '@storybook/manager-api': 7.2.0(react-dom@18.2.0)(react@18.2.0)
-      '@storybook/preview-api': 7.2.0
-      '@storybook/theming': 7.2.0(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/blocks': 7.4.5(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/channels': 7.4.5
+      '@storybook/components': 7.4.5(@types/react-dom@18.2.4)(@types/react@18.2.6)(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/core-events': 7.4.5
+      '@storybook/manager-api': 7.4.5(react-dom@18.2.0)(react@18.2.0)
+      '@storybook/preview-api': 7.4.5
+      '@storybook/theming': 7.4.5(react-dom@18.2.0)(react@18.2.0)
       react: 18.2.0
       react-dom: 18.2.0(react@18.2.0)
       react-inspector: 6.0.2(react@18.2.0)
-      react-router: 6.14.2(react@18.2.0)
-      react-router-dom: 6.14.1(react-dom@18.2.0)(react@18.2.0)
+      react-router: 6.16.0(react@18.2.0)
+      react-router-dom: 6.16.0(react-dom@18.2.0)(react@18.2.0)
     dev: true
 
   /storybook-react-context@0.6.0(react-dom@18.2.0):
@@ -12250,11 +13157,11 @@ packages:
       - react-dom
     dev: true
 
-  /storybook@7.2.0:
-    resolution: {integrity: sha512-2J+2SzxJD/EwRuqcZi+tlJddkTt9uynt+RUK01DjdX9RFy/8OnZwIi1O/w9WzxwO06kCO0KsajZEGSMvuwwuxQ==}
+  /storybook@7.4.0:
+    resolution: {integrity: sha512-jSwbyxHlr2dTY51Pv0mzenjrMDJNZH7DQhHu4ZezpjV+QK/rLCnD+Gt/7iDSaNlsmZJejQcmURDoEybWggMOqw==}
     hasBin: true
     dependencies:
-      '@storybook/cli': 7.2.0
+      '@storybook/cli': 7.4.0
     transitivePeerDependencies:
       - bufferutil
       - encoding
@@ -12378,11 +13285,6 @@ packages:
     engines: {node: '>=6'}
     dev: true
 
-  /strip-final-newline@3.0.0:
-    resolution: {integrity: sha512-dOESqjYr96iWYylGObzd39EuNTa5VJxyvVAEm5Jnh7KGo75V43Hk1odPQkNDyXNmUR6k+gEiDVXnjB8HJ3crXw==}
-    engines: {node: '>=12'}
-    dev: true
-
   /strip-indent@3.0.0:
     resolution: {integrity: sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ==}
     engines: {node: '>=8'}
@@ -12394,8 +13296,8 @@ packages:
     resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
     engines: {node: '>=8'}
 
-  /style-to-object@0.3.0:
-    resolution: {integrity: sha512-CzFnRRXhzWIdItT3OmF8SQfWyahHhjq3HwcMNCNLn+N7klOOqPjMeG/4JSu77D7ypZdGvSzvkrbyeTMizz2VrA==}
+  /style-to-object@0.4.2:
+    resolution: {integrity: sha512-1JGpfPB3lo42ZX8cuPrheZbfQ6kqPPnPHlKMyeRYtfKD+0jG+QsXgXN57O/dvJlzlB2elI6dGmrPnl5VPQFPaA==}
     dependencies:
       inline-style-parser: 0.1.1
     dev: false
@@ -12439,14 +13341,6 @@ packages:
     resolution: {integrity: sha512-AsS729u2RHUfEra9xJrE39peJcc2stq2+poBXX8bcM08Y6g9j/i/PUzwNQqkaJde7Ntg1TO7bSREbR5sdosQ+g==}
     dev: true
 
-  /synckit@0.8.5:
-    resolution: {integrity: sha512-L1dapNV6vu2s/4Sputv8xGsCdAVlb5nRDMFU/E27D44l5U6cw1g0dGd45uLc+OXjNMmF4ntiMdCimzcjFKQI8Q==}
-    engines: {node: ^14.18.0 || >=16.0.0}
-    dependencies:
-      '@pkgr/utils': 2.4.2
-      tslib: 2.6.1
-    dev: true
-
   /tapable@2.2.1:
     resolution: {integrity: sha512-GNzQvQTOIP6RyTfE2Qxb8ZVlNmw0n88vp1szwWRimP02mnTsx3Wtn5qRdqY9w2XduFNUgvOwhNnQsjwCp+kqaQ==}
     engines: {node: '>=6'}
@@ -12496,8 +13390,8 @@ packages:
       memoizerific: 1.11.3
     dev: true
 
-  /telejson@7.1.0:
-    resolution: {integrity: sha512-jFJO4P5gPebZAERPkJsqMAQ0IMA1Hi0AoSfxpnUaV6j6R2SZqlpkbS20U6dEUtA3RUYt2Ak/mTlkQzHH9Rv/hA==}
+  /telejson@7.2.0:
+    resolution: {integrity: sha512-1QTEcJkJEhc8OnStBx/ILRu5J2p0GjvWsBx56bmZRqnrkdBMUe+nX92jxV+p3dB4CP6PZCdJMQJwCggkNBMzkQ==}
     dependencies:
       memoizerific: 1.11.3
     dev: true
@@ -12573,11 +13467,6 @@ packages:
     resolution: {integrity: sha512-XPaBkWQJdsf3pLKJV9p4qN/S+fm2Oj8AIPo1BTUhg5oxkvm9+SVEGFdhyOz7tTdUTfvxMiAs4sp6/eZO2Ew+pw==}
     dev: false
 
-  /titleize@3.0.0:
-    resolution: {integrity: sha512-KxVu8EYHDPBdUYdKZdKtU2aj2XfEx9AfjXxE/Aj0vT06w2icA09Vus1rh6eSu1y01akYg6BjIK/hxyLJINoMLQ==}
-    engines: {node: '>=12'}
-    dev: true
-
   /tmp@0.0.33:
     resolution: {integrity: sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==}
     engines: {node: '>=0.6.0'}
@@ -12599,8 +13488,8 @@ packages:
     dependencies:
       is-number: 7.0.0
 
-  /tocbot@4.21.0:
-    resolution: {integrity: sha512-vXk8htr8mIl3hc2s2mDkaPTBfqmqZA2o0x7eXbxUibdrpEIPdpM0L9hH/RvEvlgSM+ZTgS34sGipk5+VrLJCLA==}
+  /tocbot@4.21.1:
+    resolution: {integrity: sha512-IfajhBTeg0HlMXu1f+VMbPef05QpDTsZ9X2Yn1+8npdaXsXg/+wrm9Ze1WG5OS1UDC3qJ5EQN/XOZ3gfXjPFCw==}
     dev: true
 
   /toggle-selection@1.0.6:
@@ -12648,13 +13537,13 @@ packages:
     engines: {node: 10.* || >= 12.*}
     dev: false
 
-  /ts-api-utils@1.0.1(typescript@5.1.6):
-    resolution: {integrity: sha512-lC/RGlPmwdrIBFTX59wwNzqh7aR2otPNPR/5brHZm/XKFYKsfqxihXUe9pU3JI+3vGkl+vyCoNNnPhJn3aLK1A==}
+  /ts-api-utils@1.0.3(typescript@5.2.2):
+    resolution: {integrity: sha512-wNMeqtMz5NtwpT/UZGY5alT+VoKdSsOOP/kqHFcUW1P/VRhH2wJ48+DN2WwUliNbQ976ETwDL0Ifd2VVvgonvg==}
     engines: {node: '>=16.13.0'}
     peerDependencies:
       typescript: '>=4.2.0'
     dependencies:
-      typescript: 5.1.6
+      typescript: 5.2.2
     dev: true
 
   /ts-dedent@2.2.0:
@@ -12673,7 +13562,7 @@ packages:
       code-block-writer: 11.0.3
     dev: false
 
-  /ts-node@10.9.1(@swc/core@1.3.38)(@types/node@18.17.0)(typescript@5.1.6):
+  /ts-node@10.9.1(@swc/core@1.3.38)(@types/node@18.18.1)(typescript@5.2.2):
     resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==}
     hasBin: true
     peerDependencies:
@@ -12693,40 +13582,40 @@ packages:
       '@tsconfig/node12': 1.0.11
       '@tsconfig/node14': 1.0.3
       '@tsconfig/node16': 1.0.4
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       acorn: 8.10.0
       acorn-walk: 8.2.0
       arg: 4.1.3
       create-require: 1.1.1
       diff: 4.0.2
       make-error: 1.3.6
-      typescript: 5.1.6
+      typescript: 5.2.2
       v8-compile-cache-lib: 3.0.1
       yn: 3.1.1
     dev: true
 
-  /ts-poet@6.5.0:
-    resolution: {integrity: sha512-44jURLT1HG6+NsDcadM826V6Ekux+wk07Go+MX5Gfx+8zcPKfUiFEtnjL9imuRVGSCRtloRLqw4bDGZVJYGZMQ==}
+  /ts-poet@6.6.0:
+    resolution: {integrity: sha512-4vEH/wkhcjRPFOdBwIh9ItO6jOoumVLRF4aABDX5JSNEubSqwOulihxQPqai+OkuygJm3WYMInxXQX4QwVNMuw==}
     dependencies:
-      dprint-node: 1.0.7
-    dev: true
+      dprint-node: 1.0.8
+    dev: false
 
-  /ts-proto-descriptors@1.14.0:
-    resolution: {integrity: sha512-xqLA6cBTfof+mZ/sIw/pZviyhnWWcWqRBjyjaMW5O4fIogpawT4aa0wI8rKh0rYIrQzoHxLugmFu4+rdiWaGEQ==}
+  /ts-proto-descriptors@1.15.0:
+    resolution: {integrity: sha512-TYyJ7+H+7Jsqawdv+mfsEpZPTIj9siDHS6EMCzG/z3b/PZiphsX+mWtqFfFVe5/N0Th6V3elK9lQqjnrgTOfrg==}
     dependencies:
       long: 5.2.3
       protobufjs: 7.2.4
-    dev: true
+    dev: false
 
-  /ts-proto@1.156.0:
-    resolution: {integrity: sha512-GnOxEAD1mRkiqV9VLv48GrNdps8gXp+vE9rWToCPyIxCIjVjkH3ls8iXxRXOS9LSwueJT8F+N9w7Xy3zftUecA==}
+  /ts-proto@1.159.1:
+    resolution: {integrity: sha512-pxzjxLXZXQtpjQvtZGqqksgjvcXc9kokO4X8nXvMenL3rqnw2V5tMExNs5xaZj1m8DkCrgHKw5TtjV1/x+GgEA==}
     hasBin: true
     dependencies:
       case-anything: 2.1.13
       protobufjs: 7.2.4
-      ts-poet: 6.5.0
-      ts-proto-descriptors: 1.14.0
-    dev: true
+      ts-poet: 6.6.0
+      ts-proto-descriptors: 1.15.0
+    dev: false
 
   /ts-prune@0.10.3:
     resolution: {integrity: sha512-iS47YTbdIcvN8Nh/1BFyziyUqmjXz7GVzWu02RaZXqb+e/3Qe1B7IQ4860krOeCGUeJmterAlaM2FRH0Ue0hjw==}
@@ -12754,15 +13643,20 @@ packages:
 
   /tslib@2.6.1:
     resolution: {integrity: sha512-t0hLfiEKfMUoqhG+U1oid7Pva4bbDPHYfJNiB7BiIjRkj1pyC++4N3huJfqY6aRH6VTB0rvtzQwjM4K6qpfOig==}
+    dev: false
 
-  /tsutils@3.21.0(typescript@5.1.6):
+  /tslib@2.6.2:
+    resolution: {integrity: sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q==}
+    dev: true
+
+  /tsutils@3.21.0(typescript@5.2.2):
     resolution: {integrity: sha512-mHKK3iUXL+3UF6xL5k0PEhKRUBKPBCv/+RkEOpjRWxxx27KKRBmmA60A9pgOUvMi8GKhRMPEmjBRPzs2W7O1OA==}
     engines: {node: '>= 6'}
     peerDependencies:
       typescript: '>=2.8.0 || >= 3.2.0-dev || >= 3.3.0-dev || >= 3.4.0-dev || >= 3.5.0-dev || >= 3.6.0-dev || >= 3.6.0-beta || >= 3.7.0-dev || >= 3.7.0-beta'
     dependencies:
       tslib: 1.14.1
-      typescript: 5.1.6
+      typescript: 5.2.2
 
   /tween-functions@1.2.0:
     resolution: {integrity: sha512-PZBtLYcCLtEcjL14Fzb1gSxPBeL7nWvGhO5ZFPGqziCcr8uvHp0NDmdjBchp6KHL+tExcg0m3NISmKxhU394dA==}
@@ -12860,8 +13754,8 @@ packages:
     resolution: {integrity: sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA==}
     dev: true
 
-  /typescript@5.1.6:
-    resolution: {integrity: sha512-zaWCozRZ6DLEWAWFrVDz1H6FVXzUSfTy5FUMWsQlU8Ym5JP9eO4xkTIROFCQvhQf61z6O/G6ugw3SgAnvvm+HA==}
+  /typescript@5.2.2:
+    resolution: {integrity: sha512-mI4WrpHsbCIcwT9cF4FZvr80QUeKvsUsUvKDoR+X/7XHQH98xYD8YHZg7ANtz2GtZt/CBq2QJ0thkGJMHfqc1w==}
     engines: {node: '>=14.17'}
     hasBin: true
 
@@ -12916,7 +13810,7 @@ packages:
   /unified@10.1.2:
     resolution: {integrity: sha512-pUSWAi/RAnVy1Pif2kAoeWNBa3JVrx0MId2LASj8G+7AiHWoKZNTomq6LG326T68U7/e263X6fTdcXIy7XnF7Q==}
     dependencies:
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
       bail: 2.0.2
       extend: 3.0.2
       is-buffer: 2.0.5
@@ -12947,36 +13841,36 @@ packages:
   /unist-util-is@5.2.1:
     resolution: {integrity: sha512-u9njyyfEh43npf1M+yGKDGVPbY/JWEemg5nH05ncKPfi+kBbKBJoTdsogMu33uhytuLlv9y0O7GH7fEdwLdLQw==}
     dependencies:
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
 
   /unist-util-position@4.0.4:
     resolution: {integrity: sha512-kUBE91efOWfIVBo8xzh/uZQ7p9ffYRtUbMRZBNFYwf0RK8koUMx6dGUfwylLOKmaT2cs4wSW96QoYUSXAyEtpg==}
     dependencies:
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
     dev: false
 
   /unist-util-stringify-position@3.0.3:
     resolution: {integrity: sha512-k5GzIBZ/QatR8N5X2y+drfpWG8IDBzdnVj6OInRNWm1oXrzydiaAT2OQiA8DPRRZyAKb9b6I2a6PxYklZD0gKg==}
     dependencies:
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
 
   /unist-util-visit-parents@3.1.1:
     resolution: {integrity: sha512-1KROIZWo6bcMrZEwiH2UrXDyalAa0uqzWCxCJj6lPOvTve2WkfgCytoDTPaMnodXh1WrXOq0haVYHj99ynJlsg==}
     dependencies:
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
       unist-util-is: 4.1.0
     dev: true
 
   /unist-util-visit-parents@5.1.3:
     resolution: {integrity: sha512-x6+y8g7wWMyQhL1iZfhIPhDAs7Xwbn9nRosDXl7qoPTSCy0yNxnKc+hWokFifWQIDGi154rdUqKvbCa4+1kLhg==}
     dependencies:
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
       unist-util-is: 5.2.1
 
   /unist-util-visit@2.0.3:
     resolution: {integrity: sha512-iJ4/RczbJMkD0712mGktuGpm/U4By4FfDonL7N/9tATGIF4imikjOuagyMY53tnZq3NP6BcmlrHhEKAfGWjh7Q==}
     dependencies:
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
       unist-util-is: 4.1.0
       unist-util-visit-parents: 3.1.1
     dev: true
@@ -12984,7 +13878,7 @@ packages:
   /unist-util-visit@4.1.2:
     resolution: {integrity: sha512-MSd8OUGISqHdVvfY9TPhyK2VdUrPgxkUtWSuMHF6XAAFuL4LokseigBnZtPnJMu+FbynTkFNnFlyjxpVKujMRg==}
     dependencies:
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
       unist-util-is: 5.2.1
       unist-util-visit-parents: 5.1.3
 
@@ -13017,13 +13911,13 @@ packages:
     engines: {node: '>=8'}
     dev: true
 
-  /update-browserslist-db@1.0.11(browserslist@4.21.9):
+  /update-browserslist-db@1.0.11(browserslist@4.21.10):
     resolution: {integrity: sha512-dCwEFf0/oT85M1fHBg4F0jtLwJrutGoHSQXCh7u4o2t1drG+c0a9Flnqww6XUKSfQMPpJBRjU8d4RXB09qtvaA==}
     hasBin: true
     peerDependencies:
       browserslist: '>= 4.21.0'
     dependencies:
-      browserslist: 4.21.9
+      browserslist: 4.21.10
       escalade: 3.1.1
       picocolors: 1.0.0
 
@@ -13051,7 +13945,7 @@ packages:
     dependencies:
       '@types/react': 18.2.6
       react: 18.2.0
-      tslib: 2.6.1
+      tslib: 2.6.2
     dev: true
 
   /use-isomorphic-layout-effect@1.1.2(@types/react@18.2.6)(react@18.2.0):
@@ -13091,7 +13985,7 @@ packages:
       '@types/react': 18.2.6
       detect-node-es: 1.1.0
       react: 18.2.0
-      tslib: 2.6.1
+      tslib: 2.6.2
     dev: true
 
   /use-sync-external-store@1.2.0(react@18.2.0):
@@ -13142,7 +14036,7 @@ packages:
     resolution: {integrity: sha512-6z3GW9x8G1gd+JIIgQQQxXuiJtCXeAjp6RaPEPLv62mH3iPHPxV6W3robxtCzNErRo6ZwTmzWhsbNvjyEBKzKA==}
     engines: {node: '>=10.12.0'}
     dependencies:
-      '@jridgewell/trace-mapping': 0.3.18
+      '@jridgewell/trace-mapping': 0.3.19
       '@types/istanbul-lib-coverage': 2.0.4
       convert-source-map: 1.9.0
     dev: true
@@ -13162,24 +14056,24 @@ packages:
   /vfile-message@3.1.4:
     resolution: {integrity: sha512-fa0Z6P8HUrQN4BZaX05SIVXic+7kE3b05PWAtPuYP9QLHsLKYR7/AlLW3NtOrpXRLeawpDLMsVkmk5DG0NXgWw==}
     dependencies:
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
       unist-util-stringify-position: 3.0.3
 
   /vfile@5.3.7:
     resolution: {integrity: sha512-r7qlzkgErKjobAmyNIkkSpizsFPYiUPuJb5pNW1RB4JcYVZhs4lIbVqk8XPk033CV/1z8ss5pkax8SuhGpcG8g==}
     dependencies:
-      '@types/unist': 2.0.7
+      '@types/unist': 2.0.8
       is-buffer: 2.0.5
       unist-util-stringify-position: 3.0.3
       vfile-message: 3.1.4
 
-  /vite-plugin-checker@0.6.0(eslint@8.46.0)(typescript@5.1.6)(vite@4.4.2):
+  /vite-plugin-checker@0.6.0(eslint@8.50.0)(typescript@5.2.2)(vite@4.4.2):
     resolution: {integrity: sha512-DWZ9Hv2TkpjviPxAelNUt4Q3IhSGrx7xrwdM64NI+Q4dt8PaMWJJh4qGNtSrfEuiuIzWWo00Ksvh5It4Y3L9xQ==}
     engines: {node: '>=14.16'}
     peerDependencies:
       eslint: '>=7'
       meow: ^9.0.0
-      optionator: ^0.9.1
+      optionator: 0.9.3
       stylelint: '>=13'
       typescript: '*'
       vite: '>=2.0.0'
@@ -13209,7 +14103,7 @@ packages:
       chalk: 4.1.2
       chokidar: 3.5.3
       commander: 8.3.0
-      eslint: 8.46.0
+      eslint: 8.50.0
       fast-glob: 3.3.1
       fs-extra: 11.1.1
       lodash.debounce: 4.0.8
@@ -13218,15 +14112,19 @@ packages:
       semver: 7.5.3
       strip-ansi: 6.0.1
       tiny-invariant: 1.3.1
-      typescript: 5.1.6
-      vite: 4.4.2(@types/node@18.17.0)
+      typescript: 5.2.2
+      vite: 4.4.2(@types/node@18.18.1)
       vscode-languageclient: 7.0.0
       vscode-languageserver: 7.0.0
       vscode-languageserver-textdocument: 1.0.8
       vscode-uri: 3.0.7
     dev: true
 
-  /vite@4.4.2(@types/node@18.17.0):
+  /vite-plugin-turbosnap@1.0.2:
+    resolution: {integrity: sha512-irjKcKXRn7v5bPAg4mAbsS6DgibpP1VUFL9tlgxU6lloK6V9yw9qCZkS+s2PtbkZpWNzr3TN3zVJAc6J7gJZmA==}
+    dev: true
+
+  /vite@4.4.2(@types/node@18.18.1):
     resolution: {integrity: sha512-zUcsJN+UvdSyHhYa277UHhiJ3iq4hUBwHavOpsNUGsTgjBeoBlK8eDt+iT09pBq0h9/knhG/SPrZiM7cGmg7NA==}
     engines: {node: ^14.18.0 || >=16.0.0}
     hasBin: true
@@ -13254,17 +14152,12 @@ packages:
       terser:
         optional: true
     dependencies:
-      '@types/node': 18.17.0
+      '@types/node': 18.18.1
       esbuild: 0.18.17
-      postcss: 8.4.27
+      postcss: 8.4.31
       rollup: 3.26.3
     optionalDependencies:
-      fsevents: 2.3.2
-
-  /void-elements@3.1.0:
-    resolution: {integrity: sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w==}
-    engines: {node: '>=0.10.0'}
-    dev: false
+      fsevents: 2.3.3
 
   /vscode-jsonrpc@6.0.0:
     resolution: {integrity: sha512-wnJA4BnEjOSyFMvjZdpiOwhSq9uDoK8e/kpRJDTaMYzwlkrhG1fwDIZI94CLsLzlCK5cIbMMtFlJlfR57Lavmg==}
@@ -13493,6 +14386,19 @@ packages:
       utf-8-validate:
         optional: true
 
+  /ws@8.14.2:
+    resolution: {integrity: sha512-wEBG1ftX4jcglPxgFCMJmZ2PLtSbJ2Peg6TmpJFTbe9GZYOQCDPdMYu/Tm0/bGZkw8paZnJY45J4K2PZrLYq8g==}
+    engines: {node: '>=10.0.0'}
+    peerDependencies:
+      bufferutil: ^4.0.1
+      utf-8-validate: '>=5.0.2'
+    peerDependenciesMeta:
+      bufferutil:
+        optional: true
+      utf-8-validate:
+        optional: true
+    dev: false
+
   /xml-name-validator@4.0.0:
     resolution: {integrity: sha512-ICP2e+jsHvAj2E2lIHxa5tjXRlKDJo4IdvPvCXbXQGdzSfmSpNVyIKMvoZHjDY9DP0zV17iI85o90vRFXNccRw==}
     engines: {node: '>=12'}
@@ -13514,32 +14420,48 @@ packages:
     resolution: {integrity: sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==}
     engines: {node: '>=0.4'}
 
-  /xterm-addon-canvas@0.4.0(xterm@5.2.1):
-    resolution: {integrity: sha512-iTC8CdjX9+hGX7jiEuiDMXzHsY/FKJdVnbjep5xjRXNu7RKOk15xuecIkJ7HZORqMVPpr4DGS3jyd9XUoBuxqw==}
+  /xterm-addon-canvas@0.5.0(xterm@5.2.0):
+    resolution: {integrity: sha512-QOo/eZCMrCleAgMimfdbaZCgmQRWOml63Ued6RwQ+UTPvQj3Av9QKx3xksmyYrDGRO/AVRXa9oNuzlYvLdmoLQ==}
+    peerDependencies:
+      xterm: ^5.0.0
+    dependencies:
+      xterm: 5.2.0
+    dev: false
+
+  /xterm-addon-fit@0.8.0(xterm@5.2.0):
+    resolution: {integrity: sha512-yj3Np7XlvxxhYF/EJ7p3KHaMt6OdwQ+HDu573Vx1lRXsVxOcnVJs51RgjZOouIZOczTsskaS+CpXspK81/DLqw==}
+    peerDependencies:
+      xterm: ^5.0.0
+    dependencies:
+      xterm: 5.2.0
+    dev: false
+
+  /xterm-addon-unicode11@0.6.0(xterm@5.2.0):
+    resolution: {integrity: sha512-5pkb8YoS/deRtNqQRw8t640mu+Ga8B2MG3RXGQu0bwgcfr8XiXIRI880TWM49ICAHhTmnOLPzIIBIjEnCq7k2A==}
     peerDependencies:
       xterm: ^5.0.0
     dependencies:
-      xterm: 5.2.1
+      xterm: 5.2.0
     dev: false
 
-  /xterm-addon-fit@0.7.0(xterm@5.2.1):
-    resolution: {integrity: sha512-tQgHGoHqRTgeROPnvmtEJywLKoC/V9eNs4bLLz7iyJr1aW/QFzRwfd3MGiJ6odJd9xEfxcW36/xRU47JkD5NKQ==}
+  /xterm-addon-web-links@0.9.0(xterm@5.2.0):
+    resolution: {integrity: sha512-LIzi4jBbPlrKMZF3ihoyqayWyTXAwGfu4yprz1aK2p71e9UKXN6RRzVONR0L+Zd+Ik5tPVI9bwp9e8fDTQh49Q==}
     peerDependencies:
       xterm: ^5.0.0
     dependencies:
-      xterm: 5.2.1
+      xterm: 5.2.0
     dev: false
 
-  /xterm-addon-web-links@0.8.0(xterm@5.2.1):
-    resolution: {integrity: sha512-J4tKngmIu20ytX9SEJjAP3UGksah7iALqBtfTwT9ZnmFHVplCumYQsUJfKuS+JwMhjsjH61YXfndenLNvjRrEw==}
+  /xterm-addon-webgl@0.16.0(xterm@5.2.0):
+    resolution: {integrity: sha512-E8cq1AiqNOv0M/FghPT+zPAEnvIQRDbAbkb04rRYSxUym69elPWVJ4sv22FCLBqM/3LcrmBLl/pELnBebVFKgA==}
     peerDependencies:
       xterm: ^5.0.0
     dependencies:
-      xterm: 5.2.1
+      xterm: 5.2.0
     dev: false
 
-  /xterm@5.2.1:
-    resolution: {integrity: sha512-cs5Y1fFevgcdoh2hJROMVIWwoBHD80P1fIP79gopLHJIE4kTzzblanoivxTiQ4+92YM9IxS36H1q0MxIJXQBcA==}
+  /xterm@5.2.0:
+    resolution: {integrity: sha512-C1NXTZYfXPTXzF7uw7Ao6/IFGrtAkHv4e/PCQRpgYHyMobvaRs3nJNGK32hX/skdMUQJ6yhSnyzfmWCQwG9qvg==}
     dev: false
 
   /y18n@5.0.8:
@@ -13606,8 +14528,8 @@ packages:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
 
-  /yup@1.2.0:
-    resolution: {integrity: sha512-PPqYKSAXjpRCgLgLKVGPA33v5c/WgEx3wi6NFjIiegz90zSwyMpvTFp/uGcVnnbx6to28pgnzp/q8ih3QRjLMQ==}
+  /yup@1.3.2:
+    resolution: {integrity: sha512-6KCM971iQtJ+/KUaHdrhVr2LDkfhBtFPRnsG1P8F4q3uUVQ2RfEM9xekpha9aA4GXWJevjM10eDcPQ1FfWlmaQ==}
     dependencies:
       property-expr: 2.0.5
       tiny-case: 1.0.3
diff --git a/site/site.go b/site/site.go
index 6b63bd963c4d1..7e39dbeab1746 100644
--- a/site/site.go
+++ b/site/site.go
@@ -34,13 +34,13 @@ import (
 	"golang.org/x/sync/singleflight"
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/buildinfo"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/coderd/database/dbauthz"
-	"github.com/coder/coder/coderd/httpapi"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
+	"github.com/coder/coder/v2/buildinfo"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
 )
 
 // We always embed the error page HTML because it it doesn't need to be built,
@@ -232,6 +232,9 @@ type htmlState struct {
 	CSRF csrfState
 
 	// Below are HTML escaped JSON strings of the respective structs.
+	ApplicationName string
+	LogoURL         string
+
 	BuildInfo    string
 	User         string
 	Entitlements string
@@ -279,10 +282,15 @@ func (h *Handler) serveHTML(resp http.ResponseWriter, request *http.Request, req
 	return false
 }
 
+func execTmpl(tmpl *template.Template, state htmlState) ([]byte, error) {
+	var buf bytes.Buffer
+	err := tmpl.Execute(&buf, state)
+	return buf.Bytes(), err
+}
+
 // renderWithState will render the file using the given nonce if the file exists
 // as a template. If it does not, it will return an error.
 func (h *Handler) renderHTMLWithState(r *http.Request, filePath string, state htmlState) ([]byte, error) {
-	var buf bytes.Buffer
 	if filePath == "" {
 		filePath = "index.html"
 	}
@@ -307,96 +315,104 @@ func (h *Handler) renderHTMLWithState(r *http.Request, filePath string, state ht
 		RedirectToLogin:             false,
 		SessionTokenFunc:            nil,
 	})
-	if ok && apiKey != nil && actor != nil {
-		ctx := dbauthz.As(r.Context(), actor.Actor)
+	if !ok || apiKey == nil || actor == nil {
+		var cfg codersdk.AppearanceConfig
+		if h.AppearanceFetcher != nil {
+			// nolint:gocritic // User is not expected to be signed in.
+			ctx := dbauthz.AsSystemRestricted(r.Context())
+			cfg, _ = h.AppearanceFetcher(ctx)
+		}
+		state.ApplicationName = applicationNameOrDefault(cfg)
+		state.LogoURL = cfg.LogoURL
+		return execTmpl(tmpl, state)
+	}
 
-		var eg errgroup.Group
-		var user database.User
-		orgIDs := []uuid.UUID{}
-		eg.Go(func() error {
-			var err error
-			user, err = h.opts.Database.GetUserByID(ctx, apiKey.UserID)
-			return err
-		})
-		eg.Go(func() error {
-			memberIDs, err := h.opts.Database.GetOrganizationIDsByMemberIDs(ctx, []uuid.UUID{apiKey.UserID})
-			if errors.Is(err, sql.ErrNoRows) || len(memberIDs) == 0 {
-				return nil
-			}
-			if err != nil {
-				return nil
+	ctx := dbauthz.As(r.Context(), actor.Actor)
+
+	var eg errgroup.Group
+	var user database.User
+	orgIDs := []uuid.UUID{}
+	eg.Go(func() error {
+		var err error
+		user, err = h.opts.Database.GetUserByID(ctx, apiKey.UserID)
+		return err
+	})
+	eg.Go(func() error {
+		memberIDs, err := h.opts.Database.GetOrganizationIDsByMemberIDs(ctx, []uuid.UUID{apiKey.UserID})
+		if errors.Is(err, sql.ErrNoRows) || len(memberIDs) == 0 {
+			return nil
+		}
+		if err != nil {
+			return nil
+		}
+		orgIDs = memberIDs[0].OrganizationIDs
+		return err
+	})
+	err := eg.Wait()
+	if err == nil {
+		var wg sync.WaitGroup
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			user, err := json.Marshal(db2sdk.User(user, orgIDs))
+			if err == nil {
+				state.User = html.EscapeString(string(user))
 			}
-			orgIDs = memberIDs[0].OrganizationIDs
-			return err
-		})
-		err := eg.Wait()
-		if err == nil {
-			var wg sync.WaitGroup
+		}()
+		entitlements := h.Entitlements.Load()
+		if entitlements != nil {
 			wg.Add(1)
 			go func() {
 				defer wg.Done()
-				user, err := json.Marshal(db2sdk.User(user, orgIDs))
+				entitlements, err := json.Marshal(entitlements)
 				if err == nil {
-					state.User = html.EscapeString(string(user))
+					state.Entitlements = html.EscapeString(string(entitlements))
 				}
 			}()
-			entitlements := h.Entitlements.Load()
-			if entitlements != nil {
-				wg.Add(1)
-				go func() {
-					defer wg.Done()
-					entitlements, err := json.Marshal(entitlements)
-					if err == nil {
-						state.Entitlements = html.EscapeString(string(entitlements))
-					}
-				}()
-			}
-			if h.AppearanceFetcher != nil {
-				wg.Add(1)
-				go func() {
-					defer wg.Done()
-					cfg, err := h.AppearanceFetcher(ctx)
-					if err == nil {
-						appearance, err := json.Marshal(cfg)
-						if err == nil {
-							state.Appearance = html.EscapeString(string(appearance))
-						}
-					}
-				}()
-			}
-			if h.RegionsFetcher != nil {
-				wg.Add(1)
-				go func() {
-					defer wg.Done()
-					regions, err := h.RegionsFetcher(ctx)
+		}
+		if h.AppearanceFetcher != nil {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				cfg, err := h.AppearanceFetcher(ctx)
+				if err == nil {
+					appearance, err := json.Marshal(cfg)
 					if err == nil {
-						regions, err := json.Marshal(regions)
-						if err == nil {
-							state.Regions = html.EscapeString(string(regions))
-						}
+						state.Appearance = html.EscapeString(string(appearance))
+						state.ApplicationName = applicationNameOrDefault(cfg)
+						state.LogoURL = cfg.LogoURL
 					}
-				}()
-			}
-			experiments := h.Experiments.Load()
-			if experiments != nil {
-				wg.Add(1)
-				go func() {
-					defer wg.Done()
-					experiments, err := json.Marshal(experiments)
+				}
+			}()
+		}
+		if h.RegionsFetcher != nil {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				regions, err := h.RegionsFetcher(ctx)
+				if err == nil {
+					regions, err := json.Marshal(regions)
 					if err == nil {
-						state.Experiments = html.EscapeString(string(experiments))
+						state.Regions = html.EscapeString(string(regions))
 					}
-				}()
-			}
-			wg.Wait()
+				}
+			}()
+		}
+		experiments := h.Experiments.Load()
+		if experiments != nil {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				experiments, err := json.Marshal(experiments)
+				if err == nil {
+					state.Experiments = html.EscapeString(string(experiments))
+				}
+			}()
 		}
+		wg.Wait()
 	}
 
-	err := tmpl.Execute(&buf, state)
-	if err != nil {
-		return nil, err
-	}
-	return buf.Bytes(), nil
+	return execTmpl(tmpl, state)
 }
 
 // noopResponseWriter is a response writer that does nothing.
@@ -751,6 +767,7 @@ type ErrorPageData struct {
 	Description  string
 	RetryEnabled bool
 	DashboardURL string
+	Warnings     []string
 }
 
 // RenderStaticErrorPage renders the static error page. This is used by app
@@ -837,3 +854,10 @@ func (b *binHashCache) getHash(name string) (string, error) {
 	//nolint:forcetypeassert
 	return strings.ToLower(v.(string)), nil
 }
+
+func applicationNameOrDefault(cfg codersdk.AppearanceConfig) string {
+	if cfg.ApplicationName != "" {
+		return cfg.ApplicationName
+	}
+	return "Coder"
+}
diff --git a/site/site_test.go b/site/site_test.go
index de4e150618b8b..b240a065fea1b 100644
--- a/site/site_test.go
+++ b/site/site_test.go
@@ -22,14 +22,15 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/coderd/database/db2sdk"
-	"github.com/coder/coder/coderd/database/dbfake"
-	"github.com/coder/coder/coderd/database/dbgen"
-	"github.com/coder/coder/coderd/httpmw"
-	"github.com/coder/coder/codersdk"
-	"github.com/coder/coder/site"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/db2sdk"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbmem"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/site"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestInjection(t *testing.T) {
@@ -41,7 +42,7 @@ func TestInjection(t *testing.T) {
 		},
 	}
 	binFs := http.FS(fstest.MapFS{})
-	db := dbfake.New()
+	db := dbmem.New()
 	handler := site.New(&site.Options{
 		BinFS:    binFs,
 		Database: db,
@@ -73,7 +74,7 @@ func TestInjection(t *testing.T) {
 func TestInjectionFailureProducesCleanHTML(t *testing.T) {
 	t.Parallel()
 
-	db := dbfake.New()
+	db := dbmem.New()
 
 	// Create an expired user with a refresh token, but provide no OAuth2
 	// configuration so that refresh is impossible, this should result in
@@ -81,15 +82,15 @@ func TestInjectionFailureProducesCleanHTML(t *testing.T) {
 	user := dbgen.User(t, db, database.User{})
 	_, token := dbgen.APIKey(t, db, database.APIKey{
 		UserID:    user.ID,
-		LastUsed:  database.Now().Add(-time.Hour),
-		ExpiresAt: database.Now().Add(-time.Second),
+		LastUsed:  dbtime.Now().Add(-time.Hour),
+		ExpiresAt: dbtime.Now().Add(-time.Second),
 		LoginType: database.LoginTypeGithub,
 	})
 	_ = dbgen.UserLink(t, db, database.UserLink{
 		UserID:            user.ID,
 		LoginType:         database.LoginTypeGithub,
 		OAuthRefreshToken: "hello",
-		OAuthExpiry:       database.Now().Add(-time.Second),
+		OAuthExpiry:       dbtime.Now().Add(-time.Second),
 	})
 
 	binFs := http.FS(fstest.MapFS{})
diff --git a/site/src/@types/emoji-mart.d.ts b/site/src/@types/emoji-mart.d.ts
index b1f3fab41bd09..18c1d81eabb0e 100644
--- a/site/src/@types/emoji-mart.d.ts
+++ b/site/src/@types/emoji-mart.d.ts
@@ -1,9 +1,42 @@
 declare module "@emoji-mart/react" {
-  const Picker: React.FC<{
-    theme: "dark" | "light"
-    data: Record<string, unknown>
-    onEmojiSelect: (emojiData: { unified: string }) => void
-  }>
+  interface CustomCategory {
+    id: string;
+    name: string;
+    emojis: CustomEmoji[];
+  }
 
-  export default Picker
+  interface CustomEmoji {
+    id: string;
+    name: string;
+    keywords: string[];
+    skins: CustomEmojiSkin[];
+  }
+
+  interface CustomEmojiSkin {
+    src: string;
+  }
+
+  type EmojiData = EmojiResource & {
+    id: string;
+    keywords: string[];
+    name: string;
+    native?: string;
+    shortcodes: string;
+  };
+
+  type EmojiResource =
+    | { unified: undefined; src: string }
+    | { unified: string; src: undefined };
+
+  const EmojiPicker: React.FC<{
+    set: "native" | "apple" | "facebook" | "google" | "twitter";
+    theme: "dark" | "light";
+    data: unknown;
+    custom: CustomCategory[];
+    emojiButtonSize?: number;
+    emojiSize?: number;
+    onEmojiSelect: (emoji: EmojiData) => void;
+  }>;
+
+  export default EmojiPicker;
 }
diff --git a/site/src/@types/emotion.d.ts b/site/src/@types/emotion.d.ts
new file mode 100644
index 0000000000000..41f9e922d5091
--- /dev/null
+++ b/site/src/@types/emotion.d.ts
@@ -0,0 +1,5 @@
+import type { DefaultTheme as MuiTheme } from "@mui/system";
+
+declare module "@emotion/react" {
+  interface Theme extends MuiTheme {}
+}
diff --git a/site/src/@types/eventsourcemock.d.ts b/site/src/@types/eventsourcemock.d.ts
index 12f9cc003ebf0..296c4f19c33ce 100644
--- a/site/src/@types/eventsourcemock.d.ts
+++ b/site/src/@types/eventsourcemock.d.ts
@@ -1 +1 @@
-declare module "eventsourcemock"
+declare module "eventsourcemock";
diff --git a/site/src/@types/i18n.d.ts b/site/src/@types/i18n.d.ts
deleted file mode 100644
index bee7fa78b1c06..0000000000000
--- a/site/src/@types/i18n.d.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-import "i18next"
-
-// https://github.com/i18next/react-i18next/issues/1543#issuecomment-1528679591
-declare module "i18next" {
-  interface TypeOptions {
-    returnNull: false
-    allowObjectInHTMLChildren: false
-  }
-  export function t<T>(s: string): T
-}
diff --git a/site/src/@types/mui.d.ts b/site/src/@types/mui.d.ts
index c8a44d589102d..3783826c0138c 100644
--- a/site/src/@types/mui.d.ts
+++ b/site/src/@types/mui.d.ts
@@ -1,4 +1,4 @@
-import { PaletteColor, PaletteColorOptions, Theme } from "@mui/material/styles"
+import { PaletteColor, PaletteColorOptions, Theme } from "@mui/material/styles";
 
 declare module "@mui/styles/defaultTheme" {
   interface DefaultTheme extends Theme {}
@@ -6,20 +6,20 @@ declare module "@mui/styles/defaultTheme" {
 
 declare module "@mui/material/styles" {
   interface TypeBackground {
-    paperLight: string
+    paperLight: string;
   }
 
   interface Palette {
-    neutral: PaletteColor
+    neutral: PaletteColor;
   }
 
   interface PaletteOptions {
-    neutral?: PaletteColorOptions
+    neutral?: PaletteColorOptions;
   }
 }
 
 declare module "@mui/material/Button" {
   interface ButtonPropsColorOverrides {
-    neutral: true
+    neutral: true;
   }
 }
diff --git a/site/src/App.tsx b/site/src/App.tsx
new file mode 100644
index 0000000000000..6e083bfb7792b
--- /dev/null
+++ b/site/src/App.tsx
@@ -0,0 +1,70 @@
+import CssBaseline from "@mui/material/CssBaseline";
+import { QueryClient, QueryClientProvider } from "react-query";
+import { AuthProvider } from "components/AuthProvider/AuthProvider";
+import { FC, PropsWithChildren, ReactNode } from "react";
+import { HelmetProvider } from "react-helmet-async";
+import { AppRouter } from "./AppRouter";
+import { ErrorBoundary } from "./components/ErrorBoundary/ErrorBoundary";
+import { GlobalSnackbar } from "./components/GlobalSnackbar/GlobalSnackbar";
+import { dark } from "./theme";
+import "./theme/globalFonts";
+import {
+  StyledEngineProvider,
+  ThemeProvider as MuiThemeProvider,
+} from "@mui/material/styles";
+import { ThemeProvider as EmotionThemeProvider } from "@emotion/react";
+
+const defaultQueryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      retry: false,
+      cacheTime: 0,
+      refetchOnWindowFocus: false,
+      networkMode: "offlineFirst",
+    },
+  },
+});
+
+export const ThemeProviders: FC<PropsWithChildren> = ({ children }) => {
+  return (
+    <StyledEngineProvider injectFirst>
+      <MuiThemeProvider theme={dark}>
+        <EmotionThemeProvider theme={dark}>
+          <CssBaseline enableColorScheme />
+          {children}
+        </EmotionThemeProvider>
+      </MuiThemeProvider>
+    </StyledEngineProvider>
+  );
+};
+
+export const AppProviders = ({
+  children,
+  queryClient = defaultQueryClient,
+}: {
+  children: ReactNode;
+  queryClient?: QueryClient;
+}) => {
+  return (
+    <HelmetProvider>
+      <ThemeProviders>
+        <ErrorBoundary>
+          <QueryClientProvider client={queryClient}>
+            <AuthProvider>
+              {children}
+              <GlobalSnackbar />
+            </AuthProvider>
+          </QueryClientProvider>
+        </ErrorBoundary>
+      </ThemeProviders>
+    </HelmetProvider>
+  );
+};
+
+export const App: FC = () => {
+  return (
+    <AppProviders>
+      <AppRouter />
+    </AppProviders>
+  );
+};
diff --git a/site/src/AppRouter.tsx b/site/src/AppRouter.tsx
index 449d4925febb3..3568b3230ab0a 100644
--- a/site/src/AppRouter.tsx
+++ b/site/src/AppRouter.tsx
@@ -1,189 +1,199 @@
-import { FullScreenLoader } from "components/Loader/FullScreenLoader"
-import { TemplateLayout } from "components/TemplateLayout/TemplateLayout"
-import { UsersLayout } from "components/UsersLayout/UsersLayout"
-import IndexPage from "pages"
-import AuditPage from "pages/AuditPage/AuditPage"
-import GroupsPage from "pages/GroupsPage/GroupsPage"
-import LoginPage from "pages/LoginPage/LoginPage"
-import { SetupPage } from "pages/SetupPage/SetupPage"
-import { TemplateSettingsPage } from "pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPage"
-import TemplatesPage from "pages/TemplatesPage/TemplatesPage"
-import UsersPage from "pages/UsersPage/UsersPage"
-import WorkspacesPage from "pages/WorkspacesPage/WorkspacesPage"
-import { FC, lazy, Suspense } from "react"
-import { Route, Routes, BrowserRouter as Router } from "react-router-dom"
-import { DashboardLayout } from "./components/Dashboard/DashboardLayout"
-import { RequireAuth } from "./components/RequireAuth/RequireAuth"
-import { SettingsLayout } from "./components/SettingsLayout/SettingsLayout"
-import { DeploySettingsLayout } from "components/DeploySettingsLayout/DeploySettingsLayout"
-import { TemplateSettingsLayout } from "pages/TemplateSettingsPage/TemplateSettingsLayout"
-import { WorkspaceSettingsLayout } from "pages/WorkspaceSettingsPage/WorkspaceSettingsLayout"
+import { FullScreenLoader } from "components/Loader/FullScreenLoader";
+import { UsersLayout } from "components/UsersLayout/UsersLayout";
+import AuditPage from "pages/AuditPage/AuditPage";
+import LoginPage from "pages/LoginPage/LoginPage";
+import { SetupPage } from "pages/SetupPage/SetupPage";
+import { TemplateLayout } from "pages/TemplatePage/TemplateLayout";
+import TemplatesPage from "pages/TemplatesPage/TemplatesPage";
+import UsersPage from "pages/UsersPage/UsersPage";
+import WorkspacesPage from "pages/WorkspacesPage/WorkspacesPage";
+import { FC, lazy, Suspense } from "react";
+import {
+  Route,
+  Routes,
+  BrowserRouter as Router,
+  Navigate,
+} from "react-router-dom";
+import { DashboardLayout } from "./components/Dashboard/DashboardLayout";
+import { RequireAuth } from "./components/RequireAuth/RequireAuth";
+import { SettingsLayout } from "./components/SettingsLayout/SettingsLayout";
+import { DeploySettingsLayout } from "components/DeploySettingsLayout/DeploySettingsLayout";
+import { TemplateSettingsLayout } from "pages/TemplateSettingsPage/TemplateSettingsLayout";
+import { WorkspaceSettingsLayout } from "pages/WorkspaceSettingsPage/WorkspaceSettingsLayout";
 
 // Lazy load pages
 // - Pages that are secondary, not in the main navigation or not usually accessed
 // - Pages that use heavy dependencies like charts or time libraries
-const NotFoundPage = lazy(() => import("./pages/404Page/404Page"))
+const NotFoundPage = lazy(() => import("./pages/404Page/404Page"));
 const CliAuthenticationPage = lazy(
   () => import("./pages/CliAuthPage/CliAuthPage"),
-)
+);
 const AccountPage = lazy(
   () => import("./pages/UserSettingsPage/AccountPage/AccountPage"),
-)
+);
+const SchedulePage = lazy(
+  () => import("./pages/UserSettingsPage/SchedulePage/SchedulePage"),
+);
 const SecurityPage = lazy(
   () => import("./pages/UserSettingsPage/SecurityPage/SecurityPage"),
-)
+);
 const SSHKeysPage = lazy(
   () => import("./pages/UserSettingsPage/SSHKeysPage/SSHKeysPage"),
-)
+);
 const TokensPage = lazy(
   () => import("./pages/UserSettingsPage/TokensPage/TokensPage"),
-)
+);
 const WorkspaceProxyPage = lazy(
   () =>
     import("./pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyPage"),
-)
+);
 const CreateUserPage = lazy(
-  () => import("./pages/UsersPage/CreateUserPage/CreateUserPage"),
-)
+  () => import("./pages/CreateUserPage/CreateUserPage"),
+);
 const WorkspaceBuildPage = lazy(
   () => import("./pages/WorkspaceBuildPage/WorkspaceBuildPage"),
-)
-const WorkspacePage = lazy(() => import("./pages/WorkspacePage/WorkspacePage"))
+);
+const WorkspacePage = lazy(() => import("./pages/WorkspacePage/WorkspacePage"));
 const WorkspaceSchedulePage = lazy(
   () =>
     import(
       "./pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceSchedulePage"
     ),
-)
+);
 const WorkspaceParametersPage = lazy(
   () =>
     import(
       "./pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage"
     ),
-)
-const TerminalPage = lazy(() => import("./pages/TerminalPage/TerminalPage"))
+);
+const TerminalPage = lazy(() => import("./pages/TerminalPage/TerminalPage"));
 const TemplatePermissionsPage = lazy(
   () =>
     import(
       "./pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPage"
     ),
-)
+);
 const TemplateSummaryPage = lazy(
   () => import("./pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPage"),
-)
+);
 const CreateWorkspacePage = lazy(
   () => import("./pages/CreateWorkspacePage/CreateWorkspacePage"),
-)
-const CreateGroupPage = lazy(() => import("./pages/GroupsPage/CreateGroupPage"))
-const GroupPage = lazy(() => import("./pages/GroupsPage/GroupPage"))
+);
+const CreateGroupPage = lazy(
+  () => import("./pages/GroupsPage/CreateGroupPage"),
+);
+const GroupPage = lazy(() => import("./pages/GroupsPage/GroupPage"));
 const SettingsGroupPage = lazy(
   () => import("./pages/GroupsPage/SettingsGroupPage"),
-)
+);
 const GeneralSettingsPage = lazy(
   () =>
     import(
       "./pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPage"
     ),
-)
+);
 const SecuritySettingsPage = lazy(
   () =>
     import(
       "./pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPage"
     ),
-)
+);
 const AppearanceSettingsPage = lazy(
   () =>
     import(
       "./pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPage"
     ),
-)
+);
 const UserAuthSettingsPage = lazy(
   () =>
     import(
       "./pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPage"
     ),
-)
-const GitAuthSettingsPage = lazy(
+);
+const ExternalAuthSettingsPage = lazy(
   () =>
     import(
-      "./pages/DeploySettingsPage/GitAuthSettingsPage/GitAuthSettingsPage"
+      "./pages/DeploySettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPage"
     ),
-)
+);
 const NetworkSettingsPage = lazy(
   () =>
     import(
       "./pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPage"
     ),
-)
-const GitAuthPage = lazy(() => import("./pages/GitAuthPage/GitAuthPage"))
+);
+const ExternalAuthPage = lazy(
+  () => import("./pages/ExternalAuthPage/ExternalAuthPage"),
+);
 const TemplateVersionPage = lazy(
   () => import("./pages/TemplateVersionPage/TemplateVersionPage"),
-)
+);
 const TemplateVersionEditorPage = lazy(
-  () =>
-    import(
-      "./pages/TemplateVersionPage/TemplateVersionEditorPage/TemplateVersionEditorPage"
-    ),
-)
+  () => import("./pages/TemplateVersionEditorPage/TemplateVersionEditorPage"),
+);
 const StarterTemplatesPage = lazy(
   () => import("./pages/StarterTemplatesPage/StarterTemplatesPage"),
-)
+);
 const StarterTemplatePage = lazy(
   () => import("pages/StarterTemplatePage/StarterTemplatePage"),
-)
+);
 const CreateTemplatePage = lazy(
   () => import("./pages/CreateTemplatePage/CreateTemplatePage"),
-)
+);
 const TemplateVariablesPage = lazy(
   () =>
     import(
       "./pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPage"
     ),
-)
+);
 const WorkspaceSettingsPage = lazy(
   () => import("./pages/WorkspaceSettingsPage/WorkspaceSettingsPage"),
-)
+);
 const CreateTokenPage = lazy(
   () => import("./pages/CreateTokenPage/CreateTokenPage"),
-)
-
+);
 const TemplateDocsPage = lazy(
   () => import("./pages/TemplatePage/TemplateDocsPage/TemplateDocsPage"),
-)
-
+);
 const TemplateFilesPage = lazy(
   () => import("./pages/TemplatePage/TemplateFilesPage/TemplateFilesPage"),
-)
-
+);
 const TemplateVersionsPage = lazy(
   () =>
     import("./pages/TemplatePage/TemplateVersionsPage/TemplateVersionsPage"),
-)
+);
 const TemplateSchedulePage = lazy(
   () =>
     import(
       "./pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePage"
     ),
-)
-
+);
+const TemplateSettingsPage = lazy(
+  () =>
+    import(
+      "./pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPage"
+    ),
+);
 const LicensesSettingsPage = lazy(
   () =>
     import(
       "./pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPage"
     ),
-)
+);
 const AddNewLicensePage = lazy(
   () =>
     import("./pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePage"),
-)
+);
 const TemplateEmbedPage = lazy(
   () => import("./pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage"),
-)
+);
 const TemplateInsightsPage = lazy(
   () =>
     import("./pages/TemplatePage/TemplateInsightsPage/TemplateInsightsPage"),
-)
-const HealthPage = lazy(() => import("./pages/HealthPage/HealthPage"))
+);
+const HealthPage = lazy(() => import("./pages/HealthPage/HealthPage"));
+const GroupsPage = lazy(() => import("./pages/GroupsPage/GroupsPage"));
+const IconsPage = lazy(() => import("./pages/IconsPage/IconsPage"));
 
 export const AppRouter: FC = () => {
   return (
@@ -196,20 +206,23 @@ export const AppRouter: FC = () => {
           {/* Dashboard routes */}
           <Route element={<RequireAuth />}>
             <Route element={<DashboardLayout />}>
-              <Route index element={<IndexPage />} />
+              <Route index element={<Navigate to="/workspaces" replace />} />
 
-              <Route path="health" element={<HealthPage />} />
+              <Route path="/health" element={<HealthPage />} />
 
-              <Route path="gitauth/:provider" element={<GitAuthPage />} />
+              <Route
+                path="/external-auth/:provider"
+                element={<ExternalAuthPage />}
+              />
 
-              <Route path="workspaces" element={<WorkspacesPage />} />
+              <Route path="/workspaces" element={<WorkspacesPage />} />
 
-              <Route path="starter-templates">
+              <Route path="/starter-templates">
                 <Route index element={<StarterTemplatesPage />} />
                 <Route path=":exampleId" element={<StarterTemplatePage />} />
               </Route>
 
-              <Route path="templates">
+              <Route path="/templates">
                 <Route index element={<TemplatesPage />} />
                 <Route path="new" element={<CreateTemplatePage />} />
                 <Route path=":template">
@@ -249,7 +262,7 @@ export const AppRouter: FC = () => {
                 </Route>
               </Route>
 
-              <Route path="users">
+              <Route path="/users">
                 <Route element={<UsersLayout />}>
                   <Route index element={<UsersPage />} />
                 </Route>
@@ -272,10 +285,7 @@ export const AppRouter: FC = () => {
 
               <Route path="/audit" element={<AuditPage />} />
 
-              <Route
-                path="/settings/deployment"
-                element={<DeploySettingsLayout />}
-              >
+              <Route path="/deployment" element={<DeploySettingsLayout />}>
                 <Route path="general" element={<GeneralSettingsPage />} />
                 <Route path="licenses" element={<LicensesSettingsPage />} />
                 <Route path="licenses/add" element={<AddNewLicensePage />} />
@@ -283,15 +293,19 @@ export const AppRouter: FC = () => {
                 <Route path="appearance" element={<AppearanceSettingsPage />} />
                 <Route path="network" element={<NetworkSettingsPage />} />
                 <Route path="userauth" element={<UserAuthSettingsPage />} />
-                <Route path="gitauth" element={<GitAuthSettingsPage />} />
+                <Route
+                  path="external-auth"
+                  element={<ExternalAuthSettingsPage />}
+                />
                 <Route
                   path="workspace-proxies"
                   element={<WorkspaceProxyPage />}
                 />
               </Route>
 
-              <Route path="settings" element={<SettingsLayout />}>
+              <Route path="/settings" element={<SettingsLayout />}>
                 <Route path="account" element={<AccountPage />} />
+                <Route path="schedule" element={<SchedulePage />} />
                 <Route path="security" element={<SecurityPage />} />
                 <Route path="ssh-keys" element={<SSHKeysPage />} />
                 <Route path="tokens">
@@ -325,9 +339,10 @@ export const AppRouter: FC = () => {
             {/* Terminal and CLI auth pages don't have the dashboard layout */}
             <Route
               path="/:username/:workspace/terminal"
-              element={<TerminalPage renderer="canvas" />}
+              element={<TerminalPage />}
             />
-            <Route path="cli-auth" element={<CliAuthenticationPage />} />
+            <Route path="/cli-auth" element={<CliAuthenticationPage />} />
+            <Route path="/icons" element={<IconsPage />} />
           </Route>
 
           {/* Using path="*"" means "match anything", so this route
@@ -337,5 +352,5 @@ export const AppRouter: FC = () => {
         </Routes>
       </Router>
     </Suspense>
-  )
-}
+  );
+};
diff --git a/site/src/Main.tsx b/site/src/Main.tsx
deleted file mode 100644
index 8d7068cacaa34..0000000000000
--- a/site/src/Main.tsx
+++ /dev/null
@@ -1,40 +0,0 @@
-import { inspect } from "@xstate/inspect"
-import { createRoot } from "react-dom/client"
-import { Interpreter } from "xstate"
-import { App } from "./app"
-import "./i18n"
-
-// if this is a development build and the developer wants to inspect
-// helpful to see realtime changes on the services
-if (
-  process.env.NODE_ENV === "development" &&
-  process.env.INSPECT_XSTATE === "true"
-) {
-  // configure the XState inspector to open in a new tab
-  inspect({
-    url: "https://stately.ai/viz?inspect",
-    iframe: false,
-  })
-  // configure all XServices to use the inspector
-  Interpreter.defaultOptions.devTools = true
-}
-
-// This is the entry point for the app - where everything start.
-// In the future, we'll likely bring in more bootstrapping logic -
-// like: https://github.com/coder/m/blob/50898bd4803df7639bd181e484c74ac5d84da474/product/coder/site/pages/_app.tsx#L32
-const main = () => {
-  console.info(`    ▄█▀    ▀█▄
-     ▄▄ ▀▀▀  █▌   ██▀▀█▄          ▐█
- ▄▄██▀▀█▄▄▄  ██  ██      █▀▀█ ▐█▀▀██ ▄█▀▀█ █▀▀
-█▌   ▄▌   ▐█ █▌  ▀█▄▄▄█▌ █  █ ▐█  ██ ██▀▀  █
-     ██████▀▄█    ▀▀▀▀   ▀▀▀▀  ▀▀▀▀▀  ▀▀▀▀ ▀
-`)
-  const element = document.getElementById("root")
-  if (element === null) {
-    throw new Error("root element is null")
-  }
-  const root = createRoot(element)
-  root.render(<App />)
-}
-
-main()
diff --git a/site/src/__mocks__/js-untar.ts b/site/src/__mocks__/js-untar.ts
index bbabe6d0d1fe5..0bb2acf50886d 100644
--- a/site/src/__mocks__/js-untar.ts
+++ b/site/src/__mocks__/js-untar.ts
@@ -1 +1 @@
-export default jest.fn()
+export default jest.fn();
diff --git a/site/src/__mocks__/monaco-editor.ts b/site/src/__mocks__/monaco-editor.ts
index 7a5bc456b46a8..bc96406f8b6cf 100644
--- a/site/src/__mocks__/monaco-editor.ts
+++ b/site/src/__mocks__/monaco-editor.ts
@@ -7,14 +7,14 @@ const editor = {
       dispose: () => {
         //
       },
-    }
+    };
   },
-}
+};
 
 const monaco = {
   editor,
-}
+};
 
-module.exports = monaco
+module.exports = monaco;
 
-export {}
+export {};
diff --git a/site/src/__mocks__/react-markdown.tsx b/site/src/__mocks__/react-markdown.tsx
index 1c91a935a5e06..f94c0fbe80286 100644
--- a/site/src/__mocks__/react-markdown.tsx
+++ b/site/src/__mocks__/react-markdown.tsx
@@ -1,7 +1,7 @@
-import { FC, PropsWithChildren } from "react"
+import { FC, PropsWithChildren } from "react";
 
 const ReactMarkdown: FC<PropsWithChildren<unknown>> = ({ children }) => {
-  return <div data-testid="markdown">{children}</div>
-}
+  return <div data-testid="markdown">{children}</div>;
+};
 
-export default ReactMarkdown
+export default ReactMarkdown;
diff --git a/site/src/api/api.test.ts b/site/src/api/api.test.ts
index 70ae81b1297a7..11d00d216feb4 100644
--- a/site/src/api/api.test.ts
+++ b/site/src/api/api.test.ts
@@ -1,4 +1,4 @@
-import axios from "axios"
+import axios from "axios";
 import {
   MockTemplate,
   MockTemplateVersionParameter1,
@@ -6,9 +6,9 @@ import {
   MockWorkspace,
   MockWorkspaceBuild,
   MockWorkspaceBuildParameter1,
-} from "testHelpers/entities"
-import * as api from "./api"
-import * as TypesGen from "./typesGenerated"
+} from "testHelpers/entities";
+import * as api from "./api";
+import * as TypesGen from "./typesGenerated";
 
 describe("api.ts", () => {
   describe("login", () => {
@@ -16,111 +16,111 @@ describe("api.ts", () => {
       // given
       const loginResponse: TypesGen.LoginWithPasswordResponse = {
         session_token: "abc_123_test",
-      }
-      jest.spyOn(axios, "post").mockResolvedValueOnce({ data: loginResponse })
+      };
+      jest.spyOn(axios, "post").mockResolvedValueOnce({ data: loginResponse });
 
       // when
-      const result = await api.login("test", "123")
+      const result = await api.login("test", "123");
 
       // then
-      expect(axios.post).toHaveBeenCalled()
-      expect(result).toStrictEqual(loginResponse)
-    })
+      expect(axios.post).toHaveBeenCalled();
+      expect(result).toStrictEqual(loginResponse);
+    });
 
     it("should throw an error on 401", async () => {
       // given
       // ..ensure that we await our expect assertion in async/await test
-      expect.assertions(1)
+      expect.assertions(1);
       const expectedError = {
         message: "Validation failed",
         errors: [{ field: "email", code: "email" }],
-      }
+      };
       const axiosMockPost = jest.fn().mockImplementationOnce(() => {
-        return Promise.reject(expectedError)
-      })
-      axios.post = axiosMockPost
+        return Promise.reject(expectedError);
+      });
+      axios.post = axiosMockPost;
 
       try {
-        await api.login("test", "123")
+        await api.login("test", "123");
       } catch (error) {
-        expect(error).toStrictEqual(expectedError)
+        expect(error).toStrictEqual(expectedError);
       }
-    })
-  })
+    });
+  });
 
   describe("logout", () => {
     it("should return without erroring", async () => {
       // given
       const axiosMockPost = jest.fn().mockImplementationOnce(() => {
-        return Promise.resolve()
-      })
-      axios.post = axiosMockPost
+        return Promise.resolve();
+      });
+      axios.post = axiosMockPost;
 
       // when
-      await api.logout()
+      await api.logout();
 
       // then
-      expect(axiosMockPost).toHaveBeenCalled()
-    })
+      expect(axiosMockPost).toHaveBeenCalled();
+    });
 
     it("should throw an error on 500", async () => {
       // given
       // ..ensure that we await our expect assertion in async/await test
-      expect.assertions(1)
+      expect.assertions(1);
       const expectedError = {
         message: "Failed to logout.",
-      }
+      };
       const axiosMockPost = jest.fn().mockImplementationOnce(() => {
-        return Promise.reject(expectedError)
-      })
-      axios.post = axiosMockPost
+        return Promise.reject(expectedError);
+      });
+      axios.post = axiosMockPost;
 
       try {
-        await api.logout()
+        await api.logout();
       } catch (error) {
-        expect(error).toStrictEqual(expectedError)
+        expect(error).toStrictEqual(expectedError);
       }
-    })
-  })
+    });
+  });
 
   describe("getApiKey", () => {
     it("should return APIKeyResponse", async () => {
       // given
       const apiKeyResponse: TypesGen.GenerateAPIKeyResponse = {
         key: "abc_123_test",
-      }
+      };
       const axiosMockPost = jest.fn().mockImplementationOnce(() => {
-        return Promise.resolve({ data: apiKeyResponse })
-      })
-      axios.post = axiosMockPost
+        return Promise.resolve({ data: apiKeyResponse });
+      });
+      axios.post = axiosMockPost;
 
       // when
-      const result = await api.getApiKey()
+      const result = await api.getApiKey();
 
       // then
-      expect(axiosMockPost).toHaveBeenCalled()
-      expect(result).toStrictEqual(apiKeyResponse)
-    })
+      expect(axiosMockPost).toHaveBeenCalled();
+      expect(result).toStrictEqual(apiKeyResponse);
+    });
 
     it("should throw an error on 401", async () => {
       // given
       // ..ensure that we await our expect assertion in async/await test
-      expect.assertions(1)
+      expect.assertions(1);
       const expectedError = {
         message: "No Cookie!",
-      }
+      };
       const axiosMockPost = jest.fn().mockImplementationOnce(() => {
-        return Promise.reject(expectedError)
-      })
-      axios.post = axiosMockPost
+        return Promise.reject(expectedError);
+      });
+      axios.post = axiosMockPost;
 
       try {
-        await api.getApiKey()
+        await api.getApiKey();
       } catch (error) {
-        expect(error).toStrictEqual(expectedError)
+        expect(error).toStrictEqual(expectedError);
       }
-    })
-  })
+    });
+  });
 
   describe("getURLWithSearchParams - workspaces", () => {
     it.each<[string, TypesGen.WorkspaceFilter | undefined, string]>([
@@ -141,10 +141,10 @@ describe("api.ts", () => {
     ])(
       `Workspaces - getURLWithSearchParams(%p, %p) returns %p`,
       (basePath, filter, expected) => {
-        expect(api.getURLWithSearchParams(basePath, filter)).toBe(expected)
+        expect(api.getURLWithSearchParams(basePath, filter)).toBe(expected);
       },
-    )
-  })
+    );
+  });
 
   describe("getURLWithSearchParams - users", () => {
     it.each<[string, TypesGen.UsersRequest | undefined, string]>([
@@ -158,72 +158,72 @@ describe("api.ts", () => {
     ])(
       `Users - getURLWithSearchParams(%p, %p) returns %p`,
       (basePath, filter, expected) => {
-        expect(api.getURLWithSearchParams(basePath, filter)).toBe(expected)
+        expect(api.getURLWithSearchParams(basePath, filter)).toBe(expected);
       },
-    )
-  })
+    );
+  });
 
   describe("update", () => {
     it("creates a build with start and the latest template", async () => {
       jest
         .spyOn(api, "postWorkspaceBuild")
-        .mockResolvedValueOnce(MockWorkspaceBuild)
-      jest.spyOn(api, "getTemplate").mockResolvedValueOnce(MockTemplate)
-      await api.updateWorkspace(MockWorkspace)
+        .mockResolvedValueOnce(MockWorkspaceBuild);
+      jest.spyOn(api, "getTemplate").mockResolvedValueOnce(MockTemplate);
+      await api.updateWorkspace(MockWorkspace);
       expect(api.postWorkspaceBuild).toHaveBeenCalledWith(MockWorkspace.id, {
         transition: "start",
         template_version_id: MockTemplate.active_version_id,
         rich_parameter_values: [],
-      })
-    })
+      });
+    });
 
     it("fails when having missing parameters", async () => {
       jest
         .spyOn(api, "postWorkspaceBuild")
-        .mockResolvedValue(MockWorkspaceBuild)
-      jest.spyOn(api, "getTemplate").mockResolvedValue(MockTemplate)
-      jest.spyOn(api, "getWorkspaceBuildParameters").mockResolvedValue([])
+        .mockResolvedValue(MockWorkspaceBuild);
+      jest.spyOn(api, "getTemplate").mockResolvedValue(MockTemplate);
+      jest.spyOn(api, "getWorkspaceBuildParameters").mockResolvedValue([]);
       jest
         .spyOn(api, "getTemplateVersionRichParameters")
         .mockResolvedValue([
           MockTemplateVersionParameter1,
           { ...MockTemplateVersionParameter2, mutable: false },
-        ])
+        ]);
 
-      let error = new Error()
+      let error = new Error();
       try {
-        await api.updateWorkspace(MockWorkspace)
+        await api.updateWorkspace(MockWorkspace);
       } catch (e) {
-        error = e as Error
+        error = e as Error;
       }
 
-      expect(error).toBeInstanceOf(api.MissingBuildParameters)
+      expect(error).toBeInstanceOf(api.MissingBuildParameters);
       // Verify if the correct missing parameters are being passed
       expect((error as api.MissingBuildParameters).parameters).toEqual([
         MockTemplateVersionParameter1,
         { ...MockTemplateVersionParameter2, mutable: false },
-      ])
-    })
+      ]);
+    });
 
     it("creates a build with the no parameters if it is already filled", async () => {
       jest
         .spyOn(api, "postWorkspaceBuild")
-        .mockResolvedValueOnce(MockWorkspaceBuild)
-      jest.spyOn(api, "getTemplate").mockResolvedValueOnce(MockTemplate)
+        .mockResolvedValueOnce(MockWorkspaceBuild);
+      jest.spyOn(api, "getTemplate").mockResolvedValueOnce(MockTemplate);
       jest
         .spyOn(api, "getWorkspaceBuildParameters")
-        .mockResolvedValue([MockWorkspaceBuildParameter1])
+        .mockResolvedValue([MockWorkspaceBuildParameter1]);
       jest
         .spyOn(api, "getTemplateVersionRichParameters")
         .mockResolvedValue([
           { ...MockTemplateVersionParameter1, required: true, mutable: false },
-        ])
-      await api.updateWorkspace(MockWorkspace)
+        ]);
+      await api.updateWorkspace(MockWorkspace);
       expect(api.postWorkspaceBuild).toHaveBeenCalledWith(MockWorkspace.id, {
         transition: "start",
         template_version_id: MockTemplate.active_version_id,
         rich_parameter_values: [],
-      })
-    })
-  })
-})
+      });
+    });
+  });
+});
diff --git a/site/src/api/api.ts b/site/src/api/api.ts
index bd2f36967f74c..c602a727e389e 100644
--- a/site/src/api/api.ts
+++ b/site/src/api/api.ts
@@ -1,17 +1,17 @@
-import axios from "axios"
-import dayjs from "dayjs"
-import * as Types from "./types"
-import { DeploymentConfig } from "./types"
-import * as TypesGen from "./typesGenerated"
-import { delay } from "utils/delay"
-import userAgentParser from "ua-parser-js"
+import axios from "axios";
+import dayjs from "dayjs";
+import * as TypesGen from "./typesGenerated";
+// This needs to include the `../`, otherwise it breaks when importing into
+// vscode-coder.
+import { delay } from "../utils/delay";
+import userAgentParser from "ua-parser-js";
 
 // Adds 304 for the default axios validateStatus function
 // https://github.com/axios/axios#handling-errors Check status here
 // https://httpstatusdogs.com/
 axios.defaults.validateStatus = (status) => {
-  return (status >= 200 && status < 300) || status === 304
-}
+  return (status >= 200 && status < 300) || status === 304;
+};
 
 export const hardCodedCSRFCookie = (): string => {
   // This is a hard coded CSRF token/cookie pair for local development. In prod,
@@ -21,10 +21,10 @@ export const hardCodedCSRFCookie = (): string => {
   // remote apis. The CSRF cookie for this token is
   // "JXm9hOUdZctWt0ZZGAy9xiS/gxMKYOThdxjjMnMUyn4="
   const csrfToken =
-    "KNKvagCBEHZK7ihe2t7fj6VeJ0UyTDco1yVUJE8N06oNqxLu5Zx1vRxZbgfC0mJJgeGkVjgs08mgPbcWPBkZ1A=="
-  axios.defaults.headers.common["X-CSRF-TOKEN"] = csrfToken
-  return csrfToken
-}
+    "KNKvagCBEHZK7ihe2t7fj6VeJ0UyTDco1yVUJE8N06oNqxLu5Zx1vRxZbgfC0mJJgeGkVjgs08mgPbcWPBkZ1A==";
+  axios.defaults.headers.common["X-CSRF-TOKEN"] = csrfToken;
+  return csrfToken;
+};
 
 // withDefaultFeatures sets all unspecified features to not_entitled and
 // disabled.
@@ -34,42 +34,42 @@ export const withDefaultFeatures = (
   for (const feature of TypesGen.FeatureNames) {
     // Skip fields that are already filled.
     if (fs[feature] !== undefined) {
-      continue
+      continue;
     }
     fs[feature] = {
       enabled: false,
       entitlement: "not_entitled",
-    }
+    };
   }
-  return fs as TypesGen.Entitlements["features"]
-}
+  return fs as TypesGen.Entitlements["features"];
+};
 
 // Always attach CSRF token to all requests. In puppeteer the document is
 // undefined. In those cases, just do nothing.
 const token =
   typeof document !== "undefined"
     ? document.head.querySelector('meta[property="csrf-token"]')
-    : null
+    : null;
 
 if (token !== null && token.getAttribute("content") !== null) {
   if (process.env.NODE_ENV === "development") {
     // Development mode uses a hard-coded CSRF token
-    axios.defaults.headers.common["X-CSRF-TOKEN"] = hardCodedCSRFCookie()
-    token.setAttribute("content", hardCodedCSRFCookie())
+    axios.defaults.headers.common["X-CSRF-TOKEN"] = hardCodedCSRFCookie();
+    token.setAttribute("content", hardCodedCSRFCookie());
   } else {
     axios.defaults.headers.common["X-CSRF-TOKEN"] =
-      token.getAttribute("content") ?? ""
+      token.getAttribute("content") ?? "";
   }
 } else {
   // Do not write error logs if we are in a FE unit test.
   if (process.env.JEST_WORKER_ID === undefined) {
-    console.error("CSRF token not found")
+    console.error("CSRF token not found");
   }
 }
 
 const CONTENT_TYPE_JSON = {
   "Content-Type": "application/json",
-}
+};
 
 export const provisioners: TypesGen.ProvisionerDaemon[] = [
   {
@@ -86,7 +86,7 @@ export const provisioners: TypesGen.ProvisionerDaemon[] = [
     provisioners: [],
     tags: {},
   },
-]
+];
 
 export const login = async (
   email: string,
@@ -95,7 +95,7 @@ export const login = async (
   const payload = JSON.stringify({
     email,
     password,
-  })
+  });
 
   const response = await axios.post<TypesGen.LoginWithPasswordResponse>(
     "/api/v2/users/login",
@@ -103,51 +103,41 @@ export const login = async (
     {
       headers: { ...CONTENT_TYPE_JSON },
     },
-  )
+  );
 
-  return response.data
-}
+  return response.data;
+};
 
 export const convertToOAUTH = async (request: TypesGen.ConvertLoginRequest) => {
   const response = await axios.post<TypesGen.OAuthConversionResponse>(
     "/api/v2/users/me/convert-login",
     request,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const logout = async (): Promise<void> => {
-  await axios.post("/api/v2/users/logout")
-}
-
-export const getAuthenticatedUser = async (): Promise<
-  TypesGen.User | undefined
-> => {
-  try {
-    const response = await axios.get<TypesGen.User>("/api/v2/users/me")
-    return response.data
-  } catch (error) {
-    if (axios.isAxiosError(error) && error.response?.status === 401) {
-      return undefined
-    }
+  await axios.post("/api/v2/users/logout");
+};
 
-    throw error
-  }
-}
+export const getAuthenticatedUser = async () => {
+  const response = await axios.get<TypesGen.User>("/api/v2/users/me");
+  return response.data;
+};
 
 export const getAuthMethods = async (): Promise<TypesGen.AuthMethods> => {
   const response = await axios.get<TypesGen.AuthMethods>(
     "/api/v2/users/authmethods",
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getUserLoginType = async (): Promise<TypesGen.UserLoginType> => {
   const response = await axios.get<TypesGen.UserLoginType>(
     "/api/v2/users/me/login-type",
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const checkAuthorization = async (
   params: TypesGen.AuthorizationRequest,
@@ -155,16 +145,16 @@ export const checkAuthorization = async (
   const response = await axios.post<TypesGen.AuthorizationResponse>(
     `/api/v2/authcheck`,
     params,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getApiKey = async (): Promise<TypesGen.GenerateAPIKeyResponse> => {
   const response = await axios.post<TypesGen.GenerateAPIKeyResponse>(
     "/api/v2/users/me/keys",
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getTokens = async (
   params: TypesGen.TokensFilter,
@@ -174,67 +164,70 @@ export const getTokens = async (
     {
       params,
     },
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const deleteToken = async (keyId: string): Promise<void> => {
-  await axios.delete("/api/v2/users/me/keys/" + keyId)
-}
+  await axios.delete("/api/v2/users/me/keys/" + keyId);
+};
 
 export const createToken = async (
   params: TypesGen.CreateTokenRequest,
 ): Promise<TypesGen.GenerateAPIKeyResponse> => {
-  const response = await axios.post(`/api/v2/users/me/keys/tokens`, params)
-  return response.data
-}
+  const response = await axios.post(`/api/v2/users/me/keys/tokens`, params);
+  return response.data;
+};
 
 export const getTokenConfig = async (): Promise<TypesGen.TokenConfig> => {
-  const response = await axios.get("/api/v2/users/me/keys/tokens/tokenconfig")
-  return response.data
-}
+  const response = await axios.get("/api/v2/users/me/keys/tokens/tokenconfig");
+  return response.data;
+};
 
 export const getUsers = async (
   options: TypesGen.UsersRequest,
+  signal?: AbortSignal,
 ): Promise<TypesGen.GetUsersResponse> => {
-  const url = getURLWithSearchParams("/api/v2/users", options)
-  const response = await axios.get<TypesGen.GetUsersResponse>(url.toString())
-  return response.data
-}
+  const url = getURLWithSearchParams("/api/v2/users", options);
+  const response = await axios.get<TypesGen.GetUsersResponse>(url.toString(), {
+    signal,
+  });
+  return response.data;
+};
 
 export const getOrganization = async (
   organizationId: string,
 ): Promise<TypesGen.Organization> => {
   const response = await axios.get<TypesGen.Organization>(
     `/api/v2/organizations/${organizationId}`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getOrganizations = async (): Promise<TypesGen.Organization[]> => {
   const response = await axios.get<TypesGen.Organization[]>(
     "/api/v2/users/me/organizations",
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getTemplate = async (
   templateId: string,
 ): Promise<TypesGen.Template> => {
   const response = await axios.get<TypesGen.Template>(
     `/api/v2/templates/${templateId}`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getTemplates = async (
   organizationId: string,
 ): Promise<TypesGen.Template[]> => {
   const response = await axios.get<TypesGen.Template[]>(
     `/api/v2/organizations/${organizationId}/templates`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getTemplateByName = async (
   organizationId: string,
@@ -242,45 +235,45 @@ export const getTemplateByName = async (
 ): Promise<TypesGen.Template> => {
   const response = await axios.get<TypesGen.Template>(
     `/api/v2/organizations/${organizationId}/templates/${name}`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getTemplateVersion = async (
   versionId: string,
 ): Promise<TypesGen.TemplateVersion> => {
   const response = await axios.get<TypesGen.TemplateVersion>(
     `/api/v2/templateversions/${versionId}`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getTemplateVersionResources = async (
   versionId: string,
 ): Promise<TypesGen.WorkspaceResource[]> => {
   const response = await axios.get<TypesGen.WorkspaceResource[]>(
     `/api/v2/templateversions/${versionId}/resources`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getTemplateVersionVariables = async (
   versionId: string,
 ): Promise<TypesGen.TemplateVersionVariable[]> => {
   const response = await axios.get<TypesGen.TemplateVersionVariable[]>(
     `/api/v2/templateversions/${versionId}/variables`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getTemplateVersions = async (
   templateId: string,
 ): Promise<TypesGen.TemplateVersion[]> => {
   const response = await axios.get<TypesGen.TemplateVersion[]>(
     `/api/v2/templates/${templateId}/versions`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getTemplateVersionByName = async (
   organizationId: string,
@@ -289,13 +282,13 @@ export const getTemplateVersionByName = async (
 ): Promise<TypesGen.TemplateVersion> => {
   const response = await axios.get<TypesGen.TemplateVersion>(
     `/api/v2/organizations/${organizationId}/templates/${templateName}/versions/${versionName}`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export type GetPreviousTemplateVersionByNameResponse =
   | TypesGen.TemplateVersion
-  | undefined
+  | undefined;
 
 export const getPreviousTemplateVersionByName = async (
   organizationId: string,
@@ -305,8 +298,8 @@ export const getPreviousTemplateVersionByName = async (
   try {
     const response = await axios.get<TypesGen.TemplateVersion>(
       `/api/v2/organizations/${organizationId}/templates/${templateName}/versions/${versionName}/previous`,
-    )
-    return response.data
+    );
+    return response.data;
   } catch (error) {
     // When there is no previous version, like the first version of a template,
     // the API returns 404 so in this case we can safely return undefined
@@ -315,12 +308,12 @@ export const getPreviousTemplateVersionByName = async (
       error.response &&
       error.response.status === 404
     ) {
-      return undefined
+      return undefined;
     }
 
-    throw error
+    throw error;
   }
-}
+};
 
 export const createTemplateVersion = async (
   organizationId: string,
@@ -329,27 +322,27 @@ export const createTemplateVersion = async (
   const response = await axios.post<TypesGen.TemplateVersion>(
     `/api/v2/organizations/${organizationId}/templateversions`,
     data,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
-export const getTemplateVersionGitAuth = async (
+export const getTemplateVersionExternalAuth = async (
   versionId: string,
-): Promise<TypesGen.TemplateVersionGitAuth[]> => {
+): Promise<TypesGen.TemplateVersionExternalAuth[]> => {
   const response = await axios.get(
-    `/api/v2/templateversions/${versionId}/gitauth`,
-  )
-  return response.data
-}
+    `/api/v2/templateversions/${versionId}/external-auth`,
+  );
+  return response.data;
+};
 
 export const getTemplateVersionRichParameters = async (
   versionId: string,
 ): Promise<TypesGen.TemplateVersionParameter[]> => {
   const response = await axios.get(
     `/api/v2/templateversions/${versionId}/rich-parameters`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const createTemplate = async (
   organizationId: string,
@@ -358,20 +351,20 @@ export const createTemplate = async (
   const response = await axios.post(
     `/api/v2/organizations/${organizationId}/templates`,
     data,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const updateActiveTemplateVersion = async (
   templateId: string,
   data: TypesGen.UpdateActiveTemplateVersion,
-): Promise<Types.Message> => {
-  const response = await axios.patch<Types.Message>(
+) => {
+  const response = await axios.patch<TypesGen.Response>(
     `/api/v2/templates/${templateId}/versions`,
     data,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const patchTemplateVersion = async (
   templateVersionId: string,
@@ -380,9 +373,23 @@ export const patchTemplateVersion = async (
   const response = await axios.patch<TypesGen.TemplateVersion>(
     `/api/v2/templateversions/${templateVersionId}`,
     data,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
+
+export const archiveTemplateVersion = async (templateVersionId: string) => {
+  const response = await axios.post<TypesGen.TemplateVersion>(
+    `/api/v2/templateversions/${templateVersionId}/archive`,
+  );
+  return response.data;
+};
+
+export const unarchiveTemplateVersion = async (templateVersionId: string) => {
+  const response = await axios.post<TypesGen.TemplateVersion>(
+    `/api/v2/templateversions/${templateVersionId}/unarchive`,
+  );
+  return response.data;
+};
 
 export const updateTemplateMeta = async (
   templateId: string,
@@ -391,18 +398,18 @@ export const updateTemplateMeta = async (
   const response = await axios.patch<TypesGen.Template>(
     `/api/v2/templates/${templateId}`,
     data,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const deleteTemplate = async (
   templateId: string,
 ): Promise<TypesGen.Template> => {
   const response = await axios.delete<TypesGen.Template>(
     `/api/v2/templates/${templateId}`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getWorkspace = async (
   workspaceId: string,
@@ -413,9 +420,9 @@ export const getWorkspace = async (
     {
       params,
     },
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 /**
  *
@@ -426,11 +433,11 @@ export const watchWorkspace = (workspaceId: string): EventSource => {
   return new EventSource(
     `${location.protocol}//${location.host}/api/v2/workspaces/${workspaceId}/watch`,
     { withCredentials: true },
-  )
-}
+  );
+};
 
 interface SearchParamOptions extends TypesGen.Pagination {
-  q?: string
+  q?: string;
 }
 
 export const getURLWithSearchParams = (
@@ -438,28 +445,28 @@ export const getURLWithSearchParams = (
   options?: SearchParamOptions,
 ): string => {
   if (options) {
-    const searchParams = new URLSearchParams()
-    const keys = Object.keys(options) as (keyof SearchParamOptions)[]
+    const searchParams = new URLSearchParams();
+    const keys = Object.keys(options) as (keyof SearchParamOptions)[];
     keys.forEach((key) => {
-      const value = options[key]
+      const value = options[key];
       if (value !== undefined && value !== "") {
-        searchParams.append(key, value.toString())
+        searchParams.append(key, value.toString());
       }
-    })
-    const searchString = searchParams.toString()
-    return searchString ? `${basePath}?${searchString}` : basePath
+    });
+    const searchString = searchParams.toString();
+    return searchString ? `${basePath}?${searchString}` : basePath;
   } else {
-    return basePath
+    return basePath;
   }
-}
+};
 
 export const getWorkspaces = async (
   options: TypesGen.WorkspacesRequest,
 ): Promise<TypesGen.WorkspacesResponse> => {
-  const url = getURLWithSearchParams("/api/v2/workspaces", options)
-  const response = await axios.get<TypesGen.WorkspacesResponse>(url)
-  return response.data
-}
+  const url = getURLWithSearchParams("/api/v2/workspaces", options);
+  const response = await axios.get<TypesGen.WorkspacesResponse>(url);
+  return response.data;
+};
 
 export const getWorkspaceByOwnerAndName = async (
   username = "me",
@@ -471,14 +478,14 @@ export const getWorkspaceByOwnerAndName = async (
     {
       params,
     },
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export function waitForBuild(build: TypesGen.WorkspaceBuild) {
   return new Promise<TypesGen.ProvisionerJob | undefined>((res, reject) => {
     void (async () => {
-      let latestJobInfo: TypesGen.ProvisionerJob | undefined = undefined
+      let latestJobInfo: TypesGen.ProvisionerJob | undefined = undefined;
 
       while (
         !["succeeded", "canceled"].some(
@@ -488,20 +495,20 @@ export function waitForBuild(build: TypesGen.WorkspaceBuild) {
         const { job } = await getWorkspaceBuildByNumber(
           build.workspace_owner_name,
           build.workspace_name,
-          String(build.build_number),
-        )
-        latestJobInfo = job
+          build.build_number,
+        );
+        latestJobInfo = job;
 
         if (latestJobInfo.status === "failed") {
-          return reject(latestJobInfo)
+          return reject(latestJobInfo);
         }
 
-        await delay(1000)
+        await delay(1000);
       }
 
-      return res(latestJobInfo)
-    })()
-  })
+      return res(latestJobInfo);
+    })();
+  });
 }
 
 export const postWorkspaceBuild = async (
@@ -511,9 +518,9 @@ export const postWorkspaceBuild = async (
   const response = await axios.post(
     `/api/v2/workspaces/${workspaceId}/builds`,
     data,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const startWorkspace = (
   workspaceId: string,
@@ -526,7 +533,7 @@ export const startWorkspace = (
     template_version_id: templateVersionId,
     log_level: logLevel,
     rich_parameter_values: buildParameters,
-  })
+  });
 export const stopWorkspace = (
   workspaceId: string,
   logLevel?: TypesGen.CreateWorkspaceBuildRequest["log_level"],
@@ -534,7 +541,7 @@ export const stopWorkspace = (
   postWorkspaceBuild(workspaceId, {
     transition: "stop",
     log_level: logLevel,
-  })
+  });
 
 export const deleteWorkspace = (
   workspaceId: string,
@@ -543,30 +550,45 @@ export const deleteWorkspace = (
   postWorkspaceBuild(workspaceId, {
     transition: "delete",
     log_level: logLevel,
-  })
+  });
 
 export const cancelWorkspaceBuild = async (
   workspaceBuildId: TypesGen.WorkspaceBuild["id"],
-): Promise<Types.Message> => {
+): Promise<TypesGen.Response> => {
   const response = await axios.patch(
     `/api/v2/workspacebuilds/${workspaceBuildId}/cancel`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
+
+export const updateWorkspaceDormancy = async (
+  workspaceId: string,
+  dormant: boolean,
+): Promise<TypesGen.Workspace> => {
+  const data: TypesGen.UpdateWorkspaceDormancy = {
+    dormant: dormant,
+  };
+
+  const response = await axios.put(
+    `/api/v2/workspaces/${workspaceId}/dormant`,
+    data,
+  );
+  return response.data;
+};
 
 export const restartWorkspace = async ({
   workspace,
   buildParameters,
 }: {
-  workspace: TypesGen.Workspace
-  buildParameters?: TypesGen.WorkspaceBuildParameter[]
+  workspace: TypesGen.Workspace;
+  buildParameters?: TypesGen.WorkspaceBuildParameter[];
 }) => {
-  const stopBuild = await stopWorkspace(workspace.id)
-  const awaitedStopBuild = await waitForBuild(stopBuild)
+  const stopBuild = await stopWorkspace(workspace.id);
+  const awaitedStopBuild = await waitForBuild(stopBuild);
 
   // If the restart is canceled halfway through, make sure we bail
   if (awaitedStopBuild?.status === "canceled") {
-    return
+    return;
   }
 
   const startBuild = await startWorkspace(
@@ -574,25 +596,25 @@ export const restartWorkspace = async ({
     workspace.latest_build.template_version_id,
     undefined,
     buildParameters,
-  )
-  await waitForBuild(startBuild)
-}
+  );
+  await waitForBuild(startBuild);
+};
 
 export const cancelTemplateVersionBuild = async (
   templateVersionId: TypesGen.TemplateVersion["id"],
-): Promise<Types.Message> => {
+): Promise<TypesGen.Response> => {
   const response = await axios.patch(
     `/api/v2/templateversions/${templateVersionId}/cancel`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const createUser = async (
   user: TypesGen.CreateUserRequest,
 ): Promise<TypesGen.User> => {
-  const response = await axios.post<TypesGen.User>("/api/v2/users", user)
-  return response.data
-}
+  const response = await axios.post<TypesGen.User>("/api/v2/users", user);
+  return response.data;
+};
 
 export const createWorkspace = async (
   organizationId: string,
@@ -602,118 +624,131 @@ export const createWorkspace = async (
   const response = await axios.post<TypesGen.Workspace>(
     `/api/v2/organizations/${organizationId}/members/${userId}/workspaces`,
     workspace,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const patchWorkspace = async (
   workspaceId: string,
   data: TypesGen.UpdateWorkspaceRequest,
 ) => {
-  await axios.patch(`/api/v2/workspaces/${workspaceId}`, data)
-}
+  await axios.patch(`/api/v2/workspaces/${workspaceId}`, data);
+};
 
 export const getBuildInfo = async (): Promise<TypesGen.BuildInfoResponse> => {
-  const response = await axios.get("/api/v2/buildinfo")
-  return response.data
-}
+  const response = await axios.get("/api/v2/buildinfo");
+  return response.data;
+};
 
 export const getUpdateCheck =
   async (): Promise<TypesGen.UpdateCheckResponse> => {
-    const response = await axios.get("/api/v2/updatecheck")
-    return response.data
-  }
+    const response = await axios.get("/api/v2/updatecheck");
+    return response.data;
+  };
 
 export const putWorkspaceAutostart = async (
   workspaceID: string,
   autostart: TypesGen.UpdateWorkspaceAutostartRequest,
 ): Promise<void> => {
-  const payload = JSON.stringify(autostart)
+  const payload = JSON.stringify(autostart);
   await axios.put(`/api/v2/workspaces/${workspaceID}/autostart`, payload, {
     headers: { ...CONTENT_TYPE_JSON },
-  })
-}
+  });
+};
 
 export const putWorkspaceAutostop = async (
   workspaceID: string,
   ttl: TypesGen.UpdateWorkspaceTTLRequest,
 ): Promise<void> => {
-  const payload = JSON.stringify(ttl)
+  const payload = JSON.stringify(ttl);
   await axios.put(`/api/v2/workspaces/${workspaceID}/ttl`, payload, {
     headers: { ...CONTENT_TYPE_JSON },
-  })
-}
+  });
+};
 
 export const updateProfile = async (
   userId: string,
   data: TypesGen.UpdateUserProfileRequest,
 ): Promise<TypesGen.User> => {
-  const response = await axios.put(`/api/v2/users/${userId}/profile`, data)
-  return response.data
-}
+  const response = await axios.put(`/api/v2/users/${userId}/profile`, data);
+  return response.data;
+};
+
+export const getUserQuietHoursSchedule = async (
+  userId: TypesGen.User["id"],
+): Promise<TypesGen.UserQuietHoursScheduleResponse> => {
+  const response = await axios.get(`/api/v2/users/${userId}/quiet-hours`);
+  return response.data;
+};
+
+export const updateUserQuietHoursSchedule = async (
+  userId: TypesGen.User["id"],
+  data: TypesGen.UpdateUserQuietHoursScheduleRequest,
+): Promise<TypesGen.UserQuietHoursScheduleResponse> => {
+  const response = await axios.put(`/api/v2/users/${userId}/quiet-hours`, data);
+  return response.data;
+};
 
 export const activateUser = async (
   userId: TypesGen.User["id"],
 ): Promise<TypesGen.User> => {
   const response = await axios.put<TypesGen.User>(
     `/api/v2/users/${userId}/status/activate`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const suspendUser = async (
   userId: TypesGen.User["id"],
 ): Promise<TypesGen.User> => {
   const response = await axios.put<TypesGen.User>(
     `/api/v2/users/${userId}/status/suspend`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const deleteUser = async (
   userId: TypesGen.User["id"],
 ): Promise<undefined> => {
-  return await axios.delete(`/api/v2/users/${userId}`)
-}
+  return await axios.delete(`/api/v2/users/${userId}`);
+};
 
 // API definition:
 // https://github.com/coder/coder/blob/db665e7261f3c24a272ccec48233a3e276878239/coderd/users.go#L33-L53
 export const hasFirstUser = async (): Promise<boolean> => {
   try {
     // If it is success, it is true
-    await axios.get("/api/v2/users/first")
-    return true
+    await axios.get("/api/v2/users/first");
+    return true;
   } catch (error) {
     // If it returns a 404, it is false
     if (axios.isAxiosError(error) && error.response?.status === 404) {
-      return false
+      return false;
     }
 
-    throw error
+    throw error;
   }
-}
+};
 
 export const createFirstUser = async (
   req: TypesGen.CreateFirstUserRequest,
 ): Promise<TypesGen.CreateFirstUserResponse> => {
-  const response = await axios.post(`/api/v2/users/first`, req)
-  return response.data
-}
+  const response = await axios.post(`/api/v2/users/first`, req);
+  return response.data;
+};
 
 export const updateUserPassword = async (
   userId: TypesGen.User["id"],
   updatePassword: TypesGen.UpdateUserPasswordRequest,
 ): Promise<undefined> =>
-  axios.put(`/api/v2/users/${userId}/password`, updatePassword)
+  axios.put(`/api/v2/users/${userId}/password`, updatePassword);
 
-export const getSiteRoles = async (): Promise<
-  Array<TypesGen.AssignableRoles>
-> => {
+export const getRoles = async (): Promise<Array<TypesGen.AssignableRoles>> => {
   const response = await axios.get<Array<TypesGen.AssignableRoles>>(
     `/api/v2/users/roles`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const updateUserRoles = async (
   roles: TypesGen.Role["name"][],
@@ -722,67 +757,67 @@ export const updateUserRoles = async (
   const response = await axios.put<TypesGen.User>(
     `/api/v2/users/${userId}/roles`,
     { roles },
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getUserSSHKey = async (
   userId = "me",
 ): Promise<TypesGen.GitSSHKey> => {
   const response = await axios.get<TypesGen.GitSSHKey>(
     `/api/v2/users/${userId}/gitsshkey`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const regenerateUserSSHKey = async (
   userId = "me",
 ): Promise<TypesGen.GitSSHKey> => {
   const response = await axios.put<TypesGen.GitSSHKey>(
     `/api/v2/users/${userId}/gitsshkey`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getWorkspaceBuilds = async (
   workspaceId: string,
-  since: Date,
-): Promise<TypesGen.WorkspaceBuild[]> => {
+  req?: TypesGen.WorkspaceBuildsRequest,
+) => {
   const response = await axios.get<TypesGen.WorkspaceBuild[]>(
-    `/api/v2/workspaces/${workspaceId}/builds?since=${since.toISOString()}`,
-  )
-  return response.data
-}
+    getURLWithSearchParams(`/api/v2/workspaces/${workspaceId}/builds`, req),
+  );
+  return response.data;
+};
 
 export const getWorkspaceBuildByNumber = async (
   username = "me",
   workspaceName: string,
-  buildNumber: string,
+  buildNumber: number,
 ): Promise<TypesGen.WorkspaceBuild> => {
   const response = await axios.get<TypesGen.WorkspaceBuild>(
     `/api/v2/users/${username}/workspace/${workspaceName}/builds/${buildNumber}`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getWorkspaceBuildLogs = async (
-  buildname: string,
+  buildId: string,
   before: Date,
 ): Promise<TypesGen.ProvisionerJobLog[]> => {
   const response = await axios.get<TypesGen.ProvisionerJobLog[]>(
-    `/api/v2/workspacebuilds/${buildname}/logs?before=${before.getTime()}`,
-  )
-  return response.data
-}
+    `/api/v2/workspacebuilds/${buildId}/logs?before=${before.getTime()}`,
+  );
+  return response.data;
+};
 
 export const getWorkspaceAgentLogs = async (
   agentID: string,
 ): Promise<TypesGen.WorkspaceAgentLog[]> => {
   const response = await axios.get<TypesGen.WorkspaceAgentLog[]>(
     `/api/v2/workspaceagents/${agentID}/logs`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const putWorkspaceExtension = async (
   workspaceId: string,
@@ -790,13 +825,17 @@ export const putWorkspaceExtension = async (
 ): Promise<void> => {
   await axios.put(`/api/v2/workspaces/${workspaceId}/extend`, {
     deadline: newDeadline,
-  })
-}
+  });
+};
+
+export const refreshEntitlements = async (): Promise<void> => {
+  await axios.post("/api/v2/licenses/refresh-entitlements");
+};
 
 export const getEntitlements = async (): Promise<TypesGen.Entitlements> => {
   try {
-    const response = await axios.get("/api/v2/entitlements")
-    return response.data
+    const response = await axios.get("/api/v2/entitlements");
+    return response.data;
   } catch (ex) {
     if (axios.isAxiosError(ex) && ex.response?.status === 404) {
       return {
@@ -806,68 +845,85 @@ export const getEntitlements = async (): Promise<TypesGen.Entitlements> => {
         require_telemetry: false,
         trial: false,
         warnings: [],
-      }
+        refreshed_at: "",
+      };
     }
-    throw ex
+    throw ex;
   }
-}
+};
 
 export const getExperiments = async (): Promise<TypesGen.Experiment[]> => {
   try {
-    const response = await axios.get("/api/v2/experiments")
-    return response.data
+    const response = await axios.get("/api/v2/experiments");
+    return response.data;
   } catch (error) {
     if (axios.isAxiosError(error) && error.response?.status === 404) {
-      return []
+      return [];
     }
-    throw error
+    throw error;
   }
-}
+};
+
+export const getAvailableExperiments =
+  async (): Promise<TypesGen.AvailableExperiments> => {
+    try {
+      const response = await axios.get("/api/v2/experiments/available");
+      return response.data;
+    } catch (error) {
+      if (axios.isAxiosError(error) && error.response?.status === 404) {
+        return { safe: [] };
+      }
+      throw error;
+    }
+  };
 
-export const getGitAuthProvider = async (
+export const getExternalAuthProvider = async (
   provider: string,
-): Promise<TypesGen.GitAuth> => {
-  const resp = await axios.get(`/api/v2/gitauth/${provider}`)
-  return resp.data
-}
+): Promise<TypesGen.ExternalAuth> => {
+  const resp = await axios.get(`/api/v2/external-auth/${provider}`);
+  return resp.data;
+};
 
-export const getGitAuthDevice = async (
+export const getExternalAuthDevice = async (
   provider: string,
-): Promise<TypesGen.GitAuthDevice> => {
-  const resp = await axios.get(`/api/v2/gitauth/${provider}/device`)
-  return resp.data
-}
+): Promise<TypesGen.ExternalAuthDevice> => {
+  const resp = await axios.get(`/api/v2/external-auth/${provider}/device`);
+  return resp.data;
+};
 
-export const exchangeGitAuthDevice = async (
+export const exchangeExternalAuthDevice = async (
   provider: string,
-  req: TypesGen.GitAuthDeviceExchange,
+  req: TypesGen.ExternalAuthDeviceExchange,
 ): Promise<void> => {
-  const resp = await axios.post(`/api/v2/gitauth/${provider}/device`, req)
-  return resp.data
-}
+  const resp = await axios.post(
+    `/api/v2/external-auth/${provider}/device`,
+    req,
+  );
+  return resp.data;
+};
 
 export const getAuditLogs = async (
   options: TypesGen.AuditLogsRequest,
 ): Promise<TypesGen.AuditLogResponse> => {
-  const url = getURLWithSearchParams("/api/v2/audit", options)
-  const response = await axios.get(url)
-  return response.data
-}
+  const url = getURLWithSearchParams("/api/v2/audit", options);
+  const response = await axios.get(url);
+  return response.data;
+};
 
 export const getTemplateDAUs = async (
   templateId: string,
 ): Promise<TypesGen.DAUsResponse> => {
-  const response = await axios.get(`/api/v2/templates/${templateId}/daus`)
-  return response.data
-}
+  const response = await axios.get(`/api/v2/templates/${templateId}/daus`);
+  return response.data;
+};
 
 export const getDeploymentDAUs = async (
   // Default to user's local timezone
   offset = new Date().getTimezoneOffset() / 60,
 ): Promise<TypesGen.DAUsResponse> => {
-  const response = await axios.get(`/api/v2/insights/daus?tz_offset=${offset}`)
-  return response.data
-}
+  const response = await axios.get(`/api/v2/insights/daus?tz_offset=${offset}`);
+  return response.data;
+};
 
 export const getTemplateACLAvailable = async (
   templateId: string,
@@ -876,43 +932,43 @@ export const getTemplateACLAvailable = async (
   const url = getURLWithSearchParams(
     `/api/v2/templates/${templateId}/acl/available`,
     options,
-  )
-  const response = await axios.get(url.toString())
-  return response.data
-}
+  );
+  const response = await axios.get(url.toString());
+  return response.data;
+};
 
 export const getTemplateACL = async (
   templateId: string,
 ): Promise<TypesGen.TemplateACL> => {
-  const response = await axios.get(`/api/v2/templates/${templateId}/acl`)
-  return response.data
-}
+  const response = await axios.get(`/api/v2/templates/${templateId}/acl`);
+  return response.data;
+};
 
 export const updateTemplateACL = async (
   templateId: string,
   data: TypesGen.UpdateTemplateACL,
-): Promise<TypesGen.TemplateACL> => {
+): Promise<{ message: string }> => {
   const response = await axios.patch(
     `/api/v2/templates/${templateId}/acl`,
     data,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getApplicationsHost =
   async (): Promise<TypesGen.AppHostResponse> => {
-    const response = await axios.get(`/api/v2/applications/host`)
-    return response.data
-  }
+    const response = await axios.get(`/api/v2/applications/host`);
+    return response.data;
+  };
 
 export const getGroups = async (
   organizationId: string,
 ): Promise<TypesGen.Group[]> => {
   const response = await axios.get(
     `/api/v2/organizations/${organizationId}/groups`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const createGroup = async (
   organizationId: string,
@@ -921,197 +977,223 @@ export const createGroup = async (
   const response = await axios.post(
     `/api/v2/organizations/${organizationId}/groups`,
     data,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getGroup = async (groupId: string): Promise<TypesGen.Group> => {
-  const response = await axios.get(`/api/v2/groups/${groupId}`)
-  return response.data
-}
+  const response = await axios.get(`/api/v2/groups/${groupId}`);
+  return response.data;
+};
 
 export const patchGroup = async (
   groupId: string,
   data: TypesGen.PatchGroupRequest,
 ): Promise<TypesGen.Group> => {
-  const response = await axios.patch(`/api/v2/groups/${groupId}`, data)
-  return response.data
-}
+  const response = await axios.patch(`/api/v2/groups/${groupId}`, data);
+  return response.data;
+};
+
+export const addMember = async (groupId: string, userId: string) => {
+  return patchGroup(groupId, {
+    name: "",
+    display_name: "",
+    add_users: [userId],
+    remove_users: [],
+  });
+};
+
+export const removeMember = async (groupId: string, userId: string) => {
+  return patchGroup(groupId, {
+    name: "",
+    display_name: "",
+    add_users: [],
+    remove_users: [userId],
+  });
+};
 
 export const deleteGroup = async (groupId: string): Promise<void> => {
-  await axios.delete(`/api/v2/groups/${groupId}`)
-}
+  await axios.delete(`/api/v2/groups/${groupId}`);
+};
 
 export const getWorkspaceQuota = async (
-  userID: string,
+  username: string,
 ): Promise<TypesGen.WorkspaceQuota> => {
-  const response = await axios.get(`/api/v2/workspace-quota/${userID}`)
-  return response.data
-}
+  const response = await axios.get(
+    `/api/v2/workspace-quota/${encodeURIComponent(username)}`,
+  );
+  return response.data;
+};
 
 export const getAgentListeningPorts = async (
   agentID: string,
 ): Promise<TypesGen.WorkspaceAgentListeningPortsResponse> => {
   const response = await axios.get(
     `/api/v2/workspaceagents/${agentID}/listening-ports`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 // getDeploymentSSHConfig is used by the VSCode-Extension.
 export const getDeploymentSSHConfig =
   async (): Promise<TypesGen.SSHConfigResponse> => {
-    const response = await axios.get(`/api/v2/deployment/ssh`)
-    return response.data
-  }
+    const response = await axios.get(`/api/v2/deployment/ssh`);
+    return response.data;
+  };
 
-export const getDeploymentValues = async (): Promise<DeploymentConfig> => {
-  const response = await axios.get(`/api/v2/deployment/config`)
-  return response.data
-}
+export type DeploymentConfig = {
+  readonly config: TypesGen.DeploymentValues;
+  readonly options: TypesGen.ClibaseOption[];
+};
+
+export const getDeploymentConfig = async (): Promise<DeploymentConfig> => {
+  const response = await axios.get(`/api/v2/deployment/config`);
+  return response.data;
+};
 
 export const getDeploymentStats =
   async (): Promise<TypesGen.DeploymentStats> => {
-    const response = await axios.get(`/api/v2/deployment/stats`)
-    return response.data
-  }
+    const response = await axios.get(`/api/v2/deployment/stats`);
+    return response.data;
+  };
 
 export const getReplicas = async (): Promise<TypesGen.Replica[]> => {
-  const response = await axios.get(`/api/v2/replicas`)
-  return response.data
-}
+  const response = await axios.get(`/api/v2/replicas`);
+  return response.data;
+};
 
 export const getFile = async (fileId: string): Promise<ArrayBuffer> => {
   const response = await axios.get<ArrayBuffer>(`/api/v2/files/${fileId}`, {
     responseType: "arraybuffer",
-  })
-  return response.data
-}
+  });
+  return response.data;
+};
 
 export const getWorkspaceProxyRegions = async (): Promise<
   TypesGen.RegionsResponse<TypesGen.Region>
 > => {
   const response = await axios.get<TypesGen.RegionsResponse<TypesGen.Region>>(
     `/api/v2/regions`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getWorkspaceProxies = async (): Promise<
   TypesGen.RegionsResponse<TypesGen.WorkspaceProxy>
 > => {
   const response = await axios.get<
     TypesGen.RegionsResponse<TypesGen.WorkspaceProxy>
-  >(`/api/v2/workspaceproxies`)
-  return response.data
-}
+  >(`/api/v2/workspaceproxies`);
+  return response.data;
+};
 
 export const getAppearance = async (): Promise<TypesGen.AppearanceConfig> => {
   try {
-    const response = await axios.get(`/api/v2/appearance`)
-    return response.data || {}
+    const response = await axios.get(`/api/v2/appearance`);
+    return response.data || {};
   } catch (ex) {
     if (axios.isAxiosError(ex) && ex.response?.status === 404) {
       return {
+        application_name: "",
         logo_url: "",
         service_banner: {
           enabled: false,
         },
-      }
+      };
     }
-    throw ex
+    throw ex;
   }
-}
+};
 
 export const updateAppearance = async (
   b: TypesGen.AppearanceConfig,
 ): Promise<TypesGen.AppearanceConfig> => {
-  const response = await axios.put(`/api/v2/appearance`, b)
-  return response.data
-}
+  const response = await axios.put(`/api/v2/appearance`, b);
+  return response.data;
+};
 
 export const getTemplateExamples = async (
   organizationId: string,
 ): Promise<TypesGen.TemplateExample[]> => {
   const response = await axios.get(
     `/api/v2/organizations/${organizationId}/templates/examples`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
-export const uploadTemplateFile = async (
+export const uploadFile = async (
   file: File,
 ): Promise<TypesGen.UploadResponse> => {
   const response = await axios.post("/api/v2/files", file, {
     headers: {
       "Content-Type": "application/x-tar",
     },
-  })
-  return response.data
-}
+  });
+  return response.data;
+};
 
 export const getTemplateVersionLogs = async (
   versionId: string,
 ): Promise<TypesGen.ProvisionerJobLog[]> => {
   const response = await axios.get<TypesGen.ProvisionerJobLog[]>(
     `/api/v2/templateversions/${versionId}/logs`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const updateWorkspaceVersion = async (
   workspace: TypesGen.Workspace,
 ): Promise<TypesGen.WorkspaceBuild> => {
-  const template = await getTemplate(workspace.template_id)
-  return startWorkspace(workspace.id, template.active_version_id)
-}
+  const template = await getTemplate(workspace.template_id);
+  return startWorkspace(workspace.id, template.active_version_id);
+};
 
 export const getWorkspaceBuildParameters = async (
   workspaceBuildId: TypesGen.WorkspaceBuild["id"],
 ): Promise<TypesGen.WorkspaceBuildParameter[]> => {
   const response = await axios.get<TypesGen.WorkspaceBuildParameter[]>(
     `/api/v2/workspacebuilds/${workspaceBuildId}/parameters`,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 type Claims = {
-  license_expires: number
-  account_type?: string
-  account_id?: string
-  trial: boolean
-  all_features: boolean
-  version: number
-  features: Record<string, number>
-  require_telemetry?: boolean
-}
+  license_expires: number;
+  account_type?: string;
+  account_id?: string;
+  trial: boolean;
+  all_features: boolean;
+  version: number;
+  features: Record<string, number>;
+  require_telemetry?: boolean;
+};
 
 export type GetLicensesResponse = Omit<TypesGen.License, "claims"> & {
-  claims: Claims
-  expires_at: string
-}
+  claims: Claims;
+  expires_at: string;
+};
 
 export const getLicenses = async (): Promise<GetLicensesResponse[]> => {
-  const response = await axios.get(`/api/v2/licenses`)
-  return response.data
-}
+  const response = await axios.get(`/api/v2/licenses`);
+  return response.data;
+};
 
 export const createLicense = async (
   data: TypesGen.AddLicenseRequest,
 ): Promise<TypesGen.AddLicenseRequest> => {
-  const response = await axios.post(`/api/v2/licenses`, data)
-  return response.data
-}
+  const response = await axios.post(`/api/v2/licenses`, data);
+  return response.data;
+};
 
 export const removeLicense = async (licenseId: number): Promise<void> => {
-  await axios.delete(`/api/v2/licenses/${licenseId}`)
-}
+  await axios.delete(`/api/v2/licenses/${licenseId}`);
+};
 
 export class MissingBuildParameters extends Error {
-  parameters: TypesGen.TemplateVersionParameter[] = []
+  parameters: TypesGen.TemplateVersionParameter[] = [];
 
   constructor(parameters: TypesGen.TemplateVersionParameter[]) {
-    super("Missing build parameters.")
-    this.parameters = parameters
+    super("Missing build parameters.");
+    this.parameters = parameters;
   }
 }
 
@@ -1131,24 +1213,24 @@ export const changeWorkspaceVersion = async (
   const [currentBuildParameters, templateParameters] = await Promise.all([
     getWorkspaceBuildParameters(workspace.latest_build.id),
     getTemplateVersionRichParameters(templateVersionId),
-  ])
+  ]);
 
   const missingParameters = getMissingParameters(
     currentBuildParameters,
     newBuildParameters,
     templateParameters,
-  )
+  );
 
   if (missingParameters.length > 0) {
-    throw new MissingBuildParameters(missingParameters)
+    throw new MissingBuildParameters(missingParameters);
   }
 
   return postWorkspaceBuild(workspace.id, {
     transition: "start",
     template_version_id: templateVersionId,
     rich_parameter_values: newBuildParameters,
-  })
-}
+  });
+};
 
 /** Steps to update the workspace
  * - Get the latest template to access the latest active version
@@ -1166,70 +1248,100 @@ export const updateWorkspace = async (
   const [template, oldBuildParameters] = await Promise.all([
     getTemplate(workspace.template_id),
     getWorkspaceBuildParameters(workspace.latest_build.id),
-  ])
-  const activeVersionId = template.active_version_id
+  ]);
+  const activeVersionId = template.active_version_id;
   const templateParameters = await getTemplateVersionRichParameters(
     activeVersionId,
-  )
+  );
   const missingParameters = getMissingParameters(
     oldBuildParameters,
     newBuildParameters,
     templateParameters,
-  )
+  );
 
   if (missingParameters.length > 0) {
-    throw new MissingBuildParameters(missingParameters)
+    throw new MissingBuildParameters(missingParameters);
   }
 
   return postWorkspaceBuild(workspace.id, {
     transition: "start",
     template_version_id: activeVersionId,
     rich_parameter_values: newBuildParameters,
-  })
-}
+  });
+};
 
 const getMissingParameters = (
   oldBuildParameters: TypesGen.WorkspaceBuildParameter[],
   newBuildParameters: TypesGen.WorkspaceBuildParameter[],
   templateParameters: TypesGen.TemplateVersionParameter[],
 ) => {
-  const missingParameters: TypesGen.TemplateVersionParameter[] = []
-  const requiredParameters: TypesGen.TemplateVersionParameter[] = []
+  const missingParameters: TypesGen.TemplateVersionParameter[] = [];
+  const requiredParameters: TypesGen.TemplateVersionParameter[] = [];
 
   templateParameters.forEach((p) => {
     // It is mutable and required. Mutable values can be changed after so we
     // don't need to ask them if they are not required.
-    const isMutableAndRequired = p.mutable && p.required
+    const isMutableAndRequired = p.mutable && p.required;
     // Is immutable, so we can check if it is its first time on the build
-    const isImmutable = !p.mutable
+    const isImmutable = !p.mutable;
 
     if (isMutableAndRequired || isImmutable) {
-      requiredParameters.push(p)
-      return
+      requiredParameters.push(p);
     }
-  })
+  });
 
   for (const parameter of requiredParameters) {
     // Check if there is a new value
     let buildParameter = newBuildParameters.find(
       (p) => p.name === parameter.name,
-    )
+    );
 
     // If not, get the old one
     if (!buildParameter) {
-      buildParameter = oldBuildParameters.find((p) => p.name === parameter.name)
+      buildParameter = oldBuildParameters.find(
+        (p) => p.name === parameter.name,
+      );
     }
 
     // If there is a value from the new or old one, it is not missed
     if (buildParameter) {
-      continue
+      continue;
     }
 
-    missingParameters.push(parameter)
+    missingParameters.push(parameter);
   }
 
-  return missingParameters
-}
+  // Check if parameter "options" changed and we can't use old build parameters.
+  templateParameters.forEach((templateParameter) => {
+    if (templateParameter.options.length === 0) {
+      return;
+    }
+
+    // Check if there is a new value
+    let buildParameter = newBuildParameters.find(
+      (p) => p.name === templateParameter.name,
+    );
+
+    // If not, get the old one
+    if (!buildParameter) {
+      buildParameter = oldBuildParameters.find(
+        (p) => p.name === templateParameter.name,
+      );
+    }
+
+    if (!buildParameter) {
+      return;
+    }
+
+    const matchingOption = templateParameter.options.find(
+      (option) => option.value === buildParameter?.value,
+    );
+    if (!matchingOption) {
+      missingParameters.push(templateParameter);
+    }
+  });
+  return missingParameters;
+};
 
 /**
  *
@@ -1241,15 +1353,15 @@ export const watchAgentMetadata = (agentId: string): EventSource => {
   return new EventSource(
     `${location.protocol}//${location.host}/api/v2/workspaceagents/${agentId}/watch-metadata`,
     { withCredentials: true },
-  )
-}
+  );
+};
 
 type WatchBuildLogsByTemplateVersionIdOptions = {
-  after?: number
-  onMessage: (log: TypesGen.ProvisionerJobLog) => void
-  onDone: () => void
-  onError: (error: Error) => void
-}
+  after?: number;
+  onMessage: (log: TypesGen.ProvisionerJobLog) => void;
+  onDone: () => void;
+  onError: (error: Error) => void;
+};
 export const watchBuildLogsByTemplateVersionId = (
   versionId: string,
   {
@@ -1259,37 +1371,37 @@ export const watchBuildLogsByTemplateVersionId = (
     after,
   }: WatchBuildLogsByTemplateVersionIdOptions,
 ) => {
-  const searchParams = new URLSearchParams({ follow: "true" })
+  const searchParams = new URLSearchParams({ follow: "true" });
   if (after !== undefined) {
-    searchParams.append("after", after.toString())
+    searchParams.append("after", after.toString());
   }
-  const proto = location.protocol === "https:" ? "wss:" : "ws:"
+  const proto = location.protocol === "https:" ? "wss:" : "ws:";
   const socket = new WebSocket(
     `${proto}//${
       location.host
     }/api/v2/templateversions/${versionId}/logs?${searchParams.toString()}`,
-  )
-  socket.binaryType = "blob"
+  );
+  socket.binaryType = "blob";
   socket.addEventListener("message", (event) =>
     onMessage(JSON.parse(event.data) as TypesGen.ProvisionerJobLog),
-  )
+  );
   socket.addEventListener("error", () => {
-    onError(new Error("Connection for logs failed."))
-    socket.close()
-  })
+    onError(new Error("Connection for logs failed."));
+    socket.close();
+  });
   socket.addEventListener("close", () => {
     // When the socket closes, logs have finished streaming!
-    onDone()
-  })
-  return socket
-}
+    onDone();
+  });
+  return socket;
+};
 
 type WatchWorkspaceAgentLogsOptions = {
-  after: number
-  onMessage: (logs: TypesGen.WorkspaceAgentLog[]) => void
-  onDone: () => void
-  onError: (error: Error) => void
-}
+  after: number;
+  onMessage: (logs: TypesGen.WorkspaceAgentLog[]) => void;
+  onDone?: () => void;
+  onError: (error: Error) => void;
+};
 
 export const watchWorkspaceAgentLogs = (
   agentId: string,
@@ -1303,61 +1415,61 @@ export const watchWorkspaceAgentLogs = (
   const noCompression =
     userAgentParser(navigator.userAgent).browser.name === "Safari"
       ? "&no_compression"
-      : ""
+      : "";
 
-  const proto = location.protocol === "https:" ? "wss:" : "ws:"
+  const proto = location.protocol === "https:" ? "wss:" : "ws:";
   const socket = new WebSocket(
     `${proto}//${location.host}/api/v2/workspaceagents/${agentId}/logs?follow&after=${after}${noCompression}`,
-  )
-  socket.binaryType = "blob"
+  );
+  socket.binaryType = "blob";
   socket.addEventListener("message", (event) => {
-    const logs = JSON.parse(event.data) as TypesGen.WorkspaceAgentLog[]
-    onMessage(logs)
-  })
+    const logs = JSON.parse(event.data) as TypesGen.WorkspaceAgentLog[];
+    onMessage(logs);
+  });
   socket.addEventListener("error", () => {
-    onError(new Error("socket errored"))
-  })
+    onError(new Error("socket errored"));
+  });
   socket.addEventListener("close", () => {
-    onDone()
-  })
+    onDone && onDone();
+  });
 
-  return socket
-}
+  return socket;
+};
 
 type WatchBuildLogsByBuildIdOptions = {
-  after?: number
-  onMessage: (log: TypesGen.ProvisionerJobLog) => void
-  onDone: () => void
-  onError: (error: Error) => void
-}
+  after?: number;
+  onMessage: (log: TypesGen.ProvisionerJobLog) => void;
+  onDone?: () => void;
+  onError?: (error: Error) => void;
+};
 export const watchBuildLogsByBuildId = (
   buildId: string,
   { onMessage, onDone, onError, after }: WatchBuildLogsByBuildIdOptions,
 ) => {
-  const searchParams = new URLSearchParams({ follow: "true" })
+  const searchParams = new URLSearchParams({ follow: "true" });
   if (after !== undefined) {
-    searchParams.append("after", after.toString())
+    searchParams.append("after", after.toString());
   }
-  const proto = location.protocol === "https:" ? "wss:" : "ws:"
+  const proto = location.protocol === "https:" ? "wss:" : "ws:";
   const socket = new WebSocket(
     `${proto}//${
       location.host
     }/api/v2/workspacebuilds/${buildId}/logs?${searchParams.toString()}`,
-  )
-  socket.binaryType = "blob"
+  );
+  socket.binaryType = "blob";
   socket.addEventListener("message", (event) =>
     onMessage(JSON.parse(event.data) as TypesGen.ProvisionerJobLog),
-  )
+  );
   socket.addEventListener("error", () => {
-    onError(new Error("Connection for logs failed."))
-    socket.close()
-  })
+    onError && onError(new Error("Connection for logs failed."));
+    socket.close();
+  });
   socket.addEventListener("close", () => {
     // When the socket closes, logs have finished streaming!
-    onDone()
-  })
-  return socket
-}
+    onDone && onDone();
+  });
+  return socket;
+};
 
 export const issueReconnectingPTYSignedToken = async (
   params: TypesGen.IssueReconnectingPTYSignedTokenRequest,
@@ -1365,55 +1477,69 @@ export const issueReconnectingPTYSignedToken = async (
   const response = await axios.post(
     "/api/v2/applications/reconnecting-pty-signed-token",
     params,
-  )
-  return response.data
-}
+  );
+  return response.data;
+};
 
 export const getWorkspaceParameters = async (workspace: TypesGen.Workspace) => {
-  const latestBuild = workspace.latest_build
+  const latestBuild = workspace.latest_build;
   const [templateVersionRichParameters, buildParameters] = await Promise.all([
     getTemplateVersionRichParameters(latestBuild.template_version_id),
     getWorkspaceBuildParameters(latestBuild.id),
-  ])
+  ]);
   return {
     templateVersionRichParameters,
     buildParameters,
-  }
-}
+  };
+};
 
-type InsightsFilter = {
-  start_time: string
-  end_time: string
-  template_ids: string
-}
+export type InsightsParams = {
+  start_time: string;
+  end_time: string;
+  template_ids: string;
+};
 
 export const getInsightsUserLatency = async (
-  filters: InsightsFilter,
+  filters: InsightsParams,
 ): Promise<TypesGen.UserLatencyInsightsResponse> => {
-  const params = new URLSearchParams(filters)
-  const response = await axios.get(`/api/v2/insights/user-latency?${params}`)
-  return response.data
-}
+  const params = new URLSearchParams(filters);
+  const response = await axios.get(`/api/v2/insights/user-latency?${params}`);
+  return response.data;
+};
+
+export const getInsightsUserActivity = async (
+  filters: InsightsParams,
+): Promise<TypesGen.UserActivityInsightsResponse> => {
+  const params = new URLSearchParams(filters);
+  const response = await axios.get(`/api/v2/insights/user-activity?${params}`);
+  return response.data;
+};
+
+export type InsightsTemplateParams = InsightsParams & {
+  interval: "day" | "week";
+};
 
 export const getInsightsTemplate = async (
-  filters: InsightsFilter,
+  params: InsightsTemplateParams,
 ): Promise<TypesGen.TemplateInsightsResponse> => {
-  const params = new URLSearchParams({
-    ...filters,
-    interval: "day",
-  })
-  const response = await axios.get(`/api/v2/insights/templates?${params}`)
-  return response.data
-}
-
-export const getHealth = () => {
-  return axios.get<{
-    healthy: boolean
-    time: string
-    coder_version: string
-    derp: { healthy: boolean }
-    access_url: { healthy: boolean }
-    websocket: { healthy: boolean }
-    database: { healthy: boolean }
-  }>("/api/v2/debug/health")
-}
+  const searchParams = new URLSearchParams(params);
+  const response = await axios.get(
+    `/api/v2/insights/templates?${searchParams}`,
+  );
+  return response.data;
+};
+
+export interface Health {
+  healthy: boolean;
+  time: string;
+  coder_version: string;
+  access_url: { healthy: boolean };
+  database: { healthy: boolean };
+  derp: { healthy: boolean };
+  websocket: { healthy: boolean };
+}
+
+export const getHealth = async () => {
+  const response = await axios.get<Health>("/api/v2/debug/health");
+  return response.data;
+};
diff --git a/site/src/api/errors.test.ts b/site/src/api/errors.test.ts
index 5fa94412f7334..f17a1787112fd 100644
--- a/site/src/api/errors.test.ts
+++ b/site/src/api/errors.test.ts
@@ -1,9 +1,10 @@
-import { mockApiError } from "testHelpers/entities"
+import { mockApiError } from "testHelpers/entities";
 import {
   getValidationErrorMessage,
   isApiError,
   mapApiErrorToFieldErrors,
-} from "./errors"
+  getErrorMessage,
+} from "./errors";
 
 describe("isApiError", () => {
   it("returns true when the object is an API Error", () => {
@@ -16,17 +17,17 @@ describe("isApiError", () => {
           ],
         }),
       ),
-    ).toBe(true)
-  })
+    ).toBe(true);
+  });
 
   it("returns false when the object is Error", () => {
-    expect(isApiError(new Error())).toBe(false)
-  })
+    expect(isApiError(new Error())).toBe(false);
+  });
 
   it("returns false when the object is undefined", () => {
-    expect(isApiError(undefined)).toBe(false)
-  })
-})
+    expect(isApiError(undefined)).toBe(false);
+  });
+});
 
 describe("mapApiErrorToFieldErrors", () => {
   it("returns correct field errors", () => {
@@ -39,9 +40,9 @@ describe("mapApiErrorToFieldErrors", () => {
       }),
     ).toEqual({
       username: "Username is already in use",
-    })
-  })
-})
+    });
+  });
+});
 
 describe("getValidationErrorMessage", () => {
   it("returns multiple validation messages", () => {
@@ -63,14 +64,14 @@ describe("getValidationErrorMessage", () => {
       ),
     ).toEqual(
       `Query param "status" has invalid value: "inactive" is not a valid user status\nQuery element "role:a:e" can only contain 1 ':'`,
-    )
-  })
+    );
+  });
 
   it("non-API error returns empty validation message", () => {
     expect(
       getValidationErrorMessage(new Error("Invalid user search query.")),
-    ).toEqual("")
-  })
+    ).toEqual("");
+  });
 
   it("no validations field returns empty validation message", () => {
     expect(
@@ -80,6 +81,23 @@ describe("getValidationErrorMessage", () => {
           detail: `Query element "role:a:e" can only contain 1 ':'`,
         }),
       ),
-    ).toEqual("")
-  })
-})
+    ).toEqual("");
+  });
+
+  it("returns default message for error that is empty string", () => {
+    expect(getErrorMessage("", "Something went wrong.")).toBe(
+      "Something went wrong.",
+    );
+  });
+
+  it("returns default message for 404 API response", () => {
+    expect(
+      getErrorMessage(
+        mockApiError({
+          message: "",
+        }),
+        "Something went wrong.",
+      ),
+    ).toBe("Something went wrong.");
+  });
+});
diff --git a/site/src/api/errors.ts b/site/src/api/errors.ts
index 33e06ae686231..953eefa47b5d5 100644
--- a/site/src/api/errors.ts
+++ b/site/src/api/errors.ts
@@ -1,56 +1,56 @@
-import axios, { AxiosError, AxiosResponse } from "axios"
+import axios, { AxiosError, AxiosResponse } from "axios";
 
 const Language = {
   errorsByCode: {
     defaultErrorCode: "Invalid value",
   },
-}
+};
 
 export interface FieldError {
-  field: string
-  detail: string
+  field: string;
+  detail: string;
 }
 
-export type FieldErrors = Record<FieldError["field"], FieldError["detail"]>
+export type FieldErrors = Record<FieldError["field"], FieldError["detail"]>;
 
 export interface ApiErrorResponse {
-  message: string
-  detail?: string
-  validations?: FieldError[]
+  message: string;
+  detail?: string;
+  validations?: FieldError[];
 }
 
 export type ApiError = AxiosError<ApiErrorResponse> & {
-  response: AxiosResponse<ApiErrorResponse>
-}
+  response: AxiosResponse<ApiErrorResponse>;
+};
 
 export const isApiError = (err: unknown): err is ApiError => {
-  return axios.isAxiosError(err) && err.response !== undefined
-}
+  return axios.isAxiosError(err) && err.response !== undefined;
+};
 
 export const hasApiFieldErrors = (error: ApiError): boolean =>
-  Array.isArray(error.response.data.validations)
+  Array.isArray(error.response.data.validations);
 
 export const isApiValidationError = (error: unknown): error is ApiError => {
-  return isApiError(error) && hasApiFieldErrors(error)
-}
+  return isApiError(error) && hasApiFieldErrors(error);
+};
 
 export const hasError = (error: unknown) =>
-  error !== undefined && error !== null
+  error !== undefined && error !== null;
 
 export const mapApiErrorToFieldErrors = (
   apiErrorResponse: ApiErrorResponse,
 ): FieldErrors => {
-  const result: FieldErrors = {}
+  const result: FieldErrors = {};
 
   if (apiErrorResponse.validations) {
     for (const error of apiErrorResponse.validations) {
       result[error.field] =
-        error.detail || Language.errorsByCode.defaultErrorCode
+        error.detail || Language.errorsByCode.defaultErrorCode;
     }
   }
 
-  return result
-}
+  return result;
+};
 
 /**
  *
@@ -61,12 +61,18 @@ export const mapApiErrorToFieldErrors = (
 export const getErrorMessage = (
   error: unknown,
   defaultMessage: string,
-): string =>
-  isApiError(error)
-    ? error.response.data.message
-    : error instanceof Error
-    ? error.message
-    : defaultMessage
+): string => {
+  // if error is API error
+  // 404s result in the default message being returned
+  if (isApiError(error) && error.response.data.message) {
+    return error.response.data.message;
+  }
+  // if error is a non-empty string
+  if (error && typeof error === "string") {
+    return error;
+  }
+  return defaultMessage;
+};
 
 /**
  *
@@ -78,13 +84,13 @@ export const getValidationErrorMessage = (error: unknown): string => {
   const validationErrors =
     isApiError(error) && error.response.data.validations
       ? error.response.data.validations
-      : []
-  return validationErrors.map((error) => error.detail).join("\n")
-}
+      : [];
+  return validationErrors.map((error) => error.detail).join("\n");
+};
 
 export const getErrorDetail = (error: unknown): string | undefined | null =>
   isApiError(error)
     ? error.response.data.detail
     : error instanceof Error
     ? `Please check the developer console for more details.`
-    : null
+    : null;
diff --git a/site/src/api/queries/appearance.ts b/site/src/api/queries/appearance.ts
new file mode 100644
index 0000000000000..10366b4382d72
--- /dev/null
+++ b/site/src/api/queries/appearance.ts
@@ -0,0 +1,24 @@
+import { QueryClient, type UseQueryOptions } from "react-query";
+import * as API from "api/api";
+import { type AppearanceConfig } from "api/typesGenerated";
+import { getMetadataAsJSON } from "utils/metadata";
+
+const initialAppearanceData = getMetadataAsJSON<AppearanceConfig>("appearance");
+const appearanceConfigKey = ["appearance"] as const;
+
+export const appearance = (): UseQueryOptions<AppearanceConfig> => {
+  return {
+    queryKey: ["appearance"],
+    initialData: initialAppearanceData,
+    queryFn: () => API.getAppearance(),
+  };
+};
+
+export const updateAppearance = (queryClient: QueryClient) => {
+  return {
+    mutationFn: API.updateAppearance,
+    onSuccess: (newConfig: AppearanceConfig) => {
+      queryClient.setQueryData(appearanceConfigKey, newConfig);
+    },
+  };
+};
diff --git a/site/src/api/queries/authCheck.ts b/site/src/api/queries/authCheck.ts
new file mode 100644
index 0000000000000..415c7676ea128
--- /dev/null
+++ b/site/src/api/queries/authCheck.ts
@@ -0,0 +1,14 @@
+import { AuthorizationRequest } from "api/typesGenerated";
+import * as API from "api/api";
+
+export const AUTHORIZATION_KEY = "authorization";
+
+export const getAuthorizationKey = (req: AuthorizationRequest) =>
+  [AUTHORIZATION_KEY, req] as const;
+
+export const checkAuthorization = (req: AuthorizationRequest) => {
+  return {
+    queryKey: getAuthorizationKey(req),
+    queryFn: () => API.checkAuthorization(req),
+  };
+};
diff --git a/site/src/api/queries/buildInfo.ts b/site/src/api/queries/buildInfo.ts
new file mode 100644
index 0000000000000..58e61575ef057
--- /dev/null
+++ b/site/src/api/queries/buildInfo.ts
@@ -0,0 +1,15 @@
+import { type UseQueryOptions } from "react-query";
+import { type BuildInfoResponse } from "api/typesGenerated";
+import * as API from "api/api";
+import { getMetadataAsJSON } from "utils/metadata";
+
+const initialBuildInfoData = getMetadataAsJSON<BuildInfoResponse>("build-info");
+const buildInfoKey = ["buildInfo"] as const;
+
+export const buildInfo = (): UseQueryOptions<BuildInfoResponse> => {
+  return {
+    queryKey: buildInfoKey,
+    initialData: initialBuildInfoData,
+    queryFn: () => API.getBuildInfo(),
+  };
+};
diff --git a/site/src/api/queries/deployment.ts b/site/src/api/queries/deployment.ts
new file mode 100644
index 0000000000000..2ad91c7724ed6
--- /dev/null
+++ b/site/src/api/queries/deployment.ts
@@ -0,0 +1,29 @@
+import * as API from "api/api";
+
+export const deploymentConfig = () => {
+  return {
+    queryKey: ["deployment", "config"],
+    queryFn: API.getDeploymentConfig,
+  };
+};
+
+export const deploymentDAUs = () => {
+  return {
+    queryKey: ["deployment", "daus"],
+    queryFn: () => API.getDeploymentDAUs(),
+  };
+};
+
+export const deploymentStats = () => {
+  return {
+    queryKey: ["deployment", "stats"],
+    queryFn: API.getDeploymentStats,
+  };
+};
+
+export const health = () => {
+  return {
+    queryKey: ["deployment", "health"],
+    queryFn: API.getHealth,
+  };
+};
diff --git a/site/src/api/queries/entitlements.ts b/site/src/api/queries/entitlements.ts
new file mode 100644
index 0000000000000..6cb0bf9c2572e
--- /dev/null
+++ b/site/src/api/queries/entitlements.ts
@@ -0,0 +1,26 @@
+import { QueryClient, UseQueryOptions } from "react-query";
+import * as API from "api/api";
+import { Entitlements } from "api/typesGenerated";
+import { getMetadataAsJSON } from "utils/metadata";
+
+const initialEntitlementsData = getMetadataAsJSON<Entitlements>("entitlements");
+const ENTITLEMENTS_QUERY_KEY = ["entitlements"] as const;
+
+export const entitlements = (): UseQueryOptions<Entitlements> => {
+  return {
+    queryKey: ENTITLEMENTS_QUERY_KEY,
+    queryFn: () => API.getEntitlements(),
+    initialData: initialEntitlementsData,
+  };
+};
+
+export const refreshEntitlements = (queryClient: QueryClient) => {
+  return {
+    mutationFn: API.refreshEntitlements,
+    onSuccess: async () => {
+      await queryClient.invalidateQueries({
+        queryKey: ENTITLEMENTS_QUERY_KEY,
+      });
+    },
+  };
+};
diff --git a/site/src/api/queries/experiments.ts b/site/src/api/queries/experiments.ts
new file mode 100644
index 0000000000000..aa12d5152411b
--- /dev/null
+++ b/site/src/api/queries/experiments.ts
@@ -0,0 +1,22 @@
+import * as API from "api/api";
+import { getMetadataAsJSON } from "utils/metadata";
+import { type Experiments } from "api/typesGenerated";
+import { type UseQueryOptions } from "react-query";
+
+const initialExperimentsData = getMetadataAsJSON<Experiments>("experiments");
+const experimentsKey = ["experiments"] as const;
+
+export const experiments = (): UseQueryOptions<Experiments> => {
+  return {
+    queryKey: experimentsKey,
+    initialData: initialExperimentsData,
+    queryFn: () => API.getExperiments(),
+  } satisfies UseQueryOptions<Experiments>;
+};
+
+export const availableExperiments = () => {
+  return {
+    queryKey: ["availableExperiments"],
+    queryFn: async () => API.getAvailableExperiments(),
+  };
+};
diff --git a/site/src/api/queries/files.ts b/site/src/api/queries/files.ts
new file mode 100644
index 0000000000000..5fd3250d50106
--- /dev/null
+++ b/site/src/api/queries/files.ts
@@ -0,0 +1,7 @@
+import * as API from "api/api";
+
+export const uploadFile = () => {
+  return {
+    mutationFn: API.uploadFile,
+  };
+};
diff --git a/site/src/api/queries/groups.ts b/site/src/api/queries/groups.ts
new file mode 100644
index 0000000000000..3dc6759c12484
--- /dev/null
+++ b/site/src/api/queries/groups.ts
@@ -0,0 +1,138 @@
+import { QueryClient, UseQueryOptions } from "react-query";
+import * as API from "api/api";
+import { checkAuthorization } from "api/api";
+import {
+  CreateGroupRequest,
+  Group,
+  PatchGroupRequest,
+} from "api/typesGenerated";
+
+const GROUPS_QUERY_KEY = ["groups"];
+
+const getGroupQueryKey = (groupId: string) => ["group", groupId];
+
+export const groups = (organizationId: string) => {
+  return {
+    queryKey: GROUPS_QUERY_KEY,
+    queryFn: () => API.getGroups(organizationId),
+  };
+};
+
+export const group = (groupId: string) => {
+  return {
+    queryKey: getGroupQueryKey(groupId),
+    queryFn: () => API.getGroup(groupId),
+  };
+};
+
+export type GroupsByUserId = Readonly<Map<string, readonly Group[]>>;
+
+export function groupsByUserId(organizationId: string) {
+  return {
+    ...groups(organizationId),
+    select: (allGroups) => {
+      // Sorting here means that nothing has to be sorted for the individual
+      // user arrays later
+      const sorted = [...allGroups].sort((g1, g2) => {
+        const key =
+          g1.display_name && g2.display_name ? "display_name" : "name";
+
+        if (g1[key] === g2[key]) {
+          return 0;
+        }
+
+        return g1[key] < g2[key] ? -1 : 1;
+      });
+
+      const userIdMapper = new Map<string, Group[]>();
+      for (const group of sorted) {
+        for (const user of group.members) {
+          let groupsForUser = userIdMapper.get(user.id);
+          if (groupsForUser === undefined) {
+            groupsForUser = [];
+            userIdMapper.set(user.id, groupsForUser);
+          }
+
+          groupsForUser.push(group);
+        }
+      }
+
+      return userIdMapper as GroupsByUserId;
+    },
+  } satisfies UseQueryOptions<Group[], unknown, GroupsByUserId>;
+}
+
+export const groupPermissions = (groupId: string) => {
+  return {
+    queryKey: [...getGroupQueryKey(groupId), "permissions"],
+    queryFn: () =>
+      checkAuthorization({
+        checks: {
+          canUpdateGroup: {
+            object: {
+              resource_type: "group",
+              resource_id: groupId,
+            },
+            action: "update",
+          },
+        },
+      }),
+  };
+};
+
+export const createGroup = (queryClient: QueryClient) => {
+  return {
+    mutationFn: ({
+      organizationId,
+      ...request
+    }: CreateGroupRequest & { organizationId: string }) =>
+      API.createGroup(organizationId, request),
+    onSuccess: async () => {
+      await queryClient.invalidateQueries(GROUPS_QUERY_KEY);
+    },
+  };
+};
+
+export const patchGroup = (queryClient: QueryClient) => {
+  return {
+    mutationFn: ({
+      groupId,
+      ...request
+    }: PatchGroupRequest & { groupId: string }) =>
+      API.patchGroup(groupId, request),
+    onSuccess: async (updatedGroup: Group) =>
+      invalidateGroup(queryClient, updatedGroup.id),
+  };
+};
+
+export const deleteGroup = (queryClient: QueryClient) => {
+  return {
+    mutationFn: API.deleteGroup,
+    onSuccess: async (_: void, groupId: string) =>
+      invalidateGroup(queryClient, groupId),
+  };
+};
+
+export const addMember = (queryClient: QueryClient) => {
+  return {
+    mutationFn: ({ groupId, userId }: { groupId: string; userId: string }) =>
+      API.addMember(groupId, userId),
+    onSuccess: async (updatedGroup: Group) =>
+      invalidateGroup(queryClient, updatedGroup.id),
+  };
+};
+
+export const removeMember = (queryClient: QueryClient) => {
+  return {
+    mutationFn: ({ groupId, userId }: { groupId: string; userId: string }) =>
+      API.removeMember(groupId, userId),
+    onSuccess: async (updatedGroup: Group) =>
+      invalidateGroup(queryClient, updatedGroup.id),
+  };
+};
+
+export const invalidateGroup = (queryClient: QueryClient, groupId: string) =>
+  Promise.all([
+    queryClient.invalidateQueries(GROUPS_QUERY_KEY),
+    queryClient.invalidateQueries(getGroupQueryKey(groupId)),
+  ]);
diff --git a/site/src/api/queries/insights.ts b/site/src/api/queries/insights.ts
new file mode 100644
index 0000000000000..7d60565e83bb0
--- /dev/null
+++ b/site/src/api/queries/insights.ts
@@ -0,0 +1,22 @@
+import * as API from "api/api";
+
+export const insightsTemplate = (params: API.InsightsTemplateParams) => {
+  return {
+    queryKey: ["insights", "templates", params.template_ids, params],
+    queryFn: () => API.getInsightsTemplate(params),
+  };
+};
+
+export const insightsUserLatency = (params: API.InsightsParams) => {
+  return {
+    queryKey: ["insights", "userLatency", params.template_ids, params],
+    queryFn: () => API.getInsightsUserLatency(params),
+  };
+};
+
+export const insightsUserActivity = (params: API.InsightsParams) => {
+  return {
+    queryKey: ["insights", "userActivity", params.template_ids, params],
+    queryFn: () => API.getInsightsUserActivity(params),
+  };
+};
diff --git a/site/src/api/queries/roles.ts b/site/src/api/queries/roles.ts
new file mode 100644
index 0000000000000..37b2af49f3e74
--- /dev/null
+++ b/site/src/api/queries/roles.ts
@@ -0,0 +1,8 @@
+import * as API from "api/api";
+
+export const roles = () => {
+  return {
+    queryKey: ["roles"],
+    queryFn: API.getRoles,
+  };
+};
diff --git a/site/src/api/queries/settings.ts b/site/src/api/queries/settings.ts
new file mode 100644
index 0000000000000..c8f9aac16e136
--- /dev/null
+++ b/site/src/api/queries/settings.ts
@@ -0,0 +1,34 @@
+import * as API from "api/api";
+import {
+  type UserQuietHoursScheduleResponse,
+  type UpdateUserQuietHoursScheduleRequest,
+} from "api/typesGenerated";
+import { type QueryClient, type QueryOptions } from "react-query";
+
+export const userQuietHoursScheduleKey = (userId: string) => [
+  "settings",
+  userId,
+  "quietHours",
+];
+
+export const userQuietHoursSchedule = (
+  userId: string,
+): QueryOptions<UserQuietHoursScheduleResponse> => {
+  return {
+    queryKey: userQuietHoursScheduleKey(userId),
+    queryFn: () => API.getUserQuietHoursSchedule(userId),
+  };
+};
+
+export const updateUserQuietHoursSchedule = (
+  userId: string,
+  queryClient: QueryClient,
+) => {
+  return {
+    mutationFn: (request: UpdateUserQuietHoursScheduleRequest) =>
+      API.updateUserQuietHoursSchedule(userId, request),
+    onSuccess: async () => {
+      await queryClient.invalidateQueries(userQuietHoursScheduleKey(userId));
+    },
+  };
+};
diff --git a/site/src/api/queries/sshKeys.ts b/site/src/api/queries/sshKeys.ts
new file mode 100644
index 0000000000000..07f9963b40c8b
--- /dev/null
+++ b/site/src/api/queries/sshKeys.ts
@@ -0,0 +1,24 @@
+import { QueryClient } from "react-query";
+import * as API from "api/api";
+import { GitSSHKey } from "api/typesGenerated";
+
+const getUserSSHKeyQueryKey = (userId: string) => [userId, "sshKey"];
+
+export const userSSHKey = (userId: string) => {
+  return {
+    queryKey: getUserSSHKeyQueryKey(userId),
+    queryFn: () => API.getUserSSHKey(userId),
+  };
+};
+
+export const regenerateUserSSHKey = (
+  userId: string,
+  queryClient: QueryClient,
+) => {
+  return {
+    mutationFn: () => API.regenerateUserSSHKey(userId),
+    onSuccess: (newKey: GitSSHKey) => {
+      queryClient.setQueryData(getUserSSHKeyQueryKey(userId), newKey);
+    },
+  };
+};
diff --git a/site/src/api/queries/templates.ts b/site/src/api/queries/templates.ts
new file mode 100644
index 0000000000000..337925a6583a4
--- /dev/null
+++ b/site/src/api/queries/templates.ts
@@ -0,0 +1,245 @@
+import * as API from "api/api";
+import {
+  type Template,
+  type CreateTemplateVersionRequest,
+  type ProvisionerJobStatus,
+  type TemplateVersion,
+  CreateTemplateRequest,
+  ProvisionerJob,
+  UsersRequest,
+  TemplateRole,
+} from "api/typesGenerated";
+import {
+  MutationOptions,
+  type QueryClient,
+  type QueryOptions,
+} from "react-query";
+import { delay } from "utils/delay";
+
+export const templateByNameKey = (orgId: string, name: string) => [
+  orgId,
+  "template",
+  name,
+  "settings",
+];
+
+export const templateByName = (
+  orgId: string,
+  name: string,
+): QueryOptions<Template> => {
+  return {
+    queryKey: templateByNameKey(orgId, name),
+    queryFn: async () => API.getTemplateByName(orgId, name),
+  };
+};
+
+const getTemplatesQueryKey = (orgId: string) => [orgId, "templates"];
+
+export const templates = (orgId: string) => {
+  return {
+    queryKey: getTemplatesQueryKey(orgId),
+    queryFn: () => API.getTemplates(orgId),
+  };
+};
+
+export const templateACL = (templateId: string) => {
+  return {
+    queryKey: ["templateAcl", templateId],
+    queryFn: () => API.getTemplateACL(templateId),
+  };
+};
+
+export const setUserRole = (
+  queryClient: QueryClient,
+): MutationOptions<
+  Awaited<ReturnType<typeof API.updateTemplateACL>>,
+  unknown,
+  { templateId: string; userId: string; role: TemplateRole }
+> => {
+  return {
+    mutationFn: ({ templateId, userId, role }) =>
+      API.updateTemplateACL(templateId, {
+        user_perms: {
+          [userId]: role,
+        },
+      }),
+    onSuccess: async (_res, { templateId }) => {
+      await queryClient.invalidateQueries(["templateAcl", templateId]);
+    },
+  };
+};
+
+export const setGroupRole = (
+  queryClient: QueryClient,
+): MutationOptions<
+  Awaited<ReturnType<typeof API.updateTemplateACL>>,
+  unknown,
+  { templateId: string; groupId: string; role: TemplateRole }
+> => {
+  return {
+    mutationFn: ({ templateId, groupId, role }) =>
+      API.updateTemplateACL(templateId, {
+        group_perms: {
+          [groupId]: role,
+        },
+      }),
+    onSuccess: async (_res, { templateId }) => {
+      await queryClient.invalidateQueries(["templateAcl", templateId]);
+    },
+  };
+};
+
+export const templateExamples = (orgId: string) => {
+  return {
+    queryKey: [...getTemplatesQueryKey(orgId), "examples"],
+    queryFn: () => API.getTemplateExamples(orgId),
+  };
+};
+
+export const templateVersion = (versionId: string) => {
+  return {
+    queryKey: ["templateVersion", versionId],
+    queryFn: () => API.getTemplateVersion(versionId),
+  };
+};
+
+export const templateVersionByName = (
+  orgId: string,
+  templateName: string,
+  versionName: string,
+) => {
+  return {
+    queryKey: ["templateVersion", orgId, templateName, versionName],
+    queryFn: () =>
+      API.getTemplateVersionByName(orgId, templateName, versionName),
+  };
+};
+
+export const templateVersions = (templateId: string) => {
+  return {
+    queryKey: ["templateVersions", templateId],
+    queryFn: () => API.getTemplateVersions(templateId),
+  };
+};
+
+export const templateVersionVariables = (versionId: string) => {
+  return {
+    queryKey: ["templateVersion", versionId, "variables"],
+    queryFn: () => API.getTemplateVersionVariables(versionId),
+  };
+};
+
+export const createAndBuildTemplateVersion = (orgId: string) => {
+  return {
+    mutationFn: async (request: CreateTemplateVersionRequest) => {
+      const newVersion = await API.createTemplateVersion(orgId, request);
+      await waitBuildToBeFinished(newVersion);
+      return newVersion;
+    },
+  };
+};
+
+export const updateActiveTemplateVersion = (
+  template: Template,
+  queryClient: QueryClient,
+) => {
+  return {
+    mutationFn: (versionId: string) =>
+      API.updateActiveTemplateVersion(template.id, {
+        id: versionId,
+      }),
+    onSuccess: async () => {
+      // invalidated because of `active_version_id`
+      await queryClient.invalidateQueries(
+        templateByNameKey(template.organization_id, template.name),
+      );
+    },
+  };
+};
+
+export const templaceACLAvailable = (
+  templateId: string,
+  options: UsersRequest,
+) => {
+  return {
+    queryKey: ["template", templateId, "aclAvailable", options],
+    queryFn: () => API.getTemplateACLAvailable(templateId, options),
+  };
+};
+
+export const templateVersionExternalAuthKey = (versionId: string) => [
+  "templateVersion",
+  versionId,
+  "externalAuth",
+];
+
+export const templateVersionExternalAuth = (versionId: string) => {
+  return {
+    queryKey: templateVersionExternalAuthKey(versionId),
+    queryFn: () => API.getTemplateVersionExternalAuth(versionId),
+  };
+};
+
+export const createTemplate = () => {
+  return {
+    mutationFn: createTemplateFn,
+  };
+};
+
+const createTemplateFn = async (options: {
+  organizationId: string;
+  version: CreateTemplateVersionRequest;
+  template: Omit<CreateTemplateRequest, "template_version_id">;
+}) => {
+  const version = await API.createTemplateVersion(
+    options.organizationId,
+    options.version,
+  );
+  await waitBuildToBeFinished(version);
+  return API.createTemplate(options.organizationId, {
+    ...options.template,
+    template_version_id: version.id,
+  });
+};
+
+export const templateVersionLogs = (versionId: string) => {
+  return {
+    queryKey: ["templateVersion", versionId, "logs"],
+    queryFn: () => API.getTemplateVersionLogs(versionId),
+  };
+};
+
+export const richParameters = (versionId: string) => {
+  return {
+    queryKey: ["templateVersion", versionId, "richParameters"],
+    queryFn: () => API.getTemplateVersionRichParameters(versionId),
+  };
+};
+
+const waitBuildToBeFinished = async (version: TemplateVersion) => {
+  let data: TemplateVersion;
+  let jobStatus: ProvisionerJobStatus;
+  do {
+    await delay(1000);
+    data = await API.getTemplateVersion(version.id);
+    jobStatus = data.job.status;
+
+    if (jobStatus === "succeeded") {
+      return version.id;
+    }
+  } while (jobStatus === "pending" || jobStatus === "running");
+
+  // No longer pending/running, but didn't succeed
+  throw new JobError(data.job, version);
+};
+
+export class JobError extends Error {
+  public job: ProvisionerJob;
+  public version: TemplateVersion;
+
+  constructor(job: ProvisionerJob, version: TemplateVersion) {
+    super(job.error);
+    this.job = job;
+    this.version = version;
+  }
+}
diff --git a/site/src/api/queries/updateCheck.ts b/site/src/api/queries/updateCheck.ts
new file mode 100644
index 0000000000000..40fcc6a3cfdde
--- /dev/null
+++ b/site/src/api/queries/updateCheck.ts
@@ -0,0 +1,8 @@
+import * as API from "api/api";
+
+export const updateCheck = () => {
+  return {
+    queryKey: ["updateCheck"],
+    queryFn: () => API.getUpdateCheck(),
+  };
+};
diff --git a/site/src/api/queries/users.ts b/site/src/api/queries/users.ts
new file mode 100644
index 0000000000000..2b6900df13ac8
--- /dev/null
+++ b/site/src/api/queries/users.ts
@@ -0,0 +1,167 @@
+import { QueryClient, type UseQueryOptions } from "react-query";
+import * as API from "api/api";
+import {
+  AuthorizationRequest,
+  GetUsersResponse,
+  UpdateUserPasswordRequest,
+  UpdateUserProfileRequest,
+  UsersRequest,
+  User,
+} from "api/typesGenerated";
+import { getAuthorizationKey } from "./authCheck";
+import { getMetadataAsJSON } from "utils/metadata";
+
+export const users = (req: UsersRequest): UseQueryOptions<GetUsersResponse> => {
+  return {
+    queryKey: ["users", req],
+    queryFn: ({ signal }) => API.getUsers(req, signal),
+  };
+};
+
+export const updatePassword = () => {
+  return {
+    mutationFn: ({
+      userId,
+      ...request
+    }: UpdateUserPasswordRequest & { userId: string }) =>
+      API.updateUserPassword(userId, request),
+  };
+};
+
+export const createUser = (queryClient: QueryClient) => {
+  return {
+    mutationFn: API.createUser,
+    onSuccess: async () => {
+      await queryClient.invalidateQueries(["users"]);
+    },
+  };
+};
+
+export const createFirstUser = () => {
+  return {
+    mutationFn: API.createFirstUser,
+  };
+};
+
+export const suspendUser = (queryClient: QueryClient) => {
+  return {
+    mutationFn: API.suspendUser,
+    onSuccess: async () => {
+      await queryClient.invalidateQueries(["users"]);
+    },
+  };
+};
+
+export const activateUser = (queryClient: QueryClient) => {
+  return {
+    mutationFn: API.activateUser,
+    onSuccess: async () => {
+      await queryClient.invalidateQueries(["users"]);
+    },
+  };
+};
+
+export const deleteUser = (queryClient: QueryClient) => {
+  return {
+    mutationFn: API.deleteUser,
+    onSuccess: async () => {
+      await queryClient.invalidateQueries(["users"]);
+    },
+  };
+};
+
+export const updateRoles = (queryClient: QueryClient) => {
+  return {
+    mutationFn: ({ userId, roles }: { userId: string; roles: string[] }) =>
+      API.updateUserRoles(roles, userId),
+    onSuccess: async () => {
+      await queryClient.invalidateQueries(["users"]);
+    },
+  };
+};
+
+export const authMethods = () => {
+  return {
+    // Even the endpoint being /users/authmethods we don't want to revalidate it
+    // when users change so its better add a unique query key
+    queryKey: ["authMethods"],
+    queryFn: API.getAuthMethods,
+  };
+};
+
+const initialUserData = getMetadataAsJSON<User>("user");
+
+export const me = (): UseQueryOptions<User> & {
+  queryKey: NonNullable<UseQueryOptions<User>["queryKey"]>;
+} => {
+  return {
+    queryKey: ["me"],
+    initialData: initialUserData,
+    queryFn: API.getAuthenticatedUser,
+  };
+};
+
+export const hasFirstUser = () => {
+  return {
+    queryKey: ["hasFirstUser"],
+    queryFn: API.hasFirstUser,
+  };
+};
+
+export const login = (
+  authorization: AuthorizationRequest,
+  queryClient: QueryClient,
+) => {
+  return {
+    mutationFn: async (credentials: { email: string; password: string }) =>
+      loginFn({ ...credentials, authorization }),
+    onSuccess: async (data: Awaited<ReturnType<typeof loginFn>>) => {
+      queryClient.setQueryData(["me"], data.user);
+      queryClient.setQueryData(
+        getAuthorizationKey(authorization),
+        data.permissions,
+      );
+    },
+  };
+};
+
+const loginFn = async ({
+  email,
+  password,
+  authorization,
+}: {
+  email: string;
+  password: string;
+  authorization: AuthorizationRequest;
+}) => {
+  await API.login(email, password);
+  const [user, permissions] = await Promise.all([
+    API.getAuthenticatedUser(),
+    API.checkAuthorization(authorization),
+  ]);
+  return {
+    user,
+    permissions,
+  };
+};
+
+export const logout = (queryClient: QueryClient) => {
+  return {
+    mutationFn: API.logout,
+    onSuccess: () => {
+      queryClient.removeQueries();
+    },
+  };
+};
+
+export const updateProfile = () => {
+  return {
+    mutationFn: ({
+      userId,
+      req,
+    }: {
+      userId: string;
+      req: UpdateUserProfileRequest;
+    }) => API.updateProfile(userId, req),
+  };
+};
diff --git a/site/src/api/queries/workspaceBuilds.ts b/site/src/api/queries/workspaceBuilds.ts
new file mode 100644
index 0000000000000..98049a89e7ffe
--- /dev/null
+++ b/site/src/api/queries/workspaceBuilds.ts
@@ -0,0 +1,38 @@
+import { UseInfiniteQueryOptions } from "react-query";
+import * as API from "api/api";
+import { WorkspaceBuild, WorkspaceBuildsRequest } from "api/typesGenerated";
+
+export const workspaceBuildByNumber = (
+  username: string,
+  workspaceName: string,
+  buildNumber: number,
+) => {
+  return {
+    queryKey: ["workspaceBuild", username, workspaceName, buildNumber],
+    queryFn: () =>
+      API.getWorkspaceBuildByNumber(username, workspaceName, buildNumber),
+  };
+};
+
+export const infiniteWorkspaceBuilds = (
+  workspaceId: string,
+  req?: WorkspaceBuildsRequest,
+): UseInfiniteQueryOptions<WorkspaceBuild[]> => {
+  const limit = req?.limit ?? 25;
+
+  return {
+    queryKey: ["workspaceBuilds", workspaceId, req],
+    getNextPageParam: (lastPage, pages) => {
+      if (lastPage.length < limit) {
+        return undefined;
+      }
+      return pages.length + 1;
+    },
+    queryFn: ({ pageParam = 0 }) => {
+      return API.getWorkspaceBuilds(workspaceId, {
+        limit,
+        offset: pageParam <= 0 ? 0 : (pageParam - 1) * limit,
+      });
+    },
+  };
+};
diff --git a/site/src/api/queries/workspaceQuota.ts b/site/src/api/queries/workspaceQuota.ts
new file mode 100644
index 0000000000000..72aaf5c716af3
--- /dev/null
+++ b/site/src/api/queries/workspaceQuota.ts
@@ -0,0 +1,13 @@
+import * as API from "api/api";
+
+const getWorkspaceQuotaQueryKey = (username: string) => [
+  username,
+  "workspaceQuota",
+];
+
+export const workspaceQuota = (username: string) => {
+  return {
+    queryKey: getWorkspaceQuotaQueryKey(username),
+    queryFn: () => API.getWorkspaceQuota(username),
+  };
+};
diff --git a/site/src/api/queries/workspaces.ts b/site/src/api/queries/workspaces.ts
new file mode 100644
index 0000000000000..bd5b76f951838
--- /dev/null
+++ b/site/src/api/queries/workspaces.ts
@@ -0,0 +1,101 @@
+import * as API from "api/api";
+import { QueryClient, type QueryOptions } from "react-query";
+
+import {
+  type WorkspaceBuildParameter,
+  type Workspace,
+  type CreateWorkspaceRequest,
+  type WorkspacesResponse,
+  type WorkspacesRequest,
+} from "api/typesGenerated";
+
+export const workspaceByOwnerAndNameKey = (owner: string, name: string) => [
+  "workspace",
+  owner,
+  name,
+  "settings",
+];
+
+export const workspaceByOwnerAndName = (
+  owner: string,
+  name: string,
+): QueryOptions<Workspace> => {
+  return {
+    queryKey: workspaceByOwnerAndNameKey(owner, name),
+    queryFn: () => API.getWorkspaceByOwnerAndName(owner, name),
+  };
+};
+
+type AutoCreateWorkspaceOptions = {
+  templateName: string;
+  versionId?: string;
+  organizationId: string;
+  defaultBuildParameters?: WorkspaceBuildParameter[];
+  defaultName: string;
+};
+
+type CreateWorkspaceMutationVariables = CreateWorkspaceRequest & {
+  userId: string;
+  organizationId: string;
+};
+
+export const createWorkspace = (queryClient: QueryClient) => {
+  return {
+    mutationFn: async (variables: CreateWorkspaceMutationVariables) => {
+      const { userId, organizationId, ...req } = variables;
+      return API.createWorkspace(organizationId, userId, req);
+    },
+    onSuccess: async () => {
+      await queryClient.invalidateQueries(["workspaces"]);
+    },
+  };
+};
+
+export const autoCreateWorkspace = (queryClient: QueryClient) => {
+  return {
+    mutationFn: async ({
+      templateName,
+      versionId,
+      organizationId,
+      defaultBuildParameters,
+      defaultName,
+    }: AutoCreateWorkspaceOptions) => {
+      let templateVersionParameters;
+
+      if (versionId) {
+        templateVersionParameters = { template_version_id: versionId };
+      } else {
+        const template = await API.getTemplateByName(
+          organizationId,
+          templateName,
+        );
+        templateVersionParameters = { template_id: template.id };
+      }
+
+      return API.createWorkspace(organizationId, "me", {
+        ...templateVersionParameters,
+        name: defaultName,
+        rich_parameter_values: defaultBuildParameters,
+      });
+    },
+    onSuccess: async () => {
+      await queryClient.invalidateQueries(["workspaces"]);
+    },
+  };
+};
+
+export function workspacesKey(config: WorkspacesRequest = {}) {
+  const { q, limit } = config;
+  return ["workspaces", { q, limit }] as const;
+}
+
+export function workspaces(config: WorkspacesRequest = {}) {
+  // Duplicates some of the work from workspacesKey, but that felt better than
+  // letting invisible properties sneak into the query logic
+  const { q, limit } = config;
+
+  return {
+    queryKey: workspacesKey(config),
+    queryFn: () => API.getWorkspaces({ q, limit }),
+  } as const satisfies QueryOptions<WorkspacesResponse>;
+}
diff --git a/site/src/api/types.ts b/site/src/api/types.ts
deleted file mode 100644
index d0c31fe6f82bd..0000000000000
--- a/site/src/api/types.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import { DeploymentValues } from "./typesGenerated"
-
-export interface UserAgent {
-  readonly browser: string
-  readonly device: string
-  readonly ip_address: string
-  readonly os: string
-}
-
-export interface ReconnectingPTYRequest {
-  readonly data?: string
-  readonly height?: number
-  readonly width?: number
-}
-
-export type WorkspaceBuildTransition = "start" | "stop" | "delete"
-
-export type Message = { message: string }
-
-export interface DeploymentGroup {
-  readonly name: string
-  readonly parent?: DeploymentGroup
-  readonly description: string
-  readonly children: DeploymentGroup[]
-}
-
-export interface DeploymentOption {
-  readonly name: string
-  readonly description: string
-  readonly flag: string
-  readonly flag_shorthand: string
-  readonly value: unknown
-  readonly hidden: boolean
-  readonly group?: DeploymentGroup
-}
-
-export type DeploymentConfig = {
-  readonly config: DeploymentValues
-  readonly options: DeploymentOption[]
-}
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index fdfa3542dbf6a..975e2b8897197 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -4,1541 +4,1630 @@
 
 // From codersdk/templates.go
 export interface ACLAvailable {
-  readonly users: User[]
-  readonly groups: Group[]
+  readonly users: User[];
+  readonly groups: Group[];
 }
 
 // From codersdk/apikey.go
 export interface APIKey {
-  readonly id: string
-  readonly user_id: string
-  readonly last_used: string
-  readonly expires_at: string
-  readonly created_at: string
-  readonly updated_at: string
-  readonly login_type: LoginType
-  readonly scope: APIKeyScope
-  readonly token_name: string
-  readonly lifetime_seconds: number
+  readonly id: string;
+  readonly user_id: string;
+  readonly last_used: string;
+  readonly expires_at: string;
+  readonly created_at: string;
+  readonly updated_at: string;
+  readonly login_type: LoginType;
+  readonly scope: APIKeyScope;
+  readonly token_name: string;
+  readonly lifetime_seconds: number;
 }
 
 // From codersdk/apikey.go
 export interface APIKeyWithOwner extends APIKey {
-  readonly username: string
+  readonly username: string;
 }
 
 // From codersdk/licenses.go
 export interface AddLicenseRequest {
-  readonly license: string
+  readonly license: string;
 }
 
 // From codersdk/templates.go
 export interface AgentStatsReportResponse {
-  readonly num_comms: number
-  readonly rx_bytes: number
-  readonly tx_bytes: number
+  readonly num_comms: number;
+  readonly rx_bytes: number;
+  readonly tx_bytes: number;
 }
 
 // From codersdk/deployment.go
 export interface AppHostResponse {
-  readonly host: string
+  readonly host: string;
 }
 
 // From codersdk/deployment.go
 export interface AppearanceConfig {
-  readonly logo_url: string
-  readonly service_banner: ServiceBannerConfig
-  readonly support_links?: LinkConfig[]
+  readonly application_name: string;
+  readonly logo_url: string;
+  readonly service_banner: ServiceBannerConfig;
+  readonly support_links?: LinkConfig[];
+}
+
+// From codersdk/templates.go
+export interface ArchiveTemplateVersionsRequest {
+  readonly all: boolean;
+}
+
+// From codersdk/templates.go
+export interface ArchiveTemplateVersionsResponse {
+  readonly template_id: string;
+  readonly archived_ids: string[];
 }
 
 // From codersdk/roles.go
 export interface AssignableRoles extends Role {
-  readonly assignable: boolean
+  readonly assignable: boolean;
 }
 
 // From codersdk/audit.go
-export type AuditDiff = Record<string, AuditDiffField>
+export type AuditDiff = Record<string, AuditDiffField>;
 
 // From codersdk/audit.go
 export interface AuditDiffField {
   // Empty interface{} type, cannot resolve the type.
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- interface{}
-  readonly old?: any
+  readonly old?: any;
   // Empty interface{} type, cannot resolve the type.
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- interface{}
-  readonly new?: any
-  readonly secret: boolean
+  readonly new?: any;
+  readonly secret: boolean;
 }
 
 // From codersdk/audit.go
 export interface AuditLog {
-  readonly id: string
-  readonly request_id: string
-  readonly time: string
-  readonly organization_id: string
+  readonly id: string;
+  readonly request_id: string;
+  readonly time: string;
+  readonly organization_id: string;
   // Named type "net/netip.Addr" unknown, using "any"
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly ip: any
-  readonly user_agent: string
-  readonly resource_type: ResourceType
-  readonly resource_id: string
-  readonly resource_target: string
-  readonly resource_icon: string
-  readonly action: AuditAction
-  readonly diff: AuditDiff
-  readonly status_code: number
-  readonly additional_fields: Record<string, string>
-  readonly description: string
-  readonly resource_link: string
-  readonly is_deleted: boolean
-  readonly user?: User
+  readonly ip: any;
+  readonly user_agent: string;
+  readonly resource_type: ResourceType;
+  readonly resource_id: string;
+  readonly resource_target: string;
+  readonly resource_icon: string;
+  readonly action: AuditAction;
+  readonly diff: AuditDiff;
+  readonly status_code: number;
+  readonly additional_fields: Record<string, string>;
+  readonly description: string;
+  readonly resource_link: string;
+  readonly is_deleted: boolean;
+  readonly user?: User;
 }
 
 // From codersdk/audit.go
 export interface AuditLogResponse {
-  readonly audit_logs: AuditLog[]
-  readonly count: number
+  readonly audit_logs: AuditLog[];
+  readonly count: number;
 }
 
 // From codersdk/audit.go
 export interface AuditLogsRequest extends Pagination {
-  readonly q?: string
+  readonly q?: string;
 }
 
 // From codersdk/users.go
 export interface AuthMethod {
-  readonly enabled: boolean
+  readonly enabled: boolean;
 }
 
 // From codersdk/users.go
 export interface AuthMethods {
-  readonly password: AuthMethod
-  readonly github: AuthMethod
-  readonly oidc: OIDCAuthMethod
+  readonly password: AuthMethod;
+  readonly github: AuthMethod;
+  readonly oidc: OIDCAuthMethod;
 }
 
 // From codersdk/authorization.go
 export interface AuthorizationCheck {
-  readonly object: AuthorizationObject
-  readonly action: string
+  readonly object: AuthorizationObject;
+  readonly action: string;
 }
 
 // From codersdk/authorization.go
 export interface AuthorizationObject {
-  readonly resource_type: RBACResource
-  readonly owner_id?: string
-  readonly organization_id?: string
-  readonly resource_id?: string
+  readonly resource_type: RBACResource;
+  readonly owner_id?: string;
+  readonly organization_id?: string;
+  readonly resource_id?: string;
 }
 
 // From codersdk/authorization.go
 export interface AuthorizationRequest {
-  readonly checks: Record<string, AuthorizationCheck>
+  readonly checks: Record<string, AuthorizationCheck>;
 }
 
 // From codersdk/authorization.go
-export type AuthorizationResponse = Record<string, boolean>
+export type AuthorizationResponse = Record<string, boolean>;
+
+// From codersdk/deployment.go
+export interface AvailableExperiments {
+  readonly safe: Experiment[];
+}
 
 // From codersdk/deployment.go
 export interface BuildInfoResponse {
-  readonly external_url: string
-  readonly version: string
-  readonly dashboard_url: string
-  readonly workspace_proxy: boolean
+  readonly external_url: string;
+  readonly version: string;
+  readonly dashboard_url: string;
+  readonly workspace_proxy: boolean;
 }
 
 // From codersdk/insights.go
 export interface ConnectionLatency {
-  readonly p50: number
-  readonly p95: number
+  readonly p50: number;
+  readonly p95: number;
 }
 
 // From codersdk/users.go
 export interface ConvertLoginRequest {
-  readonly to_type: LoginType
-  readonly password: string
+  readonly to_type: LoginType;
+  readonly password: string;
 }
 
 // From codersdk/users.go
 export interface CreateFirstUserRequest {
-  readonly email: string
-  readonly username: string
-  readonly password: string
-  readonly trial: boolean
+  readonly email: string;
+  readonly username: string;
+  readonly password: string;
+  readonly trial: boolean;
 }
 
 // From codersdk/users.go
 export interface CreateFirstUserResponse {
-  readonly user_id: string
-  readonly organization_id: string
+  readonly user_id: string;
+  readonly organization_id: string;
 }
 
 // From codersdk/groups.go
 export interface CreateGroupRequest {
-  readonly name: string
-  readonly display_name: string
-  readonly avatar_url: string
-  readonly quota_allowance: number
+  readonly name: string;
+  readonly display_name: string;
+  readonly avatar_url: string;
+  readonly quota_allowance: number;
 }
 
 // From codersdk/users.go
 export interface CreateOrganizationRequest {
-  readonly name: string
+  readonly name: string;
 }
 
 // From codersdk/organizations.go
 export interface CreateTemplateRequest {
-  readonly name: string
-  readonly display_name?: string
-  readonly description?: string
-  readonly icon?: string
-  readonly template_version_id: string
-  readonly default_ttl_ms?: number
-  readonly max_ttl_ms?: number
-  readonly restart_requirement?: TemplateRestartRequirement
-  readonly allow_user_cancel_workspace_jobs?: boolean
-  readonly allow_user_autostart?: boolean
-  readonly allow_user_autostop?: boolean
-  readonly failure_ttl_ms?: number
-  readonly inactivity_ttl_ms?: number
-  readonly locked_ttl_ms?: number
-  readonly disable_everyone_group_access: boolean
+  readonly name: string;
+  readonly display_name?: string;
+  readonly description?: string;
+  readonly icon?: string;
+  readonly template_version_id: string;
+  readonly default_ttl_ms?: number;
+  readonly max_ttl_ms?: number;
+  readonly autostop_requirement?: TemplateAutostopRequirement;
+  readonly autostart_requirement?: TemplateAutostartRequirement;
+  readonly allow_user_cancel_workspace_jobs?: boolean;
+  readonly allow_user_autostart?: boolean;
+  readonly allow_user_autostop?: boolean;
+  readonly failure_ttl_ms?: number;
+  readonly dormant_ttl_ms?: number;
+  readonly delete_ttl_ms?: number;
+  readonly disable_everyone_group_access: boolean;
+  readonly require_active_version: boolean;
 }
 
 // From codersdk/templateversions.go
 export interface CreateTemplateVersionDryRunRequest {
-  readonly workspace_name: string
-  readonly rich_parameter_values: WorkspaceBuildParameter[]
-  readonly user_variable_values?: VariableValue[]
+  readonly workspace_name: string;
+  readonly rich_parameter_values: WorkspaceBuildParameter[];
+  readonly user_variable_values?: VariableValue[];
 }
 
 // From codersdk/organizations.go
 export interface CreateTemplateVersionRequest {
-  readonly name?: string
-  readonly message?: string
-  readonly template_id?: string
-  readonly storage_method: ProvisionerStorageMethod
-  readonly file_id?: string
-  readonly example_id?: string
-  readonly provisioner: ProvisionerType
-  readonly tags: Record<string, string>
-  readonly user_variable_values?: VariableValue[]
+  readonly name?: string;
+  readonly message?: string;
+  readonly template_id?: string;
+  readonly storage_method: ProvisionerStorageMethod;
+  readonly file_id?: string;
+  readonly example_id?: string;
+  readonly provisioner: ProvisionerType;
+  readonly tags: Record<string, string>;
+  readonly user_variable_values?: VariableValue[];
 }
 
 // From codersdk/audit.go
 export interface CreateTestAuditLogRequest {
-  readonly action?: AuditAction
-  readonly resource_type?: ResourceType
-  readonly resource_id?: string
-  readonly additional_fields?: Record<string, string>
-  readonly time?: string
-  readonly build_reason?: BuildReason
+  readonly action?: AuditAction;
+  readonly resource_type?: ResourceType;
+  readonly resource_id?: string;
+  readonly additional_fields?: Record<string, string>;
+  readonly time?: string;
+  readonly build_reason?: BuildReason;
 }
 
 // From codersdk/apikey.go
 export interface CreateTokenRequest {
-  readonly lifetime: number
-  readonly scope: APIKeyScope
-  readonly token_name: string
+  readonly lifetime: number;
+  readonly scope: APIKeyScope;
+  readonly token_name: string;
 }
 
 // From codersdk/users.go
 export interface CreateUserRequest {
-  readonly email: string
-  readonly username: string
-  readonly password: string
-  readonly disable_login: boolean
-  readonly organization_id: string
+  readonly email: string;
+  readonly username: string;
+  readonly password: string;
+  readonly login_type: LoginType;
+  readonly disable_login: boolean;
+  readonly organization_id: string;
 }
 
 // From codersdk/workspaces.go
 export interface CreateWorkspaceBuildRequest {
-  readonly template_version_id?: string
-  readonly transition: WorkspaceTransition
-  readonly dry_run?: boolean
-  readonly state?: string
-  readonly orphan?: boolean
-  readonly rich_parameter_values?: WorkspaceBuildParameter[]
-  readonly log_level?: ProvisionerLogLevel
+  readonly template_version_id?: string;
+  readonly transition: WorkspaceTransition;
+  readonly dry_run?: boolean;
+  readonly state?: string;
+  readonly orphan?: boolean;
+  readonly rich_parameter_values?: WorkspaceBuildParameter[];
+  readonly log_level?: ProvisionerLogLevel;
 }
 
 // From codersdk/workspaceproxy.go
 export interface CreateWorkspaceProxyRequest {
-  readonly name: string
-  readonly display_name: string
-  readonly icon: string
+  readonly name: string;
+  readonly display_name: string;
+  readonly icon: string;
 }
 
 // From codersdk/organizations.go
 export interface CreateWorkspaceRequest {
-  readonly template_id: string
-  readonly name: string
-  readonly autostart_schedule?: string
-  readonly ttl_ms?: number
-  readonly rich_parameter_values?: WorkspaceBuildParameter[]
+  readonly template_id?: string;
+  readonly template_version_id?: string;
+  readonly name: string;
+  readonly autostart_schedule?: string;
+  readonly ttl_ms?: number;
+  readonly rich_parameter_values?: WorkspaceBuildParameter[];
+  readonly automatic_updates?: AutomaticUpdates;
 }
 
 // From codersdk/deployment.go
 export interface DAUEntry {
-  readonly date: string
-  readonly amount: number
+  readonly date: string;
+  readonly amount: number;
 }
 
 // From codersdk/deployment.go
 export interface DAURequest {
-  readonly TZHourOffset: number
+  readonly TZHourOffset: number;
 }
 
 // From codersdk/deployment.go
 export interface DAUsResponse {
-  readonly entries: DAUEntry[]
-  readonly tz_hour_offset: number
+  readonly entries: DAUEntry[];
+  readonly tz_hour_offset: number;
 }
 
 // From codersdk/deployment.go
 export interface DERP {
-  readonly server: DERPServerConfig
-  readonly config: DERPConfig
+  readonly server: DERPServerConfig;
+  readonly config: DERPConfig;
 }
 
 // From codersdk/deployment.go
 export interface DERPConfig {
-  readonly block_direct: boolean
-  readonly url: string
-  readonly path: string
+  readonly block_direct: boolean;
+  readonly force_websockets: boolean;
+  readonly url: string;
+  readonly path: string;
 }
 
 // From codersdk/workspaceagents.go
 export interface DERPRegion {
-  readonly preferred: boolean
-  readonly latency_ms: number
+  readonly preferred: boolean;
+  readonly latency_ms: number;
 }
 
 // From codersdk/deployment.go
 export interface DERPServerConfig {
-  readonly enable: boolean
-  readonly region_id: number
-  readonly region_code: string
-  readonly region_name: string
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly stun_addresses: string[]
-  readonly relay_url: string
+  readonly enable: boolean;
+  readonly region_id: number;
+  readonly region_code: string;
+  readonly region_name: string;
+  readonly stun_addresses: string[];
+  readonly relay_url: string;
 }
 
 // From codersdk/deployment.go
 export interface DangerousConfig {
-  readonly allow_path_app_sharing: boolean
-  readonly allow_path_app_site_owner_access: boolean
-  readonly allow_all_cors: boolean
+  readonly allow_path_app_sharing: boolean;
+  readonly allow_path_app_site_owner_access: boolean;
+  readonly allow_all_cors: boolean;
+}
+
+// From codersdk/deployment.go
+export interface DeploymentConfig {
+  readonly config?: DeploymentValues;
+  readonly options?: ClibaseOptionSet;
 }
 
 // From codersdk/deployment.go
 export interface DeploymentStats {
-  readonly aggregated_from: string
-  readonly collected_at: string
-  readonly next_update_at: string
-  readonly workspaces: WorkspaceDeploymentStats
-  readonly session_count: SessionCountDeploymentStats
+  readonly aggregated_from: string;
+  readonly collected_at: string;
+  readonly next_update_at: string;
+  readonly workspaces: WorkspaceDeploymentStats;
+  readonly session_count: SessionCountDeploymentStats;
 }
 
 // From codersdk/deployment.go
 export interface DeploymentValues {
-  readonly verbose?: boolean
-  readonly access_url?: string
-  readonly wildcard_access_url?: string
-  readonly docs_url?: string
-  readonly redirect_to_access_url?: boolean
-  readonly http_address?: string
-  readonly autobuild_poll_interval?: number
-  readonly job_hang_detector_interval?: number
-  readonly derp?: DERP
-  readonly prometheus?: PrometheusConfig
-  readonly pprof?: PprofConfig
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly proxy_trusted_headers?: string[]
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly proxy_trusted_origins?: string[]
-  readonly cache_directory?: string
-  readonly in_memory_database?: boolean
-  readonly pg_connection_url?: string
-  readonly oauth2?: OAuth2Config
-  readonly oidc?: OIDCConfig
-  readonly telemetry?: TelemetryConfig
-  readonly tls?: TLSConfig
-  readonly trace?: TraceConfig
-  readonly secure_auth_cookie?: boolean
-  readonly strict_transport_security?: number
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly strict_transport_security_options?: string[]
-  readonly ssh_keygen_algorithm?: string
-  readonly metrics_cache_refresh_interval?: number
-  readonly agent_stat_refresh_interval?: number
-  readonly agent_fallback_troubleshooting_url?: string
-  readonly browser_only?: boolean
-  readonly scim_api_key?: string
-  readonly provisioner?: ProvisionerConfig
-  readonly rate_limit?: RateLimitConfig
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly experiments?: string[]
-  readonly update_check?: boolean
-  readonly max_token_lifetime?: number
-  readonly swagger?: SwaggerConfig
-  readonly logging?: LoggingConfig
-  readonly dangerous?: DangerousConfig
-  readonly disable_path_apps?: boolean
-  readonly max_session_expiry?: number
-  readonly disable_session_expiry_refresh?: boolean
-  readonly disable_password_auth?: boolean
-  readonly support?: SupportConfig
-  // Named type "github.com/coder/coder/cli/clibase.Struct[[]github.com/coder/coder/codersdk.GitAuthConfig]" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly git_auth?: any
-  readonly config_ssh?: SSHConfig
-  readonly wgtunnel_host?: string
-  readonly disable_owner_workspace_exec?: boolean
-  readonly proxy_health_status_interval?: number
-  readonly enable_terraform_debug_mode?: boolean
-  readonly user_quiet_hours_schedule?: UserQuietHoursScheduleConfig
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.YAMLConfigPath")
-  readonly config?: string
-  readonly write_config?: boolean
-  // Named type "github.com/coder/coder/cli/clibase.HostPort" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly address?: any
+  readonly verbose?: boolean;
+  readonly access_url?: string;
+  readonly wildcard_access_url?: string;
+  readonly docs_url?: string;
+  readonly redirect_to_access_url?: boolean;
+  readonly http_address?: string;
+  readonly autobuild_poll_interval?: number;
+  readonly job_hang_detector_interval?: number;
+  readonly derp?: DERP;
+  readonly prometheus?: PrometheusConfig;
+  readonly pprof?: PprofConfig;
+  readonly proxy_trusted_headers?: string[];
+  readonly proxy_trusted_origins?: string[];
+  readonly cache_directory?: string;
+  readonly in_memory_database?: boolean;
+  readonly pg_connection_url?: string;
+  readonly oauth2?: OAuth2Config;
+  readonly oidc?: OIDCConfig;
+  readonly telemetry?: TelemetryConfig;
+  readonly tls?: TLSConfig;
+  readonly trace?: TraceConfig;
+  readonly secure_auth_cookie?: boolean;
+  readonly strict_transport_security?: number;
+  readonly strict_transport_security_options?: string[];
+  readonly ssh_keygen_algorithm?: string;
+  readonly metrics_cache_refresh_interval?: number;
+  readonly agent_stat_refresh_interval?: number;
+  readonly agent_fallback_troubleshooting_url?: string;
+  readonly browser_only?: boolean;
+  readonly scim_api_key?: string;
+  readonly external_token_encryption_keys?: string[];
+  readonly provisioner?: ProvisionerConfig;
+  readonly rate_limit?: RateLimitConfig;
+  readonly experiments?: string[];
+  readonly update_check?: boolean;
+  readonly max_token_lifetime?: number;
+  readonly swagger?: SwaggerConfig;
+  readonly logging?: LoggingConfig;
+  readonly dangerous?: DangerousConfig;
+  readonly disable_path_apps?: boolean;
+  readonly max_session_expiry?: number;
+  readonly disable_session_expiry_refresh?: boolean;
+  readonly disable_password_auth?: boolean;
+  readonly support?: SupportConfig;
+  readonly external_auth?: ExternalAuthConfig[];
+  readonly config_ssh?: SSHConfig;
+  readonly wgtunnel_host?: string;
+  readonly disable_owner_workspace_exec?: boolean;
+  readonly proxy_health_status_interval?: number;
+  readonly enable_terraform_debug_mode?: boolean;
+  readonly user_quiet_hours_schedule?: UserQuietHoursScheduleConfig;
+  readonly web_terminal_renderer?: string;
+  readonly config?: string;
+  readonly write_config?: boolean;
+  readonly address?: string;
 }
 
 // From codersdk/deployment.go
 export interface Entitlements {
-  readonly features: Record<FeatureName, Feature>
-  readonly warnings: string[]
-  readonly errors: string[]
-  readonly has_license: boolean
-  readonly trial: boolean
-  readonly require_telemetry: boolean
+  readonly features: Record<FeatureName, Feature>;
+  readonly warnings: string[];
+  readonly errors: string[];
+  readonly has_license: boolean;
+  readonly trial: boolean;
+  readonly require_telemetry: boolean;
+  readonly refreshed_at: string;
 }
 
 // From codersdk/deployment.go
-export type Experiments = Experiment[]
+export type Experiments = Experiment[];
 
-// From codersdk/deployment.go
-export interface Feature {
-  readonly entitlement: Entitlement
-  readonly enabled: boolean
-  readonly limit?: number
-  readonly actual?: number
+// From codersdk/externalauth.go
+export interface ExternalAuth {
+  readonly authenticated: boolean;
+  readonly device: boolean;
+  readonly display_name: string;
+  readonly user?: ExternalAuthUser;
+  readonly app_installable: boolean;
+  readonly installations: ExternalAuthAppInstallation[];
+  readonly app_install_url: string;
 }
 
-// From codersdk/apikey.go
-export interface GenerateAPIKeyResponse {
-  readonly key: string
+// From codersdk/externalauth.go
+export interface ExternalAuthAppInstallation {
+  readonly id: number;
+  readonly account: ExternalAuthUser;
+  readonly configure_url: string;
 }
 
-// From codersdk/users.go
-export interface GetUsersResponse {
-  readonly users: User[]
-  readonly count: number
+// From codersdk/deployment.go
+export interface ExternalAuthConfig {
+  readonly type: string;
+  readonly client_id: string;
+  readonly id: string;
+  readonly auth_url: string;
+  readonly token_url: string;
+  readonly validate_url: string;
+  readonly app_install_url: string;
+  readonly app_installations_url: string;
+  readonly no_refresh: boolean;
+  readonly scopes: string[];
+  readonly extra_token_keys: string[];
+  readonly device_flow: boolean;
+  readonly device_code_url: string;
+  readonly regex: string;
+  readonly display_name: string;
+  readonly display_icon: string;
+}
+
+// From codersdk/externalauth.go
+export interface ExternalAuthDevice {
+  readonly device_code: string;
+  readonly user_code: string;
+  readonly verification_uri: string;
+  readonly expires_in: number;
+  readonly interval: number;
+}
+
+// From codersdk/externalauth.go
+export interface ExternalAuthDeviceExchange {
+  readonly device_code: string;
+}
+
+// From codersdk/externalauth.go
+export interface ExternalAuthUser {
+  readonly login: string;
+  readonly avatar_url: string;
+  readonly profile_url: string;
+  readonly name: string;
 }
 
-// From codersdk/gitauth.go
-export interface GitAuth {
-  readonly authenticated: boolean
-  readonly device: boolean
-  readonly type: string
-  readonly user?: GitAuthUser
-  readonly app_installable: boolean
-  readonly installations: GitAuthAppInstallation[]
-  readonly app_install_url: string
+// From codersdk/deployment.go
+export interface Feature {
+  readonly entitlement: Entitlement;
+  readonly enabled: boolean;
+  readonly limit?: number;
+  readonly actual?: number;
 }
 
-// From codersdk/gitauth.go
-export interface GitAuthAppInstallation {
-  readonly id: number
-  readonly account: GitAuthUser
-  readonly configure_url: string
+// From codersdk/apikey.go
+export interface GenerateAPIKeyResponse {
+  readonly key: string;
 }
 
-// From codersdk/deployment.go
-export interface GitAuthConfig {
-  readonly id: string
-  readonly type: string
-  readonly client_id: string
-  readonly auth_url: string
-  readonly token_url: string
-  readonly validate_url: string
-  readonly app_install_url: string
-  readonly app_installations_url: string
-  readonly regex: string
-  readonly no_refresh: boolean
-  readonly scopes: string[]
-  readonly device_flow: boolean
-  readonly device_code_url: string
-}
-
-// From codersdk/gitauth.go
-export interface GitAuthDevice {
-  readonly device_code: string
-  readonly user_code: string
-  readonly verification_uri: string
-  readonly expires_in: number
-  readonly interval: number
-}
-
-// From codersdk/gitauth.go
-export interface GitAuthDeviceExchange {
-  readonly device_code: string
-}
-
-// From codersdk/gitauth.go
-export interface GitAuthUser {
-  readonly login: string
-  readonly avatar_url: string
-  readonly profile_url: string
-  readonly name: string
+// From codersdk/users.go
+export interface GetUsersResponse {
+  readonly users: User[];
+  readonly count: number;
 }
 
 // From codersdk/gitsshkey.go
 export interface GitSSHKey {
-  readonly user_id: string
-  readonly created_at: string
-  readonly updated_at: string
-  readonly public_key: string
+  readonly user_id: string;
+  readonly created_at: string;
+  readonly updated_at: string;
+  readonly public_key: string;
 }
 
 // From codersdk/groups.go
 export interface Group {
-  readonly id: string
-  readonly name: string
-  readonly display_name: string
-  readonly organization_id: string
-  readonly members: User[]
-  readonly avatar_url: string
-  readonly quota_allowance: number
+  readonly id: string;
+  readonly name: string;
+  readonly display_name: string;
+  readonly organization_id: string;
+  readonly members: User[];
+  readonly avatar_url: string;
+  readonly quota_allowance: number;
+  readonly source: GroupSource;
 }
 
 // From codersdk/workspaceapps.go
 export interface Healthcheck {
-  readonly url: string
-  readonly interval: number
-  readonly threshold: number
+  readonly url: string;
+  readonly interval: number;
+  readonly threshold: number;
 }
 
 // From codersdk/workspaceagents.go
 export interface IssueReconnectingPTYSignedTokenRequest {
-  readonly url: string
-  readonly agentID: string
+  readonly url: string;
+  readonly agentID: string;
 }
 
 // From codersdk/workspaceagents.go
 export interface IssueReconnectingPTYSignedTokenResponse {
-  readonly signed_token: string
+  readonly signed_token: string;
 }
 
 // From codersdk/licenses.go
 export interface License {
-  readonly id: number
-  readonly uuid: string
-  readonly uploaded_at: string
+  readonly id: number;
+  readonly uuid: string;
+  readonly uploaded_at: string;
   // Empty interface{} type, cannot resolve the type.
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- interface{}
-  readonly claims: Record<string, any>
+  readonly claims: Record<string, any>;
 }
 
 // From codersdk/deployment.go
 export interface LinkConfig {
-  readonly name: string
-  readonly target: string
-  readonly icon: string
+  readonly name: string;
+  readonly target: string;
+  readonly icon: string;
 }
 
 // From codersdk/deployment.go
 export interface LoggingConfig {
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly log_filter: string[]
-  readonly human: string
-  readonly json: string
-  readonly stackdriver: string
+  readonly log_filter: string[];
+  readonly human: string;
+  readonly json: string;
+  readonly stackdriver: string;
 }
 
 // From codersdk/users.go
 export interface LoginWithPasswordRequest {
-  readonly email: string
-  readonly password: string
+  readonly email: string;
+  readonly password: string;
 }
 
 // From codersdk/users.go
 export interface LoginWithPasswordResponse {
-  readonly session_token: string
+  readonly session_token: string;
 }
 
 // From codersdk/users.go
 export interface MinimalUser {
-  readonly id: string
-  readonly username: string
-  readonly avatar_url: string
+  readonly id: string;
+  readonly username: string;
+  readonly avatar_url: string;
 }
 
 // From codersdk/deployment.go
 export interface OAuth2Config {
-  readonly github: OAuth2GithubConfig
+  readonly github: OAuth2GithubConfig;
 }
 
 // From codersdk/deployment.go
 export interface OAuth2GithubConfig {
-  readonly client_id: string
-  readonly client_secret: string
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly allowed_orgs: string[]
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly allowed_teams: string[]
-  readonly allow_signups: boolean
-  readonly allow_everyone: boolean
-  readonly enterprise_base_url: string
+  readonly client_id: string;
+  readonly client_secret: string;
+  readonly allowed_orgs: string[];
+  readonly allowed_teams: string[];
+  readonly allow_signups: boolean;
+  readonly allow_everyone: boolean;
+  readonly enterprise_base_url: string;
 }
 
 // From codersdk/users.go
 export interface OAuthConversionResponse {
-  readonly state_string: string
-  readonly expires_at: string
-  readonly to_type: LoginType
-  readonly user_id: string
+  readonly state_string: string;
+  readonly expires_at: string;
+  readonly to_type: LoginType;
+  readonly user_id: string;
 }
 
 // From codersdk/users.go
 export interface OIDCAuthMethod extends AuthMethod {
-  readonly signInText: string
-  readonly iconUrl: string
+  readonly signInText: string;
+  readonly iconUrl: string;
 }
 
 // From codersdk/deployment.go
 export interface OIDCConfig {
-  readonly allow_signups: boolean
-  readonly client_id: string
-  readonly client_secret: string
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly email_domain: string[]
-  readonly issuer_url: string
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly scopes: string[]
-  readonly ignore_email_verified: boolean
-  readonly username_field: string
-  readonly email_field: string
-  // Named type "github.com/coder/coder/cli/clibase.Struct[map[string]string]" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly auth_url_params: any
-  readonly ignore_user_info: boolean
-  readonly groups_field: string
-  // Named type "github.com/coder/coder/cli/clibase.Struct[map[string]string]" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly group_mapping: any
-  readonly user_role_field: string
-  // Named type "github.com/coder/coder/cli/clibase.Struct[map[string][]string]" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly user_role_mapping: any
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly user_roles_default: string[]
-  readonly sign_in_text: string
-  readonly icon_url: string
+  readonly allow_signups: boolean;
+  readonly client_id: string;
+  readonly client_secret: string;
+  readonly client_key_file: string;
+  readonly client_cert_file: string;
+  readonly email_domain: string[];
+  readonly issuer_url: string;
+  readonly scopes: string[];
+  readonly ignore_email_verified: boolean;
+  readonly username_field: string;
+  readonly email_field: string;
+  readonly auth_url_params: Record<string, string>;
+  readonly ignore_user_info: boolean;
+  readonly group_auto_create: boolean;
+  readonly group_regex_filter: string;
+  readonly groups_field: string;
+  readonly group_mapping: Record<string, string>;
+  readonly user_role_field: string;
+  readonly user_role_mapping: Record<string, string[]>;
+  readonly user_roles_default: string[];
+  readonly sign_in_text: string;
+  readonly icon_url: string;
 }
 
 // From codersdk/organizations.go
 export interface Organization {
-  readonly id: string
-  readonly name: string
-  readonly created_at: string
-  readonly updated_at: string
+  readonly id: string;
+  readonly name: string;
+  readonly created_at: string;
+  readonly updated_at: string;
 }
 
 // From codersdk/organizations.go
 export interface OrganizationMember {
-  readonly user_id: string
-  readonly organization_id: string
-  readonly created_at: string
-  readonly updated_at: string
-  readonly roles: Role[]
+  readonly user_id: string;
+  readonly organization_id: string;
+  readonly created_at: string;
+  readonly updated_at: string;
+  readonly roles: Role[];
 }
 
 // From codersdk/pagination.go
 export interface Pagination {
-  readonly after_id?: string
-  readonly limit?: number
-  readonly offset?: number
+  readonly after_id?: string;
+  readonly limit?: number;
+  readonly offset?: number;
 }
 
 // From codersdk/groups.go
 export interface PatchGroupRequest {
-  readonly add_users: string[]
-  readonly remove_users: string[]
-  readonly name: string
-  readonly display_name?: string
-  readonly avatar_url?: string
-  readonly quota_allowance?: number
+  readonly add_users: string[];
+  readonly remove_users: string[];
+  readonly name: string;
+  readonly display_name?: string;
+  readonly avatar_url?: string;
+  readonly quota_allowance?: number;
 }
 
 // From codersdk/templateversions.go
 export interface PatchTemplateVersionRequest {
-  readonly name: string
-  readonly message?: string
+  readonly name: string;
+  readonly message?: string;
 }
 
 // From codersdk/workspaceproxy.go
 export interface PatchWorkspaceProxy {
-  readonly id: string
-  readonly name: string
-  readonly display_name: string
-  readonly icon: string
-  readonly regenerate_token: boolean
+  readonly id: string;
+  readonly name: string;
+  readonly display_name: string;
+  readonly icon: string;
+  readonly regenerate_token: boolean;
 }
 
 // From codersdk/deployment.go
 export interface PprofConfig {
-  readonly enable: boolean
-  // Named type "github.com/coder/coder/cli/clibase.HostPort" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly address: any
+  readonly enable: boolean;
+  readonly address: string;
 }
 
 // From codersdk/deployment.go
 export interface PrometheusConfig {
-  readonly enable: boolean
-  // Named type "github.com/coder/coder/cli/clibase.HostPort" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly address: any
-  readonly collect_agent_stats: boolean
-  readonly collect_db_metrics: boolean
+  readonly enable: boolean;
+  readonly address: string;
+  readonly collect_agent_stats: boolean;
+  readonly collect_db_metrics: boolean;
 }
 
 // From codersdk/deployment.go
 export interface ProvisionerConfig {
-  readonly daemons: number
-  readonly daemons_echo: boolean
-  readonly daemon_poll_interval: number
-  readonly daemon_poll_jitter: number
-  readonly force_cancel_interval: number
+  readonly daemons: number;
+  readonly daemons_echo: boolean;
+  readonly daemon_poll_interval: number;
+  readonly daemon_poll_jitter: number;
+  readonly force_cancel_interval: number;
+  readonly daemon_psk: string;
 }
 
 // From codersdk/provisionerdaemons.go
 export interface ProvisionerDaemon {
-  readonly id: string
-  readonly created_at: string
-  readonly updated_at?: string
-  readonly name: string
-  readonly provisioners: ProvisionerType[]
-  readonly tags: Record<string, string>
+  readonly id: string;
+  readonly created_at: string;
+  readonly updated_at?: string;
+  readonly name: string;
+  readonly provisioners: ProvisionerType[];
+  readonly tags: Record<string, string>;
 }
 
 // From codersdk/provisionerdaemons.go
 export interface ProvisionerJob {
-  readonly id: string
-  readonly created_at: string
-  readonly started_at?: string
-  readonly completed_at?: string
-  readonly canceled_at?: string
-  readonly error?: string
-  readonly error_code?: JobErrorCode
-  readonly status: ProvisionerJobStatus
-  readonly worker_id?: string
-  readonly file_id: string
-  readonly tags: Record<string, string>
-  readonly queue_position: number
-  readonly queue_size: number
+  readonly id: string;
+  readonly created_at: string;
+  readonly started_at?: string;
+  readonly completed_at?: string;
+  readonly canceled_at?: string;
+  readonly error?: string;
+  readonly error_code?: JobErrorCode;
+  readonly status: ProvisionerJobStatus;
+  readonly worker_id?: string;
+  readonly file_id: string;
+  readonly tags: Record<string, string>;
+  readonly queue_position: number;
+  readonly queue_size: number;
 }
 
 // From codersdk/provisionerdaemons.go
 export interface ProvisionerJobLog {
-  readonly id: number
-  readonly created_at: string
-  readonly log_source: LogSource
-  readonly log_level: LogLevel
-  readonly stage: string
-  readonly output: string
+  readonly id: number;
+  readonly created_at: string;
+  readonly log_source: LogSource;
+  readonly log_level: LogLevel;
+  readonly stage: string;
+  readonly output: string;
 }
 
 // From codersdk/workspaceproxy.go
 export interface ProxyHealthReport {
-  readonly errors: string[]
-  readonly warnings: string[]
+  readonly errors: string[];
+  readonly warnings: string[];
 }
 
 // From codersdk/workspaces.go
 export interface PutExtendWorkspaceRequest {
-  readonly deadline: string
+  readonly deadline: string;
 }
 
 // From codersdk/deployment.go
 export interface RateLimitConfig {
-  readonly disable_all: boolean
-  readonly api: number
+  readonly disable_all: boolean;
+  readonly api: number;
 }
 
 // From codersdk/workspaceproxy.go
 export interface Region {
-  readonly id: string
-  readonly name: string
-  readonly display_name: string
-  readonly icon_url: string
-  readonly healthy: boolean
-  readonly path_app_url: string
-  readonly wildcard_hostname: string
+  readonly id: string;
+  readonly name: string;
+  readonly display_name: string;
+  readonly icon_url: string;
+  readonly healthy: boolean;
+  readonly path_app_url: string;
+  readonly wildcard_hostname: string;
 }
 
 // From codersdk/workspaceproxy.go
 export interface RegionsResponse<R extends RegionTypes> {
-  readonly regions: R[]
+  readonly regions: R[];
 }
 
 // From codersdk/replicas.go
 export interface Replica {
-  readonly id: string
-  readonly hostname: string
-  readonly created_at: string
-  readonly relay_address: string
-  readonly region_id: number
-  readonly error: string
-  readonly database_latency: number
+  readonly id: string;
+  readonly hostname: string;
+  readonly created_at: string;
+  readonly relay_address: string;
+  readonly region_id: number;
+  readonly error: string;
+  readonly database_latency: number;
 }
 
 // From codersdk/client.go
 export interface Response {
-  readonly message: string
-  readonly detail?: string
-  readonly validations?: ValidationError[]
+  readonly message: string;
+  readonly detail?: string;
+  readonly validations?: ValidationError[];
 }
 
 // From codersdk/roles.go
 export interface Role {
-  readonly name: string
-  readonly display_name: string
+  readonly name: string;
+  readonly display_name: string;
 }
 
 // From codersdk/deployment.go
 export interface SSHConfig {
-  readonly DeploymentName: string
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly SSHConfigOptions: string[]
+  readonly DeploymentName: string;
+  readonly SSHConfigOptions: string[];
 }
 
 // From codersdk/deployment.go
 export interface SSHConfigResponse {
-  readonly hostname_prefix: string
-  readonly ssh_config_options: Record<string, string>
+  readonly hostname_prefix: string;
+  readonly ssh_config_options: Record<string, string>;
 }
 
 // From codersdk/serversentevents.go
 export interface ServerSentEvent {
-  readonly type: ServerSentEventType
+  readonly type: ServerSentEventType;
   // Empty interface{} type, cannot resolve the type.
   // eslint-disable-next-line @typescript-eslint/no-explicit-any -- interface{}
-  readonly data: any
+  readonly data: any;
 }
 
 // From codersdk/deployment.go
 export interface ServiceBannerConfig {
-  readonly enabled: boolean
-  readonly message?: string
-  readonly background_color?: string
+  readonly enabled: boolean;
+  readonly message?: string;
+  readonly background_color?: string;
 }
 
 // From codersdk/deployment.go
 export interface SessionCountDeploymentStats {
-  readonly vscode: number
-  readonly ssh: number
-  readonly jetbrains: number
-  readonly reconnecting_pty: number
+  readonly vscode: number;
+  readonly ssh: number;
+  readonly jetbrains: number;
+  readonly reconnecting_pty: number;
 }
 
 // From codersdk/deployment.go
 export interface SupportConfig {
-  // Named type "github.com/coder/coder/cli/clibase.Struct[[]github.com/coder/coder/codersdk.LinkConfig]" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly links: any
+  readonly links: LinkConfig[];
 }
 
 // From codersdk/deployment.go
 export interface SwaggerConfig {
-  readonly enable: boolean
+  readonly enable: boolean;
 }
 
 // From codersdk/deployment.go
 export interface TLSConfig {
-  readonly enable: boolean
-  // Named type "github.com/coder/coder/cli/clibase.HostPort" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly address: any
-  readonly redirect_http: boolean
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly cert_file: string[]
-  readonly client_auth: string
-  readonly client_ca_file: string
-  // This is likely an enum in an external package ("github.com/coder/coder/cli/clibase.StringArray")
-  readonly key_file: string[]
-  readonly min_version: string
-  readonly client_cert_file: string
-  readonly client_key_file: string
+  readonly enable: boolean;
+  readonly address: string;
+  readonly redirect_http: boolean;
+  readonly cert_file: string[];
+  readonly client_auth: string;
+  readonly client_ca_file: string;
+  readonly key_file: string[];
+  readonly min_version: string;
+  readonly client_cert_file: string;
+  readonly client_key_file: string;
 }
 
 // From codersdk/deployment.go
 export interface TelemetryConfig {
-  readonly enable: boolean
-  readonly trace: boolean
-  readonly url: string
+  readonly enable: boolean;
+  readonly trace: boolean;
+  readonly url: string;
 }
 
 // From codersdk/templates.go
 export interface Template {
-  readonly id: string
-  readonly created_at: string
-  readonly updated_at: string
-  readonly organization_id: string
-  readonly name: string
-  readonly display_name: string
-  readonly provisioner: ProvisionerType
-  readonly active_version_id: string
-  readonly active_user_count: number
-  readonly build_time_stats: TemplateBuildTimeStats
-  readonly description: string
-  readonly icon: string
-  readonly default_ttl_ms: number
-  readonly max_ttl_ms: number
-  readonly restart_requirement: TemplateRestartRequirement
-  readonly created_by_id: string
-  readonly created_by_name: string
-  readonly allow_user_autostart: boolean
-  readonly allow_user_autostop: boolean
-  readonly allow_user_cancel_workspace_jobs: boolean
-  readonly failure_ttl_ms: number
-  readonly inactivity_ttl_ms: number
-  readonly locked_ttl_ms: number
+  readonly id: string;
+  readonly created_at: string;
+  readonly updated_at: string;
+  readonly organization_id: string;
+  readonly name: string;
+  readonly display_name: string;
+  readonly provisioner: ProvisionerType;
+  readonly active_version_id: string;
+  readonly active_user_count: number;
+  readonly build_time_stats: TemplateBuildTimeStats;
+  readonly description: string;
+  readonly icon: string;
+  readonly default_ttl_ms: number;
+  readonly max_ttl_ms: number;
+  readonly autostop_requirement: TemplateAutostopRequirement;
+  readonly autostart_requirement: TemplateAutostartRequirement;
+  readonly created_by_id: string;
+  readonly created_by_name: string;
+  readonly allow_user_autostart: boolean;
+  readonly allow_user_autostop: boolean;
+  readonly allow_user_cancel_workspace_jobs: boolean;
+  readonly failure_ttl_ms: number;
+  readonly time_til_dormant_ms: number;
+  readonly time_til_dormant_autodelete_ms: number;
+  readonly require_active_version: boolean;
 }
 
 // From codersdk/templates.go
 export interface TemplateACL {
-  readonly users: TemplateUser[]
-  readonly group: TemplateGroup[]
+  readonly users: TemplateUser[];
+  readonly group: TemplateGroup[];
 }
 
 // From codersdk/insights.go
 export interface TemplateAppUsage {
-  readonly template_ids: string[]
-  readonly type: TemplateAppsType
-  readonly display_name: string
-  readonly slug: string
-  readonly icon: string
-  readonly seconds: number
+  readonly template_ids: string[];
+  readonly type: TemplateAppsType;
+  readonly display_name: string;
+  readonly slug: string;
+  readonly icon: string;
+  readonly seconds: number;
+}
+
+// From codersdk/templates.go
+export interface TemplateAutostartRequirement {
+  readonly days_of_week: string[];
+}
+
+// From codersdk/templates.go
+export interface TemplateAutostopRequirement {
+  readonly days_of_week: string[];
+  readonly weeks: number;
 }
 
 // From codersdk/templates.go
 export type TemplateBuildTimeStats = Record<
   WorkspaceTransition,
   TransitionStats
->
+>;
 
 // From codersdk/templates.go
 export interface TemplateExample {
-  readonly id: string
-  readonly url: string
-  readonly name: string
-  readonly description: string
-  readonly icon: string
-  readonly tags: string[]
-  readonly markdown: string
+  readonly id: string;
+  readonly url: string;
+  readonly name: string;
+  readonly description: string;
+  readonly icon: string;
+  readonly tags: string[];
+  readonly markdown: string;
 }
 
 // From codersdk/templates.go
 export interface TemplateGroup extends Group {
-  readonly role: TemplateRole
+  readonly role: TemplateRole;
 }
 
 // From codersdk/insights.go
 export interface TemplateInsightsIntervalReport {
-  readonly start_time: string
-  readonly end_time: string
-  readonly template_ids: string[]
-  readonly interval: InsightsReportInterval
-  readonly active_users: number
+  readonly start_time: string;
+  readonly end_time: string;
+  readonly template_ids: string[];
+  readonly interval: InsightsReportInterval;
+  readonly active_users: number;
 }
 
 // From codersdk/insights.go
 export interface TemplateInsightsReport {
-  readonly start_time: string
-  readonly end_time: string
-  readonly template_ids: string[]
-  readonly active_users: number
-  readonly apps_usage: TemplateAppUsage[]
-  readonly parameters_usage: TemplateParameterUsage[]
+  readonly start_time: string;
+  readonly end_time: string;
+  readonly template_ids: string[];
+  readonly active_users: number;
+  readonly apps_usage: TemplateAppUsage[];
+  readonly parameters_usage: TemplateParameterUsage[];
 }
 
 // From codersdk/insights.go
 export interface TemplateInsightsRequest {
-  readonly start_time: string
-  readonly end_time: string
-  readonly template_ids: string[]
-  readonly interval: InsightsReportInterval
+  readonly start_time: string;
+  readonly end_time: string;
+  readonly template_ids: string[];
+  readonly interval: InsightsReportInterval;
+  readonly sections: TemplateInsightsSection[];
 }
 
 // From codersdk/insights.go
 export interface TemplateInsightsResponse {
-  readonly report: TemplateInsightsReport
-  readonly interval_reports: TemplateInsightsIntervalReport[]
+  readonly report?: TemplateInsightsReport;
+  readonly interval_reports?: TemplateInsightsIntervalReport[];
 }
 
 // From codersdk/insights.go
 export interface TemplateParameterUsage {
-  readonly template_ids: string[]
-  readonly display_name: string
-  readonly name: string
-  readonly options?: TemplateVersionParameterOption[]
-  readonly values: TemplateParameterValue[]
+  readonly template_ids: string[];
+  readonly display_name: string;
+  readonly name: string;
+  readonly type: string;
+  readonly description: string;
+  readonly options?: TemplateVersionParameterOption[];
+  readonly values: TemplateParameterValue[];
 }
 
 // From codersdk/insights.go
 export interface TemplateParameterValue {
-  readonly value: string
-  readonly count: number
-}
-
-// From codersdk/templates.go
-export interface TemplateRestartRequirement {
-  readonly days_of_week: string[]
-  readonly weeks: number
+  readonly value: string;
+  readonly count: number;
 }
 
 // From codersdk/templates.go
 export interface TemplateUser extends User {
-  readonly role: TemplateRole
+  readonly role: TemplateRole;
 }
 
 // From codersdk/templateversions.go
 export interface TemplateVersion {
-  readonly id: string
-  readonly template_id?: string
-  readonly organization_id?: string
-  readonly created_at: string
-  readonly updated_at: string
-  readonly name: string
-  readonly message: string
-  readonly job: ProvisionerJob
-  readonly readme: string
-  readonly created_by: MinimalUser
-  readonly warnings?: TemplateVersionWarning[]
+  readonly id: string;
+  readonly template_id?: string;
+  readonly organization_id?: string;
+  readonly created_at: string;
+  readonly updated_at: string;
+  readonly name: string;
+  readonly message: string;
+  readonly job: ProvisionerJob;
+  readonly readme: string;
+  readonly created_by: MinimalUser;
+  readonly archived: boolean;
+  readonly warnings?: TemplateVersionWarning[];
 }
 
 // From codersdk/templateversions.go
-export interface TemplateVersionGitAuth {
-  readonly id: string
-  readonly type: GitProvider
-  readonly authenticate_url: string
-  readonly authenticated: boolean
+export interface TemplateVersionExternalAuth {
+  readonly id: string;
+  readonly type: string;
+  readonly display_name: string;
+  readonly display_icon: string;
+  readonly authenticate_url: string;
+  readonly authenticated: boolean;
 }
 
 // From codersdk/templateversions.go
 export interface TemplateVersionParameter {
-  readonly name: string
-  readonly display_name?: string
-  readonly description: string
-  readonly description_plaintext: string
-  readonly type: string
-  readonly mutable: boolean
-  readonly default_value: string
-  readonly icon: string
-  readonly options: TemplateVersionParameterOption[]
-  readonly validation_error?: string
-  readonly validation_regex?: string
-  readonly validation_min?: number
-  readonly validation_max?: number
-  readonly validation_monotonic?: ValidationMonotonicOrder
-  readonly required: boolean
-  readonly ephemeral: boolean
+  readonly name: string;
+  readonly display_name?: string;
+  readonly description: string;
+  readonly description_plaintext: string;
+  readonly type: string;
+  readonly mutable: boolean;
+  readonly default_value: string;
+  readonly icon: string;
+  readonly options: TemplateVersionParameterOption[];
+  readonly validation_error?: string;
+  readonly validation_regex?: string;
+  readonly validation_min?: number;
+  readonly validation_max?: number;
+  readonly validation_monotonic?: ValidationMonotonicOrder;
+  readonly required: boolean;
+  readonly ephemeral: boolean;
 }
 
 // From codersdk/templateversions.go
 export interface TemplateVersionParameterOption {
-  readonly name: string
-  readonly description: string
-  readonly value: string
-  readonly icon: string
+  readonly name: string;
+  readonly description: string;
+  readonly value: string;
+  readonly icon: string;
 }
 
 // From codersdk/templateversions.go
 export interface TemplateVersionVariable {
-  readonly name: string
-  readonly description: string
-  readonly type: string
-  readonly value: string
-  readonly default_value: string
-  readonly required: boolean
-  readonly sensitive: boolean
+  readonly name: string;
+  readonly description: string;
+  readonly type: string;
+  readonly value: string;
+  readonly default_value: string;
+  readonly required: boolean;
+  readonly sensitive: boolean;
 }
 
 // From codersdk/templates.go
 export interface TemplateVersionsByTemplateRequest extends Pagination {
-  readonly template_id: string
+  readonly template_id: string;
+  readonly include_archived: boolean;
 }
 
 // From codersdk/apikey.go
 export interface TokenConfig {
-  readonly max_token_lifetime: number
+  readonly max_token_lifetime: number;
 }
 
 // From codersdk/apikey.go
 export interface TokensFilter {
-  readonly include_all: boolean
+  readonly include_all: boolean;
 }
 
 // From codersdk/deployment.go
 export interface TraceConfig {
-  readonly enable: boolean
-  readonly honeycomb_api_key: string
-  readonly capture_logs: boolean
+  readonly enable: boolean;
+  readonly honeycomb_api_key: string;
+  readonly capture_logs: boolean;
+  readonly data_dog: boolean;
 }
 
 // From codersdk/templates.go
 export interface TransitionStats {
-  readonly P50?: number
-  readonly P95?: number
+  readonly P50?: number;
+  readonly P95?: number;
 }
 
 // From codersdk/templates.go
 export interface UpdateActiveTemplateVersion {
-  readonly id: string
+  readonly id: string;
 }
 
 // From codersdk/deployment.go
 export interface UpdateAppearanceConfig {
-  readonly logo_url: string
-  readonly service_banner: ServiceBannerConfig
+  readonly application_name: string;
+  readonly logo_url: string;
+  readonly service_banner: ServiceBannerConfig;
 }
 
 // From codersdk/updatecheck.go
 export interface UpdateCheckResponse {
-  readonly current: boolean
-  readonly version: string
-  readonly url: string
+  readonly current: boolean;
+  readonly version: string;
+  readonly url: string;
 }
 
 // From codersdk/users.go
 export interface UpdateRoles {
-  readonly roles: string[]
+  readonly roles: string[];
 }
 
 // From codersdk/templates.go
 export interface UpdateTemplateACL {
-  readonly user_perms?: Record<string, TemplateRole>
-  readonly group_perms?: Record<string, TemplateRole>
+  readonly user_perms?: Record<string, TemplateRole>;
+  readonly group_perms?: Record<string, TemplateRole>;
 }
 
 // From codersdk/templates.go
 export interface UpdateTemplateMeta {
-  readonly name?: string
-  readonly display_name?: string
-  readonly description?: string
-  readonly icon?: string
-  readonly default_ttl_ms?: number
-  readonly max_ttl_ms?: number
-  readonly restart_requirement?: TemplateRestartRequirement
-  readonly allow_user_autostart?: boolean
-  readonly allow_user_autostop?: boolean
-  readonly allow_user_cancel_workspace_jobs?: boolean
-  readonly failure_ttl_ms?: number
-  readonly inactivity_ttl_ms?: number
-  readonly locked_ttl_ms?: number
+  readonly name?: string;
+  readonly display_name?: string;
+  readonly description?: string;
+  readonly icon?: string;
+  readonly default_ttl_ms?: number;
+  readonly max_ttl_ms?: number;
+  readonly autostop_requirement?: TemplateAutostopRequirement;
+  readonly autostart_requirement?: TemplateAutostartRequirement;
+  readonly allow_user_autostart?: boolean;
+  readonly allow_user_autostop?: boolean;
+  readonly allow_user_cancel_workspace_jobs?: boolean;
+  readonly failure_ttl_ms?: number;
+  readonly time_til_dormant_ms?: number;
+  readonly time_til_dormant_autodelete_ms?: number;
+  readonly update_workspace_last_used_at: boolean;
+  readonly update_workspace_dormant_at: boolean;
+  readonly require_active_version: boolean;
 }
 
 // From codersdk/users.go
 export interface UpdateUserPasswordRequest {
-  readonly old_password: string
-  readonly password: string
+  readonly old_password: string;
+  readonly password: string;
 }
 
 // From codersdk/users.go
 export interface UpdateUserProfileRequest {
-  readonly username: string
+  readonly username: string;
 }
 
 // From codersdk/users.go
 export interface UpdateUserQuietHoursScheduleRequest {
-  readonly schedule: string
+  readonly schedule: string;
+}
+
+// From codersdk/workspaces.go
+export interface UpdateWorkspaceAutomaticUpdatesRequest {
+  readonly automatic_updates: AutomaticUpdates;
 }
 
 // From codersdk/workspaces.go
 export interface UpdateWorkspaceAutostartRequest {
-  readonly schedule?: string
+  readonly schedule?: string;
 }
 
 // From codersdk/workspaces.go
-export interface UpdateWorkspaceLock {
-  readonly lock: boolean
+export interface UpdateWorkspaceDormancy {
+  readonly dormant: boolean;
 }
 
 // From codersdk/workspaceproxy.go
 export interface UpdateWorkspaceProxyResponse {
-  readonly proxy: WorkspaceProxy
-  readonly proxy_token: string
+  readonly proxy: WorkspaceProxy;
+  readonly proxy_token: string;
 }
 
 // From codersdk/workspaces.go
 export interface UpdateWorkspaceRequest {
-  readonly name?: string
+  readonly name?: string;
 }
 
 // From codersdk/workspaces.go
 export interface UpdateWorkspaceTTLRequest {
-  readonly ttl_ms?: number
+  readonly ttl_ms?: number;
 }
 
 // From codersdk/files.go
 export interface UploadResponse {
-  readonly hash: string
+  readonly hash: string;
 }
 
 // From codersdk/users.go
 export interface User {
-  readonly id: string
-  readonly username: string
-  readonly email: string
-  readonly created_at: string
-  readonly last_seen_at: string
-  readonly status: UserStatus
-  readonly organization_ids: string[]
-  readonly roles: Role[]
-  readonly avatar_url: string
-  readonly login_type: LoginType
+  readonly id: string;
+  readonly username: string;
+  readonly email: string;
+  readonly created_at: string;
+  readonly last_seen_at: string;
+  readonly status: UserStatus;
+  readonly organization_ids: string[];
+  readonly roles: Role[];
+  readonly avatar_url: string;
+  readonly login_type: LoginType;
+}
+
+// From codersdk/insights.go
+export interface UserActivity {
+  readonly template_ids: string[];
+  readonly user_id: string;
+  readonly username: string;
+  readonly avatar_url: string;
+  readonly seconds: number;
+}
+
+// From codersdk/insights.go
+export interface UserActivityInsightsReport {
+  readonly start_time: string;
+  readonly end_time: string;
+  readonly template_ids: string[];
+  readonly users: UserActivity[];
+}
+
+// From codersdk/insights.go
+export interface UserActivityInsightsRequest {
+  readonly start_time: string;
+  readonly end_time: string;
+  readonly template_ids: string[];
+}
+
+// From codersdk/insights.go
+export interface UserActivityInsightsResponse {
+  readonly report: UserActivityInsightsReport;
 }
 
 // From codersdk/insights.go
 export interface UserLatency {
-  readonly template_ids: string[]
-  readonly user_id: string
-  readonly username: string
-  readonly avatar_url: string
-  readonly latency_ms: ConnectionLatency
+  readonly template_ids: string[];
+  readonly user_id: string;
+  readonly username: string;
+  readonly avatar_url: string;
+  readonly latency_ms: ConnectionLatency;
 }
 
 // From codersdk/insights.go
 export interface UserLatencyInsightsReport {
-  readonly start_time: string
-  readonly end_time: string
-  readonly template_ids: string[]
-  readonly users: UserLatency[]
+  readonly start_time: string;
+  readonly end_time: string;
+  readonly template_ids: string[];
+  readonly users: UserLatency[];
 }
 
 // From codersdk/insights.go
 export interface UserLatencyInsightsRequest {
-  readonly start_time: string
-  readonly end_time: string
-  readonly template_ids: string[]
+  readonly start_time: string;
+  readonly end_time: string;
+  readonly template_ids: string[];
 }
 
 // From codersdk/insights.go
 export interface UserLatencyInsightsResponse {
-  readonly report: UserLatencyInsightsReport
+  readonly report: UserLatencyInsightsReport;
 }
 
 // From codersdk/users.go
 export interface UserLoginType {
-  readonly login_type: LoginType
+  readonly login_type: LoginType;
 }
 
 // From codersdk/deployment.go
 export interface UserQuietHoursScheduleConfig {
-  readonly default_schedule: string
+  readonly default_schedule: string;
 }
 
 // From codersdk/users.go
 export interface UserQuietHoursScheduleResponse {
-  readonly raw_schedule: string
-  readonly user_set: boolean
-  readonly time: string
-  readonly timezone: string
-  readonly next: string
+  readonly raw_schedule: string;
+  readonly user_set: boolean;
+  readonly time: string;
+  readonly timezone: string;
+  readonly next: string;
 }
 
 // From codersdk/users.go
 export interface UserRoles {
-  readonly roles: string[]
-  readonly organization_roles: Record<string, string[]>
+  readonly roles: string[];
+  readonly organization_roles: Record<string, string[]>;
 }
 
 // From codersdk/users.go
 export interface UsersRequest extends Pagination {
-  readonly q?: string
+  readonly q?: string;
 }
 
 // From codersdk/client.go
 export interface ValidationError {
-  readonly field: string
-  readonly detail: string
+  readonly field: string;
+  readonly detail: string;
 }
 
 // From codersdk/organizations.go
 export interface VariableValue {
-  readonly name: string
-  readonly value: string
+  readonly name: string;
+  readonly value: string;
 }
 
 // From codersdk/workspaces.go
 export interface Workspace {
-  readonly id: string
-  readonly created_at: string
-  readonly updated_at: string
-  readonly owner_id: string
-  readonly owner_name: string
-  readonly organization_id: string
-  readonly template_id: string
-  readonly template_name: string
-  readonly template_display_name: string
-  readonly template_icon: string
-  readonly template_allow_user_cancel_workspace_jobs: boolean
-  readonly latest_build: WorkspaceBuild
-  readonly outdated: boolean
-  readonly name: string
-  readonly autostart_schedule?: string
-  readonly ttl_ms?: number
-  readonly last_used_at: string
-  readonly deleting_at?: string
-  readonly locked_at?: string
-  readonly health: WorkspaceHealth
+  readonly id: string;
+  readonly created_at: string;
+  readonly updated_at: string;
+  readonly owner_id: string;
+  readonly owner_name: string;
+  readonly organization_id: string;
+  readonly template_id: string;
+  readonly template_name: string;
+  readonly template_display_name: string;
+  readonly template_icon: string;
+  readonly template_allow_user_cancel_workspace_jobs: boolean;
+  readonly template_active_version_id: string;
+  readonly template_require_active_version: boolean;
+  readonly latest_build: WorkspaceBuild;
+  readonly outdated: boolean;
+  readonly name: string;
+  readonly autostart_schedule?: string;
+  readonly ttl_ms?: number;
+  readonly last_used_at: string;
+  readonly deleting_at?: string;
+  readonly dormant_at?: string;
+  readonly health: WorkspaceHealth;
+  readonly automatic_updates: AutomaticUpdates;
 }
 
 // From codersdk/workspaceagents.go
 export interface WorkspaceAgent {
-  readonly id: string
-  readonly created_at: string
-  readonly updated_at: string
-  readonly first_connected_at?: string
-  readonly last_connected_at?: string
-  readonly disconnected_at?: string
-  readonly started_at?: string
-  readonly ready_at?: string
-  readonly status: WorkspaceAgentStatus
-  readonly lifecycle_state: WorkspaceAgentLifecycle
-  readonly name: string
-  readonly resource_id: string
-  readonly instance_id?: string
-  readonly architecture: string
-  readonly environment_variables: Record<string, string>
-  readonly operating_system: string
-  readonly startup_script?: string
-  readonly startup_script_behavior: WorkspaceAgentStartupScriptBehavior
-  readonly startup_script_timeout_seconds: number
-  readonly logs_length: number
-  readonly logs_overflowed: boolean
-  readonly directory?: string
-  readonly expanded_directory?: string
-  readonly version: string
-  readonly apps: WorkspaceApp[]
-  readonly latency?: Record<string, DERPRegion>
-  readonly connection_timeout_seconds: number
-  readonly troubleshooting_url: string
-  readonly login_before_ready: boolean
-  readonly shutdown_script?: string
-  readonly shutdown_script_timeout_seconds: number
-  readonly subsystem: AgentSubsystem
-  readonly health: WorkspaceAgentHealth
+  readonly id: string;
+  readonly created_at: string;
+  readonly updated_at: string;
+  readonly first_connected_at?: string;
+  readonly last_connected_at?: string;
+  readonly disconnected_at?: string;
+  readonly started_at?: string;
+  readonly ready_at?: string;
+  readonly status: WorkspaceAgentStatus;
+  readonly lifecycle_state: WorkspaceAgentLifecycle;
+  readonly name: string;
+  readonly resource_id: string;
+  readonly instance_id?: string;
+  readonly architecture: string;
+  readonly environment_variables: Record<string, string>;
+  readonly operating_system: string;
+  readonly logs_length: number;
+  readonly logs_overflowed: boolean;
+  readonly directory?: string;
+  readonly expanded_directory?: string;
+  readonly version: string;
+  readonly apps: WorkspaceApp[];
+  readonly latency?: Record<string, DERPRegion>;
+  readonly connection_timeout_seconds: number;
+  readonly troubleshooting_url: string;
+  readonly subsystems: AgentSubsystem[];
+  readonly health: WorkspaceAgentHealth;
+  readonly display_apps: DisplayApp[];
+  readonly log_sources: WorkspaceAgentLogSource[];
+  readonly scripts: WorkspaceAgentScript[];
+  readonly startup_script_behavior: WorkspaceAgentStartupScriptBehavior;
 }
 
 // From codersdk/workspaceagents.go
 export interface WorkspaceAgentHealth {
-  readonly healthy: boolean
-  readonly reason?: string
+  readonly healthy: boolean;
+  readonly reason?: string;
 }
 
 // From codersdk/workspaceagentconn.go
 export interface WorkspaceAgentListeningPort {
-  readonly process_name: string
-  readonly network: string
-  readonly port: number
+  readonly process_name: string;
+  readonly network: string;
+  readonly port: number;
 }
 
 // From codersdk/workspaceagentconn.go
 export interface WorkspaceAgentListeningPortsResponse {
-  readonly ports: WorkspaceAgentListeningPort[]
+  readonly ports: WorkspaceAgentListeningPort[];
 }
 
 // From codersdk/workspaceagents.go
 export interface WorkspaceAgentLog {
-  readonly id: number
-  readonly created_at: string
-  readonly output: string
-  readonly level: LogLevel
+  readonly id: number;
+  readonly created_at: string;
+  readonly output: string;
+  readonly level: LogLevel;
+  readonly source_id: string;
+}
+
+// From codersdk/workspaceagents.go
+export interface WorkspaceAgentLogSource {
+  readonly workspace_agent_id: string;
+  readonly id: string;
+  readonly created_at: string;
+  readonly display_name: string;
+  readonly icon: string;
 }
 
 // From codersdk/workspaceagents.go
 export interface WorkspaceAgentMetadata {
-  readonly result: WorkspaceAgentMetadataResult
-  readonly description: WorkspaceAgentMetadataDescription
+  readonly result: WorkspaceAgentMetadataResult;
+  readonly description: WorkspaceAgentMetadataDescription;
 }
 
 // From codersdk/workspaceagents.go
 export interface WorkspaceAgentMetadataDescription {
-  readonly display_name: string
-  readonly key: string
-  readonly script: string
-  readonly interval: number
-  readonly timeout: number
+  readonly display_name: string;
+  readonly key: string;
+  readonly script: string;
+  readonly interval: number;
+  readonly timeout: number;
 }
 
 // From codersdk/workspaceagents.go
 export interface WorkspaceAgentMetadataResult {
-  readonly collected_at: string
-  readonly age: number
-  readonly value: string
-  readonly error: string
+  readonly collected_at: string;
+  readonly age: number;
+  readonly value: string;
+  readonly error: string;
+}
+
+// From codersdk/workspaceagents.go
+export interface WorkspaceAgentScript {
+  readonly log_source_id: string;
+  readonly log_path: string;
+  readonly script: string;
+  readonly cron: string;
+  readonly run_on_start: boolean;
+  readonly run_on_stop: boolean;
+  readonly start_blocks_login: boolean;
+  readonly timeout: number;
 }
 
 // From codersdk/workspaceapps.go
 export interface WorkspaceApp {
-  readonly id: string
-  readonly url: string
-  readonly external: boolean
-  readonly slug: string
-  readonly display_name: string
-  readonly command?: string
-  readonly icon?: string
-  readonly subdomain: boolean
-  readonly sharing_level: WorkspaceAppSharingLevel
-  readonly healthcheck: Healthcheck
-  readonly health: WorkspaceAppHealth
+  readonly id: string;
+  readonly url: string;
+  readonly external: boolean;
+  readonly slug: string;
+  readonly display_name: string;
+  readonly command?: string;
+  readonly icon?: string;
+  readonly subdomain: boolean;
+  readonly subdomain_name?: string;
+  readonly sharing_level: WorkspaceAppSharingLevel;
+  readonly healthcheck: Healthcheck;
+  readonly health: WorkspaceAppHealth;
 }
 
 // From codersdk/workspacebuilds.go
 export interface WorkspaceBuild {
-  readonly id: string
-  readonly created_at: string
-  readonly updated_at: string
-  readonly workspace_id: string
-  readonly workspace_name: string
-  readonly workspace_owner_id: string
-  readonly workspace_owner_name: string
-  readonly template_version_id: string
-  readonly template_version_name: string
-  readonly build_number: number
-  readonly transition: WorkspaceTransition
-  readonly initiator_id: string
-  readonly initiator_name: string
-  readonly job: ProvisionerJob
-  readonly reason: BuildReason
-  readonly resources: WorkspaceResource[]
-  readonly deadline?: string
-  readonly max_deadline?: string
-  readonly status: WorkspaceStatus
-  readonly daily_cost: number
+  readonly id: string;
+  readonly created_at: string;
+  readonly updated_at: string;
+  readonly workspace_id: string;
+  readonly workspace_name: string;
+  readonly workspace_owner_id: string;
+  readonly workspace_owner_name: string;
+  readonly template_version_id: string;
+  readonly template_version_name: string;
+  readonly build_number: number;
+  readonly transition: WorkspaceTransition;
+  readonly initiator_id: string;
+  readonly initiator_name: string;
+  readonly job: ProvisionerJob;
+  readonly reason: BuildReason;
+  readonly resources: WorkspaceResource[];
+  readonly deadline?: string;
+  readonly max_deadline?: string;
+  readonly status: WorkspaceStatus;
+  readonly daily_cost: number;
 }
 
 // From codersdk/workspacebuilds.go
 export interface WorkspaceBuildParameter {
-  readonly name: string
-  readonly value: string
+  readonly name: string;
+  readonly value: string;
 }
 
 // From codersdk/workspaces.go
 export interface WorkspaceBuildsRequest extends Pagination {
-  readonly WorkspaceID: string
-  readonly Since: string
+  readonly since?: string;
 }
 
 // From codersdk/deployment.go
 export interface WorkspaceConnectionLatencyMS {
-  readonly P50: number
-  readonly P95: number
+  readonly P50: number;
+  readonly P95: number;
 }
 
 // From codersdk/deployment.go
 export interface WorkspaceDeploymentStats {
-  readonly pending: number
-  readonly building: number
-  readonly running: number
-  readonly failed: number
-  readonly stopped: number
-  readonly connection_latency_ms: WorkspaceConnectionLatencyMS
-  readonly rx_bytes: number
-  readonly tx_bytes: number
+  readonly pending: number;
+  readonly building: number;
+  readonly running: number;
+  readonly failed: number;
+  readonly stopped: number;
+  readonly connection_latency_ms: WorkspaceConnectionLatencyMS;
+  readonly rx_bytes: number;
+  readonly tx_bytes: number;
 }
 
 // From codersdk/workspaces.go
 export interface WorkspaceFilter {
-  readonly q?: string
+  readonly q?: string;
 }
 
 // From codersdk/workspaces.go
 export interface WorkspaceHealth {
-  readonly healthy: boolean
-  readonly failing_agents: string[]
+  readonly healthy: boolean;
+  readonly failing_agents: string[];
 }
 
 // From codersdk/workspaces.go
 export interface WorkspaceOptions {
-  readonly include_deleted?: boolean
+  readonly include_deleted?: boolean;
 }
 
 // From codersdk/workspaceproxy.go
 export interface WorkspaceProxy extends Region {
-  readonly derp_enabled: boolean
-  readonly derp_only: boolean
-  readonly status?: WorkspaceProxyStatus
-  readonly created_at: string
-  readonly updated_at: string
-  readonly deleted: boolean
+  readonly derp_enabled: boolean;
+  readonly derp_only: boolean;
+  readonly status?: WorkspaceProxyStatus;
+  readonly created_at: string;
+  readonly updated_at: string;
+  readonly deleted: boolean;
 }
 
 // From codersdk/deployment.go
 export interface WorkspaceProxyBuildInfo {
-  readonly workspace_proxy: boolean
-  readonly dashboard_url: string
+  readonly workspace_proxy: boolean;
+  readonly dashboard_url: string;
 }
 
 // From codersdk/workspaceproxy.go
 export interface WorkspaceProxyStatus {
-  readonly status: ProxyHealthStatus
-  readonly report?: ProxyHealthReport
-  readonly checked_at: string
+  readonly status: ProxyHealthStatus;
+  readonly report?: ProxyHealthReport;
+  readonly checked_at: string;
 }
 
 // From codersdk/workspaces.go
 export interface WorkspaceQuota {
-  readonly credits_consumed: number
-  readonly budget: number
+  readonly credits_consumed: number;
+  readonly budget: number;
 }
 
 // From codersdk/workspacebuilds.go
 export interface WorkspaceResource {
-  readonly id: string
-  readonly created_at: string
-  readonly job_id: string
-  readonly workspace_transition: WorkspaceTransition
-  readonly type: string
-  readonly name: string
-  readonly hide: boolean
-  readonly icon: string
-  readonly agents?: WorkspaceAgent[]
-  readonly metadata?: WorkspaceResourceMetadata[]
-  readonly daily_cost: number
+  readonly id: string;
+  readonly created_at: string;
+  readonly job_id: string;
+  readonly workspace_transition: WorkspaceTransition;
+  readonly type: string;
+  readonly name: string;
+  readonly hide: boolean;
+  readonly icon: string;
+  readonly agents?: WorkspaceAgent[];
+  readonly metadata?: WorkspaceResourceMetadata[];
+  readonly daily_cost: number;
 }
 
 // From codersdk/workspacebuilds.go
 export interface WorkspaceResourceMetadata {
-  readonly key: string
-  readonly value: string
-  readonly sensitive: boolean
+  readonly key: string;
+  readonly value: string;
+  readonly sensitive: boolean;
 }
 
 // From codersdk/workspaces.go
 export interface WorkspacesRequest extends Pagination {
-  readonly q?: string
+  readonly q?: string;
 }
 
 // From codersdk/workspaces.go
 export interface WorkspacesResponse {
-  readonly workspaces: Workspace[]
-  readonly count: number
+  readonly workspaces: Workspace[];
+  readonly count: number;
 }
 
 // From codersdk/apikey.go
-export type APIKeyScope = "all" | "application_connect"
-export const APIKeyScopes: APIKeyScope[] = ["all", "application_connect"]
+export type APIKeyScope = "all" | "application_connect";
+export const APIKeyScopes: APIKeyScope[] = ["all", "application_connect"];
 
 // From codersdk/workspaceagents.go
-export type AgentSubsystem = "envbox"
-export const AgentSubsystems: AgentSubsystem[] = ["envbox"]
+export type AgentSubsystem = "envbox" | "envbuilder" | "exectrace";
+export const AgentSubsystems: AgentSubsystem[] = [
+  "envbox",
+  "envbuilder",
+  "exectrace",
+];
 
 // From codersdk/audit.go
 export type AuditAction =
@@ -1549,7 +1638,7 @@ export type AuditAction =
   | "register"
   | "start"
   | "stop"
-  | "write"
+  | "write";
 export const AuditActions: AuditAction[] = [
   "create",
   "delete",
@@ -1559,111 +1648,155 @@ export const AuditActions: AuditAction[] = [
   "start",
   "stop",
   "write",
-]
+];
+
+// From codersdk/workspaces.go
+export type AutomaticUpdates = "always" | "never";
+export const AutomaticUpdateses: AutomaticUpdates[] = ["always", "never"];
 
 // From codersdk/workspacebuilds.go
-export type BuildReason = "autostart" | "autostop" | "initiator"
+export type BuildReason = "autostart" | "autostop" | "initiator";
 export const BuildReasons: BuildReason[] = [
   "autostart",
   "autostop",
   "initiator",
-]
+];
+
+// From codersdk/workspaceagents.go
+export type DisplayApp =
+  | "port_forwarding_helper"
+  | "ssh_helper"
+  | "vscode"
+  | "vscode_insiders"
+  | "web_terminal";
+export const DisplayApps: DisplayApp[] = [
+  "port_forwarding_helper",
+  "ssh_helper",
+  "vscode",
+  "vscode_insiders",
+  "web_terminal",
+];
+
+// From codersdk/externalauth.go
+export type EnhancedExternalAuthProvider =
+  | "azure-devops"
+  | "bitbucket"
+  | "github"
+  | "gitlab"
+  | "slack";
+export const EnhancedExternalAuthProviders: EnhancedExternalAuthProvider[] = [
+  "azure-devops",
+  "bitbucket",
+  "github",
+  "gitlab",
+  "slack",
+];
 
 // From codersdk/deployment.go
-export type Entitlement = "entitled" | "grace_period" | "not_entitled"
+export type Entitlement = "entitled" | "grace_period" | "not_entitled";
 export const Entitlements: Entitlement[] = [
   "entitled",
   "grace_period",
   "not_entitled",
-]
+];
 
 // From codersdk/deployment.go
 export type Experiment =
+  | "dashboard_theme"
   | "deployment_health_page"
   | "moons"
   | "single_tailnet"
   | "tailnet_pg_coordinator"
-  | "template_restart_requirement"
-  | "workspace_actions"
+  | "template_autostop_requirement"
+  | "template_update_policies"
+  | "workspace_actions";
 export const Experiments: Experiment[] = [
+  "dashboard_theme",
   "deployment_health_page",
   "moons",
   "single_tailnet",
   "tailnet_pg_coordinator",
-  "template_restart_requirement",
+  "template_autostop_requirement",
+  "template_update_policies",
   "workspace_actions",
-]
+];
 
 // From codersdk/deployment.go
 export type FeatureName =
+  | "access_control"
   | "advanced_template_scheduling"
   | "appearance"
   | "audit_log"
   | "browser_only"
   | "external_provisioner_daemons"
+  | "external_token_encryption"
   | "high_availability"
-  | "multiple_git_auth"
+  | "multiple_external_auth"
   | "scim"
+  | "template_autostop_requirement"
   | "template_rbac"
-  | "template_restart_requirement"
   | "user_limit"
   | "user_role_management"
-  | "workspace_proxy"
+  | "workspace_batch_actions"
+  | "workspace_proxy";
 export const FeatureNames: FeatureName[] = [
+  "access_control",
   "advanced_template_scheduling",
   "appearance",
   "audit_log",
   "browser_only",
   "external_provisioner_daemons",
+  "external_token_encryption",
   "high_availability",
-  "multiple_git_auth",
+  "multiple_external_auth",
   "scim",
+  "template_autostop_requirement",
   "template_rbac",
-  "template_restart_requirement",
   "user_limit",
   "user_role_management",
+  "workspace_batch_actions",
   "workspace_proxy",
-]
+];
 
-// From codersdk/workspaceagents.go
-export type GitProvider = "azure-devops" | "bitbucket" | "github" | "gitlab"
-export const GitProviders: GitProvider[] = [
-  "azure-devops",
-  "bitbucket",
-  "github",
-  "gitlab",
-]
+// From codersdk/groups.go
+export type GroupSource = "oidc" | "user";
+export const GroupSources: GroupSource[] = ["oidc", "user"];
 
 // From codersdk/insights.go
-export type InsightsReportInterval = "day"
-export const InsightsReportIntervals: InsightsReportInterval[] = ["day"]
+export type InsightsReportInterval = "day" | "week";
+export const InsightsReportIntervals: InsightsReportInterval[] = [
+  "day",
+  "week",
+];
 
 // From codersdk/provisionerdaemons.go
-export type JobErrorCode =
-  | "MISSING_TEMPLATE_PARAMETER"
-  | "REQUIRED_TEMPLATE_VARIABLES"
-export const JobErrorCodes: JobErrorCode[] = [
-  "MISSING_TEMPLATE_PARAMETER",
-  "REQUIRED_TEMPLATE_VARIABLES",
-]
+export type JobErrorCode = "REQUIRED_TEMPLATE_VARIABLES";
+export const JobErrorCodes: JobErrorCode[] = ["REQUIRED_TEMPLATE_VARIABLES"];
 
 // From codersdk/provisionerdaemons.go
-export type LogLevel = "debug" | "error" | "info" | "trace" | "warn"
-export const LogLevels: LogLevel[] = ["debug", "error", "info", "trace", "warn"]
+export type LogLevel = "debug" | "error" | "info" | "trace" | "warn";
+export const LogLevels: LogLevel[] = [
+  "debug",
+  "error",
+  "info",
+  "trace",
+  "warn",
+];
 
 // From codersdk/provisionerdaemons.go
-export type LogSource = "provisioner" | "provisioner_daemon"
-export const LogSources: LogSource[] = ["provisioner", "provisioner_daemon"]
+export type LogSource = "provisioner" | "provisioner_daemon";
+export const LogSources: LogSource[] = ["provisioner", "provisioner_daemon"];
 
 // From codersdk/apikey.go
-export type LoginType = "github" | "none" | "oidc" | "password" | "token"
+export type LoginType = "" | "github" | "none" | "oidc" | "password" | "token";
 export const LoginTypes: LoginType[] = [
+  "",
   "github",
   "none",
   "oidc",
   "password",
   "token",
-]
+];
 
 // From codersdk/provisionerdaemons.go
 export type ProvisionerJobStatus =
@@ -1673,6 +1806,7 @@ export type ProvisionerJobStatus =
   | "pending"
   | "running"
   | "succeeded"
+  | "unknown";
 export const ProvisionerJobStatuses: ProvisionerJobStatus[] = [
   "canceled",
   "canceling",
@@ -1680,32 +1814,33 @@ export const ProvisionerJobStatuses: ProvisionerJobStatus[] = [
   "pending",
   "running",
   "succeeded",
-]
+  "unknown",
+];
 
 // From codersdk/workspaces.go
-export type ProvisionerLogLevel = "debug"
-export const ProvisionerLogLevels: ProvisionerLogLevel[] = ["debug"]
+export type ProvisionerLogLevel = "debug";
+export const ProvisionerLogLevels: ProvisionerLogLevel[] = ["debug"];
 
 // From codersdk/organizations.go
-export type ProvisionerStorageMethod = "file"
-export const ProvisionerStorageMethods: ProvisionerStorageMethod[] = ["file"]
+export type ProvisionerStorageMethod = "file";
+export const ProvisionerStorageMethods: ProvisionerStorageMethod[] = ["file"];
 
 // From codersdk/organizations.go
-export type ProvisionerType = "echo" | "terraform"
-export const ProvisionerTypes: ProvisionerType[] = ["echo", "terraform"]
+export type ProvisionerType = "echo" | "terraform";
+export const ProvisionerTypes: ProvisionerType[] = ["echo", "terraform"];
 
 // From codersdk/workspaceproxy.go
 export type ProxyHealthStatus =
   | "ok"
   | "unhealthy"
   | "unreachable"
-  | "unregistered"
+  | "unregistered";
 export const ProxyHealthStatuses: ProxyHealthStatus[] = [
   "ok",
   "unhealthy",
   "unreachable",
   "unregistered",
-]
+];
 
 // From codersdk/rbacresources.go
 export type RBACResource =
@@ -1730,7 +1865,7 @@ export type RBACResource =
   | "user_data"
   | "workspace"
   | "workspace_execution"
-  | "workspace_proxy"
+  | "workspace_proxy";
 export const RBACResources: RBACResource[] = [
   "api_key",
   "application_connect",
@@ -1754,7 +1889,7 @@ export const RBACResources: RBACResource[] = [
   "workspace",
   "workspace_execution",
   "workspace_proxy",
-]
+];
 
 // From codersdk/audit.go
 export type ResourceType =
@@ -1763,56 +1898,67 @@ export type ResourceType =
   | "git_ssh_key"
   | "group"
   | "license"
+  | "organization"
   | "template"
   | "template_version"
   | "user"
   | "workspace"
   | "workspace_build"
+  | "workspace_proxy";
 export const ResourceTypes: ResourceType[] = [
   "api_key",
   "convert_login",
   "git_ssh_key",
   "group",
   "license",
+  "organization",
   "template",
   "template_version",
   "user",
   "workspace",
   "workspace_build",
-]
+  "workspace_proxy",
+];
 
 // From codersdk/serversentevents.go
-export type ServerSentEventType = "data" | "error" | "ping"
+export type ServerSentEventType = "data" | "error" | "ping";
 export const ServerSentEventTypes: ServerSentEventType[] = [
   "data",
   "error",
   "ping",
-]
+];
+
+// From codersdk/insights.go
+export type TemplateAppsType = "app" | "builtin";
+export const TemplateAppsTypes: TemplateAppsType[] = ["app", "builtin"];
 
 // From codersdk/insights.go
-export type TemplateAppsType = "builtin"
-export const TemplateAppsTypes: TemplateAppsType[] = ["builtin"]
+export type TemplateInsightsSection = "interval_reports" | "report";
+export const TemplateInsightsSections: TemplateInsightsSection[] = [
+  "interval_reports",
+  "report",
+];
 
 // From codersdk/templates.go
-export type TemplateRole = "" | "admin" | "use"
-export const TemplateRoles: TemplateRole[] = ["", "admin", "use"]
+export type TemplateRole = "" | "admin" | "use";
+export const TemplateRoles: TemplateRole[] = ["", "admin", "use"];
 
 // From codersdk/templateversions.go
-export type TemplateVersionWarning = "UNSUPPORTED_WORKSPACES"
+export type TemplateVersionWarning = "UNSUPPORTED_WORKSPACES";
 export const TemplateVersionWarnings: TemplateVersionWarning[] = [
   "UNSUPPORTED_WORKSPACES",
-]
+];
 
 // From codersdk/users.go
-export type UserStatus = "active" | "dormant" | "suspended"
-export const UserStatuses: UserStatus[] = ["active", "dormant", "suspended"]
+export type UserStatus = "active" | "dormant" | "suspended";
+export const UserStatuses: UserStatus[] = ["active", "dormant", "suspended"];
 
 // From codersdk/templateversions.go
-export type ValidationMonotonicOrder = "decreasing" | "increasing"
+export type ValidationMonotonicOrder = "decreasing" | "increasing";
 export const ValidationMonotonicOrders: ValidationMonotonicOrder[] = [
   "decreasing",
   "increasing",
-]
+];
 
 // From codersdk/workspaceagents.go
 export type WorkspaceAgentLifecycle =
@@ -1824,7 +1970,7 @@ export type WorkspaceAgentLifecycle =
   | "shutting_down"
   | "start_error"
   | "start_timeout"
-  | "starting"
+  | "starting";
 export const WorkspaceAgentLifecycles: WorkspaceAgentLifecycle[] = [
   "created",
   "off",
@@ -1835,63 +1981,46 @@ export const WorkspaceAgentLifecycles: WorkspaceAgentLifecycle[] = [
   "start_error",
   "start_timeout",
   "starting",
-]
-
-// From codersdk/workspaceagents.go
-export type WorkspaceAgentLogSource =
-  | "envbox"
-  | "envbuilder"
-  | "external"
-  | "kubernetes"
-  | "shutdown_script"
-  | "startup_script"
-export const WorkspaceAgentLogSources: WorkspaceAgentLogSource[] = [
-  "envbox",
-  "envbuilder",
-  "external",
-  "kubernetes",
-  "shutdown_script",
-  "startup_script",
-]
+];
 
 // From codersdk/workspaceagents.go
-export type WorkspaceAgentStartupScriptBehavior = "blocking" | "non-blocking"
+export type WorkspaceAgentStartupScriptBehavior = "blocking" | "non-blocking";
 export const WorkspaceAgentStartupScriptBehaviors: WorkspaceAgentStartupScriptBehavior[] =
-  ["blocking", "non-blocking"]
+  ["blocking", "non-blocking"];
 
 // From codersdk/workspaceagents.go
 export type WorkspaceAgentStatus =
   | "connected"
   | "connecting"
   | "disconnected"
-  | "timeout"
+  | "timeout";
 export const WorkspaceAgentStatuses: WorkspaceAgentStatus[] = [
   "connected",
   "connecting",
   "disconnected",
   "timeout",
-]
+];
 
 // From codersdk/workspaceapps.go
 export type WorkspaceAppHealth =
   | "disabled"
   | "healthy"
   | "initializing"
-  | "unhealthy"
+  | "unhealthy";
 export const WorkspaceAppHealths: WorkspaceAppHealth[] = [
   "disabled",
   "healthy",
   "initializing",
   "unhealthy",
-]
+];
 
 // From codersdk/workspaceapps.go
-export type WorkspaceAppSharingLevel = "authenticated" | "owner" | "public"
+export type WorkspaceAppSharingLevel = "authenticated" | "owner" | "public";
 export const WorkspaceAppSharingLevels: WorkspaceAppSharingLevel[] = [
   "authenticated",
   "owner",
   "public",
-]
+];
 
 // From codersdk/workspacebuilds.go
 export type WorkspaceStatus =
@@ -1904,7 +2033,7 @@ export type WorkspaceStatus =
   | "running"
   | "starting"
   | "stopped"
-  | "stopping"
+  | "stopping";
 export const WorkspaceStatuses: WorkspaceStatus[] = [
   "canceled",
   "canceling",
@@ -1916,104 +2045,153 @@ export const WorkspaceStatuses: WorkspaceStatus[] = [
   "starting",
   "stopped",
   "stopping",
-]
+];
 
 // From codersdk/workspacebuilds.go
-export type WorkspaceTransition = "delete" | "start" | "stop"
+export type WorkspaceTransition = "delete" | "start" | "stop";
 export const WorkspaceTransitions: WorkspaceTransition[] = [
   "delete",
   "start",
   "stop",
-]
+];
 
 // From codersdk/workspaceproxy.go
-export type RegionTypes = Region | WorkspaceProxy
+export type RegionTypes = Region | WorkspaceProxy;
 
 // The code below is generated from coderd/healthcheck.
 
 // From healthcheck/accessurl.go
 export interface HealthcheckAccessURLReport {
-  readonly access_url: string
-  readonly healthy: boolean
-  readonly reachable: boolean
-  readonly status_code: number
-  readonly healthz_response: string
-  readonly error?: string
-}
-
-// From healthcheck/derp.go
-export interface HealthcheckDERPNodeReport {
-  readonly healthy: boolean
-  // Named type "tailscale.com/tailcfg.DERPNode" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly node?: any
-  // Named type "tailscale.com/derp.ServerInfoMessage" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly node_info: any
-  readonly can_exchange_messages: boolean
-  readonly round_trip_ping: string
-  readonly round_trip_ping_ms: number
-  readonly uses_websocket: boolean
-  readonly client_logs: string[][]
-  readonly client_errs: string[][]
-  readonly error?: string
-  readonly stun: HealthcheckDERPStunReport
-}
-
-// From healthcheck/derp.go
-export interface HealthcheckDERPRegionReport {
-  readonly healthy: boolean
-  // Named type "tailscale.com/tailcfg.DERPRegion" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly region?: any
-  readonly node_reports: HealthcheckDERPNodeReport[]
-  readonly error?: string
-}
-
-// From healthcheck/derp.go
-export interface HealthcheckDERPReport {
-  readonly healthy: boolean
-  readonly regions: Record<number, HealthcheckDERPRegionReport>
-  // Named type "tailscale.com/net/netcheck.Report" unknown, using "any"
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
-  readonly netcheck?: any
-  readonly netcheck_err?: string
-  readonly netcheck_logs: string[]
-  readonly error?: string
-}
-
-// From healthcheck/derp.go
-export interface HealthcheckDERPStunReport {
-  readonly Enabled: boolean
-  readonly CanSTUN: boolean
-  readonly Error?: string
+  readonly access_url: string;
+  readonly healthy: boolean;
+  readonly reachable: boolean;
+  readonly status_code: number;
+  readonly healthz_response: string;
+  readonly error?: string;
 }
 
 // From healthcheck/database.go
 export interface HealthcheckDatabaseReport {
-  readonly healthy: boolean
-  readonly reachable: boolean
-  readonly latency: string
-  readonly latency_ms: number
-  readonly error?: string
+  readonly healthy: boolean;
+  readonly reachable: boolean;
+  readonly latency: string;
+  readonly latency_ms: number;
+  readonly error?: string;
 }
 
 // From healthcheck/healthcheck.go
 export interface HealthcheckReport {
-  readonly time: string
-  readonly healthy: boolean
-  readonly failing_sections: string[]
-  readonly derp: HealthcheckDERPReport
-  readonly access_url: HealthcheckAccessURLReport
-  readonly websocket: HealthcheckWebsocketReport
-  readonly database: HealthcheckDatabaseReport
-  readonly coder_version: string
+  readonly time: string;
+  readonly healthy: boolean;
+  readonly failing_sections: string[];
+  // Named type "github.com/coder/coder/v2/coderd/healthcheck/derphealth.Report" unknown, using "any"
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
+  readonly derp: any;
+  readonly access_url: HealthcheckAccessURLReport;
+  readonly websocket: HealthcheckWebsocketReport;
+  readonly database: HealthcheckDatabaseReport;
+  readonly coder_version: string;
 }
 
 // From healthcheck/websocket.go
 export interface HealthcheckWebsocketReport {
-  readonly healthy: boolean
-  readonly body: string
-  readonly code: number
-  readonly error?: string
+  readonly healthy: boolean;
+  readonly body: string;
+  readonly code: number;
+  readonly error?: string;
 }
+
+// The code below is generated from coderd/healthcheck/derphealth.
+
+// From derphealth/derp.go
+export interface DerphealthNodeReport {
+  readonly healthy: boolean;
+  // Named type "tailscale.com/tailcfg.DERPNode" unknown, using "any"
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
+  readonly node?: any;
+  // Named type "tailscale.com/derp.ServerInfoMessage" unknown, using "any"
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
+  readonly node_info: any;
+  readonly can_exchange_messages: boolean;
+  readonly round_trip_ping: string;
+  readonly round_trip_ping_ms: number;
+  readonly uses_websocket: boolean;
+  readonly client_logs: string[][];
+  readonly client_errs: string[][];
+  readonly error?: string;
+  readonly stun: DerphealthStunReport;
+}
+
+// From derphealth/derp.go
+export interface DerphealthRegionReport {
+  readonly healthy: boolean;
+  // Named type "tailscale.com/tailcfg.DERPRegion" unknown, using "any"
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
+  readonly region?: any;
+  readonly node_reports: DerphealthNodeReport[];
+  readonly error?: string;
+}
+
+// From derphealth/derp.go
+export interface DerphealthReport {
+  readonly healthy: boolean;
+  readonly regions: Record<number, DerphealthRegionReport>;
+  // Named type "tailscale.com/net/netcheck.Report" unknown, using "any"
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- External type
+  readonly netcheck?: any;
+  readonly netcheck_err?: string;
+  readonly netcheck_logs: string[];
+  readonly error?: string;
+}
+
+// From derphealth/derp.go
+export interface DerphealthStunReport {
+  readonly Enabled: boolean;
+  readonly CanSTUN: boolean;
+  readonly Error?: string;
+}
+
+// The code below is generated from cli/clibase.
+
+// From clibase/clibase.go
+export type ClibaseAnnotations = Record<string, string>;
+
+// From clibase/clibase.go
+export interface ClibaseGroup {
+  readonly parent?: ClibaseGroup;
+  readonly name?: string;
+  readonly yaml?: string;
+  readonly description?: string;
+}
+
+// From clibase/option.go
+export interface ClibaseOption {
+  readonly name?: string;
+  readonly description?: string;
+  readonly required?: boolean;
+  readonly flag?: string;
+  readonly flag_shorthand?: string;
+  readonly env?: string;
+  readonly yaml?: string;
+  readonly default?: string;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Golang interface, unable to resolve type.
+  readonly value?: any;
+  readonly annotations?: ClibaseAnnotations;
+  readonly group?: ClibaseGroup;
+  readonly use_instead?: ClibaseOption[];
+  readonly hidden?: boolean;
+  readonly value_source?: ClibaseValueSource;
+}
+
+// From clibase/option.go
+export type ClibaseOptionSet = ClibaseOption[];
+
+// From clibase/option.go
+export type ClibaseValueSource = "" | "default" | "env" | "flag" | "yaml";
+export const ClibaseValueSources: ClibaseValueSource[] = [
+  "",
+  "default",
+  "env",
+  "flag",
+  "yaml",
+];
diff --git a/site/src/app.tsx b/site/src/app.tsx
deleted file mode 100644
index af58e5641b2b0..0000000000000
--- a/site/src/app.tsx
+++ /dev/null
@@ -1,50 +0,0 @@
-import CssBaseline from "@mui/material/CssBaseline"
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
-import { AuthProvider } from "components/AuthProvider/AuthProvider"
-import { FC, PropsWithChildren } from "react"
-import { HelmetProvider } from "react-helmet-async"
-import { AppRouter } from "./AppRouter"
-import { ErrorBoundary } from "./components/ErrorBoundary/ErrorBoundary"
-import { GlobalSnackbar } from "./components/GlobalSnackbar/GlobalSnackbar"
-import { dark } from "./theme"
-import "./theme/globalFonts"
-import { StyledEngineProvider, ThemeProvider } from "@mui/material/styles"
-
-const queryClient = new QueryClient({
-  defaultOptions: {
-    queries: {
-      retry: false,
-      cacheTime: 0,
-      refetchOnWindowFocus: false,
-      networkMode: "offlineFirst",
-    },
-  },
-})
-
-export const AppProviders: FC<PropsWithChildren> = ({ children }) => {
-  return (
-    <HelmetProvider>
-      <StyledEngineProvider injectFirst>
-        <ThemeProvider theme={dark}>
-          <CssBaseline enableColorScheme />
-          <ErrorBoundary>
-            <QueryClientProvider client={queryClient}>
-              <AuthProvider>
-                {children}
-                <GlobalSnackbar />
-              </AuthProvider>
-            </QueryClientProvider>
-          </ErrorBoundary>
-        </ThemeProvider>
-      </StyledEngineProvider>
-    </HelmetProvider>
-  )
-}
-
-export const App: FC = () => {
-  return (
-    <AppProviders>
-      <AppRouter />
-    </AppProviders>
-  )
-}
diff --git a/site/src/components/ActiveUserChart/ActiveUserChart.tsx b/site/src/components/ActiveUserChart/ActiveUserChart.tsx
new file mode 100644
index 0000000000000..15ff04864ccb1
--- /dev/null
+++ b/site/src/components/ActiveUserChart/ActiveUserChart.tsx
@@ -0,0 +1,165 @@
+import Box from "@mui/material/Box";
+import { Theme } from "@mui/material/styles";
+import useTheme from "@mui/styles/useTheme";
+import {
+  CategoryScale,
+  Chart as ChartJS,
+  ChartOptions,
+  defaults,
+  Filler,
+  Legend,
+  LinearScale,
+  LineElement,
+  TimeScale,
+  Title,
+  Tooltip,
+  PointElement,
+} from "chart.js";
+import "chartjs-adapter-date-fns";
+import {
+  HelpTooltip,
+  HelpTooltipTitle,
+  HelpTooltipText,
+} from "components/HelpTooltip/HelpTooltip";
+import dayjs from "dayjs";
+import { FC } from "react";
+import { Line } from "react-chartjs-2";
+import annotationPlugin from "chartjs-plugin-annotation";
+
+ChartJS.register(
+  CategoryScale,
+  LinearScale,
+  TimeScale,
+  LineElement,
+  PointElement,
+  Filler,
+  Title,
+  Tooltip,
+  Legend,
+  annotationPlugin,
+);
+
+const USER_LIMIT_DISPLAY_THRESHOLD = 60;
+
+export interface ActiveUserChartProps {
+  data: { date: string; amount: number }[];
+  interval: "day" | "week";
+  userLimit: number | undefined;
+}
+
+export const ActiveUserChart: FC<ActiveUserChartProps> = ({
+  data,
+  interval,
+  userLimit,
+}) => {
+  const theme: Theme = useTheme();
+
+  const labels = data.map((val) => dayjs(val.date).format("YYYY-MM-DD"));
+  const chartData = data.map((val) => val.amount);
+
+  defaults.font.family = theme.typography.fontFamily as string;
+  defaults.color = theme.palette.text.secondary;
+
+  const options: ChartOptions<"line"> = {
+    responsive: true,
+    plugins: {
+      annotation: {
+        annotations: [
+          {
+            type: "line",
+            scaleID: "y",
+            display: shouldDisplayUserLimit(userLimit, chartData),
+            value: userLimit,
+            borderColor: theme.palette.secondary.contrastText,
+            borderWidth: 5,
+            label: {
+              content: "User limit",
+              color: theme.palette.primary.contrastText,
+              display: true,
+              font: { weight: "normal" },
+            },
+          },
+        ],
+      },
+      legend: {
+        display: false,
+      },
+      tooltip: {
+        displayColors: false,
+        callbacks: {
+          title: (context) => {
+            const date = new Date(context[0].parsed.x);
+            return date.toLocaleDateString();
+          },
+        },
+      },
+    },
+    scales: {
+      y: {
+        suggestedMin: 0,
+        ticks: {
+          precision: 0,
+        },
+      },
+
+      x: {
+        ticks: {
+          stepSize: data.length > 10 ? 2 : undefined,
+        },
+        type: "time",
+        time: {
+          unit: interval,
+        },
+      },
+    },
+    maintainAspectRatio: false,
+  };
+
+  return (
+    <Line
+      data-chromatic="ignore"
+      data={{
+        labels: labels,
+        datasets: [
+          {
+            label: `${interval === "day" ? "Daily" : "Weekly"} Active Users`,
+            data: chartData,
+            pointBackgroundColor: theme.palette.info.light,
+            pointBorderColor: theme.palette.info.light,
+            borderColor: theme.palette.info.light,
+            backgroundColor: theme.palette.info.dark,
+            fill: "origin",
+          },
+        ],
+      }}
+      options={options}
+    />
+  );
+};
+
+export const ActiveUsersTitle = () => {
+  return (
+    <Box sx={{ display: "flex", alignItems: "center", gap: 1 }}>
+      Active Users
+      <HelpTooltip size="small">
+        <HelpTooltipTitle>How do we calculate active users?</HelpTooltipTitle>
+        <HelpTooltipText>
+          When a connection is initiated to a user&apos;s workspace they are
+          considered an active user. e.g. apps, web terminal, SSH
+        </HelpTooltipText>
+      </HelpTooltip>
+    </Box>
+  );
+};
+
+function shouldDisplayUserLimit(
+  userLimit: number | undefined,
+  activeUsers: number[],
+): boolean {
+  if (!userLimit || activeUsers.length === 0) {
+    return false;
+  }
+  return (
+    Math.max(...activeUsers) >= (userLimit * USER_LIMIT_DISPLAY_THRESHOLD) / 100
+  );
+}
diff --git a/site/src/components/Alert/Alert.stories.tsx b/site/src/components/Alert/Alert.stories.tsx
index ada32cd994ec9..797157de85abb 100644
--- a/site/src/components/Alert/Alert.stories.tsx
+++ b/site/src/components/Alert/Alert.stories.tsx
@@ -1,28 +1,34 @@
-import { Alert } from "./Alert"
-import Button from "@mui/material/Button"
-import Link from "@mui/material/Link"
-import type { Meta, StoryObj } from "@storybook/react"
+import { Alert } from "./Alert";
+import Button from "@mui/material/Button";
+import type { Meta, StoryObj } from "@storybook/react";
 
 const meta: Meta<typeof Alert> = {
   title: "components/Alert",
   component: Alert,
-}
+};
 
-export default meta
-type Story = StoryObj<typeof Alert>
+export default meta;
+type Story = StoryObj<typeof Alert>;
 
 const ExampleAction = (
   <Button onClick={() => null} size="small" variant="text">
     Button
   </Button>
-)
+);
+
+export const Success: Story = {
+  args: {
+    children: "You're doing great!",
+    severity: "success",
+  },
+};
 
 export const Warning: Story = {
   args: {
     children: "This is a warning",
     severity: "warning",
   },
-}
+};
 
 export const WarningWithDismiss: Story = {
   args: {
@@ -30,7 +36,7 @@ export const WarningWithDismiss: Story = {
     dismissible: true,
     severity: "warning",
   },
-}
+};
 
 export const WarningWithAction: Story = {
   args: {
@@ -38,7 +44,7 @@ export const WarningWithAction: Story = {
     actions: [ExampleAction],
     severity: "warning",
   },
-}
+};
 
 export const WarningWithActionAndDismiss: Story = {
   args: {
@@ -47,15 +53,4 @@ export const WarningWithActionAndDismiss: Story = {
     dismissible: true,
     severity: "warning",
   },
-}
-
-export const WithChildren: Story = {
-  args: {
-    severity: "warning",
-    children: (
-      <div>
-        This is a message with a <Link href="#">link</Link>
-      </div>
-    ),
-  },
-}
+};
diff --git a/site/src/components/Alert/Alert.tsx b/site/src/components/Alert/Alert.tsx
index 6fb919436c159..fb3f5e07c170d 100644
--- a/site/src/components/Alert/Alert.tsx
+++ b/site/src/components/Alert/Alert.tsx
@@ -1,27 +1,25 @@
-import { useState, FC, ReactNode } from "react"
-import Collapse from "@mui/material/Collapse"
+import { useState, FC, ReactNode } from "react";
+import Collapse from "@mui/material/Collapse";
 // eslint-disable-next-line no-restricted-imports -- It is the base component
-import MuiAlert, { AlertProps as MuiAlertProps } from "@mui/material/Alert"
-import Button from "@mui/material/Button"
-import Box from "@mui/material/Box"
+import MuiAlert, { AlertProps as MuiAlertProps } from "@mui/material/Alert";
+import Button from "@mui/material/Button";
+import Box from "@mui/material/Box";
 
 export type AlertProps = MuiAlertProps & {
-  actions?: ReactNode
-  dismissible?: boolean
-  onRetry?: () => void
-  onDismiss?: () => void
-}
+  actions?: ReactNode;
+  dismissible?: boolean;
+  onDismiss?: () => void;
+};
 
 export const Alert: FC<AlertProps> = ({
   children,
   actions,
-  onRetry,
   dismissible,
   severity,
   onDismiss,
   ...alertProps
 }) => {
-  const [open, setOpen] = useState(true)
+  const [open, setOpen] = useState(true);
 
   return (
     <Collapse in={open}>
@@ -34,21 +32,14 @@ export const Alert: FC<AlertProps> = ({
             {/* CTAs passed in by the consumer */}
             {actions}
 
-            {/* retry CTA */}
-            {onRetry && (
-              <Button variant="text" size="small" onClick={onRetry}>
-                Retry
-              </Button>
-            )}
-
             {/* close CTA */}
             {dismissible && (
               <Button
                 variant="text"
                 size="small"
                 onClick={() => {
-                  setOpen(false)
-                  onDismiss && onDismiss()
+                  setOpen(false);
+                  onDismiss && onDismiss();
                 }}
                 data-testid="dismiss-banner-btn"
               >
@@ -61,8 +52,8 @@ export const Alert: FC<AlertProps> = ({
         {children}
       </MuiAlert>
     </Collapse>
-  )
-}
+  );
+};
 
 export const AlertDetail = ({ children }: { children: ReactNode }) => {
   return (
@@ -74,5 +65,5 @@ export const AlertDetail = ({ children }: { children: ReactNode }) => {
     >
       {children}
     </Box>
-  )
-}
+  );
+};
diff --git a/site/src/components/Alert/ErrorAlert.stories.tsx b/site/src/components/Alert/ErrorAlert.stories.tsx
index dafaddac8505f..5ef6f4275979c 100644
--- a/site/src/components/Alert/ErrorAlert.stories.tsx
+++ b/site/src/components/Alert/ErrorAlert.stories.tsx
@@ -1,32 +1,30 @@
-import Button from "@mui/material/Button"
-import { mockApiError } from "testHelpers/entities"
-import type { Meta, StoryObj } from "@storybook/react"
-import { action } from "@storybook/addon-actions"
-import { ErrorAlert } from "./ErrorAlert"
+import Button from "@mui/material/Button";
+import { mockApiError } from "testHelpers/entities";
+import type { Meta, StoryObj } from "@storybook/react";
+import { ErrorAlert } from "./ErrorAlert";
 
 const mockError = mockApiError({
   message: "Email or password was invalid",
   detail: "Password is invalid",
-})
+});
 
 const meta: Meta<typeof ErrorAlert> = {
-  title: "components/ErrorAlert",
+  title: "components/Alert/ErrorAlert",
   component: ErrorAlert,
   args: {
     error: mockError,
     dismissible: false,
-    onRetry: undefined,
   },
-}
+};
 
-export default meta
-type Story = StoryObj<typeof ErrorAlert>
+export default meta;
+type Story = StoryObj<typeof ErrorAlert>;
 
 const ExampleAction = (
   <Button onClick={() => null} size="small" variant="text">
     Button
   </Button>
-)
+);
 
 export const WithOnlyMessage: Story = {
   args: {
@@ -34,44 +32,29 @@ export const WithOnlyMessage: Story = {
       message: "Email or password was invalid",
     }),
   },
-}
+};
 
 export const WithDismiss: Story = {
   args: {
     dismissible: true,
   },
-}
+};
 
 export const WithAction: Story = {
   args: {
     actions: [ExampleAction],
   },
-}
+};
 
 export const WithActionAndDismiss: Story = {
   args: {
     actions: [ExampleAction],
     dismissible: true,
   },
-}
-
-export const WithRetry: Story = {
-  args: {
-    onRetry: action("retry"),
-    dismissible: true,
-  },
-}
-
-export const WithActionRetryAndDismiss: Story = {
-  args: {
-    actions: [ExampleAction],
-    onRetry: action("retry"),
-    dismissible: true,
-  },
-}
+};
 
 export const WithNonApiError: Story = {
   args: {
     error: new Error("Non API error here"),
   },
-}
+};
diff --git a/site/src/components/Alert/ErrorAlert.tsx b/site/src/components/Alert/ErrorAlert.tsx
index 5b46633471b27..40b125fdf4596 100644
--- a/site/src/components/Alert/ErrorAlert.tsx
+++ b/site/src/components/Alert/ErrorAlert.tsx
@@ -1,17 +1,17 @@
-import { AlertProps, Alert, AlertDetail } from "./Alert"
-import AlertTitle from "@mui/material/AlertTitle"
-import { getErrorMessage, getErrorDetail } from "api/errors"
-import { FC } from "react"
+import { AlertProps, Alert, AlertDetail } from "./Alert";
+import AlertTitle from "@mui/material/AlertTitle";
+import { getErrorMessage, getErrorDetail } from "api/errors";
+import { FC } from "react";
 
 export const ErrorAlert: FC<
   Omit<AlertProps, "severity" | "children"> & { error: unknown }
 > = ({ error, ...alertProps }) => {
-  const message = getErrorMessage(error, "Something went wrong.")
-  const detail = getErrorDetail(error)
+  const message = getErrorMessage(error, "Something went wrong.");
+  const detail = getErrorDetail(error);
 
   // For some reason, the message and detail can be the same on the BE, but does
   // not make sense in the FE to showing them duplicated
-  const shouldDisplayDetail = message !== detail
+  const shouldDisplayDetail = message !== detail;
 
   return (
     <Alert severity="error" {...alertProps}>
@@ -24,5 +24,5 @@ export const ErrorAlert: FC<
         message
       )}
     </Alert>
-  )
-}
+  );
+};
diff --git a/site/src/components/AppLink/AppLink.stories.tsx b/site/src/components/AppLink/AppLink.stories.tsx
deleted file mode 100644
index 47f89bfb9db83..0000000000000
--- a/site/src/components/AppLink/AppLink.stories.tsx
+++ /dev/null
@@ -1,122 +0,0 @@
-import { Story } from "@storybook/react"
-import {
-  MockPrimaryWorkspaceProxy,
-  MockWorkspaceProxies,
-  MockWorkspace,
-  MockWorkspaceAgent,
-  MockWorkspaceApp,
-  MockProxyLatencies,
-} from "testHelpers/entities"
-import { AppLink, AppLinkProps } from "./AppLink"
-import { ProxyContext, getPreferredProxy } from "contexts/ProxyContext"
-
-export default {
-  title: "components/AppLink",
-  component: AppLink,
-}
-
-const Template: Story<AppLinkProps> = (args) => (
-  <ProxyContext.Provider
-    value={{
-      proxyLatencies: MockProxyLatencies,
-      proxy: getPreferredProxy(MockWorkspaceProxies, MockPrimaryWorkspaceProxy),
-      proxies: MockWorkspaceProxies,
-      isLoading: false,
-      isFetched: true,
-      setProxy: () => {
-        return
-      },
-      clearProxy: () => {
-        return
-      },
-      refetchProxyLatencies: (): Date => {
-        return new Date()
-      },
-    }}
-  >
-    <AppLink {...args} />
-  </ProxyContext.Provider>
-)
-
-export const WithIcon = Template.bind({})
-WithIcon.args = {
-  workspace: MockWorkspace,
-  app: {
-    ...MockWorkspaceApp,
-    icon: "/icon/code.svg",
-    sharing_level: "owner",
-    health: "healthy",
-  },
-  agent: MockWorkspaceAgent,
-}
-
-export const ExternalApp = Template.bind({})
-ExternalApp.args = {
-  workspace: MockWorkspace,
-  app: {
-    ...MockWorkspaceApp,
-    external: true,
-  },
-  agent: MockWorkspaceAgent,
-}
-
-export const SharingLevelOwner = Template.bind({})
-SharingLevelOwner.args = {
-  workspace: MockWorkspace,
-  app: {
-    ...MockWorkspaceApp,
-    sharing_level: "owner",
-  },
-  agent: MockWorkspaceAgent,
-}
-
-export const SharingLevelAuthenticated = Template.bind({})
-SharingLevelAuthenticated.args = {
-  workspace: MockWorkspace,
-  app: {
-    ...MockWorkspaceApp,
-    sharing_level: "authenticated",
-  },
-  agent: MockWorkspaceAgent,
-}
-
-export const SharingLevelPublic = Template.bind({})
-SharingLevelPublic.args = {
-  workspace: MockWorkspace,
-  app: {
-    ...MockWorkspaceApp,
-    sharing_level: "public",
-  },
-  agent: MockWorkspaceAgent,
-}
-
-export const HealthDisabled = Template.bind({})
-HealthDisabled.args = {
-  workspace: MockWorkspace,
-  app: {
-    ...MockWorkspaceApp,
-    sharing_level: "owner",
-    health: "disabled",
-  },
-  agent: MockWorkspaceAgent,
-}
-
-export const HealthInitializing = Template.bind({})
-HealthInitializing.args = {
-  workspace: MockWorkspace,
-  app: {
-    ...MockWorkspaceApp,
-    health: "initializing",
-  },
-  agent: MockWorkspaceAgent,
-}
-
-export const HealthUnhealthy = Template.bind({})
-HealthUnhealthy.args = {
-  workspace: MockWorkspace,
-  app: {
-    ...MockWorkspaceApp,
-    health: "unhealthy",
-  },
-  agent: MockWorkspaceAgent,
-}
diff --git a/site/src/components/AppLink/AppLink.tsx b/site/src/components/AppLink/AppLink.tsx
deleted file mode 100644
index 5e3dee464298d..0000000000000
--- a/site/src/components/AppLink/AppLink.tsx
+++ /dev/null
@@ -1,145 +0,0 @@
-import CircularProgress from "@mui/material/CircularProgress"
-import Link from "@mui/material/Link"
-import { makeStyles } from "@mui/styles"
-import Tooltip from "@mui/material/Tooltip"
-import ErrorOutlineIcon from "@mui/icons-material/ErrorOutline"
-import { PrimaryAgentButton } from "components/Resources/AgentButton"
-import { FC } from "react"
-import { combineClasses } from "utils/combineClasses"
-import * as TypesGen from "../../api/typesGenerated"
-import { generateRandomString } from "../../utils/random"
-import { BaseIcon } from "./BaseIcon"
-import { ShareIcon } from "./ShareIcon"
-import { useProxy } from "contexts/ProxyContext"
-
-const Language = {
-  appTitle: (appName: string, identifier: string): string =>
-    `${appName} - ${identifier}`,
-}
-
-export interface AppLinkProps {
-  workspace: TypesGen.Workspace
-  app: TypesGen.WorkspaceApp
-  agent: TypesGen.WorkspaceAgent
-}
-
-export const AppLink: FC<AppLinkProps> = ({ app, workspace, agent }) => {
-  const { proxy } = useProxy()
-  const preferredPathBase = proxy.preferredPathAppURL
-  const appsHost = proxy.preferredWildcardHostname
-
-  const styles = useStyles()
-  const username = workspace.owner_name
-
-  let appSlug = app.slug
-  let appDisplayName = app.display_name
-  if (!appSlug) {
-    appSlug = appDisplayName
-  }
-  if (!appDisplayName) {
-    appDisplayName = appSlug
-  }
-
-  // The backend redirects if the trailing slash isn't included, so we add it
-  // here to avoid extra roundtrips.
-  let href = `${preferredPathBase}/@${username}/${workspace.name}.${
-    agent.name
-  }/apps/${encodeURIComponent(appSlug)}/`
-  if (app.command) {
-    href = `${preferredPathBase}/@${username}/${workspace.name}.${
-      agent.name
-    }/terminal?command=${encodeURIComponent(app.command)}`
-  }
-
-  if (appsHost && app.subdomain) {
-    const subdomain = `${appSlug}--${agent.name}--${workspace.name}--${username}`
-    href = `${window.location.protocol}//${appsHost}/`.replace("*", subdomain)
-  }
-  if (app.external) {
-    href = app.url
-  }
-
-  let canClick = true
-  let icon = <BaseIcon app={app} />
-
-  let primaryTooltip = ""
-  if (app.health === "initializing") {
-    canClick = false
-    icon = <CircularProgress size={12} />
-    primaryTooltip = "Initializing..."
-  }
-  if (app.health === "unhealthy") {
-    canClick = false
-    icon = <ErrorOutlineIcon className={styles.unhealthyIcon} />
-    primaryTooltip = "Unhealthy"
-  }
-  if (!appsHost && app.subdomain) {
-    canClick = false
-    icon = <ErrorOutlineIcon className={styles.notConfiguredIcon} />
-    primaryTooltip =
-      "Your admin has not configured subdomain application access"
-  }
-
-  const isPrivateApp = app.sharing_level === "owner"
-
-  const button = (
-    <PrimaryAgentButton
-      startIcon={icon}
-      endIcon={isPrivateApp ? undefined : <ShareIcon app={app} />}
-      disabled={!canClick}
-    >
-      <span className={combineClasses({ [styles.appName]: !isPrivateApp })}>
-        {appDisplayName}
-      </span>
-    </PrimaryAgentButton>
-  )
-
-  return (
-    <Tooltip title={primaryTooltip}>
-      <span>
-        <Link
-          href={href}
-          target="_blank"
-          className={canClick ? styles.link : styles.disabledLink}
-          onClick={
-            canClick
-              ? (event) => {
-                  event.preventDefault()
-                  window.open(
-                    href,
-                    Language.appTitle(appDisplayName, generateRandomString(12)),
-                    "width=900,height=600",
-                  )
-                }
-              : undefined
-          }
-        >
-          {button}
-        </Link>
-      </span>
-    </Tooltip>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  link: {
-    textDecoration: "none !important",
-  },
-
-  disabledLink: {
-    pointerEvents: "none",
-    textDecoration: "none !important",
-  },
-
-  unhealthyIcon: {
-    color: theme.palette.warning.light,
-  },
-
-  notConfiguredIcon: {
-    color: theme.palette.grey[300],
-  },
-
-  appName: {
-    marginRight: theme.spacing(1),
-  },
-}))
diff --git a/site/src/components/AppLink/AppPreviewLink.tsx b/site/src/components/AppLink/AppPreviewLink.tsx
deleted file mode 100644
index 748f67130aa3d..0000000000000
--- a/site/src/components/AppLink/AppPreviewLink.tsx
+++ /dev/null
@@ -1,44 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import { Stack } from "components/Stack/Stack"
-import { FC } from "react"
-import * as TypesGen from "api/typesGenerated"
-import { BaseIcon } from "./BaseIcon"
-import { ShareIcon } from "./ShareIcon"
-
-interface AppPreviewProps {
-  app: TypesGen.WorkspaceApp
-}
-
-export const AppPreviewLink: FC<AppPreviewProps> = ({ app }) => {
-  const styles = useStyles()
-
-  return (
-    <Stack
-      className={styles.appPreviewLink}
-      alignItems="center"
-      direction="row"
-      spacing={1}
-    >
-      <BaseIcon app={app} />
-      {app.display_name}
-      <ShareIcon app={app} />
-    </Stack>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  appPreviewLink: {
-    padding: theme.spacing(0.25, 1.5),
-    borderRadius: 9999,
-    border: `1px solid ${theme.palette.divider}`,
-    color: theme.palette.text.primary,
-    background: theme.palette.background.paper,
-    flexShrink: 0,
-    width: "fit-content",
-    fontSize: 12,
-
-    "& img, & svg": {
-      width: 13,
-    },
-  },
-}))
diff --git a/site/src/components/AppLink/BaseIcon.tsx b/site/src/components/AppLink/BaseIcon.tsx
deleted file mode 100644
index 775b0ec920844..0000000000000
--- a/site/src/components/AppLink/BaseIcon.tsx
+++ /dev/null
@@ -1,17 +0,0 @@
-import { WorkspaceApp } from "api/typesGenerated"
-import { FC } from "react"
-import ComputerIcon from "@mui/icons-material/Computer"
-
-export const BaseIcon: FC<{ app: WorkspaceApp }> = ({ app }) => {
-  return app.icon ? (
-    <img
-      alt={`${app.display_name} Icon`}
-      src={app.icon}
-      style={{
-        pointerEvents: "none",
-      }}
-    />
-  ) : (
-    <ComputerIcon />
-  )
-}
diff --git a/site/src/components/AppLink/ShareIcon.tsx b/site/src/components/AppLink/ShareIcon.tsx
deleted file mode 100644
index 9e3f86aa44b86..0000000000000
--- a/site/src/components/AppLink/ShareIcon.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-import PublicOutlinedIcon from "@mui/icons-material/PublicOutlined"
-import GroupOutlinedIcon from "@mui/icons-material/GroupOutlined"
-import LaunchOutlinedIcon from "@mui/icons-material/LaunchOutlined"
-import * as TypesGen from "../../api/typesGenerated"
-import Tooltip from "@mui/material/Tooltip"
-import { useTranslation } from "react-i18next"
-
-export interface ShareIconProps {
-  app: TypesGen.WorkspaceApp
-}
-
-export const ShareIcon = ({ app }: ShareIconProps) => {
-  const { t } = useTranslation("agent")
-  if (app.external) {
-    return (
-      <Tooltip title={t("shareTooltip.external")}>
-        <LaunchOutlinedIcon />
-      </Tooltip>
-    )
-  }
-  if (app.sharing_level === "authenticated") {
-    return (
-      <Tooltip title={t("shareTooltip.authenticated")}>
-        <GroupOutlinedIcon />
-      </Tooltip>
-    )
-  }
-  if (app.sharing_level === "public") {
-    return (
-      <Tooltip title={t("shareTooltip.public")}>
-        <PublicOutlinedIcon />
-      </Tooltip>
-    )
-  }
-
-  return null
-}
diff --git a/site/src/components/AuditLogRow/AuditLogDescription/AuditLogDescription.test.tsx b/site/src/components/AuditLogRow/AuditLogDescription/AuditLogDescription.test.tsx
deleted file mode 100644
index be9be76b5ac27..0000000000000
--- a/site/src/components/AuditLogRow/AuditLogDescription/AuditLogDescription.test.tsx
+++ /dev/null
@@ -1,106 +0,0 @@
-import {
-  MockAuditLog,
-  MockAuditLogWithWorkspaceBuild,
-  MockWorkspaceCreateAuditLogForDifferentOwner,
-  MockAuditLogSuccessfulLogin,
-  MockAuditLogUnsuccessfulLoginKnownUser,
-} from "testHelpers/entities"
-import { AuditLogDescription } from "./AuditLogDescription"
-import { AuditLogRow } from "../AuditLogRow"
-import { render } from "testHelpers/renderHelpers"
-import { screen } from "@testing-library/react"
-import { i18n } from "i18n"
-
-const t = (str: string, variables: Record<string, unknown>) =>
-  i18n.t<string>(str, variables)
-
-const getByTextContent = (text: string) => {
-  return screen.getByText((_, element) => {
-    const hasText = (element: Element | null) => element?.textContent === text
-    const elementHasText = hasText(element)
-    const childrenDontHaveText = Array.from(element?.children || []).every(
-      (child) => !hasText(child),
-    )
-    return elementHasText && childrenDontHaveText
-  })
-}
-describe("AuditLogDescription", () => {
-  it("renders the correct string for a workspace create audit log", async () => {
-    render(<AuditLogDescription auditLog={MockAuditLog} />)
-
-    expect(screen.getByText("TestUser created workspace")).toBeDefined()
-    expect(screen.getByText("bruno-dev")).toBeDefined()
-  })
-
-  it("renders the correct string for a workspace_build stop audit log", async () => {
-    render(<AuditLogDescription auditLog={MockAuditLogWithWorkspaceBuild} />)
-
-    expect(getByTextContent("TestUser stopped workspace test2")).toBeDefined()
-  })
-
-  it("renders the correct string for a workspace_build audit log with a duplicate word", async () => {
-    const AuditLogWithRepeat = {
-      ...MockAuditLogWithWorkspaceBuild,
-      additional_fields: {
-        workspace_name: "workspace",
-      },
-    }
-    render(<AuditLogDescription auditLog={AuditLogWithRepeat} />)
-
-    expect(
-      getByTextContent("TestUser stopped workspace workspace"),
-    ).toBeDefined()
-  })
-  it("renders the correct string for a workspace created for a different owner", async () => {
-    render(
-      <AuditLogDescription
-        auditLog={MockWorkspaceCreateAuditLogForDifferentOwner}
-      />,
-    )
-
-    expect(
-      screen.getByText(
-        `on behalf of ${MockWorkspaceCreateAuditLogForDifferentOwner.additional_fields.workspace_owner}`,
-        { exact: false },
-      ),
-    ).toBeDefined()
-  })
-  it("renders the correct string for successful login", async () => {
-    render(<AuditLogRow auditLog={MockAuditLogSuccessfulLogin} />)
-
-    expect(
-      screen.getByText(
-        t("auditLog:table.logRow.description.unlinkedAuditDescription", {
-          truncatedDescription: `${MockAuditLogSuccessfulLogin.user?.username} logged in`,
-          target: "",
-          onBehalfOf: undefined,
-        })
-          .replace(/<[^>]*>/g, " ")
-          .replace(/\s{2,}/g, " ")
-          .trim(),
-      ),
-    ).toBeInTheDocument()
-
-    const statusPill = screen.getByRole("status")
-    expect(statusPill).toHaveTextContent("201")
-  })
-  it("renders the correct string for unsuccessful login for a known user", async () => {
-    render(<AuditLogRow auditLog={MockAuditLogUnsuccessfulLoginKnownUser} />)
-
-    expect(
-      screen.getByText(
-        t("auditLog:table.logRow.description.unlinkedAuditDescription", {
-          truncatedDescription: `${MockAuditLogUnsuccessfulLoginKnownUser.user?.username} logged in`,
-          target: "",
-          onBehalfOf: undefined,
-        })
-          .replace(/<[^>]*>/g, " ")
-          .replace(/\s{2,}/g, " ")
-          .trim(),
-      ),
-    ).toBeInTheDocument()
-
-    const statusPill = screen.getByRole("status")
-    expect(statusPill).toHaveTextContent("401")
-  })
-})
diff --git a/site/src/components/AuditLogRow/AuditLogDescription/AuditLogDescription.tsx b/site/src/components/AuditLogRow/AuditLogDescription/AuditLogDescription.tsx
deleted file mode 100644
index 7680a98d60163..0000000000000
--- a/site/src/components/AuditLogRow/AuditLogDescription/AuditLogDescription.tsx
+++ /dev/null
@@ -1,68 +0,0 @@
-import { FC } from "react"
-import { AuditLog } from "api/typesGenerated"
-import { Link as RouterLink } from "react-router-dom"
-import Link from "@mui/material/Link"
-import { Trans, useTranslation } from "react-i18next"
-import { BuildAuditDescription } from "./BuildAuditDescription"
-
-export const AuditLogDescription: FC<{ auditLog: AuditLog }> = ({
-  auditLog,
-}): JSX.Element => {
-  const { t } = useTranslation("auditLog")
-
-  let target = auditLog.resource_target.trim()
-  const user = auditLog.user?.username.trim()
-
-  if (auditLog.resource_type === "workspace_build") {
-    return <BuildAuditDescription auditLog={auditLog} />
-  }
-
-  // SSH key entries have no links
-  if (auditLog.resource_type === "git_ssh_key") {
-    target = ""
-  }
-
-  const truncatedDescription = auditLog.description
-    .replace("{user}", `${user}`)
-    .replace("{target}", "")
-
-  // logs for workspaces created on behalf of other users indicate ownership in the description
-  const onBehalfOf =
-    auditLog.additional_fields.workspace_owner &&
-    auditLog.additional_fields.workspace_owner !== "unknown" &&
-    auditLog.additional_fields.workspace_owner.trim() !== user
-      ? `on behalf of ${auditLog.additional_fields.workspace_owner}`
-      : ""
-
-  if (auditLog.resource_link) {
-    return (
-      <span>
-        <Trans
-          t={t}
-          i18nKey="table.logRow.description.linkedAuditDescription"
-          values={{ truncatedDescription, target, onBehalfOf }}
-        >
-          {"{{truncatedDescription}}"}
-          <Link component={RouterLink} to={auditLog.resource_link}>
-            <strong>{"{{target}}"}</strong>
-          </Link>
-          {"{{onBehalfOf}}"}
-        </Trans>
-      </span>
-    )
-  }
-
-  return (
-    <span>
-      <Trans
-        t={t}
-        i18nKey="table.logRow.description.unlinkedAuditDescription"
-        values={{ truncatedDescription, target, onBehalfOf }}
-      >
-        {"{{truncatedDescription}}"}
-        <strong>{"{{target}}"}</strong>
-        {"{{onBehalfOf}}"}
-      </Trans>
-    </span>
-  )
-}
diff --git a/site/src/components/AuditLogRow/AuditLogDescription/BuildAuditDescription.tsx b/site/src/components/AuditLogRow/AuditLogDescription/BuildAuditDescription.tsx
deleted file mode 100644
index 7efad10221d32..0000000000000
--- a/site/src/components/AuditLogRow/AuditLogDescription/BuildAuditDescription.tsx
+++ /dev/null
@@ -1,63 +0,0 @@
-import { Trans, useTranslation } from "react-i18next"
-import { AuditLog } from "api/typesGenerated"
-import { FC } from "react"
-import { Link as RouterLink } from "react-router-dom"
-import Link from "@mui/material/Link"
-
-export const BuildAuditDescription: FC<{ auditLog: AuditLog }> = ({
-  auditLog,
-}): JSX.Element => {
-  const { t } = useTranslation("auditLog")
-
-  const workspaceName = auditLog.additional_fields?.workspace_name?.trim()
-  // workspaces can be started/stopped/deleted by a user, or kicked off automatically by Coder
-  const user =
-    auditLog.additional_fields?.build_reason &&
-    auditLog.additional_fields?.build_reason !== "initiator"
-      ? "Coder automatically"
-      : auditLog.user?.username.trim()
-
-  const action: string = (() => {
-    switch (auditLog.action) {
-      case "start":
-        return "started"
-      case "stop":
-        return "stopped"
-      case "delete":
-        return "deleted"
-      default:
-        return auditLog.action
-    }
-  })()
-
-  if (auditLog.resource_link) {
-    return (
-      <span>
-        <Trans
-          t={t}
-          i18nKey="table.logRow.description.linkedWorkspaceBuild"
-          values={{ user, action, workspaceName }}
-        >
-          {"{{user}}"}
-          <Link component={RouterLink} to={auditLog.resource_link}>
-            {"{{action}}"}
-          </Link>
-          workspace{"{{workspaceName}}"}
-        </Trans>
-      </span>
-    )
-  }
-
-  return (
-    <span>
-      <Trans
-        t={t}
-        i18nKey="table.logRow.description.unlinkedWorkspaceBuild"
-        values={{ user, action, workspaceName }}
-      >
-        {"{{user}}"}
-        {"{{action}}"}workspace{"{{workspaceName}}"}
-      </Trans>
-    </span>
-  )
-}
diff --git a/site/src/components/AuditLogRow/AuditLogDescription/index.ts b/site/src/components/AuditLogRow/AuditLogDescription/index.ts
deleted file mode 100644
index 590ff7c7b0e17..0000000000000
--- a/site/src/components/AuditLogRow/AuditLogDescription/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { AuditLogDescription } from "./AuditLogDescription"
diff --git a/site/src/components/AuditLogRow/AuditLogDiff/index.ts b/site/src/components/AuditLogRow/AuditLogDiff/index.ts
deleted file mode 100644
index 7243291182ca9..0000000000000
--- a/site/src/components/AuditLogRow/AuditLogDiff/index.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-export { AuditLogDiff } from "./AuditLogDiff"
-export { determineGroupDiff } from "./auditUtils"
diff --git a/site/src/components/AuditLogRow/AuditLogRow.stories.tsx b/site/src/components/AuditLogRow/AuditLogRow.stories.tsx
deleted file mode 100644
index b74708782727b..0000000000000
--- a/site/src/components/AuditLogRow/AuditLogRow.stories.tsx
+++ /dev/null
@@ -1,100 +0,0 @@
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableHead from "@mui/material/TableHead"
-import TableRow from "@mui/material/TableRow"
-import { ComponentMeta, Story } from "@storybook/react"
-import {
-  MockAuditLog,
-  MockAuditLog2,
-  MockAuditLogWithWorkspaceBuild,
-  MockAuditLogWithDeletedResource,
-  MockAuditLogGitSSH,
-} from "testHelpers/entities"
-import { AuditLogRow, AuditLogRowProps } from "./AuditLogRow"
-
-export default {
-  title: "components/AuditLogRow",
-  component: AuditLogRow,
-} as ComponentMeta<typeof AuditLogRow>
-
-const Template: Story<AuditLogRowProps> = (args) => (
-  <TableContainer>
-    <Table>
-      <TableHead>
-        <TableRow>
-          <TableCell style={{ paddingLeft: 32 }}>Logs</TableCell>
-        </TableRow>
-      </TableHead>
-      <TableBody>
-        <AuditLogRow {...args} />
-      </TableBody>
-    </Table>
-  </TableContainer>
-)
-
-export const NoDiff = Template.bind({})
-NoDiff.args = {
-  auditLog: {
-    ...MockAuditLog,
-    diff: {},
-  },
-}
-
-export const WithDiff = Template.bind({})
-WithDiff.args = {
-  auditLog: MockAuditLog2,
-  defaultIsDiffOpen: true,
-}
-
-export const WithLongDiffRow = Template.bind({})
-WithLongDiffRow.args = {
-  auditLog: {
-    ...MockAuditLog2,
-    diff: {
-      ...MockAuditLog2.diff,
-      icon: {
-        old: "https://www.google.com/url?sa=i&url=https%3A%2F%2Fwww.docker.com%2Fcompany%2Fnewsroom%2Fmedia-resources%2F&psig=AOvVaw3hLg_lm0tzXPBt74XZD2GC&ust=1666892413988000&source=images&cd=vfe&ved=0CAwQjRxqFwoTCPDsiKa4_voCFQAAAAAdAAAAABAD",
-        new: "https://www.google.com/url?sa=i&url=https%3A%2F%2Fwww.kindpng.com%2Fimgv%2FhRowRxi_docker-icon-png-transparent-png%2F&psig=AOvVaw3hLg_lm0tzXPBt74XZD2GC&ust=1666892413988000&source=images&cd=vfe&ved=0CAwQjRxqFwoTCPDsiKa4_voCFQAAAAAdAAAAABAI",
-        secret: false,
-      },
-    },
-  },
-  defaultIsDiffOpen: true,
-}
-
-export const WithStoppedWorkspaceBuild = Template.bind({})
-WithStoppedWorkspaceBuild.args = {
-  auditLog: {
-    ...MockAuditLogWithWorkspaceBuild,
-    action: "stop",
-  },
-}
-
-export const WithStartedWorkspaceBuild = Template.bind({})
-WithStartedWorkspaceBuild.args = {
-  auditLog: {
-    ...MockAuditLogWithWorkspaceBuild,
-    action: "start",
-  },
-}
-
-export const WithDeletedWorkspaceBuild = Template.bind({})
-WithDeletedWorkspaceBuild.args = {
-  auditLog: {
-    ...MockAuditLogWithWorkspaceBuild,
-    action: "delete",
-    is_deleted: true,
-  },
-}
-
-export const DeletedResource = Template.bind({})
-DeletedResource.args = {
-  auditLog: MockAuditLogWithDeletedResource,
-}
-
-export const SecretDiffValue = Template.bind({})
-SecretDiffValue.args = {
-  auditLog: MockAuditLogGitSSH,
-}
diff --git a/site/src/components/AuditLogRow/AuditLogRow.tsx b/site/src/components/AuditLogRow/AuditLogRow.tsx
deleted file mode 100644
index 322f6fc2a2f41..0000000000000
--- a/site/src/components/AuditLogRow/AuditLogRow.tsx
+++ /dev/null
@@ -1,228 +0,0 @@
-import Collapse from "@mui/material/Collapse"
-import { makeStyles } from "@mui/styles"
-import TableCell from "@mui/material/TableCell"
-import { AuditLog } from "api/typesGenerated"
-import {
-  CloseDropdown,
-  OpenDropdown,
-} from "components/DropdownArrows/DropdownArrows"
-import { Pill } from "components/Pill/Pill"
-import { Stack } from "components/Stack/Stack"
-import { TimelineEntry } from "components/Timeline/TimelineEntry"
-import { UserAvatar } from "components/UserAvatar/UserAvatar"
-import { useState } from "react"
-import userAgentParser from "ua-parser-js"
-import { AuditLogDiff, determineGroupDiff } from "./AuditLogDiff"
-import { useTranslation } from "react-i18next"
-import { AuditLogDescription } from "./AuditLogDescription"
-import { PaletteIndex } from "theme/theme"
-
-const httpStatusColor = (httpStatus: number): PaletteIndex => {
-  // redirects are successful
-  if (httpStatus === 307) {
-    return "success"
-  }
-
-  if (httpStatus >= 300 && httpStatus < 500) {
-    return "warning"
-  }
-
-  if (httpStatus >= 500) {
-    return "error"
-  }
-
-  return "success"
-}
-
-export interface AuditLogRowProps {
-  auditLog: AuditLog
-  // Useful for Storybook
-  defaultIsDiffOpen?: boolean
-}
-
-export const AuditLogRow: React.FC<AuditLogRowProps> = ({
-  auditLog,
-  defaultIsDiffOpen = false,
-}) => {
-  const styles = useStyles()
-  const { t } = useTranslation("auditLog")
-  const [isDiffOpen, setIsDiffOpen] = useState(defaultIsDiffOpen)
-  const diffs = Object.entries(auditLog.diff)
-  const shouldDisplayDiff = diffs.length > 0
-  const { os, browser } = userAgentParser(auditLog.user_agent)
-
-  let auditDiff = auditLog.diff
-
-  // groups have nested diffs (group members)
-  if (auditLog.resource_type === "group") {
-    auditDiff = determineGroupDiff(auditLog.diff)
-  }
-
-  const toggle = () => {
-    if (shouldDisplayDiff) {
-      setIsDiffOpen((v) => !v)
-    }
-  }
-
-  return (
-    <TimelineEntry
-      key={auditLog.id}
-      data-testid={`audit-log-row-${auditLog.id}`}
-      clickable={shouldDisplayDiff}
-    >
-      <TableCell className={styles.auditLogCell}>
-        <Stack
-          direction="row"
-          alignItems="center"
-          className={styles.auditLogHeader}
-          tabIndex={0}
-          onClick={toggle}
-          onKeyDown={(event) => {
-            if (event.key === "Enter") {
-              toggle()
-            }
-          }}
-        >
-          <Stack
-            direction="row"
-            alignItems="center"
-            className={styles.auditLogHeaderInfo}
-          >
-            <Stack
-              direction="row"
-              alignItems="center"
-              className={styles.fullWidth}
-            >
-              <UserAvatar
-                username={auditLog.user?.username ?? "?"}
-                avatarURL={auditLog.user?.avatar_url}
-              />
-
-              <Stack
-                alignItems="baseline"
-                className={styles.fullWidth}
-                justifyContent="space-between"
-                direction="row"
-              >
-                <Stack
-                  className={styles.auditLogSummary}
-                  direction="row"
-                  alignItems="baseline"
-                  spacing={1}
-                >
-                  <AuditLogDescription auditLog={auditLog} />
-                  {auditLog.is_deleted && (
-                    <span className={styles.deletedLabel}>
-                      <>{t("table.logRow.deletedLabel")}</>
-                    </span>
-                  )}
-                  <span className={styles.auditLogTime}>
-                    {new Date(auditLog.time).toLocaleTimeString()}
-                  </span>
-                </Stack>
-
-                <Stack direction="row" alignItems="center">
-                  <Stack direction="row" spacing={1} alignItems="baseline">
-                    {auditLog.ip && (
-                      <span className={styles.auditLogInfo}>
-                        <>{t("table.logRow.ip")}</>
-                        <strong>{auditLog.ip}</strong>
-                      </span>
-                    )}
-                    {os.name && (
-                      <span className={styles.auditLogInfo}>
-                        <>{t("table.logRow.os")}</>
-                        <strong>{os.name}</strong>
-                      </span>
-                    )}
-                    {browser.name && (
-                      <span className={styles.auditLogInfo}>
-                        <>{t("table.logRow.browser")}</>
-                        <strong>
-                          {browser.name} {browser.version}
-                        </strong>
-                      </span>
-                    )}
-                  </Stack>
-
-                  <Pill
-                    className={styles.httpStatusPill}
-                    type={httpStatusColor(auditLog.status_code)}
-                    text={auditLog.status_code.toString()}
-                  />
-                </Stack>
-              </Stack>
-            </Stack>
-          </Stack>
-
-          {shouldDisplayDiff ? (
-            <div> {isDiffOpen ? <CloseDropdown /> : <OpenDropdown />}</div>
-          ) : (
-            <div className={styles.columnWithoutDiff}></div>
-          )}
-        </Stack>
-
-        {shouldDisplayDiff && (
-          <Collapse in={isDiffOpen}>
-            <AuditLogDiff diff={auditDiff} />
-          </Collapse>
-        )}
-      </TableCell>
-    </TimelineEntry>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  auditLogCell: {
-    padding: "0 !important",
-    border: 0,
-  },
-
-  auditLogHeader: {
-    padding: theme.spacing(2, 4),
-  },
-
-  auditLogHeaderInfo: {
-    flex: 1,
-  },
-
-  auditLogSummary: {
-    ...theme.typography.body1,
-    fontFamily: "inherit",
-  },
-
-  auditLogTime: {
-    color: theme.palette.text.secondary,
-    fontSize: 12,
-  },
-
-  auditLogInfo: {
-    ...theme.typography.body2,
-    fontSize: 12,
-    fontFamily: "inherit",
-    color: theme.palette.text.secondary,
-    display: "block",
-  },
-
-  // offset the absence of the arrow icon on diff-less logs
-  columnWithoutDiff: {
-    marginLeft: "24px",
-  },
-
-  fullWidth: {
-    width: "100%",
-  },
-
-  httpStatusPill: {
-    fontSize: 10,
-    height: 20,
-    paddingLeft: 10,
-    paddingRight: 10,
-    fontWeight: 600,
-  },
-
-  deletedLabel: {
-    ...theme.typography.caption,
-    color: theme.palette.text.secondary,
-  },
-}))
diff --git a/site/src/components/AuthProvider/AuthProvider.tsx b/site/src/components/AuthProvider/AuthProvider.tsx
index 1b113e80fc155..98327b0a7caf1 100644
--- a/site/src/components/AuthProvider/AuthProvider.tsx
+++ b/site/src/components/AuthProvider/AuthProvider.tsx
@@ -1,36 +1,134 @@
-import { useActor, useInterpret } from "@xstate/react"
-import { createContext, FC, PropsWithChildren, useContext } from "react"
-import { authMachine } from "xServices/auth/authXService"
-import { ActorRefFrom } from "xstate"
+import { checkAuthorization } from "api/queries/authCheck";
+import {
+  authMethods,
+  hasFirstUser,
+  login,
+  logout,
+  me,
+  updateProfile as updateProfileOptions,
+} from "api/queries/users";
+import {
+  AuthMethods,
+  UpdateUserProfileRequest,
+  User,
+} from "api/typesGenerated";
+import {
+  createContext,
+  FC,
+  PropsWithChildren,
+  useCallback,
+  useContext,
+} from "react";
+import { useMutation, useQuery, useQueryClient } from "react-query";
+import { permissionsToCheck, Permissions } from "./permissions";
+import { displaySuccess } from "components/GlobalSnackbar/utils";
+import { FullScreenLoader } from "components/Loader/FullScreenLoader";
+import { isApiError } from "api/errors";
 
-interface AuthContextValue {
-  authService: ActorRefFrom<typeof authMachine>
-}
+type AuthContextValue = {
+  isSignedOut: boolean;
+  isSigningOut: boolean;
+  isConfiguringTheFirstUser: boolean;
+  isSignedIn: boolean;
+  isSigningIn: boolean;
+  isUpdatingProfile: boolean;
+  user: User | undefined;
+  permissions: Permissions | undefined;
+  authMethods: AuthMethods | undefined;
+  signInError: unknown;
+  updateProfileError: unknown;
+  signOut: () => void;
+  signIn: (email: string, password: string) => Promise<void>;
+  updateProfile: (data: UpdateUserProfileRequest) => void;
+};
 
-const AuthContext = createContext<AuthContextValue | undefined>(undefined)
+const AuthContext = createContext<AuthContextValue | undefined>(undefined);
 
 export const AuthProvider: FC<PropsWithChildren> = ({ children }) => {
-  const authService = useInterpret(authMachine)
+  const queryClient = useQueryClient();
+  const meOptions = me();
+
+  const userQuery = useQuery(meOptions);
+  const authMethodsQuery = useQuery(authMethods());
+  const hasFirstUserQuery = useQuery(hasFirstUser());
+  const permissionsQuery = useQuery({
+    ...checkAuthorization({ checks: permissionsToCheck }),
+    enabled: userQuery.data !== undefined,
+  });
+
+  const loginMutation = useMutation(
+    login({ checks: permissionsToCheck }, queryClient),
+  );
+  const logoutMutation = useMutation(logout(queryClient));
+  const updateProfileMutation = useMutation({
+    ...updateProfileOptions(),
+    onSuccess: (user) => {
+      queryClient.setQueryData(meOptions.queryKey, user);
+      displaySuccess("Updated settings.");
+    },
+  });
+
+  const isSignedOut =
+    userQuery.isError &&
+    isApiError(userQuery.error) &&
+    userQuery.error.response.status === 401;
+  const isSigningOut = logoutMutation.isLoading;
+  const isLoading =
+    authMethodsQuery.isLoading ||
+    userQuery.isLoading ||
+    hasFirstUserQuery.isLoading ||
+    (userQuery.isSuccess && permissionsQuery.isLoading);
+  const isConfiguringTheFirstUser = !hasFirstUserQuery.data;
+  const isSignedIn = userQuery.isSuccess && userQuery.data !== undefined;
+  const isSigningIn = loginMutation.isLoading;
+  const isUpdatingProfile = updateProfileMutation.isLoading;
+
+  const signOut = useCallback(() => {
+    logoutMutation.mutate();
+  }, [logoutMutation]);
+
+  const signIn = async (email: string, password: string) => {
+    await loginMutation.mutateAsync({ email, password });
+  };
+
+  const updateProfile = (req: UpdateUserProfileRequest) => {
+    updateProfileMutation.mutate({ userId: userQuery.data!.id, req });
+  };
+
+  if (isLoading) {
+    return <FullScreenLoader />;
+  }
 
   return (
-    <AuthContext.Provider value={{ authService }}>
+    <AuthContext.Provider
+      value={{
+        isSignedOut,
+        isSigningOut,
+        isConfiguringTheFirstUser,
+        isSignedIn,
+        isSigningIn,
+        isUpdatingProfile,
+        signOut,
+        signIn,
+        updateProfile,
+        user: userQuery.data,
+        permissions: permissionsQuery.data as Permissions | undefined,
+        authMethods: authMethodsQuery.data,
+        signInError: loginMutation.error,
+        updateProfileError: updateProfileMutation.error,
+      }}
+    >
       {children}
     </AuthContext.Provider>
-  )
-}
+  );
+};
 
-type UseAuthReturnType = ReturnType<
-  typeof useActor<AuthContextValue["authService"]>
->
-
-export const useAuth = (): UseAuthReturnType => {
-  const context = useContext(AuthContext)
+export const useAuth = () => {
+  const context = useContext(AuthContext);
 
   if (!context) {
-    throw new Error("useAuth should be used inside of <AuthProvider />")
+    throw new Error("useAuth should be used inside of <AuthProvider />");
   }
 
-  const auth = useActor(context.authService)
-
-  return auth
-}
+  return context;
+};
diff --git a/site/src/components/AuthProvider/permissions.tsx b/site/src/components/AuthProvider/permissions.tsx
new file mode 100644
index 0000000000000..6e39286edbbaa
--- /dev/null
+++ b/site/src/components/AuthProvider/permissions.tsx
@@ -0,0 +1,98 @@
+export const checks = {
+  readAllUsers: "readAllUsers",
+  updateUsers: "updateUsers",
+  createUser: "createUser",
+  createTemplates: "createTemplates",
+  updateTemplates: "updateTemplates",
+  deleteTemplates: "deleteTemplates",
+  viewAuditLog: "viewAuditLog",
+  viewDeploymentValues: "viewDeploymentValues",
+  createGroup: "createGroup",
+  viewUpdateCheck: "viewUpdateCheck",
+  viewExternalAuthConfig: "viewExternalAuthConfig",
+  viewDeploymentStats: "viewDeploymentStats",
+  editWorkspaceProxies: "editWorkspaceProxies",
+} as const;
+
+export const permissionsToCheck = {
+  [checks.readAllUsers]: {
+    object: {
+      resource_type: "user",
+    },
+    action: "read",
+  },
+  [checks.updateUsers]: {
+    object: {
+      resource_type: "user",
+    },
+    action: "update",
+  },
+  [checks.createUser]: {
+    object: {
+      resource_type: "user",
+    },
+    action: "create",
+  },
+  [checks.createTemplates]: {
+    object: {
+      resource_type: "template",
+    },
+    action: "update",
+  },
+  [checks.updateTemplates]: {
+    object: {
+      resource_type: "template",
+    },
+    action: "update",
+  },
+  [checks.deleteTemplates]: {
+    object: {
+      resource_type: "template",
+    },
+    action: "delete",
+  },
+  [checks.viewAuditLog]: {
+    object: {
+      resource_type: "audit_log",
+    },
+    action: "read",
+  },
+  [checks.viewDeploymentValues]: {
+    object: {
+      resource_type: "deployment_config",
+    },
+    action: "read",
+  },
+  [checks.createGroup]: {
+    object: {
+      resource_type: "group",
+    },
+    action: "create",
+  },
+  [checks.viewUpdateCheck]: {
+    object: {
+      resource_type: "deployment_config",
+    },
+    action: "read",
+  },
+  [checks.viewExternalAuthConfig]: {
+    object: {
+      resource_type: "deployment_config",
+    },
+    action: "read",
+  },
+  [checks.viewDeploymentStats]: {
+    object: {
+      resource_type: "deployment_stats",
+    },
+    action: "read",
+  },
+  [checks.editWorkspaceProxies]: {
+    object: {
+      resource_type: "workspace_proxy",
+    },
+    action: "create",
+  },
+} as const;
+
+export type Permissions = Record<keyof typeof permissionsToCheck, boolean>;
diff --git a/site/src/components/Avatar/Avatar.stories.tsx b/site/src/components/Avatar/Avatar.stories.tsx
index c7b2fc1513230..67c5a5596fa54 100644
--- a/site/src/components/Avatar/Avatar.stories.tsx
+++ b/site/src/components/Avatar/Avatar.stories.tsx
@@ -1,61 +1,71 @@
-import { Story } from "@storybook/react"
-import { Avatar, AvatarIcon, AvatarProps } from "./Avatar"
-import PauseIcon from "@mui/icons-material/PauseOutlined"
+import type { Meta, StoryObj } from "@storybook/react";
+import { Avatar, AvatarIcon } from "./Avatar";
+import PauseIcon from "@mui/icons-material/PauseOutlined";
 
-export default {
+const meta: Meta<typeof Avatar> = {
   title: "components/Avatar",
   component: Avatar,
-}
-
-const Template: Story<AvatarProps> = (args: AvatarProps) => <Avatar {...args} />
-
-export const Letter = Template.bind({})
-Letter.args = {
-  children: "Coder",
-}
-
-export const LetterXL = Template.bind({})
-LetterXL.args = {
-  children: "Coder",
-  size: "xl",
-}
-
-export const LetterDarken = Template.bind({})
-LetterDarken.args = {
-  children: "Coder",
-  colorScheme: "darken",
-}
-
-export const Image = Template.bind({})
-Image.args = {
-  src: "https://avatars.githubusercontent.com/u/95932066?s=200&v=4",
-}
-
-export const ImageXL = Template.bind({})
-ImageXL.args = {
-  src: "https://avatars.githubusercontent.com/u/95932066?s=200&v=4",
-  size: "xl",
-}
-
-export const MuiIcon = Template.bind({})
-MuiIcon.args = {
-  children: <PauseIcon />,
-}
-
-export const MuiIconDarken = Template.bind({})
-MuiIconDarken.args = {
-  children: <PauseIcon />,
-  colorScheme: "darken",
-}
-
-export const MuiIconXL = Template.bind({})
-MuiIconXL.args = {
-  children: <PauseIcon />,
-  size: "xl",
-}
-
-export const AvatarIconDarken = Template.bind({})
-AvatarIconDarken.args = {
-  children: <AvatarIcon src="/icon/database.svg" />,
-  colorScheme: "darken",
-}
+};
+
+export default meta;
+type Story = StoryObj<typeof Avatar>;
+
+export const Letter: Story = {
+  args: {
+    children: "Coder",
+  },
+};
+
+export const LetterXL = {
+  args: {
+    children: "Coder",
+    size: "xl",
+  },
+};
+
+export const LetterDarken = {
+  args: {
+    children: "Coder",
+    colorScheme: "darken",
+  },
+};
+
+export const Image = {
+  args: {
+    src: "https://avatars.githubusercontent.com/u/95932066?s=200&v=4",
+  },
+};
+
+export const ImageXL = {
+  args: {
+    src: "https://avatars.githubusercontent.com/u/95932066?s=200&v=4",
+    size: "xl",
+  },
+};
+
+export const MuiIcon = {
+  args: {
+    children: <PauseIcon />,
+  },
+};
+
+export const MuiIconDarken = {
+  args: {
+    children: <PauseIcon />,
+    colorScheme: "darken",
+  },
+};
+
+export const MuiIconXL = {
+  args: {
+    children: <PauseIcon />,
+    size: "xl",
+  },
+};
+
+export const AvatarIconDarken = {
+  args: {
+    children: <AvatarIcon src="/icon/database.svg" />,
+    colorScheme: "darken",
+  },
+};
diff --git a/site/src/components/Avatar/Avatar.tsx b/site/src/components/Avatar/Avatar.tsx
index 20eb1f1ab2203..89de1f174ba4b 100644
--- a/site/src/components/Avatar/Avatar.tsx
+++ b/site/src/components/Avatar/Avatar.tsx
@@ -1,80 +1,90 @@
 // This is the only place MuiAvatar can be used
 // eslint-disable-next-line no-restricted-imports -- Read above
-import MuiAvatar, { AvatarProps as MuiAvatarProps } from "@mui/material/Avatar"
-import { makeStyles } from "@mui/styles"
-import { FC } from "react"
-import { combineClasses } from "utils/combineClasses"
-import { firstLetter } from "./firstLetter"
+import MuiAvatar, { AvatarProps as MuiAvatarProps } from "@mui/material/Avatar";
+import { FC } from "react";
+import { css, type Interpolation, type Theme } from "@emotion/react";
 
 export type AvatarProps = MuiAvatarProps & {
-  size?: "sm" | "md" | "xl"
-  colorScheme?: "light" | "darken"
-  fitImage?: boolean
-}
+  size?: "xs" | "sm" | "md" | "xl";
+  colorScheme?: "light" | "darken";
+  fitImage?: boolean;
+};
+
+const sizeStyles = {
+  xs: (theme) => ({
+    width: theme.spacing(2),
+    height: theme.spacing(2),
+    fontSize: theme.spacing(1),
+    fontWeight: 700,
+  }),
+  sm: (theme) => ({
+    width: theme.spacing(3),
+    height: theme.spacing(3),
+    fontSize: theme.spacing(1.5),
+    fontWeight: 600,
+  }),
+  md: {},
+  xl: (theme) => ({
+    width: theme.spacing(6),
+    height: theme.spacing(6),
+    fontSize: theme.spacing(3),
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
+
+const colorStyles = {
+  light: {},
+  darken: (theme) => ({
+    background: theme.palette.divider,
+    color: theme.palette.text.primary,
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
+
+const fitImageStyles = css`
+  & .MuiAvatar-img {
+    object-fit: contain;
+  }
+`;
 
 export const Avatar: FC<AvatarProps> = ({
   size = "md",
   colorScheme = "light",
   fitImage,
-  className,
   children,
   ...muiProps
 }) => {
-  const styles = useStyles()
-
   return (
     <MuiAvatar
       {...muiProps}
-      className={combineClasses([
-        className,
-        styles[size],
-        styles[colorScheme],
-        fitImage && styles.fitImage,
-      ])}
+      css={[
+        sizeStyles[size],
+        colorStyles[colorScheme],
+        fitImage && fitImageStyles,
+      ]}
     >
-      {/* If the children is a string, we always want to render the first letter */}
       {typeof children === "string" ? firstLetter(children) : children}
     </MuiAvatar>
-  )
-}
+  );
+};
 
 /**
  * Use it to make an img element behaves like a MaterialUI Icon component
  */
 export const AvatarIcon: FC<{ src: string }> = ({ src }) => {
-  const styles = useStyles()
-  return <img src={src} alt="" className={styles.avatarIcon} />
-}
+  return (
+    <img
+      src={src}
+      alt=""
+      css={{
+        maxWidth: "50%",
+      }}
+    />
+  );
+};
 
-const useStyles = makeStyles((theme) => ({
-  // Size styles
-  sm: {
-    width: theme.spacing(3),
-    height: theme.spacing(3),
-    fontSize: theme.spacing(1.5),
-  },
-  // Just use the default value from theme
-  md: {},
-  xl: {
-    width: theme.spacing(6),
-    height: theme.spacing(6),
-    fontSize: theme.spacing(3),
-  },
-  // Colors
-  // Just use the default value from theme
-  light: {},
-  darken: {
-    background: theme.palette.divider,
-    color: theme.palette.text.primary,
-  },
-  // Avatar icon
-  avatarIcon: {
-    maxWidth: "50%",
-  },
-  // Fit image
-  fitImage: {
-    "& .MuiAvatar-img": {
-      objectFit: "contain",
-    },
-  },
-}))
+const firstLetter = (str: string): string => {
+  if (str.length > 0) {
+    return str[0].toLocaleUpperCase();
+  }
+
+  return "";
+};
diff --git a/site/src/components/Avatar/firstLetter.test.ts b/site/src/components/Avatar/firstLetter.test.ts
deleted file mode 100644
index 047026af9dcf7..0000000000000
--- a/site/src/components/Avatar/firstLetter.test.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-import { firstLetter } from "./firstLetter"
-
-describe("first-letter", () => {
-  it.each<[string, string]>([
-    ["", ""],
-    ["User", "U"],
-    ["test", "T"],
-  ])(`firstLetter(%p) returns %p`, (input, expected) => {
-    expect(firstLetter(input)).toBe(expected)
-  })
-})
diff --git a/site/src/components/Avatar/firstLetter.ts b/site/src/components/Avatar/firstLetter.ts
deleted file mode 100644
index 7402615915b41..0000000000000
--- a/site/src/components/Avatar/firstLetter.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * firstLetter extracts the first character and returns it, uppercased.
- */
-export const firstLetter = (str: string): string => {
-  if (str.length > 0) {
-    return str[0].toLocaleUpperCase()
-  }
-
-  return ""
-}
diff --git a/site/src/components/AvatarData/AvatarData.stories.tsx b/site/src/components/AvatarData/AvatarData.stories.tsx
index bd4fa143107c2..9457395dae09b 100644
--- a/site/src/components/AvatarData/AvatarData.stories.tsx
+++ b/site/src/components/AvatarData/AvatarData.stories.tsx
@@ -1,24 +1,22 @@
-import { Story } from "@storybook/react"
-import { AvatarData, AvatarDataProps } from "./AvatarData"
+import type { Meta, StoryObj } from "@storybook/react";
+import { AvatarData } from "./AvatarData";
 
-export default {
+const meta: Meta<typeof AvatarData> = {
   title: "components/AvatarData",
   component: AvatarData,
-}
+  args: {
+    title: "coder",
+    subtitle: "coder@coder.com",
+  },
+};
 
-const Template: Story<AvatarDataProps> = (args: AvatarDataProps) => (
-  <AvatarData {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof AvatarData>;
 
-export const Example = Template.bind({})
-Example.args = {
-  title: "coder",
-  subtitle: "coder@coder.com",
-}
+export const WithTitleAndSubtitle: Story = {};
 
-export const WithImage = Template.bind({})
-WithImage.args = {
-  title: "coder",
-  subtitle: "coder@coder.com",
-  src: "https://avatars.githubusercontent.com/u/95932066?s=200&v=4",
-}
+export const WithImage: Story = {
+  args: {
+    src: "https://avatars.githubusercontent.com/u/95932066?s=200&v=4",
+  },
+};
diff --git a/site/src/components/AvatarData/AvatarData.tsx b/site/src/components/AvatarData/AvatarData.tsx
index 135dba4de6c43..ba5d7db14dfeb 100644
--- a/site/src/components/AvatarData/AvatarData.tsx
+++ b/site/src/components/AvatarData/AvatarData.tsx
@@ -1,25 +1,25 @@
-import { Avatar } from "components/Avatar/Avatar"
-import { FC, PropsWithChildren } from "react"
-import { Stack } from "components/Stack/Stack"
-import { makeStyles } from "@mui/styles"
+import type { FC } from "react";
+import { useTheme } from "@emotion/react";
+import { Avatar } from "components/Avatar/Avatar";
+import { Stack } from "components/Stack/Stack";
 
 export interface AvatarDataProps {
-  title: string | JSX.Element
-  subtitle?: string
-  src?: string
-  avatar?: React.ReactNode
+  title: string | JSX.Element;
+  subtitle?: string;
+  src?: string;
+  avatar?: React.ReactNode;
 }
 
-export const AvatarData: FC<PropsWithChildren<AvatarDataProps>> = ({
+export const AvatarData: FC<AvatarDataProps> = ({
   title,
   subtitle,
   src,
   avatar,
 }) => {
-  const styles = useStyles()
+  const theme = useTheme();
 
   if (!avatar) {
-    avatar = <Avatar src={src}>{title}</Avatar>
+    avatar = <Avatar src={src}>{title}</Avatar>;
   }
 
   return (
@@ -27,38 +27,41 @@ export const AvatarData: FC<PropsWithChildren<AvatarDataProps>> = ({
       spacing={1.5}
       direction="row"
       alignItems="center"
-      className={styles.root}
+      css={{
+        minHeight: theme.spacing(5), // Make it predictable for the skeleton
+        width: "100%",
+        lineHeight: "150%",
+      }}
     >
       {avatar}
 
-      <Stack spacing={0} className={styles.info}>
-        <span className={styles.title}>{title}</span>
-        {subtitle && <span className={styles.subtitle}>{subtitle}</span>}
+      <Stack
+        spacing={0}
+        css={{
+          width: "100%",
+        }}
+      >
+        <span
+          css={{
+            color: theme.palette.text.primary,
+            fontWeight: 600,
+          }}
+        >
+          {title}
+        </span>
+        {subtitle && (
+          <span
+            css={{
+              fontSize: 12,
+              color: theme.palette.text.secondary,
+              lineHeight: "150%",
+              maxWidth: 540,
+            }}
+          >
+            {subtitle}
+          </span>
+        )}
       </Stack>
     </Stack>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    minHeight: theme.spacing(5), // Make it predictable for the skeleton
-    width: "100%",
-    lineHeight: "150%",
-  },
-
-  info: {
-    width: "100%",
-  },
-
-  title: {
-    color: theme.palette.text.primary,
-    fontWeight: 600,
-  },
-
-  subtitle: {
-    fontSize: 12,
-    color: theme.palette.text.secondary,
-    lineHeight: "150%",
-    maxWidth: 540,
-  },
-}))
+  );
+};
diff --git a/site/src/components/AvatarData/AvatarDataSkeleton.tsx b/site/src/components/AvatarData/AvatarDataSkeleton.tsx
index a519dd8ca49b4..275bbff15665d 100644
--- a/site/src/components/AvatarData/AvatarDataSkeleton.tsx
+++ b/site/src/components/AvatarData/AvatarDataSkeleton.tsx
@@ -1,6 +1,6 @@
-import { FC } from "react"
-import { Stack } from "components/Stack/Stack"
-import Skeleton from "@mui/material/Skeleton"
+import { FC } from "react";
+import { Stack } from "components/Stack/Stack";
+import Skeleton from "@mui/material/Skeleton";
 
 export const AvatarDataSkeleton: FC = () => {
   return (
@@ -12,5 +12,5 @@ export const AvatarDataSkeleton: FC = () => {
         <Skeleton variant="text" width={60} />
       </Stack>
     </Stack>
-  )
-}
+  );
+};
diff --git a/site/src/components/BorderedMenu/BorderedMenu.tsx b/site/src/components/BorderedMenu/BorderedMenu.tsx
deleted file mode 100644
index 9190845107fbd..0000000000000
--- a/site/src/components/BorderedMenu/BorderedMenu.tsx
+++ /dev/null
@@ -1,35 +0,0 @@
-import Popover, { PopoverProps } from "@mui/material/Popover"
-import { makeStyles } from "@mui/styles"
-import { FC, PropsWithChildren } from "react"
-
-type BorderedMenuVariant = "user-dropdown"
-
-export type BorderedMenuProps = Omit<PopoverProps, "variant"> & {
-  variant?: BorderedMenuVariant
-}
-
-export const BorderedMenu: FC<PropsWithChildren<BorderedMenuProps>> = ({
-  children,
-  variant,
-  ...rest
-}) => {
-  const styles = useStyles()
-
-  return (
-    <Popover
-      classes={{ paper: styles.paperRoot }}
-      data-variant={variant}
-      {...rest}
-    >
-      {children}
-    </Popover>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  paperRoot: {
-    width: 260,
-    borderRadius: theme.shape.borderRadius,
-    boxShadow: theme.shadows[6],
-  },
-}))
diff --git a/site/src/components/BorderedMenuRow/BorderedMenuRow.tsx b/site/src/components/BorderedMenuRow/BorderedMenuRow.tsx
deleted file mode 100644
index fa67df6cf999e..0000000000000
--- a/site/src/components/BorderedMenuRow/BorderedMenuRow.tsx
+++ /dev/null
@@ -1,130 +0,0 @@
-import ListItem from "@mui/material/ListItem"
-import { makeStyles } from "@mui/styles"
-import CheckIcon from "@mui/icons-material/Check"
-import { FC } from "react"
-import { NavLink } from "react-router-dom"
-import { ellipsizeText } from "../../utils/ellipsizeText"
-import { Typography } from "../Typography/Typography"
-
-type BorderedMenuRowVariant = "narrow" | "wide"
-
-interface BorderedMenuRowProps {
-  /** `true` indicates this row is currently selected */
-  active?: boolean
-  /** Optional description that appears beneath the title */
-  description?: string
-  /** URL path */
-  path: string
-  /** Required title of this row */
-  title: string
-  /** Defaults to `"wide"` */
-  variant?: BorderedMenuRowVariant
-  /** Callback fired when this row is clicked */
-  onClick?: () => void
-}
-
-export const BorderedMenuRow: FC<
-  React.PropsWithChildren<BorderedMenuRowProps>
-> = ({ active, description, path, title, variant, onClick }) => {
-  const styles = useStyles()
-
-  return (
-    <NavLink className={styles.link} to={path}>
-      <ListItem
-        classes={{ gutters: styles.rootGutters }}
-        className={styles.root}
-        data-status={active ? "active" : "inactive"}
-        onClick={onClick}
-      >
-        <div className={styles.content} data-variant={variant}>
-          <div className={styles.contentTop}>
-            <Typography className={styles.title}>{title}</Typography>
-            {active && <CheckIcon className={styles.checkMark} />}
-          </div>
-
-          {description && (
-            <Typography
-              className={styles.description}
-              color="textSecondary"
-              variant="caption"
-            >
-              {ellipsizeText(description)}
-            </Typography>
-          )}
-        </div>
-      </ListItem>
-    </NavLink>
-  )
-}
-
-const iconSize = 20
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    cursor: "pointer",
-    padding: `0 ${theme.spacing(1)}`,
-
-    "&:hover": {
-      backgroundColor: "unset",
-      "& $content": {
-        backgroundColor: theme.palette.background.default,
-      },
-    },
-
-    "&[data-status='active']": {
-      color: theme.palette.secondary.dark,
-      "& .BorderedMenuRow-description": {
-        color: theme.palette.text.primary,
-      },
-      "& .BorderedMenuRow-icon": {
-        color: theme.palette.secondary.dark,
-      },
-    },
-  },
-  rootGutters: {
-    padding: `0 ${theme.spacing(1.5)}`,
-  },
-  content: {
-    borderRadius: theme.shape.borderRadius,
-    display: "flex",
-    flexDirection: "column",
-    padding: theme.spacing(2),
-    width: 320,
-
-    "&[data-variant='narrow']": {
-      width: 268,
-    },
-  },
-  contentTop: {
-    alignItems: "center",
-    display: "flex",
-  },
-  icon: {
-    color: theme.palette.text.secondary,
-    height: iconSize,
-    width: iconSize,
-
-    "& path": {
-      fill: theme.palette.text.secondary,
-    },
-  },
-  link: {
-    textDecoration: "none",
-    color: "inherit",
-  },
-  title: {
-    fontSize: 16,
-    fontWeight: 500,
-    lineHeight: 1.5,
-    marginLeft: theme.spacing(2),
-  },
-  checkMark: {
-    height: iconSize,
-    marginLeft: "auto",
-    width: iconSize,
-  },
-  description: {
-    marginLeft: theme.spacing(4.5),
-    marginTop: theme.spacing(0.5),
-  },
-}))
diff --git a/site/src/components/BuildAvatar/BuildAvatar.tsx b/site/src/components/BuildAvatar/BuildAvatar.tsx
new file mode 100644
index 0000000000000..810df5d83a6a8
--- /dev/null
+++ b/site/src/components/BuildAvatar/BuildAvatar.tsx
@@ -0,0 +1,54 @@
+import Badge from "@mui/material/Badge";
+import { useTheme, withStyles } from "@mui/styles";
+import { FC } from "react";
+import { WorkspaceBuild } from "api/typesGenerated";
+import { getDisplayWorkspaceBuildStatus } from "utils/workspace";
+import { Avatar, AvatarProps } from "components/Avatar/Avatar";
+import { PaletteIndex } from "theme/theme";
+import { Theme } from "@mui/material/styles";
+import { BuildIcon } from "components/BuildIcon/BuildIcon";
+
+interface StylesBadgeProps {
+  type: PaletteIndex;
+}
+
+const StyledBadge = withStyles((theme) => ({
+  badge: {
+    backgroundColor: ({ type }: StylesBadgeProps) => theme.palette[type].light,
+    borderRadius: "100%",
+    width: 8,
+    minWidth: 8,
+    height: 8,
+    display: "block",
+    padding: 0,
+  },
+}))(Badge);
+
+export interface BuildAvatarProps {
+  build: WorkspaceBuild;
+  size?: AvatarProps["size"];
+}
+
+export const BuildAvatar: FC<BuildAvatarProps> = ({ build, size }) => {
+  const theme = useTheme<Theme>();
+  const displayBuildStatus = getDisplayWorkspaceBuildStatus(theme, build);
+
+  return (
+    <StyledBadge
+      role="status"
+      type={displayBuildStatus.type}
+      arial-label={displayBuildStatus.status}
+      title={displayBuildStatus.status}
+      overlap="circular"
+      anchorOrigin={{
+        vertical: "bottom",
+        horizontal: "right",
+      }}
+      badgeContent={<div></div>}
+    >
+      <Avatar size={size} colorScheme="darken">
+        <BuildIcon transition={build.transition} />
+      </Avatar>
+    </StyledBadge>
+  );
+};
diff --git a/site/src/components/BuildIcon/BuildIcon.tsx b/site/src/components/BuildIcon/BuildIcon.tsx
new file mode 100644
index 0000000000000..41b87f66b6378
--- /dev/null
+++ b/site/src/components/BuildIcon/BuildIcon.tsx
@@ -0,0 +1,22 @@
+import PlayArrowOutlined from "@mui/icons-material/PlayArrowOutlined";
+import StopOutlined from "@mui/icons-material/StopOutlined";
+import DeleteOutlined from "@mui/icons-material/DeleteOutlined";
+import { WorkspaceTransition } from "api/typesGenerated";
+import { ComponentProps } from "react";
+
+type SVGIcon = typeof PlayArrowOutlined;
+
+type SVGIconProps = ComponentProps<SVGIcon>;
+
+const iconByTransition: Record<WorkspaceTransition, SVGIcon> = {
+  start: PlayArrowOutlined,
+  stop: StopOutlined,
+  delete: DeleteOutlined,
+};
+
+export const BuildIcon = (
+  props: SVGIconProps & { transition: WorkspaceTransition },
+) => {
+  const Icon = iconByTransition[props.transition];
+  return <Icon {...props} />;
+};
diff --git a/site/src/components/BuildsTable/BuildAvatar.tsx b/site/src/components/BuildsTable/BuildAvatar.tsx
deleted file mode 100644
index e095bda76a32e..0000000000000
--- a/site/src/components/BuildsTable/BuildAvatar.tsx
+++ /dev/null
@@ -1,62 +0,0 @@
-import Badge from "@mui/material/Badge"
-import { useTheme, withStyles } from "@mui/styles"
-import { FC } from "react"
-import PlayArrowOutlined from "@mui/icons-material/PlayArrowOutlined"
-import PauseOutlined from "@mui/icons-material/PauseOutlined"
-import DeleteOutlined from "@mui/icons-material/DeleteOutlined"
-import { WorkspaceBuild, WorkspaceTransition } from "api/typesGenerated"
-import { getDisplayWorkspaceBuildStatus } from "utils/workspace"
-import { Avatar, AvatarProps } from "components/Avatar/Avatar"
-import { PaletteIndex } from "theme/theme"
-import { Theme } from "@mui/material/styles"
-
-interface StylesBadgeProps {
-  type: PaletteIndex
-}
-
-const StyledBadge = withStyles((theme) => ({
-  badge: {
-    backgroundColor: ({ type }: StylesBadgeProps) => theme.palette[type].light,
-    borderRadius: "100%",
-    width: 8,
-    minWidth: 8,
-    height: 8,
-    display: "block",
-    padding: 0,
-  },
-}))(Badge)
-
-export interface BuildAvatarProps {
-  build: WorkspaceBuild
-  size?: AvatarProps["size"]
-}
-
-const iconByTransition: Record<WorkspaceTransition, JSX.Element> = {
-  start: <PlayArrowOutlined />,
-  stop: <PauseOutlined />,
-  delete: <DeleteOutlined />,
-}
-
-export const BuildAvatar: FC<BuildAvatarProps> = ({ build, size }) => {
-  const theme = useTheme<Theme>()
-  const displayBuildStatus = getDisplayWorkspaceBuildStatus(theme, build)
-
-  return (
-    <StyledBadge
-      role="status"
-      type={displayBuildStatus.type}
-      arial-label={displayBuildStatus.status}
-      title={displayBuildStatus.status}
-      overlap="circular"
-      anchorOrigin={{
-        vertical: "bottom",
-        horizontal: "right",
-      }}
-      badgeContent={<div></div>}
-    >
-      <Avatar size={size} colorScheme="darken">
-        {iconByTransition[build.transition]}
-      </Avatar>
-    </StyledBadge>
-  )
-}
diff --git a/site/src/components/BuildsTable/BuildRow.tsx b/site/src/components/BuildsTable/BuildRow.tsx
deleted file mode 100644
index 8cf0a1122c8ce..0000000000000
--- a/site/src/components/BuildsTable/BuildRow.tsx
+++ /dev/null
@@ -1,135 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import TableCell from "@mui/material/TableCell"
-import { WorkspaceBuild } from "api/typesGenerated"
-import { Stack } from "components/Stack/Stack"
-import { TimelineEntry } from "components/Timeline/TimelineEntry"
-import { useClickable } from "hooks/useClickable"
-import { useTranslation } from "react-i18next"
-import { useNavigate } from "react-router-dom"
-import { MONOSPACE_FONT_FAMILY } from "theme/constants"
-import {
-  displayWorkspaceBuildDuration,
-  getDisplayWorkspaceBuildInitiatedBy,
-} from "utils/workspace"
-import { BuildAvatar } from "./BuildAvatar"
-
-export interface BuildRowProps {
-  build: WorkspaceBuild
-}
-
-export const BuildRow: React.FC<BuildRowProps> = ({ build }) => {
-  const styles = useStyles()
-  const { t } = useTranslation("workspacePage")
-  const initiatedBy = getDisplayWorkspaceBuildInitiatedBy(build)
-  const navigate = useNavigate()
-  const clickableProps = useClickable(() =>
-    navigate(`builds/${build.build_number}`),
-  )
-
-  return (
-    <TimelineEntry hover data-testid={`build-${build.id}`} {...clickableProps}>
-      <TableCell className={styles.buildCell}>
-        <Stack
-          direction="row"
-          alignItems="center"
-          className={styles.buildWrapper}
-        >
-          <Stack
-            direction="row"
-            alignItems="center"
-            className={styles.fullWidth}
-          >
-            <BuildAvatar build={build} />
-            <Stack
-              direction="row"
-              justifyContent="space-between"
-              alignItems="center"
-              className={styles.fullWidth}
-            >
-              <Stack
-                className={styles.buildSummary}
-                direction="row"
-                alignItems="center"
-                spacing={1}
-              >
-                <span>
-                  <strong>{initiatedBy}</strong>{" "}
-                  {build.reason !== "initiator"
-                    ? t("buildMessage.automatically")
-                    : ""}
-                  <strong>{t(`buildMessage.${build.transition}`)}</strong>{" "}
-                  {t("buildMessage.theWorkspace")}
-                </span>
-
-                <span className={styles.buildTime}>
-                  {new Date(build.created_at).toLocaleTimeString()}
-                </span>
-              </Stack>
-
-              <Stack direction="row" spacing={1}>
-                <span className={styles.buildInfo}>
-                  {t("buildData.reason")}: <strong>{build.reason}</strong>
-                </span>
-
-                <span className={styles.buildInfo}>
-                  {t("buildData.duration")}:{" "}
-                  <strong>{displayWorkspaceBuildDuration(build)}</strong>
-                </span>
-
-                <span className={styles.buildInfo}>
-                  {t("buildData.version")}:{" "}
-                  <strong>{build.template_version_name}</strong>
-                </span>
-              </Stack>
-            </Stack>
-          </Stack>
-        </Stack>
-      </TableCell>
-    </TimelineEntry>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  buildWrapper: {
-    padding: theme.spacing(2, 4),
-  },
-
-  buildCell: {
-    padding: "0 !important",
-    position: "relative",
-    borderBottom: 0,
-  },
-
-  buildSummary: {
-    ...theme.typography.body1,
-    fontFamily: "inherit",
-  },
-
-  buildInfo: {
-    ...theme.typography.body2,
-    fontSize: 12,
-    fontFamily: "inherit",
-    color: theme.palette.text.secondary,
-    display: "block",
-  },
-
-  buildTime: {
-    color: theme.palette.text.secondary,
-    fontSize: 12,
-  },
-
-  buildRight: {
-    width: "auto",
-  },
-
-  buildExtraInfo: {
-    ...theme.typography.body2,
-    fontFamily: MONOSPACE_FONT_FAMILY,
-    color: theme.palette.text.secondary,
-    whiteSpace: "nowrap",
-  },
-
-  fullWidth: {
-    width: "100%",
-  },
-}))
diff --git a/site/src/components/BuildsTable/BuildsTable.stories.tsx b/site/src/components/BuildsTable/BuildsTable.stories.tsx
deleted file mode 100644
index e7791d428326e..0000000000000
--- a/site/src/components/BuildsTable/BuildsTable.stories.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { MockBuilds } from "../../testHelpers/entities"
-import { BuildsTable, BuildsTableProps } from "./BuildsTable"
-
-export default {
-  title: "components/BuildsTable",
-  component: BuildsTable,
-} as ComponentMeta<typeof BuildsTable>
-
-const Template: Story<BuildsTableProps> = (args) => <BuildsTable {...args} />
-
-export const Example = Template.bind({})
-Example.args = {
-  builds: MockBuilds,
-}
-
-export const Empty = Template.bind({})
-Empty.args = {
-  builds: [],
-}
diff --git a/site/src/components/BuildsTable/BuildsTable.tsx b/site/src/components/BuildsTable/BuildsTable.tsx
deleted file mode 100644
index 2ea2dca2dda6a..0000000000000
--- a/site/src/components/BuildsTable/BuildsTable.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-import Box from "@mui/material/Box"
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableRow from "@mui/material/TableRow"
-import { Timeline } from "components/Timeline/Timeline"
-import { FC } from "react"
-import * as TypesGen from "../../api/typesGenerated"
-import { EmptyState } from "../EmptyState/EmptyState"
-import { TableLoader } from "../TableLoader/TableLoader"
-import { BuildRow } from "./BuildRow"
-
-export const Language = {
-  emptyMessage: "No builds found",
-}
-
-export interface BuildsTableProps {
-  builds?: TypesGen.WorkspaceBuild[]
-}
-
-export const BuildsTable: FC<React.PropsWithChildren<BuildsTableProps>> = ({
-  builds,
-}) => {
-  return (
-    <TableContainer>
-      <Table data-testid="builds-table" aria-describedby="builds table">
-        <TableBody>
-          {builds ? (
-            <Timeline
-              items={builds}
-              getDate={(build) => new Date(build.created_at)}
-              row={(build) => <BuildRow key={build.id} build={build} />}
-            />
-          ) : (
-            <TableLoader />
-          )}
-
-          {builds && builds.length === 0 && (
-            <TableRow>
-              <TableCell colSpan={999}>
-                <Box p={4}>
-                  <EmptyState message={Language.emptyMessage} />
-                </Box>
-              </TableCell>
-            </TableRow>
-          )}
-        </TableBody>
-      </Table>
-    </TableContainer>
-  )
-}
diff --git a/site/src/components/CodeBlock/CodeBlock.stories.tsx b/site/src/components/CodeBlock/CodeBlock.stories.tsx
deleted file mode 100644
index 2716b32b7973d..0000000000000
--- a/site/src/components/CodeBlock/CodeBlock.stories.tsx
+++ /dev/null
@@ -1,25 +0,0 @@
-import { Story } from "@storybook/react"
-import { CodeBlock, CodeBlockProps } from "./CodeBlock"
-
-const sampleLines = `Successfully assigned coder/image-jcws7 to cluster-1
-Container image "gcr.io/coder-dogfood/master/coder-dev-ubuntu@sha256" already present on machine
-Created container user
-Started container user
-Using user 'coder' with shell '/bin/bash'`.split("\n")
-
-export default {
-  title: "components/CodeBlock",
-  component: CodeBlock,
-  argTypes: {
-    lines: { control: "text", defaultValue: sampleLines },
-  },
-}
-
-const Template: Story<CodeBlockProps> = (args: CodeBlockProps) => (
-  <CodeBlock {...args} />
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  lines: sampleLines,
-}
diff --git a/site/src/components/CodeBlock/CodeBlock.test.tsx b/site/src/components/CodeBlock/CodeBlock.test.tsx
deleted file mode 100644
index 3140893385c84..0000000000000
--- a/site/src/components/CodeBlock/CodeBlock.test.tsx
+++ /dev/null
@@ -1,15 +0,0 @@
-import { screen } from "@testing-library/react"
-import { render } from "../../testHelpers/renderHelpers"
-import { CodeBlock } from "./CodeBlock"
-
-describe("CodeBlock", () => {
-  it("renders lines)", async () => {
-    // When
-    render(<CodeBlock lines={["line1", "line2"]} />)
-
-    // Then
-    // Both lines should be rendered
-    await screen.findByText("line1")
-    await screen.findByText("line2")
-  })
-})
diff --git a/site/src/components/CodeBlock/CodeBlock.tsx b/site/src/components/CodeBlock/CodeBlock.tsx
deleted file mode 100644
index e7af0b9d3226b..0000000000000
--- a/site/src/components/CodeBlock/CodeBlock.tsx
+++ /dev/null
@@ -1,59 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import { FC, Fragment, ReactElement } from "react"
-import { MONOSPACE_FONT_FAMILY } from "../../theme/constants"
-import { combineClasses } from "../../utils/combineClasses"
-
-export interface CodeBlockProps {
-  lines: string[]
-  ctas?: ReactElement[]
-  className?: string
-}
-
-export const CodeBlock: FC<React.PropsWithChildren<CodeBlockProps>> = ({
-  lines,
-  ctas,
-  className = "",
-}) => {
-  const styles = useStyles()
-
-  return (
-    <>
-      <div className={combineClasses([styles.root, className])}>
-        {lines.map((line, idx) => (
-          <div className={styles.line} key={idx}>
-            {line}
-          </div>
-        ))}
-      </div>
-      {ctas && ctas.length > 0 && (
-        <div className={styles.ctaBar}>
-          {ctas.map((cta, i) => {
-            return <Fragment key={i}>{cta}</Fragment>
-          })}
-        </div>
-      )}
-    </>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    minHeight: 156,
-    maxHeight: 240,
-    overflowY: "scroll",
-    background: theme.palette.background.default,
-    color: theme.palette.text.primary,
-    fontFamily: MONOSPACE_FONT_FAMILY,
-    fontSize: 13,
-    wordBreak: "break-all",
-    padding: theme.spacing(2),
-    borderRadius: theme.shape.borderRadius,
-  },
-  line: {
-    whiteSpace: "pre-wrap",
-  },
-  ctaBar: {
-    display: "flex",
-    justifyContent: "space-between",
-  },
-}))
diff --git a/site/src/components/CodeExample/CodeExample.stories.tsx b/site/src/components/CodeExample/CodeExample.stories.tsx
index aabd7e9fe2b31..35c3da065f467 100644
--- a/site/src/components/CodeExample/CodeExample.stories.tsx
+++ b/site/src/components/CodeExample/CodeExample.stories.tsx
@@ -1,26 +1,27 @@
-import { Story } from "@storybook/react"
-import { CodeExample, CodeExampleProps } from "./CodeExample"
+import type { Meta, StoryObj } from "@storybook/react";
+import { CodeExample } from "./CodeExample";
 
-const sampleCode = `echo "Hello, world"`
+const sampleCode = `echo "Hello, world"`;
 
-export default {
+const meta: Meta<typeof CodeExample> = {
   title: "components/CodeExample",
   component: CodeExample,
   argTypes: {
     code: { control: "string", defaultValue: sampleCode },
   },
-}
+};
 
-const Template: Story<CodeExampleProps> = (args: CodeExampleProps) => (
-  <CodeExample {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof CodeExample>;
 
-export const Example = Template.bind({})
-Example.args = {
-  code: sampleCode,
-}
+export const Example: Story = {
+  args: {
+    code: sampleCode,
+  },
+};
 
-export const LongCode = Template.bind({})
-LongCode.args = {
-  code: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICnKzATuWwmmt5+CKTPuRGN0R1PBemA+6/SStpLiyX+L",
-}
+export const LongCode: Story = {
+  args: {
+    code: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICnKzATuWwmmt5+CKTPuRGN0R1PBemA+6/SStpLiyX+L",
+  },
+};
diff --git a/site/src/components/CodeExample/CodeExample.test.tsx b/site/src/components/CodeExample/CodeExample.test.tsx
deleted file mode 100644
index 32d992f44eb24..0000000000000
--- a/site/src/components/CodeExample/CodeExample.test.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import { screen } from "@testing-library/react"
-import { render } from "../../testHelpers/renderHelpers"
-import { CodeExample } from "./CodeExample"
-
-describe("CodeExample", () => {
-  it("renders code", async () => {
-    // When
-    render(<CodeExample code="echo hello" />)
-
-    // Then
-    // Both lines should be rendered
-    await screen.findByText("echo hello")
-  })
-})
diff --git a/site/src/components/CodeExample/CodeExample.tsx b/site/src/components/CodeExample/CodeExample.tsx
index 7d18b286b4c17..aaf5aca6432a0 100644
--- a/site/src/components/CodeExample/CodeExample.tsx
+++ b/site/src/components/CodeExample/CodeExample.tsx
@@ -1,68 +1,51 @@
-import { makeStyles } from "@mui/styles"
-import { FC } from "react"
-import { MONOSPACE_FONT_FAMILY } from "../../theme/constants"
-import { combineClasses } from "../../utils/combineClasses"
-import { CopyButton } from "../CopyButton/CopyButton"
-import { Theme } from "@mui/material/styles"
+import { type FC } from "react";
+import { useTheme } from "@emotion/react";
+import { MONOSPACE_FONT_FAMILY } from "theme/constants";
+import { CopyButton } from "../CopyButton/CopyButton";
 
 export interface CodeExampleProps {
-  code: string
-  className?: string
-  buttonClassName?: string
-  tooltipTitle?: string
-  inline?: boolean
-  password?: boolean
+  code: string;
+  password?: boolean;
+  className?: string;
 }
 
 /**
  * Component to show single-line code examples, with a copy button
  */
-export const CodeExample: FC<React.PropsWithChildren<CodeExampleProps>> = ({
-  code,
-  className,
-  buttonClassName,
-  tooltipTitle,
-  inline,
-}) => {
-  const styles = useStyles({ inline: inline })
+export const CodeExample: FC<CodeExampleProps> = (props) => {
+  const { code, password, className } = props;
+  const theme = useTheme();
 
   return (
-    <div className={combineClasses([styles.root, className])}>
-      <code className={styles.code}>{code}</code>
-      <CopyButton
-        text={code}
-        tooltipTitle={tooltipTitle}
-        buttonClassName={buttonClassName}
-      />
+    <div
+      css={{
+        display: "flex",
+        flexDirection: "row",
+        alignItems: "center",
+        background: "rgb(0 0 0 / 30%)",
+        color: theme.palette.primary.contrastText,
+        fontFamily: MONOSPACE_FONT_FAMILY,
+        fontSize: 14,
+        borderRadius: theme.shape.borderRadius,
+        padding: theme.spacing(1),
+        lineHeight: "150%",
+        border: `1px solid ${theme.palette.divider}`,
+      }}
+      className={className}
+    >
+      <code
+        css={{
+          padding: theme.spacing(0, 1),
+          width: "100%",
+          display: "flex",
+          alignItems: "center",
+          wordBreak: "break-all",
+          "-webkit-text-security": password ? "disc" : undefined,
+        }}
+      >
+        {code}
+      </code>
+      <CopyButton text={code} />
     </div>
-  )
-}
-
-interface styleProps {
-  inline?: boolean
-  password?: boolean
-}
-
-const useStyles = makeStyles<Theme, styleProps>((theme) => ({
-  root: (props) => ({
-    display: props.inline ? "inline-flex" : "flex",
-    flexDirection: "row",
-    alignItems: "center",
-    background: props.inline ? "rgb(0 0 0 / 30%)" : "hsl(223, 27%, 3%)",
-    border: props.inline ? undefined : `1px solid ${theme.palette.divider}`,
-    color: theme.palette.primary.contrastText,
-    fontFamily: MONOSPACE_FONT_FAMILY,
-    fontSize: 14,
-    borderRadius: theme.shape.borderRadius,
-    padding: theme.spacing(1),
-    lineHeight: "150%",
-  }),
-  code: {
-    padding: theme.spacing(0, 1),
-    width: "100%",
-    display: "flex",
-    alignItems: "center",
-    wordBreak: "break-all",
-    "-webkit-text-security": (props) => (props.password ? "disc" : undefined),
-  },
-}))
+  );
+};
diff --git a/site/src/components/Conditionals/ChooseOne.stories.tsx b/site/src/components/Conditionals/ChooseOne.stories.tsx
index a6c1bf8483c3f..7330a9bc6a018 100644
--- a/site/src/components/Conditionals/ChooseOne.stories.tsx
+++ b/site/src/components/Conditionals/ChooseOne.stories.tsx
@@ -1,46 +1,71 @@
-import { Story } from "@storybook/react"
-import { ChooseOne, Cond } from "./ChooseOne"
+import { Meta, StoryObj } from "@storybook/react";
+import { ChooseOne, Cond } from "./ChooseOne";
 
-export default {
+const meta: Meta<typeof ChooseOne> = {
   title: "components/Conditionals/ChooseOne",
   component: ChooseOne,
-  subcomponents: { Cond },
-}
+};
 
-export const FirstIsTrue: Story = () => (
-  <ChooseOne>
-    <Cond condition>The first one shows.</Cond>
-    <Cond condition={false}>The second one does not show.</Cond>
-    <Cond>The default does not show.</Cond>
-  </ChooseOne>
-)
+export default meta;
+type Story = StoryObj<typeof ChooseOne>;
 
-export const SecondIsTrue: Story = () => (
-  <ChooseOne>
-    <Cond condition={false}>The first one does not show.</Cond>
-    <Cond condition>The second one shows.</Cond>
-    <Cond>The default does not show.</Cond>
-  </ChooseOne>
-)
+export const FirstIsTrue: Story = {
+  args: {
+    children: [
+      <Cond key="1" condition>
+        The first one shows.
+      </Cond>,
+      <Cond key="2" condition={false}>
+        The second one does not show.
+      </Cond>,
+      <Cond key="3">The default does not show.</Cond>,
+    ],
+  },
+};
 
-export const AllAreTrue: Story = () => (
-  <ChooseOne>
-    <Cond condition>Only the first one shows.</Cond>
-    <Cond condition>The second one does not show.</Cond>
-    <Cond>The default does not show.</Cond>
-  </ChooseOne>
-)
+export const SecondIsTrue: Story = {
+  args: {
+    children: [
+      <Cond key="1" condition={false}>
+        The first one does not show.
+      </Cond>,
+      <Cond key="2" condition>
+        The second one shows.
+      </Cond>,
+      <Cond key="3">The default does not show.</Cond>,
+    ],
+  },
+};
+export const AllAreTrue: Story = {
+  args: {
+    children: [
+      <Cond key="1" condition>
+        Only the first one shows.
+      </Cond>,
+      <Cond key="2" condition>
+        The second one does not show.
+      </Cond>,
+      <Cond key="3">The default does not show.</Cond>,
+    ],
+  },
+};
 
-export const NoneAreTrue: Story = () => (
-  <ChooseOne>
-    <Cond condition={false}>The first one does not show.</Cond>
-    <Cond condition={false}>The second one does not show.</Cond>
-    <Cond>The default shows.</Cond>
-  </ChooseOne>
-)
+export const NoneAreTrue: Story = {
+  args: {
+    children: [
+      <Cond key="1" condition={false}>
+        The first one does not show.
+      </Cond>,
+      <Cond key="2" condition={false}>
+        The second one does not show.
+      </Cond>,
+      <Cond key="3">The default shows.</Cond>,
+    ],
+  },
+};
 
-export const OneCond: Story = () => (
-  <ChooseOne>
-    <Cond>An only child renders.</Cond>
-  </ChooseOne>
-)
+export const OneCond: Story = {
+  args: {
+    children: <Cond>An only child renders.</Cond>,
+  },
+};
diff --git a/site/src/components/Conditionals/ChooseOne.tsx b/site/src/components/Conditionals/ChooseOne.tsx
index 0f9087a94b0a8..36faac837dd5d 100644
--- a/site/src/components/Conditionals/ChooseOne.tsx
+++ b/site/src/components/Conditionals/ChooseOne.tsx
@@ -1,7 +1,7 @@
-import { Children, PropsWithChildren } from "react"
+import { Children, PropsWithChildren } from "react";
 
 export interface CondProps {
-  condition?: boolean
+  condition?: boolean;
 }
 
 /**
@@ -14,8 +14,8 @@ export interface CondProps {
 export const Cond = ({
   children,
 }: PropsWithChildren<CondProps>): JSX.Element => {
-  return <>{children}</>
-}
+  return <>{children}</>;
+};
 
 /**
  * Wrapper component for rendering exactly one of its children. Wrap each child in Cond to associate it
@@ -27,22 +27,22 @@ export const Cond = ({
 export const ChooseOne = ({
   children,
 }: PropsWithChildren): JSX.Element | null => {
-  const childArray = Children.toArray(children) as JSX.Element[]
+  const childArray = Children.toArray(children) as JSX.Element[];
   if (childArray.length === 0) {
-    return null
+    return null;
   }
-  const conditionedOptions = childArray.slice(0, childArray.length - 1)
-  const defaultCase = childArray[childArray.length - 1]
+  const conditionedOptions = childArray.slice(0, childArray.length - 1);
+  const defaultCase = childArray[childArray.length - 1];
   if (defaultCase.props.condition !== undefined) {
     throw new Error(
       "The last Cond in a ChooseOne was given a condition prop, but it is the default case.",
-    )
+    );
   }
   if (conditionedOptions.some((cond) => cond.props.condition === undefined)) {
     throw new Error(
       "A non-final Cond in a ChooseOne does not have a condition prop or the prop is undefined.",
-    )
+    );
   }
-  const chosen = conditionedOptions.find((child) => child.props.condition)
-  return chosen ?? defaultCase
-}
+  const chosen = conditionedOptions.find((child) => child.props.condition);
+  return chosen ?? defaultCase;
+};
diff --git a/site/src/components/Conditionals/Maybe.stories.tsx b/site/src/components/Conditionals/Maybe.stories.tsx
deleted file mode 100644
index 1d94a192a4b71..0000000000000
--- a/site/src/components/Conditionals/Maybe.stories.tsx
+++ /dev/null
@@ -1,21 +0,0 @@
-import { Story } from "@storybook/react"
-import { Maybe, MaybeProps } from "./Maybe"
-
-export default {
-  title: "components/Conditionals/Maybe",
-  component: Maybe,
-}
-
-const Template: Story<MaybeProps> = (args: MaybeProps) => (
-  <Maybe {...args}>Now you see me</Maybe>
-)
-
-export const ConditionIsTrue = Template.bind({})
-ConditionIsTrue.args = {
-  condition: true,
-}
-
-export const ConditionIsFalse = Template.bind({})
-ConditionIsFalse.args = {
-  condition: false,
-}
diff --git a/site/src/components/Conditionals/Maybe.tsx b/site/src/components/Conditionals/Maybe.tsx
deleted file mode 100644
index 63af6ddb194b9..0000000000000
--- a/site/src/components/Conditionals/Maybe.tsx
+++ /dev/null
@@ -1,17 +0,0 @@
-import { PropsWithChildren } from "react"
-
-export interface MaybeProps {
-  condition: boolean
-}
-
-/**
- * Wrapper component for conditionally rendering a child component without using "curly brace mode."
- * @param condition boolean expression that determines whether the child will be rendered
- * @returns the child or null
- */
-export const Maybe = ({
-  children,
-  condition,
-}: PropsWithChildren<MaybeProps>): JSX.Element | null => {
-  return condition ? <>{children}</> : null
-}
diff --git a/site/src/components/CopyButton/CopyButton.tsx b/site/src/components/CopyButton/CopyButton.tsx
index e7aa3228e545e..ca5ca9b7d4bc1 100644
--- a/site/src/components/CopyButton/CopyButton.tsx
+++ b/site/src/components/CopyButton/CopyButton.tsx
@@ -1,23 +1,22 @@
-import IconButton from "@mui/material/Button"
-import { makeStyles } from "@mui/styles"
-import Tooltip from "@mui/material/Tooltip"
-import Check from "@mui/icons-material/Check"
-import { useClipboard } from "hooks/useClipboard"
-import { combineClasses } from "../../utils/combineClasses"
-import { FileCopyIcon } from "../Icons/FileCopyIcon"
+import IconButton from "@mui/material/Button";
+import Tooltip from "@mui/material/Tooltip";
+import Check from "@mui/icons-material/Check";
+import { useClipboard } from "hooks/useClipboard";
+import { css } from "@emotion/react";
+import { FileCopyIcon } from "../Icons/FileCopyIcon";
 
 interface CopyButtonProps {
-  text: string
-  ctaCopy?: string
-  wrapperClassName?: string
-  buttonClassName?: string
-  tooltipTitle?: string
+  text: string;
+  ctaCopy?: string;
+  wrapperClassName?: string;
+  buttonClassName?: string;
+  tooltipTitle?: string;
 }
 
 export const Language = {
   tooltipTitle: "Copy to clipboard",
   ariaLabel: "Copy to clipboard",
-}
+};
 
 /**
  * Copy button used inside the CodeBlock component internally
@@ -29,51 +28,53 @@ export const CopyButton: React.FC<React.PropsWithChildren<CopyButtonProps>> = ({
   buttonClassName = "",
   tooltipTitle = Language.tooltipTitle,
 }) => {
-  const styles = useStyles()
-  const { isCopied, copy: copyToClipboard } = useClipboard(text)
+  const { isCopied, copy: copyToClipboard } = useClipboard(text);
+
+  const fileCopyIconStyles = css`
+    width: 20px;
+    height: 20px;
+  `;
 
   return (
     <Tooltip title={tooltipTitle} placement="top">
       <div
-        className={combineClasses([styles.copyButtonWrapper, wrapperClassName])}
+        className={wrapperClassName}
+        css={{
+          display: "flex",
+        }}
       >
         <IconButton
-          className={combineClasses([styles.copyButton, buttonClassName])}
+          className={buttonClassName}
+          css={(theme) => css`
+            border-radius: ${theme.shape.borderRadius}px;
+            padding: ${theme.spacing(0.85)};
+            min-width: 32px;
+
+            &:hover {
+              background: ${theme.palette.background.paper};
+            }
+          `}
           onClick={copyToClipboard}
           size="small"
           aria-label={Language.ariaLabel}
           variant="text"
         >
           {isCopied ? (
-            <Check className={styles.fileCopyIcon} />
+            <Check css={fileCopyIconStyles} />
           ) : (
-            <FileCopyIcon className={styles.fileCopyIcon} />
+            <FileCopyIcon css={fileCopyIconStyles} />
+          )}
+          {ctaCopy && (
+            <div
+              css={(theme) => ({
+                marginLeft: theme.spacing(1),
+              })}
+            >
+              {ctaCopy}
+            </div>
           )}
-          {ctaCopy && <div className={styles.buttonCopy}>{ctaCopy}</div>}
         </IconButton>
       </div>
     </Tooltip>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  copyButtonWrapper: {
-    display: "flex",
-  },
-  copyButton: {
-    borderRadius: theme.shape.borderRadius,
-    padding: theme.spacing(0.85),
-    minWidth: 32,
-
-    "&:hover": {
-      background: theme.palette.background.paper,
-    },
-  },
-  fileCopyIcon: {
-    width: 20,
-    height: 20,
-  },
-  buttonCopy: {
-    marginLeft: theme.spacing(1),
-  },
-}))
+  );
+};
diff --git a/site/src/components/CopyableValue/CopyableValue.tsx b/site/src/components/CopyableValue/CopyableValue.tsx
index 8f3b279d1ff29..7d2de18bce4e2 100644
--- a/site/src/components/CopyableValue/CopyableValue.tsx
+++ b/site/src/components/CopyableValue/CopyableValue.tsx
@@ -1,39 +1,30 @@
-import { makeStyles } from "@mui/styles"
-import Tooltip from "@mui/material/Tooltip"
-import { useClickable } from "hooks/useClickable"
-import { useClipboard } from "hooks/useClipboard"
-import { FC, HTMLProps } from "react"
-import { combineClasses } from "utils/combineClasses"
+import Tooltip, { type TooltipProps } from "@mui/material/Tooltip";
+import { useClickable } from "hooks/useClickable";
+import { useClipboard } from "hooks/useClipboard";
+import { type FC, type HTMLProps } from "react";
 
 interface CopyableValueProps extends HTMLProps<HTMLDivElement> {
-  value: string
+  value: string;
+  placement?: TooltipProps["placement"];
+  PopperProps?: TooltipProps["PopperProps"];
 }
 
 export const CopyableValue: FC<CopyableValueProps> = ({
   value,
-  className,
+  placement = "bottom-start",
+  PopperProps,
   ...props
 }) => {
-  const { isCopied, copy } = useClipboard(value)
-  const clickableProps = useClickable(copy)
-  const styles = useStyles()
+  const { isCopied, copy } = useClipboard(value);
+  const clickableProps = useClickable<HTMLSpanElement>(copy);
 
   return (
     <Tooltip
       title={isCopied ? "Copied!" : "Click to copy"}
-      placement="bottom-start"
+      placement={placement}
+      PopperProps={PopperProps}
     >
-      <span
-        {...props}
-        {...clickableProps}
-        className={combineClasses([styles.value, className])}
-      />
+      <span {...props} {...clickableProps} css={{ cursor: "pointer" }} />
     </Tooltip>
-  )
-}
-
-const useStyles = makeStyles(() => ({
-  value: {
-    cursor: "pointer",
-  },
-}))
+  );
+};
diff --git a/site/src/components/CreateUserForm/CreateUserForm.stories.tsx b/site/src/components/CreateUserForm/CreateUserForm.stories.tsx
deleted file mode 100644
index 1984fa0b757b2..0000000000000
--- a/site/src/components/CreateUserForm/CreateUserForm.stories.tsx
+++ /dev/null
@@ -1,41 +0,0 @@
-import { action } from "@storybook/addon-actions"
-import { StoryObj, Meta } from "@storybook/react"
-import { CreateUserForm } from "./CreateUserForm"
-import { mockApiError } from "testHelpers/entities"
-
-const meta: Meta<typeof CreateUserForm> = {
-  title: "components/CreateUserForm",
-  component: CreateUserForm,
-  args: {
-    onCancel: action("cancel"),
-    onSubmit: action("submit"),
-    isLoading: false,
-  },
-}
-
-export default meta
-type Story = StoryObj<typeof CreateUserForm>
-
-export const Ready: Story = {}
-
-export const FormError: Story = {
-  args: {
-    error: mockApiError({
-      validations: [{ field: "username", detail: "Username taken" }],
-    }),
-  },
-}
-
-export const GeneralError: Story = {
-  args: {
-    error: mockApiError({
-      message: "User already exists",
-    }),
-  },
-}
-
-export const Loading: Story = {
-  args: {
-    isLoading: true,
-  },
-}
diff --git a/site/src/components/CreateUserForm/CreateUserForm.tsx b/site/src/components/CreateUserForm/CreateUserForm.tsx
deleted file mode 100644
index c2f03155e7c62..0000000000000
--- a/site/src/components/CreateUserForm/CreateUserForm.tsx
+++ /dev/null
@@ -1,100 +0,0 @@
-import TextField from "@mui/material/TextField"
-import { FormikContextType, useFormik } from "formik"
-import { FC } from "react"
-import * as Yup from "yup"
-import * as TypesGen from "../../api/typesGenerated"
-import {
-  getFormHelpers,
-  nameValidator,
-  onChangeTrimmed,
-} from "../../utils/formUtils"
-import { FormFooter } from "../FormFooter/FormFooter"
-import { FullPageForm } from "../FullPageForm/FullPageForm"
-import { Stack } from "../Stack/Stack"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
-import { hasApiFieldErrors, isApiError } from "api/errors"
-
-export const Language = {
-  emailLabel: "Email",
-  passwordLabel: "Password",
-  usernameLabel: "Username",
-  emailInvalid: "Please enter a valid email address.",
-  emailRequired: "Please enter an email address.",
-  passwordRequired: "Please enter a password.",
-  createUser: "Create",
-  cancel: "Cancel",
-}
-
-export interface CreateUserFormProps {
-  onSubmit: (user: TypesGen.CreateUserRequest) => void
-  onCancel: () => void
-  error?: unknown
-  isLoading: boolean
-  myOrgId: string
-}
-
-const validationSchema = Yup.object({
-  email: Yup.string()
-    .trim()
-    .email(Language.emailInvalid)
-    .required(Language.emailRequired),
-  password: Yup.string().required(Language.passwordRequired),
-  username: nameValidator(Language.usernameLabel),
-})
-
-export const CreateUserForm: FC<
-  React.PropsWithChildren<CreateUserFormProps>
-> = ({ onSubmit, onCancel, error, isLoading, myOrgId }) => {
-  const form: FormikContextType<TypesGen.CreateUserRequest> =
-    useFormik<TypesGen.CreateUserRequest>({
-      initialValues: {
-        email: "",
-        password: "",
-        username: "",
-        organization_id: myOrgId,
-        disable_login: false,
-      },
-      validationSchema,
-      onSubmit,
-    })
-  const getFieldHelpers = getFormHelpers<TypesGen.CreateUserRequest>(
-    form,
-    error,
-  )
-
-  return (
-    <FullPageForm title="Create user">
-      {isApiError(error) && !hasApiFieldErrors(error) && (
-        <ErrorAlert error={error} sx={{ mb: 4 }} />
-      )}
-      <form onSubmit={form.handleSubmit} autoComplete="off">
-        <Stack spacing={2.5}>
-          <TextField
-            {...getFieldHelpers("username")}
-            onChange={onChangeTrimmed(form)}
-            autoComplete="username"
-            autoFocus
-            fullWidth
-            label={Language.usernameLabel}
-          />
-          <TextField
-            {...getFieldHelpers("email")}
-            onChange={onChangeTrimmed(form)}
-            autoComplete="email"
-            fullWidth
-            label={Language.emailLabel}
-          />
-          <TextField
-            {...getFieldHelpers("password")}
-            autoComplete="current-password"
-            fullWidth
-            id="password"
-            label={Language.passwordLabel}
-            type="password"
-          />
-        </Stack>
-        <FormFooter onCancel={onCancel} isLoading={isLoading} />
-      </form>
-    </FullPageForm>
-  )
-}
diff --git a/site/src/components/DAUChart/DAUChart.tsx b/site/src/components/DAUChart/DAUChart.tsx
deleted file mode 100644
index add0b6aa17db0..0000000000000
--- a/site/src/components/DAUChart/DAUChart.tsx
+++ /dev/null
@@ -1,118 +0,0 @@
-import Box from "@mui/material/Box"
-import { Theme } from "@mui/material/styles"
-import useTheme from "@mui/styles/useTheme"
-import * as TypesGen from "api/typesGenerated"
-import {
-  CategoryScale,
-  Chart as ChartJS,
-  ChartOptions,
-  defaults,
-  Legend,
-  LinearScale,
-  LineElement,
-  PointElement,
-  TimeScale,
-  Title,
-  Tooltip,
-} from "chart.js"
-import "chartjs-adapter-date-fns"
-import {
-  HelpTooltip,
-  HelpTooltipTitle,
-  HelpTooltipText,
-} from "components/Tooltips/HelpTooltip"
-import dayjs from "dayjs"
-import { FC } from "react"
-import { Line } from "react-chartjs-2"
-
-ChartJS.register(
-  CategoryScale,
-  LinearScale,
-  TimeScale,
-  PointElement,
-  LineElement,
-  Title,
-  Tooltip,
-  Legend,
-)
-
-export interface DAUChartProps {
-  daus: TypesGen.DAUsResponse
-}
-
-export const DAUChart: FC<DAUChartProps> = ({ daus }) => {
-  const theme: Theme = useTheme()
-
-  const labels = daus.entries.map((val) => {
-    return dayjs(val.date).format("YYYY-MM-DD")
-  })
-
-  const data = daus.entries.map((val) => {
-    return val.amount
-  })
-
-  defaults.font.family = theme.typography.fontFamily as string
-  defaults.color = theme.palette.text.secondary
-
-  const options: ChartOptions<"line"> = {
-    responsive: true,
-    plugins: {
-      legend: {
-        display: false,
-      },
-    },
-    scales: {
-      y: {
-        min: 0,
-        ticks: {
-          precision: 0,
-        },
-      },
-      x: {
-        ticks: {},
-        type: "time",
-        time: {
-          unit: "day",
-          stepSize: 2,
-        },
-      },
-    },
-    maintainAspectRatio: false,
-  }
-
-  return (
-    <Line
-      data-chromatic="ignore"
-      data={{
-        labels: labels,
-        datasets: [
-          {
-            label: "Daily Active Users",
-            data: data,
-            tension: 1 / 4,
-            backgroundColor: theme.palette.secondary.dark,
-            borderColor: theme.palette.secondary.dark,
-          },
-        ],
-      }}
-      options={options}
-    />
-  )
-}
-
-export const DAUTitle = () => {
-  return (
-    <Box sx={{ display: "flex", alignItems: "center", gap: 1 }}>
-      Daily Active Users
-      <HelpTooltip size="small">
-        <HelpTooltipTitle>
-          How do we calculate daily active users?
-        </HelpTooltipTitle>
-        <HelpTooltipText>
-          When a connection is initiated to a user{"'"}s workspace they are
-          considered a daily active user. e.g. apps, web terminal, SSH
-        </HelpTooltipText>
-      </HelpTooltip>
-    </Box>
-  )
-}
diff --git a/site/src/components/Dashboard/DashboardLayout.test.tsx b/site/src/components/Dashboard/DashboardLayout.test.tsx
index 8897aaca8a6ea..b580225491207 100644
--- a/site/src/components/Dashboard/DashboardLayout.test.tsx
+++ b/site/src/components/Dashboard/DashboardLayout.test.tsx
@@ -1,16 +1,24 @@
-import { renderWithAuth } from "testHelpers/renderHelpers"
-import { DashboardLayout } from "./DashboardLayout"
-import * as API from "api/api"
-import { screen } from "@testing-library/react"
+import { renderWithAuth } from "testHelpers/renderHelpers";
+import { DashboardLayout } from "./DashboardLayout";
+import { screen } from "@testing-library/react";
+import { rest } from "msw";
+import { server } from "testHelpers/server";
 
 test("Show the new Coder version notification", async () => {
-  jest.spyOn(API, "getUpdateCheck").mockResolvedValue({
-    current: false,
-    version: "v0.12.9",
-    url: "https://github.com/coder/coder/releases/tag/v0.12.9",
-  })
+  server.use(
+    rest.get("/api/v2/updatecheck", (req, res, ctx) => {
+      return res(
+        ctx.status(200),
+        ctx.json({
+          current: false,
+          version: "v0.12.9",
+          url: "https://github.com/coder/coder/releases/tag/v0.12.9",
+        }),
+      );
+    }),
+  );
   renderWithAuth(<DashboardLayout />, {
     children: [{ element: <h1>Test page</h1> }],
-  })
-  await screen.findByTestId("update-check-snackbar")
-})
+  });
+  await screen.findByTestId("update-check-snackbar");
+});
diff --git a/site/src/components/Dashboard/DashboardLayout.tsx b/site/src/components/Dashboard/DashboardLayout.tsx
index e7f01c9e3a161..1947e3ef9cbda 100644
--- a/site/src/components/Dashboard/DashboardLayout.tsx
+++ b/site/src/components/Dashboard/DashboardLayout.tsx
@@ -1,44 +1,47 @@
-import { makeStyles } from "@mui/styles"
-import { useMachine } from "@xstate/react"
-import { DeploymentBanner } from "components/DeploymentBanner/DeploymentBanner"
-import { LicenseBanner } from "components/LicenseBanner/LicenseBanner"
-import { Loader } from "components/Loader/Loader"
-import { ServiceBanner } from "components/ServiceBanner/ServiceBanner"
-import { usePermissions } from "hooks/usePermissions"
-import { FC, Suspense } from "react"
-import { Outlet } from "react-router-dom"
-import { dashboardContentBottomPadding } from "theme/constants"
-import { updateCheckMachine } from "xServices/updateCheck/updateCheckXService"
-import { Navbar } from "../Navbar/Navbar"
-import Snackbar from "@mui/material/Snackbar"
-import Link from "@mui/material/Link"
-import Box from "@mui/material/Box"
-import InfoOutlined from "@mui/icons-material/InfoOutlined"
-import Button from "@mui/material/Button"
-import { docs } from "utils/docs"
-import { HealthBanner } from "./HealthBanner"
+import { DeploymentBanner } from "./DeploymentBanner/DeploymentBanner";
+import { LicenseBanner } from "components/Dashboard/LicenseBanner/LicenseBanner";
+import { Loader } from "components/Loader/Loader";
+import { ServiceBanner } from "components/Dashboard/ServiceBanner/ServiceBanner";
+import { usePermissions } from "hooks/usePermissions";
+import { FC, Suspense } from "react";
+import { Outlet } from "react-router-dom";
+import { dashboardContentBottomPadding } from "theme/constants";
+import { Navbar } from "./Navbar/Navbar";
+import Snackbar from "@mui/material/Snackbar";
+import Link from "@mui/material/Link";
+import Box, { BoxProps } from "@mui/material/Box";
+import InfoOutlined from "@mui/icons-material/InfoOutlined";
+import Button from "@mui/material/Button";
+import { docs } from "utils/docs";
+import { useUpdateCheck } from "./useUpdateCheck";
 
 export const DashboardLayout: FC = () => {
-  const styles = useStyles()
-  const permissions = usePermissions()
-  const [updateCheckState, updateCheckSend] = useMachine(updateCheckMachine, {
-    context: {
-      permissions,
-    },
-  })
-  const { updateCheck } = updateCheckState.context
-  const canViewDeployment = Boolean(permissions.viewDeploymentValues)
+  const permissions = usePermissions();
+  const updateCheck = useUpdateCheck(permissions.viewUpdateCheck);
+  const canViewDeployment = Boolean(permissions.viewDeploymentValues);
 
   return (
     <>
-      <HealthBanner />
       <ServiceBanner />
       {canViewDeployment && <LicenseBanner />}
 
-      <div className={styles.site}>
+      <div
+        css={{
+          display: "flex",
+          minHeight: "100%",
+          flexDirection: "column",
+        }}
+      >
         <Navbar />
 
-        <div className={styles.siteContent}>
+        <div
+          css={{
+            flex: 1,
+            paddingBottom: dashboardContentBottomPadding, // Add bottom space since we don't use a footer
+            display: "flex",
+            flexDirection: "column",
+          }}
+        >
           <Suspense fallback={<Loader />}>
             <Outlet />
           </Suspense>
@@ -48,7 +51,7 @@ export const DashboardLayout: FC = () => {
 
         <Snackbar
           data-testid="update-check-snackbar"
-          open={updateCheckState.matches("show")}
+          open={updateCheck.isVisible}
           anchorOrigin={{
             vertical: "bottom",
             horizontal: "right",
@@ -80,38 +83,37 @@ export const DashboardLayout: FC = () => {
                 })}
               />
               <Box>
-                Coder {updateCheck?.version} is now available. View the{" "}
-                <Link href={updateCheck?.url}>release notes</Link> and{" "}
+                Coder {updateCheck.data?.version} is now available. View the{" "}
+                <Link href={updateCheck.data?.url}>release notes</Link> and{" "}
                 <Link href={docs("/admin/upgrade")}>upgrade instructions</Link>{" "}
                 for more information.
               </Box>
             </Box>
           }
           action={
-            <Button
-              variant="text"
-              size="small"
-              onClick={() => updateCheckSend("DISMISS")}
-            >
+            <Button variant="text" size="small" onClick={updateCheck.dismiss}>
               Dismiss
             </Button>
           }
         />
       </div>
     </>
-  )
-}
+  );
+};
 
-const useStyles = makeStyles({
-  site: {
-    display: "flex",
-    minHeight: "100vh",
-    flexDirection: "column",
-  },
-  siteContent: {
-    flex: 1,
-    paddingBottom: dashboardContentBottomPadding, // Add bottom space since we don't use a footer
-    display: "flex",
-    flexDirection: "column",
-  },
-})
+export const DashboardFullPage = (props: BoxProps) => {
+  return (
+    <Box
+      {...props}
+      sx={{
+        ...props.sx,
+        marginBottom: `-${dashboardContentBottomPadding}px`,
+        flex: 1,
+        display: "flex",
+        flexDirection: "column",
+        flexBasis: 0,
+        minHeight: "100%",
+      }}
+    />
+  );
+};
diff --git a/site/src/components/Dashboard/DashboardProvider.tsx b/site/src/components/Dashboard/DashboardProvider.tsx
index fd9065abdb27a..ae05ff0ae7447 100644
--- a/site/src/components/Dashboard/DashboardProvider.tsx
+++ b/site/src/components/Dashboard/DashboardProvider.tsx
@@ -1,89 +1,123 @@
-import { useMachine } from "@xstate/react"
+import { useQuery } from "react-query";
+import { buildInfo } from "api/queries/buildInfo";
+import { experiments } from "api/queries/experiments";
+import { entitlements } from "api/queries/entitlements";
 import {
   AppearanceConfig,
   BuildInfoResponse,
   Entitlements,
   Experiments,
-} from "api/typesGenerated"
-import { FullScreenLoader } from "components/Loader/FullScreenLoader"
-import { createContext, FC, PropsWithChildren, useContext } from "react"
-import { appearanceMachine } from "xServices/appearance/appearanceXService"
-import { buildInfoMachine } from "xServices/buildInfo/buildInfoXService"
-import { entitlementsMachine } from "xServices/entitlements/entitlementsXService"
-import { experimentsMachine } from "xServices/experiments/experimentsMachine"
+} from "api/typesGenerated";
+import { FullScreenLoader } from "components/Loader/FullScreenLoader";
+import {
+  type FC,
+  type PropsWithChildren,
+  createContext,
+  useCallback,
+  useContext,
+  useState,
+} from "react";
+import { appearance } from "api/queries/appearance";
+import { hslToHex, isHexColor, isHslColor } from "utils/colors";
+import { displayError } from "components/GlobalSnackbar/utils";
 
 interface Appearance {
-  config: AppearanceConfig
-  preview: boolean
-  setPreview: (config: AppearanceConfig) => void
-  save: (config: AppearanceConfig) => void
+  config: AppearanceConfig;
+  isPreview: boolean;
+  setPreview: (config: AppearanceConfig) => void;
 }
 
 interface DashboardProviderValue {
-  buildInfo: BuildInfoResponse
-  entitlements: Entitlements
-  appearance: Appearance
-  experiments: Experiments
+  buildInfo: BuildInfoResponse;
+  entitlements: Entitlements;
+  experiments: Experiments;
+  appearance: Appearance;
 }
 
 export const DashboardProviderContext = createContext<
   DashboardProviderValue | undefined
->(undefined)
+>(undefined);
 
 export const DashboardProvider: FC<PropsWithChildren> = ({ children }) => {
-  const [buildInfoState] = useMachine(buildInfoMachine)
-  const [entitlementsState] = useMachine(entitlementsMachine)
-  const [appearanceState, appearanceSend] = useMachine(appearanceMachine)
-  const [experimentsState] = useMachine(experimentsMachine)
-  const { buildInfo } = buildInfoState.context
-  const { entitlements } = entitlementsState.context
-  const { appearance, preview } = appearanceState.context
-  const { experiments } = experimentsState.context
-  const isLoading = !buildInfo || !entitlements || !appearance || !experiments
+  const buildInfoQuery = useQuery(buildInfo());
+  const entitlementsQuery = useQuery(entitlements());
+  const experimentsQuery = useQuery(experiments());
+  const appearanceQuery = useQuery(appearance());
 
-  const setAppearancePreview = (config: AppearanceConfig) => {
-    appearanceSend({
-      type: "SET_PREVIEW_APPEARANCE",
-      appearance: config,
-    })
-  }
+  const isLoading =
+    !buildInfoQuery.data ||
+    !entitlementsQuery.data ||
+    !appearanceQuery.data ||
+    !experimentsQuery.data;
 
-  const saveAppearance = (config: AppearanceConfig) => {
-    appearanceSend({
-      type: "SAVE_APPEARANCE",
-      appearance: config,
-    })
-  }
+  const [configPreview, setConfigPreview] = useState<AppearanceConfig>();
+
+  // Centralizing the logic for catching malformed configs in one spot, just to
+  // be on the safe side; don't want to expose raw setConfigPreview outside
+  // the provider
+  const setPreview = useCallback((newConfig: AppearanceConfig) => {
+    // Have runtime safety nets in place, just because so much of the codebase
+    // relies on HSL for formatting, but server expects hex values. Can't catch
+    // color format mismatches at the type level
+    const incomingBg = newConfig.service_banner.background_color;
+    let configForDispatch = newConfig;
+
+    if (typeof incomingBg === "string" && isHslColor(incomingBg)) {
+      configForDispatch = {
+        ...newConfig,
+        service_banner: {
+          ...newConfig.service_banner,
+          background_color: hslToHex(incomingBg),
+        },
+      };
+    } else if (typeof incomingBg === "string" && !isHexColor(incomingBg)) {
+      displayError(`The value ${incomingBg} is not a valid hex string`);
+      return;
+    }
+
+    setConfigPreview(configForDispatch);
+  }, []);
 
   if (isLoading) {
-    return <FullScreenLoader />
+    return <FullScreenLoader />;
   }
 
   return (
     <DashboardProviderContext.Provider
       value={{
-        buildInfo,
-        entitlements,
-        experiments,
+        buildInfo: buildInfoQuery.data,
+        entitlements: entitlementsQuery.data,
+        experiments: experimentsQuery.data,
         appearance: {
-          preview,
-          config: appearance,
-          setPreview: setAppearancePreview,
-          save: saveAppearance,
+          config: configPreview ?? appearanceQuery.data,
+          setPreview: setPreview,
+          isPreview: configPreview !== undefined,
         },
       }}
     >
       {children}
     </DashboardProviderContext.Provider>
-  )
-}
+  );
+};
 
 export const useDashboard = (): DashboardProviderValue => {
-  const context = useContext(DashboardProviderContext)
+  const context = useContext(DashboardProviderContext);
 
   if (!context) {
-    throw new Error("useDashboard only can be used inside of DashboardProvider")
+    throw new Error(
+      "useDashboard only can be used inside of DashboardProvider",
+    );
   }
 
-  return context
-}
+  return context;
+};
+
+export const useIsWorkspaceActionsEnabled = (): boolean => {
+  const { entitlements, experiments } = useDashboard();
+  const allowAdvancedScheduling =
+    entitlements.features["advanced_template_scheduling"].enabled;
+  // This check can be removed when https://github.com/coder/coder/milestone/19
+  // is merged up
+  const allowWorkspaceActions = experiments.includes("workspace_actions");
+  return allowWorkspaceActions && allowAdvancedScheduling;
+};
diff --git a/site/src/components/Dashboard/DeploymentBanner/DeploymentBanner.tsx b/site/src/components/Dashboard/DeploymentBanner/DeploymentBanner.tsx
new file mode 100644
index 0000000000000..5ebeff79b48c9
--- /dev/null
+++ b/site/src/components/Dashboard/DeploymentBanner/DeploymentBanner.tsx
@@ -0,0 +1,28 @@
+import { type FC } from "react";
+import { useQuery } from "react-query";
+import { deploymentStats, health } from "api/queries/deployment";
+import { usePermissions } from "hooks/usePermissions";
+import { DeploymentBannerView } from "./DeploymentBannerView";
+import { useDashboard } from "../DashboardProvider";
+
+export const DeploymentBanner: FC = () => {
+  const dashboard = useDashboard();
+  const permissions = usePermissions();
+  const deploymentStatsQuery = useQuery(deploymentStats());
+  const healthQuery = useQuery({
+    ...health(),
+    enabled: dashboard.experiments.includes("deployment_health_page"),
+  });
+
+  if (!permissions.viewDeploymentValues || !deploymentStatsQuery.data) {
+    return null;
+  }
+
+  return (
+    <DeploymentBannerView
+      health={healthQuery.data}
+      stats={deploymentStatsQuery.data}
+      fetchStats={() => deploymentStatsQuery.refetch()}
+    />
+  );
+};
diff --git a/site/src/components/Dashboard/DeploymentBanner/DeploymentBannerView.stories.tsx b/site/src/components/Dashboard/DeploymentBanner/DeploymentBannerView.stories.tsx
new file mode 100644
index 0000000000000..2afecffd5335e
--- /dev/null
+++ b/site/src/components/Dashboard/DeploymentBanner/DeploymentBannerView.stories.tsx
@@ -0,0 +1,25 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import {
+  DeploymentHealthUnhealthy,
+  MockDeploymentStats,
+} from "testHelpers/entities";
+import { DeploymentBannerView } from "./DeploymentBannerView";
+
+const meta: Meta<typeof DeploymentBannerView> = {
+  title: "components/DeploymentBannerView",
+  component: DeploymentBannerView,
+  args: {
+    stats: MockDeploymentStats,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof DeploymentBannerView>;
+
+export const Example: Story = {};
+
+export const WithHealthIssues: Story = {
+  args: {
+    health: DeploymentHealthUnhealthy,
+  },
+};
diff --git a/site/src/components/Dashboard/DeploymentBanner/DeploymentBannerView.tsx b/site/src/components/Dashboard/DeploymentBanner/DeploymentBannerView.tsx
new file mode 100644
index 0000000000000..27b391d717360
--- /dev/null
+++ b/site/src/components/Dashboard/DeploymentBanner/DeploymentBannerView.tsx
@@ -0,0 +1,414 @@
+import type { Health } from "api/api";
+import type { DeploymentStats, WorkspaceStatus } from "api/typesGenerated";
+import {
+  type FC,
+  useMemo,
+  useEffect,
+  useState,
+  PropsWithChildren,
+} from "react";
+import prettyBytes from "pretty-bytes";
+import BuildingIcon from "@mui/icons-material/Build";
+import Tooltip from "@mui/material/Tooltip";
+import { Link as RouterLink } from "react-router-dom";
+import Link from "@mui/material/Link";
+import { VSCodeIcon } from "components/Icons/VSCodeIcon";
+import DownloadIcon from "@mui/icons-material/CloudDownload";
+import UploadIcon from "@mui/icons-material/CloudUpload";
+import LatencyIcon from "@mui/icons-material/SettingsEthernet";
+import WebTerminalIcon from "@mui/icons-material/WebAsset";
+import CollectedIcon from "@mui/icons-material/Compare";
+import RefreshIcon from "@mui/icons-material/Refresh";
+import Button from "@mui/material/Button";
+import { css as className } from "@emotion/css";
+import {
+  css,
+  type CSSObject,
+  type Theme,
+  type Interpolation,
+  useTheme,
+} from "@emotion/react";
+import dayjs from "dayjs";
+import { TerminalIcon } from "components/Icons/TerminalIcon";
+import { RocketIcon } from "components/Icons/RocketIcon";
+import ErrorIcon from "@mui/icons-material/ErrorOutline";
+import { MONOSPACE_FONT_FAMILY } from "theme/constants";
+import { getDisplayWorkspaceStatus } from "utils/workspace";
+import { colors } from "theme/colors";
+import { HelpTooltipTitle } from "components/HelpTooltip/HelpTooltip";
+import { Stack } from "components/Stack/Stack";
+
+export const bannerHeight = 36;
+
+const styles = {
+  group: css`
+    display: flex;
+    align-items: center;
+  `,
+  category: (theme) => ({
+    marginRight: theme.spacing(2),
+    color: theme.palette.text.primary,
+  }),
+  values: (theme) => ({
+    display: "flex",
+    gap: theme.spacing(1),
+    color: theme.palette.text.secondary,
+  }),
+  value: (theme) => css`
+    display: flex;
+    align-items: center;
+    gap: ${theme.spacing(0.5)};
+
+    & svg {
+      width: 12px;
+      height: 12px;
+    }
+  `,
+} satisfies Record<string, Interpolation<Theme>>;
+
+export interface DeploymentBannerViewProps {
+  health?: Health;
+  stats?: DeploymentStats;
+  fetchStats?: () => void;
+}
+
+export const DeploymentBannerView: FC<DeploymentBannerViewProps> = (props) => {
+  const { health, stats, fetchStats } = props;
+  const theme = useTheme();
+  const aggregatedMinutes = useMemo(() => {
+    if (!stats) {
+      return;
+    }
+    return dayjs(stats.collected_at).diff(stats.aggregated_from, "minutes");
+  }, [stats]);
+  const displayLatency = stats?.workspaces.connection_latency_ms.P50 || -1;
+  const [timeUntilRefresh, setTimeUntilRefresh] = useState(0);
+  useEffect(() => {
+    if (!stats || !fetchStats) {
+      return;
+    }
+
+    let timeUntilRefresh = dayjs(stats.next_update_at).diff(
+      stats.collected_at,
+      "seconds",
+    );
+    setTimeUntilRefresh(timeUntilRefresh);
+    let canceled = false;
+    const loop = () => {
+      if (canceled) {
+        return undefined;
+      }
+      setTimeUntilRefresh(timeUntilRefresh--);
+      if (timeUntilRefresh > 0) {
+        return window.setTimeout(loop, 1000);
+      }
+      fetchStats();
+    };
+    const timeout = setTimeout(loop, 1000);
+    return () => {
+      canceled = true;
+      clearTimeout(timeout);
+    };
+  }, [fetchStats, stats]);
+  const lastAggregated = useMemo(() => {
+    if (!stats) {
+      return;
+    }
+    if (!fetchStats) {
+      // Storybook!
+      return "just now";
+    }
+    return dayjs().to(dayjs(stats.collected_at));
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- We want this to periodically update!
+  }, [timeUntilRefresh, stats]);
+
+  const unhealthy = health && !health.healthy;
+
+  const statusBadgeStyle = css`
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    background-color: ${unhealthy ? colors.red[10] : undefined};
+    padding: ${theme.spacing(0, 1.5)};
+    height: ${bannerHeight}px;
+    color: #fff;
+
+    & svg {
+      width: 16px;
+      height: 16px;
+    }
+  `;
+
+  const statusSummaryStyle = className`
+    ${theme.typography.body2 as CSSObject}
+
+    margin: ${theme.spacing(0, 0, 0.5, 1.5)};
+    width: ${theme.spacing(50)};
+    padding: ${theme.spacing(2)};
+    color: ${theme.palette.text.primary};
+    background-color: ${theme.palette.background.paper};
+    border: 1px solid ${theme.palette.divider};
+    pointer-events: none;
+  `;
+
+  return (
+    <div
+      css={{
+        position: "sticky",
+        height: bannerHeight,
+        bottom: 0,
+        zIndex: 1,
+        paddingRight: theme.spacing(2),
+        backgroundColor: theme.palette.background.paper,
+        display: "flex",
+        alignItems: "center",
+        fontFamily: MONOSPACE_FONT_FAMILY,
+        fontSize: 12,
+        gap: theme.spacing(4),
+        borderTop: `1px solid ${theme.palette.divider}`,
+        overflowX: "auto",
+        whiteSpace: "nowrap",
+      }}
+    >
+      <Tooltip
+        classes={{ tooltip: statusSummaryStyle }}
+        title={
+          unhealthy ? (
+            <>
+              <HelpTooltipTitle>
+                We have detected problems with your Coder deployment.
+              </HelpTooltipTitle>
+              <Stack spacing={1}>
+                {health.access_url && (
+                  <HealthIssue>
+                    Your access URL may be configured incorrectly.
+                  </HealthIssue>
+                )}
+                {health.database && (
+                  <HealthIssue>Your database is unhealthy.</HealthIssue>
+                )}
+                {health.derp && (
+                  <HealthIssue>
+                    We&apos;re noticing DERP proxy issues.
+                  </HealthIssue>
+                )}
+                {health.websocket && (
+                  <HealthIssue>
+                    We&apos;re noticing websocket issues.
+                  </HealthIssue>
+                )}
+              </Stack>
+            </>
+          ) : (
+            <>Status of your Coder deployment. Only visible for admins!</>
+          )
+        }
+        open={process.env.STORYBOOK === "true" ? true : undefined}
+        css={{ marginRight: theme.spacing(-2) }}
+      >
+        {unhealthy ? (
+          <Link component={RouterLink} to="/health" css={statusBadgeStyle}>
+            <ErrorIcon />
+          </Link>
+        ) : (
+          <div css={statusBadgeStyle}>
+            <RocketIcon />
+          </div>
+        )}
+      </Tooltip>
+      <div css={styles.group}>
+        <div css={styles.category}>Workspaces</div>
+        <div css={styles.values}>
+          <WorkspaceBuildValue
+            status="pending"
+            count={stats?.workspaces.pending}
+          />
+          <ValueSeparator />
+          <WorkspaceBuildValue
+            status="starting"
+            count={stats?.workspaces.building}
+          />
+          <ValueSeparator />
+          <WorkspaceBuildValue
+            status="running"
+            count={stats?.workspaces.running}
+          />
+          <ValueSeparator />
+          <WorkspaceBuildValue
+            status="stopped"
+            count={stats?.workspaces.stopped}
+          />
+          <ValueSeparator />
+          <WorkspaceBuildValue
+            status="failed"
+            count={stats?.workspaces.failed}
+          />
+        </div>
+      </div>
+      <div css={styles.group}>
+        <Tooltip title={`Activity in the last ~${aggregatedMinutes} minutes`}>
+          <div css={styles.category}>Transmission</div>
+        </Tooltip>
+
+        <div css={styles.values}>
+          <Tooltip title="Data sent to workspaces">
+            <div css={styles.value}>
+              <DownloadIcon />
+              {stats ? prettyBytes(stats.workspaces.rx_bytes) : "-"}
+            </div>
+          </Tooltip>
+          <ValueSeparator />
+          <Tooltip title="Data sent from workspaces">
+            <div css={styles.value}>
+              <UploadIcon />
+              {stats ? prettyBytes(stats.workspaces.tx_bytes) : "-"}
+            </div>
+          </Tooltip>
+          <ValueSeparator />
+          <Tooltip
+            title={
+              displayLatency < 0
+                ? "No recent workspace connections have been made"
+                : "The average latency of user connections to workspaces"
+            }
+          >
+            <div css={styles.value}>
+              <LatencyIcon />
+              {displayLatency > 0 ? displayLatency?.toFixed(2) + " ms" : "-"}
+            </div>
+          </Tooltip>
+        </div>
+      </div>
+      <div css={styles.group}>
+        <div css={styles.category}>Active Connections</div>
+
+        <div css={styles.values}>
+          <Tooltip title="VS Code Editors with the Coder Remote Extension">
+            <div css={styles.value}>
+              <VSCodeIcon
+                css={css`
+                  & * {
+                    fill: currentColor;
+                  }
+                `}
+              />
+              {typeof stats?.session_count.vscode === "undefined"
+                ? "-"
+                : stats?.session_count.vscode}
+            </div>
+          </Tooltip>
+          <ValueSeparator />
+          <Tooltip title="SSH Sessions">
+            <div css={styles.value}>
+              <TerminalIcon />
+              {typeof stats?.session_count.ssh === "undefined"
+                ? "-"
+                : stats?.session_count.ssh}
+            </div>
+          </Tooltip>
+          <ValueSeparator />
+          <Tooltip title="Web Terminal Sessions">
+            <div css={styles.value}>
+              <WebTerminalIcon />
+              {typeof stats?.session_count.reconnecting_pty === "undefined"
+                ? "-"
+                : stats?.session_count.reconnecting_pty}
+            </div>
+          </Tooltip>
+        </div>
+      </div>
+      <div
+        css={{
+          color: theme.palette.text.primary,
+          marginLeft: "auto",
+          display: "flex",
+          alignItems: "center",
+          gap: theme.spacing(2),
+        }}
+      >
+        <Tooltip title="The last time stats were aggregated. Workspaces report statistics periodically, so it may take a bit for these to update!">
+          <div css={styles.value}>
+            <CollectedIcon />
+            {lastAggregated}
+          </div>
+        </Tooltip>
+
+        <Tooltip title="A countdown until stats are fetched again. Click to refresh!">
+          <Button
+            css={css`
+              ${styles.value(theme)}
+
+              margin: 0;
+              padding: 0 8px;
+              height: unset;
+              min-height: unset;
+              font-size: unset;
+              color: unset;
+              border: 0;
+              min-width: unset;
+              font-family: inherit;
+
+              & svg {
+                margin-right: ${theme.spacing(0.5)};
+              }
+            `}
+            onClick={() => {
+              if (fetchStats) {
+                fetchStats();
+              }
+            }}
+            variant="text"
+          >
+            <RefreshIcon />
+            {timeUntilRefresh}s
+          </Button>
+        </Tooltip>
+      </div>
+    </div>
+  );
+};
+
+const ValueSeparator: FC = () => {
+  const theme = useTheme();
+  const separatorStyles = css`
+    color: ${theme.palette.text.disabled};
+  `;
+
+  return <div css={separatorStyles}>/</div>;
+};
+
+const WorkspaceBuildValue: FC<{
+  status: WorkspaceStatus;
+  count?: number;
+}> = ({ status, count }) => {
+  const displayStatus = getDisplayWorkspaceStatus(status);
+  let statusText = displayStatus.text;
+  let icon = displayStatus.icon;
+  if (status === "starting") {
+    icon = <BuildingIcon />;
+    statusText = "Building";
+  }
+
+  return (
+    <Tooltip title={`${statusText} Workspaces`}>
+      <Link
+        component={RouterLink}
+        to={`/workspaces?filter=${encodeURIComponent("status:" + status)}`}
+      >
+        <div css={styles.value}>
+          {icon}
+          {typeof count === "undefined" ? "-" : count}
+        </div>
+      </Link>
+    </Tooltip>
+  );
+};
+
+const HealthIssue: FC<PropsWithChildren> = ({ children }) => {
+  return (
+    <Stack direction="row" spacing={1}>
+      <ErrorIcon fontSize="small" htmlColor={colors.red[10]} />
+      {children}
+    </Stack>
+  );
+};
diff --git a/site/src/components/Dashboard/HealthBanner.tsx b/site/src/components/Dashboard/HealthBanner.tsx
deleted file mode 100644
index a8f5a2d0655b4..0000000000000
--- a/site/src/components/Dashboard/HealthBanner.tsx
+++ /dev/null
@@ -1,45 +0,0 @@
-import { Alert } from "components/Alert/Alert"
-import { Link as RouterLink } from "react-router-dom"
-import Link from "@mui/material/Link"
-import { colors } from "theme/colors"
-import { useQuery } from "@tanstack/react-query"
-import { getHealth } from "api/api"
-import { useDashboard } from "./DashboardProvider"
-
-export const HealthBanner = () => {
-  const { data: healthStatus } = useQuery({
-    queryKey: ["health"],
-    queryFn: () => getHealth(),
-  })
-  const dashboard = useDashboard()
-  const hasHealthIssues = healthStatus && !healthStatus.data.healthy
-
-  if (
-    dashboard.experiments.includes("deployment_health_page") &&
-    hasHealthIssues
-  ) {
-    return (
-      <Alert
-        severity="error"
-        variant="filled"
-        sx={{
-          border: 0,
-          borderRadius: 0,
-          backgroundColor: colors.red[10],
-        }}
-      >
-        We have detected problems with your Coder deployment. Please{" "}
-        <Link
-          component={RouterLink}
-          to="/health"
-          sx={{ fontWeight: 600, color: "inherit" }}
-        >
-          inspect the health status
-        </Link>
-        .
-      </Alert>
-    )
-  }
-
-  return null
-}
diff --git a/site/src/components/Dashboard/LicenseBanner/LicenseBanner.tsx b/site/src/components/Dashboard/LicenseBanner/LicenseBanner.tsx
new file mode 100644
index 0000000000000..4f37638c9156b
--- /dev/null
+++ b/site/src/components/Dashboard/LicenseBanner/LicenseBanner.tsx
@@ -0,0 +1,13 @@
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { LicenseBannerView } from "./LicenseBannerView";
+
+export const LicenseBanner: React.FC = () => {
+  const { entitlements } = useDashboard();
+  const { errors, warnings } = entitlements;
+
+  if (errors.length > 0 || warnings.length > 0) {
+    return <LicenseBannerView errors={errors} warnings={warnings} />;
+  } else {
+    return null;
+  }
+};
diff --git a/site/src/components/Dashboard/LicenseBanner/LicenseBannerView.stories.tsx b/site/src/components/Dashboard/LicenseBanner/LicenseBannerView.stories.tsx
new file mode 100644
index 0000000000000..cc37d18488085
--- /dev/null
+++ b/site/src/components/Dashboard/LicenseBanner/LicenseBannerView.stories.tsx
@@ -0,0 +1,36 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import { LicenseBannerView } from "./LicenseBannerView";
+
+const meta: Meta<typeof LicenseBannerView> = {
+  title: "components/LicenseBannerView",
+  component: LicenseBannerView,
+};
+
+export default meta;
+type Story = StoryObj<typeof LicenseBannerView>;
+
+export const OneWarning: Story = {
+  args: {
+    errors: [],
+    warnings: ["You have exceeded the number of seats in your license."],
+  },
+};
+
+export const TwoWarnings: Story = {
+  args: {
+    errors: [],
+    warnings: [
+      "You have exceeded the number of seats in your license.",
+      "You are flying too close to the sun.",
+    ],
+  },
+};
+
+export const OneError: Story = {
+  args: {
+    errors: [
+      "You have multiple replicas but high availability is an Enterprise feature. You will be unable to connect to workspaces.",
+    ],
+    warnings: [],
+  },
+};
diff --git a/site/src/components/Dashboard/LicenseBanner/LicenseBannerView.tsx b/site/src/components/Dashboard/LicenseBanner/LicenseBannerView.tsx
new file mode 100644
index 0000000000000..ed1975902b7be
--- /dev/null
+++ b/site/src/components/Dashboard/LicenseBanner/LicenseBannerView.tsx
@@ -0,0 +1,98 @@
+import {
+  type CSSObject,
+  type Interpolation,
+  type Theme,
+  useTheme,
+} from "@emotion/react";
+import Link from "@mui/material/Link";
+import { css } from "@emotion/react";
+import { useState } from "react";
+import { Expander } from "components/Expander/Expander";
+import { Pill } from "components/Pill/Pill";
+import { colors } from "theme/colors";
+
+export const Language = {
+  licenseIssue: "License Issue",
+  licenseIssues: (num: number): string => `${num} License Issues`,
+  upgrade: "Contact sales@coder.com.",
+  exceeded: "It looks like you've exceeded some limits of your license.",
+  lessDetails: "Less",
+  moreDetails: "More",
+};
+
+const styles = {
+  leftContent: (theme) => ({
+    marginRight: theme.spacing(1),
+    marginLeft: theme.spacing(1),
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
+
+export interface LicenseBannerViewProps {
+  errors: string[];
+  warnings: string[];
+}
+
+export const LicenseBannerView: React.FC<LicenseBannerViewProps> = ({
+  errors,
+  warnings,
+}) => {
+  const theme = useTheme();
+  const [showDetails, setShowDetails] = useState(false);
+  const isError = errors.length > 0;
+  const messages = [...errors, ...warnings];
+  const type = isError ? "error" : "warning";
+
+  const containerStyles = css`
+    ${theme.typography.body2 as CSSObject}
+
+    display: flex;
+    align-items: center;
+    padding: ${theme.spacing(1.5)};
+    background-color: ${type === "error"
+      ? colors.red[12]
+      : theme.palette.warning.main};
+  `;
+
+  if (messages.length === 1) {
+    return (
+      <div css={containerStyles}>
+        <Pill text={Language.licenseIssue} type={type} lightBorder />
+        <div css={styles.leftContent}>
+          <span>{messages[0]}</span>
+          &nbsp;
+          <Link color="white" fontWeight="medium" href="mailto:sales@coder.com">
+            {Language.upgrade}
+          </Link>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div css={containerStyles}>
+      <Pill
+        text={Language.licenseIssues(messages.length)}
+        type={type}
+        lightBorder
+      />
+      <div css={styles.leftContent}>
+        <div>
+          {Language.exceeded}
+          &nbsp;
+          <Link color="white" fontWeight="medium" href="mailto:sales@coder.com">
+            {Language.upgrade}
+          </Link>
+        </div>
+        <Expander expanded={showDetails} setExpanded={setShowDetails}>
+          <ul css={{ padding: theme.spacing(1), margin: 0 }}>
+            {messages.map((message) => (
+              <li css={{ margin: theme.spacing(0.5) }} key={message}>
+                {message}
+              </li>
+            ))}
+          </ul>
+        </Expander>
+      </div>
+    </div>
+  );
+};
diff --git a/site/src/components/Dashboard/Navbar/Navbar.test.tsx b/site/src/components/Dashboard/Navbar/Navbar.test.tsx
new file mode 100644
index 0000000000000..c9f9a0030122c
--- /dev/null
+++ b/site/src/components/Dashboard/Navbar/Navbar.test.tsx
@@ -0,0 +1,68 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import { App } from "App";
+import { Language } from "./NavbarView";
+import { rest } from "msw";
+import {
+  MockEntitlementsWithAuditLog,
+  MockMemberPermissions,
+} from "testHelpers/entities";
+import { server } from "testHelpers/server";
+
+/**
+ * The LicenseBanner, mounted above the AppRouter, fetches entitlements. Thus, to test their
+ * effects, we must test at the App level and `waitFor` the fetch to be done.
+ */
+describe("Navbar", () => {
+  it("shows Audit Log link when permitted and entitled", async () => {
+    // set entitlements to allow audit log
+    server.use(
+      rest.get("/api/v2/entitlements", (req, res, ctx) => {
+        return res(ctx.status(200), ctx.json(MockEntitlementsWithAuditLog));
+      }),
+    );
+    render(<App />);
+    await waitFor(
+      () => {
+        const link = screen.getByText(Language.audit);
+        expect(link).toBeDefined();
+      },
+      { timeout: 2000 },
+    );
+  });
+
+  it("does not show Audit Log link when not entitled", async () => {
+    // by default, user is an Admin with permission to see the audit log,
+    // but is unlicensed so not entitled to see the audit log
+    render(<App />);
+    await waitFor(
+      () => {
+        const link = screen.queryByText(Language.audit);
+        expect(link).toBe(null);
+      },
+      { timeout: 2000 },
+    );
+  });
+
+  it("does not show Audit Log link when not permitted via role", async () => {
+    // set permissions to Member (can't audit)
+    server.use(
+      rest.post("/api/v2/authcheck", async (req, res, ctx) => {
+        return res(ctx.status(200), ctx.json(MockMemberPermissions));
+      }),
+    );
+    // set entitlements to allow audit log
+    server.use(
+      rest.get("/api/v2/entitlements", (req, res, ctx) => {
+        return res(ctx.status(200), ctx.json(MockEntitlementsWithAuditLog));
+      }),
+    );
+    render(<App />);
+    await waitFor(
+      () => {
+        const link = screen.queryByText(Language.audit);
+        expect(link).toBe(null);
+      },
+      { timeout: 2000 },
+    );
+  });
+});
diff --git a/site/src/components/Dashboard/Navbar/Navbar.tsx b/site/src/components/Dashboard/Navbar/Navbar.tsx
new file mode 100644
index 0000000000000..c84dc1f12b26e
--- /dev/null
+++ b/site/src/components/Dashboard/Navbar/Navbar.tsx
@@ -0,0 +1,38 @@
+import { useAuth } from "components/AuthProvider/AuthProvider";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { useFeatureVisibility } from "hooks/useFeatureVisibility";
+import { useMe } from "hooks/useMe";
+import { usePermissions } from "hooks/usePermissions";
+import { FC } from "react";
+import { NavbarView } from "./NavbarView";
+import { useProxy } from "contexts/ProxyContext";
+
+export const Navbar: FC = () => {
+  const { appearance, buildInfo } = useDashboard();
+  const { signOut } = useAuth();
+  const me = useMe();
+  const permissions = usePermissions();
+  const featureVisibility = useFeatureVisibility();
+  const canViewAuditLog =
+    featureVisibility["audit_log"] && Boolean(permissions.viewAuditLog);
+  const canViewDeployment = Boolean(permissions.viewDeploymentValues);
+  const canViewAllUsers = Boolean(permissions.readAllUsers);
+  const proxyContextValue = useProxy();
+  const dashboard = useDashboard();
+
+  return (
+    <NavbarView
+      user={me}
+      logo_url={appearance.config.logo_url}
+      buildInfo={buildInfo}
+      supportLinks={appearance.config.support_links}
+      onSignOut={signOut}
+      canViewAuditLog={canViewAuditLog}
+      canViewDeployment={canViewDeployment}
+      canViewAllUsers={canViewAllUsers}
+      proxyContextValue={
+        dashboard.experiments.includes("moons") ? proxyContextValue : undefined
+      }
+    />
+  );
+};
diff --git a/site/src/components/Dashboard/Navbar/NavbarView.stories.tsx b/site/src/components/Dashboard/Navbar/NavbarView.stories.tsx
new file mode 100644
index 0000000000000..189cd82d65a88
--- /dev/null
+++ b/site/src/components/Dashboard/Navbar/NavbarView.stories.tsx
@@ -0,0 +1,34 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import { MockUser, MockUser2 } from "testHelpers/entities";
+import { NavbarView } from "./NavbarView";
+
+const meta: Meta<typeof NavbarView> = {
+  title: "components/NavbarView",
+  component: NavbarView,
+  args: {
+    user: MockUser,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof NavbarView>;
+
+export const ForAdmin: Story = {};
+
+export const ForMember: Story = {
+  args: {
+    user: MockUser2,
+    canViewAuditLog: false,
+    canViewDeployment: false,
+    canViewAllUsers: false,
+  },
+};
+
+export const SmallViewport: Story = {
+  parameters: {
+    viewport: {
+      defaultViewport: "tablet",
+    },
+    chromatic: { viewports: [420] },
+  },
+};
diff --git a/site/src/components/Dashboard/Navbar/NavbarView.test.tsx b/site/src/components/Dashboard/Navbar/NavbarView.test.tsx
new file mode 100644
index 0000000000000..f54c6ce22fbe8
--- /dev/null
+++ b/site/src/components/Dashboard/Navbar/NavbarView.test.tsx
@@ -0,0 +1,103 @@
+import { screen } from "@testing-library/react";
+import { MockPrimaryWorkspaceProxy, MockUser } from "testHelpers/entities";
+import { renderWithAuth } from "testHelpers/renderHelpers";
+import { Language as navLanguage, NavbarView } from "./NavbarView";
+import { ProxyContextValue } from "contexts/ProxyContext";
+import { action } from "@storybook/addon-actions";
+
+const proxyContextValue: ProxyContextValue = {
+  proxy: {
+    preferredPathAppURL: "",
+    preferredWildcardHostname: "",
+    proxy: MockPrimaryWorkspaceProxy,
+  },
+  isLoading: false,
+  isFetched: true,
+  setProxy: jest.fn(),
+  clearProxy: action("clearProxy"),
+  refetchProxyLatencies: jest.fn(),
+  proxyLatencies: {},
+};
+
+describe("NavbarView", () => {
+  const noop = () => {
+    return;
+  };
+
+  it("workspaces nav link has the correct href", async () => {
+    renderWithAuth(
+      <NavbarView
+        proxyContextValue={proxyContextValue}
+        user={MockUser}
+        onSignOut={noop}
+        canViewAuditLog
+        canViewDeployment
+        canViewAllUsers
+      />,
+    );
+    const workspacesLink = await screen.findByText(navLanguage.workspaces);
+    expect((workspacesLink as HTMLAnchorElement).href).toContain("/workspaces");
+  });
+
+  it("templates nav link has the correct href", async () => {
+    renderWithAuth(
+      <NavbarView
+        proxyContextValue={proxyContextValue}
+        user={MockUser}
+        onSignOut={noop}
+        canViewAuditLog
+        canViewDeployment
+        canViewAllUsers
+      />,
+    );
+    const templatesLink = await screen.findByText(navLanguage.templates);
+    expect((templatesLink as HTMLAnchorElement).href).toContain("/templates");
+  });
+
+  it("users nav link has the correct href", async () => {
+    renderWithAuth(
+      <NavbarView
+        proxyContextValue={proxyContextValue}
+        user={MockUser}
+        onSignOut={noop}
+        canViewAuditLog
+        canViewDeployment
+        canViewAllUsers
+      />,
+    );
+    const userLink = await screen.findByText(navLanguage.users);
+    expect((userLink as HTMLAnchorElement).href).toContain("/users");
+  });
+
+  it("audit nav link has the correct href", async () => {
+    renderWithAuth(
+      <NavbarView
+        proxyContextValue={proxyContextValue}
+        user={MockUser}
+        onSignOut={noop}
+        canViewAuditLog
+        canViewDeployment
+        canViewAllUsers
+      />,
+    );
+    const auditLink = await screen.findByText(navLanguage.audit);
+    expect((auditLink as HTMLAnchorElement).href).toContain("/audit");
+  });
+
+  it("deployment nav link has the correct href", async () => {
+    renderWithAuth(
+      <NavbarView
+        proxyContextValue={proxyContextValue}
+        user={MockUser}
+        onSignOut={noop}
+        canViewAuditLog
+        canViewDeployment
+        canViewAllUsers
+      />,
+    );
+    const auditLink = await screen.findByText(navLanguage.deployment);
+    expect((auditLink as HTMLAnchorElement).href).toContain(
+      "/deployment/general",
+    );
+  });
+});
diff --git a/site/src/components/Dashboard/Navbar/NavbarView.tsx b/site/src/components/Dashboard/Navbar/NavbarView.tsx
new file mode 100644
index 0000000000000..ae46a3f403fc6
--- /dev/null
+++ b/site/src/components/Dashboard/Navbar/NavbarView.tsx
@@ -0,0 +1,460 @@
+import Drawer from "@mui/material/Drawer";
+import IconButton from "@mui/material/IconButton";
+import MenuIcon from "@mui/icons-material/Menu";
+import { CoderIcon } from "components/Icons/CoderIcon";
+import { type FC, type ReactNode, useRef, useState } from "react";
+import { NavLink, useLocation, useNavigate } from "react-router-dom";
+import { colors } from "theme/colors";
+import * as TypesGen from "api/typesGenerated";
+import { navHeight } from "theme/constants";
+import { UserDropdown } from "./UserDropdown/UserDropdown";
+import Box from "@mui/material/Box";
+import Menu from "@mui/material/Menu";
+import Button from "@mui/material/Button";
+import MenuItem from "@mui/material/MenuItem";
+import KeyboardArrowDownOutlined from "@mui/icons-material/KeyboardArrowDownOutlined";
+import { ProxyContextValue } from "contexts/ProxyContext";
+import { displayError } from "components/GlobalSnackbar/utils";
+import Divider from "@mui/material/Divider";
+import Skeleton from "@mui/material/Skeleton";
+import { BUTTON_SM_HEIGHT } from "theme/theme";
+import { ProxyStatusLatency } from "components/ProxyStatusLatency/ProxyStatusLatency";
+import { usePermissions } from "hooks/usePermissions";
+import Typography from "@mui/material/Typography";
+import { css, type Interpolation, type Theme, useTheme } from "@emotion/react";
+
+export const USERS_LINK = `/users?filter=${encodeURIComponent(
+  "status:active",
+)}`;
+
+export interface NavbarViewProps {
+  logo_url?: string;
+  user?: TypesGen.User;
+  buildInfo?: TypesGen.BuildInfoResponse;
+  supportLinks?: TypesGen.LinkConfig[];
+  onSignOut: () => void;
+  canViewAuditLog: boolean;
+  canViewDeployment: boolean;
+  canViewAllUsers: boolean;
+  proxyContextValue?: ProxyContextValue;
+}
+
+export const Language = {
+  workspaces: "Workspaces",
+  templates: "Templates",
+  users: "Users",
+  audit: "Audit",
+  deployment: "Deployment",
+};
+
+const styles = {
+  desktopNavItems: (theme) => css`
+    display: none;
+
+    ${theme.breakpoints.up("md")} {
+      display: flex;
+    }
+  `,
+  mobileMenuButton: (theme) => css`
+    ${theme.breakpoints.up("md")} {
+      display: none;
+    }
+  `,
+  wrapper: (theme) => css`
+    position: relative;
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+
+    ${theme.breakpoints.up("md")} {
+      justify-content: flex-start;
+    }
+  `,
+  drawerHeader: (theme) => ({
+    padding: theme.spacing(2),
+    paddingTop: theme.spacing(4),
+    paddingBottom: theme.spacing(4),
+  }),
+  logo: (theme) => css`
+    align-items: center;
+    display: flex;
+    height: ${navHeight}px;
+    color: ${theme.palette.text.primary};
+    padding: ${theme.spacing(2)};
+
+    // svg is for the Coder logo, img is for custom images
+    & svg,
+    & img {
+      height: 100%;
+      object-fit: contain;
+    }
+  `,
+  drawerLogo: (theme) => ({
+    padding: 0,
+    maxHeight: theme.spacing(5),
+  }),
+  item: {
+    padding: 0,
+  },
+  link: (theme) => css`
+    align-items: center;
+    color: ${colors.gray[6]};
+    display: flex;
+    flex: 1;
+    font-size: 16px;
+    padding: ${theme.spacing(1.5)} ${theme.spacing(2)};
+    text-decoration: none;
+    transition: background-color 0.15s ease-in-out;
+
+    &.active {
+      color: ${theme.palette.text.primary};
+      font-weight: 500;
+    }
+
+    &:hover {
+      background-color: ${theme.palette.action.hover};
+    }
+
+    ${theme.breakpoints.up("md")} {
+      height: ${navHeight}px;
+      padding: 0 ${theme.spacing(3)};
+    }
+  `,
+} satisfies Record<string, Interpolation<Theme>>;
+
+interface NavItemsProps {
+  children?: ReactNode;
+  className?: string;
+  canViewAuditLog: boolean;
+  canViewDeployment: boolean;
+  canViewAllUsers: boolean;
+}
+
+const NavItems: React.FC<NavItemsProps> = (props) => {
+  const { className, canViewAuditLog, canViewDeployment, canViewAllUsers } =
+    props;
+  const location = useLocation();
+  const theme = useTheme();
+
+  return (
+    <nav className={className}>
+      <NavLink
+        css={[
+          styles.link,
+          location.pathname.startsWith("/@") && {
+            color: theme.palette.text.primary,
+            fontWeight: 500,
+          },
+        ]}
+        to="/workspaces"
+      >
+        {Language.workspaces}
+      </NavLink>
+      <NavLink css={styles.link} to="/templates">
+        {Language.templates}
+      </NavLink>
+      {canViewAllUsers && (
+        <NavLink css={styles.link} to={USERS_LINK}>
+          {Language.users}
+        </NavLink>
+      )}
+      {canViewAuditLog && (
+        <NavLink css={styles.link} to="/audit">
+          {Language.audit}
+        </NavLink>
+      )}
+      {canViewDeployment && (
+        <NavLink css={styles.link} to="/deployment/general">
+          {Language.deployment}
+        </NavLink>
+      )}
+    </nav>
+  );
+};
+export const NavbarView: FC<NavbarViewProps> = ({
+  user,
+  logo_url,
+  buildInfo,
+  supportLinks,
+  onSignOut,
+  canViewAuditLog,
+  canViewDeployment,
+  canViewAllUsers,
+  proxyContextValue,
+}) => {
+  const [isDrawerOpen, setIsDrawerOpen] = useState(false);
+
+  return (
+    <nav
+      css={(theme) => ({
+        height: navHeight,
+        background: theme.palette.background.paper,
+        borderBottom: `1px solid ${theme.palette.divider}`,
+      })}
+    >
+      <div css={styles.wrapper}>
+        <IconButton
+          aria-label="Open menu"
+          css={styles.mobileMenuButton}
+          onClick={() => {
+            setIsDrawerOpen(true);
+          }}
+          size="large"
+        >
+          <MenuIcon />
+        </IconButton>
+
+        <Drawer
+          anchor="left"
+          open={isDrawerOpen}
+          onClose={() => setIsDrawerOpen(false)}
+        >
+          <div css={{ width: 250 }}>
+            <div css={styles.drawerHeader}>
+              <div css={[styles.logo, styles.drawerLogo]}>
+                {logo_url ? (
+                  <img src={logo_url} alt="Custom Logo" />
+                ) : (
+                  <CoderIcon />
+                )}
+              </div>
+            </div>
+            <NavItems
+              canViewAuditLog={canViewAuditLog}
+              canViewDeployment={canViewDeployment}
+              canViewAllUsers={canViewAllUsers}
+            />
+          </div>
+        </Drawer>
+
+        <NavLink css={styles.logo} to="/workspaces">
+          {logo_url ? (
+            <img src={logo_url} alt="Custom Logo" />
+          ) : (
+            <CoderIcon fill="white" opacity={1} width={125} />
+          )}
+        </NavLink>
+
+        <NavItems
+          css={styles.desktopNavItems}
+          canViewAuditLog={canViewAuditLog}
+          canViewDeployment={canViewDeployment}
+          canViewAllUsers={canViewAllUsers}
+        />
+
+        <Box
+          display="flex"
+          marginLeft={{ md: "auto" }}
+          gap={2}
+          alignItems="center"
+          paddingRight={2}
+        >
+          {proxyContextValue && (
+            <ProxyMenu proxyContextValue={proxyContextValue} />
+          )}
+          {user && (
+            <UserDropdown
+              user={user}
+              buildInfo={buildInfo}
+              supportLinks={supportLinks}
+              onSignOut={onSignOut}
+            />
+          )}
+        </Box>
+      </div>
+    </nav>
+  );
+};
+
+const ProxyMenu: FC<{ proxyContextValue: ProxyContextValue }> = ({
+  proxyContextValue,
+}) => {
+  const buttonRef = useRef<HTMLButtonElement>(null);
+  const [isOpen, setIsOpen] = useState(false);
+  const [refetchDate, setRefetchDate] = useState<Date>();
+  const selectedProxy = proxyContextValue.proxy.proxy;
+  const refreshLatencies = proxyContextValue.refetchProxyLatencies;
+  const closeMenu = () => setIsOpen(false);
+  const navigate = useNavigate();
+  const latencies = proxyContextValue.proxyLatencies;
+  const isLoadingLatencies = Object.keys(latencies).length === 0;
+  const isLoading = proxyContextValue.isLoading || isLoadingLatencies;
+  const permissions = usePermissions();
+  const proxyLatencyLoading = (proxy: TypesGen.Region): boolean => {
+    if (!refetchDate) {
+      // Only show loading if the user manually requested a refetch
+      return false;
+    }
+
+    const latency = latencies?.[proxy.id];
+    // Only show a loading spinner if:
+    //  - A latency exists. This means the latency was fetched at some point, so the
+    //    loader *should* be resolved.
+    //  - The proxy is healthy. If it is not, the loader might never resolve.
+    //  - The latency reported is older than the refetch date. This means the latency
+    //    is stale and we should show a loading spinner until the new latency is
+    //    fetched.
+    if (proxy.healthy && latency && latency.at < refetchDate) {
+      return true;
+    }
+
+    return false;
+  };
+
+  if (isLoading) {
+    return (
+      <Skeleton
+        width="160px"
+        height={BUTTON_SM_HEIGHT}
+        sx={{ borderRadius: "4px", transform: "none" }}
+      />
+    );
+  }
+
+  return (
+    <>
+      <Button
+        ref={buttonRef}
+        onClick={() => setIsOpen(true)}
+        size="small"
+        endIcon={<KeyboardArrowDownOutlined />}
+        sx={{
+          borderRadius: "4px",
+          "& .MuiSvgIcon-root": { fontSize: 14 },
+        }}
+      >
+        {selectedProxy ? (
+          <Box display="flex" gap={2} alignItems="center">
+            <Box width={14} height={14} lineHeight={0}>
+              <Box
+                component="img"
+                src={selectedProxy.icon_url}
+                alt=""
+                sx={{ objectFit: "contain" }}
+                width="100%"
+                height="100%"
+              />
+            </Box>
+            {selectedProxy.display_name}
+            <ProxyStatusLatency
+              latency={latencies?.[selectedProxy.id]?.latencyMS}
+              isLoading={proxyLatencyLoading(selectedProxy)}
+            />
+          </Box>
+        ) : (
+          "Select Proxy"
+        )}
+      </Button>
+      <Menu
+        open={isOpen}
+        anchorEl={buttonRef.current}
+        onClick={closeMenu}
+        onClose={closeMenu}
+        sx={{ "& .MuiMenu-paper": { py: 1 } }}
+      >
+        <Box
+          sx={{
+            w: "100%",
+            fontSize: 14,
+            padding: 2,
+            maxWidth: "320px",
+            lineHeight: "140%",
+          }}
+        >
+          <Typography
+            component="h4"
+            sx={{
+              fontSize: "inherit",
+              fontWeight: 600,
+              lineHeight: "inherit",
+              margin: 0,
+            }}
+          >
+            Select a region nearest to you
+          </Typography>
+          <Typography
+            component="p"
+            sx={{
+              fontSize: 13,
+              color: (theme) => theme.palette.text.secondary,
+              lineHeight: "inherit",
+              marginTop: 0.5,
+            }}
+          >
+            Workspace proxies improve terminal and web app connections to
+            workspaces. This does not apply to CLI connections. A region must be
+            manually selected, otherwise the default primary region will be
+            used.
+          </Typography>
+        </Box>
+        <Divider sx={{ borderColor: (theme) => theme.palette.divider }} />
+        {proxyContextValue.proxies
+          ?.sort((a, b) => {
+            const latencyA = latencies?.[a.id]?.latencyMS ?? Infinity;
+            const latencyB = latencies?.[b.id]?.latencyMS ?? Infinity;
+            return latencyA - latencyB;
+          })
+          .map((proxy) => (
+            <MenuItem
+              onClick={() => {
+                if (!proxy.healthy) {
+                  displayError("Please select a healthy workspace proxy.");
+                  closeMenu();
+                  return;
+                }
+
+                proxyContextValue.setProxy(proxy);
+                closeMenu();
+              }}
+              key={proxy.id}
+              selected={proxy.id === selectedProxy?.id}
+              sx={{
+                fontSize: 14,
+              }}
+            >
+              <Box display="flex" gap={3} alignItems="center" width="100%">
+                <Box width={14} height={14} lineHeight={0}>
+                  <Box
+                    component="img"
+                    src={proxy.icon_url}
+                    alt=""
+                    sx={{ objectFit: "contain" }}
+                    width="100%"
+                    height="100%"
+                  />
+                </Box>
+                {proxy.display_name}
+                <ProxyStatusLatency
+                  latency={latencies?.[proxy.id]?.latencyMS}
+                  isLoading={proxyLatencyLoading(proxy)}
+                />
+              </Box>
+            </MenuItem>
+          ))}
+        <Divider sx={{ borderColor: (theme) => theme.palette.divider }} />
+        {Boolean(permissions.editWorkspaceProxies) && (
+          <MenuItem
+            sx={{ fontSize: 14 }}
+            onClick={() => {
+              navigate("deployment/workspace-proxies");
+            }}
+          >
+            Proxy settings
+          </MenuItem>
+        )}
+        <MenuItem
+          sx={{ fontSize: 14 }}
+          onClick={(e) => {
+            // Stop the menu from closing
+            e.stopPropagation();
+            // Refresh the latencies.
+            const refetchDate = refreshLatencies();
+            setRefetchDate(refetchDate);
+          }}
+        >
+          Refresh Latencies
+        </MenuItem>
+      </Menu>
+    </>
+  );
+};
diff --git a/site/src/components/Dashboard/Navbar/UserDropdown/UserDropdown.stories.tsx b/site/src/components/Dashboard/Navbar/UserDropdown/UserDropdown.stories.tsx
new file mode 100644
index 0000000000000..394d4846e2a2f
--- /dev/null
+++ b/site/src/components/Dashboard/Navbar/UserDropdown/UserDropdown.stories.tsx
@@ -0,0 +1,25 @@
+import { MockBuildInfo, MockUser } from "testHelpers/entities";
+import { UserDropdown } from "./UserDropdown";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof UserDropdown> = {
+  title: "components/UserDropdown",
+  component: UserDropdown,
+  args: {
+    user: MockUser,
+    isDefaultOpen: true,
+    buildInfo: MockBuildInfo,
+    supportLinks: [
+      { icon: "docs", name: "Documentation", target: "" },
+      { icon: "bug", name: "Report a bug", target: "" },
+      { icon: "chat", name: "Join the Coder Discord", target: "" },
+    ],
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof UserDropdown>;
+
+const Example: Story = {};
+
+export { Example as UserDropdown };
diff --git a/site/src/components/Dashboard/Navbar/UserDropdown/UserDropdown.tsx b/site/src/components/Dashboard/Navbar/UserDropdown/UserDropdown.tsx
new file mode 100644
index 0000000000000..d8194ac8c567e
--- /dev/null
+++ b/site/src/components/Dashboard/Navbar/UserDropdown/UserDropdown.tsx
@@ -0,0 +1,95 @@
+import Badge from "@mui/material/Badge";
+import { FC, PropsWithChildren } from "react";
+import { colors } from "theme/colors";
+import * as TypesGen from "api/typesGenerated";
+import { navHeight } from "theme/constants";
+import { DropdownArrow } from "components/DropdownArrow/DropdownArrow";
+import { UserAvatar } from "components/UserAvatar/UserAvatar";
+import { UserDropdownContent } from "./UserDropdownContent";
+import { BUTTON_SM_HEIGHT } from "theme/theme";
+import { css } from "@emotion/react";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "components/Popover/Popover";
+
+export interface UserDropdownProps {
+  user: TypesGen.User;
+  buildInfo?: TypesGen.BuildInfoResponse;
+  supportLinks?: TypesGen.LinkConfig[];
+  onSignOut: () => void;
+  isDefaultOpen?: boolean;
+}
+
+export const UserDropdown: FC<PropsWithChildren<UserDropdownProps>> = ({
+  buildInfo,
+  user,
+  supportLinks,
+  onSignOut,
+  isDefaultOpen,
+}: UserDropdownProps) => {
+  return (
+    <Popover isDefaultOpen={isDefaultOpen}>
+      {(popover) => (
+        <>
+          <PopoverTrigger>
+            <button
+              css={(theme) => css`
+                background: none;
+                border: 0;
+                cursor: pointer;
+                height: ${navHeight}px;
+                padding: ${theme.spacing(1.5, 0)};
+
+                &:hover {
+                  background-color: transparent;
+                }
+              `}
+              data-testid="user-dropdown-trigger"
+            >
+              <div
+                css={{
+                  display: "flex",
+                  alignItems: "center",
+                  minWidth: 0,
+                  maxWidth: 300,
+                }}
+              >
+                <Badge overlap="circular">
+                  <UserAvatar
+                    sx={{
+                      width: BUTTON_SM_HEIGHT,
+                      height: BUTTON_SM_HEIGHT,
+                      fontSize: 16,
+                    }}
+                    username={user.username}
+                    avatarURL={user.avatar_url}
+                  />
+                </Badge>
+                <DropdownArrow color={colors.gray[6]} close={popover.isOpen} />
+              </div>
+            </button>
+          </PopoverTrigger>
+
+          <PopoverContent
+            horizontal="right"
+            css={(theme) => ({
+              ".MuiPaper-root": {
+                width: 260,
+                boxShadow: theme.shadows[6],
+              },
+            })}
+          >
+            <UserDropdownContent
+              user={user}
+              buildInfo={buildInfo}
+              supportLinks={supportLinks}
+              onSignOut={onSignOut}
+            />
+          </PopoverContent>
+        </>
+      )}
+    </Popover>
+  );
+};
diff --git a/site/src/components/Dashboard/Navbar/UserDropdown/UserDropdownContent.test.tsx b/site/src/components/Dashboard/Navbar/UserDropdown/UserDropdownContent.test.tsx
new file mode 100644
index 0000000000000..f9650a60d0443
--- /dev/null
+++ b/site/src/components/Dashboard/Navbar/UserDropdown/UserDropdownContent.test.tsx
@@ -0,0 +1,35 @@
+import { screen } from "@testing-library/react";
+import { MockUser } from "testHelpers/entities";
+import { render, waitForLoaderToBeRemoved } from "testHelpers/renderHelpers";
+import { Language, UserDropdownContent } from "./UserDropdownContent";
+import { Popover } from "components/Popover/Popover";
+
+describe("UserDropdownContent", () => {
+  it("has the correct link for the account item", async () => {
+    render(
+      <Popover>
+        <UserDropdownContent user={MockUser} onSignOut={jest.fn()} />
+      </Popover>,
+    );
+    await waitForLoaderToBeRemoved();
+
+    const link = screen.getByText(Language.accountLabel).closest("a");
+    if (!link) {
+      throw new Error("Anchor tag not found for the account menu item");
+    }
+
+    expect(link.getAttribute("href")).toBe("/settings/account");
+  });
+
+  it("calls the onSignOut function", async () => {
+    const onSignOut = jest.fn();
+    render(
+      <Popover>
+        <UserDropdownContent user={MockUser} onSignOut={onSignOut} />
+      </Popover>,
+    );
+    await waitForLoaderToBeRemoved();
+    screen.getByText(Language.signOutLabel).click();
+    expect(onSignOut).toBeCalledTimes(1);
+  });
+});
diff --git a/site/src/components/Dashboard/Navbar/UserDropdown/UserDropdownContent.tsx b/site/src/components/Dashboard/Navbar/UserDropdown/UserDropdownContent.tsx
new file mode 100644
index 0000000000000..99d2d65a48f9a
--- /dev/null
+++ b/site/src/components/Dashboard/Navbar/UserDropdown/UserDropdownContent.tsx
@@ -0,0 +1,173 @@
+import Divider from "@mui/material/Divider";
+import MenuItem from "@mui/material/MenuItem";
+import AccountIcon from "@mui/icons-material/AccountCircleOutlined";
+import BugIcon from "@mui/icons-material/BugReportOutlined";
+import ChatIcon from "@mui/icons-material/ChatOutlined";
+import LaunchIcon from "@mui/icons-material/LaunchOutlined";
+import { Stack } from "components/Stack/Stack";
+import { FC } from "react";
+import { Link } from "react-router-dom";
+import * as TypesGen from "api/typesGenerated";
+import DocsIcon from "@mui/icons-material/MenuBook";
+import LogoutIcon from "@mui/icons-material/ExitToAppOutlined";
+import {
+  css,
+  type CSSObject,
+  type Interpolation,
+  type Theme,
+} from "@emotion/react";
+import { usePopover } from "components/Popover/Popover";
+
+export const Language = {
+  accountLabel: "Account",
+  signOutLabel: "Sign Out",
+  copyrightText: `\u00a9 ${new Date().getFullYear()} Coder Technologies, Inc.`,
+};
+
+const styles = {
+  info: (theme) => [
+    theme.typography.body2 as CSSObject,
+    {
+      padding: theme.spacing(2.5),
+    },
+  ],
+  userName: {
+    fontWeight: 600,
+  },
+  userEmail: (theme) => ({
+    color: theme.palette.text.secondary,
+    width: "100%",
+    textOverflow: "ellipsis",
+    overflow: "hidden",
+  }),
+  link: {
+    textDecoration: "none",
+    color: "inherit",
+  },
+  menuItem: (theme) => css`
+    gap: ${theme.spacing(2.5)};
+    padding: ${theme.spacing(1, 2.5)};
+
+    &:hover {
+      background-color: ${theme.palette.action.hover};
+      transition: background-color 0.3s ease;
+    }
+  `,
+  menuItemIcon: (theme) => ({
+    color: theme.palette.text.secondary,
+    width: theme.spacing(2.5),
+    height: theme.spacing(2.5),
+  }),
+  menuItemText: {
+    fontSize: 14,
+  },
+  footerText: (theme) => css`
+    font-size: 12px;
+    text-decoration: none;
+    color: ${theme.palette.text.secondary};
+    display: flex;
+    align-items: center;
+    gap: 4px;
+
+    & svg {
+      width: 12px;
+      height: 12px;
+    }
+  `,
+  buildInfo: (theme) => ({
+    color: theme.palette.text.primary,
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
+
+export interface UserDropdownContentProps {
+  user: TypesGen.User;
+  buildInfo?: TypesGen.BuildInfoResponse;
+  supportLinks?: TypesGen.LinkConfig[];
+  onSignOut: () => void;
+}
+
+export const UserDropdownContent: FC<UserDropdownContentProps> = ({
+  buildInfo,
+  user,
+  supportLinks,
+  onSignOut,
+}) => {
+  const popover = usePopover();
+
+  const onPopoverClose = () => {
+    popover.setIsOpen(false);
+  };
+
+  return (
+    <div>
+      <Stack css={styles.info} spacing={0}>
+        <span css={styles.userName}>{user.username}</span>
+        <span css={styles.userEmail}>{user.email}</span>
+      </Stack>
+
+      <Divider css={{ marginBottom: 8 }} />
+
+      <Link to="/settings/account" css={styles.link}>
+        <MenuItem css={styles.menuItem} onClick={onPopoverClose}>
+          <AccountIcon css={styles.menuItemIcon} />
+          <span css={styles.menuItemText}>{Language.accountLabel}</span>
+        </MenuItem>
+      </Link>
+
+      <MenuItem css={styles.menuItem} onClick={onSignOut}>
+        <LogoutIcon css={styles.menuItemIcon} />
+        <span css={styles.menuItemText}>{Language.signOutLabel}</span>
+      </MenuItem>
+
+      {supportLinks && (
+        <>
+          <Divider />
+          {supportLinks.map((link) => (
+            <a
+              href={includeBuildInfo(link.target, buildInfo)}
+              key={link.name}
+              target="_blank"
+              rel="noreferrer"
+              css={styles.link}
+            >
+              <MenuItem css={styles.menuItem} onClick={onPopoverClose}>
+                {link.icon === "bug" && <BugIcon css={styles.menuItemIcon} />}
+                {link.icon === "chat" && <ChatIcon css={styles.menuItemIcon} />}
+                {link.icon === "docs" && <DocsIcon css={styles.menuItemIcon} />}
+                <span css={styles.menuItemText}>{link.name}</span>
+              </MenuItem>
+            </a>
+          ))}
+        </>
+      )}
+
+      <Divider css={{ marginBottom: "0 !important" }} />
+
+      <Stack css={styles.info} spacing={0}>
+        <a
+          title="Browse Source Code"
+          css={[styles.footerText, styles.buildInfo]}
+          href={buildInfo?.external_url}
+          target="_blank"
+          rel="noreferrer"
+        >
+          {buildInfo?.version} <LaunchIcon />
+        </a>
+
+        <div css={styles.footerText}>{Language.copyrightText}</div>
+      </Stack>
+    </div>
+  );
+};
+
+const includeBuildInfo = (
+  href: string,
+  buildInfo?: TypesGen.BuildInfoResponse,
+): string => {
+  return href.replace(
+    "{CODER_BUILD_INFO}",
+    `${encodeURIComponent(
+      `Version: [\`${buildInfo?.version}\`](${buildInfo?.external_url})`,
+    )}`,
+  );
+};
diff --git a/site/src/components/Dashboard/ServiceBanner/ServiceBanner.tsx b/site/src/components/Dashboard/ServiceBanner/ServiceBanner.tsx
new file mode 100644
index 0000000000000..239e6905ef523
--- /dev/null
+++ b/site/src/components/Dashboard/ServiceBanner/ServiceBanner.tsx
@@ -0,0 +1,24 @@
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { ServiceBannerView } from "./ServiceBannerView";
+
+export const ServiceBanner: React.FC = () => {
+  const { appearance } = useDashboard();
+  const { message, background_color, enabled } =
+    appearance.config.service_banner;
+
+  if (!enabled) {
+    return null;
+  }
+
+  if (message !== undefined && background_color !== undefined) {
+    return (
+      <ServiceBannerView
+        message={message}
+        backgroundColor={background_color}
+        isPreview={appearance.isPreview}
+      />
+    );
+  } else {
+    return null;
+  }
+};
diff --git a/site/src/components/Dashboard/ServiceBanner/ServiceBannerView.stories.tsx b/site/src/components/Dashboard/ServiceBanner/ServiceBannerView.stories.tsx
new file mode 100644
index 0000000000000..8f34bce0eec6a
--- /dev/null
+++ b/site/src/components/Dashboard/ServiceBanner/ServiceBannerView.stories.tsx
@@ -0,0 +1,25 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import { ServiceBannerView } from "./ServiceBannerView";
+
+const meta: Meta<typeof ServiceBannerView> = {
+  title: "components/ServiceBannerView",
+  component: ServiceBannerView,
+};
+
+export default meta;
+type Story = StoryObj<typeof ServiceBannerView>;
+
+export const Production: Story = {
+  args: {
+    message: "weeeee",
+    backgroundColor: "#FFFFFF",
+  },
+};
+
+export const Preview: Story = {
+  args: {
+    message: "weeeee",
+    backgroundColor: "#000000",
+    isPreview: true,
+  },
+};
diff --git a/site/src/components/Dashboard/ServiceBanner/ServiceBannerView.tsx b/site/src/components/Dashboard/ServiceBanner/ServiceBannerView.tsx
new file mode 100644
index 0000000000000..526613cd1f55f
--- /dev/null
+++ b/site/src/components/Dashboard/ServiceBanner/ServiceBannerView.tsx
@@ -0,0 +1,69 @@
+import { Pill } from "components/Pill/Pill";
+import ReactMarkdown from "react-markdown";
+import { colors } from "theme/colors";
+import { useTheme } from "@mui/system";
+import { css } from "@emotion/react";
+import { readableForegroundColor } from "utils/colors";
+
+export interface ServiceBannerViewProps {
+  message: string;
+  backgroundColor: string;
+  isPreview: boolean;
+}
+
+export const ServiceBannerView: React.FC<ServiceBannerViewProps> = ({
+  message,
+  backgroundColor,
+  isPreview,
+}) => {
+  const theme = useTheme();
+  // We don't want anything funky like an image or a heading in the service
+  // banner.
+  const markdownElementsAllowed = [
+    "text",
+    "a",
+    "pre",
+    "ul",
+    "strong",
+    "emphasis",
+    "italic",
+    "link",
+    "em",
+  ];
+  return (
+    <div
+      css={css`
+        padding: ${theme.spacing(1.5)};
+        background-color: ${backgroundColor ?? theme.palette.warning.main};
+        display: flex;
+        align-items: center;
+
+        &.error {
+          background-color: ${colors.red[12]};
+        }
+      `}
+    >
+      {isPreview && <Pill text="Preview" type="info" lightBorder />}
+      <div
+        css={css`
+          margin-right: auto;
+          margin-left: auto;
+          font-weight: 400;
+          color: ${readableForegroundColor(backgroundColor)};
+
+          & a {
+            color: inherit;
+          }
+        `}
+      >
+        <ReactMarkdown
+          allowedElements={markdownElementsAllowed}
+          linkTarget="_blank"
+          unwrapDisallowed
+        >
+          {message}
+        </ReactMarkdown>
+      </div>
+    </div>
+  );
+};
diff --git a/site/src/components/Dashboard/useUpdateCheck.test.tsx b/site/src/components/Dashboard/useUpdateCheck.test.tsx
new file mode 100644
index 0000000000000..e5e307c205d79
--- /dev/null
+++ b/site/src/components/Dashboard/useUpdateCheck.test.tsx
@@ -0,0 +1,121 @@
+import { act, renderHook, waitFor } from "@testing-library/react";
+import { useUpdateCheck } from "./useUpdateCheck";
+import { QueryClient, QueryClientProvider } from "react-query";
+import { ReactNode } from "react";
+import { rest } from "msw";
+import { MockUpdateCheck } from "testHelpers/entities";
+import { server } from "testHelpers/server";
+
+const createWrapper = () => {
+  const queryClient = new QueryClient();
+  return ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  );
+};
+
+beforeEach(() => {
+  window.localStorage.clear();
+});
+
+it("is dismissed when does not have permission to see it", () => {
+  const { result } = renderHook(() => useUpdateCheck(false), {
+    wrapper: createWrapper(),
+  });
+  expect(result.current.isVisible).toBeFalsy();
+});
+
+it("is dismissed when it is already using current version", async () => {
+  server.use(
+    rest.get("/api/v2/updatecheck", (req, res, ctx) => {
+      return res(
+        ctx.status(200),
+        ctx.json({
+          ...MockUpdateCheck,
+          current: true,
+        }),
+      );
+    }),
+  );
+  const { result } = renderHook(() => useUpdateCheck(true), {
+    wrapper: createWrapper(),
+  });
+
+  await waitFor(() => {
+    expect(result.current.isVisible).toBeFalsy();
+  });
+});
+
+it("is dismissed when it was dismissed previously", async () => {
+  server.use(
+    rest.get("/api/v2/updatecheck", (req, res, ctx) => {
+      return res(
+        ctx.status(200),
+        ctx.json({
+          ...MockUpdateCheck,
+          current: false,
+        }),
+      );
+    }),
+  );
+  window.localStorage.setItem("dismissedVersion", MockUpdateCheck.version);
+  const { result } = renderHook(() => useUpdateCheck(true), {
+    wrapper: createWrapper(),
+  });
+
+  await waitFor(() => {
+    expect(result.current.isVisible).toBeFalsy();
+  });
+});
+
+it("shows when has permission and is outdated", async () => {
+  server.use(
+    rest.get("/api/v2/updatecheck", (req, res, ctx) => {
+      return res(
+        ctx.status(200),
+        ctx.json({
+          ...MockUpdateCheck,
+          current: false,
+        }),
+      );
+    }),
+  );
+  const { result } = renderHook(() => useUpdateCheck(true), {
+    wrapper: createWrapper(),
+  });
+
+  await waitFor(() => {
+    expect(result.current.isVisible).toBeTruthy();
+  });
+});
+
+it("shows when has permission and is outdated", async () => {
+  server.use(
+    rest.get("/api/v2/updatecheck", (req, res, ctx) => {
+      return res(
+        ctx.status(200),
+        ctx.json({
+          ...MockUpdateCheck,
+          current: false,
+        }),
+      );
+    }),
+  );
+  const { result } = renderHook(() => useUpdateCheck(true), {
+    wrapper: createWrapper(),
+  });
+
+  await waitFor(() => {
+    expect(result.current.isVisible).toBeTruthy();
+  });
+
+  act(() => {
+    result.current.dismiss();
+  });
+
+  await waitFor(() => {
+    expect(result.current.isVisible).toBeFalsy();
+  });
+  expect(localStorage.getItem("dismissedVersion")).toEqual(
+    MockUpdateCheck.version,
+  );
+});
diff --git a/site/src/components/Dashboard/useUpdateCheck.ts b/site/src/components/Dashboard/useUpdateCheck.ts
new file mode 100644
index 0000000000000..7089d87914591
--- /dev/null
+++ b/site/src/components/Dashboard/useUpdateCheck.ts
@@ -0,0 +1,45 @@
+import { updateCheck } from "api/queries/updateCheck";
+import { useMemo, useState } from "react";
+import { useQuery } from "react-query";
+
+export const useUpdateCheck = (enabled: boolean) => {
+  const [dismissedVersion, setDismissedVersion] = useState(() =>
+    getDismissedVersionOnLocal(),
+  );
+  const updateCheckQuery = useQuery({
+    ...updateCheck(),
+    enabled,
+  });
+
+  const isVisible: boolean = useMemo(() => {
+    if (!updateCheckQuery.data) {
+      return false;
+    }
+
+    const isNotDismissed = dismissedVersion !== updateCheckQuery.data.version;
+    const isOutdated = !updateCheckQuery.data.current;
+    return isNotDismissed && isOutdated ? true : false;
+  }, [dismissedVersion, updateCheckQuery.data]);
+
+  const dismiss = () => {
+    if (!updateCheckQuery.data) {
+      return;
+    }
+    setDismissedVersion(updateCheckQuery.data.version);
+    saveDismissedVersionOnLocal(updateCheckQuery.data.version);
+  };
+
+  return {
+    isVisible,
+    dismiss,
+    data: updateCheckQuery.data,
+  };
+};
+
+const saveDismissedVersionOnLocal = (version: string): void => {
+  window.localStorage.setItem("dismissedVersion", version);
+};
+
+const getDismissedVersionOnLocal = (): string | undefined => {
+  return localStorage.getItem("dismissedVersion") ?? undefined;
+};
diff --git a/site/src/components/DeploySettingsLayout/Badges.tsx b/site/src/components/DeploySettingsLayout/Badges.tsx
index f9d34bca918b6..dfef9540185ba 100644
--- a/site/src/components/DeploySettingsLayout/Badges.tsx
+++ b/site/src/components/DeploySettingsLayout/Badges.tsx
@@ -1,151 +1,138 @@
-import { makeStyles } from "@mui/styles"
-import { Stack } from "components/Stack/Stack"
-import { PropsWithChildren, FC } from "react"
-import { MONOSPACE_FONT_FAMILY } from "theme/constants"
-import { combineClasses } from "utils/combineClasses"
-import Tooltip from "@mui/material/Tooltip"
+import type { PropsWithChildren, FC } from "react";
+import Tooltip from "@mui/material/Tooltip";
+import { type Interpolation, type Theme } from "@emotion/react";
+import { Stack } from "components/Stack/Stack";
+import { colors } from "theme/colors";
+
+const styles = {
+  badge: (theme) => ({
+    fontSize: 10,
+    height: 24,
+    fontWeight: 600,
+    textTransform: "uppercase",
+    letterSpacing: "0.085em",
+    padding: theme.spacing(0, 1.5),
+    borderRadius: 9999,
+    display: "flex",
+    alignItems: "center",
+    width: "fit-content",
+    whiteSpace: "nowrap",
+  }),
+
+  enabledBadge: (theme) => ({
+    border: `1px solid ${theme.palette.success.light}`,
+    backgroundColor: theme.palette.success.dark,
+  }),
+  errorBadge: (theme) => ({
+    border: `1px solid ${theme.palette.error.light}`,
+    backgroundColor: theme.palette.error.dark,
+  }),
+  warnBadge: (theme) => ({
+    border: `1px solid ${theme.palette.warning.light}`,
+    backgroundColor: theme.palette.warning.dark,
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
 
 export const EnabledBadge: FC = () => {
-  const styles = useStyles()
-  return (
-    <span className={combineClasses([styles.badge, styles.enabledBadge])}>
-      Enabled
-    </span>
-  )
-}
+  return <span css={[styles.badge, styles.enabledBadge]}>Enabled</span>;
+};
 
 export const EntitledBadge: FC = () => {
-  const styles = useStyles()
-  return (
-    <span className={combineClasses([styles.badge, styles.enabledBadge])}>
-      Entitled
-    </span>
-  )
-}
+  return <span css={[styles.badge, styles.enabledBadge]}>Entitled</span>;
+};
 
-export const HealthyBadge: FC = () => {
-  const styles = useStyles()
+interface HealthyBadge {
+  derpOnly: boolean;
+}
+export const HealthyBadge: FC<HealthyBadge> = (props) => {
+  const { derpOnly } = props;
   return (
-    <span className={combineClasses([styles.badge, styles.enabledBadge])}>
-      Healthy
+    <span css={[styles.badge, styles.enabledBadge]}>
+      {derpOnly ? "Healthy (DERP only)" : "Healthy"}
     </span>
-  )
-}
+  );
+};
 
 export const NotHealthyBadge: FC = () => {
-  const styles = useStyles()
-  return (
-    <span className={combineClasses([styles.badge, styles.errorBadge])}>
-      Unhealthy
-    </span>
-  )
-}
+  return <span css={[styles.badge, styles.errorBadge]}>Unhealthy</span>;
+};
 
 export const NotRegisteredBadge: FC = () => {
-  const styles = useStyles()
   return (
     <Tooltip title="Workspace Proxy has never come online and needs to be started.">
-      <span className={combineClasses([styles.badge, styles.warnBadge])}>
-        Never Seen
-      </span>
+      <span css={[styles.badge, styles.warnBadge]}>Never seen</span>
     </Tooltip>
-  )
-}
+  );
+};
 
 export const NotReachableBadge: FC = () => {
-  const styles = useStyles()
   return (
     <Tooltip title="Workspace Proxy not responding to http(s) requests.">
-      <span className={combineClasses([styles.badge, styles.warnBadge])}>
-        Not Dialable
-      </span>
+      <span css={[styles.badge, styles.warnBadge]}>Not reachable</span>
     </Tooltip>
-  )
-}
+  );
+};
 
 export const DisabledBadge: FC = () => {
-  const styles = useStyles()
   return (
-    <span className={combineClasses([styles.badge, styles.disabledBadge])}>
+    <span
+      css={[
+        styles.badge,
+        (theme) => ({
+          border: `1px solid ${theme.palette.divider}`,
+          backgroundColor: theme.palette.background.paper,
+        }),
+      ]}
+    >
       Disabled
     </span>
-  )
-}
+  );
+};
 
 export const EnterpriseBadge: FC = () => {
-  const styles = useStyles()
   return (
-    <span className={combineClasses([styles.badge, styles.enterpriseBadge])}>
+    <span
+      css={[
+        styles.badge,
+        (theme) => ({
+          backgroundColor: theme.palette.info.dark,
+          border: `1px solid ${theme.palette.info.light}`,
+        }),
+      ]}
+    >
       Enterprise
     </span>
-  )
-}
+  );
+};
+
+export const AlphaBadge: FC = () => {
+  return (
+    <span
+      css={[
+        styles.badge,
+        {
+          border: `1px solid ${colors.violet[10]}`,
+          backgroundColor: colors.violet[14],
+          color: colors.violet[1],
+        },
+      ]}
+    >
+      Alpha
+    </span>
+  );
+};
 
 export const Badges: FC<PropsWithChildren> = ({ children }) => {
-  const styles = useStyles()
   return (
     <Stack
-      className={styles.badges}
+      css={(theme) => ({
+        margin: theme.spacing(0, 0, 2),
+      })}
       direction="row"
       alignItems="center"
       spacing={1}
     >
       {children}
     </Stack>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  badges: {
-    margin: theme.spacing(0, 0, 2),
-  },
-
-  badge: {
-    fontSize: 10,
-    height: 24,
-    fontWeight: 600,
-    textTransform: "uppercase",
-    letterSpacing: "0.085em",
-    padding: theme.spacing(0, 1.5),
-    borderRadius: 9999,
-    display: "flex",
-    alignItems: "center",
-    width: "fit-content",
-    whiteSpace: "nowrap",
-  },
-
-  enterpriseBadge: {
-    backgroundColor: theme.palette.info.dark,
-    border: `1px solid ${theme.palette.info.light}`,
-  },
-
-  versionBadge: {
-    border: `1px solid ${theme.palette.success.light}`,
-    backgroundColor: theme.palette.success.dark,
-    textTransform: "none",
-    color: "white",
-    fontFamily: MONOSPACE_FONT_FAMILY,
-    textDecoration: "none",
-    fontSize: 12,
-  },
-
-  enabledBadge: {
-    border: `1px solid ${theme.palette.success.light}`,
-    backgroundColor: theme.palette.success.dark,
-  },
-
-  errorBadge: {
-    border: `1px solid ${theme.palette.error.light}`,
-    backgroundColor: theme.palette.error.dark,
-  },
-
-  warnBadge: {
-    border: `1px solid ${theme.palette.warning.light}`,
-    backgroundColor: theme.palette.warning.dark,
-  },
-
-  disabledBadge: {
-    border: `1px solid ${theme.palette.divider}`,
-    backgroundColor: theme.palette.background.paper,
-  },
-}))
+  );
+};
diff --git a/site/src/components/DeploySettingsLayout/DeploySettingsLayout.tsx b/site/src/components/DeploySettingsLayout/DeploySettingsLayout.tsx
index 035748b3eb1ce..399915678465d 100644
--- a/site/src/components/DeploySettingsLayout/DeploySettingsLayout.tsx
+++ b/site/src/components/DeploySettingsLayout/DeploySettingsLayout.tsx
@@ -1,62 +1,51 @@
-import { makeStyles } from "@mui/styles"
-import { Margins } from "components/Margins/Margins"
-import { Stack } from "components/Stack/Stack"
-import { Sidebar } from "./Sidebar"
-import { createContext, Suspense, useContext, FC } from "react"
-import { useMachine } from "@xstate/react"
-import { Loader } from "components/Loader/Loader"
-import { DAUsResponse } from "api/typesGenerated"
-import { deploymentConfigMachine } from "xServices/deploymentConfig/deploymentConfigMachine"
-import { RequirePermission } from "components/RequirePermission/RequirePermission"
-import { usePermissions } from "hooks/usePermissions"
-import { Outlet } from "react-router-dom"
-import { DeploymentConfig } from "api/types"
+import { Margins } from "components/Margins/Margins";
+import { Stack } from "components/Stack/Stack";
+import { Sidebar } from "./Sidebar";
+import { createContext, Suspense, useContext, FC } from "react";
+import { Loader } from "components/Loader/Loader";
+import { RequirePermission } from "components/RequirePermission/RequirePermission";
+import { usePermissions } from "hooks/usePermissions";
+import { Outlet } from "react-router-dom";
+import { DeploymentConfig } from "api/api";
+import { useQuery } from "react-query";
+import { deploymentConfig } from "api/queries/deployment";
 
 type DeploySettingsContextValue = {
-  deploymentValues: DeploymentConfig
-  getDeploymentValuesError: unknown
-  deploymentDAUs?: DAUsResponse
-  getDeploymentDAUsError: unknown
-}
+  deploymentValues: DeploymentConfig;
+};
 
 const DeploySettingsContext = createContext<
   DeploySettingsContextValue | undefined
->(undefined)
+>(undefined);
 
 export const useDeploySettings = (): DeploySettingsContextValue => {
-  const context = useContext(DeploySettingsContext)
+  const context = useContext(DeploySettingsContext);
   if (!context) {
     throw new Error(
       "useDeploySettings should be used inside of DeploySettingsLayout",
-    )
+    );
   }
-  return context
-}
+  return context;
+};
 
 export const DeploySettingsLayout: FC = () => {
-  const [state] = useMachine(deploymentConfigMachine)
-  const styles = useStyles()
-  const {
-    deploymentValues,
-    deploymentDAUs,
-    getDeploymentValuesError,
-    getDeploymentDAUsError,
-  } = state.context
-  const permissions = usePermissions()
+  const deploymentConfigQuery = useQuery(deploymentConfig());
+  const permissions = usePermissions();
 
   return (
     <RequirePermission isFeatureVisible={permissions.viewDeploymentValues}>
       <Margins>
-        <Stack className={styles.wrapper} direction="row" spacing={6}>
+        <Stack
+          css={(theme) => ({ padding: theme.spacing(6, 0) })}
+          direction="row"
+          spacing={6}
+        >
           <Sidebar />
-          <main className={styles.content}>
-            {deploymentValues ? (
+          <main css={{ maxWidth: 800, width: "100%" }}>
+            {deploymentConfigQuery.data ? (
               <DeploySettingsContext.Provider
                 value={{
-                  deploymentValues,
-                  getDeploymentValuesError,
-                  deploymentDAUs,
-                  getDeploymentDAUsError,
+                  deploymentValues: deploymentConfigQuery.data,
                 }}
               >
                 <Suspense fallback={<Loader />}>
@@ -70,16 +59,5 @@ export const DeploySettingsLayout: FC = () => {
         </Stack>
       </Margins>
     </RequirePermission>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  wrapper: {
-    padding: theme.spacing(6, 0),
-  },
-
-  content: {
-    maxWidth: 800,
-    width: "100%",
-  },
-}))
+  );
+};
diff --git a/site/src/components/DeploySettingsLayout/Fieldset.tsx b/site/src/components/DeploySettingsLayout/Fieldset.tsx
index 1c0209979ca42..627db642eef03 100644
--- a/site/src/components/DeploySettingsLayout/Fieldset.tsx
+++ b/site/src/components/DeploySettingsLayout/Fieldset.tsx
@@ -1,35 +1,82 @@
-import { makeStyles } from "@mui/styles"
-import { FC, ReactNode, FormEventHandler } from "react"
-import Button from "@mui/material/Button"
+import type { FC, ReactNode, FormEventHandler } from "react";
+import Button from "@mui/material/Button";
+import { type CSSObject, useTheme } from "@emotion/react";
 
-export const Fieldset: FC<{
-  children: ReactNode
-  title: string | JSX.Element
-  subtitle?: string | JSX.Element
-  validation?: string | JSX.Element | false
-  button?: JSX.Element | false
-  onSubmit: FormEventHandler<HTMLFormElement>
-  isSubmitting?: boolean
-}> = ({
-  title,
-  subtitle,
-  children,
-  validation,
-  button,
-  onSubmit,
-  isSubmitting,
-}) => {
-  const styles = useStyles()
+interface FieldsetProps {
+  children: ReactNode;
+  title: string | JSX.Element;
+  subtitle?: string | JSX.Element;
+  validation?: string | JSX.Element | false;
+  button?: JSX.Element | false;
+  onSubmit: FormEventHandler<HTMLFormElement>;
+  isSubmitting?: boolean;
+}
+
+export const Fieldset: FC<FieldsetProps> = (props) => {
+  const {
+    title,
+    subtitle,
+    children,
+    validation,
+    button,
+    onSubmit,
+    isSubmitting,
+  } = props;
+  const theme = useTheme();
 
   return (
-    <form className={styles.fieldset} onSubmit={onSubmit}>
-      <header className={styles.header}>
-        <div className={styles.title}>{title}</div>
-        {subtitle && <div className={styles.subtitle}>{subtitle}</div>}
-        <div className={styles.body}>{children}</div>
+    <form
+      css={{
+        borderRadius: theme.spacing(1),
+        border: `1px solid ${theme.palette.divider}`,
+        background: theme.palette.background.paper,
+        marginTop: theme.spacing(4),
+      }}
+      onSubmit={onSubmit}
+    >
+      <header css={{ padding: theme.spacing(3) }}>
+        <div
+          css={{
+            fontSize: theme.spacing(2.5),
+            margin: 0,
+            fontWeight: 600,
+          }}
+        >
+          {title}
+        </div>
+        {subtitle && (
+          <div
+            css={{
+              color: theme.palette.text.secondary,
+              fontSize: 14,
+              marginTop: theme.spacing(1),
+            }}
+          >
+            {subtitle}
+          </div>
+        )}
+        <div
+          css={[
+            theme.typography.body2 as CSSObject,
+            { paddingTop: theme.spacing(2) },
+          ]}
+        >
+          {children}
+        </div>
       </header>
-      <footer className={styles.footer}>
-        <div className={styles.validation}>{validation}</div>
+      <footer
+        css={[
+          theme.typography.body2 as CSSObject,
+          {
+            background: theme.palette.background.paperLight,
+            padding: `${theme.spacing(2)} ${theme.spacing(3)}`,
+            display: "flex",
+            alignItems: "center",
+            justifyContent: "space-between",
+          },
+        ]}
+      >
+        <div css={{ color: theme.palette.text.secondary }}>{validation}</div>
         {button || (
           <Button type="submit" disabled={isSubmitting}>
             Submit
@@ -37,42 +84,5 @@ export const Fieldset: FC<{
         )}
       </footer>
     </form>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  fieldset: {
-    borderRadius: theme.spacing(1),
-    border: `1px solid ${theme.palette.divider}`,
-    background: theme.palette.background.paper,
-    marginTop: theme.spacing(4),
-  },
-  title: {
-    fontSize: theme.spacing(2.5),
-    margin: 0,
-    fontWeight: 600,
-  },
-  subtitle: {
-    color: theme.palette.text.secondary,
-    fontSize: 14,
-    marginTop: theme.spacing(1),
-  },
-  body: {
-    ...theme.typography.body2,
-    paddingTop: theme.spacing(2),
-  },
-  validation: {
-    color: theme.palette.text.secondary,
-  },
-  header: {
-    padding: theme.spacing(3),
-  },
-  footer: {
-    ...theme.typography.body2,
-    background: theme.palette.background.paperLight,
-    padding: `${theme.spacing(2)} ${theme.spacing(3)}`,
-    display: "flex",
-    alignItems: "center",
-    justifyContent: "space-between",
-  },
-}))
+  );
+};
diff --git a/site/src/components/DeploySettingsLayout/Header.tsx b/site/src/components/DeploySettingsLayout/Header.tsx
index 90c9dc95f1fe4..cc12d1a269af6 100644
--- a/site/src/components/DeploySettingsLayout/Header.tsx
+++ b/site/src/components/DeploySettingsLayout/Header.tsx
@@ -1,25 +1,50 @@
-import Button from "@mui/material/Button"
-import { makeStyles } from "@mui/styles"
-import LaunchOutlined from "@mui/icons-material/LaunchOutlined"
-import { Stack } from "components/Stack/Stack"
-import { FC } from "react"
+import Button from "@mui/material/Button";
+import LaunchOutlined from "@mui/icons-material/LaunchOutlined";
+import type { FC } from "react";
+import { useTheme } from "@emotion/react";
+import { Stack } from "components/Stack/Stack";
 
 export const Header: FC<{
-  title: string | JSX.Element
-  description?: string | JSX.Element
-  secondary?: boolean
-  docsHref?: string
+  title: string | JSX.Element;
+  description?: string | JSX.Element;
+  secondary?: boolean;
+  docsHref?: string;
 }> = ({ title, description, docsHref, secondary }) => {
-  const styles = useStyles()
+  const theme = useTheme();
 
   return (
     <Stack alignItems="baseline" direction="row" justifyContent="space-between">
-      <div className={styles.headingGroup}>
-        <h1 className={`${styles.title} ${secondary ? "secondary" : ""}`}>
+      <div css={{ maxWidth: 420, marginBottom: theme.spacing(3) }}>
+        <h1
+          css={[
+            {
+              fontSize: 32,
+              fontWeight: 700,
+              display: "flex",
+              alignItems: "center",
+              lineHeight: "initial",
+              margin: 0,
+              marginBottom: theme.spacing(0.5),
+              gap: theme.spacing(1),
+            },
+            secondary && {
+              fontSize: 24,
+              fontWeight: 500,
+            },
+          ]}
+        >
           {title}
         </h1>
         {description && (
-          <span className={styles.description}>{description}</span>
+          <span
+            css={{
+              fontSize: 14,
+              color: theme.palette.text.secondary,
+              lineHeight: "160%",
+            }}
+          >
+            {description}
+          </span>
         )}
       </div>
 
@@ -34,34 +59,5 @@ export const Header: FC<{
         </Button>
       )}
     </Stack>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  headingGroup: {
-    maxWidth: 420,
-    marginBottom: theme.spacing(3),
-  },
-
-  title: {
-    fontSize: 32,
-    fontWeight: 700,
-    display: "flex",
-    alignItems: "center",
-    lineHeight: "initial",
-    margin: 0,
-    marginBottom: theme.spacing(0.5),
-    gap: theme.spacing(1),
-
-    "&.secondary": {
-      fontSize: 24,
-      fontWeight: 500,
-    },
-  },
-
-  description: {
-    fontSize: 14,
-    color: theme.palette.text.secondary,
-    lineHeight: "160%",
-  },
-}))
+  );
+};
diff --git a/site/src/components/DeploySettingsLayout/Option.tsx b/site/src/components/DeploySettingsLayout/Option.tsx
index 49b680b55e98a..e8c51eac1e5f1 100644
--- a/site/src/components/DeploySettingsLayout/Option.tsx
+++ b/site/src/components/DeploySettingsLayout/Option.tsx
@@ -1,91 +1,199 @@
-import { makeStyles } from "@mui/styles"
-import { PropsWithChildren, FC } from "react"
-import { MONOSPACE_FONT_FAMILY } from "theme/constants"
-import { DisabledBadge, EnabledBadge } from "./Badges"
-
-export const OptionName: FC<PropsWithChildren> = ({ children }) => {
-  const styles = useStyles()
-  return <span className={styles.optionName}>{children}</span>
+import type { PropsWithChildren, FC } from "react";
+import { MONOSPACE_FONT_FAMILY } from "theme/constants";
+import Box, { BoxProps } from "@mui/material/Box";
+import { useTheme } from "@mui/system";
+import { DisabledBadge, EnabledBadge } from "./Badges";
+import { css } from "@emotion/react";
+import CheckCircleOutlined from "@mui/icons-material/CheckCircleOutlined";
+
+export const OptionName: FC<PropsWithChildren> = (props) => {
+  const { children } = props;
+
+  return (
+    <span
+      css={{
+        display: "block",
+      }}
+    >
+      {children}
+    </span>
+  );
+};
+
+export const OptionDescription: FC<PropsWithChildren> = (props) => {
+  const { children } = props;
+  const theme = useTheme();
+
+  return (
+    <span
+      css={{
+        display: "block",
+        color: theme.palette.text.secondary,
+        fontSize: 14,
+        marginTop: theme.spacing(0.5),
+      }}
+    >
+      {children}
+    </span>
+  );
+};
+
+interface OptionValueProps {
+  children?: boolean | number | string | string[] | Record<string, boolean>;
 }
 
-export const OptionDescription: FC<PropsWithChildren> = ({ children }) => {
-  const styles = useStyles()
-  return <span className={styles.optionDescription}>{children}</span>
-}
+export const OptionValue: FC<OptionValueProps> = (props) => {
+  const { children: value } = props;
+  const theme = useTheme();
 
-const NotSet: FC = () => {
-  const styles = useStyles()
+  const optionStyles = css`
+    font-size: 14px;
+    font-family: ${MONOSPACE_FONT_FAMILY};
+    overflow-wrap: anywhere;
+    user-select: all;
 
-  return <span className={styles.optionValue}>Not set</span>
-}
+    & ul {
+      padding: ${theme.spacing(2)};
+    }
+  `;
+
+  const listStyles = css`
+    margin: 0,
+    padding: 0,
+    display: "flex",
+    flex-direction: "column",
+    gap: theme.spacing(0.5),
+  `;
 
-export const OptionValue: FC<{ children?: unknown }> = ({ children }) => {
-  const styles = useStyles()
+  if (typeof value === "boolean") {
+    return value ? <EnabledBadge /> : <DisabledBadge />;
+  }
 
-  if (typeof children === "boolean") {
-    return children ? <EnabledBadge /> : <DisabledBadge />
+  if (typeof value === "number") {
+    return <span css={optionStyles}>{value}</span>;
   }
 
-  if (typeof children === "number") {
-    return <span className={styles.optionValue}>{children}</span>
+  if (!value || value.length === 0) {
+    return <span css={optionStyles}>Not set</span>;
   }
 
-  if (typeof children === "string") {
-    return <span className={styles.optionValue}>{children}</span>
+  if (typeof value === "string") {
+    return <span css={optionStyles}>{value}</span>;
   }
 
-  if (Array.isArray(children)) {
-    if (children.length === 0) {
-      return <NotSet />
-    }
+  if (typeof value === "object" && !Array.isArray(value)) {
+    return (
+      <ul css={listStyles && { listStyle: "none" }}>
+        {Object.entries(value)
+          .sort((a, b) => a[0].localeCompare(b[0]))
+          .map(([option, isEnabled]) => (
+            <li
+              key={option}
+              css={[
+                optionStyles,
+                !isEnabled && {
+                  marginLeft: 32,
+                  color: theme.palette.text.disabled,
+                },
+              ]}
+            >
+              <Box
+                sx={{
+                  display: "inline-flex",
+                  alignItems: "center",
+                }}
+              >
+                {isEnabled && (
+                  <CheckCircleOutlined
+                    sx={{
+                      width: 16,
+                      height: 16,
+                      color: (theme) => theme.palette.success.light,
+                      margin: (theme) => theme.spacing(0, 1),
+                    }}
+                  />
+                )}
+                {option}
+              </Box>
+            </li>
+          ))}
+      </ul>
+    );
+  }
 
+  if (Array.isArray(value)) {
     return (
-      <ul className={styles.optionValueList}>
-        {children.map((item) => (
-          <li key={item} className={styles.optionValue}>
+      <ul css={listStyles && { listStylePosition: "inside" }}>
+        {value.map((item) => (
+          <li key={item} css={optionStyles}>
             {item}
           </li>
         ))}
       </ul>
-    )
+    );
   }
 
-  if (children === "") {
-    return <NotSet />
-  }
+  return <span css={optionStyles}>{JSON.stringify(value)}</span>;
+};
 
-  return <span className={styles.optionValue}>{JSON.stringify(children)}</span>
+interface OptionConfigProps extends BoxProps {
+  source?: boolean;
 }
 
-const useStyles = makeStyles((theme) => ({
-  optionName: {
-    display: "block",
-  },
-
-  optionDescription: {
-    display: "block",
-    color: theme.palette.text.secondary,
-    fontSize: 14,
-    marginTop: theme.spacing(0.5),
-  },
-
-  optionValue: {
-    fontSize: 14,
-    fontFamily: MONOSPACE_FONT_FAMILY,
-    overflowWrap: "anywhere",
-    userSelect: "all",
-
-    "& ul": {
-      padding: theme.spacing(2),
-    },
-  },
-
-  optionValueList: {
-    margin: 0,
-    padding: 0,
-    listStylePosition: "inside",
-    display: "flex",
-    flexDirection: "column",
-    gap: theme.spacing(0.5),
-  },
-}))
+// OptionalConfig takes a source bool to indicate if the Option is the source of the configured value.
+export const OptionConfig = (props: OptionConfigProps) => {
+  const { source, sx, ...attrs } = props;
+  const theme = useTheme();
+  const borderColor = source
+    ? theme.palette.primary.main
+    : theme.palette.divider;
+
+  return (
+    <Box
+      {...attrs}
+      sx={{
+        fontSize: 13,
+        fontFamily: MONOSPACE_FONT_FAMILY,
+        fontWeight: 600,
+        backgroundColor: (theme) =>
+          source
+            ? theme.palette.primary.dark
+            : theme.palette.background.paperLight,
+        display: "inline-flex",
+        alignItems: "center",
+        borderRadius: 0.25,
+        padding: (theme) => theme.spacing(0, 1),
+        border: `1px solid ${borderColor}`,
+        ...sx,
+      }}
+    />
+  );
+};
+
+interface OptionConfigFlagProps extends BoxProps {
+  source?: boolean;
+}
+
+export const OptionConfigFlag = (props: OptionConfigFlagProps) => {
+  const { children, source, sx, ...attrs } = props;
+
+  return (
+    <Box
+      {...attrs}
+      sx={{
+        fontSize: 10,
+        fontWeight: 600,
+        margin: (theme) => theme.spacing(0, 0.75, 0, -0.5),
+        display: "block",
+        backgroundColor: (theme) =>
+          source ? "rgba(0, 0, 0, 0.7)" : theme.palette.divider,
+        lineHeight: 1,
+        padding: (theme) => theme.spacing(0.25, 0.5),
+        borderRadius: 0.25,
+        ...sx,
+      }}
+    >
+      {children}
+    </Box>
+  );
+};
diff --git a/site/src/components/DeploySettingsLayout/Options.test.tsx b/site/src/components/DeploySettingsLayout/Options.test.tsx
deleted file mode 100644
index 57bf5da8abeb4..0000000000000
--- a/site/src/components/DeploySettingsLayout/Options.test.tsx
+++ /dev/null
@@ -1,73 +0,0 @@
-import { optionValue } from "./OptionsTable"
-import { DeploymentOption } from "api/types"
-
-const defaultOption: DeploymentOption = {
-  name: "",
-  description: "",
-  flag: "",
-  flag_shorthand: "",
-  value: "",
-  hidden: false,
-}
-
-describe("optionValue", () => {
-  it.each<{
-    option: DeploymentOption
-    expected: unknown
-  }>([
-    {
-      option: {
-        ...defaultOption,
-        name: "Max Token Lifetime",
-        value: 3600 * 1e9,
-      },
-      expected: "1 hour",
-    },
-    {
-      option: {
-        ...defaultOption,
-        name: "Max Token Lifetime",
-        value: 24 * 3600 * 1e9,
-      },
-      expected: "1 day",
-    },
-    {
-      option: {
-        ...defaultOption,
-        name: "Session Duration",
-        value: 3600 * 1e9,
-      },
-      expected: "1 hour",
-    },
-    {
-      option: {
-        ...defaultOption,
-        name: "Session Duration",
-        value: 24 * 3600 * 1e9,
-      },
-      expected: "1 day",
-    },
-    {
-      option: {
-        ...defaultOption,
-        name: "Strict-Transport-Security",
-        value: 1000,
-      },
-      expected: "1000s",
-    },
-    {
-      option: {
-        ...defaultOption,
-        name: "OIDC Group Mapping",
-        value: {
-          "123": "foo",
-          "456": "bar",
-          "789": "baz",
-        },
-      },
-      expected: [`"123"->"foo"`, `"456"->"bar"`, `"789"->"baz"`],
-    },
-  ])(`[$option.name]optionValue($option.value)`, ({ option, expected }) => {
-    expect(optionValue(option)).toEqual(expected)
-  })
-})
diff --git a/site/src/components/DeploySettingsLayout/OptionsTable.tsx b/site/src/components/DeploySettingsLayout/OptionsTable.tsx
index b573d41b5505b..a8920c2eddc02 100644
--- a/site/src/components/DeploySettingsLayout/OptionsTable.tsx
+++ b/site/src/components/DeploySettingsLayout/OptionsTable.tsx
@@ -1,32 +1,45 @@
-import { makeStyles } from "@mui/styles"
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableHead from "@mui/material/TableHead"
-import TableRow from "@mui/material/TableRow"
-import { DeploymentOption } from "api/types"
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableHead from "@mui/material/TableHead";
+import TableRow from "@mui/material/TableRow";
+import { type FC } from "react";
+import Box from "@mui/material/Box";
+import { css } from "@emotion/react";
+import type { ClibaseOption } from "api/typesGenerated";
 import {
+  OptionConfig,
+  OptionConfigFlag,
   OptionDescription,
   OptionName,
   OptionValue,
-} from "components/DeploySettingsLayout/Option"
-import { FC } from "react"
-import { DisabledBadge } from "./Badges"
-import { intervalToDuration, formatDuration } from "date-fns"
+} from "components/DeploySettingsLayout/Option";
+import { optionValue } from "./optionValue";
 
 const OptionsTable: FC<{
-  options: DeploymentOption[]
-}> = ({ options }) => {
-  const styles = useStyles()
-
+  options: ClibaseOption[];
+  additionalValues?: string[];
+}> = ({ options, additionalValues }) => {
   if (options.length === 0) {
-    return <DisabledBadge></DisabledBadge>
+    return <p>No options to configure</p>;
   }
 
   return (
     <TableContainer>
-      <Table className={styles.table}>
+      <Table
+        css={(theme) => css`
+          & td {
+            padding-top: ${theme.spacing(3)};
+            padding-bottom: ${theme.spacing(3)};
+          }
+
+          & td:last-child,
+          & th:last-child {
+            padding-left: ${theme.spacing(4)};
+          }
+        `}
+      >
         <TableHead>
           <TableRow>
             <TableCell width="50%">Option</TableCell>
@@ -40,61 +53,60 @@ const OptionsTable: FC<{
               option.value === "" ||
               option.value === undefined
             ) {
-              return null
+              return null;
             }
             return (
               <TableRow key={option.flag}>
                 <TableCell>
                   <OptionName>{option.name}</OptionName>
                   <OptionDescription>{option.description}</OptionDescription>
+                  <Box
+                    sx={{
+                      marginTop: 3,
+                      display: "flex",
+                      flexWrap: "wrap",
+                      gap: 1,
+                    }}
+                  >
+                    {option.flag && (
+                      <OptionConfig source={option.value_source === "flag"}>
+                        <OptionConfigFlag>CLI</OptionConfigFlag>
+                        --{option.flag}
+                      </OptionConfig>
+                    )}
+                    {option.flag_shorthand && (
+                      <OptionConfig source={option.value_source === "flag"}>
+                        <OptionConfigFlag>CLI</OptionConfigFlag>-
+                        {option.flag_shorthand}
+                      </OptionConfig>
+                    )}
+                    {option.env && (
+                      <OptionConfig source={option.value_source === "env"}>
+                        <OptionConfigFlag>ENV</OptionConfigFlag>
+                        {option.env}
+                      </OptionConfig>
+                    )}
+                    {option.yaml && (
+                      <OptionConfig source={option.value_source === "yaml"}>
+                        <OptionConfigFlag>YAML</OptionConfigFlag>
+                        {option.yaml}
+                      </OptionConfig>
+                    )}
+                  </Box>
                 </TableCell>
 
                 <TableCell>
-                  <OptionValue>{optionValue(option)}</OptionValue>
+                  <OptionValue>
+                    {optionValue(option, additionalValues)}
+                  </OptionValue>
                 </TableCell>
               </TableRow>
-            )
+            );
           })}
         </TableBody>
       </Table>
     </TableContainer>
-  )
-}
-
-// optionValue is a helper function to format the value of a specific deployment options
-export function optionValue(option: DeploymentOption) {
-  switch (option.name) {
-    case "Max Token Lifetime":
-    case "Session Duration":
-      // intervalToDuration takes ms, so convert nanoseconds to ms
-      return formatDuration(
-        intervalToDuration({ start: 0, end: (option.value as number) / 1e6 }),
-      )
-    case "Strict-Transport-Security":
-      if (option.value === 0) {
-        return "Disabled"
-      }
-      return (option.value as number).toString() + "s"
-    case "OIDC Group Mapping":
-      return Object.entries(option.value as Record<string, string>).map(
-        ([key, value]) => `"${key}"->"${value}"`,
-      )
-    default:
-      return option.value
-  }
-}
-
-const useStyles = makeStyles((theme) => ({
-  table: {
-    "& td": {
-      paddingTop: theme.spacing(3),
-      paddingBottom: theme.spacing(3),
-    },
-
-    "& td:last-child, & th:last-child": {
-      paddingLeft: theme.spacing(4),
-    },
-  },
-}))
+  );
+};
 
-export default OptionsTable
+export default OptionsTable;
diff --git a/site/src/components/DeploySettingsLayout/Sidebar.tsx b/site/src/components/DeploySettingsLayout/Sidebar.tsx
index e8b0445e4c296..1a5892d22421d 100644
--- a/site/src/components/DeploySettingsLayout/Sidebar.tsx
+++ b/site/src/components/DeploySettingsLayout/Sidebar.tsx
@@ -1,52 +1,91 @@
-import { makeStyles } from "@mui/styles"
-import Brush from "@mui/icons-material/Brush"
-import LaunchOutlined from "@mui/icons-material/LaunchOutlined"
-import ApprovalIcon from "@mui/icons-material/VerifiedUserOutlined"
-import LockRounded from "@mui/icons-material/LockOutlined"
-import Globe from "@mui/icons-material/PublicOutlined"
-import HubOutlinedIcon from "@mui/icons-material/HubOutlined"
-import VpnKeyOutlined from "@mui/icons-material/VpnKeyOutlined"
-import MonitorHeartOutlined from "@mui/icons-material/MonitorHeartOutlined"
-import { GitIcon } from "components/Icons/GitIcon"
-import { Stack } from "components/Stack/Stack"
-import { ElementType, PropsWithChildren, ReactNode, FC } from "react"
-import { NavLink } from "react-router-dom"
-import { combineClasses } from "utils/combineClasses"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
+import Brush from "@mui/icons-material/Brush";
+import LaunchOutlined from "@mui/icons-material/LaunchOutlined";
+import ApprovalIcon from "@mui/icons-material/VerifiedUserOutlined";
+import LockRounded from "@mui/icons-material/LockOutlined";
+import Globe from "@mui/icons-material/PublicOutlined";
+import HubOutlinedIcon from "@mui/icons-material/HubOutlined";
+import VpnKeyOutlined from "@mui/icons-material/VpnKeyOutlined";
+import MonitorHeartOutlined from "@mui/icons-material/MonitorHeartOutlined";
+import { GitIcon } from "components/Icons/GitIcon";
+import { Stack } from "components/Stack/Stack";
+import type { ElementType, FC, PropsWithChildren, ReactNode } from "react";
+import { NavLink } from "react-router-dom";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { useTheme } from "@mui/system";
+import { css } from "@emotion/css";
 
 const SidebarNavItem: FC<
   PropsWithChildren<{ href: string; icon: ReactNode }>
 > = ({ children, href, icon }) => {
-  const styles = useStyles()
+  const theme = useTheme();
+
+  const activeStyles = css`
+    background-color: ${theme.palette.action.hover};
+
+    &::before {
+      content: "";
+      display: block;
+      width: 3px;
+      height: 100%;
+      position: absolute;
+      left: 0;
+      top: 0;
+      background-color: ${theme.palette.secondary.dark};
+      border-top-left-radius: ${theme.shape.borderRadius};
+      border-bottom-left-radius: ${theme.shape.borderRadius};
+    }
+  `;
+
   return (
     <NavLink
       to={href}
-      className={({ isActive }) =>
-        combineClasses([
-          styles.sidebarNavItem,
-          isActive ? styles.sidebarNavItemActive : undefined,
-        ])
-      }
+      className={({ isActive }) => css`
+        ${isActive && activeStyles}
+
+        color: inherit;
+        display: block;
+        font-size: 14px;
+        text-decoration: none;
+        padding: ${theme.spacing(1.5, 1.5, 1.5, 2)};
+        border-radius: ${theme.shape.borderRadius / 2}px;
+        transition: background-color 0.15s ease-in-out;
+        margin-bottom: 1;
+        position: relative;
+
+        &:hover {
+          background-color: ${theme.palette.action.hover};
+        }
+      `}
     >
       <Stack alignItems="center" spacing={1.5} direction="row">
         {icon}
         {children}
       </Stack>
     </NavLink>
-  )
-}
+  );
+};
 
 const SidebarNavItemIcon: FC<{ icon: ElementType }> = ({ icon: Icon }) => {
-  const styles = useStyles()
-  return <Icon className={styles.sidebarNavItemIcon} />
-}
+  const theme = useTheme();
+  return (
+    <Icon
+      css={{
+        width: theme.spacing(2),
+        height: theme.spacing(2),
+      }}
+    />
+  );
+};
 
 export const Sidebar: React.FC = () => {
-  const styles = useStyles()
-  const dashboard = useDashboard()
+  const dashboard = useDashboard();
 
   return (
-    <nav className={styles.sidebar}>
+    <nav
+      css={{
+        width: 245,
+      }}
+    >
       <SidebarNavItem
         href="general"
         icon={<SidebarNavItemIcon icon={LaunchOutlined} />}
@@ -72,10 +111,10 @@ export const Sidebar: React.FC = () => {
         User Authentication
       </SidebarNavItem>
       <SidebarNavItem
-        href="gitauth"
+        href="external-auth"
         icon={<SidebarNavItemIcon icon={GitIcon} />}
       >
-        Git Authentication
+        External Authentication
       </SidebarNavItem>
       <SidebarNavItem href="network" icon={<SidebarNavItemIcon icon={Globe} />}>
         Network
@@ -103,49 +142,5 @@ export const Sidebar: React.FC = () => {
         </SidebarNavItem>
       )}
     </nav>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  sidebar: {
-    width: 245,
-  },
-
-  sidebarNavItem: {
-    color: "inherit",
-    display: "block",
-    fontSize: 14,
-    textDecoration: "none",
-    padding: theme.spacing(1.5, 1.5, 1.5, 2),
-    borderRadius: theme.shape.borderRadius / 2,
-    transition: "background-color 0.15s ease-in-out",
-    marginBottom: 1,
-    position: "relative",
-
-    "&:hover": {
-      backgroundColor: theme.palette.action.hover,
-    },
-  },
-
-  sidebarNavItemActive: {
-    backgroundColor: theme.palette.action.hover,
-
-    "&:before": {
-      content: '""',
-      display: "block",
-      width: 3,
-      height: "100%",
-      position: "absolute",
-      left: 0,
-      top: 0,
-      backgroundColor: theme.palette.secondary.dark,
-      borderTopLeftRadius: theme.shape.borderRadius,
-      borderBottomLeftRadius: theme.shape.borderRadius,
-    },
-  },
-
-  sidebarNavItemIcon: {
-    width: theme.spacing(2),
-    height: theme.spacing(2),
-  },
-}))
+  );
+};
diff --git a/site/src/components/DeploySettingsLayout/optionValue.test.ts b/site/src/components/DeploySettingsLayout/optionValue.test.ts
new file mode 100644
index 0000000000000..f9797b98f60d2
--- /dev/null
+++ b/site/src/components/DeploySettingsLayout/optionValue.test.ts
@@ -0,0 +1,113 @@
+import { optionValue } from "./optionValue";
+import { ClibaseOption } from "api/typesGenerated";
+
+const defaultOption: ClibaseOption = {
+  name: "",
+  description: "",
+  flag: "",
+  flag_shorthand: "",
+  value: "",
+  hidden: false,
+};
+
+describe("optionValue", () => {
+  it.each<{
+    option: ClibaseOption;
+    additionalValues?: string[];
+    expected: unknown;
+  }>([
+    {
+      option: {
+        ...defaultOption,
+        name: "Max Token Lifetime",
+        value: 3600 * 1e9,
+      },
+      expected: "1 hour",
+    },
+    {
+      option: {
+        ...defaultOption,
+        name: "Max Token Lifetime",
+        value: 24 * 3600 * 1e9,
+      },
+      expected: "1 day",
+    },
+    {
+      option: {
+        ...defaultOption,
+        name: "Session Duration",
+        value: 3600 * 1e9,
+      },
+      expected: "1 hour",
+    },
+    {
+      option: {
+        ...defaultOption,
+        name: "Session Duration",
+        value: 24 * 3600 * 1e9,
+      },
+      expected: "1 day",
+    },
+    {
+      option: {
+        ...defaultOption,
+        name: "Strict-Transport-Security",
+        value: 1000,
+      },
+      expected: "1000s",
+    },
+    {
+      option: {
+        ...defaultOption,
+        name: "OIDC Group Mapping",
+        value: {
+          "123": "foo",
+          "456": "bar",
+          "789": "baz",
+        },
+      },
+      expected: [`"123"->"foo"`, `"456"->"bar"`, `"789"->"baz"`],
+    },
+    {
+      option: {
+        ...defaultOption,
+        name: "Experiments",
+        value: ["single_tailnet"],
+      },
+      additionalValues: ["single_tailnet", "deployment_health_page"],
+      expected: { single_tailnet: true, deployment_health_page: false },
+    },
+    {
+      option: {
+        ...defaultOption,
+        name: "Experiments",
+        value: [],
+      },
+      additionalValues: ["single_tailnet", "deployment_health_page"],
+      expected: { single_tailnet: false, deployment_health_page: false },
+    },
+    {
+      option: {
+        ...defaultOption,
+        name: "Experiments",
+        value: ["moons"],
+      },
+      additionalValues: ["single_tailnet", "deployment_health_page"],
+      expected: { single_tailnet: false, deployment_health_page: false },
+    },
+    {
+      option: {
+        ...defaultOption,
+        name: "Experiments",
+        value: ["*"],
+      },
+      additionalValues: ["single_tailnet", "deployment_health_page"],
+      expected: { single_tailnet: true, deployment_health_page: true },
+    },
+  ])(
+    `[$option.name]optionValue($option.value)`,
+    ({ option, expected, additionalValues }) => {
+      expect(optionValue(option, additionalValues)).toEqual(expected);
+    },
+  );
+});
diff --git a/site/src/components/DeploySettingsLayout/optionValue.ts b/site/src/components/DeploySettingsLayout/optionValue.ts
new file mode 100644
index 0000000000000..6221356075fbb
--- /dev/null
+++ b/site/src/components/DeploySettingsLayout/optionValue.ts
@@ -0,0 +1,49 @@
+import { ClibaseOption } from "api/typesGenerated";
+import { intervalToDuration, formatDuration } from "date-fns";
+
+// optionValue is a helper function to format the value of a specific deployment options
+export function optionValue(
+  option: ClibaseOption,
+  additionalValues?: string[],
+) {
+  switch (option.name) {
+    case "Max Token Lifetime":
+    case "Session Duration":
+      // intervalToDuration takes ms, so convert nanoseconds to ms
+      return formatDuration(
+        intervalToDuration({ start: 0, end: (option.value as number) / 1e6 }),
+      );
+    case "Strict-Transport-Security":
+      if (option.value === 0) {
+        return "Disabled";
+      }
+      return (option.value as number).toString() + "s";
+    case "OIDC Group Mapping":
+      return Object.entries(option.value as Record<string, string>).map(
+        ([key, value]) => `"${key}"->"${value}"`,
+      );
+    case "Experiments": {
+      const experimentMap: Record<string, boolean> | undefined =
+        additionalValues?.reduce(
+          (acc, v) => {
+            return { ...acc, [v]: option.value.includes("*") ? true : false };
+          },
+          {} as Record<string, boolean>,
+        );
+
+      if (!experimentMap) {
+        break;
+      }
+
+      for (const v of option.value) {
+        if (Object.hasOwn(experimentMap, v)) {
+          experimentMap[v] = true;
+        }
+      }
+
+      return experimentMap;
+    }
+    default:
+      return option.value;
+  }
+}
diff --git a/site/src/components/DeploymentBanner/DeploymentBanner.tsx b/site/src/components/DeploymentBanner/DeploymentBanner.tsx
deleted file mode 100644
index d5cd1e25e5390..0000000000000
--- a/site/src/components/DeploymentBanner/DeploymentBanner.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-import { useMachine } from "@xstate/react"
-import { usePermissions } from "hooks/usePermissions"
-import { DeploymentBannerView } from "./DeploymentBannerView"
-import { deploymentStatsMachine } from "../../xServices/deploymentStats/deploymentStatsMachine"
-
-export const DeploymentBanner: React.FC = () => {
-  const permissions = usePermissions()
-  const [state, sendEvent] = useMachine(deploymentStatsMachine)
-
-  if (!permissions.viewDeploymentValues || !state.context.deploymentStats) {
-    return null
-  }
-
-  return (
-    <DeploymentBannerView
-      stats={state.context.deploymentStats}
-      fetchStats={() => sendEvent("RELOAD")}
-    />
-  )
-}
diff --git a/site/src/components/DeploymentBanner/DeploymentBannerView.stories.tsx b/site/src/components/DeploymentBanner/DeploymentBannerView.stories.tsx
deleted file mode 100644
index dd54d531a589b..0000000000000
--- a/site/src/components/DeploymentBanner/DeploymentBannerView.stories.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-import { Story } from "@storybook/react"
-import { MockDeploymentStats } from "testHelpers/entities"
-import {
-  DeploymentBannerView,
-  DeploymentBannerViewProps,
-} from "./DeploymentBannerView"
-
-export default {
-  title: "components/DeploymentBannerView",
-  component: DeploymentBannerView,
-}
-
-const Template: Story<DeploymentBannerViewProps> = (args) => (
-  <DeploymentBannerView {...args} />
-)
-
-export const Preview = Template.bind({})
-Preview.args = {
-  stats: MockDeploymentStats,
-}
diff --git a/site/src/components/DeploymentBanner/DeploymentBannerView.tsx b/site/src/components/DeploymentBanner/DeploymentBannerView.tsx
deleted file mode 100644
index edee6dc836491..0000000000000
--- a/site/src/components/DeploymentBanner/DeploymentBannerView.tsx
+++ /dev/null
@@ -1,331 +0,0 @@
-import { DeploymentStats, WorkspaceStatus } from "api/typesGenerated"
-import { FC, useMemo, useEffect, useState } from "react"
-import prettyBytes from "pretty-bytes"
-import BuildingIcon from "@mui/icons-material/Build"
-import { makeStyles } from "@mui/styles"
-import { RocketIcon } from "components/Icons/RocketIcon"
-import { MONOSPACE_FONT_FAMILY } from "theme/constants"
-import Tooltip from "@mui/material/Tooltip"
-import { Link as RouterLink } from "react-router-dom"
-import Link from "@mui/material/Link"
-import { VSCodeIcon } from "components/Icons/VSCodeIcon"
-import DownloadIcon from "@mui/icons-material/CloudDownload"
-import UploadIcon from "@mui/icons-material/CloudUpload"
-import LatencyIcon from "@mui/icons-material/SettingsEthernet"
-import WebTerminalIcon from "@mui/icons-material/WebAsset"
-import { TerminalIcon } from "components/Icons/TerminalIcon"
-import dayjs from "dayjs"
-import CollectedIcon from "@mui/icons-material/Compare"
-import RefreshIcon from "@mui/icons-material/Refresh"
-import Button from "@mui/material/Button"
-import { getDisplayWorkspaceStatus } from "utils/workspace"
-
-export const bannerHeight = 36
-
-export interface DeploymentBannerViewProps {
-  fetchStats?: () => void
-  stats?: DeploymentStats
-}
-
-export const DeploymentBannerView: FC<DeploymentBannerViewProps> = ({
-  stats,
-  fetchStats,
-}) => {
-  const styles = useStyles()
-  const aggregatedMinutes = useMemo(() => {
-    if (!stats) {
-      return
-    }
-    return dayjs(stats.collected_at).diff(stats.aggregated_from, "minutes")
-  }, [stats])
-  const displayLatency = stats?.workspaces.connection_latency_ms.P50 || -1
-  const [timeUntilRefresh, setTimeUntilRefresh] = useState(0)
-  useEffect(() => {
-    if (!stats || !fetchStats) {
-      return
-    }
-
-    let timeUntilRefresh = dayjs(stats.next_update_at).diff(
-      stats.collected_at,
-      "seconds",
-    )
-    setTimeUntilRefresh(timeUntilRefresh)
-    let canceled = false
-    const loop = () => {
-      if (canceled) {
-        return undefined
-      }
-      setTimeUntilRefresh(timeUntilRefresh--)
-      if (timeUntilRefresh > 0) {
-        return window.setTimeout(loop, 1000)
-      }
-      fetchStats()
-    }
-    const timeout = setTimeout(loop, 1000)
-    return () => {
-      canceled = true
-      clearTimeout(timeout)
-    }
-  }, [fetchStats, stats])
-  const lastAggregated = useMemo(() => {
-    if (!stats) {
-      return
-    }
-    if (!fetchStats) {
-      // Storybook!
-      return "just now"
-    }
-    return dayjs().to(dayjs(stats.collected_at))
-    // eslint-disable-next-line react-hooks/exhaustive-deps -- We want this to periodically update!
-  }, [timeUntilRefresh, stats])
-
-  return (
-    <div className={styles.container}>
-      <Tooltip title="Status of your Coder deployment. Only visible for admins!">
-        <div className={styles.rocket}>
-          <RocketIcon />
-        </div>
-      </Tooltip>
-      <div className={styles.group}>
-        <div className={styles.category}>Workspaces</div>
-        <div className={styles.values}>
-          <WorkspaceBuildValue
-            status="pending"
-            count={stats?.workspaces.pending}
-          />
-          <ValueSeparator />
-          <WorkspaceBuildValue
-            status="starting"
-            count={stats?.workspaces.building}
-          />
-          <ValueSeparator />
-          <WorkspaceBuildValue
-            status="running"
-            count={stats?.workspaces.running}
-          />
-          <ValueSeparator />
-          <WorkspaceBuildValue
-            status="stopped"
-            count={stats?.workspaces.stopped}
-          />
-          <ValueSeparator />
-          <WorkspaceBuildValue
-            status="failed"
-            count={stats?.workspaces.failed}
-          />
-        </div>
-      </div>
-      <div className={styles.group}>
-        <Tooltip title={`Activity in the last ~${aggregatedMinutes} minutes`}>
-          <div className={styles.category}>Transmission</div>
-        </Tooltip>
-
-        <div className={styles.values}>
-          <Tooltip title="Data sent to workspaces">
-            <div className={styles.value}>
-              <DownloadIcon />
-              {stats ? prettyBytes(stats.workspaces.rx_bytes) : "-"}
-            </div>
-          </Tooltip>
-          <ValueSeparator />
-          <Tooltip title="Data sent from workspaces">
-            <div className={styles.value}>
-              <UploadIcon />
-              {stats ? prettyBytes(stats.workspaces.tx_bytes) : "-"}
-            </div>
-          </Tooltip>
-          <ValueSeparator />
-          <Tooltip
-            title={
-              displayLatency < 0
-                ? "No recent workspace connections have been made"
-                : "The average latency of user connections to workspaces"
-            }
-          >
-            <div className={styles.value}>
-              <LatencyIcon />
-              {displayLatency > 0 ? displayLatency?.toFixed(2) + " ms" : "-"}
-            </div>
-          </Tooltip>
-        </div>
-      </div>
-      <div className={styles.group}>
-        <div className={styles.category}>Active Connections</div>
-
-        <div className={styles.values}>
-          <Tooltip title="VS Code Editors with the Coder Remote Extension">
-            <div className={styles.value}>
-              <VSCodeIcon className={styles.iconStripColor} />
-              {typeof stats?.session_count.vscode === "undefined"
-                ? "-"
-                : stats?.session_count.vscode}
-            </div>
-          </Tooltip>
-          <ValueSeparator />
-          <Tooltip title="SSH Sessions">
-            <div className={styles.value}>
-              <TerminalIcon />
-              {typeof stats?.session_count.ssh === "undefined"
-                ? "-"
-                : stats?.session_count.ssh}
-            </div>
-          </Tooltip>
-          <ValueSeparator />
-          <Tooltip title="Web Terminal Sessions">
-            <div className={styles.value}>
-              <WebTerminalIcon />
-              {typeof stats?.session_count.reconnecting_pty === "undefined"
-                ? "-"
-                : stats?.session_count.reconnecting_pty}
-            </div>
-          </Tooltip>
-        </div>
-      </div>
-      <div className={styles.refresh}>
-        <Tooltip title="The last time stats were aggregated. Workspaces report statistics periodically, so it may take a bit for these to update!">
-          <div className={styles.value}>
-            <CollectedIcon />
-            {lastAggregated}
-          </div>
-        </Tooltip>
-
-        <Tooltip title="A countdown until stats are fetched again. Click to refresh!">
-          <Button
-            className={`${styles.value} ${styles.refreshButton}`}
-            onClick={() => {
-              if (fetchStats) {
-                fetchStats()
-              }
-            }}
-            variant="text"
-          >
-            <RefreshIcon />
-            {timeUntilRefresh}s
-          </Button>
-        </Tooltip>
-      </div>
-    </div>
-  )
-}
-
-const ValueSeparator: FC = () => {
-  const styles = useStyles()
-  return <div className={styles.valueSeparator}>/</div>
-}
-
-const WorkspaceBuildValue: FC<{
-  status: WorkspaceStatus
-  count?: number
-}> = ({ status, count }) => {
-  const styles = useStyles()
-  const displayStatus = getDisplayWorkspaceStatus(status)
-  let statusText = displayStatus.text
-  let icon = displayStatus.icon
-  if (status === "starting") {
-    icon = <BuildingIcon />
-    statusText = "Building"
-  }
-
-  return (
-    <Tooltip title={`${statusText} Workspaces`}>
-      <Link
-        component={RouterLink}
-        to={`/workspaces?filter=${encodeURIComponent("status:" + status)}`}
-      >
-        <div className={styles.value}>
-          {icon}
-          {typeof count === "undefined" ? "-" : count}
-        </div>
-      </Link>
-    </Tooltip>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  rocket: {
-    display: "flex",
-    alignItems: "center",
-
-    "& svg": {
-      width: 16,
-      height: 16,
-    },
-
-    [theme.breakpoints.down("lg")]: {
-      display: "none",
-    },
-  },
-  container: {
-    position: "sticky",
-    height: bannerHeight,
-    bottom: 0,
-    zIndex: 1,
-    padding: theme.spacing(1, 2),
-    backgroundColor: theme.palette.background.paper,
-    display: "flex",
-    alignItems: "center",
-    fontFamily: MONOSPACE_FONT_FAMILY,
-    fontSize: 12,
-    gap: theme.spacing(4),
-    borderTop: `1px solid ${theme.palette.divider}`,
-
-    [theme.breakpoints.down("lg")]: {
-      flexDirection: "column",
-      gap: theme.spacing(1),
-      alignItems: "left",
-    },
-  },
-  group: {
-    display: "flex",
-    alignItems: "center",
-  },
-  category: {
-    marginRight: theme.spacing(2),
-    color: theme.palette.text.primary,
-  },
-  values: {
-    display: "flex",
-    gap: theme.spacing(1),
-    color: theme.palette.text.secondary,
-  },
-  valueSeparator: {
-    color: theme.palette.text.disabled,
-  },
-  value: {
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(0.5),
-
-    "& svg": {
-      width: 12,
-      height: 12,
-    },
-  },
-  iconStripColor: {
-    "& *": {
-      fill: "currentColor",
-    },
-  },
-  refresh: {
-    color: theme.palette.text.primary,
-    marginLeft: "auto",
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(2),
-  },
-  refreshButton: {
-    margin: 0,
-    padding: "0px 8px",
-    height: "unset",
-    minHeight: "unset",
-    fontSize: "unset",
-    color: "unset",
-    border: 0,
-    minWidth: "unset",
-    fontFamily: "inherit",
-
-    "& svg": {
-      marginRight: theme.spacing(0.5),
-    },
-  },
-}))
diff --git a/site/src/components/Dialogs/ConfirmDialog/ConfirmDialog.stories.tsx b/site/src/components/Dialogs/ConfirmDialog/ConfirmDialog.stories.tsx
index aa9b65a32d99e..3d8bb0b4876e5 100644
--- a/site/src/components/Dialogs/ConfirmDialog/ConfirmDialog.stories.tsx
+++ b/site/src/components/Dialogs/ConfirmDialog/ConfirmDialog.stories.tsx
@@ -1,58 +1,57 @@
-import { action } from "@storybook/addon-actions"
-import { ComponentMeta, Story } from "@storybook/react"
-import { ConfirmDialog, ConfirmDialogProps } from "./ConfirmDialog"
+import { action } from "@storybook/addon-actions";
+import type { Meta, StoryObj } from "@storybook/react";
+import { ConfirmDialog } from "./ConfirmDialog";
 
-export default {
-  title: "Components/Dialogs/ConfirmDialog",
+const meta: Meta<typeof ConfirmDialog> = {
+  title: "components/Dialogs/ConfirmDialog",
   component: ConfirmDialog,
-  argTypes: {
-    open: {
-      control: "boolean",
-    },
-  },
   args: {
     onClose: action("onClose"),
     onConfirm: action("onConfirm"),
     open: true,
     title: "Confirm Dialog",
   },
-} as ComponentMeta<typeof ConfirmDialog>
+};
 
-const Template: Story<ConfirmDialogProps> = (args) => (
-  <ConfirmDialog {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof ConfirmDialog>;
 
-export const DeleteDialog = Template.bind({})
-DeleteDialog.args = {
-  description: "Do you really want to delete me?",
-  hideCancel: false,
-  type: "delete",
-}
+export const Example: Story = {
+  args: {
+    description: "Do you really want to delete me?",
+    hideCancel: false,
+    type: "delete",
+  },
+};
 
-export const InfoDialog = Template.bind({})
-InfoDialog.args = {
-  description: "Information is cool!",
-  hideCancel: true,
-  type: "info",
-}
+export const InfoDialog: Story = {
+  args: {
+    description: "Information is cool!",
+    hideCancel: true,
+    type: "info",
+  },
+};
 
-export const InfoDialogWithCancel = Template.bind({})
-InfoDialogWithCancel.args = {
-  description: "Information can be cool!",
-  hideCancel: false,
-  type: "info",
-}
+export const InfoDialogWithCancel: Story = {
+  args: {
+    description: "Information can be cool!",
+    hideCancel: false,
+    type: "info",
+  },
+};
 
-export const SuccessDialog = Template.bind({})
-SuccessDialog.args = {
-  description: "I am successful.",
-  hideCancel: true,
-  type: "success",
-}
+export const SuccessDialog: Story = {
+  args: {
+    description: "I am successful.",
+    hideCancel: true,
+    type: "success",
+  },
+};
 
-export const SuccessDialogWithCancel = Template.bind({})
-SuccessDialogWithCancel.args = {
-  description: "I may be successful.",
-  hideCancel: false,
-  type: "success",
-}
+export const SuccessDialogWithCancel: Story = {
+  args: {
+    description: "I may be successful.",
+    hideCancel: false,
+    type: "success",
+  },
+};
diff --git a/site/src/components/Dialogs/ConfirmDialog/ConfirmDialog.test.tsx b/site/src/components/Dialogs/ConfirmDialog/ConfirmDialog.test.tsx
index 642029afdfb8c..2390ad3aee93d 100644
--- a/site/src/components/Dialogs/ConfirmDialog/ConfirmDialog.test.tsx
+++ b/site/src/components/Dialogs/ConfirmDialog/ConfirmDialog.test.tsx
@@ -1,119 +1,31 @@
-import { fireEvent, screen } from "@testing-library/react"
-import { ConfirmDialog, ConfirmDialogProps } from "./ConfirmDialog"
-import { render } from "testHelpers/renderHelpers"
+import { fireEvent, screen } from "@testing-library/react";
+import { ConfirmDialog } from "./ConfirmDialog";
+import { renderComponent } from "testHelpers/renderHelpers";
 
 describe("ConfirmDialog", () => {
-  it("renders", () => {
-    // Given
-    const onCloseMock = jest.fn()
-    const props = {
-      onClose: onCloseMock,
-      open: true,
-      title: "Test",
-    }
-
-    // When
-    render(<ConfirmDialog {...props} />)
-
-    // Then
-    expect(screen.getByRole("dialog")).toBeDefined()
-  })
-
-  it("does not display cancel for info dialogs", () => {
-    // Given (note that info is the default)
-    const onCloseMock = jest.fn()
-    const props = {
-      cancelText: "CANCEL",
-      onClose: onCloseMock,
-      open: true,
-      title: "Test",
-    }
-
-    // When
-    render(<ConfirmDialog {...props} />)
-
-    // Then
-    expect(screen.queryByText("CANCEL")).toBeNull()
-  })
-
-  it("can display cancel when normally hidden", () => {
-    // Given
-    const onCloseMock = jest.fn()
-    const props = {
-      cancelText: "CANCEL",
-      onClose: onCloseMock,
-      open: true,
-      title: "Test",
-      hideCancel: false,
-    }
-
-    // When
-    render(<ConfirmDialog {...props} />)
-
-    // Then
-    expect(screen.getByText("CANCEL")).toBeDefined()
-  })
-
-  it("displays cancel for delete dialogs", () => {
-    // Given
-    const onCloseMock = jest.fn()
-    const props: ConfirmDialogProps = {
-      cancelText: "CANCEL",
-      onClose: onCloseMock,
-      open: true,
-      title: "Test",
-      type: "delete",
-    }
-
-    // When
-    render(<ConfirmDialog {...props} />)
-
-    // Then
-    expect(screen.getByText("CANCEL")).toBeDefined()
-  })
-
-  it("can hide cancel when normally visible", () => {
-    // Given
-    const onCloseMock = jest.fn()
-    const props: ConfirmDialogProps = {
-      cancelText: "CANCEL",
-      onClose: onCloseMock,
-      open: true,
-      title: "Test",
-      hideCancel: true,
-      type: "delete",
-    }
-
-    // When
-    render(<ConfirmDialog {...props} />)
-
-    // Then
-    expect(screen.queryByText("CANCEL")).toBeNull()
-  })
-
   it("onClose is called when cancelled", () => {
     // Given
-    const onCloseMock = jest.fn()
+    const onCloseMock = jest.fn();
     const props = {
       cancelText: "CANCEL",
       hideCancel: false,
       onClose: onCloseMock,
       open: true,
       title: "Test",
-    }
+    };
 
     // When
-    render(<ConfirmDialog {...props} />)
-    fireEvent.click(screen.getByText("CANCEL"))
+    renderComponent(<ConfirmDialog {...props} />);
+    fireEvent.click(screen.getByText("CANCEL"));
 
     // Then
-    expect(onCloseMock).toBeCalledTimes(1)
-  })
+    expect(onCloseMock).toBeCalledTimes(1);
+  });
 
   it("onConfirm is called when confirmed", () => {
     // Given
-    const onCloseMock = jest.fn()
-    const onConfirmMock = jest.fn()
+    const onCloseMock = jest.fn();
+    const onConfirmMock = jest.fn();
     const props = {
       cancelText: "CANCEL",
       confirmText: "CONFIRM",
@@ -122,14 +34,14 @@ describe("ConfirmDialog", () => {
       onConfirm: onConfirmMock,
       open: true,
       title: "Test",
-    }
+    };
 
     // When
-    render(<ConfirmDialog {...props} />)
-    fireEvent.click(screen.getByText("CONFIRM"))
+    renderComponent(<ConfirmDialog {...props} />);
+    fireEvent.click(screen.getByText("CONFIRM"));
 
     // Then
-    expect(onCloseMock).toBeCalledTimes(0)
-    expect(onConfirmMock).toBeCalledTimes(1)
-  })
-})
+    expect(onCloseMock).toBeCalledTimes(0);
+    expect(onConfirmMock).toBeCalledTimes(1);
+  });
+});
diff --git a/site/src/components/Dialogs/ConfirmDialog/ConfirmDialog.tsx b/site/src/components/Dialogs/ConfirmDialog/ConfirmDialog.tsx
index 5d77d34b28906..50f0c248509d6 100644
--- a/site/src/components/Dialogs/ConfirmDialog/ConfirmDialog.tsx
+++ b/site/src/components/Dialogs/ConfirmDialog/ConfirmDialog.tsx
@@ -1,16 +1,16 @@
-import DialogActions from "@mui/material/DialogActions"
-import { makeStyles } from "@mui/styles"
-import { ReactNode, FC, PropsWithChildren } from "react"
+import DialogActions from "@mui/material/DialogActions";
+import { type Interpolation, type Theme } from "@emotion/react";
+import { type FC, type PropsWithChildren, type ReactNode } from "react";
 import {
   Dialog,
   DialogActionButtons,
   DialogActionButtonsProps,
-} from "../Dialog"
-import { ConfirmDialogType } from "../types"
+} from "../Dialog";
+import type { ConfirmDialogType } from "../types";
 
 interface ConfirmDialogTypeConfig {
-  confirmText: ReactNode
-  hideCancel: boolean
+  confirmText: ReactNode;
+  hideCancel: boolean;
 }
 
 const CONFIRM_DIALOG_DEFAULTS: Record<
@@ -29,34 +29,34 @@ const CONFIRM_DIALOG_DEFAULTS: Record<
     confirmText: "OK",
     hideCancel: true,
   },
-}
+};
 
 export interface ConfirmDialogProps
   extends Omit<
     DialogActionButtonsProps,
     "color" | "confirmDialog" | "onCancel"
   > {
-  readonly description?: ReactNode
+  readonly description?: ReactNode;
   /**
    * hideCancel hides the cancel button when set true, and shows the cancel
    * button when set to false. When undefined:
    *   - cancel is not displayed for "info" dialogs
    *   - cancel is displayed for "delete" dialogs
    */
-  readonly hideCancel?: boolean
+  readonly hideCancel?: boolean;
   /**
    * onClose is called when canceling (if cancel is showing).
    *
    * Additionally, if onConfirm is not defined onClose will be used in its place
    * when confirming.
    */
-  readonly onClose: () => void
-  readonly open: boolean
-  readonly title: string
+  readonly onClose: () => void;
+  readonly open: boolean;
+  readonly title: string;
 }
 
-const useStyles = makeStyles((theme) => ({
-  dialogWrapper: {
+const styles = {
+  dialogWrapper: (theme) => ({
     "& .MuiPaper-root": {
       background: theme.palette.background.paper,
       border: `1px solid ${theme.palette.divider}`,
@@ -66,19 +66,19 @@ const useStyles = makeStyles((theme) => ({
     "& .MuiDialogActions-spacing": {
       padding: `0 ${theme.spacing(5)} ${theme.spacing(5)}`,
     },
-  },
-  dialogContent: {
+  }),
+  dialogContent: (theme) => ({
     color: theme.palette.text.secondary,
     padding: theme.spacing(5),
-  },
-  dialogTitle: {
+  }),
+  dialogTitle: (theme) => ({
     margin: 0,
     marginBottom: theme.spacing(2),
     color: theme.palette.text.primary,
     fontWeight: 400,
     fontSize: theme.spacing(2.5),
-  },
-  dialogDescription: {
+  }),
+  dialogDescription: (theme) => ({
     color: theme.palette.text.secondary,
     lineHeight: "160%",
     fontSize: 16,
@@ -94,8 +94,8 @@ const useStyles = makeStyles((theme) => ({
     "& > p": {
       margin: theme.spacing(1, 0),
     },
-  },
-}))
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
 
 /**
  * Quick-use version of the Dialog component with slightly alternative styles,
@@ -114,26 +114,22 @@ export const ConfirmDialog: FC<PropsWithChildren<ConfirmDialogProps>> = ({
   title,
   type = "info",
 }) => {
-  const styles = useStyles({ type })
-
-  const defaults = CONFIRM_DIALOG_DEFAULTS[type]
+  const defaults = CONFIRM_DIALOG_DEFAULTS[type];
 
   if (typeof hideCancel === "undefined") {
-    hideCancel = defaults.hideCancel
+    hideCancel = defaults.hideCancel;
   }
 
   return (
     <Dialog
-      className={styles.dialogWrapper}
+      css={styles.dialogWrapper}
       onClose={onClose}
       open={open}
       data-testid="dialog"
     >
-      <div className={styles.dialogContent}>
-        <h3 className={styles.dialogTitle}>{title}</h3>
-        {description && (
-          <div className={styles.dialogDescription}>{description}</div>
-        )}
+      <div css={styles.dialogContent}>
+        <h3 css={styles.dialogTitle}>{title}</h3>
+        {description && <div css={styles.dialogDescription}>{description}</div>}
       </div>
 
       <DialogActions>
@@ -149,5 +145,5 @@ export const ConfirmDialog: FC<PropsWithChildren<ConfirmDialogProps>> = ({
         />
       </DialogActions>
     </Dialog>
-  )
-}
+  );
+};
diff --git a/site/src/components/Dialogs/DeleteDialog/DeleteDialog.stories.tsx b/site/src/components/Dialogs/DeleteDialog/DeleteDialog.stories.tsx
index 810204222da5c..92a0472fa194b 100644
--- a/site/src/components/Dialogs/DeleteDialog/DeleteDialog.stories.tsx
+++ b/site/src/components/Dialogs/DeleteDialog/DeleteDialog.stories.tsx
@@ -1,28 +1,23 @@
-import { action } from "@storybook/addon-actions"
-import { ComponentMeta, Story } from "@storybook/react"
-import { DeleteDialog, DeleteDialogProps } from "./DeleteDialog"
+import { action } from "@storybook/addon-actions";
+import type { Meta, StoryObj } from "@storybook/react";
+import { DeleteDialog } from "./DeleteDialog";
 
-export default {
-  title: "Components/Dialogs/DeleteDialog",
+const meta: Meta<typeof DeleteDialog> = {
+  title: "components/Dialogs/DeleteDialog",
   component: DeleteDialog,
-  argTypes: {
-    open: {
-      control: "boolean",
-    },
-  },
   args: {
     onCancel: action("onClose"),
     onConfirm: action("onConfirm"),
-    open: true,
+    isOpen: true,
     entity: "foo",
     name: "MyFoo",
     info: "Here's some info about the foo so you know you're deleting the right one.",
   },
-} as ComponentMeta<typeof DeleteDialog>
+};
+
+export default meta;
+type Story = StoryObj<typeof DeleteDialog>;
 
-const Template: Story<DeleteDialogProps> = (args) => <DeleteDialog {...args} />
+const Example: Story = {};
 
-export const Example = Template.bind({})
-Example.args = {
-  isOpen: true,
-}
+export { Example as DeleteDialog };
diff --git a/site/src/components/Dialogs/DeleteDialog/DeleteDialog.test.tsx b/site/src/components/Dialogs/DeleteDialog/DeleteDialog.test.tsx
index 20a55275d05e1..10f8f9d89e805 100644
--- a/site/src/components/Dialogs/DeleteDialog/DeleteDialog.test.tsx
+++ b/site/src/components/Dialogs/DeleteDialog/DeleteDialog.test.tsx
@@ -1,12 +1,28 @@
-import { screen } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
-import i18next from "i18next"
-import { render } from "testHelpers/renderHelpers"
-import { DeleteDialog } from "./DeleteDialog"
+import { screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { renderComponent } from "testHelpers/renderHelpers";
+import { DeleteDialog } from "./DeleteDialog";
+import { act } from "react-dom/test-utils";
+
+const inputTestId = "delete-dialog-name-confirmation";
+
+async function fillInputField(inputElement: HTMLElement, text: string) {
+  // 2023-10-06 - There's something wonky with MUI's ConfirmDialog that causes
+  // its state to update after a typing event gets  fired, and React Testing
+  // Library isn't able to catch it, making React DOM freak out because an
+  // "unexpected" state change happened. It won't fail the test, but it makes
+  // the console look really scary because it'll spit out a big warning message.
+  // Tried everything under the sun to catch the state changes the proper way,
+  // but the only way to get around it for now might be to manually make React
+  // DOM aware of the changes
+
+  // eslint-disable-next-line testing-library/no-unnecessary-act -- have to make sure state updates don't slip through cracks
+  return act(() => userEvent.type(inputElement, text));
+}
 
 describe("DeleteDialog", () => {
   it("disables confirm button when the text field is empty", () => {
-    render(
+    renderComponent(
       <DeleteDialog
         isOpen
         onConfirm={jest.fn()}
@@ -14,14 +30,14 @@ describe("DeleteDialog", () => {
         entity="template"
         name="MyTemplate"
       />,
-    )
-    const confirmButton = screen.getByRole("button", { name: "Delete" })
-    expect(confirmButton).toBeDisabled()
-  })
+    );
+
+    const confirmButton = screen.getByRole("button", { name: "Delete" });
+    expect(confirmButton).toBeDisabled();
+  });
 
   it("disables confirm button when the text field is filled incorrectly", async () => {
-    const { t } = i18next
-    render(
+    renderComponent(
       <DeleteDialog
         isOpen
         onConfirm={jest.fn()}
@@ -29,20 +45,17 @@ describe("DeleteDialog", () => {
         entity="template"
         name="MyTemplate"
       />,
-    )
-    const labelText = t("deleteDialog.confirmLabel", {
-      ns: "common",
-      entity: "template",
-    })
-    const textField = screen.getByLabelText(labelText)
-    await userEvent.type(textField, "MyTemplateWrong")
-    const confirmButton = screen.getByRole("button", { name: "Delete" })
-    expect(confirmButton).toBeDisabled()
-  })
+    );
+
+    const textField = screen.getByTestId(inputTestId);
+    await fillInputField(textField, "MyTemplateButWrong");
+
+    const confirmButton = screen.getByRole("button", { name: "Delete" });
+    expect(confirmButton).toBeDisabled();
+  });
 
   it("enables confirm button when the text field is filled correctly", async () => {
-    const { t } = i18next
-    render(
+    renderComponent(
       <DeleteDialog
         isOpen
         onConfirm={jest.fn()}
@@ -50,14 +63,12 @@ describe("DeleteDialog", () => {
         entity="template"
         name="MyTemplate"
       />,
-    )
-    const labelText = t("deleteDialog.confirmLabel", {
-      ns: "common",
-      entity: "template",
-    })
-    const textField = screen.getByLabelText(labelText)
-    await userEvent.type(textField, "MyTemplate")
-    const confirmButton = screen.getByRole("button", { name: "Delete" })
-    expect(confirmButton).not.toBeDisabled()
-  })
-})
+    );
+
+    const textField = screen.getByTestId(inputTestId);
+    await fillInputField(textField, "MyTemplate");
+
+    const confirmButton = screen.getByRole("button", { name: "Delete" });
+    expect(confirmButton).not.toBeDisabled();
+  });
+});
diff --git a/site/src/components/Dialogs/DeleteDialog/DeleteDialog.tsx b/site/src/components/Dialogs/DeleteDialog/DeleteDialog.tsx
index 0a56fe65b25c6..ab1134bb6a397 100644
--- a/site/src/components/Dialogs/DeleteDialog/DeleteDialog.tsx
+++ b/site/src/components/Dialogs/DeleteDialog/DeleteDialog.tsx
@@ -1,18 +1,23 @@
-import makeStyles from "@mui/styles/makeStyles"
-import TextField from "@mui/material/TextField"
-import { Maybe } from "components/Conditionals/Maybe"
-import { ChangeEvent, useState, PropsWithChildren, FC } from "react"
-import { useTranslation } from "react-i18next"
-import { ConfirmDialog } from "../ConfirmDialog/ConfirmDialog"
+import {
+  type FC,
+  type FormEvent,
+  type PropsWithChildren,
+  useId,
+  useState,
+} from "react";
+
+import { useTheme } from "@emotion/react";
+import TextField from "@mui/material/TextField";
+import { ConfirmDialog } from "../ConfirmDialog/ConfirmDialog";
 
 export interface DeleteDialogProps {
-  isOpen: boolean
-  onConfirm: () => void
-  onCancel: () => void
-  entity: string
-  name: string
-  info?: string
-  confirmLoading?: boolean
+  isOpen: boolean;
+  onConfirm: () => void;
+  onCancel: () => void;
+  entity: string;
+  name: string;
+  info?: string;
+  confirmLoading?: boolean;
 }
 
 export const DeleteDialog: FC<PropsWithChildren<DeleteDialogProps>> = ({
@@ -24,70 +29,76 @@ export const DeleteDialog: FC<PropsWithChildren<DeleteDialogProps>> = ({
   name,
   confirmLoading,
 }) => {
-  const styles = useStyles()
-  const { t } = useTranslation("common")
-  const [nameValue, setNameValue] = useState("")
-  const confirmed = name === nameValue
-  const handleChange = (event: ChangeEvent<HTMLInputElement>) => {
-    setNameValue(event.target.value)
-  }
-  const hasError = nameValue.length > 0 && !confirmed
+  const hookId = useId();
+  const theme = useTheme();
+
+  const [userConfirmationText, setUserConfirmationText] = useState("");
+  const [isFocused, setIsFocused] = useState(false);
 
-  const content = (
-    <>
-      <p>{t("deleteDialog.intro", { entity })}</p>
-      <Maybe condition={info !== undefined}>
-        <p className={styles.warning}>{info}</p>
-      </Maybe>
-      <p>{t("deleteDialog.confirm", { entity })}</p>
+  const deletionConfirmed = name === userConfirmationText;
+  const onSubmit = (event: FormEvent) => {
+    event.preventDefault();
+    if (deletionConfirmed) {
+      onConfirm();
+    }
+  };
 
-      <form
-        onSubmit={(e) => {
-          e.preventDefault()
-          if (confirmed) {
-            onConfirm()
-          }
-        }}
-      >
-        <TextField
-          fullWidth
-          autoFocus
-          className={styles.textField}
-          name="confirmation"
-          autoComplete="off"
-          id="confirmation"
-          placeholder={name}
-          value={nameValue}
-          onChange={handleChange}
-          label={t("deleteDialog.confirmLabel", { entity })}
-          error={hasError}
-          helperText={hasError && t("deleteDialog.incorrectName", { entity })}
-        />
-      </form>
-    </>
-  )
+  const hasError = !deletionConfirmed && userConfirmationText.length > 0;
+  const displayErrorMessage = hasError && !isFocused;
+  const inputColor = hasError ? "error" : "primary";
 
   return (
     <ConfirmDialog
       type="delete"
       hideCancel={false}
       open={isOpen}
-      title={t("deleteDialog.title", { entity })}
+      title={`Delete ${entity}`}
       onConfirm={onConfirm}
       onClose={onCancel}
-      description={content}
       confirmLoading={confirmLoading}
-      disabled={!confirmed}
-    />
-  )
-}
+      disabled={!deletionConfirmed}
+      description={
+        <>
+          <p>Deleting this {entity} is irreversible!</p>
 
-const useStyles = makeStyles((theme) => ({
-  warning: {
-    color: theme.palette.warning.light,
-  },
+          {Boolean(info) && (
+            <p css={{ color: theme.palette.warning.light }}>{info}</p>
+          )}
 
-  textField: {
-    marginTop: theme.spacing(3),
-  },
-}))
+          <p>Are you sure you want to proceed?</p>
+
+          <p>
+            Type &ldquo;<strong>{name}</strong>&rdquo; below to confirm.
+          </p>
+
+          <form onSubmit={onSubmit}>
+            <TextField
+              fullWidth
+              autoFocus
+              sx={{ marginTop: theme.spacing(3) }}
+              name="confirmation"
+              autoComplete="off"
+              id={`${hookId}-confirm`}
+              placeholder={name}
+              value={userConfirmationText}
+              onChange={(event) => setUserConfirmationText(event.target.value)}
+              onFocus={() => setIsFocused(true)}
+              onBlur={() => setIsFocused(false)}
+              label={`Name of the ${entity} to delete`}
+              color={inputColor}
+              error={displayErrorMessage}
+              helperText={
+                displayErrorMessage &&
+                `${userConfirmationText} does not match the name of this ${entity}`
+              }
+              InputProps={{ color: inputColor }}
+              inputProps={{
+                "data-testid": "delete-dialog-name-confirmation",
+              }}
+            />
+          </form>
+        </>
+      }
+    />
+  );
+};
diff --git a/site/src/components/Dialogs/Dialog.tsx b/site/src/components/Dialogs/Dialog.tsx
index cf7538079267d..eba3df2903350 100644
--- a/site/src/components/Dialogs/Dialog.tsx
+++ b/site/src/components/Dialogs/Dialog.tsx
@@ -1,38 +1,34 @@
-import MuiDialog, { DialogProps as MuiDialogProps } from "@mui/material/Dialog"
-import { makeStyles } from "@mui/styles"
-import * as React from "react"
-import { colors } from "theme/colors"
-import { combineClasses } from "../../utils/combineClasses"
-import {
-  LoadingButton,
-  LoadingButtonProps,
-} from "../LoadingButton/LoadingButton"
-import { ConfirmDialogType } from "./types"
+import MuiDialog, { DialogProps as MuiDialogProps } from "@mui/material/Dialog";
+import { type ReactNode } from "react";
+import { colors } from "theme/colors";
+import { ConfirmDialogType } from "./types";
+import { type Interpolation, type Theme } from "@emotion/react";
+import LoadingButton, { LoadingButtonProps } from "@mui/lab/LoadingButton";
 
 export interface DialogActionButtonsProps {
   /** Text to display in the cancel button */
-  cancelText?: string
+  cancelText?: string;
   /** Text to display in the confirm button */
-  confirmText?: React.ReactNode
+  confirmText?: ReactNode;
   /** Whether or not confirm is loading, also disables cancel when true */
-  confirmLoading?: boolean
+  confirmLoading?: boolean;
   /** Whether or not this is a confirm dialog */
-  confirmDialog?: boolean
+  confirmDialog?: boolean;
   /** Whether or not the submit button is disabled */
-  disabled?: boolean
+  disabled?: boolean;
   /** Called when cancel is clicked */
-  onCancel?: () => void
+  onCancel?: () => void;
   /** Called when confirm is clicked */
-  onConfirm?: () => void
-  type?: ConfirmDialogType
+  onConfirm?: () => void;
+  type?: ConfirmDialogType;
 }
 
 const typeToColor = (type: ConfirmDialogType): LoadingButtonProps["color"] => {
   if (type === "delete") {
-    return "secondary"
+    return "secondary";
   }
-  return "primary"
-}
+  return "primary";
+};
 
 /**
  * Quickly handles most modals actions, some combination of a cancel and confirm button
@@ -46,8 +42,6 @@ export const DialogActionButtons: React.FC<DialogActionButtonsProps> = ({
   onConfirm,
   type = "info",
 }) => {
-  const styles = useButtonStyles({ type })
-
   return (
     <>
       {onCancel && (
@@ -65,20 +59,20 @@ export const DialogActionButtons: React.FC<DialogActionButtonsProps> = ({
           loading={confirmLoading}
           disabled={disabled}
           type="submit"
-          className={combineClasses({
-            [styles.errorButton]: type === "delete",
-            [styles.successButton]: type === "success",
-          })}
+          css={[
+            type === "delete" && styles.errorButton,
+            type === "success" && styles.successButton,
+          ]}
         >
           {confirmText}
         </LoadingButton>
       )}
     </>
-  )
-}
+  );
+};
 
-const useButtonStyles = makeStyles((theme) => ({
-  errorButton: {
+const styles = {
+  errorButton: (theme) => ({
     "&.MuiButton-contained": {
       backgroundColor: colors.red[10],
       borderColor: colors.red[9],
@@ -95,8 +89,8 @@ const useButtonStyles = makeStyles((theme) => ({
         color: colors.red[9],
       },
     },
-  },
-  successButton: {
+  }),
+  successButton: (theme) => ({
     "&.MuiButton-contained": {
       backgroundColor: theme.palette.success.main,
       color: theme.palette.primary.contrastText,
@@ -145,10 +139,10 @@ const useButtonStyles = makeStyles((theme) => ({
         color: theme.palette.text.secondary,
       },
     },
-  },
-}))
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
 
-export type DialogProps = MuiDialogProps
+export type DialogProps = MuiDialogProps;
 
 /**
  * Wrapper around Material UI's Dialog component. Conveniently exports all of
@@ -159,5 +153,5 @@ export type DialogProps = MuiDialogProps
  */
 export const Dialog: React.FC<DialogProps> = (props) => {
   // Wrapped so we can add custom attributes below
-  return <MuiDialog {...props} />
-}
+  return <MuiDialog {...props} />;
+};
diff --git a/site/src/components/Dialogs/ResetPasswordDialog/ResetPasswordDialog.stories.tsx b/site/src/components/Dialogs/ResetPasswordDialog/ResetPasswordDialog.stories.tsx
deleted file mode 100644
index 66d123bbfb9cc..0000000000000
--- a/site/src/components/Dialogs/ResetPasswordDialog/ResetPasswordDialog.stories.tsx
+++ /dev/null
@@ -1,28 +0,0 @@
-import { action } from "@storybook/addon-actions"
-import { Story } from "@storybook/react"
-import { MockUser } from "testHelpers/entities"
-
-import {
-  ResetPasswordDialog,
-  ResetPasswordDialogProps,
-} from "./ResetPasswordDialog"
-
-export default {
-  title: "components/Dialogs/ResetPasswordDialog",
-  component: ResetPasswordDialog,
-  argTypes: {
-    onClose: { action: "onClose", defaultValue: action("onClose") },
-    onConfirm: { action: "onConfirm", defaultValue: action("onConfirm") },
-  },
-}
-
-const Template: Story<ResetPasswordDialogProps> = (
-  args: ResetPasswordDialogProps,
-) => <ResetPasswordDialog {...args} />
-
-export const Example = Template.bind({})
-Example.args = {
-  open: true,
-  user: MockUser,
-  newPassword: "somerandomstringhere",
-}
diff --git a/site/src/components/Dialogs/ResetPasswordDialog/ResetPasswordDialog.tsx b/site/src/components/Dialogs/ResetPasswordDialog/ResetPasswordDialog.tsx
deleted file mode 100644
index 4c813b38137fd..0000000000000
--- a/site/src/components/Dialogs/ResetPasswordDialog/ResetPasswordDialog.tsx
+++ /dev/null
@@ -1,60 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import { FC } from "react"
-import * as TypesGen from "../../../api/typesGenerated"
-import { CodeExample } from "../../CodeExample/CodeExample"
-import { ConfirmDialog } from "../ConfirmDialog/ConfirmDialog"
-
-export interface ResetPasswordDialogProps {
-  open: boolean
-  onClose: () => void
-  onConfirm: () => void
-  user?: TypesGen.User
-  newPassword?: string
-  loading: boolean
-}
-
-export const Language = {
-  title: "Reset password",
-  message: (username?: string): JSX.Element => (
-    <>
-      You will need to send <strong>{username}</strong> the following password:
-    </>
-  ),
-  confirmText: "Reset password",
-}
-
-export const ResetPasswordDialog: FC<
-  React.PropsWithChildren<ResetPasswordDialogProps>
-> = ({ open, onClose, onConfirm, user, newPassword, loading }) => {
-  const styles = useStyles()
-
-  const description = (
-    <>
-      <p>{Language.message(user?.username)}</p>
-      <CodeExample code={newPassword ?? ""} className={styles.codeExample} />
-    </>
-  )
-
-  return (
-    <ConfirmDialog
-      type="info"
-      hideCancel={false}
-      open={open}
-      onConfirm={onConfirm}
-      onClose={onClose}
-      title={Language.title}
-      confirmLoading={loading}
-      confirmText={Language.confirmText}
-      description={description}
-    />
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  codeExample: {
-    minHeight: "auto",
-    userSelect: "all",
-    width: "100%",
-    marginTop: theme.spacing(3),
-  },
-}))
diff --git a/site/src/components/Dialogs/types.ts b/site/src/components/Dialogs/types.ts
index a2909db8258e5..4e3444811f2ba 100644
--- a/site/src/components/Dialogs/types.ts
+++ b/site/src/components/Dialogs/types.ts
@@ -1 +1 @@
-export type ConfirmDialogType = "delete" | "info" | "success"
+export type ConfirmDialogType = "delete" | "info" | "success";
diff --git a/site/src/components/DropdownArrow/DropdownArrow.tsx b/site/src/components/DropdownArrow/DropdownArrow.tsx
new file mode 100644
index 0000000000000..1e769692ccc24
--- /dev/null
+++ b/site/src/components/DropdownArrow/DropdownArrow.tsx
@@ -0,0 +1,28 @@
+import KeyboardArrowDown from "@mui/icons-material/KeyboardArrowDown";
+import KeyboardArrowUp from "@mui/icons-material/KeyboardArrowUp";
+import { type FC } from "react";
+import { type Theme } from "@emotion/react";
+
+interface ArrowProps {
+  margin?: boolean;
+  color?: string;
+  close?: boolean;
+}
+
+export const DropdownArrow: FC<ArrowProps> = (props) => {
+  const { margin = true, color, close } = props;
+
+  const Arrow = close ? KeyboardArrowUp : KeyboardArrowDown;
+
+  return (
+    <Arrow
+      aria-label={close ? "close-dropdown" : "open-dropdown"}
+      css={(theme: Theme) => ({
+        color: color ?? theme.palette.primary.contrastText,
+        marginLeft: margin ? theme.spacing(1) : 0,
+        width: 16,
+        height: 16,
+      })}
+    />
+  );
+};
diff --git a/site/src/components/DropdownArrows/DropdownArrows.tsx b/site/src/components/DropdownArrows/DropdownArrows.tsx
deleted file mode 100644
index 6a26758018a30..0000000000000
--- a/site/src/components/DropdownArrows/DropdownArrows.tsx
+++ /dev/null
@@ -1,42 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import KeyboardArrowDown from "@mui/icons-material/KeyboardArrowDown"
-import KeyboardArrowUp from "@mui/icons-material/KeyboardArrowUp"
-import { FC } from "react"
-import { Theme } from "@mui/material/styles"
-
-const useStyles = makeStyles<Theme, ArrowProps>((theme: Theme) => ({
-  arrowIcon: {
-    color: ({ color }) => color ?? theme.palette.primary.contrastText,
-    marginLeft: ({ margin }) => (margin ? theme.spacing(1) : 0),
-    width: 16,
-    height: 16,
-  },
-  arrowIconUp: {
-    color: ({ color }) => color ?? theme.palette.primary.contrastText,
-  },
-}))
-
-interface ArrowProps {
-  margin?: boolean
-  color?: string
-}
-
-export const OpenDropdown: FC<ArrowProps> = ({ margin = true, color }) => {
-  const styles = useStyles({ margin, color })
-  return (
-    <KeyboardArrowDown
-      aria-label="open-dropdown"
-      className={styles.arrowIcon}
-    />
-  )
-}
-
-export const CloseDropdown: FC<ArrowProps> = ({ margin = true, color }) => {
-  const styles = useStyles({ margin, color })
-  return (
-    <KeyboardArrowUp
-      aria-label="close-dropdown"
-      className={`${styles.arrowIcon} ${styles.arrowIconUp}`}
-    />
-  )
-}
diff --git a/site/src/components/EditRolesButton/EditRolesButton.stories.tsx b/site/src/components/EditRolesButton/EditRolesButton.stories.tsx
deleted file mode 100644
index 66b58f0741300..0000000000000
--- a/site/src/components/EditRolesButton/EditRolesButton.stories.tsx
+++ /dev/null
@@ -1,42 +0,0 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import {
-  MockOwnerRole,
-  MockSiteRoles,
-  MockUserAdminRole,
-} from "testHelpers/entities"
-import { EditRolesButtonProps, EditRolesButton } from "./EditRolesButton"
-
-export default {
-  title: "components/EditRolesButton",
-  component: EditRolesButton,
-  argTypes: {
-    defaultIsOpen: {
-      defaultValue: true,
-    },
-  },
-} as ComponentMeta<typeof EditRolesButton>
-
-const Template: Story<EditRolesButtonProps> = (args) => (
-  <EditRolesButton {...args} />
-)
-
-export const Open = Template.bind({})
-Open.args = {
-  roles: MockSiteRoles,
-  selectedRoles: [MockUserAdminRole, MockOwnerRole],
-}
-Open.parameters = {
-  chromatic: { delay: 300 },
-}
-
-export const Loading = Template.bind({})
-Loading.args = {
-  isLoading: true,
-  roles: MockSiteRoles,
-  selectedRoles: [MockUserAdminRole, MockOwnerRole],
-  userLoginType: "password",
-  oidcRoleSync: false,
-}
-Loading.parameters = {
-  chromatic: { delay: 300 },
-}
diff --git a/site/src/components/EditRolesButton/EditRolesButton.tsx b/site/src/components/EditRolesButton/EditRolesButton.tsx
deleted file mode 100644
index e49902936bee3..0000000000000
--- a/site/src/components/EditRolesButton/EditRolesButton.tsx
+++ /dev/null
@@ -1,218 +0,0 @@
-import IconButton from "@mui/material/IconButton"
-import { EditSquare } from "components/Icons/EditSquare"
-import { useRef, useState, FC } from "react"
-import { makeStyles } from "@mui/styles"
-import { useTranslation } from "react-i18next"
-import Popover from "@mui/material/Popover"
-import { Stack } from "components/Stack/Stack"
-import Checkbox from "@mui/material/Checkbox"
-import UserIcon from "@mui/icons-material/PersonOutline"
-import { Role } from "api/typesGenerated"
-import {
-  HelpTooltip,
-  HelpTooltipText,
-  HelpTooltipTitle,
-} from "components/Tooltips/HelpTooltip"
-import { Maybe } from "components/Conditionals/Maybe"
-
-const Option: React.FC<{
-  value: string
-  name: string
-  description: string
-  isChecked: boolean
-  onChange: (roleName: string) => void
-}> = ({ value, name, description, isChecked, onChange }) => {
-  const styles = useStyles()
-
-  return (
-    <label htmlFor={name} className={styles.option}>
-      <Stack direction="row" alignItems="flex-start">
-        <Checkbox
-          id={name}
-          size="small"
-          className={styles.checkbox}
-          value={value}
-          checked={isChecked}
-          onChange={(e) => {
-            onChange(e.currentTarget.value)
-          }}
-        />
-        <Stack spacing={0.5}>
-          <strong>{name}</strong>
-          <span className={styles.optionDescription}>{description}</span>
-        </Stack>
-      </Stack>
-    </label>
-  )
-}
-
-export interface EditRolesButtonProps {
-  isLoading: boolean
-  roles: Role[]
-  selectedRoles: Role[]
-  onChange: (roles: Role["name"][]) => void
-  defaultIsOpen?: boolean
-  oidcRoleSync: boolean
-  userLoginType: string
-}
-
-export const EditRolesButton: FC<EditRolesButtonProps> = ({
-  roles,
-  selectedRoles,
-  onChange,
-  isLoading,
-  defaultIsOpen = false,
-  userLoginType,
-  oidcRoleSync,
-}) => {
-  const styles = useStyles()
-  const { t } = useTranslation("usersPage")
-  const anchorRef = useRef<HTMLButtonElement>(null)
-  const [isOpen, setIsOpen] = useState(defaultIsOpen)
-  const id = isOpen ? "edit-roles-popover" : undefined
-  const selectedRoleNames = selectedRoles.map((role) => role.name)
-
-  const handleChange = (roleName: string) => {
-    if (selectedRoleNames.includes(roleName)) {
-      onChange(selectedRoleNames.filter((role) => role !== roleName))
-      return
-    }
-
-    onChange([...selectedRoleNames, roleName])
-  }
-
-  const canSetRoles =
-    userLoginType !== "oidc" || (userLoginType === "oidc" && !oidcRoleSync)
-
-  return (
-    <>
-      <Maybe condition={canSetRoles}>
-        <IconButton
-          ref={anchorRef}
-          size="small"
-          className={styles.editButton}
-          title={t("editUserRolesTooltip") || ""}
-          onClick={() => setIsOpen(true)}
-        >
-          <EditSquare />
-        </IconButton>
-      </Maybe>
-      <Maybe condition={!canSetRoles}>
-        <HelpTooltip size="small">
-          <HelpTooltipTitle>Externally controlled</HelpTooltipTitle>
-          <HelpTooltipText>
-            Roles for this user are controlled by the OIDC identity provider.
-          </HelpTooltipText>
-        </HelpTooltip>
-      </Maybe>
-
-      <Popover
-        id={id}
-        open={isOpen}
-        anchorEl={anchorRef.current}
-        onClose={() => setIsOpen(false)}
-        anchorOrigin={{
-          vertical: "bottom",
-          horizontal: "left",
-        }}
-        transformOrigin={{
-          vertical: "top",
-          horizontal: "left",
-        }}
-        classes={{ paper: styles.popoverPaper }}
-      >
-        <fieldset
-          className={styles.fieldset}
-          disabled={isLoading}
-          title={t("fieldSetRolesTooltip") || ""}
-        >
-          <Stack className={styles.options} spacing={3}>
-            {roles.map((role) => (
-              <Option
-                key={role.name}
-                onChange={handleChange}
-                isChecked={selectedRoleNames.includes(role.name)}
-                value={role.name}
-                name={role.display_name}
-                description={t(`roleDescription.${role.name}`)}
-              />
-            ))}
-          </Stack>
-        </fieldset>
-        <div className={styles.footer}>
-          <Stack direction="row" alignItems="flex-start">
-            <UserIcon className={styles.userIcon} />
-            <Stack spacing={0.5}>
-              <strong>{t("member")}</strong>
-              <span className={styles.optionDescription}>
-                {t("roleDescription.member")}
-              </span>
-            </Stack>
-          </Stack>
-        </div>
-      </Popover>
-    </>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  editButton: {
-    color: theme.palette.text.secondary,
-
-    "& .MuiSvgIcon-root": {
-      width: theme.spacing(2),
-      height: theme.spacing(2),
-      position: "relative",
-      top: -2, // Align the pencil square
-    },
-
-    "&:hover": {
-      color: theme.palette.text.primary,
-      backgroundColor: "transparent",
-    },
-  },
-  popoverPaper: {
-    width: theme.spacing(45),
-    marginTop: theme.spacing(1),
-    background: theme.palette.background.paperLight,
-  },
-  fieldset: {
-    border: 0,
-    margin: 0,
-    padding: 0,
-
-    "&:disabled": {
-      opacity: 0.5,
-    },
-  },
-  options: {
-    padding: theme.spacing(3),
-  },
-  option: {
-    cursor: "pointer",
-  },
-  checkbox: {
-    padding: 0,
-    position: "relative",
-    top: 1, // Alignment
-
-    "& svg": {
-      width: theme.spacing(2.5),
-      height: theme.spacing(2.5),
-    },
-  },
-  optionDescription: {
-    fontSize: 12,
-    color: theme.palette.text.secondary,
-  },
-  footer: {
-    padding: theme.spacing(3),
-    backgroundColor: theme.palette.background.paper,
-    borderTop: `1px solid ${theme.palette.divider}`,
-  },
-  userIcon: {
-    width: theme.spacing(2.5), // Same as the checkbox
-    height: theme.spacing(2.5),
-    color: theme.palette.primary.main,
-  },
-}))
diff --git a/site/src/components/EmptyState/EmptyState.stories.tsx b/site/src/components/EmptyState/EmptyState.stories.tsx
new file mode 100644
index 0000000000000..164cbc3cbf6cd
--- /dev/null
+++ b/site/src/components/EmptyState/EmptyState.stories.tsx
@@ -0,0 +1,23 @@
+import Button from "@mui/material/Button";
+import { EmptyState } from "./EmptyState";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof EmptyState> = {
+  title: "components/EmptyState",
+  component: EmptyState,
+  args: {
+    message: "Create your first workspace",
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof EmptyState>;
+
+const Example: Story = {
+  args: {
+    description: "It is easy, just click the button below",
+    cta: <Button>Create workspace</Button>,
+  },
+};
+
+export { Example as EmptyState };
diff --git a/site/src/components/EmptyState/EmptyState.test.tsx b/site/src/components/EmptyState/EmptyState.test.tsx
deleted file mode 100644
index 880a982fb0cc1..0000000000000
--- a/site/src/components/EmptyState/EmptyState.test.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-import { screen } from "@testing-library/react"
-import { render } from "../../testHelpers/renderHelpers"
-import { EmptyState } from "./EmptyState"
-
-describe("EmptyState", () => {
-  it("renders (smoke test)", async () => {
-    // When
-    render(<EmptyState message="Hello, world" />)
-
-    // Then
-    await screen.findByText("Hello, world")
-  })
-
-  it("renders description text", async () => {
-    // When
-    render(
-      <EmptyState message="Hello, world" description="Friendly greeting" />,
-    )
-
-    // Then
-    await screen.findByText("Hello, world")
-    await screen.findByText("Friendly greeting")
-  })
-
-  it("renders cta component", async () => {
-    // Given
-    const cta = <button title="Click me" />
-
-    // When
-    render(<EmptyState message="Hello, world" cta={cta} />)
-
-    // Then
-    await screen.findByText("Hello, world")
-    await screen.findByRole("button")
-  })
-})
diff --git a/site/src/components/EmptyState/EmptyState.tsx b/site/src/components/EmptyState/EmptyState.tsx
index 256062340cfe3..3d605b3334d98 100644
--- a/site/src/components/EmptyState/EmptyState.tsx
+++ b/site/src/components/EmptyState/EmptyState.tsx
@@ -1,17 +1,16 @@
-import Box from "@mui/material/Box"
-import { makeStyles } from "@mui/styles"
-import Typography from "@mui/material/Typography"
-import { FC, ReactNode } from "react"
-import { combineClasses } from "../../utils/combineClasses"
+import Box from "@mui/material/Box";
+import Typography from "@mui/material/Typography";
+import type { FC, ReactNode } from "react";
+import { useTheme } from "@emotion/react";
 
 export interface EmptyStateProps {
   /** Text Message to display, placed inside Typography component */
-  message: string
+  message: string;
   /** Longer optional description to display below the message */
-  description?: string | React.ReactNode
-  cta?: ReactNode
-  className?: string
-  image?: ReactNode
+  description?: string | React.ReactNode;
+  cta?: ReactNode;
+  className?: string;
+  image?: ReactNode;
 }
 
 /**
@@ -25,54 +24,56 @@ export interface EmptyStateProps {
 export const EmptyState: FC<React.PropsWithChildren<EmptyStateProps>> = (
   props,
 ) => {
-  const { message, description, cta, className, image, ...boxProps } = props
-  const styles = useStyles()
+  const { message, description, cta, image, ...boxProps } = props;
+  const theme = useTheme();
 
   return (
-    <Box className={combineClasses([styles.root, className])} {...boxProps}>
-      <Typography variant="h5" className={styles.title}>
+    <Box
+      css={{
+        overflow: "hidden",
+        display: "flex",
+        flexDirection: "column",
+        justifyContent: "center",
+        alignItems: "center",
+        textAlign: "center",
+        minHeight: 360,
+        padding: theme.spacing(10, 5),
+        position: "relative",
+      }}
+      {...boxProps}
+    >
+      <Typography
+        variant="h5"
+        css={{
+          fontSize: theme.spacing(3),
+        }}
+      >
         {message}
       </Typography>
       {description && (
         <Typography
           variant="body2"
           color="textSecondary"
-          className={styles.description}
+          css={{
+            marginTop: theme.spacing(1.5),
+            fontSize: theme.spacing(2),
+            lineHeight: "140%",
+            maxWidth: theme.spacing(60),
+          }}
         >
           {description}
         </Typography>
       )}
-      {cta && <div className={styles.cta}>{cta}</div>}
+      {cta && (
+        <div
+          css={{
+            marginTop: theme.spacing(4),
+          }}
+        >
+          {cta}
+        </div>
+      )}
       {image}
     </Box>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    overflow: "hidden",
-    display: "flex",
-    flexDirection: "column",
-    justifyContent: "center",
-    alignItems: "center",
-    textAlign: "center",
-    minHeight: 360,
-    padding: theme.spacing(10, 5),
-    position: "relative",
-  },
-
-  title: {
-    fontSize: theme.spacing(3),
-  },
-
-  description: {
-    marginTop: theme.spacing(1.5),
-    fontSize: theme.spacing(2),
-    lineHeight: "140%",
-    maxWidth: theme.spacing(60),
-  },
-
-  cta: {
-    marginTop: theme.spacing(4),
-  },
-}))
+  );
+};
diff --git a/site/src/components/EnterpriseSnackbar/EnterpriseSnackbar.stories.tsx b/site/src/components/EnterpriseSnackbar/EnterpriseSnackbar.stories.tsx
deleted file mode 100644
index f8053809bab95..0000000000000
--- a/site/src/components/EnterpriseSnackbar/EnterpriseSnackbar.stories.tsx
+++ /dev/null
@@ -1,35 +0,0 @@
-import { Story } from "@storybook/react"
-import {
-  EnterpriseSnackbar,
-  EnterpriseSnackbarProps,
-} from "./EnterpriseSnackbar"
-
-export default {
-  title: "components/EnterpriseSnackbar",
-  component: EnterpriseSnackbar,
-}
-
-const Template: Story<EnterpriseSnackbarProps> = (
-  args: EnterpriseSnackbarProps,
-) => <EnterpriseSnackbar {...args} />
-
-export const Error = Template.bind({})
-Error.args = {
-  variant: "error",
-  open: true,
-  message: "Oops, something wrong happened.",
-}
-
-export const Info = Template.bind({})
-Info.args = {
-  variant: "info",
-  open: true,
-  message: "Hey, something happened.",
-}
-
-export const Success = Template.bind({})
-Success.args = {
-  variant: "success",
-  open: true,
-  message: "Hey, something good happened.",
-}
diff --git a/site/src/components/EnterpriseSnackbar/EnterpriseSnackbar.tsx b/site/src/components/EnterpriseSnackbar/EnterpriseSnackbar.tsx
deleted file mode 100644
index 3708eb4588ff4..0000000000000
--- a/site/src/components/EnterpriseSnackbar/EnterpriseSnackbar.tsx
+++ /dev/null
@@ -1,106 +0,0 @@
-import IconButton from "@mui/material/IconButton"
-import Snackbar, {
-  SnackbarProps as MuiSnackbarProps,
-} from "@mui/material/Snackbar"
-import { makeStyles } from "@mui/styles"
-import CloseIcon from "@mui/icons-material/Close"
-import { FC } from "react"
-import { combineClasses } from "../../utils/combineClasses"
-
-type EnterpriseSnackbarVariant = "error" | "info" | "success"
-
-export interface EnterpriseSnackbarProps extends MuiSnackbarProps {
-  /** Called when the snackbar should close, either from timeout or clicking close */
-  onClose: () => void
-  /** Variant of snackbar, for theming */
-  variant?: EnterpriseSnackbarVariant
-}
-
-/**
- * Wrapper around Material UI's Snackbar component, provides pre-configured
- * themes and convenience props. Coder UI's Snackbars require a close handler,
- * since they always render a close button.
- *
- * Snackbars do _not_ automatically appear in the top-level position when
- * rendered, you'll need to use ReactDom portals or the Material UI Portal
- * component for that.
- *
- * See original component's Material UI documentation here: https://material-ui.com/components/snackbars/
- */
-export const EnterpriseSnackbar: FC<
-  React.PropsWithChildren<EnterpriseSnackbarProps>
-> = ({ onClose, variant = "info", ContentProps = {}, action, ...rest }) => {
-  const styles = useStyles()
-
-  return (
-    <Snackbar
-      anchorOrigin={{
-        vertical: "bottom",
-        horizontal: "right",
-      }}
-      {...rest}
-      action={
-        <div className={styles.actionWrapper}>
-          {action}
-          <IconButton
-            onClick={onClose}
-            className={styles.iconButton}
-            size="large"
-          >
-            <CloseIcon className={styles.closeIcon} aria-label="close" />
-          </IconButton>
-        </div>
-      }
-      ContentProps={{
-        ...ContentProps,
-        className: combineClasses({
-          [styles.snackbarContent]: true,
-          [styles.snackbarContentInfo]: variant === "info",
-          [styles.snackbarContentError]: variant === "error",
-          [styles.snackbarContentSuccess]: variant === "success",
-        }),
-      }}
-      onClose={onClose}
-    />
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  actionWrapper: {
-    display: "flex",
-    alignItems: "center",
-  },
-  iconButton: {
-    padding: 0,
-  },
-  closeIcon: {
-    width: 25,
-    height: 25,
-    color: theme.palette.primary.contrastText,
-  },
-  snackbarContent: {
-    border: `1px solid ${theme.palette.divider}`,
-    borderLeft: `4px solid ${theme.palette.primary.main}`,
-    borderRadius: theme.shape.borderRadius,
-    padding: `
-      ${theme.spacing(1)}px
-      ${theme.spacing(3)}px
-      ${theme.spacing(1)}px
-      ${theme.spacing(2)}px
-    `,
-    boxShadow: theme.shadows[6],
-    alignItems: "inherit",
-    backgroundColor: theme.palette.background.paper,
-    color: theme.palette.text.secondary,
-  },
-  snackbarContentInfo: {
-    // Use success color as a highlight
-    borderLeftColor: theme.palette.primary.main,
-  },
-  snackbarContentError: {
-    borderLeftColor: theme.palette.error.main,
-  },
-  snackbarContentSuccess: {
-    borderLeftColor: theme.palette.success.main,
-  },
-}))
diff --git a/site/src/components/ErrorBoundary/ErrorBoundary.tsx b/site/src/components/ErrorBoundary/ErrorBoundary.tsx
index 9f6eae8c971a6..9267ae172b9b8 100644
--- a/site/src/components/ErrorBoundary/ErrorBoundary.tsx
+++ b/site/src/components/ErrorBoundary/ErrorBoundary.tsx
@@ -1,10 +1,10 @@
-import { Component, ReactNode, PropsWithChildren } from "react"
-import { RuntimeErrorState } from "../RuntimeErrorState/RuntimeErrorState"
+import { Component, ReactNode, PropsWithChildren } from "react";
+import { RuntimeErrorState } from "./RuntimeErrorState";
 
-type ErrorBoundaryProps = PropsWithChildren<unknown>
+type ErrorBoundaryProps = PropsWithChildren<unknown>;
 
 interface ErrorBoundaryState {
-  error: Error | null
+  error: Error | null;
 }
 
 /**
@@ -16,19 +16,19 @@ export class ErrorBoundary extends Component<
   ErrorBoundaryState
 > {
   constructor(props: ErrorBoundaryProps) {
-    super(props)
-    this.state = { error: null }
+    super(props);
+    this.state = { error: null };
   }
 
   static getDerivedStateFromError(error: Error): { error: Error } {
-    return { error }
+    return { error };
   }
 
   render(): ReactNode {
     if (this.state.error) {
-      return <RuntimeErrorState error={this.state.error} />
+      return <RuntimeErrorState error={this.state.error} />;
     }
 
-    return this.props.children
+    return this.props.children;
   }
 }
diff --git a/site/src/components/ErrorBoundary/RuntimeErrorState.stories.tsx b/site/src/components/ErrorBoundary/RuntimeErrorState.stories.tsx
new file mode 100644
index 0000000000000..f6281579ddf2c
--- /dev/null
+++ b/site/src/components/ErrorBoundary/RuntimeErrorState.stories.tsx
@@ -0,0 +1,24 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import { RuntimeErrorState } from "./RuntimeErrorState";
+
+const error = new Error("An error occurred");
+
+const meta: Meta<typeof RuntimeErrorState> = {
+  title: "components/RuntimeErrorState",
+  component: RuntimeErrorState,
+  args: {
+    error,
+  },
+  parameters: {
+    // The RuntimeErrorState is noisy for chromatic, because it renders an actual error
+    // along with the stacktrace - and the stacktrace includes the full URL of
+    // scripts in the stack. This is problematic, because every deployment uses
+    // a different URL, causing the validation to fail.
+    chromatic: { disableSnapshot: true },
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof RuntimeErrorState>;
+
+export const Errored: Story = {};
diff --git a/site/src/components/ErrorBoundary/RuntimeErrorState.tsx b/site/src/components/ErrorBoundary/RuntimeErrorState.tsx
new file mode 100644
index 0000000000000..0b6ecdd893b41
--- /dev/null
+++ b/site/src/components/ErrorBoundary/RuntimeErrorState.tsx
@@ -0,0 +1,213 @@
+import Button from "@mui/material/Button";
+import Link from "@mui/material/Link";
+import RefreshOutlined from "@mui/icons-material/RefreshOutlined";
+import { type FC, useEffect, useState } from "react";
+import { Helmet } from "react-helmet-async";
+import { css } from "@emotion/css";
+import { useTheme, type Interpolation, type Theme } from "@emotion/react";
+import type { BuildInfoResponse } from "api/typesGenerated";
+import { CopyButton } from "components/CopyButton/CopyButton";
+import { CoderIcon } from "components/Icons/CoderIcon";
+import { FullScreenLoader } from "components/Loader/FullScreenLoader";
+import { Stack } from "components/Stack/Stack";
+import { Margins } from "components/Margins/Margins";
+
+const fetchDynamicallyImportedModuleError =
+  "Failed to fetch dynamically imported module";
+
+export type RuntimeErrorStateProps = { error: Error };
+
+export const RuntimeErrorState: FC<RuntimeErrorStateProps> = ({ error }) => {
+  const theme = useTheme();
+  const [checkingError, setCheckingError] = useState(true);
+  const [staticBuildInfo, setStaticBuildInfo] = useState<BuildInfoResponse>();
+  const coderVersion = staticBuildInfo?.version;
+
+  // We use an effect to show a loading state if the page is trying to reload
+  useEffect(() => {
+    const isImportError = error.message.includes(
+      fetchDynamicallyImportedModuleError,
+    );
+    const isRetried = window.location.search.includes("retries=1");
+
+    if (isImportError && !isRetried) {
+      const url = new URL(location.href);
+      // Add a retry to avoid loops
+      url.searchParams.set("retries", "1");
+      location.assign(url.search);
+      return;
+    }
+
+    setCheckingError(false);
+  }, [error.message]);
+
+  useEffect(() => {
+    if (!checkingError) {
+      setStaticBuildInfo(getStaticBuildInfo());
+    }
+  }, [checkingError]);
+
+  return (
+    <>
+      <Helmet>
+        <title>Something went wrong...</title>
+      </Helmet>
+      {!checkingError ? (
+        <Margins css={styles.root}>
+          <div css={{ width: "100%" }}>
+            <CoderIcon css={styles.logo} />
+            <h1 css={styles.title}>Something went wrong...</h1>
+            <p css={styles.text}>
+              Please try reloading the page, if that doesn&lsquo;t work, you can
+              ask for help in the{" "}
+              <Link href="https://discord.gg/coder">
+                Coder Discord community
+              </Link>{" "}
+              or{" "}
+              <Link
+                href={`https://github.com/coder/coder/issues/new?body=${encodeURIComponent(
+                  [
+                    ["**Version**", coderVersion ?? "-- Set version --"].join(
+                      "\n",
+                    ),
+                    ["**Path**", "`" + location.pathname + "`"].join("\n"),
+                    ["**Error**", "```\n" + error.stack + "\n```"].join("\n"),
+                  ].join("\n\n"),
+                )}`}
+                target="_blank"
+              >
+                open an issue
+              </Link>
+              .
+            </p>
+            <Stack direction="row" justifyContent="center">
+              <Button
+                startIcon={<RefreshOutlined />}
+                onClick={() => {
+                  window.location.reload();
+                }}
+              >
+                Reload page
+              </Button>
+              <Button component="a" href="/">
+                Go to dashboard
+              </Button>
+            </Stack>
+            {error.stack && (
+              <div css={styles.stack}>
+                <div css={styles.stackHeader}>
+                  Stacktrace
+                  <CopyButton
+                    buttonClassName={css`
+                      background-color: transparent;
+                      border: 0;
+                      border-radius: 999px;
+                      min-height: ${theme.spacing(4)};
+                      min-width: ${theme.spacing(4)};
+                      height: ${theme.spacing(4)};
+                      width: ${theme.spacing(4)};
+
+                      & svg {
+                        width: 16px;
+                        height: 16px;
+                      }
+                    `}
+                    text={error.stack}
+                    tooltipTitle="Copy stacktrace"
+                  />
+                </div>
+                <pre css={styles.stackCode}>{error.stack}</pre>
+              </div>
+            )}
+            {coderVersion && (
+              <div css={styles.version}>Version: {coderVersion}</div>
+            )}
+          </div>
+        </Margins>
+      ) : (
+        <FullScreenLoader />
+      )}
+    </>
+  );
+};
+
+// During the build process, we inject the build info into the HTML
+const getStaticBuildInfo = () => {
+  const buildInfoJson = document
+    .querySelector("meta[property=build-info]")
+    ?.getAttribute("content");
+
+  if (buildInfoJson) {
+    try {
+      return JSON.parse(buildInfoJson) as BuildInfoResponse;
+    } catch {
+      return undefined;
+    }
+  }
+};
+
+const styles = {
+  root: (theme) => ({
+    paddingTop: theme.spacing(4),
+    paddingBottom: theme.spacing(4),
+    textAlign: "center",
+    display: "flex",
+    alignItems: "center",
+    justifyContent: "center",
+    minHeight: "100%",
+    maxWidth: theme.spacing(75),
+  }),
+
+  logo: (theme) => ({
+    fontSize: theme.spacing(8),
+  }),
+
+  title: (theme) => ({
+    fontSize: theme.spacing(4),
+    fontWeight: 400,
+  }),
+
+  text: (theme) => ({
+    fontSize: 16,
+    color: theme.palette.text.secondary,
+    lineHeight: "160%",
+    marginBottom: theme.spacing(4),
+  }),
+
+  stack: (theme) => ({
+    backgroundColor: theme.palette.background.paper,
+    border: `1px solid ${theme.palette.divider}`,
+    borderRadius: 4,
+    marginTop: theme.spacing(8),
+    display: "block",
+    textAlign: "left",
+  }),
+
+  stackHeader: (theme) => ({
+    fontSize: 10,
+    textTransform: "uppercase",
+    fontWeight: 600,
+    letterSpacing: 1,
+    padding: theme.spacing(1, 1, 1, 2),
+    backgroundColor: theme.palette.background.paperLight,
+    borderBottom: `1px solid ${theme.palette.divider}`,
+    color: theme.palette.text.secondary,
+    display: "flex",
+    flexAlign: "center",
+    justifyContent: "space-between",
+    alignItems: "center",
+  }),
+
+  stackCode: (theme) => ({
+    padding: theme.spacing(2),
+    margin: 0,
+    wordWrap: "break-word",
+    whiteSpace: "break-spaces",
+  }),
+
+  version: (theme) => ({
+    marginTop: theme.spacing(4),
+    fontSize: 12,
+    color: theme.palette.text.secondary,
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/components/Expander/Expander.stories.tsx b/site/src/components/Expander/Expander.stories.tsx
index c3f41869f2157..83f18dccab8f2 100644
--- a/site/src/components/Expander/Expander.stories.tsx
+++ b/site/src/components/Expander/Expander.stories.tsx
@@ -1,22 +1,22 @@
-import { Story } from "@storybook/react"
-import { Expander, ExpanderProps } from "./Expander"
+import { Expander } from "./Expander";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
+const meta: Meta<typeof Expander> = {
   title: "components/Expander",
   component: Expander,
-  argTypes: {
-    setExpanded: { action: "setExpanded" },
-  },
-}
+};
 
-const Template: Story<ExpanderProps> = (args) => <Expander {...args} />
+export default meta;
+type Story = StoryObj<typeof Expander>;
 
-export const Expanded = Template.bind({})
-Expanded.args = {
-  expanded: true,
-}
+export const Expanded: Story = {
+  args: {
+    expanded: true,
+  },
+};
 
-export const Collapsed = Template.bind({})
-Collapsed.args = {
-  expanded: false,
-}
+export const Collapsed: Story = {
+  args: {
+    expanded: false,
+  },
+};
diff --git a/site/src/components/Expander/Expander.tsx b/site/src/components/Expander/Expander.tsx
index 86c5eaa21c764..c736f73168ebc 100644
--- a/site/src/components/Expander/Expander.tsx
+++ b/site/src/components/Expander/Expander.tsx
@@ -1,17 +1,12 @@
-import Link from "@mui/material/Link"
-import makeStyles from "@mui/styles/makeStyles"
-import {
-  CloseDropdown,
-  OpenDropdown,
-} from "components/DropdownArrows/DropdownArrows"
-import { PropsWithChildren, FC } from "react"
-import Collapse from "@mui/material/Collapse"
-import { useTranslation } from "react-i18next"
-import { combineClasses } from "utils/combineClasses"
+import { type Interpolation, type Theme } from "@emotion/react";
+import Collapse from "@mui/material/Collapse";
+import Link from "@mui/material/Link";
+import { DropdownArrow } from "components/DropdownArrow/DropdownArrow";
+import { type FC, type PropsWithChildren } from "react";
 
 export interface ExpanderProps {
-  expanded: boolean
-  setExpanded: (val: boolean) => void
+  expanded: boolean;
+  setExpanded: (val: boolean) => void;
 }
 
 export const Expander: FC<PropsWithChildren<ExpanderProps>> = ({
@@ -19,51 +14,48 @@ export const Expander: FC<PropsWithChildren<ExpanderProps>> = ({
   setExpanded,
   children,
 }) => {
-  const styles = useStyles()
-  const { t } = useTranslation("common")
-
-  const toggleExpanded = () => setExpanded(!expanded)
+  const toggleExpanded = () => setExpanded(!expanded);
 
   return (
     <>
       {!expanded && (
-        <Link onClick={toggleExpanded} className={styles.expandLink}>
-          <span className={styles.text}>
-            {t("ctas.expand")}
-            <OpenDropdown margin={false} />
+        <Link onClick={toggleExpanded} css={styles.expandLink}>
+          <span css={styles.text}>
+            Click here to learn more
+            <DropdownArrow margin={false} />
           </span>
         </Link>
       )}
       <Collapse in={expanded}>
-        <div className={styles.text}>{children}</div>
+        <div css={styles.text}>{children}</div>
       </Collapse>
       {expanded && (
         <Link
           onClick={toggleExpanded}
-          className={combineClasses([styles.expandLink, styles.collapseLink])}
+          css={[styles.expandLink, styles.collapseLink]}
         >
-          <span className={styles.text}>
-            {t("ctas.collapse")}
-            <CloseDropdown margin={false} />
+          <span css={styles.text}>
+            Click here to hide
+            <DropdownArrow margin={false} close />
           </span>
         </Link>
       )}
     </>
-  )
-}
+  );
+};
 
-const useStyles = makeStyles((theme) => ({
-  expandLink: {
+const styles = {
+  expandLink: (theme) => ({
     cursor: "pointer",
     color: theme.palette.text.secondary,
-  },
-  collapseLink: {
+  }),
+  collapseLink: (theme) => ({
     marginTop: theme.spacing(2),
-  },
-  text: {
+  }),
+  text: (theme) => ({
     display: "flex",
     alignItems: "center",
     color: theme.palette.text.secondary,
     fontSize: theme.typography.caption.fontSize,
-  },
-}))
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/components/FileUpload/FileUpload.tsx b/site/src/components/FileUpload/FileUpload.tsx
index 986018df7628d..0416f2c182d43 100644
--- a/site/src/components/FileUpload/FileUpload.tsx
+++ b/site/src/components/FileUpload/FileUpload.tsx
@@ -1,54 +1,53 @@
-import { makeStyles } from "@mui/styles"
-import { Stack } from "components/Stack/Stack"
-import { FC, DragEvent, useRef, ReactNode } from "react"
-import UploadIcon from "@mui/icons-material/CloudUploadOutlined"
-import { useClickable } from "hooks/useClickable"
-import CircularProgress from "@mui/material/CircularProgress"
-import { combineClasses } from "utils/combineClasses"
-import IconButton from "@mui/material/IconButton"
-import RemoveIcon from "@mui/icons-material/DeleteOutline"
-import FileIcon from "@mui/icons-material/FolderOutlined"
+import { Stack } from "components/Stack/Stack";
+import { type FC, type DragEvent, useRef, type ReactNode } from "react";
+import UploadIcon from "@mui/icons-material/CloudUploadOutlined";
+import { useClickable } from "hooks/useClickable";
+import CircularProgress from "@mui/material/CircularProgress";
+import IconButton from "@mui/material/IconButton";
+import RemoveIcon from "@mui/icons-material/DeleteOutline";
+import FileIcon from "@mui/icons-material/FolderOutlined";
+import { css, type Interpolation, type Theme } from "@emotion/react";
 
 const useFileDrop = (
   callback: (file: File) => void,
   fileTypeRequired?: string,
 ): {
-  onDragOver: (e: DragEvent<HTMLDivElement>) => void
-  onDrop: (e: DragEvent<HTMLDivElement>) => void
+  onDragOver: (e: DragEvent<HTMLDivElement>) => void;
+  onDrop: (e: DragEvent<HTMLDivElement>) => void;
 } => {
   const onDragOver = (e: DragEvent<HTMLDivElement>) => {
-    e.preventDefault()
-  }
+    e.preventDefault();
+  };
 
   const onDrop = (e: DragEvent<HTMLDivElement>) => {
-    e.preventDefault()
-    const file = e.dataTransfer.files[0]
+    e.preventDefault();
+    const file = e.dataTransfer.files[0];
     // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- file can be undefined
     if (!file) {
-      return
+      return;
     }
     if (fileTypeRequired && file.type !== fileTypeRequired) {
-      return
+      return;
     }
-    callback(file)
-  }
+    callback(file);
+  };
 
   return {
     onDragOver,
     onDrop,
-  }
-}
+  };
+};
 
 export interface FileUploadProps {
-  isUploading: boolean
-  onUpload: (file: File) => void
-  onRemove?: () => void
-  file?: File
-  removeLabel: string
-  title: string
-  description?: ReactNode
-  extension?: string
-  fileTypeRequired?: string
+  isUploading: boolean;
+  onUpload: (file: File) => void;
+  onRemove?: () => void;
+  file?: File;
+  removeLabel: string;
+  title: string;
+  description?: ReactNode;
+  extension?: string;
+  fileTypeRequired?: string;
 }
 
 export const FileUpload: FC<FileUploadProps> = ({
@@ -62,19 +61,19 @@ export const FileUpload: FC<FileUploadProps> = ({
   extension,
   fileTypeRequired,
 }) => {
-  const styles = useStyles()
-  const inputRef = useRef<HTMLInputElement>(null)
-  const tarDrop = useFileDrop(onUpload, fileTypeRequired)
-  const clickable = useClickable(() => {
+  const inputRef = useRef<HTMLInputElement>(null);
+  const tarDrop = useFileDrop(onUpload, fileTypeRequired);
+
+  const clickable = useClickable<HTMLDivElement>(() => {
     if (inputRef.current) {
-      inputRef.current.click()
+      inputRef.current.click();
     }
-  })
+  });
 
   if (!isUploading && file) {
     return (
       <Stack
-        className={styles.file}
+        css={styles.file}
         direction="row"
         justifyContent="space-between"
         alignItems="center"
@@ -88,16 +87,13 @@ export const FileUpload: FC<FileUploadProps> = ({
           <RemoveIcon />
         </IconButton>
       </Stack>
-    )
+    );
   }
 
   return (
     <>
       <div
-        className={combineClasses({
-          [styles.root]: true,
-          [styles.disabled]: isUploading,
-        })}
+        css={[styles.root, isUploading && styles.disabled]}
         {...clickable}
         {...tarDrop}
       >
@@ -105,12 +101,12 @@ export const FileUpload: FC<FileUploadProps> = ({
           {isUploading ? (
             <CircularProgress size={32} />
           ) : (
-            <UploadIcon className={styles.icon} />
+            <UploadIcon css={styles.icon} />
           )}
 
           <Stack alignItems="center" spacing={0.5}>
-            <span className={styles.title}>{title}</span>
-            <span className={styles.description}>{description}</span>
+            <span css={styles.title}>{title}</span>
+            <span css={styles.description}>{description}</span>
           </Stack>
         </Stack>
       </div>
@@ -119,61 +115,61 @@ export const FileUpload: FC<FileUploadProps> = ({
         type="file"
         data-testid="file-upload"
         ref={inputRef}
-        className={styles.input}
+        css={styles.input}
         accept={extension}
         onChange={(event) => {
-          const file = event.currentTarget.files?.[0]
+          const file = event.currentTarget.files?.[0];
           if (file) {
-            onUpload(file)
+            onUpload(file);
           }
         }}
       />
     </>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    display: "flex",
-    alignItems: "center",
-    justifyContent: "center",
-    borderRadius: theme.shape.borderRadius,
-    border: `2px dashed ${theme.palette.divider}`,
-    padding: theme.spacing(6),
-    cursor: "pointer",
-
-    "&:hover": {
-      backgroundColor: theme.palette.background.paper,
-    },
-  },
+  );
+};
+
+const styles = {
+  root: (theme) => css`
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: ${theme.shape.borderRadius}px;
+    border: 2px dashed ${theme.palette.divider};
+    padding: ${theme.spacing(6)};
+    cursor: pointer;
+
+    &:hover {
+      background-color: ${theme.palette.background.paper};
+    }
+  `,
 
   disabled: {
     pointerEvents: "none",
     opacity: 0.75,
   },
 
-  icon: {
+  icon: (theme) => ({
     fontSize: theme.spacing(8),
-  },
+  }),
 
-  title: {
+  title: (theme) => ({
     fontSize: theme.spacing(2),
-  },
+  }),
 
-  description: {
+  description: (theme) => ({
     color: theme.palette.text.secondary,
     textAlign: "center",
     maxWidth: theme.spacing(50),
-  },
+  }),
 
   input: {
     display: "none",
   },
 
-  file: {
+  file: (theme) => ({
     borderRadius: theme.shape.borderRadius,
     border: `1px solid ${theme.palette.divider}`,
     padding: theme.spacing(2),
     background: theme.palette.background.paper,
-  },
-}))
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/components/Filter/UserFilter.tsx b/site/src/components/Filter/UserFilter.tsx
index e909ae9363701..61b7754e0f78a 100644
--- a/site/src/components/Filter/UserFilter.tsx
+++ b/site/src/components/Filter/UserFilter.tsx
@@ -1,13 +1,13 @@
-import { useMe } from "hooks"
-import { BaseOption } from "./options"
-import { getUsers } from "api/api"
-import { UseFilterMenuOptions, useFilterMenu } from "./menu"
-import { FilterSearchMenu, OptionItem } from "./filter"
-import { UserAvatar } from "components/UserAvatar/UserAvatar"
+import { useMe } from "hooks";
+import { BaseOption } from "./options";
+import { getUsers } from "api/api";
+import { UseFilterMenuOptions, useFilterMenu } from "./menu";
+import { FilterSearchMenu, OptionItem } from "./filter";
+import { UserAvatar } from "components/UserAvatar/UserAvatar";
 
 export type UserOption = BaseOption & {
-  avatarUrl?: string
-}
+  avatarUrl?: string;
+};
 
 export const useUserFilterMenu = ({
   value,
@@ -17,15 +17,15 @@ export const useUserFilterMenu = ({
   UseFilterMenuOptions<UserOption>,
   "value" | "onChange" | "enabled"
 >) => {
-  const me = useMe()
+  const me = useMe();
 
   const addMeAsFirstOption = (options: UserOption[]) => {
-    options = options.filter((option) => option.value !== me.username)
+    options = options.filter((option) => option.value !== me.username);
     return [
       { label: me.username, value: me.username, avatarUrl: me.avatar_url },
       ...options,
-    ]
-  }
+    ];
+  };
 
   return useFilterMenu({
     onChange,
@@ -38,34 +38,34 @@ export const useUserFilterMenu = ({
           label: me.username,
           value: me.username,
           avatarUrl: me.avatar_url,
-        }
+        };
       }
 
-      const usersRes = await getUsers({ q: value, limit: 1 })
-      const firstUser = usersRes.users.at(0)
+      const usersRes = await getUsers({ q: value, limit: 1 });
+      const firstUser = usersRes.users.at(0);
       if (firstUser && firstUser.username === value) {
         return {
           label: firstUser.username,
           value: firstUser.username,
           avatarUrl: firstUser.avatar_url,
-        }
+        };
       }
-      return null
+      return null;
     },
     getOptions: async (query) => {
-      const usersRes = await getUsers({ q: query, limit: 25 })
+      const usersRes = await getUsers({ q: query, limit: 25 });
       let options: UserOption[] = usersRes.users.map((user) => ({
         label: user.username,
         value: user.username,
         avatarUrl: user.avatar_url,
-      }))
-      options = addMeAsFirstOption(options)
-      return options
+      }));
+      options = addMeAsFirstOption(options);
+      return options;
     },
-  })
-}
+  });
+};
 
-export type UserFilterMenu = ReturnType<typeof useUserFilterMenu>
+export type UserFilterMenu = ReturnType<typeof useUserFilterMenu>;
 
 export const UserMenu = (menu: UserFilterMenu) => {
   return (
@@ -82,15 +82,15 @@ export const UserMenu = (menu: UserFilterMenu) => {
     >
       {(itemProps) => <UserOptionItem {...itemProps} />}
     </FilterSearchMenu>
-  )
-}
+  );
+};
 
 const UserOptionItem = ({
   option,
   isSelected,
 }: {
-  option: UserOption
-  isSelected?: boolean
+  option: UserOption;
+  isSelected?: boolean;
 }) => {
   return (
     <OptionItem
@@ -104,5 +104,5 @@ const UserOptionItem = ({
         />
       }
     />
-  )
-}
+  );
+};
diff --git a/site/src/components/Filter/filter.tsx b/site/src/components/Filter/filter.tsx
index fa20e6f9b9aa8..1824554721b13 100644
--- a/site/src/components/Filter/filter.tsx
+++ b/site/src/components/Filter/filter.tsx
@@ -1,114 +1,122 @@
-import { ReactNode, forwardRef, useEffect, useRef, useState } from "react"
-import Box from "@mui/material/Box"
-import TextField from "@mui/material/TextField"
-import KeyboardArrowDown from "@mui/icons-material/KeyboardArrowDown"
-import Button, { ButtonProps } from "@mui/material/Button"
-import Menu, { MenuProps } from "@mui/material/Menu"
-import MenuItem from "@mui/material/MenuItem"
-import SearchOutlined from "@mui/icons-material/SearchOutlined"
-import InputAdornment from "@mui/material/InputAdornment"
-import IconButton from "@mui/material/IconButton"
-import Tooltip from "@mui/material/Tooltip"
-import CloseOutlined from "@mui/icons-material/CloseOutlined"
-import { useSearchParams } from "react-router-dom"
-import Skeleton, { SkeletonProps } from "@mui/material/Skeleton"
-import CheckOutlined from "@mui/icons-material/CheckOutlined"
+import { ReactNode, forwardRef, useEffect, useRef, useState } from "react";
+import Box from "@mui/material/Box";
+import TextField from "@mui/material/TextField";
+import KeyboardArrowDown from "@mui/icons-material/KeyboardArrowDown";
+import Button, { ButtonProps } from "@mui/material/Button";
+import Menu, { MenuProps } from "@mui/material/Menu";
+import MenuItem from "@mui/material/MenuItem";
+import SearchOutlined from "@mui/icons-material/SearchOutlined";
+import InputAdornment from "@mui/material/InputAdornment";
+import IconButton from "@mui/material/IconButton";
+import Tooltip from "@mui/material/Tooltip";
+import CloseOutlined from "@mui/icons-material/CloseOutlined";
+import { useSearchParams } from "react-router-dom";
+import Skeleton, { SkeletonProps } from "@mui/material/Skeleton";
+import CheckOutlined from "@mui/icons-material/CheckOutlined";
 import {
   getValidationErrorMessage,
   hasError,
   isApiValidationError,
-} from "api/errors"
-import { useFilterMenu } from "./menu"
-import { BaseOption } from "./options"
-import debounce from "just-debounce-it"
-import MenuList from "@mui/material/MenuList"
-import { Loader } from "components/Loader/Loader"
-import Divider from "@mui/material/Divider"
-import OpenInNewOutlined from "@mui/icons-material/OpenInNewOutlined"
+} from "api/errors";
+import { useFilterMenu } from "./menu";
+import { BaseOption } from "./options";
+import MenuList from "@mui/material/MenuList";
+import { Loader } from "components/Loader/Loader";
+import Divider from "@mui/material/Divider";
+import OpenInNewOutlined from "@mui/icons-material/OpenInNewOutlined";
+
+import { useDebouncedFunction } from "hooks/debounce";
 
 export type PresetFilter = {
-  name: string
-  query: string
-}
+  name: string;
+  query: string;
+};
+
+type FilterValues = Record<string, string | undefined>;
 
-type FilterValues = Record<string, string | undefined>
+type UseFilterConfig = {
+  /**
+   * The fallback value to use in the event that no filter params can be parsed
+   * from the search params object. This value is allowed to change on
+   * re-renders.
+   */
+  fallbackFilter?: string;
+  searchParamsResult: ReturnType<typeof useSearchParams>;
+  onUpdate?: (newValue: string) => void;
+};
+
+const useFilterParamsKey = "filter";
 
 export const useFilter = ({
-  initialValue = "",
-  onUpdate,
+  fallbackFilter = "",
   searchParamsResult,
-}: {
-  initialValue?: string
-  searchParamsResult: ReturnType<typeof useSearchParams>
-  onUpdate?: () => void
-}) => {
-  const [searchParams, setSearchParams] = searchParamsResult
-  const query = searchParams.get("filter") ?? initialValue
-  const values = parseFilterQuery(query)
-
-  const update = (values: string | FilterValues) => {
-    if (typeof values === "string") {
-      searchParams.set("filter", values)
-    } else {
-      searchParams.set("filter", stringifyFilter(values))
-    }
-    setSearchParams(searchParams)
-    if (onUpdate) {
-      onUpdate()
+  onUpdate,
+}: UseFilterConfig) => {
+  const [searchParams, setSearchParams] = searchParamsResult;
+  const query = searchParams.get(useFilterParamsKey) ?? fallbackFilter;
+
+  const update = (newValues: string | FilterValues) => {
+    const serialized =
+      typeof newValues === "string" ? newValues : stringifyFilter(newValues);
+
+    searchParams.set(useFilterParamsKey, serialized);
+    setSearchParams(searchParams);
+
+    if (onUpdate !== undefined) {
+      onUpdate(serialized);
     }
-  }
+  };
 
-  const debounceUpdate = debounce(
-    (values: string | FilterValues) => update(values),
+  const { debounced: debounceUpdate, cancelDebounce } = useDebouncedFunction(
+    update,
     500,
-  )
-
-  const used = query !== "" && query !== initialValue
+  );
 
   return {
     query,
     update,
     debounceUpdate,
-    values,
-    used,
-  }
-}
+    cancelDebounce,
+    values: parseFilterQuery(query),
+    used: query !== "" && query !== fallbackFilter,
+  };
+};
 
-export type UseFilterResult = ReturnType<typeof useFilter>
+export type UseFilterResult = ReturnType<typeof useFilter>;
 
 const parseFilterQuery = (filterQuery: string): FilterValues => {
   if (filterQuery === "") {
-    return {}
+    return {};
   }
 
-  const pairs = filterQuery.split(" ")
-  const result: FilterValues = {}
+  const pairs = filterQuery.split(" ");
+  const result: FilterValues = {};
 
   for (const pair of pairs) {
     const [key, value] = pair.split(":") as [
       keyof FilterValues,
       string | undefined,
-    ]
+    ];
     if (value) {
-      result[key] = value
+      result[key] = value;
     }
   }
 
-  return result
-}
+  return result;
+};
 
 const stringifyFilter = (filterValue: FilterValues): string => {
-  let result = ""
+  let result = "";
 
   for (const key in filterValue) {
-    const value = filterValue[key]
+    const value = filterValue[key];
     if (value) {
-      result += `${key}:${value} `
+      result += `${key}:${value} `;
     }
   }
 
-  return result.trim()
-}
+  return result.trim();
+};
 
 const BaseSkeleton = (props: SkeletonProps) => {
   return (
@@ -122,13 +130,25 @@ const BaseSkeleton = (props: SkeletonProps) => {
         ...props.sx,
       }}
     />
-  )
-}
+  );
+};
 
-export const SearchFieldSkeleton = () => <BaseSkeleton width="100%" />
+export const SearchFieldSkeleton = () => <BaseSkeleton width="100%" />;
 export const MenuSkeleton = () => (
   <BaseSkeleton sx={{ minWidth: 200, flexShrink: 0 }} />
-)
+);
+
+type FilterProps = {
+  filter: ReturnType<typeof useFilter>;
+  skeleton: ReactNode;
+  isLoading: boolean;
+  learnMoreLink: string;
+  learnMoreLabel2?: string;
+  learnMoreLink2?: string;
+  error?: unknown;
+  options?: ReactNode;
+  presets: PresetFilter[];
+};
 
 export const Filter = ({
   filter,
@@ -140,29 +160,29 @@ export const Filter = ({
   learnMoreLabel2,
   learnMoreLink2,
   presets,
-}: {
-  filter: ReturnType<typeof useFilter>
-  skeleton: ReactNode
-  isLoading: boolean
-  learnMoreLink: string
-  learnMoreLabel2?: string
-  learnMoreLink2?: string
-  error?: unknown
-  options?: ReactNode
-  presets: PresetFilter[]
-}) => {
-  const shouldDisplayError = hasError(error) && isApiValidationError(error)
-  const hasFilterQuery = filter.query !== ""
-  const [searchQuery, setSearchQuery] = useState(filter.query)
-  const inputRef = useRef<HTMLInputElement>(null)
-
+}: FilterProps) => {
+  // Storing local copy of the filter query so that it can be updated more
+  // aggressively without re-renders rippling out to the rest of the app every
+  // single time. Exists for performance reasons - not really a good way to
+  // remove this; render keys would cause the component to remount too often
+  const [queryCopy, setQueryCopy] = useState(filter.query);
+  const textboxInputRef = useRef<HTMLInputElement>(null);
+
+  // Conditionally re-syncs the parent and local filter queries
   useEffect(() => {
-    // We don't want to update this while the user is typing something or has the focus in the input
-    const isFocused = document.activeElement === inputRef.current
-    if (!isFocused) {
-      setSearchQuery(filter.query)
+    const hasSelfOrInnerFocus =
+      textboxInputRef.current?.contains(document.activeElement) ?? false;
+
+    // This doesn't address all state sync issues - namely, what happens if the
+    // user removes focus just after this synchronizing effect fires. Also need
+    // to rely on onBlur behavior as an extra safety measure
+    if (!hasSelfOrInnerFocus) {
+      setQueryCopy(filter.query);
     }
-  }, [filter.query])
+  }, [filter.query]);
+
+  const shouldDisplayError = hasError(error) && isApiValidationError(error);
+  const hasFilterQuery = filter.query !== "";
 
   return (
     <Box
@@ -198,11 +218,16 @@ export const Filter = ({
                 "aria-label": "Filter",
                 name: "query",
                 placeholder: "Search...",
-                value: searchQuery,
-                ref: inputRef,
+                value: queryCopy,
+                ref: textboxInputRef,
                 onChange: (e) => {
-                  setSearchQuery(e.target.value)
-                  filter.debounceUpdate(e.target.value)
+                  setQueryCopy(e.target.value);
+                  filter.debounceUpdate(e.target.value);
+                },
+                onBlur: () => {
+                  if (queryCopy !== filter.query) {
+                    setQueryCopy(filter.query);
+                  }
                 },
                 sx: {
                   borderRadius: "6px",
@@ -238,7 +263,7 @@ export const Filter = ({
                       <IconButton
                         size="small"
                         onClick={() => {
-                          filter.update("")
+                          filter.update("");
                         }}
                       >
                         <CloseOutlined sx={{ fontSize: 14 }} />
@@ -253,8 +278,8 @@ export const Filter = ({
         </>
       )}
     </Box>
-  )
-}
+  );
+};
 
 const PresetMenu = ({
   presets,
@@ -263,14 +288,14 @@ const PresetMenu = ({
   learnMoreLink2,
   onSelect,
 }: {
-  presets: PresetFilter[]
-  learnMoreLink: string
-  learnMoreLabel2?: string
-  learnMoreLink2?: string
-  onSelect: (query: string) => void
+  presets: PresetFilter[];
+  learnMoreLink: string;
+  learnMoreLabel2?: string;
+  learnMoreLink2?: string;
+  onSelect: (query: string) => void;
 }) => {
-  const [isOpen, setIsOpen] = useState(false)
-  const anchorRef = useRef<HTMLButtonElement>(null)
+  const [isOpen, setIsOpen] = useState(false);
+  const anchorRef = useRef<HTMLButtonElement>(null);
 
   return (
     <>
@@ -307,8 +332,8 @@ const PresetMenu = ({
             sx={{ fontSize: 14 }}
             key={presetFilter.name}
             onClick={() => {
-              onSelect(presetFilter.query)
-              setIsOpen(false)
+              onSelect(presetFilter.query);
+              setIsOpen(false);
             }}
           >
             {presetFilter.name}
@@ -321,32 +346,30 @@ const PresetMenu = ({
           target="_blank"
           sx={{ fontSize: 13, fontWeight: 500 }}
           onClick={() => {
-            setIsOpen(false)
+            setIsOpen(false);
           }}
         >
           <OpenInNewOutlined sx={{ fontSize: "14px !important" }} />
           View advanced filtering
         </MenuItem>
         {learnMoreLink2 && learnMoreLabel2 && (
-          <>
-            <MenuItem
-              component="a"
-              href={learnMoreLink2}
-              target="_blank"
-              sx={{ fontSize: 13, fontWeight: 500 }}
-              onClick={() => {
-                setIsOpen(false)
-              }}
-            >
-              <OpenInNewOutlined sx={{ fontSize: "14px !important" }} />
-              {learnMoreLabel2}
-            </MenuItem>
-          </>
+          <MenuItem
+            component="a"
+            href={learnMoreLink2}
+            target="_blank"
+            sx={{ fontSize: 13, fontWeight: 500 }}
+            onClick={() => {
+              setIsOpen(false);
+            }}
+          >
+            <OpenInNewOutlined sx={{ fontSize: "14px !important" }} />
+            {learnMoreLabel2}
+          </MenuItem>
         )}
       </Menu>
     </>
-  )
-}
+  );
+};
 
 export const FilterMenu = <TOption extends BaseOption>({
   id,
@@ -354,17 +377,17 @@ export const FilterMenu = <TOption extends BaseOption>({
   label,
   children,
 }: {
-  menu: ReturnType<typeof useFilterMenu<TOption>>
-  label: ReactNode
-  id: string
-  children: (values: { option: TOption; isSelected: boolean }) => ReactNode
+  menu: ReturnType<typeof useFilterMenu<TOption>>;
+  label: ReactNode;
+  id: string;
+  children: (values: { option: TOption; isSelected: boolean }) => ReactNode;
 }) => {
-  const buttonRef = useRef<HTMLButtonElement>(null)
-  const [isMenuOpen, setIsMenuOpen] = useState(false)
+  const buttonRef = useRef<HTMLButtonElement>(null);
+  const [isMenuOpen, setIsMenuOpen] = useState(false);
 
   const handleClose = () => {
-    setIsMenuOpen(false)
-  }
+    setIsMenuOpen(false);
+  };
 
   return (
     <div>
@@ -394,8 +417,8 @@ export const FilterMenu = <TOption extends BaseOption>({
             key={option.label}
             selected={option.value === menu.selectedOption?.value}
             onClick={() => {
-              menu.selectOption(option)
-              handleClose()
+              menu.selectOption(option);
+              handleClose();
             }}
           >
             {children({
@@ -406,8 +429,8 @@ export const FilterMenu = <TOption extends BaseOption>({
         ))}
       </Menu>
     </div>
-  )
-}
+  );
+};
 
 export const FilterSearchMenu = <TOption extends BaseOption>({
   id,
@@ -415,17 +438,17 @@ export const FilterSearchMenu = <TOption extends BaseOption>({
   label,
   children,
 }: {
-  menu: ReturnType<typeof useFilterMenu<TOption>>
-  label: ReactNode
-  id: string
-  children: (values: { option: TOption; isSelected: boolean }) => ReactNode
+  menu: ReturnType<typeof useFilterMenu<TOption>>;
+  label: ReactNode;
+  id: string;
+  children: (values: { option: TOption; isSelected: boolean }) => ReactNode;
 }) => {
-  const buttonRef = useRef<HTMLButtonElement>(null)
-  const [isMenuOpen, setIsMenuOpen] = useState(false)
+  const buttonRef = useRef<HTMLButtonElement>(null);
+  const [isMenuOpen, setIsMenuOpen] = useState(false);
 
   const handleClose = () => {
-    setIsMenuOpen(false)
-  }
+    setIsMenuOpen(false);
+  };
 
   return (
     <div>
@@ -449,8 +472,8 @@ export const FilterSearchMenu = <TOption extends BaseOption>({
             key={option.label}
             selected={option.value === menu.selectedOption?.value}
             onClick={() => {
-              menu.selectOption(option)
-              handleClose()
+              menu.selectOption(option);
+              handleClose();
             }}
           >
             {children({
@@ -461,14 +484,14 @@ export const FilterSearchMenu = <TOption extends BaseOption>({
         )}
       />
     </div>
-  )
-}
+  );
+};
 
 type OptionItemProps = {
-  option: BaseOption
-  left?: ReactNode
-  isSelected?: boolean
-}
+  option: BaseOption;
+  left?: ReactNode;
+  isSelected?: boolean;
+};
 
 export const OptionItem = ({ option, left, isSelected }: OptionItemProps) => {
   return (
@@ -488,8 +511,8 @@ export const OptionItem = ({ option, left, isSelected }: OptionItemProps) => {
         <CheckOutlined sx={{ width: 16, height: 16, marginLeft: "auto" }} />
       )}
     </Box>
-  )
-}
+  );
+};
 
 const MenuButton = forwardRef<HTMLButtonElement, ButtonProps>((props, ref) => {
   return (
@@ -504,8 +527,8 @@ const MenuButton = forwardRef<HTMLButtonElement, ButtonProps>((props, ref) => {
         ...props.sx,
       }}
     />
-  )
-})
+  );
+});
 
 function SearchMenu<TOption extends { label: string; value: string }>({
   options,
@@ -514,20 +537,20 @@ function SearchMenu<TOption extends { label: string; value: string }>({
   onQueryChange,
   ...menuProps
 }: Pick<MenuProps, "anchorEl" | "open" | "onClose" | "id"> & {
-  options?: TOption[]
-  renderOption: (option: TOption) => ReactNode
-  query: string
-  onQueryChange: (query: string) => void
+  options?: TOption[];
+  renderOption: (option: TOption) => ReactNode;
+  query: string;
+  onQueryChange: (query: string) => void;
 }) {
-  const menuListRef = useRef<HTMLUListElement>(null)
-  const searchInputRef = useRef<HTMLInputElement>(null)
+  const menuListRef = useRef<HTMLUListElement>(null);
+  const searchInputRef = useRef<HTMLInputElement>(null);
 
   return (
     <Menu
       {...menuProps}
       onClose={(event, reason) => {
-        menuProps.onClose && menuProps.onClose(event, reason)
-        onQueryChange("")
+        menuProps.onClose && menuProps.onClose(event, reason);
+        onQueryChange("");
       }}
       sx={{
         "& .MuiPaper-root": {
@@ -553,10 +576,10 @@ function SearchMenu<TOption extends { label: string; value: string }>({
           borderBottom: (theme) => `1px solid ${theme.palette.divider}`,
         }}
         onKeyDown={(e) => {
-          e.stopPropagation()
+          e.stopPropagation();
           if (e.key === "ArrowDown" && menuListRef.current) {
-            const firstItem = menuListRef.current.firstChild as HTMLElement
-            firstItem.focus()
+            const firstItem = menuListRef.current.firstChild as HTMLElement;
+            firstItem.focus();
           }
         }}
       >
@@ -575,7 +598,7 @@ function SearchMenu<TOption extends { label: string; value: string }>({
           value={query}
           ref={searchInputRef}
           onChange={(e) => {
-            onQueryChange(e.target.value)
+            onQueryChange(e.target.value);
           }}
           sx={{
             height: "100%",
@@ -596,9 +619,9 @@ function SearchMenu<TOption extends { label: string; value: string }>({
           ref={menuListRef}
           onKeyDown={(e) => {
             if (e.shiftKey && e.code === "Tab") {
-              e.preventDefault()
-              e.stopPropagation()
-              searchInputRef.current?.focus()
+              e.preventDefault();
+              e.stopPropagation();
+              searchInputRef.current?.focus();
             }
           }}
         >
@@ -623,5 +646,5 @@ function SearchMenu<TOption extends { label: string; value: string }>({
         </MenuList>
       </Box>
     </Menu>
-  )
+  );
 }
diff --git a/site/src/components/Filter/menu.ts b/site/src/components/Filter/menu.ts
index 35dac02a8a93f..fe8c5632d3af9 100644
--- a/site/src/components/Filter/menu.ts
+++ b/site/src/components/Filter/menu.ts
@@ -1,17 +1,17 @@
-import { useMemo, useRef, useState } from "react"
-import { BaseOption } from "./options"
-import { useQuery } from "@tanstack/react-query"
+import { useMemo, useRef, useState } from "react";
+import { BaseOption } from "./options";
+import { useQuery } from "react-query";
 
 export type UseFilterMenuOptions<TOption extends BaseOption> = {
-  id: string
-  value: string | undefined
+  id: string;
+  value: string | undefined;
   // Using null because of react-query
   // https://tanstack.com/query/v4/docs/react/guides/migrating-to-react-query-4#undefined-is-an-illegal-cache-value-for-successful-queries
-  getSelectedOption: () => Promise<TOption | null>
-  getOptions: (query: string) => Promise<TOption[]>
-  onChange: (option: TOption | undefined) => void
-  enabled?: boolean
-}
+  getSelectedOption: () => Promise<TOption | null>;
+  getOptions: (query: string) => Promise<TOption[]>;
+  onChange: (option: TOption | undefined) => void;
+  enabled?: boolean;
+};
 
 export const useFilterMenu = <TOption extends BaseOption = BaseOption>({
   id,
@@ -21,74 +21,74 @@ export const useFilterMenu = <TOption extends BaseOption = BaseOption>({
   onChange,
   enabled,
 }: UseFilterMenuOptions<TOption>) => {
-  const selectedOptionsCacheRef = useRef<Record<string, TOption>>({})
-  const [query, setQuery] = useState("")
+  const selectedOptionsCacheRef = useRef<Record<string, TOption>>({});
+  const [query, setQuery] = useState("");
   const selectedOptionQuery = useQuery({
     queryKey: [id, "autocomplete", "selected", value],
     queryFn: () => {
       if (!value) {
-        return null
+        return null;
       }
 
-      const cachedOption = selectedOptionsCacheRef.current[value]
+      const cachedOption = selectedOptionsCacheRef.current[value];
       if (cachedOption) {
-        return cachedOption
+        return cachedOption;
       }
 
-      return getSelectedOption()
+      return getSelectedOption();
     },
     enabled,
     keepPreviousData: true,
-  })
-  const selectedOption = selectedOptionQuery.data
+  });
+  const selectedOption = selectedOptionQuery.data;
   const searchOptionsQuery = useQuery({
     queryKey: [id, "autocomplete", "search", query],
     queryFn: () => getOptions(query),
     enabled,
-  })
+  });
   const searchOptions = useMemo(() => {
     const isDataLoaded =
-      searchOptionsQuery.isFetched && selectedOptionQuery.isFetched
+      searchOptionsQuery.isFetched && selectedOptionQuery.isFetched;
 
     if (!isDataLoaded) {
-      return undefined
+      return undefined;
     }
 
-    let options = searchOptionsQuery.data ?? []
+    let options = searchOptionsQuery.data ?? [];
 
     if (selectedOption) {
       options = options.filter(
         (option) => option.value !== selectedOption.value,
-      )
-      options = [selectedOption, ...options]
+      );
+      options = [selectedOption, ...options];
     }
 
     options = options.filter(
       (option) =>
         option.label.toLowerCase().includes(query.toLowerCase()) ||
         option.value.toLowerCase().includes(query.toLowerCase()),
-    )
+    );
 
-    return options
+    return options;
   }, [
     selectedOptionQuery.isFetched,
     query,
     searchOptionsQuery.data,
     searchOptionsQuery.isFetched,
     selectedOption,
-  ])
+  ]);
 
   const selectOption = (option: TOption) => {
-    let newSelectedOptionValue: TOption | undefined = option
-    selectedOptionsCacheRef.current[option.value] = option
-    setQuery("")
+    let newSelectedOptionValue: TOption | undefined = option;
+    selectedOptionsCacheRef.current[option.value] = option;
+    setQuery("");
 
     if (option.value === selectedOption?.value) {
-      newSelectedOptionValue = undefined
+      newSelectedOptionValue = undefined;
     }
 
-    onChange(newSelectedOptionValue)
-  }
+    onChange(newSelectedOptionValue);
+  };
 
   return {
     query,
@@ -99,7 +99,7 @@ export const useFilterMenu = <TOption extends BaseOption = BaseOption>({
     isInitializing: selectedOptionQuery.isInitialLoading,
     initialOption: selectedOptionQuery.data,
     isSearching: searchOptionsQuery.isFetching,
-  }
-}
+  };
+};
 
-export type UseFilterMenuResult = ReturnType<typeof useFilterMenu>
+export type UseFilterMenuResult = ReturnType<typeof useFilterMenu>;
diff --git a/site/src/components/Filter/options.ts b/site/src/components/Filter/options.ts
index 6811eeca47ca3..08b71deb88a3a 100644
--- a/site/src/components/Filter/options.ts
+++ b/site/src/components/Filter/options.ts
@@ -1,4 +1,4 @@
 export type BaseOption = {
-  label: string
-  value: string
-}
+  label: string;
+  value: string;
+};
diff --git a/site/src/components/Filter/storyHelpers.ts b/site/src/components/Filter/storyHelpers.ts
index 71e46be51ecbf..6d06cfff99e4c 100644
--- a/site/src/components/Filter/storyHelpers.ts
+++ b/site/src/components/Filter/storyHelpers.ts
@@ -1,6 +1,6 @@
-import { action } from "@storybook/addon-actions"
-import { UseFilterResult } from "./filter"
-import { UseFilterMenuResult } from "./menu"
+import { action } from "@storybook/addon-actions";
+import { UseFilterResult } from "./filter";
+import { UseFilterMenuResult } from "./menu";
 
 export const MockMenu: UseFilterMenuResult = {
   initialOption: undefined,
@@ -11,16 +11,16 @@ export const MockMenu: UseFilterMenuResult = {
   selectedOption: undefined,
   selectOption: action("selectOption"),
   setQuery: action("updateQuery"),
-}
+};
 
 export const getDefaultFilterProps = <TFilterProps>({
   query = "",
   values,
   menus,
 }: {
-  query?: string
-  values: Record<string, string | undefined>
-  menus: Record<string, UseFilterMenuResult>
+  query?: string;
+  values: Record<string, string | undefined>;
+  menus: Record<string, UseFilterMenuResult>;
 }) =>
   ({
     filter: {
@@ -31,4 +31,4 @@ export const getDefaultFilterProps = <TFilterProps>({
       values,
     },
     menus,
-  }) as TFilterProps
+  }) as TFilterProps;
diff --git a/site/src/components/Form/Form.tsx b/site/src/components/Form/Form.tsx
index 0ab0b6c4a5923..92356b38ec1bc 100644
--- a/site/src/components/Form/Form.tsx
+++ b/site/src/components/Form/Form.tsx
@@ -1,40 +1,49 @@
-import { makeStyles } from "@mui/styles"
-import {
-  FormFooterProps as BaseFormFooterProps,
-  FormFooter as BaseFormFooter,
-} from "components/FormFooter/FormFooter"
-import { Stack } from "components/Stack/Stack"
+import { type Interpolation, type Theme, useTheme } from "@emotion/react";
 import {
   createContext,
-  FC,
-  HTMLProps,
-  PropsWithChildren,
+  type FC,
+  type HTMLProps,
+  type PropsWithChildren,
   useContext,
-} from "react"
-import { combineClasses } from "utils/combineClasses"
+} from "react";
+import { AlphaBadge } from "components/DeploySettingsLayout/Badges";
+import { Stack } from "components/Stack/Stack";
+import {
+  FormFooter as BaseFormFooter,
+  FormFooterProps,
+  type FormFooterStyles,
+} from "../FormFooter/FormFooter";
 
-type FormContextValue = { direction?: "horizontal" | "vertical" }
+type FormContextValue = { direction?: "horizontal" | "vertical" };
 
 const FormContext = createContext<FormContextValue>({
   direction: "horizontal",
-})
+});
 
 type FormProps = HTMLProps<HTMLFormElement> & {
-  direction?: FormContextValue["direction"]
-}
+  direction?: FormContextValue["direction"];
+};
 
-export const Form: FC<FormProps> = ({ direction, className, ...formProps }) => {
-  const styles = useStyles({ direction })
+export const Form: FC<FormProps> = ({ direction, ...formProps }) => {
+  const theme = useTheme();
 
   return (
     <FormContext.Provider value={{ direction }}>
       <form
         {...formProps}
-        className={combineClasses([styles.form, className])}
+        css={{
+          display: "flex",
+          flexDirection: "column",
+          gap: theme.spacing(direction === "horizontal" ? 10 : 5),
+
+          [theme.breakpoints.down("md")]: {
+            gap: theme.spacing(8),
+          },
+        }}
       />
     </FormContext.Provider>
-  )
-}
+  );
+};
 
 export const HorizontalForm: FC<HTMLProps<HTMLFormElement>> = ({
   children,
@@ -44,8 +53,8 @@ export const HorizontalForm: FC<HTMLProps<HTMLFormElement>> = ({
     <Form direction="horizontal" {...formProps}>
       {children}
     </Form>
-  )
-}
+  );
+};
 
 export const VerticalForm: FC<HTMLProps<HTMLFormElement>> = ({
   children,
@@ -55,143 +64,122 @@ export const VerticalForm: FC<HTMLProps<HTMLFormElement>> = ({
     <Form direction="vertical" {...formProps}>
       {children}
     </Form>
-  )
-}
+  );
+};
 
 export const FormSection: FC<
   PropsWithChildren & {
-    title: string | JSX.Element
-    description: string | JSX.Element
+    title: string | JSX.Element;
+    description: string | JSX.Element;
     classes?: {
-      root?: string
-      sectionInfo?: string
-      infoTitle?: string
-    }
+      root?: string;
+      sectionInfo?: string;
+      infoTitle?: string;
+    };
+    alpha?: boolean;
   }
-> = ({ children, title, description, classes = {} }) => {
-  const formContext = useContext(FormContext)
-  const styles = useStyles(formContext)
+> = ({ children, title, description, classes = {}, alpha = false }) => {
+  const { direction } = useContext(FormContext);
+  const theme = useTheme();
 
   return (
-    <div className={combineClasses([styles.formSection, classes.root])}>
+    <div
+      css={{
+        display: "flex",
+        alignItems: "flex-start",
+        flexDirection: direction === "horizontal" ? "row" : "column",
+        gap: theme.spacing(direction === "horizontal" ? 15 : 3),
+
+        [theme.breakpoints.down("md")]: {
+          flexDirection: "column",
+          gap: theme.spacing(2),
+        },
+      }}
+      className={classes.root}
+    >
       <div
-        className={combineClasses([
-          classes.sectionInfo,
-          styles.formSectionInfo,
-        ])}
+        css={{
+          width: "100%",
+          maxWidth: direction === "horizontal" ? 312 : undefined,
+          flexShrink: 0,
+          position: direction === "horizontal" ? "sticky" : undefined,
+          top: theme.spacing(3),
+
+          [theme.breakpoints.down("md")]: {
+            width: "100%",
+            position: "initial" as const,
+          },
+        }}
+        className={classes.sectionInfo}
       >
         <h2
-          className={combineClasses([
+          css={[
             styles.formSectionInfoTitle,
-            classes.infoTitle,
-          ])}
+            alpha && styles.formSectionInfoTitleAlpha,
+          ]}
+          className={classes.infoTitle}
         >
           {title}
+          {alpha && <AlphaBadge />}
         </h2>
-        <div className={styles.formSectionInfoDescription}>{description}</div>
+        <div css={styles.formSectionInfoDescription}>{description}</div>
       </div>
 
       {children}
     </div>
-  )
-}
+  );
+};
 
 export const FormFields: FC<PropsWithChildren> = ({ children }) => {
-  const styles = useStyles()
   return (
-    <Stack
-      direction="column"
-      spacing={2.5}
-      className={styles.formSectionFields}
-    >
+    <Stack direction="column" spacing={2.5} css={styles.formSectionFields}>
       {children}
     </Stack>
-  )
-}
-
-export const FormFooter: FC<BaseFormFooterProps> = (props) => {
-  const formFooterStyles = useFormFooterStyles()
-  return (
-    <BaseFormFooter
-      {...props}
-      styles={{ ...formFooterStyles, ...props.styles }}
-    />
-  )
-}
-const getFlexDirection = ({ direction }: FormContextValue = {}):
-  | "row"
-  | "column" =>
-  direction === "horizontal" ? ("row" as const) : ("column" as const)
-
-const useStyles = makeStyles((theme) => ({
-  form: {
-    display: "flex",
-    flexDirection: "column",
-    gap: ({ direction }: FormContextValue = {}) =>
-      direction === "horizontal" ? theme.spacing(10) : theme.spacing(5),
-
-    [theme.breakpoints.down("md")]: {
-      gap: theme.spacing(8),
-    },
-  },
-
-  formSection: {
-    display: "flex",
-    alignItems: "flex-start",
-    gap: ({ direction }: FormContextValue = {}) =>
-      direction === "horizontal" ? theme.spacing(15) : theme.spacing(3),
-    flexDirection: getFlexDirection,
-
-    [theme.breakpoints.down("md")]: {
-      flexDirection: "column",
-      gap: theme.spacing(2),
-    },
-  },
-
-  formSectionInfo: {
-    width: "100%",
-    maxWidth: ({ direction }: FormContextValue = {}) =>
-      direction === "horizontal" ? 312 : undefined,
-    flexShrink: 0,
-    position: ({ direction }: FormContextValue = {}) =>
-      direction === "horizontal" ? "sticky" : undefined,
-    top: theme.spacing(3),
-
-    [theme.breakpoints.down("md")]: {
-      width: "100%",
-      position: "initial" as const,
-    },
-  },
+  );
+};
 
-  formSectionInfoTitle: {
+const styles = {
+  formSectionInfoTitle: (theme) => ({
     fontSize: 20,
     color: theme.palette.text.primary,
     fontWeight: 400,
     margin: 0,
     marginBottom: theme.spacing(1),
-  },
+  }),
 
-  formSectionInfoDescription: {
+  formSectionInfoTitleAlpha: (theme) => ({
+    display: "flex",
+    flexDirection: "row",
+    alignItems: "center",
+    gap: theme.spacing(1.5),
+  }),
+
+  formSectionInfoDescription: (theme) => ({
     fontSize: 14,
     color: theme.palette.text.secondary,
     lineHeight: "160%",
     margin: 0,
-  },
+  }),
 
   formSectionFields: {
     width: "100%",
   },
-}))
+} satisfies Record<string, Interpolation<Theme>>;
 
-const useFormFooterStyles = makeStyles((theme) => ({
-  button: {
+export const FormFooter = (props: Exclude<FormFooterProps, "styles">) => (
+  <BaseFormFooter {...props} styles={footerStyles} />
+);
+
+const footerStyles = {
+  button: (theme) => ({
     minWidth: theme.spacing(23),
 
     [theme.breakpoints.down("md")]: {
       width: "100%",
     },
-  },
-  footer: {
+  }),
+
+  footer: (theme) => ({
     display: "flex",
     alignItems: "center",
     justifyContent: "flex-start",
@@ -202,5 +190,5 @@ const useFormFooterStyles = makeStyles((theme) => ({
       flexDirection: "column",
       gap: theme.spacing(1),
     },
-  },
-}))
+  }),
+} satisfies FormFooterStyles;
diff --git a/site/src/components/FormFooter/FormFooter.stories.tsx b/site/src/components/FormFooter/FormFooter.stories.tsx
index 580105bac26a2..a1c18f8c89a20 100644
--- a/site/src/components/FormFooter/FormFooter.stories.tsx
+++ b/site/src/components/FormFooter/FormFooter.stories.tsx
@@ -1,28 +1,29 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { FormFooter, FormFooterProps } from "./FormFooter"
+import { FormFooter } from "./FormFooter";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
+const meta: Meta<typeof FormFooter> = {
   title: "components/FormFooter",
   component: FormFooter,
-  argTypes: {
-    onCancel: { action: "cancel" },
-  },
-} as ComponentMeta<typeof FormFooter>
+};
 
-const Template: Story<FormFooterProps> = (args) => <FormFooter {...args} />
+export default meta;
+type Story = StoryObj<typeof FormFooter>;
 
-export const Ready = Template.bind({})
-Ready.args = {
-  isLoading: false,
-}
+export const Ready: Story = {
+  args: {
+    isLoading: false,
+  },
+};
 
-export const Custom = Template.bind({})
-Custom.args = {
-  isLoading: false,
-  submitLabel: "Create",
-}
+export const Custom: Story = {
+  args: {
+    isLoading: false,
+    submitLabel: "Create",
+  },
+};
 
-export const Loading = Template.bind({})
-Loading.args = {
-  isLoading: true,
-}
+export const Loading: Story = {
+  args: {
+    isLoading: true,
+  },
+};
diff --git a/site/src/components/FormFooter/FormFooter.tsx b/site/src/components/FormFooter/FormFooter.tsx
index 4641ec4e7e93a..17d1a81d51230 100644
--- a/site/src/components/FormFooter/FormFooter.tsx
+++ b/site/src/components/FormFooter/FormFooter.tsx
@@ -1,21 +1,24 @@
-import Button from "@mui/material/Button"
-import { makeStyles } from "@mui/styles"
-import { ClassNameMap } from "@mui/styles/withStyles"
-import { FC } from "react"
-import { LoadingButton } from "../LoadingButton/LoadingButton"
+import Button from "@mui/material/Button";
+import { type FC } from "react";
+import { Interpolation, Theme } from "@emotion/react";
+import LoadingButton from "@mui/lab/LoadingButton";
 
 export const Language = {
   cancelLabel: "Cancel",
   defaultSubmitLabel: "Submit",
+};
+
+export interface FormFooterStyles {
+  footer: Interpolation<Theme>;
+  button: Interpolation<Theme>;
 }
 
-type FormFooterStyles = ClassNameMap<"footer" | "button">
 export interface FormFooterProps {
-  onCancel: () => void
-  isLoading: boolean
-  styles?: FormFooterStyles
-  submitLabel?: string
-  submitDisabled?: boolean
+  onCancel: () => void;
+  isLoading: boolean;
+  styles?: FormFooterStyles;
+  submitLabel?: string;
+  submitDisabled?: boolean;
 }
 
 export const FormFooter: FC<FormFooterProps> = ({
@@ -23,15 +26,15 @@ export const FormFooter: FC<FormFooterProps> = ({
   isLoading,
   submitDisabled,
   submitLabel = Language.defaultSubmitLabel,
-  styles = defaultStyles(),
+  styles = defaultStyles,
 }) => {
   return (
-    <div className={styles.footer}>
+    <div css={styles.footer}>
       <LoadingButton
         size="large"
         tabIndex={0}
         loading={isLoading}
-        className={styles.button}
+        css={styles.button}
         variant="contained"
         color="primary"
         type="submit"
@@ -43,18 +46,18 @@ export const FormFooter: FC<FormFooterProps> = ({
       <Button
         size="large"
         type="button"
-        className={styles.button}
+        css={styles.button}
         onClick={onCancel}
         tabIndex={0}
       >
         {Language.cancelLabel}
       </Button>
     </div>
-  )
-}
+  );
+};
 
-const defaultStyles = makeStyles((theme) => ({
-  footer: {
+const defaultStyles = {
+  footer: (theme) => ({
     display: "flex",
     flex: "0",
     // The first button is the submit so it is the first element to be focused
@@ -63,8 +66,8 @@ const defaultStyles = makeStyles((theme) => ({
     gap: theme.spacing(1.5),
     alignItems: "center",
     marginTop: theme.spacing(3),
-  },
+  }),
   button: {
     width: "100%",
   },
-}))
+} satisfies FormFooterStyles;
diff --git a/site/src/components/FullPageForm/FullPageForm.stories.tsx b/site/src/components/FullPageForm/FullPageForm.stories.tsx
index bdc8a2da10380..9933c61795b5b 100644
--- a/site/src/components/FullPageForm/FullPageForm.stories.tsx
+++ b/site/src/components/FullPageForm/FullPageForm.stories.tsx
@@ -1,20 +1,15 @@
-import TextField from "@mui/material/TextField"
-import { action } from "@storybook/addon-actions"
-import { ComponentMeta, Story } from "@storybook/react"
-import { FormFooter } from "../FormFooter/FormFooter"
-import { Stack } from "../Stack/Stack"
-import { FullPageForm, FullPageFormProps } from "./FullPageForm"
+import TextField from "@mui/material/TextField";
+import { action } from "@storybook/addon-actions";
+import { FormFooter } from "../FormFooter/FormFooter";
+import { Stack } from "../Stack/Stack";
+import { FullPageForm, FullPageFormProps } from "./FullPageForm";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "components/FullPageForm",
-  component: FullPageForm,
-} as ComponentMeta<typeof FullPageForm>
-
-const Template: Story<FullPageFormProps> = (args) => (
-  <FullPageForm {...args}>
+const Template = (props: FullPageFormProps) => (
+  <FullPageForm {...props}>
     <form
       onSubmit={(e) => {
-        e.preventDefault()
+        e.preventDefault();
       }}
     >
       <Stack>
@@ -24,10 +19,21 @@ const Template: Story<FullPageFormProps> = (args) => (
       </Stack>
     </form>
   </FullPageForm>
-)
+);
+
+const meta: Meta<typeof FullPageForm> = {
+  title: "components/FullPageForm",
+  component: Template,
+};
+
+export default meta;
+type Story = StoryObj<typeof FullPageForm>;
+
+const Example: Story = {
+  args: {
+    title: "My Form",
+    detail: "Lorem ipsum dolor",
+  },
+};
 
-export const Example = Template.bind({})
-Example.args = {
-  title: "My Form",
-  detail: "Lorem ipsum dolor",
-}
+export { Example as FullPageForm };
diff --git a/site/src/components/FullPageForm/FullPageForm.tsx b/site/src/components/FullPageForm/FullPageForm.tsx
index 2d27f33795462..9e8163dceef4e 100644
--- a/site/src/components/FullPageForm/FullPageForm.tsx
+++ b/site/src/components/FullPageForm/FullPageForm.tsx
@@ -1,15 +1,15 @@
-import { Margins } from "components/Margins/Margins"
-import { FC, ReactNode } from "react"
+import { Margins } from "components/Margins/Margins";
+import { type FC, type ReactNode } from "react";
 import {
   PageHeader,
   PageHeaderTitle,
   PageHeaderSubtitle,
-} from "components/PageHeader/PageHeader"
-import { makeStyles } from "@mui/styles"
+} from "components/PageHeader/PageHeader";
+import { useTheme } from "@emotion/react";
 
 export interface FullPageFormProps {
-  title: string
-  detail?: ReactNode
+  title: string;
+  detail?: ReactNode;
 }
 
 export const FullPageForm: FC<React.PropsWithChildren<FullPageFormProps>> = ({
@@ -17,22 +17,16 @@ export const FullPageForm: FC<React.PropsWithChildren<FullPageFormProps>> = ({
   detail,
   children,
 }) => {
-  const styles = useStyles()
+  const theme = useTheme();
 
   return (
     <Margins size="small">
-      <PageHeader className={styles.pageHeader}>
+      <PageHeader css={{ paddingBottom: theme.spacing(3) }}>
         <PageHeaderTitle>{title}</PageHeaderTitle>
         {detail && <PageHeaderSubtitle>{detail}</PageHeaderSubtitle>}
       </PageHeader>
 
       <main>{children}</main>
     </Margins>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  pageHeader: {
-    paddingBottom: theme.spacing(3),
-  },
-}))
+  );
+};
diff --git a/site/src/components/FullPageForm/FullPageHorizontalForm.tsx b/site/src/components/FullPageForm/FullPageHorizontalForm.tsx
index 175ae224e1a3a..aa85e14dc88b4 100644
--- a/site/src/components/FullPageForm/FullPageHorizontalForm.tsx
+++ b/site/src/components/FullPageForm/FullPageHorizontalForm.tsx
@@ -1,16 +1,16 @@
-import { Margins } from "components/Margins/Margins"
-import { FC, ReactNode } from "react"
+import { Margins } from "components/Margins/Margins";
+import { FC, ReactNode } from "react";
 import {
   PageHeader,
   PageHeaderTitle,
   PageHeaderSubtitle,
-} from "components/PageHeader/PageHeader"
-import Button from "@mui/material/Button"
+} from "components/PageHeader/PageHeader";
+import Button from "@mui/material/Button";
 
 export interface FullPageHorizontalFormProps {
-  title: string
-  detail?: ReactNode
-  onCancel?: () => void
+  title: string;
+  detail?: ReactNode;
+  onCancel?: () => void;
 }
 
 export const FullPageHorizontalForm: FC<
@@ -33,5 +33,5 @@ export const FullPageHorizontalForm: FC<
 
       <main>{children}</main>
     </Margins>
-  )
-}
+  );
+};
diff --git a/site/src/components/GitAuth/GitAuth.stories.tsx b/site/src/components/GitAuth/GitAuth.stories.tsx
deleted file mode 100644
index cda012212d14d..0000000000000
--- a/site/src/components/GitAuth/GitAuth.stories.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-import { Story } from "@storybook/react"
-import { GitAuth, GitAuthProps } from "./GitAuth"
-
-export default {
-  title: "components/GitAuth",
-  component: GitAuth,
-}
-
-const Template: Story<GitAuthProps> = (args) => <GitAuth {...args} />
-
-export const GithubNotAuthenticated = Template.bind({})
-GithubNotAuthenticated.args = {
-  type: "github",
-  authenticated: false,
-}
-
-export const GithubAuthenticated = Template.bind({})
-GithubAuthenticated.args = {
-  type: "github",
-  authenticated: true,
-}
-
-export const GitlabNotAuthenticated = Template.bind({})
-GitlabNotAuthenticated.args = {
-  type: "gitlab",
-  authenticated: false,
-}
-
-export const GitlabAuthenticated = Template.bind({})
-GitlabAuthenticated.args = {
-  type: "gitlab",
-  authenticated: true,
-}
-
-export const AzureDevOpsNotAuthenticated = Template.bind({})
-AzureDevOpsNotAuthenticated.args = {
-  type: "azure-devops",
-  authenticated: false,
-}
-
-export const AzureDevOpsAuthenticated = Template.bind({})
-AzureDevOpsAuthenticated.args = {
-  type: "azure-devops",
-  authenticated: true,
-}
-
-export const BitbucketNotAuthenticated = Template.bind({})
-BitbucketNotAuthenticated.args = {
-  type: "bitbucket",
-  authenticated: false,
-}
-
-export const BitbucketAuthenticated = Template.bind({})
-BitbucketAuthenticated.args = {
-  type: "bitbucket",
-  authenticated: true,
-}
diff --git a/site/src/components/GitAuth/GitAuth.tsx b/site/src/components/GitAuth/GitAuth.tsx
deleted file mode 100644
index b5b553242e283..0000000000000
--- a/site/src/components/GitAuth/GitAuth.tsx
+++ /dev/null
@@ -1,93 +0,0 @@
-import Button from "@mui/material/Button"
-import FormHelperText from "@mui/material/FormHelperText"
-import { SvgIconProps } from "@mui/material/SvgIcon"
-import Tooltip from "@mui/material/Tooltip"
-import GitHub from "@mui/icons-material/GitHub"
-import * as TypesGen from "api/typesGenerated"
-import { AzureDevOpsIcon } from "components/Icons/AzureDevOpsIcon"
-import { BitbucketIcon } from "components/Icons/BitbucketIcon"
-import { GitlabIcon } from "components/Icons/GitlabIcon"
-import { FC } from "react"
-import { makeStyles } from "@mui/styles"
-
-export interface GitAuthProps {
-  type: TypesGen.GitProvider
-  authenticated: boolean
-  authenticateURL: string
-  error?: string
-}
-
-export const GitAuth: FC<GitAuthProps> = ({
-  type,
-  authenticated,
-  authenticateURL,
-  error,
-}) => {
-  const styles = useStyles({
-    error: typeof error !== "undefined",
-  })
-
-  let prettyName: string
-  let Icon: (props: SvgIconProps) => JSX.Element
-  switch (type) {
-    case "azure-devops":
-      prettyName = "Azure DevOps"
-      Icon = AzureDevOpsIcon
-      break
-    case "bitbucket":
-      prettyName = "Bitbucket"
-      Icon = BitbucketIcon
-      break
-    case "github":
-      prettyName = "GitHub"
-      Icon = GitHub as (props: SvgIconProps) => JSX.Element
-      break
-    case "gitlab":
-      prettyName = "GitLab"
-      Icon = GitlabIcon
-      break
-    default:
-      throw new Error("invalid git provider: " + type)
-  }
-
-  return (
-    <Tooltip
-      title={
-        authenticated ? "You're already authenticated! No action needed." : ``
-      }
-    >
-      <div>
-        <Button
-          href={authenticateURL}
-          variant="contained"
-          size="large"
-          startIcon={<Icon />}
-          disabled={authenticated}
-          className={styles.button}
-          color={error ? "error" : undefined}
-          fullWidth
-          onClick={(event) => {
-            event.preventDefault()
-            // If the user is already authenticated, we don't want to redirect them
-            if (authenticated || authenticateURL === "") {
-              return
-            }
-            window.open(authenticateURL, "_blank", "width=900,height=600")
-          }}
-        >
-          {authenticated
-            ? `You're authenticated with ${prettyName}!`
-            : `Click to login with ${prettyName}!`}
-        </Button>
-
-        {error && <FormHelperText error>{error}</FormHelperText>}
-      </div>
-    </Tooltip>
-  )
-}
-
-const useStyles = makeStyles(() => ({
-  button: {
-    height: 52,
-  },
-}))
diff --git a/site/src/components/GlobalSnackbar/EnterpriseSnackbar.stories.tsx b/site/src/components/GlobalSnackbar/EnterpriseSnackbar.stories.tsx
new file mode 100644
index 0000000000000..ec5a5b5086b7a
--- /dev/null
+++ b/site/src/components/GlobalSnackbar/EnterpriseSnackbar.stories.tsx
@@ -0,0 +1,35 @@
+import { EnterpriseSnackbar } from "./EnterpriseSnackbar";
+
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof EnterpriseSnackbar> = {
+  title: "components/EnterpriseSnackbar",
+  component: EnterpriseSnackbar,
+};
+
+export default meta;
+type Story = StoryObj<typeof EnterpriseSnackbar>;
+
+export const Error: Story = {
+  args: {
+    variant: "error",
+    open: true,
+    message: "Oops, something wrong happened.",
+  },
+};
+
+export const Info: Story = {
+  args: {
+    variant: "info",
+    open: true,
+    message: "Hey, something happened.",
+  },
+};
+
+export const Success: Story = {
+  args: {
+    variant: "success",
+    open: true,
+    message: "Hey, something good happened.",
+  },
+};
diff --git a/site/src/components/GlobalSnackbar/EnterpriseSnackbar.tsx b/site/src/components/GlobalSnackbar/EnterpriseSnackbar.tsx
new file mode 100644
index 0000000000000..b39edb1209bd9
--- /dev/null
+++ b/site/src/components/GlobalSnackbar/EnterpriseSnackbar.tsx
@@ -0,0 +1,91 @@
+import IconButton from "@mui/material/IconButton";
+import Snackbar, {
+  SnackbarProps as MuiSnackbarProps,
+} from "@mui/material/Snackbar";
+import CloseIcon from "@mui/icons-material/Close";
+import { type FC } from "react";
+import { css } from "@emotion/css";
+import { type Interpolation, type Theme, useTheme } from "@emotion/react";
+
+type EnterpriseSnackbarVariant = "error" | "info" | "success";
+
+export interface EnterpriseSnackbarProps extends MuiSnackbarProps {
+  /** Called when the snackbar should close, either from timeout or clicking close */
+  onClose: () => void;
+  /** Variant of snackbar, for theming */
+  variant?: EnterpriseSnackbarVariant;
+}
+
+/**
+ * Wrapper around Material UI's Snackbar component, provides pre-configured
+ * themes and convenience props. Coder UI's Snackbars require a close handler,
+ * since they always render a close button.
+ *
+ * Snackbars do _not_ automatically appear in the top-level position when
+ * rendered, you'll need to use ReactDom portals or the Material UI Portal
+ * component for that.
+ *
+ * See original component's Material UI documentation here: https://material-ui.com/components/snackbars/
+ */
+export const EnterpriseSnackbar: FC<
+  React.PropsWithChildren<EnterpriseSnackbarProps>
+> = ({ onClose, variant = "info", ContentProps = {}, action, ...rest }) => {
+  const theme = useTheme();
+
+  const snackbarContentStyles = css`
+    border: 1px solid ${theme.palette.divider};
+    border-left: 4px solid ${variantColor(variant, theme)};
+    border-radius: ${theme.shape.borderRadius}px;
+    padding: ${theme.spacing(1, 3, 1, 2)};
+    box-shadow: ${theme.shadows[6]};
+    align-items: inherit;
+    background-color: ${theme.palette.background.paper};
+    color: ${theme.palette.text.secondary};
+  `;
+
+  return (
+    <Snackbar
+      anchorOrigin={{
+        vertical: "bottom",
+        horizontal: "right",
+      }}
+      {...rest}
+      action={
+        <div css={styles.actionWrapper}>
+          {action}
+          <IconButton onClick={onClose} css={{ padding: 0 }} size="large">
+            <CloseIcon css={styles.closeIcon} aria-label="close" />
+          </IconButton>
+        </div>
+      }
+      ContentProps={{
+        ...ContentProps,
+        className: snackbarContentStyles,
+      }}
+      onClose={onClose}
+    />
+  );
+};
+
+const variantColor = (variant: EnterpriseSnackbarVariant, theme: Theme) => {
+  switch (variant) {
+    case "error":
+      return theme.palette.error.main;
+    case "info":
+      return theme.palette.info.main;
+    case "success":
+      return theme.palette.success.main;
+  }
+};
+
+const styles = {
+  actionWrapper: {
+    display: "flex",
+    alignItems: "center",
+  },
+  closeIcon: (theme) => ({
+    width: 25,
+    height: 25,
+    color: theme.palette.primary.contrastText,
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/components/GlobalSnackbar/GlobalSnackbar.tsx b/site/src/components/GlobalSnackbar/GlobalSnackbar.tsx
index 6287918045167..d521812316468 100644
--- a/site/src/components/GlobalSnackbar/GlobalSnackbar.tsx
+++ b/site/src/components/GlobalSnackbar/GlobalSnackbar.tsx
@@ -1,44 +1,43 @@
-import { makeStyles } from "@mui/styles"
-import { useCallback, useState, FC } from "react"
-import { useCustomEvent } from "../../hooks/events"
-import { CustomEventListener } from "../../utils/events"
-import { EnterpriseSnackbar } from "../EnterpriseSnackbar/EnterpriseSnackbar"
-import { ErrorIcon } from "../Icons/ErrorIcon"
-import { Typography } from "../Typography/Typography"
+import { type FC, useCallback, useState } from "react";
+import { useCustomEvent } from "hooks/events";
+import type { CustomEventListener } from "utils/events";
+import { EnterpriseSnackbar } from "./EnterpriseSnackbar";
+import { ErrorIcon } from "../Icons/ErrorIcon";
+import { Typography } from "../Typography/Typography";
 import {
-  AdditionalMessage,
+  type AdditionalMessage,
   isNotificationList,
   isNotificationText,
   isNotificationTextPrefixed,
   MsgType,
-  NotificationMsg,
+  type NotificationMsg,
   SnackbarEventType,
-} from "./utils"
+} from "./utils";
+import { type Interpolation, type Theme } from "@emotion/react";
 
 const variantFromMsgType = (type: MsgType) => {
   if (type === MsgType.Error) {
-    return "error"
+    return "error";
   } else if (type === MsgType.Success) {
-    return "success"
+    return "success";
   } else {
-    return "info"
+    return "info";
   }
-}
+};
 
 export const GlobalSnackbar: FC = () => {
-  const styles = useStyles()
-  const [open, setOpen] = useState<boolean>(false)
-  const [notification, setNotification] = useState<NotificationMsg>()
+  const [open, setOpen] = useState<boolean>(false);
+  const [notification, setNotification] = useState<NotificationMsg>();
 
   const handleNotification = useCallback<CustomEventListener<NotificationMsg>>(
     (event) => {
-      setNotification(event.detail)
-      setOpen(true)
+      setNotification(event.detail);
+      setOpen(true);
     },
     [],
-  )
+  );
 
-  useCustomEvent(SnackbarEventType, handleNotification)
+  useCustomEvent(SnackbarEventType, handleNotification);
 
   const renderAdditionalMessage = (msg: AdditionalMessage, idx: number) => {
     if (isNotificationText(msg)) {
@@ -47,40 +46,40 @@ export const GlobalSnackbar: FC = () => {
           key={idx}
           gutterBottom
           variant="body2"
-          className={styles.messageSubtitle}
+          css={styles.messageSubtitle}
         >
           {msg}
         </Typography>
-      )
+      );
     } else if (isNotificationTextPrefixed(msg)) {
       return (
         <Typography
           key={idx}
           gutterBottom
           variant="body2"
-          className={styles.messageSubtitle}
+          css={styles.messageSubtitle}
         >
           <strong>{msg.prefix}:</strong> {msg.text}
         </Typography>
-      )
+      );
     } else if (isNotificationList(msg)) {
       return (
-        <ul className={styles.list} key={idx}>
+        <ul css={styles.list} key={idx}>
           {msg.map((item, idx) => (
             <li key={idx}>
-              <Typography variant="body2" className={styles.messageSubtitle}>
+              <Typography variant="body2" css={styles.messageSubtitle}>
                 {item}
               </Typography>
             </li>
           ))}
         </ul>
-      )
+      );
     }
-    return null
-  }
+    return null;
+  };
 
   if (!notification) {
-    return null
+    return null;
   }
 
   return (
@@ -89,12 +88,12 @@ export const GlobalSnackbar: FC = () => {
       open={open}
       variant={variantFromMsgType(notification.msgType)}
       message={
-        <div className={styles.messageWrapper}>
+        <div css={styles.messageWrapper}>
           {notification.msgType === MsgType.Error && (
-            <ErrorIcon className={styles.errorIcon} />
+            <ErrorIcon css={styles.errorIcon} />
           )}
-          <div className={styles.message}>
-            <Typography variant="body1" className={styles.messageTitle}>
+          <div css={styles.message}>
+            <Typography variant="body1" css={styles.messageTitle}>
               {notification.msg}
             </Typography>
             {notification.additionalMsgs &&
@@ -109,10 +108,10 @@ export const GlobalSnackbar: FC = () => {
         horizontal: "right",
       }}
     />
-  )
-}
+  );
+};
 
-const useStyles = makeStyles((theme) => ({
+const styles = {
   list: {
     paddingLeft: 0,
   },
@@ -126,11 +125,11 @@ const useStyles = makeStyles((theme) => ({
     fontSize: 14,
     fontWeight: 600,
   },
-  messageSubtitle: {
+  messageSubtitle: (theme) => ({
     marginTop: theme.spacing(1.5),
-  },
-  errorIcon: {
+  }),
+  errorIcon: (theme) => ({
     color: theme.palette.error.contrastText,
     marginRight: theme.spacing(2),
-  },
-}))
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/components/GlobalSnackbar/utils.test.ts b/site/src/components/GlobalSnackbar/utils.test.ts
index bd2806c2dcc3a..5fae4407e93d8 100644
--- a/site/src/components/GlobalSnackbar/utils.test.ts
+++ b/site/src/components/GlobalSnackbar/utils.test.ts
@@ -6,52 +6,52 @@ import {
   NotificationMsg,
   NotificationTextPrefixed,
   SnackbarEventType,
-} from "./utils"
+} from "./utils";
 
 describe("Snackbar", () => {
   describe("isNotificationTextPrefixed", () => {
     // Regression test for case found in #10436
     it("does not crash on null values", () => {
       // Given
-      const msg = null
+      const msg = null;
 
       // When
-      const isTextPrefixed = isNotificationTextPrefixed(msg)
+      const isTextPrefixed = isNotificationTextPrefixed(msg);
 
       // Then
-      expect(isTextPrefixed).toBe(false)
-    })
+      expect(isTextPrefixed).toBe(false);
+    });
     it("returns true if prefixed", () => {
       // Given
       const msg: NotificationTextPrefixed = {
         prefix: "warning",
         text: "careful with this workspace",
-      }
+      };
 
       // When
-      const isTextPrefixed = isNotificationTextPrefixed(msg)
+      const isTextPrefixed = isNotificationTextPrefixed(msg);
 
       // Then
-      expect(isTextPrefixed).toBe(true)
-    })
+      expect(isTextPrefixed).toBe(true);
+    });
     it("returns false if not prefixed", () => {
       // Given
-      const msg = "plain ol' message"
+      const msg = "plain ol' message";
 
       // When
-      const isTextPrefixed = isNotificationTextPrefixed(msg)
+      const isTextPrefixed = isNotificationTextPrefixed(msg);
 
       // Then
-      expect(isTextPrefixed).toBe(false)
-    })
-  })
+      expect(isTextPrefixed).toBe(false);
+    });
+  });
 
   describe("displaySuccess", () => {
-    const originalWindowDispatchEvent = window.dispatchEvent
+    const originalWindowDispatchEvent = window.dispatchEvent;
     type TDispatchEventMock = jest.MockedFunction<
       (msg: CustomEvent<NotificationMsg>) => boolean
-    >
-    let dispatchEventMock: TDispatchEventMock
+    >;
+    let dispatchEventMock: TDispatchEventMock;
 
     // Helper function to extract the notification event
     // that was sent to `dispatchEvent`. This lets us validate
@@ -63,18 +63,18 @@ describe("Snackbar", () => {
       // calls[0][0] is the first argument of the first call
       // calls[0][0].detail is the 'detail' argument passed to the `CustomEvent` -
       // this is the `NotificationMsg` object that gets sent to `dispatchEvent`
-      return dispatchEventMock.mock.calls[0][0].detail
-    }
+      return dispatchEventMock.mock.calls[0][0].detail;
+    };
 
     beforeEach(() => {
-      dispatchEventMock = jest.fn()
+      dispatchEventMock = jest.fn();
       window.dispatchEvent =
-        dispatchEventMock as unknown as typeof window.dispatchEvent
-    })
+        dispatchEventMock as unknown as typeof window.dispatchEvent;
+    });
 
     afterEach(() => {
-      window.dispatchEvent = originalWindowDispatchEvent
-    })
+      window.dispatchEvent = originalWindowDispatchEvent;
+    });
 
     it("can be called with only a title", () => {
       // Given
@@ -82,17 +82,17 @@ describe("Snackbar", () => {
         msgType: MsgType.Success,
         msg: "Test",
         additionalMsgs: undefined,
-      }
+      };
 
       // When
-      displaySuccess("Test")
+      displaySuccess("Test");
 
       // Then
-      expect(dispatchEventMock).toBeCalledTimes(1)
+      expect(dispatchEventMock).toBeCalledTimes(1);
       expect(extractNotificationEvent(dispatchEventMock)).toStrictEqual(
         expected,
-      )
-    })
+      );
+    });
 
     it("can be called with a title and additional message", () => {
       // Given
@@ -100,30 +100,30 @@ describe("Snackbar", () => {
         msgType: MsgType.Success,
         msg: "Test",
         additionalMsgs: ["additional message"],
-      }
+      };
 
       // When
-      displaySuccess("Test", "additional message")
+      displaySuccess("Test", "additional message");
 
       // Then
-      expect(dispatchEventMock).toBeCalledTimes(1)
+      expect(dispatchEventMock).toBeCalledTimes(1);
       expect(extractNotificationEvent(dispatchEventMock)).toStrictEqual(
         expected,
-      )
-    })
-  })
+      );
+    });
+  });
 
   describe("displayError", () => {
     it("shows the title and the message", (done) => {
-      const message = "Some error happened"
+      const message = "Some error happened";
 
       window.addEventListener(SnackbarEventType, (event) => {
-        const notificationEvent = event as CustomEvent<NotificationMsg>
-        expect(notificationEvent.detail.msg).toEqual(message)
-        done()
-      })
-
-      displayError(message)
-    })
-  })
-})
+        const notificationEvent = event as CustomEvent<NotificationMsg>;
+        expect(notificationEvent.detail.msg).toEqual(message);
+        done();
+      });
+
+      displayError(message);
+    });
+  });
+});
diff --git a/site/src/components/GlobalSnackbar/utils.ts b/site/src/components/GlobalSnackbar/utils.ts
index 03daf29b888ee..37e04050f9a71 100644
--- a/site/src/components/GlobalSnackbar/utils.ts
+++ b/site/src/components/GlobalSnackbar/utils.ts
@@ -1,4 +1,4 @@
-import { dispatchCustomEvent } from "../../utils/events"
+import { dispatchCustomEvent } from "utils/events";
 
 ///////////////////////////////////////////////////////////////////////////////
 // Notification Types
@@ -14,15 +14,15 @@ export enum MsgType {
  * Display a prefixed paragraph inside a notification.
  */
 export type NotificationTextPrefixed = {
-  prefix: string
-  text: string
-}
+  prefix: string;
+  text: string;
+};
 
-export type AdditionalMessage = NotificationTextPrefixed | string[] | string
+export type AdditionalMessage = NotificationTextPrefixed | string[] | string;
 
 export const isNotificationText = (msg: AdditionalMessage): msg is string => {
-  return !Array.isArray(msg) && typeof msg === "string"
-}
+  return !Array.isArray(msg) && typeof msg === "string";
+};
 
 export const isNotificationTextPrefixed = (
   msg: AdditionalMessage | null,
@@ -31,22 +31,22 @@ export const isNotificationTextPrefixed = (
     return (
       typeof msg !== "string" &&
       Object.prototype.hasOwnProperty.call(msg, "prefix")
-    )
+    );
   }
-  return false
-}
+  return false;
+};
 
 export const isNotificationList = (msg: AdditionalMessage): msg is string[] => {
-  return Array.isArray(msg)
-}
+  return Array.isArray(msg);
+};
 
 export interface NotificationMsg {
-  msgType: MsgType
-  msg: string
-  additionalMsgs?: AdditionalMessage[]
+  msgType: MsgType;
+  msg: string;
+  additionalMsgs?: AdditionalMessage[];
 }
 
-export const SnackbarEventType = "coder:notification"
+export const SnackbarEventType = "coder:notification";
 
 ///////////////////////////////////////////////////////////////////////////////
 // Notification Functions
@@ -61,7 +61,7 @@ function dispatchNotificationEvent(
     msgType,
     msg,
     additionalMsgs,
-  })
+  });
 }
 
 export const displaySuccess = (msg: string, additionalMsg?: string): void => {
@@ -69,13 +69,13 @@ export const displaySuccess = (msg: string, additionalMsg?: string): void => {
     MsgType.Success,
     msg,
     additionalMsg ? [additionalMsg] : undefined,
-  )
-}
+  );
+};
 
 export const displayError = (msg: string, additionalMsg?: string): void => {
   dispatchNotificationEvent(
     MsgType.Error,
     msg,
     additionalMsg ? [additionalMsg] : undefined,
-  )
-}
+  );
+};
diff --git a/site/src/components/GroupAvatar/GroupAvatar.stories.tsx b/site/src/components/GroupAvatar/GroupAvatar.stories.tsx
index 8fda557362fce..9f0d1e2232471 100644
--- a/site/src/components/GroupAvatar/GroupAvatar.stories.tsx
+++ b/site/src/components/GroupAvatar/GroupAvatar.stories.tsx
@@ -1,15 +1,19 @@
-import { Story } from "@storybook/react"
-import { GroupAvatar, GroupAvatarProps } from "./GroupAvatar"
+import { GroupAvatar } from "./GroupAvatar";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
+const meta: Meta<typeof GroupAvatar> = {
   title: "components/GroupAvatar",
   component: GroupAvatar,
-}
+};
 
-const Template: Story<GroupAvatarProps> = (args) => <GroupAvatar {...args} />
+export default meta;
+type Story = StoryObj<typeof GroupAvatar>;
 
-export const Example = Template.bind({})
-Example.args = {
-  name: "My Group",
-  avatarURL: "",
-}
+const Example: Story = {
+  args: {
+    name: "My Group",
+    avatarURL: "",
+  },
+};
+
+export { Example as GroupAvatar };
diff --git a/site/src/components/GroupAvatar/GroupAvatar.tsx b/site/src/components/GroupAvatar/GroupAvatar.tsx
index 8b08481a670b3..1f4cbc0347807 100644
--- a/site/src/components/GroupAvatar/GroupAvatar.tsx
+++ b/site/src/components/GroupAvatar/GroupAvatar.tsx
@@ -1,8 +1,8 @@
-import { Avatar } from "components/Avatar/Avatar"
-import Badge from "@mui/material/Badge"
-import { withStyles } from "@mui/styles"
-import Group from "@mui/icons-material/Group"
-import { FC } from "react"
+import { Avatar } from "components/Avatar/Avatar";
+import Badge from "@mui/material/Badge";
+import { withStyles } from "@mui/styles";
+import Group from "@mui/icons-material/Group";
+import { FC } from "react";
 
 const StyledBadge = withStyles((theme) => ({
   badge: {
@@ -20,12 +20,12 @@ const StyledBadge = withStyles((theme) => ({
       height: 14,
     },
   },
-}))(Badge)
+}))(Badge);
 
 export type GroupAvatarProps = {
-  name: string
-  avatarURL?: string
-}
+  name: string;
+  avatarURL?: string;
+};
 
 export const GroupAvatar: FC<GroupAvatarProps> = ({ name, avatarURL }) => {
   return (
@@ -39,5 +39,5 @@ export const GroupAvatar: FC<GroupAvatarProps> = ({ name, avatarURL }) => {
     >
       <Avatar src={avatarURL}>{name}</Avatar>
     </StyledBadge>
-  )
-}
+  );
+};
diff --git a/site/src/components/HelpTooltip/HelpTooltip.stories.tsx b/site/src/components/HelpTooltip/HelpTooltip.stories.tsx
new file mode 100644
index 0000000000000..b009727750684
--- /dev/null
+++ b/site/src/components/HelpTooltip/HelpTooltip.stories.tsx
@@ -0,0 +1,38 @@
+import {
+  HelpTooltip,
+  HelpTooltipLink,
+  HelpTooltipLinksGroup,
+  HelpTooltipText,
+  HelpTooltipTitle,
+} from "./HelpTooltip";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof HelpTooltip> = {
+  title: "components/HelpTooltip",
+  component: HelpTooltip,
+  args: {
+    children: (
+      <>
+        <HelpTooltipTitle>What is a template?</HelpTooltipTitle>
+        <HelpTooltipText>
+          A template is a common configuration for your team&apos;s workspaces.
+        </HelpTooltipText>
+        <HelpTooltipLinksGroup>
+          <HelpTooltipLink href="https://github.com/coder/coder/">
+            Creating a template
+          </HelpTooltipLink>
+          <HelpTooltipLink href="https://github.com/coder/coder/">
+            Updating a template
+          </HelpTooltipLink>
+        </HelpTooltipLinksGroup>
+      </>
+    ),
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof HelpTooltip>;
+
+const Example: Story = {};
+
+export { Example as HelpTooltip };
diff --git a/site/src/components/HelpTooltip/HelpTooltip.tsx b/site/src/components/HelpTooltip/HelpTooltip.tsx
new file mode 100644
index 0000000000000..b79babde64700
--- /dev/null
+++ b/site/src/components/HelpTooltip/HelpTooltip.tsx
@@ -0,0 +1,289 @@
+import Link from "@mui/material/Link";
+// This is used as base for the main HelpTooltip component
+// eslint-disable-next-line no-restricted-imports -- Read above
+import Popover, { PopoverProps } from "@mui/material/Popover";
+import HelpIcon from "@mui/icons-material/HelpOutline";
+import OpenInNewIcon from "@mui/icons-material/OpenInNew";
+import {
+  createContext,
+  useContext,
+  useRef,
+  useState,
+  FC,
+  PropsWithChildren,
+} from "react";
+import { Stack } from "components/Stack/Stack";
+import Box, { BoxProps } from "@mui/material/Box";
+import { type CSSObject, css as className } from "@emotion/css";
+import { css, type Interpolation, type Theme, useTheme } from "@emotion/react";
+
+type Icon = typeof HelpIcon;
+
+type Size = "small" | "medium";
+export interface HelpTooltipProps {
+  // Useful to test on storybook
+  open?: boolean;
+  size?: Size;
+  icon?: Icon;
+  iconClassName?: string;
+  buttonClassName?: string;
+}
+
+export const HelpTooltipContext = createContext<
+  { open: boolean; onClose: () => void } | undefined
+>(undefined);
+
+const useHelpTooltip = () => {
+  const helpTooltipContext = useContext(HelpTooltipContext);
+
+  if (!helpTooltipContext) {
+    throw new Error(
+      "This hook should be used in side of the HelpTooltipContext.",
+    );
+  }
+
+  return helpTooltipContext;
+};
+
+export const HelpPopover: FC<
+  PopoverProps & { onOpen: () => void; onClose: () => void }
+> = ({ onOpen, onClose, children, ...props }) => {
+  const theme = useTheme();
+
+  return (
+    <Popover
+      className={className`
+        pointer-events: none;
+      `}
+      classes={{
+        paper: className`
+          ${theme.typography.body2 as CSSObject}
+
+          margin-top: ${theme.spacing(0.5)};
+          width: ${theme.spacing(38)};
+          padding: ${theme.spacing(2.5)};
+          color: ${theme.palette.text.secondary};
+          pointer-events: auto;
+        `,
+      }}
+      onClose={onClose}
+      anchorOrigin={{
+        vertical: "bottom",
+        horizontal: "left",
+      }}
+      transformOrigin={{
+        vertical: "top",
+        horizontal: "left",
+      }}
+      PaperProps={{
+        onMouseEnter: onOpen,
+        onMouseLeave: onClose,
+      }}
+      {...props}
+    >
+      {children}
+    </Popover>
+  );
+};
+
+export const HelpTooltip: FC<PropsWithChildren<HelpTooltipProps>> = ({
+  children,
+  open = false,
+  size = "medium",
+  icon: Icon = HelpIcon,
+  iconClassName,
+  buttonClassName,
+}) => {
+  const theme = useTheme();
+  const anchorRef = useRef<HTMLButtonElement>(null);
+  const [isOpen, setIsOpen] = useState(open);
+  const id = isOpen ? "help-popover" : undefined;
+
+  const onClose = () => {
+    setIsOpen(false);
+  };
+
+  return (
+    <>
+      <button
+        ref={anchorRef}
+        aria-describedby={id}
+        css={css`
+          display: flex;
+          align-items: center;
+          justify-content: center;
+          width: ${theme.spacing(getButtonSpacingFromSize(size))};
+          height: ${theme.spacing(getButtonSpacingFromSize(size))};
+          padding: 0;
+          border: 0;
+          background: transparent;
+          color: ${theme.palette.text.primary};
+          opacity: 0.5;
+          cursor: pointer;
+
+          &:hover {
+            opacity: 0.75;
+          }
+        `}
+        className={buttonClassName}
+        onClick={(event) => {
+          event.stopPropagation();
+          setIsOpen(true);
+        }}
+        onMouseEnter={() => {
+          setIsOpen(true);
+        }}
+        onMouseLeave={() => {
+          setIsOpen(false);
+        }}
+        aria-label="More info"
+      >
+        <Icon
+          css={{
+            width: theme.spacing(getIconSpacingFromSize(size)),
+            height: theme.spacing(getIconSpacingFromSize(size)),
+          }}
+          className={iconClassName}
+        />
+      </button>
+      <HelpPopover
+        id={id}
+        open={isOpen}
+        anchorEl={anchorRef.current}
+        onOpen={() => setIsOpen(true)}
+        onClose={() => setIsOpen(false)}
+      >
+        <HelpTooltipContext.Provider value={{ open: isOpen, onClose }}>
+          {children}
+        </HelpTooltipContext.Provider>
+      </HelpPopover>
+    </>
+  );
+};
+
+export const HelpTooltipTitle: FC<PropsWithChildren> = ({ children }) => {
+  return <h4 css={styles.title}>{children}</h4>;
+};
+
+export const HelpTooltipText = (props: BoxProps) => {
+  return <Box component="p" css={styles.text} {...props} />;
+};
+
+export const HelpTooltipLink: FC<PropsWithChildren<{ href: string }>> = ({
+  children,
+  href,
+}) => {
+  return (
+    <Link href={href} target="_blank" rel="noreferrer" css={styles.link}>
+      <OpenInNewIcon css={styles.linkIcon} />
+      {children}
+    </Link>
+  );
+};
+
+export const HelpTooltipAction: FC<
+  PropsWithChildren<{
+    icon: Icon;
+    onClick: () => void;
+    ariaLabel?: string;
+  }>
+> = ({ children, icon: Icon, onClick, ariaLabel }) => {
+  const tooltip = useHelpTooltip();
+
+  return (
+    <button
+      aria-label={ariaLabel ?? ""}
+      css={styles.action}
+      onClick={(event) => {
+        event.stopPropagation();
+        onClick();
+        tooltip.onClose();
+      }}
+    >
+      <Icon css={styles.actionIcon} />
+      {children}
+    </button>
+  );
+};
+
+export const HelpTooltipLinksGroup: FC<PropsWithChildren<unknown>> = ({
+  children,
+}) => {
+  return (
+    <Stack spacing={1} css={styles.linksGroup}>
+      {children}
+    </Stack>
+  );
+};
+
+const getButtonSpacingFromSize = (size?: Size): number => {
+  switch (size) {
+    case "small":
+      return 2.5;
+    case "medium":
+    default:
+      return 3;
+  }
+};
+
+const getIconSpacingFromSize = (size?: Size): number => {
+  switch (size) {
+    case "small":
+      return 1.5;
+    case "medium":
+    default:
+      return 2;
+  }
+};
+
+const styles = {
+  title: (theme) => ({
+    marginTop: 0,
+    marginBottom: theme.spacing(1),
+    color: theme.palette.text.primary,
+    fontSize: 14,
+    lineHeight: "150%",
+    fontWeight: 600,
+  }),
+
+  text: (theme) => ({
+    marginTop: theme.spacing(0.5),
+    marginBottom: theme.spacing(0.5),
+    ...(theme.typography.body2 as CSSObject),
+  }),
+
+  link: (theme) => ({
+    display: "flex",
+    alignItems: "center",
+    ...(theme.typography.body2 as CSSObject),
+  }),
+
+  linkIcon: (theme) => ({
+    color: "inherit",
+    width: 14,
+    height: 14,
+    marginRight: theme.spacing(1),
+  }),
+
+  linksGroup: (theme) => ({
+    marginTop: theme.spacing(2),
+  }),
+
+  action: (theme) => ({
+    display: "flex",
+    alignItems: "center",
+    background: "none",
+    border: 0,
+    color: theme.palette.primary.light,
+    padding: 0,
+    cursor: "pointer",
+    fontSize: 14,
+  }),
+
+  actionIcon: (theme) => ({
+    color: "inherit",
+    width: 14,
+    height: 14,
+    marginRight: theme.spacing(1),
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/components/IconField/IconField.stories.tsx b/site/src/components/IconField/IconField.stories.tsx
new file mode 100644
index 0000000000000..35b558d02353c
--- /dev/null
+++ b/site/src/components/IconField/IconField.stories.tsx
@@ -0,0 +1,28 @@
+import { action } from "@storybook/addon-actions";
+import IconField from "./IconField";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof IconField> = {
+  title: "components/IconField",
+  component: IconField,
+  args: {
+    onPickEmoji: action("onPickEmoji"),
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof IconField>;
+
+export const Example: Story = {};
+
+export const EmojiSelected: Story = {
+  args: {
+    value: "/emojis/1f3f3-fe0f-200d-26a7-fe0f.png",
+  },
+};
+
+export const IconSelected: Story = {
+  args: {
+    value: "/icon/fedora.svg",
+  },
+};
diff --git a/site/src/components/IconField/IconField.tsx b/site/src/components/IconField/IconField.tsx
index db572d1f25110..6e8bf11506cfa 100644
--- a/site/src/components/IconField/IconField.tsx
+++ b/site/src/components/IconField/IconField.tsx
@@ -1,37 +1,62 @@
-import Button from "@mui/material/Button"
-import InputAdornment from "@mui/material/InputAdornment"
-import Popover from "@mui/material/Popover"
-import TextField from "@mui/material/TextField"
-import { OpenDropdown } from "components/DropdownArrows/DropdownArrows"
-import { useRef, FC, useState } from "react"
-import Picker from "@emoji-mart/react"
-import { makeStyles } from "@mui/styles"
-import { colors } from "theme/colors"
-import { useTranslation } from "react-i18next"
-import data from "@emoji-mart/data/sets/14/twitter.json"
-import { IconFieldProps } from "./types"
-import { Stack } from "components/Stack/Stack"
+import Button from "@mui/material/Button";
+import InputAdornment from "@mui/material/InputAdornment";
+import TextField, { TextFieldProps } from "@mui/material/TextField";
+import { makeStyles } from "@mui/styles";
+import Picker from "@emoji-mart/react";
+import { FC } from "react";
+import { DropdownArrow } from "components/DropdownArrow/DropdownArrow";
+import { Stack } from "components/Stack/Stack";
+import { colors } from "theme/colors";
+import data from "@emoji-mart/data/sets/14/twitter.json";
+import icons from "theme/icons.json";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "components/Popover/Popover";
+
+// See: https://github.com/missive/emoji-mart/issues/51#issuecomment-287353222
+const urlFromUnifiedCode = (unified: string) =>
+  `/emojis/${unified.replace(/-fe0f$/, "")}.png`;
+
+type IconFieldProps = TextFieldProps & {
+  onPickEmoji: (value: string) => void;
+};
+
+const custom = [
+  {
+    id: "icons",
+    name: "Icons",
+    emojis: icons.map((icon) => {
+      const id = icon.split(".")[0];
+
+      return {
+        id,
+        name: id,
+        keywords: id.split("-"),
+        skins: [{ src: `/icon/${icon}` }],
+      };
+    }),
+  },
+];
 
 const IconField: FC<IconFieldProps> = ({ onPickEmoji, ...textFieldProps }) => {
   if (
     typeof textFieldProps.value !== "string" &&
     typeof textFieldProps.value !== "undefined"
   ) {
-    throw new Error(`Invalid icon value "${typeof textFieldProps.value}"`)
+    throw new Error(`Invalid icon value "${typeof textFieldProps.value}"`);
   }
 
-  const styles = useStyles()
-  const emojiButtonRef = useRef<HTMLButtonElement>(null)
-  const [isEmojiPickerOpen, setIsEmojiPickerOpen] = useState(false)
-  const { t } = useTranslation("templateSettingsPage")
-  const hasIcon = textFieldProps.value && textFieldProps.value !== ""
+  const styles = useStyles();
+  const hasIcon = textFieldProps.value && textFieldProps.value !== "";
 
   return (
     <Stack spacing={1}>
       <TextField
         {...textFieldProps}
         fullWidth
-        label={t("iconLabel")}
+        label="Icon"
         InputProps={{
           endAdornment: hasIcon ? (
             <InputAdornment position="end" className={styles.adornment}>
@@ -48,42 +73,36 @@ const IconField: FC<IconFieldProps> = ({ onPickEmoji, ...textFieldProps }) => {
         }}
       />
 
-      <Button
-        fullWidth
-        ref={emojiButtonRef}
-        endIcon={<OpenDropdown />}
-        onClick={() => {
-          setIsEmojiPickerOpen((v) => !v)
-        }}
-      >
-        {t("selectEmoji")}
-      </Button>
-
-      <Popover
-        id="emoji"
-        open={isEmojiPickerOpen}
-        anchorEl={emojiButtonRef.current}
-        onClose={() => {
-          setIsEmojiPickerOpen(false)
-        }}
-      >
-        <Picker
-          theme="dark"
-          data={data}
-          onEmojiSelect={(emojiData) => {
-            // See: https://github.com/missive/emoji-mart/issues/51#issuecomment-287353222
-            const value = `/emojis/${emojiData.unified.replace(
-              /-fe0f$/,
-              "",
-            )}.png`
-            onPickEmoji(value)
-            setIsEmojiPickerOpen(false)
-          }}
-        />
+      <Popover>
+        {(popover) => (
+          <>
+            <PopoverTrigger>
+              <Button fullWidth endIcon={<DropdownArrow />}>
+                Select emoji
+              </Button>
+            </PopoverTrigger>
+            <PopoverContent
+              id="emoji"
+              css={{ marginTop: 0, ".MuiPaper-root": { width: "auto" } }}
+            >
+              <Picker
+                set="twitter"
+                theme="dark"
+                data={data}
+                custom={custom}
+                onEmojiSelect={(emoji) => {
+                  const value = emoji.src ?? urlFromUnifiedCode(emoji.unified);
+                  onPickEmoji(value);
+                  popover.setIsOpen(false);
+                }}
+              />
+            </PopoverContent>
+          </>
+        )}
       </Popover>
     </Stack>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   "@global": {
@@ -91,6 +110,9 @@ const useStyles = makeStyles((theme) => ({
       "--rgb-background": theme.palette.background.paper,
       "--rgb-input": colors.gray[17],
       "--rgb-color": colors.gray[4],
+
+      // Hack to prevent the right side from being cut off
+      width: 350,
     },
   },
   adornment: {
@@ -102,8 +124,9 @@ const useStyles = makeStyles((theme) => ({
 
     "& img": {
       maxWidth: "100%",
+      objectFit: "contain",
     },
   },
-}))
+}));
 
-export default IconField
+export default IconField;
diff --git a/site/src/components/IconField/LazyIconField.tsx b/site/src/components/IconField/LazyIconField.tsx
index b9eafa3b42b4d..be6b444f747be 100644
--- a/site/src/components/IconField/LazyIconField.tsx
+++ b/site/src/components/IconField/LazyIconField.tsx
@@ -1,12 +1,11 @@
-import { lazy, FC, Suspense } from "react"
-import { IconFieldProps } from "./types"
+import { lazy, Suspense, type ComponentProps } from "react";
 
-const IconField = lazy(() => import("./IconField"))
+const IconField = lazy(() => import("./IconField"));
 
-export const LazyIconField: FC<IconFieldProps> = (props) => {
+export const LazyIconField = (props: ComponentProps<typeof IconField>) => {
   return (
     <Suspense fallback={<div role="progressbar" data-testid="loader" />}>
       <IconField {...props} />
     </Suspense>
-  )
-}
+  );
+};
diff --git a/site/src/components/IconField/types.ts b/site/src/components/IconField/types.ts
deleted file mode 100644
index a974854220b1a..0000000000000
--- a/site/src/components/IconField/types.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-import { TextFieldProps } from "@mui/material/TextField"
-
-export type IconFieldProps = TextFieldProps & {
-  onPickEmoji: (value: string) => void
-}
diff --git a/site/src/components/Icons/AzureDevOpsIcon.tsx b/site/src/components/Icons/AzureDevOpsIcon.tsx
deleted file mode 100644
index b9aa303ed4505..0000000000000
--- a/site/src/components/Icons/AzureDevOpsIcon.tsx
+++ /dev/null
@@ -1,25 +0,0 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
-
-export const AzureDevOpsIcon = (props: SvgIconProps): JSX.Element => (
-  <SvgIcon {...props} viewBox="0 0 111 110">
-    <g clipPath="url(#clip0_1916_993)">
-      <path
-        d="M83.0365 94.769L0 82.288L83.0365 110L111 98.365V11.2115L83.0365 0V94.769Z"
-        fill="#0078D7"
-      />
-      <path
-        d="M69 27L53.7692 29.7741V63.7029L14 58.5816L30.2885 78V69.8912L53.7692 78L68.7885 65.41"
-        fill="#0078D7"
-      />
-      <path
-        d="M53 30C50.0594 27.7015 34.3059 16 34.3059 16V22.4776L13.0913 30.8358L7 38.7761V55.9104L13.5114 58V37.3134L53 30Z"
-        fill="#0078D7"
-      />
-    </g>
-    <defs>
-      <clipPath id="clip0_1916_993">
-        <rect width="111" height="110" fill="white" />
-      </clipPath>
-    </defs>
-  </SvgIcon>
-)
diff --git a/site/src/components/Icons/BitbucketIcon.tsx b/site/src/components/Icons/BitbucketIcon.tsx
deleted file mode 100644
index 97792a0ed4718..0000000000000
--- a/site/src/components/Icons/BitbucketIcon.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
-
-export const BitbucketIcon = (props: SvgIconProps): JSX.Element => (
-  <SvgIcon {...props} viewBox="0 0 501 450">
-    <g clipPath="url(#clip0_1917_1001)">
-      <path
-        d="M17.0206 0.0721333C14.6826 0.0419786 12.3663 0.523969 10.2344 1.48427C8.10245 2.44457 6.20658 3.8599 4.67987 5.63088C3.15316 7.40186 2.03262 9.48557 1.39691 11.7357C0.761211 13.9858 0.625758 16.3479 1.00007 18.6559L69.0071 431.504C69.8544 436.556 72.4548 441.148 76.3515 444.474C80.2481 447.799 85.1919 449.645 90.3144 449.688H416.572C420.412 449.737 424.142 448.405 427.082 445.935C430.023 443.465 431.978 440.021 432.592 436.23L500.6 18.736C500.974 16.428 500.838 14.0659 500.203 11.8158C499.567 9.56568 498.446 7.48197 496.92 5.71098C495.393 3.94 493.497 2.52467 491.365 1.56437C489.233 0.604073 486.917 0.122079 484.579 0.152234L17.0206 0.0721333ZM303.387 298.454H199.254L171.058 151.146H328.619L303.387 298.454Z"
-        fill="#2684FF"
-      />
-      <path
-        d="M478.972 151.146H328.619L303.387 298.454H199.254L76.2964 444.401C80.1936 447.771 85.1624 449.645 90.3143 449.688H416.652C420.492 449.737 424.222 448.405 427.162 445.935C430.103 443.465 432.058 440.021 432.673 436.23L478.972 151.146Z"
-        fill="url(#paint0_linear_1917_1001)"
-      />
-    </g>
-    <defs>
-      <linearGradient
-        id="paint0_linear_1917_1001"
-        x1="513.736"
-        y1="192.398"
-        x2="265.258"
-        y2="386.327"
-        gradientUnits="userSpaceOnUse"
-      >
-        <stop offset="0.18" stopColor="#0052CC" />
-        <stop offset="1" stopColor="#2684FF" />
-      </linearGradient>
-      <clipPath id="clip0_1917_1001">
-        <rect width="501" height="450" fill="white" />
-      </clipPath>
-    </defs>
-  </SvgIcon>
-)
diff --git a/site/src/components/Icons/BuildingIcon.tsx b/site/src/components/Icons/BuildingIcon.tsx
deleted file mode 100644
index 589553680f1e6..0000000000000
--- a/site/src/components/Icons/BuildingIcon.tsx
+++ /dev/null
@@ -1,12 +0,0 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
-
-export const BuildingIcon = (props: SvgIconProps): JSX.Element => (
-  <SvgIcon {...props} viewBox="0 0 24 24">
-    <path
-      fillRule="evenodd"
-      clipRule="evenodd"
-      d="M2.96387 1.15222H17.3405V11.2377H21V22.8479L17.3405 22.8479L10.9364 22.8479H9.36801L2.96387 22.8479V1.15222ZM10.9364 21.2795V19.4498H9.36801V21.2795H4.53223V2.72058H15.7722V11.2377H15.7721V12.806H15.7722V21.2795H10.9364ZM17.3405 12.806V21.2795H19.4317V12.806H17.3405ZM9.10661 4.81173H6.62337V6.38009H9.10661V4.81173ZM11.1978 4.81173H13.681V6.38009H11.1978V4.81173ZM9.10661 8.47124H6.62337V10.0396H9.10661V8.47124ZM11.1978 8.47124H13.681V10.0396H11.1978V8.47124ZM9.10661 12.1307H6.62337V13.6991H9.10661V12.1307ZM11.1978 12.1307H13.681V13.6991H11.1978V12.1307ZM9.10661 15.7903H6.62337V17.3586H9.10661V15.7903ZM11.1978 15.7903H13.681V17.3586H11.1978V15.7903Z"
-      fill="currentColor"
-    />
-  </SvgIcon>
-)
diff --git a/site/src/components/Icons/CloseIcon.tsx b/site/src/components/Icons/CloseIcon.tsx
deleted file mode 100644
index fbfc2f3d6e74c..0000000000000
--- a/site/src/components/Icons/CloseIcon.tsx
+++ /dev/null
@@ -1,12 +0,0 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
-
-export const CloseIcon = (props: SvgIconProps) => (
-  <SvgIcon {...props} viewBox="0 0 31 31">
-    <path
-      d="M29.5 1.5l-28 28M29.5 29.5l-28-28"
-      stroke="currentcolor"
-      strokeMiterlimit="10"
-      strokeLinecap="square"
-    />
-  </SvgIcon>
-)
diff --git a/site/src/components/Icons/CoderIcon.tsx b/site/src/components/Icons/CoderIcon.tsx
index e8bd8bddd19aa..65d4e1fc20079 100644
--- a/site/src/components/Icons/CoderIcon.tsx
+++ b/site/src/components/Icons/CoderIcon.tsx
@@ -1,4 +1,4 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 /**
  * CoderIcon represents the cloud with brackets Coder brand icon. It does not
@@ -13,4 +13,4 @@ export const CoderIcon = (props: SvgIconProps): JSX.Element => (
     <path d="M26.5677 11.8649C27.4711 11.8649 28.3744 11.9485 29.2368 12.1577V10.443C29.2368 8.0173 30.4686 6.59536 32.9324 6.59536H33.8358V0.280273H30.8793C24.5145 0.280273 22.0508 3.58419 22.0508 9.5647V12.6595C23.488 12.1577 25.0073 11.8649 26.5677 11.8649Z" />
     <path d="M53.2174 34.6165C52.5603 29.3051 48.5362 24.872 43.3623 23.8683C41.9251 23.5755 40.4879 23.5337 39.0918 23.7847C39.0507 23.7847 39.0507 23.7428 39.0096 23.7428C36.7512 18.9333 31.9058 15.7549 26.6497 15.7549C21.3937 15.7549 16.5894 18.8497 14.2898 23.6592C14.2488 23.6592 14.2488 23.701 14.2077 23.701C12.7295 23.5337 11.2512 23.6174 9.77294 23.9938C4.68116 25.2484 0.821255 29.5979 0.123188 34.8674C0.0410628 35.4111 0 35.9548 0 36.4566C0 38.0459 1.06763 39.5096 2.62802 39.7187C4.55797 40.0115 6.24154 38.5059 6.20048 36.5821C6.20048 36.2894 6.20048 35.9548 6.24154 35.662C6.57004 32.9854 8.58212 30.7271 11.2101 30.0997C12.0314 29.8906 12.8526 29.8488 13.6328 29.9743C16.1377 30.3088 18.6014 29.0124 19.6691 26.754C20.4493 25.0811 21.6811 23.6174 23.3237 22.8228C25.1304 21.9445 27.1836 21.819 29.0724 22.4882C31.0435 23.1992 32.5217 24.7047 33.4251 26.5867C34.3695 28.4269 34.8212 29.7233 36.8333 29.9743C37.6546 30.0997 39.9541 30.0579 40.8164 30.0161C42.5 30.0161 44.1835 30.6016 45.3744 31.8144C46.1546 32.6509 46.7294 33.6964 46.9758 34.8674C47.3454 36.7494 46.8937 38.6314 45.785 40.0533C45.0048 41.057 43.9372 41.8098 42.7463 42.1444C42.1715 42.3117 41.5966 42.3535 41.0217 42.3535C40.6932 42.3535 40.2415 42.3535 39.7077 42.3535C38.0652 42.3535 34.5749 42.3535 31.9468 42.3535C30.1401 42.3535 28.7029 40.8897 28.7029 39.0496V32.86V26.7958C28.7029 26.294 28.2922 25.8757 27.7995 25.8757H26.5265C24.0217 25.9176 22.0096 28.7614 22.0096 31.7726C22.0096 34.7838 22.0096 42.7717 22.0096 42.7717C22.0096 46.0338 24.5966 48.6686 27.7995 48.6686C27.7995 48.6686 42.0483 48.6268 42.2536 48.6268C45.5386 48.2922 48.5773 46.5775 50.6304 43.9427C52.6835 41.3916 53.628 38.0459 53.2174 34.6165Z" />
   </SvgIcon>
-)
+);
diff --git a/site/src/components/Icons/DockerIcon.tsx b/site/src/components/Icons/DockerIcon.tsx
index f2c4c042a291d..4118804ac8a0d 100644
--- a/site/src/components/Icons/DockerIcon.tsx
+++ b/site/src/components/Icons/DockerIcon.tsx
@@ -1,4 +1,4 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 export const DockerIcon = (props: SvgIconProps): JSX.Element => (
   <SvgIcon {...props} viewBox="0 0 32 32">
@@ -19,4 +19,4 @@ export const DockerIcon = (props: SvgIconProps): JSX.Element => (
       style={{ fill: "#fff" }}
     />
   </SvgIcon>
-)
+);
diff --git a/site/src/components/Icons/EditSquare.tsx b/site/src/components/Icons/EditSquare.tsx
index bb4ac1eee3148..7caf89131d444 100644
--- a/site/src/components/Icons/EditSquare.tsx
+++ b/site/src/components/Icons/EditSquare.tsx
@@ -1,7 +1,7 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 export const EditSquare = (props: SvgIconProps): JSX.Element => (
   <SvgIcon {...props} viewBox="0 0 48 48">
     <path d="M9 47.4q-1.2 0-2.1-.9-.9-.9-.9-2.1v-30q0-1.2.9-2.1.9-.9 2.1-.9h20.25l-3 3H9v30h30V27l3-3v20.4q0 1.2-.9 2.1-.9.9-2.1.9Zm15-18Zm9.1-17.6 2.15 2.1L21 28.1v4.3h4.25l14.3-14.3 2.1 2.1L26.5 35.4H18v-8.5Zm8.55 8.4-8.55-8.4 5-5q.85-.85 2.125-.85t2.125.9l4.2 4.25q.85.9.85 2.125t-.9 2.075Z" />
   </SvgIcon>
-)
+);
diff --git a/site/src/components/Icons/ErrorIcon.tsx b/site/src/components/Icons/ErrorIcon.tsx
index 0fb8748be6e7e..4d81f5ff3dc69 100644
--- a/site/src/components/Icons/ErrorIcon.tsx
+++ b/site/src/components/Icons/ErrorIcon.tsx
@@ -1,4 +1,4 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 export const ErrorIcon = (props: SvgIconProps): JSX.Element => (
   <SvgIcon {...props} viewBox="0 0 24 24">
@@ -9,4 +9,4 @@ export const ErrorIcon = (props: SvgIconProps): JSX.Element => (
       fill="currentColor"
     />
   </SvgIcon>
-)
+);
diff --git a/site/src/components/Icons/FileCopyIcon.tsx b/site/src/components/Icons/FileCopyIcon.tsx
index 4d430b504c7ea..433498cebb617 100644
--- a/site/src/components/Icons/FileCopyIcon.tsx
+++ b/site/src/components/Icons/FileCopyIcon.tsx
@@ -1,4 +1,4 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 export const FileCopyIcon = (props: SvgIconProps) => (
   <SvgIcon {...props} viewBox="0 0 20 20">
@@ -7,4 +7,4 @@ export const FileCopyIcon = (props: SvgIconProps) => (
       fill="currentColor"
     />
   </SvgIcon>
-)
+);
diff --git a/site/src/components/Icons/GitIcon.tsx b/site/src/components/Icons/GitIcon.tsx
index d1c57c6b318ad..63122d3781417 100644
--- a/site/src/components/Icons/GitIcon.tsx
+++ b/site/src/components/Icons/GitIcon.tsx
@@ -1,7 +1,7 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 export const GitIcon = (props: SvgIconProps) => (
   <SvgIcon {...props} viewBox="0 0 96 96">
     <path d="M92.71 44.408 52.591 4.291c-2.31-2.311-6.057-2.311-8.369 0l-8.33 8.332L46.459 23.19c2.456-.83 5.272-.273 7.229 1.685 1.969 1.97 2.521 4.81 1.67 7.275l10.186 10.185c2.465-.85 5.307-.3 7.275 1.671 2.75 2.75 2.75 7.206 0 9.958-2.752 2.751-7.208 2.751-9.961 0-2.068-2.07-2.58-5.11-1.531-7.658l-9.5-9.499v24.997c.67.332 1.303.774 1.861 1.332 2.75 2.75 2.75 7.206 0 9.959-2.75 2.749-7.209 2.749-9.957 0-2.75-2.754-2.75-7.21 0-9.959.68-.679 1.467-1.193 2.307-1.537v-25.23c-.84-.344-1.625-.853-2.307-1.537-2.083-2.082-2.584-5.14-1.516-7.698L31.798 16.715 4.288 44.222c-2.311 2.313-2.311 6.06 0 8.371l40.121 40.118c2.31 2.311 6.056 2.311 8.369 0L92.71 52.779c2.311-2.311 2.311-6.06 0-8.371z" />
   </SvgIcon>
-)
+);
diff --git a/site/src/components/Icons/GitlabIcon.tsx b/site/src/components/Icons/GitlabIcon.tsx
index e0b94a11da4d7..ee7b105ac4e2e 100644
--- a/site/src/components/Icons/GitlabIcon.tsx
+++ b/site/src/components/Icons/GitlabIcon.tsx
@@ -1,4 +1,4 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 export const GitlabIcon = (props: SvgIconProps): JSX.Element => (
   <SvgIcon {...props} viewBox="0 0 194 186">
@@ -26,4 +26,4 @@ export const GitlabIcon = (props: SvgIconProps): JSX.Element => (
       </clipPath>
     </defs>
   </SvgIcon>
-)
+);
diff --git a/site/src/components/Icons/MarkdownIcon.tsx b/site/src/components/Icons/MarkdownIcon.tsx
index 52b0793c9758f..4db8c543b6661 100644
--- a/site/src/components/Icons/MarkdownIcon.tsx
+++ b/site/src/components/Icons/MarkdownIcon.tsx
@@ -1,4 +1,4 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 export const MarkdownIcon = (props: SvgIconProps): JSX.Element => (
   <SvgIcon {...props} viewBox="0 0 32 32">
@@ -18,4 +18,4 @@ export const MarkdownIcon = (props: SvgIconProps): JSX.Element => (
       style={{ stroke: "#755838" }}
     />
   </SvgIcon>
-)
+);
diff --git a/site/src/components/Icons/RocketIcon.tsx b/site/src/components/Icons/RocketIcon.tsx
index 36dfd11c00f92..796a59fd940d9 100644
--- a/site/src/components/Icons/RocketIcon.tsx
+++ b/site/src/components/Icons/RocketIcon.tsx
@@ -1,7 +1,7 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 export const RocketIcon = (props: SvgIconProps) => (
   <SvgIcon {...props} viewBox="0 0 24 24">
     <path d="M12 2.5s4.5 2.04 4.5 10.5c0 2.49-1.04 5.57-1.6 7H9.1c-.56-1.43-1.6-4.51-1.6-7C7.5 4.54 12 2.5 12 2.5zm2 8.5c0-1.1-.9-2-2-2s-2 .9-2 2 .9 2 2 2 2-.9 2-2zm-6.31 9.52c-.48-1.23-1.52-4.17-1.67-6.87l-1.13.75c-.56.38-.89 1-.89 1.67V22l3.69-1.48zM20 22v-5.93c0-.67-.33-1.29-.89-1.66l-1.13-.75c-.15 2.69-1.2 5.64-1.67 6.87L20 22z" />
   </SvgIcon>
-)
+);
diff --git a/site/src/components/Icons/TerminalIcon.tsx b/site/src/components/Icons/TerminalIcon.tsx
index 60090c3032962..b4915050c82df 100644
--- a/site/src/components/Icons/TerminalIcon.tsx
+++ b/site/src/components/Icons/TerminalIcon.tsx
@@ -1,7 +1,7 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 export const TerminalIcon = (props: SvgIconProps) => (
   <SvgIcon {...props} viewBox="0 0 24 24">
     <path d="M20 4H4c-1.11 0-2 .9-2 2v12c0 1.1.89 2 2 2h16c1.1 0 2-.9 2-2V6c0-1.1-.89-2-2-2zm0 14H4V8h16v10zm-2-1h-6v-2h6v2zM7.5 17l-1.41-1.41L8.67 13l-2.59-2.59L7.5 9l4 4-4 4z" />
   </SvgIcon>
-)
+);
diff --git a/site/src/components/Icons/TerraformIcon.tsx b/site/src/components/Icons/TerraformIcon.tsx
index fe98d09c7a398..4fe2c826537af 100644
--- a/site/src/components/Icons/TerraformIcon.tsx
+++ b/site/src/components/Icons/TerraformIcon.tsx
@@ -1,4 +1,4 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 export const TerraformIcon = (props: SvgIconProps): JSX.Element => (
   <SvgIcon {...props} viewBox="0 0 32 32">
@@ -19,4 +19,4 @@ export const TerraformIcon = (props: SvgIconProps): JSX.Element => (
       style={{ fill: "#813cf3" }}
     />
   </SvgIcon>
-)
+);
diff --git a/site/src/components/Icons/UsersOutlinedIcon.tsx b/site/src/components/Icons/UsersOutlinedIcon.tsx
deleted file mode 100644
index aa689b4dc5321..0000000000000
--- a/site/src/components/Icons/UsersOutlinedIcon.tsx
+++ /dev/null
@@ -1,30 +0,0 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
-
-export const UsersOutlinedIcon = (props: SvgIconProps) => (
-  <SvgIcon {...props} viewBox="0 0 20 20">
-    <svg
-      width="20"
-      height="20"
-      viewBox="0 0 20 20"
-      fill="none"
-      xmlns="http://www.w3.org/2000/svg"
-    >
-      <path
-        d="M18.75 18.75H17.5V15.625V15.625C17.498 13.8999 16.1001 12.502 14.375 12.5V11.25C16.7901 11.2527 18.7473 13.2099 18.75 15.625L18.75 18.75Z"
-        fill="#677693"
-      />
-      <path
-        d="M13.75 18.75H12.5V15.625V15.6251C12.498 13.9001 11.1002 12.5021 9.3751 12.5H5.625C3.89995 12.502 2.50203 13.9 2.5 15.625V18.75H1.25V15.625L1.25 15.6251C1.25277 13.21 3.20982 11.2529 5.62489 11.25H9.37489C11.79 11.2528 13.7471 13.2099 13.7499 15.625L13.75 18.75Z"
-        fill="#677693"
-      />
-      <path
-        d="M12.5 1.25V2.5C14.2259 2.5 15.625 3.89911 15.625 5.625C15.625 7.35089 14.2259 8.75 12.5 8.75V10C14.9162 10 16.875 8.04124 16.875 5.625C16.875 3.20876 14.9162 1.25 12.5 1.25Z"
-        fill="#677693"
-      />
-      <path
-        d="M7.5 2.5C9.22589 2.5 10.625 3.89911 10.625 5.625C10.625 7.35089 9.22589 8.75 7.5 8.75C5.77411 8.75 4.375 7.35089 4.375 5.625V5.625C4.375 3.89911 5.77411 2.5 7.5 2.5V2.5ZM7.5 1.25H7.5C5.08376 1.25 3.125 3.20876 3.125 5.625C3.125 8.04124 5.08376 10 7.5 10C9.91624 10 11.875 8.04124 11.875 5.625C11.875 3.20876 9.91624 1.25 7.5 1.25L7.5 1.25Z"
-        fill="#677693"
-      />
-    </svg>
-  </SvgIcon>
-)
diff --git a/site/src/components/Icons/VSCodeIcon.tsx b/site/src/components/Icons/VSCodeIcon.tsx
index cb7200ca68523..7e210c5d01abb 100644
--- a/site/src/components/Icons/VSCodeIcon.tsx
+++ b/site/src/components/Icons/VSCodeIcon.tsx
@@ -1,4 +1,4 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 export const VSCodeIcon = (props: SvgIconProps) => (
   <SvgIcon {...props} viewBox="0 0 100 100">
@@ -131,4 +131,4 @@ export const VSCodeIcon = (props: SvgIconProps) => (
       </defs>
     </svg>
   </SvgIcon>
-)
+);
diff --git a/site/src/components/Icons/VSCodeInsidersIcon.tsx b/site/src/components/Icons/VSCodeInsidersIcon.tsx
index 0ff3f95f40c27..969b69de031c2 100644
--- a/site/src/components/Icons/VSCodeInsidersIcon.tsx
+++ b/site/src/components/Icons/VSCodeInsidersIcon.tsx
@@ -1,4 +1,4 @@
-import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon"
+import SvgIcon, { SvgIconProps } from "@mui/material/SvgIcon";
 
 export const VSCodeInsidersIcon = (props: SvgIconProps) => (
   <SvgIcon {...props} viewBox="0 0 256 256">
@@ -123,4 +123,4 @@ export const VSCodeInsidersIcon = (props: SvgIconProps) => (
       </defs>
     </svg>
   </SvgIcon>
-)
+);
diff --git a/site/src/components/InfoTooltip/InfoTooltip.stories.tsx b/site/src/components/InfoTooltip/InfoTooltip.stories.tsx
new file mode 100644
index 0000000000000..561d393aa6d05
--- /dev/null
+++ b/site/src/components/InfoTooltip/InfoTooltip.stories.tsx
@@ -0,0 +1,23 @@
+import { InfoTooltip } from "./InfoTooltip";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof InfoTooltip> = {
+  title: "components/InfoTooltip",
+  component: InfoTooltip,
+  args: {
+    type: "info",
+    title: "Hello, friend!",
+    message: "Today is a lovely day :^)",
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof InfoTooltip>;
+
+export const Example: Story = {};
+export const Warning: Story = {
+  args: {
+    type: "warning",
+    message: "Unfortunately, there's a radio connected to my brain",
+  },
+};
diff --git a/site/src/components/InfoTooltip/InfoTooltip.tsx b/site/src/components/InfoTooltip/InfoTooltip.tsx
new file mode 100644
index 0000000000000..7466ec512a92f
--- /dev/null
+++ b/site/src/components/InfoTooltip/InfoTooltip.tsx
@@ -0,0 +1,38 @@
+import { type FC, type ReactNode } from "react";
+import {
+  HelpTooltip,
+  HelpTooltipText,
+  HelpTooltipTitle,
+} from "components/HelpTooltip/HelpTooltip";
+import InfoIcon from "@mui/icons-material/InfoOutlined";
+import { css } from "@emotion/css";
+import { colors } from "theme/colors";
+
+interface InfoTooltipProps {
+  type?: "warning" | "info";
+  title: ReactNode;
+  message: ReactNode;
+}
+
+export const InfoTooltip: FC<InfoTooltipProps> = (props) => {
+  const { title, message, type = "info" } = props;
+
+  return (
+    <HelpTooltip
+      size="small"
+      icon={InfoIcon}
+      iconClassName={css`
+        color: ${type === "info" ? colors.blue[5] : colors.yellow[5]};
+      `}
+      buttonClassName={css`
+        opacity: 1;
+        &:hover {
+          opacity: 1;
+        }
+      `}
+    >
+      <HelpTooltipTitle>{title}</HelpTooltipTitle>
+      <HelpTooltipText>{message}</HelpTooltipText>
+    </HelpTooltip>
+  );
+};
diff --git a/site/src/components/LastSeen/LastSeen.tsx b/site/src/components/LastSeen/LastSeen.tsx
new file mode 100644
index 0000000000000..df9c05210e5ea
--- /dev/null
+++ b/site/src/components/LastSeen/LastSeen.tsx
@@ -0,0 +1,41 @@
+import Box, { type BoxProps } from "@mui/material/Box";
+import { useTheme } from "@emotion/react";
+import dayjs from "dayjs";
+
+export const LastSeen = ({
+  value,
+  ...boxProps
+}: { value: string } & BoxProps) => {
+  const theme = useTheme();
+  const t = dayjs(value);
+  const now = dayjs();
+
+  let message = t.fromNow();
+  let color = theme.palette.text.secondary;
+
+  if (t.isAfter(now.subtract(1, "hour"))) {
+    color = theme.palette.success.light;
+    // Since the agent reports on a 10m interval,
+    // the last_used_at can be inaccurate when recent.
+    message = "Now";
+  } else if (t.isAfter(now.subtract(3, "day"))) {
+    color = theme.palette.text.secondary;
+  } else if (t.isAfter(now.subtract(1, "month"))) {
+    color = theme.palette.warning.light;
+  } else if (t.isAfter(now.subtract(100, "year"))) {
+    color = theme.palette.error.light;
+  } else {
+    message = "Never";
+  }
+
+  return (
+    <Box
+      component="span"
+      data-chromatic="ignore"
+      {...boxProps}
+      sx={{ color, ...boxProps.sx }}
+    >
+      {message}
+    </Box>
+  );
+};
diff --git a/site/src/components/LastUsed/LastUsed.tsx b/site/src/components/LastUsed/LastUsed.tsx
deleted file mode 100644
index a491b37019ba6..0000000000000
--- a/site/src/components/LastUsed/LastUsed.tsx
+++ /dev/null
@@ -1,77 +0,0 @@
-import { makeStyles, useTheme } from "@mui/styles"
-import { FC } from "react"
-import dayjs from "dayjs"
-import relativeTime from "dayjs/plugin/relativeTime"
-import { colors } from "theme/colors"
-import { Stack } from "components/Stack/Stack"
-import { Theme } from "@mui/material/styles"
-
-dayjs.extend(relativeTime)
-
-type CircleProps = { color: string; variant?: "solid" | "outlined" }
-
-const Circle: FC<CircleProps> = ({ color, variant = "solid" }) => {
-  const styles = useCircleStyles({ color, variant })
-  return <div className={styles.root} />
-}
-
-const useCircleStyles = makeStyles((theme) => ({
-  root: {
-    width: theme.spacing(1),
-    height: theme.spacing(1),
-    backgroundColor: (props: CircleProps) =>
-      props.variant === "solid" ? props.color : undefined,
-    border: (props: CircleProps) =>
-      props.variant === "outlined" ? `1px solid ${props.color}` : undefined,
-    borderRadius: 9999,
-  },
-}))
-
-interface LastUsedProps {
-  lastUsedAt: string
-}
-
-export const LastUsed: FC<LastUsedProps> = ({ lastUsedAt }) => {
-  const theme: Theme = useTheme()
-  const styles = useStyles()
-  const t = dayjs(lastUsedAt)
-  const now = dayjs()
-  let message = t.fromNow()
-  let circle: JSX.Element = (
-    <Circle color={theme.palette.text.secondary} variant="outlined" />
-  )
-
-  if (t.isAfter(now.subtract(1, "hour"))) {
-    circle = <Circle color={colors.green[9]} />
-    // Since the agent reports on a 10m interval,
-    // the last_used_at can be inaccurate when recent.
-    message = "Now"
-  } else if (t.isAfter(now.subtract(3, "day"))) {
-    circle = <Circle color={theme.palette.text.secondary} />
-  } else if (t.isAfter(now.subtract(1, "month"))) {
-    circle = <Circle color={theme.palette.warning.light} />
-  } else if (t.isAfter(now.subtract(100, "year"))) {
-    circle = <Circle color={colors.red[10]} />
-  } else {
-    // color = theme.palette.error.light
-    message = "Never"
-  }
-
-  return (
-    <Stack
-      className={styles.root}
-      direction="row"
-      spacing={1}
-      alignItems="center"
-    >
-      {circle}
-      <span data-chromatic="ignore">{message}</span>
-    </Stack>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    color: theme.palette.text.secondary,
-  },
-}))
diff --git a/site/src/components/LicenseBanner/LicenseBanner.tsx b/site/src/components/LicenseBanner/LicenseBanner.tsx
deleted file mode 100644
index 8de586ff9e1aa..0000000000000
--- a/site/src/components/LicenseBanner/LicenseBanner.tsx
+++ /dev/null
@@ -1,13 +0,0 @@
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import { LicenseBannerView } from "./LicenseBannerView"
-
-export const LicenseBanner: React.FC = () => {
-  const { entitlements } = useDashboard()
-  const { errors, warnings } = entitlements
-
-  if (errors.length > 0 || warnings.length > 0) {
-    return <LicenseBannerView errors={errors} warnings={warnings} />
-  } else {
-    return null
-  }
-}
diff --git a/site/src/components/LicenseBanner/LicenseBannerView.stories.tsx b/site/src/components/LicenseBanner/LicenseBannerView.stories.tsx
deleted file mode 100644
index c7ee69c261e38..0000000000000
--- a/site/src/components/LicenseBanner/LicenseBannerView.stories.tsx
+++ /dev/null
@@ -1,34 +0,0 @@
-import { Story } from "@storybook/react"
-import { LicenseBannerView, LicenseBannerViewProps } from "./LicenseBannerView"
-
-export default {
-  title: "components/LicenseBannerView",
-  component: LicenseBannerView,
-}
-
-const Template: Story<LicenseBannerViewProps> = (args) => (
-  <LicenseBannerView {...args} />
-)
-
-export const OneWarning = Template.bind({})
-OneWarning.args = {
-  errors: [],
-  warnings: ["You have exceeded the number of seats in your license."],
-}
-
-export const TwoWarnings = Template.bind({})
-TwoWarnings.args = {
-  errors: [],
-  warnings: [
-    "You have exceeded the number of seats in your license.",
-    "You are flying too close to the sun.",
-  ],
-}
-
-export const OneError = Template.bind({})
-OneError.args = {
-  errors: [
-    "You have multiple replicas but high availability is an Enterprise feature. You will be unable to connect to workspaces.",
-  ],
-  warnings: [],
-}
diff --git a/site/src/components/LicenseBanner/LicenseBannerView.tsx b/site/src/components/LicenseBanner/LicenseBannerView.tsx
deleted file mode 100644
index 9034a63a065fd..0000000000000
--- a/site/src/components/LicenseBanner/LicenseBannerView.tsx
+++ /dev/null
@@ -1,106 +0,0 @@
-import Link from "@mui/material/Link"
-import { makeStyles } from "@mui/styles"
-import { Expander } from "components/Expander/Expander"
-import { Pill } from "components/Pill/Pill"
-import { useState } from "react"
-import { colors } from "theme/colors"
-
-export const Language = {
-  licenseIssue: "License Issue",
-  licenseIssues: (num: number): string => `${num} License Issues`,
-  upgrade: "Contact sales@coder.com.",
-  exceeded: "It looks like you've exceeded some limits of your license.",
-  lessDetails: "Less",
-  moreDetails: "More",
-}
-
-export interface LicenseBannerViewProps {
-  errors: string[]
-  warnings: string[]
-}
-
-export const LicenseBannerView: React.FC<LicenseBannerViewProps> = ({
-  errors,
-  warnings,
-}) => {
-  const styles = useStyles()
-  const [showDetails, setShowDetails] = useState(false)
-  const isError = errors.length > 0
-  const messages = [...errors, ...warnings]
-  const type = isError ? "error" : "warning"
-
-  if (messages.length === 1) {
-    return (
-      <div className={`${styles.container} ${type}`}>
-        <Pill text={Language.licenseIssue} type={type} lightBorder />
-        <div className={styles.leftContent}>
-          <span>{messages[0]}</span>
-          &nbsp;
-          <Link color="white" fontWeight="medium" href="mailto:sales@coder.com">
-            {Language.upgrade}
-          </Link>
-        </div>
-      </div>
-    )
-  } else {
-    return (
-      <div className={`${styles.container} ${type}`}>
-        <Pill
-          text={Language.licenseIssues(messages.length)}
-          type={type}
-          lightBorder
-        />
-        <div className={styles.leftContent}>
-          <div>
-            {Language.exceeded}
-            &nbsp;
-            <Link
-              color="white"
-              fontWeight="medium"
-              href="mailto:sales@coder.com"
-            >
-              {Language.upgrade}
-            </Link>
-          </div>
-          <Expander expanded={showDetails} setExpanded={setShowDetails}>
-            <ul className={styles.list}>
-              {messages.map((message) => (
-                <li className={styles.listItem} key={message}>
-                  {message}
-                </li>
-              ))}
-            </ul>
-          </Expander>
-        </div>
-      </div>
-    )
-  }
-}
-
-const useStyles = makeStyles((theme) => ({
-  container: {
-    ...theme.typography.body2,
-    padding: theme.spacing(1.5),
-    backgroundColor: theme.palette.warning.main,
-    display: "flex",
-    alignItems: "center",
-
-    "&.error": {
-      backgroundColor: colors.red[12],
-    },
-  },
-  flex: {
-    display: "column",
-  },
-  leftContent: {
-    marginRight: theme.spacing(1),
-    marginLeft: theme.spacing(1),
-  },
-  list: {
-    padding: theme.spacing(1),
-    margin: 0,
-  },
-  listItem: {
-    margin: theme.spacing(0.5),
-  },
-}))
diff --git a/site/src/components/LicenseCard/LicenseCard.test.tsx b/site/src/components/LicenseCard/LicenseCard.test.tsx
deleted file mode 100644
index cdef5a54f39c1..0000000000000
--- a/site/src/components/LicenseCard/LicenseCard.test.tsx
+++ /dev/null
@@ -1,70 +0,0 @@
-import { screen } from "@testing-library/react"
-import { render } from "../../testHelpers/renderHelpers"
-import { LicenseCard } from "./LicenseCard"
-import { MockLicenseResponse } from "testHelpers/entities"
-
-describe("LicenseCard", () => {
-  it("renders (smoke test)", async () => {
-    // When
-    render(
-      <LicenseCard
-        license={MockLicenseResponse[0]}
-        userLimitActual={1}
-        userLimitLimit={10}
-        onRemove={() => null}
-        isRemoving={false}
-      />,
-    )
-
-    // Then
-    await screen.findByText("#1")
-    await screen.findByText("1 / 10")
-    await screen.findByText("Enterprise")
-  })
-
-  it("renders userLimit as unlimited if there is not user limit", async () => {
-    // When
-    render(
-      <LicenseCard
-        license={MockLicenseResponse[0]}
-        userLimitActual={1}
-        userLimitLimit={undefined}
-        onRemove={() => null}
-        isRemoving={false}
-      />,
-    )
-
-    // Then
-    await screen.findByText("#1")
-    await screen.findByText("1 / Unlimited")
-    await screen.findByText("Enterprise")
-  })
-
-  it("renders license's user_limit when it is available instead of using the default", async () => {
-    const licenseUserLimit = 3
-    const license = {
-      ...MockLicenseResponse[0],
-      claims: {
-        ...MockLicenseResponse[0].claims,
-        features: {
-          ...MockLicenseResponse[0].claims.features,
-          user_limit: licenseUserLimit,
-        },
-      },
-    }
-
-    // When
-    render(
-      <LicenseCard
-        license={license}
-        userLimitActual={1}
-        userLimitLimit={100} // This should not be used
-        onRemove={() => null}
-        isRemoving={false}
-      />,
-    )
-
-    // Then
-    await screen.findByText("1 / 3")
-  })
-})
diff --git a/site/src/components/Loader/FullScreenLoader.tsx b/site/src/components/Loader/FullScreenLoader.tsx
index 9774f1bb303d9..1e34567f4f4e6 100644
--- a/site/src/components/Loader/FullScreenLoader.tsx
+++ b/site/src/components/Loader/FullScreenLoader.tsx
@@ -1,27 +1,23 @@
-import CircularProgress from "@mui/material/CircularProgress"
-import { makeStyles } from "@mui/styles"
-import { FC } from "react"
-
-export const useStyles = makeStyles((theme) => ({
-  root: {
-    position: "absolute",
-    top: "0",
-    left: "0",
-    right: "0",
-    bottom: "0",
-    display: "flex",
-    justifyContent: "center",
-    alignItems: "center",
-    background: theme.palette.background.default,
-  },
-}))
+import CircularProgress from "@mui/material/CircularProgress";
+import type { FC } from "react";
 
 export const FullScreenLoader: FC = () => {
-  const styles = useStyles()
-
   return (
-    <div className={styles.root} data-testid="loader">
+    <div
+      css={(theme) => ({
+        position: "absolute",
+        top: "0",
+        left: "0",
+        right: "0",
+        bottom: "0",
+        display: "flex",
+        justifyContent: "center",
+        alignItems: "center",
+        background: theme.palette.background.default,
+      })}
+      data-testid="loader"
+    >
       <CircularProgress />
     </div>
-  )
-}
+  );
+};
diff --git a/site/src/components/Loader/Loader.tsx b/site/src/components/Loader/Loader.tsx
index 65cc9d474da1a..0a5f487f33615 100644
--- a/site/src/components/Loader/Loader.tsx
+++ b/site/src/components/Loader/Loader.tsx
@@ -1,6 +1,6 @@
-import Box, { BoxProps } from "@mui/material/Box"
-import CircularProgress from "@mui/material/CircularProgress"
-import { FC } from "react"
+import Box, { BoxProps } from "@mui/material/Box";
+import CircularProgress from "@mui/material/CircularProgress";
+import { FC } from "react";
 
 export const Loader: FC<{ size?: number } & BoxProps> = ({
   size = 26,
@@ -18,5 +18,5 @@ export const Loader: FC<{ size?: number } & BoxProps> = ({
     >
       <CircularProgress size={size} />
     </Box>
-  )
-}
+  );
+};
diff --git a/site/src/components/LoadingButton/LoadingButton.stories.tsx b/site/src/components/LoadingButton/LoadingButton.stories.tsx
deleted file mode 100644
index 30c43745c26ed..0000000000000
--- a/site/src/components/LoadingButton/LoadingButton.stories.tsx
+++ /dev/null
@@ -1,28 +0,0 @@
-import { Story } from "@storybook/react"
-import { LoadingButton, LoadingButtonProps } from "./LoadingButton"
-
-export default {
-  title: "components/LoadingButton",
-  component: LoadingButton,
-  argTypes: {
-    loading: { control: "boolean" },
-    children: { control: "text" },
-  },
-  args: {
-    children: "Create workspace",
-  },
-}
-
-const Template: Story<LoadingButtonProps> = (args) => (
-  <LoadingButton {...args} />
-)
-
-export const Loading = Template.bind({})
-Loading.args = {
-  loading: true,
-}
-
-export const NotLoading = Template.bind({})
-NotLoading.args = {
-  loading: false,
-}
diff --git a/site/src/components/LoadingButton/LoadingButton.tsx b/site/src/components/LoadingButton/LoadingButton.tsx
deleted file mode 100644
index 5270df37c43a5..0000000000000
--- a/site/src/components/LoadingButton/LoadingButton.tsx
+++ /dev/null
@@ -1,25 +0,0 @@
-import { forwardRef } from "react"
-import MuiLoadingButton, {
-  LoadingButtonProps as MuiLoadingButtonProps,
-} from "@mui/lab/LoadingButton"
-
-export type LoadingButtonProps = MuiLoadingButtonProps
-
-export const LoadingButton = forwardRef<
-  HTMLButtonElement,
-  MuiLoadingButtonProps
->(({ children, loadingIndicator, ...buttonProps }, ref) => {
-  return (
-    <MuiLoadingButton
-      variant="outlined"
-      color="neutral"
-      ref={ref}
-      {...buttonProps}
-    >
-      {/* known issue: https://github.com/mui/material-ui/issues/27853 */}
-      <span>
-        {buttonProps.loading && loadingIndicator ? loadingIndicator : children}
-      </span>
-    </MuiLoadingButton>
-  )
-})
diff --git a/site/src/components/Logs/Logs.stories.tsx b/site/src/components/Logs/Logs.stories.tsx
deleted file mode 100644
index 7f211cc9381e1..0000000000000
--- a/site/src/components/Logs/Logs.stories.tsx
+++ /dev/null
@@ -1,27 +0,0 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { LogLevel } from "api/typesGenerated"
-import { MockWorkspaceBuildLogs } from "../../testHelpers/entities"
-import { Logs, LogsProps } from "./Logs"
-
-export default {
-  title: "components/Logs",
-  component: Logs,
-} as ComponentMeta<typeof Logs>
-
-const Template: Story<LogsProps> = (args) => <Logs {...args} />
-
-const lines = MockWorkspaceBuildLogs.map((log) => ({
-  time: log.created_at,
-  output: log.output,
-  level: "info" as LogLevel,
-}))
-export const Example = Template.bind({})
-Example.args = {
-  lines,
-}
-
-export const WithLineNumbers = Template.bind({})
-WithLineNumbers.args = {
-  lines,
-  lineNumbers: true,
-}
diff --git a/site/src/components/Logs/Logs.tsx b/site/src/components/Logs/Logs.tsx
deleted file mode 100644
index 6ad2e6ddf34df..0000000000000
--- a/site/src/components/Logs/Logs.tsx
+++ /dev/null
@@ -1,149 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import { LogLevel } from "api/typesGenerated"
-import dayjs from "dayjs"
-import { FC, useMemo } from "react"
-import { MONOSPACE_FONT_FAMILY } from "../../theme/constants"
-import { combineClasses } from "../../utils/combineClasses"
-import AnsiToHTML from "ansi-to-html"
-import { Theme } from "@mui/material/styles"
-
-export interface Line {
-  time: string
-  output: string
-  level: LogLevel
-}
-
-export interface LogsProps {
-  lines: Line[]
-  hideTimestamps?: boolean
-  lineNumbers?: boolean
-  className?: string
-}
-
-export const Logs: FC<React.PropsWithChildren<LogsProps>> = ({
-  hideTimestamps,
-  lines,
-  lineNumbers,
-  className = "",
-}) => {
-  const styles = useStyles({
-    lineNumbers: Boolean(lineNumbers),
-  })
-
-  return (
-    <div className={combineClasses([className, styles.root])}>
-      <div className={styles.scrollWrapper}>
-        {lines.map((line, idx) => (
-          <div className={combineClasses([styles.line, line.level])} key={idx}>
-            {!hideTimestamps && (
-              <>
-                <span className={styles.time}>
-                  {lineNumbers
-                    ? idx + 1
-                    : dayjs(line.time).format(`HH:mm:ss.SSS`)}
-                </span>
-                <span className={styles.space} />
-              </>
-            )}
-            <span>{line.output}</span>
-          </div>
-        ))}
-      </div>
-    </div>
-  )
-}
-
-export const logLineHeight = 20
-
-const convert = new AnsiToHTML()
-
-export const LogLine: FC<{
-  line: Line
-  hideTimestamp?: boolean
-  number?: number
-  style?: React.CSSProperties
-}> = ({ line, hideTimestamp, number, style }) => {
-  const styles = useStyles({
-    lineNumbers: Boolean(number),
-  })
-  const output = useMemo(() => {
-    return convert.toHtml(line.output.split(/\r/g).pop() as string)
-  }, [line.output])
-
-  return (
-    <div className={combineClasses([styles.line, line.level])} style={style}>
-      {!hideTimestamp && (
-        <>
-          <span className={styles.time}>
-            {number ? number : dayjs(line.time).format(`HH:mm:ss.SSS`)}
-          </span>
-          <span className={styles.space} />
-        </>
-      )}
-      <span
-        dangerouslySetInnerHTML={{
-          __html: output,
-        }}
-      />
-    </div>
-  )
-}
-
-const useStyles = makeStyles<
-  Theme,
-  {
-    lineNumbers: boolean
-  }
->((theme) => ({
-  root: {
-    minHeight: 156,
-    padding: theme.spacing(1, 0),
-    borderRadius: theme.shape.borderRadius,
-    overflowX: "auto",
-    background: theme.palette.background.default,
-
-    "&:not(:last-child)": {
-      borderBottom: `1px solid ${theme.palette.divider}`,
-      borderRadius: 0,
-    },
-  },
-  scrollWrapper: {
-    minWidth: "fit-content",
-  },
-  line: {
-    wordBreak: "break-all",
-    display: "flex",
-    fontSize: 14,
-    color: theme.palette.text.primary,
-    fontFamily: MONOSPACE_FONT_FAMILY,
-    height: ({ lineNumbers }) => (lineNumbers ? logLineHeight : "auto"),
-    // Whitespace is significant in terminal output for alignment
-    whiteSpace: "pre",
-    padding: theme.spacing(0, 4),
-
-    "&.error": {
-      backgroundColor: theme.palette.error.dark,
-    },
-
-    "&.debug": {
-      backgroundColor: theme.palette.background.paperLight,
-    },
-
-    "&.warn": {
-      backgroundColor: theme.palette.warning.dark,
-    },
-  },
-  space: {
-    userSelect: "none",
-    width: theme.spacing(3),
-    display: "block",
-    flexShrink: 0,
-  },
-  time: {
-    userSelect: "none",
-    width: ({ lineNumbers }) => theme.spacing(lineNumbers ? 3.5 : 12.5),
-    whiteSpace: "pre",
-    display: "inline-block",
-    color: theme.palette.text.secondary,
-  },
-}))
diff --git a/site/src/components/Margins/Margins.stories.tsx b/site/src/components/Margins/Margins.stories.tsx
index be798fa22ddf3..403d643c27c1f 100644
--- a/site/src/components/Margins/Margins.stories.tsx
+++ b/site/src/components/Margins/Margins.stories.tsx
@@ -1,17 +1,22 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { Margins } from "./Margins"
+import type { Meta, StoryObj } from "@storybook/react";
+import { Margins } from "./Margins";
 
-export default {
+const meta: Meta<typeof Margins> = {
   title: "components/Margins",
   component: Margins,
-} as ComponentMeta<typeof Margins>
+};
 
-const Template: Story = (args) => (
-  <Margins {...args}>
-    <div style={{ width: "100%", background: "black" }}>
-      Here is some content that will not get too wide!
-    </div>
-  </Margins>
-)
+export default meta;
+type Story = StoryObj<typeof Margins>;
 
-export const Example = Template.bind({})
+const Example: Story = {
+  args: {
+    children: (
+      <div style={{ width: "100%", background: "black" }}>
+        Here is some content that will not get too wide!
+      </div>
+    ),
+  },
+};
+
+export { Example as Margins };
diff --git a/site/src/components/Margins/Margins.tsx b/site/src/components/Margins/Margins.tsx
index 0e3af4db9440b..04304197a1bbe 100644
--- a/site/src/components/Margins/Margins.tsx
+++ b/site/src/components/Margins/Margins.tsx
@@ -1,38 +1,32 @@
-import { makeStyles } from "@mui/styles"
-import { FC } from "react"
-import { combineClasses } from "utils/combineClasses"
+import { type FC } from "react";
 import {
   containerWidth,
   containerWidthMedium,
   sidePadding,
-} from "../../theme/constants"
+} from "theme/constants";
 
-type Size = "regular" | "medium" | "small"
+type Size = "regular" | "medium" | "small";
 
 const widthBySize: Record<Size, number> = {
   regular: containerWidth,
   medium: containerWidthMedium,
   small: containerWidth / 3,
-}
-
-const useStyles = makeStyles(() => ({
-  margins: {
-    margin: "0 auto",
-    maxWidth: ({ maxWidth }: { maxWidth: number }) => maxWidth,
-    padding: `0 ${sidePadding}px`,
-    width: "100%",
-  },
-}))
+};
 
 export const Margins: FC<JSX.IntrinsicElements["div"] & { size?: Size }> = ({
   size = "regular",
   ...divProps
 }) => {
-  const styles = useStyles({ maxWidth: widthBySize[size] })
+  const maxWidth = widthBySize[size];
   return (
     <div
       {...divProps}
-      className={combineClasses([styles.margins, divProps.className])}
+      css={{
+        margin: "0 auto",
+        maxWidth: maxWidth,
+        padding: `0 ${sidePadding}px`,
+        width: "100%",
+      }}
     />
-  )
-}
+  );
+};
diff --git a/site/src/components/Markdown/Markdown.stories.tsx b/site/src/components/Markdown/Markdown.stories.tsx
index 5319947c67ed5..5c721aad661e7 100644
--- a/site/src/components/Markdown/Markdown.stories.tsx
+++ b/site/src/components/Markdown/Markdown.stories.tsx
@@ -1,18 +1,17 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { Markdown, MarkdownProps } from "./Markdown"
+import type { Meta, StoryObj } from "@storybook/react";
+import { Markdown } from "./Markdown";
 
-export default {
+const meta: Meta<typeof Markdown> = {
   title: "components/Markdown",
   component: Markdown,
-} as ComponentMeta<typeof Markdown>
+};
 
-const Template: Story<MarkdownProps> = ({ children }) => (
-  <Markdown>{children}</Markdown>
-)
+export default meta;
+type Story = StoryObj<typeof Markdown>;
 
-export const WithCode = Template.bind({})
-WithCode.args = {
-  children: `
+export const WithCode: Story = {
+  args: {
+    children: `
   ## Required permissions / policy
 
   The following sample policy allows Coder to create EC2 instances and modify instances provisioned by Coder:
@@ -64,12 +63,14 @@ WithCode.args = {
     ]
   }
   \`\`\``,
-}
+  },
+};
 
-export const WithTable = Template.bind({})
-WithTable.args = {
-  children: `
+export const WithTable: Story = {
+  args: {
+    children: `
   | heading | b  |  c |  d  |
   | - | :- | -: | :-: |
   | cell 1 | cell 2 | 3 | 4 | `,
-}
+  },
+};
diff --git a/site/src/components/Markdown/Markdown.tsx b/site/src/components/Markdown/Markdown.tsx
index 85261e5993a57..5391e965172bb 100644
--- a/site/src/components/Markdown/Markdown.tsx
+++ b/site/src/components/Markdown/Markdown.tsx
@@ -1,32 +1,34 @@
-import Link from "@mui/material/Link"
-import { makeStyles } from "@mui/styles"
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableHead from "@mui/material/TableHead"
-import TableRow from "@mui/material/TableRow"
-import { FC, memo } from "react"
-import ReactMarkdown from "react-markdown"
-import { Prism as SyntaxHighlighter } from "react-syntax-highlighter"
-import gfm from "remark-gfm"
-import { colors } from "theme/colors"
-import { darcula } from "react-syntax-highlighter/dist/cjs/styles/prism"
-import { combineClasses } from "utils/combineClasses"
-
-export interface MarkdownProps {
-  children: string
+import Link from "@mui/material/Link";
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableHead from "@mui/material/TableHead";
+import TableRow from "@mui/material/TableRow";
+import { FC, memo } from "react";
+import ReactMarkdown from "react-markdown";
+import { Prism as SyntaxHighlighter } from "react-syntax-highlighter";
+import gfm from "remark-gfm";
+import { colors } from "theme/colors";
+import { darcula } from "react-syntax-highlighter/dist/cjs/styles/prism";
+import { type Interpolation, type Theme } from "@emotion/react";
+
+interface MarkdownProps {
+  /**
+   * The Markdown text to parse and render
+   */
+  children: string;
+
+  className?: string;
 }
 
-export const Markdown: FC<{ children: string; className?: string }> = ({
-  children,
-  className,
-}) => {
-  const styles = useStyles()
+export const Markdown: FC<MarkdownProps> = (props) => {
+  const { children, className } = props;
 
   return (
     <ReactMarkdown
-      className={combineClasses([styles.markdown, className])}
+      css={markdownStyles}
+      className={className}
       remarkPlugins={[gfm]}
       components={{
         a: ({ href, target, children }) => (
@@ -36,17 +38,17 @@ export const Markdown: FC<{ children: string; className?: string }> = ({
         ),
 
         pre: ({ node, children }) => {
-          const firstChild = node.children[0]
+          const firstChild = node.children[0];
           // When pre is wrapping a code, the SyntaxHighlighter is already going
           // to wrap it with a pre so we don't need it
           if (firstChild.type === "element" && firstChild.tagName === "code") {
-            return <>{children}</>
+            return <>{children}</>;
           }
-          return <pre>{children}</pre>
+          return <pre>{children}</pre>;
         },
 
         code: ({ node, inline, className, children, style, ...props }) => {
-          const match = /language-(\w+)/.exec(className || "")
+          const match = /language-(\w+)/.exec(className || "");
 
           return !inline && match ? (
             <SyntaxHighlighter
@@ -62,10 +64,19 @@ export const Markdown: FC<{ children: string; className?: string }> = ({
               {String(children)}
             </SyntaxHighlighter>
           ) : (
-            <code className={styles.codeWithoutLanguage} {...props}>
+            <code
+              css={(theme) => ({
+                padding: theme.spacing(0.125, 0.5),
+                background: theme.palette.divider,
+                borderRadius: 4,
+                color: theme.palette.text.primary,
+                fontSize: 14,
+              })}
+              {...props}
+            >
               {children}
             </code>
-          )
+          );
         },
 
         table: ({ children }) => {
@@ -73,93 +84,88 @@ export const Markdown: FC<{ children: string; className?: string }> = ({
             <TableContainer>
               <Table>{children}</Table>
             </TableContainer>
-          )
+          );
         },
 
         tr: ({ children }) => {
-          return <TableRow>{children}</TableRow>
+          return <TableRow>{children}</TableRow>;
         },
 
         thead: ({ children }) => {
-          return <TableHead>{children}</TableHead>
+          return <TableHead>{children}</TableHead>;
         },
 
         tbody: ({ children }) => {
-          return <TableBody>{children}</TableBody>
+          return <TableBody>{children}</TableBody>;
         },
 
         td: ({ children }) => {
-          return <TableCell>{children}</TableCell>
+          return <TableCell>{children}</TableCell>;
         },
 
         th: ({ children }) => {
-          return <TableCell>{children}</TableCell>
+          return <TableCell>{children}</TableCell>;
         },
       }}
     >
       {children}
     </ReactMarkdown>
-  )
-}
+  );
+};
 
-export const MemoizedMarkdown = memo(Markdown)
+export const MemoizedMarkdown = memo(Markdown);
 
-const useStyles = makeStyles((theme) => ({
-  markdown: {
-    fontSize: 16,
-    lineHeight: "24px",
+const markdownStyles: Interpolation<Theme> = (theme: Theme) => ({
+  fontSize: 16,
+  lineHeight: "24px",
 
-    "& h1, & h2, & h3, & h4, & h5, & h6": {
-      marginTop: theme.spacing(4),
-      marginBottom: theme.spacing(2),
-      lineHeight: "1.25",
-    },
+  "& h1, & h2, & h3, & h4, & h5, & h6": {
+    marginTop: theme.spacing(4),
+    marginBottom: theme.spacing(2),
+    lineHeight: "1.25",
+  },
 
-    "& p": {
-      marginTop: 0,
-      marginBottom: theme.spacing(2),
-    },
+  "& p": {
+    marginTop: 0,
+    marginBottom: theme.spacing(2),
+  },
 
-    "& ul, & ol": {
-      display: "flex",
-      flexDirection: "column",
-      gap: theme.spacing(1),
-      marginBottom: theme.spacing(2),
-    },
+  "& p:only-child": {
+    marginTop: 0,
+    marginBottom: 0,
+  },
 
-    "& li > ul, & li > ol": {
-      marginTop: theme.spacing(2),
-    },
+  "& ul, & ol": {
+    display: "flex",
+    flexDirection: "column",
+    gap: theme.spacing(1),
+    marginBottom: theme.spacing(2),
+  },
 
-    "& li > p": {
-      marginBottom: 0,
-    },
+  "& li > ul, & li > ol": {
+    marginTop: theme.spacing(2),
+  },
 
-    "& .prismjs": {
-      background: theme.palette.background.paperLight,
-      borderRadius: theme.shape.borderRadius,
-      padding: theme.spacing(2, 3),
-      overflowX: "auto",
+  "& li > p": {
+    marginBottom: 0,
+  },
 
-      "& code": {
-        color: theme.palette.text.secondary,
-      },
+  "& .prismjs": {
+    background: theme.palette.background.paperLight,
+    borderRadius: theme.shape.borderRadius,
+    padding: theme.spacing(2, 3),
+    overflowX: "auto",
 
-      "& .key, & .property, & .inserted, .keyword": {
-        color: colors.turquoise[7],
-      },
+    "& code": {
+      color: theme.palette.text.secondary,
+    },
 
-      "& .deleted": {
-        color: theme.palette.error.light,
-      },
+    "& .key, & .property, & .inserted, .keyword": {
+      color: colors.turquoise[7],
     },
-  },
 
-  codeWithoutLanguage: {
-    padding: theme.spacing(0.125, 0.5),
-    background: theme.palette.divider,
-    borderRadius: 4,
-    color: theme.palette.text.primary,
-    fontSize: 14,
+    "& .deleted": {
+      color: theme.palette.error.light,
+    },
   },
-}))
+});
diff --git a/site/src/components/MultiTextField/MultiTextField.stories.tsx b/site/src/components/MultiTextField/MultiTextField.stories.tsx
deleted file mode 100644
index 9761e15f032da..0000000000000
--- a/site/src/components/MultiTextField/MultiTextField.stories.tsx
+++ /dev/null
@@ -1,16 +0,0 @@
-import { Story } from "@storybook/react"
-import { useState } from "react"
-import { MultiTextField, MultiTextFieldProps } from "./MultiTextField"
-
-export default {
-  title: "components/MultiTextField",
-  component: MultiTextField,
-}
-
-const Template: Story<MultiTextFieldProps> = (args) => {
-  const [values, setValues] = useState(args.values ?? ["foo", "bar"])
-  return <MultiTextField {...args} values={values} onChange={setValues} />
-}
-
-export const Example = Template.bind({})
-Example.args = {}
diff --git a/site/src/components/MultiTextField/MultiTextField.tsx b/site/src/components/MultiTextField/MultiTextField.tsx
deleted file mode 100644
index a3244580b6d30..0000000000000
--- a/site/src/components/MultiTextField/MultiTextField.tsx
+++ /dev/null
@@ -1,104 +0,0 @@
-import Chip from "@mui/material/Chip"
-import FormHelperText from "@mui/material/FormHelperText"
-import { makeStyles } from "@mui/styles"
-import { FC } from "react"
-
-export type MultiTextFieldProps = {
-  label: string
-  values: string[]
-  onChange: (values: string[]) => void
-}
-
-export const MultiTextField: FC<MultiTextFieldProps> = ({
-  label,
-  values,
-  onChange,
-}) => {
-  const styles = useStyles()
-
-  return (
-    <div>
-      <label className={styles.root}>
-        {values.map((value, index) => (
-          <Chip
-            key={index}
-            label={value}
-            size="small"
-            onDelete={() => {
-              onChange(values.filter((oldValue) => oldValue !== value))
-            }}
-          />
-        ))}
-        <input
-          aria-label={label}
-          className={styles.input}
-          onKeyDown={(event) => {
-            if (event.key === ",") {
-              event.preventDefault()
-              const newValue = event.currentTarget.value
-              onChange([...values, newValue])
-              event.currentTarget.value = ""
-              return
-            }
-
-            if (event.key === "Backspace" && event.currentTarget.value === "") {
-              event.preventDefault()
-
-              if (values.length === 0) {
-                return
-              }
-
-              const lastValue = values[values.length - 1]
-              onChange(values.slice(0, -1))
-              event.currentTarget.value = lastValue
-            }
-          }}
-          onBlur={(event) => {
-            if (event.currentTarget.value !== "") {
-              const newValue = event.currentTarget.value
-              onChange([...values, newValue])
-              event.currentTarget.value = ""
-            }
-          }}
-        />
-      </label>
-
-      <FormHelperText>{'Type "," to separate the values'}</FormHelperText>
-    </div>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    border: `1px solid ${theme.palette.divider}`,
-    borderRadius: theme.shape.borderRadius,
-    minHeight: theme.spacing(6), // Chip height + paddings
-    padding: theme.spacing(1.25, 1.75),
-    fontSize: theme.spacing(2),
-    display: "flex",
-    flexWrap: "wrap",
-    gap: theme.spacing(1),
-    position: "relative",
-    margin: theme.spacing(1, 0, 0.5), // Have same margin than TextField
-
-    "&:has(input:focus)": {
-      borderColor: theme.palette.primary.main,
-      borderWidth: 2,
-      // Compensate for the border width
-      top: -1,
-      left: -1,
-    },
-  },
-
-  input: {
-    flexGrow: 1,
-    fontSize: "inherit",
-    padding: 0,
-    border: "none",
-    background: "none",
-
-    "&:focus": {
-      outline: "none",
-    },
-  },
-}))
diff --git a/site/src/components/Navbar/Navbar.test.tsx b/site/src/components/Navbar/Navbar.test.tsx
deleted file mode 100644
index 8bdac69e67443..0000000000000
--- a/site/src/components/Navbar/Navbar.test.tsx
+++ /dev/null
@@ -1,68 +0,0 @@
-import { render, screen, waitFor } from "@testing-library/react"
-import { App } from "app"
-import { Language } from "./NavbarView"
-import { rest } from "msw"
-import {
-  MockEntitlementsWithAuditLog,
-  MockMemberPermissions,
-} from "testHelpers/entities"
-import { server } from "testHelpers/server"
-
-/**
- * The LicenseBanner, mounted above the AppRouter, fetches entitlements. Thus, to test their
- * effects, we must test at the App level and `waitFor` the fetch to be done.
- */
-describe("Navbar", () => {
-  it("shows Audit Log link when permitted and entitled", async () => {
-    // set entitlements to allow audit log
-    server.use(
-      rest.get("/api/v2/entitlements", (req, res, ctx) => {
-        return res(ctx.status(200), ctx.json(MockEntitlementsWithAuditLog))
-      }),
-    )
-    render(<App />)
-    await waitFor(
-      () => {
-        const link = screen.getByText(Language.audit)
-        expect(link).toBeDefined()
-      },
-      { timeout: 2000 },
-    )
-  })
-
-  it("does not show Audit Log link when not entitled", async () => {
-    // by default, user is an Admin with permission to see the audit log,
-    // but is unlicensed so not entitled to see the audit log
-    render(<App />)
-    await waitFor(
-      () => {
-        const link = screen.queryByText(Language.audit)
-        expect(link).toBe(null)
-      },
-      { timeout: 2000 },
-    )
-  })
-
-  it("does not show Audit Log link when not permitted via role", async () => {
-    // set permissions to Member (can't audit)
-    server.use(
-      rest.post("/api/v2/authcheck", async (req, res, ctx) => {
-        return res(ctx.status(200), ctx.json(MockMemberPermissions))
-      }),
-    )
-    // set entitlements to allow audit log
-    server.use(
-      rest.get("/api/v2/entitlements", (req, res, ctx) => {
-        return res(ctx.status(200), ctx.json(MockEntitlementsWithAuditLog))
-      }),
-    )
-    render(<App />)
-    await waitFor(
-      () => {
-        const link = screen.queryByText(Language.audit)
-        expect(link).toBe(null)
-      },
-      { timeout: 2000 },
-    )
-  })
-})
diff --git a/site/src/components/Navbar/Navbar.tsx b/site/src/components/Navbar/Navbar.tsx
deleted file mode 100644
index d8cd46b8f21f7..0000000000000
--- a/site/src/components/Navbar/Navbar.tsx
+++ /dev/null
@@ -1,39 +0,0 @@
-import { useAuth } from "components/AuthProvider/AuthProvider"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import { useFeatureVisibility } from "hooks/useFeatureVisibility"
-import { useMe } from "hooks/useMe"
-import { usePermissions } from "hooks/usePermissions"
-import { FC } from "react"
-import { NavbarView } from "./NavbarView"
-import { useProxy } from "contexts/ProxyContext"
-
-export const Navbar: FC = () => {
-  const { appearance, buildInfo } = useDashboard()
-  const [_, authSend] = useAuth()
-  const me = useMe()
-  const permissions = usePermissions()
-  const featureVisibility = useFeatureVisibility()
-  const canViewAuditLog =
-    featureVisibility["audit_log"] && Boolean(permissions.viewAuditLog)
-  const canViewDeployment = Boolean(permissions.viewDeploymentValues)
-  const canViewAllUsers = Boolean(permissions.readAllUsers)
-  const onSignOut = () => authSend("SIGN_OUT")
-  const proxyContextValue = useProxy()
-  const dashboard = useDashboard()
-
-  return (
-    <NavbarView
-      user={me}
-      logo_url={appearance.config.logo_url}
-      buildInfo={buildInfo}
-      supportLinks={appearance.config.support_links}
-      onSignOut={onSignOut}
-      canViewAuditLog={canViewAuditLog}
-      canViewDeployment={canViewDeployment}
-      canViewAllUsers={canViewAllUsers}
-      proxyContextValue={
-        dashboard.experiments.includes("moons") ? proxyContextValue : undefined
-      }
-    />
-  )
-}
diff --git a/site/src/components/Navbar/NavbarView.stories.tsx b/site/src/components/Navbar/NavbarView.stories.tsx
deleted file mode 100644
index 83347adbe038a..0000000000000
--- a/site/src/components/Navbar/NavbarView.stories.tsx
+++ /dev/null
@@ -1,45 +0,0 @@
-import { Story } from "@storybook/react"
-import { MockUser, MockUser2 } from "../../testHelpers/entities"
-import { NavbarView, NavbarViewProps } from "./NavbarView"
-
-export default {
-  title: "components/NavbarView",
-  component: NavbarView,
-  argTypes: {
-    onSignOut: { action: "Sign Out" },
-  },
-}
-
-const Template: Story<NavbarViewProps> = (args: NavbarViewProps) => (
-  <NavbarView {...args} />
-)
-
-export const ForAdmin = Template.bind({})
-ForAdmin.args = {
-  user: MockUser,
-  onSignOut: () => {
-    return Promise.resolve()
-  },
-}
-
-export const ForMember = Template.bind({})
-ForMember.args = {
-  user: MockUser2,
-  onSignOut: () => {
-    return Promise.resolve()
-  },
-}
-
-export const SmallViewport = Template.bind({})
-SmallViewport.args = {
-  user: MockUser,
-  onSignOut: () => {
-    return Promise.resolve()
-  },
-}
-SmallViewport.parameters = {
-  viewport: {
-    defaultViewport: "tablet",
-  },
-  chromatic: { viewports: [420] },
-}
diff --git a/site/src/components/Navbar/NavbarView.test.tsx b/site/src/components/Navbar/NavbarView.test.tsx
deleted file mode 100644
index 307670708cc72..0000000000000
--- a/site/src/components/Navbar/NavbarView.test.tsx
+++ /dev/null
@@ -1,175 +0,0 @@
-import { screen } from "@testing-library/react"
-import {
-  MockPrimaryWorkspaceProxy,
-  MockUser,
-  MockUser2,
-} from "../../testHelpers/entities"
-import { renderWithAuth } from "../../testHelpers/renderHelpers"
-import { Language as navLanguage, NavbarView } from "./NavbarView"
-import { ProxyContextValue } from "contexts/ProxyContext"
-import { action } from "@storybook/addon-actions"
-
-const proxyContextValue: ProxyContextValue = {
-  proxy: {
-    preferredPathAppURL: "",
-    preferredWildcardHostname: "",
-    proxy: MockPrimaryWorkspaceProxy,
-  },
-  isLoading: false,
-  isFetched: true,
-  setProxy: jest.fn(),
-  clearProxy: action("clearProxy"),
-  refetchProxyLatencies: jest.fn(),
-  proxyLatencies: {},
-}
-
-describe("NavbarView", () => {
-  const noop = () => {
-    return
-  }
-
-  const env = process.env
-
-  // REMARK: copying process.env so we don't mutate that object or encounter conflicts between tests
-  beforeEach(() => {
-    process.env = { ...env }
-  })
-
-  // REMARK: restoring process.env
-  afterEach(() => {
-    process.env = env
-  })
-
-  it("workspaces nav link has the correct href", async () => {
-    renderWithAuth(
-      <NavbarView
-        proxyContextValue={proxyContextValue}
-        user={MockUser}
-        onSignOut={noop}
-        canViewAuditLog
-        canViewDeployment
-        canViewAllUsers
-      />,
-    )
-    const workspacesLink = await screen.findByText(navLanguage.workspaces)
-    expect((workspacesLink as HTMLAnchorElement).href).toContain("/workspaces")
-  })
-
-  it("templates nav link has the correct href", async () => {
-    renderWithAuth(
-      <NavbarView
-        proxyContextValue={proxyContextValue}
-        user={MockUser}
-        onSignOut={noop}
-        canViewAuditLog
-        canViewDeployment
-        canViewAllUsers
-      />,
-    )
-    const templatesLink = await screen.findByText(navLanguage.templates)
-    expect((templatesLink as HTMLAnchorElement).href).toContain("/templates")
-  })
-
-  it("users nav link has the correct href", async () => {
-    renderWithAuth(
-      <NavbarView
-        proxyContextValue={proxyContextValue}
-        user={MockUser}
-        onSignOut={noop}
-        canViewAuditLog
-        canViewDeployment
-        canViewAllUsers
-      />,
-    )
-    const userLink = await screen.findByText(navLanguage.users)
-    expect((userLink as HTMLAnchorElement).href).toContain("/users")
-  })
-
-  it("renders profile picture for user", async () => {
-    // Given
-    const mockUser = {
-      ...MockUser,
-      username: "bryan",
-      avatar_url: "",
-    }
-
-    // When
-    renderWithAuth(
-      <NavbarView
-        proxyContextValue={proxyContextValue}
-        user={mockUser}
-        onSignOut={noop}
-        canViewAuditLog
-        canViewDeployment
-        canViewAllUsers
-      />,
-    )
-
-    // Then
-    // There should be a 'B' avatar!
-    const element = await screen.findByText("B")
-    expect(element).toBeDefined()
-  })
-
-  it("audit nav link has the correct href", async () => {
-    renderWithAuth(
-      <NavbarView
-        proxyContextValue={proxyContextValue}
-        user={MockUser}
-        onSignOut={noop}
-        canViewAuditLog
-        canViewDeployment
-        canViewAllUsers
-      />,
-    )
-    const auditLink = await screen.findByText(navLanguage.audit)
-    expect((auditLink as HTMLAnchorElement).href).toContain("/audit")
-  })
-
-  it("audit nav link is hidden for members", async () => {
-    renderWithAuth(
-      <NavbarView
-        proxyContextValue={proxyContextValue}
-        user={MockUser2}
-        onSignOut={noop}
-        canViewAuditLog={false}
-        canViewDeployment
-        canViewAllUsers
-      />,
-    )
-    const auditLink = screen.queryByText(navLanguage.audit)
-    expect(auditLink).not.toBeInTheDocument()
-  })
-
-  it("deployment nav link has the correct href", async () => {
-    renderWithAuth(
-      <NavbarView
-        proxyContextValue={proxyContextValue}
-        user={MockUser}
-        onSignOut={noop}
-        canViewAuditLog
-        canViewDeployment
-        canViewAllUsers
-      />,
-    )
-    const auditLink = await screen.findByText(navLanguage.deployment)
-    expect((auditLink as HTMLAnchorElement).href).toContain(
-      "/settings/deployment/general",
-    )
-  })
-
-  it("deployment nav link is hidden for members", async () => {
-    renderWithAuth(
-      <NavbarView
-        proxyContextValue={proxyContextValue}
-        user={MockUser2}
-        onSignOut={noop}
-        canViewAuditLog={false}
-        canViewDeployment={false}
-        canViewAllUsers
-      />,
-    )
-    const auditLink = screen.queryByText(navLanguage.deployment)
-    expect(auditLink).not.toBeInTheDocument()
-  })
-})
diff --git a/site/src/components/Navbar/NavbarView.tsx b/site/src/components/Navbar/NavbarView.tsx
deleted file mode 100644
index 6bc5777b95064..0000000000000
--- a/site/src/components/Navbar/NavbarView.tsx
+++ /dev/null
@@ -1,473 +0,0 @@
-import Drawer from "@mui/material/Drawer"
-import IconButton from "@mui/material/IconButton"
-import List from "@mui/material/List"
-import ListItem from "@mui/material/ListItem"
-import { makeStyles } from "@mui/styles"
-import MenuIcon from "@mui/icons-material/Menu"
-import { CoderIcon } from "components/Icons/CoderIcon"
-import { FC, useRef, useState } from "react"
-import { NavLink, useLocation, useNavigate } from "react-router-dom"
-import { colors } from "theme/colors"
-import * as TypesGen from "../../api/typesGenerated"
-import { navHeight } from "../../theme/constants"
-import { combineClasses } from "../../utils/combineClasses"
-import { UserDropdown } from "../UserDropdown/UsersDropdown"
-import Box from "@mui/material/Box"
-import Menu from "@mui/material/Menu"
-import Button from "@mui/material/Button"
-import MenuItem from "@mui/material/MenuItem"
-import KeyboardArrowDownOutlined from "@mui/icons-material/KeyboardArrowDownOutlined"
-import { ProxyContextValue } from "contexts/ProxyContext"
-import { displayError } from "components/GlobalSnackbar/utils"
-import Divider from "@mui/material/Divider"
-import Skeleton from "@mui/material/Skeleton"
-import { BUTTON_SM_HEIGHT } from "theme/theme"
-import { ProxyStatusLatency } from "components/ProxyStatusLatency/ProxyStatusLatency"
-import { usePermissions } from "hooks/usePermissions"
-import Typography from "@mui/material/Typography"
-
-export const USERS_LINK = `/users?filter=${encodeURIComponent("status:active")}`
-
-export interface NavbarViewProps {
-  logo_url?: string
-  user?: TypesGen.User
-  buildInfo?: TypesGen.BuildInfoResponse
-  supportLinks?: TypesGen.LinkConfig[]
-  onSignOut: () => void
-  canViewAuditLog: boolean
-  canViewDeployment: boolean
-  canViewAllUsers: boolean
-  proxyContextValue?: ProxyContextValue
-}
-
-export const Language = {
-  workspaces: "Workspaces",
-  templates: "Templates",
-  users: "Users",
-  audit: "Audit",
-  deployment: "Deployment",
-}
-
-const NavItems: React.FC<
-  React.PropsWithChildren<{
-    className?: string
-    canViewAuditLog: boolean
-    canViewDeployment: boolean
-    canViewAllUsers: boolean
-  }>
-> = ({ className, canViewAuditLog, canViewDeployment, canViewAllUsers }) => {
-  const styles = useStyles()
-  const location = useLocation()
-
-  return (
-    <List className={combineClasses([styles.navItems, className])}>
-      <ListItem button className={styles.item}>
-        <NavLink
-          className={combineClasses([
-            styles.link,
-            location.pathname.startsWith("/@") && "active",
-          ])}
-          to="/workspaces"
-        >
-          {Language.workspaces}
-        </NavLink>
-      </ListItem>
-      <ListItem button className={styles.item}>
-        <NavLink className={styles.link} to="/templates">
-          {Language.templates}
-        </NavLink>
-      </ListItem>
-      {canViewAllUsers && (
-        <ListItem button className={styles.item}>
-          <NavLink className={styles.link} to={USERS_LINK}>
-            {Language.users}
-          </NavLink>
-        </ListItem>
-      )}
-      {canViewAuditLog && (
-        <ListItem button className={styles.item}>
-          <NavLink className={styles.link} to="/audit">
-            {Language.audit}
-          </NavLink>
-        </ListItem>
-      )}
-      {canViewDeployment && (
-        <ListItem button className={styles.item}>
-          <NavLink className={styles.link} to="/settings/deployment/general">
-            {Language.deployment}
-          </NavLink>
-        </ListItem>
-      )}
-    </List>
-  )
-}
-export const NavbarView: FC<NavbarViewProps> = ({
-  user,
-  logo_url,
-  buildInfo,
-  supportLinks,
-  onSignOut,
-  canViewAuditLog,
-  canViewDeployment,
-  canViewAllUsers,
-  proxyContextValue,
-}) => {
-  const styles = useStyles()
-  const [isDrawerOpen, setIsDrawerOpen] = useState(false)
-
-  return (
-    <nav className={styles.root}>
-      <div className={styles.wrapper}>
-        <IconButton
-          aria-label="Open menu"
-          className={styles.mobileMenuButton}
-          onClick={() => {
-            setIsDrawerOpen(true)
-          }}
-          size="large"
-        >
-          <MenuIcon />
-        </IconButton>
-
-        <Drawer
-          anchor="left"
-          open={isDrawerOpen}
-          onClose={() => setIsDrawerOpen(false)}
-        >
-          <div className={styles.drawer}>
-            <div className={styles.drawerHeader}>
-              <div className={combineClasses([styles.logo, styles.drawerLogo])}>
-                {logo_url ? (
-                  <img src={logo_url} alt="Custom Logo" />
-                ) : (
-                  <CoderIcon />
-                )}
-              </div>
-            </div>
-            <NavItems
-              canViewAuditLog={canViewAuditLog}
-              canViewDeployment={canViewDeployment}
-              canViewAllUsers={canViewAllUsers}
-            />
-          </div>
-        </Drawer>
-
-        <NavLink className={styles.logo} to="/workspaces">
-          {logo_url ? (
-            <img src={logo_url} alt="Custom Logo" />
-          ) : (
-            <CoderIcon fill="white" opacity={1} width={125} />
-          )}
-        </NavLink>
-
-        <NavItems
-          className={styles.desktopNavItems}
-          canViewAuditLog={canViewAuditLog}
-          canViewDeployment={canViewDeployment}
-          canViewAllUsers={canViewAllUsers}
-        />
-
-        <Box
-          display="flex"
-          marginLeft={{ md: "auto" }}
-          gap={2}
-          alignItems="center"
-          paddingRight={2}
-        >
-          {proxyContextValue && (
-            <ProxyMenu proxyContextValue={proxyContextValue} />
-          )}
-          {user && (
-            <UserDropdown
-              user={user}
-              buildInfo={buildInfo}
-              supportLinks={supportLinks}
-              onSignOut={onSignOut}
-            />
-          )}
-        </Box>
-      </div>
-    </nav>
-  )
-}
-
-const ProxyMenu: FC<{ proxyContextValue: ProxyContextValue }> = ({
-  proxyContextValue,
-}) => {
-  const buttonRef = useRef<HTMLButtonElement>(null)
-  const [isOpen, setIsOpen] = useState(false)
-  const [refetchDate, setRefetchDate] = useState<Date>()
-  const selectedProxy = proxyContextValue.proxy.proxy
-  const refreshLatencies = proxyContextValue.refetchProxyLatencies
-  const closeMenu = () => setIsOpen(false)
-  const navigate = useNavigate()
-  const latencies = proxyContextValue.proxyLatencies
-  const isLoadingLatencies = Object.keys(latencies).length === 0
-  const isLoading = proxyContextValue.isLoading || isLoadingLatencies
-  const permissions = usePermissions()
-  const proxyLatencyLoading = (proxy: TypesGen.Region): boolean => {
-    if (!refetchDate) {
-      // Only show loading if the user manually requested a refetch
-      return false
-    }
-
-    const latency = latencies?.[proxy.id]
-    // Only show a loading spinner if:
-    //  - A latency exists. This means the latency was fetched at some point, so the
-    //    loader *should* be resolved.
-    //  - The proxy is healthy. If it is not, the loader might never resolve.
-    //  - The latency reported is older than the refetch date. This means the latency
-    //    is stale and we should show a loading spinner until the new latency is
-    //    fetched.
-    if (proxy.healthy && latency && latency.at < refetchDate) {
-      return true
-    }
-
-    return false
-  }
-
-  if (isLoading) {
-    return (
-      <Skeleton
-        width="160px"
-        height={BUTTON_SM_HEIGHT}
-        sx={{ borderRadius: "4px", transform: "none" }}
-      />
-    )
-  }
-
-  return (
-    <>
-      <Button
-        ref={buttonRef}
-        onClick={() => setIsOpen(true)}
-        size="small"
-        endIcon={<KeyboardArrowDownOutlined />}
-        sx={{
-          borderRadius: "4px",
-          "& .MuiSvgIcon-root": { fontSize: 14 },
-        }}
-      >
-        {selectedProxy ? (
-          <Box display="flex" gap={2} alignItems="center">
-            <Box width={14} height={14} lineHeight={0}>
-              <Box
-                component="img"
-                src={selectedProxy.icon_url}
-                alt=""
-                sx={{ objectFit: "contain" }}
-                width="100%"
-                height="100%"
-              />
-            </Box>
-            {selectedProxy.display_name}
-            <ProxyStatusLatency
-              latency={latencies?.[selectedProxy.id]?.latencyMS}
-              isLoading={proxyLatencyLoading(selectedProxy)}
-            />
-          </Box>
-        ) : (
-          "Select Proxy"
-        )}
-      </Button>
-      <Menu
-        open={isOpen}
-        anchorEl={buttonRef.current}
-        onClick={closeMenu}
-        onClose={closeMenu}
-        sx={{ "& .MuiMenu-paper": { py: 1 } }}
-      >
-        <Box
-          sx={{
-            w: "100%",
-            fontSize: 14,
-            padding: 2,
-            maxWidth: "320px",
-            lineHeight: "140%",
-          }}
-        >
-          <Typography
-            component="h4"
-            sx={{
-              fontSize: "inherit",
-              fontWeight: 600,
-              lineHeight: "inherit",
-              margin: 0,
-            }}
-          >
-            Select a region nearest to you
-          </Typography>
-          <Typography
-            component="p"
-            sx={{
-              fontSize: 13,
-              color: (theme) => theme.palette.text.secondary,
-              lineHeight: "inherit",
-              marginTop: 0.5,
-            }}
-          >
-            Workspace proxies improve terminal and web app connections to
-            workspaces. This does not apply to SSH connections.
-          </Typography>
-        </Box>
-        <Divider sx={{ borderColor: (theme) => theme.palette.divider }} />
-        {proxyContextValue.proxies
-          ?.sort((a, b) => {
-            const latencyA = latencies?.[a.id]?.latencyMS ?? Infinity
-            const latencyB = latencies?.[b.id]?.latencyMS ?? Infinity
-            return latencyA - latencyB
-          })
-          .map((proxy) => (
-            <MenuItem
-              onClick={() => {
-                if (!proxy.healthy) {
-                  displayError("Please select a healthy workspace proxy.")
-                  closeMenu()
-                  return
-                }
-
-                proxyContextValue.setProxy(proxy)
-                closeMenu()
-              }}
-              key={proxy.id}
-              selected={proxy.id === selectedProxy?.id}
-              sx={{
-                fontSize: 14,
-              }}
-            >
-              <Box display="flex" gap={3} alignItems="center" width="100%">
-                <Box width={14} height={14} lineHeight={0}>
-                  <Box
-                    component="img"
-                    src={proxy.icon_url}
-                    alt=""
-                    sx={{ objectFit: "contain" }}
-                    width="100%"
-                    height="100%"
-                  />
-                </Box>
-                {proxy.display_name}
-                <ProxyStatusLatency
-                  latency={latencies?.[proxy.id]?.latencyMS}
-                  isLoading={proxyLatencyLoading(proxy)}
-                />
-              </Box>
-            </MenuItem>
-          ))}
-        <Divider sx={{ borderColor: (theme) => theme.palette.divider }} />
-        {Boolean(permissions.editWorkspaceProxies) && (
-          <MenuItem
-            sx={{ fontSize: 14 }}
-            onClick={() => {
-              navigate("settings/deployment/workspace-proxies")
-            }}
-          >
-            Proxy settings
-          </MenuItem>
-        )}
-        <MenuItem
-          sx={{ fontSize: 14 }}
-          onClick={(e) => {
-            // Stop the menu from closing
-            e.stopPropagation()
-            // Refresh the latencies.
-            const refetchDate = refreshLatencies()
-            setRefetchDate(refetchDate)
-          }}
-        >
-          Refresh Latencies
-        </MenuItem>
-      </Menu>
-    </>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  displayInitial: {
-    display: "initial",
-  },
-  root: {
-    height: navHeight,
-    background: theme.palette.background.paper,
-    borderBottom: `1px solid ${theme.palette.divider}`,
-  },
-  wrapper: {
-    position: "relative",
-    display: "flex",
-    justifyContent: "space-between",
-    alignItems: "center",
-    [theme.breakpoints.up("md")]: {
-      justifyContent: "flex-start",
-    },
-  },
-  drawer: {
-    width: 250,
-  },
-  drawerHeader: {
-    padding: theme.spacing(2),
-    paddingTop: theme.spacing(4),
-    paddingBottom: theme.spacing(4),
-  },
-  navItems: {
-    padding: 0,
-  },
-  desktopNavItems: {
-    display: "none",
-    [theme.breakpoints.up("md")]: {
-      display: "flex",
-    },
-  },
-  mobileMenuButton: {
-    [theme.breakpoints.up("md")]: {
-      display: "none",
-    },
-  },
-  logo: {
-    alignItems: "center",
-    display: "flex",
-    height: navHeight,
-    color: theme.palette.text.primary,
-    padding: theme.spacing(2),
-    // svg is for the Coder logo, img is for custom images
-    "& svg, & img": {
-      height: "100%",
-      objectFit: "contain",
-    },
-  },
-  drawerLogo: {
-    padding: 0,
-    maxHeight: theme.spacing(5),
-  },
-  title: {
-    flex: 1,
-    textAlign: "center",
-  },
-  item: {
-    padding: 0,
-  },
-  link: {
-    alignItems: "center",
-    color: colors.gray[6],
-    display: "flex",
-    flex: 1,
-    fontSize: 16,
-    padding: `${theme.spacing(1.5)} ${theme.spacing(2)}`,
-    textDecoration: "none",
-    transition: "background-color 0.15s ease-in-out",
-
-    "&:hover": {
-      backgroundColor: theme.palette.action.hover,
-    },
-
-    // NavLink adds this class when the current route matches.
-    "&.active": {
-      color: theme.palette.text.primary,
-      fontWeight: 500,
-    },
-
-    [theme.breakpoints.up("md")]: {
-      height: navHeight,
-      padding: `0 ${theme.spacing(3)}`,
-    },
-  },
-}))
diff --git a/site/src/components/OverflowY/OverflowY.stories.tsx b/site/src/components/OverflowY/OverflowY.stories.tsx
new file mode 100644
index 0000000000000..f27e30d8c74d1
--- /dev/null
+++ b/site/src/components/OverflowY/OverflowY.stories.tsx
@@ -0,0 +1,36 @@
+import { Meta, StoryObj } from "@storybook/react";
+import { OverflowY } from "./OverflowY";
+
+const numbers: number[] = [];
+for (let i = 0; i < 20; i++) {
+  numbers.push(i + 1);
+}
+
+const meta: Meta<typeof OverflowY> = {
+  title: "components/OverflowY",
+  component: OverflowY,
+  args: {
+    maxHeight: 400,
+    children: numbers.map((num, i) => (
+      <p
+        key={num}
+        css={{
+          height: "50px",
+          padding: 0,
+          margin: 0,
+          color: "black",
+          backgroundColor: i % 2 === 0 ? "white" : "gray",
+        }}
+      >
+        Element {num}
+      </p>
+    )),
+  },
+};
+
+export default meta;
+
+type Story = StoryObj<typeof OverflowY>;
+const Example: Story = {};
+
+export { Example as OverflowY };
diff --git a/site/src/components/OverflowY/OverflowY.tsx b/site/src/components/OverflowY/OverflowY.tsx
new file mode 100644
index 0000000000000..1252287a94f97
--- /dev/null
+++ b/site/src/components/OverflowY/OverflowY.tsx
@@ -0,0 +1,39 @@
+/**
+ * @file Provides reusable vertical overflow behavior.
+ */
+import { type ReactNode } from "react";
+import { type SystemStyleObject } from "@mui/system";
+import Box from "@mui/system/Box";
+
+type Props = {
+  children: ReactNode;
+  height?: number;
+  maxHeight?: number;
+  sx?: SystemStyleObject;
+};
+
+export function OverflowY({ children, height, maxHeight, sx }: Props) {
+  const computedHeight = height === undefined ? "100%" : `${height}px`;
+
+  // Doing Math.max check to catch cases where height is accidentally larger
+  // than maxHeight
+  const computedMaxHeight =
+    maxHeight === undefined
+      ? computedHeight
+      : `${Math.max(height ?? 0, maxHeight)}px`;
+
+  return (
+    <Box
+      sx={{
+        width: "100%",
+        height: computedHeight,
+        maxHeight: computedMaxHeight,
+        overflowY: "auto",
+        flexShrink: 1,
+        ...sx,
+      }}
+    >
+      {children}
+    </Box>
+  );
+}
diff --git a/site/src/components/PageHeader/FullWidthPageHeader.tsx b/site/src/components/PageHeader/FullWidthPageHeader.tsx
index ced199ee8d302..c81be232be46e 100644
--- a/site/src/components/PageHeader/FullWidthPageHeader.tsx
+++ b/site/src/components/PageHeader/FullWidthPageHeader.tsx
@@ -1,77 +1,87 @@
-import { makeStyles } from "@mui/styles"
-import { FC, PropsWithChildren } from "react"
-import { combineClasses } from "utils/combineClasses"
+import { type CSSObject, useTheme } from "@emotion/react";
+import { type FC, type PropsWithChildren } from "react";
 
 export const FullWidthPageHeader: FC<
   PropsWithChildren & { sticky?: boolean }
 > = ({ children, sticky = true }) => {
-  const styles = useStyles()
-
+  const theme = useTheme();
   return (
     <header
-      className={combineClasses([styles.header, sticky ? styles.sticky : ""])}
       data-testid="header"
+      css={[
+        {
+          ...(theme.typography.body2 as CSSObject),
+          padding: theme.spacing(3),
+          background: theme.palette.background.paper,
+          borderBottom: `1px solid ${theme.palette.divider}`,
+          display: "flex",
+          alignItems: "center",
+          gap: theme.spacing(6),
+
+          zIndex: 10,
+          flexWrap: "wrap",
+
+          [theme.breakpoints.down("lg")]: {
+            position: "unset",
+            alignItems: "flex-start",
+          },
+          [theme.breakpoints.down("md")]: {
+            flexDirection: "column",
+          },
+        },
+        sticky && {
+          position: "sticky",
+          top: 0,
+        },
+      ]}
     >
       {children}
     </header>
-  )
-}
+  );
+};
 
 export const PageHeaderActions: FC<PropsWithChildren> = ({ children }) => {
-  const styles = useStyles()
-  return <div className={styles.actions}>{children}</div>
-}
+  const theme = useTheme();
+  return (
+    <div
+      css={{
+        marginLeft: "auto",
+        [theme.breakpoints.down("md")]: {
+          marginLeft: "unset",
+        },
+      }}
+    >
+      {children}
+    </div>
+  );
+};
 
 export const PageHeaderTitle: FC<PropsWithChildren> = ({ children }) => {
-  const styles = useStyles()
-  return <h1 className={styles.title}>{children}</h1>
-}
+  return (
+    <h1
+      css={{
+        fontSize: 18,
+        fontWeight: 500,
+        margin: 0,
+        lineHeight: "24px",
+      }}
+    >
+      {children}
+    </h1>
+  );
+};
 
 export const PageHeaderSubtitle: FC<PropsWithChildren> = ({ children }) => {
-  const styles = useStyles()
-  return <span className={styles.subtitle}>{children}</span>
-}
-
-const useStyles = makeStyles((theme) => ({
-  header: {
-    ...theme.typography.body2,
-    padding: theme.spacing(3),
-    background: theme.palette.background.paper,
-    borderBottom: `1px solid ${theme.palette.divider}`,
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(6),
-
-    zIndex: 10,
-    flexWrap: "wrap",
-
-    [theme.breakpoints.down("lg")]: {
-      position: "unset",
-      alignItems: "flex-start",
-    },
-    [theme.breakpoints.down("md")]: {
-      flexDirection: "column",
-    },
-  },
-  sticky: {
-    position: "sticky",
-    top: 0,
-  },
-  actions: {
-    marginLeft: "auto",
-    [theme.breakpoints.down("md")]: {
-      marginLeft: "unset",
-    },
-  },
-  title: {
-    fontSize: 18,
-    fontWeight: 500,
-    margin: 0,
-    lineHeight: "24px",
-  },
-  subtitle: {
-    fontSize: 14,
-    color: theme.palette.text.secondary,
-    display: "block",
-  },
-}))
+  const theme = useTheme();
+  return (
+    <span
+      css={{
+        fontSize: 14,
+        color: theme.palette.text.secondary,
+        display: "block",
+      }}
+    >
+      {children}
+    </span>
+  );
+};
diff --git a/site/src/components/PageHeader/PageHeader.stories.tsx b/site/src/components/PageHeader/PageHeader.stories.tsx
index a070eab54328d..9abbf2255e675 100644
--- a/site/src/components/PageHeader/PageHeader.stories.tsx
+++ b/site/src/components/PageHeader/PageHeader.stories.tsx
@@ -1,26 +1,29 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { PageHeader, PageHeaderSubtitle, PageHeaderTitle } from "./PageHeader"
+import { PageHeader, PageHeaderSubtitle, PageHeaderTitle } from "./PageHeader";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
+const meta: Meta<typeof PageHeader> = {
   title: "components/PageHeader",
   component: PageHeader,
-} as ComponentMeta<typeof PageHeader>
+};
 
-const WithTitleTemplate: Story = () => (
-  <PageHeader>
-    <PageHeaderTitle>Templates</PageHeaderTitle>
-  </PageHeader>
-)
+export default meta;
+type Story = StoryObj<typeof PageHeader>;
 
-export const WithTitle = WithTitleTemplate.bind({})
+export const WithTitle: Story = {
+  args: {
+    children: <PageHeaderTitle>Templates</PageHeaderTitle>,
+  },
+};
 
-const WithSubtitleTemplate: Story = () => (
-  <PageHeader>
-    <PageHeaderTitle>Templates</PageHeaderTitle>
-    <PageHeaderSubtitle>
-      Create a new workspace from a Template
-    </PageHeaderSubtitle>
-  </PageHeader>
-)
-
-export const WithSubtitle = WithSubtitleTemplate.bind({})
+export const WithSubtitle: Story = {
+  args: {
+    children: (
+      <>
+        <PageHeaderTitle>Templates</PageHeaderTitle>
+        <PageHeaderSubtitle>
+          Create a new workspace from a Template
+        </PageHeaderSubtitle>
+      </>
+    ),
+  },
+};
diff --git a/site/src/components/PageHeader/PageHeader.tsx b/site/src/components/PageHeader/PageHeader.tsx
index 0944828fdf071..f963560958ea0 100644
--- a/site/src/components/PageHeader/PageHeader.tsx
+++ b/site/src/components/PageHeader/PageHeader.tsx
@@ -1,11 +1,9 @@
-import { makeStyles } from "@mui/styles"
-import { PropsWithChildren, FC } from "react"
-import { combineClasses } from "../../utils/combineClasses"
-import { Stack } from "../Stack/Stack"
+import { type FC, type PropsWithChildren, type ReactNode } from "react";
+import { Stack } from "../Stack/Stack";
 
 export interface PageHeaderProps {
-  actions?: JSX.Element
-  className?: string
+  actions?: ReactNode;
+  className?: string;
 }
 
 export const PageHeader: FC<PropsWithChildren<PageHeaderProps>> = ({
@@ -13,95 +11,94 @@ export const PageHeader: FC<PropsWithChildren<PageHeaderProps>> = ({
   actions,
   className,
 }) => {
-  const styles = useStyles({})
-
   return (
     <header
-      className={combineClasses([styles.root, className])}
+      className={className}
+      css={(theme) => ({
+        display: "flex",
+        alignItems: "center",
+        paddingTop: theme.spacing(6),
+        paddingBottom: theme.spacing(6),
+        gap: theme.spacing(4),
+
+        [theme.breakpoints.down("md")]: {
+          flexDirection: "column",
+          alignItems: "flex-start",
+        },
+      })}
       data-testid="header"
     >
       <hgroup>{children}</hgroup>
       {actions && (
-        <Stack direction="row" className={styles.actions}>
+        <Stack
+          direction="row"
+          css={(theme) => ({
+            marginLeft: "auto",
+
+            [theme.breakpoints.down("md")]: {
+              marginLeft: "initial",
+              width: "100%",
+            },
+          })}
+        >
           {actions}
         </Stack>
       )}
     </header>
-  )
-}
+  );
+};
 
 export const PageHeaderTitle: FC<PropsWithChildren<unknown>> = ({
   children,
 }) => {
-  const styles = useStyles({})
-
-  return <h1 className={styles.title}>{children}</h1>
-}
+  return (
+    <h1
+      css={(theme) => ({
+        fontSize: theme.spacing(3),
+        fontWeight: 400,
+        margin: 0,
+        display: "flex",
+        alignItems: "center",
+        lineHeight: "140%",
+      })}
+    >
+      {children}
+    </h1>
+  );
+};
 
 export const PageHeaderSubtitle: FC<
   PropsWithChildren<{ condensed?: boolean }>
 > = ({ children, condensed }) => {
-  const styles = useStyles({
-    condensed,
-  })
-
-  return <h2 className={styles.subtitle}>{children}</h2>
-}
+  return (
+    <h2
+      css={(theme) => ({
+        fontSize: theme.spacing(2),
+        color: theme.palette.text.secondary,
+        fontWeight: 400,
+        display: "block",
+        margin: 0,
+        marginTop: condensed ? theme.spacing(0.5) : theme.spacing(1),
+        lineHeight: "140%",
+      })}
+    >
+      {children}
+    </h2>
+  );
+};
 
 export const PageHeaderCaption: FC<PropsWithChildren> = ({ children }) => {
-  const styles = useStyles({})
-  return <span className={styles.caption}>{children}</span>
-}
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    display: "flex",
-    alignItems: "center",
-    paddingTop: theme.spacing(6),
-    paddingBottom: theme.spacing(6),
-    gap: theme.spacing(4),
-
-    [theme.breakpoints.down("md")]: {
-      flexDirection: "column",
-      alignItems: "flex-start",
-    },
-  },
-
-  title: {
-    fontSize: theme.spacing(3),
-    fontWeight: 400,
-    margin: 0,
-    display: "flex",
-    alignItems: "center",
-    lineHeight: "140%",
-  },
-
-  subtitle: {
-    fontSize: theme.spacing(2),
-    color: theme.palette.text.secondary,
-    fontWeight: 400,
-    display: "block",
-    margin: 0,
-    marginTop: ({ condensed }: { condensed?: boolean }) =>
-      condensed ? theme.spacing(0.5) : theme.spacing(1),
-    lineHeight: "140%",
-  },
-
-  actions: {
-    marginLeft: "auto",
-
-    [theme.breakpoints.down("md")]: {
-      marginTop: theme.spacing(3),
-      marginLeft: "initial",
-      width: "100%",
-    },
-  },
-
-  caption: {
-    fontSize: 12,
-    color: theme.palette.text.secondary,
-    fontWeight: 600,
-    textTransform: "uppercase",
-    letterSpacing: "0.1em",
-  },
-}))
+  return (
+    <span
+      css={(theme) => ({
+        fontSize: 12,
+        color: theme.palette.text.secondary,
+        fontWeight: 600,
+        textTransform: "uppercase",
+        letterSpacing: "0.1em",
+      })}
+    >
+      {children}
+    </span>
+  );
+};
diff --git a/site/src/components/PaginationStatus/PaginationStatus.tsx b/site/src/components/PaginationStatus/PaginationStatus.tsx
deleted file mode 100644
index cd870f54d0b69..0000000000000
--- a/site/src/components/PaginationStatus/PaginationStatus.tsx
+++ /dev/null
@@ -1,45 +0,0 @@
-import Box from "@mui/material/Box"
-import Skeleton from "@mui/material/Skeleton"
-
-type BasePaginationStatusProps = {
-  label: string
-  isLoading: boolean
-  showing?: number
-  total?: number
-}
-
-type LoadedPaginationStatusProps = BasePaginationStatusProps & {
-  isLoading: false
-  showing: number
-  total: number
-}
-
-export const PaginationStatus = ({
-  isLoading,
-  showing,
-  total,
-  label,
-}: BasePaginationStatusProps | LoadedPaginationStatusProps) => {
-  return (
-    <Box
-      sx={{
-        fontSize: 13,
-        mb: 2,
-        mt: 1,
-        color: (theme) => theme.palette.text.secondary,
-        "& strong": { color: (theme) => theme.palette.text.primary },
-      }}
-    >
-      {!isLoading ? (
-        <>
-          Showing <strong>{showing}</strong> of{" "}
-          <strong>{total?.toLocaleString()}</strong> {label}
-        </>
-      ) : (
-        <Box sx={{ height: 24, display: "flex", alignItems: "center" }}>
-          <Skeleton variant="text" width={160} height={16} />
-        </Box>
-      )}
-    </Box>
-  )
-}
diff --git a/site/src/components/PaginationWidget/PageButton.tsx b/site/src/components/PaginationWidget/PageButton.tsx
index ade11c497d34f..7a8f304b15eb5 100644
--- a/site/src/components/PaginationWidget/PageButton.tsx
+++ b/site/src/components/PaginationWidget/PageButton.tsx
@@ -1,13 +1,13 @@
-import Button from "@mui/material/Button"
-import { makeStyles } from "@mui/styles"
+import Button from "@mui/material/Button";
+import { css, useTheme } from "@emotion/react";
 
 interface PageButtonProps {
-  activePage?: number
-  page?: number
-  placeholder?: string
-  numPages?: number
-  onPageClick?: (page: number) => void
-  disabled?: boolean
+  activePage?: number;
+  page?: number;
+  placeholder?: string;
+  numPages?: number;
+  onPageClick?: (page: number) => void;
+  disabled?: boolean;
 }
 
 export const PageButton = ({
@@ -18,14 +18,20 @@ export const PageButton = ({
   onPageClick,
   disabled = false,
 }: PageButtonProps): JSX.Element => {
-  const styles = useStyles()
+  const theme = useTheme();
   return (
     <Button
-      className={
-        activePage === page
-          ? `${styles.pageButton} ${styles.activePageButton}`
-          : styles.pageButton
-      }
+      css={[
+        css`
+          &:not(:last-of-type) {
+            margin-right: ${theme.spacing(0.5)};
+          }
+        `,
+        activePage === page && {
+          borderColor: `${theme.palette.info.main}`,
+          backgroundColor: `${theme.palette.info.dark}`,
+        },
+      ]}
       aria-label={`${page === activePage ? "Current Page" : ""} ${
         page === numPages ? "Last Page" : ""
       } Page${page}`}
@@ -35,18 +41,5 @@ export const PageButton = ({
     >
       <div>{page ?? placeholder}</div>
     </Button>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  pageButton: {
-    "&:not(:last-of-type)": {
-      marginRight: theme.spacing(0.5),
-    },
-  },
-
-  activePageButton: {
-    borderColor: `${theme.palette.info.main}`,
-    backgroundColor: `${theme.palette.info.dark}`,
-  },
-}))
+  );
+};
diff --git a/site/src/components/PaginationWidget/PaginationWidget.stories.tsx b/site/src/components/PaginationWidget/PaginationWidget.stories.tsx
deleted file mode 100644
index 8cdec1dc6c326..0000000000000
--- a/site/src/components/PaginationWidget/PaginationWidget.stories.tsx
+++ /dev/null
@@ -1,40 +0,0 @@
-import { Story } from "@storybook/react"
-import { PaginationWidget, PaginationWidgetProps } from "./PaginationWidget"
-import { createPaginationRef } from "./utils"
-
-export default {
-  title: "components/PaginationWidget",
-  component: PaginationWidget,
-  args: {
-    prevLabel: "Previous",
-    nextLabel: "Next",
-    paginationRef: createPaginationRef({ page: 1, limit: 12 }),
-    numRecords: 200,
-  },
-}
-
-const Template: Story<PaginationWidgetProps> = (
-  args: PaginationWidgetProps,
-) => <PaginationWidget {...args} />
-
-export const LessThan8Pages = Template.bind({})
-LessThan8Pages.args = {
-  numRecords: 84,
-}
-
-export const MoreThan8Pages = Template.bind({})
-
-export const MoreThan7PagesWithActivePageCloseToStart = Template.bind({})
-MoreThan7PagesWithActivePageCloseToStart.args = {
-  paginationRef: createPaginationRef({ page: 2, limit: 12 }),
-}
-
-export const MoreThan7PagesWithActivePageFarFromBoundaries = Template.bind({})
-MoreThan7PagesWithActivePageFarFromBoundaries.args = {
-  paginationRef: createPaginationRef({ page: 4, limit: 12 }),
-}
-
-export const MoreThan7PagesWithActivePageCloseToEnd = Template.bind({})
-MoreThan7PagesWithActivePageCloseToEnd.args = {
-  paginationRef: createPaginationRef({ page: 17, limit: 12 }),
-}
diff --git a/site/src/components/PaginationWidget/PaginationWidget.test.tsx b/site/src/components/PaginationWidget/PaginationWidget.test.tsx
deleted file mode 100644
index d98a07a2b5e0c..0000000000000
--- a/site/src/components/PaginationWidget/PaginationWidget.test.tsx
+++ /dev/null
@@ -1,74 +0,0 @@
-import { screen } from "@testing-library/react"
-import { render } from "../../testHelpers/renderHelpers"
-import { PaginationWidget } from "./PaginationWidget"
-import { createPaginationRef } from "./utils"
-
-describe("PaginatedList", () => {
-  it("displays an accessible previous and next button", () => {
-    render(
-      <PaginationWidget
-        prevLabel="Previous"
-        nextLabel="Next"
-        paginationRef={createPaginationRef({ page: 2, limit: 12 })}
-        numRecords={200}
-      />,
-    )
-
-    expect(screen.getByRole("button", { name: "Previous page" })).toBeEnabled()
-    expect(screen.getByRole("button", { name: "Next page" })).toBeEnabled()
-  })
-
-  it("displays the expected number of pages with one ellipsis tile", () => {
-    const { container } = render(
-      <PaginationWidget
-        prevLabel="Previous"
-        nextLabel="Next"
-        numRecords={200}
-        paginationRef={createPaginationRef({ page: 1, limit: 12 })}
-      />,
-    )
-
-    // 7 total spaces. 6 are page numbers, one is ellipsis
-    expect(
-      container.querySelectorAll(`button[name="Page button"]`),
-    ).toHaveLength(6)
-  })
-
-  it("displays the expected number of pages with two ellipsis tiles", () => {
-    const { container } = render(
-      <PaginationWidget
-        prevLabel="Previous"
-        nextLabel="Next"
-        numRecords={200}
-        paginationRef={createPaginationRef({ page: 6, limit: 12 })}
-      />,
-    )
-
-    // 7 total spaces. 2 sets of ellipsis on either side of the active page
-    expect(
-      container.querySelectorAll(`button[name="Page button"]`),
-    ).toHaveLength(5)
-  })
-
-  it("disables the previous button on the first page", () => {
-    render(
-      <PaginationWidget
-        numRecords={100}
-        paginationRef={createPaginationRef({ page: 1, limit: 25 })}
-      />,
-    )
-    const prevButton = screen.getByLabelText("Previous page")
-    expect(prevButton).toBeDisabled()
-  })
-
-  it("disables the next button on the last page", () => {
-    render(
-      <PaginationWidget
-        numRecords={100}
-        paginationRef={createPaginationRef({ page: 4, limit: 25 })}
-      />,
-    )
-    const nextButton = screen.getByLabelText("Next page")
-    expect(nextButton).toBeDisabled()
-  })
-})
diff --git a/site/src/components/PaginationWidget/PaginationWidget.tsx b/site/src/components/PaginationWidget/PaginationWidget.tsx
deleted file mode 100644
index 221e3deb22b09..0000000000000
--- a/site/src/components/PaginationWidget/PaginationWidget.tsx
+++ /dev/null
@@ -1,109 +0,0 @@
-import Button from "@mui/material/Button"
-import { makeStyles, useTheme } from "@mui/styles"
-import useMediaQuery from "@mui/material/useMediaQuery"
-import KeyboardArrowLeft from "@mui/icons-material/KeyboardArrowLeft"
-import KeyboardArrowRight from "@mui/icons-material/KeyboardArrowRight"
-import { useActor } from "@xstate/react"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { Maybe } from "components/Conditionals/Maybe"
-import { CSSProperties } from "react"
-import { PaginationMachineRef } from "xServices/pagination/paginationXService"
-import { PageButton } from "./PageButton"
-import { buildPagedList } from "./utils"
-
-export type PaginationWidgetProps = {
-  prevLabel?: string
-  nextLabel?: string
-  numRecords?: number
-  containerStyle?: CSSProperties
-  paginationRef: PaginationMachineRef
-}
-
-export const PaginationWidget = ({
-  prevLabel = "",
-  nextLabel = "",
-  numRecords,
-  containerStyle,
-  paginationRef,
-}: PaginationWidgetProps): JSX.Element | null => {
-  const theme = useTheme()
-  const isMobile = useMediaQuery(theme.breakpoints.down("md"))
-  const styles = useStyles()
-  const [paginationState, send] = useActor(paginationRef)
-
-  const currentPage = paginationState.context.page
-  const numRecordsPerPage = paginationState.context.limit
-
-  const numPages = numRecords ? Math.ceil(numRecords / numRecordsPerPage) : 0
-  const firstPageActive = currentPage === 1 && numPages !== 0
-  const lastPageActive = currentPage === numPages && numPages !== 0
-  // if beyond page 1, show pagination widget even if there's only one true page, so user can navigate back
-  const showWidget = numPages > 1 || currentPage > 1
-
-  return (
-    <Maybe condition={showWidget}>
-      <div style={containerStyle} className={styles.defaultContainerStyles}>
-        <Button
-          className={styles.prevLabelStyles}
-          aria-label="Previous page"
-          disabled={firstPageActive}
-          onClick={() => send({ type: "PREVIOUS_PAGE" })}
-        >
-          <KeyboardArrowLeft />
-          <div>{prevLabel}</div>
-        </Button>
-        <ChooseOne>
-          <Cond condition={isMobile}>
-            <PageButton
-              activePage={currentPage}
-              page={currentPage}
-              numPages={numPages}
-            />
-          </Cond>
-          <Cond>
-            {buildPagedList(numPages, currentPage).map((page) =>
-              typeof page !== "number" ? (
-                <PageButton
-                  key={`Page${page}`}
-                  activePage={currentPage}
-                  placeholder="..."
-                  disabled
-                />
-              ) : (
-                <PageButton
-                  key={`Page${page}`}
-                  activePage={currentPage}
-                  page={page}
-                  numPages={numPages}
-                  onPageClick={() => send({ type: "GO_TO_PAGE", page })}
-                />
-              ),
-            )}
-          </Cond>
-        </ChooseOne>
-        <Button
-          aria-label="Next page"
-          disabled={lastPageActive}
-          onClick={() => send({ type: "NEXT_PAGE" })}
-        >
-          <div>{nextLabel}</div>
-          <KeyboardArrowRight />
-        </Button>
-      </div>
-    </Maybe>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  defaultContainerStyles: {
-    justifyContent: "center",
-    alignItems: "center",
-    display: "flex",
-    flexDirection: "row",
-    padding: "20px",
-  },
-
-  prevLabelStyles: {
-    marginRight: theme.spacing(0.5),
-  },
-}))
diff --git a/site/src/components/PaginationWidget/PaginationWidgetBase.stories.tsx b/site/src/components/PaginationWidget/PaginationWidgetBase.stories.tsx
new file mode 100644
index 0000000000000..373dad4dd681b
--- /dev/null
+++ b/site/src/components/PaginationWidget/PaginationWidgetBase.stories.tsx
@@ -0,0 +1,35 @@
+import { PaginationWidgetBase } from "./PaginationWidgetBase";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof PaginationWidgetBase> = {
+  title: "components/PaginationWidgetBase",
+  component: PaginationWidgetBase,
+  args: {
+    page: 1,
+    limit: 12,
+    count: 200,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof PaginationWidgetBase>;
+
+export const MoreThan8Pages: Story = {};
+
+export const LessThan8Pages: Story = {
+  args: {
+    count: 84,
+  },
+};
+
+export const MoreThan7PagesWithActivePageCloseToStart: Story = {
+  args: { page: 2, limit: 12 },
+};
+
+export const MoreThan7PagesWithActivePageFarFromBoundaries: Story = {
+  args: { page: 4, limit: 12 },
+};
+
+export const MoreThan7PagesWithActivePageCloseToEnd: Story = {
+  args: { page: 17, limit: 12 },
+};
diff --git a/site/src/components/PaginationWidget/PaginationWidgetBase.tsx b/site/src/components/PaginationWidget/PaginationWidgetBase.tsx
index 594150d81190b..779dc1ec9d1a3 100644
--- a/site/src/components/PaginationWidget/PaginationWidgetBase.tsx
+++ b/site/src/components/PaginationWidget/PaginationWidgetBase.tsx
@@ -1,18 +1,17 @@
-import Button from "@mui/material/Button"
-import { makeStyles, useTheme } from "@mui/styles"
-import useMediaQuery from "@mui/material/useMediaQuery"
-import KeyboardArrowLeft from "@mui/icons-material/KeyboardArrowLeft"
-import KeyboardArrowRight from "@mui/icons-material/KeyboardArrowRight"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { PageButton } from "./PageButton"
-import { buildPagedList } from "./utils"
+import Button from "@mui/material/Button";
+import useMediaQuery from "@mui/material/useMediaQuery";
+import KeyboardArrowLeft from "@mui/icons-material/KeyboardArrowLeft";
+import KeyboardArrowRight from "@mui/icons-material/KeyboardArrowRight";
+import { useTheme } from "@emotion/react";
+import { PageButton } from "./PageButton";
+import { buildPagedList } from "./utils";
 
 export type PaginationWidgetBaseProps = {
-  count: number
-  page: number
-  limit: number
-  onChange: (page: number) => void
-}
+  count: number;
+  page: number;
+  limit: number;
+  onChange: (page: number) => void;
+};
 
 export const PaginationWidgetBase = ({
   count,
@@ -20,85 +19,77 @@ export const PaginationWidgetBase = ({
   limit,
   onChange,
 }: PaginationWidgetBaseProps): JSX.Element | null => {
-  const theme = useTheme()
-  const isMobile = useMediaQuery(theme.breakpoints.down("md"))
-  const styles = useStyles()
-  const numPages = Math.ceil(count / limit)
-  const isFirstPage = page === 0
-  const isLastPage = page === numPages - 1
+  const theme = useTheme();
+  const isMobile = useMediaQuery(theme.breakpoints.down("md"));
+  const numPages = Math.ceil(count / limit);
+  const isFirstPage = page === 0;
+  const isLastPage = page === numPages - 1;
 
   if (numPages < 2) {
-    return null
+    return null;
   }
 
   return (
-    <div className={styles.defaultContainerStyles}>
+    <div
+      css={{
+        justifyContent: "center",
+        alignItems: "center",
+        display: "flex",
+        flexDirection: "row",
+        padding: "20px",
+      }}
+    >
       <Button
-        className={styles.prevLabelStyles}
+        css={{
+          marginRight: theme.spacing(0.5),
+        }}
         aria-label="Previous page"
         disabled={isFirstPage}
         onClick={() => {
           if (!isFirstPage) {
-            onChange(page - 1)
+            onChange(page - 1);
           }
         }}
       >
         <KeyboardArrowLeft />
       </Button>
-      <ChooseOne>
-        <Cond condition={isMobile}>
-          <PageButton activePage={page} page={page} numPages={numPages} />
-        </Cond>
-        <Cond>
-          {buildPagedList(numPages, page).map((pageItem) => {
-            if (pageItem === "left" || pageItem === "right") {
-              return (
-                <PageButton
-                  key={pageItem}
-                  activePage={page}
-                  placeholder="..."
-                  disabled
-                />
-              )
-            }
-
+      {isMobile ? (
+        <PageButton activePage={page} page={page} numPages={numPages} />
+      ) : (
+        buildPagedList(numPages, page).map((pageItem) => {
+          if (pageItem === "left" || pageItem === "right") {
             return (
               <PageButton
                 key={pageItem}
-                page={pageItem}
                 activePage={page}
-                numPages={numPages}
-                onPageClick={() => onChange(pageItem)}
+                placeholder="..."
+                disabled
               />
-            )
-          })}
-        </Cond>
-      </ChooseOne>
+            );
+          }
+
+          return (
+            <PageButton
+              key={pageItem}
+              page={pageItem}
+              activePage={page}
+              numPages={numPages}
+              onPageClick={() => onChange(pageItem)}
+            />
+          );
+        })
+      )}
       <Button
         aria-label="Next page"
         disabled={isLastPage}
         onClick={() => {
           if (!isLastPage) {
-            onChange(page + 1)
+            onChange(page + 1);
           }
         }}
       >
         <KeyboardArrowRight />
       </Button>
     </div>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  defaultContainerStyles: {
-    justifyContent: "center",
-    alignItems: "center",
-    display: "flex",
-    flexDirection: "row",
-    padding: "20px",
-  },
-
-  prevLabelStyles: {
-    marginRight: theme.spacing(0.5),
-  },
-}))
+  );
+};
diff --git a/site/src/components/PaginationWidget/utils.test.ts b/site/src/components/PaginationWidget/utils.test.ts
index e65d1b0b0cc43..01f79eb0a9f30 100644
--- a/site/src/components/PaginationWidget/utils.test.ts
+++ b/site/src/components/PaginationWidget/utils.test.ts
@@ -1,42 +1,40 @@
-import { buildPagedList, getOffset } from "./utils"
+import { buildPagedList, getOffset } from "./utils";
 
-describe("unit/PaginationWidget", () => {
-  describe("buildPagedList", () => {
-    it.each<{
-      numPages: number
-      activePage: number
-      expected: (string | number)[]
-    }>([
-      { numPages: 7, activePage: 1, expected: [1, 2, 3, 4, 5, 6, 7] },
-      { numPages: 17, activePage: 1, expected: [1, 2, 3, 4, 5, "right", 17] },
-      {
-        numPages: 17,
-        activePage: 9,
-        expected: [1, "left", 8, 9, 10, "right", 17],
-      },
-      {
-        numPages: 17,
-        activePage: 17,
-        expected: [1, "left", 13, 14, 15, 16, 17],
-      },
-    ])(
-      `buildPagedList($numPages, $activePage)`,
-      ({ numPages, activePage, expected }) => {
-        expect(buildPagedList(numPages, activePage)).toEqual(expected)
-      },
-    )
-  })
-})
+describe("buildPagedList", () => {
+  it.each<{
+    numPages: number;
+    activePage: number;
+    expected: (string | number)[];
+  }>([
+    { numPages: 7, activePage: 1, expected: [1, 2, 3, 4, 5, 6, 7] },
+    { numPages: 17, activePage: 1, expected: [1, 2, 3, 4, 5, "right", 17] },
+    {
+      numPages: 17,
+      activePage: 9,
+      expected: [1, "left", 8, 9, 10, "right", 17],
+    },
+    {
+      numPages: 17,
+      activePage: 17,
+      expected: [1, "left", 13, 14, 15, 16, 17],
+    },
+  ])(
+    `buildPagedList($numPages, $activePage)`,
+    ({ numPages, activePage, expected }) => {
+      expect(buildPagedList(numPages, activePage)).toEqual(expected);
+    },
+  );
+});
 
 describe("getOffset", () => {
   it("returns 0 on page 1", () => {
-    const page = 1
-    const limit = 10
-    expect(getOffset(page, limit)).toEqual(0)
-  })
+    const page = 1;
+    const limit = 10;
+    expect(getOffset(page, limit)).toEqual(0);
+  });
   it("returns the limit on page 2", () => {
-    const page = 2
-    const limit = 10
-    expect(getOffset(page, limit)).toEqual(limit)
-  })
-})
+    const page = 2;
+    const limit = 10;
+    expect(getOffset(page, limit)).toEqual(limit);
+  });
+});
diff --git a/site/src/components/PaginationWidget/utils.ts b/site/src/components/PaginationWidget/utils.ts
index db25da9b15f8e..9575396e29595 100644
--- a/site/src/components/PaginationWidget/utils.ts
+++ b/site/src/components/PaginationWidget/utils.ts
@@ -1,27 +1,20 @@
-import {
-  PaginationContext,
-  paginationMachine,
-  PaginationMachineRef,
-} from "xServices/pagination/paginationXService"
-import { spawn } from "xstate"
-
 /**
  * Generates a ranged array with an option to step over values.
  * Shamelessly stolen from:
  * https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/from#sequence_generator_range
  */
 const range = (start: number, stop: number, step = 1) =>
-  Array.from({ length: (stop - start) / step + 1 }, (_, i) => start + i * step)
+  Array.from({ length: (stop - start) / step + 1 }, (_, i) => start + i * step);
 
-export const DEFAULT_RECORDS_PER_PAGE = 25
+export const DEFAULT_RECORDS_PER_PAGE = 25;
 // Number of pages to the left or right of the current page selection.
-const PAGE_NEIGHBORS = 1
+const PAGE_NEIGHBORS = 1;
 // Number of pages displayed for cases where there are multiple ellipsis showing. This can be
 // thought of as the minimum number of page numbers to display when multiple ellipsis are showing.
-const PAGES_TO_DISPLAY = PAGE_NEIGHBORS * 2 + 3
+const PAGES_TO_DISPLAY = PAGE_NEIGHBORS * 2 + 3;
 // Total page blocks(page numbers or ellipsis) displayed, including the maximum number of ellipsis (2).
 // This gives us maximum number of 7 page blocks to be displayed when the page neighbors value is 1.
-const NUM_PAGE_BLOCKS = PAGES_TO_DISPLAY + 2
+const NUM_PAGE_BLOCKS = PAGES_TO_DISPLAY + 2;
 
 /**
  * Builds a list of pages based on how many pages exist and where the user is in their navigation of those pages.
@@ -32,79 +25,43 @@ export const buildPagedList = (
   activePage: number,
 ): ("left" | "right" | number)[] => {
   if (numPages > NUM_PAGE_BLOCKS) {
-    let pages = []
-    const leftBound = activePage - PAGE_NEIGHBORS
-    const rightBound = activePage + PAGE_NEIGHBORS
-    const beforeLastPage = numPages - 1
-    const startPage = leftBound > 2 ? leftBound : 2
-    const endPage = rightBound < beforeLastPage ? rightBound : beforeLastPage
+    let pages = [];
+    const leftBound = activePage - PAGE_NEIGHBORS;
+    const rightBound = activePage + PAGE_NEIGHBORS;
+    const beforeLastPage = numPages - 1;
+    const startPage = leftBound > 2 ? leftBound : 2;
+    const endPage = rightBound < beforeLastPage ? rightBound : beforeLastPage;
 
-    pages = range(startPage, endPage)
+    pages = range(startPage, endPage);
 
-    const singleSpillOffset = PAGES_TO_DISPLAY - pages.length - 1
-    const hasLeftOverflow = startPage > 2
-    const hasRightOverflow = endPage < beforeLastPage
-    const leftOverflowPage = "left" as const
-    const rightOverflowPage = "right" as const
+    const singleSpillOffset = PAGES_TO_DISPLAY - pages.length - 1;
+    const hasLeftOverflow = startPage > 2;
+    const hasRightOverflow = endPage < beforeLastPage;
+    const leftOverflowPage = "left" as const;
+    const rightOverflowPage = "right" as const;
 
     if (hasLeftOverflow && !hasRightOverflow) {
-      const extraPages = range(startPage - singleSpillOffset, startPage - 1)
-      pages = [leftOverflowPage, ...extraPages, ...pages]
+      const extraPages = range(startPage - singleSpillOffset, startPage - 1);
+      pages = [leftOverflowPage, ...extraPages, ...pages];
     } else if (!hasLeftOverflow && hasRightOverflow) {
-      const extraPages = range(endPage + 1, endPage + singleSpillOffset)
-      pages = [...pages, ...extraPages, rightOverflowPage]
+      const extraPages = range(endPage + 1, endPage + singleSpillOffset);
+      pages = [...pages, ...extraPages, rightOverflowPage];
     } else if (hasLeftOverflow && hasRightOverflow) {
-      pages = [leftOverflowPage, ...pages, rightOverflowPage]
+      pages = [leftOverflowPage, ...pages, rightOverflowPage];
     }
 
-    return [1, ...pages, numPages]
+    return [1, ...pages, numPages];
   }
 
-  return range(1, numPages)
-}
-
-const getInitialPage = (page: string | null): number =>
-  page ? Number(page) : 1
+  return range(1, numPages);
+};
 
 // pages count from 1
 export const getOffset = (page: number, limit: number): number =>
-  (page - 1) * limit
-
-interface PaginationData {
-  offset: number
-  limit: number
-}
-
-export const getPaginationData = (
-  ref: PaginationMachineRef,
-): PaginationData => {
-  const snapshot = ref.getSnapshot()
-  if (snapshot) {
-    const { page, limit } = snapshot.context
-    const offset = getOffset(page, limit)
-    return { offset, limit }
-  } else {
-    throw new Error("No pagination data")
-  }
-}
-
-export const getPaginationContext = (
-  searchParams: URLSearchParams,
-  limit: number = DEFAULT_RECORDS_PER_PAGE,
-): PaginationContext => ({
-  page: getInitialPage(searchParams.get("page")),
-  limit,
-})
-
-// for storybook
-export const createPaginationRef = (
-  context: PaginationContext,
-): PaginationMachineRef => {
-  return spawn(paginationMachine.withContext(context))
-}
+  (page - 1) * limit;
 
 export const nonInitialPage = (searchParams: URLSearchParams): boolean => {
-  const page = searchParams.get("page")
-  const numberPage = page ? Number(page) : 1
-  return numberPage > 1
-}
+  const page = searchParams.get("page");
+  const numberPage = page ? Number(page) : 1;
+  return numberPage > 1;
+};
diff --git a/site/src/components/PasswordField/PasswordField.test.tsx b/site/src/components/PasswordField/PasswordField.test.tsx
deleted file mode 100644
index e5c08afa44bb9..0000000000000
--- a/site/src/components/PasswordField/PasswordField.test.tsx
+++ /dev/null
@@ -1,13 +0,0 @@
-import { render, screen } from "@testing-library/react"
-import { PasswordField } from "./PasswordField"
-
-describe("PasswordField", () => {
-  it("renders", async () => {
-    // When
-    render(<PasswordField helperText="Enter password" />)
-
-    // Then
-    const element = await screen.findByText("Enter password")
-    expect(element).toBeDefined()
-  })
-})
diff --git a/site/src/components/PasswordField/PasswordField.tsx b/site/src/components/PasswordField/PasswordField.tsx
deleted file mode 100644
index f1eb57b356bef..0000000000000
--- a/site/src/components/PasswordField/PasswordField.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-import IconButton from "@mui/material/IconButton"
-import InputAdornment from "@mui/material/InputAdornment"
-import { makeStyles } from "@mui/styles"
-import TextField, { TextFieldProps } from "@mui/material/TextField"
-import VisibilityOffOutlined from "@mui/icons-material/VisibilityOffOutlined"
-import VisibilityOutlined from "@mui/icons-material/VisibilityOutlined"
-import { useCallback, useState, FC, PropsWithChildren } from "react"
-
-type PasswordFieldProps = Omit<TextFieldProps, "InputProps" | "type">
-
-export const PasswordField: FC<PropsWithChildren<PasswordFieldProps>> = ({
-  variant = "outlined",
-  ...rest
-}) => {
-  const styles = useStyles()
-  const [showPassword, setShowPassword] = useState<boolean>(false)
-
-  const handleVisibilityChange = useCallback(
-    () => setShowPassword((showPassword) => !showPassword),
-    [],
-  )
-  const VisibilityIcon = showPassword
-    ? VisibilityOffOutlined
-    : VisibilityOutlined
-
-  return (
-    <TextField
-      {...rest}
-      type={showPassword ? "text" : "password"}
-      variant={variant}
-      InputProps={{
-        endAdornment: (
-          <InputAdornment position="end">
-            <IconButton
-              aria-label="toggle password visibility"
-              onClick={handleVisibilityChange}
-              size="small"
-            >
-              <VisibilityIcon className={styles.visibilityIcon} />
-            </IconButton>
-          </InputAdornment>
-        ),
-      }}
-    />
-  )
-}
-
-const useStyles = makeStyles({
-  visibilityIcon: {
-    fontSize: 20,
-  },
-})
diff --git a/site/src/components/Paywall/Paywall.tsx b/site/src/components/Paywall/Paywall.tsx
index 42aab2e20b180..29ffb2e16989f 100644
--- a/site/src/components/Paywall/Paywall.tsx
+++ b/site/src/components/Paywall/Paywall.tsx
@@ -1,29 +1,28 @@
-import Box from "@mui/material/Box"
-import Chip from "@mui/material/Chip"
-import { makeStyles } from "@mui/styles"
-import Typography from "@mui/material/Typography"
-import { Stack } from "components/Stack/Stack"
-import { FC, ReactNode } from "react"
+import Box from "@mui/material/Box";
+import Chip from "@mui/material/Chip";
+import Typography from "@mui/material/Typography";
+import { type FC, type ReactNode } from "react";
+import { type Interpolation, type Theme } from "@emotion/react";
+import { Stack } from "components/Stack/Stack";
 
 export interface PaywallProps {
-  message: string
-  description?: string | React.ReactNode
-  cta?: ReactNode
+  message: string;
+  description?: string | React.ReactNode;
+  cta?: ReactNode;
 }
 
 export const Paywall: FC<React.PropsWithChildren<PaywallProps>> = (props) => {
-  const { message, description, cta } = props
-  const styles = useStyles()
+  const { message, description, cta } = props;
 
   return (
-    <Box className={styles.root}>
-      <div className={styles.header}>
+    <Box css={styles.root}>
+      <div css={styles.header}>
         <Stack direction="row" alignItems="center" justifyContent="center">
-          <Typography variant="h5" className={styles.title}>
+          <Typography variant="h5" css={styles.title}>
             {message}
           </Typography>
           <Chip
-            className={styles.enterpriseChip}
+            css={styles.enterpriseChip}
             label="Enterprise"
             size="small"
             color="primary"
@@ -34,7 +33,7 @@ export const Paywall: FC<React.PropsWithChildren<PaywallProps>> = (props) => {
           <Typography
             variant="body2"
             color="textSecondary"
-            className={styles.description}
+            css={styles.description}
           >
             {description}
           </Typography>
@@ -42,11 +41,11 @@ export const Paywall: FC<React.PropsWithChildren<PaywallProps>> = (props) => {
       </div>
       {cta}
     </Box>
-  )
-}
+  );
+};
 
-const useStyles = makeStyles((theme) => ({
-  root: {
+const styles = {
+  root: (theme) => ({
     display: "flex",
     flexDirection: "column",
     justifyContent: "center",
@@ -57,24 +56,24 @@ const useStyles = makeStyles((theme) => ({
     backgroundColor: theme.palette.background.paper,
     border: `1px solid ${theme.palette.divider}`,
     borderRadius: theme.shape.borderRadius,
-  },
-  header: {
+  }),
+  header: (theme) => ({
     marginBottom: theme.spacing(3),
-  },
+  }),
   title: {
     fontWeight: 600,
     fontFamily: "inherit",
   },
-  description: {
+  description: (theme) => ({
     marginTop: theme.spacing(1),
     fontFamily: "inherit",
     maxWidth: 420,
     lineHeight: "160%",
-  },
-  enterpriseChip: {
+  }),
+  enterpriseChip: (theme) => ({
     background: theme.palette.success.dark,
     color: theme.palette.success.contrastText,
     border: `1px solid ${theme.palette.success.light}`,
     fontSize: 13,
-  },
-}))
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/components/Pill/Pill.stories.tsx b/site/src/components/Pill/Pill.stories.tsx
index 5358cb7aa0834..1ec168cf43a9f 100644
--- a/site/src/components/Pill/Pill.stories.tsx
+++ b/site/src/components/Pill/Pill.stories.tsx
@@ -1,57 +1,66 @@
-import { Story } from "@storybook/react"
-import { Pill, PillProps } from "./Pill"
+import { Pill } from "./Pill";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
+const meta: Meta<typeof Pill> = {
   title: "components/Pill",
   component: Pill,
-}
-
-const Template: Story<PillProps> = (args) => <Pill {...args} />
-
-export const Primary = Template.bind({})
-Primary.args = {
-  text: "Primary",
-  type: "primary",
-}
-
-export const Secondary = Template.bind({})
-Secondary.args = {
-  text: "Secondary",
-  type: "secondary",
-}
-
-export const Success = Template.bind({})
-Success.args = {
-  text: "Success",
-  type: "success",
-}
-
-export const Info = Template.bind({})
-Info.args = {
-  text: "Information",
-  type: "info",
-}
-
-export const Warning = Template.bind({})
-Warning.args = {
-  text: "Warning",
-  type: "warning",
-}
-
-export const Error = Template.bind({})
-Error.args = {
-  text: "Error",
-  type: "error",
-}
-
-export const Default = Template.bind({})
-Default.args = {
-  text: "Default",
-}
-
-export const WarningLight = Template.bind({})
-WarningLight.args = {
-  text: "Warning",
-  type: "warning",
-  lightBorder: true,
-}
+};
+
+export default meta;
+type Story = StoryObj<typeof Pill>;
+
+export const Primary: Story = {
+  args: {
+    text: "Primary",
+    type: "primary",
+  },
+};
+
+export const Secondary: Story = {
+  args: {
+    text: "Secondary",
+    type: "secondary",
+  },
+};
+
+export const Success: Story = {
+  args: {
+    text: "Success",
+    type: "success",
+  },
+};
+
+export const Info: Story = {
+  args: {
+    text: "Information",
+    type: "info",
+  },
+};
+
+export const Warning: Story = {
+  args: {
+    text: "Warning",
+    type: "warning",
+  },
+};
+
+export const Error: Story = {
+  args: {
+    text: "Error",
+    type: "error",
+  },
+};
+
+export const Default: Story = {
+  args: {
+    text: "Default",
+  },
+};
+
+export const WarningLight: Story = {
+  args: {
+    text: "Warning",
+    type: "warning",
+    lightBorder: true,
+  },
+};
diff --git a/site/src/components/Pill/Pill.tsx b/site/src/components/Pill/Pill.tsx
index 9632ba988cc9b..b250c0318bded 100644
--- a/site/src/components/Pill/Pill.tsx
+++ b/site/src/components/Pill/Pill.tsx
@@ -1,75 +1,114 @@
-import { PaletteColor, Theme } from "@mui/material/styles"
-import { makeStyles } from "@mui/styles"
-import { FC } from "react"
-import { PaletteIndex } from "theme/theme"
-import { combineClasses } from "utils/combineClasses"
+import { type FC, type ReactNode, useMemo, forwardRef } from "react";
+import { css, type Interpolation, type Theme, useTheme } from "@emotion/react";
+import { colors } from "theme/colors";
+
+export type PillType =
+  | "primary"
+  | "secondary"
+  | "error"
+  | "warning"
+  | "info"
+  | "success"
+  | "neutral";
 
 export interface PillProps {
-  className?: string
-  icon?: React.ReactNode
-  text: string
-  type?: PaletteIndex
-  lightBorder?: boolean
-  title?: string
+  className?: string;
+  icon?: ReactNode;
+  text: ReactNode;
+  type?: PillType;
+  lightBorder?: boolean;
+  title?: string;
 }
 
-export const Pill: FC<PillProps> = (props) => {
-  const { className, icon, text = false, title } = props
-  const styles = useStyles(props)
-  return (
-    <div
-      className={combineClasses([styles.wrapper, styles.pillColor, className])}
-      role="status"
-      title={title}
-    >
-      {icon && <div className={styles.iconWrapper}>{icon}</div>}
-      {text}
-    </div>
-  )
-}
+const themeOverrides = {
+  primary: (lightBorder) => ({
+    backgroundColor: colors.blue[13],
+    borderColor: lightBorder ? colors.blue[5] : colors.blue[7],
+  }),
+  secondary: (lightBorder) => ({
+    backgroundColor: colors.indigo[13],
+    borderColor: lightBorder ? colors.indigo[6] : colors.indigo[8],
+  }),
+  neutral: (lightBorder) => ({
+    backgroundColor: colors.gray[13],
+    borderColor: lightBorder ? colors.gray[6] : colors.gray[8],
+  }),
+} satisfies Record<string, (lightBorder?: boolean) => Interpolation<Theme>>;
 
-const useStyles = makeStyles<Theme, PillProps>((theme) => ({
-  wrapper: {
-    display: "inline-flex",
-    alignItems: "center",
-    borderWidth: 1,
-    borderStyle: "solid",
-    borderRadius: 99999,
-    fontSize: 12,
-    color: "#FFF",
-    height: theme.spacing(3),
-    paddingLeft: ({ icon }) =>
-      icon ? theme.spacing(0.75) : theme.spacing(1.5),
-    paddingRight: theme.spacing(1.5),
-    whiteSpace: "nowrap",
-    fontWeight: 400,
-  },
+const themeStyles =
+  (type: PillType, lightBorder?: boolean) => (theme: Theme) => {
+    const palette = theme.palette[type];
+    return {
+      backgroundColor: palette.dark,
+      borderColor: lightBorder ? palette.light : palette.main,
+    };
+  };
 
-  pillColor: {
-    backgroundColor: ({ type }) =>
-      type
-        ? (theme.palette[type] as PaletteColor).dark
-        : theme.palette.text.secondary,
-    borderColor: ({ type, lightBorder }) =>
-      type
-        ? lightBorder
-          ? (theme.palette[type] as PaletteColor).light
-          : (theme.palette[type] as PaletteColor).main
-        : theme.palette.text.secondary,
-  },
+export const Pill: FC<PillProps> = forwardRef<HTMLDivElement, PillProps>(
+  (props, ref) => {
+    const {
+      lightBorder,
+      icon,
+      text = null,
+      type = "neutral",
+      ...attrs
+    } = props;
+    const theme = useTheme();
+
+    const typeStyles = useMemo(() => {
+      if (type in themeOverrides) {
+        return themeOverrides[type as keyof typeof themeOverrides](lightBorder);
+      }
+      return themeStyles(type, lightBorder);
+    }, [type, lightBorder]);
 
-  iconWrapper: {
-    marginRight: theme.spacing(0.5),
-    width: theme.spacing(1.75),
-    height: theme.spacing(1.75),
-    lineHeight: 0,
-    display: "flex",
-    alignItems: "center",
-    justifyContent: "center",
+    return (
+      <div
+        ref={ref}
+        css={[
+          {
+            cursor: "default",
+            display: "inline-flex",
+            alignItems: "center",
+            borderWidth: 1,
+            borderStyle: "solid",
+            borderRadius: 99999,
+            fontSize: 12,
+            color: "#FFF",
+            height: theme.spacing(3),
+            paddingLeft: icon ? theme.spacing(0.75) : theme.spacing(1.5),
+            paddingRight: theme.spacing(1.5),
+            whiteSpace: "nowrap",
+            fontWeight: 400,
+          },
+          typeStyles,
+        ]}
+        role="status"
+        {...attrs}
+      >
+        {icon && (
+          <div
+            css={css`
+              margin-right: ${theme.spacing(0.5)};
+              width: ${theme.spacing(1.75)};
+              height: ${theme.spacing(1.75)};
+              line-height: 0;
+              display: flex;
+              align-items: center;
+              justify-content: center;
 
-    "& > svg": {
-      width: theme.spacing(1.75),
-      height: theme.spacing(1.75),
-    },
+              & > img,
+              & > svg {
+                width: ${theme.spacing(1.75)};
+                height: ${theme.spacing(1.75)};
+              }
+            `}
+          >
+            {icon}
+          </div>
+        )}
+        {text}
+      </div>
+    );
   },
-}))
+);
diff --git a/site/src/components/Popover/Popover.tsx b/site/src/components/Popover/Popover.tsx
new file mode 100644
index 0000000000000..5a936ac21a29e
--- /dev/null
+++ b/site/src/components/Popover/Popover.tsx
@@ -0,0 +1,190 @@
+import {
+  ReactElement,
+  ReactNode,
+  cloneElement,
+  createContext,
+  useContext,
+  useEffect,
+  useId,
+  useRef,
+  useState,
+} from "react";
+// This is used as base for the main Popover component
+// eslint-disable-next-line no-restricted-imports -- Read above
+import MuiPopover, {
+  type PopoverProps as MuiPopoverProps,
+} from "@mui/material/Popover";
+
+type TriggerMode = "hover" | "click";
+
+type TriggerRef = React.RefObject<HTMLElement>;
+
+type TriggerElement = ReactElement<{
+  ref: TriggerRef;
+  onClick?: () => void;
+  "aria-haspopup"?: boolean;
+  "aria-owns"?: string | undefined;
+}>;
+
+type PopoverContextValue = {
+  id: string;
+  isOpen: boolean;
+  setIsOpen: React.Dispatch<React.SetStateAction<boolean>>;
+  triggerRef: TriggerRef;
+  mode: TriggerMode;
+};
+
+const PopoverContext = createContext<PopoverContextValue | undefined>(
+  undefined,
+);
+
+export const Popover = (props: {
+  children: ReactNode | ((popover: PopoverContextValue) => ReactNode); // Allows inline usage
+  mode?: TriggerMode;
+  isDefaultOpen?: boolean;
+}) => {
+  const hookId = useId();
+  const [isOpen, setIsOpen] = useState(props.isDefaultOpen ?? false);
+  const triggerRef = useRef<HTMLElement>(null);
+
+  const value: PopoverContextValue = {
+    isOpen,
+    setIsOpen,
+    triggerRef,
+    id: `${hookId}-popover`,
+    mode: props.mode ?? "click",
+  };
+
+  return (
+    <PopoverContext.Provider value={value}>
+      {typeof props.children === "function"
+        ? props.children(value)
+        : props.children}
+    </PopoverContext.Provider>
+  );
+};
+
+export const usePopover = () => {
+  const context = useContext(PopoverContext);
+  if (!context) {
+    throw new Error(
+      "Popover compound components cannot be rendered outside the Popover component",
+    );
+  }
+  return context;
+};
+
+export const PopoverTrigger = (props: { children: TriggerElement }) => {
+  const popover = usePopover();
+
+  const clickProps = {
+    onClick: () => {
+      popover.setIsOpen((isOpen) => !isOpen);
+    },
+  };
+
+  const hoverProps = {
+    onPointerEnter: () => {
+      popover.setIsOpen(true);
+    },
+    onPointerLeave: () => {
+      popover.setIsOpen(false);
+    },
+  };
+
+  return cloneElement(props.children, {
+    ...(popover.mode === "click" ? clickProps : hoverProps),
+    "aria-haspopup": true,
+    "aria-owns": popover.isOpen ? popover.id : undefined,
+    ref: popover.triggerRef,
+  });
+};
+
+type Horizontal = "left" | "right";
+
+export const PopoverContent = (
+  props: Omit<MuiPopoverProps, "open" | "onClose" | "anchorEl"> & {
+    horizontal?: Horizontal;
+  },
+) => {
+  const popover = usePopover();
+  const [isReady, setIsReady] = useState(false);
+  const horizontal = props.horizontal ?? "left";
+  const hoverMode = popover.mode === "hover";
+
+  // This is a hack to make sure the popover is not rendered until the trigger
+  // is ready. This is a limitation on MUI that does not support defaultIsOpen
+  // on Popover but we need it to storybook the component.
+  useEffect(() => {
+    if (!isReady && popover.triggerRef.current !== null) {
+      setIsReady(true);
+    }
+  }, [isReady, popover.triggerRef]);
+
+  if (!popover.triggerRef.current) {
+    return null;
+  }
+
+  return (
+    <MuiPopover
+      disablePortal
+      css={(theme) => ({
+        // When it is on hover mode, and the mode is moving from the trigger to
+        // the popover, if there is any space, the popover will be closed. I
+        // found this is a limitation on how MUI structured the component. It is
+        // not a big issue for now but we can re-evaluate it in the future.
+        marginTop: hoverMode ? undefined : theme.spacing(1),
+        pointerEvents: hoverMode ? "none" : undefined,
+        "& .MuiPaper-root": {
+          minWidth: theme.spacing(40),
+          fontSize: 14,
+          pointerEvents: hoverMode ? "auto" : undefined,
+        },
+      })}
+      {...horizontalProps(horizontal)}
+      {...modeProps(popover)}
+      {...props}
+      id={popover.id}
+      open={popover.isOpen}
+      onClose={() => popover.setIsOpen(false)}
+      anchorEl={popover.triggerRef.current}
+    />
+  );
+};
+
+const modeProps = (popover: PopoverContextValue) => {
+  if (popover.mode === "hover") {
+    return {
+      onPointerEnter: () => {
+        popover.setIsOpen(true);
+      },
+      onPointerLeave: () => {
+        popover.setIsOpen(false);
+      },
+    };
+  }
+
+  return {};
+};
+
+const horizontalProps = (horizontal: Horizontal) => {
+  if (horizontal === "right") {
+    return {
+      anchorOrigin: {
+        vertical: "bottom",
+        horizontal: "right",
+      },
+      transformOrigin: {
+        vertical: "top",
+        horizontal: "right",
+      },
+    } as const;
+  }
+
+  return {
+    anchorOrigin: {
+      vertical: "bottom",
+      horizontal: "left",
+    },
+  } as const;
+};
diff --git a/site/src/components/PortForwardButton/PortForwardButton.tsx b/site/src/components/PortForwardButton/PortForwardButton.tsx
deleted file mode 100644
index 5c8b4943f8b60..0000000000000
--- a/site/src/components/PortForwardButton/PortForwardButton.tsx
+++ /dev/null
@@ -1,211 +0,0 @@
-import Button from "@mui/material/Button"
-import Link from "@mui/material/Link"
-import Popover from "@mui/material/Popover"
-import { makeStyles } from "@mui/styles"
-import TextField from "@mui/material/TextField"
-import { Stack } from "components/Stack/Stack"
-import { useRef, useState, Fragment } from "react"
-import { colors } from "theme/colors"
-import { CodeExample } from "../CodeExample/CodeExample"
-import {
-  HelpTooltipLink,
-  HelpTooltipLinksGroup,
-  HelpTooltipText,
-  HelpTooltipTitle,
-} from "../Tooltips/HelpTooltip"
-import { Maybe } from "components/Conditionals/Maybe"
-import { useMachine } from "@xstate/react"
-import { portForwardMachine } from "xServices/portForward/portForwardXService"
-import { SecondaryAgentButton } from "components/Resources/AgentButton"
-import { docs } from "utils/docs"
-
-export interface PortForwardButtonProps {
-  host: string
-  username: string
-  workspaceName: string
-  agentName: string
-  agentId: string
-}
-
-export const portForwardURL = (
-  host: string,
-  port: number,
-  agentName: string,
-  workspaceName: string,
-  username: string,
-): string => {
-  const { location } = window
-
-  const subdomain = `${
-    isNaN(port) ? 3000 : port
-  }--${agentName}--${workspaceName}--${username}`
-  return `${location.protocol}//${host}`.replace("*", subdomain)
-}
-
-const TooltipView: React.FC<PortForwardButtonProps> = (props) => {
-  const { host, workspaceName, agentName, agentId, username } = props
-
-  const styles = useStyles()
-  const [port, setPort] = useState("3000")
-  const urlExample = portForwardURL(
-    host,
-    parseInt(port),
-    agentName,
-    workspaceName,
-    username,
-  )
-
-  const [state] = useMachine(portForwardMachine, {
-    context: { agentId: agentId },
-  })
-  const ports = state.context.listeningPorts?.ports
-
-  return (
-    <>
-      <HelpTooltipText>
-        Access ports running on the agent with the{" "}
-        <strong>port, agent name, workspace name</strong> and{" "}
-        <strong>your username</strong> URL schema, as shown below. Port URLs are
-        only accessible by you.
-      </HelpTooltipText>
-
-      <CodeExample code={urlExample} className={styles.code} />
-
-      <HelpTooltipText>
-        Use the form to open applications in a new tab.
-      </HelpTooltipText>
-
-      <Stack
-        direction="row"
-        spacing={1}
-        alignItems="center"
-        className={styles.form}
-      >
-        <TextField
-          label="Port"
-          type="number"
-          size="small"
-          value={port}
-          className={styles.portField}
-          onChange={(e) => {
-            setPort(e.currentTarget.value)
-          }}
-        />
-        <Link
-          href={urlExample}
-          target="_blank"
-          rel="noreferrer"
-          className={styles.openUrlButton}
-        >
-          <Button>Open URL</Button>
-        </Link>
-      </Stack>
-
-      <Maybe condition={Boolean(ports && ports.length > 0)}>
-        <HelpTooltipText>
-          {ports &&
-            ports.map((p, i) => {
-              const url = portForwardURL(
-                host,
-                p.port,
-                agentName,
-                workspaceName,
-                username,
-              )
-              let label = `${p.port}`
-              if (p.process_name) {
-                label = `${p.process_name} - ${p.port}`
-              }
-
-              return (
-                <Fragment key={i}>
-                  {i > 0 && <span style={{ margin: "0 0.6em" }}>&middot;</span>}
-                  <Link href={url} target="_blank" rel="noreferrer">
-                    {label}
-                  </Link>
-                </Fragment>
-              )
-            })}
-        </HelpTooltipText>
-      </Maybe>
-
-      <HelpTooltipLinksGroup>
-        <HelpTooltipLink href={docs("/networking/port-forwarding#dashboard")}>
-          Learn more about web port forwarding
-        </HelpTooltipLink>
-      </HelpTooltipLinksGroup>
-    </>
-  )
-}
-
-export const PortForwardButton: React.FC<PortForwardButtonProps> = (props) => {
-  const anchorRef = useRef<HTMLButtonElement>(null)
-  const [isOpen, setIsOpen] = useState(false)
-  const id = isOpen ? "schedule-popover" : undefined
-  const styles = useStyles()
-
-  const onClose = () => {
-    setIsOpen(false)
-  }
-
-  return (
-    <>
-      <SecondaryAgentButton
-        ref={anchorRef}
-        onClick={() => {
-          setIsOpen(true)
-        }}
-      >
-        Port forward
-      </SecondaryAgentButton>
-      <Popover
-        classes={{ paper: styles.popoverPaper }}
-        id={id}
-        open={isOpen}
-        anchorEl={anchorRef.current}
-        onClose={onClose}
-        anchorOrigin={{
-          vertical: "bottom",
-          horizontal: "left",
-        }}
-        transformOrigin={{
-          vertical: "top",
-          horizontal: "left",
-        }}
-      >
-        <HelpTooltipTitle>Port forward</HelpTooltipTitle>
-        <TooltipView {...props} />
-      </Popover>
-    </>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  popoverPaper: {
-    padding: `${theme.spacing(2.5)} ${theme.spacing(3.5)} ${theme.spacing(
-      3.5,
-    )}`,
-    width: theme.spacing(52),
-    color: theme.palette.text.secondary,
-    marginTop: theme.spacing(0.25),
-  },
-
-  openUrlButton: {
-    flexShrink: 0,
-  },
-
-  portField: {
-    // The default border don't contrast well with the popover
-    "& .MuiOutlinedInput-root .MuiOutlinedInput-notchedOutline": {
-      borderColor: colors.gray[10],
-    },
-  },
-
-  code: {
-    margin: theme.spacing(2, 0),
-  },
-
-  form: {
-    margin: theme.spacing(2, 0),
-  },
-}))
diff --git a/site/src/components/ProxyStatusLatency/ProxyStatusLatency.tsx b/site/src/components/ProxyStatusLatency/ProxyStatusLatency.tsx
index 6a6b09e3d057e..8886652ac2ad3 100644
--- a/site/src/components/ProxyStatusLatency/ProxyStatusLatency.tsx
+++ b/site/src/components/ProxyStatusLatency/ProxyStatusLatency.tsx
@@ -1,17 +1,17 @@
-import { useTheme } from "@mui/material/styles"
-import HelpOutline from "@mui/icons-material/HelpOutline"
-import Box from "@mui/material/Box"
-import Tooltip from "@mui/material/Tooltip"
-import { FC } from "react"
-import { getLatencyColor } from "utils/latency"
-import CircularProgress from "@mui/material/CircularProgress"
+import { useTheme } from "@mui/material/styles";
+import HelpOutline from "@mui/icons-material/HelpOutline";
+import Box from "@mui/material/Box";
+import Tooltip from "@mui/material/Tooltip";
+import { FC } from "react";
+import { getLatencyColor } from "utils/latency";
+import CircularProgress from "@mui/material/CircularProgress";
 
 export const ProxyStatusLatency: FC<{
-  latency?: number
-  isLoading?: boolean
+  latency?: number;
+  isLoading?: boolean;
 }> = ({ latency, isLoading }) => {
-  const theme = useTheme()
-  const color = getLatencyColor(theme, latency)
+  const theme = useTheme();
+  const color = getLatencyColor(theme, latency);
 
   if (isLoading) {
     return (
@@ -25,7 +25,7 @@ export const ProxyStatusLatency: FC<{
           }}
         />
       </Tooltip>
-    )
+    );
   }
 
   if (!latency) {
@@ -39,12 +39,12 @@ export const ProxyStatusLatency: FC<{
           }}
         />
       </Tooltip>
-    )
+    );
   }
 
   return (
     <Box sx={{ color, fontSize: 13, marginLeft: "auto" }}>
       {latency.toFixed(0)}ms
     </Box>
-  )
-}
+  );
+};
diff --git a/site/src/components/RequireAuth/RequireAuth.test.tsx b/site/src/components/RequireAuth/RequireAuth.test.tsx
index a6abeead64b59..e7604fcaba062 100644
--- a/site/src/components/RequireAuth/RequireAuth.test.tsx
+++ b/site/src/components/RequireAuth/RequireAuth.test.tsx
@@ -1,32 +1,26 @@
-import { screen } from "@testing-library/react"
-import { rest } from "msw"
-import { renderWithAuth } from "testHelpers/renderHelpers"
-import { server } from "testHelpers/server"
+import { screen } from "@testing-library/react";
+import { rest } from "msw";
+import { renderWithAuth } from "testHelpers/renderHelpers";
+import { server } from "testHelpers/server";
 
 describe("RequireAuth", () => {
-  it("redirects to /setup if there is no first user", async () => {
+  it("redirects to /login if user is not authenticated", async () => {
     // appear logged out
     server.use(
       rest.get("/api/v2/users/me", (req, res, ctx) => {
-        return res(ctx.status(401), ctx.json({ message: "no user here" }))
+        return res(ctx.status(401), ctx.json({ message: "no user here" }));
       }),
-    )
-    // No first user
-    server.use(
-      rest.get("/api/v2/users/first", async (req, res, ctx) => {
-        return res(ctx.status(404))
-      }),
-    )
+    );
 
     renderWithAuth(<h1>Test</h1>, {
       nonAuthenticatedRoutes: [
         {
-          path: "setup",
-          element: <h1>Setup</h1>,
+          path: "login",
+          element: <h1>Login</h1>,
         },
       ],
-    })
+    });
 
-    await screen.findByText("Setup")
-  })
-})
+    await screen.findByText("Login");
+  });
+});
diff --git a/site/src/components/RequireAuth/RequireAuth.tsx b/site/src/components/RequireAuth/RequireAuth.tsx
index dd7bcddf25662..f6054a629fb91 100644
--- a/site/src/components/RequireAuth/RequireAuth.tsx
+++ b/site/src/components/RequireAuth/RequireAuth.tsx
@@ -1,26 +1,48 @@
-import { useAuth } from "components/AuthProvider/AuthProvider"
-import { FC } from "react"
-import { Outlet, Navigate, useLocation } from "react-router-dom"
-import { embedRedirect } from "../../utils/redirect"
-import { FullScreenLoader } from "../Loader/FullScreenLoader"
-import { DashboardProvider } from "components/Dashboard/DashboardProvider"
-import { ProxyProvider } from "contexts/ProxyContext"
+import axios from "axios";
+import { useAuth } from "components/AuthProvider/AuthProvider";
+import { FC, useEffect } from "react";
+import { Outlet, Navigate, useLocation } from "react-router-dom";
+import { embedRedirect } from "utils/redirect";
+import { FullScreenLoader } from "../Loader/FullScreenLoader";
+import { DashboardProvider } from "components/Dashboard/DashboardProvider";
+import { ProxyProvider } from "contexts/ProxyContext";
+import { isApiError } from "api/errors";
 
 export const RequireAuth: FC = () => {
-  const [authState] = useAuth()
-  const location = useLocation()
-  const isHomePage = location.pathname === "/"
-  const navigateTo = isHomePage ? "/login" : embedRedirect(location.pathname)
+  const { signOut, isSigningOut, isSignedOut } = useAuth();
+  const location = useLocation();
+  const isHomePage = location.pathname === "/";
+  const navigateTo = isHomePage
+    ? "/login"
+    : embedRedirect(`${location.pathname}${location.search}`);
 
-  if (authState.matches("signedOut")) {
-    return <Navigate to={navigateTo} state={{ isRedirect: !isHomePage }} />
-  } else if (authState.matches("configuringTheFirstUser")) {
-    return <Navigate to="/setup" />
-  } else if (
-    authState.matches("loadingInitialAuthData") ||
-    authState.matches("signingOut")
-  ) {
-    return <FullScreenLoader />
+  useEffect(() => {
+    const interceptorHandle = axios.interceptors.response.use(
+      (okResponse) => okResponse,
+      (error: unknown) => {
+        // 401 Unauthorized
+        // If we encountered an authentication error, then our token is probably
+        // invalid and we should update the auth state to reflect that.
+        if (isApiError(error) && error.response.status === 401) {
+          signOut();
+        }
+
+        // Otherwise, pass the response through so that it can be displayed in the UI
+        return Promise.reject(error);
+      },
+    );
+
+    return () => {
+      axios.interceptors.response.eject(interceptorHandle);
+    };
+  }, [signOut]);
+
+  if (isSignedOut) {
+    return (
+      <Navigate to={navigateTo} state={{ isRedirect: !isHomePage }} replace />
+    );
+  } else if (isSigningOut) {
+    return <FullScreenLoader />;
   } else {
     // Authenticated pages have access to some contexts for knowing enabled experiments
     // and where to route workspace connections.
@@ -30,6 +52,6 @@ export const RequireAuth: FC = () => {
           <Outlet />
         </ProxyProvider>
       </DashboardProvider>
-    )
+    );
   }
-}
+};
diff --git a/site/src/components/RequirePermission/RequirePermission.tsx b/site/src/components/RequirePermission/RequirePermission.tsx
index d7bc0a1560a8b..6a2694f5fd76b 100644
--- a/site/src/components/RequirePermission/RequirePermission.tsx
+++ b/site/src/components/RequirePermission/RequirePermission.tsx
@@ -1,9 +1,9 @@
-import { FC } from "react"
-import { Navigate } from "react-router-dom"
+import { FC } from "react";
+import { Navigate } from "react-router-dom";
 
 export interface RequirePermissionProps {
-  children: JSX.Element
-  isFeatureVisible: boolean
+  children: JSX.Element;
+  isFeatureVisible: boolean;
 }
 
 /**
@@ -14,8 +14,8 @@ export const RequirePermission: FC<RequirePermissionProps> = ({
   isFeatureVisible,
 }) => {
   if (!isFeatureVisible) {
-    return <Navigate to="/workspaces" />
+    return <Navigate to="/workspaces" />;
   } else {
-    return children
+    return children;
   }
-}
+};
diff --git a/site/src/components/Resources/AgentButton.tsx b/site/src/components/Resources/AgentButton.tsx
index 3b66c0aed5da9..1c0d346300793 100644
--- a/site/src/components/Resources/AgentButton.tsx
+++ b/site/src/components/Resources/AgentButton.tsx
@@ -1,5 +1,5 @@
-import Button, { ButtonProps } from "@mui/material/Button"
-import { FC, forwardRef } from "react"
+import Button, { ButtonProps } from "@mui/material/Button";
+import { FC, forwardRef } from "react";
 
 export const PrimaryAgentButton: FC<ButtonProps> = ({
   className,
@@ -23,12 +23,12 @@ export const PrimaryAgentButton: FC<ButtonProps> = ({
         ...props.sx,
       }}
     />
-  )
-}
+  );
+};
 
 // eslint-disable-next-line react/display-name -- Name is inferred from variable name
 export const SecondaryAgentButton = forwardRef<HTMLButtonElement, ButtonProps>(
   ({ className, ...props }, ref) => {
-    return <Button ref={ref} className={className} {...props} />
+    return <Button ref={ref} className={className} {...props} />;
   },
-)
+);
diff --git a/site/src/components/Resources/AgentLatency.tsx b/site/src/components/Resources/AgentLatency.tsx
index 04f790980c977..a611f6ba70fa5 100644
--- a/site/src/components/Resources/AgentLatency.tsx
+++ b/site/src/components/Resources/AgentLatency.tsx
@@ -1,44 +1,43 @@
-import { useRef, useState, FC } from "react"
-import { makeStyles, useTheme } from "@mui/styles"
-import { Theme } from "@mui/material/styles"
+import { type FC, useRef, useState } from "react";
+import { useTheme } from "@emotion/react";
+import { Theme } from "@mui/material/styles";
+import type { WorkspaceAgent, DERPRegion } from "api/typesGenerated";
 import {
   HelpTooltipText,
   HelpPopover,
   HelpTooltipTitle,
-} from "components/Tooltips/HelpTooltip"
-import { Stack } from "components/Stack/Stack"
-import { WorkspaceAgent, DERPRegion } from "api/typesGenerated"
-import { getLatencyColor } from "utils/latency"
+} from "components/HelpTooltip/HelpTooltip";
+import { Stack } from "components/Stack/Stack";
+import { getLatencyColor } from "utils/latency";
 
 const getDisplayLatency = (theme: Theme, agent: WorkspaceAgent) => {
   // Find the right latency to display
-  const latencyValues = Object.values(agent.latency ?? {})
+  const latencyValues = Object.values(agent.latency ?? {});
   const latency =
     latencyValues.find((derp) => derp.preferred) ??
     // Accessing an array index can return undefined as well
     // for some reason TS does not handle that
-    (latencyValues[0] as DERPRegion | undefined)
+    (latencyValues[0] as DERPRegion | undefined);
 
   if (!latency) {
-    return undefined
+    return undefined;
   }
 
   return {
     ...latency,
     color: getLatencyColor(theme, latency.latency_ms),
-  }
-}
+  };
+};
 
 export const AgentLatency: FC<{ agent: WorkspaceAgent }> = ({ agent }) => {
-  const theme: Theme = useTheme()
-  const anchorRef = useRef<HTMLButtonElement>(null)
-  const [isOpen, setIsOpen] = useState(false)
-  const id = isOpen ? "latency-popover" : undefined
-  const latency = getDisplayLatency(theme, agent)
-  const styles = useStyles()
+  const theme = useTheme();
+  const anchorRef = useRef<HTMLButtonElement>(null);
+  const [isOpen, setIsOpen] = useState(false);
+  const id = isOpen ? "latency-popover" : undefined;
+  const latency = getDisplayLatency(theme, agent);
 
   if (!latency || !agent.latency) {
-    return null
+    return null;
   }
 
   return (
@@ -49,8 +48,7 @@ export const AgentLatency: FC<{ agent: WorkspaceAgent }> = ({ agent }) => {
         ref={anchorRef}
         onMouseEnter={() => setIsOpen(true)}
         onMouseLeave={() => setIsOpen(false)}
-        className={styles.trigger}
-        style={{ color: latency.color }}
+        css={{ cursor: "pointer", color: latency.color }}
       >
         {Math.round(Math.round(latency.latency_ms))}ms
       </span>
@@ -66,44 +64,33 @@ export const AgentLatency: FC<{ agent: WorkspaceAgent }> = ({ agent }) => {
           This is the latency overhead on non peer to peer connections. The
           first row is the preferred relay.
         </HelpTooltipText>
-
         <HelpTooltipText>
-          <Stack direction="column" spacing={1} className={styles.regions}>
-            {Object.keys(agent.latency).map((regionName) => {
-              if (!agent.latency) {
-                throw new Error("No latency found on agent")
-              }
-
-              const region = agent.latency[regionName]
-
-              return (
+          <Stack
+            direction="column"
+            spacing={1}
+            css={{ marginTop: theme.spacing(2) }}
+          >
+            {Object.entries(agent.latency)
+              .sort(([, a], [, b]) => a.latency_ms - b.latency_ms)
+              .map(([regionName, region]) => (
                 <Stack
                   direction="row"
                   key={regionName}
                   spacing={0.5}
                   justifyContent="space-between"
-                  className={region.preferred ? styles.preferred : undefined}
+                  css={
+                    region.preferred && {
+                      color: theme.palette.text.primary,
+                    }
+                  }
                 >
                   <strong>{regionName}</strong>
                   {Math.round(region.latency_ms)}ms
                 </Stack>
-              )
-            })}
+              ))}
           </Stack>
         </HelpTooltipText>
       </HelpPopover>
     </>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  trigger: {
-    cursor: "pointer",
-  },
-  regions: {
-    marginTop: theme.spacing(2),
-  },
-  preferred: {
-    color: theme.palette.text.primary,
-  },
-}))
+  );
+};
diff --git a/site/src/components/Resources/AgentMetadata.stories.tsx b/site/src/components/Resources/AgentMetadata.stories.tsx
index 9e5bedfd907e9..586944a655878 100644
--- a/site/src/components/Resources/AgentMetadata.stories.tsx
+++ b/site/src/components/Resources/AgentMetadata.stories.tsx
@@ -1,25 +1,24 @@
-import { Story } from "@storybook/react"
 import {
   WorkspaceAgentMetadataDescription,
   WorkspaceAgentMetadataResult,
-} from "api/typesGenerated"
-import { AgentMetadataView, AgentMetadataViewProps } from "./AgentMetadata"
+} from "api/typesGenerated";
+import { AgentMetadataView } from "./AgentMetadata";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "components/AgentMetadata",
+const meta: Meta<typeof AgentMetadataView> = {
+  title: "components/AgentMetadataView",
   component: AgentMetadataView,
-}
+};
 
-const Template: Story<AgentMetadataViewProps> = (args) => (
-  <AgentMetadataView {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof AgentMetadataView>;
 
 const resultDefaults: WorkspaceAgentMetadataResult = {
   collected_at: "2021-05-05T00:00:00Z",
   error: "",
   value: "defvalue",
   age: 5,
-}
+};
 
 const descriptionDefaults: WorkspaceAgentMetadataDescription = {
   display_name: "DisPlay",
@@ -27,81 +26,84 @@ const descriptionDefaults: WorkspaceAgentMetadataDescription = {
   interval: 10,
   timeout: 10,
   script: "some command",
-}
+};
 
-export const Example = Template.bind({})
-Example.args = {
-  metadata: [
-    {
-      result: {
-        ...resultDefaults,
-        value: "110%",
+const Example: Story = {
+  args: {
+    metadata: [
+      {
+        result: {
+          ...resultDefaults,
+          value: "110%",
+        },
+        description: {
+          ...descriptionDefaults,
+          display_name: "CPU",
+          key: "CPU",
+        },
       },
-      description: {
-        ...descriptionDefaults,
-        display_name: "CPU",
-        key: "CPU",
+      {
+        result: {
+          ...resultDefaults,
+          value: "50GB",
+        },
+        description: {
+          ...descriptionDefaults,
+          display_name: "Memory",
+          key: "Memory",
+        },
       },
-    },
-    {
-      result: {
-        ...resultDefaults,
-        value: "50GB",
+      {
+        result: {
+          ...resultDefaults,
+          value: "stale value",
+          age: 300,
+        },
+        description: {
+          ...descriptionDefaults,
+          interval: 5,
+          display_name: "Stale",
+          key: "stale",
+        },
       },
-      description: {
-        ...descriptionDefaults,
-        display_name: "Memory",
-        key: "Memory",
+      {
+        result: {
+          ...resultDefaults,
+          value: "oops",
+          error: "fatal error",
+        },
+        description: {
+          ...descriptionDefaults,
+          display_name: "Error",
+          key: "error",
+        },
       },
-    },
-    {
-      result: {
-        ...resultDefaults,
-        value: "stale value",
-        age: 300,
+      {
+        result: {
+          ...resultDefaults,
+          value: "",
+          collected_at: "0001-01-01T00:00:00Z",
+          age: 1000000,
+        },
+        description: {
+          ...descriptionDefaults,
+          display_name: "Never loads",
+          key: "nloads",
+        },
       },
-      description: {
-        ...descriptionDefaults,
-        interval: 5,
-        display_name: "Stale",
-        key: "stale",
+      {
+        result: {
+          ...resultDefaults,
+          value: "r".repeat(1000),
+        },
+        description: {
+          ...descriptionDefaults,
+          display_name: "Really, really big",
+          key: "big",
+        },
       },
-    },
-    {
-      result: {
-        ...resultDefaults,
-        value: "oops",
-        error: "fatal error",
-      },
-      description: {
-        ...descriptionDefaults,
-        display_name: "Error",
-        key: "error",
-      },
-    },
-    {
-      result: {
-        ...resultDefaults,
-        value: "",
-        collected_at: "0001-01-01T00:00:00Z",
-        age: 1000000,
-      },
-      description: {
-        ...descriptionDefaults,
-        display_name: "Never loads",
-        key: "nloads",
-      },
-    },
-    {
-      result: {
-        ...resultDefaults,
-        value: "r".repeat(1000),
-      },
-      description: {
-        ...descriptionDefaults,
-        display_name: "Really, really big",
-        key: "big",
-      },
-    },
-  ],
-}
+    ],
+  },
+};
+
+export { Example as AgentMetadata };
diff --git a/site/src/components/Resources/AgentMetadata.tsx b/site/src/components/Resources/AgentMetadata.tsx
index 53d6ad4feeb92..009e67ee54eae 100644
--- a/site/src/components/Resources/AgentMetadata.tsx
+++ b/site/src/components/Resources/AgentMetadata.tsx
@@ -1,8 +1,8 @@
-import makeStyles from "@mui/styles/makeStyles"
-import { watchAgentMetadata } from "api/api"
-import { WorkspaceAgent, WorkspaceAgentMetadata } from "api/typesGenerated"
-import { Stack } from "components/Stack/Stack"
-import dayjs from "dayjs"
+import makeStyles from "@mui/styles/makeStyles";
+import { watchAgentMetadata } from "api/api";
+import { WorkspaceAgent, WorkspaceAgentMetadata } from "api/typesGenerated";
+import { Stack } from "components/Stack/Stack";
+import dayjs from "dayjs";
 import {
   createContext,
   FC,
@@ -10,45 +10,46 @@ import {
   useEffect,
   useRef,
   useState,
-} from "react"
-import Skeleton from "@mui/material/Skeleton"
-import { MONOSPACE_FONT_FAMILY } from "theme/constants"
-import { combineClasses } from "utils/combineClasses"
-import Tooltip from "@mui/material/Tooltip"
-import Box, { BoxProps } from "@mui/material/Box"
+} from "react";
+import Skeleton from "@mui/material/Skeleton";
+import { MONOSPACE_FONT_FAMILY } from "theme/constants";
+import { combineClasses } from "utils/combineClasses";
+import Tooltip from "@mui/material/Tooltip";
+import Box, { BoxProps } from "@mui/material/Box";
 
-type ItemStatus = "stale" | "valid" | "loading"
+type ItemStatus = "stale" | "valid" | "loading";
 
-export const WatchAgentMetadataContext = createContext(watchAgentMetadata)
+export const WatchAgentMetadataContext = createContext(watchAgentMetadata);
 
 const MetadataItem: FC<{ item: WorkspaceAgentMetadata }> = ({ item }) => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   if (item.result === undefined) {
-    throw new Error("Metadata item result is undefined")
+    throw new Error("Metadata item result is undefined");
   }
   if (item.description === undefined) {
-    throw new Error("Metadata item description is undefined")
+    throw new Error("Metadata item description is undefined");
   }
 
   const staleThreshold = Math.max(
     item.description.interval + item.description.timeout * 2,
+    // In case there is intense backpressure, we give a little bit of slack.
     5,
-  )
+  );
 
   const status: ItemStatus = (() => {
-    const year = dayjs(item.result.collected_at).year()
+    const year = dayjs(item.result.collected_at).year();
     if (year <= 1970 || isNaN(year)) {
-      return "loading"
+      return "loading";
     }
     // There is a special circumstance for metadata with `interval: 0`. It is
     // expected that they run once and never again, so never display them as
     // stale.
     if (item.result.age > staleThreshold && item.description.interval > 0) {
-      return "stale"
+      return "stale";
     }
-    return "valid"
-  })()
+    return "valid";
+  })();
 
   // Stale data is as good as no data. Plus, we want to build confidence in our
   // users that what's shown is real. If times aren't correctly synced this
@@ -83,7 +84,7 @@ const MetadataItem: FC<{ item: WorkspaceAgentMetadata }> = ({ item }) => {
       >
         {item.result.value}
       </StaticWidth>
-    )
+    );
 
   return (
     <div className={styles.metadata}>
@@ -92,90 +93,90 @@ const MetadataItem: FC<{ item: WorkspaceAgentMetadata }> = ({ item }) => {
       </div>
       <Box>{value}</Box>
     </div>
-  )
-}
+  );
+};
 
 export interface AgentMetadataViewProps {
-  metadata: WorkspaceAgentMetadata[]
+  metadata: WorkspaceAgentMetadata[];
 }
 
 export const AgentMetadataView: FC<AgentMetadataViewProps> = ({ metadata }) => {
-  const styles = useStyles()
+  const styles = useStyles();
   if (metadata.length === 0) {
-    return <></>
+    return <></>;
   }
   return (
     <div className={styles.root}>
       <Stack alignItems="baseline" direction="row" spacing={6}>
         {metadata.map((m) => {
           if (m.description === undefined) {
-            throw new Error("Metadata item description is undefined")
+            throw new Error("Metadata item description is undefined");
           }
-          return <MetadataItem key={m.description.key} item={m} />
+          return <MetadataItem key={m.description.key} item={m} />;
         })}
       </Stack>
     </div>
-  )
-}
+  );
+};
 
 export const AgentMetadata: FC<{
-  agent: WorkspaceAgent
-  storybookMetadata?: WorkspaceAgentMetadata[]
+  agent: WorkspaceAgent;
+  storybookMetadata?: WorkspaceAgentMetadata[];
 }> = ({ agent, storybookMetadata }) => {
   const [metadata, setMetadata] = useState<
     WorkspaceAgentMetadata[] | undefined
-  >(undefined)
-  const watchAgentMetadata = useContext(WatchAgentMetadataContext)
-  const styles = useStyles()
+  >(undefined);
+  const watchAgentMetadata = useContext(WatchAgentMetadataContext);
+  const styles = useStyles();
 
   useEffect(() => {
     if (storybookMetadata !== undefined) {
-      setMetadata(storybookMetadata)
-      return
+      setMetadata(storybookMetadata);
+      return;
     }
 
-    let timeout: NodeJS.Timeout | undefined = undefined
+    let timeout: NodeJS.Timeout | undefined = undefined;
 
     const connect = (): (() => void) => {
-      const source = watchAgentMetadata(agent.id)
+      const source = watchAgentMetadata(agent.id);
 
       source.onerror = (e) => {
-        console.error("received error in watch stream", e)
-        setMetadata(undefined)
-        source.close()
+        console.error("received error in watch stream", e);
+        setMetadata(undefined);
+        source.close();
 
         timeout = setTimeout(() => {
-          connect()
-        }, 3000)
-      }
+          connect();
+        }, 3000);
+      };
 
       source.addEventListener("data", (e) => {
-        const data = JSON.parse(e.data)
-        setMetadata(data)
-      })
+        const data = JSON.parse(e.data);
+        setMetadata(data);
+      });
       return () => {
         if (timeout !== undefined) {
-          clearTimeout(timeout)
+          clearTimeout(timeout);
         }
-        source.close()
-      }
-    }
-    return connect()
-  }, [agent.id, watchAgentMetadata, storybookMetadata])
+        source.close();
+      };
+    };
+    return connect();
+  }, [agent.id, watchAgentMetadata, storybookMetadata]);
 
   if (metadata === undefined) {
     return (
       <div className={styles.root}>
         <AgentMetadataSkeleton />
       </div>
-    )
+    );
   }
 
-  return <AgentMetadataView metadata={metadata} />
-}
+  return <AgentMetadataView metadata={metadata} />;
+};
 
 export const AgentMetadataSkeleton: FC = () => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <Stack alignItems="baseline" direction="row" spacing={6}>
@@ -194,26 +195,27 @@ export const AgentMetadataSkeleton: FC = () => {
         <Skeleton width={65} height={14} variant="text" />
       </div>
     </Stack>
-  )
-}
+  );
+};
 
 const StaticWidth = (props: BoxProps) => {
-  const ref = useRef<HTMLDivElement>(null)
+  const ref = useRef<HTMLDivElement>(null);
 
   useEffect(() => {
-    if (!ref.current) {
-      return
+    // Ignore this in storybook
+    if (!ref.current || process.env.STORYBOOK === "true") {
+      return;
     }
 
-    const currentWidth = ref.current.getBoundingClientRect().width
-    ref.current.style.width = "auto"
-    const autoWidth = ref.current.getBoundingClientRect().width
+    const currentWidth = ref.current.getBoundingClientRect().width;
+    ref.current.style.width = "auto";
+    const autoWidth = ref.current.getBoundingClientRect().width;
     ref.current.style.width =
-      autoWidth > currentWidth ? `${autoWidth}px` : `${currentWidth}px`
-  }, [props.children])
+      autoWidth > currentWidth ? `${autoWidth}px` : `${currentWidth}px`;
+  }, [props.children]);
 
-  return <Box {...props} ref={ref} />
-}
+  return <Box {...props} ref={ref} />;
+};
 
 // These are more or less copied from
 // site/src/components/Resources/ResourceCard.tsx
@@ -281,4 +283,4 @@ const useStyles = makeStyles((theme) => ({
     borderRadius: 4,
     color: theme.palette.text.primary,
   },
-}))
+}));
diff --git a/site/src/components/Resources/AgentOutdatedTooltip.tsx b/site/src/components/Resources/AgentOutdatedTooltip.tsx
new file mode 100644
index 0000000000000..6bbe9061d1348
--- /dev/null
+++ b/site/src/components/Resources/AgentOutdatedTooltip.tsx
@@ -0,0 +1,79 @@
+import { type ComponentProps, type FC } from "react";
+import { useTheme } from "@emotion/react";
+import RefreshIcon from "@mui/icons-material/RefreshOutlined";
+import {
+  HelpTooltipText,
+  HelpPopover,
+  HelpTooltipTitle,
+  HelpTooltipAction,
+  HelpTooltipLinksGroup,
+  HelpTooltipContext,
+} from "components/HelpTooltip/HelpTooltip";
+import type { WorkspaceAgent } from "api/typesGenerated";
+import { Stack } from "components/Stack/Stack";
+
+type AgentOutdatedTooltipProps = ComponentProps<typeof HelpPopover> & {
+  agent: WorkspaceAgent;
+  serverVersion: string;
+  onUpdate: () => void;
+};
+
+export const AgentOutdatedTooltip: FC<AgentOutdatedTooltipProps> = ({
+  agent,
+  serverVersion,
+  onUpdate,
+  onOpen,
+  id,
+  open,
+  onClose,
+  anchorEl,
+}) => {
+  const theme = useTheme();
+  const versionLabelStyles = {
+    fontWeight: 600,
+    color: theme.palette.text.primary,
+  };
+
+  return (
+    <HelpPopover
+      id={id}
+      open={open}
+      anchorEl={anchorEl}
+      onOpen={onOpen}
+      onClose={onClose}
+    >
+      <HelpTooltipContext.Provider value={{ open, onClose }}>
+        <Stack spacing={1}>
+          <div>
+            <HelpTooltipTitle>Agent Outdated</HelpTooltipTitle>
+            <HelpTooltipText>
+              This agent is an older version than the Coder server. This can
+              happen after you update Coder with running workspaces. To fix
+              this, you can stop and start the workspace.
+            </HelpTooltipText>
+          </div>
+
+          <Stack spacing={0.5}>
+            <span css={versionLabelStyles}>Agent version</span>
+            <span>{agent.version}</span>
+          </Stack>
+
+          <Stack spacing={0.5}>
+            <span css={versionLabelStyles}>Server version</span>
+            <span>{serverVersion}</span>
+          </Stack>
+
+          <HelpTooltipLinksGroup>
+            <HelpTooltipAction
+              icon={RefreshIcon}
+              onClick={onUpdate}
+              ariaLabel="Update workspace"
+            >
+              Update workspace
+            </HelpTooltipAction>
+          </HelpTooltipLinksGroup>
+        </Stack>
+      </HelpTooltipContext.Provider>
+    </HelpPopover>
+  );
+};
diff --git a/site/src/components/Resources/AgentRow.stories.tsx b/site/src/components/Resources/AgentRow.stories.tsx
index 5e4adf5e1b4f0..1c73aa7f789f0 100644
--- a/site/src/components/Resources/AgentRow.stories.tsx
+++ b/site/src/components/Resources/AgentRow.stories.tsx
@@ -1,4 +1,3 @@
-import { Story } from "@storybook/react"
 import {
   MockPrimaryWorkspaceProxy,
   MockWorkspaceProxies,
@@ -17,66 +16,11 @@ import {
   MockWorkspaceAgentTimeout,
   MockWorkspaceApp,
   MockProxyLatencies,
-} from "testHelpers/entities"
-import { AgentRow, AgentRowProps } from "./AgentRow"
-import { ProxyContext, getPreferredProxy } from "contexts/ProxyContext"
-import { Region } from "api/typesGenerated"
-
-export default {
-  title: "components/AgentRow",
-  component: AgentRow,
-  args: {
-    storybookStartupLogs: [
-      "\x1b[91mCloning Git repository...",
-      "\x1b[2;37;41mStarting Docker Daemon...",
-      "\x1b[1;95mAdding some 🧙magic🧙...",
-      "Starting VS Code...",
-      "\r  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0\r100  1475    0  1475    0     0   4231      0 --:--:-- --:--:-- --:--:--  4238",
-    ].map((line, index) => ({
-      id: index,
-      level: "info",
-      output: line,
-      time: "",
-    })),
-  },
-}
-
-const Template: Story<AgentRowProps> = (args) => {
-  return TemplateFC(args, [], undefined)
-}
-
-const TemplateWithPortForward: Story<AgentRowProps> = (args) => {
-  return TemplateFC(args, MockWorkspaceProxies, MockPrimaryWorkspaceProxy)
-}
-
-const TemplateFC = (
-  args: AgentRowProps,
-  proxies: Region[],
-  selectedProxy?: Region,
-) => {
-  return (
-    <ProxyContext.Provider
-      value={{
-        proxyLatencies: MockProxyLatencies,
-        proxy: getPreferredProxy(proxies, selectedProxy),
-        proxies: proxies,
-        isLoading: false,
-        isFetched: true,
-        setProxy: () => {
-          return
-        },
-        clearProxy: () => {
-          return
-        },
-        refetchProxyLatencies: (): Date => {
-          return new Date()
-        },
-      }}
-    >
-      <AgentRow {...args} />
-    </ProxyContext.Provider>
-  )
-}
+  MockWorkspaceAgentLogSource,
+} from "testHelpers/entities";
+import { AgentRow, LineWithID } from "./AgentRow";
+import { ProxyContext, getPreferredProxy } from "contexts/ProxyContext";
+import type { Meta, StoryObj } from "@storybook/react";
 
 const defaultAgentMetadata = [
   {
@@ -139,137 +83,209 @@ const defaultAgentMetadata = [
       script: "disk.sh",
     },
   },
-]
+];
+
+const storybookLogs: LineWithID[] = [
+  "\x1b[91mCloning Git repository...",
+  "\x1b[2;37;41mStarting Docker Daemon...",
+  "\x1b[1;95mAdding some 🧙magic🧙...",
+  "Starting VS Code...",
+  "\r  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0\r100  1475    0  1475    0     0   4231      0 --:--:-- --:--:-- --:--:--  4238",
+].map((line, index) => ({
+  id: index,
+  level: "info",
+  output: line,
+  time: "",
+  source_id: MockWorkspaceAgentLogSource.id,
+}));
 
-export const Example = Template.bind({})
-Example.args = {
-  agent: {
-    ...MockWorkspaceAgent,
-    startup_script:
-      'set -eux -o pipefail\n\n# install and start code-server\ncurl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server --version 4.8.3\n/tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &\n\n\nif [ ! -d ~/coder ]; then\n  mkdir -p ~/coder\n\n  git clone https://github.com/coder/coder ~/coder\nfi\n\nsudo service docker start\nDOTFILES_URI=" "\nrm -f ~/.personalize.log\nif [ -n "${DOTFILES_URI// }" ]; then\n  coder dotfiles "$DOTFILES_URI" -y 2>&1 | tee -a ~/.personalize.log\nfi\nif [ -x ~/personalize ]; then\n  ~/personalize 2>&1 | tee -a ~/.personalize.log\nelif [ -f ~/personalize ]; then\n  echo "~/personalize is not executable, skipping..." | tee -a ~/.personalize.log\nfi\n',
+const meta: Meta<typeof AgentRow> = {
+  title: "components/AgentRow",
+  component: AgentRow,
+  args: {
+    storybookLogs,
+    agent: {
+      ...MockWorkspaceAgent,
+      logs_length: storybookLogs.length,
+    },
+    workspace: MockWorkspace,
+    showApps: true,
+    storybookAgentMetadata: defaultAgentMetadata,
   },
-  workspace: MockWorkspace,
-  showApps: true,
-  storybookAgentMetadata: defaultAgentMetadata,
-}
+  decorators: [
+    (Story) => (
+      <ProxyContext.Provider
+        value={{
+          proxyLatencies: MockProxyLatencies,
+          proxy: getPreferredProxy([], undefined),
+          proxies: [],
+          isLoading: false,
+          isFetched: true,
+          setProxy: () => {
+            return;
+          },
+          clearProxy: () => {
+            return;
+          },
+          refetchProxyLatencies: (): Date => {
+            return new Date();
+          },
+        }}
+      >
+        <Story />
+      </ProxyContext.Provider>
+    ),
+  ],
+};
 
-export const HideSSHButton = Template.bind({})
-HideSSHButton.args = {
-  ...Example.args,
-  hideSSHButton: true,
-}
+export default meta;
+type Story = StoryObj<typeof AgentRow>;
 
-export const HideVSCodeDesktopButton = Template.bind({})
-HideVSCodeDesktopButton.args = {
-  ...Example.args,
-  hideVSCodeDesktopButton: true,
-}
+export const Example: Story = {};
 
-export const NotShowingApps = Template.bind({})
-NotShowingApps.args = {
-  ...Example.args,
-  showApps: false,
-}
+export const HideSSHButton: Story = {
+  args: {
+    hideSSHButton: true,
+  },
+};
 
-export const BunchOfApps = Template.bind({})
-BunchOfApps.args = {
-  ...Example.args,
-  agent: {
-    ...MockWorkspaceAgent,
-    apps: [
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-    ],
+export const HideVSCodeDesktopButton: Story = {
+  args: {
+    hideVSCodeDesktopButton: true,
   },
-  workspace: MockWorkspace,
-  showApps: true,
-}
+};
 
-export const Connecting = Template.bind({})
-Connecting.args = {
-  ...Example.args,
-  agent: MockWorkspaceAgentConnecting,
-  storybookAgentMetadata: [],
-}
+export const NotShowingApps: Story = {
+  args: {
+    showApps: false,
+  },
+};
 
-export const Timeout = Template.bind({})
-Timeout.args = {
-  ...Example.args,
-  agent: MockWorkspaceAgentTimeout,
-}
+export const BunchOfApps: Story = {
+  args: {
+    agent: {
+      ...MockWorkspaceAgent,
+      apps: [
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+      ],
+    },
+    workspace: MockWorkspace,
+    showApps: true,
+  },
+};
 
-export const Starting = Template.bind({})
-Starting.args = {
-  ...Example.args,
-  agent: MockWorkspaceAgentStarting,
-}
+export const Connecting: Story = {
+  args: {
+    agent: MockWorkspaceAgentConnecting,
+    storybookAgentMetadata: [],
+  },
+};
 
-export const Started = Template.bind({})
-Started.args = {
-  ...Example.args,
-  agent: {
-    ...MockWorkspaceAgentReady,
-    logs_length: 1,
+export const Timeout: Story = {
+  args: {
+    agent: MockWorkspaceAgentTimeout,
   },
-}
+};
 
-export const StartedNoMetadata = Template.bind({})
-StartedNoMetadata.args = {
-  ...Started.args,
-  storybookAgentMetadata: [],
-}
+export const Starting: Story = {
+  args: {
+    agent: MockWorkspaceAgentStarting,
+  },
+};
 
-export const StartTimeout = Template.bind({})
-StartTimeout.args = {
-  ...Example.args,
-  agent: MockWorkspaceAgentStartTimeout,
-}
+export const Started: Story = {
+  args: {
+    agent: {
+      ...MockWorkspaceAgentReady,
+      logs_length: 1,
+    },
+  },
+};
 
-export const StartError = Template.bind({})
-StartError.args = {
-  ...Example.args,
-  agent: MockWorkspaceAgentStartError,
-}
+export const StartedNoMetadata: Story = {
+  args: {
+    ...Started.args,
+    storybookAgentMetadata: [],
+  },
+};
 
-export const ShuttingDown = Template.bind({})
-ShuttingDown.args = {
-  ...Example.args,
-  agent: MockWorkspaceAgentShuttingDown,
-}
+export const StartTimeout: Story = {
+  args: {
+    agent: MockWorkspaceAgentStartTimeout,
+  },
+};
 
-export const ShutdownTimeout = Template.bind({})
-ShutdownTimeout.args = {
-  ...Example.args,
-  agent: MockWorkspaceAgentShutdownTimeout,
-}
+export const StartError: Story = {
+  args: {
+    agent: MockWorkspaceAgentStartError,
+  },
+};
 
-export const ShutdownError = Template.bind({})
-ShutdownError.args = {
-  ...Example.args,
-  agent: MockWorkspaceAgentShutdownError,
-}
+export const ShuttingDown: Story = {
+  args: {
+    agent: MockWorkspaceAgentShuttingDown,
+  },
+};
 
-export const Off = Template.bind({})
-Off.args = {
-  ...Example.args,
-  agent: MockWorkspaceAgentOff,
-}
+export const ShutdownTimeout: Story = {
+  args: {
+    agent: MockWorkspaceAgentShutdownTimeout,
+  },
+};
 
-export const ShowingPortForward = TemplateWithPortForward.bind({})
-ShowingPortForward.args = {
-  ...Example.args,
-}
+export const ShutdownError: Story = {
+  args: {
+    agent: MockWorkspaceAgentShutdownError,
+  },
+};
 
-export const Outdated = Template.bind({})
-Outdated.args = {
-  ...Example.args,
-  agent: MockWorkspaceAgentOutdated,
-  workspace: MockWorkspace,
-  serverVersion: "v99.999.9999+c1cdf14",
-}
+export const Off: Story = {
+  args: {
+    agent: MockWorkspaceAgentOff,
+  },
+};
+
+export const ShowingPortForward: Story = {
+  decorators: [
+    (Story) => (
+      <ProxyContext.Provider
+        value={{
+          proxyLatencies: MockProxyLatencies,
+          proxy: getPreferredProxy(
+            MockWorkspaceProxies,
+            MockPrimaryWorkspaceProxy,
+          ),
+          proxies: MockWorkspaceProxies,
+          isLoading: false,
+          isFetched: true,
+          setProxy: () => {
+            return;
+          },
+          clearProxy: () => {
+            return;
+          },
+          refetchProxyLatencies: (): Date => {
+            return new Date();
+          },
+        }}
+      >
+        <Story />
+      </ProxyContext.Provider>
+    ),
+  ],
+};
+
+export const Outdated: Story = {
+  args: {
+    agent: MockWorkspaceAgentOutdated,
+    workspace: MockWorkspace,
+    serverVersion: "v99.999.9999+c1cdf14",
+  },
+};
diff --git a/site/src/components/Resources/AgentRow.tsx b/site/src/components/Resources/AgentRow.tsx
index f26c8b8fbdd5c..d77160b5cc07b 100644
--- a/site/src/components/Resources/AgentRow.tsx
+++ b/site/src/components/Resources/AgentRow.tsx
@@ -1,15 +1,23 @@
-import Popover from "@mui/material/Popover"
-import { makeStyles, useTheme } from "@mui/styles"
-import Skeleton from "@mui/material/Skeleton"
-import { useMachine } from "@xstate/react"
-import CodeOutlined from "@mui/icons-material/CodeOutlined"
+import Collapse from "@mui/material/Collapse";
+import Skeleton from "@mui/material/Skeleton";
+import Tooltip from "@mui/material/Tooltip";
+import { makeStyles } from "@mui/styles";
+import * as API from "api/api";
 import {
-  CloseDropdown,
-  OpenDropdown,
-} from "components/DropdownArrows/DropdownArrows"
-import { LogLine, logLineHeight } from "components/Logs/Logs"
-import { PortForwardButton } from "components/PortForwardButton/PortForwardButton"
-import { VSCodeDesktopButton } from "components/VSCodeDesktopButton/VSCodeDesktopButton"
+  Workspace,
+  WorkspaceAgent,
+  WorkspaceAgentLogSource,
+  WorkspaceAgentMetadata,
+} from "api/typesGenerated";
+import { DropdownArrow } from "components/DropdownArrow/DropdownArrow";
+import { displayError } from "components/GlobalSnackbar/utils";
+import { VSCodeDesktopButton } from "components/Resources/VSCodeDesktopButton/VSCodeDesktopButton";
+import {
+  Line,
+  LogLine,
+  logLineHeight,
+} from "components/WorkspaceBuildLogs/Logs";
+import { useProxy } from "contexts/ProxyContext";
 import {
   FC,
   useCallback,
@@ -18,130 +26,108 @@ import {
   useMemo,
   useRef,
   useState,
-} from "react"
-import { Prism as SyntaxHighlighter } from "react-syntax-highlighter"
-import { darcula } from "react-syntax-highlighter/dist/cjs/styles/prism"
-import AutoSizer from "react-virtualized-auto-sizer"
-import { FixedSizeList as List, ListOnScrollProps } from "react-window"
-import { colors } from "theme/colors"
-import { combineClasses } from "utils/combineClasses"
-import {
-  LineWithID,
-  workspaceAgentLogsMachine,
-} from "xServices/workspaceAgentLogs/workspaceAgentLogsXService"
-import {
-  Workspace,
-  WorkspaceAgent,
-  WorkspaceAgentMetadata,
-} from "../../api/typesGenerated"
-import { AppLink } from "../AppLink/AppLink"
-import { SSHButton } from "../SSHButton/SSHButton"
-import { Stack } from "../Stack/Stack"
-import { TerminalLink } from "../TerminalLink/TerminalLink"
-import { AgentLatency } from "./AgentLatency"
-import { AgentMetadata } from "./AgentMetadata"
-import { AgentVersion } from "./AgentVersion"
-import { AgentStatus } from "./AgentStatus"
-import Collapse from "@mui/material/Collapse"
-import { useProxy } from "contexts/ProxyContext"
+} from "react";
+import AutoSizer from "react-virtualized-auto-sizer";
+import { FixedSizeList as List, ListOnScrollProps } from "react-window";
+import { colors } from "theme/colors";
+import { combineClasses } from "utils/combineClasses";
+import { Stack } from "../Stack/Stack";
+import { AgentLatency } from "./AgentLatency";
+import { AgentMetadata } from "./AgentMetadata";
+import { AgentStatus } from "./AgentStatus";
+import { AgentVersion } from "./AgentVersion";
+import { AppLink } from "./AppLink/AppLink";
+import { PortForwardButton } from "./PortForwardButton";
+import { SSHButton } from "./SSHButton/SSHButton";
+import { TerminalLink } from "./TerminalLink/TerminalLink";
+
+// Logs are stored as the Line interface to make rendering
+// much more efficient. Instead of mapping objects each time, we're
+// able to just pass the array of logs to the component.
+export interface LineWithID extends Line {
+  id: number;
+}
 
 export interface AgentRowProps {
-  agent: WorkspaceAgent
-  workspace: Workspace
-  showApps: boolean
-  hideSSHButton?: boolean
-  sshPrefix?: string
-  hideVSCodeDesktopButton?: boolean
-  serverVersion: string
-  onUpdateAgent: () => void
-  storybookLogs?: LineWithID[]
-  storybookAgentMetadata?: WorkspaceAgentMetadata[]
+  agent: WorkspaceAgent;
+  workspace: Workspace;
+  showApps: boolean;
+  showBuiltinApps?: boolean;
+  sshPrefix?: string;
+  hideSSHButton?: boolean;
+  hideVSCodeDesktopButton?: boolean;
+  serverVersion: string;
+  onUpdateAgent: () => void;
+  storybookLogs?: LineWithID[];
+  storybookAgentMetadata?: WorkspaceAgentMetadata[];
 }
 
 export const AgentRow: FC<AgentRowProps> = ({
   agent,
   workspace,
   showApps,
+  showBuiltinApps = true,
   hideSSHButton,
   hideVSCodeDesktopButton,
   serverVersion,
   onUpdateAgent,
-  storybookLogs,
   storybookAgentMetadata,
   sshPrefix,
+  storybookLogs,
 }) => {
-  const styles = useStyles()
-  const [logsMachine, sendLogsEvent] = useMachine(workspaceAgentLogsMachine, {
-    context: { agentID: agent.id },
-    services: process.env.STORYBOOK
-      ? {
-          getLogs: async () => {
-            return storybookLogs || []
-          },
-          streamLogs: () => async () => {
-            // noop
-          },
-        }
-      : undefined,
-  })
-  const theme = useTheme()
-  const startupScriptAnchorRef = useRef<HTMLButtonElement>(null)
-  const [startupScriptOpen, setStartupScriptOpen] = useState(false)
-  const hasAppsToDisplay = !hideVSCodeDesktopButton || agent.apps.length > 0
+  const styles = useStyles();
+  const hasAppsToDisplay = !hideVSCodeDesktopButton || agent.apps.length > 0;
   const shouldDisplayApps =
     showApps &&
     ((agent.status === "connected" && hasAppsToDisplay) ||
-      agent.status === "connecting")
-  const hasStartupFeatures =
-    Boolean(agent.logs_length) || Boolean(logsMachine.context.logs?.length)
-  const { proxy } = useProxy()
-
+      agent.status === "connecting");
+  const logSourceByID = useMemo(() => {
+    const sources: { [id: string]: WorkspaceAgentLogSource } = {};
+    for (const source of agent.log_sources) {
+      sources[source.id] = source;
+    }
+    return sources;
+  }, [agent.log_sources]);
+  const hasStartupFeatures = Boolean(agent.logs_length);
+  const { proxy } = useProxy();
   const [showLogs, setShowLogs] = useState(
     ["starting", "start_timeout"].includes(agent.lifecycle_state) &&
       hasStartupFeatures,
-  )
-  useEffect(() => {
-    setShowLogs(agent.lifecycle_state !== "ready" && hasStartupFeatures)
-  }, [agent.lifecycle_state, hasStartupFeatures])
-  // External applications can provide startup logs for an agent during it's spawn.
-  // These could be Kubernetes logs, or other logs that are useful to the user.
-  // For this reason, we want to fetch these logs when the agent is starting.
-  useEffect(() => {
-    if (agent.lifecycle_state === "starting") {
-      sendLogsEvent("FETCH_LOGS")
-    }
-  }, [sendLogsEvent, agent.lifecycle_state])
-  useEffect(() => {
-    // We only want to fetch logs when they are actually shown,
-    // otherwise we can make a lot of requests that aren't necessary.
-    if (showLogs && logsMachine.can("FETCH_LOGS")) {
-      sendLogsEvent("FETCH_LOGS")
-    }
-  }, [logsMachine, sendLogsEvent, showLogs])
-  const logListRef = useRef<List>(null)
-  const logListDivRef = useRef<HTMLDivElement>(null)
+  );
+  const agentLogs = useAgentLogs(agent.id, {
+    enabled: showLogs,
+    initialData: process.env.STORYBOOK ? storybookLogs || [] : undefined,
+  });
+  const logListRef = useRef<List>(null);
+  const logListDivRef = useRef<HTMLDivElement>(null);
   const startupLogs = useMemo(() => {
-    const allLogs = logsMachine.context.logs || []
+    const allLogs = agentLogs || [];
 
-    const logs = [...allLogs]
+    const logs = [...allLogs];
     if (agent.logs_overflowed) {
       logs.push({
         id: -1,
         level: "error",
         output: "Startup logs exceeded the max size of 1MB!",
         time: new Date().toISOString(),
-      })
+        source_id: "",
+      });
     }
-    return logs
-  }, [logsMachine.context.logs, agent.logs_overflowed])
-  const [bottomOfLogs, setBottomOfLogs] = useState(true)
+    return logs;
+  }, [agentLogs, agent.logs_overflowed]);
+  const [bottomOfLogs, setBottomOfLogs] = useState(true);
+
+  useEffect(() => {
+    setShowLogs(agent.lifecycle_state !== "ready" && hasStartupFeatures);
+  }, [agent.lifecycle_state, hasStartupFeatures]);
+
   // This is a layout effect to remove flicker when we're scrolling to the bottom.
   useLayoutEffect(() => {
     // If we're currently watching the bottom, we always want to stay at the bottom.
     if (bottomOfLogs && logListRef.current) {
-      logListRef.current.scrollToItem(startupLogs.length - 1, "end")
+      logListRef.current.scrollToItem(startupLogs.length - 1, "end");
     }
-  }, [showLogs, startupLogs, logListRef, bottomOfLogs])
+  }, [showLogs, startupLogs, logListRef, bottomOfLogs]);
 
   // This is a bit of a hack on the react-window API to get the scroll position.
   // If we're scrolled to the bottom, we want to keep the list scrolled to the bottom.
@@ -153,20 +139,20 @@ export const AgentRow: FC<AgentRowProps> = ({
         props.scrollUpdateWasRequested ||
         !logListDivRef.current
       ) {
-        return
+        return;
       }
       // The parent holds the height of the list!
-      const parent = logListDivRef.current.parentElement
+      const parent = logListDivRef.current.parentElement;
       if (!parent) {
-        return
+        return;
       }
       const distanceFromBottom =
         logListDivRef.current.scrollHeight -
-        (props.scrollOffset + parent.clientHeight)
-      setBottomOfLogs(distanceFromBottom < logLineHeight)
+        (props.scrollOffset + parent.clientHeight);
+      setBottomOfLogs(distanceFromBottom < logLineHeight);
     },
     [logListDivRef],
-  )
+  );
 
   return (
     <Stack
@@ -217,14 +203,17 @@ export const AgentRow: FC<AgentRowProps> = ({
           <div className={styles.agentButtons}>
             {shouldDisplayApps && (
               <>
-                {!hideVSCodeDesktopButton && (
-                  <VSCodeDesktopButton
-                    userName={workspace.owner_name}
-                    workspaceName={workspace.name}
-                    agentName={agent.name}
-                    folderPath={agent.expanded_directory}
-                  />
-                )}
+                {(agent.display_apps.includes("vscode") ||
+                  agent.display_apps.includes("vscode_insiders")) &&
+                  !hideVSCodeDesktopButton && (
+                    <VSCodeDesktopButton
+                      userName={workspace.owner_name}
+                      workspaceName={workspace.name}
+                      agentName={agent.name}
+                      folderPath={agent.expanded_directory}
+                      displayApps={agent.display_apps}
+                    />
+                  )}
                 {agent.apps.map((app) => (
                   <AppLink
                     key={app.slug}
@@ -236,28 +225,35 @@ export const AgentRow: FC<AgentRowProps> = ({
               </>
             )}
 
-            <TerminalLink
-              workspaceName={workspace.name}
-              agentName={agent.name}
-              userName={workspace.owner_name}
-            />
-            {!hideSSHButton && (
-              <SSHButton
-                workspaceName={workspace.name}
-                agentName={agent.name}
-                sshPrefix={sshPrefix}
-              />
+            {showBuiltinApps && (
+              <>
+                {agent.display_apps.includes("web_terminal") && (
+                  <TerminalLink
+                    workspaceName={workspace.name}
+                    agentName={agent.name}
+                    userName={workspace.owner_name}
+                  />
+                )}
+                {!hideSSHButton &&
+                  agent.display_apps.includes("ssh_helper") && (
+                    <SSHButton
+                      workspaceName={workspace.name}
+                      agentName={agent.name}
+                      sshPrefix={sshPrefix}
+                    />
+                  )}
+                {proxy.preferredWildcardHostname &&
+                  proxy.preferredWildcardHostname !== "" &&
+                  agent.display_apps.includes("port_forwarding_helper") && (
+                    <PortForwardButton
+                      host={proxy.preferredWildcardHostname}
+                      workspaceName={workspace.name}
+                      agent={agent}
+                      username={workspace.owner_name}
+                    />
+                  )}
+              </>
             )}
-            {proxy.preferredWildcardHostname &&
-              proxy.preferredWildcardHostname !== "" && (
-                <PortForwardButton
-                  host={proxy.preferredWildcardHostname}
-                  workspaceName={workspace.name}
-                  agentId={agent.id}
-                  agentName={agent.name}
-                  username={workspace.owner_name}
-                />
-              )}
           </div>
         )}
 
@@ -296,13 +292,138 @@ export const AgentRow: FC<AgentRowProps> = ({
                   className={styles.startupLogs}
                   onScroll={handleLogScroll}
                 >
-                  {({ index, style }) => (
-                    <LogLine
-                      line={startupLogs[index]}
-                      number={index + 1}
-                      style={style}
-                    />
-                  )}
+                  {({ index, style }) => {
+                    const log = startupLogs[index];
+                    // getLogSource always returns a valid log source.
+                    // This is necessary to support deployments before `coder_script`.
+                    // Existed that haven't restarted their agents.
+                    const getLogSource = (
+                      id: string,
+                    ): WorkspaceAgentLogSource => {
+                      return (
+                        logSourceByID[id] || {
+                          created_at: "",
+                          display_name: "Logs",
+                          icon: "",
+                          id: "00000000-0000-0000-0000-000000000000",
+                          workspace_agent_id: "",
+                        }
+                      );
+                    };
+                    const logSource = getLogSource(log.source_id);
+
+                    let assignedIcon = false;
+                    let icon: JSX.Element;
+                    // If no icon is specified, we show a deterministic
+                    // colored circle to identify unique scripts.
+                    if (logSource.icon) {
+                      icon = (
+                        <img
+                          src={logSource.icon}
+                          alt=""
+                          width={16}
+                          height={16}
+                          style={{
+                            marginRight: 8,
+                          }}
+                        />
+                      );
+                    } else {
+                      icon = (
+                        <div
+                          style={{
+                            width: 16,
+                            height: 16,
+                            marginRight: 8,
+                            background: determineScriptDisplayColor(
+                              logSource.display_name,
+                            ),
+                            borderRadius: "100%",
+                          }}
+                        />
+                      );
+                      assignedIcon = true;
+                    }
+
+                    let nextChangesSource = false;
+                    if (index < startupLogs.length - 1) {
+                      nextChangesSource =
+                        getLogSource(startupLogs[index + 1].source_id).id !==
+                        log.source_id;
+                    }
+                    // We don't want every line to repeat the icon, because
+                    // that is ugly and repetitive. This removes the icon
+                    // for subsequent lines of the same source and shows a
+                    // line instead, visually indicating they are from the
+                    // same source.
+                    if (
+                      index > 0 &&
+                      getLogSource(startupLogs[index - 1].source_id).id ===
+                        log.source_id
+                    ) {
+                      icon = (
+                        <div
+                          style={{
+                            minWidth: 16,
+                            width: 16,
+                            height: 16,
+                            marginRight: 8,
+                            display: "flex",
+                            justifyContent: "center",
+                            position: "relative",
+                          }}
+                        >
+                          <div
+                            style={{
+                              height: nextChangesSource ? "50%" : "100%",
+                              width: 4,
+                              background: "hsl(222, 31%, 25%)",
+                              borderRadius: 2,
+                            }}
+                          />
+                          {nextChangesSource && (
+                            <div
+                              style={{
+                                height: 4,
+                                width: "50%",
+                                top: "calc(50% - 2px)",
+                                left: "calc(50% - 1px)",
+                                background: "hsl(222, 31%, 25%)",
+                                borderRadius: 2,
+                                position: "absolute",
+                              }}
+                            />
+                          )}
+                        </div>
+                      );
+                    }
+
+                    return (
+                      <LogLine
+                        line={startupLogs[index]}
+                        number={index + 1}
+                        maxNumber={startupLogs.length}
+                        style={style}
+                        sourceIcon={
+                          <Tooltip
+                            title={
+                              <>
+                                {logSource.display_name}
+                                {assignedIcon && (
+                                  <i>
+                                    <br />
+                                    No icon specified!
+                                  </i>
+                                )}
+                              </>
+                            }
+                          >
+                            {icon}
+                          </Tooltip>
+                        }
+                      />
+                    );
+                  }}
                 </List>
               )}
             </AutoSizer>
@@ -316,11 +437,11 @@ export const AgentRow: FC<AgentRowProps> = ({
                   styles.toggleLogsButton,
                 ])}
                 onClick={() => {
-                  setShowLogs((v) => !v)
+                  setShowLogs((v) => !v);
                 }}
               >
-                <CloseDropdown />
-                Hide startup logs
+                <DropdownArrow close />
+                Hide logs
               </button>
             ) : (
               <button
@@ -329,60 +450,66 @@ export const AgentRow: FC<AgentRowProps> = ({
                   styles.toggleLogsButton,
                 ])}
                 onClick={() => {
-                  setShowLogs((v) => !v)
+                  setShowLogs((v) => !v);
                 }}
               >
-                <OpenDropdown />
-                Show startup logs
+                <DropdownArrow />
+                Show logs
               </button>
             )}
-
-            <button
-              className={combineClasses([
-                styles.logsPanelButton,
-                styles.scriptButton,
-              ])}
-              ref={startupScriptAnchorRef}
-              onClick={() => {
-                setStartupScriptOpen(!startupScriptOpen)
-              }}
-            >
-              <CodeOutlined />
-              Startup script
-            </button>
-
-            <Popover
-              classes={{
-                paper: styles.startupScriptPopover,
-              }}
-              open={startupScriptOpen}
-              onClose={() => setStartupScriptOpen(false)}
-              anchorEl={startupScriptAnchorRef.current}
-            >
-              <div>
-                <SyntaxHighlighter
-                  style={darcula}
-                  language="shell"
-                  showLineNumbers
-                  // Use inline styles does not work correctly
-                  // https://github.com/react-syntax-highlighter/react-syntax-highlighter/issues/329
-                  codeTagProps={{ style: {} }}
-                  customStyle={{
-                    background: theme.palette.background.default,
-                    maxWidth: 600,
-                    margin: 0,
-                  }}
-                >
-                  {agent.startup_script || ""}
-                </SyntaxHighlighter>
-              </div>
-            </Popover>
           </div>
         </div>
       )}
     </Stack>
-  )
-}
+  );
+};
+
+const useAgentLogs = (
+  agentId: string,
+  { enabled, initialData }: { enabled: boolean; initialData?: LineWithID[] },
+) => {
+  const [logs, setLogs] = useState<LineWithID[] | undefined>(initialData);
+  const socket = useRef<WebSocket | null>(null);
+
+  useEffect(() => {
+    if (!enabled) {
+      socket.current?.close();
+      setLogs([]);
+      return;
+    }
+
+    socket.current = API.watchWorkspaceAgentLogs(agentId, {
+      // Get all logs
+      after: 0,
+      onMessage: (logs) => {
+        setLogs((previousLogs) => {
+          const newLogs: LineWithID[] = logs.map((log) => ({
+            id: log.id,
+            level: log.level || "info",
+            output: log.output,
+            time: log.created_at,
+            source_id: log.source_id,
+          }));
+
+          if (!previousLogs) {
+            return newLogs;
+          }
+
+          return [...previousLogs, ...newLogs];
+        });
+      },
+      onError: () => {
+        displayError("Error on getting agent logs");
+      },
+    });
+
+    return () => {
+      socket.current?.close();
+    };
+  }, [agentId, enabled]);
+
+  return logs;
+};
 
 const useStyles = makeStyles((theme) => ({
   agentRow: {
@@ -498,10 +625,6 @@ const useStyles = makeStyles((theme) => ({
     },
   },
 
-  startupScriptPopover: {
-    backgroundColor: theme.palette.background.default,
-  },
-
   agentNameAndStatus: {
     display: "flex",
     alignItems: "center",
@@ -590,14 +713,30 @@ const useStyles = makeStyles((theme) => ({
     color: theme.palette.warning.light,
   },
 
-  scriptButton: {
-    "& svg": {
-      width: theme.spacing(2),
-      height: theme.spacing(2),
-    },
-  },
-
   agentOS: {
     textTransform: "capitalize",
   },
-}))
+}));
+
+// These colors were picked at random. Feel free
+// to add more, adjust, or change! Users will not
+// depend on these colors.
+const scriptDisplayColors = [
+  "#85A3B2",
+  "#A37EB2",
+  "#C29FDE",
+  "#90B3D7",
+  "#829AC7",
+  "#728B8E",
+  "#506080",
+  "#5654B0",
+  "#6B56D6",
+  "#7847CC",
+];
+
+const determineScriptDisplayColor = (displayName: string): string => {
+  const hash = displayName.split("").reduce((hash, char) => {
+    return (hash << 5) + hash + char.charCodeAt(0); // bit-shift and add for our simple hash
+  }, 0);
+  return scriptDisplayColors[Math.abs(hash) % scriptDisplayColors.length];
+};
diff --git a/site/src/components/Resources/AgentRowPreview.stories.tsx b/site/src/components/Resources/AgentRowPreview.stories.tsx
index 76ec878eea1c4..c14b43865ef98 100644
--- a/site/src/components/Resources/AgentRowPreview.stories.tsx
+++ b/site/src/components/Resources/AgentRowPreview.stories.tsx
@@ -1,44 +1,43 @@
-import { Story } from "@storybook/react"
-import { MockWorkspaceAgent, MockWorkspaceApp } from "testHelpers/entities"
-import { AgentRowPreview, AgentRowPreviewProps } from "./AgentRowPreview"
+import { MockWorkspaceAgent, MockWorkspaceApp } from "testHelpers/entities";
+import { AgentRowPreview } from "./AgentRowPreview";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
+const meta: Meta<typeof AgentRowPreview> = {
   title: "components/AgentRowPreview",
   component: AgentRowPreview,
-}
+  args: {
+    agent: MockWorkspaceAgent,
+  },
+};
 
-const Template: Story<AgentRowPreviewProps> = (args) => (
-  <AgentRowPreview {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof AgentRowPreview>;
 
-export const Example = Template.bind({})
-Example.args = {
-  agent: MockWorkspaceAgent,
-}
+export const Example: Story = {};
 
-export const BunchOfApps = Template.bind({})
-BunchOfApps.args = {
-  ...Example.args,
-  agent: {
-    ...MockWorkspaceAgent,
-    apps: [
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-      MockWorkspaceApp,
-    ],
+export const BunchOfApps: Story = {
+  args: {
+    agent: {
+      ...MockWorkspaceAgent,
+      apps: [
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+        MockWorkspaceApp,
+      ],
+    },
   },
-}
+};
 
-export const NoApps = Template.bind({})
-NoApps.args = {
-  ...Example.args,
-  agent: {
-    ...MockWorkspaceAgent,
-    apps: [],
+export const NoApps: Story = {
+  args: {
+    agent: {
+      ...MockWorkspaceAgent,
+      apps: [],
+    },
   },
-}
+};
diff --git a/site/src/components/Resources/AgentRowPreview.tsx b/site/src/components/Resources/AgentRowPreview.tsx
index 9f7926fb42357..755eebe73324c 100644
--- a/site/src/components/Resources/AgentRowPreview.tsx
+++ b/site/src/components/Resources/AgentRowPreview.tsx
@@ -1,27 +1,24 @@
-import { makeStyles } from "@mui/styles"
-import { AppPreviewLink } from "components/AppLink/AppPreviewLink"
-import { Maybe } from "components/Conditionals/Maybe"
-import { FC } from "react"
-import { useTranslation } from "react-i18next"
-import { combineClasses } from "utils/combineClasses"
-import { WorkspaceAgent } from "../../api/typesGenerated"
-import { Stack } from "../Stack/Stack"
+import { makeStyles } from "@mui/styles";
+import { AppPreviewLink } from "components/Resources/AppLink/AppPreviewLink";
+import { FC } from "react";
+import { combineClasses } from "utils/combineClasses";
+import { WorkspaceAgent } from "api/typesGenerated";
+import { Stack } from "../Stack/Stack";
 
 interface AgentRowPreviewStyles {
   // Helpful when there are more than one row so the values are aligned
   // When it is only one row, it is better to have than "flex" and not hard aligned
-  alignValues?: boolean
+  alignValues?: boolean;
 }
 export interface AgentRowPreviewProps extends AgentRowPreviewStyles {
-  agent: WorkspaceAgent
+  agent: WorkspaceAgent;
 }
 
 export const AgentRowPreview: FC<AgentRowPreviewProps> = ({
   agent,
   alignValues,
 }) => {
-  const styles = useStyles({ alignValues })
-  const { t } = useTranslation("agent")
+  const styles = useStyles({ alignValues });
 
   return (
     <Stack
@@ -51,7 +48,7 @@ export const AgentRowPreview: FC<AgentRowPreviewProps> = ({
               styles.agentDataName,
             ])}
           >
-            <span>{t("labels.agent").toString()}:</span>
+            <span>Agent:</span>
             <span className={styles.agentDataValue}>{agent.name}</span>
           </Stack>
 
@@ -65,7 +62,7 @@ export const AgentRowPreview: FC<AgentRowPreviewProps> = ({
               styles.agentDataOS,
             ])}
           >
-            <span>{t("labels.os").toString()}:</span>
+            <span>OS:</span>
             <span
               className={combineClasses([
                 styles.agentDataValue,
@@ -82,7 +79,7 @@ export const AgentRowPreview: FC<AgentRowPreviewProps> = ({
             spacing={1}
             className={styles.agentDataItem}
           >
-            <span>{t("labels.apps").toString()}:</span>
+            <span>Apps:</span>
             <Stack
               direction="row"
               alignItems="center"
@@ -92,18 +89,16 @@ export const AgentRowPreview: FC<AgentRowPreviewProps> = ({
               {agent.apps.map((app) => (
                 <AppPreviewLink key={app.slug} app={app} />
               ))}
-              <Maybe condition={agent.apps.length === 0}>
-                <span className={styles.agentDataValue}>
-                  {t("labels.noApps")}
-                </span>
-              </Maybe>
+              {agent.apps.length === 0 && (
+                <span className={styles.agentDataValue}>None</span>
+              )}
             </Stack>
           </Stack>
         </Stack>
       </Stack>
     </Stack>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   agentRow: {
@@ -194,4 +189,4 @@ const useStyles = makeStyles((theme) => ({
       width: "fit-content",
     },
   },
-}))
+}));
diff --git a/site/src/components/Resources/AgentStatus.tsx b/site/src/components/Resources/AgentStatus.tsx
index 7a8b80a3a57f1..c8179249d1ac5 100644
--- a/site/src/components/Resources/AgentStatus.tsx
+++ b/site/src/components/Resources/AgentStatus.tsx
@@ -1,17 +1,16 @@
-import Tooltip from "@mui/material/Tooltip"
-import { makeStyles } from "@mui/styles"
-import { combineClasses } from "utils/combineClasses"
-import { WorkspaceAgent } from "api/typesGenerated"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { useTranslation } from "react-i18next"
-import WarningRounded from "@mui/icons-material/WarningRounded"
+import Tooltip from "@mui/material/Tooltip";
+import { makeStyles } from "@mui/styles";
+import { combineClasses } from "utils/combineClasses";
+import { WorkspaceAgent } from "api/typesGenerated";
+import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
+import WarningRounded from "@mui/icons-material/WarningRounded";
 import {
   HelpPopover,
   HelpTooltipText,
   HelpTooltipTitle,
-} from "components/Tooltips/HelpTooltip"
-import { useRef, useState } from "react"
-import Link from "@mui/material/Link"
+} from "components/HelpTooltip/HelpTooltip";
+import { useRef, useState } from "react";
+import Link from "@mui/material/Link";
 
 // If we think in the agent status and lifecycle into a single enum/state I’d
 // say we would have: connecting, timeout, disconnected, connected:created,
@@ -20,21 +19,20 @@ import Link from "@mui/material/Link"
 // connected:shutdown_error, connected:off.
 
 const ReadyLifecycle = () => {
-  const styles = useStyles()
-  const { t } = useTranslation("workspacePage")
+  const styles = useStyles();
 
   return (
     <div
       role="status"
       data-testid="agent-status-ready"
-      aria-label={t("agentStatus.connected.ready") || "Ready"}
+      aria-label="Ready"
       className={combineClasses([styles.status, styles.connected])}
     />
-  )
-}
+  );
+};
 
 const StartingLifecycle: React.FC = () => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <Tooltip title="Starting...">
@@ -44,17 +42,16 @@ const StartingLifecycle: React.FC = () => {
         className={combineClasses([styles.status, styles.connecting])}
       />
     </Tooltip>
-  )
-}
+  );
+};
 
 const StartTimeoutLifecycle: React.FC<{
-  agent: WorkspaceAgent
+  agent: WorkspaceAgent;
 }> = ({ agent }) => {
-  const { t } = useTranslation("agent")
-  const styles = useStyles()
-  const anchorRef = useRef<SVGSVGElement>(null)
-  const [isOpen, setIsOpen] = useState(false)
-  const id = isOpen ? "timeout-popover" : undefined
+  const styles = useStyles();
+  const anchorRef = useRef<SVGSVGElement>(null);
+  const [isOpen, setIsOpen] = useState(false);
+  const id = isOpen ? "timeout-popover" : undefined;
 
   return (
     <>
@@ -63,7 +60,7 @@ const StartTimeoutLifecycle: React.FC<{
         onMouseEnter={() => setIsOpen(true)}
         onMouseLeave={() => setIsOpen(false)}
         role="status"
-        aria-label={t("status.startTimeout")}
+        aria-label="Start timeout"
         className={styles.timeoutWarning}
       />
       <HelpPopover
@@ -73,31 +70,30 @@ const StartTimeoutLifecycle: React.FC<{
         onOpen={() => setIsOpen(true)}
         onClose={() => setIsOpen(false)}
       >
-        <HelpTooltipTitle>{t("startTimeoutTooltip.title")}</HelpTooltipTitle>
+        <HelpTooltipTitle>Agent is taking too long to start</HelpTooltipTitle>
         <HelpTooltipText>
-          {t("startTimeoutTooltip.message")}{" "}
+          We noticed this agent is taking longer than expected to start.{" "}
           <Link
             target="_blank"
             rel="noreferrer"
             href={agent.troubleshooting_url}
           >
-            {t("startTimeoutTooltip.link")}
+            Troubleshoot
           </Link>
           .
         </HelpTooltipText>
       </HelpPopover>
     </>
-  )
-}
+  );
+};
 
 const StartErrorLifecycle: React.FC<{
-  agent: WorkspaceAgent
+  agent: WorkspaceAgent;
 }> = ({ agent }) => {
-  const { t } = useTranslation("agent")
-  const styles = useStyles()
-  const anchorRef = useRef<SVGSVGElement>(null)
-  const [isOpen, setIsOpen] = useState(false)
-  const id = isOpen ? "timeout-popover" : undefined
+  const styles = useStyles();
+  const anchorRef = useRef<SVGSVGElement>(null);
+  const [isOpen, setIsOpen] = useState(false);
+  const id = isOpen ? "timeout-popover" : undefined;
 
   return (
     <>
@@ -106,7 +102,7 @@ const StartErrorLifecycle: React.FC<{
         onMouseEnter={() => setIsOpen(true)}
         onMouseLeave={() => setIsOpen(false)}
         role="status"
-        aria-label={t("status.error")}
+        aria-label="Start error"
         className={styles.errorWarning}
       />
       <HelpPopover
@@ -116,25 +112,25 @@ const StartErrorLifecycle: React.FC<{
         onOpen={() => setIsOpen(true)}
         onClose={() => setIsOpen(false)}
       >
-        <HelpTooltipTitle>{t("startErrorTooltip.title")}</HelpTooltipTitle>
+        <HelpTooltipTitle>Error starting the agent</HelpTooltipTitle>
         <HelpTooltipText>
-          {t("startErrorTooltip.message")}{" "}
+          Something went wrong during the agent startup.{" "}
           <Link
             target="_blank"
             rel="noreferrer"
             href={agent.troubleshooting_url}
           >
-            {t("startErrorTooltip.link")}
+            Troubleshoot
           </Link>
           .
         </HelpTooltipText>
       </HelpPopover>
     </>
-  )
-}
+  );
+};
 
 const ShuttingDownLifecycle: React.FC = () => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <Tooltip title="Stopping...">
@@ -144,17 +140,16 @@ const ShuttingDownLifecycle: React.FC = () => {
         className={combineClasses([styles.status, styles.connecting])}
       />
     </Tooltip>
-  )
-}
+  );
+};
 
 const ShutdownTimeoutLifecycle: React.FC<{
-  agent: WorkspaceAgent
+  agent: WorkspaceAgent;
 }> = ({ agent }) => {
-  const { t } = useTranslation("agent")
-  const styles = useStyles()
-  const anchorRef = useRef<SVGSVGElement>(null)
-  const [isOpen, setIsOpen] = useState(false)
-  const id = isOpen ? "timeout-popover" : undefined
+  const styles = useStyles();
+  const anchorRef = useRef<SVGSVGElement>(null);
+  const [isOpen, setIsOpen] = useState(false);
+  const id = isOpen ? "timeout-popover" : undefined;
 
   return (
     <>
@@ -163,7 +158,7 @@ const ShutdownTimeoutLifecycle: React.FC<{
         onMouseEnter={() => setIsOpen(true)}
         onMouseLeave={() => setIsOpen(false)}
         role="status"
-        aria-label={t("status.shutdownTimeout")}
+        aria-label="Stop timeout"
         className={styles.timeoutWarning}
       />
       <HelpPopover
@@ -173,31 +168,30 @@ const ShutdownTimeoutLifecycle: React.FC<{
         onOpen={() => setIsOpen(true)}
         onClose={() => setIsOpen(false)}
       >
-        <HelpTooltipTitle>{t("shutdownTimeoutTooltip.title")}</HelpTooltipTitle>
+        <HelpTooltipTitle>Agent is taking too long to stop</HelpTooltipTitle>
         <HelpTooltipText>
-          {t("shutdownTimeoutTooltip.message")}{" "}
+          We noticed this agent is taking longer than expected to stop.{" "}
           <Link
             target="_blank"
             rel="noreferrer"
             href={agent.troubleshooting_url}
           >
-            {t("shutdownTimeoutTooltip.link")}
+            Troubleshoot
           </Link>
           .
         </HelpTooltipText>
       </HelpPopover>
     </>
-  )
-}
+  );
+};
 
 const ShutdownErrorLifecycle: React.FC<{
-  agent: WorkspaceAgent
+  agent: WorkspaceAgent;
 }> = ({ agent }) => {
-  const { t } = useTranslation("agent")
-  const styles = useStyles()
-  const anchorRef = useRef<SVGSVGElement>(null)
-  const [isOpen, setIsOpen] = useState(false)
-  const id = isOpen ? "timeout-popover" : undefined
+  const styles = useStyles();
+  const anchorRef = useRef<SVGSVGElement>(null);
+  const [isOpen, setIsOpen] = useState(false);
+  const id = isOpen ? "timeout-popover" : undefined;
 
   return (
     <>
@@ -206,7 +200,7 @@ const ShutdownErrorLifecycle: React.FC<{
         onMouseEnter={() => setIsOpen(true)}
         onMouseLeave={() => setIsOpen(false)}
         role="status"
-        aria-label={t("status.error")}
+        aria-label="Stop error"
         className={styles.errorWarning}
       />
       <HelpPopover
@@ -216,25 +210,25 @@ const ShutdownErrorLifecycle: React.FC<{
         onOpen={() => setIsOpen(true)}
         onClose={() => setIsOpen(false)}
       >
-        <HelpTooltipTitle>{t("shutdownErrorTooltip.title")}</HelpTooltipTitle>
+        <HelpTooltipTitle>Error stopping the agent</HelpTooltipTitle>
         <HelpTooltipText>
-          {t("shutdownErrorTooltip.message")}{" "}
+          Something went wrong while trying to stop the agent.{" "}
           <Link
             target="_blank"
             rel="noreferrer"
             href={agent.troubleshooting_url}
           >
-            {t("shutdownErrorTooltip.link")}
+            Troubleshoot
           </Link>
           .
         </HelpTooltipText>
       </HelpPopover>
     </>
-  )
-}
+  );
+};
 
 const OffLifecycle: React.FC = () => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <Tooltip title="Stopped">
@@ -244,49 +238,49 @@ const OffLifecycle: React.FC = () => {
         className={combineClasses([styles.status, styles.disconnected])}
       />
     </Tooltip>
-  )
-}
+  );
+};
 
 const ConnectedStatus: React.FC<{
-  agent: WorkspaceAgent
+  agent: WorkspaceAgent;
 }> = ({ agent }) => {
-  switch (agent.startup_script_behavior) {
-    case "non-blocking":
-      return <ReadyLifecycle />
-    case "blocking":
-      return (
-        <ChooseOne>
-          <Cond condition={agent.lifecycle_state === "ready"}>
-            <ReadyLifecycle />
-          </Cond>
-          <Cond condition={agent.lifecycle_state === "start_timeout"}>
-            <StartTimeoutLifecycle agent={agent} />
-          </Cond>
-          <Cond condition={agent.lifecycle_state === "start_error"}>
-            <StartErrorLifecycle agent={agent} />
-          </Cond>
-          <Cond condition={agent.lifecycle_state === "shutting_down"}>
-            <ShuttingDownLifecycle />
-          </Cond>
-          <Cond condition={agent.lifecycle_state === "shutdown_timeout"}>
-            <ShutdownTimeoutLifecycle agent={agent} />
-          </Cond>
-          <Cond condition={agent.lifecycle_state === "shutdown_error"}>
-            <ShutdownErrorLifecycle agent={agent} />
-          </Cond>
-          <Cond condition={agent.lifecycle_state === "off"}>
-            <OffLifecycle />
-          </Cond>
-          <Cond>
-            <StartingLifecycle />
-          </Cond>
-        </ChooseOne>
-      )
+  // This is to support legacy agents that do not support
+  // reporting the lifecycle_state field.
+  if (agent.scripts.length === 0) {
+    return <ReadyLifecycle />;
   }
-}
+  return (
+    <ChooseOne>
+      <Cond condition={agent.lifecycle_state === "ready"}>
+        <ReadyLifecycle />
+      </Cond>
+      <Cond condition={agent.lifecycle_state === "start_timeout"}>
+        <StartTimeoutLifecycle agent={agent} />
+      </Cond>
+      <Cond condition={agent.lifecycle_state === "start_error"}>
+        <StartErrorLifecycle agent={agent} />
+      </Cond>
+      <Cond condition={agent.lifecycle_state === "shutting_down"}>
+        <ShuttingDownLifecycle />
+      </Cond>
+      <Cond condition={agent.lifecycle_state === "shutdown_timeout"}>
+        <ShutdownTimeoutLifecycle agent={agent} />
+      </Cond>
+      <Cond condition={agent.lifecycle_state === "shutdown_error"}>
+        <ShutdownErrorLifecycle agent={agent} />
+      </Cond>
+      <Cond condition={agent.lifecycle_state === "off"}>
+        <OffLifecycle />
+      </Cond>
+      <Cond>
+        <StartingLifecycle />
+      </Cond>
+    </ChooseOne>
+  );
+};
 
 const DisconnectedStatus: React.FC = () => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <Tooltip title="Disconnected">
@@ -296,11 +290,11 @@ const DisconnectedStatus: React.FC = () => {
         className={combineClasses([styles.status, styles.disconnected])}
       />
     </Tooltip>
-  )
-}
+  );
+};
 
 const ConnectingStatus: React.FC = () => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <Tooltip title="Connecting...">
@@ -310,17 +304,16 @@ const ConnectingStatus: React.FC = () => {
         className={combineClasses([styles.status, styles.connecting])}
       />
     </Tooltip>
-  )
-}
+  );
+};
 
 const TimeoutStatus: React.FC<{
-  agent: WorkspaceAgent
+  agent: WorkspaceAgent;
 }> = ({ agent }) => {
-  const { t } = useTranslation("agent")
-  const styles = useStyles()
-  const anchorRef = useRef<SVGSVGElement>(null)
-  const [isOpen, setIsOpen] = useState(false)
-  const id = isOpen ? "timeout-popover" : undefined
+  const styles = useStyles();
+  const anchorRef = useRef<SVGSVGElement>(null);
+  const [isOpen, setIsOpen] = useState(false);
+  const id = isOpen ? "timeout-popover" : undefined;
 
   return (
     <>
@@ -329,7 +322,7 @@ const TimeoutStatus: React.FC<{
         onMouseEnter={() => setIsOpen(true)}
         onMouseLeave={() => setIsOpen(false)}
         role="status"
-        aria-label={t("status.timeout")}
+        aria-label="Timeout"
         className={styles.timeoutWarning}
       />
       <HelpPopover
@@ -339,25 +332,25 @@ const TimeoutStatus: React.FC<{
         onOpen={() => setIsOpen(true)}
         onClose={() => setIsOpen(false)}
       >
-        <HelpTooltipTitle>{t("timeoutTooltip.title")}</HelpTooltipTitle>
+        <HelpTooltipTitle>Agent is taking too long to connect</HelpTooltipTitle>
         <HelpTooltipText>
-          {t("timeoutTooltip.message")}{" "}
+          We noticed this agent is taking longer than expected to connect.{" "}
           <Link
             target="_blank"
             rel="noreferrer"
             href={agent.troubleshooting_url}
           >
-            {t("timeoutTooltip.link")}
+            Troubleshoot
           </Link>
           .
         </HelpTooltipText>
       </HelpPopover>
     </>
-  )
-}
+  );
+};
 
 export const AgentStatus: React.FC<{
-  agent: WorkspaceAgent
+  agent: WorkspaceAgent;
 }> = ({ agent }) => {
   return (
     <ChooseOne>
@@ -374,8 +367,8 @@ export const AgentStatus: React.FC<{
         <ConnectingStatus />
       </Cond>
     </ChooseOne>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   status: {
@@ -424,4 +417,4 @@ const useStyles = makeStyles((theme) => ({
     height: theme.spacing(2),
     position: "relative",
   },
-}))
+}));
diff --git a/site/src/components/Resources/AgentVersion.tsx b/site/src/components/Resources/AgentVersion.tsx
index c6caff69a93d3..98b358a92a4e1 100644
--- a/site/src/components/Resources/AgentVersion.tsx
+++ b/site/src/components/Resources/AgentVersion.tsx
@@ -1,22 +1,20 @@
-import { useRef, useState, FC } from "react"
-import { makeStyles } from "@mui/styles"
-import { WorkspaceAgent } from "api/typesGenerated"
-import { getDisplayVersionStatus } from "utils/workspace"
-import { AgentOutdatedTooltip } from "components/Tooltips/AgentOutdatedTooltip"
+import { type FC, useRef, useState } from "react";
+import type { WorkspaceAgent } from "api/typesGenerated";
+import { getDisplayVersionStatus } from "utils/workspace";
+import { AgentOutdatedTooltip } from "./AgentOutdatedTooltip";
 
 export const AgentVersion: FC<{
-  agent: WorkspaceAgent
-  serverVersion: string
-  onUpdate: () => void
+  agent: WorkspaceAgent;
+  serverVersion: string;
+  onUpdate: () => void;
 }> = ({ agent, serverVersion, onUpdate }) => {
-  const styles = useStyles()
-  const anchorRef = useRef<HTMLButtonElement>(null)
-  const [isOpen, setIsOpen] = useState(false)
-  const id = isOpen ? "version-outdated-popover" : undefined
-  const { outdated } = getDisplayVersionStatus(agent.version, serverVersion)
+  const anchorRef = useRef<HTMLButtonElement>(null);
+  const [isOpen, setIsOpen] = useState(false);
+  const id = isOpen ? "version-outdated-popover" : undefined;
+  const { outdated } = getDisplayVersionStatus(agent.version, serverVersion);
 
   if (!outdated) {
-    return <span>Updated</span>
+    return <span>Updated</span>;
   }
 
   return (
@@ -27,7 +25,7 @@ export const AgentVersion: FC<{
         ref={anchorRef}
         onMouseEnter={() => setIsOpen(true)}
         onMouseLeave={() => setIsOpen(false)}
-        className={styles.trigger}
+        css={{ cursor: "pointer" }}
       >
         Outdated
       </span>
@@ -42,11 +40,5 @@ export const AgentVersion: FC<{
         onUpdate={onUpdate}
       />
     </>
-  )
-}
-
-const useStyles = makeStyles(() => ({
-  trigger: {
-    cursor: "pointer",
-  },
-}))
+  );
+};
diff --git a/site/src/components/Resources/AppLink/AppLink.stories.tsx b/site/src/components/Resources/AppLink/AppLink.stories.tsx
new file mode 100644
index 0000000000000..4e71c244b5e63
--- /dev/null
+++ b/site/src/components/Resources/AppLink/AppLink.stories.tsx
@@ -0,0 +1,153 @@
+import {
+  MockPrimaryWorkspaceProxy,
+  MockWorkspaceProxies,
+  MockWorkspace,
+  MockWorkspaceAgent,
+  MockWorkspaceApp,
+  MockProxyLatencies,
+} from "testHelpers/entities";
+import { AppLink } from "./AppLink";
+import { ProxyContext, getPreferredProxy } from "contexts/ProxyContext";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof AppLink> = {
+  title: "components/AppLink",
+  component: AppLink,
+  decorators: [
+    (Story) => (
+      <ProxyContext.Provider
+        value={{
+          proxyLatencies: MockProxyLatencies,
+          proxy: {
+            ...getPreferredProxy(
+              MockWorkspaceProxies,
+              MockPrimaryWorkspaceProxy,
+            ),
+            preferredWildcardHostname: "*.super_proxy.tld",
+          },
+          proxies: MockWorkspaceProxies,
+          isLoading: false,
+          isFetched: true,
+          setProxy: () => {
+            return;
+          },
+          clearProxy: () => {
+            return;
+          },
+          refetchProxyLatencies: (): Date => {
+            return new Date();
+          },
+        }}
+      >
+        <Story />
+      </ProxyContext.Provider>
+    ),
+  ],
+};
+
+export default meta;
+type Story = StoryObj<typeof AppLink>;
+
+export const WithIcon: Story = {
+  args: {
+    workspace: MockWorkspace,
+    app: {
+      ...MockWorkspaceApp,
+      icon: "/icon/code.svg",
+      sharing_level: "owner",
+      health: "healthy",
+    },
+    agent: MockWorkspaceAgent,
+  },
+};
+
+export const ExternalApp: Story = {
+  args: {
+    workspace: MockWorkspace,
+    app: {
+      ...MockWorkspaceApp,
+      external: true,
+    },
+    agent: MockWorkspaceAgent,
+  },
+};
+
+export const SharingLevelOwner: Story = {
+  args: {
+    workspace: MockWorkspace,
+    app: {
+      ...MockWorkspaceApp,
+      sharing_level: "owner",
+    },
+    agent: MockWorkspaceAgent,
+  },
+};
+
+export const SharingLevelAuthenticated: Story = {
+  args: {
+    workspace: MockWorkspace,
+    app: {
+      ...MockWorkspaceApp,
+      sharing_level: "authenticated",
+    },
+    agent: MockWorkspaceAgent,
+  },
+};
+
+export const SharingLevelPublic: Story = {
+  args: {
+    workspace: MockWorkspace,
+    app: {
+      ...MockWorkspaceApp,
+      sharing_level: "public",
+    },
+    agent: MockWorkspaceAgent,
+  },
+};
+
+export const HealthDisabled: Story = {
+  args: {
+    workspace: MockWorkspace,
+    app: {
+      ...MockWorkspaceApp,
+      sharing_level: "owner",
+      health: "disabled",
+    },
+    agent: MockWorkspaceAgent,
+  },
+};
+
+export const HealthInitializing: Story = {
+  args: {
+    workspace: MockWorkspace,
+    app: {
+      ...MockWorkspaceApp,
+      health: "initializing",
+    },
+    agent: MockWorkspaceAgent,
+  },
+};
+
+export const HealthUnhealthy: Story = {
+  args: {
+    workspace: MockWorkspace,
+    app: {
+      ...MockWorkspaceApp,
+      health: "unhealthy",
+    },
+    agent: MockWorkspaceAgent,
+  },
+};
+
+export const InternalApp: Story = {
+  args: {
+    workspace: MockWorkspace,
+    app: {
+      ...MockWorkspaceApp,
+      display_name: "Check my URL",
+      subdomain: true,
+      subdomain_name: "slug--agent_name--workspace_name--username",
+    },
+    agent: MockWorkspaceAgent,
+  },
+};
diff --git a/site/src/components/Resources/AppLink/AppLink.tsx b/site/src/components/Resources/AppLink/AppLink.tsx
new file mode 100644
index 0000000000000..c8d177a4c8df8
--- /dev/null
+++ b/site/src/components/Resources/AppLink/AppLink.tsx
@@ -0,0 +1,159 @@
+import CircularProgress from "@mui/material/CircularProgress";
+import Link from "@mui/material/Link";
+import Tooltip from "@mui/material/Tooltip";
+import ErrorOutlineIcon from "@mui/icons-material/ErrorOutline";
+import { type FC, useState } from "react";
+import { useTheme } from "@emotion/react";
+import { getApiKey } from "api/api";
+import type * as TypesGen from "api/typesGenerated";
+import { useProxy } from "contexts/ProxyContext";
+import { PrimaryAgentButton } from "components/Resources/AgentButton";
+import { createAppLinkHref } from "utils/apps";
+import { generateRandomString } from "utils/random";
+import { BaseIcon } from "./BaseIcon";
+import { ShareIcon } from "./ShareIcon";
+
+const Language = {
+  appTitle: (appName: string, identifier: string): string =>
+    `${appName} - ${identifier}`,
+};
+
+export interface AppLinkProps {
+  workspace: TypesGen.Workspace;
+  app: TypesGen.WorkspaceApp;
+  agent: TypesGen.WorkspaceAgent;
+}
+
+export const AppLink: FC<AppLinkProps> = ({ app, workspace, agent }) => {
+  const { proxy } = useProxy();
+  const preferredPathBase = proxy.preferredPathAppURL;
+  const appsHost = proxy.preferredWildcardHostname;
+  const [fetchingSessionToken, setFetchingSessionToken] = useState(false);
+
+  const theme = useTheme();
+  const username = workspace.owner_name;
+
+  let appSlug = app.slug;
+  let appDisplayName = app.display_name;
+  if (!appSlug) {
+    appSlug = appDisplayName;
+  }
+  if (!appDisplayName) {
+    appDisplayName = appSlug;
+  }
+
+  const href = createAppLinkHref(
+    window.location.protocol,
+    preferredPathBase,
+    appsHost,
+    appSlug,
+    username,
+    workspace,
+    agent,
+    app,
+  );
+
+  let canClick = true;
+  let icon = <BaseIcon app={app} />;
+
+  let primaryTooltip = "";
+  if (app.health === "initializing") {
+    canClick = false;
+    icon = <CircularProgress size={12} />;
+    primaryTooltip = "Initializing...";
+  }
+  if (app.health === "unhealthy") {
+    canClick = false;
+    icon = <ErrorOutlineIcon css={{ color: theme.palette.warning.light }} />;
+    primaryTooltip = "Unhealthy";
+  }
+  if (!appsHost && app.subdomain) {
+    canClick = false;
+    icon = (
+      <ErrorOutlineIcon
+        css={{
+          color: theme.palette.grey[300],
+        }}
+      />
+    );
+    primaryTooltip =
+      "Your admin has not configured subdomain application access";
+  }
+  if (fetchingSessionToken) {
+    canClick = false;
+  }
+
+  const isPrivateApp = app.sharing_level === "owner";
+
+  const button = (
+    <PrimaryAgentButton
+      startIcon={icon}
+      endIcon={isPrivateApp ? undefined : <ShareIcon app={app} />}
+      disabled={!canClick}
+    >
+      <span
+        css={
+          !isPrivateApp && {
+            marginRight: theme.spacing(1),
+          }
+        }
+      >
+        {appDisplayName}
+      </span>
+    </PrimaryAgentButton>
+  );
+
+  return (
+    <Tooltip title={primaryTooltip}>
+      <span>
+        <Link
+          href={href}
+          target="_blank"
+          css={{
+            pointerEvents: canClick ? undefined : "none",
+            textDecoration: "none !important",
+          }}
+          onClick={
+            canClick
+              ? async (event) => {
+                  event.preventDefault();
+                  // This is an external URI like "vscode://", so
+                  // it needs to be opened with the browser protocol handler.
+                  if (app.external && !app.url.startsWith("http")) {
+                    // If the protocol is external the browser does not
+                    // redirect the user from the page.
+
+                    // This is a magic undocumented string that is replaced
+                    // with a brand-new session token from the backend.
+                    // This only exists for external URLs, and should only
+                    // be used internally, and is highly subject to break.
+                    const magicTokenString = "$SESSION_TOKEN";
+                    const hasMagicToken = href.indexOf(magicTokenString);
+                    let url = href;
+                    if (hasMagicToken !== -1) {
+                      setFetchingSessionToken(true);
+                      const key = await getApiKey();
+                      url = href.replaceAll(magicTokenString, key.key);
+                      setFetchingSessionToken(false);
+                    }
+                    window.location.href = url;
+                  } else {
+                    window.open(
+                      href,
+                      Language.appTitle(
+                        appDisplayName,
+                        generateRandomString(12),
+                      ),
+                      "width=900,height=600",
+                    );
+                  }
+                }
+              : undefined
+          }
+        >
+          {button}
+        </Link>
+      </span>
+    </Tooltip>
+  );
+};
diff --git a/site/src/components/Resources/AppLink/AppPreviewLink.tsx b/site/src/components/Resources/AppLink/AppPreviewLink.tsx
new file mode 100644
index 0000000000000..a2a729b7797d8
--- /dev/null
+++ b/site/src/components/Resources/AppLink/AppPreviewLink.tsx
@@ -0,0 +1,44 @@
+import { makeStyles } from "@mui/styles";
+import { Stack } from "components/Stack/Stack";
+import { FC } from "react";
+import * as TypesGen from "api/typesGenerated";
+import { BaseIcon } from "./BaseIcon";
+import { ShareIcon } from "./ShareIcon";
+
+interface AppPreviewProps {
+  app: TypesGen.WorkspaceApp;
+}
+
+export const AppPreviewLink: FC<AppPreviewProps> = ({ app }) => {
+  const styles = useStyles();
+
+  return (
+    <Stack
+      className={styles.appPreviewLink}
+      alignItems="center"
+      direction="row"
+      spacing={1}
+    >
+      <BaseIcon app={app} />
+      {app.display_name}
+      <ShareIcon app={app} />
+    </Stack>
+  );
+};
+
+const useStyles = makeStyles((theme) => ({
+  appPreviewLink: {
+    padding: theme.spacing(0.25, 1.5),
+    borderRadius: 9999,
+    border: `1px solid ${theme.palette.divider}`,
+    color: theme.palette.text.primary,
+    background: theme.palette.background.paper,
+    flexShrink: 0,
+    width: "fit-content",
+    fontSize: 12,
+
+    "& img, & svg": {
+      width: 13,
+    },
+  },
+}));
diff --git a/site/src/components/Resources/AppLink/BaseIcon.tsx b/site/src/components/Resources/AppLink/BaseIcon.tsx
new file mode 100644
index 0000000000000..72409249189ba
--- /dev/null
+++ b/site/src/components/Resources/AppLink/BaseIcon.tsx
@@ -0,0 +1,17 @@
+import { WorkspaceApp } from "api/typesGenerated";
+import { FC } from "react";
+import ComputerIcon from "@mui/icons-material/Computer";
+
+export const BaseIcon: FC<{ app: WorkspaceApp }> = ({ app }) => {
+  return app.icon ? (
+    <img
+      alt={`${app.display_name} Icon`}
+      src={app.icon}
+      style={{
+        pointerEvents: "none",
+      }}
+    />
+  ) : (
+    <ComputerIcon />
+  );
+};
diff --git a/site/src/components/Resources/AppLink/ShareIcon.tsx b/site/src/components/Resources/AppLink/ShareIcon.tsx
new file mode 100644
index 0000000000000..478509fa0932e
--- /dev/null
+++ b/site/src/components/Resources/AppLink/ShareIcon.tsx
@@ -0,0 +1,35 @@
+import PublicOutlinedIcon from "@mui/icons-material/PublicOutlined";
+import GroupOutlinedIcon from "@mui/icons-material/GroupOutlined";
+import LaunchOutlinedIcon from "@mui/icons-material/LaunchOutlined";
+import * as TypesGen from "api/typesGenerated";
+import Tooltip from "@mui/material/Tooltip";
+
+export interface ShareIconProps {
+  app: TypesGen.WorkspaceApp;
+}
+
+export const ShareIcon = ({ app }: ShareIconProps) => {
+  if (app.external) {
+    return (
+      <Tooltip title="Open external URL">
+        <LaunchOutlinedIcon />
+      </Tooltip>
+    );
+  }
+  if (app.sharing_level === "authenticated") {
+    return (
+      <Tooltip title="Shared with all authenticated users">
+        <GroupOutlinedIcon />
+      </Tooltip>
+    );
+  }
+  if (app.sharing_level === "public") {
+    return (
+      <Tooltip title="Shared publicly">
+        <PublicOutlinedIcon />
+      </Tooltip>
+    );
+  }
+
+  return null;
+};
diff --git a/site/src/components/Resources/PortForwardButton.stories.tsx b/site/src/components/Resources/PortForwardButton.stories.tsx
new file mode 100644
index 0000000000000..b77c5275d2730
--- /dev/null
+++ b/site/src/components/Resources/PortForwardButton.stories.tsx
@@ -0,0 +1,44 @@
+import Box from "@mui/material/Box";
+import { PortForwardPopoverView } from "./PortForwardButton";
+import type { Meta, StoryObj } from "@storybook/react";
+import {
+  MockListeningPortsResponse,
+  MockWorkspaceAgent,
+} from "testHelpers/entities";
+
+const meta: Meta<typeof PortForwardPopoverView> = {
+  title: "components/PortForwardPopoverView",
+  component: PortForwardPopoverView,
+  decorators: [
+    (Story) => (
+      <Box
+        sx={{
+          width: (theme) => theme.spacing(38),
+          border: (theme) => `1px solid ${theme.palette.divider}`,
+          borderRadius: 1,
+          backgroundColor: (theme) => theme.palette.background.paper,
+        }}
+      >
+        <Story />
+      </Box>
+    ),
+  ],
+  args: {
+    agent: MockWorkspaceAgent,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof PortForwardPopoverView>;
+
+export const WithPorts: Story = {
+  args: {
+    ports: MockListeningPortsResponse.ports,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    ports: [],
+  },
+};
diff --git a/site/src/components/Resources/PortForwardButton.tsx b/site/src/components/Resources/PortForwardButton.tsx
new file mode 100644
index 0000000000000..83f54aeebb73b
--- /dev/null
+++ b/site/src/components/Resources/PortForwardButton.tsx
@@ -0,0 +1,236 @@
+import Box from "@mui/material/Box";
+import Link from "@mui/material/Link";
+import CircularProgress from "@mui/material/CircularProgress";
+import OpenInNewOutlined from "@mui/icons-material/OpenInNewOutlined";
+import { css } from "@emotion/css";
+import { useTheme } from "@emotion/react";
+import { useQuery } from "react-query";
+import { colors } from "theme/colors";
+import {
+  HelpTooltipLink,
+  HelpTooltipLinksGroup,
+  HelpTooltipText,
+  HelpTooltipTitle,
+} from "components/HelpTooltip/HelpTooltip";
+import { SecondaryAgentButton } from "components/Resources/AgentButton";
+import { docs } from "utils/docs";
+import { getAgentListeningPorts } from "api/api";
+import type {
+  WorkspaceAgent,
+  WorkspaceAgentListeningPort,
+} from "api/typesGenerated";
+import { portForwardURL } from "utils/portForward";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "components/Popover/Popover";
+
+export interface PortForwardButtonProps {
+  host: string;
+  username: string;
+  workspaceName: string;
+  agent: WorkspaceAgent;
+}
+
+export const PortForwardButton: React.FC<PortForwardButtonProps> = (props) => {
+  const theme = useTheme();
+  const portsQuery = useQuery({
+    queryKey: ["portForward", props.agent.id],
+    queryFn: () => getAgentListeningPorts(props.agent.id),
+    enabled: props.agent.status === "connected",
+    refetchInterval: 5_000,
+  });
+
+  return (
+    <Popover>
+      <PopoverTrigger>
+        <SecondaryAgentButton disabled={!portsQuery.data}>
+          Ports
+          {portsQuery.data ? (
+            <Box
+              sx={{
+                fontSize: 12,
+                fontWeight: 500,
+                height: 20,
+                minWidth: 20,
+                padding: (theme) => theme.spacing(0, 0.5),
+                borderRadius: "50%",
+                display: "flex",
+                alignItems: "center",
+                justifyContent: "center",
+                backgroundColor: colors.gray[11],
+                ml: 1,
+              }}
+            >
+              {portsQuery.data.ports.length}
+            </Box>
+          ) : (
+            <CircularProgress size={10} sx={{ ml: 1 }} />
+          )}
+        </SecondaryAgentButton>
+      </PopoverTrigger>
+      <PopoverContent
+        horizontal="right"
+        classes={{
+          paper: css`
+            padding: 0;
+            width: ${theme.spacing(38)};
+            color: ${theme.palette.text.secondary};
+            margin-top: ${theme.spacing(0.5)};
+          `,
+        }}
+      >
+        <PortForwardPopoverView {...props} ports={portsQuery.data?.ports} />
+      </PopoverContent>
+    </Popover>
+  );
+};
+
+export const PortForwardPopoverView: React.FC<
+  PortForwardButtonProps & { ports?: WorkspaceAgentListeningPort[] }
+> = (props) => {
+  const { host, workspaceName, agent, username, ports } = props;
+
+  return (
+    <>
+      <Box
+        sx={{
+          padding: (theme) => theme.spacing(2.5),
+          borderBottom: (theme) => `1px solid ${theme.palette.divider}`,
+        }}
+      >
+        <HelpTooltipTitle>Forwarded ports</HelpTooltipTitle>
+        <HelpTooltipText
+          sx={{ color: (theme) => theme.palette.text.secondary }}
+        >
+          {ports?.length === 0
+            ? "No open ports were detected."
+            : "The forwarded ports are exclusively accessible to you."}
+        </HelpTooltipText>
+        <Box sx={{ marginTop: (theme) => theme.spacing(1.5) }}>
+          {ports?.map((p) => {
+            const url = portForwardURL(
+              host,
+              p.port,
+              agent.name,
+              workspaceName,
+              username,
+            );
+            const label = p.process_name !== "" ? p.process_name : p.port;
+            return (
+              <Link
+                underline="none"
+                sx={{
+                  color: (theme) => theme.palette.text.primary,
+                  fontSize: 14,
+                  display: "flex",
+                  alignItems: "center",
+                  gap: 1,
+                  py: 0.5,
+                  fontWeight: 500,
+                }}
+                key={p.port}
+                href={url}
+                target="_blank"
+                rel="noreferrer"
+              >
+                <OpenInNewOutlined sx={{ width: 14, height: 14 }} />
+                {label}
+                <Box
+                  component="span"
+                  sx={{
+                    ml: "auto",
+                    color: (theme) => theme.palette.text.secondary,
+                    fontSize: 13,
+                    fontWeight: 400,
+                  }}
+                >
+                  {p.port}
+                </Box>
+              </Link>
+            );
+          })}
+        </Box>
+      </Box>
+
+      <Box
+        sx={{
+          padding: (theme) => theme.spacing(2.5),
+        }}
+      >
+        <HelpTooltipTitle>Forward port</HelpTooltipTitle>
+        <HelpTooltipText
+          sx={{ color: (theme) => theme.palette.text.secondary }}
+        >
+          Access ports running on the agent:
+        </HelpTooltipText>
+
+        <Box
+          component="form"
+          sx={{
+            border: (theme) => `1px solid ${theme.palette.divider}`,
+            borderRadius: "4px",
+            mt: 2,
+            display: "flex",
+            alignItems: "center",
+            "&:focus-within": {
+              borderColor: (theme) => theme.palette.primary.main,
+            },
+          }}
+          onSubmit={(e) => {
+            e.preventDefault();
+            const formData = new FormData(e.currentTarget);
+            const port = Number(formData.get("portNumber"));
+            const url = portForwardURL(
+              host,
+              port,
+              agent.name,
+              workspaceName,
+              username,
+            );
+            window.open(url, "_blank");
+          }}
+        >
+          <Box
+            aria-label="Port number"
+            name="portNumber"
+            component="input"
+            type="number"
+            placeholder="Type a port number..."
+            min={0}
+            max={65535}
+            required
+            sx={{
+              fontSize: 14,
+              height: 34,
+              p: (theme) => theme.spacing(0, 1.5),
+              background: "none",
+              border: 0,
+              outline: "none",
+              color: (theme) => theme.palette.text.primary,
+              appearance: "textfield",
+              display: "block",
+              width: "100%",
+            }}
+          />
+          <OpenInNewOutlined
+            sx={{
+              flexShrink: 0,
+              width: 14,
+              height: 14,
+              marginRight: (theme) => theme.spacing(1.5),
+              color: (theme) => theme.palette.text.primary,
+            }}
+          />
+        </Box>
+
+        <HelpTooltipLinksGroup>
+          <HelpTooltipLink href={docs("/networking/port-forwarding#dashboard")}>
+            Learn more
+          </HelpTooltipLink>
+        </HelpTooltipLinksGroup>
+      </Box>
+    </>
+  );
+};
diff --git a/site/src/components/Resources/ResourceAvatar.stories.tsx b/site/src/components/Resources/ResourceAvatar.stories.tsx
index 3f9d9c2e8e77c..75af47063c532 100644
--- a/site/src/components/Resources/ResourceAvatar.stories.tsx
+++ b/site/src/components/Resources/ResourceAvatar.stories.tsx
@@ -1,61 +1,66 @@
-import { Story } from "@storybook/react"
-import { MockWorkspaceResource } from "testHelpers/entities"
-import { ResourceAvatar, ResourceAvatarProps } from "./ResourceAvatar"
+import { MockWorkspaceResource } from "testHelpers/entities";
+import { ResourceAvatar } from "./ResourceAvatar";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
+const meta: Meta<typeof ResourceAvatar> = {
   title: "components/ResourceAvatar",
   component: ResourceAvatar,
-}
+};
 
-const Template: Story<ResourceAvatarProps> = (args) => (
-  <ResourceAvatar {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof ResourceAvatar>;
 
-export const VolumeResource = Template.bind({})
-VolumeResource.args = {
-  resource: {
-    ...MockWorkspaceResource,
-    type: "docker_volume",
+export const VolumeResource: Story = {
+  args: {
+    resource: {
+      ...MockWorkspaceResource,
+      type: "docker_volume",
+    },
   },
-}
+};
 
-export const ComputeResource = Template.bind({})
-ComputeResource.args = {
-  resource: {
-    ...MockWorkspaceResource,
-    type: "docker_container",
+export const ComputeResource: Story = {
+  args: {
+    resource: {
+      ...MockWorkspaceResource,
+      type: "docker_container",
+    },
   },
-}
+};
 
-export const ImageResource = Template.bind({})
-ImageResource.args = {
-  resource: {
-    ...MockWorkspaceResource,
-    type: "docker_image",
+export const ImageResource: Story = {
+  args: {
+    resource: {
+      ...MockWorkspaceResource,
+      type: "docker_image",
+    },
   },
-}
+};
 
-export const NullResource = Template.bind({})
-NullResource.args = {
-  resource: {
-    ...MockWorkspaceResource,
-    type: "null_resource",
+export const NullResource: Story = {
+  args: {
+    resource: {
+      ...MockWorkspaceResource,
+      type: "null_resource",
+    },
   },
-}
+};
 
-export const UnknownResource = Template.bind({})
-UnknownResource.args = {
-  resource: {
-    ...MockWorkspaceResource,
-    type: "noexistentvalue",
+export const UnknownResource: Story = {
+  args: {
+    resource: {
+      ...MockWorkspaceResource,
+      type: "noexistentvalue",
+    },
   },
-}
-
-export const EmptyIcon = Template.bind({})
-EmptyIcon.args = {
-  resource: {
-    ...MockWorkspaceResource,
-    type: "helm_release",
-    icon: "",
+};
+
+export const EmptyIcon: Story = {
+  args: {
+    resource: {
+      ...MockWorkspaceResource,
+      type: "helm_release",
+      icon: "",
+    },
   },
-}
+};
diff --git a/site/src/components/Resources/ResourceAvatar.tsx b/site/src/components/Resources/ResourceAvatar.tsx
index 96c2b05f733d1..35aa96987518f 100644
--- a/site/src/components/Resources/ResourceAvatar.tsx
+++ b/site/src/components/Resources/ResourceAvatar.tsx
@@ -1,14 +1,14 @@
-import { Avatar, AvatarIcon } from "components/Avatar/Avatar"
-import { FC } from "react"
-import { WorkspaceResource } from "../../api/typesGenerated"
+import { Avatar, AvatarIcon } from "components/Avatar/Avatar";
+import { FC } from "react";
+import { WorkspaceResource } from "api/typesGenerated";
 
-const FALLBACK_ICON = "/icon/widgets.svg"
+const FALLBACK_ICON = "/icon/widgets.svg";
 
 // These resources (i.e. docker_image, kubernetes_deployment) map to Terraform
 // resource types. These are the most used ones and are based on user usage.
 // We may want to update from time-to-time.
 const BUILT_IN_ICON_PATHS: {
-  [resourceType: WorkspaceResource["type"]]: string
+  [resourceType: WorkspaceResource["type"]]: string;
 } = {
   docker_volume: "/icon/folder.svg",
   docker_container: "/icon/memory.svg",
@@ -20,25 +20,27 @@ const BUILT_IN_ICON_PATHS: {
   aws_instance: "/icon/memory.svg",
   kubernetes_deployment: "/icon/memory.svg",
   null_resource: FALLBACK_ICON,
-}
+};
 
 const getIconPathResource = (resourceType: string): string => {
   if (resourceType in BUILT_IN_ICON_PATHS) {
-    return BUILT_IN_ICON_PATHS[resourceType]
+    return BUILT_IN_ICON_PATHS[resourceType];
   }
 
-  return FALLBACK_ICON
-}
+  return FALLBACK_ICON;
+};
 
-export type ResourceAvatarProps = { resource: WorkspaceResource }
+export type ResourceAvatarProps = { resource: WorkspaceResource };
 
 export const ResourceAvatar: FC<ResourceAvatarProps> = ({ resource }) => {
-  const hasIcon = resource.icon && resource.icon !== ""
-  const avatarSrc = hasIcon ? resource.icon : getIconPathResource(resource.type)
+  const hasIcon = resource.icon && resource.icon !== "";
+  const avatarSrc = hasIcon
+    ? resource.icon
+    : getIconPathResource(resource.type);
 
   return (
     <Avatar colorScheme="darken">
       <AvatarIcon src={avatarSrc} />
     </Avatar>
-  )
-}
+  );
+};
diff --git a/site/src/components/Resources/ResourceCard.stories.tsx b/site/src/components/Resources/ResourceCard.stories.tsx
index 4b8a33c90e128..2759ab4bd5230 100644
--- a/site/src/components/Resources/ResourceCard.stories.tsx
+++ b/site/src/components/Resources/ResourceCard.stories.tsx
@@ -1,98 +1,80 @@
-import { action } from "@storybook/addon-actions"
-import { Story } from "@storybook/react"
+import { action } from "@storybook/addon-actions";
 import {
   MockProxyLatencies,
   MockWorkspace,
   MockWorkspaceResource,
-} from "testHelpers/entities"
-import { AgentRow } from "./AgentRow"
-import { ResourceCard, ResourceCardProps } from "./ResourceCard"
-import { ProxyContext, getPreferredProxy } from "contexts/ProxyContext"
+} from "testHelpers/entities";
+import { AgentRow } from "./AgentRow";
+import { ResourceCard } from "./ResourceCard";
+import { ProxyContext, getPreferredProxy } from "contexts/ProxyContext";
+import type { Meta, StoryObj } from "@storybook/react";
+import { type WorkspaceAgent } from "api/typesGenerated";
 
-export default {
-  title: "components/ResourceCard",
+const meta: Meta<typeof ResourceCard> = {
+  title: "components/Resources/ResourceCard",
   component: ResourceCard,
-}
+  args: {
+    resource: MockWorkspaceResource,
+    agentRow: getAgentRow,
+  },
+};
 
-const Template: Story<ResourceCardProps> = (args) => <ResourceCard {...args} />
+export default meta;
+type Story = StoryObj<typeof ResourceCard>;
 
-export const Example = Template.bind({})
-Example.args = {
-  resource: MockWorkspaceResource,
-  agentRow: (agent) => (
-    <ProxyContext.Provider
-      value={{
-        proxyLatencies: MockProxyLatencies,
-        proxy: getPreferredProxy([], undefined),
-        proxies: [],
-        isLoading: false,
-        isFetched: true,
-        setProxy: () => {
-          return
+export const Example: Story = {};
+
+export const BunchOfMetadata: Story = {
+  args: {
+    resource: {
+      ...MockWorkspaceResource,
+      metadata: [
+        {
+          key: "CPU(limits, requests)",
+          value: "2 cores, 500m",
+          sensitive: false,
         },
-        clearProxy: () => {
-          return
+        {
+          key: "container image pull policy",
+          value: "Always",
+          sensitive: false,
         },
-        refetchProxyLatencies: (): Date => {
-          return new Date()
+        { key: "Disk", value: "10GiB", sensitive: false },
+        {
+          key: "image",
+          value: "docker.io/markmilligan/pycharm-community:latest",
+          sensitive: false,
         },
-      }}
-    >
-      <AgentRow
-        showApps
-        key={agent.id}
-        agent={agent}
-        workspace={MockWorkspace}
-        serverVersion=""
-        onUpdateAgent={action("updateAgent")}
-      />
-    </ProxyContext.Provider>
-  ),
-}
-
-export const BunchOfMetadata = Template.bind({})
-BunchOfMetadata.args = {
-  ...Example.args,
-  resource: {
-    ...MockWorkspaceResource,
-    metadata: [
-      {
-        key: "CPU(limits, requests)",
-        value: "2 cores, 500m",
-        sensitive: false,
-      },
-      { key: "container image pull policy", value: "Always", sensitive: false },
-      { key: "Disk", value: "10GiB", sensitive: false },
-      {
-        key: "image",
-        value: "docker.io/markmilligan/pycharm-community:latest",
-        sensitive: false,
-      },
-      { key: "kubernetes namespace", value: "oss", sensitive: false },
-      {
-        key: "memory(limits, requests)",
-        value: "4GB, 500mi",
-        sensitive: false,
-      },
-      {
-        key: "security context - container",
-        value: "run_as_user 1000",
-        sensitive: false,
-      },
-      {
-        key: "security context - pod",
-        value: "run_as_user 1000 fs_group 1000",
-        sensitive: false,
-      },
-      { key: "volume", value: "/home/coder", sensitive: false },
-      {
-        key: "secret",
-        value: "3XqfNW0b1bvsGsqud8O6OW6VabH3fwzI",
-        sensitive: true,
-      },
-    ],
+        { key: "kubernetes namespace", value: "oss", sensitive: false },
+        {
+          key: "memory(limits, requests)",
+          value: "4GB, 500mi",
+          sensitive: false,
+        },
+        {
+          key: "security context - container",
+          value: "run_as_user 1000",
+          sensitive: false,
+        },
+        {
+          key: "security context - pod",
+          value: "run_as_user 1000 fs_group 1000",
+          sensitive: false,
+        },
+        { key: "volume", value: "/home/coder", sensitive: false },
+        {
+          key: "secret",
+          value: "3XqfNW0b1bvsGsqud8O6OW6VabH3fwzI",
+          sensitive: true,
+        },
+      ],
+    },
+    agentRow: getAgentRow,
   },
-  agentRow: (agent) => (
+};
+
+function getAgentRow(agent: WorkspaceAgent): JSX.Element {
+  return (
     <ProxyContext.Provider
       value={{
         proxyLatencies: MockProxyLatencies,
@@ -101,13 +83,13 @@ BunchOfMetadata.args = {
         isLoading: false,
         isFetched: true,
         setProxy: () => {
-          return
+          return;
         },
         clearProxy: () => {
-          return
+          return;
         },
         refetchProxyLatencies: (): Date => {
-          return new Date()
+          return new Date();
         },
       }}
     >
@@ -120,5 +102,5 @@ BunchOfMetadata.args = {
         onUpdateAgent={action("updateAgent")}
       />
     </ProxyContext.Provider>
-  ),
+  );
 }
diff --git a/site/src/components/Resources/ResourceCard.tsx b/site/src/components/Resources/ResourceCard.tsx
index f951cb0a4d2be..f5c0779d68a29 100644
--- a/site/src/components/Resources/ResourceCard.tsx
+++ b/site/src/components/Resources/ResourceCard.tsx
@@ -1,116 +1,16 @@
-import { makeStyles } from "@mui/styles"
-import { FC, useState } from "react"
-import { WorkspaceAgent, WorkspaceResource } from "../../api/typesGenerated"
-import { Stack } from "../Stack/Stack"
-import { ResourceAvatar } from "./ResourceAvatar"
-import { SensitiveValue } from "./SensitiveValue"
-import {
-  OpenDropdown,
-  CloseDropdown,
-} from "components/DropdownArrows/DropdownArrows"
-import IconButton from "@mui/material/IconButton"
-import Tooltip from "@mui/material/Tooltip"
-import { Maybe } from "components/Conditionals/Maybe"
-import { CopyableValue } from "components/CopyableValue/CopyableValue"
-
-export interface ResourceCardProps {
-  resource: WorkspaceResource
-  agentRow: (agent: WorkspaceAgent) => JSX.Element
-}
-
-export const ResourceCard: FC<ResourceCardProps> = ({ resource, agentRow }) => {
-  const [shouldDisplayAllMetadata, setShouldDisplayAllMetadata] =
-    useState(false)
-  const styles = useStyles()
-  const metadataToDisplay = resource.metadata ?? []
-  const visibleMetadata = shouldDisplayAllMetadata
-    ? metadataToDisplay
-    : metadataToDisplay.slice(0, 4)
-
-  return (
-    <div key={resource.id} className={styles.resourceCard}>
-      <Stack
-        direction="row"
-        alignItems="flex-start"
-        className={styles.resourceCardHeader}
-        spacing={10}
-      >
-        <Stack
-          direction="row"
-          alignItems="center"
-          className={styles.resourceCardProfile}
-        >
-          <div>
-            <ResourceAvatar resource={resource} />
-          </div>
-          <div className={styles.metadata}>
-            <div className={styles.metadataLabel}>{resource.type}</div>
-            <div className={styles.metadataValue}>{resource.name}</div>
-          </div>
-        </Stack>
-
-        <Stack alignItems="flex-start" direction="row" spacing={5}>
-          <div className={styles.metadataHeader}>
-            {resource.daily_cost > 0 && (
-              <div className={styles.metadata}>
-                <div className={styles.metadataLabel}>
-                  <b>cost</b>
-                </div>
-                <div className={styles.metadataValue}>
-                  {resource.daily_cost}
-                </div>
-              </div>
-            )}
-            {visibleMetadata.map((meta) => {
-              return (
-                <div className={styles.metadata} key={meta.key}>
-                  <div className={styles.metadataLabel}>{meta.key}</div>
-                  <div className={styles.metadataValue}>
-                    {meta.sensitive ? (
-                      <SensitiveValue value={meta.value} />
-                    ) : (
-                      <CopyableValue value={meta.value}>
-                        {meta.value}
-                      </CopyableValue>
-                    )}
-                  </div>
-                </div>
-              )
-            })}
-          </div>
-
-          <Maybe condition={metadataToDisplay.length > 4}>
-            <Tooltip
-              title={
-                shouldDisplayAllMetadata ? "Hide metadata" : "Show all metadata"
-              }
-            >
-              <IconButton
-                onClick={() => {
-                  setShouldDisplayAllMetadata((value) => !value)
-                }}
-                size="large"
-              >
-                {shouldDisplayAllMetadata ? (
-                  <CloseDropdown margin={false} />
-                ) : (
-                  <OpenDropdown margin={false} />
-                )}
-              </IconButton>
-            </Tooltip>
-          </Maybe>
-        </Stack>
-      </Stack>
-
-      {resource.agents && resource.agents.length > 0 && (
-        <div>{resource.agents.map(agentRow)}</div>
-      )}
-    </div>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  resourceCard: {
+import { type FC, useState } from "react";
+import IconButton from "@mui/material/IconButton";
+import Tooltip from "@mui/material/Tooltip";
+import { type CSSObject, type Interpolation, type Theme } from "@emotion/react";
+import { WorkspaceAgent, WorkspaceResource } from "api/typesGenerated";
+import { DropdownArrow } from "components/DropdownArrow/DropdownArrow";
+import { CopyableValue } from "components/CopyableValue/CopyableValue";
+import { Stack } from "../Stack/Stack";
+import { ResourceAvatar } from "./ResourceAvatar";
+import { SensitiveValue } from "./SensitiveValue";
+
+const styles = {
+  resourceCard: (theme) => ({
     background: theme.palette.background.paper,
     borderRadius: theme.shape.borderRadius,
     border: `1px solid ${theme.palette.divider}`,
@@ -125,46 +25,147 @@ const useStyles = makeStyles((theme) => ({
       borderBottomLeftRadius: 0,
       borderBottomRightRadius: 0,
     },
-  },
+  }),
 
   resourceCardProfile: {
     flexShrink: 0,
     width: "fit-content",
   },
 
-  resourceCardHeader: {
+  resourceCardHeader: (theme) => ({
     padding: theme.spacing(3, 4),
     borderBottom: `1px solid ${theme.palette.divider}`,
 
     "&:last-child": {
       borderBottom: 0,
     },
-  },
 
-  metadataHeader: {
-    display: "grid",
-    gridTemplateColumns: "repeat(4, minmax(0, 1fr))",
-    gap: theme.spacing(5),
-    rowGap: theme.spacing(3),
-  },
+    [theme.breakpoints.down("md")]: {
+      width: "100%",
+      overflow: "scroll",
+    },
+  }),
 
-  metadata: {
-    ...theme.typography.body2,
+  metadata: (theme) => ({
+    ...(theme.typography.body2 as CSSObject),
     lineHeight: "120%",
-  },
+  }),
 
-  metadataLabel: {
+  metadataLabel: (theme) => ({
     fontSize: 12,
     color: theme.palette.text.secondary,
     textOverflow: "ellipsis",
     overflow: "hidden",
     whiteSpace: "nowrap",
-  },
+  }),
 
-  metadataValue: {
+  metadataValue: (theme) => ({
     textOverflow: "ellipsis",
     overflow: "hidden",
     whiteSpace: "nowrap",
-    ...theme.typography.body1,
-  },
-}))
+    ...(theme.typography.body1 as CSSObject),
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
+
+export interface ResourceCardProps {
+  resource: WorkspaceResource;
+  agentRow: (agent: WorkspaceAgent) => JSX.Element;
+}
+
+export const ResourceCard: FC<ResourceCardProps> = ({ resource, agentRow }) => {
+  const [shouldDisplayAllMetadata, setShouldDisplayAllMetadata] =
+    useState(false);
+  const metadataToDisplay = resource.metadata ?? [];
+  const visibleMetadata = shouldDisplayAllMetadata
+    ? metadataToDisplay
+    : metadataToDisplay.slice(0, 4);
+
+  // Add one to `metadataLength` if the resource has a cost, and hide one
+  // additional metadata item, because cost is displayed in the same grid.
+  let metadataLength = resource.metadata?.length ?? 0;
+  if (resource.daily_cost > 0) {
+    metadataLength += 1;
+    visibleMetadata.pop();
+  }
+  const gridWidth = metadataLength === 1 ? 1 : 4;
+
+  return (
+    <div key={resource.id} css={styles.resourceCard} className="resource-card">
+      <Stack
+        direction="row"
+        alignItems="flex-start"
+        css={styles.resourceCardHeader}
+        spacing={10}
+      >
+        <Stack
+          direction="row"
+          alignItems="center"
+          css={styles.resourceCardProfile}
+        >
+          <div>
+            <ResourceAvatar resource={resource} />
+          </div>
+          <div css={styles.metadata}>
+            <div css={styles.metadataLabel}>{resource.type}</div>
+            <div css={styles.metadataValue}>{resource.name}</div>
+          </div>
+        </Stack>
+
+        <div
+          css={(theme) => ({
+            flexGrow: 2,
+            display: "grid",
+            gridTemplateColumns: `repeat(${gridWidth}, minmax(0, 1fr))`,
+            gap: theme.spacing(5),
+            rowGap: theme.spacing(3),
+          })}
+        >
+          {resource.daily_cost > 0 && (
+            <div css={styles.metadata}>
+              <div css={styles.metadataLabel}>
+                <b>cost</b>
+              </div>
+              <div css={styles.metadataValue}>{resource.daily_cost}</div>
+            </div>
+          )}
+          {visibleMetadata.map((meta) => {
+            return (
+              <div css={styles.metadata} key={meta.key}>
+                <div css={styles.metadataLabel}>{meta.key}</div>
+                <div css={styles.metadataValue}>
+                  {meta.sensitive ? (
+                    <SensitiveValue value={meta.value} />
+                  ) : (
+                    <CopyableValue value={meta.value}>
+                      {meta.value}
+                    </CopyableValue>
+                  )}
+                </div>
+              </div>
+            );
+          })}
+        </div>
+        {metadataLength > 4 && (
+          <Tooltip
+            title={
+              shouldDisplayAllMetadata ? "Hide metadata" : "Show all metadata"
+            }
+          >
+            <IconButton
+              onClick={() => {
+                setShouldDisplayAllMetadata((value) => !value);
+              }}
+              size="large"
+            >
+              <DropdownArrow margin={false} close={shouldDisplayAllMetadata} />
+            </IconButton>
+          </Tooltip>
+        )}
+      </Stack>
+
+      {resource.agents && resource.agents.length > 0 && (
+        <div>{resource.agents.map(agentRow)}</div>
+      )}
+    </div>
+  );
+};
diff --git a/site/src/components/Resources/Resources.stories.tsx b/site/src/components/Resources/Resources.stories.tsx
new file mode 100644
index 0000000000000..7e107b79ad315
--- /dev/null
+++ b/site/src/components/Resources/Resources.stories.tsx
@@ -0,0 +1,164 @@
+import { action } from "@storybook/addon-actions";
+import {
+  MockProxyLatencies,
+  MockWorkspace,
+  MockWorkspaceResource,
+  MockWorkspaceResourceMultipleAgents,
+} from "testHelpers/entities";
+import { AgentRow } from "./AgentRow";
+import { Resources } from "./Resources";
+import { ProxyContext, getPreferredProxy } from "contexts/ProxyContext";
+import type { Meta, StoryObj } from "@storybook/react";
+import { type WorkspaceAgent } from "api/typesGenerated";
+
+const meta: Meta<typeof Resources> = {
+  title: "components/Resources/Resources",
+  component: Resources,
+  args: {
+    resources: [MockWorkspaceResource],
+    agentRow: getAgentRow,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof Resources>;
+
+export const Example: Story = {};
+
+export const MultipleAgents: Story = {
+  args: {
+    resources: [MockWorkspaceResourceMultipleAgents],
+  },
+};
+
+const nullDevice = {
+  created_at: "",
+  job_id: "",
+  workspace_transition: "start",
+  type: "null_resource",
+  hide: false,
+  icon: "",
+  daily_cost: 0,
+} as const;
+
+const short = {
+  key: "Short",
+  value: "Hi!",
+  sensitive: false,
+};
+const long = {
+  key: "Long",
+  value: "The quick brown fox jumped over the lazy dog",
+  sensitive: false,
+};
+const reallyLong = {
+  key: "Really long",
+  value:
+    "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.",
+  sensitive: false,
+};
+
+export const BunchOfDevicesWithMetadata: Story = {
+  args: {
+    resources: [
+      MockWorkspaceResource,
+      {
+        ...nullDevice,
+        id: "e8c846da",
+        name: "Short",
+        metadata: [short],
+      },
+      {
+        ...nullDevice,
+        id: "a1b11343",
+        name: "Long",
+        metadata: [long],
+      },
+      {
+        ...nullDevice,
+        id: "09ab7e8c",
+        name: "Really long",
+        metadata: [reallyLong],
+      },
+      {
+        ...nullDevice,
+        id: "0a09fa91",
+        name: "Many short",
+        metadata: Array.from({ length: 8 }, (_, i) => ({
+          ...short,
+          key: `Short ${i}`,
+        })),
+      },
+      {
+        ...nullDevice,
+        id: "d0b9eb9d",
+        name: "Many long",
+        metadata: Array.from({ length: 4 }, (_, i) => ({
+          ...long,
+          key: `Long ${i}`,
+        })),
+      },
+      {
+        ...nullDevice,
+        id: "3af84e31",
+        name: "Many really long",
+        metadata: Array.from({ length: 8 }, (_, i) => ({
+          ...reallyLong,
+          key: `Really long ${i}`,
+        })),
+      },
+      {
+        ...nullDevice,
+        id: "d0b9eb9d",
+        name: "Couple long",
+        metadata: Array.from({ length: 2 }, (_, i) => ({
+          ...long,
+          key: `Long ${i}`,
+        })),
+      },
+      {
+        ...nullDevice,
+        id: "a6c69587",
+        name: "Short and long",
+        metadata: Array.from({ length: 8 }, (_, i) =>
+          i % 2 === 0
+            ? { ...short, key: `Short ${i}` }
+            : { ...long, key: `Long ${i}` },
+        ),
+      },
+    ],
+    agentRow: getAgentRow,
+  },
+};
+
+function getAgentRow(agent: WorkspaceAgent): JSX.Element {
+  return (
+    <ProxyContext.Provider
+      value={{
+        proxyLatencies: MockProxyLatencies,
+        proxy: getPreferredProxy([], undefined),
+        proxies: [],
+        isLoading: false,
+        isFetched: true,
+        setProxy: () => {
+          return;
+        },
+        clearProxy: () => {
+          return;
+        },
+        refetchProxyLatencies: (): Date => {
+          return new Date();
+        },
+      }}
+    >
+      <AgentRow
+        showApps
+        key={agent.id}
+        agent={agent}
+        workspace={MockWorkspace}
+        serverVersion=""
+        onUpdateAgent={action("updateAgent")}
+      />
+    </ProxyContext.Provider>
+  );
+}
diff --git a/site/src/components/Resources/Resources.tsx b/site/src/components/Resources/Resources.tsx
index f965e371a2e20..28152756ab598 100644
--- a/site/src/components/Resources/Resources.tsx
+++ b/site/src/components/Resources/Resources.tsx
@@ -1,37 +1,34 @@
-import Button from "@mui/material/Button"
-import { makeStyles } from "@mui/styles"
-import {
-  CloseDropdown,
-  OpenDropdown,
-} from "components/DropdownArrows/DropdownArrows"
-import { FC, useState } from "react"
-import { WorkspaceAgent, WorkspaceResource } from "../../api/typesGenerated"
-import { Stack } from "../Stack/Stack"
-import { ResourceCard } from "./ResourceCard"
+import Button from "@mui/material/Button";
+import { makeStyles } from "@mui/styles";
+import { DropdownArrow } from "components/DropdownArrow/DropdownArrow";
+import { FC, useState } from "react";
+import { WorkspaceAgent, WorkspaceResource } from "api/typesGenerated";
+import { Stack } from "../Stack/Stack";
+import { ResourceCard } from "./ResourceCard";
 
 const countAgents = (resource: WorkspaceResource) => {
-  return resource.agents ? resource.agents.length : 0
-}
+  return resource.agents ? resource.agents.length : 0;
+};
 
 interface ResourcesProps {
-  resources: WorkspaceResource[]
-  agentRow: (agent: WorkspaceAgent, numberOfAgents: number) => JSX.Element
+  resources: WorkspaceResource[];
+  agentRow: (agent: WorkspaceAgent, numberOfAgents: number) => JSX.Element;
 }
 
 export const Resources: FC<React.PropsWithChildren<ResourcesProps>> = ({
   resources,
   agentRow,
 }) => {
-  const styles = useStyles()
+  const styles = useStyles();
   const [shouldDisplayHideResources, setShouldDisplayHideResources] =
-    useState(false)
+    useState(false);
   const displayResources = shouldDisplayHideResources
     ? resources
     : resources
         .filter((resource) => !resource.hide)
         // Display the resources with agents first
-        .sort((a, b) => countAgents(b) - countAgents(a))
-  const hasHideResources = resources.some((r) => r.hide)
+        .sort((a, b) => countAgents(b) - countAgents(a));
+  const hasHideResources = resources.some((r) => r.hide);
 
   return (
     <Stack direction="column" spacing={0}>
@@ -49,21 +46,14 @@ export const Resources: FC<React.PropsWithChildren<ResourcesProps>> = ({
             size="small"
             onClick={() => setShouldDisplayHideResources((v) => !v)}
           >
-            {shouldDisplayHideResources ? (
-              <>
-                Hide resources <CloseDropdown />
-              </>
-            ) : (
-              <>
-                Show hidden resources <OpenDropdown />
-              </>
-            )}
+            {shouldDisplayHideResources ? "Hide" : "Show hidden"} resources
+            <DropdownArrow close={shouldDisplayHideResources} />
           </Button>
         </div>
       )}
     </Stack>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   buttonWrapper: {
@@ -78,4 +68,4 @@ const useStyles = makeStyles((theme) => ({
     width: "100%",
     maxWidth: 260,
   },
-}))
+}));
diff --git a/site/src/components/Resources/SSHButton/SSHButton.stories.tsx b/site/src/components/Resources/SSHButton/SSHButton.stories.tsx
new file mode 100644
index 0000000000000..b5e451160fc60
--- /dev/null
+++ b/site/src/components/Resources/SSHButton/SSHButton.stories.tsx
@@ -0,0 +1,28 @@
+import { MockWorkspace, MockWorkspaceAgent } from "testHelpers/entities";
+import { SSHButton } from "./SSHButton";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof SSHButton> = {
+  title: "components/SSHButton",
+  component: SSHButton,
+};
+
+export default meta;
+type Story = StoryObj<typeof SSHButton>;
+
+export const Closed: Story = {
+  args: {
+    workspaceName: MockWorkspace.name,
+    agentName: MockWorkspaceAgent.name,
+    sshPrefix: "coder.",
+  },
+};
+
+export const Opened: Story = {
+  args: {
+    workspaceName: MockWorkspace.name,
+    agentName: MockWorkspaceAgent.name,
+    isDefaultOpen: true,
+    sshPrefix: "coder.",
+  },
+};
diff --git a/site/src/components/Resources/SSHButton/SSHButton.tsx b/site/src/components/Resources/SSHButton/SSHButton.tsx
new file mode 100644
index 0000000000000..d9827d07956c0
--- /dev/null
+++ b/site/src/components/Resources/SSHButton/SSHButton.tsx
@@ -0,0 +1,104 @@
+import { css } from "@emotion/css";
+import { type Interpolation, type Theme, useTheme } from "@emotion/react";
+import { type FC, type PropsWithChildren } from "react";
+import {
+  HelpTooltipLink,
+  HelpTooltipLinksGroup,
+  HelpTooltipText,
+} from "components/HelpTooltip/HelpTooltip";
+import { docs } from "utils/docs";
+import { CodeExample } from "../../CodeExample/CodeExample";
+import { Stack } from "../../Stack/Stack";
+import { SecondaryAgentButton } from "../AgentButton";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "components/Popover/Popover";
+
+export interface SSHButtonProps {
+  workspaceName: string;
+  agentName: string;
+  isDefaultOpen?: boolean;
+  sshPrefix?: string;
+}
+
+export const SSHButton: FC<PropsWithChildren<SSHButtonProps>> = ({
+  workspaceName,
+  agentName,
+  isDefaultOpen = false,
+  sshPrefix,
+}) => {
+  const theme = useTheme();
+
+  return (
+    <Popover isDefaultOpen={isDefaultOpen}>
+      <PopoverTrigger>
+        <SecondaryAgentButton>SSH</SecondaryAgentButton>
+      </PopoverTrigger>
+
+      <PopoverContent
+        horizontal="right"
+        classes={{
+          paper: css`
+            padding: ${theme.spacing(2, 3, 3)};
+            width: ${theme.spacing(38)};
+            color: ${theme.palette.text.secondary};
+            margin-top: ${theme.spacing(0.25)};
+          `,
+        }}
+      >
+        <HelpTooltipText>
+          Run the following commands to connect with SSH:
+        </HelpTooltipText>
+
+        <Stack spacing={0.5} css={styles.codeExamples}>
+          <div>
+            <HelpTooltipText>
+              <strong css={styles.codeExampleLabel}>
+                Configure SSH hosts on machine:
+              </strong>
+            </HelpTooltipText>
+            <CodeExample code="coder config-ssh" />
+          </div>
+
+          <div>
+            <HelpTooltipText>
+              <strong css={styles.codeExampleLabel}>
+                Connect to the agent:
+              </strong>
+            </HelpTooltipText>
+            <CodeExample
+              code={`ssh ${sshPrefix}${workspaceName}.${agentName}`}
+            />
+          </div>
+        </Stack>
+
+        <HelpTooltipLinksGroup>
+          <HelpTooltipLink href={docs("/install")}>
+            Install Coder CLI
+          </HelpTooltipLink>
+          <HelpTooltipLink href={docs("/ides#vs-code-remote")}>
+            Connect via VS Code Remote SSH
+          </HelpTooltipLink>
+          <HelpTooltipLink href={docs("/ides#jetbrains-gateway")}>
+            Connect via JetBrains Gateway
+          </HelpTooltipLink>
+          <HelpTooltipLink href={docs("/ides#ssh-configuration")}>
+            SSH configuration
+          </HelpTooltipLink>
+        </HelpTooltipLinksGroup>
+      </PopoverContent>
+    </Popover>
+  );
+};
+
+const styles = {
+  codeExamples: (theme) => ({
+    marginTop: theme.spacing(1.5),
+  }),
+
+  codeExampleLabel: {
+    fontSize: 12,
+  },
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/components/Resources/SensitiveValue.tsx b/site/src/components/Resources/SensitiveValue.tsx
index 5fcb63cb9dd04..dcf2fb5a6e710 100644
--- a/site/src/components/Resources/SensitiveValue.tsx
+++ b/site/src/components/Resources/SensitiveValue.tsx
@@ -1,37 +1,58 @@
-import IconButton from "@mui/material/IconButton"
-import { makeStyles } from "@mui/styles"
-import Tooltip from "@mui/material/Tooltip"
-import VisibilityOffOutlined from "@mui/icons-material/VisibilityOffOutlined"
-import VisibilityOutlined from "@mui/icons-material/VisibilityOutlined"
-import { CopyableValue } from "components/CopyableValue/CopyableValue"
-import { useState } from "react"
+import IconButton from "@mui/material/IconButton";
+import Tooltip from "@mui/material/Tooltip";
+import VisibilityOffOutlined from "@mui/icons-material/VisibilityOffOutlined";
+import VisibilityOutlined from "@mui/icons-material/VisibilityOutlined";
+import { useState } from "react";
+import { css } from "@emotion/react";
+import { CopyableValue } from "components/CopyableValue/CopyableValue";
 
 const Language = {
   showLabel: "Show value",
   hideLabel: "Hide value",
-}
+};
 
 export const SensitiveValue: React.FC<{ value: string }> = ({ value }) => {
-  const [shouldDisplay, setShouldDisplay] = useState(false)
-  const styles = useStyles()
-  const displayValue = shouldDisplay ? value : "••••••••"
-  const buttonLabel = shouldDisplay ? Language.hideLabel : Language.showLabel
+  const [shouldDisplay, setShouldDisplay] = useState(false);
+  const displayValue = shouldDisplay ? value : "••••••••";
+  const buttonLabel = shouldDisplay ? Language.hideLabel : Language.showLabel;
   const icon = shouldDisplay ? (
     <VisibilityOffOutlined />
   ) : (
     <VisibilityOutlined />
-  )
+  );
 
   return (
-    <div className={styles.sensitiveValue}>
-      <CopyableValue value={value} className={styles.value}>
+    <div
+      css={(theme) => ({
+        display: "flex",
+        alignItems: "center",
+        gap: theme.spacing(0.5),
+      })}
+    >
+      <CopyableValue
+        value={value}
+        css={{
+          // 22px is the button width
+          width: "calc(100% - 22px)",
+          overflow: "hidden",
+          whiteSpace: "nowrap",
+          textOverflow: "ellipsis",
+        }}
+      >
         {displayValue}
       </CopyableValue>
       <Tooltip title={buttonLabel}>
         <IconButton
-          className={styles.button}
+          css={css`
+            color: inherit;
+
+            & .MuiSvgIcon-root {
+              width: 16px;
+              height: 16px;
+            }
+          `}
           onClick={() => {
-            setShouldDisplay((value) => !value)
+            setShouldDisplay((value) => !value);
           }}
           size="small"
           aria-label={buttonLabel}
@@ -40,30 +61,5 @@ export const SensitiveValue: React.FC<{ value: string }> = ({ value }) => {
         </IconButton>
       </Tooltip>
     </div>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  value: {
-    // 22px is the button width
-    width: "calc(100% - 22px)",
-    overflow: "hidden",
-    whiteSpace: "nowrap",
-    textOverflow: "ellipsis",
-  },
-
-  sensitiveValue: {
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(0.5),
-  },
-
-  button: {
-    color: "inherit",
-
-    "& .MuiSvgIcon-root": {
-      width: 16,
-      height: 16,
-    },
-  },
-}))
+  );
+};
diff --git a/site/src/components/Resources/TerminalLink/TerminalLink.stories.tsx b/site/src/components/Resources/TerminalLink/TerminalLink.stories.tsx
new file mode 100644
index 0000000000000..ae44504e97f59
--- /dev/null
+++ b/site/src/components/Resources/TerminalLink/TerminalLink.stories.tsx
@@ -0,0 +1,19 @@
+import { MockWorkspace } from "testHelpers/entities";
+import { TerminalLink } from "./TerminalLink";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof TerminalLink> = {
+  title: "components/TerminalLink",
+  component: TerminalLink,
+};
+
+export default meta;
+type Story = StoryObj<typeof TerminalLink>;
+
+const Example: Story = {
+  args: {
+    workspaceName: MockWorkspace.name,
+  },
+};
+
+export { Example as TerminalLink };
diff --git a/site/src/components/Resources/TerminalLink/TerminalLink.tsx b/site/src/components/Resources/TerminalLink/TerminalLink.tsx
new file mode 100644
index 0000000000000..bbf0e08a930d8
--- /dev/null
+++ b/site/src/components/Resources/TerminalLink/TerminalLink.tsx
@@ -0,0 +1,52 @@
+import Link from "@mui/material/Link";
+import { SecondaryAgentButton } from "components/Resources/AgentButton";
+import { FC } from "react";
+import * as TypesGen from "api/typesGenerated";
+import { generateRandomString } from "utils/random";
+
+export const Language = {
+  linkText: "Terminal",
+  terminalTitle: (identifier: string): string => `Terminal - ${identifier}`,
+};
+
+export interface TerminalLinkProps {
+  agentName?: TypesGen.WorkspaceAgent["name"];
+  userName?: TypesGen.User["username"];
+  workspaceName: TypesGen.Workspace["name"];
+}
+
+/**
+ * Generate a link to a terminal connected to the provided workspace agent.  If
+ * no agent is provided connect to the first agent.
+ *
+ * If no user name is provided "me" is used however it makes the link not
+ * shareable.
+ */
+export const TerminalLink: FC<React.PropsWithChildren<TerminalLinkProps>> = ({
+  agentName,
+  userName = "me",
+  workspaceName,
+}) => {
+  // Always use the primary for the terminal link. This is a relative link.
+  const href = `/@${userName}/${workspaceName}${
+    agentName ? `.${agentName}` : ""
+  }/terminal`;
+
+  return (
+    <Link
+      href={href}
+      target="_blank"
+      onClick={(event) => {
+        event.preventDefault();
+        window.open(
+          href,
+          Language.terminalTitle(generateRandomString(12)),
+          "width=900,height=600",
+        );
+      }}
+      data-testid="terminal"
+    >
+      <SecondaryAgentButton>{Language.linkText}</SecondaryAgentButton>
+    </Link>
+  );
+};
diff --git a/site/src/components/Resources/VSCodeDesktopButton/VSCodeDesktopButton.stories.tsx b/site/src/components/Resources/VSCodeDesktopButton/VSCodeDesktopButton.stories.tsx
new file mode 100644
index 0000000000000..4e23287d966bd
--- /dev/null
+++ b/site/src/components/Resources/VSCodeDesktopButton/VSCodeDesktopButton.stories.tsx
@@ -0,0 +1,26 @@
+import { MockWorkspace, MockWorkspaceAgent } from "testHelpers/entities";
+import { VSCodeDesktopButton } from "./VSCodeDesktopButton";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof VSCodeDesktopButton> = {
+  title: "components/VSCodeDesktopButton",
+  component: VSCodeDesktopButton,
+};
+
+export default meta;
+type Story = StoryObj<typeof VSCodeDesktopButton>;
+
+export const Default: Story = {
+  args: {
+    userName: MockWorkspace.owner_name,
+    workspaceName: MockWorkspace.name,
+    agentName: MockWorkspaceAgent.name,
+    displayApps: [
+      "vscode",
+      "port_forwarding_helper",
+      "ssh_helper",
+      "vscode_insiders",
+      "web_terminal",
+    ],
+  },
+};
diff --git a/site/src/components/Resources/VSCodeDesktopButton/VSCodeDesktopButton.tsx b/site/src/components/Resources/VSCodeDesktopButton/VSCodeDesktopButton.tsx
new file mode 100644
index 0000000000000..ad9f74b0e5270
--- /dev/null
+++ b/site/src/components/Resources/VSCodeDesktopButton/VSCodeDesktopButton.tsx
@@ -0,0 +1,206 @@
+import { FC, PropsWithChildren, useState, useRef } from "react";
+import { getApiKey } from "api/api";
+import { VSCodeIcon } from "components/Icons/VSCodeIcon";
+import { VSCodeInsidersIcon } from "components/Icons/VSCodeInsidersIcon";
+import { PrimaryAgentButton } from "components/Resources/AgentButton";
+import KeyboardArrowDownIcon from "@mui/icons-material/KeyboardArrowDown";
+import ButtonGroup from "@mui/material/ButtonGroup";
+import { useLocalStorage } from "hooks";
+import Menu from "@mui/material/Menu";
+import MenuItem from "@mui/material/MenuItem";
+import { DisplayApp } from "api/typesGenerated";
+
+export interface VSCodeDesktopButtonProps {
+  userName: string;
+  workspaceName: string;
+  agentName?: string;
+  folderPath?: string;
+  displayApps: DisplayApp[];
+}
+
+type VSCodeVariant = "vscode" | "vscode-insiders";
+
+const VARIANT_KEY = "vscode-variant";
+
+export const VSCodeDesktopButton: FC<
+  PropsWithChildren<VSCodeDesktopButtonProps>
+> = (props) => {
+  const [isVariantMenuOpen, setIsVariantMenuOpen] = useState(false);
+  const localStorage = useLocalStorage();
+  const previousVariant = localStorage.getLocal(VARIANT_KEY);
+  const [variant, setVariant] = useState<VSCodeVariant>(() => {
+    if (!previousVariant) {
+      return "vscode";
+    }
+    return previousVariant as VSCodeVariant;
+  });
+  const menuAnchorRef = useRef<HTMLDivElement>(null);
+
+  const selectVariant = (variant: VSCodeVariant) => {
+    localStorage.saveLocal(VARIANT_KEY, variant);
+    setVariant(variant);
+    setIsVariantMenuOpen(false);
+  };
+
+  const includesVSCodeDesktop = props.displayApps.includes("vscode");
+  const includesVSCodeInsiders = props.displayApps.includes("vscode_insiders");
+
+  return includesVSCodeDesktop && includesVSCodeInsiders ? (
+    <div>
+      <ButtonGroup
+        ref={menuAnchorRef}
+        variant="outlined"
+        sx={{
+          // Workaround to make the border transitions smoothly on button groups
+          "& > button:hover + button": {
+            borderLeft: "1px solid #FFF",
+          },
+        }}
+      >
+        {variant === "vscode" ? (
+          <VSCodeButton {...props} />
+        ) : (
+          <VSCodeInsidersButton {...props} />
+        )}
+
+        <PrimaryAgentButton
+          aria-controls={
+            isVariantMenuOpen ? "vscode-variant-button-menu" : undefined
+          }
+          aria-expanded={isVariantMenuOpen ? "true" : undefined}
+          aria-label="select VSCode variant"
+          aria-haspopup="menu"
+          disableRipple
+          onClick={() => {
+            setIsVariantMenuOpen(true);
+          }}
+          sx={{ px: 0 }}
+        >
+          <KeyboardArrowDownIcon sx={{ fontSize: 16 }} />
+        </PrimaryAgentButton>
+      </ButtonGroup>
+
+      <Menu
+        open={isVariantMenuOpen}
+        anchorEl={menuAnchorRef.current}
+        onClose={() => setIsVariantMenuOpen(false)}
+        sx={{
+          "& .MuiMenu-paper": {
+            width: menuAnchorRef.current?.clientWidth,
+          },
+        }}
+      >
+        <MenuItem
+          sx={{ fontSize: 14 }}
+          onClick={() => {
+            selectVariant("vscode");
+          }}
+        >
+          <VSCodeIcon sx={{ width: 12, height: 12 }} />
+          VS Code Desktop
+        </MenuItem>
+        <MenuItem
+          sx={{ fontSize: 14 }}
+          onClick={() => {
+            selectVariant("vscode-insiders");
+          }}
+        >
+          <VSCodeInsidersIcon sx={{ width: 12, height: 12 }} />
+          VS Code Insiders
+        </MenuItem>
+      </Menu>
+    </div>
+  ) : includesVSCodeDesktop ? (
+    <VSCodeButton {...props} />
+  ) : (
+    <VSCodeInsidersButton {...props} />
+  );
+};
+
+const VSCodeButton = ({
+  userName,
+  workspaceName,
+  agentName,
+  folderPath,
+}: VSCodeDesktopButtonProps) => {
+  const [loading, setLoading] = useState(false);
+
+  return (
+    <PrimaryAgentButton
+      startIcon={<VSCodeIcon />}
+      disabled={loading}
+      onClick={() => {
+        setLoading(true);
+        getApiKey()
+          .then(({ key }) => {
+            const query = new URLSearchParams({
+              owner: userName,
+              workspace: workspaceName,
+              url: location.origin,
+              token: key,
+            });
+            if (agentName) {
+              query.set("agent", agentName);
+            }
+            if (folderPath) {
+              query.set("folder", folderPath);
+            }
+
+            location.href = `vscode://coder.coder-remote/open?${query.toString()}`;
+          })
+          .catch((ex) => {
+            console.error(ex);
+          })
+          .finally(() => {
+            setLoading(false);
+          });
+      }}
+    >
+      VS Code Desktop
+    </PrimaryAgentButton>
+  );
+};
+
+const VSCodeInsidersButton = ({
+  userName,
+  workspaceName,
+  agentName,
+  folderPath,
+}: VSCodeDesktopButtonProps) => {
+  const [loading, setLoading] = useState(false);
+
+  return (
+    <PrimaryAgentButton
+      startIcon={<VSCodeInsidersIcon />}
+      disabled={loading}
+      onClick={() => {
+        setLoading(true);
+        getApiKey()
+          .then(({ key }) => {
+            const query = new URLSearchParams({
+              owner: userName,
+              workspace: workspaceName,
+              url: location.origin,
+              token: key,
+            });
+            if (agentName) {
+              query.set("agent", agentName);
+            }
+            if (folderPath) {
+              query.set("folder", folderPath);
+            }
+
+            location.href = `vscode-insiders://coder.coder-remote/open?${query.toString()}`;
+          })
+          .catch((ex) => {
+            console.error(ex);
+          })
+          .finally(() => {
+            setLoading(false);
+          });
+      }}
+    >
+      VS Code Insiders
+    </PrimaryAgentButton>
+  );
+};
diff --git a/site/src/components/RichParameterInput/MultiTextField.tsx b/site/src/components/RichParameterInput/MultiTextField.tsx
new file mode 100644
index 0000000000000..1c030fdd8ac59
--- /dev/null
+++ b/site/src/components/RichParameterInput/MultiTextField.tsx
@@ -0,0 +1,107 @@
+import Chip from "@mui/material/Chip";
+import FormHelperText from "@mui/material/FormHelperText";
+import { makeStyles } from "@mui/styles";
+import { FC } from "react";
+
+export type MultiTextFieldProps = {
+  label: string;
+  id?: string;
+  values: string[];
+  onChange: (values: string[]) => void;
+};
+
+export const MultiTextField: FC<MultiTextFieldProps> = ({
+  label,
+  id,
+  values,
+  onChange,
+}) => {
+  const styles = useStyles();
+
+  return (
+    <div>
+      <label className={styles.root}>
+        {values.map((value, index) => (
+          <Chip
+            key={index}
+            label={value}
+            size="small"
+            onDelete={() => {
+              onChange(values.filter((oldValue) => oldValue !== value));
+            }}
+          />
+        ))}
+        <input
+          id={id}
+          aria-label={label}
+          className={styles.input}
+          onKeyDown={(event) => {
+            if (event.key === ",") {
+              event.preventDefault();
+              const newValue = event.currentTarget.value;
+              onChange([...values, newValue]);
+              event.currentTarget.value = "";
+              return;
+            }
+
+            if (event.key === "Backspace" && event.currentTarget.value === "") {
+              event.preventDefault();
+
+              if (values.length === 0) {
+                return;
+              }
+
+              const lastValue = values[values.length - 1];
+              onChange(values.slice(0, -1));
+              event.currentTarget.value = lastValue;
+            }
+          }}
+          onBlur={(event) => {
+            if (event.currentTarget.value !== "") {
+              const newValue = event.currentTarget.value;
+              onChange([...values, newValue]);
+              event.currentTarget.value = "";
+            }
+          }}
+        />
+      </label>
+
+      <FormHelperText>{'Type "," to separate the values'}</FormHelperText>
+    </div>
+  );
+};
+
+const useStyles = makeStyles((theme) => ({
+  root: {
+    border: `1px solid ${theme.palette.divider}`,
+    borderRadius: theme.shape.borderRadius,
+    minHeight: theme.spacing(6), // Chip height + paddings
+    padding: theme.spacing(1.25, 1.75),
+    fontSize: theme.spacing(2),
+    display: "flex",
+    flexWrap: "wrap",
+    gap: theme.spacing(1),
+    position: "relative",
+    margin: theme.spacing(1, 0, 0.5), // Have same margin than TextField
+
+    "&:has(input:focus)": {
+      borderColor: theme.palette.primary.main,
+      borderWidth: 2,
+      // Compensate for the border width
+      top: -1,
+      left: -1,
+    },
+  },
+
+  input: {
+    flexGrow: 1,
+    fontSize: "inherit",
+    padding: 0,
+    border: "none",
+    background: "none",
+
+    "&:focus": {
+      outline: "none",
+    },
+  },
+}));
diff --git a/site/src/components/RichParameterInput/RichParameterInput.stories.tsx b/site/src/components/RichParameterInput/RichParameterInput.stories.tsx
index 2048a96f7e766..cd654ba7f2abc 100644
--- a/site/src/components/RichParameterInput/RichParameterInput.stories.tsx
+++ b/site/src/components/RichParameterInput/RichParameterInput.stories.tsx
@@ -1,14 +1,14 @@
-import { TemplateVersionParameter } from "api/typesGenerated"
-import { RichParameterInput } from "./RichParameterInput"
-import type { Meta, StoryObj } from "@storybook/react"
+import { TemplateVersionParameter } from "api/typesGenerated";
+import { RichParameterInput } from "./RichParameterInput";
+import type { Meta, StoryObj } from "@storybook/react";
 
 const meta: Meta<typeof RichParameterInput> = {
   title: "components/RichParameterInput",
   component: RichParameterInput,
-}
+};
 
-export default meta
-type Story = StoryObj<typeof RichParameterInput>
+export default meta;
+type Story = StoryObj<typeof RichParameterInput>;
 
 const createTemplateVersionParameter = (
   partial: Partial<TemplateVersionParameter>,
@@ -30,12 +30,12 @@ const createTemplateVersionParameter = (
     required: true,
     ephemeral: false,
     ...partial,
-  }
-}
+  };
+};
 
 export const Basic: Story = {
   args: {
-    initialValue: "initial-value",
+    value: "initial-value",
     id: "project_name",
     parameter: createTemplateVersionParameter({
       name: "project_name",
@@ -43,11 +43,11 @@ export const Basic: Story = {
         "Customize the name of a Google Cloud project that will be created!",
     }),
   },
-}
+};
 
 export const NumberType: Story = {
   args: {
-    initialValue: "4",
+    value: "4",
     id: "number_parameter",
     parameter: createTemplateVersionParameter({
       name: "number_parameter",
@@ -55,11 +55,11 @@ export const NumberType: Story = {
       description: "Numeric parameter",
     }),
   },
-}
+};
 
 export const BooleanType: Story = {
   args: {
-    initialValue: "false",
+    value: "false",
     id: "bool_parameter",
     parameter: createTemplateVersionParameter({
       name: "bool_parameter",
@@ -67,11 +67,11 @@ export const BooleanType: Story = {
       description: "Boolean parameter",
     }),
   },
-}
+};
 
-export const OptionsType: Story = {
+export const Options: Story = {
   args: {
-    initialValue: "first_option",
+    value: "first_option",
     id: "options_parameter",
     parameter: createTemplateVersionParameter({
       name: "options_parameter",
@@ -81,29 +81,71 @@ export const OptionsType: Story = {
         {
           name: "First option",
           value: "first_option",
-          description: "This is option 1",
-          icon: "",
+          description: "",
+          icon: "/icon/fedora.svg",
         },
         {
           name: "Second option",
           value: "second_option",
-          description: "This is option 2",
+          description: "",
           icon: "/icon/database.svg",
         },
         {
           name: "Third option",
           value: "third_option",
-          description: "This is option 3",
+          description: "",
           icon: "/icon/aws.png",
         },
       ],
     }),
   },
-}
+};
+
+export const OptionsWithDescriptions: Story = {
+  args: {
+    value: "first_option",
+    id: "options_parameter",
+    parameter: createTemplateVersionParameter({
+      name: "options_parameter",
+      type: "string",
+      description: "Parameter with options",
+      options: [
+        {
+          name: "First option",
+          value: "first_option",
+          description: "This is a short description.",
+          icon: "/icon/fedora.svg",
+        },
+        {
+          name: "Second option",
+          value: "second_option",
+          description:
+            "This description is a little bit longer, but still not very long.",
+          icon: "/icon/database.svg",
+        },
+        {
+          name: "Third option",
+          value: "third_option",
+          description: `
+In this description, we will explore the various ways in which this description
+is a big long boy. We'll discuss such things as, lots of words wow it's long, and
+boy howdy that's a number of sentences that this description contains. By the conclusion
+of this essay, I hope to reveal to you, the reader, that this description is just an
+absolute chonker. Just way longer than it actually needs to be. Absolutely massive.
+Very big.
+
+> Wow, that description is straight up large. –Some guy, probably
+`,
+          icon: "/icon/aws.png",
+        },
+      ],
+    }),
+  },
+};
 
 export const ListStringType: Story = {
   args: {
-    initialValue: JSON.stringify(["first", "second", "third"]),
+    value: JSON.stringify(["first", "second", "third"]),
     id: "list_string_parameter",
     parameter: createTemplateVersionParameter({
       name: "list_string_parameter",
@@ -111,11 +153,11 @@ export const ListStringType: Story = {
       description: "List string parameter",
     }),
   },
-}
+};
 
 export const IconLabel: Story = {
   args: {
-    initialValue: "initial-value",
+    value: "initial-value",
     id: "project_name",
     parameter: createTemplateVersionParameter({
       name: "project_name",
@@ -124,11 +166,11 @@ export const IconLabel: Story = {
       icon: "/emojis/1f30e.png",
     }),
   },
-}
+};
 
 export const NoDescription: Story = {
   args: {
-    initialValue: "",
+    value: "",
     id: "region",
     parameter: createTemplateVersionParameter({
       name: "Region",
@@ -160,11 +202,11 @@ export const NoDescription: Story = {
       ],
     }),
   },
-}
+};
 
 export const DescriptionWithLinks: Story = {
   args: {
-    initialValue: "",
+    value: "",
     id: "coder-repository-directory",
     parameter: createTemplateVersionParameter({
       name: "Coder Repository Directory",
@@ -179,11 +221,11 @@ export const DescriptionWithLinks: Story = {
       options: [],
     }),
   },
-}
+};
 
 export const BasicWithDisplayName: Story = {
   args: {
-    initialValue: "initial-value",
+    value: "initial-value",
     id: "project_name",
     parameter: createTemplateVersionParameter({
       name: "project_name",
@@ -192,7 +234,7 @@ export const BasicWithDisplayName: Story = {
         "Customize the name of a Google Cloud project that will be created!",
     }),
   },
-}
+};
 
 // Smaller version of the components. Used in popovers.
 
@@ -201,53 +243,60 @@ export const SmallBasic: Story = {
     ...Basic.args,
     size: "small",
   },
-}
+};
 
 export const SmallNumberType: Story = {
   args: {
     ...NumberType.args,
     size: "small",
   },
-}
+};
 
 export const SmallBooleanType: Story = {
   args: {
     ...BooleanType.args,
     size: "small",
   },
-}
+};
+
+export const SmallOptions: Story = {
+  args: {
+    ...Options.args,
+    size: "small",
+  },
+};
 
-export const SmallOptionsType: Story = {
+export const SmallOptionsWithDescriptions: Story = {
   args: {
-    ...OptionsType.args,
+    ...OptionsWithDescriptions.args,
     size: "small",
   },
-}
+};
 
 export const SmallListStringType: Story = {
   args: {
     ...ListStringType.args,
     size: "small",
   },
-}
+};
 
 export const SmallIconLabel: Story = {
   args: {
     ...IconLabel.args,
     size: "small",
   },
-}
+};
 
 export const SmallNoDescription: Story = {
   args: {
     ...NoDescription.args,
     size: "small",
   },
-}
+};
 
 export const SmallBasicWithDisplayName: Story = {
   args: {
     ...BasicWithDisplayName.args,
     size: "small",
   },
-}
+};
diff --git a/site/src/components/RichParameterInput/RichParameterInput.tsx b/site/src/components/RichParameterInput/RichParameterInput.tsx
index 3dd5f3f70c4da..a59f55d884041 100644
--- a/site/src/components/RichParameterInput/RichParameterInput.tsx
+++ b/site/src/components/RichParameterInput/RichParameterInput.tsx
@@ -1,40 +1,120 @@
-import FormControlLabel from "@mui/material/FormControlLabel"
-import Radio from "@mui/material/Radio"
-import RadioGroup from "@mui/material/RadioGroup"
-import { makeStyles } from "@mui/styles"
-import TextField, { TextFieldProps } from "@mui/material/TextField"
-import { Stack } from "components/Stack/Stack"
-import { FC, useState } from "react"
-import { TemplateVersionParameter } from "../../api/typesGenerated"
-import { colors } from "theme/colors"
-import { MemoizedMarkdown } from "components/Markdown/Markdown"
-import { MultiTextField } from "components/MultiTextField/MultiTextField"
-import Box from "@mui/material/Box"
-import { Theme } from "@mui/material/styles"
+import Box from "@mui/material/Box";
+import FormControlLabel from "@mui/material/FormControlLabel";
+import Radio from "@mui/material/Radio";
+import RadioGroup from "@mui/material/RadioGroup";
+import TextField, { TextFieldProps } from "@mui/material/TextField";
+import Tooltip from "@mui/material/Tooltip";
+import { type Interpolation, type Theme, useTheme } from "@emotion/react";
+import { type FC } from "react";
+import { TemplateVersionParameter } from "api/typesGenerated";
+import { MemoizedMarkdown } from "components/Markdown/Markdown";
+import { Stack } from "components/Stack/Stack";
+import { colors } from "theme/colors";
+import { MultiTextField } from "./MultiTextField";
 
 const isBoolean = (parameter: TemplateVersionParameter) => {
-  return parameter.type === "bool"
-}
+  return parameter.type === "bool";
+};
+
+const styles = {
+  label: (theme) => ({
+    marginBottom: theme.spacing(0.5),
+  }),
+  labelCaption: (theme) => ({
+    fontSize: 14,
+    color: theme.palette.text.secondary,
+
+    ".small &": {
+      fontSize: 13,
+      lineHeight: "140%",
+    },
+  }),
+  labelPrimary: (theme) => ({
+    fontSize: 16,
+    color: theme.palette.text.primary,
+    fontWeight: 600,
+
+    "& p": {
+      margin: 0,
+      lineHeight: "24px", // Keep the same as ParameterInput
+    },
+
+    ".small &": {
+      fontSize: 14,
+    },
+  }),
+  labelImmutable: (theme) => ({
+    marginTop: theme.spacing(0.5),
+    marginBottom: theme.spacing(0.5),
+    color: colors.yellow[7],
+  }),
+  textField: {
+    ".small & .MuiInputBase-root": {
+      height: 36,
+      fontSize: 14,
+      borderRadius: 6,
+    },
+  },
+  radioGroup: (theme) => ({
+    ".small & .MuiFormControlLabel-label": {
+      fontSize: 14,
+    },
+    ".small & .MuiRadio-root": {
+      padding: theme.spacing(0.75, "9px"), // 8px + 1px border
+    },
+    ".small & .MuiRadio-root svg": {
+      width: 16,
+      height: 16,
+    },
+  }),
+  checkbox: (theme) => ({
+    display: "flex",
+    alignItems: "center",
+    gap: theme.spacing(1),
+  }),
+  labelIconWrapper: (theme) => ({
+    width: theme.spacing(2.5),
+    height: theme.spacing(2.5),
+    display: "block",
+
+    ".small &": {
+      display: "none",
+    },
+  }),
+  labelIcon: {
+    width: "100%",
+    height: "100%",
+    objectFit: "contain",
+  },
+  optionIcon: {
+    pointerEvents: "none",
+    maxHeight: 20,
+    width: 20,
+
+    ".small &": {
+      maxHeight: 16,
+      width: 16,
+    },
+  },
+} satisfies Record<string, Interpolation<Theme>>;
 
 export interface ParameterLabelProps {
-  id: string
-  parameter: TemplateVersionParameter
+  parameter: TemplateVersionParameter;
 }
 
-const ParameterLabel: FC<ParameterLabelProps> = ({ id, parameter }) => {
-  const styles = useStyles()
-  const hasDescription = parameter.description && parameter.description !== ""
+const ParameterLabel: FC<ParameterLabelProps> = ({ parameter }) => {
+  const hasDescription = parameter.description && parameter.description !== "";
   const displayName = parameter.display_name
     ? parameter.display_name
-    : parameter.name
+    : parameter.name;
 
   return (
-    <label htmlFor={id}>
+    <label htmlFor={parameter.name}>
       <Stack direction="row" alignItems="center">
         {parameter.icon && (
-          <span className={styles.labelIconWrapper}>
+          <span css={styles.labelIconWrapper}>
             <img
-              className={styles.labelIcon}
+              css={styles.labelIcon}
               alt="Parameter icon"
               src={parameter.icon}
             />
@@ -43,39 +123,32 @@ const ParameterLabel: FC<ParameterLabelProps> = ({ id, parameter }) => {
 
         {hasDescription ? (
           <Stack spacing={0}>
-            <span className={styles.labelCaption}>{displayName}</span>
-            <MemoizedMarkdown className={styles.labelPrimary}>
+            <span css={styles.labelPrimary}>{displayName}</span>
+            <MemoizedMarkdown css={styles.labelCaption}>
               {parameter.description}
             </MemoizedMarkdown>
           </Stack>
         ) : (
-          <span className={styles.labelPrimary}>{displayName}</span>
+          <span css={styles.labelPrimary}>{displayName}</span>
         )}
       </Stack>
     </label>
-  )
-}
+  );
+};
 
-type Size = "medium" | "small"
+type Size = "medium" | "small";
 
 export type RichParameterInputProps = Omit<
   TextFieldProps,
-  "onChange" | "size"
+  "size" | "onChange"
 > & {
-  index: number
-  parameter: TemplateVersionParameter
-  onChange: (value: string) => void
-  initialValue?: string
-  id: string
-  size?: Size
-}
+  parameter: TemplateVersionParameter;
+  onChange: (value: string) => void;
+  size?: Size;
+};
 
 export const RichParameterInput: FC<RichParameterInputProps> = ({
-  index,
-  disabled,
-  onChange,
   parameter,
-  initialValue,
   size = "medium",
   ...fieldProps
 }) => {
@@ -84,41 +157,35 @@ export const RichParameterInput: FC<RichParameterInputProps> = ({
       direction="column"
       spacing={size === "small" ? 1.25 : 2}
       className={size}
+      data-testid={`parameter-field-${parameter.name}`}
     >
-      <ParameterLabel id={fieldProps.id} parameter={parameter} />
+      <ParameterLabel parameter={parameter} />
       <Box sx={{ display: "flex", flexDirection: "column" }}>
-        <RichParameterField
-          {...fieldProps}
-          index={index}
-          disabled={disabled}
-          onChange={onChange}
-          parameter={parameter}
-          initialValue={initialValue}
-        />
+        <RichParameterField {...fieldProps} size={size} parameter={parameter} />
       </Box>
     </Stack>
-  )
-}
+  );
+};
 
 const RichParameterField: React.FC<RichParameterInputProps> = ({
   disabled,
   onChange,
   parameter,
-  initialValue,
+  value,
   size,
   ...props
 }) => {
-  const [parameterValue, setParameterValue] = useState(initialValue)
-  const styles = useStyles()
+  const theme = useTheme();
+  const small = size === "small";
 
   if (isBoolean(parameter)) {
     return (
       <RadioGroup
-        className={styles.radioGroup}
-        defaultValue={parameterValue}
-        onChange={(event) => {
-          onChange(event.target.value)
-        }}
+        id={parameter.name}
+        data-testid="parameter-field-bool"
+        css={styles.radioGroup}
+        value={value}
+        onChange={(_, value) => onChange(value)}
       >
         <FormControlLabel
           disabled={disabled}
@@ -133,17 +200,17 @@ const RichParameterField: React.FC<RichParameterInputProps> = ({
           label="False"
         />
       </RadioGroup>
-    )
+    );
   }
 
   if (parameter.options.length > 0) {
     return (
       <RadioGroup
-        className={styles.radioGroup}
-        defaultValue={parameterValue}
-        onChange={(event) => {
-          onChange(event.target.value)
-        }}
+        id={parameter.name}
+        data-testid="parameter-field-options"
+        css={styles.radioGroup}
+        value={value}
+        onChange={(_, value) => onChange(value)}
       >
         {parameter.options.map((option) => (
           <FormControlLabel
@@ -152,52 +219,84 @@ const RichParameterField: React.FC<RichParameterInputProps> = ({
             value={option.value}
             control={<Radio size="small" />}
             label={
-              <span className={styles.radioOption}>
+              <Stack direction="row" alignItems="center">
                 {option.icon && (
                   <img
-                    className={styles.optionIcon}
-                    alt="Parameter icon"
+                    css={styles.optionIcon}
                     src={option.icon}
-                    style={{
-                      pointerEvents: "none",
-                    }}
+                    alt="Parameter icon"
                   />
                 )}
-                {option.name}
-              </span>
+                {option.description ? (
+                  <Stack
+                    spacing={small ? 1 : 0}
+                    alignItems={small ? "center" : undefined}
+                    direction={small ? "row" : "column"}
+                    css={{
+                      padding: small ? undefined : `${theme.spacing(0.5)} 0`,
+                    }}
+                  >
+                    {small ? (
+                      <Tooltip
+                        title={
+                          <MemoizedMarkdown>
+                            {option.description}
+                          </MemoizedMarkdown>
+                        }
+                      >
+                        <Box>{option.name}</Box>
+                      </Tooltip>
+                    ) : (
+                      <>
+                        <span>{option.name}</span>
+                        <MemoizedMarkdown css={styles.labelCaption}>
+                          {option.description}
+                        </MemoizedMarkdown>
+                      </>
+                    )}
+                  </Stack>
+                ) : (
+                  option.name
+                )}
+              </Stack>
             }
           />
         ))}
       </RadioGroup>
-    )
+    );
   }
 
   if (parameter.type === "list(string)") {
-    let values: string[] = []
+    let values: string[] = [];
+
+    if (typeof value !== "string") {
+      throw new Error("Expected value to be a string");
+    }
 
-    if (parameterValue) {
+    if (value) {
       try {
-        values = JSON.parse(parameterValue) as string[]
+        values = JSON.parse(value) as string[];
       } catch (e) {
-        console.error("Error parsing list(string) parameter", e)
+        console.error("Error parsing list(string) parameter", e);
       }
     }
 
     return (
       <MultiTextField
+        id={parameter.name}
+        data-testid="parameter-field-list-of-string"
         label={props.label as string}
         values={values}
         onChange={(values) => {
           try {
-            const value = JSON.stringify(values)
-            setParameterValue(value)
-            onChange(value)
+            const value = JSON.stringify(values);
+            onChange(value);
           } catch (e) {
-            console.error("Error on change of list(string) parameter", e)
+            console.error("Error on change of list(string) parameter", e);
           }
         }}
       />
-    )
+    );
   }
 
   // A text field can technically handle all cases!
@@ -206,102 +305,17 @@ const RichParameterField: React.FC<RichParameterInputProps> = ({
   return (
     <TextField
       {...props}
-      className={styles.textField}
+      id={parameter.name}
+      data-testid="parameter-field-text"
+      css={styles.textField}
       type={parameter.type}
       disabled={disabled}
       required={parameter.required}
       placeholder={parameter.default_value}
-      value={parameterValue}
+      value={value}
       onChange={(event) => {
-        setParameterValue(event.target.value)
-        onChange(event.target.value)
+        onChange(event.target.value);
       }}
     />
-  )
-}
-
-const useStyles = makeStyles<Theme>((theme) => ({
-  label: {
-    marginBottom: theme.spacing(0.5),
-  },
-  labelCaption: {
-    fontSize: 14,
-    color: theme.palette.text.secondary,
-
-    ".small &": {
-      fontSize: 13,
-      lineHeight: "140%",
-    },
-  },
-  labelPrimary: {
-    fontSize: 16,
-    color: theme.palette.text.primary,
-    fontWeight: 600,
-
-    "& p": {
-      margin: 0,
-      lineHeight: "24px", // Keep the same as ParameterInput
-    },
-
-    ".small &": {
-      fontSize: 14,
-    },
-  },
-  labelImmutable: {
-    marginTop: theme.spacing(0.5),
-    marginBottom: theme.spacing(0.5),
-    color: colors.yellow[7],
-  },
-  textField: {
-    ".small & .MuiInputBase-root": {
-      height: 36,
-      fontSize: 14,
-      borderRadius: 6,
-    },
-  },
-  radioGroup: {
-    ".small & .MuiFormControlLabel-label": {
-      fontSize: 14,
-    },
-    ".small & .MuiRadio-root": {
-      padding: theme.spacing(0.75, "9px"), // 8px + 1px border
-    },
-    ".small & .MuiRadio-root svg": {
-      width: 16,
-      height: 16,
-    },
-  },
-  checkbox: {
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(1),
-  },
-  labelIconWrapper: {
-    width: theme.spacing(2.5),
-    height: theme.spacing(2.5),
-    display: "block",
-
-    ".small &": {
-      display: "none",
-    },
-  },
-  labelIcon: {
-    width: "100%",
-    height: "100%",
-    objectFit: "contain",
-  },
-  radioOption: {
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(1.5),
-  },
-  optionIcon: {
-    maxHeight: 20,
-    width: 20,
-
-    ".small &": {
-      maxHeight: 16,
-      width: 16,
-    },
-  },
-}))
+  );
+};
diff --git a/site/src/components/RuntimeErrorState/RuntimeErrorState.stories.tsx b/site/src/components/RuntimeErrorState/RuntimeErrorState.stories.tsx
deleted file mode 100644
index 3660acfee60be..0000000000000
--- a/site/src/components/RuntimeErrorState/RuntimeErrorState.stories.tsx
+++ /dev/null
@@ -1,29 +0,0 @@
-import { Story } from "@storybook/react"
-import { RuntimeErrorState, RuntimeErrorStateProps } from "./RuntimeErrorState"
-
-const error = new Error("An error occurred")
-
-export default {
-  title: "components/RuntimeErrorState",
-  component: RuntimeErrorState,
-  args: {
-    error,
-  },
-}
-
-const Template: Story<RuntimeErrorStateProps> = (args) => (
-  <RuntimeErrorState {...args} />
-)
-
-export const Errored = Template.bind({})
-Errored.parameters = {
-  // The RuntimeErrorState is noisy for chromatic, because it renders an actual error
-  // along with the stacktrace - and the stacktrace includes the full URL of
-  // scripts in the stack. This is problematic, because every deployment uses
-  // a different URL, causing the validation to fail.
-  chromatic: { disableSnapshot: true },
-}
-
-Errored.args = {
-  error,
-}
diff --git a/site/src/components/RuntimeErrorState/RuntimeErrorState.tsx b/site/src/components/RuntimeErrorState/RuntimeErrorState.tsx
deleted file mode 100644
index 74174cd8dd983..0000000000000
--- a/site/src/components/RuntimeErrorState/RuntimeErrorState.tsx
+++ /dev/null
@@ -1,216 +0,0 @@
-import Button from "@mui/material/Button"
-import Link from "@mui/material/Link"
-import { makeStyles } from "@mui/styles"
-import RefreshOutlined from "@mui/icons-material/RefreshOutlined"
-import { BuildInfoResponse } from "api/typesGenerated"
-import { CopyButton } from "components/CopyButton/CopyButton"
-import { CoderIcon } from "components/Icons/CoderIcon"
-import { FullScreenLoader } from "components/Loader/FullScreenLoader"
-import { Stack } from "components/Stack/Stack"
-import { FC, useEffect, useState } from "react"
-import { Helmet } from "react-helmet-async"
-import { Margins } from "../Margins/Margins"
-
-const fetchDynamicallyImportedModuleError =
-  "Failed to fetch dynamically imported module"
-
-export type RuntimeErrorStateProps = { error: Error }
-
-export const RuntimeErrorState: FC<RuntimeErrorStateProps> = ({ error }) => {
-  const styles = useStyles()
-  const [checkingError, setCheckingError] = useState(true)
-  const [staticBuildInfo, setStaticBuildInfo] = useState<BuildInfoResponse>()
-  const coderVersion = staticBuildInfo?.version
-
-  // We use an effect to show a loading state if the page is trying to reload
-  useEffect(() => {
-    const isImportError = error.message.includes(
-      fetchDynamicallyImportedModuleError,
-    )
-    const isRetried = window.location.search.includes("retries=1")
-
-    if (isImportError && !isRetried) {
-      const url = new URL(location.href)
-      // Add a retry to avoid loops
-      url.searchParams.set("retries", "1")
-      location.assign(url.search)
-      return
-    }
-
-    setCheckingError(false)
-  }, [error.message])
-
-  useEffect(() => {
-    if (!checkingError) {
-      setStaticBuildInfo(getStaticBuildInfo())
-    }
-  }, [checkingError])
-
-  return (
-    <>
-      <Helmet>
-        <title>Something went wrong...</title>
-      </Helmet>
-      {!checkingError ? (
-        <Margins className={styles.root}>
-          <div className={styles.innerRoot}>
-            <CoderIcon className={styles.logo} />
-            <h1 className={styles.title}>Something went wrong...</h1>
-            <p className={styles.text}>
-              Please try reloading the page, if that doesn&lsquo;t work, you can
-              ask for help in the{" "}
-              <Link href="https://discord.gg/coder">
-                Coder Discord community
-              </Link>{" "}
-              or{" "}
-              <Link
-                href={`https://github.com/coder/coder/issues/new?body=${encodeURIComponent(
-                  [
-                    ["**Version**", coderVersion ?? "-- Set version --"].join(
-                      "\n",
-                    ),
-                    ["**Path**", "`" + location.pathname + "`"].join("\n"),
-                    ["**Error**", "```\n" + error.stack + "\n```"].join("\n"),
-                  ].join("\n\n"),
-                )}`}
-                target="_blank"
-              >
-                open an issue
-              </Link>
-              .
-            </p>
-            <Stack direction="row" justifyContent="center">
-              <Button
-                startIcon={<RefreshOutlined />}
-                onClick={() => {
-                  window.location.reload()
-                }}
-              >
-                Reload page
-              </Button>
-              <Button component="a" href="/">
-                Go to dashboard
-              </Button>
-            </Stack>
-            {error.stack && (
-              <div className={styles.stack}>
-                <div className={styles.stackHeader}>
-                  Stacktrace
-                  <CopyButton
-                    buttonClassName={styles.copyButton}
-                    text={error.stack}
-                    tooltipTitle="Copy stacktrace"
-                  />
-                </div>
-                <pre className={styles.stackCode}>{error.stack}</pre>
-              </div>
-            )}
-            {coderVersion && (
-              <div className={styles.version}>Version: {coderVersion}</div>
-            )}
-          </div>
-        </Margins>
-      ) : (
-        <FullScreenLoader />
-      )}
-    </>
-  )
-}
-
-// During the build process, we inject the build info into the HTML
-const getStaticBuildInfo = () => {
-  const buildInfoJson = document
-    .querySelector("meta[property=build-info]")
-    ?.getAttribute("content")
-
-  if (buildInfoJson) {
-    try {
-      return JSON.parse(buildInfoJson) as BuildInfoResponse
-    } catch {
-      return undefined
-    }
-  }
-}
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    paddingTop: theme.spacing(4),
-    paddingBottom: theme.spacing(4),
-    textAlign: "center",
-    display: "flex",
-    alignItems: "center",
-    justifyContent: "center",
-    minHeight: "100vh",
-    maxWidth: theme.spacing(75),
-  },
-
-  innerRoot: { width: "100%" },
-
-  logo: {
-    fontSize: theme.spacing(8),
-  },
-
-  title: {
-    fontSize: theme.spacing(4),
-    fontWeight: 400,
-  },
-
-  text: {
-    fontSize: 16,
-    color: theme.palette.text.secondary,
-    lineHeight: "160%",
-    marginBottom: theme.spacing(4),
-  },
-
-  stack: {
-    backgroundColor: theme.palette.background.paper,
-    border: `1px solid ${theme.palette.divider}`,
-    borderRadius: 4,
-    marginTop: theme.spacing(8),
-    display: "block",
-    textAlign: "left",
-  },
-
-  stackHeader: {
-    fontSize: 10,
-    textTransform: "uppercase",
-    fontWeight: 600,
-    letterSpacing: 1,
-    padding: theme.spacing(1, 1, 1, 2),
-    backgroundColor: theme.palette.background.paperLight,
-    borderBottom: `1px solid ${theme.palette.divider}`,
-    color: theme.palette.text.secondary,
-    display: "flex",
-    flexAlign: "center",
-    justifyContent: "space-between",
-    alignItems: "center",
-  },
-
-  stackCode: {
-    padding: theme.spacing(2),
-    margin: 0,
-    wordWrap: "break-word",
-    whiteSpace: "break-spaces",
-  },
-
-  copyButton: {
-    backgroundColor: "transparent",
-    border: 0,
-    borderRadius: 999,
-    minHeight: theme.spacing(4),
-    minWidth: theme.spacing(4),
-    height: theme.spacing(4),
-    width: theme.spacing(4),
-
-    "& svg": {
-      width: 16,
-      height: 16,
-    },
-  },
-
-  version: {
-    marginTop: theme.spacing(4),
-    fontSize: 12,
-    color: theme.palette.text.secondary,
-  },
-}))
diff --git a/site/src/components/SSHButton/SSHButton.stories.tsx b/site/src/components/SSHButton/SSHButton.stories.tsx
deleted file mode 100644
index 626292069b7d6..0000000000000
--- a/site/src/components/SSHButton/SSHButton.stories.tsx
+++ /dev/null
@@ -1,25 +0,0 @@
-import { Story } from "@storybook/react"
-import { MockWorkspace, MockWorkspaceAgent } from "testHelpers/entities"
-import { SSHButton, SSHButtonProps } from "./SSHButton"
-
-export default {
-  title: "components/SSHButton",
-  component: SSHButton,
-}
-
-const Template: Story<SSHButtonProps> = (args) => <SSHButton {...args} />
-
-export const Closed = Template.bind({})
-Closed.args = {
-  workspaceName: MockWorkspace.name,
-  agentName: MockWorkspaceAgent.name,
-  sshPrefix: "coder.",
-}
-
-export const Opened = Template.bind({})
-Opened.args = {
-  workspaceName: MockWorkspace.name,
-  agentName: MockWorkspaceAgent.name,
-  defaultIsOpen: true,
-  sshPrefix: "coder.",
-}
diff --git a/site/src/components/SSHButton/SSHButton.tsx b/site/src/components/SSHButton/SSHButton.tsx
deleted file mode 100644
index 480ae617b7c2a..0000000000000
--- a/site/src/components/SSHButton/SSHButton.tsx
+++ /dev/null
@@ -1,126 +0,0 @@
-import Popover from "@mui/material/Popover"
-import { makeStyles } from "@mui/styles"
-import { SecondaryAgentButton } from "components/Resources/AgentButton"
-import { useRef, useState } from "react"
-import { CodeExample } from "../CodeExample/CodeExample"
-import { Stack } from "../Stack/Stack"
-import {
-  HelpTooltipLink,
-  HelpTooltipLinksGroup,
-  HelpTooltipText,
-} from "../Tooltips/HelpTooltip"
-import { docs } from "utils/docs"
-
-export interface SSHButtonProps {
-  workspaceName: string
-  agentName: string
-  defaultIsOpen?: boolean
-  sshPrefix?: string
-}
-
-export const SSHButton: React.FC<React.PropsWithChildren<SSHButtonProps>> = ({
-  workspaceName,
-  agentName,
-  defaultIsOpen = false,
-  sshPrefix,
-}) => {
-  const anchorRef = useRef<HTMLButtonElement>(null)
-  const [isOpen, setIsOpen] = useState(defaultIsOpen)
-  const id = isOpen ? "schedule-popover" : undefined
-  const styles = useStyles()
-
-  const onClose = () => {
-    setIsOpen(false)
-  }
-
-  return (
-    <>
-      <SecondaryAgentButton
-        ref={anchorRef}
-        onClick={() => {
-          setIsOpen(true)
-        }}
-      >
-        SSH
-      </SecondaryAgentButton>
-
-      <Popover
-        classes={{ paper: styles.popoverPaper }}
-        id={id}
-        open={isOpen}
-        anchorEl={anchorRef.current}
-        onClose={onClose}
-        anchorOrigin={{
-          vertical: "bottom",
-          horizontal: "left",
-        }}
-        transformOrigin={{
-          vertical: "top",
-          horizontal: "left",
-        }}
-      >
-        <HelpTooltipText>
-          Run the following commands to connect with SSH:
-        </HelpTooltipText>
-
-        <Stack spacing={0.5} className={styles.codeExamples}>
-          <div>
-            <HelpTooltipText>
-              <strong className={styles.codeExampleLabel}>
-                Configure SSH hosts on machine:
-              </strong>
-            </HelpTooltipText>
-            <CodeExample code="coder config-ssh" />
-          </div>
-
-          <div>
-            <HelpTooltipText>
-              <strong className={styles.codeExampleLabel}>
-                Connect to the agent:
-              </strong>
-            </HelpTooltipText>
-            <CodeExample
-              code={`ssh ${sshPrefix}${workspaceName}.${agentName}`}
-            />
-          </div>
-        </Stack>
-
-        <HelpTooltipLinksGroup>
-          <HelpTooltipLink href={docs("/install")}>
-            Install Coder CLI
-          </HelpTooltipLink>
-          <HelpTooltipLink href={docs("/ides#vs-code-remote")}>
-            Connect via VS Code Remote SSH
-          </HelpTooltipLink>
-          <HelpTooltipLink href={docs("/ides#jetbrains-gateway")}>
-            Connect via JetBrains Gateway
-          </HelpTooltipLink>
-          <HelpTooltipLink href={docs("/ides#ssh-configuration")}>
-            SSH configuration
-          </HelpTooltipLink>
-        </HelpTooltipLinksGroup>
-      </Popover>
-    </>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  popoverPaper: {
-    padding: `${theme.spacing(2)} ${theme.spacing(3)} ${theme.spacing(3)}`,
-    width: theme.spacing(38),
-    color: theme.palette.text.secondary,
-    marginTop: theme.spacing(0.25),
-  },
-
-  codeExamples: {
-    marginTop: theme.spacing(1.5),
-  },
-
-  codeExampleLabel: {
-    fontSize: 12,
-  },
-
-  textHelper: {
-    fontWeight: 400,
-  },
-}))
diff --git a/site/src/components/Section/Section.stories.tsx b/site/src/components/Section/Section.stories.tsx
deleted file mode 100644
index ff6f803a0dba4..0000000000000
--- a/site/src/components/Section/Section.stories.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-import Button from "@mui/material/Button"
-import TextField from "@mui/material/TextField"
-import { Story } from "@storybook/react"
-import { Section, SectionProps } from "./Section"
-
-export default {
-  title: "components/Section",
-  component: Section,
-  argTypes: {
-    title: { type: "string" },
-    description: { type: "string" },
-    children: { control: { disable: true } },
-  },
-}
-
-const Template: Story<SectionProps> = (args: SectionProps) => (
-  <Section {...args} />
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  title: "User Settings",
-  description: "Add your personal info",
-  children: (
-    <>
-      <form style={{ display: "grid", gridAutoFlow: "row", gap: 12 }}>
-        <TextField label="Name" variant="filled" fullWidth />
-        <TextField label="Email" variant="filled" fullWidth />
-      </form>
-
-      <Section.Action>
-        <Button variant="contained" color="primary">
-          Submit
-        </Button>
-      </Section.Action>
-    </>
-  ),
-}
diff --git a/site/src/components/Section/Section.tsx b/site/src/components/Section/Section.tsx
deleted file mode 100644
index fc1df1dc5187b..0000000000000
--- a/site/src/components/Section/Section.tsx
+++ /dev/null
@@ -1,92 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import Typography from "@mui/material/Typography"
-import { FC } from "react"
-import { combineClasses } from "../../utils/combineClasses"
-import { SectionAction } from "../SectionAction/SectionAction"
-
-type SectionLayout = "fixed" | "fluid"
-
-export interface SectionProps {
-  title?: React.ReactNode | string
-  description?: React.ReactNode
-  toolbar?: React.ReactNode
-  alert?: React.ReactNode
-  layout?: SectionLayout
-  className?: string
-  children?: React.ReactNode
-}
-
-type SectionFC = FC<React.PropsWithChildren<SectionProps>> & {
-  Action: typeof SectionAction
-}
-
-export const Section: SectionFC = ({
-  title,
-  description,
-  toolbar,
-  alert,
-  className = "",
-  children,
-  layout = "fixed",
-}) => {
-  const styles = useStyles({ layout })
-  return (
-    <section className={combineClasses([styles.root, className])}>
-      <div className={styles.inner}>
-        {(title || description) && (
-          <div className={styles.header}>
-            <div>
-              {title && <Typography variant="h4">{title}</Typography>}
-              {description && typeof description === "string" && (
-                <Typography className={styles.description}>
-                  {description}
-                </Typography>
-              )}
-              {description && typeof description !== "string" && (
-                <div className={styles.description}>{description}</div>
-              )}
-            </div>
-            {toolbar && <div>{toolbar}</div>}
-          </div>
-        )}
-        {alert && <div className={styles.alert}>{alert}</div>}
-        {children}
-      </div>
-    </section>
-  )
-}
-
-// Sub-components
-Section.Action = SectionAction
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    backgroundColor: theme.palette.background.paper,
-    boxShadow: theme.shadows[6],
-    marginBottom: theme.spacing(1),
-    padding: theme.spacing(6),
-    borderRadius: theme.shape.borderRadius,
-    border: `1px solid ${theme.palette.divider}`,
-
-    [theme.breakpoints.down("md")]: {
-      padding: theme.spacing(4, 3, 4, 3),
-    },
-  },
-  inner: ({ layout }: { layout: SectionLayout }) => ({
-    maxWidth: layout === "fluid" ? "100%" : 500,
-  }),
-  alert: {
-    marginBottom: theme.spacing(1),
-  },
-  header: {
-    marginBottom: theme.spacing(4),
-    display: "flex",
-    flexDirection: "row",
-    justifyContent: "space-between",
-  },
-  description: {
-    color: theme.palette.text.secondary,
-    fontSize: 16,
-    marginTop: theme.spacing(2),
-  },
-}))
diff --git a/site/src/components/SectionAction/SectionAction.tsx b/site/src/components/SectionAction/SectionAction.tsx
deleted file mode 100644
index 76ac6c7c26454..0000000000000
--- a/site/src/components/SectionAction/SectionAction.tsx
+++ /dev/null
@@ -1,19 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import { FC } from "react"
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    marginTop: theme.spacing(3),
-  },
-}))
-
-/**
- * SectionAction is a content box that call to actions should be placed
- * within
- */
-export const SectionAction: FC<React.PropsWithChildren<unknown>> = ({
-  children,
-}) => {
-  const styles = useStyles()
-  return <div className={styles.root}>{children}</div>
-}
diff --git a/site/src/components/ServiceBanner/ServiceBanner.tsx b/site/src/components/ServiceBanner/ServiceBanner.tsx
deleted file mode 100644
index d76e7053ea9ef..0000000000000
--- a/site/src/components/ServiceBanner/ServiceBanner.tsx
+++ /dev/null
@@ -1,24 +0,0 @@
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import { ServiceBannerView } from "./ServiceBannerView"
-
-export const ServiceBanner: React.FC = () => {
-  const { appearance } = useDashboard()
-  const { message, background_color, enabled } =
-    appearance.config.service_banner
-
-  if (!enabled) {
-    return null
-  }
-
-  if (message !== undefined && background_color !== undefined) {
-    return (
-      <ServiceBannerView
-        message={message}
-        backgroundColor={background_color}
-        preview={appearance.preview}
-      />
-    )
-  } else {
-    return null
-  }
-}
diff --git a/site/src/components/ServiceBanner/ServiceBannerView.stories.tsx b/site/src/components/ServiceBanner/ServiceBannerView.stories.tsx
deleted file mode 100644
index 37b6c4276b6f7..0000000000000
--- a/site/src/components/ServiceBanner/ServiceBannerView.stories.tsx
+++ /dev/null
@@ -1,24 +0,0 @@
-import { Story } from "@storybook/react"
-import { ServiceBannerView, ServiceBannerViewProps } from "./ServiceBannerView"
-
-export default {
-  title: "components/ServiceBannerView",
-  component: ServiceBannerView,
-}
-
-const Template: Story<ServiceBannerViewProps> = (args) => (
-  <ServiceBannerView {...args} />
-)
-
-export const Production = Template.bind({})
-Production.args = {
-  message: "weeeee",
-  backgroundColor: "#FFFFFF",
-}
-
-export const Preview = Template.bind({})
-Preview.args = {
-  message: "weeeee",
-  backgroundColor: "#000000",
-  preview: true,
-}
diff --git a/site/src/components/ServiceBanner/ServiceBannerView.tsx b/site/src/components/ServiceBanner/ServiceBannerView.tsx
deleted file mode 100644
index f452b796d8953..0000000000000
--- a/site/src/components/ServiceBanner/ServiceBannerView.tsx
+++ /dev/null
@@ -1,87 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import { Pill } from "components/Pill/Pill"
-import ReactMarkdown from "react-markdown"
-import { colors } from "theme/colors"
-import { hex } from "color-convert"
-
-export interface ServiceBannerViewProps {
-  message: string
-  backgroundColor: string
-  preview: boolean
-}
-
-export const ServiceBannerView: React.FC<ServiceBannerViewProps> = ({
-  message,
-  backgroundColor,
-  preview,
-}) => {
-  const styles = useStyles()
-  // We don't want anything funky like an image or a heading in the service
-  // banner.
-  const markdownElementsAllowed = [
-    "text",
-    "a",
-    "pre",
-    "ul",
-    "strong",
-    "emphasis",
-    "italic",
-    "link",
-    "em",
-  ]
-  return (
-    <div
-      className={styles.container}
-      style={{ backgroundColor: backgroundColor }}
-    >
-      {preview && <Pill text="Preview" type="info" lightBorder />}
-      <div
-        className={styles.centerContent}
-        style={{
-          color: readableForegroundColor(backgroundColor),
-        }}
-      >
-        <ReactMarkdown
-          allowedElements={markdownElementsAllowed}
-          linkTarget="_blank"
-          unwrapDisallowed
-        >
-          {message}
-        </ReactMarkdown>
-      </div>
-    </div>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  container: {
-    padding: theme.spacing(1.5),
-    backgroundColor: theme.palette.warning.main,
-    display: "flex",
-    alignItems: "center",
-    "&.error": {
-      backgroundColor: colors.red[12],
-    },
-  },
-  flex: {
-    display: "column",
-  },
-  centerContent: {
-    marginRight: "auto",
-    marginLeft: "auto",
-    fontWeight: 400,
-    "& a": {
-      color: "inherit",
-    },
-  },
-}))
-
-const readableForegroundColor = (backgroundColor: string): string => {
-  const rgb = hex.rgb(backgroundColor)
-
-  // Logic taken from here:
-  // https://github.com/casesandberg/react-color/blob/bc9a0e1dc5d11b06c511a8e02a95bd85c7129f4b/src/helpers/color.js#L56
-  // to be consistent with the color-picker label.
-  const yiq = (rgb[0] * 299 + rgb[1] * 587 + rgb[2] * 114) / 1000
-  return yiq >= 128 ? "#000" : "#fff"
-}
diff --git a/site/src/components/SettingsAccountForm/SettingsAccountForm.stories.tsx b/site/src/components/SettingsAccountForm/SettingsAccountForm.stories.tsx
deleted file mode 100644
index 3b49826232a5f..0000000000000
--- a/site/src/components/SettingsAccountForm/SettingsAccountForm.stories.tsx
+++ /dev/null
@@ -1,51 +0,0 @@
-import { Story } from "@storybook/react"
-import { AccountForm, AccountFormProps } from "./SettingsAccountForm"
-import { mockApiError } from "testHelpers/entities"
-
-export default {
-  title: "components/SettingsAccountForm",
-  component: AccountForm,
-  argTypes: {
-    onSubmit: { action: "Submit" },
-  },
-}
-
-const Template: Story<AccountFormProps> = (args: AccountFormProps) => (
-  <AccountForm {...args} />
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  email: "test-user@org.com",
-  isLoading: false,
-  initialValues: {
-    username: "test-user",
-  },
-  updateProfileError: undefined,
-  onSubmit: () => {
-    return Promise.resolve()
-  },
-}
-
-export const Loading = Template.bind({})
-Loading.args = {
-  ...Example.args,
-  isLoading: true,
-}
-
-export const WithError = Template.bind({})
-WithError.args = {
-  ...Example.args,
-  updateProfileError: mockApiError({
-    message: "Username is invalid",
-    validations: [
-      {
-        field: "username",
-        detail: "Username is too long.",
-      },
-    ],
-  }),
-  initialTouched: {
-    username: true,
-  },
-}
diff --git a/site/src/components/SettingsAccountForm/SettingsAccountForm.test.tsx b/site/src/components/SettingsAccountForm/SettingsAccountForm.test.tsx
deleted file mode 100644
index 000e6a8adc3fc..0000000000000
--- a/site/src/components/SettingsAccountForm/SettingsAccountForm.test.tsx
+++ /dev/null
@@ -1,69 +0,0 @@
-import { screen } from "@testing-library/react"
-import { MockUser2 } from "../../testHelpers/entities"
-import { render } from "../../testHelpers/renderHelpers"
-import { AccountForm, AccountFormValues } from "./SettingsAccountForm"
-
-// NOTE: it does not matter what the role props of MockUser are set to,
-//       only that editable is set to true or false. This is passed from
-//       the call to /authorization done by auth provider
-describe("AccountForm", () => {
-  describe("when editable is set to true", () => {
-    it("allows updating username", async () => {
-      // Given
-      const mockInitialValues: AccountFormValues = {
-        username: MockUser2.username,
-      }
-
-      // When
-      render(
-        <AccountForm
-          editable
-          email={MockUser2.email}
-          initialValues={mockInitialValues}
-          isLoading={false}
-          onSubmit={() => {
-            return
-          }}
-        />,
-      )
-
-      // Then
-      const el = await screen.findByLabelText("Username")
-      expect(el).toBeEnabled()
-      const btn = await screen.findByRole("button", {
-        name: /Update account/i,
-      })
-      expect(btn).toBeEnabled()
-    })
-  })
-
-  describe("when editable is set to false", () => {
-    it("does not allow updating username", async () => {
-      // Given
-      const mockInitialValues: AccountFormValues = {
-        username: MockUser2.username,
-      }
-
-      // When
-      render(
-        <AccountForm
-          editable={false}
-          email={MockUser2.email}
-          initialValues={mockInitialValues}
-          isLoading={false}
-          onSubmit={() => {
-            return
-          }}
-        />,
-      )
-
-      // Then
-      const el = await screen.findByLabelText("Username")
-      expect(el).toBeDisabled()
-      const btn = await screen.findByRole("button", {
-        name: /Update account/i,
-      })
-      expect(btn).toBeDisabled()
-    })
-  })
-})
diff --git a/site/src/components/SettingsAccountForm/SettingsAccountForm.tsx b/site/src/components/SettingsAccountForm/SettingsAccountForm.tsx
deleted file mode 100644
index 98feab9cbd171..0000000000000
--- a/site/src/components/SettingsAccountForm/SettingsAccountForm.tsx
+++ /dev/null
@@ -1,98 +0,0 @@
-import TextField from "@mui/material/TextField"
-import { FormikContextType, FormikTouched, useFormik } from "formik"
-import { FC } from "react"
-import * as Yup from "yup"
-import {
-  getFormHelpers,
-  nameValidator,
-  onChangeTrimmed,
-} from "../../utils/formUtils"
-import { LoadingButton } from "../LoadingButton/LoadingButton"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
-import { Form, FormFields } from "components/Form/Form"
-
-export interface AccountFormValues {
-  username: string
-}
-
-export const Language = {
-  usernameLabel: "Username",
-  emailLabel: "Email",
-  updateSettings: "Update account",
-}
-
-const validationSchema = Yup.object({
-  username: nameValidator(Language.usernameLabel),
-})
-
-export interface AccountFormProps {
-  editable: boolean
-  email: string
-  isLoading: boolean
-  initialValues: AccountFormValues
-  onSubmit: (values: AccountFormValues) => void
-  updateProfileError?: unknown
-  // initialTouched is only used for testing the error state of the form.
-  initialTouched?: FormikTouched<AccountFormValues>
-}
-
-export const AccountForm: FC<React.PropsWithChildren<AccountFormProps>> = ({
-  editable,
-  email,
-  isLoading,
-  onSubmit,
-  initialValues,
-  updateProfileError,
-  initialTouched,
-}) => {
-  const form: FormikContextType<AccountFormValues> =
-    useFormik<AccountFormValues>({
-      initialValues,
-      validationSchema,
-      onSubmit,
-      initialTouched,
-    })
-  const getFieldHelpers = getFormHelpers<AccountFormValues>(
-    form,
-    updateProfileError,
-  )
-
-  return (
-    <>
-      <Form onSubmit={form.handleSubmit}>
-        <FormFields>
-          {Boolean(updateProfileError) && (
-            <ErrorAlert error={updateProfileError} />
-          )}
-          <TextField
-            disabled
-            fullWidth
-            label={Language.emailLabel}
-            value={email}
-          />
-          <TextField
-            {...getFieldHelpers("username")}
-            onChange={onChangeTrimmed(form)}
-            aria-disabled={!editable}
-            autoComplete="username"
-            disabled={!editable}
-            fullWidth
-            label={Language.usernameLabel}
-          />
-
-          <div>
-            <LoadingButton
-              loading={isLoading}
-              aria-disabled={!editable}
-              disabled={!editable}
-              type="submit"
-              variant="contained"
-            >
-              {isLoading ? "" : Language.updateSettings}
-            </LoadingButton>
-          </div>
-        </FormFields>
-      </Form>
-    </>
-  )
-}
diff --git a/site/src/components/SettingsLayout/Section.tsx b/site/src/components/SettingsLayout/Section.tsx
index 35419ff4ab89d..7eb933383b17d 100644
--- a/site/src/components/SettingsLayout/Section.tsx
+++ b/site/src/components/SettingsLayout/Section.tsx
@@ -1,25 +1,26 @@
-import { makeStyles } from "@mui/styles"
-import Typography from "@mui/material/Typography"
-import { FC, ReactNode, PropsWithChildren } from "react"
-import { SectionAction } from "../SectionAction/SectionAction"
+import { useTheme } from "@emotion/react";
+import Typography from "@mui/material/Typography";
+import { type FC, type ReactNode, type PropsWithChildren } from "react";
+import { SectionAction } from "./SectionAction";
+import { type Interpolation, type Theme } from "@emotion/react";
 
-type SectionLayout = "fixed" | "fluid"
+type SectionLayout = "fixed" | "fluid";
 
 export interface SectionProps {
   // Useful for testing
-  id?: string
-  title?: ReactNode | string
-  description?: ReactNode
-  toolbar?: ReactNode
-  alert?: ReactNode
-  layout?: SectionLayout
-  className?: string
-  children?: ReactNode
+  id?: string;
+  title?: ReactNode | string;
+  description?: ReactNode;
+  toolbar?: ReactNode;
+  alert?: ReactNode;
+  layout?: SectionLayout;
+  className?: string;
+  children?: ReactNode;
 }
 
 type SectionFC = FC<PropsWithChildren<SectionProps>> & {
-  Action: typeof SectionAction
-}
+  Action: typeof SectionAction;
+};
 
 export const Section: SectionFC = ({
   id,
@@ -31,12 +32,13 @@ export const Section: SectionFC = ({
   children,
   layout = "fixed",
 }) => {
-  const styles = useStyles({ layout })
+  const theme = useTheme();
+
   return (
     <section className={className} id={id} data-testid={id}>
-      <div className={styles.inner}>
+      <div css={{ maxWidth: layout === "fluid" ? "100%" : 500 }}>
         {(title || description) && (
-          <div className={styles.header}>
+          <div css={styles.header}>
             <div>
               {title && (
                 <Typography variant="h4" sx={{ fontSize: 24 }}>
@@ -44,44 +46,36 @@ export const Section: SectionFC = ({
                 </Typography>
               )}
               {description && typeof description === "string" && (
-                <Typography className={styles.description}>
-                  {description}
-                </Typography>
+                <Typography css={styles.description}>{description}</Typography>
               )}
               {description && typeof description !== "string" && (
-                <div className={styles.description}>{description}</div>
+                <div css={styles.description}>{description}</div>
               )}
             </div>
             {toolbar && <div>{toolbar}</div>}
           </div>
         )}
-        {alert && <div className={styles.alert}>{alert}</div>}
+        {alert && <div css={{ marginBottom: theme.spacing(1) }}>{alert}</div>}
         {children}
       </div>
     </section>
-  )
-}
+  );
+};
 
 // Sub-components
-Section.Action = SectionAction
+Section.Action = SectionAction;
 
-const useStyles = makeStyles((theme) => ({
-  inner: ({ layout }: { layout: SectionLayout }) => ({
-    maxWidth: layout === "fluid" ? "100%" : 500,
-  }),
-  alert: {
-    marginBottom: theme.spacing(1),
-  },
-  header: {
+const styles = {
+  header: (theme) => ({
     marginBottom: theme.spacing(3),
     display: "flex",
     flexDirection: "row",
     justifyContent: "space-between",
-  },
-  description: {
+  }),
+  description: (theme) => ({
     color: theme.palette.text.secondary,
     fontSize: 16,
     marginTop: theme.spacing(0.5),
     lineHeight: "140%",
-  },
-}))
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/components/SettingsLayout/SectionAction.tsx b/site/src/components/SettingsLayout/SectionAction.tsx
new file mode 100644
index 0000000000000..117940641307a
--- /dev/null
+++ b/site/src/components/SettingsLayout/SectionAction.tsx
@@ -0,0 +1,19 @@
+import { makeStyles } from "@mui/styles";
+import { FC } from "react";
+
+const useStyles = makeStyles((theme) => ({
+  root: {
+    marginTop: theme.spacing(3),
+  },
+}));
+
+/**
+ * SectionAction is a content box that call to actions should be placed
+ * within
+ */
+export const SectionAction: FC<React.PropsWithChildren<unknown>> = ({
+  children,
+}) => {
+  const styles = useStyles();
+  return <div className={styles.root}>{children}</div>;
+};
diff --git a/site/src/components/SettingsLayout/SettingsLayout.tsx b/site/src/components/SettingsLayout/SettingsLayout.tsx
index d2a23f35a37ab..f950588829e45 100644
--- a/site/src/components/SettingsLayout/SettingsLayout.tsx
+++ b/site/src/components/SettingsLayout/SettingsLayout.tsx
@@ -1,17 +1,17 @@
-import { makeStyles } from "@mui/styles"
-import { Sidebar } from "./Sidebar"
-import { Stack } from "components/Stack/Stack"
-import { FC, Suspense } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "../../utils/page"
-import { Margins } from "../Margins/Margins"
-import { useMe } from "hooks/useMe"
-import { Loader } from "components/Loader/Loader"
-import { Outlet } from "react-router-dom"
+import { makeStyles } from "@mui/styles";
+import { Sidebar } from "./Sidebar";
+import { Stack } from "components/Stack/Stack";
+import { FC, Suspense } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { Margins } from "../Margins/Margins";
+import { useMe } from "hooks/useMe";
+import { Loader } from "components/Loader/Loader";
+import { Outlet } from "react-router-dom";
 
 export const SettingsLayout: FC = () => {
-  const styles = useStyles()
-  const me = useMe()
+  const styles = useStyles();
+  const me = useMe();
 
   return (
     <>
@@ -30,8 +30,8 @@ export const SettingsLayout: FC = () => {
         </Stack>
       </Margins>
     </>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   wrapper: {
@@ -42,4 +42,4 @@ const useStyles = makeStyles((theme) => ({
     maxWidth: 800,
     width: "100%",
   },
-}))
+}));
diff --git a/site/src/components/SettingsLayout/Sidebar.tsx b/site/src/components/SettingsLayout/Sidebar.tsx
index e67c229f9e11f..54a9c2a66680f 100644
--- a/site/src/components/SettingsLayout/Sidebar.tsx
+++ b/site/src/components/SettingsLayout/Sidebar.tsx
@@ -1,19 +1,21 @@
-import { makeStyles } from "@mui/styles"
-import VpnKeyOutlined from "@mui/icons-material/VpnKeyOutlined"
-import FingerprintOutlinedIcon from "@mui/icons-material/FingerprintOutlined"
-import { User } from "api/typesGenerated"
-import { Stack } from "components/Stack/Stack"
-import { UserAvatar } from "components/UserAvatar/UserAvatar"
-import { FC, ElementType, PropsWithChildren, ReactNode } from "react"
-import { NavLink } from "react-router-dom"
-import { combineClasses } from "utils/combineClasses"
-import AccountIcon from "@mui/icons-material/Person"
-import SecurityIcon from "@mui/icons-material/LockOutlined"
+import { makeStyles } from "@mui/styles";
+import VpnKeyOutlined from "@mui/icons-material/VpnKeyOutlined";
+import FingerprintOutlinedIcon from "@mui/icons-material/FingerprintOutlined";
+import { User } from "api/typesGenerated";
+import { Stack } from "components/Stack/Stack";
+import { UserAvatar } from "components/UserAvatar/UserAvatar";
+import { FC, ElementType, PropsWithChildren, ReactNode } from "react";
+import { NavLink } from "react-router-dom";
+import { combineClasses } from "utils/combineClasses";
+import AccountIcon from "@mui/icons-material/Person";
+import ScheduleIcon from "@mui/icons-material/EditCalendarOutlined";
+import SecurityIcon from "@mui/icons-material/LockOutlined";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
 
 const SidebarNavItem: FC<
   PropsWithChildren<{ href: string; icon: ReactNode }>
 > = ({ children, href, icon }) => {
-  const styles = useStyles()
+  const styles = useStyles();
   return (
     <NavLink
       to={href}
@@ -29,18 +31,21 @@ const SidebarNavItem: FC<
         {children}
       </Stack>
     </NavLink>
-  )
-}
+  );
+};
 
 const SidebarNavItemIcon: React.FC<{ icon: ElementType }> = ({
   icon: Icon,
 }) => {
-  const styles = useStyles()
-  return <Icon className={styles.sidebarNavItemIcon} />
-}
+  const styles = useStyles();
+  return <Icon className={styles.sidebarNavItemIcon} />;
+};
 
 export const Sidebar: React.FC<{ user: User }> = ({ user }) => {
-  const styles = useStyles()
+  const styles = useStyles();
+  const { entitlements } = useDashboard();
+  const allowAutostopRequirement =
+    entitlements.features.template_autostop_requirement.enabled;
 
   return (
     <nav className={styles.sidebar}>
@@ -58,6 +63,14 @@ export const Sidebar: React.FC<{ user: User }> = ({ user }) => {
       >
         Account
       </SidebarNavItem>
+      {allowAutostopRequirement && (
+        <SidebarNavItem
+          href="schedule"
+          icon={<SidebarNavItemIcon icon={ScheduleIcon} />}
+        >
+          Schedule
+        </SidebarNavItem>
+      )}
       <SidebarNavItem
         href="security"
         icon={<SidebarNavItemIcon icon={SecurityIcon} />}
@@ -77,8 +90,8 @@ export const Sidebar: React.FC<{ user: User }> = ({ user }) => {
         Tokens
       </SidebarNavItem>
     </nav>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   sidebar: {
@@ -139,4 +152,4 @@ const useStyles = makeStyles((theme) => ({
     overflow: "hidden",
     textOverflow: "ellipsis",
   },
-}))
+}));
diff --git a/site/src/components/SettingsSecurityForm/SettingsSecurityForm.stories.tsx b/site/src/components/SettingsSecurityForm/SettingsSecurityForm.stories.tsx
deleted file mode 100644
index 506b81270eebc..0000000000000
--- a/site/src/components/SettingsSecurityForm/SettingsSecurityForm.stories.tsx
+++ /dev/null
@@ -1,43 +0,0 @@
-import { Story } from "@storybook/react"
-import { SecurityForm, SecurityFormProps } from "./SettingsSecurityForm"
-import { mockApiError } from "testHelpers/entities"
-
-export default {
-  title: "components/SettingsSecurityForm",
-  component: SecurityForm,
-  argTypes: {
-    onSubmit: { action: "Submit" },
-  },
-}
-
-const Template: Story<SecurityFormProps> = (args: SecurityFormProps) => (
-  <SecurityForm {...args} />
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  isLoading: false,
-  onSubmit: () => {
-    return Promise.resolve()
-  },
-}
-
-export const Loading = Template.bind({})
-Loading.args = {
-  ...Example.args,
-  isLoading: true,
-}
-
-export const WithError = Template.bind({})
-WithError.args = {
-  ...Example.args,
-  error: mockApiError({
-    message: "Old password is incorrect",
-    validations: [
-      {
-        field: "old_password",
-        detail: "Old password is incorrect.",
-      },
-    ],
-  }),
-}
diff --git a/site/src/components/Sidebar/Sidebar.tsx b/site/src/components/Sidebar/Sidebar.tsx
new file mode 100644
index 0000000000000..df614fcc622d7
--- /dev/null
+++ b/site/src/components/Sidebar/Sidebar.tsx
@@ -0,0 +1,44 @@
+import Box, { BoxProps } from "@mui/material/Box";
+import { styled } from "@mui/styles";
+import { colors } from "theme/colors";
+
+export const Sidebar = styled((props: BoxProps) => (
+  <Box {...props} component="nav" />
+))(({ theme }) => ({
+  width: theme.spacing(32),
+  flexShrink: 0,
+  borderRight: `1px solid ${theme.palette.divider}`,
+  height: "100%",
+  overflowY: "auto",
+}));
+
+export const SidebarItem = styled(
+  ({ active, ...props }: BoxProps & { active?: boolean }) => (
+    <Box component="button" {...props} />
+  ),
+)(({ theme, active }) => ({
+  background: active ? colors.gray[13] : "none",
+  border: "none",
+  fontSize: 14,
+  width: "100%",
+  textAlign: "left",
+  padding: theme.spacing(0, 3),
+  cursor: "pointer",
+  pointerEvents: active ? "none" : "auto",
+  color: active ? theme.palette.text.primary : theme.palette.text.secondary,
+  "&:hover": {
+    background: theme.palette.action.hover,
+    color: theme.palette.text.primary,
+  },
+  paddingTop: theme.spacing(1.25),
+  paddingBottom: theme.spacing(1.25),
+}));
+
+export const SidebarCaption = styled(Box)(({ theme }) => ({
+  fontSize: 10,
+  textTransform: "uppercase",
+  fontWeight: 500,
+  color: theme.palette.text.secondary,
+  padding: theme.spacing(1.5, 3),
+  letterSpacing: "0.5px",
+}));
diff --git a/site/src/components/SignInForm/PasswordSignInForm.tsx b/site/src/components/SignInForm/PasswordSignInForm.tsx
deleted file mode 100644
index 1e12a834dac66..0000000000000
--- a/site/src/components/SignInForm/PasswordSignInForm.tsx
+++ /dev/null
@@ -1,75 +0,0 @@
-import { Stack } from "../Stack/Stack"
-import TextField from "@mui/material/TextField"
-import { getFormHelpers, onChangeTrimmed } from "../../utils/formUtils"
-import { LoadingButton } from "../LoadingButton/LoadingButton"
-import { Language } from "./SignInForm"
-import { FormikContextType, FormikTouched, useFormik } from "formik"
-import * as Yup from "yup"
-import { FC } from "react"
-import { BuiltInAuthFormValues } from "./SignInForm.types"
-
-type PasswordSignInFormProps = {
-  onSubmit: (credentials: { email: string; password: string }) => void
-  initialTouched?: FormikTouched<BuiltInAuthFormValues>
-  isSigningIn: boolean
-}
-
-export const PasswordSignInForm: FC<PasswordSignInFormProps> = ({
-  onSubmit,
-  initialTouched,
-  isSigningIn,
-}) => {
-  const validationSchema = Yup.object({
-    email: Yup.string()
-      .trim()
-      .email(Language.emailInvalid)
-      .required(Language.emailRequired),
-    password: Yup.string(),
-  })
-
-  const form: FormikContextType<BuiltInAuthFormValues> =
-    useFormik<BuiltInAuthFormValues>({
-      initialValues: {
-        email: "",
-        password: "",
-      },
-      validationSchema,
-      onSubmit,
-      initialTouched,
-    })
-  const getFieldHelpers = getFormHelpers<BuiltInAuthFormValues>(form)
-
-  return (
-    <form onSubmit={form.handleSubmit}>
-      <Stack spacing={2.5}>
-        <TextField
-          {...getFieldHelpers("email")}
-          onChange={onChangeTrimmed(form)}
-          autoFocus
-          autoComplete="email"
-          fullWidth
-          label={Language.emailLabel}
-          type="email"
-        />
-        <TextField
-          {...getFieldHelpers("password")}
-          autoComplete="current-password"
-          fullWidth
-          id="password"
-          label={Language.passwordLabel}
-          type="password"
-        />
-        <div>
-          <LoadingButton
-            size="large"
-            loading={isSigningIn}
-            fullWidth
-            type="submit"
-          >
-            {isSigningIn ? "" : Language.passwordSignIn}
-          </LoadingButton>
-        </div>
-      </Stack>
-    </form>
-  )
-}
diff --git a/site/src/components/SignInForm/SignInForm.stories.tsx b/site/src/components/SignInForm/SignInForm.stories.tsx
deleted file mode 100644
index ea3610e7ba49d..0000000000000
--- a/site/src/components/SignInForm/SignInForm.stories.tsx
+++ /dev/null
@@ -1,102 +0,0 @@
-import { Story } from "@storybook/react"
-import { mockApiError } from "testHelpers/entities"
-import { SignInForm, SignInFormProps } from "./SignInForm"
-
-export default {
-  title: "components/SignInForm",
-  component: SignInForm,
-  argTypes: {
-    isLoading: "boolean",
-    onSubmit: { action: "Submit" },
-  },
-}
-
-const Template: Story<SignInFormProps> = (args: SignInFormProps) => (
-  <SignInForm {...args} />
-)
-
-export const SignedOut = Template.bind({})
-SignedOut.args = {
-  isSigningIn: false,
-  onSubmit: () => {
-    return Promise.resolve()
-  },
-}
-
-export const SigningIn = Template.bind({})
-SigningIn.args = {
-  ...SignedOut.args,
-  isSigningIn: true,
-  authMethods: {
-    password: { enabled: true },
-    github: { enabled: true },
-    oidc: { enabled: false, signInText: "", iconUrl: "" },
-  },
-}
-
-export const WithError = Template.bind({})
-WithError.args = {
-  ...SignedOut.args,
-  error: mockApiError({
-    message: "Email or password was invalid",
-    validations: [
-      {
-        field: "password",
-        detail: "Password is invalid.",
-      },
-    ],
-  }),
-  initialTouched: {
-    password: true,
-  },
-}
-
-export const WithGithub = Template.bind({})
-WithGithub.args = {
-  ...SignedOut.args,
-  authMethods: {
-    password: { enabled: true },
-    github: { enabled: true },
-    oidc: { enabled: false, signInText: "", iconUrl: "" },
-  },
-}
-
-export const WithOIDC = Template.bind({})
-WithOIDC.args = {
-  ...SignedOut.args,
-  authMethods: {
-    password: { enabled: true },
-    github: { enabled: false },
-    oidc: { enabled: true, signInText: "", iconUrl: "" },
-  },
-}
-
-export const WithOIDCWithoutPassword = Template.bind({})
-WithOIDCWithoutPassword.args = {
-  ...SignedOut.args,
-  authMethods: {
-    password: { enabled: false },
-    github: { enabled: false },
-    oidc: { enabled: true, signInText: "", iconUrl: "" },
-  },
-}
-
-export const WithoutAny = Template.bind({})
-WithoutAny.args = {
-  ...SignedOut.args,
-  authMethods: {
-    password: { enabled: false },
-    github: { enabled: false },
-    oidc: { enabled: false, signInText: "", iconUrl: "" },
-  },
-}
-
-export const WithGithubAndOIDC = Template.bind({})
-WithGithubAndOIDC.args = {
-  ...SignedOut.args,
-  authMethods: {
-    password: { enabled: true },
-    github: { enabled: true },
-    oidc: { enabled: true, signInText: "", iconUrl: "" },
-  },
-}
diff --git a/site/src/components/SignInForm/SignInForm.tsx b/site/src/components/SignInForm/SignInForm.tsx
deleted file mode 100644
index 4f3411605b377..0000000000000
--- a/site/src/components/SignInForm/SignInForm.tsx
+++ /dev/null
@@ -1,158 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import { FormikTouched } from "formik"
-import { FC, useState } from "react"
-import { AuthMethods } from "../../api/typesGenerated"
-import { useTranslation } from "react-i18next"
-import { Maybe } from "../Conditionals/Maybe"
-import { PasswordSignInForm } from "./PasswordSignInForm"
-import { OAuthSignInForm } from "./OAuthSignInForm"
-import { BuiltInAuthFormValues } from "./SignInForm.types"
-import Button from "@mui/material/Button"
-import EmailIcon from "@mui/icons-material/EmailOutlined"
-import { Alert } from "components/Alert/Alert"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
-
-export const Language = {
-  emailLabel: "Email",
-  passwordLabel: "Password",
-  emailInvalid: "Please enter a valid email address.",
-  emailRequired: "Please enter an email address.",
-  passwordSignIn: "Sign In",
-  githubSignIn: "GitHub",
-  oidcSignIn: "OpenID Connect",
-}
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    width: "100%",
-  },
-  title: {
-    fontSize: theme.spacing(4),
-    fontWeight: 400,
-    margin: 0,
-    marginBottom: theme.spacing(4),
-    lineHeight: 1,
-
-    "& strong": {
-      fontWeight: 600,
-    },
-  },
-  alert: {
-    marginBottom: theme.spacing(4),
-  },
-  divider: {
-    paddingTop: theme.spacing(3),
-    paddingBottom: theme.spacing(3),
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(2),
-  },
-  dividerLine: {
-    width: "100%",
-    height: 1,
-    backgroundColor: theme.palette.divider,
-  },
-  dividerLabel: {
-    flexShrink: 0,
-    color: theme.palette.text.secondary,
-    textTransform: "uppercase",
-    fontSize: 12,
-    letterSpacing: 1,
-  },
-  icon: {
-    width: theme.spacing(2),
-    height: theme.spacing(2),
-  },
-}))
-
-export interface SignInFormProps {
-  isSigningIn: boolean
-  redirectTo: string
-  error?: unknown
-  info?: string
-  authMethods?: AuthMethods
-  onSubmit: (credentials: { email: string; password: string }) => void
-  // initialTouched is only used for testing the error state of the form.
-  initialTouched?: FormikTouched<BuiltInAuthFormValues>
-}
-
-export const SignInForm: FC<React.PropsWithChildren<SignInFormProps>> = ({
-  authMethods,
-  redirectTo,
-  isSigningIn,
-  error,
-  info,
-  onSubmit,
-  initialTouched,
-}) => {
-  const oAuthEnabled = Boolean(
-    authMethods?.github.enabled || authMethods?.oidc.enabled,
-  )
-  const passwordEnabled = authMethods?.password.enabled ?? true
-  // Hide password auth by default if any OAuth method is enabled
-  const [showPasswordAuth, setShowPasswordAuth] = useState(!oAuthEnabled)
-  const styles = useStyles()
-  const commonTranslation = useTranslation("common")
-  const loginPageTranslation = useTranslation("loginPage")
-
-  return (
-    <div className={styles.root}>
-      <h1 className={styles.title}>
-        {loginPageTranslation.t("signInTo")}{" "}
-        <strong>{commonTranslation.t("coder")}</strong>
-      </h1>
-      <Maybe condition={error !== undefined}>
-        <div className={styles.alert}>
-          <ErrorAlert error={error} />
-        </div>
-      </Maybe>
-      <Maybe condition={Boolean(info) && info !== "" && error === undefined}>
-        <div className={styles.alert}>
-          <Alert severity="info">{info}</Alert>
-        </div>
-      </Maybe>
-      <Maybe condition={passwordEnabled && showPasswordAuth}>
-        <PasswordSignInForm
-          onSubmit={onSubmit}
-          initialTouched={initialTouched}
-          isSigningIn={isSigningIn}
-        />
-      </Maybe>
-      <Maybe condition={passwordEnabled && showPasswordAuth && oAuthEnabled}>
-        <div className={styles.divider}>
-          <div className={styles.dividerLine} />
-          <div className={styles.dividerLabel}>Or</div>
-          <div className={styles.dividerLine} />
-        </div>
-      </Maybe>
-      <Maybe condition={oAuthEnabled}>
-        <OAuthSignInForm
-          isSigningIn={isSigningIn}
-          redirectTo={redirectTo}
-          authMethods={authMethods}
-        />
-      </Maybe>
-
-      <Maybe condition={!passwordEnabled && !oAuthEnabled}>
-        <Alert severity="error">No authentication methods configured!</Alert>
-      </Maybe>
-
-      <Maybe condition={passwordEnabled && !showPasswordAuth}>
-        <div className={styles.divider}>
-          <div className={styles.dividerLine} />
-          <div className={styles.dividerLabel}>Or</div>
-          <div className={styles.dividerLine} />
-        </div>
-
-        <Button
-          fullWidth
-          size="large"
-          onClick={() => setShowPasswordAuth(true)}
-          startIcon={<EmailIcon className={styles.icon} />}
-        >
-          {loginPageTranslation.t("showPassword")}
-        </Button>
-      </Maybe>
-    </div>
-  )
-}
diff --git a/site/src/components/SignInLayout/SignInLayout.tsx b/site/src/components/SignInLayout/SignInLayout.tsx
index cf223d7d8f53e..7a7c2f4b51bc8 100644
--- a/site/src/components/SignInLayout/SignInLayout.tsx
+++ b/site/src/components/SignInLayout/SignInLayout.tsx
@@ -1,49 +1,43 @@
-import { makeStyles } from "@mui/styles"
-import { FC, ReactNode } from "react"
-
-export const useStyles = makeStyles((theme) => ({
-  "@global": {
-    // Necessary for when this is on lonely pages!
-    "html, body, #root, #storybook-root": {
-      height: "100vh",
-    },
-  },
-  root: {
-    flex: 1,
-    height: "-webkit-fill-available",
-    display: "flex",
-    justifyContent: "center",
-    alignItems: "center",
-  },
-  layout: {
-    display: "flex",
-    flexDirection: "column",
-    alignItems: "center",
-  },
-  container: {
-    maxWidth: 385,
-    display: "flex",
-    flexDirection: "column",
-    alignItems: "center",
-  },
-  footer: {
-    fontSize: 12,
-    color: theme.palette.text.secondary,
-    marginTop: theme.spacing(3),
-  },
-}))
+import { type FC, type ReactNode } from "react";
 
 export const SignInLayout: FC<{ children: ReactNode }> = ({ children }) => {
-  const styles = useStyles()
-
   return (
-    <div className={styles.root}>
-      <div className={styles.layout}>
-        <div className={styles.container}>{children}</div>
-        <div className={styles.footer}>
+    <div
+      css={{
+        flex: 1,
+        height: "-webkit-fill-available",
+        display: "flex",
+        justifyContent: "center",
+        alignItems: "center",
+      }}
+    >
+      <div
+        css={{
+          display: "flex",
+          flexDirection: "column",
+          alignItems: "center",
+        }}
+      >
+        <div
+          css={{
+            maxWidth: 385,
+            display: "flex",
+            flexDirection: "column",
+            alignItems: "center",
+          }}
+        >
+          {children}
+        </div>
+        <div
+          css={(theme) => ({
+            fontSize: 12,
+            color: theme.palette.text.secondary,
+            marginTop: theme.spacing(3),
+          })}
+        >
           {`\u00a9 ${new Date().getFullYear()} Coder Technologies, Inc.`}
         </div>
       </div>
     </div>
-  )
-}
+  );
+};
diff --git a/site/src/components/Stack/Stack.stories.tsx b/site/src/components/Stack/Stack.stories.tsx
deleted file mode 100644
index 490bda1442866..0000000000000
--- a/site/src/components/Stack/Stack.stories.tsx
+++ /dev/null
@@ -1,21 +0,0 @@
-import TextField from "@mui/material/TextField"
-import { Story } from "@storybook/react"
-import { Stack, StackProps } from "./Stack"
-
-export default {
-  title: "components/Stack",
-  component: Stack,
-}
-
-const Template: Story<StackProps> = (args: StackProps) => (
-  <Stack {...args}>
-    <TextField autoFocus autoComplete="name" fullWidth label="Name" />
-    <TextField autoComplete="email" fullWidth label="Email" />
-    <TextField autoComplete="username" fullWidth label="Username" />
-  </Stack>
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  spacing: 2,
-}
diff --git a/site/src/components/Stack/Stack.tsx b/site/src/components/Stack/Stack.tsx
index b157329927229..fdb5c0b221d7c 100644
--- a/site/src/components/Stack/Stack.tsx
+++ b/site/src/components/Stack/Stack.tsx
@@ -1,62 +1,41 @@
-import { makeStyles } from "@mui/styles"
-import { CSSProperties } from "@mui/styles/withStyles"
-import { FC } from "react"
-import { ReactNode } from "react-markdown/lib/react-markdown"
-import { combineClasses } from "../../utils/combineClasses"
-
-type Direction = "column" | "row"
+import { forwardRef } from "react";
+import type { CSSObject } from "@emotion/react";
 
 export type StackProps = {
-  className?: string
-  direction?: Direction
-  spacing?: number
-  alignItems?: CSSProperties["alignItems"]
-  justifyContent?: CSSProperties["justifyContent"]
-  maxWidth?: CSSProperties["maxWidth"]
-  wrap?: CSSProperties["flexWrap"]
-} & React.HTMLProps<HTMLDivElement>
-
-type StyleProps = Omit<StackProps, "className">
-
-const useStyles = makeStyles((theme) => ({
-  stack: {
-    display: "flex",
-    flexDirection: ({ direction }: StyleProps) => direction,
-    gap: ({ spacing }: StyleProps) => spacing && theme.spacing(spacing),
-    alignItems: ({ alignItems }: StyleProps) => alignItems,
-    justifyContent: ({ justifyContent }: StyleProps) => justifyContent,
-    flexWrap: ({ wrap }: StyleProps) => wrap,
-    maxWidth: ({ maxWidth }: StyleProps) => maxWidth,
-
-    [theme.breakpoints.down("md")]: {
-      width: "100%",
-    },
-  },
-}))
+  className?: string;
+  direction?: "column" | "row";
+  spacing?: number;
+  alignItems?: CSSObject["alignItems"];
+  justifyContent?: CSSObject["justifyContent"];
+  wrap?: CSSObject["flexWrap"];
+} & React.HTMLProps<HTMLDivElement>;
 
-export const Stack: FC<StackProps & { children: ReactNode | ReactNode[] }> = ({
-  children,
-  className,
-  direction = "column",
-  spacing = 2,
-  alignItems,
-  justifyContent,
-  maxWidth,
-  wrap,
-  ...divProps
-}) => {
-  const styles = useStyles({
-    spacing,
-    direction,
+export const Stack = forwardRef<HTMLDivElement, StackProps>((props, ref) => {
+  const {
+    children,
+    direction = "column",
+    spacing = 2,
     alignItems,
     justifyContent,
     wrap,
-    maxWidth,
-  })
+    ...divProps
+  } = props;
 
   return (
-    <div {...divProps} className={combineClasses([styles.stack, className])}>
+    <div
+      {...divProps}
+      ref={ref}
+      css={(theme) => ({
+        display: "flex",
+        flexDirection: direction,
+        gap: spacing && theme.spacing(spacing),
+        alignItems: alignItems,
+        justifyContent: justifyContent,
+        flexWrap: wrap,
+        maxWidth: "100%",
+      })}
+    >
       {children}
     </div>
-  )
-}
+  );
+});
diff --git a/site/src/components/SyntaxHighlighter/SyntaxHighlighter.tsx b/site/src/components/SyntaxHighlighter/SyntaxHighlighter.tsx
index 2dfe42d17cefe..53cdb6aebb0e0 100644
--- a/site/src/components/SyntaxHighlighter/SyntaxHighlighter.tsx
+++ b/site/src/components/SyntaxHighlighter/SyntaxHighlighter.tsx
@@ -1,21 +1,21 @@
-import { ComponentProps, FC } from "react"
-import Editor, { DiffEditor, loader } from "@monaco-editor/react"
-import * as monaco from "monaco-editor"
-import { useCoderTheme } from "./coderTheme"
-import { makeStyles } from "@mui/styles"
+import { ComponentProps, FC } from "react";
+import Editor, { DiffEditor, loader } from "@monaco-editor/react";
+import * as monaco from "monaco-editor";
+import { useCoderTheme } from "./coderTheme";
+import { makeStyles } from "@mui/styles";
 
-loader.config({ monaco })
+loader.config({ monaco });
 
 export const SyntaxHighlighter: FC<{
-  value: string
-  language: string
+  value: string;
+  language: string;
   editorProps?: ComponentProps<typeof Editor> &
-    ComponentProps<typeof DiffEditor>
-  compareWith?: string
+    ComponentProps<typeof DiffEditor>;
+  compareWith?: string;
 }> = ({ value, compareWith, language, editorProps }) => {
-  const styles = useStyles()
-  const hasDiff = compareWith && value !== compareWith
-  const coderTheme = useCoderTheme()
+  const styles = useStyles();
+  const hasDiff = compareWith && value !== compareWith;
+  const coderTheme = useCoderTheme();
   const commonProps = {
     language,
     theme: coderTheme.name,
@@ -28,10 +28,10 @@ export const SyntaxHighlighter: FC<{
       readOnly: true,
     },
     ...editorProps,
-  }
+  };
 
   if (coderTheme.isLoading) {
-    return null
+    return null;
   }
 
   return (
@@ -42,8 +42,8 @@ export const SyntaxHighlighter: FC<{
         <Editor value={value} {...commonProps} />
       )}
     </div>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   wrapper: {
@@ -51,4 +51,4 @@ const useStyles = makeStyles((theme) => ({
     background: theme.palette.background.paper,
     height: "100%",
   },
-}))
+}));
diff --git a/site/src/components/SyntaxHighlighter/coderTheme.ts b/site/src/components/SyntaxHighlighter/coderTheme.ts
index f12c204d56e6e..ab890e55a2328 100644
--- a/site/src/components/SyntaxHighlighter/coderTheme.ts
+++ b/site/src/components/SyntaxHighlighter/coderTheme.ts
@@ -1,9 +1,9 @@
-import { useTheme } from "@mui/styles"
-import { useMonaco } from "@monaco-editor/react"
-import { useEffect, useState } from "react"
-import { hslToHex } from "utils/colors"
-import { editor } from "monaco-editor"
-import { Theme } from "@mui/material/styles"
+import { useTheme } from "@mui/styles";
+import { useMonaco } from "@monaco-editor/react";
+import { useEffect, useState } from "react";
+import { hslToHex } from "utils/colors";
+import { editor } from "monaco-editor";
+import { Theme } from "@mui/material/styles";
 
 // Theme based on https://github.com/brijeshb42/monaco-themes/blob/master/themes/Dracula.json
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- The theme is not typed
@@ -219,23 +219,23 @@ export const coderTheme = (theme: Theme): editor.IStandaloneThemeData => ({
     "editorIndentGuide.activeBackground": "#9D550FB0",
     "editor.selectionHighlightBorder": "#222218",
   },
-})
+});
 
 export const useCoderTheme = (): { isLoading: boolean; name: string } => {
-  const [isLoading, setIsLoading] = useState(true)
-  const monaco = useMonaco()
-  const theme = useTheme<Theme>()
-  const name = "coder"
+  const [isLoading, setIsLoading] = useState(true);
+  const monaco = useMonaco();
+  const theme = useTheme<Theme>();
+  const name = "coder";
 
   useEffect(() => {
     if (monaco) {
-      monaco.editor.defineTheme(name, coderTheme(theme))
-      setIsLoading(false)
+      monaco.editor.defineTheme(name, coderTheme(theme));
+      setIsLoading(false);
     }
-  }, [monaco, theme])
+  }, [monaco, theme]);
 
   return {
     isLoading,
     name,
-  }
-}
+  };
+};
diff --git a/site/src/components/TabPanel/TabPanel.stories.tsx b/site/src/components/TabPanel/TabPanel.stories.tsx
deleted file mode 100644
index b0dd71155a293..0000000000000
--- a/site/src/components/TabPanel/TabPanel.stories.tsx
+++ /dev/null
@@ -1,21 +0,0 @@
-import { Story } from "@storybook/react"
-import { TabPanel, TabPanelProps } from "./TabPanel"
-
-export default {
-  title: "components/TabPanel",
-  component: TabPanel,
-}
-
-const Template: Story<TabPanelProps> = (args: TabPanelProps) => (
-  <TabPanel {...args} />
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  title: "Title",
-  menuItems: [
-    { label: "OAuth Settings", path: "oauthSettings" },
-    { label: "Security", path: "oauthSettings", hasChanges: true },
-    { label: "Hardware", path: "oauthSettings" },
-  ],
-}
diff --git a/site/src/components/TabPanel/TabPanel.tsx b/site/src/components/TabPanel/TabPanel.tsx
deleted file mode 100644
index 72e6d9f628217..0000000000000
--- a/site/src/components/TabPanel/TabPanel.tsx
+++ /dev/null
@@ -1,99 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import { FC } from "react"
-import { TabSidebar, TabSidebarItem } from "../TabSidebar/TabSidebar"
-
-export interface TabPanelProps {
-  title: string
-  menuItems: TabSidebarItem[]
-}
-
-export const TabPanel: FC<React.PropsWithChildren<TabPanelProps>> = ({
-  children,
-  title,
-  menuItems,
-}) => {
-  const styles = useStyles()
-
-  return (
-    <div className={styles.root}>
-      <div className={styles.inner}>
-        <div className={styles.menuPanel}>
-          <div className={styles.title}>{title}</div>
-          <TabSidebar menuItems={menuItems} />
-        </div>
-
-        <div className={styles.contentPanel}>{children}</div>
-      </div>
-    </div>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    minHeight: 400,
-    marginBottom: theme.spacing(2),
-  },
-
-  inner: {
-    display: "flex",
-    maxWidth: 1920,
-    padding: theme.spacing(5, 3.5, 0, 4),
-
-    [theme.breakpoints.down("md")]: {
-      flexDirection: "column",
-      padding: 0,
-    },
-  },
-
-  icon: {
-    fontSize: 100,
-    position: "absolute",
-    left: -50,
-    top: 31,
-    color: theme.palette.text.secondary,
-    transition: "transform 0.3s ease",
-    zIndex: -1,
-  },
-
-  menuPanel: {
-    paddingRight: 40,
-
-    [theme.breakpoints.down("md")]: {
-      padding: 0,
-    },
-  },
-
-  title: {
-    marginTop: theme.spacing(6),
-    fontSize: 32,
-  },
-
-  contentPanel: {
-    display: "flex",
-    flexDirection: "column",
-    width: "100%",
-    maxWidth: 930,
-  },
-
-  [theme.breakpoints.up("lg")]: {
-    icon: {
-      position: "relative",
-      top: -11,
-      left: 30,
-    },
-    contentPanel: {
-      width: 930,
-    },
-  },
-
-  [theme.breakpoints.down("xl")]: {
-    contentPanel: {
-      width: 890,
-    },
-  },
-  [theme.breakpoints.down("md")]: {
-    contentPanel: {
-      width: "auto",
-    },
-  },
-}))
diff --git a/site/src/components/TabSidebar/TabSidebar.stories.tsx b/site/src/components/TabSidebar/TabSidebar.stories.tsx
deleted file mode 100644
index dea4f9b821467..0000000000000
--- a/site/src/components/TabSidebar/TabSidebar.stories.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-import { Story } from "@storybook/react"
-import { TabSidebar, TabSidebarProps } from "./TabSidebar"
-
-export default {
-  title: "components/TabSidebar",
-  component: TabSidebar,
-}
-
-const Template: Story<TabSidebarProps> = (args: TabSidebarProps) => (
-  <TabSidebar {...args} />
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  menuItems: [
-    { label: "OAuth Settings", path: "oauthSettings" },
-    { label: "Security", path: "security", hasChanges: true },
-    { label: "Hardware", path: "hardware" },
-  ],
-}
diff --git a/site/src/components/TabSidebar/TabSidebar.tsx b/site/src/components/TabSidebar/TabSidebar.tsx
deleted file mode 100644
index af92db8a5d2a1..0000000000000
--- a/site/src/components/TabSidebar/TabSidebar.tsx
+++ /dev/null
@@ -1,134 +0,0 @@
-import List from "@mui/material/List"
-import ListItem from "@mui/material/ListItem"
-import { makeStyles } from "@mui/styles"
-import { FC } from "react"
-import { NavLink } from "react-router-dom"
-import { sidePadding } from "theme/constants"
-import { combineClasses } from "../../utils/combineClasses"
-
-export interface TabSidebarItem {
-  path: string
-  label: string
-  hasChanges?: boolean
-}
-
-export interface TabSidebarProps {
-  menuItems: TabSidebarItem[]
-}
-
-export const TabSidebar: FC<React.PropsWithChildren<TabSidebarProps>> = ({
-  menuItems,
-}) => {
-  const styles = useStyles()
-
-  return (
-    <List className={styles.menu}>
-      {menuItems.map(({ hasChanges, ...tab }) => {
-        return (
-          <NavLink to={tab.path} key={tab.path} className={styles.link}>
-            {({ isActive }) => (
-              <ListItem
-                button
-                className={styles.menuItem}
-                disableRipple
-                focusRipple={false}
-                component="li"
-              >
-                <span
-                  className={combineClasses({
-                    [styles.menuItemSpan]: true,
-                    active: isActive,
-                  })}
-                >
-                  {hasChanges ? `${tab.label}*` : tab.label}
-                </span>
-              </ListItem>
-            )}
-          </NavLink>
-        )
-      })}
-    </List>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  menu: {
-    minWidth: 160,
-    marginTop: theme.spacing(5),
-
-    [theme.breakpoints.down("md")]: {
-      display: "flex",
-      borderBottom: `1px solid ${theme.palette.divider}`,
-      marginBottom: theme.spacing(2),
-      // Fit all the width
-      width: `calc(100% + ${sidePadding * 2}px)`,
-      marginLeft: -sidePadding,
-      marginTop: sidePadding,
-    },
-  },
-
-  link: {
-    textDecoration: "none",
-    flex: 1,
-  },
-
-  menuItem: {
-    letterSpacing: theme.spacing(-0.0375),
-    padding: 0,
-    fontSize: 18,
-    color: theme.palette.text.secondary,
-
-    "&.MuiListItem-button:hover": {
-      backgroundColor: "transparent",
-    },
-  },
-
-  menuItemSpan: {
-    paddingTop: theme.spacing(1.5),
-    paddingBottom: theme.spacing(1),
-    transition: "300ms all ease",
-    position: "relative",
-
-    "&:hover": {
-      color: theme.palette.text.primary,
-    },
-    "&.active": {
-      color: theme.palette.secondary.dark,
-    },
-
-    "&.active, &:hover": {
-      "&::before": {
-        opacity: 1,
-      },
-      "&::after": {
-        opacity: 1,
-      },
-    },
-
-    [theme.breakpoints.down("md")]: {
-      textAlign: "center",
-      width: "100%",
-      paddingTop: theme.spacing(2),
-      paddingBottom: theme.spacing(2),
-    },
-  },
-
-  [theme.breakpoints.up("lg")]: {
-    menuItemSpan: {
-      "&::before": {
-        content: "'{'",
-        position: "absolute",
-        left: -15,
-        opacity: 0,
-        transition: "inherit",
-      },
-      "&::after": {
-        content: "'}'",
-        position: "absolute",
-        right: -15,
-        opacity: 0,
-        transition: "inherit",
-      },
-    },
-  },
-}))
diff --git a/site/src/components/TableEmpty/TableEmpty.tsx b/site/src/components/TableEmpty/TableEmpty.tsx
index ea6fc866de73a..d08a01f969b43 100644
--- a/site/src/components/TableEmpty/TableEmpty.tsx
+++ b/site/src/components/TableEmpty/TableEmpty.tsx
@@ -1,12 +1,9 @@
-import TableCell from "@mui/material/TableCell"
-import TableRow from "@mui/material/TableRow"
-import { FC } from "react"
-import {
-  EmptyState,
-  EmptyStateProps,
-} from "../../components/EmptyState/EmptyState"
+import TableCell from "@mui/material/TableCell";
+import TableRow from "@mui/material/TableRow";
+import { FC } from "react";
+import { EmptyState, EmptyStateProps } from "components/EmptyState/EmptyState";
 
-export type TableEmptyProps = EmptyStateProps
+export type TableEmptyProps = EmptyStateProps;
 
 export const TableEmpty: FC<TableEmptyProps> = (props) => {
   return (
@@ -15,5 +12,5 @@ export const TableEmpty: FC<TableEmptyProps> = (props) => {
         <EmptyState {...props} />
       </TableCell>
     </TableRow>
-  )
-}
+  );
+};
diff --git a/site/src/components/TableLoader/TableLoader.tsx b/site/src/components/TableLoader/TableLoader.tsx
index 9c569f08b208f..72a24b4c3cdcf 100644
--- a/site/src/components/TableLoader/TableLoader.tsx
+++ b/site/src/components/TableLoader/TableLoader.tsx
@@ -1,59 +1,48 @@
-import { makeStyles } from "@mui/styles"
-import TableCell from "@mui/material/TableCell"
-import TableRow from "@mui/material/TableRow"
-import Skeleton from "@mui/material/Skeleton"
-import { AvatarDataSkeleton } from "components/AvatarData/AvatarDataSkeleton"
-import { FC } from "react"
-import { Loader } from "../Loader/Loader"
+import TableCell from "@mui/material/TableCell";
+import TableRow, { type TableRowProps } from "@mui/material/TableRow";
+import { type FC, type ReactNode, cloneElement, isValidElement } from "react";
+import { useTheme } from "@emotion/react";
+import { Loader } from "../Loader/Loader";
 
 export const TableLoader: FC = () => {
-  const styles = useStyles()
+  const theme = useTheme();
 
   return (
     <TableRow>
-      <TableCell colSpan={999} className={styles.cell}>
+      <TableCell
+        colSpan={999}
+        css={{
+          textAlign: "center",
+          height: theme.spacing(20),
+        }}
+      >
         <Loader />
       </TableCell>
     </TableRow>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  cell: {
-    textAlign: "center",
-    height: theme.spacing(20),
-  },
-}))
-
-export const TableLoaderSkeleton: FC<{
-  columns: number
-  rows?: number
-  useAvatarData?: boolean
-}> = ({ columns, rows = 4, useAvatarData = false }) => {
-  const placeholderColumns = Array(columns).fill(undefined)
-  const placeholderRows = Array(rows).fill(undefined)
+  );
+};
 
+export const TableLoaderSkeleton = ({
+  rows = 4,
+  children,
+}: {
+  rows?: number;
+  children: ReactNode;
+}) => {
+  if (!isValidElement(children)) {
+    throw new Error(
+      "TableLoaderSkeleton children must be a valid React element",
+    );
+  }
   return (
     <>
-      {placeholderRows.map((_, rowIndex) => (
-        <TableRow key={rowIndex} role="progressbar" data-testid="loader">
-          {placeholderColumns.map((_, columnIndex) => {
-            if (useAvatarData && columnIndex === 0) {
-              return (
-                <TableCell key={columnIndex}>
-                  <AvatarDataSkeleton />
-                </TableCell>
-              )
-            }
-
-            return (
-              <TableCell key={columnIndex}>
-                <Skeleton variant="text" width="25%" />
-              </TableCell>
-            )
-          })}
-        </TableRow>
-      ))}
+      {Array.from({ length: rows }, (_, i) =>
+        cloneElement(children, { key: i }),
+      )}
     </>
-  )
-}
+  );
+};
+
+export const TableRowSkeleton = (props: TableRowProps) => {
+  return <TableRow role="progressbar" data-testid="loader" {...props} />;
+};
diff --git a/site/src/components/TableRowMenu/TableRowMenu.stories.tsx b/site/src/components/TableRowMenu/TableRowMenu.stories.tsx
index 0c8a8c075dc34..53991b0245728 100644
--- a/site/src/components/TableRowMenu/TableRowMenu.stories.tsx
+++ b/site/src/components/TableRowMenu/TableRowMenu.stories.tsx
@@ -1,26 +1,24 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { TableRowMenu, TableRowMenuProps } from "./TableRowMenu"
+import { TableRowMenu } from "./TableRowMenu";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
+const meta: Meta<typeof TableRowMenu> = {
   title: "components/TableRowMenu",
   component: TableRowMenu,
-} as ComponentMeta<typeof TableRowMenu>
+};
 
-type DataType = {
-  id: string
-}
+export default meta;
+type Story = StoryObj<typeof TableRowMenu<{ id: string }>>;
 
-const Template: Story<TableRowMenuProps<DataType>> = (args) => (
-  <TableRowMenu {...args} />
-)
+const Example: Story = {
+  args: {
+    data: { id: "123" },
+    menuItems: [
+      { label: "Suspend", onClick: (data) => alert(data.id), disabled: false },
+      { label: "Update", onClick: (data) => alert(data.id), disabled: false },
+      { label: "Delete", onClick: (data) => alert(data.id), disabled: false },
+      { label: "Explode", onClick: (data) => alert(data.id), disabled: true },
+    ],
+  },
+};
 
-export const Example = Template.bind({})
-Example.args = {
-  data: { id: "123" },
-  menuItems: [
-    { label: "Suspend", onClick: (data) => alert(data.id), disabled: false },
-    { label: "Update", onClick: (data) => alert(data.id), disabled: false },
-    { label: "Delete", onClick: (data) => alert(data.id), disabled: false },
-    { label: "Explode", onClick: (data) => alert(data.id), disabled: true },
-  ],
-}
+export { Example as TableRowMenu };
diff --git a/site/src/components/TableRowMenu/TableRowMenu.tsx b/site/src/components/TableRowMenu/TableRowMenu.tsx
index 15a4bae33d170..e4e81954b71b5 100644
--- a/site/src/components/TableRowMenu/TableRowMenu.tsx
+++ b/site/src/components/TableRowMenu/TableRowMenu.tsx
@@ -1,31 +1,31 @@
-import IconButton from "@mui/material/IconButton"
-import Menu, { MenuProps } from "@mui/material/Menu"
-import MenuItem from "@mui/material/MenuItem"
-import MoreVertIcon from "@mui/icons-material/MoreVert"
-import { MouseEvent, useState } from "react"
+import IconButton from "@mui/material/IconButton";
+import Menu, { MenuProps } from "@mui/material/Menu";
+import MenuItem from "@mui/material/MenuItem";
+import MoreVertIcon from "@mui/icons-material/MoreVert";
+import { MouseEvent, useState } from "react";
 
 export interface TableRowMenuProps<TData> {
-  data: TData
+  data: TData;
   menuItems: Array<{
-    label: React.ReactNode
-    disabled: boolean
-    onClick: (data: TData) => void
-  }>
+    label: React.ReactNode;
+    disabled: boolean;
+    onClick: (data: TData) => void;
+  }>;
 }
 
 export const TableRowMenu = <T,>({
   data,
   menuItems,
 }: TableRowMenuProps<T>): JSX.Element => {
-  const [anchorEl, setAnchorEl] = useState<MenuProps["anchorEl"]>(null)
+  const [anchorEl, setAnchorEl] = useState<MenuProps["anchorEl"]>(null);
 
   const handleClick = (event: MouseEvent) => {
-    setAnchorEl(event.currentTarget)
-  }
+    setAnchorEl(event.currentTarget);
+  };
 
   const handleClose = () => {
-    setAnchorEl(null)
-  }
+    setAnchorEl(null);
+  };
 
   return (
     <>
@@ -50,8 +50,8 @@ export const TableRowMenu = <T,>({
             key={index}
             disabled={item.disabled}
             onClick={() => {
-              handleClose()
-              item.onClick(data)
+              handleClose();
+              item.onClick(data);
             }}
           >
             {item.label}
@@ -59,5 +59,5 @@ export const TableRowMenu = <T,>({
         ))}
       </Menu>
     </>
-  )
-}
+  );
+};
diff --git a/site/src/components/TableToolbar/TableToolbar.tsx b/site/src/components/TableToolbar/TableToolbar.tsx
new file mode 100644
index 0000000000000..9c5ef7708f278
--- /dev/null
+++ b/site/src/components/TableToolbar/TableToolbar.tsx
@@ -0,0 +1,48 @@
+import { styled } from "@mui/material/styles";
+import Box from "@mui/material/Box";
+import Skeleton from "@mui/material/Skeleton";
+
+export const TableToolbar = styled(Box)(({ theme }) => ({
+  fontSize: 13,
+  marginBottom: theme.spacing(1),
+  marginTop: theme.spacing(0),
+  height: 36, // The size of a small button
+  color: theme.palette.text.secondary,
+  "& strong": { color: theme.palette.text.primary },
+  display: "flex",
+  alignItems: "center",
+}));
+
+type BasePaginationStatusProps = {
+  label: string;
+  isLoading: boolean;
+  showing?: number;
+  total?: number;
+};
+
+type LoadedPaginationStatusProps = BasePaginationStatusProps & {
+  isLoading: false;
+  showing: number;
+  total: number;
+};
+
+export const PaginationStatus = ({
+  isLoading,
+  showing,
+  total,
+  label,
+}: BasePaginationStatusProps | LoadedPaginationStatusProps) => {
+  if (isLoading) {
+    return (
+      <Box sx={{ height: 24, display: "flex", alignItems: "center" }}>
+        <Skeleton variant="text" width={160} height={16} />
+      </Box>
+    );
+  }
+  return (
+    <Box>
+      Showing <strong>{showing}</strong> of{" "}
+      <strong>{total?.toLocaleString()}</strong> {label}
+    </Box>
+  );
+};
diff --git a/site/src/components/Tabs/Tabs.tsx b/site/src/components/Tabs/Tabs.tsx
new file mode 100644
index 0000000000000..b7e6c6de61eb7
--- /dev/null
+++ b/site/src/components/Tabs/Tabs.tsx
@@ -0,0 +1,71 @@
+import { ReactNode } from "react";
+import { NavLink, NavLinkProps } from "react-router-dom";
+import { combineClasses } from "utils/combineClasses";
+import { Margins } from "components/Margins/Margins";
+import { css } from "@emotion/css";
+import { useTheme } from "@mui/material/styles";
+
+export const Tabs = ({ children }: { children: ReactNode }) => {
+  return (
+    <div
+      css={(theme) => ({
+        borderBottom: `1px solid ${theme.palette.divider}`,
+        marginBottom: theme.spacing(5),
+      })}
+    >
+      <Margins
+        css={(theme) => ({
+          display: "flex",
+          alignItems: "center",
+          gap: theme.spacing(0.25),
+        })}
+      >
+        {children}
+      </Margins>
+    </div>
+  );
+};
+
+export const TabLink = (props: NavLinkProps) => {
+  const theme = useTheme();
+
+  const baseTabLink = css`
+    text-decoration: none;
+    color: ${theme.palette.text.secondary};
+    font-size: 14px;
+    display: block;
+    padding: ${theme.spacing(0, 2, 2)};
+
+    &:hover {
+      color: ${theme.palette.text.primary};
+    }
+  `;
+
+  const activeTabLink = css`
+    color: ${theme.palette.text.primary};
+    position: relative;
+
+    &:before {
+      content: "";
+      left: 0;
+      bottom: 0;
+      height: 2px;
+      width: 100%;
+      background: ${theme.palette.secondary.dark};
+      position: absolute;
+    }
+  `;
+
+  return (
+    <NavLink
+      className={({ isActive }) =>
+        combineClasses([
+          baseTabLink,
+          isActive ? activeTabLink : undefined,
+          props.className as string,
+        ])
+      }
+      {...props}
+    />
+  );
+};
diff --git a/site/src/components/TemplateExampleCard/TemplateExampleCard.tsx b/site/src/components/TemplateExampleCard/TemplateExampleCard.tsx
index 11e420ed18732..7b0bba7a3929b 100644
--- a/site/src/components/TemplateExampleCard/TemplateExampleCard.tsx
+++ b/site/src/components/TemplateExampleCard/TemplateExampleCard.tsx
@@ -1,19 +1,19 @@
-import { makeStyles } from "@mui/styles"
-import { TemplateExample } from "api/typesGenerated"
-import { FC } from "react"
-import { Link } from "react-router-dom"
-import { combineClasses } from "utils/combineClasses"
+import { makeStyles } from "@mui/styles";
+import { TemplateExample } from "api/typesGenerated";
+import { FC } from "react";
+import { Link } from "react-router-dom";
+import { combineClasses } from "utils/combineClasses";
 
 export interface TemplateExampleCardProps {
-  example: TemplateExample
-  className?: string
+  example: TemplateExample;
+  className?: string;
 }
 
 export const TemplateExampleCard: FC<TemplateExampleCardProps> = ({
   example,
   className,
 }) => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <Link
@@ -31,8 +31,8 @@ export const TemplateExampleCard: FC<TemplateExampleCardProps> = ({
         </span>
       </div>
     </Link>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   template: {
@@ -87,4 +87,4 @@ const useStyles = makeStyles((theme) => ({
     overflow: "hidden",
     whiteSpace: "nowrap",
   },
-}))
+}));
diff --git a/site/src/components/TemplateFiles/TemplateFiles.tsx b/site/src/components/TemplateFiles/TemplateFiles.tsx
index 11bc49397f4bb..8688cb96b9f2d 100644
--- a/site/src/components/TemplateFiles/TemplateFiles.tsx
+++ b/site/src/components/TemplateFiles/TemplateFiles.tsx
@@ -1,58 +1,65 @@
-import { makeStyles } from "@mui/styles"
-import { DockerIcon } from "components/Icons/DockerIcon"
-import { MarkdownIcon } from "components/Icons/MarkdownIcon"
-import { TerraformIcon } from "components/Icons/TerraformIcon"
-import { SyntaxHighlighter } from "components/SyntaxHighlighter/SyntaxHighlighter"
-import { UseTabResult } from "hooks/useTab"
-import { FC } from "react"
-import { combineClasses } from "utils/combineClasses"
-import { TemplateVersionFiles } from "utils/templateVersion"
-
-const iconByExtension: Record<string, JSX.Element> = {
+import { makeStyles } from "@mui/styles";
+import { DockerIcon } from "components/Icons/DockerIcon";
+import { MarkdownIcon } from "components/Icons/MarkdownIcon";
+import { TerraformIcon } from "components/Icons/TerraformIcon";
+import { SyntaxHighlighter } from "components/SyntaxHighlighter/SyntaxHighlighter";
+import { UseTabResult } from "hooks/useTab";
+import { FC } from "react";
+import { combineClasses } from "utils/combineClasses";
+import { AllowedExtension, TemplateVersionFiles } from "utils/templateVersion";
+import InsertDriveFileOutlined from "@mui/icons-material/InsertDriveFileOutlined";
+
+const iconByExtension: Record<AllowedExtension, JSX.Element> = {
   tf: <TerraformIcon />,
   md: <MarkdownIcon />,
   mkd: <MarkdownIcon />,
   Dockerfile: <DockerIcon />,
-}
+  protobuf: <InsertDriveFileOutlined />,
+  sh: <InsertDriveFileOutlined />,
+  tpl: <InsertDriveFileOutlined />,
+};
 
 const getExtension = (filename: string) => {
   if (filename.includes(".")) {
-    const [_, extension] = filename.split(".")
-    return extension
+    const [_, extension] = filename.split(".");
+    return extension;
   }
 
-  return filename
-}
+  return filename;
+};
 
-const languageByExtension: Record<string, string> = {
+const languageByExtension: Record<AllowedExtension, string> = {
   tf: "hcl",
   md: "markdown",
   mkd: "markdown",
   Dockerfile: "dockerfile",
-}
+  sh: "bash",
+  tpl: "tpl",
+  protobuf: "protobuf",
+};
 
 export const TemplateFiles: FC<{
-  currentFiles: TemplateVersionFiles
-  previousFiles?: TemplateVersionFiles
-  tab: UseTabResult
+  currentFiles: TemplateVersionFiles;
+  previousFiles?: TemplateVersionFiles;
+  tab: UseTabResult;
 }> = ({ currentFiles, previousFiles, tab }) => {
-  const styles = useStyles()
-  const filenames = Object.keys(currentFiles)
-  const selectedFilename = filenames[Number(tab.value)]
-  const currentFile = currentFiles[selectedFilename]
-  const previousFile = previousFiles && previousFiles[selectedFilename]
+  const styles = useStyles();
+  const filenames = Object.keys(currentFiles);
+  const selectedFilename = filenames[Number(tab.value)];
+  const currentFile = currentFiles[selectedFilename];
+  const previousFile = previousFiles && previousFiles[selectedFilename];
 
   return (
     <div className={styles.files}>
       <div className={styles.tabs}>
         {filenames.map((filename, index) => {
-          const tabValue = index.toString()
-          const extension = getExtension(filename)
-          const icon = iconByExtension[extension]
+          const tabValue = index.toString();
+          const extension = getExtension(filename) as AllowedExtension;
+          const icon = iconByExtension[extension];
           const hasDiff =
             previousFiles &&
             previousFiles[filename] &&
-            currentFiles[filename] !== previousFiles[filename]
+            currentFiles[filename] !== previousFiles[filename];
 
           return (
             <button
@@ -61,7 +68,7 @@ export const TemplateFiles: FC<{
                 [styles.tabActive]: tabValue === tab.value,
               })}
               onClick={() => {
-                tab.set(tabValue)
+                tab.set(tabValue);
               }}
               key={filename}
             >
@@ -69,24 +76,29 @@ export const TemplateFiles: FC<{
               {filename}
               {hasDiff && <div className={styles.tabDiff} />}
             </button>
-          )
+          );
         })}
       </div>
 
       <SyntaxHighlighter
         value={currentFile}
         compareWith={previousFile}
-        language={languageByExtension[getExtension(selectedFilename)]}
+        language={
+          languageByExtension[
+            getExtension(selectedFilename) as AllowedExtension
+          ]
+        }
       />
     </div>
-  )
-}
+  );
+};
 const useStyles = makeStyles((theme) => ({
   tabs: {
     display: "flex",
     alignItems: "baseline",
     borderBottom: `1px solid ${theme.palette.divider}`,
     gap: 1,
+    overflowX: "auto",
   },
 
   tab: {
@@ -101,6 +113,7 @@ const useStyles = makeStyles((theme) => ({
     gap: theme.spacing(0.5),
     position: "relative",
     color: theme.palette.text.secondary,
+    whiteSpace: "nowrap",
 
     "& svg": {
       width: 22,
@@ -149,4 +162,4 @@ const useStyles = makeStyles((theme) => ({
   prism: {
     borderRadius: 0,
   },
-}))
+}));
diff --git a/site/src/components/TemplateFiles/hooks.ts b/site/src/components/TemplateFiles/hooks.ts
new file mode 100644
index 0000000000000..6d21538f8c3db
--- /dev/null
+++ b/site/src/components/TemplateFiles/hooks.ts
@@ -0,0 +1,68 @@
+import { TemplateVersion } from "api/typesGenerated";
+import { useTab } from "hooks/useTab";
+import { useEffect } from "react";
+import { useQuery } from "react-query";
+import {
+  TemplateVersionFiles,
+  getTemplateVersionFiles,
+} from "utils/templateVersion";
+import * as API from "api/api";
+
+export const useFileTab = (templateFiles: TemplateVersionFiles | undefined) => {
+  // Tabs The default tab is the tab that has main.tf but until we loads the
+  // files and check if main.tf exists we don't know which tab is the default
+  // one so we just use empty string
+  const tab = useTab("file", "");
+  const isLoaded = tab.value !== "";
+  useEffect(() => {
+    if (templateFiles && !isLoaded) {
+      const terraformFileIndex = Object.keys(templateFiles).indexOf("main.tf");
+      // If main.tf exists use the index if not just use the first tab
+      tab.set(terraformFileIndex !== -1 ? terraformFileIndex.toString() : "0");
+    }
+  }, [isLoaded, tab, templateFiles]);
+
+  return {
+    ...tab,
+    isLoaded,
+  };
+};
+
+export const useTemplateFiles = (
+  templateName: string,
+  version: TemplateVersion | undefined,
+) => {
+  return useQuery({
+    queryKey: ["templateFiles", templateName, version],
+    queryFn: () => {
+      if (!version) {
+        return;
+      }
+      return getTemplateFilesWithDiff(templateName, version);
+    },
+    enabled: version !== undefined,
+  });
+};
+
+const getTemplateFilesWithDiff = async (
+  templateName: string,
+  version: TemplateVersion,
+) => {
+  const previousVersion = await API.getPreviousTemplateVersionByName(
+    version.organization_id!,
+    templateName,
+    version.name,
+  );
+  const loadFilesPromises: ReturnType<typeof getTemplateVersionFiles>[] = [];
+  loadFilesPromises.push(getTemplateVersionFiles(version.job.file_id));
+  if (previousVersion) {
+    loadFilesPromises.push(
+      getTemplateVersionFiles(previousVersion.job.file_id),
+    );
+  }
+  const [currentFiles, previousFiles] = await Promise.all(loadFilesPromises);
+  return {
+    currentFiles,
+    previousFiles,
+  };
+};
diff --git a/site/src/components/TemplateLayout/TemplateLayout.tsx b/site/src/components/TemplateLayout/TemplateLayout.tsx
deleted file mode 100644
index e407dc46e8cf3..0000000000000
--- a/site/src/components/TemplateLayout/TemplateLayout.tsx
+++ /dev/null
@@ -1,224 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { createContext, FC, Suspense, useContext } from "react"
-import { NavLink, Outlet, useNavigate, useParams } from "react-router-dom"
-import { combineClasses } from "utils/combineClasses"
-import { Margins } from "components/Margins/Margins"
-import { Stack } from "components/Stack/Stack"
-import { Loader } from "components/Loader/Loader"
-import { TemplatePageHeader } from "./TemplatePageHeader"
-import {
-  checkAuthorization,
-  getTemplateByName,
-  getTemplateVersion,
-} from "api/api"
-import { useQuery } from "@tanstack/react-query"
-import { AuthorizationRequest } from "api/typesGenerated"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
-
-const templatePermissions = (
-  templateId: string,
-): AuthorizationRequest["checks"] => ({
-  canUpdateTemplate: {
-    object: {
-      resource_type: "template",
-      resource_id: templateId,
-    },
-    action: "update",
-  },
-})
-
-const fetchTemplate = async (orgId: string, templateName: string) => {
-  const template = await getTemplateByName(orgId, templateName)
-  const [activeVersion, permissions] = await Promise.all([
-    getTemplateVersion(template.active_version_id),
-    checkAuthorization({
-      checks: templatePermissions(template.id),
-    }),
-  ])
-
-  return {
-    template,
-    activeVersion,
-    permissions,
-  }
-}
-
-type TemplateLayoutContextValue = Awaited<ReturnType<typeof fetchTemplate>>
-
-const TemplateLayoutContext = createContext<
-  TemplateLayoutContextValue | undefined
->(undefined)
-
-export const useTemplateLayoutContext = (): TemplateLayoutContextValue => {
-  const context = useContext(TemplateLayoutContext)
-  if (!context) {
-    throw new Error(
-      "useTemplateLayoutContext only can be used inside of TemplateLayout",
-    )
-  }
-  return context
-}
-
-export const TemplateLayout: FC<{ children?: JSX.Element }> = ({
-  children = <Outlet />,
-}) => {
-  const navigate = useNavigate()
-  const styles = useStyles()
-  const orgId = useOrganizationId()
-  const { template: templateName } = useParams() as { template: string }
-  const { data, error, isLoading } = useQuery({
-    queryKey: ["template", templateName],
-    queryFn: () => fetchTemplate(orgId, templateName),
-  })
-  const shouldShowInsights = data?.permissions?.canUpdateTemplate
-
-  if (error) {
-    return (
-      <div className={styles.error}>
-        <ErrorAlert error={error} />
-      </div>
-    )
-  }
-
-  if (isLoading || !data) {
-    return <Loader />
-  }
-
-  return (
-    <>
-      <TemplatePageHeader
-        template={data.template}
-        activeVersion={data.activeVersion}
-        permissions={data.permissions}
-        onDeleteTemplate={() => {
-          navigate("/templates")
-        }}
-      />
-
-      <div className={styles.tabs}>
-        <Margins>
-          <Stack direction="row" spacing={0.25}>
-            <NavLink
-              end
-              to={`/templates/${templateName}`}
-              className={({ isActive }) =>
-                combineClasses([
-                  styles.tabItem,
-                  isActive ? styles.tabItemActive : undefined,
-                ])
-              }
-            >
-              Summary
-            </NavLink>
-            <NavLink
-              end
-              to={`/templates/${templateName}/docs`}
-              className={({ isActive }) =>
-                combineClasses([
-                  styles.tabItem,
-                  isActive ? styles.tabItemActive : undefined,
-                ])
-              }
-            >
-              Docs
-            </NavLink>
-            {data.permissions.canUpdateTemplate && (
-              <NavLink
-                to={`/templates/${templateName}/files`}
-                className={({ isActive }) =>
-                  combineClasses([
-                    styles.tabItem,
-                    isActive ? styles.tabItemActive : undefined,
-                  ])
-                }
-              >
-                Source Code
-              </NavLink>
-            )}
-            <NavLink
-              to={`/templates/${templateName}/versions`}
-              className={({ isActive }) =>
-                combineClasses([
-                  styles.tabItem,
-                  isActive ? styles.tabItemActive : undefined,
-                ])
-              }
-            >
-              Versions
-            </NavLink>
-            <NavLink
-              to={`/templates/${templateName}/embed`}
-              className={({ isActive }) =>
-                combineClasses([
-                  styles.tabItem,
-                  isActive ? styles.tabItemActive : undefined,
-                ])
-              }
-            >
-              Embed
-            </NavLink>
-            {shouldShowInsights && (
-              <NavLink
-                to={`/templates/${templateName}/insights`}
-                className={({ isActive }) =>
-                  combineClasses([
-                    styles.tabItem,
-                    isActive ? styles.tabItemActive : undefined,
-                  ])
-                }
-              >
-                Insights
-              </NavLink>
-            )}
-          </Stack>
-        </Margins>
-      </div>
-
-      <Margins>
-        <TemplateLayoutContext.Provider value={data}>
-          <Suspense fallback={<Loader />}>{children}</Suspense>
-        </TemplateLayoutContext.Provider>
-      </Margins>
-    </>
-  )
-}
-
-export const useStyles = makeStyles((theme) => {
-  return {
-    error: {
-      margin: theme.spacing(2),
-    },
-    tabs: {
-      borderBottom: `1px solid ${theme.palette.divider}`,
-      marginBottom: theme.spacing(5),
-    },
-
-    tabItem: {
-      textDecoration: "none",
-      color: theme.palette.text.secondary,
-      fontSize: 14,
-      display: "block",
-      padding: theme.spacing(0, 2, 2),
-
-      "&:hover": {
-        color: theme.palette.text.primary,
-      },
-    },
-
-    tabItemActive: {
-      color: theme.palette.text.primary,
-      position: "relative",
-
-      "&:before": {
-        content: `""`,
-        left: 0,
-        bottom: 0,
-        height: 2,
-        width: "100%",
-        background: theme.palette.secondary.dark,
-        position: "absolute",
-      },
-    },
-  }
-})
diff --git a/site/src/components/TemplateLayout/TemplatePageHeader.stories.tsx b/site/src/components/TemplateLayout/TemplatePageHeader.stories.tsx
deleted file mode 100644
index 016f0cee66a7d..0000000000000
--- a/site/src/components/TemplateLayout/TemplatePageHeader.stories.tsx
+++ /dev/null
@@ -1,32 +0,0 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { MockTemplate, MockTemplateVersion } from "testHelpers/entities"
-import {
-  TemplatePageHeader,
-  TemplatePageHeaderProps,
-} from "./TemplatePageHeader"
-
-export default {
-  title: "Components/TemplatePageHeader",
-  component: TemplatePageHeader,
-  args: {
-    template: MockTemplate,
-    activeVersion: MockTemplateVersion,
-    permissions: {
-      canUpdateTemplate: true,
-    },
-  },
-} as ComponentMeta<typeof TemplatePageHeader>
-
-const Template: Story<TemplatePageHeaderProps> = (args) => (
-  <TemplatePageHeader {...args} />
-)
-
-export const CanUpdate = Template.bind({})
-CanUpdate.args = {}
-
-export const CanNotUpdate = Template.bind({})
-CanNotUpdate.args = {
-  permissions: {
-    canUpdateTemplate: false,
-  },
-}
diff --git a/site/src/components/TemplateLayout/TemplatePageHeader.tsx b/site/src/components/TemplateLayout/TemplatePageHeader.tsx
deleted file mode 100644
index bf737da78ebae..0000000000000
--- a/site/src/components/TemplateLayout/TemplatePageHeader.tsx
+++ /dev/null
@@ -1,177 +0,0 @@
-import Button from "@mui/material/Button"
-import AddIcon from "@mui/icons-material/AddOutlined"
-import {
-  AuthorizationResponse,
-  Template,
-  TemplateVersion,
-} from "api/typesGenerated"
-import { Avatar } from "components/Avatar/Avatar"
-import { Maybe } from "components/Conditionals/Maybe"
-import { DeleteDialog } from "components/Dialogs/DeleteDialog/DeleteDialog"
-import {
-  PageHeader,
-  PageHeaderTitle,
-  PageHeaderSubtitle,
-} from "components/PageHeader/PageHeader"
-import { Stack } from "components/Stack/Stack"
-import { FC, useRef, useState } from "react"
-import { Link as RouterLink, useNavigate } from "react-router-dom"
-import { useDeleteTemplate } from "./deleteTemplate"
-import { Margins } from "components/Margins/Margins"
-import MoreVertOutlined from "@mui/icons-material/MoreVertOutlined"
-import Menu from "@mui/material/Menu"
-import MenuItem from "@mui/material/MenuItem"
-import SettingsOutlined from "@mui/icons-material/SettingsOutlined"
-import DeleteOutlined from "@mui/icons-material/DeleteOutlined"
-import EditOutlined from "@mui/icons-material/EditOutlined"
-import FileCopyOutlined from "@mui/icons-material/FileCopyOutlined"
-import IconButton from "@mui/material/IconButton"
-
-const TemplateMenu: FC<{
-  templateName: string
-  templateVersion: string
-  onDelete: () => void
-}> = ({ templateName, templateVersion, onDelete }) => {
-  const menuTriggerRef = useRef<HTMLButtonElement>(null)
-  const [isMenuOpen, setIsMenuOpen] = useState(false)
-  const navigate = useNavigate()
-
-  // Returns a function that will execute the action and close the menu
-  const onMenuItemClick = (actionFn: () => void) => () => {
-    setIsMenuOpen(false)
-
-    actionFn()
-  }
-
-  return (
-    <div>
-      <IconButton
-        aria-controls="template-options"
-        aria-haspopup="true"
-        onClick={() => setIsMenuOpen(true)}
-        ref={menuTriggerRef}
-        arial-label="More options"
-      >
-        <MoreVertOutlined />
-      </IconButton>
-
-      <Menu
-        id="template-options"
-        anchorEl={menuTriggerRef.current}
-        open={isMenuOpen}
-        onClose={() => setIsMenuOpen(false)}
-      >
-        <MenuItem
-          onClick={onMenuItemClick(() =>
-            navigate(`/templates/${templateName}/settings`),
-          )}
-        >
-          <SettingsOutlined />
-          Settings
-        </MenuItem>
-        <MenuItem
-          onClick={onMenuItemClick(() =>
-            navigate(`/templates/new?fromTemplate=${templateName}`),
-          )}
-        >
-          <FileCopyOutlined />
-          Duplicate
-        </MenuItem>
-        <MenuItem
-          onClick={onMenuItemClick(() =>
-            navigate(
-              `/templates/${templateName}/versions/${templateVersion}/edit`,
-            ),
-          )}
-        >
-          <EditOutlined />
-          Edit files
-        </MenuItem>
-        <MenuItem onClick={onMenuItemClick(onDelete)}>
-          <DeleteOutlined />
-          Delete
-        </MenuItem>
-      </Menu>
-    </div>
-  )
-}
-
-const CreateWorkspaceButton: FC<{
-  templateName: string
-  className?: string
-}> = ({ templateName }) => (
-  <Button
-    variant="contained"
-    startIcon={<AddIcon />}
-    component={RouterLink}
-    to={`/templates/${templateName}/workspace`}
-  >
-    Create Workspace
-  </Button>
-)
-
-export type TemplatePageHeaderProps = {
-  template: Template
-  activeVersion: TemplateVersion
-  permissions: AuthorizationResponse
-  onDeleteTemplate: () => void
-}
-
-export const TemplatePageHeader: FC<TemplatePageHeaderProps> = ({
-  template,
-  activeVersion,
-  permissions,
-  onDeleteTemplate,
-}) => {
-  const hasIcon = template.icon && template.icon !== ""
-  const deleteTemplate = useDeleteTemplate(template, onDeleteTemplate)
-
-  return (
-    <Margins>
-      <PageHeader
-        actions={
-          <>
-            <CreateWorkspaceButton templateName={template.name} />
-            <Maybe condition={permissions.canUpdateTemplate}>
-              <TemplateMenu
-                templateVersion={activeVersion.name}
-                templateName={template.name}
-                onDelete={deleteTemplate.openDeleteConfirmation}
-              />
-            </Maybe>
-          </>
-        }
-      >
-        <Stack direction="row" spacing={3} alignItems="center">
-          {hasIcon ? (
-            <Avatar size="xl" src={template.icon} variant="square" fitImage />
-          ) : (
-            <Avatar size="xl">{template.name}</Avatar>
-          )}
-
-          <div>
-            <PageHeaderTitle>
-              {template.display_name.length > 0
-                ? template.display_name
-                : template.name}
-            </PageHeaderTitle>
-            {template.description !== "" && (
-              <PageHeaderSubtitle condensed>
-                {template.description}
-              </PageHeaderSubtitle>
-            )}
-          </div>
-        </Stack>
-      </PageHeader>
-
-      <DeleteDialog
-        isOpen={deleteTemplate.isDeleteDialogOpen}
-        confirmLoading={deleteTemplate.state.status === "deleting"}
-        onConfirm={deleteTemplate.confirmDelete}
-        onCancel={deleteTemplate.cancelDeleteConfirmation}
-        entity="template"
-        name={template.name}
-      />
-    </Margins>
-  )
-}
diff --git a/site/src/components/TemplateLayout/deleteTemplate.test.ts b/site/src/components/TemplateLayout/deleteTemplate.test.ts
deleted file mode 100644
index c573db4951818..0000000000000
--- a/site/src/components/TemplateLayout/deleteTemplate.test.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import { act, renderHook, waitFor } from "@testing-library/react"
-import { MockTemplate } from "testHelpers/entities"
-import { useDeleteTemplate } from "./deleteTemplate"
-import * as API from "api/api"
-
-test("delete dialog starts closed", () => {
-  const { result } = renderHook(() =>
-    useDeleteTemplate(MockTemplate, jest.fn()),
-  )
-  expect(result.current.isDeleteDialogOpen).toBeFalsy()
-})
-
-test("confirm template deletion", async () => {
-  const onDeleteTemplate = jest.fn()
-  const { result } = renderHook(() =>
-    useDeleteTemplate(MockTemplate, onDeleteTemplate),
-  )
-
-  //Open delete confirmation
-  act(() => {
-    result.current.openDeleteConfirmation()
-  })
-  expect(result.current.isDeleteDialogOpen).toBeTruthy()
-
-  // Confirm delete
-  jest.spyOn(API, "deleteTemplate")
-  await act(async () => result.current.confirmDelete())
-  await waitFor(() => expect(API.deleteTemplate).toBeCalledTimes(1))
-  expect(onDeleteTemplate).toBeCalledTimes(1)
-})
-
-test("cancel template deletion", () => {
-  const { result } = renderHook(() =>
-    useDeleteTemplate(MockTemplate, jest.fn()),
-  )
-
-  //Open delete confirmation
-  act(() => {
-    result.current.openDeleteConfirmation()
-  })
-  expect(result.current.isDeleteDialogOpen).toBeTruthy()
-
-  // Cancel deletion
-  act(() => {
-    result.current.cancelDeleteConfirmation()
-  })
-  expect(result.current.isDeleteDialogOpen).toBeFalsy()
-})
diff --git a/site/src/components/TemplateLayout/deleteTemplate.ts b/site/src/components/TemplateLayout/deleteTemplate.ts
deleted file mode 100644
index 9a56a7f2be206..0000000000000
--- a/site/src/components/TemplateLayout/deleteTemplate.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-import { deleteTemplate } from "api/api"
-import { getErrorMessage } from "api/errors"
-import { Template } from "api/typesGenerated"
-import { displayError } from "components/GlobalSnackbar/utils"
-import { useState } from "react"
-
-type DeleteTemplateState =
-  | { status: "idle" }
-  | { status: "confirming" }
-  | { status: "deleting" }
-
-export const useDeleteTemplate = (template: Template, onDelete: () => void) => {
-  const [state, setState] = useState<DeleteTemplateState>({ status: "idle" })
-  const isDeleteDialogOpen =
-    state.status === "confirming" || state.status === "deleting"
-
-  const openDeleteConfirmation = () => {
-    setState({ status: "confirming" })
-  }
-
-  const cancelDeleteConfirmation = () => {
-    setState({ status: "idle" })
-  }
-
-  const confirmDelete = async () => {
-    try {
-      setState({ status: "deleting" })
-      await deleteTemplate(template.id)
-      onDelete()
-    } catch (e) {
-      setState({ status: "confirming" })
-      displayError(getErrorMessage(e, "Failed to delete template"))
-    }
-  }
-
-  return {
-    state,
-    isDeleteDialogOpen,
-    openDeleteConfirmation,
-    cancelDeleteConfirmation,
-    confirmDelete,
-  }
-}
diff --git a/site/src/components/TemplateParameters/TemplateParameters.tsx b/site/src/components/TemplateParameters/TemplateParameters.tsx
index fbd4a6c1d1541..9befc7c74051f 100644
--- a/site/src/components/TemplateParameters/TemplateParameters.tsx
+++ b/site/src/components/TemplateParameters/TemplateParameters.tsx
@@ -1,24 +1,24 @@
-import { TemplateVersionParameter } from "api/typesGenerated"
-import { FormSection, FormFields } from "components/Form/Form"
+import { TemplateVersionParameter } from "api/typesGenerated";
+import { FormSection, FormFields } from "components/Form/Form";
 import {
   RichParameterInput,
   RichParameterInputProps,
-} from "components/RichParameterInput/RichParameterInput"
-import { ComponentProps, FC } from "react"
+} from "components/RichParameterInput/RichParameterInput";
+import { ComponentProps, FC } from "react";
 
 export type TemplateParametersSectionProps = {
-  templateParameters: TemplateVersionParameter[]
+  templateParameters: TemplateVersionParameter[];
   getInputProps: (
     parameter: TemplateVersionParameter,
     index: number,
-  ) => Omit<RichParameterInputProps, "parameter" | "index">
-} & Pick<ComponentProps<typeof FormSection>, "classes">
+  ) => Omit<RichParameterInputProps, "parameter" | "index">;
+} & Pick<ComponentProps<typeof FormSection>, "classes">;
 
 export const MutableTemplateParametersSection: FC<
   TemplateParametersSectionProps
 > = ({ templateParameters, getInputProps, ...formSectionProps }) => {
   const hasMutableParameters =
-    templateParameters.filter((p) => p.mutable).length > 0
+    templateParameters.filter((p) => p.mutable).length > 0;
 
   return (
     <>
@@ -26,7 +26,7 @@ export const MutableTemplateParametersSection: FC<
         <FormSection
           {...formSectionProps}
           title="Parameters"
-          description="These parameters are provided by your template's Terraform configuration and can be changed after creating the workspace."
+          description="Settings used by your template"
         >
           <FormFields>
             {templateParameters.map(
@@ -34,7 +34,6 @@ export const MutableTemplateParametersSection: FC<
                 parameter.mutable && (
                   <RichParameterInput
                     {...getInputProps(parameter, index)}
-                    index={index}
                     key={parameter.name}
                     parameter={parameter}
                   />
@@ -44,14 +43,14 @@ export const MutableTemplateParametersSection: FC<
         </FormSection>
       )}
     </>
-  )
-}
+  );
+};
 
 export const ImmutableTemplateParametersSection: FC<
   TemplateParametersSectionProps
 > = ({ templateParameters, getInputProps, ...formSectionProps }) => {
   const hasImmutableParameters =
-    templateParameters.filter((p) => !p.mutable).length > 0
+    templateParameters.filter((p) => !p.mutable).length > 0;
 
   return (
     <>
@@ -61,9 +60,8 @@ export const ImmutableTemplateParametersSection: FC<
           title="Immutable parameters"
           description={
             <>
-              These parameters are also provided by your Terraform configuration
-              but they{" "}
-              <strong>cannot be changed after creating the workspace.</strong>
+              These settings <strong>cannot be changed</strong> after creating
+              the workspace.
             </>
           }
         >
@@ -73,7 +71,6 @@ export const ImmutableTemplateParametersSection: FC<
                 !parameter.mutable && (
                   <RichParameterInput
                     {...getInputProps(parameter, index)}
-                    index={index}
                     key={parameter.name}
                     parameter={parameter}
                   />
@@ -83,5 +80,5 @@ export const ImmutableTemplateParametersSection: FC<
         </FormSection>
       )}
     </>
-  )
-}
+  );
+};
diff --git a/site/src/components/TemplateResourcesTable/TemplateResourcesTable.tsx b/site/src/components/TemplateResourcesTable/TemplateResourcesTable.tsx
index c0efebebeb971..90562dbcbc51c 100644
--- a/site/src/components/TemplateResourcesTable/TemplateResourcesTable.tsx
+++ b/site/src/components/TemplateResourcesTable/TemplateResourcesTable.tsx
@@ -1,10 +1,10 @@
-import { AgentRowPreview } from "components/Resources/AgentRowPreview"
-import { Resources } from "components/Resources/Resources"
-import { FC } from "react"
-import { WorkspaceResource } from "../../api/typesGenerated"
+import { AgentRowPreview } from "components/Resources/AgentRowPreview";
+import { Resources } from "components/Resources/Resources";
+import { FC } from "react";
+import { WorkspaceResource } from "api/typesGenerated";
 
 export interface TemplateResourcesProps {
-  resources: WorkspaceResource[]
+  resources: WorkspaceResource[];
 }
 
 export const TemplateResourcesTable: FC<
@@ -19,5 +19,5 @@ export const TemplateResourcesTable: FC<
         <AgentRowPreview key={agent.id} agent={agent} alignValues={count > 1} />
       )}
     />
-  )
-}
+  );
+};
diff --git a/site/src/components/TemplateScheduleAutostart/TemplateScheduleAutostart.tsx b/site/src/components/TemplateScheduleAutostart/TemplateScheduleAutostart.tsx
new file mode 100644
index 0000000000000..3fac410e1e206
--- /dev/null
+++ b/site/src/components/TemplateScheduleAutostart/TemplateScheduleAutostart.tsx
@@ -0,0 +1,137 @@
+import { FC } from "react";
+import { TemplateAutostartRequirementDaysValue } from "utils/schedule";
+import Button from "@mui/material/Button";
+import { Stack } from "components/Stack/Stack";
+import FormHelperText from "@mui/material/FormHelperText";
+
+export interface TemplateScheduleAutostartProps {
+  allow_user_autostart?: boolean;
+  autostart_requirement_days_of_week: TemplateAutostartRequirementDaysValue[];
+  isSubmitting: boolean;
+  onChange: (newDaysOfWeek: TemplateAutostartRequirementDaysValue[]) => void;
+}
+
+export const TemplateScheduleAutostart: FC<
+  React.PropsWithChildren<TemplateScheduleAutostartProps>
+> = ({
+  autostart_requirement_days_of_week,
+  isSubmitting,
+  allow_user_autostart,
+  onChange,
+}) => {
+  return (
+    <Stack
+      direction="column"
+      width="100%"
+      alignItems="center"
+      css={{
+        marginBottom: "20px",
+      }}
+    >
+      <Stack
+        direction="row"
+        css={{
+          width: "100%",
+        }}
+        spacing={0}
+        alignItems="baseline"
+        justifyContent="center"
+      >
+        {(
+          [
+            { value: "monday", key: "Mon" },
+            { value: "tuesday", key: "Tue" },
+            { value: "wednesday", key: "Wed" },
+            { value: "thursday", key: "Thu" },
+            { value: "friday", key: "Fri" },
+            { value: "saturday", key: "Sat" },
+            { value: "sunday", key: "Sun" },
+          ] as {
+            value: TemplateAutostartRequirementDaysValue;
+            key: string;
+          }[]
+        ).map((day) => (
+          <Button
+            key={day.key}
+            css={{
+              borderRadius: "0px",
+            }}
+            // TODO: Adding a background color would also help
+            color={
+              autostart_requirement_days_of_week.includes(day.value)
+                ? "primary"
+                : "secondary"
+            }
+            disabled={isSubmitting || !allow_user_autostart}
+            onClick={() => {
+              if (!autostart_requirement_days_of_week.includes(day.value)) {
+                onChange(autostart_requirement_days_of_week.concat(day.value));
+              } else {
+                onChange(
+                  autostart_requirement_days_of_week.filter(
+                    (obj) => obj !== day.value,
+                  ),
+                );
+              }
+            }}
+          >
+            {day.key}
+          </Button>
+        ))}
+      </Stack>
+      <FormHelperText>
+        <AutostartRequirementDaysHelperText
+          allowed={allow_user_autostart}
+          days={autostart_requirement_days_of_week}
+        />
+      </FormHelperText>
+    </Stack>
+  );
+};
+
+export const sortedDays = [
+  "monday",
+  "tuesday",
+  "wednesday",
+  "thursday",
+  "friday",
+  "saturday",
+  "sunday",
+] as TemplateAutostartRequirementDaysValue[];
+
+const AutostartRequirementDaysHelperText: FC<{
+  allowed?: boolean;
+  days: TemplateAutostartRequirementDaysValue[];
+}> = ({ allowed, days: unsortedDays }) => {
+  if (!allowed) {
+    return <span>Workspaces are not allowed to auto start.</span>;
+  }
+  // Sort the days
+  const days = unsortedDays.sort(
+    (a, b) => sortedDays.indexOf(a) - sortedDays.indexOf(b),
+  );
+
+  let daymsg = `Workspaces can autostart on ${days.join(", ")}.`;
+  if (days.length === 7) {
+    // If every day is allowed, no more explaining is needed.
+    return <span>Workspaces are allowed to auto start on any day.</span>;
+  }
+  if (days.length === 0) {
+    return (
+      <span>
+        Workspaces will never auto start. This is effectively the same as
+        disabling autostart.
+      </span>
+    );
+  }
+  if (
+    days.length === 5 &&
+    !days.includes("saturday") &&
+    !days.includes("sunday")
+  ) {
+    daymsg = "Workspaces will never auto start on the weekends.";
+  }
+  return (
+    <span>{daymsg} These days are relative to the user&apos;s timezone.</span>
+  );
+};
diff --git a/site/src/components/TemplateStats/TemplateStats.stories.tsx b/site/src/components/TemplateStats/TemplateStats.stories.tsx
deleted file mode 100644
index a58e7a4eabf63..0000000000000
--- a/site/src/components/TemplateStats/TemplateStats.stories.tsx
+++ /dev/null
@@ -1,60 +0,0 @@
-import { Story } from "@storybook/react"
-import { MockTemplate, MockTemplateVersion } from "testHelpers/entities"
-import {
-  TemplateStats,
-  TemplateStatsProps,
-} from "../TemplateStats/TemplateStats"
-
-export default {
-  title: "components/TemplateStats",
-  component: TemplateStats,
-}
-
-const Template: Story<TemplateStatsProps> = (args) => (
-  <TemplateStats {...args} />
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  template: MockTemplate,
-  activeVersion: MockTemplateVersion,
-}
-
-export const UsedByMany = Template.bind({})
-UsedByMany.args = {
-  template: {
-    ...MockTemplate,
-    active_user_count: 15,
-  },
-  activeVersion: MockTemplateVersion,
-}
-
-export const ActiveUsersNotLoaded = Template.bind({})
-ActiveUsersNotLoaded.args = {
-  template: {
-    ...MockTemplate,
-    active_user_count: -1,
-  },
-  activeVersion: MockTemplateVersion,
-}
-
-export const LongTemplateVersion = Template.bind({})
-LongTemplateVersion.args = {
-  template: MockTemplate,
-  activeVersion: {
-    ...MockTemplateVersion,
-    name: "thisisareallyreallylongnamefortesting",
-  },
-}
-LongTemplateVersion.parameters = {
-  chromatic: { viewports: [960] },
-}
-
-export const SmallViewport = Template.bind({})
-SmallViewport.args = {
-  template: MockTemplate,
-  activeVersion: MockTemplateVersion,
-}
-SmallViewport.parameters = {
-  chromatic: { viewports: [600] },
-}
diff --git a/site/src/components/TemplateVariableField/TemplateVariableField.tsx b/site/src/components/TemplateVariableField/TemplateVariableField.tsx
deleted file mode 100644
index 0b1c56b65ca3b..0000000000000
--- a/site/src/components/TemplateVariableField/TemplateVariableField.tsx
+++ /dev/null
@@ -1,83 +0,0 @@
-import FormControlLabel from "@mui/material/FormControlLabel"
-import Radio from "@mui/material/Radio"
-import RadioGroup from "@mui/material/RadioGroup"
-import TextField from "@mui/material/TextField"
-import { TemplateVersionVariable } from "api/typesGenerated"
-import { FC, useState } from "react"
-import { useTranslation } from "react-i18next"
-
-export const SensitiveVariableHelperText = () => {
-  const { t } = useTranslation("templateVariablesPage")
-  return <span>{t("sensitiveVariableHelperText")}</span>
-}
-
-export interface TemplateVariableFieldProps {
-  templateVersionVariable: TemplateVersionVariable
-  initialValue: string
-  disabled: boolean
-  onChange: (value: string) => void
-}
-
-export const TemplateVariableField: FC<TemplateVariableFieldProps> = ({
-  templateVersionVariable,
-  initialValue,
-  disabled,
-  onChange,
-  ...props
-}) => {
-  const [variableValue, setVariableValue] = useState(initialValue)
-  if (isBoolean(templateVersionVariable)) {
-    return (
-      <RadioGroup
-        defaultValue={variableValue}
-        onChange={(event) => {
-          onChange(event.target.value)
-        }}
-      >
-        <FormControlLabel
-          disabled={disabled}
-          value="true"
-          control={<Radio size="small" />}
-          label="True"
-        />
-        <FormControlLabel
-          disabled={disabled}
-          value="false"
-          control={<Radio size="small" />}
-          label="False"
-        />
-      </RadioGroup>
-    )
-  }
-
-  return (
-    <TextField
-      {...props}
-      type={
-        templateVersionVariable.type === "number"
-          ? "number"
-          : templateVersionVariable.sensitive
-          ? "password"
-          : "string"
-      }
-      disabled={disabled}
-      autoFocus
-      fullWidth
-      label={templateVersionVariable.name}
-      value={variableValue}
-      placeholder={
-        templateVersionVariable.sensitive
-          ? ""
-          : templateVersionVariable.default_value
-      }
-      onChange={(event) => {
-        setVariableValue(event.target.value)
-        onChange(event.target.value)
-      }}
-    />
-  )
-}
-
-const isBoolean = (variable: TemplateVersionVariable) => {
-  return variable.type === "bool"
-}
diff --git a/site/src/components/TemplateVersionEditor/FileDialog.tsx b/site/src/components/TemplateVersionEditor/FileDialog.tsx
deleted file mode 100644
index 9e99016054722..0000000000000
--- a/site/src/components/TemplateVersionEditor/FileDialog.tsx
+++ /dev/null
@@ -1,199 +0,0 @@
-import TextField from "@mui/material/TextField"
-import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog"
-import { Stack } from "components/Stack/Stack"
-import { ChangeEvent, FC, useState } from "react"
-import Typography from "@mui/material/Typography"
-import { allowedExtensions, isAllowedFile } from "utils/templateVersion"
-import { FileTree, isFolder, validatePath } from "utils/filetree"
-
-export const CreateFileDialog: FC<{
-  onClose: () => void
-  checkExists: (path: string) => boolean
-  onConfirm: (path: string) => void
-  open: boolean
-  fileTree: FileTree
-}> = ({ checkExists, onClose, onConfirm, open, fileTree }) => {
-  const [pathValue, setPathValue] = useState("")
-  const [error, setError] = useState<string>()
-  const handleChange = (event: ChangeEvent<HTMLInputElement>) => {
-    setPathValue(event.target.value)
-  }
-  const handleConfirm = () => {
-    if (pathValue === "") {
-      setError("You must enter a path!")
-      return
-    }
-    if (checkExists(pathValue)) {
-      setError("File already exists")
-      return
-    }
-    if (!isAllowedFile(pathValue)) {
-      const extensions = allowedExtensions.join(", ")
-      setError(
-        `This extension is not allowed. You only can create files with the following extensions: ${extensions}.`,
-      )
-      return
-    }
-    const pathError = validatePath(pathValue, fileTree)
-    if (pathError) {
-      setError(pathError)
-      return
-    }
-    onConfirm(pathValue)
-    setError(undefined)
-    setPathValue("")
-  }
-
-  return (
-    <ConfirmDialog
-      open={open}
-      onClose={() => {
-        onClose()
-        setError(undefined)
-        setPathValue("")
-      }}
-      onConfirm={handleConfirm}
-      hideCancel={false}
-      type="success"
-      cancelText="Cancel"
-      confirmText="Create"
-      title="Create File"
-      description={
-        <Stack>
-          <Typography>
-            Specify the path to a file to be created. This path can contain
-            slashes too.
-          </Typography>
-          <TextField
-            autoFocus
-            onKeyDown={(event) => {
-              if (event.key === "Enter") {
-                handleConfirm()
-              }
-            }}
-            error={Boolean(error)}
-            helperText={error}
-            name="file-path"
-            autoComplete="off"
-            id="file-path"
-            placeholder="example.tf"
-            value={pathValue}
-            onChange={handleChange}
-            label="File Path"
-          />
-        </Stack>
-      }
-    />
-  )
-}
-
-export const DeleteFileDialog: FC<{
-  onClose: () => void
-  onConfirm: () => void
-  open: boolean
-  filename: string
-}> = ({ onClose, onConfirm, open, filename }) => {
-  return (
-    <ConfirmDialog
-      type="delete"
-      onClose={onClose}
-      open={open}
-      onConfirm={onConfirm}
-      title="Delete File"
-      description={
-        <>
-          Are you sure you want to delete <strong>{filename}</strong>? It will
-          be deleted permanently.
-        </>
-      }
-    />
-  )
-}
-
-export const RenameFileDialog: FC<{
-  onClose: () => void
-  onConfirm: (filename: string) => void
-  checkExists: (path: string) => boolean
-  open: boolean
-  filename: string
-  fileTree: FileTree
-}> = ({ checkExists, onClose, onConfirm, open, filename, fileTree }) => {
-  const [pathValue, setPathValue] = useState(filename)
-  const [error, setError] = useState<string>()
-  const handleChange = (event: ChangeEvent<HTMLInputElement>) => {
-    setPathValue(event.target.value)
-  }
-  const handleConfirm = () => {
-    if (pathValue === "") {
-      setError("You must enter a path!")
-      return
-    }
-    if (checkExists(pathValue)) {
-      setError("File already exists")
-      return
-    }
-    if (!isAllowedFile(pathValue)) {
-      const extensions = allowedExtensions.join(", ")
-      setError(
-        `This extension is not allowed. You only can rename files with the following extensions: ${extensions}.`,
-      )
-      return
-    }
-    //Check if a folder is renamed to a file
-    const [_, extension] = pathValue.split(".")
-    if (isFolder(filename, fileTree) && extension) {
-      setError(`A folder can't be renamed to a file.`)
-      return
-    }
-    const pathError = validatePath(pathValue, fileTree)
-    if (pathError) {
-      setError(pathError)
-      return
-    }
-    onConfirm(pathValue)
-    setError(undefined)
-    setPathValue("")
-  }
-
-  return (
-    <ConfirmDialog
-      open={open}
-      onClose={() => {
-        onClose()
-        setError(undefined)
-        setPathValue("")
-      }}
-      onConfirm={handleConfirm}
-      hideCancel={false}
-      type="success"
-      cancelText="Cancel"
-      confirmText="Rename"
-      title="Rename File"
-      description={
-        <Stack>
-          <p>
-            Rename <strong>{filename}</strong> to something else. This path can
-            contain slashes too!
-          </p>
-          <TextField
-            autoFocus
-            onKeyDown={(event) => {
-              if (event.key === "Enter") {
-                handleConfirm()
-              }
-            }}
-            error={Boolean(error)}
-            helperText={error}
-            name="file-path"
-            autoComplete="off"
-            id="file-path"
-            placeholder={filename}
-            value={pathValue}
-            onChange={handleChange}
-            label="File Path"
-          />
-        </Stack>
-      }
-    />
-  )
-}
diff --git a/site/src/components/TemplateVersionEditor/MissingTemplateVariablesDialog.tsx b/site/src/components/TemplateVersionEditor/MissingTemplateVariablesDialog.tsx
deleted file mode 100644
index b61f6578bd06e..0000000000000
--- a/site/src/components/TemplateVersionEditor/MissingTemplateVariablesDialog.tsx
+++ /dev/null
@@ -1,143 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import Dialog from "@mui/material/Dialog"
-import DialogContent from "@mui/material/DialogContent"
-import DialogContentText from "@mui/material/DialogContentText"
-import DialogTitle from "@mui/material/DialogTitle"
-import { DialogProps } from "components/Dialogs/Dialog"
-import { FC, useEffect, useState } from "react"
-import { FormFields, VerticalForm } from "components/Form/Form"
-import { TemplateVersionVariable, VariableValue } from "api/typesGenerated"
-import DialogActions from "@mui/material/DialogActions"
-import Button from "@mui/material/Button"
-import { VariableInput } from "pages/CreateTemplatePage/VariableInput"
-import { Loader } from "components/Loader/Loader"
-
-export type MissingTemplateVariablesDialogProps = Omit<
-  DialogProps,
-  "onSubmit"
-> & {
-  onClose: () => void
-  onSubmit: (values: VariableValue[]) => void
-  missingVariables?: TemplateVersionVariable[]
-}
-
-export const MissingTemplateVariablesDialog: FC<
-  MissingTemplateVariablesDialogProps
-> = ({ missingVariables, onSubmit, ...dialogProps }) => {
-  const styles = useStyles()
-  const [variableValues, setVariableValues] = useState<VariableValue[]>([])
-
-  // Pre-fill the form with the default values when missing variables are loaded
-  useEffect(() => {
-    if (!missingVariables) {
-      return
-    }
-    setVariableValues(
-      missingVariables.map((v) => ({ name: v.name, value: v.value })),
-    )
-  }, [missingVariables])
-
-  return (
-    <Dialog
-      {...dialogProps}
-      scroll="body"
-      aria-labelledby="update-build-parameters-title"
-      maxWidth="xs"
-      data-testid="dialog"
-    >
-      <DialogTitle
-        id="update-build-parameters-title"
-        classes={{ root: styles.title }}
-      >
-        Template variables
-      </DialogTitle>
-      <DialogContent className={styles.content}>
-        <DialogContentText className={styles.info}>
-          There are a few missing template variable values. Please fill them in.
-        </DialogContentText>
-        <VerticalForm
-          className={styles.form}
-          id="updateVariables"
-          onSubmit={(e) => {
-            e.preventDefault()
-            onSubmit(variableValues)
-          }}
-        >
-          {missingVariables ? (
-            <FormFields>
-              {missingVariables.map((variable, index) => {
-                return (
-                  <VariableInput
-                    defaultValue={variable.value}
-                    variable={variable}
-                    key={variable.name}
-                    onChange={async (value) => {
-                      setVariableValues((prev) => {
-                        prev[index] = {
-                          name: variable.name,
-                          value,
-                        }
-                        return [...prev]
-                      })
-                    }}
-                  />
-                )
-              })}
-            </FormFields>
-          ) : (
-            <Loader />
-          )}
-        </VerticalForm>
-      </DialogContent>
-      <DialogActions disableSpacing className={styles.dialogActions}>
-        <Button color="primary" fullWidth type="submit" form="updateVariables">
-          Submit
-        </Button>
-        <Button fullWidth type="button" onClick={dialogProps.onClose}>
-          Cancel
-        </Button>
-      </DialogActions>
-    </Dialog>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  title: {
-    padding: theme.spacing(3, 5),
-
-    "& h2": {
-      fontSize: theme.spacing(2.5),
-      fontWeight: 400,
-    },
-  },
-
-  content: {
-    padding: theme.spacing(0, 5, 0, 5),
-  },
-
-  info: {
-    margin: 0,
-  },
-
-  form: {
-    paddingTop: theme.spacing(4),
-  },
-
-  infoTitle: {
-    fontSize: theme.spacing(2),
-    fontWeight: 600,
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(1),
-  },
-
-  formFooter: {
-    flexDirection: "column",
-  },
-
-  dialogActions: {
-    padding: theme.spacing(5),
-    flexDirection: "column",
-    gap: theme.spacing(1),
-  },
-}))
diff --git a/site/src/components/TemplateVersionEditor/MonacoEditor.tsx b/site/src/components/TemplateVersionEditor/MonacoEditor.tsx
deleted file mode 100644
index 32191245422b3..0000000000000
--- a/site/src/components/TemplateVersionEditor/MonacoEditor.tsx
+++ /dev/null
@@ -1,137 +0,0 @@
-import { useTheme } from "@mui/styles"
-import Editor, { loader } from "@monaco-editor/react"
-import * as monaco from "monaco-editor"
-import { FC, useLayoutEffect, useMemo, useState } from "react"
-import { MONOSPACE_FONT_FAMILY } from "theme/constants"
-import { hslToHex } from "utils/colors"
-import type { editor } from "monaco-editor"
-
-loader.config({ monaco })
-
-export const MonacoEditor: FC<{
-  value?: string
-  path?: string
-  onChange?: (value: string) => void
-}> = ({ onChange, value, path }) => {
-  const theme = useTheme()
-  const [editor, setEditor] = useState<editor.IStandaloneCodeEditor>()
-  useLayoutEffect(() => {
-    if (!editor) {
-      return
-    }
-    const resizeListener = () => {
-      editor.layout({
-        height: 0,
-        width: 0,
-      })
-    }
-    window.addEventListener("resize", resizeListener)
-    return () => {
-      window.removeEventListener("resize", resizeListener)
-    }
-  }, [editor])
-
-  const language = useMemo(() => {
-    if (path?.endsWith(".tf")) {
-      return "hcl"
-    }
-    if (path?.endsWith(".md")) {
-      return "markdown"
-    }
-    if (path?.endsWith(".json")) {
-      return "json"
-    }
-    if (path?.endsWith(".yaml")) {
-      return "yaml"
-    }
-    if (path?.endsWith("Dockerfile")) {
-      return "dockerfile"
-    }
-  }, [path])
-
-  return (
-    <Editor
-      value={value}
-      language={language}
-      theme="vs-dark"
-      options={{
-        automaticLayout: true,
-        fontFamily: MONOSPACE_FONT_FAMILY,
-        fontSize: 16,
-        wordWrap: "on",
-        padding: {
-          top: 16,
-          bottom: 16,
-        },
-      }}
-      path={path}
-      onChange={(newValue) => {
-        if (onChange && newValue) {
-          onChange(newValue)
-        }
-      }}
-      onMount={(editor, monaco) => {
-        // This jank allows for Ctrl + Enter to work outside the editor.
-        // We use this keybind to trigger a build.
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Private type in Monaco!
-        ;(editor as any)._standaloneKeybindingService.addDynamicKeybinding(
-          `-editor.action.insertLineAfter`,
-          monaco.KeyMod.CtrlCmd | monaco.KeyCode.Enter,
-          () => {
-            //
-          },
-        )
-
-        setEditor(editor)
-
-        document.fonts.ready
-          .then(() => {
-            // Ensures that all text is measured properly.
-            // If this isn't done, there can be weird selection issues.
-            monaco.editor.remeasureFonts()
-          })
-          .catch(() => {
-            // Not a biggie!
-          })
-
-        monaco.editor.defineTheme("min", {
-          base: "vs-dark",
-          inherit: true,
-          rules: [
-            {
-              token: "comment",
-              foreground: "6B737C",
-            },
-            {
-              token: "type",
-              foreground: "B392F0",
-            },
-            {
-              token: "string",
-              foreground: "9DB1C5",
-            },
-            {
-              token: "variable",
-              foreground: "BBBBBB",
-            },
-            {
-              token: "identifier",
-              foreground: "B392F0",
-            },
-            {
-              token: "delimiter.curly",
-              foreground: "EBB325",
-            },
-          ],
-          colors: {
-            "editor.foreground": hslToHex(theme.palette.text.primary),
-            "editor.background": hslToHex(theme.palette.background.default),
-          },
-        })
-        editor.updateOptions({
-          theme: "min",
-        })
-      }}
-    />
-  )
-}
diff --git a/site/src/components/TemplateVersionEditor/PublishTemplateVersionDialog.tsx b/site/src/components/TemplateVersionEditor/PublishTemplateVersionDialog.tsx
deleted file mode 100644
index 8fcd96bcce157..0000000000000
--- a/site/src/components/TemplateVersionEditor/PublishTemplateVersionDialog.tsx
+++ /dev/null
@@ -1,106 +0,0 @@
-import { DialogProps } from "components/Dialogs/Dialog"
-import { FC } from "react"
-import { getFormHelpers } from "utils/formUtils"
-import { FormFields } from "components/Form/Form"
-import { useFormik } from "formik"
-import * as Yup from "yup"
-import { PublishVersionData } from "pages/TemplateVersionPage/TemplateVersionEditorPage/types"
-import TextField from "@mui/material/TextField"
-import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog"
-import Checkbox from "@mui/material/Checkbox"
-import FormControlLabel from "@mui/material/FormControlLabel"
-import { Stack } from "components/Stack/Stack"
-
-export type PublishTemplateVersionDialogProps = DialogProps & {
-  defaultName: string
-  isPublishing: boolean
-  publishingError?: unknown
-  onClose: () => void
-  onConfirm: (data: PublishVersionData) => void
-}
-
-export const PublishTemplateVersionDialog: FC<
-  PublishTemplateVersionDialogProps
-> = ({
-  onConfirm,
-  isPublishing,
-  onClose,
-  defaultName,
-  publishingError,
-  ...dialogProps
-}) => {
-  const form = useFormik({
-    initialValues: {
-      name: defaultName,
-      message: "",
-      isActiveVersion: false,
-    },
-    validationSchema: Yup.object({
-      name: Yup.string().required(),
-      message: Yup.string(),
-      isActiveVersion: Yup.boolean(),
-    }),
-    onSubmit: onConfirm,
-  })
-  const getFieldHelpers = getFormHelpers(form, publishingError)
-  const handleClose = () => {
-    form.resetForm()
-    onClose()
-  }
-
-  return (
-    <ConfirmDialog
-      {...dialogProps}
-      confirmLoading={isPublishing}
-      onClose={handleClose}
-      onConfirm={async () => {
-        await form.submitForm()
-      }}
-      hideCancel={false}
-      type="success"
-      cancelText="Cancel"
-      confirmText="Publish"
-      title="Publish new version"
-      description={
-        <Stack>
-          <p>You are about to publish a new version of this template.</p>
-          <FormFields>
-            <TextField
-              {...getFieldHelpers("name")}
-              label="Version name"
-              autoFocus
-              disabled={isPublishing}
-            />
-
-            <TextField
-              {...getFieldHelpers("message")}
-              label="Message"
-              placeholder="Write a short message about the changes you made..."
-              autoFocus
-              disabled={isPublishing}
-              multiline
-              rows={5}
-            />
-
-            <FormControlLabel
-              label="Promote to default version"
-              control={
-                <Checkbox
-                  size="small"
-                  checked={form.values.isActiveVersion}
-                  onChange={async (e) => {
-                    await form.setFieldValue(
-                      "isActiveVersion",
-                      e.target.checked,
-                    )
-                  }}
-                  name="isActiveVersion"
-                />
-              }
-            />
-          </FormFields>
-        </Stack>
-      }
-    />
-  )
-}
diff --git a/site/src/components/TemplateVersionEditor/TemplateVersionEditor.stories.tsx b/site/src/components/TemplateVersionEditor/TemplateVersionEditor.stories.tsx
deleted file mode 100644
index 24a40ad4d4fae..0000000000000
--- a/site/src/components/TemplateVersionEditor/TemplateVersionEditor.stories.tsx
+++ /dev/null
@@ -1,56 +0,0 @@
-import { Story } from "@storybook/react"
-import {
-  MockTemplate,
-  MockTemplateVersion,
-  MockTemplateVersionFileTree,
-  MockWorkspaceBuildLogs,
-  MockWorkspaceResource,
-  MockWorkspaceResource2,
-  MockWorkspaceResource3,
-} from "testHelpers/entities"
-import {
-  TemplateVersionEditor,
-  TemplateVersionEditorProps,
-} from "./TemplateVersionEditor"
-
-export default {
-  title: "components/TemplateVersionEditor",
-  component: TemplateVersionEditor,
-  parameters: {
-    layout: "fullscreen",
-  },
-}
-
-const Template: Story<TemplateVersionEditorProps> = (
-  args: TemplateVersionEditorProps,
-) => <TemplateVersionEditor {...args} />
-
-export const Example = Template.bind({})
-Example.args = {
-  template: MockTemplate,
-  templateVersion: MockTemplateVersion,
-  defaultFileTree: MockTemplateVersionFileTree,
-}
-
-export const Logs = Template.bind({})
-
-Logs.args = {
-  template: MockTemplate,
-  templateVersion: MockTemplateVersion,
-  defaultFileTree: MockTemplateVersionFileTree,
-  buildLogs: MockWorkspaceBuildLogs,
-}
-
-export const Resources = Template.bind({})
-
-Resources.args = {
-  template: MockTemplate,
-  templateVersion: MockTemplateVersion,
-  defaultFileTree: MockTemplateVersionFileTree,
-  buildLogs: MockWorkspaceBuildLogs,
-  resources: [
-    MockWorkspaceResource,
-    MockWorkspaceResource2,
-    MockWorkspaceResource3,
-  ],
-}
diff --git a/site/src/components/TemplateVersionEditor/TemplateVersionEditor.tsx b/site/src/components/TemplateVersionEditor/TemplateVersionEditor.tsx
deleted file mode 100644
index d4a81a3363b7a..0000000000000
--- a/site/src/components/TemplateVersionEditor/TemplateVersionEditor.tsx
+++ /dev/null
@@ -1,599 +0,0 @@
-import Button from "@mui/material/Button"
-import IconButton from "@mui/material/IconButton"
-import { makeStyles } from "@mui/styles"
-import Tooltip from "@mui/material/Tooltip"
-import CreateIcon from "@mui/icons-material/AddOutlined"
-import BuildIcon from "@mui/icons-material/BuildOutlined"
-import PreviewIcon from "@mui/icons-material/VisibilityOutlined"
-import {
-  ProvisionerJobLog,
-  Template,
-  TemplateVersion,
-  TemplateVersionVariable,
-  VariableValue,
-  WorkspaceResource,
-} from "api/typesGenerated"
-import { Alert, AlertDetail } from "components/Alert/Alert"
-import { Avatar } from "components/Avatar/Avatar"
-import { AvatarData } from "components/AvatarData/AvatarData"
-import { bannerHeight } from "components/DeploymentBanner/DeploymentBannerView"
-import { TemplateResourcesTable } from "components/TemplateResourcesTable/TemplateResourcesTable"
-import { WorkspaceBuildLogs } from "components/WorkspaceBuildLogs/WorkspaceBuildLogs"
-import { PublishVersionData } from "pages/TemplateVersionPage/TemplateVersionEditorPage/types"
-import { FC, useCallback, useEffect, useRef, useState } from "react"
-import { navHeight, dashboardContentBottomPadding } from "theme/constants"
-import {
-  createFile,
-  existsFile,
-  FileTree,
-  getFileContent,
-  isFolder,
-  moveFile,
-  removeFile,
-  traverse,
-  updateFile,
-} from "utils/filetree"
-import {
-  CreateFileDialog,
-  DeleteFileDialog,
-  RenameFileDialog,
-} from "./FileDialog"
-import { FileTreeView } from "./FileTreeView"
-import { MissingTemplateVariablesDialog } from "./MissingTemplateVariablesDialog"
-import { MonacoEditor } from "./MonacoEditor"
-import { PublishTemplateVersionDialog } from "./PublishTemplateVersionDialog"
-import {
-  getStatus,
-  TemplateVersionStatusBadge,
-} from "./TemplateVersionStatusBadge"
-import { Theme } from "@mui/material/styles"
-import AlertTitle from "@mui/material/AlertTitle"
-
-export interface TemplateVersionEditorProps {
-  template: Template
-  templateVersion: TemplateVersion
-  defaultFileTree: FileTree
-  buildLogs?: ProvisionerJobLog[]
-  resources?: WorkspaceResource[]
-  deploymentBannerVisible?: boolean
-  disablePreview: boolean
-  disableUpdate: boolean
-  onPreview: (files: FileTree) => void
-  onPublish: () => void
-  onConfirmPublish: (data: PublishVersionData) => void
-  onCancelPublish: () => void
-  publishingError: unknown
-  isAskingPublishParameters: boolean
-  isPromptingMissingVariables: boolean
-  isPublishing: boolean
-  missingVariables?: TemplateVersionVariable[]
-  onSubmitMissingVariableValues: (values: VariableValue[]) => void
-  onCancelSubmitMissingVariableValues: () => void
-}
-
-const topbarHeight = 80
-
-const findInitialFile = (fileTree: FileTree): string | undefined => {
-  let initialFile: string | undefined
-
-  traverse(fileTree, (content, filename, path) => {
-    if (filename.endsWith(".tf")) {
-      initialFile = path
-    }
-  })
-
-  return initialFile
-}
-
-export const TemplateVersionEditor: FC<TemplateVersionEditorProps> = ({
-  disablePreview,
-  disableUpdate,
-  template,
-  deploymentBannerVisible,
-  templateVersion,
-  defaultFileTree,
-  onPreview,
-  onPublish,
-  onConfirmPublish,
-  onCancelPublish,
-  publishingError,
-  isAskingPublishParameters,
-  isPublishing,
-  buildLogs,
-  resources,
-  isPromptingMissingVariables,
-  missingVariables,
-  onSubmitMissingVariableValues,
-  onCancelSubmitMissingVariableValues,
-}) => {
-  const [selectedTab, setSelectedTab] = useState(() => {
-    // If resources are provided, show them by default!
-    // This is for Storybook!
-    return resources ? 1 : 0
-  })
-  const [fileTree, setFileTree] = useState(defaultFileTree)
-  const [createFileOpen, setCreateFileOpen] = useState(false)
-  const [deleteFileOpen, setDeleteFileOpen] = useState<string>()
-  const [renameFileOpen, setRenameFileOpen] = useState<string>()
-  const [dirty, setDirty] = useState(false)
-  const [activePath, setActivePath] = useState<string | undefined>(() =>
-    findInitialFile(fileTree),
-  )
-
-  const triggerPreview = useCallback(() => {
-    onPreview(fileTree)
-    // Switch to the build log!
-    setSelectedTab(0)
-  }, [fileTree, onPreview])
-
-  // Stop ctrl+s from saving files and make ctrl+enter trigger a preview.
-  useEffect(() => {
-    const keyListener = (event: KeyboardEvent) => {
-      if (!(navigator.platform.match("Mac") ? event.metaKey : event.ctrlKey)) {
-        return
-      }
-      switch (event.key) {
-        case "s":
-          // Prevent opening the save dialog!
-          event.preventDefault()
-          break
-        case "Enter":
-          event.preventDefault()
-          triggerPreview()
-          break
-      }
-    }
-    document.addEventListener("keydown", keyListener)
-    return () => {
-      document.removeEventListener("keydown", keyListener)
-    }
-  }, [triggerPreview])
-
-  // Automatically switch to the template preview tab when the build succeeds.
-  const previousVersion = useRef<TemplateVersion>()
-  useEffect(() => {
-    if (!previousVersion.current) {
-      previousVersion.current = templateVersion
-      return
-    }
-    if (
-      ["running", "pending"].includes(previousVersion.current.job.status) &&
-      templateVersion.job.status === "succeeded"
-    ) {
-      setSelectedTab(1)
-      setDirty(false)
-    }
-    previousVersion.current = templateVersion
-  }, [templateVersion])
-
-  const hasIcon = template.icon && template.icon !== ""
-  const templateVersionSucceeded = templateVersion.job.status === "succeeded"
-  const showBuildLogs = Boolean(buildLogs)
-  const editorValue = getFileContent(activePath ?? "", fileTree) as string
-  const firstTemplateVersionOnEditor = useRef(templateVersion)
-
-  useEffect(() => {
-    window.dispatchEvent(new Event("resize"))
-  }, [showBuildLogs])
-  const styles = useStyles({
-    templateVersionSucceeded,
-    showBuildLogs,
-    deploymentBannerVisible,
-  })
-
-  return (
-    <>
-      <div className={styles.root}>
-        <div className={styles.topbar} data-testid="topbar">
-          <div className={styles.topbarSides}>
-            <AvatarData
-              title={template.display_name || template.name}
-              subtitle={template.description}
-              avatar={
-                hasIcon && (
-                  <Avatar src={template.icon} variant="square" fitImage />
-                )
-              }
-            />
-          </div>
-
-          <div className={styles.topbarSides}>
-            {/* Only start to show the build when a new template version is building */}
-            {templateVersion.id !== firstTemplateVersionOnEditor.current.id && (
-              <div className={styles.buildStatus}>
-                <TemplateVersionStatusBadge version={templateVersion} />
-              </div>
-            )}
-
-            <Button
-              title="Build template (Ctrl + Enter)"
-              disabled={disablePreview}
-              onClick={() => {
-                triggerPreview()
-              }}
-            >
-              Build template
-            </Button>
-
-            <Button
-              variant="contained"
-              title={
-                dirty
-                  ? "You have edited files! Run another build before updating."
-                  : templateVersion.job.status !== "succeeded"
-                  ? "Something"
-                  : ""
-              }
-              disabled={dirty || disableUpdate}
-              onClick={onPublish}
-            >
-              Publish version
-            </Button>
-          </div>
-        </div>
-
-        <div className={styles.sidebarAndEditor}>
-          <div className={styles.sidebar}>
-            <div className={styles.sidebarTitle}>
-              Template files
-              <div className={styles.sidebarActions}>
-                <Tooltip title="Create File" placement="top">
-                  <IconButton
-                    aria-label="Create File"
-                    onClick={(event) => {
-                      setCreateFileOpen(true)
-                      event.currentTarget.blur()
-                    }}
-                  >
-                    <CreateIcon />
-                  </IconButton>
-                </Tooltip>
-              </div>
-              <CreateFileDialog
-                fileTree={fileTree}
-                open={createFileOpen}
-                onClose={() => {
-                  setCreateFileOpen(false)
-                }}
-                checkExists={(path) => existsFile(path, fileTree)}
-                onConfirm={(path) => {
-                  setFileTree((fileTree) => createFile(path, fileTree, ""))
-                  setActivePath(path)
-                  setCreateFileOpen(false)
-                  setDirty(true)
-                }}
-              />
-              <DeleteFileDialog
-                onConfirm={() => {
-                  if (!deleteFileOpen) {
-                    throw new Error("delete file must be set")
-                  }
-                  setFileTree((fileTree) =>
-                    removeFile(deleteFileOpen, fileTree),
-                  )
-                  setDeleteFileOpen(undefined)
-                  if (activePath === deleteFileOpen) {
-                    setActivePath(undefined)
-                  }
-                  setDirty(true)
-                }}
-                open={Boolean(deleteFileOpen)}
-                onClose={() => setDeleteFileOpen(undefined)}
-                filename={deleteFileOpen || ""}
-              />
-              <RenameFileDialog
-                fileTree={fileTree}
-                open={Boolean(renameFileOpen)}
-                onClose={() => {
-                  setRenameFileOpen(undefined)
-                }}
-                filename={renameFileOpen || ""}
-                checkExists={(path) => existsFile(path, fileTree)}
-                onConfirm={(newPath) => {
-                  if (!renameFileOpen) {
-                    return
-                  }
-                  setFileTree((fileTree) =>
-                    moveFile(renameFileOpen, newPath, fileTree),
-                  )
-                  setActivePath(newPath)
-                  setRenameFileOpen(undefined)
-                  setDirty(true)
-                }}
-              />
-            </div>
-            <FileTreeView
-              fileTree={fileTree}
-              onDelete={(file) => setDeleteFileOpen(file)}
-              onSelect={(filePath) => {
-                if (!isFolder(filePath, fileTree)) {
-                  setActivePath(filePath)
-                }
-              }}
-              onRename={(file) => setRenameFileOpen(file)}
-              activePath={activePath}
-            />
-          </div>
-
-          <div className={styles.editorPane}>
-            <div className={styles.editor} data-chromatic="ignore">
-              {activePath ? (
-                <MonacoEditor
-                  value={editorValue}
-                  path={activePath}
-                  onChange={(value) => {
-                    if (!activePath) {
-                      return
-                    }
-                    setFileTree((fileTree) =>
-                      updateFile(activePath, value, fileTree),
-                    )
-                    setDirty(true)
-                  }}
-                />
-              ) : (
-                <div>No file opened</div>
-              )}
-            </div>
-
-            <div className={styles.panelWrapper}>
-              <div className={styles.tabs}>
-                <button
-                  className={`${styles.tab} ${
-                    selectedTab === 0 ? "active" : ""
-                  }`}
-                  onClick={() => {
-                    setSelectedTab(0)
-                  }}
-                >
-                  {templateVersion.job.status !== "succeeded" ? (
-                    getStatus(templateVersion).icon
-                  ) : (
-                    <BuildIcon />
-                  )}
-                  Build Log
-                </button>
-
-                {!disableUpdate && (
-                  <button
-                    className={`${styles.tab} ${
-                      selectedTab === 1 ? "active" : ""
-                    }`}
-                    onClick={() => {
-                      setSelectedTab(1)
-                    }}
-                  >
-                    <PreviewIcon />
-                    Workspace Preview
-                  </button>
-                )}
-              </div>
-
-              <div
-                className={`${styles.panel} ${styles.buildLogs} ${
-                  selectedTab === 0 ? "" : "hidden"
-                }`}
-              >
-                {templateVersion.job.error && (
-                  <div>
-                    <Alert severity="error">
-                      <AlertTitle>Error during the build</AlertTitle>
-                      <AlertDetail>{templateVersion.job.error}</AlertDetail>
-                    </Alert>
-                  </div>
-                )}
-
-                {buildLogs && buildLogs.length > 0 && (
-                  <WorkspaceBuildLogs
-                    sx={{ borderRadius: 0 }}
-                    hideTimestamps
-                    logs={buildLogs}
-                  />
-                )}
-              </div>
-
-              <div
-                className={`${styles.panel} ${
-                  selectedTab === 1 ? "" : "hidden"
-                }`}
-              >
-                {resources && (
-                  <TemplateResourcesTable
-                    resources={resources.filter(
-                      (r) => r.workspace_transition === "start",
-                    )}
-                  />
-                )}
-              </div>
-            </div>
-
-            {templateVersionSucceeded && (
-              <>
-                <div className={styles.panelDivider} />
-              </>
-            )}
-          </div>
-        </div>
-      </div>
-
-      <PublishTemplateVersionDialog
-        key={templateVersion.name}
-        publishingError={publishingError}
-        open={isAskingPublishParameters || isPublishing}
-        onClose={onCancelPublish}
-        onConfirm={onConfirmPublish}
-        isPublishing={isPublishing}
-        defaultName={templateVersion.name}
-      />
-
-      <MissingTemplateVariablesDialog
-        open={isPromptingMissingVariables}
-        onClose={onCancelSubmitMissingVariableValues}
-        onSubmit={onSubmitMissingVariableValues}
-        missingVariables={missingVariables}
-      />
-    </>
-  )
-}
-
-const useStyles = makeStyles<
-  Theme,
-  {
-    templateVersionSucceeded: boolean
-    showBuildLogs: boolean
-    deploymentBannerVisible?: boolean
-  }
->((theme) => ({
-  root: {
-    height: (props) =>
-      `calc(100vh - ${
-        navHeight + (props.deploymentBannerVisible ? bannerHeight : 0)
-      }px)`,
-    background: theme.palette.background.default,
-    flex: 1,
-    display: "flex",
-    flexDirection: "column",
-    marginBottom: -dashboardContentBottomPadding, // Remove dashboard bottom padding
-  },
-  topbar: {
-    padding: theme.spacing(2),
-    borderBottom: `1px solid ${theme.palette.divider}`,
-    display: "flex",
-    alignItems: "center",
-    justifyContent: "space-between",
-    height: topbarHeight,
-    background: theme.palette.background.paper,
-  },
-  topbarSides: {
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(2),
-  },
-  buildStatus: {
-    display: "flex",
-    alignItems: "center",
-    gap: 8,
-  },
-  sidebarAndEditor: {
-    display: "flex",
-    flex: 1,
-  },
-  sidebar: {
-    minWidth: 256,
-    backgroundColor: theme.palette.background.paper,
-    borderRight: `1px solid ${theme.palette.divider}`,
-  },
-  sidebarTitle: {
-    fontSize: 10,
-    textTransform: "uppercase",
-    padding: theme.spacing(1, 2),
-    color: theme.palette.text.primary,
-    fontWeight: 500,
-    letterSpacing: "0.5px",
-    display: "flex",
-    alignItems: "center",
-  },
-  sidebarActions: {
-    marginLeft: "auto",
-    "& svg": {
-      fill: theme.palette.text.primary,
-    },
-  },
-  editorPane: {
-    display: "grid",
-    width: "100%",
-    gridTemplateColumns: (props) =>
-      props.showBuildLogs ? "1fr 1fr" : "1fr 0fr",
-    height: `calc(100vh - ${navHeight + topbarHeight}px)`,
-    overflow: "hidden",
-  },
-  editor: {
-    flex: 1,
-  },
-  panelWrapper: {
-    flex: 1,
-    display: "flex",
-    flexDirection: "column",
-    borderLeft: `1px solid ${theme.palette.divider}`,
-    overflowY: "auto",
-  },
-  panel: {
-    padding: theme.spacing(1),
-
-    "&.hidden": {
-      display: "none",
-    },
-  },
-  tabs: {
-    borderBottom: `1px solid ${theme.palette.divider}`,
-    display: "flex",
-    boxShadow: "#000000 0 6px 6px -6px inset",
-
-    "& .MuiTab-root": {
-      padding: 0,
-      fontSize: 14,
-      textTransform: "none",
-      letterSpacing: "unset",
-    },
-  },
-  tab: {
-    cursor: "pointer",
-    padding: theme.spacing(1.5),
-    fontSize: 10,
-    textTransform: "uppercase",
-    letterSpacing: "0.5px",
-    fontWeight: 600,
-    background: "transparent",
-    fontFamily: "inherit",
-    border: 0,
-    color: theme.palette.text.secondary,
-    transition: "150ms ease all",
-    display: "flex",
-    gap: 8,
-    alignItems: "center",
-    justifyContent: "center",
-    position: "relative",
-
-    "& svg": {
-      maxWidth: 12,
-      maxHeight: 12,
-    },
-
-    "&.active": {
-      color: theme.palette.text.primary,
-      "&:after": {
-        content: '""',
-        display: "block",
-        width: "100%",
-        height: 1,
-        backgroundColor: theme.palette.text.primary,
-        bottom: -1,
-        position: "absolute",
-      },
-    },
-
-    "&:hover": {
-      color: theme.palette.text.primary,
-    },
-  },
-  tabBar: {
-    padding: "8px 16px",
-    position: "sticky",
-    top: 0,
-    background: theme.palette.background.default,
-    borderBottom: `1px solid ${theme.palette.divider}`,
-    color: theme.palette.text.primary,
-    textTransform: "uppercase",
-    fontSize: 12,
-
-    "&.top": {
-      borderTop: `1px solid ${theme.palette.divider}`,
-    },
-  },
-  buildLogs: {
-    display: "flex",
-    flexDirection: "column",
-    overflowY: "auto",
-    gap: theme.spacing(1),
-  },
-}))
diff --git a/site/src/components/TemplateVersionEditor/TemplateVersionStatusBadge.tsx b/site/src/components/TemplateVersionEditor/TemplateVersionStatusBadge.tsx
deleted file mode 100644
index 397d5c68ae824..0000000000000
--- a/site/src/components/TemplateVersionEditor/TemplateVersionStatusBadge.tsx
+++ /dev/null
@@ -1,72 +0,0 @@
-import { TemplateVersion } from "api/typesGenerated"
-import { FC, ReactNode } from "react"
-import CircularProgress from "@mui/material/CircularProgress"
-import ErrorIcon from "@mui/icons-material/ErrorOutline"
-import CheckIcon from "@mui/icons-material/CheckOutlined"
-import { Pill } from "components/Pill/Pill"
-import { PaletteIndex } from "theme/theme"
-
-export const TemplateVersionStatusBadge: FC<{
-  version: TemplateVersion
-}> = ({ version }) => {
-  const { text, icon, type } = getStatus(version)
-  return (
-    <Pill
-      icon={icon}
-      text={text}
-      type={type}
-      title={`Build status is ${text}`}
-    />
-  )
-}
-
-const LoadingIcon: FC = () => {
-  return <CircularProgress size={10} style={{ color: "#FFF" }} />
-}
-
-export const getStatus = (
-  version: TemplateVersion,
-): {
-  type?: PaletteIndex
-  text: string
-  icon: ReactNode
-} => {
-  switch (version.job.status) {
-    case "running":
-      return {
-        type: "info",
-        text: "Running",
-        icon: <LoadingIcon />,
-      }
-    case "pending":
-      return {
-        text: "Pending",
-        icon: <LoadingIcon />,
-        type: "info",
-      }
-    case "canceling":
-      return {
-        type: "warning",
-        text: "Canceling",
-        icon: <LoadingIcon />,
-      }
-    case "canceled":
-      return {
-        type: "warning",
-        text: "Canceled",
-        icon: <ErrorIcon />,
-      }
-    case "failed":
-      return {
-        type: "error",
-        text: "Failed",
-        icon: <ErrorIcon />,
-      }
-    case "succeeded":
-      return {
-        type: "success",
-        text: "Success",
-        icon: <CheckIcon />,
-      }
-  }
-}
diff --git a/site/src/components/TemplateVersionWarnings/TemplateVersionWarnings.stories.tsx b/site/src/components/TemplateVersionWarnings/TemplateVersionWarnings.stories.tsx
index 72fc1f72deda1..fe7032304c6e8 100644
--- a/site/src/components/TemplateVersionWarnings/TemplateVersionWarnings.stories.tsx
+++ b/site/src/components/TemplateVersionWarnings/TemplateVersionWarnings.stories.tsx
@@ -1,19 +1,16 @@
-import { Story } from "@storybook/react"
-import {
-  TemplateVersionWarnings,
-  TemplateVersionWarningsProps,
-} from "./TemplateVersionWarnings"
+import { TemplateVersionWarnings } from "./TemplateVersionWarnings";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
+const meta: Meta<typeof TemplateVersionWarnings> = {
   title: "components/TemplateVersionWarnings",
   component: TemplateVersionWarnings,
-}
+};
 
-const Template: Story<TemplateVersionWarningsProps> = (args) => (
-  <TemplateVersionWarnings {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof TemplateVersionWarnings>;
 
-export const UnsupportedWorkspaces = Template.bind({})
-UnsupportedWorkspaces.args = {
-  warnings: ["UNSUPPORTED_WORKSPACES"],
-}
+export const UnsupportedWorkspaces: Story = {
+  args: {
+    warnings: ["UNSUPPORTED_WORKSPACES"],
+  },
+};
diff --git a/site/src/components/TemplateVersionWarnings/TemplateVersionWarnings.tsx b/site/src/components/TemplateVersionWarnings/TemplateVersionWarnings.tsx
index dc80b5c39c8cd..473488bda92bb 100644
--- a/site/src/components/TemplateVersionWarnings/TemplateVersionWarnings.tsx
+++ b/site/src/components/TemplateVersionWarnings/TemplateVersionWarnings.tsx
@@ -1,27 +1,26 @@
-import { FC } from "react"
-import * as TypesGen from "api/typesGenerated"
-import { Alert } from "components/Alert/Alert"
-import { Maybe } from "components/Conditionals/Maybe"
+import { FC } from "react";
+import * as TypesGen from "api/typesGenerated";
+import { Alert } from "components/Alert/Alert";
 
 export interface TemplateVersionWarningsProps {
-  warnings?: TypesGen.TemplateVersionWarning[]
+  warnings?: TypesGen.TemplateVersionWarning[];
 }
 
 export const TemplateVersionWarnings: FC<
   React.PropsWithChildren<TemplateVersionWarningsProps>
-> = ({ warnings }) => {
-  if (!warnings) {
-    return <></>
+> = (props) => {
+  const { warnings = [] } = props;
+
+  if (!warnings.includes("UNSUPPORTED_WORKSPACES")) {
+    return null;
   }
 
   return (
-    <Maybe condition={Boolean(warnings.includes("UNSUPPORTED_WORKSPACES"))}>
-      <div data-testid="error-unsupported-workspaces">
-        <Alert severity="error">
-          This template uses legacy parameters which are not supported anymore.
-          Contact your administrator for assistance.
-        </Alert>
-      </div>
-    </Maybe>
-  )
-}
+    <div data-testid="error-unsupported-workspaces">
+      <Alert severity="error">
+        This template uses legacy parameters which are not supported anymore.
+        Contact your administrator for assistance.
+      </Alert>
+    </div>
+  );
+};
diff --git a/site/src/components/TerminalLink/TerminalLink.stories.tsx b/site/src/components/TerminalLink/TerminalLink.stories.tsx
deleted file mode 100644
index f3bb5d0c4adec..0000000000000
--- a/site/src/components/TerminalLink/TerminalLink.stories.tsx
+++ /dev/null
@@ -1,15 +0,0 @@
-import { Story } from "@storybook/react"
-import { MockWorkspace } from "testHelpers/entities"
-import { TerminalLink, TerminalLinkProps } from "./TerminalLink"
-
-export default {
-  title: "components/TerminalLink",
-  component: TerminalLink,
-}
-
-const Template: Story<TerminalLinkProps> = (args) => <TerminalLink {...args} />
-
-export const Example = Template.bind({})
-Example.args = {
-  workspaceName: MockWorkspace.name,
-}
diff --git a/site/src/components/TerminalLink/TerminalLink.tsx b/site/src/components/TerminalLink/TerminalLink.tsx
deleted file mode 100644
index f5227302c64b8..0000000000000
--- a/site/src/components/TerminalLink/TerminalLink.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-import Link from "@mui/material/Link"
-import { SecondaryAgentButton } from "components/Resources/AgentButton"
-import { FC } from "react"
-import * as TypesGen from "../../api/typesGenerated"
-import { generateRandomString } from "../../utils/random"
-
-export const Language = {
-  linkText: "Terminal",
-  terminalTitle: (identifier: string): string => `Terminal - ${identifier}`,
-}
-
-export interface TerminalLinkProps {
-  agentName?: TypesGen.WorkspaceAgent["name"]
-  userName?: TypesGen.User["username"]
-  workspaceName: TypesGen.Workspace["name"]
-}
-
-/**
- * Generate a link to a terminal connected to the provided workspace agent.  If
- * no agent is provided connect to the first agent.
- *
- * If no user name is provided "me" is used however it makes the link not
- * shareable.
- */
-export const TerminalLink: FC<React.PropsWithChildren<TerminalLinkProps>> = ({
-  agentName,
-  userName = "me",
-  workspaceName,
-}) => {
-  // Always use the primary for the terminal link. This is a relative link.
-  const href = `/@${userName}/${workspaceName}${
-    agentName ? `.${agentName}` : ""
-  }/terminal`
-
-  return (
-    <Link
-      href={href}
-      target="_blank"
-      onClick={(event) => {
-        event.preventDefault()
-        window.open(
-          href,
-          Language.terminalTitle(generateRandomString(12)),
-          "width=900,height=600",
-        )
-      }}
-      data-testid="terminal"
-    >
-      <SecondaryAgentButton>{Language.linkText}</SecondaryAgentButton>
-    </Link>
-  )
-}
diff --git a/site/src/components/Timeline/Timeline.test.tsx b/site/src/components/Timeline/Timeline.test.tsx
deleted file mode 100644
index d984f33ec15da..0000000000000
--- a/site/src/components/Timeline/Timeline.test.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import { createDisplayDate } from "./TimelineDateRow"
-
-describe("createDisplayDate", () => {
-  it("returns correctly for Saturdays", () => {
-    const now = new Date(2020, 1, 7)
-    const date = new Date(
-      now.getFullYear(),
-      now.getMonth(),
-      // Previous Saturday, from now.
-      now.getDate() - now.getDay() - 1,
-    )
-    expect(createDisplayDate(date, now)).toEqual("last Saturday")
-  })
-})
diff --git a/site/src/components/Timeline/Timeline.tsx b/site/src/components/Timeline/Timeline.tsx
index 02f23697563cd..ad7041d5e98fa 100644
--- a/site/src/components/Timeline/Timeline.tsx
+++ b/site/src/components/Timeline/Timeline.tsx
@@ -1,31 +1,31 @@
-import { TimelineDateRow } from "components/Timeline/TimelineDateRow"
-import { Fragment } from "react"
+import { TimelineDateRow } from "components/Timeline/TimelineDateRow";
+import { Fragment } from "react";
 
-type GetDateFn<TData> = (data: TData) => Date
+type GetDateFn<TData> = (data: TData) => Date;
 
 const groupByDate = <TData,>(
   items: TData[],
   getDate: GetDateFn<TData>,
 ): Record<string, TData[]> => {
-  const itemsByDate: Record<string, TData[]> = {}
+  const itemsByDate: Record<string, TData[]> = {};
 
   items.forEach((item) => {
-    const dateKey = getDate(item).toDateString()
+    const dateKey = getDate(item).toDateString();
 
     if (dateKey in itemsByDate) {
-      itemsByDate[dateKey].push(item)
+      itemsByDate[dateKey].push(item);
     } else {
-      itemsByDate[dateKey] = [item]
+      itemsByDate[dateKey] = [item];
     }
-  })
+  });
 
-  return itemsByDate
-}
+  return itemsByDate;
+};
 
 export interface TimelineProps<TData> {
-  items: TData[]
-  getDate: GetDateFn<TData>
-  row: (item: TData) => JSX.Element
+  items: TData[];
+  getDate: GetDateFn<TData>;
+  row: (item: TData) => JSX.Element;
 }
 
 export const Timeline = <TData,>({
@@ -33,20 +33,20 @@ export const Timeline = <TData,>({
   getDate,
   row,
 }: TimelineProps<TData>): JSX.Element => {
-  const itemsByDate = groupByDate(items, getDate)
+  const itemsByDate = groupByDate(items, getDate);
 
   return (
     <>
       {Object.keys(itemsByDate).map((dateStr) => {
-        const items = itemsByDate[dateStr]
+        const items = itemsByDate[dateStr];
 
         return (
           <Fragment key={dateStr}>
             <TimelineDateRow date={new Date(dateStr)} />
             {items.map(row)}
           </Fragment>
-        )
+        );
       })}
     </>
-  )
-}
+  );
+};
diff --git a/site/src/components/Timeline/TimelineDateRow.tsx b/site/src/components/Timeline/TimelineDateRow.tsx
index 3a0fd040ef0af..1e67979ad6fb2 100644
--- a/site/src/components/Timeline/TimelineDateRow.tsx
+++ b/site/src/components/Timeline/TimelineDateRow.tsx
@@ -1,45 +1,39 @@
-import { makeStyles } from "@mui/styles"
-import TableCell from "@mui/material/TableCell"
-import TableRow from "@mui/material/TableRow"
-import formatRelative from "date-fns/formatRelative"
-import { FC } from "react"
+import TableCell from "@mui/material/TableCell";
+import TableRow from "@mui/material/TableRow";
+import { type FC } from "react";
+import { css, useTheme } from "@emotion/react";
+import { createDisplayDate } from "./utils";
 
 export interface TimelineDateRow {
-  date: Date
+  date: Date;
 }
 
-// We only want the message related to the date since the time is displayed
-// inside of the build row
-export const createDisplayDate = (date: Date, base = new Date()): string =>
-  formatRelative(date, base).split(" at ")[0]
-
 export const TimelineDateRow: FC<TimelineDateRow> = ({ date }) => {
-  const styles = useStyles()
+  const theme = useTheme();
 
   return (
-    <TableRow className={styles.dateRow}>
-      <TableCell className={styles.dateCell} title={date.toLocaleDateString()}>
+    <TableRow
+      css={css`
+        background: ${theme.palette.background.paper};
+
+        &:not(:first-of-type) td {
+          border-top: 1px solid ${theme.palette.divider};
+        }
+      `}
+    >
+      <TableCell
+        css={{
+          padding: `${theme.spacing(1, 4)} !important`,
+          background: `${theme.palette.background.paperLight} !important`,
+          fontSize: 12,
+          position: "relative",
+          color: theme.palette.text.secondary,
+          textTransform: "capitalize",
+        }}
+        title={date.toLocaleDateString()}
+      >
         {createDisplayDate(date)}
       </TableCell>
     </TableRow>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  dateRow: {
-    background: theme.palette.background.paper,
-
-    "&:not(:first-of-type) td": {
-      borderTop: `1px solid ${theme.palette.divider}`,
-    },
-  },
-
-  dateCell: {
-    padding: `${theme.spacing(1, 4)} !important`,
-    background: `${theme.palette.background.paperLight} !important`,
-    fontSize: 12,
-    position: "relative",
-    color: theme.palette.text.secondary,
-    textTransform: "capitalize",
-  },
-}))
+  );
+};
diff --git a/site/src/components/Timeline/TimelineEntry.tsx b/site/src/components/Timeline/TimelineEntry.tsx
index a0156b40a5bfb..40985af99a1fe 100644
--- a/site/src/components/Timeline/TimelineEntry.tsx
+++ b/site/src/components/Timeline/TimelineEntry.tsx
@@ -1,20 +1,23 @@
-import { makeStyles } from "@mui/styles"
-import TableRow, { TableRowProps } from "@mui/material/TableRow"
-import { PropsWithChildren } from "react"
-import { combineClasses } from "utils/combineClasses"
+import { makeStyles } from "@mui/styles";
+import TableRow, { TableRowProps } from "@mui/material/TableRow";
+import { type PropsWithChildren, forwardRef } from "react";
+import { combineClasses } from "utils/combineClasses";
 
-interface TimelineEntryProps {
-  clickable?: boolean
-}
+type TimelineEntryProps = PropsWithChildren<
+  TableRowProps & {
+    clickable?: boolean;
+  }
+>;
+
+export const TimelineEntry = forwardRef(function TimelineEntry(
+  { children, clickable = true, ...props }: TimelineEntryProps,
+  ref?: React.ForwardedRef<HTMLTableRowElement>,
+) {
+  const styles = useStyles();
 
-export const TimelineEntry = ({
-  children,
-  clickable = true,
-  ...props
-}: PropsWithChildren<TimelineEntryProps & TableRowProps>): JSX.Element => {
-  const styles = useStyles()
   return (
     <TableRow
+      ref={ref}
       className={combineClasses({
         [styles.timelineEntry]: true,
         [styles.clickable]: clickable,
@@ -23,8 +26,8 @@ export const TimelineEntry = ({
     >
       {children}
     </TableRow>
-  )
-}
+  );
+});
 
 const useStyles = makeStyles((theme) => ({
   clickable: {
@@ -53,4 +56,4 @@ const useStyles = makeStyles((theme) => ({
       background: theme.palette.divider,
     },
   },
-}))
+}));
diff --git a/site/src/components/Timeline/utils.test.ts b/site/src/components/Timeline/utils.test.ts
new file mode 100644
index 0000000000000..c377321258997
--- /dev/null
+++ b/site/src/components/Timeline/utils.test.ts
@@ -0,0 +1,14 @@
+import { createDisplayDate } from "./utils";
+
+describe("createDisplayDate", () => {
+  it("returns correctly for Saturdays", () => {
+    const now = new Date(2020, 1, 7);
+    const date = new Date(
+      now.getFullYear(),
+      now.getMonth(),
+      // Previous Saturday, from now.
+      now.getDate() - now.getDay() - 1,
+    );
+    expect(createDisplayDate(date, now)).toEqual("last Saturday");
+  });
+});
diff --git a/site/src/components/Timeline/utils.ts b/site/src/components/Timeline/utils.ts
new file mode 100644
index 0000000000000..f37a4c57c5499
--- /dev/null
+++ b/site/src/components/Timeline/utils.ts
@@ -0,0 +1,15 @@
+/* eslint-disable eslint-comments/disable-enable-pair -- Solve below */
+/* eslint-disable import/no-duplicates -- https://github.com/date-fns/date-fns/issues/1677 */
+import formatRelative from "date-fns/formatRelative";
+import subDays from "date-fns/subDays";
+
+export const createDisplayDate = (
+  date: Date,
+  base: Date = new Date(),
+): string => {
+  const lastWeek = subDays(base, 7);
+  if (date >= lastWeek) {
+    return formatRelative(date, base).split(" at ")[0];
+  }
+  return date.toLocaleDateString();
+};
diff --git a/site/src/components/Tooltips/AgentOutdatedTooltip.tsx b/site/src/components/Tooltips/AgentOutdatedTooltip.tsx
deleted file mode 100644
index eb706f3a58fc2..0000000000000
--- a/site/src/components/Tooltips/AgentOutdatedTooltip.tsx
+++ /dev/null
@@ -1,88 +0,0 @@
-import { ComponentProps, FC } from "react"
-import { makeStyles } from "@mui/styles"
-import RefreshIcon from "@mui/icons-material/RefreshOutlined"
-import {
-  HelpTooltipText,
-  HelpPopover,
-  HelpTooltipTitle,
-  HelpTooltipAction,
-  HelpTooltipLinksGroup,
-  HelpTooltipContext,
-} from "components/Tooltips/HelpTooltip"
-import { WorkspaceAgent } from "api/typesGenerated"
-import { Stack } from "components/Stack/Stack"
-import { useTranslation } from "react-i18next"
-
-type AgentOutdatedTooltipProps = ComponentProps<typeof HelpPopover> & {
-  agent: WorkspaceAgent
-  serverVersion: string
-  onUpdate: () => void
-}
-
-export const AgentOutdatedTooltip: FC<AgentOutdatedTooltipProps> = ({
-  agent,
-  serverVersion,
-  onUpdate,
-  onOpen,
-  id,
-  open,
-  onClose,
-  anchorEl,
-}) => {
-  const styles = useStyles()
-  const { t } = useTranslation("workspacePage")
-
-  return (
-    <HelpPopover
-      id={id}
-      open={open}
-      anchorEl={anchorEl}
-      onOpen={onOpen}
-      onClose={onClose}
-    >
-      <HelpTooltipContext.Provider value={{ open, onClose }}>
-        <Stack spacing={1}>
-          <div>
-            <HelpTooltipTitle>
-              {t("agentOutdatedTooltip.title")}
-            </HelpTooltipTitle>
-            <HelpTooltipText>
-              {t("agentOutdatedTooltip.description")}
-            </HelpTooltipText>
-          </div>
-
-          <Stack spacing={0.5}>
-            <span className={styles.versionLabel}>
-              {t("agentOutdatedTooltip.agentVersionLabel")}
-            </span>
-            <span>{agent.version}</span>
-          </Stack>
-
-          <Stack spacing={0.5}>
-            <span className={styles.versionLabel}>
-              {t("agentOutdatedTooltip.serverVersionLabel")}
-            </span>
-            <span>{serverVersion}</span>
-          </Stack>
-
-          <HelpTooltipLinksGroup>
-            <HelpTooltipAction
-              icon={RefreshIcon}
-              onClick={onUpdate}
-              ariaLabel="Update workspace"
-            >
-              {t("agentOutdatedTooltip.updateWorkspaceLabel")}
-            </HelpTooltipAction>
-          </HelpTooltipLinksGroup>
-        </Stack>
-      </HelpTooltipContext.Provider>
-    </HelpPopover>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  versionLabel: {
-    fontWeight: 600,
-    color: theme.palette.text.primary,
-  },
-}))
diff --git a/site/src/components/Tooltips/HelpTooltip/HelpTooltip.stories.tsx b/site/src/components/Tooltips/HelpTooltip/HelpTooltip.stories.tsx
deleted file mode 100644
index 420dc73554dbe..0000000000000
--- a/site/src/components/Tooltips/HelpTooltip/HelpTooltip.stories.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import {
-  HelpTooltip,
-  HelpTooltipLink,
-  HelpTooltipLinksGroup,
-  HelpTooltipProps,
-  HelpTooltipText,
-  HelpTooltipTitle,
-} from "./HelpTooltip"
-
-export default {
-  title: "components/HelpTooltip",
-  component: HelpTooltip,
-} as ComponentMeta<typeof HelpTooltip>
-
-const Template: Story<HelpTooltipProps> = (args) => (
-  <HelpTooltip {...args}>
-    <HelpTooltipTitle>What is a template?</HelpTooltipTitle>
-    <HelpTooltipText>
-      A template is a common configuration for your team&apos;s workspaces.
-    </HelpTooltipText>
-    <HelpTooltipLinksGroup>
-      <HelpTooltipLink href="https://github.com/coder/coder/">
-        Creating a template
-      </HelpTooltipLink>
-      <HelpTooltipLink href="https://github.com/coder/coder/">
-        Updating a template
-      </HelpTooltipLink>
-    </HelpTooltipLinksGroup>
-  </HelpTooltip>
-)
-
-export const Close = Template.bind({})
-
-export const Open = Template.bind({})
-Open.args = {
-  open: true,
-}
diff --git a/site/src/components/Tooltips/HelpTooltip/HelpTooltip.tsx b/site/src/components/Tooltips/HelpTooltip/HelpTooltip.tsx
deleted file mode 100644
index 114d31234c48b..0000000000000
--- a/site/src/components/Tooltips/HelpTooltip/HelpTooltip.tsx
+++ /dev/null
@@ -1,303 +0,0 @@
-import Link from "@mui/material/Link"
-import Popover, { PopoverProps } from "@mui/material/Popover"
-import { makeStyles } from "@mui/styles"
-import HelpIcon from "@mui/icons-material/HelpOutline"
-import OpenInNewIcon from "@mui/icons-material/OpenInNew"
-import {
-  createContext,
-  useContext,
-  useRef,
-  useState,
-  FC,
-  PropsWithChildren,
-} from "react"
-import { combineClasses } from "utils/combineClasses"
-import { Stack } from "../../Stack/Stack"
-
-type Icon = typeof HelpIcon
-
-type Size = "small" | "medium"
-export interface HelpTooltipProps {
-  // Useful to test on storybook
-  open?: boolean
-  size?: Size
-  icon?: Icon
-  iconClassName?: string
-  buttonClassName?: string
-}
-
-export const HelpTooltipContext = createContext<
-  { open: boolean; onClose: () => void } | undefined
->(undefined)
-
-const useHelpTooltip = () => {
-  const helpTooltipContext = useContext(HelpTooltipContext)
-
-  if (!helpTooltipContext) {
-    throw new Error(
-      "This hook should be used in side of the HelpTooltipContext.",
-    )
-  }
-
-  return helpTooltipContext
-}
-
-export const HelpPopover: FC<
-  PopoverProps & { onOpen: () => void; onClose: () => void }
-> = ({ onOpen, onClose, children, ...props }) => {
-  const styles = useStyles({ size: "small" })
-
-  return (
-    <Popover
-      className={styles.popover}
-      classes={{ paper: styles.popoverPaper }}
-      onClose={onClose}
-      anchorOrigin={{
-        vertical: "bottom",
-        horizontal: "left",
-      }}
-      transformOrigin={{
-        vertical: "top",
-        horizontal: "left",
-      }}
-      PaperProps={{
-        onMouseEnter: onOpen,
-        onMouseLeave: onClose,
-      }}
-      {...props}
-    >
-      {children}
-    </Popover>
-  )
-}
-
-export const HelpTooltip: FC<PropsWithChildren<HelpTooltipProps>> = ({
-  children,
-  open,
-  size = "medium",
-  icon: Icon = HelpIcon,
-  iconClassName,
-  buttonClassName,
-}) => {
-  const styles = useStyles({ size })
-  const anchorRef = useRef<HTMLButtonElement>(null)
-  const [isOpen, setIsOpen] = useState(Boolean(open))
-  const id = isOpen ? "help-popover" : undefined
-
-  const onClose = () => {
-    setIsOpen(false)
-  }
-
-  return (
-    <>
-      <button
-        ref={anchorRef}
-        aria-describedby={id}
-        className={combineClasses([styles.button, buttonClassName])}
-        onClick={(event) => {
-          event.stopPropagation()
-          setIsOpen(true)
-        }}
-        onMouseEnter={() => {
-          setIsOpen(true)
-        }}
-        onMouseLeave={() => {
-          setIsOpen(false)
-        }}
-        aria-label="More info"
-      >
-        <Icon className={combineClasses([styles.icon, iconClassName])} />
-      </button>
-      <HelpPopover
-        id={id}
-        open={isOpen}
-        anchorEl={anchorRef.current}
-        onOpen={() => setIsOpen(true)}
-        onClose={() => setIsOpen(false)}
-      >
-        <HelpTooltipContext.Provider value={{ open: isOpen, onClose }}>
-          {children}
-        </HelpTooltipContext.Provider>
-      </HelpPopover>
-    </>
-  )
-}
-
-export const HelpTooltipTitle: FC<PropsWithChildren<unknown>> = ({
-  children,
-}) => {
-  const styles = useStyles({})
-
-  return <h4 className={styles.title}>{children}</h4>
-}
-
-export const HelpTooltipText: FC<PropsWithChildren<unknown>> = ({
-  children,
-}) => {
-  const styles = useStyles({})
-
-  return <p className={styles.text}>{children}</p>
-}
-
-export const HelpTooltipLink: FC<PropsWithChildren<{ href: string }>> = ({
-  children,
-  href,
-}) => {
-  const styles = useStyles({})
-
-  return (
-    <Link href={href} target="_blank" rel="noreferrer" className={styles.link}>
-      <OpenInNewIcon className={styles.linkIcon} />
-      {children}
-    </Link>
-  )
-}
-
-export const HelpTooltipAction: FC<
-  PropsWithChildren<{
-    icon: Icon
-    onClick: () => void
-    ariaLabel?: string
-  }>
-> = ({ children, icon: Icon, onClick, ariaLabel }) => {
-  const styles = useStyles({})
-  const tooltip = useHelpTooltip()
-
-  return (
-    <button
-      aria-label={ariaLabel ?? ""}
-      className={styles.action}
-      onClick={(event) => {
-        event.stopPropagation()
-        onClick()
-        tooltip.onClose()
-      }}
-    >
-      <Icon className={styles.actionIcon} />
-      {children}
-    </button>
-  )
-}
-
-export const HelpTooltipLinksGroup: FC<PropsWithChildren<unknown>> = ({
-  children,
-}) => {
-  const styles = useStyles({})
-
-  return (
-    <Stack spacing={1} className={styles.linksGroup}>
-      {children}
-    </Stack>
-  )
-}
-
-const getButtonSpacingFromSize = (size?: Size): number => {
-  switch (size) {
-    case "small":
-      return 2.5
-    case "medium":
-    default:
-      return 3
-  }
-}
-
-const getIconSpacingFromSize = (size?: Size): number => {
-  switch (size) {
-    case "small":
-      return 1.5
-    case "medium":
-    default:
-      return 2
-  }
-}
-
-const useStyles = makeStyles((theme) => ({
-  button: {
-    display: "flex",
-    alignItems: "center",
-    justifyContent: "center",
-    width: ({ size }: { size?: Size }) =>
-      theme.spacing(getButtonSpacingFromSize(size)),
-    height: ({ size }: { size?: Size }) =>
-      theme.spacing(getButtonSpacingFromSize(size)),
-    padding: 0,
-    border: 0,
-    background: "transparent",
-    color: theme.palette.text.primary,
-    opacity: 0.5,
-    cursor: "pointer",
-
-    "&:hover": {
-      opacity: 0.75,
-    },
-  },
-
-  icon: {
-    width: ({ size }: { size?: Size }) =>
-      theme.spacing(getIconSpacingFromSize(size)),
-    height: ({ size }: { size?: Size }) =>
-      theme.spacing(getIconSpacingFromSize(size)),
-  },
-
-  popover: {
-    pointerEvents: "none",
-  },
-
-  popoverPaper: {
-    marginTop: theme.spacing(0.5),
-    width: theme.spacing(38),
-    padding: theme.spacing(2.5),
-    color: theme.palette.text.secondary,
-    pointerEvents: "auto",
-    ...theme.typography.body2,
-  },
-
-  title: {
-    marginTop: 0,
-    marginBottom: theme.spacing(1),
-    color: theme.palette.text.primary,
-    fontSize: 14,
-    fontWeight: 600,
-  },
-
-  text: {
-    marginTop: theme.spacing(0.5),
-    marginBottom: theme.spacing(0.5),
-    ...theme.typography.body2,
-  },
-
-  link: {
-    display: "flex",
-    alignItems: "center",
-    ...theme.typography.body2,
-  },
-
-  linkIcon: {
-    color: "inherit",
-    width: 14,
-    height: 14,
-    marginRight: theme.spacing(1),
-  },
-
-  linksGroup: {
-    marginTop: theme.spacing(2),
-  },
-
-  action: {
-    display: "flex",
-    alignItems: "center",
-    background: "none",
-    border: 0,
-    color: theme.palette.primary.light,
-    padding: 0,
-    cursor: "pointer",
-    fontSize: 14,
-  },
-
-  actionIcon: {
-    color: "inherit",
-    width: 14,
-    height: 14,
-    marginRight: theme.spacing(1),
-  },
-}))
diff --git a/site/src/components/Tooltips/HelpTooltip/index.ts b/site/src/components/Tooltips/HelpTooltip/index.ts
deleted file mode 100644
index 588febfa26ab1..0000000000000
--- a/site/src/components/Tooltips/HelpTooltip/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export * from "./HelpTooltip"
diff --git a/site/src/components/Tooltips/UserRoleHelpTooltip.tsx b/site/src/components/Tooltips/UserRoleHelpTooltip.tsx
deleted file mode 100644
index c446f5a32c8d0..0000000000000
--- a/site/src/components/Tooltips/UserRoleHelpTooltip.tsx
+++ /dev/null
@@ -1,31 +0,0 @@
-import { FC } from "react"
-import {
-  HelpTooltip,
-  HelpTooltipLink,
-  HelpTooltipLinksGroup,
-  HelpTooltipText,
-  HelpTooltipTitle,
-} from "./HelpTooltip"
-import { docs } from "utils/docs"
-
-export const Language = {
-  title: "What is a role?",
-  text:
-    "Coder role-based access control (RBAC) provides fine-grained access management. " +
-    "View our docs on how to use the available roles.",
-  link: "User Roles",
-}
-
-export const UserRoleHelpTooltip: FC = () => {
-  return (
-    <HelpTooltip size="small">
-      <HelpTooltipTitle>{Language.title}</HelpTooltipTitle>
-      <HelpTooltipText>{Language.text}</HelpTooltipText>
-      <HelpTooltipLinksGroup>
-        <HelpTooltipLink href={docs("/admin/users#roles")}>
-          {Language.link}
-        </HelpTooltipLink>
-      </HelpTooltipLinksGroup>
-    </HelpTooltip>
-  )
-}
diff --git a/site/src/components/Tooltips/WorkspaceHelpTooltip.tsx b/site/src/components/Tooltips/WorkspaceHelpTooltip.tsx
deleted file mode 100644
index 58001bd9b85a0..0000000000000
--- a/site/src/components/Tooltips/WorkspaceHelpTooltip.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-import { FC } from "react"
-import {
-  HelpTooltip,
-  HelpTooltipLink,
-  HelpTooltipLinksGroup,
-  HelpTooltipText,
-  HelpTooltipTitle,
-} from "./HelpTooltip"
-import { docs } from "utils/docs"
-
-const Language = {
-  workspaceTooltipTitle: "What is a workspace?",
-  workspaceTooltipText:
-    "A workspace is your development environment in the cloud. It includes the infrastructure and tools you need to work on your project.",
-  workspaceTooltipLink1: "Create Workspaces",
-  workspaceTooltipLink2: "Connect with SSH",
-  workspaceTooltipLink3: "Editors and IDEs",
-}
-
-export const WorkspaceHelpTooltip: FC = () => {
-  return (
-    <HelpTooltip>
-      <HelpTooltipTitle>{Language.workspaceTooltipTitle}</HelpTooltipTitle>
-      <HelpTooltipText>{Language.workspaceTooltipText}</HelpTooltipText>
-      <HelpTooltipLinksGroup>
-        <HelpTooltipLink href={docs("/workspaces#create-workspaces")}>
-          {Language.workspaceTooltipLink1}
-        </HelpTooltipLink>
-        <HelpTooltipLink href={docs("/workspaces#connect-with-ssh")}>
-          {Language.workspaceTooltipLink2}
-        </HelpTooltipLink>
-        <HelpTooltipLink href={docs("/workspaces#editors-and-ides")}>
-          {Language.workspaceTooltipLink3}
-        </HelpTooltipLink>
-      </HelpTooltipLinksGroup>
-    </HelpTooltip>
-  )
-}
diff --git a/site/src/components/Tooltips/WorkspaceOutdatedTooltip.tsx b/site/src/components/Tooltips/WorkspaceOutdatedTooltip.tsx
deleted file mode 100644
index a00ab665b5854..0000000000000
--- a/site/src/components/Tooltips/WorkspaceOutdatedTooltip.tsx
+++ /dev/null
@@ -1,140 +0,0 @@
-import RefreshIcon from "@mui/icons-material/Refresh"
-import { FC } from "react"
-import {
-  HelpTooltip,
-  HelpTooltipAction,
-  HelpTooltipLinksGroup,
-  HelpTooltipText,
-  HelpTooltipTitle,
-} from "./HelpTooltip"
-import InfoIcon from "@mui/icons-material/InfoOutlined"
-import { makeStyles } from "@mui/styles"
-import { colors } from "theme/colors"
-import { useQuery } from "@tanstack/react-query"
-import { getTemplate, getTemplateVersion } from "api/api"
-import Box from "@mui/material/Box"
-import Skeleton from "@mui/material/Skeleton"
-import Link from "@mui/material/Link"
-
-export const Language = {
-  outdatedLabel: "Outdated",
-  versionTooltipText:
-    "This workspace version is outdated and a newer version is available.",
-  updateVersionLabel: "Update version",
-}
-
-interface TooltipProps {
-  onUpdateVersion: () => void
-  templateId: string
-  templateName: string
-  ariaLabel?: string
-}
-
-export const WorkspaceOutdatedTooltip: FC<TooltipProps> = ({
-  onUpdateVersion,
-  ariaLabel,
-  templateId,
-  templateName,
-}) => {
-  const styles = useStyles()
-  const { data: activeVersion } = useQuery({
-    queryFn: async () => {
-      const template = await getTemplate(templateId)
-      const activeVersion = await getTemplateVersion(template.active_version_id)
-      return activeVersion
-    },
-    queryKey: ["templates", templateId, "activeVersion"],
-  })
-
-  return (
-    <HelpTooltip
-      size="small"
-      icon={InfoIcon}
-      iconClassName={styles.icon}
-      buttonClassName={styles.button}
-    >
-      <HelpTooltipTitle>{Language.outdatedLabel}</HelpTooltipTitle>
-      <HelpTooltipText>{Language.versionTooltipText}</HelpTooltipText>
-
-      <Box
-        sx={{
-          display: "flex",
-          flexDirection: "column",
-          gap: 1,
-          py: 1,
-          fontSize: 13,
-        }}
-      >
-        <Box>
-          <Box
-            sx={{
-              color: (theme) => theme.palette.text.primary,
-              fontWeight: 600,
-            }}
-          >
-            New version
-          </Box>
-          <Box>
-            {activeVersion ? (
-              <Link
-                href={`/templates/${templateName}/versions/${activeVersion.name}`}
-                target="_blank"
-                sx={{ color: (theme) => theme.palette.primary.light }}
-              >
-                {activeVersion.name}
-              </Link>
-            ) : (
-              <Skeleton variant="text" height={20} width={100} />
-            )}
-          </Box>
-        </Box>
-
-        <Box>
-          <Box
-            sx={{
-              color: (theme) => theme.palette.text.primary,
-              fontWeight: 600,
-            }}
-          >
-            Message
-          </Box>
-          <Box>
-            {activeVersion ? (
-              activeVersion.message === "" ? (
-                "No message"
-              ) : (
-                activeVersion.message
-              )
-            ) : (
-              <Skeleton variant="text" height={20} width={150} />
-            )}
-          </Box>
-        </Box>
-      </Box>
-
-      <HelpTooltipLinksGroup>
-        <HelpTooltipAction
-          icon={RefreshIcon}
-          onClick={onUpdateVersion}
-          ariaLabel={ariaLabel}
-        >
-          {Language.updateVersionLabel}
-        </HelpTooltipAction>
-      </HelpTooltipLinksGroup>
-    </HelpTooltip>
-  )
-}
-
-const useStyles = makeStyles(() => ({
-  icon: {
-    color: colors.yellow[5],
-  },
-
-  button: {
-    opacity: 1,
-
-    "&:hover": {
-      opacity: 1,
-    },
-  },
-}))
diff --git a/site/src/components/Tooltips/index.ts b/site/src/components/Tooltips/index.ts
deleted file mode 100644
index a1b1d768038da..0000000000000
--- a/site/src/components/Tooltips/index.ts
+++ /dev/null
@@ -1,4 +0,0 @@
-export { AuditHelpTooltip } from "./AuditHelpTooltip"
-export { WorkspaceOutdatedTooltip } from "./WorkspaceOutdatedTooltip"
-export { UserRoleHelpTooltip } from "./UserRoleHelpTooltip"
-export { WorkspaceHelpTooltip } from "./WorkspaceHelpTooltip"
diff --git a/site/src/components/Typography/Typography.stories.tsx b/site/src/components/Typography/Typography.stories.tsx
index dd3f218df2159..b5c979f1c975a 100644
--- a/site/src/components/Typography/Typography.stories.tsx
+++ b/site/src/components/Typography/Typography.stories.tsx
@@ -1,25 +1,25 @@
-import { Story } from "@storybook/react"
-import { Typography, TypographyProps } from "./Typography"
+import { Typography } from "./Typography";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
+const meta: Meta<typeof Typography> = {
   title: "components/Typography",
   component: Typography,
-}
+  args: {
+    children: "Colorless green ideas sleep furiously",
+  },
+};
 
-const Template: Story<TypographyProps> = (args: TypographyProps) => (
-  <>
-    <Typography {...args}>Colorless green ideas sleep furiously</Typography>
-    <Typography {...args}>
-      More people have been to France than I have
-    </Typography>
-  </>
-)
+export default meta;
+type Story = StoryObj<typeof Typography>;
 
-export const Short = Template.bind({})
-Short.args = {
-  short: true,
-}
-export const Tall = Template.bind({})
-Tall.args = {
-  short: false,
-}
+export const Short: Story = {
+  args: {
+    short: true,
+  },
+};
+
+export const Tall: Story = {
+  args: {
+    short: false,
+  },
+};
diff --git a/site/src/components/Typography/Typography.tsx b/site/src/components/Typography/Typography.tsx
index e5c539aeb7159..ce210a067eebf 100644
--- a/site/src/components/Typography/Typography.tsx
+++ b/site/src/components/Typography/Typography.tsx
@@ -3,15 +3,13 @@
  * verbatim port from `@coder/ui`.
  */
 
-import { makeStyles } from "@mui/styles"
 import MuiTypography, {
   TypographyProps as MuiTypographyProps,
-} from "@mui/material/Typography"
-import * as React from "react"
-import { appendCSSString, combineClasses } from "../../utils/combineClasses"
+} from "@mui/material/Typography";
+import * as React from "react";
 
 export interface TypographyProps extends MuiTypographyProps {
-  short?: boolean
+  short?: boolean;
 }
 
 /**
@@ -20,29 +18,21 @@ export interface TypographyProps extends MuiTypographyProps {
  *
  * See original component's Material UI documentation here: https://material-ui.com/components/typography/
  */
-export const Typography: React.FC<TypographyProps> = ({
-  className,
-  short,
-  ...rest
-}) => {
-  const styles = useStyles()
-
-  let classes = combineClasses({ [styles.short]: short })
-  if (className) {
-    classes = appendCSSString(classes ?? "", className)
-  }
-
-  return <MuiTypography {...rest} className={classes} />
-}
-
-const useStyles = makeStyles({
-  short: {
-    "&.MuiTypography-body1": {
-      lineHeight: "21px",
-    },
-    "&.MuiTypography-body2": {
-      lineHeight: "18px",
-      letterSpacing: 0.2,
-    },
-  },
-})
+export const Typography: React.FC<TypographyProps> = ({ short, ...attrs }) => {
+  return (
+    <MuiTypography
+      css={[
+        short && {
+          "&.MuiTypography-body1": {
+            lineHeight: "21px",
+          },
+          "&.MuiTypography-body2": {
+            lineHeight: "18px",
+            letterSpacing: 0.2,
+          },
+        },
+      ]}
+      {...attrs}
+    />
+  );
+};
diff --git a/site/src/components/UserAutocomplete/UserAutocomplete.stories.tsx b/site/src/components/UserAutocomplete/UserAutocomplete.stories.tsx
index 090c903a512fb..9558c14b2d20a 100644
--- a/site/src/components/UserAutocomplete/UserAutocomplete.stories.tsx
+++ b/site/src/components/UserAutocomplete/UserAutocomplete.stories.tsx
@@ -1,23 +1,24 @@
-import { Story } from "@storybook/react"
-import { MockUser } from "testHelpers/entities"
-import { UserAutocomplete, UserAutocompleteProps } from "./UserAutocomplete"
+import { MockUser } from "testHelpers/entities";
+import { UserAutocomplete } from "./UserAutocomplete";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
+const meta: Meta<typeof UserAutocomplete> = {
   title: "components/UserAutocomplete",
   component: UserAutocomplete,
-}
+};
 
-const Template: Story<UserAutocompleteProps> = (
-  args: UserAutocompleteProps,
-) => <UserAutocomplete {...args} />
+export default meta;
+type Story = StoryObj<typeof UserAutocomplete>;
 
-export const Example = Template.bind({})
-Example.args = {
-  value: MockUser,
-  label: "User",
-}
+export const Example: Story = {
+  args: {
+    value: MockUser,
+    label: "User",
+  },
+};
 
-export const NoLabel = Template.bind({})
-NoLabel.args = {
-  value: MockUser,
-}
+export const NoLabel: Story = {
+  args: {
+    value: MockUser,
+  },
+};
diff --git a/site/src/components/UserAutocomplete/UserAutocomplete.tsx b/site/src/components/UserAutocomplete/UserAutocomplete.tsx
index a5f1727e93b45..44aee30bc5c89 100644
--- a/site/src/components/UserAutocomplete/UserAutocomplete.tsx
+++ b/site/src/components/UserAutocomplete/UserAutocomplete.tsx
@@ -1,24 +1,24 @@
-import CircularProgress from "@mui/material/CircularProgress"
-import { makeStyles } from "@mui/styles"
-import TextField from "@mui/material/TextField"
-import Autocomplete from "@mui/material/Autocomplete"
-import { useMachine } from "@xstate/react"
-import { User } from "api/typesGenerated"
-import { Avatar } from "components/Avatar/Avatar"
-import { AvatarData } from "components/AvatarData/AvatarData"
-import debounce from "just-debounce-it"
-import { ChangeEvent, ComponentProps, FC, useEffect, useState } from "react"
-import { searchUserMachine } from "xServices/users/searchUserXService"
-import { useTranslation } from "react-i18next"
-import Box from "@mui/material/Box"
+import CircularProgress from "@mui/material/CircularProgress";
+import { makeStyles } from "@mui/styles";
+import TextField from "@mui/material/TextField";
+import Autocomplete from "@mui/material/Autocomplete";
+import { User } from "api/typesGenerated";
+import { Avatar } from "components/Avatar/Avatar";
+import { AvatarData } from "components/AvatarData/AvatarData";
+import { ChangeEvent, ComponentProps, FC, useState } from "react";
+import Box from "@mui/material/Box";
+import { useDebouncedFunction } from "hooks/debounce";
+import { useQuery } from "react-query";
+import { users } from "api/queries/users";
+import { prepareQuery } from "utils/filters";
 
 export type UserAutocompleteProps = {
-  value: User | null
-  onChange: (user: User | null) => void
-  label?: string
-  className?: string
-  size?: ComponentProps<typeof TextField>["size"]
-}
+  value: User | null;
+  onChange: (user: User | null) => void;
+  label?: string;
+  className?: string;
+  size?: ComponentProps<typeof TextField>["size"];
+};
 
 export const UserAutocomplete: FC<UserAutocompleteProps> = ({
   value,
@@ -27,49 +27,59 @@ export const UserAutocomplete: FC<UserAutocompleteProps> = ({
   className,
   size = "small",
 }) => {
-  const styles = useStyles()
-  const { t } = useTranslation("common")
-  const [isAutocompleteOpen, setIsAutocompleteOpen] = useState(false)
-  const [searchState, sendSearch] = useMachine(searchUserMachine)
-  const { searchResults } = searchState.context
+  const styles = useStyles();
+  const [autoComplete, setAutoComplete] = useState<{
+    value: string;
+    open: boolean;
+  }>({
+    value: value?.email ?? "",
+    open: false,
+  });
+  const usersQuery = useQuery({
+    ...users({
+      q: prepareQuery(encodeURI(autoComplete.value)),
+      limit: 25,
+    }),
+    enabled: autoComplete.open,
+    keepPreviousData: true,
+  });
 
-  // seed list of options on the first page load if a user pases in a value
-  // since some organizations have long lists of users, we do not load all options on page load.
-  useEffect(() => {
-    if (value) {
-      sendSearch("SEARCH", { query: value.email })
-    }
-    // eslint-disable-next-line react-hooks/exhaustive-deps -- TODO look into this
-  }, [])
-
-  const handleFilterChange = debounce(
+  const { debounced: debouncedInputOnChange } = useDebouncedFunction(
     (event: ChangeEvent<HTMLInputElement>) => {
-      sendSearch("SEARCH", { query: event.target.value })
+      setAutoComplete((state) => ({
+        ...state,
+        value: event.target.value,
+      }));
     },
-    1000,
-  )
+    750,
+  );
 
   return (
     <Autocomplete
-      noOptionsText={t("forms.typeToSearch")}
+      // Since the values are filtered by the API we don't need to filter them
+      // in the FE because it can causes some mismatches.
+      filterOptions={(user) => user}
+      noOptionsText="No users found"
       className={className}
-      options={searchResults ?? []}
-      loading={searchState.matches("searching")}
+      options={usersQuery.data?.users ?? []}
+      loading={usersQuery.isLoading}
       value={value}
       id="user-autocomplete"
-      open={isAutocompleteOpen}
+      open={autoComplete.open}
       onOpen={() => {
-        setIsAutocompleteOpen(true)
+        setAutoComplete((state) => ({
+          ...state,
+          open: true,
+        }));
       }}
       onClose={() => {
-        setIsAutocompleteOpen(false)
+        setAutoComplete({
+          value: value?.email ?? "",
+          open: false,
+        });
       }}
       onChange={(_, newValue) => {
-        if (newValue === null) {
-          sendSearch("CLEAR_RESULTS")
-        }
-
-        onChange(newValue)
+        onChange(newValue);
       }}
       isOptionEqualToValue={(option: User, value: User) =>
         option.username === value.username
@@ -85,45 +95,41 @@ export const UserAutocomplete: FC<UserAutocompleteProps> = ({
         </Box>
       )}
       renderInput={(params) => (
-        <>
-          {/* eslint-disable-next-line @typescript-eslint/ban-ts-comment -- Need it */}
-          {/* @ts-ignore -- Issue from lib https://github.com/i18next/react-i18next/issues/1543 */}
-          <TextField
-            {...params}
-            fullWidth
-            size={size}
-            label={label}
-            placeholder="User email or username"
-            className={styles.textField}
-            InputProps={{
-              ...params.InputProps,
-              onChange: handleFilterChange,
-              startAdornment: value && (
-                <Avatar size="sm" src={value.avatar_url}>
-                  {value.username}
-                </Avatar>
-              ),
-              endAdornment: (
-                <>
-                  {searchState.matches("searching") ? (
-                    <CircularProgress size={16} />
-                  ) : null}
-                  {params.InputProps.endAdornment}
-                </>
-              ),
-              classes: {
-                root: styles.inputRoot,
-              },
-            }}
-            InputLabelProps={{
-              shrink: true,
-            }}
-          />
-        </>
+        <TextField
+          {...params}
+          fullWidth
+          size={size}
+          label={label}
+          placeholder="User email or username"
+          className={styles.textField}
+          InputProps={{
+            ...params.InputProps,
+            onChange: debouncedInputOnChange,
+            startAdornment: value && (
+              <Avatar size="sm" src={value.avatar_url}>
+                {value.username}
+              </Avatar>
+            ),
+            endAdornment: (
+              <>
+                {usersQuery.isFetching && autoComplete.open ? (
+                  <CircularProgress size={16} />
+                ) : null}
+                {params.InputProps.endAdornment}
+              </>
+            ),
+            classes: {
+              root: styles.inputRoot,
+            },
+          }}
+          InputLabelProps={{
+            shrink: true,
+          }}
+        />
       )}
     />
-  )
-}
+  );
+};
 
 export const useStyles = makeStyles((theme) => ({
   textField: {
@@ -135,4 +141,4 @@ export const useStyles = makeStyles((theme) => ({
     paddingLeft: `${theme.spacing(1.75)} !important`, // Same padding left as input
     gap: theme.spacing(0.5),
   },
-}))
+}));
diff --git a/site/src/components/UserAvatar/UserAvatar.tsx b/site/src/components/UserAvatar/UserAvatar.tsx
index 95183a8001546..fa453bcf6b308 100644
--- a/site/src/components/UserAvatar/UserAvatar.tsx
+++ b/site/src/components/UserAvatar/UserAvatar.tsx
@@ -1,20 +1,19 @@
-import { Avatar, AvatarProps } from "components/Avatar/Avatar"
-import { FC } from "react"
+import { Avatar, AvatarProps } from "components/Avatar/Avatar";
+import { FC } from "react";
 
 export type UserAvatarProps = {
-  username: string
-  avatarURL?: string
-} & AvatarProps
+  username: string;
+  avatarURL?: string;
+} & AvatarProps;
 
 export const UserAvatar: FC<UserAvatarProps> = ({
   username,
   avatarURL,
-
   ...avatarProps
 }) => {
   return (
     <Avatar title={username} src={avatarURL} {...avatarProps}>
       {username}
     </Avatar>
-  )
-}
+  );
+};
diff --git a/site/src/components/UserDropdown/UserDropdown.stories.tsx b/site/src/components/UserDropdown/UserDropdown.stories.tsx
deleted file mode 100644
index 8320e29e69811..0000000000000
--- a/site/src/components/UserDropdown/UserDropdown.stories.tsx
+++ /dev/null
@@ -1,26 +0,0 @@
-import Box from "@mui/material/Box"
-import { Story } from "@storybook/react"
-import { MockUser } from "../../testHelpers/entities"
-import { UserDropdown, UserDropdownProps } from "./UsersDropdown"
-
-export default {
-  title: "components/UserDropdown",
-  component: UserDropdown,
-  argTypes: {
-    onSignOut: { action: "Sign Out" },
-  },
-}
-
-const Template: Story<UserDropdownProps> = (args: UserDropdownProps) => (
-  <Box style={{ backgroundColor: "#000", width: 88 }}>
-    <UserDropdown {...args} />
-  </Box>
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  user: MockUser,
-  onSignOut: () => {
-    return Promise.resolve()
-  },
-}
diff --git a/site/src/components/UserDropdown/UserDropdown.test.tsx b/site/src/components/UserDropdown/UserDropdown.test.tsx
deleted file mode 100644
index 9c05202437cdc..0000000000000
--- a/site/src/components/UserDropdown/UserDropdown.test.tsx
+++ /dev/null
@@ -1,30 +0,0 @@
-import { fireEvent, screen } from "@testing-library/react"
-import { MockSupportLinks, MockUser } from "../../testHelpers/entities"
-import { render } from "../../testHelpers/renderHelpers"
-import { Language } from "../UserDropdownContent/UserDropdownContent"
-import { UserDropdown, UserDropdownProps } from "./UsersDropdown"
-
-const renderAndClick = async (props: Partial<UserDropdownProps> = {}) => {
-  render(
-    <UserDropdown
-      user={props.user ?? MockUser}
-      supportLinks={MockSupportLinks}
-      onSignOut={props.onSignOut ?? jest.fn()}
-    />,
-  )
-  const trigger = await screen.findByTestId("user-dropdown-trigger")
-  fireEvent.click(trigger)
-}
-
-describe("UserDropdown", () => {
-  describe("when the trigger is clicked", () => {
-    it("opens the menu", async () => {
-      await renderAndClick()
-      expect(screen.getByText(Language.accountLabel)).toBeDefined()
-      expect(screen.getByText(MockSupportLinks[0].name)).toBeDefined()
-      expect(screen.getByText(MockSupportLinks[1].name)).toBeDefined()
-      expect(screen.getByText(MockSupportLinks[2].name)).toBeDefined()
-      expect(screen.getByText(Language.signOutLabel)).toBeDefined()
-    })
-  })
-})
diff --git a/site/src/components/UserDropdown/UsersDropdown.tsx b/site/src/components/UserDropdown/UsersDropdown.tsx
deleted file mode 100644
index 1e77e5ad6bf3d..0000000000000
--- a/site/src/components/UserDropdown/UsersDropdown.tsx
+++ /dev/null
@@ -1,110 +0,0 @@
-import Badge from "@mui/material/Badge"
-import MenuItem from "@mui/material/MenuItem"
-import { makeStyles } from "@mui/styles"
-import { useState, FC, PropsWithChildren, MouseEvent } from "react"
-import { colors } from "theme/colors"
-import * as TypesGen from "../../api/typesGenerated"
-import { navHeight } from "../../theme/constants"
-import { BorderedMenu } from "../BorderedMenu/BorderedMenu"
-import { CloseDropdown, OpenDropdown } from "../DropdownArrows/DropdownArrows"
-import { UserAvatar } from "../UserAvatar/UserAvatar"
-import { UserDropdownContent } from "../UserDropdownContent/UserDropdownContent"
-import { BUTTON_SM_HEIGHT } from "theme/theme"
-
-export interface UserDropdownProps {
-  user: TypesGen.User
-  buildInfo?: TypesGen.BuildInfoResponse
-  supportLinks?: TypesGen.LinkConfig[]
-  onSignOut: () => void
-}
-
-export const UserDropdown: FC<PropsWithChildren<UserDropdownProps>> = ({
-  buildInfo,
-  user,
-  supportLinks,
-  onSignOut,
-}: UserDropdownProps) => {
-  const styles = useStyles()
-  const [anchorEl, setAnchorEl] = useState<HTMLElement | undefined>()
-
-  const handleDropdownClick = (ev: MouseEvent<HTMLLIElement>): void => {
-    setAnchorEl(ev.currentTarget)
-  }
-  const onPopoverClose = () => {
-    setAnchorEl(undefined)
-  }
-
-  return (
-    <>
-      <MenuItem
-        className={styles.menuItem}
-        onClick={handleDropdownClick}
-        data-testid="user-dropdown-trigger"
-      >
-        <div className={styles.inner}>
-          <Badge overlap="circular">
-            <UserAvatar
-              sx={{
-                width: BUTTON_SM_HEIGHT,
-                height: BUTTON_SM_HEIGHT,
-                fontSize: 16,
-              }}
-              username={user.username}
-              avatarURL={user.avatar_url}
-            />
-          </Badge>
-          {anchorEl ? (
-            <CloseDropdown color={colors.gray[6]} />
-          ) : (
-            <OpenDropdown color={colors.gray[6]} />
-          )}
-        </div>
-      </MenuItem>
-
-      <BorderedMenu
-        anchorEl={anchorEl}
-        open={Boolean(anchorEl)}
-        anchorOrigin={{
-          vertical: "bottom",
-          horizontal: "right",
-        }}
-        transformOrigin={{
-          vertical: "top",
-          horizontal: "right",
-        }}
-        marginThreshold={0}
-        variant="user-dropdown"
-        onClose={onPopoverClose}
-      >
-        <UserDropdownContent
-          user={user}
-          buildInfo={buildInfo}
-          supportLinks={supportLinks}
-          onPopoverClose={onPopoverClose}
-          onSignOut={onSignOut}
-        />
-      </BorderedMenu>
-    </>
-  )
-}
-
-export const useStyles = makeStyles((theme) => ({
-  divider: {
-    marginTop: theme.spacing(1),
-    marginBottom: theme.spacing(1),
-  },
-  inner: {
-    display: "flex",
-    alignItems: "center",
-    minWidth: 0,
-    maxWidth: 300,
-  },
-  menuItem: {
-    height: navHeight,
-    padding: theme.spacing(1.5, 0),
-
-    "&:hover": {
-      backgroundColor: "transparent",
-    },
-  },
-}))
diff --git a/site/src/components/UserDropdownContent/UserDropdownContent.stories.tsx b/site/src/components/UserDropdownContent/UserDropdownContent.stories.tsx
deleted file mode 100644
index ee562021b280d..0000000000000
--- a/site/src/components/UserDropdownContent/UserDropdownContent.stories.tsx
+++ /dev/null
@@ -1,43 +0,0 @@
-import { Story } from "@storybook/react"
-import { MockUser } from "../../testHelpers/entities"
-import {
-  UserDropdownContent,
-  UserDropdownContentProps,
-} from "./UserDropdownContent"
-
-export default {
-  title: "components/UserDropdownContent",
-  component: UserDropdownContent,
-}
-
-const Template: Story<UserDropdownContentProps> = (args) => (
-  <UserDropdownContent {...args} />
-)
-
-export const ExampleNoRoles = Template.bind({})
-ExampleNoRoles.args = {
-  user: {
-    ...MockUser,
-    roles: [],
-  },
-}
-
-export const ExampleOneRole = Template.bind({})
-ExampleOneRole.args = {
-  user: {
-    ...MockUser,
-    roles: [{ name: "member", display_name: "Member" }],
-  },
-}
-
-export const ExampleThreeRoles = Template.bind({})
-ExampleThreeRoles.args = {
-  user: {
-    ...MockUser,
-    roles: [
-      { name: "admin", display_name: "Admin" },
-      { name: "member", display_name: "Member" },
-      { name: "auditor", display_name: "Auditor" },
-    ],
-  },
-}
diff --git a/site/src/components/UserDropdownContent/UserDropdownContent.test.tsx b/site/src/components/UserDropdownContent/UserDropdownContent.test.tsx
deleted file mode 100644
index 3eb538c6b6921..0000000000000
--- a/site/src/components/UserDropdownContent/UserDropdownContent.test.tsx
+++ /dev/null
@@ -1,77 +0,0 @@
-import { screen } from "@testing-library/react"
-import {
-  MockBuildInfo,
-  MockSupportLinks,
-  MockUser,
-} from "../../testHelpers/entities"
-import { render } from "../../testHelpers/renderHelpers"
-import { Language, UserDropdownContent } from "./UserDropdownContent"
-
-describe("UserDropdownContent", () => {
-  const env = process.env
-
-  // REMARK: copying process.env so we don't mutate that object or encounter conflicts between tests
-  beforeEach(() => {
-    process.env = { ...env }
-  })
-
-  // REMARK: restoring process.env
-  afterEach(() => {
-    process.env = env
-  })
-
-  it("displays the menu items", () => {
-    render(
-      <UserDropdownContent
-        user={MockUser}
-        buildInfo={MockBuildInfo}
-        supportLinks={MockSupportLinks}
-        onSignOut={jest.fn()}
-        onPopoverClose={jest.fn()}
-      />,
-    )
-    expect(screen.getByText(Language.accountLabel)).toBeDefined()
-    expect(screen.getByText(Language.signOutLabel)).toBeDefined()
-    expect(screen.getByText(Language.copyrightText)).toBeDefined()
-    expect(screen.getByText(MockSupportLinks[0].name)).toBeDefined()
-    expect(screen.getByText(MockSupportLinks[1].name)).toBeDefined()
-    expect(screen.getByText(MockSupportLinks[2].name)).toBeDefined()
-    expect(
-      screen.getByText(MockSupportLinks[2].name).closest("a"),
-    ).toHaveAttribute(
-      "href",
-      "https://github.com/coder/coder/issues/new?labels=needs+grooming&body=Version%3A%20%5B%60v99.999.9999%2Bc9cdf14%60%5D(file%3A%2F%2F%2Fmock-url)",
-    )
-    expect(screen.getByText(MockBuildInfo.version)).toBeDefined()
-  })
-
-  it("has the correct link for the account item", () => {
-    render(
-      <UserDropdownContent
-        user={MockUser}
-        onSignOut={jest.fn()}
-        onPopoverClose={jest.fn()}
-      />,
-    )
-
-    const link = screen.getByText(Language.accountLabel).closest("a")
-    if (!link) {
-      throw new Error("Anchor tag not found for the account menu item")
-    }
-
-    expect(link.getAttribute("href")).toBe("/settings/account")
-  })
-
-  it("calls the onSignOut function", () => {
-    const onSignOut = jest.fn()
-    render(
-      <UserDropdownContent
-        user={MockUser}
-        onSignOut={onSignOut}
-        onPopoverClose={jest.fn()}
-      />,
-    )
-    screen.getByText(Language.signOutLabel).click()
-    expect(onSignOut).toBeCalledTimes(1)
-  })
-})
diff --git a/site/src/components/UserDropdownContent/UserDropdownContent.tsx b/site/src/components/UserDropdownContent/UserDropdownContent.tsx
deleted file mode 100644
index c5f779b54d875..0000000000000
--- a/site/src/components/UserDropdownContent/UserDropdownContent.tsx
+++ /dev/null
@@ -1,181 +0,0 @@
-import Divider from "@mui/material/Divider"
-import MenuItem from "@mui/material/MenuItem"
-import { makeStyles } from "@mui/styles"
-import AccountIcon from "@mui/icons-material/AccountCircleOutlined"
-import BugIcon from "@mui/icons-material/BugReportOutlined"
-import ChatIcon from "@mui/icons-material/ChatOutlined"
-import LaunchIcon from "@mui/icons-material/LaunchOutlined"
-import { Stack } from "components/Stack/Stack"
-import { FC } from "react"
-import { Link } from "react-router-dom"
-import * as TypesGen from "../../api/typesGenerated"
-import DocsIcon from "@mui/icons-material/MenuBook"
-import LogoutIcon from "@mui/icons-material/ExitToAppOutlined"
-import { combineClasses } from "utils/combineClasses"
-
-export const Language = {
-  accountLabel: "Account",
-  signOutLabel: "Sign Out",
-  copyrightText: `\u00a9 ${new Date().getFullYear()} Coder Technologies, Inc.`,
-}
-
-export interface UserDropdownContentProps {
-  user: TypesGen.User
-  buildInfo?: TypesGen.BuildInfoResponse
-  supportLinks?: TypesGen.LinkConfig[]
-  onPopoverClose: () => void
-  onSignOut: () => void
-}
-
-export const UserDropdownContent: FC<UserDropdownContentProps> = ({
-  buildInfo,
-  user,
-  supportLinks,
-  onPopoverClose,
-  onSignOut,
-}) => {
-  const styles = useStyles()
-
-  return (
-    <div>
-      <Stack className={styles.info} spacing={0}>
-        <span className={styles.userName}>{user.username}</span>
-        <span className={styles.userEmail}>{user.email}</span>
-      </Stack>
-
-      <Divider className={styles.divider} />
-
-      <Link to="/settings/account" className={styles.link}>
-        <MenuItem className={styles.menuItem} onClick={onPopoverClose}>
-          <AccountIcon className={styles.menuItemIcon} />
-          <span className={styles.menuItemText}>{Language.accountLabel}</span>
-        </MenuItem>
-      </Link>
-
-      <MenuItem className={styles.menuItem} onClick={onSignOut}>
-        <LogoutIcon className={styles.menuItemIcon} />
-        <span className={styles.menuItemText}>{Language.signOutLabel}</span>
-      </MenuItem>
-
-      <Divider className={styles.divider} />
-
-      <>
-        {supportLinks &&
-          supportLinks.map((link) => (
-            <a
-              href={includeBuildInfo(link.target, buildInfo)}
-              key={link.name}
-              target="_blank"
-              rel="noreferrer"
-              className={styles.link}
-            >
-              <MenuItem className={styles.menuItem} onClick={onPopoverClose}>
-                {link.icon === "bug" && (
-                  <BugIcon className={styles.menuItemIcon} />
-                )}
-                {link.icon === "chat" && (
-                  <ChatIcon className={styles.menuItemIcon} />
-                )}
-                {link.icon === "docs" && (
-                  <DocsIcon className={styles.menuItemIcon} />
-                )}
-                <span className={styles.menuItemText}>{link.name}</span>
-              </MenuItem>
-            </a>
-          ))}
-      </>
-
-      {supportLinks && <Divider className={styles.divider} />}
-
-      <Stack className={styles.info} spacing={0}>
-        <a
-          title="Browse Source Code"
-          className={combineClasses([styles.footerText, styles.buildInfo])}
-          href={buildInfo?.external_url}
-          target="_blank"
-          rel="noreferrer"
-        >
-          {buildInfo?.version} <LaunchIcon />
-        </a>
-
-        <div className={styles.footerText}>{Language.copyrightText}</div>
-      </Stack>
-    </div>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  info: {
-    padding: theme.spacing(2.5),
-    ...theme.typography.body2,
-  },
-  userName: {
-    fontWeight: 600,
-  },
-  userEmail: {
-    color: theme.palette.text.secondary,
-    width: "100%",
-    textOverflow: "ellipsis",
-    overflow: "hidden",
-  },
-  link: {
-    textDecoration: "none",
-    color: "inherit",
-  },
-  menuItem: {
-    gap: theme.spacing(2.5),
-    padding: theme.spacing(1, 2.5),
-
-    "&:hover": {
-      backgroundColor: theme.palette.action.hover,
-      transition: "background-color 0.3s ease",
-    },
-  },
-  menuItemIcon: {
-    color: theme.palette.text.secondary,
-    width: theme.spacing(2.5),
-    height: theme.spacing(2.5),
-  },
-  menuItemText: {
-    fontSize: 14,
-  },
-  divider: {
-    margin: theme.spacing(1, 0),
-
-    "&:first-of-type": {
-      marginTop: 0,
-    },
-
-    "&:last-of-type": {
-      marginBottom: 0,
-    },
-  },
-  footerText: {
-    fontSize: 12,
-    textDecoration: "none",
-    color: theme.palette.text.secondary,
-    display: "flex",
-    alignItems: "center",
-    gap: 4,
-
-    "& svg": {
-      width: 12,
-      height: 12,
-    },
-  },
-  buildInfo: {
-    color: theme.palette.text.primary,
-  },
-}))
-
-const includeBuildInfo = (
-  href: string,
-  buildInfo?: TypesGen.BuildInfoResponse,
-): string => {
-  return href.replace(
-    "{CODER_BUILD_INFO}",
-    `${encodeURIComponent(
-      `Version: [\`${buildInfo?.version}\`](${buildInfo?.external_url})`,
-    )}`,
-  )
-}
diff --git a/site/src/components/UserOrGroupAutocomplete/UserOrGroupAutocomplete.tsx b/site/src/components/UserOrGroupAutocomplete/UserOrGroupAutocomplete.tsx
deleted file mode 100644
index 127d970c9ee56..0000000000000
--- a/site/src/components/UserOrGroupAutocomplete/UserOrGroupAutocomplete.tsx
+++ /dev/null
@@ -1,138 +0,0 @@
-import CircularProgress from "@mui/material/CircularProgress"
-import { makeStyles } from "@mui/styles"
-import TextField from "@mui/material/TextField"
-import Autocomplete from "@mui/material/Autocomplete"
-import { useMachine } from "@xstate/react"
-import { Group, User } from "api/typesGenerated"
-import { AvatarData } from "components/AvatarData/AvatarData"
-import debounce from "just-debounce-it"
-import { ChangeEvent, useState } from "react"
-import { getGroupSubtitle } from "utils/groups"
-import { searchUsersAndGroupsMachine } from "xServices/template/searchUsersAndGroupsXService"
-import Box from "@mui/material/Box"
-
-export type UserOrGroupAutocompleteValue = User | Group | null
-
-const isGroup = (value: UserOrGroupAutocompleteValue): value is Group => {
-  return value !== null && "members" in value
-}
-
-export type UserOrGroupAutocompleteProps = {
-  value: UserOrGroupAutocompleteValue
-  onChange: (value: UserOrGroupAutocompleteValue) => void
-  organizationId: string
-  templateID?: string
-  exclude: UserOrGroupAutocompleteValue[]
-}
-
-export const UserOrGroupAutocomplete: React.FC<
-  UserOrGroupAutocompleteProps
-> = ({ value, onChange, organizationId, templateID, exclude }) => {
-  const styles = useStyles()
-  const [isAutocompleteOpen, setIsAutocompleteOpen] = useState(false)
-  const [searchState, sendSearch] = useMachine(searchUsersAndGroupsMachine, {
-    context: {
-      userResults: [],
-      groupResults: [],
-      organizationId,
-      templateID,
-    },
-  })
-  const { userResults, groupResults } = searchState.context
-  const options = [...groupResults, ...userResults].filter((result) => {
-    const excludeIds = exclude.map((optionToExclude) => optionToExclude?.id)
-    return !excludeIds.includes(result.id)
-  })
-
-  const handleFilterChange = debounce(
-    (event: ChangeEvent<HTMLInputElement>) => {
-      sendSearch("SEARCH", { query: event.target.value })
-    },
-    500,
-  )
-
-  return (
-    <Autocomplete
-      value={value}
-      id="user-or-group-autocomplete"
-      open={isAutocompleteOpen}
-      onOpen={() => {
-        setIsAutocompleteOpen(true)
-      }}
-      onClose={() => {
-        setIsAutocompleteOpen(false)
-      }}
-      onChange={(_, newValue) => {
-        if (newValue === null) {
-          sendSearch("CLEAR_RESULTS")
-        }
-
-        onChange(newValue)
-      }}
-      isOptionEqualToValue={(option, value) => option.id === value.id}
-      getOptionLabel={(option) =>
-        isGroup(option) ? option.display_name || option.name : option.email
-      }
-      renderOption={(props, option) => {
-        const isOptionGroup = isGroup(option)
-
-        return (
-          <Box component="li" {...props}>
-            <AvatarData
-              title={
-                isOptionGroup
-                  ? option.display_name || option.name
-                  : option.username
-              }
-              subtitle={isOptionGroup ? getGroupSubtitle(option) : option.email}
-              src={option.avatar_url}
-            />
-          </Box>
-        )
-      }}
-      options={options}
-      loading={searchState.matches("searching")}
-      className={styles.autocomplete}
-      renderInput={(params) => (
-        <>
-          {/* eslint-disable-next-line @typescript-eslint/ban-ts-comment -- Need it */}
-          {/* @ts-ignore -- Issue from lib https://github.com/i18next/react-i18next/issues/1543 */}
-          <TextField
-            {...params}
-            margin="none"
-            size="small"
-            placeholder="Search for user or group"
-            InputProps={{
-              ...params.InputProps,
-              onChange: handleFilterChange,
-              endAdornment: (
-                <>
-                  {searchState.matches("searching") ? (
-                    <CircularProgress size={16} />
-                  ) : null}
-                  {params.InputProps.endAdornment}
-                </>
-              ),
-            }}
-          />
-        </>
-      )}
-    />
-  )
-}
-
-export const useStyles = makeStyles(() => {
-  return {
-    autocomplete: {
-      width: "300px",
-
-      "& .MuiFormControl-root": {
-        width: "100%",
-      },
-
-      "& .MuiInputBase-root": {
-        width: "100%",
-      },
-    },
-  }
-})
diff --git a/site/src/components/UsersLayout/UsersLayout.tsx b/site/src/components/UsersLayout/UsersLayout.tsx
index a4eacd7b80d7d..397cadc25bb60 100644
--- a/site/src/components/UsersLayout/UsersLayout.tsx
+++ b/site/src/components/UsersLayout/UsersLayout.tsx
@@ -1,32 +1,21 @@
-import Button from "@mui/material/Button"
-import Link from "@mui/material/Link"
-import { makeStyles } from "@mui/styles"
-import GroupAdd from "@mui/icons-material/GroupAddOutlined"
-import PersonAdd from "@mui/icons-material/PersonAddOutlined"
-import { useMachine } from "@xstate/react"
-import { USERS_LINK } from "components/Navbar/NavbarView"
-import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader"
-import { useFeatureVisibility } from "hooks/useFeatureVisibility"
-import { usePermissions } from "hooks/usePermissions"
-import { FC } from "react"
-import {
-  Link as RouterLink,
-  NavLink,
-  Outlet,
-  useNavigate,
-} from "react-router-dom"
-import { combineClasses } from "utils/combineClasses"
-import { authMethodsXService } from "xServices/auth/authMethodsXService"
-import { Margins } from "../../components/Margins/Margins"
-import { Stack } from "../../components/Stack/Stack"
+import Button from "@mui/material/Button";
+import Link from "@mui/material/Link";
+import GroupAdd from "@mui/icons-material/GroupAddOutlined";
+import PersonAdd from "@mui/icons-material/PersonAddOutlined";
+import { USERS_LINK } from "components/Dashboard/Navbar/NavbarView";
+import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader";
+import { useFeatureVisibility } from "hooks/useFeatureVisibility";
+import { usePermissions } from "hooks/usePermissions";
+import { FC } from "react";
+import { Link as RouterLink, Outlet, useNavigate } from "react-router-dom";
+import { Margins } from "components/Margins/Margins";
+import { TabLink, Tabs } from "components/Tabs/Tabs";
 
 export const UsersLayout: FC = () => {
-  const styles = useStyles()
   const { createUser: canCreateUser, createGroup: canCreateGroup } =
-    usePermissions()
-  const [authMethods] = useMachine(authMethodsXService)
-  const navigate = useNavigate()
-  const { template_rbac: isTemplateRBACEnabled } = useFeatureVisibility()
+    usePermissions();
+  const navigate = useNavigate();
+  const { template_rbac: isTemplateRBACEnabled } = useFeatureVisibility();
 
   return (
     <>
@@ -34,17 +23,16 @@ export const UsersLayout: FC = () => {
         <PageHeader
           actions={
             <>
-              {canCreateUser &&
-                authMethods.context.authMethods?.password.enabled && (
-                  <Button
-                    onClick={() => {
-                      navigate("/users/create")
-                    }}
-                    startIcon={<PersonAdd />}
-                  >
-                    Create user
-                  </Button>
-                )}
+              {canCreateUser && (
+                <Button
+                  onClick={() => {
+                    navigate("/users/create");
+                  }}
+                  startIcon={<PersonAdd />}
+                >
+                  Create user
+                </Button>
+              )}
               {canCreateGroup && isTemplateRBACEnabled && (
                 <Link component={RouterLink} to="/groups/create">
                   <Button startIcon={<GroupAdd />}>Create group</Button>
@@ -57,75 +45,14 @@ export const UsersLayout: FC = () => {
         </PageHeader>
       </Margins>
 
-      <div className={styles.tabs}>
-        <Margins>
-          <Stack direction="row" spacing={0.25}>
-            <NavLink
-              end
-              to={USERS_LINK}
-              className={({ isActive }) =>
-                combineClasses([
-                  styles.tabItem,
-                  isActive ? styles.tabItemActive : undefined,
-                ])
-              }
-            >
-              Users
-            </NavLink>
-            <NavLink
-              to="/groups"
-              className={({ isActive }) =>
-                combineClasses([
-                  styles.tabItem,
-                  isActive ? styles.tabItemActive : undefined,
-                ])
-              }
-            >
-              Groups
-            </NavLink>
-          </Stack>
-        </Margins>
-      </div>
+      <Tabs>
+        <TabLink to={USERS_LINK}>Users</TabLink>
+        <TabLink to="/groups">Groups</TabLink>
+      </Tabs>
 
       <Margins>
         <Outlet />
       </Margins>
     </>
-  )
-}
-
-export const useStyles = makeStyles((theme) => {
-  return {
-    tabs: {
-      borderBottom: `1px solid ${theme.palette.divider}`,
-      marginBottom: theme.spacing(5),
-    },
-
-    tabItem: {
-      textDecoration: "none",
-      color: theme.palette.text.secondary,
-      fontSize: 14,
-      display: "block",
-      padding: theme.spacing(0, 2, 2),
-
-      "&:hover": {
-        color: theme.palette.text.primary,
-      },
-    },
-
-    tabItemActive: {
-      color: theme.palette.text.primary,
-      position: "relative",
-
-      "&:before": {
-        content: `""`,
-        left: 0,
-        bottom: 0,
-        height: 2,
-        width: "100%",
-        background: theme.palette.secondary.dark,
-        position: "absolute",
-      },
-    },
-  }
-})
+  );
+};
diff --git a/site/src/components/UsersTable/UsersTable.stories.tsx b/site/src/components/UsersTable/UsersTable.stories.tsx
deleted file mode 100644
index ce019b4d3e72b..0000000000000
--- a/site/src/components/UsersTable/UsersTable.stories.tsx
+++ /dev/null
@@ -1,65 +0,0 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import {
-  MockUser,
-  MockUser2,
-  MockAssignableSiteRoles,
-} from "testHelpers/entities"
-import { UsersTable, UsersTableProps } from "./UsersTable"
-
-export default {
-  title: "components/UsersTable",
-  component: UsersTable,
-  args: {
-    isNonInitialPage: false,
-  },
-} as ComponentMeta<typeof UsersTable>
-
-const Template: Story<UsersTableProps> = (args) => <UsersTable {...args} />
-
-export const Example = Template.bind({})
-Example.args = {
-  users: [MockUser, MockUser2],
-  roles: MockAssignableSiteRoles,
-  canEditUsers: false,
-}
-
-export const Editable = Template.bind({})
-Editable.args = {
-  users: [
-    MockUser,
-    MockUser2,
-    {
-      ...MockUser,
-      username: "John Doe",
-      email: "john.doe@coder.com",
-      roles: [],
-      status: "dormant",
-    },
-    {
-      ...MockUser,
-      username: "Roger Moore",
-      email: "roger.moore@coder.com",
-      roles: [],
-      status: "suspended",
-    },
-  ],
-  roles: MockAssignableSiteRoles,
-  canEditUsers: true,
-  canViewActivity: true,
-}
-
-export const Empty = Template.bind({})
-Empty.args = {
-  users: [],
-  roles: MockAssignableSiteRoles,
-}
-
-export const Loading = Template.bind({})
-Loading.args = {
-  users: [],
-  roles: MockAssignableSiteRoles,
-  isLoading: true,
-}
-Loading.parameters = {
-  chromatic: { pauseAnimationAtEnd: true },
-}
diff --git a/site/src/components/UsersTable/UsersTable.tsx b/site/src/components/UsersTable/UsersTable.tsx
deleted file mode 100644
index 6c991ee2a1dd0..0000000000000
--- a/site/src/components/UsersTable/UsersTable.tsx
+++ /dev/null
@@ -1,102 +0,0 @@
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableHead from "@mui/material/TableHead"
-import TableRow from "@mui/material/TableRow"
-import { FC } from "react"
-import * as TypesGen from "../../api/typesGenerated"
-import { Stack } from "../Stack/Stack"
-import { UserRoleHelpTooltip } from "../Tooltips"
-import { UsersTableBody } from "./UsersTableBody"
-
-export const Language = {
-  usernameLabel: "User",
-  rolesLabel: "Roles",
-  statusLabel: "Status",
-  lastSeenLabel: "Last Seen",
-}
-
-export interface UsersTableProps {
-  users?: TypesGen.User[]
-  roles?: TypesGen.AssignableRoles[]
-  isUpdatingUserRoles?: boolean
-  canEditUsers?: boolean
-  canViewActivity?: boolean
-  isLoading?: boolean
-  onSuspendUser: (user: TypesGen.User) => void
-  onActivateUser: (user: TypesGen.User) => void
-  onDeleteUser: (user: TypesGen.User) => void
-  onListWorkspaces: (user: TypesGen.User) => void
-  onViewActivity: (user: TypesGen.User) => void
-  onResetUserPassword: (user: TypesGen.User) => void
-  onUpdateUserRoles: (
-    user: TypesGen.User,
-    roles: TypesGen.Role["name"][],
-  ) => void
-  isNonInitialPage: boolean
-  actorID: string
-  oidcRoleSyncEnabled: boolean
-}
-
-export const UsersTable: FC<React.PropsWithChildren<UsersTableProps>> = ({
-  users,
-  roles,
-  onSuspendUser,
-  onDeleteUser,
-  onListWorkspaces,
-  onViewActivity,
-  onActivateUser,
-  onResetUserPassword,
-  onUpdateUserRoles,
-  isUpdatingUserRoles,
-  canEditUsers,
-  canViewActivity,
-  isLoading,
-  isNonInitialPage,
-  actorID,
-  oidcRoleSyncEnabled,
-}) => {
-  return (
-    <TableContainer>
-      <Table>
-        <TableHead>
-          <TableRow>
-            <TableCell width="30%">{Language.usernameLabel}</TableCell>
-            <TableCell width="40%">
-              <Stack direction="row" spacing={1} alignItems="center">
-                <span>{Language.rolesLabel}</span>
-                <UserRoleHelpTooltip />
-              </Stack>
-            </TableCell>
-            <TableCell width="15%">{Language.statusLabel}</TableCell>
-            <TableCell width="15%">{Language.lastSeenLabel}</TableCell>
-
-            {/* 1% is a trick to make the table cell width fit the content */}
-            {canEditUsers && <TableCell width="1%" />}
-          </TableRow>
-        </TableHead>
-        <TableBody>
-          <UsersTableBody
-            users={users}
-            roles={roles}
-            isLoading={isLoading}
-            canEditUsers={canEditUsers}
-            canViewActivity={canViewActivity}
-            isUpdatingUserRoles={isUpdatingUserRoles}
-            onActivateUser={onActivateUser}
-            onDeleteUser={onDeleteUser}
-            onListWorkspaces={onListWorkspaces}
-            onViewActivity={onViewActivity}
-            onResetUserPassword={onResetUserPassword}
-            onSuspendUser={onSuspendUser}
-            onUpdateUserRoles={onUpdateUserRoles}
-            isNonInitialPage={isNonInitialPage}
-            actorID={actorID}
-            oidcRoleSyncEnabled={oidcRoleSyncEnabled}
-          />
-        </TableBody>
-      </Table>
-    </TableContainer>
-  )
-}
diff --git a/site/src/components/UsersTable/UsersTableBody.tsx b/site/src/components/UsersTable/UsersTableBody.tsx
deleted file mode 100644
index 87fc5725a2de7..0000000000000
--- a/site/src/components/UsersTable/UsersTableBody.tsx
+++ /dev/null
@@ -1,251 +0,0 @@
-import Box from "@mui/material/Box"
-import { makeStyles } from "@mui/styles"
-import TableCell from "@mui/material/TableCell"
-import TableRow from "@mui/material/TableRow"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { LastUsed } from "components/LastUsed/LastUsed"
-import { Pill } from "components/Pill/Pill"
-import { FC } from "react"
-import { useTranslation } from "react-i18next"
-import * as TypesGen from "../../api/typesGenerated"
-import { combineClasses } from "../../utils/combineClasses"
-import { AvatarData } from "../AvatarData/AvatarData"
-import { EmptyState } from "../EmptyState/EmptyState"
-import { TableLoaderSkeleton } from "../TableLoader/TableLoader"
-import { TableRowMenu } from "../TableRowMenu/TableRowMenu"
-import { EditRolesButton } from "components/EditRolesButton/EditRolesButton"
-import { Stack } from "components/Stack/Stack"
-import { EnterpriseBadge } from "components/DeploySettingsLayout/Badges"
-
-const isOwnerRole = (role: TypesGen.Role): boolean => {
-  return role.name === "owner"
-}
-
-const roleOrder = ["owner", "user-admin", "template-admin", "auditor"]
-
-const sortRoles = (roles: TypesGen.Role[]) => {
-  return roles.slice(0).sort((a, b) => {
-    return roleOrder.indexOf(a.name) - roleOrder.indexOf(b.name)
-  })
-}
-
-interface UsersTableBodyProps {
-  users?: TypesGen.User[]
-  roles?: TypesGen.AssignableRoles[]
-  isUpdatingUserRoles?: boolean
-  canEditUsers?: boolean
-  isLoading?: boolean
-  canViewActivity?: boolean
-  onSuspendUser: (user: TypesGen.User) => void
-  onDeleteUser: (user: TypesGen.User) => void
-  onListWorkspaces: (user: TypesGen.User) => void
-  onViewActivity: (user: TypesGen.User) => void
-  onActivateUser: (user: TypesGen.User) => void
-  onResetUserPassword: (user: TypesGen.User) => void
-  onUpdateUserRoles: (
-    user: TypesGen.User,
-    roles: TypesGen.Role["name"][],
-  ) => void
-  isNonInitialPage: boolean
-  actorID: string
-  // oidcRoleSyncEnabled should be set to false if unknown.
-  // This is used to determine if the oidc roles are synced from the oidc idp and
-  // editing via the UI should be disabled.
-  oidcRoleSyncEnabled: boolean
-}
-
-export const UsersTableBody: FC<
-  React.PropsWithChildren<UsersTableBodyProps>
-> = ({
-  users,
-  roles,
-  onSuspendUser,
-  onDeleteUser,
-  onListWorkspaces,
-  onViewActivity,
-  onActivateUser,
-  onResetUserPassword,
-  onUpdateUserRoles,
-  isUpdatingUserRoles,
-  canEditUsers,
-  canViewActivity,
-  isLoading,
-  isNonInitialPage,
-  actorID,
-  oidcRoleSyncEnabled,
-}) => {
-  const styles = useStyles()
-  const { t } = useTranslation("usersPage")
-
-  return (
-    <ChooseOne>
-      <Cond condition={Boolean(isLoading)}>
-        <TableLoaderSkeleton columns={5} useAvatarData />
-      </Cond>
-      <Cond condition={!users || users.length === 0}>
-        <ChooseOne>
-          <Cond condition={isNonInitialPage}>
-            <TableRow>
-              <TableCell colSpan={999}>
-                <Box p={4}>
-                  <EmptyState message={t("emptyPageMessage")} />
-                </Box>
-              </TableCell>
-            </TableRow>
-          </Cond>
-          <Cond>
-            <TableRow>
-              <TableCell colSpan={999}>
-                <Box p={4}>
-                  <EmptyState message={t("emptyMessage")} />
-                </Box>
-              </TableCell>
-            </TableRow>
-          </Cond>
-        </ChooseOne>
-      </Cond>
-      <Cond>
-        <>
-          {users &&
-            users.map((user) => {
-              // When the user has no role we want to show they are a Member
-              const fallbackRole: TypesGen.Role = {
-                name: "member",
-                display_name: "Member",
-              }
-              const userRoles =
-                user.roles.length === 0 ? [fallbackRole] : sortRoles(user.roles)
-
-              return (
-                <TableRow key={user.id}>
-                  <TableCell>
-                    <AvatarData
-                      title={user.username}
-                      subtitle={user.email}
-                      src={user.avatar_url}
-                    />
-                  </TableCell>
-                  <TableCell>
-                    <Stack direction="row" spacing={1}>
-                      {canEditUsers && (
-                        <EditRolesButton
-                          roles={roles ? sortRoles(roles) : []}
-                          selectedRoles={userRoles}
-                          isLoading={Boolean(isUpdatingUserRoles)}
-                          userLoginType={user.login_type}
-                          oidcRoleSync={oidcRoleSyncEnabled}
-                          onChange={(roles) => {
-                            // Remove the fallback role because it is only for the UI
-                            const rolesWithoutFallback = roles.filter(
-                              (role) => role !== fallbackRole.name,
-                            )
-                            onUpdateUserRoles(user, rolesWithoutFallback)
-                          }}
-                        />
-                      )}
-                      {userRoles.map((role) => (
-                        <Pill
-                          key={role.name}
-                          text={role.display_name}
-                          className={combineClasses({
-                            [styles.rolePill]: true,
-                            [styles.rolePillOwner]: isOwnerRole(role),
-                          })}
-                        />
-                      ))}
-                    </Stack>
-                  </TableCell>
-                  <TableCell
-                    className={combineClasses([
-                      styles.status,
-                      user.status === "suspended"
-                        ? styles.suspended
-                        : undefined,
-                    ])}
-                  >
-                    {user.status}
-                  </TableCell>
-                  <TableCell>
-                    <LastUsed lastUsedAt={user.last_seen_at} />
-                  </TableCell>
-                  {canEditUsers && (
-                    <TableCell>
-                      <TableRowMenu
-                        data={user}
-                        menuItems={
-                          // Return either suspend or activate depending on status
-                          (user.status === "active" || user.status === "dormant"
-                            ? [
-                                {
-                                  label: t(
-                                    "suspendMenuItem",
-                                  ) as React.ReactNode,
-                                  onClick: onSuspendUser,
-                                  disabled: false,
-                                },
-                              ]
-                            : [
-                                {
-                                  label: t(
-                                    "activateMenuItem",
-                                  ) as React.ReactNode,
-                                  onClick: onActivateUser,
-                                  disabled: false,
-                                },
-                              ]
-                          ).concat(
-                            {
-                              label: t("deleteMenuItem"),
-                              onClick: onDeleteUser,
-                              disabled: user.id === actorID,
-                            },
-                            {
-                              label: t("resetPasswordMenuItem"),
-                              onClick: onResetUserPassword,
-                              disabled: false,
-                            },
-                            {
-                              label: t("listWorkspacesMenuItem"),
-                              onClick: onListWorkspaces,
-                              disabled: false,
-                            },
-                            {
-                              label: (
-                                <>
-                                  View activity
-                                  {!canViewActivity && <EnterpriseBadge />}
-                                </>
-                              ),
-                              onClick: onViewActivity,
-                              disabled: !canViewActivity,
-                            },
-                          )
-                        }
-                      />
-                    </TableCell>
-                  )}
-                </TableRow>
-              )
-            })}
-        </>
-      </Cond>
-    </ChooseOne>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  status: {
-    textTransform: "capitalize",
-  },
-  suspended: {
-    color: theme.palette.text.secondary,
-  },
-  rolePill: {
-    backgroundColor: theme.palette.background.paperLight,
-    borderColor: theme.palette.divider,
-  },
-  rolePillOwner: {
-    backgroundColor: theme.palette.info.dark,
-    borderColor: theme.palette.info.light,
-  },
-}))
diff --git a/site/src/components/VSCodeDesktopButton/VSCodeDesktopButton.stories.tsx b/site/src/components/VSCodeDesktopButton/VSCodeDesktopButton.stories.tsx
deleted file mode 100644
index e86c2ffa38567..0000000000000
--- a/site/src/components/VSCodeDesktopButton/VSCodeDesktopButton.stories.tsx
+++ /dev/null
@@ -1,22 +0,0 @@
-import { Story } from "@storybook/react"
-import { MockWorkspace, MockWorkspaceAgent } from "testHelpers/entities"
-import {
-  VSCodeDesktopButton,
-  VSCodeDesktopButtonProps,
-} from "./VSCodeDesktopButton"
-
-export default {
-  title: "components/VSCodeDesktopButton",
-  component: VSCodeDesktopButton,
-}
-
-const Template: Story<VSCodeDesktopButtonProps> = (args) => (
-  <VSCodeDesktopButton {...args} />
-)
-
-export const Default = Template.bind({})
-Default.args = {
-  userName: MockWorkspace.owner_name,
-  workspaceName: MockWorkspace.name,
-  agentName: MockWorkspaceAgent.name,
-}
diff --git a/site/src/components/VSCodeDesktopButton/VSCodeDesktopButton.tsx b/site/src/components/VSCodeDesktopButton/VSCodeDesktopButton.tsx
deleted file mode 100644
index f8b870c969ec4..0000000000000
--- a/site/src/components/VSCodeDesktopButton/VSCodeDesktopButton.tsx
+++ /dev/null
@@ -1,197 +0,0 @@
-import { FC, PropsWithChildren, useState, useRef } from "react"
-import { getApiKey } from "api/api"
-import { VSCodeIcon } from "components/Icons/VSCodeIcon"
-import { VSCodeInsidersIcon } from "components/Icons/VSCodeInsidersIcon"
-import { PrimaryAgentButton } from "components/Resources/AgentButton"
-import KeyboardArrowDownIcon from "@mui/icons-material/KeyboardArrowDown"
-import ButtonGroup from "@mui/material/ButtonGroup"
-import { useLocalStorage } from "hooks"
-import Menu from "@mui/material/Menu"
-import MenuItem from "@mui/material/MenuItem"
-
-export interface VSCodeDesktopButtonProps {
-  userName: string
-  workspaceName: string
-  agentName?: string
-  folderPath?: string
-}
-
-type VSCodeVariant = "vscode" | "vscode-insiders"
-
-const VARIANT_KEY = "vscode-variant"
-
-export const VSCodeDesktopButton: FC<
-  PropsWithChildren<VSCodeDesktopButtonProps>
-> = (props) => {
-  const [isVariantMenuOpen, setIsVariantMenuOpen] = useState(false)
-  const localStorage = useLocalStorage()
-  const previousVariant = localStorage.getLocal(VARIANT_KEY)
-  const [variant, setVariant] = useState<VSCodeVariant>(() => {
-    if (!previousVariant) {
-      return "vscode"
-    }
-    return previousVariant as VSCodeVariant
-  })
-  const menuAnchorRef = useRef<HTMLDivElement>(null)
-
-  const selectVariant = (variant: VSCodeVariant) => {
-    localStorage.saveLocal(VARIANT_KEY, variant)
-    setVariant(variant)
-    setIsVariantMenuOpen(false)
-  }
-
-  return (
-    <div>
-      <ButtonGroup
-        ref={menuAnchorRef}
-        variant="outlined"
-        sx={{
-          // Workaround to make the border transitions smmothly on button groups
-          "& > button:hover + button": {
-            borderLeft: "1px solid #FFF",
-          },
-        }}
-      >
-        {variant === "vscode" ? (
-          <VSCodeButton {...props} />
-        ) : (
-          <VSCodeInsidersButton {...props} />
-        )}
-
-        <PrimaryAgentButton
-          aria-controls={
-            isVariantMenuOpen ? "vscode-variant-button-menu" : undefined
-          }
-          aria-expanded={isVariantMenuOpen ? "true" : undefined}
-          aria-label="select VSCode variant"
-          aria-haspopup="menu"
-          disableRipple
-          onClick={() => {
-            setIsVariantMenuOpen(true)
-          }}
-          sx={{ px: 0 }}
-        >
-          <KeyboardArrowDownIcon sx={{ fontSize: 16 }} />
-        </PrimaryAgentButton>
-      </ButtonGroup>
-
-      <Menu
-        open={isVariantMenuOpen}
-        anchorEl={menuAnchorRef.current}
-        onClose={() => setIsVariantMenuOpen(false)}
-        sx={{
-          "& .MuiMenu-paper": {
-            width: menuAnchorRef.current?.clientWidth,
-          },
-        }}
-      >
-        <MenuItem
-          sx={{ fontSize: 14 }}
-          onClick={() => {
-            selectVariant("vscode")
-          }}
-        >
-          <VSCodeIcon sx={{ width: 12, height: 12 }} />
-          VS Code Desktop
-        </MenuItem>
-        <MenuItem
-          sx={{ fontSize: 14 }}
-          onClick={() => {
-            selectVariant("vscode-insiders")
-          }}
-        >
-          <VSCodeInsidersIcon sx={{ width: 12, height: 12 }} />
-          VS Code Insiders
-        </MenuItem>
-      </Menu>
-    </div>
-  )
-}
-
-const VSCodeButton = ({
-  userName,
-  workspaceName,
-  agentName,
-  folderPath,
-}: VSCodeDesktopButtonProps) => {
-  const [loading, setLoading] = useState(false)
-
-  return (
-    <PrimaryAgentButton
-      startIcon={<VSCodeIcon />}
-      disabled={loading}
-      onClick={() => {
-        setLoading(true)
-        getApiKey()
-          .then(({ key }) => {
-            const query = new URLSearchParams({
-              owner: userName,
-              workspace: workspaceName,
-              url: location.origin,
-              token: key,
-            })
-            if (agentName) {
-              query.set("agent", agentName)
-            }
-            if (folderPath) {
-              query.set("folder", folderPath)
-            }
-
-            location.href = `vscode://coder.coder-remote/open?${query.toString()}`
-          })
-          .catch((ex) => {
-            console.error(ex)
-          })
-          .finally(() => {
-            setLoading(false)
-          })
-      }}
-    >
-      VS Code Desktop
-    </PrimaryAgentButton>
-  )
-}
-
-const VSCodeInsidersButton = ({
-  userName,
-  workspaceName,
-  agentName,
-  folderPath,
-}: VSCodeDesktopButtonProps) => {
-  const [loading, setLoading] = useState(false)
-
-  return (
-    <PrimaryAgentButton
-      startIcon={<VSCodeInsidersIcon />}
-      disabled={loading}
-      onClick={() => {
-        setLoading(true)
-        getApiKey()
-          .then(({ key }) => {
-            const query = new URLSearchParams({
-              owner: userName,
-              workspace: workspaceName,
-              url: location.origin,
-              token: key,
-            })
-            if (agentName) {
-              query.set("agent", agentName)
-            }
-            if (folderPath) {
-              query.set("folder", folderPath)
-            }
-
-            location.href = `vscode-insiders://coder.coder-remote/open?${query.toString()}`
-          })
-          .catch((ex) => {
-            console.error(ex)
-          })
-          .finally(() => {
-            setLoading(false)
-          })
-      }}
-    >
-      VS Code Insiders
-    </PrimaryAgentButton>
-  )
-}
diff --git a/site/src/components/VersionsTable/VersionRow.tsx b/site/src/components/VersionsTable/VersionRow.tsx
deleted file mode 100644
index 52f72169deaa5..0000000000000
--- a/site/src/components/VersionsTable/VersionRow.tsx
+++ /dev/null
@@ -1,132 +0,0 @@
-import Button from "@mui/material/Button"
-import { makeStyles } from "@mui/styles"
-import TableCell from "@mui/material/TableCell"
-import { TemplateVersion } from "api/typesGenerated"
-import { Pill } from "components/Pill/Pill"
-import { Stack } from "components/Stack/Stack"
-import { TimelineEntry } from "components/Timeline/TimelineEntry"
-import { UserAvatar } from "components/UserAvatar/UserAvatar"
-import { useClickableTableRow } from "hooks/useClickableTableRow"
-import { useTranslation } from "react-i18next"
-import { useNavigate } from "react-router-dom"
-import { colors } from "theme/colors"
-import { combineClasses } from "utils/combineClasses"
-
-export interface VersionRowProps {
-  version: TemplateVersion
-  isActive: boolean
-  onPromoteClick?: (templateVersionId: string) => void
-}
-
-export const VersionRow: React.FC<VersionRowProps> = ({
-  version,
-  isActive,
-  onPromoteClick,
-}) => {
-  const styles = useStyles()
-  const { t } = useTranslation("templatePage")
-  const navigate = useNavigate()
-  const clickableProps = useClickableTableRow(() => {
-    navigate(version.name)
-  })
-
-  return (
-    <TimelineEntry
-      data-testid={`version-${version.id}`}
-      {...clickableProps}
-      className={combineClasses({
-        [clickableProps.className]: true,
-        [styles.row]: true,
-        [styles.active]: isActive,
-      })}
-    >
-      <TableCell className={styles.versionCell}>
-        <Stack
-          direction="row"
-          alignItems="center"
-          className={styles.versionWrapper}
-          justifyContent="space-between"
-        >
-          <Stack direction="row" alignItems="center">
-            <UserAvatar
-              username={version.created_by.username}
-              avatarURL={version.created_by.avatar_url}
-            />
-            <Stack
-              className={styles.versionSummary}
-              direction="row"
-              alignItems="center"
-              spacing={1}
-            >
-              <span>
-                <strong>{version.created_by.username}</strong>{" "}
-                {t("createdVersion")} <strong>{version.name}</strong>
-              </span>
-
-              <span className={styles.versionTime}>
-                {new Date(version.created_at).toLocaleTimeString()}
-              </span>
-            </Stack>
-          </Stack>
-          {isActive ? (
-            <Pill text="Active version" type="success" />
-          ) : (
-            onPromoteClick && (
-              <Button
-                className={styles.promoteButton}
-                onClick={(e) => {
-                  e.preventDefault()
-                  e.stopPropagation()
-                  onPromoteClick(version.id)
-                }}
-              >
-                Promote version
-              </Button>
-            )
-          )}
-        </Stack>
-      </TableCell>
-    </TimelineEntry>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  row: {
-    "&:hover $promoteButton": {
-      color: theme.palette.text.primary,
-      borderColor: colors.gray[11],
-      "&:hover": {
-        borderColor: theme.palette.text.primary,
-      },
-    },
-  },
-
-  promoteButton: {
-    color: theme.palette.text.secondary,
-    transition: "none",
-  },
-
-  versionWrapper: {
-    padding: theme.spacing(2, 4),
-  },
-
-  active: {
-    backgroundColor: theme.palette.background.paperLight,
-  },
-
-  versionCell: {
-    padding: "0 !important",
-    position: "relative",
-    borderBottom: 0,
-  },
-
-  versionSummary: {
-    ...theme.typography.body1,
-    fontFamily: "inherit",
-  },
-
-  versionTime: {
-    color: theme.palette.text.secondary,
-    fontSize: 12,
-  },
-}))
diff --git a/site/src/components/VersionsTable/VersionsTable.stories.tsx b/site/src/components/VersionsTable/VersionsTable.stories.tsx
deleted file mode 100644
index c0b64f592ec4a..0000000000000
--- a/site/src/components/VersionsTable/VersionsTable.stories.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-import { action } from "@storybook/addon-actions"
-import { ComponentMeta, Story } from "@storybook/react"
-import { MockTemplateVersion } from "../../testHelpers/entities"
-import { VersionsTable, VersionsTableProps } from "./VersionsTable"
-
-export default {
-  title: "components/VersionsTable",
-  component: VersionsTable,
-} as ComponentMeta<typeof VersionsTable>
-
-const Template: Story<VersionsTableProps> = (args) => (
-  <VersionsTable {...args} />
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  activeVersionId: MockTemplateVersion.id,
-  versions: [
-    {
-      ...MockTemplateVersion,
-      id: "2",
-      name: "test-template-version-2",
-      created_at: "2022-05-18T18:39:01.382927298Z",
-    },
-    MockTemplateVersion,
-  ],
-  onPromoteClick: undefined,
-}
-
-export const CanPromote = Template.bind({})
-CanPromote.args = {
-  activeVersionId: MockTemplateVersion.id,
-  onPromoteClick: action("onPromoteClick"),
-  versions: [
-    {
-      ...MockTemplateVersion,
-      id: "2",
-      name: "test-template-version-2",
-      created_at: "2022-05-18T18:39:01.382927298Z",
-    },
-    MockTemplateVersion,
-  ],
-}
-
-export const Empty = Template.bind({})
-Empty.args = {
-  versions: [],
-}
diff --git a/site/src/components/VersionsTable/VersionsTable.tsx b/site/src/components/VersionsTable/VersionsTable.tsx
deleted file mode 100644
index 57e5a256471e3..0000000000000
--- a/site/src/components/VersionsTable/VersionsTable.tsx
+++ /dev/null
@@ -1,66 +0,0 @@
-import Box from "@mui/material/Box"
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableRow from "@mui/material/TableRow"
-import { Timeline } from "components/Timeline/Timeline"
-import { FC } from "react"
-import * as TypesGen from "../../api/typesGenerated"
-import { EmptyState } from "../EmptyState/EmptyState"
-import { TableLoader } from "../TableLoader/TableLoader"
-import { VersionRow } from "./VersionRow"
-
-export const Language = {
-  emptyMessage: "No versions found",
-  nameLabel: "Version name",
-  createdAtLabel: "Created at",
-  createdByLabel: "Created by",
-}
-
-export interface VersionsTableProps {
-  activeVersionId: string
-  onPromoteClick?: (templateVersionId: string) => void
-  versions?: TypesGen.TemplateVersion[]
-}
-
-export const VersionsTable: FC<React.PropsWithChildren<VersionsTableProps>> = ({
-  versions,
-  onPromoteClick,
-  activeVersionId,
-}) => {
-  return (
-    <TableContainer>
-      <Table data-testid="versions-table">
-        <TableBody>
-          {versions ? (
-            <Timeline
-              items={versions.slice().reverse()}
-              getDate={(version) => new Date(version.created_at)}
-              row={(version) => (
-                <VersionRow
-                  onPromoteClick={onPromoteClick}
-                  version={version}
-                  key={version.id}
-                  isActive={activeVersionId === version.id}
-                />
-              )}
-            />
-          ) : (
-            <TableLoader />
-          )}
-
-          {versions && versions.length === 0 && (
-            <TableRow>
-              <TableCell colSpan={999}>
-                <Box p={4}>
-                  <EmptyState message={Language.emptyMessage} />
-                </Box>
-              </TableCell>
-            </TableRow>
-          )}
-        </TableBody>
-      </Table>
-    </TableContainer>
-  )
-}
diff --git a/site/src/components/WarningAlert/WarningAlert.stories.tsx b/site/src/components/WarningAlert/WarningAlert.stories.tsx
deleted file mode 100644
index 774f995010604..0000000000000
--- a/site/src/components/WarningAlert/WarningAlert.stories.tsx
+++ /dev/null
@@ -1,40 +0,0 @@
-import { Meta, StoryObj } from "@storybook/react"
-import { WarningAlert } from "./WarningAlert"
-import Button from "@mui/material/Button"
-
-const meta: Meta<typeof WarningAlert> = {
-  title: "components/WarningAlert",
-  component: WarningAlert,
-}
-
-export default meta
-
-type Story = StoryObj<typeof WarningAlert>
-
-export const ExampleWithDismiss: Story = {
-  args: {
-    text: "This is a warning",
-    dismissible: true,
-  },
-}
-
-const ExampleAction = (
-  <Button onClick={() => null} size="small" variant="text">
-    Button
-  </Button>
-)
-
-export const ExampleWithAction = {
-  args: {
-    text: "This is a warning",
-    actions: [ExampleAction],
-  },
-}
-
-export const ExampleWithActionAndDismiss = {
-  args: {
-    text: "This is a warning",
-    actions: [ExampleAction],
-    dismissible: true,
-  },
-}
diff --git a/site/src/components/WarningAlert/WarningAlert.tsx b/site/src/components/WarningAlert/WarningAlert.tsx
deleted file mode 100644
index b7b8d06075827..0000000000000
--- a/site/src/components/WarningAlert/WarningAlert.tsx
+++ /dev/null
@@ -1,65 +0,0 @@
-import { useState, FC, ReactElement } from "react"
-import Collapse from "@mui/material/Collapse"
-import { Stack } from "components/Stack/Stack"
-import { makeStyles } from "@mui/styles"
-import { colors } from "theme/colors"
-import ReportProblemOutlinedIcon from "@mui/icons-material/ReportProblemOutlined"
-import Button from "@mui/material/Button"
-import { useTranslation } from "react-i18next"
-
-export interface WarningAlertProps {
-  text: string
-  dismissible?: boolean
-  actions?: ReactElement[]
-}
-
-export const WarningAlert: FC<WarningAlertProps> = ({
-  text,
-  dismissible = false,
-  actions = [],
-}) => {
-  const { t } = useTranslation("common")
-  const [open, setOpen] = useState(true)
-  const classes = useStyles()
-
-  return (
-    <Collapse in={open}>
-      <Stack
-        className={classes.alertContainer}
-        direction="row"
-        alignItems="center"
-        spacing={0}
-        justifyContent="space-between"
-      >
-        <Stack direction="row" spacing={1}>
-          <ReportProblemOutlinedIcon
-            fontSize="small"
-            className={classes.alertIcon}
-          />
-          {text}
-        </Stack>
-        <Stack direction="row">
-          {actions.length > 0 &&
-            actions.map((action) => <div key={String(action)}>{action}</div>)}
-          {dismissible && (
-            <Button size="small" onClick={() => setOpen(false)}>
-              {t("ctas.dismissCta")}
-            </Button>
-          )}
-        </Stack>
-      </Stack>
-    </Collapse>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  alertContainer: {
-    border: `1px solid ${colors.orange[7]}`,
-    borderRadius: theme.shape.borderRadius,
-    padding: `${theme.spacing(1)} ${theme.spacing(2)}`,
-    backgroundColor: `${colors.gray[16]}`,
-  },
-  alertIcon: {
-    color: `${colors.orange[7]}`,
-  },
-}))
diff --git a/site/src/components/Welcome/Welcome.tsx b/site/src/components/Welcome/Welcome.tsx
index 660e7cc381f6d..916ed2c43e36f 100644
--- a/site/src/components/Welcome/Welcome.tsx
+++ b/site/src/components/Welcome/Welcome.tsx
@@ -1,7 +1,7 @@
-import { makeStyles } from "@mui/styles"
-import Typography from "@mui/material/Typography"
-import { FC, PropsWithChildren } from "react"
-import { CoderIcon } from "../Icons/CoderIcon"
+import Typography from "@mui/material/Typography";
+import { type FC, type PropsWithChildren } from "react";
+import { css, useTheme } from "@emotion/react";
+import { CoderIcon } from "../Icons/CoderIcon";
 
 const Language = {
   defaultMessage: (
@@ -9,45 +9,46 @@ const Language = {
       Welcome to <strong>Coder</strong>
     </>
   ),
-}
+};
 
 export const Welcome: FC<
   PropsWithChildren<{ message?: JSX.Element | string }>
 > = ({ message = Language.defaultMessage }) => {
-  const styles = useStyles()
+  const theme = useTheme();
 
   return (
     <div>
-      <div className={styles.logoBox}>
-        <CoderIcon className={styles.logo} />
+      <div
+        css={{
+          display: "flex",
+          justifyContent: "center",
+        }}
+      >
+        <CoderIcon
+          css={{
+            color: theme.palette.text.primary,
+            fontSize: theme.spacing(8),
+          }}
+        />
       </div>
-      <Typography className={styles.title} variant="h1">
+      <Typography
+        css={css`
+          text-align: center;
+          font-size: ${theme.spacing(4)};
+          font-weight: 400;
+          margin: 0;
+          margin-bottom: ${theme.spacing(2)};
+          margin-top: ${theme.spacing(2)};
+          line-height: 1.25;
+
+          & strong {
+            font-weight: 600;
+          }
+        `}
+        variant="h1"
+      >
         {message}
       </Typography>
     </div>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  logoBox: {
-    display: "flex",
-    justifyContent: "center",
-  },
-  logo: {
-    color: theme.palette.text.primary,
-    fontSize: theme.spacing(8),
-  },
-  title: {
-    textAlign: "center",
-    fontSize: theme.spacing(4),
-    fontWeight: 400,
-    margin: 0,
-    marginBottom: theme.spacing(2),
-    marginTop: theme.spacing(2),
-    lineHeight: 1.25,
-
-    "& strong": {
-      fontWeight: 600,
-    },
-  },
-}))
+  );
+};
diff --git a/site/src/components/Workspace/Workspace.tsx b/site/src/components/Workspace/Workspace.tsx
deleted file mode 100644
index 364bb50643bba..0000000000000
--- a/site/src/components/Workspace/Workspace.tsx
+++ /dev/null
@@ -1,402 +0,0 @@
-import Button from "@mui/material/Button"
-import { makeStyles } from "@mui/styles"
-import { Avatar } from "components/Avatar/Avatar"
-import { AgentRow } from "components/Resources/AgentRow"
-import {
-  ActiveTransition,
-  WorkspaceBuildProgress,
-} from "components/WorkspaceBuildProgress/WorkspaceBuildProgress"
-import { FC, useEffect, useState } from "react"
-import { useTranslation } from "react-i18next"
-import { useNavigate } from "react-router-dom"
-import * as TypesGen from "../../api/typesGenerated"
-import { Alert, AlertDetail } from "../Alert/Alert"
-import { BuildsTable } from "../BuildsTable/BuildsTable"
-import { Margins } from "../Margins/Margins"
-import { Resources } from "../Resources/Resources"
-import { Stack } from "../Stack/Stack"
-import { WorkspaceActions } from "../WorkspaceActions/WorkspaceActions"
-import { WorkspaceDeletedBanner } from "../WorkspaceDeletedBanner/WorkspaceDeletedBanner"
-import { WorkspaceStats } from "../WorkspaceStats/WorkspaceStats"
-import {
-  FullWidthPageHeader,
-  PageHeaderActions,
-  PageHeaderTitle,
-  PageHeaderSubtitle,
-} from "components/PageHeader/FullWidthPageHeader"
-import { TemplateVersionWarnings } from "components/TemplateVersionWarnings/TemplateVersionWarnings"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
-import { ImpendingDeletionBanner } from "components/WorkspaceDeletion"
-import { useLocalStorage } from "hooks"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import AlertTitle from "@mui/material/AlertTitle"
-import { Maybe } from "components/Conditionals/Maybe"
-import dayjs from "dayjs"
-
-export enum WorkspaceErrors {
-  GET_BUILDS_ERROR = "getBuildsError",
-  BUILD_ERROR = "buildError",
-  CANCELLATION_ERROR = "cancellationError",
-}
-export interface WorkspaceProps {
-  scheduleProps: {
-    onDeadlinePlus: (hours: number) => void
-    onDeadlineMinus: (hours: number) => void
-    maxDeadlineIncrease: number
-    maxDeadlineDecrease: number
-  }
-  handleStart: (buildParameters?: TypesGen.WorkspaceBuildParameter[]) => void
-  handleStop: () => void
-  handleRestart: (buildParameters?: TypesGen.WorkspaceBuildParameter[]) => void
-  handleDelete: () => void
-  handleUpdate: () => void
-  handleCancel: () => void
-  handleSettings: () => void
-  handleChangeVersion: () => void
-  isUpdating: boolean
-  isRestarting: boolean
-  workspace: TypesGen.Workspace
-  resources?: TypesGen.WorkspaceResource[]
-  builds?: TypesGen.WorkspaceBuild[]
-  templateWarnings?: TypesGen.TemplateVersionWarning[]
-  canUpdateWorkspace: boolean
-  canRetryDebugMode: boolean
-  canChangeVersions: boolean
-  hideSSHButton?: boolean
-  hideVSCodeDesktopButton?: boolean
-  workspaceErrors: Partial<Record<WorkspaceErrors, unknown>>
-  buildInfo?: TypesGen.BuildInfoResponse
-  sshPrefix?: string
-  template?: TypesGen.Template
-  quota_budget?: number
-  handleBuildRetry: () => void
-  buildLogs?: React.ReactNode
-}
-
-/**
- * Workspace is the top-level component for viewing an individual workspace
- */
-export const Workspace: FC<React.PropsWithChildren<WorkspaceProps>> = ({
-  scheduleProps,
-  handleStart,
-  handleStop,
-  handleRestart,
-  handleDelete,
-  handleUpdate,
-  handleCancel,
-  handleSettings,
-  handleChangeVersion,
-  workspace,
-  isUpdating,
-  isRestarting,
-  resources,
-  builds,
-  canUpdateWorkspace,
-  canRetryDebugMode,
-  canChangeVersions,
-  workspaceErrors,
-  hideSSHButton,
-  hideVSCodeDesktopButton,
-  buildInfo,
-  sshPrefix,
-  template,
-  quota_budget,
-  handleBuildRetry,
-  templateWarnings,
-  buildLogs,
-}) => {
-  const styles = useStyles()
-  const navigate = useNavigate()
-  const serverVersion = buildInfo?.version || ""
-  const { t } = useTranslation("workspacePage")
-  const { saveLocal, getLocal } = useLocalStorage()
-
-  const buildError = Boolean(workspaceErrors[WorkspaceErrors.BUILD_ERROR]) && (
-    <ErrorAlert
-      error={workspaceErrors[WorkspaceErrors.BUILD_ERROR]}
-      dismissible
-    />
-  )
-
-  const cancellationError = Boolean(
-    workspaceErrors[WorkspaceErrors.CANCELLATION_ERROR],
-  ) && (
-    <ErrorAlert
-      error={workspaceErrors[WorkspaceErrors.CANCELLATION_ERROR]}
-      dismissible
-    />
-  )
-
-  let transitionStats: TypesGen.TransitionStats | undefined = undefined
-  if (template !== undefined) {
-    transitionStats = ActiveTransition(template, workspace)
-  }
-
-  const [showAlertPendingInQueue, setShowAlertPendingInQueue] = useState(false)
-  const now = dayjs()
-  useEffect(() => {
-    if (
-      workspace.latest_build.status !== "pending" ||
-      workspace.latest_build.job.queue_size === 0
-    ) {
-      if (!showAlertPendingInQueue) {
-        return
-      }
-
-      const hideTimer = setTimeout(() => {
-        setShowAlertPendingInQueue(false)
-      }, 250)
-      return () => {
-        clearTimeout(hideTimer)
-      }
-    }
-
-    const t = Math.max(
-      0,
-      5000 - dayjs().diff(dayjs(workspace.latest_build.created_at)),
-    )
-    const showTimer = setTimeout(() => {
-      setShowAlertPendingInQueue(true)
-    }, t)
-
-    return () => {
-      clearTimeout(showTimer)
-    }
-  }, [workspace, now, showAlertPendingInQueue])
-  return (
-    <>
-      <FullWidthPageHeader>
-        <Stack direction="row" spacing={3} alignItems="center">
-          <Avatar
-            size="md"
-            src={workspace.template_icon}
-            variant={workspace.template_icon ? "square" : undefined}
-            fitImage={Boolean(workspace.template_icon)}
-          >
-            {workspace.name}
-          </Avatar>
-          <div>
-            <PageHeaderTitle>{workspace.name}</PageHeaderTitle>
-            <PageHeaderSubtitle>{workspace.owner_name}</PageHeaderSubtitle>
-          </div>
-        </Stack>
-
-        <WorkspaceStats
-          workspace={workspace}
-          quota_budget={quota_budget}
-          handleUpdate={handleUpdate}
-          canUpdateWorkspace={canUpdateWorkspace}
-          maxDeadlineDecrease={scheduleProps.maxDeadlineDecrease}
-          maxDeadlineIncrease={scheduleProps.maxDeadlineIncrease}
-          onDeadlineMinus={scheduleProps.onDeadlineMinus}
-          onDeadlinePlus={scheduleProps.onDeadlinePlus}
-        />
-
-        <PageHeaderActions>
-          <WorkspaceActions
-            workspace={workspace}
-            handleStart={handleStart}
-            handleStop={handleStop}
-            handleRestart={handleRestart}
-            handleDelete={handleDelete}
-            handleUpdate={handleUpdate}
-            handleCancel={handleCancel}
-            handleSettings={handleSettings}
-            handleChangeVersion={handleChangeVersion}
-            canChangeVersions={canChangeVersions}
-            isUpdating={isUpdating}
-            isRestarting={isRestarting}
-          />
-        </PageHeaderActions>
-      </FullWidthPageHeader>
-
-      <Margins className={styles.content}>
-        <Stack
-          direction="column"
-          className={styles.firstColumnSpacer}
-          spacing={4}
-        >
-          {buildError}
-          {cancellationError}
-          {workspace.latest_build.status === "running" &&
-            !workspace.health.healthy && (
-              <Alert
-                severity="warning"
-                actions={
-                  <Button
-                    variant="text"
-                    size="small"
-                    onClick={() => {
-                      handleRestart()
-                    }}
-                  >
-                    Restart
-                  </Button>
-                }
-              >
-                <AlertTitle>Workspace is unhealthy</AlertTitle>
-                <AlertDetail>
-                  Your workspace is running but{" "}
-                  {workspace.health.failing_agents.length > 1
-                    ? `${workspace.health.failing_agents.length} agents are unhealthy`
-                    : `1 agent is unhealthy`}
-                  .
-                </AlertDetail>
-              </Alert>
-            )}
-
-          <ChooseOne>
-            <Cond condition={workspace.latest_build.status === "deleted"}>
-              <WorkspaceDeletedBanner
-                handleClick={() => navigate(`/templates`)}
-              />
-            </Cond>
-            <Cond>
-              {/* <ImpendingDeletionBanner/> determines its own visibility */}
-              <ImpendingDeletionBanner
-                workspace={workspace}
-                shouldRedisplayBanner={
-                  getLocal("dismissedWorkspace") !== workspace.id
-                }
-                onDismiss={() => saveLocal("dismissedWorkspace", workspace.id)}
-              />
-            </Cond>
-          </ChooseOne>
-
-          <TemplateVersionWarnings warnings={templateWarnings} />
-
-          <Maybe condition={showAlertPendingInQueue}>
-            <Alert severity="info">
-              <AlertTitle>Workspace build is pending</AlertTitle>
-              <AlertDetail>
-                <div className={styles.alertPendingInQueue}>
-                  This workspace build job is waiting for a provisioner to
-                  become available. If you have been waiting for an extended
-                  period of time, please contact your administrator for
-                  assistance.
-                </div>
-                <div>
-                  Position in queue:{" "}
-                  <strong>{workspace.latest_build.job.queue_position}</strong>
-                </div>
-              </AlertDetail>
-            </Alert>
-          </Maybe>
-
-          {workspace.latest_build.job.error && (
-            <Alert
-              severity="error"
-              actions={
-                canRetryDebugMode && (
-                  <Button
-                    key={0}
-                    onClick={handleBuildRetry}
-                    variant="text"
-                    size="small"
-                  >
-                    {t("actionButton.retryDebugMode")}
-                  </Button>
-                )
-              }
-            >
-              <AlertTitle>Workspace build failed</AlertTitle>
-              <AlertDetail>{workspace.latest_build.job.error}</AlertDetail>
-            </Alert>
-          )}
-
-          {transitionStats !== undefined && (
-            <WorkspaceBuildProgress
-              workspace={workspace}
-              transitionStats={transitionStats}
-            />
-          )}
-
-          {buildLogs}
-
-          {typeof resources !== "undefined" && resources.length > 0 && (
-            <Resources
-              resources={resources}
-              agentRow={(agent) => (
-                <AgentRow
-                  key={agent.id}
-                  agent={agent}
-                  workspace={workspace}
-                  sshPrefix={sshPrefix}
-                  showApps={canUpdateWorkspace}
-                  hideSSHButton={hideSSHButton}
-                  hideVSCodeDesktopButton={hideVSCodeDesktopButton}
-                  serverVersion={serverVersion}
-                  onUpdateAgent={handleUpdate} // On updating the workspace the agent version is also updated
-                />
-              )}
-            />
-          )}
-
-          {workspaceErrors[WorkspaceErrors.GET_BUILDS_ERROR] ? (
-            <ErrorAlert
-              error={workspaceErrors[WorkspaceErrors.GET_BUILDS_ERROR]}
-            />
-          ) : (
-            <BuildsTable builds={builds} />
-          )}
-        </Stack>
-      </Margins>
-    </>
-  )
-}
-
-const spacerWidth = 300
-
-export const useStyles = makeStyles((theme) => {
-  return {
-    content: {
-      marginTop: theme.spacing(4),
-    },
-
-    statusBadge: {
-      marginLeft: theme.spacing(2),
-    },
-
-    actions: {
-      [theme.breakpoints.down("md")]: {
-        flexDirection: "column",
-      },
-    },
-
-    firstColumnSpacer: {
-      flex: 2,
-    },
-
-    secondColumnSpacer: {
-      flex: `0 0 ${spacerWidth}px`,
-    },
-
-    layout: {
-      alignItems: "flex-start",
-    },
-
-    main: {
-      width: "100%",
-    },
-
-    timelineContents: {
-      margin: 0,
-    },
-    logs: {
-      border: `1px solid ${theme.palette.divider}`,
-    },
-
-    errorDetails: {
-      color: theme.palette.text.secondary,
-      fontSize: 12,
-    },
-
-    fullWidth: {
-      width: "100%",
-    },
-
-    alertPendingInQueue: {
-      marginBottom: 12,
-    },
-  }
-})
diff --git a/site/src/components/WorkspaceActions/BuildParametersPopover.tsx b/site/src/components/WorkspaceActions/BuildParametersPopover.tsx
deleted file mode 100644
index a3810f80788b6..0000000000000
--- a/site/src/components/WorkspaceActions/BuildParametersPopover.tsx
+++ /dev/null
@@ -1,197 +0,0 @@
-import ExpandMoreOutlined from "@mui/icons-material/ExpandMoreOutlined"
-import Box from "@mui/material/Box"
-import Button from "@mui/material/Button"
-import Popover from "@mui/material/Popover"
-import { useQuery } from "@tanstack/react-query"
-import { getWorkspaceParameters } from "api/api"
-import {
-  TemplateVersionParameter,
-  Workspace,
-  WorkspaceBuildParameter,
-} from "api/typesGenerated"
-import { FormFields } from "components/Form/Form"
-import { Loader } from "components/Loader/Loader"
-import { RichParameterInput } from "components/RichParameterInput/RichParameterInput"
-import {
-  HelpTooltipLink,
-  HelpTooltipLinksGroup,
-  HelpTooltipText,
-  HelpTooltipTitle,
-} from "components/Tooltips/HelpTooltip/HelpTooltip"
-import { useFormik } from "formik"
-import { useRef, useState } from "react"
-import { docs } from "utils/docs"
-import { getFormHelpers } from "utils/formUtils"
-import { getInitialParameterValues } from "utils/richParameters"
-
-export const BuildParametersPopover = ({
-  workspace,
-  disabled,
-  onSubmit,
-}: {
-  workspace: Workspace
-  disabled?: boolean
-  onSubmit: (buildParameters: WorkspaceBuildParameter[]) => void
-}) => {
-  const anchorRef = useRef<HTMLButtonElement>(null)
-  const [isOpen, setIsOpen] = useState(false)
-  const { data: parameters } = useQuery({
-    queryKey: ["workspace", workspace.id, "parameters"],
-    queryFn: () => getWorkspaceParameters(workspace),
-    enabled: isOpen,
-  })
-  const ephemeralParameters = parameters
-    ? parameters.templateVersionRichParameters.filter((p) => p.ephemeral)
-    : undefined
-
-  return (
-    <>
-      <Button
-        data-testid="build-parameters-button"
-        disabled={disabled}
-        color="neutral"
-        sx={{ px: 0 }}
-        ref={anchorRef}
-        onClick={() => {
-          setIsOpen(true)
-        }}
-      >
-        <ExpandMoreOutlined sx={{ fontSize: 16 }} />
-      </Button>
-      <Popover
-        open={isOpen}
-        anchorEl={anchorRef.current}
-        onClose={() => {
-          setIsOpen(false)
-        }}
-        anchorOrigin={{
-          vertical: "bottom",
-          horizontal: "right",
-        }}
-        transformOrigin={{
-          vertical: "top",
-          horizontal: "right",
-        }}
-        sx={{
-          ".MuiPaper-root": {
-            width: (theme) => theme.spacing(38),
-            marginTop: 1,
-          },
-        }}
-      >
-        <Box>
-          {parameters && parameters.buildParameters && ephemeralParameters ? (
-            ephemeralParameters.length > 0 ? (
-              <>
-                <Box
-                  sx={{
-                    color: (theme) => theme.palette.text.secondary,
-                    p: 2.5,
-                    borderBottom: (theme) =>
-                      `1px solid ${theme.palette.divider}`,
-                  }}
-                >
-                  <HelpTooltipTitle>Build Options</HelpTooltipTitle>
-                  <HelpTooltipText>
-                    These parameters only apply for a single workspace start.
-                  </HelpTooltipText>
-                </Box>
-                <Box sx={{ p: 2.5 }}>
-                  <Form
-                    onSubmit={(buildParameters) => {
-                      onSubmit(buildParameters)
-                      setIsOpen(false)
-                    }}
-                    ephemeralParameters={ephemeralParameters}
-                    buildParameters={parameters.buildParameters}
-                  />
-                </Box>
-              </>
-            ) : (
-              <Box
-                sx={{
-                  color: (theme) => theme.palette.text.secondary,
-                  p: 2.5,
-                  borderBottom: (theme) => `1px solid ${theme.palette.divider}`,
-                }}
-              >
-                <HelpTooltipTitle>Build Options</HelpTooltipTitle>
-                <HelpTooltipText>
-                  This template has no ephemeral build options.
-                </HelpTooltipText>
-                <HelpTooltipLinksGroup>
-                  <HelpTooltipLink
-                    href={docs("/templates/parameters#ephemeral-parameters")}
-                  >
-                    Read the docs
-                  </HelpTooltipLink>
-                </HelpTooltipLinksGroup>
-              </Box>
-            )
-          ) : (
-            <Loader />
-          )}
-        </Box>
-      </Popover>
-    </>
-  )
-}
-
-const Form = ({
-  ephemeralParameters,
-  buildParameters,
-  onSubmit,
-}: {
-  ephemeralParameters: TemplateVersionParameter[]
-  buildParameters: WorkspaceBuildParameter[]
-  onSubmit: (buildParameters: WorkspaceBuildParameter[]) => void
-}) => {
-  const form = useFormik({
-    initialValues: {
-      rich_parameter_values: getInitialParameterValues(
-        ephemeralParameters,
-        buildParameters,
-      ),
-    },
-    onSubmit: (values) => {
-      onSubmit(values.rich_parameter_values)
-    },
-  })
-  const getFieldHelpers = getFormHelpers(form)
-
-  return (
-    <form onSubmit={form.handleSubmit} data-testid="build-parameters-form">
-      <FormFields>
-        {ephemeralParameters.map((parameter, index) => {
-          return (
-            <RichParameterInput
-              {...getFieldHelpers("rich_parameter_values[" + index + "].value")}
-              key={parameter.name}
-              parameter={parameter}
-              initialValue={form.values.rich_parameter_values[index]?.value}
-              index={index}
-              size="small"
-              onChange={async (value) => {
-                await form.setFieldValue(`rich_parameter_values[${index}]`, {
-                  name: parameter.name,
-                  value: value,
-                })
-              }}
-            />
-          )
-        })}
-      </FormFields>
-      <Box sx={{ py: 3, pb: 1 }}>
-        <Button
-          data-testid="build-parameters-submit"
-          type="submit"
-          variant="contained"
-          color="primary"
-          sx={{ width: "100%" }}
-        >
-          Build workspace
-        </Button>
-      </Box>
-    </form>
-  )
-}
diff --git a/site/src/components/WorkspaceActions/Buttons.tsx b/site/src/components/WorkspaceActions/Buttons.tsx
deleted file mode 100644
index 4e268c70a223d..0000000000000
--- a/site/src/components/WorkspaceActions/Buttons.tsx
+++ /dev/null
@@ -1,154 +0,0 @@
-import Button from "@mui/material/Button"
-import BlockIcon from "@mui/icons-material/Block"
-import CloudQueueIcon from "@mui/icons-material/CloudQueue"
-import CropSquareIcon from "@mui/icons-material/CropSquare"
-import PlayCircleOutlineIcon from "@mui/icons-material/PlayCircleOutline"
-import ReplayIcon from "@mui/icons-material/Replay"
-import { LoadingButton } from "components/LoadingButton/LoadingButton"
-import { FC } from "react"
-import BlockOutlined from "@mui/icons-material/BlockOutlined"
-import ButtonGroup from "@mui/material/ButtonGroup"
-import { Workspace, WorkspaceBuildParameter } from "api/typesGenerated"
-import { BuildParametersPopover } from "./BuildParametersPopover"
-
-interface WorkspaceAction {
-  loading?: boolean
-  handleAction: () => void
-}
-
-export const UpdateButton: FC<WorkspaceAction> = ({
-  handleAction,
-  loading,
-}) => {
-  return (
-    <LoadingButton
-      loading={loading}
-      loadingIndicator="Updating..."
-      loadingPosition="start"
-      data-testid="workspace-update-button"
-      startIcon={<CloudQueueIcon />}
-      onClick={handleAction}
-    >
-      Update
-    </LoadingButton>
-  )
-}
-
-export const StartButton: FC<
-  Omit<WorkspaceAction, "handleAction"> & {
-    workspace: Workspace
-    handleAction: (buildParameters?: WorkspaceBuildParameter[]) => void
-  }
-> = ({ handleAction, workspace, loading }) => {
-  return (
-    <ButtonGroup
-      variant="outlined"
-      sx={{
-        // Workaround to make the border transitions smmothly on button groups
-        "& > button:hover + button": {
-          borderLeft: "1px solid #FFF",
-        },
-      }}
-    >
-      <LoadingButton
-        loading={loading}
-        loadingIndicator="Starting..."
-        loadingPosition="start"
-        startIcon={<PlayCircleOutlineIcon />}
-        onClick={() => handleAction()}
-      >
-        Start
-      </LoadingButton>
-      <BuildParametersPopover
-        workspace={workspace}
-        disabled={loading}
-        onSubmit={handleAction}
-      />
-    </ButtonGroup>
-  )
-}
-
-export const StopButton: FC<WorkspaceAction> = ({ handleAction, loading }) => {
-  return (
-    <LoadingButton
-      loading={loading}
-      loadingIndicator="Stopping..."
-      loadingPosition="start"
-      startIcon={<CropSquareIcon />}
-      onClick={handleAction}
-    >
-      Stop
-    </LoadingButton>
-  )
-}
-
-export const RestartButton: FC<
-  Omit<WorkspaceAction, "handleAction"> & {
-    workspace: Workspace
-    handleAction: (buildParameters?: WorkspaceBuildParameter[]) => void
-  }
-> = ({ handleAction, loading, workspace }) => {
-  return (
-    <ButtonGroup
-      variant="outlined"
-      sx={{
-        // Workaround to make the border transitions smmothly on button groups
-        "& > button:hover + button": {
-          borderLeft: "1px solid #FFF",
-        },
-      }}
-    >
-      <LoadingButton
-        loading={loading}
-        loadingIndicator="Restarting..."
-        loadingPosition="start"
-        startIcon={<ReplayIcon />}
-        onClick={() => handleAction()}
-        data-testid="workspace-restart-button"
-      >
-        Restart
-      </LoadingButton>
-      <BuildParametersPopover
-        workspace={workspace}
-        disabled={loading}
-        onSubmit={handleAction}
-      />
-    </ButtonGroup>
-  )
-}
-
-export const CancelButton: FC<WorkspaceAction> = ({ handleAction }) => {
-  return (
-    <Button startIcon={<BlockIcon />} onClick={handleAction}>
-      Cancel
-    </Button>
-  )
-}
-
-interface DisabledProps {
-  label: string
-}
-
-export const DisabledButton: FC<DisabledProps> = ({ label }) => {
-  return (
-    <Button startIcon={<BlockOutlined />} disabled>
-      {label}
-    </Button>
-  )
-}
-
-interface LoadingProps {
-  label: string
-}
-
-export const ActionLoadingButton: FC<LoadingProps> = ({ label }) => {
-  return (
-    <LoadingButton
-      loading
-      loadingPosition="start"
-      loadingIndicator={label}
-      // This icon can be anything
-      startIcon={<ReplayIcon />}
-    />
-  )
-}
diff --git a/site/src/components/WorkspaceActions/WorkspaceActions.stories.tsx b/site/src/components/WorkspaceActions/WorkspaceActions.stories.tsx
deleted file mode 100644
index 3697a20a4d453..0000000000000
--- a/site/src/components/WorkspaceActions/WorkspaceActions.stories.tsx
+++ /dev/null
@@ -1,91 +0,0 @@
-import { action } from "@storybook/addon-actions"
-import { Story } from "@storybook/react"
-import * as Mocks from "../../testHelpers/entities"
-import { WorkspaceActions, WorkspaceActionsProps } from "./WorkspaceActions"
-
-export default {
-  title: "components/WorkspaceActions",
-  component: WorkspaceActions,
-}
-
-const Template: Story<WorkspaceActionsProps> = (args) => (
-  <WorkspaceActions {...args} />
-)
-
-const defaultArgs = {
-  handleStart: action("start"),
-  handleStop: action("stop"),
-  handleRestart: action("restart"),
-  handleDelete: action("delete"),
-  handleUpdate: action("update"),
-  handleCancel: action("cancel"),
-  isOutdated: false,
-  isUpdating: false,
-}
-
-export const Starting = Template.bind({})
-Starting.args = {
-  ...defaultArgs,
-  workspace: Mocks.MockStartingWorkspace,
-}
-
-export const Running = Template.bind({})
-Running.args = {
-  ...defaultArgs,
-  workspace: Mocks.MockWorkspace,
-}
-
-export const Stopping = Template.bind({})
-Stopping.args = {
-  ...defaultArgs,
-  workspace: Mocks.MockStoppingWorkspace,
-}
-
-export const Stopped = Template.bind({})
-Stopped.args = {
-  ...defaultArgs,
-  workspace: Mocks.MockStoppedWorkspace,
-}
-
-export const Canceling = Template.bind({})
-Canceling.args = {
-  ...defaultArgs,
-  workspace: Mocks.MockCancelingWorkspace,
-}
-
-export const Canceled = Template.bind({})
-Canceled.args = {
-  ...defaultArgs,
-  workspace: Mocks.MockCanceledWorkspace,
-}
-
-export const Deleting = Template.bind({})
-Deleting.args = {
-  ...defaultArgs,
-  workspace: Mocks.MockDeletingWorkspace,
-}
-
-export const Deleted = Template.bind({})
-Deleted.args = {
-  ...defaultArgs,
-  workspace: Mocks.MockDeletedWorkspace,
-}
-
-export const Outdated = Template.bind({})
-Outdated.args = {
-  ...defaultArgs,
-  workspace: Mocks.MockOutdatedWorkspace,
-}
-
-export const Failed = Template.bind({})
-Failed.args = {
-  ...defaultArgs,
-  workspace: Mocks.MockFailedWorkspace,
-}
-
-export const Updating = Template.bind({})
-Updating.args = {
-  ...defaultArgs,
-  isUpdating: true,
-  workspace: Mocks.MockOutdatedWorkspace,
-}
diff --git a/site/src/components/WorkspaceActions/WorkspaceActions.tsx b/site/src/components/WorkspaceActions/WorkspaceActions.tsx
deleted file mode 100644
index 8242b470c8c67..0000000000000
--- a/site/src/components/WorkspaceActions/WorkspaceActions.tsx
+++ /dev/null
@@ -1,161 +0,0 @@
-import MenuItem from "@mui/material/MenuItem"
-import Menu from "@mui/material/Menu"
-import { makeStyles } from "@mui/styles"
-import MoreVertOutlined from "@mui/icons-material/MoreVertOutlined"
-import { FC, Fragment, ReactNode, useRef, useState } from "react"
-import { Workspace, WorkspaceBuildParameter } from "api/typesGenerated"
-import {
-  ActionLoadingButton,
-  CancelButton,
-  DisabledButton,
-  StartButton,
-  StopButton,
-  RestartButton,
-  UpdateButton,
-} from "./Buttons"
-import {
-  ButtonMapping,
-  ButtonTypesEnum,
-  actionsByWorkspaceStatus,
-} from "./constants"
-import SettingsOutlined from "@mui/icons-material/SettingsOutlined"
-import HistoryOutlined from "@mui/icons-material/HistoryOutlined"
-import DeleteOutlined from "@mui/icons-material/DeleteOutlined"
-import IconButton from "@mui/material/IconButton"
-
-export interface WorkspaceActionsProps {
-  workspace: Workspace
-  handleStart: (buildParameters?: WorkspaceBuildParameter[]) => void
-  handleStop: () => void
-  handleRestart: (buildParameters?: WorkspaceBuildParameter[]) => void
-  handleDelete: () => void
-  handleUpdate: () => void
-  handleCancel: () => void
-  handleSettings: () => void
-  handleChangeVersion: () => void
-  isUpdating: boolean
-  isRestarting: boolean
-  children?: ReactNode
-  canChangeVersions: boolean
-}
-
-export const WorkspaceActions: FC<WorkspaceActionsProps> = ({
-  workspace,
-  handleStart,
-  handleStop,
-  handleRestart,
-  handleDelete,
-  handleUpdate,
-  handleCancel,
-  handleSettings,
-  handleChangeVersion,
-  isUpdating,
-  isRestarting,
-  canChangeVersions,
-}) => {
-  const styles = useStyles()
-  const {
-    canCancel,
-    canAcceptJobs,
-    actions: actionsByStatus,
-  } = actionsByWorkspaceStatus(workspace.latest_build.status)
-  const canBeUpdated = workspace.outdated && canAcceptJobs
-  const menuTriggerRef = useRef<HTMLButtonElement>(null)
-  const [isMenuOpen, setIsMenuOpen] = useState(false)
-
-  // A mapping of button type to the corresponding React component
-  const buttonMapping: ButtonMapping = {
-    [ButtonTypesEnum.update]: <UpdateButton handleAction={handleUpdate} />,
-    [ButtonTypesEnum.updating]: (
-      <UpdateButton loading handleAction={handleUpdate} />
-    ),
-    [ButtonTypesEnum.start]: (
-      <StartButton workspace={workspace} handleAction={handleStart} />
-    ),
-    [ButtonTypesEnum.starting]: (
-      <StartButton loading workspace={workspace} handleAction={handleStart} />
-    ),
-    [ButtonTypesEnum.stop]: <StopButton handleAction={handleStop} />,
-    [ButtonTypesEnum.stopping]: (
-      <StopButton loading handleAction={handleStop} />
-    ),
-    [ButtonTypesEnum.restart]: (
-      <RestartButton workspace={workspace} handleAction={handleRestart} />
-    ),
-    [ButtonTypesEnum.restarting]: (
-      <RestartButton
-        loading
-        workspace={workspace}
-        handleAction={handleRestart}
-      />
-    ),
-    [ButtonTypesEnum.deleting]: <ActionLoadingButton label="Deleting" />,
-    [ButtonTypesEnum.canceling]: <DisabledButton label="Canceling..." />,
-    [ButtonTypesEnum.deleted]: <DisabledButton label="Deleted" />,
-    [ButtonTypesEnum.pending]: <ActionLoadingButton label="Pending..." />,
-  }
-
-  // Returns a function that will execute the action and close the menu
-  const onMenuItemClick = (actionFn: () => void) => () => {
-    setIsMenuOpen(false)
-    actionFn()
-  }
-
-  return (
-    <div className={styles.actions} data-testid="workspace-actions">
-      {canBeUpdated &&
-        (isUpdating
-          ? buttonMapping[ButtonTypesEnum.updating]
-          : buttonMapping[ButtonTypesEnum.update])}
-      {isRestarting && buttonMapping[ButtonTypesEnum.restarting]}
-      {!isRestarting &&
-        actionsByStatus.map((action) => (
-          <Fragment key={action}>{buttonMapping[action]}</Fragment>
-        ))}
-      {canCancel && <CancelButton handleAction={handleCancel} />}
-      <div>
-        <IconButton
-          title="More options"
-          size="small"
-          data-testid="workspace-options-button"
-          aria-controls="workspace-options"
-          aria-haspopup="true"
-          disabled={!canAcceptJobs}
-          ref={menuTriggerRef}
-          onClick={() => setIsMenuOpen(true)}
-        >
-          <MoreVertOutlined />
-        </IconButton>
-        <Menu
-          id="workspace-options"
-          anchorEl={menuTriggerRef.current}
-          open={isMenuOpen}
-          onClose={() => setIsMenuOpen(false)}
-        >
-          <MenuItem onClick={onMenuItemClick(handleSettings)}>
-            <SettingsOutlined />
-            Settings
-          </MenuItem>
-          {canChangeVersions && (
-            <MenuItem onClick={onMenuItemClick(handleChangeVersion)}>
-              <HistoryOutlined />
-              Change version
-            </MenuItem>
-          )}
-          <MenuItem onClick={onMenuItemClick(handleDelete)}>
-            <DeleteOutlined />
-            Delete
-          </MenuItem>
-        </Menu>
-      </div>
-    </div>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  actions: {
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(1.5),
-  },
-}))
diff --git a/site/src/components/WorkspaceActions/constants.ts b/site/src/components/WorkspaceActions/constants.ts
deleted file mode 100644
index c4e81ca976ca5..0000000000000
--- a/site/src/components/WorkspaceActions/constants.ts
+++ /dev/null
@@ -1,92 +0,0 @@
-import { WorkspaceStatus } from "api/typesGenerated"
-import { ReactNode } from "react"
-
-// the button types we have
-export enum ButtonTypesEnum {
-  start = "start",
-  starting = "starting",
-  stop = "stop",
-  stopping = "stopping",
-  restart = "restart",
-  restarting = "restarting",
-  deleting = "deleting",
-  update = "update",
-  updating = "updating",
-  // disabled buttons
-  canceling = "canceling",
-  deleted = "deleted",
-  pending = "pending",
-}
-
-export type ButtonMapping = {
-  [key in ButtonTypesEnum]: ReactNode
-}
-
-interface WorkspaceAbilities {
-  actions: ButtonTypesEnum[]
-  canCancel: boolean
-  canAcceptJobs: boolean
-}
-
-export const actionsByWorkspaceStatus = (
-  status: WorkspaceStatus,
-): WorkspaceAbilities => {
-  return statusToActions[status]
-}
-
-const statusToActions: Record<WorkspaceStatus, WorkspaceAbilities> = {
-  starting: {
-    actions: [ButtonTypesEnum.starting],
-    canCancel: true,
-    canAcceptJobs: false,
-  },
-  running: {
-    actions: [ButtonTypesEnum.stop, ButtonTypesEnum.restart],
-    canCancel: false,
-    canAcceptJobs: true,
-  },
-  stopping: {
-    actions: [ButtonTypesEnum.stopping],
-    canCancel: true,
-    canAcceptJobs: false,
-  },
-  stopped: {
-    actions: [ButtonTypesEnum.start],
-    canCancel: false,
-    canAcceptJobs: true,
-  },
-  canceled: {
-    actions: [ButtonTypesEnum.start, ButtonTypesEnum.stop],
-    canCancel: false,
-    canAcceptJobs: true,
-  },
-  // in the case of an error
-  failed: {
-    actions: [ButtonTypesEnum.start, ButtonTypesEnum.stop],
-    canCancel: false,
-    canAcceptJobs: true,
-  },
-  /**
-   * disabled states
-   */
-  canceling: {
-    actions: [ButtonTypesEnum.canceling],
-    canCancel: false,
-    canAcceptJobs: false,
-  },
-  deleting: {
-    actions: [ButtonTypesEnum.deleting],
-    canCancel: true,
-    canAcceptJobs: false,
-  },
-  deleted: {
-    actions: [ButtonTypesEnum.deleted],
-    canCancel: false,
-    canAcceptJobs: false,
-  },
-  pending: {
-    actions: [ButtonTypesEnum.pending],
-    canCancel: false,
-    canAcceptJobs: false,
-  },
-}
diff --git a/site/src/components/WorkspaceBuildLogs/Logs.tsx b/site/src/components/WorkspaceBuildLogs/Logs.tsx
new file mode 100644
index 0000000000000..7b61183b79726
--- /dev/null
+++ b/site/src/components/WorkspaceBuildLogs/Logs.tsx
@@ -0,0 +1,162 @@
+import { makeStyles } from "@mui/styles";
+import { LogLevel } from "api/typesGenerated";
+import dayjs from "dayjs";
+import { FC, useMemo } from "react";
+import { MONOSPACE_FONT_FAMILY } from "theme/constants";
+import { combineClasses } from "utils/combineClasses";
+import AnsiToHTML from "ansi-to-html";
+
+export interface Line {
+  time: string;
+  output: string;
+  level: LogLevel;
+  source_id: string;
+}
+
+export interface LogsProps {
+  lines: Line[];
+  hideTimestamps?: boolean;
+  className?: string;
+}
+
+export const Logs: FC<React.PropsWithChildren<LogsProps>> = ({
+  hideTimestamps,
+  lines,
+  className = "",
+}) => {
+  const styles = useStyles();
+
+  return (
+    <div className={combineClasses([className, styles.root])}>
+      <div className={styles.scrollWrapper}>
+        {lines.map((line, idx) => (
+          <div className={combineClasses([styles.line, line.level])} key={idx}>
+            {!hideTimestamps && (
+              <>
+                <span className={styles.time}>
+                  {dayjs(line.time).format(`HH:mm:ss.SSS`)}
+                </span>
+                <span className={styles.space} />
+              </>
+            )}
+            <span>{line.output}</span>
+          </div>
+        ))}
+      </div>
+    </div>
+  );
+};
+
+export const logLineHeight = 20;
+
+const convert = new AnsiToHTML();
+
+export const LogLine: FC<{
+  line: Line;
+  hideTimestamp?: boolean;
+  number?: number;
+  style?: React.CSSProperties;
+  sourceIcon?: JSX.Element;
+  maxNumber?: number;
+}> = ({ line, hideTimestamp, number, maxNumber, sourceIcon, style }) => {
+  const styles = useStyles();
+  const output = useMemo(() => {
+    return convert.toHtml(line.output.split(/\r/g).pop() as string);
+  }, [line.output]);
+  const isUsingLineNumber = number !== undefined;
+
+  return (
+    <div
+      className={combineClasses([
+        styles.line,
+        line.level,
+        isUsingLineNumber && styles.lineNumber,
+      ])}
+      style={style}
+    >
+      {sourceIcon}
+      {!hideTimestamp && (
+        <>
+          <span
+            className={combineClasses([
+              styles.time,
+              isUsingLineNumber && styles.number,
+            ])}
+            style={{
+              minWidth: `${maxNumber ? maxNumber.toString().length - 1 : 0}em`,
+            }}
+          >
+            {number ? number : dayjs(line.time).format(`HH:mm:ss.SSS`)}
+          </span>
+          <span className={styles.space} />
+        </>
+      )}
+      <span
+        dangerouslySetInnerHTML={{
+          __html: output,
+        }}
+      />
+    </div>
+  );
+};
+
+const useStyles = makeStyles((theme) => ({
+  root: {
+    minHeight: 156,
+    padding: theme.spacing(1, 0),
+    borderRadius: theme.shape.borderRadius,
+    overflowX: "auto",
+    background: theme.palette.background.default,
+
+    "&:not(:last-child)": {
+      borderBottom: `1px solid ${theme.palette.divider}`,
+      borderRadius: 0,
+    },
+  },
+  scrollWrapper: {
+    minWidth: "fit-content",
+  },
+  line: {
+    wordBreak: "break-all",
+    display: "flex",
+    alignItems: "center",
+    fontSize: 14,
+    color: theme.palette.text.primary,
+    fontFamily: MONOSPACE_FONT_FAMILY,
+    height: "auto",
+    // Whitespace is significant in terminal output for alignment
+    whiteSpace: "pre",
+    padding: theme.spacing(0, 4),
+
+    "&.error": {
+      backgroundColor: theme.palette.error.dark,
+    },
+
+    "&.debug": {
+      backgroundColor: theme.palette.background.paperLight,
+    },
+
+    "&.warn": {
+      backgroundColor: theme.palette.warning.dark,
+    },
+  },
+  lineNumber: {
+    paddingLeft: theme.spacing(2),
+  },
+  space: {
+    userSelect: "none",
+    width: theme.spacing(3),
+    display: "block",
+    flexShrink: 0,
+  },
+  time: {
+    userSelect: "none",
+    whiteSpace: "pre",
+    display: "inline-block",
+    color: theme.palette.text.secondary,
+  },
+  number: {
+    width: theme.spacing(4),
+    textAlign: "right",
+  },
+}));
diff --git a/site/src/components/WorkspaceBuildLogs/WorkspaceBuildLogs.stories.tsx b/site/src/components/WorkspaceBuildLogs/WorkspaceBuildLogs.stories.tsx
index 5060f5910216d..5044a9c4e07bd 100644
--- a/site/src/components/WorkspaceBuildLogs/WorkspaceBuildLogs.stories.tsx
+++ b/site/src/components/WorkspaceBuildLogs/WorkspaceBuildLogs.stories.tsx
@@ -1,24 +1,24 @@
-import { Meta, StoryObj } from "@storybook/react"
-import { WorkspaceBuildLogs } from "./WorkspaceBuildLogs"
-import { MockWorkspaceBuildLogs } from "testHelpers/entities"
+import { Meta, StoryObj } from "@storybook/react";
+import { WorkspaceBuildLogs } from "./WorkspaceBuildLogs";
+import { MockWorkspaceBuildLogs } from "testHelpers/entities";
 
 const meta: Meta<typeof WorkspaceBuildLogs> = {
   title: "components/WorkspaceBuildLogs",
   component: WorkspaceBuildLogs,
-}
+};
 
-export default meta
+export default meta;
 
-type Story = StoryObj<typeof WorkspaceBuildLogs>
+type Story = StoryObj<typeof WorkspaceBuildLogs>;
 
 export const InProgress: Story = {
   args: {
     logs: MockWorkspaceBuildLogs.slice(0, 20),
   },
-}
+};
 
 export const Completed: Story = {
   args: {
     logs: MockWorkspaceBuildLogs,
   },
-}
+};
diff --git a/site/src/components/WorkspaceBuildLogs/WorkspaceBuildLogs.test.ts b/site/src/components/WorkspaceBuildLogs/WorkspaceBuildLogs.test.ts
deleted file mode 100644
index e9fc6aed079c1..0000000000000
--- a/site/src/components/WorkspaceBuildLogs/WorkspaceBuildLogs.test.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import { ProvisionerJobLog } from "api/typesGenerated"
-import { groupLogsByStage } from "./WorkspaceBuildLogs"
-
-describe("groupLogsByStage", () => {
-  it("should group them by stage", () => {
-    const input: ProvisionerJobLog[] = [
-      {
-        id: 1,
-        created_at: "oct 13",
-        log_source: "provisioner",
-        log_level: "debug",
-        stage: "build",
-        output: "test",
-      },
-      {
-        id: 2,
-        created_at: "oct 13",
-        log_source: "provisioner",
-        log_level: "debug",
-        stage: "cleanup",
-        output: "test",
-      },
-      {
-        id: 3,
-        created_at: "oct 13",
-        log_source: "provisioner",
-        log_level: "debug",
-        stage: "cleanup",
-        output: "done",
-      },
-    ]
-
-    const actual = groupLogsByStage(input)
-
-    expect(actual["cleanup"].length).toBe(2)
-  })
-})
diff --git a/site/src/components/WorkspaceBuildLogs/WorkspaceBuildLogs.tsx b/site/src/components/WorkspaceBuildLogs/WorkspaceBuildLogs.tsx
index e0682ce907c5c..e1fa8463f7602 100644
--- a/site/src/components/WorkspaceBuildLogs/WorkspaceBuildLogs.tsx
+++ b/site/src/components/WorkspaceBuildLogs/WorkspaceBuildLogs.tsx
@@ -1,49 +1,49 @@
-import { makeStyles } from "@mui/styles"
-import dayjs from "dayjs"
-import { ComponentProps, FC, Fragment } from "react"
-import { ProvisionerJobLog } from "../../api/typesGenerated"
-import { MONOSPACE_FONT_FAMILY } from "../../theme/constants"
-import { Logs } from "../Logs/Logs"
-import Box from "@mui/material/Box"
-import { combineClasses } from "utils/combineClasses"
+import { makeStyles } from "@mui/styles";
+import dayjs from "dayjs";
+import { ComponentProps, FC, Fragment } from "react";
+import { ProvisionerJobLog } from "api/typesGenerated";
+import { MONOSPACE_FONT_FAMILY } from "theme/constants";
+import { Logs } from "./Logs";
+import Box from "@mui/material/Box";
+import { combineClasses } from "utils/combineClasses";
 
 const Language = {
   seconds: "seconds",
-}
+};
 
-type Stage = ProvisionerJobLog["stage"]
-type LogsGroupedByStage = Record<Stage, ProvisionerJobLog[]>
-type GroupLogsByStageFn = (logs: ProvisionerJobLog[]) => LogsGroupedByStage
+type Stage = ProvisionerJobLog["stage"];
+type LogsGroupedByStage = Record<Stage, ProvisionerJobLog[]>;
+type GroupLogsByStageFn = (logs: ProvisionerJobLog[]) => LogsGroupedByStage;
 
 export const groupLogsByStage: GroupLogsByStageFn = (logs) => {
-  const logsByStage: LogsGroupedByStage = {}
+  const logsByStage: LogsGroupedByStage = {};
 
   for (const log of logs) {
     if (log.stage in logsByStage) {
-      logsByStage[log.stage].push(log)
+      logsByStage[log.stage].push(log);
     } else {
-      logsByStage[log.stage] = [log]
+      logsByStage[log.stage] = [log];
     }
   }
 
-  return logsByStage
-}
+  return logsByStage;
+};
 
 const getStageDurationInSeconds = (logs: ProvisionerJobLog[]) => {
   if (logs.length < 2) {
-    return
+    return;
   }
 
-  const startedAt = dayjs(logs[0].created_at)
-  const completedAt = dayjs(logs[logs.length - 1].created_at)
-  return completedAt.diff(startedAt, "seconds")
-}
+  const startedAt = dayjs(logs[0].created_at);
+  const completedAt = dayjs(logs[logs.length - 1].created_at);
+  return completedAt.diff(startedAt, "seconds");
+};
 
 export type WorkspaceBuildLogsProps = {
-  logs: ProvisionerJobLog[]
-  sticky?: boolean
-  hideTimestamps?: boolean
-} & ComponentProps<typeof Box>
+  logs: ProvisionerJobLog[];
+  sticky?: boolean;
+  hideTimestamps?: boolean;
+} & ComponentProps<typeof Box>;
 
 export const WorkspaceBuildLogs: FC<WorkspaceBuildLogsProps> = ({
   hideTimestamps,
@@ -51,9 +51,9 @@ export const WorkspaceBuildLogs: FC<WorkspaceBuildLogsProps> = ({
   logs,
   ...boxProps
 }) => {
-  const groupedLogsByStage = groupLogsByStage(logs)
-  const stages = Object.keys(groupedLogsByStage)
-  const styles = useStyles()
+  const groupedLogsByStage = groupLogsByStage(logs);
+  const stages = Object.keys(groupedLogsByStage);
+  const styles = useStyles();
 
   return (
     <Box
@@ -66,15 +66,16 @@ export const WorkspaceBuildLogs: FC<WorkspaceBuildLogsProps> = ({
       }}
     >
       {stages.map((stage) => {
-        const logs = groupedLogsByStage[stage]
-        const isEmpty = logs.every((log) => log.output === "")
+        const logs = groupedLogsByStage[stage];
+        const isEmpty = logs.every((log) => log.output === "");
         const lines = logs.map((log) => ({
           time: log.created_at,
           output: log.output,
           level: log.log_level,
-        }))
-        const duration = getStageDurationInSeconds(logs)
-        const shouldDisplayDuration = duration !== undefined
+          source_id: log.log_source,
+        }));
+        const duration = getStageDurationInSeconds(logs);
+        const shouldDisplayDuration = duration !== undefined;
 
         return (
           <Fragment key={stage}>
@@ -93,11 +94,11 @@ export const WorkspaceBuildLogs: FC<WorkspaceBuildLogsProps> = ({
             </div>
             {!isEmpty && <Logs hideTimestamps={hideTimestamps} lines={lines} />}
           </Fragment>
-        )
+        );
       })}
     </Box>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   header: {
@@ -130,4 +131,4 @@ const useStyles = makeStyles((theme) => ({
     color: theme.palette.text.secondary,
     fontSize: 12,
   },
-}))
+}));
diff --git a/site/src/components/WorkspaceBuildProgress/WorkspaceBuildProgress.stories.tsx b/site/src/components/WorkspaceBuildProgress/WorkspaceBuildProgress.stories.tsx
deleted file mode 100644
index 7d74acb452d58..0000000000000
--- a/site/src/components/WorkspaceBuildProgress/WorkspaceBuildProgress.stories.tsx
+++ /dev/null
@@ -1,75 +0,0 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import dayjs from "dayjs"
-import {
-  MockStartingWorkspace,
-  MockWorkspaceBuild,
-  MockProvisionerJob,
-} from "testHelpers/entities"
-import {
-  WorkspaceBuildProgress,
-  WorkspaceBuildProgressProps,
-} from "./WorkspaceBuildProgress"
-
-export default {
-  title: "components/WorkspaceBuildProgress",
-  component: WorkspaceBuildProgress,
-} as ComponentMeta<typeof WorkspaceBuildProgress>
-
-const Template: Story<WorkspaceBuildProgressProps> = (args) => (
-  <WorkspaceBuildProgress {...args} />
-)
-
-export const Starting = Template.bind({})
-Starting.args = {
-  transitionStats: {
-    P50: 10000,
-    P95: 10010,
-  },
-  workspace: {
-    ...MockStartingWorkspace,
-    latest_build: {
-      ...MockWorkspaceBuild,
-      status: "starting",
-      job: {
-        ...MockProvisionerJob,
-        started_at: dayjs().add(-5, "second").format(),
-        status: "running",
-      },
-    },
-  },
-}
-
-// When the transition stats are returning null, the progress bar should not be
-// displayed
-export const StartingUnknown = Template.bind({})
-StartingUnknown.args = {
-  ...Starting.args,
-  transitionStats: {
-    // HACK: the codersdk type generator doesn't support null values, but this
-    // can be null when the template is new.
-    // eslint-disable-next-line @typescript-eslint/ban-ts-comment -- Read comment above
-    // @ts-ignore-error
-    P50: null,
-    // eslint-disable-next-line @typescript-eslint/ban-ts-comment -- Read comment above
-    // @ts-ignore-error
-    P95: null,
-  },
-}
-
-export const StartingPassedEstimate = Template.bind({})
-StartingPassedEstimate.args = {
-  ...Starting.args,
-  transitionStats: { P50: 1000, P95: 1000 },
-}
-
-export const StartingHighVariaton = Template.bind({})
-StartingHighVariaton.args = {
-  ...Starting.args,
-  transitionStats: { P50: 10000, P95: 20000 },
-}
-
-export const StartingZeroEstimate = Template.bind({})
-StartingZeroEstimate.args = {
-  ...Starting.args,
-  transitionStats: { P50: 0, P95: 0 },
-}
diff --git a/site/src/components/WorkspaceBuildStats/WorkspaceBuildStats.stories.tsx b/site/src/components/WorkspaceBuildStats/WorkspaceBuildStats.stories.tsx
deleted file mode 100644
index 2bd93dc11f943..0000000000000
--- a/site/src/components/WorkspaceBuildStats/WorkspaceBuildStats.stories.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { MockWorkspaceBuild } from "../../testHelpers/entities"
-import {
-  WorkspaceBuildStats,
-  WorkspaceBuildStatsProps,
-} from "./WorkspaceBuildStats"
-
-export default {
-  title: "components/WorkspaceBuildStats",
-  component: WorkspaceBuildStats,
-} as ComponentMeta<typeof WorkspaceBuildStats>
-
-const Template: Story<WorkspaceBuildStatsProps> = (args) => (
-  <WorkspaceBuildStats {...args} />
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  build: MockWorkspaceBuild,
-}
-
-export const Autostart = Template.bind({})
-Autostart.args = {
-  build: {
-    ...MockWorkspaceBuild,
-    reason: "autostart",
-  },
-}
-
-export const Autostop = Template.bind({})
-Autostop.args = {
-  build: {
-    ...MockWorkspaceBuild,
-    transition: "stop",
-    reason: "autostop",
-  },
-}
diff --git a/site/src/components/WorkspaceBuildStats/WorkspaceBuildStats.tsx b/site/src/components/WorkspaceBuildStats/WorkspaceBuildStats.tsx
deleted file mode 100644
index e6500b233ee73..0000000000000
--- a/site/src/components/WorkspaceBuildStats/WorkspaceBuildStats.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-import { Stats, StatsItem } from "components/Stats/Stats"
-import { FC } from "react"
-import { useTranslation } from "react-i18next"
-import { Link } from "react-router-dom"
-import { WorkspaceBuild } from "../../api/typesGenerated"
-import { displayWorkspaceBuildDuration } from "../../utils/workspace"
-
-export interface WorkspaceBuildStatsProps {
-  build: WorkspaceBuild
-}
-
-export const WorkspaceBuildStats: FC<WorkspaceBuildStatsProps> = ({
-  build,
-}) => {
-  const { t } = useTranslation("buildPage")
-
-  return (
-    <Stats>
-      <StatsItem
-        label={t("stats.workspace")}
-        value={
-          <Link to={`/@${build.workspace_owner_name}/${build.workspace_name}`}>
-            {build.workspace_name}
-          </Link>
-        }
-      />
-      <StatsItem
-        label={t("stats.duration")}
-        value={displayWorkspaceBuildDuration(build)}
-      />
-      <StatsItem
-        label={t("stats.startedAt")}
-        value={new Date(build.created_at).toLocaleString()}
-      />
-      <StatsItem label={t("stats.action")} value={build.transition} />
-    </Stats>
-  )
-}
diff --git a/site/src/components/WorkspaceDeletedBanner/WorkspaceDeletedBanner.stories.tsx b/site/src/components/WorkspaceDeletedBanner/WorkspaceDeletedBanner.stories.tsx
deleted file mode 100644
index fde4f1d3097a3..0000000000000
--- a/site/src/components/WorkspaceDeletedBanner/WorkspaceDeletedBanner.stories.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-import { action } from "@storybook/addon-actions"
-import { Story } from "@storybook/react"
-import {
-  WorkspaceDeletedBanner,
-  WorkspaceDeletedBannerProps,
-} from "./WorkspaceDeletedBanner"
-
-export default {
-  title: "components/WorkspaceDeletedBanner",
-  component: WorkspaceDeletedBanner,
-}
-
-const Template: Story<WorkspaceDeletedBannerProps> = (args) => (
-  <WorkspaceDeletedBanner {...args} />
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  handleClick: action("extend"),
-}
diff --git a/site/src/components/WorkspaceDeletedBanner/WorkspaceDeletedBanner.tsx b/site/src/components/WorkspaceDeletedBanner/WorkspaceDeletedBanner.tsx
deleted file mode 100644
index 1ab764b741896..0000000000000
--- a/site/src/components/WorkspaceDeletedBanner/WorkspaceDeletedBanner.tsx
+++ /dev/null
@@ -1,26 +0,0 @@
-import Button from "@mui/material/Button"
-import { FC } from "react"
-import { Alert } from "components/Alert/Alert"
-import { useTranslation } from "react-i18next"
-
-export interface WorkspaceDeletedBannerProps {
-  handleClick: () => void
-}
-
-export const WorkspaceDeletedBanner: FC<
-  React.PropsWithChildren<WorkspaceDeletedBannerProps>
-> = ({ handleClick }) => {
-  const { t } = useTranslation("workspacePage")
-
-  const NewWorkspaceButton = (
-    <Button onClick={handleClick} size="small" variant="text">
-      {t("ctas.createWorkspaceCta")}
-    </Button>
-  )
-
-  return (
-    <Alert severity="warning" actions={NewWorkspaceButton}>
-      {t("warningsAndErrors.workspaceDeletedWarning")}
-    </Alert>
-  )
-}
diff --git a/site/src/components/WorkspaceDeletion/DormantDeletionStat.tsx b/site/src/components/WorkspaceDeletion/DormantDeletionStat.tsx
new file mode 100644
index 0000000000000..8dc7a289d21f9
--- /dev/null
+++ b/site/src/components/WorkspaceDeletion/DormantDeletionStat.tsx
@@ -0,0 +1,63 @@
+import { StatsItem } from "components/Stats/Stats";
+import Link from "@mui/material/Link";
+import { Link as RouterLink } from "react-router-dom";
+import styled from "@emotion/styled";
+import { Workspace } from "api/typesGenerated";
+import { displayDormantDeletion } from "./utils";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { type FC } from "react";
+
+interface DormantDeletionStatProps {
+  workspace: Workspace;
+}
+
+export const DormantDeletionStat: FC<DormantDeletionStatProps> = ({
+  workspace,
+}) => {
+  const { entitlements, experiments } = useDashboard();
+  const allowAdvancedScheduling =
+    entitlements.features["advanced_template_scheduling"].enabled;
+  // This check can be removed when https://github.com/coder/coder/milestone/19
+  // is merged up
+  const allowWorkspaceActions = experiments.includes("workspace_actions");
+
+  if (
+    !displayDormantDeletion(
+      workspace,
+      allowAdvancedScheduling,
+      allowWorkspaceActions,
+    )
+  ) {
+    return null;
+  }
+
+  return (
+    <StyledStatsItem
+      label="Deletion on"
+      className="containerClass"
+      value={
+        <Link
+          component={RouterLink}
+          to={`/templates/${workspace.template_name}/settings/schedule`}
+          title="Schedule settings"
+        >
+          {/* We check for string existence in the conditional */}
+          {new Date(workspace.deleting_at!).toLocaleString()}
+        </Link>
+      }
+    />
+  );
+};
+
+const StyledStatsItem = styled(StatsItem)(() => ({
+  "&.containerClass": {
+    flexDirection: "column",
+    gap: 0,
+    padding: 0,
+
+    "& > span:first-of-type": {
+      fontSize: 12,
+      fontWeight: 500,
+    },
+  },
+}));
diff --git a/site/src/components/WorkspaceDeletion/DormantDeletionText.tsx b/site/src/components/WorkspaceDeletion/DormantDeletionText.tsx
new file mode 100644
index 0000000000000..0d1b8692674fa
--- /dev/null
+++ b/site/src/components/WorkspaceDeletion/DormantDeletionText.tsx
@@ -0,0 +1,34 @@
+import { Workspace } from "api/typesGenerated";
+import { displayDormantDeletion } from "./utils";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import styled from "@emotion/styled";
+import { Theme as MaterialUITheme } from "@mui/material/styles";
+
+export const DormantDeletionText = ({
+  workspace,
+}: {
+  workspace: Workspace;
+}): JSX.Element | null => {
+  const { entitlements, experiments } = useDashboard();
+  const allowAdvancedScheduling =
+    entitlements.features["advanced_template_scheduling"].enabled;
+  // This check can be removed when https://github.com/coder/coder/milestone/19
+  // is merged up
+  const allowWorkspaceActions = experiments.includes("workspace_actions");
+
+  if (
+    !displayDormantDeletion(
+      workspace,
+      allowAdvancedScheduling,
+      allowWorkspaceActions,
+    )
+  ) {
+    return null;
+  }
+  return <StyledSpan role="status">Impending deletion</StyledSpan>;
+};
+
+const StyledSpan = styled.span<{ theme?: MaterialUITheme }>`
+  color: ${(props) => props.theme.palette.warning.light};
+  font-weight: 600;
+`;
diff --git a/site/src/components/WorkspaceDeletion/DormantWorkspaceBanner.tsx b/site/src/components/WorkspaceDeletion/DormantWorkspaceBanner.tsx
new file mode 100644
index 0000000000000..66bfc989ae89a
--- /dev/null
+++ b/site/src/components/WorkspaceDeletion/DormantWorkspaceBanner.tsx
@@ -0,0 +1,98 @@
+import { Workspace } from "api/typesGenerated";
+import { useIsWorkspaceActionsEnabled } from "components/Dashboard/DashboardProvider";
+import { Alert } from "components/Alert/Alert";
+import { formatDistanceToNow } from "date-fns";
+import Link from "@mui/material/Link";
+import { Link as RouterLink } from "react-router-dom";
+
+export enum Count {
+  Singular,
+  Multiple,
+}
+
+export const DormantWorkspaceBanner = ({
+  workspaces,
+  onDismiss,
+  shouldRedisplayBanner,
+  count = Count.Singular,
+}: {
+  workspaces?: Workspace[];
+  onDismiss: () => void;
+  shouldRedisplayBanner: boolean;
+  count?: Count;
+}): JSX.Element | null => {
+  const experimentEnabled = useIsWorkspaceActionsEnabled();
+
+  if (!workspaces) {
+    return null;
+  }
+
+  const hasDormantWorkspaces = workspaces.find(
+    (workspace) => workspace.dormant_at,
+  );
+
+  const hasDeletionScheduledWorkspaces = workspaces.find(
+    (workspace) => workspace.deleting_at,
+  );
+
+  if (
+    // Only show this if the experiment is included.
+    !experimentEnabled ||
+    !hasDormantWorkspaces ||
+    // Banners should be redisplayed after dismissal when additional workspaces are newly scheduled for deletion
+    !shouldRedisplayBanner
+  ) {
+    return null;
+  }
+
+  const formatDate = (dateStr: string): string => {
+    const date = new Date(dateStr);
+    return date.toLocaleDateString(undefined, {
+      month: "long",
+      day: "numeric",
+      year: "numeric",
+    });
+  };
+
+  const alertText = (): string => {
+    if (workspaces.length === 1) {
+      if (
+        hasDeletionScheduledWorkspaces &&
+        hasDeletionScheduledWorkspaces.deleting_at &&
+        hasDeletionScheduledWorkspaces.dormant_at
+      ) {
+        return `This workspace has been dormant for ${formatDistanceToNow(
+          Date.parse(hasDeletionScheduledWorkspaces.dormant_at),
+        )} and is scheduled to be deleted on ${formatDate(
+          hasDeletionScheduledWorkspaces.deleting_at,
+        )} . To keep it you must activate the workspace.`;
+      } else if (hasDormantWorkspaces && hasDormantWorkspaces.dormant_at) {
+        return `This workspace has been dormant for ${formatDistanceToNow(
+          Date.parse(hasDormantWorkspaces.dormant_at),
+        )}
+        and cannot be interacted
+		with. Dormant workspaces are eligible for
+		permanent deletion. To prevent deletion, activate
+		the workspace.`;
+      }
+    }
+    return "";
+  };
+
+  return (
+    <Alert severity="warning" onDismiss={onDismiss} dismissible>
+      {count === Count.Singular ? (
+        alertText()
+      ) : (
+        <>
+          <span>There are</span>{" "}
+          <Link component={RouterLink} to="/workspaces?filter=is-dormant:true">
+            workspaces
+          </Link>{" "}
+          that may be deleted soon due to inactivity. Activate the workspaces
+          you wish to retain.
+        </>
+      )}
+    </Alert>
+  );
+};
diff --git a/site/src/components/WorkspaceDeletion/ImpendingDeletionBadge.tsx b/site/src/components/WorkspaceDeletion/ImpendingDeletionBadge.tsx
deleted file mode 100644
index eb27db82a3e2e..0000000000000
--- a/site/src/components/WorkspaceDeletion/ImpendingDeletionBadge.tsx
+++ /dev/null
@@ -1,31 +0,0 @@
-import { Workspace } from "api/typesGenerated"
-import { displayImpendingDeletion } from "./utils"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import { Pill } from "components/Pill/Pill"
-import ErrorIcon from "@mui/icons-material/ErrorOutline"
-
-export const ImpendingDeletionBadge = ({
-  workspace,
-}: {
-  workspace: Workspace
-}): JSX.Element | null => {
-  const { entitlements, experiments } = useDashboard()
-  const allowAdvancedScheduling =
-    entitlements.features["advanced_template_scheduling"].enabled
-  // This check can be removed when https://github.com/coder/coder/milestone/19
-  // is merged up
-  const allowWorkspaceActions = experiments.includes("workspace_actions")
-  // return null
-
-  if (
-    !displayImpendingDeletion(
-      workspace,
-      allowAdvancedScheduling,
-      allowWorkspaceActions,
-    )
-  ) {
-    return null
-  }
-
-  return <Pill icon={<ErrorIcon />} text="Impending deletion" type="error" />
-}
diff --git a/site/src/components/WorkspaceDeletion/ImpendingDeletionBanner.tsx b/site/src/components/WorkspaceDeletion/ImpendingDeletionBanner.tsx
deleted file mode 100644
index d793c16d5dc3a..0000000000000
--- a/site/src/components/WorkspaceDeletion/ImpendingDeletionBanner.tsx
+++ /dev/null
@@ -1,81 +0,0 @@
-import { Workspace } from "api/typesGenerated"
-import { displayImpendingDeletion } from "./utils"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import { Alert } from "components/Alert/Alert"
-import { formatDistanceToNow, differenceInDays, add, format } from "date-fns"
-import Link from "@mui/material/Link"
-import { Link as RouterLink } from "react-router-dom"
-
-export enum Count {
-  Singular,
-  Multiple,
-}
-
-export const ImpendingDeletionBanner = ({
-  workspace,
-  onDismiss,
-  shouldRedisplayBanner,
-  count = Count.Singular,
-}: {
-  workspace?: Workspace
-  onDismiss: () => void
-  shouldRedisplayBanner: boolean
-  count?: Count
-}): JSX.Element | null => {
-  const { entitlements, experiments } = useDashboard()
-  const allowAdvancedScheduling =
-    entitlements.features["advanced_template_scheduling"].enabled
-  // This check can be removed when https://github.com/coder/coder/milestone/19
-  // is merged up
-  const allowWorkspaceActions = experiments.includes("workspace_actions")
-
-  if (
-    !workspace ||
-    !displayImpendingDeletion(
-      workspace,
-      allowAdvancedScheduling,
-      allowWorkspaceActions,
-    ) ||
-    // Banners should be redisplayed after dismissal when additional workspaces are newly scheduled for deletion
-    !shouldRedisplayBanner
-  ) {
-    return null
-  }
-
-  // if deleting_at is 7 days away or less, display an 'error' banner to convey urgency to user
-  const daysUntilDelete = differenceInDays(
-    Date.parse(workspace.last_used_at),
-    new Date(),
-  )
-
-  const plusFourteen = add(new Date(), { days: 14 })
-
-  return (
-    <Alert
-      severity={daysUntilDelete <= 7 ? "warning" : "info"}
-      onDismiss={onDismiss}
-      dismissible
-    >
-      {count === Count.Singular ? (
-        `This workspace has been unused for ${formatDistanceToNow(
-          Date.parse(workspace.last_used_at),
-        )} and is scheduled for deletion. To keep it, connect via SSH or the web terminal.`
-      ) : (
-        <>
-          <span>There are</span>{" "}
-          <Link
-            component={RouterLink}
-            to={`/workspaces?filter=deleting_by:${format(
-              plusFourteen,
-              "y-MM-dd",
-            )}`}
-          >
-            workspaces
-          </Link>{" "}
-          that will be deleted soon due to inactivity. To keep these workspaces,
-          connect to them via SSH or the web terminal.
-        </>
-      )}
-    </Alert>
-  )
-}
diff --git a/site/src/components/WorkspaceDeletion/ImpendingDeletionStat.tsx b/site/src/components/WorkspaceDeletion/ImpendingDeletionStat.tsx
deleted file mode 100644
index aca1e21b22a97..0000000000000
--- a/site/src/components/WorkspaceDeletion/ImpendingDeletionStat.tsx
+++ /dev/null
@@ -1,59 +0,0 @@
-import { Maybe } from "components/Conditionals/Maybe"
-import { StatsItem } from "components/Stats/Stats"
-import Link from "@mui/material/Link"
-import { Link as RouterLink } from "react-router-dom"
-import styled from "@emotion/styled"
-import { Workspace } from "api/typesGenerated"
-import { displayImpendingDeletion } from "./utils"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-
-export const ImpendingDeletionStat = ({
-  workspace,
-}: {
-  workspace: Workspace
-}): JSX.Element => {
-  const { entitlements, experiments } = useDashboard()
-  const allowAdvancedScheduling =
-    entitlements.features["advanced_template_scheduling"].enabled
-  // This check can be removed when https://github.com/coder/coder/milestone/19
-  // is merged up
-  const allowWorkspaceActions = experiments.includes("workspace_actions")
-
-  return (
-    <Maybe
-      condition={displayImpendingDeletion(
-        workspace,
-        allowAdvancedScheduling,
-        allowWorkspaceActions,
-      )}
-    >
-      <StyledStatsItem
-        label="Deletion on"
-        className="containerClass"
-        value={
-          <Link
-            component={RouterLink}
-            to={`/templates/${workspace.template_name}/settings/schedule`}
-            title="Schedule settings"
-          >
-            {/* We check for string existence in the conditional */}
-            {new Date(workspace.deleting_at as string).toLocaleString()}
-          </Link>
-        }
-      />
-    </Maybe>
-  )
-}
-
-const StyledStatsItem = styled(StatsItem)(() => ({
-  "&.containerClass": {
-    flexDirection: "column",
-    gap: 0,
-    padding: 0,
-
-    "& > span:first-of-type": {
-      fontSize: 12,
-      fontWeight: 500,
-    },
-  },
-}))
diff --git a/site/src/components/WorkspaceDeletion/ImpendingDeletionText.tsx b/site/src/components/WorkspaceDeletion/ImpendingDeletionText.tsx
deleted file mode 100644
index 6191ed927cc69..0000000000000
--- a/site/src/components/WorkspaceDeletion/ImpendingDeletionText.tsx
+++ /dev/null
@@ -1,34 +0,0 @@
-import { Workspace } from "api/typesGenerated"
-import { displayImpendingDeletion } from "./utils"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import styled from "@emotion/styled"
-import { Theme as MaterialUITheme } from "@mui/material/styles"
-
-export const ImpendingDeletionText = ({
-  workspace,
-}: {
-  workspace: Workspace
-}): JSX.Element | null => {
-  const { entitlements, experiments } = useDashboard()
-  const allowAdvancedScheduling =
-    entitlements.features["advanced_template_scheduling"].enabled
-  // This check can be removed when https://github.com/coder/coder/milestone/19
-  // is merged up
-  const allowWorkspaceActions = experiments.includes("workspace_actions")
-
-  if (
-    !displayImpendingDeletion(
-      workspace,
-      allowAdvancedScheduling,
-      allowWorkspaceActions,
-    )
-  ) {
-    return null
-  }
-  return <StyledSpan role="status">Impending deletion</StyledSpan>
-}
-
-const StyledSpan = styled.span<{ theme?: MaterialUITheme }>`
-  color: ${(props) => props.theme.palette.warning.light};
-  font-weight: 600;
-`
diff --git a/site/src/components/WorkspaceDeletion/index.ts b/site/src/components/WorkspaceDeletion/index.ts
index d58af8e83ac57..3f9637cf4a655 100644
--- a/site/src/components/WorkspaceDeletion/index.ts
+++ b/site/src/components/WorkspaceDeletion/index.ts
@@ -1,4 +1,3 @@
-export * from "./ImpendingDeletionStat"
-export * from "./ImpendingDeletionBadge"
-export * from "./ImpendingDeletionText"
-export * from "./ImpendingDeletionBanner"
+export * from "./DormantDeletionStat";
+export * from "./DormantDeletionText";
+export * from "./DormantWorkspaceBanner";
diff --git a/site/src/components/WorkspaceDeletion/utils.test.ts b/site/src/components/WorkspaceDeletion/utils.test.ts
index 9436926ec7108..caca6c5661993 100644
--- a/site/src/components/WorkspaceDeletion/utils.test.ts
+++ b/site/src/components/WorkspaceDeletion/utils.test.ts
@@ -1,9 +1,9 @@
-import * as TypesGen from "api/typesGenerated"
-import * as Mocks from "testHelpers/entities"
-import { displayImpendingDeletion } from "./utils"
+import * as TypesGen from "api/typesGenerated";
+import * as Mocks from "testHelpers/entities";
+import { displayDormantDeletion } from "./utils";
 
-describe("displayImpendingDeletion", () => {
-  const today = new Date()
+describe("displayDormantDeletion", () => {
+  const today = new Date();
   it.each<[string, boolean, boolean, boolean]>([
     [
       new Date(new Date().setDate(today.getDate() + 15)).toISOString(),
@@ -43,14 +43,14 @@ describe("displayImpendingDeletion", () => {
       const workspace: TypesGen.Workspace = {
         ...Mocks.MockWorkspace,
         deleting_at,
-      }
+      };
       expect(
-        displayImpendingDeletion(
+        displayDormantDeletion(
           workspace,
           allowAdvancedScheduling,
           allowWorkspaceActions,
         ),
-      ).toBe(shouldDisplay)
+      ).toBe(shouldDisplay);
     },
-  )
-})
+  );
+});
diff --git a/site/src/components/WorkspaceDeletion/utils.ts b/site/src/components/WorkspaceDeletion/utils.ts
index 745bd48ad8941..14ac74f4a00bd 100644
--- a/site/src/components/WorkspaceDeletion/utils.ts
+++ b/site/src/components/WorkspaceDeletion/utils.ts
@@ -1,8 +1,8 @@
-import { Workspace } from "api/typesGenerated"
+import { Workspace } from "api/typesGenerated";
 
 // This const dictates how far out we alert the user that a workspace
 // has an impending deletion (due to template.InactivityTTL being set)
-const IMPENDING_DELETION_DISPLAY_THRESHOLD = 14 // 14 days
+const IMPENDING_DELETION_DISPLAY_THRESHOLD = 14; // 14 days
 
 /**
  * Returns a boolean indicating if an impending deletion indicator should be
@@ -11,23 +11,23 @@ const IMPENDING_DELETION_DISPLAY_THRESHOLD = 14 // 14 days
  * @param {TypesGen.Workspace} workspace
  * @returns {boolean}
  */
-export const displayImpendingDeletion = (
+export const displayDormantDeletion = (
   workspace: Workspace,
   allowAdvancedScheduling: boolean,
   allowWorkspaceActions: boolean,
 ) => {
-  const today = new Date()
+  const today = new Date();
   if (
     !workspace.deleting_at ||
     !allowAdvancedScheduling ||
     !allowWorkspaceActions
   ) {
-    return false
+    return false;
   }
   return (
     new Date(workspace.deleting_at) <=
     new Date(
       today.setDate(today.getDate() + IMPENDING_DELETION_DISPLAY_THRESHOLD),
     )
-  )
-}
+  );
+};
diff --git a/site/src/components/WorkspaceOutdatedTooltip/WorkspaceOutdatedTooltip.tsx b/site/src/components/WorkspaceOutdatedTooltip/WorkspaceOutdatedTooltip.tsx
new file mode 100644
index 0000000000000..080357f3c9c7b
--- /dev/null
+++ b/site/src/components/WorkspaceOutdatedTooltip/WorkspaceOutdatedTooltip.tsx
@@ -0,0 +1,126 @@
+import RefreshIcon from "@mui/icons-material/Refresh";
+import { type FC } from "react";
+import InfoIcon from "@mui/icons-material/InfoOutlined";
+import { useQuery } from "react-query";
+import Box from "@mui/material/Box";
+import Skeleton from "@mui/material/Skeleton";
+import Link from "@mui/material/Link";
+import { css } from "@emotion/css";
+import { templateVersion } from "api/queries/templates";
+import {
+  HelpTooltip,
+  HelpTooltipAction,
+  HelpTooltipLinksGroup,
+  HelpTooltipText,
+  HelpTooltipTitle,
+} from "components/HelpTooltip/HelpTooltip";
+import { colors } from "theme/colors";
+
+export const Language = {
+  outdatedLabel: "Outdated",
+  versionTooltipText:
+    "This workspace version is outdated and a newer version is available.",
+  updateVersionLabel: "Update version",
+};
+
+interface TooltipProps {
+  onUpdateVersion: () => void;
+  latestVersionId: string;
+  templateName: string;
+  ariaLabel?: string;
+}
+
+export const WorkspaceOutdatedTooltip: FC<TooltipProps> = ({
+  onUpdateVersion,
+  ariaLabel,
+  latestVersionId,
+  templateName,
+}) => {
+  const { data: activeVersion } = useQuery(templateVersion(latestVersionId));
+
+  return (
+    <HelpTooltip
+      size="small"
+      icon={InfoIcon}
+      iconClassName={css`
+        color: ${colors.yellow[5]};
+      `}
+      buttonClassName={css`
+        opacity: 1;
+
+        &:hover {
+          opacity: 1;
+        }
+      `}
+    >
+      <HelpTooltipTitle>{Language.outdatedLabel}</HelpTooltipTitle>
+      <HelpTooltipText>{Language.versionTooltipText}</HelpTooltipText>
+
+      <Box
+        sx={{
+          display: "flex",
+          flexDirection: "column",
+          gap: 1,
+          py: 1,
+          fontSize: 13,
+        }}
+      >
+        <Box>
+          <Box
+            sx={{
+              color: (theme) => theme.palette.text.primary,
+              fontWeight: 600,
+            }}
+          >
+            New version
+          </Box>
+          <Box>
+            {activeVersion ? (
+              <Link
+                href={`/templates/${templateName}/versions/${activeVersion.name}`}
+                target="_blank"
+                sx={{ color: (theme) => theme.palette.primary.light }}
+              >
+                {activeVersion.name}
+              </Link>
+            ) : (
+              <Skeleton variant="text" height={20} width={100} />
+            )}
+          </Box>
+        </Box>
+
+        <Box>
+          <Box
+            sx={{
+              color: (theme) => theme.palette.text.primary,
+              fontWeight: 600,
+            }}
+          >
+            Message
+          </Box>
+          <Box>
+            {activeVersion ? (
+              activeVersion.message === "" ? (
+                "No message"
+              ) : (
+                activeVersion.message
+              )
+            ) : (
+              <Skeleton variant="text" height={20} width={150} />
+            )}
+          </Box>
+        </Box>
+      </Box>
+
+      <HelpTooltipLinksGroup>
+        <HelpTooltipAction
+          icon={RefreshIcon}
+          onClick={onUpdateVersion}
+          ariaLabel={ariaLabel}
+        >
+          {Language.updateVersionLabel}
+        </HelpTooltipAction>
+      </HelpTooltipLinksGroup>
+    </HelpTooltip>
+  );
+};
diff --git a/site/src/components/WorkspaceScheduleForm/WorkspaceScheduleForm.stories.tsx b/site/src/components/WorkspaceScheduleForm/WorkspaceScheduleForm.stories.tsx
deleted file mode 100644
index 0ca9d30c69a3c..0000000000000
--- a/site/src/components/WorkspaceScheduleForm/WorkspaceScheduleForm.stories.tsx
+++ /dev/null
@@ -1,94 +0,0 @@
-import { Story } from "@storybook/react"
-import dayjs from "dayjs"
-import advancedFormat from "dayjs/plugin/advancedFormat"
-import timezone from "dayjs/plugin/timezone"
-import utc from "dayjs/plugin/utc"
-import {
-  defaultSchedule,
-  emptySchedule,
-} from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule"
-import { emptyTTL } from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/ttl"
-import { mockApiError } from "testHelpers/entities"
-import {
-  WorkspaceScheduleForm,
-  WorkspaceScheduleFormProps,
-} from "./WorkspaceScheduleForm"
-
-dayjs.extend(advancedFormat)
-dayjs.extend(utc)
-dayjs.extend(timezone)
-
-export default {
-  title: "components/WorkspaceScheduleForm",
-  component: WorkspaceScheduleForm,
-  argTypes: {
-    onCancel: {
-      action: "onCancel",
-    },
-    onSubmit: {
-      action: "onSubmit",
-    },
-  },
-}
-
-const Template: Story<WorkspaceScheduleFormProps> = (args) => (
-  <WorkspaceScheduleForm {...args} />
-)
-
-const defaultInitialValues = {
-  autostartEnabled: true,
-  ...defaultSchedule(),
-  autostopEnabled: true,
-  ttl: 24,
-}
-
-export const AllDisabled = Template.bind({})
-AllDisabled.args = {
-  initialValues: {
-    autostartEnabled: false,
-    ...emptySchedule,
-    autostopEnabled: false,
-    ttl: emptyTTL,
-  },
-}
-
-export const Autostart = Template.bind({})
-Autostart.args = {
-  initialValues: {
-    autostartEnabled: true,
-    ...defaultSchedule(),
-    autostopEnabled: false,
-    ttl: emptyTTL,
-  },
-}
-
-export const WorkspaceWillShutdownInTwoHours = Template.bind({})
-WorkspaceWillShutdownInTwoHours.args = {
-  initialValues: { ...defaultInitialValues, ttl: 2 },
-}
-
-export const WorkspaceWillShutdownInADay = Template.bind({})
-WorkspaceWillShutdownInADay.args = {
-  initialValues: { ...defaultInitialValues, ttl: 24 },
-}
-
-export const WorkspaceWillShutdownInTwoDays = Template.bind({})
-WorkspaceWillShutdownInTwoDays.args = {
-  initialValues: { ...defaultInitialValues, ttl: 48 },
-}
-
-export const WithError = Template.bind({})
-WithError.args = {
-  initialValues: { ...defaultInitialValues, ttl: 100 },
-  initialTouched: { ttl: true },
-  submitScheduleError: mockApiError({
-    message: "Something went wrong.",
-    validations: [{ field: "ttl_ms", detail: "Invalid time until shutdown." }],
-  }),
-}
-
-export const Loading = Template.bind({})
-Loading.args = {
-  initialValues: defaultInitialValues,
-  isLoading: true,
-}
diff --git a/site/src/components/WorkspaceScheduleForm/WorkspaceScheduleForm.tsx b/site/src/components/WorkspaceScheduleForm/WorkspaceScheduleForm.tsx
deleted file mode 100644
index 6190750d16dac..0000000000000
--- a/site/src/components/WorkspaceScheduleForm/WorkspaceScheduleForm.tsx
+++ /dev/null
@@ -1,403 +0,0 @@
-import Checkbox from "@mui/material/Checkbox"
-import FormControl from "@mui/material/FormControl"
-import FormControlLabel from "@mui/material/FormControlLabel"
-import FormGroup from "@mui/material/FormGroup"
-import FormHelperText from "@mui/material/FormHelperText"
-import FormLabel from "@mui/material/FormLabel"
-import MenuItem from "@mui/material/MenuItem"
-import makeStyles from "@mui/styles/makeStyles"
-import Switch from "@mui/material/Switch"
-import TextField from "@mui/material/TextField"
-import {
-  HorizontalForm,
-  FormFooter,
-  FormSection,
-  FormFields,
-} from "components/Form/Form"
-import { Stack } from "components/Stack/Stack"
-import dayjs from "dayjs"
-import advancedFormat from "dayjs/plugin/advancedFormat"
-import duration from "dayjs/plugin/duration"
-import relativeTime from "dayjs/plugin/relativeTime"
-import timezone from "dayjs/plugin/timezone"
-import utc from "dayjs/plugin/utc"
-import { FormikTouched, useFormik } from "formik"
-import {
-  defaultSchedule,
-  emptySchedule,
-} from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule"
-import { ChangeEvent, FC } from "react"
-import * as Yup from "yup"
-import { getFormHelpers } from "../../utils/formUtils"
-import { zones } from "./zones"
-
-// REMARK: some plugins depend on utc, so it's listed first. Otherwise they're
-//         sorted alphabetically.
-dayjs.extend(utc)
-dayjs.extend(advancedFormat)
-dayjs.extend(duration)
-dayjs.extend(relativeTime)
-dayjs.extend(timezone)
-
-export const Language = {
-  errorNoDayOfWeek:
-    "Must set at least one day of week if autostart is enabled.",
-  errorNoTime: "Start time is required when autostart is enabled.",
-  errorTime: "Time must be in HH:mm format (24 hours).",
-  errorTimezone: "Invalid timezone.",
-  errorNoStop:
-    "Time until shutdown must be greater than zero when autostop is enabled.",
-  errorTtlMax:
-    "Please enter a limit that is less than or equal to 720 hours (30 days).",
-  daysOfWeekLabel: "Days of Week",
-  daySundayLabel: "Sun",
-  dayMondayLabel: "Mon",
-  dayTuesdayLabel: "Tue",
-  dayWednesdayLabel: "Wed",
-  dayThursdayLabel: "Thu",
-  dayFridayLabel: "Fri",
-  daySaturdayLabel: "Sat",
-  startTimeLabel: "Start time",
-  timezoneLabel: "Timezone",
-  ttlLabel: "Time until shutdown (hours)",
-  ttlCausesShutdownHelperText: "Your workspace will shut down",
-  ttlCausesShutdownAfterStart:
-    "after its next start. We delay shutdown by this time whenever we detect activity",
-  ttlCausesNoShutdownHelperText:
-    "Your workspace will not automatically shut down.",
-  formTitle: "Workspace schedule",
-  startSection: "Start",
-  startSwitch: "Enable Autostart",
-  stopSection: "Stop",
-  stopSwitch: "Enable Autostop",
-}
-
-export interface WorkspaceScheduleFormProps {
-  submitScheduleError?: unknown
-  initialValues: WorkspaceScheduleFormValues
-  isLoading: boolean
-  onCancel: () => void
-  onSubmit: (values: WorkspaceScheduleFormValues) => void
-  // for storybook
-  initialTouched?: FormikTouched<WorkspaceScheduleFormValues>
-  defaultTTL: number
-}
-
-export interface WorkspaceScheduleFormValues {
-  autostartEnabled: boolean
-  sunday: boolean
-  monday: boolean
-  tuesday: boolean
-  wednesday: boolean
-  thursday: boolean
-  friday: boolean
-  saturday: boolean
-  startTime: string
-  timezone: string
-
-  autostopEnabled: boolean
-  ttl: number
-}
-
-export const validationSchema = Yup.object({
-  sunday: Yup.boolean(),
-  monday: Yup.boolean().test(
-    "at-least-one-day",
-    Language.errorNoDayOfWeek,
-    function (value) {
-      const parent = this.parent as WorkspaceScheduleFormValues
-
-      if (!parent.autostartEnabled) {
-        return true
-      } else {
-        return ![
-          parent.sunday,
-          value,
-          parent.tuesday,
-          parent.wednesday,
-          parent.thursday,
-          parent.friday,
-          parent.saturday,
-        ].every((day) => day === false)
-      }
-    },
-  ),
-  tuesday: Yup.boolean(),
-  wednesday: Yup.boolean(),
-  thursday: Yup.boolean(),
-  friday: Yup.boolean(),
-  saturday: Yup.boolean(),
-
-  startTime: Yup.string()
-    .ensure()
-    .test("required-if-autostart", Language.errorNoTime, function (value) {
-      const parent = this.parent as WorkspaceScheduleFormValues
-      if (parent.autostartEnabled) {
-        return value !== ""
-      } else {
-        return true
-      }
-    })
-    .test("is-time-string", Language.errorTime, (value) => {
-      if (value === "") {
-        return true
-      } else if (!/^[0-9][0-9]:[0-9][0-9]$/.test(value)) {
-        return false
-      } else {
-        const parts = value.split(":")
-        const HH = Number(parts[0])
-        const mm = Number(parts[1])
-        return HH >= 0 && HH <= 23 && mm >= 0 && mm <= 59
-      }
-    }),
-  timezone: Yup.string()
-    .ensure()
-    .test("is-timezone", Language.errorTimezone, function (value) {
-      const parent = this.parent as WorkspaceScheduleFormValues
-
-      if (!parent.startTime) {
-        return true
-      } else {
-        // Unfortunately, there's not a good API on dayjs at this time for
-        // evaluating a timezone. Attempt to parse today in the supplied timezone
-        // and return as valid if the function doesn't throw.
-        try {
-          dayjs.tz(dayjs(), value)
-          return true
-        } catch (e) {
-          return false
-        }
-      }
-    }),
-  ttl: Yup.number()
-    .integer()
-    .min(0)
-    .max(24 * 30 /* 30 days */, Language.errorTtlMax)
-    .test("positive-if-autostop", Language.errorNoStop, function (value) {
-      const parent = this.parent as WorkspaceScheduleFormValues
-      if (parent.autostopEnabled) {
-        return Boolean(value)
-      } else {
-        return true
-      }
-    }),
-})
-
-export const WorkspaceScheduleForm: FC<
-  React.PropsWithChildren<WorkspaceScheduleFormProps>
-> = ({
-  submitScheduleError,
-  initialValues,
-  isLoading,
-  onCancel,
-  onSubmit,
-  initialTouched,
-  defaultTTL,
-}) => {
-  const styles = useStyles()
-
-  const form = useFormik<WorkspaceScheduleFormValues>({
-    initialValues,
-    onSubmit,
-    validationSchema,
-    initialTouched,
-  })
-  const formHelpers = getFormHelpers<WorkspaceScheduleFormValues>(
-    form,
-    submitScheduleError,
-  )
-
-  const checkboxes: Array<{ value: boolean; name: string; label: string }> = [
-    {
-      value: form.values.sunday,
-      name: "sunday",
-      label: Language.daySundayLabel,
-    },
-    {
-      value: form.values.monday,
-      name: "monday",
-      label: Language.dayMondayLabel,
-    },
-    {
-      value: form.values.tuesday,
-      name: "tuesday",
-      label: Language.dayTuesdayLabel,
-    },
-    {
-      value: form.values.wednesday,
-      name: "wednesday",
-      label: Language.dayWednesdayLabel,
-    },
-    {
-      value: form.values.thursday,
-      name: "thursday",
-      label: Language.dayThursdayLabel,
-    },
-    {
-      value: form.values.friday,
-      name: "friday",
-      label: Language.dayFridayLabel,
-    },
-    {
-      value: form.values.saturday,
-      name: "saturday",
-      label: Language.daySaturdayLabel,
-    },
-  ]
-
-  const handleToggleAutostart = async (e: ChangeEvent) => {
-    form.handleChange(e)
-    if (form.values.autostartEnabled) {
-      // disable autostart, clear values
-      await form.setValues({
-        ...form.values,
-        autostartEnabled: false,
-        ...emptySchedule,
-      })
-    } else {
-      // enable autostart, fill with defaults
-      await form.setValues({
-        ...form.values,
-        autostartEnabled: true,
-        ...defaultSchedule(),
-      })
-    }
-  }
-
-  const handleToggleAutostop = async (e: ChangeEvent) => {
-    form.handleChange(e)
-    if (form.values.autostopEnabled) {
-      // disable autostop, set TTL 0
-      await form.setValues({ ...form.values, autostopEnabled: false, ttl: 0 })
-    } else {
-      // enable autostop, fill with default TTL
-      await form.setValues({
-        ...form.values,
-        autostopEnabled: true,
-        ttl: defaultTTL,
-      })
-    }
-  }
-
-  return (
-    <HorizontalForm onSubmit={form.handleSubmit}>
-      <FormSection
-        title="Autostart"
-        description="Select the time and days of week on which you want the workspace starting automatically."
-      >
-        <FormFields>
-          <FormControlLabel
-            control={
-              <Switch
-                name="autostartEnabled"
-                checked={form.values.autostartEnabled}
-                onChange={handleToggleAutostart}
-              />
-            }
-            label={Language.startSwitch}
-          />
-          <Stack direction="row">
-            <TextField
-              {...formHelpers("startTime")}
-              disabled={isLoading || !form.values.autostartEnabled}
-              label={Language.startTimeLabel}
-              type="time"
-              fullWidth
-            />
-            <TextField
-              {...formHelpers("timezone")}
-              disabled={isLoading || !form.values.autostartEnabled}
-              label={Language.timezoneLabel}
-              select
-              fullWidth
-            >
-              {zones.map((zone) => (
-                <MenuItem key={zone} value={zone}>
-                  {zone}
-                </MenuItem>
-              ))}
-            </TextField>
-          </Stack>
-
-          <FormControl component="fieldset" error={Boolean(form.errors.monday)}>
-            <FormLabel className={styles.daysOfWeekLabel} component="legend">
-              {Language.daysOfWeekLabel}
-            </FormLabel>
-
-            <FormGroup className={styles.daysOfWeekOptions}>
-              {checkboxes.map((checkbox) => (
-                <FormControlLabel
-                  control={
-                    <Checkbox
-                      checked={checkbox.value}
-                      disabled={isLoading || !form.values.autostartEnabled}
-                      onChange={form.handleChange}
-                      name={checkbox.name}
-                      size="small"
-                    />
-                  }
-                  key={checkbox.name}
-                  label={checkbox.label}
-                />
-              ))}
-            </FormGroup>
-
-            {form.errors.monday && (
-              <FormHelperText>{Language.errorNoDayOfWeek}</FormHelperText>
-            )}
-          </FormControl>
-        </FormFields>
-      </FormSection>
-
-      <FormSection
-        title="Autostop"
-        description="Set how many hours should elapse after a workspace is started before it automatically shuts down. If workspace connection activity is detected, the autostop timer will be bumped up one hour."
-      >
-        <FormFields>
-          <FormControlLabel
-            control={
-              <Switch
-                name="autostopEnabled"
-                checked={form.values.autostopEnabled}
-                onChange={handleToggleAutostop}
-              />
-            }
-            label={Language.stopSwitch}
-          />
-          <TextField
-            {...formHelpers("ttl", ttlShutdownAt(form.values.ttl), "ttl_ms")}
-            disabled={isLoading || !form.values.autostopEnabled}
-            inputProps={{ min: 0, step: 1 }}
-            label={Language.ttlLabel}
-            type="number"
-            fullWidth
-          />
-        </FormFields>
-      </FormSection>
-      <FormFooter onCancel={onCancel} isLoading={isLoading} />
-    </HorizontalForm>
-  )
-}
-
-export const ttlShutdownAt = (formTTL: number): string => {
-  if (formTTL < 1) {
-    // Passing an empty value for TTL in the form results in a number that is not zero but less than 1.
-    return Language.ttlCausesNoShutdownHelperText
-  } else {
-    return `${Language.ttlCausesShutdownHelperText} ${dayjs
-      .duration(formTTL, "hours")
-      .humanize()} ${Language.ttlCausesShutdownAfterStart}.`
-  }
-}
-
-const useStyles = makeStyles((theme) => ({
-  daysOfWeekLabel: {
-    fontSize: 12,
-  },
-  daysOfWeekOptions: {
-    display: "flex",
-    flexDirection: "row",
-    flexWrap: "wrap",
-    paddingTop: theme.spacing(0.5),
-  },
-}))
diff --git a/site/src/components/WorkspaceScheduleForm/zones.ts b/site/src/components/WorkspaceScheduleForm/zones.ts
deleted file mode 100644
index fe2536a7e8f27..0000000000000
--- a/site/src/components/WorkspaceScheduleForm/zones.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import tzData from "tzdata"
-
-export const zones: string[] = Object.keys(tzData.zones).sort()
diff --git a/site/src/components/WorkspaceSection/WorkspaceSection.stories.tsx b/site/src/components/WorkspaceSection/WorkspaceSection.stories.tsx
deleted file mode 100644
index 7550af1fc9169..0000000000000
--- a/site/src/components/WorkspaceSection/WorkspaceSection.stories.tsx
+++ /dev/null
@@ -1,29 +0,0 @@
-import IconButton from "@mui/material/IconButton"
-import EditIcon from "@mui/icons-material/Edit"
-import { action } from "@storybook/addon-actions"
-import { Story } from "@storybook/react"
-import { WorkspaceSection, WorkspaceSectionProps } from "./WorkspaceSection"
-
-export default {
-  title: "components/WorkspaceSection",
-  component: WorkspaceSection,
-}
-
-const Template: Story<WorkspaceSectionProps> = (args) => (
-  <WorkspaceSection {...args}>Content</WorkspaceSection>
-)
-
-export const NoAction = Template.bind({})
-NoAction.args = {
-  title: "A Workspace Section",
-}
-
-export const Action = Template.bind({})
-Action.args = {
-  action: (
-    <IconButton onClick={action("edit")} size="large">
-      <EditIcon />
-    </IconButton>
-  ),
-  title: "Action Section",
-}
diff --git a/site/src/components/WorkspaceSection/WorkspaceSection.tsx b/site/src/components/WorkspaceSection/WorkspaceSection.tsx
deleted file mode 100644
index e7dc1732a71a1..0000000000000
--- a/site/src/components/WorkspaceSection/WorkspaceSection.tsx
+++ /dev/null
@@ -1,61 +0,0 @@
-import Paper from "@mui/material/Paper"
-import { makeStyles } from "@mui/styles"
-import { HTMLProps, ReactNode, FC, PropsWithChildren } from "react"
-import { combineClasses } from "../../utils/combineClasses"
-
-export interface WorkspaceSectionProps {
-  /**
-   * action appears in the top right of the section card
-   */
-  action?: ReactNode
-  contentsProps?: HTMLProps<HTMLDivElement>
-  title?: string | JSX.Element
-}
-
-export const WorkspaceSection: FC<PropsWithChildren<WorkspaceSectionProps>> = ({
-  action,
-  children,
-  contentsProps,
-  title,
-}) => {
-  const styles = useStyles()
-
-  return (
-    <Paper className={styles.root} elevation={0}>
-      {title && (
-        <div className={styles.header}>
-          <h6 className={styles.title}>{title}</h6>
-          {action && <div>{action}</div>}
-        </div>
-      )}
-
-      <div
-        {...contentsProps}
-        className={combineClasses([styles.contents, contentsProps?.className])}
-      >
-        {children}
-      </div>
-    </Paper>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  root: {
-    border: `1px solid ${theme.palette.divider}`,
-    borderRadius: theme.shape.borderRadius,
-  },
-  contents: {
-    margin: theme.spacing(2),
-  },
-  header: {
-    alignItems: "center",
-    display: "flex",
-    justifyContent: "space-between",
-    padding: theme.spacing(1.5, 2),
-  },
-  title: {
-    margin: 0,
-    fontSize: 14,
-    fontWeight: 600,
-  },
-}))
diff --git a/site/src/components/WorkspaceStats/WorkspaceStats.stories.tsx b/site/src/components/WorkspaceStats/WorkspaceStats.stories.tsx
deleted file mode 100644
index 96fe4d636fee8..0000000000000
--- a/site/src/components/WorkspaceStats/WorkspaceStats.stories.tsx
+++ /dev/null
@@ -1,51 +0,0 @@
-import { Story } from "@storybook/react"
-import {
-  MockWorkspace,
-  MockAppearance,
-  MockBuildInfo,
-  MockEntitlementsWithScheduling,
-  MockExperiments,
-} from "testHelpers/entities"
-import {
-  WorkspaceStats,
-  WorkspaceStatsProps,
-} from "../WorkspaceStats/WorkspaceStats"
-import { DashboardProviderContext } from "components/Dashboard/DashboardProvider"
-
-export default {
-  title: "components/WorkspaceStats",
-  component: WorkspaceStats,
-}
-
-const MockedAppearance = {
-  config: MockAppearance,
-  preview: false,
-  setPreview: () => null,
-  save: () => null,
-}
-
-const Template: Story<WorkspaceStatsProps> = (args) => (
-  <DashboardProviderContext.Provider
-    value={{
-      buildInfo: MockBuildInfo,
-      entitlements: MockEntitlementsWithScheduling,
-      experiments: MockExperiments,
-      appearance: MockedAppearance,
-    }}
-  >
-    <WorkspaceStats {...args} />
-  </DashboardProviderContext.Provider>
-)
-
-export const Example = Template.bind({})
-Example.args = {
-  workspace: MockWorkspace,
-}
-
-export const Outdated = Template.bind({})
-Outdated.args = {
-  workspace: {
-    ...MockWorkspace,
-    outdated: true,
-  },
-}
diff --git a/site/src/components/WorkspaceStats/WorkspaceStats.tsx b/site/src/components/WorkspaceStats/WorkspaceStats.tsx
deleted file mode 100644
index 9a474d152f83e..0000000000000
--- a/site/src/components/WorkspaceStats/WorkspaceStats.tsx
+++ /dev/null
@@ -1,403 +0,0 @@
-import Link from "@mui/material/Link"
-import { WorkspaceOutdatedTooltip } from "components/Tooltips"
-import { FC, useRef, useState } from "react"
-import { Link as RouterLink } from "react-router-dom"
-import { createDayString } from "utils/createDayString"
-import {
-  getDisplayWorkspaceBuildInitiatedBy,
-  getDisplayWorkspaceTemplateName,
-  isWorkspaceOn,
-} from "utils/workspace"
-import { Workspace } from "../../api/typesGenerated"
-import { Stats, StatsItem } from "components/Stats/Stats"
-import upperFirst from "lodash/upperFirst"
-import { autostartDisplay, autostopDisplay } from "utils/schedule"
-import IconButton from "@mui/material/IconButton"
-import RemoveIcon from "@mui/icons-material/RemoveOutlined"
-import { makeStyles } from "@mui/styles"
-import AddIcon from "@mui/icons-material/AddOutlined"
-import Popover from "@mui/material/Popover"
-import TextField from "@mui/material/TextField"
-import Button from "@mui/material/Button"
-import { WorkspaceStatusText } from "components/WorkspaceStatusBadge/WorkspaceStatusBadge"
-import { ImpendingDeletionStat } from "components/WorkspaceDeletion"
-
-const Language = {
-  workspaceDetails: "Workspace Details",
-  templateLabel: "Template",
-  statusLabel: "Workspace Status",
-  versionLabel: "Version",
-  lastBuiltLabel: "Last built",
-  outdated: "Outdated",
-  upToDate: "Up to date",
-  byLabel: "Last built by",
-  costLabel: "Daily cost",
-}
-
-export interface WorkspaceStatsProps {
-  workspace: Workspace
-  maxDeadlineIncrease: number
-  maxDeadlineDecrease: number
-  canUpdateWorkspace: boolean
-  quota_budget?: number
-  onDeadlinePlus: (hours: number) => void
-  onDeadlineMinus: (hours: number) => void
-  handleUpdate: () => void
-}
-
-export const WorkspaceStats: FC<WorkspaceStatsProps> = ({
-  workspace,
-  quota_budget,
-  maxDeadlineDecrease,
-  maxDeadlineIncrease,
-  canUpdateWorkspace,
-  handleUpdate,
-  onDeadlineMinus,
-  onDeadlinePlus,
-}) => {
-  const initiatedBy = getDisplayWorkspaceBuildInitiatedBy(
-    workspace.latest_build,
-  )
-  const displayTemplateName = getDisplayWorkspaceTemplateName(workspace)
-  const styles = useStyles()
-  const deadlinePlusEnabled = maxDeadlineIncrease >= 1
-  const deadlineMinusEnabled = maxDeadlineDecrease >= 1
-  const addButtonRef = useRef<HTMLButtonElement>(null)
-  const subButtonRef = useRef<HTMLButtonElement>(null)
-  const [isAddingTime, setIsAddingTime] = useState(false)
-  const [isSubTime, setIsSubTime] = useState(false)
-
-  return (
-    <>
-      <Stats aria-label={Language.workspaceDetails} className={styles.stats}>
-        <StatsItem
-          className={styles.statsItem}
-          label="Status"
-          value={<WorkspaceStatusText workspace={workspace} />}
-        />
-        <ImpendingDeletionStat workspace={workspace} />
-        <StatsItem
-          className={styles.statsItem}
-          label={Language.templateLabel}
-          value={
-            <Link
-              component={RouterLink}
-              to={`/templates/${workspace.template_name}`}
-            >
-              {displayTemplateName}
-            </Link>
-          }
-        />
-        <StatsItem
-          className={styles.statsItem}
-          label={Language.versionLabel}
-          value={
-            <>
-              <Link
-                component={RouterLink}
-                to={`/templates/${workspace.template_name}/versions/${workspace.latest_build.template_version_name}`}
-              >
-                {workspace.latest_build.template_version_name}
-              </Link>
-
-              {workspace.outdated && (
-                <WorkspaceOutdatedTooltip
-                  templateName={workspace.template_name}
-                  templateId={workspace.template_id}
-                  onUpdateVersion={handleUpdate}
-                  ariaLabel="update version"
-                />
-              )}
-            </>
-          }
-        />
-        <StatsItem
-          className={styles.statsItem}
-          label={Language.lastBuiltLabel}
-          value={
-            <>
-              {upperFirst(createDayString(workspace.latest_build.created_at))}{" "}
-              by {initiatedBy}
-            </>
-          }
-        />
-        {shouldDisplayScheduleLabel(workspace) && (
-          <StatsItem
-            className={styles.statsItem}
-            label={getScheduleLabel(workspace)}
-            value={
-              <span className={styles.scheduleValue}>
-                <Link
-                  component={RouterLink}
-                  to="settings/schedule"
-                  title="Schedule settings"
-                >
-                  {isWorkspaceOn(workspace)
-                    ? autostopDisplay(workspace)
-                    : autostartDisplay(workspace.autostart_schedule)}
-                </Link>
-                {canUpdateWorkspace && canEditDeadline(workspace) && (
-                  <span className={styles.scheduleControls}>
-                    <IconButton
-                      disabled={!deadlineMinusEnabled}
-                      size="small"
-                      title="Subtract hours from deadline"
-                      className={styles.scheduleButton}
-                      ref={subButtonRef}
-                      onClick={() => setIsSubTime(true)}
-                    >
-                      <RemoveIcon />
-                    </IconButton>
-                    <IconButton
-                      disabled={!deadlinePlusEnabled}
-                      size="small"
-                      title="Add hours to deadline"
-                      className={styles.scheduleButton}
-                      ref={addButtonRef}
-                      onClick={() => setIsAddingTime(true)}
-                    >
-                      <AddIcon />
-                    </IconButton>
-                  </span>
-                )}
-              </span>
-            }
-          />
-        )}
-        {workspace.latest_build.daily_cost > 0 && (
-          <StatsItem
-            className={styles.statsItem}
-            label={Language.costLabel}
-            value={`${workspace.latest_build.daily_cost} ${
-              quota_budget ? `/ ${quota_budget}` : ""
-            }`}
-          />
-        )}
-      </Stats>
-
-      <Popover
-        id="schedule-add"
-        classes={{ paper: styles.timePopoverPaper }}
-        open={isAddingTime}
-        anchorEl={addButtonRef.current}
-        onClose={() => setIsAddingTime(false)}
-        anchorOrigin={{
-          vertical: "bottom",
-          horizontal: "right",
-        }}
-        transformOrigin={{
-          vertical: "top",
-          horizontal: "right",
-        }}
-      >
-        <span className={styles.timePopoverTitle}>Add hours to deadline</span>
-        <span className={styles.timePopoverDescription}>
-          Delay the shutdown of this workspace for a few more hours. This is
-          only applied once.
-        </span>
-        <form
-          className={styles.timePopoverForm}
-          onSubmit={(e) => {
-            e.preventDefault()
-            const formData = new FormData(e.currentTarget)
-            const hours = Number(formData.get("hours"))
-            onDeadlinePlus(hours)
-            setIsAddingTime(false)
-          }}
-        >
-          <TextField
-            name="hours"
-            type="number"
-            size="small"
-            fullWidth
-            className={styles.timePopoverField}
-            InputProps={{ className: styles.timePopoverFieldInput }}
-            inputProps={{
-              min: 0,
-              max: maxDeadlineIncrease,
-              step: 1,
-              defaultValue: 1,
-            }}
-          />
-
-          <Button
-            size="small"
-            className={styles.timePopoverButton}
-            type="submit"
-          >
-            Apply
-          </Button>
-        </form>
-      </Popover>
-
-      <Popover
-        id="schedule-sub"
-        classes={{ paper: styles.timePopoverPaper }}
-        open={isSubTime}
-        anchorEl={subButtonRef.current}
-        onClose={() => setIsSubTime(false)}
-        anchorOrigin={{
-          vertical: "bottom",
-          horizontal: "right",
-        }}
-        transformOrigin={{
-          vertical: "top",
-          horizontal: "right",
-        }}
-      >
-        <span className={styles.timePopoverTitle}>
-          Subtract hours to deadline
-        </span>
-        <span className={styles.timePopoverDescription}>
-          Anticipate the shutdown of this workspace for a few more hours. This
-          is only applied once.
-        </span>
-        <form
-          className={styles.timePopoverForm}
-          onSubmit={(e) => {
-            e.preventDefault()
-            const formData = new FormData(e.currentTarget)
-            const hours = Number(formData.get("hours"))
-            onDeadlineMinus(hours)
-            setIsSubTime(false)
-          }}
-        >
-          <TextField
-            name="hours"
-            type="number"
-            size="small"
-            fullWidth
-            className={styles.timePopoverField}
-            InputProps={{ className: styles.timePopoverFieldInput }}
-            inputProps={{
-              min: 0,
-              max: maxDeadlineDecrease,
-              step: 1,
-              defaultValue: 1,
-            }}
-          />
-
-          <Button
-            size="small"
-            className={styles.timePopoverButton}
-            type="submit"
-          >
-            Apply
-          </Button>
-        </form>
-      </Popover>
-    </>
-  )
-}
-
-export const canEditDeadline = (workspace: Workspace): boolean => {
-  return isWorkspaceOn(workspace) && Boolean(workspace.latest_build.deadline)
-}
-
-export const shouldDisplayScheduleLabel = (workspace: Workspace): boolean => {
-  if (canEditDeadline(workspace)) {
-    return true
-  }
-  if (isWorkspaceOn(workspace)) {
-    return false
-  }
-  return Boolean(workspace.autostart_schedule)
-}
-
-const getScheduleLabel = (workspace: Workspace) => {
-  return isWorkspaceOn(workspace) ? "Stops at" : "Starts at"
-}
-
-const useStyles = makeStyles((theme) => ({
-  stats: {
-    padding: 0,
-    border: 0,
-    gap: theme.spacing(6),
-    rowGap: theme.spacing(3),
-    flex: 1,
-
-    [theme.breakpoints.down("md")]: {
-      display: "flex",
-      flexDirection: "column",
-      alignItems: "flex-start",
-      gap: theme.spacing(1),
-    },
-  },
-
-  statsItem: {
-    flexDirection: "column",
-    gap: 0,
-    padding: 0,
-
-    "& > span:first-of-type": {
-      fontSize: 12,
-      fontWeight: 500,
-    },
-  },
-
-  scheduleValue: {
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(1.5),
-  },
-
-  scheduleControls: {
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(0.5),
-  },
-
-  scheduleButton: {
-    border: `1px solid ${theme.palette.divider}`,
-    borderRadius: 4,
-    width: 20,
-    height: 20,
-
-    "& svg.MuiSvgIcon-root": {
-      width: theme.spacing(1.5),
-      height: theme.spacing(1.5),
-    },
-  },
-
-  timePopoverPaper: {
-    padding: theme.spacing(3),
-    maxWidth: theme.spacing(36),
-    marginTop: theme.spacing(1),
-    borderRadius: 4,
-    display: "flex",
-    flexDirection: "column",
-    gap: theme.spacing(1),
-  },
-
-  timePopoverTitle: {
-    fontWeight: 600,
-  },
-
-  timePopoverDescription: {
-    color: theme.palette.text.secondary,
-  },
-
-  timePopoverForm: {
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(1),
-    padding: theme.spacing(1, 0),
-  },
-
-  timePopoverField: {
-    margin: 0,
-  },
-
-  timePopoverFieldInput: {
-    fontSize: 14,
-    padding: theme.spacing(0),
-    borderRadius: 4,
-  },
-
-  timePopoverButton: {
-    borderRadius: 4,
-    paddingLeft: theme.spacing(2),
-    paddingRight: theme.spacing(2),
-    flexShrink: 0,
-  },
-}))
diff --git a/site/src/components/WorkspaceStatusBadge/WorkspaceStatusBadge.stories.tsx b/site/src/components/WorkspaceStatusBadge/WorkspaceStatusBadge.stories.tsx
index 3e7eefc942326..691532de06849 100644
--- a/site/src/components/WorkspaceStatusBadge/WorkspaceStatusBadge.stories.tsx
+++ b/site/src/components/WorkspaceStatusBadge/WorkspaceStatusBadge.stories.tsx
@@ -1,4 +1,3 @@
-import { Story } from "@storybook/react"
 import {
   MockCanceledWorkspace,
   MockCancelingWorkspace,
@@ -13,85 +12,96 @@ import {
   MockBuildInfo,
   MockEntitlementsWithScheduling,
   MockExperiments,
-  MockAppearance,
-} from "testHelpers/entities"
-import {
-  WorkspaceStatusBadge,
-  WorkspaceStatusBadgeProps,
-} from "./WorkspaceStatusBadge"
-import { DashboardProviderContext } from "components/Dashboard/DashboardProvider"
+  MockAppearanceConfig,
+} from "testHelpers/entities";
+import { WorkspaceStatusBadge } from "./WorkspaceStatusBadge";
+import { DashboardProviderContext } from "components/Dashboard/DashboardProvider";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const MockedAppearance = {
+  config: MockAppearanceConfig,
+  isPreview: false,
+  setPreview: () => {},
+};
 
-export default {
+const meta: Meta<typeof WorkspaceStatusBadge> = {
   title: "components/WorkspaceStatusBadge",
   component: WorkspaceStatusBadge,
-}
-
-const MockedAppearance = {
-  config: MockAppearance,
-  preview: false,
-  setPreview: () => null,
-  save: () => null,
-}
+  decorators: [
+    (Story) => (
+      <DashboardProviderContext.Provider
+        value={{
+          buildInfo: MockBuildInfo,
+          entitlements: MockEntitlementsWithScheduling,
+          experiments: MockExperiments,
+          appearance: MockedAppearance,
+        }}
+      >
+        <Story />
+      </DashboardProviderContext.Provider>
+    ),
+  ],
+};
 
-const Template: Story<WorkspaceStatusBadgeProps> = (args) => (
-  <DashboardProviderContext.Provider
-    value={{
-      buildInfo: MockBuildInfo,
-      entitlements: MockEntitlementsWithScheduling,
-      experiments: MockExperiments,
-      appearance: MockedAppearance,
-    }}
-  >
-    <WorkspaceStatusBadge {...args} />
-  </DashboardProviderContext.Provider>
-)
+export default meta;
+type Story = StoryObj<typeof WorkspaceStatusBadge>;
 
-export const Running = Template.bind({})
-Running.args = {
-  workspace: MockWorkspace,
-}
+export const Running: Story = {
+  args: {
+    workspace: MockWorkspace,
+  },
+};
 
-export const Starting = Template.bind({})
-Starting.args = {
-  workspace: MockStartingWorkspace,
-}
+export const Starting: Story = {
+  args: {
+    workspace: MockStartingWorkspace,
+  },
+};
 
-export const Stopped = Template.bind({})
-Stopped.args = {
-  workspace: MockStoppedWorkspace,
-}
+export const Stopped: Story = {
+  args: {
+    workspace: MockStoppedWorkspace,
+  },
+};
 
-export const Stopping = Template.bind({})
-Stopping.args = {
-  workspace: MockStoppingWorkspace,
-}
+export const Stopping: Story = {
+  args: {
+    workspace: MockStoppingWorkspace,
+  },
+};
 
-export const Deleting = Template.bind({})
-Deleting.args = {
-  workspace: MockDeletingWorkspace,
-}
+export const Deleting: Story = {
+  args: {
+    workspace: MockDeletingWorkspace,
+  },
+};
 
-export const Deleted = Template.bind({})
-Deleted.args = {
-  workspace: MockDeletedWorkspace,
-}
+export const Deleted: Story = {
+  args: {
+    workspace: MockDeletedWorkspace,
+  },
+};
 
-export const Canceling = Template.bind({})
-Canceling.args = {
-  workspace: MockCancelingWorkspace,
-}
+export const Canceling: Story = {
+  args: {
+    workspace: MockCancelingWorkspace,
+  },
+};
 
-export const Canceled = Template.bind({})
-Canceled.args = {
-  workspace: MockCanceledWorkspace,
-}
+export const Canceled: Story = {
+  args: {
+    workspace: MockCanceledWorkspace,
+  },
+};
 
-export const Failed = Template.bind({})
-Failed.args = {
-  workspace: MockFailedWorkspace,
-}
+export const Failed: Story = {
+  args: {
+    workspace: MockFailedWorkspace,
+  },
+};
 
-export const Pending = Template.bind({})
-Pending.args = {
-  workspace: MockPendingWorkspace,
-}
+export const Pending: Story = {
+  args: {
+    workspace: MockPendingWorkspace,
+  },
+};
diff --git a/site/src/components/WorkspaceStatusBadge/WorkspaceStatusBadge.tsx b/site/src/components/WorkspaceStatusBadge/WorkspaceStatusBadge.tsx
index 7f742dab2ff3c..17e8cafc7bebe 100644
--- a/site/src/components/WorkspaceStatusBadge/WorkspaceStatusBadge.tsx
+++ b/site/src/components/WorkspaceStatusBadge/WorkspaceStatusBadge.tsx
@@ -1,19 +1,20 @@
-import { Workspace } from "api/typesGenerated"
-import { Pill } from "components/Pill/Pill"
-import { FC, PropsWithChildren } from "react"
-import { makeStyles } from "@mui/styles"
-import { combineClasses } from "utils/combineClasses"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import {
-  ImpendingDeletionBadge,
-  ImpendingDeletionText,
-} from "components/WorkspaceDeletion"
-import { getDisplayWorkspaceStatus } from "utils/workspace"
+import { Workspace } from "api/typesGenerated";
+import { Pill } from "components/Pill/Pill";
+import { FC, PropsWithChildren } from "react";
+import { makeStyles } from "@mui/styles";
+import { combineClasses } from "utils/combineClasses";
+import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
+import { DormantDeletionText } from "components/WorkspaceDeletion";
+import { getDisplayWorkspaceStatus } from "utils/workspace";
+import Tooltip, { TooltipProps, tooltipClasses } from "@mui/material/Tooltip";
+import { styled } from "@mui/material/styles";
+import Box from "@mui/material/Box";
+import ErrorOutline from "@mui/icons-material/ErrorOutline";
 
 export type WorkspaceStatusBadgeProps = {
-  workspace: Workspace
-  className?: string
-}
+  workspace: Workspace;
+  className?: string;
+};
 
 export const WorkspaceStatusBadge: FC<
   PropsWithChildren<WorkspaceStatusBadgeProps>
@@ -21,33 +22,50 @@ export const WorkspaceStatusBadge: FC<
   const { text, icon, type } = getDisplayWorkspaceStatus(
     workspace.latest_build.status,
     workspace.latest_build.job,
-  )
+  );
   return (
     <ChooseOne>
-      {/* <ImpendingDeletionBadge/> determines its own visibility */}
-      <Cond condition={Boolean(ImpendingDeletionBadge({ workspace }))}>
-        <ImpendingDeletionBadge workspace={workspace} />
+      <Cond condition={workspace.latest_build.status === "failed"}>
+        <FailureTooltip
+          title={
+            <Box sx={{ display: "flex", alignItems: "center", gap: 1.25 }}>
+              <ErrorOutline
+                sx={{
+                  width: 14,
+                  height: 14,
+                  color: (theme) => theme.palette.error.light,
+                }}
+              />
+              <Box>{workspace.latest_build.job.error}</Box>
+            </Box>
+          }
+          placement="top"
+        >
+          <div>
+            <Pill className={className} icon={icon} text={text} type={type} />
+          </div>
+        </FailureTooltip>
       </Cond>
       <Cond>
         <Pill className={className} icon={icon} text={text} type={type} />
       </Cond>
     </ChooseOne>
-  )
-}
+  );
+};
 
 export const WorkspaceStatusText: FC<
   PropsWithChildren<WorkspaceStatusBadgeProps>
 > = ({ workspace, className }) => {
-  const styles = useStyles()
+  const styles = useStyles();
   const { text, type } = getDisplayWorkspaceStatus(
     workspace.latest_build.status,
-  )
+  );
 
   return (
     <ChooseOne>
-      {/* <ImpendingDeletionText/> determines its own visibility */}
-      <Cond condition={Boolean(ImpendingDeletionText({ workspace }))}>
-        <ImpendingDeletionText workspace={workspace} />
+      {/* <DormantDeletionText/> determines its own visibility */}
+      <Cond condition={Boolean(DormantDeletionText({ workspace }))}>
+        <DormantDeletionText workspace={workspace} />
       </Cond>
       <Cond>
         <span
@@ -63,8 +81,19 @@ export const WorkspaceStatusText: FC<
         </span>
       </Cond>
     </ChooseOne>
-  )
-}
+  );
+};
+
+const FailureTooltip = styled(({ className, ...props }: TooltipProps) => (
+  <Tooltip {...props} classes={{ popper: className }} />
+))(({ theme }) => ({
+  [`& .${tooltipClasses.tooltip}`]: {
+    backgroundColor: theme.palette.background.paperLight,
+    border: `1px solid ${theme.palette.divider}`,
+    fontSize: 12,
+    padding: theme.spacing(1, 1.25),
+  },
+}));
 
 const useStyles = makeStyles((theme) => ({
   root: { fontWeight: 600 },
@@ -89,4 +118,4 @@ const useStyles = makeStyles((theme) => ({
   "type-secondary": {
     color: theme.palette.text.secondary,
   },
-}))
+}));
diff --git a/site/src/contexts/ProxyContext.test.tsx b/site/src/contexts/ProxyContext.test.tsx
index fec66e71e31d3..d2642418bf17a 100644
--- a/site/src/contexts/ProxyContext.test.tsx
+++ b/site/src/contexts/ProxyContext.test.tsx
@@ -3,34 +3,34 @@ import {
   MockWorkspaceProxies,
   MockHealthyWildWorkspaceProxy,
   MockUnhealthyWildWorkspaceProxy,
-} from "testHelpers/entities"
+} from "testHelpers/entities";
 import {
   getPreferredProxy,
   ProxyProvider,
   saveUserSelectedProxy,
   useProxy,
-} from "./ProxyContext"
-import * as ProxyLatency from "./useProxyLatency"
+} from "./ProxyContext";
+import * as ProxyLatency from "./useProxyLatency";
 import {
   renderWithAuth,
   waitForLoaderToBeRemoved,
-} from "testHelpers/renderHelpers"
-import { screen } from "@testing-library/react"
-import { server } from "testHelpers/server"
-import { rest } from "msw"
-import { Region } from "api/typesGenerated"
-import "testHelpers/localstorage"
-import userEvent from "@testing-library/user-event"
+} from "testHelpers/renderHelpers";
+import { screen } from "@testing-library/react";
+import { server } from "testHelpers/server";
+import { rest } from "msw";
+import { Region } from "api/typesGenerated";
+import "testHelpers/localstorage";
+import userEvent from "@testing-library/user-event";
 
 // Mock useProxyLatency to use a hard-coded latency. 'jest.mock' must be called
 // here and not inside a unit test.
 jest.mock("contexts/useProxyLatency", () => ({
   useProxyLatency: () => {
-    return { proxyLatencies: hardCodedLatencies, refetch: jest.fn() }
+    return { proxyLatencies: hardCodedLatencies, refetch: jest.fn() };
   },
-}))
+}));
 
-let hardCodedLatencies: Record<string, ProxyLatency.ProxyLatencyReport> = {}
+let hardCodedLatencies: Record<string, ProxyLatency.ProxyLatencyReport> = {};
 
 // fakeLatency is a helper function to make a Latency report from just a number.
 const fakeLatency = (ms: number): ProxyLatency.ProxyLatencyReport => {
@@ -38,8 +38,8 @@ const fakeLatency = (ms: number): ProxyLatency.ProxyLatencyReport => {
     latencyMS: ms,
     accurate: true,
     at: new Date(),
-  }
-}
+  };
+};
 
 describe("ProxyContextGetURLs", () => {
   it.each([
@@ -115,14 +115,14 @@ describe("ProxyContextGetURLs", () => {
       preferredPathAppURL,
       preferredWildcardHostname,
     ) => {
-      const preferred = getPreferredProxy(regions, selected, latencies)
-      expect(preferred.preferredPathAppURL).toBe(preferredPathAppURL)
+      const preferred = getPreferredProxy(regions, selected, latencies);
+      expect(preferred.preferredPathAppURL).toBe(preferredPathAppURL);
       expect(preferred.preferredWildcardHostname).toBe(
         preferredWildcardHostname,
-      )
+      );
     },
-  )
-})
+  );
+});
 
 const TestingComponent = () => {
   return renderWithAuth(
@@ -133,13 +133,13 @@ const TestingComponent = () => {
       route: `/proxies`,
       path: "/proxies",
     },
-  )
-}
+  );
+};
 
 // TestingScreen just mounts some components that we can check in the unit test.
 const TestingScreen = () => {
   const { proxy, userProxy, isFetched, isLoading, clearProxy, setProxy } =
-    useProxy()
+    useProxy();
   return (
     <>
       <div data-testid="isFetched" title={isFetched.toString()}></div>
@@ -154,59 +154,59 @@ const TestingScreen = () => {
       <button
         data-testid="userSelectProxy"
         onClick={() => {
-          const data = screen.getByTestId("userSelectProxyData")
+          const data = screen.getByTestId("userSelectProxyData");
           if (data.innerText) {
-            setProxy(JSON.parse(data.innerText))
+            setProxy(JSON.parse(data.innerText));
           }
         }}
       ></button>
     </>
-  )
-}
+  );
+};
 
 interface ProxyContextSelectionTest {
   // Regions is the list of regions to return via the "api" response.
-  regions: Region[]
+  regions: Region[];
   // storageProxy should be the proxy stored in local storage before the
   // component is mounted and context is loaded. This simulates opening a
   // new window with a selection saved from before.
-  storageProxy: Region | undefined
+  storageProxy: Region | undefined;
   // latencies is the hard coded latencies to return. If empty, no latencies
   // are returned.
-  latencies?: Record<string, ProxyLatency.ProxyLatencyReport>
+  latencies?: Record<string, ProxyLatency.ProxyLatencyReport>;
   // afterLoad are actions to take after loading the component, but before
   // assertions. This is useful for simulating user actions.
-  afterLoad?: () => Promise<void>
+  afterLoad?: () => Promise<void>;
 
   // Assert these values.
   // expProxyID is the proxyID returned to be used.
-  expProxyID: string
+  expProxyID: string;
   // expUserProxyID is the user's stored selection.
-  expUserProxyID?: string
+  expUserProxyID?: string;
 }
 
 describe("ProxyContextSelection", () => {
   beforeEach(() => {
-    window.localStorage.clear()
-  })
+    window.localStorage.clear();
+  });
 
   // A way to simulate a user clearing the proxy selection.
   const clearProxyAction = async (): Promise<void> => {
-    const user = userEvent.setup()
-    const clearProxyButton = screen.getByTestId("clearProxy")
-    await user.click(clearProxyButton)
-  }
+    const user = userEvent.setup();
+    const clearProxyButton = screen.getByTestId("clearProxy");
+    await user.click(clearProxyButton);
+  };
 
   const userSelectProxy = (proxy: Region): (() => Promise<void>) => {
     return async (): Promise<void> => {
-      const user = userEvent.setup()
-      const selectData = screen.getByTestId("userSelectProxyData")
-      selectData.innerText = JSON.stringify(proxy)
+      const user = userEvent.setup();
+      const selectData = screen.getByTestId("userSelectProxyData");
+      selectData.innerText = JSON.stringify(proxy);
 
-      const selectProxyButton = screen.getByTestId("userSelectProxy")
-      await user.click(selectProxyButton)
-    }
-  }
+      const selectProxyButton = screen.getByTestId("userSelectProxy");
+      await user.click(selectProxyButton);
+    };
+  };
 
   it.each([
     // Not latency behavior
@@ -343,11 +343,11 @@ describe("ProxyContextSelection", () => {
       },
     ) => {
       // Mock the latencies
-      hardCodedLatencies = latencies
+      hardCodedLatencies = latencies;
 
       // Initial selection if present
       if (storageProxy) {
-        saveUserSelectedProxy(storageProxy)
+        saveUserSelectedProxy(storageProxy);
       }
 
       // Mock the API response
@@ -358,7 +358,7 @@ describe("ProxyContextSelection", () => {
             ctx.json({
               regions: regions,
             }),
-          )
+          );
         }),
         rest.get("/api/v2/workspaceproxies", async (req, res, ctx) => {
           return res(
@@ -366,29 +366,29 @@ describe("ProxyContextSelection", () => {
             ctx.json({
               regions: regions,
             }),
-          )
+          );
         }),
-      )
+      );
 
-      TestingComponent()
-      await waitForLoaderToBeRemoved()
+      TestingComponent();
+      await waitForLoaderToBeRemoved();
 
       if (afterLoad) {
-        await afterLoad()
+        await afterLoad();
       }
 
       await screen.findByTestId("isFetched").then((x) => {
-        expect(x.title).toBe("true")
-      })
+        expect(x.title).toBe("true");
+      });
       await screen.findByTestId("isLoading").then((x) => {
-        expect(x.title).toBe("false")
-      })
+        expect(x.title).toBe("false");
+      });
       await screen.findByTestId("preferredProxy").then((x) => {
-        expect(x.title).toBe(expSelectedProxyID)
-      })
+        expect(x.title).toBe(expSelectedProxyID);
+      });
       await screen.findByTestId("userProxy").then((x) => {
-        expect(x.title).toBe(expUserProxyID || "")
-      })
+        expect(x.title).toBe(expUserProxyID || "");
+      });
     },
-  )
-})
+  );
+});
diff --git a/site/src/contexts/ProxyContext.tsx b/site/src/contexts/ProxyContext.tsx
index 152b0fbd0c997..7992cb8bafc2e 100644
--- a/site/src/contexts/ProxyContext.tsx
+++ b/site/src/contexts/ProxyContext.tsx
@@ -1,7 +1,7 @@
-import { useQuery } from "@tanstack/react-query"
-import { getWorkspaceProxies, getWorkspaceProxyRegions } from "api/api"
-import { Region, WorkspaceProxy } from "api/typesGenerated"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
+import { useQuery } from "react-query";
+import { getWorkspaceProxies, getWorkspaceProxyRegions } from "api/api";
+import { Region, WorkspaceProxy } from "api/typesGenerated";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
 import {
   createContext,
   FC,
@@ -10,9 +10,9 @@ import {
   useContext,
   useEffect,
   useState,
-} from "react"
-import { ProxyLatencyReport, useProxyLatency } from "./useProxyLatency"
-import { usePermissions } from "hooks/usePermissions"
+} from "react";
+import { ProxyLatencyReport, useProxyLatency } from "./useProxyLatency";
+import { usePermissions } from "hooks/usePermissions";
 
 export interface ProxyContextValue {
   // proxy is **always** the workspace proxy that should be used.
@@ -27,13 +27,13 @@ export interface ProxyContextValue {
   // The values 'proxy.preferredPathAppURL' and 'proxy.preferredWildcardHostname' can
   // always be used even if 'proxy.selectedProxy' is undefined. These values are sourced from
   // the 'selectedProxy', but default to relative paths if the 'selectedProxy' is undefined.
-  proxy: PreferredProxy
+  proxy: PreferredProxy;
 
   // userProxy is always the proxy the user has selected. This value comes from local storage.
   // The value `proxy` should always be used instead of `userProxy`. `userProxy` is only exposed
   // so the caller can determine if the proxy being used is the user's selected proxy, or if it
   // was auto selected based on some other criteria.
-  userProxy?: Region
+  userProxy?: Region;
 
   // proxies is the list of proxies returned by coderd. This is fetched async.
   // isFetched, isLoading, and error are used to track the state of the async call.
@@ -42,25 +42,25 @@ export interface ProxyContextValue {
   // WorkspaceProxy[] is returned if the user is an admin. WorkspaceProxy extends Region with
   //  more information about the proxy and the status. More information includes the error message if
   //  the proxy is unhealthy.
-  proxies?: Region[] | WorkspaceProxy[]
+  proxies?: Region[] | WorkspaceProxy[];
   // isFetched is true when the 'proxies' api call is complete.
-  isFetched: boolean
-  isLoading: boolean
-  error?: unknown
+  isFetched: boolean;
+  isLoading: boolean;
+  error?: unknown;
   // proxyLatencies is a map of proxy id to latency report. If the proxyLatencies[proxy.id] is undefined
   // then the latency has not been fetched yet. Calculations happen async for each proxy in the list.
   // Refer to the returned report for a given proxy for more information.
-  proxyLatencies: Record<string, ProxyLatencyReport>
+  proxyLatencies: Record<string, ProxyLatencyReport>;
   // refetchProxyLatencies will trigger refreshing of the proxy latencies. By default the latencies
   // are loaded once.
-  refetchProxyLatencies: () => Date
+  refetchProxyLatencies: () => Date;
   // setProxy is a function that sets the user's selected proxy. This function should
   // only be called if the user is manually selecting a proxy. This value is stored in local
   // storage and will persist across reloads and tabs.
-  setProxy: (selectedProxy: Region) => void
+  setProxy: (selectedProxy: Region) => void;
   // clearProxy is a function that clears the user's selected proxy.
   // If no proxy is selected, then the default proxy will be used.
-  clearProxy: () => void
+  clearProxy: () => void;
 }
 
 interface PreferredProxy {
@@ -68,36 +68,36 @@ interface PreferredProxy {
   // getting the fields such as "display_name" and "id"
   // Do not use the fields 'path_app_url' or 'wildcard_hostname' from this
   // object. Use the preferred fields.
-  proxy: Region | undefined
+  proxy: Region | undefined;
   // PreferredPathAppURL is the URL of the proxy or it is the empty string
   // to indicate using relative paths. To add a path to this:
   //  PreferredPathAppURL + "/path/to/app"
-  preferredPathAppURL: string
+  preferredPathAppURL: string;
   // PreferredWildcardHostname is a hostname that includes a wildcard.
-  preferredWildcardHostname: string
+  preferredWildcardHostname: string;
 }
 
 export const ProxyContext = createContext<ProxyContextValue | undefined>(
   undefined,
-)
+);
 
 /**
  * ProxyProvider interacts with local storage to indicate the preferred workspace proxy.
  */
 export const ProxyProvider: FC<PropsWithChildren> = ({ children }) => {
-  const dashboard = useDashboard()
-  const experimentEnabled = dashboard?.experiments.includes("moons")
+  const dashboard = useDashboard();
+  const experimentEnabled = dashboard?.experiments.includes("moons");
 
   // Using a useState so the caller always has the latest user saved
   // proxy.
-  const [userSavedProxy, setUserSavedProxy] = useState(loadUserSelectedProxy())
+  const [userSavedProxy, setUserSavedProxy] = useState(loadUserSelectedProxy());
 
   // Load the initial state from local storage.
   const [proxy, setProxy] = useState<PreferredProxy>(
     computeUsableURLS(userSavedProxy),
-  )
+  );
 
-  const queryKey = ["get-proxies"]
+  const queryKey = ["get-proxies"];
   // This doesn't seem like an idiomatic way to get react-query to use the
   // initial data without performing an API request on mount, but it works.
   //
@@ -105,29 +105,29 @@ export const ProxyProvider: FC<PropsWithChildren> = ({ children }) => {
   // from the `meta` tag if it exists, and not fetch the regions route.
   const [initialData] = useState(() => {
     // Build info is injected by the Coder server into the HTML document.
-    const regions = document.querySelector("meta[property=regions]")
+    const regions = document.querySelector("meta[property=regions]");
     if (regions) {
-      const rawContent = regions.getAttribute("content")
+      const rawContent = regions.getAttribute("content");
       try {
-        const obj = JSON.parse(rawContent as string)
+        const obj = JSON.parse(rawContent as string);
         if ("regions" in obj) {
-          return obj.regions as Region[]
+          return obj.regions as Region[];
         }
-        return obj as Region[]
+        return obj as Region[];
       } catch (ex) {
         // Ignore this and fetch as normal!
       }
     }
-  })
+  });
 
-  const permissions = usePermissions()
+  const permissions = usePermissions();
   const query = async (): Promise<Region[]> => {
     const endpoint = permissions.editWorkspaceProxies
       ? getWorkspaceProxies
-      : getWorkspaceProxyRegions
-    const resp = await endpoint()
-    return resp.regions
-  }
+      : getWorkspaceProxyRegions;
+    const resp = await endpoint();
+    return resp.regions;
+  };
 
   const {
     data: proxiesResp,
@@ -139,18 +139,18 @@ export const ProxyProvider: FC<PropsWithChildren> = ({ children }) => {
     queryFn: query,
     staleTime: initialData ? Infinity : undefined,
     initialData,
-  })
+  });
 
   // Every time we get a new proxiesResponse, update the latency check
   // to each workspace proxy.
   const { proxyLatencies, refetch: refetchProxyLatencies } =
-    useProxyLatency(proxiesResp)
+    useProxyLatency(proxiesResp);
 
   // updateProxy is a helper function that when called will
   // update the proxy being used.
   const updateProxy = useCallback(() => {
     // Update the saved user proxy for the caller.
-    setUserSavedProxy(loadUserSelectedProxy())
+    setUserSavedProxy(loadUserSelectedProxy());
     setProxy(
       getPreferredProxy(
         proxiesResp ?? [],
@@ -160,15 +160,15 @@ export const ProxyProvider: FC<PropsWithChildren> = ({ children }) => {
         // to behave poorly.
         false,
       ),
-    )
-  }, [proxiesResp, proxyLatencies])
+    );
+  }, [proxiesResp, proxyLatencies]);
 
   // This useEffect ensures the proxy to be used is updated whenever the state changes.
   // This includes proxies being loaded, latencies being calculated, and the user selecting a proxy.
   useEffect(() => {
-    updateProxy()
+    updateProxy();
     // eslint-disable-next-line react-hooks/exhaustive-deps -- Only update if the source data changes
-  }, [proxiesResp, proxyLatencies])
+  }, [proxiesResp, proxyLatencies]);
 
   return (
     <ProxyContext.Provider
@@ -191,31 +191,31 @@ export const ProxyProvider: FC<PropsWithChildren> = ({ children }) => {
         // These functions are exposed to allow the user to select a proxy.
         setProxy: (proxy: Region) => {
           // Save to local storage to persist the user's preference across reloads
-          saveUserSelectedProxy(proxy)
+          saveUserSelectedProxy(proxy);
           // Update the selected proxy
-          updateProxy()
+          updateProxy();
         },
         clearProxy: () => {
           // Clear the user's selection from local storage.
-          clearUserSelectedProxy()
-          updateProxy()
+          clearUserSelectedProxy();
+          updateProxy();
         },
       }}
     >
       {children}
     </ProxyContext.Provider>
-  )
-}
+  );
+};
 
 export const useProxy = (): ProxyContextValue => {
-  const context = useContext(ProxyContext)
+  const context = useContext(ProxyContext);
 
   if (!context) {
-    throw new Error("useProxy should be used inside of <ProxyProvider />")
+    throw new Error("useProxy should be used inside of <ProxyProvider />");
   }
 
-  return context
-}
+  return context;
+};
 
 /**
  * getPreferredProxy is a helper function to calculate the urls to use for a given proxy configuration. By default, it is
@@ -237,60 +237,60 @@ export const getPreferredProxy = (
   // we should default to the primary.
   selectedProxy = proxies.find(
     (proxy) => selectedProxy && proxy.id === selectedProxy.id,
-  )
+  );
 
   // If no proxy is selected, or the selected proxy is unhealthy default to the primary proxy.
   if (!selectedProxy || !selectedProxy.healthy) {
     // By default, use the primary proxy.
-    selectedProxy = proxies.find((proxy) => proxy.name === "primary")
+    selectedProxy = proxies.find((proxy) => proxy.name === "primary");
 
     // If we have latencies, then attempt to use the best proxy by latency instead.
-    const best = selectByLatency(proxies, latencies)
+    const best = selectByLatency(proxies, latencies);
     if (autoSelectBasedOnLatency && best) {
-      selectedProxy = best
+      selectedProxy = best;
     }
   }
 
-  return computeUsableURLS(selectedProxy)
-}
+  return computeUsableURLS(selectedProxy);
+};
 
 const selectByLatency = (
   proxies: Region[],
   latencies?: Record<string, ProxyLatencyReport>,
 ): Region | undefined => {
   if (!latencies) {
-    return undefined
+    return undefined;
   }
 
   const proxyMap = proxies.reduce(
     (acc, proxy) => {
-      acc[proxy.id] = proxy
-      return acc
+      acc[proxy.id] = proxy;
+      return acc;
     },
     {} as Record<string, Region>,
-  )
+  );
 
   const best = Object.keys(latencies)
     .map((proxyId) => {
       return {
         id: proxyId,
         ...latencies[proxyId],
-      }
+      };
     })
     // If the proxy is not in our list, or it is unhealthy, ignore it.
     .filter((latency) => proxyMap[latency.id]?.healthy)
     .sort((a, b) => a.latencyMS - b.latencyMS)
-    .at(0)
+    .at(0);
 
   // Found a new best, use it!
   if (best) {
-    const bestProxy = proxies.find((proxy) => proxy.id === best.id)
+    const bestProxy = proxies.find((proxy) => proxy.id === best.id);
     // Default to w/e it was before
-    return bestProxy
+    return bestProxy;
   }
 
-  return undefined
-}
+  return undefined;
+};
 
 const computeUsableURLS = (proxy?: Region): PreferredProxy => {
   if (!proxy) {
@@ -300,13 +300,13 @@ const computeUsableURLS = (proxy?: Region): PreferredProxy => {
       proxy: undefined,
       preferredPathAppURL: "",
       preferredWildcardHostname: "",
-    }
+    };
   }
 
-  let pathAppURL = proxy?.path_app_url.replace(/\/$/, "")
+  let pathAppURL = proxy?.path_app_url.replace(/\/$/, "");
   // Primary proxy uses relative paths. It's the only exception.
   if (proxy.name === "primary") {
-    pathAppURL = ""
+    pathAppURL = "";
   }
 
   return {
@@ -314,24 +314,24 @@ const computeUsableURLS = (proxy?: Region): PreferredProxy => {
     // Trim trailing slashes to be consistent
     preferredPathAppURL: pathAppURL,
     preferredWildcardHostname: proxy.wildcard_hostname,
-  }
-}
+  };
+};
 
 // Local storage functions
 
 export const clearUserSelectedProxy = (): void => {
-  window.localStorage.removeItem("user-selected-proxy")
-}
+  window.localStorage.removeItem("user-selected-proxy");
+};
 
 export const saveUserSelectedProxy = (saved: Region): void => {
-  window.localStorage.setItem("user-selected-proxy", JSON.stringify(saved))
-}
+  window.localStorage.setItem("user-selected-proxy", JSON.stringify(saved));
+};
 
 export const loadUserSelectedProxy = (): Region | undefined => {
-  const str = localStorage.getItem("user-selected-proxy")
+  const str = localStorage.getItem("user-selected-proxy");
   if (!str) {
-    return undefined
+    return undefined;
   }
 
-  return JSON.parse(str)
-}
+  return JSON.parse(str);
+};
diff --git a/site/src/contexts/useProxyLatency.ts b/site/src/contexts/useProxyLatency.ts
index 8c6e28f235fb0..dbf689f368c32 100644
--- a/site/src/contexts/useProxyLatency.ts
+++ b/site/src/contexts/useProxyLatency.ts
@@ -1,27 +1,27 @@
-import { Region } from "api/typesGenerated"
-import { useEffect, useReducer, useState } from "react"
-import PerformanceObserver from "@fastly/performance-observer-polyfill"
-import axios from "axios"
-import { generateRandomString } from "utils/random"
+import { Region } from "api/typesGenerated";
+import { useEffect, useReducer, useState } from "react";
+import PerformanceObserver from "@fastly/performance-observer-polyfill";
+import axios from "axios";
+import { generateRandomString } from "utils/random";
 
-const proxyIntervalSeconds = 30 // seconds
+const proxyIntervalSeconds = 30; // seconds
 
 export interface ProxyLatencyReport {
   // accurate identifies if the latency was calculated using the
   // PerformanceResourceTiming API. If this is false, then the
   // latency is calculated using the total duration of the request
   // and will be off by a good margin.
-  accurate: boolean
-  latencyMS: number
+  accurate: boolean;
+  latencyMS: number;
   // at is when the latency was recorded.
-  at: Date
+  at: Date;
 }
 
 interface ProxyLatencyAction {
-  proxyID: string
+  proxyID: string;
   // cached indicates if the latency was loaded from a cache (local storage)
-  cached: boolean
-  report: ProxyLatencyReport
+  cached: boolean;
+  report: ProxyLatencyReport;
 }
 
 const proxyLatenciesReducer = (
@@ -33,56 +33,56 @@ const proxyLatenciesReducer = (
   return {
     ...state,
     [action.proxyID]: action.report,
-  }
-}
+  };
+};
 
 export const useProxyLatency = (
   proxies?: Region[],
 ): {
   // Refetch can be called to refetch the proxy latencies.
   // Until the new values are loaded, the old values will still be used.
-  refetch: () => Date
-  proxyLatencies: Record<string, ProxyLatencyReport>
+  refetch: () => Date;
+  proxyLatencies: Record<string, ProxyLatencyReport>;
 } => {
   // maxStoredLatencies is the maximum number of latencies to store per proxy in local storage.
-  let maxStoredLatencies = 1
+  let maxStoredLatencies = 1;
   // The reason we pull this from local storage is so for development purposes, a user can manually
   // set a larger number to collect data in their normal usage. This data can later be analyzed to come up
   // with some better magic numbers.
   const maxStoredLatenciesVar = localStorage.getItem(
     "workspace-proxy-latencies-max",
-  )
+  );
   if (maxStoredLatenciesVar) {
-    maxStoredLatencies = Number(maxStoredLatenciesVar)
+    maxStoredLatencies = Number(maxStoredLatenciesVar);
   }
 
   const [proxyLatencies, dispatchProxyLatencies] = useReducer(
     proxyLatenciesReducer,
     {},
-  )
+  );
 
   // This latestFetchRequest is used to trigger a refetch of the proxy latencies.
   const [latestFetchRequest, setLatestFetchRequest] = useState(
     // The initial state is the current time minus the interval. Any proxies that have a latency after this
     // in the cache are still valid.
     new Date(new Date().getTime() - proxyIntervalSeconds * 1000).toISOString(),
-  )
+  );
 
   // Refetch will always set the latestFetchRequest to the current time, making all the cached latencies
   // stale and triggering a refetch of all proxies in the list.
   const refetch = () => {
-    const d = new Date()
-    setLatestFetchRequest(d.toISOString())
-    return d
-  }
+    const d = new Date();
+    setLatestFetchRequest(d.toISOString());
+    return d;
+  };
 
   // Only run latency updates when the proxies change.
   useEffect(() => {
     if (!proxies) {
-      return
+      return;
     }
 
-    const storedLatencies = loadStoredLatencies()
+    const storedLatencies = loadStoredLatencies();
 
     // proxyMap is a map of the proxy path_app_url to the proxy object.
     // This is for the observer to know which requests are important to
@@ -91,7 +91,7 @@ export const useProxyLatency = (
       (acc, proxy) => {
         // Only run the latency check on healthy proxies.
         if (!proxy.healthy) {
-          return acc
+          return acc;
         }
 
         // Do not run latency checks if a cached check exists below the latestFetchRequest Date.
@@ -103,10 +103,10 @@ export const useProxyLatency = (
           storedLatencies[proxy.id] &&
           storedLatencies[proxy.id].length > 0
         ) {
-          const fetchRequestDate = new Date(latestFetchRequest)
+          const fetchRequestDate = new Date(latestFetchRequest);
           const latest = storedLatencies[proxy.id].reduce((prev, next) =>
             prev.at > next.at ? prev : next,
-          )
+          );
 
           if (latest && latest.at > fetchRequestDate) {
             // dispatch the cached latency. This latency already went through the
@@ -115,8 +115,8 @@ export const useProxyLatency = (
               proxyID: proxy.id,
               cached: true,
               report: latest,
-            })
-            return acc
+            });
+            return acc;
           }
         }
 
@@ -125,12 +125,12 @@ export const useProxyLatency = (
         const url = new URL(
           `/latency-check?cache_bust=${generateRandomString(6)}`,
           proxy.path_app_url,
-        )
-        acc[url.toString()] = proxy
-        return acc
+        );
+        acc[url.toString()] = proxy;
+        return acc;
       },
       {} as Record<string, Region>,
-    )
+    );
 
     // dispatchProxyLatenciesGuarded will assign the latency to the proxy
     // via the reducer. But it will only do so if the performance entry is
@@ -138,36 +138,36 @@ export const useProxyLatency = (
     const dispatchProxyLatenciesGuarded = (entry: PerformanceEntry) => {
       if (entry.entryType !== "resource") {
         // We should never get these, but just in case.
-        return
+        return;
       }
 
       // The entry.name is the url of the request.
-      const check = proxyChecks[entry.name]
+      const check = proxyChecks[entry.name];
       if (!check) {
         // This is not a proxy request, so ignore it.
-        return
+        return;
       }
 
       // These docs are super useful.
       // https://developer.mozilla.org/en-US/docs/Web/API/Performance_API/Resource_timing
-      let latencyMS = 0
-      let accurate = false
+      let latencyMS = 0;
+      let accurate = false;
       if (
         "requestStart" in entry &&
         (entry as PerformanceResourceTiming).requestStart !== 0
       ) {
         // This is the preferred logic to get the latency.
-        const timingEntry = entry as PerformanceResourceTiming
-        latencyMS = timingEntry.responseStart - timingEntry.requestStart
-        accurate = true
+        const timingEntry = entry as PerformanceResourceTiming;
+        latencyMS = timingEntry.responseStart - timingEntry.requestStart;
+        accurate = true;
       } else {
         // This is the total duration of the request and will be off by a good margin.
         // This is a fallback if the better timing is not available.
         // eslint-disable-next-line no-console -- We can remove this when we display the "accurate" bool on the UI
         console.log(
           `Using fallback latency calculation for "${entry.name}". Latency will be incorrect and larger then actual.`,
-        )
-        latencyMS = entry.duration
+        );
+        latencyMS = entry.duration;
       }
       const update = {
         proxyID: check.id,
@@ -177,25 +177,25 @@ export const useProxyLatency = (
           accurate,
           at: new Date(),
         },
-      }
-      dispatchProxyLatencies(update)
+      };
+      dispatchProxyLatencies(update);
       // Also save to local storage to persist the latency across page refreshes.
-      updateStoredLatencies(update)
+      updateStoredLatencies(update);
 
-      return
-    }
+      return;
+    };
 
     // Start a new performance observer to record of all the requests
     // to the proxies.
     const observer = new PerformanceObserver((list) => {
       // If we get entries via this callback, then dispatch the events to the latency reducer.
       list.getEntries().forEach((entry) => {
-        dispatchProxyLatenciesGuarded(entry)
-      })
-    })
+        dispatchProxyLatenciesGuarded(entry);
+      });
+    });
 
     // The resource requests include xmlhttp requests.
-    observer.observe({ entryTypes: ["resource"] })
+    observer.observe({ entryTypes: ["resource"] });
 
     const proxyRequests = Object.keys(proxyChecks).map((latencyURL) => {
       return axios.get(latencyURL, {
@@ -204,8 +204,8 @@ export const useProxyLatency = (
         // We want to force a preflight request.
         // https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests
         headers: { "X-LATENCY-CHECK": "true" },
-      })
-    })
+      });
+    });
 
     // When all the proxy requests finish
     void Promise.all(proxyRequests)
@@ -215,22 +215,22 @@ export const useProxyLatency = (
         // We want to call this before we disconnect the observer to make sure we get all the
         // proxy requests recorded.
         observer.takeRecords().forEach((entry) => {
-          dispatchProxyLatenciesGuarded(entry)
-        })
+          dispatchProxyLatenciesGuarded(entry);
+        });
         // At this point, we can be confident that all the proxy requests have been recorded
         // via the performance observer. So we can disconnect the observer.
-        observer.disconnect()
+        observer.disconnect();
 
         // Local storage cleanup
-        garbageCollectStoredLatencies(proxies, maxStoredLatencies)
-      })
-  }, [proxies, latestFetchRequest, maxStoredLatencies])
+        garbageCollectStoredLatencies(proxies, maxStoredLatencies);
+      });
+  }, [proxies, latestFetchRequest, maxStoredLatencies]);
 
   return {
     proxyLatencies,
     refetch,
-  }
-}
+  };
+};
 
 // Local storage functions
 
@@ -239,28 +239,28 @@ export const useProxyLatency = (
 // If a single request is slow, we want to omit that latency check, and go with
 // a more accurate latency check.
 const loadStoredLatencies = (): Record<string, ProxyLatencyReport[]> => {
-  const str = localStorage.getItem("workspace-proxy-latencies")
+  const str = localStorage.getItem("workspace-proxy-latencies");
   if (!str) {
-    return {}
+    return {};
   }
 
   return JSON.parse(str, (key, value) => {
     // By default json loads dates as strings. We want to convert them back to 'Date's.
     if (key === "at") {
-      return new Date(value)
+      return new Date(value);
     }
-    return value
-  })
-}
+    return value;
+  });
+};
 
 const updateStoredLatencies = (action: ProxyLatencyAction): void => {
-  const latencies = loadStoredLatencies()
-  const reports = latencies[action.proxyID] || []
+  const latencies = loadStoredLatencies();
+  const reports = latencies[action.proxyID] || [];
 
-  reports.push(action.report)
-  latencies[action.proxyID] = reports
-  localStorage.setItem("workspace-proxy-latencies", JSON.stringify(latencies))
-}
+  reports.push(action.report);
+  latencies[action.proxyID] = reports;
+  localStorage.setItem("workspace-proxy-latencies", JSON.stringify(latencies));
+};
 
 // garbageCollectStoredLatencies will remove any latencies that are older then 1 week or latencies of proxies
 // that no longer exist. This is intended to keep the size of local storage down.
@@ -268,12 +268,17 @@ const garbageCollectStoredLatencies = (
   regions: Region[],
   maxStored: number,
 ): void => {
-  const latencies = loadStoredLatencies()
-  const now = Date.now()
-  const cleaned = cleanupLatencies(latencies, regions, new Date(now), maxStored)
-
-  localStorage.setItem("workspace-proxy-latencies", JSON.stringify(cleaned))
-}
+  const latencies = loadStoredLatencies();
+  const now = Date.now();
+  const cleaned = cleanupLatencies(
+    latencies,
+    regions,
+    new Date(now),
+    maxStored,
+  );
+
+  localStorage.setItem("workspace-proxy-latencies", JSON.stringify(cleaned));
+};
 
 const cleanupLatencies = (
   stored: Record<string, ProxyLatencyReport[]>,
@@ -283,17 +288,17 @@ const cleanupLatencies = (
 ): Record<string, ProxyLatencyReport[]> => {
   Object.keys(stored).forEach((proxyID) => {
     if (!regions.find((region) => region.id === proxyID)) {
-      delete stored[proxyID]
-      return
+      delete stored[proxyID];
+      return;
     }
-    const reports = stored[proxyID]
-    const nowMS = now.getTime()
+    const reports = stored[proxyID];
+    const nowMS = now.getTime();
     stored[proxyID] = reports.filter((report) => {
       // Only keep the reports that are less then 1 week old.
-      return new Date(report.at).getTime() > nowMS - 1000 * 60 * 60 * 24 * 7
-    })
+      return new Date(report.at).getTime() > nowMS - 1000 * 60 * 60 * 24 * 7;
+    });
     // Only keep the 5 latest
-    stored[proxyID] = stored[proxyID].slice(-1 * maxStored)
-  })
-  return stored
-}
+    stored[proxyID] = stored[proxyID].slice(-1 * maxStored);
+  });
+  return stored;
+};
diff --git a/site/src/hooks/debounce.test.ts b/site/src/hooks/debounce.test.ts
new file mode 100644
index 0000000000000..5a8ed78c026aa
--- /dev/null
+++ b/site/src/hooks/debounce.test.ts
@@ -0,0 +1,193 @@
+import { renderHook } from "@testing-library/react";
+import { useDebouncedFunction, useDebouncedValue } from "./debounce";
+
+beforeAll(() => {
+  jest.useFakeTimers();
+  jest.spyOn(global, "setTimeout");
+});
+
+afterAll(() => {
+  jest.useRealTimers();
+  jest.clearAllMocks();
+});
+
+// Most UI tests should be structure from the user's experience, but just
+// because these are more abstract, general-purpose hooks, it seemed harder to
+// do that. Had to bring in some mocks
+function renderDebouncedValue<T = unknown>(value: T, time: number) {
+  return renderHook(
+    ({ value, time }: { value: T; time: number }) => {
+      return useDebouncedValue(value, time);
+    },
+    {
+      initialProps: { value, time },
+    },
+  );
+}
+
+function renderDebouncedFunction<Args extends unknown[]>(
+  callbackArg: (...args: Args) => void | Promise<void>,
+  time: number,
+) {
+  return renderHook(
+    ({ callback, time }: { callback: typeof callbackArg; time: number }) => {
+      return useDebouncedFunction<Args>(callback, time);
+    },
+    {
+      initialProps: { callback: callbackArg, time },
+    },
+  );
+}
+
+describe(`${useDebouncedValue.name}`, () => {
+  it("Should immediately return out the exact same value (by reference) on mount", () => {
+    const value = {};
+    const { result } = renderDebouncedValue(value, 2000);
+
+    expect(result.current).toBe(value);
+    expect.hasAssertions();
+  });
+
+  it("Should not immediately resync state as the hook re-renders with new value argument", async () => {
+    let value = 0;
+    const time = 5000;
+
+    const { result, rerender } = renderDebouncedValue(value, time);
+    expect(result.current).toEqual(0);
+
+    for (let i = 1; i <= 5; i++) {
+      setTimeout(() => {
+        value++;
+        rerender({ value, time });
+      }, i * 100);
+    }
+
+    await jest.advanceTimersByTimeAsync(time - 100);
+    expect(result.current).toEqual(0);
+    expect.hasAssertions();
+  });
+
+  it("Should resync after specified milliseconds pass with no change to arguments", async () => {
+    const initialValue = false;
+    const time = 5000;
+
+    const { result, rerender } = renderDebouncedValue(initialValue, time);
+    expect(result.current).toEqual(false);
+
+    rerender({ value: !initialValue, time });
+    await jest.runAllTimersAsync();
+
+    expect(result.current).toEqual(true);
+    expect.hasAssertions();
+  });
+});
+
+describe(`${useDebouncedFunction.name}`, () => {
+  describe("hook", () => {
+    it("Should provide stable function references across re-renders", () => {
+      const time = 5000;
+      const { result, rerender } = renderDebouncedFunction(jest.fn(), time);
+
+      const { debounced: oldDebounced, cancelDebounce: oldCancel } =
+        result.current;
+
+      rerender({ callback: jest.fn(), time });
+      const { debounced: newDebounced, cancelDebounce: newCancel } =
+        result.current;
+
+      expect(oldDebounced).toBe(newDebounced);
+      expect(oldCancel).toBe(newCancel);
+      expect.hasAssertions();
+    });
+
+    it("Resets any pending debounces if the timer argument changes", async () => {
+      const time = 5000;
+      let count = 0;
+      const incrementCount = () => {
+        count++;
+      };
+
+      const { result, rerender } = renderDebouncedFunction(
+        incrementCount,
+        time,
+      );
+
+      result.current.debounced();
+      rerender({ callback: incrementCount, time: time + 1 });
+
+      await jest.runAllTimersAsync();
+      expect(count).toEqual(0);
+      expect.hasAssertions();
+    });
+  });
+
+  describe("debounced function", () => {
+    it("Resolve the debounce after specified milliseconds pass with no other calls", async () => {
+      let value = false;
+      const { result } = renderDebouncedFunction(() => {
+        value = !value;
+      }, 100);
+
+      result.current.debounced();
+
+      await jest.runOnlyPendingTimersAsync();
+      expect(value).toBe(true);
+      expect.hasAssertions();
+    });
+
+    it("Always uses the most recent callback argument passed in (even if it switches while a debounce is queued)", async () => {
+      let count = 0;
+      const time = 500;
+
+      const { result, rerender } = renderDebouncedFunction(() => {
+        count = 1;
+      }, time);
+
+      result.current.debounced();
+      rerender({
+        callback: () => {
+          count = 9999;
+        },
+        time,
+      });
+
+      await jest.runAllTimersAsync();
+      expect(count).toEqual(9999);
+      expect.hasAssertions();
+    });
+
+    it("Should reset the debounce timer with repeated calls to the method", async () => {
+      let count = 0;
+      const { result } = renderDebouncedFunction(() => {
+        count++;
+      }, 2000);
+
+      for (let i = 0; i < 10; i++) {
+        setTimeout(() => {
+          result.current.debounced();
+        }, i * 100);
+      }
+
+      await jest.runAllTimersAsync();
+      expect(count).toBe(1);
+      expect.hasAssertions();
+    });
+  });
+
+  describe("cancelDebounce function", () => {
+    it("Should be able to cancel a pending debounce", async () => {
+      let count = 0;
+      const { result } = renderDebouncedFunction(() => {
+        count++;
+      }, 2000);
+
+      const { debounced, cancelDebounce } = result.current;
+      debounced();
+      cancelDebounce();
+
+      await jest.runAllTimersAsync();
+      expect(count).toEqual(0);
+      expect.hasAssertions();
+    });
+  });
+});
diff --git a/site/src/hooks/debounce.ts b/site/src/hooks/debounce.ts
new file mode 100644
index 0000000000000..38eea91da9933
--- /dev/null
+++ b/site/src/hooks/debounce.ts
@@ -0,0 +1,99 @@
+/**
+ * @file Defines hooks for created debounced versions of functions and arbitrary
+ * values.
+ *
+ * It is not safe to call a general-purpose debounce utility inside a React
+ * render. It will work on the initial render, but the memory reference for the
+ * value will change on re-renders. Most debounce functions create a "stateful"
+ * version of a function by leveraging closure; but by calling it repeatedly,
+ * you create multiple "pockets" of state, rather than a centralized one.
+ *
+ * Debounce utilities can make sense if they can be called directly outside the
+ * component or in a useEffect call, though.
+ */
+import { useCallback, useEffect, useRef, useState } from "react";
+
+type useDebouncedFunctionReturn<Args extends unknown[]> = Readonly<{
+  debounced: (...args: Args) => void;
+
+  // Mainly here to make interfacing with useEffect cleanup functions easier
+  cancelDebounce: () => void;
+}>;
+
+/**
+ * Creates a debounce function that is resilient to React re-renders, as well as
+ * a function for canceling a pending debounce.
+ *
+ * The returned-out functions will maintain the same memory references, but the
+ * debounce function will always "see" the most recent versions of the arguments
+ * passed into the hook, and use them accordingly.
+ *
+ * If the debounce time changes while a callback has been queued to fire, the
+ * callback will be canceled completely. You will need to restart the debounce
+ * process by calling the returned-out function again.
+ */
+export function useDebouncedFunction<
+  // Parameterizing on the args instead of the whole callback function type to
+  // avoid type contra-variance issues
+  Args extends unknown[] = unknown[],
+>(
+  callback: (...args: Args) => void | Promise<void>,
+  debounceTimeMs: number,
+): useDebouncedFunctionReturn<Args> {
+  const timeoutIdRef = useRef<number | null>(null);
+  const cancelDebounce = useCallback(() => {
+    if (timeoutIdRef.current !== null) {
+      window.clearTimeout(timeoutIdRef.current);
+    }
+
+    timeoutIdRef.current = null;
+  }, []);
+
+  const debounceTimeRef = useRef(debounceTimeMs);
+  useEffect(() => {
+    cancelDebounce();
+    debounceTimeRef.current = debounceTimeMs;
+  }, [cancelDebounce, debounceTimeMs]);
+
+  const callbackRef = useRef(callback);
+  useEffect(() => {
+    callbackRef.current = callback;
+  }, [callback]);
+
+  // Returned-out function will always be synchronous, even if the callback arg
+  // is async. Seemed dicey to try awaiting a genericized operation that can and
+  // will likely be canceled repeatedly
+  const debounced = useCallback(
+    (...args: Args): void => {
+      cancelDebounce();
+
+      timeoutIdRef.current = window.setTimeout(
+        () => void callbackRef.current(...args),
+        debounceTimeRef.current,
+      );
+    },
+    [cancelDebounce],
+  );
+
+  return { debounced, cancelDebounce } as const;
+}
+
+/**
+ * Takes any value, and returns out a debounced version of it.
+ */
+export function useDebouncedValue<T = unknown>(
+  value: T,
+  debounceTimeMs: number,
+): T {
+  const [debouncedValue, setDebouncedValue] = useState(value);
+
+  useEffect(() => {
+    const timeoutId = window.setTimeout(() => {
+      setDebouncedValue(value);
+    }, debounceTimeMs);
+
+    return () => window.clearTimeout(timeoutId);
+  }, [value, debounceTimeMs]);
+
+  return debouncedValue;
+}
diff --git a/site/src/hooks/events.test.ts b/site/src/hooks/events.test.ts
index df75de7626bf4..176dc448316ad 100644
--- a/site/src/hooks/events.test.ts
+++ b/site/src/hooks/events.test.ts
@@ -1,16 +1,16 @@
-import { renderHook, waitFor } from "@testing-library/react"
-import { dispatchCustomEvent } from "../utils/events"
-import { useCustomEvent } from "./events"
+import { renderHook, waitFor } from "@testing-library/react";
+import { dispatchCustomEvent } from "utils/events";
+import { useCustomEvent } from "./events";
 
 describe("useCustomEvent", () => {
   it("should listem a custom event", async () => {
-    const callback = jest.fn()
-    const detail = { title: "Test event" }
-    renderHook(() => useCustomEvent("testEvent", callback))
-    dispatchCustomEvent("testEvent", detail)
+    const callback = jest.fn();
+    const detail = { title: "Test event" };
+    renderHook(() => useCustomEvent("testEvent", callback));
+    dispatchCustomEvent("testEvent", detail);
     await waitFor(() => {
-      expect(callback).toBeCalledTimes(1)
-    })
-    expect(callback.mock.calls[0][0].detail).toBe(detail)
-  })
-})
+      expect(callback).toBeCalledTimes(1);
+    });
+    expect(callback.mock.calls[0][0].detail).toBe(detail);
+  });
+});
diff --git a/site/src/hooks/events.ts b/site/src/hooks/events.ts
index 2060e7cc03ff6..4a67319a7666a 100644
--- a/site/src/hooks/events.ts
+++ b/site/src/hooks/events.ts
@@ -1,5 +1,5 @@
-import { useEffect } from "react"
-import { CustomEventListener } from "../utils/events"
+import { useEffect } from "react";
+import { CustomEventListener } from "utils/events";
 
 /**
  * Handles a custom event with descriptive type information.
@@ -13,12 +13,12 @@ export const useCustomEvent = <T, E extends string = string>(
 ): void => {
   useEffect(() => {
     const handleEvent: CustomEventListener<T> = (event) => {
-      listener(event)
-    }
-    window.addEventListener(eventType, handleEvent as EventListener)
+      listener(event);
+    };
+    window.addEventListener(eventType, handleEvent as EventListener);
 
     return () => {
-      window.removeEventListener(eventType, handleEvent as EventListener)
-    }
-  }, [eventType, listener])
-}
+      window.removeEventListener(eventType, handleEvent as EventListener);
+    };
+  }, [eventType, listener]);
+};
diff --git a/site/src/hooks/hookPolyfills.test.ts b/site/src/hooks/hookPolyfills.test.ts
new file mode 100644
index 0000000000000..1831bf6f6d2a1
--- /dev/null
+++ b/site/src/hooks/hookPolyfills.test.ts
@@ -0,0 +1,48 @@
+import { renderHook } from "@testing-library/react";
+import { useEffectEvent } from "./hookPolyfills";
+
+function renderEffectEvent<TArgs extends unknown[], TReturn = unknown>(
+  callbackArg: (...args: TArgs) => TReturn,
+) {
+  return renderHook(
+    ({ callback }: { callback: typeof callbackArg }) => {
+      return useEffectEvent(callback);
+    },
+    {
+      initialProps: { callback: callbackArg },
+    },
+  );
+}
+
+describe(`${useEffectEvent.name}`, () => {
+  it("Should maintain a stable reference across all renders", () => {
+    const callback = jest.fn();
+    const { result, rerender } = renderEffectEvent(callback);
+
+    const firstResult = result.current;
+    for (let i = 0; i < 5; i++) {
+      rerender({ callback });
+    }
+
+    expect(result.current).toBe(firstResult);
+    expect.hasAssertions();
+  });
+
+  it("Should always call the most recent callback passed in", () => {
+    let value: "A" | "B" | "C" = "A";
+    const flipToB = () => {
+      value = "B";
+    };
+
+    const flipToC = () => {
+      value = "C";
+    };
+
+    const { result, rerender } = renderEffectEvent(flipToB);
+    rerender({ callback: flipToC });
+
+    result.current();
+    expect(value).toEqual("C");
+    expect.hasAssertions();
+  });
+});
diff --git a/site/src/hooks/hookPolyfills.ts b/site/src/hooks/hookPolyfills.ts
new file mode 100644
index 0000000000000..9adfa6b91059f
--- /dev/null
+++ b/site/src/hooks/hookPolyfills.ts
@@ -0,0 +1,37 @@
+/**
+ * @file For defining DIY versions of official React hooks that have not been
+ * released yet.
+ *
+ * These hooks should be deleted as soon as the official versions are available.
+ * They do not have the same ESLinter exceptions baked in that the official
+ * hooks do, especially for dependency arrays.
+ */
+import { useCallback, useEffect, useRef } from "react";
+
+/**
+ * A DIY version of useEffectEvent.
+ *
+ * Works like useCallback, except that it doesn't take a dependency array, and
+ * always returns out a stable function on every single render. The returned-out
+ * function is always able to "see" the most up-to-date version of the callback
+ * passed in.
+ *
+ * Should only be used as a last resort when useCallback does not work, but you
+ * still need to avoid dependency array violations. (e.g., You need an on-mount
+ * effect, but an external library doesn't give their functions stable
+ * references, so useEffect/useMemo/useCallback run too often).
+ *
+ * @see {@link https://react.dev/reference/react/experimental_useEffectEvent}
+ */
+export function useEffectEvent<TArgs extends unknown[], TReturn = unknown>(
+  callback: (...args: TArgs) => TReturn,
+) {
+  const callbackRef = useRef(callback);
+  useEffect(() => {
+    callbackRef.current = callback;
+  }, [callback]);
+
+  return useCallback((...args: TArgs): TReturn => {
+    return callbackRef.current(...args);
+  }, []);
+}
diff --git a/site/src/hooks/index.ts b/site/src/hooks/index.ts
index 613260603fbb5..16b46cd134713 100644
--- a/site/src/hooks/index.ts
+++ b/site/src/hooks/index.ts
@@ -1,10 +1,10 @@
-export * from "./useClickable"
-export * from "./useClickableTableRow"
-export * from "./useClipboard"
-export * from "./useFeatureVisibility"
-export * from "./useLocalStorage"
-export * from "./useMe"
-export * from "./useOrganizationId"
-export * from "./usePagination"
-export * from "./usePermissions"
-export * from "./useTab"
+export * from "./useClickable";
+export * from "./useClickableTableRow";
+export * from "./useClipboard";
+export * from "./useFeatureVisibility";
+export * from "./useLocalStorage";
+export * from "./useMe";
+export * from "./useOrganizationId";
+export * from "./usePagination";
+export * from "./usePermissions";
+export * from "./useTab";
diff --git a/site/src/hooks/useClickable.ts b/site/src/hooks/useClickable.ts
index 0c761d7106c1c..f9d065cabe94b 100644
--- a/site/src/hooks/useClickable.ts
+++ b/site/src/hooks/useClickable.ts
@@ -1,21 +1,56 @@
-import { KeyboardEvent } from "react"
+import {
+  type KeyboardEventHandler,
+  type MouseEventHandler,
+  type RefObject,
+  useRef,
+} from "react";
 
-export interface UseClickableResult {
-  tabIndex: 0
-  role: "button"
-  onClick: () => void
-  onKeyDown: (event: KeyboardEvent) => void
+// Literally any object (ideally an HTMLElement) that has a .click method
+type ClickableElement = {
+  click: () => void;
+};
+
+export interface UseClickableResult<
+  T extends ClickableElement = ClickableElement,
+> {
+  ref: RefObject<T>;
+  tabIndex: 0;
+  role: "button";
+  onClick: MouseEventHandler<T>;
+  onKeyDown: KeyboardEventHandler<T>;
 }
 
-export const useClickable = (onClick: () => void): UseClickableResult => {
+/**
+ * Exposes props to add basic click/interactive behavior to HTML elements that
+ * don't traditionally have support for them.
+ */
+export const useClickable = <
+  // T doesn't have a default type on purpose; the hook should error out if it
+  // doesn't have an explicit type, or a type it can infer from onClick
+  T extends ClickableElement,
+>(
+  // Even though onClick isn't used in any of the internal calculations, it's
+  // still a required argument, just to make sure that useClickable can't
+  // accidentally be called in a component without also defining click behavior
+  onClick: MouseEventHandler<T>,
+): UseClickableResult<T> => {
+  const ref = useRef<T>(null);
+
   return {
+    ref,
     tabIndex: 0,
     role: "button",
     onClick,
-    onKeyDown: (event: KeyboardEvent) => {
-      if (event.key === "Enter") {
-        onClick()
+
+    // Most interactive elements automatically make Space/Enter trigger onClick
+    // callbacks, but you explicitly have to add it for non-interactive elements
+    onKeyDown: (event) => {
+      if (event.key === "Enter" || event.key === " ") {
+        // Can't call onClick from here because onKeydown's keyboard event isn't
+        // compatible with mouse events. Have to use a ref to simulate a click
+        ref.current?.click();
+        event.stopPropagation();
       }
     },
-  }
-}
+  };
+};
diff --git a/site/src/hooks/useClickableTableRow.ts b/site/src/hooks/useClickableTableRow.ts
index 002e76c92ddac..673cf78028f31 100644
--- a/site/src/hooks/useClickableTableRow.ts
+++ b/site/src/hooks/useClickableTableRow.ts
@@ -1,23 +1,51 @@
-import { makeStyles } from "@mui/styles"
-import { useClickable, UseClickableResult } from "./useClickable"
+import { type MouseEventHandler } from "react";
+import { type TableRowProps } from "@mui/material/TableRow";
+import { makeStyles } from "@mui/styles";
+import { useClickable, type UseClickableResult } from "./useClickable";
 
-interface UseClickableTableRowResult extends UseClickableResult {
-  className: string
-  hover: true
-}
+type UseClickableTableRowResult = UseClickableResult<HTMLTableRowElement> &
+  TableRowProps & {
+    className: string;
+    hover: true;
+    onAuxClick: MouseEventHandler<HTMLTableRowElement>;
+  };
 
-export const useClickableTableRow = (
-  onClick: () => void,
-): UseClickableTableRowResult => {
-  const styles = useStyles()
-  const clickable = useClickable(onClick)
+// Awkward type definition (the hover preview in VS Code isn't great, either),
+// but this basically takes all click props from TableRowProps, but makes
+// onClick required, and adds an optional onMiddleClick
+type UseClickableTableRowConfig = {
+  [Key in keyof TableRowProps as Key extends `on${string}Click`
+    ? Key
+    : never]: UseClickableTableRowResult[Key];
+} & {
+  onClick: MouseEventHandler<HTMLTableRowElement>;
+  onMiddleClick?: MouseEventHandler<HTMLTableRowElement>;
+};
+
+export const useClickableTableRow = ({
+  onClick,
+  onAuxClick: externalOnAuxClick,
+  onDoubleClick,
+  onMiddleClick,
+}: UseClickableTableRowConfig): UseClickableTableRowResult => {
+  const styles = useStyles();
+  const clickableProps = useClickable(onClick);
 
   return {
-    ...clickable,
+    ...clickableProps,
     className: styles.row,
     hover: true,
-  }
-}
+    onDoubleClick,
+    onAuxClick: (event) => {
+      const isMiddleMouseButton = event.button === 1;
+      if (isMiddleMouseButton) {
+        onMiddleClick?.(event);
+      }
+
+      externalOnAuxClick?.(event);
+    },
+  };
+};
 
 const useStyles = makeStyles((theme) => ({
   row: {
@@ -33,4 +61,4 @@ const useStyles = makeStyles((theme) => ({
       borderBottomRightRadius: theme.shape.borderRadius,
     },
   },
-}))
+}));
diff --git a/site/src/hooks/useClipboard.ts b/site/src/hooks/useClipboard.ts
index 3737ac64ecef5..0acad67a26580 100644
--- a/site/src/hooks/useClipboard.ts
+++ b/site/src/hooks/useClipboard.ts
@@ -1,44 +1,44 @@
-import { useState } from "react"
+import { useState } from "react";
 
 export const useClipboard = (
   text: string,
 ): { isCopied: boolean; copy: () => Promise<void> } => {
-  const [isCopied, setIsCopied] = useState<boolean>(false)
+  const [isCopied, setIsCopied] = useState<boolean>(false);
 
   const copy = async (): Promise<void> => {
     try {
-      await window.navigator.clipboard.writeText(text)
-      setIsCopied(true)
+      await window.navigator.clipboard.writeText(text);
+      setIsCopied(true);
       window.setTimeout(() => {
-        setIsCopied(false)
-      }, 1000)
+        setIsCopied(false);
+      }, 1000);
     } catch (err) {
-      const input = document.createElement("input")
-      input.value = text
-      document.body.appendChild(input)
-      input.focus()
-      input.select()
-      const result = document.execCommand("copy")
-      document.body.removeChild(input)
+      const input = document.createElement("input");
+      input.value = text;
+      document.body.appendChild(input);
+      input.focus();
+      input.select();
+      const result = document.execCommand("copy");
+      document.body.removeChild(input);
       if (result) {
-        setIsCopied(true)
+        setIsCopied(true);
         window.setTimeout(() => {
-          setIsCopied(false)
-        }, 1000)
+          setIsCopied(false);
+        }, 1000);
       } else {
         const wrappedErr = new Error(
           "copyToClipboard: failed to copy text to clipboard",
-        )
+        );
         if (err instanceof Error) {
-          wrappedErr.stack = err.stack
+          wrappedErr.stack = err.stack;
         }
-        console.error(wrappedErr)
+        console.error(wrappedErr);
       }
     }
-  }
+  };
 
   return {
     isCopied,
     copy,
-  }
-}
+  };
+};
diff --git a/site/src/hooks/useFeatureVisibility.ts b/site/src/hooks/useFeatureVisibility.ts
index d12c7016854eb..00e491a6e303d 100644
--- a/site/src/hooks/useFeatureVisibility.ts
+++ b/site/src/hooks/useFeatureVisibility.ts
@@ -1,8 +1,8 @@
-import { FeatureName } from "api/typesGenerated"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import { selectFeatureVisibility } from "xServices/entitlements/entitlementsSelectors"
+import { FeatureName } from "api/typesGenerated";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { selectFeatureVisibility } from "utils/entitlements";
 
 export const useFeatureVisibility = (): Record<FeatureName, boolean> => {
-  const { entitlements } = useDashboard()
-  return selectFeatureVisibility(entitlements)
-}
+  const { entitlements } = useDashboard();
+  return selectFeatureVisibility(entitlements);
+};
diff --git a/site/src/hooks/useLocalStorage.ts b/site/src/hooks/useLocalStorage.ts
index bae3bf5fa7653..10ae2889907ba 100644
--- a/site/src/hooks/useLocalStorage.ts
+++ b/site/src/hooks/useLocalStorage.ts
@@ -3,17 +3,17 @@ export const useLocalStorage = () => {
     saveLocal,
     getLocal,
     clearLocal,
-  }
-}
+  };
+};
 
 const saveLocal = (itemKey: string, itemValue: string): void => {
-  window.localStorage.setItem(itemKey, itemValue)
-}
+  window.localStorage.setItem(itemKey, itemValue);
+};
 
 const getLocal = (itemKey: string): string | undefined => {
-  return localStorage.getItem(itemKey) ?? undefined
-}
+  return localStorage.getItem(itemKey) ?? undefined;
+};
 
 const clearLocal = (itemKey: string): void => {
-  localStorage.removeItem(itemKey)
-}
+  localStorage.removeItem(itemKey);
+};
diff --git a/site/src/hooks/useMe.ts b/site/src/hooks/useMe.ts
index bd0ac6bf593f3..57d6335e16aad 100644
--- a/site/src/hooks/useMe.ts
+++ b/site/src/hooks/useMe.ts
@@ -1,14 +1,12 @@
-import { User } from "api/typesGenerated"
-import { useAuth } from "components/AuthProvider/AuthProvider"
-import { isAuthenticated } from "xServices/auth/authXService"
+import { User } from "api/typesGenerated";
+import { useAuth } from "components/AuthProvider/AuthProvider";
 
 export const useMe = (): User => {
-  const [authState] = useAuth()
-  const { data } = authState.context
+  const { user } = useAuth();
 
-  if (isAuthenticated(data)) {
-    return data.user
+  if (!user) {
+    throw new Error("User is not authenticated");
   }
 
-  throw new Error("User is not authenticated")
-}
+  return user;
+};
diff --git a/site/src/hooks/useOrganizationId.ts b/site/src/hooks/useOrganizationId.ts
index 9f1c382c0e26e..52f0c034e5410 100644
--- a/site/src/hooks/useOrganizationId.ts
+++ b/site/src/hooks/useOrganizationId.ts
@@ -1,13 +1,6 @@
-import { useAuth } from "components/AuthProvider/AuthProvider"
-import { isAuthenticated } from "xServices/auth/authXService"
+import { useMe } from "./useMe";
 
 export const useOrganizationId = (): string => {
-  const [authState] = useAuth()
-  const { data } = authState.context
-
-  if (isAuthenticated(data)) {
-    return data.user.organization_ids[0]
-  }
-
-  throw new Error("User is not authenticated")
-}
+  const user = useMe();
+  return user.organization_ids[0];
+};
diff --git a/site/src/hooks/usePagination.ts b/site/src/hooks/usePagination.ts
index a610fc4ab01bd..2feee1ac1f033 100644
--- a/site/src/hooks/usePagination.ts
+++ b/site/src/hooks/usePagination.ts
@@ -1,23 +1,25 @@
-import { DEFAULT_RECORDS_PER_PAGE } from "components/PaginationWidget/utils"
-import { useSearchParams } from "react-router-dom"
+import { DEFAULT_RECORDS_PER_PAGE } from "components/PaginationWidget/utils";
+import { useSearchParams } from "react-router-dom";
 
 export const usePagination = ({
   searchParamsResult,
 }: {
-  searchParamsResult: ReturnType<typeof useSearchParams>
+  searchParamsResult: ReturnType<typeof useSearchParams>;
 }) => {
-  const [searchParams, setSearchParams] = searchParamsResult
-  const page = searchParams.get("page") ? Number(searchParams.get("page")) : 1
-  const limit = DEFAULT_RECORDS_PER_PAGE
+  const [searchParams, setSearchParams] = searchParamsResult;
+  const page = searchParams.get("page") ? Number(searchParams.get("page")) : 1;
+  const limit = DEFAULT_RECORDS_PER_PAGE;
+  const offset = page <= 0 ? 0 : (page - 1) * limit;
 
   const goToPage = (page: number) => {
-    searchParams.set("page", page.toString())
-    setSearchParams(searchParams)
-  }
+    searchParams.set("page", page.toString());
+    setSearchParams(searchParams);
+  };
 
   return {
     page,
     limit,
     goToPage,
-  }
-}
+    offset,
+  };
+};
diff --git a/site/src/hooks/usePermissions.ts b/site/src/hooks/usePermissions.ts
index 75e86c1dfc4d6..0837ffb64e1d5 100644
--- a/site/src/hooks/usePermissions.ts
+++ b/site/src/hooks/usePermissions.ts
@@ -1,13 +1,12 @@
-import { useAuth } from "components/AuthProvider/AuthProvider"
-import { isAuthenticated, Permissions } from "xServices/auth/authXService"
+import { useAuth } from "components/AuthProvider/AuthProvider";
+import { Permissions } from "components/AuthProvider/permissions";
 
 export const usePermissions = (): Permissions => {
-  const [authState] = useAuth()
-  const { data } = authState.context
+  const { permissions } = useAuth();
 
-  if (isAuthenticated(data)) {
-    return data.permissions
+  if (!permissions) {
+    throw new Error("User is not authenticated.");
   }
 
-  throw new Error("User is not authenticated.")
-}
+  return permissions;
+};
diff --git a/site/src/hooks/useTab.ts b/site/src/hooks/useTab.ts
index 846a98c2f0ef4..fce1679ae210a 100644
--- a/site/src/hooks/useTab.ts
+++ b/site/src/hooks/useTab.ts
@@ -1,19 +1,19 @@
-import { useSearchParams } from "react-router-dom"
+import { useSearchParams } from "react-router-dom";
 
 export interface UseTabResult {
-  value: string
-  set: (value: string) => void
+  value: string;
+  set: (value: string) => void;
 }
 
 export const useTab = (tabKey: string, defaultValue: string): UseTabResult => {
-  const [searchParams, setSearchParams] = useSearchParams()
-  const value = searchParams.get(tabKey) ?? defaultValue
+  const [searchParams, setSearchParams] = useSearchParams();
+  const value = searchParams.get(tabKey) ?? defaultValue;
 
   return {
     value,
     set: (value: string) => {
-      searchParams.set(tabKey, value)
-      setSearchParams(searchParams, { replace: true })
+      searchParams.set(tabKey, value);
+      setSearchParams(searchParams, { replace: true });
     },
-  }
-}
+  };
+};
diff --git a/site/src/hooks/useWorkspaceBuildLogs.ts b/site/src/hooks/useWorkspaceBuildLogs.ts
new file mode 100644
index 0000000000000..71b76099f5291
--- /dev/null
+++ b/site/src/hooks/useWorkspaceBuildLogs.ts
@@ -0,0 +1,39 @@
+import { watchBuildLogsByBuildId } from "api/api";
+import { ProvisionerJobLog } from "api/typesGenerated";
+import { displayError } from "components/GlobalSnackbar/utils";
+import { useState, useEffect } from "react";
+
+// buildId is optional because sometimes the build is not loaded yet
+export const useWorkspaceBuildLogs = (buildId?: string) => {
+  const [logs, setLogs] = useState<ProvisionerJobLog[]>();
+  useEffect(() => {
+    if (!buildId) {
+      return;
+    }
+
+    // Every time this hook is called reset the values
+    setLogs(undefined);
+
+    const socket = watchBuildLogsByBuildId(buildId, {
+      // Retrieve all the logs
+      after: -1,
+      onMessage: (log) => {
+        setLogs((previousLogs) => {
+          if (!previousLogs) {
+            return [log];
+          }
+          return [...previousLogs, log];
+        });
+      },
+      onError: () => {
+        displayError("Error on getting the build logs");
+      },
+    });
+
+    return () => {
+      socket.close();
+    };
+  }, [buildId]);
+
+  return logs;
+};
diff --git a/site/src/i18n/en/agent.json b/site/src/i18n/en/agent.json
deleted file mode 100644
index b4b9c8119e730..0000000000000
--- a/site/src/i18n/en/agent.json
+++ /dev/null
@@ -1,47 +0,0 @@
-{
-  "shareTooltip": {
-    "private": "Private, only accessible by you",
-    "authenticated": "Shared with all authenticated users",
-    "public": "Shared publicly",
-    "external": "Open external URL"
-  },
-  "labels": {
-    "agent": "Agent",
-    "os": "OS",
-    "apps": "Apps",
-    "noApps": "None"
-  },
-  "status": {
-    "timeout": "Timeout",
-    "startTimeout": "Start Timeout",
-    "startError": "Start Error",
-    "shutdownTimeout": "Stop Timeout",
-    "shutdownError": "Stop Error"
-  },
-  "timeoutTooltip": {
-    "title": "Agent is taking too long to connect",
-    "message": "We noticed this agent is taking longer than expected to connect.",
-    "link": "Troubleshoot"
-  },
-  "startTimeoutTooltip": {
-    "title": "Agent is taking too long to start",
-    "message": "We noticed this agent is taking longer than expected to start.",
-    "link": "Troubleshoot"
-  },
-  "startErrorTooltip": {
-    "title": "Error starting the agent",
-    "message": "Something went wrong during the agent startup.",
-    "link": "Troubleshoot"
-  },
-  "shutdownTimeoutTooltip": {
-    "title": "Agent is taking too long to stop",
-    "message": "We noticed this agent is taking longer than expected to stop.",
-    "link": "Troubleshoot"
-  },
-  "shutdownErrorTooltip": {
-    "title": "Error stopping the agent",
-    "message": "Something went wrong while trying to stop the agent.",
-    "link": "Troubleshoot"
-  },
-  "unableToConnect": "Unable to connect"
-}
diff --git a/site/src/i18n/en/appearanceSettings.json b/site/src/i18n/en/appearanceSettings.json
deleted file mode 100644
index 9c12c28296ad3..0000000000000
--- a/site/src/i18n/en/appearanceSettings.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "updateLabel": "Update",
-  "messageHelperText": "Markdown bold, italics, and links are supported.",
-  "showPreviewLabel": "Show Preview"
-}
diff --git a/site/src/i18n/en/auditLog.json b/site/src/i18n/en/auditLog.json
deleted file mode 100644
index 4ae30cf553e64..0000000000000
--- a/site/src/i18n/en/auditLog.json
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  "actions": {
-    "create": "created a new",
-    "write": "updated",
-    "delete": "deleted"
-  },
-  "table": {
-    "emptyPage": "No audit logs available on this page",
-    "noLogs": "No audit logs available",
-    "logRow": {
-      "description": {
-        "linkedWorkspaceBuild": "{{user}} <1>{{action}}</1> workspace <strong>{{workspaceName}}</strong>",
-        "unlinkedWorkspaceBuild": "{{user}} {{action}} workspace <strong>{{workspaceName}}</strong>",
-        "linkedAuditDescription": "{{truncatedDescription}} <1><strong>{{target}}</strong></1> {{onBehalfOf}}",
-        "unlinkedAuditDescription": "{{truncatedDescription}} <strong>{{target}}</strong> {{onBehalfOf}}"
-      },
-      "deletedLabel": " (deleted)",
-      "ip": "IP: ",
-      "os": "OS: ",
-      "browser": "Browser: "
-    }
-  },
-  "paywall": {
-    "title": "Audit logs",
-    "description": "Audit Logs allows Auditors to monitor user operations in their deployment. To use this feature, you have to upgrade your account.",
-    "actions": {
-      "upgrade": "See how to upgrade",
-      "readDocs": "Read the docs"
-    }
-  }
-}
diff --git a/site/src/i18n/en/buildPage.json b/site/src/i18n/en/buildPage.json
deleted file mode 100644
index 134c040e9f65f..0000000000000
--- a/site/src/i18n/en/buildPage.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "stats": {
-    "workspace": "Workspace",
-    "duration": "Duration",
-    "startedAt": "Started at",
-    "action": "Action"
-  }
-}
diff --git a/site/src/i18n/en/common.json b/site/src/i18n/en/common.json
deleted file mode 100644
index a22e318e6e8c5..0000000000000
--- a/site/src/i18n/en/common.json
+++ /dev/null
@@ -1,48 +0,0 @@
-{
-  "coder": "Coder",
-  "workspaceStatus": {
-    "loading": "Loading",
-    "running": "Running",
-    "starting": "Starting",
-    "stopping": "Stopping",
-    "stopped": "Stopped",
-    "deleting": "Deleting",
-    "deleted": "Deleted",
-    "canceling": "Canceling",
-    "canceled": "Canceled",
-    "failed": "Failed",
-    "pending": "Pending"
-  },
-  "deleteDialog": {
-    "title": "Delete {{entity}}",
-    "intro": "Deleting this {{entity}} is irreversible!",
-    "confirm": "Are you sure you want to proceed? Type the name of this {{entity}} below to confirm.",
-    "confirmLabel": "Name of {{entity}} to delete",
-    "incorrectName": "Incorrect {{entity}} name."
-  },
-  "schedule": {
-    "autostartLabel": "Starts at",
-    "autostopLabel": "Stops at"
-  },
-  "ctas": {
-    "dismissCta": "Dismiss",
-    "expand": "Click here to learn more",
-    "collapse": "Click here to hide",
-    "retry": "Retry"
-  },
-  "warningsAndErrors": {
-    "somethingWentWrong": "Something went wrong."
-  },
-  "emojiPicker": {
-    "select": "Select emoji"
-  },
-  "updateCheck": {
-    "message": "Coder {{version}} is now available. View the <4>release notes</4> and <7>upgrade instructions</7> for more information.",
-    "error": "Coder update check failed."
-  },
-  "licenseFieldTextHelper": "You need an enterprise license to use it.",
-  "learnMore": "Learn more",
-  "forms": {
-    "typeToSearch": "Start typing to search..."
-  }
-}
diff --git a/site/src/i18n/en/createTemplatePage.json b/site/src/i18n/en/createTemplatePage.json
deleted file mode 100644
index dff838b7e2445..0000000000000
--- a/site/src/i18n/en/createTemplatePage.json
+++ /dev/null
@@ -1,57 +0,0 @@
-{
-  "title": "Create Template",
-  "form": {
-    "generalInfo": {
-      "title": "General",
-      "description": "The name is used to identify the template in URLs and the API."
-    },
-    "displayInfo": {
-      "title": "Display",
-      "description": "A friendly name, description, and icon to help developers identify your template."
-    },
-    "schedule": {
-      "title": "Schedule",
-      "description": "Define when workspaces created from this template automatically stop."
-    },
-    "operations": {
-      "title": "Operations",
-      "description": "Regulate actions allowed on workspaces created from this template."
-    },
-    "parameters": {
-      "title": "Template params",
-      "description": "These params are provided by your template's Terraform configuration."
-    },
-    "fields": {
-      "name": "Name",
-      "displayName": "Display name",
-      "description": "Description",
-      "icon": "Icon",
-      "autostop": "Default autostop (hours)",
-      "maxTTL": "Max lifetime (hours)",
-      "allowUsersToCancel": "Allow users to cancel in-progress workspace jobs"
-    },
-    "helperText": {
-      "defaultTTLHelperText_zero": "Workspaces will run until stopped manually.",
-      "defaultTTLHelperText_one": "Workspaces will default to stopping after {{count}} hour. If Coder detects workspace connection activity, the autostop timer is bumped up one hour.",
-      "defaultTTLHelperText_other": "Workspaces will default to stopping after {{count}} hours. If Coder detects workspace connection activity, the autostop timer is bumped up one hour.",
-      "maxTTLHelperText_zero": "Workspaces may run indefinitely.",
-      "maxTTLHelperText_one": "Workspaces must stop within 1 hour of starting, regardless of any active connections.",
-      "maxTTLHelperText_other": "Workspaces must stop within {{count}} hours of starting, regardless of any active connections.",
-      "allowUsersToCancel": "If checked, users may be able to corrupt their workspace."
-    },
-    "upload": {
-      "removeTitle": "Remove file",
-      "title": "Upload template"
-    },
-    "tooltip": {
-      "allowUsersToCancel": "Depending on your template, canceling builds may leave workspaces in an unhealthy state. This option isn't recommended for most use cases."
-    },
-    "error": {
-      "descriptionMax": "Please enter a description that is less than or equal to 128 characters.",
-      "defaultTTLMax": "Please enter a limit that is less than or equal to 720 hours (30 days).",
-      "defaultTTLMin": "Default time until autostop must not be less than 0.",
-      "maxTTLMax": "Please enter a limit that is less than or equal to 720 hours (30 days).",
-      "maxTTLMin": "Maximum time until autostop must not be less than 0."
-    }
-  }
-}
diff --git a/site/src/i18n/en/createWorkspacePage.json b/site/src/i18n/en/createWorkspacePage.json
deleted file mode 100644
index a4e55d6122a40..0000000000000
--- a/site/src/i18n/en/createWorkspacePage.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "templateLabel": "Template",
-  "nameLabel": "Workspace Name",
-  "ownerLabel": "Owner",
-  "createWorkspace": "Create Workspace",
-  "validationNumberLesserThan": "Value must be greater than {{min}}.",
-  "validationNumberGreaterThan": "Value must be lesser than {{max}}.",
-  "validationNumberNotInRange": "Value must be between {{min}} and {{max}}.",
-  "validationPatternNotMatched": "{{error}} (value does not match the pattern {{pattern}})."
-}
diff --git a/site/src/i18n/en/index.ts b/site/src/i18n/en/index.ts
deleted file mode 100644
index d1ce33a2e2e22..0000000000000
--- a/site/src/i18n/en/index.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-import auditLog from "./auditLog.json"
-import common from "./common.json"
-import createWorkspacePage from "./createWorkspacePage.json"
-import templatePage from "./templatePage.json"
-import templatesPage from "./templatesPage.json"
-import workspacePage from "./workspacePage.json"
-import agent from "./agent.json"
-import buildPage from "./buildPage.json"
-import workspacesPage from "./workspacesPage.json"
-import usersPage from "./usersPage.json"
-import templateSettingsPage from "./templateSettingsPage.json"
-import templateVariablesPage from "./templateVariablesPage.json"
-import templateVersionPage from "./templateVersionPage.json"
-import loginPage from "./loginPage.json"
-import workspaceSchedulePage from "./workspaceSchedulePage.json"
-import appearanceSettings from "./appearanceSettings.json"
-import starterTemplatesPage from "./starterTemplatesPage.json"
-import starterTemplatePage from "./starterTemplatePage.json"
-import createTemplatePage from "./createTemplatePage.json"
-import userSettingsPage from "./userSettingsPage.json"
-import tokensPage from "./tokensPage.json"
-import workspaceSettingsPage from "./workspaceSettingsPage.json"
-
-export const en = {
-  common,
-  workspacePage,
-  auditLog,
-  templatePage,
-  templatesPage,
-  createWorkspacePage,
-  agent,
-  buildPage,
-  workspacesPage,
-  usersPage,
-  templateSettingsPage,
-  templateVariablesPage,
-  templateVersionPage,
-  loginPage,
-  workspaceSchedulePage,
-  appearanceSettings,
-  starterTemplatesPage,
-  starterTemplatePage,
-  createTemplatePage,
-  userSettingsPage,
-  tokensPage,
-  workspaceSettingsPage,
-}
diff --git a/site/src/i18n/en/loginPage.json b/site/src/i18n/en/loginPage.json
deleted file mode 100644
index 2420c7c2516de..0000000000000
--- a/site/src/i18n/en/loginPage.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "signInTo": "Sign in to",
-  "showPassword": "Email and password"
-}
diff --git a/site/src/i18n/en/starterTemplatePage.json b/site/src/i18n/en/starterTemplatePage.json
deleted file mode 100644
index 0252d0f80dd6b..0000000000000
--- a/site/src/i18n/en/starterTemplatePage.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  "actions": {
-    "viewSourceCode": "View source code",
-    "useTemplate": "Use Template"
-  }
-}
diff --git a/site/src/i18n/en/starterTemplatesPage.json b/site/src/i18n/en/starterTemplatesPage.json
deleted file mode 100644
index e9a8cd4b611cc..0000000000000
--- a/site/src/i18n/en/starterTemplatesPage.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "title": "Starter Templates",
-  "subtitle": "Import a built-in template to start developing in the cloud",
-  "filterCaption": "Filter",
-  "tags": {
-    "all": "All templates",
-    "digitalocean": "Digital Ocean",
-    "aws": "AWS",
-    "google": "Google Cloud"
-  }
-}
diff --git a/site/src/i18n/en/templateForm.json b/site/src/i18n/en/templateForm.json
deleted file mode 100644
index 59530be19b609..0000000000000
--- a/site/src/i18n/en/templateForm.json
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "generalInfo": {
-    "title": "General",
-    "description": "The name is used to identify the template in URLs and the API. It must be unique."
-  },
-  "displayInfo": {
-    "title": "Display",
-    "description": "A friendly name, description, and icon to help developers identify your template."
-  },
-  "schedule": {
-    "title": "Schedule",
-    "description": "Define when workspaces created from this template automatically stop."
-  },
-  "operations": {
-    "title": "Operations",
-    "description": "Regulate actions allowed on workspaces created from this template."
-  },
-  "parameters": {
-    "title": "Template variables",
-    "description": "These variables are provided by your template's Terraform configuration."
-  },
-  "fields": {
-    "name": "Name",
-    "displayName": "Display name",
-    "description": "Description",
-    "icon": "Icon",
-    "autostop": "Autostop default",
-    "allowUsersToCancel": "Allow users to cancel in-progress workspace jobs"
-  },
-  "helperText": {
-    "autostop": "Time in hours",
-    "allowUsersToCancel": "If checked, users may be able to corrupt their workspace."
-  },
-  "upload": {
-    "removeTitle": "Remove file",
-    "title": "Upload template"
-  },
-  "tooltip": {
-    "allowUsersToCancel": "Depending on your template, canceling builds may leave workspaces in an unhealthy state. This option isn't recommended for most use cases."
-  }
-}
diff --git a/site/src/i18n/en/templatePage.json b/site/src/i18n/en/templatePage.json
deleted file mode 100644
index 03daf50eb649f..0000000000000
--- a/site/src/i18n/en/templatePage.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "deleteSuccess": "Template successfully deleted.",
-  "createdVersion": "created the version"
-}
diff --git a/site/src/i18n/en/templateSettingsPage.json b/site/src/i18n/en/templateSettingsPage.json
deleted file mode 100644
index 11f314e0a7472..0000000000000
--- a/site/src/i18n/en/templateSettingsPage.json
+++ /dev/null
@@ -1,50 +0,0 @@
-{
-  "title": "General Settings",
-  "nameLabel": "Name",
-  "displayNameLabel": "Display name",
-  "descriptionLabel": "Description",
-  "descriptionMaxError": "Please enter a description that is less than or equal to 128 characters.",
-  "defaultTtlLabel": "Default autostop (hours)",
-  "maxTtlLabel": "Max lifetime (hours)",
-  "iconLabel": "Icon",
-  "formAriaLabel": "Template settings form",
-  "selectEmoji": "Select emoji",
-  "defaultTTLMaxError": "Please enter a limit that is less than or equal to 720 hours (30 days).",
-  "defaultTTLMinError": "Default time until autostop must not be less than 0.",
-  "defaultTTLHelperText_zero": "Workspaces will run until stopped manually.",
-  "defaultTTLHelperText_one": "Workspaces will default to stopping after {{count}} hour. If Coder detects workspace connection activity, the autostop timer is bumped up one hour.",
-  "defaultTTLHelperText_other": "Workspaces will default to stopping after {{count}} hours. If Coder detects workspace connection activity, the autostop timer is bumped up one hour.",
-  "maxTTLMaxError": "Please enter a limit that is less than or equal to 720 hours (30 days).",
-  "maxTTLMinError": "Maximum time until autostop must not be less than 0.",
-  "maxTTLHelperText_zero": "Workspaces may run indefinitely.",
-  "maxTTLHelperText_one": "Workspaces must stop within 1 hour of starting, regardless of any active connections.",
-  "maxTTLHelperText_other": "Workspaces must stop within {{count}} hours of starting, regardless of any active connections.",
-  "failureTTLHelperText_zero": "Coder will not automatically stop failed workspaces",
-  "failureTTLHelperText_one": "Coder will attempt to stop failed workspaces after {{count}} day.",
-  "failureTTLHelperText_other": "Coder will attempt to stop failed workspaces after {{count}} days.",
-  "inactivityTTLHelperText_zero": "Coder will not automatically delete inactive workspaces",
-  "inactivityTTLHelperText_one": "Coder will automatically delete inactive workspaces after {{count}} day.",
-  "inactivityTTLHelperText_other": "Coder will automatically delete inactive workspaces after {{count}} days.",
-  "lockedTTLHelperText_zero": "Coder will not automatically delete locked workspaces",
-  "lockedTTLHelperText_one": "Coder will automatically delete locked workspaces after {{count}} day.",
-  "lockedTTLHelperText_other": "Coder will automatically delete locked workspaces after {{count}} days.",
-  "allowUserCancelWorkspaceJobsLabel": "Allow users to cancel in-progress workspace jobs.",
-  "allowUserCancelWorkspaceJobsNotice": "Depending on your template, canceling builds may leave workspaces in an unhealthy state. This option isn't recommended for most use cases.",
-  "allowUsersCancelHelperText": "If checked, users may be able to corrupt their workspace.",
-  "generalInfo": {
-    "title": "General info",
-    "description": "The name is used to identify the template in URLs and the API."
-  },
-  "displayInfo": {
-    "title": "Display info",
-    "description": "A friendly name, description, and icon to help developers identify your template."
-  },
-  "schedule": {
-    "title": "Schedule",
-    "description": "Define when workspaces created from this template are stopped."
-  },
-  "operations": {
-    "title": "Operations",
-    "description": "Regulate actions allowed on workspaces created from this template."
-  }
-}
diff --git a/site/src/i18n/en/templateVariablesPage.json b/site/src/i18n/en/templateVariablesPage.json
deleted file mode 100644
index 6a885a8bde64d..0000000000000
--- a/site/src/i18n/en/templateVariablesPage.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  "title": "Template variables",
-  "sensitiveVariableHelperText": "This variable is sensitive. The previous value will be used if empty.",
-  "validationRequiredVariable": "Variable is required.",
-  "unusedVariablesNotice": "This template does not use managed variables."
-}
diff --git a/site/src/i18n/en/templateVersionPage.json b/site/src/i18n/en/templateVersionPage.json
deleted file mode 100644
index 588e237d01d00..0000000000000
--- a/site/src/i18n/en/templateVersionPage.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "title": "Version",
-  "header": {
-    "caption": "Version"
-  },
-  "stats": {
-    "template": "Template",
-    "createdBy": "Created by",
-    "created": "Created"
-  }
-}
diff --git a/site/src/i18n/en/templatesPage.json b/site/src/i18n/en/templatesPage.json
deleted file mode 100644
index 365cb3a53d399..0000000000000
--- a/site/src/i18n/en/templatesPage.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "errors": {
-    "getOrganizationError": "Something went wrong fetching organizations.",
-    "getTemplatesError": "Something went wrong fetching templates."
-  },
-  "empty": {
-    "message": "Create a Template",
-    "descriptionWithoutPermissions": "Contact your Coder administrator to create a template. You can share the code below."
-  }
-}
diff --git a/site/src/i18n/en/tokensPage.json b/site/src/i18n/en/tokensPage.json
deleted file mode 100644
index adae2cf239c9b..0000000000000
--- a/site/src/i18n/en/tokensPage.json
+++ /dev/null
@@ -1,55 +0,0 @@
-{
-  "title": "Tokens",
-  "description": "Tokens are used to authenticate with the Coder API. You can create a token on this page or with the Coder CLI using the <1>{{cliCreateCommand}}</1> command.",
-  "emptyState": "No tokens found",
-  "tokenActions": {
-    "addToken": "Add token",
-    "deleteToken": {
-      "delete": "Delete Token",
-      "deleteCaption": "Are you sure you want to permanently delete token <strong><4>{{tokenName}}</4></strong>?",
-      "deleteSuccess": "Token has been deleted",
-      "deleteFailure": "Failed to delete token"
-    }
-  },
-  "table": {
-    "id": "ID",
-    "name": "Name",
-    "lastUsed": "Last Used",
-    "expiresAt": "Expires At",
-    "createdAt": "Created At"
-  },
-  "createToken": {
-    "title": "Create Token",
-    "detail": "All tokens are unscoped and therefore have full resource access.",
-    "nameSection": {
-      "title": "Name",
-      "description": "What is this token for?"
-    },
-    "lifetimeSection": {
-      "title": "Expiration",
-      "description": "The token will expire on {{date}}.",
-      "emptyDescription": "Please set a token expiration.",
-      "7": "7 days",
-      "30": "30 days",
-      "60": "60 days",
-      "90": "90 days",
-      "custom": "Custom",
-      "noExpiration": "No expiration",
-      "expiresOn": "Expires on"
-    },
-    "fields": {
-      "name": "Name",
-      "lifetime": "Lifetime"
-    },
-    "footer": {
-      "retry": "Retry",
-      "submit": "Create token"
-    },
-    "createSuccess": "Token has been created",
-    "createError": "Failed to create token",
-    "successModal": {
-      "title": "Creation successful",
-      "description": "Make sure you copy the below token before proceeding:"
-    }
-  }
-}
diff --git a/site/src/i18n/en/userSettingsPage.json b/site/src/i18n/en/userSettingsPage.json
deleted file mode 100644
index c616d8caed09e..0000000000000
--- a/site/src/i18n/en/userSettingsPage.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-  "securityUpdateSuccessMessage": "Updated password.",
-  "sshRegenerateSuccessMessage": "SSH Key regenerated successfully."
-}
diff --git a/site/src/i18n/en/usersPage.json b/site/src/i18n/en/usersPage.json
deleted file mode 100644
index 94b3cec39b330..0000000000000
--- a/site/src/i18n/en/usersPage.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "emptyMessage": "No users found",
-  "emptyPageMessage": "No users found on this page",
-  "suspendMenuItem": "Suspend",
-  "deleteMenuItem": "Delete",
-  "listWorkspacesMenuItem": "View workspaces",
-  "activateMenuItem": "Activate",
-  "resetPasswordMenuItem": "Reset password",
-  "editUserRolesTooltip": "Edit user roles",
-  "fieldSetRolesTooltip": "Available roles",
-  "roleDescription": {
-    "owner": "Owner can manage all resources, including users, groups, templates, and workspaces.",
-    "user-admin": "User admin can manage all users and groups.",
-    "template-admin": "Template admin can manage all templates and workspaces.",
-    "auditor": "Auditor can access the audit logs.",
-    "member": "Everybody is a member. This is a shared and default role for all users."
-  },
-  "member": "Member"
-}
diff --git a/site/src/i18n/en/workspacePage.json b/site/src/i18n/en/workspacePage.json
deleted file mode 100644
index f357e9d655a0d..0000000000000
--- a/site/src/i18n/en/workspacePage.json
+++ /dev/null
@@ -1,73 +0,0 @@
-{
-  "deleteDialog": {
-    "info": "This workspace was created {{timeAgo}}."
-  },
-  "workspaceScheduleButton": {
-    "schedule": "Schedule",
-    "editDeadlineMinus": "Subtract hours",
-    "editDeadlinePlus": "Add hours",
-    "submitDeadline": "Set",
-    "hours": "Hours"
-  },
-  "ctas": {
-    "createWorkspaceCta": "Create new workspace",
-    "extendScheduleCta": "Extend"
-  },
-  "warningsAndErrors": {
-    "workspaceRefreshWarning": "We're having difficulty fetching the latest workspace state. Refresh the page to see the newest changes.",
-    "workspaceDeletedWarning": "This workspace has been deleted and cannot be edited.",
-    "workspaceShutdownWarning": "Your workspace is scheduled to automatically shut down soon."
-  },
-  "actionButton": {
-    "start": "Start",
-    "stop": "Stop",
-    "restart": "Restart",
-    "delete": "Delete",
-    "cancel": "Cancel",
-    "update": "Update",
-    "updating": "Updating",
-    "starting": "Starting...",
-    "stopping": "Stopping...",
-    "deleting": "Deleting...",
-    "settings": "Settings",
-    "retryDebugMode": "Try in debug mode"
-  },
-  "disabledButton": {
-    "canceling": "Canceling",
-    "deleted": "Deleted",
-    "pending": "Pending"
-  },
-  "agentStatus": {
-    "connected": {
-      "ready": "Ready",
-      "starting": "Starting...",
-      "shuttingDown": "Stopping...",
-      "off": "Stopped"
-    },
-    "connecting": "Connecting...",
-    "disconnected": "Disconnected",
-    "timeout": "Timeout"
-  },
-  "buildMessage": {
-    "start": "started",
-    "stop": "stopped",
-    "delete": "deleted",
-    "theWorkspace": "the workspace",
-    "automatically": "automatically "
-  },
-  "buildData": {
-    "reason": "Reason",
-    "duration": "Duration",
-    "version": "Version"
-  },
-  "agentOutdatedTooltip": {
-    "title": "Agent Outdated",
-    "description": "This agent is an older version than the Coder server. This can happen after you update Coder with running workspaces. To fix this, you can stop and start the workspace.",
-    "agentVersionLabel": "Agent version",
-    "serverVersionLabel": "Server version",
-    "updateWorkspaceLabel": "Update workspace"
-  },
-  "askParametersDialog": {
-    "message": "The new version has parameters that need to be filled in to update the workspace."
-  }
-}
diff --git a/site/src/i18n/en/workspaceSchedulePage.json b/site/src/i18n/en/workspaceSchedulePage.json
deleted file mode 100644
index 9cd02c4098e25..0000000000000
--- a/site/src/i18n/en/workspaceSchedulePage.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "forbiddenError": "You don't have permissions to update the schedule for this workspace.",
-  "dialogTitle": "Restart workspace?",
-  "dialogDescription": "Would you like to restart your workspace now to apply your new autostop setting, or let it apply after your next workspace start?",
-  "restart": "Restart workspace",
-  "applyLater": "Apply update later"
-}
diff --git a/site/src/i18n/en/workspaceSettingsPage.json b/site/src/i18n/en/workspaceSettingsPage.json
deleted file mode 100644
index 94d8bc4d126d9..0000000000000
--- a/site/src/i18n/en/workspaceSettingsPage.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-  "title": "Workspace Settings",
-  "defaultErrorMessage": "Error on update workspace settings",
-  "nameLabel": "Name",
-  "generalInfo": "General info",
-  "generalInfoDescription": "The name of your new workspace.",
-  "parameters": "Parameters",
-  "parametersDescription": "Those values are provided by your template's Terraform configuration. Values can be changed after creating the workspace."
-}
diff --git a/site/src/i18n/en/workspacesPage.json b/site/src/i18n/en/workspacesPage.json
deleted file mode 100644
index 6cdb3406d2d66..0000000000000
--- a/site/src/i18n/en/workspacesPage.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "emptyCreateWorkspaceMessage": "Create a Workspace",
-  "emptyCreateWorkspaceDescription": "A workspace is your personal, customizable development environment in the cloud",
-  "createFromTemplateButton": "Select a Template",
-  "emptyResultsMessage": "No results matched your search",
-  "emptyPageMessage": "No results on this page",
-  "updateVersionError": "Error on update workspace version"
-}
diff --git a/site/src/i18n/i18n.ts b/site/src/i18n/i18n.ts
deleted file mode 100644
index da44a43afdc67..0000000000000
--- a/site/src/i18n/i18n.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import i18next from "i18next"
-import { initReactI18next } from "react-i18next"
-import { en } from "./en"
-
-export const defaultNS = "common"
-export const resources = { en } as const
-
-export const i18n = i18next.use(initReactI18next)
-
-i18n
-  .init({
-    fallbackLng: "en",
-    interpolation: {
-      escapeValue: false, // not needed for react as it escapes by default
-    },
-    resources,
-  })
-  .catch((error) => {
-    // we are catching here to avoid lint's no-floating-promises error
-    console.error("[Translation Service]:", error)
-  })
diff --git a/site/src/i18n/index.ts b/site/src/i18n/index.ts
deleted file mode 100644
index ec2c30488a131..0000000000000
--- a/site/src/i18n/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export * from "./i18n"
diff --git a/site/src/index.tsx b/site/src/index.tsx
new file mode 100644
index 0000000000000..48130401be9b7
--- /dev/null
+++ b/site/src/index.tsx
@@ -0,0 +1,39 @@
+import { inspect } from "@xstate/inspect";
+import { createRoot } from "react-dom/client";
+import { Interpreter } from "xstate";
+import { App } from "./App";
+
+// if this is a development build and the developer wants to inspect
+// helpful to see realtime changes on the services
+if (
+  process.env.NODE_ENV === "development" &&
+  process.env.INSPECT_XSTATE === "true"
+) {
+  // configure the XState inspector to open in a new tab
+  inspect({
+    url: "https://stately.ai/viz?inspect",
+    iframe: false,
+  });
+  // configure all XServices to use the inspector
+  Interpreter.defaultOptions.devTools = true;
+}
+
+// This is the entry point for the app - where everything start.
+// In the future, we'll likely bring in more bootstrapping logic -
+// like: https://github.com/coder/m/blob/50898bd4803df7639bd181e484c74ac5d84da474/product/coder/site/pages/_app.tsx#L32
+const main = () => {
+  console.info(`    ▄█▀    ▀█▄
+     ▄▄ ▀▀▀  █▌   ██▀▀█▄          ▐█
+ ▄▄██▀▀█▄▄▄  ██  ██      █▀▀█ ▐█▀▀██ ▄█▀▀█ █▀▀
+█▌   ▄▌   ▐█ █▌  ▀█▄▄▄█▌ █  █ ▐█  ██ ██▀▀  █
+     ██████▀▄█    ▀▀▀▀   ▀▀▀▀  ▀▀▀▀▀  ▀▀▀▀ ▀
+`);
+  const element = document.getElementById("root");
+  if (element === null) {
+    throw new Error("root element is null");
+  }
+  const root = createRoot(element);
+  root.render(<App />);
+};
+
+main();
diff --git a/site/src/pages/404Page/404Page.tsx b/site/src/pages/404Page/404Page.tsx
index d7b1bfbc83c0b..1d87b26f2bba6 100644
--- a/site/src/pages/404Page/404Page.tsx
+++ b/site/src/pages/404Page/404Page.tsx
@@ -1,9 +1,9 @@
-import { makeStyles } from "@mui/styles"
-import Typography from "@mui/material/Typography"
-import { FC } from "react"
+import { makeStyles } from "@mui/styles";
+import Typography from "@mui/material/Typography";
+import { FC } from "react";
 
 export const NotFoundPage: FC = () => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <div className={styles.root}>
@@ -12,13 +12,13 @@ export const NotFoundPage: FC = () => {
       </div>
       <Typography variant="body2">This page could not be found.</Typography>
     </div>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   root: {
-    width: "100vw",
-    height: "100vh",
+    width: "100%",
+    height: "100%",
     display: "flex",
     flexDirection: "row",
     justifyContent: "center",
@@ -29,6 +29,6 @@ const useStyles = makeStyles((theme) => ({
     padding: theme.spacing(1),
     borderRight: theme.palette.divider,
   },
-}))
+}));
 
-export default NotFoundPage
+export default NotFoundPage;
diff --git a/site/src/pages/AuditPage/AuditFilter.tsx b/site/src/pages/AuditPage/AuditFilter.tsx
index 882285fe8a641..e74f01aff3c42 100644
--- a/site/src/pages/AuditPage/AuditFilter.tsx
+++ b/site/src/pages/AuditPage/AuditFilter.tsx
@@ -1,5 +1,5 @@
-import { AuditActions, ResourceTypes } from "api/typesGenerated"
-import { UserFilterMenu, UserMenu } from "components/Filter/UserFilter"
+import { AuditActions, ResourceTypes } from "api/typesGenerated";
+import { UserFilterMenu, UserMenu } from "components/Filter/UserFilter";
 import {
   Filter,
   FilterMenu,
@@ -7,11 +7,11 @@ import {
   OptionItem,
   SearchFieldSkeleton,
   useFilter,
-} from "components/Filter/filter"
-import { UseFilterMenuOptions, useFilterMenu } from "components/Filter/menu"
-import { BaseOption } from "components/Filter/options"
-import capitalize from "lodash/capitalize"
-import { docs } from "utils/docs"
+} from "components/Filter/filter";
+import { UseFilterMenuOptions, useFilterMenu } from "components/Filter/menu";
+import { BaseOption } from "components/Filter/options";
+import capitalize from "lodash/capitalize";
+import { docs } from "utils/docs";
 
 const PRESET_FILTERS = [
   {
@@ -28,20 +28,20 @@ const PRESET_FILTERS = [
     query: "resource_type:api_key action:login",
     name: "User logins",
   },
-]
+];
 
 export const AuditFilter = ({
   filter,
   error,
   menus,
 }: {
-  filter: ReturnType<typeof useFilter>
-  error?: unknown
+  filter: ReturnType<typeof useFilter>;
+  error?: unknown;
   menus: {
-    user: UserFilterMenu
-    action: ActionFilterMenu
-    resourceType: ResourceTypeFilterMenu
-  }
+    user: UserFilterMenu;
+    action: ActionFilterMenu;
+    resourceType: ResourceTypeFilterMenu;
+  };
 }) => {
   return (
     <Filter
@@ -66,8 +66,8 @@ export const AuditFilter = ({
         </>
       }
     />
-  )
-}
+  );
+};
 
 export const useActionFilterMenu = ({
   value,
@@ -76,7 +76,7 @@ export const useActionFilterMenu = ({
   const actionOptions: BaseOption[] = AuditActions.map((action) => ({
     value: action,
     label: capitalize(action),
-  }))
+  }));
   return useFilterMenu({
     onChange,
     value,
@@ -84,10 +84,10 @@ export const useActionFilterMenu = ({
     getSelectedOption: async () =>
       actionOptions.find((option) => option.value === value) ?? null,
     getOptions: async () => actionOptions,
-  })
-}
+  });
+};
 
-export type ActionFilterMenu = ReturnType<typeof useActionFilterMenu>
+export type ActionFilterMenu = ReturnType<typeof useActionFilterMenu>;
 
 const ActionMenu = (menu: ActionFilterMenu) => {
   return (
@@ -104,37 +104,37 @@ const ActionMenu = (menu: ActionFilterMenu) => {
     >
       {(itemProps) => <OptionItem {...itemProps} />}
     </FilterMenu>
-  )
-}
+  );
+};
 
 export const useResourceTypeFilterMenu = ({
   value,
   onChange,
 }: Pick<UseFilterMenuOptions<BaseOption>, "value" | "onChange">) => {
   const actionOptions: BaseOption[] = ResourceTypes.map((type) => {
-    let label = capitalize(type)
+    let label = capitalize(type);
 
     if (type === "api_key") {
-      label = "API Key"
+      label = "API Key";
     }
 
     if (type === "git_ssh_key") {
-      label = "Git SSH Key"
+      label = "Git SSH Key";
     }
 
     if (type === "template_version") {
-      label = "Template Version"
+      label = "Template Version";
     }
 
     if (type === "workspace_build") {
-      label = "Workspace Build"
+      label = "Workspace Build";
     }
 
     return {
       value: type,
       label,
-    }
-  })
+    };
+  });
   return useFilterMenu({
     onChange,
     value,
@@ -142,12 +142,12 @@ export const useResourceTypeFilterMenu = ({
     getSelectedOption: async () =>
       actionOptions.find((option) => option.value === value) ?? null,
     getOptions: async () => actionOptions,
-  })
-}
+  });
+};
 
 export type ResourceTypeFilterMenu = ReturnType<
   typeof useResourceTypeFilterMenu
->
+>;
 
 const ResourceTypeMenu = (menu: ResourceTypeFilterMenu) => {
   return (
@@ -164,5 +164,5 @@ const ResourceTypeMenu = (menu: ResourceTypeFilterMenu) => {
     >
       {(itemProps) => <OptionItem {...itemProps} />}
     </FilterMenu>
-  )
-}
+  );
+};
diff --git a/site/src/components/Tooltips/AuditHelpTooltip.tsx b/site/src/pages/AuditPage/AuditHelpTooltip.tsx
similarity index 84%
rename from site/src/components/Tooltips/AuditHelpTooltip.tsx
rename to site/src/pages/AuditPage/AuditHelpTooltip.tsx
index a5c0e7905e00f..597402adb78a6 100644
--- a/site/src/components/Tooltips/AuditHelpTooltip.tsx
+++ b/site/src/pages/AuditPage/AuditHelpTooltip.tsx
@@ -1,18 +1,18 @@
-import { FC } from "react"
+import { FC } from "react";
 import {
   HelpTooltip,
   HelpTooltipLink,
   HelpTooltipLinksGroup,
   HelpTooltipText,
   HelpTooltipTitle,
-} from "./HelpTooltip"
-import { docs } from "utils/docs"
+} from "components/HelpTooltip/HelpTooltip";
+import { docs } from "utils/docs";
 
 export const Language = {
   title: "What is an audit log?",
   body: "An audit log is a record of events and changes made throughout a system.",
   docs: "Events we track",
-}
+};
 
 export const AuditHelpTooltip: FC = () => {
   return (
@@ -25,5 +25,5 @@ export const AuditHelpTooltip: FC = () => {
         </HelpTooltipLink>
       </HelpTooltipLinksGroup>
     </HelpTooltip>
-  )
-}
+  );
+};
diff --git a/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.stories.tsx b/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.stories.tsx
new file mode 100644
index 0000000000000..ae84490d48e90
--- /dev/null
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.stories.tsx
@@ -0,0 +1,58 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import { AuditLogDescription } from "./AuditLogDescription";
+import {
+  MockAuditLog,
+  MockAuditLogSuccessfulLogin,
+  MockAuditLogUnsuccessfulLoginKnownUser,
+  MockAuditLogWithWorkspaceBuild,
+  MockWorkspaceCreateAuditLogForDifferentOwner,
+} from "testHelpers/entities";
+
+const meta: Meta<typeof AuditLogDescription> = {
+  title: "pages/AuditPage/AuditLogDescription",
+  component: AuditLogDescription,
+};
+
+export default meta;
+type Story = StoryObj<typeof AuditLogDescription>;
+
+export const WorkspaceCreate: Story = {
+  args: {
+    auditLog: MockAuditLog,
+  },
+};
+
+export const WorkspaceBuildStop: Story = {
+  args: {
+    auditLog: MockAuditLogWithWorkspaceBuild,
+  },
+};
+
+export const WorkspaceBuildDuplicatedWord: Story = {
+  args: {
+    auditLog: {
+      ...MockAuditLogWithWorkspaceBuild,
+      additional_fields: {
+        workspace_name: "workspace",
+      },
+    },
+  },
+};
+
+export const CreateWorkspaceWithDiffOwner: Story = {
+  args: {
+    auditLog: MockWorkspaceCreateAuditLogForDifferentOwner,
+  },
+};
+
+export const SuccessLogin: Story = {
+  args: {
+    auditLog: MockAuditLogSuccessfulLogin,
+  },
+};
+
+export const UnsuccessfulLoginForUnknownUser: Story = {
+  args: {
+    auditLog: MockAuditLogUnsuccessfulLoginKnownUser,
+  },
+};
diff --git a/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.tsx b/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.tsx
new file mode 100644
index 0000000000000..f583bd694aa2e
--- /dev/null
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/AuditLogDescription.tsx
@@ -0,0 +1,47 @@
+import { FC } from "react";
+import { AuditLog } from "api/typesGenerated";
+import { Link as RouterLink } from "react-router-dom";
+import Link from "@mui/material/Link";
+import { BuildAuditDescription } from "./BuildAuditDescription";
+
+export const AuditLogDescription: FC<{ auditLog: AuditLog }> = ({
+  auditLog,
+}): JSX.Element => {
+  let target = auditLog.resource_target.trim();
+  const user = auditLog.user?.username.trim();
+
+  if (auditLog.resource_type === "workspace_build") {
+    return <BuildAuditDescription auditLog={auditLog} />;
+  }
+
+  // SSH key entries have no links
+  if (auditLog.resource_type === "git_ssh_key") {
+    target = "";
+  }
+
+  const truncatedDescription = auditLog.description
+    .replace("{user}", `${user}`)
+    .replace("{target}", "");
+
+  // logs for workspaces created on behalf of other users indicate ownership in the description
+  const onBehalfOf =
+    auditLog.additional_fields.workspace_owner &&
+    auditLog.additional_fields.workspace_owner !== "unknown" &&
+    auditLog.additional_fields.workspace_owner.trim() !== user
+      ? ` on behalf of ${auditLog.additional_fields.workspace_owner}`
+      : "";
+
+  return (
+    <span>
+      {truncatedDescription}
+      {auditLog.resource_link ? (
+        <Link component={RouterLink} to={auditLog.resource_link}>
+          <strong>{target}</strong>
+        </Link>
+      ) : (
+        <strong>{target}</strong>
+      )}
+      {onBehalfOf}
+    </span>
+  );
+};
diff --git a/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/BuildAuditDescription.tsx b/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/BuildAuditDescription.tsx
new file mode 100644
index 0000000000000..dc2374d58a180
--- /dev/null
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogDescription/BuildAuditDescription.tsx
@@ -0,0 +1,42 @@
+import { AuditLog } from "api/typesGenerated";
+import { FC, useMemo } from "react";
+import { Link as RouterLink } from "react-router-dom";
+import Link from "@mui/material/Link";
+
+export const BuildAuditDescription: FC<{ auditLog: AuditLog }> = ({
+  auditLog,
+}): JSX.Element => {
+  const workspaceName = auditLog.additional_fields?.workspace_name?.trim();
+  // workspaces can be started/stopped/deleted by a user, or kicked off automatically by Coder
+  const user =
+    auditLog.additional_fields?.build_reason &&
+    auditLog.additional_fields?.build_reason !== "initiator"
+      ? "Coder automatically"
+      : auditLog.user?.username.trim();
+
+  const action = useMemo(() => {
+    switch (auditLog.action) {
+      case "start":
+        return "started";
+      case "stop":
+        return "stopped";
+      case "delete":
+        return "deleted";
+      default:
+        return auditLog.action;
+    }
+  }, [auditLog.action]);
+
+  return (
+    <span>
+      {user} <strong>{action}</strong> workspace{" "}
+      {auditLog.resource_link ? (
+        <Link component={RouterLink} to={auditLog.resource_link}>
+          <strong>{workspaceName}</strong>
+        </Link>
+      ) : (
+        <strong>{workspaceName}</strong>
+      )}
+    </span>
+  );
+};
diff --git a/site/src/components/AuditLogRow/AuditLogDiff/AuditLogDiff.tsx b/site/src/pages/AuditPage/AuditLogRow/AuditLogDiff/AuditLogDiff.tsx
similarity index 85%
rename from site/src/components/AuditLogRow/AuditLogDiff/AuditLogDiff.tsx
rename to site/src/pages/AuditPage/AuditLogRow/AuditLogDiff/AuditLogDiff.tsx
index 6cb1c44cd53b8..857c01fc1bcb7 100644
--- a/site/src/components/AuditLogRow/AuditLogDiff/AuditLogDiff.tsx
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogDiff/AuditLogDiff.tsx
@@ -1,30 +1,30 @@
-import { makeStyles } from "@mui/styles"
-import { AuditLog } from "api/typesGenerated"
-import { colors } from "theme/colors"
-import { MONOSPACE_FONT_FAMILY } from "theme/constants"
-import { combineClasses } from "utils/combineClasses"
-import { FC } from "react"
+import { makeStyles } from "@mui/styles";
+import { AuditLog } from "api/typesGenerated";
+import { colors } from "theme/colors";
+import { MONOSPACE_FONT_FAMILY } from "theme/constants";
+import { combineClasses } from "utils/combineClasses";
+import { FC } from "react";
 
 const getDiffValue = (value: unknown): string => {
   if (typeof value === "string") {
-    return `"${value}"`
+    return `"${value}"`;
   }
 
   if (Array.isArray(value)) {
-    const values = value.map((v) => getDiffValue(v))
-    return `[${values.join(", ")}]`
+    const values = value.map((v) => getDiffValue(v));
+    return `[${values.join(", ")}]`;
   }
 
   if (value === null || value === undefined) {
-    return "null"
+    return "null";
   }
 
-  return String(value)
-}
+  return String(value);
+};
 
 export const AuditLogDiff: FC<{ diff: AuditLog["diff"] }> = ({ diff }) => {
-  const styles = useStyles()
-  const diffEntries = Object.entries(diff)
+  const styles = useStyles();
+  const diffEntries = Object.entries(diff);
 
   return (
     <div className={styles.diff}>
@@ -67,8 +67,8 @@ export const AuditLogDiff: FC<{ diff: AuditLog["diff"] }> = ({ diff }) => {
         ))}
       </div>
     </div>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   diff: {
@@ -132,4 +132,4 @@ const useStyles = makeStyles((theme) => ({
   diffValueNew: {
     backgroundColor: colors.green[12],
   },
-}))
+}));
diff --git a/site/src/components/AuditLogRow/AuditLogDiff/auditUtils.test.ts b/site/src/pages/AuditPage/AuditLogRow/AuditLogDiff/auditUtils.test.ts
similarity index 94%
rename from site/src/components/AuditLogRow/AuditLogDiff/auditUtils.test.ts
rename to site/src/pages/AuditPage/AuditLogRow/AuditLogDiff/auditUtils.test.ts
index 957204f9bc358..94c83c0cc4d66 100644
--- a/site/src/components/AuditLogRow/AuditLogDiff/auditUtils.test.ts
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogDiff/auditUtils.test.ts
@@ -1,4 +1,4 @@
-import { determineGroupDiff } from "./auditUtils"
+import { determineGroupDiff } from "./auditUtils";
 
 const auditDiffForNewGroup = {
   id: {
@@ -15,7 +15,7 @@ const auditDiffForNewGroup = {
     new: "another-test-group",
     secret: false,
   },
-}
+};
 
 const auditDiffForAddedGroupMember = {
   members: {
@@ -28,7 +28,7 @@ const auditDiffForAddedGroupMember = {
     ],
     secret: false,
   },
-}
+};
 
 const auditDiffForRemovedGroupMember = {
   members: {
@@ -50,7 +50,7 @@ const auditDiffForRemovedGroupMember = {
     ],
     secret: false,
   },
-}
+};
 
 const AuditDiffForDeletedGroup = {
   id: {
@@ -72,15 +72,15 @@ const AuditDiffForDeletedGroup = {
     new: "",
     secret: false,
   },
-}
+};
 
 describe("determineAuditDiff", () => {
   it("auditDiffForNewGroup", () => {
     // there should be no change as members are not added when a group is created
     expect(determineGroupDiff(auditDiffForNewGroup)).toEqual(
       auditDiffForNewGroup,
-    )
-  })
+    );
+  });
 
   it("auditDiffForAddedGroupMember", () => {
     const result = {
@@ -88,10 +88,10 @@ describe("determineAuditDiff", () => {
         ...auditDiffForAddedGroupMember.members,
         new: ["cea4c2b0-6373-4858-b26a-df3cbfce8845"],
       },
-    }
+    };
 
-    expect(determineGroupDiff(auditDiffForAddedGroupMember)).toEqual(result)
-  })
+    expect(determineGroupDiff(auditDiffForAddedGroupMember)).toEqual(result);
+  });
 
   it("auditDiffForRemovedGroupMember", () => {
     const result = {
@@ -103,10 +103,10 @@ describe("determineAuditDiff", () => {
         ],
         new: ["84d1cd5a-17e1-4022-898c-52e64256e737"],
       },
-    }
+    };
 
-    expect(determineGroupDiff(auditDiffForRemovedGroupMember)).toEqual(result)
-  })
+    expect(determineGroupDiff(auditDiffForRemovedGroupMember)).toEqual(result);
+  });
 
   it("AuditDiffForDeletedGroup", () => {
     const result = {
@@ -115,8 +115,8 @@ describe("determineAuditDiff", () => {
         ...AuditDiffForDeletedGroup.members,
         old: ["84d1cd5a-17e1-4022-898c-52e64256e737"],
       },
-    }
+    };
 
-    expect(determineGroupDiff(AuditDiffForDeletedGroup)).toEqual(result)
-  })
-})
+    expect(determineGroupDiff(AuditDiffForDeletedGroup)).toEqual(result);
+  });
+});
diff --git a/site/src/components/AuditLogRow/AuditLogDiff/auditUtils.ts b/site/src/pages/AuditPage/AuditLogRow/AuditLogDiff/auditUtils.ts
similarity index 84%
rename from site/src/components/AuditLogRow/AuditLogDiff/auditUtils.ts
rename to site/src/pages/AuditPage/AuditLogRow/AuditLogDiff/auditUtils.ts
index 05f53912e5eb0..ed3cd917ca3d5 100644
--- a/site/src/components/AuditLogRow/AuditLogDiff/auditUtils.ts
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogDiff/auditUtils.ts
@@ -1,8 +1,8 @@
-import { AuditDiff } from "api/typesGenerated"
+import { AuditDiff } from "api/typesGenerated";
 
 interface GroupMember {
-  user_id: string
-  group_id: string
+  user_id: string;
+  group_id: string;
 }
 
 /**
@@ -22,5 +22,5 @@ export const determineGroupDiff = (auditLogDiff: AuditDiff): AuditDiff => {
       ),
       secret: auditLogDiff.members?.secret,
     },
-  }
-}
+  };
+};
diff --git a/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.stories.tsx b/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.stories.tsx
new file mode 100644
index 0000000000000..9c7c681d4e59a
--- /dev/null
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.stories.tsx
@@ -0,0 +1,112 @@
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableHead from "@mui/material/TableHead";
+import TableRow from "@mui/material/TableRow";
+import {
+  MockAuditLog,
+  MockAuditLog2,
+  MockAuditLogWithWorkspaceBuild,
+  MockAuditLogWithDeletedResource,
+  MockAuditLogGitSSH,
+} from "testHelpers/entities";
+import { AuditLogRow } from "./AuditLogRow";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof AuditLogRow> = {
+  title: "pages/AuditPage/AuditLogRow",
+  component: AuditLogRow,
+  decorators: [
+    (Story) => (
+      <TableContainer>
+        <Table>
+          <TableHead>
+            <TableRow>
+              <TableCell style={{ paddingLeft: 32 }}>Logs</TableCell>
+            </TableRow>
+          </TableHead>
+          <TableBody>
+            <Story />
+          </TableBody>
+        </Table>
+      </TableContainer>
+    ),
+  ],
+};
+
+export default meta;
+type Story = StoryObj<typeof AuditLogRow>;
+
+export const NoDiff: Story = {
+  args: {
+    auditLog: {
+      ...MockAuditLog,
+      diff: {},
+    },
+  },
+};
+
+export const WithDiff: Story = {
+  args: {
+    auditLog: MockAuditLog2,
+    defaultIsDiffOpen: true,
+  },
+};
+
+export const WithLongDiffRow: Story = {
+  args: {
+    auditLog: {
+      ...MockAuditLog2,
+      diff: {
+        ...MockAuditLog2.diff,
+        icon: {
+          old: "https://www.google.com/url?sa=i&url=https%3A%2F%2Fwww.docker.com%2Fcompany%2Fnewsroom%2Fmedia-resources%2F&psig=AOvVaw3hLg_lm0tzXPBt74XZD2GC&ust=1666892413988000&source=images&cd=vfe&ved=0CAwQjRxqFwoTCPDsiKa4_voCFQAAAAAdAAAAABAD",
+          new: "https://www.google.com/url?sa=i&url=https%3A%2F%2Fwww.kindpng.com%2Fimgv%2FhRowRxi_docker-icon-png-transparent-png%2F&psig=AOvVaw3hLg_lm0tzXPBt74XZD2GC&ust=1666892413988000&source=images&cd=vfe&ved=0CAwQjRxqFwoTCPDsiKa4_voCFQAAAAAdAAAAABAI",
+          secret: false,
+        },
+      },
+    },
+    defaultIsDiffOpen: true,
+  },
+};
+
+export const WithStoppedWorkspaceBuild: Story = {
+  args: {
+    auditLog: {
+      ...MockAuditLogWithWorkspaceBuild,
+      action: "stop",
+    },
+  },
+};
+
+export const WithStartedWorkspaceBuild: Story = {
+  args: {
+    auditLog: {
+      ...MockAuditLogWithWorkspaceBuild,
+      action: "start",
+    },
+  },
+};
+
+export const WithDeletedWorkspaceBuild: Story = {
+  args: {
+    auditLog: {
+      ...MockAuditLogWithWorkspaceBuild,
+      action: "delete",
+      is_deleted: true,
+    },
+  },
+};
+
+export const DeletedResource: Story = {
+  args: {
+    auditLog: MockAuditLogWithDeletedResource,
+  },
+};
+
+export const SecretDiffValue: Story = {
+  args: {
+    auditLog: MockAuditLogGitSSH,
+  },
+};
diff --git a/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.tsx b/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.tsx
new file mode 100644
index 0000000000000..dbeefc6d3d56b
--- /dev/null
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.tsx
@@ -0,0 +1,223 @@
+import Collapse from "@mui/material/Collapse";
+import { makeStyles } from "@mui/styles";
+import TableCell from "@mui/material/TableCell";
+import { AuditLog } from "api/typesGenerated";
+import { DropdownArrow } from "components/DropdownArrow/DropdownArrow";
+import { Pill, type PillType } from "components/Pill/Pill";
+import { Stack } from "components/Stack/Stack";
+import { TimelineEntry } from "components/Timeline/TimelineEntry";
+import { UserAvatar } from "components/UserAvatar/UserAvatar";
+import { useState } from "react";
+import userAgentParser from "ua-parser-js";
+import { AuditLogDiff } from "./AuditLogDiff/AuditLogDiff";
+import { AuditLogDescription } from "./AuditLogDescription/AuditLogDescription";
+import { determineGroupDiff } from "./AuditLogDiff/auditUtils";
+
+const httpStatusColor = (httpStatus: number): PillType => {
+  // redirects are successful
+  if (httpStatus === 307) {
+    return "success";
+  }
+
+  if (httpStatus >= 300 && httpStatus < 500) {
+    return "warning";
+  }
+
+  if (httpStatus >= 500) {
+    return "error";
+  }
+
+  return "success";
+};
+
+export interface AuditLogRowProps {
+  auditLog: AuditLog;
+  // Useful for Storybook
+  defaultIsDiffOpen?: boolean;
+}
+
+export const AuditLogRow: React.FC<AuditLogRowProps> = ({
+  auditLog,
+  defaultIsDiffOpen = false,
+}) => {
+  const styles = useStyles();
+  const [isDiffOpen, setIsDiffOpen] = useState(defaultIsDiffOpen);
+  const diffs = Object.entries(auditLog.diff);
+  const shouldDisplayDiff = diffs.length > 0;
+  const { os, browser } = userAgentParser(auditLog.user_agent);
+
+  let auditDiff = auditLog.diff;
+
+  // groups have nested diffs (group members)
+  if (auditLog.resource_type === "group") {
+    auditDiff = determineGroupDiff(auditLog.diff);
+  }
+
+  const toggle = () => {
+    if (shouldDisplayDiff) {
+      setIsDiffOpen((v) => !v);
+    }
+  };
+
+  return (
+    <TimelineEntry
+      key={auditLog.id}
+      data-testid={`audit-log-row-${auditLog.id}`}
+      clickable={shouldDisplayDiff}
+    >
+      <TableCell className={styles.auditLogCell}>
+        <Stack
+          direction="row"
+          alignItems="center"
+          className={styles.auditLogHeader}
+          tabIndex={0}
+          onClick={toggle}
+          onKeyDown={(event) => {
+            if (event.key === "Enter") {
+              toggle();
+            }
+          }}
+        >
+          <Stack
+            direction="row"
+            alignItems="center"
+            className={styles.auditLogHeaderInfo}
+          >
+            <Stack
+              direction="row"
+              alignItems="center"
+              className={styles.fullWidth}
+            >
+              <UserAvatar
+                username={auditLog.user?.username ?? "?"}
+                avatarURL={auditLog.user?.avatar_url}
+              />
+
+              <Stack
+                alignItems="baseline"
+                className={styles.fullWidth}
+                justifyContent="space-between"
+                direction="row"
+              >
+                <Stack
+                  className={styles.auditLogSummary}
+                  direction="row"
+                  alignItems="baseline"
+                  spacing={1}
+                >
+                  <AuditLogDescription auditLog={auditLog} />
+                  {auditLog.is_deleted && (
+                    <span className={styles.deletedLabel}>
+                      <>(deleted)</>
+                    </span>
+                  )}
+                  <span className={styles.auditLogTime}>
+                    {new Date(auditLog.time).toLocaleTimeString()}
+                  </span>
+                </Stack>
+
+                <Stack direction="row" alignItems="center">
+                  <Stack direction="row" spacing={1} alignItems="baseline">
+                    {auditLog.ip && (
+                      <span className={styles.auditLogInfo}>
+                        <>IP: </>
+                        <strong>{auditLog.ip}</strong>
+                      </span>
+                    )}
+                    {os.name && (
+                      <span className={styles.auditLogInfo}>
+                        <>OS: </>
+                        <strong>{os.name}</strong>
+                      </span>
+                    )}
+                    {browser.name && (
+                      <span className={styles.auditLogInfo}>
+                        <>Browser: </>
+                        <strong>
+                          {browser.name} {browser.version}
+                        </strong>
+                      </span>
+                    )}
+                  </Stack>
+
+                  <Pill
+                    className={styles.httpStatusPill}
+                    type={httpStatusColor(auditLog.status_code)}
+                    text={auditLog.status_code.toString()}
+                  />
+                </Stack>
+              </Stack>
+            </Stack>
+          </Stack>
+
+          {shouldDisplayDiff ? (
+            <div> {<DropdownArrow close={isDiffOpen} />}</div>
+          ) : (
+            <div className={styles.columnWithoutDiff}></div>
+          )}
+        </Stack>
+
+        {shouldDisplayDiff && (
+          <Collapse in={isDiffOpen}>
+            <AuditLogDiff diff={auditDiff} />
+          </Collapse>
+        )}
+      </TableCell>
+    </TimelineEntry>
+  );
+};
+
+const useStyles = makeStyles((theme) => ({
+  auditLogCell: {
+    padding: "0 !important",
+    border: 0,
+  },
+
+  auditLogHeader: {
+    padding: theme.spacing(2, 4),
+  },
+
+  auditLogHeaderInfo: {
+    flex: 1,
+  },
+
+  auditLogSummary: {
+    ...theme.typography.body1,
+    fontFamily: "inherit",
+  },
+
+  auditLogTime: {
+    color: theme.palette.text.secondary,
+    fontSize: 12,
+  },
+
+  auditLogInfo: {
+    ...theme.typography.body2,
+    fontSize: 12,
+    fontFamily: "inherit",
+    color: theme.palette.text.secondary,
+    display: "block",
+  },
+
+  // offset the absence of the arrow icon on diff-less logs
+  columnWithoutDiff: {
+    marginLeft: "24px",
+  },
+
+  fullWidth: {
+    width: "100%",
+  },
+
+  httpStatusPill: {
+    fontSize: 10,
+    height: 20,
+    paddingLeft: 10,
+    paddingRight: 10,
+    fontWeight: 600,
+  },
+
+  deletedLabel: {
+    ...theme.typography.caption,
+    color: theme.palette.text.secondary,
+  },
+}));
diff --git a/site/src/pages/AuditPage/AuditPage.test.tsx b/site/src/pages/AuditPage/AuditPage.test.tsx
index 35ea1089bd8a8..8be345bba6031 100644
--- a/site/src/pages/AuditPage/AuditPage.test.tsx
+++ b/site/src/pages/AuditPage/AuditPage.test.tsx
@@ -1,119 +1,110 @@
-import { screen, waitFor } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
-import * as API from "api/api"
-import { rest } from "msw"
+import { screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import * as API from "api/api";
+import { rest } from "msw";
 import {
   MockAuditLog,
   MockAuditLog2,
   MockEntitlementsWithAuditLog,
-} from "testHelpers/entities"
+} from "testHelpers/entities";
 import {
   renderWithAuth,
   waitForLoaderToBeRemoved,
-} from "testHelpers/renderHelpers"
-import { server } from "testHelpers/server"
+} from "testHelpers/renderHelpers";
+import { server } from "testHelpers/server";
 
-import * as CreateDayString from "utils/createDayString"
-import AuditPage from "./AuditPage"
-import { DEFAULT_RECORDS_PER_PAGE } from "components/PaginationWidget/utils"
+import * as CreateDayString from "utils/createDayString";
+import AuditPage from "./AuditPage";
+import { DEFAULT_RECORDS_PER_PAGE } from "components/PaginationWidget/utils";
 
 interface RenderPageOptions {
-  filter?: string
-  page?: number
+  filter?: string;
+  page?: number;
 }
 
 const renderPage = async ({ filter, page }: RenderPageOptions = {}) => {
-  let route = "/audit"
-  const params = new URLSearchParams()
+  let route = "/audit";
+  const params = new URLSearchParams();
 
   if (filter) {
-    params.set("filter", filter)
+    params.set("filter", filter);
   }
 
   if (page) {
-    params.set("page", page.toString())
+    params.set("page", page.toString());
   }
 
   if (Array.from(params).length > 0) {
-    route += `?${params.toString()}`
+    route += `?${params.toString()}`;
   }
 
   renderWithAuth(<AuditPage />, {
     route,
     path: "/audit",
-  })
-  await waitForLoaderToBeRemoved()
-}
+  });
+  await waitForLoaderToBeRemoved();
+};
 
 describe("AuditPage", () => {
   beforeEach(() => {
     // Mocking the dayjs module within the createDayString file
-    const mock = jest.spyOn(CreateDayString, "createDayString")
-    mock.mockImplementation(() => "a minute ago")
+    const mock = jest.spyOn(CreateDayString, "createDayString");
+    mock.mockImplementation(() => "a minute ago");
 
     // Mock the entitlements
     server.use(
       rest.get("/api/v2/entitlements", (req, res, ctx) => {
-        return res(ctx.status(200), ctx.json(MockEntitlementsWithAuditLog))
+        return res(ctx.status(200), ctx.json(MockEntitlementsWithAuditLog));
       }),
-    )
-  })
-
-  it("shows the audit logs", async () => {
-    // When
-    await renderPage()
-
-    // Then
-    await screen.findByTestId(`audit-log-row-${MockAuditLog.id}`)
-    screen.getByTestId(`audit-log-row-${MockAuditLog2.id}`)
-  })
+    );
+  });
 
   it("renders page 5", async () => {
     // Given
-    const page = 5
+    const page = 5;
     const getAuditLogsSpy = jest.spyOn(API, "getAuditLogs").mockResolvedValue({
       audit_logs: [MockAuditLog, MockAuditLog2],
       count: 2,
-    })
+    });
 
     // When
-    await renderPage({ page: page })
+    await renderPage({ page: page });
 
     // Then
     expect(getAuditLogsSpy).toBeCalledWith({
       limit: DEFAULT_RECORDS_PER_PAGE,
       offset: DEFAULT_RECORDS_PER_PAGE * (page - 1),
       q: "",
-    })
-    screen.getByTestId(`audit-log-row-${MockAuditLog.id}`)
-    screen.getByTestId(`audit-log-row-${MockAuditLog2.id}`)
-  })
+    });
+    screen.getByTestId(`audit-log-row-${MockAuditLog.id}`);
+    screen.getByTestId(`audit-log-row-${MockAuditLog2.id}`);
+  });
 
   describe("Filtering", () => {
     it("filters by URL", async () => {
       const getAuditLogsSpy = jest
         .spyOn(API, "getAuditLogs")
-        .mockResolvedValue({ audit_logs: [MockAuditLog], count: 1 })
+        .mockResolvedValue({ audit_logs: [MockAuditLog], count: 1 });
 
-      const query = "resource_type:workspace action:create"
-      await renderPage({ filter: query })
+      const query = "resource_type:workspace action:create";
+      await renderPage({ filter: query });
 
       expect(getAuditLogsSpy).toBeCalledWith({
         limit: DEFAULT_RECORDS_PER_PAGE,
         offset: 0,
         q: query,
-      })
-    })
+      });
+    });
 
     it("resets page to 1 when filter is changed", async () => {
-      await renderPage({ page: 2 })
+      await renderPage({ page: 2 });
 
-      const getAuditLogsSpy = jest.spyOn(API, "getAuditLogs")
-      getAuditLogsSpy.mockClear()
+      const getAuditLogsSpy = jest.spyOn(API, "getAuditLogs");
+      getAuditLogsSpy.mockClear();
 
-      const filterField = screen.getByLabelText("Filter")
-      const query = "resource_type:workspace action:create"
-      await userEvent.type(filterField, query)
+      const filterField = screen.getByLabelText("Filter");
+      const query = "resource_type:workspace action:create";
+      await userEvent.type(filterField, query);
 
       await waitFor(() =>
         expect(getAuditLogsSpy).toBeCalledWith({
@@ -121,7 +112,7 @@ describe("AuditPage", () => {
           offset: 0,
           q: query,
         }),
-      )
-    })
-  })
-})
+      );
+    });
+  });
+});
diff --git a/site/src/pages/AuditPage/AuditPage.tsx b/site/src/pages/AuditPage/AuditPage.tsx
index dc5bf904a09a4..2ed69c608fdfe 100644
--- a/site/src/pages/AuditPage/AuditPage.tsx
+++ b/site/src/pages/AuditPage/AuditPage.tsx
@@ -1,29 +1,29 @@
 import {
   DEFAULT_RECORDS_PER_PAGE,
   nonInitialPage,
-} from "components/PaginationWidget/utils"
-import { useFeatureVisibility } from "hooks/useFeatureVisibility"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useSearchParams } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import { AuditPageView } from "./AuditPageView"
-import { useUserFilterMenu } from "components/Filter/UserFilter"
-import { useFilter } from "components/Filter/filter"
-import { usePagination } from "hooks"
-import { useQuery } from "@tanstack/react-query"
-import { getAuditLogs } from "api/api"
-import { useActionFilterMenu, useResourceTypeFilterMenu } from "./AuditFilter"
+} from "components/PaginationWidget/utils";
+import { useFeatureVisibility } from "hooks/useFeatureVisibility";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { useSearchParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import { AuditPageView } from "./AuditPageView";
+import { useUserFilterMenu } from "components/Filter/UserFilter";
+import { useFilter } from "components/Filter/filter";
+import { usePagination } from "hooks";
+import { useQuery } from "react-query";
+import { getAuditLogs } from "api/api";
+import { useActionFilterMenu, useResourceTypeFilterMenu } from "./AuditFilter";
 
 const AuditPage: FC = () => {
-  const searchParamsResult = useSearchParams()
-  const pagination = usePagination({ searchParamsResult })
+  const searchParamsResult = useSearchParams();
+  const pagination = usePagination({ searchParamsResult });
   const filter = useFilter({
     searchParamsResult,
     onUpdate: () => {
-      pagination.goToPage(1)
+      pagination.goToPage(1);
     },
-  })
+  });
   const userMenu = useUserFilterMenu({
     value: filter.values.username,
     onChange: (option) =>
@@ -31,7 +31,7 @@ const AuditPage: FC = () => {
         ...filter.values,
         username: option?.value,
       }),
-  })
+  });
   const actionMenu = useActionFilterMenu({
     value: filter.values.action,
     onChange: (option) =>
@@ -39,7 +39,7 @@ const AuditPage: FC = () => {
         ...filter.values,
         action: option?.value,
       }),
-  })
+  });
   const resourceTypeMenu = useResourceTypeFilterMenu({
     value: filter.values["resource_type"],
     onChange: (option) =>
@@ -47,20 +47,20 @@ const AuditPage: FC = () => {
         ...filter.values,
         resource_type: option?.value,
       }),
-  })
-  const { audit_log: isAuditLogVisible } = useFeatureVisibility()
+  });
+  const { audit_log: isAuditLogVisible } = useFeatureVisibility();
   const { data, error } = useQuery({
     queryKey: ["auditLogs", filter.query, pagination.page],
     queryFn: () => {
-      const limit = DEFAULT_RECORDS_PER_PAGE
-      const page = pagination.page
+      const limit = DEFAULT_RECORDS_PER_PAGE;
+      const page = pagination.page;
       return getAuditLogs({
         offset: page <= 0 ? 0 : (page - 1) * limit,
         limit: limit,
         q: filter.query,
-      })
+      });
     },
-  })
+  });
 
   return (
     <>
@@ -87,7 +87,7 @@ const AuditPage: FC = () => {
         }}
       />
     </>
-  )
-}
+  );
+};
 
-export default AuditPage
+export default AuditPage;
diff --git a/site/src/pages/AuditPage/AuditPageView.stories.tsx b/site/src/pages/AuditPage/AuditPageView.stories.tsx
index d41911ce70faf..46facbf492746 100644
--- a/site/src/pages/AuditPage/AuditPageView.stories.tsx
+++ b/site/src/pages/AuditPage/AuditPageView.stories.tsx
@@ -1,11 +1,13 @@
-import { Meta, StoryObj } from "@storybook/react"
-import { MockAuditLog, MockAuditLog2, MockUser } from "testHelpers/entities"
-import { AuditPageView } from "./AuditPageView"
-import { WorkspacesPageView } from "pages/WorkspacesPage/WorkspacesPageView"
-import { ComponentProps } from "react"
-import { MockMenu, getDefaultFilterProps } from "components/Filter/storyHelpers"
+import { Meta, StoryObj } from "@storybook/react";
+import { MockAuditLog, MockAuditLog2, MockUser } from "testHelpers/entities";
+import { AuditPageView } from "./AuditPageView";
+import { ComponentProps } from "react";
+import {
+  MockMenu,
+  getDefaultFilterProps,
+} from "components/Filter/storyHelpers";
 
-type FilterProps = ComponentProps<typeof AuditPageView>["filterProps"]
+type FilterProps = ComponentProps<typeof AuditPageView>["filterProps"];
 
 const defaultFilterProps = getDefaultFilterProps<FilterProps>({
   query: `owner:me`,
@@ -19,10 +21,10 @@ const defaultFilterProps = getDefaultFilterProps<FilterProps>({
     action: MockMenu,
     resourceType: MockMenu,
   },
-})
+});
 
 const meta: Meta<typeof AuditPageView> = {
-  title: "pages/AuditPageView",
+  title: "pages/AuditPage",
   component: AuditPageView,
   args: {
     auditLogs: [MockAuditLog, MockAuditLog2],
@@ -32,12 +34,12 @@ const meta: Meta<typeof AuditPageView> = {
     isAuditLogVisible: true,
     filterProps: defaultFilterProps,
   },
-}
+};
 
-export default meta
-type Story = StoryObj<typeof WorkspacesPageView>
+export default meta;
+type Story = StoryObj<typeof AuditPageView>;
 
-export const AuditPage: Story = {}
+export const AuditPage: Story = {};
 
 export const Loading = {
   args: {
@@ -45,14 +47,14 @@ export const Loading = {
     count: undefined,
     isNonInitialPage: false,
   },
-}
+};
 
 export const EmptyPage = {
   args: {
     auditLogs: [],
     isNonInitialPage: true,
   },
-}
+};
 
 export const NoLogs = {
   args: {
@@ -60,16 +62,16 @@ export const NoLogs = {
     count: 0,
     isNonInitialPage: false,
   },
-}
+};
 
 export const NotVisible = {
   args: {
     isAuditLogVisible: false,
   },
-}
+};
 
 export const AuditPageSmallViewport = {
   parameters: {
     chromatic: { viewports: [600] },
   },
-}
+};
diff --git a/site/src/pages/AuditPage/AuditPageView.tsx b/site/src/pages/AuditPage/AuditPageView.tsx
index e011a8dc8e7dd..26e1b9f975dfc 100644
--- a/site/src/pages/AuditPage/AuditPageView.tsx
+++ b/site/src/pages/AuditPage/AuditPageView.tsx
@@ -1,44 +1,46 @@
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableRow from "@mui/material/TableRow"
-import { AuditLog } from "api/typesGenerated"
-import { AuditLogRow } from "components/AuditLogRow/AuditLogRow"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { EmptyState } from "components/EmptyState/EmptyState"
-import { Margins } from "components/Margins/Margins"
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableRow from "@mui/material/TableRow";
+import { AuditLog } from "api/typesGenerated";
+import { AuditLogRow } from "./AuditLogRow/AuditLogRow";
+import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
+import { EmptyState } from "components/EmptyState/EmptyState";
+import { Margins } from "components/Margins/Margins";
 import {
   PageHeader,
   PageHeaderSubtitle,
   PageHeaderTitle,
-} from "components/PageHeader/PageHeader"
-import { Stack } from "components/Stack/Stack"
-import { TableLoader } from "components/TableLoader/TableLoader"
-import { Timeline } from "components/Timeline/Timeline"
-import { AuditHelpTooltip } from "components/Tooltips"
-import { ComponentProps, FC } from "react"
-import { useTranslation } from "react-i18next"
-import { AuditPaywall } from "./AuditPaywall"
-import { AuditFilter } from "./AuditFilter"
-import { PaginationStatus } from "components/PaginationStatus/PaginationStatus"
-import { PaginationWidgetBase } from "components/PaginationWidget/PaginationWidgetBase"
+} from "components/PageHeader/PageHeader";
+import { Stack } from "components/Stack/Stack";
+import { TableLoader } from "components/TableLoader/TableLoader";
+import { Timeline } from "components/Timeline/Timeline";
+import { AuditHelpTooltip } from "./AuditHelpTooltip";
+import { ComponentProps, FC } from "react";
+import { AuditPaywall } from "./AuditPaywall";
+import { AuditFilter } from "./AuditFilter";
+import {
+  PaginationStatus,
+  TableToolbar,
+} from "components/TableToolbar/TableToolbar";
+import { PaginationWidgetBase } from "components/PaginationWidget/PaginationWidgetBase";
 
 export const Language = {
   title: "Audit",
   subtitle: "View events in your audit log.",
-}
+};
 
 export interface AuditPageViewProps {
-  auditLogs?: AuditLog[]
-  count?: number
-  page: number
-  limit: number
-  onPageChange: (page: number) => void
-  isNonInitialPage: boolean
-  isAuditLogVisible: boolean
-  error?: unknown
-  filterProps: ComponentProps<typeof AuditFilter>
+  auditLogs?: AuditLog[];
+  count?: number;
+  page: number;
+  limit: number;
+  onPageChange: (page: number) => void;
+  isNonInitialPage: boolean;
+  isAuditLogVisible: boolean;
+  error?: unknown;
+  filterProps: ComponentProps<typeof AuditFilter>;
 }
 
 export const AuditPageView: FC<AuditPageViewProps> = ({
@@ -52,10 +54,8 @@ export const AuditPageView: FC<AuditPageViewProps> = ({
   error,
   filterProps,
 }) => {
-  const { t } = useTranslation("auditLog")
-
-  const isLoading = (auditLogs === undefined || count === undefined) && !error
-  const isEmpty = !isLoading && auditLogs?.length === 0
+  const isLoading = (auditLogs === undefined || count === undefined) && !error;
+  const isEmpty = !isLoading && auditLogs?.length === 0;
 
   return (
     <Margins>
@@ -73,12 +73,14 @@ export const AuditPageView: FC<AuditPageViewProps> = ({
         <Cond condition={isAuditLogVisible}>
           <AuditFilter {...filterProps} />
 
-          <PaginationStatus
-            isLoading={Boolean(isLoading)}
-            showing={auditLogs?.length ?? 0}
-            total={count ?? 0}
-            label="audit logs"
-          />
+          <TableToolbar>
+            <PaginationStatus
+              isLoading={Boolean(isLoading)}
+              showing={auditLogs?.length ?? 0}
+              total={count ?? 0}
+              label="audit logs"
+            />
+          </TableToolbar>
 
           <TableContainer>
             <Table>
@@ -88,7 +90,7 @@ export const AuditPageView: FC<AuditPageViewProps> = ({
                   <Cond condition={Boolean(error)}>
                     <TableRow>
                       <TableCell colSpan={999}>
-                        <EmptyState message={t("table.noLogs")} />
+                        <EmptyState message="An error occurred while loading audit logs" />
                       </TableCell>
                     </TableRow>
                   </Cond>
@@ -100,14 +102,14 @@ export const AuditPageView: FC<AuditPageViewProps> = ({
                       <Cond condition={isNonInitialPage}>
                         <TableRow>
                           <TableCell colSpan={999}>
-                            <EmptyState message={t("table.emptyPage")} />
+                            <EmptyState message="No audit logs available on this page" />
                           </TableCell>
                         </TableRow>
                       </Cond>
                       <Cond>
                         <TableRow>
                           <TableCell colSpan={999}>
-                            <EmptyState message={t("table.noLogs")} />
+                            <EmptyState message="No audit logs available" />
                           </TableCell>
                         </TableRow>
                       </Cond>
@@ -144,5 +146,5 @@ export const AuditPageView: FC<AuditPageViewProps> = ({
         </Cond>
       </ChooseOne>
     </Margins>
-  )
-}
+  );
+};
diff --git a/site/src/pages/AuditPage/AuditPaywall.tsx b/site/src/pages/AuditPage/AuditPaywall.tsx
index b4f4f77cd9d17..bf1ecbeaea421 100644
--- a/site/src/pages/AuditPage/AuditPaywall.tsx
+++ b/site/src/pages/AuditPage/AuditPaywall.tsx
@@ -1,24 +1,21 @@
-import Button from "@mui/material/Button"
-import Link from "@mui/material/Link"
-import ArrowRightAltOutlined from "@mui/icons-material/ArrowRightAltOutlined"
-import { Paywall } from "components/Paywall/Paywall"
-import { Stack } from "components/Stack/Stack"
-import { FC } from "react"
-import { useTranslation } from "react-i18next"
-import { docs } from "utils/docs"
+import Button from "@mui/material/Button";
+import Link from "@mui/material/Link";
+import ArrowRightAltOutlined from "@mui/icons-material/ArrowRightAltOutlined";
+import { Paywall } from "components/Paywall/Paywall";
+import { Stack } from "components/Stack/Stack";
+import { FC } from "react";
+import { docs } from "utils/docs";
 
 export const AuditPaywall: FC = () => {
-  const { t } = useTranslation("auditLog")
-
   return (
     <Paywall
-      message={t("paywall.title")}
-      description={t("paywall.description")}
+      message="Audit logs"
+      description="Audit Logs allows Auditors to monitor user operations in their deployment. To use this feature, you have to upgrade your account."
       cta={
         <Stack direction="row" alignItems="center">
           <Link href={docs("/admin/upgrade")} target="_blank" rel="noreferrer">
             <Button size="small" startIcon={<ArrowRightAltOutlined />}>
-              {t("paywall.actions.upgrade")}
+              See how to upgrade
             </Button>
           </Link>
           <Link
@@ -26,10 +23,10 @@ export const AuditPaywall: FC = () => {
             target="_blank"
             rel="noreferrer"
           >
-            {t("paywall.actions.readDocs")}
+            Read the documentation
           </Link>
         </Stack>
       }
     />
-  )
-}
+  );
+};
diff --git a/site/src/pages/CliAuthPage/CliAuthPage.tsx b/site/src/pages/CliAuthPage/CliAuthPage.tsx
index 5da6d273c168d..697f682c6943c 100644
--- a/site/src/pages/CliAuthPage/CliAuthPage.tsx
+++ b/site/src/pages/CliAuthPage/CliAuthPage.tsx
@@ -1,21 +1,21 @@
-import { useEffect, useState, FC, PropsWithChildren } from "react"
-import { Helmet } from "react-helmet-async"
-import { getApiKey } from "../../api/api"
-import { pageTitle } from "../../utils/page"
-import { CliAuthPageView } from "./CliAuthPageView"
+import { useEffect, useState, FC, PropsWithChildren } from "react";
+import { Helmet } from "react-helmet-async";
+import { getApiKey } from "api/api";
+import { pageTitle } from "utils/page";
+import { CliAuthPageView } from "./CliAuthPageView";
 
 export const CliAuthenticationPage: FC<PropsWithChildren<unknown>> = () => {
-  const [apiKey, setApiKey] = useState<string | null>(null)
+  const [apiKey, setApiKey] = useState<string | null>(null);
 
   useEffect(() => {
     getApiKey()
       .then(({ key }) => {
-        setApiKey(key)
+        setApiKey(key);
       })
       .catch((error) => {
-        console.error(error)
-      })
-  }, [])
+        console.error(error);
+      });
+  }, []);
 
   return (
     <>
@@ -24,7 +24,7 @@ export const CliAuthenticationPage: FC<PropsWithChildren<unknown>> = () => {
       </Helmet>
       <CliAuthPageView sessionToken={apiKey} />
     </>
-  )
-}
+  );
+};
 
-export default CliAuthenticationPage
+export default CliAuthenticationPage;
diff --git a/site/src/pages/CliAuthPage/CliAuthPageView.stories.tsx b/site/src/pages/CliAuthPage/CliAuthPageView.stories.tsx
index da3d20e4c08b1..0108db8907754 100644
--- a/site/src/pages/CliAuthPage/CliAuthPageView.stories.tsx
+++ b/site/src/pages/CliAuthPage/CliAuthPageView.stories.tsx
@@ -1,20 +1,17 @@
-import { Story } from "@storybook/react"
-import { CliAuthPageView, CliAuthPageViewProps } from "./CliAuthPageView"
+import { CliAuthPageView } from "./CliAuthPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/CliAuthPageView",
+const meta: Meta<typeof CliAuthPageView> = {
+  title: "pages/CliAuthPage",
   component: CliAuthPageView,
-  argTypes: {
-    sessionToken: { control: "text" },
-  },
   args: {
     sessionToken: "some-session-token",
   },
-}
+};
+
+export default meta;
+type Story = StoryObj<typeof CliAuthPageView>;
 
-const Template: Story<CliAuthPageViewProps> = (args) => (
-  <CliAuthPageView {...args} />
-)
+const Example: Story = {};
 
-export const Example = Template.bind({})
-Example.args = {}
+export { Example as CliAuthPage };
diff --git a/site/src/pages/CliAuthPage/CliAuthPageView.tsx b/site/src/pages/CliAuthPage/CliAuthPageView.tsx
index b3756f74b2492..5253ec721a66e 100644
--- a/site/src/pages/CliAuthPage/CliAuthPageView.tsx
+++ b/site/src/pages/CliAuthPage/CliAuthPageView.tsx
@@ -1,21 +1,21 @@
-import Button from "@mui/material/Button"
-import { makeStyles } from "@mui/styles"
-import { CodeExample } from "components/CodeExample/CodeExample"
-import { SignInLayout } from "components/SignInLayout/SignInLayout"
-import { Welcome } from "components/Welcome/Welcome"
-import { FC } from "react"
-import { Link as RouterLink } from "react-router-dom"
-import { FullScreenLoader } from "../../components/Loader/FullScreenLoader"
+import Button from "@mui/material/Button";
+import { makeStyles } from "@mui/styles";
+import { CodeExample } from "components/CodeExample/CodeExample";
+import { SignInLayout } from "components/SignInLayout/SignInLayout";
+import { Welcome } from "components/Welcome/Welcome";
+import { FC } from "react";
+import { Link as RouterLink } from "react-router-dom";
+import { FullScreenLoader } from "components/Loader/FullScreenLoader";
 
 export interface CliAuthPageViewProps {
-  sessionToken: string | null
+  sessionToken: string | null;
 }
 
 export const CliAuthPageView: FC<CliAuthPageViewProps> = ({ sessionToken }) => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   if (!sessionToken) {
-    return <FullScreenLoader />
+    return <FullScreenLoader />;
   }
 
   return (
@@ -35,8 +35,8 @@ export const CliAuthPageView: FC<CliAuthPageViewProps> = ({ sessionToken }) => {
         </Button>
       </div>
     </SignInLayout>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   title: {
@@ -63,4 +63,4 @@ const useStyles = makeStyles((theme) => ({
     justifyContent: "flex-end",
     paddingTop: theme.spacing(1),
   },
-}))
+}));
diff --git a/site/src/pages/CreateTemplatePage/CreateTemplateForm.stories.tsx b/site/src/pages/CreateTemplatePage/CreateTemplateForm.stories.tsx
index 22811b15cf874..d5d554ec8b6b9 100644
--- a/site/src/pages/CreateTemplatePage/CreateTemplateForm.stories.tsx
+++ b/site/src/pages/CreateTemplatePage/CreateTemplateForm.stories.tsx
@@ -1,359 +1,370 @@
-import { ComponentMeta, Story } from "@storybook/react"
 import {
+  MockTemplate,
   MockTemplateExample,
   MockTemplateVersionVariable1,
   MockTemplateVersionVariable2,
   MockTemplateVersionVariable3,
   MockTemplateVersionVariable4,
   MockTemplateVersionVariable5,
-} from "testHelpers/entities"
-import {
-  CreateTemplateForm,
-  CreateTemplateFormProps,
-} from "./CreateTemplateForm"
+} from "testHelpers/entities";
+import { CreateTemplateForm } from "./CreateTemplateForm";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "components/CreateTemplateForm",
+const meta: Meta<typeof CreateTemplateForm> = {
+  title: "pages/CreateTemplatePage",
   component: CreateTemplateForm,
   args: {
     isSubmitting: false,
     allowDisableEveryoneAccess: true,
   },
-} as ComponentMeta<typeof CreateTemplateForm>
+};
 
-const Template: Story<CreateTemplateFormProps> = (args) => (
-  <CreateTemplateForm {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof CreateTemplateForm>;
 
-export const Initial = Template.bind({})
-Initial.args = {}
+export const Upload: Story = {
+  args: {
+    upload: {
+      isUploading: false,
+      onRemove: () => {},
+      onUpload: () => {},
+      file: undefined,
+    },
+  },
+};
 
-export const WithStarterTemplate = Template.bind({})
-WithStarterTemplate.args = {
-  starterTemplate: MockTemplateExample,
-}
+export const StarterTemplate: Story = {
+  args: {
+    starterTemplate: MockTemplateExample,
+  },
+};
 
-export const WithVariables = Template.bind({})
-WithVariables.args = {
-  variables: [
-    MockTemplateVersionVariable1,
-    MockTemplateVersionVariable2,
-    MockTemplateVersionVariable3,
-    MockTemplateVersionVariable4,
-    MockTemplateVersionVariable5,
-  ],
-}
+export const DuplicateTemplateWithVariables: Story = {
+  args: {
+    copiedTemplate: MockTemplate,
+    variables: [
+      MockTemplateVersionVariable1,
+      MockTemplateVersionVariable2,
+      MockTemplateVersionVariable3,
+      MockTemplateVersionVariable4,
+      MockTemplateVersionVariable5,
+    ],
+  },
+};
 
-export const WithJobError = Template.bind({})
-WithJobError.args = {
-  jobError:
-    "template import provision for start: recv import provision: plan terraform: terraform plan: exit status 1",
-  logs: [
-    {
-      id: 461061,
-      created_at: "2023-03-06T14:47:32.501Z",
-      log_source: "provisioner_daemon",
-      log_level: "info",
-      stage: "Adding README.md...",
-      output: "",
-    },
-    {
-      id: 461062,
-      created_at: "2023-03-06T14:47:32.501Z",
-      log_source: "provisioner_daemon",
-      log_level: "info",
-      stage: "Setting up",
-      output: "",
-    },
-    {
-      id: 461063,
-      created_at: "2023-03-06T14:47:32.528Z",
-      log_source: "provisioner_daemon",
-      log_level: "info",
-      stage: "Parsing template parameters",
-      output: "",
-    },
-    {
-      id: 461064,
-      created_at: "2023-03-06T14:47:32.552Z",
-      log_source: "provisioner_daemon",
-      log_level: "info",
-      stage: "Detecting persistent resources",
-      output: "",
-    },
-    {
-      id: 461065,
-      created_at: "2023-03-06T14:47:32.633Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "",
-    },
-    {
-      id: 461066,
-      created_at: "2023-03-06T14:47:32.633Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "Initializing the backend...",
-    },
-    {
-      id: 461067,
-      created_at: "2023-03-06T14:47:32.71Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "",
-    },
-    {
-      id: 461068,
-      created_at: "2023-03-06T14:47:32.711Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "Initializing provider plugins...",
-    },
-    {
-      id: 461069,
-      created_at: "2023-03-06T14:47:32.712Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: '- Finding coder/coder versions matching "~\u003e 0.6.12"...',
-    },
-    {
-      id: 461070,
-      created_at: "2023-03-06T14:47:32.922Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: '- Finding hashicorp/aws versions matching "~\u003e 4.55"...',
-    },
-    {
-      id: 461071,
-      created_at: "2023-03-06T14:47:33.132Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "- Installing hashicorp/aws v4.57.0...",
-    },
-    {
-      id: 461072,
-      created_at: "2023-03-06T14:47:37.364Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "- Installed hashicorp/aws v4.57.0 (signed by HashiCorp)",
-    },
-    {
-      id: 461073,
-      created_at: "2023-03-06T14:47:38.142Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "- Installing coder/coder v0.6.15...",
-    },
-    {
-      id: 461074,
-      created_at: "2023-03-06T14:47:39.083Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output:
-        "- Installed coder/coder v0.6.15 (signed by a HashiCorp partner, key ID 93C75807601AA0EC)",
-    },
-    {
-      id: 461075,
-      created_at: "2023-03-06T14:47:39.394Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "",
-    },
-    {
-      id: 461076,
-      created_at: "2023-03-06T14:47:39.394Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "Partner and community providers are signed by their developers.",
-    },
-    {
-      id: 461077,
-      created_at: "2023-03-06T14:47:39.394Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output:
-        "If you'd like to know more about provider signing, you can read about it here:",
-    },
-    {
-      id: 461078,
-      created_at: "2023-03-06T14:47:39.394Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "https://www.terraform.io/docs/cli/plugins/signing.html",
-    },
-    {
-      id: 461079,
-      created_at: "2023-03-06T14:47:39.394Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "",
-    },
-    {
-      id: 461080,
-      created_at: "2023-03-06T14:47:39.394Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output:
-        "Terraform has created a lock file .terraform.lock.hcl to record the provider",
-    },
-    {
-      id: 461081,
-      created_at: "2023-03-06T14:47:39.394Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output:
-        "selections it made above. Include this file in your version control repository",
-    },
-    {
-      id: 461082,
-      created_at: "2023-03-06T14:47:39.394Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output:
-        "so that Terraform can guarantee to make the same selections by default when",
-    },
-    {
-      id: 461083,
-      created_at: "2023-03-06T14:47:39.395Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: 'you run "terraform init" in the future.',
-    },
-    {
-      id: 461084,
-      created_at: "2023-03-06T14:47:39.395Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "",
-    },
-    {
-      id: 461085,
-      created_at: "2023-03-06T14:47:39.395Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "Terraform has been successfully initialized!",
-    },
-    {
-      id: 461086,
-      created_at: "2023-03-06T14:47:39.395Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "",
-    },
-    {
-      id: 461087,
-      created_at: "2023-03-06T14:47:39.395Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output:
-        'You may now begin working with Terraform. Try running "terraform plan" to see',
-    },
-    {
-      id: 461088,
-      created_at: "2023-03-06T14:47:39.395Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output:
-        "any changes that are required for your infrastructure. All Terraform commands",
-    },
-    {
-      id: 461089,
-      created_at: "2023-03-06T14:47:39.395Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "should now work.",
-    },
-    {
-      id: 461090,
-      created_at: "2023-03-06T14:47:39.397Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "",
-    },
-    {
-      id: 461091,
-      created_at: "2023-03-06T14:47:39.397Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output:
-        "If you ever set or change modules or backend configuration for Terraform,",
-    },
-    {
-      id: 461092,
-      created_at: "2023-03-06T14:47:39.397Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output:
-        "rerun this command to reinitialize your working directory. If you forget, other",
-    },
-    {
-      id: 461093,
-      created_at: "2023-03-06T14:47:39.397Z",
-      log_source: "provisioner",
-      log_level: "debug",
-      stage: "Detecting persistent resources",
-      output: "commands will detect it and remind you to do so if necessary.",
-    },
-    {
-      id: 461094,
-      created_at: "2023-03-06T14:47:39.431Z",
-      log_source: "provisioner",
-      log_level: "info",
-      stage: "Detecting persistent resources",
-      output: "Terraform 1.1.9",
-    },
-    {
-      id: 461095,
-      created_at: "2023-03-06T14:47:43.759Z",
-      log_source: "provisioner",
-      log_level: "error",
-      stage: "Detecting persistent resources",
-      output:
-        "Error: configuring Terraform AWS Provider: no valid credential sources for Terraform AWS Provider found.\n\nPlease see https://registry.terraform.io/providers/hashicorp/aws\nfor more information about providing credentials.\n\nError: failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, http response error StatusCode: 404, request to EC2 IMDS failed\n",
-    },
-    {
-      id: 461096,
-      created_at: "2023-03-06T14:47:43.759Z",
-      log_source: "provisioner",
-      log_level: "error",
-      stage: "Detecting persistent resources",
-      output: "",
-    },
-    {
-      id: 461097,
-      created_at: "2023-03-06T14:47:43.777Z",
-      log_source: "provisioner_daemon",
-      log_level: "info",
-      stage: "Cleaning Up",
-      output: "",
-    },
-  ],
-}
+export const WithJobError: Story = {
+  args: {
+    copiedTemplate: MockTemplate,
+    jobError:
+      "template import provision for start: recv import provision: plan terraform: terraform plan: exit status 1",
+    logs: [
+      {
+        id: 461061,
+        created_at: "2023-03-06T14:47:32.501Z",
+        log_source: "provisioner_daemon",
+        log_level: "info",
+        stage: "Adding README.md...",
+        output: "",
+      },
+      {
+        id: 461062,
+        created_at: "2023-03-06T14:47:32.501Z",
+        log_source: "provisioner_daemon",
+        log_level: "info",
+        stage: "Setting up",
+        output: "",
+      },
+      {
+        id: 461063,
+        created_at: "2023-03-06T14:47:32.528Z",
+        log_source: "provisioner_daemon",
+        log_level: "info",
+        stage: "Parsing template parameters",
+        output: "",
+      },
+      {
+        id: 461064,
+        created_at: "2023-03-06T14:47:32.552Z",
+        log_source: "provisioner_daemon",
+        log_level: "info",
+        stage: "Detecting persistent resources",
+        output: "",
+      },
+      {
+        id: 461065,
+        created_at: "2023-03-06T14:47:32.633Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "",
+      },
+      {
+        id: 461066,
+        created_at: "2023-03-06T14:47:32.633Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "Initializing the backend...",
+      },
+      {
+        id: 461067,
+        created_at: "2023-03-06T14:47:32.71Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "",
+      },
+      {
+        id: 461068,
+        created_at: "2023-03-06T14:47:32.711Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "Initializing provider plugins...",
+      },
+      {
+        id: 461069,
+        created_at: "2023-03-06T14:47:32.712Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: '- Finding coder/coder versions matching "~\u003e 0.6.12"...',
+      },
+      {
+        id: 461070,
+        created_at: "2023-03-06T14:47:32.922Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: '- Finding hashicorp/aws versions matching "~\u003e 4.55"...',
+      },
+      {
+        id: 461071,
+        created_at: "2023-03-06T14:47:33.132Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "- Installing hashicorp/aws v4.57.0...",
+      },
+      {
+        id: 461072,
+        created_at: "2023-03-06T14:47:37.364Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "- Installed hashicorp/aws v4.57.0 (signed by HashiCorp)",
+      },
+      {
+        id: 461073,
+        created_at: "2023-03-06T14:47:38.142Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "- Installing coder/coder v0.6.15...",
+      },
+      {
+        id: 461074,
+        created_at: "2023-03-06T14:47:39.083Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output:
+          "- Installed coder/coder v0.6.15 (signed by a HashiCorp partner, key ID 93C75807601AA0EC)",
+      },
+      {
+        id: 461075,
+        created_at: "2023-03-06T14:47:39.394Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "",
+      },
+      {
+        id: 461076,
+        created_at: "2023-03-06T14:47:39.394Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output:
+          "Partner and community providers are signed by their developers.",
+      },
+      {
+        id: 461077,
+        created_at: "2023-03-06T14:47:39.394Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output:
+          "If you'd like to know more about provider signing, you can read about it here:",
+      },
+      {
+        id: 461078,
+        created_at: "2023-03-06T14:47:39.394Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "https://www.terraform.io/docs/cli/plugins/signing.html",
+      },
+      {
+        id: 461079,
+        created_at: "2023-03-06T14:47:39.394Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "",
+      },
+      {
+        id: 461080,
+        created_at: "2023-03-06T14:47:39.394Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output:
+          "Terraform has created a lock file .terraform.lock.hcl to record the provider",
+      },
+      {
+        id: 461081,
+        created_at: "2023-03-06T14:47:39.394Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output:
+          "selections it made above. Include this file in your version control repository",
+      },
+      {
+        id: 461082,
+        created_at: "2023-03-06T14:47:39.394Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output:
+          "so that Terraform can guarantee to make the same selections by default when",
+      },
+      {
+        id: 461083,
+        created_at: "2023-03-06T14:47:39.395Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: 'you run "terraform init" in the future.',
+      },
+      {
+        id: 461084,
+        created_at: "2023-03-06T14:47:39.395Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "",
+      },
+      {
+        id: 461085,
+        created_at: "2023-03-06T14:47:39.395Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "Terraform has been successfully initialized!",
+      },
+      {
+        id: 461086,
+        created_at: "2023-03-06T14:47:39.395Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "",
+      },
+      {
+        id: 461087,
+        created_at: "2023-03-06T14:47:39.395Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output:
+          'You may now begin working with Terraform. Try running "terraform plan" to see',
+      },
+      {
+        id: 461088,
+        created_at: "2023-03-06T14:47:39.395Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output:
+          "any changes that are required for your infrastructure. All Terraform commands",
+      },
+      {
+        id: 461089,
+        created_at: "2023-03-06T14:47:39.395Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "should now work.",
+      },
+      {
+        id: 461090,
+        created_at: "2023-03-06T14:47:39.397Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "",
+      },
+      {
+        id: 461091,
+        created_at: "2023-03-06T14:47:39.397Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output:
+          "If you ever set or change modules or backend configuration for Terraform,",
+      },
+      {
+        id: 461092,
+        created_at: "2023-03-06T14:47:39.397Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output:
+          "rerun this command to reinitialize your working directory. If you forget, other",
+      },
+      {
+        id: 461093,
+        created_at: "2023-03-06T14:47:39.397Z",
+        log_source: "provisioner",
+        log_level: "debug",
+        stage: "Detecting persistent resources",
+        output: "commands will detect it and remind you to do so if necessary.",
+      },
+      {
+        id: 461094,
+        created_at: "2023-03-06T14:47:39.431Z",
+        log_source: "provisioner",
+        log_level: "info",
+        stage: "Detecting persistent resources",
+        output: "Terraform 1.1.9",
+      },
+      {
+        id: 461095,
+        created_at: "2023-03-06T14:47:43.759Z",
+        log_source: "provisioner",
+        log_level: "error",
+        stage: "Detecting persistent resources",
+        output:
+          "Error: configuring Terraform AWS Provider: no valid credential sources for Terraform AWS Provider found.\n\nPlease see https://registry.terraform.io/providers/hashicorp/aws\nfor more information about providing credentials.\n\nError: failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, http response error StatusCode: 404, request to EC2 IMDS failed\n",
+      },
+      {
+        id: 461096,
+        created_at: "2023-03-06T14:47:43.759Z",
+        log_source: "provisioner",
+        log_level: "error",
+        stage: "Detecting persistent resources",
+        output: "",
+      },
+      {
+        id: 461097,
+        created_at: "2023-03-06T14:47:43.777Z",
+        log_source: "provisioner_daemon",
+        log_level: "info",
+        stage: "Cleaning Up",
+        output: "",
+      },
+    ],
+  },
+};
diff --git a/site/src/pages/CreateTemplatePage/CreateTemplateForm.tsx b/site/src/pages/CreateTemplatePage/CreateTemplateForm.tsx
index 614682077ffee..2c7640e811d29 100644
--- a/site/src/pages/CreateTemplatePage/CreateTemplateForm.tsx
+++ b/site/src/pages/CreateTemplatePage/CreateTemplateForm.tsx
@@ -1,75 +1,80 @@
-import Checkbox from "@mui/material/Checkbox"
-import { makeStyles } from "@mui/styles"
-import TextField from "@mui/material/TextField"
+import Checkbox from "@mui/material/Checkbox";
+import { makeStyles } from "@mui/styles";
+import TextField from "@mui/material/TextField";
 import {
   ProvisionerJobLog,
   Template,
   TemplateExample,
   TemplateVersionVariable,
-} from "api/typesGenerated"
-import { Stack } from "components/Stack/Stack"
-import {
-  TemplateUpload,
-  TemplateUploadProps,
-} from "pages/CreateTemplatePage/TemplateUpload"
-import { useFormik } from "formik"
-import { SelectedTemplate } from "pages/CreateWorkspacePage/SelectedTemplate"
-import { FC, useEffect } from "react"
-import { useTranslation } from "react-i18next"
+  VariableValue,
+} from "api/typesGenerated";
+import { Stack } from "components/Stack/Stack";
+import { TemplateUpload, TemplateUploadProps } from "./TemplateUpload";
+import { useFormik } from "formik";
+import { SelectedTemplate } from "pages/CreateWorkspacePage/SelectedTemplate";
+import { FC, useEffect } from "react";
 import {
   nameValidator,
   getFormHelpers,
   onChangeTrimmed,
   templateDisplayNameValidator,
-} from "utils/formUtils"
-import { CreateTemplateData } from "xServices/createTemplate/createTemplateXService"
-import * as Yup from "yup"
-import { WorkspaceBuildLogs } from "components/WorkspaceBuildLogs/WorkspaceBuildLogs"
-import { HelpTooltip, HelpTooltipText } from "components/Tooltips/HelpTooltip"
-import { LazyIconField } from "components/IconField/LazyIconField"
-import { Maybe } from "components/Conditionals/Maybe"
-import i18next from "i18next"
-import Link from "@mui/material/Link"
+} from "utils/formUtils";
+import * as Yup from "yup";
+import { WorkspaceBuildLogs } from "components/WorkspaceBuildLogs/WorkspaceBuildLogs";
+import {
+  HelpTooltip,
+  HelpTooltipText,
+} from "components/HelpTooltip/HelpTooltip";
+import { LazyIconField } from "components/IconField/LazyIconField";
+import Link from "@mui/material/Link";
 import {
   HorizontalForm,
   FormSection,
   FormFields,
   FormFooter,
-} from "components/Form/Form"
-import camelCase from "lodash/camelCase"
-import capitalize from "lodash/capitalize"
-import { VariableInput } from "./VariableInput"
-import { docs } from "utils/docs"
-
-const MAX_DESCRIPTION_CHAR_LIMIT = 128
-const MAX_TTL_DAYS = 30
-
-const TTLHelperText = ({
-  ttl,
-  translationName,
-}: {
-  ttl?: number
-  translationName: string
-}) => {
-  const { t } = useTranslation("createTemplatePage")
-  const count = typeof ttl !== "number" ? 0 : ttl
-  return (
-    // no helper text if ttl is negative - error will show once field is considered touched
-    <Maybe condition={count >= 0}>
-      <span>{t(translationName, { count })}</span>
-    </Maybe>
-  )
+} from "components/Form/Form";
+import camelCase from "lodash/camelCase";
+import capitalize from "lodash/capitalize";
+import { VariableInput } from "./VariableInput";
+import { docs } from "utils/docs";
+import {
+  AutostopRequirementDaysHelperText,
+  AutostopRequirementWeeksHelperText,
+} from "pages/TemplateSettingsPage/TemplateSchedulePage/AutostopRequirementHelperText";
+import MenuItem from "@mui/material/MenuItem";
+import {
+  TemplateAutostartRequirementDaysValue,
+  TemplateAutostopRequirementDaysValue,
+} from "utils/schedule";
+import {
+  TemplateScheduleAutostart,
+  sortedDays,
+} from "components/TemplateScheduleAutostart/TemplateScheduleAutostart";
+
+const MAX_DESCRIPTION_CHAR_LIMIT = 128;
+const MAX_TTL_DAYS = 30;
+
+export interface CreateTemplateData {
+  name: string;
+  display_name: string;
+  description: string;
+  icon: string;
+  default_ttl_hours: number;
+  max_ttl_hours: number;
+  autostart_requirement_days_of_week: TemplateAutostartRequirementDaysValue[];
+  autostop_requirement_days_of_week: TemplateAutostopRequirementDaysValue;
+  autostop_requirement_weeks: number;
+  allow_user_autostart: boolean;
+  allow_user_autostop: boolean;
+  allow_user_cancel_workspace_jobs: boolean;
+  parameter_values_by_name?: Record<string, string>;
+  user_variable_values?: VariableValue[];
+  allow_everyone_group_access: boolean;
 }
 
 const validationSchema = Yup.object({
-  name: nameValidator(
-    i18next.t("form.fields.name", { ns: "createTemplatePage" }),
-  ),
-  display_name: templateDisplayNameValidator(
-    i18next.t("form.fields.displayName", {
-      ns: "createTemplatePage",
-    }),
-  ),
+  name: nameValidator("Name"),
+  display_name: templateDisplayNameValidator("Display name"),
   description: Yup.string().max(
     MAX_DESCRIPTION_CHAR_LIMIT,
     "Please enter a description that is less than or equal to 128 characters.",
@@ -89,7 +94,10 @@ const validationSchema = Yup.object({
       24 * MAX_TTL_DAYS /* 30 days in hours */,
       "Please enter a limit that is less than or equal to 720 hours (30 days).",
     ),
-})
+  autostop_requirement_days_of_week: Yup.string().required(),
+  autostop_requirement_weeks: Yup.number().required().min(1).max(16),
+  autostart_requirement_days_of_week: Yup.array().of(Yup.string()).required(),
+});
 
 const defaultInitialValues: CreateTemplateData = {
   name: "",
@@ -103,18 +111,27 @@ const defaultInitialValues: CreateTemplateData = {
   // The maximum value is 30 days but we default to 7 days as it's a much more
   // sensible value for most teams.
   max_ttl_hours: 24 * 7,
+  // autostop_requirement is an enterprise-only feature, and the server ignores
+  // the value if you are not licensed. We hide the form value based on
+  // entitlements.
+  //
+  // Default to requiring restart every Sunday in the user's quiet hours in the
+  // user's timezone.
+  autostop_requirement_days_of_week: "sunday",
+  autostop_requirement_weeks: 1,
+  autostart_requirement_days_of_week: sortedDays,
   allow_user_cancel_workspace_jobs: false,
   allow_user_autostart: false,
   allow_user_autostop: false,
   allow_everyone_group_access: true,
-}
+};
 
 type GetInitialValuesParams = {
-  fromExample?: TemplateExample
-  fromCopy?: Template
-  variables?: TemplateVersionVariable[]
-  allowAdvancedScheduling: boolean
-}
+  fromExample?: TemplateExample;
+  fromCopy?: Template;
+  variables?: TemplateVersionVariable[];
+  allowAdvancedScheduling: boolean;
+};
 
 const getInitialValues = ({
   fromExample,
@@ -122,13 +139,13 @@ const getInitialValues = ({
   allowAdvancedScheduling,
   variables,
 }: GetInitialValuesParams) => {
-  let initialValues = defaultInitialValues
+  let initialValues = defaultInitialValues;
 
   if (!allowAdvancedScheduling) {
     initialValues = {
       ...initialValues,
       max_ttl_hours: 0,
-    }
+    };
   }
 
   if (fromExample) {
@@ -138,7 +155,7 @@ const getInitialValues = ({
       display_name: fromExample.name,
       icon: fromExample.icon,
       description: fromExample.description,
-    }
+    };
   }
 
   if (fromCopy) {
@@ -149,79 +166,102 @@ const getInitialValues = ({
       display_name: fromCopy.display_name
         ? `Copy of ${fromCopy.display_name}`
         : "",
-    }
+    };
   }
 
   if (variables) {
     variables.forEach((variable) => {
       if (!initialValues.user_variable_values) {
-        initialValues.user_variable_values = []
+        initialValues.user_variable_values = [];
       }
       initialValues.user_variable_values.push({
         name: variable.name,
         value: variable.sensitive ? "" : variable.value,
-      })
-    })
+      });
+    });
   }
 
-  return initialValues
-}
-
-export interface CreateTemplateFormProps {
-  onCancel: () => void
-  onSubmit: (data: CreateTemplateData) => void
-  isSubmitting: boolean
-  upload: TemplateUploadProps
-  starterTemplate?: TemplateExample
-  variables?: TemplateVersionVariable[]
-  error?: unknown
-  jobError?: string
-  logs?: ProvisionerJobLog[]
-  allowAdvancedScheduling: boolean
-  copiedTemplate?: Template
-  allowDisableEveryoneAccess: boolean
-}
-
-export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
-  onCancel,
-  onSubmit,
-  starterTemplate,
-  copiedTemplate,
-  variables,
-  isSubmitting,
-  upload,
-  error,
-  jobError,
-  logs,
-  allowAdvancedScheduling,
-  allowDisableEveryoneAccess,
-}) => {
-  const styles = useStyles()
+  return initialValues;
+};
+
+type CopiedTemplateForm = { copiedTemplate: Template };
+type StarterTemplateForm = { starterTemplate: TemplateExample };
+type UploadTemplateForm = { upload: TemplateUploadProps };
+
+export type CreateTemplateFormProps = (
+  | CopiedTemplateForm
+  | StarterTemplateForm
+  | UploadTemplateForm
+) & {
+  onCancel: () => void;
+  onSubmit: (data: CreateTemplateData) => void;
+  isSubmitting: boolean;
+  variables?: TemplateVersionVariable[];
+  error?: unknown;
+  jobError?: string;
+  logs?: ProvisionerJobLog[];
+  allowAdvancedScheduling: boolean;
+  allowDisableEveryoneAccess: boolean;
+  allowAutostopRequirement: boolean;
+};
+
+export const CreateTemplateForm: FC<CreateTemplateFormProps> = (props) => {
+  const {
+    onCancel,
+    onSubmit,
+    variables,
+    isSubmitting,
+    error,
+    jobError,
+    logs,
+    allowAdvancedScheduling,
+    allowDisableEveryoneAccess,
+    allowAutostopRequirement,
+  } = props;
+  const styles = useStyles();
   const form = useFormik<CreateTemplateData>({
     initialValues: getInitialValues({
       allowAdvancedScheduling,
-      fromExample: starterTemplate,
-      fromCopy: copiedTemplate,
+      fromExample:
+        "starterTemplate" in props ? props.starterTemplate : undefined,
+      fromCopy: "copiedTemplate" in props ? props.copiedTemplate : undefined,
       variables,
     }),
     validationSchema,
     onSubmit,
-  })
-  const getFieldHelpers = getFormHelpers<CreateTemplateData>(form, error)
-  const { t } = useTranslation("createTemplatePage")
-  const { t: commonT } = useTranslation("common")
+  });
+  const getFieldHelpers = getFormHelpers<CreateTemplateData>(form, error);
 
   useEffect(() => {
     if (error) {
-      window.scrollTo(0, 0)
+      window.scrollTo(0, 0);
     }
-  }, [error])
+  }, [error]);
 
   useEffect(() => {
     if (jobError) {
-      window.scrollTo(0, document.body.scrollHeight)
+      window.scrollTo(0, document.body.scrollHeight);
+    }
+  }, [logs, jobError]);
+
+  // Set autostop_requirement weeks to 1 when days_of_week is set to "off" or
+  // "daily". Technically you can set weeks to a different value in the backend
+  // and it will work, but this is a UX decision so users don't set days=daily
+  // and weeks=2 and get confused when workspaces only restart daily during
+  // every second week.
+  //
+  // We want to set the value to 1 when the user selects "off" or "daily"
+  // because the input gets disabled so they can't change it to 1 themselves.
+  const {
+    values: { autostop_requirement_days_of_week },
+    setFieldValue,
+  } = form;
+  useEffect(() => {
+    if (!["saturday", "sunday"].includes(autostop_requirement_days_of_week)) {
+      // This is async but we don't really need to await the value.
+      void setFieldValue("autostop_requirement_weeks", 1);
     }
-  }, [logs, jobError])
+  }, [autostop_requirement_days_of_week, setFieldValue]);
 
   return (
     <HorizontalForm onSubmit={form.handleSubmit}>
@@ -231,16 +271,18 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
         description="The name is used to identify the template in URLs and the API."
       >
         <FormFields>
-          {starterTemplate ? (
-            <SelectedTemplate template={starterTemplate} />
-          ) : copiedTemplate ? (
-            <SelectedTemplate template={copiedTemplate} />
-          ) : (
+          {"starterTemplate" in props && (
+            <SelectedTemplate template={props.starterTemplate} />
+          )}
+          {"copiedTemplate" in props && (
+            <SelectedTemplate template={props.copiedTemplate} />
+          )}
+          {"upload" in props && (
             <TemplateUpload
-              {...upload}
+              {...props.upload}
               onUpload={async (file) => {
-                await fillNameAndDisplayWithFilename(file.name, form)
-                upload.onUpload(file)
+                await fillNameAndDisplayWithFilename(file.name, form);
+                props.upload.onUpload(file);
               }}
             />
           )}
@@ -252,7 +294,7 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
             autoFocus
             fullWidth
             required
-            label={t("form.fields.name")}
+            label="Name"
           />
         </FormFields>
       </FormSection>
@@ -267,7 +309,7 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
             {...getFieldHelpers("display_name")}
             disabled={isSubmitting}
             fullWidth
-            label={t("form.fields.displayName")}
+            label="Display name"
           />
 
           <TextField
@@ -276,7 +318,7 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
             rows={5}
             multiline
             fullWidth
-            label={t("form.fields.description")}
+            label="Description"
           />
 
           <LazyIconField
@@ -284,7 +326,7 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
             disabled={isSubmitting}
             onChange={onChangeTrimmed(form)}
             fullWidth
-            label={t("form.fields.icon")}
+            label="Icon"
             onPickEmoji={(value) => form.setFieldValue("icon", value)}
           />
         </FormFields>
@@ -300,42 +342,87 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
             <TextField
               {...getFieldHelpers(
                 "default_ttl_hours",
-                <TTLHelperText
-                  translationName="form.helperText.defaultTTLHelperText"
-                  ttl={form.values.default_ttl_hours}
-                />,
+                <DefaultTTLHelperText ttl={form.values.default_ttl_hours} />,
               )}
               disabled={isSubmitting}
               onChange={onChangeTrimmed(form)}
               fullWidth
-              label={t("form.fields.autostop")}
+              label="Default autostop (hours)"
               type="number"
             />
 
-            <TextField
-              {...getFieldHelpers(
-                "max_ttl_hours",
-                allowAdvancedScheduling ? (
-                  <TTLHelperText
-                    translationName="form.helperText.maxTTLHelperText"
-                    ttl={form.values.max_ttl_hours}
-                  />
-                ) : (
-                  <>
-                    {commonT("licenseFieldTextHelper")}{" "}
-                    <Link href={docs("/enterprise")}>
-                      {commonT("learnMore")}
-                    </Link>
-                    .
-                  </>
-                ),
-              )}
-              disabled={isSubmitting || !allowAdvancedScheduling}
-              fullWidth
-              label={t("form.fields.maxTTL")}
-              type="number"
-            />
+            {!allowAutostopRequirement && (
+              <TextField
+                {...getFieldHelpers(
+                  "max_ttl_hours",
+                  allowAdvancedScheduling ? (
+                    <MaxTTLHelperText ttl={form.values.max_ttl_hours} />
+                  ) : (
+                    <>
+                      You need an enterprise license to use it.{" "}
+                      <Link href={docs("/enterprise")}>Learn more</Link>.
+                    </>
+                  ),
+                )}
+                disabled={isSubmitting || !allowAdvancedScheduling}
+                fullWidth
+                label="Max lifetime (hours)"
+                type="number"
+              />
+            )}
           </Stack>
+
+          {allowAutostopRequirement && (
+            <Stack direction="row" className={styles.ttlFields}>
+              <TextField
+                {...getFieldHelpers(
+                  "autostop_requirement_days_of_week",
+                  <AutostopRequirementDaysHelperText
+                    days={form.values.autostop_requirement_days_of_week}
+                  />,
+                )}
+                disabled={isSubmitting}
+                fullWidth
+                select
+                value={form.values.autostop_requirement_days_of_week}
+                label="Days with required stop"
+              >
+                <MenuItem key="off" value="off">
+                  Off
+                </MenuItem>
+                <MenuItem key="daily" value="daily">
+                  Daily
+                </MenuItem>
+                <MenuItem key="saturday" value="saturday">
+                  Saturday
+                </MenuItem>
+                <MenuItem key="sunday" value="sunday">
+                  Sunday
+                </MenuItem>
+              </TextField>
+
+              <TextField
+                {...getFieldHelpers(
+                  "autostop_requirement_weeks",
+                  <AutostopRequirementWeeksHelperText
+                    days={form.values.autostop_requirement_days_of_week}
+                    weeks={form.values.autostop_requirement_weeks}
+                  />,
+                )}
+                disabled={
+                  isSubmitting ||
+                  !["saturday", "sunday"].includes(
+                    form.values.autostop_requirement_days_of_week || "",
+                  )
+                }
+                fullWidth
+                inputProps={{ min: 1, max: 16, step: 1 }}
+                label="Weeks between required stops"
+                type="number"
+              />
+            </Stack>
+          )}
+
           <Stack direction="column">
             <Stack direction="row" alignItems="center">
               <Checkbox
@@ -346,7 +433,7 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
                   await form.setFieldValue(
                     "allow_user_autostart",
                     !form.values.allow_user_autostart,
-                  )
+                  );
                 }}
                 name="allow_user_autostart"
                 checked={form.values.allow_user_autostart}
@@ -357,6 +444,25 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
                 </strong>
               </Stack>
             </Stack>
+
+            {allowAdvancedScheduling && (
+              <TemplateScheduleAutostart
+                allow_user_autostart={form.values.allow_user_autostart}
+                autostart_requirement_days_of_week={
+                  form.values.autostart_requirement_days_of_week
+                }
+                isSubmitting={isSubmitting}
+                onChange={async (
+                  newDaysOfWeek: TemplateAutostartRequirementDaysValue[],
+                ) => {
+                  await form.setFieldValue(
+                    "autostart_requirement_days_of_week",
+                    newDaysOfWeek,
+                  );
+                }}
+              />
+            )}
+
             <Stack direction="row" alignItems="center">
               <Checkbox
                 id="allow-user-autostop"
@@ -366,7 +472,7 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
                   await form.setFieldValue(
                     "allow_user_autostop",
                     !form.values.allow_user_autostop,
-                  )
+                  );
                 }}
                 name="allow-user-autostop"
                 checked={form.values.allow_user_autostop}
@@ -410,16 +516,21 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
                     spacing={0.5}
                     className={styles.optionText}
                   >
-                    <strong>{t("form.fields.allowUsersToCancel")}</strong>
+                    <strong>
+                      Allow users to cancel in-progress workspace jobs
+                    </strong>
 
                     <HelpTooltip>
                       <HelpTooltipText>
-                        {t("form.tooltip.allowUsersToCancel")}
+                        If checked, users may be able to corrupt their
+                        workspace.
                       </HelpTooltipText>
                     </HelpTooltip>
                   </Stack>
                   <span className={styles.optionHelperText}>
-                    {t("form.helperText.allowUsersToCancel")}
+                    Depending on your template, canceling builds may leave
+                    workspaces in an unhealthy state. This option isn&apos;t
+                    recommended for most use cases.
                   </span>
                 </Stack>
               </Stack>
@@ -489,7 +600,7 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
                   await form.setFieldValue("user_variable_values." + index, {
                     name: variable.name,
                     value,
-                  })
+                  });
                 }}
               />
             ))}
@@ -519,14 +630,14 @@ export const CreateTemplateForm: FC<CreateTemplateFormProps> = ({
         submitLabel={jobError ? "Retry" : "Create template"}
       />
     </HorizontalForm>
-  )
-}
+  );
+};
 
 const fillNameAndDisplayWithFilename = async (
   filename: string,
   form: ReturnType<typeof useFormik<CreateTemplateData>>,
 ) => {
-  const [name, _extension] = filename.split(".")
+  const [name, _extension] = filename.split(".");
   await Promise.all([
     form.setFieldValue(
       "name",
@@ -534,8 +645,50 @@ const fillNameAndDisplayWithFilename = async (
       camelCase(name).toLowerCase(),
     ),
     form.setFieldValue("display_name", capitalize(name)),
-  ])
-}
+  ]);
+};
+
+const hours = (h: number) => (h === 1 ? "hour" : "hours");
+
+const DefaultTTLHelperText = (props: { ttl?: number }) => {
+  const { ttl = 0 } = props;
+
+  // Error will show once field is considered touched
+  if (ttl < 0) {
+    return null;
+  }
+
+  if (ttl === 0) {
+    return <span>Workspaces will run until stopped manually.</span>;
+  }
+
+  return (
+    <span>
+      Workspaces will default to stopping after {ttl} {hours(ttl)} without
+      activity.
+    </span>
+  );
+};
+
+const MaxTTLHelperText = (props: { ttl?: number }) => {
+  const { ttl = 0 } = props;
+
+  // Error will show once field is considered touched
+  if (ttl < 0) {
+    return null;
+  }
+
+  if (ttl === 0) {
+    return <span>Workspaces may run indefinitely.</span>;
+  }
+
+  return (
+    <span>
+      Workspaces must stop within {ttl} {hours(ttl)} of starting, regardless of
+      any active connections.
+    </span>
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   ttlFields: {
@@ -576,4 +729,4 @@ const useStyles = makeStyles((theme) => ({
     color: theme.palette.error.light,
     fontSize: theme.spacing(2),
   },
-}))
+}));
diff --git a/site/src/pages/CreateTemplatePage/CreateTemplatePage.test.tsx b/site/src/pages/CreateTemplatePage/CreateTemplatePage.test.tsx
index b3bdf890295ba..8891e376b2d19 100644
--- a/site/src/pages/CreateTemplatePage/CreateTemplatePage.test.tsx
+++ b/site/src/pages/CreateTemplatePage/CreateTemplatePage.test.tsx
@@ -1,8 +1,8 @@
-import { renderWithAuth } from "testHelpers/renderHelpers"
-import CreateTemplatePage from "./CreateTemplatePage"
-import { screen, waitFor, within } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
-import * as API from "api/api"
+import { renderWithAuth } from "testHelpers/renderHelpers";
+import CreateTemplatePage from "./CreateTemplatePage";
+import { screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import * as API from "api/api";
 import {
   MockTemplateExample,
   MockTemplateVersion,
@@ -11,8 +11,7 @@ import {
   MockTemplateVersionVariable3,
   MockTemplate,
   MockOrganization,
-  MockProvisionerJob,
-} from "testHelpers/entities"
+} from "testHelpers/entities";
 
 const renderPage = async (searchParams: URLSearchParams) => {
   // Render with the example ID so we don't need to upload a file
@@ -21,23 +20,28 @@ const renderPage = async (searchParams: URLSearchParams) => {
     path: "/templates/new",
     // We need this because after creation, the user will be redirected to here
     extraRoutes: [{ path: "templates/:template", element: <></> }],
-  })
+  });
   // It is lazy loaded, so we have to wait for it to be rendered to not get an
   // act error
-  await screen.findByLabelText("Icon", undefined, { timeout: 5000 })
-  return view
-}
+  await screen.findByLabelText("Icon", undefined, { timeout: 5000 });
+  return view;
+};
+
+test("Create template from starter template", async () => {
+  // Render page, fill the name and submit
+  const searchParams = new URLSearchParams({
+    exampleId: MockTemplateExample.id,
+  });
+  const { router, container } = await renderPage(searchParams);
+  const form = container.querySelector("form") as HTMLFormElement;
 
-test("Create template with variables", async () => {
-  // Return pending when creating the first template version
   jest.spyOn(API, "createTemplateVersion").mockResolvedValueOnce({
     ...MockTemplateVersion,
     job: {
       ...MockTemplateVersion.job,
       status: "pending",
     },
-  })
-  // Return an error requesting for template variables
+  });
   jest.spyOn(API, "getTemplateVersion").mockResolvedValue({
     ...MockTemplateVersion,
     job: {
@@ -45,56 +49,49 @@ test("Create template with variables", async () => {
       status: "failed",
       error_code: "REQUIRED_TEMPLATE_VARIABLES",
     },
-  })
-  // Return the template variables
+  });
   jest
     .spyOn(API, "getTemplateVersionVariables")
     .mockResolvedValue([
       MockTemplateVersionVariable1,
       MockTemplateVersionVariable2,
       MockTemplateVersionVariable3,
-    ])
-
-  // Render page, fill the name and submit
-  const searchParams = new URLSearchParams({
-    exampleId: MockTemplateExample.id,
-  })
-  const { router, container } = await renderPage(searchParams)
-  const form = container.querySelector("form") as HTMLFormElement
-  await userEvent.type(screen.getByLabelText(/Name/), "my-template")
+    ]);
+  await userEvent.type(screen.getByLabelText(/Name/), "my-template");
   await userEvent.click(
     within(form).getByRole("button", { name: /create template/i }),
-  )
+  );
 
   // Wait for the variables form to be rendered and fill it
-  await screen.findByText(/Variables/)
+  await screen.findByText(/Variables/, undefined, { timeout: 5_000 });
 
   // Type first variable
-  await userEvent.clear(screen.getByLabelText(/var.first_variable/))
+  await userEvent.clear(screen.getByLabelText(/var.first_variable/));
   await userEvent.type(
     screen.getByLabelText(/var.first_variable/),
     "First value",
-  )
+  );
   // Type second variable
-  await userEvent.clear(screen.getByLabelText(/var.second_variable/))
-  await userEvent.type(screen.getByLabelText(/var.second_variable/), "2")
+  await userEvent.clear(screen.getByLabelText(/var.second_variable/));
+  await userEvent.type(screen.getByLabelText(/var.second_variable/), "2");
   // Select third variable on radio
-  await userEvent.click(screen.getByLabelText(/True/))
+  await userEvent.click(screen.getByLabelText(/True/));
   // Setup the mock for the second template version creation before submit the form
-  jest.clearAllMocks()
+  jest.clearAllMocks();
   jest
     .spyOn(API, "createTemplateVersion")
-    .mockResolvedValue(MockTemplateVersion)
-  jest.spyOn(API, "createTemplate").mockResolvedValue(MockTemplate)
+    .mockResolvedValue(MockTemplateVersion);
+  jest.spyOn(API, "getTemplateVersion").mockResolvedValue(MockTemplateVersion);
+  jest.spyOn(API, "createTemplate").mockResolvedValue(MockTemplate);
   await userEvent.click(
     within(form).getByRole("button", { name: /create template/i }),
-  )
-  await waitFor(() => expect(API.createTemplate).toBeCalledTimes(1))
+  );
+  await waitFor(() => expect(API.createTemplate).toBeCalledTimes(1));
   expect(router.state.location.pathname).toEqual(
     `/templates/${MockTemplate.name}`,
-  )
+  );
   expect(API.createTemplateVersion).toHaveBeenCalledWith(MockOrganization.id, {
-    file_id: MockProvisionerJob.file_id,
+    example_id: "aws-windows",
     provisioner: "terraform",
     storage_method: "file",
     tags: {},
@@ -103,34 +100,45 @@ test("Create template with variables", async () => {
       { name: "second_variable", value: "2" },
       { name: "third_variable", value: "true" },
     ],
-  })
-})
+  });
+});
+
+test("Create template from duplicating a template", async () => {
+  jest.spyOn(API, "getTemplateByName").mockResolvedValue(MockTemplate);
+  jest.spyOn(API, "getTemplateVersion").mockResolvedValue(MockTemplateVersion);
+  jest
+    .spyOn(API, "getTemplateVersionVariables")
+    .mockResolvedValue([MockTemplateVersionVariable1]);
 
-test("Create template from another template", async () => {
   const searchParams = new URLSearchParams({
     fromTemplate: MockTemplate.name,
-  })
-  const { router } = await renderPage(searchParams)
+  });
+  const { router } = await renderPage(searchParams);
   // Name and display name are using copy prefixes
-  expect(screen.getByLabelText(/Name/)).toHaveValue(`${MockTemplate.name}-copy`)
+  expect(screen.getByLabelText(/Name/)).toHaveValue(
+    `${MockTemplate.name}-copy`,
+  );
   expect(screen.getByLabelText(/Display name/)).toHaveValue(
     `Copy of ${MockTemplate.display_name}`,
-  )
+  );
   // Variables are using the same values
   expect(
     screen.getByLabelText(MockTemplateVersionVariable1.description, {
       exact: false,
     }),
-  ).toHaveValue(MockTemplateVersionVariable1.value)
+  ).toHaveValue(MockTemplateVersionVariable1.value);
   // Create template
   jest
     .spyOn(API, "createTemplateVersion")
-    .mockResolvedValue(MockTemplateVersion)
-  jest.spyOn(API, "createTemplate").mockResolvedValue(MockTemplate)
+    .mockResolvedValue(MockTemplateVersion);
+  jest.spyOn(API, "getTemplateVersion").mockResolvedValue(MockTemplateVersion);
+  jest.spyOn(API, "createTemplate").mockResolvedValue(MockTemplate);
   await userEvent.click(
     screen.getByRole("button", { name: /create template/i }),
-  )
-  expect(router.state.location.pathname).toEqual(
-    `/templates/${MockTemplate.name}`,
-  )
-})
+  );
+  await waitFor(() => {
+    expect(router.state.location.pathname).toEqual(
+      `/templates/${MockTemplate.name}`,
+    );
+  });
+});
diff --git a/site/src/pages/CreateTemplatePage/CreateTemplatePage.tsx b/site/src/pages/CreateTemplatePage/CreateTemplatePage.tsx
index b22b6e72fefe7..5b98964d5c20b 100644
--- a/site/src/pages/CreateTemplatePage/CreateTemplatePage.tsx
+++ b/site/src/pages/CreateTemplatePage/CreateTemplatePage.tsx
@@ -1,52 +1,19 @@
-import { useMachine } from "@xstate/react"
-import { isApiValidationError } from "api/errors"
-import { Maybe } from "components/Conditionals/Maybe"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import { FullPageHorizontalForm } from "components/FullPageForm/FullPageHorizontalForm"
-import { Loader } from "components/Loader/Loader"
-import { Stack } from "components/Stack/Stack"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useTranslation } from "react-i18next"
-import { useNavigate, useSearchParams } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import { createTemplateMachine } from "xServices/createTemplate/createTemplateXService"
-import { CreateTemplateForm } from "./CreateTemplateForm"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
+import { FullPageHorizontalForm } from "components/FullPageForm/FullPageHorizontalForm";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { useNavigate, useSearchParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import { DuplicateTemplateView } from "./DuplicateTemplateView";
+import { ImportStarterTemplateView } from "./ImportStarterTemplateView";
+import { UploadTemplateView } from "./UploadTemplateView";
 
 const CreateTemplatePage: FC = () => {
-  const { t } = useTranslation("createTemplatePage")
-  const navigate = useNavigate()
-  const organizationId = useOrganizationId()
-  const [searchParams] = useSearchParams()
-  const [state, send] = useMachine(createTemplateMachine, {
-    context: {
-      organizationId,
-      exampleId: searchParams.get("exampleId"),
-      templateNameToCopy: searchParams.get("fromTemplate"),
-    },
-    actions: {
-      onCreate: (_, { data }) => {
-        navigate(`/templates/${data.name}`)
-      },
-    },
-  })
-
-  const { starterTemplate, error, file, jobError, jobLogs, variables } =
-    state.context
-  const shouldDisplayForm = !state.hasTag("loading")
-  const { entitlements } = useDashboard()
-  const allowAdvancedScheduling =
-    entitlements.features["advanced_template_scheduling"].enabled
-  // Requires the template RBAC feature, otherwise disabling everyone access
-  // means no one can access.
-  const allowDisableEveryoneAccess =
-    entitlements.features["template_rbac"].enabled
+  const navigate = useNavigate();
+  const [searchParams] = useSearchParams();
 
   const onCancel = () => {
-    navigate(-1)
-  }
+    navigate(-1);
+  };
 
   return (
     <>
@@ -54,50 +21,17 @@ const CreateTemplatePage: FC = () => {
         <title>{pageTitle("Create Template")}</title>
       </Helmet>
 
-      <FullPageHorizontalForm title={t("title")} onCancel={onCancel}>
-        <Maybe condition={state.hasTag("loading")}>
-          <Loader />
-        </Maybe>
-
-        <Stack spacing={6}>
-          <Maybe condition={Boolean(error && !isApiValidationError(error))}>
-            <ErrorAlert error={error} />
-          </Maybe>
-
-          {shouldDisplayForm && (
-            <CreateTemplateForm
-              copiedTemplate={state.context.copiedTemplate}
-              allowAdvancedScheduling={allowAdvancedScheduling}
-              allowDisableEveryoneAccess={allowDisableEveryoneAccess}
-              error={error}
-              starterTemplate={starterTemplate}
-              isSubmitting={state.hasTag("submitting")}
-              variables={variables}
-              onCancel={onCancel}
-              onSubmit={(data) => {
-                send({
-                  type: "CREATE",
-                  data,
-                })
-              }}
-              upload={{
-                file,
-                isUploading: state.matches("uploading"),
-                onRemove: () => {
-                  send("REMOVE_FILE")
-                },
-                onUpload: (file) => {
-                  send({ type: "UPLOAD_FILE", file })
-                },
-              }}
-              jobError={jobError}
-              logs={jobLogs}
-            />
-          )}
-        </Stack>
+      <FullPageHorizontalForm title="Create Template" onCancel={onCancel}>
+        {searchParams.has("fromTemplate") ? (
+          <DuplicateTemplateView />
+        ) : searchParams.has("exampleId") ? (
+          <ImportStarterTemplateView />
+        ) : (
+          <UploadTemplateView />
+        )}
       </FullPageHorizontalForm>
     </>
-  )
-}
+  );
+};
 
-export default CreateTemplatePage
+export default CreateTemplatePage;
diff --git a/site/src/pages/CreateTemplatePage/DuplicateTemplateView.tsx b/site/src/pages/CreateTemplatePage/DuplicateTemplateView.tsx
new file mode 100644
index 0000000000000..3fcdb594989fb
--- /dev/null
+++ b/site/src/pages/CreateTemplatePage/DuplicateTemplateView.tsx
@@ -0,0 +1,85 @@
+import { useQuery, useMutation } from "react-query";
+import {
+  templateVersionLogs,
+  templateByName,
+  templateVersion,
+  templateVersionVariables,
+  JobError,
+  createTemplate,
+} from "api/queries/templates";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { useOrganizationId } from "hooks";
+import { useNavigate, useSearchParams } from "react-router-dom";
+import { CreateTemplateForm } from "./CreateTemplateForm";
+import { Loader } from "components/Loader/Loader";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { firstVersionFromFile, getFormPermissions, newTemplate } from "./utils";
+
+export const DuplicateTemplateView = () => {
+  const navigate = useNavigate();
+  const organizationId = useOrganizationId();
+  const [searchParams] = useSearchParams();
+  const templateByNameQuery = useQuery(
+    templateByName(organizationId, searchParams.get("fromTemplate")!),
+  );
+  const activeVersionId = templateByNameQuery.data?.active_version_id ?? "";
+  const templateVersionQuery = useQuery({
+    ...templateVersion(activeVersionId),
+    enabled: templateByNameQuery.isSuccess,
+  });
+  const templateVersionVariablesQuery = useQuery({
+    ...templateVersionVariables(activeVersionId),
+    enabled: templateByNameQuery.isSuccess,
+  });
+  const isLoading =
+    templateByNameQuery.isLoading ||
+    templateVersionQuery.isLoading ||
+    templateVersionVariablesQuery.isLoading;
+  const loadingError =
+    templateByNameQuery.error ||
+    templateVersionQuery.error ||
+    templateVersionVariablesQuery.error;
+
+  const dashboard = useDashboard();
+  const formPermissions = getFormPermissions(dashboard.entitlements);
+
+  const createTemplateMutation = useMutation(createTemplate());
+  const createError = createTemplateMutation.error;
+  const isJobError = createError instanceof JobError;
+  const templateVersionLogsQuery = useQuery({
+    ...templateVersionLogs(isJobError ? createError.version.id : ""),
+    enabled: isJobError,
+  });
+
+  if (isLoading) {
+    return <Loader />;
+  }
+
+  if (loadingError) {
+    return <ErrorAlert error={loadingError} />;
+  }
+
+  return (
+    <CreateTemplateForm
+      {...formPermissions}
+      copiedTemplate={templateByNameQuery.data!}
+      error={createTemplateMutation.error}
+      isSubmitting={createTemplateMutation.isLoading}
+      variables={templateVersionVariablesQuery.data}
+      onCancel={() => navigate(-1)}
+      jobError={isJobError ? createError.job.error : undefined}
+      logs={templateVersionLogsQuery.data}
+      onSubmit={async (formData) => {
+        const template = await createTemplateMutation.mutateAsync({
+          organizationId,
+          version: firstVersionFromFile(
+            templateVersionQuery.data!.job.file_id,
+            formData.user_variable_values,
+          ),
+          template: newTemplate(formData),
+        });
+        navigate(`/templates/${template.name}`);
+      }}
+    />
+  );
+};
diff --git a/site/src/pages/CreateTemplatePage/ImportStarterTemplateView.tsx b/site/src/pages/CreateTemplatePage/ImportStarterTemplateView.tsx
new file mode 100644
index 0000000000000..38e596b9081e1
--- /dev/null
+++ b/site/src/pages/CreateTemplatePage/ImportStarterTemplateView.tsx
@@ -0,0 +1,82 @@
+import { useQuery, useMutation } from "react-query";
+import {
+  templateVersionLogs,
+  JobError,
+  createTemplate,
+  templateExamples,
+  templateVersionVariables,
+} from "api/queries/templates";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { useOrganizationId } from "hooks";
+import { useNavigate, useSearchParams } from "react-router-dom";
+import { CreateTemplateForm } from "./CreateTemplateForm";
+import { Loader } from "components/Loader/Loader";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import {
+  firstVersionFromExample,
+  getFormPermissions,
+  newTemplate,
+} from "./utils";
+
+export const ImportStarterTemplateView = () => {
+  const navigate = useNavigate();
+  const organizationId = useOrganizationId();
+  const [searchParams] = useSearchParams();
+  const templateExamplesQuery = useQuery(templateExamples(organizationId));
+  const templateExample = templateExamplesQuery.data?.find(
+    (e) => e.id === searchParams.get("exampleId")!,
+  );
+
+  const isLoading = templateExamplesQuery.isLoading;
+  const loadingError = templateExamplesQuery.error;
+
+  const dashboard = useDashboard();
+  const formPermissions = getFormPermissions(dashboard.entitlements);
+
+  const createTemplateMutation = useMutation(createTemplate());
+  const createError = createTemplateMutation.error;
+  const isJobError = createError instanceof JobError;
+  const templateVersionLogsQuery = useQuery({
+    ...templateVersionLogs(isJobError ? createError.version.id : ""),
+    enabled: isJobError,
+  });
+
+  const missedVariables = useQuery({
+    ...templateVersionVariables(isJobError ? createError.version.id : ""),
+    enabled:
+      isJobError &&
+      createError.job.error_code === "REQUIRED_TEMPLATE_VARIABLES",
+  });
+
+  if (isLoading) {
+    return <Loader />;
+  }
+
+  if (loadingError) {
+    return <ErrorAlert error={loadingError} />;
+  }
+
+  return (
+    <CreateTemplateForm
+      {...formPermissions}
+      starterTemplate={templateExample!}
+      variables={missedVariables.data}
+      error={createTemplateMutation.error}
+      isSubmitting={createTemplateMutation.isLoading}
+      onCancel={() => navigate(-1)}
+      jobError={isJobError ? createError.job.error : undefined}
+      logs={templateVersionLogsQuery.data}
+      onSubmit={async (formData) => {
+        const template = await createTemplateMutation.mutateAsync({
+          organizationId,
+          version: firstVersionFromExample(
+            templateExample!,
+            formData.user_variable_values,
+          ),
+          template: newTemplate(formData),
+        });
+        navigate(`/templates/${template.name}`);
+      }}
+    />
+  );
+};
diff --git a/site/src/pages/CreateTemplatePage/TemplateUpload.tsx b/site/src/pages/CreateTemplatePage/TemplateUpload.tsx
index f7e73812f7c07..3b532ed536e67 100644
--- a/site/src/pages/CreateTemplatePage/TemplateUpload.tsx
+++ b/site/src/pages/CreateTemplatePage/TemplateUpload.tsx
@@ -1,14 +1,13 @@
-import Link from "@mui/material/Link"
-import { FileUpload } from "components/FileUpload/FileUpload"
-import { FC } from "react"
-import { useTranslation } from "react-i18next"
-import { Link as RouterLink } from "react-router-dom"
+import Link from "@mui/material/Link";
+import { FileUpload } from "components/FileUpload/FileUpload";
+import { FC } from "react";
+import { Link as RouterLink } from "react-router-dom";
 
 export interface TemplateUploadProps {
-  isUploading: boolean
-  onUpload: (file: File) => void
-  onRemove: () => void
-  file?: File
+  isUploading: boolean;
+  onUpload: (file: File) => void;
+  onRemove: () => void;
+  file?: File;
 }
 
 export const TemplateUpload: FC<TemplateUploadProps> = ({
@@ -17,8 +16,6 @@ export const TemplateUpload: FC<TemplateUploadProps> = ({
   onRemove,
   file,
 }) => {
-  const { t } = useTranslation("createTemplatePage")
-
   const description = (
     <>
       The template has to be a .tar file. You can also use our{" "}
@@ -27,14 +24,14 @@ export const TemplateUpload: FC<TemplateUploadProps> = ({
         to="/starter-templates"
         // Prevent trigger the upload
         onClick={(e) => {
-          e.stopPropagation()
+          e.stopPropagation();
         }}
       >
         starter templates
       </Link>{" "}
       to getting started with Coder.
     </>
-  )
+  );
 
   return (
     <FileUpload
@@ -42,11 +39,11 @@ export const TemplateUpload: FC<TemplateUploadProps> = ({
       onUpload={onUpload}
       onRemove={onRemove}
       file={file}
-      removeLabel={t("form.upload.removeFile")}
-      title={t("form.upload.title")}
+      removeLabel="Remove file"
+      title="Upload template"
       description={description}
       extension=".tar"
       fileTypeRequired="application/x-tar"
     />
-  )
-}
+  );
+};
diff --git a/site/src/pages/CreateTemplatePage/UploadTemplateView.tsx b/site/src/pages/CreateTemplatePage/UploadTemplateView.tsx
new file mode 100644
index 0000000000000..b3eb11a7c1c3c
--- /dev/null
+++ b/site/src/pages/CreateTemplatePage/UploadTemplateView.tsx
@@ -0,0 +1,68 @@
+import { useQuery, useMutation } from "react-query";
+import {
+  templateVersionLogs,
+  JobError,
+  createTemplate,
+  templateVersionVariables,
+} from "api/queries/templates";
+import { useOrganizationId } from "hooks";
+import { useNavigate } from "react-router-dom";
+import { CreateTemplateForm } from "./CreateTemplateForm";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { firstVersionFromFile, getFormPermissions, newTemplate } from "./utils";
+import { uploadFile } from "api/queries/files";
+
+export const UploadTemplateView = () => {
+  const navigate = useNavigate();
+  const organizationId = useOrganizationId();
+
+  const dashboard = useDashboard();
+  const formPermissions = getFormPermissions(dashboard.entitlements);
+
+  const uploadFileMutation = useMutation(uploadFile());
+  const uploadedFile = uploadFileMutation.data;
+
+  const createTemplateMutation = useMutation(createTemplate());
+  const createError = createTemplateMutation.error;
+  const isJobError = createError instanceof JobError;
+  const templateVersionLogsQuery = useQuery({
+    ...templateVersionLogs(isJobError ? createError.version.id : ""),
+    enabled: isJobError,
+  });
+
+  const missedVariables = useQuery({
+    ...templateVersionVariables(isJobError ? createError.version.id : ""),
+    enabled:
+      isJobError &&
+      createError.job.error_code === "REQUIRED_TEMPLATE_VARIABLES",
+  });
+
+  return (
+    <CreateTemplateForm
+      {...formPermissions}
+      variables={missedVariables.data}
+      error={createTemplateMutation.error}
+      isSubmitting={createTemplateMutation.isLoading}
+      onCancel={() => navigate(-1)}
+      jobError={isJobError ? createError.job.error : undefined}
+      logs={templateVersionLogsQuery.data}
+      upload={{
+        onUpload: uploadFileMutation.mutateAsync,
+        isUploading: uploadFileMutation.isLoading,
+        onRemove: uploadFileMutation.reset,
+        file: uploadFileMutation.variables,
+      }}
+      onSubmit={async (formData) => {
+        const template = await createTemplateMutation.mutateAsync({
+          organizationId,
+          version: firstVersionFromFile(
+            uploadedFile!.hash,
+            formData.user_variable_values,
+          ),
+          template: newTemplate(formData),
+        });
+        navigate(`/templates/${template.name}`);
+      }}
+    />
+  );
+};
diff --git a/site/src/pages/CreateTemplatePage/VariableInput.tsx b/site/src/pages/CreateTemplatePage/VariableInput.tsx
index 5b07e19346953..012e3c9efbe3e 100644
--- a/site/src/pages/CreateTemplatePage/VariableInput.tsx
+++ b/site/src/pages/CreateTemplatePage/VariableInput.tsx
@@ -1,20 +1,20 @@
-import FormControlLabel from "@mui/material/FormControlLabel"
-import Radio from "@mui/material/Radio"
-import RadioGroup from "@mui/material/RadioGroup"
-import { makeStyles } from "@mui/styles"
-import TextField from "@mui/material/TextField"
-import { Stack } from "components/Stack/Stack"
-import { FC } from "react"
-import { TemplateVersionVariable } from "../../api/typesGenerated"
+import FormControlLabel from "@mui/material/FormControlLabel";
+import Radio from "@mui/material/Radio";
+import RadioGroup from "@mui/material/RadioGroup";
+import { makeStyles } from "@mui/styles";
+import TextField from "@mui/material/TextField";
+import { Stack } from "components/Stack/Stack";
+import { FC } from "react";
+import { TemplateVersionVariable } from "api/typesGenerated";
 
 const isBoolean = (variable: TemplateVersionVariable) => {
-  return variable.type === "bool"
-}
+  return variable.type === "bool";
+};
 
 const VariableLabel: React.FC<{ variable: TemplateVersionVariable }> = ({
   variable,
 }) => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <label htmlFor={variable.name}>
@@ -24,14 +24,14 @@ const VariableLabel: React.FC<{ variable: TemplateVersionVariable }> = ({
       </span>
       <span className={styles.labelDescription}>{variable.description}</span>
     </label>
-  )
-}
+  );
+};
 
 export interface VariableInputProps {
-  disabled?: boolean
-  variable: TemplateVersionVariable
-  onChange: (value: string) => void
-  defaultValue?: string
+  disabled?: boolean;
+  variable: TemplateVersionVariable;
+  onChange: (value: string) => void;
+  defaultValue?: string;
 }
 
 export const VariableInput: FC<VariableInputProps> = ({
@@ -40,7 +40,7 @@ export const VariableInput: FC<VariableInputProps> = ({
   variable,
   defaultValue,
 }) => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <Stack direction="column" spacing={0.75}>
@@ -54,8 +54,8 @@ export const VariableInput: FC<VariableInputProps> = ({
         />
       </div>
     </Stack>
-  )
-}
+  );
+};
 
 const VariableField: React.FC<VariableInputProps> = ({
   disabled,
@@ -69,7 +69,7 @@ const VariableField: React.FC<VariableInputProps> = ({
         id={variable.name}
         defaultValue={variable.default_value}
         onChange={(event) => {
-          onChange(event.target.value)
+          onChange(event.target.value);
         }}
       >
         <FormControlLabel
@@ -85,7 +85,7 @@ const VariableField: React.FC<VariableInputProps> = ({
           label="False"
         />
       </RadioGroup>
-    )
+    );
   }
 
   return (
@@ -100,7 +100,7 @@ const VariableField: React.FC<VariableInputProps> = ({
         variable.sensitive ? "" : defaultValue ?? variable.default_value
       }
       onChange={(event) => {
-        onChange(event.target.value)
+        onChange(event.target.value);
       }}
       type={
         variable.type === "number"
@@ -110,8 +110,8 @@ const VariableField: React.FC<VariableInputProps> = ({
           : "string"
       }
     />
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   labelName: {
@@ -135,4 +135,4 @@ const useStyles = makeStyles((theme) => ({
     alignItems: "center",
     gap: theme.spacing(1),
   },
-}))
+}));
diff --git a/site/src/pages/CreateTemplatePage/utils.ts b/site/src/pages/CreateTemplatePage/utils.ts
new file mode 100644
index 0000000000000..fdeb1046d3869
--- /dev/null
+++ b/site/src/pages/CreateTemplatePage/utils.ts
@@ -0,0 +1,85 @@
+import {
+  Entitlements,
+  ProvisionerType,
+  TemplateExample,
+  VariableValue,
+} from "api/typesGenerated";
+import { calculateAutostopRequirementDaysValue } from "utils/schedule";
+import { CreateTemplateData } from "./CreateTemplateForm";
+
+const provisioner: ProvisionerType =
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Playwright needs to use a different provisioner type!
+  typeof (window as any).playwright !== "undefined" ? "echo" : "terraform";
+
+export const newTemplate = (formData: CreateTemplateData) => {
+  const {
+    default_ttl_hours,
+    max_ttl_hours,
+    parameter_values_by_name,
+    allow_everyone_group_access,
+    autostart_requirement_days_of_week,
+    autostop_requirement_days_of_week,
+    autostop_requirement_weeks,
+    ...safeTemplateData
+  } = formData;
+
+  return {
+    ...safeTemplateData,
+    disable_everyone_group_access: !formData.allow_everyone_group_access,
+    default_ttl_ms: formData.default_ttl_hours * 60 * 60 * 1000, // Convert hours to ms
+    max_ttl_ms: formData.max_ttl_hours * 60 * 60 * 1000, // Convert hours to ms
+    autostop_requirement: {
+      days_of_week: calculateAutostopRequirementDaysValue(
+        formData.autostop_requirement_days_of_week,
+      ),
+      weeks: formData.autostop_requirement_weeks,
+    },
+    autostart_requirement: {
+      days_of_week: autostart_requirement_days_of_week,
+    },
+    require_active_version: false,
+  };
+};
+
+export const getFormPermissions = (entitlements: Entitlements) => {
+  const allowAdvancedScheduling =
+    entitlements.features["advanced_template_scheduling"].enabled;
+  // Requires the template RBAC feature, otherwise disabling everyone access
+  // means no one can access.
+  const allowDisableEveryoneAccess =
+    entitlements.features["template_rbac"].enabled;
+  const allowAutostopRequirement =
+    entitlements.features["template_autostop_requirement"].enabled;
+
+  return {
+    allowAdvancedScheduling,
+    allowDisableEveryoneAccess,
+    allowAutostopRequirement,
+  };
+};
+
+export const firstVersionFromFile = (
+  fileId: string,
+  variables: VariableValue[] | undefined,
+) => {
+  return {
+    storage_method: "file" as const,
+    provisioner: provisioner,
+    user_variable_values: variables,
+    file_id: fileId,
+    tags: {},
+  };
+};
+
+export const firstVersionFromExample = (
+  example: TemplateExample,
+  variables: VariableValue[] | undefined,
+) => {
+  return {
+    storage_method: "file" as const,
+    provisioner: provisioner,
+    user_variable_values: variables,
+    example_id: example.id,
+    tags: {},
+  };
+};
diff --git a/site/src/pages/CreateTokenPage/CreateTokenForm.tsx b/site/src/pages/CreateTokenPage/CreateTokenForm.tsx
index fa104cb165427..318fbdab89a3c 100644
--- a/site/src/pages/CreateTokenPage/CreateTokenForm.tsx
+++ b/site/src/pages/CreateTokenPage/CreateTokenForm.tsx
@@ -1,36 +1,39 @@
-import { FC, useState, useEffect } from "react"
+import { type FC, useState, useEffect } from "react";
+import TextField from "@mui/material/TextField";
+import MenuItem from "@mui/material/MenuItem";
+import type { FormikContextType } from "formik";
+import dayjs from "dayjs";
+import { useNavigate } from "react-router-dom";
 import {
   FormFields,
   FormSection,
   FormFooter,
   HorizontalForm,
-} from "components/Form/Form"
-import makeStyles from "@mui/styles/makeStyles"
-import { useTranslation } from "react-i18next"
-import { onChangeTrimmed, getFormHelpers } from "utils/formUtils"
-import TextField from "@mui/material/TextField"
-import MenuItem from "@mui/material/MenuItem"
+} from "components/Form/Form";
+import { Stack } from "components/Stack/Stack";
+import { onChangeTrimmed, getFormHelpers } from "utils/formUtils";
 import {
   NANO_HOUR,
-  CreateTokenData,
+  type CreateTokenData,
   determineDefaultLtValue,
   filterByMaxTokenLifetime,
   customLifetimeDay,
-} from "./utils"
-import { FormikContextType } from "formik"
-import dayjs from "dayjs"
-import { useNavigate } from "react-router-dom"
-import { Stack } from "components/Stack/Stack"
+} from "./utils";
+import { css } from "@emotion/css";
 
 interface CreateTokenFormProps {
-  form: FormikContextType<CreateTokenData>
-  maxTokenLifetime?: number
-  formError: unknown
-  setFormError: (arg0: unknown) => void
-  isCreating: boolean
-  creationFailed: boolean
+  form: FormikContextType<CreateTokenData>;
+  maxTokenLifetime?: number;
+  formError: unknown;
+  setFormError: (arg0: unknown) => void;
+  isCreating: boolean;
+  creationFailed: boolean;
 }
 
+const sectionInfoStyles = css`
+  min-width: 300px;
+`;
+
 export const CreateTokenForm: FC<CreateTokenFormProps> = ({
   form,
   maxTokenLifetime,
@@ -39,37 +42,35 @@ export const CreateTokenForm: FC<CreateTokenFormProps> = ({
   isCreating,
   creationFailed,
 }) => {
-  const styles = useStyles()
-  const { t } = useTranslation("tokensPage")
-  const navigate = useNavigate()
+  const navigate = useNavigate();
 
-  const [expDays, setExpDays] = useState<number>(1)
+  const [expDays, setExpDays] = useState<number>(1);
   const [lifetimeDays, setLifetimeDays] = useState<number | string>(
     determineDefaultLtValue(maxTokenLifetime),
-  )
+  );
 
   useEffect(() => {
     if (lifetimeDays !== "custom") {
-      void form.setFieldValue("lifetime", lifetimeDays)
+      void form.setFieldValue("lifetime", lifetimeDays);
     } else {
-      void form.setFieldValue("lifetime", expDays)
+      void form.setFieldValue("lifetime", expDays);
     }
     // eslint-disable-next-line react-hooks/exhaustive-deps -- adding form will cause an infinite loop
-  }, [lifetimeDays, expDays])
+  }, [lifetimeDays, expDays]);
 
-  const getFieldHelpers = getFormHelpers<CreateTokenData>(form, formError)
+  const getFieldHelpers = getFormHelpers<CreateTokenData>(form, formError);
 
   return (
     <HorizontalForm onSubmit={form.handleSubmit}>
       <FormSection
         title="Name"
         description="What is this token for?"
-        classes={{ sectionInfo: styles.formSectionInfo }}
+        classes={{ sectionInfo: sectionInfoStyles }}
       >
         <FormFields>
           <TextField
             {...getFieldHelpers("name")}
-            label={t("createToken.fields.name")}
+            label="Name"
             required
             onChange={onChangeTrimmed(form, () => setFormError(undefined))}
             autoFocus
@@ -87,17 +88,17 @@ export const CreateTokenForm: FC<CreateTokenFormProps> = ({
                 .format("MMMM DD, YYYY")}`
             : "Please set a token expiration."
         }
-        classes={{ sectionInfo: styles.formSectionInfo }}
+        classes={{ sectionInfo: sectionInfoStyles }}
       >
         <FormFields>
           <Stack direction="row">
             <TextField
               select
-              label={t("createToken.fields.lifetime")}
+              label="Lifetime"
               required
               defaultValue={determineDefaultLtValue(maxTokenLifetime)}
               onChange={(event) => {
-                void setLifetimeDays(event.target.value)
+                void setLifetimeDays(event.target.value);
               }}
               fullWidth
             >
@@ -117,13 +118,13 @@ export const CreateTokenForm: FC<CreateTokenFormProps> = ({
             {lifetimeDays === "custom" && (
               <TextField
                 type="date"
-                label={t("createToken.lifetimeSection.expiresOn")}
+                label="Expires on"
                 defaultValue={dayjs().add(expDays, "day").format("YYYY-MM-DD")}
                 onChange={(event) => {
                   const lt = Math.ceil(
                     dayjs(event.target.value).diff(dayjs(), "day", true),
-                  )
-                  setExpDays(lt)
+                  );
+                  setExpDays(lt);
                 }}
                 inputProps={{
                   min: dayjs().add(1, "day").format("YYYY-MM-DD"),
@@ -149,11 +150,5 @@ export const CreateTokenForm: FC<CreateTokenFormProps> = ({
         submitLabel={creationFailed ? "Retry" : "Create token"}
       />
     </HorizontalForm>
-  )
-}
-
-const useStyles = makeStyles(() => ({
-  formSectionInfo: {
-    minWidth: "300px",
-  },
-}))
+  );
+};
diff --git a/site/src/pages/CreateTokenPage/CreateTokenPage.test.tsx b/site/src/pages/CreateTokenPage/CreateTokenPage.test.tsx
index 34cc8306d2fc1..cb167247818de 100644
--- a/site/src/pages/CreateTokenPage/CreateTokenPage.test.tsx
+++ b/site/src/pages/CreateTokenPage/CreateTokenPage.test.tsx
@@ -1,32 +1,32 @@
 import {
   renderWithAuth,
   waitForLoaderToBeRemoved,
-} from "testHelpers/renderHelpers"
-import { CreateTokenPage } from "pages/CreateTokenPage/CreateTokenPage"
-import * as API from "api/api"
-import { screen, within } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
+} from "testHelpers/renderHelpers";
+import { CreateTokenPage } from "./CreateTokenPage";
+import * as API from "api/api";
+import { screen, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 
 describe("TokenPage", () => {
   it("shows the success modal", async () => {
     jest.spyOn(API, "createToken").mockResolvedValueOnce({
       key: "abcd",
-    })
+    });
 
     // When
     const { container } = renderWithAuth(<CreateTokenPage />, {
       route: "/settings/tokens/new",
       path: "/settings/tokens/new",
-    })
-    await waitForLoaderToBeRemoved()
+    });
+    await waitForLoaderToBeRemoved();
 
-    const form = container.querySelector("form") as HTMLFormElement
-    await userEvent.type(screen.getByLabelText(/Name/), "my-token")
+    const form = container.querySelector("form") as HTMLFormElement;
+    await userEvent.type(screen.getByLabelText(/Name/), "my-token");
     await userEvent.click(
       within(form).getByRole("button", { name: /create token/i }),
-    )
+    );
 
     // Then
-    expect(screen.getByText("abcd")).toBeInTheDocument()
-  })
-})
+    expect(screen.getByText("abcd")).toBeInTheDocument();
+  });
+});
diff --git a/site/src/pages/CreateTokenPage/CreateTokenPage.tsx b/site/src/pages/CreateTokenPage/CreateTokenPage.tsx
index 91b58e41ed417..b965be76a6b78 100644
--- a/site/src/pages/CreateTokenPage/CreateTokenPage.tsx
+++ b/site/src/pages/CreateTokenPage/CreateTokenPage.tsx
@@ -1,30 +1,28 @@
-import { FC, useState } from "react"
-import { useTranslation } from "react-i18next"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { FullPageHorizontalForm } from "components/FullPageForm/FullPageHorizontalForm"
-import { useNavigate } from "react-router-dom"
-import { useFormik } from "formik"
-import { Loader } from "components/Loader/Loader"
-import { displaySuccess, displayError } from "components/GlobalSnackbar/utils"
-import { useMutation, useQuery } from "@tanstack/react-query"
-import { createToken, getTokenConfig } from "api/api"
-import { CreateTokenForm } from "./CreateTokenForm"
-import { NANO_HOUR, CreateTokenData } from "./utils"
-import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog"
-import { CodeExample } from "components/CodeExample/CodeExample"
-import { makeStyles } from "@mui/styles"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
+import { FC, useState } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { FullPageHorizontalForm } from "components/FullPageForm/FullPageHorizontalForm";
+import { useNavigate } from "react-router-dom";
+import { useFormik } from "formik";
+import { Loader } from "components/Loader/Loader";
+import { displaySuccess, displayError } from "components/GlobalSnackbar/utils";
+import { useMutation, useQuery } from "react-query";
+import { createToken, getTokenConfig } from "api/api";
+import { CreateTokenForm } from "./CreateTokenForm";
+import { NANO_HOUR, CreateTokenData } from "./utils";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import { CodeExample } from "components/CodeExample/CodeExample";
+import { makeStyles } from "@mui/styles";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
 
 const initialValues: CreateTokenData = {
   name: "",
   lifetime: 30,
-}
+};
 
 export const CreateTokenPage: FC = () => {
-  const { t } = useTranslation("tokensPage")
-  const styles = useStyles()
-  const navigate = useNavigate()
+  const styles = useStyles();
+  const navigate = useNavigate();
 
   const {
     mutate: saveToken,
@@ -32,7 +30,7 @@ export const CreateTokenPage: FC = () => {
     isError: creationFailed,
     isSuccess: creationSuccessful,
     data: newToken,
-  } = useMutation(createToken)
+  } = useMutation(createToken);
   const {
     data: tokenConfig,
     isLoading: fetchingTokenConfig,
@@ -41,19 +39,19 @@ export const CreateTokenPage: FC = () => {
   } = useQuery({
     queryKey: ["tokenconfig"],
     queryFn: getTokenConfig,
-  })
+  });
 
-  const [formError, setFormError] = useState<unknown>(undefined)
+  const [formError, setFormError] = useState<unknown>(undefined);
 
   const onCreateSuccess = () => {
-    displaySuccess(t("createToken.createSuccess"))
-    navigate("/settings/tokens")
-  }
+    displaySuccess("Token has been created");
+    navigate("/settings/tokens");
+  };
 
   const onCreateError = (error: unknown) => {
-    setFormError(error)
-    displayError(t("createToken.createError"))
-  }
+    setFormError(error);
+    displayError("Failed to create token");
+  };
 
   const form = useFormik<CreateTokenData>({
     initialValues,
@@ -67,19 +65,19 @@ export const CreateTokenPage: FC = () => {
         {
           onError: onCreateError,
         },
-      )
+      );
     },
-  })
+  });
 
   const tokenDescription = (
     <>
-      <p>{t("createToken.successModal.description")}</p>
+      <p>Make sure you copy the below token before proceeding:</p>
       <CodeExample code={newToken?.key ?? ""} className={styles.codeExample} />
     </>
-  )
+  );
 
   if (fetchingTokenConfig) {
-    return <Loader />
+    return <Loader />;
   }
 
   return (
@@ -89,8 +87,8 @@ export const CreateTokenPage: FC = () => {
       </Helmet>
       {tokenFetchFailed && <ErrorAlert error={tokenFetchError} />}
       <FullPageHorizontalForm
-        title={t("createToken.title")}
-        detail={t("createToken.detail")}
+        title="Create Token"
+        detail="All tokens are unscoped and therefore have full resource access."
       >
         <CreateTokenForm
           form={form}
@@ -104,7 +102,7 @@ export const CreateTokenPage: FC = () => {
         <ConfirmDialog
           type="info"
           hideCancel
-          title={t("createToken.successModal.title")}
+          title="Creation successful"
           description={tokenDescription}
           open={creationSuccessful && Boolean(newToken.key)}
           confirmLoading={isCreating}
@@ -113,8 +111,8 @@ export const CreateTokenPage: FC = () => {
         />
       </FullPageHorizontalForm>
     </>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   codeExample: {
@@ -123,6 +121,6 @@ const useStyles = makeStyles((theme) => ({
     width: "100%",
     marginTop: theme.spacing(3),
   },
-}))
+}));
 
-export default CreateTokenPage
+export default CreateTokenPage;
diff --git a/site/src/pages/CreateTokenPage/utils.test.tsx b/site/src/pages/CreateTokenPage/utils.test.tsx
index 4ab7d18c79a2d..edbde7ae95c35 100644
--- a/site/src/pages/CreateTokenPage/utils.test.tsx
+++ b/site/src/pages/CreateTokenPage/utils.test.tsx
@@ -4,13 +4,13 @@ import {
   lifetimeDayPresets,
   LifetimeDay,
   NANO_HOUR,
-} from "./utils"
+} from "./utils";
 
 describe("unit/CreateTokenForm", () => {
   describe("filterByMaxTokenLifetime", () => {
     it.each<{
-      maxTokenLifetime: number
-      expected: LifetimeDay[]
+      maxTokenLifetime: number;
+      expected: LifetimeDay[];
     }>([
       { maxTokenLifetime: 6 * 24 * NANO_HOUR, expected: [] },
       {
@@ -36,14 +36,14 @@ describe("unit/CreateTokenForm", () => {
     ])(
       `filterByMaxTokenLifetime($maxTokenLifetime)`,
       ({ maxTokenLifetime, expected }) => {
-        expect(filterByMaxTokenLifetime(maxTokenLifetime)).toEqual(expected)
+        expect(filterByMaxTokenLifetime(maxTokenLifetime)).toEqual(expected);
       },
-    )
-  })
+    );
+  });
   describe("determineDefaultLtValue", () => {
     it.each<{
-      maxTokenLifetime: number
-      expected: string | number
+      maxTokenLifetime: number;
+      expected: string | number;
     }>([
       {
         maxTokenLifetime: 0,
@@ -64,8 +64,8 @@ describe("unit/CreateTokenForm", () => {
     ])(
       `determineDefaultLtValue($maxTokenLifetime)`,
       ({ maxTokenLifetime, expected }) => {
-        expect(determineDefaultLtValue(maxTokenLifetime)).toEqual(expected)
+        expect(determineDefaultLtValue(maxTokenLifetime)).toEqual(expected);
       },
-    )
-  })
-})
+    );
+  });
+});
diff --git a/site/src/pages/CreateTokenPage/utils.ts b/site/src/pages/CreateTokenPage/utils.ts
index 97b2874241910..be1b9c4f16e0e 100644
--- a/site/src/pages/CreateTokenPage/utils.ts
+++ b/site/src/pages/CreateTokenPage/utils.ts
@@ -1,71 +1,69 @@
-import i18next from "i18next"
-
-export const NANO_HOUR = 3600000000000
+export const NANO_HOUR = 3600000000000;
 
 export interface CreateTokenData {
-  name: string
-  lifetime: number
+  name: string;
+  lifetime: number;
 }
 
 export interface LifetimeDay {
-  label: string
-  value: number | string
+  label: string;
+  value: number | string;
 }
 
 export const lifetimeDayPresets: LifetimeDay[] = [
   {
-    label: i18next.t("tokensPage:createToken.lifetimeSection.7"),
+    label: "7 days",
     value: 7,
   },
   {
-    label: i18next.t("tokensPage:createToken.lifetimeSection.30"),
+    label: "30 days",
     value: 30,
   },
   {
-    label: i18next.t("tokensPage:createToken.lifetimeSection.60"),
+    label: "60 days",
     value: 60,
   },
   {
-    label: i18next.t("tokensPage:createToken.lifetimeSection.90"),
+    label: "90 days",
     value: 90,
   },
-]
+];
 
 export const customLifetimeDay: LifetimeDay = {
-  label: i18next.t("tokensPage:createToken.lifetimeSection.custom"),
+  label: "Custom",
   value: "custom",
-}
+};
 
 export const filterByMaxTokenLifetime = (
   maxTokenLifetime?: number,
 ): LifetimeDay[] => {
   // if maxTokenLifetime hasn't been set, return the full array of options
   if (!maxTokenLifetime) {
-    return lifetimeDayPresets
+    return lifetimeDayPresets;
   }
 
   // otherwise only return options that are less than or equal to the max lifetime
   return lifetimeDayPresets.filter(
     (lifetime) => Number(lifetime.value) <= maxTokenLifetime / NANO_HOUR / 24,
-  )
-}
+  );
+};
 
 export const determineDefaultLtValue = (
   maxTokenLifetime?: number,
 ): string | number => {
-  const filteredArr = filterByMaxTokenLifetime(maxTokenLifetime)
+  const filteredArr = filterByMaxTokenLifetime(maxTokenLifetime);
 
   // default to a lifetime of 30 days if within the maxTokenLifetime
-  const thirtyDayDefault = filteredArr.find((lt) => lt.value === 30)
+  const thirtyDayDefault = filteredArr.find((lt) => lt.value === 30);
   if (thirtyDayDefault) {
-    return thirtyDayDefault.value
+    return thirtyDayDefault.value;
   }
 
   // otherwise default to the first preset option
   if (filteredArr[0]) {
-    return filteredArr[0].value
+    return filteredArr[0].value;
   }
 
   // if no preset options are within the maxTokenLifetime, default to "custom"
-  return "custom"
-}
+  return "custom";
+};
diff --git a/site/src/pages/CreateUserPage/CreateUserForm.stories.tsx b/site/src/pages/CreateUserPage/CreateUserForm.stories.tsx
new file mode 100644
index 0000000000000..b4e1a3d535e69
--- /dev/null
+++ b/site/src/pages/CreateUserPage/CreateUserForm.stories.tsx
@@ -0,0 +1,41 @@
+import { action } from "@storybook/addon-actions";
+import { StoryObj, Meta } from "@storybook/react";
+import { CreateUserForm } from "./CreateUserForm";
+import { mockApiError } from "testHelpers/entities";
+
+const meta: Meta<typeof CreateUserForm> = {
+  title: "pages/CreateUserPage",
+  component: CreateUserForm,
+  args: {
+    onCancel: action("cancel"),
+    onSubmit: action("submit"),
+    isLoading: false,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof CreateUserForm>;
+
+export const Ready: Story = {};
+
+export const FormError: Story = {
+  args: {
+    error: mockApiError({
+      validations: [{ field: "username", detail: "Username taken" }],
+    }),
+  },
+};
+
+export const GeneralError: Story = {
+  args: {
+    error: mockApiError({
+      message: "User already exists",
+    }),
+  },
+};
+
+export const Loading: Story = {
+  args: {
+    isLoading: true,
+  },
+};
diff --git a/site/src/pages/CreateUserPage/CreateUserForm.tsx b/site/src/pages/CreateUserPage/CreateUserForm.tsx
new file mode 100644
index 0000000000000..630316aea8c57
--- /dev/null
+++ b/site/src/pages/CreateUserPage/CreateUserForm.tsx
@@ -0,0 +1,202 @@
+import TextField from "@mui/material/TextField";
+import MenuItem from "@mui/material/MenuItem";
+import Link from "@mui/material/Link";
+import { FormikContextType, useFormik } from "formik";
+import { FC } from "react";
+import * as Yup from "yup";
+import { hasApiFieldErrors, isApiError } from "api/errors";
+import * as TypesGen from "api/typesGenerated";
+import {
+  getFormHelpers,
+  nameValidator,
+  onChangeTrimmed,
+} from "utils/formUtils";
+import { FormFooter } from "components/FormFooter/FormFooter";
+import { FullPageForm } from "components/FullPageForm/FullPageForm";
+import { Stack } from "components/Stack/Stack";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+
+export const Language = {
+  emailLabel: "Email",
+  passwordLabel: "Password",
+  usernameLabel: "Username",
+  emailInvalid: "Please enter a valid email address.",
+  emailRequired: "Please enter an email address.",
+  passwordRequired: "Please enter a password.",
+  createUser: "Create",
+  cancel: "Cancel",
+};
+
+export const authMethodLanguage = {
+  password: {
+    displayName: "Password",
+    description: "Use an email address and password to login",
+  },
+  oidc: {
+    displayName: "OpenID Connect",
+    description: "Use an OpenID Connect provider for authentication",
+  },
+  github: {
+    displayName: "Github",
+    description: "Use Github OAuth for authentication",
+  },
+  none: {
+    displayName: "None",
+    description: (
+      <>
+        Disable authentication for this user (See the{" "}
+        <Link
+          target="_blank"
+          rel="noopener"
+          href="https://coder.com/docs/v2/latest/admin/auth#disable-built-in-authentication"
+        >
+          documentation
+        </Link>{" "}
+        for more details)
+      </>
+    ),
+  },
+};
+
+export interface CreateUserFormProps {
+  onSubmit: (user: TypesGen.CreateUserRequest) => void;
+  onCancel: () => void;
+  error?: unknown;
+  isLoading: boolean;
+  myOrgId: string;
+  authMethods?: TypesGen.AuthMethods;
+}
+
+const validationSchema = Yup.object({
+  email: Yup.string()
+    .trim()
+    .email(Language.emailInvalid)
+    .required(Language.emailRequired),
+  password: Yup.string().when("login_type", {
+    is: "password",
+    then: (schema) => schema.required(Language.passwordRequired),
+    otherwise: (schema) => schema,
+  }),
+  username: nameValidator(Language.usernameLabel),
+  login_type: Yup.string().oneOf(Object.keys(authMethodLanguage)),
+});
+
+export const CreateUserForm: FC<
+  React.PropsWithChildren<CreateUserFormProps>
+> = ({ onSubmit, onCancel, error, isLoading, myOrgId, authMethods }) => {
+  const form: FormikContextType<TypesGen.CreateUserRequest> =
+    useFormik<TypesGen.CreateUserRequest>({
+      initialValues: {
+        email: "",
+        password: "",
+        username: "",
+        organization_id: myOrgId,
+        disable_login: false,
+        login_type: "",
+      },
+      validationSchema,
+      onSubmit,
+    });
+  const getFieldHelpers = getFormHelpers<TypesGen.CreateUserRequest>(
+    form,
+    error,
+  );
+
+  const methods = [
+    authMethods?.password.enabled && "password",
+    authMethods?.oidc.enabled && "oidc",
+    authMethods?.github.enabled && "github",
+    "none",
+  ].filter(Boolean) as Array<keyof typeof authMethodLanguage>;
+
+  return (
+    <FullPageForm title="Create user">
+      {isApiError(error) && !hasApiFieldErrors(error) && (
+        <ErrorAlert error={error} sx={{ mb: 4 }} />
+      )}
+      <form onSubmit={form.handleSubmit} autoComplete="off">
+        <Stack spacing={2.5}>
+          <TextField
+            {...getFieldHelpers("username")}
+            onChange={onChangeTrimmed(form)}
+            autoComplete="username"
+            autoFocus
+            fullWidth
+            label={Language.usernameLabel}
+          />
+          <TextField
+            {...getFieldHelpers("email")}
+            onChange={onChangeTrimmed(form)}
+            autoComplete="email"
+            fullWidth
+            label={Language.emailLabel}
+          />
+          <TextField
+            {...getFieldHelpers(
+              "login_type",
+              "Authentication method for this user",
+            )}
+            select
+            id="login_type"
+            data-testid="login-type-input"
+            value={form.values.login_type}
+            label="Login Type"
+            onChange={async (e) => {
+              if (e.target.value !== "password") {
+                await form.setFieldValue("password", "");
+              }
+              await form.setFieldValue("login_type", e.target.value);
+            }}
+            SelectProps={{
+              renderValue: (selected: unknown) =>
+                authMethodLanguage[selected as keyof typeof authMethodLanguage]
+                  ?.displayName ?? "",
+            }}
+          >
+            {methods.map((value) => {
+              const language = authMethodLanguage[value];
+              return (
+                <MenuItem key={value} id={"item-" + value} value={value}>
+                  <Stack
+                    spacing={0}
+                    css={{
+                      maxWidth: 400,
+                    }}
+                  >
+                    {language.displayName}
+                    <span
+                      css={(theme) => ({
+                        fontSize: 14,
+                        color: theme.palette.text.secondary,
+                        wordWrap: "normal",
+                        whiteSpace: "break-spaces",
+                      })}
+                    >
+                      {language.description}
+                    </span>
+                  </Stack>
+                </MenuItem>
+              );
+            })}
+          </TextField>
+          <TextField
+            {...getFieldHelpers(
+              "password",
+              form.values.login_type === "password"
+                ? ""
+                : "No password required for this login type",
+            )}
+            autoComplete="current-password"
+            fullWidth
+            id="password"
+            data-testid="password-input"
+            disabled={form.values.login_type !== "password"}
+            label={Language.passwordLabel}
+            type="password"
+          />
+        </Stack>
+        <FormFooter onCancel={onCancel} isLoading={isLoading} />
+      </form>
+    </FullPageForm>
+  );
+};
diff --git a/site/src/pages/CreateUserPage/CreateUserPage.test.tsx b/site/src/pages/CreateUserPage/CreateUserPage.test.tsx
new file mode 100644
index 0000000000000..7662fd7c86835
--- /dev/null
+++ b/site/src/pages/CreateUserPage/CreateUserPage.test.tsx
@@ -0,0 +1,53 @@
+import { fireEvent, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { Language as FormLanguage } from "./CreateUserForm";
+import { Language as FooterLanguage } from "components/FormFooter/FormFooter";
+import {
+  renderWithAuth,
+  waitForLoaderToBeRemoved,
+} from "testHelpers/renderHelpers";
+import { CreateUserPage } from "./CreateUserPage";
+
+const renderCreateUserPage = async () => {
+  renderWithAuth(<CreateUserPage />, {
+    extraRoutes: [{ path: "/users", element: <div>Users Page</div> }],
+  });
+  await waitForLoaderToBeRemoved();
+};
+
+const fillForm = async ({
+  username = "someuser",
+  email = "someone@coder.com",
+  password = "SomeSecurePassword!",
+}: {
+  username?: string;
+  email?: string;
+  password?: string;
+}) => {
+  const usernameField = screen.getByLabelText(FormLanguage.usernameLabel);
+  const emailField = screen.getByLabelText(FormLanguage.emailLabel);
+  const passwordField = screen
+    .getByTestId("password-input")
+    .querySelector("input");
+
+  const loginTypeField = screen.getByTestId("login-type-input");
+  await userEvent.type(usernameField, username);
+  await userEvent.type(emailField, email);
+  await userEvent.type(loginTypeField, "password");
+  await userEvent.type(passwordField as HTMLElement, password);
+  const submitButton = await screen.findByText(
+    FooterLanguage.defaultSubmitLabel,
+  );
+  fireEvent.click(submitButton);
+};
+
+describe("Create User Page", () => {
+  it("shows success notification and redirects to users page", async () => {
+    await renderCreateUserPage();
+    await fillForm({});
+    const successMessage = await screen.findByText(
+      "Successfully created user.",
+    );
+    expect(successMessage).toBeDefined();
+  });
+});
diff --git a/site/src/pages/CreateUserPage/CreateUserPage.tsx b/site/src/pages/CreateUserPage/CreateUserPage.tsx
new file mode 100644
index 0000000000000..f3ad9f622577a
--- /dev/null
+++ b/site/src/pages/CreateUserPage/CreateUserPage.tsx
@@ -0,0 +1,47 @@
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { useNavigate } from "react-router-dom";
+import { CreateUserForm } from "./CreateUserForm";
+import { Margins } from "components/Margins/Margins";
+import { pageTitle } from "utils/page";
+import { useMutation, useQuery, useQueryClient } from "react-query";
+import { authMethods, createUser } from "api/queries/users";
+import { displaySuccess } from "components/GlobalSnackbar/utils";
+
+export const Language = {
+  unknownError: "Oops, an unknown error occurred.",
+};
+
+export const CreateUserPage: FC = () => {
+  const myOrgId = useOrganizationId();
+  const navigate = useNavigate();
+  const queryClient = useQueryClient();
+  const createUserMutation = useMutation(createUser(queryClient));
+  const authMethodsQuery = useQuery(authMethods());
+
+  return (
+    <Margins>
+      <Helmet>
+        <title>{pageTitle("Create User")}</title>
+      </Helmet>
+
+      <CreateUserForm
+        error={createUserMutation.error}
+        authMethods={authMethodsQuery.data}
+        onSubmit={async (user) => {
+          await createUserMutation.mutateAsync(user);
+          displaySuccess("Successfully created user.");
+          navigate("/users");
+        }}
+        onCancel={() => {
+          navigate("/users");
+        }}
+        isLoading={createUserMutation.isLoading}
+        myOrgId={myOrgId}
+      />
+    </Margins>
+  );
+};
+
+export default CreateUserPage;
diff --git a/site/src/pages/CreateWorkspacePage/CreateWorkspacePage.test.tsx b/site/src/pages/CreateWorkspacePage/CreateWorkspacePage.test.tsx
index b34ff6fd97939..37cfbd791ca6a 100644
--- a/site/src/pages/CreateWorkspacePage/CreateWorkspacePage.test.tsx
+++ b/site/src/pages/CreateWorkspacePage/CreateWorkspacePage.test.tsx
@@ -1,124 +1,80 @@
-import { fireEvent, screen, waitFor } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
-import * as API from "api/api"
-import i18next from "i18next"
+import { fireEvent, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import * as API from "api/api";
 import {
   MockTemplate,
   MockUser,
   MockWorkspace,
   MockWorkspaceQuota,
   MockWorkspaceRequest,
+  MockWorkspaceRichParametersRequest,
   MockTemplateVersionParameter1,
   MockTemplateVersionParameter2,
   MockTemplateVersionParameter3,
-  MockTemplateVersionGitAuth,
+  MockTemplateVersionExternalAuthGithub,
   MockOrganization,
-} from "testHelpers/entities"
+  MockTemplateVersionExternalAuthGithubAuthenticated,
+} from "testHelpers/entities";
 import {
   renderWithAuth,
   waitForLoaderToBeRemoved,
-} from "testHelpers/renderHelpers"
-import CreateWorkspacePage from "./CreateWorkspacePage"
-
-const { t } = i18next
-
-const nameLabelText = t("nameLabel", { ns: "createWorkspacePage" })
-const createWorkspaceText = t("createWorkspace", { ns: "createWorkspacePage" })
-const validationNumberNotInRangeText = t("validationNumberNotInRange", {
-  ns: "createWorkspacePage",
-  min: "1",
-  max: "3",
-})
-const validationPatternNotMatched = t("validationPatternNotMatched", {
-  ns: "createWorkspacePage",
-  error: MockTemplateVersionParameter3.validation_error,
-  pattern: "^[a-z]{3}$",
-})
+} from "testHelpers/renderHelpers";
+import CreateWorkspacePage from "./CreateWorkspacePage";
+
+const nameLabelText = "Workspace Name";
+const createWorkspaceText = "Create Workspace";
+const validationNumberNotInRangeText = "Value must be between 1 and 3.";
+const validationPatternNotMatched = `${MockTemplateVersionParameter3.validation_error} (value does not match the pattern ^[a-z]{3}$)`;
 
 const renderCreateWorkspacePage = () => {
   return renderWithAuth(<CreateWorkspacePage />, {
     route: "/templates/" + MockTemplate.name + "/workspace",
     path: "/templates/:template/workspace",
-  })
-}
-
-Object.defineProperty(window, "BroadcastChannel", {
-  value: class {
-    addEventListener() {
-      // noop
-    }
-    close() {
-      // noop
-    }
-  },
-})
+  });
+};
 
 describe("CreateWorkspacePage", () => {
-  it("renders", async () => {
-    jest
-      .spyOn(API, "getTemplateVersionRichParameters")
-      .mockResolvedValueOnce([MockTemplateVersionParameter1])
-    renderCreateWorkspacePage()
-
-    const element = await screen.findByText(createWorkspaceText)
-    expect(element).toBeDefined()
-  })
-
-  it("renders with rich parameter", async () => {
-    jest
-      .spyOn(API, "getTemplateVersionRichParameters")
-      .mockResolvedValueOnce([MockTemplateVersionParameter1])
-    renderCreateWorkspacePage()
-
-    const element = await screen.findByText(createWorkspaceText)
-    expect(element).toBeDefined()
-    const firstParameter = await screen.findByText(
-      MockTemplateVersionParameter1.description,
-    )
-    expect(firstParameter).toBeDefined()
-  })
-
   it("succeeds with default owner", async () => {
     jest
       .spyOn(API, "getUsers")
-      .mockResolvedValueOnce({ users: [MockUser], count: 1 })
+      .mockResolvedValueOnce({ users: [MockUser], count: 1 });
     jest
       .spyOn(API, "getWorkspaceQuota")
-      .mockResolvedValueOnce(MockWorkspaceQuota)
-    jest.spyOn(API, "createWorkspace").mockResolvedValueOnce(MockWorkspace)
+      .mockResolvedValueOnce(MockWorkspaceQuota);
+    jest.spyOn(API, "createWorkspace").mockResolvedValueOnce(MockWorkspace);
     jest
       .spyOn(API, "getTemplateVersionRichParameters")
-      .mockResolvedValueOnce([MockTemplateVersionParameter1])
+      .mockResolvedValueOnce([MockTemplateVersionParameter1]);
 
-    renderCreateWorkspacePage()
+    renderCreateWorkspacePage();
 
-    const nameField = await screen.findByLabelText(nameLabelText)
+    const nameField = await screen.findByLabelText(nameLabelText);
 
     // have to use fireEvent b/c userEvent isn't cleaning up properly between tests
     fireEvent.change(nameField, {
       target: { value: "test" },
-    })
+    });
 
-    const submitButton = screen.getByText(createWorkspaceText)
-    await userEvent.click(submitButton)
+    const submitButton = screen.getByText(createWorkspaceText);
+    await userEvent.click(submitButton);
 
     await waitFor(() =>
       expect(API.createWorkspace).toBeCalledWith(
         MockUser.organization_ids[0],
         MockUser.id,
-        {
-          ...MockWorkspaceRequest,
-        },
+        expect.objectContaining({
+          ...MockWorkspaceRichParametersRequest,
+        }),
       ),
-    )
-  })
+    );
+  });
 
   it("uses default rich param values passed from the URL", async () => {
-    const param = "first_parameter"
-    const paramValue = "It works!"
+    const param = "first_parameter";
+    const paramValue = "It works!";
     jest
       .spyOn(API, "getTemplateVersionRichParameters")
-      .mockResolvedValueOnce([MockTemplateVersionParameter1])
+      .mockResolvedValueOnce([MockTemplateVersionParameter1]);
 
     renderWithAuth(<CreateWorkspacePage />, {
       route:
@@ -126,10 +82,10 @@ describe("CreateWorkspacePage", () => {
         MockTemplate.name +
         `/workspace?param.${param}=${paramValue}`,
       path: "/templates/:template/workspace",
-    })
+    });
 
-    await screen.findByDisplayValue(paramValue)
-  })
+    await screen.findByDisplayValue(paramValue);
+  });
 
   it("rich parameter: number validation fails", async () => {
     jest
@@ -137,34 +93,34 @@ describe("CreateWorkspacePage", () => {
       .mockResolvedValueOnce([
         MockTemplateVersionParameter1,
         MockTemplateVersionParameter2,
-      ])
+      ]);
 
-    renderCreateWorkspacePage()
-    await waitForLoaderToBeRemoved()
+    renderCreateWorkspacePage();
+    await waitForLoaderToBeRemoved();
 
-    const element = await screen.findByText("Create Workspace")
-    expect(element).toBeDefined()
+    const element = await screen.findByText("Create Workspace");
+    expect(element).toBeDefined();
     const secondParameter = await screen.findByText(
       MockTemplateVersionParameter2.description,
-    )
-    expect(secondParameter).toBeDefined()
+    );
+    expect(secondParameter).toBeDefined();
 
     const secondParameterField = await screen.findByLabelText(
       MockTemplateVersionParameter2.name,
       { exact: false },
-    )
-    expect(secondParameterField).toBeDefined()
+    );
+    expect(secondParameterField).toBeDefined();
 
     fireEvent.change(secondParameterField, {
       target: { value: "4" },
-    })
-    fireEvent.submit(secondParameter)
+    });
+    fireEvent.submit(secondParameter);
 
     const validationError = await screen.findByText(
       validationNumberNotInRangeText,
-    )
-    expect(validationError).toBeDefined()
-  })
+    );
+    expect(validationError).toBeDefined();
+  });
 
   it("rich parameter: string validation fails", async () => {
     jest
@@ -172,57 +128,103 @@ describe("CreateWorkspacePage", () => {
       .mockResolvedValueOnce([
         MockTemplateVersionParameter1,
         MockTemplateVersionParameter3,
-      ])
+      ]);
 
-    renderCreateWorkspacePage()
-    await waitForLoaderToBeRemoved()
+    renderCreateWorkspacePage();
+    await waitForLoaderToBeRemoved();
 
-    const element = await screen.findByText(createWorkspaceText)
-    expect(element).toBeDefined()
+    const element = await screen.findByText(createWorkspaceText);
+    expect(element).toBeDefined();
     const thirdParameter = await screen.findByText(
       MockTemplateVersionParameter3.description,
-    )
-    expect(thirdParameter).toBeDefined()
+    );
+    expect(thirdParameter).toBeDefined();
 
     const thirdParameterField = await screen.findByLabelText(
       MockTemplateVersionParameter3.name,
       { exact: false },
-    )
-    expect(thirdParameterField).toBeDefined()
+    );
+    expect(thirdParameterField).toBeDefined();
     fireEvent.change(thirdParameterField, {
       target: { value: "1234" },
-    })
-    fireEvent.submit(thirdParameterField)
+    });
+    fireEvent.submit(thirdParameterField);
 
-    const validationError = await screen.findByText(validationPatternNotMatched)
-    expect(validationError).toBeInTheDocument()
-  })
+    const validationError = await screen.findByText(
+      validationPatternNotMatched,
+    );
+    expect(validationError).toBeInTheDocument();
+  });
 
-  it("gitauth: errors if unauthenticated and submits", async () => {
+  it("external auth authenticates and succeeds", async () => {
     jest
-      .spyOn(API, "getTemplateVersionGitAuth")
-      .mockResolvedValueOnce([MockTemplateVersionGitAuth])
+      .spyOn(API, "getWorkspaceQuota")
+      .mockResolvedValueOnce(MockWorkspaceQuota);
+    jest
+      .spyOn(API, "getUsers")
+      .mockResolvedValueOnce({ users: [MockUser], count: 1 });
+    jest.spyOn(API, "createWorkspace").mockResolvedValueOnce(MockWorkspace);
+    jest
+      .spyOn(API, "getTemplateVersionExternalAuth")
+      .mockResolvedValue([MockTemplateVersionExternalAuthGithub]);
+
+    renderCreateWorkspacePage();
+    await waitForLoaderToBeRemoved();
 
-    renderCreateWorkspacePage()
-    await waitForLoaderToBeRemoved()
+    const nameField = await screen.findByLabelText(nameLabelText);
+    // have to use fireEvent b/c userEvent isn't cleaning up properly between tests
+    fireEvent.change(nameField, {
+      target: { value: "test" },
+    });
 
-    const nameField = await screen.findByLabelText(nameLabelText)
+    const githubButton = await screen.findByText("Login with GitHub");
+    await userEvent.click(githubButton);
+
+    jest
+      .spyOn(API, "getTemplateVersionExternalAuth")
+      .mockResolvedValue([MockTemplateVersionExternalAuthGithubAuthenticated]);
+
+    await screen.findByText("Authenticated with GitHub");
+
+    const submitButton = screen.getByText(createWorkspaceText);
+    await userEvent.click(submitButton);
+
+    await waitFor(() =>
+      expect(API.createWorkspace).toBeCalledWith(
+        MockUser.organization_ids[0],
+        MockUser.id,
+        expect.objectContaining({
+          ...MockWorkspaceRequest,
+        }),
+      ),
+    );
+  });
+
+  it("external auth: errors if unauthenticated and submits", async () => {
+    jest
+      .spyOn(API, "getTemplateVersionExternalAuth")
+      .mockResolvedValueOnce([MockTemplateVersionExternalAuthGithub]);
+
+    renderCreateWorkspacePage();
+    await waitForLoaderToBeRemoved();
+
+    const nameField = await screen.findByLabelText(nameLabelText);
 
     // have to use fireEvent b/c userEvent isn't cleaning up properly between tests
     fireEvent.change(nameField, {
       target: { value: "test" },
-    })
+    });
 
-    const submitButton = screen.getByText(createWorkspaceText)
-    await userEvent.click(submitButton)
+    const submitButton = screen.getByText(createWorkspaceText);
+    await userEvent.click(submitButton);
 
-    await screen.findByText("You must authenticate to create a workspace!")
-  })
+    await screen.findByText("You must authenticate to create a workspace!");
+  });
 
   it("auto create a workspace if uses mode=auto", async () => {
-    const param = "first_parameter"
-    const paramValue = "It works!"
-    const createWorkspaceSpy = jest.spyOn(API, "createWorkspace")
+    const param = "first_parameter";
+    const paramValue = "It works!";
+    const createWorkspaceSpy = jest.spyOn(API, "createWorkspace");
 
     renderWithAuth(<CreateWorkspacePage />, {
       route:
@@ -230,7 +232,7 @@ describe("CreateWorkspacePage", () => {
         MockTemplate.name +
         `/workspace?param.${param}=${paramValue}&mode=auto`,
       path: "/templates/:template/workspace",
-    })
+    });
 
     await waitFor(() => {
       expect(createWorkspaceSpy).toBeCalledWith(
@@ -240,7 +242,32 @@ describe("CreateWorkspacePage", () => {
           template_id: MockTemplate.id,
           rich_parameter_values: [{ name: param, value: paramValue }],
         }),
-      )
-    })
-  })
-})
+      );
+    });
+  });
+
+  it("auto create a workspace if uses mode=auto and version=version-id", async () => {
+    const param = "first_parameter";
+    const paramValue = "It works!";
+    const createWorkspaceSpy = jest.spyOn(API, "createWorkspace");
+
+    renderWithAuth(<CreateWorkspacePage />, {
+      route:
+        "/templates/" +
+        MockTemplate.name +
+        `/workspace?param.${param}=${paramValue}&mode=auto&version=test-template-version`,
+      path: "/templates/:template/workspace",
+    });
+
+    await waitFor(() => {
+      expect(createWorkspaceSpy).toBeCalledWith(
+        MockOrganization.id,
+        "me",
+        expect.objectContaining({
+          template_version_id: MockTemplate.active_version_id,
+          rich_parameter_values: [{ name: param, value: paramValue }],
+        }),
+      );
+    });
+  });
+});
diff --git a/site/src/pages/CreateWorkspacePage/CreateWorkspacePage.tsx b/site/src/pages/CreateWorkspacePage/CreateWorkspacePage.tsx
index d49ea38894ed9..2c6cff4807e81 100644
--- a/site/src/pages/CreateWorkspacePage/CreateWorkspacePage.tsx
+++ b/site/src/pages/CreateWorkspacePage/CreateWorkspacePage.tsx
@@ -1,135 +1,247 @@
-import { useMachine } from "@xstate/react"
 import {
-  Template,
-  TemplateVersionGitAuth,
   TemplateVersionParameter,
+  Workspace,
   WorkspaceBuildParameter,
-} from "api/typesGenerated"
-import { useMe } from "hooks/useMe"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useNavigate, useParams, useSearchParams } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import {
-  CreateWSPermissions,
-  CreateWorkspaceMode,
-  createWorkspaceMachine,
-} from "xServices/createWorkspace/createWorkspaceXService"
-import { CreateWorkspacePageView } from "./CreateWorkspacePageView"
-import { Loader } from "components/Loader/Loader"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
+} from "api/typesGenerated";
+import { useMe } from "hooks/useMe";
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { type FC, useCallback, useState, useEffect } from "react";
+import { Helmet } from "react-helmet-async";
+import { useNavigate, useParams, useSearchParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import { CreateWorkspacePageView } from "./CreateWorkspacePageView";
+import { Loader } from "components/Loader/Loader";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
 import {
   uniqueNamesGenerator,
   animals,
   colors,
   NumberDictionary,
-} from "unique-names-generator"
+} from "unique-names-generator";
+import { useMutation, useQuery, useQueryClient } from "react-query";
+import {
+  templateByName,
+  templateVersionExternalAuth,
+  richParameters,
+} from "api/queries/templates";
+import { autoCreateWorkspace, createWorkspace } from "api/queries/workspaces";
+import { checkAuthorization } from "api/queries/authCheck";
+import { CreateWSPermissions, createWorkspaceChecks } from "./permissions";
+import { paramsUsedToCreateWorkspace } from "utils/workspace";
+import { useEffectEvent } from "hooks/hookPolyfills";
+
+type CreateWorkspaceMode = "form" | "auto";
+
+export type ExternalAuthPollingState = "idle" | "polling" | "abandoned";
 
 const CreateWorkspacePage: FC = () => {
-  const organizationId = useOrganizationId()
-  const { template: templateName } = useParams() as { template: string }
-  const me = useMe()
-  const navigate = useNavigate()
-  const [searchParams] = useSearchParams()
-  const defaultBuildParameters = getDefaultBuildParameters(searchParams)
-  const mode = (searchParams.get("mode") ?? "form") as CreateWorkspaceMode
-  const [createWorkspaceState, send] = useMachine(createWorkspaceMachine, {
-    context: {
-      organizationId,
-      templateName,
-      mode,
-      defaultBuildParameters,
-      defaultName:
-        mode === "auto" ? generateUniqueName() : searchParams.get("name") ?? "",
-    },
-    actions: {
-      onCreateWorkspace: (_, event) => {
-        navigate(`/@${event.data.owner_name}/${event.data.name}`)
-      },
-    },
-  })
-  const { template, error, parameters, permissions, gitAuth, defaultName } =
-    createWorkspaceState.context
-  const title = createWorkspaceState.matches("autoCreating")
+  const organizationId = useOrganizationId();
+  const { template: templateName } = useParams() as { template: string };
+  const me = useMe();
+  const navigate = useNavigate();
+  const [searchParams, setSearchParams] = useSearchParams();
+  const defaultBuildParameters = getDefaultBuildParameters(searchParams);
+  const mode = (searchParams.get("mode") ?? "form") as CreateWorkspaceMode;
+  const customVersionId = searchParams.get("version") ?? undefined;
+  const defaultName =
+    mode === "auto" ? generateUniqueName() : searchParams.get("name") ?? "";
+
+  const queryClient = useQueryClient();
+  const autoCreateWorkspaceMutation = useMutation(
+    autoCreateWorkspace(queryClient),
+  );
+  const createWorkspaceMutation = useMutation(createWorkspace(queryClient));
+
+  const templateQuery = useQuery(templateByName(organizationId, templateName));
+  const permissionsQuery = useQuery(
+    checkAuthorization({
+      checks: createWorkspaceChecks(organizationId),
+    }),
+  );
+  const realizedVersionId =
+    customVersionId ?? templateQuery.data?.active_version_id;
+  const richParametersQuery = useQuery({
+    ...richParameters(realizedVersionId ?? ""),
+    enabled: realizedVersionId !== undefined,
+  });
+  const realizedParameters = richParametersQuery.data
+    ? richParametersQuery.data.filter(paramsUsedToCreateWorkspace)
+    : undefined;
+
+  const { externalAuth, externalAuthPollingState, startPollingExternalAuth } =
+    useExternalAuth(realizedVersionId);
+
+  const isLoadingFormData =
+    templateQuery.isLoading ||
+    permissionsQuery.isLoading ||
+    richParametersQuery.isLoading;
+  const loadFormDataError =
+    templateQuery.error ?? permissionsQuery.error ?? richParametersQuery.error;
+
+  const title = autoCreateWorkspaceMutation.isLoading
     ? "Creating workspace..."
-    : "Create Workspace"
+    : "Create workspace";
+
+  const onCreateWorkspace = useCallback(
+    (workspace: Workspace) => {
+      navigate(`/@${workspace.owner_name}/${workspace.name}`);
+    },
+    [navigate],
+  );
+
+  const automateWorkspaceCreation = useEffectEvent(async () => {
+    try {
+      const newWorkspace = await autoCreateWorkspaceMutation.mutateAsync({
+        templateName,
+        organizationId,
+        defaultBuildParameters,
+        defaultName,
+        versionId: realizedVersionId,
+      });
+
+      onCreateWorkspace(newWorkspace);
+    } catch (err) {
+      searchParams.delete("mode");
+      setSearchParams(searchParams);
+    }
+  });
+
+  useEffect(() => {
+    if (mode === "auto") {
+      void automateWorkspaceCreation();
+    }
+  }, [automateWorkspaceCreation, mode]);
 
   return (
     <>
       <Helmet>
         <title>{pageTitle(title)}</title>
       </Helmet>
-      {Boolean(
-        createWorkspaceState.matches("loadingFormData") ||
-          createWorkspaceState.matches("autoCreating"),
-      ) && <Loader />}
-      {createWorkspaceState.matches("loadError") && (
-        <ErrorAlert error={error} />
-      )}
-      {createWorkspaceState.matches("idle") && (
+      {loadFormDataError && <ErrorAlert error={loadFormDataError} />}
+      {isLoadingFormData || autoCreateWorkspaceMutation.isLoading ? (
+        <Loader />
+      ) : (
         <CreateWorkspacePageView
           defaultName={defaultName}
           defaultOwner={me}
           defaultBuildParameters={defaultBuildParameters}
-          error={error}
-          template={template as Template}
-          gitAuth={gitAuth as TemplateVersionGitAuth[]}
-          permissions={permissions as CreateWSPermissions}
-          parameters={parameters as TemplateVersionParameter[]}
-          creatingWorkspace={createWorkspaceState.matches("creatingWorkspace")}
+          error={createWorkspaceMutation.error}
+          template={templateQuery.data!}
+          versionId={realizedVersionId}
+          externalAuth={externalAuth ?? []}
+          externalAuthPollingState={externalAuthPollingState}
+          startPollingExternalAuth={startPollingExternalAuth}
+          permissions={permissionsQuery.data as CreateWSPermissions}
+          parameters={realizedParameters as TemplateVersionParameter[]}
+          creatingWorkspace={createWorkspaceMutation.isLoading}
           onCancel={() => {
-            navigate(-1)
+            navigate(-1);
           }}
-          onSubmit={(request, owner) => {
-            send({
-              type: "CREATE_WORKSPACE",
-              request,
-              owner,
-            })
+          onSubmit={async (request, owner) => {
+            if (realizedVersionId) {
+              request = {
+                ...request,
+                template_id: undefined,
+                template_version_id: realizedVersionId,
+              };
+            }
+
+            const workspace = await createWorkspaceMutation.mutateAsync({
+              ...request,
+              userId: owner.id,
+              organizationId,
+            });
+            onCreateWorkspace(workspace);
           }}
         />
       )}
     </>
-  )
-}
+  );
+};
+
+const useExternalAuth = (versionId: string | undefined) => {
+  const [externalAuthPollingState, setExternalAuthPollingState] =
+    useState<ExternalAuthPollingState>("idle");
+
+  const startPollingExternalAuth = useCallback(() => {
+    setExternalAuthPollingState("polling");
+  }, []);
 
-export default CreateWorkspacePage
+  const { data: externalAuth } = useQuery(
+    versionId
+      ? {
+          ...templateVersionExternalAuth(versionId),
+          refetchInterval:
+            externalAuthPollingState === "polling" ? 1000 : false,
+        }
+      : { enabled: false },
+  );
+
+  const allSignedIn = externalAuth?.every((it) => it.authenticated);
+
+  useEffect(() => {
+    if (allSignedIn) {
+      setExternalAuthPollingState("idle");
+      return;
+    }
+
+    if (externalAuthPollingState !== "polling") {
+      return;
+    }
+
+    // Poll for a maximum of one minute
+    const quitPolling = setTimeout(
+      () => setExternalAuthPollingState("abandoned"),
+      60_000,
+    );
+    return () => {
+      clearTimeout(quitPolling);
+    };
+  }, [externalAuthPollingState, allSignedIn]);
+
+  return {
+    startPollingExternalAuth,
+    externalAuth,
+    externalAuthPollingState,
+  };
+};
 
 const getDefaultBuildParameters = (
   urlSearchParams: URLSearchParams,
 ): WorkspaceBuildParameter[] => {
-  const buildValues: WorkspaceBuildParameter[] = []
+  const buildValues: WorkspaceBuildParameter[] = [];
   Array.from(urlSearchParams.keys())
     .filter((key) => key.startsWith("param."))
     .forEach((key) => {
-      const name = key.replace("param.", "")
-      const value = urlSearchParams.get(key) ?? ""
-      buildValues.push({ name, value })
-    })
-  return buildValues
-}
+      const name = key.replace("param.", "");
+      const value = urlSearchParams.get(key) ?? "";
+      buildValues.push({ name, value });
+    });
+  return buildValues;
+};
 
 export const orderedTemplateParameters = (
   templateParameters?: TemplateVersionParameter[],
 ): TemplateVersionParameter[] => {
   if (!templateParameters) {
-    return []
+    return [];
   }
 
   const immutables = templateParameters.filter(
     (parameter) => !parameter.mutable,
-  )
-  const mutables = templateParameters.filter((parameter) => parameter.mutable)
-  return [...immutables, ...mutables]
-}
+  );
+  const mutables = templateParameters.filter((parameter) => parameter.mutable);
+  return [...immutables, ...mutables];
+};
 
 const generateUniqueName = () => {
-  const numberDictionary = NumberDictionary.generate({ min: 0, max: 99 })
+  const numberDictionary = NumberDictionary.generate({ min: 0, max: 99 });
   return uniqueNamesGenerator({
     dictionaries: [colors, animals, numberDictionary],
     separator: "-",
     length: 3,
     style: "lowerCase",
-  })
-}
+  });
+};
+
+export default CreateWorkspacePage;
diff --git a/site/src/pages/CreateWorkspacePage/CreateWorkspacePageView.stories.tsx b/site/src/pages/CreateWorkspacePage/CreateWorkspacePageView.stories.tsx
index 51cfc8c69b66f..fb0546ca41363 100644
--- a/site/src/pages/CreateWorkspacePage/CreateWorkspacePageView.stories.tsx
+++ b/site/src/pages/CreateWorkspacePage/CreateWorkspacePageView.stories.tsx
@@ -1,4 +1,4 @@
-import { Meta, StoryObj } from "@storybook/react"
+import { Meta, StoryObj } from "@storybook/react";
 import {
   mockApiError,
   MockTemplate,
@@ -6,11 +6,11 @@ import {
   MockTemplateVersionParameter2,
   MockTemplateVersionParameter3,
   MockUser,
-} from "../../testHelpers/entities"
-import { CreateWorkspacePageView } from "./CreateWorkspacePageView"
+} from "testHelpers/entities";
+import { CreateWorkspacePageView } from "./CreateWorkspacePageView";
 
 const meta: Meta<typeof CreateWorkspacePageView> = {
-  title: "components/Alert",
+  title: "pages/CreateWorkspacePage",
   component: CreateWorkspacePageView,
   args: {
     defaultName: "",
@@ -18,17 +18,17 @@ const meta: Meta<typeof CreateWorkspacePageView> = {
     defaultBuildParameters: [],
     template: MockTemplate,
     parameters: [],
-    gitAuth: [],
+    externalAuth: [],
     permissions: {
       createWorkspaceForUser: true,
     },
   },
-}
+};
 
-export default meta
-type Story = StoryObj<typeof CreateWorkspacePageView>
+export default meta;
+type Story = StoryObj<typeof CreateWorkspacePageView>;
 
-export const NoParameters: Story = {}
+export const NoParameters: Story = {};
 
 export const CreateWorkspaceError: Story = {
   args: {
@@ -43,7 +43,7 @@ export const CreateWorkspaceError: Story = {
       ],
     }),
   },
-}
+};
 
 export const Parameters: Story = {
   args: {
@@ -84,23 +84,27 @@ export const Parameters: Story = {
       },
     ],
   },
-}
+};
 
-export const GitAuth: Story = {
+export const ExternalAuth: Story = {
   args: {
-    gitAuth: [
+    externalAuth: [
       {
         id: "github",
         type: "github",
         authenticated: false,
         authenticate_url: "",
+        display_icon: "/icon/github.svg",
+        display_name: "GitHub",
       },
       {
         id: "gitlab",
         type: "gitlab",
         authenticated: true,
         authenticate_url: "",
+        display_icon: "/icon/gitlab.svg",
+        display_name: "GitLab",
       },
     ],
   },
-}
+};
diff --git a/site/src/pages/CreateWorkspacePage/CreateWorkspacePageView.tsx b/site/src/pages/CreateWorkspacePage/CreateWorkspacePageView.tsx
index ecc16b9b5ce97..a4afc25bfc4c2 100644
--- a/site/src/pages/CreateWorkspacePage/CreateWorkspacePageView.tsx
+++ b/site/src/pages/CreateWorkspacePage/CreateWorkspacePageView.tsx
@@ -1,45 +1,56 @@
-import TextField from "@mui/material/TextField"
-import * as TypesGen from "api/typesGenerated"
-import { UserAutocomplete } from "components/UserAutocomplete/UserAutocomplete"
-import { FormikContextType, useFormik } from "formik"
-import { FC, useEffect, useState } from "react"
-import { useTranslation } from "react-i18next"
-import { getFormHelpers, nameValidator, onChangeTrimmed } from "utils/formUtils"
-import * as Yup from "yup"
-import { FullPageHorizontalForm } from "components/FullPageForm/FullPageHorizontalForm"
-import { SelectedTemplate } from "./SelectedTemplate"
+import TextField from "@mui/material/TextField";
+import * as TypesGen from "api/typesGenerated";
+import { UserAutocomplete } from "components/UserAutocomplete/UserAutocomplete";
+import { FormikContextType, useFormik } from "formik";
+import { FC, useEffect, useState } from "react";
+import {
+  getFormHelpers,
+  nameValidator,
+  onChangeTrimmed,
+} from "utils/formUtils";
+import * as Yup from "yup";
+import { FullPageHorizontalForm } from "components/FullPageForm/FullPageHorizontalForm";
+import { SelectedTemplate } from "./SelectedTemplate";
 import {
   FormFields,
   FormSection,
   FormFooter,
   HorizontalForm,
-} from "components/Form/Form"
-import { makeStyles } from "@mui/styles"
+} from "components/Form/Form";
+import { makeStyles } from "@mui/styles";
 import {
-  selectInitialRichParametersValues,
+  getInitialRichParameterValues,
   useValidationSchemaForRichParameters,
-  workspaceBuildParameterValue,
-} from "utils/richParameters"
+} from "utils/richParameters";
 import {
   ImmutableTemplateParametersSection,
   MutableTemplateParametersSection,
-} from "components/TemplateParameters/TemplateParameters"
-import { CreateWSPermissions } from "xServices/createWorkspace/createWorkspaceXService"
-import { GitAuth } from "components/GitAuth/GitAuth"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
+} from "components/TemplateParameters/TemplateParameters";
+import { ExternalAuth } from "./ExternalAuth";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { Stack } from "components/Stack/Stack";
+import { type ExternalAuthPollingState } from "./CreateWorkspacePage";
+import { useSearchParams } from "react-router-dom";
+import { CreateWSPermissions } from "./permissions";
 
 export interface CreateWorkspacePageViewProps {
-  error: unknown
-  defaultName: string
-  defaultOwner: TypesGen.User
-  template: TypesGen.Template
-  gitAuth: TypesGen.TemplateVersionGitAuth[]
-  parameters: TypesGen.TemplateVersionParameter[]
-  defaultBuildParameters: TypesGen.WorkspaceBuildParameter[]
-  permissions: CreateWSPermissions
-  creatingWorkspace: boolean
-  onCancel: () => void
-  onSubmit: (req: TypesGen.CreateWorkspaceRequest, owner: TypesGen.User) => void
+  error: unknown;
+  defaultName: string;
+  defaultOwner: TypesGen.User;
+  template: TypesGen.Template;
+  versionId?: string;
+  externalAuth: TypesGen.TemplateVersionExternalAuth[];
+  externalAuthPollingState: ExternalAuthPollingState;
+  startPollingExternalAuth: () => void;
+  parameters: TypesGen.TemplateVersionParameter[];
+  defaultBuildParameters: TypesGen.WorkspaceBuildParameter[];
+  permissions: CreateWSPermissions;
+  creatingWorkspace: boolean;
+  onCancel: () => void;
+  onSubmit: (
+    req: TypesGen.CreateWorkspaceRequest,
+    owner: TypesGen.User,
+  ) => void;
 }
 
 export const CreateWorkspacePageView: FC<CreateWorkspacePageViewProps> = ({
@@ -47,7 +58,10 @@ export const CreateWorkspacePageView: FC<CreateWorkspacePageViewProps> = ({
   defaultName,
   defaultOwner,
   template,
-  gitAuth,
+  versionId,
+  externalAuth,
+  externalAuthPollingState,
+  startPollingExternalAuth,
   parameters,
   defaultBuildParameters,
   permissions,
@@ -55,49 +69,47 @@ export const CreateWorkspacePageView: FC<CreateWorkspacePageViewProps> = ({
   onSubmit,
   onCancel,
 }) => {
-  const initialRichParameterValues = selectInitialRichParametersValues(
-    parameters,
-    defaultBuildParameters,
-  )
-  const { t } = useTranslation("createWorkspacePage")
-  const styles = useStyles()
-  const [owner, setOwner] = useState(defaultOwner)
-  const { verifyGitAuth, gitAuthErrors } = useGitAuthVerification(gitAuth)
+  const styles = useStyles();
+  const [owner, setOwner] = useState(defaultOwner);
+  const { verifyExternalAuth, externalAuthErrors } =
+    useExternalAuthVerification(externalAuth);
+  const [searchParams] = useSearchParams();
+  const disabledParamsList = searchParams?.get("disable_params")?.split(",");
+
   const form: FormikContextType<TypesGen.CreateWorkspaceRequest> =
     useFormik<TypesGen.CreateWorkspaceRequest>({
       initialValues: {
         name: defaultName,
         template_id: template.id,
-        rich_parameter_values: initialRichParameterValues,
-      },
-      validationSchema: Yup.object({
-        name: nameValidator(t("nameLabel", { ns: "createWorkspacePage" })),
-        rich_parameter_values: useValidationSchemaForRichParameters(
-          "createWorkspacePage",
+        rich_parameter_values: getInitialRichParameterValues(
           parameters,
+          defaultBuildParameters,
         ),
+      },
+      validationSchema: Yup.object({
+        name: nameValidator("Workspace Name"),
+        rich_parameter_values: useValidationSchemaForRichParameters(parameters),
       }),
       enableReinitialize: true,
       onSubmit: (request) => {
-        if (!verifyGitAuth()) {
-          form.setSubmitting(false)
-          return
+        if (!verifyExternalAuth()) {
+          return;
         }
 
-        onSubmit(request, owner)
+        onSubmit(request, owner);
       },
-    })
+    });
 
   useEffect(() => {
     if (error) {
-      window.scrollTo(0, 0)
+      window.scrollTo(0, 0);
     }
-  }, [error])
+  }, [error]);
 
   const getFieldHelpers = getFormHelpers<TypesGen.CreateWorkspaceRequest>(
     form,
     error,
-  )
+  );
 
   return (
     <FullPageHorizontalForm title="New workspace" onCancel={onCancel}>
@@ -110,13 +122,26 @@ export const CreateWorkspacePageView: FC<CreateWorkspacePageViewProps> = ({
         >
           <FormFields>
             <SelectedTemplate template={template} />
+            {versionId && versionId !== template.active_version_id && (
+              <Stack spacing={1} className={styles.hasDescription}>
+                <TextField
+                  disabled
+                  fullWidth
+                  value={versionId}
+                  label="Version ID"
+                />
+                <span className={styles.description}>
+                  This parameter has been preset, and cannot be modified.
+                </span>
+              </Stack>
+            )}
             <TextField
               {...getFieldHelpers("name")}
-              disabled={form.isSubmitting}
+              disabled={creatingWorkspace}
               onChange={onChangeTrimmed(form)}
               autoFocus
               fullWidth
-              label={t("nameLabel")}
+              label="Workspace Name"
             />
           </FormFields>
         </FormSection>
@@ -130,28 +155,31 @@ export const CreateWorkspacePageView: FC<CreateWorkspacePageViewProps> = ({
               <UserAutocomplete
                 value={owner}
                 onChange={(user) => {
-                  setOwner(user ?? defaultOwner)
+                  setOwner(user ?? defaultOwner);
                 }}
-                label={t("ownerLabel").toString()}
+                label="Owner"
                 size="medium"
               />
             </FormFields>
           </FormSection>
         )}
 
-        {gitAuth && gitAuth.length > 0 && (
+        {externalAuth && externalAuth.length > 0 && (
           <FormSection
-            title="Git Authentication"
-            description="This template requires authentication to automatically perform Git operations on create."
+            title="External Authentication"
+            description="This template requires authentication to external services."
           >
             <FormFields>
-              {gitAuth.map((auth, index) => (
-                <GitAuth
-                  key={index}
+              {externalAuth.map((auth) => (
+                <ExternalAuth
+                  key={auth.id}
                   authenticateURL={auth.authenticate_url}
                   authenticated={auth.authenticated}
-                  type={auth.type}
-                  error={gitAuthErrors[auth.id]}
+                  externalAuthPollingState={externalAuthPollingState}
+                  startPollingExternalAuth={startPollingExternalAuth}
+                  displayName={auth.display_name}
+                  displayIcon={auth.display_icon}
+                  error={externalAuthErrors[auth.id]}
                 />
               ))}
             </FormFields>
@@ -171,14 +199,13 @@ export const CreateWorkspacePageView: FC<CreateWorkspacePageViewProps> = ({
                     await form.setFieldValue("rich_parameter_values." + index, {
                       name: parameter.name,
                       value: value,
-                    })
+                    });
                   },
-                  initialValue: workspaceBuildParameterValue(
-                    initialRichParameterValues,
-                    parameter,
-                  ),
-                  disabled: form.isSubmitting,
-                }
+                  disabled:
+                    disabledParamsList?.includes(
+                      parameter.name.toLowerCase().replace(/ /g, "_"),
+                    ) || creatingWorkspace,
+                };
               }}
             />
             <ImmutableTemplateParametersSection
@@ -193,14 +220,13 @@ export const CreateWorkspacePageView: FC<CreateWorkspacePageViewProps> = ({
                     await form.setFieldValue("rich_parameter_values." + index, {
                       name: parameter.name,
                       value: value,
-                    })
+                    });
                   },
-                  initialValue: workspaceBuildParameterValue(
-                    initialRichParameterValues,
-                    parameter,
-                  ),
-                  disabled: form.isSubmitting,
-                }
+                  disabled:
+                    disabledParamsList?.includes(
+                      parameter.name.toLowerCase().replace(/ /g, "_"),
+                    ) || creatingWorkspace,
+                };
               }}
             />
           </>
@@ -209,52 +235,58 @@ export const CreateWorkspacePageView: FC<CreateWorkspacePageViewProps> = ({
         <FormFooter
           onCancel={onCancel}
           isLoading={creatingWorkspace}
-          submitLabel={t("createWorkspace").toString()}
+          submitLabel="Create Workspace"
         />
       </HorizontalForm>
     </FullPageHorizontalForm>
-  )
-}
+  );
+};
 
-type GitAuthErrors = Record<string, string>
+type ExternalAuthErrors = Record<string, string>;
 
-const useGitAuthVerification = (gitAuth: TypesGen.TemplateVersionGitAuth[]) => {
-  const [gitAuthErrors, setGitAuthErrors] = useState<GitAuthErrors>({})
+const useExternalAuthVerification = (
+  externalAuth: TypesGen.TemplateVersionExternalAuth[],
+) => {
+  const [externalAuthErrors, setExternalAuthErrors] =
+    useState<ExternalAuthErrors>({});
 
+  // Clear errors when externalAuth is refreshed
   useEffect(() => {
-    // templateGitAuth is refreshed automatically using a BroadcastChannel
-    // which may change the `authenticated` property.
-    //
-    // If the provider becomes authenticated, we want the error message
-    // to disappear.
-    setGitAuthErrors({})
-  }, [gitAuth])
+    setExternalAuthErrors({});
+  }, [externalAuth]);
 
-  const verifyGitAuth = () => {
-    const errors: GitAuthErrors = {}
+  const verifyExternalAuth = () => {
+    const errors: ExternalAuthErrors = {};
 
-    for (let i = 0; i < gitAuth.length; i++) {
-      const auth = gitAuth.at(i)
+    for (let i = 0; i < externalAuth.length; i++) {
+      const auth = externalAuth.at(i);
       if (!auth) {
-        continue
+        continue;
       }
       if (!auth.authenticated) {
-        errors[auth.id] = "You must authenticate to create a workspace!"
+        errors[auth.id] = "You must authenticate to create a workspace!";
       }
     }
 
-    setGitAuthErrors(errors)
-    const isValid = Object.keys(errors).length === 0
-    return isValid
-  }
+    setExternalAuthErrors(errors);
+    const isValid = Object.keys(errors).length === 0;
+    return isValid;
+  };
 
   return {
-    gitAuthErrors,
-    verifyGitAuth,
-  }
-}
+    externalAuthErrors,
+    verifyExternalAuth,
+  };
+};
 
 const useStyles = makeStyles((theme) => ({
+  hasDescription: {
+    paddingBottom: theme.spacing(2),
+  },
+  description: {
+    fontSize: 13,
+    color: theme.palette.text.secondary,
+  },
   warningText: {
     color: theme.palette.warning.light,
   },
@@ -266,4 +298,4 @@ const useStyles = makeStyles((theme) => ({
     marginLeft: theme.spacing(-10),
     marginRight: theme.spacing(-10),
   },
-}))
+}));
diff --git a/site/src/pages/CreateWorkspacePage/ExternalAuth.stories.tsx b/site/src/pages/CreateWorkspacePage/ExternalAuth.stories.tsx
new file mode 100644
index 0000000000000..87e7607282068
--- /dev/null
+++ b/site/src/pages/CreateWorkspacePage/ExternalAuth.stories.tsx
@@ -0,0 +1,74 @@
+import { ExternalAuth } from "./ExternalAuth";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof ExternalAuth> = {
+  title: "pages/CreateWorkspacePage/ExternalAuth",
+  component: ExternalAuth,
+};
+
+export default meta;
+type Story = StoryObj<typeof ExternalAuth>;
+
+export const GithubNotAuthenticated: Story = {
+  args: {
+    displayIcon: "/icon/github.svg",
+    displayName: "GitHub",
+    authenticated: false,
+  },
+};
+
+export const GithubAuthenticated: Story = {
+  args: {
+    displayIcon: "/icon/github.svg",
+    displayName: "GitHub",
+    authenticated: true,
+  },
+};
+
+export const GitlabNotAuthenticated: Story = {
+  args: {
+    displayIcon: "/icon/gitlab.svg",
+    displayName: "GitLab",
+    authenticated: false,
+  },
+};
+
+export const GitlabAuthenticated: Story = {
+  args: {
+    displayIcon: "/icon/gitlab.svg",
+    displayName: "GitLab",
+    authenticated: true,
+  },
+};
+
+export const AzureDevOpsNotAuthenticated: Story = {
+  args: {
+    displayIcon: "/icon/azure-devops.svg",
+    displayName: "Azure DevOps",
+    authenticated: false,
+  },
+};
+
+export const AzureDevOpsAuthenticated: Story = {
+  args: {
+    displayIcon: "/icon/azure-devops.svg",
+    displayName: "Azure DevOps",
+    authenticated: true,
+  },
+};
+
+export const BitbucketNotAuthenticated: Story = {
+  args: {
+    displayIcon: "/icon/bitbucket.svg",
+    displayName: "Bitbucket",
+    authenticated: false,
+  },
+};
+
+export const BitbucketAuthenticated: Story = {
+  args: {
+    displayIcon: "/icon/bitbucket.svg",
+    displayName: "Bitbucket",
+    authenticated: true,
+  },
+};
diff --git a/site/src/pages/CreateWorkspacePage/ExternalAuth.tsx b/site/src/pages/CreateWorkspacePage/ExternalAuth.tsx
new file mode 100644
index 0000000000000..c1e61ac74832b
--- /dev/null
+++ b/site/src/pages/CreateWorkspacePage/ExternalAuth.tsx
@@ -0,0 +1,78 @@
+import ReplayIcon from "@mui/icons-material/Replay";
+import Button from "@mui/material/Button";
+import FormHelperText from "@mui/material/FormHelperText";
+import Tooltip from "@mui/material/Tooltip";
+import { type FC } from "react";
+import { Stack } from "components/Stack/Stack";
+import { type ExternalAuthPollingState } from "./CreateWorkspacePage";
+import LoadingButton from "@mui/lab/LoadingButton";
+
+export interface ExternalAuthProps {
+  displayName: string;
+  displayIcon: string;
+  authenticated: boolean;
+  authenticateURL: string;
+  externalAuthPollingState: ExternalAuthPollingState;
+  startPollingExternalAuth: () => void;
+  error?: string;
+}
+
+export const ExternalAuth: FC<ExternalAuthProps> = (props) => {
+  const {
+    displayName,
+    displayIcon,
+    authenticated,
+    authenticateURL,
+    externalAuthPollingState,
+    startPollingExternalAuth,
+    error,
+  } = props;
+
+  return (
+    <Tooltip
+      title={authenticated && `${displayName} has already been connected.`}
+    >
+      <Stack alignItems="center" spacing={1}>
+        <LoadingButton
+          loadingPosition="start"
+          loading={externalAuthPollingState === "polling"}
+          href={authenticateURL}
+          variant="contained"
+          size="large"
+          startIcon={
+            <img
+              src={displayIcon}
+              alt={`${displayName} Icon`}
+              width={16}
+              height={16}
+            />
+          }
+          disabled={authenticated}
+          css={{ height: 52 }}
+          color={error ? "error" : undefined}
+          fullWidth
+          onClick={(event) => {
+            event.preventDefault();
+            // If the user is already authenticated, we don't want to redirect them
+            if (authenticated || authenticateURL === "") {
+              return;
+            }
+            window.open(authenticateURL, "_blank", "width=900,height=600");
+            startPollingExternalAuth();
+          }}
+        >
+          {authenticated
+            ? `Authenticated with ${displayName}`
+            : `Login with ${displayName}`}
+        </LoadingButton>
+
+        {externalAuthPollingState === "abandoned" && (
+          <Button variant="text" onClick={startPollingExternalAuth}>
+            <ReplayIcon /> Check again
+          </Button>
+        )}
+        {error && <FormHelperText error>{error}</FormHelperText>}
+      </Stack>
+    </Tooltip>
+  );
+};
diff --git a/site/src/pages/CreateWorkspacePage/SelectedTemplate.stories.tsx b/site/src/pages/CreateWorkspacePage/SelectedTemplate.stories.tsx
index 254ccdf7913cd..520088a5b159f 100644
--- a/site/src/pages/CreateWorkspacePage/SelectedTemplate.stories.tsx
+++ b/site/src/pages/CreateWorkspacePage/SelectedTemplate.stories.tsx
@@ -1,28 +1,29 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { MockTemplate } from "../../testHelpers/entities"
-import { SelectedTemplate, SelectedTemplateProps } from "./SelectedTemplate"
+import { MockTemplate } from "testHelpers/entities";
+import { SelectedTemplate } from "./SelectedTemplate";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "components/SelectedTemplate",
+const meta: Meta<typeof SelectedTemplate> = {
+  title: "pages/CreateWorkspacePage/SelectedTemplate",
   component: SelectedTemplate,
-} as ComponentMeta<typeof SelectedTemplate>
+};
 
-const Template: Story<SelectedTemplateProps> = (args) => (
-  <SelectedTemplate {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof SelectedTemplate>;
 
-export const WithIcon = Template.bind({})
-WithIcon.args = {
-  template: {
-    ...MockTemplate,
-    icon: "/icon/docker.png",
+export const WithIcon: Story = {
+  args: {
+    template: {
+      ...MockTemplate,
+      icon: "/icon/docker.png",
+    },
   },
-}
+};
 
-export const WithoutIcon = Template.bind({})
-WithoutIcon.args = {
-  template: {
-    ...MockTemplate,
-    icon: "",
+export const WithoutIcon: Story = {
+  args: {
+    template: {
+      ...MockTemplate,
+      icon: "",
+    },
   },
-}
+};
diff --git a/site/src/pages/CreateWorkspacePage/SelectedTemplate.tsx b/site/src/pages/CreateWorkspacePage/SelectedTemplate.tsx
index 5f022b12adefc..219851a64eede 100644
--- a/site/src/pages/CreateWorkspacePage/SelectedTemplate.tsx
+++ b/site/src/pages/CreateWorkspacePage/SelectedTemplate.tsx
@@ -1,15 +1,15 @@
-import { makeStyles } from "@mui/styles"
-import { Template, TemplateExample } from "api/typesGenerated"
-import { Avatar } from "components/Avatar/Avatar"
-import { Stack } from "components/Stack/Stack"
-import { FC } from "react"
+import { makeStyles } from "@mui/styles";
+import { Template, TemplateExample } from "api/typesGenerated";
+import { Avatar } from "components/Avatar/Avatar";
+import { Stack } from "components/Stack/Stack";
+import { FC } from "react";
 
 export interface SelectedTemplateProps {
-  template: Template | TemplateExample
+  template: Template | TemplateExample;
 }
 
 export const SelectedTemplate: FC<SelectedTemplateProps> = ({ template }) => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <Stack
@@ -39,8 +39,8 @@ export const SelectedTemplate: FC<SelectedTemplateProps> = ({ template }) => {
         )}
       </Stack>
     </Stack>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   template: {
@@ -58,4 +58,4 @@ const useStyles = makeStyles((theme) => ({
     fontSize: 14,
     color: theme.palette.text.secondary,
   },
-}))
+}));
diff --git a/site/src/pages/CreateWorkspacePage/permissions.ts b/site/src/pages/CreateWorkspacePage/permissions.ts
new file mode 100644
index 0000000000000..cbdee54beece4
--- /dev/null
+++ b/site/src/pages/CreateWorkspacePage/permissions.ts
@@ -0,0 +1,16 @@
+export const createWorkspaceChecks = (organizationId: string) =>
+  ({
+    createWorkspaceForUser: {
+      object: {
+        resource_type: "workspace",
+        organization_id: organizationId,
+        owner_id: "*",
+      },
+      action: "create",
+    },
+  }) as const;
+
+export type CreateWSPermissions = Record<
+  keyof ReturnType<typeof createWorkspaceChecks>,
+  boolean
+>;
diff --git a/site/src/pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPage.tsx b/site/src/pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPage.tsx
index 7386bd3732df5..439dc69f31763 100644
--- a/site/src/pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPage.tsx
+++ b/site/src/pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPage.tsx
@@ -1,33 +1,42 @@
-import { UpdateAppearanceConfig } from "api/typesGenerated"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { AppearanceSettingsPageView } from "./AppearanceSettingsPageView"
+import { UpdateAppearanceConfig } from "api/typesGenerated";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { AppearanceSettingsPageView } from "./AppearanceSettingsPageView";
+import { useMutation, useQueryClient } from "react-query";
+import { updateAppearance } from "api/queries/appearance";
+import { getErrorMessage } from "api/errors";
+import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
 
 // ServiceBanner is unlike the other Deployment Settings pages because it
 // implements a form, whereas the others are read-only. We make this
 // exception because the Service Banner is visual, and configuring it from
 // the command line would be a significantly worse user experience.
 const AppearanceSettingsPage: FC = () => {
-  const { appearance, entitlements } = useDashboard()
-  const isEntitled =
-    entitlements.features["appearance"].entitlement !== "not_entitled"
+  const { appearance, entitlements } = useDashboard();
+  const queryClient = useQueryClient();
+  const updateAppearanceMutation = useMutation(updateAppearance(queryClient));
 
-  const updateAppearance = (
+  const onSaveAppearance = async (
     newConfig: Partial<UpdateAppearanceConfig>,
     preview: boolean,
   ) => {
-    const newAppearance = {
-      ...appearance.config,
-      ...newConfig,
-    }
+    const newAppearance = { ...appearance.config, ...newConfig };
     if (preview) {
-      appearance.setPreview(newAppearance)
-      return
+      appearance.setPreview(newAppearance);
+      return;
+    }
+
+    try {
+      await updateAppearanceMutation.mutateAsync(newAppearance);
+      displaySuccess("Successfully updated appearance settings!");
+    } catch (error) {
+      displayError(
+        getErrorMessage(error, "Failed to update appearance settings."),
+      );
     }
-    appearance.save(newAppearance)
-  }
+  };
 
   return (
     <>
@@ -37,11 +46,13 @@ const AppearanceSettingsPage: FC = () => {
 
       <AppearanceSettingsPageView
         appearance={appearance.config}
-        isEntitled={isEntitled}
-        updateAppearance={updateAppearance}
+        onSaveAppearance={onSaveAppearance}
+        isEntitled={
+          entitlements.features.appearance.entitlement !== "not_entitled"
+        }
       />
     </>
-  )
-}
+  );
+};
 
-export default AppearanceSettingsPage
+export default AppearanceSettingsPage;
diff --git a/site/src/pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPageView.stories.tsx b/site/src/pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPageView.stories.tsx
index 3c9ef50c8d9e6..92aed8f7d1aa8 100644
--- a/site/src/pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPageView.stories.tsx
+++ b/site/src/pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPageView.stories.tsx
@@ -1,14 +1,12 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import {
-  AppearanceSettingsPageView,
-  AppearanceSettingsPageViewProps,
-} from "./AppearanceSettingsPageView"
+import { AppearanceSettingsPageView } from "./AppearanceSettingsPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/AppearanceSettingsPageView",
+const meta: Meta<typeof AppearanceSettingsPageView> = {
+  title: "pages/DeploySettingsPage/AppearanceSettingsPageView",
   component: AppearanceSettingsPageView,
   args: {
     appearance: {
+      application_name: "Foobar",
       logo_url: "https://github.com/coder.png",
       service_banner: {
         enabled: true,
@@ -17,13 +15,16 @@ export default {
       },
     },
     isEntitled: false,
-    updateAppearance: () => {
-      return undefined
-    },
   },
-} as ComponentMeta<typeof AppearanceSettingsPageView>
+};
+
+export default meta;
+type Story = StoryObj<typeof AppearanceSettingsPageView>;
+
+export const Entitled: Story = {
+  args: {
+    isEntitled: true,
+  },
+};
 
-const Template: Story<AppearanceSettingsPageViewProps> = (args) => (
-  <AppearanceSettingsPageView {...args} />
-)
-export const Page = Template.bind({})
+export const NotEntitled: Story = {};
diff --git a/site/src/pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPageView.tsx b/site/src/pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPageView.tsx
index 78e23d7434afb..75d7a55f7a1a7 100644
--- a/site/src/pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPageView.tsx
+++ b/site/src/pages/DeploySettingsPage/AppearanceSettingsPage/AppearanceSettingsPageView.tsx
@@ -1,73 +1,90 @@
-import { useState } from "react"
-import { Header } from "components/DeploySettingsLayout/Header"
+import { useState } from "react";
+import { Header } from "components/DeploySettingsLayout/Header";
 import {
   Badges,
   DisabledBadge,
   EnterpriseBadge,
   EntitledBadge,
-} from "components/DeploySettingsLayout/Badges"
-import InputAdornment from "@mui/material/InputAdornment"
-import { Fieldset } from "components/DeploySettingsLayout/Fieldset"
-import { getFormHelpers } from "utils/formUtils"
-import Button from "@mui/material/Button"
-import FormControlLabel from "@mui/material/FormControlLabel"
-import { BlockPicker } from "react-color"
-import { useTranslation } from "react-i18next"
-import makeStyles from "@mui/styles/makeStyles"
-import Switch from "@mui/material/Switch"
-import TextField from "@mui/material/TextField"
-import { UpdateAppearanceConfig } from "api/typesGenerated"
-import { Stack } from "components/Stack/Stack"
-import { useFormik } from "formik"
-import { useTheme } from "@mui/styles"
-import Link from "@mui/material/Link"
+} from "components/DeploySettingsLayout/Badges";
+import InputAdornment from "@mui/material/InputAdornment";
+import { Fieldset } from "components/DeploySettingsLayout/Fieldset";
+import { getFormHelpers } from "utils/formUtils";
+import Button from "@mui/material/Button";
+import FormControlLabel from "@mui/material/FormControlLabel";
+import { BlockPicker } from "react-color";
+import makeStyles from "@mui/styles/makeStyles";
+import Switch from "@mui/material/Switch";
+import TextField from "@mui/material/TextField";
+import { UpdateAppearanceConfig } from "api/typesGenerated";
+import { Stack } from "components/Stack/Stack";
+import { useFormik } from "formik";
+import { useTheme } from "@mui/styles";
+import Link from "@mui/material/Link";
+import { colors } from "theme/colors";
+import { hslToHex } from "utils/colors";
 
 export type AppearanceSettingsPageViewProps = {
-  appearance: UpdateAppearanceConfig
-  isEntitled: boolean
-  updateAppearance: (
+  appearance: UpdateAppearanceConfig;
+  isEntitled: boolean;
+  onSaveAppearance: (
     newConfig: Partial<UpdateAppearanceConfig>,
     preview: boolean,
-  ) => void
-}
+  ) => void;
+};
+
+const fallbackBgColor = hslToHex(colors.blue[7]);
+
 export const AppearanceSettingsPageView = ({
   appearance,
   isEntitled,
-  updateAppearance,
+  onSaveAppearance,
 }: AppearanceSettingsPageViewProps): JSX.Element => {
-  const styles = useStyles()
-  const theme = useTheme()
-  const [t] = useTranslation("appearanceSettings")
+  const styles = useStyles();
+  const theme = useTheme();
+
+  const applicationNameForm = useFormik<{
+    application_name: string;
+  }>({
+    initialValues: {
+      application_name: appearance.application_name,
+    },
+    onSubmit: (values) => onSaveAppearance(values, false),
+  });
+  const applicationNameFieldHelpers = getFormHelpers(applicationNameForm);
+
   const logoForm = useFormik<{
-    logo_url: string
+    logo_url: string;
   }>({
     initialValues: {
       logo_url: appearance.logo_url,
     },
-    onSubmit: (values) => updateAppearance(values, false),
-  })
-  const logoFieldHelpers = getFormHelpers(logoForm)
+    onSubmit: (values) => onSaveAppearance(values, false),
+  });
+  const logoFieldHelpers = getFormHelpers(logoForm);
 
   const serviceBannerForm = useFormik<UpdateAppearanceConfig["service_banner"]>(
     {
       initialValues: {
         message: appearance.service_banner.message,
         enabled: appearance.service_banner.enabled,
-        background_color: appearance.service_banner.background_color,
+        background_color:
+          appearance.service_banner.background_color ?? fallbackBgColor,
       },
       onSubmit: (values) =>
-        updateAppearance(
+        onSaveAppearance(
           {
             service_banner: values,
           },
           false,
         ),
     },
-  )
-  const serviceBannerFieldHelpers = getFormHelpers(serviceBannerForm)
+  );
+  const serviceBannerFieldHelpers = getFormHelpers(serviceBannerForm);
+
   const [backgroundColor, setBackgroundColor] = useState(
     serviceBannerForm.values.background_color,
-  )
+  );
+
   return (
     <>
       <Header
@@ -80,6 +97,22 @@ export const AppearanceSettingsPageView = ({
         <EnterpriseBadge />
       </Badges>
 
+      <Fieldset
+        title="Application name"
+        subtitle="Specify a custom application name to be displayed on the login page."
+        validation={!isEntitled ? "This is an Enterprise only feature." : ""}
+        onSubmit={applicationNameForm.handleSubmit}
+        button={!isEntitled && <Button disabled>Submit</Button>}
+      >
+        <TextField
+          {...applicationNameFieldHelpers("application_name")}
+          defaultValue={appearance.application_name}
+          fullWidth
+          placeholder='Leave empty to display "Coder".'
+          disabled={!isEntitled}
+        />
+      </Fieldset>
+
       <Fieldset
         title="Logo URL"
         subtitle="Specify a custom URL for your logo to be displayed in the top left
@@ -123,7 +156,7 @@ export const AppearanceSettingsPageView = ({
           !isEntitled && (
             <Button
               onClick={() => {
-                updateAppearance(
+                onSaveAppearance(
                   {
                     service_banner: {
                       message:
@@ -133,10 +166,10 @@ export const AppearanceSettingsPageView = ({
                     },
                   },
                   true,
-                )
+                );
               }}
             >
-              {t("showPreviewLabel")}
+              Show Preview
             </Button>
           )
         }
@@ -157,18 +190,18 @@ export const AppearanceSettingsPageView = ({
                 <Switch
                   checked={serviceBannerForm.values.enabled}
                   onChange={async () => {
-                    const newState = !serviceBannerForm.values.enabled
+                    const newState = !serviceBannerForm.values.enabled;
                     const newBanner = {
                       ...serviceBannerForm.values,
                       enabled: newState,
-                    }
-                    updateAppearance(
+                    };
+                    onSaveAppearance(
                       {
                         service_banner: newBanner,
                       },
                       false,
-                    )
-                    await serviceBannerForm.setFieldValue("enabled", newState)
+                    );
+                    await serviceBannerForm.setFieldValue("enabled", newState);
                   }}
                 />
               }
@@ -178,7 +211,7 @@ export const AppearanceSettingsPageView = ({
               <TextField
                 {...serviceBannerFieldHelpers(
                   "message",
-                  t("messageHelperText"),
+                  "Markdown bold, italics, and links are supported.",
                 )}
                 fullWidth
                 label="Message"
@@ -191,12 +224,12 @@ export const AppearanceSettingsPageView = ({
               <BlockPicker
                 color={backgroundColor}
                 onChange={async (color) => {
-                  setBackgroundColor(color.hex)
+                  setBackgroundColor(color.hex);
                   await serviceBannerForm.setFieldValue(
                     "background_color",
                     color.hex,
-                  )
-                  updateAppearance(
+                  );
+                  onSaveAppearance(
                     {
                       service_banner: {
                         ...serviceBannerForm.values,
@@ -204,7 +237,7 @@ export const AppearanceSettingsPageView = ({
                       },
                     },
                     true,
-                  )
+                  );
                 }}
                 triangle="hide"
                 colors={["#004852", "#D65D0F", "#4CD473", "#D94A5D", "#5A00CF"]}
@@ -229,8 +262,8 @@ export const AppearanceSettingsPageView = ({
         )}
       </Fieldset>
     </>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   form: {
@@ -244,4 +277,4 @@ const useStyles = makeStyles((theme) => ({
       maxWidth: "100%",
     },
   },
-}))
+}));
diff --git a/site/src/pages/DeploySettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPage.tsx b/site/src/pages/DeploySettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPage.tsx
new file mode 100644
index 0000000000000..0fc166a1a30ab
--- /dev/null
+++ b/site/src/pages/DeploySettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPage.tsx
@@ -0,0 +1,21 @@
+import { useDeploySettings } from "components/DeploySettingsLayout/DeploySettingsLayout";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { ExternalAuthSettingsPageView } from "./ExternalAuthSettingsPageView";
+
+const ExternalAuthSettingsPage: FC = () => {
+  const { deploymentValues: deploymentValues } = useDeploySettings();
+
+  return (
+    <>
+      <Helmet>
+        <title>{pageTitle("External Authentication Settings")}</title>
+      </Helmet>
+
+      <ExternalAuthSettingsPageView config={deploymentValues.config} />
+    </>
+  );
+};
+
+export default ExternalAuthSettingsPage;
diff --git a/site/src/pages/DeploySettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.stories.tsx b/site/src/pages/DeploySettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.stories.tsx
new file mode 100644
index 0000000000000..311d20109e129
--- /dev/null
+++ b/site/src/pages/DeploySettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.stories.tsx
@@ -0,0 +1,36 @@
+import { ExternalAuthSettingsPageView } from "./ExternalAuthSettingsPageView";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof ExternalAuthSettingsPageView> = {
+  title: "pages/DeploySettingsPage/ExternalAuthSettingsPageView",
+  component: ExternalAuthSettingsPageView,
+  args: {
+    config: {
+      external_auth: [
+        {
+          id: "0000-1111",
+          type: "GitHub",
+          client_id: "client_id",
+          regex: "regex",
+          auth_url: "",
+          token_url: "",
+          validate_url: "",
+          app_install_url: "https://github.com/apps/coder/installations/new",
+          app_installations_url: "",
+          no_refresh: false,
+          scopes: [],
+          extra_token_keys: [],
+          device_flow: true,
+          device_code_url: "",
+          display_icon: "",
+          display_name: "GitHub",
+        },
+      ],
+    },
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof ExternalAuthSettingsPageView>;
+
+export const Page: Story = {};
diff --git a/site/src/pages/DeploySettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.tsx b/site/src/pages/DeploySettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.tsx
new file mode 100644
index 0000000000000..d3172f05c97a6
--- /dev/null
+++ b/site/src/pages/DeploySettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.tsx
@@ -0,0 +1,105 @@
+import { makeStyles } from "@mui/styles";
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableHead from "@mui/material/TableHead";
+import TableRow from "@mui/material/TableRow";
+import { DeploymentValues, ExternalAuthConfig } from "api/typesGenerated";
+import { Alert } from "components/Alert/Alert";
+import { EnterpriseBadge } from "components/DeploySettingsLayout/Badges";
+import { Header } from "components/DeploySettingsLayout/Header";
+import { docs } from "utils/docs";
+
+export type ExternalAuthSettingsPageViewProps = {
+  config: DeploymentValues;
+};
+
+export const ExternalAuthSettingsPageView = ({
+  config,
+}: ExternalAuthSettingsPageViewProps): JSX.Element => {
+  const styles = useStyles();
+
+  return (
+    <>
+      <Header
+        title="External Authentication"
+        description="Coder integrates with GitHub, GitLab, BitBucket, Azure Repos, and OpenID Connect to authenticate developers with external services."
+        docsHref={docs("/admin/external-auth")}
+      />
+
+      <video
+        autoPlay
+        muted
+        loop
+        playsInline
+        src="/external-auth.mp4"
+        style={{
+          maxWidth: "100%",
+          borderRadius: 4,
+        }}
+      />
+
+      <div className={styles.description}>
+        <Alert severity="info" actions={<EnterpriseBadge key="enterprise" />}>
+          Integrating with multiple External authentication providers is an
+          Enterprise feature.
+        </Alert>
+      </div>
+
+      <TableContainer>
+        <Table className={styles.table}>
+          <TableHead>
+            <TableRow>
+              <TableCell width="25%">ID</TableCell>
+              <TableCell width="25%">Client ID</TableCell>
+              <TableCell width="25%">Match</TableCell>
+            </TableRow>
+          </TableHead>
+          <TableBody>
+            {((config.external_auth === null ||
+              config.external_auth?.length === 0) && (
+              <TableRow>
+                <TableCell colSpan={999}>
+                  <div className={styles.empty}>
+                    No providers have been configured!
+                  </div>
+                </TableCell>
+              </TableRow>
+            )) ||
+              config.external_auth?.map((git: ExternalAuthConfig) => {
+                const name = git.id || git.type;
+                return (
+                  <TableRow key={name}>
+                    <TableCell>{name}</TableCell>
+                    <TableCell>{git.client_id}</TableCell>
+                    <TableCell>{git.regex || "Not Set"}</TableCell>
+                  </TableRow>
+                );
+              })}
+          </TableBody>
+        </Table>
+      </TableContainer>
+    </>
+  );
+};
+
+const useStyles = makeStyles((theme) => ({
+  table: {
+    "& td": {
+      paddingTop: theme.spacing(3),
+      paddingBottom: theme.spacing(3),
+    },
+
+    "& td:last-child, & th:last-child": {
+      paddingLeft: theme.spacing(4),
+    },
+  },
+  description: {
+    marginTop: theme.spacing(3),
+    marginBottom: theme.spacing(3),
+  },
+  empty: {
+    textAlign: "center",
+  },
+}));
diff --git a/site/src/pages/DeploySettingsPage/GeneralSettingsPage/ChartSection.tsx b/site/src/pages/DeploySettingsPage/GeneralSettingsPage/ChartSection.tsx
new file mode 100644
index 0000000000000..45ad3fb5cd8c0
--- /dev/null
+++ b/site/src/pages/DeploySettingsPage/GeneralSettingsPage/ChartSection.tsx
@@ -0,0 +1,61 @@
+import Paper from "@mui/material/Paper";
+import { makeStyles } from "@mui/styles";
+import { HTMLProps, ReactNode, FC, PropsWithChildren } from "react";
+import { combineClasses } from "utils/combineClasses";
+
+export interface ChartSectionProps {
+  /**
+   * action appears in the top right of the section card
+   */
+  action?: ReactNode;
+  contentsProps?: HTMLProps<HTMLDivElement>;
+  title?: string | JSX.Element;
+}
+
+export const ChartSection: FC<PropsWithChildren<ChartSectionProps>> = ({
+  action,
+  children,
+  contentsProps,
+  title,
+}) => {
+  const styles = useStyles();
+
+  return (
+    <Paper className={styles.root} elevation={0}>
+      {title && (
+        <div className={styles.header}>
+          <h6 className={styles.title}>{title}</h6>
+          {action && <div>{action}</div>}
+        </div>
+      )}
+
+      <div
+        {...contentsProps}
+        className={combineClasses([styles.contents, contentsProps?.className])}
+      >
+        {children}
+      </div>
+    </Paper>
+  );
+};
+
+const useStyles = makeStyles((theme) => ({
+  root: {
+    border: `1px solid ${theme.palette.divider}`,
+    borderRadius: theme.shape.borderRadius,
+  },
+  contents: {
+    margin: theme.spacing(2),
+  },
+  header: {
+    alignItems: "center",
+    display: "flex",
+    justifyContent: "space-between",
+    padding: theme.spacing(1.5, 2),
+  },
+  title: {
+    margin: 0,
+    fontSize: 14,
+    fontWeight: 600,
+  },
+}));
diff --git a/site/src/pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPage.tsx b/site/src/pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPage.tsx
index db3f44b77e899..a4f45ae7a270f 100644
--- a/site/src/pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPage.tsx
+++ b/site/src/pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPage.tsx
@@ -1,12 +1,18 @@
-import { useDeploySettings } from "components/DeploySettingsLayout/DeploySettingsLayout"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { GeneralSettingsPageView } from "./GeneralSettingsPageView"
+import { type FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { useQuery } from "react-query";
+import { pageTitle } from "utils/page";
+import { deploymentDAUs } from "api/queries/deployment";
+import { entitlements } from "api/queries/entitlements";
+import { availableExperiments } from "api/queries/experiments";
+import { useDeploySettings } from "components/DeploySettingsLayout/DeploySettingsLayout";
+import { GeneralSettingsPageView } from "./GeneralSettingsPageView";
 
 const GeneralSettingsPage: FC = () => {
-  const { deploymentValues, deploymentDAUs, getDeploymentDAUsError } =
-    useDeploySettings()
+  const { deploymentValues } = useDeploySettings();
+  const deploymentDAUsQuery = useQuery(deploymentDAUs());
+  const entitlementsQuery = useQuery(entitlements());
+  const experimentsQuery = useQuery(availableExperiments());
 
   return (
     <>
@@ -15,11 +21,13 @@ const GeneralSettingsPage: FC = () => {
       </Helmet>
       <GeneralSettingsPageView
         deploymentOptions={deploymentValues.options}
-        deploymentDAUs={deploymentDAUs}
-        getDeploymentDAUsError={getDeploymentDAUsError}
+        deploymentDAUs={deploymentDAUsQuery.data}
+        deploymentDAUsError={deploymentDAUsQuery.error}
+        entitlements={entitlementsQuery.data}
+        safeExperiments={experimentsQuery.data?.safe ?? []}
       />
     </>
-  )
-}
+  );
+};
 
-export default GeneralSettingsPage
+export default GeneralSettingsPage;
diff --git a/site/src/pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPageView.stories.tsx b/site/src/pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPageView.stories.tsx
index 2a027ef7e9c41..2b3ec0afa13d5 100644
--- a/site/src/pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPageView.stories.tsx
+++ b/site/src/pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPageView.stories.tsx
@@ -1,46 +1,107 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { mockApiError, MockDeploymentDAUResponse } from "testHelpers/entities"
+import { Meta, StoryObj } from "@storybook/react";
 import {
-  GeneralSettingsPageView,
-  GeneralSettingsPageViewProps,
-} from "./GeneralSettingsPageView"
+  mockApiError,
+  MockDeploymentDAUResponse,
+  MockEntitlementsWithUserLimit,
+} from "testHelpers/entities";
+import { GeneralSettingsPageView } from "./GeneralSettingsPageView";
 
-export default {
-  title: "pages/GeneralSettingsPageView",
+const meta: Meta<typeof GeneralSettingsPageView> = {
+  title: "pages/DeploySettingsPage/GeneralSettingsPageView",
   component: GeneralSettingsPageView,
   args: {
     deploymentOptions: [
       {
         name: "Access URL",
         description:
-          "External URL to access your deployment. This must be accessible by all provisioned workspaces.",
+          "The URL that users will use to access the Coder deployment.",
+        flag: "access-url",
+        flag_shorthand: "",
         value: "https://dev.coder.com",
+        hidden: false,
       },
       {
         name: "Wildcard Access URL",
         description:
           'Specifies the wildcard hostname to use for workspace applications in the form "*.example.com".',
+        flag: "wildcard-access-url",
+        flag_shorthand: "",
         value: "*--apps.dev.coder.com",
+        hidden: false,
+      },
+      {
+        name: "Experiments",
+        description:
+          "Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '*' to opt-in to all available experiments.",
+        flag: "experiments",
+        value: ["single_tailnet"],
+        flag_shorthand: "",
+        hidden: false,
       },
     ],
     deploymentDAUs: MockDeploymentDAUResponse,
+    safeExperiments: ["single_tailnet", "deployment_health_page"],
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof GeneralSettingsPageView>;
+
+export const Page: Story = {};
+
+export const WithUserLimit: Story = {
+  args: {
+    deploymentDAUs: MockDeploymentDAUResponse,
+    entitlements: MockEntitlementsWithUserLimit,
   },
-} as ComponentMeta<typeof GeneralSettingsPageView>
+};
 
-const Template: Story<GeneralSettingsPageViewProps> = (args) => (
-  <GeneralSettingsPageView {...args} />
-)
-export const Page = Template.bind({})
+export const NoDAUs: Story = {
+  args: {
+    deploymentDAUs: undefined,
+  },
+};
 
-export const NoDAUs = Template.bind({})
-NoDAUs.args = {
-  deploymentDAUs: undefined,
-}
+export const DAUError: Story = {
+  args: {
+    deploymentDAUs: undefined,
+    deploymentDAUsError: mockApiError({
+      message: "Error fetching DAUs.",
+    }),
+  },
+};
 
-export const DAUError = Template.bind({})
-DAUError.args = {
-  deploymentDAUs: undefined,
-  getDeploymentDAUsError: mockApiError({
-    message: "Error fetching DAUs.",
-  }),
-}
+export const allExperimentsEnabled: Story = {
+  args: {
+    deploymentOptions: [
+      {
+        name: "Access URL",
+        description:
+          "The URL that users will use to access the Coder deployment.",
+        flag: "access-url",
+        flag_shorthand: "",
+        value: "https://dev.coder.com",
+        hidden: false,
+      },
+      {
+        name: "Wildcard Access URL",
+        description:
+          'Specifies the wildcard hostname to use for workspace applications in the form "*.example.com".',
+        flag: "wildcard-access-url",
+        flag_shorthand: "",
+        value: "*--apps.dev.coder.com",
+        hidden: false,
+      },
+      {
+        name: "Experiments",
+        description:
+          "Enable one or more experiments. These are not ready for production. Separate multiple experiments with commas, or enter '*' to opt-in to all available experiments.",
+        flag: "experiments",
+        value: ["*"],
+        flag_shorthand: "",
+        hidden: false,
+      },
+    ],
+    safeExperiments: ["single_tailnet", "deployment_health_page"],
+  },
+};
diff --git a/site/src/pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPageView.tsx b/site/src/pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPageView.tsx
index 8e9df03477f0f..f5a3f2abf2c59 100644
--- a/site/src/pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPageView.tsx
+++ b/site/src/pages/DeploySettingsPage/GeneralSettingsPage/GeneralSettingsPageView.tsx
@@ -1,24 +1,35 @@
-import Box from "@mui/material/Box"
-import { DeploymentOption } from "api/types"
-import { DAUsResponse } from "api/typesGenerated"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
-import { DAUChart, DAUTitle } from "components/DAUChart/DAUChart"
-import { Header } from "components/DeploySettingsLayout/Header"
-import OptionsTable from "components/DeploySettingsLayout/OptionsTable"
-import { Stack } from "components/Stack/Stack"
-import { WorkspaceSection } from "components/WorkspaceSection/WorkspaceSection"
-import { useDeploymentOptions } from "utils/deployOptions"
-import { docs } from "utils/docs"
+import Box from "@mui/material/Box";
+import {
+  ClibaseOption,
+  DAUsResponse,
+  Entitlements,
+  Experiments,
+} from "api/typesGenerated";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import {
+  ActiveUserChart,
+  ActiveUsersTitle,
+} from "components/ActiveUserChart/ActiveUserChart";
+import { Header } from "components/DeploySettingsLayout/Header";
+import OptionsTable from "components/DeploySettingsLayout/OptionsTable";
+import { Stack } from "components/Stack/Stack";
+import { ChartSection } from "./ChartSection";
+import { useDeploymentOptions } from "utils/deployOptions";
+import { docs } from "utils/docs";
 
 export type GeneralSettingsPageViewProps = {
-  deploymentOptions: DeploymentOption[]
-  deploymentDAUs?: DAUsResponse
-  getDeploymentDAUsError: unknown
-}
+  deploymentOptions: ClibaseOption[];
+  deploymentDAUs?: DAUsResponse;
+  deploymentDAUsError: unknown;
+  entitlements: Entitlements | undefined;
+  safeExperiments: Experiments | undefined;
+};
 export const GeneralSettingsPageView = ({
   deploymentOptions,
   deploymentDAUs,
-  getDeploymentDAUsError,
+  deploymentDAUsError,
+  entitlements,
+  safeExperiments,
 }: GeneralSettingsPageViewProps): JSX.Element => {
   return (
     <>
@@ -28,14 +39,22 @@ export const GeneralSettingsPageView = ({
         docsHref={docs("/admin/configure")}
       />
       <Stack spacing={4}>
-        {Boolean(getDeploymentDAUsError) && (
-          <ErrorAlert error={getDeploymentDAUsError} />
+        {Boolean(deploymentDAUsError) && (
+          <ErrorAlert error={deploymentDAUsError} />
         )}
         {deploymentDAUs && (
           <Box height={200} sx={{ mb: 3 }}>
-            <WorkspaceSection title={<DAUTitle />}>
-              <DAUChart daus={deploymentDAUs} />
-            </WorkspaceSection>
+            <ChartSection title={<ActiveUsersTitle />}>
+              <ActiveUserChart
+                data={deploymentDAUs.entries}
+                interval="day"
+                userLimit={
+                  entitlements?.features.user_limit.enabled
+                    ? entitlements?.features.user_limit.limit
+                    : undefined
+                }
+              />
+            </ChartSection>
           </Box>
         )}
         <OptionsTable
@@ -43,9 +62,11 @@ export const GeneralSettingsPageView = ({
             deploymentOptions,
             "Access URL",
             "Wildcard Access URL",
+            "Experiments",
           )}
+          additionalValues={safeExperiments}
         />
       </Stack>
     </>
-  )
-}
+  );
+};
diff --git a/site/src/pages/DeploySettingsPage/GitAuthSettingsPage/GitAuthSettingsPage.tsx b/site/src/pages/DeploySettingsPage/GitAuthSettingsPage/GitAuthSettingsPage.tsx
deleted file mode 100644
index 4022602281ac1..0000000000000
--- a/site/src/pages/DeploySettingsPage/GitAuthSettingsPage/GitAuthSettingsPage.tsx
+++ /dev/null
@@ -1,21 +0,0 @@
-import { useDeploySettings } from "components/DeploySettingsLayout/DeploySettingsLayout"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { GitAuthSettingsPageView } from "./GitAuthSettingsPageView"
-
-const GitAuthSettingsPage: FC = () => {
-  const { deploymentValues: deploymentValues } = useDeploySettings()
-
-  return (
-    <>
-      <Helmet>
-        <title>{pageTitle("Git Authentication Settings")}</title>
-      </Helmet>
-
-      <GitAuthSettingsPageView config={deploymentValues.config} />
-    </>
-  )
-}
-
-export default GitAuthSettingsPage
diff --git a/site/src/pages/DeploySettingsPage/GitAuthSettingsPage/GitAuthSettingsPageView.stories.tsx b/site/src/pages/DeploySettingsPage/GitAuthSettingsPage/GitAuthSettingsPageView.stories.tsx
deleted file mode 100644
index 2a2e6d47ed6a7..0000000000000
--- a/site/src/pages/DeploySettingsPage/GitAuthSettingsPage/GitAuthSettingsPageView.stories.tsx
+++ /dev/null
@@ -1,27 +0,0 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import {
-  GitAuthSettingsPageView,
-  GitAuthSettingsPageViewProps,
-} from "./GitAuthSettingsPageView"
-
-export default {
-  title: "pages/GitAuthSettingsPageView",
-  component: GitAuthSettingsPageView,
-  args: {
-    config: {
-      git_auth: [
-        {
-          id: "0000-1111",
-          type: "GitHub",
-          client_id: "client_id",
-          regex: "regex",
-        },
-      ],
-    },
-  },
-} as ComponentMeta<typeof GitAuthSettingsPageView>
-
-const Template: Story<GitAuthSettingsPageViewProps> = (args) => (
-  <GitAuthSettingsPageView {...args} />
-)
-export const Page = Template.bind({})
diff --git a/site/src/pages/DeploySettingsPage/GitAuthSettingsPage/GitAuthSettingsPageView.tsx b/site/src/pages/DeploySettingsPage/GitAuthSettingsPage/GitAuthSettingsPageView.tsx
deleted file mode 100644
index 19b46ce70768b..0000000000000
--- a/site/src/pages/DeploySettingsPage/GitAuthSettingsPage/GitAuthSettingsPageView.tsx
+++ /dev/null
@@ -1,103 +0,0 @@
-import { makeStyles } from "@mui/styles"
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableHead from "@mui/material/TableHead"
-import TableRow from "@mui/material/TableRow"
-import { DeploymentValues, GitAuthConfig } from "api/typesGenerated"
-import { Alert } from "components/Alert/Alert"
-import { EnterpriseBadge } from "components/DeploySettingsLayout/Badges"
-import { Header } from "components/DeploySettingsLayout/Header"
-import { docs } from "utils/docs"
-
-export type GitAuthSettingsPageViewProps = {
-  config: DeploymentValues
-}
-
-export const GitAuthSettingsPageView = ({
-  config,
-}: GitAuthSettingsPageViewProps): JSX.Element => {
-  const styles = useStyles()
-
-  return (
-    <>
-      <Header
-        title="Git Authentication"
-        description="Coder integrates with GitHub, GitLab, BitBucket, and Azure Repos to authenticate developers with your Git provider."
-        docsHref={docs("/admin/git-providers")}
-      />
-
-      <video
-        autoPlay
-        muted
-        loop
-        playsInline
-        src="/gitauth.mp4"
-        style={{
-          maxWidth: "100%",
-          borderRadius: 4,
-        }}
-      />
-
-      <div className={styles.description}>
-        <Alert severity="info" actions={<EnterpriseBadge key="enterprise" />}>
-          Integrating with multiple Git providers is an Enterprise feature.
-        </Alert>
-      </div>
-
-      <TableContainer>
-        <Table className={styles.table}>
-          <TableHead>
-            <TableRow>
-              <TableCell width="25%">ID</TableCell>
-              <TableCell width="25%">Client ID</TableCell>
-              <TableCell width="25%">Match</TableCell>
-            </TableRow>
-          </TableHead>
-          <TableBody>
-            {((config.git_auth === null || config.git_auth.length === 0) && (
-              <TableRow>
-                <TableCell colSpan={999}>
-                  <div className={styles.empty}>
-                    No providers have been configured!
-                  </div>
-                </TableCell>
-              </TableRow>
-            )) ||
-              config.git_auth.map((git: GitAuthConfig) => {
-                const name = git.id || git.type
-                return (
-                  <TableRow key={name}>
-                    <TableCell>{name}</TableCell>
-                    <TableCell>{git.client_id}</TableCell>
-                    <TableCell>{git.regex || "Not Set"}</TableCell>
-                  </TableRow>
-                )
-              })}
-          </TableBody>
-        </Table>
-      </TableContainer>
-    </>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  table: {
-    "& td": {
-      paddingTop: theme.spacing(3),
-      paddingBottom: theme.spacing(3),
-    },
-
-    "& td:last-child, & th:last-child": {
-      paddingLeft: theme.spacing(4),
-    },
-  },
-  description: {
-    marginTop: theme.spacing(3),
-    marginBottom: theme.spacing(3),
-  },
-  empty: {
-    textAlign: "center",
-  },
-}))
diff --git a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePage.tsx b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePage.tsx
index 7c75dca3713c0..1abca04845884 100644
--- a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePage.tsx
+++ b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePage.tsx
@@ -1,14 +1,14 @@
-import { useMutation } from "@tanstack/react-query"
-import { createLicense } from "api/api"
-import { displayError, displaySuccess } from "components/GlobalSnackbar/utils"
-import { FC } from "react"
-import { useNavigate } from "react-router-dom"
-import { AddNewLicensePageView } from "./AddNewLicensePageView"
-import { pageTitle } from "utils/page"
-import { Helmet } from "react-helmet-async"
+import { useMutation } from "react-query";
+import { createLicense } from "api/api";
+import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
+import { FC } from "react";
+import { useNavigate } from "react-router-dom";
+import { AddNewLicensePageView } from "./AddNewLicensePageView";
+import { pageTitle } from "utils/page";
+import { Helmet } from "react-helmet-async";
 
 const AddNewLicensePage: FC = () => {
-  const navigate = useNavigate()
+  const navigate = useNavigate();
 
   const {
     mutate: saveLicenseKeyApi,
@@ -16,23 +16,23 @@ const AddNewLicensePage: FC = () => {
     error: savingLicenseError,
   } = useMutation(createLicense, {
     onSuccess: () => {
-      displaySuccess("You have successfully added a license")
-      navigate("/settings/deployment/licenses?success=true")
+      displaySuccess("You have successfully added a license");
+      navigate("/deployment/licenses?success=true");
     },
     onError: () => displayError("Failed to save license key"),
-  })
+  });
 
   function saveLicenseKey(licenseKey: string) {
     saveLicenseKeyApi(
       { license: licenseKey },
       {
         onSuccess: () => {
-          displaySuccess("You have successfully added a license")
-          navigate("/settings/deployment/licenses?success=true")
+          displaySuccess("You have successfully added a license");
+          navigate("/deployment/licenses?success=true");
         },
         onError: () => displayError("Failed to save license key"),
       },
-    )
+    );
   }
 
   return (
@@ -47,7 +47,7 @@ const AddNewLicensePage: FC = () => {
         onSaveLicenseKey={saveLicenseKey}
       />
     </>
-  )
-}
+  );
+};
 
-export default AddNewLicensePage
+export default AddNewLicensePage;
diff --git a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePageView.stories.tsx b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePageView.stories.tsx
index 1889668fdfcd0..bb193b66296b9 100644
--- a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePageView.stories.tsx
+++ b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePageView.stories.tsx
@@ -1,13 +1,13 @@
-import { AddNewLicensePageView } from "./AddNewLicensePageView"
+import { AddNewLicensePageView } from "./AddNewLicensePageView";
 
 export default {
-  title: "pages/AddNewLicensePageView",
+  title: "pages/DeploySettingsPage/AddNewLicensePageView",
   component: AddNewLicensePageView,
-}
+};
 
 export const Default = {
   args: {
     isSavingLicense: false,
     didSavingFailed: false,
   },
-}
+};
diff --git a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePageView.tsx b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePageView.tsx
index 48d0bb992b71a..e2156b13c7159 100644
--- a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePageView.tsx
+++ b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/AddNewLicensePageView.tsx
@@ -1,49 +1,49 @@
-import Button from "@mui/material/Button"
-import TextField from "@mui/material/TextField"
-import { makeStyles } from "@mui/styles"
-import { Fieldset } from "components/DeploySettingsLayout/Fieldset"
-import { Header } from "components/DeploySettingsLayout/Header"
-import { FileUpload } from "components/FileUpload/FileUpload"
-import KeyboardArrowLeft from "@mui/icons-material/KeyboardArrowLeft"
-import { displayError } from "components/GlobalSnackbar/utils"
-import { Stack } from "components/Stack/Stack"
-import { DividerWithText } from "pages/DeploySettingsPage/LicensesSettingsPage/DividerWithText"
-import { FC } from "react"
-import { Link as RouterLink } from "react-router-dom"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
+import Button from "@mui/material/Button";
+import TextField from "@mui/material/TextField";
+import { makeStyles } from "@mui/styles";
+import { Fieldset } from "components/DeploySettingsLayout/Fieldset";
+import { Header } from "components/DeploySettingsLayout/Header";
+import { FileUpload } from "components/FileUpload/FileUpload";
+import KeyboardArrowLeft from "@mui/icons-material/KeyboardArrowLeft";
+import { displayError } from "components/GlobalSnackbar/utils";
+import { Stack } from "components/Stack/Stack";
+import { DividerWithText } from "pages/DeploySettingsPage/LicensesSettingsPage/DividerWithText";
+import { FC } from "react";
+import { Link as RouterLink } from "react-router-dom";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
 
 type AddNewLicenseProps = {
-  onSaveLicenseKey: (license: string) => void
-  isSavingLicense: boolean
-  savingLicenseError?: unknown
-}
+  onSaveLicenseKey: (license: string) => void;
+  isSavingLicense: boolean;
+  savingLicenseError?: unknown;
+};
 
 export const AddNewLicensePageView: FC<AddNewLicenseProps> = ({
   onSaveLicenseKey,
   isSavingLicense,
   savingLicenseError,
 }) => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   function handleFileUploaded(files: File[]) {
-    const fileReader = new FileReader()
+    const fileReader = new FileReader();
     fileReader.onload = () => {
-      const licenseKey = fileReader.result as string
+      const licenseKey = fileReader.result as string;
 
-      onSaveLicenseKey(licenseKey)
+      onSaveLicenseKey(licenseKey);
 
       fileReader.onerror = () => {
-        displayError("Failed to read file")
-      }
-    }
+        displayError("Failed to read file");
+      };
+    };
 
-    fileReader.readAsText(files[0])
+    fileReader.readAsText(files[0]);
   }
 
-  const isUploading = false
+  const isUploading = false;
 
   function onUpload(file: File) {
-    handleFileUploaded([file])
+    handleFileUploaded([file]);
   }
 
   return (
@@ -60,7 +60,7 @@ export const AddNewLicensePageView: FC<AddNewLicenseProps> = ({
         <Button
           component={RouterLink}
           startIcon={<KeyboardArrowLeft />}
-          to="/settings/deployment/licenses"
+          to="/deployment/licenses"
         >
           All Licenses
         </Button>
@@ -82,14 +82,14 @@ export const AddNewLicensePageView: FC<AddNewLicenseProps> = ({
         <Fieldset
           title="Paste Your License"
           onSubmit={(e) => {
-            e.preventDefault()
+            e.preventDefault();
 
-            const form = e.target
-            const formData = new FormData(form as HTMLFormElement)
+            const form = e.target;
+            const formData = new FormData(form as HTMLFormElement);
 
-            const licenseKey = formData.get("licenseKey")
+            const licenseKey = formData.get("licenseKey");
 
-            onSaveLicenseKey(licenseKey?.toString() || "")
+            onSaveLicenseKey(licenseKey?.toString() || "");
           }}
           button={
             <Button type="submit" disabled={isSavingLicense}>
@@ -107,11 +107,11 @@ export const AddNewLicensePageView: FC<AddNewLicenseProps> = ({
         </Fieldset>
       </Stack>
     </>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   main: {
     paddingTop: theme.spacing(5),
   },
-}))
+}));
diff --git a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/DividerWithText.tsx b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/DividerWithText.tsx
index 321de70f52e94..40bdb47139ce1 100644
--- a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/DividerWithText.tsx
+++ b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/DividerWithText.tsx
@@ -1,16 +1,16 @@
-import { makeStyles } from "@mui/styles"
-import { FC, PropsWithChildren } from "react"
+import { makeStyles } from "@mui/styles";
+import { FC, PropsWithChildren } from "react";
 
 export const DividerWithText: FC<PropsWithChildren> = ({ children }) => {
-  const classes = useStyles()
+  const classes = useStyles();
   return (
     <div className={classes.container}>
       <div className={classes.border} />
       <span className={classes.content}>{children}</span>
       <div className={classes.border} />
     </div>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   container: {
@@ -29,4 +29,4 @@ const useStyles = makeStyles((theme) => ({
     fontSize: theme.typography.h5.fontSize,
     color: theme.palette.text.secondary,
   },
-}))
+}));
diff --git a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicenseCard.test.tsx b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicenseCard.test.tsx
new file mode 100644
index 0000000000000..8f8a980628d50
--- /dev/null
+++ b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicenseCard.test.tsx
@@ -0,0 +1,70 @@
+import { screen } from "@testing-library/react";
+import { render } from "testHelpers/renderHelpers";
+import { LicenseCard } from "./LicenseCard";
+import { MockLicenseResponse } from "testHelpers/entities";
+
+describe("LicenseCard", () => {
+  it("renders (smoke test)", async () => {
+    // When
+    render(
+      <LicenseCard
+        license={MockLicenseResponse[0]}
+        userLimitActual={1}
+        userLimitLimit={10}
+        onRemove={() => null}
+        isRemoving={false}
+      />,
+    );
+
+    // Then
+    await screen.findByText("#1");
+    await screen.findByText("1 / 10");
+    await screen.findByText("Enterprise");
+  });
+
+  it("renders userLimit as unlimited if there is not user limit", async () => {
+    // When
+    render(
+      <LicenseCard
+        license={MockLicenseResponse[0]}
+        userLimitActual={1}
+        userLimitLimit={undefined}
+        onRemove={() => null}
+        isRemoving={false}
+      />,
+    );
+
+    // Then
+    await screen.findByText("#1");
+    await screen.findByText("1 / Unlimited");
+    await screen.findByText("Enterprise");
+  });
+
+  it("renders license's user_limit when it is available instead of using the default", async () => {
+    const licenseUserLimit = 3;
+    const license = {
+      ...MockLicenseResponse[0],
+      claims: {
+        ...MockLicenseResponse[0].claims,
+        features: {
+          ...MockLicenseResponse[0].claims.features,
+          user_limit: licenseUserLimit,
+        },
+      },
+    };
+
+    // When
+    render(
+      <LicenseCard
+        license={license}
+        userLimitActual={1}
+        userLimitLimit={100} // This should not be used
+        onRemove={() => null}
+        isRemoving={false}
+      />,
+    );
+
+    // Then
+    await screen.findByText("1 / 3");
+  });
+});
diff --git a/site/src/components/LicenseCard/LicenseCard.tsx b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicenseCard.tsx
similarity index 79%
rename from site/src/components/LicenseCard/LicenseCard.tsx
rename to site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicenseCard.tsx
index 4e6596b91a324..682b7c00affec 100644
--- a/site/src/components/LicenseCard/LicenseCard.tsx
+++ b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicenseCard.tsx
@@ -1,21 +1,21 @@
-import Button from "@mui/material/Button"
-import Paper from "@mui/material/Paper"
-import { makeStyles } from "@mui/styles"
-import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog"
-import { Stack } from "components/Stack/Stack"
-import dayjs from "dayjs"
-import { useState } from "react"
-import { Pill } from "components/Pill/Pill"
-import { compareAsc } from "date-fns"
-import { GetLicensesResponse } from "api/api"
+import Button from "@mui/material/Button";
+import Paper from "@mui/material/Paper";
+import { makeStyles } from "@mui/styles";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import { Stack } from "components/Stack/Stack";
+import dayjs from "dayjs";
+import { useState } from "react";
+import { Pill } from "components/Pill/Pill";
+import { compareAsc } from "date-fns";
+import { GetLicensesResponse } from "api/api";
 
 type LicenseCardProps = {
-  license: GetLicensesResponse
-  userLimitActual?: number
-  userLimitLimit?: number
-  onRemove: (licenseId: number) => void
-  isRemoving: boolean
-}
+  license: GetLicensesResponse;
+  userLimitActual?: number;
+  userLimitLimit?: number;
+  onRemove: (licenseId: number) => void;
+  isRemoving: boolean;
+};
 
 export const LicenseCard = ({
   license,
@@ -24,27 +24,27 @@ export const LicenseCard = ({
   onRemove,
   isRemoving,
 }: LicenseCardProps) => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   const [licenseIDMarkedForRemoval, setLicenseIDMarkedForRemoval] = useState<
     number | undefined
-  >(undefined)
+  >(undefined);
 
   const currentUserLimit =
-    license.claims.features["user_limit"] || userLimitLimit
+    license.claims.features["user_limit"] || userLimitLimit;
 
   return (
     <Paper key={license.id} elevation={2} className={styles.licenseCard}>
       <ConfirmDialog
-        type="info"
+        type="delete"
         hideCancel={false}
         open={licenseIDMarkedForRemoval !== undefined}
         onConfirm={() => {
           if (!licenseIDMarkedForRemoval) {
-            return
+            return;
           }
-          onRemove(licenseIDMarkedForRemoval)
-          setLicenseIDMarkedForRemoval(undefined)
+          onRemove(licenseIDMarkedForRemoval);
+          setLicenseIDMarkedForRemoval(undefined);
         }}
         onClose={() => setLicenseIDMarkedForRemoval(undefined)}
         title="Confirm License Removal"
@@ -105,18 +105,18 @@ export const LicenseCard = ({
           <Stack spacing={2}>
             <Button
               className={styles.removeButton}
-              variant="text"
+              variant="contained"
               size="small"
               onClick={() => setLicenseIDMarkedForRemoval(license.id)}
             >
-              Remove
+              Remove&hellip;
             </Button>
           </Stack>
         </Stack>
       </Stack>
     </Paper>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   userLimit: {
@@ -148,13 +148,9 @@ const useStyles = makeStyles((theme) => ({
     color: theme.palette.text.secondary,
   },
   removeButton: {
-    height: "17px",
-    minHeight: "17px",
-    padding: 0,
-    border: "none",
     color: theme.palette.error.main,
     "&:hover": {
       backgroundColor: "transparent",
     },
   },
-}))
+}));
diff --git a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPage.tsx b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPage.tsx
index 2a8ae72b396e4..16420749e7164 100644
--- a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPage.tsx
+++ b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPage.tsx
@@ -1,49 +1,62 @@
-import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
-import { useMachine } from "@xstate/react"
-import { getLicenses, removeLicense } from "api/api"
-import { displayError, displaySuccess } from "components/GlobalSnackbar/utils"
-import { FC, useEffect } from "react"
-import { Helmet } from "react-helmet-async"
-import { useSearchParams } from "react-router-dom"
-import useToggle from "react-use/lib/useToggle"
-import { pageTitle } from "utils/page"
-import { entitlementsMachine } from "xServices/entitlements/entitlementsXService"
-import LicensesSettingsPageView from "./LicensesSettingsPageView"
+import { useMutation, useQuery, useQueryClient } from "react-query";
+import { getLicenses, removeLicense } from "api/api";
+import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
+import { FC, useEffect } from "react";
+import { Helmet } from "react-helmet-async";
+import { useSearchParams } from "react-router-dom";
+import useToggle from "react-use/lib/useToggle";
+import { pageTitle } from "utils/page";
+import LicensesSettingsPageView from "./LicensesSettingsPageView";
+import { getErrorMessage } from "api/errors";
+import { entitlements, refreshEntitlements } from "api/queries/entitlements";
 
 const LicensesSettingsPage: FC = () => {
-  const queryClient = useQueryClient()
-  const [entitlementsState] = useMachine(entitlementsMachine)
-  const { entitlements } = entitlementsState.context
-  const [searchParams, setSearchParams] = useSearchParams()
-  const success = searchParams.get("success")
-  const [confettiOn, toggleConfettiOn] = useToggle(false)
+  const queryClient = useQueryClient();
+  const [searchParams, setSearchParams] = useSearchParams();
+  const success = searchParams.get("success");
+  const [confettiOn, toggleConfettiOn] = useToggle(false);
+  const entitlementsQuery = useQuery(entitlements());
+  const refreshEntitlementsMutation = useMutation(
+    refreshEntitlements(queryClient),
+  );
+
+  useEffect(() => {
+    if (entitlementsQuery.error) {
+      displayError(
+        getErrorMessage(
+          entitlementsQuery.error,
+          "Failed to fetch entitlements",
+        ),
+      );
+    }
+  }, [entitlementsQuery.error]);
 
   const { mutate: removeLicenseApi, isLoading: isRemovingLicense } =
     useMutation(removeLicense, {
       onSuccess: () => {
-        displaySuccess("Successfully removed license")
-        void queryClient.invalidateQueries(["licenses"])
+        displaySuccess("Successfully removed license");
+        void queryClient.invalidateQueries(["licenses"]);
       },
       onError: () => {
-        displayError("Failed to remove license")
+        displayError("Failed to remove license");
       },
-    })
+    });
 
   const { data: licenses, isLoading } = useQuery({
     queryKey: ["licenses"],
     queryFn: () => getLicenses(),
-  })
+  });
 
   useEffect(() => {
     if (success) {
-      toggleConfettiOn()
+      toggleConfettiOn();
       const timeout = setTimeout(() => {
-        toggleConfettiOn(false)
-        setSearchParams()
-      }, 2000)
-      return () => clearTimeout(timeout)
+        toggleConfettiOn(false);
+        setSearchParams();
+      }, 2000);
+      return () => clearTimeout(timeout);
     }
-  }, [setSearchParams, success, toggleConfettiOn])
+  }, [setSearchParams, success, toggleConfettiOn]);
 
   return (
     <>
@@ -53,14 +66,23 @@ const LicensesSettingsPage: FC = () => {
       <LicensesSettingsPageView
         showConfetti={confettiOn}
         isLoading={isLoading}
-        userLimitActual={entitlements?.features.user_limit.actual}
-        userLimitLimit={entitlements?.features.user_limit.limit}
+        isRefreshing={refreshEntitlementsMutation.isLoading}
+        userLimitActual={entitlementsQuery.data?.features.user_limit.actual}
+        userLimitLimit={entitlementsQuery.data?.features.user_limit.limit}
         licenses={licenses}
         isRemovingLicense={isRemovingLicense}
         removeLicense={(licenseId: number) => removeLicenseApi(licenseId)}
+        refreshEntitlements={async () => {
+          try {
+            await refreshEntitlementsMutation.mutateAsync();
+            displaySuccess("Successfully removed license");
+          } catch (error) {
+            displayError(getErrorMessage(error, "Failed to remove license"));
+          }
+        }}
       />
     </>
-  )
-}
+  );
+};
 
-export default LicensesSettingsPage
+export default LicensesSettingsPage;
diff --git a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPageView.stories.tsx b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPageView.stories.tsx
index daa0a703628f8..21edae00d209c 100644
--- a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPageView.stories.tsx
+++ b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPageView.stories.tsx
@@ -1,10 +1,10 @@
-import LicensesSettingsPageView from "./LicensesSettingsPageView"
-import { MockLicenseResponse } from "testHelpers/entities"
+import LicensesSettingsPageView from "./LicensesSettingsPageView";
+import { MockLicenseResponse } from "testHelpers/entities";
 
 export default {
-  title: "pages/LicensesSettingsPageView",
+  title: "pages/DeploySettingsPage/LicensesSettingsPageView",
   component: LicensesSettingsPageView,
-}
+};
 
 const defaultArgs = {
   showConfetti: false,
@@ -12,15 +12,15 @@ const defaultArgs = {
   userLimitActual: 1,
   userLimitLimit: 10,
   licenses: MockLicenseResponse,
-}
+};
 
 export const Default = {
   args: defaultArgs,
-}
+};
 
 export const Empty = {
   args: {
     ...defaultArgs,
     licenses: null,
   },
-}
+};
diff --git a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPageView.tsx b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPageView.tsx
index b1f5c678ac630..12d47d738ef5c 100644
--- a/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPageView.tsx
+++ b/site/src/pages/DeploySettingsPage/LicensesSettingsPage/LicensesSettingsPageView.tsx
@@ -1,26 +1,31 @@
-import Button from "@mui/material/Button"
-import { makeStyles, useTheme } from "@mui/styles"
-import Skeleton from "@mui/material/Skeleton"
-import AddIcon from "@mui/icons-material/AddOutlined"
-import { GetLicensesResponse } from "api/api"
-import { Header } from "components/DeploySettingsLayout/Header"
-import { LicenseCard } from "components/LicenseCard/LicenseCard"
-import { Stack } from "components/Stack/Stack"
-import { FC } from "react"
-import Confetti from "react-confetti"
-import { Link } from "react-router-dom"
-import useWindowSize from "react-use/lib/useWindowSize"
-import MuiLink from "@mui/material/Link"
+import Button from "@mui/material/Button";
+import { makeStyles, useTheme } from "@mui/styles";
+import Skeleton from "@mui/material/Skeleton";
+import AddIcon from "@mui/icons-material/AddOutlined";
+import RefreshIcon from "@mui/icons-material/Refresh";
+import { GetLicensesResponse } from "api/api";
+import { Header } from "components/DeploySettingsLayout/Header";
+import { LicenseCard } from "./LicenseCard";
+import { Stack } from "components/Stack/Stack";
+import { FC } from "react";
+import Confetti from "react-confetti";
+import { Link } from "react-router-dom";
+import useWindowSize from "react-use/lib/useWindowSize";
+import MuiLink from "@mui/material/Link";
+import Tooltip from "@mui/material/Tooltip";
+import LoadingButton from "@mui/lab/LoadingButton";
 
 type Props = {
-  showConfetti: boolean
-  isLoading: boolean
-  userLimitActual?: number
-  userLimitLimit?: number
-  licenses?: GetLicensesResponse[]
-  isRemovingLicense: boolean
-  removeLicense: (licenseId: number) => void
-}
+  showConfetti: boolean;
+  isLoading: boolean;
+  userLimitActual?: number;
+  userLimitLimit?: number;
+  licenses?: GetLicensesResponse[];
+  isRemovingLicense: boolean;
+  isRefreshing: boolean;
+  removeLicense: (licenseId: number) => void;
+  refreshEntitlements: () => void;
+};
 
 const LicensesSettingsPageView: FC<Props> = ({
   showConfetti,
@@ -29,12 +34,14 @@ const LicensesSettingsPageView: FC<Props> = ({
   userLimitLimit,
   licenses,
   isRemovingLicense,
+  isRefreshing,
   removeLicense,
+  refreshEntitlements,
 }) => {
-  const styles = useStyles()
-  const { width, height } = useWindowSize()
+  const styles = useStyles();
+  const { width, height } = useWindowSize();
 
-  const theme = useTheme()
+  const theme = useTheme();
 
   return (
     <>
@@ -55,13 +62,25 @@ const LicensesSettingsPageView: FC<Props> = ({
           description="Manage licenses to unlock Enterprise features."
         />
 
-        <Button
-          component={Link}
-          to="/settings/deployment/licenses/add"
-          startIcon={<AddIcon />}
-        >
-          Add a license
-        </Button>
+        <Stack direction="row" spacing={2}>
+          <Button
+            component={Link}
+            to="/deployment/licenses/add"
+            startIcon={<AddIcon />}
+          >
+            Add a license
+          </Button>
+          <Tooltip title="Refresh license entitlements. This is done automatically every 10 minutes.">
+            <LoadingButton
+              loadingPosition="start"
+              loading={isRefreshing}
+              onClick={refreshEntitlements}
+              startIcon={<RefreshIcon />}
+            >
+              Refresh
+            </LoadingButton>
+          </Tooltip>
+        </Stack>
       </Stack>
 
       {isLoading && <Skeleton variant="rectangular" height={200} />}
@@ -92,10 +111,10 @@ const LicensesSettingsPageView: FC<Props> = ({
           <Stack alignItems="center" spacing={1}>
             <Stack alignItems="center" spacing={0.5}>
               <span className={styles.title}>
-                You don{"'"}t have any licenses!
+                You don&apos;t have any licenses!
               </span>
               <span className={styles.description}>
-                You{"'"}re missing out on high availability, RBAC, quotas, and
+                You&apos;re missing out on high availability, RBAC, quotas, and
                 much more. Contact{" "}
                 <MuiLink href="mailto:sales@coder.com">sales</MuiLink> or{" "}
                 <MuiLink href="https://coder.com/trial">
@@ -108,8 +127,8 @@ const LicensesSettingsPageView: FC<Props> = ({
         </div>
       )}
     </>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   title: {
@@ -132,6 +151,6 @@ const useStyles = makeStyles((theme) => ({
     maxWidth: theme.spacing(58),
     marginTop: theme.spacing(1),
   },
-}))
+}));
 
-export default LicensesSettingsPageView
+export default LicensesSettingsPageView;
diff --git a/site/src/pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPage.tsx b/site/src/pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPage.tsx
index 061d8aa55147c..c1ae478352bc7 100644
--- a/site/src/pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPage.tsx
+++ b/site/src/pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPage.tsx
@@ -1,11 +1,11 @@
-import { useDeploySettings } from "components/DeploySettingsLayout/DeploySettingsLayout"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { NetworkSettingsPageView } from "./NetworkSettingsPageView"
+import { useDeploySettings } from "components/DeploySettingsLayout/DeploySettingsLayout";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { NetworkSettingsPageView } from "./NetworkSettingsPageView";
 
 const NetworkSettingsPage: FC = () => {
-  const { deploymentValues: deploymentValues } = useDeploySettings()
+  const { deploymentValues: deploymentValues } = useDeploySettings();
 
   return (
     <>
@@ -15,7 +15,7 @@ const NetworkSettingsPage: FC = () => {
 
       <NetworkSettingsPageView options={deploymentValues.options} />
     </>
-  )
-}
+  );
+};
 
-export default NetworkSettingsPage
+export default NetworkSettingsPage;
diff --git a/site/src/pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPageView.stories.tsx b/site/src/pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPageView.stories.tsx
index 7d5b889f0d6ef..493476353209b 100644
--- a/site/src/pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPageView.stories.tsx
+++ b/site/src/pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPageView.stories.tsx
@@ -1,60 +1,70 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import {
-  NetworkSettingsPageView,
-  NetworkSettingsPageViewProps,
-} from "./NetworkSettingsPageView"
+import { ClibaseGroup } from "api/typesGenerated";
+import { NetworkSettingsPageView } from "./NetworkSettingsPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/NetworkSettingsPageView",
+const group: ClibaseGroup = {
+  name: "Networking",
+  description: "",
+};
+
+const meta: Meta<typeof NetworkSettingsPageView> = {
+  title: "pages/DeploySettingsPage/NetworkSettingsPageView",
   component: NetworkSettingsPageView,
   args: {
     options: [
       {
         name: "DERP Server Enable",
-        usage: "Whether to enable or disable the embedded DERP relay server.",
+        description:
+          "Whether to enable or disable the embedded DERP relay server.",
         value: true,
-        group: {
-          name: "Networking",
-        },
+        group,
+        flag: "derp",
+        flag_shorthand: "d",
+        hidden: false,
       },
       {
         name: "DERP Server Region Name",
-        usage: "Region name that for the embedded DERP server.",
+        description: "Region name that for the embedded DERP server.",
         value: "aws-east",
-        group: {
-          name: "Networking",
-        },
+        group,
+        flag: "derp",
+        flag_shorthand: "d",
+        hidden: false,
       },
       {
         name: "DERP Server STUN Addresses",
-        usage:
+        description:
           "Addresses for STUN servers to establish P2P connections. Set empty to disable P2P connections.",
         value: ["stun.l.google.com:19302", "stun.l.google.com:19301"],
-        group: {
-          name: "Networking",
-        },
+        group,
+        flag: "derp",
+        flag_shorthand: "d",
+        hidden: false,
       },
       {
         name: "DERP Config URL",
-        usage:
+        description:
           "URL to fetch a DERP mapping on startup. See: https://tailscale.com/kb/1118/custom-derp-servers/",
         value: "https://coder.com",
-        group: {
-          name: "Networking",
-        },
+        group,
+        flag: "derp",
+        flag_shorthand: "d",
+        hidden: false,
       },
       {
         name: "Wildcard Access URL",
+        description: "",
         value: "https://coder.com",
-        group: {
-          name: "Networking",
-        },
+        group,
+        flag: "derp",
+        flag_shorthand: "d",
+        hidden: false,
       },
     ],
   },
-} as ComponentMeta<typeof NetworkSettingsPageView>
+};
+
+export default meta;
+type Story = StoryObj<typeof NetworkSettingsPageView>;
 
-const Template: Story<NetworkSettingsPageViewProps> = (args) => (
-  <NetworkSettingsPageView {...args} />
-)
-export const Page = Template.bind({})
+export const Page: Story = {};
diff --git a/site/src/pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPageView.tsx b/site/src/pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPageView.tsx
index dafbbd6e07d4e..3daa105967764 100644
--- a/site/src/pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPageView.tsx
+++ b/site/src/pages/DeploySettingsPage/NetworkSettingsPage/NetworkSettingsPageView.tsx
@@ -1,21 +1,21 @@
-import { DeploymentOption } from "api/types"
+import { ClibaseOption } from "api/typesGenerated";
 import {
   Badges,
   EnabledBadge,
   DisabledBadge,
-} from "components/DeploySettingsLayout/Badges"
-import { Header } from "components/DeploySettingsLayout/Header"
-import OptionsTable from "components/DeploySettingsLayout/OptionsTable"
-import { Stack } from "components/Stack/Stack"
+} from "components/DeploySettingsLayout/Badges";
+import { Header } from "components/DeploySettingsLayout/Header";
+import OptionsTable from "components/DeploySettingsLayout/OptionsTable";
+import { Stack } from "components/Stack/Stack";
 import {
   deploymentGroupHasParent,
   useDeploymentOptions,
-} from "utils/deployOptions"
-import { docs } from "utils/docs"
+} from "utils/deployOptions";
+import { docs } from "utils/docs";
 
 export type NetworkSettingsPageViewProps = {
-  options: DeploymentOption[]
-}
+  options: ClibaseOption[];
+};
 
 export const NetworkSettingsPageView = ({
   options: options,
@@ -52,4 +52,4 @@ export const NetworkSettingsPageView = ({
       </Badges>
     </div>
   </Stack>
-)
+);
diff --git a/site/src/pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPage.tsx b/site/src/pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPage.tsx
index 1041c64597589..ff78264dcb846 100644
--- a/site/src/pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPage.tsx
+++ b/site/src/pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPage.tsx
@@ -1,13 +1,13 @@
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import { useDeploySettings } from "components/DeploySettingsLayout/DeploySettingsLayout"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { SecuritySettingsPageView } from "./SecuritySettingsPageView"
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { useDeploySettings } from "components/DeploySettingsLayout/DeploySettingsLayout";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { SecuritySettingsPageView } from "./SecuritySettingsPageView";
 
 const SecuritySettingsPage: FC = () => {
-  const { deploymentValues: deploymentValues } = useDeploySettings()
-  const { entitlements } = useDashboard()
+  const { deploymentValues: deploymentValues } = useDeploySettings();
+  const { entitlements } = useDashboard();
 
   return (
     <>
@@ -23,7 +23,7 @@ const SecuritySettingsPage: FC = () => {
         }
       />
     </>
-  )
-}
+  );
+};
 
-export default SecuritySettingsPage
+export default SecuritySettingsPage;
diff --git a/site/src/pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPageView.stories.tsx b/site/src/pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPageView.stories.tsx
index 8edbaa97d2199..4fbcc0e530c9c 100644
--- a/site/src/pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPageView.stories.tsx
+++ b/site/src/pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPageView.stories.tsx
@@ -1,12 +1,14 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { DeploymentOption } from "api/types"
-import {
-  SecuritySettingsPageView,
-  SecuritySettingsPageViewProps,
-} from "./SecuritySettingsPageView"
+import { SecuritySettingsPageView } from "./SecuritySettingsPageView";
+import type { Meta, StoryObj } from "@storybook/react";
+import { ClibaseGroup, ClibaseOption } from "api/typesGenerated";
 
-export default {
-  title: "pages/SecuritySettingsPageView",
+const group: ClibaseGroup = {
+  name: "Networking",
+  description: "",
+};
+
+const meta: Meta<typeof SecuritySettingsPageView> = {
+  title: "pages/DeploySettingsPage/SecuritySettingsPageView",
   component: SecuritySettingsPageView,
   args: {
     options: [
@@ -14,50 +16,62 @@ export default {
         name: "SSH Keygen Algorithm",
         description: "something",
         value: "1234",
+        group,
+        flag: "derp",
+        flag_shorthand: "d",
+        hidden: false,
       },
       {
         name: "Secure Auth Cookie",
         description: "something",
         value: "1234",
+        flag: "derp",
+        flag_shorthand: "d",
+        hidden: false,
       },
       {
         name: "Disable Owner Workspace Access",
         description: "something",
         value: false,
+        flag: "derp",
+        flag_shorthand: "d",
+        hidden: false,
       },
       {
         name: "TLS Version",
         description: "something",
         value: ["something"],
-        group: {
-          name: "TLS",
-        },
+        group: { ...group, name: "TLS" },
+        flag: "derp",
+        flag_shorthand: "d",
+        hidden: false,
       },
     ],
     featureAuditLogEnabled: true,
     featureBrowserOnlyEnabled: true,
   },
-} as ComponentMeta<typeof SecuritySettingsPageView>
+};
+
+export default meta;
+type Story = StoryObj<typeof SecuritySettingsPageView>;
 
-const Template: Story<SecuritySettingsPageViewProps> = (args) => (
-  <SecuritySettingsPageView {...args} />
-)
-export const Page = Template.bind({})
+export const Page: Story = {};
 
-export const NoTLS = Template.bind({})
-NoTLS.args = {
-  options: [
-    {
-      name: "SSH Keygen Algorithm",
-      value: "1234",
-    } as DeploymentOption,
-    {
-      name: "Disable Owner Workspace Access",
-      value: false,
-    } as DeploymentOption,
-    {
-      name: "Secure Auth Cookie",
-      value: "1234",
-    } as DeploymentOption,
-  ],
-}
+export const NoTLS = {
+  args: {
+    options: [
+      {
+        name: "SSH Keygen Algorithm",
+        value: "1234",
+      } as ClibaseOption,
+      {
+        name: "Disable Owner Workspace Access",
+        value: false,
+      } as ClibaseOption,
+      {
+        name: "Secure Auth Cookie",
+        value: "1234",
+      } as ClibaseOption,
+    ],
+  },
+};
diff --git a/site/src/pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPageView.tsx b/site/src/pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPageView.tsx
index 3e5da55fb9f78..e2bb6508fb239 100644
--- a/site/src/pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPageView.tsx
+++ b/site/src/pages/DeploySettingsPage/SecuritySettingsPage/SecuritySettingsPageView.tsx
@@ -1,88 +1,92 @@
-import { DeploymentOption } from "api/types"
+import { ClibaseOption } from "api/typesGenerated";
 import {
   Badges,
   DisabledBadge,
   EnabledBadge,
   EnterpriseBadge,
-} from "components/DeploySettingsLayout/Badges"
-import { Header } from "components/DeploySettingsLayout/Header"
-import OptionsTable from "components/DeploySettingsLayout/OptionsTable"
-import { Stack } from "components/Stack/Stack"
+} from "components/DeploySettingsLayout/Badges";
+import { Header } from "components/DeploySettingsLayout/Header";
+import OptionsTable from "components/DeploySettingsLayout/OptionsTable";
+import { Stack } from "components/Stack/Stack";
 import {
   deploymentGroupHasParent,
   useDeploymentOptions,
-} from "utils/deployOptions"
-import { docs } from "utils/docs"
+} from "utils/deployOptions";
+import { docs } from "utils/docs";
 
 export type SecuritySettingsPageViewProps = {
-  options: DeploymentOption[]
-  featureAuditLogEnabled: boolean
-  featureBrowserOnlyEnabled: boolean
-}
+  options: ClibaseOption[];
+  featureAuditLogEnabled: boolean;
+  featureBrowserOnlyEnabled: boolean;
+};
 export const SecuritySettingsPageView = ({
   options: options,
   featureAuditLogEnabled,
   featureBrowserOnlyEnabled,
-}: SecuritySettingsPageViewProps): JSX.Element => (
-  <>
-    <Stack direction="column" spacing={6}>
-      <div>
-        <Header
-          title="Security"
-          description="Ensure your Coder deployment is secure."
-        />
+}: SecuritySettingsPageViewProps): JSX.Element => {
+  const tlsOptions = options.filter((o) =>
+    deploymentGroupHasParent(o.group, "TLS"),
+  );
 
-        <OptionsTable
-          options={useDeploymentOptions(
-            options,
-            "SSH Keygen Algorithm",
-            "Secure Auth Cookie",
-            "Disable Owner Workspace Access",
-          )}
-        />
-      </div>
+  return (
+    <>
+      <Stack direction="column" spacing={6}>
+        <div>
+          <Header
+            title="Security"
+            description="Ensure your Coder deployment is secure."
+          />
 
-      <div>
-        <Header
-          title="Audit Logging"
-          secondary
-          description="Allow auditors to monitor user operations in your deployment."
-          docsHref={docs("/admin/audit-logs")}
-        />
+          <OptionsTable
+            options={useDeploymentOptions(
+              options,
+              "SSH Keygen Algorithm",
+              "Secure Auth Cookie",
+              "Disable Owner Workspace Access",
+            )}
+          />
+        </div>
 
-        <Badges>
-          {featureAuditLogEnabled ? <EnabledBadge /> : <DisabledBadge />}
-          <EnterpriseBadge />
-        </Badges>
-      </div>
+        <div>
+          <Header
+            title="Audit Logging"
+            secondary
+            description="Allow auditors to monitor user operations in your deployment."
+            docsHref={docs("/admin/audit-logs")}
+          />
 
-      <div>
-        <Header
-          title="Browser Only Connections"
-          secondary
-          description="Block all workspace access via SSH, port forward, and other non-browser connections."
-          docsHref={docs("/networking#browser-only-connections-enterprise")}
-        />
+          <Badges>
+            {featureAuditLogEnabled ? <EnabledBadge /> : <DisabledBadge />}
+            <EnterpriseBadge />
+          </Badges>
+        </div>
 
-        <Badges>
-          {featureBrowserOnlyEnabled ? <EnabledBadge /> : <DisabledBadge />}
-          <EnterpriseBadge />
-        </Badges>
-      </div>
+        <div>
+          <Header
+            title="Browser Only Connections"
+            secondary
+            description="Block all workspace access via SSH, port forward, and other non-browser connections."
+            docsHref={docs("/networking#browser-only-connections-enterprise")}
+          />
 
-      <div>
-        <Header
-          title="TLS"
-          secondary
-          description="Ensure TLS is properly configured for your Coder deployment."
-        />
+          <Badges>
+            {featureBrowserOnlyEnabled ? <EnabledBadge /> : <DisabledBadge />}
+            <EnterpriseBadge />
+          </Badges>
+        </div>
 
-        <OptionsTable
-          options={options.filter((o) =>
-            deploymentGroupHasParent(o.group, "TLS"),
-          )}
-        />
-      </div>
-    </Stack>
-  </>
-)
+        {tlsOptions.length > 0 && (
+          <div>
+            <Header
+              title="TLS"
+              secondary
+              description="Ensure TLS is properly configured for your Coder deployment."
+            />
+
+            <OptionsTable options={tlsOptions} />
+          </div>
+        )}
+      </Stack>
+    </>
+  );
+};
diff --git a/site/src/pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPage.tsx b/site/src/pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPage.tsx
index 06f7f9917bec1..d8d83edc406cb 100644
--- a/site/src/pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPage.tsx
+++ b/site/src/pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPage.tsx
@@ -1,11 +1,11 @@
-import { useDeploySettings } from "components/DeploySettingsLayout/DeploySettingsLayout"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { UserAuthSettingsPageView } from "./UserAuthSettingsPageView"
+import { useDeploySettings } from "components/DeploySettingsLayout/DeploySettingsLayout";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { UserAuthSettingsPageView } from "./UserAuthSettingsPageView";
 
 const UserAuthSettingsPage: FC = () => {
-  const { deploymentValues: deploymentValues } = useDeploySettings()
+  const { deploymentValues: deploymentValues } = useDeploySettings();
 
   return (
     <>
@@ -15,7 +15,7 @@ const UserAuthSettingsPage: FC = () => {
 
       <UserAuthSettingsPageView options={deploymentValues.options} />
     </>
-  )
-}
+  );
+};
 
-export default UserAuthSettingsPage
+export default UserAuthSettingsPage;
diff --git a/site/src/pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPageView.stories.tsx b/site/src/pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPageView.stories.tsx
index 9f9c1f7af75ca..700ec926df6be 100644
--- a/site/src/pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPageView.stories.tsx
+++ b/site/src/pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPageView.stories.tsx
@@ -1,11 +1,19 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import {
-  UserAuthSettingsPageView,
-  UserAuthSettingsPageViewProps,
-} from "./UserAuthSettingsPageView"
+import { ClibaseGroup } from "api/typesGenerated";
+import { UserAuthSettingsPageView } from "./UserAuthSettingsPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/UserAuthSettingsPageView",
+const oidcGroup: ClibaseGroup = {
+  name: "OIDC",
+  description: "",
+};
+
+const ghGroup: ClibaseGroup = {
+  name: "GitHub",
+  description: "",
+};
+
+const meta: Meta<typeof UserAuthSettingsPageView> = {
+  title: "pages/DeploySettingsPage/UserAuthSettingsPageView",
   component: UserAuthSettingsPageView,
   args: {
     options: [
@@ -13,91 +21,101 @@ export default {
         name: "OIDC Client ID",
         description: "Client ID to use for Login with OIDC.",
         value: "1234",
-        group: {
-          name: "OIDC",
-        },
+        group: oidcGroup,
+        flag: "oidc",
+        flag_shorthand: "o",
+        hidden: false,
       },
       {
         name: "OIDC Allow Signups",
         description: "Whether new users can sign up with OIDC.",
         value: true,
-        group: {
-          name: "OIDC",
-        },
+        group: oidcGroup,
+        flag: "oidc",
+        flag_shorthand: "o",
+        hidden: false,
       },
       {
         name: "OIDC Email Domain",
         description:
           "Email domains that clients logging in with OIDC must match.",
         value: "@coder.com",
-        group: {
-          name: "OIDC",
-        },
+        group: oidcGroup,
+        flag: "oidc",
+        flag_shorthand: "o",
+        hidden: false,
       },
       {
         name: "OIDC Issuer URL",
         description: "Issuer URL to use for Login with OIDC.",
         value: "https://coder.com",
-        group: {
-          name: "OIDC",
-        },
+        group: oidcGroup,
+        flag: "oidc",
+        flag_shorthand: "o",
+        hidden: false,
       },
       {
         name: "OIDC Scopes",
         description: "Scopes to grant when authenticating with OIDC.",
         value: ["idk"],
-        group: {
-          name: "OIDC",
-        },
+        group: oidcGroup,
+        flag: "oidc",
+        flag_shorthand: "o",
+        hidden: false,
       },
       {
         name: "OAuth2 GitHub Client ID",
         description: "Client ID for Login with GitHub.",
         value: "1224",
-        group: {
-          name: "GitHub",
-        },
+        group: ghGroup,
+        flag: "oidc",
+        flag_shorthand: "o",
+        hidden: false,
       },
       {
         name: "OAuth2 GitHub Allow Signups",
         description: "Whether new users can sign up with GitHub.",
         value: true,
-        group: {
-          name: "GitHub",
-        },
+        group: ghGroup,
+        flag: "oidc",
+        flag_shorthand: "o",
+        hidden: false,
       },
       {
         name: "OAuth2 GitHub Enterprise Base URL",
         description:
           "Base URL of a GitHub Enterprise deployment to use for Login with GitHub.",
         value: "https://google.com",
-        group: {
-          name: "GitHub",
-        },
+        group: ghGroup,
+        flag: "oidc",
+        flag_shorthand: "o",
+        hidden: false,
       },
       {
         name: "OAuth2 GitHub Allowed Orgs",
         description:
           "Organizations the user must be a member of to Login with GitHub.",
         value: true,
-        group: {
-          name: "GitHub",
-        },
+        group: ghGroup,
+        flag: "oidc",
+        flag_shorthand: "o",
+        hidden: false,
       },
       {
         name: "OAuth2 GitHub Allowed Teams",
         description:
           "Teams inside organizations the user must be a member of to Login with GitHub. Structured as: <organization-name>/<team-slug>.",
         value: true,
-        group: {
-          name: "GitHub",
-        },
+        group: ghGroup,
+        flag: "oidc",
+        flag_shorthand: "o",
+        hidden: false,
       },
     ],
   },
-} as ComponentMeta<typeof UserAuthSettingsPageView>
+};
+
+export default meta;
+type Story = StoryObj<typeof UserAuthSettingsPageView>;
 
-const Template: Story<UserAuthSettingsPageViewProps> = (args) => (
-  <UserAuthSettingsPageView {...args} />
-)
-export const Page = Template.bind({})
+export const Page: Story = {};
diff --git a/site/src/pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPageView.tsx b/site/src/pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPageView.tsx
index a1c01adefcd28..9d329293eb9d7 100644
--- a/site/src/pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPageView.tsx
+++ b/site/src/pages/DeploySettingsPage/UserAuthSettingsPage/UserAuthSettingsPageView.tsx
@@ -1,74 +1,77 @@
-import { DeploymentOption } from "api/types"
+import { ClibaseOption } from "api/typesGenerated";
 import {
   Badges,
   DisabledBadge,
   EnabledBadge,
-} from "components/DeploySettingsLayout/Badges"
-import { Header } from "components/DeploySettingsLayout/Header"
-import OptionsTable from "components/DeploySettingsLayout/OptionsTable"
-import { Stack } from "components/Stack/Stack"
+} from "components/DeploySettingsLayout/Badges";
+import { Header } from "components/DeploySettingsLayout/Header";
+import OptionsTable from "components/DeploySettingsLayout/OptionsTable";
+import { Stack } from "components/Stack/Stack";
 import {
   deploymentGroupHasParent,
   useDeploymentOptions,
-} from "utils/deployOptions"
-import { docs } from "utils/docs"
+} from "utils/deployOptions";
+import { docs } from "utils/docs";
 
 export type UserAuthSettingsPageViewProps = {
-  options: DeploymentOption[]
-}
+  options: ClibaseOption[];
+};
 
 export const UserAuthSettingsPageView = ({
   options,
-}: UserAuthSettingsPageViewProps): JSX.Element => (
-  <>
-    <Stack direction="column" spacing={6}>
-      <div>
-        <Header title="User Authentication" />
+}: UserAuthSettingsPageViewProps): JSX.Element => {
+  const oidcEnabled = Boolean(
+    useDeploymentOptions(options, "OIDC Client ID")[0].value,
+  );
+  const githubEnabled = Boolean(
+    useDeploymentOptions(options, "OAuth2 GitHub Client ID")[0].value,
+  );
 
-        <Header
-          title="Login with OpenID Connect"
-          secondary
-          description="Set up authentication to login with OpenID Connect."
-          docsHref={docs("/admin/auth#openid-connect-with-google")}
-        />
+  return (
+    <>
+      <Stack direction="column" spacing={6}>
+        <div>
+          <Header title="User Authentication" />
 
-        <Badges>
-          {useDeploymentOptions(options, "OIDC Client ID")[0].value ? (
-            <EnabledBadge />
-          ) : (
-            <DisabledBadge />
-          )}
-        </Badges>
+          <Header
+            title="Login with OpenID Connect"
+            secondary
+            description="Set up authentication to login with OpenID Connect."
+            docsHref={docs("/admin/auth#openid-connect-with-google")}
+          />
+
+          <Badges>{oidcEnabled ? <EnabledBadge /> : <DisabledBadge />}</Badges>
 
-        <OptionsTable
-          options={options.filter((o) =>
-            deploymentGroupHasParent(o.group, "OIDC"),
+          {oidcEnabled && (
+            <OptionsTable
+              options={options.filter((o) =>
+                deploymentGroupHasParent(o.group, "OIDC"),
+              )}
+            />
           )}
-        />
-      </div>
+        </div>
 
-      <div>
-        <Header
-          title="Login with GitHub"
-          secondary
-          description="Set up authentication to login with GitHub."
-          docsHref={docs("/admin/auth#github")}
-        />
+        <div>
+          <Header
+            title="Login with GitHub"
+            secondary
+            description="Set up authentication to login with GitHub."
+            docsHref={docs("/admin/auth#github")}
+          />
 
-        <Badges>
-          {useDeploymentOptions(options, "OAuth2 GitHub Client ID")[0].value ? (
-            <EnabledBadge />
-          ) : (
-            <DisabledBadge />
-          )}
-        </Badges>
+          <Badges>
+            {githubEnabled ? <EnabledBadge /> : <DisabledBadge />}
+          </Badges>
 
-        <OptionsTable
-          options={options.filter((o) =>
-            deploymentGroupHasParent(o.group, "GitHub"),
+          {githubEnabled && (
+            <OptionsTable
+              options={options.filter((o) =>
+                deploymentGroupHasParent(o.group, "GitHub"),
+              )}
+            />
           )}
-        />
-      </div>
-    </Stack>
-  </>
-)
+        </div>
+      </Stack>
+    </>
+  );
+};
diff --git a/site/src/pages/ExternalAuthPage/ExternalAuthPage.tsx b/site/src/pages/ExternalAuthPage/ExternalAuthPage.tsx
new file mode 100644
index 0000000000000..8cc955b596d4c
--- /dev/null
+++ b/site/src/pages/ExternalAuthPage/ExternalAuthPage.tsx
@@ -0,0 +1,129 @@
+import { useQuery, useQueryClient } from "react-query";
+import {
+  exchangeExternalAuthDevice,
+  getExternalAuthDevice,
+  getExternalAuthProvider,
+} from "api/api";
+import { usePermissions } from "hooks";
+import { type FC } from "react";
+import { useParams, useSearchParams } from "react-router-dom";
+import ExternalAuthPageView from "./ExternalAuthPageView";
+import { ApiErrorResponse } from "api/errors";
+import { isAxiosError } from "axios";
+import Box from "@mui/material/Box";
+import Button from "@mui/material/Button";
+import { SignInLayout } from "components/SignInLayout/SignInLayout";
+import { Welcome } from "components/Welcome/Welcome";
+
+const ExternalAuthPage: FC = () => {
+  const { provider } = useParams();
+  if (!provider) {
+    throw new Error("provider must exist");
+  }
+  const [searchParams] = useSearchParams();
+  const permissions = usePermissions();
+  const queryClient = useQueryClient();
+  const getExternalAuthProviderQuery = useQuery({
+    queryKey: ["externalauth", provider],
+    queryFn: () => getExternalAuthProvider(provider),
+    refetchOnWindowFocus: true,
+  });
+
+  const getExternalAuthDeviceQuery = useQuery({
+    enabled:
+      Boolean(!getExternalAuthProviderQuery.data?.authenticated) &&
+      Boolean(getExternalAuthProviderQuery.data?.device),
+    queryFn: () => getExternalAuthDevice(provider),
+    queryKey: ["externalauth", provider, "device"],
+    refetchOnMount: false,
+  });
+  const exchangeExternalAuthDeviceQuery = useQuery({
+    queryFn: () =>
+      exchangeExternalAuthDevice(provider, {
+        device_code: getExternalAuthDeviceQuery.data?.device_code || "",
+      }),
+    queryKey: [
+      "externalauth",
+      provider,
+      getExternalAuthDeviceQuery.data?.device_code,
+    ],
+    enabled: Boolean(getExternalAuthDeviceQuery.data),
+    onSuccess: () => {
+      // Force a refresh of the Git auth status.
+      queryClient.invalidateQueries(["externalauth", provider]).catch((ex) => {
+        console.error("invalidate queries", ex);
+      });
+    },
+    retry: true,
+    retryDelay: (getExternalAuthDeviceQuery.data?.interval || 5) * 1000,
+    refetchOnWindowFocus: (query) =>
+      query.state.status === "success" ? false : "always",
+  });
+
+  if (
+    getExternalAuthProviderQuery.isLoading ||
+    !getExternalAuthProviderQuery.data
+  ) {
+    return null;
+  }
+
+  let deviceExchangeError: ApiErrorResponse | undefined;
+  if (isAxiosError(exchangeExternalAuthDeviceQuery.failureReason)) {
+    deviceExchangeError =
+      exchangeExternalAuthDeviceQuery.failureReason.response?.data;
+  }
+
+  if (
+    !getExternalAuthProviderQuery.data.authenticated &&
+    !getExternalAuthProviderQuery.data.device
+  ) {
+    const redirectedParam = searchParams?.get("redirected");
+    if (redirectedParam && redirectedParam.toLowerCase() === "true") {
+      // The auth flow redirected the user here. If we redirect back to the
+      // callback, that resets the flow and we'll end up in an infinite loop.
+      // So instead, show an error, as the user expects to be authenticated at
+      // this point.
+      // TODO: Unsure what to do about the device auth flow, should we also
+      // show an error there?
+      return (
+        <SignInLayout>
+          <Welcome message="Failed to validate oauth access token" />
+          <Box textAlign="center">
+            Attempted to validate the user&apos;s oauth access token from the
+            authentication flow. This situation may occur as a result of an
+            external authentication provider misconfiguration. Verify the
+            external authentication validation URL is accurately configured.
+          </Box>
+          <br />
+          <Button
+            onClick={() => {
+              // Redirect to the auth flow again. *crosses fingers*
+              window.location.href = `/external-auth/${provider}/callback`;
+            }}
+          >
+            Retry
+          </Button>
+        </SignInLayout>
+      );
+    }
+    window.location.href = `/external-auth/${provider}/callback`;
+    return null;
+  }
+
+  return (
+    <ExternalAuthPageView
+      externalAuth={getExternalAuthProviderQuery.data}
+      onReauthenticate={() => {
+        queryClient.setQueryData(["externalauth", provider], {
+          ...getExternalAuthProviderQuery.data,
+          authenticated: false,
+        });
+      }}
+      viewExternalAuthConfig={permissions.viewExternalAuthConfig}
+      deviceExchangeError={deviceExchangeError}
+      externalAuthDevice={getExternalAuthDeviceQuery.data}
+    />
+  );
+};
+
+export default ExternalAuthPage;
diff --git a/site/src/pages/ExternalAuthPage/ExternalAuthPageView.stories.tsx b/site/src/pages/ExternalAuthPage/ExternalAuthPageView.stories.tsx
new file mode 100644
index 0000000000000..ad240241f9e09
--- /dev/null
+++ b/site/src/pages/ExternalAuthPage/ExternalAuthPageView.stories.tsx
@@ -0,0 +1,121 @@
+import { Meta, StoryFn } from "@storybook/react";
+import ExternalAuthPageView, {
+  ExternalAuthPageViewProps,
+} from "./ExternalAuthPageView";
+
+export default {
+  title: "pages/ExternalAuthPage",
+  component: ExternalAuthPageView,
+} as Meta<typeof ExternalAuthPageView>;
+
+const Template: StoryFn<ExternalAuthPageViewProps> = (args) => (
+  <ExternalAuthPageView {...args} />
+);
+
+export const WebAuthenticated = Template.bind({});
+WebAuthenticated.args = {
+  externalAuth: {
+    authenticated: true,
+    device: false,
+    installations: [],
+    app_install_url: "",
+    app_installable: false,
+    display_name: "BitBucket",
+    user: {
+      avatar_url: "",
+      login: "kylecarbs",
+      name: "Kyle Carberry",
+      profile_url: "",
+    },
+  },
+};
+
+export const DeviceUnauthenticated = Template.bind({});
+DeviceUnauthenticated.args = {
+  externalAuth: {
+    display_name: "GitHub",
+    authenticated: false,
+    device: true,
+    installations: [],
+    app_install_url: "",
+    app_installable: false,
+  },
+  externalAuthDevice: {
+    device_code: "1234-5678",
+    expires_in: 900,
+    interval: 5,
+    user_code: "ABCD-EFGH",
+    verification_uri: "",
+  },
+};
+
+export const DeviceUnauthenticatedError = Template.bind({});
+DeviceUnauthenticatedError.args = {
+  externalAuth: {
+    display_name: "GitHub",
+    authenticated: false,
+    device: true,
+    installations: [],
+    app_install_url: "",
+    app_installable: false,
+  },
+  externalAuthDevice: {
+    device_code: "1234-5678",
+    expires_in: 900,
+    interval: 5,
+    user_code: "ABCD-EFGH",
+    verification_uri: "",
+  },
+  deviceExchangeError: {
+    message: "Error exchanging device code.",
+    detail: "expired_token",
+  },
+};
+
+export const DeviceAuthenticatedNotInstalled = Template.bind({});
+DeviceAuthenticatedNotInstalled.args = {
+  viewExternalAuthConfig: true,
+  externalAuth: {
+    display_name: "GitHub",
+    authenticated: true,
+    device: true,
+    installations: [],
+    app_install_url: "https://example.com",
+    app_installable: true,
+    user: {
+      avatar_url: "",
+      login: "kylecarbs",
+      name: "Kyle Carberry",
+      profile_url: "",
+    },
+  },
+};
+
+export const DeviceAuthenticatedInstalled = Template.bind({});
+DeviceAuthenticatedInstalled.args = {
+  externalAuth: {
+    display_name: "GitHub",
+    authenticated: true,
+    device: true,
+    installations: [
+      {
+        configure_url: "https://example.com",
+        id: 1,
+        account: {
+          avatar_url: "https://github.com/coder.png",
+          login: "coder",
+          name: "Coder",
+          profile_url: "https://github.com/coder",
+        },
+      },
+    ],
+    app_install_url: "https://example.com",
+    app_installable: true,
+    user: {
+      avatar_url: "",
+      login: "kylecarbs",
+      name: "Kyle Carberry",
+      profile_url: "",
+    },
+  },
+};
diff --git a/site/src/pages/ExternalAuthPage/ExternalAuthPageView.tsx b/site/src/pages/ExternalAuthPage/ExternalAuthPageView.tsx
new file mode 100644
index 0000000000000..b6be702ced99d
--- /dev/null
+++ b/site/src/pages/ExternalAuthPage/ExternalAuthPageView.tsx
@@ -0,0 +1,272 @@
+import OpenInNewIcon from "@mui/icons-material/OpenInNew";
+import RefreshIcon from "@mui/icons-material/Refresh";
+import CircularProgress from "@mui/material/CircularProgress";
+import Link from "@mui/material/Link";
+import Tooltip from "@mui/material/Tooltip";
+import { makeStyles } from "@mui/styles";
+import { ApiErrorResponse } from "api/errors";
+import { ExternalAuth, ExternalAuthDevice } from "api/typesGenerated";
+import { Alert } from "components/Alert/Alert";
+import { Avatar } from "components/Avatar/Avatar";
+import { CopyButton } from "components/CopyButton/CopyButton";
+import { SignInLayout } from "components/SignInLayout/SignInLayout";
+import { Welcome } from "components/Welcome/Welcome";
+import { type FC } from "react";
+
+export interface ExternalAuthPageViewProps {
+  externalAuth: ExternalAuth;
+  viewExternalAuthConfig: boolean;
+
+  externalAuthDevice?: ExternalAuthDevice;
+  deviceExchangeError?: ApiErrorResponse;
+
+  onReauthenticate: () => void;
+}
+
+const ExternalAuthPageView: FC<ExternalAuthPageViewProps> = ({
+  deviceExchangeError,
+  externalAuth,
+  externalAuthDevice,
+  onReauthenticate,
+  viewExternalAuthConfig,
+}) => {
+  const styles = useStyles();
+
+  if (!externalAuth.authenticated) {
+    return (
+      <SignInLayout>
+        <Welcome message={`Authenticate with ${externalAuth.display_name}`} />
+
+        {externalAuth.device && (
+          <GitDeviceAuth
+            deviceExchangeError={deviceExchangeError}
+            externalAuthDevice={externalAuthDevice}
+          />
+        )}
+      </SignInLayout>
+    );
+  }
+
+  const hasInstallations = externalAuth.installations.length > 0;
+
+  // We only want to wrap this with a link if an install URL is available!
+  let installTheApp: React.ReactNode = `install the ${externalAuth.display_name} App`;
+  if (externalAuth.app_install_url) {
+    installTheApp = (
+      <Link
+        href={externalAuth.app_install_url}
+        target="_blank"
+        rel="noreferrer"
+      >
+        {installTheApp}
+      </Link>
+    );
+  }
+
+  return (
+    <SignInLayout>
+      <Welcome
+        message={`You've authenticated with ${externalAuth.display_name}!`}
+      />
+      <p className={styles.text}>
+        {externalAuth.user?.login && `Hey @${externalAuth.user?.login}! 👋 `}
+        {(!externalAuth.app_installable ||
+          externalAuth.installations.length > 0) &&
+          "You are now authenticated. Feel free to close this window!"}
+      </p>
+
+      {externalAuth.installations.length > 0 && (
+        <div className={styles.authorizedInstalls}>
+          {externalAuth.installations.map((install) => {
+            if (!install.account) {
+              return;
+            }
+            return (
+              <Tooltip key={install.id} title={install.account.login}>
+                <Link
+                  href={install.account.profile_url}
+                  target="_blank"
+                  rel="noreferrer"
+                >
+                  <Avatar
+                    size="sm"
+                    src={install.account.avatar_url}
+                    colorScheme="darken"
+                  >
+                    {install.account.login}
+                  </Avatar>
+                </Link>
+              </Tooltip>
+            );
+          })}
+          &nbsp;
+          {externalAuth.installations.length} organization
+          {externalAuth.installations.length !== 1 && "s are"} authorized
+        </div>
+      )}
+
+      <div className={styles.links}>
+        {!hasInstallations && externalAuth.app_installable && (
+          <Alert severity="warning" className={styles.installAlert}>
+            You must {installTheApp} to clone private repositories. Accounts
+            will appear here once authorized.
+          </Alert>
+        )}
+
+        {viewExternalAuthConfig &&
+          externalAuth.app_install_url &&
+          externalAuth.app_installable && (
+            <Link
+              href={externalAuth.app_install_url}
+              target="_blank"
+              rel="noreferrer"
+              className={styles.link}
+            >
+              <OpenInNewIcon fontSize="small" />
+              {externalAuth.installations.length > 0
+                ? "Configure"
+                : "Install"}{" "}
+              the {externalAuth.display_name} App
+            </Link>
+          )}
+        <Link
+          className={styles.link}
+          href="#"
+          onClick={() => {
+            onReauthenticate();
+          }}
+        >
+          <RefreshIcon /> Reauthenticate
+        </Link>
+      </div>
+    </SignInLayout>
+  );
+};
+
+const GitDeviceAuth: FC<{
+  externalAuthDevice?: ExternalAuthDevice;
+  deviceExchangeError?: ApiErrorResponse;
+}> = ({ externalAuthDevice, deviceExchangeError }) => {
+  const styles = useStyles();
+
+  let status = (
+    <p className={styles.status}>
+      <CircularProgress size={16} color="secondary" data-chromatic="ignore" />
+      Checking for authentication...
+    </p>
+  );
+  if (deviceExchangeError) {
+    // See https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+    switch (deviceExchangeError.detail) {
+      case "authorization_pending":
+        break;
+      case "expired_token":
+        status = (
+          <Alert severity="error">
+            The one-time code has expired. Refresh to get a new one!
+          </Alert>
+        );
+        break;
+      case "access_denied":
+        status = (
+          <Alert severity="error">Access to the Git provider was denied.</Alert>
+        );
+        break;
+      default:
+        status = (
+          <Alert severity="error">
+            An unknown error occurred. Please try again:{" "}
+            {deviceExchangeError.message}
+          </Alert>
+        );
+        break;
+    }
+  }
+
+  if (!externalAuthDevice) {
+    return <CircularProgress />;
+  }
+
+  return (
+    <div>
+      <p className={styles.text}>
+        Copy your one-time code:&nbsp;
+        <div className={styles.copyCode}>
+          <span className={styles.code}>{externalAuthDevice.user_code}</span>
+          &nbsp; <CopyButton text={externalAuthDevice.user_code} />
+        </div>
+        <br />
+        Then open the link below and paste it:
+      </p>
+      <div className={styles.links}>
+        <Link
+          className={styles.link}
+          href={externalAuthDevice.verification_uri}
+          target="_blank"
+          rel="noreferrer"
+        >
+          <OpenInNewIcon fontSize="small" />
+          Open and Paste
+        </Link>
+      </div>
+
+      {status}
+    </div>
+  );
+};
+
+export default ExternalAuthPageView;
+
+const useStyles = makeStyles((theme) => ({
+  text: {
+    fontSize: 16,
+    color: theme.palette.text.secondary,
+    textAlign: "center",
+    lineHeight: "160%",
+    margin: 0,
+  },
+
+  copyCode: {
+    display: "inline-flex",
+    alignItems: "center",
+  },
+
+  code: {
+    fontWeight: "bold",
+    color: theme.palette.text.primary,
+  },
+
+  installAlert: {
+    margin: theme.spacing(2),
+  },
+
+  links: {
+    display: "flex",
+    gap: theme.spacing(0.5),
+    margin: theme.spacing(2),
+    flexDirection: "column",
+  },
+
+  link: {
+    display: "flex",
+    alignItems: "center",
+    justifyContent: "center",
+    fontSize: 16,
+    gap: theme.spacing(1),
+  },
+
+  status: {
+    display: "flex",
+    alignItems: "center",
+    justifyContent: "center",
+    gap: theme.spacing(1),
+    color: theme.palette.text.disabled,
+  },
+
+  authorizedInstalls: {
+    display: "flex",
+    gap: 4,
+    color: theme.palette.text.disabled,
+    margin: theme.spacing(4),
+  },
+}));
diff --git a/site/src/pages/GitAuthPage/GitAuthPage.tsx b/site/src/pages/GitAuthPage/GitAuthPage.tsx
deleted file mode 100644
index efe62ad6a9f25..0000000000000
--- a/site/src/pages/GitAuthPage/GitAuthPage.tsx
+++ /dev/null
@@ -1,101 +0,0 @@
-import { useQuery, useQueryClient } from "@tanstack/react-query"
-import {
-  exchangeGitAuthDevice,
-  getGitAuthDevice,
-  getGitAuthProvider,
-} from "api/api"
-import { usePermissions } from "hooks"
-import { FC, useEffect } from "react"
-import { useParams } from "react-router-dom"
-import GitAuthPageView from "./GitAuthPageView"
-import { ApiErrorResponse } from "api/errors"
-import { isAxiosError } from "axios"
-import { REFRESH_GITAUTH_BROADCAST_CHANNEL } from "utils/gitAuth"
-
-const GitAuthPage: FC = () => {
-  const { provider } = useParams()
-  if (!provider) {
-    throw new Error("provider must exist")
-  }
-  const permissions = usePermissions()
-  const queryClient = useQueryClient()
-  const getGitAuthProviderQuery = useQuery({
-    queryKey: ["gitauth", provider],
-    queryFn: () => getGitAuthProvider(provider),
-    refetchOnWindowFocus: true,
-  })
-
-  const getGitAuthDeviceQuery = useQuery({
-    enabled:
-      Boolean(!getGitAuthProviderQuery.data?.authenticated) &&
-      Boolean(getGitAuthProviderQuery.data?.device),
-    queryFn: () => getGitAuthDevice(provider),
-    queryKey: ["gitauth", provider, "device"],
-    refetchOnMount: false,
-  })
-  const exchangeGitAuthDeviceQuery = useQuery({
-    queryFn: () =>
-      exchangeGitAuthDevice(provider, {
-        device_code: getGitAuthDeviceQuery.data?.device_code || "",
-      }),
-    queryKey: ["gitauth", provider, getGitAuthDeviceQuery.data?.device_code],
-    enabled: Boolean(getGitAuthDeviceQuery.data),
-    onSuccess: () => {
-      // Force a refresh of the Git auth status.
-      queryClient.invalidateQueries(["gitauth", provider]).catch((ex) => {
-        console.error("invalidate queries", ex)
-      })
-    },
-    retry: true,
-    retryDelay: (getGitAuthDeviceQuery.data?.interval || 5) * 1000,
-    refetchOnWindowFocus: (query) =>
-      query.state.status === "success" ? false : "always",
-  })
-
-  useEffect(() => {
-    if (!getGitAuthProviderQuery.data?.authenticated) {
-      return
-    }
-    // This is used to notify the parent window that the Git auth token has been refreshed.
-    // It's critical in the create workspace flow!
-    const bc = new BroadcastChannel(REFRESH_GITAUTH_BROADCAST_CHANNEL)
-    // The message doesn't matter, any message refreshes the page!
-    bc.postMessage("noop")
-  }, [getGitAuthProviderQuery.data?.authenticated])
-
-  if (getGitAuthProviderQuery.isLoading || !getGitAuthProviderQuery.data) {
-    return null
-  }
-
-  let deviceExchangeError: ApiErrorResponse | undefined
-  if (isAxiosError(exchangeGitAuthDeviceQuery.failureReason)) {
-    deviceExchangeError =
-      exchangeGitAuthDeviceQuery.failureReason.response?.data
-  }
-
-  if (
-    !getGitAuthProviderQuery.data.authenticated &&
-    !getGitAuthProviderQuery.data.device
-  ) {
-    window.location.href = `/gitauth/${provider}/callback`
-
-    return null
-  }
-
-  return (
-    <GitAuthPageView
-      gitAuth={getGitAuthProviderQuery.data}
-      onReauthenticate={() => {
-        queryClient.setQueryData(["gitauth", provider], {
-          ...getGitAuthProviderQuery.data,
-          authenticated: false,
-        })
-      }}
-      viewGitAuthConfig={permissions.viewGitAuthConfig}
-      deviceExchangeError={deviceExchangeError}
-      gitAuthDevice={getGitAuthDeviceQuery.data}
-    />
-  )
-}
-
-export default GitAuthPage
diff --git a/site/src/pages/GitAuthPage/GitAuthPageView.stories.tsx b/site/src/pages/GitAuthPage/GitAuthPageView.stories.tsx
deleted file mode 100644
index 4f0a9dc45be6c..0000000000000
--- a/site/src/pages/GitAuthPage/GitAuthPageView.stories.tsx
+++ /dev/null
@@ -1,119 +0,0 @@
-import { Meta, StoryFn } from "@storybook/react"
-import GitAuthPageView, { GitAuthPageViewProps } from "./GitAuthPageView"
-
-export default {
-  title: "pages/GitAuthPageView",
-  component: GitAuthPageView,
-} as Meta<typeof GitAuthPageView>
-
-const Template: StoryFn<GitAuthPageViewProps> = (args) => (
-  <GitAuthPageView {...args} />
-)
-
-export const WebAuthenticated = Template.bind({})
-WebAuthenticated.args = {
-  gitAuth: {
-    type: "BitBucket",
-    authenticated: true,
-    device: false,
-    installations: [],
-    app_install_url: "",
-    app_installable: false,
-    user: {
-      avatar_url: "",
-      login: "kylecarbs",
-      name: "Kyle Carberry",
-      profile_url: "",
-    },
-  },
-}
-
-export const DeviceUnauthenticated = Template.bind({})
-DeviceUnauthenticated.args = {
-  gitAuth: {
-    type: "GitHub",
-    authenticated: false,
-    device: true,
-    installations: [],
-    app_install_url: "",
-    app_installable: false,
-  },
-  gitAuthDevice: {
-    device_code: "1234-5678",
-    expires_in: 900,
-    interval: 5,
-    user_code: "ABCD-EFGH",
-    verification_uri: "",
-  },
-}
-
-export const DeviceUnauthenticatedError = Template.bind({})
-DeviceUnauthenticatedError.args = {
-  gitAuth: {
-    type: "GitHub",
-    authenticated: false,
-    device: true,
-    installations: [],
-    app_install_url: "",
-    app_installable: false,
-  },
-  gitAuthDevice: {
-    device_code: "1234-5678",
-    expires_in: 900,
-    interval: 5,
-    user_code: "ABCD-EFGH",
-    verification_uri: "",
-  },
-  deviceExchangeError: {
-    message: "Error exchanging device code.",
-    detail: "expired_token",
-  },
-}
-
-export const DeviceAuthenticatedNotInstalled = Template.bind({})
-DeviceAuthenticatedNotInstalled.args = {
-  viewGitAuthConfig: true,
-  gitAuth: {
-    type: "GitHub",
-    authenticated: true,
-    device: true,
-    installations: [],
-    app_install_url: "https://example.com",
-    app_installable: true,
-    user: {
-      avatar_url: "",
-      login: "kylecarbs",
-      name: "Kyle Carberry",
-      profile_url: "",
-    },
-  },
-}
-
-export const DeviceAuthenticatedInstalled = Template.bind({})
-DeviceAuthenticatedInstalled.args = {
-  gitAuth: {
-    type: "GitHub",
-    authenticated: true,
-    device: true,
-    installations: [
-      {
-        configure_url: "https://example.com",
-        id: 1,
-        account: {
-          avatar_url: "https://github.com/coder.png",
-          login: "coder",
-          name: "Coder",
-          profile_url: "https://github.com/coder",
-        },
-      },
-    ],
-    app_install_url: "https://example.com",
-    app_installable: true,
-    user: {
-      avatar_url: "",
-      login: "kylecarbs",
-      name: "Kyle Carberry",
-      profile_url: "",
-    },
-  },
-}
diff --git a/site/src/pages/GitAuthPage/GitAuthPageView.tsx b/site/src/pages/GitAuthPage/GitAuthPageView.tsx
deleted file mode 100644
index ce46539ac366a..0000000000000
--- a/site/src/pages/GitAuthPage/GitAuthPageView.tsx
+++ /dev/null
@@ -1,277 +0,0 @@
-import OpenInNewIcon from "@mui/icons-material/OpenInNew"
-import RefreshIcon from "@mui/icons-material/Refresh"
-import CircularProgress from "@mui/material/CircularProgress"
-import Link from "@mui/material/Link"
-import Tooltip from "@mui/material/Tooltip"
-import { makeStyles } from "@mui/styles"
-import { ApiErrorResponse } from "api/errors"
-import { GitAuth, GitAuthDevice } from "api/typesGenerated"
-import { Alert } from "components/Alert/Alert"
-import { Avatar } from "components/Avatar/Avatar"
-import { CopyButton } from "components/CopyButton/CopyButton"
-import { SignInLayout } from "components/SignInLayout/SignInLayout"
-import { Welcome } from "components/Welcome/Welcome"
-import { FC, useEffect } from "react"
-import { REFRESH_GITAUTH_BROADCAST_CHANNEL } from "utils/gitAuth"
-
-export interface GitAuthPageViewProps {
-  gitAuth: GitAuth
-  viewGitAuthConfig: boolean
-
-  gitAuthDevice?: GitAuthDevice
-  deviceExchangeError?: ApiErrorResponse
-
-  onReauthenticate: () => void
-}
-
-const GitAuthPageView: FC<GitAuthPageViewProps> = ({
-  deviceExchangeError,
-  gitAuth,
-  gitAuthDevice,
-  onReauthenticate,
-  viewGitAuthConfig,
-}) => {
-  const styles = useStyles()
-
-  useEffect(() => {
-    if (!gitAuth.authenticated) {
-      return
-    }
-    // This is used to notify the parent window that the Git auth token has been refreshed.
-    // It's critical in the create workspace flow!
-    // eslint-disable-next-line compat/compat -- It actually is supported... not sure why it's complaining.
-    const bc = new BroadcastChannel(REFRESH_GITAUTH_BROADCAST_CHANNEL)
-    // The message doesn't matter, any message refreshes the page!
-    bc.postMessage("noop")
-  }, [gitAuth.authenticated])
-
-  if (!gitAuth.authenticated) {
-    return (
-      <SignInLayout>
-        <Welcome message={`Authenticate with ${gitAuth.type}`} />
-
-        {gitAuth.device && (
-          <GitDeviceAuth
-            deviceExchangeError={deviceExchangeError}
-            gitAuthDevice={gitAuthDevice}
-          />
-        )}
-      </SignInLayout>
-    )
-  }
-
-  const hasInstallations = gitAuth.installations.length > 0
-
-  // We only want to wrap this with a link if an install URL is available!
-  let installTheApp: JSX.Element = <>{`install the ${gitAuth.type} App`}</>
-  if (gitAuth.app_install_url) {
-    installTheApp = (
-      <Link href={gitAuth.app_install_url} target="_blank" rel="noreferrer">
-        {installTheApp}
-      </Link>
-    )
-  }
-
-  return (
-    <SignInLayout>
-      <Welcome message={`You've authenticated with ${gitAuth.type}!`} />
-      <p className={styles.text}>
-        Hey @{gitAuth.user?.login} 👋!{" "}
-        {(!gitAuth.app_installable || gitAuth.installations.length > 0) &&
-          "You are now authenticated with Git. Feel free to close this window!"}
-      </p>
-
-      {gitAuth.installations.length > 0 && (
-        <div className={styles.authorizedInstalls}>
-          {gitAuth.installations.map((install) => {
-            if (!install.account) {
-              return
-            }
-            return (
-              <Tooltip key={install.id} title={install.account.login}>
-                <Link
-                  href={install.account.profile_url}
-                  target="_blank"
-                  rel="noreferrer"
-                >
-                  <Avatar
-                    size="sm"
-                    src={install.account.avatar_url}
-                    colorScheme="darken"
-                  >
-                    {install.account.login}
-                  </Avatar>
-                </Link>
-              </Tooltip>
-            )
-          })}
-          &nbsp;
-          {gitAuth.installations.length} organization
-          {gitAuth.installations.length !== 1 && "s are"} authorized
-        </div>
-      )}
-
-      <div className={styles.links}>
-        {!hasInstallations && gitAuth.app_installable && (
-          <Alert severity="warning" className={styles.installAlert}>
-            You must {installTheApp} to clone private repositories. Accounts
-            will appear here once authorized.
-          </Alert>
-        )}
-
-        {viewGitAuthConfig &&
-          gitAuth.app_install_url &&
-          gitAuth.app_installable && (
-            <Link
-              href={gitAuth.app_install_url}
-              target="_blank"
-              rel="noreferrer"
-              className={styles.link}
-            >
-              <OpenInNewIcon fontSize="small" />
-              {gitAuth.installations.length > 0
-                ? "Configure"
-                : "Install"} the {gitAuth.type} App
-            </Link>
-          )}
-        <Link
-          className={styles.link}
-          href="#"
-          onClick={() => {
-            onReauthenticate()
-          }}
-        >
-          <RefreshIcon /> Reauthenticate
-        </Link>
-      </div>
-    </SignInLayout>
-  )
-}
-
-const GitDeviceAuth: FC<{
-  gitAuthDevice?: GitAuthDevice
-  deviceExchangeError?: ApiErrorResponse
-}> = ({ gitAuthDevice, deviceExchangeError }) => {
-  const styles = useStyles()
-
-  let status = (
-    <p className={styles.status}>
-      <CircularProgress size={16} color="secondary" data-chromatic="ignore" />
-      Checking for authentication...
-    </p>
-  )
-  if (deviceExchangeError) {
-    // See https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
-    switch (deviceExchangeError.detail) {
-      case "authorization_pending":
-        break
-      case "expired_token":
-        status = (
-          <Alert severity="error">
-            The one-time code has expired. Refresh to get a new one!
-          </Alert>
-        )
-        break
-      case "access_denied":
-        status = (
-          <Alert severity="error">Access to the Git provider was denied.</Alert>
-        )
-        break
-      default:
-        status = (
-          <Alert severity="error">
-            An unknown error occurred. Please try again:{" "}
-            {deviceExchangeError.message}
-          </Alert>
-        )
-        break
-    }
-  }
-
-  if (!gitAuthDevice) {
-    return <CircularProgress />
-  }
-
-  return (
-    <div>
-      <p className={styles.text}>
-        Copy your one-time code:&nbsp;
-        <div className={styles.copyCode}>
-          <span className={styles.code}>{gitAuthDevice.user_code}</span>&nbsp;{" "}
-          <CopyButton text={gitAuthDevice.user_code} />
-        </div>
-        <br />
-        Then open the link below and paste it:
-      </p>
-      <div className={styles.links}>
-        <Link
-          className={styles.link}
-          href={gitAuthDevice.verification_uri}
-          target="_blank"
-          rel="noreferrer"
-        >
-          <OpenInNewIcon fontSize="small" />
-          Open and Paste
-        </Link>
-      </div>
-
-      {status}
-    </div>
-  )
-}
-
-export default GitAuthPageView
-
-const useStyles = makeStyles((theme) => ({
-  text: {
-    fontSize: 16,
-    color: theme.palette.text.secondary,
-    textAlign: "center",
-    lineHeight: "160%",
-    margin: 0,
-  },
-
-  copyCode: {
-    display: "inline-flex",
-    alignItems: "center",
-  },
-
-  code: {
-    fontWeight: "bold",
-    color: theme.palette.text.primary,
-  },
-
-  installAlert: {
-    margin: theme.spacing(2),
-  },
-
-  links: {
-    display: "flex",
-    gap: theme.spacing(0.5),
-    margin: theme.spacing(2),
-    flexDirection: "column",
-  },
-
-  link: {
-    display: "flex",
-    alignItems: "center",
-    justifyContent: "center",
-    fontSize: 16,
-    gap: theme.spacing(1),
-  },
-
-  status: {
-    display: "flex",
-    alignItems: "center",
-    justifyContent: "center",
-    gap: theme.spacing(1),
-    color: theme.palette.text.disabled,
-  },
-
-  authorizedInstalls: {
-    display: "flex",
-    gap: 4,
-    color: theme.palette.text.disabled,
-    margin: theme.spacing(4),
-  },
-}))
diff --git a/site/src/pages/GroupsPage/CreateGroupPage.tsx b/site/src/pages/GroupsPage/CreateGroupPage.tsx
index 78ec70b68b21e..a41342331e3f6 100644
--- a/site/src/pages/GroupsPage/CreateGroupPage.tsx
+++ b/site/src/pages/GroupsPage/CreateGroupPage.tsx
@@ -1,26 +1,17 @@
-import { useMachine } from "@xstate/react"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useNavigate } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import { createGroupMachine } from "xServices/groups/createGroupXService"
-import CreateGroupPageView from "./CreateGroupPageView"
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { useNavigate } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import CreateGroupPageView from "./CreateGroupPageView";
+import { useMutation, useQueryClient } from "react-query";
+import { createGroup } from "api/queries/groups";
 
 export const CreateGroupPage: FC = () => {
-  const navigate = useNavigate()
-  const organizationId = useOrganizationId()
-  const [createState, sendCreateEvent] = useMachine(createGroupMachine, {
-    context: {
-      organizationId,
-    },
-    actions: {
-      onCreate: (_, { data }) => {
-        navigate(`/groups/${data.id}`)
-      },
-    },
-  })
-  const { error } = createState.context
+  const queryClient = useQueryClient();
+  const navigate = useNavigate();
+  const organizationId = useOrganizationId();
+  const createGroupMutation = useMutation(createGroup(queryClient));
 
   return (
     <>
@@ -28,16 +19,17 @@ export const CreateGroupPage: FC = () => {
         <title>{pageTitle("Create Group")}</title>
       </Helmet>
       <CreateGroupPageView
-        onSubmit={(data) => {
-          sendCreateEvent({
-            type: "CREATE",
-            data,
-          })
+        onSubmit={async (data) => {
+          const newGroup = await createGroupMutation.mutateAsync({
+            organizationId,
+            ...data,
+          });
+          navigate(`/groups/${newGroup.id}`);
         }}
-        formErrors={error}
-        isLoading={createState.matches("creatingGroup")}
+        formErrors={createGroupMutation.error}
+        isLoading={createGroupMutation.isLoading}
       />
     </>
-  )
-}
-export default CreateGroupPage
+  );
+};
+export default CreateGroupPage;
diff --git a/site/src/pages/GroupsPage/CreateGroupPageView.stories.tsx b/site/src/pages/GroupsPage/CreateGroupPageView.stories.tsx
index b728a2c54540f..2aeb293ba7f2e 100644
--- a/site/src/pages/GroupsPage/CreateGroupPageView.stories.tsx
+++ b/site/src/pages/GroupsPage/CreateGroupPageView.stories.tsx
@@ -1,17 +1,14 @@
-import { Story } from "@storybook/react"
-import {
-  CreateGroupPageView,
-  CreateGroupPageViewProps,
-} from "./CreateGroupPageView"
+import { CreateGroupPageView } from "./CreateGroupPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/CreateGroupPageView",
+const meta: Meta<typeof CreateGroupPageView> = {
+  title: "pages/GroupsPage/CreateGroupPageView",
   component: CreateGroupPageView,
-}
+};
 
-const Template: Story<CreateGroupPageViewProps> = (
-  args: CreateGroupPageViewProps,
-) => <CreateGroupPageView {...args} />
+export default meta;
+type Story = StoryObj<typeof CreateGroupPageView>;
 
-export const Example = Template.bind({})
-Example.args = {}
+const Example: Story = {};
+
+export { Example as CreateGroupPageView };
diff --git a/site/src/pages/GroupsPage/CreateGroupPageView.tsx b/site/src/pages/GroupsPage/CreateGroupPageView.tsx
index a2936a5924ae3..20e6d5c813aae 100644
--- a/site/src/pages/GroupsPage/CreateGroupPageView.tsx
+++ b/site/src/pages/GroupsPage/CreateGroupPageView.tsx
@@ -1,31 +1,35 @@
-import TextField from "@mui/material/TextField"
-import { CreateGroupRequest } from "api/typesGenerated"
-import { FormFooter } from "components/FormFooter/FormFooter"
-import { FullPageForm } from "components/FullPageForm/FullPageForm"
-import { Margins } from "components/Margins/Margins"
-import { Stack } from "components/Stack/Stack"
-import { useFormik } from "formik"
-import { FC } from "react"
-import { useNavigate } from "react-router-dom"
-import { getFormHelpers, nameValidator, onChangeTrimmed } from "utils/formUtils"
-import * as Yup from "yup"
+import TextField from "@mui/material/TextField";
+import { CreateGroupRequest } from "api/typesGenerated";
+import { FormFooter } from "components/FormFooter/FormFooter";
+import { FullPageForm } from "components/FullPageForm/FullPageForm";
+import { Margins } from "components/Margins/Margins";
+import { Stack } from "components/Stack/Stack";
+import { useFormik } from "formik";
+import { FC } from "react";
+import { useNavigate } from "react-router-dom";
+import {
+  getFormHelpers,
+  nameValidator,
+  onChangeTrimmed,
+} from "utils/formUtils";
+import * as Yup from "yup";
 
 const validationSchema = Yup.object({
   name: nameValidator("Name"),
-})
+});
 
 export type CreateGroupPageViewProps = {
-  onSubmit: (data: CreateGroupRequest) => void
-  formErrors?: unknown
-  isLoading: boolean
-}
+  onSubmit: (data: CreateGroupRequest) => void;
+  formErrors?: unknown;
+  isLoading: boolean;
+};
 
 export const CreateGroupPageView: FC<CreateGroupPageViewProps> = ({
   onSubmit,
   formErrors,
   isLoading,
 }) => {
-  const navigate = useNavigate()
+  const navigate = useNavigate();
   const form = useFormik<CreateGroupRequest>({
     initialValues: {
       name: "",
@@ -35,9 +39,9 @@ export const CreateGroupPageView: FC<CreateGroupPageViewProps> = ({
     },
     validationSchema,
     onSubmit,
-  })
-  const getFieldHelpers = getFormHelpers<CreateGroupRequest>(form, formErrors)
-  const onCancel = () => navigate("/groups")
+  });
+  const getFieldHelpers = getFormHelpers<CreateGroupRequest>(form, formErrors);
+  const onCancel = () => navigate("/groups");
 
   return (
     <Margins>
@@ -57,7 +61,6 @@ export const CreateGroupPageView: FC<CreateGroupPageViewProps> = ({
                 "display_name",
                 "Optional: keep empty to default to the name.",
               )}
-              onChange={onChangeTrimmed(form)}
               autoComplete="display_name"
               autoFocus
               fullWidth
@@ -75,6 +78,6 @@ export const CreateGroupPageView: FC<CreateGroupPageViewProps> = ({
         </form>
       </FullPageForm>
     </Margins>
-  )
-}
-export default CreateGroupPageView
+  );
+};
+export default CreateGroupPageView;
diff --git a/site/src/pages/GroupsPage/GroupPage.tsx b/site/src/pages/GroupsPage/GroupPage.tsx
index 13bec3399bcb8..e4113dc0d4b68 100644
--- a/site/src/pages/GroupsPage/GroupPage.tsx
+++ b/site/src/pages/GroupsPage/GroupPage.tsx
@@ -1,58 +1,231 @@
-import Button from "@mui/material/Button"
-import Link from "@mui/material/Link"
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableHead from "@mui/material/TableHead"
-import TableRow from "@mui/material/TableRow"
-import DeleteOutline from "@mui/icons-material/DeleteOutline"
-import PersonAdd from "@mui/icons-material/PersonAdd"
-import SettingsOutlined from "@mui/icons-material/SettingsOutlined"
-import { useMachine } from "@xstate/react"
-import { User } from "api/typesGenerated"
-import { AvatarData } from "components/AvatarData/AvatarData"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { DeleteDialog } from "components/Dialogs/DeleteDialog/DeleteDialog"
-import { EmptyState } from "components/EmptyState/EmptyState"
-import { Loader } from "components/Loader/Loader"
-import { LoadingButton } from "components/LoadingButton/LoadingButton"
-import { Margins } from "components/Margins/Margins"
+import Button from "@mui/material/Button";
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableHead from "@mui/material/TableHead";
+import TableRow from "@mui/material/TableRow";
+import DeleteOutline from "@mui/icons-material/DeleteOutline";
+import PersonAdd from "@mui/icons-material/PersonAdd";
+import SettingsOutlined from "@mui/icons-material/SettingsOutlined";
+import { Group, User } from "api/typesGenerated";
+import { AvatarData } from "components/AvatarData/AvatarData";
+import { DeleteDialog } from "components/Dialogs/DeleteDialog/DeleteDialog";
+import { EmptyState } from "components/EmptyState/EmptyState";
+import { Loader } from "components/Loader/Loader";
+import { Margins } from "components/Margins/Margins";
 import {
   PageHeader,
   PageHeaderSubtitle,
   PageHeaderTitle,
-} from "components/PageHeader/PageHeader"
-import { Stack } from "components/Stack/Stack"
-import { TableRowMenu } from "components/TableRowMenu/TableRowMenu"
-import { UserAutocomplete } from "components/UserAutocomplete/UserAutocomplete"
-import { useState } from "react"
-import { Helmet } from "react-helmet-async"
-import { Link as RouterLink, useNavigate, useParams } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import { groupMachine } from "xServices/groups/groupXService"
-import { Maybe } from "components/Conditionals/Maybe"
-import { makeStyles } from "@mui/styles"
-import { PaginationStatus } from "components/PaginationStatus/PaginationStatus"
+} from "components/PageHeader/PageHeader";
+import { Stack } from "components/Stack/Stack";
+import { TableRowMenu } from "components/TableRowMenu/TableRowMenu";
+import { UserAutocomplete } from "components/UserAutocomplete/UserAutocomplete";
+import { type FC, useState } from "react";
+import { Helmet } from "react-helmet-async";
+import { Link as RouterLink, useNavigate, useParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import { makeStyles } from "@mui/styles";
+import {
+  PaginationStatus,
+  TableToolbar,
+} from "components/TableToolbar/TableToolbar";
+import { UserAvatar } from "components/UserAvatar/UserAvatar";
+import { isEveryoneGroup } from "utils/groups";
+import { useMutation, useQuery, useQueryClient } from "react-query";
+import {
+  addMember,
+  deleteGroup,
+  group,
+  groupPermissions,
+  removeMember,
+} from "api/queries/groups";
+import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
+import { getErrorMessage } from "api/errors";
+import Box from "@mui/material/Box";
+import { LastSeen } from "components/LastSeen/LastSeen";
+import { type Interpolation, type Theme } from "@emotion/react";
+import LoadingButton from "@mui/lab/LoadingButton";
+
+export const GroupPage: FC = () => {
+  const { groupId } = useParams() as { groupId: string };
+  const queryClient = useQueryClient();
+  const navigate = useNavigate();
+  const groupQuery = useQuery(group(groupId));
+  const groupData = groupQuery.data;
+  const { data: permissions } = useQuery(groupPermissions(groupId));
+  const addMemberMutation = useMutation(addMember(queryClient));
+  const deleteGroupMutation = useMutation(deleteGroup(queryClient));
+  const [isDeletingGroup, setIsDeletingGroup] = useState(false);
+  const isLoading = !groupData || !permissions;
+  const canUpdateGroup = permissions ? permissions.canUpdateGroup : false;
+  const styles = useStyles();
+
+  const helmet = (
+    <Helmet>
+      <title>
+        {pageTitle(
+          (groupData?.display_name || groupData?.name) ?? "Loading...",
+        )}
+      </title>
+    </Helmet>
+  );
+
+  if (isLoading) {
+    return (
+      <>
+        {helmet}
+        <Loader />
+      </>
+    );
+  }
+
+  return (
+    <>
+      {helmet}
+
+      <Margins>
+        <PageHeader
+          actions={
+            canUpdateGroup && (
+              <>
+                <Button
+                  startIcon={<SettingsOutlined />}
+                  to="settings"
+                  component={RouterLink}
+                >
+                  Settings
+                </Button>
+                <Button
+                  disabled={groupData?.id === groupData?.organization_id}
+                  onClick={() => {
+                    setIsDeletingGroup(true);
+                  }}
+                  startIcon={<DeleteOutline />}
+                  className={styles.removeButton}
+                >
+                  Delete&hellip;
+                </Button>
+              </>
+            )
+          }
+        >
+          <PageHeaderTitle>
+            {groupData?.display_name || groupData?.name}
+          </PageHeaderTitle>
+          <PageHeaderSubtitle>
+            {/* Show the name if it differs from the display name. */}
+            {groupData?.display_name &&
+            groupData?.display_name !== groupData?.name
+              ? groupData?.name
+              : ""}{" "}
+          </PageHeaderSubtitle>
+        </PageHeader>
+
+        <Stack spacing={1}>
+          {canUpdateGroup && groupData && !isEveryoneGroup(groupData) && (
+            <AddGroupMember
+              isLoading={addMemberMutation.isLoading}
+              onSubmit={async (user, reset) => {
+                try {
+                  await addMemberMutation.mutateAsync({
+                    groupId,
+                    userId: user.id,
+                  });
+                  reset();
+                } catch (error) {
+                  displayError(getErrorMessage(error, "Failed to add member."));
+                }
+              }}
+            />
+          )}
+          <TableToolbar>
+            <PaginationStatus
+              isLoading={Boolean(isLoading)}
+              showing={groupData?.members.length ?? 0}
+              total={groupData?.members.length ?? 0}
+              label="members"
+            />
+          </TableToolbar>
+
+          <TableContainer>
+            <Table>
+              <TableHead>
+                <TableRow>
+                  <TableCell width="59%">User</TableCell>
+                  <TableCell width="40">Status</TableCell>
+                  <TableCell width="1%"></TableCell>
+                </TableRow>
+              </TableHead>
+
+              <TableBody>
+                {groupData?.members.length === 0 ? (
+                  <TableRow>
+                    <TableCell colSpan={999}>
+                      <EmptyState
+                        message="No members yet"
+                        description="Add a member using the controls above"
+                      />
+                    </TableCell>
+                  </TableRow>
+                ) : (
+                  groupData?.members.map((member) => (
+                    <GroupMemberRow
+                      member={member}
+                      group={groupData}
+                      key={member.id}
+                      canUpdate={canUpdateGroup}
+                    />
+                  ))
+                )}
+              </TableBody>
+            </Table>
+          </TableContainer>
+        </Stack>
+      </Margins>
+
+      {groupQuery.data && (
+        <DeleteDialog
+          isOpen={isDeletingGroup}
+          confirmLoading={deleteGroupMutation.isLoading}
+          name={groupQuery.data.name}
+          entity="group"
+          onConfirm={async () => {
+            try {
+              await deleteGroupMutation.mutateAsync(groupId);
+              navigate("/groups");
+            } catch (error) {
+              displayError(getErrorMessage(error, "Failed to delete group."));
+            }
+          }}
+          onCancel={() => {
+            setIsDeletingGroup(false);
+          }}
+        />
+      )}
+    </>
+  );
+};
 
 const AddGroupMember: React.FC<{
-  isLoading: boolean
-  onSubmit: (user: User, reset: () => void) => void
+  isLoading: boolean;
+  onSubmit: (user: User, reset: () => void) => void;
 }> = ({ isLoading, onSubmit }) => {
-  const [selectedUser, setSelectedUser] = useState<User | null>(null)
-  const styles = useStyles()
+  const [selectedUser, setSelectedUser] = useState<User | null>(null);
+  const styles = useStyles();
 
   const resetValues = () => {
-    setSelectedUser(null)
-  }
+    setSelectedUser(null);
+  };
 
   return (
     <form
       onSubmit={(e) => {
-        e.preventDefault()
+        e.preventDefault();
 
         if (selectedUser) {
-          onSubmit(selectedUser, resetValues)
+          onSubmit(selectedUser, resetValues);
         }
       }}
     >
@@ -61,11 +234,12 @@ const AddGroupMember: React.FC<{
           className={styles.autoComplete}
           value={selectedUser}
           onChange={(newValue) => {
-            setSelectedUser(newValue)
+            setSelectedUser(newValue);
           }}
         />
 
         <LoadingButton
+          loadingPosition="start"
           disabled={!selectedUser}
           type="submit"
           startIcon={<PersonAdd />}
@@ -75,176 +249,88 @@ const AddGroupMember: React.FC<{
         </LoadingButton>
       </Stack>
     </form>
-  )
-}
+  );
+};
 
-export const GroupPage: React.FC = () => {
-  const { groupId } = useParams()
-  if (!groupId) {
-    throw new Error("groupId is not defined.")
-  }
-
-  const navigate = useNavigate()
-  const [state, send] = useMachine(groupMachine, {
-    context: {
-      groupId,
-    },
-    actions: {
-      redirectToGroups: () => {
-        navigate("/groups")
-      },
-    },
-  })
-  const { group, permissions } = state.context
-  const isLoading = group === undefined || permissions === undefined
-  const canUpdateGroup = permissions ? permissions.canUpdateGroup : false
+const GroupMemberRow = (props: {
+  member: User;
+  group: Group;
+  canUpdate: boolean;
+}) => {
+  const { member, group, canUpdate } = props;
+  const queryClient = useQueryClient();
+  const removeMemberMutation = useMutation(removeMember(queryClient));
 
   return (
-    <>
-      <Helmet>
-        <title>
-          {pageTitle((group?.display_name || group?.name) ?? "Loading...")}
-        </title>
-      </Helmet>
-      <ChooseOne>
-        <Cond condition={isLoading}>
-          <Loader />
-        </Cond>
-
-        <Cond>
-          <Margins>
-            <PageHeader
-              actions={
-                <Maybe condition={canUpdateGroup}>
-                  <Link to="settings" component={RouterLink}>
-                    <Button startIcon={<SettingsOutlined />}>Settings</Button>
-                  </Link>
-                  <Button
-                    onClick={() => {
-                      send("DELETE")
-                    }}
-                    startIcon={<DeleteOutline />}
-                  >
-                    Delete
-                  </Button>
-                </Maybe>
-              }
-            >
-              <PageHeaderTitle>
-                {group?.display_name || group?.name}
-              </PageHeaderTitle>
-              <PageHeaderSubtitle>
-                {/* Show the name if it differs from the display name. */}
-                {group?.display_name && group?.display_name !== group?.name
-                  ? group?.name
-                  : ""}{" "}
-              </PageHeaderSubtitle>
-            </PageHeader>
-
-            <Stack spacing={1}>
-              <Maybe condition={canUpdateGroup}>
-                <AddGroupMember
-                  isLoading={state.matches("addingMember")}
-                  onSubmit={(user, reset) => {
-                    send({
-                      type: "ADD_MEMBER",
-                      userId: user.id,
-                      callback: reset,
-                    })
-                  }}
-                />
-              </Maybe>
-              <PaginationStatus
-                isLoading={Boolean(isLoading)}
-                showing={group?.members.length ?? 0}
-                total={group?.members.length ?? 0}
-                label="members"
-              />
-
-              <TableContainer>
-                <Table>
-                  <TableHead>
-                    <TableRow>
-                      <TableCell width="99%">User</TableCell>
-                      <TableCell width="1%"></TableCell>
-                    </TableRow>
-                  </TableHead>
-
-                  <TableBody>
-                    <ChooseOne>
-                      <Cond condition={Boolean(group?.members.length === 0)}>
-                        <TableRow>
-                          <TableCell colSpan={999}>
-                            <EmptyState
-                              message="No members yet"
-                              description="Add a member using the controls above"
-                            />
-                          </TableCell>
-                        </TableRow>
-                      </Cond>
-
-                      <Cond>
-                        {group?.members.map((member) => (
-                          <TableRow key={member.id}>
-                            <TableCell width="99%">
-                              <AvatarData
-                                title={member.username}
-                                subtitle={member.email}
-                              />
-                            </TableCell>
-                            <TableCell width="1%">
-                              <Maybe condition={canUpdateGroup}>
-                                <TableRowMenu
-                                  data={member}
-                                  menuItems={[
-                                    {
-                                      label: "Remove",
-                                      onClick: () => {
-                                        send({
-                                          type: "REMOVE_MEMBER",
-                                          userId: member.id,
-                                        })
-                                      },
-                                      disabled: false,
-                                    },
-                                  ]}
-                                />
-                              </Maybe>
-                            </TableCell>
-                          </TableRow>
-                        ))}
-                      </Cond>
-                    </ChooseOne>
-                  </TableBody>
-                </Table>
-              </TableContainer>
-            </Stack>
-          </Margins>
-        </Cond>
-      </ChooseOne>
-
-      {group && (
-        <DeleteDialog
-          isOpen={state.matches("confirmingDelete")}
-          confirmLoading={state.matches("deleting")}
-          name={group.name}
-          entity="group"
-          onConfirm={() => {
-            send("CONFIRM_DELETE")
-          }}
-          onCancel={() => {
-            send("CANCEL_DELETE")
-          }}
+    <TableRow key={member.id}>
+      <TableCell width="59%">
+        <AvatarData
+          avatar={
+            <UserAvatar
+              username={member.username}
+              avatarURL={member.avatar_url}
+            />
+          }
+          title={member.username}
+          subtitle={member.email}
         />
-      )}
-    </>
-  )
-}
+      </TableCell>
+      <TableCell
+        width="40%"
+        css={[styles.status, member.status === "suspended" && styles.suspended]}
+      >
+        <Box>{member.status}</Box>
+        <LastSeen value={member.last_seen_at} sx={{ fontSize: 12 }} />
+      </TableCell>
+      <TableCell width="1%">
+        {canUpdate && (
+          <TableRowMenu
+            data={member}
+            menuItems={[
+              {
+                label: "Remove",
+                onClick: async () => {
+                  try {
+                    await removeMemberMutation.mutateAsync({
+                      groupId: group.id,
+                      userId: member.id,
+                    });
+                    displaySuccess("Member removed successfully.");
+                  } catch (error) {
+                    displayError(
+                      getErrorMessage(error, "Failed to remove member."),
+                    );
+                  }
+                },
+                disabled: group.id === group.organization_id,
+              },
+            ]}
+          />
+        )}
+      </TableCell>
+    </TableRow>
+  );
+};
 
-const useStyles = makeStyles(() => ({
+const useStyles = makeStyles((theme) => ({
   autoComplete: {
     width: 300,
   },
-}))
+  removeButton: {
+    color: theme.palette.error.main,
+    "&:hover": {
+      backgroundColor: "transparent",
+    },
+  },
+}));
+
+const styles = {
+  status: {
+    textTransform: "capitalize",
+  },
+  suspended: (theme) => ({
+    color: theme.palette.text.secondary,
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
 
-export default GroupPage
+export default GroupPage;
diff --git a/site/src/pages/GroupsPage/GroupsPage.tsx b/site/src/pages/GroupsPage/GroupsPage.tsx
index e736837f810bf..37bb1abfc2d89 100644
--- a/site/src/pages/GroupsPage/GroupsPage.tsx
+++ b/site/src/pages/GroupsPage/GroupsPage.tsx
@@ -1,24 +1,28 @@
-import { useMachine } from "@xstate/react"
-import { useFeatureVisibility } from "hooks/useFeatureVisibility"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { usePermissions } from "hooks/usePermissions"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { groupsMachine } from "xServices/groups/groupsXService"
-import GroupsPageView from "./GroupsPageView"
+import { useFeatureVisibility } from "hooks/useFeatureVisibility";
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { usePermissions } from "hooks/usePermissions";
+import { FC, useEffect } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import GroupsPageView from "./GroupsPageView";
+import { useQuery } from "react-query";
+import { groups } from "api/queries/groups";
+import { displayError } from "components/GlobalSnackbar/utils";
+import { getErrorMessage } from "api/errors";
 
 export const GroupsPage: FC = () => {
-  const organizationId = useOrganizationId()
-  const { createGroup: canCreateGroup } = usePermissions()
-  const { template_rbac: isTemplateRBACEnabled } = useFeatureVisibility()
-  const [state] = useMachine(groupsMachine, {
-    context: {
-      organizationId,
-      shouldFetchGroups: isTemplateRBACEnabled,
-    },
-  })
-  const { groups } = state.context
+  const organizationId = useOrganizationId();
+  const { createGroup: canCreateGroup } = usePermissions();
+  const { template_rbac: isTemplateRBACEnabled } = useFeatureVisibility();
+  const groupsQuery = useQuery(groups(organizationId));
+
+  useEffect(() => {
+    if (groupsQuery.error) {
+      displayError(
+        getErrorMessage(groupsQuery.error, "Error on loading groups."),
+      );
+    }
+  }, [groupsQuery.error]);
 
   return (
     <>
@@ -27,12 +31,12 @@ export const GroupsPage: FC = () => {
       </Helmet>
 
       <GroupsPageView
-        groups={groups}
+        groups={groupsQuery.data}
         canCreateGroup={canCreateGroup}
         isTemplateRBACEnabled={isTemplateRBACEnabled}
       />
     </>
-  )
-}
+  );
+};
 
-export default GroupsPage
+export default GroupsPage;
diff --git a/site/src/pages/GroupsPage/GroupsPageView.stories.tsx b/site/src/pages/GroupsPage/GroupsPageView.stories.tsx
index c82baac4d5c01..8143a75d71bf6 100644
--- a/site/src/pages/GroupsPage/GroupsPageView.stories.tsx
+++ b/site/src/pages/GroupsPage/GroupsPageView.stories.tsx
@@ -1,47 +1,51 @@
-import { Story } from "@storybook/react"
-import { MockGroup } from "testHelpers/entities"
-import { GroupsPageView, GroupsPageViewProps } from "./GroupsPageView"
+import { MockGroup } from "testHelpers/entities";
+import { GroupsPageView } from "./GroupsPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/GroupsPageView",
+const meta: Meta<typeof GroupsPageView> = {
+  title: "pages/GroupsPage",
   component: GroupsPageView,
-}
+};
 
-const Template: Story<GroupsPageViewProps> = (args: GroupsPageViewProps) => (
-  <GroupsPageView {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof GroupsPageView>;
 
-export const NotEnabled = Template.bind({})
-NotEnabled.args = {
-  groups: [MockGroup],
-  canCreateGroup: true,
-  isTemplateRBACEnabled: false,
-}
+export const NotEnabled: Story = {
+  args: {
+    groups: [MockGroup],
+    canCreateGroup: true,
+    isTemplateRBACEnabled: false,
+  },
+};
 
-export const WithGroups = Template.bind({})
-WithGroups.args = {
-  groups: [MockGroup],
-  canCreateGroup: true,
-  isTemplateRBACEnabled: true,
-}
+export const WithGroups: Story = {
+  args: {
+    groups: [MockGroup],
+    canCreateGroup: true,
+    isTemplateRBACEnabled: true,
+  },
+};
 
-export const WithDisplayGroup = Template.bind({})
-WithGroups.args = {
-  groups: [{ ...MockGroup, name: "front-end" }],
-  canCreateGroup: true,
-  isTemplateRBACEnabled: true,
-}
+export const WithDisplayGroup: Story = {
+  args: {
+    groups: [{ ...MockGroup, name: "front-end" }],
+    canCreateGroup: true,
+    isTemplateRBACEnabled: true,
+  },
+};
 
-export const EmptyGroup = Template.bind({})
-EmptyGroup.args = {
-  groups: [],
-  canCreateGroup: false,
-  isTemplateRBACEnabled: true,
-}
+export const EmptyGroup: Story = {
+  args: {
+    groups: [],
+    canCreateGroup: false,
+    isTemplateRBACEnabled: true,
+  },
+};
 
-export const EmptyGroupWithPermission = Template.bind({})
-EmptyGroupWithPermission.args = {
-  groups: [],
-  canCreateGroup: true,
-  isTemplateRBACEnabled: true,
-}
+export const EmptyGroupWithPermission: Story = {
+  args: {
+    groups: [],
+    canCreateGroup: true,
+    isTemplateRBACEnabled: true,
+  },
+};
diff --git a/site/src/pages/GroupsPage/GroupsPageView.tsx b/site/src/pages/GroupsPage/GroupsPageView.tsx
index 1acb5e79cf769..8fe70c9c5ee26 100644
--- a/site/src/pages/GroupsPage/GroupsPageView.tsx
+++ b/site/src/pages/GroupsPage/GroupsPageView.tsx
@@ -1,44 +1,50 @@
-import Button from "@mui/material/Button"
-import Link from "@mui/material/Link"
-import { makeStyles } from "@mui/styles"
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableHead from "@mui/material/TableHead"
-import TableRow from "@mui/material/TableRow"
-import ArrowRightAltOutlined from "@mui/icons-material/ArrowRightAltOutlined"
-import AddOutlined from "@mui/icons-material/AddOutlined"
-import KeyboardArrowRight from "@mui/icons-material/KeyboardArrowRight"
-import AvatarGroup from "@mui/material/AvatarGroup"
-import { AvatarData } from "components/AvatarData/AvatarData"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { EmptyState } from "components/EmptyState/EmptyState"
-import { Stack } from "components/Stack/Stack"
-import { TableLoaderSkeleton } from "components/TableLoader/TableLoader"
-import { UserAvatar } from "components/UserAvatar/UserAvatar"
-import { FC } from "react"
-import { Link as RouterLink, useNavigate } from "react-router-dom"
-import { Paywall } from "components/Paywall/Paywall"
-import { Group } from "api/typesGenerated"
-import { GroupAvatar } from "components/GroupAvatar/GroupAvatar"
-import { docs } from "utils/docs"
+import Button from "@mui/material/Button";
+import Link from "@mui/material/Link";
+import { makeStyles } from "@mui/styles";
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableHead from "@mui/material/TableHead";
+import TableRow from "@mui/material/TableRow";
+import ArrowRightAltOutlined from "@mui/icons-material/ArrowRightAltOutlined";
+import AddOutlined from "@mui/icons-material/AddOutlined";
+import KeyboardArrowRight from "@mui/icons-material/KeyboardArrowRight";
+import AvatarGroup from "@mui/material/AvatarGroup";
+import { AvatarData } from "components/AvatarData/AvatarData";
+import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
+import { EmptyState } from "components/EmptyState/EmptyState";
+import { Stack } from "components/Stack/Stack";
+import {
+  TableLoaderSkeleton,
+  TableRowSkeleton,
+} from "components/TableLoader/TableLoader";
+import { UserAvatar } from "components/UserAvatar/UserAvatar";
+import { FC } from "react";
+import { Link as RouterLink, useNavigate } from "react-router-dom";
+import { Paywall } from "components/Paywall/Paywall";
+import { Group } from "api/typesGenerated";
+import { GroupAvatar } from "components/GroupAvatar/GroupAvatar";
+import { docs } from "utils/docs";
+import Skeleton from "@mui/material/Skeleton";
+import { Box } from "@mui/system";
+import { AvatarDataSkeleton } from "components/AvatarData/AvatarDataSkeleton";
 
 export type GroupsPageViewProps = {
-  groups: Group[] | undefined
-  canCreateGroup: boolean
-  isTemplateRBACEnabled: boolean
-}
+  groups: Group[] | undefined;
+  canCreateGroup: boolean;
+  isTemplateRBACEnabled: boolean;
+};
 
 export const GroupsPageView: FC<GroupsPageViewProps> = ({
   groups,
   canCreateGroup,
   isTemplateRBACEnabled,
 }) => {
-  const isLoading = Boolean(groups === undefined)
-  const isEmpty = Boolean(groups && groups.length === 0)
-  const navigate = useNavigate()
-  const styles = useStyles()
+  const isLoading = Boolean(groups === undefined);
+  const isEmpty = Boolean(groups && groups.length === 0);
+  const navigate = useNavigate();
+  const styles = useStyles();
 
   return (
     <>
@@ -83,7 +89,7 @@ export const GroupsPageView: FC<GroupsPageViewProps> = ({
               <TableBody>
                 <ChooseOne>
                   <Cond condition={isLoading}>
-                    <TableLoaderSkeleton columns={3} useAvatarData />
+                    <TableLoader />
                   </Cond>
 
                   <Cond condition={isEmpty}>
@@ -115,7 +121,7 @@ export const GroupsPageView: FC<GroupsPageViewProps> = ({
 
                   <Cond>
                     {groups?.map((group) => {
-                      const groupPageLink = `/groups/${group.id}`
+                      const groupPageLink = `/groups/${group.id}`;
 
                       return (
                         <TableRow
@@ -124,11 +130,11 @@ export const GroupsPageView: FC<GroupsPageViewProps> = ({
                           data-testid={`group-${group.id}`}
                           tabIndex={0}
                           onClick={() => {
-                            navigate(groupPageLink)
+                            navigate(groupPageLink);
                           }}
                           onKeyDown={(event) => {
                             if (event.key === "Enter") {
-                              navigate(groupPageLink)
+                              navigate(groupPageLink);
                             }
                           }}
                           className={styles.clickableTableRow}
@@ -171,7 +177,7 @@ export const GroupsPageView: FC<GroupsPageViewProps> = ({
                             </div>
                           </TableCell>
                         </TableRow>
-                      )
+                      );
                     })}
                   </Cond>
                 </ChooseOne>
@@ -181,8 +187,28 @@ export const GroupsPageView: FC<GroupsPageViewProps> = ({
         </Cond>
       </ChooseOne>
     </>
-  )
-}
+  );
+};
+
+const TableLoader = () => {
+  return (
+    <TableLoaderSkeleton>
+      <TableRowSkeleton>
+        <TableCell>
+          <Box sx={{ display: "flex", alignItems: "center", gap: 1 }}>
+            <AvatarDataSkeleton />
+          </Box>
+        </TableCell>
+        <TableCell>
+          <Skeleton variant="text" width="25%" />
+        </TableCell>
+        <TableCell>
+          <Skeleton variant="text" width="25%" />
+        </TableCell>
+      </TableRowSkeleton>
+    </TableLoaderSkeleton>
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   clickableTableRow: {
@@ -208,6 +234,6 @@ const useStyles = makeStyles((theme) => ({
   arrowCell: {
     display: "flex",
   },
-}))
+}));
 
-export default GroupsPageView
+export default GroupsPageView;
diff --git a/site/src/pages/GroupsPage/SettingsGroupPage.tsx b/site/src/pages/GroupsPage/SettingsGroupPage.tsx
index 2849650013d7f..c42468062dba5 100644
--- a/site/src/pages/GroupsPage/SettingsGroupPage.tsx
+++ b/site/src/pages/GroupsPage/SettingsGroupPage.tsx
@@ -1,32 +1,23 @@
-import { useMachine } from "@xstate/react"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useNavigate, useParams } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import { editGroupMachine } from "xServices/groups/editGroupXService"
-import SettingsGroupPageView from "./SettingsGroupPageView"
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { useNavigate, useParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import SettingsGroupPageView from "./SettingsGroupPageView";
+import { useMutation, useQuery, useQueryClient } from "react-query";
+import { group, patchGroup } from "api/queries/groups";
+import { displayError } from "components/GlobalSnackbar/utils";
+import { getErrorMessage } from "api/errors";
 
 export const SettingsGroupPage: FC = () => {
-  const { groupId } = useParams()
-  if (!groupId) {
-    throw new Error("Group ID not defined.")
-  }
-
-  const navigate = useNavigate()
+  const { groupId } = useParams() as { groupId: string };
+  const queryClient = useQueryClient();
+  const groupQuery = useQuery(group(groupId));
+  const patchGroupMutation = useMutation(patchGroup(queryClient));
+  const navigate = useNavigate();
 
   const navigateToGroup = () => {
-    navigate(`/groups/${groupId}`)
-  }
-
-  const [editState, sendEditEvent] = useMachine(editGroupMachine, {
-    context: {
-      groupId,
-    },
-    actions: {
-      onUpdate: navigateToGroup,
-    },
-  })
-  const { error, group } = editState.context
+    navigate(`/groups/${groupId}`);
+  };
 
   return (
     <>
@@ -36,15 +27,25 @@ export const SettingsGroupPage: FC = () => {
 
       <SettingsGroupPageView
         onCancel={navigateToGroup}
-        onSubmit={(data) => {
-          sendEditEvent({ type: "UPDATE", data })
+        onSubmit={async (data) => {
+          try {
+            await patchGroupMutation.mutateAsync({
+              groupId,
+              ...data,
+              add_users: [],
+              remove_users: [],
+            });
+            navigateToGroup();
+          } catch (error) {
+            displayError(getErrorMessage(error, "Failed to update group"));
+          }
         }}
-        group={group}
-        formErrors={error}
-        isLoading={editState.matches("loading")}
-        isUpdating={editState.matches("updating")}
+        group={groupQuery.data}
+        formErrors={groupQuery.error}
+        isLoading={groupQuery.isLoading}
+        isUpdating={patchGroupMutation.isLoading}
       />
     </>
-  )
-}
-export default SettingsGroupPage
+  );
+};
+export default SettingsGroupPage;
diff --git a/site/src/pages/GroupsPage/SettingsGroupPageView.stories.tsx b/site/src/pages/GroupsPage/SettingsGroupPageView.stories.tsx
index 1cde5c8ff80ad..a40740db736d6 100644
--- a/site/src/pages/GroupsPage/SettingsGroupPageView.stories.tsx
+++ b/site/src/pages/GroupsPage/SettingsGroupPageView.stories.tsx
@@ -1,21 +1,20 @@
-import { Story } from "@storybook/react"
-import { MockGroup } from "testHelpers/entities"
-import {
-  SettingsGroupPageView,
-  SettingsGroupPageViewProps,
-} from "./SettingsGroupPageView"
+import { MockGroup } from "testHelpers/entities";
+import { SettingsGroupPageView } from "./SettingsGroupPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/SettingsGroupPageView",
+const meta: Meta<typeof SettingsGroupPageView> = {
+  title: "pages/GroupsPage/SettingsGroupPageView",
   component: SettingsGroupPageView,
-}
+};
 
-const Template: Story<SettingsGroupPageViewProps> = (
-  args: SettingsGroupPageViewProps,
-) => <SettingsGroupPageView {...args} />
+export default meta;
+type Story = StoryObj<typeof SettingsGroupPageView>;
 
-export const Example = Template.bind({})
-Example.args = {
-  group: MockGroup,
-  isLoading: false,
-}
+const Example: Story = {
+  args: {
+    group: MockGroup,
+    isLoading: false,
+  },
+};
+
+export { Example as SettingsGroupPageView };
diff --git a/site/src/pages/GroupsPage/SettingsGroupPageView.tsx b/site/src/pages/GroupsPage/SettingsGroupPageView.tsx
index fd5c3d4e3fd0c..f7e7282bb55b1 100644
--- a/site/src/pages/GroupsPage/SettingsGroupPageView.tsx
+++ b/site/src/pages/GroupsPage/SettingsGroupPageView.tsx
@@ -1,36 +1,39 @@
-import TextField from "@mui/material/TextField"
-import { Group } from "api/typesGenerated"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { FormFooter } from "components/FormFooter/FormFooter"
-import { FullPageForm } from "components/FullPageForm/FullPageForm"
-import { Loader } from "components/Loader/Loader"
-import { LazyIconField } from "components/IconField/LazyIconField"
-import { Margins } from "components/Margins/Margins"
-import { useFormik } from "formik"
-import { FC } from "react"
-import { useTranslation } from "react-i18next"
-import { getFormHelpers, nameValidator, onChangeTrimmed } from "utils/formUtils"
-import * as Yup from "yup"
-import { Stack } from "components/Stack/Stack"
+import TextField from "@mui/material/TextField";
+import { Group } from "api/typesGenerated";
+import { FormFooter } from "components/FormFooter/FormFooter";
+import { FullPageForm } from "components/FullPageForm/FullPageForm";
+import { Loader } from "components/Loader/Loader";
+import { LazyIconField } from "components/IconField/LazyIconField";
+import { Margins } from "components/Margins/Margins";
+import { useFormik } from "formik";
+import { FC } from "react";
+import {
+  getFormHelpers,
+  nameValidator,
+  onChangeTrimmed,
+} from "utils/formUtils";
+import * as Yup from "yup";
+import { Stack } from "components/Stack/Stack";
+import { isEveryoneGroup } from "utils/groups";
 
 type FormData = {
-  name: string
-  display_name: string
-  avatar_url: string
-  quota_allowance: number
-}
+  name: string;
+  display_name: string;
+  avatar_url: string;
+  quota_allowance: number;
+};
 
 const validationSchema = Yup.object({
   name: nameValidator("Name"),
   quota_allowance: Yup.number().required().min(0).integer(),
-})
+});
 
 const UpdateGroupForm: FC<{
-  group: Group
-  errors: unknown
-  onSubmit: (data: FormData) => void
-  onCancel: () => void
-  isLoading: boolean
+  group: Group;
+  errors: unknown;
+  onSubmit: (data: FormData) => void;
+  onCancel: () => void;
+  isLoading: boolean;
 }> = ({ group, errors, onSubmit, onCancel, isLoading }) => {
   const form = useFormik<FormData>({
     initialValues: {
@@ -41,9 +44,8 @@ const UpdateGroupForm: FC<{
     },
     validationSchema,
     onSubmit,
-  })
-  const getFieldHelpers = getFormHelpers<FormData>(form, errors)
-  const { t } = useTranslation("common")
+  });
+  const getFieldHelpers = getFormHelpers<FormData>(form, errors);
 
   return (
     <FullPageForm title="Group settings">
@@ -56,25 +58,33 @@ const UpdateGroupForm: FC<{
             autoFocus
             fullWidth
             label="Name"
+            disabled={isEveryoneGroup(group)}
           />
-          <TextField
-            {...getFieldHelpers(
-              "display_name",
-              "Optional: keep empty to default to the name.",
-            )}
-            onChange={onChangeTrimmed(form)}
-            autoComplete="display_name"
-            autoFocus
-            fullWidth
-            label="Display Name"
-          />
-          <LazyIconField
-            {...getFieldHelpers("avatar_url")}
-            onChange={onChangeTrimmed(form)}
-            fullWidth
-            label={t("form.fields.icon")}
-            onPickEmoji={(value) => form.setFieldValue("avatar_url", value)}
-          />
+          {isEveryoneGroup(group) ? (
+            <></>
+          ) : (
+            <>
+              <TextField
+                {...getFieldHelpers(
+                  "display_name",
+                  "Optional: keep empty to default to the name.",
+                )}
+                onChange={onChangeTrimmed(form)}
+                autoComplete="display_name"
+                autoFocus
+                fullWidth
+                label="Display Name"
+                disabled={isEveryoneGroup(group)}
+              />
+              <LazyIconField
+                {...getFieldHelpers("avatar_url")}
+                onChange={onChangeTrimmed(form)}
+                fullWidth
+                label="Avatar URL"
+                onPickEmoji={(value) => form.setFieldValue("avatar_url", value)}
+              />
+            </>
+          )}
           <TextField
             {...getFieldHelpers(
               "quota_allowance",
@@ -92,17 +102,17 @@ const UpdateGroupForm: FC<{
         <FormFooter onCancel={onCancel} isLoading={isLoading} />
       </form>
     </FullPageForm>
-  )
-}
+  );
+};
 
 export type SettingsGroupPageViewProps = {
-  onCancel: () => void
-  onSubmit: (data: FormData) => void
-  group: Group | undefined
-  formErrors: unknown
-  isLoading: boolean
-  isUpdating: boolean
-}
+  onCancel: () => void;
+  onSubmit: (data: FormData) => void;
+  group: Group | undefined;
+  formErrors: unknown;
+  isLoading: boolean;
+  isUpdating: boolean;
+};
 
 export const SettingsGroupPageView: FC<SettingsGroupPageViewProps> = ({
   onCancel,
@@ -112,25 +122,21 @@ export const SettingsGroupPageView: FC<SettingsGroupPageViewProps> = ({
   isLoading,
   isUpdating,
 }) => {
-  return (
-    <ChooseOne>
-      <Cond condition={isLoading}>
-        <Loader />
-      </Cond>
+  if (isLoading) {
+    return <Loader />;
+  }
 
-      <Cond>
-        <Margins>
-          <UpdateGroupForm
-            group={group as Group}
-            onCancel={onCancel}
-            errors={formErrors}
-            isLoading={isUpdating}
-            onSubmit={onSubmit}
-          />
-        </Margins>
-      </Cond>
-    </ChooseOne>
-  )
-}
+  return (
+    <Margins>
+      <UpdateGroupForm
+        group={group!}
+        onCancel={onCancel}
+        errors={formErrors}
+        isLoading={isUpdating}
+        onSubmit={onSubmit}
+      />
+    </Margins>
+  );
+};
 
-export default SettingsGroupPageView
+export default SettingsGroupPageView;
diff --git a/site/src/pages/HealthPage/HealthPage.stories.tsx b/site/src/pages/HealthPage/HealthPage.stories.tsx
index dd7baddb70278..f0a88cc5b4518 100644
--- a/site/src/pages/HealthPage/HealthPage.stories.tsx
+++ b/site/src/pages/HealthPage/HealthPage.stories.tsx
@@ -1,9 +1,9 @@
-import { Meta, StoryObj } from "@storybook/react"
-import { HealthPageView } from "./HealthPage"
-import { MockHealth } from "testHelpers/entities"
+import { Meta, StoryObj } from "@storybook/react";
+import { HealthPageView } from "./HealthPage";
+import { MockHealth } from "testHelpers/entities";
 
 const meta: Meta<typeof HealthPageView> = {
-  title: "pages/HealthPageView",
+  title: "pages/HealthPage",
   component: HealthPageView,
   args: {
     tab: {
@@ -12,14 +12,14 @@ const meta: Meta<typeof HealthPageView> = {
     },
     healthStatus: MockHealth,
   },
-}
+};
 
-export default meta
-type Story = StoryObj<typeof HealthPageView>
+export default meta;
+type Story = StoryObj<typeof HealthPageView>;
 
-export const HealthPage: Story = {}
+export const Example: Story = {};
 
-export const UnhealthPage: Story = {
+export const UnhealthyDERP: Story = {
   args: {
     healthStatus: {
       ...MockHealth,
@@ -30,4 +30,4 @@ export const UnhealthPage: Story = {
       },
     },
   },
-}
+};
diff --git a/site/src/pages/HealthPage/HealthPage.tsx b/site/src/pages/HealthPage/HealthPage.tsx
index 55f5f820f8cfc..bba2c2634ddae 100644
--- a/site/src/pages/HealthPage/HealthPage.tsx
+++ b/site/src/pages/HealthPage/HealthPage.tsx
@@ -1,38 +1,39 @@
-import Box from "@mui/material/Box"
-import { useQuery } from "@tanstack/react-query"
-import { getHealth } from "api/api"
-import { Loader } from "components/Loader/Loader"
-import { useTab } from "hooks"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { colors } from "theme/colors"
-import CheckCircleOutlined from "@mui/icons-material/CheckCircleOutlined"
-import ErrorOutline from "@mui/icons-material/ErrorOutline"
-import { SyntaxHighlighter } from "components/SyntaxHighlighter/SyntaxHighlighter"
-import { Stack } from "components/Stack/Stack"
+import Box from "@mui/material/Box";
+import { useQuery } from "react-query";
+import { getHealth } from "api/api";
+import { Loader } from "components/Loader/Loader";
+import { useTab } from "hooks";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { colors } from "theme/colors";
+import CheckCircleOutlined from "@mui/icons-material/CheckCircleOutlined";
+import ErrorOutline from "@mui/icons-material/ErrorOutline";
+import { SyntaxHighlighter } from "components/SyntaxHighlighter/SyntaxHighlighter";
+import { Stack } from "components/Stack/Stack";
 import {
   FullWidthPageHeader,
   PageHeaderTitle,
   PageHeaderSubtitle,
-} from "components/PageHeader/FullWidthPageHeader"
-import { Stats, StatsItem } from "components/Stats/Stats"
-import { makeStyles } from "@mui/styles"
-import { createDayString } from "utils/createDayString"
+} from "components/PageHeader/FullWidthPageHeader";
+import { Stats, StatsItem } from "components/Stats/Stats";
+import { makeStyles } from "@mui/styles";
+import { createDayString } from "utils/createDayString";
+import { DashboardFullPage } from "components/Dashboard/DashboardLayout";
 
 const sections = {
   derp: "DERP",
   access_url: "Access URL",
   websocket: "Websocket",
   database: "Database",
-} as const
+} as const;
 
 export default function HealthPage() {
-  const tab = useTab("tab", "derp")
+  const tab = useTab("tab", "derp");
   const { data: healthStatus } = useQuery({
     queryKey: ["health"],
     queryFn: () => getHealth(),
-    refetchInterval: 10_000,
-  })
+    refetchInterval: 120_000,
+  });
 
   return (
     <>
@@ -41,32 +42,25 @@ export default function HealthPage() {
       </Helmet>
 
       {healthStatus ? (
-        <HealthPageView healthStatus={healthStatus.data} tab={tab} />
+        <HealthPageView healthStatus={healthStatus} tab={tab} />
       ) : (
         <Loader />
       )}
     </>
-  )
+  );
 }
 
 export function HealthPageView({
   healthStatus,
   tab,
 }: {
-  healthStatus: Awaited<ReturnType<typeof getHealth>>["data"]
-  tab: ReturnType<typeof useTab>
+  healthStatus: Awaited<ReturnType<typeof getHealth>>;
+  tab: ReturnType<typeof useTab>;
 }) {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
-    <Box
-      sx={{
-        height: "calc(100vh - 62px - 36px)",
-        overflow: "hidden",
-        // Remove padding added from dashboard layout (.siteContent)
-        marginBottom: "-48px",
-      }}
-    >
+    <DashboardFullPage>
       <FullWidthPageHeader sticky={false}>
         <Stack direction="row" spacing={2} alignItems="center">
           {healthStatus.healthy ? (
@@ -115,8 +109,9 @@ export function HealthPageView({
       <Box
         sx={{
           display: "flex",
-          alignItems: "start",
-          height: "100%",
+          flexBasis: 0,
+          flex: 1,
+          overflow: "hidden",
         }}
       >
         <Box
@@ -124,7 +119,6 @@ export function HealthPageView({
             width: (theme) => theme.spacing(32),
             flexShrink: 0,
             borderRight: (theme) => `1px solid ${theme.palette.divider}`,
-            height: "100%",
           }}
         >
           <Box
@@ -143,17 +137,17 @@ export function HealthPageView({
             {Object.keys(sections)
               .sort()
               .map((key) => {
-                const label = sections[key as keyof typeof sections]
-                const isActive = tab.value === key
+                const label = sections[key as keyof typeof sections];
+                const isActive = tab.value === key;
                 const isHealthy =
-                  healthStatus[key as keyof typeof sections].healthy
+                  healthStatus[key as keyof typeof sections].healthy;
 
                 return (
                   <Box
                     component="button"
                     key={key}
                     onClick={() => {
-                      tab.set(key)
+                      tab.set(key);
                     }}
                     sx={{
                       background: isActive ? colors.gray[13] : "none",
@@ -197,12 +191,12 @@ export function HealthPageView({
                     )}
                     {label}
                   </Box>
-                )
+                );
               })}
           </Box>
         </Box>
         {/* 62px - navbar and 36px - the bottom bar */}
-        <Box sx={{ height: "100%", overflowY: "auto", width: "100%" }}>
+        <Box sx={{ overflowY: "auto", width: "100%" }}>
           <SyntaxHighlighter
             language="json"
             editorProps={{ height: "100%" }}
@@ -214,8 +208,8 @@ export function HealthPageView({
           />
         </Box>
       </Box>
-    </Box>
-  )
+    </DashboardFullPage>
+  );
 }
 
 const useStyles = makeStyles((theme) => ({
@@ -244,4 +238,4 @@ const useStyles = makeStyles((theme) => ({
       fontWeight: 500,
     },
   },
-}))
+}));
diff --git a/site/src/pages/IconsPage/IconsPage.tsx b/site/src/pages/IconsPage/IconsPage.tsx
new file mode 100644
index 0000000000000..6b30c1079f245
--- /dev/null
+++ b/site/src/pages/IconsPage/IconsPage.tsx
@@ -0,0 +1,196 @@
+import TextField from "@mui/material/TextField";
+import InputAdornment from "@mui/material/InputAdornment";
+import Tooltip from "@mui/material/Tooltip";
+import IconButton from "@mui/material/IconButton";
+import Box from "@mui/material/Box";
+import Link from "@mui/material/Link";
+import SearchIcon from "@mui/icons-material/SearchOutlined";
+import ClearIcon from "@mui/icons-material/CloseOutlined";
+import { useTheme } from "@emotion/react";
+import { type FC, type ReactNode, useMemo, useState } from "react";
+import { Helmet } from "react-helmet-async";
+import uFuzzy from "ufuzzy";
+import { CopyableValue } from "components/CopyableValue/CopyableValue";
+import { EmptyState } from "components/EmptyState/EmptyState";
+import { Margins } from "components/Margins/Margins";
+import {
+  PageHeader,
+  PageHeaderSubtitle,
+  PageHeaderTitle,
+} from "components/PageHeader/PageHeader";
+import { Stack } from "components/Stack/Stack";
+import icons from "theme/icons.json";
+import { pageTitle } from "utils/page";
+
+const iconsWithoutSuffix = icons.map((icon) => icon.split(".")[0]);
+const fuzzyFinder = new uFuzzy({
+  intraMode: 1,
+  intraIns: 1,
+  intraSub: 1,
+  intraTrn: 1,
+  intraDel: 1,
+});
+
+export const IconsPage: FC = () => {
+  const theme = useTheme();
+  const [searchInputText, setSearchInputText] = useState("");
+  const searchText = searchInputText.trim();
+
+  const searchedIcons = useMemo(() => {
+    if (!searchText) {
+      return icons.map((icon) => ({ url: `/icon/${icon}`, description: icon }));
+    }
+
+    const [map, info, sorted] = fuzzyFinder.search(
+      iconsWithoutSuffix,
+      searchText,
+    );
+
+    // We hit an invalid state somehow
+    if (!map || !info || !sorted) {
+      return [];
+    }
+
+    return sorted.map((i) => {
+      const iconName = icons[info.idx[i]];
+      const ranges = info.ranges[i];
+
+      const nodes: ReactNode[] = [];
+      let cursor = 0;
+      for (let j = 0; j < ranges.length; j += 2) {
+        nodes.push(iconName.slice(cursor, ranges[j]));
+        nodes.push(
+          <mark key={j + 1}>{iconName.slice(ranges[j], ranges[j + 1])}</mark>,
+        );
+        cursor = ranges[j + 1];
+      }
+      nodes.push(iconName.slice(cursor));
+      return { url: `/icon/${iconName}`, description: nodes };
+    });
+  }, [searchText]);
+
+  return (
+    <>
+      <Helmet>
+        <title>{pageTitle("Icons")}</title>
+      </Helmet>
+      <Margins>
+        <PageHeader
+          actions={
+            <Tooltip
+              placement="bottom-end"
+              title={
+                <Box
+                  css={{
+                    padding: theme.spacing(1),
+                    fontSize: 13,
+                    lineHeight: 1.5,
+                  }}
+                >
+                  You can suggest a new icon by submitting a Pull Request to our
+                  public GitHub repository. Just keep in mind that it should be
+                  relevant to many Coder users, and redistributable under a
+                  permissive license.
+                </Box>
+              }
+            >
+              <Link href="https://github.com/coder/coder/tree/main/site/static/icon">
+                Suggest an icon
+              </Link>
+            </Tooltip>
+          }
+        >
+          <PageHeaderTitle>Icons</PageHeaderTitle>
+          <PageHeaderSubtitle>
+            All of the icons included with Coder
+          </PageHeaderSubtitle>
+        </PageHeader>
+        <TextField
+          size="small"
+          InputProps={{
+            "aria-label": "Filter",
+            name: "query",
+            placeholder: "Search…",
+            value: searchInputText,
+            onChange: (event) => setSearchInputText(event.target.value),
+            sx: {
+              borderRadius: "6px",
+              marginLeft: "-1px",
+              "& input::placeholder": {
+                color: theme.palette.text.secondary,
+              },
+              "& .MuiInputAdornment-root": {
+                marginLeft: 0,
+              },
+            },
+            startAdornment: (
+              <InputAdornment position="start">
+                <SearchIcon
+                  sx={{
+                    fontSize: 14,
+                    color: theme.palette.text.secondary,
+                  }}
+                />
+              </InputAdornment>
+            ),
+            endAdornment: searchInputText && (
+              <InputAdornment position="end">
+                <Tooltip title="Clear filter">
+                  <IconButton
+                    size="small"
+                    onClick={() => setSearchInputText("")}
+                  >
+                    <ClearIcon sx={{ fontSize: 14 }} />
+                  </IconButton>
+                </Tooltip>
+              </InputAdornment>
+            ),
+          }}
+        />
+
+        <Stack
+          direction="row"
+          wrap="wrap"
+          spacing={1}
+          justifyContent="center"
+          css={(theme) => ({ marginTop: theme.spacing(4) })}
+        >
+          {searchedIcons.length === 0 && (
+            <EmptyState message="No results matched your search" />
+          )}
+          {searchedIcons.map((icon) => (
+            <CopyableValue key={icon.url} value={icon.url} placement="bottom">
+              <Stack alignItems="center" css={{ margin: theme.spacing(1.5) }}>
+                <img
+                  alt={icon.url}
+                  src={icon.url}
+                  css={{
+                    width: 60,
+                    height: 60,
+                    objectFit: "contain",
+                    pointerEvents: "none",
+                    padding: theme.spacing(1.5),
+                  }}
+                />
+                <figcaption
+                  css={{
+                    width: 88,
+                    height: 48,
+                    fontSize: 13,
+                    textOverflow: "ellipsis",
+                    textAlign: "center",
+                    overflow: "hidden",
+                  }}
+                >
+                  {icon.description}
+                </figcaption>
+              </Stack>
+            </CopyableValue>
+          ))}
+        </Stack>
+      </Margins>
+    </>
+  );
+};
+
+export default IconsPage;
diff --git a/site/src/pages/LoginPage/LoginPage.test.tsx b/site/src/pages/LoginPage/LoginPage.test.tsx
index e7dcd782fcfa5..1fb78f9f196c2 100644
--- a/site/src/pages/LoginPage/LoginPage.test.tsx
+++ b/site/src/pages/LoginPage/LoginPage.test.tsx
@@ -1,93 +1,60 @@
-import { fireEvent, screen } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
-import { rest } from "msw"
-import { createMemoryRouter } from "react-router-dom"
-import { Language } from "../../components/SignInForm/SignInForm"
+import { fireEvent, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { rest } from "msw";
+import { createMemoryRouter } from "react-router-dom";
+import { Language } from "./SignInForm";
 import {
   render,
   renderWithRouter,
   waitForLoaderToBeRemoved,
-} from "../../testHelpers/renderHelpers"
-import { server } from "../../testHelpers/server"
-import { LoginPage } from "./LoginPage"
-import * as TypesGen from "api/typesGenerated"
-import { i18n } from "i18n"
-
-const { t } = i18n
+} from "testHelpers/renderHelpers";
+import { server } from "testHelpers/server";
+import { LoginPage } from "./LoginPage";
+import * as TypesGen from "api/typesGenerated";
 
 describe("LoginPage", () => {
   beforeEach(() => {
     // appear logged out
     server.use(
       rest.get("/api/v2/users/me", (req, res, ctx) => {
-        return res(ctx.status(401), ctx.json({ message: "no user here" }))
+        return res(ctx.status(401), ctx.json({ message: "no user here" }));
       }),
-    )
-  })
-
-  it("renders the sign-in form", async () => {
-    // When
-    render(<LoginPage />)
-
-    // Then
-    await screen.findByText(Language.passwordSignIn)
-  })
+    );
+  });
 
   it("shows an error message if SignIn fails", async () => {
     // Given
-    const apiErrorMessage = "Something wrong happened"
+    const apiErrorMessage = "Something wrong happened";
     server.use(
       // Make login fail
       rest.post("/api/v2/users/login", async (req, res, ctx) => {
-        return res(ctx.status(500), ctx.json({ message: apiErrorMessage }))
+        return res(ctx.status(500), ctx.json({ message: apiErrorMessage }));
       }),
-    )
+    );
 
     // When
-    render(<LoginPage />)
-    await waitForLoaderToBeRemoved()
-    const email = screen.getByLabelText(Language.emailLabel)
-    const password = screen.getByLabelText(Language.passwordLabel)
-    await userEvent.type(email, "test@coder.com")
-    await userEvent.type(password, "password")
+    render(<LoginPage />);
+    await waitForLoaderToBeRemoved();
+    const email = screen.getByLabelText(Language.emailLabel);
+    const password = screen.getByLabelText(Language.passwordLabel);
+    await userEvent.type(email, "test@coder.com");
+    await userEvent.type(password, "password");
     // Click sign-in
-    const signInButton = await screen.findByText(Language.passwordSignIn)
-    fireEvent.click(signInButton)
-
-    // Then
-    const errorMessage = await screen.findByText(apiErrorMessage)
-    expect(errorMessage).toBeDefined()
-  })
-
-  it("shows github authentication when enabled", async () => {
-    const authMethods: TypesGen.AuthMethods = {
-      password: { enabled: true },
-      github: { enabled: true },
-      oidc: { enabled: true, signInText: "", iconUrl: "" },
-    }
-
-    // Given
-    server.use(
-      rest.get("/api/v2/users/authmethods", async (req, res, ctx) => {
-        return res(ctx.status(200), ctx.json(authMethods))
-      }),
-    )
-
-    // When
-    render(<LoginPage />)
+    const signInButton = await screen.findByText(Language.passwordSignIn);
+    fireEvent.click(signInButton);
 
     // Then
-    expect(screen.queryByText(Language.passwordSignIn)).not.toBeInTheDocument()
-    await screen.findByText(Language.githubSignIn)
-  })
+    const errorMessage = await screen.findByText(apiErrorMessage);
+    expect(errorMessage).toBeDefined();
+  });
 
   it("redirects to the setup page if there is no first user", async () => {
     // Given
     server.use(
       rest.get("/api/v2/users/first", async (req, res, ctx) => {
-        return res(ctx.status(404))
+        return res(ctx.status(404));
       }),
-    )
+    );
 
     // When
     renderWithRouter(
@@ -104,38 +71,37 @@ describe("LoginPage", () => {
         ],
         { initialEntries: ["/login"] },
       ),
-    )
+    );
 
     // Then
-    await screen.findByText("Setup")
-  })
+    await screen.findByText("Setup");
+  });
 
   it("hides password authentication if OIDC/GitHub is enabled and displays on click", async () => {
     const authMethods: TypesGen.AuthMethods = {
       password: { enabled: true },
       github: { enabled: true },
       oidc: { enabled: true, signInText: "", iconUrl: "" },
-    }
+    };
 
     // Given
     server.use(
       rest.get("/api/v2/users/authmethods", async (req, res, ctx) => {
-        return res(ctx.status(200), ctx.json(authMethods))
+        return res(ctx.status(200), ctx.json(authMethods));
       }),
-    )
+    );
 
     // When
-    render(<LoginPage />)
+    render(<LoginPage />);
 
     // Then
-    expect(screen.queryByText(Language.passwordSignIn)).not.toBeInTheDocument()
-    await screen.findByText(Language.githubSignIn)
+    expect(screen.queryByText(Language.passwordSignIn)).not.toBeInTheDocument();
+    await screen.findByText(Language.githubSignIn);
 
-    const showPasswordLabel = t("showPassword", { ns: "loginPage" })
-    const showPasswordAuthLink = screen.getByText(showPasswordLabel)
-    await userEvent.click(showPasswordAuthLink)
+    const showPasswordAuthLink = screen.getByText("Email and password");
+    await userEvent.click(showPasswordAuthLink);
 
-    await screen.findByText(Language.passwordSignIn)
-    await screen.findByText(Language.githubSignIn)
-  })
-})
+    await screen.findByText(Language.passwordSignIn);
+    await screen.findByText(Language.githubSignIn);
+  });
+});
diff --git a/site/src/pages/LoginPage/LoginPage.tsx b/site/src/pages/LoginPage/LoginPage.tsx
index c5ec956ba2746..4a36e2efaa7fa 100644
--- a/site/src/pages/LoginPage/LoginPage.tsx
+++ b/site/src/pages/LoginPage/LoginPage.tsx
@@ -1,41 +1,70 @@
-import { useAuth } from "components/AuthProvider/AuthProvider"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useTranslation } from "react-i18next"
-import { Navigate, useLocation } from "react-router-dom"
-import { retrieveRedirect } from "../../utils/redirect"
-import { LoginPageView } from "./LoginPageView"
+import { useAuth } from "components/AuthProvider/AuthProvider";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { Navigate, useLocation, useNavigate } from "react-router-dom";
+import { retrieveRedirect } from "utils/redirect";
+import { LoginPageView } from "./LoginPageView";
+import { getApplicationName } from "utils/appearance";
 
 export const LoginPage: FC = () => {
-  const location = useLocation()
-  const [authState, authSend] = useAuth()
-  const redirectTo = retrieveRedirect(location.search)
-  const commonTranslation = useTranslation("common")
-  const loginPageTranslation = useTranslation("loginPage")
+  const location = useLocation();
+  const {
+    isSignedIn,
+    isConfiguringTheFirstUser,
+    signIn,
+    isSigningIn,
+    authMethods,
+    signInError,
+  } = useAuth();
+  const redirectTo = retrieveRedirect(location.search);
+  const applicationName = getApplicationName();
+  const navigate = useNavigate();
 
-  if (authState.matches("signedIn")) {
-    return <Navigate to={redirectTo} replace />
-  } else if (authState.matches("configuringTheFirstUser")) {
-    return <Navigate to="/setup" />
+  if (isSignedIn) {
+    // If the redirect is going to a workspace application, and we
+    // are missing authentication, then we need to change the href location
+    // to trigger a HTTP request. This allows the BE to generate the auth
+    // cookie required.
+    // If no redirect is present, then ignore this branched logic.
+    if (redirectTo !== "" && redirectTo !== "/") {
+      try {
+        // This catches any absolute redirects. Relative redirects
+        // will fail the try/catch. Subdomain apps are absolute redirects.
+        const redirectURL = new URL(redirectTo);
+        if (redirectURL.host !== window.location.host) {
+          window.location.href = redirectTo;
+          return <></>;
+        }
+      } catch {
+        // Do nothing
+      }
+      // Path based apps.
+      if (redirectTo.includes("/apps/")) {
+        window.location.href = redirectTo;
+        return <></>;
+      }
+    }
+    return <Navigate to={redirectTo} replace />;
+  } else if (isConfiguringTheFirstUser) {
+    return <Navigate to="/setup" replace />;
   } else {
     return (
       <>
         <Helmet>
-          <title>
-            {loginPageTranslation.t("signInTo")} {commonTranslation.t("coder")}
-          </title>
+          <title>Sign in to {applicationName}</title>
         </Helmet>
         <LoginPageView
-          context={authState.context}
-          isLoading={authState.matches("loadingInitialAuthData")}
-          isSigningIn={authState.matches("signingIn")}
-          onSignIn={({ email, password }) => {
-            authSend({ type: "SIGN_IN", email, password })
+          authMethods={authMethods}
+          error={signInError}
+          isSigningIn={isSigningIn}
+          onSignIn={async ({ email, password }) => {
+            await signIn(email, password);
+            navigate("/");
           }}
         />
       </>
-    )
+    );
   }
-}
+};
 
-export default LoginPage
+export default LoginPage;
diff --git a/site/src/pages/LoginPage/LoginPageView.stories.tsx b/site/src/pages/LoginPage/LoginPageView.stories.tsx
index 23034508dbedd..13d1734507536 100644
--- a/site/src/pages/LoginPage/LoginPageView.stories.tsx
+++ b/site/src/pages/LoginPage/LoginPageView.stories.tsx
@@ -1,59 +1,40 @@
-import { action } from "@storybook/addon-actions"
-import { ComponentMeta, Story } from "@storybook/react"
-import { MockAuthMethods } from "testHelpers/entities"
-import { LoginPageView, LoginPageViewProps } from "./LoginPageView"
+import { MockAuthMethods, mockApiError } from "testHelpers/entities";
+import { LoginPageView } from "./LoginPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/LoginPageView",
+const meta: Meta<typeof LoginPageView> = {
+  title: "pages/LoginPage",
   component: LoginPageView,
-} as ComponentMeta<typeof LoginPageView>
+};
 
-const Template: Story<LoginPageViewProps> = (args) => (
-  <LoginPageView {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof LoginPageView>;
 
-export const Example = Template.bind({})
-Example.args = {
-  isLoading: false,
-  onSignIn: action("onSignIn"),
-  context: {
-    data: {
-      authMethods: MockAuthMethods,
-      hasFirstUser: false,
-    },
+export const Example: Story = {
+  args: {
+    authMethods: MockAuthMethods,
   },
-}
+};
 
-const err = new Error("Username or email are wrong.")
-
-export const AuthError = Template.bind({})
-AuthError.args = {
-  isLoading: false,
-  onSignIn: action("onSignIn"),
-  context: {
-    error: err,
-    data: {
-      authMethods: MockAuthMethods,
-      hasFirstUser: false,
-    },
+export const AuthError: Story = {
+  args: {
+    error: mockApiError({
+      message: "User or password is incorrect",
+      detail: "Please, try again",
+    }),
+    authMethods: MockAuthMethods,
   },
-}
+};
 
-export const LoadingInitialData = Template.bind({})
-LoadingInitialData.args = {
-  isLoading: true,
-  onSignIn: action("onSignIn"),
-  context: {},
-}
+export const LoadingAuthMethods: Story = {
+  args: {
+    authMethods: undefined,
+  },
+};
 
-export const SigningIn = Template.bind({})
-SigningIn.args = {
-  isSigningIn: true,
-  onSignIn: action("onSignIn"),
-  context: {
-    data: {
-      authMethods: MockAuthMethods,
-      hasFirstUser: false,
-    },
+export const SigningIn: Story = {
+  args: {
+    isSigningIn: true,
+    authMethods: MockAuthMethods,
   },
-}
+};
diff --git a/site/src/pages/LoginPage/LoginPageView.tsx b/site/src/pages/LoginPage/LoginPageView.tsx
index a58ccb6d47399..520de317c25f9 100644
--- a/site/src/pages/LoginPage/LoginPageView.tsx
+++ b/site/src/pages/LoginPage/LoginPageView.tsx
@@ -1,42 +1,55 @@
-import { makeStyles } from "@mui/styles"
-import { FullScreenLoader } from "components/Loader/FullScreenLoader"
-import { FC } from "react"
-import { useLocation } from "react-router-dom"
-import { AuthContext, UnauthenticatedData } from "xServices/auth/authXService"
-import { SignInForm } from "components/SignInForm/SignInForm"
-import { retrieveRedirect } from "utils/redirect"
-import { CoderIcon } from "components/Icons/CoderIcon"
+import { makeStyles } from "@mui/styles";
+import { FC } from "react";
+import { useLocation } from "react-router-dom";
+import { SignInForm } from "./SignInForm";
+import { retrieveRedirect } from "utils/redirect";
+import { CoderIcon } from "components/Icons/CoderIcon";
+import { getApplicationName, getLogoURL } from "utils/appearance";
+import { AuthMethods } from "api/typesGenerated";
 
 export interface LoginPageViewProps {
-  context: AuthContext
-  isLoading: boolean
-  isSigningIn: boolean
-  onSignIn: (credentials: { email: string; password: string }) => void
+  authMethods: AuthMethods | undefined;
+  error: unknown;
+  isSigningIn: boolean;
+  onSignIn: (credentials: { email: string; password: string }) => void;
 }
 
 export const LoginPageView: FC<LoginPageViewProps> = ({
-  context,
-  isLoading,
+  authMethods,
+  error,
   isSigningIn,
   onSignIn,
 }) => {
-  const location = useLocation()
-  const redirectTo = retrieveRedirect(location.search)
-  const { error } = context
-  const data = context.data as UnauthenticatedData
-  const styles = useStyles()
+  const location = useLocation();
+  const redirectTo = retrieveRedirect(location.search);
+  const styles = useStyles();
   // This allows messages to be displayed at the top of the sign in form.
   // Helpful for any redirects that want to inform the user of something.
-  const info = new URLSearchParams(location.search).get("info") || undefined
-
-  return isLoading ? (
-    <FullScreenLoader />
+  const info = new URLSearchParams(location.search).get("info") || undefined;
+  const applicationName = getApplicationName();
+  const logoURL = getLogoURL();
+  const applicationLogo = logoURL ? (
+    <img
+      alt={applicationName}
+      src={logoURL}
+      // This prevent browser to display the ugly error icon if the
+      // image path is wrong or user didn't finish typing the url
+      onError={(e) => (e.currentTarget.style.display = "none")}
+      onLoad={(e) => (e.currentTarget.style.display = "inline")}
+      css={{
+        maxWidth: "200px",
+      }}
+    />
   ) : (
+    <CoderIcon fill="white" opacity={1} className={styles.icon} />
+  );
+
+  return (
     <div className={styles.root}>
       <div className={styles.container}>
-        <CoderIcon fill="white" opacity={1} className={styles.icon} />
+        {applicationLogo}
         <SignInForm
-          authMethods={data.authMethods}
+          authMethods={authMethods}
           redirectTo={redirectTo}
           isSigningIn={isSigningIn}
           error={error}
@@ -48,8 +61,8 @@ export const LoginPageView: FC<LoginPageViewProps> = ({
         </footer>
       </div>
     </div>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   root: {
@@ -57,7 +70,7 @@ const useStyles = makeStyles((theme) => ({
     display: "flex",
     alignItems: "center",
     justifyContent: "center",
-    minHeight: "100vh",
+    minHeight: "100%",
     textAlign: "center",
   },
 
@@ -79,4 +92,4 @@ const useStyles = makeStyles((theme) => ({
     color: theme.palette.text.secondary,
     marginTop: theme.spacing(3),
   },
-}))
+}));
diff --git a/site/src/components/SignInForm/OAuthSignInForm.tsx b/site/src/pages/LoginPage/OAuthSignInForm.tsx
similarity index 75%
rename from site/src/components/SignInForm/OAuthSignInForm.tsx
rename to site/src/pages/LoginPage/OAuthSignInForm.tsx
index 1aea02533545e..0b8515b33e60c 100644
--- a/site/src/components/SignInForm/OAuthSignInForm.tsx
+++ b/site/src/pages/LoginPage/OAuthSignInForm.tsx
@@ -1,32 +1,32 @@
-import Link from "@mui/material/Link"
-import Button from "@mui/material/Button"
-import GitHubIcon from "@mui/icons-material/GitHub"
-import KeyIcon from "@mui/icons-material/VpnKey"
-import Box from "@mui/material/Box"
-import { Language } from "./SignInForm"
-import { AuthMethods } from "../../api/typesGenerated"
-import { FC } from "react"
-import { makeStyles } from "@mui/styles"
+import Link from "@mui/material/Link";
+import Button from "@mui/material/Button";
+import GitHubIcon from "@mui/icons-material/GitHub";
+import KeyIcon from "@mui/icons-material/VpnKey";
+import Box from "@mui/material/Box";
+import { Language } from "./SignInForm";
+import { AuthMethods } from "api/typesGenerated";
+import { FC } from "react";
+import { makeStyles } from "@mui/styles";
 
 type OAuthSignInFormProps = {
-  isSigningIn: boolean
-  redirectTo: string
-  authMethods?: AuthMethods
-}
+  isSigningIn: boolean;
+  redirectTo: string;
+  authMethods?: AuthMethods;
+};
 
 const useStyles = makeStyles((theme) => ({
   buttonIcon: {
     width: theme.spacing(2),
     height: theme.spacing(2),
   },
-}))
+}));
 
 export const OAuthSignInForm: FC<OAuthSignInFormProps> = ({
   isSigningIn,
   redirectTo,
   authMethods,
 }) => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <Box display="grid" gap="16px">
@@ -76,5 +76,5 @@ export const OAuthSignInForm: FC<OAuthSignInFormProps> = ({
         </Link>
       )}
     </Box>
-  )
-}
+  );
+};
diff --git a/site/src/pages/LoginPage/PasswordSignInForm.tsx b/site/src/pages/LoginPage/PasswordSignInForm.tsx
new file mode 100644
index 0000000000000..fe3252bfa1ccc
--- /dev/null
+++ b/site/src/pages/LoginPage/PasswordSignInForm.tsx
@@ -0,0 +1,75 @@
+import { Stack } from "components/Stack/Stack";
+import TextField from "@mui/material/TextField";
+import { getFormHelpers, onChangeTrimmed } from "utils/formUtils";
+import { Language } from "./SignInForm";
+import { FormikContextType, FormikTouched, useFormik } from "formik";
+import * as Yup from "yup";
+import { FC } from "react";
+import { BuiltInAuthFormValues } from "./SignInForm.types";
+import LoadingButton from "@mui/lab/LoadingButton";
+
+type PasswordSignInFormProps = {
+  onSubmit: (credentials: { email: string; password: string }) => void;
+  initialTouched?: FormikTouched<BuiltInAuthFormValues>;
+  isSigningIn: boolean;
+};
+
+export const PasswordSignInForm: FC<PasswordSignInFormProps> = ({
+  onSubmit,
+  initialTouched,
+  isSigningIn,
+}) => {
+  const validationSchema = Yup.object({
+    email: Yup.string()
+      .trim()
+      .email(Language.emailInvalid)
+      .required(Language.emailRequired),
+    password: Yup.string(),
+  });
+
+  const form: FormikContextType<BuiltInAuthFormValues> =
+    useFormik<BuiltInAuthFormValues>({
+      initialValues: {
+        email: "",
+        password: "",
+      },
+      validationSchema,
+      onSubmit,
+      initialTouched,
+    });
+  const getFieldHelpers = getFormHelpers<BuiltInAuthFormValues>(form);
+
+  return (
+    <form onSubmit={form.handleSubmit}>
+      <Stack spacing={2.5}>
+        <TextField
+          {...getFieldHelpers("email")}
+          onChange={onChangeTrimmed(form)}
+          autoFocus
+          autoComplete="email"
+          fullWidth
+          label={Language.emailLabel}
+          type="email"
+        />
+        <TextField
+          {...getFieldHelpers("password")}
+          autoComplete="current-password"
+          fullWidth
+          id="password"
+          label={Language.passwordLabel}
+          type="password"
+        />
+        <div>
+          <LoadingButton
+            size="large"
+            loading={isSigningIn}
+            fullWidth
+            type="submit"
+          >
+            {Language.passwordSignIn}
+          </LoadingButton>
+        </div>
+      </Stack>
+    </form>
+  );
+};
diff --git a/site/src/pages/LoginPage/SignInForm.stories.tsx b/site/src/pages/LoginPage/SignInForm.stories.tsx
new file mode 100644
index 0000000000000..7408eaa97c04d
--- /dev/null
+++ b/site/src/pages/LoginPage/SignInForm.stories.tsx
@@ -0,0 +1,94 @@
+import { mockApiError } from "testHelpers/entities";
+import { SignInForm } from "./SignInForm";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof SignInForm> = {
+  title: "pages/LoginPage/SignInForm",
+  component: SignInForm,
+  args: {
+    isSigningIn: false,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof SignInForm>;
+
+export const SignedOut: Story = {};
+
+export const SigningIn: Story = {
+  args: {
+    isSigningIn: true,
+    authMethods: {
+      password: { enabled: true },
+      github: { enabled: true },
+      oidc: { enabled: false, signInText: "", iconUrl: "" },
+    },
+  },
+};
+
+export const WithError: Story = {
+  args: {
+    error: mockApiError({
+      message: "Email or password was invalid",
+      validations: [
+        {
+          field: "password",
+          detail: "Password is invalid.",
+        },
+      ],
+    }),
+    initialTouched: {
+      password: true,
+    },
+  },
+};
+
+export const WithGithub: Story = {
+  args: {
+    authMethods: {
+      password: { enabled: true },
+      github: { enabled: true },
+      oidc: { enabled: false, signInText: "", iconUrl: "" },
+    },
+  },
+};
+
+export const WithOIDC: Story = {
+  args: {
+    authMethods: {
+      password: { enabled: true },
+      github: { enabled: false },
+      oidc: { enabled: true, signInText: "", iconUrl: "" },
+    },
+  },
+};
+
+export const WithOIDCWithoutPassword: Story = {
+  args: {
+    authMethods: {
+      password: { enabled: false },
+      github: { enabled: false },
+      oidc: { enabled: true, signInText: "", iconUrl: "" },
+    },
+  },
+};
+
+export const WithoutAny: Story = {
+  args: {
+    authMethods: {
+      password: { enabled: false },
+      github: { enabled: false },
+      oidc: { enabled: false, signInText: "", iconUrl: "" },
+    },
+  },
+};
+
+export const WithGithubAndOIDC: Story = {
+  args: {
+    authMethods: {
+      password: { enabled: true },
+      github: { enabled: true },
+      oidc: { enabled: true, signInText: "", iconUrl: "" },
+    },
+  },
+};
diff --git a/site/src/pages/LoginPage/SignInForm.tsx b/site/src/pages/LoginPage/SignInForm.tsx
new file mode 100644
index 0000000000000..7b93d35443ea3
--- /dev/null
+++ b/site/src/pages/LoginPage/SignInForm.tsx
@@ -0,0 +1,162 @@
+import { makeStyles } from "@mui/styles";
+import { FormikTouched } from "formik";
+import { FC, useState } from "react";
+import { AuthMethods } from "api/typesGenerated";
+import { PasswordSignInForm } from "./PasswordSignInForm";
+import { OAuthSignInForm } from "./OAuthSignInForm";
+import { BuiltInAuthFormValues } from "./SignInForm.types";
+import Button from "@mui/material/Button";
+import EmailIcon from "@mui/icons-material/EmailOutlined";
+import { Alert } from "components/Alert/Alert";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { getApplicationName } from "utils/appearance";
+
+export const Language = {
+  emailLabel: "Email",
+  passwordLabel: "Password",
+  emailInvalid: "Please enter a valid email address.",
+  emailRequired: "Please enter an email address.",
+  passwordSignIn: "Sign In",
+  githubSignIn: "GitHub",
+  oidcSignIn: "OpenID Connect",
+};
+
+const useStyles = makeStyles((theme) => ({
+  root: {
+    width: "100%",
+  },
+  title: {
+    fontSize: theme.spacing(4),
+    fontWeight: 400,
+    margin: 0,
+    marginBottom: theme.spacing(4),
+    lineHeight: 1,
+
+    "& strong": {
+      fontWeight: 600,
+    },
+  },
+  alert: {
+    marginBottom: theme.spacing(4),
+  },
+  divider: {
+    paddingTop: theme.spacing(3),
+    paddingBottom: theme.spacing(3),
+    display: "flex",
+    alignItems: "center",
+    gap: theme.spacing(2),
+  },
+  dividerLine: {
+    width: "100%",
+    height: 1,
+    backgroundColor: theme.palette.divider,
+  },
+  dividerLabel: {
+    flexShrink: 0,
+    color: theme.palette.text.secondary,
+    textTransform: "uppercase",
+    fontSize: 12,
+    letterSpacing: 1,
+  },
+  icon: {
+    width: theme.spacing(2),
+    height: theme.spacing(2),
+  },
+}));
+
+export interface SignInFormProps {
+  isSigningIn: boolean;
+  redirectTo: string;
+  error?: unknown;
+  info?: string;
+  authMethods?: AuthMethods;
+  onSubmit: (credentials: { email: string; password: string }) => void;
+  // initialTouched is only used for testing the error state of the form.
+  initialTouched?: FormikTouched<BuiltInAuthFormValues>;
+}
+
+export const SignInForm: FC<React.PropsWithChildren<SignInFormProps>> = ({
+  authMethods,
+  redirectTo,
+  isSigningIn,
+  error,
+  info,
+  onSubmit,
+  initialTouched,
+}) => {
+  const oAuthEnabled = Boolean(
+    authMethods?.github.enabled || authMethods?.oidc.enabled,
+  );
+  const passwordEnabled = authMethods?.password.enabled ?? true;
+  // Hide password auth by default if any OAuth method is enabled
+  const [showPasswordAuth, setShowPasswordAuth] = useState(!oAuthEnabled);
+  const styles = useStyles();
+  const applicationName = getApplicationName();
+
+  return (
+    <div className={styles.root}>
+      <h1 className={styles.title}>
+        Sign in to <strong>{applicationName}</strong>
+      </h1>
+
+      {Boolean(error) && (
+        <div className={styles.alert}>
+          <ErrorAlert error={error} />
+        </div>
+      )}
+
+      {Boolean(info) && Boolean(error) && (
+        <div className={styles.alert}>
+          <Alert severity="info">{info}</Alert>
+        </div>
+      )}
+
+      {passwordEnabled && showPasswordAuth && (
+        <PasswordSignInForm
+          onSubmit={onSubmit}
+          initialTouched={initialTouched}
+          isSigningIn={isSigningIn}
+        />
+      )}
+
+      {passwordEnabled && showPasswordAuth && oAuthEnabled && (
+        <div className={styles.divider}>
+          <div className={styles.dividerLine} />
+          <div className={styles.dividerLabel}>Or</div>
+          <div className={styles.dividerLine} />
+        </div>
+      )}
+
+      {oAuthEnabled && (
+        <OAuthSignInForm
+          isSigningIn={isSigningIn}
+          redirectTo={redirectTo}
+          authMethods={authMethods}
+        />
+      )}
+
+      {!passwordEnabled && !oAuthEnabled && (
+        <Alert severity="error">No authentication methods configured!</Alert>
+      )}
+
+      {passwordEnabled && !showPasswordAuth && (
+        <>
+          <div className={styles.divider}>
+            <div className={styles.dividerLine} />
+            <div className={styles.dividerLabel}>Or</div>
+            <div className={styles.dividerLine} />
+          </div>
+
+          <Button
+            fullWidth
+            size="large"
+            onClick={() => setShowPasswordAuth(true)}
+            startIcon={<EmailIcon className={styles.icon} />}
+          >
+            Email and password
+          </Button>
+        </>
+      )}
+    </div>
+  );
+};
diff --git a/site/src/components/SignInForm/SignInForm.types.ts b/site/src/pages/LoginPage/SignInForm.types.ts
similarity index 87%
rename from site/src/components/SignInForm/SignInForm.types.ts
rename to site/src/pages/LoginPage/SignInForm.types.ts
index 8965458bd8953..a143b46e4d27a 100644
--- a/site/src/components/SignInForm/SignInForm.types.ts
+++ b/site/src/pages/LoginPage/SignInForm.types.ts
@@ -4,6 +4,6 @@
  * auth providers available and administrative configurations
  */
 export interface BuiltInAuthFormValues {
-  email: string
-  password: string
+  email: string;
+  password: string;
 }
diff --git a/site/src/pages/SetupPage/SetupPage.test.tsx b/site/src/pages/SetupPage/SetupPage.test.tsx
index 7d53fe1dce8c2..7a6718cff740e 100644
--- a/site/src/pages/SetupPage/SetupPage.test.tsx
+++ b/site/src/pages/SetupPage/SetupPage.test.tsx
@@ -1,85 +1,101 @@
-import { fireEvent, screen, waitFor } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
-import { rest } from "msw"
-import { render } from "testHelpers/renderHelpers"
-import { server } from "testHelpers/server"
-import { SetupPage } from "./SetupPage"
-import { Language as PageViewLanguage } from "./SetupPageView"
-import { MockUser } from "testHelpers/entities"
+import { fireEvent, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { rest } from "msw";
+import { createMemoryRouter } from "react-router-dom";
+import {
+  renderWithRouter,
+  waitForLoaderToBeRemoved,
+} from "testHelpers/renderHelpers";
+import { server } from "testHelpers/server";
+import { SetupPage } from "./SetupPage";
+import { Language as PageViewLanguage } from "./SetupPageView";
+import { MockUser } from "testHelpers/entities";
 
 const fillForm = async ({
   username = "someuser",
   email = "someone@coder.com",
   password = "password",
 }: {
-  username?: string
-  email?: string
-  password?: string
+  username?: string;
+  email?: string;
+  password?: string;
 } = {}) => {
-  const usernameField = screen.getByLabelText(PageViewLanguage.usernameLabel)
-  const emailField = screen.getByLabelText(PageViewLanguage.emailLabel)
-  const passwordField = screen.getByLabelText(PageViewLanguage.passwordLabel)
-  await userEvent.type(usernameField, username)
-  await userEvent.type(emailField, email)
-  await userEvent.type(passwordField, password)
+  const usernameField = screen.getByLabelText(PageViewLanguage.usernameLabel);
+  const emailField = screen.getByLabelText(PageViewLanguage.emailLabel);
+  const passwordField = screen.getByLabelText(PageViewLanguage.passwordLabel);
+  await userEvent.type(usernameField, username);
+  await userEvent.type(emailField, email);
+  await userEvent.type(passwordField, password);
   const submitButton = screen.getByRole("button", {
     name: PageViewLanguage.create,
-  })
-  fireEvent.click(submitButton)
-}
+  });
+  fireEvent.click(submitButton);
+};
 
 describe("Setup Page", () => {
   beforeEach(() => {
     // appear logged out
     server.use(
       rest.get("/api/v2/users/me", (req, res, ctx) => {
-        return res(ctx.status(401), ctx.json({ message: "no user here" }))
+        return res(ctx.status(401), ctx.json({ message: "no user here" }));
       }),
-    )
-  })
-
-  it("shows validation error message", async () => {
-    render(<SetupPage />)
-    await fillForm({ email: "test" })
-    const errorMessage = await screen.findByText(PageViewLanguage.emailInvalid)
-    expect(errorMessage).toBeDefined()
-  })
-
-  it("shows API error message", async () => {
-    const fieldErrorMessage = "invalid username"
-    server.use(
-      rest.post("/api/v2/users/first", async (req, res, ctx) => {
+      rest.get("/api/v2/users/first", (req, res, ctx) => {
         return res(
-          ctx.status(400),
-          ctx.json({
-            message: "invalid field",
-            validations: [
-              {
-                detail: fieldErrorMessage,
-                field: "username",
-              },
-            ],
-          }),
-        )
+          ctx.status(404),
+          ctx.json({ message: "no first user has been created" }),
+        );
       }),
-    )
-    render(<SetupPage />)
-    await fillForm()
-    const errorMessage = await screen.findByText(fieldErrorMessage)
-    expect(errorMessage).toBeDefined()
-  })
+    );
+  });
 
-  it("redirects to workspaces page when success", async () => {
-    render(<SetupPage />)
+  it("redirects to the app when setup is successful", async () => {
+    let userHasBeenCreated = false;
 
-    // simulates the user will be authenticated
     server.use(
       rest.get("/api/v2/users/me", (req, res, ctx) => {
-        return res(ctx.status(200), ctx.json(MockUser))
+        if (!userHasBeenCreated) {
+          return res(ctx.status(401), ctx.json({ message: "no user here" }));
+        }
+        return res(ctx.status(200), ctx.json(MockUser));
+      }),
+      rest.get("/api/v2/users/first", (req, res, ctx) => {
+        if (!userHasBeenCreated) {
+          return res(
+            ctx.status(404),
+            ctx.json({ message: "no first user has been created" }),
+          );
+        }
+        return res(
+          ctx.status(200),
+          ctx.json({ message: "hooray, someone exists!" }),
+        );
+      }),
+      rest.post("/api/v2/users/first", (req, res, ctx) => {
+        userHasBeenCreated = true;
+        return res(
+          ctx.status(200),
+          ctx.json({ data: "user setup was successful!" }),
+        );
       }),
-    )
+    );
 
-    await fillForm()
-    await waitFor(() => expect(window.location).toBeAt("/workspaces"))
-  })
-})
+    renderWithRouter(
+      createMemoryRouter(
+        [
+          {
+            path: "/setup",
+            element: <SetupPage />,
+          },
+          {
+            path: "/",
+            element: <h1>Workspaces</h1>,
+          },
+        ],
+        { initialEntries: ["/setup"] },
+      ),
+    );
+    await waitForLoaderToBeRemoved();
+    await fillForm();
+    await waitFor(() => screen.findByText("Workspaces"));
+  });
+});
diff --git a/site/src/pages/SetupPage/SetupPage.tsx b/site/src/pages/SetupPage/SetupPage.tsx
index 56c9b9b78f5f0..7dae420224546 100644
--- a/site/src/pages/SetupPage/SetupPage.tsx
+++ b/site/src/pages/SetupPage/SetupPage.tsx
@@ -1,34 +1,28 @@
-import { useMachine } from "@xstate/react"
-import { useAuth } from "components/AuthProvider/AuthProvider"
-import { FC, useEffect } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { setupMachine } from "xServices/setup/setupXService"
-import { SetupPageView } from "./SetupPageView"
+import { useAuth } from "components/AuthProvider/AuthProvider";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { SetupPageView } from "./SetupPageView";
+import { Navigate, useNavigate } from "react-router-dom";
+import { useMutation } from "react-query";
+import { createFirstUser } from "api/queries/users";
 
 export const SetupPage: FC = () => {
-  const [authState, authSend] = useAuth()
-  const [setupState, setupSend] = useMachine(setupMachine, {
-    actions: {
-      onCreateFirstUser: ({ firstUser }) => {
-        if (!firstUser) {
-          throw new Error("First user was not defined.")
-        }
-        authSend({
-          type: "SIGN_IN",
-          email: firstUser.email,
-          password: firstUser.password,
-        })
-      },
-    },
-  })
-  const { error } = setupState.context
+  const { signIn, isConfiguringTheFirstUser, isSignedIn, isSigningIn } =
+    useAuth();
+  const createFirstUserMutation = useMutation(createFirstUser());
+  const setupIsComplete = !isConfiguringTheFirstUser;
+  const navigate = useNavigate();
 
-  useEffect(() => {
-    if (authState.matches("signedIn")) {
-      window.location.assign("/workspaces")
-    }
-  }, [authState])
+  // If the user is logged in, navigate to the app
+  if (isSignedIn) {
+    return <Navigate to="/" state={{ isRedirect: true }} replace />;
+  }
+
+  // If we've already completed setup, navigate to the login page
+  if (setupIsComplete) {
+    return <Navigate to="/login" state={{ isRedirect: true }} replace />;
+  }
 
   return (
     <>
@@ -36,12 +30,14 @@ export const SetupPage: FC = () => {
         <title>{pageTitle("Set up your account")}</title>
       </Helmet>
       <SetupPageView
-        isLoading={setupState.hasTag("loading")}
-        error={error}
-        onSubmit={(firstUser) => {
-          setupSend({ type: "CREATE_FIRST_USER", firstUser })
+        isLoading={createFirstUserMutation.isLoading || isSigningIn}
+        error={createFirstUserMutation.error}
+        onSubmit={async (firstUser) => {
+          await createFirstUserMutation.mutateAsync(firstUser);
+          await signIn(firstUser.email, firstUser.password);
+          navigate("/");
         }}
       />
     </>
-  )
-}
+  );
+};
diff --git a/site/src/pages/SetupPage/SetupPageView.stories.tsx b/site/src/pages/SetupPage/SetupPageView.stories.tsx
index d39e62a2626c6..98f388043efed 100644
--- a/site/src/pages/SetupPage/SetupPageView.stories.tsx
+++ b/site/src/pages/SetupPage/SetupPageView.stories.tsx
@@ -1,32 +1,27 @@
-import { action } from "@storybook/addon-actions"
-import { Story } from "@storybook/react"
-import { SetupPageView, SetupPageViewProps } from "./SetupPageView"
-import { mockApiError } from "testHelpers/entities"
+import { SetupPageView } from "./SetupPageView";
+import { mockApiError } from "testHelpers/entities";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/SetupPageView",
+const meta: Meta<typeof SetupPageView> = {
+  title: "pages/SetupPage",
   component: SetupPageView,
-}
+};
 
-const Template: Story<SetupPageViewProps> = (args: SetupPageViewProps) => (
-  <SetupPageView {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof SetupPageView>;
 
-export const Ready = Template.bind({})
-Ready.args = {
-  onSubmit: action("submit"),
-}
+export const Ready: Story = {};
 
-export const FormError = Template.bind({})
-FormError.args = {
-  onSubmit: action("submit"),
-  error: mockApiError({
-    validations: [{ field: "username", detail: "Username taken" }],
-  }),
-}
+export const FormError: Story = {
+  args: {
+    error: mockApiError({
+      validations: [{ field: "username", detail: "Username taken" }],
+    }),
+  },
+};
 
-export const Loading = Template.bind({})
-Loading.args = {
-  onSubmit: action("submit"),
-  isLoading: true,
-}
+export const Loading: Story = {
+  args: {
+    isLoading: true,
+  },
+};
diff --git a/site/src/pages/SetupPage/SetupPageView.tsx b/site/src/pages/SetupPage/SetupPageView.tsx
index df6fedc2f0764..43830ee701d77 100644
--- a/site/src/pages/SetupPage/SetupPageView.tsx
+++ b/site/src/pages/SetupPage/SetupPageView.tsx
@@ -1,16 +1,19 @@
-import Box from "@mui/material/Box"
-import Checkbox from "@mui/material/Checkbox"
-import { makeStyles } from "@mui/styles"
-import TextField from "@mui/material/TextField"
-import Typography from "@mui/material/Typography"
-import { LoadingButton } from "components/LoadingButton/LoadingButton"
-import { SignInLayout } from "components/SignInLayout/SignInLayout"
-import { Stack } from "components/Stack/Stack"
-import { Welcome } from "components/Welcome/Welcome"
-import { FormikContextType, useFormik } from "formik"
-import { getFormHelpers, nameValidator, onChangeTrimmed } from "utils/formUtils"
-import * as Yup from "yup"
-import * as TypesGen from "../../api/typesGenerated"
+import Box from "@mui/material/Box";
+import Checkbox from "@mui/material/Checkbox";
+import TextField from "@mui/material/TextField";
+import Typography from "@mui/material/Typography";
+import { SignInLayout } from "components/SignInLayout/SignInLayout";
+import { Stack } from "components/Stack/Stack";
+import { Welcome } from "components/Welcome/Welcome";
+import { type FormikContextType, useFormik } from "formik";
+import {
+  getFormHelpers,
+  nameValidator,
+  onChangeTrimmed,
+} from "utils/formUtils";
+import * as Yup from "yup";
+import type * as TypesGen from "api/typesGenerated";
+import LoadingButton from "@mui/lab/LoadingButton";
 
 export const Language = {
   emailLabel: "Email",
@@ -21,7 +24,7 @@ export const Language = {
   passwordRequired: "Please enter a password.",
   create: "Create account",
   welcomeMessage: <>Welcome to Coder</>,
-}
+};
 
 const validationSchema = Yup.object({
   email: Yup.string()
@@ -30,12 +33,12 @@ const validationSchema = Yup.object({
     .required(Language.emailRequired),
   password: Yup.string().required(Language.passwordRequired),
   username: nameValidator(Language.usernameLabel),
-})
+});
 
 export interface SetupPageViewProps {
-  onSubmit: (firstUser: TypesGen.CreateFirstUserRequest) => void
-  error?: unknown
-  isLoading?: boolean
+  onSubmit: (firstUser: TypesGen.CreateFirstUserRequest) => void;
+  error?: unknown;
+  isLoading?: boolean;
 }
 
 export const SetupPageView: React.FC<SetupPageViewProps> = ({
@@ -53,12 +56,11 @@ export const SetupPageView: React.FC<SetupPageViewProps> = ({
       },
       validationSchema,
       onSubmit,
-    })
+    });
   const getFieldHelpers = getFormHelpers<TypesGen.CreateFirstUserRequest>(
     form,
     error,
-  )
-  const styles = useStyles()
+  );
 
   return (
     <SignInLayout>
@@ -87,7 +89,7 @@ export const SetupPageView: React.FC<SetupPageViewProps> = ({
             label={Language.passwordLabel}
             type="password"
           />
-          <div className={styles.callout}>
+          <div css={{ borderRadius: 16 }}>
             <Box display="flex">
               <div>
                 <Checkbox
@@ -122,11 +124,5 @@ export const SetupPageView: React.FC<SetupPageViewProps> = ({
         </Stack>
       </form>
     </SignInLayout>
-  )
-}
-
-const useStyles = makeStyles(() => ({
-  callout: {
-    borderRadius: 16,
-  },
-}))
+  );
+};
diff --git a/site/src/pages/StarterTemplatePage/StarterTemplatePage.test.tsx b/site/src/pages/StarterTemplatePage/StarterTemplatePage.test.tsx
deleted file mode 100644
index 482a7d2e2c726..0000000000000
--- a/site/src/pages/StarterTemplatePage/StarterTemplatePage.test.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-import { screen } from "@testing-library/react"
-import { MockTemplateExample } from "testHelpers/entities"
-import {
-  renderWithAuth,
-  waitForLoaderToBeRemoved,
-} from "testHelpers/renderHelpers"
-import StarterTemplatePage from "./StarterTemplatePage"
-
-jest.mock("remark-gfm", () => jest.fn())
-
-describe("StarterTemplatePage", () => {
-  it("shows the starter template", async () => {
-    renderWithAuth(<StarterTemplatePage />, {
-      route: `/starter-templates/${MockTemplateExample.id}`,
-      path: "/starter-templates/:exampleId",
-    })
-    await waitForLoaderToBeRemoved()
-    expect(screen.getByText(MockTemplateExample.name)).toBeInTheDocument()
-  })
-})
diff --git a/site/src/pages/StarterTemplatePage/StarterTemplatePage.tsx b/site/src/pages/StarterTemplatePage/StarterTemplatePage.tsx
index 59af54fdc79de..6ab267692e5e3 100644
--- a/site/src/pages/StarterTemplatePage/StarterTemplatePage.tsx
+++ b/site/src/pages/StarterTemplatePage/StarterTemplatePage.tsx
@@ -1,33 +1,32 @@
-import { useMachine } from "@xstate/react"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useParams } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import { starterTemplateMachine } from "xServices/starterTemplates/starterTemplateXService"
-import { StarterTemplatePageView } from "./StarterTemplatePageView"
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { useParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import { StarterTemplatePageView } from "./StarterTemplatePageView";
+import { useQuery } from "react-query";
+import { templateExamples } from "api/queries/templates";
 
 const StarterTemplatePage: FC = () => {
-  const { exampleId } = useParams() as { exampleId: string }
-  const organizationId = useOrganizationId()
-  const [state] = useMachine(starterTemplateMachine, {
-    context: {
-      organizationId,
-      exampleId,
-    },
-  })
+  const { exampleId } = useParams() as { exampleId: string };
+  const organizationId = useOrganizationId();
+  const templateExamplesQuery = useQuery(templateExamples(organizationId));
+  const starterTemplate = templateExamplesQuery.data?.find(
+    (example) => example.id === exampleId,
+  );
 
   return (
     <>
       <Helmet>
-        <title>
-          {pageTitle(state.context.starterTemplate?.name ?? exampleId)}
-        </title>
+        <title>{pageTitle(starterTemplate?.name ?? exampleId)}</title>
       </Helmet>
 
-      <StarterTemplatePageView context={state.context} />
+      <StarterTemplatePageView
+        starterTemplate={starterTemplate}
+        error={templateExamplesQuery.error}
+      />
     </>
-  )
-}
+  );
+};
 
-export default StarterTemplatePage
+export default StarterTemplatePage;
diff --git a/site/src/pages/StarterTemplatePage/StarterTemplatePageView.stories.tsx b/site/src/pages/StarterTemplatePage/StarterTemplatePageView.stories.tsx
index 5f373e32ae958..7324433985ea2 100644
--- a/site/src/pages/StarterTemplatePage/StarterTemplatePageView.stories.tsx
+++ b/site/src/pages/StarterTemplatePage/StarterTemplatePageView.stories.tsx
@@ -1,41 +1,27 @@
-import { Story } from "@storybook/react"
-import {
-  mockApiError,
-  MockOrganization,
-  MockTemplateExample,
-} from "testHelpers/entities"
-import {
-  StarterTemplatePageView,
-  StarterTemplatePageViewProps,
-} from "./StarterTemplatePageView"
+import { mockApiError, MockTemplateExample } from "testHelpers/entities";
+import { StarterTemplatePageView } from "./StarterTemplatePageView";
 
-export default {
-  title: "pages/StarterTemplatePageView",
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof StarterTemplatePageView> = {
+  title: "pages/StarterTemplatePage",
   component: StarterTemplatePageView,
-}
+};
 
-const Template: Story<StarterTemplatePageViewProps> = (args) => (
-  <StarterTemplatePageView {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof StarterTemplatePageView>;
 
-export const Default = Template.bind({})
-Default.args = {
-  context: {
-    exampleId: MockTemplateExample.id,
-    organizationId: MockOrganization.id,
+export const Example: Story = {
+  args: {
     error: undefined,
     starterTemplate: MockTemplateExample,
   },
-}
-
-export const Error = Template.bind({})
-Error.args = {
-  context: {
-    exampleId: MockTemplateExample.id,
-    organizationId: MockOrganization.id,
+};
+export const Error: Story = {
+  args: {
     error: mockApiError({
       message: `Example ${MockTemplateExample.id} not found.`,
     }),
     starterTemplate: undefined,
   },
-}
+};
diff --git a/site/src/pages/StarterTemplatePage/StarterTemplatePageView.tsx b/site/src/pages/StarterTemplatePage/StarterTemplatePageView.tsx
index 44fad0aa1714d..0264ce0eef4b4 100644
--- a/site/src/pages/StarterTemplatePage/StarterTemplatePageView.tsx
+++ b/site/src/pages/StarterTemplatePage/StarterTemplatePageView.tsx
@@ -1,43 +1,42 @@
-import Button from "@mui/material/Button"
-import { makeStyles } from "@mui/styles"
-import { Loader } from "components/Loader/Loader"
-import { Margins } from "components/Margins/Margins"
-import { MemoizedMarkdown } from "components/Markdown/Markdown"
+import Button from "@mui/material/Button";
+import { makeStyles } from "@mui/styles";
+import { Loader } from "components/Loader/Loader";
+import { Margins } from "components/Margins/Margins";
+import { MemoizedMarkdown } from "components/Markdown/Markdown";
 import {
   PageHeader,
   PageHeaderSubtitle,
   PageHeaderTitle,
-} from "components/PageHeader/PageHeader"
-import { FC } from "react"
-import { StarterTemplateContext } from "xServices/starterTemplates/starterTemplateXService"
-import ViewCodeIcon from "@mui/icons-material/OpenInNewOutlined"
-import PlusIcon from "@mui/icons-material/AddOutlined"
-import { useTranslation } from "react-i18next"
-import { Stack } from "components/Stack/Stack"
-import { Link } from "react-router-dom"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
+} from "components/PageHeader/PageHeader";
+import { FC } from "react";
+import ViewCodeIcon from "@mui/icons-material/OpenInNewOutlined";
+import PlusIcon from "@mui/icons-material/AddOutlined";
+import { Stack } from "components/Stack/Stack";
+import { Link } from "react-router-dom";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { TemplateExample } from "api/typesGenerated";
 
 export interface StarterTemplatePageViewProps {
-  context: StarterTemplateContext
+  starterTemplate?: TemplateExample;
+  error?: unknown;
 }
 
 export const StarterTemplatePageView: FC<StarterTemplatePageViewProps> = ({
-  context,
+  starterTemplate,
+  error,
 }) => {
-  const styles = useStyles()
-  const { starterTemplate } = context
-  const { t } = useTranslation("starterTemplatePage")
+  const styles = useStyles();
 
-  if (context.error) {
+  if (error) {
     return (
       <Margins>
-        <ErrorAlert error={context.error} />
+        <ErrorAlert error={error} />
       </Margins>
-    )
+    );
   }
 
   if (!starterTemplate) {
-    return <Loader />
+    return <Loader />;
   }
 
   return (
@@ -52,7 +51,7 @@ export const StarterTemplatePageView: FC<StarterTemplatePageViewProps> = ({
               rel="noreferrer"
               startIcon={<ViewCodeIcon />}
             >
-              {t("actions.viewSourceCode")}
+              View source code
             </Button>
             <Button
               variant="contained"
@@ -60,7 +59,7 @@ export const StarterTemplatePageView: FC<StarterTemplatePageViewProps> = ({
               to={`/templates/new?exampleId=${starterTemplate.id}`}
               startIcon={<PlusIcon />}
             >
-              {t("actions.useTemplate")}
+              Use template
             </Button>
           </>
         }
@@ -84,8 +83,8 @@ export const StarterTemplatePageView: FC<StarterTemplatePageViewProps> = ({
         </div>
       </div>
     </Margins>
-  )
-}
+  );
+};
 
 export const useStyles = makeStyles((theme) => {
   return {
@@ -112,5 +111,5 @@ export const useStyles = makeStyles((theme) => {
       maxWidth: 800,
       margin: "auto",
     },
-  }
-})
+  };
+});
diff --git a/site/src/pages/StarterTemplatesPage/StarterTemplatesPage.test.tsx b/site/src/pages/StarterTemplatesPage/StarterTemplatesPage.test.tsx
deleted file mode 100644
index ba3addc537753..0000000000000
--- a/site/src/pages/StarterTemplatesPage/StarterTemplatesPage.test.tsx
+++ /dev/null
@@ -1,19 +0,0 @@
-import { screen } from "@testing-library/react"
-import { MockTemplateExample, MockTemplateExample2 } from "testHelpers/entities"
-import {
-  renderWithAuth,
-  waitForLoaderToBeRemoved,
-} from "testHelpers/renderHelpers"
-import StarterTemplatesPage from "./StarterTemplatesPage"
-
-describe("StarterTemplatesPage", () => {
-  it("shows the starter template", async () => {
-    renderWithAuth(<StarterTemplatesPage />, {
-      route: `/starter-templates`,
-      path: "/starter-templates",
-    })
-    await waitForLoaderToBeRemoved()
-    expect(screen.getByText(MockTemplateExample.name)).toBeInTheDocument()
-    expect(screen.getByText(MockTemplateExample2.name)).toBeInTheDocument()
-  })
-})
diff --git a/site/src/pages/StarterTemplatesPage/StarterTemplatesPage.tsx b/site/src/pages/StarterTemplatesPage/StarterTemplatesPage.tsx
index 973c6d709c7d8..ab0a024a2845f 100644
--- a/site/src/pages/StarterTemplatesPage/StarterTemplatesPage.tsx
+++ b/site/src/pages/StarterTemplatesPage/StarterTemplatesPage.tsx
@@ -1,28 +1,31 @@
-import { useMachine } from "@xstate/react"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useTranslation } from "react-i18next"
-import { pageTitle } from "utils/page"
-import { starterTemplatesMachine } from "xServices/starterTemplates/starterTemplatesXService"
-import { StarterTemplatesPageView } from "./StarterTemplatesPageView"
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { StarterTemplatesPageView } from "./StarterTemplatesPageView";
+import { useQuery } from "react-query";
+import { templateExamples } from "api/queries/templates";
+import { getTemplatesByTag } from "utils/starterTemplates";
 
 const StarterTemplatesPage: FC = () => {
-  const { t } = useTranslation("starterTemplatesPage")
-  const organizationId = useOrganizationId()
-  const [state] = useMachine(starterTemplatesMachine, {
-    context: { organizationId },
-  })
+  const organizationId = useOrganizationId();
+  const templateExamplesQuery = useQuery(templateExamples(organizationId));
+  const starterTemplatesByTag = templateExamplesQuery.data
+    ? getTemplatesByTag(templateExamplesQuery.data)
+    : undefined;
 
   return (
     <>
       <Helmet>
-        <title>{pageTitle(t("title").toString())}</title>
+        <title>{pageTitle("Starter Templates")}</title>
       </Helmet>
 
-      <StarterTemplatesPageView context={state.context} />
+      <StarterTemplatesPageView
+        error={templateExamplesQuery.error}
+        starterTemplatesByTag={starterTemplatesByTag}
+      />
     </>
-  )
-}
+  );
+};
 
-export default StarterTemplatesPage
+export default StarterTemplatesPage;
diff --git a/site/src/pages/StarterTemplatesPage/StarterTemplatesPageView.stories.tsx b/site/src/pages/StarterTemplatesPage/StarterTemplatesPageView.stories.tsx
index b5c4f52b95a5c..6f648f376b71c 100644
--- a/site/src/pages/StarterTemplatesPage/StarterTemplatesPageView.stories.tsx
+++ b/site/src/pages/StarterTemplatesPage/StarterTemplatesPageView.stories.tsx
@@ -1,44 +1,35 @@
-import { Story } from "@storybook/react"
 import {
   mockApiError,
-  MockOrganization,
   MockTemplateExample,
   MockTemplateExample2,
-} from "testHelpers/entities"
-import { getTemplatesByTag } from "utils/starterTemplates"
-import {
-  StarterTemplatesPageView,
-  StarterTemplatesPageViewProps,
-} from "./StarterTemplatesPageView"
+} from "testHelpers/entities";
+import { getTemplatesByTag } from "utils/starterTemplates";
+import { StarterTemplatesPageView } from "./StarterTemplatesPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/StarterTemplatesPageView",
+const meta: Meta<typeof StarterTemplatesPageView> = {
+  title: "pages/StarterTemplatesPage",
   component: StarterTemplatesPageView,
-}
+};
 
-const Template: Story<StarterTemplatesPageViewProps> = (args) => (
-  <StarterTemplatesPageView {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof StarterTemplatesPageView>;
 
-export const Default = Template.bind({})
-Default.args = {
-  context: {
-    organizationId: MockOrganization.id,
+export const Example: Story = {
+  args: {
     error: undefined,
     starterTemplatesByTag: getTemplatesByTag([
       MockTemplateExample,
       MockTemplateExample2,
     ]),
   },
-}
+};
 
-export const Error = Template.bind({})
-Error.args = {
-  context: {
-    organizationId: MockOrganization.id,
+export const Error: Story = {
+  args: {
     error: mockApiError({
       message: "Error on loading the template examples",
     }),
     starterTemplatesByTag: undefined,
   },
-}
+};
diff --git a/site/src/pages/StarterTemplatesPage/StarterTemplatesPageView.tsx b/site/src/pages/StarterTemplatesPage/StarterTemplatesPageView.tsx
index 28ac49a207543..5a7e5e1b830b3 100644
--- a/site/src/pages/StarterTemplatesPage/StarterTemplatesPageView.tsx
+++ b/site/src/pages/StarterTemplatesPage/StarterTemplatesPageView.tsx
@@ -1,73 +1,71 @@
-import { makeStyles } from "@mui/styles"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
-import { Maybe } from "components/Conditionals/Maybe"
-import { Loader } from "components/Loader/Loader"
-import { Margins } from "components/Margins/Margins"
+import { makeStyles } from "@mui/styles";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { Loader } from "components/Loader/Loader";
+import { Margins } from "components/Margins/Margins";
 import {
   PageHeader,
   PageHeaderSubtitle,
   PageHeaderTitle,
-} from "components/PageHeader/PageHeader"
-import { Stack } from "components/Stack/Stack"
-import { TemplateExampleCard } from "components/TemplateExampleCard/TemplateExampleCard"
-import { FC } from "react"
-import { useTranslation } from "react-i18next"
-import { Link, useSearchParams } from "react-router-dom"
-import { combineClasses } from "utils/combineClasses"
-import { StarterTemplatesContext } from "xServices/starterTemplates/starterTemplatesXService"
+} from "components/PageHeader/PageHeader";
+import { Stack } from "components/Stack/Stack";
+import { TemplateExampleCard } from "components/TemplateExampleCard/TemplateExampleCard";
+import { FC } from "react";
+import { Link, useSearchParams } from "react-router-dom";
+import { combineClasses } from "utils/combineClasses";
+import { StarterTemplatesByTag } from "utils/starterTemplates";
 
-const getTagLabel = (tag: string, t: (key: string) => string) => {
+const getTagLabel = (tag: string) => {
   const labelByTag: Record<string, string> = {
-    all: t("tags.all"),
-    digitalocean: t("tags.digitalocean"),
-    aws: t("tags.aws"),
-    google: t("tags.google"),
-  }
+    all: "All templates",
+    digitalocean: "DigitalOcean",
+    aws: "AWS",
+    google: "Google Cloud",
+  };
   // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- this can be undefined
-  return labelByTag[tag] ?? tag
-}
+  return labelByTag[tag] ?? tag;
+};
 
-const selectTags = ({ starterTemplatesByTag }: StarterTemplatesContext) => {
+const selectTags = (starterTemplatesByTag: StarterTemplatesByTag) => {
   return starterTemplatesByTag
     ? Object.keys(starterTemplatesByTag).sort((a, b) => a.localeCompare(b))
-    : undefined
-}
+    : undefined;
+};
 export interface StarterTemplatesPageViewProps {
-  context: StarterTemplatesContext
+  starterTemplatesByTag?: StarterTemplatesByTag;
+  error?: unknown;
 }
 
 export const StarterTemplatesPageView: FC<StarterTemplatesPageViewProps> = ({
-  context,
+  starterTemplatesByTag,
+  error,
 }) => {
-  const { t } = useTranslation("starterTemplatesPage")
-  const [urlParams] = useSearchParams()
-  const styles = useStyles()
-  const { starterTemplatesByTag } = context
-  const tags = selectTags(context)
-  const activeTag = urlParams.get("tag") ?? "all"
+  const [urlParams] = useSearchParams();
+  const styles = useStyles();
+  const tags = starterTemplatesByTag
+    ? selectTags(starterTemplatesByTag)
+    : undefined;
+  const activeTag = urlParams.get("tag") ?? "all";
   const visibleTemplates = starterTemplatesByTag
     ? starterTemplatesByTag[activeTag]
-    : undefined
+    : undefined;
 
   return (
     <Margins>
       <PageHeader>
-        <PageHeaderTitle>{t("title")}</PageHeaderTitle>
-        <PageHeaderSubtitle>{t("subtitle")}</PageHeaderSubtitle>
+        <PageHeaderTitle>Starter Templates</PageHeaderTitle>
+        <PageHeaderSubtitle>
+          Import a built-in template to start developing in the cloud
+        </PageHeaderSubtitle>
       </PageHeader>
 
-      <Maybe condition={Boolean(context.error)}>
-        <ErrorAlert error={context.error} />
-      </Maybe>
+      {Boolean(error) && <ErrorAlert error={error} />}
 
-      <Maybe condition={Boolean(!starterTemplatesByTag)}>
-        <Loader />
-      </Maybe>
+      {Boolean(!starterTemplatesByTag) && <Loader />}
 
       <Stack direction="row" spacing={4}>
         {starterTemplatesByTag && tags && (
           <Stack className={styles.filter}>
-            <span className={styles.filterCaption}>{t("filterCaption")}</span>
+            <span className={styles.filterCaption}>Filter</span>
             {tags.map((tag) => (
               <Link
                 key={tag}
@@ -77,7 +75,7 @@ export const StarterTemplatesPageView: FC<StarterTemplatesPageViewProps> = ({
                   [styles.tagLinkActive]: tag === activeTag,
                 })}
               >
-                {getTagLabel(tag, t)} ({starterTemplatesByTag[tag].length})
+                {getTagLabel(tag)} ({starterTemplatesByTag[tag].length})
               </Link>
             ))}
           </Stack>
@@ -91,8 +89,8 @@ export const StarterTemplatesPageView: FC<StarterTemplatesPageViewProps> = ({
         </div>
       </Stack>
     </Margins>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   filter: {
@@ -131,4 +129,4 @@ const useStyles = makeStyles((theme) => ({
     gap: theme.spacing(2),
     gridAutoRows: "min-content",
   },
-}))
+}));
diff --git a/site/src/pages/TemplatePage/TemplateDocsPage/TemplateDocsPage.test.tsx b/site/src/pages/TemplatePage/TemplateDocsPage/TemplateDocsPage.test.tsx
deleted file mode 100644
index 793a7c01d9153..0000000000000
--- a/site/src/pages/TemplatePage/TemplateDocsPage/TemplateDocsPage.test.tsx
+++ /dev/null
@@ -1,31 +0,0 @@
-import { screen } from "@testing-library/react"
-import { TemplateLayout } from "components/TemplateLayout/TemplateLayout"
-import { ResizeObserver } from "resize-observer"
-import { renderWithAuth } from "testHelpers/renderHelpers"
-import TemplateDocsPage from "./TemplateDocsPage"
-
-jest.mock("remark-gfm", () => jest.fn())
-
-const TEMPLATE_NAME = "coder-ts"
-
-Object.defineProperty(window, "ResizeObserver", {
-  value: ResizeObserver,
-})
-
-const renderPage = () =>
-  renderWithAuth(
-    <TemplateLayout>
-      <TemplateDocsPage />
-    </TemplateLayout>,
-    {
-      route: `/templates/${TEMPLATE_NAME}/docs`,
-      path: "/templates/:template/docs",
-    },
-  )
-
-describe("TemplateSummaryPage", () => {
-  it("shows the template readme", async () => {
-    renderPage()
-    await screen.findByTestId("markdown")
-  })
-})
diff --git a/site/src/pages/TemplatePage/TemplateDocsPage/TemplateDocsPage.tsx b/site/src/pages/TemplatePage/TemplateDocsPage/TemplateDocsPage.tsx
index 602122b7363b3..a04052e95db11 100644
--- a/site/src/pages/TemplatePage/TemplateDocsPage/TemplateDocsPage.tsx
+++ b/site/src/pages/TemplatePage/TemplateDocsPage/TemplateDocsPage.tsx
@@ -1,15 +1,15 @@
-import { makeStyles } from "@mui/styles"
-import { MemoizedMarkdown } from "components/Markdown/Markdown"
-import { useTemplateLayoutContext } from "components/TemplateLayout/TemplateLayout"
-import frontMatter from "front-matter"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
+import { makeStyles } from "@mui/styles";
+import { MemoizedMarkdown } from "components/Markdown/Markdown";
+import { useTemplateLayoutContext } from "pages/TemplatePage/TemplateLayout";
+import frontMatter from "front-matter";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
 
 export default function TemplateDocsPage() {
-  const { template, activeVersion } = useTemplateLayoutContext()
-  const styles = useStyles()
+  const { template, activeVersion } = useTemplateLayoutContext();
+  const styles = useStyles();
 
-  const readme = frontMatter(activeVersion.readme)
+  const readme = frontMatter(activeVersion.readme);
 
   return (
     <>
@@ -24,7 +24,7 @@ export default function TemplateDocsPage() {
         </div>
       </div>
     </>
-  )
+  );
 }
 
 export const useStyles = makeStyles((theme) => {
@@ -47,5 +47,5 @@ export const useStyles = makeStyles((theme) => {
       maxWidth: 800,
       margin: "auto",
     },
-  }
-})
+  };
+});
diff --git a/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage.test.tsx b/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage.test.tsx
index 898e89efeb24f..d77181f9590b1 100644
--- a/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage.test.tsx
+++ b/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage.test.tsx
@@ -1,22 +1,22 @@
 import {
   renderWithAuth,
   waitForLoaderToBeRemoved,
-} from "testHelpers/renderHelpers"
-import TemplateEmbedPage from "./TemplateEmbedPage"
-import { TemplateLayout } from "components/TemplateLayout/TemplateLayout"
+} from "testHelpers/renderHelpers";
+import TemplateEmbedPage from "./TemplateEmbedPage";
+import { TemplateLayout } from "pages/TemplatePage/TemplateLayout";
 import {
   MockTemplate,
   MockTemplateVersionParameter1 as parameter1,
   MockTemplateVersionParameter2 as parameter2,
-} from "testHelpers/entities"
-import * as API from "api/api"
-import userEvent from "@testing-library/user-event"
-import { screen } from "@testing-library/react"
+} from "testHelpers/entities";
+import * as API from "api/api";
+import userEvent from "@testing-library/user-event";
+import { screen } from "@testing-library/react";
 
 test("Users can fill the parameters and copy the open in coder url", async () => {
   jest
     .spyOn(API, "getTemplateVersionRichParameters")
-    .mockResolvedValue([parameter1, parameter2])
+    .mockResolvedValue([parameter1, parameter2]);
 
   renderWithAuth(
     <TemplateLayout>
@@ -26,27 +26,27 @@ test("Users can fill the parameters and copy the open in coder url", async () =>
       route: `/templates/${MockTemplate.name}/embed`,
       path: "/templates/:template/embed",
     },
-  )
-  await waitForLoaderToBeRemoved()
+  );
+  await waitForLoaderToBeRemoved();
 
-  const user = userEvent.setup()
+  const user = userEvent.setup();
   const firstParameterField = screen.getByLabelText(
     parameter1.display_name ?? parameter1.name,
     { exact: false },
-  )
-  await user.clear(firstParameterField)
-  await user.type(firstParameterField, "firstParameterValue")
+  );
+  await user.clear(firstParameterField);
+  await user.type(firstParameterField, "firstParameterValue");
   const secondParameterField = screen.getByLabelText(
     parameter2.display_name ?? parameter2.name,
     { exact: false },
-  )
-  await user.clear(secondParameterField)
-  await user.type(secondParameterField, "123456")
+  );
+  await user.clear(secondParameterField);
+  await user.type(secondParameterField, "123456");
 
-  jest.spyOn(window.navigator.clipboard, "writeText")
-  const copyButton = screen.getByRole("button", { name: /copy/i })
-  await userEvent.click(copyButton)
+  jest.spyOn(window.navigator.clipboard, "writeText");
+  const copyButton = screen.getByRole("button", { name: /copy/i });
+  await userEvent.click(copyButton);
   expect(window.navigator.clipboard.writeText).toBeCalledWith(
     `[![Open in Coder](http://localhost/open-in-coder.svg)](http://localhost/templates/test-template/workspace?mode=manual&param.first_parameter=firstParameterValue&param.second_parameter=123456)`,
-  )
-})
+  );
+});
diff --git a/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage.tsx b/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage.tsx
index 32b9ffcd39afc..f040033f2abeb 100644
--- a/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage.tsx
+++ b/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage.tsx
@@ -1,39 +1,36 @@
-import CheckOutlined from "@mui/icons-material/CheckOutlined"
-import FileCopyOutlined from "@mui/icons-material/FileCopyOutlined"
-import Box from "@mui/material/Box"
-import Button from "@mui/material/Button"
-import FormControlLabel from "@mui/material/FormControlLabel"
-import Radio from "@mui/material/Radio"
-import RadioGroup from "@mui/material/RadioGroup"
-import { useQuery } from "@tanstack/react-query"
-import { getTemplateVersionRichParameters } from "api/api"
-import { Template, TemplateVersionParameter } from "api/typesGenerated"
-import { FormSection, VerticalForm } from "components/Form/Form"
-import { Loader } from "components/Loader/Loader"
-import { useTemplateLayoutContext } from "components/TemplateLayout/TemplateLayout"
+import CheckOutlined from "@mui/icons-material/CheckOutlined";
+import FileCopyOutlined from "@mui/icons-material/FileCopyOutlined";
+import Box from "@mui/material/Box";
+import Button from "@mui/material/Button";
+import FormControlLabel from "@mui/material/FormControlLabel";
+import Radio from "@mui/material/Radio";
+import RadioGroup from "@mui/material/RadioGroup";
+import { useQuery } from "react-query";
+import { getTemplateVersionRichParameters } from "api/api";
+import { Template, TemplateVersionParameter } from "api/typesGenerated";
+import { FormSection, VerticalForm } from "components/Form/Form";
+import { Loader } from "components/Loader/Loader";
+import { useTemplateLayoutContext } from "pages/TemplatePage/TemplateLayout";
 import {
   ImmutableTemplateParametersSection,
   MutableTemplateParametersSection,
   TemplateParametersSectionProps,
-} from "components/TemplateParameters/TemplateParameters"
-import { useClipboard } from "hooks/useClipboard"
-import { FC, useState } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import {
-  selectInitialRichParametersValues,
-  workspaceBuildParameterValue,
-} from "utils/richParameters"
-import { paramsUsedToCreateWorkspace } from "utils/workspace"
+} from "components/TemplateParameters/TemplateParameters";
+import { useClipboard } from "hooks/useClipboard";
+import { FC, useEffect, useState } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { getInitialRichParameterValues } from "utils/richParameters";
+import { paramsUsedToCreateWorkspace } from "utils/workspace";
 
-type ButtonValues = Record<string, string>
+type ButtonValues = Record<string, string>;
 
 const TemplateEmbedPage = () => {
-  const { template } = useTemplateLayoutContext()
+  const { template } = useTemplateLayoutContext();
   const { data: templateParameters } = useQuery({
     queryKey: ["template", template.id, "embed"],
     queryFn: () => getTemplateVersionRichParameters(template.active_version_id),
-  })
+  });
 
   return (
     <>
@@ -47,53 +44,61 @@ const TemplateEmbedPage = () => {
         )}
       />
     </>
-  )
-}
+  );
+};
 
 export const TemplateEmbedPageView: FC<{
-  template: Template
-  templateParameters?: TemplateVersionParameter[]
+  template: Template;
+  templateParameters?: TemplateVersionParameter[];
 }> = ({ template, templateParameters }) => {
-  const [buttonValues, setButtonValues] = useState<ButtonValues>({
-    mode: "manual",
-  })
-  const initialRichParametersValues = templateParameters
-    ? selectInitialRichParametersValues(templateParameters)
-    : undefined
-  const deploymentUrl = `${window.location.protocol}//${window.location.host}`
-  const createWorkspaceUrl = `${deploymentUrl}/templates/${template.name}/workspace`
-  const createWorkspaceParams = new URLSearchParams(buttonValues)
-  const buttonUrl = `${createWorkspaceUrl}?${createWorkspaceParams.toString()}`
-  const buttonMkdCode = `[![Open in Coder](${deploymentUrl}/open-in-coder.svg)](${buttonUrl})`
-  const clipboard = useClipboard(buttonMkdCode)
-
+  const [buttonValues, setButtonValues] = useState<ButtonValues | undefined>(
+    undefined,
+  );
+  const deploymentUrl = `${window.location.protocol}//${window.location.host}`;
+  const createWorkspaceUrl = `${deploymentUrl}/templates/${template.name}/workspace`;
+  const createWorkspaceParams = new URLSearchParams(buttonValues);
+  const buttonUrl = `${createWorkspaceUrl}?${createWorkspaceParams.toString()}`;
+  const buttonMkdCode = `[![Open in Coder](${deploymentUrl}/open-in-coder.svg)](${buttonUrl})`;
+  const clipboard = useClipboard(buttonMkdCode);
   const getInputProps: TemplateParametersSectionProps["getInputProps"] = (
     parameter,
   ) => {
-    if (!initialRichParametersValues) {
-      throw new Error("initialRichParametersValues is undefined")
+    if (!buttonValues) {
+      throw new Error("buttonValues is undefined");
     }
     return {
-      id: parameter.name,
-      initialValue: workspaceBuildParameterValue(
-        initialRichParametersValues,
-        parameter,
-      ),
+      value: buttonValues[`param.${parameter.name}`] ?? "",
       onChange: (value) => {
         setButtonValues((buttonValues) => ({
           ...buttonValues,
           [`param.${parameter.name}`]: value,
-        }))
+        }));
       },
+    };
+  };
+
+  // template parameters is async so we need to initialize the values after it
+  // is loaded
+  useEffect(() => {
+    if (templateParameters && !buttonValues) {
+      const buttonValues: ButtonValues = {
+        mode: "manual",
+      };
+      for (const parameter of getInitialRichParameterValues(
+        templateParameters,
+      )) {
+        buttonValues[`param.${parameter.name}`] = parameter.value;
+      }
+      setButtonValues(buttonValues);
     }
-  }
+  }, [buttonValues, templateParameters]);
 
   return (
     <>
       <Helmet>
         <title>{pageTitle(`${template.name} · Embed`)}</title>
       </Helmet>
-      {!templateParameters ? (
+      {!buttonValues || !templateParameters ? (
         <Loader />
       ) : (
         <Box display="flex" alignItems="flex-start" gap={6}>
@@ -109,7 +114,7 @@ export const TemplateEmbedPageView: FC<{
                     setButtonValues((buttonValues) => ({
                       ...buttonValues,
                       mode: v,
-                    }))
+                    }));
                   }}
                 >
                   <FormControlLabel
@@ -142,9 +147,9 @@ export const TemplateEmbedPageView: FC<{
           <Box
             display="flex"
             height={{
-              // 80px is the vertical padding of the content area
-              // 36px is from the status bar from the bottom
-              md: "calc(100vh - (80px + 36px))",
+              // 80px for padding, 36px is for the status bar. We want to use `vh`
+              // so that it will be relative to the screen and not the parent layout.
+              height: "calc(100vh - (80px + 36px))",
               top: 40,
               position: "sticky",
             }}
@@ -183,7 +188,7 @@ export const TemplateEmbedPageView: FC<{
         </Box>
       )}
     </>
-  )
-}
+  );
+};
 
-export default TemplateEmbedPage
+export default TemplateEmbedPage;
diff --git a/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPageView.stories.tsx b/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPageView.stories.tsx
index 39860cccb78d9..785d9007eb8b8 100644
--- a/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPageView.stories.tsx
+++ b/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPageView.stories.tsx
@@ -1,30 +1,30 @@
-import type { Meta, StoryObj } from "@storybook/react"
+import type { Meta, StoryObj } from "@storybook/react";
 
-import { TemplateEmbedPageView } from "./TemplateEmbedPage"
+import { TemplateEmbedPageView } from "./TemplateEmbedPage";
 import {
   MockTemplate,
   MockTemplateVersionParameter1,
   MockTemplateVersionParameter2,
   MockTemplateVersionParameter3,
   MockTemplateVersionParameter4,
-} from "testHelpers/entities"
+} from "testHelpers/entities";
 
 const meta: Meta<typeof TemplateEmbedPageView> = {
-  title: "pages/TemplateEmbedPageView",
+  title: "pages/TemplatePage/TemplateEmbedPageView",
   component: TemplateEmbedPageView,
   args: {
     template: MockTemplate,
   },
-}
+};
 
-export default meta
-type Story = StoryObj<typeof TemplateEmbedPageView>
+export default meta;
+type Story = StoryObj<typeof TemplateEmbedPageView>;
 
 export const NoParameters: Story = {
   args: {
     templateParameters: [],
   },
-}
+};
 
 export const WithParameters: Story = {
   args: {
@@ -35,4 +35,4 @@ export const WithParameters: Story = {
       MockTemplateVersionParameter4,
     ],
   },
-}
+};
diff --git a/site/src/pages/TemplatePage/TemplateFilesPage/TemplateFilesPage.tsx b/site/src/pages/TemplatePage/TemplateFilesPage/TemplateFilesPage.tsx
index 07953cfb60038..1a1cd9b244b10 100644
--- a/site/src/pages/TemplatePage/TemplateFilesPage/TemplateFilesPage.tsx
+++ b/site/src/pages/TemplatePage/TemplateFilesPage/TemplateFilesPage.tsx
@@ -1,81 +1,18 @@
-import { useQuery } from "@tanstack/react-query"
-import { getPreviousTemplateVersionByName } from "api/api"
-import { TemplateVersion } from "api/typesGenerated"
-import { Loader } from "components/Loader/Loader"
-import { TemplateFiles } from "components/TemplateFiles/TemplateFiles"
-import { useTemplateLayoutContext } from "components/TemplateLayout/TemplateLayout"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { useTab } from "hooks/useTab"
-import { FC, useEffect } from "react"
-import { Helmet } from "react-helmet-async"
-import {
-  getTemplateVersionFiles,
-  TemplateVersionFiles,
-} from "utils/templateVersion"
-import { getTemplatePageTitle } from "../utils"
-
-const fetchTemplateFiles = async (
-  organizationId: string,
-  templateName: string,
-  activeVersion: TemplateVersion,
-) => {
-  const previousVersion = await getPreviousTemplateVersionByName(
-    organizationId,
-    templateName,
-    activeVersion.name,
-  )
-  const loadFilesPromises: ReturnType<typeof getTemplateVersionFiles>[] = []
-  loadFilesPromises.push(getTemplateVersionFiles(activeVersion))
-  if (previousVersion) {
-    loadFilesPromises.push(getTemplateVersionFiles(previousVersion))
-  }
-  const [currentFiles, previousFiles] = await Promise.all(loadFilesPromises)
-  return {
-    currentFiles,
-    previousFiles,
-  }
-}
-
-const useTemplateFiles = (
-  organizationId: string,
-  templateName: string,
-  activeVersion: TemplateVersion,
-) =>
-  useQuery({
-    queryKey: ["templateFiles", templateName],
-    queryFn: () =>
-      fetchTemplateFiles(organizationId, templateName, activeVersion),
-  })
-
-const useFileTab = (templateFiles: TemplateVersionFiles | undefined) => {
-  // Tabs The default tab is the tab that has main.tf but until we loads the
-  // files and check if main.tf exists we don't know which tab is the default
-  // one so we just use empty string
-  const tab = useTab("file", "")
-  const isLoaded = tab.value !== ""
-  useEffect(() => {
-    if (templateFiles && !isLoaded) {
-      const terraformFileIndex = Object.keys(templateFiles).indexOf("main.tf")
-      // If main.tf exists use the index if not just use the first tab
-      tab.set(terraformFileIndex !== -1 ? terraformFileIndex.toString() : "0")
-    }
-  }, [isLoaded, tab, templateFiles])
-
-  return {
-    ...tab,
-    isLoaded,
-  }
-}
+import { Loader } from "components/Loader/Loader";
+import { TemplateFiles } from "components/TemplateFiles/TemplateFiles";
+import { useTemplateLayoutContext } from "pages/TemplatePage/TemplateLayout";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { getTemplatePageTitle } from "../utils";
+import { useFileTab, useTemplateFiles } from "components/TemplateFiles/hooks";
 
 const TemplateFilesPage: FC = () => {
-  const { template, activeVersion } = useTemplateLayoutContext()
-  const orgId = useOrganizationId()
+  const { template, activeVersion } = useTemplateLayoutContext();
   const { data: templateFiles } = useTemplateFiles(
-    orgId,
     template.name,
     activeVersion,
-  )
-  const tab = useFileTab(templateFiles?.currentFiles)
+  );
+  const tab = useFileTab(templateFiles?.currentFiles);
 
   return (
     <>
@@ -93,7 +30,7 @@ const TemplateFilesPage: FC = () => {
         <Loader />
       )}
     </>
-  )
-}
+  );
+};
 
-export default TemplateFilesPage
+export default TemplateFilesPage;
diff --git a/site/src/pages/TemplatePage/TemplateInsightsPage/DateRange.tsx b/site/src/pages/TemplatePage/TemplateInsightsPage/DateRange.tsx
new file mode 100644
index 0000000000000..aa6d43bc9a298
--- /dev/null
+++ b/site/src/pages/TemplatePage/TemplateInsightsPage/DateRange.tsx
@@ -0,0 +1,235 @@
+import Box from "@mui/material/Box";
+import { styled } from "@mui/material/styles";
+import { ComponentProps, useRef, useState } from "react";
+import "react-date-range/dist/styles.css";
+import "react-date-range/dist/theme/default.css";
+import Button from "@mui/material/Button";
+import ArrowRightAltOutlined from "@mui/icons-material/ArrowRightAltOutlined";
+import { DateRangePicker, createStaticRanges } from "react-date-range";
+import {
+  addDays,
+  addHours,
+  format,
+  isToday,
+  startOfDay,
+  startOfHour,
+  subDays,
+} from "date-fns";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "components/Popover/Popover";
+
+// The type definition from @types is wrong
+declare module "react-date-range" {
+  export function createStaticRanges(
+    ranges: Omit<StaticRange, "isSelected">[],
+  ): StaticRange[];
+}
+
+export type DateRangeValue = {
+  startDate: Date;
+  endDate: Date;
+};
+
+type RangesState = NonNullable<
+  ComponentProps<typeof DateRangePicker>["ranges"]
+>;
+
+export const DateRange = ({
+  value,
+  onChange,
+}: {
+  value: DateRangeValue;
+  onChange: (value: DateRangeValue) => void;
+}) => {
+  const selectionStatusRef = useRef<"idle" | "selecting">("idle");
+  const [ranges, setRanges] = useState<RangesState>([
+    {
+      ...value,
+      key: "selection",
+    },
+  ]);
+  const currentRange = {
+    startDate: ranges[0].startDate as Date,
+    endDate: ranges[0].endDate as Date,
+  };
+
+  return (
+    <Popover>
+      {(popover) => (
+        <>
+          <PopoverTrigger>
+            <Button>
+              <span>{format(currentRange.startDate, "MMM d, Y")}</span>
+              <ArrowRightAltOutlined sx={{ width: 16, height: 16, mx: 1 }} />
+              <span>{format(currentRange.endDate, "MMM d, Y")}</span>
+            </Button>
+          </PopoverTrigger>
+          <PopoverContent>
+            <DateRangePickerWrapper
+              component={DateRangePicker}
+              onChange={(item) => {
+                const range = item.selection;
+                setRanges([range]);
+
+                // When it is the first selection, we don't want to close the popover
+                // We have to do that ourselves because the library doesn't provide a way to do it
+                if (selectionStatusRef.current === "idle") {
+                  selectionStatusRef.current = "selecting";
+                  return;
+                }
+
+                selectionStatusRef.current = "idle";
+                const startDate = range.startDate as Date;
+                const endDate = range.endDate as Date;
+                const now = new Date();
+                onChange({
+                  startDate: startOfDay(startDate),
+                  endDate: isToday(endDate)
+                    ? startOfHour(addHours(now, 1))
+                    : startOfDay(addDays(endDate, 1)),
+                });
+                popover.setIsOpen(false);
+              }}
+              moveRangeOnFirstSelection={false}
+              months={2}
+              ranges={ranges}
+              maxDate={new Date()}
+              direction="horizontal"
+              staticRanges={createStaticRanges([
+                {
+                  label: "Today",
+                  range: () => ({
+                    startDate: new Date(),
+                    endDate: new Date(),
+                  }),
+                },
+                {
+                  label: "Yesterday",
+                  range: () => ({
+                    startDate: subDays(new Date(), 1),
+                    endDate: subDays(new Date(), 1),
+                  }),
+                },
+                {
+                  label: "Last 7 days",
+                  range: () => ({
+                    startDate: subDays(new Date(), 6),
+                    endDate: new Date(),
+                  }),
+                },
+                {
+                  label: "Last 14 days",
+                  range: () => ({
+                    startDate: subDays(new Date(), 13),
+                    endDate: new Date(),
+                  }),
+                },
+                {
+                  label: "Last 30 days",
+                  range: () => ({
+                    startDate: subDays(new Date(), 29),
+                    endDate: new Date(),
+                  }),
+                },
+              ])}
+            />
+          </PopoverContent>
+        </>
+      )}
+    </Popover>
+  );
+};
+
+const DateRangePickerWrapper: typeof Box = styled(Box)(({ theme }) => ({
+  "& .rdrDefinedRangesWrapper": {
+    background: theme.palette.background.paper,
+    borderColor: theme.palette.divider,
+  },
+
+  "& .rdrStaticRange": {
+    background: theme.palette.background.paper,
+    border: 0,
+    fontSize: 14,
+    color: theme.palette.text.secondary,
+
+    "&:hover .rdrStaticRangeLabel": {
+      background: theme.palette.background.paperLight,
+      color: theme.palette.text.primary,
+    },
+
+    "&.rdrStaticRangeSelected": {
+      color: `${theme.palette.text.primary} !important`,
+    },
+  },
+
+  "& .rdrInputRanges": {
+    display: "none",
+  },
+
+  "& .rdrDateDisplayWrapper": {
+    backgroundColor: theme.palette.background.paper,
+  },
+
+  "& .rdrCalendarWrapper": {
+    backgroundColor: theme.palette.background.paperLight,
+  },
+
+  "& .rdrDateDisplayItem": {
+    background: "transparent",
+    borderColor: theme.palette.divider,
+
+    "& input": {
+      color: theme.palette.text.secondary,
+    },
+
+    "&.rdrDateDisplayItemActive": {
+      borderColor: theme.palette.text.primary,
+      backgroundColor: theme.palette.background.paperLight,
+
+      "& input": {
+        color: theme.palette.text.primary,
+      },
+    },
+  },
+
+  "& .rdrMonthPicker select, & .rdrYearPicker select": {
+    color: theme.palette.text.primary,
+    appearance: "auto",
+    background: "transparent",
+  },
+
+  "& .rdrMonthName, & .rdrWeekDay": {
+    color: theme.palette.text.secondary,
+  },
+
+  "& .rdrDayPassive .rdrDayNumber span": {
+    color: theme.palette.text.disabled,
+  },
+
+  "& .rdrDayNumber span": {
+    color: theme.palette.text.primary,
+  },
+
+  "& .rdrDayToday .rdrDayNumber span": {
+    fontWeight: 900,
+
+    "&:after": {
+      display: "none",
+    },
+  },
+
+  "& .rdrInRange, & .rdrEndEdge, & .rdrStartEdge": {
+    color: theme.palette.primary.main,
+  },
+
+  "& .rdrDayDisabled": {
+    backgroundColor: "transparent",
+
+    "& .rdrDayNumber span": {
+      color: theme.palette.text.disabled,
+    },
+  },
+}));
diff --git a/site/src/pages/TemplatePage/TemplateInsightsPage/IntervalMenu.tsx b/site/src/pages/TemplatePage/TemplateInsightsPage/IntervalMenu.tsx
new file mode 100644
index 0000000000000..797e1b4995f10
--- /dev/null
+++ b/site/src/pages/TemplatePage/TemplateInsightsPage/IntervalMenu.tsx
@@ -0,0 +1,86 @@
+import CheckOutlined from "@mui/icons-material/CheckOutlined";
+import ExpandMoreOutlined from "@mui/icons-material/ExpandMoreOutlined";
+import Box from "@mui/material/Box";
+import Button from "@mui/material/Button";
+import Menu from "@mui/material/Menu";
+import MenuItem from "@mui/material/MenuItem";
+import { useState, useRef } from "react";
+
+export const insightsIntervals = {
+  day: {
+    label: "Daily",
+  },
+  week: {
+    label: "Weekly",
+  },
+} as const;
+
+export type InsightsInterval = keyof typeof insightsIntervals;
+
+export const IntervalMenu = ({
+  value,
+  onChange,
+}: {
+  value: InsightsInterval;
+  onChange: (value: InsightsInterval) => void;
+}) => {
+  const anchorRef = useRef<HTMLButtonElement>(null);
+  const [open, setOpen] = useState(false);
+
+  const handleClose = () => {
+    setOpen(false);
+  };
+
+  return (
+    <div>
+      <Button
+        ref={anchorRef}
+        id="interval-button"
+        aria-controls={open ? "interval-menu" : undefined}
+        aria-haspopup="true"
+        aria-expanded={open ? "true" : undefined}
+        onClick={() => setOpen(true)}
+        endIcon={<ExpandMoreOutlined />}
+      >
+        {insightsIntervals[value].label}
+      </Button>
+      <Menu
+        id="interval-menu"
+        anchorEl={anchorRef.current}
+        open={open}
+        onClose={handleClose}
+        MenuListProps={{
+          "aria-labelledby": "interval-button",
+        }}
+        anchorOrigin={{
+          vertical: "bottom",
+          horizontal: "left",
+        }}
+        transformOrigin={{
+          vertical: "top",
+          horizontal: "left",
+        }}
+      >
+        {Object.entries(insightsIntervals).map(([interval, { label }]) => {
+          return (
+            <MenuItem
+              css={{ fontSize: 14, justifyContent: "space-between" }}
+              key={interval}
+              onClick={() => {
+                onChange(interval as InsightsInterval);
+                handleClose();
+              }}
+            >
+              {label}
+              <Box css={{ width: 16, height: 16 }}>
+                {value === interval && (
+                  <CheckOutlined css={{ width: 16, height: 16 }} />
+                )}
+              </Box>
+            </MenuItem>
+          );
+        })}
+      </Menu>
+    </div>
+  );
+};
diff --git a/site/src/pages/TemplatePage/TemplateInsightsPage/TemplateInsightsPage.stories.tsx b/site/src/pages/TemplatePage/TemplateInsightsPage/TemplateInsightsPage.stories.tsx
index 49678eef08375..361ff4f12ce1a 100644
--- a/site/src/pages/TemplatePage/TemplateInsightsPage/TemplateInsightsPage.stories.tsx
+++ b/site/src/pages/TemplatePage/TemplateInsightsPage/TemplateInsightsPage.stories.tsx
@@ -1,20 +1,21 @@
-import type { Meta, StoryObj } from "@storybook/react"
-import { TemplateInsightsPageView } from "./TemplateInsightsPage"
+import type { Meta, StoryObj } from "@storybook/react";
+import { TemplateInsightsPageView } from "./TemplateInsightsPage";
+import { MockEntitlementsWithUserLimit } from "testHelpers/entities";
 
 const meta: Meta<typeof TemplateInsightsPageView> = {
-  title: "pages/TemplateInsightsPageView",
+  title: "pages/TemplatePage/TemplateInsightsPageView",
   component: TemplateInsightsPageView,
-}
+};
 
-export default meta
-type Story = StoryObj<typeof TemplateInsightsPageView>
+export default meta;
+type Story = StoryObj<typeof TemplateInsightsPageView>;
 
 export const Loading: Story = {
   args: {
     templateInsights: undefined,
     userLatency: undefined,
   },
-}
+};
 
 export const Empty: Story = {
   args: {
@@ -37,8 +38,16 @@ export const Empty: Story = {
         users: [],
       },
     },
+    userActivity: {
+      report: {
+        end_time: "",
+        start_time: "",
+        template_ids: [],
+        users: [],
+      },
+    },
   },
-}
+};
 
 export const Loaded: Story = {
   args: {
@@ -83,7 +92,381 @@ export const Loaded: Story = {
             seconds: 1020900,
           },
         ],
-        parameters_usage: [],
+        parameters_usage: [
+          {
+            template_ids: ["7dd1d090-3e23-4ada-8894-3945affcad42"],
+            display_name: "",
+            name: "Compute instances",
+            type: "number",
+            description: "Let's set the expected number of instances.",
+            values: [
+              {
+                value: "3",
+                count: 2,
+              },
+            ],
+          },
+          {
+            template_ids: ["7dd1d090-3e23-4ada-8894-3945affcad42"],
+            display_name: "",
+            name: "Docker Image",
+            type: "string",
+            description: "Docker image for the development container",
+            values: [
+              {
+                value: "ghcr.io/harrison-ai/coder-dev:base",
+                count: 2,
+              },
+            ],
+          },
+          {
+            template_ids: ["7dd1d090-3e23-4ada-8894-3945affcad42"],
+            display_name: "Very random string",
+            name: "Optional random string",
+            type: "string",
+            description: "This string is optional",
+            values: [
+              {
+                value: "ksjdlkajs;djálskd'l ;a k;aosdk ;oaids ;li",
+                count: 1,
+              },
+              {
+                value: "some other any string here",
+                count: 1,
+              },
+            ],
+          },
+          {
+            template_ids: ["7dd1d090-3e23-4ada-8894-3945affcad42"],
+            display_name: "",
+            name: "Region",
+            type: "string",
+            description: "These are options.",
+            options: [
+              {
+                name: "US Central",
+                description: "Select for central!",
+                value: "us-central1-a",
+                icon: "/icon/goland.svg",
+              },
+              {
+                name: "US East",
+                description: "Select for east!",
+                value: "us-east1-a",
+                icon: "/icon/folder.svg",
+              },
+              {
+                name: "US West",
+                description: "Select for west!",
+                value: "us-west2-a",
+                icon: "",
+              },
+            ],
+            values: [
+              {
+                value: "us-central1-a",
+                count: 1,
+              },
+              {
+                value: "us-west2-a",
+                count: 1,
+              },
+              // Test orphan values
+              {
+                value: "us-west-orphan",
+                count: 1,
+              },
+            ],
+          },
+          {
+            template_ids: ["7dd1d090-3e23-4ada-8894-3945affcad42"],
+            display_name: "",
+            name: "Security groups",
+            type: "list(string)",
+            description: "Select appropriate security groups.",
+            values: [
+              {
+                value:
+                  '["Web Server Security Group","Database Security Group","Backend Security Group"]',
+                count: 2,
+              },
+            ],
+          },
+          {
+            template_ids: ["7dd1d090-3e23-4ada-8894-3945affcad42"],
+            display_name: "Very random string",
+            name: "buggy-1",
+            type: "string",
+            description: "This string is buggy",
+            values: [
+              {
+                value: "",
+                count: 2,
+              },
+            ],
+          },
+          {
+            template_ids: ["7dd1d090-3e23-4ada-8894-3945affcad42"],
+            display_name: "Force rebuild",
+            name: "force-rebuild",
+            type: "bool",
+            description: "Rebuild the project code",
+            values: [
+              {
+                value: "false",
+                count: 2,
+              },
+            ],
+          },
+          {
+            template_ids: ["7dd1d090-3e23-4ada-8894-3945affcad42"],
+            display_name: "Location",
+            name: "location",
+            type: "string",
+            description: "What location should your workspace live in?",
+            options: [
+              {
+                name: "US (Virginia)",
+                description: "",
+                value: "eastus",
+                icon: "/emojis/1f1fa-1f1f8.png",
+              },
+              {
+                name: "US (Virginia) 2",
+                description: "",
+                value: "eastus2",
+                icon: "/emojis/1f1fa-1f1f8.png",
+              },
+              {
+                name: "US (Texas)",
+                description: "",
+                value: "southcentralus",
+                icon: "/emojis/1f1fa-1f1f8.png",
+              },
+              {
+                name: "US (Washington)",
+                description: "",
+                value: "westus2",
+                icon: "/emojis/1f1fa-1f1f8.png",
+              },
+              {
+                name: "US (Arizona)",
+                description: "",
+                value: "westus3",
+                icon: "/emojis/1f1fa-1f1f8.png",
+              },
+              {
+                name: "US (Iowa)",
+                description: "",
+                value: "centralus",
+                icon: "/emojis/1f1fa-1f1f8.png",
+              },
+              {
+                name: "Canada (Toronto)",
+                description: "",
+                value: "canadacentral",
+                icon: "/emojis/1f1e8-1f1e6.png",
+              },
+              {
+                name: "Brazil (Sao Paulo)",
+                description: "",
+                value: "brazilsouth",
+                icon: "/emojis/1f1e7-1f1f7.png",
+              },
+              {
+                name: "East Asia (Hong Kong)",
+                description: "",
+                value: "eastasia",
+                icon: "/emojis/1f1f0-1f1f7.png",
+              },
+              {
+                name: "Southeast Asia (Singapore)",
+                description: "",
+                value: "southeastasia",
+                icon: "/emojis/1f1f0-1f1f7.png",
+              },
+              {
+                name: "Australia (New South Wales)",
+                description: "",
+                value: "australiaeast",
+                icon: "/emojis/1f1e6-1f1fa.png",
+              },
+              {
+                name: "China (Hebei)",
+                description: "",
+                value: "chinanorth3",
+                icon: "/emojis/1f1e8-1f1f3.png",
+              },
+              {
+                name: "India (Pune)",
+                description: "",
+                value: "centralindia",
+                icon: "/emojis/1f1ee-1f1f3.png",
+              },
+              {
+                name: "Japan (Tokyo)",
+                description: "",
+                value: "japaneast",
+                icon: "/emojis/1f1ef-1f1f5.png",
+              },
+              {
+                name: "Korea (Seoul)",
+                description: "",
+                value: "koreacentral",
+                icon: "/emojis/1f1f0-1f1f7.png",
+              },
+              {
+                name: "Europe (Ireland)",
+                description: "",
+                value: "northeurope",
+                icon: "/emojis/1f1ea-1f1fa.png",
+              },
+              {
+                name: "Europe (Netherlands)",
+                description: "",
+                value: "westeurope",
+                icon: "/emojis/1f1ea-1f1fa.png",
+              },
+              {
+                name: "France (Paris)",
+                description: "",
+                value: "francecentral",
+                icon: "/emojis/1f1eb-1f1f7.png",
+              },
+              {
+                name: "Germany (Frankfurt)",
+                description: "",
+                value: "germanywestcentral",
+                icon: "/emojis/1f1e9-1f1ea.png",
+              },
+              {
+                name: "Norway (Oslo)",
+                description: "",
+                value: "norwayeast",
+                icon: "/emojis/1f1f3-1f1f4.png",
+              },
+              {
+                name: "Sweden (Gävle)",
+                description: "",
+                value: "swedencentral",
+                icon: "/emojis/1f1f8-1f1ea.png",
+              },
+              {
+                name: "Switzerland (Zurich)",
+                description: "",
+                value: "switzerlandnorth",
+                icon: "/emojis/1f1e8-1f1ed.png",
+              },
+              {
+                name: "Qatar (Doha)",
+                description: "",
+                value: "qatarcentral",
+                icon: "/emojis/1f1f6-1f1e6.png",
+              },
+              {
+                name: "UAE (Dubai)",
+                description: "",
+                value: "uaenorth",
+                icon: "/emojis/1f1e6-1f1ea.png",
+              },
+              {
+                name: "South Africa (Johannesburg)",
+                description: "",
+                value: "southafricanorth",
+                icon: "/emojis/1f1ff-1f1e6.png",
+              },
+              {
+                name: "UK (London)",
+                description: "",
+                value: "uksouth",
+                icon: "/emojis/1f1ec-1f1e7.png",
+              },
+            ],
+            values: [
+              {
+                value: "brazilsouth",
+                count: 1,
+              },
+              {
+                value: "switzerlandnorth",
+                count: 1,
+              },
+            ],
+          },
+          {
+            template_ids: ["7dd1d090-3e23-4ada-8894-3945affcad42"],
+            display_name: "",
+            name: "mtojek_region",
+            type: "string",
+            description: "What region should your workspace live in?",
+            options: [
+              {
+                name: "Los Angeles, CA",
+                description: "",
+                value: "Los Angeles, CA",
+                icon: "",
+              },
+              {
+                name: "Moncks Corner, SC",
+                description: "",
+                value: "Moncks Corner, SC",
+                icon: "",
+              },
+              {
+                name: "Eemshaven, NL",
+                description: "",
+                value: "Eemshaven, NL",
+                icon: "",
+              },
+            ],
+            values: [
+              {
+                value: "Los Angeles, CA",
+                count: 2,
+              },
+            ],
+          },
+          {
+            template_ids: ["7dd1d090-3e23-4ada-8894-3945affcad42"],
+            display_name: "My Project ID",
+            name: "project_id",
+            type: "string",
+            description: "This is the Project ID.",
+            values: [
+              {
+                value: "12345",
+                count: 2,
+              },
+            ],
+          },
+          {
+            template_ids: ["7dd1d090-3e23-4ada-8894-3945affcad42"],
+            display_name: "Force devcontainer rebuild",
+            name: "rebuild_devcontainer",
+            type: "bool",
+            description: "",
+            values: [
+              {
+                value: "false",
+                count: 2,
+              },
+            ],
+          },
+          {
+            template_ids: ["7dd1d090-3e23-4ada-8894-3945affcad42"],
+            display_name: "Git Repo URL",
+            name: "repo_url",
+            type: "string",
+            description:
+              "See sample projects (https://github.com/microsoft/vscode-dev-containers#sample-projects)",
+            values: [
+              {
+                value: "https://github.com/mtojek/coder",
+                count: 2,
+              },
+            ],
+          },
+        ],
       },
       interval_reports: [
         {
@@ -133,7 +516,7 @@ export const Loaded: Story = {
           end_time: "2023-07-25T00:00:00Z",
           template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
           interval: "day",
-          active_users: 11,
+          active_users: 16,
         },
       ],
     },
@@ -288,5 +671,202 @@ export const Loaded: Story = {
         ],
       },
     },
+    userActivity: {
+      report: {
+        start_time: "2023-09-03T00:00:00-03:00",
+        end_time: "2023-10-01T00:00:00-03:00",
+        template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+        users: [
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "0bac0dfd-b086-4b6d-b8ba-789e0eca7451",
+            username: "kylecarbs",
+            avatar_url: "https://avatars.githubusercontent.com/u/7122116?v=4",
+            seconds: 671040,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "12b03f43-1bb7-4fca-967a-585c97f31682",
+            username: "coadler",
+            avatar_url: "https://avatars.githubusercontent.com/u/6332295?v=4",
+            seconds: 1487460,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "15890ddb-142c-443d-8fd5-cd8307256ab1",
+            username: "jsjoeio",
+            avatar_url: "https://avatars.githubusercontent.com/u/3806031?v=4",
+            seconds: 6600,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "1c3e3fff-6a0e-4179-9ba3-27f5443e6fce",
+            username: "Kira-Pilot",
+            avatar_url: "https://avatars.githubusercontent.com/u/19142439?v=4",
+            seconds: 195240,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "2e1e7f76-ae77-424a-a209-f35a99731ec9",
+            username: "phorcys420",
+            avatar_url: "https://avatars.githubusercontent.com/u/57866459?v=4",
+            seconds: 16320,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "3f8c0eef-6a45-4759-a4d6-d00bbffb1369",
+            username: "dean",
+            avatar_url: "https://avatars.githubusercontent.com/u/11241812?v=4",
+            seconds: 533520,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "59da0bfe-9c99-47fa-a563-f9fdb18449d0",
+            username: "cian",
+            avatar_url:
+              "https://lh3.googleusercontent.com/a/ACg8ocKKaBWosY_nuQvecIaUPh5RYjxkEN-C8FNGVPlC0Ch2fx0=s96-c",
+            seconds: 607080,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "5ccd3128-cbbb-4cfb-8139-5a1edbb60c71",
+            username: "bpmct",
+            avatar_url: "https://avatars.githubusercontent.com/u/22407953?v=4",
+            seconds: 161340,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "631f78f6-098e-4cb0-ae4f-418fafb0a406",
+            username: "matifali",
+            avatar_url: "https://avatars.githubusercontent.com/u/10648092?v=4",
+            seconds: 202500,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "740bba7f-356d-4203-8f15-03ddee381998",
+            username: "eric",
+            avatar_url: "https://avatars.githubusercontent.com/u/9683576?v=4",
+            seconds: 352680,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "78dd2361-4a5a-42b0-9ec3-3eea23af1094",
+            username: "code-asher",
+            avatar_url: "https://avatars.githubusercontent.com/u/45609798?v=4",
+            seconds: 518640,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "7f5cc5e9-20ee-48ce-959d-081b3f52273e",
+            username: "mafredri",
+            avatar_url: "https://avatars.githubusercontent.com/u/147409?v=4",
+            seconds: 218100,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "8b474a55-d414-4b53-a6ba-760f3d4eed7b",
+            username: "kirby",
+            avatar_url:
+              "https://lh3.googleusercontent.com/a-/ALV-UjUHd9l3CaO99BfVlP8L9D9HqKFOUac7zVCA_Bb_2lj0hcPkQvHkMk4HRaMw4b1YF7E-uHnJO-w8sXf3pqRA2EUP9sDvX6ITd2S2YN23kttVCJKTiI-YEIS8eVDfrF8YLqjfKL3PWsxyiPcgtcdfmPiEnlh4mpUMRXZudwtINfk0W3B9KEpwJTpipdlb57HdYO-mD3DEfmwnpZIO_iVjwnpWZZimXH5g15NVregb8VH_vlsW-vHrMsZ1fRGpm6GWnTcWx2rTImz5Qq5dd15MPKYUxc4wpyYImg07eD41ShzHDJhmDaj_n3hjOwFLuyloLBck-t9skQLWf2r7Voq42jVhzJ2-GAv9atC41_ohG1kq8TpCf9ak6S4hE3xMIB4yzDC0VZxl-BlsBHCuKBRTwC-58yTL2GZI31a0Q9PpR720AyiZaOWhX1QOVZmPZey8b8SG7jWTOfzNa9Shf9E0pz3yyIxFx7KSY5Qeye5AmO1au-rXuWr4whXXY6fsn0tnG4nxdyetCiXd0mOmvYHoJuuQFfqYNjdObduRD0yaVZGL-hPFDYH6K-wiedT1y-66jKXcqjVqe0Rwo7YzcVcP-IeV5RGuJ36TEpC1lhi2V-AnG7pmvIn_4AmXfycclrISO10LgQsrx8bxeBW61t9oTFTZCXXBDAd9bLRxndLi_mWYEfOSnWODgfCrapL_GNZsV0tkQ9x-zvlSXQXtze5bg__uAo7CEnZ20yWT5Gr25_NPsH6vyR3hplKn67qBti5_rKzFQ1sVbcuab2BRmF_Al9MTQw-R2gmd0mle9JRr8tyuwCYh82mBrM-dGebXSdqvabws7_WmF5TNwDHHzeeiHq1_6FYB0tBldx3yWk3U8olZ3SiPAe_NRnY0vUKI3ZANOA-IRYxyTAfjShJE0fRMCe70BsqzJj3RDAciqt5IaP2vZQeImjPZLd2NGo-Bbw=s96-c",
+            seconds: 543960,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "9ed91bb9-db45-4cef-b39c-819856e98c30",
+            username: "jon",
+            avatar_url:
+              "https://lh3.googleusercontent.com/a/ACg8ocJEE9R4__Pdh40DHGD-3noKezyw-1qo2auV_cb2gxBg=s96-c",
+            seconds: 464100,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "a73425d1-53a7-43d3-b6ae-cae9ba59b92b",
+            username: "ammar",
+            avatar_url: "https://avatars.githubusercontent.com/u/7416144?v=4",
+            seconds: 316200,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "af657bc3-6949-4b1b-bc2d-d41a40b546a4",
+            username: "BrunoQuaresma",
+            avatar_url: "https://avatars.githubusercontent.com/u/3165839?v=4",
+            seconds: 329100,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "b006209d-fdd2-4716-afb2-104dafb32dfb",
+            username: "mtojek",
+            avatar_url: "https://avatars.githubusercontent.com/u/14044910?v=4",
+            seconds: 11520,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "b3e1b884-1a5b-44eb-b8b3-423f8eddc503",
+            username: "spikecurtis",
+            avatar_url: "https://avatars.githubusercontent.com/u/5375600?v=4",
+            seconds: 523140,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "baf63990-16a9-472f-b715-64e24c6bcefb",
+            username: "atif",
+            avatar_url:
+              "https://lh3.googleusercontent.com/a-/ALV-UjVWiI2I5XOkxxi5KwAyfzZlfcOSYlMw8dIwJVwg2satTlOaLUy2PXcFcHCYtMg41DImXlB4F7YFIEW-CR_ANiCol7LnHTFomTyeh5N4ZvVQ4rx_sCl3PARywl0-UBW6usVGRVB8CnHve95q4ZDzJA6wJGVvr7gceCpgGe2A2597_KM1L5KIWKr5SAn41AZgQHZc7pgYJtiyKNleDN8LYzmceOtR3GJgFKjMrSOczNLNI3S2TrRPmIBIr_pZFDI3_npKDmQu9fPiVip5RDTAsuP9PdqruNJ4rB0rBae4Gog-RhqUV4L_i01-bJ6aepjH9gqxEkHHkXi7W0ldH8uV2fsQ4Eul78OQp0NrWxx9xZmFseTPK0toiop3EAWnuyp5ikaAnLodtvJ8L3iZXh45LvDv1ADESYPVAeuyHY5eee54O5xy72HABVB_UTE45Zhq086i4zaTNZoObXPrgiU3uNo0EhDQKa2jPNY2oQO0oZa991Oo9zCT9AULz5RP_3GTnfRMgD8ofCKr8Y3dVmSGI0RYOMI5Yqi76sEROCT5LqwAqRTFeGSMIF7-VI9qCctCtZ50n0OVtbFjPCgUGFVN1gZxe2qb66XCQnZOklTaMadj7KvtgIIJFlBSZJLkoPhSyIdiUAOp3VpDn8jOuEI0109YHzEM7l5KFNL-cHxQQyYB9hquld6y6EVRJdro8uVQdwkZ-_Yu4oD70A-WLb-Gi5RLdbB1iFwr99Lg-l4HNDWhh0h1wT5yhn4kgjPMgeTNT7F6fkiteAIvK_jJjVVh-PtKTt48kPv9c7rbc_jCBP70zUQ9X4Xxf9917BPUfvMgLk0gShSaFXxAGTgA7TzRaEsWSi9_DuJ0Q-yQZXwCJ1Y_1VrSF9B2FKsrugotVoC5BORu9tiaWi9jRP6RymM2X0HxsLv0lUFFVjgV0SZnynBNCgqyS02xAs8vEYpw-T7RJg=s96-c",
+            seconds: 2040,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "c0240345-f14a-4632-b713-a0f09c2ed927",
+            username: "asher-user",
+            avatar_url: "",
+            seconds: 0,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "c5eb8310-cf4f-444c-b223-0e991f828b40",
+            username: "Emyrk",
+            avatar_url: "https://avatars.githubusercontent.com/u/5446298?v=4",
+            seconds: 24540,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "d96bf761-3f94-46b3-a1da-6316e2e4735d",
+            username: "aslilac",
+            avatar_url: "https://avatars.githubusercontent.com/u/418348?v=4",
+            seconds: 824820,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "db38462b-e63d-4304-87e9-2640eea4a3b8",
+            username: "marc",
+            avatar_url: "",
+            seconds: 120,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "e9b24091-a633-4ba0-9746-ca325a86f0f5",
+            username: "michaelsmith",
+            avatar_url:
+              "https://lh3.googleusercontent.com/a-/ALV-UjXDMd9gEl4aMyM5ENfj4Ruzzn57AETWW6UuNC3Od03Y3AjvrCDhp8iE4I8L0393C_peQF9PZQyVklGCW-FCzODkvyVojUFqafbFi6AtvxjKn59ZyUVtG0ELoDNZOtRQaqUuMNIjtafNQ19LgwYm7LSB47My__oafDZ6jw6Kd_H-qtx19Vh62t3ACoJBHpDrF0BdDxWGBCkUAlC8aJcnqdRqPbKB5WGGcEfwLzrhLc5REN4CuXzm09_ZpU2jdvMUKCBX9H_8j2wcPwtgY0JG0DfIOX_VgTdM6Zy7BLiVQHSjD-uSkwqOEoXvsuKWlEBt74rqjyNDjjM1NyHiUdKpUd26hI2jcro_yrf4Jli7MCf5SjnkGMxQCgrD6-D9bcyBNzXpc1_5mDWrGpSh0X6pVK6GsmuYAc68hfTIHYVs-jB97mls9ClOJ2m51AdOAlizT80Ram2yJ09l-YbTVd4fG3L9FajMsvRhcvwwvN5tGcOk36KcIm0wFy9NQyH09QP3M1Rr2kDn9MzYYuyAZ9Um0tZydrPN9FA59JUytq8GtwnZZVmlZk2X2fXsCgJBv3dCwuF3THqSvL0M3lQa89-slrp2qgSRekiCmbb0-b62T413mOA9KNXcCvct_NN-JAE0b6o7To8B1WW8-AZiFQ2DesSEXL-CWYfqfecs4hoIrSBnQLa3Pm2Q5O-R7R99eRD7H3EqPihl_TiG2s_8gvLUF7ft55hYkV0j-YzTS4nOnUtEAXSqN-JYAd_BTJPJ0kyJLGIScwUQGoNFUQYs5nmlKPepeNpoQYYpQe0zK4ZVYm6fnRXUgv1cWvkD5RuxbBs1kgoVyZrZSNco8apuIjg6sBejRJFre_m0N6emp-Jn5wIkFB1f6IRb7S1aPvCqrqgqI8mTcI6Z-4Z3E3YwiYsn8_zVF9EPa1f1zpzeoppGd_YKaAxLjyOv_nC15bN3eio43A=s96-c",
+            seconds: 449820,
+          },
+          {
+            template_ids: ["0d286645-29aa-4eaf-9b52-cc5d2740c90b"],
+            user_id: "fdc2dab9-dabd-4980-843f-2e93042db566",
+            username: "sharkymark",
+            avatar_url: "https://avatars.githubusercontent.com/u/2022166?v=4",
+            seconds: 124440,
+          },
+        ],
+      },
+    },
+  },
+};
+
+export const LoadedWithUserLimit: Story = {
+  ...Loaded,
+  args: {
+    ...Loaded.args,
+    entitlements: MockEntitlementsWithUserLimit,
   },
-}
+};
diff --git a/site/src/pages/TemplatePage/TemplateInsightsPage/TemplateInsightsPage.tsx b/site/src/pages/TemplatePage/TemplateInsightsPage/TemplateInsightsPage.tsx
index 210458a6f2f44..4a74227f2c857 100644
--- a/site/src/pages/TemplatePage/TemplateInsightsPage/TemplateInsightsPage.tsx
+++ b/site/src/pages/TemplatePage/TemplateInsightsPage/TemplateInsightsPage.tsx
@@ -1,46 +1,84 @@
-import LinearProgress from "@mui/material/LinearProgress"
-import Box from "@mui/material/Box"
-import { styled, useTheme } from "@mui/material/styles"
-import { BoxProps } from "@mui/system"
-import { useQuery } from "@tanstack/react-query"
-import { getInsightsTemplate, getInsightsUserLatency } from "api/api"
-import { DAUChart, DAUTitle } from "components/DAUChart/DAUChart"
-import { useTemplateLayoutContext } from "components/TemplateLayout/TemplateLayout"
+import LinearProgress from "@mui/material/LinearProgress";
+import Box from "@mui/material/Box";
+import { styled, useTheme } from "@mui/material/styles";
+import { BoxProps } from "@mui/system";
+import { useQuery } from "react-query";
+import {
+  ActiveUsersTitle,
+  ActiveUserChart,
+} from "components/ActiveUserChart/ActiveUserChart";
+import { useTemplateLayoutContext } from "pages/TemplatePage/TemplateLayout";
 import {
   HelpTooltip,
   HelpTooltipTitle,
   HelpTooltipText,
-} from "components/Tooltips/HelpTooltip"
-import { UserAvatar } from "components/UserAvatar/UserAvatar"
-import { getLatencyColor } from "utils/latency"
-import chroma from "chroma-js"
-import { colors } from "theme/colors"
-import { Helmet } from "react-helmet-async"
-import { getTemplatePageTitle } from "../utils"
-import { Loader } from "components/Loader/Loader"
+} from "components/HelpTooltip/HelpTooltip";
+import { UserAvatar } from "components/UserAvatar/UserAvatar";
+import { getLatencyColor } from "utils/latency";
+import chroma from "chroma-js";
+import { colors } from "theme/colors";
+import { Helmet } from "react-helmet-async";
+import { getTemplatePageTitle } from "../utils";
+import { Loader } from "components/Loader/Loader";
 import {
-  DAUsResponse,
+  Entitlements,
+  Template,
+  TemplateAppUsage,
   TemplateInsightsResponse,
+  TemplateParameterUsage,
+  TemplateParameterValue,
+  UserActivityInsightsResponse,
   UserLatencyInsightsResponse,
-} from "api/typesGenerated"
-import { ComponentProps } from "react"
-import subDays from "date-fns/subDays"
+} from "api/typesGenerated";
+import { ComponentProps, ReactNode } from "react";
+import { subDays, addWeeks, format } from "date-fns";
+import "react-date-range/dist/styles.css";
+import "react-date-range/dist/theme/default.css";
+import { DateRange as DailyPicker, DateRangeValue } from "./DateRange";
+import Link from "@mui/material/Link";
+import CheckCircleOutlined from "@mui/icons-material/CheckCircleOutlined";
+import CancelOutlined from "@mui/icons-material/CancelOutlined";
+import { lastWeeks } from "./utils";
+import Tooltip from "@mui/material/Tooltip";
+import LinkOutlined from "@mui/icons-material/LinkOutlined";
+import { InsightsInterval, IntervalMenu } from "./IntervalMenu";
+import { WeekPicker, numberOfWeeksOptions } from "./WeekPicker";
+import {
+  insightsTemplate,
+  insightsUserActivity,
+  insightsUserLatency,
+} from "api/queries/insights";
+import { useSearchParams } from "react-router-dom";
+import { entitlements } from "api/queries/entitlements";
+
+const DEFAULT_NUMBER_OF_WEEKS = numberOfWeeksOptions[0];
 
 export default function TemplateInsightsPage() {
-  const { template } = useTemplateLayoutContext()
-  const insightsFilter = {
+  const { template } = useTemplateLayoutContext();
+  const [searchParams, setSearchParams] = useSearchParams();
+
+  const defaultInterval = getDefaultInterval(template);
+  const interval =
+    (searchParams.get("interval") as InsightsInterval) || defaultInterval;
+
+  const dateRange = getDateRange(searchParams, interval);
+  const setDateRange = (newDateRange: DateRangeValue) => {
+    searchParams.set("startDate", newDateRange.startDate.toISOString());
+    searchParams.set("endDate", newDateRange.endDate.toISOString());
+    setSearchParams(searchParams);
+  };
+
+  const commonFilters = {
     template_ids: template.id,
-    start_time: toTimeFilter(sevenDaysAgo()),
-    end_time: toTimeFilter(new Date()),
-  }
-  const { data: templateInsights } = useQuery({
-    queryKey: ["templates", template.id, "usage"],
-    queryFn: () => getInsightsTemplate(insightsFilter),
-  })
-  const { data: userLatency } = useQuery({
-    queryKey: ["templates", template.id, "user-latency"],
-    queryFn: () => getInsightsUserLatency(insightsFilter),
-  })
+    start_time: toISOLocal(dateRange.startDate),
+    end_time: toISOLocal(dateRange.endDate),
+  };
+
+  const insightsFilter = { ...commonFilters, interval };
+  const { data: templateInsights } = useQuery(insightsTemplate(insightsFilter));
+  const { data: userLatency } = useQuery(insightsUserLatency(commonFilters));
+  const { data: userActivity } = useQuery(insightsUserActivity(commonFilters));
+  const { data: entitlementsQuery } = useQuery(entitlements());
 
   return (
     <>
@@ -48,71 +86,168 @@ export default function TemplateInsightsPage() {
         <title>{getTemplatePageTitle("Insights", template)}</title>
       </Helmet>
       <TemplateInsightsPageView
+        controls={
+          <>
+            <IntervalMenu
+              value={interval}
+              onChange={(interval) => {
+                // When going from daily to week we need to set a safe week range
+                if (interval === "week") {
+                  setDateRange(lastWeeks(DEFAULT_NUMBER_OF_WEEKS));
+                }
+                searchParams.set("interval", interval);
+                setSearchParams(searchParams);
+              }}
+            />
+            {interval === "day" ? (
+              <DailyPicker value={dateRange} onChange={setDateRange} />
+            ) : (
+              <WeekPicker value={dateRange} onChange={setDateRange} />
+            )}
+          </>
+        }
         templateInsights={templateInsights}
         userLatency={userLatency}
+        userActivity={userActivity}
+        interval={interval}
+        entitlements={entitlementsQuery}
       />
     </>
-  )
+  );
 }
 
+const getDefaultInterval = (template: Template) => {
+  const now = new Date();
+  const templateCreateDate = new Date(template.created_at);
+  const hasFiveWeeksOrMore = addWeeks(templateCreateDate, 5) < now;
+  return hasFiveWeeksOrMore ? "week" : "day";
+};
+
+const getDateRange = (
+  searchParams: URLSearchParams,
+  interval: InsightsInterval,
+) => {
+  const startDate = searchParams.get("startDate");
+  const endDate = searchParams.get("endDate");
+
+  if (startDate && endDate) {
+    return {
+      startDate: new Date(startDate),
+      endDate: new Date(endDate),
+    };
+  }
+
+  if (interval === "day") {
+    return {
+      startDate: subDays(new Date(), 6),
+      endDate: new Date(),
+    };
+  }
+
+  return lastWeeks(DEFAULT_NUMBER_OF_WEEKS);
+};
+
 export const TemplateInsightsPageView = ({
   templateInsights,
   userLatency,
+  userActivity,
+  entitlements,
+  controls,
+  interval,
 }: {
-  templateInsights: TemplateInsightsResponse | undefined
-  userLatency: UserLatencyInsightsResponse | undefined
+  templateInsights: TemplateInsightsResponse | undefined;
+  userLatency: UserLatencyInsightsResponse | undefined;
+  userActivity: UserActivityInsightsResponse | undefined;
+  entitlements: Entitlements | undefined;
+  controls: ReactNode;
+  interval: InsightsInterval;
 }) => {
   return (
-    <Box
-      sx={{
-        display: "grid",
-        gridTemplateColumns: "repeat(3, minmax(0, 1fr))",
-        gridTemplateRows: "440px auto",
-        gap: (theme) => theme.spacing(3),
-      }}
-    >
-      <DailyUsersPanel
-        sx={{ gridColumn: "span 2" }}
-        data={templateInsights?.interval_reports}
-      />
-      <UserLatencyPanel data={userLatency} />
-      <TemplateUsagePanel
-        sx={{ gridColumn: "span 3" }}
-        data={templateInsights?.report.apps_usage}
-      />
-    </Box>
-  )
-}
+    <>
+      <Box
+        css={(theme) => ({
+          marginBottom: theme.spacing(4),
+          display: "flex",
+          alignItems: "center",
+          gap: theme.spacing(1),
+        })}
+      >
+        {controls}
+      </Box>
+      <Box
+        sx={{
+          display: "grid",
+          gridTemplateColumns: "repeat(3, minmax(0, 1fr))",
+          gridTemplateRows: "440px 440px auto",
+          gap: (theme) => theme.spacing(3),
+        }}
+      >
+        <ActiveUsersPanel
+          sx={{ gridColumn: "span 2" }}
+          interval={interval}
+          userLimit={
+            entitlements?.features.user_limit.enabled
+              ? entitlements?.features.user_limit.limit
+              : undefined
+          }
+          data={templateInsights?.interval_reports}
+        />
+        <UsersLatencyPanel data={userLatency} />
+        <TemplateUsagePanel
+          sx={{ gridColumn: "span 2" }}
+          data={templateInsights?.report?.apps_usage}
+        />
+        <UsersActivityPanel data={userActivity} />
+        <TemplateParametersUsagePanel
+          sx={{ gridColumn: "span 3" }}
+          data={templateInsights?.report?.parameters_usage}
+        />
+      </Box>
+    </>
+  );
+};
 
-const DailyUsersPanel = ({
+const ActiveUsersPanel = ({
   data,
+  interval,
+  userLimit,
   ...panelProps
 }: PanelProps & {
-  data: TemplateInsightsResponse["interval_reports"] | undefined
+  data: TemplateInsightsResponse["interval_reports"] | undefined;
+  interval: InsightsInterval;
+  userLimit: number | undefined;
 }) => {
   return (
     <Panel {...panelProps}>
       <PanelHeader>
         <PanelTitle>
-          <DAUTitle />
+          <ActiveUsersTitle />
         </PanelTitle>
-        <PanelSubtitle>Last 7 days</PanelSubtitle>
       </PanelHeader>
       <PanelContent>
         {!data && <Loader sx={{ height: "100%" }} />}
         {data && data.length === 0 && <NoDataAvailable />}
-        {data && data.length > 0 && <DAUChart daus={mapToDAUsResponse(data)} />}
+        {data && data.length > 0 && (
+          <ActiveUserChart
+            interval={interval}
+            userLimit={userLimit}
+            data={data.map((d) => ({
+              amount: d.active_users,
+              date: d.start_time,
+            }))}
+          />
+        )}
       </PanelContent>
     </Panel>
-  )
-}
+  );
+};
 
-const UserLatencyPanel = ({
+const UsersLatencyPanel = ({
   data,
   ...panelProps
 }: PanelProps & { data: UserLatencyInsightsResponse | undefined }) => {
-  const theme = useTheme()
-  const users = data?.report.users
+  const theme = useTheme();
+  const users = data?.report.users;
 
   return (
     <Panel {...panelProps} sx={{ overflowY: "auto", ...panelProps.sx }}>
@@ -126,7 +261,6 @@ const UserLatencyPanel = ({
             </HelpTooltipText>
           </HelpTooltip>
         </PanelTitle>
-        <PanelSubtitle>Last 7 days</PanelSubtitle>
       </PanelHeader>
       <PanelContent>
         {!data && <Loader sx={{ height: "100%" }} />}
@@ -140,6 +274,7 @@ const UserLatencyPanel = ({
                 sx={{
                   display: "flex",
                   justifyContent: "space-between",
+                  alignItems: "center",
                   fontSize: 14,
                   py: 1,
                 }}
@@ -165,39 +300,104 @@ const UserLatencyPanel = ({
             ))}
       </PanelContent>
     </Panel>
-  )
-}
+  );
+};
+
+const UsersActivityPanel = ({
+  data,
+  ...panelProps
+}: PanelProps & { data: UserActivityInsightsResponse | undefined }) => {
+  const users = data?.report.users;
+
+  return (
+    <Panel {...panelProps} sx={{ overflowY: "auto", ...panelProps.sx }}>
+      <PanelHeader>
+        <PanelTitle sx={{ display: "flex", alignItems: "center", gap: 1 }}>
+          Activity by user
+          <HelpTooltip size="small">
+            <HelpTooltipTitle>How is activity calculated?</HelpTooltipTitle>
+            <HelpTooltipText>
+              When a connection is initiated to a user&apos;s workspace they are
+              considered an active user. e.g. apps, web terminal, SSH
+            </HelpTooltipText>
+          </HelpTooltip>
+        </PanelTitle>
+      </PanelHeader>
+      <PanelContent>
+        {!data && <Loader sx={{ height: "100%" }} />}
+        {users && users.length === 0 && <NoDataAvailable />}
+        {users &&
+          users
+            .sort((a, b) => b.seconds - a.seconds)
+            .map((row) => (
+              <Box
+                key={row.user_id}
+                sx={{
+                  display: "flex",
+                  justifyContent: "space-between",
+                  alignItems: "center",
+                  fontSize: 14,
+                  py: 1,
+                }}
+              >
+                <Box sx={{ display: "flex", alignItems: "center", gap: 1.5 }}>
+                  <UserAvatar
+                    username={row.username}
+                    avatarURL={row.avatar_url}
+                  />
+                  <Box sx={{ fontWeight: 500 }}>{row.username}</Box>
+                </Box>
+                <Box
+                  css={(theme) => ({
+                    color: theme.palette.text.secondary,
+                    fontSize: 13,
+                    textAlign: "right",
+                  })}
+                >
+                  {formatTime(row.seconds)}
+                </Box>
+              </Box>
+            ))}
+      </PanelContent>
+    </Panel>
+  );
+};
 
 const TemplateUsagePanel = ({
   data,
   ...panelProps
 }: PanelProps & {
-  data: TemplateInsightsResponse["report"]["apps_usage"] | undefined
+  data: TemplateAppUsage[] | undefined;
 }) => {
-  const validUsage = data?.filter((u) => u.seconds > 0)
+  const validUsage = data?.filter((u) => u.seconds > 0);
   const totalInSeconds =
-    validUsage?.reduce((total, usage) => total + usage.seconds, 0) ?? 1
+    validUsage?.reduce((total, usage) => total + usage.seconds, 0) ?? 1;
   const usageColors = chroma
     .scale([colors.green[8], colors.blue[8]])
     .mode("lch")
-    .colors(validUsage?.length ?? 0)
+    .colors(validUsage?.length ?? 0);
   // The API returns a row for each app, even if the user didn't use it.
-  const hasDataAvailable = validUsage && validUsage.length > 0
+  const hasDataAvailable = validUsage && validUsage.length > 0;
   return (
-    <Panel {...panelProps}>
+    <Panel {...panelProps} css={{ overflowY: "auto" }}>
       <PanelHeader>
         <PanelTitle>App & IDE Usage</PanelTitle>
-        <PanelSubtitle>Last 7 days</PanelSubtitle>
       </PanelHeader>
       <PanelContent>
-        {!data && <Loader sx={{ height: 200 }} />}
-        {data && !hasDataAvailable && <NoDataAvailable sx={{ height: 200 }} />}
+        {!data && <Loader sx={{ height: "100%" }} />}
+        {data && !hasDataAvailable && <NoDataAvailable />}
         {data && hasDataAvailable && (
-          <Box sx={{ display: "flex", flexDirection: "column", gap: 3 }}>
+          <Box
+            sx={{
+              display: "flex",
+              flexDirection: "column",
+              gap: 3,
+            }}
+          >
             {validUsage
               .sort((a, b) => b.seconds - a.seconds)
               .map((usage, i) => {
-                const percentage = (usage.seconds / totalInSeconds) * 100
+                const percentage = (usage.seconds / totalInSeconds) * 100;
                 return (
                   <Box
                     key={usage.slug}
@@ -251,14 +451,247 @@ const TemplateUsagePanel = ({
                       {formatTime(usage.seconds)}
                     </Box>
                   </Box>
-                )
+                );
               })}
           </Box>
         )}
       </PanelContent>
     </Panel>
-  )
-}
+  );
+};
+
+const TemplateParametersUsagePanel = ({
+  data,
+  ...panelProps
+}: PanelProps & {
+  data: TemplateParameterUsage[] | undefined;
+}) => {
+  return (
+    <Panel {...panelProps}>
+      <PanelHeader>
+        <PanelTitle>Parameters usage</PanelTitle>
+      </PanelHeader>
+      <PanelContent>
+        {!data && <Loader sx={{ height: 200 }} />}
+        {data && data.length === 0 && <NoDataAvailable sx={{ height: 200 }} />}
+        {data &&
+          data.length > 0 &&
+          data.map((parameter, parameterIndex) => {
+            const label =
+              parameter.display_name !== ""
+                ? parameter.display_name
+                : parameter.name;
+            return (
+              <Box
+                key={parameter.name}
+                sx={{
+                  display: "flex",
+                  alignItems: "start",
+                  p: 3,
+                  marginX: -3,
+                  borderTop: (theme) => `1px solid ${theme.palette.divider}`,
+                  width: (theme) => `calc(100% + ${theme.spacing(6)})`,
+                  "&:first-child": {
+                    borderTop: 0,
+                  },
+                }}
+              >
+                <Box sx={{ flex: 1 }}>
+                  <Box sx={{ fontWeight: 500 }}>{label}</Box>
+                  <Box
+                    component="p"
+                    sx={{
+                      fontSize: 14,
+                      color: (theme) => theme.palette.text.secondary,
+                      maxWidth: 400,
+                      margin: 0,
+                    }}
+                  >
+                    {parameter.description}
+                  </Box>
+                </Box>
+                <Box sx={{ flex: 1, fontSize: 14 }}>
+                  <ParameterUsageRow
+                    sx={{
+                      color: (theme) => theme.palette.text.secondary,
+                      fontWeight: 500,
+                      fontSize: 13,
+                      cursor: "default",
+                    }}
+                  >
+                    <Box>Value</Box>
+                    <Tooltip
+                      title="The number of workspaces using this value"
+                      placement="top"
+                    >
+                      <Box>Count</Box>
+                    </Tooltip>
+                  </ParameterUsageRow>
+                  {parameter.values
+                    .sort((a, b) => b.count - a.count)
+                    .filter((usage) => filterOrphanValues(usage, parameter))
+                    .map((usage, usageIndex) => (
+                      <ParameterUsageRow
+                        key={`${parameterIndex}-${usageIndex}`}
+                      >
+                        <ParameterUsageLabel
+                          usage={usage}
+                          parameter={parameter}
+                        />
+                        <Box sx={{ textAlign: "right" }}>{usage.count}</Box>
+                      </ParameterUsageRow>
+                    ))}
+                </Box>
+              </Box>
+            );
+          })}
+      </PanelContent>
+    </Panel>
+  );
+};
+
+const filterOrphanValues = (
+  usage: TemplateParameterValue,
+  parameter: TemplateParameterUsage,
+) => {
+  if (parameter.options) {
+    return parameter.options.some((o) => o.value === usage.value);
+  }
+  return true;
+};
+
+const ParameterUsageRow = styled(Box)(({ theme }) => ({
+  display: "flex",
+  alignItems: "baseline",
+  justifyContent: "space-between",
+  padding: theme.spacing(0.5, 0),
+  gap: theme.spacing(5),
+}));
+
+const ParameterUsageLabel = ({
+  usage,
+  parameter,
+}: {
+  usage: TemplateParameterValue;
+  parameter: TemplateParameterUsage;
+}) => {
+  if (parameter.options) {
+    const option = parameter.options.find((o) => o.value === usage.value)!;
+    const icon = option.icon;
+    const label = option.name;
+
+    return (
+      <Box
+        sx={{
+          display: "flex",
+          alignItems: "center",
+          gap: 2,
+        }}
+      >
+        {icon && (
+          <Box sx={{ width: 16, height: 16, lineHeight: 1 }}>
+            <Box
+              component="img"
+              src={icon}
+              sx={{
+                objectFit: "contain",
+                width: "100%",
+                height: "100%",
+              }}
+            />
+          </Box>
+        )}
+        {label}
+      </Box>
+    );
+  }
+
+  if (usage.value.startsWith("http")) {
+    return (
+      <Link
+        href={usage.value}
+        target="_blank"
+        rel="noreferrer"
+        sx={{
+          display: "flex",
+          alignItems: "center",
+          gap: 1,
+          color: (theme) => theme.palette.text.primary,
+        }}
+      >
+        <TextValue>{usage.value}</TextValue>
+        <LinkOutlined
+          sx={{
+            width: 14,
+            height: 14,
+            color: (theme) => theme.palette.primary.light,
+          }}
+        />
+      </Link>
+    );
+  }
+
+  if (parameter.type === "list(string)") {
+    const values = JSON.parse(usage.value) as string[];
+    return (
+      <Box sx={{ display: "flex", gap: 1, flexWrap: "wrap" }}>
+        {values.map((v, i) => {
+          return (
+            <Box
+              key={i}
+              sx={{
+                p: (theme) => theme.spacing(0.25, 1.5),
+                borderRadius: 999,
+                background: (theme) => theme.palette.divider,
+                whiteSpace: "nowrap",
+              }}
+            >
+              {v}
+            </Box>
+          );
+        })}
+      </Box>
+    );
+  }
+
+  if (parameter.type === "bool") {
+    return (
+      <Box
+        sx={{
+          display: "flex",
+          alignItems: "center",
+          gap: 1,
+        }}
+      >
+        {usage.value === "false" ? (
+          <>
+            <CancelOutlined
+              sx={{
+                width: 16,
+                height: 16,
+                color: (theme) => theme.palette.error.light,
+              }}
+            />
+            False
+          </>
+        ) : (
+          <>
+            <CheckCircleOutlined
+              sx={{
+                width: 16,
+                height: 16,
+                color: (theme) => theme.palette.success.light,
+              }}
+            />
+            True
+          </>
+        )}
+      </Box>
+    );
+  }
+
+  return <TextValue>{usage.value}</TextValue>;
+};
 
 const Panel = styled(Box)(({ theme }) => ({
   borderRadius: theme.shape.borderRadius,
@@ -266,28 +699,23 @@ const Panel = styled(Box)(({ theme }) => ({
   backgroundColor: theme.palette.background.paper,
   display: "flex",
   flexDirection: "column",
-}))
+}));
 
-type PanelProps = ComponentProps<typeof Panel>
+type PanelProps = ComponentProps<typeof Panel>;
 
 const PanelHeader = styled(Box)(({ theme }) => ({
   padding: theme.spacing(2.5, 3, 3),
-}))
+}));
 
 const PanelTitle = styled(Box)(() => ({
   fontSize: 14,
   fontWeight: 500,
-}))
-
-const PanelSubtitle = styled(Box)(({ theme }) => ({
-  fontSize: 13,
-  color: theme.palette.text.secondary,
-}))
+}));
 
 const PanelContent = styled(Box)(({ theme }) => ({
   padding: theme.spacing(0, 3, 3),
   flex: 1,
-}))
+}));
 
 const NoDataAvailable = (props: BoxProps) => {
   return (
@@ -306,49 +734,54 @@ const NoDataAvailable = (props: BoxProps) => {
     >
       No data available
     </Box>
-  )
-}
-
-function mapToDAUsResponse(
-  data: TemplateInsightsResponse["interval_reports"],
-): DAUsResponse {
-  return {
-    tz_hour_offset: 0,
-    entries: data.map((d) => {
-      return {
-        amount: d.active_users,
-        date: d.end_time,
-      }
-    }),
-  }
-}
+  );
+};
 
-function toTimeFilter(date: Date) {
-  date.setHours(0, 0, 0, 0)
-  const year = date.getUTCFullYear()
-  const month = String(date.getUTCMonth() + 1).padStart(2, "0")
-  const day = String(date.getUTCDate()).padStart(2, "0")
-
-  return `${year}-${month}-${day}T00:00:00Z`
-}
+const TextValue = ({ children }: { children: ReactNode }) => {
+  return (
+    <Box component="span">
+      <Box
+        component="span"
+        sx={{
+          color: (theme) => theme.palette.text.secondary,
+          weight: 600,
+          mr: 0.25,
+        }}
+      >
+        &quot;
+      </Box>
+      {children}
+      <Box
+        component="span"
+        sx={{
+          color: (theme) => theme.palette.text.secondary,
+          weight: 600,
+          ml: 0.25,
+        }}
+      >
+        &quot;
+      </Box>
+    </Box>
+  );
+};
 
 function formatTime(seconds: number): string {
   if (seconds < 60) {
-    return seconds + " seconds"
+    return seconds + " seconds";
   } else if (seconds >= 60 && seconds < 3600) {
-    const minutes = Math.floor(seconds / 60)
-    return minutes + " minutes"
+    const minutes = Math.floor(seconds / 60);
+    return minutes + " minutes";
   } else {
-    const hours = seconds / 3600
-    const minutes = Math.floor(seconds % 3600)
+    const hours = seconds / 3600;
+    const minutes = Math.floor(seconds % 3600);
     if (minutes === 0) {
-      return hours.toFixed(0) + " hours"
+      return hours.toFixed(0) + " hours";
     }
 
-    return hours.toFixed(1) + " hours"
+    return hours.toFixed(1) + " hours";
   }
 }
 
-function sevenDaysAgo() {
-  return subDays(new Date(), 7)
+function toISOLocal(d: Date) {
+  return format(d, "yyyy-MM-dd'T'HH:mm:ssxxx");
 }
diff --git a/site/src/pages/TemplatePage/TemplateInsightsPage/WeekPicker.tsx b/site/src/pages/TemplatePage/TemplateInsightsPage/WeekPicker.tsx
new file mode 100644
index 0000000000000..73ad35db9d02e
--- /dev/null
+++ b/site/src/pages/TemplatePage/TemplateInsightsPage/WeekPicker.tsx
@@ -0,0 +1,85 @@
+import CheckOutlined from "@mui/icons-material/CheckOutlined";
+import ExpandMoreOutlined from "@mui/icons-material/ExpandMoreOutlined";
+import Box from "@mui/material/Box";
+import Button from "@mui/material/Button";
+import Menu from "@mui/material/Menu";
+import MenuItem from "@mui/material/MenuItem";
+import { useState, useRef } from "react";
+import { DateRangeValue } from "./DateRange";
+import { differenceInWeeks } from "date-fns";
+import { lastWeeks } from "./utils";
+
+// There is no point in showing the period > 6 months. We prune stats older than
+// 6 months.
+export const numberOfWeeksOptions = [4, 12, 24] as const;
+
+export const WeekPicker = ({
+  value,
+  onChange,
+}: {
+  value: DateRangeValue;
+  onChange: (value: DateRangeValue) => void;
+}) => {
+  const anchorRef = useRef<HTMLButtonElement>(null);
+  const [open, setOpen] = useState(false);
+  const numberOfWeeks = differenceInWeeks(value.endDate, value.startDate);
+
+  const handleClose = () => {
+    setOpen(false);
+  };
+
+  return (
+    <div>
+      <Button
+        ref={anchorRef}
+        id="interval-button"
+        aria-controls={open ? "interval-menu" : undefined}
+        aria-haspopup="true"
+        aria-expanded={open ? "true" : undefined}
+        onClick={() => setOpen(true)}
+        endIcon={<ExpandMoreOutlined />}
+      >
+        Last {numberOfWeeks} weeks
+      </Button>
+      <Menu
+        id="interval-menu"
+        anchorEl={anchorRef.current}
+        open={open}
+        onClose={handleClose}
+        MenuListProps={{
+          "aria-labelledby": "interval-button",
+        }}
+        anchorOrigin={{
+          vertical: "bottom",
+          horizontal: "left",
+        }}
+        transformOrigin={{
+          vertical: "top",
+          horizontal: "left",
+        }}
+      >
+        {numberOfWeeksOptions.map((option) => {
+          const optionRange = lastWeeks(option);
+
+          return (
+            <MenuItem
+              css={{ fontSize: 14, justifyContent: "space-between" }}
+              key={option}
+              onClick={() => {
+                onChange(optionRange);
+                handleClose();
+              }}
+            >
+              Last {option} weeks
+              <Box css={{ width: 16, height: 16 }}>
+                {numberOfWeeks === option && (
+                  <CheckOutlined css={{ width: 16, height: 16 }} />
+                )}
+              </Box>
+            </MenuItem>
+          );
+        })}
+      </Menu>
+    </div>
+  );
+};
diff --git a/site/src/pages/TemplatePage/TemplateInsightsPage/utils.ts b/site/src/pages/TemplatePage/TemplateInsightsPage/utils.ts
new file mode 100644
index 0000000000000..e3e2dda4f2628
--- /dev/null
+++ b/site/src/pages/TemplatePage/TemplateInsightsPage/utils.ts
@@ -0,0 +1,8 @@
+import { startOfDay, subDays } from "date-fns";
+
+export const lastWeeks = (numberOfWeeks: number) => {
+  const now = new Date();
+  const endDate = startOfDay(subDays(now, 1));
+  const startDate = startOfDay(subDays(endDate, 7 * numberOfWeeks));
+  return { startDate, endDate };
+};
diff --git a/site/src/pages/TemplatePage/TemplateLayout.tsx b/site/src/pages/TemplatePage/TemplateLayout.tsx
new file mode 100644
index 0000000000000..41a15264c9a7b
--- /dev/null
+++ b/site/src/pages/TemplatePage/TemplateLayout.tsx
@@ -0,0 +1,120 @@
+import { useTheme } from "@emotion/react";
+import { createContext, type FC, Suspense, useContext } from "react";
+import { useQuery } from "react-query";
+import { Outlet, useNavigate, useParams } from "react-router-dom";
+import type { AuthorizationRequest } from "api/typesGenerated";
+import {
+  checkAuthorization,
+  getTemplateByName,
+  getTemplateVersion,
+} from "api/api";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { Margins } from "components/Margins/Margins";
+import { Loader } from "components/Loader/Loader";
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { TemplatePageHeader } from "./TemplatePageHeader";
+import { TabLink, Tabs } from "components/Tabs/Tabs";
+
+const templatePermissions = (
+  templateId: string,
+): AuthorizationRequest["checks"] => ({
+  canUpdateTemplate: {
+    object: {
+      resource_type: "template",
+      resource_id: templateId,
+    },
+    action: "update",
+  },
+});
+
+const fetchTemplate = async (orgId: string, templateName: string) => {
+  const template = await getTemplateByName(orgId, templateName);
+  const [activeVersion, permissions] = await Promise.all([
+    getTemplateVersion(template.active_version_id),
+    checkAuthorization({
+      checks: templatePermissions(template.id),
+    }),
+  ]);
+
+  return {
+    template,
+    activeVersion,
+    permissions,
+  };
+};
+
+type TemplateLayoutContextValue = Awaited<ReturnType<typeof fetchTemplate>>;
+
+const TemplateLayoutContext = createContext<
+  TemplateLayoutContextValue | undefined
+>(undefined);
+
+export const useTemplateLayoutContext = (): TemplateLayoutContextValue => {
+  const context = useContext(TemplateLayoutContext);
+  if (!context) {
+    throw new Error(
+      "useTemplateLayoutContext only can be used inside of TemplateLayout",
+    );
+  }
+  return context;
+};
+
+export const TemplateLayout: FC<{ children?: JSX.Element }> = ({
+  children = <Outlet />,
+}) => {
+  const theme = useTheme();
+  const navigate = useNavigate();
+  const orgId = useOrganizationId();
+  const { template: templateName } = useParams() as { template: string };
+  const { data, error, isLoading } = useQuery({
+    queryKey: ["template", templateName],
+    queryFn: () => fetchTemplate(orgId, templateName),
+  });
+  const shouldShowInsights = data?.permissions?.canUpdateTemplate;
+
+  if (error) {
+    return (
+      <div css={{ margin: theme.spacing(2) }}>
+        <ErrorAlert error={error} />
+      </div>
+    );
+  }
+
+  if (isLoading || !data) {
+    return <Loader />;
+  }
+
+  return (
+    <>
+      <TemplatePageHeader
+        template={data.template}
+        activeVersion={data.activeVersion}
+        permissions={data.permissions}
+        onDeleteTemplate={() => {
+          navigate("/templates");
+        }}
+      />
+
+      <Tabs>
+        <TabLink end to={`/templates/${templateName}`}>
+          Summary
+        </TabLink>
+        <TabLink to={`/templates/${templateName}/docs`}>Docs</TabLink>
+        {data.permissions.canUpdateTemplate && (
+          <TabLink to={`/templates/${templateName}/files`}>Source Code</TabLink>
+        )}
+        <TabLink to={`/templates/${templateName}/versions`}>Versions</TabLink>
+        <TabLink to={`/templates/${templateName}/embed`}>Embed</TabLink>
+        {shouldShowInsights && (
+          <TabLink to={`/templates/${templateName}/insights`}>Insights</TabLink>
+        )}
+      </Tabs>
+
+      <Margins>
+        <TemplateLayoutContext.Provider value={data}>
+          <Suspense fallback={<Loader />}>{children}</Suspense>
+        </TemplateLayoutContext.Provider>
+      </Margins>
+    </>
+  );
+};
diff --git a/site/src/pages/TemplatePage/TemplatePageHeader.stories.tsx b/site/src/pages/TemplatePage/TemplatePageHeader.stories.tsx
new file mode 100644
index 0000000000000..e5e837145ae06
--- /dev/null
+++ b/site/src/pages/TemplatePage/TemplatePageHeader.stories.tsx
@@ -0,0 +1,28 @@
+import { MockTemplate, MockTemplateVersion } from "testHelpers/entities";
+import { TemplatePageHeader } from "./TemplatePageHeader";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof TemplatePageHeader> = {
+  title: "pages/TemplatePage/TemplatePageHeader",
+  component: TemplatePageHeader,
+  args: {
+    template: MockTemplate,
+    activeVersion: MockTemplateVersion,
+    permissions: {
+      canUpdateTemplate: true,
+    },
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof TemplatePageHeader>;
+
+export const CanUpdate: Story = {};
+
+export const CanNotUpdate: Story = {
+  args: {
+    permissions: {
+      canUpdateTemplate: false,
+    },
+  },
+};
diff --git a/site/src/pages/TemplatePage/TemplatePageHeader.tsx b/site/src/pages/TemplatePage/TemplatePageHeader.tsx
new file mode 100644
index 0000000000000..ec2bae83bd852
--- /dev/null
+++ b/site/src/pages/TemplatePage/TemplatePageHeader.tsx
@@ -0,0 +1,240 @@
+import { type FC, useRef, useState } from "react";
+import { Link as RouterLink, useNavigate } from "react-router-dom";
+import { useDeletionDialogState } from "./useDeletionDialogState";
+
+import { useQuery } from "react-query";
+import { workspaces } from "api/queries/workspaces";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import {
+  AuthorizationResponse,
+  Template,
+  TemplateVersion,
+} from "api/typesGenerated";
+
+import { Avatar } from "components/Avatar/Avatar";
+import { DeleteDialog } from "components/Dialogs/DeleteDialog/DeleteDialog";
+import { Stack } from "components/Stack/Stack";
+import { Margins } from "components/Margins/Margins";
+import {
+  PageHeader,
+  PageHeaderTitle,
+  PageHeaderSubtitle,
+} from "components/PageHeader/PageHeader";
+
+import Button from "@mui/material/Button";
+import MoreVertOutlined from "@mui/icons-material/MoreVertOutlined";
+import Menu from "@mui/material/Menu";
+import MenuItem from "@mui/material/MenuItem";
+import IconButton from "@mui/material/IconButton";
+import AddIcon from "@mui/icons-material/AddOutlined";
+import SettingsIcon from "@mui/icons-material/SettingsOutlined";
+import DeleteIcon from "@mui/icons-material/DeleteOutlined";
+import EditIcon from "@mui/icons-material/EditOutlined";
+import CopyIcon from "@mui/icons-material/FileCopyOutlined";
+
+type TemplateMenuProps = {
+  templateName: string;
+  templateVersion: string;
+  templateId: string;
+  onDelete: () => void;
+};
+
+const TemplateMenu: FC<TemplateMenuProps> = ({
+  templateName,
+  templateVersion,
+  templateId,
+  onDelete,
+}) => {
+  const dialogState = useDeletionDialogState(templateId, onDelete);
+  const menuTriggerRef = useRef<HTMLButtonElement>(null);
+  const [isMenuOpen, setIsMenuOpen] = useState(false);
+  const navigate = useNavigate();
+
+  const queryText = `template:${templateName}`;
+  const workspaceCountQuery = useQuery({
+    ...workspaces({ q: queryText }),
+    select: (res) => res.count,
+  });
+
+  // Returns a function that will execute the action and close the menu
+  const onMenuItemClick = (actionFn: () => void) => () => {
+    setIsMenuOpen(false);
+    actionFn();
+  };
+
+  const safeToDeleteTemplate = workspaceCountQuery.data === 0;
+
+  return (
+    <>
+      <div>
+        <IconButton
+          aria-controls="template-options"
+          aria-haspopup="true"
+          onClick={() => setIsMenuOpen(true)}
+          ref={menuTriggerRef}
+          arial-label="More options"
+        >
+          <MoreVertOutlined />
+        </IconButton>
+
+        <Menu
+          id="template-options"
+          anchorEl={menuTriggerRef.current}
+          open={isMenuOpen}
+          onClose={() => setIsMenuOpen(false)}
+        >
+          <MenuItem
+            onClick={onMenuItemClick(() =>
+              navigate(`/templates/${templateName}/settings`),
+            )}
+          >
+            <SettingsIcon />
+            Settings
+          </MenuItem>
+
+          <MenuItem
+            onClick={onMenuItemClick(() =>
+              navigate(
+                `/templates/${templateName}/versions/${templateVersion}/edit`,
+              ),
+            )}
+          >
+            <EditIcon />
+            Edit files
+          </MenuItem>
+
+          <MenuItem
+            onClick={onMenuItemClick(() =>
+              navigate(`/templates/new?fromTemplate=${templateName}`),
+            )}
+          >
+            <CopyIcon />
+            Duplicate&hellip;
+          </MenuItem>
+
+          <MenuItem
+            onClick={onMenuItemClick(dialogState.openDeleteConfirmation)}
+          >
+            <DeleteIcon />
+            Delete&hellip;
+          </MenuItem>
+        </Menu>
+      </div>
+
+      {safeToDeleteTemplate ? (
+        <DeleteDialog
+          isOpen={dialogState.isDeleteDialogOpen}
+          onConfirm={dialogState.confirmDelete}
+          onCancel={dialogState.cancelDeleteConfirmation}
+          entity="template"
+          name={templateName}
+        />
+      ) : (
+        <ConfirmDialog
+          type="info"
+          title="Unable to delete"
+          hideCancel={false}
+          open={dialogState.isDeleteDialogOpen}
+          onClose={dialogState.cancelDeleteConfirmation}
+          confirmText="See workspaces"
+          confirmLoading={workspaceCountQuery.status !== "success"}
+          onConfirm={() => {
+            navigate({
+              pathname: "/workspaces",
+              search: new URLSearchParams({ filter: queryText }).toString(),
+            });
+          }}
+          description={
+            <>
+              {workspaceCountQuery.isSuccess && (
+                <>
+                  This template is used by{" "}
+                  <strong>
+                    {workspaceCountQuery.data} workspace
+                    {workspaceCountQuery.data === 1 ? "" : "s"}
+                  </strong>
+                  . Please delete all related workspaces before deleting this
+                  template.
+                </>
+              )}
+
+              {workspaceCountQuery.isLoading && (
+                <>Loading information about workspaces used by this template.</>
+              )}
+
+              {workspaceCountQuery.isError && (
+                <>Unable to determine workspaces used by this template.</>
+              )}
+            </>
+          }
+        />
+      )}
+    </>
+  );
+};
+
+export type TemplatePageHeaderProps = {
+  template: Template;
+  activeVersion: TemplateVersion;
+  permissions: AuthorizationResponse;
+  onDeleteTemplate: () => void;
+};
+
+export const TemplatePageHeader: FC<TemplatePageHeaderProps> = ({
+  template,
+  activeVersion,
+  permissions,
+  onDeleteTemplate,
+}) => {
+  const hasIcon = template.icon && template.icon !== "";
+
+  return (
+    <Margins>
+      <PageHeader
+        actions={
+          <>
+            <Button
+              variant="contained"
+              startIcon={<AddIcon />}
+              component={RouterLink}
+              to={`/templates/${template.name}/workspace`}
+            >
+              Create Workspace
+            </Button>
+
+            {permissions.canUpdateTemplate && (
+              <TemplateMenu
+                templateVersion={activeVersion.name}
+                templateName={template.name}
+                templateId={template.id}
+                onDelete={onDeleteTemplate}
+              />
+            )}
+          </>
+        }
+      >
+        <Stack direction="row" spacing={3} alignItems="center">
+          {hasIcon ? (
+            <Avatar size="xl" src={template.icon} variant="square" fitImage />
+          ) : (
+            <Avatar size="xl">{template.name}</Avatar>
+          )}
+
+          <div>
+            <PageHeaderTitle>
+              {template.display_name.length > 0
+                ? template.display_name
+                : template.name}
+            </PageHeaderTitle>
+
+            {template.description !== "" && (
+              <PageHeaderSubtitle condensed>
+                {template.description}
+              </PageHeaderSubtitle>
+            )}
+          </div>
+        </Stack>
+      </PageHeader>
+    </Margins>
+  );
+};
diff --git a/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateStats.stories.tsx b/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateStats.stories.tsx
new file mode 100644
index 0000000000000..244d2cd2c6cf7
--- /dev/null
+++ b/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateStats.stories.tsx
@@ -0,0 +1,61 @@
+import { MockTemplate, MockTemplateVersion } from "testHelpers/entities";
+import { TemplateStats } from "./TemplateStats";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof TemplateStats> = {
+  title: "pages/TemplatePage/TemplateStats",
+  component: TemplateStats,
+};
+
+export default meta;
+type Story = StoryObj<typeof TemplateStats>;
+
+export const Example: Story = {
+  args: {
+    template: MockTemplate,
+    activeVersion: MockTemplateVersion,
+  },
+};
+
+export const UsedByMany: Story = {
+  args: {
+    template: {
+      ...MockTemplate,
+      active_user_count: 15,
+    },
+    activeVersion: MockTemplateVersion,
+  },
+};
+
+export const ActiveUsersNotLoaded: Story = {
+  args: {
+    template: {
+      ...MockTemplate,
+      active_user_count: -1,
+    },
+    activeVersion: MockTemplateVersion,
+  },
+};
+
+export const LongTemplateVersion: Story = {
+  args: {
+    template: MockTemplate,
+    activeVersion: {
+      ...MockTemplateVersion,
+      name: "thisisareallyreallylongnamefortesting",
+    },
+  },
+  parameters: {
+    chromatic: { viewports: [960] },
+  },
+};
+
+export const SmallViewport: Story = {
+  args: {
+    template: MockTemplate,
+    activeVersion: MockTemplateVersion,
+  },
+  parameters: {
+    chromatic: { viewports: [600] },
+  },
+};
diff --git a/site/src/components/TemplateStats/TemplateStats.tsx b/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateStats.tsx
similarity index 80%
rename from site/src/components/TemplateStats/TemplateStats.tsx
rename to site/src/pages/TemplatePage/TemplateSummaryPage/TemplateStats.tsx
index 7b646a7c40342..a846698cdcf4d 100644
--- a/site/src/components/TemplateStats/TemplateStats.tsx
+++ b/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateStats.tsx
@@ -1,12 +1,12 @@
-import { Stats, StatsItem } from "components/Stats/Stats"
-import { FC } from "react"
-import { Link } from "react-router-dom"
-import { createDayString } from "utils/createDayString"
+import { Stats, StatsItem } from "components/Stats/Stats";
+import { FC } from "react";
+import { Link } from "react-router-dom";
+import { createDayString } from "utils/createDayString";
 import {
   formatTemplateBuildTime,
   formatTemplateActiveDevelopers,
-} from "utils/templates"
-import { Template, TemplateVersion } from "../../api/typesGenerated"
+} from "utils/templates";
+import { Template, TemplateVersion } from "api/typesGenerated";
 
 const Language = {
   usedByLabel: "Used by",
@@ -16,11 +16,11 @@ const Language = {
   developerPlural: "developers",
   developerSingular: "developer",
   createdByLabel: "Created by",
-}
+};
 
 export interface TemplateStatsProps {
-  template: Template
-  activeVersion: TemplateVersion
+  template: Template;
+  activeVersion: TemplateVersion;
 }
 
 export const TemplateStats: FC<TemplateStatsProps> = ({
@@ -61,5 +61,5 @@ export const TemplateStats: FC<TemplateStatsProps> = ({
         value={template.created_by_name}
       />
     </Stats>
-  )
-}
+  );
+};
diff --git a/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPage.test.tsx b/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPage.test.tsx
deleted file mode 100644
index de2e2c9747768..0000000000000
--- a/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPage.test.tsx
+++ /dev/null
@@ -1,53 +0,0 @@
-import { screen } from "@testing-library/react"
-import { TemplateLayout } from "components/TemplateLayout/TemplateLayout"
-import { rest } from "msw"
-import { ResizeObserver } from "resize-observer"
-import {
-  MockTemplate,
-  MockTemplateVersion,
-  MockMemberPermissions,
-} from "testHelpers/entities"
-import { renderWithAuth } from "testHelpers/renderHelpers"
-import { server } from "testHelpers/server"
-import * as CreateDayString from "utils/createDayString"
-import { TemplateSummaryPage } from "./TemplateSummaryPage"
-
-jest.mock("remark-gfm", () => jest.fn())
-
-Object.defineProperty(window, "ResizeObserver", {
-  value: ResizeObserver,
-})
-
-const renderPage = () =>
-  renderWithAuth(
-    <TemplateLayout>
-      <TemplateSummaryPage />
-    </TemplateLayout>,
-    {
-      route: `/templates/${MockTemplate.id}`,
-      path: "/templates/:template",
-    },
-  )
-
-describe("TemplateSummaryPage", () => {
-  it("shows the template name and resources", async () => {
-    // Mocking the dayjs module within the createDayString file
-    const mock = jest.spyOn(CreateDayString, "createDayString")
-    mock.mockImplementation(() => "a minute ago")
-
-    renderPage()
-    await screen.findByText(MockTemplate.display_name)
-    screen.queryAllByText(`${MockTemplateVersion.name}`).length
-  })
-  it("does not allow a member to delete a template", () => {
-    // get member-level permissions
-    server.use(
-      rest.post("/api/v2/authcheck", async (req, res, ctx) => {
-        return res(ctx.status(200), ctx.json(MockMemberPermissions))
-      }),
-    )
-    renderPage()
-    const dropdownButton = screen.queryByLabelText("open-dropdown")
-    expect(dropdownButton).toBe(null)
-  })
-})
diff --git a/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPage.tsx b/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPage.tsx
index e169c42591e54..69149d336233f 100644
--- a/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPage.tsx
+++ b/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPage.tsx
@@ -1,17 +1,17 @@
-import { useTemplateLayoutContext } from "components/TemplateLayout/TemplateLayout"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { getTemplatePageTitle } from "../utils"
-import { TemplateSummaryPageView } from "./TemplateSummaryPageView"
-import { useQuery } from "@tanstack/react-query"
-import { getTemplateVersionResources } from "api/api"
+import { useTemplateLayoutContext } from "pages/TemplatePage/TemplateLayout";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { getTemplatePageTitle } from "../utils";
+import { TemplateSummaryPageView } from "./TemplateSummaryPageView";
+import { useQuery } from "react-query";
+import { getTemplateVersionResources } from "api/api";
 
 export const TemplateSummaryPage: FC = () => {
-  const { template, activeVersion } = useTemplateLayoutContext()
+  const { template, activeVersion } = useTemplateLayoutContext();
   const { data: resources } = useQuery({
     queryKey: ["templates", template.id, "resources"],
     queryFn: () => getTemplateVersionResources(activeVersion.id),
-  })
+  });
 
   return (
     <>
@@ -24,7 +24,7 @@ export const TemplateSummaryPage: FC = () => {
         activeVersion={activeVersion}
       />
     </>
-  )
-}
+  );
+};
 
-export default TemplateSummaryPage
+export default TemplateSummaryPage;
diff --git a/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPageView.stories.tsx b/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPageView.stories.tsx
index 516d70362180e..edb53c9ee184c 100644
--- a/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPageView.stories.tsx
+++ b/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPageView.stories.tsx
@@ -1,66 +1,41 @@
-import { Meta, StoryObj } from "@storybook/react"
+import { Meta, StoryObj } from "@storybook/react";
 import {
   MockTemplate,
   MockTemplateVersion,
   MockTemplateVersion3,
   MockWorkspaceResource,
-  MockWorkspaceResource2,
-} from "testHelpers/entities"
-import { TemplateSummaryPageView } from "./TemplateSummaryPageView"
+  MockWorkspaceVolumeResource,
+} from "testHelpers/entities";
+import { TemplateSummaryPageView } from "./TemplateSummaryPageView";
 
 const meta: Meta<typeof TemplateSummaryPageView> = {
-  title: "pages/TemplateSummaryPageView",
+  title: "pages/TemplatePage/TemplateSummaryPageView",
   component: TemplateSummaryPageView,
-}
+};
 
-export default meta
-type Story = StoryObj<typeof TemplateSummaryPageView>
+export default meta;
+type Story = StoryObj<typeof TemplateSummaryPageView>;
 
 export const Example: Story = {
   args: {
     template: MockTemplate,
     activeVersion: MockTemplateVersion,
-    resources: [MockWorkspaceResource, MockWorkspaceResource2],
+    resources: [MockWorkspaceResource, MockWorkspaceVolumeResource],
   },
-}
+};
 
 export const NoIcon: Story = {
   args: {
     template: { ...MockTemplate, icon: "" },
     activeVersion: MockTemplateVersion,
-    resources: [MockWorkspaceResource, MockWorkspaceResource2],
+    resources: [MockWorkspaceResource, MockWorkspaceVolumeResource],
   },
-}
-
-export const SmallViewport: Story = {
-  args: {
-    template: MockTemplate,
-    activeVersion: {
-      ...MockTemplateVersion,
-      readme: `---
-    name:Template test
-    ---
-    ## Instructions
-    You can add instructions here
-
-    [Some link info](https://coder.com)
-    \`\`\`
-    # This is a really long sentence to test that the code block wraps into a new line properly.
-    \`\`\`
-    `,
-    },
-    resources: [MockWorkspaceResource, MockWorkspaceResource2],
-  },
-}
-
-SmallViewport.parameters = {
-  chromatic: { viewports: [600] },
-}
+};
 
 export const WithDeprecatedParameters: Story = {
   args: {
     template: MockTemplate,
     activeVersion: MockTemplateVersion3,
-    resources: [MockWorkspaceResource, MockWorkspaceResource2],
+    resources: [MockWorkspaceResource, MockWorkspaceVolumeResource],
   },
-}
+};
diff --git a/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPageView.tsx b/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPageView.tsx
index 06eefa264a209..a54f96f91d57f 100644
--- a/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPageView.tsx
+++ b/site/src/pages/TemplatePage/TemplateSummaryPage/TemplateSummaryPageView.tsx
@@ -1,20 +1,20 @@
-import {
+import { type FC, useEffect } from "react";
+import { useLocation, useNavigate } from "react-router-dom";
+import type {
   Template,
   TemplateVersion,
   WorkspaceResource,
-} from "api/typesGenerated"
-import { Loader } from "components/Loader/Loader"
-import { Stack } from "components/Stack/Stack"
-import { TemplateResourcesTable } from "components/TemplateResourcesTable/TemplateResourcesTable"
-import { TemplateStats } from "components/TemplateStats/TemplateStats"
-import { FC, useEffect } from "react"
-import { useLocation, useNavigate } from "react-router-dom"
-import { TemplateVersionWarnings } from "components/TemplateVersionWarnings/TemplateVersionWarnings"
+} from "api/typesGenerated";
+import { Loader } from "components/Loader/Loader";
+import { Stack } from "components/Stack/Stack";
+import { TemplateResourcesTable } from "components/TemplateResourcesTable/TemplateResourcesTable";
+import { TemplateStats } from "./TemplateStats";
+import { TemplateVersionWarnings } from "components/TemplateVersionWarnings/TemplateVersionWarnings";
 
 export interface TemplateSummaryPageViewProps {
-  resources?: WorkspaceResource[]
-  template: Template
-  activeVersion: TemplateVersion
+  resources?: WorkspaceResource[];
+  template: Template;
+  activeVersion: TemplateVersion;
 }
 
 export const TemplateSummaryPageView: FC<TemplateSummaryPageViewProps> = ({
@@ -22,26 +22,26 @@ export const TemplateSummaryPageView: FC<TemplateSummaryPageViewProps> = ({
   template,
   activeVersion,
 }) => {
-  const navigate = useNavigate()
-  const location = useLocation()
+  const navigate = useNavigate();
+  const location = useLocation();
 
   useEffect(() => {
     if (location.hash === "#readme") {
       // We moved the readme to the docs page, but we known that some users
       // have bookmarked the readme or linked it elsewhere. Redirect them to the docs page.
-      navigate(`/templates/${template.name}/docs`, { replace: true })
+      navigate(`/templates/${template.name}/docs`, { replace: true });
     }
-  }, [template, navigate, location])
+  }, [template, navigate, location]);
 
   if (!resources) {
-    return <Loader />
+    return <Loader />;
   }
 
   const getStartedResources = (resources: WorkspaceResource[]) => {
     return resources.filter(
       (resource) => resource.workspace_transition === "start",
-    )
-  }
+    );
+  };
 
   return (
     <Stack spacing={4}>
@@ -49,5 +49,5 @@ export const TemplateSummaryPageView: FC<TemplateSummaryPageViewProps> = ({
       <TemplateStats template={template} activeVersion={activeVersion} />
       <TemplateResourcesTable resources={getStartedResources(resources)} />
     </Stack>
-  )
-}
+  );
+};
diff --git a/site/src/pages/TemplatePage/TemplateVersionsPage/TemplateVersionsPage.tsx b/site/src/pages/TemplatePage/TemplateVersionsPage/TemplateVersionsPage.tsx
index d3c7780c305e3..86bed4cf7082e 100644
--- a/site/src/pages/TemplatePage/TemplateVersionsPage/TemplateVersionsPage.tsx
+++ b/site/src/pages/TemplatePage/TemplateVersionsPage/TemplateVersionsPage.tsx
@@ -1,42 +1,68 @@
-import { useMutation, useQuery } from "@tanstack/react-query"
-import { getTemplateVersions, updateActiveTemplateVersion } from "api/api"
-import { getErrorMessage } from "api/errors"
-import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog"
-import { displayError, displaySuccess } from "components/GlobalSnackbar/utils"
-import { useTemplateLayoutContext } from "components/TemplateLayout/TemplateLayout"
-import { VersionsTable } from "components/VersionsTable/VersionsTable"
-import { useState } from "react"
-import { Helmet } from "react-helmet-async"
-import { getTemplatePageTitle } from "../utils"
+import { useMutation, useQuery } from "react-query";
+import {
+  archiveTemplateVersion,
+  getTemplateVersions,
+  updateActiveTemplateVersion,
+} from "api/api";
+import { getErrorMessage } from "api/errors";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
+import { useTemplateLayoutContext } from "pages/TemplatePage/TemplateLayout";
+import { VersionsTable } from "./VersionsTable";
+import { useState } from "react";
+import { Helmet } from "react-helmet-async";
+import { getTemplatePageTitle } from "../utils";
 
 const TemplateVersionsPage = () => {
-  const { template, permissions } = useTemplateLayoutContext()
+  const { template, permissions } = useTemplateLayoutContext();
   const { data } = useQuery({
     queryKey: ["template", "versions", template.id],
     queryFn: () => getTemplateVersions(template.id),
-  })
+  });
   // We use this to update the active version in the UI without having to refetch the template
   const [latestActiveVersion, setLatestActiveVersion] = useState(
     template.active_version_id,
-  )
+  );
   const { mutate: promoteVersion, isLoading: isPromoting } = useMutation({
     mutationFn: (templateVersionId: string) => {
       return updateActiveTemplateVersion(template.id, {
         id: templateVersionId,
-      })
+      });
     },
     onSuccess: async () => {
-      setLatestActiveVersion(selectedVersionIdToPromote as string)
-      setSelectedVersionIdToPromote(undefined)
-      displaySuccess("Version promoted successfully")
+      setLatestActiveVersion(selectedVersionIdToPromote as string);
+      setSelectedVersionIdToPromote(undefined);
+      displaySuccess("Version promoted successfully");
     },
     onError: (error) => {
-      displayError(getErrorMessage(error, "Failed to promote version"))
+      displayError(getErrorMessage(error, "Failed to promote version"));
     },
-  })
+  });
+
+  const { mutate: archiveVersion, isLoading: isArchiving } = useMutation({
+    mutationFn: (templateVersionId: string) => {
+      return archiveTemplateVersion(templateVersionId);
+    },
+    onSuccess: async () => {
+      // The reload is unfortunate. When a version is archived, we should hide
+      // the row. I do not know an easy way to do that, so a reload makes the API call
+      // resend and now the version is omitted.
+      // TODO: Improve this to not reload the page.
+      location.reload();
+      setSelectedVersionIdToArchive(undefined);
+      displaySuccess("Version archived successfully");
+    },
+    onError: (error) => {
+      displayError(getErrorMessage(error, "Failed to archive version"));
+    },
+  });
+
   const [selectedVersionIdToPromote, setSelectedVersionIdToPromote] = useState<
     string | undefined
-  >()
+  >();
+  const [selectedVersionIdToArchive, setSelectedVersionIdToArchive] = useState<
+    string | undefined
+  >();
 
   return (
     <>
@@ -50,14 +76,20 @@ const TemplateVersionsPage = () => {
             ? setSelectedVersionIdToPromote
             : undefined
         }
+        onArchiveClick={
+          permissions.canUpdateTemplate
+            ? setSelectedVersionIdToArchive
+            : undefined
+        }
         activeVersionId={latestActiveVersion}
       />
+      {/* Promote confirm */}
       <ConfirmDialog
         type="info"
         hideCancel={false}
         open={selectedVersionIdToPromote !== undefined}
         onConfirm={() => {
-          promoteVersion(selectedVersionIdToPromote as string)
+          promoteVersion(selectedVersionIdToPromote as string);
         }}
         onClose={() => setSelectedVersionIdToPromote(undefined)}
         title="Promote version"
@@ -65,8 +97,22 @@ const TemplateVersionsPage = () => {
         confirmText="Promote"
         description="Are you sure you want to promote this version? Workspaces will be prompted to “Update” to this version once promoted."
       />
+      {/* Archive Confirm */}
+      <ConfirmDialog
+        type="info"
+        hideCancel={false}
+        open={selectedVersionIdToArchive !== undefined}
+        onConfirm={() => {
+          archiveVersion(selectedVersionIdToArchive as string);
+        }}
+        onClose={() => setSelectedVersionIdToArchive(undefined)}
+        title="Archive version"
+        confirmLoading={isArchiving}
+        confirmText="Archive"
+        description="Are you sure you want to archive this version (this is reversible)? Archived versions cannot be used by workspaces."
+      />
     </>
-  )
-}
+  );
+};
 
-export default TemplateVersionsPage
+export default TemplateVersionsPage;
diff --git a/site/src/pages/TemplatePage/TemplateVersionsPage/VersionRow.tsx b/site/src/pages/TemplatePage/TemplateVersionsPage/VersionRow.tsx
new file mode 100644
index 0000000000000..0ad02ffd2b696
--- /dev/null
+++ b/site/src/pages/TemplatePage/TemplateVersionsPage/VersionRow.tsx
@@ -0,0 +1,170 @@
+import Button from "@mui/material/Button";
+import { makeStyles } from "@mui/styles";
+import TableCell from "@mui/material/TableCell";
+import { TemplateVersion } from "api/typesGenerated";
+import { Pill } from "components/Pill/Pill";
+import { Stack } from "components/Stack/Stack";
+import { TimelineEntry } from "components/Timeline/TimelineEntry";
+import { UserAvatar } from "components/UserAvatar/UserAvatar";
+import { InfoTooltip } from "components/InfoTooltip/InfoTooltip";
+import { useClickableTableRow } from "hooks/useClickableTableRow";
+import { useNavigate } from "react-router-dom";
+import { colors } from "theme/colors";
+import { combineClasses } from "utils/combineClasses";
+
+export interface VersionRowProps {
+  version: TemplateVersion;
+  isActive: boolean;
+  isLatest: boolean;
+  onPromoteClick?: (templateVersionId: string) => void;
+  onArchiveClick?: (templateVersionId: string) => void;
+}
+
+export const VersionRow: React.FC<VersionRowProps> = ({
+  version,
+  isActive,
+  isLatest,
+  onPromoteClick,
+  onArchiveClick,
+}) => {
+  const styles = useStyles();
+  const navigate = useNavigate();
+
+  const clickableProps = useClickableTableRow({
+    onClick: () => navigate(version.name),
+  });
+
+  const jobStatus = version.job.status;
+
+  return (
+    <TimelineEntry
+      data-testid={`version-${version.id}`}
+      {...clickableProps}
+      className={combineClasses({
+        [clickableProps.className]: true,
+        [styles.row]: true,
+        [styles.active]: isActive,
+      })}
+    >
+      <TableCell className={styles.versionCell}>
+        <Stack
+          direction="row"
+          alignItems="center"
+          className={styles.versionWrapper}
+          justifyContent="space-between"
+        >
+          <Stack direction="row" alignItems="center">
+            <UserAvatar
+              username={version.created_by.username}
+              avatarURL={version.created_by.avatar_url}
+            />
+            <Stack
+              className={styles.versionSummary}
+              direction="row"
+              alignItems="center"
+              spacing={1}
+            >
+              <span>
+                <strong>{version.created_by.username}</strong> created the
+                version <strong>{version.name}</strong>
+              </span>
+
+              {version.message && (
+                <InfoTooltip title="Message" message={version.message} />
+              )}
+
+              <span className={styles.versionTime}>
+                {new Date(version.created_at).toLocaleTimeString()}
+              </span>
+            </Stack>
+          </Stack>
+
+          <Stack direction="row" alignItems="center" spacing={2}>
+            {isActive && <Pill text="Active" type="success" />}
+            {isLatest && <Pill text="Newest" type="info" />}
+            {jobStatus === "pending" && (
+              <Pill text={<>Pending&hellip;</>} type="warning" lightBorder />
+            )}
+            {jobStatus === "running" && (
+              <Pill text={<>Building&hellip;</>} type="warning" lightBorder />
+            )}
+            {(jobStatus === "canceling" || jobStatus === "canceled") && (
+              <Pill text="Canceled" type="neutral" lightBorder />
+            )}
+            {jobStatus === "failed" && <Pill text="Failed" type="error" />}
+            {jobStatus === "failed" ? (
+              <Button
+                className={styles.promoteButton}
+                disabled={isActive || version.archived}
+                onClick={(e) => {
+                  e.preventDefault();
+                  e.stopPropagation();
+                  if (onArchiveClick) {
+                    onArchiveClick(version.id);
+                  }
+                }}
+              >
+                Archive&hellip;
+              </Button>
+            ) : (
+              <Button
+                className={styles.promoteButton}
+                disabled={isActive || jobStatus !== "succeeded"}
+                onClick={(e) => {
+                  e.preventDefault();
+                  e.stopPropagation();
+                  if (onPromoteClick) {
+                    onPromoteClick(version.id);
+                  }
+                }}
+              >
+                Promote&hellip;
+              </Button>
+            )}
+          </Stack>
+        </Stack>
+      </TableCell>
+    </TimelineEntry>
+  );
+};
+
+const useStyles = makeStyles((theme) => ({
+  row: {
+    "&:hover $promoteButton": {
+      color: theme.palette.text.primary,
+      borderColor: colors.gray[11],
+      "&:hover": {
+        borderColor: theme.palette.text.primary,
+      },
+    },
+  },
+
+  promoteButton: {
+    color: theme.palette.text.secondary,
+    transition: "none",
+  },
+
+  versionWrapper: {
+    padding: theme.spacing(2, 4),
+  },
+
+  active: {
+    backgroundColor: theme.palette.background.paperLight,
+  },
+
+  versionCell: {
+    padding: "0 !important",
+    position: "relative",
+    borderBottom: 0,
+  },
+
+  versionSummary: {
+    ...theme.typography.body1,
+    fontFamily: "inherit",
+  },
+
+  versionTime: {
+    color: theme.palette.text.secondary,
+    fontSize: 12,
+  },
+}));
diff --git a/site/src/pages/TemplatePage/TemplateVersionsPage/VersionsTable.stories.tsx b/site/src/pages/TemplatePage/TemplateVersionsPage/VersionsTable.stories.tsx
new file mode 100644
index 0000000000000..119d56f06a771
--- /dev/null
+++ b/site/src/pages/TemplatePage/TemplateVersionsPage/VersionsTable.stories.tsx
@@ -0,0 +1,102 @@
+import { action } from "@storybook/addon-actions";
+import {
+  MockCanceledProvisionerJob,
+  MockCancelingProvisionerJob,
+  MockFailedProvisionerJob,
+  MockPendingProvisionerJob,
+  MockRunningProvisionerJob,
+  MockTemplateVersion,
+} from "testHelpers/entities";
+import { VersionsTable } from "./VersionsTable";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof VersionsTable> = {
+  title: "pages/TemplatePage/VersionsTable",
+  component: VersionsTable,
+};
+
+export default meta;
+type Story = StoryObj<typeof VersionsTable>;
+
+export const Example: Story = {
+  args: {
+    activeVersionId: MockTemplateVersion.id,
+    versions: [
+      {
+        ...MockTemplateVersion,
+        id: "2",
+        name: "test-template-version-2",
+        created_at: "2022-05-18T18:39:01.382927298Z",
+      },
+      MockTemplateVersion,
+    ],
+    onPromoteClick: undefined,
+  },
+};
+
+export const CanPromote: Story = {
+  args: {
+    activeVersionId: MockTemplateVersion.id,
+    onPromoteClick: action("onPromoteClick"),
+    versions: [
+      {
+        ...MockTemplateVersion,
+        id: "2",
+        name: "test-template-version-2",
+        created_at: "2022-05-18T18:39:01.382927298Z",
+      },
+      MockTemplateVersion,
+    ],
+  },
+};
+
+export const BuildStatuses: Story = {
+  args: {
+    activeVersionId: MockTemplateVersion.id,
+    onPromoteClick: action("onPromoteClick"),
+    versions: [
+      {
+        ...MockTemplateVersion,
+        id: "6",
+        name: "test-version-6",
+        created_at: "2022-05-18T18:39:01.382927298Z",
+        job: MockCancelingProvisionerJob,
+      },
+      {
+        ...MockTemplateVersion,
+        id: "5",
+        name: "test-version-5",
+        created_at: "2022-05-18T18:39:01.382927298Z",
+        job: MockCanceledProvisionerJob,
+      },
+      {
+        ...MockTemplateVersion,
+        id: "4",
+        name: "test-version-4",
+        created_at: "2022-05-18T18:39:01.382927298Z",
+        job: MockRunningProvisionerJob,
+      },
+      {
+        ...MockTemplateVersion,
+        id: "3",
+        name: "test-version-3",
+        created_at: "2022-05-18T18:39:01.382927298Z",
+        job: MockPendingProvisionerJob,
+      },
+      {
+        ...MockTemplateVersion,
+        id: "2",
+        name: "test-version-2",
+        created_at: "2022-05-18T18:39:01.382927298Z",
+        job: MockFailedProvisionerJob,
+      },
+      MockTemplateVersion,
+    ],
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    versions: [],
+  },
+};
diff --git a/site/src/pages/TemplatePage/TemplateVersionsPage/VersionsTable.tsx b/site/src/pages/TemplatePage/TemplateVersionsPage/VersionsTable.tsx
new file mode 100644
index 0000000000000..cbeb3e208a897
--- /dev/null
+++ b/site/src/pages/TemplatePage/TemplateVersionsPage/VersionsTable.tsx
@@ -0,0 +1,86 @@
+import Box from "@mui/material/Box";
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableRow from "@mui/material/TableRow";
+import { Timeline } from "components/Timeline/Timeline";
+import { type FC } from "react";
+import * as TypesGen from "api/typesGenerated";
+import { EmptyState } from "components/EmptyState/EmptyState";
+import { TableLoader } from "components/TableLoader/TableLoader";
+import { VersionRow } from "./VersionRow";
+
+export const Language = {
+  emptyMessage: "No versions found",
+  nameLabel: "Version name",
+  createdAtLabel: "Created at",
+  createdByLabel: "Created by",
+};
+
+export interface VersionsTableProps {
+  activeVersionId: string;
+  onPromoteClick?: (templateVersionId: string) => void;
+  onArchiveClick?: (templateVersionId: string) => void;
+
+  versions?: TypesGen.TemplateVersion[];
+}
+
+export const VersionsTable: FC<VersionsTableProps> = (props) => {
+  const { versions, onArchiveClick, onPromoteClick, activeVersionId } = props;
+
+  const latestVersionId = versions?.reduce(
+    (latestSoFar, against) => {
+      if (against.job.status !== "succeeded") {
+        return latestSoFar;
+      }
+
+      if (!latestSoFar) {
+        return against;
+      }
+
+      return new Date(against.updated_at).getTime() >
+        new Date(latestSoFar.updated_at).getTime()
+        ? against
+        : latestSoFar;
+    },
+    undefined as TypesGen.TemplateVersion | undefined,
+  )?.id;
+
+  return (
+    <TableContainer>
+      <Table data-testid="versions-table">
+        <TableBody>
+          {versions ? (
+            <Timeline
+              items={[...versions].reverse()}
+              getDate={(version) => new Date(version.created_at)}
+              row={(version) => (
+                <VersionRow
+                  onArchiveClick={onArchiveClick}
+                  onPromoteClick={onPromoteClick}
+                  version={version}
+                  key={version.id}
+                  isActive={activeVersionId === version.id}
+                  isLatest={latestVersionId === version.id}
+                />
+              )}
+            />
+          ) : (
+            <TableLoader />
+          )}
+
+          {versions && versions.length === 0 && (
+            <TableRow>
+              <TableCell colSpan={999}>
+                <Box p={4}>
+                  <EmptyState message={Language.emptyMessage} />
+                </Box>
+              </TableCell>
+            </TableRow>
+          )}
+        </TableBody>
+      </Table>
+    </TableContainer>
+  );
+};
diff --git a/site/src/pages/TemplatePage/useDeletionDialogState.test.ts b/site/src/pages/TemplatePage/useDeletionDialogState.test.ts
new file mode 100644
index 0000000000000..1858520bff06f
--- /dev/null
+++ b/site/src/pages/TemplatePage/useDeletionDialogState.test.ts
@@ -0,0 +1,48 @@
+import { act, renderHook, waitFor } from "@testing-library/react";
+import { MockTemplate } from "testHelpers/entities";
+import { useDeletionDialogState } from "./useDeletionDialogState";
+import * as API from "api/api";
+
+test("delete dialog starts closed", () => {
+  const { result } = renderHook(() =>
+    useDeletionDialogState(MockTemplate.id, jest.fn()),
+  );
+  expect(result.current.isDeleteDialogOpen).toBeFalsy();
+});
+
+test("confirm template deletion", async () => {
+  const onDeleteTemplate = jest.fn();
+  const { result } = renderHook(() =>
+    useDeletionDialogState(MockTemplate.id, onDeleteTemplate),
+  );
+
+  //Open delete confirmation
+  act(() => {
+    result.current.openDeleteConfirmation();
+  });
+  expect(result.current.isDeleteDialogOpen).toBeTruthy();
+
+  // Confirm delete
+  jest.spyOn(API, "deleteTemplate");
+  await act(async () => result.current.confirmDelete());
+  await waitFor(() => expect(API.deleteTemplate).toBeCalledTimes(1));
+  expect(onDeleteTemplate).toBeCalledTimes(1);
+});
+
+test("cancel template deletion", () => {
+  const { result } = renderHook(() =>
+    useDeletionDialogState(MockTemplate.id, jest.fn()),
+  );
+
+  //Open delete confirmation
+  act(() => {
+    result.current.openDeleteConfirmation();
+  });
+  expect(result.current.isDeleteDialogOpen).toBeTruthy();
+
+  // Cancel deletion
+  act(() => {
+    result.current.cancelDeleteConfirmation();
+  });
+  expect(result.current.isDeleteDialogOpen).toBeFalsy();
+});
diff --git a/site/src/pages/TemplatePage/useDeletionDialogState.ts b/site/src/pages/TemplatePage/useDeletionDialogState.ts
new file mode 100644
index 0000000000000..7b3b7bbfcac63
--- /dev/null
+++ b/site/src/pages/TemplatePage/useDeletionDialogState.ts
@@ -0,0 +1,45 @@
+import { useState } from "react";
+import { deleteTemplate } from "api/api";
+import { getErrorMessage } from "api/errors";
+import { displayError } from "components/GlobalSnackbar/utils";
+
+type DeleteTemplateState =
+  | { status: "idle" }
+  | { status: "confirming" }
+  | { status: "deleting" };
+
+export const useDeletionDialogState = (
+  templateId: string,
+  onDelete: () => void,
+) => {
+  const [state, setState] = useState<DeleteTemplateState>({ status: "idle" });
+  const isDeleteDialogOpen =
+    state.status === "confirming" || state.status === "deleting";
+
+  const openDeleteConfirmation = () => {
+    setState({ status: "confirming" });
+  };
+
+  const cancelDeleteConfirmation = () => {
+    setState({ status: "idle" });
+  };
+
+  const confirmDelete = async () => {
+    try {
+      setState({ status: "deleting" });
+      await deleteTemplate(templateId);
+      onDelete();
+    } catch (e) {
+      setState({ status: "confirming" });
+      displayError(getErrorMessage(e, "Failed to delete template"));
+    }
+  };
+
+  return {
+    state,
+    isDeleteDialogOpen,
+    openDeleteConfirmation,
+    cancelDeleteConfirmation,
+    confirmDelete,
+  };
+};
diff --git a/site/src/pages/TemplatePage/utils.ts b/site/src/pages/TemplatePage/utils.ts
index 3420593e34bc4..f95c48e13ff31 100644
--- a/site/src/pages/TemplatePage/utils.ts
+++ b/site/src/pages/TemplatePage/utils.ts
@@ -1,10 +1,10 @@
-import { Template } from "api/typesGenerated"
-import { pageTitle } from "utils/page"
+import { Template } from "api/typesGenerated";
+import { pageTitle } from "utils/page";
 
 export const getTemplatePageTitle = (title: string, template: Template) => {
   return pageTitle(
     `${
       template.display_name.length > 0 ? template.display_name : template.name
     } · ${title}`,
-  )
-}
+  );
+};
diff --git a/site/src/pages/TemplateSettingsPage/Sidebar.tsx b/site/src/pages/TemplateSettingsPage/Sidebar.tsx
index 1773186642e09..1947942241f8b 100644
--- a/site/src/pages/TemplateSettingsPage/Sidebar.tsx
+++ b/site/src/pages/TemplateSettingsPage/Sidebar.tsx
@@ -1,19 +1,19 @@
-import { makeStyles } from "@mui/styles"
-import ScheduleIcon from "@mui/icons-material/TimerOutlined"
-import VariablesIcon from "@mui/icons-material/CodeOutlined"
-import { Template } from "api/typesGenerated"
-import { Stack } from "components/Stack/Stack"
-import { FC, ElementType, PropsWithChildren, ReactNode } from "react"
-import { Link, NavLink } from "react-router-dom"
-import { combineClasses } from "utils/combineClasses"
-import GeneralIcon from "@mui/icons-material/SettingsOutlined"
-import SecurityIcon from "@mui/icons-material/LockOutlined"
-import { Avatar } from "components/Avatar/Avatar"
+import { makeStyles } from "@mui/styles";
+import ScheduleIcon from "@mui/icons-material/TimerOutlined";
+import VariablesIcon from "@mui/icons-material/CodeOutlined";
+import { Template } from "api/typesGenerated";
+import { Stack } from "components/Stack/Stack";
+import { FC, ElementType, PropsWithChildren, ReactNode } from "react";
+import { Link, NavLink } from "react-router-dom";
+import { combineClasses } from "utils/combineClasses";
+import GeneralIcon from "@mui/icons-material/SettingsOutlined";
+import SecurityIcon from "@mui/icons-material/LockOutlined";
+import { Avatar } from "components/Avatar/Avatar";
 
 const SidebarNavItem: FC<
   PropsWithChildren<{ href: string; icon: ReactNode }>
 > = ({ children, href, icon }) => {
-  const styles = useStyles()
+  const styles = useStyles();
   return (
     <NavLink
       end
@@ -30,18 +30,18 @@ const SidebarNavItem: FC<
         {children}
       </Stack>
     </NavLink>
-  )
-}
+  );
+};
 
 const SidebarNavItemIcon: React.FC<{ icon: ElementType }> = ({
   icon: Icon,
 }) => {
-  const styles = useStyles()
-  return <Icon className={styles.sidebarNavItemIcon} />
-}
+  const styles = useStyles();
+  return <Icon className={styles.sidebarNavItemIcon} />;
+};
 
 export const Sidebar: React.FC<{ template: Template }> = ({ template }) => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <nav className={styles.sidebar}>
@@ -83,8 +83,8 @@ export const Sidebar: React.FC<{ template: Template }> = ({ template }) => {
         Schedule
       </SidebarNavItem>
     </nav>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   sidebar: {
@@ -147,4 +147,4 @@ const useStyles = makeStyles((theme) => ({
     overflow: "hidden",
     textOverflow: "ellipsis",
   },
-}))
+}));
diff --git a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsForm.tsx b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsForm.tsx
index 0844a3e5f3959..ea94ef0982ff6 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsForm.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsForm.tsx
@@ -1,57 +1,54 @@
-import TextField from "@mui/material/TextField"
-import { Template, UpdateTemplateMeta } from "api/typesGenerated"
-import { FormikContextType, FormikTouched, useFormik } from "formik"
-import { FC } from "react"
+import TextField from "@mui/material/TextField";
+import { Template, UpdateTemplateMeta } from "api/typesGenerated";
+import { FormikContextType, FormikTouched, useFormik } from "formik";
+import { FC } from "react";
 import {
   getFormHelpers,
   nameValidator,
   templateDisplayNameValidator,
   onChangeTrimmed,
   iconValidator,
-} from "utils/formUtils"
-import * as Yup from "yup"
-import i18next from "i18next"
-import { useTranslation } from "react-i18next"
-import { LazyIconField } from "components/IconField/LazyIconField"
+} from "utils/formUtils";
+import * as Yup from "yup";
+import { LazyIconField } from "components/IconField/LazyIconField";
 import {
   FormFields,
   FormSection,
   HorizontalForm,
   FormFooter,
-} from "components/Form/Form"
-import { Stack } from "components/Stack/Stack"
-import Checkbox from "@mui/material/Checkbox"
-import { HelpTooltip, HelpTooltipText } from "components/Tooltips/HelpTooltip"
-import { makeStyles } from "@mui/styles"
+} from "components/Form/Form";
+import { Stack } from "components/Stack/Stack";
+import Checkbox from "@mui/material/Checkbox";
+import {
+  HelpTooltip,
+  HelpTooltipText,
+} from "components/HelpTooltip/HelpTooltip";
+import { makeStyles } from "@mui/styles";
 
-const MAX_DESCRIPTION_CHAR_LIMIT = 128
+const MAX_DESCRIPTION_CHAR_LIMIT = 128;
 
 export const getValidationSchema = (): Yup.AnyObjectSchema =>
   Yup.object({
-    name: nameValidator(i18next.t("nameLabel", { ns: "templateSettingsPage" })),
-    display_name: templateDisplayNameValidator(
-      i18next.t("displayNameLabel", {
-        ns: "templateSettingsPage",
-      }),
-    ),
+    name: nameValidator("Name"),
+    display_name: templateDisplayNameValidator("Display name"),
     description: Yup.string().max(
       MAX_DESCRIPTION_CHAR_LIMIT,
-      i18next
-        .t("descriptionMaxError", { ns: "templateSettingsPage" })
-        .toString(),
+      "Please enter a description that is less than or equal to 128 characters.",
     ),
     allow_user_cancel_workspace_jobs: Yup.boolean(),
     icon: iconValidator,
-  })
+    require_active_version: Yup.boolean(),
+  });
 
 export interface TemplateSettingsForm {
-  template: Template
-  onSubmit: (data: UpdateTemplateMeta) => void
-  onCancel: () => void
-  isSubmitting: boolean
-  error?: unknown
+  template: Template;
+  onSubmit: (data: UpdateTemplateMeta) => void;
+  onCancel: () => void;
+  isSubmitting: boolean;
+  error?: unknown;
   // Helpful to show field errors on Storybook
-  initialTouched?: FormikTouched<UpdateTemplateMeta>
+  initialTouched?: FormikTouched<UpdateTemplateMeta>;
+  accessControlEnabled: boolean;
 }
 
 export const TemplateSettingsForm: FC<TemplateSettingsForm> = ({
@@ -61,8 +58,9 @@ export const TemplateSettingsForm: FC<TemplateSettingsForm> = ({
   error,
   isSubmitting,
   initialTouched,
+  accessControlEnabled,
 }) => {
-  const validationSchema = getValidationSchema()
+  const validationSchema = getValidationSchema();
   const form: FormikContextType<UpdateTemplateMeta> =
     useFormik<UpdateTemplateMeta>({
       initialValues: {
@@ -72,23 +70,25 @@ export const TemplateSettingsForm: FC<TemplateSettingsForm> = ({
         icon: template.icon,
         allow_user_cancel_workspace_jobs:
           template.allow_user_cancel_workspace_jobs,
+        update_workspace_last_used_at: false,
+        update_workspace_dormant_at: false,
+        require_active_version: template.require_active_version,
       },
       validationSchema,
       onSubmit,
       initialTouched,
-    })
-  const getFieldHelpers = getFormHelpers(form, error)
-  const { t } = useTranslation("templateSettingsPage")
-  const styles = useStyles()
+    });
+  const getFieldHelpers = getFormHelpers(form, error);
+  const styles = useStyles();
 
   return (
     <HorizontalForm
       onSubmit={form.handleSubmit}
-      aria-label={t("formAriaLabel").toString()}
+      aria-label="Template settings form"
     >
       <FormSection
-        title={t("generalInfo.title").toString()}
-        description={t("generalInfo.description").toString()}
+        title="General info"
+        description="The name is used to identify the template in URLs and the API."
       >
         <FormFields>
           <TextField
@@ -97,21 +97,21 @@ export const TemplateSettingsForm: FC<TemplateSettingsForm> = ({
             onChange={onChangeTrimmed(form)}
             autoFocus
             fullWidth
-            label={t("nameLabel")}
+            label="Name"
           />
         </FormFields>
       </FormSection>
 
       <FormSection
-        title={t("displayInfo.title").toString()}
-        description={t("displayInfo.description").toString()}
+        title="Display info"
+        description="A friendly name, description, and icon to help developers identify your template."
       >
         <FormFields>
           <TextField
             {...getFieldHelpers("display_name")}
             disabled={isSubmitting}
             fullWidth
-            label={t("displayNameLabel")}
+            label="Display name"
           />
 
           <TextField
@@ -119,7 +119,7 @@ export const TemplateSettingsForm: FC<TemplateSettingsForm> = ({
             multiline
             disabled={isSubmitting}
             fullWidth
-            label={t("descriptionLabel")}
+            label="Description"
             rows={2}
           />
 
@@ -128,53 +128,88 @@ export const TemplateSettingsForm: FC<TemplateSettingsForm> = ({
             disabled={isSubmitting}
             onChange={onChangeTrimmed(form)}
             fullWidth
-            label={t("iconLabel")}
+            label="Icon"
             onPickEmoji={(value) => form.setFieldValue("icon", value)}
           />
         </FormFields>
       </FormSection>
 
       <FormSection
-        title={t("operations.title").toString()}
-        description={t("operations.description").toString()}
+        title="Operations"
+        description="Regulate actions allowed on workspaces created from this template."
       >
-        <label htmlFor="allow_user_cancel_workspace_jobs">
-          <Stack direction="row" spacing={1}>
-            <Checkbox
-              id="allow_user_cancel_workspace_jobs"
-              name="allow_user_cancel_workspace_jobs"
-              disabled={isSubmitting}
-              checked={form.values.allow_user_cancel_workspace_jobs}
-              onChange={form.handleChange}
-            />
-
-            <Stack direction="column" spacing={0.5}>
-              <Stack
-                direction="row"
-                alignItems="center"
-                spacing={0.5}
-                className={styles.optionText}
-              >
-                {t("allowUserCancelWorkspaceJobsLabel")}
+        <Stack direction="column" spacing={5}>
+          <label htmlFor="allow_user_cancel_workspace_jobs">
+            <Stack direction="row" spacing={1}>
+              <Checkbox
+                id="allow_user_cancel_workspace_jobs"
+                name="allow_user_cancel_workspace_jobs"
+                disabled={isSubmitting}
+                checked={form.values.allow_user_cancel_workspace_jobs}
+                onChange={form.handleChange}
+              />
 
-                <HelpTooltip>
-                  <HelpTooltipText>
-                    {t("allowUserCancelWorkspaceJobsNotice")}
-                  </HelpTooltipText>
-                </HelpTooltip>
+              <Stack direction="column" spacing={0.5}>
+                <Stack
+                  direction="row"
+                  alignItems="center"
+                  spacing={0.5}
+                  className={styles.optionText}
+                >
+                  Allow users to cancel in-progress workspace jobs.
+                  <HelpTooltip>
+                    <HelpTooltipText>
+                      If checked, users may be able to corrupt their workspace.
+                    </HelpTooltipText>
+                  </HelpTooltip>
+                </Stack>
+                <span className={styles.optionHelperText}>
+                  Depending on your template, canceling builds may leave
+                  workspaces in an unhealthy state. This option isn&apos;t
+                  recommended for most use cases.
+                </span>
               </Stack>
-              <span className={styles.optionHelperText}>
-                {t("allowUsersCancelHelperText")}
-              </span>
             </Stack>
-          </Stack>
-        </label>
+          </label>
+          {accessControlEnabled && (
+            <label htmlFor="require_active_version">
+              <Stack direction="row" spacing={1}>
+                <Checkbox
+                  id="require_active_version"
+                  name="require_active_version"
+                  checked={form.values.require_active_version}
+                  onChange={form.handleChange}
+                />
+
+                <Stack direction="column" spacing={0.5}>
+                  <Stack
+                    direction="row"
+                    alignItems="center"
+                    spacing={0.5}
+                    className={styles.optionText}
+                  >
+                    Require the active template version for workspace builds.
+                    <HelpTooltip>
+                      <HelpTooltipText>
+                        This setting is not enforced for template admins.
+                      </HelpTooltipText>
+                    </HelpTooltip>
+                  </Stack>
+                  <span className={styles.optionHelperText}>
+                    Workspaces that are manually started or auto-started will
+                    use the promoted template version.
+                  </span>
+                </Stack>
+              </Stack>
+            </label>
+          )}
+        </Stack>
       </FormSection>
 
       <FormFooter onCancel={onCancel} isLoading={isSubmitting} />
     </HorizontalForm>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   optionText: {
@@ -186,4 +221,4 @@ const useStyles = makeStyles((theme) => ({
     fontSize: theme.spacing(1.5),
     color: theme.palette.text.secondary,
   },
-}))
+}));
diff --git a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPage.test.tsx b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPage.test.tsx
index 597ad0a15387e..c9f2059672fce 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPage.test.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPage.test.tsx
@@ -1,22 +1,19 @@
-import { screen, waitFor } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
-import * as API from "api/api"
-import { UpdateTemplateMeta } from "api/typesGenerated"
-import { Language as FooterFormLanguage } from "components/FormFooter/FormFooter"
-import { MockTemplate } from "../../../testHelpers/entities"
+import { screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import * as API from "api/api";
+import { UpdateTemplateMeta } from "api/typesGenerated";
+import { Language as FooterFormLanguage } from "components/FormFooter/FormFooter";
+import { MockTemplate } from "testHelpers/entities";
 import {
   renderWithTemplateSettingsLayout,
   waitForLoaderToBeRemoved,
-} from "../../../testHelpers/renderHelpers"
-import { getValidationSchema } from "./TemplateSettingsForm"
-import { TemplateSettingsPage } from "./TemplateSettingsPage"
-import i18next from "i18next"
-
-const { t } = i18next
+} from "testHelpers/renderHelpers";
+import { getValidationSchema } from "./TemplateSettingsForm";
+import { TemplateSettingsPage } from "./TemplateSettingsPage";
 
 type FormValues = Required<
   Omit<UpdateTemplateMeta, "default_ttl_ms" | "max_ttl_ms">
->
+>;
 
 const validFormValues: FormValues = {
   name: "Name",
@@ -26,22 +23,36 @@ const validFormValues: FormValues = {
   allow_user_cancel_workspace_jobs: false,
   allow_user_autostart: false,
   allow_user_autostop: false,
-  restart_requirement: {
+  autostop_requirement: {
     days_of_week: [],
     weeks: 1,
   },
+  autostart_requirement: {
+    days_of_week: [
+      "monday",
+      "tuesday",
+      "wednesday",
+      "thursday",
+      "friday",
+      "saturday",
+      "sunday",
+    ],
+  },
   failure_ttl_ms: 0,
-  inactivity_ttl_ms: 0,
-  locked_ttl_ms: 0,
-}
+  time_til_dormant_ms: 0,
+  time_til_dormant_autodelete_ms: 0,
+  update_workspace_last_used_at: false,
+  update_workspace_dormant_at: false,
+  require_active_version: false,
+};
 
 const renderTemplateSettingsPage = async () => {
   renderWithTemplateSettingsLayout(<TemplateSettingsPage />, {
     route: `/templates/${MockTemplate.name}/settings`,
     path: `/templates/:template/settings`,
-  })
-  await waitForLoaderToBeRemoved()
-}
+  });
+  await waitForLoaderToBeRemoved();
+};
 
 const fillAndSubmitForm = async ({
   name,
@@ -50,69 +61,64 @@ const fillAndSubmitForm = async ({
   icon,
   allow_user_cancel_workspace_jobs,
 }: FormValues) => {
-  const label = t("nameLabel", { ns: "templateSettingsPage" })
-  const nameField = await screen.findByLabelText(label)
-  await userEvent.clear(nameField)
-  await userEvent.type(nameField, name)
-
-  const displayNameLabel = t("displayNameLabel", { ns: "templateSettingsPage" })
+  const nameField = await screen.findByLabelText("Name");
+  await userEvent.clear(nameField);
+  await userEvent.type(nameField, name);
 
-  const displayNameField = await screen.findByLabelText(displayNameLabel)
-  await userEvent.clear(displayNameField)
-  await userEvent.type(displayNameField, display_name)
+  const displayNameField = await screen.findByLabelText("Display name");
+  await userEvent.clear(displayNameField);
+  await userEvent.type(displayNameField, display_name);
 
-  const descriptionLabel = t("descriptionLabel", { ns: "templateSettingsPage" })
-  const descriptionField = await screen.findByLabelText(descriptionLabel)
-  await userEvent.clear(descriptionField)
-  await userEvent.type(descriptionField, description)
+  const descriptionField = await screen.findByLabelText("Description");
+  await userEvent.clear(descriptionField);
+  await userEvent.type(descriptionField, description);
 
-  const iconLabel = t("iconLabel", { ns: "templateSettingsPage" })
-  const iconField = await screen.findByLabelText(iconLabel)
-  await userEvent.clear(iconField)
-  await userEvent.type(iconField, icon)
+  const iconField = await screen.findByLabelText("Icon");
+  await userEvent.clear(iconField);
+  await userEvent.type(iconField, icon);
 
-  const allowCancelJobsField = screen.getByRole("checkbox")
+  const allowCancelJobsField = screen.getByRole("checkbox");
   // checkbox is checked by default, so it must be clicked to get unchecked
   if (!allow_user_cancel_workspace_jobs) {
-    await userEvent.click(allowCancelJobsField)
+    await userEvent.click(allowCancelJobsField);
   }
 
   const submitButton = await screen.findByText(
     FooterFormLanguage.defaultSubmitLabel,
-  )
-  await userEvent.click(submitButton)
-}
+  );
+  await userEvent.click(submitButton);
+};
 
 describe("TemplateSettingsPage", () => {
   it("succeeds", async () => {
-    await renderTemplateSettingsPage()
+    await renderTemplateSettingsPage();
     jest.spyOn(API, "updateTemplateMeta").mockResolvedValueOnce({
       ...MockTemplate,
       ...validFormValues,
-    })
-    await fillAndSubmitForm(validFormValues)
-    await waitFor(() => expect(API.updateTemplateMeta).toBeCalledTimes(1))
-  })
+    });
+    await fillAndSubmitForm(validFormValues);
+    await waitFor(() => expect(API.updateTemplateMeta).toBeCalledTimes(1));
+  });
 
   it("allows a description of 128 chars", () => {
     const values: UpdateTemplateMeta = {
       ...validFormValues,
       description:
         "Nam quis nulla. Integer malesuada. In in enim a arcu imperdiet malesuada. Sed vel lectus. Donec odio urna, tempus molestie, port",
-    }
-    const validate = () => getValidationSchema().validateSync(values)
-    expect(validate).not.toThrowError()
-  })
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).not.toThrowError();
+  });
 
   it("disallows a description of 128 + 1 chars", () => {
     const values: UpdateTemplateMeta = {
       ...validFormValues,
       description:
         "Nam quis nulla. Integer malesuada. In in enim a arcu imperdiet malesuada. Sed vel lectus. Donec odio urna, tempus molestie, port a",
-    }
-    const validate = () => getValidationSchema().validateSync(values)
+    };
+    const validate = () => getValidationSchema().validateSync(values);
     expect(validate).toThrowError(
-      t("descriptionMaxError", { ns: "templateSettingsPage" }).toString(),
-    )
-  })
-})
+      "Please enter a description that is less than or equal to 128 characters.",
+    );
+  });
+});
diff --git a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPage.tsx b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPage.tsx
index 3817785568d32..d483fb7ad053f 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPage.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPage.tsx
@@ -1,24 +1,28 @@
-import { useMutation, useQueryClient } from "@tanstack/react-query"
-import { updateTemplateMeta } from "api/api"
-import { UpdateTemplateMeta } from "api/typesGenerated"
-import { displaySuccess } from "components/GlobalSnackbar/utils"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useTranslation } from "react-i18next"
-import { useNavigate, useParams } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import {
-  getTemplateQuery,
-  useTemplateSettingsContext,
-} from "../TemplateSettingsLayout"
-import { TemplateSettingsPageView } from "./TemplateSettingsPageView"
+import { useMutation, useQueryClient } from "react-query";
+import { updateTemplateMeta } from "api/api";
+import { UpdateTemplateMeta } from "api/typesGenerated";
+import { displaySuccess } from "components/GlobalSnackbar/utils";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { useNavigate, useParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import { useTemplateSettings } from "../TemplateSettingsLayout";
+import { TemplateSettingsPageView } from "./TemplateSettingsPageView";
+import { templateByNameKey } from "api/queries/templates";
+import { useOrganizationId } from "hooks";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
 
 export const TemplateSettingsPage: FC = () => {
-  const { template: templateName } = useParams() as { template: string }
-  const { t } = useTranslation("templateSettingsPage")
-  const navigate = useNavigate()
-  const { template } = useTemplateSettingsContext()
-  const queryClient = useQueryClient()
+  const { template: templateName } = useParams() as { template: string };
+  const navigate = useNavigate();
+  const orgId = useOrganizationId();
+  const { template } = useTemplateSettings();
+  const queryClient = useQueryClient();
+  const { entitlements, experiments } = useDashboard();
+  const accessControlEnabled =
+    entitlements.features["advanced_template_scheduling"].enabled &&
+    experiments.includes("template_update_policies");
+
   const {
     mutate: updateTemplate,
     isLoading: isSubmitting,
@@ -27,33 +31,36 @@ export const TemplateSettingsPage: FC = () => {
     (data: UpdateTemplateMeta) => updateTemplateMeta(template.id, data),
     {
       onSuccess: async () => {
-        await queryClient.invalidateQueries({
-          queryKey: getTemplateQuery(templateName),
-        })
-        displaySuccess("Template updated successfully")
+        await queryClient.invalidateQueries(
+          templateByNameKey(orgId, templateName),
+        );
+        displaySuccess("Template updated successfully");
       },
     },
-  )
+  );
 
   return (
     <>
       <Helmet>
-        <title>{pageTitle([template.name, t("title")])}</title>
+        <title>{pageTitle([template.name, "General Settings"])}</title>
       </Helmet>
       <TemplateSettingsPageView
         isSubmitting={isSubmitting}
         template={template}
         submitError={submitError}
         onCancel={() => {
-          navigate(`/templates/${templateName}`)
+          navigate(`/templates/${templateName}`);
         }}
         onSubmit={(templateSettings) => {
           updateTemplate({
             ...template,
             ...templateSettings,
-          })
+          });
         }}
+        accessControlEnabled={accessControlEnabled}
       />
     </>
-  )
-}
+  );
+};
+
+export default TemplateSettingsPage;
diff --git a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPageView.stories.tsx b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPageView.stories.tsx
index d5f61f588a427..9313f92af19f7 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPageView.stories.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPageView.stories.tsx
@@ -1,40 +1,33 @@
-import { action } from "@storybook/addon-actions"
-import { Story } from "@storybook/react"
-import { mockApiError, MockTemplate } from "testHelpers/entities"
-import {
-  TemplateSettingsPageView,
-  TemplateSettingsPageViewProps,
-} from "./TemplateSettingsPageView"
+import { mockApiError, MockTemplate } from "testHelpers/entities";
+import { TemplateSettingsPageView } from "./TemplateSettingsPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/TemplateSettingsPageView",
+const meta: Meta<typeof TemplateSettingsPageView> = {
+  title: "pages/TemplateSettingsPage",
   component: TemplateSettingsPageView,
   args: {
     template: MockTemplate,
-    onSubmit: action("onSubmit"),
-    onCancel: action("cancel"),
   },
-}
+};
 
-const Template: Story<TemplateSettingsPageViewProps> = (args) => (
-  <TemplateSettingsPageView {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof TemplateSettingsPageView>;
 
-export const Example = Template.bind({})
-Example.args = {}
+export const Example: Story = {};
 
-export const SaveTemplateSettingsError = Template.bind({})
-SaveTemplateSettingsError.args = {
-  submitError: mockApiError({
-    message: 'Template "test" already exists.',
-    validations: [
-      {
-        field: "name",
-        detail: "This value is already in use and should be unique.",
-      },
-    ],
-  }),
-  initialTouched: {
-    allow_user_cancel_workspace_jobs: true,
+export const SaveTemplateSettingsError: Story = {
+  args: {
+    submitError: mockApiError({
+      message: 'Template "test" already exists.',
+      validations: [
+        {
+          field: "name",
+          detail: "This value is already in use and should be unique.",
+        },
+      ],
+    }),
+    initialTouched: {
+      allow_user_cancel_workspace_jobs: true,
+    },
   },
-}
+};
diff --git a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPageView.tsx b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPageView.tsx
index e9339233ac866..5eac1759d5ca2 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPageView.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateGeneralSettingsPage/TemplateSettingsPageView.tsx
@@ -1,17 +1,18 @@
-import { Template, UpdateTemplateMeta } from "api/typesGenerated"
-import { ComponentProps, FC } from "react"
-import { TemplateSettingsForm } from "./TemplateSettingsForm"
-import { useTranslation } from "react-i18next"
-import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader"
-import { makeStyles } from "@mui/styles"
+import { type ComponentProps, type FC } from "react";
+import type { Template, UpdateTemplateMeta } from "api/typesGenerated";
+import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader";
+import { TemplateSettingsForm } from "./TemplateSettingsForm";
 
 export interface TemplateSettingsPageViewProps {
-  template: Template
-  onSubmit: (data: UpdateTemplateMeta) => void
-  onCancel: () => void
-  isSubmitting: boolean
-  submitError?: unknown
-  initialTouched?: ComponentProps<typeof TemplateSettingsForm>["initialTouched"]
+  template: Template;
+  onSubmit: (data: UpdateTemplateMeta) => void;
+  onCancel: () => void;
+  isSubmitting: boolean;
+  submitError?: unknown;
+  initialTouched?: ComponentProps<
+    typeof TemplateSettingsForm
+  >["initialTouched"];
+  accessControlEnabled: boolean;
 }
 
 export const TemplateSettingsPageView: FC<TemplateSettingsPageViewProps> = ({
@@ -21,14 +22,12 @@ export const TemplateSettingsPageView: FC<TemplateSettingsPageViewProps> = ({
   isSubmitting,
   submitError,
   initialTouched,
+  accessControlEnabled,
 }) => {
-  const { t } = useTranslation("templateSettingsPage")
-  const styles = useStyles()
-
   return (
     <>
-      <PageHeader className={styles.pageHeader}>
-        <PageHeaderTitle>{t("title")}</PageHeaderTitle>
+      <PageHeader css={{ paddingTop: 0 }}>
+        <PageHeaderTitle>General Settings</PageHeaderTitle>
       </PageHeader>
 
       <TemplateSettingsForm
@@ -38,13 +37,8 @@ export const TemplateSettingsPageView: FC<TemplateSettingsPageViewProps> = ({
         onSubmit={onSubmit}
         onCancel={onCancel}
         error={submitError}
+        accessControlEnabled={accessControlEnabled}
       />
     </>
-  )
-}
-
-const useStyles = makeStyles(() => ({
-  pageHeader: {
-    paddingTop: 0,
-  },
-}))
+  );
+};
diff --git a/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPage.tsx b/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPage.tsx
index 7e29b4f14713b..6cf11ec1faf62 100644
--- a/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPage.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPage.tsx
@@ -1,99 +1,136 @@
-import Button from "@mui/material/Button"
-import Link from "@mui/material/Link"
-import ArrowRightAltOutlined from "@mui/icons-material/ArrowRightAltOutlined"
-import { useMachine } from "@xstate/react"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { Paywall } from "components/Paywall/Paywall"
-import { Stack } from "components/Stack/Stack"
-import { useFeatureVisibility } from "hooks/useFeatureVisibility"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { templateACLMachine } from "xServices/template/templateACLXService"
-import { useTemplateSettingsContext } from "../TemplateSettingsLayout"
-import { TemplatePermissionsPageView } from "./TemplatePermissionsPageView"
-import { docs } from "utils/docs"
+import Button from "@mui/material/Button";
+import Link from "@mui/material/Link";
+import ArrowRightAltOutlined from "@mui/icons-material/ArrowRightAltOutlined";
+import { Paywall } from "components/Paywall/Paywall";
+import { Stack } from "components/Stack/Stack";
+import { useFeatureVisibility } from "hooks/useFeatureVisibility";
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { useTemplateSettings } from "../TemplateSettingsLayout";
+import { TemplatePermissionsPageView } from "./TemplatePermissionsPageView";
+import { docs } from "utils/docs";
+import { useMutation, useQuery, useQueryClient } from "react-query";
+import { setGroupRole, setUserRole, templateACL } from "api/queries/templates";
+import { displaySuccess } from "components/GlobalSnackbar/utils";
 
 export const TemplatePermissionsPage: FC<
   React.PropsWithChildren<unknown>
 > = () => {
-  const organizationId = useOrganizationId()
-  const { template, permissions } = useTemplateSettingsContext()
-  const { template_rbac: isTemplateRBACEnabled } = useFeatureVisibility()
-  const [state, send] = useMachine(templateACLMachine, {
-    context: { templateId: template.id },
-  })
-  const { templateACL, userToBeUpdated, groupToBeUpdated } = state.context
+  const organizationId = useOrganizationId();
+  const { template, permissions } = useTemplateSettings();
+  const { template_rbac: isTemplateRBACEnabled } = useFeatureVisibility();
+  const templateACLQuery = useQuery(templateACL(template.id));
+  const queryClient = useQueryClient();
+
+  const addUserMutation = useMutation(setUserRole(queryClient));
+  const updateUserMutation = useMutation(setUserRole(queryClient));
+  const removeUserMutation = useMutation(setUserRole(queryClient));
+
+  const addGroupMutation = useMutation(setGroupRole(queryClient));
+  const updateGroupMutation = useMutation(setGroupRole(queryClient));
+  const removeGroupMutation = useMutation(setGroupRole(queryClient));
 
   return (
     <>
       <Helmet>
         <title>{pageTitle([template.name, "Permissions"])}</title>
       </Helmet>
-      <ChooseOne>
-        <Cond condition={!isTemplateRBACEnabled}>
-          <Paywall
-            message="Template permissions"
-            description="Manage your template permissions to allow users or groups to view or admin the template. To use this feature, you have to upgrade your account."
-            cta={
-              <Stack direction="row" alignItems="center">
-                <Link
-                  href={docs("/admin/upgrade")}
-                  target="_blank"
-                  rel="noreferrer"
-                >
-                  <Button
-                    startIcon={<ArrowRightAltOutlined />}
-                    variant="contained"
-                  >
-                    See how to upgrade
-                  </Button>
-                </Link>
-                <Link
-                  href={docs("/admin/rbac")}
-                  target="_blank"
-                  rel="noreferrer"
+      {!isTemplateRBACEnabled ? (
+        <Paywall
+          message="Template permissions"
+          description="Manage your template permissions to allow users or groups to view or admin the template. To use this feature, you have to upgrade your account."
+          cta={
+            <Stack direction="row" alignItems="center">
+              <Link
+                href={docs("/admin/upgrade")}
+                target="_blank"
+                rel="noreferrer"
+              >
+                <Button
+                  startIcon={<ArrowRightAltOutlined />}
+                  variant="contained"
                 >
-                  Read the docs
-                </Link>
-              </Stack>
-            }
-          />
-        </Cond>
-        <Cond>
-          <TemplatePermissionsPageView
-            organizationId={organizationId}
-            templateID={template.id}
-            templateACL={templateACL}
-            canUpdatePermissions={Boolean(permissions?.canUpdateTemplate)}
-            onAddUser={(user, role, reset) => {
-              send("ADD_USER", { user, role, onDone: reset })
-            }}
-            isAddingUser={state.matches("addingUser")}
-            onUpdateUser={(user, role) => {
-              send("UPDATE_USER_ROLE", { user, role })
-            }}
-            updatingUser={userToBeUpdated}
-            onRemoveUser={(user) => {
-              send("REMOVE_USER", { user })
-            }}
-            onAddGroup={(group, role, reset) => {
-              send("ADD_GROUP", { group, role, onDone: reset })
-            }}
-            isAddingGroup={state.matches("addingGroup")}
-            onUpdateGroup={(group, role) => {
-              send("UPDATE_GROUP_ROLE", { group, role })
-            }}
-            updatingGroup={groupToBeUpdated}
-            onRemoveGroup={(group) => {
-              send("REMOVE_GROUP", { group })
-            }}
-          />
-        </Cond>
-      </ChooseOne>
+                  See how to upgrade
+                </Button>
+              </Link>
+              <Link href={docs("/admin/rbac")} target="_blank" rel="noreferrer">
+                Read the docs
+              </Link>
+            </Stack>
+          }
+        />
+      ) : (
+        <TemplatePermissionsPageView
+          organizationId={organizationId}
+          templateID={template.id}
+          templateACL={templateACLQuery.data}
+          canUpdatePermissions={Boolean(permissions?.canUpdateTemplate)}
+          onAddUser={async (user, role, reset) => {
+            await addUserMutation.mutateAsync({
+              templateId: template.id,
+              userId: user.id,
+              role,
+            });
+            reset();
+          }}
+          isAddingUser={addUserMutation.isLoading}
+          onUpdateUser={async (user, role) => {
+            await updateUserMutation.mutateAsync({
+              templateId: template.id,
+              userId: user.id,
+              role,
+            });
+            displaySuccess("User role updated successfully!");
+          }}
+          updatingUserId={
+            updateUserMutation.isLoading
+              ? updateUserMutation.variables?.userId
+              : undefined
+          }
+          onRemoveUser={async (user) => {
+            await removeUserMutation.mutateAsync({
+              templateId: template.id,
+              userId: user.id,
+              role: "",
+            });
+            displaySuccess("User removed successfully!");
+          }}
+          onAddGroup={async (group, role, reset) => {
+            await addGroupMutation.mutateAsync({
+              templateId: template.id,
+              groupId: group.id,
+              role,
+            });
+            reset();
+          }}
+          isAddingGroup={addGroupMutation.isLoading}
+          onUpdateGroup={async (group, role) => {
+            await updateGroupMutation.mutateAsync({
+              templateId: template.id,
+              groupId: group.id,
+              role,
+            });
+            displaySuccess("Group role updated successfully!");
+          }}
+          updatingGroupId={
+            updateGroupMutation.isLoading
+              ? updateGroupMutation.variables?.groupId
+              : undefined
+          }
+          onRemoveGroup={async (group) => {
+            await removeGroupMutation.mutateAsync({
+              groupId: group.id,
+              templateId: template.id,
+              role: "",
+            });
+            displaySuccess("Group removed successfully!");
+          }}
+        />
+      )}
     </>
-  )
-}
+  );
+};
 
-export default TemplatePermissionsPage
+export default TemplatePermissionsPage;
diff --git a/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPageView.stories.tsx b/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPageView.stories.tsx
index 9e8d8c19cda85..fb1c43ea2b850 100644
--- a/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPageView.stories.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPageView.stories.tsx
@@ -1,38 +1,37 @@
-import { Story } from "@storybook/react"
 import {
   MockOrganization,
   MockTemplateACL,
   MockTemplateACLEmpty,
-} from "testHelpers/entities"
-import {
-  TemplatePermissionsPageView,
-  TemplatePermissionsPageViewProps,
-} from "./TemplatePermissionsPageView"
+} from "testHelpers/entities";
+import { TemplatePermissionsPageView } from "./TemplatePermissionsPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/TemplatePermissionsPageView",
+const meta: Meta<typeof TemplatePermissionsPageView> = {
+  title: "pages/TemplateSettingsPage/TemplatePermissionsPageView",
   component: TemplatePermissionsPageView,
-}
+};
 
-const Template: Story<TemplatePermissionsPageViewProps> = (
-  args: TemplatePermissionsPageViewProps,
-) => <TemplatePermissionsPageView {...args} />
+export default meta;
+type Story = StoryObj<typeof TemplatePermissionsPageView>;
 
-export const Empty = Template.bind({})
-Empty.args = {
-  templateACL: MockTemplateACLEmpty,
-  canUpdatePermissions: false,
-}
+export const Empty: Story = {
+  args: {
+    templateACL: MockTemplateACLEmpty,
+    canUpdatePermissions: false,
+  },
+};
 
-export const WithTemplateACL = Template.bind({})
-WithTemplateACL.args = {
-  templateACL: MockTemplateACL,
-  canUpdatePermissions: false,
-}
+export const WithTemplateACL: Story = {
+  args: {
+    templateACL: MockTemplateACL,
+    canUpdatePermissions: false,
+  },
+};
 
-export const WithUpdatePermissions = Template.bind({})
-WithUpdatePermissions.args = {
-  templateACL: MockTemplateACL,
-  canUpdatePermissions: true,
-  organizationId: MockOrganization.id,
-}
+export const WithUpdatePermissions: Story = {
+  args: {
+    templateACL: MockTemplateACL,
+    canUpdatePermissions: true,
+    organizationId: MockOrganization.id,
+  },
+};
diff --git a/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPageView.tsx b/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPageView.tsx
index a434fcc9302be..1ed7cc69c9138 100644
--- a/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPageView.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPageView.tsx
@@ -1,73 +1,70 @@
-import MenuItem from "@mui/material/MenuItem"
-import Select, { SelectProps } from "@mui/material/Select"
-import { makeStyles } from "@mui/styles"
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableHead from "@mui/material/TableHead"
-import TableRow from "@mui/material/TableRow"
-import PersonAdd from "@mui/icons-material/PersonAdd"
-import {
+import MenuItem from "@mui/material/MenuItem";
+import Select, { type SelectProps } from "@mui/material/Select";
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableHead from "@mui/material/TableHead";
+import TableRow from "@mui/material/TableRow";
+import PersonAdd from "@mui/icons-material/PersonAdd";
+import { type Interpolation, type Theme } from "@emotion/react";
+import type {
   Group,
   TemplateACL,
   TemplateGroup,
   TemplateRole,
   TemplateUser,
-} from "api/typesGenerated"
-import { AvatarData } from "components/AvatarData/AvatarData"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { EmptyState } from "components/EmptyState/EmptyState"
-import { LoadingButton } from "components/LoadingButton/LoadingButton"
-import { Stack } from "components/Stack/Stack"
-import { TableLoader } from "components/TableLoader/TableLoader"
-import { TableRowMenu } from "components/TableRowMenu/TableRowMenu"
+} from "api/typesGenerated";
+import { AvatarData } from "components/AvatarData/AvatarData";
+import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
+import { EmptyState } from "components/EmptyState/EmptyState";
+import { Stack } from "components/Stack/Stack";
+import { TableLoader } from "components/TableLoader/TableLoader";
+import { TableRowMenu } from "components/TableRowMenu/TableRowMenu";
 import {
   UserOrGroupAutocomplete,
   UserOrGroupAutocompleteValue,
-} from "components/UserOrGroupAutocomplete/UserOrGroupAutocomplete"
-import { FC, useState } from "react"
-import { Maybe } from "components/Conditionals/Maybe"
-import { GroupAvatar } from "components/GroupAvatar/GroupAvatar"
-import { getGroupSubtitle } from "utils/groups"
-import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader"
+} from "./UserOrGroupAutocomplete";
+import { type FC, useState } from "react";
+import { GroupAvatar } from "components/GroupAvatar/GroupAvatar";
+import { getGroupSubtitle } from "utils/groups";
+import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader";
+import LoadingButton from "@mui/lab/LoadingButton";
 
 type AddTemplateUserOrGroupProps = {
-  organizationId: string
-  templateID: string
-  isLoading: boolean
-  templateACL: TemplateACL | undefined
+  organizationId: string;
+  templateID: string;
+  isLoading: boolean;
+  templateACL: TemplateACL | undefined;
   onSubmit: (
     userOrGroup: TemplateUser | TemplateGroup,
     role: TemplateRole,
     reset: () => void,
-  ) => void
-}
+  ) => void;
+};
 
 const AddTemplateUserOrGroup: React.FC<AddTemplateUserOrGroupProps> = ({
   isLoading,
   onSubmit,
-  organizationId,
   templateID,
   templateACL,
 }) => {
-  const styles = useStyles()
   const [selectedOption, setSelectedOption] =
-    useState<UserOrGroupAutocompleteValue>(null)
-  const [selectedRole, setSelectedRole] = useState<TemplateRole>("use")
+    useState<UserOrGroupAutocompleteValue>(null);
+  const [selectedRole, setSelectedRole] = useState<TemplateRole>("use");
   const excludeFromAutocomplete = templateACL
     ? [...templateACL.group, ...templateACL.users]
-    : []
+    : [];
 
   const resetValues = () => {
-    setSelectedOption(null)
-    setSelectedRole("use")
-  }
+    setSelectedOption(null);
+    setSelectedRole("use");
+  };
 
   return (
     <form
       onSubmit={(e) => {
-        e.preventDefault()
+        e.preventDefault();
 
         if (selectedOption && selectedRole) {
           onSubmit(
@@ -77,28 +74,27 @@ const AddTemplateUserOrGroup: React.FC<AddTemplateUserOrGroupProps> = ({
             },
             selectedRole,
             resetValues,
-          )
+          );
         }
       }}
     >
       <Stack direction="row" alignItems="center" spacing={1}>
         <UserOrGroupAutocomplete
           exclude={excludeFromAutocomplete}
-          organizationId={organizationId}
           templateID={templateID}
           value={selectedOption}
           onChange={(newValue) => {
-            setSelectedOption(newValue)
+            setSelectedOption(newValue);
           }}
         />
 
         <Select
           defaultValue="use"
           size="small"
-          className={styles.select}
+          css={styles.select}
           disabled={isLoading}
           onChange={(event) => {
-            setSelectedRole(event.target.value as TemplateRole)
+            setSelectedRole(event.target.value as TemplateRole);
           }}
         >
           <MenuItem key="use" value="use">
@@ -110,6 +106,7 @@ const AddTemplateUserOrGroup: React.FC<AddTemplateUserOrGroupProps> = ({
         </Select>
 
         <LoadingButton
+          loadingPosition="start"
           disabled={!selectedRole || !selectedOption}
           type="submit"
           startIcon={<PersonAdd />}
@@ -119,60 +116,62 @@ const AddTemplateUserOrGroup: React.FC<AddTemplateUserOrGroupProps> = ({
         </LoadingButton>
       </Stack>
     </form>
-  )
-}
+  );
+};
 
 const RoleSelect: FC<SelectProps> = (props) => {
-  const styles = useStyles()
-
   return (
     <Select
-      renderValue={(value) => <div className={styles.role}>{`${value}`}</div>}
-      className={styles.updateSelect}
+      renderValue={(value) => <div css={styles.role}>{`${value}`}</div>}
+      css={styles.updateSelect}
       {...props}
     >
-      <MenuItem key="use" value="use" className={styles.menuItem}>
+      <MenuItem key="use" value="use" css={styles.menuItem}>
         <div>
           <div>Use</div>
-          <div className={styles.menuItemSecondary}>
+          <div css={styles.menuItemSecondary}>
             Can read and use this template to create workspaces.
           </div>
         </div>
       </MenuItem>
-      <MenuItem key="admin" value="admin" className={styles.menuItem}>
+      <MenuItem key="admin" value="admin" css={styles.menuItem}>
         <div>
           <div>Admin</div>
-          <div className={styles.menuItemSecondary}>
+          <div css={styles.menuItemSecondary}>
             Can modify all aspects of this template including permissions,
             metadata, and template versions.
           </div>
         </div>
       </MenuItem>
     </Select>
-  )
-}
+  );
+};
 
 export interface TemplatePermissionsPageViewProps {
-  templateACL: TemplateACL | undefined
-  templateID: string
-  organizationId: string
-  canUpdatePermissions: boolean
+  templateACL: TemplateACL | undefined;
+  templateID: string;
+  organizationId: string;
+  canUpdatePermissions: boolean;
   // User
-  onAddUser: (user: TemplateUser, role: TemplateRole, reset: () => void) => void
-  isAddingUser: boolean
-  onUpdateUser: (user: TemplateUser, role: TemplateRole) => void
-  updatingUser: TemplateUser | undefined
-  onRemoveUser: (user: TemplateUser) => void
+  onAddUser: (
+    user: TemplateUser,
+    role: TemplateRole,
+    reset: () => void,
+  ) => void;
+  isAddingUser: boolean;
+  onUpdateUser: (user: TemplateUser, role: TemplateRole) => void;
+  updatingUserId: TemplateUser["id"] | undefined;
+  onRemoveUser: (user: TemplateUser) => void;
   // Group
   onAddGroup: (
     group: TemplateGroup,
     role: TemplateRole,
     reset: () => void,
-  ) => void
-  isAddingGroup: boolean
-  onUpdateGroup: (group: TemplateGroup, role: TemplateRole) => void
-  updatingGroup: TemplateGroup | undefined
-  onRemoveGroup: (group: Group) => void
+  ) => void;
+  isAddingGroup: boolean;
+  onUpdateGroup: (group: TemplateGroup, role: TemplateRole) => void;
+  updatingGroupId?: TemplateGroup["id"] | undefined;
+  onRemoveGroup: (group: Group) => void;
 }
 
 export const TemplatePermissionsPageView: FC<
@@ -185,31 +184,30 @@ export const TemplatePermissionsPageView: FC<
   // User
   onAddUser,
   isAddingUser,
-  updatingUser,
+  updatingUserId,
   onUpdateUser,
   onRemoveUser,
   // Group
   onAddGroup,
   isAddingGroup,
-  updatingGroup,
+  updatingGroupId,
   onUpdateGroup,
   onRemoveGroup,
 }) => {
-  const styles = useStyles()
   const isEmpty = Boolean(
     templateACL &&
       templateACL.users.length === 0 &&
       templateACL.group.length === 0,
-  )
+  );
 
   return (
     <>
-      <PageHeader className={styles.pageHeader}>
+      <PageHeader css={styles.pageHeader}>
         <PageHeaderTitle>Permissions</PageHeaderTitle>
       </PageHeader>
 
       <Stack spacing={2.5}>
-        <Maybe condition={canUpdatePermissions}>
+        {canUpdatePermissions && (
           <AddTemplateUserOrGroup
             templateACL={templateACL}
             templateID={templateID}
@@ -221,7 +219,7 @@ export const TemplatePermissionsPageView: FC<
                 : onAddUser(value, role, resetAutocomplete)
             }
           />
-        </Maybe>
+        )}
         <TableContainer>
           <Table>
             <TableHead>
@@ -266,25 +264,23 @@ export const TemplatePermissionsPageView: FC<
                           <Cond condition={canUpdatePermissions}>
                             <RoleSelect
                               value={group.role}
-                              disabled={
-                                updatingGroup && updatingGroup.id === group.id
-                              }
+                              disabled={updatingGroupId === group.id}
                               onChange={(event) => {
                                 onUpdateGroup(
                                   group,
                                   event.target.value as TemplateRole,
-                                )
+                                );
                               }}
                             />
                           </Cond>
                           <Cond>
-                            <div className={styles.role}>{group.role}</div>
+                            <div css={styles.role}>{group.role}</div>
                           </Cond>
                         </ChooseOne>
                       </TableCell>
 
                       <TableCell>
-                        <Maybe condition={canUpdatePermissions}>
+                        {canUpdatePermissions && (
                           <TableRowMenu
                             data={group}
                             menuItems={[
@@ -295,7 +291,7 @@ export const TemplatePermissionsPageView: FC<
                               },
                             ]}
                           />
-                        </Maybe>
+                        )}
                       </TableCell>
                     </TableRow>
                   ))}
@@ -314,25 +310,23 @@ export const TemplatePermissionsPageView: FC<
                           <Cond condition={canUpdatePermissions}>
                             <RoleSelect
                               value={user.role}
-                              disabled={
-                                updatingUser && updatingUser.id === user.id
-                              }
+                              disabled={updatingUserId === user.id}
                               onChange={(event) => {
                                 onUpdateUser(
                                   user,
                                   event.target.value as TemplateRole,
-                                )
+                                );
                               }}
                             />
                           </Cond>
                           <Cond>
-                            <div className={styles.role}>{user.role}</div>
+                            <div css={styles.role}>{user.role}</div>
                           </Cond>
                         </ChooseOne>
                       </TableCell>
 
                       <TableCell>
-                        <Maybe condition={canUpdatePermissions}>
+                        {canUpdatePermissions && (
                           <TableRowMenu
                             data={user}
                             menuItems={[
@@ -343,7 +337,7 @@ export const TemplatePermissionsPageView: FC<
                               },
                             ]}
                           />
-                        </Maybe>
+                        )}
                       </TableCell>
                     </TableRow>
                   ))}
@@ -354,17 +348,17 @@ export const TemplatePermissionsPageView: FC<
         </TableContainer>
       </Stack>
     </>
-  )
-}
+  );
+};
 
-export const useStyles = makeStyles((theme) => ({
+const styles = {
   select: {
     // Match button small height
     fontSize: 14,
     width: 100,
   },
 
-  updateSelect: {
+  updateSelect: (theme) => ({
     margin: 0,
     // Set a fixed width for the select. It avoids selects having different sizes
     // depending on how many roles they have selected.
@@ -379,26 +373,26 @@ export const useStyles = makeStyles((theme) => ({
         display: "none",
       },
     },
-  },
+  }),
 
   role: {
     textTransform: "capitalize",
   },
 
-  menuItem: {
+  menuItem: (theme) => ({
     lineHeight: "140%",
     paddingTop: theme.spacing(1.5),
     paddingBottom: theme.spacing(1.5),
     whiteSpace: "normal",
     inlineSize: "250px",
-  },
+  }),
 
-  menuItemSecondary: {
+  menuItemSecondary: (theme) => ({
     fontSize: 14,
     color: theme.palette.text.secondary,
-  },
+  }),
 
   pageHeader: {
     paddingTop: 0,
   },
-}))
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/UserOrGroupAutocomplete.tsx b/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/UserOrGroupAutocomplete.tsx
new file mode 100644
index 0000000000000..70a3001d73b5f
--- /dev/null
+++ b/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/UserOrGroupAutocomplete.tsx
@@ -0,0 +1,149 @@
+import CircularProgress from "@mui/material/CircularProgress";
+import TextField from "@mui/material/TextField";
+import Autocomplete from "@mui/material/Autocomplete";
+import Box from "@mui/material/Box";
+import { type ChangeEvent, useState } from "react";
+import { css } from "@emotion/react";
+import type { Group, User } from "api/typesGenerated";
+import { AvatarData } from "components/AvatarData/AvatarData";
+import { getGroupSubtitle } from "utils/groups";
+import { useDebouncedFunction } from "hooks/debounce";
+import { useQuery } from "react-query";
+import { templaceACLAvailable } from "api/queries/templates";
+import { prepareQuery } from "utils/filters";
+
+export type UserOrGroupAutocompleteValue = User | Group | null;
+
+export type UserOrGroupAutocompleteProps = {
+  value: UserOrGroupAutocompleteValue;
+  onChange: (value: UserOrGroupAutocompleteValue) => void;
+  templateID: string;
+  exclude: UserOrGroupAutocompleteValue[];
+};
+
+export const UserOrGroupAutocomplete: React.FC<
+  UserOrGroupAutocompleteProps
+> = ({ value, onChange, templateID, exclude }) => {
+  const [autoComplete, setAutoComplete] = useState<{
+    value: string;
+    open: boolean;
+  }>({
+    value: "",
+    open: false,
+  });
+  const aclAvailableQuery = useQuery({
+    ...templaceACLAvailable(templateID, {
+      q: prepareQuery(encodeURI(autoComplete.value)),
+      limit: 25,
+    }),
+    enabled: autoComplete.open,
+    keepPreviousData: true,
+  });
+  const options = aclAvailableQuery.data
+    ? [
+        ...aclAvailableQuery.data.groups,
+        ...aclAvailableQuery.data.users,
+      ].filter((result) => {
+        const excludeIds = exclude.map(
+          (optionToExclude) => optionToExclude?.id,
+        );
+        return !excludeIds.includes(result.id);
+      })
+    : [];
+
+  const { debounced: handleFilterChange } = useDebouncedFunction(
+    (event: ChangeEvent<HTMLInputElement>) => {
+      setAutoComplete((state) => ({
+        ...state,
+        value: event.target.value,
+      }));
+    },
+    500,
+  );
+
+  return (
+    <Autocomplete
+      noOptionsText="No users or groups found"
+      value={value}
+      id="user-or-group-autocomplete"
+      open={autoComplete.open}
+      onOpen={() => {
+        setAutoComplete((state) => ({
+          ...state,
+          open: true,
+        }));
+      }}
+      onClose={() => {
+        setAutoComplete({
+          value: isGroup(value) ? value.display_name : value?.email ?? "",
+          open: false,
+        });
+      }}
+      onChange={(_, newValue) => {
+        onChange(newValue);
+      }}
+      isOptionEqualToValue={(option, value) => option.id === value.id}
+      getOptionLabel={(option) =>
+        isGroup(option) ? option.display_name || option.name : option.email
+      }
+      renderOption={(props, option) => {
+        const isOptionGroup = isGroup(option);
+
+        return (
+          <Box component="li" {...props}>
+            <AvatarData
+              title={
+                isOptionGroup
+                  ? option.display_name || option.name
+                  : option.username
+              }
+              subtitle={isOptionGroup ? getGroupSubtitle(option) : option.email}
+              src={option.avatar_url}
+            />
+          </Box>
+        );
+      }}
+      options={options}
+      loading={aclAvailableQuery.isFetching}
+      css={autoCompleteStyles}
+      renderInput={(params) => (
+        <>
+          <TextField
+            {...params}
+            margin="none"
+            size="small"
+            placeholder="Search for user or group"
+            InputProps={{
+              ...params.InputProps,
+              onChange: handleFilterChange,
+              endAdornment: (
+                <>
+                  {aclAvailableQuery.isFetching ? (
+                    <CircularProgress size={16} />
+                  ) : null}
+                  {params.InputProps.endAdornment}
+                </>
+              ),
+            }}
+          />
+        </>
+      )}
+    />
+  );
+};
+
+const isGroup = (value: UserOrGroupAutocompleteValue): value is Group => {
+  return value !== null && "members" in value;
+};
+
+const autoCompleteStyles = css`
+  width: 300px;
+
+  & .MuiFormControl-root {
+    width: 100%;
+  }
+
+  & .MuiInputBase-root {
+    width: 100%;
+  }
+`;
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/AutostopRequirementHelperText.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/AutostopRequirementHelperText.tsx
new file mode 100644
index 0000000000000..fff5cf23c55fd
--- /dev/null
+++ b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/AutostopRequirementHelperText.tsx
@@ -0,0 +1,69 @@
+import { Template } from "api/typesGenerated";
+import { TemplateAutostopRequirementDaysValue } from "utils/schedule";
+
+const autostopRequirementDescriptions = {
+  off: "Workspaces are not required to stop periodically.",
+  daily:
+    "Workspaces are required to be automatically stopped daily in the user's quiet hours and timezone.",
+  saturday:
+    "Workspaces are required to be automatically stopped every Saturday in the user's quiet hours and timezone.",
+  sunday:
+    "Workspaces are required to be automatically stopped every Sunday in the user's quiet hours and timezone.",
+};
+
+export const convertAutostopRequirementDaysValue = (
+  days: Template["autostop_requirement"]["days_of_week"],
+): TemplateAutostopRequirementDaysValue => {
+  if (days.length === 7) {
+    return "daily";
+  } else if (days.length === 1 && days[0] === "saturday") {
+    return "saturday";
+  } else if (days.length === 1 && days[0] === "sunday") {
+    return "sunday";
+  }
+
+  // On unsupported values we default to "off".
+  return "off";
+};
+
+export const AutostopRequirementDaysHelperText = ({
+  days = "off",
+}: {
+  days: TemplateAutostopRequirementDaysValue;
+}) => {
+  return <span>{autostopRequirementDescriptions[days]}</span>;
+};
+
+export const AutostopRequirementWeeksHelperText = ({
+  days,
+  weeks,
+}: {
+  days: TemplateAutostopRequirementDaysValue;
+  weeks: number;
+}) => {
+  // Disabled
+  if (days !== "saturday" && days !== "sunday") {
+    return (
+      <span>
+        Weeks between required stops cannot be set unless days between required
+        stops is Saturday or Sunday.
+      </span>
+    );
+  }
+
+  if (weeks <= 1) {
+    return (
+      <span>
+        Workspaces are required to be automatically stopped every week on the
+        specified day in the user&apos;s quiet hours and timezone.
+      </span>
+    );
+  }
+
+  return (
+    <span>
+      Workspaces are required to be automatically stopped every {weeks} weeks on
+      the specified day in the user&apos;s quiet hours and timezone.
+    </span>
+  );
+};
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/ScheduleDialog.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/ScheduleDialog.tsx
new file mode 100644
index 0000000000000..04c1a70e092e2
--- /dev/null
+++ b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/ScheduleDialog.tsx
@@ -0,0 +1,174 @@
+import DialogActions from "@mui/material/DialogActions";
+import { type FC, type PropsWithChildren } from "react";
+import Checkbox from "@mui/material/Checkbox";
+import FormControlLabel from "@mui/material/FormControlLabel";
+import { Stack } from "@mui/system";
+import { type Interpolation, type Theme } from "@emotion/react";
+import { Dialog, DialogActionButtons } from "components/Dialogs/Dialog";
+import { type ConfirmDialogProps } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+
+export interface ScheduleDialogProps extends ConfirmDialogProps {
+  readonly inactiveWorkspacesToGoDormant: number;
+  readonly inactiveWorkspacesToGoDormantInWeek: number;
+  readonly dormantWorkspacesToBeDeleted: number;
+  readonly dormantWorkspacesToBeDeletedInWeek: number;
+  readonly updateDormantWorkspaces: (confirm: boolean) => void;
+  readonly updateInactiveWorkspaces: (confirm: boolean) => void;
+  readonly dormantValueChanged: boolean;
+  readonly deletionValueChanged: boolean;
+}
+
+export const ScheduleDialog: FC<PropsWithChildren<ScheduleDialogProps>> = ({
+  cancelText,
+  confirmLoading,
+  disabled = false,
+  hideCancel,
+  onClose,
+  onConfirm,
+  open = false,
+  title,
+  inactiveWorkspacesToGoDormant,
+  inactiveWorkspacesToGoDormantInWeek,
+  dormantWorkspacesToBeDeleted,
+  dormantWorkspacesToBeDeletedInWeek,
+  updateDormantWorkspaces,
+  updateInactiveWorkspaces,
+  dormantValueChanged,
+  deletionValueChanged,
+}) => {
+  const defaults = {
+    confirmText: "Delete",
+    hideCancel: false,
+  };
+
+  if (typeof hideCancel === "undefined") {
+    hideCancel = defaults.hideCancel;
+  }
+
+  const showDormancyWarning =
+    dormantValueChanged &&
+    (inactiveWorkspacesToGoDormant > 0 ||
+      inactiveWorkspacesToGoDormantInWeek > 0);
+  const showDeletionWarning =
+    deletionValueChanged &&
+    (dormantWorkspacesToBeDeleted > 0 ||
+      dormantWorkspacesToBeDeletedInWeek > 0);
+
+  return (
+    <Dialog
+      css={styles.dialogWrapper}
+      onClose={onClose}
+      open={open}
+      data-testid="dialog"
+    >
+      <div css={styles.dialogContent}>
+        <h3 css={styles.dialogTitle}>{title}</h3>
+        <>
+          {showDormancyWarning && (
+            <>
+              <h4>{"Dormancy Threshold"}</h4>
+              <Stack direction="row" spacing={5}>
+                <div css={styles.dialogDescription}>{`
+                This change will result in ${inactiveWorkspacesToGoDormant} workspaces being immediately transitioned to the dormant state and ${inactiveWorkspacesToGoDormantInWeek} over the next seven days. To prevent this, do you want to reset the inactivity period for all template workspaces?`}</div>
+                <FormControlLabel
+                  sx={{
+                    marginTop: 2,
+                  }}
+                  control={
+                    <Checkbox
+                      size="small"
+                      onChange={(e) => {
+                        updateInactiveWorkspaces(e.target.checked);
+                      }}
+                    />
+                  }
+                  label="Reset"
+                />
+              </Stack>
+            </>
+          )}
+
+          {showDeletionWarning && (
+            <>
+              <h4>{"Dormancy Auto-Deletion"}</h4>
+              <Stack direction="row" spacing={5}>
+                <div
+                  css={styles.dialogDescription}
+                >{`This change will result in ${dormantWorkspacesToBeDeleted} workspaces being immediately deleted and ${dormantWorkspacesToBeDeletedInWeek} over the next 7 days. To prevent this, do you want to reset the dormancy period for all template workspaces?`}</div>
+                <FormControlLabel
+                  sx={{
+                    marginTop: 2,
+                  }}
+                  control={
+                    <Checkbox
+                      size="small"
+                      onChange={(e) => {
+                        updateDormantWorkspaces(e.target.checked);
+                      }}
+                    />
+                  }
+                  label="Reset"
+                />
+              </Stack>
+            </>
+          )}
+        </>
+      </div>
+
+      <DialogActions>
+        <DialogActionButtons
+          cancelText={cancelText}
+          confirmDialog
+          confirmLoading={confirmLoading}
+          confirmText="Submit"
+          disabled={disabled}
+          onCancel={!hideCancel ? onClose : undefined}
+          onConfirm={onConfirm || onClose}
+          type="delete"
+        />
+      </DialogActions>
+    </Dialog>
+  );
+};
+
+const styles = {
+  dialogWrapper: (theme) => ({
+    "& .MuiPaper-root": {
+      background: theme.palette.background.paper,
+      border: `1px solid ${theme.palette.divider}`,
+      width: "100%",
+      maxWidth: theme.spacing(125),
+    },
+    "& .MuiDialogActions-spacing": {
+      padding: `0 ${theme.spacing(5)} ${theme.spacing(5)}`,
+    },
+  }),
+  dialogContent: (theme) => ({
+    color: theme.palette.text.secondary,
+    padding: theme.spacing(5),
+  }),
+  dialogTitle: (theme) => ({
+    margin: 0,
+    marginBottom: theme.spacing(2),
+    color: theme.palette.text.primary,
+    fontWeight: 400,
+    fontSize: theme.spacing(2.5),
+  }),
+  dialogDescription: (theme) => ({
+    color: theme.palette.text.secondary,
+    lineHeight: "160%",
+    fontSize: 16,
+
+    "& strong": {
+      color: theme.palette.text.primary,
+    },
+
+    "& p:not(.MuiFormHelperText-root)": {
+      margin: 0,
+    },
+
+    "& > p": {
+      margin: theme.spacing(1, 0),
+    },
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TTLHelperText.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TTLHelperText.tsx
new file mode 100644
index 0000000000000..caa038cd47a8f
--- /dev/null
+++ b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TTLHelperText.tsx
@@ -0,0 +1,101 @@
+const hours = (h: number) => (h === 1 ? "hour" : "hours");
+const days = (d: number) => (d === 1 ? "day" : "days");
+
+export const DefaultTTLHelperText = (props: { ttl?: number }) => {
+  const { ttl = 0 } = props;
+
+  // Error will show once field is considered touched
+  if (ttl < 0) {
+    return null;
+  }
+
+  if (ttl === 0) {
+    return <span>Workspaces will run until stopped manually.</span>;
+  }
+
+  return (
+    <span>
+      Workspaces will default to stopping after {ttl} {hours(ttl)} without
+      activity.
+    </span>
+  );
+};
+
+export const MaxTTLHelperText = (props: { ttl?: number }) => {
+  const { ttl = 0 } = props;
+
+  // Error will show once field is considered touched
+  if (ttl < 0) {
+    return null;
+  }
+
+  if (ttl === 0) {
+    return <span>Workspaces may run indefinitely.</span>;
+  }
+
+  return (
+    <span>
+      Workspaces must stop within {ttl} {hours(ttl)} of starting, regardless of
+      any active connections.
+    </span>
+  );
+};
+
+export const FailureTTLHelperText = (props: { ttl?: number }) => {
+  const { ttl = 0 } = props;
+
+  // Error will show once field is considered touched
+  if (ttl < 0) {
+    return null;
+  }
+
+  if (ttl === 0) {
+    return <span>Coder will not automatically stop failed workspaces.</span>;
+  }
+
+  return (
+    <span>
+      Coder will attempt to stop failed workspaces after {ttl} {days(ttl)}.
+    </span>
+  );
+};
+
+export const DormancyTTLHelperText = (props: { ttl?: number }) => {
+  const { ttl = 0 } = props;
+
+  // Error will show once field is considered touched
+  if (ttl < 0) {
+    return null;
+  }
+
+  if (ttl === 0) {
+    return <span>Coder will not mark workspaces as dormant.</span>;
+  }
+
+  return (
+    <span>
+      Coder will mark workspaces as dormant after {ttl} {days(ttl)} without user
+      connections.
+    </span>
+  );
+};
+
+export const DormancyAutoDeletionTTLHelperText = (props: { ttl?: number }) => {
+  const { ttl = 0 } = props;
+
+  // Error will show once field is considered touched
+  if (ttl < 0) {
+    return null;
+  }
+
+  if (ttl === 0) {
+    return <span>Coder will not automatically delete dormant workspaces.</span>;
+  }
+
+  return (
+    <span>
+      Coder will automatically delete dormant workspaces after {ttl} {days(ttl)}
+      .
+    </span>
+  );
+};
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm.tsx
new file mode 100644
index 0000000000000..912cc070ccb79
--- /dev/null
+++ b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm.tsx
@@ -0,0 +1,660 @@
+import TextField from "@mui/material/TextField";
+import MenuItem from "@mui/material/MenuItem";
+import Link from "@mui/material/Link";
+import Checkbox from "@mui/material/Checkbox";
+import FormControlLabel from "@mui/material/FormControlLabel";
+import Switch from "@mui/material/Switch";
+import { FormikTouched, useFormik } from "formik";
+import { FC, ChangeEvent, useState, useEffect } from "react";
+import { Template, UpdateTemplateMeta } from "api/typesGenerated";
+import { getFormHelpers } from "utils/formUtils";
+import { docs } from "utils/docs";
+import {
+  TemplateAutostartRequirementDaysValue,
+  calculateAutostopRequirementDaysValue,
+} from "utils/schedule";
+import {
+  FormSection,
+  HorizontalForm,
+  FormFooter,
+  FormFields,
+} from "components/Form/Form";
+import { Stack } from "components/Stack/Stack";
+import {
+  useWorkspacesToGoDormant,
+  useWorkspacesToBeDeleted,
+} from "./useWorkspacesToBeDeleted";
+import { TemplateScheduleFormValues, getValidationSchema } from "./formHelpers";
+import {
+  DefaultTTLHelperText,
+  DormancyAutoDeletionTTLHelperText,
+  DormancyTTLHelperText,
+  FailureTTLHelperText,
+  MaxTTLHelperText,
+} from "./TTLHelperText";
+import { ScheduleDialog } from "./ScheduleDialog";
+import {
+  AutostopRequirementDaysHelperText,
+  AutostopRequirementWeeksHelperText,
+  convertAutostopRequirementDaysValue,
+} from "./AutostopRequirementHelperText";
+import { useTheme } from "@emotion/react";
+import { TemplateScheduleAutostart } from "components/TemplateScheduleAutostart/TemplateScheduleAutostart";
+
+const MS_HOUR_CONVERSION = 3600000;
+const MS_DAY_CONVERSION = 86400000;
+const FAILURE_CLEANUP_DEFAULT = 7;
+const INACTIVITY_CLEANUP_DEFAULT = 180;
+const DORMANT_AUTODELETION_DEFAULT = 30;
+
+export interface TemplateScheduleForm {
+  template: Template;
+  onSubmit: (data: UpdateTemplateMeta) => void;
+  onCancel: () => void;
+  isSubmitting: boolean;
+  error?: unknown;
+  allowAdvancedScheduling: boolean;
+  allowWorkspaceActions: boolean;
+  allowAutostopRequirement: boolean;
+  // Helpful to show field errors on Storybook
+  initialTouched?: FormikTouched<UpdateTemplateMeta>;
+}
+
+export const TemplateScheduleForm: FC<TemplateScheduleForm> = ({
+  template,
+  onSubmit,
+  onCancel,
+  error,
+  allowAdvancedScheduling,
+  allowWorkspaceActions,
+  allowAutostopRequirement,
+  isSubmitting,
+  initialTouched,
+}) => {
+  const validationSchema = getValidationSchema();
+  const form = useFormik<TemplateScheduleFormValues>({
+    initialValues: {
+      // on display, convert from ms => hours
+      default_ttl_ms: template.default_ttl_ms / MS_HOUR_CONVERSION,
+      // the API ignores these values, but to avoid tripping up validation set
+      // it to zero if the user can't set the field.
+      max_ttl_ms: allowAdvancedScheduling
+        ? template.max_ttl_ms / MS_HOUR_CONVERSION
+        : 0,
+      failure_ttl_ms: allowAdvancedScheduling
+        ? template.failure_ttl_ms / MS_DAY_CONVERSION
+        : 0,
+      time_til_dormant_ms: allowAdvancedScheduling
+        ? template.time_til_dormant_ms / MS_DAY_CONVERSION
+        : 0,
+      time_til_dormant_autodelete_ms: allowAdvancedScheduling
+        ? template.time_til_dormant_autodelete_ms / MS_DAY_CONVERSION
+        : 0,
+
+      autostop_requirement_days_of_week: allowAutostopRequirement
+        ? convertAutostopRequirementDaysValue(
+            template.autostop_requirement.days_of_week,
+          )
+        : "off",
+      autostop_requirement_weeks: allowAutostopRequirement
+        ? template.autostop_requirement.weeks > 0
+          ? template.autostop_requirement.weeks
+          : 1
+        : 1,
+      autostart_requirement_days_of_week: template.autostart_requirement
+        .days_of_week as TemplateAutostartRequirementDaysValue[],
+
+      allow_user_autostart: template.allow_user_autostart,
+      allow_user_autostop: template.allow_user_autostop,
+      failure_cleanup_enabled:
+        allowAdvancedScheduling && Boolean(template.failure_ttl_ms),
+      inactivity_cleanup_enabled:
+        allowAdvancedScheduling && Boolean(template.time_til_dormant_ms),
+      dormant_autodeletion_cleanup_enabled:
+        allowAdvancedScheduling &&
+        Boolean(template.time_til_dormant_autodelete_ms),
+      update_workspace_last_used_at: false,
+      update_workspace_dormant_at: false,
+      require_active_version: false,
+    },
+    validationSchema,
+    onSubmit: () => {
+      const dormancyChanged =
+        form.initialValues.time_til_dormant_ms !==
+        form.values.time_til_dormant_ms;
+      const deletionChanged =
+        form.initialValues.time_til_dormant_autodelete_ms !==
+        form.values.time_til_dormant_autodelete_ms;
+
+      const dormancyScheduleChanged =
+        form.values.inactivity_cleanup_enabled &&
+        dormancyChanged &&
+        workspacesToDormancyInWeek &&
+        workspacesToDormancyInWeek.length > 0;
+
+      const deletionScheduleChanged =
+        form.values.inactivity_cleanup_enabled &&
+        deletionChanged &&
+        workspacesToBeDeletedInWeek &&
+        workspacesToBeDeletedInWeek.length > 0;
+
+      if (dormancyScheduleChanged || deletionScheduleChanged) {
+        setIsScheduleDialogOpen(true);
+      } else {
+        submitValues();
+      }
+    },
+    initialTouched,
+    enableReinitialize: true,
+  });
+
+  const getFieldHelpers = getFormHelpers<TemplateScheduleFormValues>(
+    form,
+    error,
+  );
+  const theme = useTheme();
+
+  const now = new Date();
+  const weekFromNow = new Date(now);
+  weekFromNow.setDate(now.getDate() + 7);
+
+  const workspacesToDormancyNow = useWorkspacesToGoDormant(
+    template,
+    form.values,
+    now,
+  );
+
+  const workspacesToDormancyInWeek = useWorkspacesToGoDormant(
+    template,
+    form.values,
+    weekFromNow,
+  );
+
+  const workspacesToBeDeletedNow = useWorkspacesToBeDeleted(
+    template,
+    form.values,
+    now,
+  );
+
+  const workspacesToBeDeletedInWeek = useWorkspacesToBeDeleted(
+    template,
+    form.values,
+    weekFromNow,
+  );
+
+  const showScheduleDialog =
+    workspacesToDormancyNow &&
+    workspacesToBeDeletedNow &&
+    workspacesToDormancyInWeek &&
+    workspacesToBeDeletedInWeek &&
+    (workspacesToDormancyInWeek.length > 0 ||
+      workspacesToBeDeletedInWeek.length > 0);
+
+  const [isScheduleDialogOpen, setIsScheduleDialogOpen] =
+    useState<boolean>(false);
+
+  const submitValues = () => {
+    const autostop_requirement_weeks = ["saturday", "sunday"].includes(
+      form.values.autostop_requirement_days_of_week,
+    )
+      ? form.values.autostop_requirement_weeks
+      : 1;
+
+    // on submit, convert from hours => ms
+    onSubmit({
+      default_ttl_ms: form.values.default_ttl_ms
+        ? form.values.default_ttl_ms * MS_HOUR_CONVERSION
+        : undefined,
+      max_ttl_ms: form.values.max_ttl_ms
+        ? form.values.max_ttl_ms * MS_HOUR_CONVERSION
+        : undefined,
+      failure_ttl_ms: form.values.failure_ttl_ms
+        ? form.values.failure_ttl_ms * MS_DAY_CONVERSION
+        : undefined,
+      time_til_dormant_ms: form.values.time_til_dormant_ms
+        ? form.values.time_til_dormant_ms * MS_DAY_CONVERSION
+        : undefined,
+      time_til_dormant_autodelete_ms: form.values.time_til_dormant_autodelete_ms
+        ? form.values.time_til_dormant_autodelete_ms * MS_DAY_CONVERSION
+        : undefined,
+
+      autostop_requirement: {
+        days_of_week: calculateAutostopRequirementDaysValue(
+          form.values.autostop_requirement_days_of_week,
+        ),
+        weeks: autostop_requirement_weeks,
+      },
+      autostart_requirement: {
+        days_of_week: form.values.autostart_requirement_days_of_week,
+      },
+
+      allow_user_autostart: form.values.allow_user_autostart,
+      allow_user_autostop: form.values.allow_user_autostop,
+      update_workspace_last_used_at: form.values.update_workspace_last_used_at,
+      update_workspace_dormant_at: form.values.update_workspace_dormant_at,
+      require_active_version: false,
+    });
+  };
+
+  // Set autostop_requirement weeks to 1 when days_of_week is set to "off" or
+  // "daily". Technically you can set weeks to a different value in the backend
+  // and it will work, but this is a UX decision so users don't set days=daily
+  // and weeks=2 and get confused when workspaces only restart daily during
+  // every second week.
+  //
+  // We want to set the value to 1 when the user selects "off" or "daily"
+  // because the input gets disabled so they can't change it to 1 themselves.
+  const { values: currentValues, setValues } = form;
+  useEffect(() => {
+    if (
+      !["saturday", "sunday"].includes(
+        currentValues.autostop_requirement_days_of_week,
+      ) &&
+      currentValues.autostop_requirement_weeks !== 1
+    ) {
+      // This is async but we don't really need to await the value.
+      void setValues({
+        ...currentValues,
+        autostop_requirement_weeks: 1,
+      });
+    }
+  }, [currentValues, setValues]);
+
+  const handleToggleFailureCleanup = async (e: ChangeEvent) => {
+    form.handleChange(e);
+    if (!form.values.failure_cleanup_enabled) {
+      // fill failure_ttl_ms with defaults
+      await form.setValues({
+        ...form.values,
+        failure_cleanup_enabled: true,
+        failure_ttl_ms: FAILURE_CLEANUP_DEFAULT,
+      });
+    } else {
+      // clear failure_ttl_ms
+      await form.setValues({
+        ...form.values,
+        failure_cleanup_enabled: false,
+        failure_ttl_ms: 0,
+      });
+    }
+  };
+
+  const handleToggleInactivityCleanup = async (e: ChangeEvent) => {
+    form.handleChange(e);
+    if (!form.values.inactivity_cleanup_enabled) {
+      // fill time_til_dormant_ms with defaults
+      await form.setValues({
+        ...form.values,
+        inactivity_cleanup_enabled: true,
+        time_til_dormant_ms: INACTIVITY_CLEANUP_DEFAULT,
+      });
+    } else {
+      // clear time_til_dormant_ms
+      await form.setValues({
+        ...form.values,
+        inactivity_cleanup_enabled: false,
+        time_til_dormant_ms: 0,
+      });
+    }
+  };
+
+  const handleToggleDormantAutoDeletion = async (e: ChangeEvent) => {
+    form.handleChange(e);
+    if (!form.values.dormant_autodeletion_cleanup_enabled) {
+      // fill failure_ttl_ms with defaults
+      await form.setValues({
+        ...form.values,
+        dormant_autodeletion_cleanup_enabled: true,
+        time_til_dormant_autodelete_ms: DORMANT_AUTODELETION_DEFAULT,
+      });
+    } else {
+      // clear failure_ttl_ms
+      await form.setValues({
+        ...form.values,
+        dormant_autodeletion_cleanup_enabled: false,
+        time_til_dormant_autodelete_ms: 0,
+      });
+    }
+  };
+
+  return (
+    <HorizontalForm
+      onSubmit={form.handleSubmit}
+      aria-label="Template settings form"
+    >
+      <FormSection
+        title="Schedule"
+        description="Define when workspaces created from this template are stopped."
+      >
+        <Stack direction="row" css={styles.ttlFields}>
+          <TextField
+            {...getFieldHelpers(
+              "default_ttl_ms",
+              <DefaultTTLHelperText ttl={form.values.default_ttl_ms} />,
+            )}
+            disabled={isSubmitting}
+            fullWidth
+            inputProps={{ min: 0, step: 1 }}
+            label="Default autostop (hours)"
+            type="number"
+          />
+
+          {!allowAutostopRequirement && (
+            <TextField
+              {...getFieldHelpers(
+                "max_ttl_ms",
+                allowAdvancedScheduling ? (
+                  <MaxTTLHelperText ttl={form.values.max_ttl_ms} />
+                ) : (
+                  <>
+                    You need an enterprise license to use it{" "}
+                    <Link href={docs("/enterprise")}>Learn more</Link>.
+                  </>
+                ),
+              )}
+              disabled={isSubmitting || !allowAdvancedScheduling}
+              fullWidth
+              inputProps={{ min: 0, step: 1 }}
+              label="Max lifetime (hours)"
+              type="number"
+            />
+          )}
+        </Stack>
+      </FormSection>
+
+      {allowAutostopRequirement && (
+        <FormSection
+          title="Autostop Requirement"
+          description="Define when workspaces created from this template are stopped periodically to enforce template updates and ensure idle workspaces are stopped."
+        >
+          <Stack direction="row" css={styles.ttlFields}>
+            <TextField
+              {...getFieldHelpers(
+                "autostop_requirement_days_of_week",
+                <AutostopRequirementDaysHelperText
+                  days={form.values.autostop_requirement_days_of_week}
+                />,
+              )}
+              disabled={isSubmitting}
+              fullWidth
+              select
+              value={form.values.autostop_requirement_days_of_week}
+              label="Days with required stop"
+            >
+              <MenuItem key="off" value="off">
+                Off
+              </MenuItem>
+              <MenuItem key="daily" value="daily">
+                Daily
+              </MenuItem>
+              <MenuItem key="saturday" value="saturday">
+                Saturday
+              </MenuItem>
+              <MenuItem key="sunday" value="sunday">
+                Sunday
+              </MenuItem>
+            </TextField>
+
+            <TextField
+              {...getFieldHelpers(
+                "autostop_requirement_weeks",
+                <AutostopRequirementWeeksHelperText
+                  days={form.values.autostop_requirement_days_of_week}
+                  weeks={form.values.autostop_requirement_weeks}
+                />,
+              )}
+              disabled={
+                isSubmitting ||
+                !["saturday", "sunday"].includes(
+                  form.values.autostop_requirement_days_of_week || "",
+                )
+              }
+              fullWidth
+              inputProps={{ min: 1, max: 16, step: 1 }}
+              label="Weeks between required stops"
+              type="number"
+            />
+          </Stack>
+        </FormSection>
+      )}
+
+      <FormSection
+        title="Allow users scheduling"
+        description="Allow users to set custom autostart and autostop scheduling options for workspaces created from this template."
+      >
+        <Stack direction="column">
+          <Stack direction="row" alignItems="center">
+            <Checkbox
+              id="allow_user_autostart"
+              size="small"
+              disabled={isSubmitting || !allowAdvancedScheduling}
+              onChange={async () => {
+                await form.setFieldValue(
+                  "allow_user_autostart",
+                  !form.values.allow_user_autostart,
+                );
+              }}
+              name="allow_user_autostart"
+              checked={form.values.allow_user_autostart}
+            />
+            <Stack spacing={0.5}>
+              <strong>
+                Allow users to automatically start workspaces on a schedule.
+              </strong>
+            </Stack>
+          </Stack>
+          {allowAdvancedScheduling && (
+            <TemplateScheduleAutostart
+              allow_user_autostart={form.values.allow_user_autostart}
+              autostart_requirement_days_of_week={
+                form.values.autostart_requirement_days_of_week
+              }
+              isSubmitting={isSubmitting}
+              onChange={async (
+                newDaysOfWeek: TemplateAutostartRequirementDaysValue[],
+              ) => {
+                await form.setFieldValue(
+                  "autostart_requirement_days_of_week",
+                  newDaysOfWeek,
+                );
+              }}
+            />
+          )}
+
+          <Stack direction="row" alignItems="center">
+            <Checkbox
+              id="allow-user-autostop"
+              size="small"
+              disabled={isSubmitting || !allowAdvancedScheduling}
+              onChange={async () => {
+                await form.setFieldValue(
+                  "allow_user_autostop",
+                  !form.values.allow_user_autostop,
+                );
+              }}
+              name="allow_user_autostop"
+              checked={form.values.allow_user_autostop}
+            />
+            <Stack spacing={0.5}>
+              <strong>
+                Allow users to customize autostop duration for workspaces.
+              </strong>
+              <span
+                css={{
+                  fontSize: 12,
+                  color: theme.palette.text.secondary,
+                }}
+              >
+                Workspaces will always use the default TTL if this is set.
+                Regardless of this setting, workspaces can only stay on for the
+                max lifetime.
+              </span>
+            </Stack>
+          </Stack>
+        </Stack>
+      </FormSection>
+      {allowAdvancedScheduling && allowWorkspaceActions && (
+        <>
+          <FormSection
+            title="Failure Cleanup"
+            description="When enabled, Coder will attempt to stop workspaces that are in a failed state after a specified number of days."
+            alpha
+          >
+            <FormFields>
+              <FormControlLabel
+                control={
+                  <Switch
+                    name="failureCleanupEnabled"
+                    checked={form.values.failure_cleanup_enabled}
+                    onChange={handleToggleFailureCleanup}
+                  />
+                }
+                label="Enable Failure Cleanup"
+              />
+              <TextField
+                {...getFieldHelpers(
+                  "failure_ttl_ms",
+                  <FailureTTLHelperText ttl={form.values.failure_ttl_ms} />,
+                )}
+                disabled={isSubmitting || !form.values.failure_cleanup_enabled}
+                fullWidth
+                inputProps={{ min: 0, step: "any" }}
+                label="Time until cleanup (days)"
+                type="number"
+              />
+            </FormFields>
+          </FormSection>
+          <FormSection
+            title="Dormancy Threshold"
+            description="When enabled, Coder will mark workspaces as dormant after a period of time with no connections. Dormant workspaces can be auto-deleted (see below) or manually reviewed by the workspace owner or admins."
+            alpha
+          >
+            <FormFields>
+              <FormControlLabel
+                control={
+                  <Switch
+                    name="dormancyThreshold"
+                    checked={form.values.inactivity_cleanup_enabled}
+                    onChange={handleToggleInactivityCleanup}
+                  />
+                }
+                label="Enable Dormancy Threshold"
+              />
+              <TextField
+                {...getFieldHelpers(
+                  "time_til_dormant_ms",
+                  <DormancyTTLHelperText
+                    ttl={form.values.time_til_dormant_ms}
+                  />,
+                )}
+                disabled={
+                  isSubmitting || !form.values.inactivity_cleanup_enabled
+                }
+                fullWidth
+                inputProps={{ min: 0, step: "any" }}
+                label="Time until dormant (days)"
+                type="number"
+              />
+            </FormFields>
+          </FormSection>
+          <FormSection
+            title="Dormancy Auto-Deletion"
+            description="When enabled, Coder will permanently delete dormant workspaces after a period of time. Once a workspace is deleted it cannot be recovered."
+            alpha
+          >
+            <FormFields>
+              <FormControlLabel
+                control={
+                  <Switch
+                    name="dormancyAutoDeletion"
+                    checked={form.values.dormant_autodeletion_cleanup_enabled}
+                    onChange={handleToggleDormantAutoDeletion}
+                  />
+                }
+                label="Enable Dormancy Auto-Deletion"
+              />
+              <TextField
+                {...getFieldHelpers(
+                  "time_til_dormant_autodelete_ms",
+                  <DormancyAutoDeletionTTLHelperText
+                    ttl={form.values.time_til_dormant_autodelete_ms}
+                  />,
+                )}
+                disabled={
+                  isSubmitting ||
+                  !form.values.dormant_autodeletion_cleanup_enabled
+                }
+                fullWidth
+                inputProps={{ min: 0, step: "any" }}
+                label="Time until deletion (days)"
+                type="number"
+              />
+            </FormFields>
+          </FormSection>
+        </>
+      )}
+      {showScheduleDialog && (
+        <ScheduleDialog
+          onConfirm={() => {
+            submitValues();
+            setIsScheduleDialogOpen(false);
+            // These fields are request-scoped so they should be reset
+            // after every submission.
+            form
+              .setFieldValue("update_workspace_dormant_at", false)
+              .catch((error) => {
+                throw error;
+              });
+            form
+              .setFieldValue("update_workspace_last_used_at", false)
+              .catch((error) => {
+                throw error;
+              });
+          }}
+          inactiveWorkspacesToGoDormant={workspacesToDormancyNow.length}
+          inactiveWorkspacesToGoDormantInWeek={
+            workspacesToDormancyInWeek.length - workspacesToDormancyNow.length
+          }
+          dormantWorkspacesToBeDeleted={workspacesToBeDeletedNow.length}
+          dormantWorkspacesToBeDeletedInWeek={
+            workspacesToBeDeletedInWeek.length - workspacesToBeDeletedNow.length
+          }
+          open={isScheduleDialogOpen}
+          onClose={() => {
+            setIsScheduleDialogOpen(false);
+          }}
+          title="Workspace Scheduling"
+          updateDormantWorkspaces={(update: boolean) =>
+            form.setFieldValue("update_workspace_dormant_at", update)
+          }
+          updateInactiveWorkspaces={(update: boolean) =>
+            form.setFieldValue("update_workspace_last_used_at", update)
+          }
+          dormantValueChanged={
+            form.initialValues.time_til_dormant_ms !==
+            form.values.time_til_dormant_ms
+          }
+          deletionValueChanged={
+            form.initialValues.time_til_dormant_autodelete_ms !==
+            form.values.time_til_dormant_autodelete_ms
+          }
+        />
+      )}
+
+      <FormFooter
+        onCancel={onCancel}
+        isLoading={isSubmitting}
+        submitDisabled={!form.isValid || !form.dirty}
+      />
+    </HorizontalForm>
+  );
+};
+
+const styles = {
+  ttlFields: {
+    width: "100%",
+  },
+  dayButtons: {
+    borderRadius: "0px",
+  },
+};
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/InactivityDialog.stories.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/InactivityDialog.stories.tsx
deleted file mode 100644
index 645c7dfb84ddd..0000000000000
--- a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/InactivityDialog.stories.tsx
+++ /dev/null
@@ -1,19 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react"
-import { InactivityDialog } from "./InactivityDialog"
-
-const meta: Meta<typeof InactivityDialog> = {
-  title: "InactivityDialog",
-  component: InactivityDialog,
-}
-
-export default meta
-type Story = StoryObj<typeof InactivityDialog>
-
-export const OpenDialog: Story = {
-  args: {
-    submitValues: () => null,
-    isInactivityDialogOpen: true,
-    setIsInactivityDialogOpen: () => null,
-    workspacesToBeDeletedToday: 2,
-  },
-}
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/InactivityDialog.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/InactivityDialog.tsx
deleted file mode 100644
index 3f5ec252b08be..0000000000000
--- a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/InactivityDialog.tsx
+++ /dev/null
@@ -1,30 +0,0 @@
-import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog"
-
-export const InactivityDialog = ({
-  submitValues,
-  isInactivityDialogOpen,
-  setIsInactivityDialogOpen,
-  workspacesToBeDeletedToday,
-}: {
-  submitValues: () => void
-  isInactivityDialogOpen: boolean
-  setIsInactivityDialogOpen: (arg0: boolean) => void
-  workspacesToBeDeletedToday: number
-}) => {
-  return (
-    <ConfirmDialog
-      type="delete"
-      open={isInactivityDialogOpen}
-      onConfirm={() => {
-        submitValues()
-        setIsInactivityDialogOpen(false)
-      }}
-      onClose={() => setIsInactivityDialogOpen(false)}
-      title="Delete inactive workspaces"
-      confirmText="Delete Workspaces"
-      description={`There are ${
-        workspacesToBeDeletedToday ? workspacesToBeDeletedToday : ""
-      } workspaces that already match this filter and will be deleted upon form submission. Are you sure you want to proceed?`}
-    />
-  )
-}
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/TTLHelperText.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/TTLHelperText.tsx
deleted file mode 100644
index 0f7a55637bf96..0000000000000
--- a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/TTLHelperText.tsx
+++ /dev/null
@@ -1,19 +0,0 @@
-import { Maybe } from "components/Conditionals/Maybe"
-import { useTranslation } from "react-i18next"
-
-export const TTLHelperText = ({
-  ttl,
-  translationName,
-}: {
-  ttl?: number
-  translationName: string
-}) => {
-  const { t } = useTranslation("templateSettingsPage")
-  const count = typeof ttl !== "number" ? 0 : ttl
-  return (
-    // no helper text if ttl is negative - error will show once field is considered touched
-    <Maybe condition={count >= 0}>
-      <span>{t(translationName, { count })}</span>
-    </Maybe>
-  )
-}
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/TemplateScheduleForm.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/TemplateScheduleForm.tsx
deleted file mode 100644
index 598f701338f1e..0000000000000
--- a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/TemplateScheduleForm.tsx
+++ /dev/null
@@ -1,422 +0,0 @@
-import TextField from "@mui/material/TextField"
-import { Template, UpdateTemplateMeta } from "api/typesGenerated"
-import { FormikTouched, useFormik } from "formik"
-import { FC, ChangeEvent, useState } from "react"
-import { getFormHelpers } from "utils/formUtils"
-import { useTranslation } from "react-i18next"
-import {
-  FormSection,
-  HorizontalForm,
-  FormFooter,
-  FormFields,
-} from "components/Form/Form"
-import { Stack } from "components/Stack/Stack"
-import { makeStyles } from "@mui/styles"
-import Link from "@mui/material/Link"
-import Checkbox from "@mui/material/Checkbox"
-import FormControlLabel from "@mui/material/FormControlLabel"
-import Switch from "@mui/material/Switch"
-import { InactivityDialog } from "./InactivityDialog"
-import { useWorkspacesToBeDeleted } from "./useWorkspacesToBeDeleted"
-import { TemplateScheduleFormValues, getValidationSchema } from "./formHelpers"
-import { TTLHelperText } from "./TTLHelperText"
-import { docs } from "utils/docs"
-
-const MS_HOUR_CONVERSION = 3600000
-const MS_DAY_CONVERSION = 86400000
-const FAILURE_CLEANUP_DEFAULT = 7
-const INACTIVITY_CLEANUP_DEFAULT = 180
-const LOCKED_CLEANUP_DEFAULT = 30
-
-export interface TemplateScheduleForm {
-  template: Template
-  onSubmit: (data: UpdateTemplateMeta) => void
-  onCancel: () => void
-  isSubmitting: boolean
-  error?: unknown
-  allowAdvancedScheduling: boolean
-  allowWorkspaceActions: boolean
-  // Helpful to show field errors on Storybook
-  initialTouched?: FormikTouched<UpdateTemplateMeta>
-}
-
-export const TemplateScheduleForm: FC<TemplateScheduleForm> = ({
-  template,
-  onSubmit,
-  onCancel,
-  error,
-  allowAdvancedScheduling,
-  allowWorkspaceActions,
-  isSubmitting,
-  initialTouched,
-}) => {
-  const { t: commonT } = useTranslation("common")
-  const validationSchema = getValidationSchema()
-  const form = useFormik<TemplateScheduleFormValues>({
-    initialValues: {
-      // on display, convert from ms => hours
-      default_ttl_ms: template.default_ttl_ms / MS_HOUR_CONVERSION,
-      // the API ignores these values, but to avoid tripping up validation set
-      // it to zero if the user can't set the field.
-      max_ttl_ms: allowAdvancedScheduling
-        ? template.max_ttl_ms / MS_HOUR_CONVERSION
-        : 0,
-      failure_ttl_ms: allowAdvancedScheduling
-        ? template.failure_ttl_ms / MS_DAY_CONVERSION
-        : 0,
-      inactivity_ttl_ms: allowAdvancedScheduling
-        ? template.inactivity_ttl_ms / MS_DAY_CONVERSION
-        : 0,
-      locked_ttl_ms: allowAdvancedScheduling
-        ? template.locked_ttl_ms / MS_DAY_CONVERSION
-        : 0,
-
-      restart_requirement: {
-        days_of_week: template.restart_requirement.days_of_week,
-        weeks: template.restart_requirement.weeks,
-      },
-
-      allow_user_autostart: template.allow_user_autostart,
-      allow_user_autostop: template.allow_user_autostop,
-      failure_cleanup_enabled:
-        allowAdvancedScheduling && Boolean(template.failure_ttl_ms),
-      inactivity_cleanup_enabled:
-        allowAdvancedScheduling && Boolean(template.inactivity_ttl_ms),
-      locked_cleanup_enabled:
-        allowAdvancedScheduling && Boolean(template.locked_ttl_ms),
-    },
-    validationSchema,
-    onSubmit: () => {
-      if (
-        form.values.inactivity_cleanup_enabled &&
-        workspacesToBeDeletedToday &&
-        workspacesToBeDeletedToday.length > 0
-      ) {
-        setIsInactivityDialogOpen(true)
-      } else {
-        submitValues()
-      }
-    },
-    initialTouched,
-  })
-  const getFieldHelpers = getFormHelpers<TemplateScheduleFormValues>(
-    form,
-    error,
-  )
-  const { t } = useTranslation("templateSettingsPage")
-  const styles = useStyles()
-
-  const workspacesToBeDeletedToday = useWorkspacesToBeDeleted(form.values)
-
-  const [isInactivityDialogOpen, setIsInactivityDialogOpen] =
-    useState<boolean>(false)
-
-  const submitValues = () => {
-    // on submit, convert from hours => ms
-    onSubmit({
-      default_ttl_ms: form.values.default_ttl_ms
-        ? form.values.default_ttl_ms * MS_HOUR_CONVERSION
-        : undefined,
-      max_ttl_ms: form.values.max_ttl_ms
-        ? form.values.max_ttl_ms * MS_HOUR_CONVERSION
-        : undefined,
-      failure_ttl_ms: form.values.failure_ttl_ms
-        ? form.values.failure_ttl_ms * MS_DAY_CONVERSION
-        : undefined,
-      inactivity_ttl_ms: form.values.inactivity_ttl_ms
-        ? form.values.inactivity_ttl_ms * MS_DAY_CONVERSION
-        : undefined,
-      locked_ttl_ms: form.values.locked_ttl_ms
-        ? form.values.locked_ttl_ms * MS_DAY_CONVERSION
-        : undefined,
-
-      allow_user_autostart: form.values.allow_user_autostart,
-      allow_user_autostop: form.values.allow_user_autostop,
-    })
-  }
-
-  const handleToggleFailureCleanup = async (e: ChangeEvent) => {
-    form.handleChange(e)
-    if (!form.values.failure_cleanup_enabled) {
-      // fill failure_ttl_ms with defaults
-      await form.setValues({
-        ...form.values,
-        failure_cleanup_enabled: true,
-        failure_ttl_ms: FAILURE_CLEANUP_DEFAULT,
-      })
-    } else {
-      // clear failure_ttl_ms
-      await form.setValues({
-        ...form.values,
-        failure_cleanup_enabled: false,
-        failure_ttl_ms: 0,
-      })
-    }
-  }
-
-  const handleToggleInactivityCleanup = async (e: ChangeEvent) => {
-    form.handleChange(e)
-    if (!form.values.inactivity_cleanup_enabled) {
-      // fill inactivity_ttl_ms with defaults
-      await form.setValues({
-        ...form.values,
-        inactivity_cleanup_enabled: true,
-        inactivity_ttl_ms: INACTIVITY_CLEANUP_DEFAULT,
-      })
-    } else {
-      // clear inactivity_ttl_ms
-      await form.setValues({
-        ...form.values,
-        inactivity_cleanup_enabled: false,
-        inactivity_ttl_ms: 0,
-      })
-    }
-  }
-
-  const handleToggleLockedCleanup = async (e: ChangeEvent) => {
-    form.handleChange(e)
-    if (!form.values.locked_cleanup_enabled) {
-      // fill failure_ttl_ms with defaults
-      await form.setValues({
-        ...form.values,
-        locked_cleanup_enabled: true,
-        locked_ttl_ms: LOCKED_CLEANUP_DEFAULT,
-      })
-    } else {
-      // clear failure_ttl_ms
-      await form.setValues({
-        ...form.values,
-        locked_cleanup_enabled: false,
-        locked_ttl_ms: 0,
-      })
-    }
-  }
-
-  return (
-    <HorizontalForm
-      onSubmit={form.handleSubmit}
-      aria-label={t("formAriaLabel").toString()}
-    >
-      <FormSection
-        title={t("schedule.title").toString()}
-        description={t("schedule.description").toString()}
-      >
-        <Stack direction="row" className={styles.ttlFields}>
-          <TextField
-            {...getFieldHelpers(
-              "default_ttl_ms",
-              <TTLHelperText
-                translationName="defaultTTLHelperText"
-                ttl={form.values.default_ttl_ms}
-              />,
-            )}
-            disabled={isSubmitting}
-            fullWidth
-            inputProps={{ min: 0, step: 1 }}
-            label={t("defaultTtlLabel")}
-            type="number"
-          />
-
-          <TextField
-            {...getFieldHelpers(
-              "max_ttl_ms",
-              allowAdvancedScheduling ? (
-                <TTLHelperText
-                  translationName="maxTTLHelperText"
-                  ttl={form.values.max_ttl_ms}
-                />
-              ) : (
-                <>
-                  {commonT("licenseFieldTextHelper")}{" "}
-                  <Link href={docs("/enterprise")}>{commonT("learnMore")}</Link>
-                  .
-                </>
-              ),
-            )}
-            disabled={isSubmitting || !allowAdvancedScheduling}
-            fullWidth
-            inputProps={{ min: 0, step: 1 }}
-            label={t("maxTtlLabel")}
-            type="number"
-          />
-        </Stack>
-      </FormSection>
-
-      <FormSection
-        title="Allow users scheduling"
-        description="Allow users to set custom autostart and autostop scheduling options for workspaces created from this template."
-      >
-        <Stack direction="column">
-          <Stack direction="row" alignItems="center">
-            <Checkbox
-              id="allow_user_autostart"
-              size="small"
-              disabled={isSubmitting || !allowAdvancedScheduling}
-              onChange={async () => {
-                await form.setFieldValue(
-                  "allow_user_autostart",
-                  !form.values.allow_user_autostart,
-                )
-              }}
-              name="allow_user_autostart"
-              checked={form.values.allow_user_autostart}
-            />
-            <Stack spacing={0.5}>
-              <strong>
-                Allow users to automatically start workspaces on a schedule.
-              </strong>
-            </Stack>
-          </Stack>
-          <Stack direction="row" alignItems="center">
-            <Checkbox
-              id="allow-user-autostop"
-              size="small"
-              disabled={isSubmitting || !allowAdvancedScheduling}
-              onChange={async () => {
-                await form.setFieldValue(
-                  "allow_user_autostop",
-                  !form.values.allow_user_autostop,
-                )
-              }}
-              name="allow_user_autostop"
-              checked={form.values.allow_user_autostop}
-            />
-            <Stack spacing={0.5}>
-              <strong>
-                Allow users to customize autostop duration for workspaces.
-              </strong>
-              <span className={styles.optionDescription}>
-                Workspaces will always use the default TTL if this is set.
-                Regardless of this setting, workspaces can only stay on for the
-                max lifetime.
-              </span>
-            </Stack>
-          </Stack>
-        </Stack>
-      </FormSection>
-      {allowAdvancedScheduling && allowWorkspaceActions && (
-        <>
-          <FormSection
-            title="Failure Cleanup"
-            description="When enabled, Coder will attempt to stop workspaces that are in a failed state after a specified number of days."
-          >
-            <FormFields>
-              <FormControlLabel
-                control={
-                  <Switch
-                    name="failureCleanupEnabled"
-                    checked={form.values.failure_cleanup_enabled}
-                    onChange={handleToggleFailureCleanup}
-                  />
-                }
-                label="Enable Failure Cleanup"
-              />
-              <TextField
-                {...getFieldHelpers(
-                  "failure_ttl_ms",
-                  <TTLHelperText
-                    translationName="failureTTLHelperText"
-                    ttl={form.values.failure_ttl_ms}
-                  />,
-                )}
-                disabled={isSubmitting || !form.values.failure_cleanup_enabled}
-                fullWidth
-                inputProps={{ min: 0, step: "any" }}
-                label="Time until cleanup (days)"
-                type="number"
-                aria-label="Failure Cleanup"
-              />
-            </FormFields>
-          </FormSection>
-          <FormSection
-            title="Inactivity Cleanup"
-            description="When enabled, Coder will lock workspaces that have not been accessed after a specified number of days."
-          >
-            <FormFields>
-              <FormControlLabel
-                control={
-                  <Switch
-                    name="inactivityCleanupEnabled"
-                    checked={form.values.inactivity_cleanup_enabled}
-                    onChange={handleToggleInactivityCleanup}
-                  />
-                }
-                label="Enable Inactivity Cleanup"
-              />
-              <TextField
-                {...getFieldHelpers(
-                  "inactivity_ttl_ms",
-                  <TTLHelperText
-                    translationName="inactivityTTLHelperText"
-                    ttl={form.values.inactivity_ttl_ms}
-                  />,
-                )}
-                disabled={
-                  isSubmitting || !form.values.inactivity_cleanup_enabled
-                }
-                fullWidth
-                inputProps={{ min: 0, step: "any" }}
-                label="Time until cleanup (days)"
-                type="number"
-                aria-label="Inactivity Cleanup"
-              />
-            </FormFields>
-          </FormSection>
-          <FormSection
-            title="Locked Cleanup"
-            description="When enabled, Coder will permanently delete workspaces that have been locked for a specified number of days."
-          >
-            <FormFields>
-              <FormControlLabel
-                control={
-                  <Switch
-                    name="lockedCleanupEnabled"
-                    checked={form.values.locked_cleanup_enabled}
-                    onChange={handleToggleLockedCleanup}
-                  />
-                }
-                label="Enable Locked Cleanup"
-              />
-              <TextField
-                {...getFieldHelpers(
-                  "locked_ttl_ms",
-                  <TTLHelperText
-                    translationName="lockedTTLHelperText"
-                    ttl={form.values.locked_ttl_ms}
-                  />,
-                )}
-                disabled={isSubmitting || !form.values.locked_cleanup_enabled}
-                fullWidth
-                inputProps={{ min: 0, step: "any" }}
-                label="Time until cleanup (days)"
-                type="number"
-                aria-label="Locked Cleanup"
-              />
-            </FormFields>
-          </FormSection>
-        </>
-      )}
-      <InactivityDialog
-        submitValues={submitValues}
-        isInactivityDialogOpen={isInactivityDialogOpen}
-        setIsInactivityDialogOpen={setIsInactivityDialogOpen}
-        workspacesToBeDeletedToday={workspacesToBeDeletedToday?.length ?? 0}
-      />
-      <FormFooter
-        onCancel={onCancel}
-        isLoading={isSubmitting}
-        submitDisabled={!form.isValid || !form.dirty}
-      />
-    </HorizontalForm>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  ttlFields: {
-    width: "100%",
-  },
-  optionDescription: {
-    fontSize: 12,
-    color: theme.palette.text.secondary,
-  },
-}))
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/formHelpers.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/formHelpers.tsx
deleted file mode 100644
index ee1fe7b13d302..0000000000000
--- a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/formHelpers.tsx
+++ /dev/null
@@ -1,83 +0,0 @@
-import { UpdateTemplateMeta } from "api/typesGenerated"
-import * as Yup from "yup"
-import i18next from "i18next"
-
-export interface TemplateScheduleFormValues extends UpdateTemplateMeta {
-  failure_cleanup_enabled: boolean
-  inactivity_cleanup_enabled: boolean
-  locked_cleanup_enabled: boolean
-}
-
-const MAX_TTL_DAYS = 30
-
-export const getValidationSchema = (): Yup.AnyObjectSchema =>
-  Yup.object({
-    default_ttl_ms: Yup.number()
-      .integer()
-      .min(
-        0,
-        i18next
-          .t("defaultTTLMinError", { ns: "templateSettingsPage" })
-          .toString(),
-      )
-      .max(
-        24 * MAX_TTL_DAYS /* 30 days in hours */,
-        i18next
-          .t("defaultTTLMaxError", { ns: "templateSettingsPage" })
-          .toString(),
-      ),
-    max_ttl_ms: Yup.number()
-      .integer()
-      .min(
-        0,
-        i18next.t("maxTTLMinError", { ns: "templateSettingsPage" }).toString(),
-      )
-      .max(
-        24 * MAX_TTL_DAYS /* 30 days in hours */,
-        i18next.t("maxTTLMaxError", { ns: "templateSettingsPage" }).toString(),
-      ),
-    failure_ttl_ms: Yup.number()
-      .min(0, "Failure cleanup days must not be less than 0.")
-      .test(
-        "positive-if-enabled",
-        "Failure cleanup days must be greater than zero when enabled.",
-        function (value) {
-          const parent = this.parent as TemplateScheduleFormValues
-          if (parent.failure_cleanup_enabled) {
-            return Boolean(value)
-          } else {
-            return true
-          }
-        },
-      ),
-    inactivity_ttl_ms: Yup.number()
-      .min(0, "Inactivity cleanup days must not be less than 0.")
-      .test(
-        "positive-if-enabled",
-        "Inactivity cleanup days must be greater than zero when enabled.",
-        function (value) {
-          const parent = this.parent as TemplateScheduleFormValues
-          if (parent.inactivity_cleanup_enabled) {
-            return Boolean(value)
-          } else {
-            return true
-          }
-        },
-      ),
-    locked_ttl_ms: Yup.number()
-      .min(0, "Locked cleanup days must not be less than 0.")
-      .test(
-        "positive-if-enabled",
-        "Locked cleanup days must be greater than zero when enabled.",
-        function (value) {
-          const parent = this.parent as TemplateScheduleFormValues
-          if (parent.locked_cleanup_enabled) {
-            return Boolean(value)
-          } else {
-            return true
-          }
-        },
-      ),
-    allow_user_autostart: Yup.boolean(),
-    allow_user_autostop: Yup.boolean(),
-  })
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/useWorkspacesToBeDeleted.ts b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/useWorkspacesToBeDeleted.ts
deleted file mode 100644
index b65f0afb692c9..0000000000000
--- a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateScheduleForm/useWorkspacesToBeDeleted.ts
+++ /dev/null
@@ -1,33 +0,0 @@
-import { useQuery } from "@tanstack/react-query"
-import { getWorkspaces } from "api/api"
-import { compareAsc, add, endOfToday } from "date-fns"
-import { WorkspaceStatus, Workspace } from "api/typesGenerated"
-import { TemplateScheduleFormValues } from "./formHelpers"
-
-const inactiveStatuses: WorkspaceStatus[] = [
-  "stopped",
-  "canceled",
-  "failed",
-  "deleted",
-]
-
-export const useWorkspacesToBeDeleted = (
-  formValues: TemplateScheduleFormValues,
-) => {
-  const { data: workspacesData } = useQuery({
-    queryKey: ["workspaces"],
-    queryFn: () => getWorkspaces({}),
-    enabled: formValues.inactivity_cleanup_enabled,
-  })
-  return workspacesData?.workspaces?.filter((workspace: Workspace) => {
-    const isInactive = inactiveStatuses.includes(workspace.latest_build.status)
-
-    const proposedDeletion = add(new Date(workspace.last_used_at), {
-      days: formValues.inactivity_ttl_ms,
-    })
-
-    if (isInactive && compareAsc(proposedDeletion, endOfToday()) < 1) {
-      return workspace
-    }
-  })
-}
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePage.test.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePage.test.tsx
index 5b37f01f5b8ce..9c43ec8a9d631 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePage.test.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePage.test.tsx
@@ -1,268 +1,366 @@
-import { screen, waitFor } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
-import * as API from "api/api"
-import { UpdateTemplateMeta } from "api/typesGenerated"
-import { Language as FooterFormLanguage } from "components/FormFooter/FormFooter"
+import { screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import * as API from "api/api";
+import { Language as FooterFormLanguage } from "components/FormFooter/FormFooter";
 import {
   MockEntitlementsWithScheduling,
   MockTemplate,
-} from "testHelpers/entities"
+} from "testHelpers/entities";
 import {
   renderWithTemplateSettingsLayout,
   waitForLoaderToBeRemoved,
-} from "testHelpers/renderHelpers"
-import { getValidationSchema } from "./TemplateScheduleForm/formHelpers"
-import TemplateSchedulePage from "./TemplateSchedulePage"
-import i18next from "i18next"
+} from "testHelpers/renderHelpers";
+import { TemplateScheduleFormValues, getValidationSchema } from "./formHelpers";
+import TemplateSchedulePage from "./TemplateSchedulePage";
 
-const { t } = i18next
-
-const validFormValues = {
+const validFormValues: TemplateScheduleFormValues = {
   default_ttl_ms: 1,
   max_ttl_ms: 2,
   failure_ttl_ms: 7,
-  inactivity_ttl_ms: 180,
-  locked_ttl_ms: 30,
-}
+  time_til_dormant_ms: 180,
+  time_til_dormant_autodelete_ms: 30,
+  update_workspace_last_used_at: false,
+  update_workspace_dormant_at: false,
+  autostop_requirement_days_of_week: "off",
+  autostop_requirement_weeks: 1,
+  failure_cleanup_enabled: false,
+  inactivity_cleanup_enabled: false,
+  dormant_autodeletion_cleanup_enabled: false,
+  require_active_version: false,
+  autostart_requirement_days_of_week: [
+    "monday",
+    "tuesday",
+    "wednesday",
+    "thursday",
+    "friday",
+    "saturday",
+    "sunday",
+  ],
+};
 
 const renderTemplateSchedulePage = async () => {
   renderWithTemplateSettingsLayout(<TemplateSchedulePage />, {
     route: `/templates/${MockTemplate.name}/settings/schedule`,
     path: `/templates/:template/settings/schedule`,
-  })
-  await waitForLoaderToBeRemoved()
-}
+  });
+  await waitForLoaderToBeRemoved();
+};
+
+// Extracts all properties from TemplateScheduleFormValues that have a key that
+// ends in _ms, and makes those properties optional. Defined as mapped type to
+// ensure this stays in sync as TemplateScheduleFormValues changes
+type FillAndSubmitConfig = {
+  [Key in keyof TemplateScheduleFormValues as Key extends `${string}_ms`
+    ? Key
+    : never]?: TemplateScheduleFormValues[Key] | undefined;
+};
 
 const fillAndSubmitForm = async ({
   default_ttl_ms,
   max_ttl_ms,
   failure_ttl_ms,
-  inactivity_ttl_ms,
-  locked_ttl_ms,
-}: {
-  default_ttl_ms: number
-  max_ttl_ms: number
-  failure_ttl_ms: number
-  inactivity_ttl_ms: number
-  locked_ttl_ms: number
-}) => {
-  const user = userEvent.setup()
-  const defaultTtlLabel = t("defaultTtlLabel", { ns: "templateSettingsPage" })
-  const defaultTtlField = await screen.findByLabelText(defaultTtlLabel)
-  await user.clear(defaultTtlField)
-  await user.type(defaultTtlField, default_ttl_ms.toString())
-
-  const maxTtlLabel = t("maxTtlLabel", { ns: "templateSettingsPage" })
-  const maxTtlField = await screen.findByLabelText(maxTtlLabel)
-  await user.clear(maxTtlField)
-  await user.type(maxTtlField, max_ttl_ms.toString())
-
-  const failureTtlField = screen.getByRole("checkbox", {
-    name: /Failure Cleanup/i,
-  })
-  await user.type(failureTtlField, failure_ttl_ms.toString())
-
-  const inactivityTtlField = screen.getByRole("checkbox", {
-    name: /Inactivity Cleanup/i,
-  })
-  await user.type(inactivityTtlField, inactivity_ttl_ms.toString())
-
-  const lockedTtlField = screen.getByRole("checkbox", {
-    name: /Locked Cleanup/i,
-  })
-  await user.type(lockedTtlField, locked_ttl_ms.toString())
-
-  const submitButton = await screen.findByText(
-    FooterFormLanguage.defaultSubmitLabel,
-  )
-  await user.click(submitButton)
+  time_til_dormant_ms,
+  time_til_dormant_autodelete_ms,
+}: FillAndSubmitConfig) => {
+  const user = userEvent.setup();
+
+  if (default_ttl_ms) {
+    const defaultTtlField = await screen.findByLabelText(
+      "Default autostop (hours)",
+    );
+    await user.clear(defaultTtlField);
+    await user.type(defaultTtlField, default_ttl_ms.toString());
+  }
+
+  if (max_ttl_ms) {
+    const maxTtlField = await screen.findByLabelText("Max lifetime (hours)");
+
+    await user.clear(maxTtlField);
+    await user.type(maxTtlField, max_ttl_ms.toString());
+  }
+
+  if (failure_ttl_ms) {
+    const failureTtlField = screen.getByRole("checkbox", {
+      name: /Failure Cleanup/i,
+    });
+    await user.type(failureTtlField, failure_ttl_ms.toString());
+  }
+
+  if (time_til_dormant_ms) {
+    const inactivityTtlField = screen.getByRole("checkbox", {
+      name: /Dormancy Threshold/i,
+    });
+    await user.type(inactivityTtlField, time_til_dormant_ms.toString());
+  }
+
+  if (time_til_dormant_autodelete_ms) {
+    const dormancyAutoDeletionField = screen.getByRole("checkbox", {
+      name: /Dormancy Auto-Deletion/i,
+    });
+    await user.type(
+      dormancyAutoDeletionField,
+      time_til_dormant_autodelete_ms.toString(),
+    );
+  }
+
+  const submitButton = screen.getByRole("button", {
+    name: FooterFormLanguage.defaultSubmitLabel,
+  });
+
+  expect(submitButton).not.toBeDisabled();
+  await user.click(submitButton);
+
+  // User needs to confirm dormancy and auto-deletion fields.
+  const confirmButton = await screen.findByTestId("confirm-button");
+  await user.click(confirmButton);
+};
+
+// One problem with the waitFor function is that if no additional config options
+// are passed in, it will hang indefinitely as it keeps retrying an assertion.
+// Even if Jest runs out of time and kills the test, you won't get a good error
+// message. Adding options to force test to give up before test timeout
+function waitForWithCutoff(callback: () => void | Promise<void>) {
+  return waitFor(callback, {
+    // Defined to end 500ms before global cut-off time of 20s. Wanted to define
+    // this in terms of an exported constant from jest.config, but since Jest
+    // is CJS-based, that would've involved weird CJS-ESM interop issues
+    timeout: 19_500,
+  });
 }
 
 describe("TemplateSchedulePage", () => {
   beforeEach(() => {
     jest
       .spyOn(API, "getEntitlements")
-      .mockResolvedValue(MockEntitlementsWithScheduling)
+      .mockResolvedValue(MockEntitlementsWithScheduling);
 
     // remove when https://github.com/coder/coder/milestone/19 is completed.
-    jest.spyOn(API, "getExperiments").mockResolvedValue(["workspace_actions"])
-  })
+    jest.spyOn(API, "getExperiments").mockResolvedValue(["workspace_actions"]);
+  });
 
-  it("succeeds", async () => {
-    await renderTemplateSchedulePage()
+  it("Calls the API when user fills in and submits a form", async () => {
+    await renderTemplateSchedulePage();
     jest.spyOn(API, "updateTemplateMeta").mockResolvedValueOnce({
       ...MockTemplate,
       ...validFormValues,
-    })
-    await fillAndSubmitForm(validFormValues)
-    await waitFor(() => expect(API.updateTemplateMeta).toBeCalledTimes(1))
-  })
+    });
+
+    await fillAndSubmitForm(validFormValues);
+    await waitForWithCutoff(() =>
+      expect(API.updateTemplateMeta).toBeCalledTimes(1),
+    );
+  });
 
   test("default and max ttl is converted to and from hours", async () => {
-    await renderTemplateSchedulePage()
+    await renderTemplateSchedulePage();
 
     jest.spyOn(API, "updateTemplateMeta").mockResolvedValueOnce({
       ...MockTemplate,
       ...validFormValues,
-    })
+    });
 
-    await fillAndSubmitForm(validFormValues)
-    await waitFor(() => expect(API.updateTemplateMeta).toBeCalledTimes(1))
-    await waitFor(() =>
+    await fillAndSubmitForm(validFormValues);
+    await waitForWithCutoff(() =>
+      expect(API.updateTemplateMeta).toBeCalledTimes(1),
+    );
+
+    await waitForWithCutoff(() => {
       expect(API.updateTemplateMeta).toBeCalledWith(
         "test-template",
         expect.objectContaining({
-          default_ttl_ms: validFormValues.default_ttl_ms * 3600000,
-          max_ttl_ms: validFormValues.max_ttl_ms * 3600000,
+          default_ttl_ms: (validFormValues.default_ttl_ms || 0) * 3600000,
+          max_ttl_ms: (validFormValues.max_ttl_ms || 0) * 3600000,
         }),
-      ),
-    )
-  })
+      );
+    });
+  });
 
-  test("failure, inactivity, and locked ttl converted to and from days", async () => {
-    await renderTemplateSchedulePage()
+  test("failure, dormancy, and dormancy auto-deletion converted to and from days", async () => {
+    await renderTemplateSchedulePage();
 
     jest.spyOn(API, "updateTemplateMeta").mockResolvedValueOnce({
       ...MockTemplate,
       ...validFormValues,
-    })
+    });
+
+    await fillAndSubmitForm(validFormValues);
+    await waitForWithCutoff(() =>
+      expect(API.updateTemplateMeta).toBeCalledTimes(1),
+    );
 
-    await fillAndSubmitForm(validFormValues)
-    await waitFor(() => expect(API.updateTemplateMeta).toBeCalledTimes(1))
-    await waitFor(() =>
+    await waitForWithCutoff(() => {
       expect(API.updateTemplateMeta).toBeCalledWith(
         "test-template",
         expect.objectContaining({
-          failure_ttl_ms: validFormValues.failure_ttl_ms * 86400000,
-          inactivity_ttl_ms: validFormValues.inactivity_ttl_ms * 86400000,
-          locked_ttl_ms: validFormValues.locked_ttl_ms * 86400000,
+          failure_ttl_ms: (validFormValues.failure_ttl_ms || 0) * 86400000,
+          time_til_dormant_ms:
+            (validFormValues.time_til_dormant_ms || 0) * 86400000,
+          time_til_dormant_autodelete_ms:
+            (validFormValues.time_til_dormant_autodelete_ms || 0) * 86400000,
         }),
-      ),
-    )
-  })
+      );
+    });
+  });
 
   it("allows a default ttl of 7 days", () => {
-    const values: UpdateTemplateMeta = {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
       default_ttl_ms: 24 * 7,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
-    expect(validate).not.toThrowError()
-  })
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).not.toThrowError();
+  });
 
   it("allows default ttl of 0", () => {
-    const values: UpdateTemplateMeta = {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
       default_ttl_ms: 0,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
-    expect(validate).not.toThrowError()
-  })
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).not.toThrowError();
+  });
 
   it("allows a default ttl of 30 days", () => {
-    const values: UpdateTemplateMeta = {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
       default_ttl_ms: 24 * 30,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
-    expect(validate).not.toThrowError()
-  })
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).not.toThrowError();
+  });
 
   it("disallows a default ttl of 30 days + 1 hour", () => {
-    const values: UpdateTemplateMeta = {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
       default_ttl_ms: 24 * 30 + 1,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
+    };
+    const validate = () => getValidationSchema().validateSync(values);
     expect(validate).toThrowError(
-      t("defaultTTLMaxError", { ns: "templateSettingsPage" }).toString(),
-    )
-  })
+      "Please enter a limit that is less than or equal to 720 hours (30 days).",
+    );
+  });
 
   it("allows a failure ttl of 7 days", () => {
-    const values: UpdateTemplateMeta = {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
       failure_ttl_ms: 86400000 * 7,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
-    expect(validate).not.toThrowError()
-  })
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).not.toThrowError();
+  });
 
   it("allows failure ttl of 0", () => {
-    const values: UpdateTemplateMeta = {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
       failure_ttl_ms: 0,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
-    expect(validate).not.toThrowError()
-  })
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).not.toThrowError();
+  });
 
   it("disallows a negative failure ttl", () => {
-    const values: UpdateTemplateMeta = {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
       failure_ttl_ms: -1,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
+    };
+    const validate = () => getValidationSchema().validateSync(values);
     expect(validate).toThrowError(
       "Failure cleanup days must not be less than 0.",
-    )
-  })
+    );
+  });
 
   it("allows an inactivity ttl of 7 days", () => {
-    const values: UpdateTemplateMeta = {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
-      inactivity_ttl_ms: 86400000 * 7,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
-    expect(validate).not.toThrowError()
-  })
+      time_til_dormant_ms: 86400000 * 7,
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).not.toThrowError();
+  });
 
   it("allows an inactivity ttl of 0", () => {
-    const values: UpdateTemplateMeta = {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
-      inactivity_ttl_ms: 0,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
-    expect(validate).not.toThrowError()
-  })
+      time_til_dormant_ms: 0,
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).not.toThrowError();
+  });
 
   it("disallows a negative inactivity ttl", () => {
-    const values: UpdateTemplateMeta = {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
-      inactivity_ttl_ms: -1,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
+      time_til_dormant_ms: -1,
+    };
+    const validate = () => getValidationSchema().validateSync(values);
     expect(validate).toThrowError(
-      "Inactivity cleanup days must not be less than 0.",
-    )
-  })
+      "Dormancy threshold days must not be less than 0.",
+    );
+  });
 
-  it("allows a locked ttl of 7 days", () => {
-    const values: UpdateTemplateMeta = {
+  it("allows a dormancy ttl of 7 days", () => {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
-      locked_ttl_ms: 86400000 * 7,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
-    expect(validate).not.toThrowError()
-  })
-
-  it("allows a locked ttl of 0", () => {
-    const values: UpdateTemplateMeta = {
+      time_til_dormant_autodelete_ms: 86400000 * 7,
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).not.toThrowError();
+  });
+
+  it("allows a dormancy ttl of 0", () => {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
-      locked_ttl_ms: 0,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
-    expect(validate).not.toThrowError()
-  })
+      time_til_dormant_autodelete_ms: 0,
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).not.toThrowError();
+  });
 
   it("disallows a negative inactivity ttl", () => {
-    const values: UpdateTemplateMeta = {
+    const values: TemplateScheduleFormValues = {
       ...validFormValues,
-      locked_ttl_ms: -1,
-    }
-    const validate = () => getValidationSchema().validateSync(values)
+      time_til_dormant_autodelete_ms: -1,
+    };
+    const validate = () => getValidationSchema().validateSync(values);
     expect(validate).toThrowError(
-      "Locked cleanup days must not be less than 0.",
-    )
-  })
-})
+      "Dormancy auto-deletion days must not be less than 0.",
+    );
+  });
+
+  it("allows an autostop requirement weeks of 1", () => {
+    const values: TemplateScheduleFormValues = {
+      ...validFormValues,
+      autostop_requirement_days_of_week: "saturday",
+      autostop_requirement_weeks: 1,
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).not.toThrowError();
+  });
+
+  it("allows a autostop requirement weeks of 16", () => {
+    const values: TemplateScheduleFormValues = {
+      ...validFormValues,
+      autostop_requirement_weeks: 16,
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).not.toThrowError();
+  });
+
+  it("disallows a autostop requirement weeks of 0", () => {
+    const values: TemplateScheduleFormValues = {
+      ...validFormValues,
+      autostop_requirement_weeks: 0,
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).toThrowError();
+  });
+
+  it("disallows a autostop requirement weeks of 17", () => {
+    const values: TemplateScheduleFormValues = {
+      ...validFormValues,
+      autostop_requirement_weeks: 17,
+    };
+    const validate = () => getValidationSchema().validateSync(values);
+    expect(validate).toThrowError();
+  });
+});
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePage.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePage.tsx
index 2145099a6713c..ce8db54909ed9 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePage.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePage.tsx
@@ -1,27 +1,32 @@
-import { useMutation } from "@tanstack/react-query"
-import { updateTemplateMeta } from "api/api"
-import { UpdateTemplateMeta } from "api/typesGenerated"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import { displaySuccess } from "components/GlobalSnackbar/utils"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useNavigate, useParams } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import { useTemplateSettingsContext } from "../TemplateSettingsLayout"
-import { TemplateSchedulePageView } from "./TemplateSchedulePageView"
-import { useLocalStorage } from "hooks"
+import { useMutation, useQueryClient } from "react-query";
+import { updateTemplateMeta } from "api/api";
+import { UpdateTemplateMeta } from "api/typesGenerated";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { displaySuccess } from "components/GlobalSnackbar/utils";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { useNavigate, useParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import { useTemplateSettings } from "../TemplateSettingsLayout";
+import { TemplateSchedulePageView } from "./TemplateSchedulePageView";
+import { useLocalStorage, useOrganizationId } from "hooks";
+import { templateByNameKey } from "api/queries/templates";
 
 const TemplateSchedulePage: FC = () => {
-  const { template: templateName } = useParams() as { template: string }
-  const navigate = useNavigate()
-  const { template } = useTemplateSettingsContext()
-  const { entitlements, experiments } = useDashboard()
+  const { template: templateName } = useParams() as { template: string };
+  const navigate = useNavigate();
+  const queryClient = useQueryClient();
+  const orgId = useOrganizationId();
+  const { template } = useTemplateSettings();
+  const { entitlements, experiments } = useDashboard();
   const allowAdvancedScheduling =
-    entitlements.features["advanced_template_scheduling"].enabled
+    entitlements.features["advanced_template_scheduling"].enabled;
   // This check can be removed when https://github.com/coder/coder/milestone/19
   // is merged up
-  const allowWorkspaceActions = experiments.includes("workspace_actions")
-  const { clearLocal } = useLocalStorage()
+  const allowWorkspaceActions = experiments.includes("workspace_actions");
+  const allowAutostopRequirement =
+    entitlements.features["template_autostop_requirement"].enabled;
+  const { clearLocal } = useLocalStorage();
 
   const {
     mutate: updateTemplate,
@@ -30,14 +35,17 @@ const TemplateSchedulePage: FC = () => {
   } = useMutation(
     (data: UpdateTemplateMeta) => updateTemplateMeta(template.id, data),
     {
-      onSuccess: () => {
-        displaySuccess("Template updated successfully")
+      onSuccess: async () => {
+        await queryClient.invalidateQueries(
+          templateByNameKey(orgId, templateName),
+        );
+        displaySuccess("Template updated successfully");
         // clear browser storage of workspaces impending deletion
-        clearLocal("dismissedWorkspaceList") // workspaces page
-        clearLocal("dismissedWorkspace") // workspace page
+        clearLocal("dismissedWorkspaceList"); // workspaces page
+        clearLocal("dismissedWorkspace"); // workspace page
       },
     },
-  )
+  );
 
   return (
     <>
@@ -47,21 +55,22 @@ const TemplateSchedulePage: FC = () => {
       <TemplateSchedulePageView
         allowAdvancedScheduling={allowAdvancedScheduling}
         allowWorkspaceActions={allowWorkspaceActions}
+        allowAutostopRequirement={allowAutostopRequirement}
         isSubmitting={isSubmitting}
         template={template}
         submitError={submitError}
         onCancel={() => {
-          navigate(`/templates/${templateName}`)
+          navigate(`/templates/${templateName}`);
         }}
         onSubmit={(templateScheduleSettings) => {
           updateTemplate({
             ...template,
             ...templateScheduleSettings,
-          })
+          });
         }}
       />
     </>
-  )
-}
+  );
+};
 
-export default TemplateSchedulePage
+export default TemplateSchedulePage;
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePageView.stories.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePageView.stories.tsx
index 130d32fafc64e..b4b193468ec20 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePageView.stories.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePageView.stories.tsx
@@ -1,8 +1,8 @@
-import { action } from "@storybook/addon-actions"
-import { Meta, StoryObj } from "@storybook/react"
-import { MockTemplate } from "testHelpers/entities"
-import { TemplateSchedulePageView } from "./TemplateSchedulePageView"
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
+import { action } from "@storybook/addon-actions";
+import { Meta, StoryObj } from "@storybook/react";
+import { MockTemplate } from "testHelpers/entities";
+import { TemplateSchedulePageView } from "./TemplateSchedulePageView";
+import { QueryClient, QueryClientProvider } from "react-query";
 
 const queryClient = new QueryClient({
   defaultOptions: {
@@ -13,10 +13,10 @@ const queryClient = new QueryClient({
       networkMode: "offlineFirst",
     },
   },
-})
+});
 
 const meta: Meta<typeof TemplateSchedulePageView> = {
-  title: "pages/TemplateSchedulePageView",
+  title: "pages/TemplateSettingsPage/TemplateSchedulePageView",
   component: TemplateSchedulePageView,
   decorators: [
     (Story) => (
@@ -25,9 +25,9 @@ const meta: Meta<typeof TemplateSchedulePageView> = {
       </QueryClientProvider>
     ),
   ],
-}
-export default meta
-type Story = StoryObj<typeof TemplateSchedulePageView>
+};
+export default meta;
+type Story = StoryObj<typeof TemplateSchedulePageView>;
 
 const defaultArgs = {
   allowAdvancedScheduling: true,
@@ -35,12 +35,12 @@ const defaultArgs = {
   template: MockTemplate,
   onSubmit: action("onSubmit"),
   onCancel: action("cancel"),
-}
+};
 
 export const Example: Story = {
   args: { ...defaultArgs },
-}
+};
 
 export const CantSetMaxTTL: Story = {
   args: { ...defaultArgs, allowAdvancedScheduling: false },
-}
+};
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePageView.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePageView.tsx
index 89e5a896074cb..c75dab222ad78 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePageView.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/TemplateSchedulePageView.tsx
@@ -1,18 +1,20 @@
-import { Template, UpdateTemplateMeta } from "api/typesGenerated"
-import { ComponentProps, FC } from "react"
-import { TemplateScheduleForm } from "./TemplateScheduleForm/TemplateScheduleForm"
-import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader"
-import { makeStyles } from "@mui/styles"
+import { type ComponentProps, type FC } from "react";
+import type { Template, UpdateTemplateMeta } from "api/typesGenerated";
+import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader";
+import { TemplateScheduleForm } from "./TemplateScheduleForm";
 
 export interface TemplateSchedulePageViewProps {
-  template: Template
-  onSubmit: (data: UpdateTemplateMeta) => void
-  onCancel: () => void
-  isSubmitting: boolean
-  submitError?: unknown
-  initialTouched?: ComponentProps<typeof TemplateScheduleForm>["initialTouched"]
-  allowAdvancedScheduling: boolean
-  allowWorkspaceActions: boolean
+  template: Template;
+  onSubmit: (data: UpdateTemplateMeta) => void;
+  onCancel: () => void;
+  isSubmitting: boolean;
+  submitError?: unknown;
+  initialTouched?: ComponentProps<
+    typeof TemplateScheduleForm
+  >["initialTouched"];
+  allowAdvancedScheduling: boolean;
+  allowWorkspaceActions: boolean;
+  allowAutostopRequirement: boolean;
 }
 
 export const TemplateSchedulePageView: FC<TemplateSchedulePageViewProps> = ({
@@ -22,20 +24,20 @@ export const TemplateSchedulePageView: FC<TemplateSchedulePageViewProps> = ({
   isSubmitting,
   allowAdvancedScheduling,
   allowWorkspaceActions,
+  allowAutostopRequirement,
   submitError,
   initialTouched,
 }) => {
-  const styles = useStyles()
-
   return (
     <>
-      <PageHeader className={styles.pageHeader}>
+      <PageHeader css={{ paddingTop: 0 }}>
         <PageHeaderTitle>Template schedule</PageHeaderTitle>
       </PageHeader>
 
       <TemplateScheduleForm
         allowAdvancedScheduling={allowAdvancedScheduling}
         allowWorkspaceActions={allowWorkspaceActions}
+        allowAutostopRequirement={allowAutostopRequirement}
         initialTouched={initialTouched}
         isSubmitting={isSubmitting}
         template={template}
@@ -44,11 +46,5 @@ export const TemplateSchedulePageView: FC<TemplateSchedulePageViewProps> = ({
         error={submitError}
       />
     </>
-  )
-}
-
-const useStyles = makeStyles(() => ({
-  pageHeader: {
-    paddingTop: 0,
-  },
-}))
+  );
+};
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/formHelpers.tsx b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/formHelpers.tsx
new file mode 100644
index 0000000000000..9fc299fba1fe1
--- /dev/null
+++ b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/formHelpers.tsx
@@ -0,0 +1,87 @@
+import { UpdateTemplateMeta } from "api/typesGenerated";
+import {
+  TemplateAutostartRequirementDaysValue,
+  TemplateAutostopRequirementDaysValue,
+} from "utils/schedule";
+import * as Yup from "yup";
+
+export interface TemplateScheduleFormValues
+  extends Omit<
+    UpdateTemplateMeta,
+    "autostop_requirement" | "autostart_requirement"
+  > {
+  autostart_requirement_days_of_week: TemplateAutostartRequirementDaysValue[];
+  autostop_requirement_days_of_week: TemplateAutostopRequirementDaysValue;
+  autostop_requirement_weeks: number;
+  failure_cleanup_enabled: boolean;
+  inactivity_cleanup_enabled: boolean;
+  dormant_autodeletion_cleanup_enabled: boolean;
+}
+
+const MAX_TTL_DAYS = 30;
+
+export const getValidationSchema = (): Yup.AnyObjectSchema =>
+  Yup.object({
+    default_ttl_ms: Yup.number()
+      .integer()
+      .min(0, "Default time until autostop must not be less than 0.")
+      .max(
+        24 * MAX_TTL_DAYS /* 30 days in hours */,
+        "Please enter a limit that is less than or equal to 720 hours (30 days).",
+      ),
+    max_ttl_ms: Yup.number()
+      .integer()
+      .min(0, "Maximum time until autostop must not be less than 0.")
+      .max(
+        24 * MAX_TTL_DAYS /* 30 days in hours */,
+        "Please enter a limit that is less than or equal to 720 hours (30 days).",
+      ),
+    failure_ttl_ms: Yup.number()
+      .min(0, "Failure cleanup days must not be less than 0.")
+      .test(
+        "positive-if-enabled",
+        "Failure cleanup days must be greater than zero when enabled.",
+        function (value) {
+          const parent = this.parent as TemplateScheduleFormValues;
+          if (parent.failure_cleanup_enabled) {
+            return Boolean(value);
+          } else {
+            return true;
+          }
+        },
+      ),
+    time_til_dormant_ms: Yup.number()
+      .min(0, "Dormancy threshold days must not be less than 0.")
+      .test(
+        "positive-if-enabled",
+        "Dormancy threshold days must be greater than zero when enabled.",
+        function (value) {
+          const parent = this.parent as TemplateScheduleFormValues;
+          if (parent.inactivity_cleanup_enabled) {
+            return Boolean(value);
+          } else {
+            return true;
+          }
+        },
+      ),
+    time_til_dormant_autodelete_ms: Yup.number()
+      .min(0, "Dormancy auto-deletion days must not be less than 0.")
+      .test(
+        "positive-if-enabled",
+        "Dormancy auto-deletion days must be greater than zero when enabled.",
+        function (value) {
+          const parent = this.parent as TemplateScheduleFormValues;
+          if (parent.dormant_autodeletion_cleanup_enabled) {
+            return Boolean(value);
+          } else {
+            return true;
+          }
+        },
+      ),
+    allow_user_autostart: Yup.boolean(),
+    allow_user_autostop: Yup.boolean(),
+
+    autostop_requirement_days_of_week: Yup.string().required(),
+    autostart_requirement_days_of_week: Yup.array().of(Yup.string()).required(),
+    autostop_requirement_weeks: Yup.number().required().min(1).max(16),
+  });
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/useWorkspacesToBeDeleted.ts b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/useWorkspacesToBeDeleted.ts
new file mode 100644
index 0000000000000..7609621fd88fc
--- /dev/null
+++ b/site/src/pages/TemplateSettingsPage/TemplateSchedulePage/useWorkspacesToBeDeleted.ts
@@ -0,0 +1,63 @@
+import { compareAsc } from "date-fns";
+import { Workspace, Template } from "api/typesGenerated";
+import { TemplateScheduleFormValues } from "./formHelpers";
+import { useWorkspacesData } from "pages/WorkspacesPage/data";
+
+export const useWorkspacesToGoDormant = (
+  template: Template,
+  formValues: TemplateScheduleFormValues,
+  fromDate: Date,
+) => {
+  const { data } = useWorkspacesData({
+    page: 0,
+    limit: 0,
+    query: "template:" + template.name,
+  });
+
+  return data?.workspaces?.filter((workspace: Workspace) => {
+    if (!formValues.time_til_dormant_ms) {
+      return;
+    }
+
+    if (workspace.dormant_at) {
+      return;
+    }
+
+    const proposedLocking = new Date(
+      new Date(workspace.last_used_at).getTime() +
+        formValues.time_til_dormant_ms * DayInMS,
+    );
+
+    if (compareAsc(proposedLocking, fromDate) < 1) {
+      return workspace;
+    }
+  });
+};
+
+const DayInMS = 86400000;
+
+export const useWorkspacesToBeDeleted = (
+  template: Template,
+  formValues: TemplateScheduleFormValues,
+  fromDate: Date,
+) => {
+  const { data } = useWorkspacesData({
+    page: 0,
+    limit: 0,
+    query: "template:" + template.name + " is-dormant:true",
+  });
+  return data?.workspaces?.filter((workspace: Workspace) => {
+    if (!workspace.dormant_at || !formValues.time_til_dormant_autodelete_ms) {
+      return false;
+    }
+
+    const proposedLocking = new Date(
+      new Date(workspace.dormant_at).getTime() +
+        formValues.time_til_dormant_autodelete_ms * DayInMS,
+    );
+
+    if (compareAsc(proposedLocking, fromDate) < 1) {
+      return workspace;
+    }
+  });
+};
diff --git a/site/src/pages/TemplateSettingsPage/TemplateSettingsLayout.tsx b/site/src/pages/TemplateSettingsPage/TemplateSettingsLayout.tsx
index e816226142be2..1396789e15672 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateSettingsLayout.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateSettingsLayout.tsx
@@ -1,96 +1,86 @@
-import { makeStyles } from "@mui/styles"
-import { Sidebar } from "./Sidebar"
-import { Stack } from "components/Stack/Stack"
-import { createContext, FC, Suspense, useContext } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "../../utils/page"
-import { Loader } from "components/Loader/Loader"
-import { Outlet, useParams } from "react-router-dom"
-import { Margins } from "components/Margins/Margins"
-import { checkAuthorization, getTemplateByName } from "api/api"
-import { useQuery } from "@tanstack/react-query"
-import { useOrganizationId } from "hooks/useOrganizationId"
+import { makeStyles } from "@mui/styles";
+import { Sidebar } from "./Sidebar";
+import { Stack } from "components/Stack/Stack";
+import { createContext, FC, Suspense, useContext } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { Loader } from "components/Loader/Loader";
+import { Outlet, useParams } from "react-router-dom";
+import { Margins } from "components/Margins/Margins";
+import { useQuery } from "react-query";
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { templateByName } from "api/queries/templates";
+import { type AuthorizationResponse, type Template } from "api/typesGenerated";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { checkAuthorization } from "api/queries/authCheck";
 
-const templatePermissions = (templateId: string) =>
-  ({
-    canUpdateTemplate: {
-      object: {
-        resource_type: "template",
-        resource_id: templateId,
-      },
-      action: "update",
-    },
-  }) as const
-
-const fetchTemplateSettings = async (orgId: string, name: string) => {
-  const template = await getTemplateByName(orgId, name)
-  const permissions = await checkAuthorization({
-    checks: templatePermissions(template.id),
-  })
+const TemplateSettings = createContext<
+  { template: Template; permissions: AuthorizationResponse } | undefined
+>(undefined);
 
-  return {
-    template,
-    permissions,
+export function useTemplateSettings() {
+  const value = useContext(TemplateSettings);
+  if (!value) {
+    throw new Error("This hook can only be used from a template settings page");
   }
-}
 
-export const getTemplateQuery = (name: string) => ["template", name, "settings"]
-
-const useTemplate = (orgId: string, name: string) => {
-  return useQuery({
-    queryKey: getTemplateQuery(name),
-    queryFn: () => fetchTemplateSettings(orgId, name),
-    keepPreviousData: true,
-  })
+  return value;
 }
 
-const TemplateSettingsContext = createContext<
-  Awaited<ReturnType<typeof fetchTemplateSettings>> | undefined
->(undefined)
-
-export const useTemplateSettingsContext = () => {
-  const context = useContext(TemplateSettingsContext)
+export const TemplateSettingsLayout: FC = () => {
+  const styles = useStyles();
+  const orgId = useOrganizationId();
+  const { template: templateName } = useParams() as { template: string };
+  const templateQuery = useQuery(templateByName(orgId, templateName));
+  const permissionsQuery = useQuery({
+    ...checkAuthorization({
+      checks: {
+        canUpdateTemplate: {
+          object: {
+            resource_type: "template",
+            resource_id: templateQuery.data?.id ?? "",
+          },
+          action: "update",
+        },
+      },
+    }),
+    enabled: templateQuery.isSuccess,
+  });
 
-  if (!context) {
-    throw new Error(
-      "useTemplateSettingsContext must be used within a TemplateSettingsContext.Provider",
-    )
+  if (templateQuery.isLoading || permissionsQuery.isLoading) {
+    return <Loader />;
   }
 
-  return context
-}
-
-export const TemplateSettingsLayout: FC = () => {
-  const styles = useStyles()
-  const orgId = useOrganizationId()
-  const { template: templateName } = useParams() as { template: string }
-  const { data: settings } = useTemplate(orgId, templateName)
-
   return (
     <>
       <Helmet>
         <title>{pageTitle([templateName, "Settings"])}</title>
       </Helmet>
 
-      {settings ? (
-        <TemplateSettingsContext.Provider value={settings}>
-          <Margins>
-            <Stack className={styles.wrapper} direction="row" spacing={10}>
-              <Sidebar template={settings.template} />
+      <Margins>
+        <Stack className={styles.wrapper} direction="row" spacing={10}>
+          {templateQuery.isError || permissionsQuery.isError ? (
+            <ErrorAlert error={templateQuery.error} />
+          ) : (
+            <TemplateSettings.Provider
+              value={{
+                template: templateQuery.data,
+                permissions: permissionsQuery.data,
+              }}
+            >
+              <Sidebar template={templateQuery.data} />
               <Suspense fallback={<Loader />}>
                 <main className={styles.content}>
                   <Outlet />
                 </main>
               </Suspense>
-            </Stack>
-          </Margins>
-        </TemplateSettingsContext.Provider>
-      ) : (
-        <Loader />
-      )}
+            </TemplateSettings.Provider>
+          )}
+        </Stack>
+      </Margins>
     </>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   wrapper: {
@@ -100,4 +90,4 @@ const useStyles = makeStyles((theme) => ({
   content: {
     width: "100%",
   },
-}))
+}));
diff --git a/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariableField.tsx b/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariableField.tsx
new file mode 100644
index 0000000000000..05f4efabf2b64
--- /dev/null
+++ b/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariableField.tsx
@@ -0,0 +1,85 @@
+import FormControlLabel from "@mui/material/FormControlLabel";
+import Radio from "@mui/material/Radio";
+import RadioGroup from "@mui/material/RadioGroup";
+import TextField from "@mui/material/TextField";
+import { TemplateVersionVariable } from "api/typesGenerated";
+import { FC, useState } from "react";
+
+export const SensitiveVariableHelperText = () => {
+  return (
+    <span>
+      This variable is sensitive. The previous value will be used if empty.
+    </span>
+  );
+};
+
+export interface TemplateVariableFieldProps {
+  templateVersionVariable: TemplateVersionVariable;
+  initialValue: string;
+  disabled: boolean;
+  onChange: (value: string) => void;
+}
+
+export const TemplateVariableField: FC<TemplateVariableFieldProps> = ({
+  templateVersionVariable,
+  initialValue,
+  disabled,
+  onChange,
+  ...props
+}) => {
+  const [variableValue, setVariableValue] = useState(initialValue);
+  if (isBoolean(templateVersionVariable)) {
+    return (
+      <RadioGroup
+        defaultValue={variableValue}
+        onChange={(event) => {
+          onChange(event.target.value);
+        }}
+      >
+        <FormControlLabel
+          disabled={disabled}
+          value="true"
+          control={<Radio size="small" />}
+          label="True"
+        />
+        <FormControlLabel
+          disabled={disabled}
+          value="false"
+          control={<Radio size="small" />}
+          label="False"
+        />
+      </RadioGroup>
+    );
+  }
+
+  return (
+    <TextField
+      {...props}
+      type={
+        templateVersionVariable.type === "number"
+          ? "number"
+          : templateVersionVariable.sensitive
+          ? "password"
+          : "string"
+      }
+      disabled={disabled}
+      autoFocus
+      fullWidth
+      label={templateVersionVariable.name}
+      value={variableValue}
+      placeholder={
+        templateVersionVariable.sensitive
+          ? ""
+          : templateVersionVariable.default_value
+      }
+      onChange={(event) => {
+        setVariableValue(event.target.value);
+        onChange(event.target.value);
+      }}
+    />
+  );
+};
+
+const isBoolean = (variable: TemplateVersionVariable) => {
+  return variable.type === "bool";
+};
diff --git a/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesForm.tsx b/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesForm.tsx
index 06c821e43977f..8746559169599 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesForm.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesForm.tsx
@@ -3,32 +3,31 @@ import {
   TemplateVersion,
   TemplateVersionVariable,
   VariableValue,
-} from "api/typesGenerated"
-import { FormikContextType, FormikTouched, useFormik } from "formik"
-import { FC } from "react"
-import { getFormHelpers } from "utils/formUtils"
-import * as Yup from "yup"
-import { useTranslation } from "react-i18next"
+} from "api/typesGenerated";
+import { FormikContextType, FormikTouched, useFormik } from "formik";
+import { FC } from "react";
+import { getFormHelpers } from "utils/formUtils";
+import * as Yup from "yup";
 import {
   FormFields,
   FormSection,
   HorizontalForm,
   FormFooter,
-} from "components/Form/Form"
+} from "components/Form/Form";
 import {
   SensitiveVariableHelperText,
   TemplateVariableField,
-} from "components/TemplateVariableField/TemplateVariableField"
+} from "./TemplateVariableField";
 
 export interface TemplateVariablesForm {
-  templateVersion: TemplateVersion
-  templateVariables: TemplateVersionVariable[]
-  onSubmit: (data: CreateTemplateVersionRequest) => void
-  onCancel: () => void
-  isSubmitting: boolean
-  error?: unknown
+  templateVersion: TemplateVersion;
+  templateVariables: TemplateVersionVariable[];
+  onSubmit: (data: CreateTemplateVersionRequest) => void;
+  onCancel: () => void;
+  isSubmitting: boolean;
+  error?: unknown;
   // Helpful to show field errors on Storybook
-  initialTouched?: FormikTouched<CreateTemplateVersionRequest>
+  initialTouched?: FormikTouched<CreateTemplateVersionRequest>;
 }
 export const TemplateVariablesForm: FC<TemplateVariablesForm> = ({
   templateVersion,
@@ -40,7 +39,7 @@ export const TemplateVariablesForm: FC<TemplateVariablesForm> = ({
   initialTouched,
 }) => {
   const initialUserVariableValues =
-    selectInitialUserVariableValues(templateVariables)
+    selectInitialUserVariableValues(templateVariables);
   const form: FormikContextType<CreateTemplateVersionRequest> =
     useFormik<CreateTemplateVersionRequest>({
       initialValues: {
@@ -59,29 +58,28 @@ export const TemplateVariablesForm: FC<TemplateVariablesForm> = ({
       }),
       onSubmit,
       initialTouched,
-    })
+    });
   const getFieldHelpers = getFormHelpers<CreateTemplateVersionRequest>(
     form,
     error,
-  )
-  const { t } = useTranslation("templateVariablesPage")
+  );
 
   return (
     <HorizontalForm
       onSubmit={form.handleSubmit}
-      aria-label={t("formAriaLabel").toString()}
+      aria-label="Template variables"
     >
       {templateVariables.map((templateVariable, index) => {
-        let fieldHelpers
+        let fieldHelpers;
         if (templateVariable.sensitive) {
           fieldHelpers = getFieldHelpers(
             "user_variable_values[" + index + "].value",
             <SensitiveVariableHelperText />,
-          )
+          );
         } else {
           fieldHelpers = getFieldHelpers(
             "user_variable_values[" + index + "].value",
-          )
+          );
         }
 
         return (
@@ -100,88 +98,86 @@ export const TemplateVariablesForm: FC<TemplateVariablesForm> = ({
                   await form.setFieldValue("user_variable_values." + index, {
                     name: templateVariable.name,
                     value: value,
-                  })
+                  });
                 }}
               />
             </FormFields>
           </FormSection>
-        )
+        );
       })}
 
       <FormFooter onCancel={onCancel} isLoading={isSubmitting} />
     </HorizontalForm>
-  )
-}
+  );
+};
 
 export const selectInitialUserVariableValues = (
   templateVariables: TemplateVersionVariable[],
 ): VariableValue[] => {
-  const defaults: VariableValue[] = []
+  const defaults: VariableValue[] = [];
   templateVariables.forEach((templateVariable) => {
     // Boolean variables must be always either "true" or "false"
     if (templateVariable.type === "bool" && templateVariable.value === "") {
       defaults.push({
         name: templateVariable.name,
         value: templateVariable.default_value,
-      })
-      return
+      });
+      return;
     }
 
     if (templateVariable.sensitive) {
       defaults.push({
         name: templateVariable.name,
         value: "",
-      })
-      return
+      });
+      return;
     }
 
     if (templateVariable.required && templateVariable.value === "") {
       defaults.push({
         name: templateVariable.name,
         value: templateVariable.default_value,
-      })
-      return
+      });
+      return;
     }
 
     defaults.push({
       name: templateVariable.name,
       value: templateVariable.value,
-    })
-  })
-  return defaults
-}
+    });
+  });
+  return defaults;
+};
 
 const ValidationSchemaForTemplateVariables = (
   ns: string,
   templateVariables: TemplateVersionVariable[],
 ): Yup.AnySchema => {
-  const { t } = useTranslation(ns)
-
   return Yup.array()
     .of(
       Yup.object().shape({
         name: Yup.string().required(),
         value: Yup.string().test("verify with template", (val, ctx) => {
-          const name = ctx.parent.name
+          const name = ctx.parent.name;
           const templateVariable = templateVariables.find(
             (variable) => variable.name === name,
-          )
+          );
           if (templateVariable && templateVariable.sensitive) {
             // It's possible that the secret is already stored in database,
             // so we can't properly verify the "required" condition.
-            return true
+            return true;
           }
           if (templateVariable && templateVariable.required) {
             if (!val || val.length === 0) {
               return ctx.createError({
                 path: ctx.path,
-                message: t("validationRequiredVariable").toString(),
-              })
+                message: "Variable is required.",
+              });
             }
           }
-          return true
+          return true;
         }),
       }),
     )
-    .required()
-}
+    .required();
+};
diff --git a/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPage.test.tsx b/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPage.test.tsx
index 5ef8a3a2b70d4..2ce13b21fbf10 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPage.test.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPage.test.tsx
@@ -1,170 +1,112 @@
-import { screen } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
+import { screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 import {
   renderWithTemplateSettingsLayout,
   waitForLoaderToBeRemoved,
-} from "testHelpers/renderHelpers"
-import * as API from "api/api"
-import i18next from "i18next"
-import TemplateVariablesPage from "./TemplateVariablesPage"
-import { Language as FooterFormLanguage } from "components/FormFooter/FormFooter"
+} from "testHelpers/renderHelpers";
+import * as API from "api/api";
+import TemplateVariablesPage from "./TemplateVariablesPage";
+import { Language as FooterFormLanguage } from "components/FormFooter/FormFooter";
 import {
   MockTemplate,
   MockTemplateVersion,
   MockTemplateVersionVariable1,
   MockTemplateVersionVariable2,
   MockTemplateVersion2,
-  MockTemplateVersionVariable5,
-} from "testHelpers/entities"
-
-const { t } = i18next
+} from "testHelpers/entities";
+import { delay } from "utils/delay";
 
 const validFormValues = {
   first_variable: "Hello world",
   second_variable: "123",
-}
-
-const pageTitleText = t("title", { ns: "templateVariablesPage" })
-
-const validationRequiredField = t("validationRequiredVariable", {
-  ns: "templateVariablesPage",
-})
+};
 
 const renderTemplateVariablesPage = async () => {
   renderWithTemplateSettingsLayout(<TemplateVariablesPage />, {
     route: `/templates/${MockTemplate.name}/variables`,
     path: `/templates/:template/variables`,
     extraRoutes: [{ path: `/templates/${MockTemplate.name}`, element: <></> }],
-  })
-  await waitForLoaderToBeRemoved()
-}
+  });
+  await waitForLoaderToBeRemoved();
+};
 
 describe("TemplateVariablesPage", () => {
   it("renders with variables", async () => {
-    jest.spyOn(API, "getTemplateByName").mockResolvedValueOnce(MockTemplate)
+    jest.spyOn(API, "getTemplateByName").mockResolvedValueOnce(MockTemplate);
     jest
       .spyOn(API, "getTemplateVersion")
-      .mockResolvedValueOnce(MockTemplateVersion)
+      .mockResolvedValueOnce(MockTemplateVersion);
     jest
       .spyOn(API, "getTemplateVersionVariables")
       .mockResolvedValueOnce([
         MockTemplateVersionVariable1,
         MockTemplateVersionVariable2,
-      ])
-
-    await renderTemplateVariablesPage()
+      ]);
 
-    const element = await screen.findByText(pageTitleText)
-    expect(element).toBeDefined()
+    await renderTemplateVariablesPage();
 
     const firstVariable = await screen.findByLabelText(
       MockTemplateVersionVariable1.name,
-    )
-    expect(firstVariable).toBeDefined()
+    );
+    expect(firstVariable).toBeDefined();
 
     const secondVariable = await screen.findByLabelText(
       MockTemplateVersionVariable2.name,
-    )
-    expect(secondVariable).toBeDefined()
-  })
+    );
+    expect(secondVariable).toBeDefined();
+  });
 
   it("user submits the form successfully", async () => {
-    jest.spyOn(API, "getTemplateByName").mockResolvedValueOnce(MockTemplate)
+    jest.spyOn(API, "getTemplateByName").mockResolvedValueOnce(MockTemplate);
     jest
       .spyOn(API, "getTemplateVersion")
-      .mockResolvedValueOnce(MockTemplateVersion)
+      .mockResolvedValue(MockTemplateVersion);
     jest
       .spyOn(API, "getTemplateVersionVariables")
       .mockResolvedValueOnce([
         MockTemplateVersionVariable1,
         MockTemplateVersionVariable2,
-      ])
+      ]);
     jest
       .spyOn(API, "createTemplateVersion")
-      .mockResolvedValueOnce(MockTemplateVersion2)
+      .mockResolvedValueOnce(MockTemplateVersion2);
     jest.spyOn(API, "updateActiveTemplateVersion").mockResolvedValueOnce({
       message: "done",
-    })
+    });
 
-    await renderTemplateVariablesPage()
-
-    const element = await screen.findByText(pageTitleText)
-    expect(element).toBeDefined()
+    await renderTemplateVariablesPage();
 
     const firstVariable = await screen.findByLabelText(
       MockTemplateVersionVariable1.name,
-    )
-    expect(firstVariable).toBeDefined()
+    );
+    expect(firstVariable).toBeDefined();
 
     const secondVariable = await screen.findByLabelText(
       MockTemplateVersionVariable2.name,
-    )
-    expect(secondVariable).toBeDefined()
+    );
+    expect(secondVariable).toBeDefined();
 
     // Fill the form
     const firstVariableField = await screen.findByLabelText(
       MockTemplateVersionVariable1.name,
-    )
-    await userEvent.clear(firstVariableField)
-    await userEvent.type(firstVariableField, validFormValues.first_variable)
+    );
+    await userEvent.clear(firstVariableField);
+    await userEvent.type(firstVariableField, validFormValues.first_variable);
 
     const secondVariableField = await screen.findByLabelText(
       MockTemplateVersionVariable2.name,
-    )
-    await userEvent.clear(secondVariableField)
-    await userEvent.type(secondVariableField, validFormValues.second_variable)
+    );
+    await userEvent.clear(secondVariableField);
+    await userEvent.type(secondVariableField, validFormValues.second_variable);
 
     // Submit the form
     const submitButton = await screen.findByText(
       FooterFormLanguage.defaultSubmitLabel,
-    )
-    await userEvent.click(submitButton)
-
+    );
+    await userEvent.click(submitButton);
     // Wait for the success message
-    await screen.findByText("Template updated successfully")
-  })
-
-  it("user forgets to fill the required field", async () => {
-    jest.spyOn(API, "getTemplateByName").mockResolvedValueOnce(MockTemplate)
-    jest
-      .spyOn(API, "getTemplateVersion")
-      .mockResolvedValueOnce(MockTemplateVersion)
-    jest
-      .spyOn(API, "getTemplateVersionVariables")
-      .mockResolvedValueOnce([
-        MockTemplateVersionVariable1,
-        MockTemplateVersionVariable5,
-      ])
-    jest
-      .spyOn(API, "createTemplateVersion")
-      .mockResolvedValueOnce(MockTemplateVersion2)
-    jest.spyOn(API, "updateActiveTemplateVersion").mockResolvedValueOnce({
-      message: "done",
-    })
-
-    await renderTemplateVariablesPage()
-
-    const element = await screen.findByText(pageTitleText)
-    expect(element).toBeDefined()
-
-    const firstVariable = await screen.findByLabelText(
-      MockTemplateVersionVariable1.name,
-    )
-    expect(firstVariable).toBeDefined()
-
-    const fifthVariable = await screen.findByLabelText(
-      MockTemplateVersionVariable5.name,
-    )
-    expect(fifthVariable).toBeDefined()
-
-    // Submit the form
-    const submitButton = await screen.findByText(
-      FooterFormLanguage.defaultSubmitLabel,
-    )
-    await userEvent.click(submitButton)
+    await delay(1500);
 
-    // Check validation error
-    const validationError = await screen.findByText(validationRequiredField)
-    expect(validationError).toBeDefined()
-  })
-})
+    await screen.findByText("Template updated successfully");
+  });
+});
diff --git a/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPage.tsx b/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPage.tsx
index 64b0ed41b8294..f45e9e7842bd4 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPage.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPage.tsx
@@ -1,108 +1,145 @@
-import { useMachine } from "@xstate/react"
 import {
   CreateTemplateVersionRequest,
   TemplateVersionVariable,
   VariableValue,
-} from "api/typesGenerated"
-import { displaySuccess } from "components/GlobalSnackbar/utils"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useTranslation } from "react-i18next"
-import { useNavigate, useParams } from "react-router-dom"
-import { templateVariablesMachine } from "xServices/template/templateVariablesXService"
-import { pageTitle } from "../../../utils/page"
-import { useTemplateSettingsContext } from "../TemplateSettingsLayout"
-import { TemplateVariablesPageView } from "./TemplateVariablesPageView"
+} from "api/typesGenerated";
+import { displaySuccess } from "components/GlobalSnackbar/utils";
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { useCallback, type FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { useNavigate, useParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import { useTemplateSettings } from "../TemplateSettingsLayout";
+import { TemplateVariablesPageView } from "./TemplateVariablesPageView";
+import {
+  createAndBuildTemplateVersion,
+  templateVersion,
+  templateVersionVariables,
+  updateActiveTemplateVersion,
+} from "api/queries/templates";
+import { useMutation, useQuery, useQueryClient } from "react-query";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { Loader } from "components/Loader/Loader";
 
 export const TemplateVariablesPage: FC = () => {
   const { template: templateName } = useParams() as {
-    organization: string
-    template: string
-  }
-  const organizationId = useOrganizationId()
-  const { template } = useTemplateSettingsContext()
-  const navigate = useNavigate()
-  const [state, send] = useMachine(templateVariablesMachine, {
-    context: {
-      organizationId,
-      template,
+    organization: string;
+    template: string;
+  };
+  const orgId = useOrganizationId();
+  const { template } = useTemplateSettings();
+  const navigate = useNavigate();
+  const queryClient = useQueryClient();
+  const versionId = template.active_version_id;
+
+  const {
+    data: version,
+    error: versionError,
+    isLoading: isVersionLoading,
+  } = useQuery({ ...templateVersion(versionId), keepPreviousData: true });
+  const {
+    data: variables,
+    error: variablesError,
+    isLoading: isVariablesLoading,
+  } = useQuery({
+    ...templateVersionVariables(versionId),
+    keepPreviousData: true,
+  });
+
+  const {
+    mutateAsync: sendCreateAndBuildTemplateVersion,
+    error: buildError,
+    isLoading: isBuilding,
+  } = useMutation(createAndBuildTemplateVersion(orgId));
+  const {
+    mutateAsync: sendUpdateActiveTemplateVersion,
+    error: publishError,
+    isLoading: isPublishing,
+  } = useMutation(updateActiveTemplateVersion(template, queryClient));
+
+  const publishVersion = useCallback(
+    async (versionId: string) => {
+      await sendUpdateActiveTemplateVersion(versionId);
+      displaySuccess("Template updated successfully");
     },
-    actions: {
-      onUpdateTemplate: () => {
-        displaySuccess("Template updated successfully")
-      },
+    [sendUpdateActiveTemplateVersion],
+  );
+
+  const buildVersion = useCallback(
+    async (req: CreateTemplateVersionRequest) => {
+      const newVersion = await sendCreateAndBuildTemplateVersion(req);
+      await publishVersion(newVersion.id);
     },
-  })
-  const {
-    activeTemplateVersion,
-    templateVariables,
-    getTemplateDataError,
-    updateTemplateError,
-    jobError,
-  } = state.context
+    [sendCreateAndBuildTemplateVersion, publishVersion],
+  );
+
+  const isSubmitting = Boolean(isBuilding || isPublishing);
+
+  const error = versionError ?? variablesError;
+  if (error) {
+    return <ErrorAlert error={error} />;
+  }
+
+  if (isVersionLoading || isVariablesLoading) {
+    return <Loader />;
+  }
 
-  const { t } = useTranslation("templateVariablesPage")
   return (
     <>
       <Helmet>
-        <title>{pageTitle([template.name, t("title")])}</title>
+        <title>{pageTitle([template.name, "Template variables"])}</title>
       </Helmet>
 
       <TemplateVariablesPageView
-        isSubmitting={state.hasTag("submitting")}
-        templateVersion={activeTemplateVersion}
-        templateVariables={templateVariables}
+        isSubmitting={isSubmitting}
+        templateVersion={version}
+        templateVariables={variables}
         errors={{
-          getTemplateDataError,
-          updateTemplateError,
-          jobError,
+          buildError,
+          publishError,
         }}
         onCancel={() => {
-          navigate(`/templates/${templateName}`)
+          navigate(`/templates/${templateName}`);
         }}
-        onSubmit={(formData) => {
-          const request = filterEmptySensitiveVariables(
-            formData,
-            templateVariables,
-          )
-          send({ type: "UPDATE_TEMPLATE_EVENT", request: request })
+        onSubmit={async (formData) => {
+          const request = filterEmptySensitiveVariables(formData, variables);
+          await buildVersion(request);
         }}
       />
     </>
-  )
-}
+  );
+};
 
 const filterEmptySensitiveVariables = (
   request: CreateTemplateVersionRequest,
   templateVariables?: TemplateVersionVariable[],
 ): CreateTemplateVersionRequest => {
-  const filtered: VariableValue[] = []
+  const filtered: VariableValue[] = [];
 
   if (!templateVariables) {
-    return request
+    return request;
   }
 
   if (request.user_variable_values) {
     request.user_variable_values.forEach((variableValue) => {
       const templateVariable = templateVariables.find(
         (t) => t.name === variableValue.name,
-      )
+      );
       if (
         templateVariable &&
         templateVariable.sensitive &&
         variableValue.value === ""
       ) {
-        return
+        return;
       }
-      filtered.push(variableValue)
-    })
+      filtered.push(variableValue);
+    });
   }
 
   return {
     ...request,
     user_variable_values: filtered,
-  }
-}
+  };
+};
 
-export default TemplateVariablesPage
+export default TemplateVariablesPage;
diff --git a/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPageView.stories.tsx b/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPageView.stories.tsx
index 2156893b62633..44564883798fc 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPageView.stories.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPageView.stories.tsx
@@ -1,5 +1,3 @@
-import { action } from "@storybook/addon-actions"
-import { Story } from "@storybook/react"
 import {
   mockApiError,
   MockTemplateVersion,
@@ -8,88 +6,73 @@ import {
   MockTemplateVersionVariable3,
   MockTemplateVersionVariable4,
   MockTemplateVersionVariable5,
-} from "testHelpers/entities"
-import {
-  TemplateVariablesPageView,
-  TemplateVariablesPageViewProps,
-} from "./TemplateVariablesPageView"
+} from "testHelpers/entities";
+import { TemplateVariablesPageView } from "./TemplateVariablesPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/TemplateVariablesPageView",
+const meta: Meta<typeof TemplateVariablesPageView> = {
+  title: "pages/TemplateSettingsPage/TemplateVariablesPageView",
   component: TemplateVariablesPageView,
-}
+};
 
-const TemplateVariables: Story<TemplateVariablesPageViewProps> = (args) => (
-  <TemplateVariablesPageView {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof TemplateVariablesPageView>;
 
-export const Loading = TemplateVariables.bind({})
-Loading.args = {
-  onSubmit: action("onSubmit"),
-  onCancel: action("cancel"),
-}
+export const Loading: Story = {};
 
-export const Basic = TemplateVariables.bind({})
-Basic.args = {
-  templateVersion: MockTemplateVersion,
-  templateVariables: [
-    MockTemplateVersionVariable1,
-    MockTemplateVersionVariable2,
-    MockTemplateVersionVariable3,
-    MockTemplateVersionVariable4,
-  ],
-  onSubmit: action("onSubmit"),
-  onCancel: action("cancel"),
-}
+export const Basic: Story = {
+  args: {
+    templateVersion: MockTemplateVersion,
+    templateVariables: [
+      MockTemplateVersionVariable1,
+      MockTemplateVersionVariable2,
+      MockTemplateVersionVariable3,
+      MockTemplateVersionVariable4,
+    ],
+  },
+};
 
 // This example isn't fully supported. As "user_variable_values" is an array,
 // FormikTouched can't properly handle this.
 // See: https://github.com/jaredpalmer/formik/issues/2022
-export const RequiredVariable = TemplateVariables.bind({})
-RequiredVariable.args = {
-  templateVersion: MockTemplateVersion,
-  templateVariables: [
-    MockTemplateVersionVariable4,
-    MockTemplateVersionVariable5,
-  ],
-  onSubmit: action("onSubmit"),
-  onCancel: action("cancel"),
-  initialTouched: {
-    user_variable_values: true,
-  },
-}
+export const RequiredVariable: Story = {
+  args: {
+    templateVersion: MockTemplateVersion,
+    templateVariables: [
+      MockTemplateVersionVariable4,
+      MockTemplateVersionVariable5,
+    ],
 
-export const WithUpdateTemplateError = TemplateVariables.bind({})
-WithUpdateTemplateError.args = {
-  templateVersion: MockTemplateVersion,
-  templateVariables: [
-    MockTemplateVersionVariable1,
-    MockTemplateVersionVariable2,
-    MockTemplateVersionVariable3,
-    MockTemplateVersionVariable4,
-  ],
-  errors: {
-    updateTemplateError: mockApiError({
-      message: "Something went wrong.",
-    }),
+    initialTouched: {
+      user_variable_values: true,
+    },
   },
-  onSubmit: action("onSubmit"),
-  onCancel: action("cancel"),
-}
+};
+
+export const WithErrors: Story = {
+  args: {
+    templateVersion: MockTemplateVersion,
+    templateVariables: [
+      MockTemplateVersionVariable1,
+      MockTemplateVersionVariable2,
+      MockTemplateVersionVariable3,
+      MockTemplateVersionVariable4,
+    ],
+    errors: {
+      buildError: mockApiError({
+        message: "buildError",
+        validations: [
+          {
+            field: `user_variable_values[0].value`,
+            detail: "Variable is required.",
+          },
+        ],
+      }),
+      publishError: mockApiError({ message: "publishError" }),
+    },
 
-export const WithJobError = TemplateVariables.bind({})
-WithJobError.args = {
-  templateVersion: MockTemplateVersion,
-  templateVariables: [
-    MockTemplateVersionVariable1,
-    MockTemplateVersionVariable2,
-    MockTemplateVersionVariable3,
-    MockTemplateVersionVariable4,
-  ],
-  errors: {
-    jobError:
-      "template import provision for start: recv import provision: plan terraform: terraform plan: exit status 1",
+    initialTouched: {
+      user_variable_values: true,
+    },
   },
-  onSubmit: action("onSubmit"),
-  onCancel: action("cancel"),
-}
+};
diff --git a/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPageView.tsx b/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPageView.tsx
index fad5b1e94b02d..561e2ecbd3d76 100644
--- a/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPageView.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplateVariablesPage/TemplateVariablesPageView.tsx
@@ -1,31 +1,34 @@
-import {
+import { type ComponentProps, type FC } from "react";
+import type {
   CreateTemplateVersionRequest,
   TemplateVersion,
   TemplateVersionVariable,
-} from "api/typesGenerated"
-import { Alert } from "components/Alert/Alert"
-import { Loader } from "components/Loader/Loader"
-import { ComponentProps, FC } from "react"
-import { TemplateVariablesForm } from "./TemplateVariablesForm"
-import { makeStyles } from "@mui/styles"
-import { useTranslation } from "react-i18next"
-import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
+} from "api/typesGenerated";
+import { Alert } from "components/Alert/Alert";
+import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { Stack } from "components/Stack/Stack";
+import { TemplateVariablesForm } from "./TemplateVariablesForm";
 
 export interface TemplateVariablesPageViewProps {
-  templateVersion?: TemplateVersion
-  templateVariables?: TemplateVersionVariable[]
-  onSubmit: (data: CreateTemplateVersionRequest) => void
-  onCancel: () => void
-  isSubmitting: boolean
+  templateVersion?: TemplateVersion;
+  templateVariables?: TemplateVersionVariable[];
+  onSubmit: (data: CreateTemplateVersionRequest) => void;
+  onCancel: () => void;
+  isSubmitting: boolean;
   errors?: {
-    getTemplateDataError?: unknown
-    updateTemplateError?: unknown
-    jobError?: TemplateVersion["job"]["error"]
-  }
+    /**
+     * Failed to build a new template version
+     */
+    buildError?: unknown;
+    /**
+     * New version was created successfully, but publishing it failed
+     */
+    publishError?: unknown;
+  };
   initialTouched?: ComponentProps<
     typeof TemplateVariablesForm
-  >["initialTouched"]
+  >["initialTouched"];
 }
 
 export const TemplateVariablesPageView: FC<TemplateVariablesPageViewProps> = ({
@@ -37,31 +40,23 @@ export const TemplateVariablesPageView: FC<TemplateVariablesPageViewProps> = ({
   errors = {},
   initialTouched,
 }) => {
-  const classes = useStyles()
-  const isLoading =
-    !templateVersion &&
-    !templateVariables &&
-    !errors.getTemplateDataError &&
-    !errors.updateTemplateError
-  const { t } = useTranslation("templateVariablesPage")
-  const hasError = Object.values(errors).some((error) => Boolean(error))
+  const hasError = Object.values(errors).some((error) => Boolean(error));
+
   return (
     <>
-      <PageHeader className={classes.pageHeader}>
-        <PageHeaderTitle>{t("title")}</PageHeaderTitle>
+      <PageHeader css={{ paddingTop: 0 }}>
+        <PageHeaderTitle>Template variables</PageHeaderTitle>
       </PageHeader>
       {hasError && (
-        <div className={classes.errorContainer}>
-          {Boolean(errors.getTemplateDataError) && (
-            <ErrorAlert error={errors.getTemplateDataError} />
+        <Stack css={(theme) => ({ marginBottom: theme.spacing(8) })}>
+          {Boolean(errors.buildError) && (
+            <ErrorAlert error={errors.buildError} />
           )}
-          {Boolean(errors.updateTemplateError) && (
-            <ErrorAlert error={errors.updateTemplateError} />
+          {Boolean(errors.publishError) && (
+            <ErrorAlert error={errors.publishError} />
           )}
-          {Boolean(errors.jobError) && <ErrorAlert error={errors.jobError} />}
-        </div>
+        </Stack>
       )}
-      {isLoading && <Loader />}
       {templateVersion && templateVariables && templateVariables.length > 0 && (
         <TemplateVariablesForm
           initialTouched={initialTouched}
@@ -70,26 +65,14 @@ export const TemplateVariablesPageView: FC<TemplateVariablesPageViewProps> = ({
           templateVariables={templateVariables}
           onSubmit={onSubmit}
           onCancel={onCancel}
-          error={errors.updateTemplateError}
+          error={errors.buildError}
         />
       )}
       {templateVariables && templateVariables.length === 0 && (
-        <Alert severity="info">{t("unusedVariablesNotice")}</Alert>
+        <Alert severity="info">
+          This template does not use managed variables.
+        </Alert>
       )}
     </>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  errorContainer: {
-    marginBottom: theme.spacing(8),
-  },
-  goBackSection: {
-    display: "flex",
-    width: "100%",
-    marginTop: 32,
-  },
-  pageHeader: {
-    paddingTop: 0,
-  },
-}))
+  );
+};
diff --git a/site/src/pages/TemplateVersionEditorPage/FileDialog.tsx b/site/src/pages/TemplateVersionEditorPage/FileDialog.tsx
new file mode 100644
index 0000000000000..4c3f9ce234751
--- /dev/null
+++ b/site/src/pages/TemplateVersionEditorPage/FileDialog.tsx
@@ -0,0 +1,199 @@
+import TextField from "@mui/material/TextField";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import { Stack } from "components/Stack/Stack";
+import { ChangeEvent, FC, useState } from "react";
+import Typography from "@mui/material/Typography";
+import { allowedExtensions, isAllowedFile } from "utils/templateVersion";
+import { FileTree, isFolder, validatePath } from "utils/filetree";
+
+export const CreateFileDialog: FC<{
+  onClose: () => void;
+  checkExists: (path: string) => boolean;
+  onConfirm: (path: string) => void;
+  open: boolean;
+  fileTree: FileTree;
+}> = ({ checkExists, onClose, onConfirm, open, fileTree }) => {
+  const [pathValue, setPathValue] = useState("");
+  const [error, setError] = useState<string>();
+  const handleChange = (event: ChangeEvent<HTMLInputElement>) => {
+    setPathValue(event.target.value);
+  };
+  const handleConfirm = () => {
+    if (pathValue === "") {
+      setError("You must enter a path!");
+      return;
+    }
+    if (checkExists(pathValue)) {
+      setError("File already exists");
+      return;
+    }
+    if (!isAllowedFile(pathValue)) {
+      const extensions = allowedExtensions.join(", ");
+      setError(
+        `This extension is not allowed. You only can create files with the following extensions: ${extensions}.`,
+      );
+      return;
+    }
+    const pathError = validatePath(pathValue, fileTree);
+    if (pathError) {
+      setError(pathError);
+      return;
+    }
+    onConfirm(pathValue);
+    setError(undefined);
+    setPathValue("");
+  };
+
+  return (
+    <ConfirmDialog
+      open={open}
+      onClose={() => {
+        onClose();
+        setError(undefined);
+        setPathValue("");
+      }}
+      onConfirm={handleConfirm}
+      hideCancel={false}
+      type="success"
+      cancelText="Cancel"
+      confirmText="Create"
+      title="Create File"
+      description={
+        <Stack>
+          <Typography>
+            Specify the path to a file to be created. This path can contain
+            slashes too.
+          </Typography>
+          <TextField
+            autoFocus
+            onKeyDown={(event) => {
+              if (event.key === "Enter") {
+                handleConfirm();
+              }
+            }}
+            error={Boolean(error)}
+            helperText={error}
+            name="file-path"
+            autoComplete="off"
+            id="file-path"
+            placeholder="example.tf"
+            value={pathValue}
+            onChange={handleChange}
+            label="File Path"
+          />
+        </Stack>
+      }
+    />
+  );
+};
+
+export const DeleteFileDialog: FC<{
+  onClose: () => void;
+  onConfirm: () => void;
+  open: boolean;
+  filename: string;
+}> = ({ onClose, onConfirm, open, filename }) => {
+  return (
+    <ConfirmDialog
+      type="delete"
+      onClose={onClose}
+      open={open}
+      onConfirm={onConfirm}
+      title="Delete File"
+      description={
+        <>
+          Are you sure you want to delete <strong>{filename}</strong>? It will
+          be deleted permanently.
+        </>
+      }
+    />
+  );
+};
+
+export const RenameFileDialog: FC<{
+  onClose: () => void;
+  onConfirm: (filename: string) => void;
+  checkExists: (path: string) => boolean;
+  open: boolean;
+  filename: string;
+  fileTree: FileTree;
+}> = ({ checkExists, onClose, onConfirm, open, filename, fileTree }) => {
+  const [pathValue, setPathValue] = useState(filename);
+  const [error, setError] = useState<string>();
+  const handleChange = (event: ChangeEvent<HTMLInputElement>) => {
+    setPathValue(event.target.value);
+  };
+  const handleConfirm = () => {
+    if (pathValue === "") {
+      setError("You must enter a path!");
+      return;
+    }
+    if (checkExists(pathValue)) {
+      setError("File already exists");
+      return;
+    }
+    if (!isAllowedFile(pathValue)) {
+      const extensions = allowedExtensions.join(", ");
+      setError(
+        `This extension is not allowed. You only can rename files with the following extensions: ${extensions}.`,
+      );
+      return;
+    }
+    //Check if a folder is renamed to a file
+    const [_, extension] = pathValue.split(".");
+    if (isFolder(filename, fileTree) && extension) {
+      setError(`A folder can't be renamed to a file.`);
+      return;
+    }
+    const pathError = validatePath(pathValue, fileTree);
+    if (pathError) {
+      setError(pathError);
+      return;
+    }
+    onConfirm(pathValue);
+    setError(undefined);
+    setPathValue("");
+  };
+
+  return (
+    <ConfirmDialog
+      open={open}
+      onClose={() => {
+        onClose();
+        setError(undefined);
+        setPathValue("");
+      }}
+      onConfirm={handleConfirm}
+      hideCancel={false}
+      type="success"
+      cancelText="Cancel"
+      confirmText="Rename"
+      title="Rename File"
+      description={
+        <Stack>
+          <p>
+            Rename <strong>{filename}</strong> to something else. This path can
+            contain slashes too!
+          </p>
+          <TextField
+            autoFocus
+            onKeyDown={(event) => {
+              if (event.key === "Enter") {
+                handleConfirm();
+              }
+            }}
+            error={Boolean(error)}
+            helperText={error}
+            name="file-path"
+            autoComplete="off"
+            id="file-path"
+            placeholder={filename}
+            value={pathValue}
+            onChange={handleChange}
+            label="File Path"
+          />
+        </Stack>
+      }
+    />
+  );
+};
diff --git a/site/src/components/TemplateVersionEditor/FileTreeView.tsx b/site/src/pages/TemplateVersionEditorPage/FileTreeView.tsx
similarity index 75%
rename from site/src/components/TemplateVersionEditor/FileTreeView.tsx
rename to site/src/pages/TemplateVersionEditorPage/FileTreeView.tsx
index b0a39aa619bad..aff625bb3a012 100644
--- a/site/src/components/TemplateVersionEditor/FileTreeView.tsx
+++ b/site/src/pages/TemplateVersionEditorPage/FileTreeView.tsx
@@ -1,58 +1,58 @@
-import { makeStyles } from "@mui/styles"
-import ChevronRightIcon from "@mui/icons-material/ChevronRight"
-import ExpandMoreIcon from "@mui/icons-material/ExpandMore"
-import TreeView from "@mui/lab/TreeView"
-import TreeItem from "@mui/lab/TreeItem"
-import Menu from "@mui/material/Menu"
-import MenuItem from "@mui/material/MenuItem"
-import { CSSProperties, FC, useState } from "react"
-import { FileTree } from "utils/filetree"
-import { DockerIcon } from "components/Icons/DockerIcon"
-import { colors } from "theme/colors"
+import { makeStyles } from "@mui/styles";
+import ChevronRightIcon from "@mui/icons-material/ChevronRight";
+import ExpandMoreIcon from "@mui/icons-material/ExpandMore";
+import TreeView from "@mui/lab/TreeView";
+import TreeItem from "@mui/lab/TreeItem";
+import Menu from "@mui/material/Menu";
+import MenuItem from "@mui/material/MenuItem";
+import { CSSProperties, FC, useState } from "react";
+import { FileTree } from "utils/filetree";
+import { DockerIcon } from "components/Icons/DockerIcon";
+import { colors } from "theme/colors";
 
 const sortFileTree = (fileTree: FileTree) => (a: string, b: string) => {
-  const contentA = fileTree[a]
-  const contentB = fileTree[b]
+  const contentA = fileTree[a];
+  const contentB = fileTree[b];
   if (typeof contentA === "object") {
-    return -1
+    return -1;
   }
   if (typeof contentB === "object") {
-    return 1
+    return 1;
   }
-  return a.localeCompare(b)
-}
+  return a.localeCompare(b);
+};
 
 type ContextMenu = {
-  path: string
-  clientX: number
-  clientY: number
-}
+  path: string;
+  clientX: number;
+  clientY: number;
+};
 
 export const FileTreeView: FC<{
-  onSelect: (path: string) => void
-  onDelete: (path: string) => void
-  onRename: (path: string) => void
-  fileTree: FileTree
-  activePath?: string
+  onSelect: (path: string) => void;
+  onDelete: (path: string) => void;
+  onRename: (path: string) => void;
+  fileTree: FileTree;
+  activePath?: string;
 }> = ({ fileTree, activePath, onDelete, onRename, onSelect }) => {
-  const styles = useStyles()
-  const [contextMenu, setContextMenu] = useState<ContextMenu | undefined>()
+  const styles = useStyles();
+  const [contextMenu, setContextMenu] = useState<ContextMenu | undefined>();
 
   const buildTreeItems = (
     filename: string,
     content?: FileTree | string,
     parentPath?: string,
   ): JSX.Element => {
-    const currentPath = parentPath ? `${parentPath}/${filename}` : filename
-    let icon: JSX.Element | null = null
+    const currentPath = parentPath ? `${parentPath}/${filename}` : filename;
+    let icon: JSX.Element | null = null;
     if (filename.endsWith(".tf")) {
-      icon = <FileTypeTerraform />
+      icon = <FileTypeTerraform />;
     }
     if (filename.endsWith(".md")) {
-      icon = <FileTypeMarkdown />
+      icon = <FileTypeMarkdown />;
     }
     if (filename.endsWith("Dockerfile")) {
-      icon = <FileTypeDockerfile />
+      icon = <FileTypeDockerfile />;
     }
 
     return (
@@ -64,11 +64,11 @@ export const FileTreeView: FC<{
           currentPath === activePath ? "active" : ""
         }`}
         onClick={() => {
-          onSelect(currentPath)
+          onSelect(currentPath);
         }}
         onContextMenu={(event) => {
-          event.preventDefault() // Avoid default browser behavior
-          event.stopPropagation() // Avoid trigger parent context menu
+          event.preventDefault(); // Avoid default browser behavior
+          event.stopPropagation(); // Avoid trigger parent context menu
           setContextMenu(
             contextMenu
               ? undefined
@@ -77,7 +77,7 @@ export const FileTreeView: FC<{
                   clientY: event.clientY,
                   clientX: event.clientX,
                 },
-          )
+          );
         }}
         icon={icon}
         style={
@@ -90,15 +90,15 @@ export const FileTreeView: FC<{
           Object.keys(content)
             .sort(sortFileTree(content))
             .map((filename) => {
-              const child = content[filename]
-              return buildTreeItems(filename, child, currentPath)
+              const child = content[filename];
+              return buildTreeItems(filename, child, currentPath);
             })
         ) : (
           <></>
         )}
       </TreeItem>
-    )
-  }
+    );
+  };
 
   return (
     <TreeView
@@ -109,8 +109,8 @@ export const FileTreeView: FC<{
       {Object.keys(fileTree)
         .sort(sortFileTree(fileTree))
         .map((filename) => {
-          const child = fileTree[filename]
-          return buildTreeItems(filename, child)
+          const child = fileTree[filename];
+          return buildTreeItems(filename, child);
         })}
 
       <Menu
@@ -137,10 +137,10 @@ export const FileTreeView: FC<{
         <MenuItem
           onClick={() => {
             if (!contextMenu) {
-              return
+              return;
             }
-            onRename(contextMenu.path)
-            setContextMenu(undefined)
+            onRename(contextMenu.path);
+            setContextMenu(undefined);
           }}
         >
           Rename
@@ -148,18 +148,18 @@ export const FileTreeView: FC<{
         <MenuItem
           onClick={() => {
             if (!contextMenu) {
-              return
+              return;
             }
-            onDelete(contextMenu.path)
-            setContextMenu(undefined)
+            onDelete(contextMenu.path);
+            setContextMenu(undefined);
           }}
         >
           Delete
         </MenuItem>
       </Menu>
     </TreeView>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   fileTreeItem: {
@@ -213,7 +213,7 @@ const useStyles = makeStyles((theme) => ({
     flex: 1,
   },
   preview: {},
-}))
+}));
 
 const FileTypeTerraform = () => (
   <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="#813cf3">
@@ -223,7 +223,7 @@ const FileTypeTerraform = () => (
     <polygon points="3.541 11.01 11.571 15.599 11.571 6.59 3.541 2 3.541 11.01 3.541 11.01" />
     <polygon points="12.042 25.41 20.071 30 20.071 20.957 12.042 16.368 12.042 25.41 12.042 25.41" />
   </svg>
-)
+);
 
 const FileTypeMarkdown = () => (
   <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="#755838">
@@ -240,6 +240,6 @@ const FileTypeMarkdown = () => (
     <polygon points="5.909 20.636 5.909 11.364 8.636 11.364 11.364 14.773 14.091 11.364 16.818 11.364 16.818 20.636 14.091 20.636 14.091 15.318 11.364 18.727 8.636 15.318 8.636 20.636 5.909 20.636" />
     <polygon points="22.955 20.636 18.864 16.136 21.591 16.136 21.591 11.364 24.318 11.364 24.318 16.136 27.045 16.136 22.955 20.636" />
   </svg>
-)
+);
 
-const FileTypeDockerfile = () => <DockerIcon />
+const FileTypeDockerfile = () => <DockerIcon />;
diff --git a/site/src/pages/TemplateVersionEditorPage/MissingTemplateVariablesDialog.tsx b/site/src/pages/TemplateVersionEditorPage/MissingTemplateVariablesDialog.tsx
new file mode 100644
index 0000000000000..61a5c39fd1907
--- /dev/null
+++ b/site/src/pages/TemplateVersionEditorPage/MissingTemplateVariablesDialog.tsx
@@ -0,0 +1,143 @@
+import { makeStyles } from "@mui/styles";
+import Dialog from "@mui/material/Dialog";
+import DialogContent from "@mui/material/DialogContent";
+import DialogContentText from "@mui/material/DialogContentText";
+import DialogTitle from "@mui/material/DialogTitle";
+import { DialogProps } from "components/Dialogs/Dialog";
+import { FC, useEffect, useState } from "react";
+import { FormFields, VerticalForm } from "components/Form/Form";
+import { TemplateVersionVariable, VariableValue } from "api/typesGenerated";
+import DialogActions from "@mui/material/DialogActions";
+import Button from "@mui/material/Button";
+import { VariableInput } from "pages/CreateTemplatePage/VariableInput";
+import { Loader } from "components/Loader/Loader";
+
+export type MissingTemplateVariablesDialogProps = Omit<
+  DialogProps,
+  "onSubmit"
+> & {
+  onClose: () => void;
+  onSubmit: (values: VariableValue[]) => void;
+  missingVariables?: TemplateVersionVariable[];
+};
+
+export const MissingTemplateVariablesDialog: FC<
+  MissingTemplateVariablesDialogProps
+> = ({ missingVariables, onSubmit, ...dialogProps }) => {
+  const styles = useStyles();
+  const [variableValues, setVariableValues] = useState<VariableValue[]>([]);
+
+  // Pre-fill the form with the default values when missing variables are loaded
+  useEffect(() => {
+    if (!missingVariables) {
+      return;
+    }
+    setVariableValues(
+      missingVariables.map((v) => ({ name: v.name, value: v.value })),
+    );
+  }, [missingVariables]);
+
+  return (
+    <Dialog
+      {...dialogProps}
+      scroll="body"
+      aria-labelledby="update-build-parameters-title"
+      maxWidth="xs"
+      data-testid="dialog"
+    >
+      <DialogTitle
+        id="update-build-parameters-title"
+        classes={{ root: styles.title }}
+      >
+        Template variables
+      </DialogTitle>
+      <DialogContent className={styles.content}>
+        <DialogContentText className={styles.info}>
+          There are a few missing template variable values. Please fill them in.
+        </DialogContentText>
+        <VerticalForm
+          className={styles.form}
+          id="updateVariables"
+          onSubmit={(e) => {
+            e.preventDefault();
+            onSubmit(variableValues);
+          }}
+        >
+          {missingVariables ? (
+            <FormFields>
+              {missingVariables.map((variable, index) => {
+                return (
+                  <VariableInput
+                    defaultValue={variable.value}
+                    variable={variable}
+                    key={variable.name}
+                    onChange={async (value) => {
+                      setVariableValues((prev) => {
+                        prev[index] = {
+                          name: variable.name,
+                          value,
+                        };
+                        return [...prev];
+                      });
+                    }}
+                  />
+                );
+              })}
+            </FormFields>
+          ) : (
+            <Loader />
+          )}
+        </VerticalForm>
+      </DialogContent>
+      <DialogActions disableSpacing className={styles.dialogActions}>
+        <Button color="primary" fullWidth type="submit" form="updateVariables">
+          Submit
+        </Button>
+        <Button fullWidth type="button" onClick={dialogProps.onClose}>
+          Cancel
+        </Button>
+      </DialogActions>
+    </Dialog>
+  );
+};
+
+const useStyles = makeStyles((theme) => ({
+  title: {
+    padding: theme.spacing(3, 5),
+
+    "& h2": {
+      fontSize: theme.spacing(2.5),
+      fontWeight: 400,
+    },
+  },
+
+  content: {
+    padding: theme.spacing(0, 5, 0, 5),
+  },
+
+  info: {
+    margin: 0,
+  },
+
+  form: {
+    paddingTop: theme.spacing(4),
+  },
+
+  infoTitle: {
+    fontSize: theme.spacing(2),
+    fontWeight: 600,
+    display: "flex",
+    alignItems: "center",
+    gap: theme.spacing(1),
+  },
+
+  formFooter: {
+    flexDirection: "column",
+  },
+
+  dialogActions: {
+    padding: theme.spacing(5),
+    flexDirection: "column",
+    gap: theme.spacing(1),
+  },
+}));
diff --git a/site/src/pages/TemplateVersionEditorPage/MonacoEditor.tsx b/site/src/pages/TemplateVersionEditorPage/MonacoEditor.tsx
new file mode 100644
index 0000000000000..e37798ac09b93
--- /dev/null
+++ b/site/src/pages/TemplateVersionEditorPage/MonacoEditor.tsx
@@ -0,0 +1,137 @@
+import { useTheme } from "@mui/styles";
+import Editor, { loader } from "@monaco-editor/react";
+import * as monaco from "monaco-editor";
+import { FC, useLayoutEffect, useMemo, useState } from "react";
+import { MONOSPACE_FONT_FAMILY } from "theme/constants";
+import { hslToHex } from "utils/colors";
+import type { editor } from "monaco-editor";
+
+loader.config({ monaco });
+
+export const MonacoEditor: FC<{
+  value?: string;
+  path?: string;
+  onChange?: (value: string) => void;
+}> = ({ onChange, value, path }) => {
+  const theme = useTheme();
+  const [editor, setEditor] = useState<editor.IStandaloneCodeEditor>();
+  useLayoutEffect(() => {
+    if (!editor) {
+      return;
+    }
+    const resizeListener = () => {
+      editor.layout({
+        height: 0,
+        width: 0,
+      });
+    };
+    window.addEventListener("resize", resizeListener);
+    return () => {
+      window.removeEventListener("resize", resizeListener);
+    };
+  }, [editor]);
+
+  const language = useMemo(() => {
+    if (path?.endsWith(".tf")) {
+      return "hcl";
+    }
+    if (path?.endsWith(".md")) {
+      return "markdown";
+    }
+    if (path?.endsWith(".json")) {
+      return "json";
+    }
+    if (path?.endsWith(".yaml")) {
+      return "yaml";
+    }
+    if (path?.endsWith("Dockerfile")) {
+      return "dockerfile";
+    }
+  }, [path]);
+
+  return (
+    <Editor
+      value={value}
+      language={language}
+      theme="vs-dark"
+      options={{
+        automaticLayout: true,
+        fontFamily: MONOSPACE_FONT_FAMILY,
+        fontSize: 16,
+        wordWrap: "on",
+        padding: {
+          top: 16,
+          bottom: 16,
+        },
+      }}
+      path={path}
+      onChange={(newValue) => {
+        if (onChange && newValue) {
+          onChange(newValue);
+        }
+      }}
+      onMount={(editor, monaco) => {
+        // This jank allows for Ctrl + Enter to work outside the editor.
+        // We use this keybind to trigger a build.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Private type in Monaco!
+        (editor as any)._standaloneKeybindingService.addDynamicKeybinding(
+          `-editor.action.insertLineAfter`,
+          monaco.KeyMod.CtrlCmd | monaco.KeyCode.Enter,
+          () => {
+            //
+          },
+        );
+
+        setEditor(editor);
+
+        document.fonts.ready
+          .then(() => {
+            // Ensures that all text is measured properly.
+            // If this isn't done, there can be weird selection issues.
+            monaco.editor.remeasureFonts();
+          })
+          .catch(() => {
+            // Not a biggie!
+          });
+
+        monaco.editor.defineTheme("min", {
+          base: "vs-dark",
+          inherit: true,
+          rules: [
+            {
+              token: "comment",
+              foreground: "6B737C",
+            },
+            {
+              token: "type",
+              foreground: "B392F0",
+            },
+            {
+              token: "string",
+              foreground: "9DB1C5",
+            },
+            {
+              token: "variable",
+              foreground: "BBBBBB",
+            },
+            {
+              token: "identifier",
+              foreground: "B392F0",
+            },
+            {
+              token: "delimiter.curly",
+              foreground: "EBB325",
+            },
+          ],
+          colors: {
+            "editor.foreground": hslToHex(theme.palette.text.primary),
+            "editor.background": hslToHex(theme.palette.background.default),
+          },
+        });
+        editor.updateOptions({
+          theme: "min",
+        });
+      }}
+    />
+  );
+};
diff --git a/site/src/pages/TemplateVersionEditorPage/PublishTemplateVersionDialog.tsx b/site/src/pages/TemplateVersionEditorPage/PublishTemplateVersionDialog.tsx
new file mode 100644
index 0000000000000..66013982f5382
--- /dev/null
+++ b/site/src/pages/TemplateVersionEditorPage/PublishTemplateVersionDialog.tsx
@@ -0,0 +1,112 @@
+import { DialogProps } from "components/Dialogs/Dialog";
+import { FC } from "react";
+import { getFormHelpers } from "utils/formUtils";
+import { FormFields } from "components/Form/Form";
+import { useFormik } from "formik";
+import * as Yup from "yup";
+import { PublishVersionData } from "pages/TemplateVersionEditorPage/types";
+import TextField from "@mui/material/TextField";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import Checkbox from "@mui/material/Checkbox";
+import FormControlLabel from "@mui/material/FormControlLabel";
+import { Stack } from "components/Stack/Stack";
+
+export const Language = {
+  versionNameLabel: "Version name",
+  messagePlaceholder: "Write a short message about the changes you made...",
+  defaultCheckboxLabel: "Promote to default version",
+};
+
+export type PublishTemplateVersionDialogProps = DialogProps & {
+  defaultName: string;
+  isPublishing: boolean;
+  publishingError?: unknown;
+  onClose: () => void;
+  onConfirm: (data: PublishVersionData) => void;
+};
+
+export const PublishTemplateVersionDialog: FC<
+  PublishTemplateVersionDialogProps
+> = ({
+  onConfirm,
+  isPublishing,
+  onClose,
+  defaultName,
+  publishingError,
+  ...dialogProps
+}) => {
+  const form = useFormik({
+    initialValues: {
+      name: defaultName,
+      message: "",
+      isActiveVersion: true,
+    },
+    validationSchema: Yup.object({
+      name: Yup.string().required(),
+      message: Yup.string(),
+      isActiveVersion: Yup.boolean(),
+    }),
+    onSubmit: onConfirm,
+  });
+  const getFieldHelpers = getFormHelpers(form, publishingError);
+  const handleClose = () => {
+    form.resetForm();
+    onClose();
+  };
+
+  return (
+    <ConfirmDialog
+      {...dialogProps}
+      confirmLoading={isPublishing}
+      onClose={handleClose}
+      onConfirm={async () => {
+        await form.submitForm();
+      }}
+      hideCancel={false}
+      type="success"
+      cancelText="Cancel"
+      confirmText="Publish"
+      title="Publish new version"
+      description={
+        <Stack>
+          <p>You are about to publish a new version of this template.</p>
+          <FormFields>
+            <TextField
+              {...getFieldHelpers("name")}
+              label={Language.versionNameLabel}
+              autoFocus
+              disabled={isPublishing}
+            />
+
+            <TextField
+              {...getFieldHelpers("message")}
+              label="Message"
+              placeholder={Language.messagePlaceholder}
+              autoFocus
+              disabled={isPublishing}
+              multiline
+              rows={5}
+            />
+
+            <FormControlLabel
+              label={Language.defaultCheckboxLabel}
+              control={
+                <Checkbox
+                  size="small"
+                  checked={form.values.isActiveVersion}
+                  onChange={async (e) => {
+                    await form.setFieldValue(
+                      "isActiveVersion",
+                      e.target.checked,
+                    );
+                  }}
+                  name="isActiveVersion"
+                />
+              }
+            />
+          </FormFields>
+        </Stack>
+      }
+    />
+  );
+};
diff --git a/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditor.stories.tsx b/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditor.stories.tsx
new file mode 100644
index 0000000000000..c305b34eeb558
--- /dev/null
+++ b/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditor.stories.tsx
@@ -0,0 +1,82 @@
+import {
+  MockFailedProvisionerJob,
+  MockRunningProvisionerJob,
+  MockTemplate,
+  MockTemplateVersion,
+  MockTemplateVersionFileTree,
+  MockWorkspaceBuildLogs,
+  MockWorkspaceContainerResource,
+  MockWorkspaceExtendedBuildLogs,
+  MockWorkspaceImageResource,
+  MockWorkspaceResource,
+  MockWorkspaceResourceMultipleAgents,
+  MockWorkspaceResourceSensitive,
+  MockWorkspaceVolumeResource,
+} from "testHelpers/entities";
+import { TemplateVersionEditor } from "./TemplateVersionEditor";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof TemplateVersionEditor> = {
+  title: "pages/TemplateVersionEditorPage",
+  component: TemplateVersionEditor,
+  args: {
+    template: MockTemplate,
+    templateVersion: MockTemplateVersion,
+    defaultFileTree: MockTemplateVersionFileTree,
+  },
+  parameters: {
+    layout: "fullscreen",
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof TemplateVersionEditor>;
+
+export const Example: Story = {};
+
+export const Logs = {
+  args: {
+    isBuildingNewVersion: true,
+    buildLogs: MockWorkspaceBuildLogs,
+    templateVersion: {
+      ...MockTemplateVersion,
+      job: MockRunningProvisionerJob,
+    },
+  },
+};
+
+export const Resources: Story = {
+  args: {
+    isBuildingNewVersion: true,
+    buildLogs: MockWorkspaceBuildLogs,
+    resources: [
+      MockWorkspaceResource,
+      MockWorkspaceResourceSensitive,
+      MockWorkspaceResourceMultipleAgents,
+      MockWorkspaceVolumeResource,
+      MockWorkspaceImageResource,
+      MockWorkspaceContainerResource,
+    ],
+  },
+};
+
+export const ManyLogs = {
+  args: {
+    isBuildingNewVersion: true,
+    templateVersion: {
+      ...MockTemplateVersion,
+      job: {
+        ...MockFailedProvisionerJob,
+        error:
+          "template import provision for start: terraform plan: exit status 1",
+      },
+    },
+    buildLogs: MockWorkspaceExtendedBuildLogs,
+  },
+};
+
+export const Published = {
+  args: {
+    publishedVersion: MockTemplateVersion,
+  },
+};
diff --git a/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditor.tsx b/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditor.tsx
new file mode 100644
index 0000000000000..82988be7b0cca
--- /dev/null
+++ b/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditor.tsx
@@ -0,0 +1,594 @@
+import Button from "@mui/material/Button";
+import IconButton from "@mui/material/IconButton";
+import Link from "@mui/material/Link";
+import Tooltip from "@mui/material/Tooltip";
+import CreateIcon from "@mui/icons-material/AddOutlined";
+import BuildIcon from "@mui/icons-material/BuildOutlined";
+import PreviewIcon from "@mui/icons-material/VisibilityOutlined";
+import {
+  ProvisionerJobLog,
+  Template,
+  TemplateVersion,
+  TemplateVersionVariable,
+  VariableValue,
+  WorkspaceResource,
+} from "api/typesGenerated";
+import { Link as RouterLink } from "react-router-dom";
+import { Alert, AlertDetail } from "components/Alert/Alert";
+import { Avatar } from "components/Avatar/Avatar";
+import { AvatarData } from "components/AvatarData/AvatarData";
+import { TemplateResourcesTable } from "components/TemplateResourcesTable/TemplateResourcesTable";
+import { WorkspaceBuildLogs } from "components/WorkspaceBuildLogs/WorkspaceBuildLogs";
+import { PublishVersionData } from "pages/TemplateVersionEditorPage/types";
+import { type FC, useCallback, useEffect, useRef, useState } from "react";
+import {
+  createFile,
+  existsFile,
+  FileTree,
+  getFileContent,
+  isFolder,
+  moveFile,
+  removeFile,
+  traverse,
+  updateFile,
+} from "utils/filetree";
+import {
+  CreateFileDialog,
+  DeleteFileDialog,
+  RenameFileDialog,
+} from "./FileDialog";
+import { FileTreeView } from "./FileTreeView";
+import { MissingTemplateVariablesDialog } from "./MissingTemplateVariablesDialog";
+import { MonacoEditor } from "./MonacoEditor";
+import { PublishTemplateVersionDialog } from "./PublishTemplateVersionDialog";
+import {
+  getStatus,
+  TemplateVersionStatusBadge,
+} from "./TemplateVersionStatusBadge";
+import AlertTitle from "@mui/material/AlertTitle";
+import { DashboardFullPage } from "components/Dashboard/DashboardLayout";
+import { type Interpolation, type Theme, useTheme } from "@emotion/react";
+
+export interface TemplateVersionEditorProps {
+  template: Template;
+  templateVersion: TemplateVersion;
+  isBuildingNewVersion: boolean;
+  defaultFileTree: FileTree;
+  buildLogs?: ProvisionerJobLog[];
+  resources?: WorkspaceResource[];
+  disablePreview: boolean;
+  disableUpdate: boolean;
+  onPreview: (files: FileTree) => void;
+  onPublish: () => void;
+  onConfirmPublish: (data: PublishVersionData) => void;
+  onCancelPublish: () => void;
+  publishingError: unknown;
+  publishedVersion?: TemplateVersion;
+  onCreateWorkspace: () => void;
+  isAskingPublishParameters: boolean;
+  isPromptingMissingVariables: boolean;
+  isPublishing: boolean;
+  missingVariables?: TemplateVersionVariable[];
+  onSubmitMissingVariableValues: (values: VariableValue[]) => void;
+  onCancelSubmitMissingVariableValues: () => void;
+}
+
+const topbarHeight = 80;
+
+const findInitialFile = (fileTree: FileTree): string | undefined => {
+  let initialFile: string | undefined;
+
+  traverse(fileTree, (content, filename, path) => {
+    if (filename.endsWith(".tf")) {
+      initialFile = path;
+    }
+  });
+
+  return initialFile;
+};
+
+export const TemplateVersionEditor: FC<TemplateVersionEditorProps> = ({
+  disablePreview,
+  disableUpdate,
+  template,
+  templateVersion,
+  isBuildingNewVersion,
+  defaultFileTree,
+  onPreview,
+  onPublish,
+  onConfirmPublish,
+  onCancelPublish,
+  isAskingPublishParameters,
+  isPublishing,
+  publishingError,
+  publishedVersion,
+  onCreateWorkspace,
+  buildLogs,
+  resources,
+  isPromptingMissingVariables,
+  missingVariables,
+  onSubmitMissingVariableValues,
+  onCancelSubmitMissingVariableValues,
+}) => {
+  const theme = useTheme();
+  // If resources are provided, show them by default!
+  // This is for Storybook!
+  const [selectedTab, setSelectedTab] = useState(() => (resources ? 1 : 0));
+  const [fileTree, setFileTree] = useState(defaultFileTree);
+  const [createFileOpen, setCreateFileOpen] = useState(false);
+  const [deleteFileOpen, setDeleteFileOpen] = useState<string>();
+  const [renameFileOpen, setRenameFileOpen] = useState<string>();
+  const [dirty, setDirty] = useState(false);
+  const [activePath, setActivePath] = useState<string | undefined>(() =>
+    findInitialFile(fileTree),
+  );
+
+  const triggerPreview = useCallback(() => {
+    onPreview(fileTree);
+    // Switch to the build log!
+    setSelectedTab(0);
+  }, [fileTree, onPreview]);
+
+  // Stop ctrl+s from saving files and make ctrl+enter trigger a preview.
+  useEffect(() => {
+    const keyListener = (event: KeyboardEvent) => {
+      if (!(navigator.platform.match("Mac") ? event.metaKey : event.ctrlKey)) {
+        return;
+      }
+      switch (event.key) {
+        case "s":
+          // Prevent opening the save dialog!
+          event.preventDefault();
+          break;
+        case "Enter":
+          event.preventDefault();
+          triggerPreview();
+          break;
+      }
+    };
+    document.addEventListener("keydown", keyListener);
+    return () => {
+      document.removeEventListener("keydown", keyListener);
+    };
+  }, [triggerPreview]);
+
+  // Automatically switch to the template preview tab when the build succeeds.
+  const previousVersion = useRef<TemplateVersion>();
+  useEffect(() => {
+    if (!previousVersion.current) {
+      previousVersion.current = templateVersion;
+      return;
+    }
+    if (
+      ["running", "pending"].includes(previousVersion.current.job.status) &&
+      templateVersion.job.status === "succeeded"
+    ) {
+      setSelectedTab(1);
+      setDirty(false);
+    }
+    previousVersion.current = templateVersion;
+  }, [templateVersion]);
+
+  const hasIcon = template.icon && template.icon !== "";
+  const showBuildLogs = Boolean(buildLogs);
+  const editorValue = getFileContent(activePath ?? "", fileTree) as string;
+
+  useEffect(() => {
+    window.dispatchEvent(new Event("resize"));
+  }, [showBuildLogs]);
+
+  return (
+    <>
+      <DashboardFullPage
+        css={{
+          background: theme.palette.background.default,
+        }}
+      >
+        <div css={styles.topbar} data-testid="topbar">
+          <div css={styles.topbarSides}>
+            <Link
+              component={RouterLink}
+              underline="none"
+              to={`/templates/${template.name}`}
+            >
+              <AvatarData
+                title={template.display_name || template.name}
+                subtitle={template.description}
+                avatar={
+                  hasIcon && (
+                    <Avatar src={template.icon} variant="square" fitImage />
+                  )
+                }
+              />
+            </Link>
+          </div>
+
+          {publishedVersion && (
+            <Alert
+              severity="success"
+              dismissible
+              actions={
+                <Button variant="text" size="small" onClick={onCreateWorkspace}>
+                  Create a workspace
+                </Button>
+              }
+            >
+              Successfully published {publishedVersion.name}!
+            </Alert>
+          )}
+
+          <div css={styles.topbarSides}>
+            {isBuildingNewVersion && (
+              <TemplateVersionStatusBadge version={templateVersion} />
+            )}
+
+            <Button
+              title="Build template (Ctrl + Enter)"
+              disabled={disablePreview}
+              onClick={() => {
+                triggerPreview();
+              }}
+            >
+              Build template
+            </Button>
+
+            <Button
+              variant="contained"
+              disabled={dirty || disableUpdate}
+              onClick={onPublish}
+            >
+              Publish version
+            </Button>
+          </div>
+        </div>
+
+        <div css={styles.sidebarAndEditor}>
+          <div css={styles.sidebar}>
+            <div css={styles.sidebarTitle}>
+              Template files
+              <div css={styles.sidebarActions}>
+                <Tooltip title="Create File" placement="top">
+                  <IconButton
+                    aria-label="Create File"
+                    onClick={(event) => {
+                      setCreateFileOpen(true);
+                      event.currentTarget.blur();
+                    }}
+                  >
+                    <CreateIcon />
+                  </IconButton>
+                </Tooltip>
+              </div>
+              <CreateFileDialog
+                fileTree={fileTree}
+                open={createFileOpen}
+                onClose={() => {
+                  setCreateFileOpen(false);
+                }}
+                checkExists={(path) => existsFile(path, fileTree)}
+                onConfirm={(path) => {
+                  setFileTree((fileTree) => createFile(path, fileTree, ""));
+                  setActivePath(path);
+                  setCreateFileOpen(false);
+                  setDirty(true);
+                }}
+              />
+              <DeleteFileDialog
+                onConfirm={() => {
+                  if (!deleteFileOpen) {
+                    throw new Error("delete file must be set");
+                  }
+                  setFileTree((fileTree) =>
+                    removeFile(deleteFileOpen, fileTree),
+                  );
+                  setDeleteFileOpen(undefined);
+                  if (activePath === deleteFileOpen) {
+                    setActivePath(undefined);
+                  }
+                  setDirty(true);
+                }}
+                open={Boolean(deleteFileOpen)}
+                onClose={() => setDeleteFileOpen(undefined)}
+                filename={deleteFileOpen || ""}
+              />
+              <RenameFileDialog
+                fileTree={fileTree}
+                open={Boolean(renameFileOpen)}
+                onClose={() => {
+                  setRenameFileOpen(undefined);
+                }}
+                filename={renameFileOpen || ""}
+                checkExists={(path) => existsFile(path, fileTree)}
+                onConfirm={(newPath) => {
+                  if (!renameFileOpen) {
+                    return;
+                  }
+                  setFileTree((fileTree) =>
+                    moveFile(renameFileOpen, newPath, fileTree),
+                  );
+                  setActivePath(newPath);
+                  setRenameFileOpen(undefined);
+                  setDirty(true);
+                }}
+              />
+            </div>
+            <FileTreeView
+              fileTree={fileTree}
+              onDelete={(file) => setDeleteFileOpen(file)}
+              onSelect={(filePath) => {
+                if (!isFolder(filePath, fileTree)) {
+                  setActivePath(filePath);
+                }
+              }}
+              onRename={(file) => setRenameFileOpen(file)}
+              activePath={activePath}
+            />
+          </div>
+
+          <div
+            css={{
+              display: "grid",
+              width: "100%",
+              gridTemplateColumns: showBuildLogs ? "1fr 1fr" : "1fr 0fr",
+              minHeight: "100%",
+              overflow: "hidden",
+            }}
+          >
+            <div css={styles.editor} data-chromatic="ignore">
+              {activePath ? (
+                <MonacoEditor
+                  value={editorValue}
+                  path={activePath}
+                  onChange={(value) => {
+                    if (!activePath) {
+                      return;
+                    }
+                    setFileTree((fileTree) =>
+                      updateFile(activePath, value, fileTree),
+                    );
+                    setDirty(true);
+                  }}
+                />
+              ) : (
+                <div>No file opened</div>
+              )}
+            </div>
+
+            <div css={styles.panelWrapper}>
+              <div css={styles.tabs}>
+                <button
+                  css={styles.tab}
+                  className={selectedTab === 0 ? "active" : ""}
+                  onClick={() => {
+                    setSelectedTab(0);
+                  }}
+                >
+                  {templateVersion.job.status !== "succeeded" ? (
+                    getStatus(templateVersion).icon
+                  ) : (
+                    <BuildIcon />
+                  )}
+                  Build Log
+                </button>
+
+                {!disableUpdate && (
+                  <button
+                    css={styles.tab}
+                    className={selectedTab === 1 ? "active" : ""}
+                    onClick={() => {
+                      setSelectedTab(1);
+                    }}
+                  >
+                    <PreviewIcon />
+                    Workspace Preview
+                  </button>
+                )}
+              </div>
+
+              <div
+                css={[
+                  styles.panel,
+                  {
+                    display: selectedTab !== 0 ? "none" : "flex",
+                    flexDirection: "column",
+                  },
+                ]}
+              >
+                {templateVersion.job.error && (
+                  <div>
+                    <Alert
+                      severity="error"
+                      sx={{
+                        borderRadius: 0,
+                        border: 0,
+                        borderBottom: (theme) =>
+                          `1px solid ${theme.palette.divider}`,
+                        borderLeft: (theme) =>
+                          `2px solid ${theme.palette.error.main}`,
+                      }}
+                    >
+                      <AlertTitle>Error during the build</AlertTitle>
+                      <AlertDetail>{templateVersion.job.error}</AlertDetail>
+                    </Alert>
+                  </div>
+                )}
+
+                {buildLogs && buildLogs.length > 0 && (
+                  <WorkspaceBuildLogs
+                    sx={{ borderRadius: 0, border: 0 }}
+                    hideTimestamps
+                    logs={buildLogs}
+                  />
+                )}
+              </div>
+
+              <div
+                css={[
+                  styles.panel,
+                  {
+                    paddingBottom: theme.spacing(2),
+                    display: selectedTab !== 1 ? "none" : undefined,
+                  },
+                ]}
+              >
+                {resources && (
+                  <TemplateResourcesTable
+                    resources={resources.filter(
+                      (r) => r.workspace_transition === "start",
+                    )}
+                  />
+                )}
+              </div>
+            </div>
+          </div>
+        </div>
+      </DashboardFullPage>
+
+      <PublishTemplateVersionDialog
+        key={templateVersion.name}
+        publishingError={publishingError}
+        open={isAskingPublishParameters || isPublishing}
+        onClose={onCancelPublish}
+        onConfirm={onConfirmPublish}
+        isPublishing={isPublishing}
+        defaultName={templateVersion.name}
+      />
+
+      <MissingTemplateVariablesDialog
+        open={isPromptingMissingVariables}
+        onClose={onCancelSubmitMissingVariableValues}
+        onSubmit={onSubmitMissingVariableValues}
+        missingVariables={missingVariables}
+      />
+    </>
+  );
+};
+
+const styles = {
+  topbar: (theme) => ({
+    padding: theme.spacing(2),
+    borderBottom: `1px solid ${theme.palette.divider}`,
+    display: "flex",
+    alignItems: "center",
+    justifyContent: "space-between",
+    height: topbarHeight,
+    background: theme.palette.background.paper,
+  }),
+  topbarSides: (theme) => ({
+    display: "flex",
+    alignItems: "center",
+    gap: theme.spacing(2),
+  }),
+  sidebarAndEditor: {
+    display: "flex",
+    flex: 1,
+    flexBasis: 0,
+    overflow: "hidden",
+  },
+  sidebar: (theme) => ({
+    minWidth: 256,
+    backgroundColor: theme.palette.background.paper,
+    borderRight: `1px solid ${theme.palette.divider}`,
+  }),
+  sidebarTitle: (theme) => ({
+    fontSize: 10,
+    textTransform: "uppercase",
+    padding: theme.spacing(1, 2),
+    color: theme.palette.text.primary,
+    fontWeight: 500,
+    letterSpacing: "0.5px",
+    display: "flex",
+    alignItems: "center",
+  }),
+  sidebarActions: (theme) => ({
+    marginLeft: "auto",
+    "& svg": {
+      fill: theme.palette.text.primary,
+    },
+  }),
+  editor: {
+    flex: 1,
+  },
+  panelWrapper: (theme) => ({
+    flex: 1,
+    borderLeft: `1px solid ${theme.palette.divider}`,
+    overflow: "hidden",
+    display: "flex",
+    flexDirection: "column",
+  }),
+  panel: {
+    overflowY: "auto",
+    height: "100%",
+
+    // Hack to access customize resource-card from here
+    "& .resource-card": {
+      border: 0,
+    },
+  },
+  tabs: (theme) => ({
+    borderBottom: `1px solid ${theme.palette.divider}`,
+    display: "flex",
+    boxShadow: "#000000 0 6px 6px -6px inset",
+
+    "& .MuiTab-root": {
+      padding: 0,
+      fontSize: 14,
+      textTransform: "none",
+      letterSpacing: "unset",
+    },
+  }),
+  tab: (theme) => ({
+    cursor: "pointer",
+    padding: theme.spacing(1.5),
+    fontSize: 10,
+    textTransform: "uppercase",
+    letterSpacing: "0.5px",
+    fontWeight: 600,
+    background: "transparent",
+    fontFamily: "inherit",
+    border: 0,
+    color: theme.palette.text.secondary,
+    transition: "150ms ease all",
+    display: "flex",
+    gap: 8,
+    alignItems: "center",
+    justifyContent: "center",
+    position: "relative",
+
+    "& svg": {
+      maxWidth: 12,
+      maxHeight: 12,
+    },
+
+    "&.active": {
+      color: theme.palette.text.primary,
+      "&:after": {
+        content: '""',
+        display: "block",
+        width: "100%",
+        height: 1,
+        backgroundColor: theme.palette.text.primary,
+        bottom: -1,
+        position: "absolute",
+      },
+    },
+
+    "&:hover": {
+      color: theme.palette.text.primary,
+    },
+  }),
+  tabBar: (theme) => ({
+    padding: "8px 16px",
+    position: "sticky",
+    top: 0,
+    background: theme.palette.background.default,
+    borderBottom: `1px solid ${theme.palette.divider}`,
+    color: theme.palette.text.primary,
+    textTransform: "uppercase",
+    fontSize: 12,
+
+    "&.top": {
+      borderTop: `1px solid ${theme.palette.divider}`,
+    },
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.test.tsx b/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.test.tsx
new file mode 100644
index 0000000000000..9659c8f6c7098
--- /dev/null
+++ b/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.test.tsx
@@ -0,0 +1,203 @@
+import { renderWithAuth } from "testHelpers/renderHelpers";
+import TemplateVersionEditorPage from "./TemplateVersionEditorPage";
+import { screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import * as api from "api/api";
+import {
+  MockTemplateVersion,
+  MockWorkspaceBuildLogs,
+} from "testHelpers/entities";
+import { Language } from "./PublishTemplateVersionDialog";
+
+// For some reason this component in Jest is throwing a MUI style warning so,
+// since we don't need it for this test, we can mock it out
+jest.mock("components/TemplateResourcesTable/TemplateResourcesTable", () => {
+  return {
+    TemplateResourcesTable: () => <div />,
+  };
+});
+
+test("Use custom name, message and set it as active when publishing", async () => {
+  const user = userEvent.setup();
+  renderWithAuth(<TemplateVersionEditorPage />, {
+    extraRoutes: [
+      {
+        path: "/templates/:templateId",
+        element: <div />,
+      },
+    ],
+  });
+  const topbar = await screen.findByTestId("topbar");
+
+  // Build Template
+  jest.spyOn(api, "uploadFile").mockResolvedValueOnce({ hash: "hash" });
+  jest
+    .spyOn(api, "createTemplateVersion")
+    .mockResolvedValueOnce(MockTemplateVersion);
+  jest
+    .spyOn(api, "getTemplateVersion")
+    .mockResolvedValue({ ...MockTemplateVersion, id: "new-version-id" });
+  jest
+    .spyOn(api, "watchBuildLogsByTemplateVersionId")
+    .mockImplementation((_, options) => {
+      options.onMessage(MockWorkspaceBuildLogs[0]);
+      options.onDone();
+      return jest.fn() as never;
+    });
+  const buildButton = within(topbar).getByRole("button", {
+    name: "Build template",
+  });
+  await user.click(buildButton);
+
+  // Publish
+  const patchTemplateVersion = jest
+    .spyOn(api, "patchTemplateVersion")
+    .mockResolvedValue(MockTemplateVersion);
+  const updateActiveTemplateVersion = jest
+    .spyOn(api, "updateActiveTemplateVersion")
+    .mockResolvedValue({ message: "" });
+  await within(topbar).findByText("Success");
+  const publishButton = within(topbar).getByRole("button", {
+    name: "Publish version",
+  });
+  await user.click(publishButton);
+  const publishDialog = await screen.findByTestId("dialog");
+  const nameField = within(publishDialog).getByLabelText("Version name");
+  await user.clear(nameField);
+  await user.type(nameField, "v1.0");
+  const messageField = within(publishDialog).getByLabelText("Message");
+  await user.clear(messageField);
+  await user.type(messageField, "Informative message");
+  await user.click(
+    within(publishDialog).getByRole("button", { name: "Publish" }),
+  );
+  await waitFor(() => {
+    expect(patchTemplateVersion).toBeCalledWith("new-version-id", {
+      name: "v1.0",
+      message: "Informative message",
+    });
+  });
+  expect(updateActiveTemplateVersion).toBeCalledWith("test-template", {
+    id: "new-version-id",
+  });
+});
+
+test("Do not mark as active if promote is not checked", async () => {
+  const user = userEvent.setup();
+  renderWithAuth(<TemplateVersionEditorPage />, {
+    extraRoutes: [
+      {
+        path: "/templates/:templateId",
+        element: <div />,
+      },
+    ],
+  });
+  const topbar = await screen.findByTestId("topbar");
+
+  // Build Template
+  jest.spyOn(api, "uploadFile").mockResolvedValueOnce({ hash: "hash" });
+  jest
+    .spyOn(api, "createTemplateVersion")
+    .mockResolvedValueOnce(MockTemplateVersion);
+  jest
+    .spyOn(api, "getTemplateVersion")
+    .mockResolvedValue({ ...MockTemplateVersion, id: "new-version-id" });
+  jest
+    .spyOn(api, "watchBuildLogsByTemplateVersionId")
+    .mockImplementation((_, options) => {
+      options.onMessage(MockWorkspaceBuildLogs[0]);
+      options.onDone();
+      return jest.fn() as never;
+    });
+  const buildButton = within(topbar).getByRole("button", {
+    name: "Build template",
+  });
+  await user.click(buildButton);
+
+  // Publish
+  const patchTemplateVersion = jest
+    .spyOn(api, "patchTemplateVersion")
+    .mockResolvedValue(MockTemplateVersion);
+  const updateActiveTemplateVersion = jest
+    .spyOn(api, "updateActiveTemplateVersion")
+    .mockResolvedValue({ message: "" });
+  await within(topbar).findByText("Success");
+  const publishButton = within(topbar).getByRole("button", {
+    name: "Publish version",
+  });
+  await user.click(publishButton);
+  const publishDialog = await screen.findByTestId("dialog");
+  const nameField = within(publishDialog).getByLabelText("Version name");
+  await user.clear(nameField);
+  await user.type(nameField, "v1.0");
+  await user.click(
+    within(publishDialog).getByLabelText(Language.defaultCheckboxLabel),
+  );
+  await user.click(
+    within(publishDialog).getByRole("button", { name: "Publish" }),
+  );
+  await waitFor(() => {
+    expect(patchTemplateVersion).toBeCalledWith("new-version-id", {
+      name: "v1.0",
+      message: "",
+    });
+  });
+  expect(updateActiveTemplateVersion).toBeCalledTimes(0);
+});
+
+test("Patch request is not send when there are no changes", async () => {
+  const MockTemplateVersionWithEmptyMessage = {
+    ...MockTemplateVersion,
+    message: "",
+  };
+  const user = userEvent.setup();
+  renderWithAuth(<TemplateVersionEditorPage />, {
+    extraRoutes: [
+      {
+        path: "/templates/:templateId",
+        element: <div />,
+      },
+    ],
+  });
+  const topbar = await screen.findByTestId("topbar");
+
+  // Build Template
+  jest.spyOn(api, "uploadFile").mockResolvedValueOnce({ hash: "hash" });
+  jest
+    .spyOn(api, "createTemplateVersion")
+    .mockResolvedValueOnce(MockTemplateVersionWithEmptyMessage);
+  jest.spyOn(api, "getTemplateVersion").mockResolvedValue({
+    ...MockTemplateVersionWithEmptyMessage,
+    id: "new-version-id",
+  });
+  jest
+    .spyOn(api, "watchBuildLogsByTemplateVersionId")
+    .mockImplementation((_, options) => {
+      options.onMessage(MockWorkspaceBuildLogs[0]);
+      options.onDone();
+      return jest.fn() as never;
+    });
+  const buildButton = within(topbar).getByRole("button", {
+    name: "Build template",
+  });
+  await user.click(buildButton);
+
+  // Publish
+  const patchTemplateVersion = jest
+    .spyOn(api, "patchTemplateVersion")
+    .mockResolvedValue(MockTemplateVersionWithEmptyMessage);
+  await within(topbar).findByText("Success");
+  const publishButton = within(topbar).getByRole("button", {
+    name: "Publish version",
+  });
+  await user.click(publishButton);
+  const publishDialog = await screen.findByTestId("dialog");
+  // It is using the name from the template version
+  const nameField = within(publishDialog).getByLabelText("Version name");
+  expect(nameField).toHaveValue(MockTemplateVersionWithEmptyMessage.name);
+  // Publish
+  await user.click(
+    within(publishDialog).getByRole("button", { name: "Publish" }),
+  );
+  expect(patchTemplateVersion).toBeCalledTimes(0);
+});
diff --git a/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.tsx b/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.tsx
new file mode 100644
index 0000000000000..3e571900c90f5
--- /dev/null
+++ b/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.tsx
@@ -0,0 +1,115 @@
+import { useMachine } from "@xstate/react";
+import { TemplateVersionEditor } from "./TemplateVersionEditor";
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { useNavigate, useParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import { templateVersionEditorMachine } from "xServices/templateVersionEditor/templateVersionEditorXService";
+import { useTemplateVersionData } from "./data";
+
+type Params = {
+  version: string;
+  template: string;
+};
+
+export const TemplateVersionEditorPage: FC = () => {
+  const navigate = useNavigate();
+  const { version: versionName, template: templateName } =
+    useParams() as Params;
+  const orgId = useOrganizationId();
+  const [editorState, sendEvent] = useMachine(templateVersionEditorMachine, {
+    context: { orgId },
+  });
+  const { isSuccess, data } = useTemplateVersionData(
+    {
+      orgId,
+      templateName,
+      versionName,
+    },
+    {
+      onSuccess(data) {
+        sendEvent({ type: "INITIALIZE", tarReader: data.tarReader });
+      },
+    },
+  );
+
+  return (
+    <>
+      <Helmet>
+        <title>{pageTitle(`${templateName} · Template Editor`)}</title>
+      </Helmet>
+
+      {isSuccess && (
+        <TemplateVersionEditor
+          template={data.template}
+          templateVersion={editorState.context.version || data.version}
+          isBuildingNewVersion={Boolean(editorState.context.version)}
+          defaultFileTree={data.fileTree}
+          onPreview={(fileTree) => {
+            sendEvent({
+              type: "CREATE_VERSION",
+              fileTree,
+              templateId: data.template.id,
+            });
+          }}
+          onPublish={() => {
+            sendEvent({
+              type: "PUBLISH",
+            });
+          }}
+          onCancelPublish={() => {
+            sendEvent({
+              type: "CANCEL_PUBLISH",
+            });
+          }}
+          onConfirmPublish={(data) => {
+            sendEvent({
+              type: "CONFIRM_PUBLISH",
+              ...data,
+            });
+          }}
+          isAskingPublishParameters={editorState.matches(
+            "askPublishParameters",
+          )}
+          isPublishing={editorState.matches("publishingVersion")}
+          publishingError={editorState.context.publishingError}
+          publishedVersion={editorState.context.lastSuccessfulPublishedVersion}
+          onCreateWorkspace={() => {
+            const params = new URLSearchParams();
+            const publishedVersion =
+              editorState.context.lastSuccessfulPublishedVersion;
+            if (publishedVersion) {
+              params.set("version", publishedVersion.id);
+            }
+            navigate(
+              `/templates/${templateName}/workspace?${params.toString()}`,
+            );
+          }}
+          disablePreview={editorState.hasTag("loading")}
+          disableUpdate={
+            editorState.hasTag("loading") ||
+            editorState.context.version?.job.status !== "succeeded"
+          }
+          resources={editorState.context.resources}
+          buildLogs={editorState.context.buildLogs}
+          isPromptingMissingVariables={editorState.matches("promptVariables")}
+          missingVariables={editorState.context.missingVariables}
+          onSubmitMissingVariableValues={(values) => {
+            sendEvent({
+              type: "SET_MISSING_VARIABLE_VALUES",
+              values,
+            });
+          }}
+          onCancelSubmitMissingVariableValues={() => {
+            sendEvent({
+              type: "CANCEL_MISSING_VARIABLE_VALUES",
+            });
+          }}
+        />
+      )}
+    </>
+  );
+};
+
+export default TemplateVersionEditorPage;
diff --git a/site/src/pages/TemplateVersionEditorPage/TemplateVersionStatusBadge.tsx b/site/src/pages/TemplateVersionEditorPage/TemplateVersionStatusBadge.tsx
new file mode 100644
index 0000000000000..efe63454c2838
--- /dev/null
+++ b/site/src/pages/TemplateVersionEditorPage/TemplateVersionStatusBadge.tsx
@@ -0,0 +1,72 @@
+import { type TemplateVersion } from "api/typesGenerated";
+import { type FC, type ReactNode } from "react";
+import CircularProgress from "@mui/material/CircularProgress";
+import ErrorIcon from "@mui/icons-material/ErrorOutline";
+import CheckIcon from "@mui/icons-material/CheckOutlined";
+import { Pill, type PillType } from "components/Pill/Pill";
+
+export const TemplateVersionStatusBadge: FC<{
+  version: TemplateVersion;
+}> = ({ version }) => {
+  const { text, icon, type } = getStatus(version);
+  return (
+    <Pill
+      icon={icon}
+      text={text}
+      type={type}
+      title={`Build status is ${text}`}
+    />
+  );
+};
+
+const LoadingIcon: FC = () => {
+  return <CircularProgress size={10} style={{ color: "#FFF" }} />;
+};
+
+export const getStatus = (
+  version: TemplateVersion,
+): {
+  type?: PillType;
+  text: string;
+  icon: ReactNode;
+} => {
+  switch (version.job.status) {
+    case "running":
+      return {
+        type: "info",
+        text: "Running",
+        icon: <LoadingIcon />,
+      };
+    case "pending":
+      return {
+        text: "Pending",
+        icon: <LoadingIcon />,
+        type: "info",
+      };
+    case "canceling":
+      return {
+        type: "warning",
+        text: "Canceling",
+        icon: <LoadingIcon />,
+      };
+    case "canceled":
+      return {
+        type: "warning",
+        text: "Canceled",
+        icon: <ErrorIcon />,
+      };
+    case "unknown":
+    case "failed":
+      return {
+        type: "error",
+        text: "Failed",
+        icon: <ErrorIcon />,
+      };
+    case "succeeded":
+      return {
+        type: "success",
+        text: "Success",
+        icon: <CheckIcon />,
+      };
+  }
+};
diff --git a/site/src/pages/TemplateVersionEditorPage/data.ts b/site/src/pages/TemplateVersionEditorPage/data.ts
new file mode 100644
index 0000000000000..19039d212c7d9
--- /dev/null
+++ b/site/src/pages/TemplateVersionEditorPage/data.ts
@@ -0,0 +1,47 @@
+import { useQuery, UseQueryOptions } from "react-query";
+import { getFile, getTemplateByName, getTemplateVersionByName } from "api/api";
+import { TarReader } from "utils/tar";
+import { createTemplateVersionFileTree } from "utils/templateVersion";
+
+const getTemplateVersionData = async (
+  orgId: string,
+  templateName: string,
+  versionName: string,
+) => {
+  const [template, version] = await Promise.all([
+    getTemplateByName(orgId, templateName),
+    getTemplateVersionByName(orgId, templateName, versionName),
+  ]);
+  const tarFile = await getFile(version.job.file_id);
+  const tarReader = new TarReader();
+  await tarReader.readFile(tarFile);
+  const fileTree = await createTemplateVersionFileTree(tarReader);
+
+  return {
+    template,
+    version,
+    fileTree,
+    tarReader,
+  };
+};
+
+type GetTemplateVersionResponse = Awaited<
+  ReturnType<typeof getTemplateVersionData>
+>;
+
+type UseTemplateVersionDataParams = {
+  orgId: string;
+  templateName: string;
+  versionName: string;
+};
+
+export const useTemplateVersionData = (
+  { templateName, versionName, orgId }: UseTemplateVersionDataParams,
+  options?: UseQueryOptions<GetTemplateVersionResponse>,
+) => {
+  return useQuery({
+    queryKey: ["templateVersion", templateName, versionName],
+    queryFn: () => getTemplateVersionData(orgId, templateName, versionName),
+    ...options,
+  });
+};
diff --git a/site/src/pages/TemplateVersionEditorPage/types.ts b/site/src/pages/TemplateVersionEditorPage/types.ts
new file mode 100644
index 0000000000000..c31c745a4058e
--- /dev/null
+++ b/site/src/pages/TemplateVersionEditorPage/types.ts
@@ -0,0 +1,5 @@
+export type PublishVersionData = {
+  name: string;
+  message: string;
+  isActiveVersion: boolean;
+};
diff --git a/site/src/pages/TemplateVersionPage/TemplateVersionEditorPage/TemplateVersionEditorPage.test.tsx b/site/src/pages/TemplateVersionPage/TemplateVersionEditorPage/TemplateVersionEditorPage.test.tsx
deleted file mode 100644
index b969363951fc8..0000000000000
--- a/site/src/pages/TemplateVersionPage/TemplateVersionEditorPage/TemplateVersionEditorPage.test.tsx
+++ /dev/null
@@ -1,202 +0,0 @@
-import { renderWithAuth } from "testHelpers/renderHelpers"
-import TemplateVersionEditorPage from "./TemplateVersionEditorPage"
-import { screen, waitFor, within } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
-import * as api from "api/api"
-import {
-  MockTemplateVersion,
-  MockWorkspaceBuildLogs,
-} from "testHelpers/entities"
-
-// For some reason this component in Jest is throwing a MUI style warning so,
-// since we don't need it for this test, we can mock it out
-jest.mock("components/TemplateResourcesTable/TemplateResourcesTable", () => {
-  return {
-    TemplateResourcesTable: () => <div />,
-  }
-})
-
-test("Use custom name, message and set it as active when publishing", async () => {
-  const user = userEvent.setup()
-  renderWithAuth(<TemplateVersionEditorPage />, {
-    extraRoutes: [
-      {
-        path: "/templates/:templateId",
-        element: <div />,
-      },
-    ],
-  })
-  const topbar = await screen.findByTestId("topbar")
-
-  // Build Template
-  jest.spyOn(api, "uploadTemplateFile").mockResolvedValueOnce({ hash: "hash" })
-  jest
-    .spyOn(api, "createTemplateVersion")
-    .mockResolvedValueOnce(MockTemplateVersion)
-  jest
-    .spyOn(api, "getTemplateVersion")
-    .mockResolvedValue({ ...MockTemplateVersion, id: "new-version-id" })
-  jest
-    .spyOn(api, "watchBuildLogsByTemplateVersionId")
-    .mockImplementation((_, options) => {
-      options.onMessage(MockWorkspaceBuildLogs[0])
-      options.onDone()
-      return jest.fn() as never
-    })
-  const buildButton = within(topbar).getByRole("button", {
-    name: "Build template",
-  })
-  await user.click(buildButton)
-
-  // Publish
-  const patchTemplateVersion = jest
-    .spyOn(api, "patchTemplateVersion")
-    .mockResolvedValue(MockTemplateVersion)
-  const updateActiveTemplateVersion = jest
-    .spyOn(api, "updateActiveTemplateVersion")
-    .mockResolvedValue({ message: "" })
-  await within(topbar).findByText("Success")
-  const publishButton = within(topbar).getByRole("button", {
-    name: "Publish version",
-  })
-  await user.click(publishButton)
-  const publishDialog = await screen.findByTestId("dialog")
-  const nameField = within(publishDialog).getByLabelText("Version name")
-  await user.clear(nameField)
-  await user.type(nameField, "v1.0")
-  const messageField = within(publishDialog).getByLabelText("Message")
-  await user.clear(messageField)
-  await user.type(messageField, "Informative message")
-  await user.click(
-    within(publishDialog).getByLabelText("Promote to default version"),
-  )
-  await user.click(
-    within(publishDialog).getByRole("button", { name: "Publish" }),
-  )
-  await waitFor(() => {
-    expect(patchTemplateVersion).toBeCalledWith("new-version-id", {
-      name: "v1.0",
-      message: "Informative message",
-    })
-  })
-  expect(updateActiveTemplateVersion).toBeCalledWith("test-template", {
-    id: "new-version-id",
-  })
-})
-
-test("Do not mark as active if promote is not checked", async () => {
-  const user = userEvent.setup()
-  renderWithAuth(<TemplateVersionEditorPage />, {
-    extraRoutes: [
-      {
-        path: "/templates/:templateId",
-        element: <div />,
-      },
-    ],
-  })
-  const topbar = await screen.findByTestId("topbar")
-
-  // Build Template
-  jest.spyOn(api, "uploadTemplateFile").mockResolvedValueOnce({ hash: "hash" })
-  jest
-    .spyOn(api, "createTemplateVersion")
-    .mockResolvedValueOnce(MockTemplateVersion)
-  jest
-    .spyOn(api, "getTemplateVersion")
-    .mockResolvedValue({ ...MockTemplateVersion, id: "new-version-id" })
-  jest
-    .spyOn(api, "watchBuildLogsByTemplateVersionId")
-    .mockImplementation((_, options) => {
-      options.onMessage(MockWorkspaceBuildLogs[0])
-      options.onDone()
-      return jest.fn() as never
-    })
-  const buildButton = within(topbar).getByRole("button", {
-    name: "Build template",
-  })
-  await user.click(buildButton)
-
-  // Publish
-  const patchTemplateVersion = jest
-    .spyOn(api, "patchTemplateVersion")
-    .mockResolvedValue(MockTemplateVersion)
-  const updateActiveTemplateVersion = jest
-    .spyOn(api, "updateActiveTemplateVersion")
-    .mockResolvedValue({ message: "" })
-  await within(topbar).findByText("Success")
-  const publishButton = within(topbar).getByRole("button", {
-    name: "Publish version",
-  })
-  await user.click(publishButton)
-  const publishDialog = await screen.findByTestId("dialog")
-  const nameField = within(publishDialog).getByLabelText("Version name")
-  await user.clear(nameField)
-  await user.type(nameField, "v1.0")
-  await user.click(
-    within(publishDialog).getByRole("button", { name: "Publish" }),
-  )
-  await waitFor(() => {
-    expect(patchTemplateVersion).toBeCalledWith("new-version-id", {
-      name: "v1.0",
-      message: "",
-    })
-  })
-  expect(updateActiveTemplateVersion).toBeCalledTimes(0)
-})
-
-test("Patch request is not send when there are no changes", async () => {
-  const MockTemplateVersionWithEmptyMessage = {
-    ...MockTemplateVersion,
-    message: "",
-  }
-  const user = userEvent.setup()
-  renderWithAuth(<TemplateVersionEditorPage />, {
-    extraRoutes: [
-      {
-        path: "/templates/:templateId",
-        element: <div />,
-      },
-    ],
-  })
-  const topbar = await screen.findByTestId("topbar")
-
-  // Build Template
-  jest.spyOn(api, "uploadTemplateFile").mockResolvedValueOnce({ hash: "hash" })
-  jest
-    .spyOn(api, "createTemplateVersion")
-    .mockResolvedValueOnce(MockTemplateVersionWithEmptyMessage)
-  jest.spyOn(api, "getTemplateVersion").mockResolvedValue({
-    ...MockTemplateVersionWithEmptyMessage,
-    id: "new-version-id",
-  })
-  jest
-    .spyOn(api, "watchBuildLogsByTemplateVersionId")
-    .mockImplementation((_, options) => {
-      options.onMessage(MockWorkspaceBuildLogs[0])
-      options.onDone()
-      return jest.fn() as never
-    })
-  const buildButton = within(topbar).getByRole("button", {
-    name: "Build template",
-  })
-  await user.click(buildButton)
-
-  // Publish
-  const patchTemplateVersion = jest
-    .spyOn(api, "patchTemplateVersion")
-    .mockResolvedValue(MockTemplateVersionWithEmptyMessage)
-  await within(topbar).findByText("Success")
-  const publishButton = within(topbar).getByRole("button", {
-    name: "Publish version",
-  })
-  await user.click(publishButton)
-  const publishDialog = await screen.findByTestId("dialog")
-  // It is using the name from the template version
-  const nameField = within(publishDialog).getByLabelText("Version name")
-  expect(nameField).toHaveValue(MockTemplateVersionWithEmptyMessage.name)
-  // Publish
-  await user.click(
-    within(publishDialog).getByRole("button", { name: "Publish" }),
-  )
-  expect(patchTemplateVersion).toBeCalledTimes(0)
-})
diff --git a/site/src/pages/TemplateVersionPage/TemplateVersionEditorPage/TemplateVersionEditorPage.tsx b/site/src/pages/TemplateVersionPage/TemplateVersionEditorPage/TemplateVersionEditorPage.tsx
deleted file mode 100644
index 0bcfe6cbbf253..0000000000000
--- a/site/src/pages/TemplateVersionPage/TemplateVersionEditorPage/TemplateVersionEditorPage.tsx
+++ /dev/null
@@ -1,109 +0,0 @@
-import { useMachine } from "@xstate/react"
-import { TemplateVersionEditor } from "components/TemplateVersionEditor/TemplateVersionEditor"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { usePermissions } from "hooks/usePermissions"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useNavigate, useParams } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import { templateVersionEditorMachine } from "xServices/templateVersionEditor/templateVersionEditorXService"
-import { useTemplateVersionData } from "./data"
-
-type Params = {
-  version: string
-  template: string
-}
-
-export const TemplateVersionEditorPage: FC = () => {
-  const { version: versionName, template: templateName } = useParams() as Params
-  const navigate = useNavigate()
-  const orgId = useOrganizationId()
-  const [editorState, sendEvent] = useMachine(templateVersionEditorMachine, {
-    context: { orgId },
-    actions: {
-      onPublish: () => {
-        navigate(`/templates/${templateName}`)
-      },
-    },
-  })
-  const permissions = usePermissions()
-  const { isSuccess, data } = useTemplateVersionData(
-    {
-      orgId,
-      templateName,
-      versionName,
-    },
-    {
-      onSuccess(data) {
-        sendEvent({ type: "INITIALIZE", tarReader: data.tarReader })
-      },
-    },
-  )
-
-  return (
-    <>
-      <Helmet>
-        <title>{pageTitle(`${templateName} · Template Editor`)}</title>
-      </Helmet>
-
-      {isSuccess && (
-        <TemplateVersionEditor
-          template={data.template}
-          deploymentBannerVisible={permissions.viewDeploymentStats}
-          templateVersion={editorState.context.version || data.version}
-          defaultFileTree={data.fileTree}
-          onPreview={(fileTree) => {
-            sendEvent({
-              type: "CREATE_VERSION",
-              fileTree,
-              templateId: data.template.id,
-            })
-          }}
-          onCancelPublish={() => {
-            sendEvent({
-              type: "CANCEL_PUBLISH",
-            })
-          }}
-          onPublish={() => {
-            sendEvent({
-              type: "PUBLISH",
-            })
-          }}
-          onConfirmPublish={(data) => {
-            sendEvent({
-              type: "CONFIRM_PUBLISH",
-              ...data,
-            })
-          }}
-          isAskingPublishParameters={editorState.matches(
-            "askPublishParameters",
-          )}
-          publishingError={editorState.context.publishingError}
-          isPublishing={editorState.matches("publishingVersion")}
-          disablePreview={editorState.hasTag("loading")}
-          disableUpdate={
-            editorState.hasTag("loading") ||
-            editorState.context.version?.job.status !== "succeeded"
-          }
-          resources={editorState.context.resources}
-          buildLogs={editorState.context.buildLogs}
-          isPromptingMissingVariables={editorState.matches("promptVariables")}
-          missingVariables={editorState.context.missingVariables}
-          onSubmitMissingVariableValues={(values) => {
-            sendEvent({
-              type: "SET_MISSING_VARIABLE_VALUES",
-              values,
-            })
-          }}
-          onCancelSubmitMissingVariableValues={() => {
-            sendEvent({
-              type: "CANCEL_MISSING_VARIABLE_VALUES",
-            })
-          }}
-        />
-      )}
-    </>
-  )
-}
-
-export default TemplateVersionEditorPage
diff --git a/site/src/pages/TemplateVersionPage/TemplateVersionEditorPage/data.ts b/site/src/pages/TemplateVersionPage/TemplateVersionEditorPage/data.ts
deleted file mode 100644
index fba82b39b2ec7..0000000000000
--- a/site/src/pages/TemplateVersionPage/TemplateVersionEditorPage/data.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-import { useQuery, UseQueryOptions } from "@tanstack/react-query"
-import { getFile, getTemplateByName, getTemplateVersionByName } from "api/api"
-import { TarReader } from "utils/tar"
-import { createTemplateVersionFileTree } from "utils/templateVersion"
-
-const getTemplateVersionData = async (
-  orgId: string,
-  templateName: string,
-  versionName: string,
-) => {
-  const [template, version] = await Promise.all([
-    getTemplateByName(orgId, templateName),
-    getTemplateVersionByName(orgId, templateName, versionName),
-  ])
-  const tarFile = await getFile(version.job.file_id)
-  const tarReader = new TarReader()
-  await tarReader.readFile(tarFile)
-  const fileTree = await createTemplateVersionFileTree(tarReader)
-
-  return {
-    template,
-    version,
-    fileTree,
-    tarReader,
-  }
-}
-
-type GetTemplateVersionResponse = Awaited<
-  ReturnType<typeof getTemplateVersionData>
->
-
-type UseTemplateVersionDataParams = {
-  orgId: string
-  templateName: string
-  versionName: string
-}
-
-export const useTemplateVersionData = (
-  { templateName, versionName, orgId }: UseTemplateVersionDataParams,
-  options?: UseQueryOptions<GetTemplateVersionResponse>,
-) => {
-  return useQuery({
-    queryKey: ["templateVersion", templateName, versionName],
-    queryFn: () => getTemplateVersionData(orgId, templateName, versionName),
-    ...options,
-  })
-}
diff --git a/site/src/pages/TemplateVersionPage/TemplateVersionEditorPage/types.ts b/site/src/pages/TemplateVersionPage/TemplateVersionEditorPage/types.ts
deleted file mode 100644
index f3ab9aa537e3e..0000000000000
--- a/site/src/pages/TemplateVersionPage/TemplateVersionEditorPage/types.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-export type PublishVersionData = {
-  name: string
-  message: string
-  isActiveVersion: boolean
-}
diff --git a/site/src/pages/TemplateVersionPage/TemplateVersionPage.test.tsx b/site/src/pages/TemplateVersionPage/TemplateVersionPage.test.tsx
index 25659bfe28cae..2f33cc0384c3e 100644
--- a/site/src/pages/TemplateVersionPage/TemplateVersionPage.test.tsx
+++ b/site/src/pages/TemplateVersionPage/TemplateVersionPage.test.tsx
@@ -1,42 +1,42 @@
 import {
   renderWithAuth,
   waitForLoaderToBeRemoved,
-} from "testHelpers/renderHelpers"
-import TemplateVersionPage from "./TemplateVersionPage"
-import * as templateVersionUtils from "utils/templateVersion"
-import { screen } from "@testing-library/react"
-import * as CreateDayString from "utils/createDayString"
+} from "testHelpers/renderHelpers";
+import TemplateVersionPage from "./TemplateVersionPage";
+import * as templateVersionUtils from "utils/templateVersion";
+import { screen } from "@testing-library/react";
+import * as CreateDayString from "utils/createDayString";
 
-const TEMPLATE_NAME = "coder-ts"
-const VERSION_NAME = "12345"
-const TERRAFORM_FILENAME = "main.tf"
-const README_FILENAME = "readme.md"
+const TEMPLATE_NAME = "coder-ts";
+const VERSION_NAME = "12345";
+const TERRAFORM_FILENAME = "main.tf";
+const README_FILENAME = "readme.md";
 const TEMPLATE_VERSION_FILES = {
   [TERRAFORM_FILENAME]: "{}",
   [README_FILENAME]: "Readme",
-}
+};
 
 const setup = async () => {
   jest
     .spyOn(templateVersionUtils, "getTemplateVersionFiles")
-    .mockResolvedValue(TEMPLATE_VERSION_FILES)
+    .mockResolvedValue(TEMPLATE_VERSION_FILES);
 
   jest
     .spyOn(CreateDayString, "createDayString")
-    .mockImplementation(() => "a minute ago")
+    .mockImplementation(() => "a minute ago");
 
   renderWithAuth(<TemplateVersionPage />, {
     route: `/templates/${TEMPLATE_NAME}/versions/${VERSION_NAME}`,
     path: "/templates/:template/versions/:version",
-  })
-  await waitForLoaderToBeRemoved()
-}
+  });
+  await waitForLoaderToBeRemoved();
+};
 
 describe("TemplateVersionPage", () => {
-  beforeEach(setup)
+  beforeEach(setup);
 
   it("shows files", () => {
-    expect(screen.getByText(TERRAFORM_FILENAME)).toBeInTheDocument()
-    expect(screen.getByText(README_FILENAME)).toBeInTheDocument()
-  })
-})
+    expect(screen.getByText(TERRAFORM_FILENAME)).toBeInTheDocument();
+    expect(screen.getByText(README_FILENAME)).toBeInTheDocument();
+  });
+});
diff --git a/site/src/pages/TemplateVersionPage/TemplateVersionPage.tsx b/site/src/pages/TemplateVersionPage/TemplateVersionPage.tsx
index 3664ae88bdcc3..491e57a576571 100644
--- a/site/src/pages/TemplateVersionPage/TemplateVersionPage.tsx
+++ b/site/src/pages/TemplateVersionPage/TemplateVersionPage.tsx
@@ -1,44 +1,62 @@
-import { useMachine } from "@xstate/react"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { useTab } from "hooks/useTab"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useTranslation } from "react-i18next"
-import { useParams } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import { templateVersionMachine } from "xServices/templateVersion/templateVersionXService"
-import TemplateVersionPageView from "./TemplateVersionPageView"
+import { usePermissions } from "hooks/usePermissions";
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { type FC, useMemo } from "react";
+import { Helmet } from "react-helmet-async";
+import { useParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import TemplateVersionPageView from "./TemplateVersionPageView";
+import { useQuery } from "react-query";
+import { templateVersionByName } from "api/queries/templates";
+import { useFileTab, useTemplateFiles } from "components/TemplateFiles/hooks";
 
 type Params = {
-  version: string
-  template: string
-}
+  version: string;
+  template: string;
+};
 
 export const TemplateVersionPage: FC = () => {
-  const { version: versionName, template: templateName } = useParams() as Params
-  const orgId = useOrganizationId()
-  const [state] = useMachine(templateVersionMachine, {
-    context: { templateName, versionName, orgId },
-  })
-  const tab = useTab("file", "0")
-  const { t } = useTranslation("templateVersionPage")
+  const { version: versionName, template: templateName } =
+    useParams() as Params;
+  const orgId = useOrganizationId();
+  const templateVersionQuery = useQuery(
+    templateVersionByName(orgId, templateName, versionName),
+  );
+  const { data: templateFiles, error: templateFilesError } = useTemplateFiles(
+    templateName,
+    templateVersionQuery.data,
+  );
+  const tab = useFileTab(templateFiles?.currentFiles);
+  const permissions = usePermissions();
+  const versionId = templateVersionQuery.data?.id;
+  const createWorkspaceUrl = useMemo(() => {
+    const params = new URLSearchParams();
+    if (versionId) {
+      params.set("version", versionId);
+      return `/templates/${templateName}/workspace?${params.toString()}`;
+    }
+    return undefined;
+  }, [templateName, versionId]);
 
   return (
     <>
       <Helmet>
-        <title>
-          {pageTitle(`${t("title")} ${versionName} · ${templateName}`)}
-        </title>
+        <title>{pageTitle(`Version ${versionName} · ${templateName}`)}</title>
       </Helmet>
 
       <TemplateVersionPageView
-        context={state.context}
+        error={templateVersionQuery.error || templateFilesError}
+        currentVersion={templateVersionQuery.data}
+        currentFiles={templateFiles?.currentFiles}
+        previousFiles={templateFiles?.previousFiles}
         versionName={versionName}
         templateName={templateName}
         tab={tab}
+        createWorkspaceUrl={
+          permissions.updateTemplates ? createWorkspaceUrl : undefined
+        }
       />
     </>
-  )
-}
+  );
+};
 
-export default TemplateVersionPage
+export default TemplateVersionPage;
diff --git a/site/src/pages/TemplateVersionPage/TemplateVersionPageView.stories.tsx b/site/src/pages/TemplateVersionPage/TemplateVersionPageView.stories.tsx
index 0c259c2eaf515..feb0d49f95f7a 100644
--- a/site/src/pages/TemplateVersionPage/TemplateVersionPageView.stories.tsx
+++ b/site/src/pages/TemplateVersionPage/TemplateVersionPageView.stories.tsx
@@ -1,30 +1,20 @@
-import { action } from "@storybook/addon-actions"
-import { Story } from "@storybook/react"
-import { UseTabResult } from "hooks/useTab"
+import { action } from "@storybook/addon-actions";
+import { UseTabResult } from "hooks/useTab";
 import {
   mockApiError,
-  MockOrganization,
   MockTemplate,
   MockTemplateVersion,
-} from "testHelpers/entities"
+} from "testHelpers/entities";
 import {
   TemplateVersionPageView,
   TemplateVersionPageViewProps,
-} from "./TemplateVersionPageView"
-
-export default {
-  title: "pages/TemplateVersionPageView",
-  component: TemplateVersionPageView,
-}
-
-const Template: Story<TemplateVersionPageViewProps> = (args) => (
-  <TemplateVersionPageView {...args} />
-)
+} from "./TemplateVersionPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
 const tab: UseTabResult = {
   value: "0",
   set: action("changeTab"),
-}
+};
 
 const readmeContent = `---
 name:Template test
@@ -35,36 +25,41 @@ You can add instructions here
 [Some link info](https://coder.com)
 \`\`\`
 # This is a really long sentence to test that the code block wraps into a new line properly.
-\`\`\``
+\`\`\``;
 
 const defaultArgs: TemplateVersionPageViewProps = {
   tab,
   templateName: MockTemplate.name,
   versionName: MockTemplateVersion.name,
-  context: {
-    templateName: MockTemplate.name,
-    orgId: MockOrganization.id,
-    versionName: MockTemplateVersion.name,
-    currentVersion: MockTemplateVersion,
-    currentFiles: {
-      "README.md": readmeContent,
-      "main.tf": `{}`,
-    },
+  currentVersion: MockTemplateVersion,
+  currentFiles: {
+    "README.md": readmeContent,
+    "main.tf": `{}`,
+    "some.tpl": `{{.Name}}`,
+    "some.sh": `echo "Hello world"`,
   },
-}
+  previousFiles: undefined,
+  error: undefined,
+};
+
+const meta: Meta<typeof TemplateVersionPageView> = {
+  title: "pages/TemplateVersionPage",
+  component: TemplateVersionPageView,
+  args: defaultArgs,
+};
+
+export default meta;
+type Story = StoryObj<typeof TemplateVersionPageView>;
 
-export const Default = Template.bind({})
-Default.args = defaultArgs
+export const Default: Story = {};
 
-export const Error = Template.bind({})
-Error.args = {
-  ...defaultArgs,
-  context: {
-    ...defaultArgs.context,
+export const Error: Story = {
+  args: {
+    ...defaultArgs,
     currentVersion: undefined,
     currentFiles: undefined,
     error: mockApiError({
       message: "Error on loading the template version",
     }),
   },
-}
+};
diff --git a/site/src/pages/TemplateVersionPage/TemplateVersionPageView.tsx b/site/src/pages/TemplateVersionPage/TemplateVersionPageView.tsx
index 5a87a120f77ae..44107caffeef6 100644
--- a/site/src/pages/TemplateVersionPage/TemplateVersionPageView.tsx
+++ b/site/src/pages/TemplateVersionPage/TemplateVersionPageView.tsx
@@ -1,57 +1,72 @@
-import Button from "@mui/material/Button"
-import Link from "@mui/material/Link"
-import EditIcon from "@mui/icons-material/Edit"
-import { Loader } from "components/Loader/Loader"
-import { Margins } from "components/Margins/Margins"
+import Button from "@mui/material/Button";
+import AddIcon from "@mui/icons-material/Add";
+import EditIcon from "@mui/icons-material/Edit";
+import { Loader } from "components/Loader/Loader";
+import { Margins } from "components/Margins/Margins";
 import {
   PageHeader,
   PageHeaderCaption,
   PageHeaderSubtitle,
   PageHeaderTitle,
-} from "components/PageHeader/PageHeader"
-import { Stack } from "components/Stack/Stack"
-import { Stats, StatsItem } from "components/Stats/Stats"
-import { TemplateFiles } from "components/TemplateFiles/TemplateFiles"
-import { UseTabResult } from "hooks/useTab"
-import { FC } from "react"
-import { useTranslation } from "react-i18next"
-import { Link as RouterLink } from "react-router-dom"
-import { createDayString } from "utils/createDayString"
-import { TemplateVersionMachineContext } from "xServices/templateVersion/templateVersionXService"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
+} from "components/PageHeader/PageHeader";
+import { Stack } from "components/Stack/Stack";
+import { Stats, StatsItem } from "components/Stats/Stats";
+import { TemplateFiles } from "components/TemplateFiles/TemplateFiles";
+import { UseTabResult } from "hooks/useTab";
+import { type FC } from "react";
+import { Link as RouterLink } from "react-router-dom";
+import { createDayString } from "utils/createDayString";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { TemplateVersion } from "api/typesGenerated";
+import { TemplateVersionFiles } from "utils/templateVersion";
 
 export interface TemplateVersionPageViewProps {
-  /**
-   * Used to display the version name before loading the version in the API
-   */
-  versionName: string
-  templateName: string
-  tab: UseTabResult
-  context: TemplateVersionMachineContext
+  versionName: string;
+  templateName: string;
+  tab: UseTabResult;
+  createWorkspaceUrl?: string;
+  error: unknown;
+  currentVersion: TemplateVersion | undefined;
+  currentFiles: TemplateVersionFiles | undefined;
+  previousFiles: TemplateVersionFiles | undefined;
 }
 
 export const TemplateVersionPageView: FC<TemplateVersionPageViewProps> = ({
-  context,
   tab,
   versionName,
   templateName,
+  createWorkspaceUrl,
+  currentVersion,
+  currentFiles,
+  previousFiles,
+  error,
 }) => {
-  const { currentFiles, error, currentVersion, previousFiles } = context
-  const { t } = useTranslation("templateVersionPage")
-
   return (
     <Margins>
       <PageHeader
         actions={
-          <Link
-            component={RouterLink}
-            to={`/templates/${templateName}/versions/${versionName}/edit`}
-          >
-            <Button startIcon={<EditIcon />}>Edit</Button>
-          </Link>
+          <>
+            {createWorkspaceUrl && (
+              <Button
+                variant="contained"
+                startIcon={<AddIcon />}
+                component={RouterLink}
+                to={createWorkspaceUrl}
+              >
+                Create workspace
+              </Button>
+            )}
+            <Button
+              startIcon={<EditIcon />}
+              component={RouterLink}
+              to={`/templates/${templateName}/versions/${versionName}/edit`}
+            >
+              Edit
+            </Button>
+          </>
         }
       >
-        <PageHeaderCaption>{t("header.caption")}</PageHeaderCaption>
+        <PageHeaderCaption>Version</PageHeaderCaption>
         <PageHeaderTitle>{versionName}</PageHeaderTitle>
         {currentVersion &&
           currentVersion.message &&
@@ -68,7 +83,7 @@ export const TemplateVersionPageView: FC<TemplateVersionPageViewProps> = ({
           <>
             <Stats>
               <StatsItem
-                label={t("stats.template")}
+                label="Template"
                 value={
                   <RouterLink to={`/templates/${templateName}`}>
                     {templateName}
@@ -76,11 +91,11 @@ export const TemplateVersionPageView: FC<TemplateVersionPageViewProps> = ({
                 }
               />
               <StatsItem
-                label={t("stats.createdBy")}
+                label="Created by"
                 value={currentVersion.created_by.username}
               />
               <StatsItem
-                label={t("stats.created")}
+                label="Created"
                 value={createDayString(currentVersion.created_at)}
               />
             </Stats>
@@ -94,7 +109,7 @@ export const TemplateVersionPageView: FC<TemplateVersionPageViewProps> = ({
         )}
       </Stack>
     </Margins>
-  )
-}
+  );
+};
 
-export default TemplateVersionPageView
+export default TemplateVersionPageView;
diff --git a/site/src/pages/TemplatesPage/EmptyTemplates.tsx b/site/src/pages/TemplatesPage/EmptyTemplates.tsx
index 228cc3c83e727..62e89705c8e41 100644
--- a/site/src/pages/TemplatesPage/EmptyTemplates.tsx
+++ b/site/src/pages/TemplatesPage/EmptyTemplates.tsx
@@ -1,16 +1,14 @@
-import Button from "@mui/material/Button"
-import Link from "@mui/material/Link"
-import { makeStyles } from "@mui/styles"
-import { TemplateExample } from "api/typesGenerated"
-import { CodeExample } from "components/CodeExample/CodeExample"
-import { Stack } from "components/Stack/Stack"
-import { TableEmpty } from "components/TableEmpty/TableEmpty"
-import { TemplateExampleCard } from "components/TemplateExampleCard/TemplateExampleCard"
-import { FC } from "react"
-import { useTranslation } from "react-i18next"
-import { Link as RouterLink } from "react-router-dom"
-import { docs } from "utils/docs"
-import { Permissions } from "xServices/auth/authXService"
+import { type Interpolation, type Theme } from "@emotion/react";
+import Button from "@mui/material/Button";
+import Link from "@mui/material/Link";
+import { Link as RouterLink } from "react-router-dom";
+import { type FC } from "react";
+import type { TemplateExample } from "api/typesGenerated";
+import { CodeExample } from "components/CodeExample/CodeExample";
+import { Stack } from "components/Stack/Stack";
+import { TableEmpty } from "components/TableEmpty/TableEmpty";
+import { TemplateExampleCard } from "components/TemplateExampleCard/TemplateExampleCard";
+import { docs } from "utils/docs";
 
 // Those are from https://github.com/coder/coder/tree/main/examples/templates
 const featuredExampleIds = [
@@ -20,42 +18,40 @@ const featuredExampleIds = [
   "aws-windows",
   "gcp-linux",
   "gcp-windows",
-]
+];
 
 const findFeaturedExamples = (examples: TemplateExample[]) => {
-  const featuredExamples: TemplateExample[] = []
+  const featuredExamples: TemplateExample[] = [];
 
   // We loop the featuredExampleIds first to keep the order
   featuredExampleIds.forEach((exampleId) => {
     examples.forEach((example) => {
       if (exampleId === example.id) {
-        featuredExamples.push(example)
+        featuredExamples.push(example);
       }
-    })
-  })
+    });
+  });
 
-  return featuredExamples
-}
+  return featuredExamples;
+};
 
 export const EmptyTemplates: FC<{
-  permissions: Permissions
-  examples: TemplateExample[]
-}> = ({ permissions, examples }) => {
-  const styles = useStyles()
-  const { t } = useTranslation("templatesPage")
-  const featuredExamples = findFeaturedExamples(examples)
+  canCreateTemplates: boolean;
+  examples: TemplateExample[];
+}> = ({ canCreateTemplates, examples }) => {
+  const featuredExamples = findFeaturedExamples(examples);
 
-  if (permissions.createTemplates) {
+  if (canCreateTemplates) {
     return (
       <TableEmpty
-        message={t("empty.message")}
+        message="Create a Template"
         description={
           <>
             Templates are written in Terraform and describe the infrastructure
             for workspaces (e.g., docker_container, aws_instance,
             kubernetes_pod). Select a starter template below or
             <Link
-              href={docs("/templates#add-a-template")}
+              href={docs("/templates/tutorial")}
               target="_blank"
               rel="noreferrer"
             >
@@ -66,12 +62,12 @@ export const EmptyTemplates: FC<{
         }
         cta={
           <Stack alignItems="center" spacing={4}>
-            <div className={styles.featuredExamples}>
+            <div css={styles.featuredExamples}>
               {featuredExamples.map((example) => (
                 <TemplateExampleCard
                   example={example}
                   key={example.id}
-                  className={styles.template}
+                  css={styles.template}
                 />
               ))}
             </div>
@@ -80,37 +76,37 @@ export const EmptyTemplates: FC<{
               size="small"
               component={RouterLink}
               to="/starter-templates"
-              className={styles.viewAllButton}
+              css={styles.viewAllButton}
             >
               View all starter templates
             </Button>
           </Stack>
         }
       />
-    )
+    );
   }
 
   return (
     <TableEmpty
-      className={styles.withImage}
-      message={t("empty.message")}
-      description={t("empty.descriptionWithoutPermissions")}
+      css={styles.withImage}
+      message="Create a Template"
+      description="Contact your Coder administrator to create a template. You can share the code below."
       cta={<CodeExample code="coder templates init" />}
       image={
-        <div className={styles.emptyImage}>
+        <div css={styles.emptyImage}>
           <img src="/featured/templates.webp" alt="" />
         </div>
       }
     />
-  )
-}
+  );
+};
 
-const useStyles = makeStyles((theme) => ({
+const styles = {
   withImage: {
     paddingBottom: 0,
   },
 
-  emptyImage: {
+  emptyImage: (theme) => ({
     maxWidth: "50%",
     height: theme.spacing(40),
     overflow: "hidden",
@@ -119,25 +115,25 @@ const useStyles = makeStyles((theme) => ({
     "& img": {
       maxWidth: "100%",
     },
-  },
+  }),
 
-  featuredExamples: {
+  featuredExamples: (theme) => ({
     maxWidth: theme.spacing(100),
     display: "grid",
     gridTemplateColumns: "repeat(2, minmax(0, 1fr))",
     gap: theme.spacing(2),
     gridAutoRows: "min-content",
-  },
+  }),
 
-  template: {
+  template: (theme) => ({
     backgroundColor: theme.palette.background.paperLight,
 
     "&:hover": {
       backgroundColor: theme.palette.divider,
     },
-  },
+  }),
 
   viewAllButton: {
     borderRadius: 9999,
   },
-}))
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/pages/TemplatesPage/TemplatesPage.test.tsx b/site/src/pages/TemplatesPage/TemplatesPage.test.tsx
deleted file mode 100644
index afb5e9b7d115d..0000000000000
--- a/site/src/pages/TemplatesPage/TemplatesPage.test.tsx
+++ /dev/null
@@ -1,91 +0,0 @@
-import { screen } from "@testing-library/react"
-import { rest } from "msw"
-import * as CreateDayString from "utils/createDayString"
-import { MockTemplate } from "../../testHelpers/entities"
-import { renderWithAuth } from "../../testHelpers/renderHelpers"
-import { server } from "../../testHelpers/server"
-import { TemplatesPage } from "./TemplatesPage"
-import i18next from "i18next"
-
-const { t } = i18next
-
-describe("TemplatesPage", () => {
-  beforeEach(() => {
-    // Mocking the dayjs module within the createDayString file
-    const mock = jest.spyOn(CreateDayString, "createDayString")
-    mock.mockImplementation(() => "a minute ago")
-  })
-
-  it("renders an empty templates page", async () => {
-    // Given
-    server.use(
-      rest.get(
-        "/api/v2/organizations/:organizationId/templates",
-        (req, res, ctx) => {
-          return res(ctx.status(200), ctx.json([]))
-        },
-      ),
-      rest.post("/api/v2/authcheck", (req, res, ctx) => {
-        return res(
-          ctx.status(200),
-          ctx.json({
-            createTemplates: true,
-          }),
-        )
-      }),
-    )
-
-    // When
-    renderWithAuth(<TemplatesPage />, {
-      route: `/templates`,
-      path: "/templates",
-    })
-
-    // Then
-    const emptyMessage = t("empty.message", {
-      ns: "templatesPage",
-    })
-    await screen.findByText(emptyMessage)
-  })
-
-  it("renders a filled templates page", async () => {
-    // When
-    renderWithAuth(<TemplatesPage />, {
-      route: `/templates`,
-      path: "/templates",
-    })
-
-    // Then
-    await screen.findByText(MockTemplate.display_name)
-  })
-
-  it("shows empty view without permissions to create", async () => {
-    server.use(
-      rest.get(
-        "/api/v2/organizations/:organizationId/templates",
-        (req, res, ctx) => {
-          return res(ctx.status(200), ctx.json([]))
-        },
-      ),
-      rest.post("/api/v2/authcheck", (req, res, ctx) => {
-        return res(
-          ctx.status(200),
-          ctx.json({
-            createTemplates: false,
-          }),
-        )
-      }),
-    )
-
-    // When
-    renderWithAuth(<TemplatesPage />, {
-      route: `/templates`,
-      path: "/templates",
-    })
-    // Then
-    const emptyMessage = t("empty.descriptionWithoutPermissions", {
-      ns: "templatesPage",
-    })
-    await screen.findByText(emptyMessage)
-  })
-})
diff --git a/site/src/pages/TemplatesPage/TemplatesPage.tsx b/site/src/pages/TemplatesPage/TemplatesPage.tsx
index e2b1f46e5e0b0..80b39c26449c6 100644
--- a/site/src/pages/TemplatesPage/TemplatesPage.tsx
+++ b/site/src/pages/TemplatesPage/TemplatesPage.tsx
@@ -1,30 +1,35 @@
-import { useMachine } from "@xstate/react"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { usePermissions } from "hooks/usePermissions"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "../../utils/page"
-import { templatesMachine } from "../../xServices/templates/templatesXService"
-import { TemplatesPageView } from "./TemplatesPageView"
+import { useOrganizationId } from "hooks/useOrganizationId";
+import { usePermissions } from "hooks/usePermissions";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { TemplatesPageView } from "./TemplatesPageView";
+import { templateExamples, templates } from "api/queries/templates";
+import { useQuery } from "react-query";
 
 export const TemplatesPage: FC = () => {
-  const organizationId = useOrganizationId()
-  const permissions = usePermissions()
-  const [templatesState] = useMachine(templatesMachine, {
-    context: {
-      organizationId,
-      permissions,
-    },
-  })
+  const organizationId = useOrganizationId();
+  const permissions = usePermissions();
+  const templatesQuery = useQuery(templates(organizationId));
+  const examplesQuery = useQuery({
+    ...templateExamples(organizationId),
+    enabled: permissions.createTemplates,
+  });
+  const error = templatesQuery.error || examplesQuery.error;
 
   return (
     <>
       <Helmet>
         <title>{pageTitle("Templates")}</title>
       </Helmet>
-      <TemplatesPageView context={templatesState.context} />
+      <TemplatesPageView
+        error={error}
+        canCreateTemplates={permissions.createTemplates}
+        examples={examplesQuery.data}
+        templates={templatesQuery.data}
+      />
     </>
-  )
-}
+  );
+};
 
-export default TemplatesPage
+export default TemplatesPage;
diff --git a/site/src/pages/TemplatesPage/TemplatesPageView.stories.tsx b/site/src/pages/TemplatesPage/TemplatesPageView.stories.tsx
index 2c74729dbc75c..5bbbb55fdce56 100644
--- a/site/src/pages/TemplatesPage/TemplatesPageView.stories.tsx
+++ b/site/src/pages/TemplatesPage/TemplatesPageView.stories.tsx
@@ -1,28 +1,23 @@
-import { ComponentMeta, Story } from "@storybook/react"
 import {
   mockApiError,
-  MockOrganization,
-  MockPermissions,
   MockTemplate,
   MockTemplateExample,
   MockTemplateExample2,
-} from "../../testHelpers/entities"
-import { TemplatesPageView, TemplatesPageViewProps } from "./TemplatesPageView"
+} from "testHelpers/entities";
+import { TemplatesPageView } from "./TemplatesPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "pages/TemplatesPageView",
+const meta: Meta<typeof TemplatesPageView> = {
+  title: "pages/TemplatesPage",
   component: TemplatesPageView,
-} as ComponentMeta<typeof TemplatesPageView>
+};
 
-const Template: Story<TemplatesPageViewProps> = (args) => (
-  <TemplatesPageView {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof TemplatesPageView>;
 
-export const WithTemplates = Template.bind({})
-WithTemplates.args = {
-  context: {
-    organizationId: MockOrganization.id,
-    permissions: MockPermissions,
+export const WithTemplates: Story = {
+  args: {
+    canCreateTemplates: true,
     error: undefined,
     templates: [
       MockTemplate,
@@ -46,53 +41,42 @@ WithTemplates.args = {
     ],
     examples: [],
   },
-}
+};
 
-export const WithTemplatesSmallViewPort = Template.bind({})
-WithTemplatesSmallViewPort.args = {
-  ...WithTemplates.args,
-}
-WithTemplatesSmallViewPort.parameters = {
-  chromatic: { viewports: [600] },
-}
+export const WithTemplatesSmallViewPort: Story = {
+  args: {
+    ...WithTemplates.args,
+  },
+  parameters: {
+    chromatic: { viewports: [600] },
+  },
+};
 
-export const EmptyCanCreate = Template.bind({})
-EmptyCanCreate.args = {
-  context: {
-    organizationId: MockOrganization.id,
-    permissions: MockPermissions,
+export const EmptyCanCreate: Story = {
+  args: {
+    canCreateTemplates: true,
     error: undefined,
     templates: [],
     examples: [MockTemplateExample, MockTemplateExample2],
   },
-}
+};
 
-export const EmptyCannotCreate = Template.bind({})
-EmptyCannotCreate.args = {
-  context: {
-    organizationId: MockOrganization.id,
-    permissions: {
-      ...MockPermissions,
-      createTemplates: false,
-    },
+export const EmptyCannotCreate: Story = {
+  args: {
     error: undefined,
     templates: [],
     examples: [MockTemplateExample, MockTemplateExample2],
+    canCreateTemplates: false,
   },
-}
+};
 
-export const Error = Template.bind({})
-Error.args = {
-  context: {
-    organizationId: MockOrganization.id,
-    permissions: {
-      ...MockPermissions,
-      createTemplates: false,
-    },
+export const Error: Story = {
+  args: {
     error: mockApiError({
       message: "Something went wrong fetching templates.",
     }),
     templates: undefined,
     examples: undefined,
+    canCreateTemplates: false,
   },
-}
+};
diff --git a/site/src/pages/TemplatesPage/TemplatesPageView.tsx b/site/src/pages/TemplatesPage/TemplatesPageView.tsx
index 77a8edad916a1..14834849a1bd3 100644
--- a/site/src/pages/TemplatesPage/TemplatesPageView.tsx
+++ b/site/src/pages/TemplatesPage/TemplatesPageView.tsx
@@ -1,53 +1,56 @@
-import Button from "@mui/material/Button"
-import { makeStyles } from "@mui/styles"
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableHead from "@mui/material/TableHead"
-import TableRow from "@mui/material/TableRow"
-import AddIcon from "@mui/icons-material/AddOutlined"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { Maybe } from "components/Conditionals/Maybe"
-import { FC } from "react"
-import { useNavigate, Link as RouterLink } from "react-router-dom"
-import { createDayString } from "utils/createDayString"
+import Button from "@mui/material/Button";
+import { makeStyles } from "@mui/styles";
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableHead from "@mui/material/TableHead";
+import TableRow from "@mui/material/TableRow";
+import AddIcon from "@mui/icons-material/AddOutlined";
+import { FC } from "react";
+import { useNavigate, Link as RouterLink } from "react-router-dom";
+import { createDayString } from "utils/createDayString";
 import {
   formatTemplateBuildTime,
   formatTemplateActiveDevelopers,
-} from "utils/templates"
-import { AvatarData } from "../../components/AvatarData/AvatarData"
-import { Margins } from "../../components/Margins/Margins"
+} from "utils/templates";
+import { AvatarData } from "components/AvatarData/AvatarData";
+import { Margins } from "components/Margins/Margins";
 import {
   PageHeader,
   PageHeaderSubtitle,
   PageHeaderTitle,
-} from "../../components/PageHeader/PageHeader"
-import { Stack } from "../../components/Stack/Stack"
-import { TableLoaderSkeleton } from "../../components/TableLoader/TableLoader"
+} from "components/PageHeader/PageHeader";
+import { Stack } from "components/Stack/Stack";
+import {
+  TableLoaderSkeleton,
+  TableRowSkeleton,
+} from "components/TableLoader/TableLoader";
 import {
   HelpTooltip,
   HelpTooltipLink,
   HelpTooltipLinksGroup,
   HelpTooltipText,
   HelpTooltipTitle,
-} from "../../components/Tooltips/HelpTooltip/HelpTooltip"
-import { EmptyTemplates } from "./EmptyTemplates"
-import { TemplatesContext } from "xServices/templates/templatesXService"
-import { useClickableTableRow } from "hooks/useClickableTableRow"
-import { Template } from "api/typesGenerated"
-import { combineClasses } from "utils/combineClasses"
-import { colors } from "theme/colors"
-import ArrowForwardOutlined from "@mui/icons-material/ArrowForwardOutlined"
-import { Avatar } from "components/Avatar/Avatar"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
-import { docs } from "utils/docs"
+} from "components/HelpTooltip/HelpTooltip";
+import { EmptyTemplates } from "./EmptyTemplates";
+import { useClickableTableRow } from "hooks/useClickableTableRow";
+import { Template, TemplateExample } from "api/typesGenerated";
+import { combineClasses } from "utils/combineClasses";
+import { colors } from "theme/colors";
+import ArrowForwardOutlined from "@mui/icons-material/ArrowForwardOutlined";
+import { Avatar } from "components/Avatar/Avatar";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { docs } from "utils/docs";
+import Skeleton from "@mui/material/Skeleton";
+import { Box } from "@mui/system";
+import { AvatarDataSkeleton } from "components/AvatarData/AvatarDataSkeleton";
 
 export const Language = {
   developerCount: (activeCount: number): string => {
     return `${formatTemplateActiveDevelopers(activeCount)} developer${
       activeCount !== 1 ? "s" : ""
-    }`
+    }`;
   },
   nameLabel: "Name",
   buildTimeLabel: "Build time",
@@ -57,7 +60,7 @@ export const Language = {
   templateTooltipText:
     "With templates you can create a common configuration for your workspaces using Terraform.",
   templateTooltipLink: "Manage templates",
-}
+};
 
 const TemplateHelpTooltip: React.FC = () => {
   return (
@@ -65,23 +68,22 @@ const TemplateHelpTooltip: React.FC = () => {
       <HelpTooltipTitle>{Language.templateTooltipTitle}</HelpTooltipTitle>
       <HelpTooltipText>{Language.templateTooltipText}</HelpTooltipText>
       <HelpTooltipLinksGroup>
-        <HelpTooltipLink href={docs("/templates#manage-templates")}>
+        <HelpTooltipLink href={docs("/templates")}>
           {Language.templateTooltipLink}
         </HelpTooltipLink>
       </HelpTooltipLinksGroup>
     </HelpTooltip>
-  )
-}
+  );
+};
 
 const TemplateRow: FC<{ template: Template }> = ({ template }) => {
-  const templatePageLink = `/templates/${template.name}`
-  const hasIcon = template.icon && template.icon !== ""
-  const navigate = useNavigate()
-  const styles = useStyles()
+  const templatePageLink = `/templates/${template.name}`;
+  const hasIcon = template.icon && template.icon !== "";
+  const navigate = useNavigate();
+  const styles = useStyles();
+
   const { className: clickableClassName, ...clickableRow } =
-    useClickableTableRow(() => {
-      navigate(templatePageLink)
-    })
+    useClickableTableRow({ onClick: () => navigate(templatePageLink) });
 
   return (
     <TableRow
@@ -123,45 +125,52 @@ const TemplateRow: FC<{ template: Template }> = ({ template }) => {
           startIcon={<ArrowForwardOutlined />}
           title={`Create a workspace using the ${template.display_name} template`}
           onClick={(e) => {
-            e.stopPropagation()
-            navigate(`/templates/${template.name}/workspace`)
+            e.stopPropagation();
+            navigate(`/templates/${template.name}/workspace`);
           }}
         >
           Create Workspace
         </Button>
       </TableCell>
     </TableRow>
-  )
-}
+  );
+};
 
 export interface TemplatesPageViewProps {
-  context: TemplatesContext
+  error?: unknown;
+  examples: TemplateExample[] | undefined;
+  templates: Template[] | undefined;
+  canCreateTemplates: boolean;
 }
 
-export const TemplatesPageView: FC<
-  React.PropsWithChildren<TemplatesPageViewProps>
-> = ({ context }) => {
-  const { templates, error, examples, permissions } = context
-  const isLoading = !templates
-  const isEmpty = Boolean(templates && templates.length === 0)
+export const TemplatesPageView: FC<TemplatesPageViewProps> = ({
+  templates,
+  error,
+  examples,
+  canCreateTemplates,
+}) => {
+  const isLoading = !templates;
+  const isEmpty = templates && templates.length === 0;
 
   return (
     <Margins>
       <PageHeader
         actions={
-          <Maybe condition={permissions.createTemplates}>
-            <Button component={RouterLink} to="/starter-templates">
-              Starter Templates
-            </Button>
-            <Button
-              startIcon={<AddIcon />}
-              component={RouterLink}
-              to="new"
-              variant="contained"
-            >
-              Create Template
-            </Button>
-          </Maybe>
+          canCreateTemplates && (
+            <>
+              <Button component={RouterLink} to="/starter-templates">
+                Starter Templates
+              </Button>
+              <Button
+                startIcon={<AddIcon />}
+                component={RouterLink}
+                to="new"
+                variant="contained"
+              >
+                Create Template
+              </Button>
+            </>
+          )
         }
       >
         <PageHeaderTitle>
@@ -170,57 +179,73 @@ export const TemplatesPageView: FC<
             <TemplateHelpTooltip />
           </Stack>
         </PageHeaderTitle>
-        <Maybe condition={Boolean(templates && templates.length > 0)}>
+        {templates && templates.length > 0 && (
           <PageHeaderSubtitle>
             Select a template to create a workspace.
           </PageHeaderSubtitle>
-        </Maybe>
+        )}
       </PageHeader>
 
-      <ChooseOne>
-        <Cond condition={Boolean(error)}>
-          <ErrorAlert error={error} />
-        </Cond>
-
-        <Cond>
-          <TableContainer>
-            <Table>
-              <TableHead>
-                <TableRow>
-                  <TableCell width="35%">{Language.nameLabel}</TableCell>
-                  <TableCell width="15%">{Language.usedByLabel}</TableCell>
-                  <TableCell width="10%">{Language.buildTimeLabel}</TableCell>
-                  <TableCell width="15%">{Language.lastUpdatedLabel}</TableCell>
-                  <TableCell width="1%"></TableCell>
-                </TableRow>
-              </TableHead>
-              <TableBody>
-                <Maybe condition={isLoading}>
-                  <TableLoaderSkeleton columns={5} useAvatarData />
-                </Maybe>
-
-                <ChooseOne>
-                  <Cond condition={isEmpty}>
-                    <EmptyTemplates
-                      permissions={permissions}
-                      examples={examples ?? []}
-                    />
-                  </Cond>
-
-                  <Cond>
-                    {templates?.map((template) => (
-                      <TemplateRow key={template.id} template={template} />
-                    ))}
-                  </Cond>
-                </ChooseOne>
-              </TableBody>
-            </Table>
-          </TableContainer>
-        </Cond>
-      </ChooseOne>
+      {error ? (
+        <ErrorAlert error={error} />
+      ) : (
+        <TableContainer>
+          <Table>
+            <TableHead>
+              <TableRow>
+                <TableCell width="35%">{Language.nameLabel}</TableCell>
+                <TableCell width="15%">{Language.usedByLabel}</TableCell>
+                <TableCell width="10%">{Language.buildTimeLabel}</TableCell>
+                <TableCell width="15%">{Language.lastUpdatedLabel}</TableCell>
+                <TableCell width="1%"></TableCell>
+              </TableRow>
+            </TableHead>
+            <TableBody>
+              {isLoading && <TableLoader />}
+
+              {isEmpty ? (
+                <EmptyTemplates
+                  canCreateTemplates={canCreateTemplates}
+                  examples={examples ?? []}
+                />
+              ) : (
+                templates?.map((template) => (
+                  <TemplateRow key={template.id} template={template} />
+                ))
+              )}
+            </TableBody>
+          </Table>
+        </TableContainer>
+      )}
     </Margins>
-  )
-}
+  );
+};
+
+const TableLoader = () => {
+  return (
+    <TableLoaderSkeleton>
+      <TableRowSkeleton>
+        <TableCell>
+          <Box sx={{ display: "flex", alignItems: "center", gap: 1 }}>
+            <AvatarDataSkeleton />
+          </Box>
+        </TableCell>
+        <TableCell>
+          <Skeleton variant="text" width="25%" />
+        </TableCell>
+        <TableCell>
+          <Skeleton variant="text" width="25%" />
+        </TableCell>
+        <TableCell>
+          <Skeleton variant="text" width="25%" />
+        </TableCell>
+        <TableCell>
+          <Skeleton variant="text" width="25%" />
+        </TableCell>
+      </TableRowSkeleton>
+    </TableLoaderSkeleton>
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   templateIconWrapper: {
@@ -252,4 +277,4 @@ const useStyles = makeStyles((theme) => ({
     color: theme.palette.text.secondary,
     transition: "none",
   },
-}))
+}));
diff --git a/site/src/pages/TerminalPage/TerminalAlerts.tsx b/site/src/pages/TerminalPage/TerminalAlerts.tsx
new file mode 100644
index 0000000000000..3a5d7ebd66276
--- /dev/null
+++ b/site/src/pages/TerminalPage/TerminalAlerts.tsx
@@ -0,0 +1,136 @@
+import Button from "@mui/material/Button";
+import Link from "@mui/material/Link";
+import { Alert, AlertProps } from "components/Alert/Alert";
+import { useState } from "react";
+import { docs } from "utils/docs";
+
+export const ErrorScriptAlert = () => {
+  return (
+    <TerminalAlert
+      severity="warning"
+      dismissible
+      actions={<RefreshSessionButton />}
+    >
+      The workspace{" "}
+      <Link
+        title="startup script has exited with an error"
+        href={docs("/templates#startup-script-exited-with-an-error")}
+        target="_blank"
+        rel="noreferrer"
+      >
+        startup script has exited with an error
+      </Link>
+      , we recommend reloading this session and{" "}
+      <Link
+        title=" debugging the startup script"
+        href={docs("/templates#debugging-the-startup-script")}
+        target="_blank"
+        rel="noreferrer"
+      >
+        debugging the startup script
+      </Link>{" "}
+      because{" "}
+      <Link
+        title="your workspace may be incomplete."
+        href={docs("/templates#your-workspace-may-be-incomplete")}
+        target="_blank"
+        rel="noreferrer"
+      >
+        your workspace may be incomplete.
+      </Link>{" "}
+    </TerminalAlert>
+  );
+};
+
+export const LoadingScriptsAlert = () => {
+  return (
+    <TerminalAlert
+      dismissible
+      severity="info"
+      actions={<RefreshSessionButton />}
+    >
+      Startup scripts are still running. You can continue using this terminal,
+      but{" "}
+      <Link
+        title="your workspace may be incomplete."
+        href={docs("/templates#your-workspace-may-be-incomplete")}
+        target="_blank"
+        rel="noreferrer"
+      >
+        {" "}
+        your workspace may be incomplete.
+      </Link>
+    </TerminalAlert>
+  );
+};
+
+export const LoadedScriptsAlert = () => {
+  return (
+    <TerminalAlert
+      severity="success"
+      dismissible
+      actions={<RefreshSessionButton />}
+    >
+      Startup scripts have completed successfully. The workspace is ready but
+      this{" "}
+      <Link
+        title="session was started before the startup scripts finished"
+        href={docs("/templates#your-workspace-may-be-incomplete")}
+        target="_blank"
+        rel="noreferrer"
+      >
+        session was started before the startup script finished.
+      </Link>{" "}
+      To ensure your shell environment is up-to-date, we recommend reloading
+      this session.
+    </TerminalAlert>
+  );
+};
+
+const TerminalAlert = (props: AlertProps) => {
+  return (
+    <Alert
+      {...props}
+      sx={{
+        borderRadius: 0,
+        borderWidth: 0,
+        borderBottomWidth: 1,
+        borderBottomColor: (theme) => theme.palette.divider,
+        backgroundColor: (theme) => theme.palette.background.paperLight,
+        borderLeft: (theme) =>
+          `3px solid ${theme.palette[props.severity!].light}`,
+        marginBottom: 1,
+      }}
+    />
+  );
+};
+
+export const DisconnectedAlert = (props: AlertProps) => {
+  return (
+    <TerminalAlert
+      {...props}
+      severity="warning"
+      actions={<RefreshSessionButton />}
+    >
+      Disconnected
+    </TerminalAlert>
+  );
+};
+
+const RefreshSessionButton = () => {
+  const [isRefreshing, setIsRefreshing] = useState(false);
+
+  return (
+    <Button
+      disabled={isRefreshing}
+      size="small"
+      variant="text"
+      onClick={() => {
+        setIsRefreshing(true);
+        window.location.reload();
+      }}
+    >
+      {isRefreshing ? "Refreshing session..." : "Refresh session"}
+    </Button>
+  );
+};
diff --git a/site/src/pages/TerminalPage/TerminalPage.test.tsx b/site/src/pages/TerminalPage/TerminalPage.test.tsx
index 6412efaaa519a..064a892d3564e 100644
--- a/site/src/pages/TerminalPage/TerminalPage.test.tsx
+++ b/site/src/pages/TerminalPage/TerminalPage.test.tsx
@@ -1,21 +1,20 @@
-import { waitFor } from "@testing-library/react"
-import "jest-canvas-mock"
-import WS from "jest-websocket-mock"
-import { rest } from "msw"
+import { waitFor } from "@testing-library/react";
+import "jest-canvas-mock";
+import WS from "jest-websocket-mock";
+import { rest } from "msw";
 import {
   MockUser,
   MockWorkspace,
   MockWorkspaceAgent,
-} from "testHelpers/entities"
-import { TextDecoder, TextEncoder } from "util"
-import { ReconnectingPTYRequest } from "../../api/types"
+} from "testHelpers/entities";
+import { TextDecoder, TextEncoder } from "util";
 import {
   renderWithAuth,
   waitForLoaderToBeRemoved,
-} from "../../testHelpers/renderHelpers"
-import { server } from "../../testHelpers/server"
-import TerminalPage, { Language } from "./TerminalPage"
-import * as API from "api/api"
+} from "testHelpers/renderHelpers";
+import { server } from "testHelpers/server";
+import TerminalPage, { Language } from "./TerminalPage";
+import * as API from "api/api";
 
 Object.defineProperty(window, "matchMedia", {
   writable: true,
@@ -29,54 +28,60 @@ Object.defineProperty(window, "matchMedia", {
     removeEventListener: jest.fn(),
     dispatchEvent: jest.fn(),
   })),
-})
+});
 
 Object.defineProperty(window, "TextEncoder", {
   value: TextEncoder,
-})
+});
 
 const renderTerminal = async (
   route = `/${MockUser.username}/${MockWorkspace.name}/terminal`,
 ) => {
-  const utils = renderWithAuth(<TerminalPage renderer="dom" />, {
+  const utils = renderWithAuth(<TerminalPage />, {
     route,
     path: "/:username/:workspace/terminal",
-  })
-  await waitForLoaderToBeRemoved()
-  return utils
-}
+  });
+  await waitForLoaderToBeRemoved();
+  return utils;
+};
 
 const expectTerminalText = (container: HTMLElement, text: string) => {
   return waitFor(
     () => {
-      const elements = container.getElementsByClassName("xterm-rows")
+      const elements = container.getElementsByClassName("xterm-rows");
       if (elements.length === 0) {
-        throw new Error("no xterm-rows")
+        throw new Error("no xterm-rows");
       }
-      const row = elements[0] as HTMLDivElement
+      const row = elements[0] as HTMLDivElement;
       if (!row.textContent) {
-        throw new Error("no text content")
+        throw new Error("no text content");
       }
-      expect(row.textContent).toContain(text)
+      expect(row.textContent).toContain(text);
     },
-    { timeout: 3_000 },
-  )
-}
+    { timeout: 5_000 },
+  );
+};
 
 describe("TerminalPage", () => {
   it("loads the right workspace data", async () => {
     const spy = jest
       .spyOn(API, "getWorkspaceByOwnerAndName")
-      .mockResolvedValue(MockWorkspace)
-    await renderTerminal(`/${MockUser.username}/${MockWorkspace.name}/terminal`)
+      .mockResolvedValue(MockWorkspace);
+    const ws = new WS(
+      `ws://localhost/api/v2/workspaceagents/${MockWorkspaceAgent.id}/pty`,
+    );
+    await renderTerminal(
+      `/${MockUser.username}/${MockWorkspace.name}/terminal`,
+    );
     await waitFor(() => {
       expect(API.getWorkspaceByOwnerAndName).toHaveBeenCalledWith(
         MockUser.username,
         MockWorkspace.name,
-      )
-    })
-    spy.mockRestore()
-  })
+      );
+    });
+    spy.mockRestore();
+    ws.close();
+  });
 
   it("shows an error if fetching workspace fails", async () => {
     // Given
@@ -84,87 +89,92 @@ describe("TerminalPage", () => {
       rest.get(
         "/api/v2/users/:userId/workspace/:workspaceName",
         (req, res, ctx) => {
-          return res(ctx.status(500), ctx.json({ id: "workspace-id" }))
+          return res(ctx.status(500), ctx.json({ id: "workspace-id" }));
         },
       ),
-    )
+    );
 
     // When
-    const { container } = await renderTerminal()
+    const { container } = await renderTerminal();
 
     // Then
-    await expectTerminalText(container, Language.workspaceErrorMessagePrefix)
-  })
+    await expectTerminalText(container, Language.workspaceErrorMessagePrefix);
+  });
 
   it("shows an error if the websocket fails", async () => {
     // Given
     server.use(
       rest.get("/api/v2/workspaceagents/:agentId/pty", (req, res, ctx) => {
-        return res(ctx.status(500), ctx.json({}))
+        return res(ctx.status(500), ctx.json({}));
       }),
-    )
+    );
 
     // When
-    const { container } = await renderTerminal()
+    const { container } = await renderTerminal();
 
     // Then
-    await expectTerminalText(container, Language.websocketErrorMessagePrefix)
-  })
+    await expectTerminalText(container, Language.websocketErrorMessagePrefix);
+  });
 
   it("renders data from the backend", async () => {
     // Given
     const ws = new WS(
       `ws://localhost/api/v2/workspaceagents/${MockWorkspaceAgent.id}/pty`,
-    )
-    const text = "something to render"
+    );
+    const text = "something to render";
 
     // When
-    const { container } = await renderTerminal()
+    const { container } = await renderTerminal();
 
     // Then
-    await ws.connected
-    ws.send(text)
-    await expectTerminalText(container, text)
-    ws.close()
-  })
-
+    // Ideally we could use ws.connected but that seems to pause React updates.
+    // For now, wait for the initial resize message instead.
+    await ws.nextMessage;
+    ws.send(text);
+    await expectTerminalText(container, text);
+    ws.close();
+  });
+
+  // Ideally we could just pass the correct size in the web socket URL without
+  // having to resize separately afterward (and then we could delete also this
+  // test), but we need the initial resize message to have something to wait for
+  // in the other tests since ws.connected appears to pause React updates.  So
+  // for now the initial resize message (and this test) are here to stay.
   it("resizes on connect", async () => {
     // Given
     const ws = new WS(
       `ws://localhost/api/v2/workspaceagents/${MockWorkspaceAgent.id}/pty`,
-    )
+    );
 
     // When
-    await renderTerminal()
+    await renderTerminal();
 
     // Then
-    await ws.connected
-    const msg = await ws.nextMessage
-    const req: ReconnectingPTYRequest = JSON.parse(
-      new TextDecoder().decode(msg as Uint8Array),
-    )
-
-    expect(req.height).toBeGreaterThan(0)
-    expect(req.width).toBeGreaterThan(0)
-    ws.close()
-  })
+    const msg = await ws.nextMessage;
+    const req = JSON.parse(new TextDecoder().decode(msg as Uint8Array));
+    expect(req.height).toBeGreaterThan(0);
+    expect(req.width).toBeGreaterThan(0);
+    ws.close();
+  });
 
   it("supports workspace.agent syntax", async () => {
     // Given
     const ws = new WS(
       `ws://localhost/api/v2/workspaceagents/${MockWorkspaceAgent.id}/pty`,
-    )
-    const text = "something to render"
+    );
+    const text = "something to render";
 
     // When
     const { container } = await renderTerminal(
       `/some-user/${MockWorkspace.name}.${MockWorkspaceAgent.name}/terminal`,
-    )
+    );
 
     // Then
-    await ws.connected
-    ws.send(text)
-    await expectTerminalText(container, text)
-    ws.close()
-  })
-})
+    // Ideally we could use ws.connected but that seems to pause React updates.
+    // For now, wait for the initial resize message instead.
+    await ws.nextMessage;
+    ws.send(text);
+    await expectTerminalText(container, text);
+    ws.close();
+  });
+});
diff --git a/site/src/pages/TerminalPage/TerminalPage.tsx b/site/src/pages/TerminalPage/TerminalPage.tsx
index 4352ee40c0991..7c82c82a1f5bb 100644
--- a/site/src/pages/TerminalPage/TerminalPage.tsx
+++ b/site/src/pages/TerminalPage/TerminalPage.tsx
@@ -1,181 +1,115 @@
-import { makeStyles, useTheme } from "@mui/styles"
-import { useMachine } from "@xstate/react"
-import { portForwardURL } from "components/PortForwardButton/PortForwardButton"
-import { Stack } from "components/Stack/Stack"
-import { FC, useCallback, useEffect, useRef, useState } from "react"
-import { Helmet } from "react-helmet-async"
-import { useNavigate, useParams, useSearchParams } from "react-router-dom"
-import { colors } from "theme/colors"
-import { v4 as uuidv4 } from "uuid"
-import * as XTerm from "xterm"
-import { CanvasAddon } from "xterm-addon-canvas"
-import { FitAddon } from "xterm-addon-fit"
-import { WebLinksAddon } from "xterm-addon-web-links"
-import "xterm/css/xterm.css"
-import { MONOSPACE_FONT_FAMILY } from "../../theme/constants"
-import { pageTitle } from "../../utils/page"
-import { terminalMachine } from "../../xServices/terminal/terminalXService"
-import { useProxy } from "contexts/ProxyContext"
-import Box from "@mui/material/Box"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import { Region, WorkspaceAgent } from "api/typesGenerated"
-import { getLatencyColor } from "utils/latency"
-import Popover from "@mui/material/Popover"
-import { ProxyStatusLatency } from "components/ProxyStatusLatency/ProxyStatusLatency"
-import TerminalPageAlert, { TerminalPageAlertType } from "./TerminalPageAlert"
+import { makeStyles, useTheme } from "@mui/styles";
+import { FC, useCallback, useEffect, useRef, useState } from "react";
+import { Helmet } from "react-helmet-async";
+import { useNavigate, useParams, useSearchParams } from "react-router-dom";
+import { colors } from "theme/colors";
+import { v4 as uuidv4 } from "uuid";
+import * as XTerm from "xterm";
+import { WebglAddon } from "xterm-addon-webgl";
+import { CanvasAddon } from "xterm-addon-canvas";
+import { FitAddon } from "xterm-addon-fit";
+import { WebLinksAddon } from "xterm-addon-web-links";
+import { Unicode11Addon } from "xterm-addon-unicode11";
+import "xterm/css/xterm.css";
+import { MONOSPACE_FONT_FAMILY } from "theme/constants";
+import { pageTitle } from "utils/page";
+import { useProxy } from "contexts/ProxyContext";
+import Box from "@mui/material/Box";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { Region } from "api/typesGenerated";
+import { getLatencyColor } from "utils/latency";
+import { ProxyStatusLatency } from "components/ProxyStatusLatency/ProxyStatusLatency";
+import { openMaybePortForwardedURL } from "utils/portForward";
+import { terminalWebsocketUrl } from "utils/terminal";
+import { getMatchingAgentOrFirst } from "utils/workspace";
+import {
+  DisconnectedAlert,
+  ErrorScriptAlert,
+  LoadedScriptsAlert,
+  LoadingScriptsAlert,
+} from "./TerminalAlerts";
+import { useQuery } from "react-query";
+import { deploymentConfig } from "api/queries/deployment";
+import { workspaceByOwnerAndName } from "api/queries/workspaces";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "components/Popover/Popover";
 
 export const Language = {
   workspaceErrorMessagePrefix: "Unable to fetch workspace: ",
   workspaceAgentErrorMessagePrefix: "Unable to fetch workspace agent: ",
   websocketErrorMessagePrefix: "WebSocket failed: ",
-}
+};
 
-const useTerminalWarning = ({ agent }: { agent?: WorkspaceAgent }) => {
-  const lifecycleState = agent?.lifecycle_state
-  const [startupWarning, setStartupWarning] = useState<
-    TerminalPageAlertType | undefined
-  >(undefined)
-
-  useEffect(() => {
-    if (lifecycleState === "start_error") {
-      setStartupWarning("error")
-    } else if (lifecycleState === "starting") {
-      setStartupWarning("starting")
-    } else {
-      setStartupWarning((prev) => {
-        if (prev === "starting") {
-          return "success"
-        }
-        return undefined
-      })
-    }
-  }, [lifecycleState])
-
-  return {
-    startupWarning,
-  }
-}
-
-type TerminalPageProps = React.PropsWithChildren<{
-  renderer: "canvas" | "dom"
-}>
-
-const TerminalPage: FC<TerminalPageProps> = ({ renderer }) => {
-  const navigate = useNavigate()
-  const styles = useStyles()
-  const { proxy } = useProxy()
-  const params = useParams() as { username: string; workspace: string }
-  const username = params.username.replace("@", "")
-  const workspaceName = params.workspace
-  const xtermRef = useRef<HTMLDivElement>(null)
-  const [terminal, setTerminal] = useState<XTerm.Terminal | null>(null)
-  const [fitAddon, setFitAddon] = useState<FitAddon | null>(null)
-  const [searchParams] = useSearchParams()
+const TerminalPage: FC = () => {
+  const navigate = useNavigate();
+  const styles = useStyles();
+  const { proxy } = useProxy();
+  const params = useParams() as { username: string; workspace: string };
+  const username = params.username.replace("@", "");
+  const xtermRef = useRef<HTMLDivElement>(null);
+  const [terminal, setTerminal] = useState<XTerm.Terminal | null>(null);
+  const [terminalState, setTerminalState] = useState<
+    "connected" | "disconnected" | "initializing"
+  >("initializing");
+  const [searchParams] = useSearchParams();
   // The reconnection token is a unique token that identifies
   // a terminal session. It's generated by the client to reduce
   // a round-trip, and must be a UUIDv4.
-  const reconnectionToken = searchParams.get("reconnect") ?? uuidv4()
-  const command = searchParams.get("command") || undefined
+  const reconnectionToken = searchParams.get("reconnect") ?? uuidv4();
+  const command = searchParams.get("command") || undefined;
   // The workspace name is in the format:
   // <workspace name>[.<agent name>]
-  const workspaceNameParts = workspaceName?.split(".")
-  const [terminalState, sendEvent] = useMachine(terminalMachine, {
-    context: {
-      agentName: workspaceNameParts?.[1],
-      reconnection: reconnectionToken,
-      workspaceName: workspaceNameParts?.[0],
-      username: username,
-      command: command,
-      baseURL: proxy.preferredPathAppURL,
-    },
-    actions: {
-      readMessage: (_, event) => {
-        if (typeof event.data === "string") {
-          // This exclusively occurs when testing.
-          // "jest-websocket-mock" doesn't support ArrayBuffer.
-          terminal?.write(event.data)
-        } else {
-          terminal?.write(new Uint8Array(event.data))
-        }
-      },
-    },
-  })
-  const isConnected = terminalState.matches("connected")
-  const isDisconnected = terminalState.matches("disconnected")
-  const {
-    workspaceError,
-    workspace,
-    workspaceAgentError,
-    workspaceAgent,
-    websocketError,
-  } = terminalState.context
-  const reloading = useReloading(isDisconnected)
-  const dashboard = useDashboard()
-  const proxyContext = useProxy()
-  const selectedProxy = proxyContext.proxy.proxy
+  const workspaceNameParts = params.workspace?.split(".");
+  const workspace = useQuery(
+    workspaceByOwnerAndName(username, workspaceNameParts?.[0]),
+  );
+  const workspaceAgent = workspace.data
+    ? getMatchingAgentOrFirst(workspace.data, workspaceNameParts?.[1])
+    : undefined;
+  const dashboard = useDashboard();
+  const proxyContext = useProxy();
+  const selectedProxy = proxyContext.proxy.proxy;
   const latency = selectedProxy
     ? proxyContext.proxyLatencies[selectedProxy.id]
-    : undefined
-  const { startupWarning } = useTerminalWarning({
-    agent: workspaceAgent,
-  })
+    : undefined;
+
+  const lifecycleState = workspaceAgent?.lifecycle_state;
+  const prevLifecycleState = useRef(lifecycleState);
+  useEffect(() => {
+    prevLifecycleState.current = lifecycleState;
+  }, [lifecycleState]);
+
+  const config = useQuery(deploymentConfig());
+  const renderer = config.data?.config.web_terminal_renderer;
 
   // handleWebLink handles opening of URLs in the terminal!
   const handleWebLink = useCallback(
     (uri: string) => {
-      if (
-        !workspaceAgent ||
-        !workspace ||
-        !username ||
-        !proxy.preferredWildcardHostname
-      ) {
-        return
-      }
-
-      const open = (uri: string) => {
-        // Copied from: https://github.com/xtermjs/xterm.js/blob/master/addons/xterm-addon-web-links/src/WebLinksAddon.ts#L23
-        const newWindow = window.open()
-        if (newWindow) {
-          try {
-            newWindow.opener = null
-          } catch {
-            // no-op, Electron can throw
-          }
-          newWindow.location.href = uri
-        } else {
-          console.warn("Opening link blocked as opener could not be cleared")
-        }
-      }
-
-      try {
-        const url = new URL(uri)
-        const localHosts = ["0.0.0.0", "127.0.0.1", "localhost"]
-        if (!localHosts.includes(url.hostname)) {
-          open(uri)
-          return
-        }
-        open(
-          portForwardURL(
-            proxy.preferredWildcardHostname,
-            parseInt(url.port),
-            workspaceAgent.name,
-            workspace.name,
-            username,
-          ) + url.pathname,
-        )
-      } catch (ex) {
-        open(uri)
-      }
+      openMaybePortForwardedURL(
+        uri,
+        proxy.preferredWildcardHostname,
+        workspaceAgent?.name,
+        workspace.data?.name,
+        username,
+      );
     },
-    [workspaceAgent, workspace, username, proxy.preferredWildcardHostname],
-  )
+    [workspaceAgent, workspace.data, username, proxy.preferredWildcardHostname],
+  );
+  const handleWebLinkRef = useRef(handleWebLink);
+  useEffect(() => {
+    handleWebLinkRef.current = handleWebLink;
+  }, [handleWebLink]);
 
   // Create the terminal!
   useEffect(() => {
-    if (!xtermRef.current) {
-      return
+    if (!xtermRef.current || config.isLoading) {
+      return;
     }
     const terminal = new XTerm.Terminal({
+      allowProposedApi: true,
       allowTransparency: true,
       disableStdin: false,
       fontFamily: MONOSPACE_FONT_FAMILY,
@@ -183,57 +117,48 @@ const TerminalPage: FC<TerminalPageProps> = ({ renderer }) => {
       theme: {
         background: colors.gray[16],
       },
-    })
-    // DOM is the default renderer.
-    if (renderer === "canvas") {
-      terminal.loadAddon(new CanvasAddon())
+    });
+    if (renderer === "webgl") {
+      terminal.loadAddon(new WebglAddon());
+    } else if (renderer === "canvas") {
+      terminal.loadAddon(new CanvasAddon());
     }
-    const fitAddon = new FitAddon()
-    setFitAddon(fitAddon)
-    terminal.loadAddon(fitAddon)
+    const fitAddon = new FitAddon();
+    terminal.loadAddon(fitAddon);
+    terminal.loadAddon(new Unicode11Addon());
+    terminal.unicode.activeVersion = "11";
     terminal.loadAddon(
       new WebLinksAddon((_, uri) => {
-        handleWebLink(uri)
+        handleWebLinkRef.current(uri);
       }),
-    )
-    terminal.onData((data) => {
-      sendEvent({
-        type: "WRITE",
-        request: {
-          data: data,
-        },
-      })
-    })
-    terminal.onResize((event) => {
-      sendEvent({
-        type: "WRITE",
-        request: {
-          height: event.rows,
-          width: event.cols,
-        },
-      })
-    })
-    setTerminal(terminal)
-    terminal.open(xtermRef.current)
-    const listener = () => {
-      // This will trigger a resize event on the terminal.
-      fitAddon.fit()
-    }
-    window.addEventListener("resize", listener)
+    );
+
+    terminal.open(xtermRef.current);
+
+    // We have to fit twice here. It's unknown why, but the first fit will
+    // overflow slightly in some scenarios. Applying a second fit resolves this.
+    fitAddon.fit();
+    fitAddon.fit();
+
+    // This will trigger a resize event on the terminal.
+    const listener = () => fitAddon.fit();
+    window.addEventListener("resize", listener);
+
+    // Terminal is correctly sized and is ready to be used.
+    setTerminal(terminal);
+
     return () => {
-      window.removeEventListener("resize", listener)
-      terminal.dispose()
-    }
-  }, [renderer, sendEvent, xtermRef, handleWebLink])
+      window.removeEventListener("resize", listener);
+      terminal.dispose();
+    };
+  }, [renderer, config.isLoading, xtermRef, handleWebLinkRef]);
 
-  // Triggers the initial terminal connection using
-  // the reconnection token and workspace name found
-  // from the router.
+  // Updates the reconnection token into the URL if necessary.
   useEffect(() => {
     if (searchParams.get("reconnect") === reconnectionToken) {
-      return
+      return;
     }
-    searchParams.set("reconnect", reconnectionToken)
+    searchParams.set("reconnect", reconnectionToken);
     navigate(
       {
         search: searchParams.toString(),
@@ -241,110 +166,156 @@ const TerminalPage: FC<TerminalPageProps> = ({ renderer }) => {
       {
         replace: true,
       },
-    )
-  }, [searchParams, navigate, reconnectionToken])
+    );
+  }, [searchParams, navigate, reconnectionToken]);
 
-  // Apply terminal options based on connection state.
+  // Hook up the terminal through a web socket.
   useEffect(() => {
-    if (!terminal || !fitAddon) {
-      return
-    }
-
-    // We have to fit twice here. It's unknown why, but
-    // the first fit will overflow slightly in some
-    // scenarios. Applying a second fit resolves this.
-    fitAddon.fit()
-    fitAddon.fit()
-
-    if (!isConnected) {
-      // Disable user input when not connected.
-      terminal.options = {
-        disableStdin: true,
-      }
-      if (workspaceError instanceof Error) {
-        terminal.writeln(
-          Language.workspaceErrorMessagePrefix + workspaceError.message,
-        )
-      }
-      if (workspaceAgentError instanceof Error) {
-        terminal.writeln(
-          Language.workspaceAgentErrorMessagePrefix +
-            workspaceAgentError.message,
-        )
-      }
-      if (websocketError instanceof Error) {
-        terminal.writeln(
-          Language.websocketErrorMessagePrefix + websocketError.message,
-        )
-      }
-      return
+    if (!terminal) {
+      return;
     }
 
     // The terminal should be cleared on each reconnect
     // because all data is re-rendered from the backend.
-    terminal.clear()
+    terminal.clear();
 
-    // Focusing on connection allows users to reload the
-    // page and start typing immediately.
-    terminal.focus()
-    terminal.options = {
-      disableStdin: false,
-      windowsMode: workspaceAgent?.operating_system === "windows",
+    // Focusing on connection allows users to reload the page and start
+    // typing immediately.
+    terminal.focus();
+
+    // Disable input while we connect.
+    terminal.options.disableStdin = true;
+
+    // Show a message if we failed to find the workspace or agent.
+    if (workspace.isLoading) {
+      return;
+    } else if (workspace.error instanceof Error) {
+      terminal.writeln(
+        Language.workspaceErrorMessagePrefix + workspace.error.message,
+      );
+      return;
+    } else if (!workspaceAgent) {
+      terminal.writeln(
+        Language.workspaceAgentErrorMessagePrefix + "no agent found with ID",
+      );
+      return;
     }
 
-    // Update the terminal size post-fit.
-    sendEvent({
-      type: "WRITE",
-      request: {
-        height: terminal.rows,
-        width: terminal.cols,
-      },
-    })
+    // Hook up terminal events to the websocket.
+    let websocket: WebSocket | null;
+    const disposers = [
+      terminal.onData((data) => {
+        websocket?.send(
+          new TextEncoder().encode(JSON.stringify({ data: data })),
+        );
+      }),
+      terminal.onResize((event) => {
+        websocket?.send(
+          new TextEncoder().encode(
+            JSON.stringify({
+              height: event.rows,
+              width: event.cols,
+            }),
+          ),
+        );
+      }),
+    ];
+
+    let disposed = false;
+
+    // Open the web socket and hook it up to the terminal.
+    terminalWebsocketUrl(
+      proxy.preferredPathAppURL,
+      reconnectionToken,
+      workspaceAgent.id,
+      command,
+      terminal.rows,
+      terminal.cols,
+    )
+      .then((url) => {
+        if (disposed) {
+          return; // Unmounted while we waited for the async call.
+        }
+        websocket = new WebSocket(url);
+        websocket.binaryType = "arraybuffer";
+        websocket.addEventListener("open", () => {
+          // Now that we are connected, allow user input.
+          terminal.options = {
+            disableStdin: false,
+            windowsMode: workspaceAgent?.operating_system === "windows",
+          };
+          // Send the initial size.
+          websocket?.send(
+            new TextEncoder().encode(
+              JSON.stringify({
+                height: terminal.rows,
+                width: terminal.cols,
+              }),
+            ),
+          );
+          setTerminalState("connected");
+        });
+        websocket.addEventListener("error", () => {
+          terminal.options.disableStdin = true;
+          terminal.writeln(
+            Language.websocketErrorMessagePrefix + "socket errored",
+          );
+          setTerminalState("disconnected");
+        });
+        websocket.addEventListener("close", () => {
+          terminal.options.disableStdin = true;
+          setTerminalState("disconnected");
+        });
+        websocket.addEventListener("message", (event) => {
+          if (typeof event.data === "string") {
+            // This exclusively occurs when testing.
+            // "jest-websocket-mock" doesn't support ArrayBuffer.
+            terminal.write(event.data);
+          } else {
+            terminal.write(new Uint8Array(event.data));
+          }
+        });
+      })
+      .catch((error) => {
+        if (disposed) {
+          return; // Unmounted while we waited for the async call.
+        }
+        terminal.writeln(Language.websocketErrorMessagePrefix + error.message);
+        setTerminalState("disconnected");
+      });
+
+    return () => {
+      disposed = true; // Could use AbortController instead?
+      disposers.forEach((d) => d.dispose());
+      websocket?.close(1000);
+    };
   }, [
-    workspaceError,
-    workspaceAgentError,
-    websocketError,
-    workspaceAgent,
+    command,
+    proxy.preferredPathAppURL,
+    reconnectionToken,
     terminal,
-    fitAddon,
-    isConnected,
-    sendEvent,
-  ])
+    workspace.isLoading,
+    workspace.error,
+    workspaceAgent,
+  ]);
 
   return (
     <>
       <Helmet>
         <title>
-          {terminalState.context.workspace
+          {workspace.data
             ? pageTitle(
-                `Terminal · ${terminalState.context.workspace.owner_name}/${terminalState.context.workspace.name}`,
+                `Terminal · ${workspace.data.owner_name}/${workspace.data.name}`,
               )
             : ""}
         </title>
       </Helmet>
-      {/* This overlay makes it more obvious that the terminal is disconnected. */}
-      {/* It's nice for situations where Coder restarts, and they are temporarily disconnected. */}
-      <div className={`${styles.overlay} ${isDisconnected ? "" : "connected"}`}>
-        {reloading.status === "reloading" ? (
-          <span className={styles.overlayText}>Reloading...</span>
-        ) : (
-          <Stack spacing={0.5} alignItems="center">
-            <span className={styles.overlayText}>Disconnected</span>
-            <span className={styles.overlaySubtext}>
-              Press any key to retry
-            </span>
-          </Stack>
-        )}
-      </div>
       <Box display="flex" flexDirection="column" height="100vh">
-        {startupWarning && (
-          <TerminalPageAlert
-            alertType={startupWarning}
-            onDismiss={() => {
-              fitAddon?.fit()
-            }}
-          />
-        )}
+        {lifecycleState === "start_error" && <ErrorScriptAlert />}
+        {lifecycleState === "starting" && <LoadingScriptsAlert />}
+        {lifecycleState === "ready" &&
+          prevLifecycleState.current === "starting" && <LoadedScriptsAlert />}
+        {terminalState === "disconnected" && <DisconnectedAlert />}
         <div
           className={styles.terminal}
           ref={xtermRef}
@@ -357,19 +328,17 @@ const TerminalPage: FC<TerminalPageProps> = ({ renderer }) => {
           )}
       </Box>
     </>
-  )
-}
+  );
+};
 
 const BottomBar = ({ proxy, latency }: { proxy: Region; latency?: number }) => {
-  const theme = useTheme()
-  const color = getLatencyColor(theme, latency)
-  const anchorRef = useRef<HTMLButtonElement>(null)
-  const [isOpen, setIsOpen] = useState(false)
+  const theme = useTheme();
+  const color = getLatencyColor(theme, latency);
 
   return (
     <Box
       sx={{
-        padding: (theme) => theme.spacing(1, 2),
+        padding: theme.spacing(0, 2),
         background: (theme) => theme.palette.background.paper,
         display: "flex",
         alignItems: "center",
@@ -378,114 +347,84 @@ const BottomBar = ({ proxy, latency }: { proxy: Region; latency?: number }) => {
         borderTop: (theme) => `1px solid ${theme.palette.divider}`,
       }}
     >
-      <Box
-        ref={anchorRef}
-        component="button"
-        aria-label="Terminal latency"
-        aria-haspopup="true"
-        onMouseEnter={() => setIsOpen(true)}
-        onMouseLeave={() => setIsOpen(false)}
-        sx={{
-          background: "none",
-          cursor: "pointer",
-          display: "flex",
-          alignItems: "center",
-          gap: 1,
-          border: 0,
-        }}
-      >
-        <Box
+      <Popover mode="hover">
+        <PopoverTrigger>
+          <Box
+            component="button"
+            aria-label="Terminal latency"
+            aria-haspopup="true"
+            sx={{
+              background: "none",
+              cursor: "pointer",
+              display: "flex",
+              alignItems: "center",
+              gap: 1,
+              border: 0,
+              padding: theme.spacing(1),
+            }}
+          >
+            <Box
+              sx={{
+                height: 6,
+                width: 6,
+                backgroundColor: color,
+                border: 0,
+                borderRadius: 9999,
+              }}
+            />
+            <ProxyStatusLatency latency={latency} />
+          </Box>
+        </PopoverTrigger>
+        <PopoverContent
+          id="latency-popover"
+          disableRestoreFocus
           sx={{
-            height: 6,
-            width: 6,
-            backgroundColor: color,
-            border: 0,
-            borderRadius: 9999,
+            pointerEvents: "none",
+            "& .MuiPaper-root": {
+              padding: (theme) => theme.spacing(1, 2),
+            },
           }}
-        />
-        <ProxyStatusLatency latency={latency} />
-      </Box>
-      <Popover
-        id="latency-popover"
-        disableRestoreFocus
-        anchorEl={anchorRef.current}
-        open={isOpen}
-        onClose={() => setIsOpen(false)}
-        sx={{
-          pointerEvents: "none",
-          "& .MuiPaper-root": {
-            padding: (theme) => theme.spacing(1, 2),
-            marginTop: -1,
-          },
-        }}
-        anchorOrigin={{
-          vertical: "top",
-          horizontal: "right",
-        }}
-        transformOrigin={{
-          vertical: "bottom",
-          horizontal: "right",
-        }}
-      >
-        <Box
-          sx={{
-            fontSize: 13,
-            color: (theme) => theme.palette.text.secondary,
-            fontWeight: 500,
+          anchorOrigin={{
+            vertical: "top",
+            horizontal: "right",
+          }}
+          transformOrigin={{
+            vertical: "bottom",
+            horizontal: "right",
           }}
         >
-          Selected proxy
-        </Box>
-        <Box
-          sx={{ fontSize: 14, display: "flex", gap: 3, alignItems: "center" }}
-        >
-          <Box sx={{ display: "flex", alignItems: "center", gap: 1 }}>
-            <Box width={12} height={12} lineHeight={0}>
-              <Box
-                component="img"
-                src={proxy.icon_url}
-                alt=""
-                sx={{ objectFit: "contain" }}
-                width="100%"
-                height="100%"
-              />
+          <Box
+            sx={{
+              fontSize: 13,
+              color: (theme) => theme.palette.text.secondary,
+              fontWeight: 500,
+            }}
+          >
+            Selected proxy
+          </Box>
+          <Box
+            sx={{ fontSize: 14, display: "flex", gap: 3, alignItems: "center" }}
+          >
+            <Box sx={{ display: "flex", alignItems: "center", gap: 1 }}>
+              <Box width={12} height={12} lineHeight={0}>
+                <Box
+                  component="img"
+                  src={proxy.icon_url}
+                  alt=""
+                  sx={{ objectFit: "contain" }}
+                  width="100%"
+                  height="100%"
+                />
+              </Box>
+              {proxy.display_name}
             </Box>
-            {proxy.display_name}
+            <ProxyStatusLatency latency={latency} />
           </Box>
-          <ProxyStatusLatency latency={latency} />
-        </Box>
+        </PopoverContent>
       </Popover>
     </Box>
-  )
-}
-
-const useReloading = (isDisconnected: boolean) => {
-  const [status, setStatus] = useState<"reloading" | "notReloading">(
-    "notReloading",
-  )
-
-  // Retry connection on key press when it is disconnected
-  useEffect(() => {
-    if (!isDisconnected) {
-      return
-    }
-
-    const keyDownHandler = () => {
-      setStatus("reloading")
-      window.location.reload()
-    }
-
-    document.addEventListener("keydown", keyDownHandler)
-
-    return () => {
-      document.removeEventListener("keydown", keyDownHandler)
-    }
-  }, [isDisconnected])
-
-  return {
-    status,
-  }
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   overlay: {
@@ -571,6 +510,6 @@ const useStyles = makeStyles((theme) => ({
   alertActions: {
     marginLeft: "auto",
   },
-}))
+}));
 
-export default TerminalPage
+export default TerminalPage;
diff --git a/site/src/pages/TerminalPage/TerminalPageAlert.stories.tsx b/site/src/pages/TerminalPage/TerminalPageAlert.stories.tsx
deleted file mode 100644
index d781188335f7b..0000000000000
--- a/site/src/pages/TerminalPage/TerminalPageAlert.stories.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react"
-
-import TerminalPageAlert from "./TerminalPageAlert"
-
-const meta: Meta<typeof TerminalPageAlert> = {
-  component: TerminalPageAlert,
-  title: "components/TerminalPageAlert",
-  argTypes: {
-    alertType: {
-      control: {
-        type: "radio",
-      },
-      options: ["error", "starting", "success"],
-    },
-  },
-}
-type Story = StoryObj<typeof TerminalPageAlert>
-
-export const Error: Story = {
-  args: {
-    alertType: "error",
-  },
-}
-
-export const Starting: Story = {
-  args: {
-    alertType: "starting",
-  },
-}
-
-export const Success: Story = {
-  args: {
-    alertType: "success",
-  },
-}
-
-export default meta
diff --git a/site/src/pages/TerminalPage/TerminalPageAlert.tsx b/site/src/pages/TerminalPage/TerminalPageAlert.tsx
index f40c70c3e5c83..7a157cc35b4e4 100644
--- a/site/src/pages/TerminalPage/TerminalPageAlert.tsx
+++ b/site/src/pages/TerminalPage/TerminalPageAlert.tsx
@@ -1,18 +1,18 @@
-import { AlertColor } from "@mui/material/Alert/Alert"
-import Button from "@mui/material/Button"
-import Link from "@mui/material/Link"
-import { Alert } from "components/Alert/Alert"
-import { ReactNode } from "react"
-import { docs } from "utils/docs"
+import { AlertColor } from "@mui/material/Alert/Alert";
+import Button from "@mui/material/Button";
+import Link from "@mui/material/Link";
+import { Alert } from "components/Alert/Alert";
+import { ReactNode } from "react";
+import { docs } from "utils/docs";
 
-export type TerminalPageAlertType = "error" | "starting" | "success"
+export type TerminalPageAlertType = "error" | "starting" | "success";
 
 type MapAlertTypeToComponent = {
   [key in TerminalPageAlertType]: {
-    severity: AlertColor
-    children: ReactNode | undefined
-  }
-}
+    severity: AlertColor;
+    children: ReactNode | undefined;
+  };
+};
 
 const mapAlertTypeToText: MapAlertTypeToComponent = {
   error: {
@@ -22,7 +22,9 @@ const mapAlertTypeToText: MapAlertTypeToComponent = {
         The workspace{" "}
         <Link
           title="startup script has exited with an error"
-          href={docs("/templates#startup-script-exited-with-an-error")}
+          href={docs(
+            "/templates/troubleshooting#startup-script-exited-with-an-error",
+          )}
           target="_blank"
           rel="noreferrer"
         >
@@ -31,7 +33,7 @@ const mapAlertTypeToText: MapAlertTypeToComponent = {
         , we recommend reloading this session and{" "}
         <Link
           title=" debugging the startup script"
-          href={docs("/templates#debugging-the-startup-script")}
+          href={docs("/templates/troubleshooting#debugging-the-startup-script")}
           target="_blank"
           rel="noreferrer"
         >
@@ -40,7 +42,9 @@ const mapAlertTypeToText: MapAlertTypeToComponent = {
         because{" "}
         <Link
           title="your workspace may be incomplete."
-          href={docs("/templates#your-workspace-may-be-incomplete")}
+          href={docs(
+            "/templates/troubleshooting#your-workspace-may-be-incomplete",
+          )}
           target="_blank"
           rel="noreferrer"
         >
@@ -57,7 +61,9 @@ const mapAlertTypeToText: MapAlertTypeToComponent = {
         but{" "}
         <Link
           title="your workspace may be incomplete."
-          href={docs("/templates#your-workspace-may-be-incomplete")}
+          href={docs(
+            "/templates/troubleshooting#your-workspace-may-be-incomplete",
+          )}
           target="_blank"
           rel="noreferrer"
         >
@@ -75,7 +81,9 @@ const mapAlertTypeToText: MapAlertTypeToComponent = {
         this{" "}
         <Link
           title="session was started before the startup script finished"
-          href={docs("/templates#your-workspace-may-be-incomplete")}
+          href={docs(
+            "/templates/troubleshooting#your-workspace-may-be-incomplete",
+          )}
           target="_blank"
           rel="noreferrer"
         >
@@ -86,16 +94,16 @@ const mapAlertTypeToText: MapAlertTypeToComponent = {
       </>
     ),
   },
-}
+};
 
 export default ({
   alertType,
   onDismiss,
 }: {
-  alertType: TerminalPageAlertType
-  onDismiss: () => void
+  alertType: TerminalPageAlertType;
+  onDismiss: () => void;
 }) => {
-  const severity = mapAlertTypeToText[alertType].severity
+  const severity = mapAlertTypeToText[alertType].severity;
   return (
     <Alert
       severity={severity}
@@ -118,7 +126,7 @@ export default ({
           onClick={() => {
             // By redirecting the user without the session in the URL we
             // create a new one
-            window.location.href = window.location.pathname
+            window.location.href = window.location.pathname;
           }}
         >
           Refresh session
@@ -127,5 +135,5 @@ export default ({
     >
       {mapAlertTypeToText[alertType].children}
     </Alert>
-  )
-}
+  );
+};
diff --git a/site/src/pages/UserSettingsPage/AccountPage/AccountForm.stories.tsx b/site/src/pages/UserSettingsPage/AccountPage/AccountForm.stories.tsx
new file mode 100644
index 0000000000000..70fba78867017
--- /dev/null
+++ b/site/src/pages/UserSettingsPage/AccountPage/AccountForm.stories.tsx
@@ -0,0 +1,43 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import { AccountForm } from "./AccountForm";
+import { mockApiError } from "testHelpers/entities";
+
+const meta: Meta<typeof AccountForm> = {
+  title: "pages/UserSettingsPage/AccountForm",
+  component: AccountForm,
+  args: {
+    email: "test-user@org.com",
+    isLoading: false,
+    initialValues: {
+      username: "test-user",
+    },
+    updateProfileError: undefined,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof AccountForm>;
+
+export const Example: Story = {};
+
+export const Loading: Story = {
+  args: {
+    isLoading: true,
+  },
+};
+export const WithError: Story = {
+  args: {
+    updateProfileError: mockApiError({
+      message: "Username is invalid",
+      validations: [
+        {
+          field: "username",
+          detail: "Username is too long.",
+        },
+      ],
+    }),
+    initialTouched: {
+      username: true,
+    },
+  },
+};
diff --git a/site/src/pages/UserSettingsPage/AccountPage/AccountForm.test.tsx b/site/src/pages/UserSettingsPage/AccountPage/AccountForm.test.tsx
new file mode 100644
index 0000000000000..3b6c9951b3a52
--- /dev/null
+++ b/site/src/pages/UserSettingsPage/AccountPage/AccountForm.test.tsx
@@ -0,0 +1,70 @@
+import { screen } from "@testing-library/react";
+import { MockUser2 } from "testHelpers/entities";
+import { render } from "testHelpers/renderHelpers";
+import { AccountForm } from "./AccountForm";
+import { UpdateUserProfileRequest } from "api/typesGenerated";
+
+// NOTE: it does not matter what the role props of MockUser are set to,
+//       only that editable is set to true or false. This is passed from
+//       the call to /authorization done by auth provider
+describe("AccountForm", () => {
+  describe("when editable is set to true", () => {
+    it("allows updating username", async () => {
+      // Given
+      const mockInitialValues: UpdateUserProfileRequest = {
+        username: MockUser2.username,
+      };
+
+      // When
+      render(
+        <AccountForm
+          editable
+          email={MockUser2.email}
+          initialValues={mockInitialValues}
+          isLoading={false}
+          onSubmit={() => {
+            return;
+          }}
+        />,
+      );
+
+      // Then
+      const el = await screen.findByLabelText("Username");
+      expect(el).toBeEnabled();
+      const btn = await screen.findByRole("button", {
+        name: /Update account/i,
+      });
+      expect(btn).toBeEnabled();
+    });
+  });
+
+  describe("when editable is set to false", () => {
+    it("does not allow updating username", async () => {
+      // Given
+      const mockInitialValues: UpdateUserProfileRequest = {
+        username: MockUser2.username,
+      };
+
+      // When
+      render(
+        <AccountForm
+          editable={false}
+          email={MockUser2.email}
+          initialValues={mockInitialValues}
+          isLoading={false}
+          onSubmit={() => {
+            return;
+          }}
+        />,
+      );
+
+      // Then
+      const el = await screen.findByLabelText("Username");
+      expect(el).toBeDisabled();
+      const btn = await screen.findByRole("button", {
+        name: /Update account/i,
+      });
+      expect(btn).toBeDisabled();
+    });
+  });
+});
diff --git a/site/src/pages/UserSettingsPage/AccountPage/AccountForm.tsx b/site/src/pages/UserSettingsPage/AccountPage/AccountForm.tsx
new file mode 100644
index 0000000000000..400cf20464fa2
--- /dev/null
+++ b/site/src/pages/UserSettingsPage/AccountPage/AccountForm.tsx
@@ -0,0 +1,90 @@
+import TextField from "@mui/material/TextField";
+import { FormikTouched, useFormik } from "formik";
+import { FC } from "react";
+import * as Yup from "yup";
+import {
+  getFormHelpers,
+  nameValidator,
+  onChangeTrimmed,
+} from "utils/formUtils";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { Form, FormFields } from "components/Form/Form";
+import { UpdateUserProfileRequest } from "api/typesGenerated";
+import LoadingButton from "@mui/lab/LoadingButton";
+
+export const Language = {
+  usernameLabel: "Username",
+  emailLabel: "Email",
+  updateSettings: "Update account",
+};
+
+const validationSchema = Yup.object({
+  username: nameValidator(Language.usernameLabel),
+});
+
+export interface AccountFormProps {
+  editable: boolean;
+  email: string;
+  isLoading: boolean;
+  initialValues: UpdateUserProfileRequest;
+  onSubmit: (values: UpdateUserProfileRequest) => void;
+  updateProfileError?: unknown;
+  // initialTouched is only used for testing the error state of the form.
+  initialTouched?: FormikTouched<UpdateUserProfileRequest>;
+}
+
+export const AccountForm: FC<AccountFormProps> = ({
+  editable,
+  email,
+  isLoading,
+  onSubmit,
+  initialValues,
+  updateProfileError,
+  initialTouched,
+}) => {
+  const form = useFormik({
+    initialValues,
+    validationSchema,
+    onSubmit,
+    initialTouched,
+  });
+  const getFieldHelpers = getFormHelpers(form, updateProfileError);
+
+  return (
+    <>
+      <Form onSubmit={form.handleSubmit}>
+        <FormFields>
+          {Boolean(updateProfileError) && (
+            <ErrorAlert error={updateProfileError} />
+          )}
+          <TextField
+            disabled
+            fullWidth
+            label={Language.emailLabel}
+            value={email}
+          />
+          <TextField
+            {...getFieldHelpers("username")}
+            onChange={onChangeTrimmed(form)}
+            aria-disabled={!editable}
+            autoComplete="username"
+            disabled={!editable}
+            fullWidth
+            label={Language.usernameLabel}
+          />
+
+          <div>
+            <LoadingButton
+              loading={isLoading}
+              disabled={!editable}
+              type="submit"
+              variant="contained"
+            >
+              {Language.updateSettings}
+            </LoadingButton>
+          </div>
+        </FormFields>
+      </Form>
+    </>
+  );
+};
diff --git a/site/src/pages/UserSettingsPage/AccountPage/AccountPage.test.tsx b/site/src/pages/UserSettingsPage/AccountPage/AccountPage.test.tsx
index 468d986fada23..8e776f0c674d6 100644
--- a/site/src/pages/UserSettingsPage/AccountPage/AccountPage.test.tsx
+++ b/site/src/pages/UserSettingsPage/AccountPage/AccountPage.test.tsx
@@ -1,29 +1,25 @@
-import { fireEvent, screen, waitFor } from "@testing-library/react"
-import * as API from "../../../api/api"
-import * as AccountForm from "../../../components/SettingsAccountForm/SettingsAccountForm"
-import { renderWithAuth } from "../../../testHelpers/renderHelpers"
-import * as AuthXService from "../../../xServices/auth/authXService"
-import { AccountPage } from "./AccountPage"
-import i18next from "i18next"
-import { mockApiError } from "testHelpers/entities"
-
-const { t } = i18next
+import { fireEvent, screen, waitFor } from "@testing-library/react";
+import * as API from "api/api";
+import * as AccountForm from "./AccountForm";
+import { renderWithAuth } from "testHelpers/renderHelpers";
+import { AccountPage } from "./AccountPage";
+import { mockApiError } from "testHelpers/entities";
 
 const renderPage = () => {
-  return renderWithAuth(<AccountPage />)
-}
+  return renderWithAuth(<AccountPage />);
+};
 
 const newData = {
   username: "user",
-}
+};
 
 const fillAndSubmitForm = async () => {
-  await waitFor(() => screen.findByLabelText("Username"))
+  await waitFor(() => screen.findByLabelText("Username"));
   fireEvent.change(screen.getByLabelText("Username"), {
     target: { value: newData.username },
-  })
-  fireEvent.click(screen.getByText(AccountForm.Language.updateSettings))
-}
+  });
+  fireEvent.click(screen.getByText(AccountForm.Language.updateSettings));
+};
 
 describe("AccountPage", () => {
   describe("when it is a success", () => {
@@ -41,18 +37,16 @@ describe("AccountPage", () => {
           login_type: "password",
           ...data,
         }),
-      )
-      const { user } = renderPage()
-      await fillAndSubmitForm()
+      );
+      const { user } = renderPage();
+      await fillAndSubmitForm();
 
-      const successMessage = await screen.findByText(
-        AuthXService.Language.successProfileUpdate,
-      )
-      expect(successMessage).toBeDefined()
-      expect(API.updateProfile).toBeCalledTimes(1)
-      expect(API.updateProfile).toBeCalledWith(user.id, newData)
-    })
-  })
+      const successMessage = await screen.findByText("Updated settings.");
+      expect(successMessage).toBeDefined();
+      expect(API.updateProfile).toBeCalledTimes(1);
+      expect(API.updateProfile).toBeCalledWith(user.id, newData);
+    });
+  });
 
   describe("when the username is already taken", () => {
     it("shows an error", async () => {
@@ -63,34 +57,33 @@ describe("AccountPage", () => {
             { detail: "Username is already in use", field: "username" },
           ],
         }),
-      )
+      );
 
-      const { user } = renderPage()
-      await fillAndSubmitForm()
+      const { user } = renderPage();
+      await fillAndSubmitForm();
 
-      const errorMessage = await screen.findByText("Username is already in use")
-      expect(errorMessage).toBeDefined()
-      expect(API.updateProfile).toBeCalledTimes(1)
-      expect(API.updateProfile).toBeCalledWith(user.id, newData)
-    })
-  })
+      const errorMessage = await screen.findByText(
+        "Username is already in use",
+      );
+      expect(errorMessage).toBeDefined();
+      expect(API.updateProfile).toBeCalledTimes(1);
+      expect(API.updateProfile).toBeCalledWith(user.id, newData);
+    });
+  });
 
   describe("when it is an unknown error", () => {
     it("shows a generic error message", async () => {
       jest.spyOn(API, "updateProfile").mockRejectedValueOnce({
         data: "unknown error",
-      })
+      });
 
-      const { user } = renderPage()
-      await fillAndSubmitForm()
+      const { user } = renderPage();
+      await fillAndSubmitForm();
 
-      const errorText = t("warningsAndErrors.somethingWentWrong", {
-        ns: "common",
-      })
-      const errorMessage = await screen.findByText(errorText)
-      expect(errorMessage).toBeDefined()
-      expect(API.updateProfile).toBeCalledTimes(1)
-      expect(API.updateProfile).toBeCalledWith(user.id, newData)
-    })
-  })
-})
+      const errorMessage = await screen.findByText("Something went wrong.");
+      expect(errorMessage).toBeDefined();
+      expect(API.updateProfile).toBeCalledTimes(1);
+      expect(API.updateProfile).toBeCalledWith(user.id, newData);
+    });
+  });
+});
diff --git a/site/src/pages/UserSettingsPage/AccountPage/AccountPage.tsx b/site/src/pages/UserSettingsPage/AccountPage/AccountPage.tsx
index bc2cdc793fb2a..f266383aa2ca4 100644
--- a/site/src/pages/UserSettingsPage/AccountPage/AccountPage.tsx
+++ b/site/src/pages/UserSettingsPage/AccountPage/AccountPage.tsx
@@ -1,16 +1,15 @@
-import { FC } from "react"
-import { Section } from "../../../components/SettingsLayout/Section"
-import { AccountForm } from "../../../components/SettingsAccountForm/SettingsAccountForm"
-import { useAuth } from "components/AuthProvider/AuthProvider"
-import { useMe } from "hooks/useMe"
-import { usePermissions } from "hooks/usePermissions"
+import { FC } from "react";
+import { Section } from "components/SettingsLayout/Section";
+import { AccountForm } from "./AccountForm";
+import { useAuth } from "components/AuthProvider/AuthProvider";
+import { useMe } from "hooks/useMe";
+import { usePermissions } from "hooks/usePermissions";
 
 export const AccountPage: FC = () => {
-  const [authState, authSend] = useAuth()
-  const me = useMe()
-  const permissions = usePermissions()
-  const { updateProfileError } = authState.context
-  const canEditUsers = permissions && permissions.updateUsers
+  const { updateProfile, updateProfileError, isUpdatingProfile } = useAuth();
+  const me = useMe();
+  const permissions = usePermissions();
+  const canEditUsers = permissions && permissions.updateUsers;
 
   return (
     <Section title="Account" description="Update your account info">
@@ -18,19 +17,14 @@ export const AccountPage: FC = () => {
         editable={Boolean(canEditUsers)}
         email={me.email}
         updateProfileError={updateProfileError}
-        isLoading={authState.matches("signedIn.profile.updatingProfile")}
+        isLoading={isUpdatingProfile}
         initialValues={{
           username: me.username,
         }}
-        onSubmit={(data) => {
-          authSend({
-            type: "UPDATE_PROFILE",
-            data,
-          })
-        }}
+        onSubmit={updateProfile}
       />
     </Section>
-  )
-}
+  );
+};
 
-export default AccountPage
+export default AccountPage;
diff --git a/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPage.test.tsx b/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPage.test.tsx
index 1c0ea90613663..d5d84ec767876 100644
--- a/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPage.test.tsx
+++ b/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPage.test.tsx
@@ -1,99 +1,88 @@
-import { fireEvent, screen, within } from "@testing-library/react"
-import * as API from "../../../api/api"
-import { renderWithAuth } from "../../../testHelpers/renderHelpers"
-import { Language as SSHKeysPageLanguage, SSHKeysPage } from "./SSHKeysPage"
-import { Language as SSHKeysPageViewLanguage } from "./SSHKeysPageView"
-import { i18n } from "i18n"
-import { MockGitSSHKey, mockApiError } from "testHelpers/entities"
-
-const { t } = i18n
+import { fireEvent, screen, within } from "@testing-library/react";
+import * as API from "api/api";
+import { renderWithAuth } from "testHelpers/renderHelpers";
+import { Language as SSHKeysPageLanguage, SSHKeysPage } from "./SSHKeysPage";
+import { MockGitSSHKey, mockApiError } from "testHelpers/entities";
 
 describe("SSH keys Page", () => {
   it("shows the SSH key", async () => {
-    renderWithAuth(<SSHKeysPage />)
-    await screen.findByText(MockGitSSHKey.public_key)
-  })
+    renderWithAuth(<SSHKeysPage />);
+    await screen.findByText(MockGitSSHKey.public_key);
+  });
 
   describe("regenerate SSH key", () => {
     describe("when it is success", () => {
       it("shows a success message and updates the ssh key on the page", async () => {
-        renderWithAuth(<SSHKeysPage />)
+        renderWithAuth(<SSHKeysPage />);
 
         // Wait to the ssh be rendered on the screen
-        await screen.findByText(MockGitSSHKey.public_key)
+        await screen.findByText(MockGitSSHKey.public_key);
 
         // Click on the "Regenerate" button to display the confirm dialog
-        const regenerateButton = screen.getByRole("button", {
-          name: SSHKeysPageViewLanguage.regenerateLabel,
-        })
-        fireEvent.click(regenerateButton)
-        const confirmDialog = screen.getByRole("dialog")
+        const regenerateButton = screen.getByTestId("regenerate");
+        fireEvent.click(regenerateButton);
+        const confirmDialog = screen.getByRole("dialog");
         expect(confirmDialog).toHaveTextContent(
           SSHKeysPageLanguage.regenerateDialogMessage,
-        )
+        );
 
         const newUserSSHKey =
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDSC/ouD/LqiT1Rd99vDv/MwUmqzJuinLTMTpk5kVy66"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDSC/ouD/LqiT1Rd99vDv/MwUmqzJuinLTMTpk5kVy66";
         jest.spyOn(API, "regenerateUserSSHKey").mockResolvedValueOnce({
           ...MockGitSSHKey,
           public_key: newUserSSHKey,
-        })
+        });
 
         // Click on the "Confirm" button
         const confirmButton = within(confirmDialog).getByRole("button", {
           name: SSHKeysPageLanguage.confirmLabel,
-        })
-        fireEvent.click(confirmButton)
+        });
+        fireEvent.click(confirmButton);
 
         // Check if the success message is displayed
-        const successMessage = t("sshRegenerateSuccessMessage", {
-          ns: "userSettingsPage",
-        })
-        await screen.findByText(successMessage)
+        await screen.findByText("SSH Key regenerated successfully.");
 
         // Check if the API was called correctly
-        expect(API.regenerateUserSSHKey).toBeCalledTimes(1)
+        expect(API.regenerateUserSSHKey).toBeCalledTimes(1);
 
         // Check if the SSH key is updated
-        await screen.findByText(newUserSSHKey)
-      })
-    })
+        await screen.findByText(newUserSSHKey);
+      });
+    });
 
     describe("when it fails", () => {
       it("shows an error message", async () => {
-        renderWithAuth(<SSHKeysPage />)
+        renderWithAuth(<SSHKeysPage />);
 
         // Wait to the ssh be rendered on the screen
-        await screen.findByText(MockGitSSHKey.public_key)
+        await screen.findByText(MockGitSSHKey.public_key);
 
         jest.spyOn(API, "regenerateUserSSHKey").mockRejectedValueOnce(
           mockApiError({
             message: "Error regenerating SSH key",
           }),
-        )
+        );
 
         // Click on the "Regenerate" button to display the confirm dialog
-        const regenerateButton = screen.getByRole("button", {
-          name: SSHKeysPageViewLanguage.regenerateLabel,
-        })
-        fireEvent.click(regenerateButton)
-        const confirmDialog = screen.getByRole("dialog")
+        const regenerateButton = screen.getByTestId("regenerate");
+        fireEvent.click(regenerateButton);
+        const confirmDialog = screen.getByRole("dialog");
         expect(confirmDialog).toHaveTextContent(
           SSHKeysPageLanguage.regenerateDialogMessage,
-        )
+        );
 
         // Click on the "Confirm" button
         const confirmButton = within(confirmDialog).getByRole("button", {
           name: SSHKeysPageLanguage.confirmLabel,
-        })
-        fireEvent.click(confirmButton)
+        });
+        fireEvent.click(confirmButton);
 
         // Check if the error message is displayed
-        await screen.findByText("Error regenerating SSH key")
+        await screen.findByText("Error regenerating SSH key");
 
         // Check if the API was called correctly
-        expect(API.regenerateUserSSHKey).toBeCalledTimes(1)
-      })
-    })
-  })
-})
+        expect(API.regenerateUserSSHKey).toBeCalledTimes(1);
+      });
+    });
+  });
+});
diff --git a/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPage.tsx b/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPage.tsx
index 7feceb30c47e4..10512591c28b0 100644
--- a/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPage.tsx
+++ b/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPage.tsx
@@ -1,9 +1,11 @@
-import { useMachine } from "@xstate/react"
-import { PropsWithChildren, FC } from "react"
-import { sshKeyMachine } from "xServices/sshKey/sshKeyXService"
-import { ConfirmDialog } from "../../../components/Dialogs/ConfirmDialog/ConfirmDialog"
-import { Section } from "../../../components/SettingsLayout/Section"
-import { SSHKeysPageView } from "./SSHKeysPageView"
+import { PropsWithChildren, FC, useState } from "react";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
+import { Section } from "components/SettingsLayout/Section";
+import { SSHKeysPageView } from "./SSHKeysPageView";
+import { regenerateUserSSHKey, userSSHKey } from "api/queries/sshKeys";
+import { useMutation, useQuery, useQueryClient } from "react-query";
+import { getErrorMessage } from "api/errors";
 
 export const Language = {
   title: "SSH keys",
@@ -12,48 +14,57 @@ export const Language = {
     "You will need to replace the public SSH key on services you use it with, and you'll need to rebuild existing workspaces.",
   confirmLabel: "Confirm",
   cancelLabel: "Cancel",
-}
+};
 
 export const SSHKeysPage: FC<PropsWithChildren<unknown>> = () => {
-  const [sshState, sshSend] = useMachine(sshKeyMachine)
-  const isLoading = sshState.matches("gettingSSHKey")
-  const hasLoaded = sshState.matches("loaded")
-  const { getSSHKeyError, regenerateSSHKeyError, sshKey } = sshState.context
-
-  const onRegenerateClick = () => {
-    sshSend({ type: "REGENERATE_SSH_KEY" })
-  }
+  const [isConfirmingRegeneration, setIsConfirmingRegeneration] =
+    useState(false);
+  const queryClient = useQueryClient();
+  const userSSHKeyQuery = useQuery(userSSHKey("me"));
+  const regenerateSSHKeyMutation = useMutation(
+    regenerateUserSSHKey("me", queryClient),
+  );
 
   return (
     <>
       <Section title={Language.title}>
         <SSHKeysPageView
-          isLoading={isLoading}
-          hasLoaded={hasLoaded}
-          getSSHKeyError={getSSHKeyError}
-          regenerateSSHKeyError={regenerateSSHKeyError}
-          sshKey={sshKey}
-          onRegenerateClick={onRegenerateClick}
+          isLoading={userSSHKeyQuery.isLoading}
+          getSSHKeyError={userSSHKeyQuery.error}
+          regenerateSSHKeyError={regenerateSSHKeyMutation.error}
+          sshKey={userSSHKeyQuery.data}
+          onRegenerateClick={() => {
+            setIsConfirmingRegeneration(true);
+          }}
         />
       </Section>
 
       <ConfirmDialog
         type="delete"
         hideCancel={false}
-        open={sshState.matches("confirmSSHKeyRegenerate")}
-        confirmLoading={sshState.matches("regeneratingSSHKey")}
+        open={isConfirmingRegeneration}
+        confirmLoading={regenerateSSHKeyMutation.isLoading}
         title={Language.regenerateDialogTitle}
         confirmText={Language.confirmLabel}
-        onConfirm={() => {
-          sshSend({ type: "CONFIRM_REGENERATE_SSH_KEY" })
+        onConfirm={async () => {
+          try {
+            await regenerateSSHKeyMutation.mutateAsync();
+            displaySuccess("SSH Key regenerated successfully.");
+          } catch (error) {
+            displayError(
+              getErrorMessage(error, "Failed to regenerate SSH key"),
+            );
+          } finally {
+            setIsConfirmingRegeneration(false);
+          }
         }}
         onClose={() => {
-          sshSend({ type: "CANCEL_REGENERATE_SSH_KEY" })
+          setIsConfirmingRegeneration(false);
         }}
         description={<>{Language.regenerateDialogMessage}</>}
       />
     </>
-  )
-}
+  );
+};
 
-export default SSHKeysPage
+export default SSHKeysPage;
diff --git a/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPageView.stories.tsx b/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPageView.stories.tsx
index 9b51e231adb29..4d8d46b5d4087 100644
--- a/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPageView.stories.tsx
+++ b/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPageView.stories.tsx
@@ -1,53 +1,45 @@
-import { Story } from "@storybook/react"
-import { mockApiError } from "testHelpers/entities"
-import { SSHKeysPageView, SSHKeysPageViewProps } from "./SSHKeysPageView"
+import { mockApiError } from "testHelpers/entities";
+import { SSHKeysPageView } from "./SSHKeysPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "components/SSHKeysPageView",
+const meta: Meta<typeof SSHKeysPageView> = {
+  title: "pages/UserSettingsPage/SSHKeysPageView",
   component: SSHKeysPageView,
-  argTypes: {
-    onRegenerateClick: { action: "Submit" },
+  args: {
+    isLoading: false,
+    sshKey: {
+      user_id: "test-user-id",
+      created_at: "2022-07-28T07:45:50.795918897Z",
+      updated_at: "2022-07-28T07:45:50.795919142Z",
+      public_key: "SSH-Key",
+    },
   },
-}
+};
 
-const Template: Story<SSHKeysPageViewProps> = (args: SSHKeysPageViewProps) => (
-  <SSHKeysPageView {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof SSHKeysPageView>;
 
-export const Example = Template.bind({})
-Example.args = {
-  isLoading: false,
-  hasLoaded: true,
-  sshKey: {
-    user_id: "test-user-id",
-    created_at: "2022-07-28T07:45:50.795918897Z",
-    updated_at: "2022-07-28T07:45:50.795919142Z",
-    public_key: "SSH-Key",
-  },
-  onRegenerateClick: () => {
-    return Promise.resolve()
-  },
-}
+export const Example: Story = {};
 
-export const Loading = Template.bind({})
-Loading.args = {
-  ...Example.args,
-  isLoading: true,
-}
+export const Loading: Story = {
+  args: {
+    isLoading: true,
+  },
+};
 
-export const WithGetSSHKeyError = Template.bind({})
-WithGetSSHKeyError.args = {
-  ...Example.args,
-  hasLoaded: false,
-  getSSHKeyError: mockApiError({
-    message: "Failed to get SSH key",
-  }),
-}
+export const WithGetSSHKeyError: Story = {
+  args: {
+    sshKey: undefined,
+    getSSHKeyError: mockApiError({
+      message: "Failed to get SSH key",
+    }),
+  },
+};
 
-export const WithRegenerateSSHKeyError = Template.bind({})
-WithRegenerateSSHKeyError.args = {
-  ...Example.args,
-  regenerateSSHKeyError: mockApiError({
-    message: "Failed to regenerate SSH key",
-  }),
-}
+export const WithRegenerateSSHKeyError: Story = {
+  args: {
+    regenerateSSHKeyError: mockApiError({
+      message: "Failed to regenerate SSH key",
+    }),
+  },
+};
diff --git a/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPageView.tsx b/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPageView.tsx
index 5e9b27f043585..7ded569057a85 100644
--- a/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPageView.tsx
+++ b/site/src/pages/UserSettingsPage/SSHKeysPage/SSHKeysPageView.tsx
@@ -1,44 +1,36 @@
-import { makeStyles } from "@mui/styles"
-import Box from "@mui/material/Box"
-import Button from "@mui/material/Button"
-import CircularProgress from "@mui/material/CircularProgress"
-import { GitSSHKey } from "api/typesGenerated"
-import { CodeExample } from "components/CodeExample/CodeExample"
-import { Stack } from "components/Stack/Stack"
-import { FC } from "react"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
-
-export const Language = {
-  regenerateLabel: "Regenerate",
-}
+import Box from "@mui/material/Box";
+import Button from "@mui/material/Button";
+import CircularProgress from "@mui/material/CircularProgress";
+import { type FC, type PropsWithChildren } from "react";
+import { useTheme } from "@emotion/react";
+import type { GitSSHKey } from "api/typesGenerated";
+import { CodeExample } from "components/CodeExample/CodeExample";
+import { Stack } from "components/Stack/Stack";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
 
 export interface SSHKeysPageViewProps {
-  isLoading: boolean
-  hasLoaded: boolean
-  getSSHKeyError?: unknown
-  regenerateSSHKeyError?: unknown
-  sshKey?: GitSSHKey
-  onRegenerateClick: () => void
+  isLoading: boolean;
+  getSSHKeyError?: unknown;
+  regenerateSSHKeyError?: unknown;
+  sshKey?: GitSSHKey;
+  onRegenerateClick: () => void;
 }
 
-export const SSHKeysPageView: FC<
-  React.PropsWithChildren<SSHKeysPageViewProps>
-> = ({
+export const SSHKeysPageView: FC<PropsWithChildren<SSHKeysPageViewProps>> = ({
   isLoading,
-  hasLoaded,
   getSSHKeyError,
   regenerateSSHKeyError,
   sshKey,
   onRegenerateClick,
 }) => {
-  const styles = useStyles()
+  const theme = useTheme();
 
   if (isLoading) {
     return (
       <Box p={4}>
         <CircularProgress size={26} />
       </Box>
-    )
+    );
   }
 
   return (
@@ -49,37 +41,39 @@ export const SSHKeysPageView: FC<
       {Boolean(regenerateSSHKeyError) && (
         <ErrorAlert error={regenerateSSHKeyError} dismissible />
       )}
-      {hasLoaded && sshKey && (
+      {sshKey && (
         <>
-          <p className={styles.description}>
+          <p
+            css={{
+              fontSize: 14,
+              color: theme.palette.text.secondary,
+              margin: 0,
+            }}
+          >
             The following public key is used to authenticate Git in workspaces.
             You may add it to Git services (such as GitHub) that you need to
             access from your workspace. Coder configures authentication via{" "}
-            <code className={styles.code}>$GIT_SSH_COMMAND</code>.
+            <code
+              css={{
+                background: theme.palette.divider,
+                fontSize: 12,
+                padding: "2px 4px",
+                color: theme.palette.text.primary,
+                borderRadius: 2,
+              }}
+            >
+              $GIT_SSH_COMMAND
+            </code>
+            .
           </p>
           <CodeExample code={sshKey.public_key.trim()} />
           <div>
-            <Button onClick={onRegenerateClick}>
-              {Language.regenerateLabel}
+            <Button onClick={onRegenerateClick} data-testid="regenerate">
+              Regenerate&hellip;
             </Button>
           </div>
         </>
       )}
     </Stack>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  description: {
-    fontSize: 14,
-    color: theme.palette.text.secondary,
-    margin: 0,
-  },
-  code: {
-    background: theme.palette.divider,
-    fontSize: 12,
-    padding: "2px 4px",
-    color: theme.palette.text.primary,
-    borderRadius: 2,
-  },
-}))
+  );
+};
diff --git a/site/src/pages/UserSettingsPage/SchedulePage/ScheduleForm.stories.tsx b/site/src/pages/UserSettingsPage/SchedulePage/ScheduleForm.stories.tsx
new file mode 100644
index 0000000000000..db90165e45bde
--- /dev/null
+++ b/site/src/pages/UserSettingsPage/SchedulePage/ScheduleForm.stories.tsx
@@ -0,0 +1,62 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import { ScheduleForm } from "./ScheduleForm";
+import { mockApiError } from "testHelpers/entities";
+import { action } from "@storybook/addon-actions";
+
+const defaultArgs = {
+  submitting: false,
+  initialValues: {
+    raw_schedule: "CRON_TZ=Australia/Sydney 0 2 * * *",
+    user_set: false,
+    time: "02:00",
+    timezone: "Australia/Sydney",
+    next: "2023-09-05T02:00:00+10:00",
+  },
+  updateErr: undefined,
+  now: new Date("2023-09-04T15:00:00+10:00"),
+  onSubmit: action("onSubmit"),
+};
+
+const meta: Meta<typeof ScheduleForm> = {
+  title: "pages/UserSettingsPage/ScheduleForm",
+  component: ScheduleForm,
+  args: defaultArgs,
+};
+export default meta;
+
+type Story = StoryObj<typeof ScheduleForm>;
+
+export const ExampleDefault: Story = {};
+
+export const ExampleUserSet: Story = {
+  args: {
+    initialValues: {
+      raw_schedule: "CRON_TZ=America/Chicago 0 2 * * *",
+      user_set: true,
+      time: "02:00",
+      timezone: "America/Chicago",
+      next: "2023-09-05T02:00:00-05:00",
+    },
+    now: new Date("2023-09-04T15:00:00-05:00"),
+  },
+};
+
+export const Submitting: Story = {
+  args: {
+    isLoading: true,
+  },
+};
+
+export const WithError: Story = {
+  args: {
+    submitError: mockApiError({
+      message: "Invalid schedule",
+      validations: [
+        {
+          field: "schedule",
+          detail: "Could not validate cron schedule.",
+        },
+      ],
+    }),
+  },
+};
diff --git a/site/src/pages/UserSettingsPage/SchedulePage/ScheduleForm.tsx b/site/src/pages/UserSettingsPage/SchedulePage/ScheduleForm.tsx
new file mode 100644
index 0000000000000..38104575761b7
--- /dev/null
+++ b/site/src/pages/UserSettingsPage/SchedulePage/ScheduleForm.tsx
@@ -0,0 +1,139 @@
+import TextField from "@mui/material/TextField";
+import { FormikContextType, useFormik } from "formik";
+import { FC, useEffect, useState } from "react";
+import * as Yup from "yup";
+import { getFormHelpers } from "utils/formUtils";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { Form, FormFields } from "components/Form/Form";
+import {
+  UpdateUserQuietHoursScheduleRequest,
+  UserQuietHoursScheduleResponse,
+} from "api/typesGenerated";
+import MenuItem from "@mui/material/MenuItem";
+import { Stack } from "components/Stack/Stack";
+import { timeZones, getPreferredTimezone } from "utils/timeZones";
+import { Alert } from "components/Alert/Alert";
+import { timeToCron, quietHoursDisplay, validTime } from "utils/schedule";
+import LoadingButton from "@mui/lab/LoadingButton";
+
+export interface ScheduleFormValues {
+  time: string;
+  timezone: string;
+}
+
+const validationSchema = Yup.object({
+  time: Yup.string()
+    .ensure()
+    .test("is-time-string", "Time must be in HH:mm format.", (value) => {
+      if (!validTime(value)) {
+        return false;
+      }
+      const parts = value.split(":");
+      const HH = Number(parts[0]);
+      const mm = Number(parts[1]);
+      return HH >= 0 && HH <= 23 && mm >= 0 && mm <= 59;
+    }),
+  timezone: Yup.string().required(),
+});
+
+export interface ScheduleFormProps {
+  isLoading: boolean;
+  initialValues: UserQuietHoursScheduleResponse;
+  submitError: unknown;
+  onSubmit: (data: UpdateUserQuietHoursScheduleRequest) => void;
+  // now can be set to force the time used for "Next occurrence" in tests.
+  now?: Date;
+}
+
+export const ScheduleForm: FC<React.PropsWithChildren<ScheduleFormProps>> = ({
+  isLoading,
+  initialValues,
+  submitError,
+  onSubmit,
+  now,
+}) => {
+  // Update every 15 seconds to update the "Next occurrence" field.
+  const [, setTime] = useState<number>(Date.now());
+  useEffect(() => {
+    const interval = setInterval(() => setTime(Date.now()), 15000);
+    return () => {
+      clearInterval(interval);
+    };
+  }, []);
+
+  // If the user has a custom schedule, use that as the initial values.
+  // Otherwise, use the default time, with their local timezone.
+  const formInitialValues = { ...initialValues };
+  if (!initialValues.user_set) {
+    formInitialValues.timezone = getPreferredTimezone();
+  }
+
+  const form: FormikContextType<ScheduleFormValues> =
+    useFormik<ScheduleFormValues>({
+      initialValues: formInitialValues,
+      validationSchema,
+      onSubmit: (values) => {
+        onSubmit({
+          schedule: timeToCron(values.time, values.timezone),
+        });
+      },
+    });
+  const getFieldHelpers = getFormHelpers<ScheduleFormValues>(form, submitError);
+
+  return (
+    <Form onSubmit={form.handleSubmit}>
+      <FormFields>
+        {Boolean(submitError) && <ErrorAlert error={submitError} />}
+
+        {!initialValues.user_set && (
+          <Alert severity="info">
+            You are currently using the default quiet hours schedule, which
+            starts every day at <code>{initialValues.time}</code> in{" "}
+            <code>{initialValues.timezone}</code>.
+          </Alert>
+        )}
+
+        <Stack direction="row">
+          <TextField
+            {...getFieldHelpers("time")}
+            disabled={isLoading}
+            label="Start time"
+            type="time"
+            fullWidth
+          />
+          <TextField
+            {...getFieldHelpers("timezone")}
+            disabled={isLoading}
+            label="Timezone"
+            select
+            fullWidth
+          >
+            {timeZones.map((zone) => (
+              <MenuItem key={zone} value={zone}>
+                {zone}
+              </MenuItem>
+            ))}
+          </TextField>
+        </Stack>
+
+        <TextField
+          disabled
+          fullWidth
+          label="Next occurrence"
+          value={quietHoursDisplay(form.values.time, form.values.timezone, now)}
+        />
+
+        <div>
+          <LoadingButton
+            loading={isLoading}
+            disabled={isLoading}
+            type="submit"
+            variant="contained"
+          >
+            Update schedule
+          </LoadingButton>
+        </div>
+      </FormFields>
+    </Form>
+  );
+};
diff --git a/site/src/pages/UserSettingsPage/SchedulePage/SchedulePage.test.tsx b/site/src/pages/UserSettingsPage/SchedulePage/SchedulePage.test.tsx
new file mode 100644
index 0000000000000..06f2fcdd43367
--- /dev/null
+++ b/site/src/pages/UserSettingsPage/SchedulePage/SchedulePage.test.tsx
@@ -0,0 +1,124 @@
+import { fireEvent, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { renderWithAuth } from "testHelpers/renderHelpers";
+import { SchedulePage } from "./SchedulePage";
+import { server } from "testHelpers/server";
+import { MockUser } from "testHelpers/entities";
+import { rest } from "msw";
+
+const fillForm = async ({
+  hour,
+  minute,
+  timezone,
+}: {
+  hour: number;
+  minute: number;
+  timezone: string;
+}) => {
+  const user = userEvent.setup();
+  await waitFor(() => screen.findByLabelText("Start time"));
+  const HH = hour.toString().padStart(2, "0");
+  const mm = minute.toString().padStart(2, "0");
+  fireEvent.change(screen.getByLabelText("Start time"), {
+    target: { value: `${HH}:${mm}` },
+  });
+
+  const timezoneDropdown = screen.getByLabelText("Timezone");
+  await user.click(timezoneDropdown);
+  const list = screen.getByRole("listbox");
+  const option = within(list).getByText(timezone);
+  await user.click(option);
+};
+
+const submitForm = async () => {
+  fireEvent.click(screen.getByText("Update schedule"));
+};
+
+const defaultQuietHoursResponse = {
+  raw_schedule: "CRON_TZ=America/Chicago 0 0 * * *",
+  user_set: false,
+  time: "00:00",
+  timezone: "America/Chicago",
+  next: "", // not consumed by the frontend
+};
+
+const cronTests = [
+  {
+    timezone: "Australia/Sydney",
+    hour: 0,
+    minute: 0,
+  },
+] as const;
+
+describe("SchedulePage", () => {
+  beforeEach(() => {
+    // appear logged out
+    server.use(
+      rest.get(`/api/v2/users/${MockUser.id}/quiet-hours`, (req, res, ctx) => {
+        return res(ctx.status(200), ctx.json(defaultQuietHoursResponse));
+      }),
+    );
+  });
+
+  describe("cron tests", () => {
+    it.each(cronTests)(
+      "case %# has the correct expected time",
+      async (test) => {
+        server.use(
+          rest.put(
+            `/api/v2/users/${MockUser.id}/quiet-hours`,
+            async (req, res, ctx) => {
+              const data = await req.json();
+              return res(
+                ctx.status(200),
+                ctx.json({
+                  response: {},
+                  raw_schedule: data.schedule,
+                  user_set: true,
+                  time: `${test.hour.toString().padStart(2, "0")}:${test.minute
+                    .toString()
+                    .padStart(2, "0")}`,
+                  timezone: test.timezone,
+                  next: "", // This value isn't used in the UI, the UI generates it.
+                }),
+              );
+            },
+          ),
+        );
+
+        renderWithAuth(<SchedulePage />);
+        await fillForm(test);
+        await submitForm();
+        const successMessage = await screen.findByText(
+          "Schedule updated successfully",
+        );
+        expect(successMessage).toBeDefined();
+      },
+    );
+  });
+
+  describe("when it is an unknown error", () => {
+    it("shows a generic error message", async () => {
+      server.use(
+        rest.put(
+          `/api/v2/users/${MockUser.id}/quiet-hours`,
+          (req, res, ctx) => {
+            return res(
+              ctx.status(500),
+              ctx.json({
+                message: "oh no!",
+              }),
+            );
+          },
+        ),
+      );
+
+      renderWithAuth(<SchedulePage />);
+      await fillForm(cronTests[0]);
+      await submitForm();
+
+      const errorMessage = await screen.findByText("oh no!");
+      expect(errorMessage).toBeDefined();
+    });
+  });
+});
diff --git a/site/src/pages/UserSettingsPage/SchedulePage/SchedulePage.tsx b/site/src/pages/UserSettingsPage/SchedulePage/SchedulePage.tsx
new file mode 100644
index 0000000000000..66f27465571c4
--- /dev/null
+++ b/site/src/pages/UserSettingsPage/SchedulePage/SchedulePage.tsx
@@ -0,0 +1,61 @@
+import { FC } from "react";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { Section } from "components/SettingsLayout/Section";
+import { ScheduleForm } from "./ScheduleForm";
+import { useMe } from "hooks/useMe";
+import { Loader } from "components/Loader/Loader";
+import { useMutation, useQuery, useQueryClient } from "react-query";
+import {
+  updateUserQuietHoursSchedule,
+  userQuietHoursSchedule,
+} from "api/queries/settings";
+import { displaySuccess } from "components/GlobalSnackbar/utils";
+
+export const SchedulePage: FC = () => {
+  const me = useMe();
+  const queryClient = useQueryClient();
+
+  const {
+    data: quietHoursSchedule,
+    error,
+    isLoading,
+    isError,
+  } = useQuery(userQuietHoursSchedule(me.id));
+
+  const {
+    mutate: onSubmit,
+    error: submitError,
+    isLoading: mutationLoading,
+  } = useMutation(updateUserQuietHoursSchedule(me.id, queryClient));
+
+  if (isLoading) {
+    return <Loader />;
+  }
+
+  if (isError) {
+    return <ErrorAlert error={error} />;
+  }
+
+  return (
+    <Section
+      title="Quiet hours"
+      layout="fluid"
+      description="Workspaces may be automatically updated during your quiet hours, as configured by your administrators."
+    >
+      <ScheduleForm
+        isLoading={mutationLoading}
+        initialValues={quietHoursSchedule}
+        submitError={submitError}
+        onSubmit={(values) => {
+          onSubmit(values, {
+            onSuccess: () => {
+              displaySuccess("Schedule updated successfully");
+            },
+          });
+        }}
+      />
+    </Section>
+  );
+};
+
+export default SchedulePage;
diff --git a/site/src/pages/UserSettingsPage/SecurityPage/SecurityPage.test.tsx b/site/src/pages/UserSettingsPage/SecurityPage/SecurityPage.test.tsx
index d5ef50fad2ba5..f13334b7af73f 100644
--- a/site/src/pages/UserSettingsPage/SecurityPage/SecurityPage.test.tsx
+++ b/site/src/pages/UserSettingsPage/SecurityPage/SecurityPage.test.tsx
@@ -1,73 +1,67 @@
-import { fireEvent, screen, waitFor, within } from "@testing-library/react"
-import * as API from "../../../api/api"
-import * as SecurityForm from "../../../components/SettingsSecurityForm/SettingsSecurityForm"
+import { fireEvent, screen, waitFor, within } from "@testing-library/react";
+import * as API from "api/api";
+import * as SecurityForm from "./SettingsSecurityForm";
 import {
   renderWithAuth,
   waitForLoaderToBeRemoved,
-} from "../../../testHelpers/renderHelpers"
-import { SecurityPage } from "./SecurityPage"
-import i18next from "i18next"
+} from "testHelpers/renderHelpers";
+import { SecurityPage } from "./SecurityPage";
 import {
   MockAuthMethodsWithPasswordType,
   mockApiError,
-} from "testHelpers/entities"
-import userEvent from "@testing-library/user-event"
-import * as SSO from "./SingleSignOnSection"
-import { OAuthConversionResponse } from "api/typesGenerated"
-
-const { t } = i18next
+} from "testHelpers/entities";
+import userEvent from "@testing-library/user-event";
+import * as SSO from "./SingleSignOnSection";
+import { OAuthConversionResponse } from "api/typesGenerated";
 
 const renderPage = async () => {
-  const utils = renderWithAuth(<SecurityPage />)
-  await waitForLoaderToBeRemoved()
-  return utils
-}
+  const utils = renderWithAuth(<SecurityPage />);
+  await waitForLoaderToBeRemoved();
+  return utils;
+};
 
 const newSecurityFormValues = {
   old_password: "password1",
   password: "password2",
   confirm_password: "password2",
-}
+};
 
 const fillAndSubmitSecurityForm = () => {
   fireEvent.change(screen.getByLabelText("Old Password"), {
     target: { value: newSecurityFormValues.old_password },
-  })
+  });
   fireEvent.change(screen.getByLabelText("New Password"), {
     target: { value: newSecurityFormValues.password },
-  })
+  });
   fireEvent.change(screen.getByLabelText("Confirm Password"), {
     target: { value: newSecurityFormValues.confirm_password },
-  })
-  fireEvent.click(screen.getByText(SecurityForm.Language.updatePassword))
-}
+  });
+  fireEvent.click(screen.getByText(SecurityForm.Language.updatePassword));
+};
 
 beforeEach(() => {
   jest
     .spyOn(API, "getAuthMethods")
-    .mockResolvedValue(MockAuthMethodsWithPasswordType)
+    .mockResolvedValue(MockAuthMethodsWithPasswordType);
   jest.spyOn(API, "getUserLoginType").mockResolvedValue({
     login_type: "password",
-  })
-})
+  });
+});
 
 test("update password successfully", async () => {
   jest
     .spyOn(API, "updateUserPassword")
-    .mockImplementationOnce((_userId, _data) => Promise.resolve(undefined))
-  const { user } = await renderPage()
-  fillAndSubmitSecurityForm()
+    .mockImplementationOnce((_userId, _data) => Promise.resolve(undefined));
+  const { user } = await renderPage();
+  fillAndSubmitSecurityForm();
 
-  const expectedMessage = t("securityUpdateSuccessMessage", {
-    ns: "userSettingsPage",
-  })
-  const successMessage = await screen.findByText(expectedMessage)
-  expect(successMessage).toBeDefined()
-  expect(API.updateUserPassword).toBeCalledTimes(1)
-  expect(API.updateUserPassword).toBeCalledWith(user.id, newSecurityFormValues)
+  const successMessage = await screen.findByText("Updated password.");
+  expect(successMessage).toBeDefined();
+  expect(API.updateUserPassword).toBeCalledTimes(1);
+  expect(API.updateUserPassword).toBeCalledWith(user.id, newSecurityFormValues);
 
-  await waitFor(() => expect(window.location).toBeAt("/"))
-})
+  await waitFor(() => expect(window.location).toBeAt("/"));
+});
 
 test("update password with incorrect old password", async () => {
   jest.spyOn(API, "updateUserPassword").mockRejectedValueOnce(
@@ -75,17 +69,17 @@ test("update password with incorrect old password", async () => {
       message: "Incorrect password.",
       validations: [{ detail: "Incorrect password.", field: "old_password" }],
     }),
-  )
+  );
 
-  const { user } = await renderPage()
-  fillAndSubmitSecurityForm()
+  const { user } = await renderPage();
+  fillAndSubmitSecurityForm();
 
-  const errorMessage = await screen.findAllByText("Incorrect password.")
-  expect(errorMessage).toBeDefined()
-  expect(errorMessage).toHaveLength(2)
-  expect(API.updateUserPassword).toBeCalledTimes(1)
-  expect(API.updateUserPassword).toBeCalledWith(user.id, newSecurityFormValues)
-})
+  const errorMessage = await screen.findAllByText("Incorrect password.");
+  expect(errorMessage).toBeDefined();
+  expect(errorMessage).toHaveLength(2);
+  expect(API.updateUserPassword).toBeCalledTimes(1);
+  expect(API.updateUserPassword).toBeCalledWith(user.id, newSecurityFormValues);
+});
 
 test("update password with invalid password", async () => {
   jest.spyOn(API, "updateUserPassword").mockRejectedValueOnce(
@@ -93,38 +87,35 @@ test("update password with invalid password", async () => {
       message: "Invalid password.",
       validations: [{ detail: "Invalid password.", field: "password" }],
     }),
-  )
+  );
 
-  const { user } = await renderPage()
-  fillAndSubmitSecurityForm()
+  const { user } = await renderPage();
+  fillAndSubmitSecurityForm();
 
-  const errorMessage = await screen.findAllByText("Invalid password.")
-  expect(errorMessage).toBeDefined()
-  expect(errorMessage).toHaveLength(2)
-  expect(API.updateUserPassword).toBeCalledTimes(1)
-  expect(API.updateUserPassword).toBeCalledWith(user.id, newSecurityFormValues)
-})
+  const errorMessage = await screen.findAllByText("Invalid password.");
+  expect(errorMessage).toBeDefined();
+  expect(errorMessage).toHaveLength(2);
+  expect(API.updateUserPassword).toBeCalledTimes(1);
+  expect(API.updateUserPassword).toBeCalledWith(user.id, newSecurityFormValues);
+});
 
 test("update password when submit returns an unknown error", async () => {
   jest.spyOn(API, "updateUserPassword").mockRejectedValueOnce({
     data: "unknown error",
-  })
+  });
 
-  const { user } = await renderPage()
-  fillAndSubmitSecurityForm()
+  const { user } = await renderPage();
+  fillAndSubmitSecurityForm();
 
-  const errorText = t("warningsAndErrors.somethingWentWrong", {
-    ns: "common",
-  })
-  const errorMessage = await screen.findByText(errorText)
-  expect(errorMessage).toBeDefined()
-  expect(API.updateUserPassword).toBeCalledTimes(1)
-  expect(API.updateUserPassword).toBeCalledWith(user.id, newSecurityFormValues)
-})
+  const errorMessage = await screen.findByText("Something went wrong.");
+  expect(errorMessage).toBeDefined();
+  expect(API.updateUserPassword).toBeCalledTimes(1);
+  expect(API.updateUserPassword).toBeCalledWith(user.id, newSecurityFormValues);
+});
 
 test("change login type to OIDC", async () => {
-  const user = userEvent.setup()
-  const { user: userData } = await renderPage()
+  const user = userEvent.setup();
+  const { user: userData } = await renderPage();
   const convertToOAUTHSpy = jest
     .spyOn(API, "convertToOAUTH")
     .mockResolvedValue({
@@ -132,28 +123,29 @@ test("change login type to OIDC", async () => {
       expires_at: "2021-01-01T00:00:00Z",
       to_type: "oidc",
       user_id: userData.id,
-    } as OAuthConversionResponse)
+    } as OAuthConversionResponse);
 
   jest.spyOn(SSO, "redirectToOIDCAuth").mockImplementation(() => {
     // Does a noop
-  })
+    return "";
+  });
 
-  const ssoSection = screen.getByTestId("sso-section")
-  const githubButton = within(ssoSection).getByText("GitHub", { exact: false })
-  await user.click(githubButton)
+  const ssoSection = screen.getByTestId("sso-section");
+  const githubButton = within(ssoSection).getByText("GitHub", { exact: false });
+  await user.click(githubButton);
 
-  const confirmationDialog = await screen.findByTestId("dialog")
+  const confirmationDialog = await screen.findByTestId("dialog");
   const confirmPasswordField = within(confirmationDialog).getByLabelText(
     "Confirm your password",
-  )
-  await user.type(confirmPasswordField, "password123")
-  const updateButton = within(confirmationDialog).getByText("Update")
-  await user.click(updateButton)
+  );
+  await user.type(confirmPasswordField, "password123");
+  const updateButton = within(confirmationDialog).getByText("Update");
+  await user.click(updateButton);
 
   await waitFor(() => {
     expect(convertToOAUTHSpy).toHaveBeenCalledWith({
       password: "password123",
       to_type: "github",
-    })
-  })
-})
+    });
+  });
+});
diff --git a/site/src/pages/UserSettingsPage/SecurityPage/SecurityPage.tsx b/site/src/pages/UserSettingsPage/SecurityPage/SecurityPage.tsx
index 36f0db6f38c63..5d06b74f13d43 100644
--- a/site/src/pages/UserSettingsPage/SecurityPage/SecurityPage.tsx
+++ b/site/src/pages/UserSettingsPage/SecurityPage/SecurityPage.tsx
@@ -1,41 +1,30 @@
-import { useMachine } from "@xstate/react"
-import { useMe } from "hooks/useMe"
-import { ComponentProps, FC } from "react"
-import { userSecuritySettingsMachine } from "xServices/userSecuritySettings/userSecuritySettingsXService"
-import { Section } from "../../../components/SettingsLayout/Section"
-import { SecurityForm } from "../../../components/SettingsSecurityForm/SettingsSecurityForm"
-import { useQuery } from "@tanstack/react-query"
-import { getAuthMethods, getUserLoginType } from "api/api"
+import { useMe } from "hooks/useMe";
+import { ComponentProps, FC } from "react";
+import { Section } from "components/SettingsLayout/Section";
+import { SecurityForm } from "./SettingsSecurityForm";
+import { useMutation, useQuery } from "react-query";
+import { getUserLoginType } from "api/api";
 import {
   SingleSignOnSection,
   useSingleSignOnSection,
-} from "./SingleSignOnSection"
-import { Loader } from "components/Loader/Loader"
-import { Stack } from "components/Stack/Stack"
+} from "./SingleSignOnSection";
+import { Loader } from "components/Loader/Loader";
+import { Stack } from "components/Stack/Stack";
+import { authMethods, updatePassword } from "api/queries/users";
+import { displaySuccess } from "components/GlobalSnackbar/utils";
 
 export const SecurityPage: FC = () => {
-  const me = useMe()
-  const [securityState, securitySend] = useMachine(
-    userSecuritySettingsMachine,
-    {
-      context: {
-        userId: me.id,
-      },
-    },
-  )
-  const { error } = securityState.context
-  const { data: authMethods } = useQuery({
-    queryKey: ["authMethods"],
-    queryFn: getAuthMethods,
-  })
+  const me = useMe();
+  const updatePasswordMutation = useMutation(updatePassword());
+  const authMethodsQuery = useQuery(authMethods());
   const { data: userLoginType } = useQuery({
     queryKey: ["loginType"],
     queryFn: getUserLoginType,
-  })
-  const singleSignOnSection = useSingleSignOnSection()
+  });
+  const singleSignOnSection = useSingleSignOnSection();
 
-  if (!authMethods || !userLoginType) {
-    return <Loader />
+  if (!authMethodsQuery.data || !userLoginType) {
+    return <Loader />;
   }
 
   return (
@@ -43,37 +32,41 @@ export const SecurityPage: FC = () => {
       security={{
         form: {
           disabled: userLoginType.login_type !== "password",
-          error,
-          isLoading: securityState.matches("updatingSecurity"),
-          onSubmit: (data) => {
-            securitySend({
-              type: "UPDATE_SECURITY",
-              data,
-            })
+          error: updatePasswordMutation.error,
+          isLoading: updatePasswordMutation.isLoading,
+          onSubmit: async (data) => {
+            await updatePasswordMutation.mutateAsync({
+              userId: me.id,
+              ...data,
+            });
+            displaySuccess("Updated password.");
+            // Refresh the browser session. We need to improve the AuthProvider
+            // to include better API to handle these scenarios
+            window.location.href = location.origin;
           },
         },
       }}
       oidc={{
         section: {
-          authMethods,
+          authMethods: authMethodsQuery.data,
           userLoginType,
           ...singleSignOnSection,
         },
       }}
     />
-  )
-}
+  );
+};
 
 export const SecurityPageView = ({
   security,
   oidc,
 }: {
   security: {
-    form: ComponentProps<typeof SecurityForm>
-  }
+    form: ComponentProps<typeof SecurityForm>;
+  };
   oidc?: {
-    section: ComponentProps<typeof SingleSignOnSection>
-  }
+    section: ComponentProps<typeof SingleSignOnSection>;
+  };
 }) => {
   return (
     <Stack spacing={6}>
@@ -82,7 +75,7 @@ export const SecurityPageView = ({
       </Section>
       {oidc && <SingleSignOnSection {...oidc.section} />}
     </Stack>
-  )
-}
+  );
+};
 
-export default SecurityPage
+export default SecurityPage;
diff --git a/site/src/pages/UserSettingsPage/SecurityPage/SecurityPageView.stories.tsx b/site/src/pages/UserSettingsPage/SecurityPage/SecurityPageView.stories.tsx
index f0f71abf2f170..b7c96c53b8245 100644
--- a/site/src/pages/UserSettingsPage/SecurityPage/SecurityPageView.stories.tsx
+++ b/site/src/pages/UserSettingsPage/SecurityPage/SecurityPageView.stories.tsx
@@ -1,12 +1,12 @@
-import type { Meta, StoryObj } from "@storybook/react"
-import { SecurityPageView } from "./SecurityPage"
-import { action } from "@storybook/addon-actions"
+import type { Meta, StoryObj } from "@storybook/react";
+import { SecurityPageView } from "./SecurityPage";
+import { action } from "@storybook/addon-actions";
 import {
   MockAuthMethods,
   MockAuthMethodsWithPasswordType,
-} from "testHelpers/entities"
-import { ComponentProps } from "react"
-import set from "lodash/fp/set"
+} from "testHelpers/entities";
+import { ComponentProps } from "react";
+import set from "lodash/fp/set";
 
 const defaultArgs: ComponentProps<typeof SecurityPageView> = {
   security: {
@@ -31,25 +31,25 @@ const defaultArgs: ComponentProps<typeof SecurityPageView> = {
       openConfirmation: action("openConfirmation"),
     },
   },
-}
+};
 
 const meta: Meta<typeof SecurityPageView> = {
-  title: "pages/SecurityPageView",
+  title: "pages/UserSettingsPage/SecurityPageView",
   component: SecurityPageView,
   args: defaultArgs,
-}
+};
 
-export default meta
-type Story = StoryObj<typeof SecurityPageView>
+export default meta;
+type Story = StoryObj<typeof SecurityPageView>;
 
-export const UsingOIDC: Story = {}
+export const UsingOIDC: Story = {};
 
 export const NoOIDCAvailable: Story = {
   args: {
     ...defaultArgs,
     oidc: undefined,
   },
-}
+};
 
 export const UserLoginTypeIsPassword: Story = {
   args: set(
@@ -57,7 +57,7 @@ export const UserLoginTypeIsPassword: Story = {
     MockAuthMethodsWithPasswordType,
     defaultArgs,
   ),
-}
+};
 
 export const ConfirmingOIDCConversion: Story = {
   args: set(
@@ -69,4 +69,4 @@ export const ConfirmingOIDCConversion: Story = {
     },
     defaultArgs,
   ),
-}
+};
diff --git a/site/src/pages/UserSettingsPage/SecurityPage/SettingsSecurityForm.stories.tsx b/site/src/pages/UserSettingsPage/SecurityPage/SettingsSecurityForm.stories.tsx
new file mode 100644
index 0000000000000..e8bd94add4b10
--- /dev/null
+++ b/site/src/pages/UserSettingsPage/SecurityPage/SettingsSecurityForm.stories.tsx
@@ -0,0 +1,40 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import { SecurityForm } from "./SettingsSecurityForm";
+import { mockApiError } from "testHelpers/entities";
+
+const meta: Meta<typeof SecurityForm> = {
+  title: "pages/UserSettingsPage/SecurityForm",
+  component: SecurityForm,
+  args: {
+    isLoading: false,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof SecurityForm>;
+
+export const Example: Story = {
+  args: {
+    isLoading: false,
+  },
+};
+
+export const Loading: Story = {
+  args: {
+    isLoading: true,
+  },
+};
+
+export const WithError: Story = {
+  args: {
+    error: mockApiError({
+      message: "Old password is incorrect",
+      validations: [
+        {
+          field: "old_password",
+          detail: "Old password is incorrect.",
+        },
+      ],
+    }),
+  },
+};
diff --git a/site/src/components/SettingsSecurityForm/SettingsSecurityForm.tsx b/site/src/pages/UserSettingsPage/SecurityPage/SettingsSecurityForm.tsx
similarity index 79%
rename from site/src/components/SettingsSecurityForm/SettingsSecurityForm.tsx
rename to site/src/pages/UserSettingsPage/SecurityPage/SettingsSecurityForm.tsx
index 39230f3837b1b..143e6213832b9 100644
--- a/site/src/components/SettingsSecurityForm/SettingsSecurityForm.tsx
+++ b/site/src/pages/UserSettingsPage/SecurityPage/SettingsSecurityForm.tsx
@@ -1,17 +1,17 @@
-import TextField from "@mui/material/TextField"
-import { FormikContextType, useFormik } from "formik"
-import { FC } from "react"
-import * as Yup from "yup"
-import { getFormHelpers } from "../../utils/formUtils"
-import { LoadingButton } from "../LoadingButton/LoadingButton"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
-import { Form, FormFields } from "components/Form/Form"
-import { Alert } from "components/Alert/Alert"
+import TextField from "@mui/material/TextField";
+import { FormikContextType, useFormik } from "formik";
+import { FC } from "react";
+import * as Yup from "yup";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { Form, FormFields } from "components/Form/Form";
+import { Alert } from "components/Alert/Alert";
+import { getFormHelpers } from "utils/formUtils";
+import LoadingButton from "@mui/lab/LoadingButton";
 
 interface SecurityFormValues {
-  old_password: string
-  password: string
-  confirm_password: string
+  old_password: string;
+  password: string;
+  confirm_password: string;
 }
 
 export const Language = {
@@ -25,7 +25,7 @@ export const Language = {
   passwordMaxLength: "Password must be no more than 64 characters",
   confirmPasswordMatch: "Password and confirmation must match",
   updatePassword: "Update password",
-}
+};
 
 const validationSchema = Yup.object({
   old_password: Yup.string().trim().required(Language.oldPasswordRequired),
@@ -37,15 +37,15 @@ const validationSchema = Yup.object({
   confirm_password: Yup.string()
     .trim()
     .test("passwords-match", Language.confirmPasswordMatch, function (value) {
-      return (this.parent as SecurityFormValues).password === value
+      return (this.parent as SecurityFormValues).password === value;
     }),
-})
+});
 
 export interface SecurityFormProps {
-  disabled: boolean
-  isLoading: boolean
-  onSubmit: (values: SecurityFormValues) => void
-  error?: unknown
+  disabled: boolean;
+  isLoading: boolean;
+  onSubmit: (values: SecurityFormValues) => void;
+  error?: unknown;
 }
 
 export const SecurityForm: FC<SecurityFormProps> = ({
@@ -63,15 +63,15 @@ export const SecurityForm: FC<SecurityFormProps> = ({
       },
       validationSchema,
       onSubmit,
-    })
-  const getFieldHelpers = getFormHelpers<SecurityFormValues>(form, error)
+    });
+  const getFieldHelpers = getFormHelpers<SecurityFormValues>(form, error);
 
   if (disabled) {
     return (
       <Alert severity="info">
         Password changes are only allowed for password based accounts.
       </Alert>
-    )
+    );
   }
 
   return (
@@ -107,11 +107,11 @@ export const SecurityForm: FC<SecurityFormProps> = ({
               type="submit"
               variant="contained"
             >
-              {isLoading ? "" : Language.updatePassword}
+              {Language.updatePassword}
             </LoadingButton>
           </div>
         </FormFields>
       </Form>
     </>
-  )
-}
+  );
+};
diff --git a/site/src/pages/UserSettingsPage/SecurityPage/SingleSignOnSection.tsx b/site/src/pages/UserSettingsPage/SecurityPage/SingleSignOnSection.tsx
index 6d793d2e2546d..2fed4ee0ebe73 100644
--- a/site/src/pages/UserSettingsPage/SecurityPage/SingleSignOnSection.tsx
+++ b/site/src/pages/UserSettingsPage/SecurityPage/SingleSignOnSection.tsx
@@ -1,46 +1,63 @@
-import { useState } from "react"
-import { Section } from "../../../components/SettingsLayout/Section"
-import TextField from "@mui/material/TextField"
-import Box from "@mui/material/Box"
-import GitHubIcon from "@mui/icons-material/GitHub"
-import KeyIcon from "@mui/icons-material/VpnKey"
-import Button from "@mui/material/Button"
-import Typography from "@mui/material/Typography"
-import { convertToOAUTH } from "api/api"
-import { AuthMethods, LoginType, UserLoginType } from "api/typesGenerated"
-import Skeleton from "@mui/material/Skeleton"
-import { Stack } from "components/Stack/Stack"
-import { useMutation } from "@tanstack/react-query"
-import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog"
-import { getErrorMessage } from "api/errors"
-import CheckCircleOutlined from "@mui/icons-material/CheckCircleOutlined"
+import { useState } from "react";
+import { Section } from "components/SettingsLayout/Section";
+import TextField from "@mui/material/TextField";
+import Box from "@mui/material/Box";
+import GitHubIcon from "@mui/icons-material/GitHub";
+import KeyIcon from "@mui/icons-material/VpnKey";
+import Button from "@mui/material/Button";
+import Typography from "@mui/material/Typography";
+import { convertToOAUTH } from "api/api";
+import {
+  AuthMethods,
+  LoginType,
+  OIDCAuthMethod,
+  UserLoginType,
+} from "api/typesGenerated";
+import { Stack } from "components/Stack/Stack";
+import { useMutation } from "react-query";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import { getErrorMessage } from "api/errors";
+import CheckCircleOutlined from "@mui/icons-material/CheckCircleOutlined";
+import { EmptyState } from "components/EmptyState/EmptyState";
+import { makeStyles } from "@mui/styles";
+import Link from "@mui/material/Link";
+import { docs } from "utils/docs";
 
 type LoginTypeConfirmation =
   | {
-      open: false
-      selectedType: undefined
+      open: false;
+      selectedType: undefined;
     }
   | {
-      open: true
-      selectedType: LoginType
-    }
+      open: true;
+      selectedType: LoginType;
+    };
 
 export const redirectToOIDCAuth = (
   toType: string,
   stateString: string,
   redirectTo: string,
 ) => {
-  window.location.href = `/api/v2/users/${toType}/callback?oidc_merge_state=${stateString}&redirect=${redirectTo}`
-}
+  switch (toType) {
+    case "github":
+      window.location.href = `/api/v2/users/oauth2/github/callback?oidc_merge_state=${stateString}&redirect=${redirectTo}`;
+      break;
+    case "oidc":
+      window.location.href = `/api/v2/users/oidc/callback?oidc_merge_state=${stateString}&redirect=${redirectTo}`;
+      break;
+    default:
+      throw new Error(`Unknown login type ${toType}`);
+  }
+};
 
 export const useSingleSignOnSection = () => {
   const [loginTypeConfirmation, setLoginTypeConfirmation] =
-    useState<LoginTypeConfirmation>({ open: false, selectedType: undefined })
+    useState<LoginTypeConfirmation>({ open: false, selectedType: undefined });
 
   const mutation = useMutation(convertToOAUTH, {
     onSuccess: (data) => {
       const loginTypeMsg =
-        data.to_type === "github" ? "Github" : "OpenID Connect"
+        data.to_type === "github" ? "Github" : "OpenID Connect";
       redirectToOIDCAuth(
         data.to_type,
         data.state_string,
@@ -49,28 +66,28 @@ export const useSingleSignOnSection = () => {
         encodeURIComponent(
           `/login?info=Login type has been changed to ${loginTypeMsg}. Log in again using the new method.`,
         ),
-      )
+      );
     },
-  })
+  });
 
   const openConfirmation = (selectedType: LoginType) => {
-    setLoginTypeConfirmation({ open: true, selectedType })
-  }
+    setLoginTypeConfirmation({ open: true, selectedType });
+  };
 
   const closeConfirmation = () => {
-    setLoginTypeConfirmation({ open: false, selectedType: undefined })
-    mutation.reset()
-  }
+    setLoginTypeConfirmation({ open: false, selectedType: undefined });
+    mutation.reset();
+  };
 
   const confirm = (password: string) => {
     if (!loginTypeConfirmation.selectedType) {
-      throw new Error("No login type selected")
+      throw new Error("No login type selected");
     }
     mutation.mutate({
       to_type: loginTypeConfirmation.selectedType,
       password,
-    })
-  }
+    });
+  };
 
   return {
     openConfirmation,
@@ -81,13 +98,39 @@ export const useSingleSignOnSection = () => {
     isUpdating: mutation.isLoading || mutation.isSuccess,
     isConfirming: loginTypeConfirmation.open,
     error: mutation.error,
-  }
+  };
+};
+
+const useEmptyStateStyles = makeStyles((theme) => ({
+  root: {
+    minHeight: 0,
+    padding: theme.spacing(6, 4),
+    backgroundColor: theme.palette.background.paper,
+    borderRadius: theme.shape.borderRadius,
+  },
+}));
+
+function SSOEmptyState() {
+  const styles = useEmptyStateStyles();
+
+  return (
+    <EmptyState
+      className={styles.root}
+      message="No SSO Providers"
+      description="No SSO providers are configured with this Coder deployment."
+      cta={
+        <Link href={docs("/admin/auth")} target="_blank" rel="noreferrer">
+          Learn how to add a provider
+        </Link>
+      }
+    />
+  );
 }
 
 type SingleSignOnSectionProps = ReturnType<typeof useSingleSignOnSection> & {
-  authMethods: AuthMethods
-  userLoginType: UserLoginType
-}
+  authMethods: AuthMethods;
+  userLoginType: UserLoginType;
+};
 
 export const SingleSignOnSection = ({
   authMethods,
@@ -99,6 +142,12 @@ export const SingleSignOnSection = ({
   isConfirming,
   error,
 }: SingleSignOnSectionProps) => {
+  const authList = Object.values(
+    authMethods,
+  ) as (typeof authMethods)[keyof typeof authMethods][];
+
+  const noSsoEnabled = !authList.some((method) => method.enabled);
+
   return (
     <>
       <Section
@@ -107,73 +156,69 @@ export const SingleSignOnSection = ({
         description="Authenticate in Coder using one-click"
       >
         <Box display="grid" gap="16px">
-          {authMethods && userLoginType ? (
-            userLoginType.login_type === "password" ? (
-              <>
-                {authMethods.github.enabled && (
-                  <Button
-                    disabled={isUpdating}
-                    onClick={() => openConfirmation("github")}
-                    startIcon={<GitHubIcon sx={{ width: 16, height: 16 }} />}
-                    fullWidth
-                    size="large"
-                  >
-                    GitHub
-                  </Button>
-                )}
-                {authMethods.oidc.enabled && (
-                  <Button
-                    size="large"
-                    startIcon={<OIDCIcon authMethods={authMethods} />}
-                    fullWidth
-                    disabled={isUpdating}
-                    onClick={() => openConfirmation("oidc")}
-                  >
-                    {getOIDCLabel(authMethods)}
-                  </Button>
-                )}
-              </>
-            ) : (
-              <Box
+          {userLoginType.login_type === "password" ? (
+            <>
+              {authMethods.github.enabled && (
+                <Button
+                  size="large"
+                  fullWidth
+                  disabled={isUpdating}
+                  startIcon={<GitHubIcon sx={{ width: 16, height: 16 }} />}
+                  onClick={() => openConfirmation("github")}
+                >
+                  GitHub
+                </Button>
+              )}
+
+              {authMethods.oidc.enabled && (
+                <Button
+                  size="large"
+                  fullWidth
+                  disabled={isUpdating}
+                  startIcon={<OIDCIcon oidcAuth={authMethods.oidc} />}
+                  onClick={() => openConfirmation("oidc")}
+                >
+                  {getOIDCLabel(authMethods.oidc)}
+                </Button>
+              )}
+
+              {noSsoEnabled && <SSOEmptyState />}
+            </>
+          ) : (
+            <Box
+              sx={{
+                background: (theme) => theme.palette.background.paper,
+                borderRadius: 1,
+                border: (theme) => `1px solid ${theme.palette.divider}`,
+                padding: 2,
+                display: "flex",
+                gap: 2,
+                alignItems: "center",
+                fontSize: 14,
+              }}
+            >
+              <CheckCircleOutlined
                 sx={{
-                  background: (theme) => theme.palette.background.paper,
-                  borderRadius: 1,
-                  border: (theme) => `1px solid ${theme.palette.divider}`,
-                  padding: 2,
-                  display: "flex",
-                  gap: 2,
-                  alignItems: "center",
-                  fontSize: 14,
+                  color: (theme) => theme.palette.success.light,
+                  fontSize: 16,
                 }}
-              >
-                <CheckCircleOutlined
-                  sx={{
-                    color: (theme) => theme.palette.success.light,
-                    fontSize: 16,
-                  }}
-                />
-                <span>
-                  Authenticated with{" "}
-                  <strong>
-                    {userLoginType.login_type === "github"
-                      ? "GitHub"
-                      : getOIDCLabel(authMethods)}
-                  </strong>
-                </span>
-                <Box sx={{ ml: "auto", lineHeight: 1 }}>
-                  {userLoginType.login_type === "github" ? (
-                    <GitHubIcon sx={{ width: 16, height: 16 }} />
-                  ) : (
-                    <OIDCIcon authMethods={authMethods} />
-                  )}
-                </Box>
+              />
+              <span>
+                Authenticated with{" "}
+                <strong>
+                  {userLoginType.login_type === "github"
+                    ? "GitHub"
+                    : getOIDCLabel(authMethods.oidc)}
+                </strong>
+              </span>
+              <Box sx={{ ml: "auto", lineHeight: 1 }}>
+                {userLoginType.login_type === "github" ? (
+                  <GitHubIcon sx={{ width: 16, height: 16 }} />
+                ) : (
+                  <OIDCIcon oidcAuth={authMethods.oidc} />
+                )}
               </Box>
-            )
-          ) : (
-            <Skeleton
-              variant="rectangular"
-              sx={{ height: 40, borderRadius: 1 }}
-            />
+            </Box>
           )}
         </Box>
       </Section>
@@ -186,25 +231,27 @@ export const SingleSignOnSection = ({
         onConfirm={confirm}
       />
     </>
-  )
-}
+  );
+};
 
-const OIDCIcon = ({ authMethods }: { authMethods: AuthMethods }) => {
-  return authMethods.oidc.iconUrl ? (
+const OIDCIcon = ({ oidcAuth }: { oidcAuth: OIDCAuthMethod }) => {
+  if (!oidcAuth.iconUrl) {
+    return <KeyIcon sx={{ width: 16, height: 16 }} />;
+  }
+
+  return (
     <Box
       component="img"
       alt="Open ID Connect icon"
-      src={authMethods.oidc.iconUrl}
+      src={oidcAuth.iconUrl}
       sx={{ width: 16, height: 16 }}
     />
-  ) : (
-    <KeyIcon sx={{ width: 16, height: 16 }} />
-  )
-}
+  );
+};
 
-const getOIDCLabel = (authMethods: AuthMethods) => {
-  return authMethods.oidc.signInText || "OpenID Connect"
-}
+const getOIDCLabel = (oidcAuth: OIDCAuthMethod) => {
+  return oidcAuth.signInText || "OpenID Connect";
+};
 
 const ConfirmLoginTypeChangeModal = ({
   open,
@@ -213,23 +260,23 @@ const ConfirmLoginTypeChangeModal = ({
   onClose,
   onConfirm,
 }: {
-  open: boolean
-  loading: boolean
-  error: unknown
-  onClose: () => void
-  onConfirm: (password: string) => void
+  open: boolean;
+  loading: boolean;
+  error: unknown;
+  onClose: () => void;
+  onConfirm: (password: string) => void;
 }) => {
-  const [password, setPassword] = useState("")
+  const [password, setPassword] = useState("");
 
   const handleConfirm = () => {
-    onConfirm(password)
-  }
+    onConfirm(password);
+  };
 
   return (
     <ConfirmDialog
       open={open}
       onClose={() => {
-        onClose()
+        onClose();
       }}
       onConfirm={handleConfirm}
       hideCancel={false}
@@ -247,7 +294,7 @@ const ConfirmLoginTypeChangeModal = ({
             autoFocus
             onKeyDown={(event) => {
               if (event.key === "Enter") {
-                handleConfirm()
+                handleConfirm();
               }
             }}
             error={Boolean(error)}
@@ -266,5 +313,5 @@ const ConfirmLoginTypeChangeModal = ({
         </Stack>
       }
     />
-  )
-}
+  );
+};
diff --git a/site/src/pages/UserSettingsPage/TokensPage/ConfirmDeleteDialog.stories.tsx b/site/src/pages/UserSettingsPage/TokensPage/ConfirmDeleteDialog.stories.tsx
new file mode 100644
index 0000000000000..e2062fe0aad34
--- /dev/null
+++ b/site/src/pages/UserSettingsPage/TokensPage/ConfirmDeleteDialog.stories.tsx
@@ -0,0 +1,39 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import { MockToken } from "testHelpers/entities";
+import { ConfirmDeleteDialog } from "./ConfirmDeleteDialog";
+import { QueryClient, QueryClientProvider } from "react-query";
+
+const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      retry: false,
+      cacheTime: 0,
+      refetchOnWindowFocus: false,
+    },
+  },
+});
+
+const meta: Meta<typeof ConfirmDeleteDialog> = {
+  title: "pages/UserSettingsPage/TokensDeleteDialog",
+  component: ConfirmDeleteDialog,
+  decorators: [
+    (Story) => (
+      <QueryClientProvider client={queryClient}>
+        <Story />
+      </QueryClientProvider>
+    ),
+  ],
+};
+
+export default meta;
+type Story = StoryObj<typeof ConfirmDeleteDialog>;
+
+export const DeleteDialog: Story = {
+  args: {
+    queryKey: ["tokens"],
+    token: MockToken,
+    setToken: () => {
+      return null;
+    },
+  },
+};
diff --git a/site/src/pages/UserSettingsPage/TokensPage/ConfirmDeleteDialog.tsx b/site/src/pages/UserSettingsPage/TokensPage/ConfirmDeleteDialog.tsx
new file mode 100644
index 0000000000000..7c588251c4483
--- /dev/null
+++ b/site/src/pages/UserSettingsPage/TokensPage/ConfirmDeleteDialog.tsx
@@ -0,0 +1,61 @@
+import { FC } from "react";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import { useDeleteToken } from "./hooks";
+import { displaySuccess, displayError } from "components/GlobalSnackbar/utils";
+import { getErrorMessage } from "api/errors";
+import { APIKeyWithOwner } from "api/typesGenerated";
+
+export interface ConfirmDeleteDialogProps {
+  queryKey: (string | boolean)[];
+  token: APIKeyWithOwner | undefined;
+  setToken: (arg: APIKeyWithOwner | undefined) => void;
+}
+
+export const ConfirmDeleteDialog: FC<ConfirmDeleteDialogProps> = ({
+  queryKey,
+  token,
+  setToken,
+}) => {
+  const tokenName = token?.token_name;
+
+  const { mutate: deleteToken, isLoading: isDeleting } =
+    useDeleteToken(queryKey);
+
+  const onDeleteSuccess = () => {
+    displaySuccess("Token has been deleted");
+    setToken(undefined);
+  };
+
+  const onDeleteError = (error: unknown) => {
+    const message = getErrorMessage(error, "Failed to delete token");
+    displayError(message);
+    setToken(undefined);
+  };
+
+  return (
+    <ConfirmDialog
+      type="delete"
+      title="Delete Token"
+      description={
+        <>
+          Are you sure you want to permanently delete token{" "}
+          <strong>{tokenName}</strong>?
+        </>
+      }
+      open={Boolean(token) || isDeleting}
+      confirmLoading={isDeleting}
+      onConfirm={() => {
+        if (!token) {
+          return;
+        }
+        deleteToken(token.id, {
+          onError: onDeleteError,
+          onSuccess: onDeleteSuccess,
+        });
+      }}
+      onClose={() => {
+        setToken(undefined);
+      }}
+    />
+  );
+};
diff --git a/site/src/pages/UserSettingsPage/TokensPage/TokensPage.tsx b/site/src/pages/UserSettingsPage/TokensPage/TokensPage.tsx
index fc7505a5f3ee5..5842426fe1fb8 100644
--- a/site/src/pages/UserSettingsPage/TokensPage/TokensPage.tsx
+++ b/site/src/pages/UserSettingsPage/TokensPage/TokensPage.tsx
@@ -1,33 +1,35 @@
-import { FC, PropsWithChildren, useState } from "react"
-import { Section } from "components/SettingsLayout/Section"
-import { TokensPageView } from "./TokensPageView"
-import makeStyles from "@mui/styles/makeStyles"
-import { useTranslation } from "react-i18next"
-import { useTokensData } from "./hooks"
-import { ConfirmDeleteDialog } from "./components"
-import { Stack } from "components/Stack/Stack"
-import Button from "@mui/material/Button"
-import { Link as RouterLink } from "react-router-dom"
-import AddIcon from "@mui/icons-material/AddOutlined"
-import { APIKeyWithOwner } from "api/typesGenerated"
+import { FC, PropsWithChildren, useState } from "react";
+import { Section } from "components/SettingsLayout/Section";
+import { TokensPageView } from "./TokensPageView";
+import { useTokensData } from "./hooks";
+import { ConfirmDeleteDialog } from "./ConfirmDeleteDialog";
+import { Stack } from "components/Stack/Stack";
+import Button from "@mui/material/Button";
+import { Link as RouterLink } from "react-router-dom";
+import AddIcon from "@mui/icons-material/AddOutlined";
+import { APIKeyWithOwner } from "api/typesGenerated";
+import { css } from "@emotion/react";
 
 export const TokensPage: FC<PropsWithChildren<unknown>> = () => {
-  const styles = useStyles()
-  const { t } = useTranslation("tokensPage")
-
-  const cliCreateCommand = "coder tokens create"
+  const cliCreateCommand = "coder tokens create";
 
   const TokenActions = () => (
-    <Stack direction="row" justifyContent="end" className={styles.tokenActions}>
+    <Stack
+      direction="row"
+      justifyContent="end"
+      css={(theme) => ({
+        marginBottom: theme.spacing(1),
+      })}
+    >
       <Button startIcon={<AddIcon />} component={RouterLink} to="new">
-        {t("tokenActions.addToken")}
+        Add token
       </Button>
     </Stack>
-  )
+  );
 
   const [tokenToDelete, setTokenToDelete] = useState<
     APIKeyWithOwner | undefined
-  >(undefined)
+  >(undefined);
 
   const {
     data: tokens,
@@ -39,13 +41,21 @@ export const TokensPage: FC<PropsWithChildren<unknown>> = () => {
     // we currently do not show all tokens in the UI, even if
     // the user has read all permissions
     include_all: false,
-  })
+  });
 
   return (
     <>
       <Section
-        title={t("title")}
-        className={styles.section}
+        title="Tokens"
+        css={(theme) => css`
+          & code {
+            background: ${theme.palette.divider};
+            font-size: 12px;
+            padding: 2px 4px;
+            color: ${theme.palette.text.primary};
+            border-radius: 2px;
+          }
+        `}
         description={
           <>
             Tokens are used to authenticate with the Coder API. You can create a
@@ -62,7 +72,7 @@ export const TokensPage: FC<PropsWithChildren<unknown>> = () => {
           hasLoaded={isFetched}
           getTokensError={getTokensError}
           onDelete={(token) => {
-            setTokenToDelete(token)
+            setTokenToDelete(token);
           }}
         />
       </Section>
@@ -72,22 +82,7 @@ export const TokensPage: FC<PropsWithChildren<unknown>> = () => {
         setToken={setTokenToDelete}
       />
     </>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  section: {
-    "& code": {
-      background: theme.palette.divider,
-      fontSize: 12,
-      padding: "2px 4px",
-      color: theme.palette.text.primary,
-      borderRadius: 2,
-    },
-  },
-  tokenActions: {
-    marginBottom: theme.spacing(1),
-  },
-}))
+  );
+};
 
-export default TokensPage
+export default TokensPage;
diff --git a/site/src/pages/UserSettingsPage/TokensPage/TokensPageView.stories.tsx b/site/src/pages/UserSettingsPage/TokensPage/TokensPageView.stories.tsx
index 6748f53b74ba4..c536692dae497 100644
--- a/site/src/pages/UserSettingsPage/TokensPage/TokensPageView.stories.tsx
+++ b/site/src/pages/UserSettingsPage/TokensPage/TokensPageView.stories.tsx
@@ -1,56 +1,52 @@
-import { Story } from "@storybook/react"
-import { mockApiError, MockTokens } from "testHelpers/entities"
-import { TokensPageView, TokensPageViewProps } from "./TokensPageView"
+import { mockApiError, MockTokens } from "testHelpers/entities";
+import { TokensPageView } from "./TokensPageView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "components/TokensPageView",
+const meta: Meta<typeof TokensPageView> = {
+  title: "pages/UserSettingsPage/TokensPageView",
   component: TokensPageView,
   args: {
-    onRegenerateClick: { action: "Submit" },
+    isLoading: false,
+    hasLoaded: true,
+    tokens: MockTokens,
+    onDelete: () => {
+      return Promise.resolve();
+    },
   },
-}
+};
 
-const Template: Story<TokensPageViewProps> = (args: TokensPageViewProps) => (
-  <TokensPageView {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof TokensPageView>;
 
-export const Example = Template.bind({})
-Example.args = {
-  isLoading: false,
-  hasLoaded: true,
-  tokens: MockTokens,
-  onDelete: () => {
-    return Promise.resolve()
-  },
-}
+export const Example: Story = {};
 
-export const Loading = Template.bind({})
-Loading.args = {
-  ...Example.args,
-  isLoading: true,
-  hasLoaded: false,
-}
+export const Loading: Story = {
+  args: {
+    isLoading: true,
+    hasLoaded: false,
+  },
+};
 
-export const Empty = Template.bind({})
-Empty.args = {
-  ...Example.args,
-  tokens: [],
-}
+export const Empty: Story = {
+  args: {
+    tokens: [],
+  },
+};
 
-export const WithGetTokensError = Template.bind({})
-WithGetTokensError.args = {
-  ...Example.args,
-  hasLoaded: false,
-  getTokensError: mockApiError({
-    message: "Failed to get tokens.",
-  }),
-}
+export const WithGetTokensError: Story = {
+  args: {
+    hasLoaded: false,
+    getTokensError: mockApiError({
+      message: "Failed to get tokens.",
+    }),
+  },
+};
 
-export const WithDeleteTokenError = Template.bind({})
-WithDeleteTokenError.args = {
-  ...Example.args,
-  hasLoaded: false,
-  deleteTokenError: mockApiError({
-    message: "Failed to delete token.",
-  }),
-}
+export const WithDeleteTokenError: Story = {
+  args: {
+    hasLoaded: false,
+    deleteTokenError: mockApiError({
+      message: "Failed to delete token.",
+    }),
+  },
+};
diff --git a/site/src/pages/UserSettingsPage/TokensPage/TokensPageView.tsx b/site/src/pages/UserSettingsPage/TokensPage/TokensPageView.tsx
index 43150e8422407..73a0560145f89 100644
--- a/site/src/pages/UserSettingsPage/TokensPage/TokensPageView.tsx
+++ b/site/src/pages/UserSettingsPage/TokensPage/TokensPageView.tsx
@@ -1,38 +1,37 @@
-import { useTheme } from "@mui/styles"
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableHead from "@mui/material/TableHead"
-import TableRow from "@mui/material/TableRow"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { Stack } from "components/Stack/Stack"
-import { TableEmpty } from "components/TableEmpty/TableEmpty"
-import { TableLoader } from "components/TableLoader/TableLoader"
-import DeleteOutlineIcon from "@mui/icons-material/DeleteOutline"
-import dayjs from "dayjs"
-import { FC } from "react"
-import IconButton from "@mui/material/IconButton/IconButton"
-import { useTranslation } from "react-i18next"
-import { APIKeyWithOwner } from "api/typesGenerated"
-import relativeTime from "dayjs/plugin/relativeTime"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
+import { useTheme } from "@mui/styles";
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableHead from "@mui/material/TableHead";
+import TableRow from "@mui/material/TableRow";
+import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
+import { Stack } from "components/Stack/Stack";
+import { TableEmpty } from "components/TableEmpty/TableEmpty";
+import { TableLoader } from "components/TableLoader/TableLoader";
+import DeleteOutlineIcon from "@mui/icons-material/DeleteOutline";
+import dayjs from "dayjs";
+import { FC } from "react";
+import IconButton from "@mui/material/IconButton/IconButton";
+import { APIKeyWithOwner } from "api/typesGenerated";
+import relativeTime from "dayjs/plugin/relativeTime";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
 
-dayjs.extend(relativeTime)
+dayjs.extend(relativeTime);
 
 const lastUsedOrNever = (lastUsed: string) => {
-  const t = dayjs(lastUsed)
-  const now = dayjs()
-  return now.isBefore(t.add(100, "year")) ? t.fromNow() : "Never"
-}
+  const t = dayjs(lastUsed);
+  const now = dayjs();
+  return now.isBefore(t.add(100, "year")) ? t.fromNow() : "Never";
+};
 
 export interface TokensPageViewProps {
-  tokens?: APIKeyWithOwner[]
-  getTokensError?: unknown
-  isLoading: boolean
-  hasLoaded: boolean
-  onDelete: (token: APIKeyWithOwner) => void
-  deleteTokenError?: unknown
+  tokens?: APIKeyWithOwner[];
+  getTokensError?: unknown;
+  isLoading: boolean;
+  hasLoaded: boolean;
+  onDelete: (token: APIKeyWithOwner) => void;
+  deleteTokenError?: unknown;
 }
 
 export const TokensPageView: FC<
@@ -45,8 +44,7 @@ export const TokensPageView: FC<
   onDelete,
   deleteTokenError,
 }) => {
-  const theme = useTheme()
-  const { t } = useTranslation("tokensPage")
+  const theme = useTheme();
 
   return (
     <Stack>
@@ -56,11 +54,11 @@ export const TokensPageView: FC<
         <Table>
           <TableHead>
             <TableRow>
-              <TableCell width="20%">{t("table.id")}</TableCell>
-              <TableCell width="20%">{t("table.name")}</TableCell>
-              <TableCell width="20%">{t("table.lastUsed")}</TableCell>
-              <TableCell width="20%">{t("table.expiresAt")}</TableCell>
-              <TableCell width="20%">{t("table.createdAt")}</TableCell>
+              <TableCell width="20%">ID</TableCell>
+              <TableCell width="20%">Name</TableCell>
+              <TableCell width="20%">Last Used</TableCell>
+              <TableCell width="20%">Expires At</TableCell>
+              <TableCell width="20%">Created At</TableCell>
               <TableCell width="0%"></TableCell>
             </TableRow>
           </TableHead>
@@ -70,7 +68,7 @@ export const TokensPageView: FC<
                 <TableLoader />
               </Cond>
               <Cond condition={hasLoaded && tokens?.length === 0}>
-                <TableEmpty message={t("emptyState")} />
+                <TableEmpty message="No tokens found" />
               </Cond>
               <Cond>
                 {tokens?.map((token) => {
@@ -113,19 +111,17 @@ export const TokensPageView: FC<
                         <span style={{ color: theme.palette.text.secondary }}>
                           <IconButton
                             onClick={() => {
-                              onDelete(token)
+                              onDelete(token);
                             }}
                             size="medium"
-                            aria-label={t(
-                              "tokenActions.deleteToken.delete",
-                            ).toString()}
+                            aria-label="Delete token"
                           >
                             <DeleteOutlineIcon />
                           </IconButton>
                         </span>
                       </TableCell>
                     </TableRow>
-                  )
+                  );
                 })}
               </Cond>
             </ChooseOne>
@@ -133,5 +129,5 @@ export const TokensPageView: FC<
         </Table>
       </TableContainer>
     </Stack>
-  )
-}
+  );
+};
diff --git a/site/src/pages/UserSettingsPage/TokensPage/components/ConfirmDeleteDialog.stories.tsx b/site/src/pages/UserSettingsPage/TokensPage/components/ConfirmDeleteDialog.stories.tsx
deleted file mode 100644
index 6f254680dc167..0000000000000
--- a/site/src/pages/UserSettingsPage/TokensPage/components/ConfirmDeleteDialog.stories.tsx
+++ /dev/null
@@ -1,39 +0,0 @@
-import { Story } from "@storybook/react"
-import { MockToken } from "testHelpers/entities"
-import {
-  ConfirmDeleteDialog,
-  ConfirmDeleteDialogProps,
-} from "./ConfirmDeleteDialog"
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
-
-const queryClient = new QueryClient({
-  defaultOptions: {
-    queries: {
-      retry: false,
-      cacheTime: 0,
-      refetchOnWindowFocus: false,
-    },
-  },
-})
-
-export default {
-  title: "components/ConfirmDeleteDialog",
-  component: ConfirmDeleteDialog,
-}
-
-const Template: Story<ConfirmDeleteDialogProps> = (
-  args: ConfirmDeleteDialogProps,
-) => (
-  <QueryClientProvider client={queryClient}>
-    <ConfirmDeleteDialog {...args} />
-  </QueryClientProvider>
-)
-
-export const DeleteDialog = Template.bind({})
-DeleteDialog.args = {
-  queryKey: ["tokens"],
-  token: MockToken,
-  setToken: () => {
-    return null
-  },
-}
diff --git a/site/src/pages/UserSettingsPage/TokensPage/components/ConfirmDeleteDialog.tsx b/site/src/pages/UserSettingsPage/TokensPage/components/ConfirmDeleteDialog.tsx
deleted file mode 100644
index 90d2477843be5..0000000000000
--- a/site/src/pages/UserSettingsPage/TokensPage/components/ConfirmDeleteDialog.tsx
+++ /dev/null
@@ -1,70 +0,0 @@
-import { FC } from "react"
-import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog"
-import { useTranslation, Trans } from "react-i18next"
-import { useDeleteToken } from "../hooks"
-import { displaySuccess, displayError } from "components/GlobalSnackbar/utils"
-import { getErrorMessage } from "api/errors"
-import { APIKeyWithOwner } from "api/typesGenerated"
-
-export interface ConfirmDeleteDialogProps {
-  queryKey: (string | boolean)[]
-  token: APIKeyWithOwner | undefined
-  setToken: (arg: APIKeyWithOwner | undefined) => void
-}
-
-export const ConfirmDeleteDialog: FC<ConfirmDeleteDialogProps> = ({
-  queryKey,
-  token,
-  setToken,
-}) => {
-  const { t } = useTranslation("tokensPage")
-  const tokenName = token?.token_name
-  const description = (
-    <Trans
-      t={t}
-      i18nKey="tokenActions.deleteToken.deleteCaption"
-      values={{ tokenName }}
-    >
-      Are you sure you want to permanently delete token {{ tokenName }}?
-    </Trans>
-  )
-
-  const { mutate: deleteToken, isLoading: isDeleting } =
-    useDeleteToken(queryKey)
-
-  const onDeleteSuccess = () => {
-    displaySuccess(t("tokenActions.deleteToken.deleteSuccess"))
-    setToken(undefined)
-  }
-
-  const onDeleteError = (error: unknown) => {
-    const message = getErrorMessage(
-      error,
-      t("tokenActions.deleteToken.deleteFailure"),
-    )
-    displayError(message)
-    setToken(undefined)
-  }
-
-  return (
-    <ConfirmDialog
-      type="delete"
-      title={t("tokenActions.deleteToken.delete")}
-      description={description}
-      open={Boolean(token) || isDeleting}
-      confirmLoading={isDeleting}
-      onConfirm={() => {
-        if (!token) {
-          return
-        }
-        deleteToken(token.id, {
-          onError: onDeleteError,
-          onSuccess: onDeleteSuccess,
-        })
-      }}
-      onClose={() => {
-        setToken(undefined)
-      }}
-    />
-  )
-}
diff --git a/site/src/pages/UserSettingsPage/TokensPage/components/index.ts b/site/src/pages/UserSettingsPage/TokensPage/components/index.ts
deleted file mode 100644
index 55b192231a325..0000000000000
--- a/site/src/pages/UserSettingsPage/TokensPage/components/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { ConfirmDeleteDialog } from "./ConfirmDeleteDialog"
diff --git a/site/src/pages/UserSettingsPage/TokensPage/hooks.ts b/site/src/pages/UserSettingsPage/TokensPage/hooks.ts
index 38b23c73543a7..923dbda0d8d24 100644
--- a/site/src/pages/UserSettingsPage/TokensPage/hooks.ts
+++ b/site/src/pages/UserSettingsPage/TokensPage/hooks.ts
@@ -1,38 +1,33 @@
-import {
-  useQuery,
-  useMutation,
-  useQueryClient,
-  QueryKey,
-} from "@tanstack/react-query"
-import { getTokens, deleteToken } from "api/api"
-import { TokensFilter } from "api/typesGenerated"
+import { useQuery, useMutation, useQueryClient, QueryKey } from "react-query";
+import { getTokens, deleteToken } from "api/api";
+import { TokensFilter } from "api/typesGenerated";
 
 // Load all tokens
 export const useTokensData = ({ include_all }: TokensFilter) => {
-  const queryKey = ["tokens", include_all]
+  const queryKey = ["tokens", include_all];
   const result = useQuery({
     queryKey,
     queryFn: () =>
       getTokens({
         include_all,
       }),
-  })
+  });
 
   return {
     queryKey,
     ...result,
-  }
-}
+  };
+};
 
 // Delete a token
 export const useDeleteToken = (queryKey: QueryKey) => {
-  const queryClient = useQueryClient()
+  const queryClient = useQueryClient();
 
   return useMutation({
     mutationFn: deleteToken,
     onSuccess: () => {
       // Invalidate and refetch
-      void queryClient.invalidateQueries(queryKey)
+      void queryClient.invalidateQueries(queryKey);
     },
-  })
-}
+  });
+};
diff --git a/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyPage.tsx b/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyPage.tsx
index 88d337bf43cac..eabf730ff4039 100644
--- a/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyPage.tsx
+++ b/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyPage.tsx
@@ -1,14 +1,14 @@
-import { FC, PropsWithChildren } from "react"
-import { Section } from "components/SettingsLayout/Section"
-import { WorkspaceProxyView } from "./WorkspaceProxyView"
-import makeStyles from "@mui/styles/makeStyles"
-import { useProxy } from "contexts/ProxyContext"
+import { FC, PropsWithChildren } from "react";
+import { Section } from "components/SettingsLayout/Section";
+import { WorkspaceProxyView } from "./WorkspaceProxyView";
+import makeStyles from "@mui/styles/makeStyles";
+import { useProxy } from "contexts/ProxyContext";
 
 export const WorkspaceProxyPage: FC<PropsWithChildren<unknown>> = () => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   const description =
-    "Workspace proxies improve terminal and web app connections to workspaces."
+    "Workspace proxies improve terminal and web app connections to workspaces.";
 
   const {
     proxyLatencies,
@@ -17,7 +17,7 @@ export const WorkspaceProxyPage: FC<PropsWithChildren<unknown>> = () => {
     isFetched: proxiesFetched,
     isLoading: proxiesLoading,
     proxy,
-  } = useProxy()
+  } = useProxy();
 
   return (
     <Section
@@ -35,8 +35,8 @@ export const WorkspaceProxyPage: FC<PropsWithChildren<unknown>> = () => {
         preferredProxy={proxy.proxy}
       />
     </Section>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   section: {
@@ -48,6 +48,6 @@ const useStyles = makeStyles((theme) => ({
       borderRadius: 2,
     },
   },
-}))
+}));
 
-export default WorkspaceProxyPage
+export default WorkspaceProxyPage;
diff --git a/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyRow.tsx b/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyRow.tsx
index e106eb61ea973..16f37eeec1a3d 100644
--- a/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyRow.tsx
+++ b/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyRow.tsx
@@ -1,37 +1,36 @@
-import { Region, WorkspaceProxy } from "api/typesGenerated"
-import { AvatarData } from "components/AvatarData/AvatarData"
-import { Avatar } from "components/Avatar/Avatar"
-import TableCell from "@mui/material/TableCell"
-import TableRow from "@mui/material/TableRow"
-import { FC, ReactNode } from "react"
+import { Region, WorkspaceProxy } from "api/typesGenerated";
+import { AvatarData } from "components/AvatarData/AvatarData";
+import { Avatar } from "components/Avatar/Avatar";
+import TableCell from "@mui/material/TableCell";
+import TableRow from "@mui/material/TableRow";
+import { FC, ReactNode } from "react";
 import {
   HealthyBadge,
   NotHealthyBadge,
   NotReachableBadge,
   NotRegisteredBadge,
-} from "components/DeploySettingsLayout/Badges"
-import { ProxyLatencyReport } from "contexts/useProxyLatency"
-import { getLatencyColor } from "utils/latency"
-import { Maybe } from "components/Conditionals/Maybe"
-import Box from "@mui/material/Box"
+} from "components/DeploySettingsLayout/Badges";
+import { ProxyLatencyReport } from "contexts/useProxyLatency";
+import { getLatencyColor } from "utils/latency";
+import Box from "@mui/material/Box";
 
 export const ProxyRow: FC<{
-  latency?: ProxyLatencyReport
-  proxy: Region
+  latency?: ProxyLatencyReport;
+  proxy: Region;
 }> = ({ proxy, latency }) => {
   // If we have a more specific proxy status, use that.
   // All users can see healthy/unhealthy, some can see more.
-  let statusBadge = <ProxyStatus proxy={proxy} />
-  let shouldShowMessages = false
+  let statusBadge = <ProxyStatus proxy={proxy} />;
+  let shouldShowMessages = false;
   if ("status" in proxy) {
-    const wsproxy = proxy as WorkspaceProxy
-    statusBadge = <DetailedProxyStatus proxy={wsproxy} />
+    const wsproxy = proxy as WorkspaceProxy;
+    statusBadge = <DetailedProxyStatus proxy={wsproxy} />;
     shouldShowMessages = Boolean(
       (wsproxy.status?.report?.warnings &&
         wsproxy.status?.report?.warnings.length > 0) ||
         (wsproxy.status?.report?.errors &&
           wsproxy.status?.report?.errors.length > 0),
-    )
+    );
   }
 
   return (
@@ -72,7 +71,7 @@ export const ProxyRow: FC<{
           {latency ? `${latency.latencyMS.toFixed(0)} ms` : "Not available"}
         </TableCell>
       </TableRow>
-      <Maybe condition={shouldShowMessages}>
+      {shouldShowMessages && (
         <TableRow>
           <TableCell
             colSpan={4}
@@ -81,13 +80,13 @@ export const ProxyRow: FC<{
             <ProxyMessagesRow proxy={proxy as WorkspaceProxy} />
           </TableCell>
         </TableRow>
-      </Maybe>
+      )}
     </>
-  )
-}
+  );
+};
 
 const ProxyMessagesRow: FC<{
-  proxy: WorkspaceProxy
+  proxy: WorkspaceProxy;
 }> = ({ proxy }) => {
   return (
     <>
@@ -114,15 +113,15 @@ const ProxyMessagesRow: FC<{
         messages={proxy.status?.report?.warnings}
       />
     </>
-  )
-}
+  );
+};
 
 const ProxyMessagesList: FC<{
-  title: ReactNode
-  messages?: string[]
+  title: ReactNode;
+  messages?: string[];
 }> = ({ title, messages }) => {
   if (!messages) {
-    return <></>
+    return <></>;
   }
 
   return (
@@ -157,40 +156,45 @@ const ProxyMessagesList: FC<{
         </Box>
       ))}
     </Box>
-  )
-}
+  );
+};
 
 // DetailedProxyStatus allows a more precise status to be displayed.
 const DetailedProxyStatus: FC<{
-  proxy: WorkspaceProxy
+  proxy: WorkspaceProxy;
 }> = ({ proxy }) => {
   if (!proxy.status) {
     // If the status is null/undefined/not provided, just go with the boolean "healthy" value.
-    return <ProxyStatus proxy={proxy} />
+    return <ProxyStatus proxy={proxy} />;
+  }
+
+  let derpOnly = false;
+  if ("derp_only" in proxy) {
+    derpOnly = proxy.derp_only;
   }
 
   switch (proxy.status.status) {
     case "ok":
-      return <HealthyBadge />
+      return <HealthyBadge derpOnly={derpOnly} />;
     case "unhealthy":
-      return <NotHealthyBadge />
+      return <NotHealthyBadge />;
     case "unreachable":
-      return <NotReachableBadge />
+      return <NotReachableBadge />;
     case "unregistered":
-      return <NotRegisteredBadge />
+      return <NotRegisteredBadge />;
     default:
-      return <NotHealthyBadge />
+      return <NotHealthyBadge />;
   }
-}
+};
 
 // ProxyStatus will only show "healthy" or "not healthy" status.
 const ProxyStatus: FC<{
-  proxy: Region
+  proxy: Region;
 }> = ({ proxy }) => {
-  let icon = <NotHealthyBadge />
+  let icon = <NotHealthyBadge />;
   if (proxy.healthy) {
-    icon = <HealthyBadge />
+    icon = <HealthyBadge derpOnly={false} />;
   }
 
-  return icon
-}
+  return icon;
+};
diff --git a/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyView.tsx b/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyView.tsx
index de0fad789b0e2..21037635de1a5 100644
--- a/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyView.tsx
+++ b/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyView.tsx
@@ -1,27 +1,27 @@
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableHead from "@mui/material/TableHead"
-import TableRow from "@mui/material/TableRow"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { Stack } from "components/Stack/Stack"
-import { TableEmpty } from "components/TableEmpty/TableEmpty"
-import { TableLoader } from "components/TableLoader/TableLoader"
-import { FC } from "react"
-import { Region } from "api/typesGenerated"
-import { ProxyRow } from "./WorkspaceProxyRow"
-import { ProxyLatencyReport } from "contexts/useProxyLatency"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableHead from "@mui/material/TableHead";
+import TableRow from "@mui/material/TableRow";
+import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
+import { Stack } from "components/Stack/Stack";
+import { TableEmpty } from "components/TableEmpty/TableEmpty";
+import { TableLoader } from "components/TableLoader/TableLoader";
+import { FC } from "react";
+import { Region } from "api/typesGenerated";
+import { ProxyRow } from "./WorkspaceProxyRow";
+import { ProxyLatencyReport } from "contexts/useProxyLatency";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
 
 export interface WorkspaceProxyViewProps {
-  proxies?: Region[]
-  proxyLatencies?: Record<string, ProxyLatencyReport>
-  getWorkspaceProxiesError?: unknown
-  isLoading: boolean
-  hasLoaded: boolean
-  preferredProxy?: Region
-  selectProxyError?: unknown
+  proxies?: Region[];
+  proxyLatencies?: Record<string, ProxyLatencyReport>;
+  getWorkspaceProxiesError?: unknown;
+  isLoading: boolean;
+  hasLoaded: boolean;
+  preferredProxy?: Region;
+  selectProxyError?: unknown;
 }
 
 export const WorkspaceProxyView: FC<
@@ -74,5 +74,5 @@ export const WorkspaceProxyView: FC<
         </Table>
       </TableContainer>
     </Stack>
-  )
-}
+  );
+};
diff --git a/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorspaceProxyView.stories.tsx b/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorspaceProxyView.stories.tsx
index 552aa6378215a..9e7d060004515 100644
--- a/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorspaceProxyView.stories.tsx
+++ b/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorspaceProxyView.stories.tsx
@@ -1,73 +1,72 @@
-import { Story } from "@storybook/react"
 import {
   mockApiError,
   MockWorkspaceProxies,
   MockPrimaryWorkspaceProxy,
   MockHealthyWildWorkspaceProxy,
   MockProxyLatencies,
-} from "testHelpers/entities"
-import {
-  WorkspaceProxyView,
-  WorkspaceProxyViewProps,
-} from "./WorkspaceProxyView"
+} from "testHelpers/entities";
+import { WorkspaceProxyView } from "./WorkspaceProxyView";
+import type { Meta, StoryObj } from "@storybook/react";
 
-export default {
-  title: "components/WorkspaceProxyView",
+const meta: Meta<typeof WorkspaceProxyView> = {
+  title: "pages/UserSettingsPage/WorkspaceProxyView",
   component: WorkspaceProxyView,
-  args: {
-    onRegenerateClick: { action: "Submit" },
-  },
-}
+};
 
-const Template: Story<WorkspaceProxyViewProps> = (
-  args: WorkspaceProxyViewProps,
-) => <WorkspaceProxyView {...args} />
+export default meta;
+type Story = StoryObj<typeof WorkspaceProxyView>;
 
-export const PrimarySelected = Template.bind({})
-PrimarySelected.args = {
-  isLoading: false,
-  hasLoaded: true,
-  proxies: MockWorkspaceProxies,
-  proxyLatencies: MockProxyLatencies,
-  preferredProxy: MockPrimaryWorkspaceProxy,
-}
+export const PrimarySelected: Story = {
+  args: {
+    isLoading: false,
+    hasLoaded: true,
+    proxies: MockWorkspaceProxies,
+    proxyLatencies: MockProxyLatencies,
+    preferredProxy: MockPrimaryWorkspaceProxy,
+  },
+};
 
-export const Example = Template.bind({})
-Example.args = {
-  isLoading: false,
-  hasLoaded: true,
-  proxies: MockWorkspaceProxies,
-  proxyLatencies: MockProxyLatencies,
-  preferredProxy: MockHealthyWildWorkspaceProxy,
-}
+export const Example: Story = {
+  args: {
+    isLoading: false,
+    hasLoaded: true,
+    proxies: MockWorkspaceProxies,
+    proxyLatencies: MockProxyLatencies,
+    preferredProxy: MockHealthyWildWorkspaceProxy,
+  },
+};
 
-export const Loading = Template.bind({})
-Loading.args = {
-  ...Example.args,
-  isLoading: true,
-  hasLoaded: false,
-}
+export const Loading: Story = {
+  args: {
+    ...Example.args,
+    isLoading: true,
+    hasLoaded: false,
+  },
+};
 
-export const Empty = Template.bind({})
-Empty.args = {
-  ...Example.args,
-  proxies: [],
-}
+export const Empty: Story = {
+  args: {
+    ...Example.args,
+    proxies: [],
+  },
+};
 
-export const WithProxiesError = Template.bind({})
-WithProxiesError.args = {
-  ...Example.args,
-  hasLoaded: false,
-  getWorkspaceProxiesError: mockApiError({
-    message: "Failed to get proxies.",
-  }),
-}
+export const WithProxiesError: Story = {
+  args: {
+    ...Example.args,
+    hasLoaded: false,
+    getWorkspaceProxiesError: mockApiError({
+      message: "Failed to get proxies.",
+    }),
+  },
+};
 
-export const WithSelectProxyError = Template.bind({})
-WithSelectProxyError.args = {
-  ...Example.args,
-  hasLoaded: false,
-  selectProxyError: mockApiError({
-    message: "Failed to select proxy.",
-  }),
-}
+export const WithSelectProxyError: Story = {
+  args: {
+    ...Example.args,
+    hasLoaded: false,
+    selectProxyError: mockApiError({
+      message: "Failed to select proxy.",
+    }),
+  },
+};
diff --git a/site/src/pages/UsersPage/CreateUserPage/CreateUserPage.test.tsx b/site/src/pages/UsersPage/CreateUserPage/CreateUserPage.test.tsx
deleted file mode 100644
index d342ace9bdf75..0000000000000
--- a/site/src/pages/UsersPage/CreateUserPage/CreateUserPage.test.tsx
+++ /dev/null
@@ -1,82 +0,0 @@
-import { fireEvent, screen } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
-import { rest } from "msw"
-import { Language as FormLanguage } from "../../../components/CreateUserForm/CreateUserForm"
-import { Language as FooterLanguage } from "../../../components/FormFooter/FormFooter"
-import {
-  renderWithAuth,
-  waitForLoaderToBeRemoved,
-} from "../../../testHelpers/renderHelpers"
-import { server } from "../../../testHelpers/server"
-import { Language as CreateUserLanguage } from "../../../xServices/users/createUserXService"
-import { CreateUserPage } from "./CreateUserPage"
-
-const renderCreateUserPage = async () => {
-  renderWithAuth(<CreateUserPage />, {
-    extraRoutes: [{ path: "/users", element: <div>Users Page</div> }],
-  })
-  await waitForLoaderToBeRemoved()
-}
-
-const fillForm = async ({
-  username = "someuser",
-  email = "someone@coder.com",
-  password = "password",
-}: {
-  username?: string
-  email?: string
-  password?: string
-}) => {
-  const usernameField = screen.getByLabelText(FormLanguage.usernameLabel)
-  const emailField = screen.getByLabelText(FormLanguage.emailLabel)
-  const passwordField = screen.getByLabelText(FormLanguage.passwordLabel)
-  await userEvent.type(usernameField, username)
-  await userEvent.type(emailField, email)
-  await userEvent.type(passwordField, password)
-  const submitButton = await screen.findByText(
-    FooterLanguage.defaultSubmitLabel,
-  )
-  fireEvent.click(submitButton)
-}
-
-describe("Create User Page", () => {
-  it("shows validation error message", async () => {
-    await renderCreateUserPage()
-    await fillForm({ email: "test" })
-    const errorMessage = await screen.findByText(FormLanguage.emailInvalid)
-    expect(errorMessage).toBeDefined()
-  })
-
-  it("shows API error message", async () => {
-    const fieldErrorMessage = "username already in use"
-    server.use(
-      rest.post("/api/v2/users", async (req, res, ctx) => {
-        return res(
-          ctx.status(400),
-          ctx.json({
-            message: "invalid field",
-            validations: [
-              {
-                detail: fieldErrorMessage,
-                field: "username",
-              },
-            ],
-          }),
-        )
-      }),
-    )
-    await renderCreateUserPage()
-    await fillForm({})
-    const errorMessage = await screen.findByText(fieldErrorMessage)
-    expect(errorMessage).toBeDefined()
-  })
-
-  it("shows success notification and redirects to users page", async () => {
-    await renderCreateUserPage()
-    await fillForm({})
-    const successMessage = await screen.findByText(
-      CreateUserLanguage.createUserSuccess,
-    )
-    expect(successMessage).toBeDefined()
-  })
-})
diff --git a/site/src/pages/UsersPage/CreateUserPage/CreateUserPage.tsx b/site/src/pages/UsersPage/CreateUserPage/CreateUserPage.tsx
deleted file mode 100644
index cd905c39d88ae..0000000000000
--- a/site/src/pages/UsersPage/CreateUserPage/CreateUserPage.tsx
+++ /dev/null
@@ -1,50 +0,0 @@
-import { useMachine } from "@xstate/react"
-import { useOrganizationId } from "hooks/useOrganizationId"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useNavigate } from "react-router-dom"
-import { createUserMachine } from "xServices/users/createUserXService"
-import * as TypesGen from "../../../api/typesGenerated"
-import { CreateUserForm } from "../../../components/CreateUserForm/CreateUserForm"
-import { Margins } from "../../../components/Margins/Margins"
-import { pageTitle } from "../../../utils/page"
-
-export const Language = {
-  unknownError: "Oops, an unknown error occurred.",
-}
-
-export const CreateUserPage: FC = () => {
-  const myOrgId = useOrganizationId()
-  const navigate = useNavigate()
-  const [createUserState, createUserSend] = useMachine(createUserMachine, {
-    actions: {
-      redirectToUsersPage: () => {
-        navigate("/users")
-      },
-    },
-  })
-  const { error } = createUserState.context
-
-  return (
-    <Margins>
-      <Helmet>
-        <title>{pageTitle("Create User")}</title>
-      </Helmet>
-
-      <CreateUserForm
-        error={error}
-        onSubmit={(user: TypesGen.CreateUserRequest) =>
-          createUserSend({ type: "CREATE", user })
-        }
-        onCancel={() => {
-          createUserSend("CANCEL_CREATE_USER")
-          navigate("/users")
-        }}
-        isLoading={createUserState.hasTag("loading")}
-        myOrgId={myOrgId}
-      />
-    </Margins>
-  )
-}
-
-export default CreateUserPage
diff --git a/site/src/pages/UsersPage/ResetPasswordDialog.stories.tsx b/site/src/pages/UsersPage/ResetPasswordDialog.stories.tsx
new file mode 100644
index 0000000000000..fab79ed6c6a9e
--- /dev/null
+++ b/site/src/pages/UsersPage/ResetPasswordDialog.stories.tsx
@@ -0,0 +1,22 @@
+import { Meta, StoryObj } from "@storybook/react";
+import { MockUser } from "testHelpers/entities";
+
+import { ResetPasswordDialog } from "./ResetPasswordDialog";
+
+const meta: Meta<typeof ResetPasswordDialog> = {
+  title: "pages/UsersPage/ResetPasswordDialog",
+  component: ResetPasswordDialog,
+};
+
+export default meta;
+type Story = StoryObj<typeof ResetPasswordDialog>;
+
+const Example: Story = {
+  args: {
+    open: true,
+    user: MockUser,
+    newPassword: "somerandomstringhere",
+  },
+};
+
+export { Example as ResetPasswordDialog };
diff --git a/site/src/pages/UsersPage/ResetPasswordDialog.tsx b/site/src/pages/UsersPage/ResetPasswordDialog.tsx
new file mode 100644
index 0000000000000..42725a1e8f38b
--- /dev/null
+++ b/site/src/pages/UsersPage/ResetPasswordDialog.tsx
@@ -0,0 +1,59 @@
+import { type FC } from "react";
+import { useTheme } from "@emotion/react";
+import type * as TypesGen from "api/typesGenerated";
+import { CodeExample } from "components/CodeExample/CodeExample";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+
+export interface ResetPasswordDialogProps {
+  open: boolean;
+  onClose: () => void;
+  onConfirm: () => void;
+  user?: TypesGen.User;
+  newPassword?: string;
+  loading: boolean;
+}
+
+export const Language = {
+  title: "Reset password",
+  message: (username?: string): JSX.Element => (
+    <>
+      You will need to send <strong>{username}</strong> the following password:
+    </>
+  ),
+  confirmText: "Reset password",
+};
+
+export const ResetPasswordDialog: FC<
+  React.PropsWithChildren<ResetPasswordDialogProps>
+> = ({ open, onClose, onConfirm, user, newPassword, loading }) => {
+  const theme = useTheme();
+
+  const description = (
+    <>
+      <p>{Language.message(user?.username)}</p>
+      <CodeExample
+        code={newPassword ?? ""}
+        css={{
+          minHeight: "auto",
+          userSelect: "all",
+          width: "100%",
+          marginTop: theme.spacing(3),
+        }}
+      />
+    </>
+  );
+
+  return (
+    <ConfirmDialog
+      type="info"
+      hideCancel={false}
+      open={open}
+      onConfirm={onConfirm}
+      onClose={onClose}
+      title={Language.title}
+      confirmLoading={loading}
+      confirmText={Language.confirmText}
+      description={description}
+    />
+  );
+};
diff --git a/site/src/pages/UsersPage/UsersFilter.tsx b/site/src/pages/UsersPage/UsersFilter.tsx
index e89e765cae31b..366900690b804 100644
--- a/site/src/pages/UsersPage/UsersFilter.tsx
+++ b/site/src/pages/UsersPage/UsersFilter.tsx
@@ -1,6 +1,6 @@
-import { FC } from "react"
-import Box from "@mui/material/Box"
-import { Palette, PaletteColor } from "@mui/material/styles"
+import { FC } from "react";
+import Box from "@mui/material/Box";
+import { Palette, PaletteColor } from "@mui/material/styles";
 import {
   Filter,
   FilterMenu,
@@ -8,15 +8,19 @@ import {
   OptionItem,
   SearchFieldSkeleton,
   useFilter,
-} from "components/Filter/filter"
-import { BaseOption } from "components/Filter/options"
-import { UseFilterMenuOptions, useFilterMenu } from "components/Filter/menu"
-import { userFilterQuery } from "utils/filters"
-import { docs } from "utils/docs"
+} from "components/Filter/filter";
+import { BaseOption } from "components/Filter/options";
+import { UseFilterMenuOptions, useFilterMenu } from "components/Filter/menu";
+import { docs } from "utils/docs";
+
+const userFilterQuery = {
+  active: "status:active",
+  all: "",
+};
 
 type StatusOption = BaseOption & {
-  color: string
-}
+  color: string;
+};
 
 export const useStatusFilterMenu = ({
   value,
@@ -26,7 +30,7 @@ export const useStatusFilterMenu = ({
     { value: "active", label: "Active", color: "success" },
     { value: "dormant", label: "Dormant", color: "secondary" },
     { value: "suspended", label: "Suspended", color: "warning" },
-  ]
+  ];
   return useFilterMenu({
     onChange,
     value,
@@ -34,26 +38,26 @@ export const useStatusFilterMenu = ({
     getSelectedOption: async () =>
       statusOptions.find((option) => option.value === value) ?? null,
     getOptions: async () => statusOptions,
-  })
-}
+  });
+};
 
-export type StatusFilterMenu = ReturnType<typeof useStatusFilterMenu>
+export type StatusFilterMenu = ReturnType<typeof useStatusFilterMenu>;
 
 const PRESET_FILTERS = [
   { query: userFilterQuery.active, name: "Active users" },
   { query: userFilterQuery.all, name: "All users" },
-]
+];
 
 export const UsersFilter = ({
   filter,
   error,
   menus,
 }: {
-  filter: ReturnType<typeof useFilter>
-  error?: unknown
+  filter: ReturnType<typeof useFilter>;
+  error?: unknown;
   menus: {
-    status: StatusFilterMenu
-  }
+    status: StatusFilterMenu;
+  };
 }) => {
   return (
     <Filter
@@ -72,8 +76,8 @@ export const UsersFilter = ({
         </>
       }
     />
-  )
-}
+  );
+};
 
 const StatusMenu = (menu: StatusFilterMenu) => {
   return (
@@ -90,15 +94,15 @@ const StatusMenu = (menu: StatusFilterMenu) => {
     >
       {(itemProps) => <StatusOptionItem {...itemProps} />}
     </FilterMenu>
-  )
-}
+  );
+};
 
 const StatusOptionItem = ({
   option,
   isSelected,
 }: {
-  option: StatusOption
-  isSelected?: boolean
+  option: StatusOption;
+  isSelected?: boolean;
 }) => {
   return (
     <OptionItem
@@ -106,8 +110,8 @@ const StatusOptionItem = ({
       left={<StatusIndicator option={option} />}
       isSelected={isSelected}
     />
-  )
-}
+  );
+};
 
 const StatusIndicator: FC<{ option: StatusOption }> = ({ option }) => {
   return (
@@ -120,5 +124,5 @@ const StatusIndicator: FC<{ option: StatusOption }> = ({ option }) => {
           (theme.palette[option.color as keyof Palette] as PaletteColor).light,
       }}
     />
-  )
-}
+  );
+};
diff --git a/site/src/pages/UsersPage/UsersPage.test.tsx b/site/src/pages/UsersPage/UsersPage.test.tsx
index ef2ec64d44107..540e6bc439d49 100644
--- a/site/src/pages/UsersPage/UsersPage.test.tsx
+++ b/site/src/pages/UsersPage/UsersPage.test.tsx
@@ -1,460 +1,367 @@
-import { fireEvent, screen, waitFor, within } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
-import { i18n } from "i18n"
-import { rest } from "msw"
+import { fireEvent, screen, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { rest } from "msw";
 import {
   MockUser,
   MockUser2,
   SuspendedMockUser,
   MockAuditorRole,
-  MockOwnerRole,
-} from "testHelpers/entities"
-import { Language as usersXServiceLanguage } from "xServices/users/usersXService"
-import * as API from "../../api/api"
-import { Role } from "../../api/typesGenerated"
-import { Language as ResetPasswordDialogLanguage } from "../../components/Dialogs/ResetPasswordDialog/ResetPasswordDialog"
-import { renderWithAuth } from "../../testHelpers/renderHelpers"
-import { server } from "../../testHelpers/server"
-import { Language as UsersPageLanguage, UsersPage } from "./UsersPage"
-
-const { t } = i18n
+} from "testHelpers/entities";
+import * as API from "api/api";
+import { Role } from "api/typesGenerated";
+import { Language as ResetPasswordDialogLanguage } from "./ResetPasswordDialog";
+import { renderWithAuth } from "testHelpers/renderHelpers";
+import { server } from "testHelpers/server";
+import { UsersPage } from "./UsersPage";
 
 const renderPage = () => {
-  return renderWithAuth(<UsersPage />)
-}
+  return renderWithAuth(<UsersPage />);
+};
 
-const suspendUser = async (setupActionSpies: () => void) => {
-  const user = userEvent.setup()
+const suspendUser = async () => {
+  const user = userEvent.setup();
   // Get the first user in the table
-  const moreButtons = await screen.findAllByLabelText("more")
-  const firstMoreButton = moreButtons[0]
+  const moreButtons = await screen.findAllByLabelText("more");
+  const firstMoreButton = moreButtons[0];
+  await user.click(firstMoreButton);
 
-  await user.click(firstMoreButton)
-
-  const menu = await screen.findByRole("menu")
-  const text = t("suspendMenuItem", { ns: "usersPage" })
-  const suspendButton = within(menu).getByText(text)
-
-  await user.click(suspendButton)
+  const menu = await screen.findByRole("menu");
+  const suspendButton = within(menu).getByText(/Suspend/);
+  await user.click(suspendButton);
 
   // Check if the confirm message is displayed
-  const confirmDialog = await screen.findByRole("dialog")
-  expect(confirmDialog).toHaveTextContent(
-    `${UsersPageLanguage.suspendDialogMessagePrefix} ${MockUser.username}?`,
-  )
-
-  // Setup spies to check the actions after
-  setupActionSpies()
-
-  // Click on the "Confirm" button
-  const confirmButton = await within(confirmDialog).findByText(
-    UsersPageLanguage.suspendDialogAction,
-  )
-  await user.click(confirmButton)
-}
-
-const deleteUser = async (setupActionSpies: () => void) => {
-  const user = userEvent.setup()
+  const confirmDialog = await screen.findByRole("dialog");
+  const confirmButton = await within(confirmDialog).findByRole("button", {
+    name: "Suspend",
+  });
+  await user.click(confirmButton);
+};
+
+const deleteUser = async () => {
+  const user = userEvent.setup();
   // Click on the "more" button to display the "Delete" option
   // Needs to await fetching users and fetching permissions, because they're needed to see the more button
-  const moreButtons = await screen.findAllByLabelText("more")
+  const moreButtons = await screen.findAllByLabelText("more");
   // get MockUser2
-  const selectedMoreButton = moreButtons[1]
+  const selectedMoreButton = moreButtons[1];
 
-  await user.click(selectedMoreButton)
+  await user.click(selectedMoreButton);
 
-  const menu = await screen.findByRole("menu")
-  const text = t("deleteMenuItem", { ns: "usersPage" })
-  const deleteButton = within(menu).getByText(text)
+  const menu = await screen.findByRole("menu");
+  const deleteButton = within(menu).getByText(/Delete/);
 
-  await user.click(deleteButton)
+  await user.click(deleteButton);
 
   // Check if the confirm message is displayed
-  const confirmDialog = await screen.findByRole("dialog")
-  expect(confirmDialog).toHaveTextContent(
-    t("deleteDialog.confirm", { ns: "common", entity: "user" }).toString(),
-  )
+  const confirmDialog = await screen.findByRole("dialog");
+  expect(confirmDialog).toHaveTextContent(`Are you sure you want to proceed?`);
 
   // Confirm with text input
-  const labelText = t("deleteDialog.confirmLabel", {
-    ns: "common",
-    entity: "user",
-  })
-  const textField = screen.getByLabelText(labelText)
-  const dialog = screen.getByRole("dialog")
-  await user.type(textField, MockUser2.username)
-
-  // Setup spies to check the actions after
-  setupActionSpies()
+  const textField = screen.getByLabelText("Name of the user to delete");
+  const dialog = screen.getByRole("dialog");
+  await user.type(textField, MockUser2.username);
 
   // Click on the "Confirm" button
-  const confirmButton = within(dialog).getByRole("button", { name: "Delete" })
-  await user.click(confirmButton)
-}
+  const confirmButton = within(dialog).getByRole("button", { name: "Delete" });
+  await user.click(confirmButton);
+};
 
-const activateUser = async (setupActionSpies: () => void) => {
-  const moreButtons = await screen.findAllByLabelText("more")
-  const suspendedMoreButton = moreButtons[2]
-  fireEvent.click(suspendedMoreButton)
+const activateUser = async () => {
+  const moreButtons = await screen.findAllByLabelText("more");
+  const suspendedMoreButton = moreButtons[2];
+  fireEvent.click(suspendedMoreButton);
 
-  const menu = screen.getByRole("menu")
-  const text = t("activateMenuItem", { ns: "usersPage" })
-  const activateButton = within(menu).getByText(text)
-  fireEvent.click(activateButton)
+  const menu = screen.getByRole("menu");
+  const activateButton = within(menu).getByText(/Activate/);
+  fireEvent.click(activateButton);
 
   // Check if the confirm message is displayed
-  const confirmDialog = screen.getByRole("dialog")
-  expect(confirmDialog).toHaveTextContent(
-    `${UsersPageLanguage.activateDialogMessagePrefix} ${SuspendedMockUser.username}?`,
-  )
-
-  // Setup spies to check the actions after
-  setupActionSpies()
+  const confirmDialog = screen.getByRole("dialog");
 
   // Click on the "Confirm" button
-  const confirmButton = within(confirmDialog).getByText(
-    UsersPageLanguage.activateDialogAction,
-  )
-  fireEvent.click(confirmButton)
-}
+  const confirmButton = within(confirmDialog).getByRole("button", {
+    name: "Activate",
+  });
+  fireEvent.click(confirmButton);
+};
 
 const resetUserPassword = async (setupActionSpies: () => void) => {
-  const moreButtons = await screen.findAllByLabelText("more")
-  const firstMoreButton = moreButtons[0]
+  const moreButtons = await screen.findAllByLabelText("more");
+  const firstMoreButton = moreButtons[0];
 
-  fireEvent.click(firstMoreButton)
+  fireEvent.click(firstMoreButton);
 
-  const menu = screen.getByRole("menu")
-  const text = t("resetPasswordMenuItem", { ns: "usersPage" })
-  const resetPasswordButton = within(menu).getByText(text)
+  const menu = screen.getByRole("menu");
+  const resetPasswordButton = within(menu).getByText(/Reset password/);
 
-  fireEvent.click(resetPasswordButton)
+  fireEvent.click(resetPasswordButton);
 
   // Check if the confirm message is displayed
-  const confirmDialog = screen.getByRole("dialog")
+  const confirmDialog = screen.getByRole("dialog");
   expect(confirmDialog).toHaveTextContent(
     `You will need to send ${MockUser.username} the following password:`,
-  )
+  );
 
   // Setup spies to check the actions after
-  setupActionSpies()
+  setupActionSpies();
 
   // Click on the "Confirm" button
   const confirmButton = within(confirmDialog).getByRole("button", {
     name: ResetPasswordDialogLanguage.confirmText,
-  })
+  });
 
-  fireEvent.click(confirmButton)
-}
+  fireEvent.click(confirmButton);
+};
 
-const updateUserRole = async (setupActionSpies: () => void, role: Role) => {
+const updateUserRole = async (role: Role) => {
   // Get the first user in the table
-  const users = await screen.findAllByText(/.*@coder.com/)
-  const userRow = users[0].closest("tr")
+  const users = await screen.findAllByText(/.*@coder.com/);
+  const userRow = users[0].closest("tr");
   if (!userRow) {
-    throw new Error("Error on get the first user row")
+    throw new Error("Error on get the first user row");
   }
 
   // Click on the "edit icon" to display the role options
-  const buttonTitle = t("editUserRolesTooltip", { ns: "usersPage" })
-  const editButton = within(userRow).getByTitle(buttonTitle)
-  fireEvent.click(editButton)
-
-  // Setup spies to check the actions after
-  setupActionSpies()
+  const editButton = within(userRow).getByTitle("Edit user roles");
+  fireEvent.click(editButton);
 
   // Click on the role option
-  const fieldsetTitle = t("fieldSetRolesTooltip", { ns: "usersPage" })
-  const fieldset = await screen.findByTitle(fieldsetTitle)
-  const auditorOption = within(fieldset).getByText(role.display_name)
-  fireEvent.click(auditorOption)
+  const fieldset = await screen.findByTitle("Available roles");
+  const auditorOption = within(fieldset).getByText(role.display_name);
+  fireEvent.click(auditorOption);
 
   return {
     userRow,
-  }
-}
+  };
+};
 
 describe("UsersPage", () => {
-  it("shows users", async () => {
-    renderPage()
-    const users = await screen.findAllByText(/.*@coder.com/)
-    expect(users.length).toEqual(3)
-  })
-
   describe("suspend user", () => {
     describe("when it is success", () => {
-      it("shows a success message and refresh the page", async () => {
-        renderPage()
+      it("shows a success message", async () => {
+        renderPage();
 
-        await suspendUser(() => {
-          jest.spyOn(API, "suspendUser").mockResolvedValueOnce(MockUser)
-          jest.spyOn(API, "getUsers").mockResolvedValueOnce({
-            users: [SuspendedMockUser, MockUser2],
-            count: 2,
-          })
-        })
+        server.use(
+          rest.put(
+            `/api/v2/users/${MockUser.id}/status/suspend`,
+            async (req, res, ctx) => {
+              return res(ctx.status(200), ctx.json(SuspendedMockUser));
+            },
+          ),
+        );
 
-        // Check if the success message is displayed
-        await screen.findByText(usersXServiceLanguage.suspendUserSuccess)
+        await suspendUser();
 
-        // Check if the API was called correctly
-        expect(API.suspendUser).toBeCalledTimes(1)
-        expect(API.suspendUser).toBeCalledWith(MockUser.id)
+        // Check if the success message is displayed
+        await screen.findByText("Successfully suspended the user.");
+      });
+    });
 
-        // Check if the users list was reload
-        await waitFor(() => expect(API.getUsers).toBeCalledTimes(1))
-      })
-    })
     describe("when it fails", () => {
       it("shows an error message", async () => {
-        renderPage()
+        renderPage();
 
-        await suspendUser(() => {
-          jest.spyOn(API, "suspendUser").mockRejectedValueOnce({})
-        })
+        server.use(
+          rest.put(
+            `/api/v2/users/${MockUser.id}/status/suspend`,
+            async (req, res, ctx) => {
+              return res(
+                ctx.status(400),
+                ctx.json({
+                  message: "Error suspending user.",
+                }),
+              );
+            },
+          ),
+        );
+
+        await suspendUser();
 
         // Check if the error message is displayed
-        await screen.findByText(usersXServiceLanguage.suspendUserError)
-
-        // Check if the API was called correctly
-        expect(API.suspendUser).toBeCalledTimes(1)
-        expect(API.suspendUser).toBeCalledWith(MockUser.id)
-      })
-    })
-  })
-
-  describe("pagination", () => {
-    it("goes to next and previous page", async () => {
-      const { container } = renderPage()
-      const user = userEvent.setup()
-
-      const mock = jest
-        .spyOn(API, "getUsers")
-        .mockResolvedValueOnce({ users: [MockUser, MockUser2], count: 26 })
-
-      const nextButton = await screen.findByLabelText("Next page")
-      expect(nextButton).toBeEnabled()
-      const previousButton = await screen.findByLabelText("Previous page")
-      expect(previousButton).toBeDisabled()
-      await user.click(nextButton)
-
-      await waitFor(() =>
-        expect(API.getUsers).toBeCalledWith({ offset: 25, limit: 25, q: "" }),
-      )
-
-      mock.mockClear()
-      await user.click(previousButton)
-
-      await waitFor(() =>
-        expect(API.getUsers).toBeCalledWith({ offset: 0, limit: 25, q: "" }),
-      )
-
-      const pageButtons = container.querySelectorAll(
-        `button[name="Page button"]`,
-      )
-      // count handler says there are 2 pages of results
-      expect(pageButtons.length).toBe(2)
-    })
-  })
+        await screen.findByText("Error suspending user.");
+      });
+    });
+  });
 
   describe("delete user", () => {
     describe("when it is success", () => {
-      it("shows a success message and refresh the page", async () => {
-        renderPage()
+      it("shows a success message", async () => {
+        renderPage();
 
-        await deleteUser(() => {
-          jest.spyOn(API, "deleteUser").mockResolvedValueOnce(undefined)
-          jest.spyOn(API, "getUsers").mockResolvedValueOnce({
-            users: [MockUser, SuspendedMockUser],
-            count: 2,
-          })
-        })
+        server.use(
+          rest.delete(
+            `/api/v2/users/${MockUser2.id}`,
+            async (req, res, ctx) => {
+              return res(ctx.status(200), ctx.json(MockUser2));
+            },
+          ),
+        );
 
-        // Check if the success message is displayed
-        await screen.findByText(usersXServiceLanguage.deleteUserSuccess)
+        await deleteUser();
 
-        // Check if the API was called correctly
-        expect(API.deleteUser).toBeCalledTimes(1)
-        expect(API.deleteUser).toBeCalledWith(MockUser2.id)
-
-        // Check if the users list was reloaded
-        await waitFor(() => {
-          const users = screen.getAllByLabelText("more")
-          expect(users.length).toEqual(2)
-        })
-      })
-    })
+        // Check if the success message is displayed
+        await screen.findByText("Successfully deleted the user.");
+      });
+    });
     describe("when it fails", () => {
       it("shows an error message", async () => {
-        renderPage()
+        renderPage();
 
-        await deleteUser(() => {
-          jest.spyOn(API, "deleteUser").mockRejectedValueOnce({})
-        })
+        server.use(
+          rest.delete(
+            `/api/v2/users/${MockUser2.id}`,
+            async (req, res, ctx) => {
+              return res(
+                ctx.status(400),
+                ctx.json({
+                  message: "Error deleting user.",
+                }),
+              );
+            },
+          ),
+        );
+
+        await deleteUser();
 
         // Check if the error message is displayed
-        await screen.findByText(usersXServiceLanguage.deleteUserError)
-
-        // Check if the API was called correctly
-        expect(API.deleteUser).toBeCalledTimes(1)
-        expect(API.deleteUser).toBeCalledWith(MockUser2.id)
-      })
-    })
-  })
+        await screen.findByText("Error deleting user.");
+      });
+    });
+  });
 
   describe("activate user", () => {
     describe("when user is successfully activated", () => {
       it("shows a success message and refreshes the page", async () => {
-        renderPage()
+        renderPage();
 
-        await activateUser(() => {
-          jest
-            .spyOn(API, "activateUser")
-            .mockResolvedValueOnce(SuspendedMockUser)
-          jest.spyOn(API, "getUsers").mockImplementationOnce(() =>
-            Promise.resolve({
-              users: [MockUser, MockUser2, SuspendedMockUser],
-              count: 3,
-            }),
-          )
-        })
+        server.use(
+          rest.put(
+            `/api/v2/users/${SuspendedMockUser.id}/status/activate`,
+            async (req, res, ctx) => {
+              return res(ctx.status(200), ctx.json(MockUser));
+            },
+          ),
+        );
 
-        // Check if the success message is displayed
-        await screen.findByText(usersXServiceLanguage.activateUserSuccess)
+        await activateUser();
 
-        // Check if the API was called correctly
-        expect(API.activateUser).toBeCalledTimes(1)
-        expect(API.activateUser).toBeCalledWith(SuspendedMockUser.id)
-      })
-    })
+        // Check if the success message is displayed
+        await screen.findByText("Successfully activated the user.");
+      });
+    });
     describe("when activation fails", () => {
       it("shows an error message", async () => {
-        renderPage()
+        renderPage();
 
-        await activateUser(() => {
-          jest.spyOn(API, "activateUser").mockRejectedValueOnce({})
-        })
+        server.use(
+          rest.put(
+            `/api/v2/users/${SuspendedMockUser.id}/status/activate`,
+            async (req, res, ctx) => {
+              return res(
+                ctx.status(400),
+                ctx.json({
+                  message: "Error activating user.",
+                }),
+              );
+            },
+          ),
+        );
+
+        await activateUser();
 
         // Check if the error message is displayed
-        await screen.findByText(usersXServiceLanguage.activateUserError)
-
-        // Check if the API was called correctly
-        expect(API.activateUser).toBeCalledTimes(1)
-        expect(API.activateUser).toBeCalledWith(SuspendedMockUser.id)
-      })
-    })
-  })
+        await screen.findByText("Error activating user.");
+      });
+    });
+  });
 
   describe("reset user password", () => {
     describe("when it is success", () => {
       it("shows a success message", async () => {
-        renderPage()
+        renderPage();
 
         await resetUserPassword(() => {
-          jest.spyOn(API, "updateUserPassword").mockResolvedValueOnce(undefined)
-        })
+          jest
+            .spyOn(API, "updateUserPassword")
+            .mockResolvedValueOnce(undefined);
+        });
 
         // Check if the success message is displayed
-        await screen.findByText(usersXServiceLanguage.resetUserPasswordSuccess)
+        await screen.findByText("Successfully updated the user password.");
 
         // Check if the API was called correctly
-        expect(API.updateUserPassword).toBeCalledTimes(1)
+        expect(API.updateUserPassword).toBeCalledTimes(1);
         expect(API.updateUserPassword).toBeCalledWith(MockUser.id, {
           password: expect.any(String),
           old_password: "",
-        })
-      })
-    })
+        });
+      });
+    });
     describe("when it fails", () => {
       it("shows an error message", async () => {
-        renderPage()
+        renderPage();
 
         await resetUserPassword(() => {
-          jest.spyOn(API, "updateUserPassword").mockRejectedValueOnce({})
-        })
+          jest.spyOn(API, "updateUserPassword").mockRejectedValueOnce({});
+        });
 
         // Check if the error message is displayed
-        await screen.findByText(usersXServiceLanguage.resetUserPasswordError)
+        await screen.findByText("Error on resetting the user password.");
 
         // Check if the API was called correctly
-        expect(API.updateUserPassword).toBeCalledTimes(1)
+        expect(API.updateUserPassword).toBeCalledTimes(1);
         expect(API.updateUserPassword).toBeCalledWith(MockUser.id, {
           password: expect.any(String),
           old_password: "",
-        })
-      })
-    })
-  })
+        });
+      });
+    });
+  });
 
   describe("Update user role", () => {
     describe("when it is success", () => {
       it("updates the roles", async () => {
-        renderPage()
-
-        const { userRow } = await updateUserRole(() => {
-          jest.spyOn(API, "updateUserRoles").mockResolvedValueOnce({
-            ...MockUser,
-            roles: [...MockUser.roles, MockAuditorRole],
-          })
-        }, MockAuditorRole)
+        renderPage();
 
-        // Check if the select text was updated with the Auditor role
-        await waitFor(() => {
-          expect(userRow).toHaveTextContent(MockOwnerRole.display_name)
-        })
-        expect(userRow).toHaveTextContent(MockAuditorRole.display_name)
-
-        // Check if the API was called correctly
-        const currentRoles = MockUser.roles.map((r) => r.name)
-        expect(API.updateUserRoles).toBeCalledTimes(1)
-        expect(API.updateUserRoles).toBeCalledWith(
-          [...currentRoles, MockAuditorRole.name],
-          MockUser.id,
-        )
-      })
-    })
+        server.use(
+          rest.put(
+            `/api/v2/users/${MockUser.id}/roles`,
+            async (req, res, ctx) => {
+              return res(
+                ctx.status(200),
+                ctx.json({
+                  ...MockUser,
+                  roles: [...MockUser.roles, MockAuditorRole],
+                }),
+              );
+            },
+          ),
+        );
+
+        await updateUserRole(MockAuditorRole);
+
+        await screen.findByText("Successfully updated the user roles.");
+      });
+    });
 
     describe("when it fails", () => {
       it("shows an error message", async () => {
-        renderPage()
-
-        await updateUserRole(() => {
-          jest.spyOn(API, "updateUserRoles").mockRejectedValueOnce({})
-        }, MockAuditorRole)
-
-        // Check if the error message is displayed
-        const errorMessage = await screen.findByText(
-          usersXServiceLanguage.updateUserRolesError,
-        )
-        await waitFor(() => expect(errorMessage).toBeDefined())
-
-        // Check if the API was called correctly
-        const currentRoles = MockUser.roles.map((r) => r.name)
-
-        expect(API.updateUserRoles).toBeCalledTimes(1)
-        expect(API.updateUserRoles).toBeCalledWith(
-          [...currentRoles, MockAuditorRole.name],
-          MockUser.id,
-        )
-      })
-      it("shows an error from the backend", async () => {
-        renderPage()
+        renderPage();
 
         server.use(
           rest.put(`/api/v2/users/${MockUser.id}/roles`, (req, res, ctx) => {
             return res(
-              ctx.status(401),
-              ctx.json({ message: "message from the backend" }),
-            )
+              ctx.status(400),
+              ctx.json({ message: "Error on updating the user roles." }),
+            );
           }),
-        )
+        );
 
-        await updateUserRole(() => null, MockAuditorRole)
+        await updateUserRole(MockAuditorRole);
 
         // Check if the error message is displayed
-        const errorMessage = await screen.findByText("message from the backend")
-        expect(errorMessage).toBeDefined()
-      })
-    })
-  })
-})
+        await screen.findByText("Error on updating the user roles.");
+      });
+    });
+  });
+});
diff --git a/site/src/pages/UsersPage/UsersPage.tsx b/site/src/pages/UsersPage/UsersPage.tsx
index ad3ccb25badb2..7d09df412b32e 100644
--- a/site/src/pages/UsersPage/UsersPage.tsx
+++ b/site/src/pages/UsersPage/UsersPage.tsx
@@ -1,102 +1,75 @@
-import { useMachine } from "@xstate/react"
-import { User } from "api/typesGenerated"
-import { DeleteDialog } from "components/Dialogs/DeleteDialog/DeleteDialog"
+import { type FC, type ReactNode, useState } from "react";
+
+import { type User } from "api/typesGenerated";
+import { roles } from "api/queries/roles";
+import { groupsByUserId } from "api/queries/groups";
+import { getErrorMessage } from "api/errors";
+import { deploymentConfig } from "api/queries/deployment";
 import {
-  getPaginationContext,
-  nonInitialPage,
-} from "components/PaginationWidget/utils"
-import { useMe } from "hooks/useMe"
-import { usePermissions } from "hooks/usePermissions"
-import { FC, ReactNode, useEffect } from "react"
-import { Helmet } from "react-helmet-async"
-import { useSearchParams, useNavigate } from "react-router-dom"
-import { siteRolesMachine } from "xServices/roles/siteRolesXService"
-import { usersMachine } from "xServices/users/usersXService"
-import { ConfirmDialog } from "../../components/Dialogs/ConfirmDialog/ConfirmDialog"
-import { ResetPasswordDialog } from "../../components/Dialogs/ResetPasswordDialog/ResetPasswordDialog"
-import { pageTitle } from "../../utils/page"
-import { UsersPageView } from "./UsersPageView"
-import { useStatusFilterMenu } from "./UsersFilter"
-import { useFilter } from "components/Filter/filter"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import { deploymentConfigMachine } from "xServices/deploymentConfig/deploymentConfigMachine"
+  users,
+  suspendUser,
+  activateUser,
+  deleteUser,
+  updatePassword,
+  updateRoles,
+  authMethods,
+} from "api/queries/users";
 
-export const Language = {
-  suspendDialogTitle: "Suspend user",
-  suspendDialogAction: "Suspend",
-  suspendDialogMessagePrefix: "Do you want to suspend the user",
-  activateDialogTitle: "Activate user",
-  activateDialogAction: "Activate",
-  activateDialogMessagePrefix: "Do you want to activate the user",
-}
+import { useMutation, useQuery, useQueryClient } from "react-query";
+import { useSearchParams, useNavigate } from "react-router-dom";
+import { useOrganizationId, usePagination } from "hooks";
+import { useMe } from "hooks/useMe";
+import { usePermissions } from "hooks/usePermissions";
+import { useStatusFilterMenu } from "./UsersFilter";
+import { useFilter } from "components/Filter/filter";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import { generateRandomString } from "utils/random";
+import { prepareQuery } from "utils/filters";
 
-const getSelectedUser = (id: string, users?: User[]) =>
-  users?.find((u) => u.id === id)
+import { Helmet } from "react-helmet-async";
+import { DeleteDialog } from "components/Dialogs/DeleteDialog/DeleteDialog";
+import { nonInitialPage } from "components/PaginationWidget/utils";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import { ResetPasswordDialog } from "./ResetPasswordDialog";
+import { pageTitle } from "utils/page";
+import { UsersPageView } from "./UsersPageView";
+import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
 
 export const UsersPage: FC<{ children?: ReactNode }> = () => {
-  const navigate = useNavigate()
-  const searchParamsResult = useSearchParams()
-  const { entitlements } = useDashboard()
-  const [searchParams, setSearchParams] = searchParamsResult
-  const filter = searchParams.get("filter") ?? ""
-  const [usersState, usersSend] = useMachine(usersMachine, {
-    context: {
-      filter,
-      paginationContext: getPaginationContext(searchParams),
-    },
-    actions: {
-      updateURL: (context, event) =>
-        setSearchParams({ page: event.page, filter: context.filter }),
-    },
-  })
-  const {
-    users,
-    getUsersError,
-    usernameToDelete,
-    usernameToSuspend,
-    usernameToActivate,
-    userIdToResetPassword,
-    newUserPassword,
-    paginationRef,
-    count,
-  } = usersState.context
+  const queryClient = useQueryClient();
+  const navigate = useNavigate();
 
-  const { updateUsers: canEditUsers, viewDeploymentValues } = usePermissions()
-  const [rolesState] = useMachine(siteRolesMachine, {
-    context: {
-      hasPermission: canEditUsers,
-    },
-  })
-  const { roles } = rolesState.context
+  const searchParamsResult = useSearchParams();
+  const { entitlements } = useDashboard();
+  const [searchParams] = searchParamsResult;
 
-  // Ideally this only runs if 'canViewDeployment' is true.
-  // TODO: Prevent api call if the user does not have the perms.
-  const [state] = useMachine(deploymentConfigMachine)
-  const { deploymentValues } = state.context
-  // Indicates if oidc roles are synced from the oidc idp.
-  // Assign 'false' if unknown.
-  const oidcRoleSyncEnabled =
-    viewDeploymentValues &&
-    deploymentValues?.config.oidc?.user_role_field !== ""
+  const pagination = usePagination({ searchParamsResult });
+  const usersQuery = useQuery(
+    users({
+      q: prepareQuery(searchParams.get("filter") ?? ""),
+      limit: pagination.limit,
+      offset: pagination.offset,
+    }),
+  );
 
-  // Is loading if
-  // - users are loading or
-  // - the user can edit the users but the roles are loading
-  const isLoading =
-    usersState.matches("gettingUsers") ||
-    (canEditUsers && rolesState.matches("gettingRoles"))
+  const organizationId = useOrganizationId();
+  const groupsByUserIdQuery = useQuery(groupsByUserId(organizationId));
+  const authMethodsQuery = useQuery(authMethods());
 
-  const me = useMe()
+  const { updateUsers: canEditUsers, viewDeploymentValues } = usePermissions();
+  const rolesQuery = useQuery(roles());
+  const { data: deploymentValues } = useQuery({
+    ...deploymentConfig(),
+    enabled: viewDeploymentValues,
+  });
 
+  const me = useMe();
   const useFilterResult = useFilter({
     searchParamsResult,
     onUpdate: () => {
-      usersSend({ type: "UPDATE_PAGE", page: "1" })
+      pagination.goToPage(1);
     },
-  })
-  useEffect(() => {
-    usersSend({ type: "UPDATE_FILTER", query: useFilterResult.query })
-  }, [useFilterResult.query, usersSend])
+  });
   const statusMenu = useStatusFilterMenu({
     value: useFilterResult.values.status,
     onChange: (option) =>
@@ -104,114 +77,138 @@ export const UsersPage: FC<{ children?: ReactNode }> = () => {
         ...useFilterResult.values,
         status: option?.value,
       }),
-  })
+  });
+
+  const [userToSuspend, setUserToSuspend] = useState<User>();
+  const suspendUserMutation = useMutation(suspendUser(queryClient));
+
+  const [userToActivate, setUserToActivate] = useState<User>();
+  const activateUserMutation = useMutation(activateUser(queryClient));
+
+  const [userToDelete, setUserToDelete] = useState<User>();
+  const deleteUserMutation = useMutation(deleteUser(queryClient));
+
+  const [confirmResetPassword, setConfirmResetPassword] = useState<{
+    user: User;
+    newPassword: string;
+  }>();
+
+  const updatePasswordMutation = useMutation(updatePassword());
+  const updateRolesMutation = useMutation(updateRoles(queryClient));
+
+  // Indicates if oidc roles are synced from the oidc idp.
+  // Assign 'false' if unknown.
+  const oidcRoleSyncEnabled =
+    viewDeploymentValues &&
+    deploymentValues?.config.oidc?.user_role_field !== "";
+
+  const isLoading =
+    usersQuery.isLoading ||
+    rolesQuery.isLoading ||
+    authMethodsQuery.isLoading ||
+    groupsByUserIdQuery.isLoading;
 
   return (
     <>
       <Helmet>
         <title>{pageTitle("Users")}</title>
       </Helmet>
+
       <UsersPageView
         oidcRoleSyncEnabled={oidcRoleSyncEnabled}
-        roles={roles}
-        users={users}
-        count={count}
+        roles={rolesQuery.data}
+        users={usersQuery.data?.users}
+        groupsByUserId={groupsByUserIdQuery.data}
+        authMethods={authMethodsQuery.data}
         onListWorkspaces={(user) => {
           navigate(
             "/workspaces?filter=" +
               encodeURIComponent(`owner:${user.username}`),
-          )
+          );
         }}
         onViewActivity={(user) => {
           navigate(
             "/audit?filter=" + encodeURIComponent(`username:${user.username}`),
-          )
-        }}
-        onDeleteUser={(user) => {
-          usersSend({
-            type: "DELETE_USER",
-            userId: user.id,
-            username: user.username,
-          })
-        }}
-        onSuspendUser={(user) => {
-          usersSend({
-            type: "SUSPEND_USER",
-            userId: user.id,
-            username: user.username,
-          })
-        }}
-        onActivateUser={(user) => {
-          usersSend({
-            type: "ACTIVATE_USER",
-            userId: user.id,
-            username: user.username,
-          })
+          );
         }}
+        onDeleteUser={setUserToDelete}
+        onSuspendUser={setUserToSuspend}
+        onActivateUser={setUserToActivate}
         onResetUserPassword={(user) => {
-          usersSend({ type: "RESET_USER_PASSWORD", userId: user.id })
+          setConfirmResetPassword({
+            user,
+            newPassword: generateRandomString(12),
+          });
         }}
-        onUpdateUserRoles={(user, roles) => {
-          usersSend({
-            type: "UPDATE_USER_ROLES",
-            userId: user.id,
-            roles,
-          })
+        onUpdateUserRoles={async (user, roles) => {
+          try {
+            await updateRolesMutation.mutateAsync({
+              userId: user.id,
+              roles,
+            });
+            displaySuccess("Successfully updated the user roles.");
+          } catch (e) {
+            displayError(
+              getErrorMessage(e, "Error on updating the user roles."),
+            );
+          }
         }}
-        isUpdatingUserRoles={usersState.matches("updatingUserRoles")}
+        isUpdatingUserRoles={updateRolesMutation.isLoading}
         isLoading={isLoading}
         canEditUsers={canEditUsers}
         canViewActivity={entitlements.features.audit_log.enabled}
-        paginationRef={paginationRef}
         isNonInitialPage={nonInitialPage(searchParams)}
         actorID={me.id}
         filterProps={{
           filter: useFilterResult,
-          error: getUsersError,
-          menus: {
-            status: statusMenu,
-          },
+          error: usersQuery.error,
+          menus: { status: statusMenu },
         }}
+        count={usersQuery.data?.count}
+        page={pagination.page}
+        limit={pagination.limit}
+        onPageChange={pagination.goToPage}
       />
 
       <DeleteDialog
-        key={usernameToDelete}
-        isOpen={
-          usersState.matches("confirmUserDeletion") ||
-          usersState.matches("deletingUser")
-        }
-        confirmLoading={usersState.matches("deletingUser")}
-        name={usernameToDelete ?? ""}
+        key={userToDelete?.username}
+        isOpen={userToDelete !== undefined}
+        confirmLoading={deleteUserMutation.isLoading}
+        name={userToDelete?.username ?? ""}
         entity="user"
-        onConfirm={() => {
-          usersSend("CONFIRM_USER_DELETE")
-        }}
-        onCancel={() => {
-          usersSend("CANCEL_USER_DELETE")
+        onCancel={() => setUserToDelete(undefined)}
+        onConfirm={async () => {
+          try {
+            await deleteUserMutation.mutateAsync(userToDelete!.id);
+            setUserToDelete(undefined);
+            displaySuccess("Successfully deleted the user.");
+          } catch (e) {
+            displayError(getErrorMessage(e, "Error deleting user."));
+          }
         }}
       />
 
       <ConfirmDialog
         type="delete"
         hideCancel={false}
-        open={
-          usersState.matches("confirmUserSuspension") ||
-          usersState.matches("suspendingUser")
-        }
-        confirmLoading={usersState.matches("suspendingUser")}
-        title={Language.suspendDialogTitle}
-        confirmText={Language.suspendDialogAction}
-        onConfirm={() => {
-          usersSend("CONFIRM_USER_SUSPENSION")
-        }}
-        onClose={() => {
-          usersSend("CANCEL_USER_SUSPENSION")
+        open={userToSuspend !== undefined}
+        confirmLoading={suspendUserMutation.isLoading}
+        title="Suspend user"
+        confirmText="Suspend"
+        onClose={() => setUserToSuspend(undefined)}
+        onConfirm={async () => {
+          try {
+            await suspendUserMutation.mutateAsync(userToSuspend!.id);
+            setUserToSuspend(undefined);
+            displaySuccess("Successfully suspended the user.");
+          } catch (e) {
+            displayError(getErrorMessage(e, "Error suspending user."));
+          }
         }}
         description={
           <>
-            {Language.suspendDialogMessagePrefix}
-            {usernameToSuspend && " "}
-            <strong>{usernameToSuspend ?? ""}</strong>?
+            Do you want to suspend the user{" "}
+            <strong>{userToSuspend?.username ?? ""}</strong>?
           </>
         }
       />
@@ -219,47 +216,55 @@ export const UsersPage: FC<{ children?: ReactNode }> = () => {
       <ConfirmDialog
         type="success"
         hideCancel={false}
-        open={
-          usersState.matches("confirmUserActivation") ||
-          usersState.matches("activatingUser")
-        }
-        confirmLoading={usersState.matches("activatingUser")}
-        title={Language.activateDialogTitle}
-        confirmText={Language.activateDialogAction}
-        onConfirm={() => {
-          usersSend("CONFIRM_USER_ACTIVATION")
-        }}
-        onClose={() => {
-          usersSend("CANCEL_USER_ACTIVATION")
+        open={userToActivate !== undefined}
+        confirmLoading={activateUserMutation.isLoading}
+        title="Activate user"
+        confirmText="Activate"
+        onClose={() => setUserToActivate(undefined)}
+        onConfirm={async () => {
+          try {
+            await activateUserMutation.mutateAsync(userToActivate!.id);
+            setUserToActivate(undefined);
+            displaySuccess("Successfully activated the user.");
+          } catch (e) {
+            displayError(getErrorMessage(e, "Error activating user."));
+          }
         }}
         description={
           <>
-            {Language.activateDialogMessagePrefix}
-            {usernameToActivate && " "}
-            <strong>{usernameToActivate ?? ""}</strong>?
+            Do you want to activate{" "}
+            <strong>{userToActivate?.username ?? ""}</strong>?
           </>
         }
       />
 
-      {userIdToResetPassword && (
-        <ResetPasswordDialog
-          open={
-            usersState.matches("confirmUserPasswordReset") ||
-            usersState.matches("resettingUserPassword")
+      <ResetPasswordDialog
+        key={confirmResetPassword?.user.username}
+        open={confirmResetPassword !== undefined}
+        loading={updatePasswordMutation.isLoading}
+        user={confirmResetPassword?.user}
+        newPassword={confirmResetPassword?.newPassword}
+        onClose={() => {
+          setConfirmResetPassword(undefined);
+        }}
+        onConfirm={async () => {
+          try {
+            await updatePasswordMutation.mutateAsync({
+              userId: confirmResetPassword!.user.id,
+              password: confirmResetPassword!.newPassword,
+              old_password: "",
+            });
+            setConfirmResetPassword(undefined);
+            displaySuccess("Successfully updated the user password.");
+          } catch (e) {
+            displayError(
+              getErrorMessage(e, "Error on resetting the user password."),
+            );
           }
-          loading={usersState.matches("resettingUserPassword")}
-          user={getSelectedUser(userIdToResetPassword, users)}
-          newPassword={newUserPassword}
-          onClose={() => {
-            usersSend("CANCEL_USER_PASSWORD_RESET")
-          }}
-          onConfirm={() => {
-            usersSend("CONFIRM_USER_PASSWORD_RESET")
-          }}
-        />
-      )}
+        }}
+      />
     </>
-  )
-}
+  );
+};
 
-export default UsersPage
+export default UsersPage;
diff --git a/site/src/pages/UsersPage/UsersPageView.stories.tsx b/site/src/pages/UsersPage/UsersPageView.stories.tsx
index 1b860d2d4e29f..85449d520ad44 100644
--- a/site/src/pages/UsersPage/UsersPageView.stories.tsx
+++ b/site/src/pages/UsersPage/UsersPageView.stories.tsx
@@ -1,16 +1,19 @@
-import { Meta, StoryObj } from "@storybook/react"
-import { createPaginationRef } from "components/PaginationWidget/utils"
+import { Meta, StoryObj } from "@storybook/react";
 import {
   MockUser,
   MockUser2,
   MockAssignableSiteRoles,
   mockApiError,
-} from "testHelpers/entities"
-import { UsersPageView } from "./UsersPageView"
-import { ComponentProps } from "react"
-import { MockMenu, getDefaultFilterProps } from "components/Filter/storyHelpers"
+  MockAuthMethods,
+} from "testHelpers/entities";
+import { UsersPageView } from "./UsersPageView";
+import { ComponentProps } from "react";
+import {
+  MockMenu,
+  getDefaultFilterProps,
+} from "components/Filter/storyHelpers";
 
-type FilterProps = ComponentProps<typeof UsersPageView>["filterProps"]
+type FilterProps = ComponentProps<typeof UsersPageView>["filterProps"];
 
 const defaultFilterProps = getDefaultFilterProps<FilterProps>({
   query: "owner:me",
@@ -20,40 +23,42 @@ const defaultFilterProps = getDefaultFilterProps<FilterProps>({
   values: {
     status: "active",
   },
-})
+});
 
 const meta: Meta<typeof UsersPageView> = {
-  title: "pages/UsersPageView",
+  title: "pages/UsersPage",
   component: UsersPageView,
   args: {
-    paginationRef: createPaginationRef({ page: 1, limit: 25 }),
+    page: 1,
+    limit: 25,
     isNonInitialPage: false,
     users: [MockUser, MockUser2],
     roles: MockAssignableSiteRoles,
     count: 2,
     canEditUsers: true,
     filterProps: defaultFilterProps,
+    authMethods: MockAuthMethods,
   },
-}
+};
 
-export default meta
-type Story = StoryObj<typeof UsersPageView>
+export default meta;
+type Story = StoryObj<typeof UsersPageView>;
 
-export const Admin: Story = {}
+export const Admin: Story = {};
 
 export const SmallViewport = {
   parameters: {
     chromatic: { viewports: [600] },
   },
-}
+};
 
 export const Member = {
   args: { canEditUsers: false },
-}
+};
 
 export const Empty = {
   args: { users: [], count: 0 },
-}
+};
 
 export const EmptyPage = {
   args: {
@@ -61,7 +66,7 @@ export const EmptyPage = {
     count: 0,
     isNonInitialPage: true,
   },
-}
+};
 
 export const Error = {
   args: {
@@ -80,4 +85,4 @@ export const Error = {
       }),
     },
   },
-}
+};
diff --git a/site/src/pages/UsersPage/UsersPageView.tsx b/site/src/pages/UsersPage/UsersPageView.tsx
index a25d79391cfc5..5ea743d210781 100644
--- a/site/src/pages/UsersPage/UsersPageView.tsx
+++ b/site/src/pages/UsersPage/UsersPageView.tsx
@@ -1,43 +1,48 @@
-import { PaginationWidget } from "components/PaginationWidget/PaginationWidget"
-import { ComponentProps, FC } from "react"
-import { PaginationMachineRef } from "xServices/pagination/paginationXService"
-import * as TypesGen from "../../api/typesGenerated"
-import { UsersTable } from "../../components/UsersTable/UsersTable"
-import { UsersFilter } from "./UsersFilter"
-import { PaginationStatus } from "components/PaginationStatus/PaginationStatus"
+import { type ComponentProps, type FC } from "react";
+import type * as TypesGen from "api/typesGenerated";
+import { type GroupsByUserId } from "api/queries/groups";
+
+import { UsersTable } from "./UsersTable/UsersTable";
+import { UsersFilter } from "./UsersFilter";
+import {
+  PaginationStatus,
+  TableToolbar,
+} from "components/TableToolbar/TableToolbar";
+import { PaginationWidgetBase } from "components/PaginationWidget/PaginationWidgetBase";
 
-export const Language = {
-  activeUsersFilterName: "Active users",
-  allUsersFilterName: "All users",
-}
 export interface UsersPageViewProps {
-  users?: TypesGen.User[]
-  count?: number
-  roles?: TypesGen.AssignableRoles[]
-  isUpdatingUserRoles?: boolean
-  canEditUsers?: boolean
-  oidcRoleSyncEnabled: boolean
-  canViewActivity?: boolean
-  isLoading?: boolean
-  onSuspendUser: (user: TypesGen.User) => void
-  onDeleteUser: (user: TypesGen.User) => void
-  onListWorkspaces: (user: TypesGen.User) => void
-  onViewActivity: (user: TypesGen.User) => void
-  onActivateUser: (user: TypesGen.User) => void
-  onResetUserPassword: (user: TypesGen.User) => void
+  users?: TypesGen.User[];
+  roles?: TypesGen.AssignableRoles[];
+  isUpdatingUserRoles?: boolean;
+  canEditUsers: boolean;
+  oidcRoleSyncEnabled: boolean;
+  canViewActivity?: boolean;
+  isLoading: boolean;
+  authMethods?: TypesGen.AuthMethods;
+  onSuspendUser: (user: TypesGen.User) => void;
+  onDeleteUser: (user: TypesGen.User) => void;
+  onListWorkspaces: (user: TypesGen.User) => void;
+  onViewActivity: (user: TypesGen.User) => void;
+  onActivateUser: (user: TypesGen.User) => void;
+  onResetUserPassword: (user: TypesGen.User) => void;
   onUpdateUserRoles: (
     user: TypesGen.User,
     roles: TypesGen.Role["name"][],
-  ) => void
-  filterProps: ComponentProps<typeof UsersFilter>
-  paginationRef: PaginationMachineRef
-  isNonInitialPage: boolean
-  actorID: string
+  ) => void;
+  filterProps: ComponentProps<typeof UsersFilter>;
+  isNonInitialPage: boolean;
+  actorID: string;
+  groupsByUserId: GroupsByUserId | undefined;
+
+  // Pagination
+  count?: number;
+  page: number;
+  limit: number;
+  onPageChange: (page: number) => void;
 }
 
 export const UsersPageView: FC<React.PropsWithChildren<UsersPageViewProps>> = ({
   users,
-  count,
   roles,
   onSuspendUser,
   onDeleteUser,
@@ -52,24 +57,32 @@ export const UsersPageView: FC<React.PropsWithChildren<UsersPageViewProps>> = ({
   canViewActivity,
   isLoading,
   filterProps,
-  paginationRef,
   isNonInitialPage,
   actorID,
+  authMethods,
+  count,
+  limit,
+  onPageChange,
+  page,
+  groupsByUserId,
 }) => {
   return (
     <>
       <UsersFilter {...filterProps} />
 
-      <PaginationStatus
-        isLoading={Boolean(isLoading)}
-        showing={users?.length ?? 0}
-        total={count ?? 0}
-        label="users"
-      />
+      <TableToolbar>
+        <PaginationStatus
+          isLoading={Boolean(isLoading)}
+          showing={users?.length ?? 0}
+          total={count ?? 0}
+          label="users"
+        />
+      </TableToolbar>
 
       <UsersTable
         users={users}
         roles={roles}
+        groupsByUserId={groupsByUserId}
         onSuspendUser={onSuspendUser}
         onDeleteUser={onDeleteUser}
         onListWorkspaces={onListWorkspaces}
@@ -84,9 +97,17 @@ export const UsersPageView: FC<React.PropsWithChildren<UsersPageViewProps>> = ({
         isLoading={isLoading}
         isNonInitialPage={isNonInitialPage}
         actorID={actorID}
+        authMethods={authMethods}
       />
 
-      <PaginationWidget numRecords={count} paginationRef={paginationRef} />
+      {count && (
+        <PaginationWidgetBase
+          count={count}
+          limit={limit}
+          onChange={onPageChange}
+          page={page}
+        />
+      )}
     </>
-  )
-}
+  );
+};
diff --git a/site/src/pages/UsersPage/UsersTable/EditRolesButton.stories.tsx b/site/src/pages/UsersPage/UsersTable/EditRolesButton.stories.tsx
new file mode 100644
index 0000000000000..fea9065dcd3f2
--- /dev/null
+++ b/site/src/pages/UsersPage/UsersTable/EditRolesButton.stories.tsx
@@ -0,0 +1,43 @@
+import {
+  MockOwnerRole,
+  MockSiteRoles,
+  MockUserAdminRole,
+} from "testHelpers/entities";
+import { EditRolesButton } from "./EditRolesButton";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const meta: Meta<typeof EditRolesButton> = {
+  title: "pages/UsersPage/EditRolesButton",
+  component: EditRolesButton,
+  args: {
+    isDefaultOpen: true,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof EditRolesButton>;
+
+const selectedRoleNames = new Set([MockUserAdminRole.name, MockOwnerRole.name]);
+
+export const Open: Story = {
+  args: {
+    selectedRoleNames,
+    roles: MockSiteRoles,
+  },
+  parameters: {
+    chromatic: { delay: 300 },
+  },
+};
+
+export const Loading: Story = {
+  args: {
+    isLoading: true,
+    selectedRoleNames,
+    roles: MockSiteRoles,
+    userLoginType: "password",
+    oidcRoleSync: false,
+  },
+  parameters: {
+    chromatic: { delay: 300 },
+  },
+};
diff --git a/site/src/pages/UsersPage/UsersTable/EditRolesButton.tsx b/site/src/pages/UsersPage/UsersTable/EditRolesButton.tsx
new file mode 100644
index 0000000000000..eca9bcf389f9f
--- /dev/null
+++ b/site/src/pages/UsersPage/UsersTable/EditRolesButton.tsx
@@ -0,0 +1,216 @@
+import IconButton from "@mui/material/IconButton";
+import { EditSquare } from "components/Icons/EditSquare";
+import { FC } from "react";
+import { makeStyles } from "@mui/styles";
+import { Stack } from "components/Stack/Stack";
+import Checkbox from "@mui/material/Checkbox";
+import UserIcon from "@mui/icons-material/PersonOutline";
+import { Role } from "api/typesGenerated";
+import {
+  HelpTooltip,
+  HelpTooltipText,
+  HelpTooltipTitle,
+} from "components/HelpTooltip/HelpTooltip";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "components/Popover/Popover";
+
+const roleDescriptions: Record<string, string> = {
+  owner:
+    "Owner can manage all resources, including users, groups, templates, and workspaces.",
+  "user-admin": "User admin can manage all users and groups.",
+  "template-admin": "Template admin can manage all templates and workspaces.",
+  auditor: "Auditor can access the audit logs.",
+  member:
+    "Everybody is a member. This is a shared and default role for all users.",
+};
+
+const Option: React.FC<{
+  value: string;
+  name: string;
+  description: string;
+  isChecked: boolean;
+  onChange: (roleName: string) => void;
+}> = ({ value, name, description, isChecked, onChange }) => {
+  const styles = useStyles();
+
+  return (
+    <label htmlFor={name} className={styles.option}>
+      <Stack direction="row" alignItems="flex-start">
+        <Checkbox
+          id={name}
+          size="small"
+          className={styles.checkbox}
+          value={value}
+          checked={isChecked}
+          onChange={(e) => {
+            onChange(e.currentTarget.value);
+          }}
+        />
+        <Stack spacing={0}>
+          <strong>{name}</strong>
+          <span className={styles.optionDescription}>{description}</span>
+        </Stack>
+      </Stack>
+    </label>
+  );
+};
+
+export interface EditRolesButtonProps {
+  isLoading: boolean;
+  roles: Role[];
+  selectedRoleNames: Set<string>;
+  onChange: (roles: Role["name"][]) => void;
+  isDefaultOpen?: boolean;
+  oidcRoleSync: boolean;
+  userLoginType: string;
+}
+
+export const EditRolesButton: FC<EditRolesButtonProps> = ({
+  roles,
+  selectedRoleNames,
+  onChange,
+  isLoading,
+  isDefaultOpen = false,
+  userLoginType,
+  oidcRoleSync,
+}) => {
+  const styles = useStyles();
+
+  const handleChange = (roleName: string) => {
+    if (selectedRoleNames.has(roleName)) {
+      const serialized = [...selectedRoleNames];
+      onChange(serialized.filter((role) => role !== roleName));
+      return;
+    }
+
+    onChange([...selectedRoleNames, roleName]);
+  };
+
+  const canSetRoles =
+    userLoginType !== "oidc" || (userLoginType === "oidc" && !oidcRoleSync);
+
+  if (!canSetRoles) {
+    return (
+      <HelpTooltip size="small">
+        <HelpTooltipTitle>Externally controlled</HelpTooltipTitle>
+        <HelpTooltipText>
+          Roles for this user are controlled by the OIDC identity provider.
+        </HelpTooltipText>
+      </HelpTooltip>
+    );
+  }
+
+  return (
+    <Popover isDefaultOpen={isDefaultOpen}>
+      <PopoverTrigger>
+        <IconButton
+          size="small"
+          className={styles.editButton}
+          title="Edit user roles"
+        >
+          <EditSquare />
+        </IconButton>
+      </PopoverTrigger>
+
+      <PopoverContent classes={{ paper: styles.popoverPaper }}>
+        <fieldset
+          className={styles.fieldset}
+          disabled={isLoading}
+          title="Available roles"
+        >
+          <Stack className={styles.options} spacing={3}>
+            {roles.map((role) => (
+              <Option
+                key={role.name}
+                onChange={handleChange}
+                isChecked={selectedRoleNames.has(role.name)}
+                value={role.name}
+                name={role.display_name}
+                description={roleDescriptions[role.name] ?? ""}
+              />
+            ))}
+          </Stack>
+        </fieldset>
+        <div className={styles.footer}>
+          <Stack direction="row" alignItems="flex-start">
+            <UserIcon className={styles.userIcon} />
+            <Stack spacing={0}>
+              <strong>Member</strong>
+              <span className={styles.optionDescription}>
+                {roleDescriptions.member}
+              </span>
+            </Stack>
+          </Stack>
+        </div>
+      </PopoverContent>
+    </Popover>
+  );
+};
+
+const useStyles = makeStyles((theme) => ({
+  editButton: {
+    color: theme.palette.text.secondary,
+
+    "& .MuiSvgIcon-root": {
+      width: theme.spacing(2),
+      height: theme.spacing(2),
+      position: "relative",
+      top: -2, // Align the pencil square
+    },
+
+    "&:hover": {
+      color: theme.palette.text.primary,
+      backgroundColor: "transparent",
+    },
+  },
+  popoverPaper: {
+    width: theme.spacing(45),
+    marginTop: theme.spacing(1),
+    background: theme.palette.background.paperLight,
+  },
+  fieldset: {
+    border: 0,
+    margin: 0,
+    padding: 0,
+
+    "&:disabled": {
+      opacity: 0.5,
+    },
+  },
+  options: {
+    padding: theme.spacing(3),
+  },
+  option: {
+    cursor: "pointer",
+    fontSize: 14,
+  },
+  checkbox: {
+    padding: 0,
+    position: "relative",
+    top: 1, // Alignment
+
+    "& svg": {
+      width: theme.spacing(2.5),
+      height: theme.spacing(2.5),
+    },
+  },
+  optionDescription: {
+    fontSize: 13,
+    color: theme.palette.text.secondary,
+    lineHeight: "160%",
+  },
+  footer: {
+    padding: theme.spacing(3),
+    backgroundColor: theme.palette.background.paper,
+    borderTop: `1px solid ${theme.palette.divider}`,
+    fontSize: 14,
+  },
+  userIcon: {
+    width: theme.spacing(2.5), // Same as the checkbox
+    height: theme.spacing(2.5),
+    color: theme.palette.primary.main,
+  },
+}));
diff --git a/site/src/pages/UsersPage/UsersTable/TableColumnHelpTooltip.tsx b/site/src/pages/UsersPage/UsersTable/TableColumnHelpTooltip.tsx
new file mode 100644
index 0000000000000..2f8109b9bedfc
--- /dev/null
+++ b/site/src/pages/UsersPage/UsersTable/TableColumnHelpTooltip.tsx
@@ -0,0 +1,58 @@
+import { FC } from "react";
+import {
+  HelpTooltip,
+  HelpTooltipLink,
+  HelpTooltipLinksGroup,
+  HelpTooltipText,
+  HelpTooltipTitle,
+} from "components/HelpTooltip/HelpTooltip";
+import { docs } from "utils/docs";
+
+type ColumnHeader = "roles" | "groups";
+
+type TooltipData = {
+  title: string;
+  text: string;
+  links: readonly { text: string; href: string }[];
+};
+
+export const Language = {
+  roles: {
+    title: "What is a role?",
+    text:
+      "Coder role-based access control (RBAC) provides fine-grained access management. " +
+      "View our docs on how to use the available roles.",
+    links: [{ text: "User Roles", href: docs("/admin/users#roles") }],
+  },
+
+  groups: {
+    title: "What is a group?",
+    text:
+      "Groups can be used with template RBAC to give groups of users access " +
+      "to specific templates. View our docs on how to use groups.",
+    links: [{ text: "User Groups", href: docs("/admin/groups") }],
+  },
+} as const satisfies Record<ColumnHeader, TooltipData>;
+
+type Props = {
+  variant: ColumnHeader;
+};
+
+export const TableColumnHelpTooltip: FC<Props> = ({ variant }) => {
+  const variantLang = Language[variant];
+
+  return (
+    <HelpTooltip size="small">
+      <HelpTooltipTitle>{variantLang.title}</HelpTooltipTitle>
+      <HelpTooltipText>{variantLang.text}</HelpTooltipText>
+
+      <HelpTooltipLinksGroup>
+        {variantLang.links.map((link) => (
+          <HelpTooltipLink key={link.text} href={link.href}>
+            {link.text}
+          </HelpTooltipLink>
+        ))}
+      </HelpTooltipLinksGroup>
+    </HelpTooltip>
+  );
+};
diff --git a/site/src/pages/UsersPage/UsersTable/UserGroupsCell.tsx b/site/src/pages/UsersPage/UsersTable/UserGroupsCell.tsx
new file mode 100644
index 0000000000000..f4d32f3f52f32
--- /dev/null
+++ b/site/src/pages/UsersPage/UsersTable/UserGroupsCell.tsx
@@ -0,0 +1,118 @@
+import { useTheme } from "@emotion/react";
+import { type Group } from "api/typesGenerated";
+
+import { Stack } from "components/Stack/Stack";
+import { Avatar } from "components/Avatar/Avatar";
+import { OverflowY } from "components/OverflowY/OverflowY";
+
+import TableCell from "@mui/material/TableCell";
+import Button from "@mui/material/Button";
+import List from "@mui/material/List";
+import ListItem from "@mui/material/ListItem";
+import GroupIcon from "@mui/icons-material/Group";
+
+import {
+  Popover,
+  PopoverTrigger,
+  PopoverContent,
+} from "components/Popover/Popover";
+
+type GroupsCellProps = {
+  userGroups: readonly Group[] | undefined;
+};
+
+export function UserGroupsCell({ userGroups }: GroupsCellProps) {
+  const theme = useTheme();
+
+  return (
+    <TableCell>
+      {userGroups === undefined ? (
+        // Felt right to add emphasis to the undefined state for semantics
+        // ("hey, this isn't normal"), but the default italics looked weird in
+        // the table UI
+        <em css={{ fontStyle: "normal" }}>N/A</em>
+      ) : (
+        <Popover mode="hover">
+          <PopoverTrigger>
+            <Button
+              css={{
+                justifyContent: "flex-start",
+                fontSize: theme.typography.body2.fontSize,
+                lineHeight: theme.typography.body2.lineHeight,
+                fontWeight: 400,
+                border: "none",
+                padding: 0,
+                "&:hover": {
+                  border: "none",
+                  backgroundColor: "transparent",
+                },
+              }}
+            >
+              <Stack
+                spacing={0}
+                direction="row"
+                css={{ columnGap: theme.spacing(1), alignItems: "center" }}
+              >
+                <GroupIcon
+                  sx={{
+                    width: "1rem",
+                    height: "1rem",
+                    opacity: userGroups.length > 0 ? 0.8 : 0.5,
+                  }}
+                />
+
+                <span>
+                  {userGroups.length} Group{userGroups.length !== 1 && "s"}
+                </span>
+              </Stack>
+            </Button>
+          </PopoverTrigger>
+
+          <PopoverContent disableScrollLock disableRestoreFocus>
+            <OverflowY maxHeight={400}>
+              <List
+                component="ul"
+                css={{
+                  display: "flex",
+                  flexFlow: "column nowrap",
+                  fontSize: theme.typography.body2.fontSize,
+                  padding: theme.spacing(0.5, 0.25),
+                  gap: theme.spacing(0),
+                }}
+              >
+                {userGroups.map((group) => {
+                  const groupName = group.display_name || group.name;
+                  return (
+                    <ListItem
+                      key={group.id}
+                      css={{
+                        columnGap: theme.spacing(1.25),
+                        alignItems: "center",
+                      }}
+                    >
+                      <Avatar size="xs" src={group.avatar_url} alt={groupName}>
+                        {groupName}
+                      </Avatar>
+
+                      <span
+                        css={{
+                          whiteSpace: "nowrap",
+                          textOverflow: "ellipsis",
+                          overflow: "hidden",
+                          lineHeight: 1,
+                          margin: 0,
+                        }}
+                      >
+                        {groupName || <em>N/A</em>}
+                      </span>
+                    </ListItem>
+                  );
+                })}
+              </List>
+            </OverflowY>
+          </PopoverContent>
+        </Popover>
+      )}
+    </TableCell>
+  );
+}
diff --git a/site/src/pages/UsersPage/UsersTable/UserRoleCell.tsx b/site/src/pages/UsersPage/UsersTable/UserRoleCell.tsx
new file mode 100644
index 0000000000000..fa45683ebbae6
--- /dev/null
+++ b/site/src/pages/UsersPage/UsersTable/UserRoleCell.tsx
@@ -0,0 +1,171 @@
+/**
+ * @file Defines the visual logic for the Roles cell in the Users page table.
+ *
+ * The previous implementation tried to dynamically truncate the number of roles
+ * that would get displayed in a cell, only truncating if there were more roles
+ * than room in the cell. But there was a problem – that information can't
+ * exist on the first render, because the DOM nodes haven't been made yet.
+ *
+ * The only way to avoid UI flickering was by juggling between useLayoutEffect
+ * for direct DOM node mutations for any renders that had new data, and normal
+ * state logic for all other renders. It was clunky, and required duplicating
+ * the logic in two places (making things easy to accidentally break), so we
+ * went with a simpler design. If we decide we really do need to display the
+ * users like that, though, know that it will be painful
+ */
+import { useTheme } from "@emotion/react";
+import { type User, type Role } from "api/typesGenerated";
+
+import { EditRolesButton } from "./EditRolesButton";
+import { Pill } from "components/Pill/Pill";
+import TableCell from "@mui/material/TableCell";
+import Stack from "@mui/material/Stack";
+
+import {
+  Popover,
+  PopoverTrigger,
+  PopoverContent,
+} from "components/Popover/Popover";
+
+type UserRoleCellProps = {
+  canEditUsers: boolean;
+  allAvailableRoles: Role[] | undefined;
+  user: User;
+  isLoading: boolean;
+  oidcRoleSyncEnabled: boolean;
+  onUserRolesUpdate: (user: User, newRoleNames: string[]) => void;
+};
+
+export function UserRoleCell({
+  canEditUsers,
+  allAvailableRoles,
+  user,
+  isLoading,
+  oidcRoleSyncEnabled,
+  onUserRolesUpdate,
+}: UserRoleCellProps) {
+  const theme = useTheme();
+
+  const [mainDisplayRole = fallbackRole, ...extraRoles] =
+    sortRolesByAccessLevel(user.roles ?? []);
+  const hasOwnerRole = mainDisplayRole.name === "owner";
+
+  return (
+    <TableCell>
+      <Stack direction="row" spacing={1}>
+        {canEditUsers && (
+          <EditRolesButton
+            roles={sortRolesByAccessLevel(allAvailableRoles ?? [])}
+            selectedRoleNames={getSelectedRoleNames(user.roles)}
+            isLoading={isLoading}
+            userLoginType={user.login_type}
+            oidcRoleSync={oidcRoleSyncEnabled}
+            onChange={(roles) => {
+              // Remove the fallback role because it is only for the UI
+              const rolesWithoutFallback = roles.filter(
+                (role) => role !== fallbackRole.name,
+              );
+
+              onUserRolesUpdate(user, rolesWithoutFallback);
+            }}
+          />
+        )}
+
+        <Pill
+          text={mainDisplayRole.display_name}
+          css={{
+            backgroundColor: hasOwnerRole
+              ? theme.palette.info.dark
+              : theme.palette.background.paperLight,
+            borderColor: hasOwnerRole
+              ? theme.palette.info.light
+              : theme.palette.divider,
+          }}
+        />
+
+        {extraRoles.length > 0 && <OverflowRolePill roles={extraRoles} />}
+      </Stack>
+    </TableCell>
+  );
+}
+
+type OverflowRolePillProps = {
+  roles: readonly Role[];
+};
+
+function OverflowRolePill({ roles }: OverflowRolePillProps) {
+  const theme = useTheme();
+
+  return (
+    <Popover mode="hover">
+      <PopoverTrigger>
+        <Pill
+          text={`+${roles.length} more`}
+          css={{
+            backgroundColor: theme.palette.background.paperLight,
+            borderColor: theme.palette.divider,
+          }}
+        />
+      </PopoverTrigger>
+
+      <PopoverContent
+        disableRestoreFocus
+        disableScrollLock
+        css={{
+          ".MuiPaper-root": {
+            display: "flex",
+            flexFlow: "row wrap",
+            columnGap: theme.spacing(1),
+            rowGap: theme.spacing(1.5),
+            padding: theme.spacing(1.5, 2),
+            alignContent: "space-around",
+          },
+        }}
+      >
+        {roles.map((role) => (
+          <Pill
+            key={role.name}
+            text={role.display_name || role.name}
+            css={{
+              backgroundColor: theme.palette.background.paperLight,
+              borderColor: theme.palette.divider,
+            }}
+          />
+        ))}
+      </PopoverContent>
+    </Popover>
+  );
+}
+
+const fallbackRole: Role = {
+  name: "member",
+  display_name: "Member",
+} as const;
+
+const roleNamesByAccessLevel: readonly string[] = [
+  "owner",
+  "user-admin",
+  "template-admin",
+  "auditor",
+];
+
+function sortRolesByAccessLevel(roles: Role[]) {
+  if (roles.length === 0) {
+    return roles;
+  }
+
+  return [...roles].sort(
+    (r1, r2) =>
+      roleNamesByAccessLevel.indexOf(r1.name) -
+      roleNamesByAccessLevel.indexOf(r2.name),
+  );
+}
+
+function getSelectedRoleNames(roles: readonly Role[]) {
+  const roleNameSet = new Set(roles.map((role) => role.name));
+  if (roleNameSet.size === 0) {
+    roleNameSet.add(fallbackRole.name);
+  }
+
+  return roleNameSet;
+}
diff --git a/site/src/pages/UsersPage/UsersTable/UsersTable.stories.tsx b/site/src/pages/UsersPage/UsersTable/UsersTable.stories.tsx
new file mode 100644
index 0000000000000..d88ab3425884a
--- /dev/null
+++ b/site/src/pages/UsersPage/UsersTable/UsersTable.stories.tsx
@@ -0,0 +1,88 @@
+import {
+  MockUser,
+  MockUser2,
+  MockAssignableSiteRoles,
+  MockAuthMethods,
+  MockGroup,
+} from "testHelpers/entities";
+import { UsersTable } from "./UsersTable";
+import type { Meta, StoryObj } from "@storybook/react";
+
+const mockGroupsByUserId = new Map([
+  [MockUser.id, [MockGroup]],
+  [MockUser2.id, [MockGroup]],
+]);
+
+const meta: Meta<typeof UsersTable> = {
+  title: "pages/UsersPage/UsersTable",
+  component: UsersTable,
+  args: {
+    isNonInitialPage: false,
+    authMethods: MockAuthMethods,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof UsersTable>;
+
+export const Example: Story = {
+  args: {
+    users: [MockUser, MockUser2],
+    roles: MockAssignableSiteRoles,
+    canEditUsers: false,
+    groupsByUserId: mockGroupsByUserId,
+  },
+};
+
+export const Editable: Story = {
+  args: {
+    users: [
+      MockUser,
+      MockUser2,
+      {
+        ...MockUser,
+        username: "John Doe",
+        email: "john.doe@coder.com",
+        roles: [],
+        status: "dormant",
+      },
+      {
+        ...MockUser,
+        username: "Roger Moore",
+        email: "roger.moore@coder.com",
+        roles: [],
+        status: "suspended",
+      },
+      {
+        ...MockUser,
+        username: "OIDC User",
+        email: "oidc.user@coder.com",
+        roles: [],
+        status: "active",
+        login_type: "oidc",
+      },
+    ],
+    roles: MockAssignableSiteRoles,
+    canEditUsers: true,
+    canViewActivity: true,
+    groupsByUserId: mockGroupsByUserId,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    users: [],
+    roles: MockAssignableSiteRoles,
+  },
+};
+
+export const Loading: Story = {
+  args: {
+    users: [],
+    roles: MockAssignableSiteRoles,
+    isLoading: true,
+  },
+  parameters: {
+    chromatic: { pauseAnimationAtEnd: true },
+  },
+};
diff --git a/site/src/pages/UsersPage/UsersTable/UsersTable.tsx b/site/src/pages/UsersPage/UsersTable/UsersTable.tsx
new file mode 100644
index 0000000000000..84028c79a9016
--- /dev/null
+++ b/site/src/pages/UsersPage/UsersTable/UsersTable.tsx
@@ -0,0 +1,122 @@
+import { type FC } from "react";
+import type * as TypesGen from "api/typesGenerated";
+import { type GroupsByUserId } from "api/queries/groups";
+
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableHead from "@mui/material/TableHead";
+import TableRow from "@mui/material/TableRow";
+import { Stack } from "components/Stack/Stack";
+import { TableColumnHelpTooltip } from "./TableColumnHelpTooltip";
+import { UsersTableBody } from "./UsersTableBody";
+
+export const Language = {
+  usernameLabel: "User",
+  rolesLabel: "Roles",
+  groupsLabel: "Groups",
+  statusLabel: "Status",
+  lastSeenLabel: "Last Seen",
+  loginTypeLabel: "Login Type",
+} as const;
+
+export interface UsersTableProps {
+  users: TypesGen.User[] | undefined;
+  roles: TypesGen.AssignableRoles[] | undefined;
+  groupsByUserId: GroupsByUserId | undefined;
+  isUpdatingUserRoles?: boolean;
+  canEditUsers: boolean;
+  canViewActivity?: boolean;
+  isLoading: boolean;
+  onSuspendUser: (user: TypesGen.User) => void;
+  onActivateUser: (user: TypesGen.User) => void;
+  onDeleteUser: (user: TypesGen.User) => void;
+  onListWorkspaces: (user: TypesGen.User) => void;
+  onViewActivity: (user: TypesGen.User) => void;
+  onResetUserPassword: (user: TypesGen.User) => void;
+  onUpdateUserRoles: (
+    user: TypesGen.User,
+    roles: TypesGen.Role["name"][],
+  ) => void;
+  isNonInitialPage: boolean;
+  actorID: string;
+  oidcRoleSyncEnabled: boolean;
+  authMethods?: TypesGen.AuthMethods;
+}
+
+export const UsersTable: FC<React.PropsWithChildren<UsersTableProps>> = ({
+  users,
+  roles,
+  onSuspendUser,
+  onDeleteUser,
+  onListWorkspaces,
+  onViewActivity,
+  onActivateUser,
+  onResetUserPassword,
+  onUpdateUserRoles,
+  isUpdatingUserRoles,
+  canEditUsers,
+  canViewActivity,
+  isLoading,
+  isNonInitialPage,
+  actorID,
+  oidcRoleSyncEnabled,
+  authMethods,
+  groupsByUserId,
+}) => {
+  return (
+    <TableContainer>
+      <Table>
+        <TableHead>
+          <TableRow>
+            <TableCell width="29%">{Language.usernameLabel}</TableCell>
+
+            <TableCell width="29%">
+              <Stack direction="row" spacing={1} alignItems="center">
+                <span>{Language.rolesLabel}</span>
+                <TableColumnHelpTooltip variant="roles" />
+              </Stack>
+            </TableCell>
+
+            <TableCell width="14%">
+              <Stack direction="row" spacing={1} alignItems="center">
+                <span>{Language.groupsLabel}</span>
+                <TableColumnHelpTooltip variant="groups" />
+              </Stack>
+            </TableCell>
+
+            <TableCell width="14%">{Language.loginTypeLabel}</TableCell>
+            <TableCell width="14%">{Language.statusLabel}</TableCell>
+
+            {/* 1% is a trick to make the table cell width fit the content */}
+            {canEditUsers && <TableCell width="1%" />}
+          </TableRow>
+        </TableHead>
+
+        <TableBody>
+          <UsersTableBody
+            users={users}
+            roles={roles}
+            groupsByUserId={groupsByUserId}
+            isLoading={isLoading}
+            canEditUsers={canEditUsers}
+            canViewActivity={canViewActivity}
+            isUpdatingUserRoles={isUpdatingUserRoles}
+            onActivateUser={onActivateUser}
+            onDeleteUser={onDeleteUser}
+            onListWorkspaces={onListWorkspaces}
+            onViewActivity={onViewActivity}
+            onResetUserPassword={onResetUserPassword}
+            onSuspendUser={onSuspendUser}
+            onUpdateUserRoles={onUpdateUserRoles}
+            isNonInitialPage={isNonInitialPage}
+            actorID={actorID}
+            oidcRoleSyncEnabled={oidcRoleSyncEnabled}
+            authMethods={authMethods}
+          />
+        </TableBody>
+      </Table>
+    </TableContainer>
+  );
+};
diff --git a/site/src/pages/UsersPage/UsersTable/UsersTableBody.tsx b/site/src/pages/UsersPage/UsersTable/UsersTableBody.tsx
new file mode 100644
index 0000000000000..559fdc9c5ed93
--- /dev/null
+++ b/site/src/pages/UsersPage/UsersTable/UsersTableBody.tsx
@@ -0,0 +1,284 @@
+import Box from "@mui/material/Box";
+import TableCell from "@mui/material/TableCell";
+import TableRow from "@mui/material/TableRow";
+import Skeleton from "@mui/material/Skeleton";
+import { type Interpolation, type Theme } from "@emotion/react";
+import { type FC } from "react";
+import dayjs from "dayjs";
+import relativeTime from "dayjs/plugin/relativeTime";
+import type * as TypesGen from "api/typesGenerated";
+import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
+import { AvatarData } from "components/AvatarData/AvatarData";
+import { AvatarDataSkeleton } from "components/AvatarData/AvatarDataSkeleton";
+import { EmptyState } from "components/EmptyState/EmptyState";
+import {
+  TableLoaderSkeleton,
+  TableRowSkeleton,
+} from "components/TableLoader/TableLoader";
+import { TableRowMenu } from "components/TableRowMenu/TableRowMenu";
+import { EnterpriseBadge } from "components/DeploySettingsLayout/Badges";
+import HideSourceOutlined from "@mui/icons-material/HideSourceOutlined";
+import KeyOutlined from "@mui/icons-material/KeyOutlined";
+import GitHub from "@mui/icons-material/GitHub";
+import PasswordOutlined from "@mui/icons-material/PasswordOutlined";
+import ShieldOutlined from "@mui/icons-material/ShieldOutlined";
+import { LastSeen } from "components/LastSeen/LastSeen";
+import { UserRoleCell } from "./UserRoleCell";
+import { type GroupsByUserId } from "api/queries/groups";
+import { UserGroupsCell } from "./UserGroupsCell";
+
+dayjs.extend(relativeTime);
+
+interface UsersTableBodyProps {
+  users: TypesGen.User[] | undefined;
+  groupsByUserId: GroupsByUserId | undefined;
+  authMethods?: TypesGen.AuthMethods;
+  roles?: TypesGen.AssignableRoles[];
+  isUpdatingUserRoles?: boolean;
+  canEditUsers: boolean;
+  isLoading: boolean;
+  canViewActivity?: boolean;
+  onSuspendUser: (user: TypesGen.User) => void;
+  onDeleteUser: (user: TypesGen.User) => void;
+  onListWorkspaces: (user: TypesGen.User) => void;
+  onViewActivity: (user: TypesGen.User) => void;
+  onActivateUser: (user: TypesGen.User) => void;
+  onResetUserPassword: (user: TypesGen.User) => void;
+  onUpdateUserRoles: (
+    user: TypesGen.User,
+    roles: TypesGen.Role["name"][],
+  ) => void;
+  isNonInitialPage: boolean;
+  actorID: string;
+  // oidcRoleSyncEnabled should be set to false if unknown.
+  // This is used to determine if the oidc roles are synced from the oidc idp and
+  // editing via the UI should be disabled.
+  oidcRoleSyncEnabled: boolean;
+}
+
+export const UsersTableBody: FC<
+  React.PropsWithChildren<UsersTableBodyProps>
+> = ({
+  users,
+  authMethods,
+  roles,
+  onSuspendUser,
+  onDeleteUser,
+  onListWorkspaces,
+  onViewActivity,
+  onActivateUser,
+  onResetUserPassword,
+  onUpdateUserRoles,
+  isUpdatingUserRoles,
+  canEditUsers,
+  canViewActivity,
+  isLoading,
+  isNonInitialPage,
+  actorID,
+  oidcRoleSyncEnabled,
+  groupsByUserId,
+}) => {
+  return (
+    <ChooseOne>
+      <Cond condition={Boolean(isLoading)}>
+        <TableLoaderSkeleton>
+          <TableRowSkeleton>
+            <TableCell>
+              <Box sx={{ display: "flex", alignItems: "center", gap: 1 }}>
+                <AvatarDataSkeleton />
+              </Box>
+            </TableCell>
+
+            <TableCell>
+              <Skeleton variant="text" width="25%" />
+            </TableCell>
+
+            <TableCell>
+              <Skeleton variant="text" width="25%" />
+            </TableCell>
+
+            <TableCell>
+              <Skeleton variant="text" width="25%" />
+            </TableCell>
+
+            <TableCell>
+              <Skeleton variant="text" width="25%" />
+            </TableCell>
+
+            {canEditUsers && (
+              <TableCell>
+                <Skeleton variant="text" width="25%" />
+              </TableCell>
+            )}
+          </TableRowSkeleton>
+        </TableLoaderSkeleton>
+      </Cond>
+
+      <Cond condition={!users || users.length === 0}>
+        <ChooseOne>
+          <Cond condition={isNonInitialPage}>
+            <TableRow>
+              <TableCell colSpan={999}>
+                <Box p={4}>
+                  <EmptyState message="No users found on this page" />
+                </Box>
+              </TableCell>
+            </TableRow>
+          </Cond>
+
+          <Cond>
+            <TableRow>
+              <TableCell colSpan={999}>
+                <Box p={4}>
+                  <EmptyState message="No users found" />
+                </Box>
+              </TableCell>
+            </TableRow>
+          </Cond>
+        </ChooseOne>
+      </Cond>
+
+      <Cond>
+        {users?.map((user) => (
+          <TableRow key={user.id} data-testid={`user-${user.id}`}>
+            <TableCell>
+              <AvatarData
+                title={user.username}
+                subtitle={user.email}
+                src={user.avatar_url}
+              />
+            </TableCell>
+
+            <UserRoleCell
+              canEditUsers={canEditUsers}
+              allAvailableRoles={roles}
+              user={user}
+              oidcRoleSyncEnabled={oidcRoleSyncEnabled}
+              isLoading={Boolean(isUpdatingUserRoles)}
+              onUserRolesUpdate={onUpdateUserRoles}
+            />
+
+            <UserGroupsCell userGroups={groupsByUserId?.get(user.id)} />
+
+            <TableCell>
+              <LoginType authMethods={authMethods!} value={user.login_type} />
+            </TableCell>
+
+            <TableCell
+              css={[
+                styles.status,
+                user.status === "suspended" && styles.suspended,
+              ]}
+            >
+              <Box>{user.status}</Box>
+              <LastSeen value={user.last_seen_at} sx={{ fontSize: 12 }} />
+            </TableCell>
+
+            {canEditUsers && (
+              <TableCell>
+                <TableRowMenu
+                  data={user}
+                  menuItems={[
+                    // Return either suspend or activate depending on status
+                    user.status === "active" || user.status === "dormant"
+                      ? {
+                          label: <>Suspend&hellip;</>,
+                          onClick: onSuspendUser,
+                          disabled: false,
+                        }
+                      : {
+                          label: <>Activate&hellip;</>,
+                          onClick: onActivateUser,
+                          disabled: false,
+                        },
+                    {
+                      label: <>Delete&hellip;</>,
+                      onClick: onDeleteUser,
+                      disabled: user.id === actorID,
+                    },
+                    {
+                      label: <>Reset password&hellip;</>,
+                      onClick: onResetUserPassword,
+                      disabled: user.login_type !== "password",
+                    },
+                    {
+                      label: "View workspaces",
+                      onClick: onListWorkspaces,
+                      disabled: false,
+                    },
+                    {
+                      label: (
+                        <>
+                          View activity
+                          {!canViewActivity && <EnterpriseBadge />}
+                        </>
+                      ),
+                      onClick: onViewActivity,
+                      disabled: !canViewActivity,
+                    },
+                  ]}
+                />
+              </TableCell>
+            )}
+          </TableRow>
+        ))}
+      </Cond>
+    </ChooseOne>
+  );
+};
+
+const LoginType = ({
+  authMethods,
+  value,
+}: {
+  authMethods: TypesGen.AuthMethods;
+  value: TypesGen.LoginType;
+}) => {
+  let displayName: string = value;
+  let icon = <></>;
+  const iconStyles = { width: 14, height: 14 };
+
+  if (value === "password") {
+    displayName = "Password";
+    icon = <PasswordOutlined sx={iconStyles} />;
+  } else if (value === "none") {
+    displayName = "None";
+    icon = <HideSourceOutlined sx={iconStyles} />;
+  } else if (value === "github") {
+    displayName = "GitHub";
+    icon = <GitHub sx={iconStyles} />;
+  } else if (value === "token") {
+    displayName = "Token";
+    icon = <KeyOutlined sx={iconStyles} />;
+  } else if (value === "oidc") {
+    displayName =
+      authMethods.oidc.signInText === "" ? "OIDC" : authMethods.oidc.signInText;
+    icon =
+      authMethods.oidc.iconUrl === "" ? (
+        <ShieldOutlined sx={iconStyles} />
+      ) : (
+        <Box
+          component="img"
+          alt="Open ID Connect icon"
+          src={authMethods.oidc.iconUrl}
+          sx={iconStyles}
+        />
+      );
+  }
+
+  return (
+    <Box sx={{ display: "flex", alignItems: "center", gap: 1, fontSize: 14 }}>
+      {icon}
+      {displayName}
+    </Box>
+  );
+};
+
+const styles = {
+  status: {
+    textTransform: "capitalize",
+  },
+  suspended: (theme) => ({
+    color: theme.palette.text.secondary,
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPage.test.tsx b/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPage.test.tsx
index 42554fc513b00..7ec9d8f25595d 100644
--- a/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPage.test.tsx
+++ b/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPage.test.tsx
@@ -1,37 +1,37 @@
-import { screen, waitFor } from "@testing-library/react"
-import WS from "jest-websocket-mock"
-import { renderWithAuth } from "../../testHelpers/renderHelpers"
-import { WorkspaceBuildPage } from "./WorkspaceBuildPage"
-import { MockWorkspace, MockWorkspaceBuild } from "testHelpers/entities"
-import * as API from "api/api"
+import { screen, waitFor } from "@testing-library/react";
+import WS from "jest-websocket-mock";
+import { renderWithAuth } from "testHelpers/renderHelpers";
+import { WorkspaceBuildPage } from "./WorkspaceBuildPage";
+import { MockWorkspace, MockWorkspaceBuild } from "testHelpers/entities";
+import * as API from "api/api";
 
 afterEach(() => {
-  WS.clean()
-})
+  WS.clean();
+});
 
 describe("WorkspaceBuildPage", () => {
   test("gets the right workspace build", async () => {
     const getWorkspaceBuildSpy = jest
       .spyOn(API, "getWorkspaceBuildByNumber")
-      .mockResolvedValue(MockWorkspaceBuild)
+      .mockResolvedValue(MockWorkspaceBuild);
     renderWithAuth(<WorkspaceBuildPage />, {
       route: `/@${MockWorkspace.owner_name}/${MockWorkspace.name}/builds/${MockWorkspace.latest_build.build_number}`,
       path: "/:username/:workspace/builds/:buildNumber",
-    })
+    });
     await waitFor(() =>
       expect(getWorkspaceBuildSpy).toBeCalledWith(
         MockWorkspace.owner_name,
         MockWorkspace.name,
-        `${MockWorkspaceBuild.build_number}`,
+        MockWorkspaceBuild.build_number,
       ),
-    )
-  })
+    );
+  });
 
   test("the mock server seamlessly handles JSON protocols", async () => {
-    const server = new WS("ws://localhost:1234", { jsonProtocol: true })
-    const client = new WebSocket("ws://localhost:1234")
+    const server = new WS("ws://localhost:1234", { jsonProtocol: true });
+    const client = new WebSocket("ws://localhost:1234");
 
-    await server.connected
+    await server.connected;
     const log = {
       id: "70459334-4878-4bda-a546-98eee166c4c6",
       created_at: "2022-05-19T16:46:02.283Z",
@@ -39,21 +39,21 @@ describe("WorkspaceBuildPage", () => {
       log_level: "info",
       stage: "Another stage",
       output: "",
-    }
-    client.send(JSON.stringify(log))
-    await expect(server).toReceiveMessage(log)
-    expect(server).toHaveReceivedMessages([log])
+    };
+    client.send(JSON.stringify(log));
+    await expect(server).toReceiveMessage(log);
+    expect(server).toHaveReceivedMessages([log]);
 
     client.onmessage = async () => {
       renderWithAuth(<WorkspaceBuildPage />, {
         route: `/@${MockWorkspace.owner_name}/${MockWorkspace.name}/builds/${MockWorkspace.latest_build.build_number}`,
         path: "/:username/:workspace/builds/:buildNumber",
-      })
+      });
 
-      await screen.findByText(MockWorkspaceBuild.workspace_name)
-      await screen.findByText(log.stage)
-    }
+      await screen.findByText(MockWorkspaceBuild.workspace_name);
+      await screen.findByText(log.stage);
+    };
 
-    server.close()
-  })
-})
+    server.close();
+  });
+});
diff --git a/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPage.tsx b/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPage.tsx
index 3cffeeff8456b..18264239e4d41 100644
--- a/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPage.tsx
+++ b/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPage.tsx
@@ -1,24 +1,38 @@
-import { useMachine } from "@xstate/react"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useParams } from "react-router-dom"
-import { pageTitle } from "../../utils/page"
-import { workspaceBuildMachine } from "../../xServices/workspaceBuild/workspaceBuildXService"
-import { WorkspaceBuildPageView } from "./WorkspaceBuildPageView"
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { useParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import { WorkspaceBuildPageView } from "./WorkspaceBuildPageView";
+import { useQuery } from "react-query";
+import { getWorkspaceBuilds } from "api/api";
+import dayjs from "dayjs";
+import { workspaceBuildByNumber } from "api/queries/workspaceBuilds";
+import { useWorkspaceBuildLogs } from "hooks/useWorkspaceBuildLogs";
 
 export const WorkspaceBuildPage: FC = () => {
   const params = useParams() as {
-    username: string
-    workspace: string
-    buildNumber: string
-  }
-  const workspaceName = params.workspace
-  const buildNumber = params.buildNumber
-  const username = params.username.replace("@", "")
-  const [buildState] = useMachine(workspaceBuildMachine, {
-    context: { username, workspaceName, buildNumber, timeCursor: new Date() },
-  })
-  const { logs, build } = buildState.context
+    username: string;
+    workspace: string;
+    buildNumber: string;
+  };
+  const workspaceName = params.workspace;
+  const buildNumber = Number(params.buildNumber);
+  const username = params.username.replace("@", "");
+  const wsBuildQuery = useQuery({
+    ...workspaceBuildByNumber(username, workspaceName, buildNumber),
+    keepPreviousData: true,
+  });
+  const build = wsBuildQuery.data;
+  const buildsQuery = useQuery({
+    queryKey: ["builds", username, build?.workspace_id],
+    queryFn: () => {
+      return getWorkspaceBuilds(build?.workspace_id ?? "", {
+        since: dayjs().add(-30, "day").toISOString(),
+      });
+    },
+    enabled: Boolean(build),
+  });
+  const logs = useWorkspaceBuildLogs(build?.id);
 
   return (
     <>
@@ -32,9 +46,14 @@ export const WorkspaceBuildPage: FC = () => {
         </title>
       </Helmet>
 
-      <WorkspaceBuildPageView logs={logs} build={build} />
+      <WorkspaceBuildPageView
+        logs={logs}
+        build={build}
+        builds={buildsQuery.data}
+        activeBuildNumber={buildNumber}
+      />
     </>
-  )
-}
+  );
+};
 
-export default WorkspaceBuildPage
+export default WorkspaceBuildPage;
diff --git a/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPageView.stories.tsx b/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPageView.stories.tsx
index bc397dc80ba1a..6be22af0c95b3 100644
--- a/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPageView.stories.tsx
+++ b/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPageView.stories.tsx
@@ -1,31 +1,48 @@
-import { ComponentMeta, Story } from "@storybook/react"
+import { Meta, StoryObj } from "@storybook/react";
 import {
   MockFailedWorkspaceBuild,
   MockWorkspaceBuild,
   MockWorkspaceBuildLogs,
-} from "../../testHelpers/entities"
-import {
-  WorkspaceBuildPageView,
-  WorkspaceBuildPageViewProps,
-} from "./WorkspaceBuildPageView"
+} from "testHelpers/entities";
+import { WorkspaceBuildPageView } from "./WorkspaceBuildPageView";
+
+const defaultBuilds = Array.from({ length: 15 }, (_, i) => ({
+  ...MockWorkspaceBuild,
+  id: `${i}`,
+  build_number: i,
+}));
 
-export default {
-  title: "pages/WorkspaceBuildPageView",
+const meta: Meta<typeof WorkspaceBuildPageView> = {
+  title: "pages/WorkspaceBuildPage",
   component: WorkspaceBuildPageView,
-} as ComponentMeta<typeof WorkspaceBuildPageView>
+  args: {
+    build: MockWorkspaceBuild,
+    logs: MockWorkspaceBuildLogs,
+    builds: defaultBuilds,
+    activeBuildNumber: defaultBuilds[0].build_number,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof WorkspaceBuildPageView>;
+
+export const Loaded: Story = {};
 
-const Template: Story<WorkspaceBuildPageViewProps> = (args) => (
-  <WorkspaceBuildPageView {...args} />
-)
+export const LoadingBuildLogs: Story = {
+  args: {
+    builds: undefined,
+  },
+};
 
-export const Example = Template.bind({})
-Example.args = {
-  build: MockWorkspaceBuild,
-  logs: MockWorkspaceBuildLogs,
-}
+const failedBuild = {
+  ...MockFailedWorkspaceBuild("delete"),
+  build_number: 123123123123,
+};
 
-export const FailedDelete = Template.bind({})
-FailedDelete.args = {
-  build: MockFailedWorkspaceBuild("delete"),
-  logs: MockWorkspaceBuildLogs,
-}
+export const FailedDelete: Story = {
+  args: {
+    build: failedBuild,
+    builds: [failedBuild, ...defaultBuilds],
+    activeBuildNumber: failedBuild.build_number,
+  },
+};
diff --git a/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPageView.tsx b/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPageView.tsx
index f2bf9905e6608..c764a30bb67a9 100644
--- a/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPageView.tsx
+++ b/site/src/pages/WorkspaceBuildPage/WorkspaceBuildPageView.tsx
@@ -1,60 +1,269 @@
-import { BuildAvatar } from "components/BuildsTable/BuildAvatar"
-import { FC } from "react"
-import { ProvisionerJobLog, WorkspaceBuild } from "../../api/typesGenerated"
-import { Loader } from "../../components/Loader/Loader"
-import { Margins } from "../../components/Margins/Margins"
+import { BuildAvatar } from "components/BuildAvatar/BuildAvatar";
+import { FC } from "react";
+import { ProvisionerJobLog, WorkspaceBuild } from "api/typesGenerated";
+import { Loader } from "components/Loader/Loader";
+import { Stack } from "components/Stack/Stack";
+import { WorkspaceBuildLogs } from "components/WorkspaceBuildLogs/WorkspaceBuildLogs";
+import { makeStyles } from "@mui/styles";
 import {
-  PageHeader,
-  PageHeaderSubtitle,
+  FullWidthPageHeader,
   PageHeaderTitle,
-} from "../../components/PageHeader/PageHeader"
-import { Stack } from "../../components/Stack/Stack"
-import { WorkspaceBuildLogs } from "../../components/WorkspaceBuildLogs/WorkspaceBuildLogs"
-import { WorkspaceBuildStats } from "../../components/WorkspaceBuildStats/WorkspaceBuildStats"
-import { WorkspaceBuildStateError } from "./WorkspaceBuildStateError"
+  PageHeaderSubtitle,
+} from "components/PageHeader/FullWidthPageHeader";
+import { Link } from "react-router-dom";
+import { Stats, StatsItem } from "components/Stats/Stats";
+import {
+  displayWorkspaceBuildDuration,
+  getDisplayWorkspaceBuildInitiatedBy,
+  getDisplayWorkspaceBuildStatus,
+} from "utils/workspace";
+import Box from "@mui/material/Box";
+import {
+  Sidebar,
+  SidebarCaption,
+  SidebarItem,
+} from "components/Sidebar/Sidebar";
+import { BuildIcon } from "components/BuildIcon/BuildIcon";
+import Skeleton from "@mui/material/Skeleton";
+import { Alert } from "components/Alert/Alert";
+import { DashboardFullPage } from "components/Dashboard/DashboardLayout";
 
 const sortLogsByCreatedAt = (logs: ProvisionerJobLog[]) => {
   return [...logs].sort(
     (a, b) =>
       new Date(a.created_at).getTime() - new Date(b.created_at).getTime(),
-  )
-}
+  );
+};
 
 export interface WorkspaceBuildPageViewProps {
-  logs: ProvisionerJobLog[] | undefined
-  build: WorkspaceBuild | undefined
+  logs: ProvisionerJobLog[] | undefined;
+  build: WorkspaceBuild | undefined;
+  builds: WorkspaceBuild[] | undefined;
+  activeBuildNumber: number;
 }
 
 export const WorkspaceBuildPageView: FC<WorkspaceBuildPageViewProps> = ({
   logs,
   build,
+  builds,
+  activeBuildNumber,
 }) => {
+  const styles = useStyles();
+
+  if (!build) {
+    return <Loader />;
+  }
+
   return (
-    <Margins>
-      {build && (
-        <PageHeader>
-          <Stack direction="row" alignItems="center" spacing={3}>
-            <BuildAvatar build={build} size="xl" />
-            <div>
-              <PageHeaderTitle>Build #{build.build_number}</PageHeaderTitle>
-              <PageHeaderSubtitle condensed>
-                {build.initiator_name}
-              </PageHeaderSubtitle>
-            </div>
-          </Stack>
-        </PageHeader>
-      )}
-
-      <Stack spacing={4}>
-        {build &&
-          build.transition === "delete" &&
-          build.job.status === "failed" && (
-            <WorkspaceBuildStateError build={build} />
+    <DashboardFullPage>
+      <FullWidthPageHeader sticky={false}>
+        <Stack direction="row" alignItems="center" spacing={3}>
+          <BuildAvatar build={build} />
+          <div>
+            <PageHeaderTitle>Build #{build.build_number}</PageHeaderTitle>
+            <PageHeaderSubtitle>{build.initiator_name}</PageHeaderSubtitle>
+          </div>
+        </Stack>
+
+        <Stats aria-label="Build details" className={styles.stats}>
+          <StatsItem
+            className={styles.statsItem}
+            label="Workspace"
+            value={
+              <Link
+                to={`/@${build.workspace_owner_name}/${build.workspace_name}`}
+              >
+                {build.workspace_name}
+              </Link>
+            }
+          />
+          <StatsItem
+            className={styles.statsItem}
+            label="Template version"
+            value={build.template_version_name}
+          />
+          <StatsItem
+            className={styles.statsItem}
+            label="Duration"
+            value={displayWorkspaceBuildDuration(build)}
+          />
+          <StatsItem
+            className={styles.statsItem}
+            label="Started at"
+            value={new Date(build.created_at).toLocaleString()}
+          />
+          <StatsItem
+            className={styles.statsItem}
+            label="Action"
+            value={
+              <Box component="span" sx={{ textTransform: "capitalize" }}>
+                {build.transition}
+              </Box>
+            }
+          />
+        </Stats>
+      </FullWidthPageHeader>
+
+      <Box
+        sx={{
+          display: "flex",
+          alignItems: "start",
+          overflow: "hidden",
+          flex: 1,
+          flexBasis: 0,
+        }}
+      >
+        <Sidebar>
+          <SidebarCaption>Builds</SidebarCaption>
+          {!builds &&
+            Array.from({ length: 15 }, (_, i) => (
+              <BuildSidebarItemSkeleton key={i} />
+            ))}
+
+          {builds?.map((build) => (
+            <BuildSidebarItem
+              key={build.id}
+              build={build}
+              active={build.build_number === activeBuildNumber}
+            />
+          ))}
+        </Sidebar>
+
+        <Box sx={{ height: "100%", overflowY: "auto", width: "100%" }}>
+          {build.transition === "delete" && build.job.status === "failed" && (
+            <Alert
+              severity="error"
+              sx={{
+                borderRadius: 0,
+                border: 0,
+                background: (theme) => theme.palette.error.dark,
+                borderBottom: (theme) => `1px solid ${theme.palette.divider}`,
+              }}
+            >
+              <Box>
+                The workspace may have failed to delete due to a Terraform state
+                mismatch. A template admin may run{" "}
+                <Box
+                  component="code"
+                  display="inline-block"
+                  width="fit-content"
+                  fontWeight={600}
+                >
+                  `
+                  {`coder rm ${
+                    build.workspace_owner_name + "/" + build.workspace_name
+                  } --orphan`}
+                  `
+                </Box>{" "}
+                to delete the workspace skipping resource destruction.
+              </Box>
+            </Alert>
           )}
-        {build && <WorkspaceBuildStats build={build} />}
-        {!logs && <Loader />}
-        {logs && <WorkspaceBuildLogs logs={sortLogsByCreatedAt(logs)} />}
-      </Stack>
-    </Margins>
-  )
-}
+          {logs ? (
+            <WorkspaceBuildLogs
+              sx={{ border: 0 }}
+              logs={sortLogsByCreatedAt(logs)}
+            />
+          ) : (
+            <Loader />
+          )}
+        </Box>
+      </Box>
+    </DashboardFullPage>
+  );
+};
+
+const BuildSidebarItem = ({
+  build,
+  active,
+}: {
+  build: WorkspaceBuild;
+  active: boolean;
+}) => {
+  return (
+    <Link
+      key={build.id}
+      to={`/@${build.workspace_owner_name}/${build.workspace_name}/builds/${build.build_number}`}
+    >
+      <SidebarItem active={active}>
+        <Box sx={{ display: "flex", alignItems: "start", gap: 1 }}>
+          <BuildIcon
+            transition={build.transition}
+            sx={{
+              width: 16,
+              height: 16,
+              color: (theme) =>
+                theme.palette[getDisplayWorkspaceBuildStatus(theme, build).type]
+                  .light,
+            }}
+          />
+          <Box sx={{ overflow: "hidden" }}>
+            <Box
+              sx={{
+                textTransform: "capitalize",
+                color: (theme) => theme.palette.text.primary,
+                textOverflow: "ellipsis",
+                overflow: "hidden",
+                whiteSpace: "nowrap",
+              }}
+            >
+              {build.transition} by{" "}
+              <strong>{getDisplayWorkspaceBuildInitiatedBy(build)}</strong>
+            </Box>
+            <Box
+              sx={{
+                fontSize: 12,
+                color: (theme) => theme.palette.text.secondary,
+                mt: 0.25,
+              }}
+            >
+              {displayWorkspaceBuildDuration(build)}
+            </Box>
+          </Box>
+        </Box>
+      </SidebarItem>
+    </Link>
+  );
+};
+
+const BuildSidebarItemSkeleton = () => {
+  return (
+    <SidebarItem>
+      <Box sx={{ display: "flex", alignItems: "start", gap: 1 }}>
+        <Skeleton variant="circular" width={16} height={16} />
+        <Box>
+          <Skeleton variant="text" width={94} height={16} />
+          <Skeleton variant="text" width={60} height={14} sx={{ mt: 0.25 }} />
+        </Box>
+      </Box>
+    </SidebarItem>
+  );
+};
+
+const useStyles = makeStyles((theme) => ({
+  stats: {
+    padding: 0,
+    border: 0,
+    gap: theme.spacing(6),
+    rowGap: theme.spacing(3),
+    flex: 1,
+
+    [theme.breakpoints.down("md")]: {
+      display: "flex",
+      flexDirection: "column",
+      alignItems: "flex-start",
+      gap: theme.spacing(1),
+    },
+  },
+
+  statsItem: {
+    flexDirection: "column",
+    gap: 0,
+    padding: 0,
+
+    "& > span:first-of-type": {
+      fontSize: 12,
+      fontWeight: 500,
+    },
+  },
+}));
diff --git a/site/src/pages/WorkspaceBuildPage/WorkspaceBuildStateError.tsx b/site/src/pages/WorkspaceBuildPage/WorkspaceBuildStateError.tsx
deleted file mode 100644
index 1a654a3f6715b..0000000000000
--- a/site/src/pages/WorkspaceBuildPage/WorkspaceBuildStateError.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-import Box from "@mui/material/Box"
-import { WorkspaceBuild } from "api/typesGenerated"
-import { Alert } from "components/Alert/Alert"
-
-const Language = {
-  stateMessage:
-    "The workspace may have failed to delete due to a Terraform state mismatch.",
-}
-
-export interface WorkspaceBuildStateErrorProps {
-  build: WorkspaceBuild
-}
-
-export const WorkspaceBuildStateError: React.FC<
-  WorkspaceBuildStateErrorProps
-> = ({ build }) => {
-  const orphanCommand = `coder rm ${
-    build.workspace_owner_name + "/" + build.workspace_name
-  } --orphan`
-  return (
-    <Alert severity="error">
-      <Box>
-        {Language.stateMessage} A template admin may run{" "}
-        <Box
-          component="code"
-          display="inline-block"
-          width="fit-content"
-          fontWeight={600}
-        >
-          `{orphanCommand}`
-        </Box>{" "}
-        to delete the workspace skipping resource destruction.
-      </Box>
-    </Alert>
-  )
-}
diff --git a/site/src/pages/WorkspacePage/BuildRow.tsx b/site/src/pages/WorkspacePage/BuildRow.tsx
new file mode 100644
index 0000000000000..693e1508dd5af
--- /dev/null
+++ b/site/src/pages/WorkspacePage/BuildRow.tsx
@@ -0,0 +1,115 @@
+import TableCell from "@mui/material/TableCell";
+import { type CSSObject, type Interpolation, type Theme } from "@emotion/react";
+import { useNavigate } from "react-router-dom";
+import type { WorkspaceBuild } from "api/typesGenerated";
+import { BuildAvatar } from "components/BuildAvatar/BuildAvatar";
+import { Stack } from "components/Stack/Stack";
+import { TimelineEntry } from "components/Timeline/TimelineEntry";
+import { useClickable } from "hooks/useClickable";
+import {
+  displayWorkspaceBuildDuration,
+  getDisplayWorkspaceBuildInitiatedBy,
+} from "utils/workspace";
+
+export interface BuildRowProps {
+  build: WorkspaceBuild;
+}
+
+const transitionMessages = {
+  start: "started",
+  stop: "stopped",
+  delete: "deleted",
+};
+
+export const BuildRow: React.FC<BuildRowProps> = ({ build }) => {
+  const initiatedBy = getDisplayWorkspaceBuildInitiatedBy(build);
+  const navigate = useNavigate();
+  const clickableProps = useClickable<HTMLTableRowElement>(() =>
+    navigate(`builds/${build.build_number}`),
+  );
+
+  return (
+    <TimelineEntry hover data-testid={`build-${build.id}`} {...clickableProps}>
+      <TableCell css={styles.buildCell}>
+        <Stack direction="row" alignItems="center" css={styles.buildWrapper}>
+          <Stack direction="row" alignItems="center" css={styles.fullWidth}>
+            <BuildAvatar build={build} />
+            <Stack
+              direction="row"
+              justifyContent="space-between"
+              alignItems="center"
+              css={styles.fullWidth}
+            >
+              <Stack
+                css={styles.buildSummary}
+                direction="row"
+                alignItems="center"
+                spacing={1}
+              >
+                <span>
+                  <strong>{initiatedBy}</strong>{" "}
+                  {build.reason !== "initiator" ? "automatically " : ""}
+                  <strong>{transitionMessages[build.transition]}</strong> the
+                  workspace
+                </span>
+
+                <span css={styles.buildTime}>
+                  {new Date(build.created_at).toLocaleTimeString()}
+                </span>
+              </Stack>
+
+              <Stack direction="row" spacing={1}>
+                <span css={styles.buildInfo}>
+                  Reason: <strong>{build.reason}</strong>
+                </span>
+
+                <span css={styles.buildInfo}>
+                  Duration:{" "}
+                  <strong>{displayWorkspaceBuildDuration(build)}</strong>
+                </span>
+
+                <span css={styles.buildInfo}>
+                  Version: <strong>{build.template_version_name}</strong>
+                </span>
+              </Stack>
+            </Stack>
+          </Stack>
+        </Stack>
+      </TableCell>
+    </TimelineEntry>
+  );
+};
+
+const styles = {
+  buildWrapper: (theme) => ({
+    padding: theme.spacing(2, 4),
+  }),
+
+  buildCell: {
+    padding: "0 !important",
+    position: "relative",
+    borderBottom: 0,
+  },
+
+  buildSummary: (theme) => ({
+    ...(theme.typography.body1 as CSSObject),
+    fontFamily: "inherit",
+  }),
+
+  buildInfo: (theme) => ({
+    ...(theme.typography.body2 as CSSObject),
+    fontSize: 12,
+    fontFamily: "inherit",
+    color: theme.palette.text.secondary,
+    display: "block",
+  }),
+
+  buildTime: (theme) => ({
+    color: theme.palette.text.secondary,
+    fontSize: 12,
+  }),
+
+  fullWidth: {
+    width: "100%",
+  },
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/pages/WorkspacePage/BuildsTable.stories.tsx b/site/src/pages/WorkspacePage/BuildsTable.stories.tsx
new file mode 100644
index 0000000000000..7a86c78faf970
--- /dev/null
+++ b/site/src/pages/WorkspacePage/BuildsTable.stories.tsx
@@ -0,0 +1,31 @@
+import { Meta, StoryObj } from "@storybook/react";
+import { MockBuilds } from "testHelpers/entities";
+import { BuildsTable } from "./BuildsTable";
+
+const meta: Meta<typeof BuildsTable> = {
+  title: "pages/WorkspacePage/BuildsTable",
+  component: BuildsTable,
+};
+
+export default meta;
+type Story = StoryObj<typeof BuildsTable>;
+
+export const Example: Story = {
+  args: {
+    builds: MockBuilds,
+    hasMoreBuilds: true,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    builds: [],
+  },
+};
+
+export const NoMoreBuilds: Story = {
+  args: {
+    builds: MockBuilds,
+    hasMoreBuilds: false,
+  },
+};
diff --git a/site/src/pages/WorkspacePage/BuildsTable.tsx b/site/src/pages/WorkspacePage/BuildsTable.tsx
new file mode 100644
index 0000000000000..2cf4dd5524d34
--- /dev/null
+++ b/site/src/pages/WorkspacePage/BuildsTable.tsx
@@ -0,0 +1,80 @@
+import Box from "@mui/material/Box";
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableRow from "@mui/material/TableRow";
+import { Timeline } from "components/Timeline/Timeline";
+import { FC } from "react";
+import * as TypesGen from "api/typesGenerated";
+import { EmptyState } from "components/EmptyState/EmptyState";
+import { TableLoader } from "components/TableLoader/TableLoader";
+import { BuildRow } from "./BuildRow";
+import { Stack } from "components/Stack/Stack";
+import LoadingButton from "@mui/lab/LoadingButton";
+import ArrowDownwardOutlined from "@mui/icons-material/ArrowDownwardOutlined";
+
+export const Language = {
+  emptyMessage: "No builds found",
+};
+
+export interface BuildsTableProps {
+  builds: TypesGen.WorkspaceBuild[] | undefined;
+  onLoadMoreBuilds: () => void;
+  isLoadingMoreBuilds: boolean;
+  hasMoreBuilds: boolean;
+}
+
+export const BuildsTable: FC<React.PropsWithChildren<BuildsTableProps>> = ({
+  builds,
+  onLoadMoreBuilds,
+  isLoadingMoreBuilds,
+  hasMoreBuilds,
+}) => {
+  return (
+    <Stack>
+      <TableContainer>
+        <Table data-testid="builds-table" aria-describedby="builds table">
+          <TableBody>
+            {builds ? (
+              <Timeline
+                items={builds}
+                getDate={(build) => new Date(build.created_at)}
+                row={(build) => <BuildRow key={build.id} build={build} />}
+              />
+            ) : (
+              <TableLoader />
+            )}
+
+            {builds && builds.length === 0 && (
+              <TableRow>
+                <TableCell colSpan={999}>
+                  <Box p={4}>
+                    <EmptyState message={Language.emptyMessage} />
+                  </Box>
+                </TableCell>
+              </TableRow>
+            )}
+          </TableBody>
+        </Table>
+      </TableContainer>
+      {hasMoreBuilds && (
+        <LoadingButton
+          onClick={onLoadMoreBuilds}
+          loading={isLoadingMoreBuilds}
+          loadingPosition="start"
+          variant="outlined"
+          color="neutral"
+          startIcon={<ArrowDownwardOutlined />}
+          css={{
+            display: "inline-flex",
+            margin: "auto",
+            borderRadius: "9999px",
+          }}
+        >
+          Load previous builds
+        </LoadingButton>
+      )}
+    </Stack>
+  );
+};
diff --git a/site/src/pages/WorkspacePage/ChangeVersionDialog.tsx b/site/src/pages/WorkspacePage/ChangeVersionDialog.tsx
index d4d170fe4ec3a..a3fa053364fc0 100644
--- a/site/src/pages/WorkspacePage/ChangeVersionDialog.tsx
+++ b/site/src/pages/WorkspacePage/ChangeVersionDialog.tsx
@@ -1,26 +1,31 @@
-import { DialogProps } from "components/Dialogs/Dialog"
-import { FC, useRef, useState } from "react"
-import { FormFields } from "components/Form/Form"
-import TextField from "@mui/material/TextField"
-import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog"
-import { Stack } from "components/Stack/Stack"
-import { Template, TemplateVersion } from "api/typesGenerated"
-import { Loader } from "components/Loader/Loader"
-import Autocomplete from "@mui/material/Autocomplete"
-import { createDayString } from "utils/createDayString"
-import { AvatarData } from "components/AvatarData/AvatarData"
-import { Pill } from "components/Pill/Pill"
-import { Avatar } from "components/Avatar/Avatar"
-import CircularProgress from "@mui/material/CircularProgress"
-import Box from "@mui/material/Box"
+import { type FC, useRef, useState } from "react";
+import TextField from "@mui/material/TextField";
+import Autocomplete from "@mui/material/Autocomplete";
+import CircularProgress from "@mui/material/CircularProgress";
+import Box from "@mui/material/Box";
+import AlertTitle from "@mui/material/AlertTitle";
+import InfoIcon from "@mui/icons-material/InfoOutlined";
+import { css } from "@emotion/css";
+import { useTheme } from "@emotion/react";
+import type { Template, TemplateVersion } from "api/typesGenerated";
+import { Alert, AlertDetail } from "components/Alert/Alert";
+import type { DialogProps } from "components/Dialogs/Dialog";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import { FormFields } from "components/Form/Form";
+import { Stack } from "components/Stack/Stack";
+import { Loader } from "components/Loader/Loader";
+import { AvatarData } from "components/AvatarData/AvatarData";
+import { Pill } from "components/Pill/Pill";
+import { Avatar } from "components/Avatar/Avatar";
+import { createDayString } from "utils/createDayString";
 
 export type ChangeVersionDialogProps = DialogProps & {
-  template: Template | undefined
-  templateVersions: TemplateVersion[] | undefined
-  defaultTemplateVersion: TemplateVersion | undefined
-  onClose: () => void
-  onConfirm: (templateVersion: TemplateVersion) => void
-}
+  template: Template | undefined;
+  templateVersions: TemplateVersion[] | undefined;
+  defaultTemplateVersion: TemplateVersion | undefined;
+  onClose: () => void;
+  onConfirm: (templateVersion: TemplateVersion) => void;
+};
 
 export const ChangeVersionDialog: FC<ChangeVersionDialogProps> = ({
   onConfirm,
@@ -30,8 +35,10 @@ export const ChangeVersionDialog: FC<ChangeVersionDialogProps> = ({
   defaultTemplateVersion,
   ...dialogProps
 }) => {
-  const [isAutocompleteOpen, setIsAutocompleteOpen] = useState(false)
-  const selectedTemplateVersion = useRef<TemplateVersion | undefined>()
+  const [isAutocompleteOpen, setIsAutocompleteOpen] = useState(false);
+  const selectedTemplateVersion = useRef<TemplateVersion | undefined>();
+  const version = selectedTemplateVersion.current;
+  const theme = useTheme();
 
   return (
     <ConfirmDialog
@@ -39,7 +46,7 @@ export const ChangeVersionDialog: FC<ChangeVersionDialogProps> = ({
       onClose={onClose}
       onConfirm={() => {
         if (selectedTemplateVersion.current) {
-          onConfirm(selectedTemplateVersion.current)
+          onConfirm(selectedTemplateVersion.current);
         }
       }}
       hideCancel={false}
@@ -51,81 +58,111 @@ export const ChangeVersionDialog: FC<ChangeVersionDialogProps> = ({
         <Stack>
           <p>You are about to change the version of this workspace.</p>
           {templateVersions ? (
-            <FormFields>
-              <Autocomplete
-                disableClearable
-                options={templateVersions}
-                defaultValue={defaultTemplateVersion}
-                id="template-version-autocomplete"
-                open={isAutocompleteOpen}
-                onChange={(_, newTemplateVersion) => {
-                  selectedTemplateVersion.current =
-                    newTemplateVersion ?? undefined
-                }}
-                onOpen={() => {
-                  setIsAutocompleteOpen(true)
-                }}
-                onClose={() => {
-                  setIsAutocompleteOpen(false)
-                }}
-                isOptionEqualToValue={(
-                  option: TemplateVersion,
-                  value: TemplateVersion,
-                ) => option.id === value.id}
-                getOptionLabel={(option) => option.name}
-                renderOption={(props, option: TemplateVersion) => (
-                  <Box component="li" {...props}>
-                    <AvatarData
-                      avatar={
-                        <Avatar src={option.created_by.avatar_url}>
-                          {option.name}
-                        </Avatar>
-                      }
-                      title={
-                        <Stack
-                          direction="row"
-                          justifyContent="space-between"
-                          style={{ width: "100%" }}
-                        >
-                          {option.name}
-                          {template?.active_version_id === option.id && (
-                            <Pill text="Active" type="success" />
-                          )}
-                        </Stack>
-                      }
-                      subtitle={createDayString(option.created_at)}
-                    />
-                  </Box>
-                )}
-                renderInput={(params) => (
-                  <>
-                    {/* eslint-disable-next-line @typescript-eslint/ban-ts-comment -- Need it */}
-                    {/* @ts-ignore -- Issue from lib https://github.com/i18next/react-i18next/issues/1543 */}
-                    <TextField
-                      {...params}
-                      fullWidth
-                      placeholder="Template version name"
-                      InputProps={{
-                        ...params.InputProps,
-                        endAdornment: (
-                          <>
-                            {!templateVersions ? (
-                              <CircularProgress size={16} />
-                            ) : null}
-                            {params.InputProps.endAdornment}
-                          </>
-                        ),
-                      }}
-                    />
-                  </>
-                )}
-              />
-            </FormFields>
+            <>
+              <FormFields>
+                <Autocomplete
+                  disableClearable
+                  options={templateVersions}
+                  defaultValue={defaultTemplateVersion}
+                  id="template-version-autocomplete"
+                  open={isAutocompleteOpen}
+                  onChange={(_, newTemplateVersion) => {
+                    selectedTemplateVersion.current =
+                      newTemplateVersion ?? undefined;
+                  }}
+                  onOpen={() => {
+                    setIsAutocompleteOpen(true);
+                  }}
+                  onClose={() => {
+                    setIsAutocompleteOpen(false);
+                  }}
+                  isOptionEqualToValue={(
+                    option: TemplateVersion,
+                    value: TemplateVersion,
+                  ) => option.id === value.id}
+                  getOptionLabel={(option) => option.name}
+                  renderOption={(props, option: TemplateVersion) => (
+                    <Box component="li" {...props}>
+                      <AvatarData
+                        avatar={
+                          <Avatar src={option.created_by.avatar_url}>
+                            {option.name}
+                          </Avatar>
+                        }
+                        title={
+                          <Stack
+                            direction="row"
+                            justifyContent="space-between"
+                            style={{ width: "100%" }}
+                          >
+                            <Stack
+                              direction="row"
+                              alignItems="center"
+                              spacing={1}
+                            >
+                              {option.name}
+                              {option.message && (
+                                <InfoIcon
+                                  sx={(theme) => ({
+                                    width: theme.spacing(1.5),
+                                    height: theme.spacing(1.5),
+                                  })}
+                                />
+                              )}
+                            </Stack>
+                            {template?.active_version_id === option.id && (
+                              <Pill text="Active" type="success" />
+                            )}
+                          </Stack>
+                        }
+                        subtitle={createDayString(option.created_at)}
+                      />
+                    </Box>
+                  )}
+                  renderInput={(params) => (
+                    <>
+                      <TextField
+                        {...params}
+                        fullWidth
+                        placeholder="Template version name"
+                        InputProps={{
+                          ...params.InputProps,
+                          endAdornment: (
+                            <>
+                              {!templateVersions ? (
+                                <CircularProgress size={16} />
+                              ) : null}
+                              {params.InputProps.endAdornment}
+                            </>
+                          ),
+                          classes: {
+                            // Same `padding-left` as input
+                            root: css`
+                              padding-left: ${theme.spacing(1.75)} !important;
+                            `,
+                          },
+                        }}
+                      />
+                    </>
+                  )}
+                />
+              </FormFields>
+              {version && (
+                <Alert severity="info">
+                  <AlertTitle>
+                    Published by {version.created_by.username}
+                  </AlertTitle>
+                  {version.message && (
+                    <AlertDetail>{version.message}</AlertDetail>
+                  )}
+                </Alert>
+              )}
+            </>
           ) : (
             <Loader />
           )}
         </Stack>
       }
     />
-  )
-}
+  );
+};
diff --git a/site/src/pages/WorkspacePage/UpdateBuildParametersDialog.tsx b/site/src/pages/WorkspacePage/UpdateBuildParametersDialog.tsx
index 33d42b6bc5ae2..f91f807ac8a17 100644
--- a/site/src/pages/WorkspacePage/UpdateBuildParametersDialog.tsx
+++ b/site/src/pages/WorkspacePage/UpdateBuildParametersDialog.tsx
@@ -1,56 +1,51 @@
-import { makeStyles } from "@mui/styles"
-import Dialog from "@mui/material/Dialog"
-import DialogContent from "@mui/material/DialogContent"
-import DialogContentText from "@mui/material/DialogContentText"
-import DialogTitle from "@mui/material/DialogTitle"
-import { DialogProps } from "components/Dialogs/Dialog"
-import { FC } from "react"
-import { getFormHelpers } from "utils/formUtils"
-import { FormFields, VerticalForm } from "components/Form/Form"
-import {
+import Dialog from "@mui/material/Dialog";
+import DialogContent from "@mui/material/DialogContent";
+import DialogContentText from "@mui/material/DialogContentText";
+import DialogTitle from "@mui/material/DialogTitle";
+import DialogActions from "@mui/material/DialogActions";
+import Button from "@mui/material/Button";
+import { useFormik } from "formik";
+import * as Yup from "yup";
+import { type FC } from "react";
+import { css } from "@emotion/css";
+import { type Interpolation, type Theme, useTheme } from "@emotion/react";
+import { getFormHelpers } from "utils/formUtils";
+import type { DialogProps } from "components/Dialogs/Dialog";
+import { FormFields, VerticalForm } from "components/Form/Form";
+import type {
   TemplateVersionParameter,
   WorkspaceBuildParameter,
-} from "api/typesGenerated"
-import { RichParameterInput } from "components/RichParameterInput/RichParameterInput"
-import { useFormik } from "formik"
+} from "api/typesGenerated";
+import { RichParameterInput } from "components/RichParameterInput/RichParameterInput";
 import {
-  selectInitialRichParametersValues,
+  getInitialRichParameterValues,
   useValidationSchemaForRichParameters,
-  workspaceBuildParameterValue,
-} from "utils/richParameters"
-import * as Yup from "yup"
-import DialogActions from "@mui/material/DialogActions"
-import Button from "@mui/material/Button"
-import { useTranslation } from "react-i18next"
+} from "utils/richParameters";
 
 export type UpdateBuildParametersDialogProps = DialogProps & {
-  onClose: () => void
-  onUpdate: (buildParameters: WorkspaceBuildParameter[]) => void
-  missedParameters?: TemplateVersionParameter[]
-}
+  onClose: () => void;
+  onUpdate: (buildParameters: WorkspaceBuildParameter[]) => void;
+  missedParameters: TemplateVersionParameter[];
+};
 
 export const UpdateBuildParametersDialog: FC<
   UpdateBuildParametersDialogProps
 > = ({ missedParameters, onUpdate, ...dialogProps }) => {
-  const styles = useStyles()
-  const initialRichParameterValues =
-    selectInitialRichParametersValues(missedParameters)
+  const theme = useTheme();
   const form = useFormik({
     initialValues: {
-      rich_parameter_values: initialRichParameterValues,
+      rich_parameter_values: getInitialRichParameterValues(missedParameters),
     },
     validationSchema: Yup.object({
-      rich_parameter_values: useValidationSchemaForRichParameters(
-        "createWorkspacePage",
-        missedParameters,
-      ),
+      rich_parameter_values:
+        useValidationSchemaForRichParameters(missedParameters),
     }),
     onSubmit: (values) => {
-      onUpdate(values.rich_parameter_values)
+      onUpdate(values.rich_parameter_values);
     },
-  })
-  const getFieldHelpers = getFormHelpers(form)
-  const { t } = useTranslation("workspacePage")
+    enableReinitialize: true,
+  });
+  const getFieldHelpers = getFormHelpers(form);
 
   return (
     <Dialog
@@ -62,16 +57,26 @@ export const UpdateBuildParametersDialog: FC<
     >
       <DialogTitle
         id="update-build-parameters-title"
-        classes={{ root: styles.title }}
+        classes={{
+          root: css`
+            padding: ${theme.spacing(3, 5)};
+
+            & h2 {
+              font-size: ${theme.spacing(2.5)};
+              font-weight: 400;
+            }
+          `,
+        }}
       >
         Workspace parameters
       </DialogTitle>
-      <DialogContent className={styles.content}>
-        <DialogContentText className={styles.info}>
-          {t("askParametersDialog.message")}
+      <DialogContent css={styles.content}>
+        <DialogContentText css={{ margin: 0 }}>
+          This template has new parameters that must be configured to complete
+          the update
         </DialogContentText>
         <VerticalForm
-          className={styles.form}
+          css={styles.form}
           onSubmit={form.handleSubmit}
           id="updateParameters"
         >
@@ -83,13 +88,8 @@ export const UpdateBuildParametersDialog: FC<
                     {...getFieldHelpers(
                       "rich_parameter_values[" + index + "].value",
                     )}
-                    initialValue={workspaceBuildParameterValue(
-                      initialRichParameterValues,
-                      parameter,
-                    )}
                     key={parameter.name}
                     parameter={parameter}
-                    index={index}
                     onChange={async (value) => {
                       await form.setFieldValue(
                         "rich_parameter_values." + index,
@@ -97,69 +97,45 @@ export const UpdateBuildParametersDialog: FC<
                           name: parameter.name,
                           value: value,
                         },
-                      )
+                      );
                     }}
                   />
-                )
+                );
               })}
             </FormFields>
           )}
         </VerticalForm>
       </DialogContent>
-      <DialogActions disableSpacing className={styles.dialogActions}>
+      <DialogActions disableSpacing css={styles.dialogActions}>
         <Button fullWidth type="button" onClick={dialogProps.onClose}>
           Cancel
         </Button>
-        <Button color="primary" fullWidth type="submit" form="updateParameters">
+        <Button
+          color="primary"
+          fullWidth
+          type="submit"
+          form="updateParameters"
+          data-testid="form-submit"
+        >
           Update
         </Button>
       </DialogActions>
     </Dialog>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  title: {
-    padding: theme.spacing(3, 5),
-
-    "& h2": {
-      fontSize: theme.spacing(2.5),
-      fontWeight: 400,
-    },
-  },
+  );
+};
 
-  content: {
+const styles = {
+  content: (theme) => ({
     padding: theme.spacing(0, 5, 0, 5),
-  },
+  }),
 
-  info: {
-    margin: 0,
-  },
-
-  form: {
+  form: (theme) => ({
     paddingTop: theme.spacing(4),
-  },
-
-  infoTitle: {
-    fontSize: theme.spacing(2),
-    fontWeight: 600,
-    display: "flex",
-    alignItems: "center",
-    gap: theme.spacing(1),
-  },
-
-  warningIcon: {
-    color: theme.palette.warning.light,
-    fontSize: theme.spacing(1.5),
-  },
-
-  formFooter: {
-    flexDirection: "column",
-  },
+  }),
 
-  dialogActions: {
+  dialogActions: (theme) => ({
     padding: theme.spacing(5),
     flexDirection: "column",
     gap: theme.spacing(1),
-  },
-}))
+  }),
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/components/Workspace/Workspace.stories.tsx b/site/src/pages/WorkspacePage/Workspace.stories.tsx
similarity index 95%
rename from site/src/components/Workspace/Workspace.stories.tsx
rename to site/src/pages/WorkspacePage/Workspace.stories.tsx
index 189eb8f87924f..d77bff78c5875 100644
--- a/site/src/components/Workspace/Workspace.stories.tsx
+++ b/site/src/pages/WorkspacePage/Workspace.stories.tsx
@@ -1,24 +1,23 @@
-import { action } from "@storybook/addon-actions"
-import { Meta, StoryObj } from "@storybook/react"
-import { WatchAgentMetadataContext } from "components/Resources/AgentMetadata"
-import { ProvisionerJobLog } from "api/typesGenerated"
-import * as Mocks from "testHelpers/entities"
-import { Workspace, WorkspaceErrors } from "./Workspace"
-import { withReactContext } from "storybook-react-context"
-import EventSource from "eventsourcemock"
-import { ProxyContext, getPreferredProxy } from "contexts/ProxyContext"
-import { DashboardProviderContext } from "components/Dashboard/DashboardProvider"
-import { WorkspaceBuildLogsSection } from "pages/WorkspacePage/WorkspaceBuildLogsSection"
+import { action } from "@storybook/addon-actions";
+import { Meta, StoryObj } from "@storybook/react";
+import { WatchAgentMetadataContext } from "components/Resources/AgentMetadata";
+import { ProvisionerJobLog } from "api/typesGenerated";
+import * as Mocks from "testHelpers/entities";
+import { Workspace, WorkspaceErrors } from "./Workspace";
+import { withReactContext } from "storybook-react-context";
+import EventSource from "eventsourcemock";
+import { ProxyContext, getPreferredProxy } from "contexts/ProxyContext";
+import { DashboardProviderContext } from "components/Dashboard/DashboardProvider";
+import { WorkspaceBuildLogsSection } from "pages/WorkspacePage/WorkspaceBuildLogsSection";
 
 const MockedAppearance = {
-  config: Mocks.MockAppearance,
-  preview: false,
-  setPreview: () => null,
-  save: () => null,
-}
+  config: Mocks.MockAppearanceConfig,
+  isPreview: false,
+  setPreview: () => {},
+};
 
 const meta: Meta<typeof Workspace> = {
-  title: "components/Workspace",
+  title: "pages/WorkspacePage/Workspace",
   component: Workspace,
   decorators: [
     (Story) => (
@@ -38,13 +37,13 @@ const meta: Meta<typeof Workspace> = {
             isLoading: false,
             isFetched: true,
             clearProxy: () => {
-              return
+              return;
             },
             setProxy: () => {
-              return
+              return;
             },
             refetchProxyLatencies: (): Date => {
-              return new Date()
+              return new Date();
             },
           }}
         >
@@ -56,13 +55,14 @@ const meta: Meta<typeof Workspace> = {
       Context: WatchAgentMetadataContext,
       initialState: (_: string): EventSource => {
         // Need Bruno's help here.
-        return new EventSource()
+        return new EventSource();
       },
     }),
   ],
-}
-export default meta
-type Story = StoryObj<typeof Workspace>
+};
+
+export default meta;
+type Story = StoryObj<typeof Workspace>;
 
 export const Running: Story = {
   args: {
@@ -80,9 +80,10 @@ export const Running: Story = {
     handleStart: action("start"),
     handleStop: action("stop"),
     resources: [
-      Mocks.MockWorkspaceResource,
-      Mocks.MockWorkspaceResource2,
-      Mocks.MockWorkspaceResource3,
+      Mocks.MockWorkspaceResourceMultipleAgents,
+      Mocks.MockWorkspaceVolumeResource,
+      Mocks.MockWorkspaceImageResource,
+      Mocks.MockWorkspaceContainerResource,
     ],
     builds: [Mocks.MockWorkspaceBuild],
     canUpdateWorkspace: true,
@@ -90,42 +91,42 @@ export const Running: Story = {
     buildInfo: Mocks.MockBuildInfo,
     template: Mocks.MockTemplate,
   },
-}
+};
 
 export const WithoutUpdateAccess: Story = {
   args: {
     ...Running.args,
     canUpdateWorkspace: false,
   },
-}
+};
 
 export const PendingInQueue: Story = {
   args: {
     ...Running.args,
     workspace: Mocks.MockPendingWorkspace,
   },
-}
+};
 
 export const Starting: Story = {
   args: {
     ...Running.args,
     workspace: Mocks.MockStartingWorkspace,
   },
-}
+};
 
 export const Stopped: Story = {
   args: {
     ...Running.args,
     workspace: Mocks.MockStoppedWorkspace,
   },
-}
+};
 
 export const Stopping: Story = {
   args: {
     ...Running.args,
     workspace: Mocks.MockStoppingWorkspace,
   },
-}
+};
 
 export const Failed: Story = {
   args: {
@@ -137,7 +138,7 @@ export const Failed: Story = {
       }),
     },
   },
-}
+};
 
 export const FailedWithLogs: Story = {
   args: {
@@ -155,7 +156,7 @@ export const FailedWithLogs: Story = {
     },
     buildLogs: <WorkspaceBuildLogsSection logs={makeFailedBuildLogs()} />,
   },
-}
+};
 
 export const FailedWithRetry: Story = {
   args: {
@@ -174,42 +175,42 @@ export const FailedWithRetry: Story = {
     canRetryDebugMode: true,
     buildLogs: <WorkspaceBuildLogsSection logs={makeFailedBuildLogs()} />,
   },
-}
+};
 
 export const Deleting: Story = {
   args: {
     ...Running.args,
     workspace: Mocks.MockDeletingWorkspace,
   },
-}
+};
 
 export const Deleted: Story = {
   args: {
     ...Running.args,
     workspace: Mocks.MockDeletedWorkspace,
   },
-}
+};
 
 export const Canceling: Story = {
   args: {
     ...Running.args,
     workspace: Mocks.MockCancelingWorkspace,
   },
-}
+};
 
 export const Canceled: Story = {
   args: {
     ...Running.args,
     workspace: Mocks.MockCanceledWorkspace,
   },
-}
+};
 
 export const Outdated: Story = {
   args: {
     ...Running.args,
     workspace: Mocks.MockOutdatedWorkspace,
   },
-}
+};
 
 export const GetBuildsError: Story = {
   args: {
@@ -220,7 +221,7 @@ export const GetBuildsError: Story = {
       }),
     },
   },
-}
+};
 
 export const CancellationError: Story = {
   args: {
@@ -232,7 +233,7 @@ export const CancellationError: Story = {
     },
     buildLogs: <WorkspaceBuildLogsSection logs={makeFailedBuildLogs()} />,
   },
-}
+};
 
 export const Unhealthy: Story = {
   args: {
@@ -246,7 +247,7 @@ export const Unhealthy: Story = {
       },
     },
   },
-}
+};
 
 function makeFailedBuildLogs(): ProvisionerJobLog[] {
   return [
@@ -736,7 +737,7 @@ function makeFailedBuildLogs(): ProvisionerJobLog[] {
       stage: "Cleaning Up",
       output: "",
     },
-  ]
+  ];
 }
 
 export const UnsupportedWorkspace: Story = {
@@ -744,4 +745,4 @@ export const UnsupportedWorkspace: Story = {
     ...Running.args,
     templateWarnings: ["UNSUPPORTED_WORKSPACES"],
   },
-}
+};
diff --git a/site/src/pages/WorkspacePage/Workspace.tsx b/site/src/pages/WorkspacePage/Workspace.tsx
new file mode 100644
index 0000000000000..7dbcd6cc0527a
--- /dev/null
+++ b/site/src/pages/WorkspacePage/Workspace.tsx
@@ -0,0 +1,380 @@
+import { type Interpolation, type Theme } from "@emotion/react";
+import Button from "@mui/material/Button";
+import AlertTitle from "@mui/material/AlertTitle";
+import { type FC, useEffect, useState } from "react";
+import { useNavigate } from "react-router-dom";
+import dayjs from "dayjs";
+import type * as TypesGen from "api/typesGenerated";
+import { Alert, AlertDetail } from "components/Alert/Alert";
+import { Margins } from "components/Margins/Margins";
+import { Resources } from "components/Resources/Resources";
+import { Stack } from "components/Stack/Stack";
+import {
+  FullWidthPageHeader,
+  PageHeaderActions,
+  PageHeaderTitle,
+  PageHeaderSubtitle,
+} from "components/PageHeader/FullWidthPageHeader";
+import { TemplateVersionWarnings } from "components/TemplateVersionWarnings/TemplateVersionWarnings";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { DormantWorkspaceBanner } from "components/WorkspaceDeletion";
+import { Avatar } from "components/Avatar/Avatar";
+import { AgentRow } from "components/Resources/AgentRow";
+import { useLocalStorage } from "hooks";
+import { WorkspaceActions } from "pages/WorkspacePage/WorkspaceActions/WorkspaceActions";
+import {
+  ActiveTransition,
+  WorkspaceBuildProgress,
+} from "./WorkspaceBuildProgress";
+import { BuildsTable } from "./BuildsTable";
+import { WorkspaceDeletedBanner } from "./WorkspaceDeletedBanner";
+import { WorkspaceStats } from "./WorkspaceStats";
+
+export enum WorkspaceErrors {
+  GET_BUILDS_ERROR = "getBuildsError",
+  BUILD_ERROR = "buildError",
+  CANCELLATION_ERROR = "cancellationError",
+}
+export interface WorkspaceProps {
+  scheduleProps: {
+    onDeadlinePlus: (hours: number) => void;
+    onDeadlineMinus: (hours: number) => void;
+    maxDeadlineIncrease: number;
+    maxDeadlineDecrease: number;
+  };
+  handleStart: (buildParameters?: TypesGen.WorkspaceBuildParameter[]) => void;
+  handleStop: () => void;
+  handleRestart: (buildParameters?: TypesGen.WorkspaceBuildParameter[]) => void;
+  handleDelete: () => void;
+  handleUpdate: () => void;
+  handleCancel: () => void;
+  handleSettings: () => void;
+  handleChangeVersion: () => void;
+  handleDormantActivate: () => void;
+  isUpdating: boolean;
+  isRestarting: boolean;
+  workspace: TypesGen.Workspace;
+  resources?: TypesGen.WorkspaceResource[];
+  templateWarnings?: TypesGen.TemplateVersionWarning[];
+  canUpdateWorkspace: boolean;
+  updateMessage?: string;
+  canRetryDebugMode: boolean;
+  canChangeVersions: boolean;
+  hideSSHButton?: boolean;
+  hideVSCodeDesktopButton?: boolean;
+  workspaceErrors: Partial<Record<WorkspaceErrors, unknown>>;
+  buildInfo?: TypesGen.BuildInfoResponse;
+  sshPrefix?: string;
+  template?: TypesGen.Template;
+  quotaBudget?: number;
+  handleBuildRetry: () => void;
+  buildLogs?: React.ReactNode;
+  builds: TypesGen.WorkspaceBuild[] | undefined;
+  onLoadMoreBuilds: () => void;
+  isLoadingMoreBuilds: boolean;
+  hasMoreBuilds: boolean;
+}
+
+/**
+ * Workspace is the top-level component for viewing an individual workspace
+ */
+export const Workspace: FC<React.PropsWithChildren<WorkspaceProps>> = ({
+  scheduleProps,
+  handleStart,
+  handleStop,
+  handleRestart,
+  handleDelete,
+  handleUpdate,
+  handleCancel,
+  handleSettings,
+  handleChangeVersion,
+  handleDormantActivate: handleDormantActivate,
+  workspace,
+  isUpdating,
+  isRestarting,
+  resources,
+  builds,
+  canUpdateWorkspace,
+  updateMessage,
+  canRetryDebugMode,
+  canChangeVersions,
+  workspaceErrors,
+  hideSSHButton,
+  hideVSCodeDesktopButton,
+  buildInfo,
+  sshPrefix,
+  template,
+  quotaBudget,
+  handleBuildRetry,
+  templateWarnings,
+  buildLogs,
+  onLoadMoreBuilds,
+  isLoadingMoreBuilds,
+  hasMoreBuilds,
+}) => {
+  const navigate = useNavigate();
+  const serverVersion = buildInfo?.version || "";
+  const { saveLocal, getLocal } = useLocalStorage();
+
+  const buildError = Boolean(workspaceErrors[WorkspaceErrors.BUILD_ERROR]) && (
+    <ErrorAlert
+      error={workspaceErrors[WorkspaceErrors.BUILD_ERROR]}
+      dismissible
+    />
+  );
+
+  const cancellationError = Boolean(
+    workspaceErrors[WorkspaceErrors.CANCELLATION_ERROR],
+  ) && (
+    <ErrorAlert
+      error={workspaceErrors[WorkspaceErrors.CANCELLATION_ERROR]}
+      dismissible
+    />
+  );
+
+  let transitionStats: TypesGen.TransitionStats | undefined = undefined;
+  if (template !== undefined) {
+    transitionStats = ActiveTransition(template, workspace);
+  }
+
+  const [showAlertPendingInQueue, setShowAlertPendingInQueue] = useState(false);
+  const now = dayjs();
+  useEffect(() => {
+    if (
+      workspace.latest_build.status !== "pending" ||
+      workspace.latest_build.job.queue_size === 0
+    ) {
+      if (!showAlertPendingInQueue) {
+        return;
+      }
+
+      const hideTimer = setTimeout(() => {
+        setShowAlertPendingInQueue(false);
+      }, 250);
+      return () => {
+        clearTimeout(hideTimer);
+      };
+    }
+
+    const t = Math.max(
+      0,
+      5000 - dayjs().diff(dayjs(workspace.latest_build.created_at)),
+    );
+    const showTimer = setTimeout(() => {
+      setShowAlertPendingInQueue(true);
+    }, t);
+
+    return () => {
+      clearTimeout(showTimer);
+    };
+  }, [workspace, now, showAlertPendingInQueue]);
+  return (
+    <>
+      <FullWidthPageHeader>
+        <Stack direction="row" spacing={3} alignItems="center">
+          <Avatar
+            size="md"
+            src={workspace.template_icon}
+            variant={workspace.template_icon ? "square" : undefined}
+            fitImage={Boolean(workspace.template_icon)}
+          >
+            {workspace.name}
+          </Avatar>
+          <div>
+            <PageHeaderTitle>{workspace.name}</PageHeaderTitle>
+            <PageHeaderSubtitle>{workspace.owner_name}</PageHeaderSubtitle>
+          </div>
+        </Stack>
+
+        <WorkspaceStats
+          workspace={workspace}
+          quotaBudget={quotaBudget}
+          handleUpdate={handleUpdate}
+          canUpdateWorkspace={canUpdateWorkspace}
+          maxDeadlineDecrease={scheduleProps.maxDeadlineDecrease}
+          maxDeadlineIncrease={scheduleProps.maxDeadlineIncrease}
+          onDeadlineMinus={scheduleProps.onDeadlineMinus}
+          onDeadlinePlus={scheduleProps.onDeadlinePlus}
+        />
+
+        {canUpdateWorkspace && (
+          <PageHeaderActions>
+            <WorkspaceActions
+              workspace={workspace}
+              handleStart={handleStart}
+              handleStop={handleStop}
+              handleRestart={handleRestart}
+              handleDelete={handleDelete}
+              handleUpdate={handleUpdate}
+              handleCancel={handleCancel}
+              handleSettings={handleSettings}
+              handleChangeVersion={handleChangeVersion}
+              handleDormantActivate={handleDormantActivate}
+              canChangeVersions={canChangeVersions}
+              isUpdating={isUpdating}
+              isRestarting={isRestarting}
+            />
+          </PageHeaderActions>
+        )}
+      </FullWidthPageHeader>
+
+      <Margins css={styles.content}>
+        <Stack direction="column" css={styles.firstColumnSpacer} spacing={4}>
+          {workspace.outdated && (
+            <Alert severity="info">
+              <AlertTitle>An update is available for your workspace</AlertTitle>
+              {updateMessage && <AlertDetail>{updateMessage}</AlertDetail>}
+            </Alert>
+          )}
+          {buildError}
+          {cancellationError}
+          {workspace.latest_build.status === "running" &&
+            !workspace.health.healthy && (
+              <Alert
+                severity="warning"
+                actions={
+                  canUpdateWorkspace && (
+                    <Button
+                      variant="text"
+                      size="small"
+                      onClick={() => {
+                        handleRestart();
+                      }}
+                    >
+                      Restart
+                    </Button>
+                  )
+                }
+              >
+                <AlertTitle>Workspace is unhealthy</AlertTitle>
+                <AlertDetail>
+                  Your workspace is running but{" "}
+                  {workspace.health.failing_agents.length > 1
+                    ? `${workspace.health.failing_agents.length} agents are unhealthy`
+                    : `1 agent is unhealthy`}
+                  .
+                </AlertDetail>
+              </Alert>
+            )}
+
+          {workspace.latest_build.status === "deleted" && (
+            <WorkspaceDeletedBanner
+              handleClick={() => navigate(`/templates`)}
+            />
+          )}
+          {/* <DormantWorkspaceBanner/> determines its own visibility */}
+          <DormantWorkspaceBanner
+            workspaces={[workspace]}
+            shouldRedisplayBanner={
+              getLocal("dismissedWorkspace") !== workspace.id
+            }
+            onDismiss={() => saveLocal("dismissedWorkspace", workspace.id)}
+          />
+
+          <TemplateVersionWarnings warnings={templateWarnings} />
+
+          {showAlertPendingInQueue && (
+            <Alert severity="info">
+              <AlertTitle>Workspace build is pending</AlertTitle>
+              <AlertDetail>
+                <div css={styles.alertPendingInQueue}>
+                  This workspace build job is waiting for a provisioner to
+                  become available. If you have been waiting for an extended
+                  period of time, please contact your administrator for
+                  assistance.
+                </div>
+                <div>
+                  Position in queue:{" "}
+                  <strong>{workspace.latest_build.job.queue_position}</strong>
+                </div>
+              </AlertDetail>
+            </Alert>
+          )}
+
+          {workspace.latest_build.job.error && (
+            <Alert
+              severity="error"
+              actions={
+                canRetryDebugMode && (
+                  <Button
+                    key={0}
+                    onClick={handleBuildRetry}
+                    variant="text"
+                    size="small"
+                  >
+                    Try in debug mode
+                  </Button>
+                )
+              }
+            >
+              <AlertTitle>Workspace build failed</AlertTitle>
+              <AlertDetail>{workspace.latest_build.job.error}</AlertDetail>
+            </Alert>
+          )}
+
+          {transitionStats !== undefined && (
+            <WorkspaceBuildProgress
+              workspace={workspace}
+              transitionStats={transitionStats}
+            />
+          )}
+
+          {buildLogs}
+
+          {typeof resources !== "undefined" && resources.length > 0 && (
+            <Resources
+              resources={resources}
+              agentRow={(agent) => (
+                <AgentRow
+                  key={agent.id}
+                  agent={agent}
+                  workspace={workspace}
+                  sshPrefix={sshPrefix}
+                  showApps={canUpdateWorkspace}
+                  showBuiltinApps={canUpdateWorkspace}
+                  hideSSHButton={hideSSHButton}
+                  hideVSCodeDesktopButton={hideVSCodeDesktopButton}
+                  serverVersion={serverVersion}
+                  onUpdateAgent={handleUpdate} // On updating the workspace the agent version is also updated
+                />
+              )}
+            />
+          )}
+
+          {workspaceErrors[WorkspaceErrors.GET_BUILDS_ERROR] ? (
+            <ErrorAlert
+              error={workspaceErrors[WorkspaceErrors.GET_BUILDS_ERROR]}
+            />
+          ) : (
+            <BuildsTable
+              builds={builds}
+              onLoadMoreBuilds={onLoadMoreBuilds}
+              isLoadingMoreBuilds={isLoadingMoreBuilds}
+              hasMoreBuilds={hasMoreBuilds}
+            />
+          )}
+        </Stack>
+      </Margins>
+    </>
+  );
+};
+
+const styles = {
+  content: (theme) => ({
+    marginTop: theme.spacing(4),
+  }),
+
+  actions: (theme) => ({
+    [theme.breakpoints.down("md")]: {
+      flexDirection: "column",
+    },
+  }),
+
+  firstColumnSpacer: {
+    flex: 2,
+  },
+
+  alertPendingInQueue: {
+    marginBottom: 12,
+  },
+} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/pages/WorkspacePage/WorkspaceActions/BuildParametersPopover.tsx b/site/src/pages/WorkspacePage/WorkspaceActions/BuildParametersPopover.tsx
new file mode 100644
index 0000000000000..333d7999e7855
--- /dev/null
+++ b/site/src/pages/WorkspacePage/WorkspaceActions/BuildParametersPopover.tsx
@@ -0,0 +1,193 @@
+import ExpandMoreOutlined from "@mui/icons-material/ExpandMoreOutlined";
+import Box from "@mui/material/Box";
+import Button from "@mui/material/Button";
+import { useQuery } from "react-query";
+import { getWorkspaceParameters } from "api/api";
+import {
+  TemplateVersionParameter,
+  Workspace,
+  WorkspaceBuildParameter,
+} from "api/typesGenerated";
+import { FormFields } from "components/Form/Form";
+import { Loader } from "components/Loader/Loader";
+import { RichParameterInput } from "components/RichParameterInput/RichParameterInput";
+import {
+  HelpTooltipLink,
+  HelpTooltipLinksGroup,
+  HelpTooltipText,
+  HelpTooltipTitle,
+} from "components/HelpTooltip/HelpTooltip";
+import { useFormik } from "formik";
+import { docs } from "utils/docs";
+import { getFormHelpers } from "utils/formUtils";
+import { getInitialRichParameterValues } from "utils/richParameters";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+  usePopover,
+} from "components/Popover/Popover";
+
+export const BuildParametersPopover = ({
+  workspace,
+  disabled,
+  onSubmit,
+}: {
+  workspace: Workspace;
+  disabled?: boolean;
+  onSubmit: (buildParameters: WorkspaceBuildParameter[]) => void;
+}) => {
+  return (
+    <Popover>
+      <PopoverTrigger>
+        <Button
+          data-testid="build-parameters-button"
+          disabled={disabled}
+          color="neutral"
+          sx={{ px: 0 }}
+        >
+          <ExpandMoreOutlined sx={{ fontSize: 16 }} />
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent
+        horizontal="right"
+        css={(theme) => ({ ".MuiPaper-root": { width: theme.spacing(38) } })}
+      >
+        <BuildParametersPopoverContent
+          workspace={workspace}
+          onSubmit={onSubmit}
+        />
+      </PopoverContent>
+    </Popover>
+  );
+};
+
+const BuildParametersPopoverContent = ({
+  workspace,
+  onSubmit,
+}: {
+  workspace: Workspace;
+  onSubmit: (buildParameters: WorkspaceBuildParameter[]) => void;
+}) => {
+  const popover = usePopover();
+  const { data: parameters } = useQuery({
+    queryKey: ["workspace", workspace.id, "parameters"],
+    queryFn: () => getWorkspaceParameters(workspace),
+    enabled: popover.isOpen,
+  });
+  const ephemeralParameters = parameters
+    ? parameters.templateVersionRichParameters.filter((p) => p.ephemeral)
+    : undefined;
+
+  return (
+    <>
+      {parameters && parameters.buildParameters && ephemeralParameters ? (
+        ephemeralParameters.length > 0 ? (
+          <>
+            <Box
+              sx={{
+                color: (theme) => theme.palette.text.secondary,
+                p: 2.5,
+                borderBottom: (theme) => `1px solid ${theme.palette.divider}`,
+              }}
+            >
+              <HelpTooltipTitle>Build Options</HelpTooltipTitle>
+              <HelpTooltipText>
+                These parameters only apply for a single workspace start.
+              </HelpTooltipText>
+            </Box>
+            <Box sx={{ p: 2.5 }}>
+              <Form
+                onSubmit={(buildParameters) => {
+                  onSubmit(buildParameters);
+                  popover.setIsOpen(false);
+                }}
+                ephemeralParameters={ephemeralParameters}
+                buildParameters={parameters.buildParameters}
+              />
+            </Box>
+          </>
+        ) : (
+          <Box
+            sx={{
+              color: (theme) => theme.palette.text.secondary,
+              p: 2.5,
+              borderBottom: (theme) => `1px solid ${theme.palette.divider}`,
+            }}
+          >
+            <HelpTooltipTitle>Build Options</HelpTooltipTitle>
+            <HelpTooltipText>
+              This template has no ephemeral build options.
+            </HelpTooltipText>
+            <HelpTooltipLinksGroup>
+              <HelpTooltipLink
+                href={docs("/templates/parameters#ephemeral-parameters")}
+              >
+                Read the docs
+              </HelpTooltipLink>
+            </HelpTooltipLinksGroup>
+          </Box>
+        )
+      ) : (
+        <Loader />
+      )}
+    </>
+  );
+};
+
+const Form = ({
+  ephemeralParameters,
+  buildParameters,
+  onSubmit,
+}: {
+  ephemeralParameters: TemplateVersionParameter[];
+  buildParameters: WorkspaceBuildParameter[];
+  onSubmit: (buildParameters: WorkspaceBuildParameter[]) => void;
+}) => {
+  const form = useFormik({
+    initialValues: {
+      rich_parameter_values: getInitialRichParameterValues(
+        ephemeralParameters,
+        buildParameters,
+      ),
+    },
+    onSubmit: (values) => {
+      onSubmit(values.rich_parameter_values);
+    },
+  });
+  const getFieldHelpers = getFormHelpers(form);
+
+  return (
+    <form onSubmit={form.handleSubmit} data-testid="build-parameters-form">
+      <FormFields>
+        {ephemeralParameters.map((parameter, index) => {
+          return (
+            <RichParameterInput
+              {...getFieldHelpers("rich_parameter_values[" + index + "].value")}
+              key={parameter.name}
+              parameter={parameter}
+              size="small"
+              onChange={async (value) => {
+                await form.setFieldValue(`rich_parameter_values[${index}]`, {
+                  name: parameter.name,
+                  value: value,
+                });
+              }}
+            />
+          );
+        })}
+      </FormFields>
+      <Box sx={{ py: 3, pb: 1 }}>
+        <Button
+          data-testid="build-parameters-submit"
+          type="submit"
+          variant="contained"
+          color="primary"
+          sx={{ width: "100%" }}
+        >
+          Build workspace
+        </Button>
+      </Box>
+    </form>
+  );
+};
diff --git a/site/src/pages/WorkspacePage/WorkspaceActions/Buttons.tsx b/site/src/pages/WorkspacePage/WorkspaceActions/Buttons.tsx
new file mode 100644
index 0000000000000..12eaf5c9a3edc
--- /dev/null
+++ b/site/src/pages/WorkspacePage/WorkspaceActions/Buttons.tsx
@@ -0,0 +1,164 @@
+import Button from "@mui/material/Button";
+import BlockIcon from "@mui/icons-material/Block";
+import CloudQueueIcon from "@mui/icons-material/CloudQueue";
+import CropSquareIcon from "@mui/icons-material/CropSquare";
+import PlayCircleOutlineIcon from "@mui/icons-material/PlayCircleOutline";
+import ReplayIcon from "@mui/icons-material/Replay";
+import { FC } from "react";
+import BlockOutlined from "@mui/icons-material/BlockOutlined";
+import ButtonGroup from "@mui/material/ButtonGroup";
+import { Workspace, WorkspaceBuildParameter } from "api/typesGenerated";
+import { BuildParametersPopover } from "./BuildParametersPopover";
+import PowerSettingsNewIcon from "@mui/icons-material/PowerSettingsNew";
+import LoadingButton from "@mui/lab/LoadingButton";
+
+interface WorkspaceAction {
+  loading?: boolean;
+  handleAction: () => void;
+}
+
+export const UpdateButton: FC<WorkspaceAction> = ({
+  handleAction,
+  loading,
+}) => {
+  return (
+    <LoadingButton
+      loading={loading}
+      loadingPosition="start"
+      data-testid="workspace-update-button"
+      startIcon={<CloudQueueIcon />}
+      onClick={handleAction}
+    >
+      {loading ? <>Updating&hellip;</> : <>Update&hellip;</>}
+    </LoadingButton>
+  );
+};
+
+export const ActivateButton: FC<WorkspaceAction> = ({
+  handleAction,
+  loading,
+}) => {
+  return (
+    <LoadingButton
+      loading={loading}
+      loadingPosition="start"
+      startIcon={<PowerSettingsNewIcon />}
+      onClick={handleAction}
+    >
+      {loading ? <>Activating&hellip;</> : "Activate"}
+    </LoadingButton>
+  );
+};
+
+export const StartButton: FC<
+  Omit<WorkspaceAction, "handleAction"> & {
+    workspace: Workspace;
+    handleAction: (buildParameters?: WorkspaceBuildParameter[]) => void;
+  }
+> = ({ handleAction, workspace, loading }) => {
+  return (
+    <ButtonGroup
+      variant="outlined"
+      sx={{
+        // Workaround to make the border transitions smmothly on button groups
+        "& > button:hover + button": {
+          borderLeft: "1px solid #FFF",
+        },
+      }}
+    >
+      <LoadingButton
+        loading={loading}
+        loadingPosition="start"
+        startIcon={<PlayCircleOutlineIcon />}
+        onClick={() => handleAction()}
+      >
+        {loading ? <>Starting&hellip;</> : "Start"}
+      </LoadingButton>
+      <BuildParametersPopover
+        workspace={workspace}
+        disabled={loading}
+        onSubmit={handleAction}
+      />
+    </ButtonGroup>
+  );
+};
+
+export const StopButton: FC<WorkspaceAction> = ({ handleAction, loading }) => {
+  return (
+    <LoadingButton
+      loading={loading}
+      loadingPosition="start"
+      startIcon={<CropSquareIcon />}
+      onClick={handleAction}
+      data-testid="workspace-stop-button"
+    >
+      {loading ? <>Stopping&hellip;</> : "Stop"}
+    </LoadingButton>
+  );
+};
+
+export const RestartButton: FC<
+  Omit<WorkspaceAction, "handleAction"> & {
+    workspace: Workspace;
+    handleAction: (buildParameters?: WorkspaceBuildParameter[]) => void;
+  }
+> = ({ handleAction, loading, workspace }) => {
+  return (
+    <ButtonGroup
+      variant="outlined"
+      sx={{
+        // Workaround to make the border transitions smmothly on button groups
+        "& > button:hover + button": {
+          borderLeft: "1px solid #FFF",
+        },
+      }}
+    >
+      <LoadingButton
+        loading={loading}
+        loadingPosition="start"
+        startIcon={<ReplayIcon />}
+        onClick={() => handleAction()}
+        data-testid="workspace-restart-button"
+      >
+        {loading ? <>Restarting&hellip;</> : <>Restart&hellip;</>}
+      </LoadingButton>
+      <BuildParametersPopover
+        workspace={workspace}
+        disabled={loading}
+        onSubmit={handleAction}
+      />
+    </ButtonGroup>
+  );
+};
+
+export const CancelButton: FC<WorkspaceAction> = ({ handleAction }) => {
+  return (
+    <Button startIcon={<BlockIcon />} onClick={handleAction}>
+      Cancel
+    </Button>
+  );
+};
+
+interface DisabledProps {
+  label: string;
+}
+
+export const DisabledButton: FC<DisabledProps> = ({ label }) => {
+  return (
+    <Button startIcon={<BlockOutlined />} disabled>
+      {label}
+    </Button>
+  );
+};
+
+interface LoadingProps {
+  label: string;
+}
+
+export const ActionLoadingButton: FC<LoadingProps> = ({ label }) => {
+  return (
+    <LoadingButton loading loadingPosition="start" startIcon={<ReplayIcon />}>
+      {label}
+    </LoadingButton>
+  );
+};
diff --git a/site/src/pages/WorkspacePage/WorkspaceActions/WorkspaceActions.stories.tsx b/site/src/pages/WorkspacePage/WorkspaceActions/WorkspaceActions.stories.tsx
new file mode 100644
index 0000000000000..bbe9afe598fba
--- /dev/null
+++ b/site/src/pages/WorkspacePage/WorkspaceActions/WorkspaceActions.stories.tsx
@@ -0,0 +1,95 @@
+import { Meta, StoryObj } from "@storybook/react";
+import * as Mocks from "testHelpers/entities";
+import { WorkspaceActions } from "./WorkspaceActions";
+
+const meta: Meta<typeof WorkspaceActions> = {
+  title: "pages/WorkspacePage/WorkspaceActions",
+  component: WorkspaceActions,
+  args: {
+    isUpdating: false,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof WorkspaceActions>;
+
+export const Starting: Story = {
+  args: {
+    workspace: Mocks.MockStartingWorkspace,
+  },
+};
+
+export const Running: Story = {
+  args: {
+    workspace: Mocks.MockWorkspace,
+  },
+};
+
+export const Stopping: Story = {
+  args: {
+    workspace: Mocks.MockStoppingWorkspace,
+  },
+};
+
+export const Stopped: Story = {
+  args: {
+    workspace: Mocks.MockStoppedWorkspace,
+  },
+};
+
+export const Canceling: Story = {
+  args: {
+    workspace: Mocks.MockCancelingWorkspace,
+  },
+};
+
+export const Canceled: Story = {
+  args: {
+    workspace: Mocks.MockCanceledWorkspace,
+  },
+};
+
+export const Deleting: Story = {
+  args: {
+    workspace: Mocks.MockDeletingWorkspace,
+  },
+};
+
+export const Deleted: Story = {
+  args: {
+    workspace: Mocks.MockDeletedWorkspace,
+  },
+};
+
+export const Outdated: Story = {
+  args: {
+    workspace: Mocks.MockOutdatedWorkspace,
+  },
+};
+
+export const Failed: Story = {
+  args: {
+    workspace: Mocks.MockFailedWorkspace,
+  },
+};
+
+export const Updating: Story = {
+  args: {
+    isUpdating: true,
+    workspace: Mocks.MockOutdatedWorkspace,
+  },
+};
+
+export const RequireActiveVersionStarted: Story = {
+  args: {
+    workspace: Mocks.MockOutdatedRunningWorkspaceRequireActiveVersion,
+    canChangeVersions: false,
+  },
+};
+
+export const RequireActiveVersionStopped: Story = {
+  args: {
+    workspace: Mocks.MockOutdatedStoppedWorkspaceRequireActiveVersion,
+    canChangeVersions: false,
+  },
+};
diff --git a/site/src/pages/WorkspacePage/WorkspaceActions/WorkspaceActions.tsx b/site/src/pages/WorkspacePage/WorkspaceActions/WorkspaceActions.tsx
new file mode 100644
index 0000000000000..226396720b593
--- /dev/null
+++ b/site/src/pages/WorkspacePage/WorkspaceActions/WorkspaceActions.tsx
@@ -0,0 +1,177 @@
+import MenuItem from "@mui/material/MenuItem";
+import Menu from "@mui/material/Menu";
+import { makeStyles } from "@mui/styles";
+import MoreVertOutlined from "@mui/icons-material/MoreVertOutlined";
+import { FC, Fragment, ReactNode, useRef, useState } from "react";
+import { Workspace, WorkspaceBuildParameter } from "api/typesGenerated";
+import {
+  ActionLoadingButton,
+  CancelButton,
+  DisabledButton,
+  StartButton,
+  StopButton,
+  RestartButton,
+  UpdateButton,
+  ActivateButton,
+} from "./Buttons";
+import {
+  ButtonMapping,
+  ButtonTypesEnum,
+  actionsByWorkspaceStatus,
+} from "./constants";
+import SettingsOutlined from "@mui/icons-material/SettingsOutlined";
+import HistoryOutlined from "@mui/icons-material/HistoryOutlined";
+import DeleteOutlined from "@mui/icons-material/DeleteOutlined";
+import IconButton from "@mui/material/IconButton";
+
+export interface WorkspaceActionsProps {
+  workspace: Workspace;
+  handleStart: (buildParameters?: WorkspaceBuildParameter[]) => void;
+  handleStop: () => void;
+  handleRestart: (buildParameters?: WorkspaceBuildParameter[]) => void;
+  handleDelete: () => void;
+  handleUpdate: () => void;
+  handleCancel: () => void;
+  handleSettings: () => void;
+  handleChangeVersion: () => void;
+  handleDormantActivate: () => void;
+  isUpdating: boolean;
+  isRestarting: boolean;
+  children?: ReactNode;
+  canChangeVersions: boolean;
+}
+
+export const WorkspaceActions: FC<WorkspaceActionsProps> = ({
+  workspace,
+  handleStart,
+  handleStop,
+  handleRestart,
+  handleDelete,
+  handleUpdate,
+  handleCancel,
+  handleSettings,
+  handleChangeVersion,
+  handleDormantActivate: handleDormantActivate,
+  isUpdating,
+  isRestarting,
+  canChangeVersions,
+}) => {
+  const styles = useStyles();
+  const {
+    canCancel,
+    canAcceptJobs,
+    actions: actionsByStatus,
+  } = actionsByWorkspaceStatus(
+    workspace,
+    workspace.latest_build.status,
+    canChangeVersions,
+  );
+  const canBeUpdated = workspace.outdated && canAcceptJobs;
+  const menuTriggerRef = useRef<HTMLButtonElement>(null);
+  const [isMenuOpen, setIsMenuOpen] = useState(false);
+
+  // A mapping of button type to the corresponding React component
+  const buttonMapping: ButtonMapping = {
+    [ButtonTypesEnum.update]: <UpdateButton handleAction={handleUpdate} />,
+    [ButtonTypesEnum.updating]: (
+      <UpdateButton loading handleAction={handleUpdate} />
+    ),
+    [ButtonTypesEnum.start]: (
+      <StartButton workspace={workspace} handleAction={handleStart} />
+    ),
+    [ButtonTypesEnum.starting]: (
+      <StartButton loading workspace={workspace} handleAction={handleStart} />
+    ),
+    [ButtonTypesEnum.stop]: <StopButton handleAction={handleStop} />,
+    [ButtonTypesEnum.stopping]: (
+      <StopButton loading handleAction={handleStop} />
+    ),
+    [ButtonTypesEnum.restart]: (
+      <RestartButton workspace={workspace} handleAction={handleRestart} />
+    ),
+    [ButtonTypesEnum.restarting]: (
+      <RestartButton
+        loading
+        workspace={workspace}
+        handleAction={handleRestart}
+      />
+    ),
+    [ButtonTypesEnum.deleting]: <ActionLoadingButton label="Deleting" />,
+    [ButtonTypesEnum.canceling]: <DisabledButton label="Canceling..." />,
+    [ButtonTypesEnum.deleted]: <DisabledButton label="Deleted" />,
+    [ButtonTypesEnum.pending]: <ActionLoadingButton label="Pending..." />,
+    [ButtonTypesEnum.activate]: (
+      <ActivateButton handleAction={handleDormantActivate} />
+    ),
+    [ButtonTypesEnum.activating]: (
+      <ActivateButton loading handleAction={handleDormantActivate} />
+    ),
+  };
+
+  // Returns a function that will execute the action and close the menu
+  const onMenuItemClick = (actionFn: () => void) => () => {
+    setIsMenuOpen(false);
+    actionFn();
+  };
+
+  return (
+    <div className={styles.actions} data-testid="workspace-actions">
+      {canBeUpdated &&
+        (isUpdating
+          ? buttonMapping[ButtonTypesEnum.updating]
+          : buttonMapping[ButtonTypesEnum.update])}
+      {isRestarting && buttonMapping[ButtonTypesEnum.restarting]}
+      {!isRestarting &&
+        actionsByStatus.map((action) => (
+          <Fragment key={action}>{buttonMapping[action]}</Fragment>
+        ))}
+      {canCancel && <CancelButton handleAction={handleCancel} />}
+      <div>
+        <IconButton
+          title="More options"
+          size="small"
+          data-testid="workspace-options-button"
+          aria-controls="workspace-options"
+          aria-haspopup="true"
+          disabled={!canAcceptJobs}
+          ref={menuTriggerRef}
+          onClick={() => setIsMenuOpen(true)}
+        >
+          <MoreVertOutlined />
+        </IconButton>
+        <Menu
+          id="workspace-options"
+          anchorEl={menuTriggerRef.current}
+          open={isMenuOpen}
+          onClose={() => setIsMenuOpen(false)}
+        >
+          <MenuItem onClick={onMenuItemClick(handleSettings)}>
+            <SettingsOutlined />
+            Settings
+          </MenuItem>
+          {canChangeVersions && (
+            <MenuItem onClick={onMenuItemClick(handleChangeVersion)}>
+              <HistoryOutlined />
+              Change version&hellip;
+            </MenuItem>
+          )}
+          <MenuItem
+            onClick={onMenuItemClick(handleDelete)}
+            data-testid="delete-button"
+          >
+            <DeleteOutlined />
+            Delete&hellip;
+          </MenuItem>
+        </Menu>
+      </div>
+    </div>
+  );
+};
+
+const useStyles = makeStyles((theme) => ({
+  actions: {
+    display: "flex",
+    alignItems: "center",
+    gap: theme.spacing(1.5),
+  },
+}));
diff --git a/site/src/pages/WorkspacePage/WorkspaceActions/constants.ts b/site/src/pages/WorkspacePage/WorkspaceActions/constants.ts
new file mode 100644
index 0000000000000..dc57d0e4fbd0e
--- /dev/null
+++ b/site/src/pages/WorkspacePage/WorkspaceActions/constants.ts
@@ -0,0 +1,123 @@
+import { Workspace, WorkspaceStatus } from "api/typesGenerated";
+import { ReactNode } from "react";
+
+// the button types we have
+export enum ButtonTypesEnum {
+  start = "start",
+  starting = "starting",
+  stop = "stop",
+  stopping = "stopping",
+  restart = "restart",
+  restarting = "restarting",
+  deleting = "deleting",
+  update = "update",
+  updating = "updating",
+  activate = "activate",
+  activating = "activating",
+  // disabled buttons
+  canceling = "canceling",
+  deleted = "deleted",
+  pending = "pending",
+}
+
+export type ButtonMapping = {
+  [key in ButtonTypesEnum]: ReactNode;
+};
+
+interface WorkspaceAbilities {
+  actions: ButtonTypesEnum[];
+  canCancel: boolean;
+  canAcceptJobs: boolean;
+}
+
+export const actionsByWorkspaceStatus = (
+  workspace: Workspace,
+  status: WorkspaceStatus,
+  canChangeVersions: boolean,
+): WorkspaceAbilities => {
+  if (workspace.dormant_at) {
+    return {
+      actions: [ButtonTypesEnum.activate],
+      canCancel: false,
+      canAcceptJobs: false,
+    };
+  }
+  if (
+    workspace.template_require_active_version &&
+    workspace.outdated &&
+    !canChangeVersions
+  ) {
+    if (status === "running") {
+      return {
+        actions: [ButtonTypesEnum.stop],
+        canCancel: false,
+        canAcceptJobs: true,
+      };
+    }
+    if (status === "stopped") {
+      return {
+        actions: [],
+        canCancel: false,
+        canAcceptJobs: true,
+      };
+    }
+  }
+  return statusToActions[status];
+};
+
+const statusToActions: Record<WorkspaceStatus, WorkspaceAbilities> = {
+  starting: {
+    actions: [ButtonTypesEnum.starting],
+    canCancel: true,
+    canAcceptJobs: false,
+  },
+  running: {
+    actions: [ButtonTypesEnum.stop, ButtonTypesEnum.restart],
+    canCancel: false,
+    canAcceptJobs: true,
+  },
+  stopping: {
+    actions: [ButtonTypesEnum.stopping],
+    canCancel: true,
+    canAcceptJobs: false,
+  },
+  stopped: {
+    actions: [ButtonTypesEnum.start],
+    canCancel: false,
+    canAcceptJobs: true,
+  },
+  canceled: {
+    actions: [ButtonTypesEnum.start, ButtonTypesEnum.stop],
+    canCancel: false,
+    canAcceptJobs: true,
+  },
+  // in the case of an error
+  failed: {
+    actions: [ButtonTypesEnum.start, ButtonTypesEnum.stop],
+    canCancel: false,
+    canAcceptJobs: true,
+  },
+  /**
+   * disabled states
+   */
+  canceling: {
+    actions: [ButtonTypesEnum.canceling],
+    canCancel: false,
+    canAcceptJobs: false,
+  },
+  deleting: {
+    actions: [ButtonTypesEnum.deleting],
+    canCancel: true,
+    canAcceptJobs: false,
+  },
+  deleted: {
+    actions: [ButtonTypesEnum.deleted],
+    canCancel: false,
+    canAcceptJobs: false,
+  },
+  pending: {
+    actions: [ButtonTypesEnum.pending],
+    canCancel: false,
+    canAcceptJobs: false,
+  },
+};
diff --git a/site/src/pages/WorkspacePage/WorkspaceBuildLogsSection.tsx b/site/src/pages/WorkspacePage/WorkspaceBuildLogsSection.tsx
index 7c062d23614aa..332e7aa076e3c 100644
--- a/site/src/pages/WorkspacePage/WorkspaceBuildLogsSection.tsx
+++ b/site/src/pages/WorkspacePage/WorkspaceBuildLogsSection.tsx
@@ -1,22 +1,27 @@
-import Box from "@mui/material/Box"
-import { ProvisionerJobLog } from "api/typesGenerated"
-import { Loader } from "components/Loader/Loader"
-import { WorkspaceBuildLogs } from "components/WorkspaceBuildLogs/WorkspaceBuildLogs"
-import { useRef, useEffect } from "react"
+import Box from "@mui/material/Box";
+import { ProvisionerJobLog } from "api/typesGenerated";
+import { Loader } from "components/Loader/Loader";
+import { WorkspaceBuildLogs } from "components/WorkspaceBuildLogs/WorkspaceBuildLogs";
+import { useRef, useEffect } from "react";
 
 export const WorkspaceBuildLogsSection = ({
   logs,
 }: {
-  logs: ProvisionerJobLog[] | undefined
+  logs: ProvisionerJobLog[] | undefined;
 }) => {
-  const scrollRef = useRef<HTMLDivElement>(null)
+  const scrollRef = useRef<HTMLDivElement>(null);
 
   useEffect(() => {
-    const scrollEl = scrollRef.current
+    // Auto scrolling makes hard to snapshot test using Chromatic
+    if (process.env.STORYBOOK === "true") {
+      return;
+    }
+
+    const scrollEl = scrollRef.current;
     if (scrollEl) {
-      scrollEl.scrollTop = scrollEl.scrollHeight
+      scrollEl.scrollTop = scrollEl.scrollHeight;
     }
-  }, [logs])
+  }, [logs]);
 
   return (
     <Box
@@ -67,5 +72,5 @@ export const WorkspaceBuildLogsSection = ({
         )}
       </Box>
     </Box>
-  )
-}
+  );
+};
diff --git a/site/src/pages/WorkspacePage/WorkspaceBuildProgress.stories.tsx b/site/src/pages/WorkspacePage/WorkspaceBuildProgress.stories.tsx
new file mode 100644
index 0000000000000..b65a9ee74f4de
--- /dev/null
+++ b/site/src/pages/WorkspacePage/WorkspaceBuildProgress.stories.tsx
@@ -0,0 +1,71 @@
+import { Meta, StoryObj } from "@storybook/react";
+import dayjs from "dayjs";
+import {
+  MockStartingWorkspace,
+  MockWorkspaceBuild,
+  MockProvisionerJob,
+} from "testHelpers/entities";
+import { WorkspaceBuildProgress } from "./WorkspaceBuildProgress";
+
+const meta: Meta<typeof WorkspaceBuildProgress> = {
+  title: "pages/WorkspacePage/WorkspaceBuildProgress",
+  component: WorkspaceBuildProgress,
+  args: {
+    transitionStats: {
+      P50: 10000,
+      P95: 10010,
+    },
+    workspace: {
+      ...MockStartingWorkspace,
+      latest_build: {
+        ...MockWorkspaceBuild,
+        status: "starting",
+        job: {
+          ...MockProvisionerJob,
+          started_at: dayjs().add(-5, "second").format(),
+          status: "running",
+        },
+      },
+    },
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof WorkspaceBuildProgress>;
+
+export const Starting: Story = {};
+
+// When the transition stats are returning null, the progress bar should not be
+// displayed
+export const StartingUnknown: Story = {
+  args: {
+    transitionStats: {
+      // HACK: the codersdk type generator doesn't support null values, but this
+      // can be null when the template is new.
+      // eslint-disable-next-line @typescript-eslint/ban-ts-comment -- Read comment above
+      // @ts-ignore-error
+      P50: null,
+      // eslint-disable-next-line @typescript-eslint/ban-ts-comment -- Read comment above
+      // @ts-ignore-error
+      P95: null,
+    },
+  },
+};
+
+export const StartingPassedEstimate: Story = {
+  args: {
+    transitionStats: { P50: 1000, P95: 1000 },
+  },
+};
+
+export const StartingHighVariaton: Story = {
+  args: {
+    transitionStats: { P50: 10000, P95: 20000 },
+  },
+};
+
+export const StartingZeroEstimate: Story = {
+  args: {
+    transitionStats: { P50: 0, P95: 0 },
+  },
+};
diff --git a/site/src/components/WorkspaceBuildProgress/WorkspaceBuildProgress.tsx b/site/src/pages/WorkspacePage/WorkspaceBuildProgress.tsx
similarity index 75%
rename from site/src/components/WorkspaceBuildProgress/WorkspaceBuildProgress.tsx
rename to site/src/pages/WorkspacePage/WorkspaceBuildProgress.tsx
index 29df203e17504..64fdabc67c5f0 100644
--- a/site/src/components/WorkspaceBuildProgress/WorkspaceBuildProgress.tsx
+++ b/site/src/pages/WorkspacePage/WorkspaceBuildProgress.tsx
@@ -1,13 +1,13 @@
-import LinearProgress from "@mui/material/LinearProgress"
-import makeStyles from "@mui/styles/makeStyles"
-import { TransitionStats, Template, Workspace } from "api/typesGenerated"
-import dayjs, { Dayjs } from "dayjs"
-import { FC, useEffect, useState } from "react"
-import capitalize from "lodash/capitalize"
+import LinearProgress from "@mui/material/LinearProgress";
+import makeStyles from "@mui/styles/makeStyles";
+import { TransitionStats, Template, Workspace } from "api/typesGenerated";
+import dayjs, { Dayjs } from "dayjs";
+import { FC, useEffect, useState } from "react";
+import capitalize from "lodash/capitalize";
 
-import duration from "dayjs/plugin/duration"
+import duration from "dayjs/plugin/duration";
 
-dayjs.extend(duration)
+dayjs.extend(duration);
 
 // ActiveTransition gets the build estimate for the workspace,
 // if it is in a transition state.
@@ -15,65 +15,65 @@ export const ActiveTransition = (
   template: Template,
   workspace: Workspace,
 ): TransitionStats | undefined => {
-  const status = workspace.latest_build.status
+  const status = workspace.latest_build.status;
 
   switch (status) {
     case "starting":
-      return template.build_time_stats.start
+      return template.build_time_stats.start;
     case "stopping":
-      return template.build_time_stats.stop
+      return template.build_time_stats.stop;
     case "deleting":
-      return template.build_time_stats.delete
+      return template.build_time_stats.delete;
     default:
-      return undefined
+      return undefined;
   }
-}
+};
 
 const estimateFinish = (
   startedAt: Dayjs,
   p50: number,
   p95: number,
 ): [number | undefined, string] => {
-  const sinceStart = dayjs().diff(startedAt)
+  const sinceStart = dayjs().diff(startedAt);
   const secondsLeft = (est: number) => {
     const max = Math.max(
       Math.ceil(dayjs.duration((1 - sinceStart / est) * est).asSeconds()),
       0,
-    )
-    return isNaN(max) ? 0 : max
-  }
+    );
+    return isNaN(max) ? 0 : max;
+  };
 
   // Under-promise, over-deliver with the 95th percentile estimate.
-  const highGuess = secondsLeft(p95)
+  const highGuess = secondsLeft(p95);
 
   const anyMomentNow: [number | undefined, string] = [
     undefined,
     "Any moment now...",
-  ]
+  ];
 
-  const p50percent = (sinceStart * 100) / p50
+  const p50percent = (sinceStart * 100) / p50;
   if (highGuess <= 0) {
-    return anyMomentNow
+    return anyMomentNow;
   }
 
-  return [p50percent, `Up to ${highGuess} seconds remaining...`]
-}
+  return [p50percent, `Up to ${highGuess} seconds remaining...`];
+};
 
 export interface WorkspaceBuildProgressProps {
-  workspace: Workspace
-  transitionStats: TransitionStats
+  workspace: Workspace;
+  transitionStats: TransitionStats;
 }
 
 export const WorkspaceBuildProgress: FC<WorkspaceBuildProgressProps> = ({
   workspace,
   transitionStats: transitionStats,
 }) => {
-  const styles = useStyles()
-  const job = workspace.latest_build.job
-  const [progressValue, setProgressValue] = useState<number | undefined>(0)
+  const styles = useStyles();
+  const job = workspace.latest_build.job;
+  const [progressValue, setProgressValue] = useState<number | undefined>(0);
   const [progressText, setProgressText] = useState<string | undefined>(
     "Finding ETA...",
-  )
+  );
 
   // By default workspace is updated every second, which can cause visual stutter
   // when the build estimate is a few seconds. The timer ensures no observable
@@ -85,26 +85,26 @@ export const WorkspaceBuildProgress: FC<WorkspaceBuildProgressProps> = ({
         transitionStats.P50 === undefined ||
         transitionStats.P95 === undefined
       ) {
-        setProgressValue(undefined)
-        setProgressText(undefined)
-        return
+        setProgressValue(undefined);
+        setProgressText(undefined);
+        return;
       }
 
       const [est, text] = estimateFinish(
         dayjs(job.started_at),
         transitionStats.P50,
         transitionStats.P95,
-      )
-      setProgressValue(est)
-      setProgressText(text)
-    }
-    setTimeout(updateProgress, 5)
-  }, [progressValue, job, transitionStats])
+      );
+      setProgressValue(est);
+      setProgressText(text);
+    };
+    setTimeout(updateProgress, 5);
+  }, [progressValue, job, transitionStats]);
 
   // HACK: the codersdk type generator doesn't support null values, but this
   // can be null when the template is new.
   if ((transitionStats.P50 as number | null) === null) {
-    return <></>
+    return <></>;
   }
   return (
     <div className={styles.stack}>
@@ -134,8 +134,8 @@ export const WorkspaceBuildProgress: FC<WorkspaceBuildProgressProps> = ({
         </div>
       </div>
     </div>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   stack: {
@@ -156,4 +156,4 @@ const useStyles = makeStyles((theme) => ({
     fontWeight: 600,
     color: theme.palette.text.secondary,
   },
-}))
+}));
diff --git a/site/src/pages/WorkspacePage/WorkspaceDeletedBanner.stories.tsx b/site/src/pages/WorkspacePage/WorkspaceDeletedBanner.stories.tsx
new file mode 100644
index 0000000000000..bc81e1b7c9b3f
--- /dev/null
+++ b/site/src/pages/WorkspacePage/WorkspaceDeletedBanner.stories.tsx
@@ -0,0 +1,14 @@
+import { Meta, StoryObj } from "@storybook/react";
+import { WorkspaceDeletedBanner } from "./WorkspaceDeletedBanner";
+
+const meta: Meta<typeof WorkspaceDeletedBanner> = {
+  title: "pages/WorkspacePage/WorkspaceDeletedBanner",
+  component: WorkspaceDeletedBanner,
+};
+
+export default meta;
+type Story = StoryObj<typeof WorkspaceDeletedBanner>;
+
+const Example: Story = {};
+
+export { Example as WorkspaceDeletedBanner };
diff --git a/site/src/pages/WorkspacePage/WorkspaceDeletedBanner.tsx b/site/src/pages/WorkspacePage/WorkspaceDeletedBanner.tsx
new file mode 100644
index 0000000000000..a5b75a524c350
--- /dev/null
+++ b/site/src/pages/WorkspacePage/WorkspaceDeletedBanner.tsx
@@ -0,0 +1,23 @@
+import Button from "@mui/material/Button";
+import { FC } from "react";
+import { Alert } from "components/Alert/Alert";
+
+export interface WorkspaceDeletedBannerProps {
+  handleClick: () => void;
+}
+
+export const WorkspaceDeletedBanner: FC<
+  React.PropsWithChildren<WorkspaceDeletedBannerProps>
+> = ({ handleClick }) => {
+  const NewWorkspaceButton = (
+    <Button onClick={handleClick} size="small" variant="text">
+      Create new workspace
+    </Button>
+  );
+
+  return (
+    <Alert severity="warning" actions={NewWorkspaceButton}>
+      This workspace has been deleted and cannot be edited.
+    </Alert>
+  );
+};
diff --git a/site/src/pages/WorkspacePage/WorkspacePage.test.tsx b/site/src/pages/WorkspacePage/WorkspacePage.test.tsx
index 6db1d93ebd5d8..8a79bccea4513 100644
--- a/site/src/pages/WorkspacePage/WorkspacePage.test.tsx
+++ b/site/src/pages/WorkspacePage/WorkspacePage.test.tsx
@@ -1,8 +1,7 @@
-import { screen, waitFor, within } from "@testing-library/react"
-import userEvent from "@testing-library/user-event"
-import EventSourceMock from "eventsourcemock"
-import i18next from "i18next"
-import { rest } from "msw"
+import { screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import EventSourceMock from "eventsourcemock";
+import { rest } from "msw";
 import {
   MockTemplate,
   MockWorkspace,
@@ -12,50 +11,35 @@ import {
   MockOutdatedWorkspace,
   MockTemplateVersionParameter1,
   MockTemplateVersionParameter2,
-  MockStoppingWorkspace,
-  MockFailedWorkspace,
-  MockCancelingWorkspace,
-  MockCanceledWorkspace,
-  MockDeletingWorkspace,
-  MockDeletedWorkspace,
-  MockWorkspaceWithDeletion,
   MockBuilds,
   MockTemplateVersion3,
   MockUser,
-  MockEntitlementsWithScheduling,
   MockDeploymentConfig,
-} from "testHelpers/entities"
-import * as api from "../../api/api"
-import { Workspace } from "../../api/typesGenerated"
-import {
-  renderWithAuth,
-  waitForLoaderToBeRemoved,
-} from "../../testHelpers/renderHelpers"
-import { server } from "../../testHelpers/server"
-import { WorkspacePage } from "./WorkspacePage"
-
-const { t } = i18next
+} from "testHelpers/entities";
+import * as api from "api/api";
+import { renderWithAuth } from "testHelpers/renderHelpers";
+import { server } from "testHelpers/server";
+import { WorkspacePage } from "./WorkspacePage";
 
 // It renders the workspace page and waits for it be loaded
 const renderWorkspacePage = async () => {
-  jest.spyOn(api, "getTemplate").mockResolvedValueOnce(MockTemplate)
-  jest.spyOn(api, "getTemplateVersionRichParameters").mockResolvedValueOnce([])
+  jest.spyOn(api, "getTemplate").mockResolvedValueOnce(MockTemplate);
+  jest.spyOn(api, "getTemplateVersionRichParameters").mockResolvedValueOnce([]);
   jest
-    .spyOn(api, "getDeploymentValues")
-    .mockResolvedValueOnce(MockDeploymentConfig)
+    .spyOn(api, "getDeploymentConfig")
+    .mockResolvedValueOnce(MockDeploymentConfig);
   jest
     .spyOn(api, "watchWorkspaceAgentLogs")
     .mockImplementation((_, options) => {
-      options.onDone()
-      return new WebSocket("")
-    })
+      options.onDone && options.onDone();
+      return new WebSocket("");
+    });
   renderWithAuth(<WorkspacePage />, {
     route: `/@${MockWorkspace.owner_name}/${MockWorkspace.name}`,
     path: "/:username/:workspace",
-  })
-
-  await waitForLoaderToBeRemoved()
-}
+  });
+  await screen.findByText(MockWorkspace.name);
+};
 
 /**
  * Requests and responses related to workspace status are unrelated, so we can't test in the usual way.
@@ -64,204 +48,157 @@ const renderWorkspacePage = async () => {
  * workspaceStatus was calculated correctly.
  */
 const testButton = async (label: string, actionMock: jest.SpyInstance) => {
-  const user = userEvent.setup()
-  await renderWorkspacePage()
-  const workspaceActions = screen.getByTestId("workspace-actions")
-  const button = within(workspaceActions).getByRole("button", { name: label })
-  await user.click(button)
-  expect(actionMock).toBeCalled()
-}
-
-const testStatus = async (ws: Workspace, label: string) => {
-  server.use(
-    rest.get(
-      `/api/v2/users/:username/workspace/:workspaceName`,
-      (req, res, ctx) => {
-        return res(ctx.status(200), ctx.json(ws))
-      },
-    ),
-  )
-  await renderWorkspacePage()
-  const header = screen.getByTestId("header")
-  const status = within(header).getByRole("status")
-  expect(status).toHaveTextContent(label)
-}
-
-let originalEventSource: typeof window.EventSource
+  const user = userEvent.setup();
+  await renderWorkspacePage();
+  const workspaceActions = screen.getByTestId("workspace-actions");
+  const button = within(workspaceActions).getByRole("button", { name: label });
+  await user.click(button);
+  expect(actionMock).toBeCalled();
+};
+
+let originalEventSource: typeof window.EventSource;
 
 beforeAll(() => {
-  originalEventSource = window.EventSource
+  originalEventSource = window.EventSource;
   // mocking out EventSource for SSE
-  window.EventSource = EventSourceMock
-})
+  window.EventSource = EventSourceMock;
+});
 
 beforeEach(() => {
-  jest.resetAllMocks()
-})
+  jest.resetAllMocks();
+});
 
 afterAll(() => {
-  window.EventSource = originalEventSource
-})
+  window.EventSource = originalEventSource;
+});
 
 describe("WorkspacePage", () => {
   it("requests a delete job when the user presses Delete and confirms", async () => {
-    const user = userEvent.setup({ delay: 0 })
+    const user = userEvent.setup({ delay: 0 });
     const deleteWorkspaceMock = jest
       .spyOn(api, "deleteWorkspace")
-      .mockResolvedValueOnce(MockWorkspaceBuild)
-    await renderWorkspacePage()
+      .mockResolvedValueOnce(MockWorkspaceBuild);
+    await renderWorkspacePage();
 
     // open the workspace action popover so we have access to all available ctas
-    const trigger = screen.getByTestId("workspace-options-button")
-    await user.click(trigger)
-    const buttonText = t("actionButton.delete", { ns: "workspacePage" })
+    const trigger = screen.getByTestId("workspace-options-button");
+    await user.click(trigger);
 
     // Click on delete
-    const button = await screen.findByText(buttonText)
-    await user.click(button)
+    const button = await screen.findByTestId("delete-button");
+    await user.click(button);
 
     // Get dialog and confirm
-    const dialog = await screen.findByTestId("dialog")
-    const labelText = t("deleteDialog.confirmLabel", {
-      ns: "common",
-      entity: "workspace",
-    })
-    const textField = within(dialog).getByLabelText(labelText)
-    await user.type(textField, MockWorkspace.name)
+    const dialog = await screen.findByTestId("dialog");
+    const labelText = "Name of the workspace to delete";
+    const textField = within(dialog).getByLabelText(labelText);
+    await user.type(textField, MockWorkspace.name);
     const confirmButton = within(dialog).getByRole("button", {
       name: "Delete",
       hidden: false,
-    })
-    await user.click(confirmButton)
-    expect(deleteWorkspaceMock).toBeCalled()
-  })
+    });
+    await user.click(confirmButton);
+    expect(deleteWorkspaceMock).toBeCalled();
+  });
 
   it("requests a start job when the user presses Start", async () => {
     server.use(
       rest.get(
         `/api/v2/users/:userId/workspace/:workspaceName`,
         (req, res, ctx) => {
-          return res(ctx.status(200), ctx.json(MockStoppedWorkspace))
+          return res(ctx.status(200), ctx.json(MockStoppedWorkspace));
         },
       ),
-    )
+    );
     const startWorkspaceMock = jest
       .spyOn(api, "startWorkspace")
-      .mockImplementation(() => Promise.resolve(MockWorkspaceBuild))
-    await testButton(
-      t("actionButton.start", { ns: "workspacePage" }),
-      startWorkspaceMock,
-    )
-  })
+      .mockImplementation(() => Promise.resolve(MockWorkspaceBuild));
+    await testButton("Start", startWorkspaceMock);
+  });
 
   it("requests a stop job when the user presses Stop", async () => {
     const stopWorkspaceMock = jest
       .spyOn(api, "stopWorkspace")
-      .mockResolvedValueOnce(MockWorkspaceBuild)
+      .mockResolvedValueOnce(MockWorkspaceBuild);
 
-    await testButton(
-      t("actionButton.stop", { ns: "workspacePage" }),
-      stopWorkspaceMock,
-    )
-  })
+    await testButton("Stop", stopWorkspaceMock);
+  });
 
   it("requests a stop when the user presses Restart", async () => {
     const stopWorkspaceMock = jest
       .spyOn(api, "stopWorkspace")
-      .mockResolvedValueOnce(MockWorkspaceBuild)
+      .mockResolvedValueOnce(MockWorkspaceBuild);
 
     // Render
-    await renderWorkspacePage()
+    await renderWorkspacePage();
 
     // Actions
-    const user = userEvent.setup()
-    await user.click(screen.getByTestId("workspace-restart-button"))
-    const confirmButton = await screen.findByTestId("confirm-button")
-    await user.click(confirmButton)
+    const user = userEvent.setup();
+    await user.click(screen.getByTestId("workspace-restart-button"));
+    const confirmButton = await screen.findByTestId("confirm-button");
+    await user.click(confirmButton);
 
     // Assertions
     await waitFor(() => {
-      expect(stopWorkspaceMock).toBeCalled()
-    })
-  })
-
-  it("requests a stop without confirmation when the user presses Restart", async () => {
-    const stopWorkspaceMock = jest
-      .spyOn(api, "stopWorkspace")
-      .mockResolvedValueOnce(MockWorkspaceBuild)
-    window.localStorage.setItem(
-      `${MockUser.id}_ignoredWarnings`,
-      JSON.stringify({ restart: new Date().toISOString() }),
-    )
-
-    // Render
-    await renderWorkspacePage()
-
-    // Actions
-    const user = userEvent.setup()
-    await user.click(screen.getByTestId("workspace-restart-button"))
-
-    // Assertions
-    await waitFor(() => {
-      expect(stopWorkspaceMock).toBeCalled()
-    })
-  })
+      expect(stopWorkspaceMock).toBeCalled();
+    });
+  });
 
   it("requests cancellation when the user presses Cancel", async () => {
     server.use(
       rest.get(
         `/api/v2/users/:userId/workspace/:workspaceName`,
         (req, res, ctx) => {
-          return res(ctx.status(200), ctx.json(MockStartingWorkspace))
+          return res(ctx.status(200), ctx.json(MockStartingWorkspace));
         },
       ),
-    )
+    );
     const cancelWorkspaceMock = jest
       .spyOn(api, "cancelWorkspaceBuild")
-      .mockImplementation(() => Promise.resolve({ message: "job canceled" }))
+      .mockImplementation(() => Promise.resolve({ message: "job canceled" }));
 
-    await renderWorkspacePage()
+    await renderWorkspacePage();
 
-    const workspaceActions = screen.getByTestId("workspace-actions")
+    const workspaceActions = screen.getByTestId("workspace-actions");
     const cancelButton = within(workspaceActions).getByRole("button", {
       name: "Cancel",
-    })
+    });
 
-    await userEvent.setup().click(cancelButton)
+    await userEvent.click(cancelButton);
 
-    expect(cancelWorkspaceMock).toBeCalled()
-  })
+    expect(cancelWorkspaceMock).toBeCalled();
+  });
 
   it("requests an update when the user presses Update", async () => {
     // Mocks
     jest
       .spyOn(api, "getWorkspaceByOwnerAndName")
-      .mockResolvedValueOnce(MockOutdatedWorkspace)
+      .mockResolvedValueOnce(MockOutdatedWorkspace);
 
     const updateWorkspaceMock = jest
       .spyOn(api, "updateWorkspace")
-      .mockResolvedValueOnce(MockWorkspaceBuild)
+      .mockResolvedValueOnce(MockWorkspaceBuild);
 
     // Render
-    await renderWorkspacePage()
+    await renderWorkspacePage();
 
     // Actions
-    const user = userEvent.setup()
-    await user.click(screen.getByTestId("workspace-update-button"))
-    const confirmButton = await screen.findByTestId("confirm-button")
-    await user.click(confirmButton)
+    const user = userEvent.setup();
+    await user.click(screen.getByTestId("workspace-update-button"));
+    const confirmButton = await screen.findByTestId("confirm-button");
+    await user.click(confirmButton);
 
     // Assertions
     await waitFor(() => {
-      expect(updateWorkspaceMock).toBeCalled()
-    })
-  })
+      expect(updateWorkspaceMock).toBeCalled();
+    });
+  });
 
   it("updates the parameters when they are missing during update", async () => {
     // Mocks
     jest
       .spyOn(api, "getWorkspaceByOwnerAndName")
-      .mockResolvedValueOnce(MockOutdatedWorkspace)
+      .mockResolvedValueOnce(MockOutdatedWorkspace);
     const updateWorkspaceSpy = jest
       .spyOn(api, "updateWorkspace")
       .mockRejectedValueOnce(
@@ -269,39 +206,39 @@ describe("WorkspacePage", () => {
           MockTemplateVersionParameter1,
           MockTemplateVersionParameter2,
         ]),
-      )
+      );
 
     // Render
-    await renderWorkspacePage()
+    await renderWorkspacePage();
 
     // Actions
-    const user = userEvent.setup()
-    await user.click(screen.getByTestId("workspace-update-button"))
-    const confirmButton = await screen.findByTestId("confirm-button")
-    await user.click(confirmButton)
+    const user = userEvent.setup();
+    await user.click(screen.getByTestId("workspace-update-button"));
+    const confirmButton = await screen.findByTestId("confirm-button");
+    await user.click(confirmButton);
 
     // The update was called
     await waitFor(() => {
-      expect(api.updateWorkspace).toBeCalled()
-      updateWorkspaceSpy.mockClear()
-    })
+      expect(api.updateWorkspace).toBeCalled();
+      updateWorkspaceSpy.mockClear();
+    });
 
     // After trying to update, a new dialog asking for missed parameters should
     // be displayed and filled
-    const dialog = await screen.findByTestId("dialog")
+    const dialog = await screen.findByTestId("dialog");
     const firstParameterInput = within(dialog).getByLabelText(
       MockTemplateVersionParameter1.name,
       { exact: false },
-    )
-    await user.clear(firstParameterInput)
-    await user.type(firstParameterInput, "some-value")
+    );
+    await user.clear(firstParameterInput);
+    await user.type(firstParameterInput, "some-value");
     const secondParameterInput = within(dialog).getByLabelText(
       MockTemplateVersionParameter2.name,
       { exact: false },
-    )
-    await user.clear(secondParameterInput)
-    await user.type(secondParameterInput, "2")
-    await user.click(within(dialog).getByRole("button", { name: "Update" }))
+    );
+    await user.clear(secondParameterInput);
+    await user.type(secondParameterInput, "2");
+    await user.click(within(dialog).getByRole("button", { name: "Update" }));
 
     // Check if the update was called using the values from the form
     await waitFor(() => {
@@ -314,149 +251,38 @@ describe("WorkspacePage", () => {
           name: MockTemplateVersionParameter2.name,
           value: "2",
         },
-      ])
-    })
-  })
-
-  it("shows the Stopping status when the workspace is stopping", async () => {
-    await testStatus(
-      MockStoppingWorkspace,
-      t("workspaceStatus.stopping", { ns: "common" }),
-    )
-  })
-
-  it("shows the Stopped status when the workspace is stopped", async () => {
-    await testStatus(
-      MockStoppedWorkspace,
-      t("workspaceStatus.stopped", { ns: "common" }),
-    )
-  })
-
-  it("shows the Building status when the workspace is starting", async () => {
-    await testStatus(
-      MockStartingWorkspace,
-      t("workspaceStatus.starting", { ns: "common" }),
-    )
-  })
-
-  it("shows the Running status when the workspace is running", async () => {
-    await testStatus(
-      MockWorkspace,
-      t("workspaceStatus.running", { ns: "common" }),
-    )
-  })
-
-  it("shows the Failed status when the workspace is failed or canceled", async () => {
-    await testStatus(
-      MockFailedWorkspace,
-      t("workspaceStatus.failed", { ns: "common" }),
-    )
-  })
-
-  it("shows the Canceling status when the workspace is canceling", async () => {
-    await testStatus(
-      MockCancelingWorkspace,
-      t("workspaceStatus.canceling", { ns: "common" }),
-    )
-  })
-
-  it("shows the Canceled status when the workspace is canceling", async () => {
-    await testStatus(
-      MockCanceledWorkspace,
-      t("workspaceStatus.canceled", { ns: "common" }),
-    )
-  })
-
-  it("shows the Deleting status when the workspace is deleting", async () => {
-    await testStatus(
-      MockDeletingWorkspace,
-      t("workspaceStatus.deleting", { ns: "common" }),
-    )
-  })
-
-  it("shows the Deleted status when the workspace is deleted", async () => {
-    await testStatus(
-      MockDeletedWorkspace,
-      t("workspaceStatus.deleted", { ns: "common" }),
-    )
-  })
-
-  it("shows the Impending deletion status when the workspace is impending deletion", async () => {
-    jest
-      .spyOn(api, "getEntitlements")
-      .mockResolvedValue(MockEntitlementsWithScheduling)
-    await testStatus(MockWorkspaceWithDeletion, "Impending deletion")
-  })
+      ]);
+    });
+  });
 
   it("shows the timeline build", async () => {
-    await renderWorkspacePage()
-    const table = await screen.findByTestId("builds-table")
+    await renderWorkspacePage();
+    const table = await screen.findByTestId("builds-table");
 
     // Wait for the results to be loaded
     await waitFor(async () => {
-      const rows = table.querySelectorAll("tbody > tr")
+      const rows = table.querySelectorAll("tbody > tr");
       // Added +1 because of the date row
-      expect(rows).toHaveLength(MockBuilds.length + 1)
-    })
-  })
+      expect(rows).toHaveLength(MockBuilds.length + 1);
+    });
+  });
 
   it("shows the template warning", async () => {
     server.use(
       rest.get(
         "/api/v2/templateversions/:templateVersionId",
         async (req, res, ctx) => {
-          return res(ctx.status(200), ctx.json(MockTemplateVersion3))
+          return res(ctx.status(200), ctx.json(MockTemplateVersion3));
         },
       ),
-    )
+    );
 
-    await renderWorkspacePage()
-    await screen.findByTestId("error-unsupported-workspaces")
-  })
+    await renderWorkspacePage();
+    await screen.findByTestId("error-unsupported-workspaces");
+  });
 
   it("restart the workspace with one time parameters when having the confirmation dialog", async () => {
-    window.localStorage.removeItem(`${MockUser.id}_ignoredWarnings`)
-    jest.spyOn(api, "getWorkspaceParameters").mockResolvedValue({
-      templateVersionRichParameters: [
-        {
-          ...MockTemplateVersionParameter1,
-          ephemeral: true,
-          name: "rebuild",
-          description: "Rebuild",
-          required: false,
-        },
-      ],
-      buildParameters: [{ name: "rebuild", value: "false" }],
-    })
-    const restartWorkspaceSpy = jest.spyOn(api, "restartWorkspace")
-    const user = userEvent.setup()
-    await renderWorkspacePage()
-    await user.click(screen.getByTestId("build-parameters-button"))
-    const buildParametersForm = await screen.findByTestId(
-      "build-parameters-form",
-    )
-    const rebuildField = within(buildParametersForm).getByLabelText("Rebuild", {
-      exact: false,
-    })
-    await user.clear(rebuildField)
-    await user.type(rebuildField, "true")
-    await user.click(screen.getByTestId("build-parameters-submit"))
-    await user.click(screen.getByTestId("confirm-button"))
-    await waitFor(() => {
-      expect(restartWorkspaceSpy).toBeCalledWith({
-        workspace: MockWorkspace,
-        buildParameters: [{ name: "rebuild", value: "true" }],
-      })
-    })
-  })
-
-  it("restart the workspace with one time parameters without the confirmation dialog", async () => {
-    window.localStorage.setItem(
-      `${MockUser.id}_ignoredWarnings`,
-      JSON.stringify({
-        restart: new Date().toISOString(),
-      }),
-    )
+    window.localStorage.removeItem(`${MockUser.id}_ignoredWarnings`);
     jest.spyOn(api, "getWorkspaceParameters").mockResolvedValue({
       templateVersionRichParameters: [
         {
@@ -468,25 +294,26 @@ describe("WorkspacePage", () => {
         },
       ],
       buildParameters: [{ name: "rebuild", value: "false" }],
-    })
-    const restartWorkspaceSpy = jest.spyOn(api, "restartWorkspace")
-    const user = userEvent.setup()
-    await renderWorkspacePage()
-    await user.click(screen.getByTestId("build-parameters-button"))
+    });
+    const restartWorkspaceSpy = jest.spyOn(api, "restartWorkspace");
+    const user = userEvent.setup();
+    await renderWorkspacePage();
+    await user.click(screen.getByTestId("build-parameters-button"));
     const buildParametersForm = await screen.findByTestId(
       "build-parameters-form",
-    )
+    );
     const rebuildField = within(buildParametersForm).getByLabelText("Rebuild", {
       exact: false,
-    })
-    await user.clear(rebuildField)
-    await user.type(rebuildField, "true")
-    await user.click(screen.getByTestId("build-parameters-submit"))
+    });
+    await user.clear(rebuildField);
+    await user.type(rebuildField, "true");
+    await user.click(screen.getByTestId("build-parameters-submit"));
+    await user.click(screen.getByTestId("confirm-button"));
     await waitFor(() => {
       expect(restartWorkspaceSpy).toBeCalledWith({
         workspace: MockWorkspace,
         buildParameters: [{ name: "rebuild", value: "true" }],
-      })
-    })
-  })
-})
+      });
+    });
+  });
+});
diff --git a/site/src/pages/WorkspacePage/WorkspacePage.tsx b/site/src/pages/WorkspacePage/WorkspacePage.tsx
index 43a1944207a78..2c8dc3d8b9d7d 100644
--- a/site/src/pages/WorkspacePage/WorkspacePage.tsx
+++ b/site/src/pages/WorkspacePage/WorkspacePage.tsx
@@ -1,36 +1,57 @@
-import { useMachine } from "@xstate/react"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { Loader } from "components/Loader/Loader"
-import { FC } from "react"
-import { useParams } from "react-router-dom"
-import { quotaMachine } from "xServices/quotas/quotasXService"
-import { workspaceMachine } from "xServices/workspace/workspaceXService"
-import { WorkspaceReadyPage } from "./WorkspaceReadyPage"
-import { RequirePermission } from "components/RequirePermission/RequirePermission"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
-import { useOrganizationId } from "hooks"
-import { isAxiosError } from "axios"
-import { Margins } from "components/Margins/Margins"
+import { useMachine } from "@xstate/react";
+import { Loader } from "components/Loader/Loader";
+import { FC } from "react";
+import { useParams } from "react-router-dom";
+import { workspaceMachine } from "xServices/workspace/workspaceXService";
+import { WorkspaceReadyPage } from "./WorkspaceReadyPage";
+import { RequirePermission } from "components/RequirePermission/RequirePermission";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { useOrganizationId } from "hooks";
+import { isAxiosError } from "axios";
+import { Margins } from "components/Margins/Margins";
+import { workspaceQuota } from "api/queries/workspaceQuota";
+import { useInfiniteQuery, useQuery } from "react-query";
+import { infiniteWorkspaceBuilds } from "api/queries/workspaceBuilds";
 
 export const WorkspacePage: FC = () => {
   const params = useParams() as {
-    username: string
-    workspace: string
-  }
-  const workspaceName = params.workspace
-  const username = params.username.replace("@", "")
-  const orgId = useOrganizationId()
+    username: string;
+    workspace: string;
+  };
+  const workspaceName = params.workspace;
+  const username = params.username.replace("@", "");
+  const orgId = useOrganizationId();
   const [workspaceState, workspaceSend] = useMachine(workspaceMachine, {
     context: {
       orgId,
       workspaceName,
       username,
     },
-  })
-  const { workspace, error } = workspaceState.context
-  const [quotaState] = useMachine(quotaMachine, { context: { username } })
-  const { getQuotaError } = quotaState.context
-  const pageError = error ?? getQuotaError
+    actions: {
+      refreshBuilds: async () => {
+        await buildsQuery.refetch();
+      },
+    },
+  });
+  const { workspace, error } = workspaceState.context;
+  const quotaQuery = useQuery(workspaceQuota(username));
+  const pageError = error ?? quotaQuery.error;
+  const buildsQuery = useInfiniteQuery({
+    ...infiniteWorkspaceBuilds(workspace?.id ?? ""),
+    enabled: Boolean(workspace),
+  });
+
+  if (pageError) {
+    return (
+      <Margins>
+        <ErrorAlert error={pageError} sx={{ my: 2 }} />
+      </Margins>
+    );
+  }
+
+  if (!workspace || !workspaceState.matches("ready") || !quotaQuery.isSuccess) {
+    return <Loader />;
+  }
 
   return (
     <RequirePermission
@@ -38,31 +59,20 @@ export const WorkspacePage: FC = () => {
         !(isAxiosError(pageError) && pageError.response?.status === 404)
       }
     >
-      <ChooseOne>
-        <Cond condition={Boolean(pageError)}>
-          <Margins>
-            <ErrorAlert error={pageError} sx={{ my: 2 }} />
-          </Margins>
-        </Cond>
-        <Cond
-          condition={
-            Boolean(workspace) &&
-            workspaceState.matches("ready") &&
-            quotaState.matches("success")
-          }
-        >
-          <WorkspaceReadyPage
-            workspaceState={workspaceState}
-            quotaState={quotaState}
-            workspaceSend={workspaceSend}
-          />
-        </Cond>
-        <Cond>
-          <Loader />
-        </Cond>
-      </ChooseOne>
+      <WorkspaceReadyPage
+        workspaceState={workspaceState}
+        quota={quotaQuery.data}
+        workspaceSend={workspaceSend}
+        builds={buildsQuery.data?.pages.flat()}
+        buildsError={buildsQuery.error}
+        isLoadingMoreBuilds={buildsQuery.isFetchingNextPage}
+        onLoadMoreBuilds={async () => {
+          await buildsQuery.fetchNextPage();
+        }}
+        hasMoreBuilds={Boolean(buildsQuery.hasNextPage)}
+      />
     </RequirePermission>
-  )
-}
+  );
+};
 
-export default WorkspacePage
+export default WorkspacePage;
diff --git a/site/src/pages/WorkspacePage/WorkspaceReadyPage.tsx b/site/src/pages/WorkspacePage/WorkspaceReadyPage.tsx
index 4407f8f017775..f332ea78500f2 100644
--- a/site/src/pages/WorkspacePage/WorkspaceReadyPage.tsx
+++ b/site/src/pages/WorkspacePage/WorkspaceReadyPage.tsx
@@ -1,116 +1,129 @@
-import { useActor, useMachine } from "@xstate/react"
-import { useDashboard } from "components/Dashboard/DashboardProvider"
-import dayjs from "dayjs"
-import { useFeatureVisibility } from "hooks/useFeatureVisibility"
-import { FC, useEffect, useState } from "react"
-import { Helmet } from "react-helmet-async"
-import { useTranslation } from "react-i18next"
-import { useNavigate } from "react-router-dom"
+import { useActor } from "@xstate/react";
+import { useDashboard } from "components/Dashboard/DashboardProvider";
+import dayjs from "dayjs";
+import { useFeatureVisibility } from "hooks/useFeatureVisibility";
+import { FC, useEffect, useState } from "react";
+import { Helmet } from "react-helmet-async";
+import { useNavigate } from "react-router-dom";
 import {
   getDeadline,
   getMaxDeadline,
   getMaxDeadlineChange,
   getMinDeadline,
-} from "utils/schedule"
-import { quotaMachine } from "xServices/quotas/quotasXService"
-import { StateFrom } from "xstate"
-import { DeleteDialog } from "../../components/Dialogs/DeleteDialog/DeleteDialog"
-import {
-  Workspace,
-  WorkspaceErrors,
-} from "../../components/Workspace/Workspace"
-import { pageTitle } from "../../utils/page"
-import { getFaviconByStatus, hasJobError } from "../../utils/workspace"
+} from "utils/schedule";
+import { StateFrom } from "xstate";
+import { DeleteDialog } from "components/Dialogs/DeleteDialog/DeleteDialog";
+import { Workspace, WorkspaceErrors } from "./Workspace";
+import { pageTitle } from "utils/page";
+import { getFaviconByStatus, hasJobError } from "utils/workspace";
 import {
   WorkspaceEvent,
   workspaceMachine,
-} from "../../xServices/workspace/workspaceXService"
-import { UpdateBuildParametersDialog } from "./UpdateBuildParametersDialog"
-import { ChangeVersionDialog } from "./ChangeVersionDialog"
-import { useMutation, useQuery } from "@tanstack/react-query"
-import { getTemplateVersions, restartWorkspace } from "api/api"
+} from "xServices/workspace/workspaceXService";
+import { UpdateBuildParametersDialog } from "./UpdateBuildParametersDialog";
+import { ChangeVersionDialog } from "./ChangeVersionDialog";
+import { useMutation, useQuery } from "react-query";
+import { restartWorkspace } from "api/api";
 import {
   ConfirmDialog,
   ConfirmDialogProps,
-} from "components/Dialogs/ConfirmDialog/ConfirmDialog"
-import { useMe } from "hooks/useMe"
-import Checkbox from "@mui/material/Checkbox"
-import FormControlLabel from "@mui/material/FormControlLabel"
-import { workspaceBuildMachine } from "xServices/workspaceBuild/workspaceBuildXService"
-import * as TypesGen from "api/typesGenerated"
-import { WorkspaceBuildLogsSection } from "./WorkspaceBuildLogsSection"
+} from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import * as TypesGen from "api/typesGenerated";
+import { WorkspaceBuildLogsSection } from "./WorkspaceBuildLogsSection";
+import { templateVersion, templateVersions } from "api/queries/templates";
+import { Alert } from "components/Alert/Alert";
+import { Stack } from "components/Stack/Stack";
+import { useWorkspaceBuildLogs } from "hooks/useWorkspaceBuildLogs";
 
 interface WorkspaceReadyPageProps {
-  workspaceState: StateFrom<typeof workspaceMachine>
-  quotaState: StateFrom<typeof quotaMachine>
-  workspaceSend: (event: WorkspaceEvent) => void
+  workspaceState: StateFrom<typeof workspaceMachine>;
+  workspaceSend: (event: WorkspaceEvent) => void;
+  quota?: TypesGen.WorkspaceQuota;
+  builds: TypesGen.WorkspaceBuild[] | undefined;
+  buildsError: unknown;
+  onLoadMoreBuilds: () => void;
+  isLoadingMoreBuilds: boolean;
+  hasMoreBuilds: boolean;
 }
 
 export const WorkspaceReadyPage = ({
   workspaceState,
-  quotaState,
   workspaceSend,
+  quota,
+  builds,
+  buildsError,
+  onLoadMoreBuilds,
+  isLoadingMoreBuilds,
+  hasMoreBuilds,
 }: WorkspaceReadyPageProps): JSX.Element => {
   const [_, bannerSend] = useActor(
     workspaceState.children["scheduleBannerMachine"],
-  )
-  const { buildInfo } = useDashboard()
-  const featureVisibility = useFeatureVisibility()
+  );
+  const { buildInfo } = useDashboard();
+  const featureVisibility = useFeatureVisibility();
   const {
     workspace,
     template,
-    templateVersion,
+    templateVersion: currentVersion,
     deploymentValues,
-    builds,
-    getBuildsError,
     buildError,
     cancellationError,
     sshPrefix,
     permissions,
     missedParameters,
-  } = workspaceState.context
+  } = workspaceState.context;
   if (workspace === undefined) {
-    throw Error("Workspace is undefined")
+    throw Error("Workspace is undefined");
   }
-  const deadline = getDeadline(workspace)
-  const canUpdateWorkspace = Boolean(permissions?.updateWorkspace)
-  const canUpdateTemplate = Boolean(permissions?.updateTemplate)
+  const deadline = getDeadline(workspace);
+  const canUpdateWorkspace = Boolean(permissions?.updateWorkspace);
+  const canUpdateTemplate = Boolean(permissions?.updateTemplate);
   const canRetryDebugMode =
     Boolean(permissions?.viewDeploymentValues) &&
-    Boolean(deploymentValues?.enable_terraform_debug_mode)
-  const { t } = useTranslation("workspacePage")
-  const favicon = getFaviconByStatus(workspace.latest_build)
-  const navigate = useNavigate()
-  const [changeVersionDialogOpen, setChangeVersionDialogOpen] = useState(false)
-  const { data: templateVersions } = useQuery({
-    queryKey: ["template", "versions", workspace.template_id],
-    queryFn: () => getTemplateVersions(workspace.template_id),
-    enabled: changeVersionDialogOpen,
-  })
-  const [isConfirmingUpdate, setIsConfirmingUpdate] = useState(false)
+    Boolean(deploymentValues?.enable_terraform_debug_mode);
+  const favicon = getFaviconByStatus(workspace.latest_build);
+  const navigate = useNavigate();
+  const [changeVersionDialogOpen, setChangeVersionDialogOpen] = useState(false);
+  const [isConfirmingUpdate, setIsConfirmingUpdate] = useState(false);
   const [confirmingRestart, setConfirmingRestart] = useState<{
-    open: boolean
-    buildParameters?: TypesGen.WorkspaceBuildParameter[]
-  }>({ open: false })
-  const user = useMe()
-  const { isWarningIgnored, ignoreWarning } = useIgnoreWarnings(user.id)
-  const buildLogs = useBuildLogs(workspace)
+    open: boolean;
+    buildParameters?: TypesGen.WorkspaceBuildParameter[];
+  }>({ open: false });
+
+  const { data: allVersions } = useQuery({
+    ...templateVersions(workspace.template_id),
+    enabled: changeVersionDialogOpen,
+  });
+  const { data: latestVersion } = useQuery({
+    ...templateVersion(workspace.template_active_version_id),
+    enabled: workspace.outdated,
+  });
+  const [faviconTheme, setFaviconTheme] = useState<"light" | "dark">("dark");
+  useEffect(() => {
+    if (typeof window === "undefined" || !window.matchMedia) {
+      return;
+    }
+    const isDark = window.matchMedia("(prefers-color-scheme: dark)");
+    // We want the favicon the opposite of the theme.
+    setFaviconTheme(isDark ? "light" : "dark");
+  }, []);
+  const buildLogs = useWorkspaceBuildLogs(workspace.latest_build.id);
   const shouldDisplayBuildLogs =
     hasJobError(workspace) ||
     ["canceling", "deleting", "pending", "starting", "stopping"].includes(
       workspace.latest_build.status,
-    )
+    );
   const {
     mutate: mutateRestartWorkspace,
     error: restartBuildError,
     isLoading: isRestarting,
   } = useMutation({
     mutationFn: restartWorkspace,
-  })
+  });
   // keep banner machine in sync with workspace
   useEffect(() => {
-    bannerSend({ type: "REFRESH_WORKSPACE", workspace })
-  }, [bannerSend, workspace])
+    bannerSend({ type: "REFRESH_WORKSPACE", workspace });
+  }, [bannerSend, workspace]);
 
   return (
     <>
@@ -119,12 +132,12 @@ export const WorkspaceReadyPage = ({
         <link
           rel="alternate icon"
           type="image/png"
-          href={`/favicons/${favicon}.png`}
+          href={`/favicons/${favicon}-${faviconTheme}.png`}
         />
         <link
           rel="icon"
           type="image/svg+xml"
-          href={`/favicons/${favicon}.svg`}
+          href={`/favicons/${favicon}-${faviconTheme}.svg`}
         />
       </Helmet>
 
@@ -134,13 +147,13 @@ export const WorkspaceReadyPage = ({
             bannerSend({
               type: "DECREASE_DEADLINE",
               hours,
-            })
+            });
           },
           onDeadlinePlus: (hours: number) => {
             bannerSend({
               type: "INCREASE_DEADLINE",
               hours,
-            })
+            });
           },
           maxDeadlineDecrease: getMaxDeadlineChange(deadline, getMinDeadline()),
           maxDeadlineIncrease: getMaxDeadlineChange(
@@ -157,42 +170,39 @@ export const WorkspaceReadyPage = ({
         handleStop={() => workspaceSend({ type: "STOP" })}
         handleDelete={() => workspaceSend({ type: "ASK_DELETE" })}
         handleRestart={(buildParameters) => {
-          if (isWarningIgnored("restart")) {
-            mutateRestartWorkspace({ workspace, buildParameters })
-          } else {
-            setConfirmingRestart({ open: true, buildParameters })
-          }
+          setConfirmingRestart({ open: true, buildParameters });
         }}
         handleUpdate={() => {
-          if (isWarningIgnored("update")) {
-            workspaceSend({ type: "UPDATE" })
-          } else {
-            setIsConfirmingUpdate(true)
-          }
+          setIsConfirmingUpdate(true);
         }}
         handleCancel={() => workspaceSend({ type: "CANCEL" })}
         handleSettings={() => navigate("settings")}
         handleBuildRetry={() => workspaceSend({ type: "RETRY_BUILD" })}
         handleChangeVersion={() => {
-          setChangeVersionDialogOpen(true)
+          setChangeVersionDialogOpen(true);
         }}
+        handleDormantActivate={() => workspaceSend({ type: "ACTIVATE" })}
         resources={workspace.latest_build.resources}
         builds={builds}
+        onLoadMoreBuilds={onLoadMoreBuilds}
+        isLoadingMoreBuilds={isLoadingMoreBuilds}
+        hasMoreBuilds={hasMoreBuilds}
         canUpdateWorkspace={canUpdateWorkspace}
+        updateMessage={latestVersion?.message}
         canRetryDebugMode={canRetryDebugMode}
         canChangeVersions={canUpdateTemplate}
         hideSSHButton={featureVisibility["browser_only"]}
         hideVSCodeDesktopButton={featureVisibility["browser_only"]}
         workspaceErrors={{
-          [WorkspaceErrors.GET_BUILDS_ERROR]: getBuildsError,
+          [WorkspaceErrors.GET_BUILDS_ERROR]: buildsError,
           [WorkspaceErrors.BUILD_ERROR]: buildError || restartBuildError,
           [WorkspaceErrors.CANCELLATION_ERROR]: cancellationError,
         }}
         buildInfo={buildInfo}
         sshPrefix={sshPrefix}
         template={template}
-        quota_budget={quotaState.context.quota?.budget}
-        templateWarnings={templateVersion?.warnings}
+        quotaBudget={quota?.budget}
+        templateWarnings={currentVersion?.warnings}
         buildLogs={
           shouldDisplayBuildLogs && (
             <WorkspaceBuildLogsSection logs={buildLogs} />
@@ -202,168 +212,95 @@ export const WorkspaceReadyPage = ({
       <DeleteDialog
         entity="workspace"
         name={workspace.name}
-        info={t("deleteDialog.info", {
-          timeAgo: dayjs(workspace.created_at).fromNow(),
-        }).toString()}
+        info={`This workspace was created ${dayjs(
+          workspace.created_at,
+        ).fromNow()}.`}
         isOpen={workspaceState.matches({ ready: { build: "askingDelete" } })}
         onCancel={() => workspaceSend({ type: "CANCEL_DELETE" })}
         onConfirm={() => {
-          workspaceSend({ type: "DELETE" })
+          workspaceSend({ type: "DELETE" });
         }}
       />
       <UpdateBuildParametersDialog
-        missedParameters={missedParameters}
+        missedParameters={missedParameters ?? []}
         open={workspaceState.matches(
           "ready.build.askingForMissedBuildParameters",
         )}
         onClose={() => {
-          workspaceSend({ type: "CANCEL" })
+          workspaceSend({ type: "CANCEL" });
         }}
         onUpdate={(buildParameters) => {
-          workspaceSend({ type: "UPDATE", buildParameters })
+          workspaceSend({ type: "UPDATE", buildParameters });
         }}
       />
       <ChangeVersionDialog
-        templateVersions={templateVersions?.reverse()}
+        templateVersions={allVersions?.reverse()}
         template={template}
-        defaultTemplateVersion={templateVersions?.find(
+        defaultTemplateVersion={allVersions?.find(
           (v) => workspace.latest_build.template_version_id === v.id,
         )}
         open={changeVersionDialogOpen}
         onClose={() => {
-          setChangeVersionDialogOpen(false)
+          setChangeVersionDialogOpen(false);
         }}
         onConfirm={(templateVersion) => {
-          setChangeVersionDialogOpen(false)
+          setChangeVersionDialogOpen(false);
           workspaceSend({
             type: "CHANGE_VERSION",
             templateVersionId: templateVersion.id,
-          })
+          });
         }}
       />
       <WarningDialog
         open={isConfirmingUpdate}
-        onConfirm={(shouldIgnore) => {
-          if (shouldIgnore) {
-            ignoreWarning("update")
-          }
-          workspaceSend({ type: "UPDATE" })
-          setIsConfirmingUpdate(false)
+        onConfirm={() => {
+          workspaceSend({ type: "UPDATE" });
+          setIsConfirmingUpdate(false);
         }}
         onClose={() => setIsConfirmingUpdate(false)}
-        title="Confirm update"
+        title="Update and restart?"
         confirmText="Update"
-        description="Are you sure you want to update your workspace? Updating your workspace will stop all running processes and delete non-persistent data."
+        description={
+          <Stack>
+            <p>
+              Restarting your workspace will stop all running processes and{" "}
+              <strong>delete non-persistent data</strong>.
+            </p>
+            {latestVersion?.message && (
+              <Alert severity="info">{latestVersion.message}</Alert>
+            )}
+          </Stack>
+        }
       />
 
       <WarningDialog
         open={confirmingRestart.open}
-        onConfirm={(shouldIgnore) => {
-          if (shouldIgnore) {
-            ignoreWarning("restart")
-          }
+        onConfirm={() => {
           mutateRestartWorkspace({
             workspace,
             buildParameters: confirmingRestart.buildParameters,
-          })
-          setConfirmingRestart({ open: false })
+          });
+          setConfirmingRestart({ open: false });
         }}
         onClose={() => setConfirmingRestart({ open: false })}
-        title="Confirm restart"
+        title="Restart your workspace?"
         confirmText="Restart"
-        description="Are you sure you want to restart your workspace? Updating your workspace will stop all running processes and delete non-persistent data."
+        description={
+          <>
+            Restarting your workspace will stop all running processes and{" "}
+            <strong>delete non-persistent data</strong>.
+          </>
+        }
       />
     </>
-  )
-}
-
-type IgnoredWarnings = Record<string, string>
-
-const useIgnoreWarnings = (prefix: string) => {
-  const ignoredWarningsJSON = localStorage.getItem(`${prefix}_ignoredWarnings`)
-  let ignoredWarnings: IgnoredWarnings | undefined
-  if (ignoredWarningsJSON) {
-    ignoredWarnings = JSON.parse(ignoredWarningsJSON)
-  }
-
-  const isWarningIgnored = (warningId: string) => {
-    return Boolean(ignoredWarnings?.[warningId])
-  }
-
-  const ignoreWarning = (warningId: string) => {
-    if (!ignoredWarnings) {
-      ignoredWarnings = {}
-    }
-    ignoredWarnings[warningId] = new Date().toISOString()
-    localStorage.setItem(
-      `${prefix}_ignoredWarnings`,
-      JSON.stringify(ignoredWarnings),
-    )
-  }
-
-  return {
-    isWarningIgnored,
-    ignoreWarning,
-  }
-}
+  );
+};
 
 const WarningDialog: FC<
   Pick<
     ConfirmDialogProps,
-    "open" | "onClose" | "title" | "confirmText" | "description"
-  > & { onConfirm: (shouldIgnore: boolean) => void }
-> = ({ open, onConfirm, onClose, title, confirmText, description }) => {
-  const [shouldIgnore, setShouldIgnore] = useState(false)
-
-  return (
-    <ConfirmDialog
-      type="info"
-      hideCancel={false}
-      open={open}
-      onConfirm={() => {
-        onConfirm(shouldIgnore)
-      }}
-      onClose={onClose}
-      title={title}
-      confirmText={confirmText}
-      description={
-        <>
-          <div>{description}</div>
-          <FormControlLabel
-            sx={{
-              marginTop: 2,
-            }}
-            control={
-              <Checkbox
-                size="small"
-                onChange={(e) => {
-                  setShouldIgnore(e.target.checked)
-                }}
-              />
-            }
-            label="Don't show me this message again"
-          />
-        </>
-      }
-    />
-  )
-}
-
-const useBuildLogs = (workspace: TypesGen.Workspace) => {
-  const buildNumber = workspace.latest_build.build_number.toString()
-  const [buildState, buildSend] = useMachine(workspaceBuildMachine, {
-    context: {
-      buildNumber,
-      username: workspace.owner_name,
-      workspaceName: workspace.name,
-      timeCursor: new Date(),
-    },
-  })
-  const { logs } = buildState.context
-
-  useEffect(() => {
-    buildSend({ type: "RESET", buildNumber, timeCursor: new Date() })
-  }, [buildNumber, buildSend])
-
-  return logs
-}
+    "open" | "onClose" | "title" | "confirmText" | "description" | "onConfirm"
+  >
+> = (props) => {
+  return <ConfirmDialog type="info" hideCancel={false} {...props} />;
+};
diff --git a/site/src/pages/WorkspacePage/WorkspaceStats.stories.tsx b/site/src/pages/WorkspacePage/WorkspaceStats.stories.tsx
new file mode 100644
index 0000000000000..de444ba38960f
--- /dev/null
+++ b/site/src/pages/WorkspacePage/WorkspaceStats.stories.tsx
@@ -0,0 +1,53 @@
+import { Meta, StoryObj } from "@storybook/react";
+import {
+  MockWorkspace,
+  MockAppearanceConfig,
+  MockBuildInfo,
+  MockEntitlementsWithScheduling,
+  MockExperiments,
+} from "testHelpers/entities";
+import { WorkspaceStats } from "./WorkspaceStats";
+import { DashboardProviderContext } from "components/Dashboard/DashboardProvider";
+
+const MockedAppearance = {
+  config: MockAppearanceConfig,
+  isPreview: false,
+  setPreview: () => {},
+};
+
+const meta: Meta<typeof WorkspaceStats> = {
+  title: "pages/WorkspacePage/WorkspaceStats",
+  component: WorkspaceStats,
+  decorators: [
+    (Story) => (
+      <DashboardProviderContext.Provider
+        value={{
+          buildInfo: MockBuildInfo,
+          entitlements: MockEntitlementsWithScheduling,
+          experiments: MockExperiments,
+          appearance: MockedAppearance,
+        }}
+      >
+        <Story />
+      </DashboardProviderContext.Provider>
+    ),
+  ],
+};
+
+export default meta;
+type Story = StoryObj<typeof WorkspaceStats>;
+
+export const Example: Story = {
+  args: {
+    workspace: MockWorkspace,
+  },
+};
+
+export const Outdated: Story = {
+  args: {
+    workspace: {
+      ...MockWorkspace,
+      outdated: true,
+    },
+  },
+};
diff --git a/site/src/pages/WorkspacePage/WorkspaceStats.tsx b/site/src/pages/WorkspacePage/WorkspaceStats.tsx
new file mode 100644
index 0000000000000..773be0baa59f6
--- /dev/null
+++ b/site/src/pages/WorkspacePage/WorkspaceStats.tsx
@@ -0,0 +1,416 @@
+import Link from "@mui/material/Link";
+import { WorkspaceOutdatedTooltip } from "components/WorkspaceOutdatedTooltip/WorkspaceOutdatedTooltip";
+import { FC } from "react";
+import { Link as RouterLink } from "react-router-dom";
+import { createDayString } from "utils/createDayString";
+import {
+  getDisplayWorkspaceBuildInitiatedBy,
+  getDisplayWorkspaceTemplateName,
+  isWorkspaceOn,
+} from "utils/workspace";
+import { Workspace } from "api/typesGenerated";
+import { Stats, StatsItem } from "components/Stats/Stats";
+import upperFirst from "lodash/upperFirst";
+import { autostartDisplay, autostopDisplay } from "utils/schedule";
+import IconButton from "@mui/material/IconButton";
+import RemoveIcon from "@mui/icons-material/RemoveOutlined";
+import { makeStyles } from "@mui/styles";
+import AddIcon from "@mui/icons-material/AddOutlined";
+import TextField from "@mui/material/TextField";
+import Button from "@mui/material/Button";
+import { WorkspaceStatusText } from "components/WorkspaceStatusBadge/WorkspaceStatusBadge";
+import { DormantDeletionStat } from "components/WorkspaceDeletion";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+  usePopover,
+} from "components/Popover/Popover";
+
+const Language = {
+  workspaceDetails: "Workspace Details",
+  templateLabel: "Template",
+  statusLabel: "Workspace Status",
+  versionLabel: "Version",
+  lastBuiltLabel: "Last built",
+  outdated: "Outdated",
+  upToDate: "Up to date",
+  byLabel: "Last built by",
+  costLabel: "Daily cost",
+};
+
+export interface WorkspaceStatsProps {
+  workspace: Workspace;
+  maxDeadlineIncrease: number;
+  maxDeadlineDecrease: number;
+  canUpdateWorkspace: boolean;
+  quotaBudget?: number;
+  onDeadlinePlus: (hours: number) => void;
+  onDeadlineMinus: (hours: number) => void;
+  handleUpdate: () => void;
+}
+
+export const WorkspaceStats: FC<WorkspaceStatsProps> = ({
+  workspace,
+  quotaBudget,
+  maxDeadlineDecrease,
+  maxDeadlineIncrease,
+  canUpdateWorkspace,
+  handleUpdate,
+  onDeadlineMinus,
+  onDeadlinePlus,
+}) => {
+  const initiatedBy = getDisplayWorkspaceBuildInitiatedBy(
+    workspace.latest_build,
+  );
+  const displayTemplateName = getDisplayWorkspaceTemplateName(workspace);
+  const styles = useStyles();
+  const deadlinePlusEnabled = maxDeadlineIncrease >= 1;
+  const deadlineMinusEnabled = maxDeadlineDecrease >= 1;
+
+  return (
+    <>
+      <Stats aria-label={Language.workspaceDetails} className={styles.stats}>
+        <StatsItem
+          className={styles.statsItem}
+          label="Status"
+          value={<WorkspaceStatusText workspace={workspace} />}
+        />
+        <DormantDeletionStat workspace={workspace} />
+        <StatsItem
+          className={styles.statsItem}
+          label={Language.templateLabel}
+          value={
+            <Link
+              component={RouterLink}
+              to={`/templates/${workspace.template_name}`}
+            >
+              {displayTemplateName}
+            </Link>
+          }
+        />
+        <StatsItem
+          className={styles.statsItem}
+          label={Language.versionLabel}
+          value={
+            <>
+              <Link
+                component={RouterLink}
+                to={`/templates/${workspace.template_name}/versions/${workspace.latest_build.template_version_name}`}
+              >
+                {workspace.latest_build.template_version_name}
+              </Link>
+
+              {workspace.outdated && (
+                <WorkspaceOutdatedTooltip
+                  templateName={workspace.template_name}
+                  latestVersionId={workspace.template_active_version_id}
+                  onUpdateVersion={handleUpdate}
+                  ariaLabel="update version"
+                />
+              )}
+            </>
+          }
+        />
+        <StatsItem
+          className={styles.statsItem}
+          label={Language.lastBuiltLabel}
+          value={
+            <>
+              {upperFirst(createDayString(workspace.latest_build.created_at))}{" "}
+              by {initiatedBy}
+            </>
+          }
+        />
+        {shouldDisplayScheduleLabel(workspace) && (
+          <StatsItem
+            className={styles.statsItem}
+            label={getScheduleLabel(workspace)}
+            value={
+              <span className={styles.scheduleValue}>
+                <Link
+                  component={RouterLink}
+                  to="settings/schedule"
+                  title="Schedule settings"
+                >
+                  {isWorkspaceOn(workspace)
+                    ? autostopDisplay(workspace)
+                    : autostartDisplay(workspace.autostart_schedule)}
+                </Link>
+                {canUpdateWorkspace && canEditDeadline(workspace) && (
+                  <span className={styles.scheduleControls}>
+                    <Popover>
+                      <PopoverTrigger>
+                        <IconButton
+                          disabled={!deadlineMinusEnabled}
+                          size="small"
+                          title="Subtract hours from deadline"
+                          className={styles.scheduleButton}
+                        >
+                          <RemoveIcon />
+                        </IconButton>
+                      </PopoverTrigger>
+                      <PopoverContent
+                        id="schedule-sub"
+                        classes={{ paper: styles.timePopoverPaper }}
+                        horizontal="right"
+                      >
+                        <DecreaseTimeContent
+                          maxDeadlineDecrease={maxDeadlineDecrease}
+                          onDeadlineMinus={onDeadlineMinus}
+                        />
+                      </PopoverContent>
+                    </Popover>
+                    <Popover>
+                      <PopoverTrigger>
+                        <IconButton
+                          disabled={!deadlinePlusEnabled}
+                          size="small"
+                          title="Add hours to deadline"
+                          className={styles.scheduleButton}
+                        >
+                          <AddIcon />
+                        </IconButton>
+                      </PopoverTrigger>
+                      <PopoverContent
+                        id="schedule-add"
+                        classes={{ paper: styles.timePopoverPaper }}
+                        horizontal="right"
+                      >
+                        <AddTimeContent
+                          maxDeadlineIncrease={maxDeadlineIncrease}
+                          onDeadlinePlus={onDeadlinePlus}
+                        />
+                      </PopoverContent>
+                    </Popover>
+                  </span>
+                )}
+              </span>
+            }
+          />
+        )}
+        {workspace.latest_build.daily_cost > 0 && (
+          <StatsItem
+            className={styles.statsItem}
+            label={Language.costLabel}
+            value={`${workspace.latest_build.daily_cost} ${
+              quotaBudget ? `/ ${quotaBudget}` : ""
+            }`}
+          />
+        )}
+      </Stats>
+    </>
+  );
+};
+
+const AddTimeContent = (props: {
+  maxDeadlineIncrease: number;
+  onDeadlinePlus: (value: number) => void;
+}) => {
+  const styles = useStyles();
+  const popover = usePopover();
+
+  return (
+    <>
+      <span className={styles.timePopoverTitle}>Add hours to deadline</span>
+      <span className={styles.timePopoverDescription}>
+        Delay the shutdown of this workspace for a few more hours. This is only
+        applied once.
+      </span>
+      <form
+        className={styles.timePopoverForm}
+        onSubmit={(e) => {
+          e.preventDefault();
+          const formData = new FormData(e.currentTarget);
+          const hours = Number(formData.get("hours"));
+          props.onDeadlinePlus(hours);
+          popover.setIsOpen(false);
+        }}
+      >
+        <TextField
+          name="hours"
+          type="number"
+          size="small"
+          fullWidth
+          className={styles.timePopoverField}
+          InputProps={{
+            className: styles.timePopoverFieldInput,
+          }}
+          inputProps={{
+            min: 0,
+            max: props.maxDeadlineIncrease,
+            step: 1,
+            defaultValue: 1,
+          }}
+        />
+
+        <Button className={styles.timePopoverButton} type="submit">
+          Apply
+        </Button>
+      </form>
+    </>
+  );
+};
+
+export const DecreaseTimeContent = (props: {
+  onDeadlineMinus: (hours: number) => void;
+  maxDeadlineDecrease: number;
+}) => {
+  const styles = useStyles();
+  const popover = usePopover();
+
+  return (
+    <>
+      <span className={styles.timePopoverTitle}>
+        Subtract hours to deadline
+      </span>
+      <span className={styles.timePopoverDescription}>
+        Anticipate the shutdown of this workspace for a few more hours. This is
+        only applied once.
+      </span>
+      <form
+        className={styles.timePopoverForm}
+        onSubmit={(e) => {
+          e.preventDefault();
+          const formData = new FormData(e.currentTarget);
+          const hours = Number(formData.get("hours"));
+          props.onDeadlineMinus(hours);
+          popover.setIsOpen(false);
+        }}
+      >
+        <TextField
+          name="hours"
+          type="number"
+          size="small"
+          fullWidth
+          className={styles.timePopoverField}
+          InputProps={{
+            className: styles.timePopoverFieldInput,
+          }}
+          inputProps={{
+            min: 0,
+            max: props.maxDeadlineDecrease,
+            step: 1,
+            defaultValue: 1,
+          }}
+        />
+
+        <Button className={styles.timePopoverButton} type="submit">
+          Apply
+        </Button>
+      </form>
+    </>
+  );
+};
+
+export const canEditDeadline = (workspace: Workspace): boolean => {
+  return isWorkspaceOn(workspace) && Boolean(workspace.latest_build.deadline);
+};
+
+export const shouldDisplayScheduleLabel = (workspace: Workspace): boolean => {
+  if (canEditDeadline(workspace)) {
+    return true;
+  }
+  if (isWorkspaceOn(workspace)) {
+    return false;
+  }
+  return Boolean(workspace.autostart_schedule);
+};
+
+const getScheduleLabel = (workspace: Workspace) => {
+  return isWorkspaceOn(workspace) ? "Stops at" : "Starts at";
+};
+
+const useStyles = makeStyles((theme) => ({
+  stats: {
+    padding: 0,
+    border: 0,
+    gap: theme.spacing(6),
+    rowGap: theme.spacing(3),
+    flex: 1,
+
+    [theme.breakpoints.down("md")]: {
+      display: "flex",
+      flexDirection: "column",
+      alignItems: "flex-start",
+      gap: theme.spacing(1),
+    },
+  },
+
+  statsItem: {
+    flexDirection: "column",
+    gap: 0,
+    padding: 0,
+
+    "& > span:first-of-type": {
+      fontSize: 12,
+      fontWeight: 500,
+    },
+  },
+
+  scheduleValue: {
+    display: "flex",
+    alignItems: "center",
+    gap: theme.spacing(1.5),
+  },
+
+  scheduleControls: {
+    display: "flex",
+    alignItems: "center",
+    gap: theme.spacing(0.5),
+  },
+
+  scheduleButton: {
+    border: `1px solid ${theme.palette.divider}`,
+    borderRadius: 4,
+    width: 20,
+    height: 20,
+
+    "& svg.MuiSvgIcon-root": {
+      width: theme.spacing(1.5),
+      height: theme.spacing(1.5),
+    },
+  },
+
+  timePopoverPaper: {
+    padding: theme.spacing(3),
+    maxWidth: theme.spacing(36),
+    marginTop: theme.spacing(1),
+    borderRadius: 4,
+    display: "flex",
+    flexDirection: "column",
+    gap: theme.spacing(1),
+  },
+
+  timePopoverTitle: {
+    fontWeight: 600,
+  },
+
+  timePopoverDescription: {
+    color: theme.palette.text.secondary,
+  },
+
+  timePopoverForm: {
+    display: "flex",
+    alignItems: "center",
+    gap: theme.spacing(1),
+    padding: theme.spacing(1, 0),
+  },
+
+  timePopoverField: {
+    margin: 0,
+  },
+
+  timePopoverFieldInput: {
+    fontSize: 14,
+    padding: theme.spacing(0),
+    borderRadius: 4,
+  },
+
+  timePopoverButton: {
+    borderRadius: 4,
+    paddingLeft: theme.spacing(2),
+    paddingRight: theme.spacing(2),
+    flexShrink: 0,
+  },
+}));
diff --git a/site/src/pages/WorkspaceSettingsPage/Sidebar.tsx b/site/src/pages/WorkspaceSettingsPage/Sidebar.tsx
index b2b8cb30c661c..cffa51c4bf619 100644
--- a/site/src/pages/WorkspaceSettingsPage/Sidebar.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/Sidebar.tsx
@@ -1,18 +1,18 @@
-import { makeStyles } from "@mui/styles"
-import ScheduleIcon from "@mui/icons-material/TimerOutlined"
-import { Workspace } from "api/typesGenerated"
-import { Stack } from "components/Stack/Stack"
-import { FC, ElementType, PropsWithChildren, ReactNode } from "react"
-import { Link, NavLink } from "react-router-dom"
-import { combineClasses } from "utils/combineClasses"
-import GeneralIcon from "@mui/icons-material/SettingsOutlined"
-import ParameterIcon from "@mui/icons-material/CodeOutlined"
-import { Avatar } from "components/Avatar/Avatar"
+import { makeStyles } from "@mui/styles";
+import ScheduleIcon from "@mui/icons-material/TimerOutlined";
+import { Workspace } from "api/typesGenerated";
+import { Stack } from "components/Stack/Stack";
+import { FC, ElementType, PropsWithChildren, ReactNode } from "react";
+import { Link, NavLink } from "react-router-dom";
+import { combineClasses } from "utils/combineClasses";
+import GeneralIcon from "@mui/icons-material/SettingsOutlined";
+import ParameterIcon from "@mui/icons-material/CodeOutlined";
+import { Avatar } from "components/Avatar/Avatar";
 
 const SidebarNavItem: FC<
   PropsWithChildren<{ href: string; icon: ReactNode }>
 > = ({ children, href, icon }) => {
-  const styles = useStyles()
+  const styles = useStyles();
   return (
     <NavLink
       end
@@ -29,21 +29,21 @@ const SidebarNavItem: FC<
         {children}
       </Stack>
     </NavLink>
-  )
-}
+  );
+};
 
 const SidebarNavItemIcon: React.FC<{ icon: ElementType }> = ({
   icon: Icon,
 }) => {
-  const styles = useStyles()
-  return <Icon className={styles.sidebarNavItemIcon} />
-}
+  const styles = useStyles();
+  return <Icon className={styles.sidebarNavItemIcon} />;
+};
 
 export const Sidebar: React.FC<{ username: string; workspace: Workspace }> = ({
   username,
   workspace,
 }) => {
-  const styles = useStyles()
+  const styles = useStyles();
 
   return (
     <nav className={styles.sidebar}>
@@ -79,8 +79,8 @@ export const Sidebar: React.FC<{ username: string; workspace: Workspace }> = ({
         Schedule
       </SidebarNavItem>
     </nav>
-  )
-}
+  );
+};
 
 const useStyles = makeStyles((theme) => ({
   sidebar: {
@@ -143,4 +143,4 @@ const useStyles = makeStyles((theme) => ({
     overflow: "hidden",
     textOverflow: "ellipsis",
   },
-}))
+}));
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersForm.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersForm.tsx
index 15c38499b8e1c..e281a740ed9ce 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersForm.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersForm.tsx
@@ -3,34 +3,32 @@ import {
   FormFooter,
   FormSection,
   HorizontalForm,
-} from "components/Form/Form"
-import { RichParameterInput } from "components/RichParameterInput/RichParameterInput"
-import { useFormik } from "formik"
-import { FC } from "react"
-import { useTranslation } from "react-i18next"
+} from "components/Form/Form";
+import { RichParameterInput } from "components/RichParameterInput/RichParameterInput";
+import { useFormik } from "formik";
+import { FC } from "react";
 import {
-  getInitialParameterValues,
+  getInitialRichParameterValues,
   useValidationSchemaForRichParameters,
-  workspaceBuildParameterValue,
-} from "utils/richParameters"
-import * as Yup from "yup"
-import { getFormHelpers } from "utils/formUtils"
+} from "utils/richParameters";
+import * as Yup from "yup";
+import { getFormHelpers } from "utils/formUtils";
 import {
   TemplateVersionParameter,
   WorkspaceBuildParameter,
-} from "api/typesGenerated"
+} from "api/typesGenerated";
 
 export type WorkspaceParametersFormValues = {
-  rich_parameter_values: WorkspaceBuildParameter[]
-}
+  rich_parameter_values: WorkspaceBuildParameter[];
+};
 
 export const WorkspaceParametersForm: FC<{
-  isSubmitting: boolean
-  templateVersionRichParameters: TemplateVersionParameter[]
-  buildParameters: WorkspaceBuildParameter[]
-  error: unknown
-  onCancel: () => void
-  onSubmit: (values: WorkspaceParametersFormValues) => void
+  isSubmitting: boolean;
+  templateVersionRichParameters: TemplateVersionParameter[];
+  buildParameters: WorkspaceBuildParameter[];
+  error: unknown;
+  onCancel: () => void;
+  onSubmit: (values: WorkspaceParametersFormValues) => void;
 }> = ({
   onCancel,
   onSubmit,
@@ -39,71 +37,61 @@ export const WorkspaceParametersForm: FC<{
   error,
   isSubmitting,
 }) => {
-  const { t } = useTranslation("workspaceSettingsPage")
-  const mutableParameters = templateVersionRichParameters.filter(
-    (param) => param.mutable === true,
-  )
-  const immutableParameters = templateVersionRichParameters.filter(
-    (param) => param.mutable === false,
-  )
   const form = useFormik<WorkspaceParametersFormValues>({
     onSubmit,
     initialValues: {
-      rich_parameter_values: getInitialParameterValues(
-        mutableParameters,
+      rich_parameter_values: getInitialRichParameterValues(
+        templateVersionRichParameters,
         buildParameters,
       ),
     },
     validationSchema: Yup.object({
       rich_parameter_values: useValidationSchemaForRichParameters(
-        "createWorkspacePage",
         templateVersionRichParameters,
       ),
     }),
-  })
+  });
   const getFieldHelpers = getFormHelpers<WorkspaceParametersFormValues>(
     form,
     error,
-  )
-  const hasEphemeralParameters = mutableParameters.some(
+  );
+  const hasEphemeralParameters = templateVersionRichParameters.some(
     (parameter) => parameter.ephemeral,
-  )
-  const hasNonEphemeralParameters = mutableParameters.some(
+  );
+  const hasNonEphemeralParameters = templateVersionRichParameters.some(
     (parameter) => !parameter.ephemeral,
-  )
+  );
+  const hasImmutableParameters = templateVersionRichParameters.some(
+    (parameter) => !parameter.mutable,
+  );
 
   return (
     <HorizontalForm onSubmit={form.handleSubmit} data-testid="form">
       {hasNonEphemeralParameters && (
         <FormSection
-          title={t("parameters").toString()}
-          description={t("parametersDescription").toString()}
+          title="Parameters"
+          description="Settings used by your template"
         >
           <FormFields>
-            {mutableParameters.map((parameter, index) =>
+            {templateVersionRichParameters.map((parameter, index) =>
               // Since we are adding the values to the form based on the index
               // we can't filter them to not loose the right index position
-              parameter.ephemeral ? null : (
+              parameter.mutable && !parameter.ephemeral ? (
                 <RichParameterInput
                   {...getFieldHelpers(
                     "rich_parameter_values[" + index + "].value",
                   )}
                   disabled={isSubmitting}
-                  index={index}
                   key={parameter.name}
                   onChange={async (value) => {
                     await form.setFieldValue("rich_parameter_values." + index, {
                       name: parameter.name,
                       value: value,
-                    })
+                    });
                   }}
                   parameter={parameter}
-                  initialValue={workspaceBuildParameterValue(
-                    buildParameters,
-                    parameter,
-                  )}
                 />
-              ),
+              ) : null,
             )}
           </FormFields>
         </FormSection>
@@ -114,28 +102,23 @@ export const WorkspaceParametersForm: FC<{
           description="These parameters only apply for a single workspace start."
         >
           <FormFields>
-            {mutableParameters.map((parameter, index) =>
+            {templateVersionRichParameters.map((parameter, index) =>
               // Since we are adding the values to the form based on the index
               // we can't filter them to not loose the right index position
-              parameter.ephemeral ? (
+              parameter.mutable && parameter.ephemeral ? (
                 <RichParameterInput
                   {...getFieldHelpers(
                     "rich_parameter_values[" + index + "].value",
                   )}
                   disabled={isSubmitting}
-                  index={index}
                   key={parameter.name}
                   onChange={async (value) => {
                     await form.setFieldValue("rich_parameter_values." + index, {
                       name: parameter.name,
                       value: value,
-                    })
+                    });
                   }}
                   parameter={parameter}
-                  initialValue={workspaceBuildParameterValue(
-                    buildParameters,
-                    parameter,
-                  )}
                 />
               ) : null,
             )}
@@ -143,42 +126,36 @@ export const WorkspaceParametersForm: FC<{
         </FormSection>
       )}
       {/* They are displayed here only for visibility purposes */}
-      {immutableParameters.length > 0 && (
+      {hasImmutableParameters && (
         <FormSection
           title="Immutable parameters"
           description={
             <>
-              These parameters are also provided by your Terraform configuration
-              but they{" "}
-              <strong>cannot be changed after creating the workspace.</strong>
+              These settings <strong>cannot be changed</strong> after creating
+              the workspace.
             </>
           }
         >
           <FormFields>
-            {immutableParameters.map((parameter, index) => (
-              <RichParameterInput
-                disabled
-                {...getFieldHelpers(
-                  "rich_parameter_values[" + index + "].value",
-                )}
-                index={index}
-                key={parameter.name}
-                onChange={async () => {
-                  throw new Error(
-                    "Cannot change immutable parameter after creation",
-                  )
-                }}
-                parameter={parameter}
-                initialValue={workspaceBuildParameterValue(
-                  buildParameters,
-                  parameter,
-                )}
-              />
-            ))}
+            {templateVersionRichParameters.map((parameter, index) =>
+              !parameter.mutable ? (
+                <RichParameterInput
+                  disabled
+                  {...getFieldHelpers(
+                    "rich_parameter_values[" + index + "].value",
+                  )}
+                  key={parameter.name}
+                  parameter={parameter}
+                  onChange={() => {
+                    throw new Error("Immutable parameters cannot be changed");
+                  }}
+                />
+              ) : null,
+            )}
           </FormFields>
         </FormSection>
       )}
       <FormFooter onCancel={onCancel} isLoading={isSubmitting} />
     </HorizontalForm>
-  )
-}
+  );
+};
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.stories.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.stories.tsx
index 6639674566251..bd21640a8fc7f 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.stories.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.stories.tsx
@@ -1,9 +1,5 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import {
-  WorkspaceParametersPageView,
-  WorkspaceParametersPageViewProps,
-} from "./WorkspaceParametersPage"
-import { action } from "@storybook/addon-actions"
+import { Meta, StoryObj } from "@storybook/react";
+import { WorkspaceParametersPageView } from "./WorkspaceParametersPage";
 import {
   MockWorkspaceBuildParameter1,
   MockWorkspaceBuildParameter2,
@@ -11,15 +7,15 @@ import {
   MockTemplateVersionParameter2,
   MockTemplateVersionParameter3,
   MockWorkspaceBuildParameter3,
-} from "testHelpers/entities"
+} from "testHelpers/entities";
 
-export default {
-  title: "pages/WorkspaceParametersPageView",
+const meta: Meta<typeof WorkspaceParametersPageView> = {
+  title: "pages/WorkspaceSettingsPage/WorkspaceParametersPageView",
   component: WorkspaceParametersPageView,
   args: {
     submitError: undefined,
     isSubmitting: false,
-    onCancel: action("cancel"),
+
     data: {
       buildParameters: [
         MockWorkspaceBuildParameter1,
@@ -36,11 +32,20 @@ export default {
       ],
     },
   },
-} as ComponentMeta<typeof WorkspaceParametersPageView>
+};
+
+export default meta;
+type Story = StoryObj<typeof WorkspaceParametersPageView>;
+
+const Example: Story = {};
 
-const Template: Story<WorkspaceParametersPageViewProps> = (args) => (
-  <WorkspaceParametersPageView {...args} />
-)
+export const Empty: Story = {
+  args: {
+    data: {
+      buildParameters: [],
+      templateVersionRichParameters: [],
+    },
+  },
+};
 
-export const Example = Template.bind({})
-Example.args = {}
+export { Example as WorkspaceParametersPage };
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.test.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.test.tsx
index b100c5bda56f8..18267f7a8f25d 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.test.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.test.tsx
@@ -1,11 +1,11 @@
-import userEvent from "@testing-library/user-event"
+import userEvent from "@testing-library/user-event";
 import {
   renderWithWorkspaceSettingsLayout,
   waitForLoaderToBeRemoved,
-} from "testHelpers/renderHelpers"
-import WorkspaceParametersPage from "./WorkspaceParametersPage"
-import { screen, waitFor, within } from "@testing-library/react"
-import * as api from "api/api"
+} from "testHelpers/renderHelpers";
+import WorkspaceParametersPage from "./WorkspaceParametersPage";
+import { screen, waitFor, within } from "@testing-library/react";
+import * as api from "api/api";
 import {
   MockWorkspace,
   MockTemplateVersionParameter1,
@@ -13,53 +13,55 @@ import {
   MockWorkspaceBuildParameter1,
   MockWorkspaceBuildParameter2,
   MockWorkspaceBuild,
-} from "testHelpers/entities"
+  MockTemplateVersionParameter4,
+  MockWorkspaceBuildParameter4,
+} from "testHelpers/entities";
 
 test("Submit the workspace settings page successfully", async () => {
   // Mock the API calls that loads data
   jest
     .spyOn(api, "getWorkspaceByOwnerAndName")
-    .mockResolvedValueOnce(MockWorkspace)
-  jest
-    .spyOn(api, "getTemplateVersionRichParameters")
-    .mockResolvedValueOnce([
-      MockTemplateVersionParameter1,
-      MockTemplateVersionParameter2,
-    ])
-  jest
-    .spyOn(api, "getWorkspaceBuildParameters")
-    .mockResolvedValueOnce([
-      MockWorkspaceBuildParameter1,
-      MockWorkspaceBuildParameter2,
-    ])
+    .mockResolvedValueOnce(MockWorkspace);
+  jest.spyOn(api, "getTemplateVersionRichParameters").mockResolvedValueOnce([
+    MockTemplateVersionParameter1,
+    MockTemplateVersionParameter2,
+    // Immutable parameters
+    MockTemplateVersionParameter4,
+  ]);
+  jest.spyOn(api, "getWorkspaceBuildParameters").mockResolvedValueOnce([
+    MockWorkspaceBuildParameter1,
+    MockWorkspaceBuildParameter2,
+    // Immutable value
+    MockWorkspaceBuildParameter4,
+  ]);
   // Mock the API calls that submit data
   const postWorkspaceBuildSpy = jest
     .spyOn(api, "postWorkspaceBuild")
-    .mockResolvedValue(MockWorkspaceBuild)
+    .mockResolvedValue(MockWorkspaceBuild);
   // Setup event and rendering
-  const user = userEvent.setup()
+  const user = userEvent.setup();
   renderWithWorkspaceSettingsLayout(<WorkspaceParametersPage />, {
     route: "/@test-user/test-workspace/settings",
     path: "/:username/:workspace/settings",
     // Need this because after submit the user is redirected
     extraRoutes: [{ path: "/:username/:workspace", element: <div /> }],
-  })
-  await waitForLoaderToBeRemoved()
+  });
+  await waitForLoaderToBeRemoved();
   // Fill the form and submit
-  const form = screen.getByTestId("form")
+  const form = screen.getByTestId("form");
   const parameter1 = within(form).getByLabelText(
     MockWorkspaceBuildParameter1.name,
     { exact: false },
-  )
-  await user.clear(parameter1)
-  await user.type(parameter1, "new-value")
+  );
+  await user.clear(parameter1);
+  await user.type(parameter1, "new-value");
   const parameter2 = within(form).getByLabelText(
     MockWorkspaceBuildParameter2.name,
     { exact: false },
-  )
-  await user.clear(parameter2)
-  await user.type(parameter2, "1")
-  await user.click(within(form).getByRole("button", { name: "Submit" }))
+  );
+  await user.clear(parameter2);
+  await user.type(parameter2, "1");
+  await user.click(within(form).getByRole("button", { name: "Submit" }));
   // Assert that the API calls were made with the correct data
   await waitFor(() => {
     expect(postWorkspaceBuildSpy).toHaveBeenCalledWith(MockWorkspace.id, {
@@ -68,6 +70,6 @@ test("Submit the workspace settings page successfully", async () => {
         { name: MockTemplateVersionParameter1.name, value: "new-value" },
         { name: MockTemplateVersionParameter2.name, value: "1" },
       ],
-    })
-  })
-})
+    });
+  });
+});
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.tsx
index 80a13b622502e..c7656c8ea04d2 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.tsx
@@ -1,37 +1,41 @@
-import { getWorkspaceParameters, postWorkspaceBuild } from "api/api"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { useWorkspaceSettingsContext } from "../WorkspaceSettingsLayout"
-import { useMutation, useQuery } from "@tanstack/react-query"
-import { Loader } from "components/Loader/Loader"
+import { getWorkspaceParameters, postWorkspaceBuild } from "api/api";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { useWorkspaceSettings } from "../WorkspaceSettingsLayout";
+import { useMutation, useQuery } from "react-query";
+import { Loader } from "components/Loader/Loader";
 import {
   WorkspaceParametersFormValues,
   WorkspaceParametersForm,
-} from "./WorkspaceParametersForm"
-import { useNavigate } from "react-router-dom"
-import { makeStyles } from "@mui/styles"
-import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader"
-import { FC } from "react"
-import { isApiValidationError } from "api/errors"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
+} from "./WorkspaceParametersForm";
+import { useNavigate } from "react-router-dom";
+import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader";
+import { FC } from "react";
+import { isApiValidationError } from "api/errors";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { WorkspaceBuildParameter } from "api/typesGenerated";
+import { EmptyState } from "components/EmptyState/EmptyState";
+import Button from "@mui/material/Button";
+import OpenInNewOutlined from "@mui/icons-material/OpenInNewOutlined";
+import { docs } from "utils/docs";
 
 const WorkspaceParametersPage = () => {
-  const { workspace } = useWorkspaceSettingsContext()
-  const query = useQuery({
+  const workspace = useWorkspaceSettings();
+  const parameters = useQuery({
     queryKey: ["workspace", workspace.id, "parameters"],
     queryFn: () => getWorkspaceParameters(workspace),
-  })
-  const navigate = useNavigate()
-  const mutation = useMutation({
-    mutationFn: (formValues: WorkspaceParametersFormValues) =>
+  });
+  const navigate = useNavigate();
+  const updateParameters = useMutation({
+    mutationFn: (buildParameters: WorkspaceBuildParameter[]) =>
       postWorkspaceBuild(workspace.id, {
         transition: "start",
-        rich_parameter_values: formValues.rich_parameter_values,
+        rich_parameter_values: buildParameters,
       }),
     onSuccess: () => {
-      navigate(`/${workspace.owner_name}/${workspace.name}`)
+      navigate(`/${workspace.owner_name}/${workspace.name}`);
     },
-  })
+  });
 
   return (
     <>
@@ -40,34 +44,46 @@ const WorkspaceParametersPage = () => {
       </Helmet>
 
       <WorkspaceParametersPageView
-        data={query.data}
-        submitError={mutation.error}
-        isSubmitting={mutation.isLoading}
-        onSubmit={mutation.mutate}
+        data={parameters.data}
+        submitError={updateParameters.error}
+        isSubmitting={updateParameters.isLoading}
+        onSubmit={(values) => {
+          // When updating the parameters, the API does not accept immutable
+          // values so we need to filter them
+          const onlyMultableValues = parameters
+            .data!.templateVersionRichParameters.filter((p) => p.mutable)
+            .map(
+              (p) =>
+                values.rich_parameter_values.find((v) => v.name === p.name)!,
+            );
+          updateParameters.mutate(onlyMultableValues);
+        }}
         onCancel={() => {
-          navigate("../..")
+          navigate("../..");
         }}
       />
     </>
-  )
-}
+  );
+};
 
 export type WorkspaceParametersPageViewProps = {
-  data: Awaited<ReturnType<typeof getWorkspaceParameters>> | undefined
-  submitError: unknown
-  isSubmitting: boolean
-  onSubmit: (formValues: WorkspaceParametersFormValues) => void
-  onCancel: () => void
-}
+  data: Awaited<ReturnType<typeof getWorkspaceParameters>> | undefined;
+  submitError: unknown;
+  isSubmitting: boolean;
+  onSubmit: (formValues: WorkspaceParametersFormValues) => void;
+  onCancel: () => void;
+};
 
 export const WorkspaceParametersPageView: FC<
   WorkspaceParametersPageViewProps
 > = ({ data, submitError, isSubmitting, onSubmit, onCancel }) => {
-  const styles = useStyles()
-
   return (
     <>
-      <PageHeader className={styles.pageHeader}>
+      <PageHeader
+        css={{
+          paddingTop: 0,
+        }}
+      >
         <PageHeaderTitle>Workspace parameters</PageHeaderTitle>
       </PageHeader>
 
@@ -76,25 +92,41 @@ export const WorkspaceParametersPageView: FC<
       )}
 
       {data ? (
-        <WorkspaceParametersForm
-          buildParameters={data.buildParameters}
-          templateVersionRichParameters={data.templateVersionRichParameters}
-          error={submitError}
-          isSubmitting={isSubmitting}
-          onSubmit={onSubmit}
-          onCancel={onCancel}
-        />
+        data.templateVersionRichParameters.length > 0 ? (
+          <WorkspaceParametersForm
+            buildParameters={data.buildParameters}
+            templateVersionRichParameters={data.templateVersionRichParameters}
+            error={submitError}
+            isSubmitting={isSubmitting}
+            onSubmit={onSubmit}
+            onCancel={onCancel}
+          />
+        ) : (
+          <EmptyState
+            message="This workspace has no parameters"
+            cta={
+              <Button
+                component="a"
+                href={docs("/templates/parameters")}
+                startIcon={<OpenInNewOutlined />}
+                variant="contained"
+                target="_blank"
+                rel="noreferrer"
+              >
+                Learn more about parameters
+              </Button>
+            }
+            css={(theme) => ({
+              border: `1px solid ${theme.palette.divider}`,
+              borderRadius: theme.shape.borderRadius,
+            })}
+          />
+        )
       ) : (
         <Loader />
       )}
     </>
-  )
-}
-
-const useStyles = makeStyles(() => ({
-  pageHeader: {
-    paddingTop: 0,
-  },
-}))
+  );
+};
 
-export default WorkspaceParametersPage
+export default WorkspaceParametersPage;
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceScheduleForm.stories.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceScheduleForm.stories.tsx
new file mode 100644
index 0000000000000..6b643fd911bff
--- /dev/null
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceScheduleForm.stories.tsx
@@ -0,0 +1,98 @@
+import { Meta, StoryObj } from "@storybook/react";
+import dayjs from "dayjs";
+import advancedFormat from "dayjs/plugin/advancedFormat";
+import timezone from "dayjs/plugin/timezone";
+import utc from "dayjs/plugin/utc";
+import {
+  defaultSchedule,
+  emptySchedule,
+} from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule";
+import { emptyTTL } from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/ttl";
+import { mockApiError } from "testHelpers/entities";
+import { WorkspaceScheduleForm } from "./WorkspaceScheduleForm";
+
+dayjs.extend(advancedFormat);
+dayjs.extend(utc);
+dayjs.extend(timezone);
+
+const meta: Meta<typeof WorkspaceScheduleForm> = {
+  title: "pages/WorkspaceSettingsPage/WorkspaceScheduleForm",
+  component: WorkspaceScheduleForm,
+  args: {
+    enableAutoStart: true,
+    enableAutoStop: true,
+  },
+};
+
+export default meta;
+type Story = StoryObj<typeof WorkspaceScheduleForm>;
+
+const defaultInitialValues = {
+  autostartEnabled: true,
+  ...defaultSchedule(),
+  autostopEnabled: true,
+  ttl: 24,
+};
+
+export const AllDisabled: Story = {
+  args: {
+    initialValues: {
+      autostartEnabled: false,
+      ...emptySchedule,
+      autostopEnabled: false,
+      ttl: emptyTTL,
+    },
+    enableAutoStart: false,
+    enableAutoStop: false,
+  },
+};
+
+export const Autostart: Story = {
+  args: {
+    initialValues: {
+      autostartEnabled: true,
+      ...defaultSchedule(),
+      autostopEnabled: false,
+      ttl: emptyTTL,
+    },
+    enableAutoStop: false,
+  },
+};
+
+export const WorkspaceWillShutdownInTwoHours: Story = {
+  args: {
+    initialValues: { ...defaultInitialValues, ttl: 2 },
+  },
+};
+
+export const WorkspaceWillShutdownInADay: Story = {
+  args: {
+    initialValues: { ...defaultInitialValues, ttl: 24 },
+  },
+};
+
+export const WorkspaceWillShutdownInTwoDays: Story = {
+  args: {
+    initialValues: { ...defaultInitialValues, ttl: 48 },
+  },
+};
+
+export const WithError: Story = {
+  args: {
+    initialValues: { ...defaultInitialValues, ttl: 100 },
+    initialTouched: { ttl: true },
+    submitScheduleError: mockApiError({
+      message: "Something went wrong.",
+      validations: [
+        { field: "ttl_ms", detail: "Invalid time until shutdown." },
+      ],
+    }),
+  },
+};
+
+export const Loading: Story = {
+  args: {
+    initialValues: defaultInitialValues,
+    isLoading: true,
+  },
+};
diff --git a/site/src/components/WorkspaceScheduleForm/WorkspaceScheduleForm.test.ts b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceScheduleForm.test.ts
similarity index 81%
rename from site/src/components/WorkspaceScheduleForm/WorkspaceScheduleForm.test.ts
rename to site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceScheduleForm.test.ts
index ee74b3ba95722..57c5849180af1 100644
--- a/site/src/components/WorkspaceScheduleForm/WorkspaceScheduleForm.test.ts
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceScheduleForm.test.ts
@@ -3,8 +3,8 @@ import {
   ttlShutdownAt,
   validationSchema,
   WorkspaceScheduleFormValues,
-} from "./WorkspaceScheduleForm"
-import { zones } from "./zones"
+} from "./WorkspaceScheduleForm";
+import { timeZones } from "utils/timeZones";
 
 const valid: WorkspaceScheduleFormValues = {
   autostartEnabled: true,
@@ -20,7 +20,7 @@ const valid: WorkspaceScheduleFormValues = {
 
   autostopEnabled: true,
   ttl: 120,
-}
+};
 
 describe("validationSchema", () => {
   it("allows everything to be falsy when switches are off", () => {
@@ -38,19 +38,19 @@ describe("validationSchema", () => {
 
       autostopEnabled: false,
       ttl: 0,
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).not.toThrow()
-  })
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).not.toThrow();
+  });
 
   it("disallows ttl to be negative", () => {
     const values: WorkspaceScheduleFormValues = {
       ...valid,
       ttl: -1,
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).toThrow()
-  })
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).toThrow();
+  });
 
   it("disallows all days-of-week to be false when autostart is enabled", () => {
     const values: WorkspaceScheduleFormValues = {
@@ -62,10 +62,10 @@ describe("validationSchema", () => {
       thursday: false,
       friday: false,
       saturday: false,
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).toThrowError(Language.errorNoDayOfWeek)
-  })
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).toThrowError(Language.errorNoDayOfWeek);
+  });
 
   it("disallows empty startTime when autostart is enabled", () => {
     const values: WorkspaceScheduleFormValues = {
@@ -78,104 +78,104 @@ describe("validationSchema", () => {
       friday: false,
       saturday: false,
       startTime: "",
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).toThrowError(Language.errorNoTime)
-  })
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).toThrowError(Language.errorNoTime);
+  });
 
   it("allows startTime 16:20", () => {
     const values: WorkspaceScheduleFormValues = {
       ...valid,
       startTime: "16:20",
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).not.toThrow()
-  })
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).not.toThrow();
+  });
 
   it("disallows startTime to be H:mm", () => {
     const values: WorkspaceScheduleFormValues = {
       ...valid,
       startTime: "9:30",
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).toThrowError(Language.errorTime)
-  })
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).toThrowError(Language.errorTime);
+  });
 
   it("disallows startTime to be HH:m", () => {
     const values: WorkspaceScheduleFormValues = {
       ...valid,
       startTime: "09:5",
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).toThrowError(Language.errorTime)
-  })
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).toThrowError(Language.errorTime);
+  });
 
   it("disallows an invalid startTime 24:01", () => {
     const values: WorkspaceScheduleFormValues = {
       ...valid,
       startTime: "24:01",
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).toThrowError(Language.errorTime)
-  })
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).toThrowError(Language.errorTime);
+  });
 
   it("disallows an invalid startTime 09:60", () => {
     const values: WorkspaceScheduleFormValues = {
       ...valid,
       startTime: "09:60",
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).toThrowError(Language.errorTime)
-  })
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).toThrowError(Language.errorTime);
+  });
 
   it("disallows an invalid timezone Canada/North", () => {
     const values: WorkspaceScheduleFormValues = {
       ...valid,
       timezone: "Canada/North",
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).toThrowError(Language.errorTimezone)
-  })
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).toThrowError(Language.errorTimezone);
+  });
 
-  it.each<[string]>(zones.map((zone) => [zone]))(
+  it.each<[string]>(timeZones.map((zone) => [zone]))(
     `validation passes for tz=%p`,
     (zone) => {
       const values: WorkspaceScheduleFormValues = {
         ...valid,
         timezone: zone,
-      }
-      const validate = () => validationSchema.validateSync(values)
-      expect(validate).not.toThrow()
+      };
+      const validate = () => validationSchema.validateSync(values);
+      expect(validate).not.toThrow();
     },
-  )
+  );
 
   it("allows a ttl of 7 days", () => {
     const values: WorkspaceScheduleFormValues = {
       ...valid,
       ttl: 24 * 7,
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).not.toThrowError()
-  })
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).not.toThrowError();
+  });
 
   it("allows a ttl of 30 days", () => {
     const values: WorkspaceScheduleFormValues = {
       ...valid,
       ttl: 24 * 30,
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).not.toThrowError()
-  })
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).not.toThrowError();
+  });
 
   it("disallows a ttl of 30 days + 1 hour", () => {
     const values: WorkspaceScheduleFormValues = {
       ...valid,
       ttl: 24 * 30 + 1,
-    }
-    const validate = () => validationSchema.validateSync(values)
-    expect(validate).toThrowError(Language.errorTtlMax)
-  })
-})
+    };
+    const validate = () => validationSchema.validateSync(values);
+    expect(validate).toThrowError(Language.errorTtlMax);
+  });
+});
 
 describe("ttlShutdownAt", () => {
   it.each<[string, number, string]>([
@@ -205,6 +205,6 @@ describe("ttlShutdownAt", () => {
       `${Language.ttlCausesShutdownHelperText} 2 days ${Language.ttlCausesShutdownAfterStart}.`,
     ],
   ])("%p", (_, ttlHours, expected) => {
-    expect(ttlShutdownAt(ttlHours)).toEqual(expected)
-  })
-})
+    expect(ttlShutdownAt(ttlHours)).toEqual(expected);
+  });
+});
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceScheduleForm.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceScheduleForm.tsx
new file mode 100644
index 0000000000000..6bacd8b37afb1
--- /dev/null
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceScheduleForm.tsx
@@ -0,0 +1,436 @@
+import Checkbox from "@mui/material/Checkbox";
+import FormControl from "@mui/material/FormControl";
+import FormControlLabel from "@mui/material/FormControlLabel";
+import FormGroup from "@mui/material/FormGroup";
+import FormHelperText from "@mui/material/FormHelperText";
+import FormLabel from "@mui/material/FormLabel";
+import MenuItem from "@mui/material/MenuItem";
+import makeStyles from "@mui/styles/makeStyles";
+import Switch from "@mui/material/Switch";
+import TextField from "@mui/material/TextField";
+import {
+  HorizontalForm,
+  FormFooter,
+  FormSection,
+  FormFields,
+} from "components/Form/Form";
+import { Stack } from "components/Stack/Stack";
+import dayjs from "dayjs";
+import advancedFormat from "dayjs/plugin/advancedFormat";
+import duration from "dayjs/plugin/duration";
+import relativeTime from "dayjs/plugin/relativeTime";
+import timezone from "dayjs/plugin/timezone";
+import utc from "dayjs/plugin/utc";
+import { FormikTouched, useFormik } from "formik";
+import {
+  defaultSchedule,
+  emptySchedule,
+} from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule";
+import { ChangeEvent, FC } from "react";
+import * as Yup from "yup";
+import { getFormHelpers } from "utils/formUtils";
+import { timeZones } from "utils/timeZones";
+import { Pill } from "components/Pill/Pill";
+import Tooltip from "@mui/material/Tooltip";
+
+// REMARK: some plugins depend on utc, so it's listed first. Otherwise they're
+//         sorted alphabetically.
+dayjs.extend(utc);
+dayjs.extend(advancedFormat);
+dayjs.extend(duration);
+dayjs.extend(relativeTime);
+dayjs.extend(timezone);
+
+export const Language = {
+  errorNoDayOfWeek:
+    "Must set at least one day of week if autostart is enabled.",
+  errorNoTime: "Start time is required when autostart is enabled.",
+  errorTime: "Time must be in HH:mm format.",
+  errorTimezone: "Invalid timezone.",
+  errorNoStop:
+    "Time until shutdown must be greater than zero when autostop is enabled.",
+  errorTtlMax:
+    "Please enter a limit that is less than or equal to 720 hours (30 days).",
+  daysOfWeekLabel: "Days of Week",
+  daySundayLabel: "Sun",
+  dayMondayLabel: "Mon",
+  dayTuesdayLabel: "Tue",
+  dayWednesdayLabel: "Wed",
+  dayThursdayLabel: "Thu",
+  dayFridayLabel: "Fri",
+  daySaturdayLabel: "Sat",
+  startTimeLabel: "Start time",
+  timezoneLabel: "Timezone",
+  ttlLabel: "Time until shutdown (hours)",
+  ttlCausesShutdownHelperText: "Your workspace will shut down",
+  ttlCausesShutdownAfterStart:
+    "after its next start. We delay shutdown by this time whenever we detect activity",
+  ttlCausesNoShutdownHelperText:
+    "Your workspace will not automatically shut down.",
+  formTitle: "Workspace schedule",
+  startSection: "Start",
+  startSwitch: "Enable Autostart",
+  stopSection: "Stop",
+  stopSwitch: "Enable Autostop",
+};
+
+export interface WorkspaceScheduleFormProps {
+  submitScheduleError?: unknown;
+  initialValues: WorkspaceScheduleFormValues;
+  isLoading: boolean;
+  enableAutoStop: boolean;
+  enableAutoStart: boolean;
+  onCancel: () => void;
+  onSubmit: (values: WorkspaceScheduleFormValues) => void;
+  // for storybook
+  initialTouched?: FormikTouched<WorkspaceScheduleFormValues>;
+  defaultTTL: number;
+}
+
+export interface WorkspaceScheduleFormValues {
+  autostartEnabled: boolean;
+  sunday: boolean;
+  monday: boolean;
+  tuesday: boolean;
+  wednesday: boolean;
+  thursday: boolean;
+  friday: boolean;
+  saturday: boolean;
+  startTime: string;
+  timezone: string;
+
+  autostopEnabled: boolean;
+  ttl: number;
+}
+
+export const validationSchema = Yup.object({
+  sunday: Yup.boolean(),
+  monday: Yup.boolean().test(
+    "at-least-one-day",
+    Language.errorNoDayOfWeek,
+    function (value) {
+      const parent = this.parent as WorkspaceScheduleFormValues;
+
+      if (!parent.autostartEnabled) {
+        return true;
+      } else {
+        return ![
+          parent.sunday,
+          value,
+          parent.tuesday,
+          parent.wednesday,
+          parent.thursday,
+          parent.friday,
+          parent.saturday,
+        ].every((day) => day === false);
+      }
+    },
+  ),
+  tuesday: Yup.boolean(),
+  wednesday: Yup.boolean(),
+  thursday: Yup.boolean(),
+  friday: Yup.boolean(),
+  saturday: Yup.boolean(),
+
+  startTime: Yup.string()
+    .ensure()
+    .test("required-if-autostart", Language.errorNoTime, function (value) {
+      const parent = this.parent as WorkspaceScheduleFormValues;
+      if (parent.autostartEnabled) {
+        return value !== "";
+      } else {
+        return true;
+      }
+    })
+    .test("is-time-string", Language.errorTime, (value) => {
+      if (value === "") {
+        return true;
+      } else if (!/^[0-9][0-9]:[0-9][0-9]$/.test(value)) {
+        return false;
+      } else {
+        const parts = value.split(":");
+        const HH = Number(parts[0]);
+        const mm = Number(parts[1]);
+        return HH >= 0 && HH <= 23 && mm >= 0 && mm <= 59;
+      }
+    }),
+  timezone: Yup.string()
+    .ensure()
+    .test("is-timezone", Language.errorTimezone, function (value) {
+      const parent = this.parent as WorkspaceScheduleFormValues;
+
+      if (!parent.startTime) {
+        return true;
+      } else {
+        // Unfortunately, there's not a good API on dayjs at this time for
+        // evaluating a timezone. Attempt to parse today in the supplied timezone
+        // and return as valid if the function doesn't throw.
+        try {
+          dayjs.tz(dayjs(), value);
+          return true;
+        } catch (e) {
+          return false;
+        }
+      }
+    }),
+  ttl: Yup.number()
+    .integer()
+    .min(0)
+    .max(24 * 30 /* 30 days */, Language.errorTtlMax)
+    .test("positive-if-autostop", Language.errorNoStop, function (value) {
+      const parent = this.parent as WorkspaceScheduleFormValues;
+      if (parent.autostopEnabled) {
+        return Boolean(value);
+      } else {
+        return true;
+      }
+    }),
+});
+
+export const WorkspaceScheduleForm: FC<
+  React.PropsWithChildren<WorkspaceScheduleFormProps>
+> = ({
+  submitScheduleError,
+  initialValues,
+  isLoading,
+  onCancel,
+  onSubmit,
+  initialTouched,
+  defaultTTL,
+  enableAutoStop,
+  enableAutoStart,
+}) => {
+  const styles = useStyles();
+
+  const form = useFormik<WorkspaceScheduleFormValues>({
+    initialValues,
+    onSubmit,
+    validationSchema,
+    initialTouched,
+    enableReinitialize: true,
+  });
+  const formHelpers = getFormHelpers<WorkspaceScheduleFormValues>(
+    form,
+    submitScheduleError,
+  );
+
+  const checkboxes: Array<{ value: boolean; name: string; label: string }> = [
+    {
+      value: form.values.sunday,
+      name: "sunday",
+      label: Language.daySundayLabel,
+    },
+    {
+      value: form.values.monday,
+      name: "monday",
+      label: Language.dayMondayLabel,
+    },
+    {
+      value: form.values.tuesday,
+      name: "tuesday",
+      label: Language.dayTuesdayLabel,
+    },
+    {
+      value: form.values.wednesday,
+      name: "wednesday",
+      label: Language.dayWednesdayLabel,
+    },
+    {
+      value: form.values.thursday,
+      name: "thursday",
+      label: Language.dayThursdayLabel,
+    },
+    {
+      value: form.values.friday,
+      name: "friday",
+      label: Language.dayFridayLabel,
+    },
+    {
+      value: form.values.saturday,
+      name: "saturday",
+      label: Language.daySaturdayLabel,
+    },
+  ];
+
+  const handleToggleAutostart = async (e: ChangeEvent) => {
+    form.handleChange(e);
+    if (form.values.autostartEnabled) {
+      // disable autostart, clear values
+      await form.setValues({
+        ...form.values,
+        autostartEnabled: false,
+        ...emptySchedule,
+      });
+    } else {
+      // enable autostart, fill with defaults
+      await form.setValues({
+        ...form.values,
+        autostartEnabled: true,
+        ...defaultSchedule(),
+      });
+    }
+  };
+
+  const handleToggleAutostop = async (e: ChangeEvent) => {
+    form.handleChange(e);
+    if (form.values.autostopEnabled) {
+      // disable autostop, set TTL 0
+      await form.setValues({ ...form.values, autostopEnabled: false, ttl: 0 });
+    } else {
+      // enable autostop, fill with default TTL
+      await form.setValues({
+        ...form.values,
+        autostopEnabled: true,
+        ttl: defaultTTL,
+      });
+    }
+  };
+
+  return (
+    <HorizontalForm onSubmit={form.handleSubmit}>
+      <FormSection
+        title="Autostart"
+        description={
+          <>
+            <div css={{ marginBottom: 16 }}>
+              Select the time and days of week on which you want the workspace
+              starting automatically.
+            </div>
+            {!enableAutoStart && (
+              <Tooltip title="This option can be enabled in the template settings">
+                <Pill text="Disabled" />
+              </Tooltip>
+            )}
+          </>
+        }
+      >
+        <FormFields>
+          <FormControlLabel
+            control={
+              <Switch
+                disabled={!enableAutoStart}
+                name="autostartEnabled"
+                checked={form.values.autostartEnabled}
+                onChange={handleToggleAutostart}
+              />
+            }
+            label={Language.startSwitch}
+          />
+          <Stack direction="row">
+            <TextField
+              {...formHelpers("startTime")}
+              disabled={isLoading || !form.values.autostartEnabled}
+              label={Language.startTimeLabel}
+              type="time"
+              fullWidth
+            />
+            <TextField
+              {...formHelpers("timezone")}
+              disabled={isLoading || !form.values.autostartEnabled}
+              label={Language.timezoneLabel}
+              select
+              fullWidth
+            >
+              {timeZones.map((zone) => (
+                <MenuItem key={zone} value={zone}>
+                  {zone}
+                </MenuItem>
+              ))}
+            </TextField>
+          </Stack>
+
+          <FormControl component="fieldset" error={Boolean(form.errors.monday)}>
+            <FormLabel className={styles.daysOfWeekLabel} component="legend">
+              {Language.daysOfWeekLabel}
+            </FormLabel>
+
+            <FormGroup className={styles.daysOfWeekOptions}>
+              {checkboxes.map((checkbox) => (
+                <FormControlLabel
+                  control={
+                    <Checkbox
+                      checked={checkbox.value}
+                      disabled={isLoading || !form.values.autostartEnabled}
+                      onChange={form.handleChange}
+                      name={checkbox.name}
+                      size="small"
+                    />
+                  }
+                  key={checkbox.name}
+                  label={checkbox.label}
+                />
+              ))}
+            </FormGroup>
+
+            {form.errors.monday && (
+              <FormHelperText>{Language.errorNoDayOfWeek}</FormHelperText>
+            )}
+          </FormControl>
+        </FormFields>
+      </FormSection>
+
+      <FormSection
+        title="Autostop"
+        description={
+          <>
+            <div css={{ marginBottom: 16 }}>
+              Set how many hours should elapse after you log off before the
+              workspace automatically shuts down.
+            </div>
+            {!enableAutoStop && (
+              <Tooltip title="This option can be enabled in the template settings">
+                <Pill text="Disabled" />
+              </Tooltip>
+            )}
+          </>
+        }
+      >
+        <FormFields>
+          <FormControlLabel
+            control={
+              <Switch
+                name="autostopEnabled"
+                checked={form.values.autostopEnabled}
+                onChange={handleToggleAutostop}
+                disabled={!enableAutoStop}
+              />
+            }
+            label={Language.stopSwitch}
+          />
+          <TextField
+            {...formHelpers("ttl", ttlShutdownAt(form.values.ttl), "ttl_ms")}
+            disabled={isLoading || !form.values.autostopEnabled}
+            inputProps={{ min: 0, step: 1 }}
+            label={Language.ttlLabel}
+            type="number"
+            fullWidth
+          />
+        </FormFields>
+      </FormSection>
+      <FormFooter onCancel={onCancel} isLoading={isLoading} />
+    </HorizontalForm>
+  );
+};
+
+export const ttlShutdownAt = (formTTL: number): string => {
+  if (formTTL < 1) {
+    // Passing an empty value for TTL in the form results in a number that is not zero but less than 1.
+    return Language.ttlCausesNoShutdownHelperText;
+  } else {
+    return `${Language.ttlCausesShutdownHelperText} ${dayjs
+      .duration(formTTL, "hours")
+      .humanize()} ${Language.ttlCausesShutdownAfterStart}.`;
+  }
+};
+
+const useStyles = makeStyles((theme) => ({
+  daysOfWeekLabel: {
+    fontSize: 12,
+  },
+  daysOfWeekOptions: {
+    display: "flex",
+    flexDirection: "row",
+    flexWrap: "wrap",
+    paddingTop: theme.spacing(0.5),
+  },
+}));
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceSchedulePage.test.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceSchedulePage.test.tsx
index 85d0d0b6b6787..cf3f94cef47e9 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceSchedulePage.test.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceSchedulePage.test.tsx
@@ -1,30 +1,20 @@
-import { renderWithWorkspaceSettingsLayout } from "testHelpers/renderHelpers"
-import userEvent from "@testing-library/user-event"
-import { screen } from "@testing-library/react"
+import { renderWithWorkspaceSettingsLayout } from "testHelpers/renderHelpers";
+import userEvent from "@testing-library/user-event";
+import { screen } from "@testing-library/react";
+import { rest } from "msw";
+import { server } from "testHelpers/server";
+import { MockUser, MockWorkspace } from "testHelpers/entities";
 import {
   formValuesToAutostartRequest,
   formValuesToTTLRequest,
-} from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/formToRequest"
-import {
-  Autostart,
-  scheduleToAutostart,
-} from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule"
-import {
-  Autostop,
-  ttlMsToAutostop,
-} from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/ttl"
-import * as TypesGen from "../../../api/typesGenerated"
+} from "./formToRequest";
+import { scheduleToAutostart } from "./schedule";
+import { ttlMsToAutostop } from "./ttl";
 import {
   WorkspaceScheduleFormValues,
   Language as FormLanguage,
-} from "components/WorkspaceScheduleForm/WorkspaceScheduleForm"
-import { WorkspaceSchedulePage } from "./WorkspaceSchedulePage"
-import i18next from "i18next"
-import { server } from "testHelpers/server"
-import { rest } from "msw"
-import { MockUser, MockWorkspace } from "testHelpers/entities"
-
-const { t } = i18next
+} from "./WorkspaceScheduleForm";
+import { WorkspaceSchedulePage } from "./WorkspaceSchedulePage";
 
 const validValues: WorkspaceScheduleFormValues = {
   autostartEnabled: true,
@@ -39,13 +29,11 @@ const validValues: WorkspaceScheduleFormValues = {
   timezone: "Canada/Eastern",
   autostopEnabled: true,
   ttl: 120,
-}
+};
 
 describe("WorkspaceSchedulePage", () => {
   describe("formValuesToAutostartRequest", () => {
-    it.each<
-      [WorkspaceScheduleFormValues, TypesGen.UpdateWorkspaceAutostartRequest]
-    >([
+    it.each([
       [
         // Empty case
         {
@@ -146,13 +134,16 @@ describe("WorkspaceSchedulePage", () => {
           schedule: "20 16 * * 1,3,5",
         },
       ],
-    ])(`formValuesToAutostartRequest(%p) return %p`, (values, request) => {
-      expect(formValuesToAutostartRequest(values)).toEqual(request)
-    })
-  })
+    ] as const)(
+      `formValuesToAutostartRequest(%p) return %p`,
+      (values, request) => {
+        expect(formValuesToAutostartRequest(values)).toEqual(request);
+      },
+    );
+  });
 
   describe("formValuesToTTLRequest", () => {
-    it.each<[WorkspaceScheduleFormValues, TypesGen.UpdateWorkspaceTTLRequest]>([
+    it.each([
       [
         // 0 case
         {
@@ -183,13 +174,13 @@ describe("WorkspaceSchedulePage", () => {
           ttl_ms: 28_800_000,
         },
       ],
-    ])(`formValuesToTTLRequest(%p) returns %p`, (values, request) => {
-      expect(formValuesToTTLRequest(values)).toEqual(request)
-    })
-  })
+    ] as const)(`formValuesToTTLRequest(%p) returns %p`, (values, request) => {
+      expect(formValuesToTTLRequest(values)).toEqual(request);
+    });
+  });
 
   describe("scheduleToAutostart", () => {
-    it.each<[string | undefined, Autostart]>([
+    it.each([
       // Empty case
       [
         undefined,
@@ -240,23 +231,23 @@ describe("WorkspaceSchedulePage", () => {
           timezone: "Canada/Eastern",
         },
       ],
-    ])(`scheduleToAutostart(%p) returns %p`, (schedule, autostart) => {
-      expect(scheduleToAutostart(schedule)).toEqual(autostart)
-    })
-  })
+    ] as const)(`scheduleToAutostart(%p) returns %p`, (schedule, autostart) => {
+      expect(scheduleToAutostart(schedule)).toEqual(autostart);
+    });
+  });
 
   describe("ttlMsToAutostop", () => {
-    it.each<[number | undefined, Autostop]>([
+    it.each([
       // empty case
       [undefined, { autostopEnabled: false, ttl: 0 }],
       // zero
       [0, { autostopEnabled: false, ttl: 0 }],
       // basic case
       [28_800_000, { autostopEnabled: true, ttl: 8 }],
-    ])(`ttlMsToAutostop(%p) returns %p`, (ttlMs, autostop) => {
-      expect(ttlMsToAutostop(ttlMs)).toEqual(autostop)
-    })
-  })
+    ] as const)(`ttlMsToAutostop(%p) returns %p`, (ttlMs, autostop) => {
+      expect(ttlMsToAutostop(ttlMs)).toEqual(autostop);
+    });
+  });
 
   describe("autostop", () => {
     it("uses template default ttl when first enabled", async () => {
@@ -268,48 +259,47 @@ describe("WorkspaceSchedulePage", () => {
             return res(
               ctx.status(200),
               ctx.json({ ...MockWorkspace, ttl_ms: 0 }),
-            )
+            );
           },
         ),
-      )
+      );
       renderWithWorkspaceSettingsLayout(<WorkspaceSchedulePage />, {
         route: `/@${MockUser.username}/${MockWorkspace.name}/schedule`,
         path: "/:username/:workspace/schedule",
-      })
-      const user = userEvent.setup()
+      });
+      const user = userEvent.setup();
       const autostopToggle = await screen.findByLabelText(
         FormLanguage.stopSwitch,
-      )
+      );
       // enable autostop
-      await user.click(autostopToggle)
+      await user.click(autostopToggle);
       // find helper text that describes the mock template's 24 hour default
       const autostopHelperText = await screen.findByText(
         "Your workspace will shut down a day after",
         { exact: false },
-      )
-      expect(autostopHelperText).toBeDefined()
-    })
-  })
+      );
+      expect(autostopHelperText).toBeDefined();
+    });
+  });
 
   describe("autostop change dialog", () => {
     it("shows if autostop is changed", async () => {
       renderWithWorkspaceSettingsLayout(<WorkspaceSchedulePage />, {
         route: `/@${MockUser.username}/${MockWorkspace.name}/schedule`,
         path: "/:username/:workspace/schedule",
-      })
-      const user = userEvent.setup()
+      });
+      const user = userEvent.setup();
       const autostopToggle = await screen.findByLabelText(
         FormLanguage.stopSwitch,
-      )
-      await user.click(autostopToggle)
+      );
+      await user.click(autostopToggle);
       const submitButton = await screen.findByRole("button", {
         name: /submit/i,
-      })
-      await user.click(submitButton)
-      const title = t("dialogTitle", { ns: "workspaceSchedulePage" })
-      const dialog = await screen.findByText(title)
-      expect(dialog).toBeInTheDocument()
-    })
+      });
+      await user.click(submitButton);
+      const dialog = await screen.findByText("Restart workspace?");
+      expect(dialog).toBeInTheDocument();
+    });
 
     it("doesn't show if autostop is not changed", async () => {
       renderWithWorkspaceSettingsLayout(<WorkspaceSchedulePage />, {
@@ -318,19 +308,18 @@ describe("WorkspaceSchedulePage", () => {
         extraRoutes: [
           { path: "/:username/:workspace", element: <div>Workspace</div> },
         ],
-      })
-      const user = userEvent.setup()
+      });
+      const user = userEvent.setup();
       const autostartToggle = await screen.findByLabelText(
         FormLanguage.startSwitch,
-      )
-      await user.click(autostartToggle)
+      );
+      await user.click(autostartToggle);
       const submitButton = await screen.findByRole("button", {
         name: /submit/i,
-      })
-      await user.click(submitButton)
-      const title = t("dialogTitle", { ns: "workspaceSchedulePage" })
-      const dialog = screen.queryByText(title)
-      expect(dialog).not.toBeInTheDocument()
-    })
-  })
-})
+      });
+      await user.click(submitButton);
+      const dialog = screen.queryByText("Restart workspace?");
+      expect(dialog).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceSchedulePage.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceSchedulePage.tsx
index 778384fe8e7b6..08d116744e4a6 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceSchedulePage.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/WorkspaceSchedulePage.tsx
@@ -1,67 +1,59 @@
-import { makeStyles } from "@mui/styles"
-import { useMachine } from "@xstate/react"
-import { Alert } from "components/Alert/Alert"
-import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog"
-import { Loader } from "components/Loader/Loader"
-import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader"
-import dayjs from "dayjs"
-import { scheduleToAutostart } from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule"
-import { ttlMsToAutostop } from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/ttl"
-import { useWorkspaceSettingsContext } from "pages/WorkspaceSettingsPage/WorkspaceSettingsLayout"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { useTranslation } from "react-i18next"
-import { Navigate, useNavigate, useParams } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import { scheduleChanged } from "utils/schedule"
-import * as TypesGen from "../../../api/typesGenerated"
-import { WorkspaceScheduleForm } from "../../../components/WorkspaceScheduleForm/WorkspaceScheduleForm"
-import { workspaceSchedule } from "../../../xServices/workspaceSchedule/workspaceScheduleXService"
+import { useMachine } from "@xstate/react";
+import { Alert } from "components/Alert/Alert";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import { Loader } from "components/Loader/Loader";
+import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader";
+import dayjs from "dayjs";
+import {
+  scheduleToAutostart,
+  scheduleChanged,
+} from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule";
+import { ttlMsToAutostop } from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/ttl";
+import { useWorkspaceSettings } from "pages/WorkspaceSettingsPage/WorkspaceSettingsLayout";
+import { FC } from "react";
+import { Helmet } from "react-helmet-async";
+import { Navigate, useNavigate, useParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import * as TypesGen from "api/typesGenerated";
+import { workspaceByOwnerAndNameKey } from "api/queries/workspaces";
+import { WorkspaceScheduleForm } from "./WorkspaceScheduleForm";
+import { workspaceSchedule } from "xServices/workspaceSchedule/workspaceScheduleXService";
 import {
   formValuesToAutostartRequest,
   formValuesToTTLRequest,
-} from "./formToRequest"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
+} from "./formToRequest";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { useQueryClient } from "react-query";
 
 const getAutostart = (workspace: TypesGen.Workspace) =>
-  scheduleToAutostart(workspace.autostart_schedule)
+  scheduleToAutostart(workspace.autostart_schedule);
 const getAutostop = (workspace: TypesGen.Workspace) =>
-  ttlMsToAutostop(workspace.ttl_ms)
-
-const useStyles = makeStyles((theme) => ({
-  topMargin: {
-    marginTop: theme.spacing(3),
-  },
-  pageHeader: {
-    paddingTop: 0,
-  },
-}))
+  ttlMsToAutostop(workspace.ttl_ms);
 
 export const WorkspaceSchedulePage: FC = () => {
-  const { t } = useTranslation("workspaceSchedulePage")
-  const styles = useStyles()
-  const params = useParams() as { username: string; workspace: string }
-  const navigate = useNavigate()
-  const username = params.username.replace("@", "")
-  const workspaceName = params.workspace
-  const { workspace } = useWorkspaceSettingsContext()
+  const params = useParams() as { username: string; workspace: string };
+  const navigate = useNavigate();
+  const username = params.username.replace("@", "");
+  const workspaceName = params.workspace;
+  const queryClient = useQueryClient();
+  const workspace = useWorkspaceSettings();
   const [scheduleState, scheduleSend] = useMachine(workspaceSchedule, {
     context: { workspace },
-  })
+  });
   const {
     checkPermissionsError,
     submitScheduleError,
     getTemplateError,
     permissions,
     template,
-  } = scheduleState.context
+  } = scheduleState.context;
 
   if (!username || !workspaceName) {
-    return <Navigate to="/workspaces" />
+    return <Navigate to="/workspaces" />;
   }
 
   if (scheduleState.matches("done")) {
-    return <Navigate to={`/@${username}/${workspaceName}`} />
+    return <Navigate to={`/@${username}/${workspaceName}`} />;
   }
 
   return (
@@ -69,7 +61,11 @@ export const WorkspaceSchedulePage: FC = () => {
       <Helmet>
         <title>{pageTitle([workspaceName, "Schedule"])}</title>
       </Helmet>
-      <PageHeader className={styles.pageHeader}>
+      <PageHeader
+        css={{
+          paddingTop: 0,
+        }}
+      >
         <PageHeaderTitle>Workspace Schedule</PageHeaderTitle>
       </PageHeader>
       {(scheduleState.hasTag("loading") || !template) && <Loader />}
@@ -77,13 +73,18 @@ export const WorkspaceSchedulePage: FC = () => {
         <ErrorAlert error={checkPermissionsError || getTemplateError} />
       )}
       {permissions && !permissions.updateWorkspace && (
-        <Alert severity="error">{t("forbiddenError")}</Alert>
+        <Alert severity="error">
+          You don&apos;t have permissions to update the schedule for this
+          workspace.
+        </Alert>
       )}
       {template &&
         workspace &&
         (scheduleState.matches("presentForm") ||
           scheduleState.matches("submittingSchedule")) && (
           <WorkspaceScheduleForm
+            enableAutoStart={template.allow_user_autostart}
+            enableAutoStop={template.allow_user_autostop}
             submitScheduleError={submitScheduleError}
             initialValues={{
               ...getAutostart(workspace),
@@ -92,9 +93,9 @@ export const WorkspaceSchedulePage: FC = () => {
             isLoading={scheduleState.tags.has("loading")}
             defaultTTL={dayjs.duration(template.default_ttl_ms, "ms").asHours()}
             onCancel={() => {
-              navigate(`/@${username}/${workspaceName}`)
+              navigate(`/@${username}/${workspaceName}`);
             }}
-            onSubmit={(values) => {
+            onSubmit={async (values) => {
               scheduleSend({
                 type: "SUBMIT_SCHEDULE",
                 autostart: formValuesToAutostartRequest(values),
@@ -107,26 +108,30 @@ export const WorkspaceSchedulePage: FC = () => {
                   getAutostop(workspace),
                   values,
                 ),
-              })
+              });
+
+              await queryClient.invalidateQueries(
+                workspaceByOwnerAndNameKey(params.username, params.workspace),
+              );
             }}
           />
         )}
       <ConfirmDialog
         open={scheduleState.matches("showingRestartDialog")}
-        title={t("dialogTitle")}
-        description={t("dialogDescription")}
-        confirmText={t("restart")}
-        cancelText={t("applyLater").toString()}
+        title="Restart workspace?"
+        description="Would you like to restart your workspace now to apply your new autostop setting, or let it apply after your next workspace start?"
+        confirmText="Restart"
+        cancelText="Apply later"
         hideCancel={false}
         onConfirm={() => {
-          scheduleSend("RESTART_WORKSPACE")
+          scheduleSend("RESTART_WORKSPACE");
         }}
         onClose={() => {
-          scheduleSend("APPLY_LATER")
+          scheduleSend("APPLY_LATER");
         }}
       />
     </>
-  )
-}
+  );
+};
 
-export default WorkspaceSchedulePage
+export default WorkspaceSchedulePage;
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/formToRequest.ts b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/formToRequest.ts
index 3481540e99932..8096512e973db 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/formToRequest.ts
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/formToRequest.ts
@@ -1,5 +1,5 @@
-import * as TypesGen from "api/typesGenerated"
-import { WorkspaceScheduleFormValues } from "components/WorkspaceScheduleForm/WorkspaceScheduleForm"
+import * as TypesGen from "api/typesGenerated";
+import { WorkspaceScheduleFormValues } from "./WorkspaceScheduleForm";
 
 export const formValuesToAutostartRequest = (
   values: WorkspaceScheduleFormValues,
@@ -7,15 +7,15 @@ export const formValuesToAutostartRequest = (
   if (!values.autostartEnabled || !values.startTime) {
     return {
       schedule: "",
-    }
+    };
   }
 
-  const [HH, mm] = values.startTime.split(":")
+  const [HH, mm] = values.startTime.split(":");
 
   // Note: Space after CRON_TZ if timezone is defined
-  const preparedTZ = values.timezone ? `CRON_TZ=${values.timezone} ` : ""
+  const preparedTZ = values.timezone ? `CRON_TZ=${values.timezone} ` : "";
 
-  const makeCronString = (dow: string) => `${preparedTZ}${mm} ${HH} * * ${dow}`
+  const makeCronString = (dow: string) => `${preparedTZ}${mm} ${HH} * * ${dow}`;
 
   const days = [
     values.sunday,
@@ -25,9 +25,9 @@ export const formValuesToAutostartRequest = (
     values.thursday,
     values.friday,
     values.saturday,
-  ]
+  ];
 
-  const isEveryDay = days.every((day) => day)
+  const isEveryDay = days.every((day) => day);
 
   const isMonThroughFri =
     !values.sunday &&
@@ -37,32 +37,32 @@ export const formValuesToAutostartRequest = (
     values.thursday &&
     values.friday &&
     !values.saturday &&
-    !values.sunday
+    !values.sunday;
 
   // Handle special cases, falling through to comma-separation
   if (isEveryDay) {
     return {
       schedule: makeCronString("*"),
-    }
+    };
   } else if (isMonThroughFri) {
     return {
       schedule: makeCronString("1-5"),
-    }
+    };
   } else {
     const dow = days.reduce((previous, current, idx) => {
       if (!current) {
-        return previous
+        return previous;
       } else {
-        const prefix = previous ? "," : ""
-        return previous + prefix + idx
+        const prefix = previous ? "," : "";
+        return previous + prefix + idx;
       }
-    }, "")
+    }, "");
 
     return {
       schedule: makeCronString(dow),
-    }
+    };
   }
-}
+};
 
 export const formValuesToTTLRequest = (
   values: WorkspaceScheduleFormValues,
@@ -73,5 +73,5 @@ export const formValuesToTTLRequest = (
       values.autostopEnabled && values.ttl
         ? values.ttl * 60 * 60 * 1000
         : undefined,
-  }
-}
+  };
+};
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule.test.ts b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule.test.ts
new file mode 100644
index 0000000000000..765d6547970c8
--- /dev/null
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule.test.ts
@@ -0,0 +1,70 @@
+import { emptySchedule, scheduleChanged } from "./schedule";
+import { emptyTTL } from "./ttl";
+
+describe("scheduleChanged", () => {
+  describe("autostart", () => {
+    it("should be true if toggle values are different", () => {
+      const autostart = { autostartEnabled: true, ...emptySchedule };
+      const formValues = {
+        autostartEnabled: false,
+        ...emptySchedule,
+        autostopEnabled: false,
+        ttl: emptyTTL,
+      };
+      expect(scheduleChanged(autostart, formValues)).toBe(true);
+    });
+    it("should be true if schedule values are different", () => {
+      const autostart = { autostartEnabled: true, ...emptySchedule };
+      const formValues = {
+        autostartEnabled: true,
+        ...{ ...emptySchedule, monday: true, startTime: "09:00" },
+        autostopEnabled: false,
+        ttl: emptyTTL,
+      };
+      expect(scheduleChanged(autostart, formValues)).toBe(true);
+    });
+    it("should be false if all autostart values are the same", () => {
+      const autostart = { autostartEnabled: true, ...emptySchedule };
+      const formValues = {
+        autostartEnabled: true,
+        ...emptySchedule,
+        autostopEnabled: false,
+        ttl: emptyTTL,
+      };
+      expect(scheduleChanged(autostart, formValues)).toBe(false);
+    });
+  });
+
+  describe("autostop", () => {
+    it("should be true if toggle values are different", () => {
+      const autostop = { autostopEnabled: true, ttl: 1000 };
+      const formValues = {
+        autostartEnabled: false,
+        ...emptySchedule,
+        autostopEnabled: false,
+        ttl: 1000,
+      };
+      expect(scheduleChanged(autostop, formValues)).toBe(true);
+    });
+    it("should be true if ttl values are different", () => {
+      const autostop = { autostopEnabled: true, ttl: 1000 };
+      const formValues = {
+        autostartEnabled: false,
+        ...emptySchedule,
+        autostopEnabled: true,
+        ttl: 2000,
+      };
+      expect(scheduleChanged(autostop, formValues)).toBe(true);
+    });
+    it("should be false if all autostop values are the same", () => {
+      const autostop = { autostopEnabled: true, ttl: 1000 };
+      const formValues = {
+        autostartEnabled: false,
+        ...emptySchedule,
+        autostopEnabled: true,
+        ttl: 1000,
+      };
+      expect(scheduleChanged(autostop, formValues)).toBe(false);
+    });
+  });
+});
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule.ts b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule.ts
index a04c9f486c0b8..72dbfb9bffeb6 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule.ts
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule.ts
@@ -1,30 +1,34 @@
-import * as cronParser from "cron-parser"
-import dayjs from "dayjs"
-import timezone from "dayjs/plugin/timezone"
-import utc from "dayjs/plugin/utc"
-import { extractTimezone, stripTimezone } from "../../../utils/schedule"
+import * as cronParser from "cron-parser";
+import dayjs from "dayjs";
+import timezone from "dayjs/plugin/timezone";
+import utc from "dayjs/plugin/utc";
+import { extractTimezone, stripTimezone } from "utils/schedule";
+import { Autostop } from "./ttl";
+import { WorkspaceScheduleFormValues } from "./WorkspaceScheduleForm";
+import map from "lodash/map";
+import some from "lodash/some";
 
 // REMARK: timezone plugin depends on UTC
 //
 // SEE: https://day.js.org/docs/en/timezone/timezone
-dayjs.extend(utc)
-dayjs.extend(timezone)
+dayjs.extend(utc);
+dayjs.extend(timezone);
 
 export interface AutostartSchedule {
-  sunday: boolean
-  monday: boolean
-  tuesday: boolean
-  wednesday: boolean
-  thursday: boolean
-  friday: boolean
-  saturday: boolean
-  startTime: string
-  timezone: string
+  sunday: boolean;
+  monday: boolean;
+  tuesday: boolean;
+  wednesday: boolean;
+  thursday: boolean;
+  friday: boolean;
+  saturday: boolean;
+  startTime: string;
+  timezone: string;
 }
 
 export type Autostart = {
-  autostartEnabled: boolean
-} & AutostartSchedule
+  autostartEnabled: boolean;
+} & AutostartSchedule;
 
 export const emptySchedule = {
   sunday: false,
@@ -37,7 +41,7 @@ export const emptySchedule = {
 
   startTime: "",
   timezone: "",
-}
+};
 
 export const defaultSchedule = (): AutostartSchedule => ({
   sunday: false,
@@ -50,20 +54,20 @@ export const defaultSchedule = (): AutostartSchedule => ({
 
   startTime: "09:30",
   timezone: dayjs.tz.guess(),
-})
+});
 
 const transformSchedule = (schedule: string) => {
-  const timezone = extractTimezone(schedule, dayjs.tz.guess())
+  const timezone = extractTimezone(schedule, dayjs.tz.guess());
 
-  const expression = cronParser.parseExpression(stripTimezone(schedule))
+  const expression = cronParser.parseExpression(stripTimezone(schedule));
 
-  const HH = expression.fields.hour.join("").padStart(2, "0")
-  const mm = expression.fields.minute.join("").padStart(2, "0")
+  const HH = expression.fields.hour.join("").padStart(2, "0");
+  const mm = expression.fields.minute.join("").padStart(2, "0");
 
-  const weeklyFlags = [false, false, false, false, false, false, false]
+  const weeklyFlags = [false, false, false, false, false, false, false];
 
   for (const day of expression.fields.dayOfWeek) {
-    weeklyFlags[day % 7] = true
+    weeklyFlags[day % 7] = true;
   }
 
   return {
@@ -76,16 +80,28 @@ const transformSchedule = (schedule: string) => {
     saturday: weeklyFlags[6],
     startTime: `${HH}:${mm}`,
     timezone,
-  }
-}
+  };
+};
 
 export const scheduleToAutostart = (schedule?: string): Autostart => {
   if (schedule) {
     return {
       autostartEnabled: true,
       ...transformSchedule(schedule),
-    }
+    };
   } else {
-    return { autostartEnabled: false, ...emptySchedule }
+    return { autostartEnabled: false, ...emptySchedule };
   }
-}
+};
+
+export const scheduleChanged = (
+  initialValues: Autostart | Autostop,
+  formValues: WorkspaceScheduleFormValues,
+): boolean =>
+  some(
+    map(
+      { ...initialValues },
+      (v: boolean | string, k: keyof typeof initialValues) =>
+        formValues[k] !== v,
+    ),
+  );
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/ttl.ts b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/ttl.ts
index b77cbb29571da..7118494587662 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/ttl.ts
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSchedulePage/ttl.ts
@@ -1,13 +1,13 @@
 export interface Autostop {
-  autostopEnabled: boolean
-  ttl: number
+  autostopEnabled: boolean;
+  ttl: number;
 }
 
-export const emptyTTL = 0
+export const emptyTTL = 0;
 
-const msToHours = (ms: number) => Math.round(ms / (1000 * 60 * 60))
+const msToHours = (ms: number) => Math.round(ms / (1000 * 60 * 60));
 
 export const ttlMsToAutostop = (ttl_ms?: number): Autostop =>
   ttl_ms
     ? { autostopEnabled: true, ttl: msToHours(ttl_ms) }
-    : { autostopEnabled: false, ttl: 0 }
+    : { autostopEnabled: false, ttl: 0 };
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsForm.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsForm.tsx
index ee288c24bfc53..7626e12585797 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsForm.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsForm.tsx
@@ -1,50 +1,49 @@
+import TextField from "@mui/material/TextField";
 import {
   FormFields,
   FormFooter,
   FormSection,
   HorizontalForm,
-} from "components/Form/Form"
-import { useFormik } from "formik"
-import { FC } from "react"
-import { useTranslation } from "react-i18next"
-import * as Yup from "yup"
-import { nameValidator, getFormHelpers, onChangeTrimmed } from "utils/formUtils"
-import TextField from "@mui/material/TextField"
-import { Workspace } from "api/typesGenerated"
+} from "components/Form/Form";
+import { useFormik } from "formik";
+import { type FC } from "react";
+import * as Yup from "yup";
+import {
+  nameValidator,
+  getFormHelpers,
+  onChangeTrimmed,
+} from "utils/formUtils";
+import { Workspace } from "api/typesGenerated";
+import { Alert } from "components/Alert/Alert";
 
 export type WorkspaceSettingsFormValues = {
-  name: string
-}
+  name: string;
+};
 
 export const WorkspaceSettingsForm: FC<{
-  isSubmitting: boolean
-  workspace: Workspace
-  error: unknown
-  onCancel: () => void
-  onSubmit: (values: WorkspaceSettingsFormValues) => void
+  isSubmitting: boolean;
+  workspace: Workspace;
+  error: unknown;
+  onCancel: () => void;
+  onSubmit: (values: WorkspaceSettingsFormValues) => void;
 }> = ({ onCancel, onSubmit, workspace, error, isSubmitting }) => {
-  const { t } = useTranslation("workspaceSettingsPage")
-
   const form = useFormik<WorkspaceSettingsFormValues>({
     onSubmit,
     initialValues: {
       name: workspace.name,
     },
     validationSchema: Yup.object({
-      name: nameValidator(t("nameLabel")),
+      name: nameValidator("Name"),
     }),
-  })
+  });
   const getFieldHelpers = getFormHelpers<WorkspaceSettingsFormValues>(
     form,
     error,
-  )
+  );
 
   return (
     <HorizontalForm onSubmit={form.handleSubmit} data-testid="form">
-      <FormSection
-        title="General info"
-        description="The name of your new workspace."
-      >
+      <FormSection title="General" description="The name of your workspace.">
         <FormFields>
           <TextField
             {...getFieldHelpers("name")}
@@ -52,11 +51,17 @@ export const WorkspaceSettingsForm: FC<{
             onChange={onChangeTrimmed(form)}
             autoFocus
             fullWidth
-            label={t("nameLabel")}
+            label="Name"
           />
+          {form.values.name !== form.initialValues.name && (
+            <Alert severity="warning">
+              Depending on the template, renaming your workspace may be
+              destructive
+            </Alert>
+          )}
         </FormFields>
       </FormSection>
       <FormFooter onCancel={onCancel} isLoading={isSubmitting} />
     </HorizontalForm>
-  )
-}
+  );
+};
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsLayout.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsLayout.tsx
index 0abecb68a2354..a3c2340fda298 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsLayout.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsLayout.tsx
@@ -1,55 +1,48 @@
-import { makeStyles } from "@mui/styles"
-import { Sidebar } from "./Sidebar"
-import { Stack } from "components/Stack/Stack"
-import { createContext, FC, Suspense, useContext } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "../../utils/page"
-import { Loader } from "components/Loader/Loader"
-import { Outlet, useParams } from "react-router-dom"
-import { Margins } from "components/Margins/Margins"
-import { getWorkspaceByOwnerAndName } from "api/api"
-import { useQuery } from "@tanstack/react-query"
+import { createContext, type FC, Suspense, useContext } from "react";
+import { Helmet } from "react-helmet-async";
+import { Outlet, useParams } from "react-router-dom";
+import { useQuery } from "react-query";
+import { useTheme } from "@emotion/react";
+import type { Workspace } from "api/typesGenerated";
+import { workspaceByOwnerAndName } from "api/queries/workspaces";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { Loader } from "components/Loader/Loader";
+import { Margins } from "components/Margins/Margins";
+import { Stack } from "components/Stack/Stack";
+import { pageTitle } from "utils/page";
+import { Sidebar } from "./Sidebar";
 
-const fetchWorkspaceSettings = async (owner: string, name: string) => {
-  const workspace = await getWorkspaceByOwnerAndName(owner, name)
+const WorkspaceSettings = createContext<Workspace | undefined>(undefined);
 
-  return {
-    workspace,
-  }
-}
-
-const useWorkspace = (owner: string, name: string) => {
-  return useQuery({
-    queryKey: ["workspace", name, "settings"],
-    queryFn: () => fetchWorkspaceSettings(owner, name),
-  })
-}
-
-const WorkspaceSettingsContext = createContext<
-  Awaited<ReturnType<typeof fetchWorkspaceSettings>> | undefined
->(undefined)
-
-export const useWorkspaceSettingsContext = () => {
-  const context = useContext(WorkspaceSettingsContext)
-
-  if (!context) {
+export function useWorkspaceSettings() {
+  const value = useContext(WorkspaceSettings);
+  if (!value) {
     throw new Error(
-      "useWorkspaceSettingsContext must be used within a WorkspaceSettingsContext.Provider",
-    )
+      "This hook can only be used from a workspace settings page",
+    );
   }
 
-  return context
+  return value;
 }
 
 export const WorkspaceSettingsLayout: FC = () => {
-  const styles = useStyles()
+  const theme = useTheme();
   const params = useParams() as {
-    workspace: string
-    username: string
+    workspace: string;
+    username: string;
+  };
+  const workspaceName = params.workspace;
+  const username = params.username.replace("@", "");
+  const {
+    data: workspace,
+    error,
+    isLoading,
+    isError,
+  } = useQuery(workspaceByOwnerAndName(username, workspaceName));
+
+  if (isLoading) {
+    return <Loader />;
   }
-  const workspaceName = params.workspace
-  const username = params.username.replace("@", "")
-  const { data: settings } = useWorkspace(username, workspaceName)
 
   return (
     <>
@@ -57,32 +50,26 @@ export const WorkspaceSettingsLayout: FC = () => {
         <title>{pageTitle([workspaceName, "Settings"])}</title>
       </Helmet>
 
-      {settings ? (
-        <WorkspaceSettingsContext.Provider value={settings}>
-          <Margins>
-            <Stack className={styles.wrapper} direction="row" spacing={10}>
-              <Sidebar workspace={settings.workspace} username={username} />
+      <Margins>
+        <Stack
+          css={{ padding: theme.spacing(6, 0) }}
+          direction="row"
+          spacing={10}
+        >
+          {isError ? (
+            <ErrorAlert error={error} />
+          ) : (
+            <WorkspaceSettings.Provider value={workspace}>
+              <Sidebar workspace={workspace} username={username} />
               <Suspense fallback={<Loader />}>
-                <main className={styles.content}>
+                <main css={{ width: "100%" }}>
                   <Outlet />
                 </main>
               </Suspense>
-            </Stack>
-          </Margins>
-        </WorkspaceSettingsContext.Provider>
-      ) : (
-        <Loader />
-      )}
+            </WorkspaceSettings.Provider>
+          )}
+        </Stack>
+      </Margins>
     </>
-  )
-}
-
-const useStyles = makeStyles((theme) => ({
-  wrapper: {
-    padding: theme.spacing(6, 0),
-  },
-
-  content: {
-    width: "100%",
-  },
-}))
+  );
+};
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPage.test.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPage.test.tsx
index eaf5afaeb14be..0aaa510857e8e 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPage.test.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPage.test.tsx
@@ -1,41 +1,41 @@
-import userEvent from "@testing-library/user-event"
+import userEvent from "@testing-library/user-event";
 import {
   renderWithWorkspaceSettingsLayout,
   waitForLoaderToBeRemoved,
-} from "testHelpers/renderHelpers"
-import WorkspaceSettingsPage from "./WorkspaceSettingsPage"
-import { screen, waitFor, within } from "@testing-library/react"
-import * as api from "api/api"
-import { MockWorkspace } from "testHelpers/entities"
+} from "testHelpers/renderHelpers";
+import WorkspaceSettingsPage from "./WorkspaceSettingsPage";
+import { screen, waitFor, within } from "@testing-library/react";
+import * as api from "api/api";
+import { MockWorkspace } from "testHelpers/entities";
 
 test("Submit the workspace settings page successfully", async () => {
   // Mock the API calls that loads data
   jest
     .spyOn(api, "getWorkspaceByOwnerAndName")
-    .mockResolvedValueOnce(MockWorkspace)
+    .mockResolvedValueOnce(MockWorkspace);
   // Mock the API calls that submit data
   const patchWorkspaceSpy = jest
     .spyOn(api, "patchWorkspace")
-    .mockResolvedValue()
+    .mockResolvedValue();
   // Setup event and rendering
-  const user = userEvent.setup()
+  const user = userEvent.setup();
   renderWithWorkspaceSettingsLayout(<WorkspaceSettingsPage />, {
     route: "/@test-user/test-workspace/settings",
     path: "/:username/:workspace/settings",
     // Need this because after submit the user is redirected
     extraRoutes: [{ path: "/:username/:workspace", element: <div /> }],
-  })
-  await waitForLoaderToBeRemoved()
+  });
+  await waitForLoaderToBeRemoved();
   // Fill the form and submit
-  const form = screen.getByTestId("form")
-  const name = within(form).getByLabelText("Name")
-  await user.clear(name)
-  await user.type(within(form).getByLabelText("Name"), "new-name")
-  await user.click(within(form).getByRole("button", { name: "Submit" }))
+  const form = screen.getByTestId("form");
+  const name = within(form).getByLabelText("Name");
+  await user.clear(name);
+  await user.type(within(form).getByLabelText("Name"), "new-name");
+  await user.click(within(form).getByRole("button", { name: "Submit" }));
   // Assert that the API calls were made with the correct data
   await waitFor(() => {
     expect(patchWorkspaceSpy).toHaveBeenCalledWith(MockWorkspace.id, {
       name: "new-name",
-    })
-  })
-})
+    });
+  });
+});
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPage.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPage.tsx
index 89b927e526e8d..38b65eeacf6ec 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPage.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPage.tsx
@@ -1,30 +1,30 @@
-import { Helmet } from "react-helmet-async"
-import { useNavigate, useParams } from "react-router-dom"
-import { pageTitle } from "utils/page"
-import { useWorkspaceSettingsContext } from "./WorkspaceSettingsLayout"
-import { WorkspaceSettingsPageView } from "./WorkspaceSettingsPageView"
-import { useMutation } from "@tanstack/react-query"
-import { displaySuccess } from "components/GlobalSnackbar/utils"
-import { patchWorkspace } from "api/api"
-import { WorkspaceSettingsFormValues } from "./WorkspaceSettingsForm"
+import { Helmet } from "react-helmet-async";
+import { useNavigate, useParams } from "react-router-dom";
+import { pageTitle } from "utils/page";
+import { useWorkspaceSettings } from "./WorkspaceSettingsLayout";
+import { WorkspaceSettingsPageView } from "./WorkspaceSettingsPageView";
+import { useMutation } from "react-query";
+import { displaySuccess } from "components/GlobalSnackbar/utils";
+import { patchWorkspace } from "api/api";
+import { WorkspaceSettingsFormValues } from "./WorkspaceSettingsForm";
 
 const WorkspaceSettingsPage = () => {
   const params = useParams() as {
-    workspace: string
-    username: string
-  }
-  const workspaceName = params.workspace
-  const username = params.username.replace("@", "")
-  const { workspace } = useWorkspaceSettingsContext()
-  const navigate = useNavigate()
+    workspace: string;
+    username: string;
+  };
+  const workspaceName = params.workspace;
+  const username = params.username.replace("@", "");
+  const workspace = useWorkspaceSettings();
+  const navigate = useNavigate();
   const mutation = useMutation({
     mutationFn: (formValues: WorkspaceSettingsFormValues) =>
       patchWorkspace(workspace.id, { name: formValues.name }),
     onSuccess: (_, formValues) => {
-      displaySuccess("Workspace updated successfully")
-      navigate(`/@${username}/${formValues.name}/settings`)
+      displaySuccess("Workspace updated successfully");
+      navigate(`/@${username}/${formValues.name}/settings`);
     },
-  })
+  });
 
   return (
     <>
@@ -40,7 +40,7 @@ const WorkspaceSettingsPage = () => {
         onSubmit={mutation.mutate}
       />
     </>
-  )
-}
+  );
+};
 
-export default WorkspaceSettingsPage
+export default WorkspaceSettingsPage;
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPageView.stories.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPageView.stories.tsx
index eb21ad342fb86..13a44283d6aa1 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPageView.stories.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPageView.stories.tsx
@@ -1,25 +1,20 @@
-import { ComponentMeta, Story } from "@storybook/react"
-import { MockWorkspace } from "testHelpers/entities"
-import {
-  WorkspaceSettingsPageView,
-  WorkspaceSettingsPageViewProps,
-} from "./WorkspaceSettingsPageView"
-import { action } from "@storybook/addon-actions"
+import { Meta, StoryObj } from "@storybook/react";
+import { MockWorkspace } from "testHelpers/entities";
+import { WorkspaceSettingsPageView } from "./WorkspaceSettingsPageView";
 
-export default {
-  title: "pages/WorkspaceSettingsPageView",
+const meta: Meta<typeof WorkspaceSettingsPageView> = {
+  title: "pages/WorkspaceSettingsPage/WorkspaceSettingsPageView",
   component: WorkspaceSettingsPageView,
   args: {
     error: undefined,
     isSubmitting: false,
     workspace: MockWorkspace,
-    onCancel: action("cancel"),
   },
-} as ComponentMeta<typeof WorkspaceSettingsPageView>
+};
 
-const Template: Story<WorkspaceSettingsPageViewProps> = (args) => (
-  <WorkspaceSettingsPageView {...args} />
-)
+export default meta;
+type Story = StoryObj<typeof WorkspaceSettingsPageView>;
 
-export const Example = Template.bind({})
-Example.args = {}
+const Example: Story = {};
+
+export { Example as WorkspaceSettingsPageView };
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPageView.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPageView.tsx
index bed0052ee6e88..eae60876b07d3 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPageView.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceSettingsPageView.tsx
@@ -1,17 +1,15 @@
-import { makeStyles } from "@mui/styles"
-import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader"
-import { ComponentProps, FC } from "react"
-import { useTranslation } from "react-i18next"
-import { WorkspaceSettingsForm } from "./WorkspaceSettingsForm"
-import { Workspace } from "api/typesGenerated"
+import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader";
+import { ComponentProps, FC } from "react";
+import { WorkspaceSettingsForm } from "./WorkspaceSettingsForm";
+import { Workspace } from "api/typesGenerated";
 
 export type WorkspaceSettingsPageViewProps = {
-  error: unknown
-  isSubmitting: boolean
-  workspace: Workspace
-  onCancel: () => void
-  onSubmit: ComponentProps<typeof WorkspaceSettingsForm>["onSubmit"]
-}
+  error: unknown;
+  isSubmitting: boolean;
+  workspace: Workspace;
+  onCancel: () => void;
+  onSubmit: ComponentProps<typeof WorkspaceSettingsForm>["onSubmit"];
+};
 
 export const WorkspaceSettingsPageView: FC<WorkspaceSettingsPageViewProps> = ({
   onCancel,
@@ -20,13 +18,14 @@ export const WorkspaceSettingsPageView: FC<WorkspaceSettingsPageViewProps> = ({
   error,
   workspace,
 }) => {
-  const { t } = useTranslation("workspaceSettingsPage")
-  const styles = useStyles()
-
   return (
     <>
-      <PageHeader className={styles.pageHeader}>
-        <PageHeaderTitle>{t("title")}</PageHeaderTitle>
+      <PageHeader
+        css={{
+          paddingTop: 0,
+        }}
+      >
+        <PageHeaderTitle>Workspace Settings</PageHeaderTitle>
       </PageHeader>
 
       <WorkspaceSettingsForm
@@ -37,11 +36,5 @@ export const WorkspaceSettingsPageView: FC<WorkspaceSettingsPageViewProps> = ({
         onSubmit={onSubmit}
       />
     </>
-  )
-}
-
-const useStyles = makeStyles(() => ({
-  pageHeader: {
-    paddingTop: 0,
-  },
-}))
+  );
+};
diff --git a/site/src/pages/WorkspacesPage/LastUsed.tsx b/site/src/pages/WorkspacesPage/LastUsed.tsx
new file mode 100644
index 0000000000000..9bb9977e42c6e
--- /dev/null
+++ b/site/src/pages/WorkspacesPage/LastUsed.tsx
@@ -0,0 +1,72 @@
+import { type FC } from "react";
+import dayjs from "dayjs";
+import relativeTime from "dayjs/plugin/relativeTime";
+import { useTheme } from "@emotion/react";
+import { Stack } from "components/Stack/Stack";
+import { colors } from "theme/colors";
+
+dayjs.extend(relativeTime);
+
+type CircleProps = {
+  color: string;
+  variant?: "solid" | "outlined";
+};
+
+const Circle: FC<CircleProps> = ({ color, variant = "solid" }) => {
+  const theme = useTheme();
+
+  return (
+    <div
+      aria-hidden
+      css={{
+        width: theme.spacing(1),
+        height: theme.spacing(1),
+        backgroundColor: variant === "solid" ? color : undefined,
+        border: variant === "outlined" ? `1px solid ${color}` : undefined,
+        borderRadius: 9999,
+      }}
+    />
+  );
+};
+
+interface LastUsedProps {
+  lastUsedAt: string;
+}
+
+export const LastUsed: FC<LastUsedProps> = ({ lastUsedAt }) => {
+  const theme = useTheme();
+  const t = dayjs(lastUsedAt);
+  const now = dayjs();
+  let message = t.fromNow();
+  let circle = (
+    <Circle color={theme.palette.text.secondary} variant="outlined" />
+  );
+
+  if (t.isAfter(now.subtract(1, "hour"))) {
+    circle = <Circle color={colors.green[9]} />;
+    // Since the agent reports on a 10m interval,
+    // the last_used_at can be inaccurate when recent.
+    message = "Now";
+  } else if (t.isAfter(now.subtract(3, "day"))) {
+    circle = <Circle color={theme.palette.text.secondary} />;
+  } else if (t.isAfter(now.subtract(1, "month"))) {
+    circle = <Circle color={theme.palette.warning.light} />;
+  } else if (t.isAfter(now.subtract(100, "year"))) {
+    circle = <Circle color={colors.red[10]} />;
+  } else {
+    // color = theme.palette.error.light
+    message = "Never";
+  }
+
+  return (
+    <Stack
+      css={{ color: theme.palette.text.secondary }}
+      direction="row"
+      spacing={1}
+      alignItems="center"
+    >
+      {circle}
+      <span data-chromatic="ignore">{message}</span>
+    </Stack>
+  );
+};
diff --git a/site/src/pages/WorkspacesPage/WorkspaceHelpTooltip.tsx b/site/src/pages/WorkspacesPage/WorkspaceHelpTooltip.tsx
new file mode 100644
index 0000000000000..7db515e3e20fd
--- /dev/null
+++ b/site/src/pages/WorkspacesPage/WorkspaceHelpTooltip.tsx
@@ -0,0 +1,35 @@
+import { FC } from "react";
+import {
+  HelpTooltip,
+  HelpTooltipLink,
+  HelpTooltipLinksGroup,
+  HelpTooltipText,
+  HelpTooltipTitle,
+} from "components/HelpTooltip/HelpTooltip";
+import { docs } from "utils/docs";
+
+const Language = {
+  workspaceTooltipTitle: "What is a workspace?",
+  workspaceTooltipText:
+    "A workspace is your development environment in the cloud. It includes the infrastructure and tools you need to work on your project.",
+  workspaceTooltipLink1: "Create Workspaces",
+  workspaceTooltipLink2: "Connect with SSH",
+  workspaceTooltipLink3: "Editors and IDEs",
+};
+
+export const WorkspaceHelpTooltip: FC = () => {
+  return (
+    <HelpTooltip>
+      <HelpTooltipTitle>{Language.workspaceTooltipTitle}</HelpTooltipTitle>
+      <HelpTooltipText>{Language.workspaceTooltipText}</HelpTooltipText>
+      <HelpTooltipLinksGroup>
+        <HelpTooltipLink href={docs("/workspaces")}>
+          {Language.workspaceTooltipLink1}
+        </HelpTooltipLink>
+        <HelpTooltipLink href={docs("/ides")}>
+          {Language.workspaceTooltipLink2}
+        </HelpTooltipLink>
+      </HelpTooltipLinksGroup>
+    </HelpTooltip>
+  );
+};
diff --git a/site/src/pages/WorkspacesPage/WorkspacesButton.tsx b/site/src/pages/WorkspacesPage/WorkspacesButton.tsx
new file mode 100644
index 0000000000000..2e3d6563602df
--- /dev/null
+++ b/site/src/pages/WorkspacesPage/WorkspacesButton.tsx
@@ -0,0 +1,219 @@
+import { type PropsWithChildren, type ReactNode, useState } from "react";
+import { type Template } from "api/typesGenerated";
+import { type UseQueryResult } from "react-query";
+import {
+  Link as RouterLink,
+  LinkProps as RouterLinkProps,
+} from "react-router-dom";
+import Box from "@mui/system/Box";
+import Button from "@mui/material/Button";
+import Link from "@mui/material/Link";
+import AddIcon from "@mui/icons-material/AddOutlined";
+import OpenIcon from "@mui/icons-material/OpenInNewOutlined";
+import { Loader } from "components/Loader/Loader";
+import { OverflowY } from "components/OverflowY/OverflowY";
+import { EmptyState } from "components/EmptyState/EmptyState";
+import { Avatar } from "components/Avatar/Avatar";
+import { SearchBox } from "./WorkspacesSearchBox";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "components/Popover/Popover";
+
+const ICON_SIZE = 18;
+const COLUMN_GAP = 1.5;
+
+type TemplatesQuery = UseQueryResult<Template[]>;
+
+type WorkspacesButtonProps = PropsWithChildren<{
+  templatesFetchStatus: TemplatesQuery["status"];
+  templates: TemplatesQuery["data"];
+}>;
+
+export function WorkspacesButton({
+  children,
+  templatesFetchStatus,
+  templates,
+}: WorkspacesButtonProps) {
+  // Dataset should always be small enough that client-side filtering should be
+  // good enough. Can swap out down the line if it becomes an issue
+  const [searchTerm, setSearchTerm] = useState("");
+  const processed = sortTemplatesByUsersDesc(templates ?? [], searchTerm);
+
+  let emptyState: ReactNode = undefined;
+  if (templates?.length === 0) {
+    emptyState = (
+      <EmptyState
+        message="No templates yet"
+        cta={
+          <Link to="/templates" component={RouterLink}>
+            Create one now.
+          </Link>
+        }
+      />
+    );
+  } else if (processed.length === 0) {
+    emptyState = <EmptyState message="No templates match your text" />;
+  }
+
+  return (
+    <Popover>
+      <PopoverTrigger>
+        <Button startIcon={<AddIcon />} variant="contained">
+          {children}
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent horizontal="right">
+        <SearchBox
+          value={searchTerm}
+          onValueChange={(newValue) => setSearchTerm(newValue)}
+          placeholder="Type/select a workspace template"
+          label="Template select for workspace"
+          sx={{ flexShrink: 0, columnGap: COLUMN_GAP }}
+        />
+
+        <OverflowY
+          maxHeight={380}
+          sx={{
+            display: "flex",
+            flexDirection: "column",
+            paddingY: 1,
+          }}
+        >
+          {templatesFetchStatus === "loading" ? (
+            <Loader size={14} />
+          ) : (
+            <>
+              {processed.map((template) => (
+                <WorkspaceResultsRow key={template.id} template={template} />
+              ))}
+
+              {emptyState}
+            </>
+          )}
+        </OverflowY>
+
+        <Box
+          css={(theme) => ({
+            padding: theme.spacing(1, 0),
+            borderTop: `1px solid ${theme.palette.divider}`,
+          })}
+        >
+          <PopoverLink
+            to="/templates"
+            css={(theme) => ({
+              display: "flex",
+              alignItems: "center",
+              columnGap: theme.spacing(COLUMN_GAP),
+
+              color: theme.palette.primary.main,
+            })}
+          >
+            <OpenIcon css={{ width: 14, height: 14 }} />
+            <span>See all templates</span>
+          </PopoverLink>
+        </Box>
+      </PopoverContent>
+    </Popover>
+  );
+}
+
+function WorkspaceResultsRow({ template }: { template: Template }) {
+  return (
+    <PopoverLink
+      to={`/templates/${template.name}/workspace`}
+      css={(theme) => ({
+        display: "flex",
+        gap: theme.spacing(COLUMN_GAP),
+        alignItems: "center",
+      })}
+    >
+      <Avatar
+        src={template.icon}
+        fitImage
+        alt={template.display_name || "Coder template"}
+        sx={{
+          width: `${ICON_SIZE}px`,
+          height: `${ICON_SIZE}px`,
+          fontSize: `${ICON_SIZE * 0.5}px`,
+          fontWeight: 700,
+        }}
+      >
+        {template.display_name || "-"}
+      </Avatar>
+
+      <Box
+        css={(theme) => ({
+          color: theme.palette.text.primary,
+          display: "flex",
+          flexDirection: "column",
+          lineHeight: "140%",
+          fontSize: 14,
+          overflow: "hidden",
+        })}
+      >
+        <span css={{ whiteSpace: "nowrap", textOverflow: "ellipsis" }}>
+          {template.display_name || template.name || "[Unnamed]"}
+        </span>
+        <span
+          css={(theme) => ({
+            fontSize: 13,
+            color: theme.palette.text.secondary,
+          })}
+        >
+          {/*
+           * There are some templates that have -1 as their user count –
+           * basically functioning like a null value in JS. Can safely just
+           * treat them as if they were 0.
+           */}
+          {template.active_user_count <= 0 ? "No" : template.active_user_count}{" "}
+          developer
+          {template.active_user_count === 1 ? "" : "s"}
+        </span>
+      </Box>
+    </PopoverLink>
+  );
+}
+
+function PopoverLink(props: RouterLinkProps) {
+  return (
+    <RouterLink
+      {...props}
+      css={(theme) => ({
+        color: theme.palette.text.primary,
+        padding: theme.spacing(1, 2),
+        fontSize: 14,
+        outline: "none",
+        textDecoration: "none",
+        "&:focus": {
+          backgroundColor: theme.palette.action.focus,
+        },
+        "&:hover": {
+          textDecoration: "none",
+          backgroundColor: theme.palette.action.hover,
+        },
+      })}
+    />
+  );
+}
+
+function sortTemplatesByUsersDesc(
+  templates: readonly Template[],
+  searchTerm: string,
+) {
+  const allWhitespace = /^\s+$/.test(searchTerm);
+  if (allWhitespace) {
+    return templates;
+  }
+
+  const termMatcher = new RegExp(searchTerm.replaceAll(/[^\w]/g, "."), "i");
+  return templates
+    .filter(
+      (template) =>
+        termMatcher.test(template.display_name) ||
+        termMatcher.test(template.name),
+    )
+    .sort((t1, t2) => t2.active_user_count - t1.active_user_count)
+    .slice(0, 10);
+}
diff --git a/site/src/pages/WorkspacesPage/WorkspacesPage.test.tsx b/site/src/pages/WorkspacesPage/WorkspacesPage.test.tsx
index d030f0bd8901d..aaa352bbfd61c 100644
--- a/site/src/pages/WorkspacesPage/WorkspacesPage.test.tsx
+++ b/site/src/pages/WorkspacesPage/WorkspacesPage.test.tsx
@@ -1,43 +1,78 @@
-import { screen } from "@testing-library/react"
-import { rest } from "msw"
-import * as CreateDayString from "utils/createDayString"
-import { MockWorkspace, MockWorkspacesResponse } from "testHelpers/entities"
-import { renderWithAuth } from "testHelpers/renderHelpers"
-import { server } from "testHelpers/server"
-import WorkspacesPage from "./WorkspacesPage"
-import { i18n } from "i18n"
-
-const { t } = i18n
+import { screen, waitFor, within } from "@testing-library/react";
+import { rest } from "msw";
+import * as CreateDayString from "utils/createDayString";
+import { MockWorkspace, MockWorkspacesResponse } from "testHelpers/entities";
+import {
+  renderWithAuth,
+  waitForLoaderToBeRemoved,
+} from "testHelpers/renderHelpers";
+import { server } from "testHelpers/server";
+import WorkspacesPage from "./WorkspacesPage";
+import userEvent from "@testing-library/user-event";
+import * as API from "api/api";
+import { Workspace } from "api/typesGenerated";
 
 describe("WorkspacesPage", () => {
   beforeEach(() => {
     // Mocking the dayjs module within the createDayString file
-    const mock = jest.spyOn(CreateDayString, "createDayString")
-    mock.mockImplementation(() => "a minute ago")
-  })
+    const mock = jest.spyOn(CreateDayString, "createDayString");
+    mock.mockImplementation(() => "a minute ago");
+  });
 
   it("renders an empty workspaces page", async () => {
     // Given
     server.use(
       rest.get("/api/v2/workspaces", async (req, res, ctx) => {
-        return res(ctx.status(200), ctx.json({ workspaces: [], count: 0 }))
+        return res(ctx.status(200), ctx.json({ workspaces: [], count: 0 }));
       }),
-    )
+    );
 
     // When
-    renderWithAuth(<WorkspacesPage />)
+    renderWithAuth(<WorkspacesPage />);
 
     // Then
-    const text = t("emptyCreateWorkspaceMessage", { ns: "workspacesPage" })
-    await screen.findByText(text)
-  })
+    await screen.findByText("Create a workspace");
+  });
 
   it("renders a filled workspaces page", async () => {
-    renderWithAuth(<WorkspacesPage />)
-    await screen.findByText(`${MockWorkspace.name}1`)
+    renderWithAuth(<WorkspacesPage />);
+    await screen.findByText(`${MockWorkspace.name}1`);
     const templateDisplayNames = await screen.findAllByText(
       `${MockWorkspace.template_display_name}`,
-    )
-    expect(templateDisplayNames).toHaveLength(MockWorkspacesResponse.count)
-  })
-})
+    );
+    expect(templateDisplayNames).toHaveLength(MockWorkspacesResponse.count);
+  });
+
+  it("deletes only the selected workspaces", async () => {
+    const workspaces = [
+      { ...MockWorkspace, id: "1" },
+      { ...MockWorkspace, id: "2" },
+      { ...MockWorkspace, id: "3" },
+    ];
+    jest
+      .spyOn(API, "getWorkspaces")
+      .mockResolvedValue({ workspaces, count: workspaces.length });
+    const deleteWorkspace = jest.spyOn(API, "deleteWorkspace");
+    const user = userEvent.setup();
+    renderWithAuth(<WorkspacesPage />);
+    await waitForLoaderToBeRemoved();
+
+    await user.click(getWorkspaceCheckbox(workspaces[0]));
+    await user.click(getWorkspaceCheckbox(workspaces[1]));
+    await user.click(screen.getByRole("button", { name: /delete selected/i }));
+    await user.type(screen.getByLabelText(/type delete to confirm/i), "DELETE");
+    await user.click(screen.getByTestId("confirm-button"));
+
+    await waitFor(() => {
+      expect(deleteWorkspace).toHaveBeenCalledTimes(2);
+    });
+    expect(deleteWorkspace).toHaveBeenCalledWith(workspaces[0].id);
+    expect(deleteWorkspace).toHaveBeenCalledWith(workspaces[1].id);
+  });
+});
+
+const getWorkspaceCheckbox = (workspace: Workspace) => {
+  return within(screen.getByTestId(`checkbox-${workspace.id}`)).getByRole(
+    "checkbox",
+  );
+};
diff --git a/site/src/pages/WorkspacesPage/WorkspacesPage.tsx b/site/src/pages/WorkspacesPage/WorkspacesPage.tsx
index 112a89ae5eaa1..b3c3cfcd0365c 100644
--- a/site/src/pages/WorkspacesPage/WorkspacesPage.tsx
+++ b/site/src/pages/WorkspacesPage/WorkspacesPage.tsx
@@ -1,27 +1,108 @@
-import { usePagination } from "hooks/usePagination"
-import { FC } from "react"
-import { Helmet } from "react-helmet-async"
-import { pageTitle } from "utils/page"
-import { useWorkspacesData, useWorkspaceUpdate } from "./data"
-import { WorkspacesPageView } from "./WorkspacesPageView"
-import { useOrganizationId, usePermissions } from "hooks"
-import { useTemplateFilterMenu, useStatusFilterMenu } from "./filter/menus"
-import { useSearchParams } from "react-router-dom"
-import { useFilter } from "components/Filter/filter"
-import { useUserFilterMenu } from "components/Filter/UserFilter"
+import { usePagination } from "hooks/usePagination";
+import { Workspace } from "api/typesGenerated";
+import {
+  useDashboard,
+  useIsWorkspaceActionsEnabled,
+} from "components/Dashboard/DashboardProvider";
+import { type FC, useEffect, useState } from "react";
+import { Helmet } from "react-helmet-async";
+import { pageTitle } from "utils/page";
+import { useWorkspacesData, useWorkspaceUpdate } from "./data";
+import { WorkspacesPageView } from "./WorkspacesPageView";
+import { useOrganizationId, usePermissions } from "hooks";
+import { useTemplateFilterMenu, useStatusFilterMenu } from "./filter/menus";
+import { useSearchParams } from "react-router-dom";
+import { useFilter } from "components/Filter/filter";
+import { useUserFilterMenu } from "components/Filter/UserFilter";
+import { deleteWorkspace, getWorkspaces } from "api/api";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import Box from "@mui/material/Box";
+import { MONOSPACE_FONT_FAMILY } from "theme/constants";
+import TextField from "@mui/material/TextField";
+import { displayError } from "components/GlobalSnackbar/utils";
+import { getErrorMessage } from "api/errors";
+import { useEffectEvent } from "hooks/hookPolyfills";
+import { useQuery } from "react-query";
+import { templates } from "api/queries/templates";
+
+function useSafeSearchParams() {
+  // Have to wrap setSearchParams because React Router doesn't make sure that
+  // the function's memory reference stays stable on each render, even though
+  // its logic never changes, and even though it has function update support
+  const [searchParams, setSearchParams] = useSearchParams();
+  const stableSetSearchParams = useEffectEvent(setSearchParams);
+
+  // Need this to be a tuple type, but can't use "as const", because that would
+  // make the whole array readonly and cause type mismatches downstream
+  return [searchParams, stableSetSearchParams] as ReturnType<
+    typeof useSearchParams
+  >;
+}
 
 const WorkspacesPage: FC = () => {
+  const [dormantWorkspaces, setDormantWorkspaces] = useState<Workspace[]>([]);
   // If we use a useSearchParams for each hook, the values will not be in sync.
   // So we have to use a single one, centralizing the values, and pass it to
   // each hook.
-  const searchParamsResult = useSearchParams()
-  const pagination = usePagination({ searchParamsResult })
-  const filterProps = useWorkspacesFilter({ searchParamsResult, pagination })
-  const { data, error, queryKey } = useWorkspacesData({
+  const searchParamsResult = useSafeSearchParams();
+  const pagination = usePagination({ searchParamsResult });
+
+  const organizationId = useOrganizationId();
+  const templatesQuery = useQuery(templates(organizationId));
+
+  const filterProps = useWorkspacesFilter({
+    searchParamsResult,
+    organizationId,
+    onFilterChange: () => pagination.goToPage(1),
+  });
+
+  const { data, error, queryKey, refetch } = useWorkspacesData({
     ...pagination,
     query: filterProps.filter.query,
-  })
-  const updateWorkspace = useWorkspaceUpdate(queryKey)
+  });
+
+  const experimentEnabled = useIsWorkspaceActionsEnabled();
+  // If workspace actions are enabled we need to fetch the dormant
+  // workspaces as well. This lets us determine whether we should
+  // show a banner to the user indicating that some of their workspaces
+  // are at risk of being deleted.
+  useEffect(() => {
+    if (experimentEnabled) {
+      const includesDormant = filterProps.filter.query.includes("dormant_at");
+      const dormantQuery = includesDormant
+        ? filterProps.filter.query
+        : filterProps.filter.query + " is-dormant:true";
+
+      if (includesDormant && data) {
+        setDormantWorkspaces(data.workspaces);
+      } else {
+        getWorkspaces({ q: dormantQuery })
+          .then((resp) => {
+            setDormantWorkspaces(resp.workspaces);
+          })
+          .catch(() => {
+            // TODO
+          });
+      }
+    } else {
+      // If the experiment isn't included then we'll pretend
+      // like dormant workspaces don't exist.
+      setDormantWorkspaces([]);
+    }
+  }, [experimentEnabled, data, filterProps.filter.query]);
+  const updateWorkspace = useWorkspaceUpdate(queryKey);
+  const [checkedWorkspaces, setCheckedWorkspaces] = useState<Workspace[]>([]);
+  const [isDeletingAll, setIsDeletingAll] = useState(false);
+  const [urlSearchParams] = searchParamsResult;
+  const { entitlements } = useDashboard();
+  const canCheckWorkspaces =
+    entitlements.features["workspace_batch_actions"].enabled;
+
+  // We want to uncheck the selected workspaces always when the url changes
+  // because of filtering or pagination
+  useEffect(() => {
+    setCheckedWorkspaces([]);
+  }, [urlSearchParams]);
 
   return (
     <>
@@ -30,7 +111,13 @@ const WorkspacesPage: FC = () => {
       </Helmet>
 
       <WorkspacesPageView
+        checkedWorkspaces={checkedWorkspaces}
+        onCheckChange={setCheckedWorkspaces}
+        canCheckWorkspaces={canCheckWorkspaces}
+        templates={templatesQuery.data}
+        templatesFetchStatus={templatesQuery.status}
         workspaces={data?.workspaces}
+        dormantWorkspaces={dormantWorkspaces}
         error={error}
         count={data?.count}
         page={pagination.page}
@@ -38,51 +125,68 @@ const WorkspacesPage: FC = () => {
         onPageChange={pagination.goToPage}
         filterProps={filterProps}
         onUpdateWorkspace={(workspace) => {
-          updateWorkspace.mutate(workspace)
+          updateWorkspace.mutate(workspace);
+        }}
+        onDeleteAll={() => {
+          setIsDeletingAll(true);
+        }}
+      />
+
+      <BatchDeleteConfirmation
+        checkedWorkspaces={checkedWorkspaces}
+        open={isDeletingAll}
+        onClose={() => {
+          setIsDeletingAll(false);
+        }}
+        onDelete={async () => {
+          await refetch();
+          setCheckedWorkspaces([]);
         }}
       />
     </>
-  )
-}
+  );
+};
 
-export default WorkspacesPage
+export default WorkspacesPage;
 
 type UseWorkspacesFilterOptions = {
-  searchParamsResult: ReturnType<typeof useSearchParams>
-  pagination: ReturnType<typeof usePagination>
-}
+  searchParamsResult: ReturnType<typeof useSearchParams>;
+  onFilterChange: () => void;
+  organizationId: string;
+};
 
 const useWorkspacesFilter = ({
   searchParamsResult,
-  pagination,
+  onFilterChange,
+  organizationId,
 }: UseWorkspacesFilterOptions) => {
-  const orgId = useOrganizationId()
   const filter = useFilter({
-    initialValue: `owner:me`,
+    fallbackFilter: "owner:me",
     searchParamsResult,
-    onUpdate: () => {
-      pagination.goToPage(1)
-    },
-  })
-  const permissions = usePermissions()
-  const canFilterByUser = permissions.viewDeploymentValues
+    onUpdate: onFilterChange,
+  });
+
+  const permissions = usePermissions();
+  const canFilterByUser = permissions.viewDeploymentValues;
   const userMenu = useUserFilterMenu({
     value: filter.values.owner,
     onChange: (option) =>
       filter.update({ ...filter.values, owner: option?.value }),
     enabled: canFilterByUser,
-  })
+  });
+
   const templateMenu = useTemplateFilterMenu({
-    orgId,
+    orgId: organizationId,
     value: filter.values.template,
     onChange: (option) =>
       filter.update({ ...filter.values, template: option?.value }),
-  })
+  });
+
   const statusMenu = useStatusFilterMenu({
     value: filter.values.status,
     onChange: (option) =>
       filter.update({ ...filter.values, status: option?.value }),
-  })
+  });
 
   return {
     filter,
@@ -91,5 +195,111 @@ const useWorkspacesFilter = ({
       template: templateMenu,
       status: statusMenu,
     },
-  }
-}
+  };
+};
+
+const BatchDeleteConfirmation = ({
+  checkedWorkspaces,
+  open,
+  onClose,
+  onDelete,
+}: {
+  checkedWorkspaces: Workspace[];
+  open: boolean;
+  onClose: () => void;
+  onDelete: () => void;
+}) => {
+  const [confirmValue, setConfirmValue] = useState("");
+  const [confirmError, setConfirmError] = useState(false);
+  const [isDeleting, setIsDeleting] = useState(false);
+
+  const close = () => {
+    if (isDeleting) {
+      return;
+    }
+
+    onClose();
+    setConfirmValue("");
+    setConfirmError(false);
+    setIsDeleting(false);
+  };
+
+  const confirmDeletion = async () => {
+    setConfirmError(false);
+
+    if (confirmValue !== "DELETE") {
+      setConfirmError(true);
+      return;
+    }
+
+    try {
+      setIsDeleting(true);
+      await Promise.all(checkedWorkspaces.map((w) => deleteWorkspace(w.id)));
+    } catch (e) {
+      displayError(
+        "Error on deleting workspaces",
+        getErrorMessage(e, "An error occurred while deleting the workspaces"),
+      );
+    } finally {
+      close();
+      onDelete();
+    }
+  };
+
+  return (
+    <ConfirmDialog
+      type="delete"
+      open={open}
+      confirmLoading={isDeleting}
+      onConfirm={confirmDeletion}
+      onClose={() => {
+        onClose();
+        setConfirmValue("");
+        setConfirmError(false);
+      }}
+      title={`Delete ${checkedWorkspaces?.length} ${
+        checkedWorkspaces.length === 1 ? "workspace" : "workspaces"
+      }`}
+      description={
+        <form
+          onSubmit={async (e) => {
+            e.preventDefault();
+            await confirmDeletion();
+          }}
+        >
+          <Box>
+            Deleting these workspaces is irreversible! Are you sure you want to
+            proceed? Type{" "}
+            <Box
+              component="code"
+              sx={{
+                fontFamily: MONOSPACE_FONT_FAMILY,
+                color: (theme) => theme.palette.text.primary,
+                fontWeight: 600,
+              }}
+            >
+              `DELETE`
+            </Box>{" "}
+            to confirm.
+          </Box>
+          <TextField
+            value={confirmValue}
+            required
+            autoFocus
+            fullWidth
+            inputProps={{
+              "aria-label": "Type DELETE to confirm",
+            }}
+            placeholder="Type DELETE to confirm"
+            sx={{ mt: 2 }}
+            onChange={(e) => {
+              setConfirmValue(e.currentTarget.value);
+            }}
+            error={confirmError}
+            helperText={confirmError && "Please type DELETE to confirm"}
+          />
+        </form>
+      }
+    />
+  );
+};
diff --git a/site/src/pages/WorkspacesPage/WorkspacesPageView.stories.tsx b/site/src/pages/WorkspacesPage/WorkspacesPageView.stories.tsx
index d9d8c0786a6f9..81b00ac113c23 100644
--- a/site/src/pages/WorkspacesPage/WorkspacesPageView.stories.tsx
+++ b/site/src/pages/WorkspacesPage/WorkspacesPageView.stories.tsx
@@ -1,26 +1,30 @@
-import { Meta, StoryObj } from "@storybook/react"
-import { DEFAULT_RECORDS_PER_PAGE } from "components/PaginationWidget/utils"
-import dayjs from "dayjs"
-import uniqueId from "lodash/uniqueId"
+import { Meta, StoryObj } from "@storybook/react";
+import { DEFAULT_RECORDS_PER_PAGE } from "components/PaginationWidget/utils";
+import dayjs from "dayjs";
+import uniqueId from "lodash/uniqueId";
 import {
   Workspace,
   WorkspaceStatus,
   WorkspaceStatuses,
-} from "api/typesGenerated"
+} from "api/typesGenerated";
 import {
   MockWorkspace,
-  MockAppearance,
+  MockAppearanceConfig,
   MockBuildInfo,
   MockEntitlementsWithScheduling,
   MockExperiments,
   mockApiError,
   MockUser,
   MockPendingProvisionerJob,
-} from "testHelpers/entities"
-import { WorkspacesPageView } from "./WorkspacesPageView"
-import { DashboardProviderContext } from "components/Dashboard/DashboardProvider"
-import { ComponentProps } from "react"
-import { MockMenu, getDefaultFilterProps } from "components/Filter/storyHelpers"
+  MockTemplate,
+} from "testHelpers/entities";
+import { WorkspacesPageView } from "./WorkspacesPageView";
+import { DashboardProviderContext } from "components/Dashboard/DashboardProvider";
+import { ComponentProps } from "react";
+import {
+  MockMenu,
+  getDefaultFilterProps,
+} from "components/Filter/storyHelpers";
 
 const createWorkspace = (
   status: WorkspaceStatus,
@@ -40,12 +44,12 @@ const createWorkspace = (
           : MockWorkspace.latest_build.job,
     },
     last_used_at: lastUsedAt,
-  }
-}
+  };
+};
 
 // This is type restricted to prevent future statuses from slipping
 // through the cracks unchecked!
-const workspaces = WorkspaceStatuses.map((status) => createWorkspace(status))
+const workspaces = WorkspaceStatuses.map((status) => createWorkspace(status));
 
 // Additional Workspaces depending on time
 const additionalWorkspaces: Record<string, Workspace> = {
@@ -60,21 +64,20 @@ const additionalWorkspaces: Record<string, Workspace> = {
     true,
     dayjs().subtract(1, "month").subtract(4, "day").toString(),
   ),
-}
+};
 
 const allWorkspaces = [
   ...Object.values(workspaces),
   ...Object.values(additionalWorkspaces),
-]
+];
 
 const MockedAppearance = {
-  config: MockAppearance,
-  preview: false,
-  setPreview: () => null,
-  save: () => null,
-}
+  config: MockAppearanceConfig,
+  isPreview: false,
+  setPreview: () => {},
+};
 
-type FilterProps = ComponentProps<typeof WorkspacesPageView>["filterProps"]
+type FilterProps = ComponentProps<typeof WorkspacesPageView>["filterProps"];
 
 const defaultFilterProps = getDefaultFilterProps<FilterProps>({
   query: "owner:me",
@@ -88,7 +91,20 @@ const defaultFilterProps = getDefaultFilterProps<FilterProps>({
     template: undefined,
     status: undefined,
   },
-})
+});
+
+const mockTemplates = [
+  MockTemplate,
+  ...[1, 2, 3, 4].map((num) => {
+    return {
+      ...MockTemplate,
+      active_user_count: Math.floor(Math.random() * 10) * num,
+      display_name: `Extra Template ${num}`,
+      description: "Auto-Generated template",
+      icon: num % 2 === 0 ? "" : "/icon/goland.svg",
+    };
+  }),
+];
 
 const meta: Meta<typeof WorkspacesPageView> = {
   title: "pages/WorkspacesPageView",
@@ -96,6 +112,10 @@ const meta: Meta<typeof WorkspacesPageView> = {
   args: {
     limit: DEFAULT_RECORDS_PER_PAGE,
     filterProps: defaultFilterProps,
+    checkedWorkspaces: [],
+    canCheckWorkspaces: true,
+    templates: mockTemplates,
+    templatesFetchStatus: "success",
   },
   decorators: [
     (Story) => (
@@ -111,24 +131,24 @@ const meta: Meta<typeof WorkspacesPageView> = {
       </DashboardProviderContext.Provider>
     ),
   ],
-}
+};
 
-export default meta
-type Story = StoryObj<typeof WorkspacesPageView>
+export default meta;
+type Story = StoryObj<typeof WorkspacesPageView>;
 
 export const AllStates: Story = {
   args: {
     workspaces: allWorkspaces,
     count: allWorkspaces.length,
   },
-}
+};
 
 export const OwnerHasNoWorkspaces: Story = {
   args: {
     workspaces: [],
     count: 0,
   },
-}
+};
 
 export const NoSearchResults: Story = {
   args: {
@@ -143,7 +163,7 @@ export const NoSearchResults: Story = {
     },
     count: 0,
   },
-}
+};
 
 export const UnhealthyWorkspace: Story = {
   args: {
@@ -157,10 +177,10 @@ export const UnhealthyWorkspace: Story = {
       },
     ],
   },
-}
+};
 
 export const Error: Story = {
   args: {
     error: mockApiError({ message: "Something went wrong" }),
   },
-}
+};
diff --git a/site/src/pages/WorkspacesPage/WorkspacesPageView.tsx b/site/src/pages/WorkspacesPage/WorkspacesPageView.tsx
index 05350277d0bbf..44d16701d5e03 100644
--- a/site/src/pages/WorkspacesPage/WorkspacesPageView.tsx
+++ b/site/src/pages/WorkspacesPage/WorkspacesPageView.tsx
@@ -1,50 +1,62 @@
-import Link from "@mui/material/Link"
-import { Workspace } from "api/typesGenerated"
-import { Maybe } from "components/Conditionals/Maybe"
-import { PaginationWidgetBase } from "components/PaginationWidget/PaginationWidgetBase"
-import { ComponentProps, FC } from "react"
-import { Link as RouterLink } from "react-router-dom"
-import { Margins } from "components/Margins/Margins"
+import { Template, Workspace } from "api/typesGenerated";
+import { PaginationWidgetBase } from "components/PaginationWidget/PaginationWidgetBase";
+import { ComponentProps, FC } from "react";
+import { Margins } from "components/Margins/Margins";
+import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader";
+import { Stack } from "components/Stack/Stack";
+import { WorkspaceHelpTooltip } from "./WorkspaceHelpTooltip";
+import { WorkspacesTable } from "pages/WorkspacesPage/WorkspacesTable";
+import { useLocalStorage } from "hooks";
+import { DormantWorkspaceBanner, Count } from "components/WorkspaceDeletion";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { WorkspacesFilter } from "./filter/filter";
+import { hasError, isApiValidationError } from "api/errors";
 import {
-  PageHeader,
-  PageHeaderSubtitle,
-  PageHeaderTitle,
-} from "components/PageHeader/PageHeader"
-import { Stack } from "components/Stack/Stack"
-import { WorkspaceHelpTooltip } from "components/Tooltips"
-import { WorkspacesTable } from "pages/WorkspacesPage/WorkspacesTable"
-import { useLocalStorage } from "hooks"
-import difference from "lodash/difference"
-import { ImpendingDeletionBanner, Count } from "components/WorkspaceDeletion"
-import { ErrorAlert } from "components/Alert/ErrorAlert"
-import { WorkspacesFilter } from "./filter/filter"
-import { hasError, isApiValidationError } from "api/errors"
-import { PaginationStatus } from "components/PaginationStatus/PaginationStatus"
+  PaginationStatus,
+  TableToolbar,
+} from "components/TableToolbar/TableToolbar";
+import Box from "@mui/material/Box";
+import Button from "@mui/material/Button";
+import DeleteOutlined from "@mui/icons-material/DeleteOutlined";
+import { WorkspacesButton } from "./WorkspacesButton";
+import { UseQueryResult } from "react-query";
 
 export const Language = {
   pageTitle: "Workspaces",
   yourWorkspacesButton: "Your workspaces",
   allWorkspacesButton: "All workspaces",
   runningWorkspacesButton: "Running workspaces",
-  createANewWorkspace: `Create a new workspace from a `,
+  createWorkspace: <>Create Workspace&hellip;</>,
+  seeAllTemplates: "See all templates",
   template: "Template",
-}
+};
+
+type TemplateQuery = UseQueryResult<Template[]>;
 
 export interface WorkspacesPageViewProps {
-  error: unknown
-  workspaces?: Workspace[]
-  count?: number
-  filterProps: ComponentProps<typeof WorkspacesFilter>
-  page: number
-  limit: number
-  onPageChange: (page: number) => void
-  onUpdateWorkspace: (workspace: Workspace) => void
+  error: unknown;
+  workspaces?: Workspace[];
+  dormantWorkspaces?: Workspace[];
+  checkedWorkspaces: Workspace[];
+  count?: number;
+  filterProps: ComponentProps<typeof WorkspacesFilter>;
+  page: number;
+  limit: number;
+  onPageChange: (page: number) => void;
+  onUpdateWorkspace: (workspace: Workspace) => void;
+  onCheckChange: (checkedWorkspaces: Workspace[]) => void;
+  onDeleteAll: () => void;
+  canCheckWorkspaces: boolean;
+
+  templatesFetchStatus: TemplateQuery["status"];
+  templates: TemplateQuery["data"];
 }
 
 export const WorkspacesPageView: FC<
   React.PropsWithChildren<WorkspacesPageViewProps>
 > = ({
   workspaces,
+  dormantWorkspaces,
   error,
   limit,
   count,
@@ -52,65 +64,54 @@ export const WorkspacesPageView: FC<
   onPageChange,
   onUpdateWorkspace,
   page,
+  checkedWorkspaces,
+  onCheckChange,
+  onDeleteAll,
+  canCheckWorkspaces,
+  templates,
+  templatesFetchStatus,
 }) => {
-  const { saveLocal, getLocal } = useLocalStorage()
+  const { saveLocal } = useLocalStorage();
 
-  const workspaceIdsWithImpendingDeletions = workspaces
+  const workspacesDeletionScheduled = dormantWorkspaces
     ?.filter((workspace) => workspace.deleting_at)
-    .map((workspace) => workspace.id)
-
-  /**
-   * Returns a boolean indicating if there are workspaces that have been
-   * recently marked for deletion but are not in local storage.
-   * If there are, we want to alert the user so they can potentially take action
-   * before deletion takes place.
-   * @returns {boolean}
-   */
-  const isNewWorkspacesImpendingDeletion = (): boolean => {
-    const dismissedList = getLocal("dismissedWorkspaceList")
-    if (!dismissedList) {
-      return true
-    }
-
-    const diff = difference(
-      workspaceIdsWithImpendingDeletions,
-      JSON.parse(dismissedList),
-    )
+    .map((workspace) => workspace.id);
 
-    return diff && diff.length > 0
-  }
+  const hasDormantWorkspace =
+    dormantWorkspaces !== undefined && dormantWorkspaces.length > 0;
 
   return (
     <Margins>
-      <PageHeader>
+      <PageHeader
+        actions={
+          <WorkspacesButton
+            templates={templates}
+            templatesFetchStatus={templatesFetchStatus}
+          >
+            {Language.createWorkspace}
+          </WorkspacesButton>
+        }
+      >
         <PageHeaderTitle>
           <Stack direction="row" spacing={1} alignItems="center">
             <span>{Language.pageTitle}</span>
             <WorkspaceHelpTooltip />
           </Stack>
         </PageHeaderTitle>
-
-        <PageHeaderSubtitle>
-          {Language.createANewWorkspace}
-          <Link component={RouterLink} to="/templates">
-            {Language.template}
-          </Link>
-          .
-        </PageHeaderSubtitle>
       </PageHeader>
 
       <Stack>
-        <Maybe condition={hasError(error) && !isApiValidationError(error)}>
+        {hasError(error) && !isApiValidationError(error) && (
           <ErrorAlert error={error} />
-        </Maybe>
-        {/* <ImpendingDeletionBanner/> determines its own visibility */}
-        <ImpendingDeletionBanner
-          workspace={workspaces?.find((workspace) => workspace.deleting_at)}
-          shouldRedisplayBanner={isNewWorkspacesImpendingDeletion()}
+        )}
+        {/* <DormantWorkspaceBanner/> determines its own visibility */}
+        <DormantWorkspaceBanner
+          workspaces={dormantWorkspaces}
+          shouldRedisplayBanner={hasDormantWorkspace}
           onDismiss={() =>
             saveLocal(
               "dismissedWorkspaceList",
-              JSON.stringify(workspaceIdsWithImpendingDeletions),
+              JSON.stringify(workspacesDeletionScheduled),
             )
           }
           count={Count.Multiple}
@@ -119,17 +120,42 @@ export const WorkspacesPageView: FC<
         <WorkspacesFilter error={error} {...filterProps} />
       </Stack>
 
-      <PaginationStatus
-        isLoading={!workspaces && !error}
-        showing={workspaces?.length ?? 0}
-        total={count ?? 0}
-        label="workspaces"
-      />
+      <TableToolbar>
+        {checkedWorkspaces.length > 0 ? (
+          <>
+            <Box>
+              Selected <strong>{checkedWorkspaces.length}</strong> of{" "}
+              <strong>{workspaces?.length}</strong>{" "}
+              {workspaces?.length === 1 ? "workspace" : "workspaces"}
+            </Box>
+
+            <Box sx={{ marginLeft: "auto" }}>
+              <Button
+                size="small"
+                startIcon={<DeleteOutlined />}
+                onClick={onDeleteAll}
+              >
+                Delete selected
+              </Button>
+            </Box>
+          </>
+        ) : (
+          <PaginationStatus
+            isLoading={!workspaces && !error}
+            showing={workspaces?.length ?? 0}
+            total={count ?? 0}
+            label="workspaces"
+          />
+        )}
+      </TableToolbar>
 
       <WorkspacesTable
         workspaces={workspaces}
         isUsingFilter={filterProps.filter.used}
         onUpdateWorkspace={onUpdateWorkspace}
+        checkedWorkspaces={checkedWorkspaces}
+        onCheckChange={onCheckChange}
+        canCheckWorkspaces={canCheckWorkspaces}
       />
       {count !== undefined && (
         <PaginationWidgetBase
@@ -140,5 +166,5 @@ export const WorkspacesPageView: FC<
         />
       )}
     </Margins>
-  )
-}
+  );
+};
diff --git a/site/src/pages/WorkspacesPage/WorkspacesSearchBox.tsx b/site/src/pages/WorkspacesPage/WorkspacesSearchBox.tsx
new file mode 100644
index 0000000000000..297ae5699fbdc
--- /dev/null
+++ b/site/src/pages/WorkspacesPage/WorkspacesSearchBox.tsx
@@ -0,0 +1,94 @@
+/**
+ * @file Defines a controlled searchbox component for processing form state.
+ *
+ * Not defined as a top-level component just yet, because it's not clear how
+ * reusable this is outside of workspace dropdowns.
+ */
+import {
+  type ForwardedRef,
+  type KeyboardEvent,
+  forwardRef,
+  useId,
+} from "react";
+
+import Box from "@mui/system/Box";
+import SearchIcon from "@mui/icons-material/SearchOutlined";
+import { visuallyHidden } from "@mui/utils";
+import { type SystemStyleObject } from "@mui/system";
+
+type Props = {
+  value: string;
+  onValueChange: (newValue: string) => void;
+
+  placeholder?: string;
+  label?: string;
+  onKeyDown?: (event: KeyboardEvent) => void;
+  sx?: SystemStyleObject;
+};
+
+export const SearchBox = forwardRef(function SearchBox(
+  {
+    value,
+    onValueChange,
+    onKeyDown,
+    label = "Search",
+    placeholder = "Search...",
+    sx = {},
+  }: Props,
+  ref?: ForwardedRef<HTMLInputElement>,
+) {
+  const hookId = useId();
+  const inputId = `${hookId}-${SearchBox.name}-input`;
+
+  return (
+    <Box
+      sx={{
+        display: "flex",
+        flexFlow: "row nowrap",
+        alignItems: "center",
+        paddingX: 2,
+        height: "40px",
+        borderBottom: (theme) => `1px solid ${theme.palette.divider}`,
+        ...sx,
+      }}
+      onKeyDown={onKeyDown}
+    >
+      <Box component="div" sx={{ width: "18px" }}>
+        <SearchIcon
+          sx={{
+            display: "block",
+            fontSize: "14px",
+            marginX: "auto",
+            color: (theme) => theme.palette.text.secondary,
+          }}
+        />
+      </Box>
+
+      <Box component="label" sx={visuallyHidden} htmlFor={inputId}>
+        {label}
+      </Box>
+
+      <Box
+        component="input"
+        type="text"
+        ref={ref}
+        id={inputId}
+        autoFocus
+        tabIndex={0}
+        placeholder={placeholder}
+        value={value}
+        onChange={(e) => onValueChange(e.target.value)}
+        sx={{
+          height: "100%",
+          border: 0,
+          background: "none",
+          width: "100%",
+          outline: 0,
+          "&::placeholder": {
+            color: (theme) => theme.palette.text.secondary,
+          },
+        }}
+      />
+    </Box>
+  );
+});
diff --git a/site/src/pages/WorkspacesPage/WorkspacesTable.tsx b/site/src/pages/WorkspacesPage/WorkspacesTable.tsx
index 2f79cfde547df..63eb19d865d86 100644
--- a/site/src/pages/WorkspacesPage/WorkspacesTable.tsx
+++ b/site/src/pages/WorkspacesPage/WorkspacesTable.tsx
@@ -1,58 +1,87 @@
-import Table from "@mui/material/Table"
-import TableBody from "@mui/material/TableBody"
-import TableCell from "@mui/material/TableCell"
-import TableContainer from "@mui/material/TableContainer"
-import TableHead from "@mui/material/TableHead"
-import TableRow from "@mui/material/TableRow"
-import { Workspace } from "api/typesGenerated"
-import { FC, ReactNode } from "react"
-import { TableEmpty } from "components/TableEmpty/TableEmpty"
-import { useTranslation } from "react-i18next"
-import { TableLoaderSkeleton } from "components/TableLoader/TableLoader"
-import AddOutlined from "@mui/icons-material/AddOutlined"
-import Button from "@mui/material/Button"
-import { ChooseOne, Cond } from "components/Conditionals/ChooseOne"
-import { Link as RouterLink, useNavigate } from "react-router-dom"
-import { makeStyles } from "@mui/styles"
+import Table from "@mui/material/Table";
+import TableBody from "@mui/material/TableBody";
+import TableCell from "@mui/material/TableCell";
+import TableContainer from "@mui/material/TableContainer";
+import TableHead from "@mui/material/TableHead";
+import TableRow from "@mui/material/TableRow";
+import { Workspace } from "api/typesGenerated";
+import { FC, ReactNode } from "react";
+import { TableEmpty } from "components/TableEmpty/TableEmpty";
 import {
-  HelpTooltip,
-  HelpTooltipText,
-  HelpTooltipTitle,
-} from "components/Tooltips/HelpTooltip"
-import InfoIcon from "@mui/icons-material/InfoOutlined"
-import { colors } from "theme/colors"
-import { useClickableTableRow } from "hooks/useClickableTableRow"
-import KeyboardArrowRight from "@mui/icons-material/KeyboardArrowRight"
-import Box from "@mui/material/Box"
-import { AvatarData } from "components/AvatarData/AvatarData"
-import { Avatar } from "components/Avatar/Avatar"
-import { Stack } from "components/Stack/Stack"
-import { LastUsed } from "components/LastUsed/LastUsed"
-import { WorkspaceOutdatedTooltip } from "components/Tooltips"
-import { WorkspaceStatusBadge } from "components/WorkspaceStatusBadge/WorkspaceStatusBadge"
-import { getDisplayWorkspaceTemplateName } from "utils/workspace"
+  TableLoaderSkeleton,
+  TableRowSkeleton,
+} from "components/TableLoader/TableLoader";
+import AddOutlined from "@mui/icons-material/AddOutlined";
+import Button from "@mui/material/Button";
+import { Link as RouterLink, useNavigate } from "react-router-dom";
+import { useClickableTableRow } from "hooks/useClickableTableRow";
+import KeyboardArrowRight from "@mui/icons-material/KeyboardArrowRight";
+import Box from "@mui/material/Box";
+import { AvatarData } from "components/AvatarData/AvatarData";
+import { Avatar } from "components/Avatar/Avatar";
+import { Stack } from "components/Stack/Stack";
+import { LastUsed } from "pages/WorkspacesPage/LastUsed";
+import { WorkspaceOutdatedTooltip } from "components/WorkspaceOutdatedTooltip/WorkspaceOutdatedTooltip";
+import { WorkspaceStatusBadge } from "components/WorkspaceStatusBadge/WorkspaceStatusBadge";
+import { getDisplayWorkspaceTemplateName } from "utils/workspace";
+import Checkbox from "@mui/material/Checkbox";
+import { AvatarDataSkeleton } from "components/AvatarData/AvatarDataSkeleton";
+import Skeleton from "@mui/material/Skeleton";
+import { InfoTooltip } from "components/InfoTooltip/InfoTooltip";
+import { css } from "@emotion/react";
+import { useTheme } from "@mui/system";
 
 export interface WorkspacesTableProps {
-  workspaces?: Workspace[]
-  isUsingFilter: boolean
-  onUpdateWorkspace: (workspace: Workspace) => void
-  error?: unknown
+  workspaces?: Workspace[];
+  checkedWorkspaces: Workspace[];
+  error?: unknown;
+  isUsingFilter: boolean;
+  onUpdateWorkspace: (workspace: Workspace) => void;
+  onCheckChange: (checkedWorkspaces: Workspace[]) => void;
+  canCheckWorkspaces: boolean;
 }
 
 export const WorkspacesTable: FC<WorkspacesTableProps> = ({
   workspaces,
+  checkedWorkspaces,
   isUsingFilter,
   onUpdateWorkspace,
+  onCheckChange,
+  canCheckWorkspaces,
 }) => {
-  const { t } = useTranslation("workspacesPage")
-  const styles = useStyles()
+  const theme = useTheme();
 
   return (
     <TableContainer>
       <Table>
         <TableHead>
           <TableRow>
-            <TableCell width="40%">Name</TableCell>
+            <TableCell width="40%">
+              <Box sx={{ display: "flex", alignItems: "center", gap: 1 }}>
+                {canCheckWorkspaces && (
+                  <Checkbox
+                    // Remove the extra padding added for the first cell in the
+                    // table
+                    sx={{ marginLeft: "-20px" }}
+                    disabled={!workspaces || workspaces.length === 0}
+                    checked={checkedWorkspaces.length === workspaces?.length}
+                    size="small"
+                    onChange={(_, checked) => {
+                      if (!workspaces) {
+                        return;
+                      }
+
+                      if (!checked) {
+                        onCheckChange([]);
+                      } else {
+                        onCheckChange(workspaces);
+                      }
+                    }}
+                  />
+                )}
+                Name
+              </Box>
+            </TableCell>
             <TableCell width="25%">Template</TableCell>
             <TableCell width="20%">Last used</TableCell>
             <TableCell width="15%">Status</TableCell>
@@ -60,171 +89,248 @@ export const WorkspacesTable: FC<WorkspacesTableProps> = ({
           </TableRow>
         </TableHead>
         <TableBody>
-          {!workspaces && <TableLoaderSkeleton columns={5} useAvatarData />}
+          {!workspaces && (
+            <TableLoader canCheckWorkspaces={canCheckWorkspaces} />
+          )}
           {workspaces && workspaces.length === 0 && (
-            <ChooseOne>
-              <Cond condition={isUsingFilter}>
-                <TableEmpty message={t("emptyResultsMessage")} />
-              </Cond>
-
-              <Cond>
+            <>
+              {isUsingFilter ? (
+                <TableEmpty message="No results matched your search" />
+              ) : (
                 <TableEmpty
-                  className={styles.withImage}
-                  message={t("emptyCreateWorkspaceMessage")}
-                  description={t("emptyCreateWorkspaceDescription")}
+                  css={{
+                    paddingBottom: 0,
+                  }}
+                  message="Create a workspace"
+                  description="A workspace is your personal, customizable development environment in the cloud"
                   cta={
                     <Button
                       component={RouterLink}
                       to="/templates"
                       startIcon={<AddOutlined />}
                       variant="contained"
+                      data-testid="button-select-template"
                     >
-                      {t("createFromTemplateButton")}
+                      Select a Template
                     </Button>
                   }
                   image={
-                    <div className={styles.emptyImage}>
+                    <div
+                      css={css`
+                        max-width: 50%;
+                        height: ${theme.spacing(34)};
+                        overflow: hidden;
+                        margin-top: ${theme.spacing(6)};
+                        opacity: 0.85;
+
+                        & img {
+                          max-width: 100%;
+                        }
+                      `}
+                    >
                       <img src="/featured/workspaces.webp" alt="" />
                     </div>
                   }
                 />
-              </Cond>
-            </ChooseOne>
+              )}
+            </>
           )}
           {workspaces &&
-            workspaces.map((workspace) => (
-              <WorkspacesRow workspace={workspace} key={workspace.id}>
-                <TableCell>
-                  <AvatarData
-                    title={
-                      <Stack direction="row" spacing={0} alignItems="center">
-                        {workspace.name}
-                        {workspace.outdated && (
-                          <WorkspaceOutdatedTooltip
-                            templateName={workspace.template_name}
-                            templateId={workspace.template_id}
-                            onUpdateVersion={() => {
-                              onUpdateWorkspace(workspace)
-                            }}
+            workspaces.map((workspace) => {
+              const checked = checkedWorkspaces.some(
+                (w) => w.id === workspace.id,
+              );
+              return (
+                <WorkspacesRow
+                  workspace={workspace}
+                  key={workspace.id}
+                  checked={checked}
+                >
+                  <TableCell>
+                    <Box sx={{ display: "flex", alignItems: "center", gap: 1 }}>
+                      {canCheckWorkspaces && (
+                        <Checkbox
+                          // Remove the extra padding added for the first cell in the
+                          // table
+                          sx={{ marginLeft: "-20px" }}
+                          data-testid={`checkbox-${workspace.id}`}
+                          size="small"
+                          disabled={cantBeChecked(workspace)}
+                          checked={checked}
+                          onClick={(e) => {
+                            e.stopPropagation();
+                          }}
+                          onChange={(e) => {
+                            if (e.currentTarget.checked) {
+                              onCheckChange([...checkedWorkspaces, workspace]);
+                            } else {
+                              onCheckChange(
+                                checkedWorkspaces.filter(
+                                  (w) => w.id !== workspace.id,
+                                ),
+                              );
+                            }
+                          }}
+                        />
+                      )}
+                      <AvatarData
+                        title={
+                          <Stack
+                            direction="row"
+                            spacing={0}
+                            alignItems="center"
+                          >
+                            {workspace.name}
+                            {workspace.outdated && (
+                              <WorkspaceOutdatedTooltip
+                                templateName={workspace.template_name}
+                                latestVersionId={
+                                  workspace.template_active_version_id
+                                }
+                                onUpdateVersion={() => {
+                                  onUpdateWorkspace(workspace);
+                                }}
+                              />
+                            )}
+                          </Stack>
+                        }
+                        subtitle={workspace.owner_name}
+                        avatar={
+                          <Avatar
+                            src={workspace.template_icon}
+                            variant={
+                              workspace.template_icon ? "square" : undefined
+                            }
+                            fitImage={Boolean(workspace.template_icon)}
+                          >
+                            {workspace.name}
+                          </Avatar>
+                        }
+                      />
+                    </Box>
+                  </TableCell>
+
+                  <TableCell>
+                    {getDisplayWorkspaceTemplateName(workspace)}
+                  </TableCell>
+
+                  <TableCell>
+                    <LastUsed lastUsedAt={workspace.last_used_at} />
+                  </TableCell>
+
+                  <TableCell>
+                    <Box sx={{ display: "flex", alignItems: "center", gap: 1 }}>
+                      <WorkspaceStatusBadge workspace={workspace} />
+                      {workspace.latest_build.status === "running" &&
+                        !workspace.health.healthy && (
+                          <InfoTooltip
+                            type="warning"
+                            title="Workspace is unhealthy"
+                            message="Your workspace is running but some agents are unhealthy."
                           />
                         )}
-                      </Stack>
-                    }
-                    subtitle={workspace.owner_name}
-                    avatar={
-                      <Avatar
-                        src={workspace.template_icon}
-                        variant={workspace.template_icon ? "square" : undefined}
-                        fitImage={Boolean(workspace.template_icon)}
-                      >
-                        {workspace.name}
-                      </Avatar>
-                    }
-                  />
-                </TableCell>
-
-                <TableCell>
-                  {getDisplayWorkspaceTemplateName(workspace)}
-                </TableCell>
-
-                <TableCell>
-                  <LastUsed lastUsedAt={workspace.last_used_at} />
-                </TableCell>
-
-                <TableCell>
-                  <Box sx={{ display: "flex", alignItems: "center", gap: 1 }}>
-                    <WorkspaceStatusBadge workspace={workspace} />
-                    {workspace.latest_build.status === "running" &&
-                      !workspace.health.healthy && <UnhealthyTooltip />}
-                  </Box>
-                </TableCell>
-
-                <TableCell>
-                  <Box
-                    sx={{
-                      display: "flex",
-                      paddingLeft: (theme) => theme.spacing(2),
-                    }}
-                  >
-                    <KeyboardArrowRight
+                    </Box>
+                  </TableCell>
+
+                  <TableCell>
+                    <Box
                       sx={{
-                        color: (theme) => theme.palette.text.secondary,
-                        width: 20,
-                        height: 20,
+                        display: "flex",
+                        paddingLeft: (theme) => theme.spacing(2),
                       }}
-                    />
-                  </Box>
-                </TableCell>
-              </WorkspacesRow>
-            ))}
+                    >
+                      <KeyboardArrowRight
+                        sx={{
+                          color: (theme) => theme.palette.text.secondary,
+                          width: 20,
+                          height: 20,
+                        }}
+                      />
+                    </Box>
+                  </TableCell>
+                </WorkspacesRow>
+              );
+            })}
         </TableBody>
       </Table>
     </TableContainer>
-  )
-}
+  );
+};
 
 const WorkspacesRow: FC<{
-  workspace: Workspace
-  children: ReactNode
-}> = ({ workspace, children }) => {
-  const navigate = useNavigate()
-  const workspacePageLink = `/@${workspace.owner_name}/${workspace.name}`
-  const clickable = useClickableTableRow(() => {
-    navigate(workspacePageLink)
-  })
+  workspace: Workspace;
+  children: ReactNode;
+  checked: boolean;
+}> = ({ workspace, children, checked }) => {
+  const navigate = useNavigate();
 
-  return (
-    <TableRow data-testid={`workspace-${workspace.id}`} {...clickable}>
-      {children}
-    </TableRow>
-  )
-}
+  const workspacePageLink = `/@${workspace.owner_name}/${workspace.name}`;
+  const openLinkInNewTab = () => window.open(workspacePageLink, "_blank");
 
-export const UnhealthyTooltip = () => {
-  const styles = useUnhealthyTooltipStyles()
+  const clickableProps = useClickableTableRow({
+    onMiddleClick: openLinkInNewTab,
+    onClick: (event) => {
+      // Order of booleans actually matters here for Windows-Mac compatibility;
+      // meta key is Cmd on Macs, but on Windows, it's either the Windows key,
+      // or the key does nothing at all (depends on the browser)
+      const shouldOpenInNewTab =
+        event.shiftKey || event.metaKey || event.ctrlKey;
+
+      if (shouldOpenInNewTab) {
+        openLinkInNewTab();
+      } else {
+        navigate(workspacePageLink);
+      }
+    },
+  });
 
   return (
-    <HelpTooltip
-      size="small"
-      icon={InfoIcon}
-      iconClassName={styles.unhealthyIcon}
-      buttonClassName={styles.unhealthyButton}
+    <TableRow
+      {...clickableProps}
+      data-testid={`workspace-${workspace.id}`}
+      sx={{
+        backgroundColor: (theme) =>
+          checked ? theme.palette.action.hover : undefined,
+      }}
     >
-      <HelpTooltipTitle>Workspace is unhealthy</HelpTooltipTitle>
-      <HelpTooltipText>
-        Your workspace is running but some agents are unhealthy.
-      </HelpTooltipText>
-    </HelpTooltip>
-  )
-}
-
-const useUnhealthyTooltipStyles = makeStyles(() => ({
-  unhealthyIcon: {
-    color: colors.yellow[5],
-  },
+      {children}
+    </TableRow>
+  );
+};
 
-  unhealthyButton: {
-    opacity: 1,
+const TableLoader = ({
+  canCheckWorkspaces,
+}: {
+  canCheckWorkspaces: boolean;
+}) => {
+  return (
+    <TableLoaderSkeleton>
+      <TableRowSkeleton>
+        <TableCell width="40%">
+          <Box sx={{ display: "flex", alignItems: "center", gap: 1 }}>
+            {canCheckWorkspaces && (
+              <Checkbox size="small" disabled sx={{ marginLeft: "-20px" }} />
+            )}
+            <AvatarDataSkeleton />
+          </Box>
+        </TableCell>
+        <TableCell>
+          <Skeleton variant="text" width="25%" />
+        </TableCell>
+        <TableCell>
+          <Skeleton variant="text" width="25%" />
+        </TableCell>
+        <TableCell>
+          <Skeleton variant="text" width="25%" />
+        </TableCell>
+        <TableCell>
+          <Skeleton variant="text" width="25%" />
+        </TableCell>
+      </TableRowSkeleton>
+    </TableLoaderSkeleton>
+  );
+};
 
-    "&:hover": {
-      opacity: 1,
-    },
-  },
-}))
-
-const useStyles = makeStyles((theme) => ({
-  withImage: {
-    paddingBottom: 0,
-  },
-  emptyImage: {
-    maxWidth: "50%",
-    height: theme.spacing(34),
-    overflow: "hidden",
-    marginTop: theme.spacing(6),
-    opacity: 0.85,
-
-    "& img": {
-      maxWidth: "100%",
-    },
-  },
-}))
+const cantBeChecked = (workspace: Workspace) => {
+  return ["deleting", "pending"].includes(workspace.latest_build.status);
+};
diff --git a/site/src/pages/WorkspacesPage/data.ts b/site/src/pages/WorkspacesPage/data.ts
index e3d71ab80853f..8bbda6c41780b 100644
--- a/site/src/pages/WorkspacesPage/data.ts
+++ b/site/src/pages/WorkspacesPage/data.ts
@@ -1,33 +1,27 @@
-import {
-  QueryKey,
-  useMutation,
-  useQuery,
-  useQueryClient,
-} from "@tanstack/react-query"
-import { getWorkspaces, updateWorkspaceVersion } from "api/api"
-import { getErrorMessage } from "api/errors"
+import { QueryKey, useMutation, useQuery, useQueryClient } from "react-query";
+import { getWorkspaces, updateWorkspaceVersion } from "api/api";
+import { getErrorMessage } from "api/errors";
 import {
   Workspace,
   WorkspaceBuild,
   WorkspacesResponse,
-} from "api/typesGenerated"
-import { displayError } from "components/GlobalSnackbar/utils"
-import { useState } from "react"
-import { useTranslation } from "react-i18next"
+} from "api/typesGenerated";
+import { displayError } from "components/GlobalSnackbar/utils";
+import { useState } from "react";
 
 type UseWorkspacesDataParams = {
-  page: number
-  limit: number
-  query: string
-}
+  page: number;
+  limit: number;
+  query: string;
+};
 
 export const useWorkspacesData = ({
   page,
   limit,
   query,
 }: UseWorkspacesDataParams) => {
-  const queryKey = ["workspaces", query, page]
-  const [shouldRefetch, setShouldRefetch] = useState(true)
+  const queryKey = ["workspaces", query, page];
+  const [shouldRefetch, setShouldRefetch] = useState(true);
   const result = useQuery({
     queryKey,
     queryFn: () =>
@@ -37,47 +31,49 @@ export const useWorkspacesData = ({
         offset: page <= 0 ? 0 : (page - 1) * limit,
       }),
     onSuccess: () => {
-      setShouldRefetch(true)
+      setShouldRefetch(true);
     },
     onError: () => {
-      setShouldRefetch(false)
+      setShouldRefetch(false);
     },
     refetchInterval: shouldRefetch ? 5_000 : undefined,
-  })
+  });
 
   return {
     ...result,
     queryKey,
-  }
-}
+  };
+};
 
 export const useWorkspaceUpdate = (queryKey: QueryKey) => {
-  const queryClient = useQueryClient()
-  const { t } = useTranslation("workspacesPage")
+  const queryClient = useQueryClient();
 
   return useMutation({
     mutationFn: updateWorkspaceVersion,
     onMutate: async (workspace) => {
-      await queryClient.cancelQueries({ queryKey })
+      await queryClient.cancelQueries({ queryKey });
       queryClient.setQueryData<WorkspacesResponse>(queryKey, (oldResponse) => {
         if (oldResponse) {
-          return assignPendingStatus(oldResponse, workspace)
+          return assignPendingStatus(oldResponse, workspace);
         }
-      })
+      });
     },
     onSuccess: (workspaceBuild) => {
       queryClient.setQueryData<WorkspacesResponse>(queryKey, (oldResponse) => {
         if (oldResponse) {
-          return assignLatestBuild(oldResponse, workspaceBuild)
+          return assignLatestBuild(oldResponse, workspaceBuild);
         }
-      })
+      });
     },
     onError: (error) => {
-      const message = getErrorMessage(error, t("updateVersionError"))
-      displayError(message)
+      const message = getErrorMessage(
+        error,
+        "Error updating workspace version",
+      );
+      displayError(message);
     },
-  })
-}
+  });
+};
 
 const assignLatestBuild = (
   oldResponse: WorkspacesResponse,
@@ -90,13 +86,13 @@ const assignLatestBuild = (
         return {
           ...workspace,
           latest_build: build,
-        }
+        };
       }
 
-      return workspace
+      return workspace;
     }),
-  }
-}
+  };
+};
 
 const assignPendingStatus = (
   oldResponse: WorkspacesResponse,
@@ -116,10 +112,10 @@ const assignPendingStatus = (
               status: "pending",
             },
           },
-        } as Workspace
+        } as Workspace;
       }
 
-      return workspaceItem
+      return workspaceItem;
     }),
-  }
-}
+  };
+};
diff --git a/site/src/pages/WorkspacesPage/filter/filter.tsx b/site/src/pages/WorkspacesPage/filter/filter.tsx
index 2772347d995cf..53d83008cc308 100644
--- a/site/src/pages/WorkspacesPage/filter/filter.tsx
+++ b/site/src/pages/WorkspacesPage/filter/filter.tsx
@@ -1,9 +1,10 @@
-import { FC } from "react"
-import Box from "@mui/material/Box"
-import { Avatar, AvatarProps } from "components/Avatar/Avatar"
-import { Palette, PaletteColor } from "@mui/material/styles"
-import { TemplateFilterMenu, StatusFilterMenu } from "./menus"
-import { TemplateOption, StatusOption } from "./options"
+import { FC } from "react";
+import Box from "@mui/material/Box";
+import { useIsWorkspaceActionsEnabled } from "components/Dashboard/DashboardProvider";
+import { Avatar, AvatarProps } from "components/Avatar/Avatar";
+import { Palette, PaletteColor } from "@mui/material/styles";
+import { TemplateFilterMenu, StatusFilterMenu } from "./menus";
+import { TemplateOption, StatusOption } from "./options";
 import {
   Filter,
   FilterMenu,
@@ -12,14 +13,34 @@ import {
   OptionItem,
   SearchFieldSkeleton,
   useFilter,
-} from "components/Filter/filter"
-import { UserFilterMenu, UserMenu } from "components/Filter/UserFilter"
-import { workspaceFilterQuery } from "utils/filters"
-import { docs } from "utils/docs"
+} from "components/Filter/filter";
+import { UserFilterMenu, UserMenu } from "components/Filter/UserFilter";
+import { docs } from "utils/docs";
 
-const PRESET_FILTERS = [
-  { query: workspaceFilterQuery.me, name: "My workspaces" },
-  { query: workspaceFilterQuery.all, name: "All workspaces" },
+export const workspaceFilterQuery = {
+  me: "owner:me",
+  all: "",
+  running: "status:running",
+  failed: "status:failed",
+  dormant: "is-dormant:true",
+};
+
+type FilterPreset = {
+  query: string;
+  name: string;
+};
+
+// Can't use as const declarations to make arrays deep readonly because that
+// interferes with the type contracts for Filter
+const PRESET_FILTERS: FilterPreset[] = [
+  {
+    query: workspaceFilterQuery.me,
+    name: "My workspaces",
+  },
+  {
+    query: workspaceFilterQuery.all,
+    name: "All workspaces",
+  },
   {
     query: workspaceFilterQuery.running,
     name: "Running workspaces",
@@ -28,24 +49,38 @@ const PRESET_FILTERS = [
     query: workspaceFilterQuery.failed,
     name: "Failed workspaces",
   },
-]
+];
+
+// Defined outside component so that the array doesn't get reconstructed each render
+const PRESETS_WITH_DORMANT: FilterPreset[] = [
+  ...PRESET_FILTERS,
+  {
+    query: workspaceFilterQuery.dormant,
+    name: "Dormant workspaces",
+  },
+];
+
+type WorkspaceFilterProps = {
+  filter: ReturnType<typeof useFilter>;
+  error?: unknown;
+  menus: {
+    user?: UserFilterMenu;
+    template: TemplateFilterMenu;
+    status: StatusFilterMenu;
+  };
+};
 
 export const WorkspacesFilter = ({
   filter,
   error,
   menus,
-}: {
-  filter: ReturnType<typeof useFilter>
-  error?: unknown
-  menus: {
-    user?: UserFilterMenu
-    template: TemplateFilterMenu
-    status: StatusFilterMenu
-  }
-}) => {
+}: WorkspaceFilterProps) => {
+  const actionsEnabled = useIsWorkspaceActionsEnabled();
+  const presets = actionsEnabled ? PRESETS_WITH_DORMANT : PRESET_FILTERS;
+
   return (
     <Filter
-      presets={PRESET_FILTERS}
+      presets={presets}
       isLoading={menus.status.isInitializing}
       filter={filter}
       error={error}
@@ -66,8 +101,8 @@ export const WorkspacesFilter = ({
         </>
       }
     />
-  )
-}
+  );
+};
 
 const TemplateMenu = (menu: TemplateFilterMenu) => {
   return (
@@ -84,15 +119,15 @@ const TemplateMenu = (menu: TemplateFilterMenu) => {
     >
       {(itemProps) => <TemplateOptionItem {...itemProps} />}
     </FilterSearchMenu>
-  )
-}
+  );
+};
 
 const TemplateOptionItem = ({
   option,
   isSelected,
 }: {
-  option: TemplateOption
-  isSelected?: boolean
+  option: TemplateOption;
+  isSelected?: boolean;
 }) => {
   return (
     <OptionItem
@@ -106,8 +141,8 @@ const TemplateOptionItem = ({
         />
       }
     />
-  )
-}
+  );
+};
 
 const TemplateAvatar: FC<
   AvatarProps & { templateName: string; icon?: string }
@@ -116,8 +151,8 @@ const TemplateAvatar: FC<
     <Avatar src={icon} variant="square" fitImage {...avatarProps} />
   ) : (
     <Avatar {...avatarProps}>{templateName}</Avatar>
-  )
-}
+  );
+};
 
 const StatusMenu = (menu: StatusFilterMenu) => {
   return (
@@ -134,15 +169,15 @@ const StatusMenu = (menu: StatusFilterMenu) => {
     >
       {(itemProps) => <StatusOptionItem {...itemProps} />}
     </FilterMenu>
-  )
-}
+  );
+};
 
 const StatusOptionItem = ({
   option,
   isSelected,
 }: {
-  option: StatusOption
-  isSelected?: boolean
+  option: StatusOption;
+  isSelected?: boolean;
 }) => {
   return (
     <OptionItem
@@ -150,8 +185,8 @@ const StatusOptionItem = ({
       left={<StatusIndicator option={option} />}
       isSelected={isSelected}
     />
-  )
-}
+  );
+};
 
 const StatusIndicator: FC<{ option: StatusOption }> = ({ option }) => {
   return (
@@ -164,5 +199,5 @@ const StatusIndicator: FC<{ option: StatusOption }> = ({ option }) => {
           (theme.palette[option.color as keyof Palette] as PaletteColor).light,
       }}
     />
-  )
-}
+  );
+};
diff --git a/site/src/pages/WorkspacesPage/filter/menus.ts b/site/src/pages/WorkspacesPage/filter/menus.ts
index 6d77cbcd8e368..d83a00aba6afd 100644
--- a/site/src/pages/WorkspacesPage/filter/menus.ts
+++ b/site/src/pages/WorkspacesPage/filter/menus.ts
@@ -1,8 +1,8 @@
-import { StatusOption, TemplateOption } from "./options"
-import { getTemplates } from "api/api"
-import { WorkspaceStatuses } from "api/typesGenerated"
-import { getDisplayWorkspaceStatus } from "utils/workspace"
-import { UseFilterMenuOptions, useFilterMenu } from "components/Filter/menu"
+import { StatusOption, TemplateOption } from "./options";
+import { getTemplates } from "api/api";
+import { WorkspaceStatus } from "api/typesGenerated";
+import { getDisplayWorkspaceStatus } from "utils/workspace";
+import { UseFilterMenuOptions, useFilterMenu } from "components/Filter/menu";
 
 export const useTemplateFilterMenu = ({
   value,
@@ -17,8 +17,8 @@ export const useTemplateFilterMenu = ({
     value,
     id: "template",
     getSelectedOption: async () => {
-      const templates = await getTemplates(orgId)
-      const template = templates.find((template) => template.name === value)
+      const templates = await getTemplates(orgId);
+      const template = templates.find((template) => template.name === value);
       if (template) {
         return {
           label:
@@ -27,41 +27,47 @@ export const useTemplateFilterMenu = ({
               : template.name,
           value: template.name,
           icon: template.icon,
-        }
+        };
       }
-      return null
+      return null;
     },
     getOptions: async (query) => {
-      const templates = await getTemplates(orgId)
+      const templates = await getTemplates(orgId);
       const filteredTemplates = templates.filter(
         (template) =>
           template.name.toLowerCase().includes(query.toLowerCase()) ||
           template.display_name.toLowerCase().includes(query.toLowerCase()),
-      )
+      );
       return filteredTemplates.map((template) => ({
         label:
           template.display_name !== "" ? template.display_name : template.name,
         value: template.name,
         icon: template.icon,
-      }))
+      }));
     },
-  })
-}
+  });
+};
 
-export type TemplateFilterMenu = ReturnType<typeof useTemplateFilterMenu>
+export type TemplateFilterMenu = ReturnType<typeof useTemplateFilterMenu>;
 
 export const useStatusFilterMenu = ({
   value,
   onChange,
 }: Pick<UseFilterMenuOptions<StatusOption>, "value" | "onChange">) => {
-  const statusOptions = WorkspaceStatuses.map((status) => {
-    const display = getDisplayWorkspaceStatus(status)
+  const statusesToFilter: WorkspaceStatus[] = [
+    "running",
+    "stopped",
+    "failed",
+    "pending",
+  ];
+  const statusOptions = statusesToFilter.map((status) => {
+    const display = getDisplayWorkspaceStatus(status);
     return {
       label: display.text,
       value: status,
       color: display.type ?? "warning",
-    } as StatusOption
-  })
+    } as StatusOption;
+  });
   return useFilterMenu({
     onChange,
     value,
@@ -69,7 +75,7 @@ export const useStatusFilterMenu = ({
     getSelectedOption: async () =>
       statusOptions.find((option) => option.value === value) ?? null,
     getOptions: async () => statusOptions,
-  })
-}
+  });
+};
 
-export type StatusFilterMenu = ReturnType<typeof useStatusFilterMenu>
+export type StatusFilterMenu = ReturnType<typeof useStatusFilterMenu>;
diff --git a/site/src/pages/WorkspacesPage/filter/options.ts b/site/src/pages/WorkspacesPage/filter/options.ts
index 2e1b112248cf9..5266e4cdb9587 100644
--- a/site/src/pages/WorkspacesPage/filter/options.ts
+++ b/site/src/pages/WorkspacesPage/filter/options.ts
@@ -1,9 +1,9 @@
-import { BaseOption } from "components/Filter/options"
+import { BaseOption } from "components/Filter/options";
 
 export type StatusOption = BaseOption & {
-  color: string
-}
+  color: string;
+};
 
 export type TemplateOption = BaseOption & {
-  icon?: string
-}
+  icon?: string;
+};
diff --git a/site/src/pages/index.tsx b/site/src/pages/index.tsx
deleted file mode 100644
index 9759d739e0ca0..0000000000000
--- a/site/src/pages/index.tsx
+++ /dev/null
@@ -1,8 +0,0 @@
-import { FC } from "react"
-import { Navigate } from "react-router-dom"
-
-const IndexPage: FC = () => {
-  return <Navigate to="/workspaces" replace />
-}
-
-export default IndexPage
diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
index 8b208548018ed..47c8e4d4a1468 100644
--- a/site/src/testHelpers/entities.ts
+++ b/site/src/testHelpers/entities.ts
@@ -1,20 +1,23 @@
-import { withDefaultFeatures, GetLicensesResponse } from "api/api"
-import { FieldError } from "api/errors"
-import { everyOneGroup } from "utils/groups"
-import * as Types from "api/types"
-import * as TypesGen from "api/typesGenerated"
-import range from "lodash/range"
-import { Permissions } from "xServices/auth/authXService"
-import { TemplateVersionFiles } from "utils/templateVersion"
-import { FileTree } from "utils/filetree"
-import { ProxyLatencyReport } from "contexts/useProxyLatency"
+import {
+  withDefaultFeatures,
+  type GetLicensesResponse,
+  type DeploymentConfig,
+  type Health,
+} from "api/api";
+import { FieldError } from "api/errors";
+import * as TypesGen from "api/typesGenerated";
+import range from "lodash/range";
+import { Permissions } from "components/AuthProvider/permissions";
+import { TemplateVersionFiles } from "utils/templateVersion";
+import { FileTree } from "utils/filetree";
+import { ProxyLatencyReport } from "contexts/useProxyLatency";
 
 export const MockOrganization: TypesGen.Organization = {
   id: "fc0774ce-cc9e-48d4-80ae-88f7a4d4a8b0",
   name: "Test Organization",
   created_at: "",
   updated_at: "",
-}
+};
 
 export const MockTemplateDAUResponse: TypesGen.DAUsResponse = {
   tz_hour_offset: 0,
@@ -23,22 +26,22 @@ export const MockTemplateDAUResponse: TypesGen.DAUsResponse = {
     { date: "2022-08-29T00:00:00Z", amount: 2 },
     { date: "2022-08-30T00:00:00Z", amount: 1 },
   ],
-}
+};
 export const MockDeploymentDAUResponse: TypesGen.DAUsResponse = {
   tz_hour_offset: 0,
   entries: [
-    { date: "2022-08-27T00:00:00Z", amount: 1 },
-    { date: "2022-08-29T00:00:00Z", amount: 2 },
-    { date: "2022-08-30T00:00:00Z", amount: 1 },
+    { date: "2022-08-27T00:00:00Z", amount: 10 },
+    { date: "2022-08-29T00:00:00Z", amount: 22 },
+    { date: "2022-08-30T00:00:00Z", amount: 14 },
   ],
-}
+};
 export const MockSessionToken: TypesGen.LoginWithPasswordResponse = {
   session_token: "my-session-token",
-}
+};
 
 export const MockAPIKey: TypesGen.GenerateAPIKeyResponse = {
   key: "my-api-key",
-}
+};
 
 export const MockToken: TypesGen.APIKeyWithOwner = {
   id: "tBoVE3dqLl",
@@ -52,7 +55,7 @@ export const MockToken: TypesGen.APIKeyWithOwner = {
   lifetime_seconds: 2592000,
   token_name: "token-one",
   username: "admin",
-}
+};
 
 export const MockTokens: TypesGen.APIKeyWithOwner[] = [
   MockToken,
@@ -69,7 +72,7 @@ export const MockTokens: TypesGen.APIKeyWithOwner[] = [
     token_name: "token-two",
     username: "admin",
   },
-]
+];
 
 export const MockPrimaryWorkspaceProxy: TypesGen.WorkspaceProxy = {
   id: "4aa23000-526a-481f-a007-0f20b98b1e12",
@@ -88,7 +91,7 @@ export const MockPrimaryWorkspaceProxy: TypesGen.WorkspaceProxy = {
     status: "ok",
     checked_at: new Date().toISOString(),
   },
-}
+};
 
 export const MockHealthyWildWorkspaceProxy: TypesGen.WorkspaceProxy = {
   id: "5e2c1ab7-479b-41a9-92ce-aa85625de52c",
@@ -107,7 +110,7 @@ export const MockHealthyWildWorkspaceProxy: TypesGen.WorkspaceProxy = {
     status: "ok",
     checked_at: new Date().toISOString(),
   },
-}
+};
 
 export const MockUnhealthyWildWorkspaceProxy: TypesGen.WorkspaceProxy = {
   id: "8444931c-0247-4171-842a-569d9f9cbadb",
@@ -130,7 +133,7 @@ export const MockUnhealthyWildWorkspaceProxy: TypesGen.WorkspaceProxy = {
     },
     checked_at: new Date().toISOString(),
   },
-}
+};
 
 export const MockWorkspaceProxies: TypesGen.WorkspaceProxy[] = [
   MockPrimaryWorkspaceProxy,
@@ -154,13 +157,13 @@ export const MockWorkspaceProxies: TypesGen.WorkspaceProxy[] = [
       checked_at: new Date().toISOString(),
     },
   },
-]
+];
 
 export const MockProxyLatencies: Record<string, ProxyLatencyReport> = {
   ...MockWorkspaceProxies.reduce(
     (acc, proxy) => {
       if (!proxy.healthy) {
-        return acc
+        return acc;
       }
       acc[proxy.id] = {
         // Make one of them inaccurate.
@@ -180,19 +183,19 @@ export const MockProxyLatencies: Record<string, ProxyLatencyReport> = {
             100) %
           250,
         at: new Date(),
-      }
-      return acc
+      };
+      return acc;
     },
     {} as Record<string, ProxyLatencyReport>,
   ),
-}
+};
 
 export const MockBuildInfo: TypesGen.BuildInfoResponse = {
   external_url: "file:///mock-url",
   version: "v99.999.9999+c9cdf14",
   dashboard_url: "https:///mock-url",
   workspace_proxy: false,
-}
+};
 
 export const MockSupportLinks: TypesGen.LinkConfig[] = [
   {
@@ -211,38 +214,38 @@ export const MockSupportLinks: TypesGen.LinkConfig[] = [
       "https://github.com/coder/coder/issues/new?labels=needs+grooming&body={CODER_BUILD_INFO}",
     icon: "",
   },
-]
+];
 
 export const MockUpdateCheck: TypesGen.UpdateCheckResponse = {
   current: true,
   url: "file:///mock-url",
   version: "v99.999.9999+c9cdf14",
-}
+};
 
 export const MockOwnerRole: TypesGen.Role = {
   name: "owner",
   display_name: "Owner",
-}
+};
 
 export const MockUserAdminRole: TypesGen.Role = {
   name: "user_admin",
   display_name: "User Admin",
-}
+};
 
 export const MockTemplateAdminRole: TypesGen.Role = {
   name: "template_admin",
   display_name: "Template Admin",
-}
+};
 
 export const MockMemberRole: TypesGen.Role = {
   name: "member",
   display_name: "Member",
-}
+};
 
 export const MockAuditorRole: TypesGen.Role = {
   name: "auditor",
   display_name: "Auditor",
-}
+};
 
 // assignableRole takes a role and a boolean. The boolean implies if the
 // actor can assign (add/remove) the role from other users.
@@ -253,18 +256,18 @@ export function assignableRole(
   return {
     ...role,
     assignable: assignable,
-  }
+  };
 }
 
-export const MockSiteRoles = [MockUserAdminRole, MockAuditorRole]
+export const MockSiteRoles = [MockUserAdminRole, MockAuditorRole];
 export const MockAssignableSiteRoles = [
   assignableRole(MockUserAdminRole, true),
   assignableRole(MockAuditorRole, true),
-]
+];
 
 export const MockMemberPermissions = {
   viewAuditLog: false,
-}
+};
 
 export const MockUser: TypesGen.User = {
   id: "test-user",
@@ -277,7 +280,7 @@ export const MockUser: TypesGen.User = {
   avatar_url: "https://avatars.githubusercontent.com/u/95932066?s=200&v=4",
   last_seen_at: "",
   login_type: "password",
-}
+};
 
 export const MockUserAdmin: TypesGen.User = {
   id: "test-user",
@@ -290,7 +293,7 @@ export const MockUserAdmin: TypesGen.User = {
   avatar_url: "",
   last_seen_at: "",
   login_type: "password",
-}
+};
 
 export const MockUser2: TypesGen.User = {
   id: "test-user-2",
@@ -303,7 +306,7 @@ export const MockUser2: TypesGen.User = {
   avatar_url: "",
   last_seen_at: "2022-09-14T19:12:21Z",
   login_type: "oidc",
-}
+};
 
 export const SuspendedMockUser: TypesGen.User = {
   id: "suspended-mock-user",
@@ -316,7 +319,7 @@ export const SuspendedMockUser: TypesGen.User = {
   avatar_url: "",
   last_seen_at: "",
   login_type: "password",
-}
+};
 
 export const MockProvisioner: TypesGen.ProvisionerDaemon = {
   created_at: "",
@@ -324,7 +327,7 @@ export const MockProvisioner: TypesGen.ProvisionerDaemon = {
   name: "Test Provisioner",
   provisioners: ["echo"],
   tags: {},
-}
+};
 
 export const MockProvisionerJob: TypesGen.ProvisionerJob = {
   created_at: "",
@@ -335,31 +338,31 @@ export const MockProvisionerJob: TypesGen.ProvisionerJob = {
   tags: {},
   queue_position: 0,
   queue_size: 0,
-}
+};
 
 export const MockFailedProvisionerJob: TypesGen.ProvisionerJob = {
   ...MockProvisionerJob,
   status: "failed",
-}
+};
 
 export const MockCancelingProvisionerJob: TypesGen.ProvisionerJob = {
   ...MockProvisionerJob,
   status: "canceling",
-}
+};
 export const MockCanceledProvisionerJob: TypesGen.ProvisionerJob = {
   ...MockProvisionerJob,
   status: "canceled",
-}
+};
 export const MockRunningProvisionerJob: TypesGen.ProvisionerJob = {
   ...MockProvisionerJob,
   status: "running",
-}
+};
 export const MockPendingProvisionerJob: TypesGen.ProvisionerJob = {
   ...MockProvisionerJob,
   status: "pending",
   queue_position: 2,
   queue_size: 4,
-}
+};
 export const MockTemplateVersion: TypesGen.TemplateVersion = {
   id: "test-template-version",
   created_at: "2022-05-17T17:39:01.382927298Z",
@@ -376,7 +379,8 @@ You can add instructions here
 
 [Some link info](https://coder.com)`,
   created_by: MockUser,
-}
+  archived: false,
+};
 
 export const MockTemplateVersion2: TypesGen.TemplateVersion = {
   id: "test-template-version-2",
@@ -394,7 +398,8 @@ You can add instructions here
 
 [Some link info](https://coder.com)`,
   created_by: MockUser,
-}
+  archived: false,
+};
 
 export const MockTemplateVersion3: TypesGen.TemplateVersion = {
   id: "test-template-version-3",
@@ -407,7 +412,8 @@ export const MockTemplateVersion3: TypesGen.TemplateVersion = {
   readme: "README",
   created_by: MockUser,
   warnings: ["UNSUPPORTED_WORKSPACES"],
-}
+  archived: false,
+};
 
 export const MockTemplate: TypesGen.Template = {
   id: "test-template",
@@ -436,20 +442,32 @@ export const MockTemplate: TypesGen.Template = {
   description: "This is a test description.",
   default_ttl_ms: 24 * 60 * 60 * 1000,
   max_ttl_ms: 2 * 24 * 60 * 60 * 1000,
-  restart_requirement: {
+  autostop_requirement: {
     days_of_week: [],
     weeks: 1,
   },
+  autostart_requirement: {
+    days_of_week: [
+      "monday",
+      "tuesday",
+      "wednesday",
+      "thursday",
+      "friday",
+      "saturday",
+      "sunday",
+    ],
+  },
   created_by_id: "test-creator-id",
   created_by_name: "test_creator",
   icon: "/icon/code.svg",
   allow_user_cancel_workspace_jobs: true,
   failure_ttl_ms: 0,
-  inactivity_ttl_ms: 0,
-  locked_ttl_ms: 0,
-  allow_user_autostart: false,
-  allow_user_autostop: false,
-}
+  time_til_dormant_ms: 0,
+  time_til_dormant_autodelete_ms: 0,
+  allow_user_autostart: true,
+  allow_user_autostop: true,
+  require_active_version: false,
+};
 
 export const MockTemplateVersionFiles: TemplateVersionFiles = {
   "README.md": "# Example\n\nThis is an example template.",
@@ -481,7 +499,7 @@ spec {
 }
 }
 `,
-}
+};
 
 export const MockTemplateVersionFileTree: FileTree = {
   "README.md": "# Example\n\nThis is an example template.",
@@ -517,7 +535,7 @@ spec {
     "java.Dockerfile": "FROM eclipse-temurin:17-jdk-jammy",
     "python.Dockerfile": "FROM python:3.8-slim-buster",
   },
-}
+};
 
 export const MockWorkspaceApp: TypesGen.WorkspaceApp = {
   id: "test-app",
@@ -534,7 +552,26 @@ export const MockWorkspaceApp: TypesGen.WorkspaceApp = {
     interval: 0,
     threshold: 0,
   },
-}
+};
+
+export const MockWorkspaceAgentLogSource: TypesGen.WorkspaceAgentLogSource = {
+  created_at: "2023-05-04T11:30:41.402072Z",
+  id: "dc790496-eaec-4f88-a53f-8ce1f61a1fff",
+  display_name: "Startup Script",
+  icon: "",
+  workspace_agent_id: "",
+};
+
+export const MockWorkspaceAgentScript: TypesGen.WorkspaceAgentScript = {
+  log_source_id: MockWorkspaceAgentLogSource.id,
+  cron: "",
+  log_path: "",
+  run_on_start: true,
+  run_on_stop: false,
+  script: "echo 'hello world'",
+  start_blocks_login: false,
+  timeout: 0,
+};
 
 export const MockWorkspaceAgent: TypesGen.WorkspaceAgent = {
   apps: [MockWorkspaceApp],
@@ -557,17 +594,23 @@ export const MockWorkspaceAgent: TypesGen.WorkspaceAgent = {
   connection_timeout_seconds: 120,
   troubleshooting_url: "https://coder.com/troubleshoot",
   lifecycle_state: "starting",
-  login_before_ready: false, // Deprecated.
-  startup_script_behavior: "blocking",
   logs_length: 0,
   logs_overflowed: false,
-  startup_script_timeout_seconds: 120,
-  shutdown_script_timeout_seconds: 120,
-  subsystem: "envbox",
+  log_sources: [MockWorkspaceAgentLogSource],
+  scripts: [MockWorkspaceAgentScript],
+  startup_script_behavior: "non-blocking",
+  subsystems: ["envbox", "exectrace"],
   health: {
     healthy: true,
   },
-}
+  display_apps: [
+    "ssh_helper",
+    "port_forwarding_helper",
+    "vscode",
+    "vscode_insiders",
+    "web_terminal",
+  ],
+};
 
 export const MockWorkspaceAgentDisconnected: TypesGen.WorkspaceAgent = {
   ...MockWorkspaceAgent,
@@ -581,7 +624,7 @@ export const MockWorkspaceAgentDisconnected: TypesGen.WorkspaceAgent = {
     healthy: false,
     reason: "agent is not connected",
   },
-}
+};
 
 export const MockWorkspaceAgentOutdated: TypesGen.WorkspaceAgent = {
   ...MockWorkspaceAgent,
@@ -605,7 +648,7 @@ export const MockWorkspaceAgentOutdated: TypesGen.WorkspaceAgent = {
     },
   },
   lifecycle_state: "ready",
-}
+};
 
 export const MockWorkspaceAgentConnecting: TypesGen.WorkspaceAgent = {
   ...MockWorkspaceAgent,
@@ -615,7 +658,7 @@ export const MockWorkspaceAgentConnecting: TypesGen.WorkspaceAgent = {
   version: "",
   latency: {},
   lifecycle_state: "created",
-}
+};
 
 export const MockWorkspaceAgentTimeout: TypesGen.WorkspaceAgent = {
   ...MockWorkspaceAgent,
@@ -629,28 +672,28 @@ export const MockWorkspaceAgentTimeout: TypesGen.WorkspaceAgent = {
     healthy: false,
     reason: "agent is taking too long to connect",
   },
-}
+};
 
 export const MockWorkspaceAgentStarting: TypesGen.WorkspaceAgent = {
   ...MockWorkspaceAgent,
   id: "test-workspace-agent-starting",
   name: "a-starting-workspace-agent",
   lifecycle_state: "starting",
-}
+};
 
 export const MockWorkspaceAgentReady: TypesGen.WorkspaceAgent = {
   ...MockWorkspaceAgent,
   id: "test-workspace-agent-ready",
   name: "a-ready-workspace-agent",
   lifecycle_state: "ready",
-}
+};
 
 export const MockWorkspaceAgentStartTimeout: TypesGen.WorkspaceAgent = {
   ...MockWorkspaceAgent,
   id: "test-workspace-agent-start-timeout",
   name: "a-workspace-agent-timed-out-while-running-startup-script",
   lifecycle_state: "start_timeout",
-}
+};
 
 export const MockWorkspaceAgentStartError: TypesGen.WorkspaceAgent = {
   ...MockWorkspaceAgent,
@@ -661,7 +704,7 @@ export const MockWorkspaceAgentStartError: TypesGen.WorkspaceAgent = {
     healthy: false,
     reason: "agent startup script failed",
   },
-}
+};
 
 export const MockWorkspaceAgentShuttingDown: TypesGen.WorkspaceAgent = {
   ...MockWorkspaceAgent,
@@ -672,7 +715,7 @@ export const MockWorkspaceAgentShuttingDown: TypesGen.WorkspaceAgent = {
     healthy: false,
     reason: "agent is shutting down",
   },
-}
+};
 
 export const MockWorkspaceAgentShutdownTimeout: TypesGen.WorkspaceAgent = {
   ...MockWorkspaceAgent,
@@ -683,7 +726,7 @@ export const MockWorkspaceAgentShutdownTimeout: TypesGen.WorkspaceAgent = {
     healthy: false,
     reason: "agent is shutting down",
   },
-}
+};
 
 export const MockWorkspaceAgentShutdownError: TypesGen.WorkspaceAgent = {
   ...MockWorkspaceAgent,
@@ -694,7 +737,7 @@ export const MockWorkspaceAgentShutdownError: TypesGen.WorkspaceAgent = {
     healthy: false,
     reason: "agent is shutting down",
   },
-}
+};
 
 export const MockWorkspaceAgentOff: TypesGen.WorkspaceAgent = {
   ...MockWorkspaceAgent,
@@ -705,73 +748,94 @@ export const MockWorkspaceAgentOff: TypesGen.WorkspaceAgent = {
     healthy: false,
     reason: "agent is shutting down",
   },
-}
+};
 
 export const MockWorkspaceResource: TypesGen.WorkspaceResource = {
-  agents: [
-    MockWorkspaceAgent,
-    MockWorkspaceAgentConnecting,
-    MockWorkspaceAgentOutdated,
-  ],
-  created_at: "",
   id: "test-workspace-resource",
-  job_id: "",
   name: "a-workspace-resource",
+  agents: [MockWorkspaceAgent],
+  created_at: "",
+  job_id: "",
   type: "google_compute_disk",
   workspace_transition: "start",
   hide: false,
   icon: "",
-  metadata: [{ key: "api_key", value: "12345678", sensitive: true }],
+  metadata: [{ key: "size", value: "32GB", sensitive: false }],
   daily_cost: 10,
-}
+};
 
-export const MockWorkspaceResource2: TypesGen.WorkspaceResource = {
+export const MockWorkspaceResourceSensitive: TypesGen.WorkspaceResource = {
+  ...MockWorkspaceResource,
+  id: "test-workspace-resource-sensitive",
+  name: "workspace-resource-sensitive",
+  metadata: [{ key: "api_key", value: "12345678", sensitive: true }],
+};
+
+export const MockWorkspaceResourceMultipleAgents: TypesGen.WorkspaceResource = {
+  ...MockWorkspaceResource,
+  id: "test-workspace-resource-multiple-agents",
+  name: "workspace-resource-multiple-agents",
   agents: [
     MockWorkspaceAgent,
     MockWorkspaceAgentDisconnected,
     MockWorkspaceAgentOutdated,
   ],
+};
+
+export const MockWorkspaceResourceHidden: TypesGen.WorkspaceResource = {
+  ...MockWorkspaceResource,
+  id: "test-workspace-resource-hidden",
+  name: "workspace-resource-hidden",
+  hide: true,
+};
+
+export const MockWorkspaceVolumeResource: TypesGen.WorkspaceResource = {
+  id: "test-workspace-volume-resource",
   created_at: "",
-  id: "test-workspace-resource-2",
   job_id: "",
-  name: "another-workspace-resource",
-  type: "google_compute_disk",
   workspace_transition: "start",
+  type: "docker_volume",
+  name: "home_volume",
   hide: false,
   icon: "",
-  metadata: [{ key: "size", value: "32GB", sensitive: false }],
-  daily_cost: 10,
-}
+  daily_cost: 0,
+};
 
-export const MockWorkspaceResource3: TypesGen.WorkspaceResource = {
-  agents: [
-    MockWorkspaceAgent,
-    MockWorkspaceAgentDisconnected,
-    MockWorkspaceAgentOutdated,
-  ],
+export const MockWorkspaceImageResource: TypesGen.WorkspaceResource = {
+  id: "test-workspace-image-resource",
   created_at: "",
-  id: "test-workspace-resource-3",
   job_id: "",
-  name: "another-workspace-resource",
-  type: "google_compute_disk",
   workspace_transition: "start",
-  hide: true,
+  type: "docker_image",
+  name: "main",
+  hide: false,
   icon: "",
-  metadata: [{ key: "size", value: "32GB", sensitive: false }],
-  daily_cost: 20,
-}
+  daily_cost: 0,
+};
+
+export const MockWorkspaceContainerResource: TypesGen.WorkspaceResource = {
+  id: "test-workspace-container-resource",
+  created_at: "",
+  job_id: "",
+  workspace_transition: "start",
+  type: "docker_container",
+  name: "workspace",
+  hide: false,
+  icon: "",
+  daily_cost: 0,
+};
 
 export const MockWorkspaceAutostartDisabled: TypesGen.UpdateWorkspaceAutostartRequest =
   {
     schedule: "",
-  }
+  };
 
 export const MockWorkspaceAutostartEnabled: TypesGen.UpdateWorkspaceAutostartRequest =
   {
     // Runs at 9:30am Monday through Friday using Canada/Eastern
     // (America/Toronto) time
     schedule: "CRON_TZ=Canada/Eastern 30 9 * * 1-5",
-  }
+  };
 
 export const MockWorkspaceBuild: TypesGen.WorkspaceBuild = {
   build_number: 1,
@@ -793,7 +857,51 @@ export const MockWorkspaceBuild: TypesGen.WorkspaceBuild = {
   resources: [MockWorkspaceResource],
   status: "running",
   daily_cost: 20,
-}
+};
+
+export const MockWorkspaceBuildAutostart: TypesGen.WorkspaceBuild = {
+  build_number: 1,
+  created_at: "2022-05-17T17:39:01.382927298Z",
+  id: "1",
+  initiator_id: MockUser.id,
+  initiator_name: MockUser.username,
+  job: MockProvisionerJob,
+  template_version_id: MockTemplateVersion.id,
+  template_version_name: MockTemplateVersion.name,
+  transition: "start",
+  updated_at: "2022-05-17T17:39:01.382927298Z",
+  workspace_name: "test-workspace",
+  workspace_owner_id: MockUser.id,
+  workspace_owner_name: MockUser.username,
+  workspace_id: "759f1d46-3174-453d-aa60-980a9c1442f3",
+  deadline: "2022-05-17T23:39:00.00Z",
+  reason: "autostart",
+  resources: [MockWorkspaceResource],
+  status: "running",
+  daily_cost: 20,
+};
+
+export const MockWorkspaceBuildAutostop: TypesGen.WorkspaceBuild = {
+  build_number: 1,
+  created_at: "2022-05-17T17:39:01.382927298Z",
+  id: "1",
+  initiator_id: MockUser.id,
+  initiator_name: MockUser.username,
+  job: MockProvisionerJob,
+  template_version_id: MockTemplateVersion.id,
+  template_version_name: MockTemplateVersion.name,
+  transition: "start",
+  updated_at: "2022-05-17T17:39:01.382927298Z",
+  workspace_name: "test-workspace",
+  workspace_owner_id: MockUser.id,
+  workspace_owner_name: MockUser.username,
+  workspace_id: "759f1d46-3174-453d-aa60-980a9c1442f3",
+  deadline: "2022-05-17T23:39:00.00Z",
+  reason: "autostop",
+  resources: [MockWorkspaceResource],
+  status: "running",
+  daily_cost: 20,
+};
 
 export const MockFailedWorkspaceBuild = (
   transition: TypesGen.WorkspaceTransition = "start",
@@ -815,27 +923,29 @@ export const MockFailedWorkspaceBuild = (
   deadline: "2022-05-17T23:39:00.00Z",
   reason: "initiator",
   resources: [],
-  status: "running",
+  status: "failed",
   daily_cost: 20,
-})
+});
 
 export const MockWorkspaceBuildStop: TypesGen.WorkspaceBuild = {
   ...MockWorkspaceBuild,
   id: "2",
   transition: "stop",
-}
+};
 
 export const MockWorkspaceBuildDelete: TypesGen.WorkspaceBuild = {
   ...MockWorkspaceBuild,
   id: "3",
   transition: "delete",
-}
+};
 
 export const MockBuilds = [
   MockWorkspaceBuild,
+  MockWorkspaceBuildAutostart,
+  MockWorkspaceBuildAutostop,
   MockWorkspaceBuildStop,
   MockWorkspaceBuildDelete,
-]
+];
 
 export const MockWorkspace: TypesGen.Workspace = {
   id: "test-workspace",
@@ -848,6 +958,8 @@ export const MockWorkspace: TypesGen.Workspace = {
   template_display_name: MockTemplate.display_name,
   template_allow_user_cancel_workspace_jobs:
     MockTemplate.allow_user_cancel_workspace_jobs,
+  template_active_version_id: MockTemplate.active_version_id,
+  template_require_active_version: MockTemplate.require_active_version,
   outdated: false,
   owner_id: MockUser.id,
   organization_id: MockOrganization.id,
@@ -860,13 +972,14 @@ export const MockWorkspace: TypesGen.Workspace = {
     healthy: true,
     failing_agents: [],
   },
-}
+  automatic_updates: "never",
+};
 
 export const MockStoppedWorkspace: TypesGen.Workspace = {
   ...MockWorkspace,
   id: "test-stopped-workspace",
   latest_build: { ...MockWorkspaceBuildStop, status: "stopped" },
-}
+};
 export const MockStoppingWorkspace: TypesGen.Workspace = {
   ...MockWorkspace,
   id: "test-stopping-workspace",
@@ -875,7 +988,7 @@ export const MockStoppingWorkspace: TypesGen.Workspace = {
     job: MockRunningProvisionerJob,
     status: "stopping",
   },
-}
+};
 export const MockStartingWorkspace: TypesGen.Workspace = {
   ...MockWorkspace,
   id: "test-starting-workspace",
@@ -885,7 +998,7 @@ export const MockStartingWorkspace: TypesGen.Workspace = {
     transition: "start",
     status: "starting",
   },
-}
+};
 export const MockCancelingWorkspace: TypesGen.Workspace = {
   ...MockWorkspace,
   id: "test-canceling-workspace",
@@ -894,7 +1007,7 @@ export const MockCancelingWorkspace: TypesGen.Workspace = {
     job: MockCancelingProvisionerJob,
     status: "canceling",
   },
-}
+};
 export const MockCanceledWorkspace: TypesGen.Workspace = {
   ...MockWorkspace,
   id: "test-canceled-workspace",
@@ -903,7 +1016,7 @@ export const MockCanceledWorkspace: TypesGen.Workspace = {
     job: MockCanceledProvisionerJob,
     status: "canceled",
   },
-}
+};
 export const MockFailedWorkspace: TypesGen.Workspace = {
   ...MockWorkspace,
   id: "test-failed-workspace",
@@ -912,7 +1025,7 @@ export const MockFailedWorkspace: TypesGen.Workspace = {
     job: MockFailedProvisionerJob,
     status: "failed",
   },
-}
+};
 export const MockDeletingWorkspace: TypesGen.Workspace = {
   ...MockWorkspace,
   id: "test-deleting-workspace",
@@ -921,24 +1034,45 @@ export const MockDeletingWorkspace: TypesGen.Workspace = {
     job: MockRunningProvisionerJob,
     status: "deleting",
   },
-}
+};
 
 export const MockWorkspaceWithDeletion = {
   ...MockStoppedWorkspace,
   deleting_at: new Date().toISOString(),
-}
+};
 
 export const MockDeletedWorkspace: TypesGen.Workspace = {
   ...MockWorkspace,
   id: "test-deleted-workspace",
   latest_build: { ...MockWorkspaceBuildDelete, status: "deleted" },
-}
+};
 
 export const MockOutdatedWorkspace: TypesGen.Workspace = {
   ...MockFailedWorkspace,
   id: "test-outdated-workspace",
   outdated: true,
-}
+};
+
+export const MockOutdatedRunningWorkspaceRequireActiveVersion: TypesGen.Workspace =
+  {
+    ...MockWorkspace,
+    id: "test-outdated-workspace-require-active-version",
+    outdated: true,
+    template_require_active_version: true,
+    latest_build: {
+      ...MockWorkspaceBuild,
+      status: "running",
+    },
+  };
+
+export const MockOutdatedStoppedWorkspaceRequireActiveVersion: TypesGen.Workspace =
+  {
+    ...MockOutdatedRunningWorkspaceRequireActiveVersion,
+    latest_build: {
+      ...MockWorkspaceBuild,
+      status: "stopped",
+    },
+  };
 
 export const MockPendingWorkspace: TypesGen.Workspace = {
   ...MockWorkspace,
@@ -949,7 +1083,7 @@ export const MockPendingWorkspace: TypesGen.Workspace = {
     transition: "start",
     status: "pending",
   },
-}
+};
 
 // just over one page of workspaces
 export const MockWorkspacesResponse: TypesGen.WorkspacesResponse = {
@@ -959,12 +1093,12 @@ export const MockWorkspacesResponse: TypesGen.WorkspacesResponse = {
     name: `${MockWorkspace.name}${id}`,
   })),
   count: 26,
-}
+};
 
 export const MockWorkspacesResponseWithDeletions = {
   workspaces: [...MockWorkspacesResponse.workspaces, MockWorkspaceWithDeletion],
   count: MockWorkspacesResponse.count + 1,
-}
+};
 
 export const MockTemplateVersionParameter1: TypesGen.TemplateVersionParameter =
   {
@@ -978,7 +1112,7 @@ export const MockTemplateVersionParameter1: TypesGen.TemplateVersionParameter =
     options: [],
     required: true,
     ephemeral: false,
-  }
+  };
 
 export const MockTemplateVersionParameter2: TypesGen.TemplateVersionParameter =
   {
@@ -995,7 +1129,7 @@ export const MockTemplateVersionParameter2: TypesGen.TemplateVersionParameter =
     validation_monotonic: "increasing",
     required: true,
     ephemeral: false,
-  }
+  };
 
 export const MockTemplateVersionParameter3: TypesGen.TemplateVersionParameter =
   {
@@ -1011,7 +1145,7 @@ export const MockTemplateVersionParameter3: TypesGen.TemplateVersionParameter =
     validation_regex: "^[a-z]{3}$",
     required: true,
     ephemeral: false,
-  }
+  };
 
 export const MockTemplateVersionParameter4: TypesGen.TemplateVersionParameter =
   {
@@ -1025,7 +1159,7 @@ export const MockTemplateVersionParameter4: TypesGen.TemplateVersionParameter =
     options: [],
     required: true,
     ephemeral: false,
-  }
+  };
 
 export const MockTemplateVersionParameter5: TypesGen.TemplateVersionParameter =
   {
@@ -1042,7 +1176,7 @@ export const MockTemplateVersionParameter5: TypesGen.TemplateVersionParameter =
     validation_monotonic: "decreasing",
     required: true,
     ephemeral: false,
-  }
+  };
 
 export const MockTemplateVersionVariable1: TypesGen.TemplateVersionVariable = {
   name: "first_variable",
@@ -1052,7 +1186,7 @@ export const MockTemplateVersionVariable1: TypesGen.TemplateVersionVariable = {
   default_value: "abc",
   required: false,
   sensitive: false,
-}
+};
 
 export const MockTemplateVersionVariable2: TypesGen.TemplateVersionVariable = {
   name: "second_variable",
@@ -1062,7 +1196,7 @@ export const MockTemplateVersionVariable2: TypesGen.TemplateVersionVariable = {
   default_value: "3",
   required: false,
   sensitive: false,
-}
+};
 
 export const MockTemplateVersionVariable3: TypesGen.TemplateVersionVariable = {
   name: "third_variable",
@@ -1072,7 +1206,7 @@ export const MockTemplateVersionVariable3: TypesGen.TemplateVersionVariable = {
   default_value: "false",
   required: false,
   sensitive: false,
-}
+};
 
 export const MockTemplateVersionVariable4: TypesGen.TemplateVersionVariable = {
   name: "fourth_variable",
@@ -1082,7 +1216,7 @@ export const MockTemplateVersionVariable4: TypesGen.TemplateVersionVariable = {
   default_value: "",
   required: true,
   sensitive: true,
-}
+};
 
 export const MockTemplateVersionVariable5: TypesGen.TemplateVersionVariable = {
   name: "fifth_variable",
@@ -1092,38 +1226,44 @@ export const MockTemplateVersionVariable5: TypesGen.TemplateVersionVariable = {
   default_value: "",
   required: true,
   sensitive: false,
-}
+};
 
-// requests the MockWorkspace
 export const MockWorkspaceRequest: TypesGen.CreateWorkspaceRequest = {
   name: "test",
-  template_id: "test-template",
-  rich_parameter_values: [
-    {
-      name: MockTemplateVersionParameter1.name,
-      value: MockTemplateVersionParameter1.default_value,
-    },
-  ],
-}
+  template_version_id: "test-template-version",
+  rich_parameter_values: [],
+};
 
-export const MockUserAgent: Types.UserAgent = {
+export const MockWorkspaceRichParametersRequest: TypesGen.CreateWorkspaceRequest =
+  {
+    name: "test",
+    template_version_id: "test-template-version",
+    rich_parameter_values: [
+      {
+        name: MockTemplateVersionParameter1.name,
+        value: MockTemplateVersionParameter1.default_value,
+      },
+    ],
+  };
+
+export const MockUserAgent = {
   browser: "Chrome 99.0.4844",
   device: "Other",
   ip_address: "11.22.33.44",
   os: "Windows 10",
-}
+};
 
 export const MockAuthMethods: TypesGen.AuthMethods = {
   password: { enabled: true },
   github: { enabled: false },
   oidc: { enabled: false, signInText: "", iconUrl: "" },
-}
+};
 
 export const MockAuthMethodsWithPasswordType: TypesGen.AuthMethods = {
   ...MockAuthMethods,
   github: { enabled: true },
   oidc: { enabled: true, signInText: "", iconUrl: "" },
-}
+};
 
 export const MockGitSSHKey: TypesGen.GitSSHKey = {
   user_id: "1fa0200f-7331-4524-a364-35770666caa7",
@@ -1131,7 +1271,7 @@ export const MockGitSSHKey: TypesGen.GitSSHKey = {
   updated_at: "2022-05-16T15:29:10.302441433Z",
   public_key:
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFJOQRIM7kE30rOzrfy+/+R+nQGCk7S9pioihy+2ARbq",
-}
+};
 
 export const MockWorkspaceBuildLogs: TypesGen.ProvisionerJobLog[] = [
   {
@@ -1404,28 +1544,337 @@ export const MockWorkspaceBuildLogs: TypesGen.ProvisionerJobLog[] = [
     stage: "Cleaning Up",
     output: "",
   },
-]
+];
+
+export const MockWorkspaceExtendedBuildLogs: TypesGen.ProvisionerJobLog[] = [
+  {
+    id: 938494,
+    created_at: "2023-08-25T19:07:43.331Z",
+    log_source: "provisioner_daemon",
+    log_level: "info",
+    stage: "Setting up",
+    output: "",
+  },
+  {
+    id: 938495,
+    created_at: "2023-08-25T19:07:43.331Z",
+    log_source: "provisioner_daemon",
+    log_level: "info",
+    stage: "Parsing template parameters",
+    output: "",
+  },
+  {
+    id: 938496,
+    created_at: "2023-08-25T19:07:43.339Z",
+    log_source: "provisioner_daemon",
+    log_level: "info",
+    stage: "Detecting persistent resources",
+    output: "",
+  },
+  {
+    id: 938497,
+    created_at: "2023-08-25T19:07:44.15Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output: "Initializing the backend...",
+  },
+  {
+    id: 938498,
+    created_at: "2023-08-25T19:07:44.215Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output: "Initializing provider plugins...",
+  },
+  {
+    id: 938499,
+    created_at: "2023-08-25T19:07:44.216Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output: '- Finding coder/coder versions matching "~> 0.11.0"...',
+  },
+  {
+    id: 938500,
+    created_at: "2023-08-25T19:07:44.668Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output: '- Finding kreuzwerker/docker versions matching "~> 3.0.1"...',
+  },
+  {
+    id: 938501,
+    created_at: "2023-08-25T19:07:44.722Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output: "- Using coder/coder v0.11.1 from the shared cache directory",
+  },
+  {
+    id: 938502,
+    created_at: "2023-08-25T19:07:44.857Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output: "- Using kreuzwerker/docker v3.0.2 from the shared cache directory",
+  },
+  {
+    id: 938503,
+    created_at: "2023-08-25T19:07:45.081Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output:
+      "Terraform has created a lock file .terraform.lock.hcl to record the provider",
+  },
+  {
+    id: 938504,
+    created_at: "2023-08-25T19:07:45.081Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output:
+      "selections it made above. Include this file in your version control repository",
+  },
+  {
+    id: 938505,
+    created_at: "2023-08-25T19:07:45.081Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output:
+      "so that Terraform can guarantee to make the same selections by default when",
+  },
+  {
+    id: 938506,
+    created_at: "2023-08-25T19:07:45.082Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output: 'you run "terraform init" in the future.',
+  },
+  {
+    id: 938507,
+    created_at: "2023-08-25T19:07:45.083Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output: "Terraform has been successfully initialized!",
+  },
+  {
+    id: 938508,
+    created_at: "2023-08-25T19:07:45.084Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output:
+      'You may now begin working with Terraform. Try running "terraform plan" to see',
+  },
+  {
+    id: 938509,
+    created_at: "2023-08-25T19:07:45.084Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output:
+      "any changes that are required for your infrastructure. All Terraform commands",
+  },
+  {
+    id: 938510,
+    created_at: "2023-08-25T19:07:45.084Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output: "should now work.",
+  },
+  {
+    id: 938511,
+    created_at: "2023-08-25T19:07:45.084Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output:
+      "If you ever set or change modules or backend configuration for Terraform,",
+  },
+  {
+    id: 938512,
+    created_at: "2023-08-25T19:07:45.084Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output:
+      "rerun this command to reinitialize your working directory. If you forget, other",
+  },
+  {
+    id: 938513,
+    created_at: "2023-08-25T19:07:45.084Z",
+    log_source: "provisioner",
+    log_level: "debug",
+    stage: "Detecting persistent resources",
+    output: "commands will detect it and remind you to do so if necessary.",
+  },
+  {
+    id: 938514,
+    created_at: "2023-08-25T19:07:45.143Z",
+    log_source: "provisioner",
+    log_level: "info",
+    stage: "Detecting persistent resources",
+    output: "Terraform 1.1.9",
+  },
+  {
+    id: 938515,
+    created_at: "2023-08-25T19:07:46.297Z",
+    log_source: "provisioner",
+    log_level: "warn",
+    stage: "Detecting persistent resources",
+    output: "Warning: Argument is deprecated",
+  },
+  {
+    id: 938516,
+    created_at: "2023-08-25T19:07:46.297Z",
+    log_source: "provisioner",
+    log_level: "warn",
+    stage: "Detecting persistent resources",
+    output: 'on devcontainer-on-docker.tf line 15, in provider "coder":',
+  },
+  {
+    id: 938517,
+    created_at: "2023-08-25T19:07:46.297Z",
+    log_source: "provisioner",
+    log_level: "warn",
+    stage: "Detecting persistent resources",
+    output: "  15:   feature_use_managed_variables = true",
+  },
+  {
+    id: 938518,
+    created_at: "2023-08-25T19:07:46.297Z",
+    log_source: "provisioner",
+    log_level: "warn",
+    stage: "Detecting persistent resources",
+    output: "",
+  },
+  {
+    id: 938519,
+    created_at: "2023-08-25T19:07:46.297Z",
+    log_source: "provisioner",
+    log_level: "warn",
+    stage: "Detecting persistent resources",
+    output:
+      "Terraform variables are now exclusively utilized for template-wide variables after the removal of support for legacy parameters.",
+  },
+  {
+    id: 938520,
+    created_at: "2023-08-25T19:07:46.3Z",
+    log_source: "provisioner",
+    log_level: "error",
+    stage: "Detecting persistent resources",
+    output: "Error: ephemeral parameter requires the default property",
+  },
+  {
+    id: 938521,
+    created_at: "2023-08-25T19:07:46.3Z",
+    log_source: "provisioner",
+    log_level: "error",
+    stage: "Detecting persistent resources",
+    output:
+      'on devcontainer-on-docker.tf line 27, in data "coder_parameter" "another_one":',
+  },
+  {
+    id: 938522,
+    created_at: "2023-08-25T19:07:46.3Z",
+    log_source: "provisioner",
+    log_level: "error",
+    stage: "Detecting persistent resources",
+    output: '  27: data "coder_parameter" "another_one" {',
+  },
+  {
+    id: 938523,
+    created_at: "2023-08-25T19:07:46.301Z",
+    log_source: "provisioner",
+    log_level: "error",
+    stage: "Detecting persistent resources",
+    output: "",
+  },
+  {
+    id: 938524,
+    created_at: "2023-08-25T19:07:46.301Z",
+    log_source: "provisioner",
+    log_level: "error",
+    stage: "Detecting persistent resources",
+    output: "",
+  },
+  {
+    id: 938525,
+    created_at: "2023-08-25T19:07:46.303Z",
+    log_source: "provisioner",
+    log_level: "warn",
+    stage: "Detecting persistent resources",
+    output: "Warning: Argument is deprecated",
+  },
+  {
+    id: 938526,
+    created_at: "2023-08-25T19:07:46.303Z",
+    log_source: "provisioner",
+    log_level: "warn",
+    stage: "Detecting persistent resources",
+    output: 'on devcontainer-on-docker.tf line 15, in provider "coder":',
+  },
+  {
+    id: 938527,
+    created_at: "2023-08-25T19:07:46.303Z",
+    log_source: "provisioner",
+    log_level: "warn",
+    stage: "Detecting persistent resources",
+    output: "  15:   feature_use_managed_variables = true",
+  },
+  {
+    id: 938528,
+    created_at: "2023-08-25T19:07:46.303Z",
+    log_source: "provisioner",
+    log_level: "warn",
+    stage: "Detecting persistent resources",
+    output: "",
+  },
+  {
+    id: 938529,
+    created_at: "2023-08-25T19:07:46.303Z",
+    log_source: "provisioner",
+    log_level: "warn",
+    stage: "Detecting persistent resources",
+    output:
+      "Terraform variables are now exclusively utilized for template-wide variables after the removal of support for legacy parameters.",
+  },
+  {
+    id: 938530,
+    created_at: "2023-08-25T19:07:46.311Z",
+    log_source: "provisioner_daemon",
+    log_level: "info",
+    stage: "Cleaning Up",
+    output: "",
+  },
+];
 
 export const MockCancellationMessage = {
   message: "Job successfully canceled",
-}
+};
 
 type MockAPIInput = {
-  message?: string
-  detail?: string
-  validations?: FieldError[]
-}
+  message?: string;
+  detail?: string;
+  validations?: FieldError[];
+};
 
 type MockAPIOutput = {
-  isAxiosError: true
+  isAxiosError: true;
   response: {
     data: {
-      message: string
-      detail: string | undefined
-      validations: FieldError[] | undefined
-    }
-  }
-}
+      message: string;
+      detail: string | undefined;
+      validations: FieldError[] | undefined;
+    };
+  };
+};
 
 export const mockApiError = ({
   message,
@@ -1441,16 +1890,22 @@ export const mockApiError = ({
       validations: validations ?? undefined,
     },
   },
-})
+});
 
 export const MockEntitlements: TypesGen.Entitlements = {
   errors: [],
   warnings: [],
   has_license: false,
-  features: withDefaultFeatures({}),
+  features: withDefaultFeatures({
+    workspace_batch_actions: {
+      enabled: true,
+      entitlement: "entitled",
+    },
+  }),
   require_telemetry: false,
   trial: false,
-}
+  refreshed_at: "2022-05-20T16:45:57.122Z",
+};
 
 export const MockEntitlementsWithWarnings: TypesGen.Entitlements = {
   errors: [],
@@ -1458,6 +1913,7 @@ export const MockEntitlementsWithWarnings: TypesGen.Entitlements = {
   has_license: true,
   trial: false,
   require_telemetry: false,
+  refreshed_at: "2022-05-20T16:45:57.122Z",
   features: withDefaultFeatures({
     user_limit: {
       enabled: true,
@@ -1474,7 +1930,7 @@ export const MockEntitlementsWithWarnings: TypesGen.Entitlements = {
       entitlement: "entitled",
     },
   }),
-}
+};
 
 export const MockEntitlementsWithAuditLog: TypesGen.Entitlements = {
   errors: [],
@@ -1482,13 +1938,14 @@ export const MockEntitlementsWithAuditLog: TypesGen.Entitlements = {
   has_license: true,
   require_telemetry: false,
   trial: false,
+  refreshed_at: "2022-05-20T16:45:57.122Z",
   features: withDefaultFeatures({
     audit_log: {
       enabled: true,
       entitlement: "entitled",
     },
   }),
-}
+};
 
 export const MockEntitlementsWithScheduling: TypesGen.Entitlements = {
   errors: [],
@@ -1496,18 +1953,32 @@ export const MockEntitlementsWithScheduling: TypesGen.Entitlements = {
   has_license: true,
   require_telemetry: false,
   trial: false,
+  refreshed_at: "2022-05-20T16:45:57.122Z",
   features: withDefaultFeatures({
     advanced_template_scheduling: {
       enabled: true,
       entitlement: "entitled",
     },
   }),
-}
+};
 
-export const MockExperiments: TypesGen.Experiment[] = [
-  "workspace_actions",
-  "moons",
-]
+export const MockEntitlementsWithUserLimit: TypesGen.Entitlements = {
+  errors: [],
+  warnings: [],
+  has_license: true,
+  require_telemetry: false,
+  trial: false,
+  refreshed_at: "2022-05-20T16:45:57.122Z",
+  features: withDefaultFeatures({
+    user_limit: {
+      enabled: true,
+      entitlement: "entitled",
+      limit: 25,
+    },
+  }),
+};
+
+export const MockExperiments: TypesGen.Experiment[] = ["moons"];
 
 export const MockAuditLog: TypesGen.AuditLog = {
   id: "fbd2116a-8961-4954-87ae-e4575bd29ce0",
@@ -1535,7 +2006,7 @@ export const MockAuditLog: TypesGen.AuditLog = {
   user: MockUser,
   resource_link: "/@admin/bruno-dev",
   is_deleted: false,
-}
+};
 
 export const MockAuditLog2: TypesGen.AuditLog = {
   ...MockAuditLog,
@@ -1565,14 +2036,14 @@ export const MockAuditLog2: TypesGen.AuditLog = {
       secret: false,
     },
   },
-}
+};
 
 export const MockWorkspaceCreateAuditLogForDifferentOwner = {
   ...MockAuditLog,
   additional_fields: {
     workspace_owner: "Member",
   },
-}
+};
 
 export const MockAuditLogWithWorkspaceBuild: TypesGen.AuditLog = {
   ...MockAuditLog,
@@ -1584,12 +2055,12 @@ export const MockAuditLogWithWorkspaceBuild: TypesGen.AuditLog = {
   additional_fields: {
     workspace_name: "test2",
   },
-}
+};
 
 export const MockAuditLogWithDeletedResource: TypesGen.AuditLog = {
   ...MockAuditLog,
   is_deleted: true,
-}
+};
 
 export const MockAuditLogGitSSH: TypesGen.AuditLog = {
   ...MockAuditLog,
@@ -1605,7 +2076,7 @@ export const MockAuditLogGitSSH: TypesGen.AuditLog = {
       secret: false,
     },
   },
-}
+};
 
 export const MockAuditOauthConvert: TypesGen.AuditLog = {
   ...MockAuditLog,
@@ -1641,7 +2112,7 @@ export const MockAuditOauthConvert: TypesGen.AuditLog = {
       secret: false,
     },
   },
-}
+};
 
 export const MockAuditLogSuccessfulLogin: TypesGen.AuditLog = {
   ...MockAuditLog,
@@ -1650,17 +2121,17 @@ export const MockAuditLogSuccessfulLogin: TypesGen.AuditLog = {
   action: "login",
   status_code: 201,
   description: "{user} logged in",
-}
+};
 
 export const MockAuditLogUnsuccessfulLoginKnownUser: TypesGen.AuditLog = {
   ...MockAuditLogSuccessfulLogin,
   status_code: 401,
-}
+};
 
 export const MockWorkspaceQuota: TypesGen.WorkspaceQuota = {
   credits_consumed: 0,
   budget: 100,
-}
+};
 
 export const MockGroup: TypesGen.Group = {
   id: "fbd2116a-8961-4954-87ae-e4575bd29ce0",
@@ -1670,7 +2141,19 @@ export const MockGroup: TypesGen.Group = {
   organization_id: MockOrganization.id,
   members: [MockUser, MockUser2],
   quota_allowance: 5,
-}
+  source: "user",
+};
+
+const everyOneGroup = (organizationId: string): TypesGen.Group => ({
+  id: organizationId,
+  name: "Everyone",
+  display_name: "",
+  organization_id: organizationId,
+  members: [],
+  avatar_url: "",
+  quota_allowance: 0,
+  source: "user",
+});
 
 export const MockTemplateACL: TypesGen.TemplateACL = {
   group: [
@@ -1678,12 +2161,12 @@ export const MockTemplateACL: TypesGen.TemplateACL = {
     { ...MockGroup, role: "admin" },
   ],
   users: [{ ...MockUser, role: "use" }],
-}
+};
 
 export const MockTemplateACLEmpty: TypesGen.TemplateACL = {
   group: [],
   users: [],
-}
+};
 
 export const MockTemplateExample: TypesGen.TemplateExample = {
   id: "aws-windows",
@@ -1694,7 +2177,7 @@ export const MockTemplateExample: TypesGen.TemplateExample = {
     "\n# aws-ecs\n\nThis is a sample template for running a Coder workspace on ECS. It assumes there\nis a pre-existing ECS cluster with EC2-based compute to host the workspace.\n\n## Architecture\n\nThis workspace is built using the following AWS resources:\n\n- Task definition - the container definition, includes the image, command, volume(s)\n- ECS service - manages the task definition\n\n## code-server\n\n`code-server` is installed via the `startup_script` argument in the `coder_agent`\nresource block. The `coder_app` resource is defined to access `code-server` through\nthe dashboard UI over `localhost:13337`.\n",
   icon: "/icon/aws.png",
   tags: ["aws", "cloud"],
-}
+};
 
 export const MockTemplateExample2: TypesGen.TemplateExample = {
   id: "aws-linux",
@@ -1705,63 +2188,83 @@ export const MockTemplateExample2: TypesGen.TemplateExample = {
     '\n# aws-linux\n\nTo get started, run `coder templates init`. When prompted, select this template.\nFollow the on-screen instructions to proceed.\n\n## Authentication\n\nThis template assumes that coderd is run in an environment that is authenticated\nwith AWS. For example, run `aws configure import` to import credentials on the\nsystem and user running coderd.  For other ways to authenticate [consult the\nTerraform docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration).\n\n## Required permissions / policy\n\nThe following sample policy allows Coder to create EC2 instances and modify\ninstances provisioned by Coder:\n\n```json\n{\n    "Version": "2012-10-17",\n    "Statement": [\n        {\n            "Sid": "VisualEditor0",\n            "Effect": "Allow",\n            "Action": [\n                "ec2:GetDefaultCreditSpecification",\n                "ec2:DescribeIamInstanceProfileAssociations",\n                "ec2:DescribeTags",\n                "ec2:CreateTags",\n                "ec2:RunInstances",\n                "ec2:DescribeInstanceCreditSpecifications",\n                "ec2:DescribeImages",\n                "ec2:ModifyDefaultCreditSpecification",\n                "ec2:DescribeVolumes"\n            ],\n            "Resource": "*"\n        },\n        {\n            "Sid": "CoderResources",\n            "Effect": "Allow",\n            "Action": [\n                "ec2:DescribeInstances",\n                "ec2:DescribeInstanceAttribute",\n                "ec2:UnmonitorInstances",\n                "ec2:TerminateInstances",\n                "ec2:StartInstances",\n                "ec2:StopInstances",\n                "ec2:DeleteTags",\n                "ec2:MonitorInstances",\n                "ec2:CreateTags",\n                "ec2:RunInstances",\n                "ec2:ModifyInstanceAttribute",\n                "ec2:ModifyInstanceCreditSpecification"\n            ],\n            "Resource": "arn:aws:ec2:*:*:instance/*",\n            "Condition": {\n                "StringEquals": {\n                    "aws:ResourceTag/Coder_Provisioned": "true"\n                }\n            }\n        }\n    ]\n}\n```\n\n## code-server\n\n`code-server` is installed via the `startup_script` argument in the `coder_agent`\nresource block. The `coder_app` resource is defined to access `code-server` through\nthe dashboard UI over `localhost:13337`.\n',
   icon: "/icon/aws.png",
   tags: ["aws", "cloud"],
-}
+};
 
 export const MockPermissions: Permissions = {
   createGroup: true,
   createTemplates: true,
   createUser: true,
   deleteTemplates: true,
+  updateTemplates: true,
   readAllUsers: true,
   updateUsers: true,
   viewAuditLog: true,
   viewDeploymentValues: true,
   viewUpdateCheck: true,
   viewDeploymentStats: true,
-  viewGitAuthConfig: true,
+  viewExternalAuthConfig: true,
   editWorkspaceProxies: true,
-}
+};
 
-export const MockDeploymentConfig: Types.DeploymentConfig = {
+export const MockDeploymentConfig: DeploymentConfig = {
   config: {
     enable_terraform_debug_mode: true,
   },
   options: [],
-}
+};
 
-export const MockAppearance: TypesGen.AppearanceConfig = {
+export const MockAppearanceConfig: TypesGen.AppearanceConfig = {
+  application_name: "",
   logo_url: "",
   service_banner: {
     enabled: false,
   },
-}
+};
 
 export const MockWorkspaceBuildParameter1: TypesGen.WorkspaceBuildParameter = {
   name: MockTemplateVersionParameter1.name,
   value: "mock-abc",
-}
+};
 
 export const MockWorkspaceBuildParameter2: TypesGen.WorkspaceBuildParameter = {
   name: MockTemplateVersionParameter2.name,
   value: "3",
-}
+};
 
 export const MockWorkspaceBuildParameter3: TypesGen.WorkspaceBuildParameter = {
   name: MockTemplateVersionParameter3.name,
   value: "my-database",
-}
+};
+
+export const MockWorkspaceBuildParameter4: TypesGen.WorkspaceBuildParameter = {
+  name: MockTemplateVersionParameter4.name,
+  value: "immutable-value",
+};
 
 export const MockWorkspaceBuildParameter5: TypesGen.WorkspaceBuildParameter = {
   name: MockTemplateVersionParameter5.name,
   value: "5",
-}
+};
 
-export const MockTemplateVersionGitAuth: TypesGen.TemplateVersionGitAuth = {
-  id: "github",
-  type: "github",
-  authenticate_url: "https://example.com/gitauth/github",
-  authenticated: false,
-}
+export const MockTemplateVersionExternalAuthGithub: TypesGen.TemplateVersionExternalAuth =
+  {
+    id: "github",
+    type: "github",
+    authenticate_url: "https://example.com/external-auth/github",
+    authenticated: false,
+    display_icon: "/icon/github.svg",
+    display_name: "GitHub",
+  };
+
+export const MockTemplateVersionExternalAuthGithubAuthenticated: TypesGen.TemplateVersionExternalAuth =
+  {
+    id: "github",
+    type: "github",
+    authenticate_url: "https://example.com/external-auth/github",
+    authenticated: true,
+    display_icon: "/icon/github.svg",
+    display_name: "GitHub",
+  };
 
 export const MockDeploymentStats: TypesGen.DeploymentStats = {
   aggregated_from: "2023-03-06T19:08:55.211625Z",
@@ -1786,12 +2289,12 @@ export const MockDeploymentStats: TypesGen.DeploymentStats = {
     rx_bytes: 15613513253,
     tx_bytes: 36113513253,
   },
-}
+};
 
 export const MockDeploymentSSH: TypesGen.SSHConfigResponse = {
   hostname_prefix: " coder.",
   ssh_config_options: {},
-}
+};
 
 export const MockWorkspaceAgentLogs: TypesGen.WorkspaceAgentLog[] = [
   {
@@ -1799,6 +2302,7 @@ export const MockWorkspaceAgentLogs: TypesGen.WorkspaceAgentLog[] = [
     created_at: "2023-05-04T11:30:41.402072Z",
     output: "+ curl -fsSL https://code-server.dev/install.sh",
     level: "info",
+    source_id: MockWorkspaceAgentLogSource.id,
   },
   {
     id: 166664,
@@ -1806,20 +2310,23 @@ export const MockWorkspaceAgentLogs: TypesGen.WorkspaceAgentLog[] = [
     output:
       "+ sh -s -- --method=standalone --prefix=/tmp/code-server --version 4.8.3",
     level: "info",
+    source_id: MockWorkspaceAgentLogSource.id,
   },
   {
     id: 166665,
     created_at: "2023-05-04T11:30:42.590731Z",
     output: "Ubuntu 22.04.2 LTS",
     level: "info",
+    source_id: MockWorkspaceAgentLogSource.id,
   },
   {
     id: 166666,
     created_at: "2023-05-04T11:30:42.593686Z",
     output: "Installing v4.8.3 of the amd64 release from GitHub.",
     level: "info",
+    source_id: MockWorkspaceAgentLogSource.id,
   },
-]
+];
 
 export const MockLicenseResponse: GetLicensesResponse[] = [
   {
@@ -1861,7 +2368,7 @@ export const MockLicenseResponse: GetLicensesResponse[] = [
       license_expires: 1682346425,
     },
   },
-]
+];
 
 export const MockHealth = {
   time: "2023-08-01T16:51:03.29792825Z",
@@ -2280,4 +2787,23 @@ export const MockHealth = {
     error: null,
   },
   coder_version: "v0.27.1-devel+c575292",
-}
+};
+
+export const MockListeningPortsResponse: TypesGen.WorkspaceAgentListeningPortsResponse =
+  {
+    ports: [
+      { process_name: "web", network: "", port: 3000 },
+      { process_name: "go", network: "", port: 8080 },
+      { process_name: "", network: "", port: 8081 },
+    ],
+  };
+
+export const DeploymentHealthUnhealthy: Health = {
+  healthy: false,
+  time: "2023-10-12T23:15:00.000000000Z",
+  coder_version: "v2.3.0-devel+8cca4915a",
+  access_url: { healthy: false },
+  database: { healthy: false },
+  derp: { healthy: false },
+  websocket: { healthy: false },
+};
diff --git a/site/src/testHelpers/handlers.ts b/site/src/testHelpers/handlers.ts
index 9d90e09724c37..8bc5dabba16c4 100644
--- a/site/src/testHelpers/handlers.ts
+++ b/site/src/testHelpers/handlers.ts
@@ -1,19 +1,18 @@
-import { rest } from "msw"
-import { WorkspaceBuildTransition } from "../api/types"
-import { CreateWorkspaceBuildRequest } from "../api/typesGenerated"
-import { permissionsToCheck } from "../xServices/auth/authXService"
-import * as M from "./entities"
-import { MockGroup, MockWorkspaceQuota } from "./entities"
-import fs from "fs"
-import path from "path"
+import { rest } from "msw";
+import { CreateWorkspaceBuildRequest } from "api/typesGenerated";
+import { permissionsToCheck } from "components/AuthProvider/permissions";
+import * as M from "./entities";
+import { MockGroup, MockWorkspaceQuota } from "./entities";
+import fs from "fs";
+import path from "path";
 
 export const handlers = [
   rest.get("/api/v2/templates/:templateId/daus", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockTemplateDAUResponse))
+    return res(ctx.status(200), ctx.json(M.MockTemplateDAUResponse));
   }),
 
   rest.get("/api/v2/insights/daus", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockDeploymentDAUResponse))
+    return res(ctx.status(200), ctx.json(M.MockDeploymentDAUResponse));
   }),
   // Workspace proxies
   rest.get("/api/v2/regions", async (req, res, ctx) => {
@@ -22,7 +21,7 @@ export const handlers = [
       ctx.json({
         regions: M.MockWorkspaceProxies,
       }),
-    )
+    );
   }),
   rest.get("/api/v2/workspaceproxies", async (req, res, ctx) => {
     return res(
@@ -30,26 +29,26 @@ export const handlers = [
       ctx.json({
         regions: M.MockWorkspaceProxies,
       }),
-    )
+    );
   }),
   // build info
   rest.get("/api/v2/buildinfo", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockBuildInfo))
+    return res(ctx.status(200), ctx.json(M.MockBuildInfo));
   }),
 
   // experiments
   rest.get("/api/v2/experiments", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockExperiments))
+    return res(ctx.status(200), ctx.json(M.MockExperiments));
   }),
 
   // update check
   rest.get("/api/v2/updatecheck", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockUpdateCheck))
+    return res(ctx.status(200), ctx.json(M.MockUpdateCheck));
   }),
 
   // organizations
   rest.get("/api/v2/organizations/:organizationId", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockOrganization))
+    return res(ctx.status(200), ctx.json(M.MockOrganization));
   }),
   rest.get(
     "api/v2/organizations/:organizationId/templates/examples",
@@ -57,39 +56,39 @@ export const handlers = [
       return res(
         ctx.status(200),
         ctx.json([M.MockTemplateExample, M.MockTemplateExample2]),
-      )
+      );
     },
   ),
   rest.get(
     "/api/v2/organizations/:organizationId/templates/:templateId",
     async (req, res, ctx) => {
-      return res(ctx.status(200), ctx.json(M.MockTemplate))
+      return res(ctx.status(200), ctx.json(M.MockTemplate));
     },
   ),
   rest.get(
     "/api/v2/organizations/:organizationId/templates",
     async (req, res, ctx) => {
-      return res(ctx.status(200), ctx.json([M.MockTemplate]))
+      return res(ctx.status(200), ctx.json([M.MockTemplate]));
     },
   ),
 
   // templates
   rest.get("/api/v2/templates/:templateId", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockTemplate))
+    return res(ctx.status(200), ctx.json(M.MockTemplate));
   }),
   rest.get("/api/v2/templates/:templateId/versions", async (req, res, ctx) => {
     return res(
       ctx.status(200),
       ctx.json([M.MockTemplateVersion2, M.MockTemplateVersion]),
-    )
+    );
   }),
   rest.patch("/api/v2/templates/:templateId", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockTemplate))
+    return res(ctx.status(200), ctx.json(M.MockTemplate));
   }),
   rest.get(
     "/api/v2/templateversions/:templateVersionId",
     async (req, res, ctx) => {
-      return res(ctx.status(200), ctx.json(M.MockTemplateVersion))
+      return res(ctx.status(200), ctx.json(M.MockTemplateVersion));
     },
   ),
   rest.get(
@@ -97,36 +96,47 @@ export const handlers = [
     async (req, res, ctx) => {
       return res(
         ctx.status(200),
-        ctx.json([M.MockWorkspaceResource, M.MockWorkspaceResource2]),
-      )
+        ctx.json([
+          M.MockWorkspaceResource,
+          M.MockWorkspaceVolumeResource,
+          M.MockWorkspaceImageResource,
+          M.MockWorkspaceContainerResource,
+        ]),
+      );
     },
   ),
   rest.get(
     "/api/v2/templateversions/:templateVersionId/rich-parameters",
     async (req, res, ctx) => {
-      return res(ctx.status(200), ctx.json([]))
+      return res(ctx.status(200), ctx.json([]));
+    },
+  ),
+  rest.get(
+    "/api/v2/templateversions/:templateVersionId/external-auth",
+    async (req, res, ctx) => {
+      return res(ctx.status(200), ctx.json([]));
     },
   ),
   rest.get(
-    "/api/v2/templateversions/:templateVersionId/gitauth",
+    "/api/v2/templateversions/:templateversionId/logs",
     async (req, res, ctx) => {
-      return res(ctx.status(200), ctx.json([]))
+      return res(ctx.status(200), ctx.json(M.MockWorkspaceBuildLogs));
     },
   ),
   rest.get(
     "api/v2/organizations/:organizationId/templates/:templateName/versions/:templateVersionName",
     async (req, res, ctx) => {
-      return res(ctx.status(200), ctx.json(M.MockTemplateVersion))
+      return res(ctx.status(200), ctx.json(M.MockTemplateVersion));
     },
   ),
   rest.get(
     "api/v2/organizations/:organizationId/templates/:templateName/versions/:templateVersionName/previous",
     async (req, res, ctx) => {
-      return res(ctx.status(200), ctx.json(M.MockTemplateVersion2))
+      return res(ctx.status(200), ctx.json(M.MockTemplateVersion2));
     },
   ),
   rest.delete("/api/v2/templates/:templateId", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockTemplate))
+    return res(ctx.status(200), ctx.json(M.MockTemplate));
   }),
 
   // users
@@ -137,10 +147,10 @@ export const handlers = [
         users: [M.MockUser, M.MockUser2, M.SuspendedMockUser],
         count: 26,
       }),
-    )
+    );
   }),
   rest.post("/api/v2/users", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockUser))
+    return res(ctx.status(200), ctx.json(M.MockUser));
   }),
   rest.get("/api/v2/users/:userid/login-type", async (req, res, ctx) => {
     return res(
@@ -148,106 +158,106 @@ export const handlers = [
       ctx.json({
         login_type: "password",
       }),
-    )
+    );
   }),
   rest.get("/api/v2/users/me/organizations", (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json([M.MockOrganization]))
+    return res(ctx.status(200), ctx.json([M.MockOrganization]));
   }),
   rest.get(
     "/api/v2/users/me/organizations/:organizationId",
     async (req, res, ctx) => {
-      return res(ctx.status(200), ctx.json(M.MockOrganization))
+      return res(ctx.status(200), ctx.json(M.MockOrganization));
     },
   ),
   rest.post("/api/v2/users/login", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockSessionToken))
+    return res(ctx.status(200), ctx.json(M.MockSessionToken));
   }),
   rest.post("/api/v2/users/logout", async (req, res, ctx) => {
-    return res(ctx.status(200))
+    return res(ctx.status(200));
   }),
   rest.get("/api/v2/users/me", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockUser))
+    return res(ctx.status(200), ctx.json(M.MockUser));
   }),
   rest.get("/api/v2/users/me/keys", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockAPIKey))
+    return res(ctx.status(200), ctx.json(M.MockAPIKey));
   }),
   rest.get("/api/v2/users/authmethods", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockAuthMethods))
+    return res(ctx.status(200), ctx.json(M.MockAuthMethods));
   }),
   rest.get("/api/v2/users/roles", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockSiteRoles))
+    return res(ctx.status(200), ctx.json(M.MockSiteRoles));
   }),
   rest.post("/api/v2/authcheck", async (req, res, ctx) => {
     const permissions = [
       ...Object.keys(permissionsToCheck),
       "canUpdateTemplate",
       "updateWorkspace",
-    ]
+    ];
     const response = permissions.reduce((obj, permission) => {
       return {
         ...obj,
         [permission]: true,
-      }
-    }, {})
+      };
+    }, {});
 
-    return res(ctx.status(200), ctx.json(response))
+    return res(ctx.status(200), ctx.json(response));
   }),
   rest.get("/api/v2/users/:userId/gitsshkey", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockGitSSHKey))
+    return res(ctx.status(200), ctx.json(M.MockGitSSHKey));
   }),
   rest.get(
     "/api/v2/users/:userId/workspace/:workspaceName",
     async (req, res, ctx) => {
-      return res(ctx.status(200), ctx.json(M.MockWorkspace))
+      return res(ctx.status(200), ctx.json(M.MockWorkspace));
     },
   ),
 
   // First user
   rest.get("/api/v2/users/first", async (req, res, ctx) => {
-    return res(ctx.status(200))
+    return res(ctx.status(200));
   }),
   rest.post("/api/v2/users/first", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockUser))
+    return res(ctx.status(200), ctx.json(M.MockUser));
   }),
 
   // workspaces
   rest.get("/api/v2/workspaces", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockWorkspacesResponse))
+    return res(ctx.status(200), ctx.json(M.MockWorkspacesResponse));
   }),
   rest.get("/api/v2/workspaces/:workspaceId", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockWorkspace))
+    return res(ctx.status(200), ctx.json(M.MockWorkspace));
   }),
   rest.put(
     "/api/v2/workspaces/:workspaceId/autostart",
     async (req, res, ctx) => {
-      return res(ctx.status(200))
+      return res(ctx.status(200));
     },
   ),
   rest.put("/api/v2/workspaces/:workspaceId/ttl", async (req, res, ctx) => {
-    return res(ctx.status(200))
+    return res(ctx.status(200));
   }),
   rest.put("/api/v2/workspaces/:workspaceId/extend", async (req, res, ctx) => {
-    return res(ctx.status(200))
+    return res(ctx.status(200));
   }),
 
   // workspace builds
   rest.post("/api/v2/workspaces/:workspaceId/builds", async (req, res, ctx) => {
-    const { transition } = req.body as CreateWorkspaceBuildRequest
+    const { transition } = req.body as CreateWorkspaceBuildRequest;
     const transitionToBuild = {
       start: M.MockWorkspaceBuild,
       stop: M.MockWorkspaceBuildStop,
       delete: M.MockWorkspaceBuildDelete,
-    }
-    const result = transitionToBuild[transition as WorkspaceBuildTransition]
-    return res(ctx.status(200), ctx.json(result))
+    };
+    const result = transitionToBuild[transition];
+    return res(ctx.status(200), ctx.json(result));
   }),
   rest.get("/api/v2/workspaces/:workspaceId/builds", async (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockBuilds))
+    return res(ctx.status(200), ctx.json(M.MockBuilds));
   }),
   rest.get(
     "/api/v2/users/:username/workspace/:workspaceName/builds/:buildNumber",
     (req, res, ctx) => {
-      return res(ctx.status(200), ctx.json(M.MockWorkspaceBuild))
+      return res(ctx.status(200), ctx.json(M.MockWorkspaceBuild));
     },
   ),
   rest.get(
@@ -255,101 +265,110 @@ export const handlers = [
     (req, res, ctx) => {
       return res(
         ctx.status(200),
-        ctx.json([M.MockWorkspaceResource, M.MockWorkspaceResource2]),
-      )
+        ctx.json([
+          M.MockWorkspaceResource,
+          M.MockWorkspaceVolumeResource,
+          M.MockWorkspaceImageResource,
+          M.MockWorkspaceContainerResource,
+        ]),
+      );
     },
   ),
   rest.patch(
     "/api/v2/workspacebuilds/:workspaceBuildId/cancel",
     (req, res, ctx) => {
-      return res(ctx.status(200), ctx.json(M.MockCancellationMessage))
+      return res(ctx.status(200), ctx.json(M.MockCancellationMessage));
     },
   ),
   rest.get(
     "/api/v2/workspacebuilds/:workspaceBuildId/logs",
     (req, res, ctx) => {
-      return res(ctx.status(200), ctx.json(M.MockWorkspaceBuildLogs))
+      return res(ctx.status(200), ctx.json(M.MockWorkspaceBuildLogs));
     },
   ),
   rest.get("/api/v2/entitlements", (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockEntitlements))
+    return res(ctx.status(200), ctx.json(M.MockEntitlements));
   }),
 
   // Audit
   rest.get("/api/v2/audit", (req, res, ctx) => {
-    const filter = req.url.searchParams.get("q") as string
+    const filter = req.url.searchParams.get("q") as string;
     const logs =
       filter === "resource_type:workspace action:create"
         ? [M.MockAuditLog]
-        : [M.MockAuditLog, M.MockAuditLog2]
+        : [M.MockAuditLog, M.MockAuditLog2];
     return res(
       ctx.status(200),
       ctx.json({
         audit_logs: logs,
         count: logs.length,
       }),
-    )
+    );
   }),
 
   // Applications host
   rest.get("/api/v2/applications/host", (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json({ host: "*.dev.coder.com" }))
+    return res(ctx.status(200), ctx.json({ host: "*.dev.coder.com" }));
   }),
 
   // Groups
   rest.get("/api/v2/organizations/:organizationId/groups", (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json([MockGroup]))
+    return res(ctx.status(200), ctx.json([MockGroup]));
   }),
 
   rest.post(
     "/api/v2/organizations/:organizationId/groups",
     async (req, res, ctx) => {
-      return res(ctx.status(201), ctx.json(M.MockGroup))
+      return res(ctx.status(201), ctx.json(M.MockGroup));
     },
   ),
 
   rest.get("/api/v2/groups/:groupId", (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(MockGroup))
+    return res(ctx.status(200), ctx.json(MockGroup));
   }),
 
   rest.patch("/api/v2/groups/:groupId", (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(MockGroup))
+    return res(ctx.status(200), ctx.json(MockGroup));
   }),
 
   rest.delete("/api/v2/groups/:groupId", (req, res, ctx) => {
-    return res(ctx.status(204))
+    return res(ctx.status(204));
   }),
 
   rest.get("/api/v2/workspace-quota/:userId", (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(MockWorkspaceQuota))
+    return res(ctx.status(200), ctx.json(MockWorkspaceQuota));
   }),
 
   rest.get("/api/v2/appearance", (req, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockAppearance))
+    return res(ctx.status(200), ctx.json(M.MockAppearanceConfig));
   }),
 
   rest.get("/api/v2/deployment/stats", (_, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockDeploymentStats))
+    return res(ctx.status(200), ctx.json(M.MockDeploymentStats));
+  }),
+
+  rest.get("/api/v2/deployment/config", (_, res, ctx) => {
+    return res(ctx.status(200), ctx.json(M.MockDeploymentConfig));
   }),
 
   rest.get(
     "/api/v2/workspacebuilds/:workspaceBuildId/parameters",
     (_, res, ctx) => {
-      return res(ctx.status(200), ctx.json([M.MockWorkspaceBuildParameter1]))
+      return res(ctx.status(200), ctx.json([M.MockWorkspaceBuildParameter1]));
     },
   ),
 
   rest.get("/api/v2/files/:fileId", (_, res, ctx) => {
     const fileBuffer = fs.readFileSync(
       path.resolve(__dirname, "./templateFiles.tar"),
-    )
+    );
 
     return res(
       ctx.set("Content-Length", fileBuffer.byteLength.toString()),
       ctx.set("Content-Type", "application/octet-stream"),
       // Respond with the "ArrayBuffer".
       ctx.body(fileBuffer),
-    )
+    );
   }),
 
   rest.get(
@@ -362,7 +381,7 @@ export const handlers = [
           M.MockTemplateVersionParameter2,
           M.MockTemplateVersionParameter3,
         ]),
-      )
+      );
     },
   ),
 
@@ -376,19 +395,23 @@ export const handlers = [
           M.MockTemplateVersionVariable2,
           M.MockTemplateVersionVariable3,
         ]),
-      )
+      );
     },
   ),
 
   rest.get("/api/v2/deployment/ssh", (_, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockDeploymentSSH))
+    return res(ctx.status(200), ctx.json(M.MockDeploymentSSH));
   }),
 
   rest.get("/api/v2/workspaceagents/:agent/logs", (_, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockWorkspaceAgentLogs))
+    return res(ctx.status(200), ctx.json(M.MockWorkspaceAgentLogs));
   }),
 
   rest.get("/api/v2/debug/health", (_, res, ctx) => {
-    return res(ctx.status(200), ctx.json(M.MockHealth))
+    return res(ctx.status(200), ctx.json(M.MockHealth));
+  }),
+
+  rest.get("/api/v2/workspaceagents/:agent/listening-ports", (_, res, ctx) => {
+    return res(ctx.status(200), ctx.json(M.MockListeningPortsResponse));
   }),
-]
+];
diff --git a/site/src/testHelpers/localstorage.ts b/site/src/testHelpers/localstorage.ts
index 331a311323a36..bff92d8f9f0b4 100644
--- a/site/src/testHelpers/localstorage.ts
+++ b/site/src/testHelpers/localstorage.ts
@@ -1,22 +1,22 @@
 export const localStorageMock = () => {
-  const store = {} as Record<string, string>
+  const store = {} as Record<string, string>;
 
   return {
     getItem: (key: string): string => {
-      return store[key]
+      return store[key];
     },
     setItem: (key: string, value: string) => {
-      store[key] = value
+      store[key] = value;
     },
     clear: () => {
       Object.keys(store).forEach((key) => {
-        delete store[key]
-      })
+        delete store[key];
+      });
     },
     removeItem: (key: string) => {
-      delete store[key]
+      delete store[key];
     },
-  }
-}
+  };
+};
 
-Object.defineProperty(window, "localStorage", { value: localStorageMock() })
+Object.defineProperty(window, "localStorage", { value: localStorageMock() });
diff --git a/site/src/testHelpers/renderHelpers.tsx b/site/src/testHelpers/renderHelpers.tsx
index 47862b5d29b07..1de1c1997b12b 100644
--- a/site/src/testHelpers/renderHelpers.tsx
+++ b/site/src/testHelpers/renderHelpers.tsx
@@ -1,39 +1,43 @@
-import {
-  render as tlRender,
-  screen,
-  waitForElementToBeRemoved,
-} from "@testing-library/react"
-import { AppProviders } from "app"
-import { DashboardLayout } from "components/Dashboard/DashboardLayout"
-import { i18n } from "i18n"
-import { TemplateSettingsLayout } from "pages/TemplateSettingsPage/TemplateSettingsLayout"
-import { WorkspaceSettingsLayout } from "pages/WorkspaceSettingsPage/WorkspaceSettingsLayout"
-import { I18nextProvider } from "react-i18next"
+import { render as tlRender, screen, waitFor } from "@testing-library/react";
+import { AppProviders, ThemeProviders } from "App";
+import { DashboardLayout } from "components/Dashboard/DashboardLayout";
+import { TemplateSettingsLayout } from "pages/TemplateSettingsPage/TemplateSettingsLayout";
+import { WorkspaceSettingsLayout } from "pages/WorkspaceSettingsPage/WorkspaceSettingsLayout";
 import {
   RouterProvider,
   createMemoryRouter,
   RouteObject,
-} from "react-router-dom"
-import { RequireAuth } from "../components/RequireAuth/RequireAuth"
-import { MockUser } from "./entities"
-import { ReactNode } from "react"
-
-const baseRender = (element: ReactNode) => {
-  return tlRender(
-    <I18nextProvider i18n={i18n}>
-      <AppProviders>{element}</AppProviders>
-    </I18nextProvider>,
-  )
-}
+} from "react-router-dom";
+import { RequireAuth } from "../components/RequireAuth/RequireAuth";
+import { MockUser } from "./entities";
+import { ReactNode } from "react";
+import { QueryClient } from "react-query";
 
 export const renderWithRouter = (
   router: ReturnType<typeof createMemoryRouter>,
 ) => {
+  // Create one query client for each render isolate it avoid other
+  // tests to be affected
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: {
+        retry: false,
+        cacheTime: 0,
+        refetchOnWindowFocus: false,
+        networkMode: "offlineFirst",
+      },
+    },
+  });
+
   return {
-    ...baseRender(<RouterProvider router={router} />),
+    ...tlRender(
+      <AppProviders queryClient={queryClient}>
+        <RouterProvider router={router} />
+      </AppProviders>,
+    ),
     router,
-  }
-}
+  };
+};
 
 export const render = (element: ReactNode) => {
   return renderWithRouter(
@@ -46,22 +50,22 @@ export const render = (element: ReactNode) => {
       ],
       { initialEntries: ["/"] },
     ),
-  )
-}
+  );
+};
 
 type RenderWithAuthOptions = {
   // The current URL, /workspaces/123
-  route?: string
+  route?: string;
   // The route path, /workspaces/:workspaceId
-  path?: string
+  path?: string;
   // Extra routes to add to the router. It is helpful when having redirecting
   // routes or multiple routes during the test flow
-  extraRoutes?: RouteObject[]
+  extraRoutes?: RouteObject[];
   // The same as extraRoutes but for routes that don't require authentication
-  nonAuthenticatedRoutes?: RouteObject[]
+  nonAuthenticatedRoutes?: RouteObject[];
   // In case you want to render a layout inside of it
-  children?: RouteObject["children"]
-}
+  children?: RouteObject["children"];
+};
 
 export function renderWithAuth(
   element: JSX.Element,
@@ -79,16 +83,16 @@ export function renderWithAuth(
       children: [{ path, element, children }, ...extraRoutes],
     },
     ...nonAuthenticatedRoutes,
-  ]
+  ];
 
   const renderResult = renderWithRouter(
     createMemoryRouter(routes, { initialEntries: [route] }),
-  )
+  );
 
   return {
     user: MockUser,
     ...renderResult,
-  }
+  };
 }
 
 export function renderWithTemplateSettingsLayout(
@@ -116,16 +120,16 @@ export function renderWithTemplateSettingsLayout(
       ],
     },
     ...nonAuthenticatedRoutes,
-  ]
+  ];
 
   const renderResult = renderWithRouter(
     createMemoryRouter(routes, { initialEntries: [route] }),
-  )
+  );
 
   return {
     user: MockUser,
     ...renderResult,
-  }
+  };
 }
 
 export function renderWithWorkspaceSettingsLayout(
@@ -153,22 +157,29 @@ export function renderWithWorkspaceSettingsLayout(
       ],
     },
     ...nonAuthenticatedRoutes,
-  ]
+  ];
 
   const renderResult = renderWithRouter(
     createMemoryRouter(routes, { initialEntries: [route] }),
-  )
+  );
 
   return {
     user: MockUser,
     ...renderResult,
-  }
+  };
 }
 
-export const waitForLoaderToBeRemoved = (): Promise<void> =>
-  // Sometimes, we have pages that are doing a lot of requests to get done, so the
-  // default timeout of 1_000 is not enough. We should revisit this when we unify
-  // some of the endpoints
-  waitForElementToBeRemoved(() => screen.queryByTestId("loader"), {
-    timeout: 5_000,
-  })
+export const waitForLoaderToBeRemoved = async (): Promise<void> => {
+  return waitFor(
+    () => {
+      expect(screen.queryByTestId("loader")).not.toBeInTheDocument();
+    },
+    {
+      timeout: 5_000,
+    },
+  );
+};
+
+export const renderComponent = (component: React.ReactNode) => {
+  return tlRender(<ThemeProviders>{component}</ThemeProviders>);
+};
diff --git a/site/src/testHelpers/server.ts b/site/src/testHelpers/server.ts
index 104074528453c..9bb8a8709c809 100644
--- a/site/src/testHelpers/server.ts
+++ b/site/src/testHelpers/server.ts
@@ -1,5 +1,5 @@
-import { setupServer } from "msw/node"
-import { handlers } from "./handlers"
+import { setupServer } from "msw/node";
+import { handlers } from "./handlers";
 
 // This configures a request mocking server with the given request handlers.
-export const server = setupServer(...handlers)
+export const server = setupServer(...handlers);
diff --git a/site/src/testHelpers/styleMock.ts b/site/src/testHelpers/styleMock.ts
index b1c6ea436a540..ff8b4c56321a3 100644
--- a/site/src/testHelpers/styleMock.ts
+++ b/site/src/testHelpers/styleMock.ts
@@ -1 +1 @@
-export default {}
+export default {};
diff --git a/site/src/theme/colors.ts b/site/src/theme/colors.ts
index c137ea08a33fc..6f0e870ae1631 100644
--- a/site/src/theme/colors.ts
+++ b/site/src/theme/colors.ts
@@ -1,47 +1,96 @@
 // Based on https://codepen.io/hkfoster/pen/YzeYRwR
 
+import { getMetadataAsJSON } from "utils/metadata";
+
+// When in development mode the experiments meta tag won't exist,
+// so you can just set this to true.
+export const experimentalTheme =
+  typeof document !== "undefined" &&
+  (getMetadataAsJSON<string[]>("experiments")?.includes("dashboard_theme") ??
+    false);
+
 export const colors = {
   white: "hsl(0, 0%, 100%)",
 
-  gray: {
-    17: "hsl(220, 50%, 3%)",
-    16: "hsl(223, 44%, 9%)",
-    15: "hsl(222, 38%, 14%)",
-    14: "hsl(222, 32%, 19%)",
-    13: "hsl(222, 31%, 25%)",
-    12: "hsl(222, 30%, 31%)",
-    11: "hsl(219, 29%, 38%)",
-    10: "hsl(219, 28%, 45%)",
-    9: "hsl(219, 28%, 52%)",
-    8: "hsl(218, 29%, 58%)",
-    7: "hsl(219, 30%, 64%)",
-    6: "hsl(219, 31%, 71%)",
-    5: "hsl(218, 32%, 77%)",
-    4: "hsl(223, 38%, 84%)",
-    3: "hsl(218, 44%, 92%)",
-    2: "hsl(220, 50%, 95%)",
-    1: "hsl(220, 55%, 98%)",
-  },
+  gray: experimentalTheme
+    ? {
+        17: "hsl(0, 0%, 4%)",
+        16: "hsl(0, 0%, 7%)",
+        15: "hsl(0, 0%, 10%)",
+        14: "hsl(0, 0%, 14%)",
+        13: "hsl(0, 0%, 17%)",
+        12: "hsl(0, 0%, 20%)",
+        11: "hsl(0, 0%, 23%)",
+        10: "hsl(0, 0%, 27%)",
+        9: "hsl(0, 0%, 31%)",
+        8: "hsl(0, 0%, 35%)",
+        7: "hsl(0, 0%, 62%)",
+        6: "hsl(0, 0%, 69%)",
+        5: "hsl(0, 0%, 75%)",
+        4: "hsl(0, 0%, 82%)",
+        3: "hsl(0, 0%, 90%)",
+        2: "hsl(0, 0%, 93%)",
+        1: "hsl(0, 0%, 96%)",
+      }
+    : {
+        17: "hsl(220, 50%, 3%)",
+        16: "hsl(223, 44%, 9%)",
+        15: "hsl(222, 38%, 14%)",
+        14: "hsl(222, 32%, 19%)",
+        13: "hsl(222, 31%, 25%)",
+        12: "hsl(222, 30%, 31%)",
+        11: "hsl(219, 29%, 38%)",
+        10: "hsl(219, 28%, 45%)",
+        9: "hsl(219, 28%, 52%)",
+        8: "hsl(218, 29%, 58%)",
+        7: "hsl(219, 30%, 64%)",
+        6: "hsl(219, 31%, 71%)",
+        5: "hsl(218, 32%, 77%)",
+        4: "hsl(223, 38%, 84%)",
+        3: "hsl(218, 44%, 92%)",
+        2: "hsl(220, 50%, 95%)",
+        1: "hsl(220, 55%, 98%)",
+      },
 
-  red: {
-    17: "hsl(355, 95%, 3%)",
-    16: "hsl(355, 88%, 9%)",
-    15: "hsl(355, 86%, 14%)",
-    14: "hsl(355, 84%, 19%)",
-    13: "hsl(355, 82%, 25%)",
-    12: "hsl(355, 74%, 31%)",
-    11: "hsl(355, 70%, 38%)",
-    10: "hsl(355, 66%, 45%)",
-    9: "hsl(355, 69%, 52%)",
-    8: "hsl(355, 73%, 58%)",
-    7: "hsl(355, 76%, 64%)",
-    6: "hsl(355, 78%, 71%)",
-    5: "hsl(355, 79%, 77%)",
-    4: "hsl(355, 85%, 84%)",
-    3: "hsl(355, 88%, 92%)",
-    2: "hsl(355, 95%, 96%)",
-    1: "hsl(355, 100%, 98%) ",
-  },
+  red: experimentalTheme
+    ? {
+        17: "hsl(355, 95%, 3%)",
+        16: "hsl(355, 88%, 8%)",
+        15: "hsl(355, 86%, 13%)",
+        14: "hsl(355, 84%, 18%)",
+        13: "hsl(355, 82%, 23%)",
+        12: "hsl(355, 74%, 28%)",
+        11: "hsl(355, 70%, 33%)",
+        10: "hsl(355, 66%, 38%)",
+        9: "hsl(355, 69%, 43%)",
+        8: "hsl(355, 73%, 48%)",
+        7: "hsl(355, 76%, 53%)",
+        6: "hsl(355, 78%, 58%)",
+        5: "hsl(355, 79%, 63%)",
+        4: "hsl(355, 85%, 68%)",
+        3: "hsl(355, 88%, 73%)",
+        2: "hsl(355, 95%, 78%)",
+        1: "hsl(355, 100%, 83%) ",
+      }
+    : {
+        17: "hsl(355, 95%, 3%)",
+        16: "hsl(355, 88%, 9%)",
+        15: "hsl(355, 86%, 14%)",
+        14: "hsl(355, 84%, 19%)",
+        13: "hsl(355, 82%, 25%)",
+        12: "hsl(355, 74%, 31%)",
+        11: "hsl(355, 70%, 38%)",
+        10: "hsl(355, 66%, 45%)",
+        9: "hsl(355, 69%, 52%)",
+        8: "hsl(355, 73%, 58%)",
+        7: "hsl(355, 76%, 64%)",
+        6: "hsl(355, 78%, 71%)",
+        5: "hsl(355, 79%, 77%)",
+        4: "hsl(355, 85%, 84%)",
+        3: "hsl(355, 88%, 92%)",
+        2: "hsl(355, 95%, 96%)",
+        1: "hsl(355, 100%, 98%) ",
+      },
 
   orange: {
     17: "hsl(20, 100%, 3%)",
@@ -222,4 +271,4 @@ export const colors = {
     2: "hsl(315, 95%, 96%)",
     1: "hsl(315, 100%, 98%)",
   },
-}
+};
diff --git a/site/src/theme/constants.ts b/site/src/theme/constants.ts
index c5f832f39873f..a768dc4ab18e7 100644
--- a/site/src/theme/constants.ts
+++ b/site/src/theme/constants.ts
@@ -1,11 +1,9 @@
-export const borderRadius = 8
-export const borderRadiusSm = 6
+export const borderRadius = 8;
 export const MONOSPACE_FONT_FAMILY =
-  "'IBM Plex Mono', 'Lucida Console', 'Lucida Sans Typewriter', 'Liberation Mono', 'Monaco', 'Courier New', Courier, monospace"
-export const BODY_FONT_FAMILY = `"Inter", sans-serif`
-export const navHeight = 62
-export const containerWidth = 1380
-export const containerWidthMedium = 1080
-export const sidePadding = 24
-export const CardPadding = 20
-export const dashboardContentBottomPadding = 8 * 6
+  "'IBM Plex Mono', 'Lucida Console', 'Lucida Sans Typewriter', 'Liberation Mono', 'Monaco', 'Courier New', Courier, monospace";
+export const BODY_FONT_FAMILY = `"Inter", system-ui, sans-serif`;
+export const navHeight = 62;
+export const containerWidth = 1380;
+export const containerWidthMedium = 1080;
+export const sidePadding = 24;
+export const dashboardContentBottomPadding = 8 * 6;
diff --git a/site/src/theme/globalFonts.ts b/site/src/theme/globalFonts.ts
index 7714377acaf72..d840a8738b527 100644
--- a/site/src/theme/globalFonts.ts
+++ b/site/src/theme/globalFonts.ts
@@ -1,8 +1,8 @@
 // Monospace fonts used for code, button styles, and banners
-import "@fontsource/ibm-plex-mono/400.css"
-import "@fontsource/ibm-plex-mono/600.css"
+import "@fontsource/ibm-plex-mono/400.css";
+import "@fontsource/ibm-plex-mono/600.css";
 // Main body copy font
-import "@fontsource/inter/300.css"
-import "@fontsource/inter/400.css"
-import "@fontsource/inter/500.css"
-import "@fontsource/inter/600.css"
+import "@fontsource/inter/300.css";
+import "@fontsource/inter/400.css";
+import "@fontsource/inter/500.css";
+import "@fontsource/inter/600.css";
diff --git a/site/src/theme/icons.json b/site/src/theme/icons.json
new file mode 100644
index 0000000000000..fe8011d7e8685
--- /dev/null
+++ b/site/src/theme/icons.json
@@ -0,0 +1,74 @@
+[
+  "android-studio.svg",
+  "apache-guacamole.svg",
+  "apple-black.svg",
+  "apple-grey.svg",
+  "aws.png",
+  "azure-devops.svg",
+  "azure.png",
+  "bitbucket.svg",
+  "centos.svg",
+  "clion.svg",
+  "code.svg",
+  "coder.svg",
+  "conda.svg",
+  "database.svg",
+  "datagrip.svg",
+  "dataspell.svg",
+  "debian.svg",
+  "discord.svg",
+  "do.png",
+  "docker.png",
+  "dotfiles.svg",
+  "fedora.svg",
+  "fly.io.svg",
+  "folder.svg",
+  "gateway.svg",
+  "gcp.png",
+  "git.svg",
+  "github.svg",
+  "gitlab.svg",
+  "go.svg",
+  "goland.svg",
+  "google.svg",
+  "image.svg",
+  "intellij.svg",
+  "java.svg",
+  "javascript.svg",
+  "jax.svg",
+  "jfrog.svg",
+  "jupyter.svg",
+  "k8s.png",
+  "kasmvnc.svg",
+  "kotlin.svg",
+  "matlab.svg",
+  "memory.svg",
+  "microsoft.svg",
+  "node.svg",
+  "nomad.svg",
+  "novnc.svg",
+  "okta.svg",
+  "personalize.svg",
+  "php.svg",
+  "phpstorm.svg",
+  "projector.svg",
+  "pycharm.svg",
+  "python.svg",
+  "pytorch.svg",
+  "rider.svg",
+  "rockylinux.svg",
+  "rstudio.svg",
+  "ruby.png",
+  "rubymine.svg",
+  "rust.svg",
+  "slack.svg",
+  "swift.svg",
+  "tensorflow.svg",
+  "terminal.svg",
+  "theia.svg",
+  "typescript.svg",
+  "ubuntu.svg",
+  "vault.svg",
+  "webstorm.svg",
+  "widgets.svg"
+]
diff --git a/site/src/theme/index.ts b/site/src/theme/index.ts
index eefbaf7a2500a..7cc5f34d8cda2 100644
--- a/site/src/theme/index.ts
+++ b/site/src/theme/index.ts
@@ -1 +1 @@
-export { dark } from "./theme"
+export { dark } from "./theme";
diff --git a/site/src/theme/theme.ts b/site/src/theme/theme.ts
index 48adafe05408d..7ebaec29c01fc 100644
--- a/site/src/theme/theme.ts
+++ b/site/src/theme/theme.ts
@@ -1,17 +1,23 @@
-import { colors } from "./colors"
-import { ThemeOptions, createTheme, Theme } from "@mui/material/styles"
-import { BODY_FONT_FAMILY, borderRadius } from "./constants"
+import { colors, experimentalTheme } from "./colors";
+import { createTheme, type ThemeOptions } from "@mui/material/styles";
+import { BODY_FONT_FAMILY, borderRadius } from "./constants";
 
 // MUI does not have aligned heights for buttons and inputs so we have to "hack" it a little bit
-export const BUTTON_LG_HEIGHT = 40
-export const BUTTON_MD_HEIGHT = 36
-export const BUTTON_SM_HEIGHT = 32
+export const BUTTON_LG_HEIGHT = 40;
+export const BUTTON_MD_HEIGHT = 36;
+export const BUTTON_SM_HEIGHT = 32;
 
-export type PaletteIndex = keyof Theme["palette"]
-export type PaletteStatusIndex = Extract<
-  PaletteIndex,
-  "error" | "warning" | "info" | "success"
->
+export type PaletteIndex =
+  | "primary"
+  | "secondary"
+  | "background"
+  | "text"
+  | "error"
+  | "warning"
+  | "info"
+  | "success"
+  | "action"
+  | "neutral";
 
 export let dark = createTheme({
   palette: {
@@ -39,8 +45,8 @@ export let dark = createTheme({
     },
     divider: colors.gray[13],
     warning: {
-      light: colors.orange[7],
-      main: colors.orange[9],
+      light: experimentalTheme ? colors.orange[9] : colors.orange[7],
+      main: experimentalTheme ? colors.orange[11] : colors.orange[9],
       dark: colors.orange[15],
     },
     success: {
@@ -50,7 +56,7 @@ export let dark = createTheme({
     info: {
       light: colors.blue[7],
       main: colors.blue[9],
-      dark: colors.blue[15],
+      dark: colors.blue[14],
       contrastText: colors.gray[4],
     },
     error: {
@@ -68,30 +74,40 @@ export let dark = createTheme({
   },
   typography: {
     fontFamily: BODY_FONT_FAMILY,
+
     body1: {
-      fontSize: 16,
-      lineHeight: "24px",
+      fontSize: "1rem" /* 16px at default scaling */,
+      lineHeight: "1.5rem" /* 24px at default scaling */,
     },
+
     body2: {
-      fontSize: 14,
-      lineHeight: "20px",
+      fontSize: "0.875rem" /* 14px at default scaling */,
+      lineHeight: "1.25rem" /* 20px at default scaling */,
     },
   },
   shape: {
     borderRadius,
   },
-})
+});
 
 dark = createTheme(dark, {
   components: {
     MuiCssBaseline: {
       styleOverrides: `
+        html, body, #root, #storybook-root {
+          height: 100%;
+        }
+
         input:-webkit-autofill,
         input:-webkit-autofill:hover,
         input:-webkit-autofill:focus,
         input:-webkit-autofill:active  {
           -webkit-box-shadow: 0 0 0 100px ${dark.palette.background.default} inset !important;
         }
+
+        ::placeholder {
+          color: ${dark.palette.text.disabled};
+        }
       `,
     },
     MuiAvatar: {
@@ -153,6 +169,11 @@ dark = createTheme(dark, {
         sizeLarge: {
           height: BUTTON_LG_HEIGHT,
         },
+        outlined: {
+          ":hover": {
+            border: `1px solid ${colors.gray[10]}`,
+          },
+        },
         outlinedNeutral: {
           borderColor: colors.gray[12],
 
@@ -187,6 +208,22 @@ dark = createTheme(dark, {
         },
       },
     },
+    MuiButtonGroup: {
+      styleOverrides: {
+        root: {
+          ">button:hover+button": {
+            // The !important is unfortunate, but necessary for the border.
+            borderLeftColor: `${colors.gray[10]} !important`,
+          },
+        },
+      },
+    },
+    MuiLoadingButton: {
+      defaultProps: {
+        variant: "outlined",
+        color: "neutral",
+      },
+    },
     MuiTableContainer: {
       styleOverrides: {
         root: {
@@ -362,7 +399,7 @@ dark = createTheme(dark, {
           // The default outlined input color is white, which seemed jarring.
           "&:hover:not(.Mui-error):not(.Mui-focused) .MuiOutlinedInput-notchedOutline":
             {
-              borderColor: colors.gray[7],
+              borderColor: colors.gray[10],
             },
         },
       },
@@ -380,6 +417,15 @@ dark = createTheme(dark, {
         disableRipple: true,
       },
     },
+    MuiCheckbox: {
+      styleOverrides: {
+        root: {
+          "&.Mui-disabled": {
+            color: colors.gray[11],
+          },
+        },
+      },
+    },
     MuiSwitch: {
       defaultProps: {
         color: "primary",
@@ -444,4 +490,4 @@ dark = createTheme(dark, {
       },
     },
   },
-} as ThemeOptions)
+} as ThemeOptions);
diff --git a/site/src/utils/appearance.ts b/site/src/utils/appearance.ts
new file mode 100644
index 0000000000000..3e9e3785f0064
--- /dev/null
+++ b/site/src/utils/appearance.ts
@@ -0,0 +1,16 @@
+export const getApplicationName = (): string => {
+  const c = document.head
+    .querySelector(`meta[name=application-name]`)
+    ?.getAttribute("content");
+  // Fallback to "Coder" if the application name is not available for some reason.
+  // We need to check if the content does not look like {{ .ApplicationName}}
+  // as it means that Coder is running in development mode (port :8080).
+  return c && !c.startsWith("{{ .") ? c : "Coder";
+};
+
+export const getLogoURL = (): string => {
+  const c = document.head
+    .querySelector(`meta[property=logo-url]`)
+    ?.getAttribute("content");
+  return c && !c.startsWith("{{ .") ? c : "";
+};
diff --git a/site/src/utils/apps.test.ts b/site/src/utils/apps.test.ts
new file mode 100644
index 0000000000000..9e188efb2af35
--- /dev/null
+++ b/site/src/utils/apps.test.ts
@@ -0,0 +1,103 @@
+import { createAppLinkHref } from "./apps";
+import {
+  MockWorkspace,
+  MockWorkspaceAgent,
+  MockWorkspaceApp,
+} from "testHelpers/entities";
+
+describe("create app link", () => {
+  it("with external URL", () => {
+    const externalURL = "https://external-url.tld";
+    const href = createAppLinkHref(
+      "http:",
+      "/path-base",
+      "*.apps-host.tld",
+      "app-slug",
+      "username",
+      MockWorkspace,
+      MockWorkspaceAgent,
+      {
+        ...MockWorkspaceApp,
+        external: true,
+        url: externalURL,
+      },
+    );
+    expect(href).toBe(externalURL);
+  });
+
+  it("without subdomain", () => {
+    const href = createAppLinkHref(
+      "http:",
+      "/path-base",
+      "*.apps-host.tld",
+      "app-slug",
+      "username",
+      MockWorkspace,
+      MockWorkspaceAgent,
+      {
+        ...MockWorkspaceApp,
+        subdomain: false,
+      },
+    );
+    expect(href).toBe(
+      "/path-base/@username/Test-Workspace.a-workspace-agent/apps/app-slug/",
+    );
+  });
+
+  it("with command", () => {
+    const href = createAppLinkHref(
+      "https:",
+      "/path-base",
+      "*.apps-host.tld",
+      "app-slug",
+      "username",
+      MockWorkspace,
+      MockWorkspaceAgent,
+      {
+        ...MockWorkspaceApp,
+        command: "ls -la",
+      },
+    );
+    expect(href).toBe(
+      "/path-base/@username/Test-Workspace.a-workspace-agent/terminal?command=ls%20-la",
+    );
+  });
+
+  it("with subdomain", () => {
+    const href = createAppLinkHref(
+      "ftps:",
+      "/path-base",
+      "*.apps-host.tld",
+      "app-slug",
+      "username",
+      MockWorkspace,
+      MockWorkspaceAgent,
+      {
+        ...MockWorkspaceApp,
+        subdomain: true,
+        subdomain_name: "hellocoder",
+      },
+    );
+    expect(href).toBe("ftps://hellocoder.apps-host.tld/");
+  });
+
+  it("with subdomain, but not apps host", () => {
+    const href = createAppLinkHref(
+      "ftps:",
+      "/path-base",
+      "",
+      "app-slug",
+      "username",
+      MockWorkspace,
+      MockWorkspaceAgent,
+      {
+        ...MockWorkspaceApp,
+        subdomain: true,
+        subdomain_name: "hellocoder",
+      },
+    );
+    expect(href).toBe(
+      "/path-base/@username/Test-Workspace.a-workspace-agent/apps/app-slug/",
+    );
+  });
+});
diff --git a/site/src/utils/apps.ts b/site/src/utils/apps.ts
new file mode 100644
index 0000000000000..6021f2ffebb52
--- /dev/null
+++ b/site/src/utils/apps.ts
@@ -0,0 +1,32 @@
+import * as TypesGen from "api/typesGenerated";
+
+export const createAppLinkHref = (
+  protocol: string,
+  preferredPathBase: string,
+  appsHost: string,
+  appSlug: string,
+  username: string,
+  workspace: TypesGen.Workspace,
+  agent: TypesGen.WorkspaceAgent,
+  app: TypesGen.WorkspaceApp,
+): string => {
+  if (app.external) {
+    return app.url;
+  }
+
+  // The backend redirects if the trailing slash isn't included, so we add it
+  // here to avoid extra roundtrips.
+  let href = `${preferredPathBase}/@${username}/${workspace.name}.${
+    agent.name
+  }/apps/${encodeURIComponent(appSlug)}/`;
+  if (app.command) {
+    href = `${preferredPathBase}/@${username}/${workspace.name}.${
+      agent.name
+    }/terminal?command=${encodeURIComponent(app.command)}`;
+  }
+
+  if (appsHost && app.subdomain && app.subdomain_name) {
+    href = `${protocol}//${appsHost}/`.replace("*", app.subdomain_name);
+  }
+  return href;
+};
diff --git a/site/src/utils/colors.test.ts b/site/src/utils/colors.test.ts
new file mode 100644
index 0000000000000..71074f590b5b0
--- /dev/null
+++ b/site/src/utils/colors.test.ts
@@ -0,0 +1,81 @@
+/**
+ * Not testing hslToHex, because it's code directly copied from a reliable
+ * source
+ */
+import { isHslColor, isHexColor } from "./colors";
+
+describe(`${isHslColor.name}`, () => {
+  it("Should reject obviously wrong or malformed inputs", () => {
+    const wrongInputs = [
+      "",
+      "Hi :)",
+      "hsl",
+      "#333",
+      "#444666",
+      "rgb(255, 300, 299)",
+      "hsl(255deg, 10%, 20%",
+      "hsv(255deg, 10%, 20%)",
+      "hsb(255deg, 10%, 20%)",
+      "hsl(0%, 10deg, 20)",
+    ];
+
+    for (const str of wrongInputs) {
+      expect(isHslColor(str)).toBe(false);
+    }
+  });
+
+  it("Should allow strings with or without deg unit", () => {
+    const base = "hsl(200deg, 100%, 37%)";
+    expect(isHslColor(base)).toBe(true);
+
+    const withoutDeg = base.replace("deg", "");
+    expect(isHslColor(withoutDeg)).toBe(true);
+  });
+
+  it("Should not care about whether there are spaces separating the inner values", () => {
+    const inputs = [
+      "hsl(180deg,20%,97%)",
+      "hsl(180deg, 20%, 97%)",
+      "hsl(180deg,           20%,         97%)",
+    ];
+
+    for (const str of inputs) {
+      expect(isHslColor(str)).toBe(true);
+    }
+  });
+
+  it("Should reject HSL strings that don't have percents for saturation/luminosity values", () => {
+    expect(isHslColor("hsl(20%, 45, 92)")).toBe(false);
+  });
+
+  it("Should catch HSL strings that follow the correct pattern, but have impossible values", () => {
+    const inputs = [
+      "hsl(360deg, 120%, 240%)", // Impossible hue
+      "hsl(100deg, 120%, 84%)", //  Impossible saturation
+      "hsl(257, 12%, 110%)", //     Impossible luminosity
+      "hsl(360deg, 120%, 240%)", // Impossible everything
+    ];
+
+    for (const str of inputs) {
+      expect(isHslColor(str)).toBe(false);
+    }
+  });
+});
+
+describe(`${isHexColor.name}`, () => {
+  it("Should reject obviously wrong or malformed inputs", () => {
+    const inputs = ["", "#", "#bananas", "#ZZZZZZ", "AB179C", "#55555"];
+
+    for (const str of inputs) {
+      expect(isHexColor(str)).toBe(false);
+    }
+  });
+
+  it("Should be fully case-insensitive", () => {
+    const inputs = ["#aaaaaa", "#BBBBBB", "#CcCcCc"];
+
+    for (const str of inputs) {
+      expect(isHexColor(str)).toBe(true);
+    }
+  });
+});
diff --git a/site/src/utils/colors.ts b/site/src/utils/colors.ts
index 054e2cb6e98ef..f4d795bc05400 100644
--- a/site/src/utils/colors.ts
+++ b/site/src/utils/colors.ts
@@ -1,3 +1,67 @@
+import { hex } from "color-convert";
+
+/**
+ * Does not support shorthand hex strings (e.g., #fff), just to maximize
+ * compatibility with server, which also doesn't support shorthand
+ */
+const hexMatcher = /^#[0-9A-Fa-f]{6}$/;
+
+/**
+ * Determines whether a string is a hex color string. Returns false for
+ * shorthand hex strings.
+ *
+ * Mainly here to validate input before sending it to the server.
+ */
+export function isHexColor(input: string): boolean {
+  // Length check isn't necessary; it's just an fast way to validate before
+  // kicking things off to the slower regex check
+  return input.length === 7 && hexMatcher.test(input);
+}
+
+/**
+ * Regex written and tested via Regex101. This doesn't catch every invalid HSL
+ * string and still requires some other checks, but it can do a lot by itself.
+ *
+ * Setup:
+ * - Supports capture groups for all three numeric values. Regex tries to fail
+ *   the input as quickly as possible.
+ * - Regex is all-or-nothing – there is some tolerance for extra spaces, but
+ *   this regex will fail any string that is missing any part of the format.
+ * - String is case-insensitive
+ * - String must start with HSL and have both parentheses
+ * - All three numeric values must be comma-delimited
+ * - Hue can be 1-3 digits. Rightmost digit (if it exists) can only be 1-3;
+ *   other digits have no constraints. The degree unit ("deg") is optional
+ * - Both saturation and luminosity can be 1-3 digits. Rightmost digit (if it
+ *   exists) can only ever be 1. Other digits have no constraints.
+ */
+const hslMatcher =
+  /^hsl\(((?:[1-3]?\d)?\d)(?:deg)?, *((?:1?\d)?\d)%, *((?:1?\d)?\d)%\)$/i;
+
+export function isHslColor(input: string): boolean {
+  const [, hue, sat, lum] = hslMatcher.exec(input) ?? [];
+  if (hue === undefined || sat === undefined || lum === undefined) {
+    return false;
+  }
+
+  const hueN = Number(hue);
+  if (!Number.isInteger(hueN) || hueN < 0 || hueN > 359) {
+    return false;
+  }
+
+  const satN = Number(sat);
+  if (!Number.isInteger(satN) || satN < 0 || satN > 100) {
+    return false;
+  }
+
+  const lumN = Number(lum);
+  if (!Number.isInteger(lumN) || lumN < 0 || lumN > 100) {
+    return false;
+  }
+
+  return true;
+}
+
 // Used to convert our theme colors to Hex since monaco theme only support hex colors
 // From https://www.jameslmilner.com/posts/converting-rgb-hex-hsl-colors/
 export function hslToHex(hsl: string): string {
@@ -6,18 +70,28 @@ export function hslToHex(hsl: string): string {
     .replace(")", "")
     .replaceAll("%", "")
     .split(",")
-    .map(Number)
+    .map(Number);
 
-  const hDecimal = l / 100
-  const a = (s * Math.min(hDecimal, 1 - hDecimal)) / 100
+  const hDecimal = l / 100;
+  const a = (s * Math.min(hDecimal, 1 - hDecimal)) / 100;
   const f = (n: number) => {
-    const k = (n + h / 30) % 12
-    const color = hDecimal - a * Math.max(Math.min(k - 3, 9 - k, 1), -1)
+    const k = (n + h / 30) % 12;
+    const color = hDecimal - a * Math.max(Math.min(k - 3, 9 - k, 1), -1);
 
     // Convert to Hex and prefix with "0" if required
     return Math.round(255 * color)
       .toString(16)
-      .padStart(2, "0")
-  }
-  return `#${f(0)}${f(8)}${f(4)}`
+      .padStart(2, "0");
+  };
+  return `#${f(0)}${f(8)}${f(4)}`;
 }
+
+export const readableForegroundColor = (backgroundColor: string): string => {
+  const rgb = hex.rgb(backgroundColor);
+
+  // Logic taken from here:
+  // https://github.com/casesandberg/react-color/blob/bc9a0e1dc5d11b06c511a8e02a95bd85c7129f4b/src/helpers/color.js#L56
+  // to be consistent with the color-picker label.
+  const yiq = (rgb[0] * 299 + rgb[1] * 587 + rgb[2] * 114) / 1000;
+  return yiq >= 128 ? "#000" : "#fff";
+};
diff --git a/site/src/utils/combineClasses.test.ts b/site/src/utils/combineClasses.test.ts
index 21ec349db1451..6e81d533a264a 100644
--- a/site/src/utils/combineClasses.test.ts
+++ b/site/src/utils/combineClasses.test.ts
@@ -1,10 +1,10 @@
-import { combineClasses } from "./combineClasses"
+import { combineClasses } from "./combineClasses";
 
 const staticStyles = {
   text: "MuiText",
   success: "MuiText-Green",
   warning: "MuiText-Red",
-}
+};
 
 describe("combineClasses", () => {
   it.each([
@@ -26,6 +26,6 @@ describe("combineClasses", () => {
     [{ [staticStyles.text]: true, [staticStyles.success]: false }, "MuiText"],
     [[staticStyles.text, staticStyles.success], "MuiText  MuiText-Green"],
   ])(`classNames(%p) returns %p`, (staticClasses, result) => {
-    expect(combineClasses(staticClasses)).toBe(result)
-  })
-})
+    expect(combineClasses(staticClasses)).toBe(result);
+  });
+});
diff --git a/site/src/utils/combineClasses.ts b/site/src/utils/combineClasses.ts
index 041cac03efb07..5153f0e4b5b73 100644
--- a/site/src/utils/combineClasses.ts
+++ b/site/src/utils/combineClasses.ts
@@ -3,10 +3,10 @@ export const appendCSSString = (
   cssClass: string,
 ): string => {
   if (cssString === "") {
-    return cssClass
+    return cssClass;
   }
-  return `${cssString}  ${cssClass}`
-}
+  return `${cssString}  ${cssClass}`;
+};
 
 /**
  * @param classes May be an object or an array. When using an object, each key
@@ -26,22 +26,22 @@ export const combineClasses = (
     | Array<string | false | undefined>
     | Record<string, boolean | undefined> = {},
 ): string | undefined => {
-  let result = ""
+  let result = "";
 
   if (Array.isArray(classes)) {
     for (const cssClass of classes) {
       if (cssClass) {
-        result = appendCSSString(result, cssClass)
+        result = appendCSSString(result, cssClass);
       }
     }
   } else {
     for (const cssClass in classes) {
-      const useClass = classes[cssClass]
+      const useClass = classes[cssClass];
       if (useClass) {
-        result = appendCSSString(result, cssClass)
+        result = appendCSSString(result, cssClass);
       }
     }
   }
 
-  return result.length > 0 ? result : undefined
-}
+  return result.length > 0 ? result : undefined;
+};
diff --git a/site/src/utils/createDayString.ts b/site/src/utils/createDayString.ts
index a48472e22a12d..0b58124c3f586 100644
--- a/site/src/utils/createDayString.ts
+++ b/site/src/utils/createDayString.ts
@@ -1,12 +1,12 @@
-import dayjs from "dayjs"
-import relativeTime from "dayjs/plugin/relativeTime"
+import dayjs from "dayjs";
+import relativeTime from "dayjs/plugin/relativeTime";
 
-dayjs.extend(relativeTime)
+dayjs.extend(relativeTime);
 
 /**
  * Returns a human-readable string describing the passing of time
  * Broken into its own module for testing purposes
  */
 export function createDayString(time: string): string {
-  return dayjs().to(dayjs(time))
+  return dayjs().to(dayjs(time));
 }
diff --git a/site/src/utils/delay.ts b/site/src/utils/delay.ts
index cdbcf00bdfa91..35ee50b121439 100644
--- a/site/src/utils/delay.ts
+++ b/site/src/utils/delay.ts
@@ -1,4 +1,4 @@
 export const delay = (ms: number): Promise<void> =>
   new Promise((res) => {
-    setTimeout(res, ms)
-  })
+    setTimeout(res, ms);
+  });
diff --git a/site/src/utils/deployOptions.ts b/site/src/utils/deployOptions.ts
index 4f4ad3e64c4a8..44a0db64fb39a 100644
--- a/site/src/utils/deployOptions.ts
+++ b/site/src/utils/deployOptions.ts
@@ -1,41 +1,41 @@
-import { useMemo } from "react"
-import { DeploymentGroup, DeploymentOption } from "../api/types"
+import { ClibaseGroup, ClibaseOption } from "api/typesGenerated";
+import { useMemo } from "react";
 
 const deploymentOptions = (
-  options: DeploymentOption[],
+  options: ClibaseOption[],
   ...names: string[]
-): DeploymentOption[] => {
-  const found: DeploymentOption[] = []
+): ClibaseOption[] => {
+  const found: ClibaseOption[] = [];
   for (const name of names) {
-    const option = options.find((o) => o.name === name)
+    const option = options.find((o) => o.name === name);
     if (option) {
-      found.push(option)
+      found.push(option);
     } else {
-      throw new Error(`Deployment option ${name} not found`)
+      throw new Error(`Deployment option ${name} not found`);
     }
   }
-  return found
-}
+  return found;
+};
 
 export const useDeploymentOptions = (
-  options: DeploymentOption[],
+  options: ClibaseOption[],
   ...names: string[]
-): DeploymentOption[] => {
-  return useMemo(() => deploymentOptions(options, ...names), [options, names])
-}
+): ClibaseOption[] => {
+  return useMemo(() => deploymentOptions(options, ...names), [options, names]);
+};
 
 export const deploymentGroupHasParent = (
-  group: DeploymentGroup | undefined,
+  group: ClibaseGroup | undefined,
   parent: string,
 ): boolean => {
   if (!group) {
-    return false
+    return false;
   }
   if (group.parent) {
-    return deploymentGroupHasParent(group.parent, parent)
+    return deploymentGroupHasParent(group.parent, parent);
   }
   if (group.name === parent) {
-    return true
+    return true;
   }
-  return false
-}
+  return false;
+};
diff --git a/site/src/utils/docs.ts b/site/src/utils/docs.ts
index 3fee2d5490613..12ed7cc58aaa7 100644
--- a/site/src/utils/docs.ts
+++ b/site/src/utils/docs.ts
@@ -1,28 +1,28 @@
-const DEFAULT_DOCS_URL = "https://coder.com/docs/v2/latest"
+const DEFAULT_DOCS_URL = "https://coder.com/docs/v2/latest";
 
 // Add cache to avoid DOM reading all the time
-let CACHED_DOCS_URL: string | undefined
+let CACHED_DOCS_URL: string | undefined;
 
 export const docs = (path: string) => {
-  return `${getBaseDocsURL()}${path}`
-}
+  return `${getBaseDocsURL()}${path}`;
+};
 
 const getBaseDocsURL = () => {
   if (!CACHED_DOCS_URL) {
     const docsUrl = document
       .querySelector<HTMLMetaElement>('meta[property="docs-url"]')
-      ?.getAttribute("content")
-    const isValidDocsURL = docsUrl && isURL(docsUrl)
-    CACHED_DOCS_URL = isValidDocsURL ? docsUrl : DEFAULT_DOCS_URL
+      ?.getAttribute("content");
+    const isValidDocsURL = docsUrl && isURL(docsUrl);
+    CACHED_DOCS_URL = isValidDocsURL ? docsUrl : DEFAULT_DOCS_URL;
   }
-  return CACHED_DOCS_URL
-}
+  return CACHED_DOCS_URL;
+};
 
 const isURL = (value: string) => {
   try {
-    new URL(value)
-    return true
+    new URL(value);
+    return true;
   } catch {
-    return false
+    return false;
   }
-}
+};
diff --git a/site/src/utils/ellipsizeText.test.ts b/site/src/utils/ellipsizeText.test.ts
index eeb3f12dd3910..4c563a8e24b27 100644
--- a/site/src/utils/ellipsizeText.test.ts
+++ b/site/src/utils/ellipsizeText.test.ts
@@ -1,5 +1,5 @@
-import { ellipsizeText } from "./ellipsizeText"
-import { Nullable } from "./nullable"
+import { ellipsizeText } from "./ellipsizeText";
+import { Nullable } from "./nullable";
 
 describe("ellipsizeText", () => {
   it.each([
@@ -15,7 +15,7 @@ describe("ellipsizeText", () => {
       maxLength: number | undefined,
       output: Nullable<string>,
     ) => {
-      expect(ellipsizeText(str, maxLength)).toBe(output)
+      expect(ellipsizeText(str, maxLength)).toBe(output);
     },
-  )
-})
+  );
+});
diff --git a/site/src/utils/ellipsizeText.ts b/site/src/utils/ellipsizeText.ts
index 0899e65c38d90..3d66ad9ed966f 100644
--- a/site/src/utils/ellipsizeText.ts
+++ b/site/src/utils/ellipsizeText.ts
@@ -1,4 +1,4 @@
-import { Nullable } from "./nullable"
+import { Nullable } from "./nullable";
 
 /** Truncates and ellipsizes text if it's longer than maxLength */
 export const ellipsizeText = (
@@ -6,7 +6,9 @@ export const ellipsizeText = (
   maxLength = 80,
 ): string | undefined => {
   if (typeof text !== "string") {
-    return
+    return;
   }
-  return text.length <= maxLength ? text : `${text.substr(0, maxLength - 3)}...`
-}
+  return text.length <= maxLength
+    ? text
+    : `${text.substr(0, maxLength - 3)}...`;
+};
diff --git a/site/src/utils/entitlements.test.ts b/site/src/utils/entitlements.test.ts
new file mode 100644
index 0000000000000..b2f473e4a6d9a
--- /dev/null
+++ b/site/src/utils/entitlements.test.ts
@@ -0,0 +1,34 @@
+import { getFeatureVisibility } from "./entitlements";
+
+describe("getFeatureVisibility", () => {
+  it("returns empty object if there is no license", () => {
+    const result = getFeatureVisibility(false, {
+      audit_log: { entitlement: "entitled", enabled: true },
+    });
+    expect(result).toEqual(expect.objectContaining({}));
+  });
+  it("returns false for a feature that is not enabled", () => {
+    const result = getFeatureVisibility(true, {
+      audit_log: { entitlement: "entitled", enabled: false },
+    });
+    expect(result).toEqual(expect.objectContaining({ audit_log: false }));
+  });
+  it("returns false for a feature that is not entitled", () => {
+    const result = getFeatureVisibility(true, {
+      audit_log: { entitlement: "not_entitled", enabled: true },
+    });
+    expect(result).toEqual(expect.objectContaining({ audit_log: false }));
+  });
+  it("returns true for a feature that is in grace period", () => {
+    const result = getFeatureVisibility(true, {
+      audit_log: { entitlement: "grace_period", enabled: true },
+    });
+    expect(result).toEqual(expect.objectContaining({ audit_log: true }));
+  });
+  it("returns true for a feature that is in entitled", () => {
+    const result = getFeatureVisibility(true, {
+      audit_log: { entitlement: "entitled", enabled: true },
+    });
+    expect(result).toEqual(expect.objectContaining({ audit_log: true }));
+  });
+});
diff --git a/site/src/utils/entitlements.ts b/site/src/utils/entitlements.ts
new file mode 100644
index 0000000000000..b2940ba93b7bc
--- /dev/null
+++ b/site/src/utils/entitlements.ts
@@ -0,0 +1,29 @@
+import { Entitlements, Feature, FeatureName } from "api/typesGenerated";
+
+/**
+ * @param hasLicense true if Enterprise edition
+ * @param features record from feature name to feature object
+ * @returns record from feature name whether to show the feature
+ */
+export const getFeatureVisibility = (
+  hasLicense: boolean,
+  features: Record<string, Feature>,
+): Record<string, boolean> => {
+  if (hasLicense) {
+    const permissionPairs = Object.keys(features).map((feature) => {
+      const { entitlement, limit, actual, enabled } = features[feature];
+      const entitled = ["entitled", "grace_period"].includes(entitlement);
+      const limitCompliant = limit && actual ? limit >= actual : true;
+      return [feature, entitled && limitCompliant && enabled];
+    });
+    return Object.fromEntries(permissionPairs);
+  } else {
+    return {};
+  }
+};
+
+export const selectFeatureVisibility = (
+  entitlements: Entitlements,
+): Record<FeatureName, boolean> => {
+  return getFeatureVisibility(entitlements.has_license, entitlements.features);
+};
diff --git a/site/src/utils/events.test.ts b/site/src/utils/events.test.ts
index 805c1f8759de7..4d38275cdc3ad 100644
--- a/site/src/utils/events.test.ts
+++ b/site/src/utils/events.test.ts
@@ -1,18 +1,18 @@
-import { dispatchCustomEvent, isCustomEvent } from "./events"
+import { dispatchCustomEvent, isCustomEvent } from "./events";
 
 describe("events", () => {
   describe("dispatchCustomEvent", () => {
     it("dispatch a custom event", (done) => {
-      const eventDetail = { title: "Event title" }
+      const eventDetail = { title: "Event title" };
 
       window.addEventListener("eventType", (event) => {
         if (isCustomEvent(event)) {
-          expect(event.detail).toEqual(eventDetail)
-          done()
+          expect(event.detail).toEqual(eventDetail);
+          done();
         }
-      })
+      });
 
-      dispatchCustomEvent("eventType", eventDetail)
-    })
-  })
-})
+      dispatchCustomEvent("eventType", eventDetail);
+    });
+  });
+});
diff --git a/site/src/utils/events.ts b/site/src/utils/events.ts
index 7627c0626703e..b69446415715c 100644
--- a/site/src/utils/events.ts
+++ b/site/src/utils/events.ts
@@ -10,14 +10,14 @@ export const dispatchCustomEvent = <D = unknown>(
   detail?: D,
   target: EventTarget = window,
 ): CustomEvent<D> => {
-  const event = new CustomEvent<D>(eventType, { detail })
+  const event = new CustomEvent<D>(eventType, { detail });
 
-  target.dispatchEvent(event)
+  target.dispatchEvent(event);
 
-  return event
-}
+  return event;
+};
 /** Annotates a custom event listener with descriptive type information. */
-export type CustomEventListener<D = unknown> = (event: CustomEvent<D>) => void
+export type CustomEventListener<D = unknown> = (event: CustomEvent<D>) => void;
 
 /**
  * Determines if an Event object is a CustomEvent.
@@ -28,5 +28,5 @@ export type CustomEventListener<D = unknown> = (event: CustomEvent<D>) => void
 export const isCustomEvent = <D = unknown>(
   event: CustomEvent<D> | Event,
 ): event is CustomEvent<D> => {
-  return Boolean((event as CustomEvent).detail)
-}
+  return Boolean((event as CustomEvent).detail);
+};
diff --git a/site/src/utils/filetree.test.ts b/site/src/utils/filetree.test.ts
index 18b63788de1a6..77e2c0febc97d 100644
--- a/site/src/utils/filetree.test.ts
+++ b/site/src/utils/filetree.test.ts
@@ -7,32 +7,32 @@ import {
   removeFile,
   createFile,
   traverse,
-} from "./filetree"
+} from "./filetree";
 
 test("createFile() set file into the file tree", () => {
   let fileTree: FileTree = {
     "main.tf": "terraform",
     images: { "java.Dockerfile": "java dockerfile" },
-  }
+  };
   fileTree = createFile(
     "images/python.Dockerfile",
     fileTree,
     "python dockerfile",
-  )
+  );
   expect((fileTree.images as FileTree)["python.Dockerfile"]).toEqual(
     "python dockerfile",
-  )
-})
+  );
+});
 
 test("getFileContent() return the file content from the file tree", () => {
   const fileTree: FileTree = {
     "main.tf": "terraform content",
     images: { "java.Dockerfile": "java dockerfile" },
-  }
+  };
   expect(getFileContent("images/java.Dockerfile", fileTree)).toEqual(
     "java dockerfile",
-  )
-})
+  );
+});
 
 test("removeFile() removes a file from a folder", () => {
   let fileTree: FileTree = {
@@ -41,16 +41,16 @@ test("removeFile() removes a file from a folder", () => {
       "java.Dockerfile": "java dockerfile",
       "python.Dockerfile": "python Dockerfile",
     },
-  }
-  fileTree = removeFile("images/python.Dockerfile", fileTree)
+  };
+  fileTree = removeFile("images/python.Dockerfile", fileTree);
   const expectedFileTree = {
     "main.tf": "terraform content",
     images: {
       "java.Dockerfile": "java dockerfile",
     },
-  }
-  expect(expectedFileTree).toEqual(fileTree)
-})
+  };
+  expect(expectedFileTree).toEqual(fileTree);
+});
 
 test("removeFile() removes a file from root", () => {
   let fileTree: FileTree = {
@@ -59,16 +59,16 @@ test("removeFile() removes a file from root", () => {
       "java.Dockerfile": "java dockerfile",
       "python.Dockerfile": "python Dockerfile",
     },
-  }
-  fileTree = removeFile("main.tf", fileTree)
+  };
+  fileTree = removeFile("main.tf", fileTree);
   const expectedFileTree = {
     images: {
       "java.Dockerfile": "java dockerfile",
       "python.Dockerfile": "python Dockerfile",
     },
-  }
-  expect(expectedFileTree).toEqual(fileTree)
-})
+  };
+  expect(expectedFileTree).toEqual(fileTree);
+});
 
 test("moveFile() moves a file from in file tree", () => {
   let fileTree: FileTree = {
@@ -77,12 +77,12 @@ test("moveFile() moves a file from in file tree", () => {
       "java.Dockerfile": "java dockerfile",
       "python.Dockerfile": "python Dockerfile",
     },
-  }
+  };
   fileTree = moveFile(
     "images/java.Dockerfile",
     "other/java.Dockerfile",
     fileTree,
-  )
+  );
   const expectedFileTree = {
     "main.tf": "terraform content",
     images: {
@@ -91,37 +91,37 @@ test("moveFile() moves a file from in file tree", () => {
     other: {
       "java.Dockerfile": "java dockerfile",
     },
-  }
-  expect(fileTree).toEqual(expectedFileTree)
-})
+  };
+  expect(fileTree).toEqual(expectedFileTree);
+});
 
 test("existsFile() returns if there is or not a file", () => {
   const fileTree: FileTree = {
     "main.tf": "terraform content",
     images: { "java.Dockerfile": "java dockerfile" },
-  }
-  expect(existsFile("images/java.Dockerfile", fileTree)).toBeTruthy()
-  expect(existsFile("no-existent-path", fileTree)).toBeFalsy()
-})
+  };
+  expect(existsFile("images/java.Dockerfile", fileTree)).toBeTruthy();
+  expect(existsFile("no-existent-path", fileTree)).toBeFalsy();
+});
 
 test("isFolder() returns when a path is a folder or not", () => {
   const fileTree: FileTree = {
     "main.tf": "terraform content",
     images: { "java.Dockerfile": "java dockerfile" },
-  }
-  expect(isFolder("images", fileTree)).toBeTruthy()
-  expect(isFolder("images/java.Dockerfile", fileTree)).toBeFalsy()
-})
+  };
+  expect(isFolder("images", fileTree)).toBeTruthy();
+  expect(isFolder("images/java.Dockerfile", fileTree)).toBeFalsy();
+});
 
 test("traverse() go trough all the file tree files", () => {
   const fileTree: FileTree = {
     "main.tf": "terraform content",
     images: { "java.Dockerfile": "java dockerfile" },
-  }
-  const filePaths: string[] = []
+  };
+  const filePaths: string[] = [];
   traverse(fileTree, (_content, _filename, fullPath) => {
-    filePaths.push(fullPath)
-  })
-  const expectedFilePaths = ["main.tf", "images", "images/java.Dockerfile"]
-  expect(filePaths).toEqual(expectedFilePaths)
-})
+    filePaths.push(fullPath);
+  });
+  const expectedFilePaths = ["main.tf", "images", "images/java.Dockerfile"];
+  expect(filePaths).toEqual(expectedFilePaths);
+});
diff --git a/site/src/utils/filetree.ts b/site/src/utils/filetree.ts
index 9b5ea60b0aa7c..833af78c923c3 100644
--- a/site/src/utils/filetree.ts
+++ b/site/src/utils/filetree.ts
@@ -1,11 +1,11 @@
-import set from "lodash/set"
-import has from "lodash/has"
-import unset from "lodash/unset"
-import get from "lodash/get"
+import set from "lodash/set";
+import has from "lodash/has";
+import unset from "lodash/unset";
+import get from "lodash/get";
 
 export type FileTree = {
-  [key: string]: FileTree | string
-}
+  [key: string]: FileTree | string;
+};
 
 export const createFile = (
   path: string,
@@ -13,71 +13,71 @@ export const createFile = (
   value: string,
 ): FileTree => {
   if (existsFile(path, fileTree)) {
-    throw new Error(`File ${path} already exists`)
+    throw new Error(`File ${path} already exists`);
   }
-  const pathError = validatePath(path, fileTree)
+  const pathError = validatePath(path, fileTree);
   if (pathError) {
-    throw new Error(pathError)
+    throw new Error(pathError);
   }
 
-  return set(fileTree, path.split("/"), value)
-}
+  return set(fileTree, path.split("/"), value);
+};
 
 export const validatePath = (
   path: string,
   fileTree: FileTree,
 ): string | undefined => {
-  const paths = path.split("/")
-  paths.pop() // The last item is the filename
+  const paths = path.split("/");
+  paths.pop(); // The last item is the filename
   for (let i = 0; i <= paths.length; i++) {
-    const path = paths.slice(0, i + 1)
-    const pathStr = path.join("/")
+    const path = paths.slice(0, i + 1);
+    const pathStr = path.join("/");
     if (existsFile(pathStr, fileTree) && !isFolder(pathStr, fileTree)) {
-      return `Invalid path. The path ${path} is not a folder`
+      return `Invalid path. The path ${path} is not a folder`;
     }
   }
-}
+};
 
 export const updateFile = (
   path: string,
   content: FileTree | string,
   fileTree: FileTree,
 ): FileTree => {
-  return set(fileTree, path.split("/"), content)
-}
+  return set(fileTree, path.split("/"), content);
+};
 
 export const existsFile = (path: string, fileTree: FileTree) => {
-  return has(fileTree, path.split("/"))
-}
+  return has(fileTree, path.split("/"));
+};
 
 export const removeFile = (path: string, fileTree: FileTree) => {
-  const updatedFileTree = { ...fileTree }
-  unset(updatedFileTree, path.split("/"))
-  return updatedFileTree
-}
+  const updatedFileTree = { ...fileTree };
+  unset(updatedFileTree, path.split("/"));
+  return updatedFileTree;
+};
 
 export const moveFile = (
   currentPath: string,
   newPath: string,
   fileTree: FileTree,
 ) => {
-  const content = getFileContent(currentPath, fileTree)
+  const content = getFileContent(currentPath, fileTree);
   if (typeof content !== "string") {
-    throw new Error("Move folders is not allowed")
+    throw new Error("Move folders is not allowed");
   }
-  fileTree = removeFile(currentPath, fileTree)
-  fileTree = createFile(newPath, fileTree, content)
-  return fileTree
-}
+  fileTree = removeFile(currentPath, fileTree);
+  fileTree = createFile(newPath, fileTree, content);
+  return fileTree;
+};
 
 export const getFileContent = (path: string, fileTree: FileTree) => {
-  return get(fileTree, path.split("/")) as string | FileTree
-}
+  return get(fileTree, path.split("/")) as string | FileTree;
+};
 
 export const isFolder = (path: string, fileTree: FileTree) => {
-  const content = getFileContent(path, fileTree)
-  return typeof content === "object"
-}
+  const content = getFileContent(path, fileTree);
+  return typeof content === "object";
+};
 
 export const traverse = (
   fileTree: FileTree,
@@ -89,11 +89,11 @@ export const traverse = (
   parent?: string,
 ) => {
   Object.keys(fileTree).forEach((filename) => {
-    const fullPath = parent ? `${parent}/${filename}` : filename
-    const content = fileTree[filename]
-    callback(content, filename, fullPath)
+    const fullPath = parent ? `${parent}/${filename}` : filename;
+    const content = fileTree[filename];
+    callback(content, filename, fullPath);
     if (typeof content === "object") {
-      traverse(content, callback, fullPath)
+      traverse(content, callback, fullPath);
     }
-  })
-}
+  });
+};
diff --git a/site/src/utils/filters.test.ts b/site/src/utils/filters.test.ts
deleted file mode 100644
index 0f0ad348d2a80..0000000000000
--- a/site/src/utils/filters.test.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import * as TypesGen from "../api/typesGenerated"
-import { queryToFilter } from "./filters"
-
-describe("queryToFilter", () => {
-  it.each<
-    [string | undefined, TypesGen.WorkspaceFilter | TypesGen.UsersRequest]
-  >([
-    [undefined, {}],
-    ["", { q: "" }],
-    ["asdkfvjn", { q: "asdkfvjn" }],
-    ["owner:me", { q: "owner:me" }],
-    ["owner:me owner:me2", { q: "owner:me owner:me2" }],
-    ["me/dev", { q: "me/dev" }],
-    ["me/", { q: "me/" }],
-    ["    key:val      owner:me       ", { q: "key:val owner:me" }],
-    ["status:failed", { q: "status:failed" }],
-  ])(`query=%p, filter=%p`, (query, filter) => {
-    expect(queryToFilter(query)).toEqual(filter)
-  })
-})
diff --git a/site/src/utils/filters.ts b/site/src/utils/filters.ts
index 698979de356a4..beb850a65e218 100644
--- a/site/src/utils/filters.ts
+++ b/site/src/utils/filters.ts
@@ -1,22 +1,3 @@
-import * as TypesGen from "../api/typesGenerated"
-
-export const queryToFilter = (
-  query?: string,
-): TypesGen.WorkspaceFilter | TypesGen.UsersRequest => {
-  const preparedQuery = query?.trim().replace(/  +/g, " ")
-  return {
-    q: preparedQuery,
-  }
-}
-
-export const workspaceFilterQuery = {
-  me: "owner:me",
-  all: "",
-  running: "status:running",
-  failed: "status:failed",
-}
-
-export const userFilterQuery = {
-  active: "status:active",
-  all: "",
-}
+export const prepareQuery = (query?: string) => {
+  return query?.trim().replace(/  +/g, " ");
+};
diff --git a/site/src/utils/formUtils.test.ts b/site/src/utils/formUtils.test.ts
index ec495d50c1b20..fab07cb7d6c2f 100644
--- a/site/src/utils/formUtils.test.ts
+++ b/site/src/utils/formUtils.test.ts
@@ -1,15 +1,15 @@
-import { FormikContextType } from "formik/dist/types"
-import { getFormHelpers, nameValidator, onChangeTrimmed } from "./formUtils"
-import { mockApiError } from "testHelpers/entities"
+import { FormikContextType } from "formik/dist/types";
+import { getFormHelpers, nameValidator, onChangeTrimmed } from "./formUtils";
+import { mockApiError } from "testHelpers/entities";
 
 interface TestType {
-  untouchedGoodField: string
-  untouchedBadField: string
-  touchedGoodField: string
-  touchedBadField: string
+  untouchedGoodField: string;
+  untouchedBadField: string;
+  touchedGoodField: string;
+  touchedBadField: string;
 }
 
-const mockHandleChange = jest.fn()
+const mockHandleChange = jest.fn();
 
 const form = {
   errors: {
@@ -32,42 +32,42 @@ const form = {
       onBlur: jest.fn(),
       onChange: jest.fn(),
       value: "",
-    }
+    };
   },
-} as unknown as FormikContextType<TestType>
+} as unknown as FormikContextType<TestType>;
 
-const nameSchema = nameValidator("name")
+const nameSchema = nameValidator("name");
 
 describe("form util functions", () => {
   describe("getFormHelpers", () => {
     describe("without API errors", () => {
-      const getFieldHelpers = getFormHelpers<TestType>(form)
-      const untouchedGoodResult = getFieldHelpers("untouchedGoodField")
-      const untouchedBadResult = getFieldHelpers("untouchedBadField")
-      const touchedGoodResult = getFieldHelpers("touchedGoodField")
-      const touchedBadResult = getFieldHelpers("touchedBadField")
+      const getFieldHelpers = getFormHelpers<TestType>(form);
+      const untouchedGoodResult = getFieldHelpers("untouchedGoodField");
+      const untouchedBadResult = getFieldHelpers("untouchedBadField");
+      const touchedGoodResult = getFieldHelpers("touchedGoodField");
+      const touchedBadResult = getFieldHelpers("touchedBadField");
       it("populates the 'field props'", () => {
-        expect(untouchedGoodResult.name).toEqual("untouchedGoodField")
-        expect(untouchedGoodResult.onBlur).toBeDefined()
-        expect(untouchedGoodResult.onChange).toBeDefined()
-        expect(untouchedGoodResult.value).toBeDefined()
-      })
+        expect(untouchedGoodResult.name).toEqual("untouchedGoodField");
+        expect(untouchedGoodResult.onBlur).toBeDefined();
+        expect(untouchedGoodResult.onChange).toBeDefined();
+        expect(untouchedGoodResult.value).toBeDefined();
+      });
       it("sets the id to the name", () => {
-        expect(untouchedGoodResult.id).toEqual("untouchedGoodField")
-      })
+        expect(untouchedGoodResult.id).toEqual("untouchedGoodField");
+      });
       it("sets error to true if touched and invalid", () => {
-        expect(untouchedGoodResult.error).toBeFalsy
-        expect(untouchedBadResult.error).toBeFalsy
-        expect(touchedGoodResult.error).toBeFalsy
-        expect(touchedBadResult.error).toBeTruthy
-      })
+        expect(untouchedGoodResult.error).toBeFalsy;
+        expect(untouchedBadResult.error).toBeFalsy;
+        expect(touchedGoodResult.error).toBeFalsy;
+        expect(touchedBadResult.error).toBeTruthy;
+      });
       it("sets helperText to the error message if touched and invalid", () => {
-        expect(untouchedGoodResult.helperText).toBeUndefined
-        expect(untouchedBadResult.helperText).toBeUndefined
-        expect(touchedGoodResult.helperText).toBeUndefined
-        expect(touchedBadResult.helperText).toEqual("oops!")
-      })
-    })
+        expect(untouchedGoodResult.helperText).toBeUndefined;
+        expect(untouchedBadResult.helperText).toBeUndefined;
+        expect(touchedGoodResult.helperText).toBeUndefined;
+        expect(touchedBadResult.helperText).toEqual("oops!");
+      });
+    });
     describe("with API errors", () => {
       it("shows an error if there is only an API error", () => {
         const getFieldHelpers = getFormHelpers<TestType>(
@@ -80,17 +80,17 @@ describe("form util functions", () => {
               },
             ],
           }),
-        )
-        const result = getFieldHelpers("touchedGoodField")
-        expect(result.error).toBeTruthy()
-        expect(result.helperText).toEqual("API error!")
-      })
+        );
+        const result = getFieldHelpers("touchedGoodField");
+        expect(result.error).toBeTruthy();
+        expect(result.helperText).toEqual("API error!");
+      });
       it("shows an error if there is only a validation error", () => {
-        const getFieldHelpers = getFormHelpers<TestType>(form, {})
-        const result = getFieldHelpers("touchedBadField")
-        expect(result.error).toBeTruthy()
-        expect(result.helperText).toEqual("oops!")
-      })
+        const getFieldHelpers = getFormHelpers<TestType>(form, {});
+        const result = getFieldHelpers("touchedBadField");
+        expect(result.error).toBeTruthy();
+        expect(result.helperText).toEqual("oops!");
+      });
       it("shows the API error if both are present", () => {
         const getFieldHelpers = getFormHelpers<TestType>(
           form,
@@ -102,57 +102,57 @@ describe("form util functions", () => {
               },
             ],
           }),
-        )
-        const result = getFieldHelpers("touchedBadField")
-        expect(result.error).toBeTruthy()
-        expect(result.helperText).toEqual("API error!")
-      })
-    })
-  })
+        );
+        const result = getFieldHelpers("touchedBadField");
+        expect(result.error).toBeTruthy();
+        expect(result.helperText).toEqual("API error!");
+      });
+    });
+  });
 
   describe("onChangeTrimmed", () => {
     it("calls handleChange with trimmed value", () => {
       const event = {
         target: { value: " hello " },
-      } as React.ChangeEvent<HTMLInputElement>
-      onChangeTrimmed<TestType>(form)(event)
+      } as React.ChangeEvent<HTMLInputElement>;
+      onChangeTrimmed<TestType>(form)(event);
       expect(mockHandleChange).toHaveBeenCalledWith({
         target: { value: "hello" },
-      })
-    })
-  })
+      });
+    });
+  });
 
   describe("nameValidator", () => {
     it("allows a 1-letter name", () => {
-      const validate = () => nameSchema.validateSync("a")
-      expect(validate).not.toThrow()
-    })
+      const validate = () => nameSchema.validateSync("a");
+      expect(validate).not.toThrow();
+    });
 
     it("allows a 32-letter name", () => {
-      const input = Array(32).fill("a").join("")
-      const validate = () => nameSchema.validateSync(input)
-      expect(validate).not.toThrow()
-    })
+      const input = Array(32).fill("a").join("");
+      const validate = () => nameSchema.validateSync(input);
+      expect(validate).not.toThrow();
+    });
 
     it("allows 'test-3' to be used as name", () => {
-      const validate = () => nameSchema.validateSync("test-3")
-      expect(validate).not.toThrow()
-    })
+      const validate = () => nameSchema.validateSync("test-3");
+      expect(validate).not.toThrow();
+    });
 
     it("allows '3-test' to be used as a name", () => {
-      const validate = () => nameSchema.validateSync("3-test")
-      expect(validate).not.toThrow()
-    })
+      const validate = () => nameSchema.validateSync("3-test");
+      expect(validate).not.toThrow();
+    });
 
     it("disallows a 33-letter name", () => {
-      const input = Array(33).fill("a").join("")
-      const validate = () => nameSchema.validateSync(input)
-      expect(validate).toThrow()
-    })
+      const input = Array(33).fill("a").join("");
+      const validate = () => nameSchema.validateSync(input);
+      expect(validate).toThrow();
+    });
 
     it("disallows a space", () => {
-      const validate = () => nameSchema.validateSync("test 3")
-      expect(validate).toThrow()
-    })
-  })
-})
+      const validate = () => nameSchema.validateSync("test 3");
+      expect(validate).toThrow();
+    });
+  });
+});
diff --git a/site/src/utils/formUtils.ts b/site/src/utils/formUtils.ts
index 828f6ed103be7..1de43b825c14b 100644
--- a/site/src/utils/formUtils.ts
+++ b/site/src/utils/formUtils.ts
@@ -1,36 +1,36 @@
-import { isApiValidationError, mapApiErrorToFieldErrors } from "api/errors"
-import { FormikContextType, FormikErrors, getIn } from "formik"
+import { isApiValidationError, mapApiErrorToFieldErrors } from "api/errors";
+import { FormikContextType, FormikErrors, getIn } from "formik";
 import {
   ChangeEvent,
   ChangeEventHandler,
   FocusEventHandler,
   ReactNode,
-} from "react"
-import * as Yup from "yup"
+} from "react";
+import * as Yup from "yup";
 
 const Language = {
   nameRequired: (name: string): string => {
-    return name ? `Please enter a ${name.toLowerCase()}.` : "Required"
+    return name ? `Please enter a ${name.toLowerCase()}.` : "Required";
   },
   nameInvalidChars: (name: string): string => {
-    return `${name} must start with a-Z or 0-9 and can contain a-Z, 0-9 or -`
+    return `${name} must start with a-Z or 0-9 and can contain a-Z, 0-9 or -`;
   },
   nameTooLong: (name: string, len: number): string => {
-    return `${name} cannot be longer than ${len} characters`
+    return `${name} cannot be longer than ${len} characters`;
   },
   templateDisplayNameInvalidChars: (name: string): string => {
-    return `${name} must start and end with non-whitespace character`
+    return `${name} must start and end with non-whitespace character`;
   },
-}
+};
 
 interface FormHelpers {
-  name: string
-  onBlur: FocusEventHandler
-  onChange: ChangeEventHandler
-  id: string
-  value?: string | number
-  error: boolean
-  helperText?: ReactNode
+  name: string;
+  onBlur: FocusEventHandler;
+  onChange: ChangeEventHandler;
+  id: string;
+  value?: string | number;
+  error: boolean;
+  helperText?: ReactNode;
 }
 
 export const getFormHelpers =
@@ -45,44 +45,44 @@ export const getFormHelpers =
       ? (mapApiErrorToFieldErrors(
           error.response.data,
         ) as FormikErrors<TFormValues> & { [key: string]: string })
-      : undefined
+      : undefined;
     // Since the fieldName can be a path string like parameters[0].value we need to use getIn
-    const touched = Boolean(getIn(form.touched, fieldName.toString()))
-    const formError = getIn(form.errors, fieldName.toString())
+    const touched = Boolean(getIn(form.touched, fieldName.toString()));
+    const formError = getIn(form.errors, fieldName.toString());
     // Since the field in the form can be diff from the backend, we need to
     // check for both when getting the error
-    const apiField = backendFieldName ?? fieldName
-    const apiError = apiValidationErrors?.[apiField.toString()]
-    const errorToDisplay = apiError ?? formError
+    const apiField = backendFieldName ?? fieldName;
+    const apiError = apiValidationErrors?.[apiField.toString()];
+    const errorToDisplay = apiError ?? formError;
 
     return {
       ...form.getFieldProps(fieldName),
       id: fieldName.toString(),
       error: touched && Boolean(errorToDisplay),
       helperText: touched ? errorToDisplay ?? helperText : helperText,
-    }
-  }
+    };
+  };
 
 export const onChangeTrimmed =
-  <T>(form: FormikContextType<T>, callback?: () => void) =>
+  <T>(form: FormikContextType<T>, callback?: (value: string) => void) =>
   (event: ChangeEvent<HTMLInputElement>): void => {
-    event.target.value = event.target.value.trim()
-    form.handleChange(event)
-    callback && callback()
-  }
+    event.target.value = event.target.value.trim();
+    form.handleChange(event);
+    callback?.(event.target.value);
+  };
 
 // REMARK: Keep these consts in sync with coderd/httpapi/httpapi.go
-const maxLenName = 32
-const templateDisplayNameMaxLength = 64
-const usernameRE = /^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$/
-const templateDisplayNameRE = /^[^\s](.*[^\s])?$/
+const maxLenName = 32;
+const templateDisplayNameMaxLength = 64;
+const usernameRE = /^[a-zA-Z0-9]+(?:-[a-zA-Z0-9]+)*$/;
+const templateDisplayNameRE = /^[^\s](.*[^\s])?$/;
 
 // REMARK: see #1756 for name/username semantics
 export const nameValidator = (name: string): Yup.StringSchema =>
   Yup.string()
     .required(Language.nameRequired(name))
     .matches(usernameRE, Language.nameInvalidChars(name))
-    .max(maxLenName, Language.nameTooLong(name, maxLenName))
+    .max(maxLenName, Language.nameTooLong(name, maxLenName));
 
 export const templateDisplayNameValidator = (
   displayName: string,
@@ -96,6 +96,6 @@ export const templateDisplayNameValidator = (
       templateDisplayNameMaxLength,
       Language.nameTooLong(displayName, templateDisplayNameMaxLength),
     )
-    .optional()
+    .optional();
 
-export const iconValidator = Yup.string().label("Icon").max(256)
+export const iconValidator = Yup.string().label("Icon").max(256);
diff --git a/site/src/utils/gitAuth.ts b/site/src/utils/gitAuth.ts
deleted file mode 100644
index 11a15668f1bc0..0000000000000
--- a/site/src/utils/gitAuth.ts
+++ /dev/null
@@ -1 +0,0 @@
-export const REFRESH_GITAUTH_BROADCAST_CHANNEL = "gitauth_refresh"
diff --git a/site/src/utils/groups.ts b/site/src/utils/groups.ts
index 9afc048ce7cef..a5321d6e614f8 100644
--- a/site/src/utils/groups.ts
+++ b/site/src/utils/groups.ts
@@ -1,28 +1,30 @@
-import { Group } from "api/typesGenerated"
+import { Group } from "api/typesGenerated";
 
-export const everyOneGroup = (organizationId: string): Group => ({
-  id: organizationId,
-  name: "Everyone",
-  display_name: "",
-  organization_id: organizationId,
-  members: [],
-  avatar_url: "",
-  quota_allowance: 0,
-})
+/**
+ * Returns true if the provided group is the 'Everyone' group.
+ * The everyone group represents all the users in an organization
+ * for which every organization member is implicitly a member of.
+ *
+ * @param {Group} group - The group to evaluate.
+ * @returns {boolean} - Returns true if the group's ID matches its
+ * organization ID.
+ */
+export const isEveryoneGroup = (group: Group): boolean =>
+  group.id === group.organization_id;
 
 export const getGroupSubtitle = (group: Group): string => {
   // It is the everyone group when a group id is the same of the org id
   if (group.id === group.organization_id) {
-    return `All users`
+    return `All users`;
   }
 
   if (!group.members) {
-    return `0 members`
+    return `0 members`;
   }
 
   if (group.members.length === 1) {
-    return `1 member`
+    return `1 member`;
   }
 
-  return `${group.members.length} members`
-}
+  return `${group.members.length} members`;
+};
diff --git a/site/src/utils/latency.ts b/site/src/utils/latency.ts
index 1767742d4defc..0a7f45d551cf3 100644
--- a/site/src/utils/latency.ts
+++ b/site/src/utils/latency.ts
@@ -1,16 +1,16 @@
-import { Theme } from "@mui/material/styles"
+import { Theme } from "@mui/material/styles";
 
 export const getLatencyColor = (theme: Theme, latency?: number) => {
   if (!latency) {
-    return theme.palette.text.secondary
+    return theme.palette.text.secondary;
   }
 
-  let color = theme.palette.success.light
+  let color = theme.palette.success.light;
 
   if (latency >= 150 && latency < 300) {
-    color = theme.palette.warning.light
+    color = theme.palette.warning.light;
   } else if (latency >= 300) {
-    color = theme.palette.error.light
+    color = theme.palette.error.light;
   }
-  return color
-}
+  return color;
+};
diff --git a/site/src/utils/metadata.ts b/site/src/utils/metadata.ts
new file mode 100644
index 0000000000000..8b05747579746
--- /dev/null
+++ b/site/src/utils/metadata.ts
@@ -0,0 +1,24 @@
+export const getMetadataAsJSON = <T extends NonNullable<unknown>>(
+  property: string,
+): T | undefined => {
+  const appearance = document.querySelector(`meta[property=${property}]`);
+
+  if (appearance) {
+    const rawContent = appearance.getAttribute("content");
+
+    if (rawContent) {
+      try {
+        return JSON.parse(rawContent);
+      } catch (err) {
+        // In development, the metadata is always going to be empty; error is
+        // only a concern for production
+        if (process.env.NODE_ENV === "production") {
+          console.warn(`Failed to parse ${property} metadata. Error message:`);
+          console.warn(err);
+        }
+      }
+    }
+  }
+
+  return undefined;
+};
diff --git a/site/src/utils/nullable.ts b/site/src/utils/nullable.ts
index dda3b129e80c6..6a9361e5034f5 100644
--- a/site/src/utils/nullable.ts
+++ b/site/src/utils/nullable.ts
@@ -2,4 +2,4 @@
  * A Nullable may be its concrete type, `null` or `undefined`
  * @remark Exact opposite of the native TS type NonNullable<T>
  */
-export type Nullable<T> = null | undefined | T
+export type Nullable<T> = null | undefined | T;
diff --git a/site/src/utils/page.ts b/site/src/utils/page.ts
index 96f67e85968f9..965d27e0d712c 100644
--- a/site/src/utils/page.ts
+++ b/site/src/utils/page.ts
@@ -1,4 +1,4 @@
 export const pageTitle = (prefix: string | string[]): string => {
-  const title = Array.isArray(prefix) ? prefix.join(" · ") : prefix
-  return `${title} - Coder`
-}
+  const title = Array.isArray(prefix) ? prefix.join(" · ") : prefix;
+  return `${title} - Coder`;
+};
diff --git a/site/src/utils/portForward.ts b/site/src/utils/portForward.ts
new file mode 100644
index 0000000000000..6d2dc4cbefeb7
--- /dev/null
+++ b/site/src/utils/portForward.ts
@@ -0,0 +1,64 @@
+export const portForwardURL = (
+  host: string,
+  port: number,
+  agentName: string,
+  workspaceName: string,
+  username: string,
+): string => {
+  const { location } = window;
+
+  const subdomain = `${
+    isNaN(port) ? 3000 : port
+  }--${agentName}--${workspaceName}--${username}`;
+  return `${location.protocol}//${host}`.replace("*", subdomain);
+};
+
+// openMaybePortForwardedURL tries to open the provided URI through the
+// port-forwarded URL if it is localhost, otherwise opens it normally.
+export const openMaybePortForwardedURL = (
+  uri: string,
+  proxyHost?: string,
+  agentName?: string,
+  workspaceName?: string,
+  username?: string,
+) => {
+  const open = (uri: string) => {
+    // Copied from: https://github.com/xtermjs/xterm.js/blob/master/addons/xterm-addon-web-links/src/WebLinksAddon.ts#L23
+    const newWindow = window.open();
+    if (newWindow) {
+      try {
+        newWindow.opener = null;
+      } catch {
+        // no-op, Electron can throw
+      }
+      newWindow.location.href = uri;
+    } else {
+      console.warn("Opening link blocked as opener could not be cleared");
+    }
+  };
+
+  if (!agentName || !workspaceName || !username || !proxyHost) {
+    open(uri);
+    return;
+  }
+
+  try {
+    const url = new URL(uri);
+    const localHosts = ["0.0.0.0", "127.0.0.1", "localhost"];
+    if (!localHosts.includes(url.hostname)) {
+      open(uri);
+      return;
+    }
+    open(
+      portForwardURL(
+        proxyHost,
+        parseInt(url.port),
+        agentName,
+        workspaceName,
+        username,
+      ) + url.pathname,
+    );
+  } catch (ex) {
+    open(uri);
+  }
+};
diff --git a/site/src/utils/random.ts b/site/src/utils/random.ts
index e4d51da67b360..7db0d8fe02435 100644
--- a/site/src/utils/random.ts
+++ b/site/src/utils/random.ts
@@ -7,13 +7,13 @@
  * @see <https://developer.mozilla.org/en-US/docs/Glossary/Base64#encoded_size_increase>
  */
 export const generateRandomString = (bytes: number): string => {
-  const byteArr = window.crypto.getRandomValues(new Uint8Array(bytes))
+  const byteArr = window.crypto.getRandomValues(new Uint8Array(bytes));
   // The types for `map` don't seem to support mapping from one array type to
   // another and `String.fromCharCode.apply` wants `number[]` so loop like this
   // instead.
-  const strArr: string[] = []
+  const strArr: string[] = [];
   for (const byte of byteArr) {
-    strArr.push(String.fromCharCode(byte))
+    strArr.push(String.fromCharCode(byte));
   }
-  return btoa(strArr.join(""))
-}
+  return btoa(strArr.join(""));
+};
diff --git a/site/src/utils/redirect.test.ts b/site/src/utils/redirect.test.ts
index c4be13828680f..77ad787d5a81b 100644
--- a/site/src/utils/redirect.test.ts
+++ b/site/src/utils/redirect.test.ts
@@ -1,20 +1,20 @@
-import { embedRedirect, retrieveRedirect } from "./redirect"
+import { embedRedirect, retrieveRedirect } from "./redirect";
 
 describe("redirect helper functions", () => {
   describe("embedRedirect", () => {
     it("embeds the page to return to in the URL", () => {
-      const result = embedRedirect("/workspaces", "/page")
-      expect(result).toEqual("/page?redirect=%2Fworkspaces")
-    })
+      const result = embedRedirect("/workspaces", "/page");
+      expect(result).toEqual("/page?redirect=%2Fworkspaces");
+    });
     it("defaults to navigating to the login page", () => {
-      const result = embedRedirect("/workspaces")
-      expect(result).toEqual("/login?redirect=%2Fworkspaces")
-    })
-  })
+      const result = embedRedirect("/workspaces");
+      expect(result).toEqual("/login?redirect=%2Fworkspaces");
+    });
+  });
   describe("retrieveRedirect", () => {
     it("retrieves the page to return to from the URL", () => {
-      const result = retrieveRedirect("?redirect=%2Fworkspaces")
-      expect(result).toEqual("/workspaces")
-    })
-  })
-})
+      const result = retrieveRedirect("?redirect=%2Fworkspaces");
+      expect(result).toEqual("/workspaces");
+    });
+  });
+});
diff --git a/site/src/utils/redirect.ts b/site/src/utils/redirect.ts
index 6bee5afe53850..efaf0f3738364 100644
--- a/site/src/utils/redirect.ts
+++ b/site/src/utils/redirect.ts
@@ -8,7 +8,7 @@
 export const embedRedirect = (
   returnTo: string,
   navigateTo = "/login",
-): string => `${navigateTo}?redirect=${encodeURIComponent(returnTo)}`
+): string => `${navigateTo}?redirect=${encodeURIComponent(returnTo)}`;
 
 /**
  * Retrieves a url from the query string of the current URL
@@ -16,8 +16,8 @@ export const embedRedirect = (
  * @returns the URL to redirect to
  */
 export const retrieveRedirect = (search: string): string => {
-  const defaultRedirect = "/"
-  const searchParams = new URLSearchParams(search)
-  const redirect = searchParams.get("redirect")
-  return redirect ? redirect : defaultRedirect
-}
+  const defaultRedirect = "/";
+  const searchParams = new URLSearchParams(search);
+  const redirect = searchParams.get("redirect");
+  return redirect ? redirect : defaultRedirect;
+};
diff --git a/site/src/utils/richParameters.test.ts b/site/src/utils/richParameters.test.ts
index 66ccb3ac6b068..d2a0bdc7a2ae8 100644
--- a/site/src/utils/richParameters.test.ts
+++ b/site/src/utils/richParameters.test.ts
@@ -1,7 +1,7 @@
-import { TemplateVersionParameter } from "api/typesGenerated"
-import { selectInitialRichParametersValues } from "./richParameters"
+import { TemplateVersionParameter } from "api/typesGenerated";
+import { getInitialRichParameterValues } from "./richParameters";
 
-test("selectInitialRichParametersValues return default value when default build parameter is not valid", () => {
+test("getInitialRichParameterValues return default value when default build parameter is not valid", () => {
   const templateParameters: TemplateVersionParameter[] = [
     {
       name: "cpu",
@@ -41,13 +41,13 @@ test("selectInitialRichParametersValues return default value when default build
       required: false,
       ephemeral: false,
     },
-  ]
+  ];
 
-  const cpuParameter = templateParameters[0]
-  const [cpuParameterInitialValue] = selectInitialRichParametersValues(
+  const cpuParameter = templateParameters[0];
+  const [cpuParameterInitialValue] = getInitialRichParameterValues(
     templateParameters,
     [{ name: cpuParameter.name, value: "100" }],
-  )
+  );
 
-  expect(cpuParameterInitialValue.value).toBe(cpuParameter.default_value)
-})
+  expect(cpuParameterInitialValue.value).toBe(cpuParameter.default_value);
+});
diff --git a/site/src/utils/richParameters.ts b/site/src/utils/richParameters.ts
index 6fac6c33f25f4..d63da7c4ee530 100644
--- a/site/src/utils/richParameters.ts
+++ b/site/src/utils/richParameters.ts
@@ -1,80 +1,49 @@
 import {
   TemplateVersionParameter,
   WorkspaceBuildParameter,
-} from "api/typesGenerated"
-import { useTranslation } from "react-i18next"
-import * as Yup from "yup"
+} from "api/typesGenerated";
+import * as Yup from "yup";
 
-export const selectInitialRichParametersValues = (
-  templateParameters?: TemplateVersionParameter[],
-  defaultBuildParameters?: WorkspaceBuildParameter[],
+export const getInitialRichParameterValues = (
+  templateParameters: TemplateVersionParameter[],
+  buildParameters?: WorkspaceBuildParameter[],
 ): WorkspaceBuildParameter[] => {
-  const defaults: WorkspaceBuildParameter[] = []
-  if (!templateParameters) {
-    return defaults
-  }
-
-  templateParameters.forEach((parameter) => {
-    let parameterValue = parameter.default_value
-
-    if (parameter.options.length > 0) {
-      parameterValue = parameterValue ?? parameter.options[0].value
-      const validValues = parameter.options.map((option) => option.value)
-
-      if (defaultBuildParameters) {
-        const defaultBuildParameter = defaultBuildParameters.find(
-          (p) => p.name === parameter.name,
-        )
-
-        // We don't want invalid values from default parameters to be set
-        if (
-          defaultBuildParameter &&
-          validValues.includes(defaultBuildParameter.value)
-        ) {
-          parameterValue = defaultBuildParameter?.value
-        }
-      }
-
-      const buildParameter: WorkspaceBuildParameter = {
+  return templateParameters.map((parameter) => {
+    const existentBuildParameter = buildParameters?.find(
+      (p) => p.name === parameter.name,
+    );
+    const shouldReturnTheDefaultValue =
+      !existentBuildParameter ||
+      !isValidValue(parameter, existentBuildParameter) ||
+      parameter.ephemeral;
+    if (shouldReturnTheDefaultValue) {
+      return {
         name: parameter.name,
-        value: parameterValue,
-      }
-      defaults.push(buildParameter)
-      return
-    }
-
-    if (parameter.ephemeral) {
-      parameterValue = parameter.default_value
+        value: parameter.default_value,
+      };
     }
+    return existentBuildParameter;
+  });
+};
 
-    if (defaultBuildParameters) {
-      const buildParameter = defaultBuildParameters.find(
-        (p) => p.name === parameter.name,
-      )
-
-      if (buildParameter) {
-        parameterValue = buildParameter?.value
-      }
-    }
+const isValidValue = (
+  templateParam: TemplateVersionParameter,
+  buildParam: WorkspaceBuildParameter,
+) => {
+  if (templateParam.options.length > 0) {
+    const validValues = templateParam.options.map((option) => option.value);
+    return validValues.includes(buildParam.value);
+  }
 
-    const buildParameter: WorkspaceBuildParameter = {
-      name: parameter.name,
-      value: parameterValue || "",
-    }
-    defaults.push(buildParameter)
-  })
-  return defaults
-}
+  return true;
+};
 
 export const useValidationSchemaForRichParameters = (
-  ns: string,
   templateParameters?: TemplateVersionParameter[],
   lastBuildParameters?: WorkspaceBuildParameter[],
 ): Yup.AnySchema => {
-  const { t } = useTranslation(ns)
-
   if (!templateParameters) {
-    return Yup.object()
+    return Yup.object();
   }
 
   return Yup.array()
@@ -82,10 +51,10 @@ export const useValidationSchemaForRichParameters = (
       Yup.object().shape({
         name: Yup.string().required(),
         value: Yup.string().test("verify with template", (val, ctx) => {
-          const name = ctx.parent.name
+          const name = ctx.parent.name;
           const templateParameter = templateParameters.find(
             (parameter) => parameter.name === name,
-          )
+          );
           if (templateParameter) {
             switch (templateParameter.type) {
               case "number":
@@ -96,10 +65,8 @@ export const useValidationSchemaForRichParameters = (
                   if (Number(val) < templateParameter.validation_min) {
                     return ctx.createError({
                       path: ctx.path,
-                      message: t("validationNumberLesserThan", {
-                        min: templateParameter.validation_min,
-                      }).toString(),
-                    })
+                      message: `Value must be greater than ${templateParameter.validation_min}.`,
+                    });
                   }
                 } else if (
                   !templateParameter.validation_min &&
@@ -108,10 +75,8 @@ export const useValidationSchemaForRichParameters = (
                   if (templateParameter.validation_max < Number(val)) {
                     return ctx.createError({
                       path: ctx.path,
-                      message: t("validationNumberGreaterThan", {
-                        max: templateParameter.validation_max,
-                      }).toString(),
-                    })
+                      message: `Value must be lesser than ${templateParameter.validation_max}.`,
+                    });
                   }
                 } else if (
                   templateParameter.validation_min &&
@@ -123,11 +88,8 @@ export const useValidationSchemaForRichParameters = (
                   ) {
                     return ctx.createError({
                       path: ctx.path,
-                      message: t("validationNumberNotInRange", {
-                        min: templateParameter.validation_min,
-                        max: templateParameter.validation_max,
-                      }).toString(),
-                    })
+                      message: `Value must be between ${templateParameter.validation_min} and ${templateParameter.validation_max}.`,
+                    });
                   }
                 }
 
@@ -137,87 +99,52 @@ export const useValidationSchemaForRichParameters = (
                 ) {
                   const lastBuildParameter = lastBuildParameters.find(
                     (last) => last.name === name,
-                  )
+                  );
                   if (lastBuildParameter) {
                     switch (templateParameter.validation_monotonic) {
                       case "increasing":
                         if (Number(lastBuildParameter.value) > Number(val)) {
                           return ctx.createError({
                             path: ctx.path,
-                            message: t("validationNumberNotIncreasing", {
-                              last: lastBuildParameter.value,
-                            }).toString(),
-                          })
+                            message: `Value must only ever increase (last value was ${lastBuildParameter.value})`,
+                          });
                         }
-                        break
+                        break;
                       case "decreasing":
                         if (Number(lastBuildParameter.value) < Number(val)) {
                           return ctx.createError({
                             path: ctx.path,
-                            message: t("validationNumberNotDecreasing", {
-                              last: lastBuildParameter.value,
-                            }).toString(),
-                          })
+                            message: `Value must only ever decrease (last value was ${lastBuildParameter.value})`,
+                          });
                         }
-                        break
+                        break;
                     }
                   }
                 }
-                break
+                break;
               case "string":
                 {
                   if (
                     !templateParameter.validation_regex ||
                     templateParameter.validation_regex.length === 0
                   ) {
-                    return true
+                    return true;
                   }
 
-                  const regex = new RegExp(templateParameter.validation_regex)
+                  const regex = new RegExp(templateParameter.validation_regex);
                   if (val && !regex.test(val)) {
                     return ctx.createError({
                       path: ctx.path,
-                      message: t("validationPatternNotMatched", {
-                        error: templateParameter.validation_error,
-                        pattern: templateParameter.validation_regex,
-                      }).toString(),
-                    })
+                      message: `${templateParameter.validation_error} (value does not match the pattern ${templateParameter.validation_regex})`,
+                    });
                   }
                 }
-                break
+                break;
             }
           }
-          return true
+          return true;
         }),
       }),
     )
-    .required()
-}
-
-export const workspaceBuildParameterValue = (
-  workspaceBuildParameters: WorkspaceBuildParameter[],
-  parameter: TemplateVersionParameter,
-): string => {
-  const buildParameter = workspaceBuildParameters.find((buildParameter) => {
-    return buildParameter.name === parameter.name
-  })
-  return (buildParameter && buildParameter.value) || ""
-}
-
-export const getInitialParameterValues = (
-  templateParameters: TemplateVersionParameter[],
-  buildParameters: WorkspaceBuildParameter[],
-) => {
-  return templateParameters.map((parameter) => {
-    const buildParameter = buildParameters.find(
-      (p) => p.name === parameter.name,
-    )
-    if (!buildParameter || parameter.ephemeral) {
-      return {
-        name: parameter.name,
-        value: parameter.default_value,
-      }
-    }
-    return buildParameter
-  })
-}
+    .required();
+};
diff --git a/site/src/utils/schedule.test.ts b/site/src/utils/schedule.test.ts
index 29d8aec1912f3..154fc4b0e7c24 100644
--- a/site/src/utils/schedule.test.ts
+++ b/site/src/utils/schedule.test.ts
@@ -1,9 +1,7 @@
-import dayjs from "dayjs"
-import duration from "dayjs/plugin/duration"
-import { emptySchedule } from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule"
-import { emptyTTL } from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/ttl"
-import { Workspace } from "../api/typesGenerated"
-import * as Mocks from "../testHelpers/entities"
+import dayjs from "dayjs";
+import duration from "dayjs/plugin/duration";
+import { Workspace } from "api/typesGenerated";
+import * as Mocks from "testHelpers/entities";
 import {
   deadlineExtensionMax,
   deadlineExtensionMin,
@@ -12,12 +10,12 @@ import {
   getMaxDeadlineChange,
   getMinDeadline,
   stripTimezone,
-  scheduleChanged,
-} from "./schedule"
+  quietHoursDisplay,
+} from "./schedule";
 
-dayjs.extend(duration)
-const now = dayjs()
-const startTime = dayjs(Mocks.MockWorkspaceBuild.updated_at)
+dayjs.extend(duration);
+const now = dayjs();
+const startTime = dayjs(Mocks.MockWorkspaceBuild.updated_at);
 
 describe("util/schedule", () => {
   describe("stripTimezone", () => {
@@ -26,9 +24,9 @@ describe("util/schedule", () => {
       ["CRON_TZ=America/Central 0 8 1,2,4,5", "0 8 1,2,4,5"],
       ["30 9 1-5", "30 9 1-5"],
     ])(`stripTimezone(%p) returns %p`, (input, expected) => {
-      expect(stripTimezone(input)).toBe(expected)
-    })
-  })
+      expect(stripTimezone(input)).toBe(expected);
+    });
+  });
 
   describe("extractTimezone", () => {
     it.each<[string, string]>([
@@ -36,112 +34,56 @@ describe("util/schedule", () => {
       ["CRON_TZ=America/Central 0 8 1,2,4,5", "America/Central"],
       ["30 9 1-5", "UTC"],
     ])(`extractTimezone(%p) returns %p`, (input, expected) => {
-      expect(extractTimezone(input)).toBe(expected)
-    })
-  })
-})
+      expect(extractTimezone(input)).toBe(expected);
+    });
+  });
 
-describe("maxDeadline", () => {
-  const workspace: Workspace = {
-    ...Mocks.MockWorkspace,
-    latest_build: {
-      ...Mocks.MockWorkspaceBuild,
-      deadline: startTime.add(8, "hours").utc().format(),
-    },
-  }
-  it("should be 24 hours from the workspace start time", () => {
-    const delta = getMaxDeadline(workspace).diff(startTime)
-    expect(delta).toEqual(deadlineExtensionMax.asMilliseconds())
-  })
-})
+  describe("maxDeadline", () => {
+    const workspace: Workspace = {
+      ...Mocks.MockWorkspace,
+      latest_build: {
+        ...Mocks.MockWorkspaceBuild,
+        deadline: startTime.add(8, "hours").utc().format(),
+      },
+    };
+    it("should be 24 hours from the workspace start time", () => {
+      const delta = getMaxDeadline(workspace).diff(startTime);
+      expect(delta).toEqual(deadlineExtensionMax.asMilliseconds());
+    });
+  });
 
-describe("minDeadline", () => {
-  it("should never be less than 30 minutes", () => {
-    const delta = getMinDeadline().diff(now)
-    expect(delta).toBeGreaterThanOrEqual(deadlineExtensionMin.asMilliseconds())
-  })
-})
+  describe("minDeadline", () => {
+    it("should never be less than 30 minutes", () => {
+      const delta = getMinDeadline().diff(now);
+      expect(delta).toBeGreaterThanOrEqual(
+        deadlineExtensionMin.asMilliseconds(),
+      );
+    });
+  });
 
-describe("getMaxDeadlineChange", () => {
-  it("should return the number of hours you can add before hitting the max deadline", () => {
-    const deadline = dayjs()
-    const maxDeadline = dayjs().add(1, "hour").add(40, "minutes")
-    // you can only add one hour even though the max is 1:40 away
-    expect(getMaxDeadlineChange(deadline, maxDeadline)).toEqual(1)
-  })
+  describe("getMaxDeadlineChange", () => {
+    it("should return the number of hours you can add before hitting the max deadline", () => {
+      const deadline = dayjs();
+      const maxDeadline = dayjs().add(1, "hour").add(40, "minutes");
+      // you can only add one hour even though the max is 1:40 away
+      expect(getMaxDeadlineChange(deadline, maxDeadline)).toEqual(1);
+    });
 
-  it("should return the number of hours you can subtract before hitting the min deadline", () => {
-    const deadline = dayjs().add(2, "hours").add(40, "minutes")
-    const minDeadline = dayjs()
-    // you can only subtract 2 hours even though the min is 2:40 less
-    expect(getMaxDeadlineChange(deadline, minDeadline)).toEqual(2)
-  })
-})
+    it("should return the number of hours you can subtract before hitting the min deadline", () => {
+      const deadline = dayjs().add(2, "hours").add(40, "minutes");
+      const minDeadline = dayjs();
+      // you can only subtract 2 hours even though the min is 2:40 less
+      expect(getMaxDeadlineChange(deadline, minDeadline)).toEqual(2);
+    });
+  });
 
-describe("scheduleChanged", () => {
-  describe("autostart", () => {
-    it("should be true if toggle values are different", () => {
-      const autostart = { autostartEnabled: true, ...emptySchedule }
-      const formValues = {
-        autostartEnabled: false,
-        ...emptySchedule,
-        autostopEnabled: false,
-        ttl: emptyTTL,
-      }
-      expect(scheduleChanged(autostart, formValues)).toBe(true)
-    })
-    it("should be true if schedule values are different", () => {
-      const autostart = { autostartEnabled: true, ...emptySchedule }
-      const formValues = {
-        autostartEnabled: true,
-        ...{ ...emptySchedule, monday: true, startTime: "09:00" },
-        autostopEnabled: false,
-        ttl: emptyTTL,
-      }
-      expect(scheduleChanged(autostart, formValues)).toBe(true)
-    })
-    it("should be false if all autostart values are the same", () => {
-      const autostart = { autostartEnabled: true, ...emptySchedule }
-      const formValues = {
-        autostartEnabled: true,
-        ...emptySchedule,
-        autostopEnabled: false,
-        ttl: emptyTTL,
-      }
-      expect(scheduleChanged(autostart, formValues)).toBe(false)
-    })
-  })
+  describe("quietHoursDisplay", () => {
+    const quietHoursStart = quietHoursDisplay(
+      "00:00",
+      "Australia/Sydney",
+      new Date("2023-09-06T15:00:00.000+10:00"),
+    );
 
-  describe("autostop", () => {
-    it("should be true if toggle values are different", () => {
-      const autostop = { autostopEnabled: true, ttl: 1000 }
-      const formValues = {
-        autostartEnabled: false,
-        ...emptySchedule,
-        autostopEnabled: false,
-        ttl: 1000,
-      }
-      expect(scheduleChanged(autostop, formValues)).toBe(true)
-    })
-    it("should be true if ttl values are different", () => {
-      const autostop = { autostopEnabled: true, ttl: 1000 }
-      const formValues = {
-        autostartEnabled: false,
-        ...emptySchedule,
-        autostopEnabled: true,
-        ttl: 2000,
-      }
-      expect(scheduleChanged(autostop, formValues)).toBe(true)
-    })
-    it("should be false if all autostop values are the same", () => {
-      const autostop = { autostopEnabled: true, ttl: 1000 }
-      const formValues = {
-        autostartEnabled: false,
-        ...emptySchedule,
-        autostopEnabled: true,
-        ttl: 1000,
-      }
-      expect(scheduleChanged(autostop, formValues)).toBe(false)
-    })
-  })
-})
+    expect(quietHoursStart).toBe("12:00AM tomorrow (in 9 hours)");
+  });
+});
diff --git a/site/src/utils/schedule.ts b/site/src/utils/schedule.ts
index 02e37516389b9..9deb11b6216a3 100644
--- a/site/src/utils/schedule.ts
+++ b/site/src/utils/schedule.ts
@@ -1,26 +1,19 @@
-import map from "lodash/map"
-import some from "lodash/some"
-import cronstrue from "cronstrue"
-import dayjs, { Dayjs } from "dayjs"
-import advancedFormat from "dayjs/plugin/advancedFormat"
-import duration from "dayjs/plugin/duration"
-import relativeTime from "dayjs/plugin/relativeTime"
-import timezone from "dayjs/plugin/timezone"
-import utc from "dayjs/plugin/utc"
-import { Workspace } from "../api/typesGenerated"
-import { isWorkspaceOn } from "./workspace"
-import { WorkspaceScheduleFormValues } from "components/WorkspaceScheduleForm/WorkspaceScheduleForm"
-import { Autostop } from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/ttl"
-import { Autostart } from "pages/WorkspaceSettingsPage/WorkspaceSchedulePage/schedule"
+import cronstrue from "cronstrue";
+import dayjs, { Dayjs } from "dayjs";
+import duration from "dayjs/plugin/duration";
+import relativeTime from "dayjs/plugin/relativeTime";
+import timezone from "dayjs/plugin/timezone";
+import utc from "dayjs/plugin/utc";
+import { Template, Workspace } from "api/typesGenerated";
+import { isWorkspaceOn } from "./workspace";
+import cronParser from "cron-parser";
 
 // REMARK: some plugins depend on utc, so it's listed first. Otherwise they're
 //         sorted alphabetically.
-dayjs.extend(utc)
-dayjs.extend(advancedFormat)
-dayjs.extend(duration)
-dayjs.extend(relativeTime)
-dayjs.extend(timezone)
-
+dayjs.extend(utc);
+dayjs.extend(duration);
+dayjs.extend(relativeTime);
+dayjs.extend(timezone);
 /**
  * @fileoverview Client-side counterpart of the coderd/autostart/schedule Go
  * package. This package is a variation on crontab that uses minute, hour and
@@ -31,14 +24,14 @@ dayjs.extend(timezone)
  * DEFAULT_TIMEZONE is the default timezone that crontab assumes unless one is
  * specified.
  */
-const DEFAULT_TIMEZONE = "UTC"
+const DEFAULT_TIMEZONE = "UTC";
 
 /**
  * stripTimezone strips a leading timezone from a schedule string
  */
 export const stripTimezone = (raw: string): string => {
-  return raw.replace(/CRON_TZ=\S*\s/, "")
-}
+  return raw.replace(/CRON_TZ=\S*\s/, "");
+};
 
 /**
  * extractTimezone returns a leading timezone from a schedule string if one is
@@ -48,14 +41,14 @@ export const extractTimezone = (
   raw: string,
   defaultTZ = DEFAULT_TIMEZONE,
 ): string => {
-  const matches = raw.match(/CRON_TZ=\S*\s/g)
+  const matches = raw.match(/CRON_TZ=\S*\s/g);
 
   if (matches && matches.length > 0) {
-    return matches[0].replace(/CRON_TZ=/, "").trim()
+    return matches[0].replace(/CRON_TZ=/, "").trim();
   } else {
-    return defaultTZ
+    return defaultTZ;
   }
-}
+};
 
 /** Language used in the schedule components */
 export const Language = {
@@ -64,7 +57,7 @@ export const Language = {
   afterStart: "after start",
   autostartLabel: "Starts at",
   autostopLabel: "Stops at",
-}
+};
 
 export const autostartDisplay = (schedule: string | undefined): string => {
   if (schedule) {
@@ -75,11 +68,11 @@ export const autostartDisplay = (schedule: string | undefined): string => {
         })
         // We don't want to keep the At because it is on the label
         .replace("At", "")
-    )
+    );
   } else {
-    return Language.manual
+    return Language.manual;
   }
-}
+};
 
 export const isShuttingDown = (
   workspace: Workspace,
@@ -87,16 +80,16 @@ export const isShuttingDown = (
 ): boolean => {
   if (!deadline) {
     if (!workspace.latest_build.deadline) {
-      return false
+      return false;
     }
-    deadline = dayjs(workspace.latest_build.deadline).utc()
+    deadline = dayjs(workspace.latest_build.deadline).utc();
   }
-  const now = dayjs().utc()
-  return isWorkspaceOn(workspace) && now.isAfter(deadline)
-}
+  const now = dayjs().utc();
+  return isWorkspaceOn(workspace) && now.isAfter(deadline);
+};
 
 export const autostopDisplay = (workspace: Workspace): string => {
-  const ttl = workspace.ttl_ms
+  const ttl = workspace.ttl_ms;
 
   if (isWorkspaceOn(workspace) && workspace.latest_build.deadline) {
     // Workspace is on --> derive from latest_build.deadline. Note that the
@@ -105,26 +98,26 @@ export const autostopDisplay = (workspace: Workspace): string => {
     // represent the previously defined ttl. Thus, we always derive from the
     // deadline as the source of truth.
 
-    const deadline = dayjs(workspace.latest_build.deadline).utc()
+    const deadline = dayjs(workspace.latest_build.deadline).utc();
     if (isShuttingDown(workspace, deadline)) {
-      return Language.workspaceShuttingDownLabel
+      return Language.workspaceShuttingDownLabel;
     } else {
-      return deadline.tz(dayjs.tz.guess()).format("MMM D, YYYY h:mm A")
+      return deadline.tz(dayjs.tz.guess()).format("MMMM D, YYYY h:mm A");
     }
   } else if (!ttl || ttl < 1) {
     // If the workspace is not on, and the ttl is 0 or undefined, then the
     // workspace is set to manually shutdown.
-    return Language.manual
+    return Language.manual;
   } else {
     // The workspace has a ttl set, but is either in an unknown state or is
     // not running. Therefore, we derive from workspace.ttl.
-    const duration = dayjs.duration(ttl, "milliseconds")
-    return `${duration.humanize()} ${Language.afterStart}`
+    const duration = dayjs.duration(ttl, "milliseconds");
+    return `${duration.humanize()} ${Language.afterStart}`;
   }
-}
+};
 
-export const deadlineExtensionMin = dayjs.duration(30, "minutes")
-export const deadlineExtensionMax = dayjs.duration(24, "hours")
+export const deadlineExtensionMin = dayjs.duration(30, "minutes");
+export const deadlineExtensionMax = dayjs.duration(24, "hours");
 
 /**
  * Depends on the time the workspace was last updated and a global constant.
@@ -135,10 +128,10 @@ export function getMaxDeadline(ws: Workspace | undefined): dayjs.Dayjs {
   // note: we count runtime from updated_at as started_at counts from the start of
   // the workspace build process, which can take a while.
   if (ws === undefined) {
-    throw Error("Cannot calculate max deadline because workspace is undefined")
+    throw Error("Cannot calculate max deadline because workspace is undefined");
   }
-  const startedAt = dayjs(ws.latest_build.updated_at)
-  return startedAt.add(deadlineExtensionMax)
+  const startedAt = dayjs(ws.latest_build.updated_at);
+  return startedAt.add(deadlineExtensionMax);
 }
 
 /**
@@ -146,11 +139,11 @@ export function getMaxDeadline(ws: Workspace | undefined): dayjs.Dayjs {
  * @returns the earliest datetime at which the workspace can be automatically shut down.
  */
 export function getMinDeadline(): dayjs.Dayjs {
-  return dayjs().add(deadlineExtensionMin)
+  return dayjs().add(deadlineExtensionMin);
 }
 
 export const getDeadline = (workspace: Workspace): dayjs.Dayjs =>
-  dayjs(workspace.latest_build.deadline).utc()
+  dayjs(workspace.latest_build.deadline).utc();
 
 /**
  * Get number of hours you can add or subtract to the current deadline before hitting the max or min deadline.
@@ -161,16 +154,97 @@ export const getDeadline = (workspace: Workspace): dayjs.Dayjs =>
 export const getMaxDeadlineChange = (
   deadline: dayjs.Dayjs,
   extremeDeadline: dayjs.Dayjs,
-): number => Math.abs(deadline.diff(extremeDeadline, "hours"))
-
-export const scheduleChanged = (
-  initialValues: Autostart | Autostop,
-  formValues: WorkspaceScheduleFormValues,
-): boolean =>
-  some(
-    map(
-      { ...initialValues },
-      (v: boolean | string, k: keyof typeof initialValues) =>
-        formValues[k] !== v,
-    ),
-  )
+): number => Math.abs(deadline.diff(extremeDeadline, "hours"));
+
+export const validTime = (time: string): boolean => {
+  return /^[0-9][0-9]:[0-9][0-9]$/.test(time);
+};
+
+export const timeToCron = (time: string, tz?: string) => {
+  if (!validTime(time)) {
+    throw new Error(`Invalid time: ${time}`);
+  }
+  const [HH, mm] = time.split(":");
+  let prefix = "";
+  if (tz) {
+    prefix = `CRON_TZ=${tz} `;
+  }
+  return `${prefix}${Number(mm)} ${Number(HH)} * * *`;
+};
+
+export const quietHoursDisplay = (
+  time: string,
+  tz: string,
+  now: Date | undefined,
+): string => {
+  if (!validTime(time)) {
+    return "Invalid time";
+  }
+
+  // The cron-parser package doesn't accept a timezone in the cron string, but
+  // accepts it as an option.
+  const cron = timeToCron(time);
+  const parsed = cronParser.parseExpression(cron, {
+    currentDate: now,
+    iterator: false,
+    utc: false,
+    tz,
+  });
+
+  const today = dayjs(now).tz(tz);
+  const day = dayjs(parsed.next().toDate()).tz(tz);
+  let display = day.format("h:mmA");
+
+  if (day.isSame(today, "day")) {
+    display += " today";
+  } else if (day.isSame(today.add(1, "day"), "day")) {
+    display += " tomorrow";
+  } else {
+    // This case will rarely ever be hit, as we're dealing with only times and
+    // not dates, but it can be hit due to mismatched browser timezone to cron
+    // timezone or due to daylight savings changes.
+    display += ` on ${day.format("dddd, MMMM D")}`;
+  }
+
+  display += ` (${day.from(today)})`;
+
+  return display;
+};
+
+export type TemplateAutostartRequirementDaysValue =
+  | "monday"
+  | "tuesday"
+  | "wednesday"
+  | "thursday"
+  | "friday"
+  | "saturday"
+  | "sunday";
+
+export type TemplateAutostopRequirementDaysValue =
+  | "off"
+  | "daily"
+  | "saturday"
+  | "sunday";
+
+export const calculateAutostopRequirementDaysValue = (
+  value: TemplateAutostopRequirementDaysValue,
+): Template["autostop_requirement"]["days_of_week"] => {
+  switch (value) {
+    case "daily":
+      return [
+        "monday",
+        "tuesday",
+        "wednesday",
+        "thursday",
+        "friday",
+        "saturday",
+        "sunday",
+      ];
+    case "saturday":
+      return ["saturday"];
+    case "sunday":
+      return ["sunday"];
+  }
+
+  return [];
+};
diff --git a/site/src/utils/starterTemplates.ts b/site/src/utils/starterTemplates.ts
index 628cf21aa8a62..0caddfb9a8a07 100644
--- a/site/src/utils/starterTemplates.ts
+++ b/site/src/utils/starterTemplates.ts
@@ -1,24 +1,24 @@
-import { TemplateExample } from "api/typesGenerated"
+import { TemplateExample } from "api/typesGenerated";
 
-export type StarterTemplatesByTag = Record<string, TemplateExample[]>
+export type StarterTemplatesByTag = Record<string, TemplateExample[]>;
 
 export const getTemplatesByTag = (
   templates: TemplateExample[],
 ): StarterTemplatesByTag => {
   const tags: StarterTemplatesByTag = {
     all: templates,
-  }
+  };
 
   templates.forEach((template) => {
     template.tags.forEach((tag) => {
       // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- this can be undefined
       if (tags[tag]) {
-        tags[tag].push(template)
+        tags[tag].push(template);
       } else {
-        tags[tag] = [template]
+        tags[tag] = [template];
       }
-    })
-  })
+    });
+  });
 
-  return tags
-}
+  return tags;
+};
diff --git a/site/src/utils/tar.test.ts b/site/src/utils/tar.test.ts
index e5bdeebb0dc68..4ed8b32876aff 100644
--- a/site/src/utils/tar.test.ts
+++ b/site/src/utils/tar.test.ts
@@ -1,60 +1,60 @@
-import { TarReader, TarWriter, ITarFileInfo, TarFileTypeCodes } from "./tar"
+import { TarReader, TarWriter, ITarFileInfo, TarFileTypeCodes } from "./tar";
 
-const mtime = 1666666666666
+const mtime = 1666666666666;
 
 test("tar", async () => {
   // Write
-  const writer = new TarWriter()
-  writer.addFile("a.txt", "hello", { mtime })
-  writer.addFile("b.txt", new Blob(["world"]), { mtime })
-  writer.addFile("c.txt", "", { mtime })
-  writer.addFolder("etc", { mtime })
+  const writer = new TarWriter();
+  writer.addFile("a.txt", "hello", { mtime });
+  writer.addFile("b.txt", new Blob(["world"]), { mtime });
+  writer.addFile("c.txt", "", { mtime });
+  writer.addFolder("etc", { mtime });
   writer.addFile("etc/d.txt", "Some text content", {
     mtime,
     user: "coder",
     group: "codergroup",
     mode: parseInt("777", 8),
-  })
-  const blob = (await writer.write()) as Blob
+  });
+  const blob = (await writer.write()) as Blob;
 
   // Read
-  const reader = new TarReader()
-  const fileInfos = await reader.readFile(blob)
+  const reader = new TarReader();
+  const fileInfos = await reader.readFile(blob);
   verifyFile(fileInfos[0], reader.getTextFile(fileInfos[0].name) as string, {
     name: "a.txt",
     content: "hello",
-  })
+  });
   verifyFile(fileInfos[1], reader.getTextFile(fileInfos[1].name) as string, {
     name: "b.txt",
     content: "world",
-  })
+  });
   verifyFile(fileInfos[2], reader.getTextFile(fileInfos[2].name) as string, {
     name: "c.txt",
     content: "",
-  })
+  });
   verifyFolder(fileInfos[3], {
     name: "etc",
-  })
+  });
   verifyFile(fileInfos[4], reader.getTextFile(fileInfos[4].name) as string, {
     name: "etc/d.txt",
     content: "Some text content",
-  })
-  expect(fileInfos[4].group).toEqual("codergroup")
-  expect(fileInfos[4].user).toEqual("coder")
-  expect(fileInfos[4].mode).toEqual(parseInt("777", 8))
-})
+  });
+  expect(fileInfos[4].group).toEqual("codergroup");
+  expect(fileInfos[4].user).toEqual("coder");
+  expect(fileInfos[4].mode).toEqual(parseInt("777", 8));
+});
 
 function verifyFile(
   info: ITarFileInfo,
   content: string,
   expected: { name: string; content: string },
 ) {
-  expect(info.name).toEqual(expected.name)
-  expect(info.size).toEqual(expected.content.length)
-  expect(content).toEqual(expected.content)
+  expect(info.name).toEqual(expected.name);
+  expect(info.size).toEqual(expected.content.length);
+  expect(content).toEqual(expected.content);
 }
 
 function verifyFolder(info: ITarFileInfo, expected: { name: string }) {
-  expect(info.name).toEqual(expected.name)
-  expect(info.type).toEqual(TarFileTypeCodes.Dir)
+  expect(info.name).toEqual(expected.name);
+  expect(info.type).toEqual(TarFileTypeCodes.Dir);
 }
diff --git a/site/src/utils/tar.ts b/site/src/utils/tar.ts
index 57b59adac37b3..a243006c27420 100644
--- a/site/src/utils/tar.ts
+++ b/site/src/utils/tar.ts
@@ -1,87 +1,87 @@
 // Based on https://github.com/gera2ld/tarjs
 // and https://github.com/ankitrohatgi/tarballjs/blob/master/tarball.js
-type TarFileType = string
+type TarFileType = string;
 // Added the most common codes
 export const TarFileTypeCodes = {
   File: "0",
   Dir: "5",
-}
-const encoder = new TextEncoder()
-const utf8Encode = (input: string) => encoder.encode(input)
-const decoder = new TextDecoder()
-const utf8Decode = (input: Uint8Array) => decoder.decode(input)
+};
+const encoder = new TextEncoder();
+const utf8Encode = (input: string) => encoder.encode(input);
+const decoder = new TextDecoder();
+const utf8Decode = (input: Uint8Array) => decoder.decode(input);
 
 export interface ITarFileInfo {
-  name: string
-  type: TarFileType
-  size: number
-  mode: number
-  mtime: number
-  user: string
-  group: string
-  headerOffset: number
+  name: string;
+  type: TarFileType;
+  size: number;
+  mode: number;
+  mtime: number;
+  user: string;
+  group: string;
+  headerOffset: number;
 }
 
 export interface ITarWriteItem {
-  name: string
-  type: TarFileType
-  data: ArrayBuffer | Promise<ArrayBuffer> | null
-  size: number
-  opts?: Partial<ITarWriteOptions>
+  name: string;
+  type: TarFileType;
+  data: ArrayBuffer | Promise<ArrayBuffer> | null;
+  size: number;
+  opts?: Partial<ITarWriteOptions>;
 }
 
 export interface ITarWriteOptions {
-  uid: number
-  gid: number
-  mode: number
-  mtime: number
-  user: string
-  group: string
+  uid: number;
+  gid: number;
+  mode: number;
+  mtime: number;
+  user: string;
+  group: string;
 }
 
 export class TarReader {
-  public fileInfo: ITarFileInfo[] = []
-  private _buffer: ArrayBuffer | null = null
+  public fileInfo: ITarFileInfo[] = [];
+  private _buffer: ArrayBuffer | null = null;
 
   constructor() {
-    this.reset()
+    this.reset();
   }
 
   get buffer() {
     if (!this._buffer) {
-      throw new Error("Buffer is not set")
+      throw new Error("Buffer is not set");
     }
 
-    return this._buffer
+    return this._buffer;
   }
 
   reset() {
-    this.fileInfo = []
-    this._buffer = null
+    this.fileInfo = [];
+    this._buffer = null;
   }
 
   async readFile(file: ArrayBuffer | Uint8Array | Blob) {
-    this.reset()
-    this._buffer = await getArrayBuffer(file)
-    this.readFileInfo()
-    return this.fileInfo
+    this.reset();
+    this._buffer = await getArrayBuffer(file);
+    this.readFileInfo();
+    return this.fileInfo;
   }
 
   private readFileInfo() {
-    this.fileInfo = []
-    let offset = 0
+    this.fileInfo = [];
+    let offset = 0;
 
     while (offset < this.buffer.byteLength - 512) {
-      const fileName = this.readFileName(offset)
+      const fileName = this.readFileName(offset);
       if (!fileName) {
-        break
+        break;
       }
-      const fileType = this.readFileType(offset)
-      const fileSize = this.readFileSize(offset)
-      const fileMode = this.readFileMode(offset)
-      const fileMtime = this.readFileMtime(offset)
-      const fileUser = this.readFileUser(offset)
-      const fileGroup = this.readFileGroup(offset)
+      const fileType = this.readFileType(offset);
+      const fileSize = this.readFileSize(offset);
+      const fileMode = this.readFileMode(offset);
+      const fileMtime = this.readFileMtime(offset);
+      const fileUser = this.readFileUser(offset);
+      const fileGroup = this.readFileGroup(offset);
 
       this.fileInfo.push({
         name: fileName,
@@ -92,91 +92,91 @@ export class TarReader {
         mtime: fileMtime,
         user: fileUser,
         group: fileGroup,
-      })
+      });
 
-      offset += 512 + 512 * Math.floor((fileSize + 511) / 512)
+      offset += 512 + 512 * Math.floor((fileSize + 511) / 512);
     }
   }
 
   private readString(offset: number, maxSize: number) {
-    let size = 0
-    let view = new Uint8Array(this.buffer, offset, maxSize)
+    let size = 0;
+    let view = new Uint8Array(this.buffer, offset, maxSize);
     while (size < maxSize && view[size]) {
-      size += 1
+      size += 1;
     }
-    view = new Uint8Array(this.buffer, offset, size)
-    return utf8Decode(view)
+    view = new Uint8Array(this.buffer, offset, size);
+    return utf8Decode(view);
   }
 
   private readFileName(offset: number) {
-    return this.readString(offset, 100)
+    return this.readString(offset, 100);
   }
 
   private readFileMode(offset: number) {
-    const mode = this.readString(offset + 100, 8)
-    return parseInt(mode, 8)
+    const mode = this.readString(offset + 100, 8);
+    return parseInt(mode, 8);
   }
 
   private readFileMtime(offset: number) {
-    const mtime = this.readString(offset + 136, 12)
-    return parseInt(mtime, 8)
+    const mtime = this.readString(offset + 136, 12);
+    return parseInt(mtime, 8);
   }
 
   private readFileUser(offset: number) {
-    return this.readString(offset + 265, 32)
+    return this.readString(offset + 265, 32);
   }
 
   private readFileGroup(offset: number) {
-    return this.readString(offset + 297, 32)
+    return this.readString(offset + 297, 32);
   }
 
   private readFileType(offset: number) {
-    const typeView = new Uint8Array(this.buffer, offset + 156, 1)
-    const typeStr = String.fromCharCode(typeView[0])
-    return typeStr
+    const typeView = new Uint8Array(this.buffer, offset + 156, 1);
+    const typeStr = String.fromCharCode(typeView[0]);
+    return typeStr;
   }
 
   private readFileSize(offset: number) {
     // offset = 124, length = 12
-    const view = new Uint8Array(this.buffer, offset + 124, 12)
-    const sizeStr = utf8Decode(view)
-    return parseInt(sizeStr, 8)
+    const view = new Uint8Array(this.buffer, offset + 124, 12);
+    const sizeStr = utf8Decode(view);
+    return parseInt(sizeStr, 8);
   }
 
   private readFileBlob(offset: number, size: number, mimetype: string) {
-    const view = new Uint8Array(this.buffer, offset, size)
-    return new Blob([view], { type: mimetype })
+    const view = new Uint8Array(this.buffer, offset, size);
+    return new Blob([view], { type: mimetype });
   }
 
   private readTextFile(offset: number, size: number) {
-    const view = new Uint8Array(this.buffer, offset, size)
-    return utf8Decode(view)
+    const view = new Uint8Array(this.buffer, offset, size);
+    return utf8Decode(view);
   }
 
   getTextFile(filename: string) {
-    const item = this.fileInfo.find((info) => info.name === filename)
+    const item = this.fileInfo.find((info) => info.name === filename);
     if (item) {
-      return this.readTextFile(item.headerOffset + 512, item.size)
+      return this.readTextFile(item.headerOffset + 512, item.size);
     }
   }
 
   getFileBlob(filename: string, mimetype = "") {
-    const item = this.fileInfo.find((info) => info.name === filename)
+    const item = this.fileInfo.find((info) => info.name === filename);
     if (item) {
-      return this.readFileBlob(item.headerOffset + 512, item.size, mimetype)
+      return this.readFileBlob(item.headerOffset + 512, item.size, mimetype);
     }
   }
 }
 
 export class TarWriter {
-  private fileData: ITarWriteItem[] = []
-  private _buffer: ArrayBuffer | null = null
+  private fileData: ITarWriteItem[] = [];
+  private _buffer: ArrayBuffer | null = null;
 
   get buffer() {
     if (!this._buffer) {
-      throw new Error("Buffer is not set")
+      throw new Error("Buffer is not set");
     }
-    return this._buffer
+    return this._buffer;
   }
 
   addFile(
@@ -184,16 +184,16 @@ export class TarWriter {
     file: string | ArrayBuffer | Uint8Array | Blob,
     opts?: Partial<ITarWriteOptions>,
   ) {
-    const data = getArrayBuffer(file)
-    const size = (data as ArrayBuffer).byteLength ?? (file as Blob).size
+    const data = getArrayBuffer(file);
+    const size = (data as ArrayBuffer).byteLength ?? (file as Blob).size;
     const item: ITarWriteItem = {
       name,
       type: TarFileTypeCodes.File,
       data,
       size,
       opts,
-    }
-    this.fileData.push(item)
+    };
+    this.fileData.push(item);
   }
 
   addFolder(name: string, opts?: Partial<ITarWriteOptions>) {
@@ -203,109 +203,113 @@ export class TarWriter {
       data: null,
       size: 0,
       opts,
-    })
+    });
   }
 
   private createBuffer() {
     const dataSize = this.fileData.reduce(
       (prev, item) => prev + 512 + 512 * Math.floor((item.size + 511) / 512),
       0,
-    )
-    const bufSize = 10240 * Math.floor((dataSize + 10240 - 1) / 10240)
-    this._buffer = new ArrayBuffer(bufSize)
+    );
+    const bufSize = 10240 * Math.floor((dataSize + 10240 - 1) / 10240);
+    this._buffer = new ArrayBuffer(bufSize);
   }
 
   async write() {
-    this.createBuffer()
-    const view = new Uint8Array(this.buffer)
-    let offset = 0
+    this.createBuffer();
+    const view = new Uint8Array(this.buffer);
+    let offset = 0;
     for (const item of this.fileData) {
       // write header
-      this.writeFileName(item.name, offset)
-      this.writeFileType(item.type, offset)
-      this.writeFileSize(item.size, offset)
-      this.fillHeader(offset, item.opts as Partial<ITarWriteOptions>, item.type)
-      this.writeChecksum(offset)
+      this.writeFileName(item.name, offset);
+      this.writeFileType(item.type, offset);
+      this.writeFileSize(item.size, offset);
+      this.fillHeader(
+        offset,
+        item.opts as Partial<ITarWriteOptions>,
+        item.type,
+      );
+      this.writeChecksum(offset);
 
       // write data
-      const data = new Uint8Array((await item.data) as ArrayBuffer)
-      view.set(data, offset + 512)
-      offset += 512 + 512 * Math.floor((item.size + 511) / 512)
+      const data = new Uint8Array((await item.data) as ArrayBuffer);
+      view.set(data, offset + 512);
+      offset += 512 + 512 * Math.floor((item.size + 511) / 512);
     }
     // Required so it works in the browser and node.
     if (typeof Blob !== "undefined") {
-      return new Blob([this.buffer], { type: "application/x-tar" })
+      return new Blob([this.buffer], { type: "application/x-tar" });
     } else {
-      return this.buffer
+      return this.buffer;
     }
   }
 
   private writeString(str: string, offset: number, size: number) {
-    const strView = utf8Encode(str)
-    const view = new Uint8Array(this.buffer, offset, size)
+    const strView = utf8Encode(str);
+    const view = new Uint8Array(this.buffer, offset, size);
     for (let i = 0; i < size; i += 1) {
-      view[i] = i < strView.length ? strView[i] : 0
+      view[i] = i < strView.length ? strView[i] : 0;
     }
   }
 
   private writeFileName(name: string, offset: number) {
     // offset: 0
-    this.writeString(name, offset, 100)
+    this.writeString(name, offset, 100);
   }
 
   private writeFileType(type: TarFileType, offset: number) {
     // offset: 156
-    const typeView = new Uint8Array(this.buffer, offset + 156, 1)
-    typeView[0] = type.charCodeAt(0)
+    const typeView = new Uint8Array(this.buffer, offset + 156, 1);
+    typeView[0] = type.charCodeAt(0);
   }
 
   private writeFileSize(size: number, offset: number) {
     // offset: 124
-    const sizeStr = size.toString(8).padStart(11, "0")
-    this.writeString(sizeStr, offset + 124, 12)
+    const sizeStr = size.toString(8).padStart(11, "0");
+    this.writeString(sizeStr, offset + 124, 12);
   }
 
   private writeFileMode(mode: number, offset: number) {
     // offset: 100
-    this.writeString(mode.toString(8).padStart(7, "0"), offset + 100, 8)
+    this.writeString(mode.toString(8).padStart(7, "0"), offset + 100, 8);
   }
 
   private writeFileUid(uid: number, offset: number) {
     // offset: 108
-    this.writeString(uid.toString(8).padStart(7, "0"), offset + 108, 8)
+    this.writeString(uid.toString(8).padStart(7, "0"), offset + 108, 8);
   }
 
   private writeFileGid(gid: number, offset: number) {
     // offset: 116
-    this.writeString(gid.toString(8).padStart(7, "0"), offset + 116, 8)
+    this.writeString(gid.toString(8).padStart(7, "0"), offset + 116, 8);
   }
 
   private writeFileMtime(mtime: number, offset: number) {
     // offset: 136
-    this.writeString(mtime.toString(8).padStart(11, "0"), offset + 136, 12)
+    this.writeString(mtime.toString(8).padStart(11, "0"), offset + 136, 12);
   }
 
   private writeFileUser(user: string, offset: number) {
     // offset: 265
-    this.writeString(user, offset + 265, 32)
+    this.writeString(user, offset + 265, 32);
   }
 
   private writeFileGroup(group: string, offset: number) {
     // offset: 297
-    this.writeString(group, offset + 297, 32)
+    this.writeString(group, offset + 297, 32);
   }
 
   private writeChecksum(offset: number) {
     // offset: 148
-    this.writeString("        ", offset + 148, 8) // first fill with spaces
+    this.writeString("        ", offset + 148, 8); // first fill with spaces
 
     // add up header bytes
-    const header = new Uint8Array(this.buffer, offset, 512)
-    let chksum = 0
+    const header = new Uint8Array(this.buffer, offset, 512);
+    let chksum = 0;
     for (let i = 0; i < 512; i += 1) {
-      chksum += header[i]
+      chksum += header[i];
     }
-    this.writeString(chksum.toString(8), offset + 148, 8)
+    this.writeString(chksum.toString(8), offset + 148, 8);
   }
 
   private fillHeader(
@@ -321,30 +325,30 @@ export class TarWriter {
       user: "tarballjs",
       group: "tarballjs",
       ...opts,
-    }
+    };
 
-    this.writeFileMode(mode, offset)
-    this.writeFileUid(uid, offset)
-    this.writeFileGid(gid, offset)
-    this.writeFileMtime(mtime, offset)
+    this.writeFileMode(mode, offset);
+    this.writeFileUid(uid, offset);
+    this.writeFileGid(gid, offset);
+    this.writeFileMtime(mtime, offset);
 
-    this.writeString("ustar", offset + 257, 6) // magic string
-    this.writeString("00", offset + 263, 2) // magic version
+    this.writeString("ustar", offset + 257, 6); // magic string
+    this.writeString("00", offset + 263, 2); // magic version
 
-    this.writeFileUser(user, offset)
-    this.writeFileGroup(group, offset)
+    this.writeFileUser(user, offset);
+    this.writeFileGroup(group, offset);
   }
 }
 
 function getArrayBuffer(file: string | ArrayBuffer | Uint8Array | Blob) {
   if (typeof file === "string") {
-    return utf8Encode(file).buffer
+    return utf8Encode(file).buffer;
   }
   if (file instanceof ArrayBuffer) {
-    return file
+    return file;
   }
   if (ArrayBuffer.isView(file)) {
-    return new Uint8Array(file).buffer
+    return new Uint8Array(file).buffer;
   }
-  return file.arrayBuffer()
+  return file.arrayBuffer();
 }
diff --git a/site/src/utils/templateVersion.ts b/site/src/utils/templateVersion.ts
index 67eb18805a7c0..00bb3c6562a4e 100644
--- a/site/src/utils/templateVersion.ts
+++ b/site/src/utils/templateVersion.ts
@@ -1,46 +1,53 @@
-import * as API from "api/api"
-import { TemplateVersion } from "api/typesGenerated"
-import { FileTree, createFile } from "./filetree"
-import { TarReader } from "./tar"
+import * as API from "api/api";
+import { FileTree, createFile } from "./filetree";
+import { TarReader } from "./tar";
 
-/**
- * Content by filename
- */
-export type TemplateVersionFiles = Record<string, string>
+// Content by filename
+export type TemplateVersionFiles = Record<string, string>;
 
 export const getTemplateVersionFiles = async (
-  version: TemplateVersion,
+  fileId: string,
 ): Promise<TemplateVersionFiles> => {
-  const files: TemplateVersionFiles = {}
-  const tarFile = await API.getFile(version.job.file_id)
-  const tarReader = new TarReader()
-  await tarReader.readFile(tarFile)
+  const files: TemplateVersionFiles = {};
+  const tarFile = await API.getFile(fileId);
+  const tarReader = new TarReader();
+  await tarReader.readFile(tarFile);
   for (const file of tarReader.fileInfo) {
     if (isAllowedFile(file.name)) {
-      files[file.name] = tarReader.getTextFile(file.name) as string
+      files[file.name] = tarReader.getTextFile(file.name) as string;
     }
   }
-  return files
-}
+  return files;
+};
 
-export const allowedExtensions = ["tf", "md", "Dockerfile"]
+export const allowedExtensions = [
+  "tf",
+  "md",
+  "mkd",
+  "Dockerfile",
+  "protobuf",
+  "sh",
+  "tpl",
+] as const;
+
+export type AllowedExtension = (typeof allowedExtensions)[number];
 
 export const isAllowedFile = (name: string) => {
-  return allowedExtensions.some((ext) => name.endsWith(ext))
-}
+  return allowedExtensions.some((ext) => name.endsWith(ext));
+};
 
 export const createTemplateVersionFileTree = async (
   tarReader: TarReader,
 ): Promise<FileTree> => {
-  let fileTree: FileTree = {}
+  let fileTree: FileTree = {};
   for (const file of tarReader.fileInfo) {
     if (isAllowedFile(file.name)) {
       fileTree = createFile(
         file.name,
         fileTree,
         tarReader.getTextFile(file.name) as string,
-      )
+      );
     }
   }
-  return fileTree
-}
+  return fileTree;
+};
diff --git a/site/src/utils/templates.ts b/site/src/utils/templates.ts
index 3f9aae69e5818..9c54afd0aaf4c 100644
--- a/site/src/utils/templates.ts
+++ b/site/src/utils/templates.ts
@@ -1,20 +1,20 @@
-import dayjs from "dayjs"
-import duration from "dayjs/plugin/duration"
-import relativeTime from "dayjs/plugin/relativeTime"
+import dayjs from "dayjs";
+import duration from "dayjs/plugin/duration";
+import relativeTime from "dayjs/plugin/relativeTime";
 
-dayjs.extend(duration)
-dayjs.extend(relativeTime)
+dayjs.extend(duration);
+dayjs.extend(relativeTime);
 
 export const formatTemplateActiveDevelopers = (num?: number): string => {
   if (num === undefined || num < 0) {
     // Loading
-    return "-"
+    return "-";
   }
-  return num.toString()
-}
+  return num.toString();
+};
 
 export const formatTemplateBuildTime = (buildTimeMs?: number): string => {
   return buildTimeMs === undefined
     ? "Unknown"
-    : `${Math.round(dayjs.duration(buildTimeMs, "milliseconds").asSeconds())}s`
-}
+    : `${Math.round(dayjs.duration(buildTimeMs, "milliseconds").asSeconds())}s`;
+};
diff --git a/site/src/utils/terminal.ts b/site/src/utils/terminal.ts
new file mode 100644
index 0000000000000..d27a6efce379c
--- /dev/null
+++ b/site/src/utils/terminal.ts
@@ -0,0 +1,41 @@
+import * as API from "api/api";
+
+export const terminalWebsocketUrl = async (
+  baseUrl: string | undefined,
+  reconnect: string,
+  agentId: string,
+  command: string | undefined,
+  height: number,
+  width: number,
+): Promise<string> => {
+  const query = new URLSearchParams({ reconnect });
+  if (command) {
+    query.set("command", command);
+  }
+  query.set("height", height.toString());
+  query.set("width", width.toString());
+
+  const url = new URL(baseUrl || `${location.protocol}//${location.host}`);
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  if (!url.pathname.endsWith("/")) {
+    url.pathname + "/";
+  }
+  url.pathname += `api/v2/workspaceagents/${agentId}/pty`;
+  url.search = "?" + query.toString();
+
+  // If the URL is just the primary API, we don't need a signed token to
+  // connect.
+  if (!baseUrl) {
+    return url.toString();
+  }
+
+  // Do ticket issuance and set the query parameter.
+  const tokenRes = await API.issueReconnectingPTYSignedToken({
+    url: url.toString(),
+    agentID: agentId,
+  });
+  query.set("coder_signed_app_token_23db1dde", tokenRes.signed_token);
+  url.search = "?" + query.toString();
+
+  return url.toString();
+};
diff --git a/site/src/utils/timeZones.ts b/site/src/utils/timeZones.ts
new file mode 100644
index 0000000000000..c7336155e30f2
--- /dev/null
+++ b/site/src/utils/timeZones.ts
@@ -0,0 +1,6 @@
+import tzData from "tzdata";
+
+export const timeZones = Object.keys(tzData.zones).sort();
+
+export const getPreferredTimezone = () =>
+  Intl.DateTimeFormat().resolvedOptions().timeZone;
diff --git a/site/src/utils/workspace.test.ts b/site/src/utils/workspace.test.ts
index 26bb223c6b566..f7385eb850ca0 100644
--- a/site/src/utils/workspace.test.ts
+++ b/site/src/utils/workspace.test.ts
@@ -1,13 +1,13 @@
-import dayjs from "dayjs"
-import * as TypesGen from "../api/typesGenerated"
-import * as Mocks from "../testHelpers/entities"
+import dayjs from "dayjs";
+import * as TypesGen from "api/typesGenerated";
+import * as Mocks from "testHelpers/entities";
 import {
   defaultWorkspaceExtension,
   getDisplayVersionStatus,
   getDisplayWorkspaceBuildInitiatedBy,
   getDisplayWorkspaceTemplateName,
   isWorkspaceOn,
-} from "./workspace"
+} from "./workspace";
 
 describe("util > workspace", () => {
   describe("isWorkspaceOn", () => {
@@ -47,11 +47,11 @@ describe("util > workspace", () => {
             },
             transition,
           },
-        }
-        expect(isWorkspaceOn(workspace)).toBe(isOn)
+        };
+        expect(isWorkspaceOn(workspace)).toBe(isOn);
       },
-    )
-  })
+    );
+  });
 
   describe("defaultWorkspaceExtension", () => {
     it.each<[string, TypesGen.PutExtendWorkspaceRequest]>([
@@ -71,9 +71,9 @@ describe("util > workspace", () => {
         },
       ],
     ])(`defaultWorkspaceExtension(%p) returns %p`, (startTime, request) => {
-      expect(defaultWorkspaceExtension(dayjs(startTime))).toEqual(request)
-    })
-  })
+      expect(defaultWorkspaceExtension(dayjs(startTime))).toEqual(request);
+    });
+  });
 
   describe("getDisplayWorkspaceBuildInitiatedBy", () => {
     it.each<[TypesGen.WorkspaceBuild, string]>([
@@ -95,10 +95,10 @@ describe("util > workspace", () => {
     ])(
       `getDisplayWorkspaceBuildInitiatedBy(%p) returns %p`,
       (build, initiatedBy) => {
-        expect(getDisplayWorkspaceBuildInitiatedBy(build)).toEqual(initiatedBy)
+        expect(getDisplayWorkspaceBuildInitiatedBy(build)).toEqual(initiatedBy);
       },
-    )
-  })
+    );
+  });
 
   describe("getDisplayVersionStatus", () => {
     it.each<[string, string, string, boolean]>([
@@ -115,28 +115,28 @@ describe("util > workspace", () => {
         const { displayVersion, outdated } = getDisplayVersionStatus(
           agentVersion,
           serverVersion,
-        )
-        expect(displayVersion).toEqual(expectedVersion)
-        expect(expectedOutdated).toEqual(outdated)
+        );
+        expect(displayVersion).toEqual(expectedVersion);
+        expect(expectedOutdated).toEqual(outdated);
       },
-    )
-  })
+    );
+  });
 
   describe("getDisplayWorkspaceTemplateName", () => {
     it("display name is not set", async () => {
       const workspace: TypesGen.Workspace = {
         ...Mocks.MockWorkspace,
         template_display_name: "",
-      }
-      const displayed = getDisplayWorkspaceTemplateName(workspace)
-      expect(displayed).toEqual(workspace.template_name)
-    })
+      };
+      const displayed = getDisplayWorkspaceTemplateName(workspace);
+      expect(displayed).toEqual(workspace.template_name);
+    });
     it("display name is set", async () => {
       const workspace: TypesGen.Workspace = {
         ...Mocks.MockWorkspace,
-      }
-      const displayed = getDisplayWorkspaceTemplateName(workspace)
-      expect(displayed).toEqual(workspace.template_display_name)
-    })
-  })
-})
+      };
+      const displayed = getDisplayWorkspaceTemplateName(workspace);
+      expect(displayed).toEqual(workspace.template_display_name);
+    });
+  });
+});
diff --git a/site/src/utils/workspace.tsx b/site/src/utils/workspace.tsx
index 26b436aafe79e..9365e5d615cac 100644
--- a/site/src/utils/workspace.tsx
+++ b/site/src/utils/workspace.tsx
@@ -1,20 +1,19 @@
-import { Theme } from "@mui/material/styles"
-import dayjs from "dayjs"
-import duration from "dayjs/plugin/duration"
-import minMax from "dayjs/plugin/minMax"
-import utc from "dayjs/plugin/utc"
-import semver from "semver"
-import * as TypesGen from "../api/typesGenerated"
-import i18next from "i18next"
-import CircularProgress from "@mui/material/CircularProgress"
-import ErrorIcon from "@mui/icons-material/ErrorOutline"
-import StopIcon from "@mui/icons-material/StopOutlined"
-import PlayIcon from "@mui/icons-material/PlayArrowOutlined"
-import QueuedIcon from "@mui/icons-material/HourglassEmpty"
+import { Theme } from "@mui/material/styles";
+import dayjs from "dayjs";
+import duration from "dayjs/plugin/duration";
+import minMax from "dayjs/plugin/minMax";
+import utc from "dayjs/plugin/utc";
+import semver from "semver";
+import * as TypesGen from "api/typesGenerated";
+import CircularProgress from "@mui/material/CircularProgress";
+import ErrorIcon from "@mui/icons-material/ErrorOutline";
+import StopIcon from "@mui/icons-material/StopOutlined";
+import PlayIcon from "@mui/icons-material/PlayArrowOutlined";
+import QueuedIcon from "@mui/icons-material/HourglassEmpty";
 
-dayjs.extend(duration)
-dayjs.extend(utc)
-dayjs.extend(minMax)
+dayjs.extend(duration);
+dayjs.extend(utc);
+dayjs.extend(minMax);
 
 const DisplayWorkspaceBuildStatusLanguage = {
   succeeded: "Succeeded",
@@ -23,11 +22,11 @@ const DisplayWorkspaceBuildStatusLanguage = {
   canceling: "Canceling",
   canceled: "Canceled",
   failed: "Failed",
-}
+};
 
 const DisplayAgentVersionLanguage = {
   unknown: "Unknown",
-}
+};
 
 export const getDisplayWorkspaceBuildStatus = (
   theme: Theme,
@@ -37,75 +36,77 @@ export const getDisplayWorkspaceBuildStatus = (
     case "succeeded":
       return {
         type: "success",
-        color: theme.palette.success.main,
+        color: theme.palette.success.light,
         status: DisplayWorkspaceBuildStatusLanguage.succeeded,
-      } as const
+      } as const;
     case "pending":
       return {
         type: "secondary",
         color: theme.palette.text.secondary,
         status: DisplayWorkspaceBuildStatusLanguage.pending,
-      } as const
+      } as const;
     case "running":
       return {
         type: "info",
         color: theme.palette.primary.main,
         status: DisplayWorkspaceBuildStatusLanguage.running,
-      } as const
+      } as const;
+    // Just handle unknown as failed
+    case "unknown":
     case "failed":
       return {
         type: "error",
         color: theme.palette.text.secondary,
         status: DisplayWorkspaceBuildStatusLanguage.failed,
-      } as const
+      } as const;
     case "canceling":
       return {
         type: "warning",
         color: theme.palette.warning.light,
         status: DisplayWorkspaceBuildStatusLanguage.canceling,
-      } as const
+      } as const;
     case "canceled":
       return {
         type: "secondary",
         color: theme.palette.text.secondary,
         status: DisplayWorkspaceBuildStatusLanguage.canceled,
-      } as const
+      } as const;
   }
-}
+};
 
 export const getDisplayWorkspaceBuildInitiatedBy = (
   build: TypesGen.WorkspaceBuild,
 ): string => {
   switch (build.reason) {
     case "initiator":
-      return build.initiator_name
+      return build.initiator_name;
     case "autostart":
     case "autostop":
-      return "Coder"
+      return "Coder";
   }
-}
+};
 
 const getWorkspaceBuildDurationInSeconds = (
   build: TypesGen.WorkspaceBuild,
 ): number | undefined => {
-  const isCompleted = build.job.started_at && build.job.completed_at
+  const isCompleted = build.job.started_at && build.job.completed_at;
 
   if (!isCompleted) {
-    return
+    return;
   }
 
-  const startedAt = dayjs(build.job.started_at)
-  const completedAt = dayjs(build.job.completed_at)
-  return completedAt.diff(startedAt, "seconds")
-}
+  const startedAt = dayjs(build.job.started_at);
+  const completedAt = dayjs(build.job.completed_at);
+  return completedAt.diff(startedAt, "seconds");
+};
 
 export const displayWorkspaceBuildDuration = (
   build: TypesGen.WorkspaceBuild,
   inProgressLabel = "In progress",
 ): string => {
-  const duration = getWorkspaceBuildDurationInSeconds(build)
-  return duration ? `${duration} seconds` : inProgressLabel
-}
+  const duration = getWorkspaceBuildDurationInSeconds(build);
+  return duration ? `${duration} seconds` : inProgressLabel;
+};
 
 export const getDisplayVersionStatus = (
   agentVersion: string,
@@ -115,36 +116,36 @@ export const getDisplayVersionStatus = (
     return {
       displayVersion: agentVersion || DisplayAgentVersionLanguage.unknown,
       outdated: false,
-    }
+    };
   } else if (semver.lt(agentVersion, serverVersion)) {
     return {
       displayVersion: agentVersion,
       outdated: true,
-    }
+    };
   } else {
     return {
       displayVersion: agentVersion,
       outdated: false,
-    }
+    };
   }
-}
+};
 
 export const isWorkspaceOn = (workspace: TypesGen.Workspace): boolean => {
-  const transition = workspace.latest_build.transition
-  const status = workspace.latest_build.job.status
-  return transition === "start" && status === "succeeded"
-}
+  const transition = workspace.latest_build.transition;
+  const status = workspace.latest_build.job.status;
+  return transition === "start" && status === "succeeded";
+};
 
 export const defaultWorkspaceExtension = (
   __startDate?: dayjs.Dayjs,
 ): TypesGen.PutExtendWorkspaceRequest => {
-  const now = __startDate ? dayjs(__startDate) : dayjs()
-  const fourHoursFromNow = now.add(4, "hours").utc()
+  const now = __startDate ? dayjs(__startDate) : dayjs();
+  const fourHoursFromNow = now.add(4, "hours").utc();
 
   return {
     deadline: fourHoursFromNow.format(),
-  }
-}
+  };
+};
 
 // You can see the favicon designs here: https://www.figma.com/file/YIGBkXUcnRGz2ZKNmLaJQf/Coder-v2-Design?node-id=560%3A620
 
@@ -153,139 +154,152 @@ type FaviconType =
   | "favicon-success"
   | "favicon-error"
   | "favicon-warning"
-  | "favicon-running"
+  | "favicon-running";
 
 export const getFaviconByStatus = (
   build: TypesGen.WorkspaceBuild,
 ): FaviconType => {
   switch (build.status) {
     case undefined:
-      return "favicon"
+      return "favicon";
     case "running":
-      return "favicon-success"
+      return "favicon-success";
     case "starting":
-      return "favicon-running"
+      return "favicon-running";
     case "stopping":
-      return "favicon-running"
+      return "favicon-running";
     case "stopped":
-      return "favicon"
+      return "favicon";
     case "deleting":
-      return "favicon"
+      return "favicon";
     case "deleted":
-      return "favicon"
+      return "favicon";
     case "canceling":
-      return "favicon-warning"
+      return "favicon-warning";
     case "canceled":
-      return "favicon"
+      return "favicon";
     case "failed":
-      return "favicon-error"
+      return "favicon-error";
     case "pending":
-      return "favicon"
+      return "favicon";
   }
-}
+};
 
 export const getDisplayWorkspaceTemplateName = (
   workspace: TypesGen.Workspace,
 ): string => {
   return workspace.template_display_name.length > 0
     ? workspace.template_display_name
-    : workspace.template_name
-}
+    : workspace.template_name;
+};
 
 export const getDisplayWorkspaceStatus = (
   workspaceStatus: TypesGen.WorkspaceStatus,
   provisionerJob?: TypesGen.ProvisionerJob,
 ) => {
-  const { t } = i18next
-
   switch (workspaceStatus) {
     case undefined:
       return {
-        text: t("workspaceStatus.loading", { ns: "common" }),
+        text: "Loading",
         icon: <LoadingIcon />,
-      } as const
+      } as const;
     case "running":
       return {
         type: "success",
-        text: t("workspaceStatus.running", { ns: "common" }),
+        text: "Running",
         icon: <PlayIcon />,
-      } as const
+      } as const;
     case "starting":
       return {
         type: "success",
-        text: t("workspaceStatus.starting", { ns: "common" }),
+        text: "Starting",
         icon: <LoadingIcon />,
-      } as const
+      } as const;
     case "stopping":
       return {
         type: "warning",
-        text: t("workspaceStatus.stopping", { ns: "common" }),
+        text: "Stopping",
         icon: <LoadingIcon />,
-      } as const
+      } as const;
     case "stopped":
       return {
         type: "warning",
-        text: t("workspaceStatus.stopped", { ns: "common" }),
+        text: "Stopped",
         icon: <StopIcon />,
-      } as const
+      } as const;
     case "deleting":
       return {
         type: "warning",
-        text: t("workspaceStatus.deleting", { ns: "common" }),
+        text: "Deleting",
         icon: <LoadingIcon />,
-      } as const
+      } as const;
     case "deleted":
       return {
         type: "error",
-        text: t("workspaceStatus.deleted", { ns: "common" }),
+        text: "Deleted",
         icon: <ErrorIcon />,
-      } as const
+      } as const;
     case "canceling":
       return {
         type: "warning",
-        text: t("workspaceStatus.canceling", { ns: "common" }),
+        text: "Canceling",
         icon: <LoadingIcon />,
-      } as const
+      } as const;
     case "canceled":
       return {
         type: "warning",
-        text: t("workspaceStatus.canceled", { ns: "common" }),
+        text: "Canceled",
         icon: <ErrorIcon />,
-      } as const
+      } as const;
     case "failed":
       return {
         type: "error",
-        text: t("workspaceStatus.failed", { ns: "common" }),
+        text: "Failed",
         icon: <ErrorIcon />,
-      } as const
+      } as const;
     case "pending":
       return {
         type: "info",
         text: getPendingWorkspaceStatusText(provisionerJob),
         icon: <QueuedIcon />,
-      } as const
+      } as const;
   }
-}
+};
 
 const getPendingWorkspaceStatusText = (
   provisionerJob?: TypesGen.ProvisionerJob,
 ): string => {
-  const { t } = i18next
-
   if (!provisionerJob || provisionerJob.queue_size === 0) {
-    return t("workspaceStatus.pending", { ns: "common" })
+    return "Pending";
   }
-  return "Position in queue: " + provisionerJob.queue_position
-}
+  return "Position in queue: " + provisionerJob.queue_position;
+};
 
 const LoadingIcon = () => {
-  return <CircularProgress size={10} style={{ color: "#FFF" }} />
-}
+  return <CircularProgress size={10} style={{ color: "#FFF" }} />;
+};
 
 export const hasJobError = (workspace: TypesGen.Workspace) => {
-  return workspace.latest_build.job.error !== undefined
-}
+  return workspace.latest_build.job.error !== undefined;
+};
 
 export const paramsUsedToCreateWorkspace = (
   param: TypesGen.TemplateVersionParameter,
-) => !param.ephemeral
+) => !param.ephemeral;
+
+export const getMatchingAgentOrFirst = (
+  workspace: TypesGen.Workspace,
+  agentName: string | undefined,
+): TypesGen.WorkspaceAgent | undefined => {
+  return workspace.latest_build.resources
+    .map((resource) => {
+      if (!resource.agents || resource.agents.length === 0) {
+        return;
+      }
+      if (!agentName) {
+        return resource.agents[0];
+      }
+      return resource.agents.find((agent) => agent.name === agentName);
+    })
+    .filter((a) => a)[0];
+};
diff --git a/site/src/xServices/appearance/appearanceXService.ts b/site/src/xServices/appearance/appearanceXService.ts
deleted file mode 100644
index 267d07608b726..0000000000000
--- a/site/src/xServices/appearance/appearanceXService.ts
+++ /dev/null
@@ -1,127 +0,0 @@
-import { displaySuccess } from "components/GlobalSnackbar/utils"
-import { assign, createMachine } from "xstate"
-import * as API from "../../api/api"
-import { AppearanceConfig } from "../../api/typesGenerated"
-
-export type AppearanceContext = {
-  appearance?: AppearanceConfig
-  getAppearanceError?: unknown
-  setAppearanceError?: unknown
-  preview: boolean
-}
-
-export type AppearanceEvent =
-  | { type: "SET_PREVIEW_APPEARANCE"; appearance: AppearanceConfig }
-  | { type: "SAVE_APPEARANCE"; appearance: AppearanceConfig }
-
-export const appearanceMachine = createMachine(
-  {
-    id: "appearanceMachine",
-    predictableActionArguments: true,
-    tsTypes: {} as import("./appearanceXService.typegen").Typegen0,
-    schema: {
-      context: {} as AppearanceContext,
-      events: {} as AppearanceEvent,
-      services: {
-        getAppearance: {
-          data: {} as AppearanceConfig,
-        },
-        setAppearance: {
-          data: {},
-        },
-      },
-    },
-    context: {
-      preview: false,
-    },
-    initial: "gettingAppearance",
-    states: {
-      idle: {
-        on: {
-          SET_PREVIEW_APPEARANCE: {
-            actions: [
-              "clearGetAppearanceError",
-              "clearSetAppearanceError",
-              "assignPreviewAppearance",
-            ],
-          },
-          SAVE_APPEARANCE: "savingAppearance",
-        },
-      },
-      gettingAppearance: {
-        entry: "clearGetAppearanceError",
-        invoke: {
-          id: "getAppearance",
-          src: "getAppearance",
-          onDone: {
-            target: "idle",
-            actions: ["assignAppearance"],
-          },
-          onError: {
-            target: "idle",
-            actions: ["assignGetAppearanceError"],
-          },
-        },
-      },
-      savingAppearance: {
-        entry: "clearSetAppearanceError",
-        invoke: {
-          id: "setAppearance",
-          src: "setAppearance",
-          onDone: {
-            target: "idle",
-            actions: ["assignAppearance", "notifyUpdateAppearanceSuccess"],
-          },
-          onError: {
-            target: "idle",
-            actions: ["assignSetAppearanceError"],
-          },
-        },
-      },
-    },
-  },
-  {
-    actions: {
-      assignPreviewAppearance: assign({
-        appearance: (_, event) => event.appearance,
-        preview: (_) => true,
-      }),
-      notifyUpdateAppearanceSuccess: () => {
-        displaySuccess("Successfully updated appearance settings!")
-      },
-      assignAppearance: assign({
-        appearance: (_, event) => event.data as AppearanceConfig,
-        preview: (_) => false,
-      }),
-      assignGetAppearanceError: assign({
-        getAppearanceError: (_, event) => event.data,
-      }),
-      clearGetAppearanceError: assign({
-        getAppearanceError: (_) => undefined,
-      }),
-      assignSetAppearanceError: assign({
-        setAppearanceError: (_, event) => event.data,
-      }),
-      clearSetAppearanceError: assign({
-        setAppearanceError: (_) => undefined,
-      }),
-    },
-    services: {
-      getAppearance: async () => {
-        // Appearance is injected by the Coder server into the HTML document.
-        const appearance = document.querySelector("meta[property=appearance]")
-        if (appearance) {
-          const rawContent = appearance.getAttribute("content")
-          try {
-            return JSON.parse(rawContent as string)
-          } catch (ex) {
-            // Ignore this and fetch as normal!
-          }
-        }
-
-        return API.getAppearance()
-      },
-      setAppearance: (_, event) => API.updateAppearance(event.appearance),
-    },
-  },
-)
diff --git a/site/src/xServices/auth/authMethodsXService.ts b/site/src/xServices/auth/authMethodsXService.ts
deleted file mode 100644
index 50a66acaa2a32..0000000000000
--- a/site/src/xServices/auth/authMethodsXService.ts
+++ /dev/null
@@ -1,55 +0,0 @@
-import { assign, createMachine } from "xstate"
-import * as TypeGen from "api/typesGenerated"
-import * as API from "api/api"
-
-export interface AuthMethodsContext {
-  authMethods?: TypeGen.AuthMethods
-  error?: unknown
-}
-
-export const authMethodsXService = createMachine(
-  {
-    id: "authMethods",
-    predictableActionArguments: true,
-    tsTypes: {} as import("./authMethodsXService.typegen").Typegen0,
-    schema: {
-      context: {} as AuthMethodsContext,
-      services: {} as {
-        getAuthMethods: {
-          data: TypeGen.AuthMethods
-        }
-      },
-    },
-    context: {},
-    initial: "gettingAuthMethods",
-    states: {
-      gettingAuthMethods: {
-        invoke: {
-          src: "getAuthMethods",
-          onDone: {
-            target: "idle",
-            actions: ["assignAuthMethods"],
-          },
-          onError: {
-            target: "idle",
-            actions: ["setError"],
-          },
-        },
-      },
-      idle: {},
-    },
-  },
-  {
-    actions: {
-      assignAuthMethods: assign({
-        authMethods: (_, event) => event.data,
-      }),
-      setError: assign({
-        error: (_, event) => event.data,
-      }),
-    },
-    services: {
-      getAuthMethods: () => API.getAuthMethods(),
-    },
-  },
-)
diff --git a/site/src/xServices/auth/authXService.ts b/site/src/xServices/auth/authXService.ts
deleted file mode 100644
index 983fa0f6386bd..0000000000000
--- a/site/src/xServices/auth/authXService.ts
+++ /dev/null
@@ -1,410 +0,0 @@
-import { assign, createMachine } from "xstate"
-import * as API from "../../api/api"
-import * as TypesGen from "../../api/typesGenerated"
-import { displaySuccess } from "../../components/GlobalSnackbar/utils"
-
-export const Language = {
-  successProfileUpdate: "Updated settings.",
-}
-
-export const checks = {
-  readAllUsers: "readAllUsers",
-  updateUsers: "updateUsers",
-  createUser: "createUser",
-  createTemplates: "createTemplates",
-  deleteTemplates: "deleteTemplates",
-  viewAuditLog: "viewAuditLog",
-  viewDeploymentValues: "viewDeploymentValues",
-  createGroup: "createGroup",
-  viewUpdateCheck: "viewUpdateCheck",
-  viewGitAuthConfig: "viewGitAuthConfig",
-  viewDeploymentStats: "viewDeploymentStats",
-  editWorkspaceProxies: "editWorkspaceProxies",
-} as const
-
-export const permissionsToCheck = {
-  [checks.readAllUsers]: {
-    object: {
-      resource_type: "user",
-    },
-    action: "read",
-  },
-  [checks.updateUsers]: {
-    object: {
-      resource_type: "user",
-    },
-    action: "update",
-  },
-  [checks.createUser]: {
-    object: {
-      resource_type: "user",
-    },
-    action: "create",
-  },
-  [checks.createTemplates]: {
-    object: {
-      resource_type: "template",
-    },
-    action: "update",
-  },
-  [checks.deleteTemplates]: {
-    object: {
-      resource_type: "template",
-    },
-    action: "delete",
-  },
-  [checks.viewAuditLog]: {
-    object: {
-      resource_type: "audit_log",
-    },
-    action: "read",
-  },
-  [checks.viewDeploymentValues]: {
-    object: {
-      resource_type: "deployment_config",
-    },
-    action: "read",
-  },
-  [checks.createGroup]: {
-    object: {
-      resource_type: "group",
-    },
-    action: "create",
-  },
-  [checks.viewUpdateCheck]: {
-    object: {
-      resource_type: "deployment_config",
-    },
-    action: "read",
-  },
-  [checks.viewGitAuthConfig]: {
-    object: {
-      resource_type: "deployment_config",
-    },
-    action: "read",
-  },
-  [checks.viewDeploymentStats]: {
-    object: {
-      resource_type: "deployment_stats",
-    },
-    action: "read",
-  },
-  [checks.editWorkspaceProxies]: {
-    object: {
-      resource_type: "workspace_proxy",
-    },
-    action: "create",
-  },
-} as const
-
-export type Permissions = Record<keyof typeof permissionsToCheck, boolean>
-
-export type AuthenticatedData = {
-  user: TypesGen.User
-  permissions: Permissions
-}
-export type UnauthenticatedData = {
-  hasFirstUser: boolean
-  authMethods: TypesGen.AuthMethods
-}
-export type AuthData = AuthenticatedData | UnauthenticatedData
-
-export const isAuthenticated = (data?: AuthData): data is AuthenticatedData =>
-  data !== undefined && "user" in data
-
-const loadInitialAuthData = async (): Promise<AuthData> => {
-  let authenticatedUser: TypesGen.User | undefined
-  // User is injected by the Coder server into the HTML document.
-  const userMeta = document.querySelector("meta[property=user]")
-  if (userMeta) {
-    const rawContent = userMeta.getAttribute("content")
-    try {
-      authenticatedUser = JSON.parse(rawContent as string) as TypesGen.User
-    } catch (ex) {
-      // Ignore this and fetch as normal!
-    }
-  }
-
-  // If we have the user from the meta tag, we can skip this!
-  if (!authenticatedUser) {
-    authenticatedUser = await API.getAuthenticatedUser()
-  }
-
-  if (authenticatedUser) {
-    const permissions = (await API.checkAuthorization({
-      checks: permissionsToCheck,
-    })) as Permissions
-    return {
-      user: authenticatedUser,
-      permissions,
-    }
-  }
-
-  const [hasFirstUser, authMethods] = await Promise.all([
-    API.hasFirstUser(),
-    API.getAuthMethods(),
-  ])
-
-  return {
-    hasFirstUser,
-    authMethods,
-  }
-}
-
-const signIn = async (
-  email: string,
-  password: string,
-): Promise<AuthenticatedData> => {
-  await API.login(email, password)
-  const [user, permissions] = await Promise.all([
-    API.getAuthenticatedUser(),
-    API.checkAuthorization({
-      checks: permissionsToCheck,
-    }),
-  ])
-
-  return {
-    user: user as TypesGen.User,
-    permissions: permissions as Permissions,
-  }
-}
-
-const signOut = async () => {
-  const [authMethods] = await Promise.all([
-    API.getAuthMethods(), // Anticipate and load the auth methods
-    API.logout(),
-  ])
-
-  return {
-    hasFirstUser: true,
-    authMethods,
-  } as UnauthenticatedData
-}
-export interface AuthContext {
-  error?: unknown
-  updateProfileError?: unknown
-  data?: AuthData
-}
-
-export type AuthEvent =
-  | { type: "SIGN_OUT" }
-  | { type: "SIGN_IN"; email: string; password: string }
-  | { type: "UPDATE_PROFILE"; data: TypesGen.UpdateUserProfileRequest }
-
-export const authMachine =
-  /** @xstate-layout N4IgpgJg5mDOIC5QEMCuAXAFgZXc9YAdLAJZQB2kA8hgMTYCSA4gHID6DLioADgPal0JPuW4gAHogBsATimEAzDIAcAFgUB2VTJ26ANCACeiAIwaADKsLKFtu-dsBfRwbRZc+IqQolyUBuS0ECJEvgBufADWXmTkAWL8gsKiSBKICubKhKpSyhoArAbGCGaqGoRSlVXVlfnOrhg4eATEsb7+gWAATl18XYQ8ADb4AGZ9ALatFPGpiSRCImKSCLLySmqa2ro6RaYFAEzWDscK9SBuTZ6EMOhCfgCqsN1BIYThUUQ3ALJgCQLzySW6Uy2VyBV2JXyUhMFRqcLqLnOjQ8LRudygj2e3V6-SGowm1zA6B+fySi1Sy32MnyhHyyksYK2ug0EJM1IURxO9jOFxRnyJ6IACt1xiRYKQRLAXpQ3uQItFCABjTBgRWRYVdUXi5LwWb-BYpUDLZRScygvKFIyIGQaQ4FHnI5r827tDVaiXkKXYvoDYboMaapUqtVusUe3W8fWAimIE1mnIW1l0rImOE1BENdxOwkuvw-LB8CBS4Iy94K75EzCFiMgOYGoEIZRUwgyVT5BQmfaW4omGxZGxcuwOrNXNHtfNVou0b24v0ByYVgtF0kA8lG2PN1vtzvd0zszmD06I3nZ7yUCABAa9EYkQahCB32j3QUAEQAggAVACibEFACUqAAMQYAAZL8V3rGMSjbGQKihLsISkOlaWHS4WjPSBLx4a9byIVAeAgfBXRwx8S1COUPkIE8rgwi9yCvPgbzvQh8MIoUSLABB3kVIiRAAbXMABdCDo3XaD8lgpCpAQq0EA0eTUL5KZzywjiWIIoi-EFDjpx6H08X9AlqPQ2JMPo7DGNw9S2OIyy7y4iieINAThL1MlDTScTJPg3dGxkfZFNPUy6OIWBMDeB8wFoJgvw-NhsGwAAJNgAGkvwATREtdPM7VQrE0XyTF7coB0PQKaOCy9xXCsc-ASxKUrAQxpXI+UiGMmIKDM0KaoFdp6sawwHIiJzkhcrKPOWIqkOscFZNTfYOXtY9HQqrqQuqnN0QGprdJxX18UDDrlO6zbaqgHahu43jyHGtzV0m0x9jyxQ5p7ExzBhUrB3Kkz1qqsLCEGPhkAgSAIsfP8vxilgvz-T8f3q1KMomht9g+8ocnMGQCtZDRZAPLkMyREc-pU+jNuB0HwcVEQb01S6-zAGBKC6TxaAAYTfFgOa-EC2ChmG4YR+KkuRzL7sgsT0bMQhzCUcxpMK20vsPBRieO2iAfCqmwYgJU6ZIBmksGpmWe6dmOaoFhgL-L4Behr9Yfh79ReStKJcjdy0Yx0Fsdx+b23MX7OvJnqgZBvXCC6ZmwFZzSLpN3ayNlNqqNWsnTsB3XwZj822e2pOrscm67q9h6GzMBQrDy7cZJ7DR1ZQlbSdDrOdcj3PY-jwuGt2mcDsMo6M7bjbs87-W87ji3e8G4a+FG-ihNRqCq5rtsO3r0wpG0ZvMzQ0eqtVVAunmQwIai5931d7Avw5+4-wYD9PdrKNsqmsoOQyBM3sQZ6pBDidDax9T7oHPqxBO2AQFnxaqnSimtKoU2gWA6ykDkHFxGqXZektRI5U-ooBkiZZIKFyHvEmB8gFH0VCfM+qDtroL2vpOcRkR6UKQdQ0B4CNL0I4Wfeei9brYPLlLPBjcCE-18m2KwGtWFa0CIwVgbAqD3A-CvaWWgYSEN-iUDIZpUxpiqBoQBZ52g0HQLAssoczFqM8k2WCW5N6+X2OYeShMTgyNbspUxdAB4GXnMpaxOD35-w0XLCRrJ0ZWH0QYqQRiW4UOVKqSI7RAJG1gOgTEXQLEUQVMdRJaoUlpIyU8Lo-CsGuWEbg5YmhCD7B3nU-YA5lA6HVhCZxYjoRshyDvJQ+NVCAIAO7IABH4QCfQPwqlSV0dJmT6DMHYJwGx1Sm7Yx0I3SwziTBOLqWaLQdIpC2HyKoLZ5gESInIIWOAYgEHrUCZU4JJRsY0iIT2akZoPEUJMX4GY9zHoIDbIcdGLzt4qFhDEpCgDzqZKWYgVQ+xWSyCyOC2okK+paRFGGHUML-mmnNNorZbIwUxI+Upc6E5qzYq2LUuQwKSitnymrI8+8lJyIYkxe8zELlfj0l0bFVcaRlCklvRspzjGILZVZEgkVCAzj5Y3AV+MfIQjyEy8hLLxUWXZRfOVRVsiKqVhCRuhxtgaBVY3A5MgxX-XMmpCB7E7K-CCX8oq+RnnaIKJa+J6rrUSrvHykwHZZq+X2bScwYbzUSTUBCr1QUfWbSlX6p1lctlusKp2Q4JLY1hzOmixOfdii-MrlIiotKPpyCtdm8e1N9YJsdYWqCmyshyH9vigoVhkWxIre3CO1aDbkHpuMRm3cZ51tft7BtqhzAZoVga+aGhexuOOJmtalaO69qnj3fqRc+UKHpIQIq87S25GXZnMea69Y7qhPuswxVCptnKNsOQ7Z2xUhPYfCmYV-WBtLVOjkJqzUkP6TGldp10EX0IFynlcroRywsI4iEu6ArAdPVQmhKDa0yqg0m1e+NNFwZ3BCNswdkPvuIGB2tcqakuPlgR4h2MWzMgAxartwDeEoLtf1dB-rXVBoQyQljqHOFfq+q2v9jHG7mqUKqm55N-UuN4-NT6DGdD5C0Gp-Ypq31eL8HcsdFcG0yA+rB5QtHijOKOYoNWgD8nJNGUU6F2GxK9LlvSTIcLGn5C2ZUNpLj5CxIUFSD6XmuyDOGeiMZXQJlgCmTMkp2LGm1OUFCHQORGkyEVqoZQbTNly2-poaERy6kh0pYl5LrZpLNIy1l2Sm5dAkPRs4wz+NlDOGcEAA */
-  createMachine(
-    {
-      id: "authState",
-      predictableActionArguments: true,
-      tsTypes: {} as import("./authXService.typegen").Typegen0,
-      schema: {
-        context: {} as AuthContext,
-        events: {} as AuthEvent,
-        services: {} as {
-          loadInitialAuthData: {
-            data: Awaited<ReturnType<typeof loadInitialAuthData>>
-          }
-          signIn: {
-            data: Awaited<ReturnType<typeof signIn>>
-          }
-          updateProfile: {
-            data: TypesGen.User
-          }
-          signOut: {
-            data: Awaited<ReturnType<typeof signOut>>
-          }
-        },
-      },
-      initial: "loadingInitialAuthData",
-      states: {
-        loadingInitialAuthData: {
-          invoke: {
-            src: "loadInitialAuthData",
-            onDone: [
-              {
-                target: "signedIn",
-                actions: ["assignData", "clearError"],
-                cond: "isAuthenticated",
-              },
-              {
-                target: "configuringTheFirstUser",
-                actions: ["assignData", "clearError"],
-                cond: "needSetup",
-              },
-              {
-                target: "signedOut",
-                actions: ["assignData", "clearError"],
-              },
-            ],
-            onError: {
-              target: "signedOut",
-              actions: ["assignError"],
-            },
-          },
-        },
-        signedOut: {
-          on: {
-            SIGN_IN: {
-              target: "signingIn",
-            },
-          },
-        },
-        signingIn: {
-          entry: "clearError",
-          invoke: {
-            src: "signIn",
-            id: "signIn",
-            onDone: [
-              {
-                target: "signedIn",
-                actions: "assignData",
-              },
-            ],
-            onError: [
-              {
-                actions: "assignError",
-                target: "signedOut",
-              },
-            ],
-          },
-        },
-        signedIn: {
-          type: "parallel",
-          on: {
-            SIGN_OUT: {
-              target: "signingOut",
-            },
-          },
-          states: {
-            profile: {
-              initial: "idle",
-              states: {
-                idle: {
-                  initial: "noError",
-                  states: {
-                    noError: {},
-                    error: {},
-                  },
-                  on: {
-                    UPDATE_PROFILE: {
-                      target: "updatingProfile",
-                    },
-                  },
-                },
-                updatingProfile: {
-                  entry: "clearUpdateProfileError",
-                  invoke: {
-                    src: "updateProfile",
-                    onDone: [
-                      {
-                        actions: ["updateUser", "notifySuccessProfileUpdate"],
-                        target: "#authState.signedIn.profile.idle.noError",
-                      },
-                    ],
-                    onError: [
-                      {
-                        actions: "assignUpdateProfileError",
-                        target: "#authState.signedIn.profile.idle.error",
-                      },
-                    ],
-                  },
-                },
-              },
-            },
-          },
-        },
-        signingOut: {
-          invoke: {
-            src: "signOut",
-            id: "signOut",
-            onDone: [
-              {
-                actions: ["clearData", "clearError", "redirect"],
-                cond: "hasRedirectUrl",
-              },
-              {
-                actions: ["clearData", "clearError"],
-                target: "signedOut",
-              },
-            ],
-            onError: [
-              {
-                actions: "assignError",
-                target: "signedIn",
-              },
-            ],
-          },
-        },
-        configuringTheFirstUser: {
-          on: {
-            SIGN_IN: {
-              target: "signingIn",
-            },
-          },
-        },
-      },
-    },
-    {
-      services: {
-        loadInitialAuthData,
-        signIn: (_, { email, password }) => signIn(email, password),
-        signOut,
-        updateProfile: async ({ data }, event) => {
-          if (!data) {
-            throw new Error("Authenticated data is not loaded yet")
-          }
-
-          if (isAuthenticated(data)) {
-            return API.updateProfile(data.user.id, event.data)
-          }
-
-          throw new Error("User not authenticated")
-        },
-      },
-      actions: {
-        assignData: assign({
-          data: (_, { data }) => data,
-        }),
-        clearData: assign({
-          data: (_) => undefined,
-        }),
-        assignError: assign({
-          error: (_, event) => event.data,
-        }),
-        clearError: assign({
-          error: (_) => undefined,
-        }),
-        updateUser: assign({
-          data: (context, event) => {
-            if (!context.data) {
-              throw new Error("No authentication data loaded")
-            }
-
-            return {
-              ...context.data,
-              user: event.data,
-            }
-          },
-        }),
-        assignUpdateProfileError: assign({
-          updateProfileError: (_, event) => event.data,
-        }),
-        notifySuccessProfileUpdate: () => {
-          displaySuccess(Language.successProfileUpdate)
-        },
-        clearUpdateProfileError: assign({
-          updateProfileError: (_) => undefined,
-        }),
-        redirect: (_, _data) => {
-          window.location.href = location.origin
-        },
-      },
-      guards: {
-        isAuthenticated: (_, { data }) => isAuthenticated(data),
-        needSetup: (_, { data }) =>
-          !isAuthenticated(data) && !data.hasFirstUser,
-        hasRedirectUrl: (_, { data }) => Boolean(data),
-      },
-    },
-  )
diff --git a/site/src/xServices/buildInfo/buildInfoXService.ts b/site/src/xServices/buildInfo/buildInfoXService.ts
deleted file mode 100644
index 9d8775f4ff214..0000000000000
--- a/site/src/xServices/buildInfo/buildInfoXService.ts
+++ /dev/null
@@ -1,88 +0,0 @@
-import { assign, createMachine } from "xstate"
-import * as API from "../../api/api"
-import * as TypesGen from "../../api/typesGenerated"
-
-export interface BuildInfoContext {
-  getBuildInfoError?: unknown
-  buildInfo?: TypesGen.BuildInfoResponse
-}
-
-export const buildInfoMachine = createMachine(
-  {
-    id: "buildInfoState",
-    predictableActionArguments: true,
-    tsTypes: {} as import("./buildInfoXService.typegen").Typegen0,
-    schema: {
-      context: {} as BuildInfoContext,
-      services: {} as {
-        getBuildInfo: {
-          data: TypesGen.BuildInfoResponse
-        }
-      },
-    },
-    context: {
-      buildInfo: undefined,
-    },
-    initial: "gettingBuildInfo",
-    states: {
-      gettingBuildInfo: {
-        invoke: {
-          src: "getBuildInfo",
-          id: "getBuildInfo",
-          onDone: [
-            {
-              actions: ["assignBuildInfo", "clearGetBuildInfoError"],
-              target: "#buildInfoState.success",
-            },
-          ],
-          onError: [
-            {
-              actions: ["assignGetBuildInfoError", "clearBuildInfo"],
-              target: "#buildInfoState.failure",
-            },
-          ],
-        },
-      },
-      success: {
-        type: "final",
-      },
-      failure: {
-        type: "final",
-      },
-    },
-  },
-  {
-    services: {
-      getBuildInfo: async () => {
-        // Build info is injected by the Coder server into the HTML document.
-        const buildInfo = document.querySelector("meta[property=build-info]")
-        if (buildInfo) {
-          const rawContent = buildInfo.getAttribute("content")
-          try {
-            return JSON.parse(rawContent as string)
-          } catch (ex) {
-            // Ignore this and fetch as normal!
-          }
-        }
-
-        return API.getBuildInfo()
-      },
-    },
-    actions: {
-      assignBuildInfo: assign({
-        buildInfo: (_, event) => event.data,
-      }),
-      clearBuildInfo: assign((context: BuildInfoContext) => ({
-        ...context,
-        buildInfo: undefined,
-      })),
-      assignGetBuildInfoError: assign({
-        getBuildInfoError: (_, event) => event.data,
-      }),
-      clearGetBuildInfoError: assign((context: BuildInfoContext) => ({
-        ...context,
-        getBuildInfoError: undefined,
-      })),
-    },
-  },
-)
diff --git a/site/src/xServices/createTemplate/createTemplateXService.ts b/site/src/xServices/createTemplate/createTemplateXService.ts
deleted file mode 100644
index 3d4205fc23f05..0000000000000
--- a/site/src/xServices/createTemplate/createTemplateXService.ts
+++ /dev/null
@@ -1,550 +0,0 @@
-import {
-  getTemplateExamples,
-  createTemplateVersion,
-  getTemplateVersion,
-  createTemplate,
-  uploadTemplateFile,
-  getTemplateVersionLogs,
-  getTemplateVersionVariables,
-  getTemplateByName,
-} from "api/api"
-import {
-  ProvisionerJob,
-  ProvisionerJobLog,
-  ProvisionerType,
-  Template,
-  TemplateExample,
-  TemplateVersion,
-  TemplateVersionVariable,
-  UploadResponse,
-  VariableValue,
-} from "api/typesGenerated"
-import { displayError } from "components/GlobalSnackbar/utils"
-import { delay } from "utils/delay"
-import { assign, createMachine } from "xstate"
-
-// for creating a new template:
-// 1. upload template tar or use the example ID
-// 2. create template version
-// 3. wait for it to complete
-// 4. verify if template has missing parameters or variables
-//    a. prompt for params
-//    b. create template version again with the same file hash
-//    c. wait for it to complete
-// 5.create template with the successful template version ID
-// https://github.com/coder/coder/blob/b6703b11c6578b2f91a310d28b6a7e57f0069be6/cli/templatecreate.go#L169-L170
-
-const provisioner: ProvisionerType =
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Playwright needs to use a different provisioner type!
-  typeof (window as any).playwright !== "undefined" ? "echo" : "terraform"
-
-export interface CreateTemplateData {
-  name: string
-  display_name: string
-  description: string
-  icon: string
-  default_ttl_hours: number
-  max_ttl_hours: number
-  allow_user_autostart: boolean
-  allow_user_autostop: boolean
-  allow_user_cancel_workspace_jobs: boolean
-  parameter_values_by_name?: Record<string, string>
-  user_variable_values?: VariableValue[]
-  allow_everyone_group_access: boolean
-}
-interface CreateTemplateContext {
-  organizationId: string
-  error?: unknown
-  jobError?: string
-  jobLogs?: ProvisionerJobLog[]
-  starterTemplate?: TemplateExample
-  exampleId?: string | null // It can be null because it is being passed from query string
-  version?: TemplateVersion
-  templateData?: CreateTemplateData
-  variables?: TemplateVersionVariable[]
-  // file is used in the FE to show the filename and some other visual stuff
-  // uploadedFile is the response from the server to use in the API
-  file?: File
-  uploadResponse?: UploadResponse
-  // When wanting to duplicate a Template
-  templateNameToCopy: string | null // It can be null because it is passed from query string
-  copiedTemplate?: Template
-}
-
-export const createTemplateMachine =
-  /** @xstate-layout N4IgpgJg5mDOIC5QGMBOYCGAXMAVMAtgA4A22YAdLFhqlgJYB2UAxANoAMAuoqEQPax6Dfo14gAHogCMAVgDMFDgA5ZATgBM86dO3z5agDQgAnoi0B2CmosA2WbNsGOF5WpsBfD8bSYc+YjIcKho6JlY2aR4kEAEhETEYqQQ5RRV1LR09A2MzBGVpClkOEo5pABZlZVsNNWllLx90cgDScgoSfgwIcIBlUJxUVqCwFghRSiYAN34Aa0pfFsI24M7uvoGwIeWRhGn+ZGx6UU4uU-E44WPE0GSaxQsLeXLZaTVntQVc8xKlUo59LZbHUXhZGiBFv4du01j1mP1aINhuQWFtUPxUBQVgAzDEECiQvDQ1ZdOFQBF0LbInB7RgzQ4JU7nGKXBLiO5aCiPZ6vd7lT7yb4IWqKF7aN5ucrSYEcWTgwnUyYQEijADCACUAKIAQVwmuZfEEV1E7MQsg0QulHHKFBqxXcNhqWnk8uaUMC7XoytGAFUAAoAGQA8tqACIAfQAYgBJAP67gXI1spLmV5c57yCxyWzWmwOIXyarWDg1R4lDTKDQaaSuvxEj3BL0qlhagCyQYAapqo7H49FDfFrqaEPIOBobQK9C4LLVZELXjanAZ3Pz3LUwd4IW76ytKABXUik8JjCYUfbzAnbxUUA+w8K0+lHE7cA2xJNDlPCtNPcqZ7O5ix81MRBKkUeR1ClcoSlHKVbFrJYG33Q91mYVFUHRTEcTxS862vW8j2YB8DifRgmQTFl3xNT8q3kDQKG0DQs1eJxZHKec7AoAoNAUWVR1qODNwVYkFjdcIcKOZhI3oVBqA7LYhFEE9GEmOk5hE3DhPEhhmC08IpJkrA5Jk64iIZa4yP7N9Byo24QLkIo7Q4NRlABJ55CcS1rVFMdpVAysnI3JoNMQ3SdMhPTpNk+TrjQjCsSCXFUHxISQvCsLRMkyLDOi0RTJIizE2sm5JHMbi6IYpjpXAtjgIQYErGrZQLBsconm45QXUEq9NLSqAKAAdwwK5JIxAApfgACNcH4AAhMBVX4QIwBwCAlJUmYLxS3dQr6wbhqgSMxsm6a5oWpaVryxkX3IgdjWK5JpDHG0oJqNQnPKCtWMtCorA+t4HEqDqXE6oKEO23qBqG7SDqOqbZvmxbSGWyA1rPVTNu61KMt2qG9Nhk6EfOyBLvMl8okKu7hyrc16OkRi5Cqr7auajhbSzDqK0zJiBNB91wexyH9sO1Bxrh07EZVFbUfPdSwZGHbBeh4XRYJs6kYu-YzOfM4NEs1kP1slInooF7anez6aryao6LUWwmuUSpzXNOR4L5+WIb2pX8fhtXJZRtEMXi7BEuSzH+b8MTPbxkXjp9iXkYgEntdffWbJK4Vx3KunKpYy3ECqG06f5fl3P5QKt2C8OJL6u9mFbehYCEZg-VoDACGRmTpfR2W3faCHa6gevG-CFvUDbjvYCT0jrr1yj7pkQCrE0Zz1A66pbe+2xClsLM6hLB1bblLrK-dgWB6HpuoFH8fBlgWLA6wpKtJ3U+I508+G8v6-29vqeCoooqVMtBZ3psxaqnksxKAYixSsjEeYVzln3AWRB0TECwN-CeLANQ6j1CnOew56hOQoJnKCspXAKE0JaCsyg2ZvFok4R6VRXYvyQW-PqvUjIKUYAAdWEAACwwbfLuG0e4sOCBDDhOUeH8MEfJP+M8KbJkNlKWQDluJORcpmQEgpapZFsJxBwFZdD2HKLYD6zDrwSOxpw64vCsACNbj-eS99MIJWwltV+1cdo2NEHYhxY8nEyXkWcG6VlKafhUWo+0mi3IeV0b+RQbgHYWBcNbAo5cPGsK8b1RUwi1LP0sQLHJwlgl4MAZ+aQi9rC1FUM5QswJbBCiag1eozUpQzgsB9DQFiepFOxrkgOrjg7uLDp46GO1FSlNCaneeGdaK01AYzPOCAbBWFkK4H6spijViPpuRg-AIBwHEJknAiiDbpwALRGFqhc1RB97n3JBgg3uwRqCInCGctOyQPpNP0dKIEKTCw6H5DvHpIUB4UiRMJT5sz3JWEqbbR4NQgStSeEKasdEZz2CcBWFw7gmpgu2k2MAMKqauFZs8VwTUVAFDUC8IUW99EqCzO5YoZQS6EvlvhFCUBSURItLVKCVgSiuFgjvT4spOVZOhnyw2ORmZPGsC8KC7k3gzlkA0Y+iDxF9LYfpKKxk04zIIesig-1RxuBsBoMoQJPKMVtBWO2GrrWfHKOUKVOq2GK2jirOORMICyvTik4V7xOkHzFAKvIOhrXEMqKYt6FQmqsQ9T3MSH9h7N0cRPQND1Kj6JBPUYEtFKzOW+i8TiK8NBOCxSylNCsUGI3QVm2+OafglmsBUKtegTHKEtAxM1jtzSZmXgSrVLzU3pTYT46R9jZEyVbfkCwlooJqC5GyqojhxzZzrVYthioF0MxtHYDqjxXgA10L8wobqFAMwBtUTVvMxETvYduANADwmG2te2kEXbjGsV7bVNwS8xTPCMTYMcXgvBAA */
-  createMachine(
-    {
-      id: "createTemplate",
-      predictableActionArguments: true,
-      schema: {
-        context: {} as CreateTemplateContext,
-        events: {} as
-          | { type: "CREATE"; data: CreateTemplateData }
-          | { type: "UPLOAD_FILE"; file: File }
-          | { type: "REMOVE_FILE" },
-        services: {} as {
-          uploadFile: {
-            data: UploadResponse
-          }
-          loadStarterTemplate: {
-            data: TemplateExample
-          }
-          createFirstVersion: {
-            data: TemplateVersion
-          }
-          createVersionWithParametersAndVariables: {
-            data: TemplateVersion
-          }
-          waitForJobToBeCompleted: {
-            data: TemplateVersion
-          }
-          checkParametersAndVariables: {
-            data: {
-              variables?: TemplateVersionVariable[]
-            }
-          }
-          createTemplate: {
-            data: Template
-          }
-          loadVersionLogs: {
-            data: ProvisionerJobLog[]
-          }
-          copyTemplateData: {
-            data: {
-              template: Template
-              version: TemplateVersion
-              variables: TemplateVersionVariable[]
-            }
-          }
-        },
-      },
-      tsTypes: {} as import("./createTemplateXService.typegen").Typegen0,
-      initial: "starting",
-      states: {
-        starting: {
-          always: [
-            { target: "loadingStarterTemplate", cond: "isExampleProvided" },
-            {
-              target: "copyingTemplateData",
-              cond: "isTemplateIdToCopyProvided",
-            },
-            { target: "idle" },
-          ],
-          tags: ["loading"],
-        },
-        loadingStarterTemplate: {
-          invoke: {
-            src: "loadStarterTemplate",
-            onDone: {
-              target: "idle",
-              actions: ["assignStarterTemplate"],
-            },
-            onError: {
-              target: "idle",
-              actions: ["assignError"],
-            },
-          },
-          tags: ["loading"],
-        },
-        copyingTemplateData: {
-          invoke: {
-            src: "copyTemplateData",
-            onDone: [
-              {
-                target: "creating.promptParametersAndVariables",
-                actions: ["assignCopiedTemplateData"],
-                cond: "hasParametersOrVariables",
-              },
-              {
-                target: "idle",
-                actions: ["assignCopiedTemplateData"],
-              },
-            ],
-            onError: {
-              target: "idle",
-              actions: ["assignError"],
-            },
-          },
-          tags: ["loading"],
-        },
-        idle: {
-          on: {
-            CREATE: {
-              target: "creating",
-              actions: ["assignTemplateData"],
-            },
-            UPLOAD_FILE: {
-              actions: ["assignFile"],
-              target: "uploading",
-              cond: "isNotUsingExample",
-            },
-            REMOVE_FILE: {
-              actions: ["removeFile"],
-              cond: "hasFile",
-            },
-          },
-        },
-        uploading: {
-          invoke: {
-            src: "uploadFile",
-            onDone: {
-              target: "idle",
-              actions: ["assignUploadResponse"],
-            },
-            onError: {
-              target: "idle",
-              actions: ["displayUploadError", "removeFile"],
-            },
-          },
-        },
-        creating: {
-          initial: "creatingFirstVersion",
-          states: {
-            creatingFirstVersion: {
-              invoke: {
-                src: "createFirstVersion",
-                onDone: {
-                  target: "waitingForJobToBeCompleted",
-                  actions: ["assignVersion"],
-                },
-                onError: {
-                  actions: ["assignError"],
-                  target: "#createTemplate.idle",
-                },
-              },
-              tags: ["submitting"],
-            },
-            waitingForJobToBeCompleted: {
-              invoke: {
-                src: "waitForJobToBeCompleted",
-                onDone: [
-                  {
-                    target: "loadingVersionLogs",
-                    actions: ["assignJobError", "assignVersion"],
-                    cond: "hasFailed",
-                  },
-                  {
-                    target: "checkingParametersAndVariables",
-                    actions: ["assignVersion"],
-                  },
-                ],
-                onError: {
-                  target: "#createTemplate.idle",
-                  actions: ["assignError"],
-                },
-              },
-              tags: ["submitting"],
-            },
-            checkingParametersAndVariables: {
-              invoke: {
-                src: "checkParametersAndVariables",
-                onDone: [
-                  {
-                    target: "creatingTemplate",
-                    cond: "hasNoParametersOrVariables",
-                  },
-                  {
-                    target: "promptParametersAndVariables",
-                    actions: ["assignParametersAndVariables"],
-                  },
-                ],
-                onError: {
-                  target: "#createTemplate.idle",
-                  actions: ["assignError"],
-                },
-              },
-              tags: ["submitting"],
-            },
-            promptParametersAndVariables: {
-              on: {
-                CREATE: {
-                  target: "creatingVersionWithParametersAndVariables",
-                  actions: ["assignTemplateData"],
-                },
-              },
-            },
-            creatingVersionWithParametersAndVariables: {
-              invoke: {
-                src: "createVersionWithParametersAndVariables",
-                onDone: {
-                  target: "waitingForJobToBeCompleted",
-                  actions: ["assignVersion"],
-                },
-                onError: {
-                  actions: ["assignError"],
-                  target: "promptParametersAndVariables",
-                },
-              },
-              tags: ["submitting"],
-            },
-            creatingTemplate: {
-              invoke: {
-                src: "createTemplate",
-                onDone: {
-                  target: "created",
-                  actions: ["onCreate"],
-                },
-                onError: {
-                  actions: ["assignError"],
-                  target: "#createTemplate.idle",
-                },
-              },
-              tags: ["submitting"],
-            },
-            created: {
-              type: "final",
-            },
-            loadingVersionLogs: {
-              invoke: {
-                src: "loadVersionLogs",
-                onDone: {
-                  target: "#createTemplate.idle",
-                  actions: ["assignJobLogs"],
-                },
-                onError: {
-                  target: "#createTemplate.idle",
-                  actions: ["assignError"],
-                },
-              },
-            },
-          },
-        },
-      },
-    },
-    {
-      services: {
-        uploadFile: (_, { file }) => uploadTemplateFile(file),
-        loadStarterTemplate: async ({ organizationId, exampleId }) => {
-          if (!exampleId) {
-            throw new Error(`Example ID is not defined.`)
-          }
-          const examples = await getTemplateExamples(organizationId)
-          const starterTemplate = examples.find(
-            (example) => example.id === exampleId,
-          )
-          if (!starterTemplate) {
-            throw new Error(`Example ${exampleId} not found.`)
-          }
-          return starterTemplate
-        },
-        copyTemplateData: async ({ organizationId, templateNameToCopy }) => {
-          if (!organizationId) {
-            throw new Error("No organization ID provided")
-          }
-          if (!templateNameToCopy) {
-            throw new Error("No template name to copy provided")
-          }
-          const template = await getTemplateByName(
-            organizationId,
-            templateNameToCopy,
-          )
-          const [version, variables] = await Promise.all([
-            getTemplateVersion(template.active_version_id),
-            getTemplateVersionVariables(template.active_version_id),
-          ])
-
-          return {
-            template,
-            version,
-            variables,
-          }
-        },
-        createFirstVersion: async ({
-          organizationId,
-          templateNameToCopy,
-          exampleId,
-          uploadResponse,
-          version,
-        }) => {
-          if (exampleId) {
-            return createTemplateVersion(organizationId, {
-              storage_method: "file",
-              example_id: exampleId,
-              provisioner: provisioner,
-              tags: {},
-            })
-          }
-
-          if (templateNameToCopy) {
-            if (!version) {
-              throw new Error(
-                "Can't copy template due to a missing template version",
-              )
-            }
-
-            return createTemplateVersion(organizationId, {
-              storage_method: "file",
-              file_id: version.job.file_id,
-              provisioner: provisioner,
-              tags: {},
-            })
-          }
-
-          if (uploadResponse) {
-            return createTemplateVersion(organizationId, {
-              storage_method: "file",
-              file_id: uploadResponse.hash,
-              provisioner: provisioner,
-              tags: {},
-            })
-          }
-
-          throw new Error("No file or example provided")
-        },
-        createVersionWithParametersAndVariables: async ({
-          organizationId,
-          templateData,
-          version,
-        }) => {
-          if (!version) {
-            throw new Error("No previous version found")
-          }
-          if (!templateData) {
-            throw new Error("No template data defined")
-          }
-
-          return createTemplateVersion(organizationId, {
-            storage_method: "file",
-            file_id: version.job.file_id,
-            provisioner: provisioner,
-            user_variable_values: templateData.user_variable_values,
-            tags: {},
-          })
-        },
-        waitForJobToBeCompleted: async ({ version }) => {
-          if (!version) {
-            throw new Error("Version not defined")
-          }
-
-          let job = version.job
-          while (isPendingOrRunning(job)) {
-            version = await getTemplateVersion(version.id)
-            job = version.job
-
-            // Delay the verification in two seconds to not overload the server
-            // with too many requests Maybe at some point we could have a
-            // websocket for template version Also, preferred doing this way to
-            // avoid a new state since we don't need to reflect it on the UI
-            if (isPendingOrRunning(job)) {
-              await delay(2_000)
-            }
-          }
-          return version
-        },
-        checkParametersAndVariables: async ({ version }) => {
-          if (!version) {
-            throw new Error("Version not defined")
-          }
-
-          let promiseVariables: Promise<TemplateVersionVariable[]> | undefined =
-            undefined
-
-          if (isMissingVariables(version)) {
-            promiseVariables = getTemplateVersionVariables(version.id)
-          }
-
-          const [variables] = await Promise.all([promiseVariables])
-
-          return {
-            variables,
-          }
-        },
-        createTemplate: async ({ organizationId, version, templateData }) => {
-          if (!version) {
-            throw new Error("Version not defined")
-          }
-
-          if (!templateData) {
-            throw new Error("Template data not defined")
-          }
-
-          const {
-            default_ttl_hours,
-            max_ttl_hours,
-            parameter_values_by_name,
-            allow_everyone_group_access,
-            ...safeTemplateData
-          } = templateData
-
-          return createTemplate(organizationId, {
-            ...safeTemplateData,
-            disable_everyone_group_access: !allow_everyone_group_access,
-            default_ttl_ms: templateData.default_ttl_hours * 60 * 60 * 1000, // Convert hours to ms
-            max_ttl_ms: templateData.max_ttl_hours * 60 * 60 * 1000, // Convert hours to ms
-            template_version_id: version.id,
-          })
-        },
-        loadVersionLogs: ({ version }) => {
-          if (!version) {
-            throw new Error("Version is not set")
-          }
-
-          return getTemplateVersionLogs(version.id)
-        },
-      },
-      actions: {
-        assignError: assign({ error: (_, { data }) => data }),
-        assignJobError: assign({ jobError: (_, { data }) => data.job.error }),
-        displayUploadError: () => {
-          displayError("Error on upload the file.")
-        },
-        assignStarterTemplate: assign({
-          starterTemplate: (_, { data }) => data,
-        }),
-        assignVersion: assign({ version: (_, { data }) => data }),
-        assignTemplateData: assign({ templateData: (_, { data }) => data }),
-        assignParametersAndVariables: assign({
-          variables: (_, { data }) => data.variables,
-        }),
-        assignFile: assign({ file: (_, { file }) => file }),
-        assignUploadResponse: assign({ uploadResponse: (_, { data }) => data }),
-        removeFile: assign({
-          file: (_) => undefined,
-          uploadResponse: (_) => undefined,
-        }),
-        assignJobLogs: assign({ jobLogs: (_, { data }) => data }),
-        assignCopiedTemplateData: assign({
-          copiedTemplate: (_, { data }) => data.template,
-          version: (_, { data }) => data.version,
-          variables: (_, { data }) => data.variables,
-        }),
-      },
-      guards: {
-        isExampleProvided: ({ exampleId }) => Boolean(exampleId),
-        isTemplateIdToCopyProvided: ({ templateNameToCopy }) =>
-          Boolean(templateNameToCopy),
-        isNotUsingExample: ({ exampleId }) => !exampleId,
-        hasFile: ({ file }) => Boolean(file),
-        hasFailed: (_, { data }) =>
-          Boolean(
-            data.job.status === "failed" &&
-              !isMissingParameter(data) &&
-              !isMissingVariables(data),
-          ),
-        hasNoParametersOrVariables: (_, { data }) =>
-          data.variables === undefined,
-        hasParametersOrVariables: (_, { data }) => {
-          return data.variables.length > 0
-        },
-      },
-    },
-  )
-
-const isMissingParameter = (version: TemplateVersion) => {
-  return Boolean(
-    version.job.error_code &&
-      version.job.error_code === "MISSING_TEMPLATE_PARAMETER",
-  )
-}
-
-const isMissingVariables = (version: TemplateVersion) => {
-  return Boolean(
-    version.job.error_code &&
-      version.job.error_code === "REQUIRED_TEMPLATE_VARIABLES",
-  )
-}
-
-const isPendingOrRunning = (job: ProvisionerJob) => {
-  return job.status === "pending" || job.status === "running"
-}
diff --git a/site/src/xServices/createWorkspace/createWorkspaceXService.ts b/site/src/xServices/createWorkspace/createWorkspaceXService.ts
deleted file mode 100644
index 0df9f13a1c3ab..0000000000000
--- a/site/src/xServices/createWorkspace/createWorkspaceXService.ts
+++ /dev/null
@@ -1,233 +0,0 @@
-import {
-  checkAuthorization,
-  createWorkspace,
-  getTemplateByName,
-  getTemplateVersionGitAuth,
-  getTemplateVersionRichParameters,
-} from "api/api"
-import {
-  CreateWorkspaceRequest,
-  Template,
-  TemplateVersionGitAuth,
-  TemplateVersionParameter,
-  User,
-  Workspace,
-  WorkspaceBuildParameter,
-} from "api/typesGenerated"
-import { assign, createMachine } from "xstate"
-import { paramsUsedToCreateWorkspace } from "utils/workspace"
-import { REFRESH_GITAUTH_BROADCAST_CHANNEL } from "utils/gitAuth"
-
-export type CreateWorkspaceMode = "form" | "auto"
-
-type CreateWorkspaceContext = {
-  organizationId: string
-  templateName: string
-  mode: CreateWorkspaceMode
-  defaultName: string
-  error?: unknown
-  // Form
-  template?: Template
-  parameters?: TemplateVersionParameter[]
-  permissions?: Record<string, boolean>
-  gitAuth?: TemplateVersionGitAuth[]
-  // Used on auto-create
-  defaultBuildParameters?: WorkspaceBuildParameter[]
-}
-
-type CreateWorkspaceEvent = {
-  type: "CREATE_WORKSPACE"
-  request: CreateWorkspaceRequest
-  owner: User
-}
-
-type RefreshGitAuthEvent = {
-  type: "REFRESH_GITAUTH"
-}
-
-export const createWorkspaceMachine =
-  /** @xstate-layout N4IgpgJg5mDOIC5QGMBOYCGAXMB1A9qgNawAOGyYAyltmAHQxZYCWAdlACpgC2pANnVgBiCPjYN2AN3xEGaTDgLEyFarRyMwzdl14ChCafmTYW4gNoAGALrWbiUKXywWrcY5AAPRABYATAA0IACeiACMvgCs9ADssQBsVgDM-v5JyQnJUQkAvrnBCnTKJOSUNHRaOhzcfII4ImIS9MZy9EVKhKVqFZpMrDX69XBGbDKm7mz2FuEOSCDOrpOePgjJAJzr9AAcVr4J677bCeFWB3vBYQgBvvQJB-5R6+GxVulPUfmF6MVdquUaBj9XS1AwNYRgVCoQj0MEAM0IPHaP06KjK6kqwMGdUMxgm5imtnsnkWbgJK0QGy2u32h2Op3OvkuiH8vis9HCDxO0XC2z5CX8XxAHTwf3RvSB2gGehxOCoyAAFrwMKJxJIxrJ5CjRWieoCqtLQcN5UqeBhRuMzJYibYSS4yR55qtTv52bFeYlfPEor4XuFmddwlscqz1mdfMlfZlfEKRSV-hi+lKQUM6CblRCoTD4YjkYodd0AZjk9iwdRFcqLSYrYS7Lb5qTlk6Im83R6El7Yj6-QH4gl6M8ctsoht7skrJ8CsLtfHxfqsTKywAFDCoDA8bSQxpqloatpxsV64vVRfDFdrjc4VCwKv4611uZOe1N0DOgXhOKRjZf-axR4Btl2XWWJngSKJtgCHJwnSWMZ0PIskxPI06HPddN2vTNoVQWF6gRVAkQPXUEMlJDUxwVDLy3W8a2mesnyWclmwQTl-A-WIv3WH8Ej-KIAyyW4Em2Z5XV5fx1m48JYPzWcj0Qw0yLAABxNwAEEAFcsAVVVmlaLVpPgxMSPk2UlNUjSFWoyZaMfBZn0Y18WSDfsfUEvlfEHViA2SbZ-HoDZwPSe4omCwUp0IwtDINFMTOUrB1M0zDs1w3NwoTCUotLYZYviiy8Rom0bMbezvEc8T6BcvkII8-1Qj8dZfP2R4fXEziUliKTfiIyKK2QIhdCXSEeBYWBXHEbcdL3eQlV6gb8OG0a2FgYkGzsx0HIQfwfJiKJXmSZJoO88IRwAqwP22aD3OeLshP2DrUQi9Ker6jhZqGkaCRESEsJw7A8II6aiFe+aPuW+iHTYCkNqiKxtgHVi+XWYK2SZWqNr5HZslAiNoJSSdvn0rr0rhFh+H4frV3XEQAGEACUAFEVM4OmAH1cAAeRpgBpKglxUqm6dB2yGLWkq0cecrdv2-xDuO1GXluRH9s5H1wKObi7oLNL9WJ0nyYvEQqDpgAZOmqc4Zm2dwAA5OmacFoqRdWcd0asSWkZuoJUbSftpc2vZ6rZDsXg1mTiLzMwOFDsBtPVGR9zgwn9Q6XQo8sglrLtYWIaYzbxZ2lIpZl5IA3O+hLvWeleSiVj6pDgzHpRFODMS7Cc3w8P7q1ypk8jgy0-ve3Vuz9bc+2yWDvO2WrjE2HMcybZYiOHJYm2fIpzYfAIDgTxUrnOhM-ByGAFoEgDE-6CsS+3n8d0nl9aW8enAmHvnEtTyEA+X1F4cOWryM0k5JyTiAZWS3DSKBdIC9zjZDronY8xkyzpjNJ-YqqxXjORXuEfaEYAh9gAtLO4aQNgenqkdSMsCX7wOisuCmlFrwoMdhETazl9hCQ2NLKwFd1gnRiCkMM51og8k2BQruclqFZTMppBhw9RZBldvQTa0FzgdnuF5Y4ZdgrumyI8JyC8RF700E9fqg1gZjWkZDUBWwDgjjElgnawE1GxAUUJPYglwIjjeDGMKCdKGaB1mTF6tD4ArSzpDfabwdiXxApseqtjT6o1SE4txrVXTpHSF4-GnVfF6QjlAKO5ic5RCOn5LsbwjpHWeJyAMZVThHUgvcCSvp9GyRyTgCABT1rhN8rsV2MTYmgQDC6BR7xuznByCcZpYcvqEA6aLSxdxFa2OyCBWIAYimwxXvwoMrp3GrzXkAA */
-  createMachine(
-    {
-      id: "createWorkspaceState",
-      predictableActionArguments: true,
-      tsTypes: {} as import("./createWorkspaceXService.typegen").Typegen0,
-      schema: {
-        context: {} as CreateWorkspaceContext,
-        events: {} as CreateWorkspaceEvent | RefreshGitAuthEvent,
-        services: {} as {
-          loadFormData: {
-            data: {
-              template: Template
-              permissions: CreateWSPermissions
-              parameters: TemplateVersionParameter[]
-              gitAuth: TemplateVersionGitAuth[]
-            }
-          }
-          createWorkspace: {
-            data: Workspace
-          }
-          autoCreateWorkspace: {
-            data: Workspace
-          }
-        },
-      },
-      initial: "checkingMode",
-      states: {
-        checkingMode: {
-          always: [
-            {
-              target: "autoCreating",
-              cond: ({ mode }) => mode === "auto",
-            },
-            { target: "loadingFormData" },
-          ],
-        },
-        autoCreating: {
-          invoke: {
-            src: "autoCreateWorkspace",
-            onDone: {
-              actions: ["onCreateWorkspace"],
-            },
-            onError: {
-              actions: ["assignError"],
-              target: "loadingFormData",
-            },
-          },
-        },
-        loadingFormData: {
-          invoke: {
-            src: "loadFormData",
-            onDone: {
-              target: "idle",
-              actions: ["assignFormData"],
-            },
-            onError: {
-              target: "loadError",
-              actions: ["assignError"],
-            },
-          },
-        },
-        idle: {
-          invoke: [
-            {
-              src: () => (callback) => {
-                const channel = watchGitAuthRefresh(() => {
-                  callback("REFRESH_GITAUTH")
-                })
-                return () => channel.close()
-              },
-            },
-          ],
-          on: {
-            CREATE_WORKSPACE: {
-              target: "creatingWorkspace",
-            },
-          },
-        },
-        creatingWorkspace: {
-          entry: "clearError",
-          invoke: {
-            src: "createWorkspace",
-            onDone: {
-              actions: ["onCreateWorkspace"],
-              target: "created",
-            },
-            onError: {
-              actions: ["assignError"],
-              target: "idle",
-            },
-          },
-        },
-        created: {
-          type: "final",
-        },
-        loadError: {
-          type: "final",
-        },
-      },
-    },
-    {
-      services: {
-        createWorkspace: ({ organizationId }, { request, owner }) => {
-          return createWorkspace(organizationId, owner.id, request)
-        },
-        autoCreateWorkspace: async ({
-          templateName,
-          organizationId,
-          defaultBuildParameters,
-          defaultName,
-        }) => {
-          const template = await getTemplateByName(organizationId, templateName)
-          return createWorkspace(organizationId, "me", {
-            template_id: template.id,
-            name: defaultName,
-            rich_parameter_values: defaultBuildParameters,
-          })
-        },
-        loadFormData: async ({ templateName, organizationId }) => {
-          const [template, permissions] = await Promise.all([
-            getTemplateByName(organizationId, templateName),
-            checkCreateWSPermissions(organizationId),
-          ])
-          const [parameters, gitAuth] = await Promise.all([
-            getTemplateVersionRichParameters(template.active_version_id).then(
-              (p) => p.filter(paramsUsedToCreateWorkspace),
-            ),
-            getTemplateVersionGitAuth(template.active_version_id),
-          ])
-
-          return {
-            template,
-            permissions,
-            parameters,
-            gitAuth,
-          }
-        },
-      },
-      actions: {
-        assignFormData: assign((ctx, event) => {
-          return {
-            ...ctx,
-            ...event.data,
-          }
-        }),
-        assignError: assign({
-          error: (_, event) => event.data,
-        }),
-        clearError: assign({
-          error: (_) => undefined,
-        }),
-      },
-    },
-  )
-
-const checkCreateWSPermissions = async (organizationId: string) => {
-  // HACK: below, we pass in * for the owner_id, which is a hacky way of checking if the
-  // current user can create a workspace on behalf of anyone within the org (only org owners should be able to do this).
-  // This pattern should not be replicated outside of this narrow use case.
-  const permissionsToCheck = {
-    createWorkspaceForUser: {
-      object: {
-        resource_type: "workspace",
-        organization_id: organizationId,
-        owner_id: "*",
-      },
-      action: "create",
-    },
-  } as const
-
-  return checkAuthorization({
-    checks: permissionsToCheck,
-  }) as Promise<Record<keyof typeof permissionsToCheck, boolean>>
-}
-
-export const watchGitAuthRefresh = (callback: () => void) => {
-  const bc = new BroadcastChannel(REFRESH_GITAUTH_BROADCAST_CHANNEL)
-  bc.addEventListener("message", callback)
-  return bc
-}
-
-export type CreateWSPermissions = Awaited<
-  ReturnType<typeof checkCreateWSPermissions>
->
diff --git a/site/src/xServices/deploymentConfig/deploymentConfigMachine.ts b/site/src/xServices/deploymentConfig/deploymentConfigMachine.ts
deleted file mode 100644
index 52ecc37223db9..0000000000000
--- a/site/src/xServices/deploymentConfig/deploymentConfigMachine.ts
+++ /dev/null
@@ -1,86 +0,0 @@
-import { DAUsResponse } from "./../../api/typesGenerated"
-import { getDeploymentValues, getDeploymentDAUs } from "api/api"
-import { createMachine, assign } from "xstate"
-import { DeploymentConfig } from "api/types"
-
-export const deploymentConfigMachine = createMachine(
-  {
-    id: "deploymentConfigMachine",
-    predictableActionArguments: true,
-
-    schema: {
-      context: {} as {
-        deploymentValues?: DeploymentConfig
-        getDeploymentValuesError?: unknown
-        deploymentDAUs?: DAUsResponse
-        getDeploymentDAUsError?: unknown
-      },
-      events: {} as { type: "LOAD" },
-      services: {} as {
-        getDeploymentValues: {
-          data: DeploymentConfig
-        }
-        getDeploymentDAUs: {
-          data: DAUsResponse
-        }
-      },
-    },
-    tsTypes: {} as import("./deploymentConfigMachine.typegen").Typegen0,
-    initial: "config",
-    states: {
-      config: {
-        invoke: {
-          src: "getDeploymentValues",
-          onDone: {
-            target: "daus",
-            actions: ["assignDeploymentValues"],
-          },
-          onError: {
-            target: "daus",
-            actions: ["assignGetDeploymentValuesError"],
-          },
-        },
-        tags: "loading",
-      },
-      daus: {
-        invoke: {
-          src: "getDeploymentDAUs",
-          onDone: {
-            target: "done",
-            actions: ["assignDeploymentDAUs"],
-          },
-          onError: {
-            target: "done",
-            actions: ["assignGetDeploymentDAUsError"],
-          },
-        },
-        tags: "loading",
-      },
-      done: {
-        type: "final",
-      },
-    },
-  },
-  {
-    services: {
-      getDeploymentValues: getDeploymentValues,
-      getDeploymentDAUs: async () => {
-        return getDeploymentDAUs()
-      },
-    },
-    actions: {
-      assignDeploymentValues: assign({
-        deploymentValues: (_, { data }) => data,
-      }),
-      assignGetDeploymentValuesError: assign({
-        getDeploymentValuesError: (_, { data }) => data,
-      }),
-      assignDeploymentDAUs: assign({
-        deploymentDAUs: (_, { data }) => data,
-      }),
-      assignGetDeploymentDAUsError: assign({
-        getDeploymentDAUsError: (_, { data }) => data,
-      }),
-    },
-  },
-)
diff --git a/site/src/xServices/deploymentStats/deploymentStatsMachine.ts b/site/src/xServices/deploymentStats/deploymentStatsMachine.ts
deleted file mode 100644
index a68447b54b45a..0000000000000
--- a/site/src/xServices/deploymentStats/deploymentStatsMachine.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import { getDeploymentStats } from "api/api"
-import { DeploymentStats } from "api/typesGenerated"
-import { assign, createMachine } from "xstate"
-
-export const deploymentStatsMachine = createMachine(
-  {
-    id: "deploymentStatsMachine",
-    predictableActionArguments: true,
-
-    schema: {
-      context: {} as {
-        deploymentStats?: DeploymentStats
-        getDeploymentStatsError?: unknown
-      },
-      events: {} as { type: "RELOAD" },
-      services: {} as {
-        getDeploymentStats: {
-          data: DeploymentStats
-        }
-      },
-    },
-    tsTypes: {} as import("./deploymentStatsMachine.typegen").Typegen0,
-    initial: "stats",
-    states: {
-      stats: {
-        invoke: {
-          src: "getDeploymentStats",
-          onDone: {
-            target: "idle",
-            actions: ["assignDeploymentStats"],
-          },
-          onError: {
-            target: "idle",
-            actions: ["assignDeploymentStatsError"],
-          },
-        },
-        tags: "loading",
-      },
-      idle: {
-        on: {
-          RELOAD: "stats",
-        },
-      },
-    },
-  },
-  {
-    services: {
-      getDeploymentStats: getDeploymentStats,
-    },
-    actions: {
-      assignDeploymentStats: assign({
-        deploymentStats: (_, { data }) => data,
-      }),
-      assignDeploymentStatsError: assign({
-        getDeploymentStatsError: (_, { data }) => data,
-      }),
-    },
-  },
-)
diff --git a/site/src/xServices/entitlements/entitlementsSelectors.test.ts b/site/src/xServices/entitlements/entitlementsSelectors.test.ts
deleted file mode 100644
index 9d179457a6e2e..0000000000000
--- a/site/src/xServices/entitlements/entitlementsSelectors.test.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import { getFeatureVisibility } from "./entitlementsSelectors"
-
-describe("getFeatureVisibility", () => {
-  it("returns empty object if there is no license", () => {
-    const result = getFeatureVisibility(false, {
-      audit_log: { entitlement: "entitled", enabled: true },
-    })
-    expect(result).toEqual(expect.objectContaining({}))
-  })
-  it("returns false for a feature that is not enabled", () => {
-    const result = getFeatureVisibility(true, {
-      audit_log: { entitlement: "entitled", enabled: false },
-    })
-    expect(result).toEqual(expect.objectContaining({ audit_log: false }))
-  })
-  it("returns false for a feature that is not entitled", () => {
-    const result = getFeatureVisibility(true, {
-      audit_log: { entitlement: "not_entitled", enabled: true },
-    })
-    expect(result).toEqual(expect.objectContaining({ audit_log: false }))
-  })
-  it("returns true for a feature that is in grace period", () => {
-    const result = getFeatureVisibility(true, {
-      audit_log: { entitlement: "grace_period", enabled: true },
-    })
-    expect(result).toEqual(expect.objectContaining({ audit_log: true }))
-  })
-  it("returns true for a feature that is in entitled", () => {
-    const result = getFeatureVisibility(true, {
-      audit_log: { entitlement: "entitled", enabled: true },
-    })
-    expect(result).toEqual(expect.objectContaining({ audit_log: true }))
-  })
-})
diff --git a/site/src/xServices/entitlements/entitlementsSelectors.ts b/site/src/xServices/entitlements/entitlementsSelectors.ts
deleted file mode 100644
index 5777700604625..0000000000000
--- a/site/src/xServices/entitlements/entitlementsSelectors.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import { Entitlements, Feature, FeatureName } from "api/typesGenerated"
-
-/**
- * @param hasLicense true if Enterprise edition
- * @param features record from feature name to feature object
- * @returns record from feature name whether to show the feature
- */
-export const getFeatureVisibility = (
-  hasLicense: boolean,
-  features: Record<string, Feature>,
-): Record<string, boolean> => {
-  if (hasLicense) {
-    const permissionPairs = Object.keys(features).map((feature) => {
-      const { entitlement, limit, actual, enabled } = features[feature]
-      const entitled = ["entitled", "grace_period"].includes(entitlement)
-      const limitCompliant = limit && actual ? limit >= actual : true
-      return [feature, entitled && limitCompliant && enabled]
-    })
-    return Object.fromEntries(permissionPairs)
-  } else {
-    return {}
-  }
-}
-
-export const selectFeatureVisibility = (
-  entitlements: Entitlements,
-): Record<FeatureName, boolean> => {
-  return getFeatureVisibility(entitlements.has_license, entitlements.features)
-}
diff --git a/site/src/xServices/entitlements/entitlementsXService.ts b/site/src/xServices/entitlements/entitlementsXService.ts
deleted file mode 100644
index 1b35c39b797d2..0000000000000
--- a/site/src/xServices/entitlements/entitlementsXService.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import { assign, createMachine } from "xstate"
-import * as API from "../../api/api"
-import { Entitlements } from "../../api/typesGenerated"
-
-export type EntitlementsContext = {
-  entitlements?: Entitlements
-  getEntitlementsError?: unknown
-}
-
-export const entitlementsMachine = createMachine(
-  {
-    id: "entitlementsMachine",
-    predictableActionArguments: true,
-    tsTypes: {} as import("./entitlementsXService.typegen").Typegen0,
-    schema: {
-      context: {} as EntitlementsContext,
-      services: {
-        getEntitlements: {
-          data: {} as Entitlements,
-        },
-      },
-    },
-    initial: "gettingEntitlements",
-    states: {
-      gettingEntitlements: {
-        entry: "clearGetEntitlementsError",
-        invoke: {
-          id: "getEntitlements",
-          src: "getEntitlements",
-          onDone: {
-            target: "success",
-            actions: ["assignEntitlements"],
-          },
-          onError: {
-            target: "error",
-            actions: ["assignGetEntitlementsError"],
-          },
-        },
-      },
-      success: {
-        type: "final",
-      },
-      error: {
-        type: "final",
-      },
-    },
-  },
-  {
-    actions: {
-      assignEntitlements: assign({
-        entitlements: (_, event) => event.data,
-      }),
-      assignGetEntitlementsError: assign({
-        getEntitlementsError: (_, event) => event.data,
-      }),
-      clearGetEntitlementsError: assign({
-        getEntitlementsError: (_) => undefined,
-      }),
-    },
-    services: {
-      getEntitlements: async () => {
-        // Entitlements is injected by the Coder server into the HTML document.
-        const entitlements = document.querySelector(
-          "meta[property=entitlements]",
-        )
-        if (entitlements) {
-          const rawContent = entitlements.getAttribute("content")
-          try {
-            return JSON.parse(rawContent as string)
-          } catch (ex) {
-            // Ignore this and fetch as normal!
-          }
-        }
-
-        return API.getEntitlements()
-      },
-    },
-  },
-)
diff --git a/site/src/xServices/experiments/experimentsMachine.ts b/site/src/xServices/experiments/experimentsMachine.ts
deleted file mode 100644
index 53bd5a7d86568..0000000000000
--- a/site/src/xServices/experiments/experimentsMachine.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-import { getExperiments } from "api/api"
-import { Experiment } from "api/typesGenerated"
-import { createMachine, assign } from "xstate"
-
-export interface ExperimentsContext {
-  experiments?: Experiment[]
-  getExperimentsError?: unknown
-}
-
-export const experimentsMachine = createMachine(
-  {
-    id: "experimentsState",
-    predictableActionArguments: true,
-    tsTypes: {} as import("./experimentsMachine.typegen").Typegen0,
-    schema: {
-      context: {} as ExperimentsContext,
-      services: {} as {
-        getExperiments: {
-          data: Experiment[]
-        }
-      },
-    },
-    initial: "gettingExperiments",
-    states: {
-      gettingExperiments: {
-        invoke: {
-          src: "getExperiments",
-          id: "getExperiments",
-          onDone: [
-            {
-              actions: ["assignExperiments", "clearGetExperimentsError"],
-              target: "#experimentsState.success",
-            },
-          ],
-          onError: [
-            {
-              actions: ["assignGetExperimentsError", "clearExperiments"],
-              target: "#experimentsState.failure",
-            },
-          ],
-        },
-      },
-      success: {
-        type: "final",
-      },
-      failure: {
-        type: "final",
-      },
-    },
-  },
-  {
-    services: {
-      getExperiments: async () => {
-        // Experiments is injected by the Coder server into the HTML document.
-        const experiments = document.querySelector("meta[property=experiments]")
-        if (experiments) {
-          const rawContent = experiments.getAttribute("content")
-          try {
-            return JSON.parse(rawContent as string)
-          } catch (ex) {
-            // Ignore this and fetch as normal!
-          }
-        }
-
-        return getExperiments()
-      },
-    },
-    actions: {
-      assignExperiments: assign({
-        experiments: (_, event) => event.data,
-      }),
-      clearExperiments: assign((context: ExperimentsContext) => ({
-        ...context,
-        experiments: undefined,
-      })),
-      assignGetExperimentsError: assign({
-        getExperimentsError: (_, event) => event.data,
-      }),
-      clearGetExperimentsError: assign((context: ExperimentsContext) => ({
-        ...context,
-        getExperimentsError: undefined,
-      })),
-    },
-  },
-)
diff --git a/site/src/xServices/groups/createGroupXService.ts b/site/src/xServices/groups/createGroupXService.ts
deleted file mode 100644
index 404c79325d0bb..0000000000000
--- a/site/src/xServices/groups/createGroupXService.ts
+++ /dev/null
@@ -1,59 +0,0 @@
-import { createGroup } from "api/api"
-import { CreateGroupRequest, Group } from "api/typesGenerated"
-import { createMachine, assign } from "xstate"
-
-export const createGroupMachine = createMachine(
-  {
-    id: "createGroupMachine",
-    schema: {
-      context: {} as {
-        organizationId: string
-        error?: unknown
-      },
-      services: {} as {
-        createGroup: {
-          data: Group
-        }
-      },
-      events: {} as {
-        type: "CREATE"
-        data: CreateGroupRequest
-      },
-    },
-    tsTypes: {} as import("./createGroupXService.typegen").Typegen0,
-    initial: "idle",
-    states: {
-      idle: {
-        on: {
-          CREATE: {
-            target: "creatingGroup",
-          },
-        },
-      },
-      creatingGroup: {
-        invoke: {
-          src: "createGroup",
-          onDone: {
-            target: "idle",
-            actions: ["onCreate"],
-          },
-          onError: {
-            target: "idle",
-            actions: ["assignError"],
-          },
-        },
-      },
-    },
-  },
-  {
-    services: {
-      createGroup: ({ organizationId }, { data }) =>
-        createGroup(organizationId, data),
-    },
-    actions: {
-      assignError: assign({
-        error: (_, event) => event.data,
-      }),
-    },
-  },
-)
diff --git a/site/src/xServices/groups/editGroupXService.ts b/site/src/xServices/groups/editGroupXService.ts
deleted file mode 100644
index ef919b7db72d3..0000000000000
--- a/site/src/xServices/groups/editGroupXService.ts
+++ /dev/null
@@ -1,100 +0,0 @@
-import { getGroup, patchGroup } from "api/api"
-import { getErrorMessage } from "api/errors"
-import { Group } from "api/typesGenerated"
-import { displayError } from "components/GlobalSnackbar/utils"
-import { assign, createMachine } from "xstate"
-
-export const editGroupMachine = createMachine(
-  {
-    id: "editGroup",
-    schema: {
-      context: {} as {
-        groupId: string
-        group?: Group
-        error?: unknown
-      },
-      services: {} as {
-        loadGroup: {
-          data: Group
-        }
-        updateGroup: {
-          data: Group
-        }
-      },
-      events: {} as {
-        type: "UPDATE"
-        data: {
-          display_name: string
-          name: string
-          avatar_url: string
-          quota_allowance: number
-        }
-      },
-    },
-    tsTypes: {} as import("./editGroupXService.typegen").Typegen0,
-    initial: "loading",
-    states: {
-      loading: {
-        invoke: {
-          src: "loadGroup",
-          onDone: {
-            actions: ["assignGroup"],
-            target: "idle",
-          },
-          onError: {
-            actions: ["displayLoadGroupError"],
-            target: "idle",
-          },
-        },
-      },
-      idle: {
-        on: {
-          UPDATE: {
-            target: "updating",
-          },
-        },
-      },
-      updating: {
-        invoke: {
-          src: "updateGroup",
-          onDone: {
-            actions: ["onUpdate"],
-          },
-          onError: {
-            target: "idle",
-            actions: ["assignError"],
-          },
-        },
-      },
-    },
-  },
-  {
-    services: {
-      loadGroup: ({ groupId }) => getGroup(groupId),
-
-      updateGroup: ({ group }, { data }) => {
-        if (!group) {
-          throw new Error("Group not defined.")
-        }
-
-        return patchGroup(group.id, {
-          ...data,
-          add_users: [],
-          remove_users: [],
-        })
-      },
-    },
-    actions: {
-      assignGroup: assign({
-        group: (_, { data }) => data,
-      }),
-      displayLoadGroupError: (_, { data }) => {
-        const message = getErrorMessage(data, "Failed to the group.")
-        displayError(message)
-      },
-      assignError: assign({
-        error: (_, event) => event.data,
-      }),
-    },
-  },
-)
diff --git a/site/src/xServices/groups/groupXService.ts b/site/src/xServices/groups/groupXService.ts
deleted file mode 100644
index d9aa63fa23f4f..0000000000000
--- a/site/src/xServices/groups/groupXService.ts
+++ /dev/null
@@ -1,272 +0,0 @@
-import { deleteGroup, getGroup, patchGroup, checkAuthorization } from "api/api"
-import { getErrorMessage } from "api/errors"
-import { AuthorizationResponse, Group } from "api/typesGenerated"
-import { displayError, displaySuccess } from "components/GlobalSnackbar/utils"
-import { assign, createMachine } from "xstate"
-
-export const groupMachine = createMachine(
-  {
-    id: "group",
-    schema: {
-      context: {} as {
-        groupId: string
-        group?: Group
-        permissions?: AuthorizationResponse
-        addMemberCallback?: () => void
-        removingMember?: string
-      },
-      services: {} as {
-        loadGroup: {
-          data: Group
-        }
-        loadPermissions: {
-          data: AuthorizationResponse
-        }
-        addMember: {
-          data: Group
-        }
-        removeMember: {
-          data: Group
-        }
-        deleteGroup: {
-          data: unknown
-        }
-      },
-      events: {} as
-        | {
-            type: "ADD_MEMBER"
-            userId: string
-            callback: () => void
-          }
-        | {
-            type: "REMOVE_MEMBER"
-            userId: string
-          }
-        | {
-            type: "DELETE"
-          }
-        | {
-            type: "CONFIRM_DELETE"
-          }
-        | {
-            type: "CANCEL_DELETE"
-          },
-    },
-    tsTypes: {} as import("./groupXService.typegen").Typegen0,
-    initial: "loading",
-    states: {
-      loading: {
-        type: "parallel",
-        states: {
-          data: {
-            initial: "loading",
-            states: {
-              loading: {
-                invoke: {
-                  src: "loadGroup",
-                  onDone: {
-                    actions: ["assignGroup"],
-                    target: "success",
-                  },
-                  onError: {
-                    actions: ["displayLoadGroupError"],
-                  },
-                },
-              },
-              success: {
-                type: "final",
-              },
-            },
-          },
-          permissions: {
-            initial: "loading",
-            states: {
-              loading: {
-                invoke: {
-                  src: "loadPermissions",
-                  onDone: {
-                    actions: ["assignPermissions"],
-                    target: "success",
-                  },
-                  onError: {
-                    actions: ["displayLoadPermissionsError"],
-                  },
-                },
-              },
-              success: {
-                type: "final",
-              },
-            },
-          },
-        },
-        onDone: "idle",
-      },
-      idle: {
-        on: {
-          ADD_MEMBER: {
-            target: "addingMember",
-            actions: ["assignAddMemberCallback"],
-          },
-          REMOVE_MEMBER: {
-            target: "removingMember",
-            actions: ["removeUserFromMembers"],
-          },
-          DELETE: {
-            target: "confirmingDelete",
-          },
-        },
-      },
-      addingMember: {
-        invoke: {
-          src: "addMember",
-          onDone: {
-            actions: ["assignGroup", "callAddMemberCallback"],
-            target: "idle",
-          },
-          onError: {
-            target: "idle",
-            actions: ["displayAddMemberError"],
-          },
-        },
-      },
-      removingMember: {
-        invoke: {
-          src: "removeMember",
-          onDone: {
-            actions: ["assignGroup", "displayRemoveMemberSuccess"],
-            target: "idle",
-          },
-          onError: {
-            target: "idle",
-            actions: ["displayRemoveMemberError"],
-          },
-        },
-      },
-      confirmingDelete: {
-        on: {
-          CONFIRM_DELETE: "deleting",
-          CANCEL_DELETE: "idle",
-        },
-      },
-      deleting: {
-        invoke: {
-          src: "deleteGroup",
-          onDone: {
-            actions: ["redirectToGroups"],
-          },
-          onError: {
-            actions: ["displayDeleteGroupError"],
-          },
-        },
-      },
-    },
-  },
-  {
-    services: {
-      loadGroup: ({ groupId }) => getGroup(groupId),
-      loadPermissions: ({ groupId }) =>
-        checkAuthorization({
-          checks: {
-            canUpdateGroup: {
-              object: {
-                resource_type: "group",
-                resource_id: groupId,
-              },
-              action: "update",
-            },
-          },
-        }),
-      addMember: ({ group }, { userId }) => {
-        if (!group) {
-          throw new Error("Group not defined.")
-        }
-
-        return patchGroup(group.id, {
-          name: "",
-          display_name: "",
-          add_users: [userId],
-          remove_users: [],
-        })
-      },
-      removeMember: ({ group }, { userId }) => {
-        if (!group) {
-          throw new Error("Group not defined.")
-        }
-
-        return patchGroup(group.id, {
-          name: "",
-          display_name: "",
-          add_users: [],
-          remove_users: [userId],
-        })
-      },
-      deleteGroup: ({ group }) => {
-        if (!group) {
-          throw new Error("Group not defined.")
-        }
-
-        return deleteGroup(group.id)
-      },
-    },
-    actions: {
-      assignGroup: assign({
-        group: (_, { data }) => data,
-      }),
-      assignAddMemberCallback: assign({
-        addMemberCallback: (_, { callback }) => callback,
-      }),
-      displayLoadGroupError: (_, { data }) => {
-        const message = getErrorMessage(data, "Failed to load the group.")
-        displayError(message)
-      },
-      displayAddMemberError: (_, { data }) => {
-        const message = getErrorMessage(
-          data,
-          "Failed to add member to the group.",
-        )
-        displayError(message)
-      },
-      callAddMemberCallback: ({ addMemberCallback }) => {
-        if (addMemberCallback) {
-          addMemberCallback()
-        }
-      },
-      // Optimistically remove the user from members
-      removeUserFromMembers: assign({
-        group: ({ group }, { userId }) => {
-          if (!group) {
-            throw new Error("Group is not defined.")
-          }
-
-          return {
-            ...group,
-            members: group.members.filter(
-              (currentMember) => currentMember.id !== userId,
-            ),
-          }
-        },
-      }),
-      displayRemoveMemberError: (_, { data }) => {
-        const message = getErrorMessage(
-          data,
-          "Failed to remove member from the group.",
-        )
-        displayError(message)
-      },
-      displayRemoveMemberSuccess: () => {
-        displaySuccess("Member removed successfully.")
-      },
-      displayDeleteGroupError: (_, { data }) => {
-        const message = getErrorMessage(data, "Failed to delete group.")
-        displayError(message)
-      },
-      assignPermissions: assign({
-        permissions: (_, { data }) => data,
-      }),
-      displayLoadPermissionsError: (_, { data }) => {
-        const message = getErrorMessage(data, "Failed to load the permissions.")
-        displayError(message)
-      },
-    },
-  },
-)
diff --git a/site/src/xServices/groups/groupsXService.ts b/site/src/xServices/groups/groupsXService.ts
deleted file mode 100644
index ff17e94dc5bdc..0000000000000
--- a/site/src/xServices/groups/groupsXService.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-import { getGroups } from "api/api"
-import { getErrorMessage } from "api/errors"
-import { Group } from "api/typesGenerated"
-import { displayError } from "components/GlobalSnackbar/utils"
-import { assign, createMachine } from "xstate"
-
-export const groupsMachine = createMachine(
-  {
-    id: "groupsMachine",
-    predictableActionArguments: true,
-    schema: {
-      context: {} as {
-        organizationId: string
-        shouldFetchGroups: boolean
-        groups?: Group[]
-      },
-      services: {} as {
-        loadGroups: {
-          data: Group[]
-        }
-      },
-    },
-    tsTypes: {} as import("./groupsXService.typegen").Typegen0,
-    initial: "loading",
-    states: {
-      loading: {
-        always: [{ target: "idle", cond: "cantFetchGroups" }],
-        invoke: {
-          src: "loadGroups",
-          onDone: {
-            actions: ["assignGroups"],
-            target: "idle",
-          },
-          onError: {
-            target: "idle",
-            actions: ["displayLoadingGroupsError"],
-          },
-        },
-      },
-      idle: {},
-    },
-  },
-  {
-    guards: {
-      cantFetchGroups: ({ shouldFetchGroups }) => !shouldFetchGroups,
-    },
-    services: {
-      loadGroups: ({ organizationId }) => getGroups(organizationId),
-    },
-    actions: {
-      assignGroups: assign({
-        groups: (_, { data }) => data,
-      }),
-      displayLoadingGroupsError: (_, { data }) => {
-        const message = getErrorMessage(data, "Error on loading groups.")
-        displayError(message)
-      },
-    },
-  },
-)
diff --git a/site/src/xServices/pagination/paginationXService.ts b/site/src/xServices/pagination/paginationXService.ts
deleted file mode 100644
index 66073b8927181..0000000000000
--- a/site/src/xServices/pagination/paginationXService.ts
+++ /dev/null
@@ -1,66 +0,0 @@
-import { ActorRefFrom, createMachine, sendParent, assign } from "xstate"
-
-export interface PaginationContext {
-  page: number
-  limit: number
-}
-
-export type PaginationEvent =
-  | { type: "NEXT_PAGE" }
-  | { type: "PREVIOUS_PAGE" }
-  | { type: "GO_TO_PAGE"; page: number }
-  | { type: "RESET_PAGE" }
-
-export type PaginationMachineRef = ActorRefFrom<typeof paginationMachine>
-
-export const paginationMachine =
-  /** @xstate-layout N4IgpgJg5mDOIC5QAcCGUCWA7VAXDA9lgLKoDGAFtmAMQByAogBoAqA+gAoCCA4gwNoAGALqIUBWBnxExIAB6IATADZBAOgAcGgCwBWDYMEHBAdm2KANCACeiEwEZ7axboCcbkw8-3XGgL5+VmiYONIk5FRYtBwASgwAagCSAPIAqgDKnLwCIrLIElKEWLIKCAC09hrKarq6AMwarsraGormuiYaVrYIDk4u7q7e3r4BQejYeEWklNQ0PMlsLIvcfEKiSCD5kmElduq69vrKyiaCjqfu3YgauupatYp1eia+o4FbE6HTEXNx6Qx2KschtxDsintyvZqlVzmdGs0tIpbtcENplIoanV7M8jrpFCZntoAh8sAQIHA8l8pkQZpEwGoAE5gVAQHpgwoyTalZSuNTuV6CFzabSCFqdVFmdTPMU+dHnZrKMafEI08KzKJ5Aq7blKJwC1xC3QisUaCU2RDKQ5qGXaOWqaHokl+IA */
-  createMachine(
-    {
-      tsTypes: {} as import("./paginationXService.typegen").Typegen0,
-      schema: {
-        context: {} as PaginationContext,
-        events: {} as PaginationEvent,
-      },
-      predictableActionArguments: true,
-      id: "paginationMachine",
-      initial: "ready",
-      on: {
-        NEXT_PAGE: {
-          actions: ["assignNextPage", "sendUpdatePage"],
-        },
-        PREVIOUS_PAGE: {
-          actions: ["assignPreviousPage", "sendUpdatePage"],
-        },
-        GO_TO_PAGE: {
-          actions: ["assignPage", "sendUpdatePage"],
-        },
-        RESET_PAGE: {
-          actions: ["resetPage", "sendUpdatePage"],
-        },
-      },
-      states: {
-        ready: {},
-      },
-    },
-    {
-      actions: {
-        sendUpdatePage: sendParent((context) => ({
-          type: "UPDATE_PAGE",
-          page: context.page.toString(),
-        })),
-        assignNextPage: assign({
-          page: (context) => context.page + 1,
-        }),
-        assignPreviousPage: assign({
-          page: (context) => context.page - 1,
-        }),
-        assignPage: assign({
-          page: (_, event) => event.page,
-        }),
-        resetPage: assign({
-          page: (_) => 1,
-        }),
-      },
-    },
-  )
diff --git a/site/src/xServices/portForward/portForwardXService.ts b/site/src/xServices/portForward/portForwardXService.ts
deleted file mode 100644
index cd908155dbcc1..0000000000000
--- a/site/src/xServices/portForward/portForwardXService.ts
+++ /dev/null
@@ -1,47 +0,0 @@
-import { getAgentListeningPorts } from "api/api"
-import { WorkspaceAgentListeningPortsResponse } from "api/typesGenerated"
-import { createMachine, assign } from "xstate"
-
-export const portForwardMachine = createMachine(
-  {
-    predictableActionArguments: true,
-    id: "portForwardMachine",
-    schema: {
-      context: {} as {
-        agentId: string
-        listeningPorts?: WorkspaceAgentListeningPortsResponse
-      },
-      services: {} as {
-        getListeningPorts: {
-          data: WorkspaceAgentListeningPortsResponse
-        }
-      },
-    },
-    tsTypes: {} as import("./portForwardXService.typegen").Typegen0,
-    initial: "loading",
-    states: {
-      loading: {
-        invoke: {
-          src: "getListeningPorts",
-          onDone: {
-            target: "success",
-            actions: ["assignListeningPorts"],
-          },
-        },
-      },
-      success: {
-        type: "final",
-      },
-    },
-  },
-  {
-    services: {
-      getListeningPorts: ({ agentId }) => getAgentListeningPorts(agentId),
-    },
-    actions: {
-      assignListeningPorts: assign({
-        listeningPorts: (_, { data }) => data,
-      }),
-    },
-  },
-)
diff --git a/site/src/xServices/quotas/quotasXService.ts b/site/src/xServices/quotas/quotasXService.ts
deleted file mode 100644
index bc6f2e8e67a22..0000000000000
--- a/site/src/xServices/quotas/quotasXService.ts
+++ /dev/null
@@ -1,63 +0,0 @@
-import { assign, createMachine } from "xstate"
-import * as API from "../../api/api"
-import { WorkspaceQuota } from "../../api/typesGenerated"
-
-export type QuotaContext = {
-  username: string
-  quota?: WorkspaceQuota
-  getQuotaError?: unknown
-}
-
-export const quotaMachine = createMachine(
-  {
-    id: "quotasMachine",
-    predictableActionArguments: true,
-    tsTypes: {} as import("./quotasXService.typegen").Typegen0,
-    schema: {
-      context: {} as QuotaContext,
-      services: {
-        getQuota: {
-          data: {} as WorkspaceQuota,
-        },
-      },
-    },
-    initial: "gettingQuotas",
-    states: {
-      idle: {},
-      gettingQuotas: {
-        entry: "clearGetQuotaError",
-        invoke: {
-          id: "getQuota",
-          src: "getQuota",
-          onDone: {
-            target: "success",
-            actions: ["assignQuota"],
-          },
-          onError: {
-            target: "idle",
-            actions: ["assignGetQuotaError"],
-          },
-        },
-      },
-      success: {
-        type: "final",
-      },
-    },
-  },
-  {
-    actions: {
-      assignQuota: assign({
-        quota: (_, event) => event.data,
-      }),
-      assignGetQuotaError: assign({
-        getQuotaError: (_, event) => event.data,
-      }),
-      clearGetQuotaError: assign({
-        getQuotaError: (_) => undefined,
-      }),
-    },
-    services: {
-      getQuota: ({ username }) => API.getWorkspaceQuota(username),
-    },
-  },
-)
diff --git a/site/src/xServices/roles/siteRolesXService.ts b/site/src/xServices/roles/siteRolesXService.ts
deleted file mode 100644
index 447a30b2527b9..0000000000000
--- a/site/src/xServices/roles/siteRolesXService.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-import { assign, createMachine } from "xstate"
-import * as API from "../../api/api"
-import * as TypesGen from "../../api/typesGenerated"
-import { displayError } from "../../components/GlobalSnackbar/utils"
-
-export const Language = {
-  getRolesError: "Error on get the roles.",
-}
-
-type SiteRolesContext = {
-  hasPermission: boolean
-  roles?: TypesGen.AssignableRoles[]
-  getRolesError: unknown
-}
-
-export const siteRolesMachine = createMachine(
-  {
-    id: "siteRolesState",
-    predictableActionArguments: true,
-    tsTypes: {} as import("./siteRolesXService.typegen").Typegen0,
-    schema: {
-      context: {} as SiteRolesContext,
-      services: {
-        getRoles: {
-          data: {} as TypesGen.AssignableRoles[],
-        },
-      },
-    },
-    initial: "initializing",
-    states: {
-      initializing: {
-        always: [
-          { target: "gettingRoles", cond: "hasPermission" },
-          { target: "done" },
-        ],
-      },
-      gettingRoles: {
-        entry: "clearGetRolesError",
-        invoke: {
-          id: "getRoles",
-          src: "getRoles",
-          onDone: {
-            target: "done",
-            actions: ["assignRoles"],
-          },
-          onError: {
-            target: "done",
-            actions: ["assignGetRolesError", "displayGetRolesError"],
-          },
-        },
-      },
-      done: {
-        type: "final",
-      },
-    },
-  },
-  {
-    actions: {
-      assignRoles: assign({
-        roles: (_, event) => event.data,
-      }),
-      assignGetRolesError: assign({
-        getRolesError: (_, event) => event.data,
-      }),
-      displayGetRolesError: () => {
-        displayError(Language.getRolesError)
-      },
-      clearGetRolesError: assign({
-        getRolesError: (_) => undefined,
-      }),
-    },
-    services: {
-      getRoles: () => API.getSiteRoles(),
-    },
-    guards: {
-      hasPermission: ({ hasPermission }) => hasPermission,
-    },
-  },
-)
diff --git a/site/src/xServices/setup/setupXService.ts b/site/src/xServices/setup/setupXService.ts
deleted file mode 100644
index c5dd918679cf6..0000000000000
--- a/site/src/xServices/setup/setupXService.ts
+++ /dev/null
@@ -1,81 +0,0 @@
-import * as API from "api/api"
-import * as TypesGen from "api/typesGenerated"
-import { assign, createMachine } from "xstate"
-
-export interface SetupContext {
-  error?: unknown
-  firstUser?: TypesGen.CreateFirstUserRequest
-}
-
-export type SetupEvent = {
-  type: "CREATE_FIRST_USER"
-  firstUser: TypesGen.CreateFirstUserRequest
-}
-
-export const setupMachine =
-  /** @xstate-layout N4IgpgJg5mDOIC5QGUwBcCuAHZaCGaYAdAJYQA2YAxAMIBKAogIIAqDA+gGICSdyL7AKrIGdRKCwB7WCTQlJAO3EgAHogDMAViKaAnPoDsABgBMRgCy6jpkwBoQAT0QBGI+qIA2N0ePOAHJqa-qYAviH2qJg4+IREAMYATmAEJApQnCQJsGiCsGAJVBCKxKkAbpIA1sSJyYQZWTl5CcpSMnKKymoI6ibuzmZGuiYG6kYemn4eHvZOCObOzjom-X7qHsZGmuq6mmER6Ni4BNVJKWn12bn5VPkJkglEWOQEAGb3ALbxp3WZl00t0lk8iUSFUGl07g8-XMxlWmmsWnUMxcUyIzg86hhPgWvg8JjC4RACkkEDgykihxiJQoYABbWBnUQflcRAMZlc6jWwwMfmRCDM2ksfgMzl0Bisbj85j8exAFOixy+tVS6V+jXydKBHVBXQAtDsiOyeVp-OoFrpnHyzboiKZ1CMDCNzEY-H4xbL5UdYi81VcEjRvpBNe0QaAuoEbZzpfaRh4rFM+eYTOZbcsTBD0b0bB6DgrCMGGTrELrzYajM5jUFVubLY4NIsvKM2eMtKZNOMCSEgA */
-  createMachine(
-    {
-      id: "SetupState",
-      predictableActionArguments: true,
-      tsTypes: {} as import("./setupXService.typegen").Typegen0,
-      schema: {
-        context: {} as SetupContext,
-        events: {} as SetupEvent,
-        services: {} as {
-          createFirstUser: {
-            data: TypesGen.CreateFirstUserResponse
-          }
-        },
-      },
-      initial: "idle",
-      states: {
-        idle: {
-          on: {
-            CREATE_FIRST_USER: {
-              actions: "assignFirstUserData",
-              target: "creatingFirstUser",
-            },
-          },
-        },
-        creatingFirstUser: {
-          entry: "clearError",
-          invoke: {
-            src: "createFirstUser",
-            id: "createFirstUser",
-            onDone: [
-              {
-                actions: "onCreateFirstUser",
-                target: "firstUserCreated",
-              },
-            ],
-            onError: {
-              actions: "assignError",
-              target: "idle",
-            },
-          },
-          tags: "loading",
-        },
-        firstUserCreated: {
-          tags: "loading",
-          type: "final",
-        },
-      },
-    },
-    {
-      services: {
-        createFirstUser: (_, event) => API.createFirstUser(event.firstUser),
-      },
-      actions: {
-        assignFirstUserData: assign({
-          firstUser: (_, event) => event.firstUser,
-        }),
-        assignError: assign({
-          error: (_, event) => event.data,
-        }),
-        clearError: assign({
-          error: (_) => undefined,
-        }),
-      },
-    },
-  )
diff --git a/site/src/xServices/sshKey/sshKeyXService.ts b/site/src/xServices/sshKey/sshKeyXService.ts
deleted file mode 100644
index 135a8a40393c8..0000000000000
--- a/site/src/xServices/sshKey/sshKeyXService.ts
+++ /dev/null
@@ -1,125 +0,0 @@
-import { getUserSSHKey, regenerateUserSSHKey } from "api/api"
-import { GitSSHKey } from "api/typesGenerated"
-import { displaySuccess } from "components/GlobalSnackbar/utils"
-import { createMachine, assign } from "xstate"
-import { i18n } from "i18n"
-
-const { t } = i18n
-
-interface Context {
-  sshKey?: GitSSHKey
-  getSSHKeyError?: unknown
-  regenerateSSHKeyError?: unknown
-}
-
-type Events =
-  | { type: "REGENERATE_SSH_KEY" }
-  | { type: "CONFIRM_REGENERATE_SSH_KEY" }
-  | { type: "CANCEL_REGENERATE_SSH_KEY" }
-
-export const sshKeyMachine = createMachine(
-  {
-    id: "sshKeyState",
-    predictableActionArguments: true,
-    schema: {
-      context: {} as Context,
-      events: {} as Events,
-      services: {} as {
-        getSSHKey: {
-          data: GitSSHKey
-        }
-        regenerateSSHKey: {
-          data: GitSSHKey
-        }
-      },
-    },
-    tsTypes: {} as import("./sshKeyXService.typegen").Typegen0,
-    initial: "gettingSSHKey",
-    states: {
-      gettingSSHKey: {
-        entry: "clearGetSSHKeyError",
-        invoke: {
-          src: "getSSHKey",
-          onDone: [
-            {
-              actions: "assignSSHKey",
-              target: "loaded",
-            },
-          ],
-          onError: [
-            {
-              actions: "assignGetSSHKeyError",
-              target: "notLoaded",
-            },
-          ],
-        },
-      },
-      notLoaded: {
-        type: "final",
-      },
-      loaded: {
-        on: {
-          REGENERATE_SSH_KEY: {
-            target: "confirmSSHKeyRegenerate",
-          },
-        },
-      },
-      confirmSSHKeyRegenerate: {
-        on: {
-          CANCEL_REGENERATE_SSH_KEY: {
-            target: "loaded",
-          },
-          CONFIRM_REGENERATE_SSH_KEY: {
-            target: "regeneratingSSHKey",
-          },
-        },
-      },
-      regeneratingSSHKey: {
-        entry: "clearRegenerateSSHKeyError",
-        invoke: {
-          src: "regenerateSSHKey",
-          onDone: [
-            {
-              actions: ["assignSSHKey", "notifySuccessSSHKeyRegenerated"],
-              target: "loaded",
-            },
-          ],
-          onError: [
-            {
-              actions: "assignRegenerateSSHKeyError",
-              target: "loaded",
-            },
-          ],
-        },
-      },
-    },
-  },
-  {
-    services: {
-      getSSHKey: () => getUserSSHKey(),
-      regenerateSSHKey: () => regenerateUserSSHKey(),
-    },
-    actions: {
-      assignSSHKey: assign({
-        sshKey: (_, { data }) => data,
-      }),
-      assignGetSSHKeyError: assign({
-        getSSHKeyError: (_, { data }) => data,
-      }),
-      clearGetSSHKeyError: assign({
-        getSSHKeyError: (_) => undefined,
-      }),
-      assignRegenerateSSHKeyError: assign({
-        regenerateSSHKeyError: (_, { data }) => data,
-      }),
-      clearRegenerateSSHKeyError: assign({
-        regenerateSSHKeyError: (_) => undefined,
-      }),
-      notifySuccessSSHKeyRegenerated: () => {
-        displaySuccess(
-          t("sshRegenerateSuccessMessage", { ns: "userSettingsPage" }),
-        )
-      },
-    },
-  },
-)
diff --git a/site/src/xServices/starterTemplates/starterTemplateXService.ts b/site/src/xServices/starterTemplates/starterTemplateXService.ts
deleted file mode 100644
index 077b5b8d4fec9..0000000000000
--- a/site/src/xServices/starterTemplates/starterTemplateXService.ts
+++ /dev/null
@@ -1,71 +0,0 @@
-import { getTemplateExamples } from "api/api"
-import { TemplateExample } from "api/typesGenerated"
-import { assign, createMachine } from "xstate"
-
-export interface StarterTemplateContext {
-  organizationId: string
-  exampleId: string
-  starterTemplate?: TemplateExample
-  error?: unknown
-}
-
-export const starterTemplateMachine = createMachine(
-  {
-    id: "starterTemplate",
-    predictableActionArguments: true,
-    schema: {
-      context: {} as StarterTemplateContext,
-      services: {} as {
-        loadStarterTemplate: {
-          data: TemplateExample
-        }
-      },
-    },
-    tsTypes: {} as import("./starterTemplateXService.typegen").Typegen0,
-    initial: "loading",
-    states: {
-      loading: {
-        invoke: {
-          src: "loadStarterTemplate",
-          onDone: {
-            actions: ["assignStarterTemplate"],
-            target: "idle.ok",
-          },
-          onError: {
-            actions: ["assignError"],
-            target: "idle.error",
-          },
-        },
-      },
-      idle: {
-        initial: "ok",
-        states: {
-          ok: { type: "final" },
-          error: { type: "final" },
-        },
-      },
-    },
-  },
-  {
-    services: {
-      loadStarterTemplate: async ({ organizationId, exampleId }) => {
-        const examples = await getTemplateExamples(organizationId)
-        const starterTemplate = examples.find(
-          (example) => example.id === exampleId,
-        )
-        if (!starterTemplate) {
-          throw new Error(`Example ${exampleId} not found.`)
-        }
-        return starterTemplate
-      },
-    },
-    actions: {
-      assignError: assign({
-        error: (_, { data }) => data,
-      }),
-      assignStarterTemplate: assign({
-        starterTemplate: (_, { data }) => data,
-      }),
-    },
-  },
-)
diff --git a/site/src/xServices/starterTemplates/starterTemplatesXService.ts b/site/src/xServices/starterTemplates/starterTemplatesXService.ts
deleted file mode 100644
index 3e07ce39da956..0000000000000
--- a/site/src/xServices/starterTemplates/starterTemplatesXService.ts
+++ /dev/null
@@ -1,66 +0,0 @@
-import { getTemplateExamples } from "api/api"
-import { TemplateExample } from "api/typesGenerated"
-import {
-  getTemplatesByTag,
-  StarterTemplatesByTag,
-} from "utils/starterTemplates"
-import { assign, createMachine } from "xstate"
-
-export interface StarterTemplatesContext {
-  organizationId: string
-  starterTemplatesByTag?: StarterTemplatesByTag
-  error?: unknown
-}
-
-export const starterTemplatesMachine = createMachine(
-  {
-    id: "starterTemplates",
-    predictableActionArguments: true,
-    schema: {
-      context: {} as StarterTemplatesContext,
-      services: {} as {
-        loadStarterTemplates: {
-          data: TemplateExample[]
-        }
-      },
-    },
-    tsTypes: {} as import("./starterTemplatesXService.typegen").Typegen0,
-    initial: "loading",
-    states: {
-      loading: {
-        invoke: {
-          src: "loadStarterTemplates",
-          onDone: {
-            actions: ["assignStarterTemplates"],
-            target: "idle.ok",
-          },
-          onError: {
-            actions: ["assignError"],
-            target: "idle.error",
-          },
-        },
-      },
-      idle: {
-        initial: "ok",
-        states: {
-          ok: { type: "final" },
-          error: { type: "final" },
-        },
-      },
-    },
-  },
-  {
-    services: {
-      loadStarterTemplates: ({ organizationId }) =>
-        getTemplateExamples(organizationId),
-    },
-    actions: {
-      assignError: assign({
-        error: (_, { data }) => data,
-      }),
-      assignStarterTemplates: assign({
-        starterTemplatesByTag: (_, { data }) => getTemplatesByTag(data),
-      }),
-    },
-  },
-)
diff --git a/site/src/xServices/template/searchUsersAndGroupsXService.ts b/site/src/xServices/template/searchUsersAndGroupsXService.ts
deleted file mode 100644
index 2b962dce96295..0000000000000
--- a/site/src/xServices/template/searchUsersAndGroupsXService.ts
+++ /dev/null
@@ -1,101 +0,0 @@
-import { getGroups, getTemplateACLAvailable, getUsers } from "api/api"
-import { Group, User } from "api/typesGenerated"
-import { queryToFilter } from "utils/filters"
-import { everyOneGroup } from "utils/groups"
-import { assign, createMachine } from "xstate"
-
-export type SearchUsersAndGroupsEvent =
-  | { type: "SEARCH"; query: string }
-  | { type: "CLEAR_RESULTS" }
-
-export const searchUsersAndGroupsMachine = createMachine(
-  {
-    id: "searchUsersAndGroups",
-    predictableActionArguments: true,
-    schema: {
-      context: {} as {
-        organizationId: string
-        templateID?: string
-        userResults: User[]
-        groupResults: Group[]
-      },
-      events: {} as SearchUsersAndGroupsEvent,
-      services: {} as {
-        search: {
-          data: {
-            users: User[]
-            groups: Group[]
-          }
-        }
-      },
-    },
-    tsTypes: {} as import("./searchUsersAndGroupsXService.typegen").Typegen0,
-    initial: "idle",
-    states: {
-      idle: {
-        on: {
-          SEARCH: {
-            target: "searching",
-            cond: "queryHasMinLength",
-          },
-          CLEAR_RESULTS: {
-            actions: ["clearResults"],
-            target: "idle",
-          },
-        },
-      },
-      searching: {
-        invoke: {
-          src: "search",
-          onDone: {
-            target: "idle",
-            actions: ["assignSearchResults"],
-          },
-        },
-      },
-    },
-  },
-  {
-    services: {
-      search: async ({ organizationId, templateID }, { query }) => {
-        let users, groups
-        if (templateID && templateID !== "") {
-          const res = await getTemplateACLAvailable(
-            templateID,
-            queryToFilter(query),
-          )
-          users = res.users
-          groups = res.groups
-        } else {
-          const [userRes, groupsRes] = await Promise.all([
-            getUsers(queryToFilter(query)),
-            getGroups(organizationId),
-          ])
-
-          users = userRes.users
-          groups = groupsRes
-        }
-
-        // The Everyone groups is not returned by the API so we have to add it
-        // manually
-        return {
-          users: users,
-          groups: [everyOneGroup(organizationId), ...groups],
-        }
-      },
-    },
-    actions: {
-      assignSearchResults: assign({
-        userResults: (_, { data }) => data.users,
-        groupResults: (_, { data }) => data.groups,
-      }),
-      clearResults: assign({
-        userResults: (_) => [],
-        groupResults: (_) => [],
-      }),
-    },
-    guards: {
-      queryHasMinLength: (_, { query }) => query.length >= 3,
-    },
-  },
-)
diff --git a/site/src/xServices/template/templateACLXService.ts b/site/src/xServices/template/templateACLXService.ts
deleted file mode 100644
index 4ff85299c692d..0000000000000
--- a/site/src/xServices/template/templateACLXService.ts
+++ /dev/null
@@ -1,366 +0,0 @@
-import { getTemplateACL, updateTemplateACL } from "api/api"
-import {
-  TemplateACL,
-  TemplateGroup,
-  TemplateRole,
-  TemplateUser,
-} from "api/typesGenerated"
-import { displaySuccess } from "components/GlobalSnackbar/utils"
-import { assign, createMachine } from "xstate"
-
-export const templateACLMachine = createMachine(
-  {
-    schema: {
-      context: {} as {
-        templateId: string
-        templateACL?: TemplateACL
-        // User
-        userToBeAdded?: TemplateUser
-        userToBeUpdated?: TemplateUser
-        addUserCallback?: () => void
-        // Group
-        groupToBeAdded?: TemplateGroup
-        groupToBeUpdated?: TemplateGroup
-        addGroupCallback?: () => void
-      },
-      services: {} as {
-        loadTemplateACL: {
-          data: TemplateACL
-        }
-        // User
-        addUser: {
-          data: unknown
-        }
-        updateUser: {
-          data: unknown
-        }
-        // Group
-        addGroup: {
-          data: unknown
-        }
-        updateGroup: {
-          data: unknown
-        }
-      },
-      events: {} as  // User
-        | {
-            type: "ADD_USER"
-            user: TemplateUser
-            role: TemplateRole
-            onDone: () => void
-          }
-        | {
-            type: "UPDATE_USER_ROLE"
-            user: TemplateUser
-            role: TemplateRole
-          }
-        | {
-            type: "REMOVE_USER"
-            user: TemplateUser
-          }
-        // Group
-        | {
-            type: "ADD_GROUP"
-            group: TemplateGroup
-            role: TemplateRole
-            onDone: () => void
-          }
-        | {
-            type: "UPDATE_GROUP_ROLE"
-            group: TemplateGroup
-            role: TemplateRole
-          }
-        | {
-            type: "REMOVE_GROUP"
-            group: TemplateGroup
-          },
-    },
-    tsTypes: {} as import("./templateACLXService.typegen").Typegen0,
-    id: "templateACL",
-    initial: "loading",
-    states: {
-      loading: {
-        invoke: {
-          src: "loadTemplateACL",
-          onDone: {
-            actions: ["assignTemplateACL"],
-            target: "idle",
-          },
-        },
-      },
-      idle: {
-        on: {
-          // User
-          ADD_USER: { target: "addingUser", actions: ["assignUserToBeAdded"] },
-          UPDATE_USER_ROLE: {
-            target: "updatingUser",
-            actions: ["assignUserToBeUpdated"],
-          },
-          REMOVE_USER: {
-            target: "removingUser",
-            actions: ["removeUserFromTemplateACL"],
-          },
-          // Group
-          ADD_GROUP: {
-            target: "addingGroup",
-            actions: ["assignGroupToBeAdded"],
-          },
-          UPDATE_GROUP_ROLE: {
-            target: "updatingGroup",
-            actions: ["assignGroupToBeUpdated"],
-          },
-          REMOVE_GROUP: {
-            target: "removingGroup",
-            actions: ["removeGroupFromTemplateACL"],
-          },
-        },
-      },
-      // User
-      addingUser: {
-        invoke: {
-          src: "addUser",
-          onDone: {
-            target: "idle",
-            actions: ["addUserToTemplateACL", "runAddUserCallback"],
-          },
-        },
-      },
-      updatingUser: {
-        invoke: {
-          src: "updateUser",
-          onDone: {
-            target: "idle",
-            actions: [
-              "updateUserOnTemplateACL",
-              "clearUserToBeUpdated",
-              "displayUpdateUserSuccessMessage",
-            ],
-          },
-        },
-      },
-      removingUser: {
-        invoke: {
-          src: "removeUser",
-          onDone: {
-            target: "idle",
-            actions: ["displayRemoveUserSuccessMessage"],
-          },
-        },
-      },
-      // Group
-      addingGroup: {
-        invoke: {
-          src: "addGroup",
-          onDone: {
-            target: "idle",
-            actions: ["addGroupToTemplateACL", "runAddGroupCallback"],
-          },
-        },
-      },
-      updatingGroup: {
-        invoke: {
-          src: "updateGroup",
-          onDone: {
-            target: "idle",
-            actions: [
-              "updateGroupOnTemplateACL",
-              "clearGroupToBeUpdated",
-              "displayUpdateGroupSuccessMessage",
-            ],
-          },
-        },
-      },
-      removingGroup: {
-        invoke: {
-          src: "removeGroup",
-          onDone: {
-            target: "idle",
-            actions: ["displayRemoveGroupSuccessMessage"],
-          },
-        },
-      },
-    },
-  },
-  {
-    services: {
-      loadTemplateACL: ({ templateId }) => getTemplateACL(templateId),
-      // User
-      addUser: ({ templateId }, { user, role }) =>
-        updateTemplateACL(templateId, {
-          user_perms: {
-            [user.id]: role,
-          },
-        }),
-      updateUser: ({ templateId }, { user, role }) =>
-        updateTemplateACL(templateId, {
-          user_perms: {
-            [user.id]: role,
-          },
-        }),
-      removeUser: ({ templateId }, { user }) =>
-        updateTemplateACL(templateId, {
-          user_perms: {
-            [user.id]: "",
-          },
-        }),
-      // Group
-      addGroup: ({ templateId }, { group, role }) =>
-        updateTemplateACL(templateId, {
-          group_perms: {
-            [group.id]: role,
-          },
-        }),
-      updateGroup: ({ templateId }, { group, role }) =>
-        updateTemplateACL(templateId, {
-          group_perms: {
-            [group.id]: role,
-          },
-        }),
-      removeGroup: ({ templateId }, { group }) =>
-        updateTemplateACL(templateId, {
-          group_perms: {
-            [group.id]: "",
-          },
-        }),
-    },
-    actions: {
-      assignTemplateACL: assign({
-        templateACL: (_, { data }) => data,
-      }),
-      // User
-      assignUserToBeAdded: assign({
-        userToBeAdded: (_, { user, role }) => ({ ...user, role }),
-        addUserCallback: (_, { onDone }) => onDone,
-      }),
-      addUserToTemplateACL: assign({
-        templateACL: ({ templateACL, userToBeAdded }) => {
-          if (!userToBeAdded) {
-            throw new Error("No user to be added")
-          }
-          if (!templateACL) {
-            throw new Error("Template ACL is not loaded yet")
-          }
-          return {
-            ...templateACL,
-            users: [...templateACL.users, userToBeAdded],
-          }
-        },
-      }),
-      runAddUserCallback: ({ addUserCallback }) => {
-        if (addUserCallback) {
-          addUserCallback()
-        }
-      },
-      assignUserToBeUpdated: assign({
-        userToBeUpdated: (_, { user, role }) => ({ ...user, role }),
-      }),
-      updateUserOnTemplateACL: assign({
-        templateACL: ({ templateACL, userToBeUpdated }) => {
-          if (!userToBeUpdated) {
-            throw new Error("No user to be added")
-          }
-          if (!templateACL) {
-            throw new Error("Template ACL is not loaded yet")
-          }
-          return {
-            ...templateACL,
-            users: templateACL.users.map((oldTemplateUser) => {
-              return oldTemplateUser.id === userToBeUpdated.id
-                ? userToBeUpdated
-                : oldTemplateUser
-            }),
-          }
-        },
-      }),
-      clearUserToBeUpdated: assign({
-        userToBeUpdated: (_) => undefined,
-      }),
-      displayUpdateUserSuccessMessage: () => {
-        displaySuccess("User role update successfully!")
-      },
-      removeUserFromTemplateACL: assign({
-        templateACL: ({ templateACL }, { user }) => {
-          if (!templateACL) {
-            throw new Error("Template ACL is not loaded yet")
-          }
-          return {
-            ...templateACL,
-            users: templateACL.users.filter((oldTemplateUser) => {
-              return oldTemplateUser.id !== user.id
-            }),
-          }
-        },
-      }),
-      displayRemoveUserSuccessMessage: () => {
-        displaySuccess("User removed successfully!")
-      },
-      // Group
-      assignGroupToBeAdded: assign({
-        groupToBeAdded: (_, { group, role }) => ({ ...group, role }),
-        addGroupCallback: (_, { onDone }) => onDone,
-      }),
-      addGroupToTemplateACL: assign({
-        templateACL: ({ templateACL, groupToBeAdded }) => {
-          if (!groupToBeAdded) {
-            throw new Error("No group to be added")
-          }
-          if (!templateACL) {
-            throw new Error("Template ACL is not loaded yet")
-          }
-          return {
-            ...templateACL,
-            group: [...templateACL.group, groupToBeAdded],
-          }
-        },
-      }),
-      runAddGroupCallback: ({ addGroupCallback }) => {
-        if (addGroupCallback) {
-          addGroupCallback()
-        }
-      },
-      assignGroupToBeUpdated: assign({
-        groupToBeUpdated: (_, { group, role }) => ({ ...group, role }),
-      }),
-      updateGroupOnTemplateACL: assign({
-        templateACL: ({ templateACL, groupToBeUpdated }) => {
-          if (!groupToBeUpdated) {
-            throw new Error("No group to be added")
-          }
-          if (!templateACL) {
-            throw new Error("Template ACL is not loaded yet")
-          }
-          return {
-            ...templateACL,
-            group: templateACL.group.map((oldTemplateGroup) => {
-              return oldTemplateGroup.id === groupToBeUpdated.id
-                ? groupToBeUpdated
-                : oldTemplateGroup
-            }),
-          }
-        },
-      }),
-      clearGroupToBeUpdated: assign({
-        groupToBeUpdated: (_) => undefined,
-      }),
-      displayUpdateGroupSuccessMessage: () => {
-        displaySuccess("Group role update successfully!")
-      },
-      removeGroupFromTemplateACL: assign({
-        templateACL: ({ templateACL }, { group }) => {
-          if (!templateACL) {
-            throw new Error("Template ACL is not loaded yet")
-          }
-          return {
-            ...templateACL,
-            group: templateACL.group.filter((oldTemplateGroup) => {
-              return oldTemplateGroup.id !== group.id
-            }),
-          }
-        },
-      }),
-      displayRemoveGroupSuccessMessage: () => {
-        displaySuccess("Group removed successfully!")
-      },
-    },
-  },
-)
diff --git a/site/src/xServices/template/templateVariablesXService.ts b/site/src/xServices/template/templateVariablesXService.ts
deleted file mode 100644
index a408a053157cc..0000000000000
--- a/site/src/xServices/template/templateVariablesXService.ts
+++ /dev/null
@@ -1,244 +0,0 @@
-import {
-  createTemplateVersion,
-  getTemplateVersion,
-  getTemplateVersionVariables,
-  updateActiveTemplateVersion,
-} from "api/api"
-import {
-  CreateTemplateVersionRequest,
-  Template,
-  TemplateVersion,
-  TemplateVersionVariable,
-} from "api/typesGenerated"
-import { assign, createMachine } from "xstate"
-import { delay } from "utils/delay"
-import { Message } from "api/types"
-
-type TemplateVariablesContext = {
-  organizationId: string
-
-  template: Template
-  activeTemplateVersion?: TemplateVersion
-  templateVariables?: TemplateVersionVariable[]
-
-  createTemplateVersionRequest?: CreateTemplateVersionRequest
-  newTemplateVersion?: TemplateVersion
-
-  getTemplateDataError?: unknown
-  updateTemplateError?: unknown
-
-  jobError?: TemplateVersion["job"]["error"]
-}
-
-type UpdateTemplateEvent = {
-  type: "UPDATE_TEMPLATE_EVENT"
-  request: CreateTemplateVersionRequest
-}
-
-export const templateVariablesMachine = createMachine(
-  {
-    id: "templateVariablesState",
-    predictableActionArguments: true,
-    tsTypes: {} as import("./templateVariablesXService.typegen").Typegen0,
-    schema: {
-      context: {} as TemplateVariablesContext,
-      events: {} as UpdateTemplateEvent,
-      services: {} as {
-        getActiveTemplateVersion: {
-          data: TemplateVersion
-        }
-        getTemplateVariables: {
-          data: TemplateVersionVariable[]
-        }
-        createNewTemplateVersion: {
-          data: TemplateVersion
-        }
-        waitForJobToBeCompleted: {
-          data: TemplateVersion
-        }
-        updateTemplate: {
-          data: Message
-        }
-      },
-    },
-    initial: "gettingActiveTemplateVersion",
-    states: {
-      gettingActiveTemplateVersion: {
-        entry: "clearGetTemplateDataError",
-        invoke: {
-          src: "getActiveTemplateVersion",
-          onDone: [
-            {
-              actions: ["assignActiveTemplateVersion"],
-              target: "gettingTemplateVariables",
-            },
-          ],
-          onError: {
-            actions: ["assignGetTemplateDataError"],
-            target: "error",
-          },
-        },
-      },
-      gettingTemplateVariables: {
-        entry: "clearGetTemplateDataError",
-        invoke: {
-          src: "getTemplateVariables",
-          onDone: [
-            {
-              actions: ["assignTemplateVariables"],
-              target: "fillingParams",
-            },
-          ],
-          onError: {
-            actions: ["assignGetTemplateDataError"],
-            target: "error",
-          },
-        },
-      },
-      fillingParams: {
-        on: {
-          UPDATE_TEMPLATE_EVENT: {
-            actions: ["assignCreateTemplateVersionRequest", "clearJobError"],
-            target: "creatingTemplateVersion",
-          },
-        },
-      },
-      creatingTemplateVersion: {
-        entry: "clearUpdateTemplateError",
-        invoke: {
-          src: "createNewTemplateVersion",
-          onDone: {
-            actions: ["assignNewTemplateVersion"],
-            target: "waitingForJobToBeCompleted",
-          },
-          onError: {
-            actions: ["assignGetTemplateDataError"],
-            target: "fillingParams",
-          },
-        },
-        tags: ["submitting"],
-      },
-      waitingForJobToBeCompleted: {
-        invoke: {
-          src: "waitForJobToBeCompleted",
-          onDone: [
-            {
-              target: "fillingParams",
-              cond: "hasJobError",
-              actions: ["assignJobError"],
-            },
-            {
-              actions: ["assignNewTemplateVersion"],
-              target: "updatingTemplate",
-            },
-          ],
-          onError: {
-            actions: ["assignUpdateTemplateError"],
-            target: "fillingParams",
-          },
-        },
-        tags: ["submitting"],
-      },
-      updatingTemplate: {
-        invoke: {
-          src: "updateTemplate",
-          onDone: {
-            target: "updated",
-            actions: ["onUpdateTemplate"],
-          },
-          onError: {
-            actions: ["assignUpdateTemplateError"],
-            target: "fillingParams",
-          },
-        },
-        tags: ["submitting"],
-      },
-      updated: {
-        entry: "onUpdateTemplate",
-        type: "final",
-      },
-      error: {},
-    },
-  },
-  {
-    services: {
-      getActiveTemplateVersion: ({ template }) => {
-        return getTemplateVersion(template.active_version_id)
-      },
-      getTemplateVariables: ({ template }) => {
-        return getTemplateVersionVariables(template.active_version_id)
-      },
-      createNewTemplateVersion: ({
-        organizationId,
-        createTemplateVersionRequest,
-      }) => {
-        if (!createTemplateVersionRequest) {
-          throw new Error("Missing request body")
-        }
-        return createTemplateVersion(
-          organizationId,
-          createTemplateVersionRequest,
-        )
-      },
-      waitForJobToBeCompleted: async ({ newTemplateVersion }) => {
-        if (!newTemplateVersion) {
-          throw new Error("Template version is undefined")
-        }
-
-        let status = newTemplateVersion.job.status
-        while (["pending", "running"].includes(status)) {
-          newTemplateVersion = await getTemplateVersion(newTemplateVersion.id)
-          status = newTemplateVersion.job.status
-          await delay(2_000)
-        }
-        return newTemplateVersion
-      },
-      updateTemplate: ({ template, newTemplateVersion }) => {
-        if (!newTemplateVersion) {
-          throw new Error("New template version is undefined")
-        }
-
-        return updateActiveTemplateVersion(template.id, {
-          id: newTemplateVersion.id,
-        })
-      },
-    },
-    actions: {
-      assignActiveTemplateVersion: assign({
-        activeTemplateVersion: (_, event) => event.data,
-      }),
-      assignTemplateVariables: assign({
-        templateVariables: (_, event) => event.data,
-      }),
-      assignCreateTemplateVersionRequest: assign({
-        createTemplateVersionRequest: (_, event) => event.request,
-      }),
-      assignNewTemplateVersion: assign({
-        newTemplateVersion: (_, event) => event.data,
-      }),
-      assignGetTemplateDataError: assign({
-        getTemplateDataError: (_, event) => event.data,
-      }),
-      clearGetTemplateDataError: assign({
-        getTemplateDataError: (_) => undefined,
-      }),
-      assignUpdateTemplateError: assign({
-        updateTemplateError: (_, event) => event.data,
-      }),
-      clearUpdateTemplateError: assign({
-        updateTemplateError: (_) => undefined,
-      }),
-      assignJobError: assign({
-        jobError: (_, event) => event.data.job.error,
-      }),
-      clearJobError: assign({
-        jobError: (_) => undefined,
-      }),
-    },
-    guards: {
-      hasJobError: (_, { data }) => {
-        return Boolean(data.job.error)
-      },
-    },
-  },
-)
diff --git a/site/src/xServices/templateVersion/templateVersionXService.ts b/site/src/xServices/templateVersion/templateVersionXService.ts
deleted file mode 100644
index 407324a0f2e9c..0000000000000
--- a/site/src/xServices/templateVersion/templateVersionXService.ts
+++ /dev/null
@@ -1,179 +0,0 @@
-import {
-  getPreviousTemplateVersionByName,
-  GetPreviousTemplateVersionByNameResponse,
-  getTemplateByName,
-  getTemplateVersionByName,
-} from "api/api"
-import { Template, TemplateVersion } from "api/typesGenerated"
-import {
-  getTemplateVersionFiles,
-  TemplateVersionFiles,
-} from "utils/templateVersion"
-import { assign, createMachine } from "xstate"
-
-export interface TemplateVersionMachineContext {
-  orgId: string
-  templateName: string
-  versionName: string
-  template?: Template
-  currentVersion?: TemplateVersion
-  currentFiles?: TemplateVersionFiles
-  error?: unknown
-  // Get file diffs
-  previousVersion?: TemplateVersion
-  previousFiles?: TemplateVersionFiles
-}
-
-export const templateVersionMachine = createMachine(
-  {
-    predictableActionArguments: true,
-    id: "templateVersion",
-    schema: {
-      context: {} as TemplateVersionMachineContext,
-      services: {} as {
-        loadVersions: {
-          data: {
-            currentVersion: GetPreviousTemplateVersionByNameResponse
-            previousVersion: GetPreviousTemplateVersionByNameResponse
-          }
-        }
-        loadTemplate: {
-          data: {
-            template: Template
-          }
-        }
-        loadFiles: {
-          data: {
-            currentFiles: TemplateVersionFiles
-            previousFiles: TemplateVersionFiles
-          }
-        }
-      },
-    },
-    tsTypes: {} as import("./templateVersionXService.typegen").Typegen0,
-    initial: "initialInfo",
-    states: {
-      initialInfo: {
-        type: "parallel",
-        states: {
-          versions: {
-            initial: "loadingVersions",
-            states: {
-              loadingVersions: {
-                invoke: {
-                  src: "loadVersions",
-                  onDone: [
-                    {
-                      actions: "assignVersions",
-                      target: "success",
-                    },
-                  ],
-                },
-              },
-              success: {
-                type: "final",
-              },
-            },
-          },
-          template: {
-            initial: "loadingTemplate",
-            states: {
-              loadingTemplate: {
-                invoke: {
-                  src: "loadTemplate",
-                  onDone: [
-                    {
-                      actions: "assignTemplate",
-                      target: "success",
-                    },
-                  ],
-                },
-              },
-              success: {
-                type: "final",
-              },
-            },
-          },
-        },
-        onDone: {
-          target: "loadingFiles",
-        },
-      },
-      loadingFiles: {
-        invoke: {
-          src: "loadFiles",
-          onDone: {
-            target: "done.ok",
-            actions: ["assignFiles"],
-          },
-          onError: {
-            target: "done.error",
-            actions: ["assignError"],
-          },
-        },
-      },
-      done: {
-        states: {
-          ok: { type: "final" },
-          error: { type: "final" },
-        },
-      },
-    },
-  },
-  {
-    actions: {
-      assignError: assign({
-        error: (_, { data }) => data,
-      }),
-      assignTemplate: assign({
-        template: (_, { data }) => data.template,
-      }),
-      assignVersions: assign({
-        currentVersion: (_, { data }) => data.currentVersion,
-        previousVersion: (_, { data }) => data.previousVersion,
-      }),
-      assignFiles: assign({
-        currentFiles: (_, { data }) => data.currentFiles,
-        previousFiles: (_, { data }) => data.previousFiles,
-      }),
-    },
-    services: {
-      loadVersions: async ({ orgId, templateName, versionName }) => {
-        const [currentVersion, previousVersion] = await Promise.all([
-          getTemplateVersionByName(orgId, templateName, versionName),
-          getPreviousTemplateVersionByName(orgId, templateName, versionName),
-        ])
-
-        return {
-          currentVersion,
-          previousVersion,
-        }
-      },
-      loadTemplate: async ({ orgId, templateName }) => {
-        const template = await getTemplateByName(orgId, templateName)
-
-        return {
-          template,
-        }
-      },
-      loadFiles: async ({ currentVersion, previousVersion }) => {
-        if (!currentVersion) {
-          throw new Error("Version is not defined")
-        }
-        const loadFilesPromises: ReturnType<typeof getTemplateVersionFiles>[] =
-          []
-        loadFilesPromises.push(getTemplateVersionFiles(currentVersion))
-        if (previousVersion) {
-          loadFilesPromises.push(getTemplateVersionFiles(previousVersion))
-        }
-        const [currentFiles, previousFiles] = await Promise.all(
-          loadFilesPromises,
-        )
-        return {
-          currentFiles,
-          previousFiles,
-        }
-      },
-    },
-  },
-)
diff --git a/site/src/xServices/templateVersionEditor/templateVersionEditorXService.ts b/site/src/xServices/templateVersionEditor/templateVersionEditorXService.ts
index e540ec39317c8..7ef9fbd0b9379 100644
--- a/site/src/xServices/templateVersionEditor/templateVersionEditorXService.ts
+++ b/site/src/xServices/templateVersionEditor/templateVersionEditorXService.ts
@@ -6,30 +6,32 @@ import {
   UploadResponse,
   VariableValue,
   WorkspaceResource,
-} from "api/typesGenerated"
-import { assign, createMachine } from "xstate"
-import * as API from "api/api"
-import { FileTree, traverse } from "utils/filetree"
-import { isAllowedFile } from "utils/templateVersion"
-import { TarReader, TarWriter } from "utils/tar"
-import { PublishVersionData } from "pages/TemplateVersionPage/TemplateVersionEditorPage/types"
+} from "api/typesGenerated";
+import { assign, createMachine } from "xstate";
+import * as API from "api/api";
+import { FileTree, traverse } from "utils/filetree";
+import { isAllowedFile } from "utils/templateVersion";
+import { TarReader, TarWriter } from "utils/tar";
+import { PublishVersionData } from "pages/TemplateVersionEditorPage/types";
 
 export interface TemplateVersionEditorMachineContext {
-  orgId: string
-  templateId?: string
-  fileTree?: FileTree
-  uploadResponse?: UploadResponse
-  version?: TemplateVersion
-  resources?: WorkspaceResource[]
-  buildLogs?: ProvisionerJobLog[]
-  tarReader?: TarReader
-  publishingError?: unknown
-  missingVariables?: TemplateVersionVariable[]
-  missingVariableValues?: VariableValue[]
+  orgId: string;
+  templateId?: string;
+  fileTree?: FileTree;
+  uploadResponse?: UploadResponse;
+  version?: TemplateVersion;
+  resources?: WorkspaceResource[];
+  buildLogs?: ProvisionerJobLog[];
+  tarReader?: TarReader;
+  publishingError?: unknown;
+  lastSuccessfulPublishedVersion?: TemplateVersion;
+  missingVariables?: TemplateVersionVariable[];
+  missingVariableValues?: VariableValue[];
 }
 
 export const templateVersionEditorMachine = createMachine(
   {
+    /** @xstate-layout N4IgpgJg5mDOIC5QBcwFsAOAbAhqgamAE6wCWA9gHYCiEpy5RAdKZfaTlqQF6tQDEASQByggCqCAggBlBALWoBtAAwBdRKAzkyyCpQ0gAHogC0AFgDsypgDYAnAFZlFpzefKbADgA0IAJ6IAIzKngDMTIF2FmYONoFW9s4Avkm+qJi4BMRkVLT0jCwQWGD8AMIAStSSYtQA+vjU5QDKggDywirqSCBaOnoGxggmoTYOTKEATIEOThNxDmajvgEIgTFjDhaeNpPTZpbRKWno2HhghCR6eQzMpEUlAAoAqgBCsk0AEp0GvexUA6Y5mNlKEzBNPJ5Ap4JjCbEt-EEJsozEw7MoHKEQhYJqFPBYbBYjiB0qcspdcnQboVivwACKCJoAWQZTVqzzeDI+tRekmEwka326v10-26gxMcM8TGcoRGc0CNjMyg8yyCkzsqOUkWcnjMEJhRJJmXO2SulIKOFgAGsHgBXABGXFgAAsHjgiDg0GBUCQyrzStRpGzXu8vmofto-voxaZAvFxnZ9mFonY7NswarVuCLEwLPjQlCPGsJodUsSTsaLjkaObmJabQ6na73Z7vdkyu0AGKCcqM4Mcz6CzSRkXR0CDOM5ta6ya4jHbZR2TNx1O5iHTHEWQLgzyGitnKtm-LMDCN0guviHqj8CBUMAsSgAN3IVvvp8d5+dl9NVCHPRH-QxggSrWOioSOHCdhzCEMzLuCGoFqMkJmGsgRynuGQHj+NbHkw75Nt+5KUPwxBEAUpIAGaMGgeFnhelBQFelB-sKgHjkEcbStESKbGYaZFoEy6LlKcJePE4IzDYEwYaSJpEdcBQAMY4JQilgFwDGCJQDxkVARBwLALy2qQWAQDed4Ps+r5MMpqnqUZJkQCxAGiuxQyhA4UpmLiLhePYaEjMuFgFqibjOPmqbKNJZZGlh8m1kwtrYOQOAQGI7rmZQ96sFZ95JVgKVpe6zl9K5RimFETAljioI4mmdgjBYy7QhsepWE4DVQShMmVthCnMIp+l4HwDmmZl2VPi+96DWAZyjU54ZCi5Y7lcBDgTNKeITGm+LYutNjNRMrV4uii7gRM+w9XF1b9UwADueCKV+DHzdI5BQLA-CSLStLck8gjSL90itAA4iVUYAggjg5o4UxJutkzbEFDgakionbImMKeVdZI3QlD3IE9I3GaZb0ffwLz-YDtS0u0SiLcOpUrYMvlMJJowwgqiZpsumPSoWnjIrEMTBTjcl47hBNEy9JMQGTn2lP6gb1I0LTtODo6QyYeKoidaZxBd0JxMuUnWCjFipiMITeeBYtMbdUvPVAr3vQrlTVHUDTNG0HQM-+TNa3ENi5vEnjQ6m20o4dgS2GC6L1W4upmHbfUJRR3rS4x2HjZZU1MOnhPOkxGtsatUkorqmxWLKFuC4JCIIHDwcuAj60uKCiwp-FuEF5nTE5zlee90X2GKIEXSMxDQHBDsuZah5cbBHYAWZk3uYzJEDVxlJdhdxLVIYGRmDIPg7ocI6cBMAVqV8Iy55kAxp9EOfxSfbeWW59ZsW40eB9HxgJ8z44AvrAK+hVb730vEAkBCBB7KVHJ0EuZVBhhVRAFTwvFI5TFXrVJg3l9Qll1CEGwe9f7kX-oA5+wDX7UhKE0agYhajMiaC0YQIN6iSHKFIN4nsZBPGoE0JBzNEAEgiDuWUippgW28qvdaG0rBrB3iEKKhIYr7h-hSXCh9yDHyfi-S+dwaSK2EAGIMzDWHsPwJw7h0heHSH4YIv2rFkFBEklVUI0ipgNSsPsVeJZg5RCxmhWYkRQikM0VSYe5Q4DkFtEQNSb8LKD2sjAZA0TYCxPiXAIRkNixjDQpCDwgTtz4hNk4WwDgFTKgxHxLcYSiSUHIBAOABhv7izIUQCMAcgImC3MHGUcog4gQOg3VMYx7DREWDEaEkJorHEwhonCVJWDsE4DwPgXSp5uQlCFPpUIkTInsBmBucYPARGiFFSYJYPAFnCUsgohiwCbM1j0gs8jqlgjRKmbcy4PIbTxEnI6BYYIODubdesdoPwujdB6L0Pp4BLW6ds7cGow6eVlOta2YIRkrG3MiTUGIsQ4jxASMFCV8KfkItWZ5pdBgeSlM4GYwtrZOF8ScuM4QkTgX2ASZUaZ6nzNkvbBKtk1IaSgFpHS719KwEMrLGlLihhKgZSUuuQIwg4tcZVYSWp4hSW2GEMluF8qFXSp0xFWzVrDEcNKSY6JDYzxxA4Q64R1ptxBEcw5RqqQzWGjLRyCrhGrEWGzDxVgwjeXWpCHwJzoSuqOkCKEnlwQkLUQs9pESCiO2Jo5eWgbIZwg2nHeeSIrAesOv0o5BIwR6lxLvNNQrU49wzk7Ji+agJeE5QSfyTgUYwjMKvLUGwbl2FGAU7qDberdz-jogBejqEtItS8ty20Y6JkWDCFw0zjkrCxuEFCCxLBxDzF6yd10Ol4QofOkBYCb4MTvrKqBVCQHtrcrKDU66pIlgWJ5HdiAcRKjQQsD1wRtoCvLOm4VWir3QJoY819q0wioo6mjLY2JFg4MVHg6Y4FZzbn7d6goUSYlxISQhicHiEJxCVCMewiotSrwKbYXYwQPAoTxCkFIQA */
     predictableActionArguments: true,
     id: "templateVersionEditor",
     schema: {
@@ -37,9 +39,9 @@ export const templateVersionEditorMachine = createMachine(
       events: {} as
         | { type: "INITIALIZE"; tarReader: TarReader }
         | {
-            type: "CREATE_VERSION"
-            fileTree: FileTree
-            templateId: string
+            type: "CREATE_VERSION";
+            fileTree: FileTree;
+            templateId: string;
           }
         | { type: "CANCEL_VERSION" }
         | { type: "SET_MISSING_VARIABLE_VALUES"; values: VariableValue[] }
@@ -52,26 +54,26 @@ export const templateVersionEditorMachine = createMachine(
 
       services: {} as {
         uploadTar: {
-          data: UploadResponse
-        }
+          data: UploadResponse;
+        };
         createBuild: {
-          data: TemplateVersion
-        }
+          data: TemplateVersion;
+        };
         cancelBuild: {
-          data: void
-        }
+          data: void;
+        };
         fetchVersion: {
-          data: TemplateVersion
-        }
+          data: TemplateVersion;
+        };
         getResources: {
-          data: WorkspaceResource[]
-        }
+          data: WorkspaceResource[];
+        };
         publishingVersion: {
-          data: void
-        }
+          data: void;
+        };
         loadMissingVariables: {
-          data: TemplateVersionVariable[]
-        }
+          data: TemplateVersionVariable[];
+        };
       },
     },
     tsTypes: {} as import("./templateVersionEditorXService.typegen").Typegen0,
@@ -85,39 +87,46 @@ export const templateVersionEditorMachine = createMachine(
           },
         },
       },
+
       idle: {
         on: {
           CREATE_VERSION: {
             actions: ["assignCreateBuild"],
-            target: "cancelingBuild",
+            target: "cancelingInProgressBuild",
           },
           PUBLISH: {
             target: "askPublishParameters",
           },
         },
       },
+
       askPublishParameters: {
         on: {
           CANCEL_PUBLISH: "idle",
           CONFIRM_PUBLISH: "publishingVersion",
         },
       },
+
       publishingVersion: {
         tags: "loading",
-        entry: ["clearPublishingError"],
+        entry: ["clearPublishingError", "clearLastSuccessfulPublishedVersion"],
         invoke: {
           id: "publishingVersion",
           src: "publishingVersion",
-          onDone: {
-            actions: ["onPublish"],
-          },
+
           onError: {
             actions: ["assignPublishingError"],
             target: "askPublishParameters",
           },
+
+          onDone: {
+            actions: ["assignLastSuccessfulPublishedVersion"],
+            target: ["idle"],
+          },
         },
       },
-      cancelingBuild: {
+
+      cancelingInProgressBuild: {
         tags: "loading",
         invoke: {
           id: "cancelBuild",
@@ -127,6 +136,7 @@ export const templateVersionEditorMachine = createMachine(
           },
         },
       },
+
       uploadTar: {
         tags: "loading",
         invoke: {
@@ -138,6 +148,7 @@ export const templateVersionEditorMachine = createMachine(
           },
         },
       },
+
       creatingBuild: {
         tags: "loading",
         invoke: {
@@ -149,6 +160,7 @@ export const templateVersionEditorMachine = createMachine(
           },
         },
       },
+
       watchingBuildLogs: {
         tags: "loading",
         invoke: {
@@ -161,7 +173,7 @@ export const templateVersionEditorMachine = createMachine(
           },
           BUILD_DONE: "fetchingVersion",
           CANCEL_VERSION: {
-            target: "cancelingBuild",
+            target: "cancelingInProgressBuild",
           },
           CREATE_VERSION: {
             actions: ["assignCreateBuild"],
@@ -169,11 +181,13 @@ export const templateVersionEditorMachine = createMachine(
           },
         },
       },
+
       fetchingVersion: {
         tags: "loading",
         invoke: {
           id: "fetchVersion",
           src: "fetchVersion",
+
           onDone: [
             {
               actions: ["assignBuild"],
@@ -187,6 +201,7 @@ export const templateVersionEditorMachine = createMachine(
           ],
         },
       },
+
       promptVariables: {
         initial: "loadingMissingVariables",
         states: {
@@ -212,6 +227,7 @@ export const templateVersionEditorMachine = createMachine(
           },
         },
       },
+
       fetchResources: {
         tags: "loading",
         invoke: {
@@ -242,10 +258,14 @@ export const templateVersionEditorMachine = createMachine(
       assignBuild: assign({
         version: (_, event) => event.data,
       }),
+      assignLastSuccessfulPublishedVersion: assign({
+        lastSuccessfulPublishedVersion: (ctx) => ctx.version,
+        version: () => undefined,
+      }),
       addBuildLog: assign({
         buildLogs: (context, event) => {
-          const previousLogs = context.buildLogs ?? []
-          return [...previousLogs, event.log]
+          const previousLogs = context.buildLogs ?? [];
+          return [...previousLogs, event.log];
         },
         // Instead of periodically fetching the version,
         // we just assume the state is running after the first log.
@@ -253,7 +273,7 @@ export const templateVersionEditorMachine = createMachine(
         // The machine fetches the version after the log stream ends anyways!
         version: (context) => {
           if (!context.version || context.buildLogs?.length !== 0) {
-            return context.version
+            return context.version;
           }
           return {
             ...context.version,
@@ -261,7 +281,7 @@ export const templateVersionEditorMachine = createMachine(
               ...context.version.job,
               status: "running" as ProvisionerJobStatus,
             },
-          }
+          };
         },
       }),
       assignTarReader: assign({
@@ -271,6 +291,9 @@ export const templateVersionEditorMachine = createMachine(
         publishingError: (_, event) => event.data,
       }),
       clearPublishingError: assign({ publishingError: (_) => undefined }),
+      clearLastSuccessfulPublishedVersion: assign({
+        lastSuccessfulPublishedVersion: (_) => undefined,
+      }),
       assignMissingVariables: assign({
         missingVariables: (_, event) => event.data,
       }),
@@ -281,12 +304,12 @@ export const templateVersionEditorMachine = createMachine(
     services: {
       uploadTar: async ({ fileTree, tarReader }) => {
         if (!fileTree) {
-          throw new Error("file tree must to be set")
+          throw new Error("file tree must to be set");
         }
         if (!tarReader) {
-          throw new Error("tar reader must to be set")
+          throw new Error("tar reader must to be set");
         }
-        const tar = new TarWriter()
+        const tar = new TarWriter();
 
         // Add previous non editable files
         for (const file of tarReader.fileInfo) {
@@ -297,7 +320,7 @@ export const templateVersionEditorMachine = createMachine(
                 mtime: file.mtime,
                 user: file.user,
                 group: file.group,
-              })
+              });
             } else {
               tar.addFile(
                 file.name,
@@ -308,7 +331,7 @@ export const templateVersionEditorMachine = createMachine(
                   user: file.user,
                   group: file.group,
                 },
-              )
+              );
             }
           }
         }
@@ -316,22 +339,22 @@ export const templateVersionEditorMachine = createMachine(
         traverse(fileTree, (content, _filename, fullPath) => {
           // When a file is deleted. Don't add it to the tar.
           if (content === undefined) {
-            return
+            return;
           }
 
           if (typeof content === "string") {
-            tar.addFile(fullPath, content)
-            return
+            tar.addFile(fullPath, content);
+            return;
           }
 
-          tar.addFolder(fullPath)
-        })
-        const blob = (await tar.write()) as Blob
-        return API.uploadTemplateFile(new File([blob], "template.tar"))
+          tar.addFolder(fullPath);
+        });
+        const blob = (await tar.write()) as Blob;
+        return API.uploadFile(new File([blob], "template.tar"));
       },
       createBuild: (ctx) => {
         if (!ctx.uploadResponse) {
-          throw new Error("no upload response")
+          throw new Error("no upload response");
         }
         return API.createTemplateVersion(ctx.orgId, {
           provisioner: "terraform",
@@ -340,49 +363,49 @@ export const templateVersionEditorMachine = createMachine(
           template_id: ctx.templateId,
           file_id: ctx.uploadResponse.hash,
           user_variable_values: ctx.missingVariableValues,
-        })
+        });
       },
       fetchVersion: (ctx) => {
         if (!ctx.version) {
-          throw new Error("template version must be set")
+          throw new Error("template version must be set");
         }
-        return API.getTemplateVersion(ctx.version.id)
+        return API.getTemplateVersion(ctx.version.id);
       },
       watchBuildLogs:
         ({ version }) =>
         async (callback) => {
           if (!version) {
-            throw new Error("version must be set")
+            throw new Error("version must be set");
           }
 
           const socket = API.watchBuildLogsByTemplateVersionId(version.id, {
             onMessage: (log) => {
-              callback({ type: "ADD_BUILD_LOG", log })
+              callback({ type: "ADD_BUILD_LOG", log });
             },
             onDone: () => {
-              callback({ type: "BUILD_DONE" })
+              callback({ type: "BUILD_DONE" });
             },
             onError: (error) => {
-              console.error(error)
+              console.error(error);
             },
-          })
+          });
 
           return () => {
-            socket.close()
-          }
+            socket.close();
+          };
         },
       getResources: (ctx) => {
         if (!ctx.version) {
-          throw new Error("template version must be set")
+          throw new Error("template version must be set");
         }
-        return API.getTemplateVersionResources(ctx.version.id)
+        return API.getTemplateVersionResources(ctx.version.id);
       },
       cancelBuild: async (ctx) => {
         if (!ctx.version) {
-          return
+          return;
         }
         if (ctx.version.job.status === "running") {
-          await API.cancelTemplateVersionBuild(ctx.version.id)
+          await API.cancelTemplateVersionBuild(ctx.version.id);
         }
       },
       publishingVersion: async (
@@ -390,12 +413,13 @@ export const templateVersionEditorMachine = createMachine(
         { name, message, isActiveVersion },
       ) => {
         if (!version) {
-          throw new Error("Version is not set")
+          throw new Error("Version is not set");
         }
         if (!templateId) {
-          throw new Error("Template is not set")
+          throw new Error("Template is not set");
         }
-        const haveChanges = name !== version.name || message !== version.message
+        const haveChanges =
+          name !== version.name || message !== version.message;
         await Promise.all([
           haveChanges
             ? API.patchTemplateVersion(version.id, { name, message })
@@ -405,20 +429,20 @@ export const templateVersionEditorMachine = createMachine(
                 id: version.id,
               })
             : Promise.resolve(),
-        ])
+        ]);
       },
       loadMissingVariables: ({ version }) => {
         if (!version) {
-          throw new Error("Version is not set")
+          throw new Error("Version is not set");
         }
-        const variables = API.getTemplateVersionVariables(version.id)
-        return variables
+        const variables = API.getTemplateVersionVariables(version.id);
+        return variables;
       },
     },
     guards: {
       jobFailedWithMissingVariables: (_, { data }) => {
-        return data.job.error_code === "REQUIRED_TEMPLATE_VARIABLES"
+        return data.job.error_code === "REQUIRED_TEMPLATE_VARIABLES";
       },
     },
   },
-)
+);
diff --git a/site/src/xServices/templates/templatesXService.ts b/site/src/xServices/templates/templatesXService.ts
deleted file mode 100644
index 42249b0410584..0000000000000
--- a/site/src/xServices/templates/templatesXService.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-import { Permissions } from "xServices/auth/authXService"
-import { assign, createMachine } from "xstate"
-import * as API from "../../api/api"
-import * as TypesGen from "../../api/typesGenerated"
-
-export interface TemplatesContext {
-  organizationId: string
-  permissions: Permissions
-  templates?: TypesGen.Template[]
-  examples?: TypesGen.TemplateExample[]
-  error?: unknown
-}
-
-export const templatesMachine = createMachine(
-  {
-    id: "templatesState",
-    predictableActionArguments: true,
-    tsTypes: {} as import("./templatesXService.typegen").Typegen0,
-    schema: {
-      context: {} as TemplatesContext,
-      services: {} as {
-        load: {
-          data: {
-            templates: TypesGen.Template[]
-            examples: TypesGen.TemplateExample[]
-          }
-        }
-      },
-    },
-    initial: "loading",
-    states: {
-      loading: {
-        invoke: {
-          src: "load",
-          id: "load",
-          onDone: {
-            actions: ["assignData"],
-            target: "idle",
-          },
-          onError: {
-            actions: "assignError",
-            target: "idle",
-          },
-        },
-      },
-      idle: {
-        type: "final",
-      },
-    },
-  },
-  {
-    actions: {
-      assignData: assign({
-        templates: (_, event) => event.data.templates,
-        examples: (_, event) => event.data.examples,
-      }),
-      assignError: assign({
-        error: (_, { data }) => data,
-      }),
-    },
-    services: {
-      load: async ({ organizationId, permissions }) => {
-        const [templates, examples] = await Promise.all([
-          API.getTemplates(organizationId),
-          permissions.createTemplates
-            ? API.getTemplateExamples(organizationId)
-            : Promise.resolve([]),
-        ])
-
-        return {
-          templates,
-          examples,
-        }
-      },
-    },
-  },
-)
diff --git a/site/src/xServices/terminal/terminalXService.ts b/site/src/xServices/terminal/terminalXService.ts
deleted file mode 100644
index 8216c23ff2d74..0000000000000
--- a/site/src/xServices/terminal/terminalXService.ts
+++ /dev/null
@@ -1,349 +0,0 @@
-import { assign, createMachine } from "xstate"
-import * as API from "../../api/api"
-import * as Types from "../../api/types"
-import * as TypesGen from "../../api/typesGenerated"
-
-export interface TerminalContext {
-  workspaceError?: unknown
-  workspace?: TypesGen.Workspace
-  workspaceAgent?: TypesGen.WorkspaceAgent
-  workspaceAgentError?: unknown
-  websocket?: WebSocket
-  websocketError?: unknown
-  websocketURL?: string
-  websocketURLError?: unknown
-
-  // Assigned by connecting!
-  // The workspace agent is entirely optional.  If the agent is omitted the
-  // first agent will be used.
-  agentName?: string
-  username?: string
-  workspaceName?: string
-  reconnection?: string
-  command?: string
-  // If baseURL is not.....
-  baseURL?: string
-}
-
-export type TerminalEvent =
-  | {
-      type: "CONNECT"
-      agentName?: string
-      reconnection?: string
-      workspaceName?: string
-      username?: string
-    }
-  | { type: "WRITE"; request: Types.ReconnectingPTYRequest }
-  | { type: "READ"; data: ArrayBuffer }
-  | { type: "DISCONNECT" }
-
-export const terminalMachine =
-  /** @xstate-layout N4IgpgJg5mDOIC5QBcwCcC2BLAdgQwBsBlZPVAOljGQFcAHAYggHscxLSLVNdCSz2VWnQDaABgC6iUHWawsyLK2kgAHogAcAVgCM5MQGYdAJgMaALOYDsV8zq0AaEAE9ExgGwHyATmPf3VmI6Yub+5gYAvhFO3Nj4xJyC1PTkMMgA6sxoANawdHgAxuxpijhQmTl5hWBMrOy4AG7M2cXUFbn5ReJSSCCy8orKveoI5qbkOhq23hozflruxuZOrghGXuZaRsFiWlbeWuYa7lEx6HF8iZTJdKltWR3Vd8il5Q9VRQzoaFnkdARkABmWQwz3aHzA3RU-QUShwKhGYy8k2msw080WyxcbmMYnIoW8hO8ZkMYisOlOIFivASAmer3BnTAAEEYDhkLU2ORGs1Whl3kzWWB2VDejDBvDhogdAYrFoJuYxJjdmJvCENCs3Fo8e4glpjFptWSDhpKdT4vwKCVcG9KoK2Rzvr9-kCQWCBdUhSLJNC5LChqARotNQgpniNAYtAdjFYDL4pidolTzjTLXyGWAAEZEZgFFrIACqACUADKc+o4JotZ45vPUYsl0UyP0ShGIWVWchGA27Akzbwh4LjDQmAk6AmBbxmlMWq7WsrpLO1-MNr5oH5oP4A5DAzA13Mr0tNvotuFthBWYyDo56ULGewWHTk0zGac8Wd0gqsNgFV7l7mVry5BfjgP7IMe4pnlKobmO45D3mG7ihFMBgBIOhgaPoizar4xIRv4b4XLSFAgWBNprhuW6unupFgL+EGngGaiIMG2IIPYtj4psMYaGIxh+Do9iEamVy0b+kAMOkRYAJIACoAKIMQMUGBogdiYZs3Z+N444GqYg42F4kY6LqmxWLMUaREm5qXJ+350agEAMEW8nMgAIkp-qSqpow6N45BIRYkYRgsBxyoOASdnG2gyu43jcUhwkfiR9niU5bnSUQADCADyAByeXyVlsmea20F+Zho6EksgU6WIGpsZMuj6OZfimLB0bmEltkUBAWCwGJjkMLlBVFSVPpiox3nMexV6Na+lI4MwEBwCoNnEWAvrKUxIwALRjCGu1yuQRpiCEBpyrshLdRt1zCFtXnnu4IabCdZ1nWMezalGFLWTOPVJMI7p2tUD1lT5hyDgYXjvR9KrxSZXV-e+AN3SkaSMk8862o8RRgypM1DiGL4+FY7iGvqniXvYSNnCjt1COj9wg0UlA0AURSwPAk3bdNQbQ-o3YLCYHGwcTRwBeE-GYjToRWDdab0jamNFF6yD4ztiD+PKgTdtYljuAEBjE3G+J+HFI7ah45IK3O1AZtmB71qWGt84gezofe+j2Lq7h+XxSFWXTRGK4NNqu09fFYUssyLPxCyOI1hjyh4CzW1b3jy8jIeialjkR9BhzweTiwBPqOm2Asg5TOYXbqmY6xISEtt0n1A155ABc+aheiGCYfhGAnthWIO33kOSxwRn3vgBFEURAA */
-  createMachine(
-    {
-      id: "terminalState",
-      predictableActionArguments: true,
-      tsTypes: {} as import("./terminalXService.typegen").Typegen0,
-      schema: {
-        context: {} as TerminalContext,
-        events: {} as TerminalEvent,
-        services: {} as {
-          getWorkspace: {
-            data: TypesGen.Workspace
-          }
-          getWorkspaceAgent: {
-            data: TypesGen.WorkspaceAgent
-          }
-          getWebsocketURL: {
-            data: string
-          }
-          connect: {
-            data: WebSocket
-          }
-        },
-      },
-      initial: "setup",
-      states: {
-        setup: {
-          type: "parallel",
-          states: {
-            getWorkspace: {
-              initial: "gettingWorkspace",
-              states: {
-                gettingWorkspace: {
-                  invoke: {
-                    src: "getWorkspace",
-                    id: "getWorkspace",
-                    onDone: [
-                      {
-                        actions: ["assignWorkspace", "clearWorkspaceError"],
-                        target: "success",
-                      },
-                    ],
-                    onError: [
-                      {
-                        actions: "assignWorkspaceError",
-                        target: "success",
-                      },
-                    ],
-                  },
-                },
-                success: {
-                  type: "final",
-                },
-              },
-            },
-          },
-          onDone: {
-            target: "gettingWorkspaceAgent",
-          },
-        },
-        gettingWorkspaceAgent: {
-          invoke: {
-            src: "getWorkspaceAgent",
-            id: "getWorkspaceAgent",
-            onDone: [
-              {
-                actions: ["assignWorkspaceAgent", "clearWorkspaceAgentError"],
-                target: "gettingWebSocketURL",
-              },
-            ],
-            onError: [
-              {
-                actions: "assignWorkspaceAgentError",
-                target: "disconnected",
-              },
-            ],
-          },
-        },
-        gettingWebSocketURL: {
-          invoke: {
-            src: "getWebsocketURL",
-            id: "getWebsocketURL",
-            onDone: [
-              {
-                actions: ["assignWebsocketURL", "clearWebsocketURLError"],
-                target: "connecting",
-              },
-            ],
-            onError: [
-              {
-                actions: "assignWebsocketURLError",
-                target: "disconnected",
-              },
-            ],
-          },
-        },
-        connecting: {
-          invoke: {
-            src: "connect",
-            id: "connect",
-            onDone: [
-              {
-                actions: ["assignWebsocket", "clearWebsocketError"],
-                target: "connected",
-              },
-            ],
-            onError: [
-              {
-                actions: "assignWebsocketError",
-                target: "disconnected",
-              },
-            ],
-          },
-        },
-        connected: {
-          on: {
-            WRITE: {
-              actions: "sendMessage",
-            },
-            READ: {
-              actions: "readMessage",
-            },
-            DISCONNECT: {
-              actions: "disconnect",
-              target: "disconnected",
-            },
-          },
-        },
-        disconnected: {
-          on: {
-            CONNECT: {
-              actions: "assignConnection",
-              target: "gettingWorkspaceAgent",
-            },
-          },
-        },
-      },
-    },
-    {
-      services: {
-        getWorkspace: async (context) => {
-          if (!context.workspaceName) {
-            throw new Error("workspace name not set")
-          }
-          return API.getWorkspaceByOwnerAndName(
-            context.username,
-            context.workspaceName,
-          )
-        },
-        getWorkspaceAgent: async (context) => {
-          if (!context.workspace || !context.workspaceName) {
-            throw new Error("workspace or workspace name is not set")
-          }
-
-          const agent = context.workspace.latest_build.resources
-            .map((resource) => {
-              if (!resource.agents || resource.agents.length === 0) {
-                return
-              }
-              if (!context.agentName) {
-                return resource.agents[0]
-              }
-              return resource.agents.find(
-                (agent) => agent.name === context.agentName,
-              )
-            })
-            .filter((a) => a)[0]
-          if (!agent) {
-            throw new Error("no agent found with id")
-          }
-          return agent
-        },
-        getWebsocketURL: async (context) => {
-          if (!context.workspaceAgent) {
-            throw new Error("workspace agent is not set")
-          }
-          if (!context.reconnection) {
-            throw new Error("reconnection ID is not set")
-          }
-
-          let baseURL = context.baseURL || ""
-          if (!baseURL) {
-            baseURL = `${location.protocol}//${location.host}`
-          }
-
-          const query = new URLSearchParams({
-            reconnect: context.reconnection,
-          })
-          if (context.command) {
-            query.set("command", context.command)
-          }
-
-          const url = new URL(baseURL)
-          url.protocol = url.protocol === "https:" ? "wss:" : "ws:"
-          if (!url.pathname.endsWith("/")) {
-            url.pathname + "/"
-          }
-          url.pathname += `api/v2/workspaceagents/${context.workspaceAgent.id}/pty`
-          url.search = "?" + query.toString()
-
-          // If the URL is just the primary API, we don't need a signed token to
-          // connect.
-          if (!context.baseURL) {
-            return url.toString()
-          }
-
-          // Do ticket issuance and set the query parameter.
-          const tokenRes = await API.issueReconnectingPTYSignedToken({
-            url: url.toString(),
-            agentID: context.workspaceAgent.id,
-          })
-          query.set("coder_signed_app_token_23db1dde", tokenRes.signed_token)
-          url.search = "?" + query.toString()
-
-          return url.toString()
-        },
-        connect: (context) => (send) => {
-          return new Promise<WebSocket>((resolve, reject) => {
-            if (!context.workspaceAgent) {
-              return reject("workspace agent is not set")
-            }
-            if (!context.websocketURL) {
-              return reject("websocket URL is not set")
-            }
-
-            const socket = new WebSocket(context.websocketURL)
-            socket.binaryType = "arraybuffer"
-            socket.addEventListener("open", () => {
-              resolve(socket)
-            })
-            socket.addEventListener("error", () => {
-              reject(new Error("socket errored"))
-            })
-            socket.addEventListener("close", () => {
-              send({
-                type: "DISCONNECT",
-              })
-            })
-            socket.addEventListener("message", (event) => {
-              send({
-                type: "READ",
-                data: event.data,
-              })
-            })
-          })
-        },
-      },
-      actions: {
-        assignConnection: assign((context, event) => ({
-          ...context,
-          agentName: event.agentName ?? context.agentName,
-          reconnection: event.reconnection ?? context.reconnection,
-          workspaceName: event.workspaceName ?? context.workspaceName,
-        })),
-        assignWorkspace: assign({
-          workspace: (_, event) => event.data,
-        }),
-        assignWorkspaceError: assign({
-          workspaceError: (_, event) => event.data,
-        }),
-        clearWorkspaceError: assign((context) => ({
-          ...context,
-          workspaceError: undefined,
-        })),
-        assignWorkspaceAgent: assign({
-          workspaceAgent: (_, event) => event.data,
-        }),
-        assignWorkspaceAgentError: assign({
-          workspaceAgentError: (_, event) => event.data,
-        }),
-        clearWorkspaceAgentError: assign((context: TerminalContext) => ({
-          ...context,
-          workspaceAgentError: undefined,
-        })),
-        assignWebsocket: assign({
-          websocket: (_, event) => event.data,
-        }),
-        assignWebsocketError: assign({
-          websocketError: (_, event) => event.data,
-        }),
-        clearWebsocketError: assign((context: TerminalContext) => ({
-          ...context,
-          webSocketError: undefined,
-        })),
-        assignWebsocketURL: assign({
-          websocketURL: (context, event) => event.data ?? context.websocketURL,
-        }),
-        assignWebsocketURLError: assign({
-          websocketURLError: (_, event) => event.data,
-        }),
-        clearWebsocketURLError: assign((context: TerminalContext) => ({
-          ...context,
-          websocketURLError: undefined,
-        })),
-        sendMessage: (context, event) => {
-          if (!context.websocket) {
-            throw new Error("websocket doesn't exist")
-          }
-          context.websocket.send(
-            new TextEncoder().encode(JSON.stringify(event.request)),
-          )
-        },
-        disconnect: (context: TerminalContext) => {
-          // Code 1000 is a successful exit!
-          context.websocket?.close(1000)
-        },
-      },
-    },
-  )
diff --git a/site/src/xServices/updateCheck/updateCheckXService.test.ts b/site/src/xServices/updateCheck/updateCheckXService.test.ts
deleted file mode 100644
index a12668d83551a..0000000000000
--- a/site/src/xServices/updateCheck/updateCheckXService.test.ts
+++ /dev/null
@@ -1,138 +0,0 @@
-import { waitFor } from "@testing-library/react"
-import { MockPermissions, MockUpdateCheck } from "testHelpers/entities"
-import { interpret } from "xstate"
-import {
-  clearDismissedVersionOnLocal,
-  getDismissedVersionOnLocal,
-  saveDismissedVersionOnLocal,
-  updateCheckMachine,
-} from "./updateCheckXService"
-
-describe("updateCheckMachine", () => {
-  beforeEach(() => {
-    clearDismissedVersionOnLocal()
-  })
-
-  it("is dismissed when does not have permission to see it", () => {
-    const machine = updateCheckMachine.withContext({
-      permissions: {
-        ...MockPermissions,
-        viewUpdateCheck: false,
-      },
-    })
-
-    const updateCheckService = interpret(machine)
-    updateCheckService.start()
-    expect(updateCheckService.state.matches("dismissed")).toBeTruthy()
-  })
-
-  it("is dismissed when it is already using current version", async () => {
-    const machine = updateCheckMachine
-      .withContext({
-        permissions: {
-          ...MockPermissions,
-          viewUpdateCheck: true,
-        },
-      })
-      .withConfig({
-        services: {
-          getUpdateCheck: () =>
-            Promise.resolve({
-              ...MockUpdateCheck,
-              current: true,
-            }),
-        },
-      })
-
-    const updateCheckService = interpret(machine)
-    updateCheckService.start()
-
-    await waitFor(() => {
-      expect(updateCheckService.state.matches("dismissed")).toBeTruthy()
-    })
-  })
-
-  it("is dismissed when it was dismissed previously", async () => {
-    const machine = updateCheckMachine
-      .withContext({
-        permissions: {
-          ...MockPermissions,
-          viewUpdateCheck: true,
-        },
-      })
-      .withConfig({
-        services: {
-          getUpdateCheck: () =>
-            Promise.resolve({
-              ...MockUpdateCheck,
-              current: false,
-            }),
-        },
-      })
-
-    saveDismissedVersionOnLocal(MockUpdateCheck.version)
-    const updateCheckService = interpret(machine)
-    updateCheckService.start()
-
-    await waitFor(() => {
-      expect(updateCheckService.state.matches("dismissed")).toBeTruthy()
-    })
-  })
-
-  it("shows when has permission and is outdated", async () => {
-    const machine = updateCheckMachine
-      .withContext({
-        permissions: {
-          ...MockPermissions,
-          viewUpdateCheck: true,
-        },
-      })
-      .withConfig({
-        services: {
-          getUpdateCheck: () =>
-            Promise.resolve({
-              ...MockUpdateCheck,
-              current: false,
-            }),
-        },
-      })
-
-    const updateCheckService = interpret(machine)
-    updateCheckService.start()
-
-    await waitFor(() => {
-      expect(updateCheckService.state.matches("show")).toBeTruthy()
-    })
-  })
-
-  it("it is dismissed when the DISMISS event happens", async () => {
-    const machine = updateCheckMachine
-      .withContext({
-        permissions: {
-          ...MockPermissions,
-          viewUpdateCheck: true,
-        },
-      })
-      .withConfig({
-        services: {
-          getUpdateCheck: () =>
-            Promise.resolve({
-              ...MockUpdateCheck,
-              current: false,
-            }),
-        },
-      })
-
-    const updateCheckService = interpret(machine)
-    updateCheckService.start()
-    await waitFor(() => {
-      expect(updateCheckService.state.matches("show")).toBeTruthy()
-    })
-
-    updateCheckService.send("DISMISS")
-    await waitFor(() => {
-      expect(updateCheckService.state.matches("dismissed")).toBeTruthy()
-    })
-    expect(getDismissedVersionOnLocal()).toEqual(MockUpdateCheck.version)
-  })
-})
diff --git a/site/src/xServices/updateCheck/updateCheckXService.ts b/site/src/xServices/updateCheck/updateCheckXService.ts
deleted file mode 100644
index 7ab85abd673cb..0000000000000
--- a/site/src/xServices/updateCheck/updateCheckXService.ts
+++ /dev/null
@@ -1,122 +0,0 @@
-import { assign, createMachine } from "xstate"
-import { getUpdateCheck } from "api/api"
-import { AuthorizationResponse, UpdateCheckResponse } from "api/typesGenerated"
-import { checks, Permissions } from "xServices/auth/authXService"
-
-export interface UpdateCheckContext {
-  permissions: Permissions
-  updateCheck?: UpdateCheckResponse
-  error?: unknown
-}
-
-export type UpdateCheckEvent = { type: "DISMISS" }
-
-export const updateCheckMachine = createMachine(
-  {
-    id: "updateCheckState",
-    predictableActionArguments: true,
-    tsTypes: {} as import("./updateCheckXService.typegen").Typegen0,
-    schema: {
-      context: {} as UpdateCheckContext,
-      events: {} as UpdateCheckEvent,
-      services: {} as {
-        checkPermissions: {
-          data: AuthorizationResponse
-        }
-        getUpdateCheck: {
-          data: UpdateCheckResponse
-        }
-      },
-    },
-    initial: "checkingPermissions",
-    states: {
-      checkingPermissions: {
-        always: [
-          {
-            target: "fetchingUpdateCheck",
-            cond: "canViewUpdateCheck",
-          },
-          {
-            target: "dismissed",
-          },
-        ],
-      },
-      fetchingUpdateCheck: {
-        invoke: {
-          src: "getUpdateCheck",
-          id: "getUpdateCheck",
-          onDone: [
-            {
-              actions: ["assignUpdateCheck"],
-              target: "show",
-              cond: "shouldShowUpdateCheck",
-            },
-            {
-              target: "dismissed",
-            },
-          ],
-          onError: [
-            {
-              actions: ["assignError"],
-              target: "dismissed",
-            },
-          ],
-        },
-      },
-      show: {
-        on: {
-          DISMISS: {
-            actions: ["setDismissedVersion"],
-            target: "dismissed",
-          },
-        },
-      },
-      dismissed: {
-        type: "final",
-      },
-    },
-  },
-  {
-    services: {
-      // For some reason, when passing values directly, jest.spy does not work.
-      getUpdateCheck: () => getUpdateCheck(),
-    },
-    actions: {
-      assignUpdateCheck: assign({
-        updateCheck: (_, event) => event.data,
-      }),
-      assignError: assign({
-        error: (_, event) => event.data,
-      }),
-      setDismissedVersion: ({ updateCheck }) => {
-        if (!updateCheck) {
-          throw new Error("Update check is not set")
-        }
-
-        saveDismissedVersionOnLocal(updateCheck.version)
-      },
-    },
-    guards: {
-      canViewUpdateCheck: ({ permissions }) =>
-        permissions[checks.viewUpdateCheck] || false,
-      shouldShowUpdateCheck: (_, { data }) => {
-        const isNotDismissed = getDismissedVersionOnLocal() !== data.version
-        const isOutdated = !data.current
-        return isNotDismissed && isOutdated
-      },
-    },
-  },
-)
-
-// Exporting to be used in the tests
-export const saveDismissedVersionOnLocal = (version: string): void => {
-  window.localStorage.setItem("dismissedVersion", version)
-}
-
-export const getDismissedVersionOnLocal = (): string | undefined => {
-  return localStorage.getItem("dismissedVersion") ?? undefined
-}
-
-export const clearDismissedVersionOnLocal = (): void => {
-  localStorage.removeItem("dismissedVersion")
-}
diff --git a/site/src/xServices/userSecuritySettings/userSecuritySettingsXService.ts b/site/src/xServices/userSecuritySettings/userSecuritySettingsXService.ts
deleted file mode 100644
index adccf76dbaa43..0000000000000
--- a/site/src/xServices/userSecuritySettings/userSecuritySettingsXService.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-import { assign, createMachine } from "xstate"
-import * as API from "api/api"
-import { UpdateUserPasswordRequest } from "api/typesGenerated"
-import { displaySuccess } from "components/GlobalSnackbar/utils"
-import { t } from "i18next"
-
-interface Context {
-  userId: string
-  error?: unknown
-}
-
-type Events = { type: "UPDATE_SECURITY"; data: UpdateUserPasswordRequest }
-
-export const userSecuritySettingsMachine = createMachine(
-  {
-    id: "userSecuritySettings",
-    predictableActionArguments: true,
-    schema: {
-      context: {} as Context,
-      events: {} as Events,
-    },
-    tsTypes: {} as import("./userSecuritySettingsXService.typegen").Typegen0,
-    initial: "idle",
-    states: {
-      idle: {
-        on: {
-          UPDATE_SECURITY: {
-            target: "updatingSecurity",
-          },
-        },
-      },
-      updatingSecurity: {
-        entry: "clearError",
-        invoke: {
-          src: "updateSecurity",
-          onDone: [
-            {
-              actions: ["notifyUpdate", "redirectToHome"],
-              target: "idle",
-            },
-          ],
-          onError: [
-            {
-              actions: "assignError",
-              target: "idle",
-            },
-          ],
-        },
-      },
-    },
-  },
-  {
-    services: {
-      updateSecurity: async ({ userId }, { data }) =>
-        API.updateUserPassword(userId, data),
-    },
-    actions: {
-      clearError: assign({
-        error: (_) => undefined,
-      }),
-      notifyUpdate: () => {
-        displaySuccess(
-          t("securityUpdateSuccessMessage", { ns: "userSettingsPage" }),
-        )
-      },
-      assignError: assign({
-        error: (_, event) => event.data,
-      }),
-      redirectToHome: () => {
-        window.location.href = location.origin
-      },
-    },
-  },
-)
diff --git a/site/src/xServices/users/createUserXService.ts b/site/src/xServices/users/createUserXService.ts
deleted file mode 100644
index ddc0e0db08477..0000000000000
--- a/site/src/xServices/users/createUserXService.ts
+++ /dev/null
@@ -1,72 +0,0 @@
-import { assign, createMachine } from "xstate"
-import * as API from "../../api/api"
-import * as TypesGen from "../../api/typesGenerated"
-import { displaySuccess } from "../../components/GlobalSnackbar/utils"
-
-export const Language = {
-  createUserSuccess: "Successfully created user.",
-}
-
-export interface CreateUserContext {
-  error?: unknown
-}
-
-export type CreateUserEvent =
-  | { type: "CREATE"; user: TypesGen.CreateUserRequest }
-  | { type: "CANCEL_CREATE_USER" }
-
-export const createUserMachine = createMachine(
-  {
-    id: "usersState",
-    predictableActionArguments: true,
-    tsTypes: {} as import("./createUserXService.typegen").Typegen0,
-    schema: {
-      context: {} as CreateUserContext,
-      events: {} as CreateUserEvent,
-      services: {} as {
-        createUser: {
-          data: TypesGen.User
-        }
-      },
-    },
-    initial: "idle",
-    states: {
-      idle: {
-        on: {
-          CREATE: "creatingUser",
-          CANCEL_CREATE_USER: { actions: ["clearError"] },
-        },
-      },
-      creatingUser: {
-        entry: "clearError",
-        invoke: {
-          src: "createUser",
-          id: "createUser",
-          onDone: {
-            target: "idle",
-            actions: ["displayCreateUserSuccess", "redirectToUsersPage"],
-          },
-          onError: {
-            target: "idle",
-            actions: ["assignError"],
-          },
-        },
-        tags: "loading",
-      },
-    },
-  },
-  {
-    services: {
-      createUser: (_, event) => API.createUser(event.user),
-    },
-    actions: {
-      assignError: assign({
-        error: (_, event) => event.data,
-      }),
-      clearError: assign({ error: (_) => undefined }),
-      displayCreateUserSuccess: () => {
-        displaySuccess(Language.createUserSuccess)
-      },
-    },
-  },
-)
diff --git a/site/src/xServices/users/searchUserXService.ts b/site/src/xServices/users/searchUserXService.ts
deleted file mode 100644
index d86e94c5a89df..0000000000000
--- a/site/src/xServices/users/searchUserXService.ts
+++ /dev/null
@@ -1,65 +0,0 @@
-import { getUsers } from "api/api"
-import { User } from "api/typesGenerated"
-import { queryToFilter } from "utils/filters"
-import { assign, createMachine } from "xstate"
-
-export type AutocompleteEvent =
-  | { type: "SEARCH"; query: string }
-  | { type: "CLEAR_RESULTS" }
-
-export const searchUserMachine = createMachine(
-  {
-    id: "searchUserMachine",
-    predictableActionArguments: true,
-    schema: {
-      context: {} as {
-        searchResults?: User[]
-      },
-      events: {} as AutocompleteEvent,
-      services: {} as {
-        searchUsers: {
-          data: User[]
-        }
-      },
-    },
-    context: {
-      searchResults: [],
-    },
-    tsTypes: {} as import("./searchUserXService.typegen").Typegen0,
-    initial: "idle",
-    states: {
-      idle: {
-        on: {
-          SEARCH: "searching",
-          CLEAR_RESULTS: {
-            actions: ["clearResults"],
-            target: "idle",
-          },
-        },
-      },
-      searching: {
-        invoke: {
-          src: "searchUsers",
-          onDone: {
-            target: "idle",
-            actions: ["assignSearchResults"],
-          },
-        },
-      },
-    },
-  },
-  {
-    services: {
-      searchUsers: async (_, { query }) =>
-        (await getUsers(queryToFilter(query))).users,
-    },
-    actions: {
-      assignSearchResults: assign({
-        searchResults: (_, { data }) => data,
-      }),
-      clearResults: assign({
-        searchResults: (_) => undefined,
-      }),
-    },
-  },
-)
diff --git a/site/src/xServices/users/usersXService.ts b/site/src/xServices/users/usersXService.ts
deleted file mode 100644
index 7b5f2f12b5de9..0000000000000
--- a/site/src/xServices/users/usersXService.ts
+++ /dev/null
@@ -1,557 +0,0 @@
-import { getPaginationData } from "components/PaginationWidget/utils"
-import {
-  PaginationContext,
-  paginationMachine,
-  PaginationMachineRef,
-} from "xServices/pagination/paginationXService"
-import { assign, createMachine, send, spawn } from "xstate"
-import * as API from "../../api/api"
-import { getErrorMessage } from "../../api/errors"
-import * as TypesGen from "../../api/typesGenerated"
-import {
-  displayError,
-  displaySuccess,
-} from "../../components/GlobalSnackbar/utils"
-import { queryToFilter } from "../../utils/filters"
-import { generateRandomString } from "../../utils/random"
-
-const usersPaginationId = "usersPagination"
-
-export const Language = {
-  getUsersError: "Error getting users.",
-  suspendUserSuccess: "Successfully suspended the user.",
-  suspendUserError: "Error suspending user.",
-  deleteUserSuccess: "Successfully deleted the user.",
-  deleteUserError: "Error deleting user.",
-  activateUserSuccess: "Successfully activated the user.",
-  activateUserError: "Error activating user.",
-  resetUserPasswordSuccess: "Successfully updated the user password.",
-  resetUserPasswordError: "Error on resetting the user password.",
-  updateUserRolesSuccess: "Successfully updated the user roles.",
-  updateUserRolesError: "Error on updating the user roles.",
-}
-
-export interface UsersContext {
-  // Get users
-  users?: TypesGen.User[]
-  filter: string
-  getUsersError?: unknown
-  // Suspend user
-  userIdToSuspend?: TypesGen.User["id"]
-  usernameToSuspend?: TypesGen.User["username"]
-  suspendUserError?: unknown
-  // Delete user
-  userIdToDelete?: TypesGen.User["id"]
-  usernameToDelete?: TypesGen.User["username"]
-  deleteUserError?: unknown
-  // Activate user
-  userIdToActivate?: TypesGen.User["id"]
-  usernameToActivate?: TypesGen.User["username"]
-  activateUserError?: unknown
-  // Reset user password
-  userIdToResetPassword?: TypesGen.User["id"]
-  resetUserPasswordError?: unknown
-  newUserPassword?: string
-  // Update user roles
-  userIdToUpdateRoles?: TypesGen.User["id"]
-  updateUserRolesError?: unknown
-  paginationContext: PaginationContext
-  paginationRef: PaginationMachineRef
-  count: number
-}
-
-export type UsersEvent =
-  | { type: "GET_USERS"; query?: string }
-  // Suspend events
-  | {
-      type: "SUSPEND_USER"
-      userId: TypesGen.User["id"]
-      username: TypesGen.User["username"]
-    }
-  | { type: "CONFIRM_USER_SUSPENSION" }
-  | { type: "CANCEL_USER_SUSPENSION" }
-  // Delete events
-  | {
-      type: "DELETE_USER"
-      userId: TypesGen.User["id"]
-      username: TypesGen.User["username"]
-    }
-  | { type: "CONFIRM_USER_DELETE" }
-  | { type: "CANCEL_USER_DELETE" }
-  // Activate events
-  | {
-      type: "ACTIVATE_USER"
-      userId: TypesGen.User["id"]
-      username: TypesGen.User["username"]
-    }
-  | { type: "CONFIRM_USER_ACTIVATION" }
-  | { type: "CANCEL_USER_ACTIVATION" }
-  // Reset password events
-  | { type: "RESET_USER_PASSWORD"; userId: TypesGen.User["id"] }
-  | { type: "CONFIRM_USER_PASSWORD_RESET" }
-  | { type: "CANCEL_USER_PASSWORD_RESET" }
-  // Update roles events
-  | {
-      type: "UPDATE_USER_ROLES"
-      userId: TypesGen.User["id"]
-      roles: TypesGen.Role["name"][]
-    }
-  // Filter
-  | { type: "UPDATE_FILTER"; query: string }
-  // Pagination
-  | { type: "UPDATE_PAGE"; page: string }
-
-export const usersMachine =
-  /** @xstate-layout N4IgpgJg5mDOIC5QFdZgE6wMoBcCGOYAdLPujgJYB2UACnlNQRQPZUDEA2gAwC6ioAA4tYFSmwEgAHogC0ARgBMigBxEAnCoCsAdhWrdK9QBYdAGhABPRPO7ruRAMzdj3HYuNbFANm5b1AL4BFqgY2PiERDA4lDQAqmiY7BBsxNQAbiwA1sTRCWE8-EggwqLiVJIyCArc8upOxt6K-o7qjloq3ioW1ghKPkQu6m2KOraaw0EhieEEuWAx1FD5SRjoLOhEggA2BABmGwC2UQsrsIWSpWKsFcVVCqqOGoqOKnUqKrW15lY2ivI6IiNRqOHR6bhdXRTEChTC4OZECgQbZgdhYOJYWgAUQAcgARAD6GKxACULsUruVKnIdLoiPJjPItF42p0fI4ejYtMZjE4ASoxi4dI4lCpobDZpEkSj2HisQAZLEAFSxRKwpPJQhE1wkdxp3nqAJM3i0zm8tPknL63gNRB0TQBTNBHRM4pm8KlyNRAEEAMJKgCSADVvSq1Rq+JdtVS9dUdMYnkN1C9uM0Teofr15CpXEQPt95IXC952m6wh60l72CSseqleGSQTaN6sFgAOoAeRJeM1JWjN2pca8RH+bmar3tdUUVve3me8kcIqU3G0NrLcIilZlcVoeNDquJjZJHcVWF7lIHsdk8d5As6ybeHxLxitym4Dh5b1pYx0LhUjnXSUt1RHc9zDZsAHEsXPftdVAe4GT0IEMz0UYtAhV51BnZwHDsTQDQXZNNEAitESrUD9wJAAxAN5RVMlIwpWDbnguR5BNXlEPUbNmk+Ixp1+PpFHULQgUcbxTH8YTCy8EjNyIABjNg9godBDhWLBUEEMAqFENh2F9DscRokkAFkGwJdFMVxLAAyMmCykvVjqg8eQ82UdQJJ5DxaWZGdmUUDRWi8VM+LGbw5IRJSqBUtSNK0nS9I4X1vRxX0FQsqzsRxWz7MYrVHLg6Q5GMbQgWZbiS3tbhWktQT2P+PMBR0DMM0dLQIuCGF3Xk6LYvUxI8TAFFygMoyTPMw8CTlRUVQcnUWOKlzlEGBlHATPRhn0JkZy6XlSuMUZamEox7UiyI+tUgaMCGkabgM1L0vlCyZuVaD8r7QrFvuYwM3pewRUhTxPkzGx7XqYTGTayTtEUc7iEuuLEm9BTKHSZh9MM4yAzMiy-UDENAzyooCoWwdZBeNQfBccT0NqbkOhnHNAXaPxVHsJpTB0eHFOUq6VhRtGMeSx6Mqm-Hg1DOycXmmNnNkdC51KlqlHaYTRgErM2lvZkDUO37-ELHnYASqgICWFZklSREqEyHISFNiAVllpyltaJ5fscXivd0UqsPq0q3MLFrzRzV5MONx2LcSdg1g2LZdhwA41Id2BtLN52PovIqqhNUTOgI2xF3tUEZy5kcXXNQ6Vx8TrpnLeSIGGhZo4wK2qDSW3smIJuRrATOSc+snY1cD83hC1lPG8OqswkiHGghX8Du0Ywed7lv4hjuPNh2fYjiIdfCAHqMvsHc03PfdpPI6xkF26eqS1E5pUNUbQM1GHm8FRih0diZYY5SB3G2dtiBfyFkfRILsc6IGCiOX8vgmTsTGJ5F89UwQOBDtoU0pgPCry6hKUiYCf7ME3m3beCc94pyIb-fukCs7MTPtPIgCDhJuE+O7bwM49BPBFCYXQoxhjsTFPgnqUU+ZIwwPQWAsAADuGwIAkjgAsMa2NcZTWbK2Ts3YCQ1jrFA76bEPiDFaP+G0UkXhaFfLUNQWhsx6xeM4dweD64bjETFfmiQpGyPkYotAOAHppTFuqRsGj2xdkJLo5U+jya2MBDTWkyhaQGk6K+WwolGjuH+KVaeDIeboCUYsUh6AvFyPQBAduncQFEHyX4lYJT5HRNjKCD2RYRIgyaIoPwM5uJuXEsKDqjwVZ5IKX-OpeBpGlPKeQ3eSd941NOJ48Z3iymNOchJJ4bRFyXy6MmLo3TPIaAFJ0xcug3CMh5sgQQEASH-wwCSFgKJYAVOAd3IglzrkQLuQ8uAqy3adAaHYdiSgOivBnogf4tpWhbQBK4ZQuSRENwRO8m5Kx7mPNjugdYO9E7J2OMiz56A0U-PoafWMJo3I+AZLXcc7FLGCThXObiYxRie2DvDdgFEww0TohGQe2cDHVFsAmekvgTnsV+mkq09gHDOHWs0TpU5OpdSoCwJu8BigEPkqQPA5Alj0EYFQYWJ9h7ywXAyPMdgEzV02bSKVC47SfHfLSX65pSwItcZEaIoyZjGrlktBQSh6guAhI0aejJhQzjcKJA0Xt2g8i8Aqnm0owC+tdghO+eYTRoSLo0DM2F4xEGwZ00wbg1bc3dUBXm7iJHoE0mnRKrt+XkwlcY0wrI6jZlqP5YcbRjQeDsLoM6FbSKI2uugW6LcipNqvNk5hph1rTw6HUPZD8cxAhzEdQNp1nHdURRdcRY7BbEL9dO+WpVo2lSjQKEUjJ2hM25KtNoisvaHXNJHetZtW7oFTdAhAbxmF2HjKCIwIl1b+SZGJES75RimIBGvZu3qMA-oFQKO0edxJVW8kYXazI7ToT9nTAUrph3yWoSixIyHBxlQkrYaDnwOqaFBn0N4c5bGsm0MdcYPNR1jImT4gplGZ0SXpKaAdYJQRtHNFYjwThWoLg8JVESwy-GIeKUsyZgnnIMjcuGuVEIl2mCsamJwXsBR2BeOKuuu6PXEHxV+ol6rSZ+qqCKQYyYMNoRBsKVBvR-j-ITHPcS7DXhWc1XMTT-qATGa4jxDoK5kxWjeL0mqIJ5NczwUEIAA */
-  createMachine(
-    {
-      tsTypes: {} as import("./usersXService.typegen").Typegen0,
-      schema: {
-        context: {} as UsersContext,
-        events: {} as UsersEvent,
-        services: {} as {
-          getUsers: {
-            data: TypesGen.GetUsersResponse
-          }
-          createUser: {
-            data: TypesGen.User
-          }
-          suspendUser: {
-            data: TypesGen.User
-          }
-          deleteUser: {
-            data: undefined
-          }
-          activateUser: {
-            data: TypesGen.User
-          }
-          updateUserPassword: {
-            data: undefined
-          }
-          updateUserRoles: {
-            data: TypesGen.User
-          }
-        },
-      },
-      predictableActionArguments: true,
-      id: "usersState",
-      on: {
-        UPDATE_FILTER: {
-          actions: ["assignFilter", "sendResetPage"],
-        },
-        UPDATE_PAGE: {
-          target: "gettingUsers",
-          actions: "updateURL",
-        },
-      },
-      initial: "startingPagination",
-      states: {
-        startingPagination: {
-          entry: "assignPaginationRef",
-          always: {
-            target: "gettingUsers",
-          },
-        },
-        gettingUsers: {
-          entry: "clearGetUsersError",
-          invoke: {
-            src: "getUsers",
-            id: "getUsers",
-            onDone: [
-              {
-                target: "idle",
-                actions: "assignUsers",
-              },
-            ],
-            onError: [
-              {
-                target: "idle",
-                actions: ["clearUsers", "assignGetUsersError"],
-              },
-            ],
-          },
-          tags: "loading",
-        },
-        idle: {
-          entry: "clearSelectedUser",
-          on: {
-            SUSPEND_USER: {
-              target: "confirmUserSuspension",
-              actions: "assignUserToSuspend",
-            },
-            DELETE_USER: {
-              target: "confirmUserDeletion",
-              actions: "assignUserToDelete",
-            },
-            ACTIVATE_USER: {
-              target: "confirmUserActivation",
-              actions: "assignUserToActivate",
-            },
-            RESET_USER_PASSWORD: {
-              target: "confirmUserPasswordReset",
-              actions: [
-                "assignUserIdToResetPassword",
-                "generateRandomPassword",
-              ],
-            },
-            UPDATE_USER_ROLES: {
-              target: "updatingUserRoles",
-              actions: "assignUserIdToUpdateRoles",
-            },
-          },
-        },
-        confirmUserSuspension: {
-          on: {
-            CONFIRM_USER_SUSPENSION: {
-              target: "suspendingUser",
-            },
-            CANCEL_USER_SUSPENSION: {
-              target: "idle",
-            },
-          },
-        },
-        confirmUserDeletion: {
-          on: {
-            CONFIRM_USER_DELETE: {
-              target: "deletingUser",
-            },
-            CANCEL_USER_DELETE: {
-              target: "idle",
-            },
-          },
-        },
-        confirmUserActivation: {
-          on: {
-            CONFIRM_USER_ACTIVATION: {
-              target: "activatingUser",
-            },
-            CANCEL_USER_ACTIVATION: {
-              target: "idle",
-            },
-          },
-        },
-        suspendingUser: {
-          entry: "clearSuspendUserError",
-          invoke: {
-            src: "suspendUser",
-            id: "suspendUser",
-            onDone: [
-              {
-                target: "gettingUsers",
-                actions: "displaySuspendSuccess",
-              },
-            ],
-            onError: [
-              {
-                target: "idle",
-                actions: [
-                  "assignSuspendUserError",
-                  "displaySuspendedErrorMessage",
-                ],
-              },
-            ],
-          },
-        },
-        deletingUser: {
-          entry: "clearDeleteUserError",
-          invoke: {
-            src: "deleteUser",
-            id: "deleteUser",
-            onDone: [
-              {
-                target: "gettingUsers",
-                actions: "displayDeleteSuccess",
-              },
-            ],
-            onError: [
-              {
-                target: "idle",
-                actions: ["assignDeleteUserError", "displayDeleteErrorMessage"],
-              },
-            ],
-          },
-        },
-        activatingUser: {
-          entry: "clearActivateUserError",
-          invoke: {
-            src: "activateUser",
-            id: "activateUser",
-            onDone: [
-              {
-                target: "gettingUsers",
-                actions: "displayActivateSuccess",
-              },
-            ],
-            onError: [
-              {
-                target: "idle",
-                actions: [
-                  "assignActivateUserError",
-                  "displayActivatedErrorMessage",
-                ],
-              },
-            ],
-          },
-        },
-        confirmUserPasswordReset: {
-          on: {
-            CONFIRM_USER_PASSWORD_RESET: {
-              target: "resettingUserPassword",
-            },
-            CANCEL_USER_PASSWORD_RESET: {
-              target: "idle",
-            },
-          },
-        },
-        resettingUserPassword: {
-          entry: "clearResetUserPasswordError",
-          invoke: {
-            src: "resetUserPassword",
-            id: "resetUserPassword",
-            onDone: [
-              {
-                target: "idle",
-                actions: "displayResetPasswordSuccess",
-              },
-            ],
-            onError: [
-              {
-                target: "idle",
-                actions: [
-                  "assignResetUserPasswordError",
-                  "displayResetPasswordErrorMessage",
-                ],
-              },
-            ],
-          },
-        },
-        updatingUserRoles: {
-          entry: "clearUpdateUserRolesError",
-          invoke: {
-            src: "updateUserRoles",
-            id: "updateUserRoles",
-            onDone: [
-              {
-                target: "idle",
-                actions: "updateUserRolesInTheList",
-              },
-            ],
-            onError: [
-              {
-                target: "idle",
-                actions: [
-                  "assignUpdateRolesError",
-                  "displayUpdateRolesErrorMessage",
-                ],
-              },
-            ],
-          },
-        },
-      },
-    },
-    {
-      services: {
-        // Passing API.getUsers directly does not invoke the function properly
-        // when it is mocked. This happen in the UsersPage tests inside of the
-        // "shows a success message and refresh the page" test case.
-        getUsers: (context) => {
-          const { offset, limit } = getPaginationData(context.paginationRef)
-          return API.getUsers({
-            ...queryToFilter(context.filter),
-            offset,
-            limit,
-          })
-        },
-        suspendUser: (context) => {
-          if (!context.userIdToSuspend) {
-            throw new Error("userIdToSuspend is undefined")
-          }
-
-          return API.suspendUser(context.userIdToSuspend)
-        },
-        deleteUser: (context) => {
-          if (!context.userIdToDelete) {
-            throw new Error("userIdToDelete is undefined")
-          }
-          return API.deleteUser(context.userIdToDelete)
-        },
-        activateUser: (context) => {
-          if (!context.userIdToActivate) {
-            throw new Error("userIdToActivate is undefined")
-          }
-
-          return API.activateUser(context.userIdToActivate)
-        },
-        resetUserPassword: (context) => {
-          if (!context.userIdToResetPassword) {
-            throw new Error("userIdToResetPassword is undefined")
-          }
-
-          if (!context.newUserPassword) {
-            throw new Error("newUserPassword not generated")
-          }
-
-          return API.updateUserPassword(context.userIdToResetPassword, {
-            password: context.newUserPassword,
-            old_password: "",
-          })
-        },
-        updateUserRoles: (context, event) => {
-          if (!context.userIdToUpdateRoles) {
-            throw new Error("userIdToUpdateRoles is undefined")
-          }
-
-          return API.updateUserRoles(event.roles, context.userIdToUpdateRoles)
-        },
-      },
-
-      actions: {
-        clearSelectedUser: assign({
-          userIdToSuspend: (_) => undefined,
-          usernameToSuspend: (_) => undefined,
-          userIdToDelete: (_) => undefined,
-          usernameToDelete: (_) => undefined,
-          userIdToActivate: (_) => undefined,
-          usernameToActivate: (_) => undefined,
-          userIdToResetPassword: (_) => undefined,
-          userIdToUpdateRoles: (_) => undefined,
-        }),
-        assignUsers: assign({
-          users: (_, event) => event.data.users,
-          count: (_, event) => event.data.count,
-        }),
-        assignFilter: assign({
-          filter: (_, event) => event.query,
-        }),
-        assignGetUsersError: assign({
-          getUsersError: (_, event) => event.data,
-        }),
-        assignUserToSuspend: assign({
-          userIdToSuspend: (_, event) => event.userId,
-          usernameToSuspend: (_, event) => event.username,
-        }),
-        assignUserToDelete: assign({
-          userIdToDelete: (_, event) => event.userId,
-          usernameToDelete: (_, event) => event.username,
-        }),
-        assignUserToActivate: assign({
-          userIdToActivate: (_, event) => event.userId,
-          usernameToActivate: (_, event) => event.username,
-        }),
-        assignUserIdToResetPassword: assign({
-          userIdToResetPassword: (_, event) => event.userId,
-        }),
-        assignUserIdToUpdateRoles: assign({
-          userIdToUpdateRoles: (_, event) => event.userId,
-        }),
-        clearGetUsersError: assign((context: UsersContext) => ({
-          ...context,
-          getUsersError: undefined,
-        })),
-        assignSuspendUserError: assign({
-          suspendUserError: (_, event) => event.data,
-        }),
-        assignDeleteUserError: assign({
-          deleteUserError: (_, event) => event.data,
-        }),
-        assignActivateUserError: assign({
-          activateUserError: (_, event) => event.data,
-        }),
-        assignResetUserPasswordError: assign({
-          resetUserPasswordError: (_, event) => event.data,
-        }),
-        assignUpdateRolesError: assign({
-          updateUserRolesError: (_, event) => event.data,
-        }),
-        clearUsers: assign((context: UsersContext) => ({
-          ...context,
-          users: undefined,
-          count: undefined,
-        })),
-        clearSuspendUserError: assign({
-          suspendUserError: (_) => undefined,
-        }),
-        clearDeleteUserError: assign({
-          deleteUserError: (_) => undefined,
-        }),
-        clearActivateUserError: assign({
-          activateUserError: (_) => undefined,
-        }),
-        clearResetUserPasswordError: assign({
-          resetUserPasswordError: (_) => undefined,
-        }),
-        clearUpdateUserRolesError: assign({
-          updateUserRolesError: (_) => undefined,
-        }),
-        displaySuspendSuccess: () => {
-          displaySuccess(Language.suspendUserSuccess)
-        },
-        displaySuspendedErrorMessage: (context) => {
-          const message = getErrorMessage(
-            context.suspendUserError,
-            Language.suspendUserError,
-          )
-          displayError(message)
-        },
-        displayDeleteSuccess: () => {
-          displaySuccess(Language.deleteUserSuccess)
-        },
-        displayDeleteErrorMessage: (context) => {
-          const message = getErrorMessage(
-            context.deleteUserError,
-            Language.deleteUserError,
-          )
-          displayError(message)
-        },
-        displayActivateSuccess: () => {
-          displaySuccess(Language.activateUserSuccess)
-        },
-        displayActivatedErrorMessage: (context) => {
-          const message = getErrorMessage(
-            context.activateUserError,
-            Language.activateUserError,
-          )
-          displayError(message)
-        },
-        displayResetPasswordSuccess: () => {
-          displaySuccess(Language.resetUserPasswordSuccess)
-        },
-        displayResetPasswordErrorMessage: (context) => {
-          const message = getErrorMessage(
-            context.resetUserPasswordError,
-            Language.resetUserPasswordError,
-          )
-          displayError(message)
-        },
-        displayUpdateRolesErrorMessage: (context) => {
-          const message = getErrorMessage(
-            context.updateUserRolesError,
-            Language.updateUserRolesError,
-          )
-          displayError(message)
-        },
-        generateRandomPassword: assign({
-          newUserPassword: (_) => generateRandomString(12),
-        }),
-        updateUserRolesInTheList: assign({
-          users: ({ users }, event) => {
-            if (!users) {
-              return users
-            }
-
-            return users.map((u) => {
-              return u.id === event.data.id ? event.data : u
-            })
-          },
-        }),
-        assignPaginationRef: assign({
-          paginationRef: (context) =>
-            spawn(
-              paginationMachine.withContext(context.paginationContext),
-              usersPaginationId,
-            ),
-        }),
-        sendResetPage: send({ type: "RESET_PAGE" }, { to: usersPaginationId }),
-      },
-    },
-  )
diff --git a/site/src/xServices/workspace/workspaceXService.ts b/site/src/xServices/workspace/workspaceXService.ts
index 1876a2aff0f4e..74161d95fed6d 100644
--- a/site/src/xServices/workspace/workspaceXService.ts
+++ b/site/src/xServices/workspace/workspaceXService.ts
@@ -1,76 +1,41 @@
-import { getErrorMessage } from "api/errors"
-import dayjs from "dayjs"
-import { workspaceScheduleBannerMachine } from "xServices/workspaceSchedule/workspaceScheduleBannerXService"
-import { assign, createMachine, send } from "xstate"
-import * as API from "../../api/api"
-import * as Types from "../../api/types"
-import * as TypesGen from "../../api/typesGenerated"
-import {
-  displayError,
-  displaySuccess,
-} from "../../components/GlobalSnackbar/utils"
+import { getErrorMessage } from "api/errors";
+import { workspaceScheduleBannerMachine } from "xServices/workspaceSchedule/workspaceScheduleBannerXService";
+import { assign, createMachine } from "xstate";
+import * as API from "api/api";
+import * as TypesGen from "api/typesGenerated";
+import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
 
-const latestBuild = (builds: TypesGen.WorkspaceBuild[]) => {
-  // Cloning builds to not change the origin object with the sort()
-  return [...builds].sort((a, b) => {
-    return new Date(b.updated_at).getTime() - new Date(a.updated_at).getTime()
-  })[0]
-}
-
-const moreBuildsAvailable = (
-  context: WorkspaceContext,
-  event: {
-    type: "REFRESH_TIMELINE"
-    checkRefresh?: boolean
-    data?: TypesGen.ServerSentEvent["data"]
-  },
-) => {
-  // No need to refresh the timeline if it is not loaded
-  if (!context.builds) {
-    return false
-  }
-
-  if (!event.checkRefresh) {
-    return true
-  }
-
-  // After we refresh a workspace, we want to check if the latest
-  // build was updated before refreshing the timeline so as to not over fetch the builds
-  const latestBuildInTimeline = latestBuild(context.builds)
-  return event.data.latest_build.updated_at !== latestBuildInTimeline.updated_at
-}
-
-type Permissions = Record<keyof ReturnType<typeof permissionsToCheck>, boolean>
+type Permissions = Record<keyof ReturnType<typeof permissionsToCheck>, boolean>;
 
 export interface WorkspaceContext {
   // Initial data
-  orgId: string
-  username: string
-  workspaceName: string
+  orgId: string;
+  username: string;
+  workspaceName: string;
 
-  error?: unknown
+  error?: unknown;
   // our server side events instance
-  eventSource?: EventSource
-  workspace?: TypesGen.Workspace
-  template?: TypesGen.Template
-  permissions?: Permissions
-  templateVersion?: TypesGen.TemplateVersion
-  deploymentValues?: TypesGen.DeploymentValues
-  build?: TypesGen.WorkspaceBuild
+  eventSource?: EventSource;
+  workspace?: TypesGen.Workspace;
+  template?: TypesGen.Template;
+  permissions?: Permissions;
+  templateVersion?: TypesGen.TemplateVersion;
+  deploymentValues?: TypesGen.DeploymentValues;
+  build?: TypesGen.WorkspaceBuild;
   // Builds
-  builds?: TypesGen.WorkspaceBuild[]
-  getBuildsError?: unknown
-  missedParameters?: TypesGen.TemplateVersionParameter[]
+  builds?: TypesGen.WorkspaceBuild[];
+  getBuildsError?: unknown;
+  missedParameters?: TypesGen.TemplateVersionParameter[];
   // error creating a new WorkspaceBuild
-  buildError?: unknown
-  cancellationMessage?: Types.Message
-  cancellationError?: unknown
+  buildError?: unknown;
+  cancellationMessage?: TypesGen.Response;
+  cancellationError?: unknown;
   // debug
-  createBuildLogLevel?: TypesGen.CreateWorkspaceBuildRequest["log_level"]
+  createBuildLogLevel?: TypesGen.CreateWorkspaceBuildRequest["log_level"];
   // SSH Config
-  sshPrefix?: string
+  sshPrefix?: string;
   // Change version
-  templateVersionIdToChange?: TypesGen.TemplateVersion["id"]
+  templateVersionIdToChange?: TypesGen.TemplateVersion["id"];
 }
 
 export type WorkspaceEvent =
@@ -82,27 +47,26 @@ export type WorkspaceEvent =
   | { type: "CANCEL_DELETE" }
   | { type: "UPDATE"; buildParameters?: TypesGen.WorkspaceBuildParameter[] }
   | {
-      type: "CHANGE_VERSION"
-      templateVersionId: TypesGen.TemplateVersion["id"]
-      buildParameters?: TypesGen.WorkspaceBuildParameter[]
+      type: "CHANGE_VERSION";
+      templateVersionId: TypesGen.TemplateVersion["id"];
+      buildParameters?: TypesGen.WorkspaceBuildParameter[];
     }
   | { type: "CANCEL" }
   | {
-      type: "REFRESH_TIMELINE"
-      checkRefresh?: boolean
-      data?: TypesGen.ServerSentEvent["data"]
+      type: "REFRESH_TIMELINE";
     }
   | { type: "EVENT_SOURCE_ERROR"; error: unknown }
   | { type: "INCREASE_DEADLINE"; hours: number }
   | { type: "DECREASE_DEADLINE"; hours: number }
   | { type: "RETRY_BUILD" }
+  | { type: "ACTIVATE" };
 
 export const checks = {
   readWorkspace: "readWorkspace",
   updateWorkspace: "updateWorkspace",
   updateTemplate: "updateTemplate",
   viewDeploymentValues: "viewDeploymentValues",
-} as const
+} as const;
 
 const permissionsToCheck = (
   workspace: TypesGen.Workspace,
@@ -138,7 +102,7 @@ const permissionsToCheck = (
       },
       action: "read",
     },
-  }) as const
+  }) as const;
 
 export const workspaceMachine = createMachine(
   {
@@ -150,35 +114,38 @@ export const workspaceMachine = createMachine(
       events: {} as WorkspaceEvent,
       services: {} as {
         loadInitialWorkspaceData: {
-          data: Awaited<ReturnType<typeof loadInitialWorkspaceData>>
-        }
+          data: Awaited<ReturnType<typeof loadInitialWorkspaceData>>;
+        };
         updateWorkspace: {
-          data: TypesGen.WorkspaceBuild
-        }
+          data: TypesGen.WorkspaceBuild;
+        };
         changeWorkspaceVersion: {
-          data: TypesGen.WorkspaceBuild
-        }
+          data: TypesGen.WorkspaceBuild;
+        };
         startWorkspace: {
-          data: TypesGen.WorkspaceBuild
-        }
+          data: TypesGen.WorkspaceBuild;
+        };
         stopWorkspace: {
-          data: TypesGen.WorkspaceBuild
-        }
+          data: TypesGen.WorkspaceBuild;
+        };
         deleteWorkspace: {
-          data: TypesGen.WorkspaceBuild
-        }
+          data: TypesGen.WorkspaceBuild;
+        };
         cancelWorkspace: {
-          data: Types.Message
-        }
+          data: TypesGen.Response;
+        };
+        activateWorkspace: {
+          data: TypesGen.Response;
+        };
         listening: {
-          data: TypesGen.ServerSentEvent
-        }
+          data: TypesGen.ServerSentEvent;
+        };
         getBuilds: {
-          data: TypesGen.WorkspaceBuild[]
-        }
+          data: TypesGen.WorkspaceBuild[];
+        };
         getSSHPrefix: {
-          data: TypesGen.SSHConfigResponse
-        }
+          data: TypesGen.SSHConfigResponse;
+        };
       },
     },
     initial: "loadInitialData",
@@ -199,6 +166,11 @@ export const workspaceMachine = createMachine(
       },
       ready: {
         type: "parallel",
+        on: {
+          REFRESH_TIMELINE: {
+            actions: ["refreshBuilds"],
+          },
+        },
         states: {
           listening: {
             initial: "gettingEvents",
@@ -260,6 +232,7 @@ export const workspaceMachine = createMachine(
                       actions: ["enableDebugMode"],
                     },
                   ],
+                  ACTIVATE: "requestingActivate",
                 },
               },
               askingDelete: {
@@ -405,33 +378,15 @@ export const workspaceMachine = createMachine(
                   ],
                 },
               },
-            },
-          },
-          timeline: {
-            initial: "gettingBuilds",
-            states: {
-              gettingBuilds: {
+              requestingActivate: {
+                entry: ["clearBuildError"],
                 invoke: {
-                  src: "getBuilds",
-                  onDone: [
-                    {
-                      actions: ["assignBuilds", "clearGetBuildsError"],
-                      target: "loadedBuilds",
-                    },
-                  ],
-                  onError: [
-                    {
-                      actions: "assignGetBuildsError",
-                      target: "loadedBuilds",
-                    },
-                  ],
-                },
-              },
-              loadedBuilds: {
-                on: {
-                  REFRESH_TIMELINE: {
-                    target: "#workspaceState.ready.timeline.gettingBuilds",
-                    cond: "moreBuildsAvailable",
+                  src: "activateWorkspace",
+                  id: "activateWorkspace",
+                  onDone: "idle",
+                  onError: {
+                    target: "idle",
+                    actions: ["displayActivateError"],
                   },
                 },
               },
@@ -515,7 +470,7 @@ export const workspaceMachine = createMachine(
       }),
       displayCancellationMessage: (context) => {
         if (context.cancellationMessage) {
-          displaySuccess(context.cancellationMessage.message)
+          displaySuccess(context.cancellationMessage.message);
         }
       },
       assignCancellationError: assign({
@@ -536,18 +491,8 @@ export const workspaceMachine = createMachine(
         workspace: (_, event) => event.data,
       }),
       logWatchWorkspaceWarning: (_, event) => {
-        console.error("Watch workspace error:", event)
+        console.error("Watch workspace error:", event);
       },
-      // Timeline
-      assignBuilds: assign({
-        builds: (_, event) => event.data,
-      }),
-      assignGetBuildsError: assign({
-        getBuildsError: (_, event) => event.data,
-      }),
-      clearGetBuildsError: assign({
-        getBuildsError: (_) => undefined,
-      }),
       // SSH
       assignSSHPrefix: assign({
         sshPrefix: (_, { data }) => data.hostname_prefix,
@@ -556,16 +501,19 @@ export const workspaceMachine = createMachine(
         const message = getErrorMessage(
           data,
           "Error getting the deployment ssh configuration.",
-        )
-        displayError(message)
+        );
+        displayError(message);
+      },
+      displayActivateError: (_, { data }) => {
+        const message = getErrorMessage(data, "Error activate workspace.");
+        displayError(message);
       },
-
       assignMissedParameters: assign({
         missedParameters: (_, { data }) => {
           if (!(data instanceof API.MissingBuildParameters)) {
-            throw new Error("data is not a MissingBuildParameters error")
+            throw new Error("data is not a MissingBuildParameters error");
           }
-          return data.parameters
+          return data.parameters;
         },
       }),
       // Debug mode when build fails
@@ -581,18 +529,17 @@ export const workspaceMachine = createMachine(
       }),
     },
     guards: {
-      moreBuildsAvailable,
       isMissingBuildParameterError: (_, { data }) => {
-        return data instanceof API.MissingBuildParameters
+        return data instanceof API.MissingBuildParameters;
       },
       lastBuildWasStarting: ({ workspace }) => {
-        return workspace?.latest_build.transition === "start"
+        return workspace?.latest_build.transition === "start";
       },
       lastBuildWasStopping: ({ workspace }) => {
-        return workspace?.latest_build.transition === "stop"
+        return workspace?.latest_build.transition === "stop";
       },
       lastBuildWasDeleting: ({ workspace }) => {
-        return workspace?.latest_build.transition === "delete"
+        return workspace?.latest_build.transition === "delete";
       },
       isChangingVersion: ({ templateVersionIdToChange }) =>
         Boolean(templateVersionIdToChange),
@@ -603,28 +550,28 @@ export const workspaceMachine = createMachine(
         ({ workspace }, { buildParameters }) =>
         async (send) => {
           if (!workspace) {
-            throw new Error("Workspace is not set")
+            throw new Error("Workspace is not set");
           }
-          const build = await API.updateWorkspace(workspace, buildParameters)
-          send({ type: "REFRESH_TIMELINE" })
-          return build
+          const build = await API.updateWorkspace(workspace, buildParameters);
+          send({ type: "REFRESH_TIMELINE" });
+          return build;
         },
       changeWorkspaceVersion:
         ({ workspace, templateVersionIdToChange }, { buildParameters }) =>
         async (send) => {
           if (!workspace) {
-            throw new Error("Workspace is not set")
+            throw new Error("Workspace is not set");
           }
           if (!templateVersionIdToChange) {
-            throw new Error("Template version id to change is not set")
+            throw new Error("Template version id to change is not set");
           }
           const build = await API.changeWorkspaceVersion(
             workspace,
             templateVersionIdToChange,
             buildParameters,
-          )
-          send({ type: "REFRESH_TIMELINE" })
-          return build
+          );
+          send({ type: "REFRESH_TIMELINE" });
+          return build;
         },
       startWorkspace: (context, data) => async (send) => {
         if (context.workspace) {
@@ -633,11 +580,11 @@ export const workspaceMachine = createMachine(
             context.workspace.latest_build.template_version_id,
             context.createBuildLogLevel,
             "buildParameters" in data ? data.buildParameters : undefined,
-          )
-          send({ type: "REFRESH_TIMELINE" })
-          return startWorkspacePromise
+          );
+          send({ type: "REFRESH_TIMELINE" });
+          return startWorkspacePromise;
         } else {
-          throw Error("Cannot start workspace without workspace id")
+          throw Error("Cannot start workspace without workspace id");
         }
       },
       stopWorkspace: (context) => async (send) => {
@@ -645,87 +592,93 @@ export const workspaceMachine = createMachine(
           const stopWorkspacePromise = await API.stopWorkspace(
             context.workspace.id,
             context.createBuildLogLevel,
-          )
-          send({ type: "REFRESH_TIMELINE" })
-          return stopWorkspacePromise
+          );
+          send({ type: "REFRESH_TIMELINE" });
+          return stopWorkspacePromise;
         } else {
-          throw Error("Cannot stop workspace without workspace id")
+          throw Error("Cannot stop workspace without workspace id");
         }
       },
-      deleteWorkspace: async (context) => {
+      deleteWorkspace: (context) => async (send) => {
         if (context.workspace) {
           const deleteWorkspacePromise = await API.deleteWorkspace(
             context.workspace.id,
             context.createBuildLogLevel,
-          )
-          send({ type: "REFRESH_TIMELINE" })
-          return deleteWorkspacePromise
+          );
+          send({ type: "REFRESH_TIMELINE" });
+          return deleteWorkspacePromise;
         } else {
-          throw Error("Cannot delete workspace without workspace id")
+          throw Error("Cannot delete workspace without workspace id");
         }
       },
       cancelWorkspace: (context) => async (send) => {
         if (context.workspace) {
           const cancelWorkspacePromise = await API.cancelWorkspaceBuild(
             context.workspace.latest_build.id,
-          )
-          send({ type: "REFRESH_TIMELINE" })
-          return cancelWorkspacePromise
+          );
+          send({ type: "REFRESH_TIMELINE" });
+          return cancelWorkspacePromise;
+        } else {
+          throw Error("Cannot cancel workspace without build id");
+        }
+      },
+      activateWorkspace: (context) => async (send) => {
+        if (context.workspace) {
+          const activateWorkspacePromise = await API.updateWorkspaceDormancy(
+            context.workspace.id,
+            false,
+          );
+          send({ type: "REFRESH_WORKSPACE", data: activateWorkspacePromise });
+          return activateWorkspacePromise;
         } else {
-          throw Error("Cannot cancel workspace without build id")
+          throw Error("Cannot activate workspace without workspace id");
         }
       },
       listening: (context) => (send) => {
         if (!context.eventSource) {
-          send({ type: "EVENT_SOURCE_ERROR", error: "error initializing sse" })
-          return
+          send({ type: "EVENT_SOURCE_ERROR", error: "error initializing sse" });
+          return;
         }
 
         context.eventSource.addEventListener("data", (event) => {
+          const newWorkspaceData = JSON.parse(event.data) as TypesGen.Workspace;
           // refresh our workspace with each SSE
-          send({ type: "REFRESH_WORKSPACE", data: JSON.parse(event.data) })
-          // refresh our timeline
-          send({
-            type: "REFRESH_TIMELINE",
-            checkRefresh: true,
-            data: JSON.parse(event.data),
-          })
-          // refresh
-        })
+          send({ type: "REFRESH_WORKSPACE", data: newWorkspaceData });
+
+          const currentWorkspace = context.workspace!;
+          const hasNewBuild =
+            newWorkspaceData.latest_build.id !==
+            currentWorkspace.latest_build.id;
+          const lastBuildHasChanged =
+            newWorkspaceData.latest_build.status !==
+            currentWorkspace.latest_build.status;
+
+          if (hasNewBuild || lastBuildHasChanged) {
+            send({ type: "REFRESH_TIMELINE" });
+          }
+        });
 
         // handle any error events returned by our sse
         context.eventSource.addEventListener("error", (event) => {
-          send({ type: "EVENT_SOURCE_ERROR", error: event })
-        })
+          send({ type: "EVENT_SOURCE_ERROR", error: event });
+        });
 
         // handle any sse implementation exceptions
         context.eventSource.onerror = () => {
-          send({ type: "EVENT_SOURCE_ERROR", error: "sse error" })
-        }
+          send({ type: "EVENT_SOURCE_ERROR", error: "sse error" });
+        };
 
         return () => {
-          context.eventSource?.close()
-        }
-      },
-      getBuilds: async (context) => {
-        if (context.workspace) {
-          // For now, we only retrieve the last month of builds to minimize
-          // page bloat. We should add pagination in the future.
-          return await API.getWorkspaceBuilds(
-            context.workspace.id,
-            dayjs().add(-30, "day").toDate(),
-          )
-        } else {
-          throw Error("Cannot get builds without id")
-        }
+          context.eventSource?.close();
+        };
       },
       scheduleBannerMachine: workspaceScheduleBannerMachine,
       getSSHPrefix: async () => {
-        return API.getDeploymentSSHConfig()
+        return API.getDeploymentSSHConfig();
       },
     },
   },
-)
+);
 
 async function loadInitialWorkspaceData({
   orgId,
@@ -738,26 +691,26 @@ async function loadInitialWorkspaceData({
     {
       include_deleted: true,
     },
-  )
-  const template = await API.getTemplateByName(orgId, workspace.template_name)
+  );
+  const template = await API.getTemplateByName(orgId, workspace.template_name);
   const [templateVersion, permissions] = await Promise.all([
     API.getTemplateVersion(template.active_version_id),
     API.checkAuthorization({
       checks: permissionsToCheck(workspace, template),
     }),
-  ])
+  ]);
 
   const canViewDeploymentValues = Boolean(
     (permissions as Permissions)?.viewDeploymentValues,
-  )
+  );
   const deploymentValues = canViewDeploymentValues
-    ? (await API.getDeploymentValues())?.config
-    : undefined
+    ? (await API.getDeploymentConfig())?.config
+    : undefined;
   return {
     workspace,
     template,
     templateVersion,
     permissions,
     deploymentValues,
-  }
+  };
 }
diff --git a/site/src/xServices/workspaceAgentLogs/workspaceAgentLogsXService.ts b/site/src/xServices/workspaceAgentLogs/workspaceAgentLogsXService.ts
deleted file mode 100644
index 9f2277dc8b38d..0000000000000
--- a/site/src/xServices/workspaceAgentLogs/workspaceAgentLogsXService.ts
+++ /dev/null
@@ -1,130 +0,0 @@
-import * as API from "api/api"
-import { createMachine, assign } from "xstate"
-import { Line } from "components/Logs/Logs"
-
-// Logs are stored as the Line interface to make rendering
-// much more efficient. Instead of mapping objects each time, we're
-// able to just pass the array of logs to the component.
-export interface LineWithID extends Line {
-  id: number
-}
-
-export const workspaceAgentLogsMachine = createMachine(
-  {
-    predictableActionArguments: true,
-    id: "workspaceAgentLogsMachine",
-    schema: {
-      events: {} as
-        | {
-            type: "ADD_LOGS"
-            logs: LineWithID[]
-          }
-        | {
-            type: "FETCH_LOGS"
-          }
-        | {
-            type: "DONE"
-          },
-      context: {} as {
-        agentID: string
-        logs?: LineWithID[]
-      },
-      services: {} as {
-        getLogs: {
-          data: LineWithID[]
-        }
-      },
-    },
-    tsTypes: {} as import("./workspaceAgentLogsXService.typegen").Typegen0,
-    initial: "waiting",
-    states: {
-      waiting: {
-        on: {
-          FETCH_LOGS: "loading",
-        },
-      },
-      loading: {
-        invoke: {
-          src: "getLogs",
-          onDone: {
-            target: "watchLogs",
-            actions: ["assignLogs"],
-          },
-        },
-      },
-      watchLogs: {
-        id: "watchingLogs",
-        invoke: {
-          id: "streamLogs",
-          src: "streamLogs",
-        },
-        on: {
-          ADD_LOGS: {
-            actions: "addLogs",
-          },
-          DONE: {
-            target: "loaded",
-          },
-        },
-      },
-      loaded: {
-        type: "final",
-      },
-    },
-  },
-  {
-    services: {
-      getLogs: (ctx) =>
-        API.getWorkspaceAgentLogs(ctx.agentID).then((data) =>
-          data.map((log) => ({
-            id: log.id,
-            level: log.level || "info",
-            output: log.output,
-            time: log.created_at,
-          })),
-        ),
-      streamLogs: (ctx) => async (callback) => {
-        let after = 0
-        if (ctx.logs && ctx.logs.length > 0) {
-          after = ctx.logs[ctx.logs.length - 1].id
-        }
-
-        const socket = API.watchWorkspaceAgentLogs(ctx.agentID, {
-          after,
-          onMessage: (logs) => {
-            callback({
-              type: "ADD_LOGS",
-              logs: logs.map((log) => ({
-                id: log.id,
-                level: log.level || "info",
-                output: log.output,
-                time: log.created_at,
-              })),
-            })
-          },
-          onDone: () => {
-            callback({ type: "DONE" })
-          },
-          onError: (error) => {
-            console.error(error)
-          },
-        })
-
-        return () => {
-          socket.close()
-        }
-      },
-    },
-    actions: {
-      assignLogs: assign({
-        logs: (_, { data }) => data,
-      }),
-      addLogs: assign({
-        logs: (context, event) => {
-          const previousLogs = context.logs ?? []
-          return [...previousLogs, ...event.logs]
-        },
-      }),
-    },
-  },
-)
diff --git a/site/src/xServices/workspaceBuild/workspaceBuildXService.ts b/site/src/xServices/workspaceBuild/workspaceBuildXService.ts
deleted file mode 100644
index 980cb5c910e42..0000000000000
--- a/site/src/xServices/workspaceBuild/workspaceBuildXService.ts
+++ /dev/null
@@ -1,173 +0,0 @@
-import { assign, createMachine } from "xstate"
-import * as API from "../../api/api"
-import { ProvisionerJobLog, WorkspaceBuild } from "../../api/typesGenerated"
-
-type LogsContext = {
-  // Build
-  username: string
-  workspaceName: string
-  buildNumber: string
-  buildId: string
-  // Used to reference logs before + after.
-  timeCursor: Date
-  build?: WorkspaceBuild
-  getBuildError?: unknown
-  // Logs
-  logs?: ProvisionerJobLog[]
-}
-
-type LogsEvent =
-  | {
-      type: "ADD_LOG"
-      log: ProvisionerJobLog
-    }
-  | {
-      type: "BUILD_DONE"
-    }
-  | {
-      type: "RESET"
-      buildNumber: string
-      timeCursor: Date
-    }
-
-export const workspaceBuildMachine = createMachine(
-  {
-    id: "workspaceBuildState",
-    predictableActionArguments: true,
-    tsTypes: {} as import("./workspaceBuildXService.typegen").Typegen0,
-    schema: {
-      context: {} as LogsContext,
-      events: {} as LogsEvent,
-      services: {} as {
-        getWorkspaceBuild: {
-          data: WorkspaceBuild
-        }
-        getLogs: {
-          data: ProvisionerJobLog[]
-        }
-      },
-    },
-    initial: "gettingBuild",
-    on: {
-      RESET: {
-        target: "gettingBuild",
-        actions: ["resetContext"],
-      },
-    },
-    states: {
-      gettingBuild: {
-        entry: "clearGetBuildError",
-        invoke: {
-          src: "getWorkspaceBuild",
-          onDone: {
-            target: "logs",
-            actions: ["assignBuild", "assignBuildId"],
-          },
-          onError: {
-            target: "idle",
-            actions: "assignGetBuildError",
-          },
-        },
-      },
-      idle: {},
-      logs: {
-        initial: "gettingExistentLogs",
-        states: {
-          gettingExistentLogs: {
-            invoke: {
-              id: "getLogs",
-              src: "getLogs",
-              onDone: {
-                actions: ["assignLogs"],
-                target: "watchingLogs",
-              },
-            },
-          },
-          watchingLogs: {
-            id: "watchingLogs",
-            invoke: {
-              id: "streamWorkspaceBuildLogs",
-              src: "streamWorkspaceBuildLogs",
-            },
-            on: {
-              ADD_LOG: {
-                actions: "addLog",
-              },
-              BUILD_DONE: {
-                target: "loaded",
-              },
-            },
-          },
-          loaded: {
-            type: "final",
-          },
-        },
-      },
-    },
-  },
-  {
-    actions: {
-      resetContext: assign({
-        buildNumber: (_, event) => event.buildNumber,
-        timeCursor: (_, event) => event.timeCursor,
-        logs: undefined,
-      }),
-      // Build ID
-      assignBuildId: assign({
-        buildId: (_, event) => event.data.id,
-      }),
-      // Build
-      assignBuild: assign({
-        build: (_, event) => event.data,
-      }),
-      assignGetBuildError: assign({
-        getBuildError: (_, event) => event.data,
-      }),
-      clearGetBuildError: assign({
-        getBuildError: (_) => undefined,
-      }),
-      // Logs
-      assignLogs: assign({
-        logs: (_, event) => event.data,
-      }),
-      addLog: assign({
-        logs: (context, event) => {
-          const previousLogs = context.logs ?? []
-          return [...previousLogs, event.log]
-        },
-      }),
-    },
-    services: {
-      getWorkspaceBuild: (ctx) =>
-        API.getWorkspaceBuildByNumber(
-          ctx.username,
-          ctx.workspaceName,
-          ctx.buildNumber,
-        ),
-      getLogs: async (ctx) =>
-        API.getWorkspaceBuildLogs(ctx.buildId, ctx.timeCursor),
-      streamWorkspaceBuildLogs: (ctx) => async (callback) => {
-        if (!ctx.logs) {
-          throw new Error("logs must be set")
-        }
-        const after =
-          ctx.logs.length > 0 ? ctx.logs[ctx.logs.length - 1].id : undefined
-        const socket = API.watchBuildLogsByBuildId(ctx.buildId, {
-          after,
-          onMessage: (log) => {
-            callback({ type: "ADD_LOG", log })
-          },
-          onDone: () => {
-            callback({ type: "BUILD_DONE" })
-          },
-          onError: (err) => {
-            console.error(err)
-          },
-        })
-        return () => {
-          socket.close()
-        }
-      },
-    },
-  },
-)
diff --git a/site/src/xServices/workspaceSchedule/workspaceScheduleBannerXService.ts b/site/src/xServices/workspaceSchedule/workspaceScheduleBannerXService.ts
index 61a684621f00c..73905019cddda 100644
--- a/site/src/xServices/workspaceSchedule/workspaceScheduleBannerXService.ts
+++ b/site/src/xServices/workspaceSchedule/workspaceScheduleBannerXService.ts
@@ -2,42 +2,39 @@
  * @fileoverview workspaceScheduleBanner is an xstate machine backing a form,
  * presented as an Alert/banner, for reactively updating a workspace schedule.
  */
-import { getErrorMessage } from "api/errors"
-import { Workspace } from "api/typesGenerated"
-import dayjs from "dayjs"
-import minMax from "dayjs/plugin/minMax"
-import { getDeadline, getMaxDeadline, getMinDeadline } from "utils/schedule"
-import { assign, createMachine } from "xstate"
-import * as API from "../../api/api"
-import {
-  displayError,
-  displaySuccess,
-} from "../../components/GlobalSnackbar/utils"
+import { getErrorMessage } from "api/errors";
+import { Workspace } from "api/typesGenerated";
+import dayjs from "dayjs";
+import minMax from "dayjs/plugin/minMax";
+import { getDeadline, getMaxDeadline, getMinDeadline } from "utils/schedule";
+import { assign, createMachine } from "xstate";
+import * as API from "api/api";
+import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
 
-dayjs.extend(minMax)
+dayjs.extend(minMax);
 
 export const Language = {
   errorExtension: "Failed to update workspace shutdown time.",
   successExtension: "Updated workspace shutdown time.",
-}
+};
 
 export interface WorkspaceScheduleBannerContext {
-  workspace: Workspace
+  workspace: Workspace;
 }
 
 export type WorkspaceScheduleBannerEvent =
   | {
-      type: "INCREASE_DEADLINE"
-      hours: number
+      type: "INCREASE_DEADLINE";
+      hours: number;
     }
   | {
-      type: "DECREASE_DEADLINE"
-      hours: number
+      type: "DECREASE_DEADLINE";
+      hours: number;
     }
   | {
-      type: "REFRESH_WORKSPACE"
-      workspace: Workspace
-    }
+      type: "REFRESH_WORKSPACE";
+      workspace: Workspace;
+    };
 
 export const workspaceScheduleBannerMachine = createMachine(
   {
@@ -95,10 +92,10 @@ export const workspaceScheduleBannerMachine = createMachine(
     actions: {
       // This error does not have a detail, so using the snackbar is okay
       displayFailureMessage: (_, event) => {
-        displayError(getErrorMessage(event.data, Language.errorExtension))
+        displayError(getErrorMessage(event.data, Language.errorExtension));
       },
       displaySuccessMessage: () => {
-        displaySuccess(Language.successExtension)
+        displaySuccess(Language.successExtension);
       },
       assignWorkspace: assign((_, event) => ({
         workspace: event.workspace,
@@ -108,29 +105,29 @@ export const workspaceScheduleBannerMachine = createMachine(
     services: {
       increaseDeadline: async (context, event) => {
         if (!context.workspace.latest_build.deadline) {
-          throw Error("Deadline is undefined.")
+          throw Error("Deadline is undefined.");
         }
         const proposedDeadline = getDeadline(context.workspace).add(
           event.hours,
           "hours",
-        )
+        );
         const newDeadline = dayjs.min(
           proposedDeadline,
           getMaxDeadline(context.workspace),
-        )
-        await API.putWorkspaceExtension(context.workspace.id, newDeadline)
+        );
+        await API.putWorkspaceExtension(context.workspace.id, newDeadline);
       },
       decreaseDeadline: async (context, event) => {
         if (!context.workspace.latest_build.deadline) {
-          throw Error("Deadline is undefined.")
+          throw Error("Deadline is undefined.");
         }
         const proposedDeadline = getDeadline(context.workspace).subtract(
           event.hours,
           "hours",
-        )
-        const newDeadline = dayjs.max(proposedDeadline, getMinDeadline())
-        await API.putWorkspaceExtension(context.workspace.id, newDeadline)
+        );
+        const newDeadline = dayjs.max(proposedDeadline, getMinDeadline());
+        await API.putWorkspaceExtension(context.workspace.id, newDeadline);
       },
     },
   },
-)
+);
diff --git a/site/src/xServices/workspaceSchedule/workspaceScheduleXService.ts b/site/src/xServices/workspaceSchedule/workspaceScheduleXService.ts
index 8b1795c01c0c8..9d14f790e0249 100644
--- a/site/src/xServices/workspaceSchedule/workspaceScheduleXService.ts
+++ b/site/src/xServices/workspaceSchedule/workspaceScheduleXService.ts
@@ -2,32 +2,32 @@
  * @fileoverview workspaceSchedule is an xstate machine backing a form to CRUD
  * an individual workspace's schedule.
  */
-import { assign, createMachine } from "xstate"
-import * as API from "../../api/api"
-import * as TypesGen from "../../api/typesGenerated"
+import { assign, createMachine } from "xstate";
+import * as API from "api/api";
+import * as TypesGen from "api/typesGenerated";
 
-type Permissions = Record<keyof ReturnType<typeof permissionsToCheck>, boolean>
+type Permissions = Record<keyof ReturnType<typeof permissionsToCheck>, boolean>;
 
 export interface WorkspaceScheduleContext {
-  getWorkspaceError?: unknown
+  getWorkspaceError?: unknown;
   /**
    * Each workspace has their own schedule (start and ttl). For this reason, we
    * re-fetch the workspace to ensure we're up-to-date. As a result, this
    * machine is partially influenced by workspaceXService.
    */
-  workspace: TypesGen.Workspace
-  template?: TypesGen.Template
-  getTemplateError?: unknown
-  permissions?: Permissions
-  checkPermissionsError?: unknown
-  submitScheduleError?: unknown
-  autostopChanged?: boolean
-  shouldRestartWorkspace?: boolean
+  workspace: TypesGen.Workspace;
+  template?: TypesGen.Template;
+  getTemplateError?: unknown;
+  permissions?: Permissions;
+  checkPermissionsError?: unknown;
+  submitScheduleError?: unknown;
+  autostopChanged?: boolean;
+  shouldRestartWorkspace?: boolean;
 }
 
 export const checks = {
   updateWorkspace: "updateWorkspace",
-} as const
+} as const;
 
 const permissionsToCheck = (workspace: TypesGen.Workspace) =>
   ({
@@ -39,18 +39,18 @@ const permissionsToCheck = (workspace: TypesGen.Workspace) =>
       },
       action: "update",
     },
-  }) as const
+  }) as const;
 
 export type WorkspaceScheduleEvent =
   | {
-      type: "SUBMIT_SCHEDULE"
-      autostart: TypesGen.UpdateWorkspaceAutostartRequest
-      autostartChanged: boolean
-      ttl: TypesGen.UpdateWorkspaceTTLRequest
-      autostopChanged: boolean
+      type: "SUBMIT_SCHEDULE";
+      autostart: TypesGen.UpdateWorkspaceAutostartRequest;
+      autostartChanged: boolean;
+      ttl: TypesGen.UpdateWorkspaceTTLRequest;
+      autostopChanged: boolean;
     }
   | { type: "RESTART_WORKSPACE" }
-  | { type: "APPLY_LATER" }
+  | { type: "APPLY_LATER" };
 
 export const workspaceSchedule =
   /** @xstate-layout N4IgpgJg5mDOIC5QHcD2AnA1rADgQwGMwBlAgC0gFcAbEgFzzrAGIBxAUQBUB9AdQHkASgGliABQCCAYXYBtAAwBdRKBypYASzobUAOxUgAHogCMAJgB0AVgAcAThsAWeXZMA2O2YDsdq1YA0IACeiGbyFl428o4AzFYmMT4xbl5mAL5pgWhYuIQk5FS0xAxMFjB02rpQvBjY+ETMEHpgFhq6AG6omC3lNTn1YArKSCBqmtp6BsYI7tbybmZ+9mYO8u6OgSEIMY6OFo5eC34mdqkLNhlZtblEpBQQNPSMPWAVbdXXA8xg6OgYFjhqIwAGYYAC2ZVefTqeSGBjGWh0+hG02SNmsXhMVhWdkcbkcNm8Xk2oRcFgW7hi8h8djcVkuIGyMNuBQeRRKLzeVTEPzBGlgmj0sEazVaHS6LQKBEwPPQfIFSNgcJGCImyNA0wAtOEYrjsa4vD5bMkEiSEG44uTFosCa41lY3AymTd8vdHsVnpCuVBZfLBbphT8-ugAUC6KC5RYpTLefz-UqlPD1IjJijEMkrBE3G4bO5cfN5GYzGadnsDgt5rmnFZHL4nZ88ndCk9Sjh0HAwLo6AAxcHMYgAVQAQgBZACSPGIUgAEuwACIDgAyckTKuTaqmiEzqTMdOzJixJi82OLwUQNic5MxrjxusS5nr-UbrPdHIssEoACM+d6m2yWE0ugtG0nTdO+X4-n+jzKqo65IpuMx7CYF7ZjYMSJLihpeBsZ4zO4Jj7HahomPINaEo4j7Mq6zYeqUH7flolRQFBtAikBYqgS09GQS+tCyCYwyweM8Fpggjg1hYu5UrqZiOCsjjmGaB5uARtYkfq7jUjYjqZIyDYsm67KetxjHvCxLBBv8gIguC4EMXQ5kwaMcGphq6YpBEB4JFYuqxN4Jhmq4bj7CkiReNEpykSYlEuuZtFcWQqDIO8ghwAw6B0HOGh4NQqBQMwgjsMQnASIIPACCI4jSCugnOcJrlGOeMT7LYyExMhClybESmJMFrU2OFDo+OYOlXE+Bk0W+sCJclVSpbA6WZdluX5RIYhiIuACa3CLhInDsIITmqiJbnbG4Oq1gpaxOHmMRKWY2kWPYObnehOwxDFAxxW+lnoGwXB8EIoiSDIR0ueqjXbFYdgWKcVZmCN5x+EpBJPa4ngmLE8jtV4GS6boqAQHABjOl9vEtmASb1RDWqo75GmGr4aFuGampYpYTgI-IUS+Nzhy47ppPPoZFOtBAtBUymNOmOEUQ1nidJWMe1IPazdIWDsXMHseXgxFEAtjVR32euUTHQi6ksbqJXgWPI8y1rJix23ESso3sdvRLrKxmDEjvpIL+nUf+8VekxvpxoqlsnZD6K5nYLhHnJNjYmsZoEjbuu+ASJqdbrn3C5Nnpth2Xa9nKUcNdMuxPdjaFOFS2ErGakTNQjDu3qkJF2PnE3B1NEGmVU5kV9LMzhNDSvzBa1IqZ4OFbLSMMWj7OZoXrhIfQH41B6+xkzSlaV4BlWU5XlI8ISReyYbJ5h2A4cnI7hI2ZtmcSRNpOZxP7huxeTIe-efUSthMyyU8PHO+R4LRKQks4HMmMDhfzWNFLeRs-5vkApTNc1MEK6hAe4c6pE6QDTCCzJ+tZY4nD1qkdCqQBYZCAA */
@@ -64,8 +64,8 @@ export const workspaceSchedule =
         events: {} as WorkspaceScheduleEvent,
         services: {} as {
           getTemplate: {
-            data: TypesGen.Template
-          }
+            data: TypesGen.Template;
+          };
         },
       },
       initial: "gettingPermissions",
@@ -188,7 +188,7 @@ export const workspaceSchedule =
             return API.startWorkspace(
               context.workspace.id,
               context.template.active_version_id,
-            )
+            );
           }
         },
       },
@@ -196,38 +196,38 @@ export const workspaceSchedule =
       services: {
         getTemplate: async (context) => {
           if (context.workspace) {
-            return await API.getTemplate(context.workspace.template_id)
+            return await API.getTemplate(context.workspace.template_id);
           } else {
-            throw Error("Can't fetch template without workspace.")
+            throw Error("Can't fetch template without workspace.");
           }
         },
         checkPermissions: async (context) => {
           if (context.workspace) {
             return await API.checkAuthorization({
               checks: permissionsToCheck(context.workspace),
-            })
+            });
           } else {
             throw Error(
               "Cannot check permissions without both workspace and user id",
-            )
+            );
           }
         },
         submitSchedule: async (context, event) => {
           if (!context.workspace?.id) {
             // This state is theoretically impossible, but helps TS
-            throw new Error("Failed to load workspace.")
+            throw new Error("Failed to load workspace.");
           }
 
           if (event.autostartChanged) {
             await API.putWorkspaceAutostart(
               context.workspace.id,
               event.autostart,
-            )
+            );
           }
           if (event.autostopChanged) {
-            await API.putWorkspaceAutostop(context.workspace.id, event.ttl)
+            await API.putWorkspaceAutostop(context.workspace.id, event.ttl);
           }
         },
       },
     },
-  )
+  );
diff --git a/site/static/error.html b/site/static/error.html
index 6fa05323b47d3..46c9a1b9e7f7a 100644
--- a/site/static/error.html
+++ b/site/static/error.html
@@ -38,7 +38,7 @@
         text-align: center;
       }
 
-      svg {
+      .coder-svg {
         width: 80px;
         margin-bottom: 24px;
       }
@@ -49,11 +49,18 @@
         margin-bottom: 8px;
       }
 
-      p {
+      p,
+      li {
         color: #b2bfd7;
         line-height: 140%;
       }
 
+      .warning li {
+        text-align: left;
+        padding-top: 10px;
+        margin-left: 30px;
+      }
+
       .button-group {
         display: flex;
         align-items: center;
@@ -83,11 +90,41 @@
       .button-group button:hover {
         border-color: hsl(222, 31%, 40%);
       }
+
+      .warning {
+        margin-top: 24px;
+        border: 1px solid rgb(243, 140, 89);
+        background: rgb(13, 19, 33);
+        width: calc(520px + var(--side-padding) * 2);
+        /* Recenter */
+        margin-left: calc(-1 * (100px + var(--side-padding)));
+        padding: 10px;
+      }
+
+      .warning-title {
+        display: inline-flex;
+        align-self: center;
+        align-items: center;
+      }
+
+      .svg-icon svg {
+        height: 1em;
+        width: 1em;
+      }
+
+      .warning-title h3 {
+        margin-left: 10px;
+      }
     </style>
   </head>
   <body>
     <div class="container">
-      <svg viewBox="0 0 36 36" fill="none" xmlns="http://www.w3.org/2000/svg">
+      <svg
+        class="coder-svg"
+        viewBox="0 0 36 36"
+        fill="none"
+        xmlns="http://www.w3.org/2000/svg"
+      >
         <g clip-path="url(#clip0_1094_2915)">
           <path
             d="M32.9812 15.9039C32.326 15.9039 31.8894 15.5197 31.8894 14.7311V10.202C31.8894 7.31059 30.6982 5.71326 27.6211 5.71326H26.1917V8.76638H26.6285C27.8394 8.76638 28.4152 9.43363 28.4152 10.6266V14.63C28.4152 16.3689 28.9313 17.0766 30.0629 17.4405C28.9313 17.7843 28.4152 18.5122 28.4152 20.251C28.4152 21.2418 28.4152 22.2325 28.4152 23.2233C28.4152 24.0523 28.4152 24.8611 28.1968 25.69C27.9784 26.4584 27.6211 27.1863 27.1248 27.8131C26.8468 28.1771 26.5292 28.4803 26.1719 28.7635V29.1678H27.6012C30.6784 29.1678 31.8696 27.5705 31.8696 24.6791V20.1499C31.8696 19.3411 32.2863 18.9772 32.9614 18.9772H33.7754V15.924H32.9812V15.9039Z"
@@ -131,6 +168,30 @@ <h1>
         .Error.Title }}
       </h1>
       <p>{{ .Error.Description }}</p>
+      {{- if .Error.Warnings }}
+      <div class="warning">
+        <div class="warning-title">
+          <svg
+            height="1em"
+            width="auto"
+            focusable="false"
+            aria-hidden="true"
+            viewBox="0 0 24 24"
+          >
+            <path
+              fill="#e66828"
+              d="M12 5.99L19.53 19H4.47L12 5.99M12 2L1 21h22L12 2zm1 14h-2v2h2v-2zm0-6h-2v4h2v-4z"
+            ></path>
+          </svg>
+          <h3>Warnings</h3>
+        </div>
+        <ul>
+          {{ range $i, $v := .Error.Warnings }}
+          <li>{{ $v }}</li>
+          {{ end }}
+        </ul>
+      </div>
+      {{ end }}
       <div class="button-group">
         {{- if .Error.RetryEnabled }}
         <button onclick="window.location.reload()">Retry</button>
diff --git a/site/static/gitauth.mp4 b/site/static/external-auth.mp4
similarity index 100%
rename from site/static/gitauth.mp4
rename to site/static/external-auth.mp4
diff --git a/site/static/favicons/favicon.png b/site/static/favicons/favicon-dark.png
similarity index 100%
rename from site/static/favicons/favicon.png
rename to site/static/favicons/favicon-dark.png
diff --git a/site/static/favicons/favicon.svg b/site/static/favicons/favicon-dark.svg
similarity index 100%
rename from site/static/favicons/favicon.svg
rename to site/static/favicons/favicon-dark.svg
diff --git a/site/static/favicons/favicon-error.png b/site/static/favicons/favicon-error-dark.png
similarity index 100%
rename from site/static/favicons/favicon-error.png
rename to site/static/favicons/favicon-error-dark.png
diff --git a/site/static/favicons/favicon-error.svg b/site/static/favicons/favicon-error-dark.svg
similarity index 100%
rename from site/static/favicons/favicon-error.svg
rename to site/static/favicons/favicon-error-dark.svg
diff --git a/site/static/favicons/favicon-error-light.png b/site/static/favicons/favicon-error-light.png
new file mode 100644
index 0000000000000..4905ae236cc99
Binary files /dev/null and b/site/static/favicons/favicon-error-light.png differ
diff --git a/site/static/favicons/favicon-error-light.svg b/site/static/favicons/favicon-error-light.svg
new file mode 100644
index 0000000000000..7737cfd357f97
--- /dev/null
+++ b/site/static/favicons/favicon-error-light.svg
@@ -0,0 +1,4 @@
+<svg width="117" height="117" viewBox="0 0 117 117" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M46.7154 35.6259C48.1678 35.6259 49.6204 35.7604 51.0068 36.0966V33.3396C51.0068 29.4396 52.9874 27.1534 56.9488 27.1534H58.4012V17H53.6476C43.4142 17 39.4531 22.3121 39.4531 31.9276V36.9034C41.7637 36.0966 44.2067 35.6259 46.7154 35.6259ZM107.059 46.9897C107.059 49.6121 108.511 50.8897 110.69 50.8897V50.9568H113.331V61.1103H110.624C108.379 61.1103 106.993 62.3206 106.993 65.0103V69.017C103.728 66.3694 99.8322 64.4685 95.5666 63.5745C95.9032 59.0518 97.6314 57.0187 100.985 56C97.2216 54.7897 95.5051 52.4362 95.5051 46.6535V33.3396C95.5051 29.3724 93.5905 27.1534 89.5633 27.1534H88.1107V17H92.8643C103.098 17 107.059 22.3121 107.059 31.9276V46.9897ZM86.184 63.2676C83.2966 59.0248 78.8606 55.9202 73.7182 54.9226C71.4076 54.452 69.0967 54.3846 66.8521 54.7881C66.8191 54.7881 66.8026 54.7713 66.7861 54.7544C66.7696 54.7376 66.7531 54.7208 66.7201 54.7208C63.0889 46.9881 55.2985 41.8777 46.8477 41.8777C38.397 41.8777 30.6726 46.8537 26.9753 54.5864C26.9423 54.5864 26.9258 54.6032 26.9093 54.62C26.8928 54.6369 26.8763 54.6537 26.8433 54.6537C24.4666 54.3846 22.0898 54.519 19.713 55.1243C11.5264 57.1414 5.32042 64.1346 4.19806 72.607C4.06602 73.4811 4 74.3552 4 75.1623C4 77.7173 5.71655 80.0708 8.22534 80.407C11.3283 80.8778 14.0352 78.457 13.9692 75.364C13.9692 74.8932 13.9692 74.3552 14.0352 73.8846C14.5634 69.5811 17.7984 65.9502 22.0237 64.9414C23.3442 64.6052 24.6646 64.5381 25.919 64.7399C29.9463 65.2778 33.9075 63.1932 35.6241 59.5623C36.8786 56.8726 38.8592 54.519 41.5001 53.2414C44.4048 51.8293 47.706 51.6278 50.7431 52.7037C53.9119 53.8467 56.2886 56.2673 57.7412 59.2932C57.886 59.5754 58.0236 59.8496 58.1569 60.1151L58.1569 60.1152C59.4209 62.6343 60.2943 64.3749 63.221 64.7399C64.5413 64.9414 68.2385 64.8743 69.625 64.807C71.9243 64.807 74.2236 65.4862 76.0374 66.8859C79.0787 65.0448 82.5126 63.787 86.184 63.2676ZM63.4171 94.7536C63.143 93.2104 63 91.6219 63 90C63 88.1659 63.1829 86.3746 63.5314 84.6432H55.3643C52.4596 84.6432 50.1487 82.2899 50.1487 79.3311V59.6293C50.1487 58.8226 49.4886 58.1502 48.6963 58.1502H46.6496C42.6222 58.2173 39.3873 62.7899 39.3873 67.6311V85.3158C39.3873 90.5605 43.5465 94.7967 48.6963 94.7967C48.6963 94.7967 56.7834 94.7729 63.4171 94.7536ZM63.683 32.3331H78.3397C78.6696 32.3331 78.9998 32.0641 78.9998 31.7279V30.5849C78.9998 30.2486 78.7357 29.9797 78.4057 29.9797H63.683C63.3528 29.9797 63.0889 30.2486 63.0889 30.5849V31.7279C63.0889 32.0641 63.3528 32.3331 63.683 32.3331ZM80.8483 46.8566H70.153C69.8228 46.8566 69.5586 46.5875 69.5586 46.2513V45.1083C69.5586 44.7722 69.8228 44.5031 70.153 44.5031H80.8483C81.1785 44.5031 81.4424 44.7722 81.4424 45.1083V46.2513C81.4424 46.5204 81.1785 46.8566 80.8483 46.8566ZM63.683 39.5948H85.0737C85.4039 39.5948 85.602 39.2586 85.602 38.9897V37.8465C85.602 37.5103 85.3379 37.2414 85.0077 37.2414H63.683C63.3528 37.2414 63.0889 37.5103 63.0889 37.8465V38.9897C63.0889 39.3259 63.3528 39.5948 63.683 39.5948Z" fill="white"/>
+<circle cx="90" cy="90" r="20" fill="#F44336"/>
+</svg>
diff --git a/site/static/favicons/favicon-light.png b/site/static/favicons/favicon-light.png
new file mode 100644
index 0000000000000..048d4e974ccec
Binary files /dev/null and b/site/static/favicons/favicon-light.png differ
diff --git a/site/static/favicons/favicon-light.svg b/site/static/favicons/favicon-light.svg
new file mode 100644
index 0000000000000..03949d61e9dcf
--- /dev/null
+++ b/site/static/favicons/favicon-light.svg
@@ -0,0 +1,8 @@
+<svg width="117" height="117" viewBox="0 0 117 117" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M109.69 52.8897C107.511 52.8897 106.059 51.6121 106.059 48.9897V33.9276C106.059 24.3121 102.098 19 91.8643 19H87.1107V29.1534H88.5633C92.5905 29.1534 94.5051 31.3724 94.5051 35.3396V48.6535C94.5051 54.4362 96.2216 56.7897 99.9849 58C96.2216 59.1432 94.5051 61.5638 94.5051 67.3465C94.5051 70.6415 94.5051 73.9362 94.5051 77.2312C94.5051 79.9879 94.5051 82.6776 93.7789 85.4344C93.0527 87.9897 91.8643 90.4103 90.2138 92.4947C89.2895 93.7053 88.2331 94.7138 87.0449 95.6553V97H91.7982C102.032 97 105.993 91.6879 105.993 82.0724V67.0103C105.993 64.3206 107.379 63.1103 109.624 63.1103H112.331V52.9568H109.69V52.8897Z" fill="white"/>
+<path d="M77.3397 34.3331H62.683C62.3528 34.3331 62.0889 34.0641 62.0889 33.7279V32.5849C62.0889 32.2486 62.3528 31.9797 62.683 31.9797H77.4057C77.7357 31.9797 77.9998 32.2486 77.9998 32.5849V33.7279C77.9998 34.0641 77.6696 34.3331 77.3397 34.3331Z" fill="white"/>
+<path d="M79.8483 48.8566H69.153C68.8228 48.8566 68.5586 48.5875 68.5586 48.2513V47.1083C68.5586 46.7722 68.8228 46.5031 69.153 46.5031H79.8483C80.1785 46.5031 80.4424 46.7722 80.4424 47.1083V48.2513C80.4424 48.5204 80.1785 48.8566 79.8483 48.8566Z" fill="white"/>
+<path d="M84.0737 41.5948H62.683C62.3528 41.5948 62.0889 41.3259 62.0889 40.9897V39.8465C62.0889 39.5103 62.3528 39.2414 62.683 39.2414H84.0077C84.3379 39.2414 84.602 39.5103 84.602 39.8465V40.9897C84.602 41.2586 84.4039 41.5948 84.0737 41.5948Z" fill="white"/>
+<path d="M45.7154 37.6259C47.1678 37.6259 48.6204 37.7604 50.0068 38.0966V35.3396C50.0068 31.4396 51.9874 29.1534 55.9488 29.1534H57.4012V19H52.6476C42.4142 19 38.4531 24.3121 38.4531 33.9276V38.9034C40.7637 38.0966 43.2067 37.6259 45.7154 37.6259Z" fill="white"/>
+<path d="M88.5634 74.2037C87.507 65.664 81.0369 58.5364 72.7182 56.9226C70.4076 56.452 68.0967 56.3846 65.8521 56.7881C65.7861 56.7881 65.7861 56.7208 65.7201 56.7208C62.0889 48.9881 54.2985 43.8777 45.8477 43.8777C37.397 43.8777 29.6726 48.8537 25.9753 56.5864C25.9093 56.5864 25.9093 56.6537 25.8433 56.6537C23.4666 56.3846 21.0898 56.519 18.713 57.1243C10.5264 59.1414 4.32042 66.1346 3.19806 74.607C3.06602 75.4811 3 76.3552 3 77.1623C3 79.7173 4.71655 82.0708 7.22534 82.407C10.3283 82.8778 13.0352 80.457 12.9692 77.364C12.9692 76.8932 12.9692 76.3552 13.0352 75.8846C13.5634 71.5811 16.7984 67.9502 21.0237 66.9414C22.3442 66.6052 23.6646 66.5381 24.919 66.7399C28.9463 67.2778 32.9075 65.1932 34.6241 61.5623C35.8786 58.8726 37.8592 56.519 40.5001 55.2414C43.4048 53.8293 46.706 53.6278 49.7431 54.7037C52.9119 55.8467 55.2886 58.2673 56.7412 61.2932C58.2596 64.252 58.9858 66.3364 62.221 66.7399C63.5413 66.9414 67.2385 66.8743 68.625 66.807C71.3319 66.807 74.0388 67.7484 75.9534 69.6984C77.2076 71.0432 78.1319 72.7243 78.5282 74.607C79.1223 77.6329 78.3961 80.6587 76.6135 82.9449C75.359 84.5587 73.6425 85.769 71.7279 86.307C70.8036 86.5761 69.8793 86.6432 68.955 86.6432C68.4269 86.6432 67.7007 86.6432 66.8425 86.6432C64.2017 86.6432 58.5898 86.6432 54.3643 86.6432C51.4596 86.6432 49.1487 84.2899 49.1487 81.3311V71.3793V61.6293C49.1487 60.8226 48.4886 60.1502 47.6963 60.1502H45.6496C41.6222 60.2173 38.3873 64.7899 38.3873 69.6311C38.3873 74.4726 38.3873 87.3158 38.3873 87.3158C38.3873 92.5605 42.5465 96.7967 47.6963 96.7967C47.6963 96.7967 70.6057 96.7293 70.9357 96.7293C76.2173 96.1914 81.103 93.4346 84.4039 89.1984C87.7051 85.0967 89.2235 79.7173 88.5634 74.2037Z" fill="white"/>
+</svg>
diff --git a/site/static/favicons/favicon-running.png b/site/static/favicons/favicon-running-dark.png
similarity index 100%
rename from site/static/favicons/favicon-running.png
rename to site/static/favicons/favicon-running-dark.png
diff --git a/site/static/favicons/favicon-running.svg b/site/static/favicons/favicon-running-dark.svg
similarity index 100%
rename from site/static/favicons/favicon-running.svg
rename to site/static/favicons/favicon-running-dark.svg
diff --git a/site/static/favicons/favicon-running-light.png b/site/static/favicons/favicon-running-light.png
new file mode 100644
index 0000000000000..5cd57da4d814a
Binary files /dev/null and b/site/static/favicons/favicon-running-light.png differ
diff --git a/site/static/favicons/favicon-running-light.svg b/site/static/favicons/favicon-running-light.svg
new file mode 100644
index 0000000000000..92e70c99444e9
--- /dev/null
+++ b/site/static/favicons/favicon-running-light.svg
@@ -0,0 +1,4 @@
+<svg width="117" height="117" viewBox="0 0 117 117" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M46.7154 35.6259C48.1678 35.6259 49.6204 35.7604 51.0068 36.0966V33.3396C51.0068 29.4396 52.9874 27.1534 56.9488 27.1534H58.4012V17H53.6476C43.4142 17 39.4531 22.3121 39.4531 31.9276V36.9034C41.7637 36.0966 44.2067 35.6259 46.7154 35.6259ZM107.059 46.9897C107.059 49.6121 108.511 50.8897 110.69 50.8897V50.9568H113.331V61.1103H110.624C108.379 61.1103 106.993 62.3206 106.993 65.0103V69.017C103.728 66.3694 99.8322 64.4685 95.5666 63.5745C95.9032 59.0518 97.6314 57.0187 100.985 56C97.2216 54.7897 95.5051 52.4362 95.5051 46.6535V33.3396C95.5051 29.3724 93.5905 27.1534 89.5633 27.1534H88.1107V17H92.8643C103.098 17 107.059 22.3121 107.059 31.9276V46.9897ZM86.184 63.2676C83.2966 59.0248 78.8606 55.9202 73.7182 54.9226C71.4076 54.452 69.0967 54.3846 66.8521 54.7881C66.8191 54.7881 66.8026 54.7713 66.7861 54.7544C66.7696 54.7376 66.7531 54.7208 66.7201 54.7208C63.0889 46.9881 55.2985 41.8777 46.8477 41.8777C38.397 41.8777 30.6726 46.8537 26.9753 54.5864C26.9423 54.5864 26.9258 54.6032 26.9093 54.62C26.8928 54.6369 26.8763 54.6537 26.8433 54.6537C24.4666 54.3846 22.0898 54.519 19.713 55.1243C11.5264 57.1414 5.32042 64.1346 4.19806 72.607C4.06602 73.4811 4 74.3552 4 75.1623C4 77.7173 5.71655 80.0708 8.22534 80.407C11.3283 80.8778 14.0352 78.457 13.9692 75.364C13.9692 74.8932 13.9692 74.3552 14.0352 73.8846C14.5634 69.5811 17.7984 65.9502 22.0237 64.9414C23.3442 64.6052 24.6646 64.5381 25.919 64.7399C29.9463 65.2778 33.9075 63.1932 35.6241 59.5623C36.8786 56.8726 38.8592 54.519 41.5001 53.2414C44.4048 51.8293 47.706 51.6278 50.7431 52.7037C53.9119 53.8467 56.2886 56.2673 57.7412 59.2932C57.886 59.5754 58.0236 59.8496 58.1569 60.1151L58.1569 60.1152C59.4209 62.6343 60.2943 64.3749 63.221 64.7399C64.5413 64.9414 68.2385 64.8743 69.625 64.807C71.9243 64.807 74.2236 65.4862 76.0374 66.8859C79.0787 65.0448 82.5126 63.787 86.184 63.2676ZM63.4171 94.7536C63.143 93.2104 63 91.6219 63 90C63 88.1659 63.1829 86.3746 63.5314 84.6432H55.3643C52.4596 84.6432 50.1487 82.2899 50.1487 79.3311V59.6293C50.1487 58.8226 49.4886 58.1502 48.6963 58.1502H46.6496C42.6222 58.2173 39.3873 62.7899 39.3873 67.6311V85.3158C39.3873 90.5605 43.5465 94.7967 48.6963 94.7967C48.6963 94.7967 56.7834 94.7729 63.4171 94.7536ZM63.683 32.3331H78.3397C78.6696 32.3331 78.9998 32.0641 78.9998 31.7279V30.5849C78.9998 30.2486 78.7357 29.9797 78.4057 29.9797H63.683C63.3528 29.9797 63.0889 30.2486 63.0889 30.5849V31.7279C63.0889 32.0641 63.3528 32.3331 63.683 32.3331ZM80.8483 46.8566H70.153C69.8228 46.8566 69.5586 46.5875 69.5586 46.2513V45.1083C69.5586 44.7722 69.8228 44.5031 70.153 44.5031H80.8483C81.1785 44.5031 81.4424 44.7722 81.4424 45.1083V46.2513C81.4424 46.5204 81.1785 46.8566 80.8483 46.8566ZM63.683 39.5948H85.0737C85.4039 39.5948 85.602 39.2586 85.602 38.9897V37.8465C85.602 37.5103 85.3379 37.2414 85.0077 37.2414H63.683C63.3528 37.2414 63.0889 37.5103 63.0889 37.8465V38.9897C63.0889 39.3259 63.3528 39.5948 63.683 39.5948Z" fill="white"/>
+<circle cx="90" cy="90" r="20" fill="#409BF4"/>
+</svg>
diff --git a/site/static/favicons/favicon-success.png b/site/static/favicons/favicon-success-dark.png
similarity index 100%
rename from site/static/favicons/favicon-success.png
rename to site/static/favicons/favicon-success-dark.png
diff --git a/site/static/favicons/favicon-success.svg b/site/static/favicons/favicon-success-dark.svg
similarity index 100%
rename from site/static/favicons/favicon-success.svg
rename to site/static/favicons/favicon-success-dark.svg
diff --git a/site/static/favicons/favicon-success-light.png b/site/static/favicons/favicon-success-light.png
new file mode 100644
index 0000000000000..45ee20c2ef059
Binary files /dev/null and b/site/static/favicons/favicon-success-light.png differ
diff --git a/site/static/favicons/favicon-success-light.svg b/site/static/favicons/favicon-success-light.svg
new file mode 100644
index 0000000000000..45254597e3d9e
--- /dev/null
+++ b/site/static/favicons/favicon-success-light.svg
@@ -0,0 +1,4 @@
+<svg width="117" height="117" viewBox="0 0 117 117" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M46.7154 35.6259C48.1678 35.6259 49.6204 35.7604 51.0068 36.0966V33.3396C51.0068 29.4396 52.9874 27.1534 56.9488 27.1534H58.4012V17H53.6476C43.4142 17 39.4531 22.3121 39.4531 31.9276V36.9034C41.7637 36.0966 44.2067 35.6259 46.7154 35.6259ZM107.059 46.9897C107.059 49.6121 108.511 50.8897 110.69 50.8897V50.9568H113.331V61.1103H110.624C108.379 61.1103 106.993 62.3206 106.993 65.0103V69.017C103.728 66.3694 99.8322 64.4685 95.5666 63.5745C95.9032 59.0518 97.6314 57.0187 100.985 56C97.2216 54.7897 95.5051 52.4362 95.5051 46.6535V33.3396C95.5051 29.3724 93.5905 27.1534 89.5633 27.1534H88.1107V17H92.8643C103.098 17 107.059 22.3121 107.059 31.9276V46.9897ZM86.184 63.2676C83.2966 59.0248 78.8606 55.9202 73.7182 54.9226C71.4076 54.452 69.0967 54.3846 66.8521 54.7881C66.8191 54.7881 66.8026 54.7713 66.7861 54.7544C66.7696 54.7376 66.7531 54.7208 66.7201 54.7208C63.0889 46.9881 55.2985 41.8777 46.8477 41.8777C38.397 41.8777 30.6726 46.8537 26.9753 54.5864C26.9423 54.5864 26.9258 54.6032 26.9093 54.62C26.8928 54.6369 26.8763 54.6537 26.8433 54.6537C24.4666 54.3846 22.0898 54.519 19.713 55.1243C11.5264 57.1414 5.32042 64.1346 4.19806 72.607C4.06602 73.4811 4 74.3552 4 75.1623C4 77.7173 5.71655 80.0708 8.22534 80.407C11.3283 80.8778 14.0352 78.457 13.9692 75.364C13.9692 74.8932 13.9692 74.3552 14.0352 73.8846C14.5634 69.5811 17.7984 65.9502 22.0237 64.9414C23.3442 64.6052 24.6646 64.5381 25.919 64.7399C29.9463 65.2778 33.9075 63.1932 35.6241 59.5623C36.8786 56.8726 38.8592 54.519 41.5001 53.2414C44.4048 51.8293 47.706 51.6278 50.7431 52.7037C53.9119 53.8467 56.2886 56.2673 57.7412 59.2932C57.886 59.5754 58.0236 59.8496 58.1569 60.1151L58.1569 60.1152C59.4209 62.6343 60.2943 64.3749 63.221 64.7399C64.5413 64.9414 68.2385 64.8743 69.625 64.807C71.9243 64.807 74.2236 65.4862 76.0374 66.8859C79.0787 65.0448 82.5126 63.787 86.184 63.2676ZM63.4171 94.7536C63.143 93.2104 63 91.6219 63 90C63 88.1659 63.1829 86.3746 63.5314 84.6432H55.3643C52.4596 84.6432 50.1487 82.2899 50.1487 79.3311V59.6293C50.1487 58.8226 49.4886 58.1502 48.6963 58.1502H46.6496C42.6222 58.2173 39.3873 62.7899 39.3873 67.6311V85.3158C39.3873 90.5605 43.5465 94.7967 48.6963 94.7967C48.6963 94.7967 56.7834 94.7729 63.4171 94.7536ZM63.683 32.3331H78.3397C78.6696 32.3331 78.9998 32.0641 78.9998 31.7279V30.5849C78.9998 30.2486 78.7357 29.9797 78.4057 29.9797H63.683C63.3528 29.9797 63.0889 30.2486 63.0889 30.5849V31.7279C63.0889 32.0641 63.3528 32.3331 63.683 32.3331ZM80.8483 46.8566H70.153C69.8228 46.8566 69.5586 46.5875 69.5586 46.2513V45.1083C69.5586 44.7722 69.8228 44.5031 70.153 44.5031H80.8483C81.1785 44.5031 81.4424 44.7722 81.4424 45.1083V46.2513C81.4424 46.5204 81.1785 46.8566 80.8483 46.8566ZM63.683 39.5948H85.0737C85.4039 39.5948 85.602 39.2586 85.602 38.9897V37.8465C85.602 37.5103 85.3379 37.2414 85.0077 37.2414H63.683C63.3528 37.2414 63.0889 37.5103 63.0889 37.8465V38.9897C63.0889 39.3259 63.3528 39.5948 63.683 39.5948Z" fill="white"/>
+<circle cx="90" cy="90" r="20" fill="#6BBE00"/>
+</svg>
diff --git a/site/static/favicons/favicon-warning.png b/site/static/favicons/favicon-warning-dark.png
similarity index 100%
rename from site/static/favicons/favicon-warning.png
rename to site/static/favicons/favicon-warning-dark.png
diff --git a/site/static/favicons/favicon-warning.svg b/site/static/favicons/favicon-warning-dark.svg
similarity index 100%
rename from site/static/favicons/favicon-warning.svg
rename to site/static/favicons/favicon-warning-dark.svg
diff --git a/site/static/favicons/favicon-warning-light.png b/site/static/favicons/favicon-warning-light.png
new file mode 100644
index 0000000000000..240a4629b9bad
Binary files /dev/null and b/site/static/favicons/favicon-warning-light.png differ
diff --git a/site/static/favicons/favicon-warning-light.svg b/site/static/favicons/favicon-warning-light.svg
new file mode 100644
index 0000000000000..fa951792ee62b
--- /dev/null
+++ b/site/static/favicons/favicon-warning-light.svg
@@ -0,0 +1,4 @@
+<svg width="117" height="117" viewBox="0 0 117 117" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M46.7154 35.6259C48.1678 35.6259 49.6204 35.7604 51.0068 36.0966V33.3396C51.0068 29.4396 52.9874 27.1534 56.9488 27.1534H58.4012V17H53.6476C43.4142 17 39.4531 22.3121 39.4531 31.9276V36.9034C41.7637 36.0966 44.2067 35.6259 46.7154 35.6259ZM107.059 46.9897C107.059 49.6121 108.511 50.8897 110.69 50.8897V50.9568H113.331V61.1103H110.624C108.379 61.1103 106.993 62.3206 106.993 65.0103V69.017C103.728 66.3694 99.8322 64.4685 95.5666 63.5745C95.9032 59.0518 97.6314 57.0187 100.985 56C97.2216 54.7897 95.5051 52.4362 95.5051 46.6535V33.3396C95.5051 29.3724 93.5905 27.1534 89.5633 27.1534H88.1107V17H92.8643C103.098 17 107.059 22.3121 107.059 31.9276V46.9897ZM86.184 63.2676C83.2966 59.0248 78.8606 55.9202 73.7182 54.9226C71.4076 54.452 69.0967 54.3846 66.8521 54.7881C66.8191 54.7881 66.8026 54.7713 66.7861 54.7544C66.7696 54.7376 66.7531 54.7208 66.7201 54.7208C63.0889 46.9881 55.2985 41.8777 46.8477 41.8777C38.397 41.8777 30.6726 46.8537 26.9753 54.5864C26.9423 54.5864 26.9258 54.6032 26.9093 54.62C26.8928 54.6369 26.8763 54.6537 26.8433 54.6537C24.4666 54.3846 22.0898 54.519 19.713 55.1243C11.5264 57.1414 5.32042 64.1346 4.19806 72.607C4.06602 73.4811 4 74.3552 4 75.1623C4 77.7173 5.71655 80.0708 8.22534 80.407C11.3283 80.8778 14.0352 78.457 13.9692 75.364C13.9692 74.8932 13.9692 74.3552 14.0352 73.8846C14.5634 69.5811 17.7984 65.9502 22.0237 64.9414C23.3442 64.6052 24.6646 64.5381 25.919 64.7399C29.9463 65.2778 33.9075 63.1932 35.6241 59.5623C36.8786 56.8726 38.8592 54.519 41.5001 53.2414C44.4048 51.8293 47.706 51.6278 50.7431 52.7037C53.9119 53.8467 56.2886 56.2673 57.7412 59.2932C57.886 59.5754 58.0236 59.8496 58.1569 60.1151L58.1569 60.1152C59.4209 62.6343 60.2943 64.3749 63.221 64.7399C64.5413 64.9414 68.2385 64.8743 69.625 64.807C71.9243 64.807 74.2236 65.4862 76.0374 66.8859C79.0787 65.0448 82.5126 63.787 86.184 63.2676ZM63.4171 94.7536C63.143 93.2104 63 91.6219 63 90C63 88.1659 63.1829 86.3746 63.5314 84.6432H55.3643C52.4596 84.6432 50.1487 82.2899 50.1487 79.3311V59.6293C50.1487 58.8226 49.4886 58.1502 48.6963 58.1502H46.6496C42.6222 58.2173 39.3873 62.7899 39.3873 67.6311V85.3158C39.3873 90.5605 43.5465 94.7967 48.6963 94.7967C48.6963 94.7967 56.7834 94.7729 63.4171 94.7536ZM63.683 32.3331H78.3397C78.6696 32.3331 78.9998 32.0641 78.9998 31.7279V30.5849C78.9998 30.2486 78.7357 29.9797 78.4057 29.9797H63.683C63.3528 29.9797 63.0889 30.2486 63.0889 30.5849V31.7279C63.0889 32.0641 63.3528 32.3331 63.683 32.3331ZM80.8483 46.8566H70.153C69.8228 46.8566 69.5586 46.5875 69.5586 46.2513V45.1083C69.5586 44.7722 69.8228 44.5031 70.153 44.5031H80.8483C81.1785 44.5031 81.4424 44.7722 81.4424 45.1083V46.2513C81.4424 46.5204 81.1785 46.8566 80.8483 46.8566ZM63.683 39.5948H85.0737C85.4039 39.5948 85.602 39.2586 85.602 38.9897V37.8465C85.602 37.5103 85.3379 37.2414 85.0077 37.2414H63.683C63.3528 37.2414 63.0889 37.5103 63.0889 37.8465V38.9897C63.0889 39.3259 63.3528 39.5948 63.683 39.5948Z" fill="white"/>
+<circle cx="90" cy="90" r="20" fill="#FFB74D"/>
+</svg>
diff --git a/site/static/icon/android-studio.svg b/site/static/icon/android-studio.svg
index 965cf72bc167b..6681425b604ed 100644
--- a/site/static/icon/android-studio.svg
+++ b/site/static/icon/android-studio.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" id="Layer_1" data-name="Layer 1" viewBox="0 0 409.24 496.55"><defs><style>.cls-1{fill:#073042}.cls-2{fill:#4285f4}.cls-3{fill:#3870b2}.cls-4{fill:#fff}.cls-5{fill:#3ddc84}</style></defs><title>android-studio</title><path d="M153.34,62.74H41.18A41.3,41.3,0,0,0,0,104a40,40,0,0,0,38.74,41.14l1.22,0H154.54Z" class="cls-1"/><path d="M408.84,429.74H41.05A41.3,41.3,0,0,1,0,388.58V103.77A41.3,41.3,0,0,0,41.1,145.28c.92,0,1.83,0,2.74-.08H348.9s59.94-5.2,59.94,40Z" class="cls-2"/><path d="M214.62,231.65a22.78,22.78,0,1,0,21.6,14.41A22.92,22.92,0,0,0,214.62,231.65Z"/><path d="M237.27,283.87a37,37,0,0,0-21.18-66.6h1.2a33.82,33.82,0,0,1,6.52,0V194.35a7.3,7.3,0,0,0-3.46-6.52,7.19,7.19,0,0,0-7.33,0,7.3,7.3,0,0,0-3.46,6.52v23.32a37.16,37.16,0,0,0-16.25,66.6L125.5,429.21h44.23L201,362.6a16.26,16.26,0,0,1,14.66-9.19,16,16,0,0,1,14.52,9.19l32.23,66.61H307.2Zm-22.65-6.53a23,23,0,1,1,22.91-22.91,22.91,22.91,0,0,1-22.91,22.91Z" class="cls-3"/><path d="M129.1,83H286.42V111.9H129.1Z" class="cls-4"/><path d="M202.37,231.65a22.77,22.77,0,1,1-16.26,6.66A23.25,23.25,0,0,1,202.37,231.65Zm9-13.32v-24a7.3,7.3,0,0,0-3.46-6.52,7.19,7.19,0,0,0-7.33,0,7.32,7.32,0,0,0-3.46,6.52v23.32a37.16,37.16,0,0,0-16.25,66.6L95.8,467.44a20.24,20.24,0,0,0,1.46,20.38,20.54,20.54,0,0,0,18.52,8.66,20.13,20.13,0,0,0,16.52-12L189,362.6a16.39,16.39,0,0,1,14.66-9.19,16,16,0,0,1,14.52,9.19l58.21,121.22a20.13,20.13,0,1,0,36.23-17.58L225,283.87a37.48,37.48,0,0,0-13.32-65.4" class="cls-1"/><path d="M263.64,108.43a10.66,10.66,0,0,1-7.72-18.25,10.79,10.79,0,0,1,18.38,7.6,10.65,10.65,0,0,1-10.66,10.65h0m-118.42,0a10.66,10.66,0,0,1-7.6-18.25,10.79,10.79,0,0,1,16.69,13.69,10.63,10.63,0,0,1-1.5,1.5,10.51,10.51,0,0,1-7.59,3.06m122.29-64.6,21.31-37a4.53,4.53,0,0,0-7.73-4.53L259.51,39.83a134.25,134.25,0,0,0-110,0L127.77,2.26A4.54,4.54,0,0,0,123.9,0,4.92,4.92,0,0,0,120,2.26a4.53,4.53,0,0,0,0,4.53l21.45,37A126.8,126.8,0,0,0,76,145.2h257.1A126.85,126.85,0,0,0,267.51,43.83" class="cls-5"/><path d="M371.94,224.19H355a2.14,2.14,0,0,0-2.14,2.14h0V493.41a2.13,2.13,0,0,0,2,2.13h17.45a37,37,0,0,0,36.9-37V187.16a37,37,0,0,1-37,37Z" class="cls-1"/></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" id="Layer_1" data-name="Layer 1" viewBox="0 0 409.24 496.55" width="409.24px" height="496.55px"><defs><style>.cls-1{fill:#073042}.cls-2{fill:#4285f4}.cls-3{fill:#3870b2}.cls-4{fill:#fff}.cls-5{fill:#3ddc84}</style></defs><title>android-studio</title><path d="M153.34,62.74H41.18A41.3,41.3,0,0,0,0,104a40,40,0,0,0,38.74,41.14l1.22,0H154.54Z" class="cls-1"/><path d="M408.84,429.74H41.05A41.3,41.3,0,0,1,0,388.58V103.77A41.3,41.3,0,0,0,41.1,145.28c.92,0,1.83,0,2.74-.08H348.9s59.94-5.2,59.94,40Z" class="cls-2"/><path d="M214.62,231.65a22.78,22.78,0,1,0,21.6,14.41A22.92,22.92,0,0,0,214.62,231.65Z"/><path d="M237.27,283.87a37,37,0,0,0-21.18-66.6h1.2a33.82,33.82,0,0,1,6.52,0V194.35a7.3,7.3,0,0,0-3.46-6.52,7.19,7.19,0,0,0-7.33,0,7.3,7.3,0,0,0-3.46,6.52v23.32a37.16,37.16,0,0,0-16.25,66.6L125.5,429.21h44.23L201,362.6a16.26,16.26,0,0,1,14.66-9.19,16,16,0,0,1,14.52,9.19l32.23,66.61H307.2Zm-22.65-6.53a23,23,0,1,1,22.91-22.91,22.91,22.91,0,0,1-22.91,22.91Z" class="cls-3"/><path d="M129.1,83H286.42V111.9H129.1Z" class="cls-4"/><path d="M202.37,231.65a22.77,22.77,0,1,1-16.26,6.66A23.25,23.25,0,0,1,202.37,231.65Zm9-13.32v-24a7.3,7.3,0,0,0-3.46-6.52,7.19,7.19,0,0,0-7.33,0,7.32,7.32,0,0,0-3.46,6.52v23.32a37.16,37.16,0,0,0-16.25,66.6L95.8,467.44a20.24,20.24,0,0,0,1.46,20.38,20.54,20.54,0,0,0,18.52,8.66,20.13,20.13,0,0,0,16.52-12L189,362.6a16.39,16.39,0,0,1,14.66-9.19,16,16,0,0,1,14.52,9.19l58.21,121.22a20.13,20.13,0,1,0,36.23-17.58L225,283.87a37.48,37.48,0,0,0-13.32-65.4" class="cls-1"/><path d="M263.64,108.43a10.66,10.66,0,0,1-7.72-18.25,10.79,10.79,0,0,1,18.38,7.6,10.65,10.65,0,0,1-10.66,10.65h0m-118.42,0a10.66,10.66,0,0,1-7.6-18.25,10.79,10.79,0,0,1,16.69,13.69,10.63,10.63,0,0,1-1.5,1.5,10.51,10.51,0,0,1-7.59,3.06m122.29-64.6,21.31-37a4.53,4.53,0,0,0-7.73-4.53L259.51,39.83a134.25,134.25,0,0,0-110,0L127.77,2.26A4.54,4.54,0,0,0,123.9,0,4.92,4.92,0,0,0,120,2.26a4.53,4.53,0,0,0,0,4.53l21.45,37A126.8,126.8,0,0,0,76,145.2h257.1A126.85,126.85,0,0,0,267.51,43.83" class="cls-5"/><path d="M371.94,224.19H355a2.14,2.14,0,0,0-2.14,2.14h0V493.41a2.13,2.13,0,0,0,2,2.13h17.45a37,37,0,0,0,36.9-37V187.16a37,37,0,0,1-37,37Z" class="cls-1"/></svg>
diff --git a/site/static/icon/apple-black.svg b/site/static/icon/apple-black.svg
new file mode 100644
index 0000000000000..82b0cddcdbf27
--- /dev/null
+++ b/site/static/icon/apple-black.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="814" height="1000">
+  <path d="M788.1 340.9c-5.8 4.5-108.2 62.2-108.2 190.5 0 148.4 130.3 200.9 134.2 202.2-.6 3.2-20.7 71.9-68.7 141.9-42.8 61.6-87.5 123.1-155.5 123.1s-85.5-39.5-164-39.5c-76.5 0-103.7 40.8-165.9 40.8s-105.6-57-155.5-127C46.7 790.7 0 663 0 541.8c0-194.4 126.4-297.5 250.8-297.5 66.1 0 121.2 43.4 162.7 43.4 39.5 0 101.1-46 176.3-46 28.5 0 130.9 2.6 198.3 99.2zm-234-181.5c31.1-36.9 53.1-88.1 53.1-139.3 0-7.1-.6-14.3-1.9-20.1-50.6 1.9-110.8 33.7-147.1 75.8-28.5 32.4-55.1 83.6-55.1 135.5 0 7.8 1.3 15.6 1.9 18.1 3.2.6 8.4 1.3 13.6 1.3 45.4 0 102.5-30.4 135.5-71.3z"/>
+</svg>
\ No newline at end of file
diff --git a/site/static/icon/apple-grey.svg b/site/static/icon/apple-grey.svg
new file mode 100644
index 0000000000000..3f06156a4bce8
--- /dev/null
+++ b/site/static/icon/apple-grey.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="842.32007" height="1000.0001">
+  <path fill="#b3b3b3" d="M824.66636 779.30363c-15.12299 34.93724-33.02368 67.09674-53.7638 96.66374-28.27076 40.3074-51.4182 68.2078-69.25717 83.7012-27.65347 25.4313-57.2822 38.4556-89.00964 39.1963-22.77708 0-50.24539-6.4813-82.21973-19.629-32.07926-13.0861-61.55985-19.5673-88.51583-19.5673-28.27075 0-58.59083 6.4812-91.02193 19.5673-32.48053 13.1477-58.64639 19.9994-78.65196 20.6784-30.42501 1.29623-60.75123-12.0985-91.02193-40.2457-19.32039-16.8514-43.48632-45.7394-72.43607-86.6641-31.060778-43.7024-56.597041-94.37983-76.602609-152.15586C10.740416 658.44309 0 598.01283 0 539.50845c0-67.01648 14.481044-124.8172 43.486336-173.25401C66.28194 327.34823 96.60818 296.6578 134.5638 274.1276c37.95566-22.53016 78.96676-34.01129 123.1321-34.74585 24.16591 0 55.85633 7.47508 95.23784 22.166 39.27042 14.74029 64.48571 22.21538 75.54091 22.21538 8.26518 0 36.27668-8.7405 83.7629-26.16587 44.90607-16.16001 82.80614-22.85118 113.85458-20.21546 84.13326 6.78992 147.34122 39.95559 189.37699 99.70686-75.24463 45.59122-112.46573 109.4473-111.72502 191.36456.67899 63.8067 23.82643 116.90384 69.31888 159.06309 20.61664 19.56727 43.64066 34.69027 69.2571 45.4307-5.55531 16.11062-11.41933 31.54225-17.65372 46.35662zM631.70926 20.0057c0 50.01141-18.27108 96.70693-54.6897 139.92782-43.94932 51.38118-97.10817 81.07162-154.75459 76.38659-.73454-5.99983-1.16045-12.31444-1.16045-18.95003 0-48.01091 20.9006-99.39207 58.01678-141.40314 18.53027-21.27094 42.09746-38.95744 70.67685-53.0663C578.3158 9.00229 605.2903 1.31621 630.65988 0c.74076 6.68575 1.04938 13.37191 1.04938 20.00505z"/>
+</svg>
\ No newline at end of file
diff --git a/site/static/icon/azure-devops.svg b/site/static/icon/azure-devops.svg
new file mode 100644
index 0000000000000..2a8c0366f81d8
--- /dev/null
+++ b/site/static/icon/azure-devops.svg
@@ -0,0 +1,21 @@
+<svg viewBox="0 0 111 110" xmlns="http://www.w3.org/2000/svg" width="111px" height="110px">
+    <g clipPath="url(#clip0_1916_993)">
+      <path
+        d="M83.0365 94.769L0 82.288L83.0365 110L111 98.365V11.2115L83.0365 0V94.769Z"
+        fill="#0078D7"
+      />
+      <path
+        d="M69 27L53.7692 29.7741V63.7029L14 58.5816L30.2885 78V69.8912L53.7692 78L68.7885 65.41"
+        fill="#0078D7"
+      />
+      <path
+        d="M53 30C50.0594 27.7015 34.3059 16 34.3059 16V22.4776L13.0913 30.8358L7 38.7761V55.9104L13.5114 58V37.3134L53 30Z"
+        fill="#0078D7"
+      />
+    </g>
+    <defs>
+      <clipPath id="clip0_1916_993">
+        <rect width="111" height="110" fill="white" />
+      </clipPath>
+    </defs>
+  </svg>
diff --git a/site/static/icon/bitbucket.svg b/site/static/icon/bitbucket.svg
new file mode 100644
index 0000000000000..32535cb579904
--- /dev/null
+++ b/site/static/icon/bitbucket.svg
@@ -0,0 +1,28 @@
+<svg viewBox="0 0 501 450" xmlns="http://www.w3.org/2000/svg" width="501px" height="450px">
+    <g clip-path="url(#clip0_1917_1001)">
+      <path
+        d="M17.0206 0.0721333C14.6826 0.0419786 12.3663 0.523969 10.2344 1.48427C8.10245 2.44457 6.20658 3.8599 4.67987 5.63088C3.15316 7.40186 2.03262 9.48557 1.39691 11.7357C0.761211 13.9858 0.625758 16.3479 1.00007 18.6559L69.0071 431.504C69.8544 436.556 72.4548 441.148 76.3515 444.474C80.2481 447.799 85.1919 449.645 90.3144 449.688H416.572C420.412 449.737 424.142 448.405 427.082 445.935C430.023 443.465 431.978 440.021 432.592 436.23L500.6 18.736C500.974 16.428 500.838 14.0659 500.203 11.8158C499.567 9.56568 498.446 7.48197 496.92 5.71098C495.393 3.94 493.497 2.52467 491.365 1.56437C489.233 0.604073 486.917 0.122079 484.579 0.152234L17.0206 0.0721333ZM303.387 298.454H199.254L171.058 151.146H328.619L303.387 298.454Z"
+        fill="#2684FF"
+      />
+      <path
+        d="M478.972 151.146H328.619L303.387 298.454H199.254L76.2964 444.401C80.1936 447.771 85.1624 449.645 90.3143 449.688H416.652C420.492 449.737 424.222 448.405 427.162 445.935C430.103 443.465 432.058 440.021 432.673 436.23L478.972 151.146Z"
+        fill="url(#paint0_linear_1917_1001)"
+      />
+    </g>
+    <defs>
+      <linearGradient
+        id="paint0_linear_1917_1001"
+        x1="513.736"
+        y1="192.398"
+        x2="265.258"
+        y2="386.327"
+        gradientUnits="userSpaceOnUse"
+      >
+        <stop offset="0.18" stop-color="#0052CC" />
+        <stop offset="1" stop-color="#2684FF" />
+      </linearGradient>
+      <clipPath id="clip0_1917_1001">
+        <rect width="501" height="450" fill="white" />
+      </clipPath>
+    </defs>
+  </svg>
diff --git a/site/static/icon/clion.svg b/site/static/icon/clion.svg
index 52592f88a5b2d..fcdebbc861d58 100644
--- a/site/static/icon/clion.svg
+++ b/site/static/icon/clion.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" data-name="Layer 1" viewBox="0 0 128 128"><defs><linearGradient id="linear-gradient" x1="40.69" x2="83.48" y1="-676.56" y2="-676.56" gradientTransform="matrix(1, 0, 0, -1, 0, -648.86)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#ed358c"/><stop offset=".16" stop-color="#e9388c"/><stop offset=".3" stop-color="#de418c"/><stop offset=".43" stop-color="#cc508c"/><stop offset=".57" stop-color="#b2658d"/><stop offset=".7" stop-color="#90808d"/><stop offset=".83" stop-color="#67a18e"/><stop offset=".95" stop-color="#37c78f"/><stop offset="1" stop-color="#22d88f"/></linearGradient><linearGradient id="linear-gradient-2" x1="32.58" x2="13.76" y1="-665.27" y2="-791.59" gradientTransform="matrix(1, 0, 0, -1, 0, -648.86)" gradientUnits="userSpaceOnUse"><stop offset=".09" stop-color="#22d88f"/><stop offset=".9" stop-color="#029de0"/></linearGradient><linearGradient id="linear-gradient-3" x1="116.68" x2="-12.09" y1="-660.66" y2="-796.66" xlink:href="#linear-gradient-2"/><linearGradient id="linear-gradient-4" x1="73.35" x2="122.29" y1="-739.1" y2="-746.06" xlink:href="#linear-gradient-2"/></defs><title>icon_CLion</title><g><polygon fill="url(#linear-gradient)" points="49.2 51.8 40.6 55.4 48.4 0 77.8 16.2 49.2 51.8"/><polygon fill="url(#linear-gradient-2)" points="44.6 76.8 48.8 0 11.8 23.2 0 94 44.6 76.8"/><polygon fill="url(#linear-gradient-3)" points="125.4 38.4 109 4.8 77.8 16.2 55 41.4 0 94 41.6 124.4 93.6 77.2 125.4 38.4"/><polygon fill="url(#linear-gradient-4)" points="53.8 54.6 46.6 98.4 75.8 121 107.8 128 128 82.4 53.8 54.6"/></g><g><rect width="80" height="80" x="24" y="24"/><rect width="30" height="5" x="31.6" y="89" fill="#fff"/><path fill="#fff" d="M31,51.2h0A16.83,16.83,0,0,1,48.2,34c6.2,0,10,2,13,5.2l-4.6,5.4c-2.6-2.4-5.2-3.8-8.4-3.8-5.6,0-9.6,4.6-9.6,10.4h0c0,5.6,4,10.4,9.6,10.4,3.8,0,6.2-1.6,8.8-3.8l4.6,4.6c-3.4,3.6-7.2,6-13.6,6A17,17,0,0,1,31,51.2"/><path fill="#fff" d="M66.6,34.4H74v27H88.4v6.2H66.6V34.4Z"/></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" data-name="Layer 1" viewBox="0 0 128 128" width="128px" height="128px"><defs><linearGradient id="linear-gradient" x1="40.69" x2="83.48" y1="-676.56" y2="-676.56" gradientTransform="matrix(1, 0, 0, -1, 0, -648.86)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#ed358c"/><stop offset=".16" stop-color="#e9388c"/><stop offset=".3" stop-color="#de418c"/><stop offset=".43" stop-color="#cc508c"/><stop offset=".57" stop-color="#b2658d"/><stop offset=".7" stop-color="#90808d"/><stop offset=".83" stop-color="#67a18e"/><stop offset=".95" stop-color="#37c78f"/><stop offset="1" stop-color="#22d88f"/></linearGradient><linearGradient id="linear-gradient-2" x1="32.58" x2="13.76" y1="-665.27" y2="-791.59" gradientTransform="matrix(1, 0, 0, -1, 0, -648.86)" gradientUnits="userSpaceOnUse"><stop offset=".09" stop-color="#22d88f"/><stop offset=".9" stop-color="#029de0"/></linearGradient><linearGradient id="linear-gradient-3" x1="116.68" x2="-12.09" y1="-660.66" y2="-796.66" xlink:href="#linear-gradient-2"/><linearGradient id="linear-gradient-4" x1="73.35" x2="122.29" y1="-739.1" y2="-746.06" xlink:href="#linear-gradient-2"/></defs><title>icon_CLion</title><g><polygon fill="url(#linear-gradient)" points="49.2 51.8 40.6 55.4 48.4 0 77.8 16.2 49.2 51.8"/><polygon fill="url(#linear-gradient-2)" points="44.6 76.8 48.8 0 11.8 23.2 0 94 44.6 76.8"/><polygon fill="url(#linear-gradient-3)" points="125.4 38.4 109 4.8 77.8 16.2 55 41.4 0 94 41.6 124.4 93.6 77.2 125.4 38.4"/><polygon fill="url(#linear-gradient-4)" points="53.8 54.6 46.6 98.4 75.8 121 107.8 128 128 82.4 53.8 54.6"/></g><g><rect width="80" height="80" x="24" y="24"/><rect width="30" height="5" x="31.6" y="89" fill="#fff"/><path fill="#fff" d="M31,51.2h0A16.83,16.83,0,0,1,48.2,34c6.2,0,10,2,13,5.2l-4.6,5.4c-2.6-2.4-5.2-3.8-8.4-3.8-5.6,0-9.6,4.6-9.6,10.4h0c0,5.6,4,10.4,9.6,10.4,3.8,0,6.2-1.6,8.8-3.8l4.6,4.6c-3.4,3.6-7.2,6-13.6,6A17,17,0,0,1,31,51.2"/><path fill="#fff" d="M66.6,34.4H74v27H88.4v6.2H66.6V34.4Z"/></g></svg>
diff --git a/site/static/icon/code.svg b/site/static/icon/code.svg
index c6ee366939ba4..5ef5c3ec5110b 100644
--- a/site/static/icon/code.svg
+++ b/site/static/icon/code.svg
@@ -1,4 +1,4 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" fill="none">
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" fill="none" width="100px" height="100px">
 <mask id="mask0" mask-type="alpha" maskUnits="userSpaceOnUse" x="0" y="0" width="100" height="100">
 <path fill-rule="evenodd" clip-rule="evenodd" d="M70.9119 99.3171C72.4869 99.9307 74.2828 99.8914 75.8725 99.1264L96.4608 89.2197C98.6242 88.1787 100 85.9892 100 83.5872V16.4133C100 14.0113 98.6243 11.8218 96.4609 10.7808L75.8725 0.873756C73.7862 -0.130129 71.3446 0.11576 69.5135 1.44695C69.252 1.63711 69.0028 1.84943 68.769 2.08341L29.3551 38.0415L12.1872 25.0096C10.589 23.7965 8.35363 23.8959 6.86933 25.2461L1.36303 30.2549C-0.452552 31.9064 -0.454633 34.7627 1.35853 36.417L16.2471 50.0001L1.35853 63.5832C-0.454633 65.2374 -0.452552 68.0938 1.36303 69.7453L6.86933 74.7541C8.35363 76.1043 10.589 76.2037 12.1872 74.9905L29.3551 61.9587L68.769 97.9167C69.3925 98.5406 70.1246 99.0104 70.9119 99.3171ZM75.0152 27.2989L45.1091 50.0001L75.0152 72.7012V27.2989Z" fill="white"/>
 </mask>
diff --git a/site/static/icon/coder.svg b/site/static/icon/coder.svg
new file mode 100644
index 0000000000000..3bb941d9e9d46
--- /dev/null
+++ b/site/static/icon/coder.svg
@@ -0,0 +1,8 @@
+<svg width="66" height="48" viewBox="0 0 66 48" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M64.3029 20.8302C62.9894 20.8302 62.1144 20.0449 62.1144 18.4331V9.17517C62.1144 3.26504 59.7268 0 53.5592 0H50.6941V6.24078H51.5697C53.9968 6.24078 55.1508 7.60467 55.1508 10.0431V18.2264C55.1508 21.7807 56.1853 23.2273 58.4535 23.9713C56.1853 24.6739 55.1508 26.1617 55.1508 29.716C55.1508 31.7412 55.1508 33.7663 55.1508 35.7916C55.1508 37.4861 55.1508 39.1393 54.7131 40.8337C54.2754 42.4044 53.5592 43.8922 52.5644 45.1733C52.0073 45.9174 51.3707 46.5373 50.6545 47.116V47.9425H53.5193C59.687 47.9425 62.0746 44.6774 62.0746 38.7672V29.5094C62.0746 27.8562 62.9103 27.1123 64.2634 27.1123H65.8944V20.8714H64.3029V20.8302Z" fill="#D9D9D9"/>
+<path d="M44.8049 9.42443H35.9712C35.7722 9.42443 35.6131 9.25912 35.6131 9.05247V8.34987C35.6131 8.14322 35.7722 7.97791 35.9712 7.97791H44.8447C45.0436 7.97791 45.2028 8.14322 45.2028 8.34987V9.05247C45.2028 9.25912 45.0038 9.42443 44.8049 9.42443Z" fill="#D9D9D9"/>
+<path d="M46.3171 18.3513H39.871C39.672 18.3513 39.5128 18.1859 39.5128 17.9792V17.2767C39.5128 17.0701 39.672 16.9047 39.871 16.9047H46.3171C46.5161 16.9047 46.6752 17.0701 46.6752 17.2767V17.9792C46.6752 18.1446 46.5161 18.3513 46.3171 18.3513Z" fill="#D9D9D9"/>
+<path d="M48.8636 13.8879H35.9712C35.7722 13.8879 35.6131 13.7226 35.6131 13.5159V12.8133C35.6131 12.6067 35.7722 12.4413 35.9712 12.4413H48.8237C49.0228 12.4413 49.182 12.6067 49.182 12.8133V13.5159C49.182 13.6812 49.0626 13.8879 48.8636 13.8879Z" fill="#D9D9D9"/>
+<path d="M25.7449 11.4483C26.6203 11.4483 27.4958 11.531 28.3313 11.7377V10.0431C28.3313 7.64602 29.5251 6.24078 31.9126 6.24078H32.7879V0H29.923C23.7552 0 21.3679 3.26504 21.3679 9.17517V12.2336C22.7605 11.7377 24.2329 11.4483 25.7449 11.4483Z" fill="#D9D9D9"/>
+<path d="M51.5695 33.9308C50.9329 28.6819 47.0333 24.3009 42.0196 23.3089C40.6269 23.0197 39.2342 22.9783 37.8813 23.2263C37.8415 23.2263 37.8415 23.1849 37.8018 23.1849C35.6132 18.4321 30.9179 15.291 25.8246 15.291C20.7313 15.291 16.0757 18.3494 13.8474 23.1023C13.8076 23.1023 13.8076 23.1437 13.7678 23.1437C12.3353 22.9783 10.9028 23.0609 9.47035 23.433C4.5362 24.6728 0.795835 28.9711 0.119377 34.1786C0.039787 34.7159 0 35.2532 0 35.7492C0 37.3196 1.03457 38.7662 2.54664 38.9729C4.41683 39.2623 6.04827 37.7743 6.00848 35.8732C6.00848 35.5838 6.00848 35.2532 6.04827 34.9639C6.36659 32.3188 8.31638 30.087 10.863 29.467C11.6589 29.2604 12.4547 29.2191 13.2107 29.3432C15.638 29.6738 18.0255 28.3925 19.06 26.1607C19.8161 24.5075 21.0098 23.0609 22.6015 22.2757C24.3522 21.4077 26.3418 21.2838 28.1723 21.9452C30.0822 22.6477 31.5146 24.1355 32.3901 25.9953C33.3053 27.814 33.743 29.0951 35.6928 29.3432C36.4886 29.467 38.7169 29.4257 39.5526 29.3844C41.184 29.3844 42.8154 29.963 43.9694 31.1616C44.7254 31.9881 45.2825 33.0214 45.5213 34.1786C45.8793 36.0385 45.4417 37.8983 44.3673 39.3035C43.6112 40.2954 42.5767 41.0394 41.4227 41.37C40.8656 41.5354 40.3085 41.5766 39.7514 41.5766C39.4332 41.5766 38.9955 41.5766 38.4782 41.5766C36.8866 41.5766 33.5043 41.5766 30.9576 41.5766C29.2069 41.5766 27.8141 40.1302 27.8141 38.3116V26.2019C27.8141 25.7061 27.4162 25.2928 26.9387 25.2928H25.7052C23.2778 25.334 21.3281 28.1446 21.3281 31.1202C21.3281 34.096 21.3281 41.99 21.3281 41.99C21.3281 45.2137 23.8349 47.8175 26.9387 47.8175C26.9387 47.8175 40.7464 47.7761 40.9452 47.7761C44.1285 47.4454 47.0731 45.751 49.0626 43.1472C51.0522 40.6261 51.9674 37.3196 51.5695 33.9308Z" fill="#D9D9D9"/>
+</svg>
diff --git a/site/static/icon/conda.svg b/site/static/icon/conda.svg
index cbc4286cec73a..dc442e1a99e2e 100644
--- a/site/static/icon/conda.svg
+++ b/site/static/icon/conda.svg
@@ -1,6 +1,7 @@
 <?xml version="1.0" encoding="iso-8859-1"?>
 <!-- Generator: Adobe Illustrator 26.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
 <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="48px" height="48px"
 	 viewBox="0 0 48 48" style="enable-background:new 0 0 48 48;" xml:space="preserve">
 <g id="&#x421;&#x43B;&#x43E;&#x439;_1">
 </g>
@@ -37,4 +38,4 @@
 		c-1.146-0.437-2.237-0.972-3.252-1.553c-0.775,1.586-1.341,3.103-1.722,4.276c1.202,0.291,2.823,0.608,4.613,0.779
 		C11.214,33.341,11.324,32.161,11.541,30.983z"/>
 </g>
-</svg>
\ No newline at end of file
+</svg>
diff --git a/site/static/icon/datagrip.svg b/site/static/icon/datagrip.svg
index 2638fea784c7f..83913d6e9441d 100644
--- a/site/static/icon/datagrip.svg
+++ b/site/static/icon/datagrip.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" enable-background="new 0 0 70 70" version="1.0" viewBox="0 0 70 70" xml:space="preserve"><g><g><polygon fill="#9775F8" points="65.5 10.9 70 39.5 53 49.4 49.8 33.2"/><linearGradient id="SVGID_1_" x1="41.069" x2="46.521" y1="54.357" y2="67.944" gradientTransform="matrix(1 0 0 -1 0 72)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#9775f8"/><stop offset=".952" style="stop-color:#22d88f"/></linearGradient><polygon fill="url(#SVGID_1_)" points="65.5 10.9 40.5 0 19.4 17.5 49.8 33.2"/><linearGradient id="SVGID_2_" x1="17.067" x2="24.146" y1="35.739" y2="4.895" gradientTransform="matrix(1 0 0 -1 0 72)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#9775f8"/><stop offset=".214" style="stop-color:#689cce"/><stop offset=".423" style="stop-color:#42bdac"/><stop offset=".59" style="stop-color:#2bd197"/><stop offset=".694" style="stop-color:#22d88f"/></linearGradient><polygon fill="url(#SVGID_2_)" points="47.3 70 18 30.6 9.3 36.4 .6 62.5"/><linearGradient id="SVGID_3_" x1="4.9" x2="66.239" y1="37.969" y2="4.102" gradientTransform="matrix(1 0 0 -1 0 72)" gradientUnits="userSpaceOnUse"><stop offset=".075" style="stop-color:#22d88f"/><stop offset=".72" style="stop-color:#9775f8"/></linearGradient><polygon fill="url(#SVGID_3_)" points="52.8 50.1 32.3 36.6 0 32.3 47.3 70"/><linearGradient id="SVGID_4_" x1="0" x2="61.646" y1="45.15" y2="45.15" gradientTransform="matrix(1 0 0 -1 0 72)" gradientUnits="userSpaceOnUse"><stop offset=".075" style="stop-color:#22d88f"/><stop offset=".266" style="stop-color:#5ab0b4"/><stop offset=".565" style="stop-color:#b86cf2"/><stop offset="1" style="stop-color:#ff59e6"/></linearGradient><polygon fill="url(#SVGID_4_)" points="0 .5 0 32.3 60.8 53.2 65.5 10.9"/></g><g><g><rect width="43.2" height="43.2" x="13.4" y="13.4"/><g><g><path fill="#FFF" d="M17.8,19h7c5.6,0,9.5,3.9,9.5,8.9V28c0,5-3.9,8.9-9.5,8.9h-7V19z M21.7,22.6v10.8h3 c3.2,0,5.4-2.2,5.4-5.3V28c0-3.2-2.2-5.4-5.4-5.4H21.7z"/><path fill="#FFF" d="M35,28L35,28c0-5.1,4-9.3,9.4-9.3c3.2,0,5.2,0.9,7,2.5l-2.5,3c-1.4-1.2-2.6-1.8-4.7-1.8 c-2.9,0-5.1,2.5-5.1,5.6V28c0,3.3,2.2,5.7,5.4,5.7c1.4,0,2.7-0.4,3.7-1.1V30h-4v-3.4H52v7.8c-1.8,1.6-4.4,2.8-7.6,2.8 C38.8,37.2,35,33.3,35,28z"/></g></g><rect width="16.2" height="2.7" x="17.4" y="48.5" fill="#FFF"/></g></g></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" enable-background="new 0 0 70 70" version="1.0" viewBox="0 0 70 70" width="70px" height="70px" xml:space="preserve"><g><g><polygon fill="#9775F8" points="65.5 10.9 70 39.5 53 49.4 49.8 33.2"/><linearGradient id="SVGID_1_" x1="41.069" x2="46.521" y1="54.357" y2="67.944" gradientTransform="matrix(1 0 0 -1 0 72)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#9775f8"/><stop offset=".952" style="stop-color:#22d88f"/></linearGradient><polygon fill="url(#SVGID_1_)" points="65.5 10.9 40.5 0 19.4 17.5 49.8 33.2"/><linearGradient id="SVGID_2_" x1="17.067" x2="24.146" y1="35.739" y2="4.895" gradientTransform="matrix(1 0 0 -1 0 72)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#9775f8"/><stop offset=".214" style="stop-color:#689cce"/><stop offset=".423" style="stop-color:#42bdac"/><stop offset=".59" style="stop-color:#2bd197"/><stop offset=".694" style="stop-color:#22d88f"/></linearGradient><polygon fill="url(#SVGID_2_)" points="47.3 70 18 30.6 9.3 36.4 .6 62.5"/><linearGradient id="SVGID_3_" x1="4.9" x2="66.239" y1="37.969" y2="4.102" gradientTransform="matrix(1 0 0 -1 0 72)" gradientUnits="userSpaceOnUse"><stop offset=".075" style="stop-color:#22d88f"/><stop offset=".72" style="stop-color:#9775f8"/></linearGradient><polygon fill="url(#SVGID_3_)" points="52.8 50.1 32.3 36.6 0 32.3 47.3 70"/><linearGradient id="SVGID_4_" x1="0" x2="61.646" y1="45.15" y2="45.15" gradientTransform="matrix(1 0 0 -1 0 72)" gradientUnits="userSpaceOnUse"><stop offset=".075" style="stop-color:#22d88f"/><stop offset=".266" style="stop-color:#5ab0b4"/><stop offset=".565" style="stop-color:#b86cf2"/><stop offset="1" style="stop-color:#ff59e6"/></linearGradient><polygon fill="url(#SVGID_4_)" points="0 .5 0 32.3 60.8 53.2 65.5 10.9"/></g><g><g><rect width="43.2" height="43.2" x="13.4" y="13.4"/><g><g><path fill="#FFF" d="M17.8,19h7c5.6,0,9.5,3.9,9.5,8.9V28c0,5-3.9,8.9-9.5,8.9h-7V19z M21.7,22.6v10.8h3 c3.2,0,5.4-2.2,5.4-5.3V28c0-3.2-2.2-5.4-5.4-5.4H21.7z"/><path fill="#FFF" d="M35,28L35,28c0-5.1,4-9.3,9.4-9.3c3.2,0,5.2,0.9,7,2.5l-2.5,3c-1.4-1.2-2.6-1.8-4.7-1.8 c-2.9,0-5.1,2.5-5.1,5.6V28c0,3.3,2.2,5.7,5.4,5.7c1.4,0,2.7-0.4,3.7-1.1V30h-4v-3.4H52v7.8c-1.8,1.6-4.4,2.8-7.6,2.8 C38.8,37.2,35,33.3,35,28z"/></g></g><rect width="16.2" height="2.7" x="17.4" y="48.5" fill="#FFF"/></g></g></g></svg>
diff --git a/site/static/icon/dataspell.svg b/site/static/icon/dataspell.svg
index 20fee0268cfd4..f409148e92515 100644
--- a/site/static/icon/dataspell.svg
+++ b/site/static/icon/dataspell.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 64 64"><path fill="url(#paint0_linear)" d="M41.2 0L44.4 40.4L16.5 55.4L0 13L41.2 0Z"/><path fill="url(#paint1_linear)" d="M23.7 36.8L16.5 55.4L0 13L23.7 36.8Z"/><path fill="url(#paint2_linear)" d="M41.1999 0L42.3999 22.3H24.0999L15.8999 7.9L41.1999 0Z"/><path fill="url(#paint3_linear)" d="M34.3 21.2002L64 15.2002V43.3002L43.6 50.9002L35.2001 43.4002L34.3 21.2002Z"/><path fill="#21D789" d="M64 15.2L36.5 44.9L41.2 0L64 15.2Z"/><path fill="url(#paint4_linear)" d="M64 15.2001L48.8 11.6001L43.3 51.3001L64 43.3001V15.2001Z"/><path fill="url(#paint5_linear)" d="M21.8999 12.8999L42.3999 16.0999L63.9999 43.2999L43.2999 51.2999L35.1999 43.3999L21.8999 12.8999Z"/><path fill="url(#paint6_linear)" d="M13.2001 0L42.4001 16.1L32.3001 64H15.3001L0.600098 48.8L13.2001 0Z"/><path fill="url(#paint7_linear)" d="M23.2999 5.6001L10.6999 9.6001L5.8999 28.2001L16.4999 55.4001L36.8999 42.4001L42.3999 16.4001L42.2999 16.1001L23.2999 5.6001Z"/><path fill="url(#paint8_linear)" d="M38.1001 16.6001L42.4001 16.1001L38.1001 16.6001Z"/><path fill="url(#paint9_linear)" d="M20.1001 40.3L28.0001 17.6L13.2001 0L0.600098 48.8L20.1001 40.3Z"/><path fill="url(#paint10_linear)" d="M15.3002 64.0001L5.7002 54.1001L15.3002 64.0001H32.3002H15.3002Z"/><path fill="url(#paint11_linear)" d="M5.8999 28.1998L12.8999 46.1998L16.4999 55.3998L23.6999 36.7998L7.7999 20.7998L5.8999 28.1998Z"/><path fill="url(#paint12_linear)" d="M20.1001 40.2998L32.3001 63.9998H15.3001L0.600098 48.7998L20.1001 40.2998Z"/><path fill="url(#paint13_linear)" d="M20.1001 40.3001L32.3001 64.0001L42.4001 16.1001L28.0001 17.6001L20.1001 40.3001Z"/><path fill="url(#paint14_linear)" d="M36.2001 44.7998L32.3 63.9998H15.3L16.5 55.3998L36.2001 44.7998Z"/><path fill="url(#paint15_linear)" d="M16.5 55.3998L25.4 50.5998L20.1 40.2998L12 43.8998L16.5 55.3998Z"/><path fill="url(#paint16_linear)" d="M25.3999 50.5998L32.2999 63.9998L36.1999 44.7998L25.3999 50.5998Z"/><path fill="url(#paint17_linear)" d="M13.2 0L42.4 16.1L35.5 16.9L28 17.6L13.2 0Z"/><path fill="url(#paint18_linear)" d="M42 15.9001L23.3 5.6001L19 7.0001L28 17.6001L35.5 16.9001L42.1 16.2001L42 15.9001Z"/><path fill="url(#paint19_linear)" d="M39.5 16.4001L42.4 16.1001L39.7 14.6001L39.5 16.4001Z"/><path fill="url(#paint20_linear)" d="M64 43.3001L42.4 16.1001L35.5 16.9001L28 17.6001L64 43.3001Z"/><path fill="url(#paint21_linear)" d="M38.6001 25.2001L48.3001 32.1001L52.0001 28.2001L42.4001 16.1001L39.5001 16.4001L38.6001 25.2001Z"/><path fill="url(#paint22_linear)" d="M46.2 30.5998L64 43.2998L47.2999 22.2998L46.2 30.5998Z"/><path fill="url(#paint23_linear)" d="M64 43.3001L43.3 51.3001L36.5 44.9001L28 17.6001L64 43.3001Z"/><path fill="url(#paint24_linear)" d="M38.6 25.2002L36.5 44.9002L48.3 32.1002L38.6 25.2002Z"/><path fill="url(#paint25_linear)" d="M43.3 51.3001L64 43.3001L46.2001 30.6001L43.3 51.3001Z"/><path fill="url(#paint26_linear)" d="M36.6001 44.7001L36.7001 44.8001L45.5001 35.2001L46.2001 30.6001L37.8001 32.5001L36.6001 44.7001Z"/><path fill="url(#paint27_linear)" d="M43.3 51.3001L36.5 44.9001L28 17.6001L43.3 51.3001Z"/><path fill="url(#paint28_linear)" d="M36.5 44.9L43.3 51.3L37.2 38L36.5 44.9Z"/><path fill="url(#paint29_linear)" d="M41.2 0L36.5 44.9L45.5 35.2L48.8 11.6L41.2 0Z"/><path fill="url(#paint30_linear)" d="M64 15.2L48.7999 11.6L41.2 0L64 15.2Z"/><path fill="url(#paint31_linear)" d="M52 12H12V52H52V12Z"/><g opacity=".3"><path fill="url(#paint32_linear)" d="M12 44.2L15.05 52H21.85L44.15 39.95L41.9 12H12V44.2Z" opacity=".3"/><path fill="url(#paint33_linear)" d="M39.6 12L36.25 44.5L45.25 34.8L48.4 12H39.6Z" opacity=".3"/><path fill="url(#paint34_linear)" d="M52 12.05L51.7 12H48.4L43 50.95L52 47.45V12.05Z" opacity=".3"/><path fill="url(#paint35_linear)" d="M52 34.55L27.7 17.25L36.25 44.5L43 50.95L52 47.45V34.55Z" opacity=".3"/><path fill="url(#paint36_linear)" d="M12 52H34.5L42.15 15.75L35.35 12H12V52Z" opacity=".3"/><path fill="url(#paint37_linear)" d="M12 43.35L19.8 39.95L27.7 17.25L23.3 12H12V43.35Z" opacity=".3"/><path fill="url(#paint38_linear)" d="M27.7 17.25L35.25 16.45L42.15 15.75L41.75 15.55L36.35 12.55L35.35 12H23.3L27.7 17.25Z" opacity=".3"/></g><path fill="#fff" d="M32 44.4502H17V46.9502H32V44.4502Z"/><path fill="#fff" d="M17 17.001H22.8345C27.5625 17.001 30.8821 20.22 30.8821 24.445C30.8821 28.67 27.5625 31.9896 22.8345 31.9896H17V17.001ZM20.3196 20.0188V29.0724H22.8345C25.5506 29.0724 27.3613 27.2616 27.3613 24.5456C27.3613 21.8295 25.5506 20.0188 22.8345 20.0188H20.3196Z"/><path fill="#fff" d="M32.0891 29.9777L34.101 27.5634C35.5093 28.67 36.9177 29.3742 38.6278 29.3742C40.0361 29.3742 40.8409 28.8712 40.8409 27.9658C40.8409 27.1611 40.3379 26.6581 37.823 26.0545C34.8052 25.2498 32.7933 24.445 32.7933 21.4272C32.7933 18.7111 35.0064 16.7998 38.1248 16.7998C40.3379 16.7998 42.2492 17.504 43.7581 18.7111L42.048 21.226C40.7403 20.3206 39.3319 19.7171 38.1248 19.7171C36.8171 19.7171 36.2135 20.3206 36.2135 21.0248C36.2135 22.0307 36.8171 22.3325 39.5331 23.0367C42.6516 23.8414 44.3617 24.948 44.3617 27.5634C44.3617 30.5813 42.048 32.2914 38.829 32.2914C36.2135 32.392 33.8998 31.5872 32.0891 29.9777Z"/><defs><linearGradient id="paint0_linear" x1="49.727" x2="5.283" y1="27.723" y2="27.723" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#21D789"/><stop offset=".873" stop-color="#FCF84A"/></linearGradient><linearGradient id="paint1_linear" x1="16.21" x2="9.867" y1="28.175" y2="32.975" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#fff"/><stop offset=".873" stop-color="#FCF84A"/></linearGradient><linearGradient id="paint2_linear" x1="33.188" x2="39.624" y1="9.221" y2="-.152" gradientUnits="userSpaceOnUse"><stop offset=".095" stop-color="#BBF8AF" stop-opacity="0"/><stop offset="1" stop-color="#21FF79"/></linearGradient><linearGradient id="paint3_linear" x1="49.157" x2="49.157" y1="18.476" y2="71.421" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#21D789"/><stop offset="1" stop-color="#087CFA"/></linearGradient><linearGradient id="paint4_linear" x1="69.468" x2="31.54" y1="39.976" y2="23.905" gradientUnits="userSpaceOnUse"><stop offset=".02" stop-color="#21D789" stop-opacity="0"/><stop offset="1" stop-color="#00FF6A"/></linearGradient><linearGradient id="paint5_linear" x1="84.241" x2="21.095" y1="67.216" y2="16.131" gradientUnits="userSpaceOnUse"><stop offset=".105" stop-color="#21D789"/><stop offset=".967" stop-color="#087CFA"/></linearGradient><linearGradient id="paint6_linear" x1="55.333" x2="11.222" y1="-4.926" y2="45.066" gradientUnits="userSpaceOnUse"><stop offset=".235" stop-color="#21D789"/><stop offset=".74" stop-color="#087CFA"/></linearGradient><linearGradient id="paint7_linear" x1="-.462" x2="24.652" y1="13.226" y2="32.169" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#21D789"/><stop offset=".828" stop-color="#087CFA" stop-opacity="0"/></linearGradient><linearGradient id="paint8_linear" x1="40.152" x2="41.071" y1="16.524" y2="15.368" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#21D789" stop-opacity="0"/><stop offset=".873" stop-color="#01D0FF"/></linearGradient><linearGradient id="paint9_linear" x1="8.75" x2="25.461" y1="30.091" y2="9.061" gradientUnits="userSpaceOnUse"><stop offset=".383" stop-color="#087CFA" stop-opacity="0"/><stop offset="1" stop-color="#01EFDB"/></linearGradient><linearGradient id="paint10_linear" x1="18.006" x2="21.234" y1="60.336" y2="56.274" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#21D789" stop-opacity="0"/><stop offset=".873" stop-color="#01D0FF"/></linearGradient><linearGradient id="paint11_linear" x1="15.178" x2="14.835" y1="19.44" y2="31.526" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#21D789"/><stop offset=".828" stop-color="#087CFA" stop-opacity="0"/></linearGradient><linearGradient id="paint12_linear" x1="38.519" x2="9.719" y1="28.117" y2="65.06" gradientUnits="userSpaceOnUse"><stop offset=".235" stop-color="#083FFA"/><stop offset=".74" stop-color="#087CFA"/></linearGradient><linearGradient id="paint13_linear" x1="16.847" x2="44.875" y1="3.522" y2="53.407" gradientUnits="userSpaceOnUse"><stop offset=".246" stop-color="#083FFA"/><stop offset=".913" stop-color="#087CFA"/></linearGradient><linearGradient id="paint14_linear" x1="16.931" x2="31.322" y1="45.56" y2="59.951" gradientUnits="userSpaceOnUse"><stop offset=".235" stop-color="#089FFF"/><stop offset=".74" stop-color="#087CFA" stop-opacity="0"/></linearGradient><linearGradient id="paint15_linear" x1="26.212" x2="16.704" y1="56.525" y2="46.161" gradientUnits="userSpaceOnUse"><stop offset=".153" stop-color="#0832FF"/><stop offset=".914" stop-color="#087CFA" stop-opacity="0"/></linearGradient><linearGradient id="paint16_linear" x1="39.767" x2="28.198" y1="60.907" y2="47.215" gradientUnits="userSpaceOnUse"><stop offset=".153" stop-color="#0832FF"/><stop offset=".914" stop-color="#087CFA" stop-opacity="0"/></linearGradient><linearGradient id="paint17_linear" x1="27.528" x2="27.934" y1="-14.351" y2="19.733" gradientUnits="userSpaceOnUse"><stop offset=".235" stop-color="#21D789"/><stop offset=".825" stop-color="#087CFA"/></linearGradient><linearGradient id="paint18_linear" x1="30.374" x2="29.497" y1="10.004" y2="1.895" gradientUnits="userSpaceOnUse"><stop offset=".095" stop-color="#BBF8AF" stop-opacity="0"/><stop offset="1" stop-color="#21FF79"/></linearGradient><linearGradient id="paint19_linear" x1="41.831" x2="39.031" y1="17.317" y2="14.064" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#21D789" stop-opacity="0"/><stop offset=".918" stop-color="#21D789"/></linearGradient><linearGradient id="paint20_linear" x1="57.147" x2="35.715" y1="47.188" y2="15.041" gradientUnits="userSpaceOnUse"><stop offset=".028" stop-color="#21D789"/><stop offset=".929" stop-color="#0860FA"/></linearGradient><linearGradient id="paint21_linear" x1="45.753" x2="43.31" y1="30.152" y2="12.152" gradientUnits="userSpaceOnUse"><stop offset=".076" stop-color="#087CFA" stop-opacity="0"/><stop offset="1" stop-color="#21D789" stop-opacity=".6"/></linearGradient><linearGradient id="paint22_linear" x1="52.077" x2="40.248" y1="32.782" y2="16.453" gradientUnits="userSpaceOnUse"><stop offset=".076" stop-color="#087CFA" stop-opacity="0"/><stop offset="1" stop-color="#4F46C6" stop-opacity=".6"/></linearGradient><linearGradient id="paint23_linear" x1="53.815" x2="32.383" y1="49.41" y2="17.262" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#18AFAF"/><stop offset=".659" stop-color="#0860FA"/><stop offset=".998" stop-color="#084CFA"/></linearGradient><linearGradient id="paint24_linear" x1="43.602" x2="35.117" y1="40.368" y2="26.868" gradientUnits="userSpaceOnUse"><stop offset=".076" stop-color="#087CFA" stop-opacity="0"/><stop offset="1" stop-color="#21D789" stop-opacity=".6"/></linearGradient><linearGradient id="paint25_linear" x1="53.504" x2="39.961" y1="47.181" y2="34.554" gradientUnits="userSpaceOnUse"><stop offset=".076" stop-color="#087CFA" stop-opacity="0"/><stop offset="1" stop-color="#21D789" stop-opacity=".6"/></linearGradient><linearGradient id="paint26_linear" x1="40.017" x2="35.335" y1="36.371" y2="32.006" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#087CFA" stop-opacity="0"/><stop offset=".855" stop-color="#0841FA"/></linearGradient><linearGradient id="paint27_linear" x1="44.632" x2="25.698" y1="49.825" y2="21.423" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#089CFA"/><stop offset=".74" stop-color="#083CFA"/></linearGradient><linearGradient id="paint28_linear" x1="43.291" x2="35.818" y1="51.072" y2="39.863" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#087CFA" stop-opacity="0"/><stop offset=".979" stop-color="#0860FA"/></linearGradient><linearGradient id="paint29_linear" x1="42.705" x2="45.705" y1="20.503" y2="6.789" gradientUnits="userSpaceOnUse"><stop offset=".355" stop-color="#BBF8AF" stop-opacity="0"/><stop offset="1" stop-color="#21FF79"/></linearGradient><linearGradient id="paint30_linear" x1="39.765" x2="57.422" y1=".906" y2="14.192" gradientUnits="userSpaceOnUse"><stop offset=".02" stop-color="#BBF8AF" stop-opacity="0"/><stop offset="1" stop-color="#21FF79"/></linearGradient><linearGradient id="paint31_linear" x1="12.336" x2="53.366" y1="12.336" y2="53.366" gradientUnits="userSpaceOnUse"><stop offset=".028" stop-color="#002846"/><stop offset=".137" stop-color="#002038"/><stop offset=".495" stop-color="#000910"/><stop offset=".679"/></linearGradient><linearGradient id="paint32_linear" x1="8.178" x2="40.333" y1="32" y2="32" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#21D789"/><stop offset=".873" stop-color="#FCF84A"/></linearGradient><linearGradient id="paint33_linear" x1="42.825" x2="41.644" y1="41.937" y2="9.179" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#218640"/><stop offset=".803" stop-color="#B5FA59"/></linearGradient><linearGradient id="paint34_linear" x1="46.802" x2="48.564" y1="14.348" y2="58.398" gradientUnits="userSpaceOnUse"><stop offset=".235" stop-color="#21D789"/><stop offset="1" stop-color="#083450"/></linearGradient><linearGradient id="paint35_linear" x1="49.909" x2="29.887" y1="48.21" y2="18.177" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#021A43"/><stop offset=".659" stop-color="#0860FA"/></linearGradient><linearGradient id="paint36_linear" x1="24.714" x2="28.605" y1="-.048" y2="56.043" gradientUnits="userSpaceOnUse"><stop offset=".235" stop-color="#21D789"/><stop offset=".74" stop-color="#083450"/></linearGradient><linearGradient id="paint37_linear" x1="21.246" x2="17.795" y1="43.404" y2="10.954" gradientUnits="userSpaceOnUse"><stop offset=".227" stop-color="#086C93"/><stop offset=".82" stop-color="#01EFDB"/></linearGradient><linearGradient id="paint38_linear" x1="24.72" x2="44.427" y1="12.502" y2="18.66" gradientUnits="userSpaceOnUse"><stop offset=".251" stop-color="#21D789"/><stop offset=".885" stop-color="#0C515A"/></linearGradient></defs><path fill="#FDB60D" d="M56.1887 64H23.8113C21.7397 64 19.7528 63.1771 18.2879 61.7122C16.823 60.2473 16 58.2604 16 56.1887V47.8113C16 46.7855 16.202 45.7697 16.5946 44.822C16.9872 43.8743 17.5626 43.0132 18.2879 42.2878C19.0133 41.5625 19.8743 40.9872 20.8221 40.5946C21.7698 40.202 22.7855 40 23.8113 40H56.1887C58.2604 40 60.2472 40.8229 61.7121 42.2878C63.177 43.7527 64 45.7396 64 47.8113V56.1887C64 58.2604 63.177 60.2473 61.7121 61.7122C60.2472 63.1771 58.2604 64 56.1887 64Z"/><path fill="#000" d="M24.9124 46.7561H33.1512V48.8945H27.2997V51.1102H32.4492V53.2476H27.2997V55.5415H33.2294V57.679H24.9124V46.7561Z"/><path fill="#000" d="M39.1113 46.679H41.327L46.0082 57.679H43.4959L42.4973 55.2296H37.8791L36.8805 57.679H34.4312L39.1113 46.679ZM41.6399 53.1074L40.1882 49.5651L38.7375 53.1074H41.6399Z"/><path fill="#000" d="M47.6936 46.7561H52.1564C54.7621 46.7561 56.3378 48.3013 56.3378 50.5321V50.5636C56.3378 53.0911 54.372 54.4026 51.9228 54.4026H50.0972V57.6788H47.6936L47.6936 46.7561ZM51.9999 52.2643C52.2361 52.2943 52.4759 52.274 52.7037 52.205C52.9315 52.1359 53.1422 52.0194 53.3219 51.8633C53.5016 51.7072 53.6463 51.5149 53.7466 51.299C53.8468 51.083 53.9004 50.8484 53.9037 50.6104V50.5789C53.9037 49.503 53.155 48.925 51.9532 48.925H50.0972V52.2643H51.9999Z"/></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 64 64" width="64px" height="64px"><path fill="url(#paint0_linear)" d="M41.2 0L44.4 40.4L16.5 55.4L0 13L41.2 0Z"/><path fill="url(#paint1_linear)" d="M23.7 36.8L16.5 55.4L0 13L23.7 36.8Z"/><path fill="url(#paint2_linear)" d="M41.1999 0L42.3999 22.3H24.0999L15.8999 7.9L41.1999 0Z"/><path fill="url(#paint3_linear)" d="M34.3 21.2002L64 15.2002V43.3002L43.6 50.9002L35.2001 43.4002L34.3 21.2002Z"/><path fill="#21D789" d="M64 15.2L36.5 44.9L41.2 0L64 15.2Z"/><path fill="url(#paint4_linear)" d="M64 15.2001L48.8 11.6001L43.3 51.3001L64 43.3001V15.2001Z"/><path fill="url(#paint5_linear)" d="M21.8999 12.8999L42.3999 16.0999L63.9999 43.2999L43.2999 51.2999L35.1999 43.3999L21.8999 12.8999Z"/><path fill="url(#paint6_linear)" d="M13.2001 0L42.4001 16.1L32.3001 64H15.3001L0.600098 48.8L13.2001 0Z"/><path fill="url(#paint7_linear)" d="M23.2999 5.6001L10.6999 9.6001L5.8999 28.2001L16.4999 55.4001L36.8999 42.4001L42.3999 16.4001L42.2999 16.1001L23.2999 5.6001Z"/><path fill="url(#paint8_linear)" d="M38.1001 16.6001L42.4001 16.1001L38.1001 16.6001Z"/><path fill="url(#paint9_linear)" d="M20.1001 40.3L28.0001 17.6L13.2001 0L0.600098 48.8L20.1001 40.3Z"/><path fill="url(#paint10_linear)" d="M15.3002 64.0001L5.7002 54.1001L15.3002 64.0001H32.3002H15.3002Z"/><path fill="url(#paint11_linear)" d="M5.8999 28.1998L12.8999 46.1998L16.4999 55.3998L23.6999 36.7998L7.7999 20.7998L5.8999 28.1998Z"/><path fill="url(#paint12_linear)" d="M20.1001 40.2998L32.3001 63.9998H15.3001L0.600098 48.7998L20.1001 40.2998Z"/><path fill="url(#paint13_linear)" d="M20.1001 40.3001L32.3001 64.0001L42.4001 16.1001L28.0001 17.6001L20.1001 40.3001Z"/><path fill="url(#paint14_linear)" d="M36.2001 44.7998L32.3 63.9998H15.3L16.5 55.3998L36.2001 44.7998Z"/><path fill="url(#paint15_linear)" d="M16.5 55.3998L25.4 50.5998L20.1 40.2998L12 43.8998L16.5 55.3998Z"/><path fill="url(#paint16_linear)" d="M25.3999 50.5998L32.2999 63.9998L36.1999 44.7998L25.3999 50.5998Z"/><path fill="url(#paint17_linear)" d="M13.2 0L42.4 16.1L35.5 16.9L28 17.6L13.2 0Z"/><path fill="url(#paint18_linear)" d="M42 15.9001L23.3 5.6001L19 7.0001L28 17.6001L35.5 16.9001L42.1 16.2001L42 15.9001Z"/><path fill="url(#paint19_linear)" d="M39.5 16.4001L42.4 16.1001L39.7 14.6001L39.5 16.4001Z"/><path fill="url(#paint20_linear)" d="M64 43.3001L42.4 16.1001L35.5 16.9001L28 17.6001L64 43.3001Z"/><path fill="url(#paint21_linear)" d="M38.6001 25.2001L48.3001 32.1001L52.0001 28.2001L42.4001 16.1001L39.5001 16.4001L38.6001 25.2001Z"/><path fill="url(#paint22_linear)" d="M46.2 30.5998L64 43.2998L47.2999 22.2998L46.2 30.5998Z"/><path fill="url(#paint23_linear)" d="M64 43.3001L43.3 51.3001L36.5 44.9001L28 17.6001L64 43.3001Z"/><path fill="url(#paint24_linear)" d="M38.6 25.2002L36.5 44.9002L48.3 32.1002L38.6 25.2002Z"/><path fill="url(#paint25_linear)" d="M43.3 51.3001L64 43.3001L46.2001 30.6001L43.3 51.3001Z"/><path fill="url(#paint26_linear)" d="M36.6001 44.7001L36.7001 44.8001L45.5001 35.2001L46.2001 30.6001L37.8001 32.5001L36.6001 44.7001Z"/><path fill="url(#paint27_linear)" d="M43.3 51.3001L36.5 44.9001L28 17.6001L43.3 51.3001Z"/><path fill="url(#paint28_linear)" d="M36.5 44.9L43.3 51.3L37.2 38L36.5 44.9Z"/><path fill="url(#paint29_linear)" d="M41.2 0L36.5 44.9L45.5 35.2L48.8 11.6L41.2 0Z"/><path fill="url(#paint30_linear)" d="M64 15.2L48.7999 11.6L41.2 0L64 15.2Z"/><path fill="url(#paint31_linear)" d="M52 12H12V52H52V12Z"/><g opacity=".3"><path fill="url(#paint32_linear)" d="M12 44.2L15.05 52H21.85L44.15 39.95L41.9 12H12V44.2Z" opacity=".3"/><path fill="url(#paint33_linear)" d="M39.6 12L36.25 44.5L45.25 34.8L48.4 12H39.6Z" opacity=".3"/><path fill="url(#paint34_linear)" d="M52 12.05L51.7 12H48.4L43 50.95L52 47.45V12.05Z" opacity=".3"/><path fill="url(#paint35_linear)" d="M52 34.55L27.7 17.25L36.25 44.5L43 50.95L52 47.45V34.55Z" opacity=".3"/><path fill="url(#paint36_linear)" d="M12 52H34.5L42.15 15.75L35.35 12H12V52Z" opacity=".3"/><path fill="url(#paint37_linear)" d="M12 43.35L19.8 39.95L27.7 17.25L23.3 12H12V43.35Z" opacity=".3"/><path fill="url(#paint38_linear)" d="M27.7 17.25L35.25 16.45L42.15 15.75L41.75 15.55L36.35 12.55L35.35 12H23.3L27.7 17.25Z" opacity=".3"/></g><path fill="#fff" d="M32 44.4502H17V46.9502H32V44.4502Z"/><path fill="#fff" d="M17 17.001H22.8345C27.5625 17.001 30.8821 20.22 30.8821 24.445C30.8821 28.67 27.5625 31.9896 22.8345 31.9896H17V17.001ZM20.3196 20.0188V29.0724H22.8345C25.5506 29.0724 27.3613 27.2616 27.3613 24.5456C27.3613 21.8295 25.5506 20.0188 22.8345 20.0188H20.3196Z"/><path fill="#fff" d="M32.0891 29.9777L34.101 27.5634C35.5093 28.67 36.9177 29.3742 38.6278 29.3742C40.0361 29.3742 40.8409 28.8712 40.8409 27.9658C40.8409 27.1611 40.3379 26.6581 37.823 26.0545C34.8052 25.2498 32.7933 24.445 32.7933 21.4272C32.7933 18.7111 35.0064 16.7998 38.1248 16.7998C40.3379 16.7998 42.2492 17.504 43.7581 18.7111L42.048 21.226C40.7403 20.3206 39.3319 19.7171 38.1248 19.7171C36.8171 19.7171 36.2135 20.3206 36.2135 21.0248C36.2135 22.0307 36.8171 22.3325 39.5331 23.0367C42.6516 23.8414 44.3617 24.948 44.3617 27.5634C44.3617 30.5813 42.048 32.2914 38.829 32.2914C36.2135 32.392 33.8998 31.5872 32.0891 29.9777Z"/><defs><linearGradient id="paint0_linear" x1="49.727" x2="5.283" y1="27.723" y2="27.723" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#21D789"/><stop offset=".873" stop-color="#FCF84A"/></linearGradient><linearGradient id="paint1_linear" x1="16.21" x2="9.867" y1="28.175" y2="32.975" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#fff"/><stop offset=".873" stop-color="#FCF84A"/></linearGradient><linearGradient id="paint2_linear" x1="33.188" x2="39.624" y1="9.221" y2="-.152" gradientUnits="userSpaceOnUse"><stop offset=".095" stop-color="#BBF8AF" stop-opacity="0"/><stop offset="1" stop-color="#21FF79"/></linearGradient><linearGradient id="paint3_linear" x1="49.157" x2="49.157" y1="18.476" y2="71.421" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#21D789"/><stop offset="1" stop-color="#087CFA"/></linearGradient><linearGradient id="paint4_linear" x1="69.468" x2="31.54" y1="39.976" y2="23.905" gradientUnits="userSpaceOnUse"><stop offset=".02" stop-color="#21D789" stop-opacity="0"/><stop offset="1" stop-color="#00FF6A"/></linearGradient><linearGradient id="paint5_linear" x1="84.241" x2="21.095" y1="67.216" y2="16.131" gradientUnits="userSpaceOnUse"><stop offset=".105" stop-color="#21D789"/><stop offset=".967" stop-color="#087CFA"/></linearGradient><linearGradient id="paint6_linear" x1="55.333" x2="11.222" y1="-4.926" y2="45.066" gradientUnits="userSpaceOnUse"><stop offset=".235" stop-color="#21D789"/><stop offset=".74" stop-color="#087CFA"/></linearGradient><linearGradient id="paint7_linear" x1="-.462" x2="24.652" y1="13.226" y2="32.169" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#21D789"/><stop offset=".828" stop-color="#087CFA" stop-opacity="0"/></linearGradient><linearGradient id="paint8_linear" x1="40.152" x2="41.071" y1="16.524" y2="15.368" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#21D789" stop-opacity="0"/><stop offset=".873" stop-color="#01D0FF"/></linearGradient><linearGradient id="paint9_linear" x1="8.75" x2="25.461" y1="30.091" y2="9.061" gradientUnits="userSpaceOnUse"><stop offset=".383" stop-color="#087CFA" stop-opacity="0"/><stop offset="1" stop-color="#01EFDB"/></linearGradient><linearGradient id="paint10_linear" x1="18.006" x2="21.234" y1="60.336" y2="56.274" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#21D789" stop-opacity="0"/><stop offset=".873" stop-color="#01D0FF"/></linearGradient><linearGradient id="paint11_linear" x1="15.178" x2="14.835" y1="19.44" y2="31.526" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#21D789"/><stop offset=".828" stop-color="#087CFA" stop-opacity="0"/></linearGradient><linearGradient id="paint12_linear" x1="38.519" x2="9.719" y1="28.117" y2="65.06" gradientUnits="userSpaceOnUse"><stop offset=".235" stop-color="#083FFA"/><stop offset=".74" stop-color="#087CFA"/></linearGradient><linearGradient id="paint13_linear" x1="16.847" x2="44.875" y1="3.522" y2="53.407" gradientUnits="userSpaceOnUse"><stop offset=".246" stop-color="#083FFA"/><stop offset=".913" stop-color="#087CFA"/></linearGradient><linearGradient id="paint14_linear" x1="16.931" x2="31.322" y1="45.56" y2="59.951" gradientUnits="userSpaceOnUse"><stop offset=".235" stop-color="#089FFF"/><stop offset=".74" stop-color="#087CFA" stop-opacity="0"/></linearGradient><linearGradient id="paint15_linear" x1="26.212" x2="16.704" y1="56.525" y2="46.161" gradientUnits="userSpaceOnUse"><stop offset=".153" stop-color="#0832FF"/><stop offset=".914" stop-color="#087CFA" stop-opacity="0"/></linearGradient><linearGradient id="paint16_linear" x1="39.767" x2="28.198" y1="60.907" y2="47.215" gradientUnits="userSpaceOnUse"><stop offset=".153" stop-color="#0832FF"/><stop offset=".914" stop-color="#087CFA" stop-opacity="0"/></linearGradient><linearGradient id="paint17_linear" x1="27.528" x2="27.934" y1="-14.351" y2="19.733" gradientUnits="userSpaceOnUse"><stop offset=".235" stop-color="#21D789"/><stop offset=".825" stop-color="#087CFA"/></linearGradient><linearGradient id="paint18_linear" x1="30.374" x2="29.497" y1="10.004" y2="1.895" gradientUnits="userSpaceOnUse"><stop offset=".095" stop-color="#BBF8AF" stop-opacity="0"/><stop offset="1" stop-color="#21FF79"/></linearGradient><linearGradient id="paint19_linear" x1="41.831" x2="39.031" y1="17.317" y2="14.064" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#21D789" stop-opacity="0"/><stop offset=".918" stop-color="#21D789"/></linearGradient><linearGradient id="paint20_linear" x1="57.147" x2="35.715" y1="47.188" y2="15.041" gradientUnits="userSpaceOnUse"><stop offset=".028" stop-color="#21D789"/><stop offset=".929" stop-color="#0860FA"/></linearGradient><linearGradient id="paint21_linear" x1="45.753" x2="43.31" y1="30.152" y2="12.152" gradientUnits="userSpaceOnUse"><stop offset=".076" stop-color="#087CFA" stop-opacity="0"/><stop offset="1" stop-color="#21D789" stop-opacity=".6"/></linearGradient><linearGradient id="paint22_linear" x1="52.077" x2="40.248" y1="32.782" y2="16.453" gradientUnits="userSpaceOnUse"><stop offset=".076" stop-color="#087CFA" stop-opacity="0"/><stop offset="1" stop-color="#4F46C6" stop-opacity=".6"/></linearGradient><linearGradient id="paint23_linear" x1="53.815" x2="32.383" y1="49.41" y2="17.262" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#18AFAF"/><stop offset=".659" stop-color="#0860FA"/><stop offset=".998" stop-color="#084CFA"/></linearGradient><linearGradient id="paint24_linear" x1="43.602" x2="35.117" y1="40.368" y2="26.868" gradientUnits="userSpaceOnUse"><stop offset=".076" stop-color="#087CFA" stop-opacity="0"/><stop offset="1" stop-color="#21D789" stop-opacity=".6"/></linearGradient><linearGradient id="paint25_linear" x1="53.504" x2="39.961" y1="47.181" y2="34.554" gradientUnits="userSpaceOnUse"><stop offset=".076" stop-color="#087CFA" stop-opacity="0"/><stop offset="1" stop-color="#21D789" stop-opacity=".6"/></linearGradient><linearGradient id="paint26_linear" x1="40.017" x2="35.335" y1="36.371" y2="32.006" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#087CFA" stop-opacity="0"/><stop offset=".855" stop-color="#0841FA"/></linearGradient><linearGradient id="paint27_linear" x1="44.632" x2="25.698" y1="49.825" y2="21.423" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#089CFA"/><stop offset=".74" stop-color="#083CFA"/></linearGradient><linearGradient id="paint28_linear" x1="43.291" x2="35.818" y1="51.072" y2="39.863" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#087CFA" stop-opacity="0"/><stop offset=".979" stop-color="#0860FA"/></linearGradient><linearGradient id="paint29_linear" x1="42.705" x2="45.705" y1="20.503" y2="6.789" gradientUnits="userSpaceOnUse"><stop offset=".355" stop-color="#BBF8AF" stop-opacity="0"/><stop offset="1" stop-color="#21FF79"/></linearGradient><linearGradient id="paint30_linear" x1="39.765" x2="57.422" y1=".906" y2="14.192" gradientUnits="userSpaceOnUse"><stop offset=".02" stop-color="#BBF8AF" stop-opacity="0"/><stop offset="1" stop-color="#21FF79"/></linearGradient><linearGradient id="paint31_linear" x1="12.336" x2="53.366" y1="12.336" y2="53.366" gradientUnits="userSpaceOnUse"><stop offset=".028" stop-color="#002846"/><stop offset=".137" stop-color="#002038"/><stop offset=".495" stop-color="#000910"/><stop offset=".679"/></linearGradient><linearGradient id="paint32_linear" x1="8.178" x2="40.333" y1="32" y2="32" gradientUnits="userSpaceOnUse"><stop offset=".078" stop-color="#21D789"/><stop offset=".873" stop-color="#FCF84A"/></linearGradient><linearGradient id="paint33_linear" x1="42.825" x2="41.644" y1="41.937" y2="9.179" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#218640"/><stop offset=".803" stop-color="#B5FA59"/></linearGradient><linearGradient id="paint34_linear" x1="46.802" x2="48.564" y1="14.348" y2="58.398" gradientUnits="userSpaceOnUse"><stop offset=".235" stop-color="#21D789"/><stop offset="1" stop-color="#083450"/></linearGradient><linearGradient id="paint35_linear" x1="49.909" x2="29.887" y1="48.21" y2="18.177" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#021A43"/><stop offset=".659" stop-color="#0860FA"/></linearGradient><linearGradient id="paint36_linear" x1="24.714" x2="28.605" y1="-.048" y2="56.043" gradientUnits="userSpaceOnUse"><stop offset=".235" stop-color="#21D789"/><stop offset=".74" stop-color="#083450"/></linearGradient><linearGradient id="paint37_linear" x1="21.246" x2="17.795" y1="43.404" y2="10.954" gradientUnits="userSpaceOnUse"><stop offset=".227" stop-color="#086C93"/><stop offset=".82" stop-color="#01EFDB"/></linearGradient><linearGradient id="paint38_linear" x1="24.72" x2="44.427" y1="12.502" y2="18.66" gradientUnits="userSpaceOnUse"><stop offset=".251" stop-color="#21D789"/><stop offset=".885" stop-color="#0C515A"/></linearGradient></defs><path fill="#FDB60D" d="M56.1887 64H23.8113C21.7397 64 19.7528 63.1771 18.2879 61.7122C16.823 60.2473 16 58.2604 16 56.1887V47.8113C16 46.7855 16.202 45.7697 16.5946 44.822C16.9872 43.8743 17.5626 43.0132 18.2879 42.2878C19.0133 41.5625 19.8743 40.9872 20.8221 40.5946C21.7698 40.202 22.7855 40 23.8113 40H56.1887C58.2604 40 60.2472 40.8229 61.7121 42.2878C63.177 43.7527 64 45.7396 64 47.8113V56.1887C64 58.2604 63.177 60.2473 61.7121 61.7122C60.2472 63.1771 58.2604 64 56.1887 64Z"/><path fill="#000" d="M24.9124 46.7561H33.1512V48.8945H27.2997V51.1102H32.4492V53.2476H27.2997V55.5415H33.2294V57.679H24.9124V46.7561Z"/><path fill="#000" d="M39.1113 46.679H41.327L46.0082 57.679H43.4959L42.4973 55.2296H37.8791L36.8805 57.679H34.4312L39.1113 46.679ZM41.6399 53.1074L40.1882 49.5651L38.7375 53.1074H41.6399Z"/><path fill="#000" d="M47.6936 46.7561H52.1564C54.7621 46.7561 56.3378 48.3013 56.3378 50.5321V50.5636C56.3378 53.0911 54.372 54.4026 51.9228 54.4026H50.0972V57.6788H47.6936L47.6936 46.7561ZM51.9999 52.2643C52.2361 52.2943 52.4759 52.274 52.7037 52.205C52.9315 52.1359 53.1422 52.0194 53.3219 51.8633C53.5016 51.7072 53.6463 51.5149 53.7466 51.299C53.8468 51.083 53.9004 50.8484 53.9037 50.6104V50.5789C53.9037 49.503 53.155 48.925 51.9532 48.925H50.0972V52.2643H51.9999Z"/></svg>
diff --git a/site/static/icon/discord.svg b/site/static/icon/discord.svg
new file mode 100644
index 0000000000000..ca65400760907
--- /dev/null
+++ b/site/static/icon/discord.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 127.14 96.36"><defs><style>.cls-1{fill:#5865f2;}</style></defs><g id="图层_2" data-name="图层 2"><g id="Discord_Logos" data-name="Discord Logos"><g id="Discord_Logo_-_Large_-_White" data-name="Discord Logo - Large - White"><path class="cls-1" d="M107.7,8.07A105.15,105.15,0,0,0,81.47,0a72.06,72.06,0,0,0-3.36,6.83A97.68,97.68,0,0,0,49,6.83,72.37,72.37,0,0,0,45.64,0,105.89,105.89,0,0,0,19.39,8.09C2.79,32.65-1.71,56.6.54,80.21h0A105.73,105.73,0,0,0,32.71,96.36,77.7,77.7,0,0,0,39.6,85.25a68.42,68.42,0,0,1-10.85-5.18c.91-.66,1.8-1.34,2.66-2a75.57,75.57,0,0,0,64.32,0c.87.71,1.76,1.39,2.66,2a68.68,68.68,0,0,1-10.87,5.19,77,77,0,0,0,6.89,11.1A105.25,105.25,0,0,0,126.6,80.22h0C129.24,52.84,122.09,29.11,107.7,8.07ZM42.45,65.69C36.18,65.69,31,60,31,53s5-12.74,11.43-12.74S54,46,53.89,53,48.84,65.69,42.45,65.69Zm42.24,0C78.41,65.69,73.25,60,73.25,53s5-12.74,11.44-12.74S96.23,46,96.12,53,91.08,65.69,84.69,65.69Z"/></g></g></g></svg>
\ No newline at end of file
diff --git a/site/static/icon/dotfiles.svg b/site/static/icon/dotfiles.svg
new file mode 100644
index 0000000000000..d7c5623cbeba4
--- /dev/null
+++ b/site/static/icon/dotfiles.svg
@@ -0,0 +1,11 @@
+<svg version="1.0" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="185.69px" height="237px"
+	 viewBox="0 0 185.69 237" enable-background="new 0 0 185.69 237" xml:space="preserve">
+<g>
+	<path fill="#333333" d="M135.96,0h-1.06H16.93C7.58,0,0,7.58,0,16.93v203.14C0,229.42,7.58,237,16.93,237h151.83
+		c9.35,0,16.93-7.58,16.93-16.93V50.79v-1.06L135.96,0z"/>
+	<circle fill="#3FA9F5" cx="92.84" cy="118.5" r="25.39"/>
+	<line fill="#1A1A1A" x1="185.69" y1="50.79" x2="134.9" y2="0"/>
+	<path fill="#3FA9F5" d="M135.96,32.8c0,9.35,7.58,16.93,16.93,16.93h32.8L135.96,0V32.8z"/>
+</g>
+</svg>
diff --git a/site/static/icon/fly.io.svg b/site/static/icon/fly.io.svg
index 0d0086b7eff5d..991b5cf0c4d06 100644
--- a/site/static/icon/fly.io.svg
+++ b/site/static/icon/fly.io.svg
@@ -1 +1 @@
-<svg viewBox="0 0 167 151" xmlns="http://www.w3.org/2000/svg" fill-rule="evenodd" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2"><path d="M116.78 20.613h19.23c17.104 0 30.99 13.886 30.99 30.99v67.618c0 17.104-13.886 30.99-30.99 30.99h-1.516c-8.803-1.377-12.621-4.017-15.57-6.248L94.475 123.86a3.453 3.453 0 00-4.329 0l-7.943 6.532-22.37-18.394a3.443 3.443 0 00-4.326 0l-31.078 27.339c-6.255 5.087-10.392 4.148-13.075 3.853C4.424 137.503 0 128.874 0 119.221V51.603c0-17.104 13.886-30.99 30.993-30.99H50.18l-.035.077-.647 1.886-.201.647-.871 3.862-.12.678-.382 3.868-.051 1.062-.008.372.036 1.774.088 1.039.215 1.628.275 1.464.326 1.349.423 1.46 1.098 3.092.362.927 1.912 4.04.675 1.241 2.211 3.795.846 1.369 3.086 4.544.446.602 4.015 5.226 1.297 1.608 4.585 5.36.942 1.031 3.779 4.066 1.497 1.55 2.474 2.457-.497.415-.309.279a30.309 30.309 0 00-2.384 2.49c-.359.423-.701.86-1.025 1.31-.495.687-.938 1.41-1.324 2.164-.198.391-.375.792-.531 1.202a11.098 11.098 0 00-.718 3.267l-.014.966c.035 1.362.312 2.707.819 3.972a11.06 11.06 0 002.209 3.464 11.274 11.274 0 002.329 1.896c.731.447 1.51.816 2.319 1.096 1.76.597 3.627.809 5.476.623h.01a12.347 12.347 0 004.516-1.341 11.647 11.647 0 001.724-1.116 11.067 11.067 0 003.479-4.626c.569-1.422.848-2.941.823-4.471l-.044-.799a11.305 11.305 0 00-.749-3.078c-.17-.429-.364-.848-.58-1.257-.4-.752-.856-1.473-1.362-2.158-.232-.313-.472-.62-.72-.921a29.81 29.81 0 00-2.661-2.787l-.669-.569 1.133-1.119 4.869-5.085 1.684-1.849 2.618-2.945 1.703-1.992 2.428-2.957 1.644-2.067 2.414-3.228 1.219-1.67 1.729-2.585 1.44-2.203 2.713-4.725 1.552-3.1.045-.095 1.188-2.876c.015-.037.029-.075.04-.114l1.28-3.991.134-.582.555-3.177.108-.86.033-.527.038-1.989-.01-.371-.102-1.781-.126-1.383-.63-3.989a1.521 1.521 0 00-.037-.159l-.809-2.949-.279-.82-.364-.907zm9.141 84.321c-4.007.056-7.287 3.336-7.343 7.342.059 4.006 3.337 7.284 7.343 7.341 4.005-.058 7.284-3.335 7.345-7.341-.058-4.006-3.338-7.286-7.345-7.342z" fill="url(#_Radial1)"/><path d="M72.499 147.571l-1.296 1.09a6.802 6.802 0 01-4.253 1.55H30.993a30.867 30.867 0 01-19.639-7.021c2.683.295 6.82 1.234 13.075-3.853l31.078-27.339a3.443 3.443 0 014.326 0l22.37 18.394 7.943-6.532a3.453 3.453 0 014.329 0l24.449 20.103c2.949 2.231 6.767 4.871 15.57 6.248H118.23a6.919 6.919 0 01-3.993-1.33l-.285-.22-1.207-1.003a2.377 2.377 0 00-.32-.323 21845.256 21845.256 0 00-18.689-15.497 2.035 2.035 0 00-2.606.006s.044.052-18.386 15.491c-.09.075-.172.154-.245.236zm53.422-42.637c-4.007.056-7.287 3.336-7.343 7.342.059 4.006 3.337 7.284 7.343 7.341 4.005-.058 7.284-3.335 7.345-7.341-.058-4.006-3.338-7.286-7.345-7.342zM78.453 82.687l-2.474-2.457-1.497-1.55-3.779-4.066-.942-1.031-4.585-5.36-1.297-1.609-4.015-5.225-.446-.602-3.086-4.544-.846-1.369-2.211-3.795-.675-1.241-1.912-4.04-.362-.927-1.098-3.092-.423-1.46-.326-1.349-.275-1.465-.215-1.627-.088-1.039-.036-1.774.008-.372.051-1.062.382-3.869.12-.677.871-3.862.201-.647.647-1.886.207-.488 1.03-2.262.714-1.346.994-1.64.991-1.46.706-.928.813-.98.895-.985.767-.771 1.867-1.643 1.365-1.117c.033-.028.067-.053.102-.077l1.615-1.092 1.283-.818L65.931 3.8c.037-.023.079-.041.118-.059l3.456-1.434.319-.12 3.072-.899 1.297-.291 1.754-.352L77.11.468l1.784-.222L80.11.138 82.525.01l.946-.01 1.791.037.466.026 2.596.216 3.433.484.397.083 3.393.844.996.297 1.107.383 1.348.51 1.066.452 1.566.738.987.507 1.774 1.041.661.407 2.418 1.765.694.602 1.686 1.536.083.083 1.43 1.534.492.555 1.678 2.23.342.533 1.332 2.249.401.771.751 1.678.785 1.959.279.82.809 2.949c.015.052.027.105.037.159l.63 3.988.126 1.384.102 1.781.01.371-.038 1.989-.033.527-.108.86-.555 3.177-.134.582-1.28 3.991a1.186 1.186 0 01-.04.114l-1.188 2.876-.045.095-1.552 3.1-2.713 4.725-1.44 2.203-1.729 2.585-1.219 1.67-2.414 3.228-1.644 2.067-2.428 2.957-1.703 1.992-2.618 2.945-1.684 1.849-4.869 5.085-1.133 1.119.669.569c.946.871 1.835 1.8 2.661 2.787.248.301.488.608.72.921.506.685.962 1.406 1.362 2.158.216.407.409.828.58 1.257.389.985.651 2.026.749 3.078l.044.799c.025 1.53-.255 3.05-.823 4.471a11.057 11.057 0 01-3.479 4.625c-.541.424-1.118.796-1.724 1.117a12.347 12.347 0 01-4.516 1.341h-.01a12.996 12.996 0 01-5.476-.623 11.933 11.933 0 01-2.319-1.096 11.268 11.268 0 01-2.329-1.896 11.06 11.06 0 01-2.209-3.464 11.468 11.468 0 01-.819-3.972l.014-.966c.073-1.119.315-2.221.718-3.267.157-.411.334-.812.531-1.202.386-.755.83-1.477 1.324-2.164.323-.45.667-.887 1.025-1.31a30.309 30.309 0 012.384-2.49l.309-.279.497-.415z" fill="#24175b"/><path d="M71.203 148.661l19.927-16.817a2.035 2.035 0 012.606-.006l20.216 16.823a6.906 6.906 0 004.351 1.55H66.877a6.805 6.805 0 004.326-1.55zm12.404-60.034l.195.057c.063.03.116.075.173.114l.163.144c.402.37.793.759 1.169 1.157.265.283.523.574.771.875.315.38.61.779.879 1.194.116.183.224.368.325.561.088.167.167.34.236.515.122.305.214.627.242.954l-.006.614a3.507 3.507 0 01-1.662 2.732 4.747 4.747 0 01-2.021.665l-.759.022-.641-.056a4.964 4.964 0 01-.881-.214 4.17 4.17 0 01-.834-.391l-.5-.366a3.431 3.431 0 01-1.139-1.952 5.016 5.016 0 01-.059-.387l-.018-.586c.01-.158.034-.315.069-.472.087-.341.213-.673.372-.988.205-.396.439-.776.7-1.137.433-.586.903-1.143 1.405-1.67.324-.342.655-.673 1.001-.993l.246-.221c.171-.114.173-.114.368-.171h.206zM82.348 6.956l.079-.006v68.484l-.171-.315a191.264 191.264 0 01-6.291-12.75 136.318 136.318 0 01-4.269-10.688 84.358 84.358 0 01-2.574-8.802c-.541-2.365-.956-4.765-1.126-7.19a35.028 35.028 0 01-.059-3.108c.016-.903.053-1.804.109-2.705.09-1.418.234-2.832.442-4.235.165-1.104.368-2.205.62-3.293.2-.865.431-1.723.696-2.567.382-1.22.84-2.412 1.373-3.576.195-.419.405-.836.624-1.245 1.322-2.449 3.116-4.704 5.466-6.214a11.422 11.422 0 015.081-1.79zm8.88.173l4.607 1.314a28.193 28.193 0 016.076 3.096 24.387 24.387 0 016.533 6.517 24.618 24.618 0 012.531 4.878 28.586 28.586 0 011.761 7.898c.061.708.096 1.418.11 2.127.016.659.012 1.321-.041 1.98a22.306 22.306 0 01-.828 4.352 34.281 34.281 0 01-1.194 3.426 49.43 49.43 0 01-1.895 4.094c-1.536 2.966-3.304 5.803-5.195 8.547a133.118 133.118 0 01-7.491 9.776 185.466 185.466 0 01-8.987 9.96c2.114-3.963 4.087-8 5.915-12.102a149.96 149.96 0 002.876-6.93 108.799 108.799 0 002.679-7.792 76.327 76.327 0 001.54-5.976c.368-1.727.657-3.472.836-5.228.15-1.464.205-2.937.169-4.406a62.154 62.154 0 00-.1-2.695c-.216-3.612-.765-7.212-1.818-10.676a31.255 31.255 0 00-1.453-3.849c-1.348-2.937-3.23-5.683-5.776-7.686l-.855-.625z" fill="#fff"/><defs><radialGradient id="_Radial1" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(88.67 84.848) scale(120.977)"><stop offset="0" stop-color="#ba7bf0"/><stop offset=".45" stop-color="#996bec"/><stop offset="1" stop-color="#5046e4"/></radialGradient></defs></svg>
\ No newline at end of file
+<svg viewBox="0 0 167 151" width="167px" height="151px" xmlns="http://www.w3.org/2000/svg" fill-rule="evenodd" clip-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2"><path d="M116.78 20.613h19.23c17.104 0 30.99 13.886 30.99 30.99v67.618c0 17.104-13.886 30.99-30.99 30.99h-1.516c-8.803-1.377-12.621-4.017-15.57-6.248L94.475 123.86a3.453 3.453 0 00-4.329 0l-7.943 6.532-22.37-18.394a3.443 3.443 0 00-4.326 0l-31.078 27.339c-6.255 5.087-10.392 4.148-13.075 3.853C4.424 137.503 0 128.874 0 119.221V51.603c0-17.104 13.886-30.99 30.993-30.99H50.18l-.035.077-.647 1.886-.201.647-.871 3.862-.12.678-.382 3.868-.051 1.062-.008.372.036 1.774.088 1.039.215 1.628.275 1.464.326 1.349.423 1.46 1.098 3.092.362.927 1.912 4.04.675 1.241 2.211 3.795.846 1.369 3.086 4.544.446.602 4.015 5.226 1.297 1.608 4.585 5.36.942 1.031 3.779 4.066 1.497 1.55 2.474 2.457-.497.415-.309.279a30.309 30.309 0 00-2.384 2.49c-.359.423-.701.86-1.025 1.31-.495.687-.938 1.41-1.324 2.164-.198.391-.375.792-.531 1.202a11.098 11.098 0 00-.718 3.267l-.014.966c.035 1.362.312 2.707.819 3.972a11.06 11.06 0 002.209 3.464 11.274 11.274 0 002.329 1.896c.731.447 1.51.816 2.319 1.096 1.76.597 3.627.809 5.476.623h.01a12.347 12.347 0 004.516-1.341 11.647 11.647 0 001.724-1.116 11.067 11.067 0 003.479-4.626c.569-1.422.848-2.941.823-4.471l-.044-.799a11.305 11.305 0 00-.749-3.078c-.17-.429-.364-.848-.58-1.257-.4-.752-.856-1.473-1.362-2.158-.232-.313-.472-.62-.72-.921a29.81 29.81 0 00-2.661-2.787l-.669-.569 1.133-1.119 4.869-5.085 1.684-1.849 2.618-2.945 1.703-1.992 2.428-2.957 1.644-2.067 2.414-3.228 1.219-1.67 1.729-2.585 1.44-2.203 2.713-4.725 1.552-3.1.045-.095 1.188-2.876c.015-.037.029-.075.04-.114l1.28-3.991.134-.582.555-3.177.108-.86.033-.527.038-1.989-.01-.371-.102-1.781-.126-1.383-.63-3.989a1.521 1.521 0 00-.037-.159l-.809-2.949-.279-.82-.364-.907zm9.141 84.321c-4.007.056-7.287 3.336-7.343 7.342.059 4.006 3.337 7.284 7.343 7.341 4.005-.058 7.284-3.335 7.345-7.341-.058-4.006-3.338-7.286-7.345-7.342z" fill="url(#_Radial1)"/><path d="M72.499 147.571l-1.296 1.09a6.802 6.802 0 01-4.253 1.55H30.993a30.867 30.867 0 01-19.639-7.021c2.683.295 6.82 1.234 13.075-3.853l31.078-27.339a3.443 3.443 0 014.326 0l22.37 18.394 7.943-6.532a3.453 3.453 0 014.329 0l24.449 20.103c2.949 2.231 6.767 4.871 15.57 6.248H118.23a6.919 6.919 0 01-3.993-1.33l-.285-.22-1.207-1.003a2.377 2.377 0 00-.32-.323 21845.256 21845.256 0 00-18.689-15.497 2.035 2.035 0 00-2.606.006s.044.052-18.386 15.491c-.09.075-.172.154-.245.236zm53.422-42.637c-4.007.056-7.287 3.336-7.343 7.342.059 4.006 3.337 7.284 7.343 7.341 4.005-.058 7.284-3.335 7.345-7.341-.058-4.006-3.338-7.286-7.345-7.342zM78.453 82.687l-2.474-2.457-1.497-1.55-3.779-4.066-.942-1.031-4.585-5.36-1.297-1.609-4.015-5.225-.446-.602-3.086-4.544-.846-1.369-2.211-3.795-.675-1.241-1.912-4.04-.362-.927-1.098-3.092-.423-1.46-.326-1.349-.275-1.465-.215-1.627-.088-1.039-.036-1.774.008-.372.051-1.062.382-3.869.12-.677.871-3.862.201-.647.647-1.886.207-.488 1.03-2.262.714-1.346.994-1.64.991-1.46.706-.928.813-.98.895-.985.767-.771 1.867-1.643 1.365-1.117c.033-.028.067-.053.102-.077l1.615-1.092 1.283-.818L65.931 3.8c.037-.023.079-.041.118-.059l3.456-1.434.319-.12 3.072-.899 1.297-.291 1.754-.352L77.11.468l1.784-.222L80.11.138 82.525.01l.946-.01 1.791.037.466.026 2.596.216 3.433.484.397.083 3.393.844.996.297 1.107.383 1.348.51 1.066.452 1.566.738.987.507 1.774 1.041.661.407 2.418 1.765.694.602 1.686 1.536.083.083 1.43 1.534.492.555 1.678 2.23.342.533 1.332 2.249.401.771.751 1.678.785 1.959.279.82.809 2.949c.015.052.027.105.037.159l.63 3.988.126 1.384.102 1.781.01.371-.038 1.989-.033.527-.108.86-.555 3.177-.134.582-1.28 3.991a1.186 1.186 0 01-.04.114l-1.188 2.876-.045.095-1.552 3.1-2.713 4.725-1.44 2.203-1.729 2.585-1.219 1.67-2.414 3.228-1.644 2.067-2.428 2.957-1.703 1.992-2.618 2.945-1.684 1.849-4.869 5.085-1.133 1.119.669.569c.946.871 1.835 1.8 2.661 2.787.248.301.488.608.72.921.506.685.962 1.406 1.362 2.158.216.407.409.828.58 1.257.389.985.651 2.026.749 3.078l.044.799c.025 1.53-.255 3.05-.823 4.471a11.057 11.057 0 01-3.479 4.625c-.541.424-1.118.796-1.724 1.117a12.347 12.347 0 01-4.516 1.341h-.01a12.996 12.996 0 01-5.476-.623 11.933 11.933 0 01-2.319-1.096 11.268 11.268 0 01-2.329-1.896 11.06 11.06 0 01-2.209-3.464 11.468 11.468 0 01-.819-3.972l.014-.966c.073-1.119.315-2.221.718-3.267.157-.411.334-.812.531-1.202.386-.755.83-1.477 1.324-2.164.323-.45.667-.887 1.025-1.31a30.309 30.309 0 012.384-2.49l.309-.279.497-.415z" fill="#24175b"/><path d="M71.203 148.661l19.927-16.817a2.035 2.035 0 012.606-.006l20.216 16.823a6.906 6.906 0 004.351 1.55H66.877a6.805 6.805 0 004.326-1.55zm12.404-60.034l.195.057c.063.03.116.075.173.114l.163.144c.402.37.793.759 1.169 1.157.265.283.523.574.771.875.315.38.61.779.879 1.194.116.183.224.368.325.561.088.167.167.34.236.515.122.305.214.627.242.954l-.006.614a3.507 3.507 0 01-1.662 2.732 4.747 4.747 0 01-2.021.665l-.759.022-.641-.056a4.964 4.964 0 01-.881-.214 4.17 4.17 0 01-.834-.391l-.5-.366a3.431 3.431 0 01-1.139-1.952 5.016 5.016 0 01-.059-.387l-.018-.586c.01-.158.034-.315.069-.472.087-.341.213-.673.372-.988.205-.396.439-.776.7-1.137.433-.586.903-1.143 1.405-1.67.324-.342.655-.673 1.001-.993l.246-.221c.171-.114.173-.114.368-.171h.206zM82.348 6.956l.079-.006v68.484l-.171-.315a191.264 191.264 0 01-6.291-12.75 136.318 136.318 0 01-4.269-10.688 84.358 84.358 0 01-2.574-8.802c-.541-2.365-.956-4.765-1.126-7.19a35.028 35.028 0 01-.059-3.108c.016-.903.053-1.804.109-2.705.09-1.418.234-2.832.442-4.235.165-1.104.368-2.205.62-3.293.2-.865.431-1.723.696-2.567.382-1.22.84-2.412 1.373-3.576.195-.419.405-.836.624-1.245 1.322-2.449 3.116-4.704 5.466-6.214a11.422 11.422 0 015.081-1.79zm8.88.173l4.607 1.314a28.193 28.193 0 016.076 3.096 24.387 24.387 0 016.533 6.517 24.618 24.618 0 012.531 4.878 28.586 28.586 0 011.761 7.898c.061.708.096 1.418.11 2.127.016.659.012 1.321-.041 1.98a22.306 22.306 0 01-.828 4.352 34.281 34.281 0 01-1.194 3.426 49.43 49.43 0 01-1.895 4.094c-1.536 2.966-3.304 5.803-5.195 8.547a133.118 133.118 0 01-7.491 9.776 185.466 185.466 0 01-8.987 9.96c2.114-3.963 4.087-8 5.915-12.102a149.96 149.96 0 002.876-6.93 108.799 108.799 0 002.679-7.792 76.327 76.327 0 001.54-5.976c.368-1.727.657-3.472.836-5.228.15-1.464.205-2.937.169-4.406a62.154 62.154 0 00-.1-2.695c-.216-3.612-.765-7.212-1.818-10.676a31.255 31.255 0 00-1.453-3.849c-1.348-2.937-3.23-5.683-5.776-7.686l-.855-.625z" fill="#fff"/><defs><radialGradient id="_Radial1" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(88.67 84.848) scale(120.977)"><stop offset="0" stop-color="#ba7bf0"/><stop offset=".45" stop-color="#996bec"/><stop offset="1" stop-color="#5046e4"/></radialGradient></defs></svg>
diff --git a/site/static/icon/gateway.svg b/site/static/icon/gateway.svg
new file mode 100644
index 0000000000000..b68e949072407
--- /dev/null
+++ b/site/static/icon/gateway.svg
@@ -0,0 +1,64 @@
+<svg width="64" height="64" viewBox="0 0 64 64" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M32 62L57.975 46.98V16.964L32 2L6.02602 16.964H6.02502L32 31.984V62Z" fill="url(#paint0_linear_1725:872)"/>
+<path d="M57.975 16.964L32 2L6.02602 16.964H6.02502L32 31.984L57.975 16.964Z" fill="url(#paint1_linear_1725:872)"/>
+<path d="M57.975 16.964L32 2L6.02602 16.964H6.02502L32 31.984L57.975 16.964Z" fill="url(#paint2_linear_1725:872)"/>
+<path d="M57.975 16.964L32 2L6.02602 16.964H6.02502L32 31.984L57.975 16.964Z" fill="url(#paint3_linear_1725:872)"/>
+<path d="M6.026 46.9799V16.9639L32 31.9839L6.026 46.9799Z" fill="url(#paint4_linear_1725:872)"/>
+<path d="M32 31.9844L6.026 46.9804L32 62.0004V31.9844Z" fill="url(#paint5_linear_1725:872)" style="mix-blend-mode:overlay"/>
+<path d="M32 61.9999L57.975 46.9799V16.9639L32 31.9839V61.9999Z" fill="url(#paint6_linear_1725:872)"/>
+<path d="M32 61.9999L57.975 46.9799V16.9639L32 31.9839V61.9999Z" fill="url(#paint7_linear_1725:872)"/>
+<path d="M32 61.9999L57.975 46.9799V16.9639L32 31.9839V61.9999Z" fill="url(#paint8_linear_1725:872)"/>
+<g opacity="0.8">
+<path d="M25.028 27.9699L32 32V2L6 16.972L25.028 27.9699Z" fill="url(#paint9_linear_1725:872)" style="mix-blend-mode:overlay"/>
+</g>
+<defs>
+<linearGradient id="paint0_linear_1725:872" x1="17.0683" y1="11.5629" x2="61.3962" y2="55.8908" gradientUnits="userSpaceOnUse">
+<stop  offset="0" stop-color="#FDB60D"/>
+<stop offset="0.54795" stop-color="#FF318C"/>
+<stop offset="0.88765" stop-color="#6B57FF"/>
+</linearGradient>
+<linearGradient id="paint1_linear_1725:872" x1="25.5898" y1="28.0668" x2="28.4505" y2="23.112" gradientUnits="userSpaceOnUse">
+<stop  offset="0" stop-color="white" stop-opacity="0.6"/>
+<stop offset="0.08098" stop-color="#FFC524" stop-opacity="0.4"/>
+<stop offset="0.70457" stop-color="#FFC524" stop-opacity="0"/>
+</linearGradient>
+<linearGradient id="paint2_linear_1725:872" x1="25.4334" y1="5.59024" x2="29.6963" y2="12.9738" gradientUnits="userSpaceOnUse">
+<stop  offset="0" stop-color="#F9ED32" stop-opacity="0.6"/>
+<stop offset="0.19796" stop-color="#FFC524" stop-opacity="0.4"/>
+<stop offset="0.70457" stop-color="#FFC524" stop-opacity="0"/>
+</linearGradient>
+<linearGradient id="paint3_linear_1725:872" x1="38.9129" y1="4.99057" x2="37.0135" y2="8.28029" gradientUnits="userSpaceOnUse">
+<stop  offset="0" stop-color="#FDB60D" stop-opacity="0.6"/>
+<stop offset="0.23369" stop-color="#FDB60D" stop-opacity="0.4"/>
+<stop offset="0.5185" stop-color="#FF318C" stop-opacity="0"/>
+</linearGradient>
+<linearGradient id="paint4_linear_1725:872" x1="6.02553" y1="31.972" x2="48.2774" y2="31.972" gradientUnits="userSpaceOnUse">
+<stop offset="0.01477"/>
+<stop offset="0.19258"/>
+<stop offset="0.57156" stop-color="#6B57FF"/>
+<stop offset="0.82576" stop-color="#FF318C"/>
+</linearGradient>
+<linearGradient id="paint5_linear_1725:872" x1="25.2369" y1="19.192" x2="18.7738" y2="55.8462" gradientUnits="userSpaceOnUse">
+<stop offset="0.046628" stop-color="white" stop-opacity="0.86"/>
+<stop offset="0.766654" stop-color="#CBCAA4" stop-opacity="0"/>
+</linearGradient>
+<linearGradient id="paint6_linear_1725:872" x1="32.0001" y1="39.4819" x2="38.997" y2="39.4819" gradientUnits="userSpaceOnUse">
+<stop  offset="0" stop-color="#FFB2FF" stop-opacity="0.6"/>
+<stop offset="0.08098" stop-color="#D828FF" stop-opacity="0.4"/>
+<stop offset="0.70457" stop-color="#FF318C" stop-opacity="0"/>
+</linearGradient>
+<linearGradient id="paint7_linear_1725:872" x1="58.0814" y1="39.4819" x2="50.9352" y2="39.4819" gradientUnits="userSpaceOnUse">
+<stop  offset="0" stop-color="#6644FF" stop-opacity="0.8"/>
+<stop offset="0.09676" stop-color="#6B57FF" stop-opacity="0.4"/>
+<stop offset="0.70457" stop-color="#FF318C" stop-opacity="0"/>
+</linearGradient>
+<linearGradient id="paint8_linear_1725:872" x1="51.8655" y1="51.3952" x2="49.8093" y2="47.8337" gradientUnits="userSpaceOnUse">
+<stop offset="0.00572" stop-color="#FF318C"/>
+<stop offset="0.46934" stop-color="#6B57FF" stop-opacity="0"/>
+</linearGradient>
+<linearGradient id="paint9_linear_1725:872" x1="18.9999" y1="2.93734" x2="18.9999" y2="20.5615" gradientUnits="userSpaceOnUse">
+<stop offset="0.23873" stop-color="#FF5592" stop-opacity="0.65"/>
+<stop offset="0.8289" stop-color="#FF57E4" stop-opacity="0"/>
+</linearGradient>
+</defs>
+</svg>
diff --git a/site/static/icon/git.svg b/site/static/icon/git.svg
new file mode 100644
index 0000000000000..7b6372f371b12
--- /dev/null
+++ b/site/static/icon/git.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="97" height="97">
+  <path fill="#F05133" d="M92.71 44.408 52.591 4.291c-2.31-2.311-6.057-2.311-8.369 0l-8.33 8.332L46.459 23.19c2.456-.83 5.272-.273 7.229 1.685 1.969 1.97 2.521 4.81 1.67 7.275l10.186 10.185c2.465-.85 5.307-.3 7.275 1.671 2.75 2.75 2.75 7.206 0 9.958-2.752 2.751-7.208 2.751-9.961 0-2.068-2.07-2.58-5.11-1.531-7.658l-9.5-9.499v24.997c.67.332 1.303.774 1.861 1.332 2.75 2.75 2.75 7.206 0 9.959-2.75 2.749-7.209 2.749-9.957 0-2.75-2.754-2.75-7.21 0-9.959.68-.679 1.467-1.193 2.307-1.537v-25.23c-.84-.344-1.625-.853-2.307-1.537-2.083-2.082-2.584-5.14-1.516-7.698L31.798 16.715 4.288 44.222c-2.311 2.313-2.311 6.06 0 8.371l40.121 40.118c2.31 2.311 6.056 2.311 8.369 0L92.71 52.779c2.311-2.311 2.311-6.06 0-8.371z"/>
+</svg>
diff --git a/site/static/icon/github.svg b/site/static/icon/github.svg
new file mode 100644
index 0000000000000..c679c236fd224
--- /dev/null
+++ b/site/static/icon/github.svg
@@ -0,0 +1 @@
+<svg width="98" height="96" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M48.854 0C21.839 0 0 22 0 49.217c0 21.756 13.993 40.172 33.405 46.69 2.427.49 3.316-1.059 3.316-2.362 0-1.141-.08-5.052-.08-9.127-13.59 2.934-16.42-5.867-16.42-5.867-2.184-5.704-5.42-7.17-5.42-7.17-4.448-3.015.324-3.015.324-3.015 4.934.326 7.523 5.052 7.523 5.052 4.367 7.496 11.404 5.378 14.235 4.074.404-3.178 1.699-5.378 3.074-6.6-10.839-1.141-22.243-5.378-22.243-24.283 0-5.378 1.94-9.778 5.014-13.2-.485-1.222-2.184-6.275.486-13.038 0 0 4.125-1.304 13.426 5.052a46.97 46.97 0 0 1 12.214-1.63c4.125 0 8.33.571 12.213 1.63 9.302-6.356 13.427-5.052 13.427-5.052 2.67 6.763.97 11.816.485 13.038 3.155 3.422 5.015 7.822 5.015 13.2 0 18.905-11.404 23.06-22.324 24.283 1.78 1.548 3.316 4.481 3.316 9.126 0 6.6-.08 11.897-.08 13.526 0 1.304.89 2.853 3.316 2.364 19.412-6.52 33.405-24.935 33.405-46.691C97.707 22 75.788 0 48.854 0z" fill="#fff"/></svg>
diff --git a/site/static/icon/gitlab.svg b/site/static/icon/gitlab.svg
new file mode 100644
index 0000000000000..657533853f1d3
--- /dev/null
+++ b/site/static/icon/gitlab.svg
@@ -0,0 +1,25 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 194 186" width="194px" height="186px">
+    <g clipPath="url(#clip0_1915_987)">
+      <path
+        d="M189.83 73.7299L189.56 73.0399L163.42 4.81995C162.888 3.48288 161.946 2.34863 160.73 1.57996C159.513 0.82434 158.093 0.460411 156.662 0.537307C155.232 0.614203 153.859 1.12822 152.73 2.00996C151.613 2.91701 150.803 4.14609 150.41 5.52995L132.76 59.53H61.2899L43.6399 5.52995C43.2571 4.13855 42.4453 2.90331 41.3199 1.99995C40.1907 1.11822 38.8181 0.6042 37.3875 0.527305C35.9569 0.450409 34.5371 0.814338 33.3199 1.56995C32.1062 2.34173 31.1653 3.47499 30.6299 4.80995L4.43991 73L4.17991 73.69C0.416933 83.522 -0.0475445 94.3109 2.8565 104.43C5.76055 114.549 11.8757 123.45 20.2799 129.79L20.3699 129.86L20.6099 130.03L60.4299 159.85L80.1299 174.76L92.1299 183.82C93.5336 184.886 95.2475 185.463 97.0099 185.463C98.7723 185.463 100.486 184.886 101.89 183.82L113.89 174.76L133.59 159.85L173.65 129.85L173.75 129.77C182.135 123.429 188.236 114.537 191.136 104.432C194.035 94.3262 193.577 83.5527 189.83 73.7299Z"
+        fill="#E24329"
+      />
+      <path
+        d="M189.83 73.7299L189.56 73.0399C176.823 75.6543 164.82 81.0495 154.41 88.8399L97 132.25C116.55 147.04 133.57 159.89 133.57 159.89L173.63 129.89L173.73 129.81C182.127 123.469 188.238 114.572 191.141 104.457C194.045 94.3434 193.585 83.5598 189.83 73.7299Z"
+        fill="#FC6D26"
+      />
+      <path
+        d="M60.4299 159.89L80.1299 174.8L92.1299 183.86C93.5336 184.926 95.2475 185.503 97.0099 185.503C98.7723 185.503 100.486 184.926 101.89 183.86L113.89 174.8L133.59 159.89C133.59 159.89 116.55 147 96.9999 132.25C77.4499 147 60.4299 159.89 60.4299 159.89Z"
+        fill="#FCA326"
+      />
+      <path
+        d="M39.5799 88.84C29.1778 81.0335 17.1779 75.6243 4.43991 73L4.17991 73.69C0.416933 83.5221 -0.0475445 94.311 2.8565 104.43C5.76055 114.549 11.8757 123.45 20.2799 129.79L20.3699 129.86L20.6099 130.03L60.4299 159.85C60.4299 159.85 77.4299 147 96.9999 132.21L39.5799 88.84Z"
+        fill="#FC6D26"
+      />
+    </g>
+    <defs>
+      <clipPath id="clip0_1915_987">
+        <rect width="194" height="186" fill="white" />
+      </clipPath>
+    </defs>
+  </svg>
diff --git a/site/static/icon/go.svg b/site/static/icon/go.svg
new file mode 100644
index 0000000000000..baaae77a60863
--- /dev/null
+++ b/site/static/icon/go.svg
@@ -0,0 +1 @@
+<svg height="77" viewBox="0 0 206 77" width="206" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><linearGradient id="a" x1="100%" x2="0%" y1="50%" y2="50%"><stop offset="0" stop-color="#00a29c"/><stop offset="1" stop-color="#00add8"/></linearGradient><path d="m127.481483 31.4343267c1.445351-4.5790807 3.790459-8.9059246 6.918517-13 7.3-9.59999996 16.1-14.59999996 28-16.69999996 10.2-1.8 19.8-.8 28.5 5.1 7.9 5.39999996 12.8 12.69999996 14.1 22.29999996 1.7 13.5-2.2 24.5-11.5 33.9-6.6 6.7-14.7 10.9-24 12.8-2.7.5-5.4.6-8 .9-9.1-.2-17.4-2.8-24.4-8.8-4.923224-4.2556681-8.314592-9.4861534-9.999798-15.5752516-1.1695 2.3617137-2.567865 4.6235348-4.200202 6.7752516-7.2 9.5-16.6 15.4-28.5 17-9.8 1.3-18.9-.6-26.9-6.6-7.4-5.6-11.6-13-12.7-22.2-1.3-10.9 1.9-20.7 8.5-29.3 7.1-9.29999996 16.5-15.19999996 28-17.29999996 9.4-1.70000001 18.4-.6 26.5 4.9 5.3 3.5 9.1 8.29999996 11.6 14.09999996.6.9.2 1.4-1 1.7-6.3 1.6-10.6 2.8-16.8 4.4-1.5.4-1.6.5-2.9-1-1.5-1.7-2.6-2.8-4.7-3.8-6.3-3.1-12.4-2.2-18.1 1.5-6.8 4.4-10.3 10.9-10.2 19 .1 8 5.6 14.6 13.5 15.7 6.8.9 12.5-1.5 17-6.6.9-1.1 1.7-2.3 2.7-3.7-3.6 0-8.1 0-19.3 0-2.1 0-2.6-1.3-1.9-3 1.3-3.1 3.7-8.3 5.1-10.9.3-.6 1-1.6 2.5-1.6zm-111.981483-8.2c-.4 0-.5-.2-.3-.5l2.1-2.7c.2-.3.7-.5 1.1-.5h35.7c.4 0 .5.3.3.6l-1.7 2.6c-.2.3-.7.6-1 .6zm-15.1 9.2c-.4 0-.5-.2-.3-.5l2.1-2.7c.2-.3.7-.5 1.1-.5h45.6c.4 0 .6.3.5.6l-.8 2.4c-.1.4-.5.6-.9.6zm24.2 9.2c-.4 0-.5-.3-.3-.6l1.4-2.5c.2-.3.6-.6 1-.6h20c.4 0 .6.3.6.7l-.2 2.4c0 .4-.4.7-.7.7zm160.7-5.3c-.1-1.3-.1-2.3-.3-3.3-1.8-9.9-10.9-15.5-20.4-13.3-9.3 2.1-15.3 8-17.5 17.4-1.8 7.8 2 15.7 9.2 18.9 5.5 2.4 11 2.1 16.3-.6 7.9-4.1 12.2-10.5 12.7-19.1z" fill="url(#a)"/></svg>
diff --git a/site/static/icon/goland.svg b/site/static/icon/goland.svg
index b18cad6243be5..67c770217fec5 100644
--- a/site/static/icon/goland.svg
+++ b/site/static/icon/goland.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" enable-background="new 0 0 70 70" version="1.1" viewBox="0 0 70 70" xml:space="preserve"><g><linearGradient id="SVGID_1_" x1="218.31" x2="206.336" y1="276.731" y2="294.988" gradientTransform="matrix(1.5625 0 0 1.5625 -286.9062 -405.0312)" gradientUnits="userSpaceOnUse"><stop offset=".174" style="stop-color:#078efc"/><stop offset=".204" style="stop-color:#118afc"/><stop offset=".435" style="stop-color:#5971fc"/><stop offset=".627" style="stop-color:#8e5efc"/><stop offset=".77" style="stop-color:#af52fc"/><stop offset=".849" style="stop-color:#bb4efc"/></linearGradient><path fill="url(#SVGID_1_)" d="M57.274,22.361l9.541,21.197l-13.49,23.045L20.922,40.202L37.493,24.23L57.274,22.361z"/><path fill="#BB4EFC" d="M43.499,42.747l9.826,23.857L23.39,56.314l-2.468-16.111L43.499,42.747z"/><path fill="#078EFC" d="M24.281,9.433l13.776,7.06l-12.398,37.54L0.69,53.773l5.364-11.895L0.69,26.677L24.281,9.433z"/><linearGradient id="SVGID_2_" x1="188.25" x2="212.533" y1="278.506" y2="260.237" gradientTransform="matrix(1.5625 0 0 1.5625 -286.9062 -405.0312)" gradientUnits="userSpaceOnUse"><stop offset=".174" style="stop-color:#078efc"/><stop offset=".204" style="stop-color:#118afc"/><stop offset=".435" style="stop-color:#5971fc"/><stop offset=".627" style="stop-color:#8e5efc"/><stop offset=".77" style="stop-color:#af52fc"/><stop offset=".849" style="stop-color:#bb4efc"/></linearGradient><path fill="url(#SVGID_2_)" d="M41.563,0.479l6.515,22.17L0.69,26.677L15.761,0.479H41.563z"/><linearGradient id="SVGID_3_" x1="189.941" x2="220.469" y1="296.496" y2="276.879" gradientTransform="matrix(1.5625 0 0 1.5625 -286.9062 -405.0312)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#078efc"/><stop offset=".106" style="stop-color:#15a7d3"/><stop offset=".228" style="stop-color:#23bfaa"/><stop offset=".348" style="stop-color:#2dd28b"/><stop offset=".463" style="stop-color:#35df74"/><stop offset=".573" style="stop-color:#39e767"/><stop offset=".67" style="stop-color:#3bea62"/></linearGradient><polygon fill="url(#SVGID_3_)" points="66.815 14.519 39.091 21.099 .69 53.773 25.458 66.604 46.973 44.423"/></g><g><rect width="44.083" height="44.083" x="11.711" y="11.5"/><rect width="16.531" height="2.645" x="16.119" y="48.309" fill="#FFF"/><g><path fill="#FFF" d="M14.607,25.88v-0.054c-0.18-5.295,3.967-9.734,9.262-9.913c0.09-0.003,0.179-0.005,0.269-0.005 c2.64-0.135,5.22,0.815,7.142,2.63l-2.52,3.206c-1.251-1.272-2.969-1.975-4.753-1.945c-3.083,0.226-5.41,2.889-5.22,5.974v0.054 c-0.258,3.091,2.039,5.805,5.13,6.063c0.125,0.01,0.251,0.017,0.377,0.019c1.347,0.04,2.67-0.365,3.765-1.151v-2.74h-4.025v-3.643 h7.895v8.328c-2.113,1.955-4.886,3.041-7.765,3.043c-5.162,0.123-9.446-3.963-9.569-9.125c0,0,0,0,0,0 C14.59,26.374,14.594,26.127,14.607,25.88z"/><path fill="#FFF" d="M33.609,25.88v-0.054c-0.141-5.335,4.069-9.774,9.405-9.915s9.774,4.069,9.915,9.405 c0.004,0.152,0.004,0.305,0.001,0.457v0.054c0.141,5.335-4.069,9.774-9.405,9.915c-5.335,0.141-9.774-4.069-9.915-9.405l0,0 C33.606,26.185,33.606,26.033,33.609,25.88z M48.75,25.88v-0.054c0.186-3.14-2.209-5.835-5.349-6.021 c-0.053-0.003-0.105-0.005-0.158-0.007c-3.096,0.078-5.542,2.65-5.464,5.746c0,0,0,0,0,0c0.002,0.076,0.005,0.152,0.01,0.229 v0.054c-0.186,3.14,2.209,5.835,5.349,6.021c0.053,0.003,0.105,0.005,0.158,0.007c3.096-0.078,5.542-2.65,5.464-5.746c0,0,0,0,0,0 C48.758,26.033,48.755,25.956,48.75,25.88z"/></g></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" enable-background="new 0 0 70 70" version="1.1" viewBox="0 0 70 70" width="70px" height="70px" xml:space="preserve"><g><linearGradient id="SVGID_1_" x1="218.31" x2="206.336" y1="276.731" y2="294.988" gradientTransform="matrix(1.5625 0 0 1.5625 -286.9062 -405.0312)" gradientUnits="userSpaceOnUse"><stop offset=".174" style="stop-color:#078efc"/><stop offset=".204" style="stop-color:#118afc"/><stop offset=".435" style="stop-color:#5971fc"/><stop offset=".627" style="stop-color:#8e5efc"/><stop offset=".77" style="stop-color:#af52fc"/><stop offset=".849" style="stop-color:#bb4efc"/></linearGradient><path fill="url(#SVGID_1_)" d="M57.274,22.361l9.541,21.197l-13.49,23.045L20.922,40.202L37.493,24.23L57.274,22.361z"/><path fill="#BB4EFC" d="M43.499,42.747l9.826,23.857L23.39,56.314l-2.468-16.111L43.499,42.747z"/><path fill="#078EFC" d="M24.281,9.433l13.776,7.06l-12.398,37.54L0.69,53.773l5.364-11.895L0.69,26.677L24.281,9.433z"/><linearGradient id="SVGID_2_" x1="188.25" x2="212.533" y1="278.506" y2="260.237" gradientTransform="matrix(1.5625 0 0 1.5625 -286.9062 -405.0312)" gradientUnits="userSpaceOnUse"><stop offset=".174" style="stop-color:#078efc"/><stop offset=".204" style="stop-color:#118afc"/><stop offset=".435" style="stop-color:#5971fc"/><stop offset=".627" style="stop-color:#8e5efc"/><stop offset=".77" style="stop-color:#af52fc"/><stop offset=".849" style="stop-color:#bb4efc"/></linearGradient><path fill="url(#SVGID_2_)" d="M41.563,0.479l6.515,22.17L0.69,26.677L15.761,0.479H41.563z"/><linearGradient id="SVGID_3_" x1="189.941" x2="220.469" y1="296.496" y2="276.879" gradientTransform="matrix(1.5625 0 0 1.5625 -286.9062 -405.0312)" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#078efc"/><stop offset=".106" style="stop-color:#15a7d3"/><stop offset=".228" style="stop-color:#23bfaa"/><stop offset=".348" style="stop-color:#2dd28b"/><stop offset=".463" style="stop-color:#35df74"/><stop offset=".573" style="stop-color:#39e767"/><stop offset=".67" style="stop-color:#3bea62"/></linearGradient><polygon fill="url(#SVGID_3_)" points="66.815 14.519 39.091 21.099 .69 53.773 25.458 66.604 46.973 44.423"/></g><g><rect width="44.083" height="44.083" x="11.711" y="11.5"/><rect width="16.531" height="2.645" x="16.119" y="48.309" fill="#FFF"/><g><path fill="#FFF" d="M14.607,25.88v-0.054c-0.18-5.295,3.967-9.734,9.262-9.913c0.09-0.003,0.179-0.005,0.269-0.005 c2.64-0.135,5.22,0.815,7.142,2.63l-2.52,3.206c-1.251-1.272-2.969-1.975-4.753-1.945c-3.083,0.226-5.41,2.889-5.22,5.974v0.054 c-0.258,3.091,2.039,5.805,5.13,6.063c0.125,0.01,0.251,0.017,0.377,0.019c1.347,0.04,2.67-0.365,3.765-1.151v-2.74h-4.025v-3.643 h7.895v8.328c-2.113,1.955-4.886,3.041-7.765,3.043c-5.162,0.123-9.446-3.963-9.569-9.125c0,0,0,0,0,0 C14.59,26.374,14.594,26.127,14.607,25.88z"/><path fill="#FFF" d="M33.609,25.88v-0.054c-0.141-5.335,4.069-9.774,9.405-9.915s9.774,4.069,9.915,9.405 c0.004,0.152,0.004,0.305,0.001,0.457v0.054c0.141,5.335-4.069,9.774-9.405,9.915c-5.335,0.141-9.774-4.069-9.915-9.405l0,0 C33.606,26.185,33.606,26.033,33.609,25.88z M48.75,25.88v-0.054c0.186-3.14-2.209-5.835-5.349-6.021 c-0.053-0.003-0.105-0.005-0.158-0.007c-3.096,0.078-5.542,2.65-5.464,5.746c0,0,0,0,0,0c0.002,0.076,0.005,0.152,0.01,0.229 v0.054c-0.186,3.14,2.209,5.835,5.349,6.021c0.053,0.003,0.105,0.005,0.158,0.007c3.096-0.078,5.542-2.65,5.464-5.746c0,0,0,0,0,0 C48.758,26.033,48.755,25.956,48.75,25.88z"/></g></g></svg>
diff --git a/site/static/icon/google.svg b/site/static/icon/google.svg
new file mode 100644
index 0000000000000..088288fa3fb36
--- /dev/null
+++ b/site/static/icon/google.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z" fill="#4285F4"/><path d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" fill="#34A853"/><path d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" fill="#FBBC05"/><path d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" fill="#EA4335"/><path d="M1 1h22v22H1z" fill="none"/></svg>
\ No newline at end of file
diff --git a/site/static/icon/intellij.svg b/site/static/icon/intellij.svg
index 0b3efa53ee8f1..016e1cdc49e26 100644
--- a/site/static/icon/intellij.svg
+++ b/site/static/icon/intellij.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 70 70" xml:space="preserve" style="enable-background:new 0 0 70 70"><g><g><linearGradient id="SVGID_1_" x1=".79" x2="33.317" y1="40.089" y2="40.089" gradientUnits="userSpaceOnUse"><stop offset=".258" style="stop-color:#f97a12"/><stop offset=".459" style="stop-color:#b07b58"/><stop offset=".724" style="stop-color:#577bae"/><stop offset=".91" style="stop-color:#1e7ce5"/><stop offset="1" style="stop-color:#087cfa"/></linearGradient><polygon style="fill:url(#SVGID_1_)" points="17.7 54.6 .8 41.2 9.2 25.6 33.3 35"/><linearGradient id="SVGID_2_" x1="25.767" x2="79.424" y1="24.88" y2="54.57" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#f97a12"/><stop offset=".072" style="stop-color:#cb7a3e"/><stop offset=".154" style="stop-color:#9e7b6a"/><stop offset=".242" style="stop-color:#757b91"/><stop offset=".334" style="stop-color:#537bb1"/><stop offset=".432" style="stop-color:#387ccc"/><stop offset=".538" style="stop-color:#237ce0"/><stop offset=".655" style="stop-color:#147cef"/><stop offset=".792" style="stop-color:#0b7cf7"/><stop offset="1" style="stop-color:#087cfa"/></linearGradient><polygon style="fill:url(#SVGID_2_)" points="70 18.7 68.7 59.2 41.8 70 25.6 59.6 49.3 35 38.9 12.3 48.2 1.1"/><linearGradient id="SVGID_3_" x1="63.228" x2="48.29" y1="42.915" y2="-1.719" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#fe315d"/><stop offset=".078" style="stop-color:#cb417e"/><stop offset=".16" style="stop-color:#9e4e9b"/><stop offset=".247" style="stop-color:#755bb4"/><stop offset=".339" style="stop-color:#5365ca"/><stop offset=".436" style="stop-color:#386ddb"/><stop offset=".541" style="stop-color:#2374e9"/><stop offset=".658" style="stop-color:#1478f3"/><stop offset=".794" style="stop-color:#0b7bf8"/><stop offset="1" style="stop-color:#087cfa"/></linearGradient><polygon style="fill:url(#SVGID_3_)" points="70 18.7 48.7 43.9 38.9 12.3 48.2 1.1"/><linearGradient id="SVGID_4_" x1="10.72" x2="55.524" y1="16.473" y2="90.58" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#fe315d"/><stop offset=".04" style="stop-color:#f63462"/><stop offset=".104" style="stop-color:#df3a71"/><stop offset=".167" style="stop-color:#c24383"/><stop offset=".291" style="stop-color:#ad4a91"/><stop offset=".55" style="stop-color:#755bb4"/><stop offset=".917" style="stop-color:#1d76ed"/><stop offset="1" style="stop-color:#087cfa"/></linearGradient><polygon style="fill:url(#SVGID_4_)" points="33.7 58.1 5.6 68.3 10.1 52.5 16 33.1 0 27.7 10.1 0 32.1 2.7 53.7 27.4"/></g><g><rect style="fill:#000" width="43.2" height="43.2" x="13.7" y="13.5"/><rect style="fill:#fff" width="16.2" height="2.7" x="17.7" y="48.6"/><polygon style="fill:#fff" points="29.4 22.4 29.4 19.1 20.4 19.1 20.4 22.4 23 22.4 23 33.7 20.4 33.7 20.4 37 29.4 37 29.4 33.7 26.9 33.7 26.9 22.4"/><path style="fill:#fff" d="M38,37.3c-1.4,0-2.6-0.3-3.5-0.8c-0.9-0.5-1.7-1.2-2.3-1.9l2.5-2.8c0.5,0.6,1,1,1.5,1.3 c0.5,0.3,1.1,0.5,1.7,0.5c0.7,0,1.3-0.2,1.8-0.7c0.4-0.5,0.6-1.2,0.6-2.3V19.1h4v11.7c0,1.1-0.1,2-0.4,2.8c-0.3,0.8-0.7,1.4-1.3,2 c-0.5,0.5-1.2,1-2,1.2C39.8,37.1,39,37.3,38,37.3"/></g></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 70 70" width="70px" height="70px" xml:space="preserve" style="enable-background:new 0 0 70 70"><g><g><linearGradient id="SVGID_1_" x1=".79" x2="33.317" y1="40.089" y2="40.089" gradientUnits="userSpaceOnUse"><stop offset=".258" style="stop-color:#f97a12"/><stop offset=".459" style="stop-color:#b07b58"/><stop offset=".724" style="stop-color:#577bae"/><stop offset=".91" style="stop-color:#1e7ce5"/><stop offset="1" style="stop-color:#087cfa"/></linearGradient><polygon style="fill:url(#SVGID_1_)" points="17.7 54.6 .8 41.2 9.2 25.6 33.3 35"/><linearGradient id="SVGID_2_" x1="25.767" x2="79.424" y1="24.88" y2="54.57" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#f97a12"/><stop offset=".072" style="stop-color:#cb7a3e"/><stop offset=".154" style="stop-color:#9e7b6a"/><stop offset=".242" style="stop-color:#757b91"/><stop offset=".334" style="stop-color:#537bb1"/><stop offset=".432" style="stop-color:#387ccc"/><stop offset=".538" style="stop-color:#237ce0"/><stop offset=".655" style="stop-color:#147cef"/><stop offset=".792" style="stop-color:#0b7cf7"/><stop offset="1" style="stop-color:#087cfa"/></linearGradient><polygon style="fill:url(#SVGID_2_)" points="70 18.7 68.7 59.2 41.8 70 25.6 59.6 49.3 35 38.9 12.3 48.2 1.1"/><linearGradient id="SVGID_3_" x1="63.228" x2="48.29" y1="42.915" y2="-1.719" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#fe315d"/><stop offset=".078" style="stop-color:#cb417e"/><stop offset=".16" style="stop-color:#9e4e9b"/><stop offset=".247" style="stop-color:#755bb4"/><stop offset=".339" style="stop-color:#5365ca"/><stop offset=".436" style="stop-color:#386ddb"/><stop offset=".541" style="stop-color:#2374e9"/><stop offset=".658" style="stop-color:#1478f3"/><stop offset=".794" style="stop-color:#0b7bf8"/><stop offset="1" style="stop-color:#087cfa"/></linearGradient><polygon style="fill:url(#SVGID_3_)" points="70 18.7 48.7 43.9 38.9 12.3 48.2 1.1"/><linearGradient id="SVGID_4_" x1="10.72" x2="55.524" y1="16.473" y2="90.58" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#fe315d"/><stop offset=".04" style="stop-color:#f63462"/><stop offset=".104" style="stop-color:#df3a71"/><stop offset=".167" style="stop-color:#c24383"/><stop offset=".291" style="stop-color:#ad4a91"/><stop offset=".55" style="stop-color:#755bb4"/><stop offset=".917" style="stop-color:#1d76ed"/><stop offset="1" style="stop-color:#087cfa"/></linearGradient><polygon style="fill:url(#SVGID_4_)" points="33.7 58.1 5.6 68.3 10.1 52.5 16 33.1 0 27.7 10.1 0 32.1 2.7 53.7 27.4"/></g><g><rect style="fill:#000" width="43.2" height="43.2" x="13.7" y="13.5"/><rect style="fill:#fff" width="16.2" height="2.7" x="17.7" y="48.6"/><polygon style="fill:#fff" points="29.4 22.4 29.4 19.1 20.4 19.1 20.4 22.4 23 22.4 23 33.7 20.4 33.7 20.4 37 29.4 37 29.4 33.7 26.9 33.7 26.9 22.4"/><path style="fill:#fff" d="M38,37.3c-1.4,0-2.6-0.3-3.5-0.8c-0.9-0.5-1.7-1.2-2.3-1.9l2.5-2.8c0.5,0.6,1,1,1.5,1.3 c0.5,0.3,1.1,0.5,1.7,0.5c0.7,0,1.3-0.2,1.8-0.7c0.4-0.5,0.6-1.2,0.6-2.3V19.1h4v11.7c0,1.1-0.1,2-0.4,2.8c-0.3,0.8-0.7,1.4-1.3,2 c-0.5,0.5-1.2,1-2,1.2C39.8,37.1,39,37.3,38,37.3"/></g></g></svg>
diff --git a/site/static/icon/javascript.svg b/site/static/icon/javascript.svg
new file mode 100644
index 0000000000000..ff80efd7c9a1c
--- /dev/null
+++ b/site/static/icon/javascript.svg
@@ -0,0 +1,31 @@
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 630 630" width="630px" height="630px">
+<!--
+The MIT License (MIT)
+
+Copyright (c) 2011 Christopher Williams <chris@iterativedesigns.com>,
+                     Manuel Strehl <boldewyn@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+-->
+<g id="logo">
+  <rect id="background" x="0" y="0" width="630" height="630" fill="#f7df1e" />
+  <path id="j" d="m 165.65,526.47375 48.2125,-29.1775 C 223.16375,513.7875 231.625,527.74 251.92,527.74 c 19.45375,0 31.71875,-7.60975 31.71875,-37.21 l 0,-201.3 59.20375,0 0,202.1375 c 0,61.32 -35.94375,89.23125 -88.385,89.23125 -47.36125,0 -74.8525,-24.52875 -88.8075,-54.13" />
+  <path id="s" d="m 375,520.13 48.20625,-27.91125 c 12.69,20.72375 29.1825,35.9475 58.36125,35.9475 24.53125,0 40.17375,-12.26475 40.17375,-29.18125 0,-20.29875 -16.06875,-27.48875 -43.135,-39.32625 l -14.7975,-6.3475 c -42.715,-18.18125 -71.05,-41.0175 -71.05,-89.2275 0,-44.40375 33.83125,-78.2375 86.695,-78.2375 37.6375,0 64.7025,13.11125 84.15375,47.36625 l -46.09625,29.60125 c -10.15,-18.1825 -21.1425,-25.37125 -38.0575,-25.37125 -17.33875,0 -28.335,10.995 -28.335,25.37125 0,17.7625 10.99625,24.9525 36.3675,35.94875 l 14.8,6.3425 c 50.325,21.56875 78.66,43.5575 78.66,93.03375 0,53.2875 -41.86625,82.465 -98.11,82.465 -54.97625,0 -90.5,-26.2175 -107.83625,-60.47375" />
+</g>
+</svg>
diff --git a/site/static/icon/jax.svg b/site/static/icon/jax.svg
index 707be21621d3f..e8db01d132d1f 100644
--- a/site/static/icon/jax.svg
+++ b/site/static/icon/jax.svg
@@ -1 +1,40 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 451 260.81"><defs><style>.cls-1{fill:#5e97f6;}.cls-1,.cls-2,.cls-3,.cls-4,.cls-5,.cls-6,.cls-7,.cls-8,.cls-9{stroke:#dce0df;stroke-linejoin:round;}.cls-2{fill:#2a56c6;}.cls-3{fill:#00796b;}.cls-4{fill:#3367d6;}.cls-5{fill:#26a69a;}.cls-6{fill:#9c27b0;}.cls-7{fill:#6a1b9a;}.cls-8{fill:#00695c;}.cls-9{fill:#ea80fc;}</style></defs><title>JAX Light Stroke</title><g id="Layer_2" data-name="Layer 2"><g id="Layer_1-2" data-name="Layer 1"><polygon class="cls-1" points="50.5 130.4 25.5 173.71 75.5 173.71 100.5 130.4 50.5 130.4"/><polygon class="cls-1" points="0.5 217.01 25.5 173.71 75.5 173.71 50.5 217.01 0.5 217.01"/><polygon class="cls-1" points="125.5 173.71 75.5 173.71 50.5 217.01 100.5 217.01 125.5 173.71"/><polygon class="cls-1" points="175.5 173.71 125.5 173.71 100.5 217.01 150.5 217.01 175.5 173.71"/><polygon class="cls-1" points="150.5 130.4 125.5 173.71 175.5 173.71 200.5 130.4 150.5 130.4"/><polygon class="cls-1" points="175.5 87.1 150.5 130.4 200.5 130.4 225.5 87.1 175.5 87.1"/><polygon class="cls-1" points="200.5 43.8 175.5 87.1 225.5 87.1 250.5 43.8 200.5 43.8"/><polygon class="cls-1" points="225.5 0.5 200.5 43.8 250.5 43.8 275.5 0.5 225.5 0.5"/><polygon class="cls-2" points="0.5 217.01 25.5 260.31 75.5 260.31 50.5 217.01 0.5 217.01"/><polygon class="cls-2" points="125.5 260.31 75.5 260.31 50.5 217.01 100.5 217.01 125.5 260.31"/><polygon class="cls-2" points="175.5 260.31 125.5 260.31 100.5 217.01 150.5 217.01 175.5 260.31"/><polygon class="cls-3" points="200.5 217.01 175.5 173.71 150.5 217.01 175.5 260.31 200.5 217.01"/><polygon class="cls-3" points="250.5 130.4 225.5 87.1 200.5 130.4 250.5 130.4"/><polygon class="cls-3" points="250.5 43.8 225.5 87.1 250.5 130.4 275.5 87.1 250.5 43.8"/><polygon class="cls-4" points="125.5 173.71 100.5 130.4 75.5 173.71 125.5 173.71"/><polygon class="cls-5" points="250.5 130.4 200.5 130.4 175.5 173.71 225.5 173.71 250.5 130.4"/><polygon class="cls-5" points="300.5 130.4 250.5 130.4 225.5 173.71 275.5 173.71 300.5 130.4"/><polygon class="cls-6" points="350.5 43.8 325.5 0.5 300.5 43.8 325.5 87.1 350.5 43.8"/><polygon class="cls-6" points="375.5 87.1 350.5 43.8 325.5 87.1 350.5 130.4 375.5 87.1"/><polygon class="cls-6" points="400.5 130.4 375.5 87.1 350.5 130.4 375.5 173.71 400.5 130.4"/><polygon class="cls-6" points="425.5 173.71 400.5 130.4 375.5 173.71 400.5 217.01 425.5 173.71"/><polygon class="cls-6" points="450.5 217.01 425.5 173.71 400.5 217.01 425.5 260.31 450.5 217.01"/><polygon class="cls-6" points="425.5 0.5 400.5 43.8 425.5 87.1 450.5 43.8 425.5 0.5"/><polygon class="cls-6" points="375.5 87.1 400.5 43.8 425.5 87.1 400.5 130.4 375.5 87.1"/><polygon class="cls-6" points="350.5 130.4 325.5 173.71 350.5 217.01 375.5 173.71 350.5 130.4"/><polygon class="cls-6" points="325.5 260.31 300.5 217.01 325.5 173.71 350.5 217.01 325.5 260.31"/><polygon class="cls-7" points="275.5 260.31 250.5 217.01 300.5 217.01 325.5 260.31 275.5 260.31"/><polygon class="cls-8" points="225.5 173.71 175.5 173.71 200.5 217.01 250.5 217.01 225.5 173.71"/><polygon class="cls-8" points="275.5 173.71 225.5 173.71 250.5 217.01 275.5 173.71"/><polygon class="cls-8" points="275.5 87.1 300.5 130.4 350.5 130.4 325.5 87.1 275.5 87.1"/><polygon class="cls-8" points="300.5 43.8 250.5 43.8 275.5 87.1 325.5 87.1 300.5 43.8"/><polygon class="cls-8" points="425.5 260.31 400.5 217.01 350.5 217.01 375.5 260.31 425.5 260.31"/><polygon class="cls-8" points="375.5 173.71 350.5 217.01 400.5 217.01 375.5 173.71"/><polygon class="cls-9" points="325.5 0.5 275.5 0.5 250.5 43.8 300.5 43.8 325.5 0.5"/><polygon class="cls-9" points="325.5 173.71 275.5 173.71 250.5 217.01 300.5 217.01 325.5 173.71"/><polygon class="cls-9" points="350.5 130.4 300.5 130.4 275.5 173.71 325.5 173.71 350.5 130.4"/><polygon class="cls-9" points="425.5 0.5 375.5 0.5 350.5 43.8 400.5 43.8 425.5 0.5"/><polygon class="cls-9" points="375.5 87.1 350.5 43.8 400.5 43.8 375.5 87.1"/></g></g></svg>
\ No newline at end of file
+<svg width="92px" height="92px" viewBox="0 0 100 100" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M14.3016 49.404L9.20178 58.2389H19.4013L24.5011 49.404H14.3016Z" fill="#5E97F6" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M4.10199 67.0716L9.20177 58.2388H19.4013L14.3015 67.0716H4.10199Z" fill="#5E97F6" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M29.6009 58.2388H19.4013L14.3015 67.0716H24.5011L29.6009 58.2388Z" fill="#5E97F6" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M39.8004 58.2388H29.6009L24.5011 67.0716H34.7007L39.8004 58.2388Z" fill="#5E97F6" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M34.7007 49.404L29.6009 58.2389H39.8004L44.9002 49.404H34.7007Z" fill="#5E97F6" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M39.8004 40.5712L34.7007 49.404H44.9002L50 40.5712H39.8004Z" fill="#5E97F6" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M44.9002 31.7383L39.8004 40.5712H50L55.0998 31.7383H44.9002Z" fill="#5E97F6" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M50 22.9055L44.9002 31.7383H55.0998L60.1995 22.9055H50Z" fill="#5E97F6" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M4.10199 67.0717L9.20177 75.9045H19.4013L14.3015 67.0717H4.10199Z" fill="#2A56C6" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M29.6009 75.9045H19.4013L14.3015 67.0717H24.5011L29.6009 75.9045Z" fill="#2A56C6" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M39.8004 75.9045H29.6009L24.5011 67.0717H34.7007L39.8004 75.9045Z" fill="#2A56C6" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M44.9002 67.0716L39.8004 58.2388L34.7007 67.0716L39.8004 75.9045L44.9002 67.0716Z" fill="#00796B" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M55.0998 49.404L50 40.5712L44.9002 49.404H55.0998Z" fill="#00796B" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M55.0998 31.7383L50 40.5712L55.0998 49.404L60.1996 40.5712L55.0998 31.7383Z" fill="#00796B" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M29.6009 58.2389L24.5011 49.404L19.4013 58.2389H29.6009Z" fill="#3367D6" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M55.0998 49.404H44.9002L39.8004 58.2389H50L55.0998 49.404Z" fill="#26A69A" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M65.2993 49.404H55.0998L50 58.2389H60.1996L65.2993 49.404Z" fill="#26A69A" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M75.4989 31.7383L70.3991 22.9055L65.2993 31.7383L70.3991 40.5712L75.4989 31.7383Z" fill="#9C27B0" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M80.5987 40.5712L75.4989 31.7383L70.3991 40.5712L75.4989 49.404L80.5987 40.5712Z" fill="#9C27B0" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M85.6985 49.404L80.5987 40.5712L75.4989 49.404L80.5987 58.2388L85.6985 49.404Z" fill="#9C27B0" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M90.7982 58.2388L85.6984 49.404L80.5987 58.2388L85.6984 67.0717L90.7982 58.2388Z" fill="#9C27B0" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M95.898 67.0716L90.7982 58.2388L85.6984 67.0716L90.7982 75.9045L95.898 67.0716Z" fill="#9C27B0" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M90.7982 22.9055L85.6984 31.7383L90.7982 40.5712L95.898 31.7383L90.7982 22.9055Z" fill="#9C27B0" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M80.5987 40.5712L85.6984 31.7383L90.7982 40.5712L85.6984 49.404L80.5987 40.5712Z" fill="#9C27B0" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M75.4989 49.404L70.3991 58.2388L75.4989 67.0717L80.5987 58.2388L75.4989 49.404Z" fill="#9C27B0" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M70.3991 75.9045L65.2993 67.0716L70.3991 58.2388L75.4989 67.0716L70.3991 75.9045Z" fill="#9C27B0" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M60.1995 75.9045L55.0998 67.0717H65.2993L70.3991 75.9045H60.1995Z" fill="#6A1B9A" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M50 58.2388H39.8004L44.9002 67.0716H55.0998L50 58.2388Z" fill="#00695C" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M60.1996 58.2388H50L55.0998 67.0716L60.1996 58.2388Z" fill="#00695C" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M60.1996 40.5712L65.2993 49.404H75.4989L70.3991 40.5712H60.1996Z" fill="#00695C" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M65.2993 31.7383H55.0998L60.1995 40.5712H70.3991L65.2993 31.7383Z" fill="#00695C" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M90.7982 75.9045L85.6985 67.0717H75.4989L80.5987 75.9045H90.7982Z" fill="#00695C" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M80.5987 58.2388L75.4989 67.0716H85.6985L80.5987 58.2388Z" fill="#00695C" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M70.3991 22.9055H60.1995L55.0998 31.7383H65.2993L70.3991 22.9055Z" fill="#EA80FC" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M70.3991 58.2388H60.1995L55.0998 67.0716H65.2993L70.3991 58.2388Z" fill="#EA80FC" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M75.4989 49.404H65.2993L60.1996 58.2389H70.3991L75.4989 49.404Z" fill="#EA80FC" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M90.7982 22.9055H80.5987L75.4989 31.7383H85.6985L90.7982 22.9055Z" fill="#EA80FC" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+<path d="M80.5987 40.5712L75.4989 31.7383H85.6985L80.5987 40.5712Z" fill="#EA80FC" stroke="#DCE0DF" stroke-width="0.203991" stroke-linejoin="round"/>
+</svg>
diff --git a/site/static/icon/jfrog.svg b/site/static/icon/jfrog.svg
index 5e0c6337f3bb8..3ffc4ad871707 100644
--- a/site/static/icon/jfrog.svg
+++ b/site/static/icon/jfrog.svg
@@ -1 +1,3 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="120" height="60"><path d="M57.117 37.792l-2.72.757c.237.686.426 1.917.426 3.573v8.14h3.053V41.65c.568-.686 1.183-1.018 1.846-1.018.33 0 .592.07.876.237l.828-2.816c-.473-.213-.686-.26-1.136-.26-.33 0-.734.07-.994.19-.568.284-1.278.923-1.727 1.538 0-.686-.166-1.23-.45-1.727zM46.6 33.77h-.33v16.47h3.17v-7.29h4v-2.72h-4v-3.786h4.993l.19-1.444a50.36 50.36 0 0 1-8.022-1.231zm-7.407 18.67l1.467 1.704c1.42-.568 3.195-1.846 3.668-3.88.166-.663.213-1.09.213-3.242V33.793h-3.195v13.583c0 1.775-.07 2.437-.308 3.053-.308.686-1.04 1.49-1.846 2.01zm28.8-8.353c0 2.887-.568 4.118-1.87 4.118-.592 0-1.254-.33-1.538-.994-.237-.615-.38-1.656-.38-3.076 0-1.207.118-2.06.308-2.72.237-.757.828-1.23 1.562-1.23.544 0 1.018.237 1.302.64.426.568.615 1.633.615 3.266zm1.87 4.733c.994-1.183 1.444-2.627 1.444-4.71 0-1.964-.402-3.313-1.325-4.45-.994-1.23-2.272-1.822-3.928-1.822-3.124 0-5.206 2.532-5.206 6.366s2.06 6.295 5.206 6.295c1.775.024 2.934-.64 3.8-1.68zm8.66-6.815c0 1.112-.663 1.727-1.846 1.727-1.065 0-1.775-.497-1.775-1.727 0-1.136.663-1.798 1.798-1.798s1.822.663 1.822 1.798zm5.372-2.603L82.65 37.4c-.7.663-1.562 1.04-2.4 1.04-.38 0-.592-.047-1.42-.26a7.04 7.04 0 0 0-2.082-.308c-2.958 0-4.875 1.61-4.875 4.118 0 1.798.805 2.934 2.485 3.384-.686.166-1.42.52-1.75.923-.237.284-.355.663-.355 1.112a2.2 2.2 0 0 0 .237.994c.166.26.38.473.663.592.544.213 1.42.355 2.77.38l1.278.024c.828.047 1.254.19 1.585.355.308.19.544.615.544 1.09s-.284.947-.734 1.23c-.402.284-1.065.402-1.917.402-1.396 0-2.177-.52-2.177-1.49 0-.426.047-.52.142-.78H71.86c-.118.237-.26.568-.26 1.23 0 .828.308 1.538.947 2.153 1.04 1.018 2.745 1.302 4.378 1.302 1.798 0 3.55-.426 4.567-1.562.64-.7.923-1.49.923-2.508 0-1.09-.308-1.917-.994-2.603-.805-.78-1.727-1.065-3.502-1.09l-1.633-.024c-.308 0-.497-.118-.497-.284 0-.33.426-.615 1.207-.994l.45.024c2.46 0 4.26-1.514 4.26-3.62 0-.805-.237-1.42-.686-1.988.38.047.497.07.78.07.805 0 1.444-.26 2.106-.9zm-38.1-19.95c-3.786.923-6.366 2.745-6.366 4.827 0 1.302.994 2.485 2.627 3.408-.497-.78-.757-1.633-.757-2.485.024-2.153 1.704-4.165 4.496-5.75zm39.945 8.164c0-1.373-.852-2.627-2.272-3.668.118.426.213.852.213 1.278 0 3.905-5.466 7.265-13.228 8.66a25.21 25.21 0 0 0 2.721.142c6.934-.024 12.566-2.887 12.566-6.413zm-4.472-2.13c0-1.444-1.23-2.77-3.337-3.857.497.592.757 1.23.757 1.893 0 3.48-7.383 6.295-16.517 6.295-9.11 0-16.517-2.816-16.517-6.295a2.48 2.48 0 0 1 .355-1.278c-1.467.97-2.295 2.082-2.295 3.266 0 3.763 8.4 6.815 18.766 6.815s18.79-3.1 18.79-6.84zm-8.188-.19c-3.834 2.46-15.618 3.408-20.682.237-3.976-2.485-2.603-6.437-13.985-15.098-1.49-1.136.284-2.343 1.396-1.562s.095.97 2.343 3.218c4.543 4.543 4.496.45 5.206 2.01 1.514 3.242 4.827 6.508 4.827 6.508 3.337 2.177 5.987 2.65 10.91-.686 3.124-2.106 1.846 3.36 9.49-.592 2.792-1.444 2.674-.473 5.514-4.425 1.183-1.633 3.43 1.254.876 1.656-1.018.166-2.745 1.278-3.48 3.03-1.065 2.627-.615 4.567-2.414 5.703zm-21.25-6.673c-.947-.426-1.94-2.035-2.32-2.674 1.065-1.04.64-2.77.024-3.715-.592-.947-1.325-.686-2.106-1.562-.805-.876.308-3.147 1.325-1.396 3.8 6.555 6.318 3.834 9.418 3.43 2.982-.38 5.632 1.254 6.437-3.36.142-.757.876-.923.947.308.07 1.254.544 4.283 2.177 4.662 1.633.402 2.958-.38 3.337-.805s.592-.38.757.7c.166 1.065.592 2.556 2.887.9 4.71-3.36 3.36-4.662 5.206-5.537 1.04-.497 2.698 1.112.308 2.32-3.408 1.727-3.763 3.857-5.916 5.206-3.62 2.272-2.508.095-8.33-.734-2.248-.308-2.958 2.177-4.71 1.467-4-1.656-6.815-1.325-9.442.78zm12.613-12.14c.142.994.308.97.663 1.04.355.095.805-.473.805-.994.024-.544-.237-.876-.757-.852-.544.024-.734.284-.7.805zm17.51 1.775c.426.402 1.562.142 1.822-.166.686-.757.7-1.207.355-1.727-.355-.497-1.09-.426-1.822.118s-.592 1.562-.355 1.775zm-.308 5.017c-.355.473-.38.828-.118 1.09.284.284.852.52 1.254.213.402-.33.402-.805.07-1.207-.355-.426-.828-.426-1.207-.095zM45.734 7.36c.544.166.805.686 1.254.095.237-.284.26-.686-.047-1.112-.19-.26-1.09-.45-1.467-.07s-.024.994.26 1.09zm-11.098-.33c.994.615 1.633 1.538 2.4.7.26-.284.568-.78.024-1.775-.402-.734-1.704-1.018-2.153-.734-.473.26-1.04 1.325-.26 1.798zm9.158 4.71c.308.33.852.308 1.183.118.308-.19.26-.686-.047-1.112-.19-.26-.757-.402-1.136 0s-.213.757 0 .994z" fill="#41bf47"/></svg>
\ No newline at end of file
+<svg width="92px" height="92px" viewBox="0 0 60 60" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M27.117 37.792L24.397 38.549C24.634 39.235 24.823 40.466 24.823 42.122V50.262H27.876V41.65C28.444 40.964 29.059 40.632 29.722 40.632C30.052 40.632 30.314 40.702 30.598 40.869L31.426 38.053C30.953 37.84 30.74 37.793 30.29 37.793C29.96 37.793 29.556 37.863 29.296 37.983C28.728 38.267 28.018 38.906 27.569 39.521C27.569 38.835 27.403 38.291 27.119 37.794L27.117 37.792ZM16.6 33.77H16.27V50.24H19.44V42.95H23.44V40.23H19.44V36.444H24.433L24.623 35C21.9202 34.8062 19.2375 34.3945 16.601 33.769L16.6 33.77ZM9.19301 52.44L10.66 54.144C12.08 53.576 13.855 52.298 14.328 50.264C14.494 49.601 14.541 49.174 14.541 47.022V33.793H11.346V47.376C11.346 49.151 11.276 49.813 11.038 50.429C10.73 51.115 9.99801 51.919 9.19201 52.439L9.19301 52.44ZM37.993 44.087C37.993 46.974 37.425 48.205 36.123 48.205C35.531 48.205 34.869 47.875 34.585 47.211C34.348 46.596 34.205 45.555 34.205 44.135C34.205 42.928 34.323 42.075 34.513 41.415C34.75 40.658 35.341 40.185 36.075 40.185C36.619 40.185 37.093 40.422 37.377 40.825C37.803 41.393 37.992 42.458 37.992 44.091L37.993 44.087ZM39.863 48.82C40.857 47.637 41.307 46.193 41.307 44.11C41.307 42.146 40.905 40.797 39.982 39.66C38.988 38.43 37.71 37.838 36.054 37.838C32.93 37.838 30.848 40.37 30.848 44.204C30.848 48.038 32.908 50.499 36.054 50.499C37.829 50.523 38.988 49.859 39.854 48.819L39.863 48.82ZM48.523 42.005C48.523 43.117 47.86 43.732 46.677 43.732C45.612 43.732 44.902 43.235 44.902 42.005C44.902 40.869 45.565 40.207 46.7 40.207C47.835 40.207 48.523 40.87 48.523 42.005ZM53.895 39.402L52.65 37.4C51.95 38.063 51.088 38.44 50.25 38.44C49.87 38.44 49.658 38.393 48.83 38.18C48.1554 37.9736 47.4535 37.8698 46.748 37.872C43.79 37.872 41.873 39.482 41.873 41.99C41.873 43.788 42.678 44.924 44.358 45.374C43.672 45.54 42.938 45.894 42.608 46.297C42.371 46.581 42.253 46.96 42.253 47.409C42.2529 47.7544 42.3341 48.0949 42.49 48.403C42.656 48.663 42.87 48.876 43.153 48.995C43.697 49.208 44.573 49.35 45.923 49.375L47.201 49.399C48.029 49.446 48.455 49.589 48.786 49.754C49.094 49.944 49.33 50.369 49.33 50.844C49.33 51.319 49.046 51.791 48.596 52.074C48.194 52.358 47.531 52.476 46.679 52.476C45.283 52.476 44.502 51.956 44.502 50.986C44.502 50.56 44.549 50.466 44.644 50.206H41.86C41.742 50.443 41.6 50.774 41.6 51.436C41.6 52.264 41.908 52.974 42.547 53.589C43.587 54.607 45.292 54.891 46.925 54.891C48.723 54.891 50.475 54.465 51.492 53.329C52.132 52.629 52.415 51.839 52.415 50.821C52.415 49.731 52.107 48.904 51.421 48.218C50.616 47.438 49.694 47.153 47.919 47.128L46.286 47.104C45.978 47.104 45.789 46.986 45.789 46.82C45.789 46.49 46.215 46.205 46.996 45.826L47.446 45.85C49.906 45.85 51.706 44.336 51.706 42.23C51.706 41.425 51.469 40.81 51.02 40.242C51.4 40.289 51.517 40.312 51.8 40.312C52.605 40.312 53.244 40.052 53.906 39.412L53.895 39.402ZM15.795 19.452C12.009 20.375 9.42901 22.197 9.42901 24.279C9.42901 25.581 10.423 26.764 12.056 27.687C11.559 26.907 11.299 26.054 11.299 25.202C11.323 23.049 13.003 21.037 15.795 19.452ZM55.74 27.616C55.74 26.243 54.888 24.989 53.468 23.948C53.586 24.374 53.681 24.8 53.681 25.226C53.681 29.131 48.215 32.491 40.453 33.886C41.3568 33.9824 42.2651 34.0298 43.174 34.028C50.108 34.004 55.74 31.142 55.74 27.616ZM51.268 25.486C51.268 24.042 50.038 22.716 47.931 21.629C48.428 22.221 48.688 22.859 48.688 23.522C48.688 27.002 41.305 29.817 32.171 29.817C23.061 29.817 15.654 27.001 15.654 23.522C15.6541 23.0717 15.7768 22.6299 16.009 22.244C14.542 23.214 13.714 24.326 13.714 25.51C13.714 29.273 22.114 32.325 32.48 32.325C42.846 32.325 51.27 29.225 51.27 25.485L51.268 25.486ZM43.08 25.296C39.246 27.756 27.462 28.704 22.398 25.533C18.422 23.048 19.795 19.096 8.413 10.435C6.923 9.29903 8.697 8.09203 9.809 8.87303C10.921 9.65403 9.904 9.84303 12.152 12.091C16.695 16.634 16.648 12.541 17.358 14.101C18.872 17.343 22.185 20.609 22.185 20.609C25.522 22.786 28.172 23.259 33.095 19.923C36.219 17.817 34.941 23.283 42.585 19.331C45.377 17.887 45.259 18.858 48.099 14.906C49.282 13.273 51.529 16.16 48.975 16.562C47.957 16.728 46.23 17.84 45.495 19.592C44.43 22.219 44.88 24.159 43.081 25.295L43.08 25.296ZM21.83 18.623C20.883 18.197 19.89 16.588 19.51 15.949C20.575 14.909 20.15 13.179 19.534 12.234C18.942 11.287 18.209 11.548 17.428 10.672C16.623 9.79603 17.736 7.52503 18.753 9.27603C22.553 15.831 25.071 13.11 28.171 12.706C31.153 12.326 33.803 13.96 34.608 9.34603C34.75 8.58903 35.484 8.42303 35.555 9.65403C35.625 10.908 36.099 13.937 37.732 14.316C39.365 14.718 40.69 13.936 41.069 13.511C41.448 13.086 41.661 13.131 41.826 14.211C41.992 15.276 42.418 16.767 44.713 15.111C49.423 11.751 48.073 10.449 49.919 9.57403C50.959 9.07703 52.617 10.686 50.227 11.894C46.819 13.621 46.464 15.751 44.311 17.1C40.691 19.372 41.803 17.195 35.981 16.366C33.733 16.058 33.023 18.543 31.271 17.833C27.271 16.177 24.456 16.508 21.829 18.613L21.83 18.623ZM34.443 6.48303C34.585 7.47703 34.751 7.45303 35.106 7.52303C35.461 7.61803 35.911 7.05003 35.911 6.52903C35.935 5.98503 35.674 5.65303 35.154 5.67703C34.61 5.70103 34.42 5.96103 34.454 6.48203L34.443 6.48303ZM51.953 8.25803C52.379 8.66003 53.515 8.40003 53.775 8.09203C54.461 7.33503 54.475 6.88503 54.13 6.36503C53.775 5.86803 53.04 5.93903 52.308 6.48303C51.576 7.02703 51.716 8.04503 51.953 8.25803ZM51.645 13.275C51.29 13.748 51.265 14.103 51.527 14.365C51.811 14.649 52.379 14.885 52.781 14.578C53.183 14.248 53.183 13.773 52.851 13.371C52.496 12.945 52.023 12.945 51.644 13.276L51.645 13.275ZM15.734 7.36003C16.278 7.52603 16.539 8.04603 16.988 7.45503C17.225 7.17103 17.248 6.76903 16.941 6.34303C16.751 6.08303 15.851 5.89303 15.474 6.27303C15.097 6.65303 15.45 7.26703 15.734 7.36303V7.36003ZM4.63601 7.03003C5.63001 7.64503 6.269 8.56803 7.036 7.73003C7.296 7.44603 7.60401 6.95003 7.06001 5.95503C6.65801 5.22103 5.35601 4.93703 4.90701 5.22103C4.43401 5.48103 3.867 6.54603 4.647 7.01903L4.63601 7.03003ZM13.794 11.74C14.102 12.07 14.646 12.048 14.977 11.858C15.285 11.668 15.237 11.172 14.93 10.746C14.74 10.486 14.173 10.344 13.794 10.746C13.415 11.148 13.581 11.503 13.794 11.74Z" fill="#41BF47"/>
+</svg>
diff --git a/site/static/icon/jupyter.svg b/site/static/icon/jupyter.svg
index 6b25a34fe5160..356361efc0004 100644
--- a/site/static/icon/jupyter.svg
+++ b/site/static/icon/jupyter.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 44 51"><g style="mix-blend-mode:normal"><g style="mix-blend-mode:normal"><use fill="#4E4E4E" transform="translate(.54 21.36)" xlink:href="#path0_fill" style="mix-blend-mode:normal"/><use fill="#4E4E4E" transform="translate(5.68 21.37)" xlink:href="#path1_fill" style="mix-blend-mode:normal"/><use fill="#4E4E4E" transform="translate(13.39 21.26)" xlink:href="#path2_fill" style="mix-blend-mode:normal"/><use fill="#4E4E4E" transform="translate(20.43 21.39)" xlink:href="#path3_fill" style="mix-blend-mode:normal"/><use fill="#4E4E4E" transform="translate(27.55 19.54)" xlink:href="#path4_fill" style="mix-blend-mode:normal"/><use fill="#4E4E4E" transform="translate(32.47 21.29)" xlink:href="#path5_fill" style="mix-blend-mode:normal"/><use fill="#4E4E4E" transform="translate(39.98 21.24)" xlink:href="#path6_fill" style="mix-blend-mode:normal"/></g><g style="mix-blend-mode:normal"><use fill="#767677" transform="translate(33.48 .69)" xlink:href="#path7_fill" style="mix-blend-mode:normal"/><use fill="#F37726" transform="translate(3.21 31.27)" xlink:href="#path8_fill" style="mix-blend-mode:normal"/><use fill="#F37726" transform="translate(3.21 4.88)" xlink:href="#path9_fill" style="mix-blend-mode:normal"/><use fill="#9E9E9E" transform="translate(3.28 43.09)" xlink:href="#path10_fill" style="mix-blend-mode:normal"/><use fill="#616262" transform="translate(1.87 5.43)" xlink:href="#path11_fill" style="mix-blend-mode:normal"/></g></g><defs><path id="path0_fill" d="M1.745 5.475c0 1.558-.125 2.066-.445 2.44a1.94 1.94 0 01-1.3.498l.125.89a3.045 3.045 0 002.03-.738 3.561 3.561 0 00.783-2.671V0H1.745V5.475z"/><path id="path1_fill" d="M5.502 4.763c0 .668 0 1.264.053 1.78H4.496l-.071-1.059A2.466 2.466 0 012.26 6.695C1.23 6.695 0 6.135 0 3.846V.045h1.193v3.56c0 1.238.383 2.066 1.46 2.066A1.665 1.665 0 004.336 3.99V0h1.193v4.727l-.027.036z"/><path id="path2_fill" d="M.053 2.273c0-.828 0-1.505-.053-2.12h1.068l.054 1.114A2.582 2.582 0 013.454.002c1.585 0 2.778 1.327 2.778 3.303 0 2.333-1.433 3.49-2.982 3.49a2.306 2.306 0 01-2.021-1.023v3.56H.053V2.274zM1.23 4.009c.003.161.02.322.053.48a1.834 1.834 0 001.78 1.38c1.256 0 1.995-1.023 1.995-2.51 0-1.3-.695-2.413-1.95-2.413a2.048 2.048 0 00-1.878 1.95v1.113z"/><path id="path3_fill" d="M1.318.018L2.75 3.855c.151.427.312.944.418 1.327.125-.392.259-.89.419-1.354l1.3-3.81h1.255l-1.78 4.63c-.89 2.225-1.434 3.374-2.253 4.068a3.24 3.24 0 01-1.46.766l-.294-.997a3.16 3.16 0 001.042-.58 3.561 3.561 0 001.006-1.317.89.89 0 00.098-.285 1.024 1.024 0 00-.08-.311L0 0h1.3l.018.018z"/><path id="path4_fill" d="M2.19 0v1.87H3.9v.89H2.19v3.508c0 .801.232 1.264.89 1.264.234.004.468-.023.695-.08l.053.89c-.34.118-.7.172-1.06.16a1.656 1.656 0 01-1.29-.498 2.395 2.395 0 01-.463-1.692V2.751H0v-.89h1.033V.276L2.19 0z"/><path id="path5_fill" d="M1.177 3.579A2.092 2.092 0 003.43 5.831a4.345 4.345 0 001.78-.338l.205.89a5.342 5.342 0 01-2.181.401A3.027 3.027 0 01.01 3.508C.01 1.549 1.177 0 3.082 0 5.22 0 5.753 1.87 5.753 3.063c.012.183.012.368 0 .552H1.15l.027-.036zm3.49-.89A1.683 1.683 0 003.011.766a1.968 1.968 0 00-1.825 1.923h3.481z"/><path id="path6_fill" d="M.053 2.192c0-.765 0-1.424-.053-2.03h1.068v1.274h.054A1.968 1.968 0 012.902.01a1.3 1.3 0 01.339 0v1.113a1.78 1.78 0 00-.41 0 1.665 1.665 0 00-1.593 1.513 3.293 3.293 0 00-.054.552v3.464H.01V2.2l.044-.009z"/><path id="path7_fill" d="M6.03 2.836A3.018 3.018 0 112.889.005a2.982 2.982 0 013.143 2.83z"/><path id="path8_fill" d="M18.696 7.122C10.684 7.122 3.641 4.247 0 0a19.934 19.934 0 0037.392 0C33.76 4.247 26.744 7.122 18.696 7.122z"/><path id="path9_fill" d="M18.696 5.897c8.013 0 15.055 2.876 18.696 7.123A19.934 19.934 0 000 13.02c3.641-4.256 10.648-7.123 18.696-7.123z"/><path id="path10_fill" d="M7.596 3.567A3.802 3.802 0 113.634.005a3.766 3.766 0 013.962 3.562z"/><path id="path11_fill" d="M2.25 4.38A2.19 2.19 0 114.379 2.1a2.217 2.217 0 01-2.127 2.28z"/></defs></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="2.0" viewBox="0 0 44 51" width="44px" height="51px"><g style="mix-blend-mode:normal"><g style="mix-blend-mode:normal"><use fill="#4E4E4E" transform="translate(.54 21.36)" xlink:href="#path0_fill" style="mix-blend-mode:normal"/><use fill="#4E4E4E" transform="translate(5.68 21.37)" xlink:href="#path1_fill" style="mix-blend-mode:normal"/><use fill="#4E4E4E" transform="translate(13.39 21.26)" xlink:href="#path2_fill" style="mix-blend-mode:normal"/><use fill="#4E4E4E" transform="translate(20.43 21.39)" xlink:href="#path3_fill" style="mix-blend-mode:normal"/><use fill="#4E4E4E" transform="translate(27.55 19.54)" xlink:href="#path4_fill" style="mix-blend-mode:normal"/><use fill="#4E4E4E" transform="translate(32.47 21.29)" xlink:href="#path5_fill" style="mix-blend-mode:normal"/><use fill="#4E4E4E" transform="translate(39.98 21.24)" xlink:href="#path6_fill" style="mix-blend-mode:normal"/></g><g style="mix-blend-mode:normal"><use fill="#767677" transform="translate(33.48 .69)" xlink:href="#path7_fill" style="mix-blend-mode:normal"/><use fill="#F37726" transform="translate(3.21 31.27)" xlink:href="#path8_fill" style="mix-blend-mode:normal"/><use fill="#F37726" transform="translate(3.21 4.88)" xlink:href="#path9_fill" style="mix-blend-mode:normal"/><use fill="#9E9E9E" transform="translate(3.28 43.09)" xlink:href="#path10_fill" style="mix-blend-mode:normal"/><use fill="#616262" transform="translate(1.87 5.43)" xlink:href="#path11_fill" style="mix-blend-mode:normal"/></g></g><defs><path id="path0_fill" d="M1.745 5.475c0 1.558-.125 2.066-.445 2.44a1.94 1.94 0 01-1.3.498l.125.89a3.045 3.045 0 002.03-.738 3.561 3.561 0 00.783-2.671V0H1.745V5.475z"/><path id="path1_fill" d="M5.502 4.763c0 .668 0 1.264.053 1.78H4.496l-.071-1.059A2.466 2.466 0 012.26 6.695C1.23 6.695 0 6.135 0 3.846V.045h1.193v3.56c0 1.238.383 2.066 1.46 2.066A1.665 1.665 0 004.336 3.99V0h1.193v4.727l-.027.036z"/><path id="path2_fill" d="M.053 2.273c0-.828 0-1.505-.053-2.12h1.068l.054 1.114A2.582 2.582 0 013.454.002c1.585 0 2.778 1.327 2.778 3.303 0 2.333-1.433 3.49-2.982 3.49a2.306 2.306 0 01-2.021-1.023v3.56H.053V2.274zM1.23 4.009c.003.161.02.322.053.48a1.834 1.834 0 001.78 1.38c1.256 0 1.995-1.023 1.995-2.51 0-1.3-.695-2.413-1.95-2.413a2.048 2.048 0 00-1.878 1.95v1.113z"/><path id="path3_fill" d="M1.318.018L2.75 3.855c.151.427.312.944.418 1.327.125-.392.259-.89.419-1.354l1.3-3.81h1.255l-1.78 4.63c-.89 2.225-1.434 3.374-2.253 4.068a3.24 3.24 0 01-1.46.766l-.294-.997a3.16 3.16 0 001.042-.58 3.561 3.561 0 001.006-1.317.89.89 0 00.098-.285 1.024 1.024 0 00-.08-.311L0 0h1.3l.018.018z"/><path id="path4_fill" d="M2.19 0v1.87H3.9v.89H2.19v3.508c0 .801.232 1.264.89 1.264.234.004.468-.023.695-.08l.053.89c-.34.118-.7.172-1.06.16a1.656 1.656 0 01-1.29-.498 2.395 2.395 0 01-.463-1.692V2.751H0v-.89h1.033V.276L2.19 0z"/><path id="path5_fill" d="M1.177 3.579A2.092 2.092 0 003.43 5.831a4.345 4.345 0 001.78-.338l.205.89a5.342 5.342 0 01-2.181.401A3.027 3.027 0 01.01 3.508C.01 1.549 1.177 0 3.082 0 5.22 0 5.753 1.87 5.753 3.063c.012.183.012.368 0 .552H1.15l.027-.036zm3.49-.89A1.683 1.683 0 003.011.766a1.968 1.968 0 00-1.825 1.923h3.481z"/><path id="path6_fill" d="M.053 2.192c0-.765 0-1.424-.053-2.03h1.068v1.274h.054A1.968 1.968 0 012.902.01a1.3 1.3 0 01.339 0v1.113a1.78 1.78 0 00-.41 0 1.665 1.665 0 00-1.593 1.513 3.293 3.293 0 00-.054.552v3.464H.01V2.2l.044-.009z"/><path id="path7_fill" d="M6.03 2.836A3.018 3.018 0 112.889.005a2.982 2.982 0 013.143 2.83z"/><path id="path8_fill" d="M18.696 7.122C10.684 7.122 3.641 4.247 0 0a19.934 19.934 0 0037.392 0C33.76 4.247 26.744 7.122 18.696 7.122z"/><path id="path9_fill" d="M18.696 5.897c8.013 0 15.055 2.876 18.696 7.123A19.934 19.934 0 000 13.02c3.641-4.256 10.648-7.123 18.696-7.123z"/><path id="path10_fill" d="M7.596 3.567A3.802 3.802 0 113.634.005a3.766 3.766 0 013.962 3.562z"/><path id="path11_fill" d="M2.25 4.38A2.19 2.19 0 114.379 2.1a2.217 2.217 0 01-2.127 2.28z"/></defs></svg>
diff --git a/site/static/icon/kasmvnc.svg b/site/static/icon/kasmvnc.svg
new file mode 100644
index 0000000000000..9ba3dc358f33a
--- /dev/null
+++ b/site/static/icon/kasmvnc.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="Layer_1" x="0px" y="0px" viewBox="0 328.5 120 135" width="120px" height="135px" enable-background="new 0 328.5 612 135" xml:space="preserve" style="&#10;">
+<polygon fill="#185F85" points="29,434.2 29,439.3 29,446.3 47.4,457.1 51.9,459.7 58.3,463.2 62.7,455.5 64.3,447.3 58.3,441.9   29,425 "/>
+<path fill="#0D84BE" d="M116.5,429.8V396c0-11.1,0-22.3,0-33.4l-12.1-0.3l-2.9,3.8l-3.8,7V419L58,442.2v8.9v12.4  C77.4,452,97.1,440.9,116.5,429.8z"/>
+<polygon fill="#FFFFFF" points="18.5,385.5 18.5,351.7 0,362.6 0,429.8 18.5,440.3 18.5,406.8 58.3,429.8 58.3,429.8 58.3,408.4   36.9,396 58.3,383.9 58.3,362.6 "/>
+<path fill="#1A9BD7" d="M58.3,328.8c19.1,11.1,38.8,22.6,58.3,33.8l-10.8,6l-8,4.5l-39.5-22.9L29,366.7c0-7,0-14.3,0-21.3  L58.3,328.8z"/>
+
+</svg>
diff --git a/site/static/icon/kotlin.svg b/site/static/icon/kotlin.svg
new file mode 100644
index 0000000000000..f7908d89b1965
--- /dev/null
+++ b/site/static/icon/kotlin.svg
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 24.1.2, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="500px" height="500px"
+	 viewBox="0 0 500 500" style="enable-background:new 0 0 500 500;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill:url(#SVGID_1_);}
+</style>
+<g id="Logotypes">
+	<g>
+
+			<linearGradient id="SVGID_1_" gradientUnits="userSpaceOnUse" x1="500.0035" y1="579.1058" x2="-9.653803e-02" y2="1079.2058" gradientTransform="matrix(0.9998 0 0 0.9998 9.651873e-02 -578.99)">
+			<stop  offset="3.435144e-03" style="stop-color:#E44857"/>
+			<stop  offset="0.4689" style="stop-color:#C711E1"/>
+			<stop  offset="1" style="stop-color:#7F52FF"/>
+		</linearGradient>
+		<polygon class="st0" points="500,500 0,500 0,0 500,0 250,250 		"/>
+	</g>
+</g>
+</svg>
diff --git a/site/static/icon/microsoft.svg b/site/static/icon/microsoft.svg
new file mode 100644
index 0000000000000..5334aa7ca6864
--- /dev/null
+++ b/site/static/icon/microsoft.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 23 23"><path fill="#f3f3f3" d="M0 0h23v23H0z"/><path fill="#f35325" d="M1 1h10v10H1z"/><path fill="#81bc06" d="M12 1h10v10H12z"/><path fill="#05a6f0" d="M1 12h10v10H1z"/><path fill="#ffba08" d="M12 12h10v10H12z"/></svg>
\ No newline at end of file
diff --git a/site/static/icon/nomad.svg b/site/static/icon/nomad.svg
new file mode 100644
index 0000000000000..b4dc91c7b7c1d
--- /dev/null
+++ b/site/static/icon/nomad.svg
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="utf-8"?><!-- Uploaded to: SVG Repo, www.svgrepo.com, Generator: SVG Repo Mixer Tools -->
+<svg width="800px" height="800px" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="none"><path fill="#06D092" d="M8 0L1 4v8l7 4 7-4V4L8 0zm3.119 8.797L9.254 9.863 7.001 8.65v2.549l-2.118 1.33v-5.33l1.68-1.018 2.332 1.216V4.794l2.23-1.322-.006 5.325z"/></svg>
diff --git a/site/static/icon/okta.svg b/site/static/icon/okta.svg
new file mode 100644
index 0000000000000..5595186b2abec
--- /dev/null
+++ b/site/static/icon/okta.svg
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 19.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 viewBox="0 0 400 134.7" style="enable-background:new 0 0 400 134.7;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill:#007DC1;}
+</style>
+<g>
+	<g>
+		<g>
+			<path class="st0" d="M50.3,33.8C22.5,33.8,0,56.3,0,84.1s22.5,50.3,50.3,50.3s50.3-22.5,50.3-50.3S78.1,33.8,50.3,33.8z
+				 M50.3,109.3c-13.9,0-25.2-11.3-25.2-25.2s11.3-25.2,25.2-25.2s25.2,11.3,25.2,25.2S64.2,109.3,50.3,109.3z"/>
+		</g>
+		<path class="st0" d="M138.7,101c0-4,4.8-5.9,7.6-3.1c12.6,12.8,33.4,34.8,33.5,34.9c0.3,0.3,0.6,0.8,1.8,1.2
+			c0.5,0.2,1.3,0.2,2.2,0.2l22.7,0c4.1,0,5.3-4.7,3.4-7.1l-37.6-38.5l-2-2c-4.3-5.1-3.8-7.1,1.1-12.3L201.2,41c1.9-2.4,0.7-7-3.5-7
+			h-20.6c-0.8,0-1.4,0-2,0.2c-1.2,0.4-1.7,0.8-2,1.2c-0.1,0.1-16.6,17.9-26.8,28.8c-2.8,3-7.8,1-7.8-3.1l0-57.1c0-2.9-2.4-4-4.3-4
+			h-16.8c-2.9,0-4.3,1.9-4.3,3.6v126.6c0,2.9,2.4,3.7,4.4,3.7h16.8c2.6,0,4.3-1.9,4.3-3.8v-1.3V101z"/>
+		<path class="st0" d="M275.9,129.6l-1.8-16.8c-0.2-2.3-2.4-3.9-4.7-3.5c-1.3,0.2-2.6,0.3-3.9,0.3c-13.4,0-24.3-10.5-25.1-23.8
+			c0-0.4,0-0.9,0-1.4V63.8c0-2.7,2-4.9,4.7-4.9l22.5,0c1.6,0,4-1.4,4-4.3V38.7c0-3.1-2-4.7-3.8-4.7h-22.7c-2.6,0-4.7-1.9-4.8-4.5
+			l0-25.5c0-1.6-1.2-4-4.3-4h-16.7c-2.1,0-4.1,1.3-4.1,3.9c0,0,0,81.5,0,81.9c0.7,27.2,23,48.9,50.3,48.9c2.3,0,4.5-0.2,6.7-0.5
+			C274.6,133.9,276.2,131.9,275.9,129.6z"/>
+	</g>
+	<g>
+		<path class="st0" d="M397.1,108.5c-14.2,0-16.4-5.1-16.4-24.2c0-0.1,0-0.1,0-0.2l0-45.9c0-1.6-1.2-4.3-4.4-4.3h-16.8
+			c-2.1,0-4.4,1.7-4.4,4.3l0,2.1c-7.3-4.2-15.8-6.6-24.8-6.6c-27.8,0-50.3,22.5-50.3,50.3c0,27.8,22.5,50.3,50.3,50.3
+			c12.5,0,23.9-4.6,32.7-12.1c4.7,7.2,12.3,12,24.2,12.1c2,0,12.8,0.4,12.8-4.7v-17.9C400,110.2,398.8,108.5,397.1,108.5z
+			 M330.4,109.3c-13.9,0-25.2-11.3-25.2-25.2c0-13.9,11.3-25.2,25.2-25.2c13.9,0,25.2,11.3,25.2,25.2
+			C355.5,98,344.2,109.3,330.4,109.3z"/>
+	</g>
+</g>
+</svg>
diff --git a/site/static/icon/personalize.svg b/site/static/icon/personalize.svg
new file mode 100644
index 0000000000000..e9fbf7228da8d
--- /dev/null
+++ b/site/static/icon/personalize.svg
@@ -0,0 +1 @@
+<svg xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 47.5 47.5" width="47.5px" height="47.5px" style="enable-background:new 0 0 47.5 47.5;" id="svg2" xml:space="preserve"><defs id="defs6"><clipPath id="clipPath18"><path d="M 0,38 38,38 38,0 0,0 0,38 z" id="path20"/></clipPath></defs><g transform="matrix(1.25,0,0,-1.25,0,47.5)" id="g12"><g id="g14"><g clip-path="url(#clipPath18)" id="g16"><g transform="translate(21.8486,9.4102)" id="g22"><path d="m 0,0 c -0.395,-1.346 -2.46,-1.924 -4.613,-1.291 -2.153,0.632 -3.578,2.234 -3.183,3.581 0.395,1.346 2.461,1.924 4.613,1.29 C -1.029,2.949 0.396,1.347 0,0 m -2.849,24.447 c -9.941,0 -18,-6.908 -18,-15.428 0,-1.067 0.127,-2.108 0.367,-3.113 1.779,-3.06 3.01,-1.128 8.633,1.684 5.727,2.864 0,-4 -2,-8 -0.615,-1.231 -0.281,-2.272 0.56,-3.124 2.946,-1.804 6.544,-2.876 10.44,-2.876 9.942,0 18,6.907 18,15.429 0,8.52 -8.058,15.428 -18,15.428" id="path24" style="fill:#d99e82;fill-opacity:1;fill-rule:nonzero;stroke:none"/></g><g transform="translate(14,26)" id="g26"><path d="m 0,0 c 0,-1.657 -1.343,-3 -3,-3 -1.657,0 -3,1.343 -3,3 0,1.657 1.343,3 3,3 1.657,0 3,-1.343 3,-3" id="path28" style="fill:#5c913b;fill-opacity:1;fill-rule:nonzero;stroke:none"/></g><g transform="translate(24,28)" id="g30"><path d="m 0,0 c 0,-1.657 -1.344,-3 -3,-3 -1.657,0 -3,1.343 -3,3 0,1.657 1.343,3 3,3 1.656,0 3,-1.343 3,-3" id="path32" style="fill:#226699;fill-opacity:1;fill-rule:nonzero;stroke:none"/></g><g transform="translate(33,22)" id="g34"><path d="m 0,0 c 0,-1.657 -1.344,-3 -3,-3 -1.656,0 -3,1.343 -3,3 0,1.657 1.344,3 3,3 1.656,0 3,-1.343 3,-3" id="path36" style="fill:#dd2e44;fill-opacity:1;fill-rule:nonzero;stroke:none"/></g><g transform="translate(32,13)" id="g38"><path d="m 0,0 c 0,-1.656 -1.344,-3 -3,-3 -1.656,0 -3,1.344 -3,3 0,1.656 1.344,3 3,3 1.656,0 3,-1.344 3,-3" id="path40" style="fill:#ffcc4d;fill-opacity:1;fill-rule:nonzero;stroke:none"/></g></g></g></g></svg>
diff --git a/site/static/icon/php.svg b/site/static/icon/php.svg
new file mode 100644
index 0000000000000..1b05aa9d4f893
--- /dev/null
+++ b/site/static/icon/php.svg
@@ -0,0 +1,6 @@
+<svg width="128" height="128" viewBox="0 0 128 128" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="128" height="128" rx="64" fill="#7577AB"/>
+<path d="M23.579 50.123H37.783C41.952 50.158 44.973 51.36 46.846 53.727C48.719 56.094 49.337 59.327 48.701 63.426C48.454 65.299 47.906 67.136 47.058 68.938C46.245 70.74 45.115 72.365 43.666 73.814C41.899 75.651 40.009 76.817 37.995 77.312C35.981 77.807 33.896 78.054 31.741 78.054H25.381L23.367 88.124H16L23.579 50.123ZM29.78 56.165L26.6 72.065C26.812 72.1 27.024 72.118 27.236 72.118C27.483 72.118 27.731 72.118 27.978 72.118C31.37 72.153 34.197 71.818 36.458 71.111C38.719 70.369 40.239 67.79 41.016 63.373C41.652 59.663 41.016 57.525 39.108 56.96C37.235 56.395 34.886 56.13 32.059 56.165C31.635 56.2 31.229 56.218 30.84 56.218C30.487 56.218 30.116 56.218 29.727 56.218L29.78 56.165Z" fill="black"/>
+<path d="M57.093 40H64.407L62.34 50.123H68.912C72.516 50.194 75.201 50.936 76.968 52.349C78.77 53.762 79.3 56.448 78.558 60.405L75.007 78.054H67.587L70.979 61.2C71.332 59.433 71.226 58.179 70.661 57.437C70.096 56.695 68.877 56.324 67.004 56.324L61.121 56.271L56.775 78.054H49.461L57.093 40Z" fill="black"/>
+<path d="M86.412 50.123H100.616C104.785 50.158 107.806 51.36 109.679 53.727C111.552 56.094 112.17 59.327 111.534 63.426C111.287 65.299 110.739 67.136 109.891 68.938C109.078 70.74 107.948 72.365 106.499 73.814C104.732 75.651 102.842 76.817 100.828 77.312C98.814 77.807 96.729 78.054 94.574 78.054H88.214L86.2 88.124H78.833L86.412 50.123ZM92.613 56.165L89.433 72.065C89.645 72.1 89.857 72.118 90.069 72.118C90.316 72.118 90.564 72.118 90.811 72.118C94.203 72.153 97.03 71.818 99.291 71.111C101.552 70.369 103.072 67.79 103.849 63.373C104.485 59.663 103.849 57.525 101.941 56.96C100.068 56.395 97.719 56.13 94.892 56.165C94.468 56.2 94.062 56.218 93.673 56.218C93.32 56.218 92.949 56.218 92.56 56.218L92.613 56.165Z" fill="black"/>
+</svg>
diff --git a/site/static/icon/phpstorm.svg b/site/static/icon/phpstorm.svg
index 4c83b0924092e..4230fec6faf2a 100644
--- a/site/static/icon/phpstorm.svg
+++ b/site/static/icon/phpstorm.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 70 70" xml:space="preserve" style="enable-background:new 0 0 70 70"><g><g><linearGradient id="SVGID_1_" x1=".558" x2="29.947" y1="46.846" y2="8.026" gradientUnits="userSpaceOnUse"><stop offset=".016" style="stop-color:#765af8"/><stop offset=".382" style="stop-color:#b345f1"/><stop offset=".758" style="stop-color:#fa3293"/><stop offset=".941" style="stop-color:#ff318c"/></linearGradient><polygon style="fill:url(#SVGID_1_)" points="39.6 15.2 36.3 5.2 11.9 0 0 13.5 37.2 32.5"/><linearGradient id="SVGID_2_" x1="2.73" x2="32.072" y1="48.379" y2="9.621" gradientUnits="userSpaceOnUse"><stop offset=".016" style="stop-color:#765af8"/><stop offset=".382" style="stop-color:#b345f1"/><stop offset=".758" style="stop-color:#fa3293"/><stop offset=".941" style="stop-color:#ff318c"/></linearGradient><polygon style="fill:url(#SVGID_2_)" points="28 41.4 27.3 20.6 0 13.5 6.7 53.6 28 53.4"/><linearGradient id="SVGID_3_" x1="50.857" x2="34.274" y1="46.405" y2="7.048" gradientUnits="userSpaceOnUse"><stop offset=".183" style="stop-color:#765af8"/><stop offset=".238" style="stop-color:#8655f6"/><stop offset=".345" style="stop-color:#9f4cf3"/><stop offset=".443" style="stop-color:#ae47f2"/><stop offset=".522" style="stop-color:#b345f1"/></linearGradient><polygon style="fill:url(#SVGID_3_)" points="22.1 41 23.4 24.5 43.2 4.2 60.9 7.4 70 30.1 60.5 39.5 45 37 35.4 47.1"/><linearGradient id="SVGID_4_" x1="63.266" x2="24.698" y1="57.339" y2="27.516" gradientUnits="userSpaceOnUse"><stop offset=".016" style="stop-color:#765af8"/><stop offset=".382" style="stop-color:#b345f1"/></linearGradient><polygon style="fill:url(#SVGID_4_)" points="43.2 4.2 14.8 29.4 20.3 61.8 43.9 70 70 54.4"/></g><g><rect style="fill:#000" width="43.2" height="43.2" x="13.4" y="13.4"/><rect style="fill:#fff" width="16.2" height="2.7" x="17.5" y="48.5"/><path style="fill:#fff" d="M17.3,19h7.3c4.3,0,6.9,2.5,6.9,6.2v0.1c0,4.2-3.2,6.3-7.3,6.3h-3l0,5.4h-3.9L17.3,19z M24.4,28 c2,0,3.1-1.2,3.1-2.7v-0.1c0-1.8-1.2-2.7-3.2-2.7h-3V28H24.4z"/><path style="fill:#fff" d="M32.5,34.4l2.3-2.8c1.6,1.3,3.3,2.2,5.4,2.2c1.6,0,2.6-0.6,2.6-1.7V32c0-1-0.6-1.5-3.6-2.3 c-3.6-0.9-6-1.9-6-5.5v-0.1c0-3.3,2.6-5.4,6.3-5.4c2.6,0,4.9,0.8,6.7,2.3l-2.1,3c-1.6-1.1-3.2-1.8-4.7-1.8c-1.5,0-2.3,0.7-2.3,1.6 v0.1c0,1.2,0.8,1.6,3.9,2.4c3.6,1,5.7,2.3,5.7,5.4v0.1c0,3.6-2.7,5.6-6.6,5.6C37.4,37.3,34.7,36.3,32.5,34.4"/></g></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 70 70" width="70px" height="70px" xml:space="preserve" style="enable-background:new 0 0 70 70"><g><g><linearGradient id="SVGID_1_" x1=".558" x2="29.947" y1="46.846" y2="8.026" gradientUnits="userSpaceOnUse"><stop offset=".016" style="stop-color:#765af8"/><stop offset=".382" style="stop-color:#b345f1"/><stop offset=".758" style="stop-color:#fa3293"/><stop offset=".941" style="stop-color:#ff318c"/></linearGradient><polygon style="fill:url(#SVGID_1_)" points="39.6 15.2 36.3 5.2 11.9 0 0 13.5 37.2 32.5"/><linearGradient id="SVGID_2_" x1="2.73" x2="32.072" y1="48.379" y2="9.621" gradientUnits="userSpaceOnUse"><stop offset=".016" style="stop-color:#765af8"/><stop offset=".382" style="stop-color:#b345f1"/><stop offset=".758" style="stop-color:#fa3293"/><stop offset=".941" style="stop-color:#ff318c"/></linearGradient><polygon style="fill:url(#SVGID_2_)" points="28 41.4 27.3 20.6 0 13.5 6.7 53.6 28 53.4"/><linearGradient id="SVGID_3_" x1="50.857" x2="34.274" y1="46.405" y2="7.048" gradientUnits="userSpaceOnUse"><stop offset=".183" style="stop-color:#765af8"/><stop offset=".238" style="stop-color:#8655f6"/><stop offset=".345" style="stop-color:#9f4cf3"/><stop offset=".443" style="stop-color:#ae47f2"/><stop offset=".522" style="stop-color:#b345f1"/></linearGradient><polygon style="fill:url(#SVGID_3_)" points="22.1 41 23.4 24.5 43.2 4.2 60.9 7.4 70 30.1 60.5 39.5 45 37 35.4 47.1"/><linearGradient id="SVGID_4_" x1="63.266" x2="24.698" y1="57.339" y2="27.516" gradientUnits="userSpaceOnUse"><stop offset=".016" style="stop-color:#765af8"/><stop offset=".382" style="stop-color:#b345f1"/></linearGradient><polygon style="fill:url(#SVGID_4_)" points="43.2 4.2 14.8 29.4 20.3 61.8 43.9 70 70 54.4"/></g><g><rect style="fill:#000" width="43.2" height="43.2" x="13.4" y="13.4"/><rect style="fill:#fff" width="16.2" height="2.7" x="17.5" y="48.5"/><path style="fill:#fff" d="M17.3,19h7.3c4.3,0,6.9,2.5,6.9,6.2v0.1c0,4.2-3.2,6.3-7.3,6.3h-3l0,5.4h-3.9L17.3,19z M24.4,28 c2,0,3.1-1.2,3.1-2.7v-0.1c0-1.8-1.2-2.7-3.2-2.7h-3V28H24.4z"/><path style="fill:#fff" d="M32.5,34.4l2.3-2.8c1.6,1.3,3.3,2.2,5.4,2.2c1.6,0,2.6-0.6,2.6-1.7V32c0-1-0.6-1.5-3.6-2.3 c-3.6-0.9-6-1.9-6-5.5v-0.1c0-3.3,2.6-5.4,6.3-5.4c2.6,0,4.9,0.8,6.7,2.3l-2.1,3c-1.6-1.1-3.2-1.8-4.7-1.8c-1.5,0-2.3,0.7-2.3,1.6 v0.1c0,1.2,0.8,1.6,3.9,2.4c3.6,1,5.7,2.3,5.7,5.4v0.1c0,3.6-2.7,5.6-6.6,5.6C37.4,37.3,34.7,36.3,32.5,34.4"/></g></g></svg>
diff --git a/site/static/icon/pycharm.svg b/site/static/icon/pycharm.svg
index 88a3e3a3c2178..39fd5609938ce 100644
--- a/site/static/icon/pycharm.svg
+++ b/site/static/icon/pycharm.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 70 70" xml:space="preserve" style="enable-background:new 0 0 70 70"><g><g><linearGradient id="SVGID_1_" x1="24.998" x2="66.656" y1="27.046" y2="27.046" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#21d789"/><stop offset="1" style="stop-color:#07c3f2"/></linearGradient><polygon style="fill:url(#SVGID_1_)" points="49.1 11 69.5 28.1 62.2 43 49.8 39.6 39.2 39.6"/><linearGradient id="SVGID_2_" x1="-24.559" x2="61.22" y1="59.081" y2="-4.241" gradientUnits="userSpaceOnUse"><stop offset=".011" style="stop-color:#fcf84a"/><stop offset=".112" style="stop-color:#a7eb62"/><stop offset=".206" style="stop-color:#5fe077"/><stop offset=".273" style="stop-color:#32da84"/><stop offset=".306" style="stop-color:#21d789"/><stop offset=".577" style="stop-color:#21d789"/><stop offset=".597" style="stop-color:#21d789"/><stop offset=".686" style="stop-color:#20d68c"/><stop offset=".763" style="stop-color:#1ed497"/><stop offset=".835" style="stop-color:#19d1a9"/><stop offset=".904" style="stop-color:#13ccc2"/><stop offset=".971" style="stop-color:#0bc6e1"/><stop offset="1" style="stop-color:#07c3f2"/></linearGradient><polygon style="fill:url(#SVGID_2_)" points="28.5 22.1 24.5 43 24.1 50.2 14.2 54.5 0 56 4.3 10.7 29.9 0 45.7 10.4"/><linearGradient id="SVGID_3_" x1="9.33" x2="23.637" y1="77.654" y2="32.76" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#21d789"/><stop offset=".164" style="stop-color:#24d788"/><stop offset=".305" style="stop-color:#2fd886"/><stop offset=".437" style="stop-color:#41da82"/><stop offset=".564" style="stop-color:#5adc7d"/><stop offset=".688" style="stop-color:#7ae077"/><stop offset=".809" style="stop-color:#a1e36e"/><stop offset=".925" style="stop-color:#cfe865"/><stop offset="1" style="stop-color:#f1eb5e"/></linearGradient><polygon style="fill:url(#SVGID_3_)" points="28.5 22.1 30.4 62.5 24 70 0 56 19.7 26.6"/><linearGradient id="SVGID_4_" x1="28.275" x2="59.409" y1="38.623" y2="-3.236" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#21d789"/><stop offset=".061" style="stop-color:#24d788"/><stop offset=".113" style="stop-color:#2fd886"/><stop offset=".162" style="stop-color:#41da82"/><stop offset=".209" style="stop-color:#5add7d"/><stop offset=".255" style="stop-color:#79e077"/><stop offset=".258" style="stop-color:#7ce076"/><stop offset=".499" style="stop-color:#8ce173"/><stop offset=".925" style="stop-color:#b2e56b"/></linearGradient><polygon style="fill:url(#SVGID_4_)" points="54.9 19.1 30.6 19.1 52.1 0"/><linearGradient id="SVGID_5_" x1="75.889" x2="13.158" y1="43.95" y2="43.369" gradientUnits="userSpaceOnUse"><stop offset=".387" style="stop-color:#fcf84a"/><stop offset=".536" style="stop-color:#ecf451"/><stop offset=".826" style="stop-color:#c2e964"/><stop offset=".925" style="stop-color:#b2e56b"/></linearGradient><polygon style="fill:url(#SVGID_5_)" points="70 62.6 48.6 69.9 20.2 61.9 28.5 22.1 31.8 19.1 49.1 17.5 47.5 34.9 61.3 29.6"/></g><g><rect style="fill:#000" width="43.2" height="43.2" x="13.4" y="13.4"/><rect style="fill:#fff" width="16.2" height="2.7" x="17.5" y="48.5"/><path style="fill:#fff" d="M17.3,19.1h7.3c4.3,0,6.9,2.5,6.9,6.2v0.1c0,4.1-3.2,6.3-7.2,6.3h-3V37h-3.9V19.1z M24.4,28.1 c2,0,3.1-1.2,3.1-2.7v-0.1c0-1.8-1.2-2.7-3.2-2.7h-3v5.5H24.4z"/><path style="fill:#fff" d="M33.1,28.1L33.1,28.1c0-5.1,3.8-9.3,9.3-9.3c3.4,0,5.4,1.1,7.1,2.8l-2.5,2.9c-1.4-1.3-2.8-2-4.6-2 c-3,0-5.2,2.5-5.2,5.6V28c0,3.1,2.1,5.6,5.2,5.6c2,0,3.3-0.8,4.7-2.1l2.5,2.5c-1.8,2-3.9,3.2-7.3,3.2C37,37.3,33.1,33.2,33.1,28.1"/></g></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 70 70" width="70px" height="70px" xml:space="preserve" style="enable-background:new 0 0 70 70"><g><g><linearGradient id="SVGID_1_" x1="24.998" x2="66.656" y1="27.046" y2="27.046" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#21d789"/><stop offset="1" style="stop-color:#07c3f2"/></linearGradient><polygon style="fill:url(#SVGID_1_)" points="49.1 11 69.5 28.1 62.2 43 49.8 39.6 39.2 39.6"/><linearGradient id="SVGID_2_" x1="-24.559" x2="61.22" y1="59.081" y2="-4.241" gradientUnits="userSpaceOnUse"><stop offset=".011" style="stop-color:#fcf84a"/><stop offset=".112" style="stop-color:#a7eb62"/><stop offset=".206" style="stop-color:#5fe077"/><stop offset=".273" style="stop-color:#32da84"/><stop offset=".306" style="stop-color:#21d789"/><stop offset=".577" style="stop-color:#21d789"/><stop offset=".597" style="stop-color:#21d789"/><stop offset=".686" style="stop-color:#20d68c"/><stop offset=".763" style="stop-color:#1ed497"/><stop offset=".835" style="stop-color:#19d1a9"/><stop offset=".904" style="stop-color:#13ccc2"/><stop offset=".971" style="stop-color:#0bc6e1"/><stop offset="1" style="stop-color:#07c3f2"/></linearGradient><polygon style="fill:url(#SVGID_2_)" points="28.5 22.1 24.5 43 24.1 50.2 14.2 54.5 0 56 4.3 10.7 29.9 0 45.7 10.4"/><linearGradient id="SVGID_3_" x1="9.33" x2="23.637" y1="77.654" y2="32.76" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#21d789"/><stop offset=".164" style="stop-color:#24d788"/><stop offset=".305" style="stop-color:#2fd886"/><stop offset=".437" style="stop-color:#41da82"/><stop offset=".564" style="stop-color:#5adc7d"/><stop offset=".688" style="stop-color:#7ae077"/><stop offset=".809" style="stop-color:#a1e36e"/><stop offset=".925" style="stop-color:#cfe865"/><stop offset="1" style="stop-color:#f1eb5e"/></linearGradient><polygon style="fill:url(#SVGID_3_)" points="28.5 22.1 30.4 62.5 24 70 0 56 19.7 26.6"/><linearGradient id="SVGID_4_" x1="28.275" x2="59.409" y1="38.623" y2="-3.236" gradientUnits="userSpaceOnUse"><stop offset="0" style="stop-color:#21d789"/><stop offset=".061" style="stop-color:#24d788"/><stop offset=".113" style="stop-color:#2fd886"/><stop offset=".162" style="stop-color:#41da82"/><stop offset=".209" style="stop-color:#5add7d"/><stop offset=".255" style="stop-color:#79e077"/><stop offset=".258" style="stop-color:#7ce076"/><stop offset=".499" style="stop-color:#8ce173"/><stop offset=".925" style="stop-color:#b2e56b"/></linearGradient><polygon style="fill:url(#SVGID_4_)" points="54.9 19.1 30.6 19.1 52.1 0"/><linearGradient id="SVGID_5_" x1="75.889" x2="13.158" y1="43.95" y2="43.369" gradientUnits="userSpaceOnUse"><stop offset=".387" style="stop-color:#fcf84a"/><stop offset=".536" style="stop-color:#ecf451"/><stop offset=".826" style="stop-color:#c2e964"/><stop offset=".925" style="stop-color:#b2e56b"/></linearGradient><polygon style="fill:url(#SVGID_5_)" points="70 62.6 48.6 69.9 20.2 61.9 28.5 22.1 31.8 19.1 49.1 17.5 47.5 34.9 61.3 29.6"/></g><g><rect style="fill:#000" width="43.2" height="43.2" x="13.4" y="13.4"/><rect style="fill:#fff" width="16.2" height="2.7" x="17.5" y="48.5"/><path style="fill:#fff" d="M17.3,19.1h7.3c4.3,0,6.9,2.5,6.9,6.2v0.1c0,4.1-3.2,6.3-7.2,6.3h-3V37h-3.9V19.1z M24.4,28.1 c2,0,3.1-1.2,3.1-2.7v-0.1c0-1.8-1.2-2.7-3.2-2.7h-3v5.5H24.4z"/><path style="fill:#fff" d="M33.1,28.1L33.1,28.1c0-5.1,3.8-9.3,9.3-9.3c3.4,0,5.4,1.1,7.1,2.8l-2.5,2.9c-1.4-1.3-2.8-2-4.6-2 c-3,0-5.2,2.5-5.2,5.6V28c0,3.1,2.1,5.6,5.2,5.6c2,0,3.3-0.8,4.7-2.1l2.5,2.5c-1.8,2-3.9,3.2-7.3,3.2C37,37.3,33.1,33.2,33.1,28.1"/></g></g></svg>
diff --git a/site/static/icon/python.svg b/site/static/icon/python.svg
new file mode 100644
index 0000000000000..5a2314da23c8c
--- /dev/null
+++ b/site/static/icon/python.svg
@@ -0,0 +1,19 @@
+<svg width="113" height="113" viewBox="0 0 113 113" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_27_2)">
+<path d="M55.4091 0.000919274C50.7846 0.0222173 46.3682 0.413137 42.4822 1.09467C31.0347 3.09917 28.9563 7.29477 28.9563 15.0322V25.2509H56.0082V28.6572H28.9563H18.8039C10.9419 28.6572 4.05769 33.3409 1.90439 42.2509C-0.579412 52.4639 -0.689582 58.8369 1.90439 69.5009C3.82733 77.4388 8.41959 83.0947 16.2816 83.0947H25.5827V70.8447C25.5827 61.9948 33.3082 54.1884 42.4822 54.1884H69.5026C77.0241 54.1884 83.0286 48.0503 83.0286 40.5634V15.0322C83.0286 7.76583 76.8438 2.30739 69.5026 1.09467C64.8555 0.327944 60.0337 -0.020379 55.4091 0.000919274ZM40.7797 8.21967C43.5739 8.21967 45.8558 10.5183 45.8558 13.3447C45.8558 16.161 43.5739 18.4384 40.7797 18.4384C37.9754 18.4384 35.7035 16.161 35.7035 13.3447C35.7035 10.5183 37.9754 8.21967 40.7797 8.21967Z" fill="url(#paint0_linear_27_2)"/>
+<path d="M86.4022 28.6572V40.5634C86.4022 49.7942 78.5064 57.5634 69.5026 57.5634H42.4822C35.0809 57.5634 28.9563 63.8419 28.9563 71.1884V96.7197C28.9563 103.986 35.3313 108.26 42.4822 110.345C51.0453 112.84 59.2569 113.291 69.5026 110.345C76.313 108.39 83.0286 104.457 83.0285 96.7197V86.5009H56.0082V83.0947H83.0285H96.5545C104.417 83.0947 107.346 77.6593 110.08 69.5009C112.905 61.102 112.785 53.0251 110.08 42.2509C108.137 34.4935 104.427 28.6572 96.5545 28.6572H86.4022ZM71.2052 93.3134C74.0095 93.3134 76.2813 95.5908 76.2813 98.4072C76.2813 101.234 74.0095 103.532 71.2052 103.532C68.4109 103.532 66.129 101.234 66.129 98.4072C66.129 95.5908 68.4109 93.3134 71.2052 93.3134Z" fill="url(#paint1_linear_27_2)"/>
+</g>
+<defs>
+<linearGradient id="paint0_linear_27_2" x1="-3.36866e-07" y1="-2.90036e-07" x2="61.9116" y2="53.2283" gradientUnits="userSpaceOnUse">
+<stop stop-color="#5A9FD4"/>
+<stop offset="1" stop-color="#306998"/>
+</linearGradient>
+<linearGradient id="paint1_linear_27_2" x1="70.5551" y1="97.548" x2="48.4388" y2="66.2798" gradientUnits="userSpaceOnUse">
+<stop stop-color="#FFD43B"/>
+<stop offset="1" stop-color="#FFE873"/>
+</linearGradient>
+<clipPath id="clip0_27_2">
+<rect width="113" height="113" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/site/static/icon/pytorch.svg b/site/static/icon/pytorch.svg
index 575f6823e4762..fbffcfecdec44 100644
--- a/site/static/icon/pytorch.svg
+++ b/site/static/icon/pytorch.svg
@@ -2,6 +2,7 @@
 <!-- Generator: Adobe Illustrator 17.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
 <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
 <svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="90.3px" height="109.1px"
 	 viewBox="0.6 1067.9 90.3 109.1" enable-background="new 0.6 1067.9 90.3 109.1" xml:space="preserve">
 <g>
 	<path fill="#EE4C2C" d="M77.6,1099.6l-8.1,8.1c13.3,13.3,13.3,34.7,0,47.8c-13.3,13.3-34.7,13.3-47.8,0
diff --git a/site/static/icon/rider.svg b/site/static/icon/rider.svg
index 58c66adef9433..f68e74e640473 100644
--- a/site/static/icon/rider.svg
+++ b/site/static/icon/rider.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 70 70" xml:space="preserve" style="enable-background:new 0 0 70 70"><defs><linearGradient id="linear-gradient" x1="70.226" x2="-5.13" y1="27.799" y2="63.122" gradientTransform="matrix(1, 0, 0, -1, 0, 71.27997)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#c90f5e"/><stop offset=".221" stop-color="#c90f5e"/><stop offset=".236" stop-color="#c90f5e"/><stop offset=".356" stop-color="#ca135c"/><stop offset=".466" stop-color="#ce1e57"/><stop offset=".574" stop-color="#d4314e"/><stop offset=".678" stop-color="#dc4b41"/><stop offset=".782" stop-color="#e66d31"/><stop offset=".883" stop-color="#f3961d"/><stop offset=".942" stop-color="#fcb20f"/></linearGradient><linearGradient id="linear-gradient-2" x1="24.659" x2="46.048" y1="61.996" y2="2.934" gradientTransform="matrix(1, 0, 0, -1, 0, 71.27997)" gradientUnits="userSpaceOnUse"><stop offset=".042" stop-color="#077cfb"/><stop offset=".445" stop-color="#c90f5e"/><stop offset=".958" stop-color="#077cfb"/></linearGradient><linearGradient id="linear-gradient-3" x1="17.396" x2="33.194" y1="63.346" y2="7.201" gradientTransform="matrix(1, 0, 0, -1, 0, 71.27997)" gradientUnits="userSpaceOnUse"><stop offset=".277" stop-color="#c90f5e"/><stop offset=".974" stop-color="#fcb20f"/></linearGradient></defs><title>rider</title><g><polygon fill="url(#linear-gradient)" points="70 27.237 63.391 23.75 20.926 0 3.827 17.921 21.619 41.068 60.537 44.397 70 27.237"/><polygon fill="url(#linear-gradient-2)" points="50.423 16.132 44.271 1.107 27.643 17.471 11.768 50.194 49.411 70 70 57.98 50.423 16.132"/><polygon fill="url(#linear-gradient-3)" points="20.926 0 0 14.095 7.779 62.172 27.848 69.889 53.78 48.823 20.926 0"/></g><g><rect width="43.614" height="43.614" x="13.302" y="13.193"/><g><path fill="#fff" d="M17.22741,18.86293h8.39564a7.38416,7.38416,0,0,1,5.34268,1.85358,5.86989,5.86989,0,0,1,1.52648,4.1433h0A5.74339,5.74339,0,0,1,28.567,30.5296l4.47041,6.54206H28.34891L24.42368,31.1838h-3.162v5.88785H17.22741V18.86293h0ZM25.296,27.69471c1.96262,0,3.053-1.09034,3.053-2.61682h0c0-1.74455-1.19938-2.61682-3.162-2.61682H21.15265v5.23365H25.296Z"/><path fill="#fff" d="M36.09034,18.86293H43.2866c5.77882,0,9.70405,3.92523,9.70405,9.15888h0c0,5.12461-3.92523,9.15888-9.70405,9.15888H36.09034V18.86293Zm4.03427,3.59813V33.47352h3.162a5.23727,5.23727,0,0,0,5.56075-5.45171h0a5.26493,5.26493,0,0,0-5.56075-5.56075h-3.162Z"/></g><rect width="16.355" height="2.726" x="17.227" y="48.629" fill="#fff"/></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 70 70" width="70px" height="70px" xml:space="preserve" style="enable-background:new 0 0 70 70"><defs><linearGradient id="linear-gradient" x1="70.226" x2="-5.13" y1="27.799" y2="63.122" gradientTransform="matrix(1, 0, 0, -1, 0, 71.27997)" gradientUnits="userSpaceOnUse"><stop offset="0" stop-color="#c90f5e"/><stop offset=".221" stop-color="#c90f5e"/><stop offset=".236" stop-color="#c90f5e"/><stop offset=".356" stop-color="#ca135c"/><stop offset=".466" stop-color="#ce1e57"/><stop offset=".574" stop-color="#d4314e"/><stop offset=".678" stop-color="#dc4b41"/><stop offset=".782" stop-color="#e66d31"/><stop offset=".883" stop-color="#f3961d"/><stop offset=".942" stop-color="#fcb20f"/></linearGradient><linearGradient id="linear-gradient-2" x1="24.659" x2="46.048" y1="61.996" y2="2.934" gradientTransform="matrix(1, 0, 0, -1, 0, 71.27997)" gradientUnits="userSpaceOnUse"><stop offset=".042" stop-color="#077cfb"/><stop offset=".445" stop-color="#c90f5e"/><stop offset=".958" stop-color="#077cfb"/></linearGradient><linearGradient id="linear-gradient-3" x1="17.396" x2="33.194" y1="63.346" y2="7.201" gradientTransform="matrix(1, 0, 0, -1, 0, 71.27997)" gradientUnits="userSpaceOnUse"><stop offset=".277" stop-color="#c90f5e"/><stop offset=".974" stop-color="#fcb20f"/></linearGradient></defs><title>rider</title><g><polygon fill="url(#linear-gradient)" points="70 27.237 63.391 23.75 20.926 0 3.827 17.921 21.619 41.068 60.537 44.397 70 27.237"/><polygon fill="url(#linear-gradient-2)" points="50.423 16.132 44.271 1.107 27.643 17.471 11.768 50.194 49.411 70 70 57.98 50.423 16.132"/><polygon fill="url(#linear-gradient-3)" points="20.926 0 0 14.095 7.779 62.172 27.848 69.889 53.78 48.823 20.926 0"/></g><g><rect width="43.614" height="43.614" x="13.302" y="13.193"/><g><path fill="#fff" d="M17.22741,18.86293h8.39564a7.38416,7.38416,0,0,1,5.34268,1.85358,5.86989,5.86989,0,0,1,1.52648,4.1433h0A5.74339,5.74339,0,0,1,28.567,30.5296l4.47041,6.54206H28.34891L24.42368,31.1838h-3.162v5.88785H17.22741V18.86293h0ZM25.296,27.69471c1.96262,0,3.053-1.09034,3.053-2.61682h0c0-1.74455-1.19938-2.61682-3.162-2.61682H21.15265v5.23365H25.296Z"/><path fill="#fff" d="M36.09034,18.86293H43.2866c5.77882,0,9.70405,3.92523,9.70405,9.15888h0c0,5.12461-3.92523,9.15888-9.70405,9.15888H36.09034V18.86293Zm4.03427,3.59813V33.47352h3.162a5.23727,5.23727,0,0,0,5.56075-5.45171h0a5.26493,5.26493,0,0,0-5.56075-5.56075h-3.162Z"/></g><rect width="16.355" height="2.726" x="17.227" y="48.629" fill="#fff"/></g></svg>
diff --git a/site/static/icon/ruby.png b/site/static/icon/ruby.png
new file mode 100644
index 0000000000000..797167a700a97
Binary files /dev/null and b/site/static/icon/ruby.png differ
diff --git a/site/static/icon/rubymine.svg b/site/static/icon/rubymine.svg
index 4f1cbac3dfcd7..b60f0be776752 100644
--- a/site/static/icon/rubymine.svg
+++ b/site/static/icon/rubymine.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 70 70" xml:space="preserve" style="enable-background:new 0 0 70 70"><g><g><linearGradient id="SVGID_1_" x1="49.609" x2="30.346" y1="52.554" y2="7.163" gradientUnits="userSpaceOnUse"><stop offset=".172" style="stop-color:#ff1f51"/><stop offset=".28" style="stop-color:#ff3648"/><stop offset=".468" style="stop-color:#ff593b"/><stop offset=".646" style="stop-color:#ff7231"/><stop offset=".809" style="stop-color:#ff812b"/><stop offset=".941" style="stop-color:#ff8629"/></linearGradient><polygon style="fill:url(#SVGID_1_)" points="58.2 0 38.2 7.2 22.4 0 6.9 38.9 24.7 31.8 24.4 51.5 62.5 52.2 70 13.7"/><linearGradient id="SVGID_2_" x1="33.259" x2="25.105" y1="12.887" y2="33.436" gradientUnits="userSpaceOnUse"><stop offset=".022" style="stop-color:#9039d0"/><stop offset=".629" style="stop-color:#ff1f51"/></linearGradient><polygon style="fill:url(#SVGID_2_)" points="50.8 22.7 25.6 6.2 5.3 18.7 49.8 35.9"/><linearGradient id="SVGID_3_" x1=".29" x2="45.284" y1="11.224" y2="68.42" gradientUnits="userSpaceOnUse"><stop offset=".107" style="stop-color:#9039d0"/><stop offset=".387" style="stop-color:#ff1f51"/><stop offset=".629" style="stop-color:#ff1f51"/><stop offset=".66" style="stop-color:#ff3648"/><stop offset=".714" style="stop-color:#ff593b"/><stop offset=".765" style="stop-color:#ff7231"/><stop offset=".812" style="stop-color:#ff812b"/><stop offset=".85" style="stop-color:#ff8629"/></linearGradient><polygon style="fill:url(#SVGID_3_)" points="29.1 68.2 55.3 64.7 47 48.7 52.5 42 53.1 37.9 25.6 6.1 0 12.4 0 49.1 14.8 70 29.1 68.2 29.1 68.2 29.1 68.2 29.1 68.2"/></g><g><rect style="fill:#000" width="43.2" height="43.2" x="13.4" y="13.4"/><rect style="fill:#fff" width="16.2" height="2.7" x="17.5" y="48.5"/><polygon style="fill:#fff" points="34.6 19 38.9 19 43.6 26.6 48.3 19 52.6 19 52.6 36.9 48.6 36.9 48.6 25.2 43.6 32.9 43.5 32.9 38.5 25.3 38.5 36.9 34.6 36.9"/><path style="fill:#fff" d="M17.4,19h8.2c2.3,0,4,0.6,5.2,1.8c1,1,1.5,2.4,1.5,4.1v0.1c0,1.5-0.4,2.6-1.1,3.5 c-0.7,0.9-1.6,1.6-2.8,2l4.4,6.4h-4.6l-3.7-5.5h-3.3l0,5.5h-3.9V19z M25.4,27.7c1,0,1.7-0.2,2.2-0.7c0.5-0.5,0.8-1.1,0.8-1.8v-0.1 c0-0.9-0.3-1.5-0.8-1.9c-0.5-0.4-1.3-0.6-2.3-0.6h-3.9v5.1H25.4z"/></g></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 70 70" width="70px" height="70px" xml:space="preserve" style="enable-background:new 0 0 70 70"><g><g><linearGradient id="SVGID_1_" x1="49.609" x2="30.346" y1="52.554" y2="7.163" gradientUnits="userSpaceOnUse"><stop offset=".172" style="stop-color:#ff1f51"/><stop offset=".28" style="stop-color:#ff3648"/><stop offset=".468" style="stop-color:#ff593b"/><stop offset=".646" style="stop-color:#ff7231"/><stop offset=".809" style="stop-color:#ff812b"/><stop offset=".941" style="stop-color:#ff8629"/></linearGradient><polygon style="fill:url(#SVGID_1_)" points="58.2 0 38.2 7.2 22.4 0 6.9 38.9 24.7 31.8 24.4 51.5 62.5 52.2 70 13.7"/><linearGradient id="SVGID_2_" x1="33.259" x2="25.105" y1="12.887" y2="33.436" gradientUnits="userSpaceOnUse"><stop offset=".022" style="stop-color:#9039d0"/><stop offset=".629" style="stop-color:#ff1f51"/></linearGradient><polygon style="fill:url(#SVGID_2_)" points="50.8 22.7 25.6 6.2 5.3 18.7 49.8 35.9"/><linearGradient id="SVGID_3_" x1=".29" x2="45.284" y1="11.224" y2="68.42" gradientUnits="userSpaceOnUse"><stop offset=".107" style="stop-color:#9039d0"/><stop offset=".387" style="stop-color:#ff1f51"/><stop offset=".629" style="stop-color:#ff1f51"/><stop offset=".66" style="stop-color:#ff3648"/><stop offset=".714" style="stop-color:#ff593b"/><stop offset=".765" style="stop-color:#ff7231"/><stop offset=".812" style="stop-color:#ff812b"/><stop offset=".85" style="stop-color:#ff8629"/></linearGradient><polygon style="fill:url(#SVGID_3_)" points="29.1 68.2 55.3 64.7 47 48.7 52.5 42 53.1 37.9 25.6 6.1 0 12.4 0 49.1 14.8 70 29.1 68.2 29.1 68.2 29.1 68.2 29.1 68.2"/></g><g><rect style="fill:#000" width="43.2" height="43.2" x="13.4" y="13.4"/><rect style="fill:#fff" width="16.2" height="2.7" x="17.5" y="48.5"/><polygon style="fill:#fff" points="34.6 19 38.9 19 43.6 26.6 48.3 19 52.6 19 52.6 36.9 48.6 36.9 48.6 25.2 43.6 32.9 43.5 32.9 38.5 25.3 38.5 36.9 34.6 36.9"/><path style="fill:#fff" d="M17.4,19h8.2c2.3,0,4,0.6,5.2,1.8c1,1,1.5,2.4,1.5,4.1v0.1c0,1.5-0.4,2.6-1.1,3.5 c-0.7,0.9-1.6,1.6-2.8,2l4.4,6.4h-4.6l-3.7-5.5h-3.3l0,5.5h-3.9V19z M25.4,27.7c1,0,1.7-0.2,2.2-0.7c0.5-0.5,0.8-1.1,0.8-1.8v-0.1 c0-0.9-0.3-1.5-0.8-1.9c-0.5-0.4-1.3-0.6-2.3-0.6h-3.9v5.1H25.4z"/></g></g></svg>
diff --git a/site/static/icon/rust.svg b/site/static/icon/rust.svg
new file mode 100644
index 0000000000000..6c5ff13735c34
--- /dev/null
+++ b/site/static/icon/rust.svg
@@ -0,0 +1,11 @@
+<svg width="106" height="106" viewBox="0 0 106 106" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_78_2)">
+<path d="M53.05 5.67999C26.99 5.67999 5.78 26.9 5.78 52.95C5.78 79 27 100.22 53.05 100.22C79.1 100.22 100.32 79 100.32 52.95C100.32 26.9 79.1 5.67999 53.05 5.67999ZM52.98 9.87999C53.7882 9.90089 54.5563 10.2378 55.1205 10.8188C55.6847 11.3998 56.0003 12.1789 56 12.99C56 13.8148 55.6723 14.6059 55.0891 15.1891C54.5059 15.7723 53.7148 16.1 52.89 16.1C52.0652 16.1 51.2741 15.7723 50.6909 15.1891C50.1077 14.6059 49.78 13.8148 49.78 12.99C49.7798 12.5739 49.8631 12.162 50.025 11.7787C50.1869 11.3954 50.4241 11.0484 50.7225 10.7584C51.0209 10.4685 51.3744 10.2413 51.7622 10.0904C52.15 9.93949 52.5641 9.86799 52.98 9.87999ZM60.1 15C65.5596 16.0226 70.7312 18.2214 75.2556 21.4438C79.78 24.6661 83.549 28.8347 86.3 33.66L82.63 41.94C82 43.37 82.65 45.05 84.07 45.69L91.13 48.82C91.349 51.0268 91.376 53.2485 91.21 55.46H87.28C86.89 55.46 86.73 55.72 86.73 56.1V57.9C86.73 62.14 84.34 63.07 82.24 63.3C80.24 63.53 78.03 62.46 77.75 61.24C76.57 54.61 74.61 53.2 71.51 50.75C75.36 48.31 79.36 44.7 79.36 39.88C79.36 34.67 75.79 31.39 73.36 29.78C69.94 27.53 66.16 27.08 65.14 27.08H24.54C30.154 20.8084 37.6791 16.5626 45.95 15L50.74 20.02C51.82 21.15 53.61 21.2 54.74 20.11L60.1 15ZM15.9 38.02C16.7091 38.0434 17.4772 38.3814 18.0411 38.9621C18.6051 39.5428 18.9203 40.3205 18.92 41.13C18.92 41.9548 18.5923 42.7459 18.0091 43.3291C17.4259 43.9123 16.6348 44.24 15.81 44.24C14.9852 44.24 14.1941 43.9123 13.6109 43.3291C13.0277 42.7459 12.7 41.9548 12.7 41.13C12.6998 40.7139 12.7831 40.302 12.945 39.9187C13.1069 39.5354 13.3441 39.1884 13.6425 38.8984C13.9409 38.6085 14.2944 38.3813 14.6822 38.2304C15.07 38.0795 15.4841 38.008 15.9 38.02ZM90.05 38.16C90.859 38.1834 91.627 38.5214 92.191 39.1021C92.755 39.6828 93.07 40.4605 93.07 41.27C93.07 42.0948 92.742 42.8859 92.159 43.4691C91.576 44.0523 90.785 44.38 89.96 44.38C89.135 44.38 88.344 44.0523 87.761 43.4691C87.178 42.8859 86.85 42.0948 86.85 41.27C86.85 40.8539 86.933 40.442 87.095 40.0587C87.257 39.6754 87.494 39.3284 87.792 39.0384C88.091 38.7485 88.444 38.5213 88.832 38.3704C89.22 38.2195 89.634 38.148 90.05 38.16ZM21.76 38.66H27.18V63.1H16.24C14.8889 58.3554 14.4678 53.3944 15 48.49L21.7 45.51C23.13 44.87 23.78 43.2 23.14 41.77L21.76 38.66ZM44.38 38.92H57.29C57.96 38.92 62 39.69 62 42.72C62 45.23 58.9 46.13 56.35 46.13H44.37L44.38 38.92ZM44.38 56.48H54.27C55.17 56.48 59.1 56.74 60.35 61.76C60.74 63.3 61.61 68.32 62.2 69.93C62.79 71.73 65.18 75.33 67.73 75.33H83.87C82.788 76.7786 81.6054 78.1487 80.33 79.43L73.76 78.02C72.23 77.69 70.72 78.67 70.39 80.2L68.83 87.48C63.8135 89.752 58.3657 90.915 52.8586 90.89C47.3515 90.864 41.9149 89.649 36.92 87.33L35.36 80.05C35.03 78.52 33.53 77.54 32 77.87L25.57 79.25C24.3768 78.0192 23.2676 76.7095 22.25 75.33H53.52C53.87 75.33 54.11 75.27 54.11 74.94V63.88C54.11 63.56 53.87 63.49 53.52 63.49H44.37L44.38 56.48ZM29.95 81.81C30.7591 81.8334 31.5272 82.171 32.0911 82.752C32.6551 83.333 32.9703 84.111 32.97 84.92C32.97 85.745 32.6423 86.536 32.0591 87.119C31.4759 87.702 30.6848 88.03 29.86 88.03C29.0352 88.03 28.2441 87.702 27.6609 87.119C27.0777 86.536 26.75 85.745 26.75 84.92C26.7498 84.504 26.8331 84.092 26.995 83.709C27.1569 83.325 27.3941 82.978 27.6925 82.688C27.9909 82.398 28.3444 82.171 28.7322 82.02C29.12 81.8695 29.5341 81.7979 29.95 81.81ZM76 81.95C76.8091 81.9734 77.5772 82.311 78.1412 82.892C78.7051 83.473 79.0203 84.251 79.02 85.06C79.02 85.885 78.6923 86.676 78.1091 87.259C77.5259 87.842 76.7348 88.17 75.91 88.17C75.0852 88.17 74.2941 87.842 73.7109 87.259C73.1277 86.676 72.8 85.885 72.8 85.06C72.7998 84.644 72.8832 84.232 73.045 83.849C73.2069 83.465 73.4441 83.118 73.7425 82.828C74.0409 82.538 74.3944 82.311 74.7822 82.16C75.17 82.009 75.5841 81.9379 76 81.95Z" fill="white"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M97.68 52.95C97.68 64.7866 92.978 76.1384 84.608 84.508C76.2384 92.878 64.8866 97.58 53.05 97.58C41.2134 97.58 29.8616 92.878 21.4918 84.508C13.1221 76.1384 8.41999 64.7866 8.41999 52.95C8.41999 41.1134 13.1221 29.7616 21.4918 21.3918C29.8616 13.0221 41.2134 8.32001 53.05 8.32001C64.8866 8.32001 76.2384 13.0221 84.608 21.3918C92.978 29.7616 97.68 41.1134 97.68 52.95ZM96.84 48.64L103.8 52.95L96.84 57.26L102.82 62.85L95.16 65.72L99.94 72.37L91.85 73.69L95.25 81.15L87.06 80.86L88.94 88.84L80.96 86.96L81.25 95.15L73.79 91.75L72.47 99.84L65.82 95.06L62.95 102.72L57.36 96.74L53.05 103.7L48.74 96.74L43.15 102.72L40.28 95.06L33.63 99.84L32.31 91.75L24.85 95.15L25.14 86.96L17.16 88.84L19.04 80.86L10.85 81.15L14.25 73.69L6.15999 72.37L10.94 65.72L3.27999 62.85L9.25999 57.26L2.29999 52.95L9.25999 48.64L3.27999 43.05L10.94 40.18L6.15999 33.53L14.25 32.21L10.85 24.75L19.04 25.04L17.16 17.06L25.14 18.94L24.85 10.75L32.31 14.15L33.63 6.06001L40.28 10.84L43.15 3.18001L48.74 9.16001L53.05 2.20001L57.36 9.16001L62.95 3.18001L65.82 10.84L72.47 6.06001L73.79 14.15L81.25 10.75L80.96 18.94L88.94 17.06L87.06 25.04L95.25 24.75L91.85 32.21L99.94 33.53L95.16 40.18L102.82 43.05L96.84 48.64Z" fill="white" stroke="white" stroke-width="3" stroke-linecap="round" stroke-linejoin="round"/>
+</g>
+<defs>
+<clipPath id="clip0_78_2">
+<rect width="106" height="106" fill="white"/>
+</clipPath>
+</defs>
+</svg>
diff --git a/site/static/icon/slack.svg b/site/static/icon/slack.svg
new file mode 100644
index 0000000000000..fb55f7245df5b
--- /dev/null
+++ b/site/static/icon/slack.svg
@@ -0,0 +1,6 @@
+<svg width="127" height="127" xmlns="http://www.w3.org/2000/svg">
+  <path d="M27.2 80c0 7.3-5.9 13.2-13.2 13.2C6.7 93.2.8 87.3.8 80c0-7.3 5.9-13.2 13.2-13.2h13.2V80zm6.6 0c0-7.3 5.9-13.2 13.2-13.2 7.3 0 13.2 5.9 13.2 13.2v33c0 7.3-5.9 13.2-13.2 13.2-7.3 0-13.2-5.9-13.2-13.2V80z" fill="#E01E5A"/>
+  <path d="M47 27c-7.3 0-13.2-5.9-13.2-13.2C33.8 6.5 39.7.6 47 .6c7.3 0 13.2 5.9 13.2 13.2V27H47zm0 6.7c7.3 0 13.2 5.9 13.2 13.2 0 7.3-5.9 13.2-13.2 13.2H13.9C6.6 60.1.7 54.2.7 46.9c0-7.3 5.9-13.2 13.2-13.2H47z" fill="#36C5F0"/>
+  <path d="M99.9 46.9c0-7.3 5.9-13.2 13.2-13.2 7.3 0 13.2 5.9 13.2 13.2 0 7.3-5.9 13.2-13.2 13.2H99.9V46.9zm-6.6 0c0 7.3-5.9 13.2-13.2 13.2-7.3 0-13.2-5.9-13.2-13.2V13.8C66.9 6.5 72.8.6 80.1.6c7.3 0 13.2 5.9 13.2 13.2v33.1z" fill="#2EB67D"/>
+  <path d="M80.1 99.8c7.3 0 13.2 5.9 13.2 13.2 0 7.3-5.9 13.2-13.2 13.2-7.3 0-13.2-5.9-13.2-13.2V99.8h13.2zm0-6.6c-7.3 0-13.2-5.9-13.2-13.2 0-7.3 5.9-13.2 13.2-13.2h33.1c7.3 0 13.2 5.9 13.2 13.2 0 7.3-5.9 13.2-13.2 13.2H80.1z" fill="#ECB22E"/>
+</svg>
diff --git a/site/static/icon/swift.svg b/site/static/icon/swift.svg
new file mode 100644
index 0000000000000..9e97bfaa8cc45
--- /dev/null
+++ b/site/static/icon/swift.svg
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 18.1.1, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 width="106.1px" height="106.1px" viewBox="-252 343.9 106.1 106.1" enable-background="new -252 343.9 106.1 106.1"
+	 xml:space="preserve">
+<g>
+	<path fill="#F05138" d="M-145.9,373.3c0-1.1,0-2.1,0-3.2c-0.1-2.3-0.2-4.7-0.6-7c-0.4-2.3-1.1-4.5-2.2-6.6c-1.1-2.1-2.4-4-4.1-5.6
+		c-1.7-1.7-3.6-3-5.6-4.1c-2.1-1.1-4.3-1.8-6.6-2.2c-2.3-0.4-4.6-0.6-7-0.6c-1.1,0-2.1,0-3.2,0c-1.3,0-2.5,0-3.8,0h-28.1h-11.6
+		c-1.3,0-2.5,0-3.8,0c-1.1,0-2.1,0-3.2,0c-0.6,0-1.2,0-1.7,0.1c-1.7,0.1-3.5,0.2-5.2,0.5c-1.7,0.3-3.4,0.8-5,1.4
+		c-0.5,0.2-1.1,0.5-1.6,0.7c-1.6,0.8-3,1.8-4.4,2.9c-0.4,0.4-0.9,0.8-1.3,1.2c-1.7,1.7-3,3.6-4.1,5.6c-1.1,2.1-1.8,4.3-2.2,6.6
+		c-0.4,2.3-0.5,4.6-0.6,7c0,1.1,0,2.1,0,3.2c0,1.3,0,2.5,0,3.8v17.3v22.4c0,1.3,0,2.5,0,3.8c0,1.1,0,2.1,0,3.2
+		c0.1,2.3,0.2,4.7,0.6,7c0.4,2.3,1.1,4.5,2.2,6.6c1.1,2.1,2.4,4,4.1,5.6c1.7,1.7,3.6,3,5.6,4.1c2.1,1.1,4.3,1.8,6.6,2.2
+		c2.3,0.4,4.6,0.6,7,0.6c1.1,0,2.1,0,3.2,0c1.3,0,2.5,0,3.8,0h39.7c1.3,0,2.5,0,3.8,0c1.1,0,2.1,0,3.2,0c2.3-0.1,4.7-0.2,7-0.6
+		c2.3-0.4,4.5-1.1,6.6-2.2c2.1-1.1,4-2.4,5.6-4.1c1.7-1.7,3-3.6,4.1-5.6c1.1-2.1,1.8-4.3,2.2-6.6c0.4-2.3,0.6-4.6,0.6-7
+		c0-1.1,0-2.1,0-3.2c0-1.3,0-2.5,0-3.8v-39.7C-145.9,375.8-145.9,374.6-145.9,373.3z"/>
+	<path fill="#FFFFFF" d="M-168,409.4c0.1-0.4,0.2-0.8,0.3-1.2c4.4-17.5-6.3-38.3-24.5-49.2c8,10.8,11.5,23.9,8.4,35.3
+		c-0.3,1-0.6,2-1,3c-0.4-0.3-0.9-0.6-1.6-0.9c0,0-18.1-11.2-37.7-30.9c-0.5-0.5,10.5,15.7,22.9,28.8c-5.9-3.3-22.2-15.2-32.6-24.6
+		c1.3,2.1,2.8,4.2,4.4,6.1c8.6,11,19.9,24.5,33.4,34.9c-9.5,5.8-22.9,6.3-36.2,0c-3.3-1.5-6.4-3.4-9.3-5.5
+		c5.6,9,14.3,16.8,24.9,21.4c12.6,5.4,25.2,5.1,34.5,0.1l0,0c0,0,0.1,0,0.1-0.1c0.4-0.2,0.8-0.5,1.2-0.7c4.5-2.3,13.3-4.6,18.1,4.6
+		C-161.3,432.6-158.8,420.6-168,409.4C-168,409.4-168,409.4-168,409.4z"/>
+</g>
+</svg>
diff --git a/site/static/icon/theia.svg b/site/static/icon/theia.svg
index 99320b7ea85e5..b0934fa4c84e2 100644
--- a/site/static/icon/theia.svg
+++ b/site/static/icon/theia.svg
@@ -1 +1,37 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="758.6" height="364.319" viewBox="0 0 758.6 364.319"><defs><pattern id="b" width="1" height="1" viewBox="109.329 88.095 521.942 244.07"><image preserveAspectRatio="xMidYMid slice" width="740.6" height="437.627" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAC7AAAAboCAMAAAA4RSyIAAAC9FBMVEUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGBgYDAwMzUXMcHBwlJSYsLS8zMzM4ODggISQoLC8yNjkYdtIeHh7g4OAjRV4FLkonJyfU1NQuLi4AAAD19fWb3P7c3NxERUVRUVGtra3x8/TFxcUqKSxVVldoaGpDi9goKCiGhobY2NhgmLDR0dF0UHvNzc3JyclUVVNqnrOfn58rMTXEnwCaoKZVmtW7u7uCg4OQkJDc3KpeX19wcHG+vr63t7d/f386OjrAwcJ4eHhaW1tDjNpsbG2xsbGLjIy0tLWnp6dKS0xlZWaXoqtAQUM/Pj57e3tNTk6cnJyWlpajo6MAl/xyn8+rq6tzdHRHR0hhYmOSk5T////u8PKZmZkgfa/Fhr+Y1/cvOkFqkaVOybBoSGxvTXNSVFfq6+1KZXUChr28t7ODt9NCMkQ9UVpRT0tegZIapuRhRGWU0PBQO1SL4jQvKDEDktA4SVE7Lj1VPVkzQUg2KjdSbX5/scsQcaRbQV9LOE1HNUk6PUBjiJrk5uZGXGujw+gvTmT/WlKBruJUwizmwClAPDLb5fGOmKEmfNNeeIlCVmPl6/NahqFWdIZ7qsM2VW2Lw+FLRkDAu7eSueW90uxypuA1ODuPyed2o7pfjaZDcplnn96HvdlHeaVelqx3iJWAj5w7htZslsQ5XnxhXVIxgdXH2e4nQFNRktqwy+q6tLA6Z4mAgGbS3/DQ0KFWfJhdmtyvsIlmjbc3cGSQkHJrfo5MhbYIPGFZUCdQj8QNT3mstr3AgrrDxJcEbrc/j34KW465uZBzZR8AjeuojA10c12zrqqMY4gDest1vv96V3eaa5VFoo8BhNxKuqOGcxWgq7WmpYGalJCMhoKF2TKqdaWbm3pakCoglcpsrCyYgBRAZyh7yDBPfyg3TiKxeqykREBOsy3SsSu2frHoVE42ghJeAAAAG3RSTlMBChMaIioyOUU/VVBLeXKAa4aLYFtlj5LYq+pxvU7IAAPx0UlEQVR42uzBgQAAAACAoP2pF6kCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGD27mi3URgKAqjn/396JZowMQ50VamrVThD1dg+FKmXlyvkUhERERERERERERERERERkf8weRk14Zxzzjnn/KR/lN9ILhfPkHPOOeec86Fv/7Vk5K/Lmnq6Fs4555xzzptlro3/QfJNpaKSIiIiIqK//MfJBVxSHl89tVPOOeecc87H6Fl2zPwguajhXOf0lGxHab1ExuCcc84553zzrudxbCkcf0Ljvv7y15X9vpytfO8W55xzzjnnzxS6cHTP2eecVCcdZ8e83oZUp3tRf2g455xzzjnflzvIdPbsTe7btaelOn1aPnJSs3x5Oi+++MibSyWcc8455/yz/Zv+MPWeW0+Hr8ktu/apZGt9s1PG2qJ3eLhFWdr62Uc455xzzvlH+0V/ODeZOfafHd60RU8/F8nSi5c6zXIvxnjr68P6cM4555zzW/hVf5j6tn7atefG+9rT0VKBvZxP/sJW830Dv2X1jLz44Jxzzjnnt/K88VE/vn+w8+ny08IHN+tZ52ul190s/WyRjz7SY5tMPkZ2fSxzzjnnnPOb+FX/2Mm0cb3zLdMj+Y9/yp7zvyB9v1u9Zex6Js8m2Uf15yycc8455/zGnnf949p7drZR/XnuDbr19zvWszbvy9aktupfR9eSXuPpo0s7h3POOeec39O3wXn/uM/b/F//T8/coWtfNvXPlezi8vD8tZRJizZ5jj4455xzzjk/7x9HNh7JznM3+vj24W16+jmVpuvtzg9bklJ/ljJpIZMNH8I555xzznl9LP6uv9yPk5fPjOM4o8nndPHL29aXd788PX3KPpd6+9x9C+ecc845/8PeGWw3DgJBcFr//9H7goXrjclq7WQPkl2dmBmo5CB8aXgDkv+Cr/5zHa3gad+4ICaENg9zOA+HSpndzJiwkDrku+BDcrlcLpfL5fIP4i/4R3gRKg+mvfn297visT/SiL0ABp5UrVPfZnXh9OVyuVwul8vl8gMO5Ahq45Va74pcr3kf/F0KYkJLkT+PN3lGPsW6Z6juDX25XC6Xy+Vyufw/cAgt/pQjqKk0f3v10pisF+Csj5js46xoioERAmMmGVjEsFwul8vlcrlcDv+3v8SzE1NfImnONm9R1J6WTo/O0oWZmf0hhkbnHN+xXC6Xy+VyufwteN9W7/5z9acMrR73urXsIfYyn9Hi2kfKQVMm6xUxwXK5XC6Xy+VyeeMvO/zVn/Zd536LTK65vx4iQ6n1upxQE9Mnqpp9BzTViRdtcrlcLpfL5fJz8dWWkx8mRbkMFj17uN4Oe74d60/W7mwcsY6KX+pwxcS/KaWUUkop9a2KUHRJEMP4UwpExmeEfkHM1arYQ9YNOqU/o//32dGBK6WUUkqpk4i3pNaejAbrvneuYtbRuuDgkO1603rpz5VSSiml1FlUqdatNP+Kv30ojbnOHnsvvu/VPlya4za6UkoppZQ6tyoklMWkQgHJNTfXW7l6ccC030U/VcQfa8s2M8L4yOVyuVwul8vlv1X1XgV/m+55K1fZaA8td8pT/fOzevWNljSEHY1fuVwul8vlcrk88K2Dp1Uk+FkOZeJ+c5lTp2kvac1oeCyel/wVbTQjbBu9h6WVXC6Xy+VyuVwO30fu+DWx+8wVh1X30ZFe6zVKKR6Cp1pK1+kcabtNPz/ZmOwRBx8JfONL+krlcrlcLpfL5Z/Gv/ePM4HlaRXN/ov3HZ+bclbbHmphGOEZknr2uCmLJOavZ9u2J8QxhIe/x00ul8vlcrlc/uEc/4itJzZf+aRnr1vkzCm3IZ7vWvb0LI/HTLn/5qUTpljzr2ZP+Qr27AuPJvBNLpfL5XK5XC7/nufe3Tm1MkcV7jhZhvqdMcG659SvUgpt7j28+pNF6vOHecyezkken9kbIjbJ5XK5XC6Xyz+dr/5xeswZ2JU/3GenaITt9Rmn/z3njex5CDQ8CKK3lKr3OWP9M2JPR5Y9ZaxxpZRSSin1SfqnP4R3f8mecd8sTlc9xPAm/xrtCOdz6925hya35DlRSETVC+sj9Fcbnme+P7lcLpfL5XL5x/A8OZzWBjua4832IlIgM5T5OV1dTNbzprwV6rhOnWS75Uw/s0o3P7Hs/Enk8j/sncFu00AURWdsLyJEJRZITUWIypoNC4L4h26QIpZ0DT/Ah/DFNC+ZHDlOJgVB7bbn2H5+k8vC2JvL482Murq6urq6+jPQ8yBnRLM7YwZ0tR+nvxIi/pdO9qm1sW+fjqy3nHy6V9P6hhjxpuKMAGDLi4iIiIj8Cbk57y9zCTRnn4GFVlJkaYJ7nuYEOU58emR1Gt6CjeciIiIi8nD0a+zctzEHLNhen4KaIo9zigs70g5TcurrPP8AKuq5/4oYA+MabUPSxtGUK+Lurq6urq6urq6u/oR1+EPnDvxYaYvhnljbkSXOgzwR707JvxTXI63V2PHq9KvnfMaKM4qzhBhGzqh8x0jb3ke8O9XV1dXV1dXV1Z+kPnSEQRkBQ8jDX8rCMdSaT4FN314T2ey0/yAlz9tAXT3V9zKNlBJ7vYR+6NLb3TCEOMjL11NXV1dXV1dXV39WeoMeB3qcNTIx49qZiToEs8t0TsgTMe5sbJp6W5pGCtD0qutV2hJ5yfEZgoaURF1dXV1dXV1dXf2IXrx8jIrBrMFmS021wp5IizmOY0Ld7JnKfwksSXnKq8cdKgX1lv/2iPe8OeIOuzEjdXV1dXV1dXV19UM97GTPX5Z7hIFZpzFmsBcqTpcspX17+ERWYc+JOLDs5xZeP98CE6+VRiWIlywiIiIi8jc0cXI1uPUYnZp82rApf59UQoBNHndlR+a9UmA/6IepzTat7E1FIZ1XCTp1EREREfmn4DgPPOmwvsya5JtkaNdTnMMCey7JOOSDjZ2qq8OUhehL7MNUgTLdV4MuIiIiIv8X+mnojhlCkT1HCpDKua+vj98XwwOUqzxXfVvTfNSsY9o38R50vZykZHG0XYewjfzQterq6urq6urq6k9Gr/jD+3N8PmpuyFjjERIZszqxyuP59qFVz5nr6GTTpnf1YDLpWaO+8+LcyiB0vDpfsPzxTl1dXV1dXV1d/YnrEfi15x+rlDmpLPQOzESlMwZoiKF3fSqLOmYK/jxVbdn1CEBRvWbVuwi4c75CR0Tvuq5cQWjq6urq6urq6urPSMcyHrh4YiQAbMU0hCp7hD6J5LCwnskfDKr8QX1xmPJ32tLNXl3N37wXEREREXkkvJlfvZp1VNkjAEa92HV2Px2JHJGSeoosxifWcaQR5uXF/Pp29ePT17vjjrsoIiIiIjJNvm6Or59uft4u5hczemOKzYXUd+1UuMfqjMmHLTERhmDXtyX29vXl4uePm/Vqz8+ViIiIiMi0Wa9/fF9cvm73jp1NlIA+9u0tKu0jtcOw7npicMKtM+V0w+ur5c2H2+XHxbWIiIiIyCNh8W7568PN8uoFbey49QGJmacjmPVhBz3/hgAIrw6zy+X62/LztYiIiIjIo+Lz8tt6eTlrgOp0v75OhX0bRvDs2Hb6YRKPiFXfn8W0dxfXqy9vra6LiIiIyKNj8fbLanHR4dYjHmtkxx8/fJk99/I4d4HHg9IJAy/n32+X+nUREZHf7N0xcqNAEIVhdQ8HcGhXSSqsVKkD5z4HG+s8vofvuKUWwzMMdm0AWg31f4IBJzbhc9djBKBC++Ofy7NG7H2X5OfIrn1ZYrkf03z91wK7nt08e2ovX/RhAAAAUKX3r0v75N+pEiN9Tr/d/t8meyyq6exmI/vYy2d3bAEAAIAqHbvPl9mvPp2RC+R3jeqWLwrq2m9yWNWFmSb25M+X7q0FAAAAqvTWXZ4V12Od395RI/Y47vv6qZrz+Q/rsUSpfeTcdTTYAQAAUKl9152TD8znW+xZjulxueusXUk9H6V49jglpXPXtQAAAECluu7sEyrFiGrjxbYtqzOdFjfxNIWhgO+SkhPYAQAAULPrhD0l9+Ri7nY9ZTczYrc7xnaLY7KnY8nHaZ0JOwAAAKoXlZjU59tgmrJfF1FMt13QuH0t+u3F7utxI676uqREYAcAAEDdbhP25CNWtmJ2t6Nf4rhfK8Z0xE9WcI3XTRP2lBKBHQAAAFWLwD6O7JZPcytp1r12VLdij5hho5opH2bso7ROYAcAAEDtIrD3Jm+eFqUYdddNL4GuXGQ33dhvGzoWm8O4VxbY3w/HE6p3PPC1ugAAYK0Je3Kx2zpjd1vzR/P21Vi/xpn767tyuj6N7O41BfbDCZtxaAEAAJajCbsXoT0+xU4xRY5em95uzR36+d1h4qJCTE2VmLcTNoXv1gUAAIsH9vkpu5U9dnVT7lJk14um8YmloO1hFNerCuwfJ2zMRwsAALBWYJ822UVxOUfntbeJseI6M1/3flFev35yaG8eP7Dv6a5v0Me+BQAAWEAO7OI9K4bsZVTXAHyF5G76C8NF/zRM0no8qqRBk5qHD+zk9U06tgAAAAuIwN40zbTGLpGHJ/pOeXyUqtejNswuv/MqfX0903Q9NM3DB3b6MBtFKwYAACwX2GMSnY1KMeZlWh/OIUyvx+LIN2b5Ih7rDw32poLA/nrCRr22AAAAi03YmySReXtWlGLUZl95vm660TTfSh5POLP/elNHYD9hs1oAAIAFKzHN6NXTNPTY+4Z4tusPtWLWrMSM/yPQE0w77Ars8fC9pknNwwd29l/fMPZjBwAACygn7B4zdjG3wvddFldkCuvK6v+4oWMTif3xA/tf9u6ntYkgDAM4jdl+DFkGBNtDqiMWFbHgxUqrUiXaVopRwT+wCr0k9OapggcPodDQ5uwtX6AHD36B4rH0OzS0FJLQizvvZvI6O5Pdmm7Q1OeXuO7WbbO5PX19MivgHPMBAAAAsgnsiqqPmDV2nrHT08aNFXqSoTZi3PdM4shuLOc4GhP2GwLOscs+AAAAQFaBPd5jv2B87NRdYo+2lqHcNEnhl47k6Gk02JnK6iMwYUcj5lxDJwYAAADOjAK7l49wkT1n4ro46SZpbsYMdbUYXiCGngmNGP68Kf13wUgEdqzpeK5hZUcAAADIAE3YNeOjp9pY9IjTDXOzv5J9VNd/69DOcvHIHl40B/bRmLALOM9w8yQAAADIKrB7zsCujamnOWKnTZTYObkPAb0AD9mTB+w8X6eN4uU9Lz2w11utk1CrVU85b2+/E9rfSznv4tFBO3RwdBGB/T/nAwAAAJwNV2LsD56qB6V1jusa91PMxRezL8LoAz1et+fr/RoxXV56YK+3aj1Jkb1+2Nnu6hwmnDd53N7qah9PIrD/13wAAACATAK7xzP2fp2YnBHWia6Wk2EW2J0jdvsDpxzXe4ndU4+UwL57UvvNya7fxx7Fda2z5/dxRHFdax8hsP/PfAAAAIBsAvvvlZi8az12Suw5e8DOd0+KdrMypjdjeqvxLsd1zuskz9In7K1aTKtPXt+O2euT17dijjII7JvNj58FjCAfAAAAIKvA7uV7LtjLsbtXduSwztTXsqbr8tZ03aqwWwX21MC+W7PsJuZ1tpeY19nRWQP7l4+fQh+/CBg5PgAAAEA2gZ0iu9VjzxHuscd1yyq8ydQY/eEFYhyVGDOucyUm4oVPLyWw109qlpO647zOtqXjOG+yvWVpT54psK/++NT1Y1XAiPEBAAAAsgrseY8De68Wk7M6MWYrxl7acSzrSgyFddoa6Er07xJ0nY71HD1CgT25EJNeijncdjj0LcdbDsdnCezfmp9CX7+qbfObgNHiAwAAAGQT2Dmyk/gNT3U0Nu9zynczoscw8D1O1R8ztRsFdnuFGPV2UgN7veZUt87bdrLOm9xymhw4sG9GbZjvQnyO9jYFjBL/1OYWF+d8AAAAgKTAznFdJ/ac0YpxLu3ISX14od29qKN6MLpavUKM5pHxhMDeqjm1EhvsbC+xwc6OBgrsurze3BRks/lXquzVkvhD5/ESBuWf2uLCwqIPAAAA4A7s454V2XnCnhbZ+ZOnQ7pdEm1idD3H2V8nnjaeRWDf33ba92MOtpwOBgjsurze3BGhnW+0bWZfZZ+W8opIsBzI1yLdfXlLDGpJbojUSxhR/qkthHwAAACAPoF9XJdiHPc7ZVFO5qyud7jInslNT/n7+afS04rsrhViuMROaV09EwL7Sc3pxI/pbDt1/Jj2llN7gMCuy+urgmbr0Zx9dbAqe6NYbIg+5qUsiwSPpCyIdLflU5HkXfG96OepDMRAl5C9lXLptGfaBzYEdgAAAMh6wm6P2FUY5gm7qxFjDsMzXyWGfyOIyZk3TcrFV4jpDdjHRzSwr4UpnVZfp2KMLsN8Dw+aa+LPPJdybtDAXi1UZkW6QE6LJEsyGDSw8yUM34vXd8WpzD6ctQ5sCOwAAACQWWCPIntePQgNq7u9cLMQY9zxVGf2zJn3YnKs6OiK68Z0Pa/zujeygX1NfcKUV3XUZZidtfX1rAP7mRVlIM4U2P8Rpw3sKw8fckifDQ9WhAsCOwAAAGRWidGR3VooJm0x9ihUc2ynbVbGuM3ukGP2TU69vC7EjO6Efe2riGrrrLnz5cd6SLhVnxi5caqUEtivVI3AvvxOsOVyw3G64TofP5R3BJm6bnxbaSo5sDfKDSOwl6u//9uy43T7EtJNTdk/vVQW7F3JFdirDeHAIX22t4sJOwAAAAwNB/auvMelGKvFrsvjml6+JRKl9yzwwu56ik+7sTXYecDO9HydCzGj+6FTCuw/Ka+zZnNdcWbfpYqUMnhKoTQIpt+ow2srQkwHMhQE8RR7O/z6xisd2EsT4WEwEyX+8owMFYrRj3pGAX5Cnf6hFASlMGIHE08K4XHlhYhsyPvqnAX1UhW1Kx4HQXWmImXwWsX1gK5gQpjeX1KvMq8De1EdVt4IPpAzJcGXME2nv70fbAjHJbgVgqVnG+GFPxNX6A3MRy88IUOXikIp3bs1cXtmcU6IR1ffvL778tUsvd/5+eL0+5JQVqp9EjvvILADAAAAG05gV8mWWzGU15m5TgzhxN7b4bidaWofo60pltjtRow2HhrVZR2jwL6mquxac209ImyNCRm5JUJS3pHkEs3QSWw2XZHkWhTY5wNJKuqgFMjIPP2oV+F2rvulB3T6A7lRkeStUJalnAq3FRlZUjlWyglJnqoZOikIRqeQ4HYU2O/KSKHB/yYry71LeCYjM+p04xISbMhbktyks6M3W9bvr6jebKGgAvu1hffiZhTYb6r3++KtCuxz5SiwN/okdv0XAjvAL/bObrWNI4rjtdvUyTuUIoZuQLmQ5GNskDASCIplbNnIwl8yiz8E0QebQm+0+AV60QtfLILc5BX2FfIKIb0Joe/QEhNIQm86c2ZHR2ON5ILXdVXOT9FaK492R7n65eQ/ZxiGYRji3oTdzsSg+xpbJ5Qp21B0JSVbp4uZBad4tJjowU6+bnVg18zpxklG2C9/Mr6Oun751J1hP1W1ar+WAzhFxQVvLVobqrO42wHY7uaFRRag3MsXA+2wcQjBhd86AFgXQqwAVLt+EcAb2XIOYKWXryXD6wDwY6t1DElDxgscuQGw0WtdhACRNu7Gqq9ukBdR9wCCbte3AzwBwPNBQV4EDXwAEHai1XUAlUqR89mNWssAB2YKvhzeLhTaONyawmxhh3B78Bwky62OvHhdvunJC541j/X3q3u5fj7qrDSWRezX2tUoiuTNdk87rThqbjW7JOwuY8eDYGFnGIZhGOa+IGFH3L0d7VDMyNm/Gh2oW3qa+XX6SbebsmmSgWydfJ2E3cmnmQV24oPL1z9Mjvvo8vWPmTsIO0K6/lYIt7Dv1TeUD68axQ0jLcEH7gx7D3TqfKAN/Fx7vjgC6CnLRQkuNnaMLe8DrOhSuhH2C6HNfqyp43n9WEheYGW+ltzgEKDjzrC3AV7gbQACvEaAmXVPnUUAGxh9b1yYKUjpPkRPxuHWFGYL+xmOQlOP9H9A7NTRscv40ZK3LiSdan8sw97ZPY2EpNkckLC7jJ183c3t+5s2HPzGe54yDMMwDGML+9KSVWGXfzSk7O7GjiTSlGDBZ0qyTj1i5MNZYidfd/eIUSzNEvZXfzmWnL5yjPviWHLqGPfss2PJ6bM7CTvyp07DvPtZkLC7GaJZo6hLQiiPCXvsayLMn6wKRQMNfD2pU/uowTmA4khR8Z1j9F7JhhF2PDvUb8cBnIgREZp1TWm7JA/QHxP2yNfEqsYfxnrK+LtAK7oo4jUBwjVhTaEEoaDh9hQ0dHUrEoMCnsymBJ5QmDvJkete7nSiS0xtV3+hbnMQU4bdaew1cRdhd/o673nKMAzDMMyEsH9rUuzIbF1fnKLrlGZJA1pwqk4sFm1dV0+zZ5ICY/hUYF9aogq7izeTwv7GNe79zAQ7ce1KsN9d2FHXr14LMUPYT6qN9ZwHibBvCoVnCXsfNFnl6YEwwjtACc4iADv4HgSVfn5kyzS8qIU9kedOEoA3vz19XsnmhkbYW8nnX4wJexk0VXXPrEBWkpp6mFV4AHtYEodhoxbTFEJYFwjOxZ6CIQRN0/r3i2Qtea+ihd0v7pRLXojCXvRypfXlXX9c2OPa7p5KsDdlhT16CGH/LcMwDMMwDGMLu1F2BUqvRDkwsqgehoVJTOdFqzKe3l6n+hZTEjFqbho7wE7CThV2N59mBmKI9zN9nbh2+Hoqwn75VHVlfz1N2P0SIEbYD4UiZwn7BQk7ltSpD3sAIyryzc1Qv8wntkzDOyTsyYepqWMvBMQIuz9D2H9U92yM9WFvAtEXIq7ilMJ+bKZgD6cpuIR9a7awHwaA6CkWS7jotO2TsOdru8mi0+bAR2HnSAzDMAzDMA8BCTtlYm7rxW7HYqhJDEViUsIsN8WfTmNfcGyaRHEY+XW0ri/dIuw/vPnLysO8ybj57v0XKw+Dvu7i+rOVh7nOpCXsQp5Oz7BXAMJGv7YdzhB2v6c5myiZD8ErJvS0Bx9gD0Vjy3UzfNMl7EM4THR5eLS5uz9L2M96Gl9+yiqZRwCNYgJmXKJaYwgAy3oKOtyCVKYLe7OnETOFvam+2fHh6bGZ4km1XpGLTq0K+1rh7KzV7eZ9HYnhRacMwzAMwzwUJOyUikkK7FYvdneJnXw9xVWnFIWf0tFR4moRQ5smSVDXJSTs03n1aay8/mrGuA9fRrr+Yca4Zx8/j3T947NMesL+VB6nCnsAof45Tdht2nYoPevotbLqAbQSWz4H2BeKdYewY1NH9GCU48EsYScolO4lGfa6sMFmkyEV+YMIZTp0Cbsbt7C3k7+dczNFbMbeqOfHM+yUoEdh57aODMMwDMM8FCTsS1Rjd/Ril2ZsOrGrhx2IsWLsKS45dfd0xElMj8Q8SjC6TsI+S9k//SX5hLo+a9z7379Ifn9/y7jvr//4LPnj+ns8TUnYr36RTBX2pCnLnjMSY06JfdAJk3yAwnucdIkpNFa2hV+vd5LI+xbaMkq4F2HzSIewX4CHt1YjJUduYYeusFkGKCYpmwD9Peji6cpKXqzV62dUTccLH4I2+h24q7DvJEtlPTVF/+hgH9PrjXoBhd3H75J0ifELZzFvnMQwDMMwzINBwq5wrDulFPs4NzY7VdjtYVJy9gWj6w4WEQrEUCKGerBbwv6f5RZhFy9Hwm66Ok4R9hBgN443A5ew5wG8LWGTA9hoxfuhNvAogKAYR9uhctlYnmxLyR2SLYuG2oP0fAVcwp7VLWm62NklOnBk2FG3Gy1h4QcA/SjCFa660eSwJ/LyNNQnAxHVAsiOpjAEyLXbObijsONc1geikAWc4tDLnQixtdFQTWr221VcftqVGfa8iFtbSVvHKb5OL1nYGYZhGIaxSF/YydgRKb12jF1qsbXb6SIZO/1JMxSDF8OnuY2zwC4nZgs76fojI+xP5lbY9TLTtyTs2NXxpXun0z4ggSvDLkK0XIteAEhFC28NEtrJnqOB+n1/ZMt+Vl++PyHs1NSxDMjQJewFkOScU4Zkp9MjSOjo6A0E6kk7nTZDUHg7dxX2KATEwym+8HKlbFlm2PeEEHmz0+mJWXTqO4Xd15JOxu6zsDMMwzAMQ9yPsH9LJXbKxCgP1kwpsX9ljnZ5PUVrxwOxaI7uJuyPDImuz3eF/fLy3a/yxa/v5CvT1fE1BmOEg/NAyfJWCRqouMVxYe8p3RY2Aw9U1byQCG/PQ9nWH9sM8QSVFLVd0i8Pc8ur2o93YGiCNQNq6hjVQZL1A3XzUxJ2DMoUQwBP2HRCvMsFujcOkZTQ/uODAC/WG5tC9Dw7XK/62CXGnsJ0PJ38ObG6xAxKABDs9JIuMVnVJWZjX+DAcy3sYoDCvhqJaRX22tgJV9gZhmEYhrlPKBKDUIgdubnmdEE/CKqq44v0sBrETOvqiKV/R1PHbzVzLewvr1DZf0ZLv/zlJyy3v8NgzEvhZHUtEtOIzvzJ904KYoz4ZC0vDN39NV+4C/lnwmYDyqMr9nrxjClMTi+vbkn42z0aM+iYE5sKhOKu+CergsirrjWG2I+TF139yo3vOGFhZxiGYRiGSFfYnzwZU3Zad0oLT9GLXRH2GwX2lBMxeDVHF/Yxbu5xOplgfzKvkRgThnmL9o7Ht5d63em/TxQEaOWx7uhCUFPH+2YvCKro8QGUxdzAws4wDMMwTErCTpkYMvabmycZrBq7FV/Xgp3Sxkl2iN1WdseSU5OIsX19njPsQhXULyVXTwXyVG93+quIxb9PDqDU3qwEAEfCpoXBkvsnUutpL85LGHKfGzLE7XueHmUYhmEYhmGmCTuV2KXtuvZOovq6NvabmAhLGrV1CsTgw5Z180Dcu5yqr0AF9nkWdgzDSK5em/C6fPUwtELQlGNh0ysfiX+FDiRUxfyQ+cdsHR3x/qYMwzAMw0wVdqm1ZuHpIyqxk7Ej1CXGCLsdY09J2vECdElXG3YDBdi/pm1OSdd1j5j5jcQgJspO4fUHIr4oDUOvsi8eju5BLgxz9YKYIzIMwzAMwzBpVdifUIld84293akdiSFlp1RMyo1ijP3btu7owo667u7Bjr7+eL6FXcQYZU+6OjJzRoZhGIZhGCYNYX+MkRjKsdudHTVG1vXB2jjJ6Dol2e8ARdfdO50mc5jo6oiM8jDk63NfYRciVn0dMbzOzB0ZhmEYhmGYdCrsVord4I6xm0o3kQTNSbM1C3ddbGr0f6LAbpTdBGJo0yRqwW4S7PNfYVe8vpJdHZk5JMMwDMMwDJNOhf2xSbFrTIHdKrF/bWVijLMbVV+gqngaIXYyd7oNNWF373NqJ2KSBPvjx/8HYWfmlQzDMAzDMMzf7N1BbuJAEIXhYBAJio9AJMZnyCL73MnnH3eZ4lG4UUbplqYx/5fAMItAlk+ll6oqgT10Yu5tYs902EWT8So99rgjxp6U2C9CWlde14T9MCGw498R2AEAQIPmCXvqxOh20j5UYhbXTtMjiBP28rSudkyM651959aw75K40pEJO/6/EwAAQJ0J+1sqe6sU88Ot0/nrTFPwKnUYpX5/y2tddsK+WzZi5rje/oT9OGDVjicAAIBCHtiV18OxU7PNRvbIInb5fD3+rKbr0m0yFfYk/cKqsPtfnDY+YSewrxyBHQAAFPMOuxK7bicprptQibl/6NSeajXY03+C9PFOfZh7Sx2br8R8Dli1zxMAAECNwD6x20k/TNg7FysxiRaxF/Ctjor//gkqxIQBe2d53SN77mhS6xP27wGr9nECAACoEdiTMGK/WsVugdjEvH4b2UPQrjNm94q82Mfmt8SkPoyP2F8tsk95vfnAPmDlTgAAABUCe5/yehJvnV7+6PSmFbOxyB74OPylBnsvhfaok+nX8QK7Evtywt43HNhpxKwenRgAAFCvEnPZxa7AHlvsncRjpy/2eEn833pb2BXZfbKvO6cz5fVEef0BAvuA1TsBAABUmLD3c2TXWscwYt/uFp2Y5V+dahm7puPlax2V2RXana6cLrawXxoxjQf2PwNWjxE7AACoMWE3h7fFJnZfxe60JSbeOvV8XWVJjMV+/55eS5ivK7Frwq4BuyoxfbuBnZ2OT4HNjgAAoJB12CcH3xPzanl9n1kT03mJXXldzvm6xCa88sgepE9XJUYDduX1m0pM325gJ68/iRMAAEAJVWLi7SR12L0R07nYYtehU6+eVzid5Fk9PYetjuHOaXbCbny+3vKE/chKxyfxzYwdAAAUUGD3Frv2xCiyu05CI8aflLhLePqf+BtnIvs23k3KD9gbnrAzX38iJHYAAFAgTNjnwG6dmLP86aTN/BWE+nmlToyndemuxTunJhPY35sM7B8Dngj3kwAAQAHrsPsmdu113OfyuvawR56vFborTNmdXuUqMbv0UCHGE/vBlsQ0O2Fn//rTYVkMAAAoCux975WYdDtppkqMTid1sljDnlSI65789TKsYe9yjRhzNWBvesJ+PH5RXn9K3180YwAAwC9YYH/vtSfGJ+ye2OOWGFVi7En8clLNzH53wq7Ebs55fWcTdjViNGEfxwEAAAB4UON4nrCrxW4Wt07VYt8swro9Ko3YtdPR3k/SZyqu686pL4nRhN0qMW8HAjsAAAAe3zjGSsxkf3cTu2gTuyK72RSN2bVoJq50VCtGFfbu3IjZelzPnk3q3wnsAAAAeGDjqErMZHHs9M5ex9tLp/OTAvevqVqjvK64rrNJF2FHTNjCTmAH8Je9u1ltIgrDOO58BI3JLRjJgCDi1lJFtJiNQUFwI1Fs0UJjN4IbF7MIvQZx2bUkC68gIIz30Qswm96CM2dy8s6ZmcY2k6id8/9VG3Dl8uHhyXsAALj8VGCXxC4NuyINu2I27G75rZjqe5hCxS5ykxjfWwxipGKXwN6+RmAHAADA5SYNezz6nhfsV9VdR9mwe74s2EvOsKtsrQfs8ncVTvZzMY6Xil3kN+yLr5zqhr1Jww4AAIAa0A17QiYxuZeTvOLLSTkS2auOYjLB3wjsbvq3kNeNTUzhO6d86RQAAACXWxLYdWIv27A30sDuS2AvD+0yYXcqJPXlV2Jc6dhzZ9jl1aSraWJfBPYWDTsAAAAus1xgT15OkrdO/fwlduG4pWFdPlZiRvbChN3N0A+dpht2P/ud02bT4i+d9no3ugAAADVwo8d7k9nAfq0tDbtK7OYkxs9NYlKuMYiRhrwqqdgNrrmI0RW7DGIamYZdF+xWBfZerwsAAFArhPb5hl1/7VQCu3HX0Vt62PGKbtkXRbtT+ZFT9bvkmVO5EiNxXTHPsGe+cmrRJIa0DgAAasn6yK4adjOwS173cxW7hHU3v2DPP5jkVHw4SfJ6aWI3zzrqgl1PYhZ32Fv2bNiJ6wAAoLYsj+xxYL/eas3zejGxz8mVmLINuz7AKC37qiSsS1oXZZOYVMP2hp24DgAAas3qyJ5u2I0zMckQ3Fyxe76M2IuH2HVcl6he6SunEvtzkxi3bBLj5fJ6/EcCuzUbdvI6AACoOZsTu57EtPUkxrzE7hcOsUvB7hYLdvWrEse8NeOYdGb3Fncd5UhMIx3EZN9NsqVh5y4MAACovRuBteaB/dqiYVcde2LJy0lpcM6fYTcr8hUZWd1o2JMfTRp2pZGp2BW7JjFdAAAACwS2yjXszbKG3Ut+Eq7mmBN2/bmeR06lqS+r1xVPJ/a5Yl5vpgW7DYG9CwAAYIXgP/F52N+PJmE06A//Qs7UgV0l9kTmEPv8ToyvlJ11dAtnYpzqh9glsBsVezrBkX5d8dPI3sgFdsnrbRteOu0CAABYIvgPfNjbD6P+y9ls9msQTSaDvQ/BhukrMdKwN/OH2MufOnXEIlpL2K7UsUtsN7glL52aBbuO7M2Ebtiv1zyws18HAADW+Pc79rdPoygaPOuMO8ej6XTvXTQJJ0/fBpulAns7ZmxiMnm9If26cYndHMVc0b/WV7Gr32dEdqnYl72bFKt9YOc+DAAAsEgv+Le2TsIoOpluj8edm7vj6Wj64mQShSdbwQbphr2l87oK7HLWsdCwS2I3yPX1SqMYOQ/jlMR14WlpWpe8LoFdSfJ6vQM7eR0AAFjlgon9x8ePP4JzGw6D5V6EYRiFe9s3R+PtO8e7o53xaBhN4n98GmySBPZEU43Yy87EaO5Zd2J00FbWlNqdksxuHnWcR3YzsctRx9q/dNoFAACok9evu8sFF/Dp5+nR0enPT8G5/Dmw96MwNtjd7owOd45v3xlNR+Od2SSM9YPNkcDeLjvr6Cc/6kzM8hG7/lQqrtgT88beCOvJj0R2o2JPO/ZsXrdkEkPBDgAA6uXVq/VV7N9Oj5TTb+sJ7P1QFezPb3d2Xsx+zWbj3a034+PDg40ndnMSE0d2mbCf3bA7jtGvpwuWmP6s+oVT/RjTeScxaV5XjCsxF/3S6f7dJ0Elh/ffBKu69/7Rrbt3vz7c3/oepP78n+ku8eX5weMHXx88Phh+6QIAAPxm72x6k6miOO5rNOpHcGpmIsYa0xdIiTRNa5iQQqAlQChCMw9gkw7wUBM3M9FF40oTFy4mJG6aLk1d8AVsYlK/gW5c9QO0G7+C5547Zw6XGWgLra/8VRjmzty5d5iR35z+77n/ChmlPeORQuzffyZg/ZdfxOtn3xv3UWEqsGevvhQ6Pl1Kpq+vvvxx5+a0XL1cusAQ+48PdcW0Xbf9EGB/I8jqiMAeyhITCrFzVkfmaiJu/G8uaJ9uieEIO7Rp3BLzmgrsD/OwD3efP//QmEupWq1gzKSNreeB3KR8fHg+R4Ddaw9c0qD9T0N2zdNo0YvqBJc9lcyhvtBC95Bj/jPr+n/JW5y5hRb6P8kulWx9mu4bYv/2OwnqBO7ffTtvhD35JerHE0B0yMJe2kl8mT8sXz77oAoudvFP0niA0s9BR8Z9xGkdyRMT6WHnNOzsYUeAVj0xDNvz5YhhcseK2RHDUj3sIQs78jqMOX0IsA/34LSVjLlUqM1G7MP6c0UHnmEcP78T2PWJKsTcUcUK+iT1Mj39UTXMZByqWrnh3P6mXDhx4/G4bOYAlpK4aHZ7++08cbxaph3mPjmobYwepNDerRdX9Qep0u8fy713oQUrum71+yU9SprnecY0fADxJyf1Sb1wZzAAdtGii0zRmWxHn1vKiWRZzfp+r8tNZ2mTOrCWWt/vJUcr6dJXMFHD5kGmqx73aDddHvJJZSkN9ry/BcfMZH3dNvQ7tBzvO/qM4kv+7ro2MhlTNss05Zta9FA5mUxFfyrxjT63rEymqt+pVCbzTws6LLTQQk+oT0qlA/0OGfcQmNfZCvMDfvhlvgi7dX0l/DBXP96+f3lT//LHBMj+uHl58cFFHXAdouzXlnF/xZ+D4jN42DlNDAfYKcauADvSs4rrPl8/il4kXlekznMqFR5zqprYgdcR2O/L69ueMZeG5ZmIvbMMx/5wt1ixrI3iznPQlrUOrzMH2FMuaDdVsUyrktp1QSl9gs4zbf1Rlc9kDImGY8gQjw/wvR4XEktJXMKHiaYbR5FtjcsQ3VHLAdN+2o+jPjH0B+gwHt/FhZU4KKbrq/H4th6l/Tg1NlLlOMgkMorFUbuaPkWrosXNyKKc3/W9uZEk8kSa63FUDL+MRnxU2egONLbjKLccfBv+NpsTkd3cGjuucRBH9dN+vZU4q8s7agNxbP0vV90/63fwJGyyrs8qvorurCubOacFcQo7mYylFD1UlUwmrz+V+EafU9hRW79LRkZg/UILLfR/Ub4EqswXYmdC/1wsCmj/nPh9jgh79kshAHb77a6YMSmRKCVuT+3Li6UPakDrD00V46Kt4kGWmDcVS4yP7GpWx+nDTn1WV15nZnUQB+2ViU5fJEcMz3SKQmBHT4xP7DzmFLPEzMPrT0/sQ8HrO63AHZOAj/HncwB7Fgh9m6/1yjZ8zt4X2Fczma6y9EClCC8OKTCo0osm4DFd9MHZPcgKTt2Nk/YA79SyWlDW9xkmESetzADs+CywVUtOBvZufCqwD90RYM/GSTFLn6zNOKgYGUiIkwbz80/4RGoxpuQwsEd2oNGXnxm/m7yLM+GcrNAGJzrK5OMmqBLWIe95RNj812qfmrKtTQ+S+3/mcfvbcwE71xWtTKZMN2RZ3jyjRf9EYMcbfYqoO8U5gJ1ryTT0hRZa6P+idgnUnhPYv5EeGJHO8WdY/AwXpEPmm5kj7B2IrqN+/Pj9w/Y1fNpL7LRPq5dnz94/3BPrIcjeeaAlJn1/YH8TFFhiXlNGnaomdgDl0ZmTQiIry+y0rgbYJ4fYX4rKw44iCzvoIcA+TBCvPwqxD42H6Hj8++o9lzKmS5+gLvD5+pLOWlqHNd17AnsLg1m89FAFP8C1TC+KXhwgcV0KwHA1CFmvFLy8gNejsTJHQFXXaGREjF1WLGLra6ZTgvf0DMB+Eo/vwNtEYDfdycDOzwtmEDl3U6utT/vUupCoydHAXohDaxzNa/eRbOeTeiIJTPsnHa/oQjsNAOtPAsEB7cgOxMSaodYVDxlrSOOC5qum0RSV6JHaEqH0tWoijpWCRHz92NIbe/Cekg6peLxEx7bYuhH/W4D9BA66392oi0tpunk6J7kXzutcwM51sdTH5BYumPLvUtlMb7TonwjsTNrTt6o9ArCbeUtfaKGF/i9aLZUyR6WSNZ8n5jMaZfrtL1+hfvmWxqB+MXOEvfmlr+tnH1ze3rSvr2HG06OPu5dn73xwVv9RjjttGvfXyYMHnXIi9tfIEwOimU4VFztKwrMC6xwenzepY8jCzkF2EvE6Enu0hx3nTXqLPex38/rOvLzOxG4/hNg3ws9XiXmA3Vxx3f3xeKLrrhh/CbA3KBZm8t4KvdiIZyrPuMByhK99Qy3bpe1touQBhIYpOB2bAdhht+w0YD+A1dHATu1wYwTsYkODyL070VgBhTvRwL5DXa9C1/X5FD6R+PeMPDVBCdTmoRuRHegQp+sr/gNRDbYxqRIn8n+vZF8qgW1GtoQ4/ZgeBMCaY+khxaDFfy2wU/PqGCaG82Tq0zU/sN+tQiaj0U3n4W3ZHC36BwI73uiPBOwLLbTQQiNKlUqHyVIpOx+wf/fF1z+J95/AByP1B37+5euvv5g5wl4HNww6Ym6WPjotH17aR9e3h+XuJQD70kd2AnAddGw8hcJ52EN5HTlHDIfYidZVDzu8zOVjZ1bHF1UvKSH2KF6XaWKEgnmTyMN+P14fGo+iof1AYk/AsQ1FtedSszlicq676flY4rpywdt03dwUYPc2VmV1puHALyhUzktiLb56jqezhq1Kw4jAWfpb/lomsyqXtG6qQfRiWFkIbVqWp5uWJVwYlgWQgtFfVAlBissQz/3DDiRRegEGGSOMayRTGxO5xigUPQJ2z4Kgb9OyjADYu6mWgjpQKx8jJEMYG1YI2OFDJfDGbBKfJ1M2wQxhfX09BOzUqbVgqcPjWG1YJhn5bHHDHIWlbFSuzvCJRPvPduABOR4z6aQiO1AEwxCZWOSfIuCEnQRPT8Fl5NnFoJOfkA1dA6QXa80gFm/QEkTf9ZA+BRCuKsC+Wiw6ms7Cq8GUR7T8XsO3J7e1a9XIGAy3j3egukTldvD9LnOP+ORXRLvlwYaWx9ejRyv01WzXVEb6pvizesmTaNfoHXrEtVW8f0zCbSrCOxCk0X1v0gO7tlpZhS5RKSx6ldYIsJvBHp1Ki46P2+kNZxh9Q1PFDaWPLdpcvdFNy3E8bbQBptMa0sdMJocNCMtsOKYK7EOnNbql5zirpk6d4I0aGtaM67Fqa8NaJJFZaKH/jozd0r5p7pZ2zbk8Md99/Z0fUWd98f23v34BwD5rhN35kizst0tLl93L8u3NVe728vQyD8D+wSngOtplmDofH9ghr6MfYh+1sI+Y2AGOxy3svq9cjbLPH2Gn/yhkz8Q+MRE7TZtEaR1polPhiYG+3Q3sQzHOMwGI/bcQewvGmzbUpPzP5wH2pYHr2joDu5TtuoOlScBezAhV5QA3qRwvYZgsq5fxU4GQsYcfU2R7tri+FL6L7fF9iCMY3TrSC2CilIuD/lCWnkIwRBVwq5EyPZcmoIpJthym037/tADYNwa4+Y6hR8jBwkFTAjsZtHcksA+3+jgyUkHo7JTY6L7ASwJ2D2mUGiPXdWUf3dSoUWWghYGdOmUFS6t8xriCjm/ZPzb9Ax30sTgcmAyfSL3sup8GXvFd1afvRnfADiop+EufBGb2gwBvs+gb6h8FAet88KBwICqjenlpM96PHIvbGAX2el/pK7W8R0fx/LYnMBWSHItc0VWF29cIupSW38J2YL3Kjv2VRvsE99s2/OeLTXFSenFf+DW5+omLByb83ZANGVBDlEuehXWFdkAZOFzE7PXEbQWv4Nk+7/XyXASf5ddGhvaaHCHiyfuwZ1HUO98V+zKwD+FjUWyYlRs6tJ2REp/bDj2mnsu7fTWw76ifHVme1Mdu9GEzg6qaVHHrPGhRPuNLVxU0/NxhYK9mcA09POflAcuGnyVGk81oY6s86F4Lz8K5Bh1bjEldaKF/v0yrlU+WU73MAfjXi7qeLZX2DjK9VDmZb1nmw4H9cwD2b433vv5K0deA63NE2G1yxPx4++yseXJzVT+6uro+KV8mYdDpB8/qe5jY8ceyQXrCCLvM66imiQknieFEMSQm7LmSsfPOzOosddAp4Tohu2qJ4TTsCOwz8PrTEzvj+f7YivsBu6ZHquq623oI2LVt161OAPZiRqo5Auw9XpLATh9rpvyDO8nyMT8Z5HrLU8VZ/Al341Lrk4B9VT9CyEM1kMG5bMx2ofa5SLBVo+3dtQhfNyF6HZE1rgD7cmx87GEaVkaaGdhJYgTAnpctIJzcUMZWtonGEGcnAHuJfPgdevrI0xmTgN0KPm5J0qEWhzOOhE7kqJapQRxgj+6AFYTp93ysTZGrRRtAT6hIatPUCcrJ2bOt/OmhSDsPxCk18xVNbVRaZ2D3aOgqWnBIFb/KCo2CreN7irbtq8Qebp8K7FlsC11apmrLN6gFse0RYP9UBfY2XW2Ob84n9XT1ko8CdnUHNrAM0Q6jKM9FKXyFdyJ3+Z7nbX1eBpBnYJe8nsWUTaSK3C4JBagC+W74hlZucIcev6VqmnKje20qyPoNoC2Fs6c7Cdi5q0kf2I0cramqB+yZstum0kyge3Gr5zLtbPB/r4UWWujfrGppRBYa2VmR+KLdGWH/3Pj+iy8UXkfNHmGvXQXAfnFWhg83R9dXicSXheolRNgvjgDWhXLGU4g97BRhZws7htjHPOwE6+Hous/trPl9MeI1MsT+shphH0/rSLx+z7SOpcfkdSb2wv0dMU2V1+8J7Hq06mR+CRll6tHADr/v3YaTyqCFxWslISLXalm8hHQAqraconjDv9hDkeNVetKhaiIjoLrjSR2XxbC+Yrbkj+Os2EeAX7bd1Tu28CXYtq0JptseGTVpjpYFasTGxwcmxbBJylW4XEz2XHalsIy+CLSWa5s+AldtGCCZsW0HgV2WiUbmgseC/uoUYB+gFZyA3WDcMzFvI45YjbW7tgiyWoGPZF+fBOxr/qErA5/ANRdaULfrgstT8gS69ULygAatJqA4XbV3ODkiK3QiWUPpTCclodboDqCtfqUBn+twpCE1adcAlN+GkuAJabdQgD6h8abBDm/LfwLIQcVV0SQ4/fCOCL9iI8quBDb4Jp5mBvYElO43e8uYWobVj7uUiHHbB18Pv9ed7Fotxsdmqe0LA7tL9hxaJB2LQ2dtDPQzsFv+9VhAYAeVsuUD0RP6BmO9ak8UOOolHwHs4R04c2On2cwC+ZbLQKvnzWbT46Kuj+QZ0FCORC1LDO/lG3kBux7yMiiXrFQI2InX9Rqsz3uOoFvN3+68K3fsyGzomWJl1elBfRLHYaHbss+xYsnvdqNRFYTNN7r/AJFsdARIO9SAotNIwhtcvEarBeWtVsjsbiKrtyrQLB/Ym7Bw2GgVM9JJ18EDWoL4qwTssvpavtGFZvnADu/tbsMR9SyGpS600L9blb0SaHcdoupVfECHaPs6rturzGBi/xyB/b0vvvjiawXXv3vvs9kj7Glww1zBfwDsp8+qkCQmd3199OVO4vayDCH2sxuAdYHsR08406kkdoqwCwleVyLsr6gRduRnQnV659Gic890yrQebYpRA+wotsSQJ+Z+Efb08wg9INFOtzZBXeNeij1/PqmBMwF7wnUrUbeC6yYmAHvP9GN31UmDTmXAzI/omYAcPgYYsDeGDBEfZC09Jaljl2Y/ahK92BwaJtRqSEgm2HGoLNDRXmlFYFJAoMbeXiIGe7UpRQmivAfwVYjIt+2uSi8LDzqtBjF7t+NzmqtRA06mDBdsy0D3qIe9SSiIIew8DeIEuC1yTJ6APayuAPSBINkdDY9AbYL2xvAI/Q08xxJrN2BrLM5gMSvyRLK21Cw20IFUZAdApmBRd9CHl4JP4aK2wUC8rFIeHds3p/Q9CqsLcbA9JfbHfqXp24Y1Uin+00OFgR1D6AW6WIbKEIAOthmqkAA/wG22/S+9r+mscPsigJ0aSZ4kkgdNrFGUnIGdr0cJ7Fmsuy9bu+z/eUbbkaeYL/koYA/toGZudICDKbcjFyFBFwmIu7CQREtICteCisjHWFzlQafM6xpws+bf5Q25Xc70d6zJu7WJJ+5c3rZZqA+37yFPa7C6JTPWYDnf6G3+H0PZb0CXNpwy6DQJ7cEv2PaB3cIHEdmSHK7nvxkwsOeomTUG9nP6v1dSX2ihhf7Vau2jGUZREVbtt2YadSosMQjshOwYW//e+PyL2SPs11fkYb85vLhMf3mU/fLqpn21d3NRuDxbWsoCrQtdGYoedaZTEOdhVy0xzOsoxRKjIDviNlH7o8ycJF6nJYlhZB8FdhBNm3S/mU4/nATsHxr3Uqo2QSmDNf34lsGaG9g3XddSLTEoy3U3J2U4Jv9rdgqwd+VSDn9IW2M/w0a1a0YndUwEzuntaGBHDWDJC5Jy2yFgd6WlhbvciaOKGhnJfYpQI7MqkWpuFLAXgzIZ6EMMZmAPe677FgM7Wi/cDen35gyBZI4+5pj8ZGDXyNqRsGR7aTtzZTDQlBD5irTQ5IImW1w86URy5BgbrjjcJ3Vgbcv3mvDESa7vVHH8vhEAJxBwayP+eDhDkn3hkKi0KT+j0eSTGjrwO/ynhxFg53Qxu4NBV4mXQ58NOCgCfh6NP/aUFEFq+8LAblH3JT7zoXpBpbUpwL7F2YRkv7ygh5Z6yYeBPbyDjCe3KCVMm3M7UpG8T8+RY9u5TIoI1iR8xiUD7+FznYGdeB0ktyQ1goC0iaDMKmPEndd6vfMmPkb4126TWsZjRamemj7agBw0aDKwQ8McWsKKymylwx1t1ZUugX0Y9GJIwE7NaYkWLrTQQv9uWcK+XtNZWg1WHFi6PkuEnYAdJd3rX/z6OWR5/GL2CPsVxteFJabd/PismL75uFwuXp+kb88+vnx2tlQQJQLaDUWPOdOpOtWpMnHSeFbHiXnYX5D/ouYfdfqiGmLnuZNUYod2oYE95GFHXkdg/+dH2B8b2Aeua0YAu+m6gwnAzj+5U4BdCzjAlr+XtbW7kzoi3jRkUXcKsHcFHe73jmMYhc2HgH3Q7yNAFjhPYl8CpKj8kD3Qcq9U21dXCabWQ8CulCEpkfWaUMtsk1b9OPWJ7gM7T6KUaKehQGYKJGlN309+IgGPgT1JNRYDS3rf7YtXW+f2hjSULLkSxJ5LGMhtUG2fRp1IUg5j16wYcuuEDtTQn42IvmViX/Z4zZGP/8UAjdfxQWlvDNjzbtAvt4Er4n711sAPLG9AkcHAjn1r6BHykLebUAoPQfgwcih9UJtljbbh8xBqXxjYR5MAbRKw8/BaVH8ysGMsl7A/SXWjl6iqXvJhYA/toGZurGVSnNtxtKiMCN3LFMGWQhzcYUotUuS8zMCePOdyWDzPm8HJYoxuKlneNRvr6SDos6rE1wLdq3yjK8Cek6uLQYMsBdidrq9VcuBTrN3mMbSyow35p7yipQC7QuWpANiHRPApfaGFFvqXa1gHQO+Z9NHswcc63OTzRdhRX4N+F4nY54qwA6/Dv6Afj3LJs8LNbbNwc51u3xTOlk4vzpaS1z+Ggf2RZzoVWWKI19HDTsCuTJwEAlT2PewhXmfMnj3KLuugGkjM66EQu2KJ4XlOOa3jffKw783tYf9c/eeeHna2xGwY0/S0EXbOwz4V2M+pGvnD2JQD0KrDiKSO9MNuqQ5hYwqw86i+tPAncxnLKKygC5tl1Vw0siCN9qUk7bpU275iry6GgJ3LshIaD+QmDOxenGRTYJqAnWPPqK26b/Vw1jeRUxHY0WSxqgB7gmqM0YyuTYE6wvQuWClkyR4ebQ9EheSQ4b7Ge4KuSZEnknrOIKpzVsPoDlRhec8CeMvRXE7rwjYvIpwHvp1FGOiDRmyHLTGy2ysboraB7zZqJBJtzpvpo29TZ2DniyWkgaizBG1eFudgGXeHz0IrxxIc+TyE2vcAS8wW0/tgMrB7o88mOb6ej+EbUS/5MLCHdwD1Atps4y0noBzFRWsilmwAOFsCaOEliVRbZaTOIy8XGNiFqJoN/NSzVwnYmwzM2OOWnTvPoBpKxUTfrKKa1DGZ7bWDdFLcgPI4sPu10wM/XY4OrKBSUh5NOKDzVN4cAfYu+17sANh1lLYA9oUW+i/IEHOcZgxKnwUf2vhh7gi7CK+/JyZR+vkewF6YZokR/4Cu08Wzy/pt9fbmNnd9knz2wbNnZ2fdOuJ6tCVm/plOOUsMEXsksIcD7JQmhhwx7GKfWxL+sUq2yKNvnmc65TzsQYCdQ+xgxn9LAfYnycI+f5YYHnQ6i6Z72BnY2cM+C7BzEUWycvJ3XiprjtWWDQJ3+li8eBqw6w4alDdzhDtcxlpG+GKhZ/1TxB5WfwzYD8nBAIshYOcKk7i4BvsbE4Ed4+9dBnYpL9EXLH1gYsQbaycdSHY80icDu81WlW1BldReVlZUzzvER1VXQDXyRJLbJaOHA+zRHYgFX1BFPkMMOTzfg+9Tdp+1GTXo9BNYowVG9VzIuGNhyzd1Bdix8rCwNgs6tC/+XGHoff8MHflnZttTgD3UvgcMOt1k4//KJGBXdsWr74QNNetKLyKAPbwDZW7UnfNzgakytyMsW1yEIeyioHATmN7WDzEEX6VCQuwQsLMVfs1H4p4lubrKOxakKZzUoIpZUMqq8Y2OvA16KLBzBJ/ysGdYksrNJuWDYWBPcrOqC2BfaKH/pMwcQLofmnNgEUfbzBxh/3wU2DEr+xe/zhVhT8sI+5UA9pOzM/sGJjttX9drl2cw5PTsndP2Hnpi6oaiJ5vpVLHEsCkm7GFXJQmbszLOHl4nNzxWSrQenYidI+zRaR0Z2J+M2OfPw16jtI6Kjp7f+YVr07PEMLBzlpj5I+yrwU9tq5Cjn2+SktSxqN8rws5q5DXOWsJlLCcEdG0EsRwwbo2UHf3ru4UR6xih7/QI+y4Gbd1tlIg4b/UE0FBdpkwkKIv7ong/iPV3DUlyHbnNYC9da6YR2L1gFxcasrVliK19NWRI/5h9+S4BL6slPCWJeq9YCCLstUAAlwbVVok6kaj8eArIMoNkqAP4SKCxZaOGQL0ywqgWrl+vkZJKWscC9JeMI1I5HliguFDECdkWWoG9t7YOcU30RZ2EdgB0V8U3VqwE2RA1+xM4DrZOOQ+h9jGwHwVpHTtRaR0TPB2se58Iu4vdO3hohF3dATM3YtRYlcFFMuW4nhW3WzHTA4A9x8LpEfYiZnEkWckaVRuKsAs6rhW6lVYWgb1C9XCEvVohNfhGxzQ17WYy7zTuBHav48uYEGGvBJLn13TKCPmcJWaDjfPFBbAvtNB/VL+VKL+EWSr9pk+RNj3CTmkdGdi//+7rr7+fy8NeA2CXxH51dHz69kX5Jl0/vm4Xnj179sHS2dLFLQD7X5TWETQy0ymb2IVZnBSdhp3cMMTcs2qkjpCY1pWZTkUbCdjZEsMm9nvPdOoZj6Jh+WEzna7B8NY1Y0wdcLYbd8icmId9KwLYt1y3OgewZ0z2sI/YVDibWiip4wbFKVsU354K7OyNWVbKVut1YgdNhk8P6/UGk+cK1ryjTxQD2XEI2JWyNoIeK1xrTi12xx8n+hLK6vQIcICHUGTpLEZiKdm9vpr0JI2pxBUP+6o+XXwiUU5fju1kDSjYH9UBizoWPE7URog7hv7xYw6aT5g4yWWsLcivslkqVfj4nthEUQ3P3YYeJa0fT6TxvAxgQTkD1idxOjYp3L5GcDL2ANinTJx0FAwc7kwZdFoIMoDG8Orb5mw2SfWSDwN7eAfK3Kg7ti2GYNo24HPWtqs6FRFZGxh8dnChqHOgmj3sCrBX9SomSWRpXRm/FnjNO0JrMbDODvLVMfytMvirN/ohJWY3pwF7WID5VHXgYY/yqVoi22wA7BY3+3wB7Ast9N+UB651eDNNeAFHuzHXTKffKhH2378GAbDPEWG3gdSli/2qfn370Uenueur63by9Ozi4p2ls3ee2dLDXjZITwHsONMpe9ijJk56RR1yCi/j4olOH8kUw/LTSIYD7Cg1wI552GniJAb2O4l923s0Xi88JFwPx94xxrQLtnpafuqZTsPAXtZRvMTpl3sYWjOHQx2Vol9yTupIdGFSyLJE9uCJwO71+24jYLmCUrYGVKROznnC2Vjq6B/xMHcfytno6GNyyf5hRmaJSeGS5uJx9/okNEHv6qqyarFoV6zfLxIKEqmaI58t3gX38XSSOhCWrd0DAZucJSaBcM1kWQpC8tbGhqmzJp3IjkuOE1KROTLcAXxuGCqTLXV5e62PnpFsgK/GxoZH3n/aoCGfK5oMwVv4tVFPG35H1TOTxawxO+NZYqgh7iYy937cXY4P/IitRo1UmTDUPgyj8zS2SpacZYXtq5R6Xk+MAzvtEPOdPNTcYfAYZsGSp17yYWAP70CZG3nMqcP0ykUesDAaYUxccDg3DMiAJXMc2PN4f4IBFG9Yk27MJmyHIE87DsVrj5NGyYo9P0tMD7PEEHablmWO3OhNGo3qTAb282lZYrQ2ZYmh4IBhWRq8Dg1Zjl1EYJfNavi9WwD7Qgv9N5UvlVKAHwcHcIunSqX8XMAOr+99R8Au9Jnwsc+Rh90J0sRcHR9fffz2R6fN2/Lpxemzi4uzd5beOTu8+lFow3hssYf9DbLEhLLEcB72SWkdGdbxZV5apzrIFX/HzEkjHnZEdnLECAGvUx72OzXcQ2J/LF43HqIKDTlQJ0+qGHdJD4nMLyveGLAPV8gocyewd/AnVl3K0A/8oQSDLMXZazLHRCfVHOr4q1kg8MixHcOWGRenRNhjtJTAjZQylxwQ5kCSUCsIqa71JXBvUw7zRESsPe2nKdH2ovOwryF7UR52xX08WTHC8k/Ig55DDOMAbEF62FkHobA2bdal7mHja5RnEdobw90+wba6Etgd6n0e0Zg14UR6LsfHwwH2cAewjmXiXnSOaJxLfU+Sr0lfioePF/JM2v5xN/3eul7wJdXEO/XU3Byz6RfoiaJBKc6L/kNDbeXA4MlEe0jU9C1u4ztoBQ/NimofJej/lI7g+s89Nei+KS7s5UTDr2wAC9puPATscSvIw57jrw4bsoxQvAz9irzkO6XlKtcV2oGTOuoSWwuEoVTEU5wFjnJT99OliwUzhbH2MLCb5xKk80DkGgW0JbD3DNxR3vVE/lUfiZuw2lTzsOfxxMLnysiNXvAXhu1oYOeaVR1CVzya0NT2vTWWTgnZieglo2sE7NQ86NwC2Bda6D8qSLx+aKRKoJSRpLTs0TKmC0j9e/H+63df+8AOBnbQ93NE2I36FQqI/fj4un7x7tLZ2dnHhUsA9nfeARv7xzjq9Np4CvHESaFBp1GjTl+a6GHnPDH0MiOuM7SHeT3CEqPOdAotH7fEELDPROxPyuus43Fir8GKdeNOTbqGAc73dVW7APHG/YDdzMBCt6EsZYTsSj4Fb4f+ULOms3qYg3dNskRWhuQ7nNSRooyA2bXcdnwisBPa1A97mxTypjKa37Kw6uRcWNiQ3AMQ27W6x30/AXtD7N6z6ys8WZAKb/2DbDoWjwJ2KPsk215BjpsB2PHQ7m4Bp7Us+dMd9UupbCJ+P2DXxKH380Yr5xLQDkT3UscxaRMpCzd9r7nep7QyCVHcrO311SG4E06kIWor+Tqgbbhv4Q7otqij2Bke7ohDY9PFQtWzyqKxbTrOdqp54NKDjvh+63l7h2B1FZrXbztGBb8kg6ZyOsi3sgMoWQ0DO81ttVNr00ynom0n9E1JYNb6dISs2CjVTcckcrNC7aOTlvp0OQ7KErnvFboHlHve9bvajQeTRqnALmqqZ2mm0+1eTpywZYRqPOepujjTjchLfgdbQXWFduCkjkPJ5zV5JwZFnKqlSQO+c7Q9TDS6kTxHyg0DuwThsgyk1/JWPotcDNuB2tUK7mhJLj8vODjxKBKxgRU7NNMpJpnJbjgF+Hw+eqO3xPr8WnXyoNNzrEhXhIF12NLp5pSZTm2nUhYV+iBfaDXEASntPCZZFe3qwcvCErPQQv9RQWaY6m/+T1YVMsbMDOyfC07/7mex9DsgOmV1/Bl87LNH2I2m8LDjf9f14x/rp2enl9Xb28MLAPazdz5YenZSAmJvGqoedaZTyhKjemJ8XH+VeB2JXQ2wM6tTlH3uCDt5YqY6Yl6KssTwoNPX7z/TqUrsW2Fif3peN4bLwkLfoo9eHT5u3qMlph6truu660s6a2kd1nT1+wA7BfB6yhK8wjIqq6l53ojse+GkjqjOgDKauH+ydza7SgNhGNao8fcSrGYmwURj/JcEY5TQGCCgKAR/SipUEgv4k7ih0UUvwIWLhsQNcV0XvYImJl6Cblx5AXgVTmf68Tm2oKcV9eg8x3MOZegw0IPnPR9v3y9VsIOaBeo4hkZfoA3R4YBjxPoMndAJmhCzUkoR7NcL8eB1kkmwM0EN3NKkxd37sWCHCrjcAHQ6g+2qkH+C844Q7N4pGJ55BFnxRNpygo7c2zT5ADgV3GNGwTcCQGej5ZwNvk2Xq3oA54ni3U7hsOFRShfs9DLcoqCLAbDROGwty6Xosf0faBKZ5PpM2DwrBDs8UdBfVgdtTbqP4zm/S4m5Bwk0BX5ooQuAnONTSv7IQ1E+gLmSO2CoY0foUlC9OASBLFM407ML1wEXSVKwwy3YhQZGsMSxjm9gG+raHJ7DzlMkgWkcowiY+ELnNX5B30oR7BgnldawQQAnkmJOzUQXLVdj3gQo2EkwiRetUmIUin8T/Zag1Yov6FkdMfQdN8MIlc4kO9fuL7mP/dWxzBX2Ea+v8y8PHy7cE/649eVLd+wzV8zcP+GXv0Qm9hFNkL/TKQp29MSgIwYUO2fXD2Ni8pvYMYRdzPZ9iR3BXEcssKMlZssedlTsd2kuuhn0OmMUKfaT1VbHpEHnwSz6y8Gk2QU7qTF9fqVDgM4Vtl0jqVzgHRQlwU7tuFyGl9hXrW+xDatIBGPxC7XlYWMVKdTRIoDOUwNnFokFZxdzUVCUkzuOEOA2SYxpdScOCgcHSABq626AqZARx3skBYMPFpom2yEOWBS3i66gV6PZnTtkC4JdinUsFoQwhAyekais1ozvolkeok6WoKx4LhY/hWfsOr/GacXjfOM2cZbvOTj8mnuUpIBPJIhhxEmNiMEHAPQKsdi1NJyVM2svdb4jRL4Bi74qdqmRGAMEddWDw3YjnuRiIgOmCpcnDp9lqMemb+fMUoDfFTdYWsi1J45Q3OImQPr6zvCHVLBby6NQeQzJn0K/w8rNypXCZcuAWMfj8ZHWKs5SsBN++fFVCg/1koiEN1b8yPcfi7uBueQdKIYVNvmLUQeVDEMc7GuqvcG/hwOhc+944KDpyoJd2EjY6KAubmiAsBd7vhkQzogP170GuMSDkrg93NFAvODbAYQ6CvQun6XLrrojLcCGNfaiHQkiLbxuUHDXkaK4h6IuJm7GqY58swTvNGgNVhMpnoZYxztKsCsU/xZnbkUMR4SMhvzimQyCHXgdSfanwgcTuWOCD1GhnRtlslbYaSv2xLz93HaPHp6X21++NMKe67v+3J37dpsJ9hpNIX+nU7TEJCvs2OoU+yZh5yT+T4B+c/Cf56ywi3n4x9pzTtETk2h0urUKOyr2kzQXpSx6nRHceyRhBfRnIKsoOYxqqWPqZqdUdRglshWCQJcuCdkeDChB6GjgEUDXk6GOyKDrkR+h9erDlrdirFEaVuzTBAmK9XuTYiCFnLQv0pWTN8Y6SQGXl4eLpSHTQQhtsJVtAdq7c88SDw8w7TFOoU2bfBDxml28JvWJzPQAEKNfGfKmNYDWqQ2HLcnaoI/tgUYQvVuZSDcwmw/YQfKkdVvDmkHWQotNE6cgazF79hmNSKxcX1AUUhDpPLHG2nKYEiS9i5NpeMscds+Wf4sMmoM1P1MUD2Zyh0ZqQAoO/QiPL+vH6OaAnzCKhXDT0AkOj04TGW9gagTR+Ase01vx/n+wRurp6UdvpBEJ3ZCmCmBTBhu0KhSKfw6bafSPXcIpVtmGncERg3x4zoCC+uunkVz/RIEsFXZqfn7PeHuv68/ZRxguvvTcsOG6btn33RPlonX9s0nXkr/TqeRhZyRTYoRgR5Ix7CjV8wc7wrRShV1W7LuFYGdLTI913Kpgp8HwZIXmYlzq0Wx0LqNcvwoLzlxiJ82C8y2FJskOCPa1JEMdFYpth37q1CUPI4kSgGD/lWBy44+H8oOCPRP4Qv8TsOr6iJDYzB4QhULxzzFhvZICfCfu1q1J9gI7FWYYxqd3sXldGGPyVNhpLyqvW+7cd/2w3e4v2mE5DF2fCfZ52XX94dUiXUP+TqcHkjnseM5pjBDsGMMu2hnJqhr7H2UAdoUKO/8EVvdNQskul9jZ40HBvh24+OBK4eS5S9crHfrTkJV4lZkDzCoe2bRgT4Y6KhTbjxkzqkzZ95YDHpyNC3bwhKwf+psEO7zQfyvgpI/K8uYk+h9JoVD8e1RvTwlBprereQrsNM51ZPkwaF7PVmFHWqzGzgQ6+/flyaK+aPfCMLwfbc/9cFwew76b6nR6IMph3weCPUK2xCT7JoElBgB9vSM/aImRe53KjZOwxM4XiRZ2FOyHDjK2j2DPwjpZ7DUfnr80u3T1oQ1yfdOCHUMd1W9TxfakzS30Dveg098i2EfgGl8/9DcJdtj7txOI01AtcfKrQqH45zD7OpHQ+2a2AjvyLLKyY6pj1go7Un/7xXf9shta94bWk1YxLPtH5kyvz++XG40R3QQo2LHV6f4IyHXcI9gt5TqmNU4Caf2N2M5TY8eLADpiAKiwJzzseNYpE+zbqsKeCfJ7+KkzutAS6xnq7WrF9qTlQHrMaZLK8cePya9EM0YZhvIx4uEwGcAX+p/Bm1wT1E8ThULxP0O3wLMPUZH90zP6k9g2XUu964dMsDcW1ovP9Wbo+keOzP37USJ7r0w3CMY67otbnSYK7OkhMVLfJGh0BDEvOdmJH4Cw4GCFnbMbGiehYpc87P98hZ0q54lC8UvRanevXL5emRLF38io26/1iwZRKBT/NTrdEu9eoXn9xzRtuh73fui7bm+x+LywQ3d+grVM8iPJXjboZkDBzpBSYhiJHHYu2blYRkeMBGYy5jCxw+7osUlPdYz53sK+lwONTg9tLw+7UuwKhUKhUCgUufT65rkZmdi7Q8uymX/9yJGjR5hgL/v+iG4UjHWEHHYQ7IzVOew7+adsYhdCG8ir2mUPu7gz0OuxZI+WteybhOecxpaY/8HDztCIQqFQKBQKxX+CRv80gem69ufhosis664b+r7vhvcDuknAEgOtTvfjSadSrCOW2AFZrcN3Tk4Xu3zaaXpOzC4BFNgTiv3/qbBTShQKxVf27h6nmSAIwjBa1hJ/ISlCmgtwCKdIkJA6QcKcgNNwABIfgpsxnt12bXtsAq8sW9vv8wm+kLTUqq0BAASRzsDqafn78b78+V7klZi8EfO5SsemC3s96zi4sF9uDAoxjfJ6l9GtGDP6g1N7jEn8F6cK7L7DPqjE3PUvnU4+sJPYAQBAEOlMfD2/vOXT+mLx+vqYjk8rMbs77Dqx/7fqqGHHi7HvnGqMvdJsDTu2monxKzHWiAlRiUkkdgAAEEOKyh5Ouq0rMbqwq8GuxF4q5b4TM/qjU7VidLHv9X9vayWm22G3RkxW8roqMTchAjs9dgAAMH2n76+fiF+JucuBvd5hV2TXU6f1Dnufr0dzW+57dtgvLbG3vdmuSsxVkA57SmzFAACAyZunuLqPTrPNSoy/sLft/iH2xvdhMvf74KyuBXZpqkaMjcTMNrOOmQX2OCsxJHYAABBA5LxugV2VmK4TUz902qoSo7TuWJVlRFrPLK7b/9LUDycVs628HmqHncgOAACmL3Rc37USc60Z9qK+sNehXSsx2ehRR19hV4m9MXrptHvXSauObtaxHNjvgwR2IjsAAJio4HFdH52WCvta9W7SbFBhz//s2aRhWO+u6/o1Rn9arysx6sSowu5fOlVi7w/skS7sa3MyOwAAmJh5+LiuC3uJ7JbXXSXG+AN7CdBVJWb0hd1+6qeTfIVdF/a2qrAHezipCu1sxgAAgEl4IKxvBXY1YvyFXZUYXdi78KzEXvK133c5/LpuP/su7ErsrXGJ3TrsAS/sAIA/9u4et20giOK4KYmRlLB0rwOkppFSpWt3VmsgUJUDGAjgLjdJ7zadD6IDuPIVslxy9DhcQki0bij/f5HyUSRAusHg7RsAuDz26LRq2KXTT2qJ0cAe6WpSejdJd05zWSQm/Dy+Yo8WzTcoW8cN+/K4YK8Y2AEAADBx2rDHeT1pieki7IthSUwRP42rtCWmyL90qml9LMOuEHu6YLdLpys27AAAAJi++OjU97Cv00un2rD3U+zGtuFqY8+gYsfwPbVhV63j+OGkD5phBwAAwGXRht1C7MvGoNZRPTFGG3adTlJ4PffVaTGyYo8//MTu5vVoOLB/+UC1jgAAALhE3cBeHXsdlWH3mZh2Xve1jqJLR1l3TsNHf+ibNV9px/XkctLSeth5dAoAAIALocNJlmFPIzHp3aRu3d1PxMSvJu8ctq93EfmYm0+K2BVhH9awM7ADAADgEqglxj869Rt2rdilcLRej9+M9Xr8yULs/s2pqIY9KP2rUw3s1Ye6dAoAAIBL1BvYV9Exw176HnbTX7H7QEw7btvdo7P029wTmtZdJKY8htgVYV+3iZjwYcMOAACASQsD+3Xv0ek60JvTdMGucX3k1qkOnWayRHxf+8w1eXQa+Uuny0GGfb//BgAAAEzUfm8ZdiVigtFLp76JfZZEYuzOaQ77N4qTmRib1+e9lpjSIjFBE4k59rDX2w0AAAAwUfXWHU5a69Gpr3Uca2GfpT0xirWcn4hRJGbY65hGYhrlsCVm1W7Yw//pcxOJ2dYbAAAAYKLq+uu11Tpqxa6WmEVX6zjvTp3OfQ+7Otj18DRLYZmYk4mY2UgkJuoSMetVVWnDzsAOAACAydrWYcPuL52qJCa9dOpW7M5VbohdC3Z1xPgVe+R37Fqwu0iMMuxs2AEAADBpvUjMqtKj0yi9m6TLSfGjBbv9onbGrFOnusJ06s2p9ToOD52uV1FVsWEHAADA1MWB3UViltGwJcYGdil6fAW7fpNR7BgkG/ZiUMOuR6eqddSlUyIxAAAAmL5trQ27Bnb/5jRKI+y6dGp0/+gshe9hv0rfnI7XOpYtv2KvAlpiAAAAMHV1bRv2VTRS66hHp4EW7OEjNl9f5dLA7ntiZoPDSVqxuwi7WmKquGGnJQYAAADTtg0tMap1XK+6DLtFYoJhJmauw0kdG617w3bOjl2/NUrEmHTDrgx7IycS8/vteQMAAAC8t93N7ev94fHxcP96e7P7v5aYuGGvTkRikgW7P3Rqh46s5iVToR9mFr+2YXePTsvAT+zdm9PqnA37rx9PwZ8NAAAA8I52dw8vLy+H+8Ph++HwGDzc7f45EhNYhn0duF5H62GP4rCsRIyjTsaMELv9dWVsZCZzl2EvFzqc5Af2M2odn59abz83AAAAwF/2zqY3cSsKw2rVr3Rm2TVX6s5skggNUiQLI29CBIQvEUJQDIklIJGS/Viq1VVHmmU3s2FdwaKLbIeV53/wA2DTv9Bzr305XJsSY6et2jnPDCSAx76+ZvHM0etzX4hix3FA189G7cpo1F8tbc8Bzt4kuekUVh5S+zpuLbF/wR/hELt4kqS1djXD7h9M+nqg7GJYAGbYA1+XkRhgv0jMp5+Rx/eMIAiCIAiCIF6A8coBvGHftaaTybQ4n49WtsNZjeO0dfwhWDgJlP0AbzpV2zqquh6xdflTkDLFrt52isARwyV2LLCjsWNbR+zDHju8/rPCJ0YQBEEQBEEQqckvhK8vmiDrViYzmbrzeXnU8cS7+WeFfUdbR6Hs0tclG4GYjZWTfEeXwZjUN5zKxZgQ5Y5TSbSrIwd9HSMxscPrwOO7TzIX8xsjCIIgCIIgiHSUHI7nLa3sxLWyWWZZ0+K02Ft5DqcUW9ijGfZdJfZoht2X9rTrnGIz9ghfhho7fqW0ifkGhR0TMXtEYp42Jb3+tJZ3RhAEQRAEQRDJqS8dgdedZ0HY3UkWfkyLxUkxH3yytOJm2MHYMRKjVtiFHqtLnYpIuZqJSX3TKaZisGIfEBwv1CVG7cMOCF/HEvv3cbvEfPoDYzBqvf3pV0YQBEEQBEEQaX190ZlkM9O7ysidTjLT+fxo4o66jjODzx6sncJeFF1ihK+/jtGHHYx9ax/2wK9To/Ry396HnQ9CCrvP1kjMd5hhjx1efwq/SS0eCYIgCIIgiDQsHVlgL2eYO1otl51lyZ32evOpNV96zoz/WT4biXm12SVGrbBLJ8YI+7b7TqWrK8+JXV08R/IwaiIGm8TAGLf3YX+FK53GDa+zDeq/U5SdIAiCIAiCSJ9fF3hLN1Nc2YsLcHSvNs9X5m7GHS2cmWD17MJJ4ZVOZYEdjR0jMWjrITDKktjWAanrUW3/MrpwkiC8btKefdgjWv7xD5mLef9IUXaCIAiCIAgiOXlHsqhZk+Zy6DnVXK5q9trNfHEymdvOzKe9s61jsG6S7BJzgG3YBdEKe1TasUsMkLqpoxphxxA7HnljpVM+PqWrozT2oEvMD7sjMR/D4fWfHrm8f5Sv/qAWjwRBEARBEERCxgsU9jYU2G+gop4DvOa8XXGnmelKCrs33hmJeeUvdIqZGBT20Eqn/A8g1Fltww6WjU9pCErr0UgMZmIwwq6udIrGrrR13CHsH8Lh9ffr9jA/SaOXBfj/s7LXW81my2KfB28qtfwVIwiCIAiC+AdYORKv28vOzx4WntMAYXdW01EbhD3TdqSxr57vEgPKLn1djcRI1AI7F+hoJCZ1hV0+IksnqRF2rLBHff1gn4WT3j5i4iW00unTeyb48Uls8ssHlpSivsEJK+l6i7GubrAkHOsb3DLkRNfHjNkJdtu61ASnZRYlp1+wGOCW6TB1/Z5JznTdFLP1ctRNXRPYY5YUQxcYp3aNbaOgD9kL0tAVmiw2z8/dla53Yn+J8fIa0W+Z+EITBEEQBBGi6KzxzHlmvjQXIhKTm3XcUW9uTbLuQgq7U3wuEvMKEzFqhR0jMVhh9+UZjV34tdrfJamvo7Jvq7Crxv6VBI1dybC/iiHsb98+Qnh990qn7x4f3/6SQtjfaBucsY6mgRmfaxpLwqm2QZchN5p2JXd7ZBjxvW6E+9sioLpWZbupGcYVbpmSvqYZ6IWa1haz9WJc5bQ1bZYQHfdR2LYTTTtnaYkeDq9RbJ6fu6Km3cb+Elc3hqQzFf+bRxAEQRBEiA76unc2BWG3F57nzKq56s280nMn0Odx6cwCznYJu/B1jlzp9BvsEoPCLsBVk6LrJglvTwuaOwDP20vsAj6mLSudHny7LrC/9oW9uEPYgXfYLCZEoPLvPv0CpBL2wlCSTy/sl0NJ8y+EvaVp9ywmZQ1UrN+6OzHgl1YCYT+Df/Ziwl6HQQyYz0ADL3xRYS/rsMuLk3LlhlvwXXKDHgKnBQ0w/3Zhvxly4GAXQ06ZhJ0gCIIg/jNcOYhXymTc5mppDxcecFOeg7CzTPYOBD7g6tkKu/D1SJeYIML+VbhJjCh5o6oL8G7R9Cudoq1vybBLZd9aYJcrnfK+jvGF/dcn1dUxyv4r6HpaYVdU9rrVYqmEPSphKOyDVnFPYbd5oV7u+jiFsL9pXbH0XKBC3sLIxGy9GFBfLwwYp17VNCO5sDPB4Slq/25hTw+Mt8j2Q8wdCTtBEARB/Is0HWQxymbdfq3WXJmLm1VtVXF7Uy7szFwLe39Hhv2V2of9ILrSKVbYlRR7gKyGYzf2FGBjR3jsqrBjW8ftCyc9m2FHYceVTqM8Pv7yssIe9RsrtbBfS2Hn7CnsufW/u95wWGuLsFuRY6KwI7glcshi08ZBGKFTrddZOkbg63IodShZv8HxJhF2wFamDIX9uX1a6YTdCl9+9f26teWI18oFSS/seFGiwv653L9MEARBEM9hO8iwnMm682IxP1p6y37Pnbp5d5LJZDP5tbDbuxZO+h6FHQrsnFBbR+wTI1lX2FHaMbye+q7TL7aU2MUf1dgVXxeEhB2M/YdYwv7h7eMOXX9ZYW8aRhH9psyTFdVbK7Gw1294LruR94X9wWiwkgGqqxu5ePssoAlW9UJoTCjstQZY2nlNSjq80gomeF/X4L8Zl3BGhs04pSq8YwyFE3aMKruH8emngz10eCATMYVgtoDxMZxUzj6CXxuwU855EJ6/N3KHLA7GZgL8AeIsyniTCLsFv+fVKRPCLl7mbPHyGCaHIyeofgsHLFxeHRt2AmFXrkTbyF23hoY25vN8C/NsmEzMt3ZelN80OL553eXfiKHFOK0LXePJoKu0wo4XBYW9YZjBuZO0EwRBEARPxCDdImOVdq1i2+bMXCx7d257zoV94i5mkqudwv563dcRM+xqJsb3dbWtI4IrHaVQdjVNo95zyh+Ir+uRlZO+Vfqw7xOJ+cBvPo1m2EHXX1zY1Qz7vebTsJIJO95GacgMO6ioz5jF4RwOjluGxiSF3brUOIHjHlY1H/2INTRBQW55fS4/a4sKtG5rPnGNfQgOKRMxN+scdkWXRxTu2uKjgJcnvofrLA5jbXPD63J5oI53L2HHEnsnPGWwL3lNuMrmZBG+oDX4AeWMFbRqAmFXrkRJ0yriSsMwLjTB/XFwOody7nJaIxcMR0i+FlAYpxV2vChS2NVzJwiCIIjPnbwi7O7E6tvmcGHbs66zWCzzxbspgwq7O3RmAe3dFfbX6wx7NBITXTcpKHdvJmLEA807DbJer0TkRW5+ayN2qetqG3YU9uKbWMIeVXap628//G3C3ufm1b/n1dmEws7L13btBnR9Lex3XXjOdbsWi0NNAy5r0tnVMUkNH4Lf3fdNDfzOH4PeLdkFroAnvHh70b2VW3Kf7NbuDX84wtbtkq3zeHw87mDssh4+kLM10GAHpU5DiOiJP4omHzcX97j7zkc3VMebQNhhsrrhKRM2bNbMAvyICnvD/xB2kkTY1StREn5caFzbXJvNPvwQIzmDdx9Q2GGThxI/0b5/V+/p7egetjhJJezqRUFh3zh3giAIgvjcKTlrZlBhn0xGQ89bPNhe12nkZmflEZTYs9mpvRb2kx192EUiRr3pVK2wY4kd+UIBy+v8kaa8Lp5kiH1rV0cssaOxK20dpbC/5iudxq2wA0ouBlo5+nxkLLWwa3pAWRF2C8xnwOBnA96LK+y4MxDbdnAbZf1US9glRhbkCxd9MPzImISGl4Pa8QA+q/NXhaMgD1KWGXbcUuev6peg8ULYhWce7eFvBV+dB1zc5WzB2VUYYPITO4TRCHX1d1rin8WhIywWOLzyuQ6NN4Gw98Bjw1PGy8uH/DAGSHFY2O/gwzGfET2RsKtXosSnoCcK/f4IumK+xVHON4Q9xwPsJ6DX4gtjMqAFr/YUdk2XwK8sdFGksCvnThAEQRCfOUulwj63pj0ThP2s69jDqtGw573elGUz06U3C3h4tq3jd4J1hv1rtQ+7ZLPErgZi4BE8J+7vuNnNPQLauhKJ4WPkbEbYD/xEDPyNX2FHZVfSMJ8YSy/sSE8R9pK0mgHo0/592AtiN31fQhMLOyuvUyG3LDImoeEQtwBD9z+ssUt4kgvznKjCzj/rMM41WJ3FbOnIYI0sBuh/PBFzJoV9DLV0Kb0FUaSu8wo8SOxAHDJ2P5wS4zRkaiM83v2F/QgEOjxlmrjAvl0bYWG/lP+96CQSdvVKlGTUyA5GUJHfIz4sFPY7Blj8gHhPACj9fsKuoDP1oqCw47nTQkoEQRDEZ0/Xc5Bh23Xny4VndhaOaUMMZtErjopWJjNdrYV9+JfC/sPGTacHAN5zGi2wo65vWesUFzpNiUzEb+Lf5hq56VSgrnT6bTjDHlvYZS4GdT1YAzV9H/ZuwEARdp6ALglgk9jCftENuBe5EcyiJxN2oN42fYk9joxJaHgOVFfQgaPzV/W/6sOO4xlyT7Slv4Fo7jFdOV/xD6WwV8ANSwJ4d8yPWOE9bdrCtnXtMvb/BM5UYQ+Pd39hz8OEhKdM6XMTEnYM3FuJhF29EiXpzDafFuBOnqKuCDse3+fwT/bO56dxI4rjLf3d7rHnjNSbuQQUERUpSqJcNlGABCOTBisOIRIhK8F9kepjK+2Bw1568Rm5h/4D65P5P/wHxJf+C30z9vAy9hJiG3qA99ltAjSJxzN7+Ozb77ypvqtnF/b6UCKEXV0UKex479TmkSAIgiCCZWEPeqbrhtNpaLaGY3gOpqbleZZTcmaBFHZ/dR92JRGDxp46OGnJ2ZOyzh8K27r8jC9XZmKkr3+11CXmG4zEgLDD3WTcdLqk7BheZxHPlWHf15Bargw7ClIrl7Aj/b2KSDmrYxIaDg/IPqvJa6aFHR7q+OM2F8lRVmFnDe5/p/xKcrbeaUvMeW33nEfY+4cgnUd80GvR42/jVNscuI3keLMLOyjzRJ0y7MMuVqOcEHacvFoeYVdXAq7ekcJuxcI+SAt7Ha8vu+JwDopl2NVFkcKu3jtBEARBvG58Rdg7va7bXXQGc7sZTs8Xi7DruJ5rcWG/D7Gvc3CSEHa1xI7CnurCvpHuE4Oxlpy6rkRikn0d05EYzjfJLjGQiAF4JObHDJEY5AbD688s7IdPKOyX+YTdPDvbWjq0aBvGlBZ2bYm38F3lQWHH8eyCOwqRzCbsMgwDDz05W/zekL3IQYdaBX5e4y/sZyndq1Onjje7sJ9zzT9cIexbCWHHC+aqsKsrAcKuPyrs6vVHDQ2o708KC7u6KJ8TduoTQxAEQbx2FGH3J2HV8RaDsDO4DIbDaWvsOSVXCPtUCvv1g11ifpZtHbHEjl1ieAUb4HoMgCkrfdjR1WWVvXCFXWZiViZiNj4biQHiRMwPEIjBCns+Yb/7yJ5d2EH3RsVOOsWWhtv5hL2NyiZyx8qYMOjSYEhdXrNvGCfpSAwmxo18wn7CxbrC3ylnS5dVdFT6k4Y24X7aPARxXRMQy+rydtFGcryZhX2kwc0npwz/XnCIkZg4V46Td5FH2OVK4OJVMwr7MYxOvKewsMtFQUFX750iMQRBEAQRKMI+Xcwcu9fSPaM9MwbnrZ4NTdgdi1nGRAq7v6JLjHrSKTaJSZ90qpTYFb4oHmLHFu7RpyVL7ECyxi5sPR2JwQx77gr77yzi9jmFHb7UmWB4fJZL2N9KZevXMgs77ppEh32rjinW8APZ1P3k+FjnKnYk72SiCDuOR6hwOZ+wc1mHO/gNZwsGOYwn73g7GnRHbOAVz+0MpfvKcvCmkRxvZmE/hhlLLeN9h8iyiLRXYkVvipnelxe8zCPs6krkEfZ6/A8S5aLCri4KCru8d+rrSBAEQRBi0ykybC1cxwvDcDG5bA2Hg5nrlErMYY7XuX5s0ymedPoGN50K0ucm4clJ4ncE5s1l/rxghT36HPFr5Z5TGFWiwI7nJgljL1JhZ4I/r66eU9hPQRplHXmYS9jH4KBWJKM5M+y8ZTcWSTvqmISGi6scy1foPLz8VjZgPEoIew/fDXKcU9jhvY2lZipdYdPNeCobkV3XhHju8+cRW5N+HZw5erW1zTedJsebUdjLcFfaTmoZRX94zrn49iC26gMh7O14wXbytHVUVyKXsEuPHhYWdnVRpLAr904QBEEQr5yFGmKfXtqbbjVcLCbQw6EVeo5V2uTC7rb9x9s6qpGY7wTJLjFS2JF0G3ZUdfwid2NHIFVh/zLZhl1uOpXKnjjptKiwf4SvnlPYhWjV9YujSy1LH/ZpR2JEheLZaD7Eg5PiUMl4j63FWIMX66esPOZR7FN1TJGGi6vsV0cGbw/SB+/l31k7B5E974JD6vevrMC79+C8fL4RMa+wl+MwOM7WTAMTbZ4MGvEuy5Ym7Jediee12ePx7TPT6g7qGtBIjHd9YYe5P5u81YAJSy2jBuwbI/M4Om12Ahdqj+Zv46Hyw/x3jct8ByepK5FH2Bsw5NHI5KOpWIWEXV0UKezKvRMEQRDEK6fNfV06ux9Mh0Zp050tzoMgmIZz24EAe4kLuy7bxIQPRWKwwo7Cru45FaQj7HjSqQTPPyp4dFLc1j295zTd1hFDMWqJ/Q2AXWJyCfsdPD2zsJcrWsy79TPsCBQzuzVNgsIO3rS+ME00pJsYk9RwvIopvFeyFSXfsQEkO6prMWcsr7CLtivny7PFhrjTUnYFn8TXHrD16dY1SWVbayTGu76wS2oGY6kp05A2/5/ytQ0QZrxgo5FD2NWVyCPsZ1oM/5xCwq4uCgo73jtBEARBvHaqSiQmGAYTBw42HU+gvt7zbMtxIRTDmGUZwzgTYzy06VRW2L8XPNDWEeRYzbBjJAZ7xPDnoqCwq31iNhIHJ2GJXYmwY5cY7utA7gw7u4WHpxH2LW40yK6IkBzEJeRJTfju2nZzkBB2dhEpfGvChV1+7LieocI5l20Jt5ssNaZaNPZydN1Dk3FODyNP27p/ef3+ldaxeHfDjCvh/RzC3tZANXG25B0BE0vKp2aK4WUs5Frb9UhXL/t7WkMdb0Zhr1WO340YkJ6y33ajz4zPEGqIb7YOQZiB0XEd3nxQhpdlE/ZTpq6EmKc5w3kWWahdlHM+d0lhZ63o7aeDWNg7mf4Qo7CriyL/5EHQ5v7eCYIgCOLVcyIK7L4U9iDwe5u/btqzsDd3bdt1LNdiUGN3upfXkbGfPFhh/xnbOoLrRhl2GYkBkpmYr/DgpBip1kuyXaTGjl9KMBEjSVfYMcPOKR6Jkb3Yb1DYn4mLPeOUFeJI32KFKJvts7ZprR7Tlm6Wl6/ZtdgDnOrzPntyrKq+02fFKc/ezcpPPF6cMpwfs780dYYyWaMT0SWmxXKAK5ETa653+/yuZ+WnXxQQ9vjeCYIgCIJgbHq9hB+cB74pOsNYrmd0bRB2xynBD+x41+mQreoSIyrsb1ZEYlIFdvWgU3nQkWzzUpAv8ZckiuCoFXYYlPR11djjPadv1q+ws4+fFGGXXP3FUNgJojC79brJOK0XGRrhwk4QBEEQhET3fayx++fnwyAwHMe1m9XeuGrzSAxzSpvM7fl/c8ZsRSRGKHvk64DS11H2YRcIWcZEjAL2ZCwQYpdvx4wNko6wC13nA8SDk1RhX7+tI/DnXVrYbxkjYSeekiMejomy+bUXWIYmYScIgiCIZU6EsGOIfRgsTNdtGnoY6rGwWw5U2PUAEzHrbDqFk4fUvo6fLbF/yf9LhtjFg6SotasZ9uhi0tdjZRfDAjDDHvu6jMQAa0RirqSK/3WjCvsdk70dSdiJ4uCG2kal9kJ3ZZKwEwRBEITCwMfOjr7fahvuJrPNcRjOzHnTcl2+8bRkecbwb6DDkGRbx5+jg5MAyLDjplOlraOq6ylbl8+Cgil2ddspAldMltixwI7Gjm0d1+zDDtz8ySJul4T96gMDomYxJOzEU9E/1wR1g71AaiTsBEEQBLFM0weuI2kP2k3b3SzZnh6Ge55nNl3btS23ySyzeslD7DsPCvuKto5C2aWvS5YCMRvo65Gjy2BM4Q2n8jAmRNlxKkl3deSgrz8aienfvI+4+4dx/vl4Fwv7e+nnn/79Q/CehJ14Giy9czY+eoF5GOBk54QRBEEQBIHs+nGM3dddXlFn3twIF7pne17TBlzLc0tQcwdhH7D1hF3NsK8qsacz7JG0Fz3nFJuxp9hINHb8WmkT8y0KOyZiHo3EsNur9xG3TEbZubB/kimZq/t4DEEQBEEQBEFk4yKISuxDz+XC7hozfbzoVb2m53Fdb7qOa7uurV//7V8w9niGHYwdIzFqhV3osXrUqYiUq5mYwptOMRWDFfuY+HqJLjFqH3ZA+DqW2H/ELjEP8Y9oD6NG2aWdf5Bp9psPjCAIgiAIgiCyUvU5Qdfl2MYg7ISL8d7c88Dgo2bsdtOzu4vAWBGsaYouMcLX36zRhz0y9nQf9tivC6P0cn+gDzsMQgp7xGcjMd+vzrCjsX+4e69G2TG8HnFFaRiCIAiCIAgiF20fCF1bMGi1JotFCMLeFCeduo7juE2IxzS7jK2OxPy03CVGrbBLJ1Yi7Kl9p9LVlcfcri4eU3kYNRGDTWJgjJ/vw/4TnnT6CH+pUXa5ATX29U+MIAiCIAiCIPLR8f3AjITdW0ynwfQyNLq2bZVKFhd2ZjW7XtdmnJUHJyVPOpUFdjR2jMSgrSfAKEtuWwekrqe1fSN9cJIgeW5Slj7saOfJKPt9eP1lbg4kCIIgCIIg/hf6C39ouk0bfnuLxfR62tHntuuUNkuO5ThWyeEbUNkqdkQkJvJ1QEZiBGjsaoU9Le3YJQYo3NRRjbBjiH1DsnzSKR+f0tVRGnvcJeZnjMSs4pe75Sj7x/s0zJ+MIAiCIIj/2Lt/3aahKI7jpFDakIxsVDZC7HSBOWICwdCFAZCCUCX+LOwMeGRgYGBhYUZ5BvIsPABvwbnXvv35+KIo1LEUS98PcVQYKsafjn4+B8ClnZ09Pn+/qurA/vjh+Z+376vqRxEC+8oKMTZhr6pSxFViZvWhU3ViFNg7l07tTzqb1A7r9XRdX300o/W8EqNOjCrs/tKpErtb66jAvsmdL18vquy/Ptds3g4AAAD08/SJBXb7PDn/89B2Oq7Xltfts6yWK7t3un5RZrJKjErs6rCrEpP4AXsI0HklpveEPT3Z6SRfYdeEPc/r0y0PJ+W+NyseWeUIAACAHXpXB/b3z88fPn5g8/VlfN90VYWmzP17pWysxMzUiPET9iaxa8IeTLKXTlN1vdcy9omL7KIJu0vs1xIldtdh14R9Wz9bgf3DtxIAAADYgbNw1nTx4M2b8z8PqnK5skXslYX2xXr14qzcJrDHvB6kS6fXtSVGgT3S1aT8blLM7X0puRv7FuX11IgJT37pdHp0MWCf14F9UcoWVfYY2D9+KgEAAIAdWVo8f/b79/PXb8OAfVEZ+5fVsjRbT9hjXs+2xDQV9mvdJTFx5K2oHult0f6XTl1azzrsKrHnA/Z06TTsdfSBfdsq+wdWOQIAAGDnU/YmsFtUD/thlst3Z6Vs7rDP/B72aX7pVBN212JvpGm4trH3oMWO9myasGut478PJ/13h11VdsrrAAAA2L0XL189erZeV4tVUW5Fh5NuKLDbgD3QWkef2N1KxwNfiVF5ve9bp/bJR+zxj0/sLq9H3cA+01rH7X0pAQAAgD3RBPb5xV5Hddh9J6bO636to+jSUa87p/bRX9oOwiN1XM8uJx35PeyqxAAAAAAjlSbs84sOe16Jye8mNePudiMmPkrefaR5vX67ib35bBG7KuzdNewK7HbpFAAAABipxX1tidFLp90Ju0bsMnE0Xg9Pn/F6/Eoldv/OqWgNuzn0b50qsM/DpVMm7AAAABix1lrH4+iiw37o97An7RG7L8TY03xfer9je5t7RmndVWLC/zFoV9indSPGPkzYAQAAMGoW2G+2XjqdGvfOaXfArrie3zrVodOeUiO+rX7NNXvpNPKXTo+6HXYCOwAAAEYr7WF3jRgl9uxwUiuzZ5WYdOe0j/Q7Jhs7MSmvX21tiTlUJSYM2O3TBPbT02JwJwB2osDAPmDMvp8A2EPF4E5PdTipCex+xK7Anm1hP8j3xKjWcsm47iox3b2OeSUmOOxuibFGjAmVmBszAjswKgUGRWAft+93TwDsoWJwFthvprWOGrFrS0yYYJsQj40lZbeHXVk9Tdl7T9hTJ2ZjI+bgn5UY0zRiplaIYcIOjFCBgd3CiN29fQJgDxWDixN2f+lUS2LyS6duxO5c6Vti14BdO2L8iD3yM3YN2H0lxswJ7MD4FBgUgX3c7jJhB/ZSMTBXiTme66XTKL+bpMtJ8VNT3zz1z3tO2OvfE/9seuc0BnY/YNfdpJjYCezA2BQYFIF93AjswH4qhhYDu6/EHEXdLTEpsMukxa9g1w89FjuabMI+6a5hTy+daq2jYcIOjFeBQRHYx+02gR3YS8XgNGFXYM/fOTV5hV2XThPdP+p3Oin+FB7J7yYZVdgDP2Kfz5mwA+NTYFAE9nFjwg7sp2JwmrAfR/9Y66iXTo0G7PaRlK+v9KXA7vfEHHQOJ2nE7irs2hIT8/qMLTHAuBQYFIF93JiwA/upGFrcEqO1jtPjpsOeKjGm24m5qsNJjRStW2G7z4xdP4oaMbV8wq4Oe0Al5i97d5TaMBBDURSbEJLiHRS0ie5/b3XEqLI8SSgdREdwTxvnq9SfD/FGA9QkSEVgr40JOzAnSWZbYnTCvr2pxHQD9njRqV10ZGteBi3+Y1b9xAn7/lKW12Nib2dONybsQDWCVAT22piwA3OSbBrYd9Zhv+/CXkfbw640LHsjJvCdjAMldvtz79i4WGFXbcB+CRcnWWCnww4UJEhFYK+NCTswJ0nWHzrVi07DXsenI/ZFP6cSuz7MaGqPHfZ2ylVpL+dBX2vnHfaW1zWy02EHChKkIrDXxoQdmJOk0w67Xpy0u9390Glc6xjjepfW7VuNttjjsVO3LucRexiwH7fEMGEHihKkIrDXxoQdmJMke7/W8XrosP84FGLWQ17XqG3FmOEDp4v+HoUTp6bf6uiVmI1Dp0BBglQE9tqYsANzkmwxsPcd9n7E/rrDrol79J5TX8beWU+LHS9hTczVA7s1YqjEAOUIUhHYa2PCDsxJkoXAvt28EnOasGs8jledaqU8dmKGD516K8Yn9k37f6ctMXEP+07zuo/YPwjsQC2CVAT22piwA3OSbLYlRvP69os97JrYn+xhb/l6WNjl/mIP++M91KV5Wom50WEH5vHVIbD/BwJ7bUzYgTlJMtvDftwSEyfslyZU2Ltzp5bVw/PPWV2fS7R2jRhbErO/49M97FRigIkQ2GfxicKYsANzkmQe2ONNpzZg98RulZiQ1iOrsgyk9Z3Fdft2a39xkjrfm8QedmB+3+zdXW7TQBAHcIH4FDzy5jDlgZEwspxCCGqCZSN4aCIaGlrFTYooBKSWQnoOJMRjL4DgClyBczG78WaysQlu0xAH5ldS1/VmcSsh/RmNdyWwL4YE9uUmFXYhignmjHvYVV4npiVGu6ilK+zp0M6rxJBZF3W0W9iN8/THGN/pVN2ftaqjSezJKjE3JLALUUAS2BdDAvtykwq7EMUE86YD+7XhRqemJ4YDe2qnU/VBdHS2l2GnlM2fZpGU1tMtMdwTwy3s9k6nnNhlWUchCqSSIoF9USSwLzepsAtRTDBnXGFXkd3kdbslxrAL7DpAM66yz1ph5yZ2fche1JEr7Om8flU2ThKiWOYZ2F0/EbQ2IJ+y7zchv1XfqFf6K0Bq/pgKDD3xfRcS3WR8FH/YA22LTnswskOnfTPQ6J/gh74HpySBfblJhV2IYoJ548DOHTF2hT1J7FxhV86lHjqlD2t9l9NX180rq8JuJ/YLhpXYTQ+7VNiFKKizDOw+shbksorYh/yqOMbfBoC3OMYdu5EDGKrgiN8Epaa+hJGATntmoJE/hCOuw6k5E55++Tbh+2dHFJRU2IUoJpgzfuj0umJ2Or3Eq8RwYNd416T0vkk6t8+Kkzuhz9kldk3dU8ZOp1cvjwrs1/+hwC7/JxD/jjMO7DHpVlRgPoI8VnlgHlVEP1a6ESLW2zqwh7HxFrQtJBUYqiC26FLLRRICqSHZgsRjJD0z0NiCfM42sN/+8Uj5wS/yyZl0OBh0nBNbGQyazoRXA+M4aDjZenTRyQQ8Y8rp39EasGOnyKTCLkQxwdzZGydxid3e6JSCsb1ITFLyVjhU89Ois+90ymk9o4fdRPbMArvZ6fRKASvsr8ORWiMMN0paLQxXS1GoVe4dlkgUHpTYnQ8qjATxqjVJJdZDezznY+uaEEVQSTnzwA7ayj4iQh4r29t7kF8VscJf4iYF9ozEX0EMEcujk23Q3uFwbI3zPNlH0uOBJ3O2gf3Towzf+frm8fEKHTqe99r5s+6xO3585XlPnAnvvTGt7DLygC51nBSeMQf7HqYLPDZwZsW/NSIVdiH+CzB3+qFTex32q+mdTrnCbnWxJ0w1nFdjnwEv7EivaRV2XtYxe+OkIvaw93GkBz76d0vkPSJFFxyJS+qsye9qh5jYnJjkucr2fNqxrwlRADMH9k7cnbTPIdcEdqWOuAuJNh+myDGAA7vyArGXGdjLiC9qSauNlcM3EPGNDuw+4t7opv0cgb3NR9ZegbMN7F8fZfjJ1488bzd/YA+8++Y4JbAP1kkrUrH8yMmw4ZHgd4G97+TD99DPEdij9cS+Mxv+rZ1cuRFHUdwoS4VdiGUDc8cVdtPEflmZWNaR14kxRhV2Du3cvD7zU6fnMkrs+sNO7FZe1yYD+7ViLevYRzxI7JYOVDYnIfptFdGf03c3n/g0xA7sbfrW/uGDcqOO+HZskqaLWFOB3TVzrkxcE2LxZg3sbczgQsIK7C3EDegEQbsau1gGaEQ++q0GADSD4DVo3SCEchA0QHkX0FTdlwBwLwjeAOknA2mWDdDswL6DeC8zsD9BPGgj1oHYOTxCfKcDe4z4FjT1b39qYKe7qL6gm4+2odryadomaIcv6oh+r73sgd11hu55nu9kcD0PPQ8yK8y7uw/yB/a876DAvuqwBQX2u0eYOLorFXYhlgvMmwns10frOnIPu90Tk+R1a1lHxjsdzRLZ9RyG/cyperFhXE/tnHTZrMNe1IdO++iX2Dris1Kpibg1VlMHH1/wmRLrAQRCxPbYJKBL85Eab9jXhFi8WQP7Y8wCCSuwR4iHKhkfICm313GoB/ASMQJlDzE0D52+cXFoC6CfhGk3icIx4mPQ7MD+jmbPDOx19HX9XaV/O4dvILZ0YK/V0QWix3WmBnbE5Ob9jo9aH8gODrkLC+y379620uOao63lCeyldGC/7XmekwaeF9Ymov6ttYzweis5llL3xPdgWZuY4Oa0wL7GE07/S0lpSmB/cNvJpRzhSOWVVNiFWCowd7xxkulht1tisvdNSsrd4x0x+sXJexamXs+zE903n7kQu4nr9jLsJw7s5d7g4ySvCnmcMrCDj/W194it0ngTzHN0+YzQgJ6ptSN2eRJdXM8I7HxNiMWrED47VWCvNxoqW+80WoitRu93gf0NIraT3hM/2uvSG482e8OwW0/aUWo0jQnsNGfUbDxHxIfqvZHO80mRvE6HjMC+SlO3swL7Q8RYP3i6ngrsNKc7DOyU9qvJd1qH0wM7qTRrLpJoZ3N9+BN39Hd36I7/XmD/xd657LRyBAE0D0V5LrNrp02i21KMRmPsCQgMspGzAGRs85ABg7ABSzzNIiuyyTpSlOXkA6LkA7LhF/Id+ZRU1UzTrpmxmTAQrpM+udCeV3ePpZuclKqrW/7Qce78Ggn7kg+Cra4EUPNPxUah7IG4dlXZKbt1tFLXLzuO75/qVgs73gTdNBtM2IGhMxQ9398WhPT9LrYDx9nMwf2C2PZLiy0f82hmgnvWhbj2C6KOXZ4LcQptuVoUSKdSdvDsGzOX8Ak+Uerg1IUHC1txYT/y1eLh2p0jWYdjBuUvx781uLbvO3jnLqi26/ub5NwF3y+KGLM1NYI3ayPsFss0IV8cUyWGLzrlEXYTYje8yzDhdfzJEl7XEXrslK05jYfYtbHzVadG2D/7BzudHvs3CfjHMgVPEHaio1S9qlw5UdhvKayur7lcyg+YsEevWSyvzzMI+wrJ+BLlndTlZrKwHy65dCfVTzySclepah7Pu8qlyPh+aNJbobCfoTIDm+TjBeqmr4BDKS+VOh8V9sIScovi3JL0qHI1PQk0lWoEk8FD7uFwbyDsJ2HlxmulOlrYR3qqMmEfQHNM4wE1yoOvhv+f0PkXhb3iEHco7MoJ2IHzd45Xg4+eKPpOgALzLTuEp1st7D190yYTdrxcw76cvEDOHGdfUOfDN6LqOIECK6cSjuw/xOwPnLLnEKfbQTucJdMnKP89Mgc2UergwCHK+ZiwQ3S/g49L1mHioPzlYt+aqDkhCyD84QNNx6mKOLeKcWsj7BbLNCFfFi7sHxEPOewf8DrsmtEQO0+ICXRb73v0JEaruccwts5SYnCOyGgKO/zBADv8SR1hr98kUpWpSC/sWwF5Oj5QwGbOCDtlrDfpyEj6Sk6zo9QsSbk+6qOZe2GfMhe5ZrG8Ps8j7LLdkmOF3bCLZkxyK1tBQyfWdQR9i9JTSNh1EJ3uvESj72AmTJXMfp/82wi7oStJ2A1k6L0wMH8Af3ONsJsZBsIOxu1KYAUaI+wa7EFDB3SnOsb2FJN9Vh9y90v/nrDvY2zba9VFh+x3/xQO7wKnRoPeeAO2PRz0u0PS6VIL2larr9tQlt/AQ5WNdbTdxoiwz1zAwx3S7Hqo5uUcNA3HWaOFp7XwLA5BT/eNsMO5Un+PjPt85wyGG9CDZW9jswQn8yIyBzZR7ADYWz+Aw2aSsA/hj7vIOkwclL9c7FtbgCfqnXYBmmCUFXqxu0URo6giHNsIu8UyRcgXhoT989DYSdcBtuY0GmA3uh7f69RsdJoRnRE/SrDMNbbolOA7nX74pBz2lZtkujIF6YVdE3j1rKvUWo5QqtVut5e6cKbDhL0KAq+ZAw3ATtYAr6BU9RsUdo2Xi1yzWF6fZxF25HFhLxwFfr4Wuu4SsUFR6iqZ9bpSm1rYMW5OtNCl5ymmXlCDKir9Nih1srCvHAfCXi1p8kHMvC6BI+g0IcJeCYQdf+1Qf90RYV/THd2yHHZqa+E8NlDY+zht4uR1ctgptC5AU7+hqLiDKSqnjqMwEVyCoS4l57BT5Lwkgj4KJOxOGcH2Cp9FhwbyGA8HamTPb+D6YijsCj/so1sbYR9uhd5dhHaegtYlcmaacpvPITJRerCMD/bAngOVLodUSdid4a7gHY4ZlL8c/9bo1s3wlcC/v4Dvbl3Ce62KOOsqwrqNsFssU4QcT76ISGCr+Ch5yYnnsPOMGG3s8Y2TRpw9Kuv4K7Ot6z7enZgTo339/ZEqMTrE/jGAKTEZ67Dv34S0JSOrsLsBlYcCMDUt7JpzXtZxBZXe5LMfjVp/kXJfdJ/NHL9msbwFBIr+F/F0YffA1jsg7JuHstepRIT9FLltz+uA+nU08u5RzHwf/diVobDvKgPadkUVMAC/UFcuPnzAhL1WRObaLkXo4znsBRbl58JeBLsPhX2LplLC2P9jOewHcWE/pRrwxOsIe0UgJdLpu1Cuh3gV2QXrThZ2vPnujUA8iFTzOuwrMtDlS2jqjoOWvEgOTZkj16Gwz2ObQyM2wr4UWvK2QMo4u3O/Eriv42zwOUQmSh0MdFSf12F3A2FHM+cdJg/KXy76rQ3ga8KrJ6XSZTB2WdFrxdlTEfZshN1imSLkeOolpAO+fl56lLocB984iYT946SyjklV2N+L14kxaS1P1HWWEhOp65icEoO+zqvEQEYMgCkxn3z6ZGEv+jchDWnILOwudxkF7IfCXqgB293dHBf2pqqOJr1voZRfA2ctpSpf8xz2yDWL5fV5HmFX5x21KevkqWcJOewGimIDigv7FubE5JUqaWG/iiS6nCtV3FEKz580MD8mcdEp3BsXdi7/BxEPb5Ndk7DLNYzzu/BCTxH2ulL9FxH2338B/ly+//5nMPU/Ydek35KFva7zRRok7D3UR1OX0XfKycKON/nrhIfKewlC3kK2XQc+5gQmjuxRDyTq1+DS2qyNUgsc0x0RdimCIPeZQIbozkR+s1SOCzufKHWwqjU7EHavFbBPr1gTAO8weVD+cvxbo7GdYXNnViA6yb4qkqipCJ6NsFssU4QcT4nYAbMspWCSsH+uyzpGF52isWMEG0A9BsCUWR124+o6yp49wo5AdxMzYt5LSIkhKCMGjf2zzDudnpRvAoaHEngJYV8HW8fNEbmiR44Gyn1IbqkrNdJJH6yCCXv0msXy+oxLiSHSCzuAwq7aZMeThX0hCHoX2PkmuHIb9FgL+xZJsaEBRl1SVRxqA6PsMWHXSeUncWE/UKp1SsAMVZ55OD5yrYV9QamzHfhr/yRhb2NHRO95hf2X72a+/O7n+y9//e7n5T9m7u9n7seUdWTCPhTAiQ42k/PKRGHHmwyD0UWn+Tu8HvbWw88k1IYTEva7JGHPhe68MSLs3wzcsgPEhD06UexgkQs7z2EnI+cdJg/KXy5W1vHMIfw6PKkT8r9IKew2wm6xTBESeHFhB19nO52aIjHxnU5ZiJ3xTvYkdlPCPegtGmIneIydbD2SEvNcddgbzk2AuyWB5xf2nqtqmOVSnSjsRxSDJ76BB0Y7cdUZE/boNYvl9XkGYS/skqTv75bg91whnbBvK1WUyOXaWj8orbKxjRKvc9hdbfSdtbV56qi5ogYoydtVtRYVdqPmVzFhz5OlB1RJzI2HU5nJvBZ2TLzBQjVPEXaqeyOJ6+dOifnpF4itzywjv/76AxykEHZfAHOUV07UIOaeKOwouIYSK+u4ECTaDLDPLhk/N+AmOa6fUthPKC3erzZjwh6dKHUwSdgvsOUdJg/KXy5eh71Y8h3kTgpgCzvsinQpMTbCbrFMERJ4eWHXi04/M4tOifi+SWbnJPzDA+zUBLqdMcIe9EP/TFpzSsLOA+xm3yQy9lTCvtpybmJcSKCjj5ovI+w1pY5zuTOlzhKF3dym89G7Ss2PdrKiukzYo9csltcnu7BHSSfsbaVaOrS+E9xYBVHXwk7uvU66XQlKsewpl/Y9OsX2Yoywn8Y2TjLrXLVaV42H061qQz4I+0ABTTlW2FePjg7HCbsshG9SdF9C2Je//uk3+H0/M3OfSthdASwa+VZgvsnCnqOqLxom7LTelJpt4Qenm/C5TgxAlmfSC3uQWH+oz7I5RCf6qLA3sOUdJg/KXy4m7MhihypgBmMjuyLVolMbYbdYpggJvLyw85SYD4lolRgt7GMi7LwEO33IWNgRwcYAQ0bLsOtFp1rZn7DT6apzk4CzKoG+Pjx7CWHfV2oJ24JSJ5OEfR7LSkOL1eearBNPtZiwR69ZLK9PVmHvqQQqk4Vdp6J4nV6npELpPVdA0Qh7EQ7PG722F/r4ggKgbVA7Rtjhb+01Wbh3plmSVRrSTHcOPfwcLtXXXDisSSPshwroGGGnGzWbNOnBWGHv4/LY+WLbVS8i7Pc/0ucvv11OK+zkrOUvRFji5W7cotOhVu4jz7tkwn5En+n2wyCsPVMGSzdqvfQPhF3qPPV+XNj5RFMKO+8weVD+ctFvrd48FcgVDSoGjlODvoaLIk1ZRxtht1imCDme8xJyIWWv9DjnkhOPsHNh52tOiXgKO/5wqzb7H2XbOiksExNfc5pc1vGDAB5i/wxII+zbN4n4PQnc6sPOcwn7AwdFXSAG7KHwdVTYNbj9EW5O7lYr+B/pL5iUrwU7nT7QH71mdzq1vBV4Mf7hv/Q2atUo3kUKYW+4KuRIInPkzkbY5bopqaR7qoXt9jhhb+M1Xoe9csL+B2IbFJyVV7+WI8KOcu9KJuyGtUeEXe4pzfMLO/Kb+G355++++j0q7CfjhX1bp5pUHWcvWdgpaL5OsgkR69lRYV/0Ke+bUmMU7pZEBVk8EbIBZ/+BsDfCPPU3flzY+URTCjvvMHlQ/nJwsdFYNN9ahc4JWppKDw5ncQI1kWLjJLvTqcUyTcjxrB4hqJW7R4+yKpHJEfaPiDFlHUGOeQ47+nO0Rgy2WTHCzuvEvBfZOMmE2FkKu6kSQ76eYuMk5yaZmkQOwqO7Zxf2vZpye3pZqbrNuZCpbnBHhT1XrNFxZT8SRb9Van5U2Hei1yyWVyeDsKfCVW5U2K8kcbytkOqRWf25roX9jEx8RSGtQ0m0wmLqHpVPNJygsJvP6lJuMGEfkHtrdtDImyqgsD2Ye5jWeth2R4S9GRN2mgNVs6GpVHRg/4qerlCvuy+Sw/7L/Z8g7F//9tuXcMDs1dtZHSfssgz6PZ9ruBQ3Jv89vejplmSZItXOwdw3/QJuHERVYm6RQXNITyFDvEUALnYfsggnj1MLO93efyMvfOxrhs+BTzSlsPMOEweNvpxw4FnzrQ3gXTdnxGEVE2dyd1SVfXaIih9n1lMjeLN2p1OLZZqQLwvfOAlT2D8Kc9h1SgzCc2Lgj944SaPVekS2s8TYzUcGjvoAj7DzjZOQ9CkxN0CRneneEHWJeMHBUE4ml4WZFPdc9o++yFks00cGYc/OSf/oWE5it9/YktNEb3Mh24THCvv9T2Lm++Xvf1he/vHnUWFfdYC7JGEn+k5IuSOAugN4uiVZprB5yFCSsBuGV4LowmezkZFmBS0+fQ57wQm4gx/F58AnmlLYeYdjBuUvR8JuvrWc/3Cxh0N5AriAw56Ic+yN+PqxsBF2i2WakC8GrxJDEfbPJqTExALsfKNTvdGRLvOSPcQeW3RKPzzCDpPSvs6MHXVdh9ifJuxm4Wm+kE7YLRbL2yfslgQEB1PW75cJ8+l7YegOUT2PIDrMhL2iNdN1kEJeILkqSjK2WpZvBXCoHMTLB06u8ddmzepTFYr7udCg2g7jwn5LuzfNCOBE1z6n+XxRdZDmTI1643PgE6UOjLDDnZdM2Oex5R0mD8pfjoR93nxrQjYdYqWHaT/Db3SdGlckMHurQm7he7ERdotlmpDjKc4Dq3n4dDj/KEU5DhJ2UvbA1wFW11HXYSdIlk1GDMPUZMyQxK4fNzk2hngKO+k6TtBsnMSFPUuEnRaeEvNW2C2WCUxblOL/jojw+3KMP74U/4TDi6J4jDdzO3M5EcesPt0X2ZGNi2NsV69ykyaavcP0LzdzuLm5uijScby+53l76zikjbBbLFOFHE+3hGxK2Uux02lXJhNfdIobnfK6jokh9nfxJ5rETr80Wa2d57AHg2lfD5WdpgWwHHb0dZ0SkyXCrheeWmG3WCZihX3KEFG+/THCT+JfZwXTTSwGG2G3WKYLOY7n3emUNk4CPvrYLDrlZR25rsdsXbdE1ix2vuyU14nhIXYWYGdVYjJF2NnCUyvsFstErLBPGeKtQ4o2Lsq0PGAj7BbLtCHH8UzCPrmsIyo783VEB9jJoI2vB5pOop19wSnf5ZRgK0418aqOiPH1jMJOC0+tsFssE7HCPmWIt46yA2wJi42wWyxTixzHCwk7z2FPDLGPz2En4866z6kpxh7jvUhhR6w1GWDWnCKmSEymlBjiQlpht1gmYoV9yhBvHSjsfWGxEXaLZXqR43gBYUdjNykxPMJOesy3OqWUcp4Tk3nRKUFPm4h9SDhepEoMq8OOkK+bEPsnWYW9Jq2wWywTscI+ZYi3joWzdl5YbITdYpli5DieddEpQL7+WYo67GDsiXXYQ7/ODKvlPqYOO82DhD0kMSWGYuyfWGG3WKYKaUnJf0fYLTbCbrH8zd697MoQRWEAdqfpodlqu7ukB0pUTkRIJIIwMnAPAxLBwG2EmpzJiWDQyUFEQkxJjBmYewAPcF5AznvYe7dl11K1u0tXVaut/w8HkUi5RH5/Vq0VOuVT71rHXdktMbJh50wsRthz751yVhcfZ87q9mNuHkZOxLglMfoZi/ew79LQsAOERUFJCOyLCA07QDupxnFgl5dOuWB3iZ1HYkRal3iUpUJa1ziu52P7pvzhJCt3N6niHnZ2HoEdYJoA/9FbdAQBQ8MO0E6qaTzDbvO6xiMx1lbL17DL0M4z51a1pY5yhJ2Zy6ose+nUPJ/b6ijWOtqCfTcCO0BAFDQKgT1saNgB2kn5nbxumNM+l69PdVJ52MC+a3zolGdiRGCXl071Jz6blA3r43adP1Tzq1rPj8S4mRg3wi4WsYshdluwo2EHCI2CkhDYFxEadoB2Un53Dhp3lbpxcLo7yocbdhvZOa+LkRgmC3YboHMjMdUbdv7Cp5N8Sx25Yc/n9Y6GkRiAQCkoCYF9EaFhB2gn5dPAWkeeiJENO69hdw27sVFOxNh8Lfe7zN6u8xd/w86JfQsTiZ1n2NGwAwRIQUkI7IsIDTtAOymfWgO7zesGXzrd5rbEuMBuuatJ+btJNrfXgkdi7Meiit0yz1Rw6bSz/XfB3kVgBwiMgpIQ2BcRGnaAdlI+DR1OchW7PHSqg7FcEjOuvF1Ut8Sp0goVO8/Ce2fYObIXFux86XQHGnaA8CgoCYF9EaFhB2gn5VNrYN8l97B35KVT2bBnp9gZt+FiG3vVy0n25/U17HKtY/HhJMywAwRIQUkI7IsIDTtAOym/UweNK0pdKHHp9JTycQ07D7FvN3JrHXlPDOOGndkdjJWOJlnc0hdU7PaTTOwir1t/BvZdWOsIEBQFJSGwLyI07ADtpPz6S4bSLixN1VceHNi7v/c6uhl2ORMzzutyraPjLh1ViOxymka+c2q+OOO4nructJ33sOOlU4BAKSgJgX0RoWEHaCfVOHc4iWfYxUiM727SuO7OTsTYLy55V8F9vRiRt3PzhYvYOa7LNewI7AAhUtAoBPawoWEHaCfVOLclRr50Kht2V7E7GwVXr9svFep1+4GH2JlJ6/mK3SV2udaRA3sXl04BAqOgUQjsYUPDDtBOyu/+JcNEzSuXprqvionAvsPq/D6cJPews2zFLgdixnGb7x7NJLvNPceldTESY57RyI6wd8YTMfpzTQ37WwR2gGII7IEhCBgadoB2Un533JaYipdOd2deOu1o/M6pp2DnuJ6/dVr50Cnjifis8WuuuZdOLXnpdHsDM+xXEdgBiiGwB4YgYAjsAO2kfGrfwy4nYjix5w8nZTJ7biSG75xWwT/HxokzMZzXN2e2xHDF3tHMSEyde9gPXFOT9QGgFtS0Xn/pXr9Hc9N78/T5Cyr24vWbIdUgev9tQH6D1fffonIP++39af8TDY/H56jQYOXDxwF5DSKiL0nCP83qy08rEf290yujHnmtpeleYofjOD5KJUXvPiyvEltOksdUSm91ZeVRj2owGBCtpz/IeqCf/R75jD6MKGPv8od3e/k7q8v2F+KY3+kBTfM4SfbR6NOIPIajT+8imkE0mvTnPErT78RUHD+gCQ7F8bFDtwigBZb25BEpn4YOJ9nA3ila61i0hX1TwZ4YjT/MFNfFSMwfex3zIzHcr8stMWYixub17s5aRmLenr2vENgBioQX2NtkSC0z5YGOxPEemtGz5Fnlcpkm6KXpuvvebZ3vBjSTz0kS/YM/wShN18i6GMfn5vf3iQN7E4YTf/BHmvaInYmPD2iCezqxx4cIoAX6lDenwL6b1zq6it1tiTENtmbisaaTstjD7rI6t+yVG3aeiZk4EbOpYCTGshMxJrF3a7t0aiGwAxRCYF8kw5ni4NflHkWvkuQJNWYYjda5r+XQe55msPejftBXNFc/1h4N6bR+/tNkDHQyXaLZtCywTxA9WrP/Qylv/80jhwmgBeYc2GXDLi+duiUx+UunomIXNlQfYueC3e2IkRW7JTt2V7DLkRiti8AOEB6C/8yXZOwzNWeUaj+G2eGdE0OaQaI93EtztZ5aHF+X4vgOTRV6YE+19YgAAvTXgf22fZn0vlL9Uwenul1mJGZH1710auXvJrnLSfazK9j5K7edsdKpU3eFyf/OKQd2WbDzWkeb2BHYAUJD8J95+cym4MdDas6qTn9rwxpGVfSDfn1E8/V93abXEc2VDOw9mjPzHyzkdQiTJ7A3TF46NXRet/7cEmNt8u5hlyvY7TcqLnbUcg37xj/WsPNLp26to4GGHeAne2fz00QUBPBojN9Hb0/dYnYTSdy2xo+kxqhIUjGggATxIxTQRERjgr1oQogJlyaEnhriFRJqbzQEThw8cCfxT3Jmdoe3j20r0upuy/y0y74+3tunp18mszPtixI6DvtK4Z8KoW3H7mWAv8BO2HZXbzv/CwThaBGxsJ8zhd1855QIp7DrTqeM7n/UXOskuqMPE+qbROgUdsQMsZ8HDiLs1z424okIuyA0QoRdiB47fq/vCoLQqUQfYT9N1CnrCHJs5rCjP4dqxMCleVjYzToxx0ONkzjEbqSw6yox5OsHaJw0/LERYyLsgtAIEXZBEAThCBGhsF/QZR3Bdb0cdk6JQcycGPjLjZMYVuuAbDcXY+dbRmfEMOEIu85hRw6eEjPSKMTuWCLsgtAIEXZBEAThCBFphP0cRdjPN0iJCQXYzUan3OiIy7w0H2IPvXRKHzPCDodiXzeMHXWdQ+ws7PW5PfzlY22S1ycvi7ALQiNE2AVBEIQjRKTCTsru+Tpg1HXkOuwEybLOiDHgmoxNlXXk5TrHRhNOYSdd161OSddNYecI+6ERYReEhoiwC4IgCEeI2Lx0Cp2HzLqONUPsx/CzP4mdLkSLrJ22JbyHsa/7yk7HAowcdvR1TokBRNgFoa1QgiAIghBbIs1hp8ZJwOkz+qVTs6yjqeshW+efRLNZ7OZrp2adGDPEbgTYg1ViJMIuCG2KEgRBEITYEpsIeyCHnZSdfZ0JJMQEOieRX3tR9la8cMrNmDTGG6dMuKojon09jsL+emBgYMYSBEGEXRAEQWg3YiLsoRz2UIi9fg47GXezfU51MfYQx/cVdjxhlIk5qYWdM2JimBIzct9BbqTrzI+n068sIpdOv7eIyfSklUprUvyrxJBeyYzTkzIPHw/k9jbweDD2sG+k1v6CEBeUIAiCIMSWGAg7GLtOiTEj7KTHZqtTSik3c2KaeOmU4dU6Yu/jP29flRijDjtCvq5D7GejE/bxnFWDd47HlFWbpzDnLZyCO8+o7zhJ656jeaR/Fel+NMlDvXm/tyD5BmZSjnPHQh4nHeTuQHh/QYgLShAEQRBiS8RVYsjXzx+gDjsYe8067L5fN41Ry71OHXY8B3HCp2ZKzOlIc9hHksNWDZJs2c88plPGdA7nMnhHQv0Eb+oLO5MEAzeF/UGS7x/uCXvukcM8C+wvwi7ECyUIgiAIsSXaOuzBKjFmhJ2d2EhhD713yq5uXA/t6nQN5cOYGTG6SAycsWYd9khTYkaSzj2rBs5+kpng9JgDeAun8BZNnIR6YgpAFwemLYAM/flg38NH6OZpGj6a8pixXjjO/VvW6HOcYmF/ictHrP4b8HNS7y/CLsQL9S9IJFSnUyhVy+V51QKutmSfUs+S+o+szCHzShAEIUynCXug0ykH2LWxc0qMYesmnMrShK0DrOthbT8ebpxE7O+bFIM67ODrjYVdc2fc0tyDZejYwBRNDlkBoXYMs37qx+In74Kq6yHR7W8Ccj7mC/skbDdKk8OO80nvL8IuxAvVai5OPuvLZPqeDSnN+4mJAdVeJHp7VQOqLvJNtYArLdln1p1TtbELhauq1RRdZEUJgiCE6RxhP+v5OsApMQQbezjCHpZ2zjkHmi3qaKawM9hZlQl2OsXzGVUd2dj9KjEXIhB28PWDCjtZNJN2nBsZx3mJ91M0+dZqKOy8yhnnIUBLnMcWMP306YQv7NdR64mZZPKJ3l+EXYgXqtU8y/j0a4dHg1ftxY9stkvVZR5stVIsrraDsH/G/VuMvVwq9YiwC4JQh04R9nNeo1POidHCHup0Cn+4bVJQ1r3oOl+aww+th1NidE6MTmE3O51qY4+yrCP5+mGEnbJWBnOk5STUn2D2VmNhJ6DyzGtT2Idh5fDgON2TsFPwfoang/uLsAvxQgEtFvbB/ve5fjD2cf5qNNNpwg6yOq+A+Ah7vrzyn4SdWRRhFwShNh0j7JwTw75upsQwZoAdBTqcEtN0hJ0/odZJZgq7jrCHff1MtI2TyNcPKeywcAhle9oioR77ALscQNhfwB0MmW7LupX07t7dsljYcW8cvEdSen8RdiFeqFYzklLI+0yGs2Bymb7BDhP2ouuqWAm7bSslwi4IQgcSubDrjBgzwu4bu46wI8dCL51y6npTxdhpMX/qR9jZ2E8whrFzDns0EXby9UMK+zRlrUxAcNzyhNq6Cyq+X9hzhBZ2CsxPaWGnN0zTPHzHwg73FnDfIQL7i7ALsUL9K/rY0RODmfREVMLe9WNjd3fjsyJsGGxt9/pGvv0z8X0D5/QkzdLc9lY2u7MNqBBX8/n8guvmgQIMv+ZX1Ndqpbim/p6lcqW8tCfs9lq1stlT4MnlcmV9rrrKw8RKtQK/rYiufH7RXq5W5r7ZOCohy4qYz+dt2lcpOl2+6rpzeeCKt823cmWODk58yy+rQr6yme9SJr3wr+MNafJKqQjP/9ZbS9iXS2sKWSot+V/0bFaqX5XP1bGxsWklCILQdsKOvo5wp9OTukqMFnZCd00K900ib28JnBID19ohdgLPVKPT6ZlTewH28xEIey7pHFLYMbb+ob9/Br5L+ULdD46eMoX9gQMYOTB414eX4YfEmIUMDbzrdoDHvrDfoQLvWtj1/iLsQpxQrYeFfVAR/ZkJOyph/5712CHL/eUNfigkm93apeF3RZNZnwTOaWpFrBkS7Tl3tkqDsvpLEnPeOl/YF9ddoqQQu+J6LPnavOAS6zQquO6a9wt5GK3S3Zwi8rgjUrbpdHt8pcMv6JMjrlvscZGKMuna2xCek1BqxfWYXQ0JO/0fKGTBO97FoksUE4rIdXd331OCIAhtJ+y+sRshdqPRKYixWSTGD3mzqhOBhkfNdzrF3ermsLOy1wywc6fT09FE2HPD9zzGrBCNhT2lv/vkC7UFhRmf1hT2US3slJ7OQ+LV6Ogk/bwBaTG+sN/HNbB8ZmYm6TjB/UXYhTih/hGXMplRhVzOZIZURML+A4x7d2fjV3YLFRh8/dfGFit6Fuc20NltHO7i5M6WJ+w7GzixtQGoEF3FYnEWbBRY9ZV4tozXQqhgzmiAV2o/ZVxYZH3uQhuvllnR8zA5ly8vuGueoeNsuVpxZ3m4AF9sLpCwf4YKiwFhB4plOGEPjFaKRZhaLwKLMLQXYCEddomFHb/ZXGdh12y67sWAuZdcd7PcgysX/yjs6/iQKmxcFmEXBKGdhf2cWYf9jNnp1IywB7PYGY6G62rsLeicRPs2irDrso61GydFksPemMbC/kl/181CTfF6Q9hTL4m0NvQR7I7KQ+IxaDjdpGGJL+zvMNMGwbFj7C/CLsQI1Xr4RdOUQiZA3CMS9otg46SX37fxAgpug2eCmfvCjja+kc3+xGi3/6393W6Yw24YKoE+DGa75rpVtY+bgwFmVDiGvQCPmPeFvezF1ntn3dmEJ729Clj2/HgdZ4H5ovb3Kzi9rKvEaGEv0D5uIpTDvgL2bVNIfkERHDNfDKW5L0EQX3mm/pWyXq7SccjCGwv7GjwEHp2owEFE2IXf7J3JixNBFMZxX4/eKmpHWlDBDReMiKgBFRTjgjvu4AZCnFNAwkAuA8E5SfA6QuLcRkRPHjx4F/yTfO91PasrZaKx46Rbv99MZ1LTk+qOB/nl8dUrAAos7EmFXUPsq5igraP2iVG0wp6Sds2fZ151yt9hiV2+fGP3fF3oE3Yy9g2FEfbt9PwGQxL9xAr15tpWYuii00sUdrnihswB+svH9JNd/ogV9sc0T01fSMKu80PYQb4wY8dfc3qscvrQpIT9y8mTnwyjNXRRcKqic27dpl+eJxGZMtm8UUYVdkmJSCHap3QzxW7jISY8bSeYFn3/oA1oOiLgdeN4o2djo8LOPi+Ewt6zP7uBsOvHgBfq0lprD4k4JiMvqduLqpMPFXZ5rJfsTR+HsAMAii3s63/0dbQZ9iATY309bOsouJ2Osii7zKH4a075cCS6HuyctKqvD3v+Kuzbtwac0XPs1YzkVFSoN+8bIuynnt6/IqH0GzLctzfhDgfWD1f27DlN6v/QCrs0Xt979sbZfZJhd/ND2EGuMH+FTbTkVKRt/+nKMTMZYRc1j92IEjCaa3/thpGV+pP0s/yHwm5ldd6MBCXfy7aUPZ0UvXuzBM03lSTHZ5tpue+YFDN01gwU9o719KlA2OtWt1+qp+/UNxIyK/dXFf+XeaaPSxio9Sth5/z8LKPJ+JjX7RsAACigsJOva4Y9jMSE+ybZcnc6ESOHM+8saL1eZxckN//TRuyq634b9nwK+9PA1/dtVngbI+EMZ1xUqPcMFnZl1xNvSLZ/yYVrbqmwn7/y43dpYd8DYQe5wowf0fTTycyPKrV4YsL+TWIuitbQn7OiuyGvSJVqPPPx+QjCHsrqSHywpt8UoZ7e6ehJ9oRZePkj7l7tE/apwcLethXyXiDsWqhv6uvZqQfQkddN2Y7z23T56i+Ena/naBkAACiwsEsixl906lfYXYndscTDldf5yFJelwcNsSts62GJXY3dX3Wqwi5dYnIWidn91K+x77p+SU+Rj+/ZLHCB/PQzFmrmhBN2EW/lmp3h6MPddqhcoyzMBfuUzt3S192heYmrx1jY3fwQdpAnzF+gVKtUbuuK04N3CRL4u3dLZpGRXLoSq6FXSdFDYY8/Jz1jvsZjFPYdKYJ3P2+Fva1iPDtl6UigZCFR3rYt48d9wj43WNi3GJfR8YQ90sJ8W9Mq+gvFn3Ke31ZLP17UZ49zQ8vhwi4fBhamLF0DAACFF/bVwo8M+wq/D7uSKrF7gRg57OMf93dMd3MPcLbuRWL4Hpl0hH1Nkoih75xV2BeP3Zevnr55e7PPrUdXz2wGIM+Y8RPdqVQeG2FzJcVms8iQgpswEvOZUuuhsJvYlF+zs38ak7CHi07DyEmqkt2VyHksX5ZtDa5qz9tge7tP2LuDhF1L4rwKNqywz6euGQp7RBhGy/r04uN2knm5sV8Le1lK+7H9AgCAwgr7BmvsouuEt+Y0LLCrrod7nWbe6FTRRHyaZJlrsOhU8Hc6XZXjDDsAYLGFPbpYqezR/1JrCaTrtdoms8i8V+nWgIyq+OefCLvK/NfFEXaVcF18KiGXgOrOxOq79De/L+xzdsnnK1/YVbe19Uso7Ju2E49SF3mlN9m1yfjIxVy2sMv7nz2otv7TmM29Bw/uGQAAKJiwk9T6bdidsYcbJ6WcvV/W+SGzrescS4ZmYtTXl6W6xKxwkRgSdno3EHYAiocZN/GjSuWA8ZhUhv21SrkpJUtQ2yLupOKDhD1iYVd1/5w5ErNxWCSmYUvgCyLUUZ17qwiR15RlZyLd2qul+hvCPm/r4280B/POb2kj024ZJOwX0x1h1PBf2s8TUyrsnpiT1j9P/mghSc80/XfC0xoAACiisLOxW2H3S+xO2IMu7HQEfWIIffgjXfciMf19HcNIDLOiv0sMJWIIjsSs/X8jMQAUE6OMsQH7nVvC7QkLu7j5+4gk9+vHZLHpyaqJ37OpB8JePfmFLL78nkeadP/2PMoo7MNpcauW+J3twz5HKjxjTNz5UJeTPRpsm9atTd/RkzbdYK/1a2Ent45N15l1ncrpZaOvq8+YqMf59qHCrh6eajXTaiZLY1upHpG9medbElOf32aa9eRu23SRl3yx3s4mhB0AUFxh36BtHfsXna4UXRdjZz0myJTDPuzi6lplz1xh10zM0ETM0p9EYgSbiFlDgRhU2AEoIGbcnK78IJqwsIujC+Lm73VUDYSd/lIpuwA887eEXTRXmU6WdRJ1fuCRHWiZvNSyv6h7wq7ZFKXOwq50jCq8G87qtO3hwm4t3bZ71w1d5WilmsPbu435jLAgF9Sbt8IeQ9gBAEUUdvJ1b6dT9fVg3yQm7BKj1p49xO5auNvZ+krsgl9jt7buRWLy3IcdALDIwl77ubDXzCQofTzJfHsto08y+Fo2obCXrZ9/rRpL9OXbSMK+MLKwm4aIbcMKezyXaG/ruJo1DxqaNDqeGPlUKOzP+4U9mbdjLPF0S4VdTusuqQwVycMMuxIvuNRL+UUy6Qcn7HHSyMYQTXH5hv4bvGkldzNbleEBmvWUAQCAwgm7XXS63i06FcJ9k9zOSfKd4PLmmj/PWGG38/DXkDWnIuxBgV3bOoqxQ9gBKBrmXyY2cfz89euqjmnwOTIBeu7t53JqPPK1RieemZtJz7ClMdfZosN2Y67RNinaL7vNyAxBjXybmenODL5mt1P+g/dEN9fVewuJmnPevZY7qZu/T8L+2AAAQAGFPRWJWSX0d4lRYXeEbdhV1fVJpsaORFBh9419ua2wp/qw536nUwDAfyzsRSaOzeiosOeLC9u3nzMAAFBEYV/nC7u/5lQII+x8+FYtrp0hEeP1YZdDCfZNElyEnfFK7OTrqLADUDwM+LfIn7BHVGC/ZQAAoIjCThX21cKAto4kx36Gnf056BFDD9lRYff7xCwNNk7SErsXYXddYsTX/+ONkwAoJgb8W+RO2OOoVjtoAACgcMK+wbV1JNdNMuwaiWH8TAx968ZJiqp1Sraz1dj1qeISMUpYYXcZdgaRGACKiQH/FiTsJQMAAP8Kk+0SIxX29UMiMUGB3d/oVDc60jYv2UvswaJTOfwKO92U+rpv7HbN6XpU2AEoGgYAAADILRMVdlH2xNcJr6+j9mEXRJbDRIzgejJmCLHry13GxhFG2EXX3VanoutO2JFhB6CAGAAAACC35GbR6SoVdg2x/7TEvoSP/hC7PChZrd3PsCcXU1+3yi63RbgMu/V1UXZk2AEoIAYAAADILRPNsMvGScTqNW7Rqd/W0df1wNb1p5A1xe4vOw37xLgSu1dg97rELHaFvQQAGAeIOwMAAMgxuamwpzLsouzq60oqEMOH+nqi6SLa2Rec2oJ9Gm/FqRJ2dWScr0PYASgaBgAAAMgtORH2IMMelNgHZ9jFuLPuc+qasQcs7WvsuNxrE7PSCbsmYhgI+3f2zuW1iSiKw/h+Lt3dUVPJQCtMtfjAEVFroCqK1YjP0lYt1AcIyawKoRSyKRSzCqVbC8bsDCFdZdFF9oX+SZ575h5nbu/E0U7aPDifSdrJZO5cs/o8/u65DNNXCIZhGIbpWXpA2MHYg0iMXmFHPda3OsVIuZ6JSbDolKCrg4q9Qt1vR5cYvQ87gL4elNhPsrAzTH8hGIZhGKZn6XKXGPT10/F92OEhMfuwK79OjNbLvU0fdpwHCrsiMhJznDPsDNN/CIZhGIbpWbrbhz3cJUavsJMTaxF2Y90pubr2umtXx1cjD6MnYoImMTDHyD7sHIlhmD5EMAzDMEzP0gPCHtrpNFRgJ2GnSIxp6wRFWRLYOkC6bmr7QXPjJOSIsdPpce4SwzB9imAYhmGYnqXLGXb0dYAiMQgZu1lhN6WdMudA0qaOeoSdOAgPIrzTqZyf1tWRjF11iTnDws4wfYRgGIZhmJ6lm8J+yt/oNJSJOYqYO53CH9o2KSzrqrpOL4lQpXUzEhNkYnZE2PVIDBo7t3VkmD5FMAzDMEzP0k1hp0wM+boeiSH0AjsKtBGJSVxhp6exdZIZYQcww25E2HnjJIbpX8RekEqJHiCd35CsiV2zWKkMiWiWy7VKZZGOyuPfRDus8fFlMRik1lr1ejPi/Q1JSzAMwyADJexBIkavsCtjDyrsaOvGolOKridqxo4X07N9hZ2M/TChGTtl2LnCzjB9iOg01rvsA9d9kH0qkOys4qLYd35OSOpthT6TSYm/suQ4eRFJzZEs0WHOKYh2ZBynLOJZKCIFLyM6TH65Q0NmJhBhMITvbwuGYRjJ4Ai79HUJ7XR6NNQlRs+wB7smmfsmobd3BIrEwGt0iR2Rc4rY6fTEsT8F9tMDKuxPR0ddi2EGEtFpsq7iER66xDmx72SazaYm7IZm/tylsC+CrVdLpfUOCvuSQ5RFR6HJJWcLpHyj3hIGKfiit1nYGYZRDI6wK2PXSuzaRqcgxnqTGFXyJlVHQhseJd/pVI7WNsNOyh5ZYKedTo8PboX9km1/gB9vRq5YDDNgiE6TdScffZp5BIo+7Qt79hEyLPadNDz3RtjHHWdRhPAq30U7hiuV9X8T9sb4eCnnwNA9KuwTE1uiLRss7AzDKAZG2E/pfdhP6Dud6hX2cIqdoGq41o096c5JOG67Crve1jF646T+yLAPX5uamro8bP0HKOxf4Mcze9RimAFDdJrnl4Tkk+s+9oX9uegm7YU9nUDYS46jDZUWSaB7fZdDwdDV3hR2+L6aLOwMw8QzMMLuV9gpxI7Sa7R1pD4xBFXYQ9JO+fPkq07hYZbY8Y9u7JqvIzuF/VSPt3V8d8eWXJm2/ocb796ds1jYmYFE7BUP3Ac9J+ybrY2t1qb/a7PZmpjYaAJDwsQql6rji3+EPf2jVm2otaPDnucVHccD8I2hsmRV0MmVC+VCtXaB1qZKVtSB51nLXrXhUXT+R6VaWUgt4XkUdsBynJxv8N6qwE/j/DIwoVLZn+qQ5+UXa9XSEoyjT49Or6RXa9XCUlre0nOcoges4wTUvNY9b1j8D8H39RPvKL/KjdZmG2HfrG/B2TxNb62FR4pHr169mhEMwzD7Iuzn7z6edb+8n3/z/os7+/juv15Gwn76T19HlWE3MjHK1822jkiw01ESZccxCH3NqXwG+Lpu7Jx0jPqw982i0zc2ggmXePTb6MJ+0WKYQUB0HhL2yR4T9tTGBFJPoV/+YVMYXCg6koIS9pVfoXR53vnDErqv/1Eh1Ekv50hQn9NecB06OTyAooXzKeBBBd4lYZfArdMCcJzSuANgwX3VQXLrKkFfwsNfGaFPD1l2nB9VR+LJUYkaXlgTdJOU+Gf070sA2+r3ejpC2NNb6uwaHmbUh38Kn9cjIyNZwTAMsw/Cfs19M6bxxr32b1cGGydRht2MxJj7JqlydzgRg8/AvJNA9XoaHcHcfGQjdtJ1vQ17Lwn7w7Y+Pmr7jFxXtB3p3L2b8LnReVmLP3/r1qx15xZcfOvWFwuYvTNqj96ftRim7xF7xFnXfeEL++Ts5MfPF0V3IGGnNZP1+rb/zs96HRx0qw5khEERZLjWcAAp7EOOPKzA6zd5VCrJpHkJQH3OFwqFkLADjUoRXvD4W6HQCAk7UKiQWtdAwCtg3rqwp+FYSMDr4dH45VT9YRs1aeEZFHagUCuiy2vTI2GX828UQdjXYZZwmxKwgH+vHH2kInbw7kUI3ea176slALn8tCW/y40IYW+BneNZFHYLjrZadenvLOwMw+ynsJ+/fm8sgnvXz8deqnWJ0Rad6hX2oMQecEAjKK/jM0F5HV8oxK6tOTVL7GTsZltHFPbTPbLT6aj90orG3snNNtZ9fsT2GZ32F52S6z+B4voTde6exTD9jtgjXrjuJRR2xTXRBTRhXwOLTPvl33zMotMFX8DLStgrvmFnck5OiWxBiS+RCws7mHGKyuRARhP2FSjfg037np3LoDtrwu7hWYAK6itwtiQ/g+cqSth/CJEGgV80p4cj/pLRl9VVfXI4wIL6t4LRG35qMoQVs0i3ladSumUKO7w7jMGYjADqeBm2fkyxsDMMs3/CPjU31oa5qbhrNWE/jvzJsB/R+7AToRK7FojBp3rddX/HcDd3g8DWtUiMnKMkHGE/4Sdi4LG7Cvtz98O9N/Nz7x9m8drkwt7O2G2Dm1HZFszOjLjXXdD2+0rY5+Zh2Pn5rGW9hKu+ZOdG5bsM0+eIvYHWnAp38vrzqVkX9b0bBMK+rYRxZWKiFSPsDRWFycFPNOsG9YZZjRf2qjLjfJSwezg8Xl1GCVcyjidrC9/KDfR3iaqYU7VdqAn5wl6kOrk5PRT2jDk5gD6bzuEAOm+nQqRjhD34R9CmKezb4V7tKeot04LPsrAzDLNfwv78/dhfeP/8H4T9jDJ21HVAW3NqFthJ1829ThNvdEpQIj6Mv8zVWHSK6DudHkuYYZ/JzoXDRdmnHRD2dsZumzyyorhl21fhx9mb9ii1daQM+2XbviPPTUMs5obFMP2N2BPOwZJTy/8NX++67oO06AaBsMvENQIGGSPsReWzFdTudfDjSgkogHDHC/s4RmGw+G0K+6oa1n8dwo+SsBMlJel0D6zJ12hCwxRFx9tWI6a3jEPokyMKeNOF+GbvccKe3mzCV7mlci5Ghb2ep4MVDCIBG9Rk5uLMzIwlGIZh9lLYs2MxZGMGoAy7noghYzc3Tgo5uxGJgUdiW6cxDvw1E0O+fijUJeYIRWIAGYnZZR/26dl54z8qkgt7tLH/h7BDN5kHFvB4bu7GDmF/bdvTlmTStjnGzvQ7Yi+4Cr5+XoT52IWdk0jYSTcDtmOEHUWY6uSo0kQlXtiXVKhmNUrY8yqQ4pfxhWRRE/Zig5q2h9o7rtMQHkZZFumw6BSN6aGwe+2EfRUvLYD3JxP2ZVp1GiXsm3hia01tNxtQFwzDMPsh7E8fjsXy8GmssFMmRgn7iai2jlFd2A9G9IkB6GVXuq5FYnb0dYyOxKCva11iIBEDyEjMyf+OxFybj/oOzycWdmDMMvh3YXfhzMi9qat4oAv7bdueROAzry2G6W/EHmBNuu6M0Ljsup9EFwiEPQ8K2VSsxQg7uXIZDBstueQpVhMK+4VA2KtK2Je1DHtAqE7+jc6VcdhFOvzl5CKmt4ynjcnRQVEGYwrCYPhiiBhhz0shrzebdV3YiRW/Tcy2DObIvWabihXBMAyzD8I+A3GYeN7PxEViqK3jzkWnR1HX0dilHgNgymYfdnR1qrInrrBTJuaviZiDEZEYBBMx0thP726n0xdjkXydTi7smGnR+Q9hP/vaRm5nrbCw0+gEb33K9Dui86Rmwc7NTPtl0QUCYU/hb2n8I2Ir7L8oFQ7C/gOXeNKVHRP2klqXuhor7FQzpwkt4iFV2LXpUVvHyMlRjf43e+fy2kQUhXF84Hvp7o7NRCaggtbBB1bEV0FbWk1sqdpKrLXQFwjWlVBE6EZwK+K2BR+7iug6C/eCf5I3Z+4xc+dMcjOdxFDz/WzSZGZaL7P65fS752jt31Qqz6bTbyaP/kEIu8Gv/ag7/d9LAkIBAMA/EPbqzbAtblZdFXZ70in7upybpJFdYtja84fYucDOPWKSJXbCrrGTrYtIjCPD7k4YzZcnlyqF6pOpFT5QzS/szzyBQ9gtlu9fpvP3TkDYwX+M6jj+RIqcTw4NVVQv0NYoXjmEnSrXnPheFRGTTgn7C6PNL9zCfoJfr5HkvzJvfdpCai3PIey0mk9b2vMFQRZh/80bSePCfitQDLdzjIrxP5XF2Pz8/JgCAIAuCXtlLmyTuYo7EmMGJ/GmU0LOTWpMTqKviEbenPPnOSvs5vfQv+Z7TknYRYGd2zqSsWcV9kchMT3VOLQ0yvcwr7DPeQKHsAsqs1f1BeWEsJ8snfQA+F9QnSZYjPdwDIy8jQwNeaoX/CKPNK9WrUUFrJKCr5FuF6O2jr7ul2gW73dQ2F9FwZRg3Sns1B3Gixa0bto6+opq6zfE8qSwr5/esjvgkOELvFMNjimXsNNd9TnDTu7Ot9duFhPoa3zrvj/VXWLmFAAAdEnYV8K2WXEIuxWJ2U8ku8SwsKdX2EULdnqRq7GjRlTYdyXbsPOmU1b2XJNOOb8+ameIxqKjK7mEPd3X2xf28+H9cXpxU+fUE8J+p1Qq0LnK3bvjHgA7GyXI34B9tkrUY+yLE0vHAq+qQ+2PVA8gj/xVKxYDLc7GLoe/sVnqAzVfCagry/O3qrhl+rBvaE9+o1Tw/vvzzgk7hdg/vX3z/bRT2Cm7/qWohrfoUhL2L556ozW+KJYnhX1NL2A41mNew2+dSGHncvpPXxV/xYS9pjPrH4pFv27q9R4x/mfzJ43P+oR+H+iQDIQdANB9YS+HESPjIwthOs8mZs2rsrvC3hB2seeUkBF2elhW3Zh/lG90Er2iByPmJhEcYY+wS+xHNNmEvRBFjGaTx2ei44/yCHu6rzuE3f4VV+j7WKkUJoR9gvea3i6VIOxgp6M6ja6lM75SE/y67Kue4N8i3tL2R4MRdj5QSy2xn9Y6TMJOVWl+bwk7yz3zXAj7RuPkWlLYSbg17VTY/XWzgPWAhJ3Xc0PZy5PCTpcTXxvV+i/KhXvTKfGbhV1Tt/fobxbRGU3N2D2jiDkt7M8UAAB0RdjHQkNFbz6duhkKphcH9WXcUXzMXWE/QMi2jkbXucjOaH8WPWL0U35Y2O0+MbvF4CQusSci7NwlhnxdDE5ybzh9IE8MTlOMvZJD2Oe8dK6UBGc9CbV1vHfh0qXlk1rKWdj1gNOV8Sr9knPLp5YXSujDDnY+qtOULWEfM/4+5qveEBR//FX01d+mu6Bnzn02WikIXpzWbL0zwh5sGLe+IYV9NSnsG0bYNyMLZ77Tu2EWdvrRL/pn1l5Ffr1B32JQk0bGW4tatPvGwN9pg6fKvVieFHa1uRYX9k80kCk7gRF2npik+bEaE3b/Gwv7D2PzfGM/m/cmgHRHC/uMAgCAbgh74aaddrm4oBV9dKi8uDg7NKr9cmG8QMdHeONpwT04qR5hP2Ay7BSJMdiZGP3Fg5MYVuuYbOersfNLwkrEMLLCHsuwa7YRiamQls8V0m5SWGd828I+W/aa8KCU5NwJL42ZM3zBtfMs7E9Lmrued/1MozoPwA5HdZuByuDgqZ73BwmiJ7/2uTacPBWkXe9vfjwe//HjLzfe04HOMkxu/4pX2AJvc+OVzyVzrdyrHzf9bS1v/fTzYPv3kAlWP7zlA5LhxH0u1j7Uiiz22tfvKgAA6IqwT4WJsMvgo5lYSXj5SfK68ZZdYqjCfqRFJEYU2O1BpzzoiNu85C+xi02n9LAr7HpR7Ou2sZs9p0cyVdiXwzp04wRD9KHHKezZGXhg19jPzM946Vw/F12wcJ7aOo7qQ8fuRMLuDdw5Qyo/6QGw01F9Rc8/OAh44mkWSNi3yybV2rtLywaOk1rYBxUAAHRc2LkaTEy4+54Q05UWwk7KHvm6xurryH3YCZJlmYghuCdjrraO/OOcsWnW1dFgCux77cFJLOzuDLuU8qH0c0thnSWHsHeZgQuLF5+c8NIZHB8b8ADY+SjQKza3XheV/47i7f9I2E+svn5OMZ8e8uzkyYcKAAC6IuwTYZvCflFc6Nh0SoNOrb6OqSX2XfRIhNjpiclr7XaGPfrP2NeNstOyNI0Mu/F1UvasGXb6DDTZ5OTTUDP1T4V9ZDTGjAdAf6BAr3jJ0ffj/0zYv3JPxx5yoVwuKAAA6Lyws1xaeySdZj/dIsNOg5M0lGHnTadWW0db14Wt83ciZ4rd3naa3idmT4RVYLe6xGSvsM+EmoVmUf9Fx732Os+ZUowVD4D+QIFe8fZL1D6mqDLyJo+wr79TAACwc8gk7JPhX+bFSVEZNkxmbutIys6+zsQCMbHJSZGjczAm94ZTqtULW2f2MLKrY52Gr2cR9smWzdavh5qn/1TYly/GqHoA9AcK9AAOeg+/KSoAAAAdEvaRMEOFnRlxC7vMsMsSe/MMOxl33jmnjWbsgt2Jxo57rTYx+xrCzomYTJGYRxxhT2Wp9YcjxMcBgLADAAD473EIu0jEiHaNznmo0w5h57aOJL2JCjvpsT3qlCLldiYm16ZThq2fK/YG8/8lusTYfdg15OuNEvuh9oV9kYcmpVIJ60DYAUgAYQcAANBHZBH2s+FflgccPGlc+6RFlxjy9SPuPuwciRF92I1f58bq5d6kDzutg4TdkBqJOZAtwz7eciJslRLuEHYAEkDYAQAA9BFZhH0qLcHuLrFPNe/DHu8SY1fY2YmtCLvYd8quLp+zu7p5TuZhRCKGm8ToNab2Yd9OJOZBy889cxB2ABJA2AEAAPQRWYS9LHLprsoxUXYIe2zSaazAzsLOkRhp6wxHWXLYuoZ1XWr7bjk4iRBzk7bVh31SzEYSU5VGIewAJICwAwAA6COyCPtoyDwacHI9ZEZbZNjJ1zUciSHY2GWFXUo7Z86JfE0dRYSd2K2/mPik0/r6rK6ObOymS8zRNoW9KmYjialKZQg7AAkg7AAAAPqILMI+52jVKPubEDebCfvhaNBpLBOzj5CTTvU/HpsUl3VTXeenXJjSuozENDIxiQi7HYkhY5dtHd3Mt5iNVIimKkHYAUgAYQcAANBHZBH2+ZBpQ0Ufi8C7EHbOxLCvi0gMYRfYSaBFJCZ3hZ0fYnSSiLBzhV34+sEMg5NEB8z5QvNdAwsFCDsACSDsAAAA+ogswh7+5UKWCvtCS2HnREyywm6MvVFhJ1sXm045up6rGfsuS9llhT1h7HsZy9g5w561wj7YfGfu4+loRyqEHYAEEHYAAAB9xB/2zuc3iSCK41ETtdqjt1mBQzeRHqCb/ohjjG16kYYqlQYRSIHSpGgTw0VuXowx0Xho9V/jTtKeOXvoybdvebDDLAwIdqm+T2XZ3cFt7enjy3fem0TYC8FdHU09IAujNp0uutCk09u+LjFqhr0/NUmfm4TePhMoEgPH4BI7gt3h9UmnC3d6BfZFRdhN5PGXVBzaaafKws4wg7CwMwzDMP8Rkwj7ttKp0cC+OcNOxq6U2JVBpyDGapOYbsmbVB3xDTyaftIp2Xpghp2UPbDATpNO76oVdjPJYwzFJLWFiuMiIyzsDDMIC/tcEjlcfRY/EQzDMEyIwl6bpK1jziFqQzedqn3YF9RJp2qF3Z9iJ6garnRjn3ZyEj53WIVdbesYPDhp0gw7FdILW+rdqPQCRW9Z2BlG43oIeyymXf/TLG3GgUPBMAzDiPCEPR+ccjH1gMyPrrBTiB2lV2vrSH1iCKqw+6Sd8ucz2HV6I6DEjl+qsSu+jgwK+31jW0e9vf1xNur/Bb13kHSEhZ1hNOZf2K1qNiVlKrtHNyK5DFzX98S8sfT1a0zMhP14/EVx+R//XwnDMMwEhDU4iShGDOwdO0RlhLAv9vo6djPsWiam6+tqW0fCN+loCmVX0zTqnlP31cfTdW1y0h3qw27YdGr6rR7lDiJIdEs6HrsRFnaG0Zl/Yc/KLmmBJFN0OW98aTQ+iZkg4/GiYBiGYZDQhP2d0yNjTsT0SI8enEQZdj0So89N6pa7/YkYfPXNexqoXq9E5DE3H9iInXRdbcM+qbBnHYWarNQz+YLT83UWdoYJ4DoIeyb9tpyWUh4IYA9OSm/LK5V/WdhP4vE1wTAMwyChCXvSGbvEHj1yeiQNXWJ8m07VCrtSYicGu8TQF9r6NOV1PFCIXdlzqpfYydj1to4o7IvjTzqtOCM4TkdY2BkmiPkX9v0kvr2VclcAdZkqewEUMW/MVNh59y7DMAwRhrBTmxiiFo2Mou7LeUQMwn4XWegNTlL7sBO+ErsSiMFX9/jH/R393dw1+rauRGLcn9HFH2Ff8BIx8GfMCnvKIbYdjcOtCAs7wwQy/8JOpGQKjhEp34nw+NA8E1/POxfn3r/zx/lFp/0ZT8+azfNG46IJfIHL781mTAAfmx9w2Wo2vy/9aHcuPi25n/0kzuD8lIWdYRjGSIjCnnL6nJCxG8Izjhwm7A98m04XAGXPqV5gJ13XZ51OPeiUoES8H2+bq7bpFFEnnd6ZPMNe8TXK3B9Q9vdQXmdhZ5hgrpOwZ+C4LuWyCI9Wow1aDnTgInbRQNqumsM5ceaafaPxRQDtRkO4fG00Tju4eu5+tuU9pS2COWRhZxiGIUIU9i0lbV0emoepOz7eRQwZdl8ihoxdH5zkc/ZBWcfDtLZOz7gxMhNDvn7L1yWGSuwLgBuJmaAPe9ZRsurpHYcopKC6zsLOMMO4NsL+UMocvJVkKlbdzezux0QYtBqXjcblRQeFvQOn7fal592f2m1w9k4b+B4s7JewfHEJwo5y32q7x68ikNV4fP4SPwzDMP8CJmFXee/4OCrtBY9MOlQ+BXeMg5NQ2BeC2joGdWG/GdAnBqDDH+m6EokZ6OsYHIlBX1e6xLiJGPT1xXtjRWKyWiOd8npudzdXSm9FIxEWdoYZzrUR9pyUSXjblZW6dElFRQi0wLR/uIkXCKufQgIGtHqpA96tZtiDhb3xy71zdobC3onhA85FENF4fFMwDMMwSJjCXvLsMlkqOC7H+XcDzh6t5kjXtT4nWiSG2joObjq9jbqOxu7qMQCmrPdhR1enKvvUFXbKxIxMxNwMiMQgmIhxjX1x/EmnGYfI6oss7Awziusi7LTntCKlzKyv1OEYRg0ahP0bnV82WjEMspN3m4R9TSAo7B+9p10IDXn4GoYm5QTDMAyDhCns0YKr6SVoGHPUq6DXfT6/faw1OtkbUWFXJ52Sr+tzkwC9SwxZ+wxC7DfoSHkYtcSOqDV2tHUtEjNRhl06RB2u5l7YnyVeTr5G7CUS0mKYeUb8FSIpmcJHZ8DU3ZMNKYvi6mk1WoJwYy0IJtrNwn4hfMLeVf6O0HgGuv6qLBiGYRgiBGEnSpTgKJKaF8pBbWQUGTVNOl3sbzpF9LlJ/clJ+Mejnzen/PmUFXbvOfg1fM8pCbtaYKe2jmTsZmFPKb+i+Rf2hL06+RqRtO2axTDzjPgbrKUoApOVsop3pCyJq6eFik163uPXOMJ+3hf2rvb/ChL2/PZLUPZ9wTAMwyDhCDtRc1z2YYdkUJwjp3UmjI4QdjUScwcZ7BJDwh5cYddasMPJlI0dAa3CfmOwDTttOiVln3zSqXSIElxdvbA/Wi+VSiuPrDGZXthPLIaZZ8RfwMpIWe5F2SPdpjF1ccWoIZaPUFg/73JqFnZYMwo7kY7HVwXDMAyDhCvsRcdlO0rFdmddW/VTjZgr7CTs2p5TRI+w40ux6l6gZcrRSXiGL0Kbm4RQhN1DLbEvAmZhlw6xAVdXL+zVTdtl9cAal2L157Als7A/rlY5bs/MN2L2xCpSvhUeJSnXusKeFVdPq9+J0VK7MpqF/dQg7GosRjAMwzBISMJOVHpbSZP1fH5XNfI9R99xaqqw30WGtHUEOVYz7K4/az1i4DA9JOxqn5ib2uAkKrEPRNipSwz6umlwUtbXfx25amEv2Ig5qLL8OOimsqYI+/LABxnmmiBmTiwr5QpdrEi5J4Al7PJ41ZCwUzxGE/YPwmPptNs6pvNHwr7NfdgZhmGIsISdyFNyPQh102ke75kGJ7kR9rvdDDtFYoDBTMyt3uAkgtTaJ9vT1djpFFESMYReYfdl2IHxIjFpQx5mVsK+M9THE7ZHfKNL4JNyr57YduJl0QJePC1YVunp0+WiE7ej6hoJe2UzYSeeV+i7w5X95Mh9cvTp04rFMPOMmDVLdSnXBWFJudHtGhNCzBuFXen1gix133w19x+evK81DMLOk04ZhmEMhC3sUWzGvhM1C3uNPjO0SwxW2BdHRGK0Ars66JQGHVGbl+lL7NqmU3ypFXb4ocjXVWPv7jldNFXYtw2+PithT9ivrWDsQZ4ECPURLe5aXSnP2PaG6/rRgDVr+aXtsW0BkdXuVSLJm06Za4CYNTkpKwdIWQC7Um5h1xj5UFwlurB/hzYx31wXb7c+0mrrsyWQx7D4Xax1/ljYHwmGYRgGCUvYiTL6Zm3FJOxHahVeF3aAMuwLgNLXkfqwIyjLeiIGoZ6MU7V1pL9OGZthXR2VDDuNOkVdV4TdVGE39F+fobAPM3Zb44kWX9mBu29k7Rm8HfSF3a2aby4HrFmvYeUke5Tw5PwVfPQ4U4AyfJyFnbkGiFmTkj1iwlP1lHsvLUIAhZ1oNoCWe/hIN5AzlHJvrfVHwi7j8T3BMAzDuIQu7JFyzXEpnOzsvC9Ehwn74YGyYtp0CpOH1L6OgSX2G/gaCLHjgZjW2tUMu/fNyNe7yo4/FqBm2MHXUdnHyLDXDAn/2Qn7MGO3ddKWykP42xsW8AJtm4TdfrIfvLZi25trcOsAYjGPrXX44AFcrcEnt1jYmd/s3d9vDFEUB/CgwdJHb/caJJ1EJXaJarRptCWhzVbVCqVNtSUplQgRb7yIB4kfEfwDHohHD/wn3iX+DU/unJmzc0/vjK6dlblT30/t6uy0MY9fJ+ee4z/VaxdlYFdDLVp0uqBKIAL7wMCTX/cj33+cSj559Os7B3ZTXDd+dnfodHhwcF4BAECk/MAeHJg/3pYX2Ofnglzcw06Lk4zdtfTQqRzrKOO6k9b5b1Ksi10eO82ZE7MjJgrsYkpMZxX2Y2vZ5017H9izE3tHgX2Kf7VRr1+1AvtSzr1r8S36oWU9G4at+Kpen0JgB/+pf+/gXOPIgPKCfvv02UvVJp7q5Zu33T7lETOJ/fSllgIAAOVBYA+CmbU/B/Y1N412PtbRqrDvaLMaYqzNSXFG58aYogdO5ZZTIk6cMneqY8TK6zKwu1amr9+8HLh6H9iN49qxeWCnQTInNUsD+2zePdMec5GMmG4ZPRaV2RNoiYEKUCDSe3eujJnIvqoAAEB5EdiDxt3jsbms7uzpRuDKD+xuD7tbYs/vYafEXXDPqTWM3bF9w2DHPjEmZmca2LkjRrTEFFE8sJMh7dg0sFMT+hHN0sA+n3PPvKVOmKtBzRDYoQIU9MDAwIGJK0sKAAA8CexBsH4mL7BfXww2IQJ7/26rJUZW2Ckey1Wn1FIue2IKHTplnPq5Yp9I/r0NU2LkHHaD8npaYt/jU2C/px2dBPbxMNQWDuwzefdkYA/DMc0Q2KECFAAAgLe6Ceysaarsa7Il5ro5bDo8F2yKp8RQXu/ffA47t8Q4c9iTfF2YmOWeM4c9eg7Sl8hsiaEa+x5/AvuqdnQU2Ge5J11fXlxIA3sz796gqKmPhnVNTi0u3kBgB/8pAAAAb3UX2NnKzIT7QQd4Drs9JUZW2PsSooXdOXfKWV28d53V6d3phxEdMdaQGPOMmXPYPWuJWdWujgL7vTCcpm/uhOG4COzZ9y5E49kjc7OzM1ENfoWuRswjILCD/xQAAIC3CgT2Qjiwy02nVoG9L8YtMSKtS9zKUiCtGxzX3di+3V2cRJy9SUlg96rCnpnXNwnsC83mDa0nwnA00JrK6XdFYM++14rOmkbOR30zd01fzGFtjIbhMQR28J8CAADwVqmBfU+c1w1uiRGrTt0KuxvaueecFBvqKFvYWbRZldmbTqPnE1MdObEnU2L2eRHYV3W2sdBxzL55RlPJfHQmuLEahvV3IrBn3qNfO7F+ZH0tjAbEDI2aq+bQgvnBMfSwQwUoAAAAb5UZ2PfGi06tnpidxN10ar54bZId1uPqOr8Vk5TW3ZaYtCcmbWEXg9itxJ4U2H2psC9f1DnmQ4nq4QkO7EujfK+lRWDPvqcn6naxfpiv6g0EdqgABQAA4K2yK+wU2Tmvi5YYJgvsFKCdlpjiFXZ+ydVJ7lBHrrC7eb1meNYSky+YlzX2+q0F3TaWTJYZukqhe3BdG/XwEgX2y5o494zgAn02Hv/I0ngYudTQFNinNYDPFAAAgLdKD+zcESMq7GIMO1fYjW3OoVPzJea7dF9d51d+hZ0Tex8TiZ172D2qsBe3NNMM/uZew/7s8Mrtif0aoBIUAACAt8o+dNof4U2nO60pMbKHPd2a5O5NotzeE9wSQ+9ZJXYSPVPGptParnaBvX/LBHaA/4UCAADwVvkVdsrrzpSYpIW9b+OQGCp5J1GdiVWlBTedirTu9LBzZM8qsPOm091bqcIO8L9QAAAA3ir10Kmcw16Tm05lhd3uYmdcDRfT2AvggY70nllhl2MdsxcnVaKHHQAQ2AEAoCo8qLAnTey7Is5YR54Tw7jCzmgGY6GlSYSr9BkldvqSiV3kdbIxsO/1YqwjACCwAwBA9ZUc2Pvbcx3THnbZE5PkdTnWkVmbjgpEdtlNI8+cRq9UHNedzUm7eA77ljt0CvC/UAAAAN46UP7ipKSH3W2JcfcmJeVuuyOGXmnyLoLr9aJFnvrmMwexc1yXY9gR2AGqSAEAAHjLhykx4tCpqLCnJfbUNiEtr9OrQHmd3riJXZw5dUvsnNjdsY4U2Ps92XQKAKUG9oMH1ZZz8OPkp08P+er55OQhVdDkp1fK8uVxBP+DAgDwLLDvJrX24iQ5h53ZJXbZEBPHbd571BV7mrsjTeuiJSZ6xojdwl6LO2LMH1TYASpF9ZpeaU2NjEy15uhqeLntmKqyFw+OGg/48sPRoy9UQQ+OvpaXkbOqG4fOHlIAAFtRiYF9n3XotGaIM6dugZ3jurvrtPCiU8Yd8bb4mKtz6JTITae70MMOUFmq11ojiaYylqPv+LrKPpu0/vj1pIoN/IPA/vH9+6/dBvZz574pgN/sncur00AUh30hvpbuTtREIqgQFXxgNuq1UBXFJwoqvkHFVZuVUEToplDMxiJuFVq7a5G66sKFe8E/yZMzc5pMp/GVyk30fPc2t7mTTuJGvnv4zRlB+BcpQYY9k4hhY7c3Tso4+7ys06GorfMca3+YiWFfX5/pEsMl9s1IEomRPuyCUEEAli7sl84/vXseDf0Ont0/r7gUhjuhygTBEDK8GAy8JQu7D9ATYRcEQSiXsJOxK2HfvKit46Iu7Piy+sQgfPgjXTciMXN9He1IDNfXzS4xm1SFHf9NWyQSIwjVApbNtYOQ8DQML2Rk9Gx4D6pMLQgiWDIs7IwIuyAIQpmEfTu3dZxfdLqRdJ2MPdFjBE3Z7sNOrs5V9uIVdoJmy0/ErFsQiSFUIgaNfZvsdCoIVQT+FmfDszDjThiWMMK+uzcYTsYvgHBfDoatqAMJe6Oou7vXGo530+nzKBoHQSuKopfqvJfggOb9eBi/dPq9NwDg9HpdNXVPqffL6A10ouEk8pJ5+4PJKMabsLA3o8kkai4Wdo8eiM9xoihyYQG16XRar3+bImomdzqt+Z+/fP30wQd4O/0MCR/0IHz+8unrl88gCIJQDVa1wm7udMq+jlg7nRoldoM1xUPsaQt3Ndt8iZ0wa+zK1s1IjPRhF4TqAsuHhf0SzLgQhuVrf/IuUIwBabYD4iWdBEHUoFNy61bANDjPjnRTy0aGjaBFn1QzPA+CNzpKE6+oC2hQ0dPCPlQ3eb9I2N+osQZNQ1fToM2H+owvkNCs199+pfNpWnvXg+6nOvHxH+zjIwjCP0kJIjGbtqWLTgl736R05yT6VqR5c86fF6yw63noK3/NKQm7VWDnto5k7CLsglA14C+xIwyvA3M8yceUjUS0J+NBm4IpPvp6e5CY+SvQZj0ZtPFAZh/HODKKY73oNGq1RiTsWs2D1hgvzRP2ZObJKBH2Lk4yWBkEeA0r+Gg8waNnC/ubZMKV5IGaPxH25sePH7HC/hHpsLB/q9e/fvq2QNi/0pU4/BEEQRCqQBl2OtUbJxHzXWJY2HMq7GYLdnpTsLEjYlXYTWPfoCvsmT7sstOpIFQc+EtcD8ODwFwLw7tQMjwubb+LVLW95QO8R7nWwv4cwEXX9oFgEbfbOo5oGq+dK+xBI7lNF39dG+/Wd25rBY+Vpa9Ywu63k2npgSY/Fnbf5ww7vSVhR133kvTL53lhf4unPl6I3t4EQRCEClCGCjsLu73mFLEj7PQyrHoWaCm4dRK9oxdj7ZtEcIRdYZTY0delwi4I1QOWj73m9BLm2cvGCidTWLtrOv3SIe0eAhJxfTtf2LtK1KGfL+yvYA6ssWsF361+NixhfxUEEcdvfEvY8xedsrB7oDGFHUvrLj11cioIglABVr/CvonIaeuIcmxk2DkSw7BfrykOC7vZJ2adtXESl9iNCHvaJYZ8XTZOEoSKAX+FnbjkNJ36bhmbsKOau9mOLSMW5Vek3Sv67EW+sHMipg+ImyvsDUjZ248GcYzVc4fu2YaEmJzcFPaVJJITIyOdo4dmt9uFXxN2PrOFPUmvE1iDB0EQhApQgo2Tkgj7Jp1hp0iMxszE4DdvnMSwWmdku1iNnd8SRiKGsSvsmQw7IpEYQagm8Dc4gr6+y1hyuh/KRtswaU6evKDKtqXd+cLe4zWjucI+hBlRwHgk7BOW8+a8sLeClOfA/LKwTxcLu1dP+QaCIAgVYHW7xFCFfdsPIjFWgd3c6JQ3OuI2L8VL7NaiU3qZFXZ8KPZ109j1mtNtUmEXhKoBfwHnkpFZd8LwKpQOrm+Dro/HnHBZ+S1hj7gCnivsseHrrZUoGrKwt1jYO/PCjpdETPP3hf3tImGnka9TzVsQBEGoAKsq7KTsytcRo68j92EnSJbtRAzBPRkLtXXkj3PGJq+ro0YX2DcYGyexsEuGXRAqCCwf914YPoWUU2F4H0rHaK7CPuTmLC9/S9j7VAG3hL1vCzuF1Sm0PmBhV/cc46kp7HTJXgBffxUXdpeE3aXuMD6SzCoIglABSrPoFHceMvs6Liyxr6XXXIidDkxRazcz7Opm7Ota2emxEDPDjr5Oyi4ZdkGoILB03Ku0S5Kx5LSEXb9jCqIw7aDNyvz8t4T9vY67v1DC7unFopEl7DQ2hoRZhb3Bp6B4yfkaiOhdlpU4Huz9fWH/psLqTc6w45nBg0ePHoAgCEJpWdUMO22chFCGnRedGm0dTV23bJ1/EsVS7Oay05w+MesVRoE92yVGKuyCUFFg2fhPwvCo8Z9tGB6D8kFtXYiayoy/V+Ie7P4tYXeCoOGS/6vp9I/2AmHfq4PyLzjDjvdUHj9Km69HQHToWsLNb+uY0fJvOcKODRwB+aiEPW3n6INiHwKCIAilpTQV9kyGnZSdfZ3JBGIyOycpR+dgTNEFp7pgn8VYccrYXR0TtK/LolNBqCDALLEB+707xF0gjoXhZSghI3RpD6A7jJUgNzrgDsi3fy7sPgk7J9BHL3bjcWbqz2mehZGY4JUL7xupsDe64I3wt5ne8FGz6ek/ALykrcxo+AvCjvuXTj1b2NnU/Q96G9RaXY3VPtabIuyCIFSBkgi7lWG3Suz5GXYy7qL7nKbN2C3WzTV23GC0idmYCjsnYiQSIwiVA5bN2XCGC4h7NrwEZaSTKDC+lFHHdIJ0fyLsdCnTQ6Ue0buGFvaXAZ/awt4LeJCFXd1zZLaRoWh7rZ0MJqO/IuzNOvHFFvaa7gmjB6d1Rgm7L8IuCEK5KYGwo7GnkRizwk56bG51SpFyMxNTaNEpw9bPFXuNvt9clxizDztCvp6W2Lf8g8J+4sBFJ+XAgdNOHk8PHLjnCEK1gGVzaU7Yb4XhNSghvu+1goT2q4wrj3ZrPX9Hws5Jcv4N0TKEHdxBA60a9T+maQcBMpl9MggGwPjqHlHEwh6T+7fc9IqXbVZ0dxwQo/4vCLvf/DQTdr+WFXb/Lfm6x4PNb3XiowMJp9DXz4AgCEJpWeUuMeTr236hD7sydrsPu/brwhi93HP6sNNzkLBrFkZiNv2jGfYDew7j8d6+fZcdZM+eG04ep/bsCR1BqBbwP+N2+q+6oPE7/Tfe71o/EJ4P/ix+vvvV8725fyO8edeBLN6r5541Ib/vvuq/8H7xOXyaX9/GGHI/v/WyV7qfP3yugeYZCvtTEARBKC2r24c92yXGrLCzExsRdmvdKbu6cfxjV6ejlYcxEzFpkxh8xoV92KsRidl79Pbt24f2Or8KC/u5PXvuO44Iu/DPAcJS6FMSfdXw4c+4sm/fRRAEQSgvJRD2zE6nmQI7CztHYmxbZzjKUsDWEdZ1W9vX2RsnEfP7JlWpD/v9k3sSDt9xfplb9187IuzCPwsIBWmvNAHeNIJGBTubu1hgPwiCIAjlZZUz7OTrCEdiCDZ2u8JuSztnzpGiTR3NCDuzDr+Z7E6nyfMZXR3Z2HWXmO2lFvabexQPnZ+w3zExhX3nEceGhX2/IwjVAYSCBJrnUD0O7tv3GARBEErMagr7VrXRaSYTs5GwdzrFL942KSvrqrrOh2Lo0rodiUkzMXMRdjMSQ8ZesraO39m7l92mgSgMwNyh0CW7GZoiMRLDwhBxEY4sgtjQNgFKEYS0ooVWSqFSFzwFEs/AA7Biw5IlGyS2LFjwAGx4B8bHPrEnkymmBmKH/2sdxw64VVe/js6cWfTm8UAl9LXU2Cet3Gmp4HInjNrm4k7Ul4PI/MdWdJcC+4O2MhehNHpRlET33ehyEthX2oEK2j0JUBMCSnpP017evRIAACDEFAV27onhvG63xDC7wE4B2mmJKV1h54MXnnqHOnKF3c3rM9XbOCnw9q2oUa0N6dhSibYKZNLD3lakFT9Aq0RfUsH+jIzdVYoCO39454wEqAUBpZ19/VIAAACZtsDOHTFWhd0aw84VduOgs+jUfFnzXfZfXefDX2HnxH6EWYmde9grVGEPvJ3mytFyOlh2zd3BxqY2Jw7s4SBS6u5gM3nAjcWFtjmtO4GdPtzZaJrTXQlQCwIAAKCyJr3odDbGO50e4ykxdmA3sl2T3H2TKLeXx8ndMK/jS+yEpsO7O53OHB8W2GerE9g9iV25OtJ2JVDB1fjcpsDuTIlRTWncVmplXGB/LI2bgVIXJUAdCAAAgMqafIWd8rozJSZtYT8yOiSGSt5pVGfZatHyO53GT/P2sHNkH1tg551OT1Sqwu5J7AUCe0jdLsbq+MAeUEl+TamdMYE9uEKXO0oNJEAdCAAAgMqa6KJTew77jL3TqV1hz3exM66GW9PYy+6cRM/1VdjtsY7jN06qVA97rCkdRQJ7U6lVSfTYwG6ujGWlbrmBnX/mhfifAdSBAAAAqKwKVNjTJvbjMWesI8+JYVxhz4V27j8vv+rUfLsldvqyE7uV18loYD9VibGOgSJXpKNAYL+s1HV+F0jPxkm+wN4b/gYtCVAHAgAAoLImHNhnh3Md0x52pycmzevuWEeS7XRUJrLTM5i95jQ+Mklcd3ZOOs5z2Ku36NTYlY4igb09DOzt3w/s4fA3CCRAHQgAAIDKakx+46S0h91tiXH3TUrL3fmOGDqy5F0G1+v56YT65scOYue4bo9hr1xgfyYdhQL742FLTKt4YG+ngX1r+HNuSIA6EAAAAJVVhSkx1qJTq8KeldgzBy1ZeZ2OEuV1euEmdmvNqVti58TujnWkwD5bkZ1OA09eLxTYNymKGw/ULwP7VjoN5nyQBvaWJF3MdYS6EAAAAJVVgcB+ggx72I/ac9hZrsRuNcTQkb7ue75jfpq7I0vrVktM/DvG8i3sM0lHjPkuVGF/8nCx3198+KTofZfcU+DL63sH9tVOZ13KJ0oFz83VhRsjgf2SNOzA3qNXOlNgT3tizkRKdSVAHQgAAIDK+p3A3twnT2A/nVt0OmPwmlNPgZ3jurvXaemNThl3xOcly1ydRafE3un0+G/2sDfCZips+O6XDezP5HiRclzKfUjx+5FSwc6Lnlb5wL5gaubbN0cD+4P4ny6vbqk0sBv9qxeumagfSYBaEAAAAJU1wcBuQq09hj1L7O7GSbnM7rTE8D6nZfAzDu7ZE8N5/XBuSgyX2GeMuCWm6Bz2xmZzaLPhu18qsG/ckx49NeryeZniwD7XViTIT4m5qozWaGCXN1SCe9hZcFMC1IKAYuYf3e6IxPPbd6+LvazdbkeRAACA2gd2SuxJYJ8ZN9Zx3BR2czhzYgx+2Vdct1piRuc6ui0xsaOjU2JMR4wRt8ScLNASs2H+MrfWLl3a6Js397z39yb3aa4Xqbxga1UORTxZZlebT9pX71BLeqDuS+NWkAb2gTQ4sDfuU5DvPuMpMX0Vu9yQAPUg/ob5+dHL+utpPScSUutbYg8PdUwAAMC/DuyL3W7XOrkWm2SRr/wtMTzWcXTR6TGK65TY43hsmKTszmGnrM5V9vIVdkJP83fEHBrTEkOoIyZO7LNFdzq9OIhbXrikPriYv7/p3PeRf9n1i+ZFFxn10rjWbVj/88H2UwlQG+JPk09XFsJwYWVZJOa248vunKiX82/XRd4ZrR8J9kzrZeF3X+uV5fMCAAD+dWDvOidHt0m62ZW3wm7vdMp53XB2OrVK7JYD5ZvYucDOM2JGS+zErrFTWndaYn6nh3272dxqzJEnppa+7bs/scC+2motytiaUo8lwJQTf9pKmOrQ5UW+XBe18nFpaU7k7Gq9KlhD64Hwu6FvCwAAqH1gTxedzmaLTom7b1K2cxJ9J7J+c+4/L1lhT59DX/41pxTYnQI7j3WkxF4ksG/m/nxdU1T33Z9chT1QwZo5dQKlUCuHqSf+tJXwXuf5esdE9CfmSpry+try+jVTZK9XX8xIYD8X6fsic1fr68JL674AAIApCOy5lpjjZHRKDDnkncNuj2CnNyUHOxpOhf3g6Bh2XnTKkX0fO52azpfh55eazb7v/uQC+07cld4OFArs8D8Qf9qDi3R6HoZdc1oPw+207r4sauQcBXarLf2hyNzUemGvwL4lAABgShadcmB31pwSt4U92+mUDRtaSm6dRO/oYM6+SYRb2BN2iX3WKBLYt3LB/KYJ5r77E+xhDwNFehJg6om/ZSFciJNtGF4SyfmpqJhvn758/zD/8eMbQT78+Gquk/L6589fl5Z+fDZEYqD1vJ3JbyOwAwCMM1WB3VTYTxDPWEcTjq0edm6JYZyvD5THgd2eE3PI2TiJS+xWC3s2JYbyeoGNk3Y8rS87lWmJMV6Eu/euXpAA00/8LQvhvaTQ/kAYL+IOmUqZN5Hc+L609FEY8tMS+RTn8qXMsC09Enltrf1PRmAHAJiCwH46G+s4cyLtYeeWGGO0J+bwcOMkxtE6F7bL1dj5LbE6YphbYc/1sBuFWmI4jPfX50jDVNU3vPf3JAGg0oH9TBg+THrY783Hp8r1sP9k7/5xmwiiOI4LCP9T0j1ku3DBcxOsAMpKEUg0GGMIGPEviISABAGJK/gkHMB3SBlZskSbIkUOkIY7MPt2XnbHs+MY1sK78PuAA1gCLKqvhrdvjuM6l0qXYD/odkfHxyPzHhH9HI/Nzw7HBok15lXKes38jgK+MH8gAABYyFrH3/Rw6pYYOWFfnjIS4x2wuxed6kVHuual+BG799CpvNwTdvOhtNfdYrfPnC7PcsK+dbK+8Wl8U9Ku/349it9HsAPkqEywv4iiFTJWOlHU+xxFnZJtiWmZQG8RDW2wH5k+bxA1TLcPcx46fTe5FmaH+REFfGLuEQAALOSh05nN8NCpJHvS64az11H3sAuJZX8iRuhOxkJrHfW364xNaKujZQ/Yl5yLkzTYvRn28F7H9pv+zZtv75ufRMH3EewAOaoS7PLMqah1IqPTonLZtyfr4+RHc6B+nYyBGV3PCfbnzA8pqx+I8t1vH1eZHzcJAACqH+zZPewa7DrEnnvEfkZeE0Ps8kUVrXZ3ht0+5SpkLicmH8tIZ9htr0uy+zPs4Sl29aEeeh/BDpCnIsFuKr2T/NHvTa1vb5gvm1QqZiJmjYyjJNjj+RjR7R7kBPsj5leU1WPuk3JDntdfEQAAVD7YryUXJxmXLqcPnbprHd1c92pdfxTFptjdx04De2LOJZwDdmdLjH/CHlbvtK1OPfg+gh0gTzWC/Zbp9TrF6ibXbxG1TLKX667TQ/s86VCC/Xs3NcoJ9t3J50gfMr+lHLs7n+4yPyEAAKh6sAfXOkqya6+rzEBM5uakpNF1MKboA6f2wD7LeeJU+VsdY2mvu8Ee1rbC7yPYAXJVItivmzzfOhllb9lwf0tlcuAE+8AcrP+wjnKCvcb8mLLazO8pX+MZ8x0CAIB/KNi9GXbviD08wy7FXfSe03QZu+fsxGLHJWdNzIU02HUiJoZgB6gUmr/GdhTtUmI76uiWxz6ViZl9aZKxJ8G+JtthmolssKt1vktZq8zXKeAz81cCAIB/JNjtWseLsYkTdslj96pTGSl3Z2IKPXSqtPr1xN6yf9/Elhh3D7shvZ4esV9BsANUC81doy+XJSU2NNijaJvK5Ge3OyDjh86wH3gPpX6n1BNmylrnVQq5gT3sAACLC/Y7vUlPbZt7Tt8SI72+PMMedin2nD3stq8Lc3a5B/awx59DLFm5IzGm2DESA1A1NG9Ns8PxNqleFNXJeBpF5RoTGZg9jvGnHSXBfhD3u2gQ2ZP3PUpFzJuUqjPv4KZTAICAxQZ7e5IN9jftCf3Tgv1qdkuMe8K+ZDkj7N5zp9rqztc/bnX56s3DuBMx6ZIY8xlz97BjJAaggkjNcQH79juxlSyJ2agR1TfiKZlSMYk+3hoeyh725KnTIyIaHku4yxujQYPULea2u4Z9C8EOAJDnnwv2zE2nmQP2pYSOxDi17tJRlgK1bmiu+9l+1r84SXj3Js28h121hTdo1EOwA5yi/MHeiU7Evds3P3bi98p2l9CwK+wJO/1IfmEMNOgFWS+ZW6QazI8pbJ1fEgAAVD7YryS9buhIjDgvQifsbrTrzLkottTRHWFXZ813lb3pNP58zlZHLXa7JebaLMGuem6vI9gBTlH+YN9wg73xPLk46XbJ7hJqUj1O8sOhnKwbg1FXjFsk1o7lDbI2mT+Q2mD+QmH3eH2NAACgXMH+2w+dXk0uOs3MxFwQ/k2n5ptem5SNdXu6rl8KsUfr/khMOhMzMcLujsRIsc+41tFP817umwh2gIDyB7unWVtZqZUs12NNopbMqg/sL9f29ve+U0ib15tpkT+mKXaYefUBAQBApYNdZ2K0192RGOUesEtAeyMxhU/Y9aUPngaXOgqZYfdH2Ge/OEn1/TjvZf6DAsEOEFDBYC+3sdx4erpmjfkFJW4y79IUN16zQQAAUP1g14kY54TdWcOuJ+zGGe+hUx1dL7SMXX6zvsIn7FrsS8opdp1hd0/YZy92v9cR7AAhCPZ5GYz2W9TYl2Uxc3dr80u5luIAAFTUPIL9T9c6Sq/H9KbTC5ktMe4Me3prkn9vknT7XOhIjHzNO2IXsh3ev+n08sWTA/ZlJ9hnL3a31xHsAEEI9jlp7nWtGgEAQFkt+KFTferU2xJjR9iXJpfEyJG3TXWVPi1a/KZTqfXQDLsme+4Bu950esk7YZ+12N1eR7ADhCHY52WYrIE5bBEAAJTWIoP9qruH/bJ706l7wp6dYld6Gp5uYy9EFzqaV+iE3V3rmH9xkjfDPnuxZ3sdwQ4wBYJ9fpqtIWodAKDcSnDCbofYL8a8tY66J0bpCbuSHYyFLk0Sekqfc8Qu39xid3pdTAb7VV3rOFux+/9yCHaAaRDsc1TC1TUAAPC3Hzr9NCXYl0/2OtoZdm8mxva6v9ZRpDcdFUh2d5rGfeY0fqWSXPduTrro7WHXE/aZ9P1eR7ADTIVgBwCA/8iCg930us6w+yMx/r1J9rg7OxEjr7S8i9DzemdEXubmcxexa667a9jDwR7Wn+z1/zfYV5h71wH+NgQ7AAD8Yu/sXuK4ogDeD/rdx77d6bors7CzsH6wRqwsflSIZmM0KkljRG0jmCYQopsWAtZILcViIy0V6UsfEsjWPCliniLkQRFECRQq4kMItFLwof4PPffce3bm7uys6+422W3vr83unrl37kznsu1vT8/cKWVeqrBjRYx606maYbdT7DavKtjpdfxTQHodX6iIneC27k6xk7Grd53awv4+Pek0L2Pv9b0AYQ+dGhgYqAkZpcblYPCModG8aLSwazQajaaU+XeWdTyRsL+NpGrY31DXYSecKXa1IEboNj33KC+cq7m7sG1dKYnh58hxlrC/Iypi4G/KsOdIr+Lr/76wf9oc5EQHjRJDC7vmJRHSaE5ILRDSaDSaF8JQyE3BN5325iTsH0hjR10H6J5TjwQ76br7WacFP+iUoIp4J+I2V9dNp4j6pNO38qlhJ3qVa1dEYQ/XGRnoDwqueO/nHVHs7hVSBChtp7pwlhF9IUXY6dQ1Gm+0sGsKQwu7RqMpH16isIPUqsuw28bufnCSw9nTZR1fCrV1GuPVrDUx5OuvO1aJoRT7OwAviTnhOuxErYTiIgn75apzRgaqggKrXqKOdKYZOjSOyI3dUYhitRj1xWJDnRA3tocN/h5sGjCA5tjHNT2NEPVLET9/MQYjRHsxuBQbCY9awWBVrVTwYRi/qn3YOWAwdg2OFOO9YjEYZIBvq2oaNjQaT7SwawpBC7tGoykfXrKwo7FLYVdT7CTspOsESrR7nRiAXvLSdaUkJm1dx8wlMejryioxb4sMO/wzvfteiQj75apgs5GBYDqNDjP2ReXGqmqIwucougZRfTAos/PRDrn9LP4ASP0EqDaACxRe4ooeCzY3iTCGmfMu2fixGPCGDK8a9KnC+CiY6qPRZEYLu6YwtLBrNJry4cTCnhO5lcTQso7pN52+ibqOxs71GABTdq/Djq5OWfbCM+wIjuZdEfNahpIYRFbEvAMFMaWUYQdf9xZ2lcawQfSAnI929zeCfUPUDo39w9ctePuJ+zVwcfhMFdr4cEeTOAAPG0eGRxrhLQTHhbDpzHAtvNWisMPmG8Pc03shvAjR9d4R2OeKHLCrg4/faJwaPQc7jo6G6/hBOzv5ANWGRvMCCAGshCn18/s/UgswjUajeSFUMJUXKOzg68qTTsnXAdeTTpUUu8IrRShif5VexWjpKXZEzbELW3eXxADvl46wg6/nJuyUKEdOgToPwnsd7N3Co6pPIWpoB68Wfj0A4QV4HxadqoSwx/jJVICbdxhGFEQ9BGGfEO4YtIYh7ADXN4waOKc6iAZh1wYc8KoBgOv7qIYdE/kGAIn2jwyNJiNa2DUnRAu7RqMpW16msNNNp+/bN50i7ucm2U9Owr8Fdr051Z8XmGGX4+Bf3veckrCrCXZa1hGNvUSEHXw9H2Hvwjw40F1V1QGRVOYwjPYhN+kutBueEOdESdhbMGzhZS+D0NiA4Q0wdxT2UzgEFNJARXswOCjG585fT2c4EgzWSGHHHw3Web7HyEi9odF4oYW9xPBfbD/L/jdoYdf8Dxlqb/+QnZjP27saHOFn7d3Zu9c2x6w+piklYXeUxLyFpK8SQ8LukWFXl2DHDwUu7Ai4MuyKsYOu002nCAo7p9Qy7ODreQl7jCe+JSjbIQO5CNrN/bpb3rbag+/npLBb9t7GhVTpeRiOL7YhjTxqgiEQSJ9f4gNeIX0/S8KOvwCqznXochhNVkpe2EN1Shg2y1HY/X/88Z0z/OGP58//YJn5xLJ8zMlkMhlgmbmdSNqNRmvrDPNiprU1wEqQjML+YX293xG21H/OcuDxys9MxXyy/phpio57igbqK/KbIvbrOm3KRsPh4UN2AvxhVtJ0Wc1M0Jq8x3LFsKyPHeEZ/DeFJz6L8z/68V8Wwv6eKuzqPaeIu4Qd/yhWnSpoKfDRSfgJ/xCu5yYhVMIuUFLs4OslkmEHX89P2Em+KWqkpWNAtLlf98rt7fjeLoWdFqOBIvSK65A6d+4egxcSdr7JJioGdAv7gOjVWDtkaDSelLKw1w13RYGuUzI+1cWjT8pP2Otu3vzCjr7//Sbwu4cJWdZFpjAViYxntpKlCIca2yKReebFvUhklh1P6zRnaW7ez4qLOTMTylnYK7q7nZ07uweYB4G2ACNOn37E0nh0+jT7l2nAMygcf1tbUS+0d2PhuKeou/vzPKfoN9qUlV/i8Q2WM0eb8Xh8f4gdy9omsn9UbL83Hz7MdqH7LGuYCcYiqyxnPrOs83ZUZ1mjzJsboPeDdSbTlJKwQ4b9bcRjWUeQY6WGnUpiCPLrVwqHhF1dJ+Y114OTKMWulLDbq8Sgr5/4wUkV3bWS7gralrewUwVLnsIu1nJR9Z3qyT2EnSKMg9VXsBPSyJtjQetkwg74zjTTeWk0HpS0sF+KSq5g+JGM+s3yFva/wdb/9Mqw37CsyzkKewJsfXVuLpCDsJs5CvtERDJ2nxWV8UhkqrjCTkb+koX94NZfrBhs37oVKPqF9m4svrDnN0Vm8YXd3I8L7rDj2IgTGyx3Cj/fHivmz0fYK1RFH82aYr9oWdrWS0rYP7CXdQTXFTXsVBIDpNfEvJ56cBJBau2Q7cJy7PRRgR81hTvDbtewc/Isiam4XpviOm0sTNjrzjULuk8i7OTYSMPAwJBh8YgetnTNW9ibDAFodqgXy1xwiCBvUIXdwojwEHbcua+/ipfKazQZKXFh74qeu9557QY4Oje28/A+PNQHWfZPyk3Y/c+ff2VHN2/+7W0bMauH5Sjsi5GI6fzHSyY9LRvranIT9uXW1glu7IH/gLD/vLLOMqCFvWSEna2v/FpkYT+Kxzc31rbAws0chH3/6GhrE+3+xQl7tWXdYPkIO+uyrAbXOB6cs5qZppSEHXwdM+zvZymJcSXY1Qed0oOOaJmXwlPsrptO8Y+aYYeTIl9XjR3+OSjFfjJh74BL+/FATc1wP3y46ssdIx+8hZ2U+1NKqX9m9HBNRywodvEW9uAQhj4wbLBu8ndQ90uqsIuiGYzOd3V1egj71YsXQzhcFe+s0WSixIX9TL0Qtmj0Iv//wdHoBS6/PdFz5Sbs6en2L5kXFyzrQq7CPhZZZMWDhL0N3gLTkUiCsbIXdi+0sJeMsANFFnbQ71/gDYz92fHCjn1M6LvL2AsT9hHIjOcn7C2W1aE4eUwLezkJOyq78HVAWdeR1mFHUJbdFTEIrclY0LKOtDvV2Hit6iiRCXah7KjrqrCfNMP+OVzZjyow1X4FrtcQbX85wg4V6NGQXGixxhgOBq06Hn2CFu4p7DKEldNHjVCj7BWGDwOqsAuJp+qZTMJ+HQIoqqmnXw9hQ6PJQKkLOxGN9ogCGZNHHdFoTTkJ+3dfcL4XwY9ffvnHzZt/fvnll18zN/h/uf2MMObnFlsnU8IemEouTiTaGGcmkYCKmOkEYGA8z5ll1GjMJBZXE3Ko29hoyCBxj91eXpx7QFdlfgIOMovtJOxsIRKZwEMmErPmwvLixJQpBp5YTN4zRc4+kTDvJheTd3mgnB6dgz90d25xboEfMrEMAyaASoyY4EFiqgBh9z9+/Pi306cfAz9LG/T/vPJ0ZZxuZ+RgC9K2/ujpo5Wf/ax4+Le3t/+6dWsbmGScyu29g4O9SZP8eHvb9E/uHeyJeeGfZsztbXGJTAgPtisZBwY4uHVrbxtgCnIOxidhwqb8zJ7ByqnVxSQO68fLPsMA9UJnb5yhLux+IhFyH8R8sLy42jqTu7DnMUUGTtETRjxZefr00fq4hwD7NvZ3D6Xo+ja2dncPN8J0sjzc3/mFAWvx+BYDhriEr+3Y3vxwZ8fPNnbWjGdbu1t3bGEHDEixM6BuZ+cXc+1wd3/DxKPsQM8dcZAwNN052t3aSF2gZ9Dv6CED1D3hoDtHkLrfAXx42App2zs74po1WVGWJuyVicQUxrP8K4bfNvWLwgSW1a7eoH5ZC3s5CbtzHXYSdipiz5hifxX/pBWx4wtRuLXLYRFxMPJ1qex4WoBaww6+jsqeRw37cG3tSIUPGew/0UU28iQWdFFDbXVg2dGzdZchEx4TXRvrw5/WQpdTWYQd9hkI912C9wrsFRy57OvkIxmqsIsRo9fC10aDuA67Kuw/wc+C3npc/f0jn/HTZ0HYVaPJSFkJO2XWz0ajHeUk7CDogKxh/xMD75tOmxw5s8rpCGdCCvvCGIZjCyLtTmCjmcCP86mcvGifNqh2BpilJPrYMsZJ50HmxDgk7AHYF7U7Enkg9k5g0TyyVMlEkBTjmMx1etg8K7ZM8lGJ29CCr+IgiwUIe+B0it+kDT7FSEq6aGKSddl1hRUNM3CLEGn2PQoCqax5m9gyDr0P8BP0QSlv+wtDEdyyYS4mcXaApTaGrEamFyIIBOM4fyJzrl7obI046jJDoI/fdZDZpQgyX5CwZ58icxw/U9LdxCZqdAn7URxBQ34Wl7SI1k0Z8lM6osw6xOwwHifB5p9NBiK9i12fkbBTVt7kTg+xaN5B9adaeNG0hdFmmI6Z6pi25348xRpjd+LxQ0YH8cvlWy6lCfv4GHzRmOMrNs7SvihM0GxZzKbesrzLA6Na2EtM2D8QD04CsIadbjpVlnVUdd1l6/SOFFbFrt526rFOzOsCJcGurBKTX4b9iuPCdp6oit3Ik0+CKphUJ+rpttCqaog+baQuV4xswk5gzfwIRVa1W9hbquysvirsNFIFrCFJXDA0moyUh7BD8Xq/KuzXy0nYv/nzzz9Twv718+cQ/P3cY1nHBksk38iklpZXyckXuLu3Tsjo/tzcHNjxHIB2eHdiYtUp7NA3mfKtxMTEkkPYYb8kf52RB5lehkgV9klUBBR2fhar01zY73GxT/IdSC0gBNNoZa7Tg2a+59ji6hgI+725OWhYmgNmQVWhI+PMRyJ3C8mwr6yscAMHHpOgP13h1mdi+8qjR7awz/LGdWhdcR/tggMfu+aIzqY3qhh7e3vg3XvAtiyPOdjbOwBjN0nYofng4C8QdrB53pMc3eBej+EkRGKcgz0gk7ADE8vTMCUk7GMwhauLXNhNPh04m3cZUy/0MY0wO0xOcdJ1kACXxuUk7pmjsOcxRYFHfIpI2Ne5vK+v/JZZ2IH9w014kaK9e3jExXiIh7ug0VtH4NMNEGyh1Iut5jPUbfLlXcZQuQ+5WpsOYTchltq9CX/vb8Z3xDF3sWsYm+gMdhkQ5o1wSDGAuufG1tY+tG4BQ8LTqcshlb3dUIV9dkxe6Fb+nWpdhGkz074oTHDJsgZZiiHL6mIehCyrh2lKSdg9l3VEZSdfJxwFMa85fF1oOop24TecyoS9E+WOU8K9qiPH9vWTCjtk1VN9a2pr+305Y+SJ7xM1x141ctmwGWzGjT3VGIUvoURbWDMzAGUsUti78L2LlnXswF6xFin9Fg5bW8eDpmDMFnbAdw77NvfRgA5h720USfobwuqbBgyNxoOyEPZRKF5XS2JGyknYTblKDAXf3rz5NfNg0LEMxG3x3+t5dGCUr/vc1COpotcxaHfQpgg7OFklSJd7WUcubQZjD0SG9TYMZ0KzKuzmotTwGUqoLyzgGUxC26rQh4RQ/jZwDb/79LB5jjdMVaZXT8MAASaU0SxA2E1XgTTaOBjiE3f99Lrc2oavCpe7HVSzYUfUm9boWcMuBR2LYcxtsHARc0c3+ZYAM0DQG2BOpLDLRHuDU+4DOExGYX8g5mSSrh9ezID4ETVh4mWfdpWpZ2+k/O0yTKPrIKDq8wwnd8yfr7BnnyL3so7g8Tjkk7bMwr7GmF9mwtd2Qo7qlxCYMg/9z/i5gitXkLD7GigFjlJ+hMJ+KKx+zSHsO6jhwso3K/jIa9hnQ7QdYhP2NWHUh4wa0dv9rj3VGnYYALcd4p5Ah2X1KsI+M0b/RwRmqlLMzXzaF4UWdlRWVjf573sPrlpWP9OUqrC7athdKXbvGnY07kKfc2ovxu7itbSFHflakwLydRJ2qogB8hb2ljyEvfiEPr3a8qEdDnWeajA8oXXYazr7wM+Jur4L5w1PqjvP+o45hc8HrvbpG0413pSFsMM9p+h0HwtvN3vgHtRyEnZ1Wcfswt5nWWdsrxXJ6jF8v4tVKbQ2zLHCnpCp2IzCfp8BEdx7VW6fTgn7vdt3E9NcxknYyZ/uyyqaWeHkCQzx/UGG00uQJbpV8TacqBhnubg3nZ7m7gR1Fr8qzfQpwDJTMeDAx/oc0am0xtxuOvWDpksJtxu30dDJ1EHfD2jz7DE3nU5SeRJVMa3SB2BJzs8EThhd6FwaA2IazTEcXTkItWHGd6EAYc8+RSTs9El2NDPXsO9K+XUK1yaauk/m3Wlb3GBMOPUdiKBpbesQS1PWUNgN4dcbQtgP155t7MYhJO1OTTIYOA0oU+hUGsNYHd2legSjuvZUhb1OnJ5J47ErllXjFHb+JbuPQVJOlIE/tZUviqTXsjqZTVPmshfjxsddlhU7zzSlKOxg7HZJjJphRz1WH3WKJeVqTUwBN50StLedsZfI46WtEqOuww6gr9sp9nffK6Qk5oovZ4wSgQu7RlPO/DtCXB2NRsMMGIIPw4Pw8KT/sLCfdRSlTkvjTaJLt4JDJeeAJbKvrMK+IPfMKOxy+EXXQaCRmKJ6iTnGlFFpnwSGKIEJ1+lh8z0PYWfCEZfhlIor7E9Rl+EmR3fzY2h9YrKiowq7Ob69B5Cwk6RLUffzHjO4bRYLYoADCI8X9mVaFYiEvTJ1KdHs8AfTXfVCZ28Ucx0gKVQPgjl5nE3okyiisKtT5M6w092oGWvYZfH6HbFh4wgqTtCB0cLxhlOlUpzt875b0ANz7WwHS9ylaBuwBwo7scVsGxf44JAk/iFoohBHaOFFOJx9HIj2dAk7nUgd/u+AjVSW/HPndwF9nX5hJec48CM97Ysi6aTsPJW0N3k+5HTUzzSlJuzvoq+/n8M67MLY3euwS78uGGUtd4912PE8UNglGUti3j55DftVyKoP+ZCKEXtdRy3sGo035SDsFdHUojCfRJH2MiuJOYmwf25ZI+qqjai+40KlidvHCzuaz3JmYR+T2r2UfhA6ytj0nDSnGYewtdIQizhsQoZ+kAzX6WHzpJewt3KpN0Eni7+sI76vu5sNcefjY0Viii3sdCOpQ9jH7X63xIUAQ+ctNnvHC/s8/VAiYWcEpcKhU0K50N6NxAKMixMXch1kKmKTLKawq1OkCvsTnKKnP2dbJnFNJLRD+3HJpkxzA/up0nUfefIvXMnDJibQ97EvJeOFfm/IQfbvMBL2HSYhweam/1Dm5CmrjzsSh7Snl7CvYds+935a2+WCQ9g5rRTY+JUvCnHGsgaYjUdJjPHZSNSymsJMU1rC/p5zlRg1w05OrJSwu+47JVdXXvN2dXx11cOoFTH2IjFwjhnXYc+jJGZwFNLqFT7gPF/WcVBu1sKu+Ye9c3lt44riMH3QNG2W3d2pPRIXKhlKE+IWF0LbVNBihzZ94LZpaPqCPlaVlI2hOKXeCEyyCqabLBKw66wciruqwZtgCDWBLkTxQqsagzf5H3rmzP155upqZEkj2zPO+WTLGt0ZzTCTMZ9Pzj1HSCYHwj72HndNCrnw7lmS9ZGzZyePq7BTaOy9SLeWMeWsxpZcB7X9hb3Yo7C/7Ah7RcVoxOLkSxhbhbAXFXJr3MOj4UqSsBcDDZyhdw5L2HmCY1IJEn8shq/GY0vjbYPdhd0nX98JajPGJLyUKOy0YkgPKTG3Tfy1iioxGPPxPyDzkD6c6H0GEb8t0NVzd1KnLeuGhcMSdjX/MPyrqpIo7NoIezOIiT/a3GR5JtbCki1Nv23Sqa9GKfP8rcDm1QaHwGk7W9hbKsbd2HIrJuxrlrBP8XsPNg1r2LKjsMPxJ3jPSGuZjAt7tYoQO72uA23dKOBMufyV9eviXQXclsnfKiGtsF883ScX9xF2u9NpLMAOYUdKjGvrAKksKWydgK672v6k2ziJcfomDVSHHXUdz1z66PTpy2/Tiy9HRNgFYV+yL+zj5OvfWwLPOTIfHVdhV+fKb7QnNJxnl17iSKjmhxqesCNqey9R2FGvHTFziCMWS5RM4RweDxeShJ30vqppV96hCDvQNS7tqIc/6RRmzS5u57B7sZQYzVZKK/Gqs0r7/NCdhN0nImGv2xF2/mn/VbeA84sT3X0Ql6hxk1zR3ckiX3ZczYMXduCv/xkE2a1z4ETYeampYcIhI62mqbG4S6vArEMzfzRFfk3C3OpZ2BEzR5r6LSxiny1eUQco1VXYEaOnXV2LGpR+FxP2anGWGwvj5OO0WzcKoMC5Z2XQfd31b38hnbAPQvccdvZ1AikxDIzdjbC70o6ccyJ1UUc7hR26Tl8g3uk0OD6rqiOM3VSJeaFXYUe/JPDNaA6F/crnH3iCkGeGL8QeJaxfVBY8+fSVYyvs76POchRQDeuw19mswNCEfdnYwPL+wn4dQdgqb4kk9Tu0W+fwkoUdH7XI4d9DFHbkSdeGLexXXSd3hV2Hs0uR116kZ6iZLewIwhJjUR12EzBfdYQdEk/iPeOc6ORB/INZWuFV7J1YmVCHKezIXbLPgRthbxkn9zklBtBYU/HgriLGwsGtqebG1MhWUMZ9pC9hL9GqSK3RSFLnfW4hox10F3Y+lN3A88G58od2Wce6ubSrYSaMe6NEmyIHBvVmfpQ67PkR9ufDRqfIiYmE3el0Sg+0TYrLuomu4ykVJrTupsREOTFtKexIiYkZe99lHcHo62eYsONp/oRdEPLO0IXY/+Ts2U8dvwrmnB5bYX8dvQtZtxdMSewaO9QqTsvwhB0F5Iov7y/s8yZgOxMaRN0sLrGq24fnCrvPcXigq9xRKa2wc4FAv0dhx/q1rikxWk3ElibaB9vBZFK8LBqHdyPstbAujN4JVf0qNkMwlSajNtqEfQTCHmocmdt5R9hR82eOLzlOdC+D/EFEvcNOfIr7eriaKYQdl6gPYUexGJyDThH2lol2b1rCPsHCzhbvhYOb/CNY6T4/9yXsKCgzHm551xRwbPGWPg8yvrslj++qiCZ3VIr/Ve7bjZOWw9uwjsuBj8WNAkYppG73Rfak02l+hB05MfB1OyUG2AF2FmgnJSZ1hB3fmHiaWNQREXbX108O1jgJfDE9eenS5LTJXxdhF4SuZF/YL9EM08shmhYnJ7/QH3xEaewfH19hHy+Xz0SZ3tV5VVgxLn2Dso1JgUuLK8sdhV13E3adJOyloLtS8c7cPsIOv7un1Ww1/Kh6IHuaDI/10Tk8CDugrWbwBh8ZbZZe2H8nBSzoHoT9z6BGjF5HSsxQgJRvF3T0Umny9g7CrgONrxTpmYSdh3aK9O78tgnQV+iNmk4S9mWPi3UXIOzxC1RtKH+Jzr57opMHUV+TqHTayW26PA2l9MJqNa2wd79EOlbWMagR49PqDxOFXe+lxGxcU3sWfmXjEa028sBEvelnc9Rv0eCEEe1drpe+1Yewozj7hBrb4F3z5zQ9/jEWbrlxNzigran2LWH7axOx4D9vBi5TqRdb2IthHVWf7sM6qXqlXq3bN0pUhv2K9cviEyXCnjNhR0ZMe4TdGLsVYWd5tiad0sOu7zJ4dB3fyRF2GPvTwDJ25LBbEfb+EWEXhB7IvrBTxXUwzg2UQj5VeRL2X3/a4z9H2F0+oTSAmNWSQBmXrswFi8GyI+wsWOBnR9jJpcHNdmEn4Wbmugs7FviAUH8dLCjn8Fxhr2NdZh6h3ZTC7r/DPHRskCO1oMK5MCF/qeHiX2V2eNJp8IK+LGEHNbOiSXTfDheIvdwappOw47yfV5Gwgxs8Rsw7J7rrIPx92dmJ2Qc2TSvsyZeo8E6EaYPKF219vwh71PwfwW96MYVK6CP0krkPdaZNWLv7E3Z/A/vQPARoQ+sQ3C3Z9pm1yN+bTvl0CLvJfZnzlFrYO+31+I0CfDsvnUrGvKq6ZNedU0IKYR8umHR6KgCdTp9BlRhb2Imoa5LbN4m9fSggJYaeO4fYmeCYOnQ6PXliL8B+SoRdEHLGwQo7yjp+eFnlSNi17lPYPy+Xv8G2rFcrXCWG8Mm/+Q0odNWqkQ5WeakSE/afOwr7ipnTuhD0rz9POymEhldwhR3U5syHoFMm6wXZn3N4rrDrX+biqkgLlSEIuy78kSTs71jC/tc/Q/d1HMG/EHZV3OGXBSPs2oqwq0Kg5Nu1qA0qs4NK7d6/0Hc3h/3mHM47oSHscQdfKTonuvsgCv9cT9jJbdZG+peRQthxiXoTdlPG55911TWH/a0gtLwV6nAzbJzUnGKadxUzxssQaFrQPHP0bq/CDrwHYYl23wzd34hntqAk5KOOwq7DlSHsu/bw6zBtCDvfeUv0o7hs7uLZ+I0CLlo56/oNSmhP5tugoIyQKWE3xm6F2K1GpyTGdpEYE/KGqjOxhkfpO52yrSflsEPZOwbY0en0WYmwC0L+OHAh9t6avkDmnidhV1pr52VXzpTPaWzg31ksqgg9f31xtpDqaDq99Atw+2QgnTOLjagMTEk1Fhv9Hx7abKYRdqC7nFgNeLiw/ttvNa2GiXtKK7MNr8uKJc5Vr+EkNGbnezhds4FV1xbv+Emf21hcKKi+B9HzPmEnWhVnbi8U00467X6JdAiGKuu/r1d6O9mja62YefnXWvfXRqJlLzaq8TwA3rXWNT/m8rd4EYystbDT/SB718pS7fdVAv7s7esN375RwJtWgH0a2p/YhK385ns/KCEzwv68XYf9pN3p1I6wx7PYAaLhVjX2tJ2T+HOTIux2WcfOjZMIEXZByBslQmWYozk+3efqI2ircmigoEgfQNgHRJ+n8Hxfwp4PHCtNnqQKehT2A+EO5qD2vxNX2Idy9jKLZmEf9M5ewxxU8Fq5/GLvNwo4jRapSFL/THXjmzJxQQmZEfYwwo4kdpZep6wj6sQARNhj0o788/SzTunLDbHzwzZ2y9eZNmEnY39BhF0QcoQIew6pr854qnAD9f4OQ9gLDdKQOXUMhb0b8zt/e5wls60yIeyl2i9VSrbKkLBnGgh7/5RuBdkzt1LcKIPivXJhWrqdZkvYT+3VdTQ57E5OjPF1u6wjiHU6GlzZoepYsHWdviNCXXc6J51AHXaZdCoIOSXrQpz14zsS7r0csqIOTdhXOI36cRP2xlVDIRvCzhe+rkTY+4iwD8QuZ76nuFGEYyTs5OvIYXdTYty+SSbcHc+I4e/IvNOAeD0+neG8+Y6F2KHrdhl2EXZByCNZF+KsH9+RcJ2nGlbregBh9wYW9pUZ9bgJeyUsA7Pt9W36BybsczejnYiwH0CEHZ1SNzZT3CiCUsdF2Dkjxpp0akXYrRA7aK8SgwfbeprwOj8hiR0Etu6G2GHs9qxTCDtXiZGUGEHIFVkX4qwf3xGhiw1PHQHJwj42Pe2riFenP1e5R2ulvaKnjgltl+i16VF1vNHHMTP/cSQDwv4sgxx2BNgRYgfxELudEBPqNvoeDUS8mrtDZOtWSkxwjAHxFPaTYUYMfUmEXRByRUkQ+uQMURIEQTgUrpQcDkvYXzDGzrpOYM5pQoAduu72Ok3d6BQgIz5OOM3VmXTK2J1OT0gOuyDklpIgiLALgpBZjlDYSWrby7DD2N3GSTFnb5d1fkpr6/iMJ7rmxMDXn4pViUGI/SQRpMRIHXZByCElQRBhFwQhsxyxsLOxG2G3Q+wQdug6YIl268QQeBpI162UmLa6jm5KDOLrdpWYICOGff3Uc5ISIwj5oiQIIuyCIGSWo0yJQVnH9kmnz7Cus7EHekyQKbt12NnVEWVPHWFHTkzXjJgnO6TEMJwRExj7Kel0Kgh5RAlCn7wiCMKBoIQOjCqXQ4uw251O4etu3yTCrRIDa0+fxI4AO2rEtIfYGTvGbmzdSomROuyCkF+UIIiwC0ImUELWhN1MOj0VTTpl3L5JUeck/gqJ8s2Rf54ywm4+hx/Jc04h7HaAHWUd2dhF2AUhbyhB6FvYXxIEYeiIsGdS2GMpMSeY9ioxEPaECLtVgh0vUhV2JJwIu23spOuYdApll06ngpBzlCCIsP/P3vmEuFHFcVxF/H/09sZ2kfzZXdio7HZxymJVUCOtVrdsq27drW2pf0AixYWAgqiIlW5jFZa9hQhrvBSlKgl42IMHvcRgWEIgh11bAl569uDJ3/u9+Tbz8jImOlmdpO/TbmZe3rw3b4ZCP/vjN7+xWCKAFfZICvvdurDrz5wyZgo7/2hWza4dIiNGq8POP8B4bxKDFHaFFmInX7cRdotl+BAWixV2iyUCWGGPpLBThP0OJqCsI8mxlsOOlBgAv74pPBB2vU7MLcaLkxBi70hhR5UY9nX74iSLZcgQFosVdoslAlhhj5yw39su60iuq3LYkRIj0XNi6C9enASg1j7ZDhdjxy6jZcQAM8Luy2EnbrCUmOWJied6HPLAxMQhx2KJPMJiscJusUQAK+yRE3bydY6w3/M3KTFGgF1/0SledIQyL+FD7MZDp/yjR9hpUfB13di9Z07vGcII+/i+xcXFB8edf8bT8fiJHoe8FI8/7VgskUfsArEx+3vAQLj/vW++/HJDRA0r7BYLMfrCHosGe2Mm/5mws7IrXye0uo6ow86wLJsZMQxqMoYq64jhyLEJquoIYSfkArUXJ0HYhzKH/cSBuGT6ZecfYIXdMkKIQbN3cTntuun5JXyxbz6dnn9U3DA4586LwbAxJXlHRI1dFPZGs9msBXXWqTNpsYwsVtijKOz+OuwQdiSxdw2x38w/HUns/AHCWruew65OBl/3lJ2XReg57OTrrOxDmcP+Ylxx0vkn6MI+6e/ZM84bXdgnZxyLJaKIQXPQ9VjkZmwBrRuFtzOZj8QgGCdb/+DChYKIGv9C2Bv1ej2gqyb70Fk/ffp0I2iSFnUmLURJUgkxQaWyHtCzuVqpVLJorVU2gidZpeOGkGyl0P99KkmSIalWa7Vq1Qr7MAr7verFSQTnsOOhU62so67rhq1jy4TLYtceOwWQ9o4QuxZg91eJiXiE/elAH0/FFROzHv3MfGaOhu2fe9Yh9j2/P56aPslGPu7O0VSpZ444zuG5CdqbmyOZX5xO0e4jy47FEkXEoDmYnj2x9NICRdlfE8QR111+7bVl171hYuwDE/YvpqbOiijyL4R9h1y7GtiDzsEIe60pae3Ua8kBUyWSEWDzOBPYn0hs9pxgNcBmeeYymiU6SyA4rse58ky5kkgOEFzmv6CMa+qD4wydJgS1nKLR49+jFfYoCntgWUdWdvg68CXE+N6cpBwdiTGhHzjlWL1p69B1YFZ1lHi+HuGHTlPxowE98U729yHWB7xDafeNuOKANPanMMms86a3t9dx8eXjjsUSQcSgGRPMXtc9JIi0m6ZzzLjuYXGDMDBhL0xNfSyiyCCFvXGaQWduEMJ+GrQGrNc0ZTRycjY2NvKkncGaWUoGA2EPMtR8qYTOgQj7cYBFDQrMuIvCnt3YKIcT9mrOR9UK+zALu5HDboTYg3PY2bhDvufUV4zd4JaOwo63wtjxqlMIOzJiIpsSk4oHGXvcYP+k0wv3DEXSnz1DYft5ip0/Pv/GfsqCd5xZapycXZ6mjbPvzDPx+CNnzkzO0JQvHjr0EG0ecCyW6CF2i8Os6Euue0TF2d29YlRwVlbOxz7bvnb1/ZggYp/S7pVz3PX+ysrVTObKCqGaF5XEr6jucysrsbFP6PCLqnOMhm6/K7rw3tmz301NPXb27NkstbJnCyL7zVcXNgSc+dixY0dE/0RW2OtSgkllINuUHdP1OOTV9CfsoDWiwk6Ud0XYi8ePFzRh/bvEmwLEvte58pVKKX+cph46YSdWIewhfP3yTz9d5p2aFfYhFXYy9nZKjB5hZz3WX3XKKeV6Tkyoh04BrB8Rew/vfB1VYvQ67AT7ejvEfldkhT3A2OMmB52eIIf9vlQ89TJtZyjm/qDMh19wiKekmyOHfZZ8nTYy0O46Fkv0ELtELO0u0+Ygi/qkSxwRo8K5TObTaxnJFWqd/yPDvC2Ircx1VPOqkPCRxEomc14d8i53qlk+FSZvTYF3qPXO1FvfcONLoUhPTEycEf8PEPbNigS50IkflN5UiGz/wt5Cx2CAsLdy9eZpggTJCnvfws4ZMevJgYFzlZT48opvMGHPMZd//72s9mpW2IdO2O9iX7+njzrsytjNOuyeX4dGq+UeUIedFgFhV3RNibkjujnsqXiAsYcU9uV4PM3tl+PxF2QazLMPU+PBU6deui7s++JxLtk+eerUrGOxRA+xOzy86LoHaTvrujEh5t3lUXrslIT9z0zm2tU/pYaPb9HulW36/IS6rmxvk4Rf3SYChP2PzNa1q1tK2KklD9+KCYPHLlz4mmT9gnro9B1y9be+lJ8fR0fYE9MSJX61X3+79O2PtPP7NPGEFmLcaeWqbWGv1VutekP1NXI5qdV1EhluankD0m6qudZOA00maXby0J1Wnb5gIarJKb3fBXJeDnG1Skfs1NorqPnmabR2+KTa8rAgugD6psqhUinsaoV8KsyAw0MQUjsThVK+tOrtFgoU0y4QXdU7S0eutYW9WCiXK2uemhYKNGuFRhZVW5JNorPIY71JN7mziFh7IbG5ShPBbNcrcjlZ6oewExRjT2CmBJ224E1col3u4C7u4Xn05WkjjcuUn7j8hDqW0oaC7xydtEIjtBVg7fKUWUPYcdl0CzbQzpbK1Ep0uQegoQs7UbXCPmTCfre/SoweYYcTaynsxnOncHXt81+7On925sMYGTEoEkNr7FqHPdopMcRDZkdIYaeY+rHDTIoy2h+gwamjr/LaIOx87tQzaZsOY4kqYheYXSA/d+fHaPdVNy3ES647KVPaR4Vz0rRlnvrFi0Jsq9j6zFZma0zLYQ8Q9sw2HRZ7+yPqpH3BE1zs8h8lZcVMTd0vCCXsXztc5/GbKAn78WKxKP2k9uRvv1STly9dupxcLxazfmGvcqC7iUB6lXYkqnYj9YFqu9lQA2lvh9s7iG5Lkl0762pfmTqEvcHdqpP2JVgB92AetUJagL48XhBG7vBsoMbnaLKRhU+8CS/sG8eZfEL5Jah0H0aUIOwlf3Z5e2TZ124nrOe5nVVai+MkCcp2UQev+9ZT5n4WdpyL1ZvaheujEzwplsODMI++PH1k52XSxSeZCsYGPyxKp1AnJaHXVsB4F5Lf1IUdGUOKonfVGKnfAzOB/XK5/B4ePbXCPpTC7nvTqS/ADmFHSoxp6wCpLCFsnYCum9p+i/niJKbzvUnRr8OeijMzRkdIYZ/2DUvJb5mJk5NOW9gX1cn3P7TkWCwRRAyemCs5xPq6TMLupN19Iu3Oi1FBCvuMUDgZz8mvZDKf9SPsfwrAis+zvS9MOoX9C0FQzD1Kwq4kqfaz1HXi+99+u8TfQ9gDnBytXsIOarqwm52QaV3Yc7xlYQf+czb1eVpJY3lomsKuuqpers//HWGvSKet5JW0rlMZQtkm1vQROLRSum6ZedmUI0teDUPaLdNIJeUUePYJO5GvXP8iUaZOn7DTPs2jvljj9dCHLuxlL8LOvpwv57lXzsoLWjNOoi9PH9l5mSWeG+beS9gJnLNzBdn2vdSFHb5e5uUl1FXnSwU5ctW8Bwiwm1StsA+XsN+lfJ1ASgwDYzcj7Ka0I+ecCFvUUU9hB/LNqsD/plO5Pq2qI4zdqxJzb2SF/U2zI6SwH9CF3Xnt1Jyy8+cg7MSepw9gYosleohdYGFhPu26y3LuwyTss+5yTMiU9lHhHCSd+IwUfFtCz5qu9BZ2JefovCaIMe7sKey8/WDqK8GMLy0tTYqwhBd21vWf2UEuX/qNSOrCXmMX3oED59ipc01WYGrW67wrHyZFUxP2Jss2d9IxEHajs8mtpi7sVcxVV36+Q6F0z+3VVA0Ie32n6/Ig7K16i5pVbwF1gg9Vp8aaQhBW2BNePLhA5tgruduTepZMttOyN9e6bqeg5Bf2ivqiiE5N2NeUYHuevc4bTdjXoeEIUSdWeQUlZcJ5r6ukrqRgLE8bqV8mT17xflfY6CnsuAm8MVewro5ZM4QdF7buXVhlEw/Vdt4DkNMj7EzNCvtQCfvd6kWnyInRhF1/0yn9wWuT/LKuouv4CIcXWjdTYto5MR0p7EiJ8Rl75Ms6Eq84BmGFnWq/TDo6kwuyuOOzEHbFw0delJXbHYsleojdYeygyoGZd9PPue4eIUYsJQaKTXreZrsfYX9XGJ39CPtbnrB/Lf5/NGH/hSydAuw/sq4bwr6j3LfhGbHaqG3XUo11Tdjp2BrkGceanbRRHRB29nMl21WeE5M2lIN7ee5NnoebnExjLq+JL6o1/aFTNbKJtJswhBf2Uttn8z2EfcNz+hJtIZfQ3d7C7h26ago7n5lFO0Et/h6+zUK7trZa8mXeQIZ5BZs+J4dk0xBzeRgJcJmYCHelD2HPIuLfuYIiz4lr0G4JX9AGTqbfI+Me6BkxyGFnGlbYh0rYkRMDX9dTYoAeYGeBNlJiQkfY8YMHTwOLOiLCbvr6ndF/cVIqwNfDCrsbjx9ymBefPemcPPoG778u3RzC/urRo+MOsScli7JbLJFD7Bavuu64EAtUgN19nQTedWfFqOBPYrlCnn7Fo6+UmJkRFHZKheFPU9hbUGDeVlmdiSY3ewp7U41sacJudsKaWxB2D8TmsQPnhou352HzN5eHGL02GIth1d/hzzCEF3aZMsKQogYLOzJioJ6rSmoxstxb2PPettBN2CvtGjNryHOHsIO8pv6YFQvKoomL05eHkaawY+FrOCWTIALvHM5Z1FfA0xS9m5o3hL3C+UIER9p5UEG1jHugqFlhHxFhR0ZMZ4QdKTGIsCtbNx46Rep6qGLsPBg/wRF2GPutQDN25LBHO8Le1dfDCPuDtFmihPX7HIfN/SGZ0c7rGqdvWdilv5+Ur1GSHJDReIslcojdYp/rPifE667rpseE2COLxowK53yVGD/lfRAg7I5P2J2RFHagCzu8GOLOKg0a3YQ9pz90GiDseicPyvFgXdibOf2XAAxs15msYnbeGsuDuJvCjsQbfPMfo8eSQS9hxyDEyRO+gfnewg5prpjCztOxqhc5jL/eRdjLWX0Y9rGggmpCjY3lodsUdvTBt/u8c0Vatb4CPnECB/mEHQPbrHEwHRj3oJuwAyvswyXs0tcleNPpbagSows70X5rkvneJPb2gYCUGPrsHmJn5Jq6vOn0ztuvB9jviaywK183mYsbPOj0Jk1ZL68+ymVi9h/ae+LNlBz2Jon6woxz4hkuSPM5vThpflaWdUy5e5zPX5EWb7FED7FbUE7MkhAnXNoofY/a/0XhhR3pMYawn8f+nypN/d2BC/tzp06dSov+iYawN3oKe/3fCDsP0oW9Wceb4FV3za/ZEPaaNw9UvNFN2APrsPNBmC4U4YW9AHoIO3I52C45ixsDs72FvdSnsBcMYddXw21tH/FpNNmbjeWh2xiMleL6+hf2QucKKrj+AGEvgISqhVOuUClMQ9htSswoCbtn7FqIXXvRKYmxXiRGhbyh6grfC4/Cv+lUzhaYww5l7xpgx5tO74huhH35cFDPsXgn0+NOb0jDOe9lzyMYRtH0++bQSD3geInze52jcbDgWCzRQwwab8axw5wSM5Z20zEhYstyMyr4hT2Gco60K5gPM5kP0XstsyWI7YEL+xGqEjMtwjJ4Yb+cNFNilLgjoN3c8agNTNiREqOVdQQQdm0g5kKEnbfG8gKFHdMiTT4c4VNi8v2+UaikBZe14wYn7FmKP/cv7GV9QWWc1lheD2Envd+QpRX7vXNI3dFW0P5lI28KO24GQJJ8yQp7J6Mk7Hfrddjv1N90qkfY/VnsANFwrRp72Dcn8bxBEXa9rGP3FydFOIc9mD3H9Bh7it551A+Pew+Rjssd2l12iL2enD/DVdfn97OwOxR+lzyy6FgsEUQMmDH30AP3xcaWll1Zx5GT2BfHxhZH6b1JStjB+1ST/ZwQsYtXtwRznr54Vzo8TD32fmaEhf3Htq1fkrpuPnRaw0OiEGwwqJQYFEVv9hR2PE+KbZU3UH5jeYHCjjVgwH8NNFFXd0ODDZDxsQo/zg9c2JFcQtvewg4vRi6Lr54jlmeMNC8TU+URH/dqVAblBfFRkHNtBcilx7nbHQRyfQDuRN4UduAXdlvWcTiFXUXYkcTO0muUdUSdGIAIu0/aWdRDKjui9F1C7PxHN3bN15lOYb87kmUd/2Lv3FmciMIw7A2vKe1OvBQ6o40KiiiI2IiKijdE8I6Ct1+QVsRu8VKEdMsWkkostUthrYEgEtjCBVnwP1h55jt5zXxzMiZmsuZMfB832czOzpmTVM9+vuc7K8qOwzdu4fWhu1fPnchG1fc8uvHwCheckkAxYGLCDk5vM5ZDF9zRhT1mZnDCDr5bHf/yJXkyKKsLTt6FnxMX9rPBCHvc/qx0XQv7V+e46Ju4KGlzS2dpMZ5YhV3se6krNxki7FiYuuSubMuVcVvm5U3PF3aMhKGm1YQdOwTBI9/EQNXcPeoimeKYc+iMMnFhh3a/HyrsMoMmusWgqSI6JWJ66sr8t/kGjd9H6BKDD8GbAXq91HErJGdSf4EAOZKf5gp7Z4Cwc+Ok0gl75XdfR2TYs5kY5+uZto4gtdNREWWXMYBec5o8+jhd93ZO2oA+7IEvOh2L02dS3EsfXK+Ox93cES9UCZkSZsLsunr6qHD4iBGOXE6OLlfN7KCFfdfTL87Kod3Vbz8h7OapnHnec/JdRYX9HYT9iRX2a2YqaGGHsr/9GAMIO8watMWl0XJRCztegq+DnBx0MieRThku7HIStPX0YjU9T9hx3Jf2Li6bBtI4vBZFCLEnmrtgv0FJ37TyQuw1kX2xS/QOjz7BjCci7At2ao2WvclQYRfbjeQ2790ptFqs+9PTV+q3iYtrIwm7DPtJRlMzgM3jh/01AlHUit0vJd9r88kbc8M0By46Bb6wdyjspRN26+vIsKtITN6+Sa7cnU7EyKNv3kVAvR6jC5KbH9iIHbqu27DPnLDv2+2DvPp4PMkdcV+VkClhJs+hi/v3b9+ZKrrfvr3TzDC7zPNnT18/H3yu+urlodRh4Vv1uLR377FpfKha2E+dPHmyLl7+8bfhnTx5sy/syqXb/cOhwr70J2HvZk7i0qGRGBxB7SHsOMTJPGHvKmGP3USnANzbsiDuDlAKxp79HrWbYM5VpYEWdtwARErYxcL7eLKKK4cLuzgwbmFRXWHU9PSV3tuEiMcjCTtoZWcgbwWjgoXfM2qpNzaHgz8Ieycr7N2Ywl4yYZdEjFp0qirsqsQOsl1i8E9svUh5XZ4QYldrTr0SO4w929YRwl4JdKfTsXh8OMXD9MGt6njcyh3xcZWQ6TBLhe//iJ22wH7aTAEt7AlzseKH/ZEIuxLkF0tYndlZRMvF8SvsvrDHL5YXl190kzvlCjvoQroRrcGGqXp6anKgsyznOyqgPy0+/Vb01oeeRjagsh/gnH4oJqGO7Y8aPQV93/KF/eYfhD0aKOzNRFYhwfMNuWSIsEOHWzglM8cvqOnpK/23WcPpocI+Pyf3jDIzECK5pbwfMDcvwo7PPDmo9S9ceANh158BjF3vdBpT2Msp7BsFZNhRYEeJHaRL7DoQ43Qb+x6NRbqbu0ff1lUkJpljQjrCvsklYuzX7FTYCfkvMKSE2Aj78akU2CHsQjMhI0WNpkUlj9udjNR2ut1OO14BlkeMlLe73bbKwnc7Y01PCvGB0KjVG6P+ZqSzNXP1KJ44LpG+MNqEmsrla/UxpodU/6g0a63sDECrqT8hTVSrNVKjDLkjjB3EFPaSCfvW1KLTTRasOc0psEPX/b1OC290CpCIT+OWuXqLTgW90+mG2cywE/JfYEgJuX3hwgEzDSDsYdG2S07bHaxsHRkI+3i0l6SgT3JAx5VRgbCPBRq7BEi7+wJ0Ywp72YRdMuw6EQNj9zdOSjl7VtblqaitY4zVf8zEwNfXprrEoMS+yZJEYgLuw04IobCTGRZ2sByvuLAjDiPEZADzC5FL1sf/TNijuqynDZJ2J3F2/L8Nhb18wi7G7oRdl9gh7NB1IBLt94mx4GksXVeRmExfRz8Sg/q67hKTJGLE1yubGYkhpFwYQmZH2H0nmqywB9LTMXD6+/f7rIywN91K0LJDYQ9O2LeirWN20el60XUx9kSPLdaUM33Y4eqphadFwOUyWn4iZs2ASIwgiZjE2Csh73RKCKGwk5kV9vhrshh0cflr7LOCFfZF+rpG92GZb8T/UtjtpaWHwh6csFtfVzudwtcdeqdTVWJXrJpAiH01nt1o2RK7oGvsztZ1JGZG+7AT8l9gCCm9sJPQiKKY/CUU9iCFvbfotNJfdCr4+yb1d06SL0c/b478ecEKuxtH/uWvOYWw6wI72jo6Y6ewE1I2DCEUdkICgMIepLCnIjEbhGyXGAh7ToVdtWDHi0KNHS1ehX11tg07Fp1C2Wd5p1NC/gsMIRR2QgKAwh6ksG/Rwq7XnAp+hF0eyqrFtQskYlQfdnkAb98kARF2hy6xVyqssBNSPgwhFHZCAoDCHqSw2wr7RiGnraOVY5VhRyQGwK9XFQfCrvvErPE2TkKJPRNhR5cY8XVunERIyTCEUNgJCQAKe3DCvrXf1tG6rsuwIxKToDMx9gsbJwGodUq2i9XY8VJQiRjgV9hTGXYLIzGElBNDyF8L+zZCyMShsAcn7NbXpcJe+UMkxiuw641OsdER2rwUL7F7i07loSvsdlLwdW3svTWnFVbYCSkbhhAKOyEBQGEPUNhF2Z2vW1RfR/RhF0SWM4kYgJ6Mhdo64nJkbPK6OqYz7Fh1ikQMhJ0ZdkJKiCGEwk5IAFDYQxT2dB92CDtC7ANL7KvlkQmxyxMoau06w+5uBl/vKbtMy6Iz7NbXRdmZYSekhBhCKOyEBACFPThh3+o2TrJIhh2LTlVbR63rnq3ju1Asxa6Xneb0iVnrUAX2dJcYVtgJKSmGDOD+3uMHn2wzhMJOSB4U9hxmSNhz2zqKssPXQSoQk9o5yTk6gjGFF5y6gn0ateIU+F0dE3q+zkWnhJQQswLs2ln2vwMe7LWcN4TCTkgeFPYcZlTYvQy7V2LPz7CLccujkLQjB++xJtPYcZ1qE7O+L+xIxDASQ0jpMJNmx407p48ePX35tgG3zl2+vNOUil/snd9v0lAUx+OPqFMffbu9uBibeHjYRuqINQ2YvcACjA2CG5AB2xJkS/a6P8T/w//R096e0dtbp9hheuf5bOsiUIo+mE9Ovv2ezfIXD+BUMHcK+3Yvi7ZkGIaF/SEJOxr7MhKjT9gjPdZWnapIuZ6JyXXTKUHWTxP7mPh6qZYYvYcdiXx9OWJ/ycLOMHYh7puWHzMWEYupj3wQtjEGGAvmTmHve1mcyHz0h8MfcnXaZ8eSYWyGhb2Iwv4y8vXXf9DDrozd7GGP/To3Wpd7dg97+CFI2BWZkZgXnGFnGPsQ902rWZ1NRgOcsi8E0vV9O4V9G2AqmN8Je8PAFHb/eleWrq8P5Z/RBFjI1fkKgWQYm2FhL6Cwv0q2xOgTdnJiLcJu3HdKrm4eV3f1+JjOwxiJGCqJwc+Y2cPOkRiGsRBx32zGyRjfbwuk6Td3xjYK+wSgK5jfCbv8mKJlCHsJYCAHAO9Y2BmGhd1KYU9sOk0M2EnYKRJj2jpBUZYcto6Qrpva/thcnBSR3pvEPewMYy9iXXT9yHd7o/eChf1hsaKwo6uX5AV4cr3CPp2fSYaxGRb2Agr7S+XrCEVitFWn5oTdlHbKnCN5Sx31CDvxGL+J5KbT8PNprY5k7HFLzJv/Sti7W1szx5lvgcMwdiLWxPumT4kSa4X9WDD5hV25ugd7Kwk7w/x/sLAXT9hfqUWnlInRhF3fdIpftDYpKetquk6HfMSjdTMSs8zEpCLsFIlJGPv/V+tYhz0HOXbdL47TcbcchrETsR4+oaS3rBb2TwANweQU9gW2xtTgqDcFGPa+SWS2f3I078qI6n5TVi+Ovk6l4p3/tXPWvxV2f38sd646jXOVfh9fNzoXAxnTmx8N2yXfnynJ95GeJHbPDzrDaTl1EYYpNizsxRN2ysSQr+uRGCI1YEeBNiMxuSfs9GOsTjIi7DRhN3x9w+rFSR92x+PxzgdnVbZcz0F8191hYWdsRqyB6mAa6tOm1cIuAoCPgskn7D4kwQf2IcKLlPwEansQMlS6UoeQryTsAVSuIaQTyvxXiKiUJFI+UecB+DIEQgIZQxfZTl2EYQoNC3tBhZ0SMekJO0ViaMKubN246ZSi67nK2B9pym5O2FPG/pTQjJ0y7FZO2Gd1N8Q7dVaDhL08m31gYWdsRtw/7/2Q9qawW9inAEHljJticgl7u14PAOp1gKBe96Q8C/9R9zr4UDlyaYDaPDzuSARf5V00ACFhx0fqB14k7B6+dHiBD8xVzAaCYSUAEvbKyUntVti7ofUPw3Nl6iIMU2RY2Aso7KGvh9Cm02eJlhg9w77cmmTsTVLefi9QJAaP2SP2iPAzZWw63Xh+O2B/XWBhL390Mhi6inNnJUjYI1jYGZsRa2Aw6GFEYerYLexi4QGAJ5gcwp6KsC8A6qf4+xzgWLm0907KHkTPDgDCU/2EsENwGaZoutFrTkpSljsAN1IeAtQmUt6QsGstMeUaQB9/o/q3UxdhmCLDwl5AYY+NXRuxa4tOUYz1khg18iZVVyQWHuXfdEq2nplhJ2XPHLDTptMXhZ6wj7Y6jgl6twKqMb96534QXDoh1SDYHgUBnhMEY6cdBAsWdsZmxHrYbOGM3W5hR3+Egz1uiskr7B5cyBJAVSLDULeRUgCecumWMvPwnINY1GsJYW/LmDoEJYm0AM6kPAZoSqSSJeyX8RR+BNBIXYRhigwLe/GE/ZXew76hbzrVJ+zJFDtB03CtjT0HVOgYHTMn7HqtY/bipEJn2Edbbt3JwE3zeepkUnXdnhPSdd3Wrqvo8k2njPWIdfENLd1qYa8BjASTS9iphb0KUFLyDnOkUqlBoFxa2XgceqnLkOFS2GuSAAjUmWjh0Ut+SKSdJexdgGr8tvXURRimyLCwF0/Y1YSdQuyR9Bq1jtQTQ9CEPSHtlD/Pf9cpfpsj9uhLN3bN1yPSwv6qmLWO6Ou/E3bic9kxSQl7aT7HF87nX1jYGesR62LX9w9tFvYPHIfJL+zUwr4Xt7DXYEk5uh80HsIfRX6OR+T8VtiXir2AJfUo7aI+QJawnwHMZEgHH9EvwjBFhoW9kML++rbXkTLs6UyM8vVUrSOR2HSUQ9n1NE3qnlP8WaJ03dic9Jx62At+0yn6+u+FnWg5Jilhd+IMO9c6MvYj1gVmYiY2C/sEYF8w+YS9HgQAEB/2pQSoXRGGsEPs58eJlhg8kpl7dOI0VnHkJkvYhwCnMuQAgIWdsQgW9kIKO/o6ZdjNSIy5NykedycTMdHP0rzzQPN6LSIf5eYzi9hJ1/Ua9gILO/o6CzvD/CNhj99xs2t5JIY3nd6DsAeQ4FqFVAjDpWvg0YTcEPZDlUsnKvGEvZol7PsAu+ptecLOWAULewGFPUrEaDedahN2bcROGC0x6kvZeo7xujpQiJ0Ibd0csZOxp2sdSdhfF3LTKfo6CzvD/CNh3/Tb2/L95mTq+73oz5PJpO37i8mkJKzilIU9v7Dv9C8Bmv0rgH6/PwmjLEE5W9jJr5EDU9gpL0OcA1xK5CpL2HsA3fgcj4WdsQgW9sIK+4uIjdvFSXoPO5EcseuBGKXbtPfor0i2uRssbV2LxISfMSQZYd9QiRj8Lt6EHX2dhZ1h/p2wE00pkEOf6Amr2AVoCyaPsFOEPWp2pOH3vlSUDJe+UDeL/oAsYW8A9Jcn9gEOJFLPEvYRwFF86QoLO2MRLOyFE/Y3iZtONxDtnlNzwE66bu46zb3olKBEfBJ1m6tx02mEvun0eaEz7OUt916FvcnCzjwo7v1/+EHTj6h+ErqwfxNWsQewI5g8wq63sFNFehhen1zVrgyX3gaozeQPL1PYZwBBO5zZD4NQ3I8AhrOdhtHDTnKP1+sHACMWdsYiWNgLJ+wotekadjJ2c3FSwtnTsh4d8to6vcejOzMx5OtPEi0xNGLfQMJITEF72D926oquY/A3wn7Nws48KMT98/Fwe7u0KWzGP6oBBI5g8gq7B2fyLcBYKi4DAKiFB0PYoxE7BAC6sBP7gNQA1KT9Rr2OJuz4ODFDqQ/iNxpKFnbGIljYiynskbErYd/IqnXMamF/nNETg9Dhr3Rdi8Skeh0zIzFo7OmWmBdqwo5/p5cFjMTcwQrCPnZd3wnpsLAzDwrBZDAPZbAlmNzCDjCmFvaI0wZEHPQ1l/akiqQjXqIlZi6XtOoQEswnElk0AggO+gDTlLDvhE96gEQur1+EYYoMC3vhhP0N1TrSiD3ZEoM+rHw9XnX6JNXDTq5OU/bcE3bKxNyZiHmcGYlBVCIGjf11wTedZrKCsC9ct+YgM5eFnXlQCCaDUXX3UDC/E/YfNzclmeL7zUzeSak/be+WfvHcZW9b/pLDy+4g8eaTqCWmL7P4Xp3ulCXDWMVP9u6up4kgCgOwYMWvXno3nWqMTawXYLJKXEOMd65pDYghYglFQoIfCbf8EH+xZ3fmtPOxNdYpZmZ4H6FAjKGXryfvnoPAHl1gp7xuXTrlvE68S6fmiN12I7zEzgN23hHjjtiJO2NXad2uxMS/h32xnYHnea/NK6rCf5lMy00d2F8PNnfHzxDYIXkCYPnAHonz+uIpQCYQ2CMM7Pqh06750Cnx7yYZl5Powxqwc4c9sMbOS2b0tH7hM6cc2J0BO691VIk9vcD+eeAqnvZanQ2UjyqwFwOyi8AOyRMAQRP2vfplenkp5fHlc8ocNGG/eqOi2pPPqDxzKAFygcAeZWA3KjG3G+6WGA7s7RN2bwU7fRO42JF4E3Y7sXf0hN3Yw57IpdPF+p/tGfvm2aTX7tVZ8/enIxXYJ2+awF4NBhMEdkiZAAjosG/Jo6LYk+Oi6MuT4oOUZfE/MvS2fqx0J5phPwACu5ZZYL9vBnb/mVPiV9jnl07ZrNASeDpJr4nxnzltX+t4S7FH7N1uihP2ZcjRt60eQGYEQHqB/evHIdk53JMA2UBgjzKw04T9TmPBWkcKx1aHnSsxjPP1jXAc2O09Meve4SQesTsVdt4S0+T1GA8n/avqvWHSA8iTAEiywz59/ksC5ASBvd3DyvefDyd16wuhusPOlRjidmJuzg4nMY7WRtgOm7Hzt8RpxDB/wm502EmqlZg/2BwYfvYA8iQAkgzsALlBYI8usFNebybs3T9UYrwBu33olA8d8ZqXQGvzP0xVcOwJO70pzut2YtfPnHazmrD/2DYc9wDyJAAQ2AEigMAeYWBvIrvK68Ta68h72Bt1WHYbMYx3MgatdeR/zh2bRVsdNT1g71iHkziwZ99hB8iRAEBgB4gAAnuMgd3cw86BnUvsrSP2tfrTLbE3LywstbsddvXLOK/ryN68LWJ32CmvN5E9tw47wLUgABDYASKAwB7dQ6cP1OEkQh12fujUWetox3UvrfNXJajF7jx22r4n5qZiDdjNLTGYsAMkSgAgsANEAIE9usC+cK3jhtFhnzEKMcblJJXRuRgT+sCpHtibrCdOmb/Vsabzem4PnQJcCwIAgR0gAgjsUQd2t8Puj9gXdthVaA+8c2osY/esO4sdO9aamI15YOdGDCoxAMkRAAjsABFAYI82sHfvOJWYDXOpY8c+daoq5XYnJuihU8apnyf2mv59zpYYew87qfO6UYm5h8AOkBYBgMAOEAEE9hgD+70mr3f/Yg+7Suz+Hnadr4NZu9wX7GG/ObucpLVWYu6gww6QHgGAwA4QAQT2CAP7fXNLjD1h72hmhd1/7pSzuv+6fFbXr24fxmvE8JIYeo+te9hRiQFIkLgCTx71rB/xv4K8ILADEAT2BTIM7MalU2PA3lG4EmOkdRdXWQLSOuG47sf2df9wUsO9m4Q97ADpEqv28OikKstqfypqT7bG9U8nEwHZmAX2rf02YwkACOx5BPZ7Kq8TrsT4p061deaEdu6ck9CljnaFna3TBzMvndbvz9rqyIldb4l5gMAOkBCxaqNSOxLkU6ntPxGQiVlg/1S0OZQr0z89fSkBrgkE9vgC+3116NToxGw0/Eun9IfPJplhXU3X+SWMHq37lZh5J8apsHMlxkjsWOsIkCixaqNq++t0clCV5fcmsFdHk+lb+umHgEyYgf2dxw/s5cVL2b+42JNLOx4OSwlwTSCwxxfYuRPDed2uxDBnwE4B2q/EBE/Y+dM7neRX2InqsLsVdhxOAkiXWLVHuhlTlmP68v1t87OsykpAJszALl84Rl5g7w+HB/JgOHyMwA6AwJ5gYOdGjDth14ndmLCTNe+hU66uBy1jX7Miuz9hdxJ7h1mJnTvsmLADJEhcld1yV8yNy1IKyMOSgZ2yel+eDQu5vIfn5yMJcE0gsEcY2Ou8XuNLpxvGlhi7wz6/muTeTdK5fSW4EkOv7SP2Rv2eWi6d3r09G7B3EdjhN3vnsps2EIXhXtVblt3ZQ6MqI3VYcJFTVEcWlrIJqJAQorQQREhBIg1StjxI36Pv2DOeOWCPnTbUQbXd8xEMpmDY9dPRP/8QOcPaEnstdxIV9n2LKAabCbtydUccMoIgSNhzJuy4cRJgtsToCPszoyRGjbxR1c2WmMfpdzpFW0/MsKOyJw7YcafTlzRhJ4j8YW2HTyPX/WytoUhMgdhA2L9Da0xTnPYnQgz71/BCr92+YDez08EJk5T7s+7R7RIH6u6g++3swnVLDFi6kiumKZ8Mu4NFjQW02o33/frpkObvRIEgYc+esL+J9rC/MnY6jUzYwyl2BKfh6zb2dGChozwmT9ijtY7JGydRhp0gcoi1BRrnE9kLs2utqMnSGKIgbCDsrggjLVyIyamQLODswhEBX5Wu+EJSF+I7A6ZC4qL6+yJ07omBusqEEURRIGHPnrCrCTuG2F9IYrWO2BOD4IQdeaQDMSmVHaf0SSN2eYsau+HrgCnsb6jWkSByhfXw7LmSTsjXyzBg37WIgrCBsHd83xPCB9n2fN9Rwg4nzrEvpoz1PHh6OIfjNQMc+LfZsRBa2DuDwdFK2MtNeOtwIIToKGGXp124LCOIokDCnklh31n1OmKG3czEKF83ah2R0E5HKZQ9mqYx1pzCfY3S9djOSS+wh50WnRJETrG2wPl5v+W6k9W1d2Hg3rOIorCBsMci7Etp2vLzjQZjczVbv/REsxQsTj2CsxMl7EZLDLw6KDN2A06vhX3Gggs0GEEUBBL2TAo7+Dpm2I1ITOK+SXrcHU7EBPe1eacB5/WRiHyQm08sYle6btawk7ATRB6xtsPuZ1nrqNi7dt2aRRSGzYTdAbUuBWKNwj5mip40dMmtECPGjoW4YEAzSdgd/bGBEMtA2L336motRhAFgYQ9g8IuEzHGolNjwr4esSNmSwzewLfTLDjVBwyxG2tOjRE7GrtZ64jCvkM7nRJEzrC2BVj6Bz1wl+tPieJwf2HHFvaGEKWVsH9hGjkun8/n9TqoepsxX/hMMkwS9qauhbxW8RlPnDLgvRBTRhAFgYQ9s8L+MmCVYX8e7WFHQiN2IxADd338637HcJt7jLWtRyIx8jdKwhH2VyoRA380YSeIXGFti48YgxnRgtOCcX9hxxb2Q6nbKOzTpBWpQy3hwCJJ2IU4Vl8Jbq8WneqXvzGCKAgk7JkT9rehRaevAFxzmjxgR11P2Os09UanCCbiw6hlrsaiU010p9MXlGEniNxibQvIxFzqx3OLKBL3F3bf84QQ+tDWwn7CNFMh6gvNDUi4Dsi0E4S9hIP5K6XonvhCwk4UDRL2zAk7SK1Zw47GHt84KeTspqzLQ2pbx2s8/m0mBn39aagl5jlGYgAZifmfe9gnQvTs31MVomMTROawHhp9xd0TFYk5c93rPYsoEvcXdk+EuNXC3meaPj6Ppl4O48K+tvkRvELCThQTEvZsCrs0di3sr5JqHZNa2J8k9MQAePgrXY9EYsxex3gkRvLcbImBRAwgIzGvcx+J+fBxNBrVPtib0eb8yv49F5y3bYLIHNYDs+t2qmxv93Liun04vXLdVnUcYFtEMbi/sNfOboRonS2EODs7uzSEHeMxSFd4JQYcJQm7L5oYo2mQsBPFhIQ9c8L+FmsdzUWn0tjBh5Wv661Onxo97OjqOGVPPWHHTMxvEzFPEiMxgErEgLHvFGOn0yufS5yxvQEk7ESOsR6YXRdpMbXgFMna/0XE1oUdI+wzNTs3hb3sKUUH5MNC2Xk1sdZxIMQNtsWQsBPFhIQ9c8IOvh7Z6RR93dg3SZHQEoPWnj7E/hiP6mrmiB0wZ+yBrRuRmCL1sA+5YmpvgCHsZTtECYf1YWEv79sEkRGsB2bvvOUGND5ZQIOEvXhsIuzYwm4KO5arO0t4HB17cHzngZ6Pb5qmsOPnmjVWHsosOwk7UUxI2DMo7HrR6U540SkQ3zdptXOS+lOs8+aYP085YdfXkbc715yisBsDdqx1VMaeF2Fv3+njFa4QDc19vmnuwccOvGMb+Hh6wCvONDDyD64Hl6p0z2z7xBPwzPNA5kdOBZ42JzZBZAHr4dnvVasl2ti0uGwi7A4Y9TshRonCLqvXhdeUBwZMRICvhL0lVsgr1uW75P2ChJ0oKCTsmRT2UCTmRYDZEoPCnjxhNyrY8UmaYkcgNmF/bNaw46JTVPac7nRa4V/sZLjJwT3E2tdvhacLrvClsR9xTcO+5Yp3tss1hzZBZACLILYo7ODqqoVdU1PCjrQ85ei3TDJyhGgefhWiFxX2I10eo3dJBZorYb9lBFEQSNgzKexvosJurjkF4hF2uBtWvQq0pNw6SdfExNecJtc6PldERuzg6/mZsFf4XcbOYxyU7T/hzj3Oj+cwtu9zXjnsLw44d2y7ASfTxsSBB/vjvMt5cz4v78Mlh51OHR6qNkH8eyyC+Fth/7lclpjBj+UV24Tx+clozJByT7bEeCyJ8nLS6DGCKCwk7JkUdpiwvwy4o9YR5NjIsIM/xzpi4JAeFPZoT8yT2MZJOGI3IuzYEhP4ek42Tqrwu4ydx/ls/xHMsLMKr4zhcd/nvCbz8Oc2cCTdHDPsDfB1G3A5d22C+PdYBLG5sG8PteMpQfyHkLBnTtjfrmodwXR1hh0jMYCZiXm62jgJQbUOyXa6GTs+BYxEDBKfsIcy7EDeIjHJxp5W2Cect2zJmPOBjMEcf4KT2mx2sRL2j5wHle3l2axhE8S/xyKIVBP2njxcLpeMjZc1cA6csG/O4qgDl6sL0WIE8R9Cwp45YQdfDybsO7+JxMQG7NGNTnGjI6x5Scnj9Q1REZzohB1+lPJ109j1mtOdPE3YOa/bJmmFfcj515OACiTaq3LF6Zdr/VuxJaYCL3ZbFIchsoJFECky7FU2cpwe6zhOiU2cLmMuZtg351CvK3UYQfyPkLBnUNgDZVe+DkR6HbGHPUDKspmIQbCTMVWtI34cMzZ3tTpq9ID9WWTjJBT2fGXYJfu2QVphd/iainw1QEzL9lrYR+rLD+qXNkFkAIsgMiLs174AvGmZEcT/CAl7FoU93MOOwo4h9sQR+2N5N0PswQFJZ+1mhl19Gfq6VvbgZwHRDDv4eqDsOcuwc35rm6QVdj8q7Pb3mafsvIfCDpTaPl6YIP49FkFkJ8P+i72zaW0iisIwfn8u3d2bNJUUGmFapbU4In5CGtPUYEtaa7CtFawVBO1CBNGCG0F0o4gbFwqmdaUUu4rgoiIEQsGFCxf+ADf+B8+de08yc2eibaZpZ5LzJJnp7UxqdKGPh/ee0304GiGIFoWEPXDCfkAOTgIgw46bTrW2jk5dd9k6niW+UuzatlPvPjHbJI4Cu71LTBgr7Fe5C7/CDr1f9J4yh3KiueMFFHbJseEx0bmdE8TmwwgiOMJOEC0MCXvghL1mW8edtgx7BVsgxjY5STo6BmP8bjhVBXs7jh2niLuro0D5esg2nXr5ul9hNzs6Mtxi7MIUnxq5yQUzws1R2KdHRjo5EO0STdkJYtNhBEHCThABgIQ90MKuZ9jdJfaaGXYp7T7nnOITDi62ao0dt8NTonwdhR0TMWGKxHj6uh9hPwyncQisRzgA5n5EJNqjHOiE71rCLvx9SoxREpwS1XiC2HQYQZCwE0QAIGEPrLCDsVciMVqFXeixc9SpjJQ7MzG+Np0iaP1YsVeoX0/rEuPsww4IX7dFYvaGRdivcm9OdLg4zP9PClIv06etNjHHM22Tt7rE226BqOd6+eSgsHf+HAYnDfWJto5dZpQ/vyosniA2H0YQJOwEEQBI2IMo7HstX9+/ij7sYOyefdiVX/vG0cu9Rh/2bZXJSQrPSMzu8GTYJ7K8BqMdOj2d/P+Ahlu5l+jJDgVU0yMV++/q5io438ZHOpAcJ4jNhxEECTtBBAAS9gAK+z57lxhnhR2d2B5hd+87RVfXjnW5ujrqeRhXIgabxMBn9OzDHqJITG2io84aexfMPFoNZ9Um0k7xBXw5wYE2JeeD3RwYOm4JO4fyu+BknhNEAGAEQcJOEAGAhD2wwm6bdGorsKOwYyTGbesIRll82DqAuu7W9q3uwUkW+tyk8PVhbyhtffkrXNE7mcuc1qPqnTfy08O04ZQICIwgSNgJIgCQsAdQ2PdKXwcwEqONOtUr7G5px8w54LepoxZhR12HJ2KfdCo+n6OrIxq76hJzoFmFPXXexpR9cZnXx2TNn5jlBLEhkLATJOwEEQxI2IMn7PvkoFPMxNiEXZ90Cg8cm2SXdVldx4M/VGndHYmpZmK0CLseiQFjD1lbx7ro6qjFTV4fNztq0cUJYkMgYSdI2AkiGJCwB0/YMROjfF2LxCBagR0E2h2J8V9hx5c+OkmPsGOF3e3re8I3OKkuZvpsTNsXV3h9XKn5E2c4QWwQrAHEY9yxpP8VSN4WCjHmi9nCO9YwHv7+3UnCThCrhYS9Bk0n7JiI0SvsythtFXZgi77pFB7O/i71V9fxVbvCjsa+HXEYO2bYm73CThBNCVtv2vITKdNMDY0zQe/AkFhlD8dZqxA7d45588Iw2pkvbhv3GfDxEfKB+SP+/n1F0r+m09G1CXv3kBeZCEEQJOzNIezC1wU46XSnrUuMM8NenZqkz01S3r4uYCQGjt4ldgvxmTwmne7ZVSmw7ydhJ4iQwdabAVORZ8A4riZirEWYTybbGyzsC0YF5o/X6fTX+oV9uMeLS5HapC4JhiMEQZCwh0HYlbHbSuzaoFMQY61JjCx5S0tHqrtF/U86RVv3zLCjsnsW2HHS6W6qsBNE+GDrzUCqb3L8cg7q6jeEsKcyp7u787DKsxZhY4T9o+TMZgt7v4t/CvtIQpCNEARBwh4CYd/n7MO+R5t06qiw21PsCFbDq93YfYENHeFVq8LubOvoPTip2TPsBNGUsPUmppIxppmx/sJnAp4yU6xF2Bhhx39PN1vYI70aA/8U9vzo6FkSdoIgYQ+JsMsKO4bYdwlcbR2xTwyCFXabtGP+3P+uU3i6S+zy4TB2zdcBXdj3NW9bR4JoSlijyJpZ26rPNI+xUNE+v7iysnhHLYpLK4vznAlixeK59vmllWWUbw4X8ep8sbiUTC4XAW9hf1pYKDxlisez9xcKb6R0P3nxIsaABy/mGDA3+5K/e7ZQeIsbVj8u3J/jDmFH7s2+Yfc+Ljx7x9bI53L5Tzr9swxElbC/L//4WY4xi95y+XX88+8fP7/GGRAtl36Uyof8CTswScJOECTs4RH2/ZW+jphh1zMx0te1to6IbdJR/cqupWm0PafwqiJ13TU5aRf2YadNpwQRUliDiKfMCdsyY5rhCrG/SkqWGfBFLZ5Y8g7flMs70rrVxe8MSFbxFPaCIbgv/yxmDYsPBy1DNwzr/NEwVC39gyF4g28FFjyF/b5xG94EFNja+Jmu8FkKOzyBb5wJ3qfTv36kBWVh92nJQxJ2gpCQsHvTZMIOvo4Zdi0S4zk3SZW77YkY61U1bz9gvd4Rkbdy856N2KWu623YSdgJIoywxnAsb5oDDIlNmuYQCxPzYNwry4vfk0tC0cVicQWO7dYKWIJLcA2IWXcuL0lhX16E++Aq4CXswLPCbUigM+CNtXpkGI88hR1MvgBmfjsOq6f4xoqw35HELWGHuwri+Jhp8JyNy0zja6kEzv6jBIxbwg6USnD4isL+DZ4/vwlhf52GO38Lfz+0VmGPZq/1D16f9hL2K+aRwcGx1Diu+8b6ey6cHcA7r1242D+WiUYIoiUgYQ+gsItEjLbpVKuwV0vsiN4lBh9o63WW19UBQ+zanlOtxI7Grrd1RGHf38yTTgmiKWENoC83YYKhx+TqaN+QWB1iIYJjOf1VEQ4QcpmHUzGZXFTC/oWxOBh7XNwhv8v4q/9n2KVTn7ttZdnjoOoP4PTJMJ66hV1ZPVTkX8JJ3toOJ61LzFsp7B84Y+/EOzR6szZm/p9hT79mrA0kXQk7fNUmiutQfy/JG8vp9O81CvvwyYRFj1vYswnJiRlreahfraXcT6nV9QhBtAQk7IEV9t0WlQz7DmcfdsRWYtcCMfBSx7r7O9q7ubuo2rojEiM+o8AeYd8jEzHwpAo7QYQKtv7ETUEGIzATYjURruFJkHkpyt8LA1TcBc5JKewrTPp7u/Tz+dVvOn2mznOQSlcZlieG8clT2LnI21i3PlGiPuct7PLExEUNnrfR/X9h/8MAKKNXhD3KFGjxUHNfm7DfFa4+dm0wcdIt7KOJRP/YrUtwx6Qy9JOXpq6fSgyJ1QyIfP+tsR4SdqJVIGEPnLAfsG063QPgnlPvAjvqusesU9+DThFMxNuR21y1TacK56TTXZRhJ4jQwhpALjeUqjr6cG46a5qpKAsRS6J6LsDQOhMsJpOx6vKVDLHfAY1/FVutsN9jwDmrFj4ni+eifP7IS9g/MIAbxixj9wzjnVqhsD+QxKSwq5+z4LdLzGcGlKrCXmKKqJB5dbFzTcLek0iY1r0jbmHPj7YpNb+ubh0X577L4ng1kchY989ECKIlIGEPnLD/Ze9cWpuIwjCM9+vS3TmpUWYgUzC1pJZEQ2ot2Eatxkq0KlovoFUoWBfiRgU3QtCNIm5cKHjbeEPdKLhQBEEKWbj0B7jxP/idy5fMnJmkiVN1JvkebSYnyWh2ffh4z3tAas0adjR2/8FJLmc3ZV08hLZ1/DcWNc3EoK8vcbXELMNIDCAiMdTDThAxhP0dkrtlrSMyDcYep7NOq2KmjnzEGfp7qegbYKlf/siAObnj9PWGloT9BqvNwoc3baowrd+Bm071R4fljQ/xxtod4neWpTedamF/EVbY7zPgZ13YvzHNB/wcZGKetSPsu2GIPu+m0yGVlyk4BW9le1+CILoIEvZoCrswdi3sq4JqHYNa2BcH9MQA+PBHuu6JxJi9jv5IjGCZ2RIDiRhARGJWUySGIOIF+1uczeVS9dUWcY5SfAAD9xTGPEEV/1gTdguF3XqCfTItCPus9u6nMp4+Ildv5hX2izBRN3vYkebC3uuCt9DDbgj7D6b54RL2D+0Ie85xjjYR9umxk/39/XlnSCzGYdK+JQFghH3/IG04JboIEvbICfs6rHU0N50ul7oujV3oMQCmbPSwo6vjlD30hB0zMU0TMYsDIzGASsSAsa+lk04JIo6wvwAqeqm+6snlDrD4MOduZZzFQPsnUHFjwq4YeV/Flsdmwo6D8iSk110W/kIKNwr7rQBhf4DpmU1tCbu56TSEsNem7b9gDN+OsB+GmEtDYV8/6SiUsB91gHxG98kcz8s3iuTsRLdAwh45YQdf95x0ir5unJukCGyJMXsd4RJmwI4dMeaIHTBn7NLWjUgM9bATRHxhfwvIxByvr47HS9hfu6U7qXpgMNluTtgBC7epzivs1xhwQwbTb6qOdYyrP9L+/tQn7HJ/6h0GVP6bsKcgz47d7VaLwo7BlsY97KPg5/0zxSJmYc5llL2fUPYymZcGfzZBEF0BCXsEhV1vOl3r3nQK+M9Nqp+cBH+NATtm2MPF2LFkRk/rG+45RWE3BuxY66iMnYSdIOIGW2i4ttx9IhKDK1bO5aL2u6gZ91TJOsBVO0xSiXuVBU3Y5QozMfh6sLCDUmNXY0UEY4DLqjvmobL5kU0Bwr5B3/iyXWFniXkiMUmoaWwq7Ag0xoj7B0RbTDvCPgMNMI2EfdpxxnWGvYAz9/Kkg68CB07nwdh7EwTRDZCwR1LYXZGYFRKzJQaFPXjCblSw45MwxY6Ab8K+yKxhx02nqOx00ilBxBy2wCRze/oSVvL4lDoqaWrqRI9l9YCvj8Wq2LEKU/Uk6PPcW7XZdC7J+Jw0dXPC/qT6RHywqlbACHj9bLJRD/uwJWbp13V2/aXFrkCBY0WZ+oUKG3kRJOzslrzx5qZ5hb1txCmn2ebCjtn171nW+wUm8m0J+4TjjBlS4jgztfcGxbXH0cKOUZi8t2XmUoIgugES9kgK+xqvsJt7TgF/hB1+DKuuBVpCHp2ka2L8e06Dax2XKTwjdvB1mrATRPxgC0wyh4wlZAk7cpzFidmdGiHsVlUvqpYxYZc2r5mrB+AlQcKOXFbJGOAC/DzW3i25ECTss3jjAgo7irjkw3zCngRVl3yx2hL26ZqM16LssJlUPTnrOEVxPa8+g2Q8wn6ahJ3oFkjYIynsMGFfKWlQ6whybGTYwZ/NjhhxDQ8Ku7cnZrHv4CQcsRsRdmyJkb5OBycRRMxgC4xVHstJBrMM2LJPrSbWs3jB3ypFvydtVS1eC1+3XBP2ivB2bfMwkNckP1UbCvtl8HHcQcpmr28S3FErGK4DF2stMbdQ2Osfvda0JebFnwi79flLc2FH+Nddgq9J1rKwo3BnoFe9dLjgmpmf2Tx9TMn8AVEko4V96Ayo+cYxfSjq5OhgL8TaIRNDkRiiOyBhj5ywr6vVOoLp6gw7RmIAMxOzpHZwEoJq7ZLtcDN2fAoYiRjEP2F3ZdgBisQQRDxhC89Aqa+vJ4krvr5ven2s4jACi1nW7L17I7hOVu6ZMRcLL/AevtkCNx7cqC82XH50w2JI5dFDXPjZ+Ohhcr7v/HfhV39cha/QprBvHBIbR/OuIfo5RwLP9oq3xI96UzwtOMA5sRrF1fkEQXQFJOyRE3bwdTlhX9skEuMbsHsPOsWDjrDmJfyI3bfpVP54J+zwpZSvm8au95yupQk7QcQNRkQFKy5HS7Uo7MiMI8jXvftcJq+EvTQp3xkcVbWOB/OqJKacEBQL6r5igiC6AxL2CAq7VHbl64Cn1xF72CVCls1EDIKdjKFqHfF2zNg0anXU6AH7Us/BSSjscc+wj7wK4A4niM6GEcSfCvvzS5d8Lem3L51ImBw5O7GlN9hQ9kz0uRtkymPl+u19R/ed3UI17ETXQMIeRWF397CjsGOIPXDEvkj8mCF2+YCEs3Yzw67+M/R1rezyawHeDDv4ulT2uGfYNw4HwVviTNrhBBFLGEG0L+wEQZCwN6CDhH2dOjgJgAw7bjo1ah29uu6zdbxKwqXYjW2nwT0xSxSeAbu7JaYTJuxhhH3cTvP2mHKcEieI/w8jiFAT9pJ4OH4J9oseu7QZnAMm7ARBkLB3grA3rHWUyo6+jrgCMa6Tk5SjYzAm7IZTPbB349lxivhbHQXa1+O+6fTfCnvRtk9wgvj/MIIIkWHvSxzNZEqJPZlMT2IqMw6dL5BhJwiChL3ThN3MsPtH7A0z7EraQ55z6ipj97HYKHZc6qmJWV4XdkzEdG8khoSdiC2MIEjYCSICkLBHVth1reMKgTFhF3psHHUqI+XeTEyoTacIWj9O7DX6/zNaYrw97IDwdVckZnWHC3t2wL1K9aqrR9gHstzDgLwlix9F3MLek+IE8X8gYScow04Q0YCEPYrCvlr6+toWetjB2AN72LVfh8bT5R7cwy6+BAq7IjASs7LTM+zTex3bTg8dVavSwbxtb81MyAUK+4HxrfDi6GYO9ObzR3t2FOx9/Mhk2oaXT9Wl/Uw+DS/k94L05/LwXnr8ACeI/wAJO0HCThDRgIQ9gsK+xt0S452woxO7I+z+fafo6v7H9l1dP5p5GF8iBkti4DsG9rB3eiRmIm0rDnOgjKvJAV4T9hlbcwgWJbg48HzfFvzoUJZrhmzJVs5Hbc0gJ4h/Dwk7QcJOENGAhD2ywu466dQ1YEdhx0iM39YRjLKEsHUAdd2v7Yv9BydJzHOTOqSHXQr7o1Qqm0qlKsPv7m6Qr3BkM0h15nwuA5cJzo/ApVCc6odLP0dhz8FqdCy3Hy57pLCn4W9hd8G2xyfKM7DIcU3uDMzV9545xQfhE6cGpzJw4QTx7yFhJ0jYCSIakLBHUNhXK18HMBIDoLIHT9hNacfMORC61NGMsGOIfTHiPulUfD9PqyMau26JWRdrYR9+9eounKB0cXjk8rZtN93CDk49w4FD4O1y1Z+C1QGQ8z4t7L1p6fJS3LdmhbBLRR+w7TwHpsHbOYIZ9sO2XebAqPhnCOKfQ8JOkLATRDQgYY+esK9RB51iJsYl7OZJp/AHj01yy7qaruNDOPRo3R+JqWdijAi7GYkBY++kWseb4skrbkRijskAC5DNpx25ysrlDJi7FvYxNHKReNkjhX1K3AAev50DxdM5jqCww+17s3DdfPr0EU4Q/xwS9t/snd9v2lYUx9X96rL1cW/XJKQCCUcyXVSC6i5qmyK1RElGmoq0TZSQNtLSVppE/DBFQigSL0hR/FKE9jqkIN7CKraX/hX7k3bu9T3YvjHNOqDBcD4BY8fGvtMe+unp955LkLATxGhAwj56wo6ZGOnrSiQGUQrswqHVSEz/FXZ8q0snKRF2rLAH+PrUmC2cdCp2tJpf2NOiwI7k4/GHmmAOoulS2KFavqIJNvjF66j4azy+/vaB5gWF/RacS24eTGsEcSWQsBMk7AQxGpCwj6iwYyJGrbBLY/dV2EGe1UmnGF3vqxm7+DK+e1fY0di/QnzGjhn2saqwL52ljnzCviziLshbUTwXJON3pbBDTEaOawvq5to6FtxvQYhd7QSDwg6fAh1ayBDE54eEnSBhJ4jRgIR9BIWd+zoHVzr9xtMlxp9hd1dNUtdNkt4+EDASA9vgEruAjylgpdOp690C+43xEfal2mGm5hH2h74+Lq9cfb8bT7rCntIEO9zV13lYRpAorCXjnLca4vZhf72/6HSMWdcI4rNDwk6QsBPEaEDCPoLCLo3dU2JXFjoFMVaaxIiSt1R1xJ0t2v9Kp2jrgRl2VPbAAjuudPrtWFXYgaNZj7Dnuj1etraf8szLK+foDnSLkcK+ybPqgjRPzKzzTZet5btg5e/wEIVdMJd/HOc1eYL47JCwEyTsBDEakLCPnrB/7+/DPqWsdOqrsHtT7AhWw91u7H2BDR3h3avC7m/rGLxw0nhl2DmZY1fYF+LxJxonAeKd2BKaDnB1fy6FfRkNnat7oSvse5ubWxrnHv+tBIX91aZTdX/DA+8EcQWwIRCLjsnfAxLNZpkFU621PSdrS6esFzCDvcrGChJ2ggBI2HswTsLuVNgxxH6do7R1BJSujlhh90g75s8HMOv0WkCJXfz4jV3xdUAV9u/D3tZRCvtPP8EmUnOFPQWhlgUNyEFbR7B2mYmZg51tKew7TotH0bI9OYPCzlX/hcZ5KdqzL6yszGlC2H/U3Nx7AmLsGkFcAWzQzGwXsqaZ3dhlLq8LhVUWQm4axjELpG0A7smiUWK9yBhGjV3OUUVQsjJswBxWB3PL2cysIuy3NoJYjRAEQcI+LsJ+o9vXETPsaiZG+rrS1hFxVzrqQ9n9aRplzim8XTDDrqycdB37sI/dpNNaqto4rLqRGGdVJHN3OpcUndPTcLS/Nb16l+u7FHbeJiZpru8ux3lgxo3EJOHSHW2uAJ+g6nGnl0wWMjAHD3hbRz2f0vbWeOCdIK4ANmhWTMk2QzRu8CyE9BT2Mth6y7YbAxT2YwOpsUGCg+ufvx49UoT96e0gnkcIgiBhHxdhB1/HDLsSiQlcN0mWu72JGPF2zbsfsF7vi8iL3HxgI3ap60ob9rER9r+P+fbP0yPxqSGJ23GBNOt9PNJvaSjsc/fjkrU7HmHfiCNwjMK+wI/vapFFPJekhZOIK2AYwp5N7+1u5cHRXzNJ3hw3YV8yjLL32Gr+8bFcTeO/CXtnackuGnDrEAn74wtcIuw3f9yLEARBwh4OYeeJGGXSqVJhd0vsiNolBn+ErfdTXhcbDLErc06VEjsau9rWEYX9RvhXOlXRXJ4lhVhnnaO0Lo7mU5omhR14mxQebmrAerdz+8Fi3P017DzVgIdJEVuf2ZSKT75OXA1s0ERlMsY0MQWza2ZzYybstmH4/1hj/YDCzqU/BrduhUjYIymFlUuE3dR1isATBAl7qIT9W0E3w/61vw874imxK4EYeMvt/+7v6O3mfgHX1n2RGD5GjjfCPuUkYuAV/gq7H83LdDq96x6lnubXNUC5ZDugo/q7lYM3O1owqb386gPqwk5cFWxY5MycNPic+WMhdMJ+2mw1T7vCHjtrtzpy7mjCsqyKYViA+MVsjVNnePLkZq3Uat/EuamcE3lgWVrVanWsKHM4g4ccRY/5eRR2phlG0TF4q87E1bMMyNTsll2DXWDWsg7L7ZZ9DPfxDw9Pn8Tq7VbpOMYfaRlGxQIaYgByXA3LSrBPIPrhw4d/Hj36APxOwk4QAhL2YMZI2H/wTDqdAnDOaXCBHXU9YK3Tvhc6RTAR78WZ5qpMOpX4Vzq9Ph4Z9lS53LjwU9YIYrxhQyKWNQsYai/Ewibs0ZLBaUphPzn3pMsPDYk82TA4JcbkSatocIQ+xyz3e8LJ4QVUNPUhKOxAxTBiDDAMe8ngtOCgbgiKDZmgt8XheYapwwOqhnHWMjgWvyvShi/yLT4k+in/N2cfdfmHhJ0gBCTswYyRsIPUKm3Y0dgDFk7yOLsq63zTt63jPa59NBODvv6lp0sMltinAB6JCXsfdoKYSNhwuLNtmiuMM22a6yxswt4EN27a6OSz3I3bTdie8iPb5klzG2gIRy+VSh5hBzrNCmzE8Wmp1PEIO1Bqolq38SE+YY/BMeOA18Orc260nNt22tzCM0LYgVK7wl1eHR5QFd8871RA2BswSniMDRwJTy/iJU2msJf3oNp89P379yDr74EPnyrs07n9x2u/HESA7PLyz7r+chmICHaeba7NP3snr1xfXt6KvNl/8jwXIYjJg4R9NIWdG7sU9qmgto5BXdi/COgTA+Dmf+m6LxKj9HUMjMSAsatdYiARA/BIzHchjsQQxETChkA6XzBNc8ORvoKZZ2ETdlDgyiyIsXTppmPYmaJRlCJbkuKLFL3CDmYcxTI5kPEJ+4lIxp87DylmwJ0VYbfEWQAL6idw1oZrnHNNKexnjMVA4MsBw6tygefRl3pdzbBbfHRAm/8LgMJ2zoM2uAz703u64DbsL+pdxLm084vFNxHBb7peeKJz3kYIYuIgYR85Yf8B2zqqk065sfMKNsD1GABTVvqwo6tjlb3vCjtmYj6aiPkiMBIDiEQMN/YboV/plCAmEjZ4YiZn1XHbB2b2TuiEvSbTLiX4FGbdwd4w9cuFvSXN+DBI2C0GdIyi5yF2V9jbR6e1Tre9u6yYY7VdPsdwhL2CdXJleCjsmaDBda+NFeEGKlvbHmIDE/bfuKu/2F/T78HBy/n527r+fH5+/pcI8BrOPYZTur6L196Hq3++r7+KEMTEQcI+csIOvu5b6RR9XV03SRDQJQatvf8Q+zXcyrspJXZArbELW1ciMWPSh50gJhI2BPL5jaxpFvi9U1nzAQudsEMBepYBp0KeG+DHTRsAf7cuF/Yl+c1ykLDXZeCGb/EhKOyIjZJe9HSraWNUJ4FRdPHYljI8Key2OjikJB56BEP6XF1iQNBNce3mxQz7pq5n4WNZ11+4cs/PptMRgpg4SNhHUNjlpNMb7qRTwcV1k9yVk8TLwc2bY/68zwq7vA//6TnnFIVdLbBjW0dh7CTsBBE22HCIrjhtHQ/MXCx8wt6RMfKycOljw6V5ubDDN4QS14OE/VD+fUB5iCvslU6DOXjaOzbwFpaIspTxsGJUlOFJYbd6CXtdfLUE3v+ZhH0Faug9J51CQV183tMXu8K+EyGICYWEfSSF3ROJuS5Qu8SgsAdX2JUW7LjTT2NHjlphv6a2YcdJp6js47TSKUFMJGxYHJhmgs84Te8BWTO7t6exsNCSLn0CLi0s2bYk9T6F/SYKu/uQqtIlBvHUyU/xXE3ctoyH50YxYHhVeVoZHB5UeDCmxC6QmPMwCGFHP9/uJew7uv5Q7LzQ9Rkp7JsRgphUSNhHUti/9wm7OucUCIiww1ux6m6gpd+lk2Rb9+A5p2pbRwzF+Ers4OtUYSeI8MGGxQLvDjNjephhYQHXRaoLlz5zpniKHzY4YbflvNT6pcLu1syXRI2+DIdYYVeGh20dAweHNXrQ/gZjQ590ii6+20vY3+j6M7HzStcXHGGn8DoxwZCwj6SwQ4X9W0GPto4gx0qGHfxZ7RHDP/sHhd3fJ+YLZeEkt8SuRNixS4zw9TAvnEQQEwkbFpCJ2WXTOQfQ9VxumoUF8OITnHyqREwGJ+yW1GbrcmFP4H5JSH5ZHkYNo6MM71Jhh9E0z7nnq8QGLuwYU+/Zh31V13Ni5xmU4aWwU0NHYnIhYR85Yf+h29YRTFdm2DESAyiZGHjhwkkIqrVHtvurseMuoCRikIsVdjfDzqFIDEGEEzZoNFzflEdiBOHLsB/JWZ3nwqWjRaOI/1UDFPayE0yJVS4Xdri/ocl2k7KtY5SJ2vqSMrwgYa8Y5/58vjR8BW3OJcICgEbs0U8W9l91fa+XsC9g+8aXuv5aCvtGhCAmlX/ZO7fWJoIojuMFr330bSYxlQx0C26UtKWGJcEWvGCtseKtolYFbyDoSxFEBF8K4pPiewtenryhX8Pv5JnJHHf3dL2kG3Q3/n/tbnbTbmbwxV8P/zkDYS+csJOvuwr7yC8iMesK7OmNTnmjI27zMoASu1x06o50hZ0m5X1dGLtfczqCCjsAZUMNmNqhuUalXrtCndgXVFmFXZFEP1f1j77F4ip58opS9Vdf7g9K2H1S/s2zFRLoXwo7Z9ffjapZ+weEF/Z3Wq2Qxo+K6WUJ+yOawGzijxGCbvvn7ZEjX0frfQr7gm0Ek+SYl3NiXxAcdBfzVIaHsIP/Hgh7AYXdKbv39UQfdgv3YXdYWZaJGIZ7MuZq68iPc8YmiYywc4WdJpjaOImFHRl2AEqIUoMWduZYpbzC/nw/8+RHVfq+PUlhdy0XmftC2J1LM4+ksDvhJv6kwl576ifwtO6EnedzWMnpSWH3v058jKv179RGqB1xfOtL2KnVervi8FH2s0Fwll64O0yVXrpB0IGwAwBhL6KwJ/uws7BziD2zxL7JHjLE7k5MPmuXGfbeYOzrXtndtIg4w+593Sk7MuwAlBA1YOpnjx1yTE2rpLCfUqXioXPgh16/66verQ+vF/YHUthX/fNrPQtnvri7WRZ29+g7eubR455fr9qXJK5JI6Mf9Vq017yBvySD58q9nJ4UdrX2KCnsb3hDpn6pj37uQ9iZG0HQXCQpv+i9fZHs/Ey1wtn1093KlSZF1yHsAEDYCyfse3obJxGUYedFp6Kto0jESFvnV0e+FLtYdhpDI8oSOxfYpbHvRIUdgJKiBs9Et9Go1lS5qa+sriTu1L6Hq6/2qYEz69z+sRvi1+i11cc1LpmTcj94vVbrc3oc97lfVxui7k71/oR9XycIgijyhXbiaOCwl1X3Mzqa4xB2ACDshRP2n7Z1dMrOvs4kAjH2YF/3q0TtOf+CU1+wl7bObGEyujoS3tex6BSAEqLAv4R3PO0DL+wbZc3W2nPRh7DzulMiuutvuzfaAdGz+XOB5aavuB+AsIP/GQh7oYVdZtizS+zZGXZn3Hn3OY2bsa9js2jsuDXVJmZbLOyciEEkBoDSocC/Yu3Dk1FVe2nj7X9L2McePKH0zINBCfv75eVqRfBieakiWby1MDleyaR64hQFZAAAEPYCC/vIjjgSIyrsVo/FVqcuUp7OxIhFp3lSMXHF3uPHE11i0n3YCefrcYl9F4QdgHKhwL/iIUff9/01Yf/IPR3zCjsAAML+E4ZL2Hc5Xx/5gz7sZOyZfdi9X+cm1cs9uw+7nYQXdk9mJGYHMuwAlA8F/hXP3vXax4yqPlnJI+xPXyo10Ap7156uLC9XKpeXD5BzUIUdAABhHw5h353sEpOusLMTxxH2rHWn7OrivCFX92eZhxGJmLhJDM0xsw87IjEAlBAF/hH2v5zZlVFVPpIZ9kblUrPZrcw1m9XK1eZJ2hiJMuwAAAj7MAl7YqdTLrDHxi4jMeTPEo6y5LB1gnWdX0WJXURiLHLfJPRhB6C8KAAg7AAUAAh7AYV9l/d1wkdiCFb27Aq7lHbOnBN5mzqKCDvrOn0zyZ1O7fxSXR3Z2H2XmD0QdgBKhAIAGXYACgCEvXjCvru30SlnYhLCLnc6pS/eNikp6766zqdc+NL6+khMnIkREXYZiSFjR1tHAEqKAgDCDkABgLAXT9g5E+N9XURiGFFgdw4tIzH5K+x8yK2TRISdK+wZvr4TGycBUF4UABB2AAoAhL2gws6JGFlh98aeqrCTPMtFpxxdz9WM3T3MR0aFXRj7ViZl7JxhL3uFffZTBi/1X2N8cm7hxF4NwN8Ewg4g7AAUAwh7AYXd+rqFdzrd5rvECGEn4l2T5L5J3tsHAkdi6JxdYnfYOWXsdLpz+48C+0iZhX3f4Sx0XzTCHu2jM3d0X9w+bRztszqDa2EYaUE3DA9lj0+0OuduawB+C4QdQNgBKAYQ9gIKuzf2RIldbHRKYiyaxLiSt1d1Jl4tmn+nU2HrIsPOyp5VYOedTneUvMKeS9g7wYwmFk1Ms6HXczUIujqDW6Fhbuh1jNmfTuk0DWOua4Ebn7mrc9EIgjkNhh8FAIQdgAIAYS+esO9O92HfKXY6TVXYkyl2hqvhcTf2XHBDR3fOrrCn2zpmb5xU9gx7LmEPTVNrJ8ytgwcPnus4/87w3ePGLOn1zNBvRxfn7txr0kVnWgvmDHFap2lIJefxiQsdQ0zqPNBnHddg+FEAQNgBKAAQ9uIJu6+w+xD7doto60iIro5cYU9IO+fP8686dd+yxO6+0sYufJ2Qwr67vG0dByPs9OpYahkTjmtJtrAfILu+qR0LWaVx0vi2MSLfPr20VNWCePy9Hb7cGBD2/wYFAIQdgAIAYS+ksI/86OvIGXaZifG+Lto6MvFORxtXdpGmEWtO6YjhDLvYOWk792EfhkWnfyLsE9PZt1LYiQlS7HP+eozny8Iu3iW5nuHrOynRd1ddY04eEwGYiQkdM+0f4PH9Q60fI43zpzEZ9+LfNCXs4xMaDCsKAAg7AAUAwl5IYSdf5wy7iMRk7pvky93JRIw7YvPOA9frUxF5l5vPbMTudV20YR9+YZ+8EFCl+9hkFC1qoutub1wmtY0iG2mJLrEwO87Qe5pYmg/pKrzQ1fpmRJetaD79rnP02IibLsZ+Nzqqp46GzrnvGXN2nP17nMapzrTNqb1RdFUTUy5/05qZ1jo1Pr07po9Gd/WhZkgjTs+0QxN2ro9pYiGK9l6L6KnTU9pSnWnZ2dy8rJlTUUBvRBE5/aVmSJftqxoMJQoACDsABQDCXkBht4kYsehUVNjjEjsju8Twl7P1POV1d+IQu1hzKkrsbOyyrSML+0iZdzr9nbDPmR4ne+HwqdA4woaeND1OeWH2UIm9QbprPK29uuOv0u/qG8Zc04wV/bbW86Z1yHhJb5lwTNOwJ7R2lfPzgR3MLzq9ZzyntRT20D46P08/m9eLgenRtlJ+3Ri+t5+xl2/C7+ydu08jVxSHlaTIs0w3d4yJxpLHhR2EQR5iGQIFYBsMRrwVkwXJwEoUG6QoDUmJtEq1UTqaSCloIqVJRYksIbtFFgUdQnLD/5BzztyTGV9m8RJDZE/ut4s9dx53Jptivz363TPS2L1pB4QTk0wKTRgxngErGoZ/B1iCN46adfXYq2YzajwN8VbrRyOYyPldq3XNo/O7a6Mn0MKu0QBa2N9CCIX9I4Iz7Fxg5xI74yuxK4EY+JGf/7q/o7+b+z08W2+LxOAzIv4I+8duIgZ+93mF/fd4PBOPx19//devg7RHMAV0dccZlqs5v4GvtS0HFDwZiVSroNbV6kS7sK9AYVykk7Bre3kWvmaEU82CPFe32/eii38pGGna867Or7h3HhKiiNotSNip4F1AYaeDyXlneQdOrrQJexmcnFw/BhtOBiP1B+XJJO5FYQemHWcOzV+IdTxl1LFhn5CMVOFYrlpNpOGU9WJxCL5SQhNCjKdmYHNrxnFmyhWDKG9JEkZfUb89PLy9maLtm8Pbe4cPDweNd8Gamupg9pF8/twI5DqPXPGwBpudSdSIq9ap8cQkTk8UYU+VgyiaGo1GC3sYhP1zaeyk6wCvOQ0usLOuB7zrtOsXnTKciPfjLnNVFp1K2t90+mGYMux//vkrvEHpu6+nfvjqq5/9wg6m7ghg0hX2RdlncYfWiKoZduIAD23KyvS34PeCM+zKXhBlUzA0TJCwj1doPB2LTQiRSeJuEnb3SVDY6f4F4U685d0/s3GAno3CDrafhoQN2HcEr7bJ0LdJ1IFSLDYWF9lYLA0DE/ReMJxhH8V5AAfvqgkhxlNTcCSbNHSYiNFHWDeHLq+6FfbBw8P6vxT2ONh67eLiXBX2TtMxF8bTcpWvKcK+NBzEmhnAy/Wy2YGF9fURZVfkxQveNbkGrHxhajShRQt7zwk7SK3Shp2NPeDFST5nV2UdP7q2dZ7jvQczMezrH/i6xHCJ/WMAIzFh6cP+M278KZRITAqDKkg8icI+gPVuGo5BbCVY2B1MuhSz2T0cLGD1moVd2QszCh/DKOjznFkXnF5fgSwMXUJqzsI+mR0XyBb4tNKHPWmSsK8JQd8bAlmiEvs2PiffrIhRnRkcFHd2MkLCwj4CFyzgY+zsjApNCDGemsLM6LeVjWWosu+5wl4uEHGjjwAfv60fN8HYrWBhx0jMcwv7j/l8wz++Y3fvNF3t7q5Vy+PVzy/s0/cIFvacvWZ2YM+2S8qub2zb+WcCpGJqNKFFC3tvCjsauxT2j4PaOgZ1YX8/oE8MwB//StfbIjFKX8egSAwau9olBhIxAEZiPun3SIwr7ID4pV3Yd1FfiSEU9lEw7RIBSfWFYGGfxCo2Edl/OeYXdmUvfKaFRxaT4/Po0MRqLHYgBKl2VnjdX6SwE2+Wd5L3hH34G0FT41eG/7mB9fskCXtREEWcxcHYzOSm/yG8LjEYwJmb0XGY0GI8NdJjBxyn6Ar7ktF3WLduAR2M/ShQ2C3rXWfqQtjP8/nHxVp4ugt5df4/EHYzrVB4JmHfWl2d18KuCTVa2HtO2D/nto7qolM0dqxgA6jHAJiy0oedXZ2r7F1X2DkT82Ai5v2ASAxBiRg09s9C86ZTV9h/T//QJuwvMZDOWyP44TESLOzzlFaJl6DJCuEJu7J3mMrfDGfYeZ8d8/jS7fEoABb2yEGOZmJhH9tGZpe/EYgMuXyJhXaEsjwLKOx7gkjhEXMtRuTKgvGEfdOdfmyoIjRhxHguSk6pb4X99eFhE7+nDg9vXGGP1m9umq8MwqoTluEtSr25qX/hVd/rOEbhP67XmzAFnAzDAK4vLlvXnrCf3V1dts6krTcaV/n8XaPRoB2Jc0Qeizcalcg5nBvhJ7huXV7dnXrCjkCN/YRmbVwbdHYFR9FzOLVxyjc5O2nAEOZRnoAPG6cNmDmNt2zAhA3g+j8U9oFqteCNVrWwa0KNFvaeE3bw9bY3nbKvq+9NIgK7xCh9HbtackqfcjalxA6oNXaydSUSE7I+7CDsyC+vpn7xCfsLFnaMpo/gh8dosLDbqMYJm2x3eNIv7MredVJjZoMq6fNcdQfX9lghYR8SgBT2L6k7pD23wsI+LDxQ2G0BTNClxDQuHt3GwjtRcf1/f2UshizGBcPCLiKz4zGiIDQhxHgmrBlnq1+F3apjZR2BTIwr7LewxbXyzCHBCj6Fx+ggYYGiE8d4IcIjleiVGzWXwi5gg8ZRHNGmt+j0R95ETsDk88SpO665o0absMN0pN6X+dpZnvBOxTvSTS7d4Y+G8gQEbLn3ucRbMrVnFnYVLeya/wta2HtQ2OWi08+8RafE/fcmeW9Oot8uXt6c8+ddVtjlPPjroTWnJOxqgZ3bOpKxh0nYv/76h0GfsG9hgpyYB2HHJElZeAQJ+2YMq9tQu87tx/EMT9jVvUVa+Qnw/EP0KQgw8bVt4oDatS9wf0USdgqpYyl+5G3CnhNAwtufg4lR2DcFUcCu78TCVo6XoiIs7ERmaT2JURxNCDGeh8ym4xRcYS9tlXb3+6tHTFOuNkXjtlzvvm02WbujzWaTMjOEkAfZ8fHkm+bNLQp8vdm8waPAlHGPFshv6+Iffb7EYasmffvu4gI2ry4uLq7Jya+urvzCDtt4Ku1IoFLf4UTXLOxyvlP5DTNfXqKwWzW8yRWdCpCMt/CEuPoE7mE8/aoGwp6GB8EDQOORwl6YnFubifwj7MuT09OTo7g1M4tfcu9siYQ95czPTcrpv3eQb98i7G+c6uLKrBZ4TYjQwt6Twu6LxHxIqF1iWNiDK+xKC3ba6LKxI6JW2N9T27DzolNW9jC+6ZSEnZj6yRP2CU6Bp2nRaQqtmnDm10SQsEdsEF7KpGRo6K+wq3uzZNsExdAXWNjxdmjpCLl2SRF2GI3TqPyQsFPMJiKQCnn3NkdkMJE/kx5aKdJgkncDLOy7KytxetQkRus14cN4BkaXt8C0ylESdsmI0UfcoI57GyjdAqIu8HW/S0zTra1n4KDlpmlu8YjVPPYtOrUMFfLsWoJq5yTs16Df8CcWJc/mDHvE8F1b8wv7GZwKBo0HsUQvvT36j7BbOK/Fwo7HMw33JhbdsyaFHc9tQHFefQL2+Qm833kXGfZVG1nMusL+xZpNVCOmOWwPm8y4vYjCvp21gez3JrJtI06wsI9mbSS7aWo0YUELe08K+6c+YVfXnBIBEXb4Uaz6n0BLt69Okm3dg9ecqm0dORTjK7GTr4epwv7VV/Bh/uIJe3xMrtOsuqF1m1LgpLW2CBD2DXyPKEg516WH3OjJLObQlb1UjOf6fSGJJW9P2EvcjkZQ25mcIuwFqdiZ7MPCvsaZmDmafpvy8EAKbrcgkrSclTu+bxQKFUFzvRR06qhAxrGtpCZ8GE+P5SDFKA2c0ujSJvp7r/1V9BBQP496pXYU9iPWd1XYBdTTec9r95wv3q1LzDl6tOfbYN9Chl/ufMLOKMJ+abiiPWAYaRwhd6TxERienZ3DrF6lvWVILuWUV+jkZOQJ/B8G/h70BFyIt7pYdFoEqR5axxYvtHvFtnPVKsj2ummu27Ypidj2CxB2YHp93Lbn3UvX1qbfJuybNpz1Au1/z9RoQoIW9p4Udqiwf0QEt3XkRadS2DkVo/aIwY/u4UiMnJd9XX1xEpfYlQg7d4khX+/7FyexsP+SPv7t1TFsCKaMjc1HtxblKtNlyKespt44VEenknmpmCB9n52d3d6h1HdRkNhPJhIFvAxf8z8D/r07oe6lrutzzsZCeQij7XKPQHK+6HgCDqbahJ12lTMLRRufLv12YV9IwpGRRAFf9JRACwdWUwtbSbiMXHxxJJPZt+mZs+4d3uAi1FHM2iSdiHgDIX5baEKI8QwsL5dnHGeL5naVc8JxZiyjb7jFJAxyw8JuSSc/VoSdKupN5MY1cxh2buvIiZiMfD3Suax2EyDcnYX9jq6k8PkEdmtHwMIbKOxMTXiSzlNI5752VRxFXfp7wBPg4a67xAzb9hLkV3Ik7Ojk42+g+UsO1XvXtr83XfZte5SEvQjyDsaeULrEqMKegHMKGLdBuddoQoIW9p4T9s+9to7gum6GnSMxgJKJgd/84iSG1don293V2HkTUBIxzP0Ku5dhR0IUifnrJ/z88+cf6Ns7vhNzWXNTLVV3JA15GLdKIMweuZQAtuUomYQPjJoDY+peqrwz0yaMWdhTbcnxOdDrNmGnGxM23jFY2IkyT58cdZ8qyY8ZEWIDB8R4Wgo7QDsHIETPLAtNCDGeh2gB2zp67PbVm5NAvjO8MUWfLOd1Rdhhg6HOMhZ+dhZ2tmRZ0D5HCfeodRZ2qs2fQUkdT/NosbBDaP3aq6obDKbeucW7HPK/HQKeAMS9W2H/VlbWS+73C9suU3zdtmfNBbLx1ZUZ03xp2xEU9kUTmIWyeQdh38XrkUWUe40mHGhh7zlhB1+nCvtnD0Ri1AI7Zdh9ys4dXdi1uy+xq4tO6cersHOJnXxdNXa55vSzUFTY2xEeu9g/MVuCYMobGo6R/75I42DDXbCZYiseH9oSCHv+eMVx1XwSF28qe5ECTI7YDg1Z2F+gPDO0OhWE/YAGKartR+ZiyEoaLsjhvkXhZwwj7kRqPIYMV4QgYS8s0oOux3E84Xp/spqGQVbeoTxGwi4Okq7ZbwpNGDGeAVb0uDf6Et+j1C9YTfR0/6LT24eEvVmXvEY/7yzsikhXQL9JoS8bkut3E3YLhZ2CMRd85ZmXYffdp8abUY7JVNwaPQw5THOiPgEf7k7Yi9LQv3CFfUWmYAYgxY6dY1ZMM2vnTHPaHqfy+wtp40sdhP0AKuvVanVoCAr4I6ZGEw60sPegsJOyS1/39WFHuA87gbKsJmIY7snYVVtHvtzL2AR3dfRn2HnVKem6T9jDkmFvR7TxTZratshRolDcyIhOJEZ2JzJ47fLAw3v3SqsjGfFoBgrFlABG9k3xMBvFDYGQsKdEZLNYEUxkZHf027gIJL63ubukF5yGFeO5GHGcBW+05zhfGn0DCPsxZ2MMr8J+DFl2VdiPcJ8VpV8WRWJuHhL2KCA3L6Swn5F+Z8iOLZdHVNg53sKXsbADqrBzzZzvSUN+lKjyBN0LOzt2gTZcYR+2s6YcTqO+j5tLFEPPYaZ9T9r5sm3vdxD2NdujaGo04UALey8Ku78POws7h9gDS+zv4Y8aYqcPomtrVzPs7s3Y16Wy02MBXoZd+jope79n2NNHR7/d+3UkmOzYtEASyRC0NwRh168u1bgYzwVkYireaAn1vW84wjq5bP0iF5tKS3+lCvsXnpBLxb+13i7sERvYNbisXZFezvLMPKrCforVcqKzsHOG/RyvpJA6F/uVJwgW9vyjhX2bq+Vul5hxKKfL4TAFYwYO7Ky9WsE6PLV1fEdhn7Ptl4xedaoJC1rYe07YP3dfnARAhp0XnSptHZVEjGrr/E10l2JXlp0SLO1qib2twO7vEhOGCnsHFiGBEhfiTRYbuvQ7Wtg1zNMLu5wxWqJIjCV3zjiOMPoGC0Q96mp53RX2OjePUYQdT+WdFnd5dEdRPt5UhL1scJW7RRLt6vclriAlosajKuxRyJzzH3onYb+SN6m5U+fdYQJUPegJlJlacJ/HCTtl10d9FfZpqrDzcAMODttle24XTPxRwl4F1Tc1mpChhb3nhP2tbR1J2dnXGV8gBn/Y111NJ9HufsGpLNj7UVecEgFdHQHp6/2+6LQD+5jxzo3F6CVH/Y4Wdg3z5BYddYop04pWthwHxXS3vGda4huw902jf8AQ+82gdQQyLuS7kI5pZ1Ptw05bt1/AJa9vDvk1qHULhrd1g8Bro6qwEzXMslgt2Sb9RDZRPG2xNivCbgVX2Om82ikOr/KdhP2U3o4abclzYFQ7MdI1nEd9AlXY6T5XJ9bjhH3ftlfxewMNnUT7G7kWdZLq7JN2Dj534PMdhH3mnwOzmLTRaEKGFvaeFnY1wx5cYg/OsJNxd/ueU68Z+z3eVxo7Yq9JF+nrLOyciOnvSEwnCnaMWAlBN3It7BrmGYSdmTFhWOZRKWr0EYO3hy51g4SdGVSFnY/S+e4RHtb5TOK1KuwYPmfO3a7qQA1+AoR9wNfARamwU92c6SDsmFaXnJCRM5dG0BMoMwl+gEcI+4Ltvh1p0hV2x7YPcLjjrkWdxlcoUSB9rYOws/1vm8QIZeCJiKnRhAQt7D0r7LKtI0mvUmFHPVZedUqR8vZMTBeLThm+2qvYS+T9lC4xbX3YEfJ1r8T+SYiFXYhvS9vOfigWX0Y2NjJCo0GMJ8ZannGI0QwOC3JU6CtftyzhSvqRVPJbV8MHjQBhZyXnkvorV/ZvpuRcdRq/VjPsJNwILQBFfqzliYtEoLAzbRX2CT4Tqd11EHaScuQywkZOsn8VNYKeQJ3ppPUoYefwymTC3JVOHsnCfz4FZXIJt1BuL5tb8Ol0EHa2/+zLvb03bruZFfge2BqeNjWakKCFvReF/RPy9c8692HHGntgH3bp193j7+Ue3IcdH0IKuyQwEvNRuDPsGk04MZ6e9EIqFfFSIDBK9NFLkziPHn19NOjf0T5sUnKdGTw+eu0dhUvrxzxkZOMVZd/p9an/npmz87OT4MfpsDdydn0WMd4FuOdZ2reqNH19lvEeiJ/gIR4l7Hug6Db+2LR7Bkc4LNP1sBEx/4DPb1Vhp1MZnnGbRouwVcnxRHOmRhMStLD3oLB/6u8S015hZyf2IuxB607Z1ZXPf+nq9KnmYZREjNckBp4xsA972CMxGk0oMTSPhfs99hKW8VhY2IPpXtiZvb/ZO5cVJ4IoDOMFNZqlu0q8kYARkhGiA63gbRZGHDVGFFGMguDozgsEQURwKbpR3CvqUlyIr+CbCD6Gp0/qpDsnpUymEqnq/F/SHV1ME2b1zc9f55xsEJ0T1rqXWd5PDCP0Q+zbMuxRhH15QthHKXpykoWd2HO3wVzuVQEoCBD2YIU9t+lUAvbM2HUlhvxZI1UWD1snRNftp4rYVSWG0XuTCjKHHYCFxIApqa2sPEoPpZr48RX2r4PBRIX87eCOtpDeg0N5g19bo5/359CdXu9KtwpAYYCwByjsO62vE7YSw4ix64TdJe3SOSe8hzrqCjuzmd5CftNp+v3GpjqKsdspMbsh7ABEhAHTUXv1hHlk4mfjwg4AgLD/hSIJ+67holPpxOSEXW86pZesTcrLuk3X5eaFjdYnKzFZJ0ZV2HUlhox9AcY6AlBMDJgSFvZfRfB1Evbf/gl7N731BwM6Ijo4TM5BCTsAAMJeCGGXToz1dVWJEVTAzg6tKzH+CbtcenWSqrBLwu7w9dJiLE4CoJgYMB3RnZ+dLbrDvlS92W53q6vt9p7q7TY10hPqsAMAIOzFEXZpxOiE3Rp7lrCzretDp/Qan++y8XRdLkfCrox9qzBm7NJhR8IOQIQYAGOHsAMQABD2AIU99fUU2XS6zU6JUcJOZFuT9N4k6+0zQSoxdHdH7Ez6nRybTkvbRwF7GcIOQGQYANBhByAAIOwBCrs19lzErhadkhirITEceVtVF7LTov6bTpWtqw67KLsrYJdNpzuQsAMQHwYACDsAAQBhD0/Yd43PYS/pTaf5hD3fYhckDc+msXshAx357k7YLdbX3YuT0GEHIEIMABB2AAIAwh6esNuE3ZbYWXrVWEdCTXWUhD0n7dI/9z91ym8dsfNr3NiVrxNa2HdhrCMAUWEAgLADEAAQ9iCFvTya6ygddt2Jsb6uxjoK2aYjH2XnZwjqzCldGdJhV5uTtsscdhw6BSBSDAAQdgACAMIepLCTr0uHXVVinHuTbNydb8TwlZm3D5LXy9MZ7s07B7FbXVdj2CHsAMSIAQDCDkAAQNgDFPa0EaMOnaqEPYvYBT0lRl5s6z7xOt+kxK7OnKqIXYxdj3UUYS9j0ykAkWEAgLADEAAQ9mCFfQdTGi1OUnPYLbmIXRVi6LL3Dc93zE9z1+jFSVKJSb9jSr7CXho2YuiNhB2AqDAAQNgBCAAIe3DCvjt36LREyJlTd8Auuu7Ydeq96FSQRnye4TFXdejUMr7pdDs67ABEiwEAwg5AAEDYgxN2klo1hl2M3bE4KefsWtb55mvr8oxN/+zEiK9vyU2JkYi9RKSVGMxhByBCDAAQdgACAMIeprCnxm6FveQa6+iawr7ZMSeGkNuGdH2sEqPmOjorMWTsekpM2ohhXy/vRCUGgLgwc6C2Tz123z6zKHx4lvLc+HL6y2vjxfMvX/abDAg7AKEDYQ9O2HfLWEd96HQb6zobe6rHBJmymsMuri4pu3/Czihb142YzY5KDMONmNTYy/FvOl15+knx8+PByvTcWu4dxV8UIBbMrNl783YnSTq9vrHsuXqJ/r/WNQvBm2bKB+PLw+Yb48WLZvMRfXx+OeLVzIV9qeditQoAgLAXQdjJ18c2nYqv671JjHNKjJrr6HXklO/2aSpiJ3TGzrauKjFFmcP+8/gkrytTsvduq57SWK2sm3utBt1PtC5WAPjvmFlzPrHctHbXSZjzZhGovX/37nRIwv64OeL5zIX9StvF9SoAAMJeDGG3h07L2aFTZnJvUrY5id4qYKdL+ueeCbt9Dr/cCTvDwq4DdhnryMYetbCvHHfwo7I+TjbO8OdSqy5cq6yXC/UW3Vv1dmXEUoOMH4C5Mw9h7yzf6d+4Spp+3xDdVN3v9w/fXgxhNzVjXgUm7N+/DTkwD2E/OwGEHQAIe4GEPVeJ2c7oKTEi7O6EXY1g5394DnZkVMK+SY9hl0OnouxF2nR6wEPYxbarxyhbT04d7rXJ2DuVdeEU9hv1+rkKAP8BM2v22WZMkqwaYi3p9K3JLgqhCftT+f3PQ9irRxTnIewAQNgLJOx/2DublkaSMI6zy7Lvx711dSaKgXQgcSQabG3i20EHX6IOjo5BnVGILyBoDiIsspCLIHoZ8b6yiqfVBZmvsJ9r//WkHrtT2xrZJLMxqZ+m20qqu/Uy/ObhX0/9FBB2fc0pERJhx0uz6odAS61bJ6m27uFrTvW2jhyKCZTYyddfeIW9HsKeicWyvUKyE4sNiGdhhN3wv2I1ipybwzHiuttWSzFWLB5bxFGx2IFT5/nZzc31b2Nhwv77+QWdz89VHuVi5P7m7pBnxovF4u+PCvt+8f6+uM+PxVPOzvE8IM7PTyx68rl86iHucXh3c3alpgpMHTnShZ04LhbFcfHmvhg1wm4wNBtG2JtS2FFh/554pK0j5FjLsMOf9R4x8lwPOBIDcGBf1zdO4hK7FmHnLjHk6y9546TnCHtvf/iQbXvDr6s7sVhClOnvFUHi6n11qirsiV5hMDQMq0F0TbhrOPW5bsJqKTqSyV8t4iaZjMLJk2X2LkOEfU/NTSZHSKXPksRZlGfiuseE/WaP5pZvexF8yH4y+ZsFDpPJC5x+Te7d0afXNLWzRINfw4QdFo9vUBJG2A2GJsMIe9MJ+y8PbR1huirDzpEYoGVi8M0bJzGs1gHZrq3Gzj8CLRHD6BX24MZJknaIxPQtQcKzE32etyzALA03VmDXnocEjOflxUwstqhmf0ylXguwNYNpqaG8AOPejnDTqRk4/Gg2hXfX40KECHvOk9d4HpQ+n07hx+wa3n3neR+F5L3nrQmDoT5YjaE/X15mmncnoh+mclNvW6ex430yKQLmfo6Q+PUI9Dh5UlXYb2HK13clqHV1YcdHt3f3OHaQosso+g2OY2HCjrtcyyOV/kt8IQv7b/tEnIQd/HqNw/kXE/bE/Mb0+O6BGs2+ebNsb2/MLeVoOPUmZ69MzEy//0DDhdHx8dGMrXDf5O3XO9Pj67O2wdAGGGFvOmGHr1OF/ecnIjF6gR0E+7DzRkfc5qUOJXZ90Sm9/Ao7l9jJ13VjV2tOf27pCvtUrMx0LNaHYSYVI1Ldok99khOLCMIMiyDzmEa8x2AgNjODH2fEsqPeza6IEGHfVZ++Em5MMSrEME7b8pZ4SEIYDPXBagCZhTXXdeelo0+5a5uuZOKV1SKcJpNXFHMp164vzuOqBH5dTdivIMtRpPxvoNbPEPYzeghdeVZW9CIeEirst4Lufkdv8v8jtC4xRSXsJyjC44ovJezLaYdYtIkDx1mbcyQ7Nhh3snkaeRh0LjlEIWITntOz60imbYOhDTDC3oTCTsqufD3Qh13CfdgJkmUtEcNwT8aa2jry5ZyxeayrYzDDzqtOSdcDwt7iGfZJ6equm8ZJCvsKTktr7hCMPRIpFODQhcKw6I6B9GK3YF7L8Q5dNS+FXeq74/YP4LLd+VGMHBEi7H2Fabh8oZDolaY/NdWDE+75hkx9FVcNC4OhTlj1p8uVTEUtIM091/d6E8dWWXUaTSZvyuXyveCfVEreVhF2TNkTFrjE8BnC3klnmoDKPL8bKuyUlCmb+j1Enabqwj5Cwg5vp0l7X0jYZz3HSY8WcNxkYR/COzNDznpZ2D3PyY5Pew4G7xwnW5BT37OwD2H2TNoIu6E9MMLejMIe7MPOws4h9tAS+1f00kLsdCBqtnY9w15+GPu6Unb6tYCfYVe+Tsre4hl2OLcrwGhZ2OdisYwASK3vCN+2M6rsnl6c5at2BViMyQkD+Kinl1akZuWfMOugLP9Uhj0jK/PAlQ+nuy2JrIzdGAz1wmoACwvzE667Ju+dg6nLc8Z1l60W4YxiKmMPJfX930bOzs72kqVqwi5j5mcSUn7QdXJy0mmFwrfD3C6rk4rnAGGWeJiwq/8y3NCxpKaysBePiLGysF+oD7+QsBfKtfVVaHlECbuTltdnMiTsGLqUlLHtLdj5J9teyTrOqhJ2x9vG+UPONhjaACPsTSfsv5Q3TgLIsPOiU62to5aI0W2dz0RtKXZt2SnB0q6X2CsK7MEuMa1fYe+GYwtJPCWF/ZUMttBwAN1gAra9+j7FfdhfUR0en4J+L+WQsC8JgPOykLxFif0pYe/D59L8ExsbGZwiuDekfVoYDHXDagzRyXJbx3nX/WCBXrmRUotwQb5cVDsRxeHLRDVhh2f7lKq3dbyn84j07kvOnOOhx2GLTrnGTxfe8FR/0WkXvh56PYK7LyXss44zbkuQbcmzsK/4n49zOR18dJx5G0w4zhsWdrNrqqGNMMLedML+aFtHUnb2dSYQiJEv9nW1ShTHOiw4VQX7IPqKUyKkqyNQvv7yF53+cQiusL3p4efBvw4HB/+48oV9Uxo00QNhl6Xv8RyBgvdspW1/2JkmaXcSctquYEjUV3DqJ/knnFjqyS4xuFFqeqJbEJTLMQF2Q32xGgVSMHEU2103QsMJd9NqFciJuZJ9j1TL2UixWKoq7EdIjhcVV1YV+MoRqeinfMdzKHoVYefq/fkjXWI6v6iwb6NqXigUenpmYOFK2N/ZPuMBfUcihs6vkGJXwp61DYb2wQh7Uwu7nmEPL7GHZ9jJuGvc55S/cWBCK+xfS13HN+BMjC/snIh56ZGYq5Ox3pPLwePjo6PBwc6/B/f/ZmGnFMvCw099OATo02wbDC/RXqdvZHSdoQy7AK+p0E7MQfefEvY8jB0M9KwK4j0GC8JgqB9Wo0BDx1nZJcbtVcI+b7UKCJSM7ascOs43VL1+Stg7aHIHhWi61FcVuFB+J/M3xzJ6zvV2X9ivQivsONLUphB21/F5r4R9vVLYbSbteDbBVXnPhNcNbYUR9qYVdhj7QyRGq7BLPda2OqVIeWUmptZFp4Cv9iv2CvU8rUtMZR92QL7ul9h/fNHCPjh4eCJTMH8Mgr/3r2ig+PggyrswdBwCZNi2P62vbwtFTqZhRulDBsLuCDAsXb7MOFaTPtmHPfJmKEZMChD38NOQMBjqh9UokIlZtazX0Ha1EHXBahXgz+fw4ZMHaQZRP+bSqVxexcrBEWfYMQrSgTz7yGPCvsfN3hG7oZYx5bh6Fy5T/l4ME/ZbNfr1ecL+cWPjYwOFfd1xenYU20rYcxXCnrWZIf7Zc9Lq3GMbDO2DEfZmFPYfydd/fkYfdhh7aB925de1E+zlHt6HXf4SStgVoZGY71sgwy6FffAYxXWwL/4ICPvaw1LPGSnsUxWlc7bt2Zg8EZR174W1u4JYzr+Vwp4VIOFPQ6Cm6sZJ/W/fp1QWfiMmWRcGQ92w6o26YzRHkRjhuhkLbLnuW6tlgBpzQf2U5ZmFPSjmbM/XZWG/l7F3IvqcPuyX5dr8bXkkyqMS94MBpTBhv8ObNPV5wu6ABgr7POXSAxzQG6HCPu5X2JeMsBvaECPsTSjsPwW7xFRW2NmJ/Qh72LpTdnXt+B9dnY56HkZLxPhNYvA7hvZhf/mRGBJ2eew9+Tw4eCk+B4R9mHPnvbTotBvtXgThziwJtm2cUg/bmyJ9LheNztEojvh6nIRdTYsIySpE/Clh33z3Lo4TrTZ9RRH2gWXK4BgM9cKqM1F3qtvuiq6uueUMzJTrDuOf1gnXta2WYYT7mlM8pXREJuwL+y2yL8f7nWzqXfgQJ/LzvVOcj68h7tWFfe/E6sCtTsuB9JsOawyj35SpH1pR3DxE2DvVhc0h7JSAeaawF1Se/YPjjBphN7QhRtibVtgDO51ygd03dj0SA3/W4ShLDbYOWNfVWSuxa5EYQt83qYX6sJOwQ9M7Dwf/6ji69IWdjHtKgEJZmNGQcUuAZerzwradRmCFDJsaOU4ruwc5KqqzsC9xJgbt1jcqhX15cnJVnsrdItc5UoNcTIK0fVIsmmWnhvrRCGFnJmwMSdUn8HInrdZhP6n2HOV9RuXLF/bLJEFGTpSksJM9q8nPEHaeSon0aEmNSl3Ku9XHurCDOzX1WcLe1WBhT3iOF7GJSDVhR9591wYbmGKE3dCGGGFvQmH/Ufk6UJEYwMoeXmHXpZ0z56DWpo5ahJ11Hd9McKdT+ftVdHVkY1ddYn556cL+1+Xnv/YPB49PP9t/QdiZebmHUWZtTq0yXUABfbH7k+vIUjgtJ81NJcSWzK4sbvUnJpdiJPguTu5qJIf3F3xhn8Uw3ZeYHMJNEpXC7tGmpuITCvrzGdGHCW5EfPqo2j9SV3ZcNSMMhjpR93/hFyZcItNvEb3zZO8t04Vd0nXrp146fiV3vrj3hb3r8paEHfxOvr7PqfbLUtm0z8YexL/0mLDLdu20NapE4CngrDzqupaD+0PEZgLCfiuFnRwd3IZ0iaFa/1iFsA/D18cb2Yc95zjpA5zzM141YY/I3ZXoimzCCLuhDTHC3nzC/lN5o1POxASEXd/pFF+8bVJQ1lV1nQ81oUrr/47E+JkYLcKuR2Jg7K3R1lFV2C/j8aPBPzA8PfKFnfLjBFT8A4YFNeTSOsjRTkcMpdfjaR71CF/YYf+KVEaECjtG4JV4F2MWaBlrLz5awWfzwmCoD1b96Z3t7o5E/XF0tjvRKtucKir+nM7Dq07rMToursYqx78fnmi3evTa08MOixGXvx9F/WeeHsbDfymco5f4hZ7HDoR9q3HCDmbwBC+LQxVhBxNylufIGUbYDW2IEfbmE3bOxChf1yIxjFZgJ4fWIzG1V9j5pW+dpEfYiXKGXY+wt8jGSfHPkHW8GBr9IXw2szBlL4ei+ScaDpBxf+wVYDlbFnaxyoqdzgtiMUXTJgQYeOjw0j1UnrQqAAv7HI6e6tw+P0DCLnZxOcjmRQSnt0Li4n4mFGOoE5ahnZlznJlGtnUEE54jGdql0Wtd2IcCowxNzW7bLOwF22BoH4ywN6mwcyJGr7ArY6+osEOe9UWnHF2vqRk7XcyvkAq7ZuzfMBXGzhn2l15hFxchG50eiwpWYOcwcjVKTE4t9wudxPD8zkR+VjwQyWTIyzWWp5bFM4hv5TffvhIGQ0Mwwt7eROHH3f9d2P88OIjYGp8OPtgaKwu5/Ir9LLY2N7ttg6E9McLehMIufV3CO51+q7rEaMIO/F2T9H2TlLfXBY7E4BheYifk7xSy0+kP3z0U2H9+0cIuOo40jgM67g2M0zmRQmMXg6FlsAxtTLfjFP7DVcapDQbbNsL+CC0l7MrYAyV2baNTiLHWJIZK3krVGX+1aO07nbKth2bYWdlDC+y80+n3L73C/jRzWF0aF+KTJxuyGwwtg2Uw1FRhn5WH1YMDVNIPXsM5UGE3GAxG2FtC2H+q7MP+g77TabDCHkyxM1wN97ux1wQ3dMTrqQo7UL4evnHSS8+wV2FbJtGzAzgOxIXB0DJYBkMNGfZuO59Oz9pT6XTEXktP27aLDLvBYDDC3hLCThV2FnboOtDaOgKtqyNX2APSzvnz2led0rdeYqevSmPXfB3owv7Ty23rWI1JJ0a8M+s9Da3EP+ydMU7DQBBF5SBBHLlMtwXn4AZ0XAHRcf8LsMzm481kCZJdMF6/l8SlpXRPoz9/EgDCDhAAhD2ksE8/vY7KsPtMTPF1V+soqktHy5XdpWnczmn+zSjD7i4nPamHvYul0z95f/t4+WT/E/oiAZBhBwgAwh5S2LOvK8PuIjHtu0mDfepEjP1m816D5vV6u2G5+WYRe9F1X8O+A2EH6JAEgLADBABhb/P8Kv6pJcYtnboJ+zxiF74lRh/Z+uLxuj0UYnc7p27ELmP3tY4S9mnLl04BdkkCQNgBAoCwhxX2o6EMuwbsGrGLasTuAjFFt3X3aBF1m/sNB1/DrlbHYux1hH0siZj8ZcIOsCkSAMIOEACEPZywn6ul0zGjndP2gF263rh1uvrQqVAivqasufql08L1pdOnvWTYATokASDsAAFA2MMJe5ZaV8MuY28cTqqc3cu6Pdbaut4x3M3EyNcfqpYYjdjHzHckpvMedoA+SQAIO0AAEPaYwm7GXoR9bNU6tlrYD42emIweCxgqac+4XkcfiVGvo2+JOZYJe/5PJyIxANsiASDsAAFA2MMJ+1m1jn7p9NF0vdQ6lkxMNmXXwy5XrxZPVzEoE3M3EXNoRGKMSyJmPE69XzoF6JMEgLADBABhDyfsp9P1pVP5ur+bZDRbYlyv4/KVUz3L2/yIXVQzdrN1F4nZTQ87QIckAIQdIAAIe0BhvyydTvPSqXF7N2m+nGTfwpw3V/585YS9vMc+v+6cStj9gF21jmbsCDvA1kgACPsXe2fw2jQYBXD0oqJHb9+iWelhOXzoUIaBMaiFbmWbg4niHG7Tg3gRtpwGRQq9DIo9hbHrhGW9tZZ66sFD7wP/JN/3klc+vqbKmlab9v1Yk74kzZfjb4/3XhhmAmBhn0hh10pibiHmlBgS9vgMuzGCHb8kHOyIGBn2G+YYdmo6JWWfrTedMswUIsZA1ub/AzQy5WYQXFB0nPNFQuaD4EQLF0qKnPgTLOwMM/GwsE+ksN/VhN3sOUViStjhY1h1r6Al4auT8Bt+zJ5Tc6yj0XVKKXb0dc6wM0z6EKPm4e7+muuube9htLTf47GYTS6kokRhTR6KhFSlvNDCjFRUxDBk83l7eGF/tB3HhsUwDAv7tAg7ZNhvIwPGOoIcGzXs4M/mjBi1Tw4JO82JIV83X5xEKXajhJ2mxKCv84uTGCZliFGz7kbsqmjf7bEuZpIFJdO12vn4hN32fb8ypLDPFwqXwwv7yydxvLFMHmx/3tn5YDEMw8KeKmG/3xvrCKYb1bBTSQxg1MTAH704iSC11mQ7WY6dvgJGRQzRn2HXatgBLolhmHQiRs362tLB3ttXkGX/BNHBesiW6z4QM8k3KT09vghyIxR2ov2/hH21j35hP1hxgBWLYRgW9iGE3Yj/7ZQYzLDf+0NJTF+CXfm6puw00YVcO3mK3Ww6xQ9l2PWmU/B109ijntN7nGFnmLQhRo0tkIeuuyF6ZNfcfTGbnEt5YhyaHGHPJhZ266nBer+wb4Ktv1l8bzEMw8KeMmFHZQ99XZ/DrqA57AjKslERQ9BMxkRjHennVGMzaKqjXsNOXaeo65qwcw07w6QQMS623C3R453rTlUJ+4lXa5RyGYHk/Vq95s8LxYLnVTN+qd4Mz5U9ry1lzvO849DefeBCy7bXg2O77FeVhfu+LYAvfllEvz2FdeptT905A2vUg3K+J+xfcrDmXLywV70SXJulsAzL2yKGn51Ot1D40QHCpz/qdLL2Weuq9ROCsw5sgcvOEe6zZ92rH92jIYTdcTYthmFY2NMo7PocdhJ2KmKPTbHfwI9RxI4bJLG1mzXs4WLk65Gy42MBeg07+joqO9ewM0wKEWPBzKlvuO4UDY6xmzIELfxUIoffUHml9A4xxrQ6ftWaTsMr6TYlDAMpy0qrpUTJh3uL6NpaTirqmKbXFqnCKQwrmThh9yTSUG5ND5EXMfwo9AjdvFMo5MMYfgsqLwDYdwWQ/1VALq8t7HuOU7QYhmFhT52w3w9fnARADTs1nRpjHY2KGNPWaY8kq2I32k4RknYzxU4JdtPY73CGnWFSihgPz3axy5QiVR8zPZSUgOdKh/I8VHTZbtZRijGCMKjARgC5Wq0B19ao6bRWgl+RsDdBwAMw74HCXoG/dkMJu69umlPrVlHYcU11OkbYc1Kpfh1OZv8i7JetFjj7VQvIk7D/ggNXMcI+V4AT3RZsz64l7EvF4nPHeVEsFrcs5NXz1dXnS3R6Aw6/W3uxuXNgMcysw8I+ccI+cKwjKjv5OqEVxNzUfD3UdBTt5A2nUcJex+w4RWKmOgKRr3PTKcOkEDEGll6p4TDbtiBeuu6emBpOo9S23TxWDh76tidlEAk7HLVBppUuw4dEvG9KzDz4OnjyySBhp4R6tQxL+gvRykEk7Odw87aUp33CfoRPhw/kG8L+p6ZTEvZCy4Y7X86bwt5SF+L1Bfs6wv7GIVZUmInijw8sZNVZ2cUDyxbDzDos7BMt7GYNe3yKPb6GHY074XtO6Q82fdw0BjuqWZMhWs8p0BsSk+6SmPz3GPy5/8qzhwtzDDNWxOjJuooNW69nXxPTQ53aSCkRTloc6nI9Kks5EshAYfdB1PHAYGH/KgwqsqGEHdfEfalP2IPo6eakbAwh7L9EiCHsNuTXMepC+cx1hH1rcREc/cniYth0+hrE/ePHZcfZIWFfXnZWVjeXHYthfrN3Lj1tXFEcVx9SmzbL7uYOmMhX8liKTWRiMa5lQyMVEM8SQQMRj4AESaRIhkWEFKFIbJAQ2RShbINEklXbRGk3XWTRT5CP1HPOnYPHN9e8TBQzPT/KDDO+vjO7/HT6v+f+3xFhb1thB2M/isRYFXbUY2urU4qUN2ZiWlp0yrD1c8U+Inqe1SWmoQ87gr4ei8R8d4mF/Vq/C8XM5AJ1oQzmiFL1ztKscjJS0rqkjmM8l1tUgtAK3idgampyMAwXFF/PJ6sJey0yYd616E8W5QwJez9e7V6/vtlc2PkLXTS0mbDTQGbtaT8Ea2rk5Tv4TH4TW9ghgvPyGVLjidZ2dna80wr7K7ew74DKvwUwQ/PPGTPs94NgsP5n9Tffn6sEwXwk7EEQwnlCUu6CIMLejsL+Hfn61VP0YQdjd/Zhj/y6deK93N192PElWNgNzkjMt5c8w36CsI/qnPqImaCgzsuQrrOSdQzI5rS2Hmrzq9Z9H7/GQhBMKEE4Hd6nITVsYuu85DTrJYYURMQb2qzv8VLPbRJ2KptvcFqlubC/i4R6s6mwv/aYzJPrBhb29UjOa5awo8TXSXnMqYV9zS3sr36u8/b8wn4vCCbxPMjrUAew1i4Iggh7mwr79/EuMY0VdnbieoTdte6UXd06ntPV6WjnYaxETL1JDLyjsw/7ZY/EnEfYf4Gb54OEvQL/m3isQl4+5xwwMFVUzWFhx9ewvih1d+G0eJ+K1TDMeISCPLuXHK5RkJzZhTg5J1z2zyTsryMz327eJQZPLPe1Z9AdcouF/Wl9CkvYYeQ6kz67sGdcwk6fvP0n4v15hZ0SMXTuhBQ7C/ucLwiCCHtbC3tsp1MusNeNnSMxDltnOMrSgq0DrOt8tkrsViQGsfdNSkgf9hOEfX7xvrJoWdgfKmIVlN1RqR/TukMdhwi7cAF4n4qbYTjhEX1huOglCOwAg7Bur3NzlrUzCDtl10mo9xuF/ZlD2DEZT2O36hV2vrSFne6l6Qc4s7CnbGFPkbA/x+4wXhqAW+cX9gIvLg2CgUjYJbwuCCLs7Svs3xlfBzgSQ7Cx2xV2l7Rz5hxouamjHWEncGdVJr7TKb5fQ1dHNvaoS8wPCRX2ONkeOlmmnKWjfdnT67zNwk7MgbFPWgNI2Ovf8pWLk4W9Q1atCsfjfSqGsTMMLzlNeQli63qtLsMZ9uon4N+nFXbO0BzQ2XzlMEq9v3YI+2E0W8pEYnixaZpTM/x05J2VhKHeki8zZxf2D2aZ6RoJOx2JloS9GlR8ohwUuEuMLwiCCHubCvv3ZqNTzsTEhN3e6RR+eNukuKyb6jofWiMqrX8cialnYqwIuxWJQWNPQlvHE4T9UbkKx3J5dXYM14KGcFEtg2iXy6TdC9Wczg0sKOBuuZydvRHoTqVuj+LYgW4FzJXLI5M4qvqrQkjYeXKIx+C5915F62B6WIGEm8lDUP4Q/oQBNPmd8pgiRsvLRthjr0Gs4GUJh2XCMqZtRm8rQWiKd9FEM6bGORLTGYZFL0lQWxck1WUy4wrNF136TMK+abQ7vWW+cmBOt647hH03Kqmvs7DjM+khf7KUk/3TGBpLpE7uEpNGEXcLO3Rjx9NbGEHj+KN0C8I+UK+w3xFhFwQR9nYXds7EsK/bkRiDVWAnh7YjMa1X2PnX3jrJirBzhd3h61cSsnHSqTLsWt/IaWJGqegvUOPsmDb8BGPGtS7iR53o4QZU9D5QcW0Y9VWjsGc1zZ4va8OUUiVNTKveKs8yBEPKOlBESVeNsMdeg4iGl5Qa0BFFJQjN8C6YVDiS99Op+YWj4HoRszFJAp16L+Wl97demOz66y7v1h/k2ycLe5qEnRPoL3e2oSLOpl7bwXnckZitTZyqLuyvM952zYg494Y/XFvLmBbw6ymYb722bgm7C9zlNOUUdjL19KufjdLD+cMavP77v35uQdhXosj6YhD8JMIuCCLsl0LYORFjV9gjY2+osIM824tOObreUjN2+jL/OirslrF/zTQYO2fYE1FhP8xkejOZzE7/3/td6ppD2IHK0CBK8bxaXgFXXlmZVGoaBPnh5DJcLpGwY427mg1h1MBg+AucRlDYgcrDhRsk1w3CTnreozIg9NVw4Q4MGFZLKyWcfBWtv3RjYXIAHdwl7LHXIMKVMjxgZUkV4T2WigsFOClBcPMphJ0Z9M2NwXDcSxYvrgM12r2IBNlcbKVPFHYYyux4KNwIVdgp1ULUbGHnz2r0y8JurvvjzeGj633zIXC8sLOjE+8/FvZb5pMPUQ3+r5+ZFoQ9DIJHeF4OgkkRdkEQYW97YUdfR8jY0de5S0xc2In6rkn2vkmRt18IHImBo7vETuA7OXY6vfLNUYH96qUX9v43b/ZhB6X1/lsbP/646xT2GwoYoNA5h8e7QbR7FGXRc70o7LoEMZQsJ9NDuO4lYb+jgD64n7eEvap1N95ZVkCR1qByhr2ic514BvHusIT9+Az7DFXq6V3zShCa4F0w6anBkCj2esRsGN72EkU6vW3M+7XZociY9rNUVAt/EQn7gS3spM7MNg4Gy649gWjMIQnyHyTZsS4xLz2mi55R23/Hwr63FRk5k3pZ4xvXYFrk3eYphD396kMTYU8/J1/v4tDMq0jg/21B2DvKQbDq++NBUMmKsAuCCHvbC3tk7LESu7XRKYix1SSGSt6s6obYhket73SKszXNsLOyOwvsvNPpt0mosAO7+Mcb1SwSk8sq4C7ZNpsy1MTn8IyuvoAHuhyE7IsCSMdHUNhzPQp5CAVxS9hHtb6tSuj1AKr6xJGwF8ozih9yJmF/BIV2nK97eXlWCUITvIunZyKf70jUMtOPyRy82D/ycHXwYjN1zngNuX1k1juHB2mvCdc2Dq813jg8SDn+fTX2vvlidzt1pn+XXTdT7593eTG63j9/39XKolNqwI57m2KBXYRdEETY213Yv2/sw37F3uk0XmGPp9gZrobHurG3vnMSzdu8wh5v6+jeOCkpGfZd+kPtNRH2gkImKK7OplzRepwIsYg+HuXJZzDZQkxq/QiF/YYisjCLJewww0Sv1sE4cQfmY2EnMrOTcHVGYc/jitPp1Q4lCMfgCZ8T3vGUSHuXgxaE3S+WA6DywGdhr/qCIIiwt6mwmwo7h9hJeq22joDV1ZEr7DFpJ1FvUdm5Su8osdNPo7Fbvg7Ywv795W/raIT9sGfDLezTcLSFPafrFNQ4LTLlDAsyiwrfZ26b8aWPM+wQrInxqC7seeg4A5xR2OlMBEtZJQhuRNg/Iwd/PO3yUnvYLOZycSTsvz9+3OFb/PZ40T+W+6ureV8QBBH2yyHsV4/6OnKG3c7EGF+32joysZ2OWlF2moOx1pzCbx3OsFs7J33DfdgTs+jUCDuyt3Zr79zCPqKAAi4kJeYgHIPCHipDDr7Gws7TldRNHWP5SNgH8TJXuVM4s7Cr+8tljZQmlCA4EWH/jGxcN9SueZeLvAi3IPi+CHsTEibs4OucYbciMe59k0y5O56Iod+6ebcC1+t5doJy885G7EbX7TbsSRP2/v6NrtMKe0AWzYxHUZhptGmiiKP7yMIJrSuNwr6MRu9TZoZhYQfZ10so3I8ahT13orAT2akB6kojCE5E2D8jO2Zx6JMu75LRWGGfwMP848e+P/e4G5wDKuyCIIiwJ0PYMRFjLTq1Kuz1Ejtjd4nhH7L1VsrrdOAQu7Xm1Cqxs7HbbR1Z2K8mYadTEnbi1tPTCDt9pjvN7bGxkSNhH8IxAKn7Agp7SREjaNBxYe+GEn03OnhZEXfHxmZZ2GG2ezzJHPWMUUhenyjsS9Nm/gf4YEFwIsL+eeCFnre2L52tWxn2vH+3UJjwRwqFDn+hMOr7IWTYBUEQYU+SsH9LcIadC+xcYmdiJXYrEGN0m/c9Ohfxbu429sZJHInBd0TiEfYrJhED/yWkwv7jj3Dw904p7JOmYSN1UGRhN7XxvAK6NXZm7NNRJsYvw6i4sOM2SwMq8nqgpwTpdxb2e9HNuRzNNhpNPuoS9pvDw1lFM3ereoY+o3WgBMGJCLsgwi4I7YEIe9sJ+w+xRadXAF5z6i6ws6479jpteaNThhPxccwyV3vRqaFxp9NvEphh3+vZPljbPjESMwbSPUJBFV14kH2wAmbea4QdmYHLcGJ+CEMt0cZJMzezxYqmSjrc/mVoaOjRSoApczT7ThzQ1zFZgE8UC/sqfHgzkw8xJz/Vi/4eLHTchCEs7LHX0PhkSr2PrfZhhiaY6lGLoxi1EQQnIuyCZNgFoT0QYW87YQeptdqws7E7Nk6KObst63ho2dZ5ji+OzcSwr38V6xLDJfYrAEZiktKH/e+neHyzuwHnk4R9SQNjtBdSxLCqC3u2yndHe0nYmVyfQmGvM51VyAJflzoVC3sHT12mpah8mQtY2OuvwcJ+k6agSr4hJxsnCU0QYRdE2AWhPRBhb09hJ2M3wn7F1dbR1YX9S0efGIAP59L1hkiM1dfRFYlBY7e7xGAihnz96ncJiMTUcQr7igJY2P1RY8qqY5REunpbkbDDiXhId0uhUiTsQzMaKVDgPWQ5L8w8UBGLFY2MzSvFwq66y+Tcv6oSCDtcBmTv+aquUi19NvYaOnryTzmKrXdOa2JUfF1ohgi7IMIuCO2BCHvbCfsP3NbRXnSKxo4VbAD1GABTtvqws6tzlb3lCjtnYo5NxHzpiMQQlIhBY7+amJ1OG1GnJj8y7HitjuLdrCKorWPv7dVFdRy93at9vj1zcWoCPyr2ZcyD7vao09GzODXSJ13YheaIsAsi7ILQHoiwt52wg6837HTKvm7vm0Q4u8RYfR1bWnJKRzObXWIH7Bo72boViUlIH/b/2DuX1yaiKA7j+7l0d52ahCx6C4OGanEgVI2QpPQdqTaWplXBx0JoZyFCkEI3hWI2FulWobG7lpKusujCfcE/yTPnzkkmN1ON5sFMer6YuXM700nAzdfD755799On702vT517Pgo7wwQNwTAs7AwTAFjYAyjs7qLT6/VFp0jzvkn1nZPwn6KeN6f8eZsVdvUcfJ245pSEXS+wU1tHNPZQC3t3YWFnAopgGBZ2hgkALOyBFHZPJOYSoneJIWH3r7BrLdjxpM3GjohWYT+jt2GnRaek7P2002l3YWFnAopgGBZ2hgkALOyBFPZrHmHX15wiPhF2eGtWXQu0tLl1Ep7hm9D3TVJQhF3hKbGjr3OF/Q+wsDMBRTAMCzvDBAAW9kAKO1TYLyMntHUEOdYy7ODPeo8YZ2wfEvbGPjFnmzZOohK7FmGnLjHo62HeOKnb3H3+PIxfm+l3BMOwsDNMAGBhD5yw36i3dQTXVRl2isQAeibmXG3jJILU2iPb7dXY6RTQEjFEc4Xdk2EHOBLDMOFEMAwLO8MEABb2wAk7+DpW2K//IRLTVGBv3OiUNjqiNi8dKLHri07x3Vhhhy+lfF03dnfN6XWusDNM2BBdIB5pfGwkIk4VsElyVPydR+XP3ul+0SEMf0GxsDMMwMJ+An0l7KjsyteBhr6O1IcdQVnWEjEE9WRsq60j/TplbE7q6ujNsNOqU9R1j7Bzhp1hQojoNLcWlrKWlc0VhGLgjTOdGBCnh2+muUnn8Y2NQeHPillqnDo8Fv9D9HFU9ABd2G/n/JgwGIZhYe8TYff2YSdhpxC7b4n9DL61EDsekLatXc+wqw8jX3eVHb8W4M2wo6+jsnOGnWFCiOg045bLgpI7mhbEaSHuFfZV01xrTdh3trYq/yvs6fSh6AG6sD8Z9mPe0BnIvc/nXxod5GU+ZzBMn8HCHjhhv6E2TgIgw06LTrW2jloiRrd1GpH2UuzaslP/PjHnFFRg1439ClfYGSakiE4znh1ZLjyfg7L6W5jdhHFhpjACRfbTk4v5VC5H/13Y40JshU/YM000C/vyqARGjQ6SlE8NhukzWNgDJ+wntnVEZSdfJzyBGM/OScrRKRjT9oJTVbD3oq84RXy6OgKur/OiU4YJIaLTuF5+y7ImYChY1hsB5CxrRpxGWhd2EUphN+5qjDcL+yTY+nziBQs7w7Cwh1fY9Qy7f4ndP8OOxt3mPqeeZuxNnNUaO54nY6etTknYKRHDkRiGCR2iW0xb03B8aFl3hBqXRT+wYds36Txq25swfLS/idhaZbcME5htOcA9eMXeN82iDcQEMLhTruyV7I2asK/alYq96i/s0bXybtGuzdfgIRHhw+NqtZpO/6oC6kmRavVx/Ojn8eGPuBDb1SPh8AMuIkc/D49/HvVU2KWcdAYWdoZhYQ+nsIOx1yIxWoXd0WNtq1OMlDdmYtpadEqQ9VPF3sX9PK1LTGMfdgB9vV5iv8rCzjDhQnSJeNZaguGtZT0RwDvLWhT9wEfT/Ernn03zOwwVc/2riQhgF0bKsBfNGh+x2u6y5Qr77gpOv/sJ+1d1bYU+Dabqos6PdI2fqqifTm8f47xar727FyOHaeQg0jthL0g5xsLOMCzsoRT2q+jr11voww7G7tuH3fXr9vH2cvfvw+58CRJ2hW8k5jJn2BkmfIjucH/BssZVhn064gz9kmEfNE2bzqF6HkFhXwGxruwqYbeLxT0S9m+lEjj7XglwfrAJ5+VHZTDvNVLwvf0KHKPNwu78CVB85Bj/6l+EffXg4AAq7AfABgn7r3T6+PCXj7Af451w+aBHwj4yNpaScmpsbGzaQOZSmUxqhC5PwI8Xs1OT+WWcLo/Nz76GG5EPL5/OZlI5o8bc+6nZp9YtV9hjucRsftz4G6/mDIYJByzsART2a94uMY0VdnLiWoTdd90pubp2/E9Xx6Oeh2lKxFCTGPiOvn3YORLDMCFEdIGRuSXLsnIRlLsshNnfWFa2X7rErJsVOt0z9wRQcQ08SiZ/UpeYx/sxAURNc91V8JKy9EdNwh5fV4X376ZZ+bOwx+OUYYdTEvb0cRROjo50Yd+GaRxuBG9f7Y2wz0ti1ABi7vz1gIFk5OiCdEgawJhEht8aQEK6M/fTFjMSSc6gsM/P4mzp77X40RfcN54JBSzsgRV2z06nVGCvG7seiQF/1qEoSxu2DpCuq1EvsWuRGETfN4n7sDNMeBGdJ245TEQEMpC1gOyQ6BPK5go4cakERmya+66wlwXhL+z6I0xXwWNqXGkS9s9UyIe6fdxX2P0XnZKwRwWiCzuU1vG/ZROmvRH26URiHqQ7kVCLTp+CuL9+nZQyT8KeBKPOTCYlTF6AjSdSk1I+GILZlBydSqVm4RecmTEwCmeJVCYpF1HD4aH5SRR9jULGg2U8kMDkmyGDYYIOC3sAhf2q8nWAIjHIBcS/wq5LO2XOgXabOuoRdiqxN/eJwQg7Kjt1dfQYu9sl5gYLO8OECNEF5uZyYOlL+OxlC86m4fBc9Ac7jmbbpvlNbGAyHYU91qKwD+7Y5VIJquc3UcHXhUMJnFwX9kdQWS+XAIjXuEGXzc1N0aqw00wXdie9jkANvmcZ9rdSZuunD75AsRzku+AKu5QWjDNj6qIj4y+lfAZDVkn2eynfGMrmnw7AuDg1o4T9FQyvpRwxNJ5LDwljaC4jgWTqrcEwwYaFPXjCfk1tdEqZGI+w6zudwou2TfLKuqqu06E93NJ6cySmnonRIux6JAaMnds6MkxIEd0hMq7aOt4CXb8rxBAoe5/sdRozzR2n7l0Uaxg+R2EXrQm7bRJRFPYKyfmqLuxFs85HQbQs7FV/YY+m6/zqvbCjdWMmPUvrUDNUawfyUn7AWnpSDhs1YlKmnBGce8AbdEnGYPhAj/bwZd4DXp15hmX2Wd5riQk2LOzBE3bKxJCv65EYhVZgR4fWIzHtV9jprW+dpEfYEZVh1yPsvHESw4QX0S0gtz4oxJxlDQkl7guiP1gxyxGnfYsouRXyCowtCbuNC0lte5eEvUjCvqELO9xiE6v/LuzbfsKOV46rLtu9F3ZMxOB4C1LsJOyLdN8w/BBIJEZlUj3+WQqiNKD0qm7+oiGZPuva/EujFe7kMURjMEyAYWEPqLBTIkavsFMkhirsytabFp1SdL2tZuz4y/T2qbBrxn6eaDB2yrBzhZ1hQojoFvdwq6QlKyuQrJUT/UHR3PtqFnfNT+tmqXVhd8PqMQGUSdh3qdlMVBd2uGVQiLh6dUDYIyDseDyApwL41N4L+zBlzqXMkLAbxKisA2mY5WGJKLefkHK6QdjVp6DGt8Q7JwNvMEyAYWEPoLBjfR2gnU4vUpcYr7Aj9V2T9H2TXG/vCBSJgaN/iR1xvpPPTqdXLtUK7NdZ2BkmZIhuAZmYghDTJOwQjRH9wW/2zue3iSOK46JVW2hz7M2zxkYeyWOJdSInVhxWNiESSYTjhERJcSJMiKX8sGSJcIiQEKrEBQmFSyLUayul7akU1PbSA4f+BfxJfftmn72erAPES7RZ3ifx7o73h4048OHpO2/Aqn+9+vPh1UnIsX+UsKdxkirQqbA/oCEtjtTpyf4Qj/xMvnjxa/bjhf2dDqvvUoYdRz7uN5v3z07YK+TMlHqZ9kk0CHWLyFmXQbAr9Y3ZWQiiw8l5papmH/ZgYc8N+2h4X6FdVkDTYpgIw8IeQWH3jN1XYjcWOgUxNprEYMmbVF3jW/Bo8JVOydYDM+yk7IEFdlrp9CJX2Bnm/JEIG++JqXmMxFRLpcvucKFUKibiwTPMoO+62yvvF/YUWjqS9Vo0PqEMO0i59vhX3ebrDzsf8hc94cS2jqTl7wKFHRuvu7s3Wti77RypwK6AsxP26W6F/c4xYa+oikWgobcx9aKFfUepHz5I2M1Jp5CJnykooAId3BkmyrCwR0/Yv+vtw37JXOnUX2H3p9gJqoZ3urGHsXISPrd/hd3f1jF44STOsDPMOSQRMqlSNW9lUg3oxL6om8TMJyHCDvq+nYgJV7GP+lM3xh4o7BkSdhLtR+nO4X4q8QvsSNgfPE+kX8G7nRo8GPvublq3jnkM++zRq98/QNj/hnmm6UBhR1PP/OYtgzp1U5+beoPifubCvulF1teVumEIO9p8zurQ9MIyO9q6F0DxTyXsOysKcEbGLIaJOCzs0RN2XWGnEDtKr9HWETC6OlKF3SftlD8PYdbphYASO/70Grvh64Ap7N+d37aOU68DOBQME28SIZMqETOWO150j2ZgU03EBYiwTGLK/C9T2LVoE4f+zjAvMUyjeUDCro+pwE4XY7R96ql70j17srCToyP/GcKOio68807+e5PQwp45W2EvYdkcbXzxmLDPYusYJNntGTONwo4J93U8t5B7TyRm3ceB7tg+k7QYJvKwsEdS2Ic6fR0pw25mYrSvG20dCd9KR4MoOz6DMOacwqsLZdiNlZO+oT7scZh0emUyCEHUbSUMarZdp+Mx226JgSjbNcEwZ04iZDLLMyWkOK4FfgnHM2OZRExIgVU/wfjKYYCwPzaFPfPjUxL2jPbxhw9J2F+g3j/G0AtdTIqe+vMq8uroA4Q9s/t3R9gzU35hz/yEvp6mk7vvbiJv9N/8daXU9NkJe9LBrurzuBqSKew5cPIWvN1olVvY+XF620puKk/Yl5VyivCEknPXEPaTcZz6sMUw5wEW9kgKO/g6ZdiNSEzwukm63O1PxOCra96DQPV6ejqCufnARuxa18027HEX9jlpC4OClHJJaG5JeUMMhC0Log95paqCYT4JifAZXcjnkz4JTcIwNrqO/4gZ437XHRtk0i9/fpbwk95/lO53T+b5/tGT9Id9JfihL0Y7OpV6+1Paf2Xq7W9vO+bfUkptn5mwo4Yrx1G6wE7CTuy4J8ruBoT9Stkd4O8IxWlwpD5O2Ne4uM6cF1jYIyjsmIjxTzo1Kuz+EjthdomhH7T1QcrruKEQuzHn1Cixk7GbbR1J2IfO80qnpxP2iXEBfGJhX5VyVjDMJyHBxIHT/ofotlK1M2nrSBQd9O4dyq33TDS9O62Q2hIM9vRU0W1HbVrIFt6q1zstd4S9bTFMTGBhj6ywX0Q6GfavzD7sGl+J3QjEwMvbnrq/o7+bu4m5cBJFYtzv6OKPsF/SiRj4jW2FvbG+LQwKEmgKIAxhX10/EIGwsDOfDhb2z5uUUip/emH/Y28vaRkc7K1bJ7K9tZW3+pFculcdo2cOLy4vWH4ay/M7f1gME1NY2CMn7N/7Jp1eAmjOaXCBnXQ9YK3TgRc6JSgR70dPczUnnWp6Vzr95rPIsHdJZnGHwm5LOSyAk4R9dFwgFu6JnBB9h7meK3uFPTcqGCY0WNg/b/JKbZ5q4SSGYVjY+xAjYQepNdqwk7EHLJzkc3ZT1nEzqK3TMy6cmIkhX//S1yXmK4rEAG4k5rz3YX+PsLedCmyzJUeCps9BdB2FvSSlAn8nYV9ynB3hUnScvBB3nGZuRUlZXhS5Edjbdf3Fx++X4b6VWwJoOdOiOG1PiDmnjieXb0/AlbVVQcw77q2OA06/VrDhsHxPMEw4sLAzwEAV9gV309jbg0TL3jA4B1TYGYZhYY+NsKOxa2G/FNTWMagL+xcBfWIA2pxK13siMUZfx6BIDPCV2SXmoq6ww5/p2/hGYnSGfVp6FAUKu6hIuSEECXtRykXhMi8l6Lgjy8q73JFIRQB5GCDLMKjJiRIcTlCGvSk9qsKjLTWXRYnO3RAMEwos7AwwQIY9b60VCgtWtVBIWvcKc5ZVggw7wzAs7HEQ9u+praM56fRr1HU0dlePATBlow87uTpV2QeusFMm5sREzBcBkRhEJ2LA2IfO/UqnKOxH2ex4Npt9PvnPy7S4Ygg7Crm9UbxXkDDQwp6XUm6LvsIupWotzklgYnbrBuzGhMgqEPfSvTsSr6lJPLviCfssDO6UNsqwuys0Y5vwgPLmZm4U3qxXqyOwywuGCQMWdoaFnWGiAQt75IQdfL1npVPydXPdJCSwSwzaeggh9gu01U8zS+yAWWNHWzciMbHqw/769UtYQenh5NSja9f2jwl7HaviWGjPa2EXLZBp0V/YK6MC98rdt6UsoZM3hcCLC1rYKw0htLBbtpRF/XFQuScww4431AVQch/DMGHAws5whp1hogELewSF3Zt0OtSddIocXzepu3IS/mq6eXPKnw9YYdfPwZ++c05J2M0CO7V1RGOPgbBPTu67B69FQCQGjbs2DoPhZnPVE/Ys2PgP/YQdvR49H2Pn16VsCzFBvSDB1RfczQSOUNhnpFzBUd624UBDwj4mpVqAfa7ZLAqGCQMWdoaFnWGiAQt7JIXdF4n5BjG7xJCwB1fYjRbseDBgY0fEqLBfMNuw06RTUvY4rnS6jwfiMEDYMQBjr2zhx3vCLtbhvUYfYUcXR88Hv8fb22JcSjWPQChm3hX2GQFoYa9jaMYEhR0vkfbcDMdhmPBgYWdY2BkmGrCwR1LYv/MJuznnFAmIsMPLsOpOoGXApZPwCF+EuW6ShiLsGl+JHX09ThX2yaPRRwHCDnEWRG3kBAm7uC9loZ+wKxy1vUD6XVfYh2UXGNa0zHvCflvKnDDoCvuarQPvIw3BMKHAws6wsDNMNGBhj6SwQ4X9ItKnrSPIsZFhB382e8S4+zCgSIx+Lvm6uXASldiNCDt1iUFfj8PCSfv64HB36tAUdmC76WhpXugI+7iCxIsh7DP9hX1M+mi6wj4qAC3sFXykCQm7SM5WJHJLMEwYsLAzLOwMEw1Y2CMn7N932zqC6+oMO0ViADMT82Vn4SSC1Non24PV2OkQMBIxxPEKuy/DDsQuEgM8SpvCrsktu80dayTsmC23q73C3u4v7JaUI6JLjRQdhb2mrwSW1lYFgcLuMb5Ut93YO8OEAQs7w8LOMNGAhT1ywg6+jhX2oRMiMccK7L0LndJCR9TmJYQSuznpFF+9FXb4UtrXTWP35pwOxanCDkz9aAr7xkoLBzuozCTsog5DFPY16t8y11/YwcwdgazVaquGsLdJzbexZ7uGhH1rZSUrgKTtNmVnmBBgYWdY2BkmGrCwR1DYUdm1rwM9fR2pDzuCsmwkYgjqyThQW0e6nTI2/bo6+jPsNOsUdd0n7LHKsF+7Bhvr0BR2UHT86KyUyifsoxMSuIGaXRbAujxB2FcgQUN3JQ1hvw7qj58Ab7fA1G/dagjY4UBs6JaPGJzJCYYJARZ2hoWdYaIBC3sUhd3fh52EnULsgSX2C/gyQuy4QQa2djPDrj+MfN1TdvxagD/Djr6Oyh6rDPvh6LNfdp8FtXVUy6NifQ5jLSjsyI4n7OO2lPXVRsk+SdgvS7joenIRbr9tRGKwND9RTTbuS2kfwAPwqeJAyvJiEaM3paQ4gJNKMEwYsLAzLOwMEw3+Z+9cdpsGojAs7hRYsptMG6EgcVgAVUrUQZFB3cRRUtqmSi9ETRoqpYDEFrFBvAAr3oAHYMn7MR77kPHEAVonUib+vzQ2g1XHZcPXo3/OgbAvnLDfjwcnaXSGnTedOm0d07o+Yet8NuRLsTvbTrP7xFyLSRXY7S4xy1Rh//XVDFD69lmfXWGX9YcJT3hwUsxBLOyls+Ty3l+EvTTgm7xYmxD2kxd8sVNiYY+uadb0pzDdEgCzAMKezRkF1Q9yvB42dgSAsANgAWGfwhIJ+9S2jkbZ2dcZKxBjTU6KHZ2DMXk3nCYFe5vUjlMmo6ujJvH1Zdl0msLddLqWOPP2U73YGwv74yexWm+eGZsftoywByatbqahfo/O3yNh15wG5iav+6WUsO9Fp40DY+f0PlrUk2/oRBq/ps1fX9MEvRIAM0LMgUo5fVv/fisYkWZ7vG4SrQoAYQdgDIR9Cksq7G6GPbvEnp1hN8adc86p1Yx9gqtOY8frqTYxN8fCzomY5YjEpCm5bJx226/+kiCXrfP/mGy0+ez8lZx28aTdmvYDPnrXO9/HhlMwQ8SsWesNQqXCTj9Z73ZCvXouvKL8+FWV6EQwG0QjAVxhf9rJoi0BABD2ZRJ2bex2JMausEd67Iw6NZHydCYm16ZThq2fK/YJyec5XWLsPuxs7CtWJOaOx8K+8eXLj4nXlxIAy42YNS2V0DPLV8mqWxF+0SPqWSV3lNgzhH2/msWRdFntfDw+fiv/h2fD4U8JQCGBsC+isN8xvn7vP/qwa2PP7MOe+HV+7F7uU/qw64dgYY/JjMTc9jzDDkAhEbOmFdZO+2+6oVLv9EoqFZ4+3u0o5VmNXTwlGqRWHwWYFPbGBJPCfhqQJpD/ww7RGwlAIYGwL6Cw37W7xKQr7OzEVoQ9Y98pu7pzvKSrm6Obh5lIxHCTGP2MmX3YfY/EAFBIxKwpC8OaUm196in1VJ8qO8q3XZt9IvuRt6kuwKSwyw2H1qSwbxMFR+tDCDsAEHY/hd2adGoV2FnYnUiM9mcXjrLksHUN6zqfLWefHJxkcOcmLUkfdgAKiZgXsaJ3VMjJmDXhFY6wH2qRHBvr4eHhvigsFxV2om35v+yPRrsSgEICYV9AYb8T+7qGIzEaVvbsCrsr7Zw51+Rt6uhE2FnX9RdjTzqNni/V1ZGNPekScx/CDoBHiDlRCdXAaLs+avpKPRNe0Sc6tJY1exlSoTehXlDY+0RNCQCAsPsn7HfjQaecibGE3Z10ql88NsmW9bi6zod8JKX1yUjMOBPjRNg5EmMZ+zK0dQSgkIj5sNlTqpUSdr30ik2iRtrfX0PYLy7stWZzS//TNZvNHWnobjUaWzW+3NZ/fRK+3j4+NddUxANpCJu1B531veOWBKAYQNgXT9g5E8O+no7EME6B3Ti0G4nJX2Hntzs6yYmwc4U9w9dXlmRwEgCFRMyBWneglOqU05GYmvCLOtHGeFUhqkLYLy7sR8QEUvMgWY9WpaFBQY8i6lKzRxrOsNfpKF4PJACFAMK+oMLOiRi3wp4Yu1Vh11xxN53qV7q/y+Wr6/yeXmFnY7/OpIydM+yosAPgIWL2VFREuyxSm05VW/jFgKi+PhzwMqCXEPaLC/vO+rp29Or6erzp9IAoGI3qRMcs7PU6BY3tOklN8+ioagk7UfV4O3J5AAoBhH0BhT3y9QiedHrT6hKTzrCPpya5c5MSb58JHInRx+wSuyF6poxJpyu3/hTY70HYAfAMMQe63U6o1KCUauuozoVnvKuSVVZ/SYFgHvX7/ceisFwww/6OKBz/8eV3KU8Con4i7ERKn3ebLPi2sJ/p04ioJgEoAhD2BRT2xNitErsz6FSLsdMkxpS8WdVjrIFH+Sedsq1nZthZ2TML7Dzp9DYq7AD4h5gP5VZSUn+uDINQ9YRfdIno9dYOLyN3BzmFfUjUkZqQqMnCfiwZV9jrD/TpU/TdABQBCPviCfvddB/2FXfSqV1ht1PsDFfDrW7s+ScnmftOr7DbbR2zBychww6Ah4h5ca7UI6Hpa1cPa5tK+dYHMTCNHJlVooYAOYX9gMic14hGLOwnU4V9z6Teid5KAIoAhH3xhD2usHOI3Uiv09ZR43R15Aq7Je2cP5/BrtMrGSV280obu+PrGlfY76KtIwBeIeaFLq3vihj9IatKvRFe8ShdUm8RDQXIKexVDqQTNVjY5VRhj29ENJQAFAEI+0IK+70/fR05w+5mYmJfd9o6MtakoxzKnk7TOHtO9XsMZ9idyUm3uA87Np0C4CliXrSU6o9XPaU8C333iZrWMiR6L5jds7OzUBSWywv7SwrYxqvcJWa6sB9A2EGhgLAvpLBrX+cMuxOJyZyblJS77USMeVvmnQOu16ci8iY3n9mInXU93YYdwg6Aj4hZk9yxvBNFYpjV0Ls9p86k0xFRSTD7VOhE++WFvTGusB9B2AGAsC+8sJtEjL3p1Kmw2yV2xu0Swy9j63nK6+bAIXZnz6lTYmdjd9s6srDfw6RTADxDzJiyaj+VlXJ/oFTHuO3+48rGaRjlY/ziJCXsG0QHAsKeV9hHSWT9lGgLwg4AhN0TYb9t+JNhv5Huw85YJXYnEKPfyfHS/R3tbu4u7uAkjsREzxhhR9hX4kSM/kKFHQCvEDOmrJhQCk03WT0XnvGcqD1eNYmsn6AFYb+csCuij1JzRtSBsAMAYV9wYb9vbTpd0fCe0+wCO+t6xqzT3INOGU7E28TbXJ1NpwnpSae3kGEHwFvEjKl0Q2WobfLeU83Oov1H9G+2iJ4JphKkBP0DER2KwnJ5YV+tE50bKw8eQ9gBgLAvuLBrqXXasLOxZwxOspzdlXVzyGvrfI8rf83EsK9fs7rEcIl9RRNFYtCHHfxm73xemwiiOI6/fx697Wz8gQNuIBvLxtIkS+IP0IqaxpRqUqnRCqkWCuqhFEQELwXRi/4DioonUVEvHjx683/yzdt9zexkU1u3wiZ5HzXbSXYno6ePj++8YQYQa+sp1PP5zBEaHTmcvymsAaN4teI4vtB7sp+yulyFD49YI8s/Czs2YFdnm1KBPSrsY84aRRZ2ZvRgYU+nsKOxB8K+L66tY1wX9u0xfWIAevknXY9EYoy+jnGRGGCX2SUGEjGAisTs50gMwwwWFhNDB5yxeqk7vuI09dgPfDrCTWKSCLs97jtA5Z5Nwl6112g6a1y37QoJO6RoGGYUYGFPnbAforaO5qbT3ajraOxKjwEwZaMPO7m6tvE0CfQ4ztY/EbM9JhKDYCJGGftBPumUYQYRi4lhdvxU3erLJTDOES6wd4X94/JyxjZ4uXzLXpe7Cwt5m2EYFvb0Czv4euSkU/J189wkJKZLDFl78hD7NnoNZjNL7IBZY0dbNyIx3IedYQYXi9k0N6emTlojTJ6Fm2Fsm4W9D0Ml7OGm04P6plOg99yk7slJ+Dugmzen/HnCCnswD/7qu+eUhN0ssFNbRzR2FnaGGTQshklUYa+rl5vLy7Y9t3wSnAMq7AzDsLAPi7BrkZg9iNklhoQ9vsJutGDHHxI2dkSMCvs2sw07bTolZeeTThlmwLEYJkGGPW/f8Ly6fdnzMnbbu2LbRciwMwzDwj4swn5AE3ZzzykSE2GHP4ZVrwVakh6dFLZ1j99zarZ1pFCMVmJHXx/0Cvu5lbcGv96cEAwz3FgMw8LOMCmAhT2Vwg4V9r1In7aOIMdGhh382ewRo67JIWGP9onZ3nNwEpXYjQg7dYlBXx/og5N+lXt5LrYKz3WviVimXPeW2Dj0BMNsASzsDGfYGSYdsLCnTtgPdds6gusGGXaKxABmJmbH2sFJBKm1JtvJauz0I2AkYojeCruWYQeGIBJzrhzDd7FFzEogftnXpTwtNkbVObvJJ9qOUxcM0w8WdoaFnWHSAQt76oQdfB0r7AfXicT0FNijB53SQUfU5iV5ib1n0yn+iVbYYVHk61FjD/ecHhzoCvux/yrsHQlcFHEUpTwpNoYrvU0+cVFKLsYz/WFhZ1jYGSYdsLCnUNhR2QNfByJ9HakPO4KybCRiCOrJmKitIz1OGZt+XR31DDvtOkVd14R90DPs/1XYJ1zpu9IRcWRv3dpYVB6FfVNPsLAzf4GFnWFhZ5h0wMKeRmHX+7CTsFOIPbbEvg3/GCF2fEESW7uZYQ++jHw9VHZcFqBn2NHXUdkHPcO+EWE/kY2OJwpCJxu9WVtlQ8rrNSlPRe4uiB4KEwKxJ/QbbYGQsK+3ooIx1oU9w1toGRMWdoaFnWHSAQt76oT9UHBwEgAZdtp0arR1jOp6j63TFUmWYje2ncb3idkRECmw611iRqLCXr/mS1nyGjho+V6m6Ujp1PIioF11pXuhLYDrvicWK1K63pwIqEqZuSFlUyC+vzBbK8FkRQFc9v27QjT9O9lrMGGlIbJjcHVb+JcsFH1Xwrsw76zvw0++fwOfMFeEE3TUg2MFQXTUwyW/BmJfVA+7V6ZhyqrvX8a5PTUPM+JYDMPCzjApgIU9dcLet60jKjv5OqEFYrZrvh5oOop28g2nYcFex9xxisR0dQRCXx/0Tad/E/YZVwY0lRB7IMIScccFkK3JgLMwaIFuhx/eFIqbUl4VAoTexqGUY+FkLUFbSH1ZcSQy7kukCp9NVGXIRXFKBkzhEz0r8mW1IhFfEOHTJSEuyJBx/EL3MHx6Tcorghl1LIZhYWeYFMDCnmphNzPs8SX2+Aw7GnfCc061Zuw9bDcaO+6MtInZ3RV2SsQMdSRmVtW5L7bH4DImUNjhh/aicuS8QPktLTbugELPK2EHWu0WjK4JxVkpF3Dj6SQOJc41qXT6ZlfYpXQWG1dQsC8unJUYoFmCwVi7cQEuItPpwKXTOY1PmCvCCUpL7RpcGiKk2IF3a515MQ6OPj/e9uACb19FU5+B+7OCGXUshmFhZ5gUwMKeWmEHY9cjMXqFXemxcdQpRsqjmZhEm04Jsn6q2IeE32d0iYn2YQeUr2uRmP3DK+weaLHKgE8rQ8ehq6rcJ5pgxEKclLJagOGcK90JJeyuyprklWcrSvAu3lTBYaDYWPZuaMIOM+DVKQhU9aIQFayF49dlBGXY8QljRfigr/x7kv6XAFCGXa1oBr8Rb824UrbrrpqFGXkshmFhZ5gUwMKeRmHfj75+cAN92MHYY/uwh36dHL2Xe58+7LgOFPaQ2EjM3qHOsM+Be0/AFU16DG15EYcF8N6sAG2fw+EUqLDS4yUcgW8LYDx06JKUswIAn88K4AZMogl7XgAtNQFwGufw/JYAaH5d2M0V+eGe1qyEmwgSdrilpm4+eefOrEDHd+H+64JhLIZhYWeYFMDCnkJhP6B3iYlW2MmJtQh7zL5TcnXj9R9dHV/NPExPIoaaxMAaY/uwD34k5u0K8A6ON135Xv68Ui6/fdcV9hmVTkeymC73lKYjHSXKFSmnkKLaWdqi2nVNSgFAzmVaALel7AiAlLqOk5Kwl4RiKZT6PEm/ODHbqMleYTdX5EtXICUYESTsMJt0ry2ofzf6Fg6wMwAL+7qceP/+sRXP6qtP2oevzjy3+iHOnFm1hoSfP758+XKEhZ1hABb2PgyhsGsnnWoFdhJ2IxID/mxCUZYEtg6QrtM1WmI3IjGIeW7S0PRhf/fsXOHZm/Lq6uPH5fKxX+UHv7rCvoiFb8RVau2RHit7bsN7XTzRCmyehD0j18BojKDQSlTYHaFYCmv1c4Gw58cciZjCbq6IjD9O2PGKOPNZgfh48CrD/C9hv9RuT1sBpxqTk43T1iByLJd7YsXyKQd0P7yfe2T141wu98r6OytPkUcPz1lbzIPVLZry+O/ziqNrwp5vxHHZZhiGhX04hH1/4OsARWKQXUh8hd2UdsqcA4mbOpoRdmQ7/Cb0k07V+iJdHcnYwy4xhwZX2MvllWcqBfO2DPx68A4HIfO0lRMD6bqwF6Us9gq7LYBQ2BelRkNsRtgnUfIrTa9X2M0V0QTxwi7u3vGlolTH2V1saMMw/0nY68ViccZSHJ8pIjesAaSvsD8GW//w4sWbLRT2JzmC7k6Ksbjk/ABb/6ZX2Ke9OJq2Saax1GrN2//A3OTZVqthM8wowMKePmE/EBx0SpkYTdjNk07hFx2bpMt6UF2nl2SEpfXeSEw3E2NE2CkSoxn7sLR1VMJeXoXiOvBAvNWEvaHavyATUlYwEnNCIGelvCEctGXCEHYH3HseaWJ4ZePCDi9yvo7vmsJurmh9YUeyM6q5Y00AFamYFgxj/Q+OT60J+3Sx2L57t10sDmKNva+wn8nlIlmZh+9fr5erebMxYf965syL+zmYOqXCDgX24+qqC/uFHnqF/VbFASr25vnD3rn0tHFFcVx9N22W3d0ZYiMjeZCmBAWsTGORB1Ix4uGIiDYFBUgrJaVSJeNFhGRZSN5YQnhT5D1W43pV3MrKpt+hUj9Szz0zx1yOpyTGptie8wM/xtczc7PKj6P/PXfN0Ty1BSEKiLAPnrBTJibwdRaJIViBHR2aR2J6r7DTg2+dxCPsCGbYOyLsI7RxEgi7fp45fHPvXs16Ywj7BnV40aL8FIUdAymo41s6pX4Ljx6vri4zYX+Clo7YOtrShbDDEtbnluabDmHnM7pY2L//5ic83IUSu3+ThTXp6iho1FWw5G2TsGe8DNxjxvOyavj4T2GvuK4ySCRUL5Cwa+lPwKUbgynsiX++/ltxYbdnGEudwr4Ctv50+rndNbfSjnNnejprC0IUEGEfUGGnRAyvsFMkxqywgzzzRacUXe+pGTueTI+QCjsz9g+Jc8ZOGfaRqbCDpo/v3/sjXqwZwp78KkigTMKbTX/jJJzFMgTDyZkBqGFzYYenrIXg8KMuhP05/lngJ1imrHPCzmfEhX1jaWnLQmG/bQVtIYEkznYWYjZj1gpYuyVEHnUFjHnerUDYtzzvCdbZ4SM1TBzVG/WjtrAnXjcbrWDtaDKfz5dcNw/gB/FjTVXR4OH4caHRHKe1qZrD4CCft8r5RisfUz6v4Sb7sQMcR2EHLNfN+Qafryr8dhyDNceVRuUY36p4Pr9XbDYqB3gdc3o0fJioNhuFg4S+Zd51S3mghhMI5lXL55OqG+b/+gsSMf/8BcS6FXbHWbEvxa7j/GQLQlQQYR9AYde+rqGdTj+mLjGmsCNnuybxfZMCb+8LFImB5/ASO6LnFLLT6Y1P2gX2m6Mg7H/U3vyxt3+vfPTG/qMt7NiaceKHjbHlr/wWL3d0HHzt1sb3E36H8zR8vDu5+wKXlZ4T9skJOgJSMN6FsL+Em8wmp7wv9V3uYlg9uzyJZ/AZcWFP62tjCH715QN9VWd9xtoBSZ9Gw1/2u7FnLSHqqCtgzdtMBMK+hKI+6QFP1PAQK7iaeiDsh6dGunzPJfzBGr4tKAAH8zlXg/qcyJ+dh04Ov0DJ4jchYQdKrptQgOtWHroAFtyrLpKrBQn6Ch6ezis+PaDsuq8briavr0o08cSmopvEVDf89nWbeJfCvuU4i/alyDrOrC0IUUGEfQCFPTB2o8TONjoFMWZNYrDkTaruY2x41PtOp2TroRl2UvbQAjvtdPrpqFTYa8lk8d6vcHhU1MJO/DAR4ExZKOzEtAU8+JIOl1iG3cPYOAFfS72zsKNTI2kt58Fds3hGx4zChX0WF5paNhz6fDllrQYzWsYdl4SIo/rPbUjBkLCnPC+hDX57uJad1sGN6xVy8rh242Ydno/0UaWik+YVoIaOXigUDGEHWvUSPOHxUaHQMoQdKNRJrZt0k3PCnoBjpQGvh9/WqdvwL9tqagufR2EHCs0SujybHlDGM09bJRD2GswSblMB9tHTc/SVumLsrBt02Pwe9HOECvufQFcV9tTi4iPHWV1cXMzayPqjhYVHKRpeho+fZVZXvtvpGMwsLq46znM4M2ULQhQQYR88Yf/8fB/2G3ynU7PCbqbYCaqGG93Ye985Ca97QYXdaOsYvnHSsGfYk29A1uFB4NGv1hkpB4V3esaysEvMUhpleNtCxlZQru8/sdCk8Uso7PcnJnatNtM6h+K3Yydhz2Dn9bmJtAXoljK/WMAv2CXmdhrv+a31FQr7xhwKO57BZ0QXIGHX5wOPvsTY+q1vJpCVKSuFgRjNgk7XCxFH9Z27GW9HkbC/9DJKbXge1NiX1dAQB+WNoxijS9d9w57PublAZAsgviY5U9jBjGNUJgfmzwn7ISbjT/2b5EC/y0zY8zgKUEH9EEYr+js4Vg+E/bVSCRD4Yuf08IqnOvpSrfIMex5nh38rlBVjM2tgKYCn9KFHTNcZ9qcOMWcD48HxizEbWXDmNh1NumMw7QCy6FSIECLsgyfsfoWdQuwovaytI8C6OlKF3ZB2yp/3vuoUf3mJHX/OGzvzdYAL++fD29bRqoZsdFq2TGaerD+2EL+t47P1lDmTqeWl/k9sKoX3vJt6kLQINqN3Y2ZnffmBrDIVOKrvLHvbqi3s2yDsVsabVRlvTQ0Nx0HapQCvaNYt6g1TfbuwNwIz3gsT9rwCWng23aTSFvbm/tFxC/1dE1TMqdoe3Mf1hb1EdXI2PRL2+bDJtb+byMEFOBubBgnFuaSwZ6enn+LKUX/R6Tcg7i9egIt/R8KeTjtzCytpp2Pw+fT0HZD1aVl0KkQFEfaBFPab7b6OlGHnmRjf11lbR8LY6agXZcdrEGzNKTzOoAw72znpE+rDPgqLTi0rXmSU71rh+MIuCCOA6jdTnjd2JuxZEPaUt51QGdD4oQEK0HEMtKA818CP6xUA/D3/dmF/GJxZDBP2ahC4wWfzJjBIVEjSc0a3miZFdZIURcfbNkKmV4ZL8MkRBbzpPk7pYnoXduJHx8mcvb3/C3RXn3OcrUDYHceD18eLbBDxHEc2VRWigwj7QAo7+Dpl2FkkJnTfpKDcbSZi8GGYdw9QvZ6ujmBuPrQRu6/rvA37CAj7uyPCLowMqs/EMhhWJ2Ff8zKP0eCHKhLTQqNGMz7wVZqov03Y8QxU4mqYsO8Ffw903ITuUmrVlI/R3rFGl8hjlKVIhyW3FDK9Mop7uLBX8dQCeP+1CPtzx1nDfDqtQ12gWjsbFGEXIogI+wAKOyZizEWnrMJultgJ3iWGftDWeymv4xOF2NmaU1ZiJ2PnbR1J2G8O806n3SDCLowMqs888LzZnZ2d2563vbOh1LrnZb1d8HjPS6mhoRG49CG4NFpyJR9Q7VHYx0nYz25SNjLsJkad/IjGjvGyRTo8dXMh0yvjMJscocMwcRc/YSQnDa5E2DH0gq+3IKhOwv7MDhkUYRciiAj7wAr7p0g7w/7R+T7shFliNwMx+AieL93f0ezmzuEbJ1EkRs9RY0bYb/iJGPiVCrsgDBWqz8x6Z2SU2tUvMWzNvqSGBtoXqYou/dpf4ok/ql/CjjdJ0E0uEnazZv4Qa/RFOKQKO5setXUMnRzV6EH7a4rBF51ejbDfcdLUmn2BhB1f+aAIuxBBRNgHTti/MBad3gBozWl4gZ10PWSv0543OiUoEW/iL3Nli04Dzu90+smoZNi7YWxDGiIKI4HqL4mNrA94enZbqR0Q9i3f4wft/6JwyIsPafEpi5j0T9jzgTbn3y7sSXpfQMkvBocx122x6V0k7DSb+qn2fE7i/xD2+86cjaSdO76w0wdsUIRdiCAi7AMn7CC1rA07GXvIxkmGs3NZx6debZ2u8d6FmRjy9Q+MLjFUYr8B6EjMsPdhF4RIoq4CyrBjpD2TgMNt/TI07AerOk/RpWM5N2cpJNZHYS+6eFKidLGwU3cYK2g36Z/pxhTW1h+y6YUJe8k9PZ/PR8PvwJo8w76iSMzCWRH9qSHsnYMi7EIEEWEfTGFHY/eF/UZYW8ewLuzvh/SJAejpUrp+LhLD+jqGRmLA2HmXGEjEADoS81lkIjGCMCIo4kqEHUPsm7HY5nDtm6RKuqViohm0WDwBTy7Dv6nayvVP2DHEXj8st9yLhZ2y6424mj/Fr6KwNyxVBo2Ps+mFCXsBJjBv/DECwOG1LDp9EUTWdxznkSHsnYMi7EIEEWEfOGH/gto68kWnH6Ouo7FrPQbAlFkfdnJ1qrL3XGGnTMyFiZj3QyIxCCZitLHfHPqdTgUhkijiioR9Jush2aQaIo5c4qBdlc65QKewj7ttckzY0aWJAhd2FG7gXSrssVIwgVIChZ3m81Dx6XFhx68jzbNqfUNdi7Cjgf9sAz9gQxgS9pBBEXYhgoiwD5ywg6+f2+mUfJ3vm4SEdolhfR17WnKKz/7VeIkd4DV2tHUWiRmZPuyCEEHU1ZBod4W5u+YBa5YaKvbRgfcD/U6cBG79sFPY97iwnwTn13wLJ1p4NE/Cjqc24JxC0ffrE3wxwCaNhFVwNZVYYODHYPBUuefT48KuagVT2Ouue3Rdwj6WdpyXtp11nLlJQ9g7B0XYhQgiwj6Awh4sOr1pLjoFOvdNOts5CX99zvLmlD/vscLuXwd/LlpzisLOC+zU1hGNXYRdEIYNdfXEtrZiathIlE/KxpEa3z+pjqu+M49uX8RbXIxVOynGFFLUyr33uha71PRKbi6heqAHYcce63pvU6qhk7B3DIqwCxFEhH0ghd2IxHyC8C4xJOzhFXbWgh3f9NjYEWEV9vd4G3ZadErKPlo7nQpCBFHCdUI7nnYFCvtlqWGt/TqEHUmlHWBu1yZhv28jfJAM/pktCFFBhH0ghf1zQ9j5mlMkJMIOD2bV7UBLj1sn4Tt8EHzfJB+KsPsYJXb0damwC8LwoYTronZ6EFexY4y3/0/Cntw7gPTMXr+E/fdXr8Zsxi+vduwL+fHly6mLBqWmLkQVEfaBFHaosH+K/EdbR5BjlmEHf+Y9YvRrP6BIDF6XfL1j4yQqsbMIO3WJQV+PzsZJgjAiKOG62Kfo+/j/JuxN6unYE1Pi1IJg2yLs/8EICfsX7baOYLpBhp0iMQDLxMAvbZxEkFobst1bjZ3eAiwRQ3RW2I0MOyCRGEEYTpRwXRw2XE0hrrqk3Iuwl46V6muF/bF+2nr1yrafvboNzgEVdkEQRNhHQdj/Ze9cXpuIojCOIj67dHfvxAcdyAiplag4GtTqwgRr1YrWBxofUEWQ2GJBqCIWxFfFR3GvYOnOCuJf4r7Qrl27cOWZOznx9nTqo2Pwzvj90tyZZCYmO38cvnsO+bqpsHf8JBIjC+yE3YedBx212rykL7HLTafmyRV2e9Mp+bo09uae0w5U2AHIGgr8I6L/cg4+3KSyh51h3+qdK5ePeb3lcsGrl494XkgZdgAAhD0fwm6UPfZ1uw97BPdhNxhZFokYhnsypmrryB/njI2NjLBzhZ13nRpdt4QdGXYAMogCAMIOgANA2F0UdrsPOws7h9gTS+zLzFOE2M3CpLN2mWGPv4x9vans5mcRdobd+LpRdmTYAcggCgBk2AFwAAi7c8K+Ph6cRFCGnTediraOIhEjbZ2PhnQpdrHtVPSJEV1i7AK73SUGFXYAMooCAMIOgANA2J0T9kXbOq60MuwtrECMNTkpdnQOxqTdcCqnnBJyx6khoasj0fR1bDoFIIMoACDsADgAhN1pYZcZ9uQSe3KG3Rh3yjmn/EfLApaLxo4r2Nh51CkLOydiEIkBIHMoACDsADgAhN1ZYSdjb0ViRIU90mMx6tREyudnYlJtOmXY+rli36T5faJLjN2HnY19jRWJWQthByBbKAAg7AA4AITdRWFfa3y94zf6sJOxJ/Zhb/p1euxe7sl92KMfwcIekxiJWY0MOwDZQwEAYQfAASDsDgr7OrtLzPwKOzuxFWFP2HfKri7WJbq6WWUeRiZiWk1i6Dcm9mFHJAaADKIAgLAD4AAQdmeF3Zp0ahXYWdhFJIb8WcJRlhS2TrCu81GU2EUkJkLOTcpJH/aDHxKY0L9BYYsGIKsoACDsADgAhN1BYV8b+zrBkRg56lRW2KW0tzLnRNqmjiLCzrpOf4w96TT6fXZXx5axN7vErM+qsG/uSUL/ikKf7/uhBiCjKAAg7AA4AITdPWFfFw865UyMJexy0ik9eGySLetxdZ2XdDRL6wsiMVaXGBFhl5EYMvY8tHVcorAf8Ikav6oHwTENQIZQAEDYAXAACLt7wm6H2MnXRSSGEQV249AyEpO+ws5POTpJRtgNcYZdRthzMjhpacK+q8vvqp48zy9rvn9RA5AhFPhX9EyOq1TcnZzcpH4PCDsAzgNhd1TYOREjK+wcibEr7CTPctMpR9dTNWNfZit7QoVdGPsKxjb2Vob9/6ywv/L9bZqBsIPsodrD4Xr9BJ+f7+3v36jyhH70VKXnZumZSsW9UmmIDk/GWrxRbUUK+9b+JHo9AACEPR/CHvl6BE86XcldYmxhN/yYmiTnJjW9PT1s7gStySV2Q/SbEiadrlnVKrB35F7Yi1u0obDLHIywX9LMfGEvFDUAzqPawrEwDE8qw7V6SBRVnrjVaDxwR9jvlloMq7Yihf1EOYnTnqTQf+PMmcteanovDXgA5BYIu4PC3jR2q8QuBp2SGIsmMabkzaoeYw08Sj/pVNi6yLCzsicV2HnS6ep8V9gPVa7rsNzVp/WxA7t93+8qn9C6txLQWWXvdm0YrHT5/u4K3VMMK9E9R05oANxGtYPOoy1hpzMIe9uFfWw65q1qN1LYDy1gobBf3BsQe70/ZUt39wbP5lRQ8QDILRB294R93fw+7GvkpFO7wm6n2Bmuhlvd2FPBDR1pXbTCbrd1TB6clPMM+26/L+oH06dfdflNDuvQj9miDft8w27Se75npwbAaVQ7OBzWWdirYbX7HIS9zcI+rYhOerQdKezedsHhhcJ+hGz99LZL3p9yLQiqEHbw/wBhd0/Y4wo7h9iN9Iq2joTo6sgVdkvaOX+eftep+ZMldvOYb+zC1wkp7Osy3tbxXbG4q1gsPun59HpT9I4t7JGoB2Fk5ZUrvdW9kbyfGDzt+3sHB7drQzhYoXcHL+udVF2/vLNepoMGwGlUGyiE4QYW9v6znSqLwn5r5IV6NPtlblYrovP5DJ0+UhH3R0bmGo3ZEUIRL0aeq4jHI4/NUY+MPO18Sbff74zufbGRPjpzZxFhHxr++HF4SMVsvDc5NTr8UBneTLw2x4mJu7TeHn6jbk9PPXunYvTEs6meu0LYY4rDw082T4xOTW/md/oHBsKN/1LYg+CIR6QX9vrgJQ+A3AJhd1LYO1p9HTnDLjMxsa+Lto6MNelo6cou0jRizyk9f8AZdjE5aRX3Yc/PptMPH17TBKXhnoO39+wZny/stL2UxHyX7+/TxPYuqqQvlmE/4/sntTaF9q0aAJdRbaA/PNfJwk5kUtg/N2ZmGxFf6MXTrw3DrfhKC0XMNT6riK90Z8SjRuP5F3N1Nrp3Lj5/nijsUzdLEXGQZWisZLjXvDhqjqVSD62jpZvT5uKkitgc3zqaJOxDlGSP/9mHKqYSBEHhHwr7hSCoLV3YAfhvgLA7Kezk65xhF5GY5LlJcbnbTsSYp2XeKeB6/byIvMnNi76OdoRdtmHPibD39IxHJx/0wkiMf1oTFyqVevONLr2YsN+gQvsuOnZfuXJWA+Ay6u/THVZ1DoT9W6PxjXSbNLz4mbx9dobWqIg+OzNDEj43Qywi7N/o9rlvsbA3Gl+j2z8npFUirX4//ZHWTfSqkyR8bHKUXo0nCDu9fdNcNBY+xh9kYX82ZNhkhJ34ODlGiwvCvrNWOxAEfbVa7Si92jwwcNGIycDABXOx6u28cvxU3WN21E6V+25stT5IxF9XDYn+H3de7jtypr7FnHfXaoUdlw/1XS94AGQXCLuDwm4SMfamU1Fht0vsjOwSww9j62nK62bhELvYcypK7Gzssq0jC3tHHiadjpsTPbFQ2M9rZvv+6j7/J8K+1aerp64WNACu8529c3ltIorCOL6fS3c3E6NE8AaqDaniYEh9LFSMRisVU2kbLfgCqQqWgopUkfrER3FvQXFlXIh/SfYFXbt24coz586JN9ebOiYp3hnPz3Ym6WTGLH8cvvtd0XP2HPZrIgHCPtl4CecnM0IsqNn6QGOykTEy7DZhB0cPrr54gU9ZEPiAFzZhxxD7nHLyNzAxzwoxD9puFfZ6Soi3apY+DR/FG82WmPehsE8LkQFjzzog7GckUVIz84oHDEt5GS+WDuC1qoekJ6SijDcSu/Eivix6IUckUsCv4sMoXr1lY2diDAu7s8K+Fmlm2FeZPewKfcSuB2LwNzx23O+ot7mbmBsnUSQm+I4BeoR9nUrEwE9CJuz73w5Mm8JOcfSjx0HegbbCjmdEns+lGMZpRM8p++MiEcL+iALjME/HF5CReRlJ2AfoIio+/m3GKuxb1fkaHOt9fQeFcvNZm7BjbkaZ+icQdbzRLux4EjfgogPCXsnnQb0L+Xz+nE3YweMvBMd+L+A4GPmZc2dKsqLfmK/hxfwZuFCkx8I9p6uDUg6Gwi6Lpy8UpeTaRybGsLA7J+ybtEWn6wBac2ofsJOuW/Y67XqjU4IS8Tpqmau56FTRutPpmiRl2JWwA3PXD861CrtMIWewCGawKtsLO3BpoqgaY06kGMZlRK/Z6fvpRAh7g16+hJDLQgCsNb0ZRdi/ak/BP2Yg0G4T9nt4fgaz8OBdHd89hUyMTdiFysK8x6O68V1T2G/dQR4rYd8fPueOQDaPjY2JfyDsZhTdKuyFrZ43JOUBDzgL/h08On1g+A8tMbmSlKfgfEjKshL24gjoDjzOY5jYwsLunLCD1Bo17GTslo2TNGc3ZR0P3do6PWPZopkY8vUVWkvMKorEAEEkJik97E/pxfSWVmEv4XkcJutDOXgx2F7YFbnhQ9gDyTAuI3pM5rB/ViRC2L9pJY5NFiIIuybnjVDe7cIepsz3o3dT5hz0+4Zt0Wko7HW1WhXf3dAXnVKp43Vctoq5mddCw1FhP+oBRYn3nJRyKlqt42UpL3jAiJSHlLCf99DfSx7DxBYWdjeFHY1dCfs6W62jrYV9uaUnBqBDR7reEokxeh1tkRhgldkSA4kYIIjErE9MJCbg4F2LsEMZ+yl8sdiE/fzpK/j2clDKzjAuI3rMPt/fVavV+n1/vDYSa2EPVJuSMAtfQiJFYmaiCvstEvZZkcFAO/AYFX1RYcfQCzBntMTEUdi9gEF5THl7IWIPe4WC7YOYifHV47wL8DyGiS0s7M4J+yaqdTQXna5GXUdjD/QYAFM2etjJ1WnK3vWEnTIxiyZillsiMYhKxICxb0zMTqco7Hv3wsGbswg7LDbF/73cmmEfOXp0LIXC3g+nQvih7RBjTzGMy4ges8v/xeFYC/sCvXxutDLahf2HVusYVdiVd3/Emhiy8Nco3CTsW+wT9roy/fgLu5qIF+RJOKYhlh5R2M9JWQv3ZCoqYb/kARMs7EycYWF3TtjB11t2OiVfN/dNQqwtMUavY+dLTumonmaO2AFzxo62bkRiEtXDHgr73MDs/PVZWyQmv23bydE9/dVtwKtfwg6J9QNwOgwZmIv7glpHOTyQqh2D7vYUw7iM6C3ZkYoCdL0yngxhx5CLKexP6PVCKOyNDoRdWfj7vj4VTKex+TSl1UHGbcJeD9/diibslYmJiRMxEPZRKasRhb0q5SgtU1XCPsrCzsQeFnYHhT1cdLpRX3QK/L5vkrZzEvxoA3Y6hbrdOVQyQzWR7dackrCbA3aqdURjT4Swf76LGyg9nYazRdhPbQuR8HvWFPZduNA05cFbxQ7eOIlxG7EEJCPD3hT2LNU5wkuB3J+cvN8MzCh5fzTZgbD3zashel0rgrmH3TEk5e9swv4RXBxvjCbsJyVExZ0Rdnw5ZBN2T8rjEYX9iJS7wjuLLOxMUmBhd1LYtUjMGsRsiSFht0/YjQp2fNFlsSNiTNiXmTXstOiUlD15O53qGMI+mEKGdqCUHx0xhf1qcD6wA2Prm09vQ46xrzOOI4glEvYMVJSUff/S2FhaxAlN2MUMNKs/FCL74mtDIE/gD7fR4ZWpZ8TtRkfCfu2x2FJXtTCz8A6i7GDot5qmnr3bZxP2reGN8RP2E1Je8YArVmEvyVLOuNG3C/sQTupV7J2FnUkKLOxOCvsGTdjNNaeIJcIOv4ZVNwMt3W6dpGpiLGtOrbWOqxTaiB19PSETdquw62yvlS/n4JwuL2bjA7Xh8j5uYWecRxBLJOwnfGJIxAkUdgL6HCcbjeAgFN8mEQFk8e/w04GwA8GhTu2O8A54rNaeIvdswi4+0kcjCXvBHWH3pMSrg1Zhz9MH0x/wlJNywi7sI1LdMSxlnoWdSQos7E4KO0zY1yJtah1Bjo0MO/iz2RETnLuHhL21J2a5uXFSc8RuRNipJQZ9Pc4bJw3cuTP/2787KYZJNoLoubDvNoT9oogTLcKenQEjB36QdqcWfpCwi9to7Pe/dyDsz571AbcygloagfpWgbxBX7/eKuz1QNjpo/WwJWbWFPY3obDPqy8vpSymHBF2MPVhL12VVmEfC3Y+ynm53aWKhxRlsfzBFHbkEFa3n4IbRljYmaTAwu6csG9q1jqC6YYZdorEAGYmZkVz4ySC1FqT7e5m7PQSMBIxxO8Tdi3DDiQgEsMw/yWCiUBWPLg/8/JBm4u3nz8RHbLl6fQWQWRn376Gd3Tp9duDwiBL58z8261Re3uklL5wRNhxT1IpSxZhBw5LiddkhaLqyG6VlwnBgpj+onqQrHos7ExSYGF3TtjB13HCvnGRSIw2YCf0Hnba6IhqXnowYjcXneKvPmHHEbvyddPYwzWnG2M9YWeY/xLBJJyrYLYZV4Tdq0rgkNkSQwXsUwUZcKzfQ3L+YNEi7MHVS+qTPok+CvsBFnYmzrCwOyjsqOzK14GWXkfqYUdQlo1EDEGdjF3VOtLtlLFp1+qoZ9hp1Snquibscc+wM8x/iWASDphtRSyNsH+Ymkp7Bq+mat5ijF4sb/bas/lyZfeoF4VXu8f7cx7DJAcWdheFXe9hJ2GnELt1xL4Mf40QOx6Qrq3dzLCr/4x8PVR2/FqAnmFHX0dlj3uGnWH+SwSTcIYr49meCzvDMCzsbUiQsG9SGycBkGGnRadGraORiDFtnc5Idyl2Y9mpvSdmhaJlwK63xPCEnWFiimASDtr6Ek7YTwSHsakpGJ5P9YNzwISdYRgW9iQIe9taR1R28nVCC8RoOycpR6dgTNcLTtXAXsdccYpYWh2B0Nd50SnDxBDBMF1k2Hd6ZwuFE165UEh744VjnudDhp1hGBb2pAm7mWG3j9jtGXY07i73OdXK2H9juVHsuBJ+FNqaU6BZEsORGIaJHYJhWNgZxgFY2J0VdjB2PRKjT9iVHutbnapIeWsmpqtFpwRZP03sQ8L/z2iJ0XvYydjXaZGY9SzsDBMvBMNwhp1hHICF3UVhX4++vjFCDzsYu7WHPfTr7tG73O097MGXIGFXWCMxaznDzjDxQzDMX7KTYZglgIXdQWHfoLfEtE7YyYm1CLtl3Sm5unHs0NXxaOZhzERMsyQGvqO1h50jMQwTQwTDsLAzzE/27m6niSiIA3iKn1UuvTtHJKYn4fSiYKqEgxskekENtSgGPyDaKgkiifc+hC9hfAZfwedydrZTTodN/dg27uL/148UbNd693cyZ6YUTLk0yqEEgT3adBoV2C9mdEsM5WdNWlkKpHUicf1sbJ87uziJ6b1JmMMOUF0GAAAAgV2RHvY0rxNpiWGXWH6FXYd26TknhYc66hZ2Nkd3EW86Tb9fNNUxHuvIBfYbCOwAFWIAAAAQ2JU0sF/PFp1KT0wU2PWmU7rJ2qQ4rGfVdXkqpiY97OPmoikxqoVdt8RQYsdYR4CKMgAAAAjsilTYObJLXtctMUwV2DlD65aY4hV2eejVSaqFXSrsOXm9jsVJANVlAAAAENiVUWCXjhhdYR8m9qjCTmr60Cndxue7/H11XR45FXaV2C+KscQuPeyosANUkAEAAEBgV+TQ6XxKNp1elikxcWBnp1uT9N6kYW6fCmmJoef8EjtLv1POptP6lVGBfR6BHaBiDAAAAAK7Ei9OikrsatEpBWM1JKbGd4nqLFp4VHzTqUrrqoddIntegV02nV5FhR2gesz/6tBvtE9uGgAAQGDXhodOx+ew1/Wm07jCHnexC6mGR9PYi29O4utOqLBHYx3zFyehhx2ggszsNUr5v4IjT54YAABAYNfiCrs0sV9JqbGORE11lAp7FNql/7z4qVO+6xI738YTu8rrRAf26xjrCFApZja2+/3nhjSWu50QOv19UzaLzc22928MAAAgsGsS2OdHcx2lh133xGR5XY11FNGmo2J7Tuku1JlTepySHna1OemKzGHHoVOAijIz8TSEsGfI8zC02zClc+D9gQEAAAR2JV6cJD3sqiUmf29SjW9xRww/ouRdgNTr5eqM++bVXMe4hV2PYUdgB6giMwuNndPA3jnYf7vZCeGjKZ1l7/sGAAAQ2JV4Skx86FRV2OMSu9BTYuTGab1IeZ2fpIldnTlVJXZJ7HqsowT2eWw6BagYMwvboT8M7Mebi4bc7ISOKZ233u8YAABAYNfiwH6V1UeLk/Qc9kxUYlcNMVnclr1HfyWe5q7pxUnSEpN+x1Tcwl7POmLoXuEK+6PP35QfX5fs1DXvdXe3b1mAcjAzsBDCrWFgF90QyjeRBYEdAACBPQ8H9hvRodM6kTOn+QV2ies5u04LLzoV0hEfy4656kOnmfFNp1fOSQ/7j/tnfbF/YKfVGthfOH7m2MaeZZ1W66kF+HfMDOyGg8bZwH7XlA0F9pcGAAAQ2LW4h50Du54SoxcnRZldh3V+onshco3axJ4YyesXoikxUmKvk7Qlpupz2B/dz/Hd/oGXzm3ayT60nDi0qffOLdsZWfa+awEmM9O3EjpWB/ZStsSseb9lAAAAgV3Ri5M4sNfzxjrmTWGfy5kTQ+TpL9Si0E7UXMe8lhhySU+JuZpV2OnfdK3CLTG3Cwf24NyKneihcy553f34qU0vHqzZ2Qb2feceW4DJzNStdcLAqMC+EkIZ57Ek3pev7g8AUAqNcviXLTEy1lEfOr3McZ0TexqPCSVlNYddsnp08LSQmvTETOyImctpiWHcEZMm9vnKbzotHtibg8GSnWTFOXdk2S69PLEI7PDPmanrhr5Rgb1JBfZFUz5975M77zApBgAAgV3hCvv4plPJ63pvEsudEqPmOhY6csrP2dV0iZ3oGjunddUSc07msP9WYF9qWta0p9aiHxT15gfOPZTXH51rNSWw01siC+rTE36c+J44sC8sWYA8ZtqWQ1hQgX2xH8JTU0bHbe992wAAAAJ7ZHzT6Xx86JSc3ZsUbU6ie1xg54f0nxessGfX4dukM6cc2HWBXcY6cmI/z4F9Kzmxod3qUUB/t+Gcf7FtU/uv0q709fdpRu4mybFdTUZ2Lek/aLnWVt/aLKPftaLt3GEW2N8ldIVnqza18HDd0duO3lirPn2QJM39O971kuStTa1tJHfs+Nc5Sbbs6lZr3ZKdxNOF6EN2KSTpNZ88t/bugyTpWnK3nX5ZAGumbLETDsx4YG98CGHFlNGe9773EJNiAAAQ2JV40+lwcRLTU2IksOdX2NUIdn5RcLAjUxX2mh7DLodOJbKfp02nvwjs667Xc8717HLiMnv023stx7ghnQ+d7jiRVtObvdPX9tC5d3bkuXMbHNi9y7ynX96SH1pvrPo0XXg1/dsO+Z1klX8/9nV6bj3QSw7sn1zmlt1yQ6v8HVvpTMkXzj2xANMP7Jsh3BsMBish9Af7hu2FsG3KqLHh/b4BAAAEdk0q7FFg12dOWU4LOz1Uqh41tBRcncSv+CH03qSMtLBnohI75/XzXWFfd2la9mHJUzoP/Vf0w7a1G5R7d/c+0R+FYWA/PmJpSF7hXLx+snvY4pD9hH81QrXzNLCTn+zdS09TURAH8IhP1KU7husjnqR00UoopA9SCC7QtLSIoWqJopComLhwx4Y1iXFl4gcw+AHc8BX8XM6Z04HT4fqITdVb/r++vKW3vcu/kzlzliuVFX5pEz3xPzFXmeL3yJzd5qjNxwuvnZsnj9P8U4ovR95i1Q6x2Zf8nfWXL/NzfOLW3OYMvxDRA0nq6/ypPAEQ5QEAADImGbK4wn5JpIx11EWnYkxxfrYzYvzr4DSw98+JGbMbJx2V2E0Lu06Jkbye5Y2TfhnYnZsuEd2XThapb89QqReeX0sKjsY6TnKOXpNVpgt8Dj3lcF4mfm+SjvjDPG2FoC55vJqjeedK/vSqK9iz2z6KPyTphPfl91zB1c3lSGBfeEaB9rA/CdV3WpZ2+YRT/+ZqwV8qAAI7AABkUDJs8cZJvoX9Uq+HXVtimOmJ4btunKQ0Wkdhe7Aau/6TmY4YZSvs8cZJ3mloiXGPw2u1rAXu1bIG3/vbWmEPVkIby2PJ1iGObxJ/mCIz/uNbPmjrYdOH8XvEmtvbZXM2P4XDe6EnZsO5irkc/1QlMoH9rXMt/5k729tdklacwrxzjwgAgR0AALIoGTKdEiMV9qs/aYmxBXYWz2HXjY50zMuAzhzf1Jg8+ivsfFEhr9vE3ltzejXjFfaDXfaFtzfdPax93a3VDr7EgT3E5bJzU23Bcbrtg7lbeCMxPQ7sS70O8Tp/RlR83K+G8rma9/3lWz6mi6bP4RXfdrO0UaKTZ7d9A703Gcr6/Pt5ezktyfsmsBd9S3znVUJCAjwa2AGBHQAAMisZNgnsTHvYx+M57J7OYRcSlk1HjNKZjAONddTTtccmZlvYtcKuq04lrkeBPfs97F/e3y29/1zb39/bq9Vufau9+9bfw07sjou8pSKH6jCBJQ7saxyjJ0Ob+rEZX0PvpvSwvyZR9Kl88rET9bUTZ7elKq7N6/6vK/Zy/F+6JrCz+05MbeVJzPNBQgBiAkbCEvwL/+dqaoBTIBk6u+g0bHQaz3VMLbGfkYdpYpcnMXBqtz3s4cc0r/Pdk8ticQ+75HWJ7KPQw7773nfBHNTYt3df5EBV3RSxWRfZJsptroRc/eY4sC/2hrzYyP1EArTqSqF8y4dv8SyUvXc6Vec9yJ0M7E0SGz6bN6Qz3VxOK6rha2Bnr7fnnVddJfa0IHNnABgC+6hYWnqB21+/NW5PAMDvyWJgvxY2TmKXxo8WnZqxjqYjxqZ1fRWDdbGbZafpc2LOBlpgt4l9fDQq7CGw1/a5uM7e0UF/YK8Tm3RumozufZ+xP2pg9ys6GySmJOWrpqwrVS3+JgnsGyQaPnGL1U1ft2+bs9v6reE/Dx1XyJnLke8kpYE9yK8vy1BKVnfeQwIgQmAH+HO3EdgBflcWA/sPxzpGFfazR6KGmGjnpJDRtTFm4AWnoWAfsytORcpUR9bL66Ow6JQDu38uvT+s1T7ToQ3sXsHNk9hotbrPO50uMR+CN3uBvTR/3Ei+4tvUvdVWqym9KBUSkqbdqgT2xySm+bTSdKdJ3hK/bc6OAvu2c8WCmz5xOemBfavzhrwd56okLezLa5jqCAECO8Cfu4HADvC7sh7YbQ97eok9vYddEveA+5xGw9hPGDODHc/xPYjWnLKjITGj0RLDDm/t1r7e3PucFtg7PpqzUtW5ZNa5J+S9cK4pgV0r58GaxvFl/rv0smgfeqMQCupbMq+dFfmN1aP83eAvMWdHgb3o3Ir8lrkcDezdRuOZf5FGHZrxf2E556akiaaQEJ++TACEwA6ACjtA9iRDpoE9Hut40TMVdh+PzVan0lLe3xMz0KJTpalfK/Y9vd8zU2LMHHZJ7ONRS8zlEQjsXz8ffn23W9v/cDj5NSWwX3cc0heTNY7BD4h87H5K+U1+zUtg9wm80AwWpaY+s5PfeclvlinMSV+pdFfXpl2ocfPH2aPi6mZBsv8Cf+tsubwzJQE/PlsDu6j7009ejgb2+dCj/tEvXp3zJfWp9RI955A+Tfkqf3OYxt4mAAR2AFTYAbInGTadEiN5/eqv57DznaXMYe/l68HFs9zT57D7i9DAHqS2xFwalR72z7ncXu2ADz/smcAuNl1P9bovoaslCoG96pSP1IsFJzRs33dHlieJ+XzvgnpC1NUDt1AyZ8eBvSIzYezl2MBOcvr1ST4MCkX/iRaxJh8WCQCBHQAVdoDMSYZM57DHU2L6K+yaiaMW9pR1p5rVzfMfZnV5tv0wtiPmaEgMX2PqHPast8TkDjms80PJ0QGpqlug4Hndea1nxF715q9USHY06prATkkYIrPwkIJGnY/ZVIWYBPbGAwnTT3LEFmecHL0skTm7HS0UzcsiV3s5cWCXOL9W9YGdrnecWCnSnDTEeMv8tQSAwA6ACjtA5iRDpoHd7nQaFdjPBbYlhvOzpa0sA6R1pnE9vNoSu2mJEXbfpBGZw06faicc7lOa8p1Xi5N68LHxaucp/USx2Ugo8rr9aLZMsWSj+YxUMvtq7nnOnK1+eTnpSs/Xm4tYZQonIbADoMIOkD3JsGkPu+R1pi0x4rxIr7Db0K4952zgoY62hV2M8V3FO53664umOsZjHaXAfi2zgZ1u7hn7ZQIYcRMAgAo7QMYkwyaB/UrY6FR7YqLAbnc65ZtumxSH9VBd16fBnNEe9n5j0ZQY08JuW2I4sY/CWEeAU2kCAFBhB8iYZOi0wi6RXfO6bYkRpsAuGdq2xAxeYdeH3TrJtrCL0MNuW9hHZOMkgFNpAgBQYQfImGTIosCuHTG2wn4+juv+5p2xi0751j/f5c+r6/pIqbCbxH5O9SV27WFHhR0ggyYAABV2gIxJhk4XnV71dKfTCzolJg7s4njXJLtvUi+3D06TO+Pn9BK78NeUstPp+MWjAvtVBHaAjJkAAFTYATImGTKzcRKzU2J6Lezn7JAYKXlrVA+iDY8G3+nUpHXTw66RPa3ArjudXkKFHSB7JgAAFXaAjEmGThad9s9hH7c7ncYV9riLXWk1PJrGPhAd6Bie0yvs8VjH9I2T0MMOkEETAIAKO8C/lF9vnrB+/T8I7KHCrk3sFz0z1pGZqY5aYY9Cu/afD77qVO62xC63/sRu8jqzgf1Klsc6ApxCEwDf2Tu33USOIAwriXLOZe56FqyIkjyo1Swe2zIEgUUuABnwSTZga40PEuxa5Jo8RC55gSjPkFfIc6W6ego37cHJ2ngNcX+7BmYYmp7ZKPq29u8aj6+wezwvyLmCJPaXQth/mPZ15Ay7m4kxvu60dWSsOx09RdlpDMZZc4o/d3CG3blz0tfch90vOvV4VhTh8Xh8hd3jeUEOIZEwWAZhR1/nDLsTiUm+b5Ipd9uJGPqxzPsJcL2eRycoN5/YiN3outuG3Qu7x7OKCI/H4yvsHs8LAnNIv7ywUyLGXnTqVNjtEjvjdonhX2TrTymv0wOH2J01p06JnY3dbevIwv7Dat/p1ON5hYjXTXCx1UwJj8dX2D2eFwPKu0wZdpn28gj7N8Q0w/6l24fdYJXYnUCM0W2+79GjsLu5u7g3TuJIjJ6jxo6wf2sSMfjbV9g9npVCvE4yqcvz+lW3DABN553358O9A+Hx+Aq7x/NpgEgwEQim9/LC/qO16PRbhNecJhfYWdcT7nX65BudMpyItzHLXN1Fp4bZO51+7TPsHs/KIubzZnh92rrpbGWEQ0nFlNsfxHzeKXUkLHoqFMtAdvsqUmBwfX19YN4pNsSjOVUxYavghe5/ja+wezz/a2FHqXXasLOxJ9w4yXJ2V9bp4am2zmN89mAmhn39C6tLzJcciUF0JMb3Yfd4VpD5WvsrS210ImZRcEdtvrJcAtSFRQuUeHmyHZp+sq/nisBEm4tYPxWmxXwq4ZV4afbrS5EIStf3xQriK+wez/9f2MnYjbB/m9TWMakL++cJfWIQfniUrs9EYpy+jomRGDR2t0sMJmIQHYn5zkdiPJ7VQszhrAx3VANX2AdInurUjdUS9mwEiDosAXEibLb1W/n+bqGmAIoXjxf22gBphdr7xXwUHIoXpinlx5xmfTQ6E89BV47FY+mMRinxEGoUCRtfYfd4loulFfYfua2ju+j0K9J1MnatxwiastOHnV2dq+xPrrBzJubBRMznCZEYghIx2th/8Hc69XhWEZHMWwVIt9NphIC014SFYvPO3AColRL2zRZAOEyhZ10MywDF9Ix+KYCyKay/x5fR44U9ttomAFwutbCHUomPoCHlW/EMZEay9y9GPwnFHHpSpsVDjOTsZ32F3eNZLpZW2NHXZ+50yr7u3jeJSOwS4/R1fNKSU3o0o7kldsStsZOtO5EY34fd41ldRCKpEmjO8WUNNLeusMcUrcZb64IIHGFfTxB252sDawRm5zlcKGgD/JrlYvsA4FRYXANU+FtTCmBLMOsP1VXX1pOEnegC1N1T5iFnhD2Dm4smuBT/RkrK/jIIe1/KlHiQktxYQmH3FXaP538u7PGi0x/sRafI/fsmWXdO0r8Nd3lzzp8/scJuxqFfc9ecsrC7BXZu60jG7oXd41k15jgQENukn8RusrDXAD6IvVJ5PTcIIYvmFSmA0uANC/uwggdXCjPCfnlYBBXdUtG+XGrmanrzvdDPENZJX+slAFCtLbFgrgB6lmP9OpNh31HatJkGQFmIg1LphM/BkDoN8Z2bA4GclqrrA5yqGqwlC3sd4EYg9mXhq1XCD+LDnhC5UwUA4W0gFkpv40T8CzdylFkGYVeo1M8n7Lmz2fd9hd3jWS6WWtitSMzXhNslhoU9ucLutGCnF09s7Eg4FfbP3DbsvOiUld3f6dTjWXFEEmlrRWYERC9J2Ondt6IPQHeWzu7UwKCOjbCHYGgFd8LeAENFSy5AN27LsqeAuMa9bYj5IBZKSkFl0w7IhFBMCWYP5ySmBAog45wD8kEBobSxlyEqA1FKFvZbOp+Zy8JXi+lT/IioLFb/dsf/auxj2f2I+vFOgrBvzh4TzGxmdpzPzxn8QMqT5PF21h4W9s1ZYQ/mTs05gHkz/5Kns2JKNu0r7B7PLK9G2L+3hN1dc0okRNjxx7Fqcu2nJGLsPuz0w7j3TTJwhN1gldjJ132F3eNZPUQSBTAM8XUFCJVKEvYDAAi0giqAYoXEtDek2HtKCztSbhwN8Kk7FfYmgKo2G0WTEQckqvdD8tX9YZsy8R/w8fb8KKKNRbLvrjJt6nNkOrMraCOAnHsO9FeZ06N6BUChK2pbL14ftYGHcYQ9E9IXzl4WvlqDAT4OBpd6lNbw/FpRfOaTGvu5lO+EmhRpozyZpAVyNQGtqsflsZTjyiUdN4Gds9pYpljY9ycTPJVMZyKl3CgfC0RNBpelkZTQDQRxUtyQOMIgY8y7C3jopGO2Uoc4OJxeCENejmjvYKzHC2k8mBydVfQUGjQ4jjWZXAmbTA9wr9pjYd8tjfDDVVJ8e2p4Zl3aV8UZjSrplt48xrNthnq+H+b4elTLTn29FqV9hd3jsXhFwo4V9m+IOW0dUY6dDDv6s9sjRj8vAo7EmHHZ190bJ3GJ3Ymwc5cY8nV/4ySPZ8UQSZyCoa9Lm2A4vi/s6X4RoEwKCsUtMnSV0xrTBmjTpsmIXyqAi1jYAwUqrWuTFdJaANAWtkk+bCz5QNyY9Lyo0ccWSM+91XXK/qeDAdm1vdm8dw6HcdW/CtAgYS+va3+lg1xhz+7h+yrrXha+WpxhX4vr8+8AagL5hMZelkqIUEo93TdSyoJAJmTPNzLmFjcKUp5o+2Zh70jKvldkjI5OoQtLw/hC2APQyZ2NpQG04m7Hh44ueMnpQP/nxAPIPdySshZvd/XgRDRj1CANEyPsV9Kg1oQzNZNh3ynG0xvLohAnUvIMj+YIe1jLsq+HUdpX2D0em9ch7D9O2zqi6cYZdo7EIE4mBn/zjZMYVmtLtp9WY+eXiJOIYe5X2K0MO+IjMR7PaiKSqIBhH1+HYBjawm5xZhQ0bZIs9WkaPCBRXeM8eC8W9iMaFUmT5AIUM6SOAG/iDMlbcQ3Q1XvfV6s5sUgqUHH2FCGyRXtLMDSVW/ccsqTcSKYIIc2aCs4BQGQLu0XBvSx8tabCnuHofKdKh306Y89KWSf7ruLGEQkx7Tw0Sl4pdEr4NCRhH+FvtWOE/Rr3nqN2467qyX4oyfCpnJ7fz4/wCf/w9qTciBrNvCSbXsO9k149woNalICRh/WGwg+SEg+NceM25IcFkFL/KZF7X3eKNEC+jQO0231hoT9+ut+bSPMVffzCQf9qLGXoTs0IexE3BjQ/I+xI1Lma4HTFw8aebaGv+wy7x2PzSoQdfZ0q7D88EImxCuyM3Yedb3TEbV4WUGJ3F53Sz2yFHSdlfN019njN6Q++wu7xrBoiiSLbpmXnhURhD7Xi9mONLQHEApNHk9WyOxAICy0J+w2O1CcUFCnDHv9PWtFzXX/wgtqhN9+IRVOClrOnBWX73xW2BUMzPXLP4QNAu0+UAVIo7IovWCVR2NX+/cvCV4uFnRIzUeNSMJ/M2K/kRoYMXelZSGO3BV2VDkZx+5gG6XdBv3fMi06rqMa71DtdNoWpZr8jYZ9ktd5OqFKfN3Vy8auU+1T9Dtdw61LqryxRZJ2OoZBLSEKdoXmQ3I+NsNfi0feTMuznOLO0PrxEwo4zHh3oTYVTdKZGwr6Fx+tY18XICDuX1nFz8yFjJ19P+S4xHo/DKxF2Unbj63Yfdg33YSdIlp1EDMM9GZ/U1pE/zhmbeV0d7Qw7rzolXbeEfeUz7L/89qfD33+sBwshd3R+EHg8y4hIIgJDB19DTHNG2G81jWYuI4ywd8z+8C4O3heXd5ZPck7CHsEdSo+evyfs9HF4jr4pERTv1dwP7b4wHWftqHsODbB4i8IeJgt7/lbT3w0SLgtdLVvYD8qgUa1dsXAybVl5YMlpOy5Vr+kkTCglKm9FK3VHyvK0jj0kYT/gLjEDlPdcHHqJMtrC8/n3KOy8HvUtmrsQgzgZX5eyQVacps3WaPQuxdmWzJjUPI1foZ9gUo+nNSJh3whiMb9KEvYyd6TMkrDj9xR4AeuhMzUS9grFY5BbFnYzwTzPO9HYW9mU9nXfJcbjuccrEXa7DzsLO4fYE0vsn9GPE2KnB+LJ1u5m2M2Xsa/Hyk7TQuwMO/k6KfvKZ9j//vk+vwf/nX2lLoMECmUFiKqaWStV/ZgBPZ7nRSQxAEOt2exDzJabYWdI2LdtMyXvrnMfdv7ERwi7eFctAcI9XBaYYZ8dcBOgKphzsOydkipr7jlcg8WH+cJ+Jph7l4WvFgs7kjmqKdA0xILJ9GQpKxKh1Mp7gVzrgveOlKjGHW23FSqe7007pN9oYa9wW8eQUjKad7ru3jqKx99ATTdMpm6dbuY3tLBnyI6ZbRytTgC1X+9ZvSXXdjEEEwt7yK3ie3fCno+IQ/qWzFTd0+JUyts6sSHHztRQ2DmajwQs7OZPvkCnmkwKa+yH4WHK92H3eGZ5LcL+o7lxEoIZdl506rR1dBIxrq3zM/G0FLuz7DS5T8wXhpkCu90l5v9QYf/l5wT+CpKphPetuwOwG9wj2wJGHQcIwGnwEA8POH86Hs+jEEmwpasoqvDL7IPCfiyQcLr/Ru+5vLNhgHIs7AOAHcHMEXZi/bxNK1EXyRDgyN3RFEwWAC7sjjKhcM/hhI5n/puwu5fFXC0WdibXKQJA6hP6uqhIYCWuiaaUGYVafkZJEbTy+HPvpYy01F6zsGvGa8KYPjGpBiTsZb4q9OHNG7UhiYYepGUncSy2tE/nBbFXGUuEhb2VIOwjabD/gjDQwh7KOzacqaGw28dvxMLed4Q92djR130fdo9nhtcj7HPbOpKys68zViDGunOScXQOxjx5wakp2Nu4K06JhK6OSOzrq77o9KePEXYFUeCQ7NcHRQBoF3bPrxSAOgsWL+w8HY/nUYgksgq44psBw5X4d2E/xGd2VNDdUdhntwHasbDXp/XlXvd2jrDfnjZo4xigKBZJNpyt2W+WobgzU4Cv8eugSBN1zuFg2lWm3j39j8LuXhZX2HOnpzkjuvzXiU/j65scIhEgx6ItlbhBU65SPibUj5wwKWupHU6FPZxI2RZELj8xAp/SGsyXoCLlhbjc0OY8Kbe0sO9RqxfmRlpsa3U+EJqIXF11xw8IuxoToN+f3I2XFkV5x8iZGgm7fJSwH2ph93c69Xiel2I5kyDsXcguk7C7GfbkEntyhp2M+4n3ObWasd/jc6exo+41abDWnCLTJjGrHYl5HmHvAqi39OpNGaASeGH3LBkikV/dDLvK/QdhHwKEa3Ef9zLJrsmTBCWAk1jY03hMEKt5b46wRwCbJJxky4vkHKC3ZmWUAQq2wiqAdtwoPKRTuHcOYVyEzwGU/qOwu5fFFvbIfMUNX/STT+fr4lpuxJeiisY7kT29LvOdojaMLR3s5vzKgKSWhb2SeS8tx905qeBmpDUY7tq3ZMQYd+JV0GM2ULrZ5lPn58HQuDJTktO0+2g/0BdzrrDbkNYTLS3sNSl3BONMDYWdj6cBHWF/MBLT0hF2X2H3eJ6VW0gkL5ZF2P9h71x2GjmiMKzcr8vsqmg7EUeyLdRmxhf5JoOcBViYS7CwsS2wGUvcFBZZMZtZjxRlFZEHiCYPkM28Qp4rp071ccqVBiaAI8ycb4ZuqmkXZW/mm6O/T6Gxu5EYt8Ju9Njb6pQi5dOZmHs9dMqw9XPFPiL6fV6XmOk+7IjxdScS8+XTFvZMXhO3Cnu+pC2nAOGv/OoQIMHCHuSnJtYxozhhz8QO3eWUMloQ/gMqllLOE/ahukXYuUacHpSyx0DBlhEg41FpUCe7JWGnWEhlL5N9Qc0M44X9hZkmqbJrAMfqYekBbO5wCqUG0GDj4t8OteZq6awRAoTLyn8PZPxh+TBYTwN030nY/Y/FFfYKhMNiSoW4jB2V2sVzST0gF+zr8VxNYiqHmHghbX1uzmV6KWo62/C6I+wk8mMbimlsHinDGQ7xtfxcaQbF21hxyBn4JjVpX+Tqe/twUqFvYhg9YHPO4Y9Yxd9B2NO8pkV6ohVXdqKI/VzDWxoKu3P/+EZh9309Q01ipMIuCLNkYf2H3L/pBo9B2L8kX//6Hfqwo7HH9mGP/Pr+uL3c4/uwm0WwsFtiIzGfz3mG/TZhH+TMP+H1odb9Wg0AarVBrlaPvHuztjnx6519U5sbH9B1gIZmjgG6JOxtEwuulDVROjL/mnc2NJHp4ShMl43x84TDWq2ewHPhhwqEuRd5s5haLdN/loaEdpaD3+6HtPMiSnu5VttMRa/uaUG4DhXPQRqQdK/XAcN48Z2EPVuBiHMru0zYZ2E3MZSI5nUZdl2bvG5HPSxBCFBptvMqmS3jYnuecG2EwNR2VMx7UMc8/OHdMuz+x+IKew6QoToBpqEekuKK9fXVLZdDFUH7JbG7o/QuotSac4kU3sRaoj6MGV/YF20ophIF3RcpbfKcq+hr5ocb1M3d3tokWyaD3qGAOV7LRvn4KzVGl+fC/ILtyn6bsPP/BCCpkAZ1iUngXFohXfz13tJI2Nej+0+fxwt7fJMYbusoFXZBeGQEM4b7sLtdYqYr7OzEToQ95rlTdnXveEdXp6Ofh/ETMZMmMbjG2D7sTzwSU4aIhi6AZXsLYKgNfYAt9utiyBECHFQAnLUuLJSMsKfBQh6dZTXZ08ioApZ6aSLs6zjcxfM5WFbQ2LcB6PeQx/NydCHkW0o6gzMdmfnBzCII16GuIbEJ/7C+qG4R9lVF6P2QZLcQye762MptRrGwo+Qc0T0VymsD9KYaLm5TETrzDBAqhj8wXSDCCp06SeURbIZgqFByht5D13kPSKtCE1wkSdhrMcK+BpBVjP+xuJ9Wtk7Crlo1MKTX1UzYW3IZTYQdFHOM18PIfSu2TI1m3U0kXuCFhvKFHTUeL1ChvZVU/Tp1TDeZ9fSg1M7hOVAlPA4Xg5MrPO/jPXjq9JNnVziiBT1vHiSaGJu5UJd4hUW/trM46tiNkHxhx2mPTg6VA851tZcvbNH9tOLLk6A/xnWMvKWRsJuQDnQH4x+XYoT99o2TpMIuCI+LYMawsPs7nToFdhZ2LxKD/uzDUZZ72DrCum7Pfondi8QQ/r5JT6QP+83CnjeC3WoZjcgGx8cAlePj1QJEUZQxwEbk1wcAsD8srwCEgS6ZuK4H6XhzHW+AQ61TadTr8nAfzAzaRGjTje0tPHVY2PEIA3zdLs7Y2D2vAORI2E2hcMXkXybL0XUUnN29ixCgbD1+VadqpqwvCNeiriM5XAHL8Uj9BxLFZddiFgutrPLJDDYS6kaSp4PiKKUemi441PeSKoZgr7nBv9m2dfTeg24XD+gt3v1j8QnarfaO+n9Z6irmdMla8fIS1cN5H3+ivugLuzX8y6S+4nt+PCRhZ9YpsWK5xC9wHjS9Mp/CFo/SJrQSaXibL5ppB76wN5aQnHJY5o4xVtgXgAdHSrlLY2HvX0bTX8YKe7yvE5k1NHapsAvCoyKYNZxhJ19HOBJDsLH7FfY4aefMOXLvpo5+hJ0wO6sy7k6nZn1TXR3Z2KMuMd88TWEvRgXxMskwh8bTUQG9AhX26x8AilqTw5/rEcAP2gMAnmlkjermTYAxzU8efo7HPI6WAcKUnfAFflvASwshhAd4zqNELRthh0pbW3g5eYCaRk7R2zVNVsk3zPeCcD3Kx3Xt4Xmj29pRT4aJr1d+6G2PkuoWWNifJs+1mnBJ+XGy7kBZjn4k3+1GUluwH2CUo1nEFzxTweYSUTu0bR279JKrVcqk1pcMm8kVEnZ1ZnW5U1KGXRo97yVVnUr7xDa9/HKjHwn7livsuu4LuwrS1InmWc+m5xd79vXrCnGXhsJeU0g+d4lvqJ75cSlH+zG1bhF24+ts7LmEVNgF4VERzBoS9q/sRqeciXGE3d/pFP/wtkmurNvqOh/uDrs6HSyur7OxexF2jsQ4xv702zoWANI7eM6Mx0U9EfauLV+vAlxEwp4w4RhDykh8K6YlDECY0cgAjZ5Uv6QNWwA7OMKDoROGWZqwgbefamSI3qANBwD7JOwHOoKXUwqj9EtzXNZIDgDtviJPoQo3od4jugD1/YvtQT9QxPst7EN1CwvFQUndTLLfaq3iTdyHfXTSTqqIYOPkgCL0Z9re2z45XVSM3rDb5K6PC4pZ7LfOzGT51qF6N/rTKZlgr7jjLW2aUgJvogdqbyeRURMyCcmwC8LjIpg5XGEnZWdf9yMxhFdgJ4f2IzH3r7Dzl791kh9hJ2yG3Y+wP5GNk76rvnmJ/IHbm758W/3zZbX65g8nwx4ChJvrWU2wsGcA6ng6Js8mYS8CrG0TdbzYBrzPgy/tADQoM7NN7ANs42hFMzRhDgBaNOgBdLeJECpG2Lc04S5nE3CC81W+mggBKWhBuJb3StiDwg7bpAj7g8LC/pgpX162leEZZXb+C9KHXRAeH8GMcYSdEzF+hZ0jMW6F3cqzY+zWr93+LnevrvNXTIXdM/aPmSlj5wz7/FfY//j5+/zPv1dfv371qlr97q/qT385wj6IHkV7dqgR7qO4RYXuCo1I2M/BoRBMZdiD4bDNbR0jYV8Gh4u+/RnTBaKS18jUhu56eyqZzsvJ1u2PN9uaKFL8RhCu570SdoMIu8N7Jex9DOsc2hj+j0n1n5CdTgXh8RHMGhJ28nUD73T6KXeJcYWd+GfXJH/fpMjbHwSOxOAxvsROmDXF7HT6xWeTAvvX8y3s1erLn00K5k0V+eunP2gwIWiuALGh/xH2NsCROezqSNgvwKGI90FGM2jZx56wF8BhvEFBeYaEPVczL0JWfGFv6QhnOalh1OLinIbH1BZPC8K1iLDfQjKbzSvhCQg7PQZ7Bc/poVipsAvCvBPMGG/jJMTvEhNF2D/2m8RQyZtV3eJseHT/nU7Z1mMz7KzssQV23un087mvsFthr77G4jryk37Dws6U2r0QoKLZkJE0DjsQTtqmt6y8M3WAF5rpALQ8YV/gEjhfWou+GwwWdBeHpX70X4RnpP7MNl1kaDlMv1kBgF+1LbCD7IEq3IQIu/C+CPvi2hJxWVRKKuyCMO8EM4ceOp3uw/6Fv9OpW2F3U+wMV8Odbuz33zmJ5r2+wu62dYzfOGn+M+wk7OaY//lttfq7fusI+0mnk9JIEAIkHENuoqWHVAO3wp6dGHh5a18bfw/Zsw8AIOMJO05U08Rga6uPI1J/aiHTthPqCxuKKU9q6r2tF/HCPup0+jSsAwxthH05DdDUgnAdIuzCA5E4TahHjm6dN4Z9dGypsAvC3BPMGLfCziF2kl6vrSPidXXkCrsj7STq91R2rtLHlNjpz7Sxe76O+ML+1Xy3dSRhR03/7mX1z29f/e4I+wvbrZGiKRlH2AOAOgB5svXrNMCpRvo2vl7D06G9s071c0/YO8atkTxtsZSjMAu5fcgTpmr0f4BDnGhBI2UcsrDvbGzgr+blFDhRc0Ryj5NdUEh+WQvCNYiwC4JU2AVh/ghmDQv715O+jpxh9zMx1te9to6Ms9PRfZSd5mD8Z05Z1g2cYfd2TvqM+7A/jYdOrbD/+fvbP396WX39y9uFP6faOoblQP96ZD28AuF2K6ORLbDdz9mv9/DGbvbXclTaHgCOG8VMfz2krZR8YU8AQG812M1Rx/a+GY3yZ2k88YTk3BvUJqbSSowuTN2chb1n28rwckKA8YHODCk5X8Z1pVDeqUAvCPGIsAuCVNgFYf4IZoy7cRJn2L1ITPy+Sbbc7SZi6Msx73vA9XqenaDcfGwjdqvrfhv2JyPs1d9TqVfVNzj85ZWTYe8As6ejni3bGmlD1LCF/foYCA6PF0JgQnRsX9j1ECIqCRxd8ChdiiZEGuTcQR0izrUn7LycXWAa5P59bQv0HS0I8YiwC4JU2AVh/ghmjtslxuvr6FTYnRI743eJ4T9k6/cpr9OBQ+zeM6deiZ2N3W/ryML+9TzvdJp6i7KOXwyN3ugJF9a86wON9Oss7LrCT4OuR9GYkwrZ+VFeE8FaCMSxvS3q+sLCrkdWxLdscOYsTaNexpmwhNfGuMAGTVQZahL2trbC7i7npGbdv6x1nVvFjKhALwixiLALglTYBWH+CGaNK+yfE5MM+yd+H3aLU2L3AjFWt3nfozvhdnP38TdO4kiMWaPBjbB/YRMx+Hd+K+z6t5iNTl87P0+dDk7aCe2RoWS6d22j1S85453W+S5diKe0fLK6oJl8m14cS6I4ONA38uvGydmBFoR3RIRdEKTCLgjzRzBjSNi/iYyddB3hZ07jC+ys6zF7nd57o1OGE/Eu9jFX/6FTy/ROp589jQy71t++8nhd0rfSBDjTgjC3KEEQpMIuCHNGMHM4w+4mYlxj9zdOcpzdl3U63NfWeY4PbszEsK9/5HSJ+YQjMYiJxMx7H/a7kE2NQkhrQZhflCAIUmEXhDkjmDH+xkkk7F/EtXWM68L+YUyfGIQPd9L1qUiM19cxNhKDxu53icFEDGIiMV/OcyTmDuQAOdGCML8oQRCkwi4Ic0YwaygSw20d/YdOPyVdJ2M3eoygKXt92NnVucp+7wo7Z2JuTMR8GBOJISgRY4z967nf6fQOkLCPtSDMMUoQBKmwC8KcEcwcqrBP73TKvu7vm0TEdonx+jre/ZFTPtrZ/BI74tfYyda9SMwT6cN+F5bL6yMtCPPM3+zdPYsTURTGcd9fU9rdMEaJQS2CYBdBxVQiClaCClYBESzs0tilshdbRT+AVpLWQkjrl7CwCYK9M+fm6JnjGDWzV/e6/59Jdl1YdsqHw3PPDQCYsAOZKZKzN512zKHTyo/3Jpmbk6qXHbBrh11em9MlM7omcs2ZUwnsfsCuax0lse+4wA5kLwBgwg5kpkhMA7utxBwUfkuMBvbmCbtbwS7ftFzsKNyEfbdfw66HTjWy/083nQI7UgDAhB3ITJGcTthNYPdnTkVDhd3edCpi1m7TiLF72OWt/L1JkVbYIzNil7zOhB3ITwDAhB3ITJGYnbAfEg1rHfXQqe2wayVGab7e1Z4G9vqemD31i5PMiN1V2HVLjOT1rC9OAnaiAIAJO5CZIjV7cVJVYT+06rBLJSbynZi93y5OUhqtTdhuN2PXb4VvxAg/YbcXJ1WoxAB5CgCYsAOZKRLTLTEyYe+sqcSYAbuye9j1oiNd87IFI3Z/6FTedsIuI/aY131iX5057TBhB3ITADBhBzJTJCeBXSJ7zOt2D3tF97ALCcuuEaN0J2OrtY7669qxsXyFXSfseupU4roJ7HTYgQwFAAAyUyTnD53Gi07tXsfGEftuebsSu3yI1qndd9jjH9O8vors8lgl22GXvC6RnQ47kKEAAEBmiuSkwy4XJ5UOHbaHTu1aR9eI8Wldv4p2LXZ37LR5T8zeqDZgt1ti/vqEfQBgSwQAADJTJLZ+reMB02H/xhRizM1JMaNrMab1gdM4sLf8iVPRsNWx9D2vE9iB3AQAADJTpOYDu++wN4/Ymzvskrhb3nNqlrH/YI9b7LivtibmgAns2ogpEdiBrAQAADJTJKaB3a51PFhxE/YYj+1Vp7FSXu/EtDp0qjT168R+ZfX33JYYu4ddE/thU4k5QmAH8hIAAMhMkZpuiZG83vmNPexaifF72Ff5uj27y715D3v1EBrYo8ZKzCE67EB+AgAAmSkS0z3sdktMfcKumdhU2BvOnWpWd58bZnX59H2YeiPGLIkpn7FxDzuVGCBDAQCAzBSJaWD3N52aAfu+SCsxJq17WmVpkdZFjOv61Y3YXSWmpJ0YuySGLTFApgIAAJkpUtMOu+T1klZixH7RPGH3oV0756LlUkdfYRd7ypeyN51Wz2e2Otq1jjJgP0ZgBzISAADITJGUBvaj8aJT7cSYwO5vOi3/6bVJNqzH6bp+tLNbO+x1e8yWGFdh10qMSeysdQQyFdb6MpvNlv2w0v3y5Us//IlPs9mnXvip94vFo374Iyfmk8nLbkjp1WLxpBd+qTsej3vrn/7lZDJ/FH7Do8Vk8n4cNnP7+q0i/NS9i6duXCt6AQCydXzlX0zYJbJrXveVGOEG7JKhfSWm/YRd3/7qJF9hF7HD7ivsXJwE5Cus068H9mX5v8/9rQvsT+aTeTdst8Behuf5OPzatHySF2ufpL8dAvvVM6cuBwDI2T8N7NqI8RP2/Taua4l9t2vExHxt97tsPl3Xd8OE3SX2faqW2LXDnv2E/dmb187LdwPgPxfWOrtcLj+nCOw6gH7a23aB/f1kMu1uENjbTNhPT1+9etwNm7j/4PxwdPPKnbOh2cPR6FwAgJz9q8Aueb2iN50e0C0xNrCL77cm+XuTVrl9S2glRj6bRuyieqaGm04PH/w2YO9kHdhfXvjR+4F3dzh8Nvhjb4fDacPPotGZm88HzS4Nhx8GjT4OR+2fwZsOjbcD7ARhrX4QaQL7SRmwb7fAPpYBe4LAnsatM6eiaz0CO/CVvXN5baeK4jgqvl26m6iJzAzGxajoQtPQglmo+MAqio+fL8QnuMhuNtkJgTLbkF1pmZB1XNgyLl0MDGSVfyKLQim23Xvv98xpbo/XNBo1Sb2fn206M/c1yg8+PZ57ruOWstoIO3xdVIlhYVdiLIrEIOTNqk4YBx4tf9KpsHWRw87Kbguw80mnD2x4hL2/ZeHn2fPtxlR/TIJgAWGPG42x2Ws/CJLQBPcMju3DBAr7dLtBEN7M/DXY52P2w3+ASWMndKw11wPqp+fnpy9enJ6eai3/7RSUiq7unusEGXXnQt25VJ+Xl6fnZ/oCqAt1VTWuLnwI+7xQtnrYi2PW3r04Rut2nI8Gh9yxG8e96pNxOhq0/Sth78RxTC26g7RI88Oar21bDdZuxWlOkXsaqcgT5KTzjSId8PWTvXyUxy3dlRlkXyVP/bFv9TCOu63DNI3VQ0yvbPyrXK3CGhlv9dK0V5kJewsTPVnlF030mns0cbsXa7o8TuUwHyWtrrpbu5o3T9WFhTd2gvpb9Q9+2I2csDscjlvLqoT94et12B+UJ52aEXYzi53haLhRjX35k5Mw7pwIu1HW0X5w0qbnsJOwS2bPowDquaCwB8Edo9efCXtzonjl+UCBx5IJi7NkcWHnNSwq7NGEOQj/AZ4PotCx1ngGlyc/Kk70dx8BdXDmc7CcOVd3TvUTuoJocuuTSzT/Dc3P5gg71FtLqPpo+1cRaaXDvopda7LytjbjHm6NKizsh/paW3ll9BVRqLFwe0BNa/Q7QUlKultNMrrOX/RmE5kpMDWVTf6kL/oi8K7GpJFbtCamUNeSvQIds1LY/R5P9CJWkXNX2DxWMcthb2HsTN/cU+sZqWbZrLHg5Sh49qM3X3rce/tFLNrWwgm7w+HYcFYbYeckdkivWdaREFUdOcJuSDtEfUllN6L0MsSOP6Kso+nrQAr7w5tb1nEVwn6nnHo7CKahBL3rQVAPbQyTOJyPXHk/SW5eNpr+Yzhh3wC8GT47+YLCzpxRY+ZpdfkUt54j7APl1vqZclsOphdK2PUDBhFolmNT2Dvqu+oFrRbCzgwq17r2KlLCEUw3nwJl9IOax23Z5yHsTKc6X9jxWwSTtTGoMZQxb2YRdp/nnQk7sOfffB3sfAthZySV54Lm557D4XBsMisU9keu6jpyDrvMiSFfF2UdGeOko2WUHWMwcs+pnpThHHZxctL9XIf9Nmw6/WvC3r/ely757jxh5zYs7OAgCJqWJR2p8Pou9xTdbff6ck3mymUPW1u7sPe50QKThgISdn7oWEO8GRew7zMWdv+3s7PzK2H3T8/OTrSsn52dXbCwn6hbikoZnD/H5Rk/Vb3nCHtFB9h9kuqE2lQzLeytTAs1pDavzIS9yNMsLYV95ut+oX9q7/WKmbBngwK2j65pr7unjTjTj7v6cTFIRhD2tm6WIrUla/GqCo73+3lGffGUhD3LsaqammiASUb5YNB70ZP08AppVjr5kzQRBdx9z9czxlgzwu97yUCNy8Le1Y1zTETCjnkLNnrBl1Hw7ufzhP2754M3v/UcDodjk1llhP2Rqxx2kRJjPzeJwt1mRgy+DPNeAo7X8+gAefPWQuyk67IM++0W9riud3bV6wcQ9mkUBNFOT3dq1g/606ZOQR9O6vrukbp7XG+oH+vNhHtdCfvwFfWkOdVdTWHvBcHz4VG9vh+Ccb2ODPhtNZdy+Vdwc1CvD8c7keqOXJU79W31vVk/incjNW0S6s+gQSP097ERrXlsrFyPH4ehuVAeoMEdTWHHHLvheDdqXBvQPql8OWKb5r6jBpiqZ0E0UQ+Ter05xGxN9Q6OVePN0H59CtmmCLvvm3XY/eubTk8pmO6f0L0zavj0Ce5iqAt1d46wJ8pAq+UPaaWnN6C2laVWENkeVGHmFGKHUe/puH2Xbusn5Ou4hKp7aAphb/vVomywV6MYPfs7J8Ps6Wi1luIYnzwaot05huO+WA6EHSNryR+1btp0mlP2SwJDp4h6UqPPXoWyXNpYc1WWdUQjHeM/LAxh7/pt9TFqW6usB82IyzoKKp99qf5SRh9XPIfD4dhkVlslxtx0KiLsZoidkVVi+A9sfZnwOr5xErvYcypC7GzssqwjC/sjm3zS6VxhTwLiWAt7MyCGylFVDLyB++MoIF7ph3cC4oB7sbBzI5RrMYT9WLfpKfUNgUpq19Y71BofRmUOzjgIeNyjkHPYg+DNcsQDDI0hYfp8lYg1mAvFAJPyehL+QdjfVC4eYFXGgPZJ5csRAfFmOGwERNTD60HU6zo/37FqPIKTXi5VsBzCflMd9lMjln5Khv6iz00wVBVxdxZ2STXjXPGOdnVosdLtouKNSlEfaFPVnVPW89LQQY9u+Aim52hXCnv6IkLclH3SzQt0oMkKGprARHGn04FPk9Rq09+jBmbftg9hz1poUPxR2FXLqz9pCytuQ/Ih7IioH+qJ4OJ+ijV3KphICntOSTetEQs7xqimJPkS/wf83ap/+alvKcr5vv7r95HvORwOx0azYmF/AFzlsN8r67ATRohdJMSQbvO5R38Ls5q7RB6cxCkxeo0aM4X9QcqIUf/c0gh7fzJR4jqZJLQPdHqsNXcCp9bR9uZBrOPP+8cTmG8y2cWG0iH3KmW5pzX5eH9b9egbwt5XP0VDWHGC6zJBZgo1n5QlZMaBYvf4Th0GzcKu2Nk/Rvh7+/hoN8DdOzqWjaso7Is1mAvFALjUQj60CLtCdb42oH1S+XLEFP+aJkf6Ver7Y/27za56vwimPtG/jzhWjjdDh8O13JGwg3nCDlH3fqMWJ2XfC9z21eV5dU5ZRyh1iidIgakgJJ5kOglGW26F5Ju0PIVmC2FPK5wJT+Q1H33IvbtajSvQXAIeXikQjmcK3OfuLPwp/XS9b1XLNx5ZhR3uz2Qtf1Q2gmxff5qq+wm/Q9v/o7BD9umThX30JC5J2CXvfl3H39PvKp6k8urXz0dB43V3zKnD4dhsViTsj5bGDl1X8J5Te4Cddd1y1unSB50ynBFvQttc5aZT4vpJp/f/33LYgziE2zYg7OTTO+S/4QCPrTnsCC0j1WWKpzp4HSkQH9M5IkcYg+Lt6As9Tkp9H1NonULuhrBPQyg+Jc5sY/Ym/B+LGoo1yIWSt2O4I7L5qCQhYd8ehmJA66Ti5RjOYW+Wmf8NXGJu9T4Nl9W+BliE/URE2P+6sL94o7D7nCtelonRCjtIUecxK4W9o+Wbhb1m1pYBHYzrV3P2ZMphp8j6XqZzX9iMM0O6RxiJo+lMqenatDlYb/bt3iDs/nVhr3CjlKLj/JRrzFQHGBUZ7TZhz4Swpy0h7PKk051mFGx/xNcyZ+atZzyHw+HYZFacww5hl1Vi5MFJhrNLWce3ZW2dx7hrbk4M+/o9RpUYDrE/qNApMbeyDrtN2OGjcFAIO+S6p2PP4A4M2CrsQx1fBo2ggXszpmhMg+yQ3Y71SGgcxLhEIgmMOJkJe4MXM8TsJOV13RHC3RNrkAvlePgBFhwHMwboj+HFgJZJ5csxLOzb/L8JptOyRyPSvRyrR6TEPK0SKRaNsOMJDJ2FnW5f+CzqPn1KyKxHlVmke6B0FNULuz4i7E+VOzcP7cKuH2V8qxWPuAALlXVEhB2R9gKG7Hs5hB2Kjm4AT/OSXoWycyDaYIRKiqpvNl/YwWCkKfA9ryGy3iKP55SYlCd6EW/RS+HsSc2SEoP5aqOFhV1XidGbT/m/k0yL2XZVYhwOx2azBgcnaWF/0FbW0VaF/W5LnRgFf/vLoJeZEiPqOtpSYrSxyyoxD1CEXb3TQxudEjP6SZFvbeU/qROT1Ncotws7PJOMeQh5hU1Py2Hg1VZhH+uUFgDVRR12zW49INudIkjdLwPXz0OacXeCKTAkAvAHRg477m2TF9M8RHz0ZvBHYZcL5RyYIe7HyJ4hevBzaLYYUExqfTkGwo4mQX160A8BBN4lsK8JYtPpBRR8ToT9whD2c5/voe+l7/Fnuff0tz8V9gJuTuQ6jp1p/0XdmJTyV/jTIuxpJSExZ6qxvvsUCXvB2zurfgFRh3zjsyAZVvhGqg0uQYrAPfCpLe7Zhb2HLaTc3ccY9J2XvoccdnLwdjmRf7XmXkYqLoWddqh2i78k7CqQ/s4Lrg67w+G4nawwJQZlHeWm0/ug6zB2rccKZcqiDju7urHxdBm4u7B1mRFztyUlBiAjRhv7I7fgpNP8l374y69bvyi2tvrp1jCdV4edhR152HcoXYXaNezCrhoZDERZR+S4w9uP9c8YmoH0jmkKKewIfUthjyf1AEhhlwvlAVjYZQ47YvtiQDGp/eVKWNj7bwagicnp5eqhYx3wwKzwywV8XUbYDUl/2jca+7/9CEOnR09B9k8qytvRr6I+7MLexfbSa0UQkRWTqZsxSXeHouh2Ya+yins4EJXuvqiFHaH2vQyPWdC7dEkynKkfanleQ9IL4u9eLabclK4RYEffjupb2IWd5irYw9nX6TOHi1dTZL3QG410yxdjVLtJEJhnFRfCjvIwSU99X0TYv3vbh7B/oSPs7qRTh8NxO1nhplPzpFP2dXluErBWiRF1HZfacorvNJoMsStkjB22LlJiblEd9p+GKrYejrYU6TBXFzcKO+RVCHu0iLCPDWHnxG/UcVTfGjSkwdFfEvZjSH7zzZ0bhD26UdjxrmJAMan95QgSdnAwQTEL/H6Dl9Fv4VgDvBmVH2f4pOTMOR1fKg9O4ks+dAnfkNl+w8FJI8hwCfS6V81wMhLnlmdcCsYq7LDlrAavzkZUtTyhlBimqFHPbDDgHHavRkNn5N4VuioyDoCnRp1Gs69d2PfQHZfk6j4LOywfkLBXRjwR/7+DrKA1D2pk6EyBejBgMWH/Onr/jY93P/ywrnPYnbA7HI7byapPOn1ktukU/PHcpNnJSfgHQKz5g3R7yQg7jYM/8/acQthlgJ3LOsLYb4Wwb/3Sz7cUw3C0kLAjw+RoJt/YI2oV9iPIMmMIO4x4QsMcD8vbDfVJvInklcWFvReorsMQzi+EXSz0ZmHHpxjQnFS8nATCzgyPm2XK/zAKFJHbc7oOeDMoXE7ajWQXBvnpmnOrsCOtHYrOD7mlFHZD0TMjoYWMOUX9dQp0AwrC24WdajJWINCAnJuFncuw8yUJu/E8rVHKutm5XfABSqaPW4Ud5KawA/g6P2JhNwWehd1cVI9Wwa154mwxYQ+IP68F830jcsLucDg2m1WfdFoenARklRgWdnuEXZRgxw9LFnYEIsJ+lyzDzptOWdlv20mnEPatX8Mhvv+8uLDH2n7BETK8rcIew3Rx+eYroSXCjub7lAI+gKWDPjJRFhf2YywKa5XCLha6mLCLAcWk1pdjIOyoinnE7/kKegb7rqrjmuCZXJ6dnJxdkrD7p38U9qfPTkxhvzinvBjqS45+iiu/givOYZekHDyfpYtXvJg3mfotUtaEmvhWYUcGDWWrg+JKyON0dq5SByPlecbl1dsjsmF63EpLT0ZRyBy/AgDZt+rVhLDrd4yLjIRdwLVrDpHDjonyrJxIp+AkvOZO1ZPCjl20RZF3Ud7xRmF/+pu36lEQ1D/8xPfsvNoM3nnMczgcjg1mxRF2Fna55xRYUtjxZVo1ufYyGTFmHXZ8MfLcJIJT2AkjxA5fvy0RdpUV0/9Jff3y6+LCHjZKne6rH8Z2Yed6L3hanwk7bsw2mNbhsbzhk6ea/gVhn6IrBcZjsQax0IWEXQwoJrW/XP/gAC8EYadovuYAfe/oX0b6kdt2uhZ4BqV5l4Lu49LGrBzM0xeXs1aV39SV7oUmeGTnSQTYxbyAO1f2Ok/yXbkQuZbaXuewiyrsXLu91mlX+fGTnW7lWv9q+7Dbmo3d6nT26LJlBNhF37/BU11l+cCciG/V2mrNfCWo0mqowswifP6medKp5Fld7Wn7jRc8h8Ph2FRWG2F/ANjLOvKmUxZ2yoqRNWL059IYKTE0Lvu6PDiJQ+wihZ2rxMDXN/3gJOSw//rzz8Oftn7Jt/o/m8LeCKLjcd8u7JSUPY37R5FWXtxvHo1nveC0aLQfD/cbXIf9+Tua6W7AohxzBng/oHl48GhhYUd2SmMQxvsRxhJrEAtdRNjFgHJS28vhqvy3dOeop0Pqz6s2B/h1IaFTmg6g/45V4xmcn5z+dnl6QjF0G8ZdEnb5VP5sJ0e99X8Bn4T97/VVsfpkHQ7xT4qk2z5EVcllhR28o4syvfS453A4HJvKig9O0insD5Q57EiJIWROzD1XBycxrNaGbC8XY+cfgcyIATLCbh6cpLklKTEDyoUJf9kaqcv8F1PYd+iMJLuwIwpNNCCh+HHIvUqnVZ0BtFjfY3ByEtgOyIKPUTCGiZQoLy7s/YgH1XIu1iAWuoiwiwHlpNaXY2HHXtQ31cDMdr/fKAP2E1cpZh3wRF1H4tKbjxR2yfyweHsP0ed/gSWEXa+qsg6n+HPCDHbALsJHQtgl1U/ffe8Td9qpw+HYXFZXJQYR9kfmpMTIADty2A1l54ou7NrLh9jlplN8mRF2hNjJ16Wxl3tOH9noCDtS1tUXg6vR7HFMOyanUtg5rWWMKijRhJ4e6ash99KSHfNtxbQfmsIeNXmQq3TxbVg5AbXdPeDiKyzsUTjz7R1UluGSkEkTo+6HDYxmrkEuVAq7mVfOwi4GtE4qX46Fvf88hD1MdgKedaqVHs8wmmO12IX9zF9M2NfBb/8YYd9sN/VZ2FHncRGeeO27Fz2Hw+G4vaxM2KHs5OtmHXYN12EHkGWREcNwTcalyjpyd86xMZEp7Bxh512n0HVD2Dc9hz1UKeuSn38J/wL9wXh4c6ODcTzn8RRWvTTxmJYyTuYudPkBF3+5fnI0dhkwa4hn8Jvac/rjycn5pXczF+so7N4tEHZvb1DompWjzjrk5zgcDscasBabTnHQqVnX0RpivwtfIokd38DS1i5z2Gky9vVS2bEshZnDDl+Hsm96DrtSyl8k4X9OFDRDh+M/RCShL4q/dq4O1nNVDofD4dhAYX+UDk5SIIedNp2Kso4iI0baOn+C5bLY5bZTwNIuq8SYAXazSsytiLCvnt/ZO5vd1I0ojqtf6ueyuyHAwke6ZjEEmURgWXbEhqAEAon4CBGQBIkmkbLvm3TXZR+hD9In6swZH5hOTElLW+r2/NJAxnCNncXtT+f+55yffvhFB9UZ5h9EMAzDMMy/mn9Fhd3KsKOyk68TViDGmpxkHJ2CMXtvODUFext3xymS0dVRkfp63jedHp7vgQf2M/8wLOwMwzDMv51/gbC7GfbsEnt2hh2Ne885p1Yz9jd87DR21L0mDdaeU8W6SUzeIzEHBtsdSo55M/8kLOwMwzDMv53DCju1dUTpdSrsWo+dUacYKbdsXbHXplOCrJ8q9inp5zldYuw+7GTsX1qRmK9Y2Pfgh59//Jmn9TP/KCzsDMMwzL+dA3aJQV//5h192JWxZ/ZhT/16f+xe7tl92PVFkLAbMiMxX3CGnWHyhzgMXrVa90Qmzdj34/bDdwVhGEV+SlARl4m/SF9oR2rtcJ74UzztaxwVhWacSAgHZ2WBNF4jAJCD87p+xbcoiSyOk0XdWp4l0KmIv5rTBBTducim8qiv2V+PPnoe+eD31G0aLmiZMmsl8VXFmnP6WBIMwzC55nB92O0uMb+tsJMTWxH2jH2n5OrO4590dXx08zBOImbTJEZdY2Yfdo7EMEwOEYeh70OzIDJZSkD8E2PZCRCyIu4j6BobrUbwVtgfQjB/aiRBC653a04mn/HD5utzlehziP4WYb+yhb0mZdUTfzWlxXgcbxX2Ug8ME/OGy4R+O1nL6SpUq9eS9dsMjwXDMEyuOZywu5NOrQI7CbsTiVH+7EJRlj1sXUG6bp7dErsTiUHcuUn/lT7sDPN/RByAncI+qgXaO02RPQG5ukVeGrgymt4MYfxhl7CPQwjHp7chyJLW97aEaHl3+eCDWt611ClH6g019bwsirfcPyQy7Lae6WPmAayK4m9hRMKe9euIOxe6yr44UsvjAcjWdS2E+EmkyyUup0Ix9kFhC/swgfOKYBiGyTMHzLCjrysoEoOQsbsV9ixpp8y5Yu+mjm6EHdGTVQl70qm+vk1XR8vY0y4x37KwM0yOEAdgp7Afe6L8KsGvGGEP1TOxkmDyLT0JVW+XsCudPVbrVghXSvZPYpigcJevj+j/Agm0ycEzTma4LwvkJQR1NuKfEfbCBPSvQ5xHUNPveFS3UhHeSsJzwSzP1fJWwl3BXHLvJbGFvbyCYCoYhmHyzKGE/Wsz6JQyMZawu5NO1ReNTbJl3VTX6WE/0tL620jMJhPjRNgpEmMZO7d1ZJicYmWla7vErnJeS3od47ffdTpGuO86nZIWys7FvDPovvRJoqcv7WC1WPvtVee5XO0Eg9eiJy46nZaE7kun05l72cKO+RN0ekfYhz48NtSzl2if3yHsJ5HR8XkMiXo+9+GCLmi3sC98iCZh7TWQJOw96VvJmbtlMLquXDbv9UVedu6q5+3u61Om0J82T+uYXxnfNMxddIb1+Xl70Kp6O4S92oWkqp/bEKjnxgSiJyHuu4D+3hhBNN0sRef2vnwRWMKOSn8mGIZh8swhK+yo7OTrbiQGcQrs6NBuJGb/Cjt9u6OT3Ag7YjLsboSdBycxTH4Ra+YAUbMhtnMRpnlwT+ushJGW03sJkY6MhBDgy/LGKOhYgiYmI49g8oCHgoa2aWJY3irsxz4kR2+EvRGb6PqJD8v6LmEfh2DuaICZmE4I4/q7hX0k5VxtOm2IeUEglQEMSiLFa+HtTnx41JfThgTXcvhBvGWS6ngPVqX0QLsVgSKZ7RD2Sg8NXSgNb6t3nATazMsrCXj4ZIDLW72cCoMj7Ko0f10XDMMwOeagwk6JGLfCTpEYu8Ku5NnddErR9b2asX9kK3tGhd0x9k+JjbFbGXausDNMDrH+QgTN5Gyrr0uAbqsHACjhI4DvPNGIwOzDDLWdLweQRsyvJUBvFQH4BRJ2Xy0GMSQNcV0btSXEk9FoNN1eYRexMfVEfUIRKejDbSmLJp5yUc4S9tNSUdFGYW/RmyZSp9YvffCn3hZhr9SCDboXTBeSEgo78RxbEfaOD3Iy8gFI2AGiVTsEOfXeJeyhBD9IZFzdlWFXMj78ILwHHYXBjjLjoriKQUI4peUCl/fZwj5MYNkXDMMwOeaQm06/0aCxa1+nLjG2sCObqUnu3KTU2/eHzF2hHrNL7Ii+poxJp19+vi6wf8PCzjA5Q2xonMeg8E0V2sWLAE6UjJ5I6GoJLihVn3sjgGtPGGGfqMMdCY/qyYvxzV5PwndlI+xpaX6+KL8rw25M3Qg7cVs3+0ify+TtGcK+poiB93t1KvqhHgBA8nhWzhL2fgBr8Ji69qczW9ivo01Tx3oXQpVnnwUbYW8rLV5EsCy+S9hBfldXH39Z3CXs85EEf+Cru1fn126+OOr34FHd/71ZVtTyVS2Ps4Qd4zKTmWAYhskxhx+cZJfY7UGnSoydJjFY8iZVN1gDj/afdEq2nplhJ2XPLLDTpNMv/skKe4FhmL8Exw6XaLy9G/GGSwkvKL8BABrvk4T4CoMxqbDrKLvnY039JIRRQZ8vhKBAwq7UHXmvsA8A+t4bYa8qJ67rZEy7skPY0bnnHp7TbMq8iUETvlbeCvvRbXtDU72h6YOMpdXWUR0YFjby/lLBhDgJO+5H9XoQzt4n7M3Kjk2nRGMlQTEupm1ghh9aMn5Sd3q/WU5fQ9gi7BV16ifBMAyTYw626fS3fdi/dCed2hV2O8VOUDXc6sa+/+QkPO/2Crvd1jF7cJKChZ1h8oZweW6jG3vC4RWgWxspYkiFeqFF0m8IJIS4kIZPCpiIuUur5D4Je9gQf0zYuxJmKOzy7gbp4+EA4oq48+GqkCns5xc3igFGYtoSSrawi8qLUfak5O3KsFMPd79VTN879vEklIjB7MtFQsIezdMLqL4vElN9Z1vHaRcg9HUcqWqu4fQygdOCNnTPLAOzPPMyhf1DDQYs7AzD5JrDVtgpxI7S67R1VDhdHanCbkk7ivqeyk5V+qwSO34hZOyOryscYVfG/i0LO8PkCPGG8gIAJp5w6MGGoUd1Yqh6JOzdcqrGSnAfJTwZ6Qb5IRX25MMfFPYAoOJuOjWvl7yWxOr7jk2nNboMagapKF0rjYdWZZewK54nISh09kWziKB5RBcRAgp2NSBhD/qpyN977xH2ePbOto4j0OH1hrqzZQm3kDYHOh3TkrrCfqWWXbPcVmGv9qBXFQzDMDnmgML+zbqvI2XY3UyM8XWnrSNhTTraR9nxHISz51R9bzC67k5OUrpu92HnSAzD5A/hcFyT2lEXnnDQaW1i7qWWCXK2FvZeGZUZ26Mvyad7EkjYe4U/KOwxhFnC/uzDZQHL7DuEHU91Q0vL7y8iCEuusHuzpw1UgD9OAh8g7uNiGG8C6rdSomDP1sLe7adV+IvCbmGnA7uF/TKBVkkXykcQTnEpwZ/iBdybpfTVD0u1zBb25wBWc8EwDJNjDjs4iTLsTiQme26SKXfbiRj8tsx7D6heT2dHMDef2Yjd6Lrbhp2FnWHyiLApPvqgCLCC7rACOBI22AlG93REKKx+K6GOTR3P0ip5SMI++YPC3o8gPsoQ9nIMtXkMD43dwv4SwjV+fBeA/qKn5a5Np4juEjOhMr2S83Zp090cS+Rn60hM0k9nKz1lVdgH2pkbbaut4zuEnULr+k6xpI42DqC2q3o1pe3WcqWW2cK+iKFZFAzDMDnmsF1i7E2nToXdLrETbpcY+kJb36e8jg8UYnf2nLoldjJ2t60jCjt2ieFIDMPkCrHGu0ZlDR9KIouO1H1fLKoSfHWwRptOw0La8Vw9DyVc4XEl3YUsYS/5MN4h7MpQWw0SdpuJ9Js+HJd3C/vQh5H+s5UEfFtaV/IPCPtmr2mbau04g+mygTEZEvZwnlbeZ1kt3RP9anWwVdhrEFdFFh38IEULfy2lHkBvjsl2lWk3yxktXWGnE9x4gmEYJsccWNi/QNYZ9s/cPuwGq8TuBGKMbtPcoz+F3c3dxR2cRJEYfY0aO8L+pUnEqP+4ws4wucIenKQY3IktTCUMPIGUhWnrCFOvvWnriD5fDCEpqHOZJ/EcwiRT2Ms+3P6+sN/5IEtelrBfhRBIdWy3sJcDCPse6vXjkbqq04bQNAbgv43EzKsbip6y/aKHwk5BeMydUALoKcDQujeRJOygRyZVuhDPs3qph2bHqC3s7k1PRRbfxbDqq+f6BOQU36g+CE91XbeXsDjKFvaljswwDMPkmQMJ+7fWptMvFbTnNLvATrqeMet070GnBCXibcw2V3fTqSH1derDzhl2hskttrCHj0WxnRFAT73euE6Cslk2PXHkbwYnhVWvHqQ7UnughXzqA8kuCTsRg7yseFuEvXn9OpAAjx/SduzXl4hSU00pBoDJ0W5hx8lJwbQwjMzm2NPIb1bL4rgrYVTcuem0K1fD03i5CnXaBblJoFPZFOl7Z0/qxbWwhzdlLfdX9cwy+arknSawVdjPI0i+m/ULwmWmzvxSFMVbCd2ZmYPkPzfUYzgV6fKucZrQ3KSz4fAxgt5ieEr/RtCFFs9NYhgm3xw0w24nYsjYMwYnWc7uyjo+7GvrdI6PfjcTQ77+idUl5jOKxCh0JIb7sDNMDhFrCjfidyn6ACCletDCvkjnJ51IiBoo7Ar9kOApq/pH/d6VWmYJe1OC5rScJeyITEPuCaxJN7sOAOCy8B5hLwZg6NSFFnZICefebmEHA3WJQS33SX6rA9D4koTd3K8psLv0zblCuVXYGxNQYNXc4SpKzywxkVT+lb2z6WnjisKw0lZVP1h2NxdDK14Jz2IcyzYy45GN0gVBwYYYYcARcYIlJyCxyI5N1pGirPIPEPkB2fAX8rt675k5+HIZgsM09UfPQzuT284dRurm6dF7z+FW8z3fs5dbtPQGYB5y2B4VScQIgjDdTMDgJCPsv6a1dUzrwv5DSp8YDV/upevXIjFOX8e0SIwxdrdLjEnEkK/P/SaRGEGYLrzRWUxUut7WWeqQgypHAfqLRtg7JK3r1cRRGzDssetG6CjPYqlXD9KF/RG1qSkN2KlLN4T9NATpeKqwr9nC7vktct0t+qqFR3kQ+wV22Nytwr7k95rm8ahPwRxu7LhZ5Z2DEMHT4xL2YmFvrYcAnsaf6GKK68jvNC1hd8reuX4+XdiXVkowPK0sxusT+n8hepKWeVrOe6nCvrAvTR0FQZh6xhWJ4baO7qHTn0nXydiNHmu0KTt92NnVrYOnWeDtjq27iZgfUiIxBCVijLHPTf+k07/PLhy+nC8rQZhtvG9h6XDz1VpaFoWEfbG8+2x+6Kv+cZviMN/KUso6A4uVzcNFj1nYaW8+rI78yrXGtYTLUouS64y/6FUaJkNOwr5QPV7J3fbm6hp9xb1Y2j5uP7HevPhit5C8i5e3/mdcjQLd2FIQBGGqGeOhU3vSKfs64Uw6TRt0ytaePcT+gK/x29wSO2PV2MnWnUjMrPRh/1K7yQeVnUKQEOaf9pQgTBZedljYxyCGZd8mg9rfIezMcd0MOLU4CekfkLB7k8fSgSTYBUGYfsY96XRueOiUuDk3aTg5if6KGebNOX+escIev4d+bj1zysLuFti5rSMZ+1QL+9+1FC7VFY38I3UvurDoqJv08vltcy/k85tqJHiTIGRk2oW9AZuc9y/CbR3LXiovWhvbS0vtCM0Fb3KFXRAEYRYY96TTZHAS4XaJYWFPr7A7LdjpDxkbOxJOhf2B24adD52yss/SpNO/7hD2ACV1L7pAWNR0KOK6oW6wAbxIHtxQI8GbBCEjIuxfZ+FlRXmpVBrJUdC1RRF2QRCEG8yIsP9uCbt75pRIibAPJ50yV4GWrKOTkrbu6WdO3baOHIqxSuzk61NeYf+ews47+0BDOYiwC2PF+5fIozgGYd95YqO8/47nHdL1ZnJ8tSXCLgiCMGRmhF1X2H8hbmnrqOXYybBrf3Z7xJh7dljYuU8M+7o7OIlL7E6EnbvEkK9P8+CkbxN2P7nNKxu/rK6oJo/Ywr4MQLmkC/tysp0p+6mbiJycjRXujTf1LF39/Mf4hZw0TBQEQUhjJoSdByfNmQmhSYadIzEaNxPz49XgJIbV2pLtbDV2/iPhJmIIt8JuD04yzHokphtFAKLomTqJ1tXKehBqhV6NqO1yT2mi6FW3FQLhavz8PnWmO/IVC3tMgEBf96IoNvvTqKQG5i1h1NqK8kAQRWbLdicCwlJbGfajvj8w/65YVgxv0mK/GlGdb0d/UCOKKARfLkXRayUIdzMLwi4IgiDMNuPrEkMV9rmvRGJuFNivDzrlQUfc5iUjD4Y/TBzBGVbYucROvu4ae3LmdG52K+wVxGyplnZyAKGqNkDEZXGgGIA4MI8HiGlUrwl7AVjXtwNgntYtQDVAhKeIWVBql7fvG0WP0KiDiBTDm5RaR8KKUntAoLerDtBUgjACIuyCIAjCpDM2YSdlj33d7sNu4D7sBMmyk4hhuCdjpraOvJ0zNrd1dbQz7HzqlHTdEvaZzrDnBgMgHAzWVAuGsKNO9bXYa6+TNito6huPGwCeK1UHmu3d0wBYtYS9vBkar3aEfXUQAa3BUWXQBOqDga+69K5eEUBRPxSRzvdaANoqgTepFSA4WumVQKX7p2Tqu0DoK0EYARF2QRAEYdKZiEOnNOjU7uuYWmJ/QH87IXa6EJmt3c2wx7+MfT1RdvosjZ1hJ18nZf+fZNhbABrayVU9rmarEqA/h+Ras26supwUw18DTRJ2BAZzP1bKEXY3w05vLJpU+g6AAgk75WQe200hedMBsEu/lx7NBUBvW1/WlCCMggi7IAiCMOmMLcNOg5M0OsPOh06dto5OIsa1db4T2VLszrHT9D4xXGG3C+x2l5iZr7ArW9hDWpeiA7rvA4dKAYFvVs+AE1VlZd7oU4Xdormg7hL2QyCsKsMpUCRhr5iVP4zW8CZ6pGUeftjvdxU5fhABe0oQRkKEXRAEQZh0JqLCbmXYSdnZ1xkrEGNNToodnYMxWQ+cJgV7G/fEKZHS1VGT+Pr0Hzq9ONN80uNNzy5rn89qtYtP6cL+WDHL3XYLJOws09vAI6WaABon5Ozk4eHAsN8AEM7fJey75hWEDzSMsAeKCPWK4U0FAEHnVU4RJPASYBdGR4RdEARBmHQmQNjdDHt6iT09w07GnXHOqdWM/QY/OI0df2Jj51GnLOyciJn2SMyn93+X35/X3r17+7ZW++tL7c2XdGHvKqJQzIMgYae4Cgt7oQ5w7xb70OnHEDi6S9hPgB7/ToRG2ENapAg73Yn8ka+ICEBOCcJoiLALgiAIk854hZ3bOpL0OhV2o8fOqFOKlF/PxGQ4dMrw7mHFPiH5fU6XGLsPOxv7r1Yk5repFvZa7ey9ScFc1DRf3nzSi1RhL9P6MSl5fb+UIuxqudcMYDhhYY9ZARp3CfvR8HBpiMAoeJ5XrrAbXvcjGMJtszoMYL5AEEZDhF0QBEGYdMbYJYZ8fW6EPuxk7Cl92BO/zo7dyz29D7v5CBb2mNRIzC8zkGE3wl57p4vrmjfq4hZhp+UhgCPjyKcpwk50N0IAH68J+wKQt4S9kSbsbeBIEVWgfoewE/7uOoCW0tRh2FGCMCLeFX6x6wmCIAjC5JP7znAfdrtLzPUKOzuxFWFPOXfKru5c7+nqdHXzME4iZtgkRn9jah/26Y/EkLCba/n9Za12ri6/JuxbwEtl6NwU9hedTpdWdaB3Tdif0Z/7QMGsloM0Ye8aTSfawP4dwn7UOaHlMSg4cwqst6Wro/ANWMP2gWi16gmCIAjChJP7zrCwu5NOrQI7CztHYixbd+AoSwZb17Cu890psTuRGIM7N2mG+rBrYTdc/nVW+/zn2/OvCftLSprHGZSCI+wV4IAf2rSF3Y+AU6X2qAxv7izsD82yCxj7Xg6BNj0dAs9uCHvlyROfN3FTSb0J5qkKEORUE1hXgjAa3hULMOyveYIgCIIw0eS+N5xhJ1/XcCSGYGN3K+xp0s6ZcyJjU0c3wk6YyaqMPenUfN+wq6Nl7EmXmD+mXdg/n19+fnNWe/fhcv6zLewhgq1N/0rYXwFhZbmwGgDYrTqRmADoHyq/p+80Bym/YTjt6HXgx80XT7a7fWgUpeFbr9aU+gjU2ysUdEe/m9sMyfRdYQfwZLjpFMjvltWLJlAkw9+Mu7FvKUEYCW9I9XEdmvxe2RMEQRCEySX3vSFh/z0edMqZGEvY3Umn+ofHJtmyHlfX+ZKNpLR+MxIzzMQ4EXaOxFjGPhttHZMK+/ny8tvahV5+eGsLewmaLRZ2smIiAtB3hL0NRi+6AMOTk+qIiTPsFSAOtNArFygyE5MvqFuEnTfNR0gICqqVBNk3aeKSIIyCd43n/RCa1o4nCIIgCP+wdzc7MwVBGMcd38NZ2vVJD8lMgoWPkAkTEbGxwAJBEPGx8LFwCdb2ElfgGtyfc6qnZko5JqLTybT5/16vEEwsn1SertpVsTidsEtk17zuKzHCDdglQ/tKTP6EXb/96SRfYRepw+4r7P/J4aSzP/qw3n8r+d33bu35TRPYe5duSEx+2i1TYH/X9fTR6fvV5pbrnaxKVzcux24wfSB/eu9N+rDbF1Jgf7hMgb1bnJPPviz7aG6ms6kmsD8y/2j6ZC7uX+wWUogZ3Jn3fxX4G8H7eGfeezYLAADspliYCezaiPETdq3E2Al7H579o1OtrmctY29sZB+ZsLvEflhtErvpsNc+Ye++jRw6/dJtcXHxeFgTc21x62z3m69333982f3RdHFv2m1x9ZF89t+4+vrxvVu8MsU/Cr85/WqoshPYAQC7Khanj07bgV46PapbYmxgF5urSf5u0iq359Pknkb24yN2MfyfRi6dTo6tB+xt1YG9O/PZ+XKtA/5zwbl0eahmLV8R2AEAuyoW5g4n9fyWmFWF/bBfEiMjb43qiTl4lH/p1KV112HXyD42YNdLp8drn7AD+yhY8a20sa48Jq4DAHZXLE4enf66h33iL53aCbttsSudhptt7PmXk+Rzt0zYzVrH8cNJtXfYgb0U1mYP5WX18s00AACww2JhdsKuJfZjA7vWMXFbHXXCbkK7Ka/nvjptRkbs8uXWOtq8LnxgP1nvWkdgL9nDSb0HLwIAALstlqaBvV3vddQOu+/EpLzu1joqc+koJ7LLZyj35rT/3tAOu7ucdEz3sP8Xj06BfWQD+/JtDAAA7LpYmD2cpB12V4kZv5vUyJdtxMi3Sd4ZdF6vny6kN+/2OtoKu1/DTmAHahTWOpavAwCqEAuzW2Lso1M3YbcjduW3xOiXpPWc8br8pCV29+bUjdg1sfu1jhrY25ovnQJ7KQAAUJlYmg3sx8VkfTjJ72FPzIjdFWJS3Na7R//EbnP3/OEkrcQM/8eBrbBPUiOm/8GEHahKAACgMrEwCeynzKPTSU/fnLoBu2vEjNw6zT50qrQRb6Vnrv7RafLrpdNjdNiBagUAACoTi9MOu23E2MTuDyfZzO4rMXrnNId+RrO1E6N5/ZDZEqMj9klvqMSwhx2oUAAAoDKxMH84SQL7ZGyt49gW9uHb1WJMreVfNCa099xex7FKTO+I3xIzNGIkr7cnqMQAdQkAAFQmliaVGF3r6B+dHpW4ntY6SidmSMpuD7tmdfPwNEujnZitjZiDI5UYIY2YIbG3XDoFahQAAKhMLE0fndpLp3ZJjL906g6dGgdyS+z26lL6ND9iV2bGLmndVWLYww7UKwAAUJlYnL102tpHp73f7yZtLifJj2TTN9f+eeaEPX2OfG17cyqB3Q/Yda2jJHYCO1CbAABAZWJhGthtJeaY8FtiNLBvNJZfwd5kJXZN6n7C3vg17ProVCM7l06BygUAACoTi9MJuwns/s2pGKmw20unImXtnEaM3cMu38rfTUq0wp6YEbvkdSbsQH0CAACViYXZCftxMbLWUR+d2g67VmKU5usD2UwlJn2u5nV/OElH7K7CrltiJK9zOAmoTAAAoDKxNHs4qR0uhK467FKJSXwn5tD6cJLSaG3Cdt6MXX8pfCNG+Am7PZw0oBID1Cn8tdPnb92czz/Mwrju03I+n597MfO//YO3F+bvnp+fBQAAdjGw93ldJuztlkqMGbAru4ddDx3pmpdMzeZLpQqOnbDLiD3ldZ/YV29OWybswE/27mY3iSiKA3j8/ly6m2PbGP6Jw+LWBmrgMgGji2paoZZYKUbRkuBH0oU7N65NjC9h9AHc+Ao+l/ee4cLlOrToaIR6fiLkCA5dmb8nZ85dNNGveKzwcFrEboLdWxmWypVT7CpVjoQQQoi5Dewc2dO87u9ht9wedsZhOZiIcdxOxlxrHd1fdzM207Y6+jPs7q5TjuteYJcZdiEWUPQrXipUC1Pe0ki2ltrN1opfdrjMdF/pSiSEEELMb2D397C7wO6G2DNb7Cf4dzDEzk8sd2oPZ9jTL3N53Tws/rEMf4ad8zpHdplhF2IBRb/i6fTA3lNoe2/teOW0wB5LYBdCCDG3gf1KenCSYWbY3U2nwVrHYCImTOvuleWbYg9uO83eE3MqNdFg97fESIddiAUVjRTXujkC+5bCrcJkKYFdCCEEW8jAPnWt41lvhn3EG4jxTk5KM7objMl9w+kJfvjCO05ZxlZHY5jX5aZTIRaQl8aBpFo5KrC/nhLDtzU6K5MlRYcpQQK7EEKIxQjs4Qx7dos9e4adE3fOc07dwzz95GSw2PG0eaS8e06N0ZKYBR+JufP2c+D7p+skxPEWjSzD6tyKpisrlFaibBvAphfmm1xOdz1GXQK7EEKIuQ/sJrH7IzF+h93G4+CoUx4pn5yJCW46zTMVM+7YDw2/L9gSM7mH3bB53RuJubjIgf177Wcfaao9FdPvWVU+EuJfisYqd+sw4kflaBoNFKNMxTqgi+OyYctDEvsLjc71SAghhJjfwH6R8/rlGfawm8SeuYd9mK/z83e5T9nDfmp0ctJQ5kjM+QWfYb9Ty/CNRhrxbfLdh6Lf04WPfkEvjre9cjWOt0iIXIKZl76G0WxH2VoKqtm/W4hC5QTGhm2/P1svRJU6lzQsA7Tff6CgV2UJuxBCiDkO7Jf8LTGTHXaXib0R9oz7Tl1WD55/M6vzczgPE0zEjJfEmJ8xcw/7oo/EXDsisCuUyJMvsOu1EfoF94Bnkxe6R0LkEoVebcDYmxKmuw0A9ZUo1AEeNoGqeUeDoo4ypeIyRiUKLMUAmsVICCGEmPvA7p106jXYT6fCkRiTn0NulCVHWjdcXE9fwxZ7MBLDwnOTjske9l8N7E+fvaTf04W51G+QwC7+gowTTXsAOoVpu2DwYK/605vLGgcrlQR4VihoEJfXTXmjUMgI7PR8YCdmtqXDLoQQYo4D+8U0rxtuJIadYdkd9jC0u5lzI/dSx3CEnZ00D8c/6dT+fN5WR3+tIzfYr/wfgb1IQTF7OUNgL1cmS3eJQwJ7sUxC/IYocGNNAdC97DAd2wyevYX9ZSF6phFf3dagcVk0ZSXKcKCwRpEQQggxr4H9UnrQqZuJ8QJ7eNKp+eWOTfLDetpdd0+5cFDnp0knvS0xwQh7OBJjEvtxWOt4aGDvJgmAJHlMr5MNurmhNB0kDbJ27muo0mY1LSv7JQW9sb2b7JHVayiojR4Zj5Ok2F2LsTwZ2Cv1ZFjdSJKWednuxEC9/4SMTtIvDkyp1spEg0QBOmlSqpXYN8xFzaVL5h1Vt1+zmyTPydpLkh4JcZTIt7Qfwyg9LESZKorHYTLjt71SVaHZUpr2x+Vdpa9n/mMboyFbYoQQQsxvYPeH2DmvhyMxLGiwc4YOR2Lyd9jd7/DopHCEnaUz7OEI+zE5OOnQwL6OVIua0FUA2s2w95FqcFlsgGmNki2bSN02RQu4qYAwsFMDuEXWHrBJZD7D1CoRJWjUwRIid21KHSC1TFWMv+aWeXlFRDuALpIQR4lGCjslGPr58mF72PcLU8457do3NmAcrIxKZUuSPexCCCEWNLC7iZiww+5GYvwOuwnP4U2nbnQ91zL2E35kz+iwB4n9tDNO7N4M+7HusC8NBoAeDG5RGsH1Lgf2NDUPerYtyaUdzL3d6yukmXzXlK93bLnPgV2ZulEMArv58z2ytM3iTwB0elVzIbVElJhKH/Tsl+5QdWDK5mCfUuuD+0B9MCiWYa6wtbVmXkzIv8dJ3QQr3CIhjuSlcRgPHv/WSafd4YL2cgyoq1FXo0S2TExZlJNOhRBCLGJgt3ndciednvW2xEzOsI9PTQrPTRrm9vxccjfMc3aLndmfKeOk0wvnRg32y8c2sJObYefA3nhKlAb2soJaJ/NqAzY34uNlU64qzuQ3zEfLpnyioCo2mEO3KV3rqJwtew1NxJ/uEz0AbpLRB15zYE+KproL7NK0Gfabw8RfBarmpQR0qA48IiGO5gd2vb8UHWqVA3uWEnB/2Yyt1wFdniyvSmAXQgixiIF9mNi9Fntw0KkJxsGSmBP8cFGdeQce5T/p1F5t6gy7ebDMBrs76fT8ce6wkx/YNdcc2KuuO96FLTc4bRuPOLB3gCdctoCeeRqWXXh6fMl14oi+SstAk6zr3G9P0reoyNfLDuz834Rt+6F+3377kgJsXCIhZhCNUDs6SlthJzuwL8fpKJi1uzJZUpSlo0yyF0IIIeY1sF+a3MN+ITzp1O+w+1PsjuuGe9vY85+cxNed3mH31zpmH5y0+DPsn98aX8zxpm+/1b6+rdU+f8kO7He55sC+BnSJxabkJ8MF7DrQYlWgQy2Xxbt2usa5QfQKGBCRRp275RstVge2KXEX1GjQtMBOClD3767S0CYgA+xiVtGv6APrhShTsQPrwZMHANlSjcpKlOW2Qlv2OgohhJjbwJ522N0QO4deN8MeJnZ/paN9+KHdzZ/nv+uUH2GLnX9NJvYgrxthYL+0yGsdv3y4U/7wqfb+/bt3tdq177U337MCu4voHNhLQIVYyZYKif9phRFTttyUSjDDPhxe7/Lbr+FZp8S8ww4N7I8VLL32lNieKR6SELOIZvaooQFdiaaprPfa5XF5fX2nXT4kkW9qIG7ckswuhBBibgP75dFeRzfDHs7EpHk9WOvoeCcd5TrnlB+u8J20v8fcDHtwctI5t4f9uNx0+vaDnYL5XDO+v/liiszAXuaaA3tjFNgbtsQRgX2LiDICe99m89vAEtEBPDcpQUzs0MBOS/caYJtk2PNqzMeFmEU0s10A8eM/F7BfawAPVyIhhBBiTgO7yetuhj0Yick+Nyltd/sTMfzbS945uH69uzrjufnMRexpXA/XsB+bwF57b5rrxhv6PCWwE+PA3hmNxGhT8hPb5kweI6axVpqnMwL7KjCgmP9wC9ihkdkCO6u099RwvL4Pa5+EmEE0s+7D9tNC9AfR6ubWknTYhRBCzGlg54kY/6bToMPut9idcEuM+8VpPU97nZ/cEHtwz2nQYneJPVzr6AL75UU/6dQEdvtc/vCtVvtE344O7PvAba7asGXJZfIDzuT3gWUut5vNrUMCO9WhTGh/QZzd14hVm50ZA/uL3d3rZCwp/r5NQHd5oEaII8lho0KIH+zdTU8TQRgH8Pj+Eo/edlzQ9EnYHqY2VdOuZGt6gQaKArEtEEFoAkLCwZsXz148mfgBjF/Ai9/PmWc67XS6FWRTdO3/R+l2+7Lt8Z8nzzwDkDvhtLmB/TYb9LDf8OewG06J3WuIMXHb7nt0Ie40d5+/cZJtidG/UXNb2O+Yjhh1+w8q7CqmP/rw/MfDj9/ODuxviOQ7dVJMOLDvESW6YWZbcibfIOoKbYnot4G9RqQuVxVKRPSu/6YoLbA/FsqrlZVt854TdTiws2nqREWO7Suig2WncB4I7AAAkD/hlHFgv+8sOr2j2DWn6QV2G9dT9jrNvNGpZTviXWaZq7/o1Bjd6fTW/9XD/uPbzx/vPzz/9Pnngx9uYI9JvlwteoFdtInkyXHHbpykjklt59RunLSoDsfF40MiWR0J7FFzQMfqIiltob0mkp3Sl1pE1BwL7MtEa0cv9KpSPv1ClGw802MdZS0UX/Y547fMpMm6eqsAOAMCOwAA5E84bW4POwd2f0qMv3GSk9n9sM53WdO6vcaV3/bE2Lx+zZkSY0vsdxTdEvM/zGHnCvu3hYWPz7+r088f3cBeIeWlH9jDOjFZ4dO3MbFF05H+QlLfykgPu+sLX2zYwnI4XKY6FtifkhIPArvgy8+JNlmv9bfE/c2aaEMA/B4COwAA5E84Zf7GSRzY76SNdUybwn41ZU6MYu8u4IoT2hVvrmNKS4x2w58SoztiOK/fu5vjlpiFnyqsq3+Lz76Lge1kPLBrpxGRrD9tUSyUsBur01YoaY1PW5KU+qbgwK4OSmk8sD/jHG4cxaTIfR27E1oUGgd2pSFHAvtGzIFdnErSkh0Rkv2WGpFEUwycAYEdAADyJ5w2bomxYx39Rac3Oa5zYtfxWFFJ2ZvDbrO6s/A0C/txvtrkjpirKS0xjDtidGK/l/udTsXXlI1OP4lzqJbUXUSJMIq7QszxYlRWWl0JxZ8prqxuV8WfWHi3c7Q5JwD+EAI7AADkTzh1XGEf3enU5nV/3ySWOiXGm+uYackp35ur+SV2xa+xc1r3WmL+kznsQjz86Pl0ZmrejuOm0HZ4felyHG8KrUe0JwByIAAAAMiZcOrcnU7vDRedsvF9k4Y7J/HNGPab2/7zjBV2cx3+m7jm1AZ2v8BuxzpyYs95YL8ISXJHHVYk0VuznLQkTDvKEwGQA8GlCSPqzAfnUiiVJm6SehSRsvZg5HSpGAAAwMwIp87d6VRTeZ35U2LY1Ulz2L0R7Pwg42BH5lXYr/hj2O2iUxvZ/6edTi/mhIjiuiQusJuVqVEiCQV2yIsgg6kF9lcR1USQbrfW6cTDwL673OlECOwAADMlnDpbYXcCu7/mlKW0sA93OrUGDS1Zt04yY2LG15ymj3W8YTglds7rM1lhFzVJrCO0aplYvCMAciG4NAtb5c1C5sDO6hzYByoI7AAAMyWcMrfCfptNGOuowrHXw67ysz8jRh+zs4F9dE7MVW/jpGGJ3Wtht1NiOK/neeOkCzuunb58WrRnxdXOwcZ2VQDkQ/AvQmAHAIDgH5gSY8Y6qqTb72HnlhjD74m5Ntg4ybLR2gnb2Wrs9iHzO2KYX2F3N07SZrYlBiDngoFieTv4nZfN44Wjdr38tMCny82V3eZ66+QVn+41XzQqvVe7vcphyE943i3XlJJ+id+982S1XClv2haZN/tL9fXyajVQVjrNhqT1g2azucvvLzW7lfWtjQUEdgAAuNQpMVxhv/eblpixAvvoRqd2oyM75iV7iX1s0Sn/uxV2LrGbvO4n9v6a03uzWWEHyDOnOZxosVYNJopoKSFtj2N0TJWYFMkBPiIt0s8kIhh3IkmxPewJteqkLZv3NiWxtv76siRrVb+/J4ktlgoI7AAAcHmBnSO7yevuHHbNzmFnHJa9jhjLzmTMNNbRftz22Eya6uj2sNtVpxzXncA+oz3sAPkWDMyR1n0xObATJYcVophjN2fz3jqRLPKLJr/X1QOuuXt21pbWpRPY+VKSYs7dLyKSlcZWXXZ1YD8qt5ckJd12u71d4AAft3o99WZZRGAHAIC/s+iUNzp15zqmltiv8L/XxM53LHNq93vYzZfZvK5uGv8sxe1h57zOkX1me9gB8iwYqi4npESdJ5MC+5YK0IdEOwUT2LvzXBw/UIeI1ufDmCqiGtPG/FlTYhKiQ8G182f6mQNJR/r4ZnM+pYd974gfNmPaEwjsAABwaT3svHGScvuOu+jUHevodcT4ad0eWbYudm/ZafqcmGvGSIHdnRKDCjtATnkzE3sxKWubqYFd6iS/LWm5H9hDdSxEFHFgb8yrp7bm1aPaOQK71J99p57RP+BQUqlw1qLTakJbTxDYAQDgb491dCrs1wachhhn5yST0W1jTOYFp1f45vJXnLLxqY5aP69j0SlADgW+4yUirqX7Ikr0k0LSqQnsCcfvNSKhXzzQWX1/Plikk3ME9qSqL6U+INSxIyl5XZ0c2N8uN9rdrqQ2AjsAAFx6YPd72FNL7JN72DlxZ9zn1BnGPuaqN9jxuroZzppTZTAkBi0xALkTjJnfI6JuWmBf4iclNUxgb3H87kkq6heb/aye0P45AntrwVyyJ9ShaFpxDp6kBvbddUlGF4EdAAAuObDbsY63NK/CruOxt9Upt5SP9sRkXnTK+NPDin1f//u8KTEjc9g1zuvDEvtdBHaAfAk8j3lIS7yXFtjXRgP7GsfvBvezRNT5o8C+5Ab2YK4tSZEbKT3sCxWiqHzabKovRGAHAIDLnBLDef3eOeawc2JPmcPez9fZubPcJ8xh17+DXe9LbYm5jR52gPwJXOFBRErlNSfzswJ7heP1oaQnQZbAzgpvGxGRLI4H9qOYGtw/kyCwAwDApc5hd6fEjFbYr/c5Lewp605tVvfuL5jV+d7vh/E6YoZDYtRvTJ3DjpYYgBwKBgobFVLi/bmAnRnYzXjHdZIic2BnLaL+pkxzi9SxL+xLKprZj8PAXqE6Pzc8RWAHAJgh4ZTZwO7vdOoU2K8bXksMp3WPbWXJkNYVG9ftcejq+MZJzN83CXPYf7F3NztNRFEcwAN+IMrS3b2O1fQktIuLpIXQseFDF2psi2BUoEG0JJWQuHHlMxh3xjfwAdj4fs6c29NeLjOITGpmyv9HW7ioBXf/nJx7DkBxuYuTIltd5UkP7ByvA0NrpcyBXaL5kv0LpSbtrijryeC7O2YU2J8ZCtRIJz4CAMCVEYyb9LBzXo9ISwy7wZIr7H5ol55zlnGoo9/Czqajh3A3nca/nzPV0R3ryAX2uwjsAAXiBvawFyh2wcAe7pfvrRG9KWcM7Itbb0qqvFQhqg57XsynalnFDkKqHZVLh4ZGgf04+l73/auSfwQAgCshGDcO7HfsolOnJ+YmO7vpNPqQtUluWLfVdXnJZkp62E+bdqbEeC3s0hLjJHaMdQQoKDWkXyt24cAe4eWmJfXXwL5tSLTnzwT2jrHvxEMeWYOPFOV4pdfsz3EDe32NYsslxVYGR60AAOAqCMZOKuwc2SWv+y0xzCuwc4b2W2KyV9jl6a9O8lvYme1h91vYsTgJoLiU7+KB/W2bIp0VJYG9khrYDwyJLQ7sHTewNyoUMz2tBsoHq2YQ2NVCjSKVo1Ue62gFOyERdUtyfMtHlNgBAK6GYMycwC4dMX6F/YYb16WJferMpVNpXc80jJ3/sTzTK+yS2K+LUWJ3ethRYQcoIHVZIS2W7r3p3lMso+DlduuDVikWWstBWQEAAPzvS6dzMdl0elOmxLiBnY22Jp3dmyR7TrOTlhh+TSqxs/h3Sth0OjszLLDPIbADFEymwK5YdkjjAACQv8A+SOxOid1bdHrtuj8kZoofEtWZs/Ao+6ZTTutpPewS2RML7LLp9BYq7ADFk4vADgAAkLvAfuf0HPZZf9OpW2F3u9iFVMOdaezZNyfx+6ZX2N2xjsmLk9DDDlBACOwAAFA0wZi5FXZpYp+JuWMdLW+qo1TYndAu/efZb53ywy+x84c31tHN68wP7HeKO9bx6UmCHxpgsiGwAwBA0QTjJoF9bjjXUXrY/Z4Ym9e9sY7C2XSUac8pP+Tgmo6fI9LD7m1OmpE57JNw6fThRhINMNkUAABAwQRj5i5Okh52pyUmfW+SLXe7HTH8dJJ3BlKvl3dn3DefOIjdxnV/DPvEB/a1yhN9KQuVSksD5JQCAAAomGDM3Ckx7qVTr8LultiFPyVGPjitZymv84s0sXt3Tr0SuyR2f6yjBPa5Im86/VtgN1TTl7JH9EID5JQCAAAomGDc3MB+i80OFyf5c9gtp8TuNcTYuC17jy7Fnebu8xcnSUtM/DvG3Bb2WdsREz0mt8KOwA4TSQEAABRMMGYc2O86l05nI3LnNLnALnE9Yddp5kWnQjriXfaaq3/p1Dq96XTmavSwnxPYq+ecTgf2al0D5IoCAAAomGDspIfd7YhxE7u/OMnJ7H5Y55esaV3eY+rcnhjJ69ecKTFSYp+NxC0xRZ/Dfm5g32s2iajZ7Naaq3XN2s223m42739sEoVby9pa2grJ1Hp1LTabFSLTbFa17tYMkVk90AD5oS6sVF1fJToqq2T6c0hElW7ZP6boGervVbEyCQAAchzYObHbwD6bNNYxaQr7dMKcmIi8XMKUE9oj3lzHhJaY2A1/SswtW2GP/k+3J7UlZomszQ6RDdx7RB3dI6qQ1dOxY7LWhon9M1n3dYMGnmiA3FD/omvoTVrE7hB7URocjRxTvDWmrgAAAHIa2O/KWEf/0ulNjus3bF4frDq95s1hl6zuXDzNZEp6Ys7tiJlOaIlh3BETJ/a5wm865cD+a35+ZX5+/tvG758P+DvaCvp9orDfX1+iQWfMIdFL3aPIs0ajHWd5rfU2kXmyfRzyX7KW+m2i1X6/Wiei3VZrkYgWNEBeqH9xZKhRTvmjkJqt4HVns+Qed/iYqG3CFQUAAJDTwM4FdmfTqeR1f28SS5wS4811zHTllF/tu/klduHU2Dmtey0xEzWH/eTkZ7RB6cvG06+PH39P6mGvEPFPDynUusdBPbJJFM7re4bMfnSqrxE90gPSw75MtKsjDaKGBsgL9S/epwf2A0OvnT/almOqtqkgsAMAQI4D++DS6dzo0ik7uzdptDmJH9ao31z6zzNW2O378EfqnVMJ7H6BXcY6cmKfgMC+sfE9/uJEp106fUf0Lvq0TvSZA3tNsxpRSx8QPefTPtGOHpDAvkRUeRV9rh4eLmuAvFBD1cW9DIG9ZWi9fPqIwA4AAKywgd1piZlh/pQYNp02h90bwc5fZBzsyLwK+5Q/hl0unUpkn8RNp9/5C/0jJbBXiVajT32iVxzYW5q1iHp6l+jdJjMUaiFTYgyRaT9HOwzki5PGiZqNlb8F9uOUGP4qpJ3S6aNW56kRAjsAAOQ7sN9xArt/55QltLCPNp2KYUNLxtVJ/BU/hb83yZIWdsspsXNen6QK+8av+teUsY4don2tQz71iI40W4hr6jUaMVpIYO8aioWL7zVAbqih+xTbWVfp6oZqJZXsGdFLJ8x3+JhuvkKrCOx/2LuT3SaCIAzAhH07cutmEiT/ku3DBERAZkA2ggOgQFgsNkdAcCQ2iQM3LogjF07wBDwE70dP2WX3dNoQGJBmhv+zM6YFKD7+KlVXERFRpQO7q7AfFvGxjnrpdBbYtSVGab7eU54G9uKcmL3B4qR5iT1oYdcpMZLXm7A46fPkD1/fXf0aDexD4Hn+uGclsD+x4ilwyw4WB/ZccmMAsW6JqsLM9a734XQerplFMqBrorp9IOvOj4P82DILvczwqG2IiIgqGthPzMc6uqw76WHXlhgn7InZN1ucpDRae2G7XI1d/yjCjhgRVtj9xUm5xrXEOO9PxRcndZDZB0h7VgL7phXrwLY9A3RtSAO76A0fp0Bmiaoi6HnZzuBsDE3c7RTpxvb1lgmtXYJzLS+/b51rmV5fjnZ6DNjx9t0U2SqHsBMRUWUDu8vrUmE//pOWmB0F9uKiU110pGNeSlqav9Re+ZlX2LXELnk9TOzTO6fHm1Rhd65+jAb2G8DlFC+sM55dLj0DXLcXZi3tjzfGdkoD+8sHD9rWSVJg2RJVhAm9vgbncctEjQYA+ism9Ai4vwFccH+TwZpHqTumcuygZwJJB8BG1xAREVU4sEtkn+R1fw57TuewCwnLQUeM0pmMpcY66n/XHptFUx39Hna9dSpx3Qvsjephv3jRPU5+jQb2BOgDI+uMMZ3fuJoCd+xToHPSOheAM9beWV8fWQnsbyb/9rzNDYCuJaoIs8PKMwCPWotmweDu452TYpYzvF3pXQK2Wq0MVo5tdzzdakUCu33+YgBkd1hhJyKiKgd2fw67BnZtYo+W2JfkJ2hil4condrDHvbJL9O87t45+VqO38MueV0ie6N62L+uffr27lOhJSZDevumJO0NAJdsbgzn4eqdZ+lkyPpjILu5vPXWHU/LaWCt/QL0752354D0QmK/PAc6lqgqTOD0mRRA9iwepjt5Bo9PYX/VMlsZOifvZLDzY9cdeybibYoz1hAREVU0sJ+YLE5yDh/xL536Yx2DjpgwreunKNfFHlw7jc+J2TdRKLD7U2KaVGH//lEWKH1+L5925ix0S9IQk1nsEthTTPQTd076EFJT18BuUzjL9gHUfUtUFcaXjDtwzt5vmaheiv7Kgvht3ceFFBu308yO58fradY2EUkHA06JISKiygb2hWMdvQr7vhmvIcbbnDTJ6NoYU/rC6ZK8feGNUxGZ6uhM83pTLp0W2ZlRXwO7zbSpZQys34WTPm7bXPtKCilPWkcD+71MArt1mSbX37RElWFmWvfOwsmeL/9sDvu4tWDP6aglsx2dtyuzY5ofLeewExFRrQN72MMeL7HHe9glcZfcc+oNY99hbzDYcb97T3h3Tp3ZkJhmtMQU2YgucM2KMbBqk82bT+3c8vnNJzau/Wrz5ZAXTqlSvDQO5+7mH206HU0HtK91gPSkGeWLCqazY9IuN50SEVF9A/t0rOOhXFBhz+NxsOpUWsqLPTGlLp0qTf1asZ+a/r5gSkxxDrsjeX1eYj9a48C+9uHDtx2vDzbiBvDaijHAzaVUb35gz8aJ+alVCewxZ4Fbyy2z1QeyteLxJAM7ERHVMrAflbx+fBdz2CWxR+awT/N1ef4s9wVz2PfNNidNRVtiDte8h32XVttbKTo2x8BODWBm7ND8yjDFvXhgX+4AyDLkHqwUj9bEPEpdsiciIqpsYD/mT4kpVtg1E3st7JF7p5rVg+cfZnV5hv0wQUfMfEiM+47ROex1b4nZpbNwXtocAzs1gPkd24CuQQp1HyF398ldwObHdHbsmZgrKYac60hERFUP7N6mU6/Avn9CW2IiaV1pK0uJtO5oXNfPub07FyeJcG9SQ+aw744E9m0rGNipAcyuPRxkQNYzi/TOPRt6NfP2uXvDtZZZaD0DOoPLzOxERFTRwH50ktcdbYkRB0S8wh6Gdu05FyWHOoYt7GKveyt/02n+/bypjv5YRymwn2h4YD994fqWVclo1LNEdWZ27QGAzubfC9hvMgD3VwwREVEVA/uxyaJTryfmoNi56dS9dG2SH9Yn1XV9lLOkPexFe70pMUELu7bEeIm9CWMdif5LZtdG94dPW+YvsqvrNxNW2ImIqJqBXXtiNK8XW2JUUGCXDB22xJSvsOtPuDopaGHXCnskrx9pyOIkov+SISIiqpnkH/MCu3bEhBX2aWL3KuzO0o5Lp9q6XmoY+5If2SMV9iCx71eFxK497KywE9WQISIiqpnkn9NLp8dzuun0oE6J8QO7mG9NCvcmTXN7eZrcHXnGSuwi/06RTadHDs0K7McZ2IlqxhAREdVM8o8Fi5OccErMtIV9fzgkZkneGtWFt/Co/KZTTevRHnaN7NECu246PcwKO1H9GCIioppJ/jm5dFqcw34k3HTqV9j9Lnal1XBvGnsZOtBRnvEKe3GsY3xxEnvYiWrIEBER1Uzyj/kVdm1iP5QLxjo6wVRHrbB7od1rXi9763QpUmKXVzGxB3ndCQP7scaPdSRqFkNERPSDvfvbTSKIwgBu/V/jpXczpcTwJV0uBsmigXWzGLxoiRRLjRRsLFqSVpt470N45RsYn8FX8LmcPbsD0+mixLWl1PNrYemyXerdl+OZM0umcN5MYL8/metoetjdnpgkrztjHQ1rp6M8kZ3uYThrTvVjyvSwOzsn3TFz2HnRKWNLSjDGGGNLpnDO7I2TTA+70xKTvW/SCn3ZHTH0sJJ3DqZeb+5OqG8+cxB7EtfdMewc2BlbRmIxSpVKrTT3xW8rNZ7XzhhjbBFTYuxFp06F3S6xG+6UGPNFaT1PeZ2eTBO7s+bUKbGbxO6OdTSB/f5/sNMpY1eLWIwdDw0598Uh9vi/AhhjjC0ksN8lkx72W84c9pRdYrcbYuiRPv/1fEd7mrvL3TjJtMTEf2PMbmFfTTpi9DdX2BlbKmI+HNgZY4xdGoVzRoH9gbXodFUza06zC+wmrmfsdZp7o1PDdMTbkmWuzqLT1OmdTu9wDztjS0vMhwM7Y4yxS6Nw7kwPu90RYyd2d+MkK7O7YZ2e8qZ1c4+V3/bEmLx+w5oSY0rsq1rcEsNz2BlbQmKiXH0jfudl++PGcb9ZfVwSsa32i4N2b/tkh34ctZ+1/PHOwdg/KtAJ19vWZrNX7WwI7UW73VLYPmm32wd08Yf2wO+Nd6VIjdr7xUq713uv7/Vir90K0DuML+ZGdsYYYwvYOIkC+2rWWMesKezXM+bEaObpL6xYoV1z5jpmtcRot9wpMXeTCrv+N93jlhjGlouYOADCRl3M5GEzQmxEuTmAH0BTFOA9xLz4TCTFWW0F0o/f7CsYr4v656ECiSolQSIM3tPN/TVRVTA6XGZnjDF2YS0xZqyju+j0NsV1SuxxPNZ0UnbmsJusbi08zWXF9MT8tiPmekZLDKGOmDix3+edThlbRmJiHbHBs9mBHYiOfCAoCo2y+bgHqDK9meT3pgfomrvrcQDlt4bNJLDvVvubCtGg3++/ia8dqGB7PPYVgrIJ7B7g9SLVXBPHR5OL3xUFY4wxdnGLTu2dTk1ed/dNIplTYpy5jrmWnNJzcje3xG5YNXZK605LDM9hZ2x5ian6VgTN26vNCuzDkhBHwH4pCeyDIpXOD/XBQ69YCODLeoDdonAdKnTis29fFTN62EcdmVbhRzIN7FD7+sqDXck97Iwxxha70+n96aJTcnbfpOnOSfSdmPabm/7znBX25D70NXPNqQnsboHdjHWkxM6BnbFlI045GAfQuq8yA7uKk/wbha00sBf0seTBo8DeKupTw6J+1SgKV1XhbelPi07rIYYbJrDvSl50yhhj7DLsdJpunETcKTHk+qw57M4IdnqRc7AjcSrsK+4YdrPo1ER23umUsSUnXB83AaqluzxE8Ump8CkJ7BEF8y4g4zcP46z+vihCnBSzWtijJxuzA/u7RmswGCj062lgD8o8JYYxxpi4DBV2E9idNacko4V9utOpMWloybl1Er2ih+Hum5QwLewJq8ROeX3ZK+zPP393/Py2IRm72sQZxRGAQVZg36STCq0ksG9TMB8rlOM322lWj+LU7ip70LyTemZgf9tDamACe3ONAztjjDGx+Ar7XZI91tEsOp0EdtMSY5h8fS0/E9hPz4m57mycNC2xOy3sZkoM5fWl3jjp59OzvsjcXir1TjJ2WQnHI5rKEoyyAnv3dGDvUjBvKVRKwsNeZmA31gcKmjrO6GHfaAJe9VO7HUwDe7fGgZ0xxpi4BBsnxS3sd9MedtMSo7k9MTcmGycZJlpbYTtfjd28JG5HDHEr7PbGSbEr0BLz/GmGHzK3PeCZnE/F8zqSsQslbIVDD5r/2onr2YHdp/B9pFATbmDPUHrUCgC1djawHwdoxa9lOA3sAw7sjDHGFj4lJq6w3/9NS4xVYDfsOexmoyMz5iWnlemXcZ0e0wq7KbFTXncTe7rm9P5SV9gfnlNgbwCP5HzeAG3J2IWyEvWuDy14vy4c2YE9He/Yg5JzBHbiA89KIrbuTTN4S6EstGfejMC+HmJvQzDGGGMXGdg108O+as9hj5k57ITCstMRY5iZjLnGOppfNz02s6Y62j3sZtUpxXUrsC97D/t5Bfbyu3cbch4c2Nki2Bsnab19QeYJ7HisjwWFZnHewN5SJrAXPQzNZ4/Ts101I7AXIxzVBGOMMbawRae00ak91zGzxL5CD6eJnZ5I7tTu9rAnH2byehrZ6c/S7B52yusU2Ze9h/1vA3uhLm21mkyUzQtLrSwt5gfDBHbz64xdADuwB4cFQeYM7MHb0loTeF36Y2Dv954URemxB9RFIoLqlJPwPgrgfygVxwpuYDeaUMf6YsYYY+wCe9hp4yTt7qq96NQe6+h0xLhp3RxJvi52Z9lp9pyYG4lTBXZ7SszVr7A3Q5+O22G4I7WTMFyXcqcVAFD+K32mHIb7hVaElzIMj990AyBoSK0Thh+kHITj8pEHqGoSxOuHvkKwudMPhzL1MozfD8OylPv6TahopM/2w/C9jA3DcCQZ+9fEhHwlyNyBXQsAKrD/KbB3VXItPpkPbCjEdI4XMkruFMwM7I0AsdfcyM4YY2zhYx2tCvuNCashxto5KcnopjEm94LTFfq2uStOScZURy3N68u+6PT3gd0H3uhDAcCW1DwoKb8qpF7o8A7seQBeSqCqQIbSLDoN0YxAQqmVmyBBAF+mPiGxLhtItaR8BuCjfncXCMqSsX9NuOYP7P1taN26MIHdmxnY9zzE1IkUqdIoUmlgFx98aF4lcgO7fTEHdsYYY4sK7G4Pe3aJPbuHnRJ3zn1OrWHsZ1x3Bjve1N8Ja82pNhkSc5VbYraAQ304BtDVx3VgIGUTCMedrYjO7QBUFn8hoUXtrSaAg2lgB4JPoy6AXUm/GbRGYwVMA/vjo20gOjoq1wAMO50qgIqUbUrqByq+DWP/nPhbAarFtdf7a2I+6y92O++kmKHSecItL4wxxi5jYE/HOt6JORX2OB47W51SS/npnphci04Nk/pNxT6Vfp4zJcaew24S+6rVEnPvygb2AtDUhyqAQB9fAk9kPTknayo+twOtITUAValtArtWYA/LkoJ/X2dzwFvXP1WUFdgnPexPgKHUGsn9fGAgI2BPsl/snUtv6kYYhtX77Sy7m6mdVrxSzGIIMonAsXBEF4C4BILCVZALEsmJlEV33XRdqeqqUn9AdfoDujl/ob+rM589wXGcNjmENqTzpNjBeIwhm6ffeecbw1OzorAzg8FgMBj+mU0V9s/J1189oA87GXtKH/bIr1cn3sv9nj7sdB8k7BGpkZhPX3SGnQdAgXMHLjBVLi62+Uynyj2IUNjDp4Cg8MoEuIoJ+y6XZMnQq8r3FYMUYSed76hz53N1lqWsHmhxg+HJMcJuMBgMhs3DWjO6D3u8S8ztCrt24mWEPW3eqXb1xPYdXZ22yTxMIhGzbBIj7zG1D/vmR2LefC/5XS5v+v3b/T++399/83tM2OvKsbPAhMreAlUeUjioBYiE3eOElvAOUFkKu+CEhyBMwBPZNGHnAhCtWo5HNAATYDesByPsBoPBYNg8rDWjhT250qkusC+NPRGJIVtPoKMsK9i6ROt6uE+W2BORGCK5btKL6cP++0/fFn76bf/HH3/4YX//mz/3v/szJuwdIM+bQDFAlZ8CF1zSaHsgSNh1EZxSLzwh7NrmSdgFfB4i0oR9IqDw8jNOjGi6ncHw9BhhNxgMBsPmYa0bnWEnX5foSAzxEZFeYU9Ku86cEys2dUxG2Am1sqomvtKpur9lV8eYsUddYr7cXGHf3//+J5WCebMv+fO73+nJDWV4fIEyv4bg55SP4UPS6mDkQERGT6QLu8MJEnb8vbBzqx6AaHDJtg/IUQbDGjB9VwwGg8GwcVjrhoT9i3ChU52JiQl7cqVT+aOXTYrLelhd15vViErrdyMxy0xMIsKuIzExY38pbR2VsO//KIvrku/4m1vCfg784qPCd4FcgK48cgKII5VUCSC0nkseIOweBNenJIU9otgbiShkM4finBsMT44RdoPBYDBsHtba0RV2Unbt68lIDJEosJNDJyMxq1fY9SO5dFIywk5Qhv1OhP0FLZwkhV1tCz+93d//jb+9JexTYEAlb4E6cCiPtIEeVziPFXaXLiS5ThP2i35/m0ssAdgUYffGAHa5wfDUGGE3GAwGw+ZhrZmYsOtETLLCHhn7ssJOtn5n0qmOrq/UjJ0G60dKhT1h7B9qlsYey7C/mAq71PRvvt//4+sffosLO2k5UOTcVfuwsA66kSYeK+wnQFllasYCcNW+0ZipHXAld+e6h0wAZEnbG3xgpp0a1oERdoPBYDBsHtba0ZNOXynI2JWv6y4xcWEnlqsmJddNirz9SdCRGNqmldgJdU8pK51+9slNgf3VSxD2P357+8d33+//+PPbr/64JeyVKEl+TntJHuhOizsjSH55lLBzByiXJtd64SQ/HPsLUD7a47uAKFn8lzOoQS1gxEne29xgeGKMsBsMBoNh87DWTGLhJEmyS0wUYf8w2SSGSt6RqmuWs0VXX+lU23pqhl0re2qBXa90+ulLqbD/tr39w/4b+fTnH24J+xjAmdzvIFrEqIcIB8DkUcJ+6oHwnbiwcwGJzfvQHPNDwFPF+KkAjrjB8NSwB7OVPSgDlxn2AAa+M6MT576v3qLvOxEHdLhYcQCI1qF88arsxCgw1gwczY48O38ztqfa0pyXHXt5D7FX3Sy7j8zQH2bZIzny0eBsjWTmfnvG3o3sEGc2S6HRd+C0T7dYCnPhXiavk0elc9/92TnLLD9rMBieJdbaoUmnt/uwf5Zc6TReYY+n2DW6Gh7rxr76ykl03fsr7PG2jukLJ216hn37rZR1+dDQszc8hhdl1ilarjgSkHiNcSTs15wAFnKrhb0GjDkvw9cXCdTOGnpKVyxBdXM/Gnvkga59LaAoT7gFHZQvAcKEYgxPDnsME4HjByncSGBMJ7aAbbkLoJkolZz6iChI5RaI8ZW0fQ+ahjzbheZ4i9Hpndg9uNAIi91H00Gp+OyEfRKgbj2xsDcDKOj/bVYVdoteMxgMhmeItWbiFXYdYifpTbR1lCS6OuoKe0zaSdRXVHZdpU8psdPPbWNP+LokKexfbG5bR/5rykKnP/K/Zfu0+VpJtNXM8UeTnXFuA5XUC19OLno2NxjWDnsMlwKldxL20nw0FHBGo9FUHt4KAL/SaFY8JezHc3m4L+As5H5eJGF3RyGqTF9TY+nVXCZN2MViRFwV2H204Nns2Ql7XohL9rTCvtOCmB/lPZTHDxN2Xso3s0bYDQbDpmGtGy3sr276OuoMezITE/p6oq2jJrbS0UrrnMbHJeacyseSUNfvrJz0ie7D/hImnXL+9Q8Jfizy9VDzvB5XzIETbjD8h7DHMHtHYaexHvqcET35Kx3lh/r9bQftIlOQsDe3br+vjyHpeJqwexb7Bxo+rr96dsLec1GxnljYrzzUsiwzEpjwBwk7YYTdYDBsGtaaiS+cpDPsiUhM6rpJUbk7noihx9K8V0HX6/XVCcrNpzZiD3U92Yb9BQj7v8cYcHI8jLkUuMHwHxJPR4wfJ+zFQb1+knkHYR8IHCzHrV/Y20KoIbX6Mtp9Uae6cm7QdvO1r5ZHJ9uzQatbmWWWwj4Z1Hc53cVVNXD7R9lMdGquVm1dX0aXnJb6rjs6zDJN9mjkuvnXRUYUmiO3ep3buvUdCfqOUshezLtufqLG7g1e11uLnVm92x+HoxuV7vAklyrsxT78MWOnLSA/SxX2UzVa19RnFyXJbpFF2KV24A5r9PWe1upnZQSVer1+wMOzD/vd4eDG4F8PmpZ90nZHO1vy98PweGavfmGzf6QxaNr20dAdHZjFcg0Gw3MWdkrExCedJirs8RK7JtklRv+Qra9SXqeNDrEn5pwmSuza2JNtHbWwv9rklU7/VVwATlnAFNgN/zUxKwb8UvGfhP0qE38Gb+sdhP1MoLb17wn7ThnzLJ060j697UJ55aEDha9FvoV2hQ4F9o2w1xz4uQyjX4g2GWkVgQeJOKbPd+6B8LWC7gUg8nT2QRcKcVRgmlMXC5ulMnFB9KV056FwPAH4qjy+dUW3UXXShH23q0R9ayTUZ0oVdpfu8zwcekH3WOnczr+jNVZ/BAeaAX3Bxy4Uzp7+I6I7pwHlA1b3MKHPvdNGPsf+kXM51qWxPWYwGAzPXdg/JW4y7B8l+rBHxEvs8UAMPaLtO/d3jHdzv8PS1m9FYtQ9KuIR9s/CRIz8z1TYH0QxD8KbcIPhPyXmzFAMD9j9FATcrQcKe8O2JG6asB95oCYy9wt7adZRFDIPEHaRswieYdmhu2QQG0HGXRWBdvteWQn7sQ9UF2UBx9bC7sgn3UAshX3goDylknMA4c5HrtDCDviLqgdBfXMqntcdzbsCYhq6cBkIRvlAtDrKY13AnQ89mkWroBF3/pkhJs7BYiHHTknYAwdA2Rc0uORDtPsOkCbse66y65MyBLydNGEH/GHLgwjf+WBelU+0sF+2gUB+Bo+EvVHptx341X6/T5X+Rhdw866At6uF3ZNP3MAr77KDKkb0uUsOjvkDhF2P9Y2wGwyG5yvsX0bGTrou0XNO0wvsWtdT1jpdeaFTjU7ExwmnuSYmnUbcXun0k5eSYf9XyTYH50fjIjcY/lvYkmKtDIlDppuOB2QfKOyaFGH/ygcQXJ1m7hX2iErxAcKuWXzFOmUsaUd3Oi2jT79ee8JevoXNMlVgwinxfViMhB1CCWfnIhsJ+5WHYJaJXPSwoO5ltxgJe1Ve7dAPg+hNNYKq8CX1S6EKcUGJlro8KZMXaMpnYxfuTH95LbQ7LI1CO6rET+odJexBLtuWm+2hkvFiXxrzFstV04RdqfphttPGdVWIdGFv58j5S9bdLjFH5bBpjX2QvZthz5wJnGRZZuDgyo6EHaJmybP2ZupVR6k3ryA4YA8RdoiBGjuZMoPBYHiuwi6lNtGGXRt7ysJJMWdPyjptVrV1fY33/jYTo339g1iXmI90JEaiIjGb3ofdYPhfksi8zD1y3R5L51BAtOe1zGrCzl47UHhX/GmFPbuoLikVb+7llAbs+ZCBlevhhMuL+LaKyrSVoXYCuJYW9sNifNJpxYNrM+LMU6NvqAKqSXymDS+WFt9uhRmYmo8zi2kaAVk9GfMlC7n20Ev/7k58VGymySPfYX2Vjlng2mbHgdoyVk+NxJQcNIsVUR7Lqx+kCntP3vNsiLNOQtiT1fGksF8Ow6SMtUD5QAs7qbuW/ZMCY5Mu6vbDhP3cTGc1GAwbIexk7KGwf5bW1jGtC/v7KX1iJHrzTrp+KxKT6OuYFolRxp7sEqMSMeTrrz43kRiDYbNgSV5XIRllWCrjAEA5NM3MbDq17510etJTBKnCzrLXDhRBNl3Yz3cPFNaDIjGTHqGPJrADtKzwTQMMCrkAVYt10bdY08cF3VxbOLZu/9iJd4kpCwT6QM1B+SKbWQq7P4uSLdNQaQ8r/eHQQ9smu1+uMEX67vYVgUAYeWdWFd3ZPTbr4TQTE/ZRR24WHbYQ846qju9mqMUMCXvFd25o5VR+57jpYo+fp+Zt5oKS7VsLLGZ3hb0ZwK/ZmXRhb3SjKPu18HqRsIve8tQFqvLSV0I02B3qsZvsHoTCLl4zg8FgeObC/qVu65icdPox6ToZu9JjiTTlRB927eqxiaeroIfT1e5PxLyfEokhKBGjjP3Vxq90ajD8L2F32DoBMLwnXi2A7qiUWa2tI2GftARwzdc46TRZym6hbZUcCNsOVCV94ESv5IXoRCcEdlzYJULLc7YFiXMWKW0VLo2pO/RJZ32BkLZNV/SmLIL0XaO6LkbD9vh93513yWLCXrHJ1eXxRYdsnklyVRL2PJY4p+ywjFILoxk7E0iNxLhjegf0p3eFvTCiq8xzmRRhvwhwUaQb9xAJO5XaCTosVd1eoD1O+QtgidcIhd2E1w0Gw/MXdunrt1Y61b6eXDeJSO8SQ369eoj9Pb0Nr5YssUuSNXay9UQk5sX0YTcY/oewBDt5AcC7p12jQ0GQVfuwayYenMJTCnsmd7nEorOylHfRwurYQyHQu/CRy+hSNt2tFvaqdUvYy2Kp8FYYFxK1QijsLXph4Ki5oLwt4Ayvr+o+qupSQzjTuChjfh6xw6OcejBl6eThpAi7HQr7WSTsnTYJ+8l8dEPdVkVyIZxT9Y4iXdgv04WdyIYNaETdTgo7peOPuf68kbC7p+yGXgtX9lGZ/skiSTN2k1e5UNjdA2b4i72z2U3ciuK4+v01y+6ua6yRjzRmcUkEiahLIYJKJAqQACIEEB8JEvmQsmulLvoI3XTfTdVn6Ct0m/Wo++77BrXP9cXmcj0lIczg9PwygME2GGUWvxz97zkEQWy9sAeLTl+Ei06R5blJ4eQk/CcI8+Yyf75mhV28D/7ErjmVwq4W2GVbRzR2EnaCSBosinmJypbtxEh5nmMcZm1hlxQBnlLYdYtOj9ywlN1yYJjlZafcc90UhlxucNcZ5ylZgl8Q9qk55ZHpRnb/sgDAh9hyJgjL3Lq+++8XoecfZlSFsPc4z0TKz44MuYQhGSxYS2zbsuxQq3k/TtjxrZjHpK7LsB9nAaCVY3YPnMnDhB2xM90SB962l4S9k4VxWnxfLivszchHWP5y0zte2GOrcAlNEnaCIBIh7JFIzCeI2iVGCru+wq60YMeNNRs7IkqF/T21DbtcdCqV/XlNOiWI/yERa2xlwcNFEYztw34ZMc/ybDa11hH2Bt+0sBtZKM73j0owdap7pWKR+5X0QQG6OXGRBb2wHxu5OiwuxdwNhohWcbEpqvkIlTwTNFevngqNP7ai71TLswhGAwoZFuKXtt3rUO9vjDhhHxdFCr5T0gl7qgHQGDLWr0I9s7qwqxH6Vk4G08sjJtirBwtVL7izpxF2/8Luqt4xJOwEQehIrLB/ERF2dc0poomwh5NOJfNAy5qjk3ALbxJ1bpJARtgFkRI7+jpV2AkieUSsGDyag9UnnTIXAB4j7MN9cVau+NSRmFEmxAymHbVeLbSUOczXAeAoh91hiinRlL1hxgg7OygFndbnOi2FHc053YTiKHx1yoWwD4rQFO76lcVYpjlv52jZQVOVw/SiJIfCflOCpvDpnLUk7AdNHKfEylwj7PhyLY+5lXH6kcJ+UpTCbk+hcR3m2Qu+Y08a0tMVYT/FOP2NTcJOEISOxAq7V2H/FIlp6+jJsZJh9/xZ7RHjP66PFPbFPjHvK4OTwhK7EmGXXWLQ12lwEkEkjKiwu5cmeyOZxwr7Xqf2NYfSVa3m91npuM7h0PZdGHZf/aewH3jnulBq1WqmLYT9sCa4trBLzLiGdPJsCTsLjrlQHoehXXYBDixxlTOTXWcB9qwYYUf5baZ8F25e5Zjtj0AaMSHsbtvK73LsZ1grQnbPsm5dEMLOZhyqGZudzhqnQsjrfYsZgyqKu30GbobphV1Yf71vs1SvMVSFHa+5a9qHBdAKe6cEziC/n8W5SQ8U9m79xGS2Pz6pHer/0cgK9jrQ6NujXQ5XeVXYkVsOUJ8wEnaCIHQkUti/DNs6eq4rMuwYiRGomZgP5oOTJFKtI7K9Xo1dbiJqIgZZrrCHGXYfisQQRDJhc4w2+y/aHFp2aMOrC3sJJAPLF3YIcE37P4U9C5KOJaRbMsvhXsnQZio1B77OL/QpL5rspgAisz70L4sD+D0eY4XdPudwlMavBNw/eGoKYQ/OLY5ExgXABeBS2DN1EIfjpNP0uTwZl5rul+DIjBf2YVWeqxH2dlbs0wu7JRvSnKT/W9hvsiDJTjDtL955NgyD6z5dU1TQxe5qn2mF/abpfyoJO0EQWhIp7J6vY4X9xRsiMUsF9sVBp3LQkWzzsn6JfWnRKd7CCrsssaOvq8YerDl9QRV2gkga7CFMAbuAB+xxgGyssF/rhf3GOyHVcwA5m4dbzIiwfx0n7PuKsPcWhX1kM5W6UHPJpAjlNLOysnFMqopvdptmMcJu+aoqiupj8R14MBCpCo2qL8d18anDBgcAZ897B/GBuTKqsyuiL1ZXfOMCzkHdxSWp2gw7krsT5/oH7/piPoO5sLODOraqaYoBSir2kePvbn3FtMLejAr7IAuS0oSxTpPjF+yN5m82qHIp7Mws4+6p3Huh1NONMrhtRsJOEISWhAo7Krvw9Wgfdh/Zhx1BWVYSMZKwJ+MaIXZ5uszYxHV1DDPs4apT1PWIsFOGnSASCFuZbskFcPNszh3HJo+P4vS4VZu8YhtmUIDLHHsTX7WvJgZbDbPdutrJ2UwKeyp/MzBtFjDq7C9OkbIztU7fmD873b9qi6OPs7LzTCz2sFPDc3WMOgd5Fos16Vwb7FGkD66u9tI2iyF/UNvLsTh2GjDLMIIgiBiSKezRPuxS2GWIXVtifw9vSogd75C1rV3NsIsPk74eKDtelkc0w46+jspOGXaCSCBsZc4AwBnYC6XvpsW2mQbnpzbbBCjs7HH0OO/b7Lnh98/c7v8NBEE8I8yNgxl2HJzkgRl2sehUaeuoJGJUW5ePyHopdmXZqb5PzAeChQJ7tEsMVdgJIqGwlel32guhE8sF2HLx3DmehA65NcI+OZ68Ys+LdP+2ANkdRhAEEUvyhD22rSMqu/R1SSQQE5mcJBxdBmPWXnAqCvZR1BWniKaro0fg67TolCASCHsstnV4WNtuX19ka4T9GVIGAN4xGEEQRBwJF3Y1w64vsesz7Gjc6845DZuxL/G+0tjxw4U2MR+Hwi4TMRSJIYjEwYhHCvs5CXtE2HlpP88IgiBiSbCwB20dUXqVCruvx8qoU4yUL2Zi1l50iuDZYcU+IPg8pUvMQh92H/T1sMT+OQk7QSQLRhAEQRAJw9w0sksM+vqLFfqwo7Fr+rAHfr0+0V7uMX3Y8TpQ2AO0kZhPKcNOEMmDEQRBEETCMDeM7MMe7RKzWGGXThxG2HXrTqWrK/ePdHW8V/MwSiImbBLjXaO2DztFYggigTCCIAiCSBjmhpHCrk46lQX20NiVSAzauoKMsqxh64jQ9WVtf395cBKizk16Ln3YKz/+rvDnb68MgnjeMIIgCIJIGOamkRl29HUPGYlBPkL0FXZV2mXmHFmzqaMaYUf8yaqS6KRT//rCro4RYw+6xHyZWGH/85tlfjYI4nnDCIIgCCJhmJsGhf0LMehUZmIiwq5OOvV+5NikqKyL6rq8W4+gtL4ciQkzMUqEXUZiIsb+HNo6Vr7R8IfxpJScskEQWwWbU3n5gB+bLXB///d3kvt78fjPPW6JTeT1P/jstbf1ndjyjzCYHuuHb3+y2YYx8hZ7M9b33/5isU2TqsKtyVZjWC4Vx2mmo39R5AD8vK+74k7dkTT77C1j9qA8Yg9neFTiALzatpiW/DjLAdye7gvVso6gnGF6crewO2FPzWQXPEr77N3zagzVNoshnTk1WDxGC+rHbHWMq1WOP8BfSrF6OcGnozJ4FA5Z8rDaUOywFTAyI4O9C6wdcK7YCuTLJQ4AzjTNnh47k8nH7ToBn7NtFvYwxI6+rkRiJEqBHR1ajcSsX2GXN3V0khphR0SGXY2wP5PBSS/fgrBzyBoEsVUwib2OsFcqvoIjf5mVQNzNSuUvsfm3WfEwX1bu/Rd+xR3BIe9W2I3vv/3J2nph/+r49rw3Dnb3Zy4AXKa0plgHAe9oRjMdFkDi7LDV2byw5/e6Z7ND3e7MLgj4SY5pSJU5+Lg6Oz50QdDYeavCnh50u+fbL+y5E2jsvXVhb3MQuHc5/1ff7nZ7iRR2G4V9fbHXs3lht1O1aeNOjK42IaCQYU+NnQE+jt3X7R4lQdhlIkatsAfGHlbY0daXFp3K6PpazdjxZHnTVNgVY/9QEhp7JMOe9Ao7CTvxvyQi3Q8xdsWkfzXvl4Tdl/TXc2F//fffr1OVyn0g7Pck7Avku72bfMwFXArvLNwY3rMjB+BNwp69uBrXObg7NlPZue0hTRd6I/aWMca9TpppsYK/JJxWTifspWmrdc7BRbVQMC4BCtPWeFYaaIWd13s+4xTTY13tnqTYJhjzrRB262a3O3qksFttPPfphb10Ud4tAjjd+UtJFHa2/cJun/YurmN2mXXw4c0RCnvxolXrOQBZmyGbF3aJxbdc2H1f95GTTj+OdIlZzLCHU5PUuUmBtz8NIhKD99oSO+Jfk2bS6WefzAvsL/6Pwm7mjTjShkJE2NM5gyC2ADbnpW/sFTO8lzf5DMEttcJu35u/SmH/52VFPJqVe/N+Lux/BYL+jxD2yl8k7Kth7nJwGpczB9yJzViZQ+O2FCPso9u24T3YUw4ov3puXRhYbGswLzi41YteQefkqa8Hef8bHXHommyJQRaqWD23ba2wOw+T5ucn7MgjhR3ZgLDzO+8hPQY4G5KwvyPsiQO8OLttAGQt76koFqRL4AjBJ2H3UAYneahdYoII+4dqkxgseYeqjoSrRdefdIq2Hpdhl8quLbDLSaefPusK+7/snU2P2toZx9VWVV+X3dkxbuRHGrM4gMwgcHxtxK3EILDBIN41vEq8SSwqJVIX6SKKoiZNpcmN1F02Vbut1E2/Qrd3Hd199/cb9Jzn+ABjTJjJ3Js0ufxnBnPs5xy/APf+ePI/jx2Lo7ZrWTW2XFlWTJZrBRMAiNGQ5YZlFXhozrJ6dHHum3TLZMvlPcsCAMvqy3LfIADEHtK1Lcsa4+auZQ3lk0760NrNsF+smv8cpvzZkmN5bpUZrYreakGbbOOy4E57o6nbvfwybIl5q8SQzDmcc3+68gY5XQB7APFvGbAryv237wL2l6+unr6UN8CuPn969eKxzBvPHz+TH7/gTbFCkx9fXX0lB8GvRPCmffXqGW/Lj5/SxnOOq88eP/7q0RdXXz1+/PhMi+r7jB7Gc/kgsCv1rmGklme8lWh7RuoiLjZWSpn0IFf0C5c4WrrSNYrrRPRAmXaJKi+Ldq3tOUZrqLCe2owAjnpZhG5Nkkrdnlo2ENgPq+JAoXaQ01LgjALEqpRKF4dHijenvtESifFBteV32pthl+2KEht6RjeJJ5XtF3x3nJSjIQ1PsJzeYPhFxzA6FwM8wRWBVYyddRdavV3+W14kNo2lD7MwSiDHb7wwtwf2WDNHVY5vX8+WYXjtRBT7J9v1y+TELVZjovN85nul3s2AXanQ4NWIDzzKDROjlVu8EJcyUSoW24tkrs+PRD5fF/2peFtJvfbwMp6ZGan+3rVd5Or1ljevNb1iRQ5eMNfolJKasObkqDJKsJvccLEoFV2eNa/VS+siWDP6ujTjGJyhfb1SXvRdsr7NoO9lrtpLtGnfS/HijFae321mxTs257mTxm2AXVp44C8jgF3trTxjVknzVnpZKBrepCFek2x55jvF9bkaBC9KNHiOwUcUq1ZHuKTXExcX+XzB72wmgygXHX/cqF3MYzw8l0ueNQqGV2XneNYYF+nndykOI17tGIXlBsTVy3bHSA3vRX3amqVVCswOvc5VhV+6RsH1CxltP1aM1TLc9ULaBk+bIvhern2uJsdGMZfmGXQa27qIS1HKVktUucFm4FHXddwu/66umKCX2coymDlJSG6DWY88qPzYNbpzTcTlSg2ttzbcUjrqu8Dac/xCRcNGv7SaAhTpkbRjNwH2eC7leCVxRr0JHWo61z7qpNPrddh/Eb7T6W6GfdfFLiSy4TvV2O9+5yQc93CGfbesY/SNkz5vD7sBwChcAYAL1taByPJrAoHKcpoAOcNQC0iaEj1wORtiPweuqpyDQBTx83SxpFvrAGZcPumkD6xdD/uXlt7xdabqfep6oc2izVrWkuG7jVsctvD3POxI5N9QjzqCOkL6my/ffhP78r/XgJ2uQGB/8xZXHAB27ekXTC++CID92UNsP3qJrYdfXD3aNnHFi69wzRM5FIzsT9tMT1XaePWINx4ivz/FFur5tR3xlsajXzw6AOwZG1CpGAKahQ0rH8R6UCzgKmdAW3kfmEh03jtFAGDrYR8GAxdZz6YDzbNgtb3gATcB9vHBgLkDJSWAmBaAmT8UWHYB5eFumwY29IwsocbgTx2gstkAvRbBE2xHGvEnuFF42MVQ4Of5XqpxfkENa8t7g5INxvkusHf37bWXXcT42wO7GJMqNQqdrlGOGorYhgkAYn+NIr8a1fQNgP3cw2DzAoPrdCh9u2eNv48MAzp5PPE1v5Lias2J08Wd6XsoVcFIUyf0ocrfFyizxNExifsVHvYmsXzcr4eX3QGh1IKdkOi74i/GqMNaAsD7om+RvySxEj/IVAJPocHfCP5tgL02Bru+D+xKjo/c6SGw+YAiBX5UlylABfHKBcGm15OOakT0Ei7BHuLCdAj25aewwPPXPXCaHBWJPpvhBSnQ18QFFJkpGJzwMbgYAHt6yA/DT0p7qvkg5OC1Uwp8qJYSPV+lzcYSfqH4mAd74gNLzNSUX3naOqvwWCcfibMmAGw97OmCuJQM5ktgJ4LppsTbMv4YIj8x8gRQvhKMRUgKhyPF/dgOcBkx1nJBiCyPA7u2DKaklLElhrJjHz/DHpjYEXr3yjqKOjFCIsO+A+0I6ndEdpGlj0ix4891Yg/xOlUY2H/16ZZ1fDewXwBM6GIOAB5dxgA6suww+2TlwsZ1HkCTRQ6wVWefi/rKhK0JRmEff3M2y6cBoFuppOgiIcslJPUBAcjLJ530wSVtxIBd142uSxGdETpvTouWbr1GYOf87jq63gt72KkP5huG5ZTV0QeDVvZv8XlUhv0NkvshYH9Fmfkp0jQC+zP67OqrF7SJmP2Qofkr1jwTwE5XPbx6gsCOwa8oZPNg6Tm2nz754oWMiP7o6tWrKzq+jHn8pzTwyYunT5/SYOT13b5fPRKHEQnscwvA6KZs4sYCendnDgF9IIBdpw3DITZdkTRo7LRjApSjhqrOWkUTgT2AFOJMuwZhwK6mYFaTtGbKLzR90rshsK90pPxoFQjJazcA9r4B4KRmBvFHbJ8+gJEyCJjnAthN2jAc06YrFh0a223pAPOo/Ta7LU9HYBcTSe3Z1DUZsKsT0hlJWrnrducp0ucRcsYjjA63AFS1IIKN8x5cLAuOVazEo4Ed2BsWk4wRWkyKrrUB9sEUwE5Ni/oBYGeA5ulA6lpQB8ZpuSaY8+PA3tsEDzmwA5g4VFXjLyahFxaAATtyLFipmQ0QkPOcENrTMXR9GAHsuk2APpgwoVdnaRO7Ne3QkdsanhLNids7wA5gup7FtyZWrY4Dpt9qtXIKAjzr26JbS9i3hn23wA40tkO3rjTkdQC91XUAsKxI0gXi4CncGNjxXWBk9oBdyQHona4BgGw8cojVmaYsIAWN8esFY+pCx8L4neCWcmtgR//2zKF9ZXapPPbqFwG2wE5MILZvMWC/NIjuTWc2DdbYtWHBM4aidhN5HcD0pj6Au38Y8Vyr4wMx6HUe11i7TYM7LR1IpA8kPgEgLn0NzTHSuwj2BLAT2rB8iwG7XGEoP3UBnFgU+hdaLX8D7HKGDVxI2QzYNQr+Jcrn9DUuNcHAgOALgB3xSWL8QzopHURomgBtWL4dBew+mMXplNERvVZqtdViB0hPP3V5FNi1JQC4hSIAqbGmC6aLQ5naRwX2X2/qOgoPe9gTw3k9XNZRaHuno7sgO44hFJpzSv+24ri+d+ekn4k67J//pFMFwKELBtkmXVYBMnKWr5PThK0rI6hjar0v3yNALtkmByApxhAe9gxAl7VyADm6MBj82wBt+aSTPrTCGXZ9SlF9ZulNumDNFF2uLH1CF7bu3V9Yunv/taUPw8COeP4Wq7+8URiKswY+XAP2N3SJwM62fBMJ7Ohdf0jXpR8FwP7kiy9eati+Ujmwv6DLx5vE98Mgny4/1/aC1Yd8m/QSrerP2XPsi82Qh/0q6Etz+HT/Gv0ikNak7MNoYL/nAqlkGaqXFJYLIpA5k7SCif4VBHYgc7q9VlEkLUWAxfYMMAZHqsQgm+bYGLXze4hz51q2SxheEBjdDNgTHpjJQxt7RSgmpOPAnu0CwXMpt2m4NiZA3QNaW0f/CgI73U4PWckMJG3CfTuJFjj5o1ViKoEFP5ZXkLkrqlwy+Qn28fAnFmu5wovD7TJmX9pT3wfXAJH4Plglxsmox6vE9H1+gEqyFg3sPoXRjINBWpWwl0urWDBNHAX2IYF1TNKaFnQTHNiNPqVrA6YDhCHSzkpKKQD2uYluptgErHkA7DzbHi8n94HdqmeroA/VIbToaSyG6LrJe9gKV4lpEoTRhgGzxL6HPTFMajyx3knuV4np074V/IeiFrvQSxNm9JCUNuiUnNUmkPUZRdPbALtKh/R6e8B+bkIngWSOKeba8FzjcO+es2ULXHaRsj3smTfBY8FV0EvvAex6G99Y9hxt5iQVl7LNHWAHcHvM+5OhJ1ot4/eUGRhl5g8B0spK2UoA7AkT/AU9qDmY46Me9oEJRoLu1wAn4lppdLcGe+3uVS/Y6Zvg0JFjBtjLANgBnCTzDVVoQwebxspNIN2jVWLuTUFfookoT7tUwU5rNRuoTLD5pPCiQ1tWJgr9TdDppUj7YPYFsINFx9ES9Ygp5E2NLcZAmrf1sKs6EDZsA6DIel5wX80aoPLRb5wUeNhDlpjo+ybxdPeuIwb/tuR9F4l8vRgdhb75yELsHNfDZdg/c2Bn2fQ0c8IYAJTEi8z/MhCucxMIf8zShc0aQ3TOUF0yGg8kgP0cQK/RZXw6zdCFQoCN6sonnfTBFc6wW/+koH5u6bkA2BPUvn7f1h0E9vF9+jBlD7kwsP/uDTW/vLn/Rvn2dwq3wWDdGOR4Duxfv337NR3lLW6iiXhMsUcC+/PAu/6UA/tLSuZawNMy5/O0xpaI9XwFQ3XUS4HxLzBYYH1IlMWfhoAdzTPbvlk8DGy+wuWeLnRYK1saMMBDBvXBGQhg5+jO7QcFjJ0SWBwF9pW+k4cf2kZCopRcXHVMuCGwq10C6KeNEhtsnr0BsM8dBpRCiw7ii6TMwM4LYF+Jg8gXAwik4F0+CuxVC+qbPHzToE6Bug3GeqYD9CkzuQQA7NJA2zmjyDmniP4A7npqA1zci3qN7M7MNQGMxnFgr9hwIa5LJLAPVXoWa4wfFMBg9BNfgdU8Buy1MTh9FlwCq8KBPceGWiEaJ1uckJfcEpOYBoDd1CGncWA/aPupEL8vVcDI0GeI3lxqna6KBPaVKjGu9hoHJ52qFSTWCGBfq8jRLu1bW4PfR9K2YK1JiS6ulfLGDYHdazYvWgTIWgsDe2wFBu4+b8FU26l1wym75wPFaqFYCRwEuZEFXe32wN5J42pGu7ECr8J5WdwC+/67RkuiF0cZ8+CBjyAezwXenksbPO0IsDOqX/F1ZBr5KbG2DHxWAXPNgs8FkscIojuKfVWrYicbDO0YsMeLYCvSxh5DZtK9FpBUyQCwg5ktVNYiapQ+P1atB8QTwG4emVKtKUDGtwR2bQ5QwicOkJ0zSgNMP36VmO2k01CGfTfFLhSuEiN+kNbvkl7HB2FiD805DaXYBbGHyzoKYP/1p3yn0/sP/v4Hqn/Q25v+4d8P/vWHBw/+/o8dYC+xnHocoI9pcQJFmSudv3AAgb2Anpgaps+7AO0qCrPvQgQMvgDiXiTE2jLAycB+0sdROMPuM+/6PzGlzpoGWmNaloXAPmGsvr7/paOvwsBO0fvtN2yW6duA0b9Bbkcs58COesM2cWB/e1/5JhrYv0LWRvh+rCFzXz1leoJWFcrnT1SJ87wA9kdiiGvBLzW0qV+3aGSff/WU+VxehIE93Jc5Yp5xY3sksBdM2Jmd2LSDsiwtol8GwG5e7hRAN1pMDmFWla6lb1Qc7AH70AZrqARjl/TUQO5AqiZJa/OGwN7Wsf5GtLKznSLsWuzysiYfHKWxPcGyHxDzmpiNANhJYwecnU6LyjCZIb20c4Jufg/YMwbo7Vow9tDyRvIYvBF+B+rHC8Ccg/nrB1W3o0qp43o8rHMvMl8Zw6uYmAGUlKPAXnZBXw20g8CuMzZUc8i4yVZwMkPTrB8D9lEqCK6b5hCBHd3oahVRumxAW2a0N0VgbxTB8lpUrg7jWGCJuZAOAbtbZtS+5M+olMxq1ukYCLL7wG5ecCT3+1HALvra8yhgN9t0oTXxq0DPAx0PsqjDrMYcMQVZQo6/TR121jUM7InWduTWgE+cLXU7HR8w4nIGZopPcmYtGlxkwZ4O3uDWwE4KuEcDUuiI6ZyhgWXHEjPb/diU2WG4PCvfAQ+D2wjiMXpQxRQ7DAv8yyPAHi+Bw6cq6KQT8Y71wddEgwXb57haJ54A9uJmaxcI7rdjMUO6Yusb2dMQsKOFnfgNVdC7udJq+NUhbgQZ9qpr6ICurbDkHOgNHEMHQwC7/Q5WP29POx0PSPe2wF4AcFMtKhsC+1+eDdUBSH10YP85auNh/2m4DjvXbop91xCDf8Hje9d33K3mvqctrV+zxLBjZNq1sP+CO2Lo76ecYf/Hn79M//lvD/70pz/+8cGD+/958Pv/bIAdQTzFLGNZh7L6CGDOVpY9E1BExmR6EcG+hzYXFN8mJIC9H8yrSA1kVBcY65900odXOMPeCczrYw7sHuP3L6eW/poBewlZnT2M94D9rfL1t/fZ7zfc/fJfMas0tsmwf43l1wWw44TUKGAXyXEpjcBOwXyr5wjsVypyvWBxJHgUAvq14CsO80Lyldj4Qt4D9le7fVU2FCJ4NhrYW8QcXMu3l3HELiGJANjtzfaxCYEw7d6BrfTEHrDfw+16AeFxStbKwkVHet+5GbBXbXB6B7c2HZi+lm6gNSHn1/Lt82yQQxfAjql2VE6HjVYxumkrs7wH7NkCbuj22Am2zWliMIPqPYTVvjJlpoRs6JgNsMuRJxMYC7Q2IZl3TS7tjI4C+1mJ4H+V81o0sNu4A5ZiRrjnhSzmOgyPAXvDDezoFR2qCOwc34ZosmnawP3YKwT2vg2orc1njnx/ANiLDc7qTcIgPF7VAXUA2C08VoTuPWCPD0Vfux4F7FYVl5gAP3dgo86INdfcrn1zYCd6ca5Ke8A+MmCjIr0c2aYFXBih9gmapSrYtbcT7OZvP+l0InHzeutMSjgcCbOVLbCbhZ2CReIw2BiXBnR4MIL4YOcwnMYRYFe6YOD3lJqD6B1STQck81BwzAFfeNhTm60+bGQtpRhsRYp7wK4l8NI5Fyp7pWy9ri7BuqRvkNyWvdUliSrreFYIZuakHbACYBd7iHL12IB6D2AvwlbsPZoQQ31EYP9NQOyI61Rizml0gl3gesS9Tu98o1Mh4YjfFZ/mGp50ynX9Tqc/+3w87H/4M3PB/P0B1X9+/w9sbGSDKc/AltdA5An6Y/hsaNPp6kB4BMnSB4s+dQ4DO5NSCgLKrHVmAXPDn3TSh1cY2FtI6AjsQZOqYOlJllxvHwZ2iuRfv1X+S/0w396PBQUbv6Z6c5/l2wW+v8W0OwI7VpM5COwqW2JZR2x+9TjQGQL7CwHsODdUrBB9X4ngLFraH+4Mr9Hc+cOndLRHYWAP901rG2A/UNbRE9NLUSUd8qpIvAfb3ZrYOiUwnQRKytLFtLtRSdkDdkkZ65uKKzOSi1M+RzeKdyNgrzhgoR05WgUSmvh6OFDnNCfS/k05SLyXA2A38HACik9NAjWyUmXnBFeJELBjahL5h0xqtCt9zHuAnpEC9M/aJsOi8UK7Btx6X4uuYxNUgqSk2pSixf0O5SPAjrZhm1fRuIwEdqe/Bfa+AbksXmzrOLAvDWhjMLL5HrBbAbCXENibOriTQM04B3a7cjNgV+cETH+6KnXAjgR2u34Q2NUmAWLQvq1DwD4UwI5OGGMSaK6gMQbHG97cw67xRhjY8zY4YuS6Imllkx+VuBeqXDZgU6xmtBM8VG4N7Lw5aDEz28LeA3YMF1YYE4jTnZSm2Clhc2CX+wjilzZYk0AXsSPAHuuAH0c0N8DdDx2Q3by70gEDg2PGBtjNwmarA7rYbztGPz3djabDPWCXtAV6zcBm3+xMfSlXweE+F3vH/BJlh8+mQFfwib8F9tlBK4wJYM0mpQmQ2W2B3QCYBFoN6P5MAJ0OVQJofXQP+9YRI4g94sZJO8wehnV8uCutizF+9E5PjOD1n+xUifmpsMRQMUvM51CHnQH7gz/R5DrV7ym47wL7BOC1BQXmQE844MtoVCd15mRxOJTnACoxgJKMk1OjLC4I7FzZRpcAt8tMgWkin3TSh1cY2K9n2IvI711L/+eXR4D9W+XN1worC0NT7dwRQ4WDvRXAzlE9mHTKU+yRwC68Ls84sL/CppDIsGNCXJZCwM5WZq/Bv8iwC4f7KxU97FHALjww26HS77DEzAgZ7OCZBRk5WC0sMcXaDs6PDiJ0CNhR2mJlAxDaqUDGsYSLU1Yz0Rl2TVNVTdut7WI2VCl6K85HNXrSTTQxyfm1XDavWL0yiciw+6NtDZcjt2ISwC6kDXIGAUIxvG12WYb9Is4z7DRwSLcAOAH74GqzGX1GyU6Qhh7qUNHCW4WyE6SUI8COZa2rPsE6MEeAvSFerbpOjlpizj1Yx3iGnexn2PsOXGgM1cYM2JHur1/JOXGaNwP2RJebXdT67YH9csrXqpUbAHveh7EsbZQ3OLAr7U28eBUOTzqNBvaeC10xMjfZOHM2XBlEhBZvdgigwX3hwmwbfENgVxubDPta4q71lipdurz+S7waBezKCqwq2zen/IHLgT09RBCveeDJN71xklIAI4GnZoEXkWG3d/Pu8QI4GByzwRXAPt4clQfGwf2GgR0lN2YEb5QUt80hy7DTwc/aYO/sEYgbVdRR7+EJ22ALYO8e2mUVyAqHeg9gbwHJ7rD/EPgb6+yjAzsSOwf2X0SVdYyqws7+QraYra3lPXH9miUmVNcxyhLDiD1cJYY5YpDXf/3LT9oSg8DOHtN//veDB3+T/30N2C8B2pgSJ1ACqMpYyLGBm4IMexygmAOIyZzdZVTX25C4APZ5q3XGWgrB4DKA2QOAc/mkkz60jmTYbUTuIvWwHwP2b1gk5tA5od//8u1/mRDO98s6BndWehMF7I9Z6lxMPsXFy+3exGRTZPEwsO8Hv8KxhISLJs2BXdzGNLrvY2yKyacRPAs7XLx0Ao+EB9ZgD9jrFhL3jYFdpOWbWcr6HvWwo593HO1hLzHn6WjDPj6Yuxn0Ntua3G3vzt7MtlutiISyMN5Xtv7/cxfGNeR0TLyHgD1jIHHfGNhRbZN1GtpuUh5DcYTGmj5PaE51LD7dz3IoJ3P5um9d+F9iUzRO0K4maXK8ZVtDgMsmRZ7fBNi5Kx1KyjFgX8xgxjP7xJwfAnaBSotusI86Met7wH5e5Ncl7yGw5ztQqL0nsDd8aGs4c/NmwJ5FFz1X3oWVhon+GwD7IoVFYoR6HejG8DqL+KQBQCa3AHZzJQrrY5EYoUURprycIwK7UFKHDt3/oAteIvRST2fd6gFgN5HQ03UB7Jw5FzbMKCjP+JzqWjcC2NHhrvG+bGWMBtcknIFsNzmDL6TD0tSGeD34DNUMjonmlrBiHitfLpS+COY01wjp7AF7fAz26FbAjmYYhulxz1xrNTQFxZ0dYNeUSGAfBtVL0yb4x4BdnoGu8e9YAtgvgVTfdZAmGOI+aFgkRkjrAmj4/viYwP4bUdYxPOmUETvlYc7riOyUlEN12AWr70w8vYtEdxztsCPmxxGWGBQ6Yhix//qzuNMpAjvF9Pt/ePCv3/7xb7vAjlgOkJVlgy15Yh3wQCrC9lIE4vAc+gBAv8ee5Jj1Xa6Vyz1ZFsA+AchgvEPHQWwvy+3TtNOTPoaOZNj1JV0mLN0/Cuy/4wb1b2mgKLCOwvKNAtjxJqffILDzFDvVPrA/C/LgV7xKTBYrNKICBwyCtEorqKshYA8HY05doLmGwI4M/hQ97CisF8N1xss5ir7P6CbWfBFd1jFjgxvDZ3EaHfO5Zb3hIKeHgD3hb8o5qtpNgT2nM8qf205Cylngj4smHAN25C7Sl6WDwK7OxP8Sj1aJabjC85JmNU1SYLHAkYecHgL2QQqcvDjBmwL73GHA3vftBnvqFDomQF9wRd0ngDdOWrSA1LNSNLBLbUKaGrKL3t9ubYpc/Ka64zRxU2DPGDcA9vgK9AryIeDqCM11qIqpg5yaLmlwZg/YYxOkOW1uMmDHZO5cHP7tgb0QY1Rt3QzYtZ2KMOc+TFnfsn0c2LHoYk7QKH5BwDx4Qxfx+dsB+7kFBY3bkoagt8XICOytGiN0+xqwJzwK7MjP5moTjMoDwAGzRs9CyLz0BLBDMcHv9FngQ01YkHkA2N0B26+DwC5OP2EhsJ81cQhxGPvSEuKkcH94GOkh7jCse20xlhbH1DxSfZYe3XoP2OUlkJnY702B/V6KAXt2TVqsLgzprB0AW9LuafzdsgJSiHClc1O8WgHSPQrsKTAXbGlsji6Lgx6Uaosy69oIwBVraXMG0EOnzMfNsF+/06ng9fB9k1CRVWJCdR3vNOUUH/lo4RQ7VTjHjrQessR8RnXYGbD/62///tfv//DgT3/5971/XQP2QuA0n/Al+l78y2yyC1Sv2YoMUNUxmK40K7HRmgAksYU9TCDVSvwcgOQU+fUYQJdll1dldwA8+aSTPrgkIS0iw67boy9f+5Y+Pw7sb2hOHa0wvDoMTi8V1WIEsOOTtxzYkeojgV16ghNGvxI3TnrF8Vp7+UTUYX+U1rQrDAoBOw1mhK7R4CsO31e8s/yCPT6nOP9M0yi340qxL3Xb9yor+vIvDCpNtEcDu5QiUExoUi3lxbh3PRVjZA5lOQzsmI53e6ok94s3qMM+cVnB85EL0EP0WcoyHR3AJAjs+WZzYoE3bGbiIWBHkoFpvcKUz0YBe9+ATuI4sIuD9vOqFBsXR3wgr6cNUgTm2TCw8zo4ZXqCjZZxfryso5uLUYpJAfQxPVvPym2dn2B/B7AKOh1r0AVIDStM5/F9YF/6lJjVdMmEbmIP2DNuqxmTL9c6kIp2vKyjWxpI2mAKUD/mYUfvul/WYhMC7bgUqbIPVqlXi2toU/eXWmxFoBQPAztORXWGiQsrqMPedygxn0nqqODUbwnsixkFybhWNuA4sKMyBFJJWfwrhN6Oa5T5jwI7B3KLmvjVxMTJsXM1wUtqIw/eE9gXHTCnyZqiUY72QaeOf+1y5VA0rhVAXyv4WUBg7xWnI01TLgC6GmvS4FKavmglZ3UU2BNFRuqxNWyAnbQUNW+Bn+eJdn2V6DsQaYlZ0+OLaXQEwJUJk5V8rLWwDjtaZMw1PYxY25lKUbok4JSzEqrGSiRpcoZgKn1PNQvMMb2y58aYe9f1kib3aXBtD9glpUgPKy7R62GnpONlHb2GJrH9OnQxBzumxRxRhz3d0sfJe+piBqCXIz4lPivBqTYI6IOjlpgckGKNjggbYJdNMPvZyGhRG8Zv1GoafeoBdOLsG4rt09YF3TBgXwH+HywxzPctJp2i9u+btL1zEv5ybf3mwn9+xww7Hwd/Ds45FcAeTrCLso5I7J8FsD/429nZHx/8nTb/8sdrwN4DgDFdJiG4yVEDAukA0GdrCADJYrBiQ6CVvAV2A6iqcguEmnIVwEzTTZeEsf5JJ31YRWXY72+BnYo9+LR1DNi/xnKOlNsZmn/LMB2F6C6AHbcrCOw8xR4N7C8pI9NfAezqky9om614woGdSrTCwL4bLPMaLxgdMP8T3tgAOzI8E7K/erXtiyl23jMa2BHOgRDgifYBtgCgw1phYI93CI8F5/IosI/NILZbY1kmwjyvy6m3TgxLbOwUCI32gD3jgJCbiAL2MdaVvBmwD1L8oDmY11LAW8WetA/s6QLG0gf7OLDndD4SThjVVsShXc7XXiHZLC2ucUIizqaVChnn+8Aut/nFwgT7HrAbwBWVM0f3iZDdR98SPyovfxzYlQnwaGMpRUvGu+ajv0VZieC+tA/sSgkDTZMDu1wVV1K/LbCrc+zKfu0Kh3Ahqx4F7L0WMKUSOOlU9MWoy+m2b3UP2OWmGRwkVnus4dUAeF9gV/vYuZNgTzcjl5ivQhwVB/aRg01RBUddmoArRLZaOwjsmAhnIqYAdtEVs7/ZZlC8JnLS6YjwWMKBPZ7j5xsAu5oXh0GigV0pAJODr++Sj4Uj7YvBOW5HMJfLQbC5kvaBXVts9ts6DuxGcMxmjh2RyYhbrra8i9jqQkp3IBAZRyF1nvDOpCAdA3YpjskF9iuAXV3xocuHevBLj58rPTgjdMmcbYaC1se/02lw4yRUuEqMAPboDHuoBDs+uWNhR1Qow/6jcBl2MelUIPvndKfTs39TWKd/Qtj6+26EGXjW0XrOVCe8bFlPAHsXoCOGK/CNQ9YQwN6zEdjlNQn+LyErwAdF8ww5mWJO+uCSNmKFYLYZdlzMPMbrLTrl9HqVmPU+sL9lpI4LYYTh+pqtEMCOzwSwI+QrCOwhPUPK5nXYqTAlzjD6ucb5/AVtIKWHgD0czKQ+xfZDbMpX+PwZeti5nj9h23mw9lj0VbeH8Rxt7hG6NzWByqymefkHwloTgYYeeLVtrNrWOfzk4keBfW7gSKQQQ/bx4Vof7Z3AboBQMQrYlRZY2BBtAeyRyrKhGZPFOHXgYU0Hgv3BHe2cICVlJn1VOwrsfZef4GwROKAnkX3EjFMhPwTsKHVoIcyXNWnPw55skaBOYVqKUN67BuwNjx9VKykdB3Yp3sYXH4OjlR7aBGBcQ8BjwQjkCOzOFtgx0AJi50SuXyv7wGROe8eB3RPAbvpL5tVAwilVCQLtYgZC+nAf2FnE1OTALkpCkkkdo3ZhX78IATsiXBGAV8zntzBCaizd3sMuMNUhDNjRf+HxkVsNdm3meFTTJkFgH/CPHB4ER9YguEOD8SSQ3aMVm+Cbri+AXW8Z+IZVgwmZDm1MK2AsBbC3t7CfwcNolRnF434IbftVsPnVGLSCaopLKVLKSicBsNPkORsLq91H+2d8HMooY3DeEt+3BLCvd2KVFN+vnzkA7PltHfaJKV5NKnkO+nLXpW4Byoo8Kk1b4HazKm2AfXowYZ7EWPtyC/VqTifvAHat5hMIrHoUllAOHkiPn32NQOrjZ9gFsIfmnKIiLOz0L0TVG0PLXW+dxMvE7M85jS7r+FOunRQ78vonnmGX/xpxo9M/vbvL2aiyZJCtVBIRW2OZ/uWhjov+vBGTTzrpo0vaiFE5/cMffEKB/f7reeU1X6kEG/nWMLDfQXJUOuxl9toe5JfPn6lb17n28mWIoaODxWAvz7TNtpeHXNZi+zMWIFrpdwVriUqzJ28AvjFPyodja5l5Qzk42rmxY65QzufzfFzbJNxbg92BpA8nbZCpjLIbgM9XztOHY2PLeTl28GUZdWC94fJ4soIXQyTci8m7HGOzX4vaLe6nWceNN1J6VKmXYze9vnKvWVakmwYvaLB2eHNWGhQQ7lHx83l/IEvvoXijObp9R7HXSvIWfdP5eSYhb3eciUnfkbJJOvLZZjeVPD7nkhOZen+gXgtuLkTAIAXvuIWSGuv34xIKgb2tDprnO2Or9/BWronI/Hyy0sjutvOVwfV3Q6XZw4Dj0mKZykA7vDmbp2/abXD/XcHqooKf0GjJddAzm5Fqy2FzoW4S7uZkZ1jtXr45LMcOH5TSnye0G57fotJPv//nOVGZJzfdF/MMf/6xM+w/Rx0o60jhOORhp/wcrhHDlnfX1hKD4wpe37txkkixhyzsokoM8vqnfOMkWf7tH0P6U1Y+6aTPXLsZ9us/DNgRzsWanY3fG7AfF04T/eyUO1hIJkuJ3XQnzeSiRxn+kxWfYhqls7YOpj+u5BcL5Ts+wU/oei3xjqcn3UkjC80jxySAPcIGVmR3PP1sFJ+BvTiQPzAA9Fau3EssPtn/nCrft3ZvnMQs7D8PPOxoieEKe2J+srlxkpBA6x3YvluOXTxFhR0xqP0M+9bDzvQZWGJOOukHKWmjAMUVvgwy7ALT2e/uxhOwf3eKDRJtG6uuH7w5KVdbkT5JKYNE1QDoHzpBYVRnOfgfnGKlWUPWki3mOz/pTtLOATq19wL29LzYzGpskutK+jykDi6TUwKOKkUr2wYuvS99olK+Z4kqMZhh//U7LDF7CfbrNzoVNzoSZV7unmLfm3SKf9cz7PSgOK+HiT2Yc/rrTzzDftJJP0BJGwkcF0sEdkT1UIZdOWXYv1N1gAkt69FKl0ueZZpmNS59khoD0yxx2ASRb3dseoKlmPSD06AAKNJOSyfdSdkKUvj7AHv8Arg6n+iX4j0pwrJ+2JlTKRi6adoN6ROV8r0LgR2RnfP6bh12JlGHHYWwHHLECImajHcq6yi6C4/NoaqOux52MesUcX0H2D95D/tJJ/0QFcqws18B5bbeFYS+tbCfLDGo7xrY9dLnAgoRWgOAOR5IJ4WFqIgTGp36yRDzITUiem7Xl9W3kW8nWekzkYLvqs/6X22U713hSad4o9NrdR0jU+w/wr+QiR0fUHem9rCHne9M8HqA7HhYVLseduR1RPZP38N+0kk/QB30sG/xXLQ2z75bYD+Bykk/XGHxolrt9CH46FJjl6d/4/ikpHzvQg873jiJCj3sfNJpqKzjdVzfo3WxRN3NxR6adhpdJ+YnXNcS7LtVYk4Z9pNO+kQlbcRJXNkQetjT/n/iYT/pf+ydS4/aTBaGNTfNdTk7O8aKfKQ2iwJkugWWYyN6JIPAXMVd3NoS3SD1LtllE0WREmXRyazzF+a39LqV/ezzD6bqlAtoYxoyPZMvPeP3S2PKPlUuG77o6ZO3jmPFihXr/17Kf1kPl3VEZBe8LrRliNl6chJndGGMefSCU56w31Z4xSlqt6ojU8Dr8aLTWLGeoKIz7CE8x+YG4OMMe6xYsWLF+h49eWAPe9ijU+zRHnYk7sc+53RTjH1Hvw4VdmS1JrmQ1zfALhwxsSUmVqwnJ2mte4SuhJwx9w/GGfZYsWLFivUdetLATol9bYkJZdgZHocedYqW8vuemEcvOkVh703GPlBwvlCVmHt12JmQ1zcp9j/FwB4r1tOStNZeVt/s+BkWncaKFStWrP97Kf9tiSoxyOt/OaIOOxJ7RB32gK8fr+1a7nvqsOM8ENgDRVpi/hB72GPFenoKV4nhL2ITmXGP8LDf3v5zDeC3t3z77Rbf8beou2/YuqPv/ibe7Qd29dWL15r0X5acUw9EqC9ffI6IqYGbkH4BjQygaqakjZL9/TUhtUZq7+OWrq5tAkBqs323YHLt2CVlq2lgM0LVGpY68dqydFCNok5lGZllTvqhKvSByqlIG2VXkJntfbhjKrH3zuQNduuaI1V6rIYZoLI7oQqFeagVojuk/IcebX9SB7cdBA5E4C8iuQrNinjfgeZS+m5lL/Gr4tRKivRDpVwAlm6SNlLbD1TKl1MT+ciRfYcAgHWdjD7+LO8QYj++WI34MlCRwfoRpKBPpf+StAmQ+p5DDSClf3PUVCon/eJ12LeqxNzPsAsmXlvYI9edClYPvf6brI6vYT/MjiNGFImhc4yswx5bYmLFeoKS1grh+cO+mBAEnp8zBEd9Vc4DcKeVIL/yt/9UzqmU5+e3bMcXdkCE/LLALr988Vp9UsCeaPV6zvHArvRhvn0s2y73B1MFSdEFLtLJRfK8bwLAvHGvWcRmWFoRAk2fSYeUyojg/lD6kVI6vZ57PLAn6bE9E5z4wEV6SemRSo56vf53ALvaImAa/Xn6ILA/W/Z6mScN7MkSBPrB9QnlQq9XPB7Y5Qp+gMdoDIGMSeQVXwMTqWX/IwxNgNj9TPXpAvsEoP5zAPvWk05Fgn1D7CFLDNJ6SMLK8ghaR3Fc59twij1kiUGFn5sU12GPFevpKpRhV+6ViBE7dtPsIZL+otzuADuD9Ls1sN/98593ifPz2wDYb2Ng//e1uA/sci/TeXYUsKtlHZj0sxMEdqd4OXUJmIWI+5y3ALaAvYTNvcCuZ/LVskGHqhwD7Hpm7rv6L/Fk0zy5B+zqZaae+LeA3R5MWwsTzJYmPV4tcjywJy7Ae+Amq8tMbwsFO+SnAHb1NFNO/VvAbnrzYtcG8ArSD9aQBMAuaDczv/oPADtxrluXCxNILeKbk2sB2Pm6A2QhPV7yGZj57UtIZPx0KOZHALuUzCwKTxfY/8R5nUpYYlCC2MMZ9ihoF55z1OOKOoYt7CLFvlsnBi3siOyiquMWsQdVYv4aA3usWE9I0lq7tWC2d4gN/oQz7Nqt8kUA+7fn53yrnN8qt2tg/xoA+jcO7OdfY2B/JLCHdRjYlQEBvXa90ME81aRJuS0jbBOYRuSJL0xwV8Ya2FfYRGCPkKzipmdCPXkEsNdmdDtqwo9/yCICe7SOB3ZNqVezbFsncJH4wcB+NYDioXP+dMD+70mjwG63GLYNMNv9Y4XAHtLjgV07wU3DASO1ezRhgFOg10vAUKRHK5cH++pAzI8AdtSTBfY/8wedCk/MGth3n3QapNgRnbdgnWfXxcvjFKTWdy0xG09MyMIessQwYo/LOsaK9US1bWsprTr/mGaaiyXH8vzqbLZya6srbJZWy6LnD2e+Nxifhy0xd0oCyZzDOW7vlC/I6QLYA4i/Y8CuKM/vHgL2j59u3n6U18Cuvn978+G1zBvvX7+TX3/gTbFDk1/f3HyWg+BPInjdvvn0jrfl129p4z3Hy3evX39+9eLm8+vXr0+0qL7v6DTey3uBPV2vNeczcaxaPstO8l6zOMbuqV7NyJSSiGPlgrwGKP5E00a55hjdqRKcKVv1Dfc6pa6DOslJyW36fE+jJ4IjgH3SylMVTkQ7gcH1BAtOl8pzG4x5uVxO0xloPoGewvr0YTCRhKoO+JMItB0U1La3Bvb8oqCeegjs+1VpiqHkTrlcmjwI7HIRzCXv1qsmEq2+MSjw66XfwX5vjI798jIp+rV7iM/KtG8Y/fxYC6BkOfe84qm8DrpMKJddY9BW18G1fEqLAvZEJ09VWZ9AaXVpcA+DU9PytQG2T2/dA1b7tgvddDQrVa5doz9NBCNXF83aaqZxECy18Mak6VVHAXuq57rlQjSwX+XLAxuM63J5muIuH98z+mU2MjZHeaoz5ThgT3YGTfeiwPum8vUhPbPXi/rQcFb1q+RoYHSreKvl2arWHHRywtZDp1FbnYrb3MjXvIu2APZkJU9VVYT9vzQb92rNdcY9wYILYwwISQC7ugRSDEYuDXMV3+i38NTZpe9584rGxi1PG9L6/FX+ISyajjtvqxJKTZVrRqaVFeelE8m1i0ZtikOdtFlwEYN3gD13mqdqrU8gs2CvWGHBzzrliwyYffpVqe9cgno1T0X/NhhlsNGGQLr0bJcAej46fTDudQ1PpPrl07nX9DsaNrKlXjtZ7xv+jE+5VL4wwJyXy7029kznqeqT9SXQb7s/SpZwT0jyNN/GbT4/DCY28BxvIJZsaEq+6/R7yc2/UxmDsz3Ars3yVKVx0KqXK7lW18GMe2T0tWcMWhq+H5XLPoBXpkr8shl2RHbB62FLDCqUYEeGDltiHp1hFz9i4eneoo4o9LDvWNjjByfFivV0JQlp5+eW3m/qTPXnNJtOm67NWtaS4buNRxy2ae542JHIv1KPOoI6QvqX87uvifN/3gN2ugOB/csd7tgD7NrbF0wfXgTA/u4ltl99xNbLFzevNk3c8eEz7nkjh4KR/Wmb6a1KG59e8cZL5Pe32EK9v3ci3tJ49IdXe4DdMYGKXObWBF/UgcqZ0NbUAiaroLIjmYTEJdcgRTd1C1C1Ce5NN7FFhAE8Q4fCCIcFT21AueMoYG/h0eIa/UQwCyjrIJSnKHFmQDDZS8eabZjO2YvhAbALHQT2jiFcLsoAgFT2AztuRYZ9BYZvAJVd4Zl3Jr16wo7UBBDL19Dhi25RzVM+2IDgrVsFN6BHDB/7W6PNUGC0o4B9iUfXHvaKFwSzgKoNQsWJtE+nNejOIrOzi2CWlSCMySxlt+l8ikfDwK6d4ZkdIxLYqwQCIYdXDECZPf7NKeCJ3PZRwD7s8r5l5K4zYjV1/E6eRkaPiD3oAwQkmSjz255J4WnFNPhKSu0U23YzuMArPJHwsLeJzk/ktTG4wINdDIgEdtyaZX7HibXI4LlWPPPORPwknQTYU3EP27BgRxeAsvLBYASbbvCJzYi+wAhzzhg/CNZ7UcDewBOtETsxABQGTAwQMk4jcu/EuJQj1p6CvXu92Tq7vdrYBAT3XWV7JPjQ8IrmgeFdwUkR4tk4qw6egUAgMsCuRTw2FRPwcJwMmBGu9iQhC9wCWbHtSTEYyeeAfsbH1tvYfObisW40sKs4SeFhl01wbdzRiuT1MqCcBGu4sNboFwZ24YgJZ9gDYt9k2JHWdxadCuv6o4qxY2fxsz/DLoj9t0L3iF142OMMe6xYT1DSWgzYdd0YeBTRGaHzpu9auvV3BHbO756j68Owh536YL4yLP/CIPw2sLJ/w/dRGfYvSO77gP0TZea3SNMI7O/ou5vPH2gTMfslQ/NPrHkigJ3uennzBoEdgz9RyObB0ntsv33z4oOMiP7q5tOnGzq+jHn8tzTwzYe3b9/SYOT17b6fX4lpRAM7gLVwTYCZFuzQCeiGQ2wKeIy6vIVDd4wpf+MuVMFgwD40gHLlwCAuT7UaAIbfNwEqcgDsZjAUC/YAnAENjgb2U9/1zDWwX7kY3DQR2Jd+t6aDVet2u8sTSR2QzJgC4aLpV12yocGeDtXcfwLYtVkfoCMfA+wFWWlniKD7Fbte03BMq8Lp1sgYBNPvPWKJQa4yDNjHCwB74XsmZ6MUbTqLjAVQzwXAjkMZpjViPIfBrhkN7FcXrmchsIuFpHbGd3UE9vR1t2aD7tFb19pn8kGsLyf31KOxuvRjcM6COjBO1zORjQ4Be4V9NzIOQCSwnw66ng42/USv04yibWJ3/b4OJK/hNfRczz4S2FPseruuSWmfAzuA6fUtIGUtGtiJCcQxdDPPeB1A7w4cAD/JZuUQu+93ad8L1nfm0cCMsf59JZF3XWcL2AHMZt8GMmfBQ5cFewD7gH0qZ696JnichU9xGjadxgUd+JpNo2Zi+j2Nu1BKngF7sk6P1opdS88HY4HZ9w2AvsKBnQ/VtBiwP5vSoxgcCezJKbsEAezZFg+2MYBmm/vsQ6Nfld01GeopcrF/FfL6TAk0k5F594qkLIAQUovKy18AEI9+4GYR6Z1dUVcH4nJgB3YrHQBDY7HFLrvJ9KuywGnLl65rrIH9WQZAz9QIHAPs6oidtriwic95nTbdogegJ9jAdChzUQPYk2HvuG5zG9gB7IVD+2oRsVOgM17oABa2ul2XfUmpxr8csCOvMyGxM17fqhJz38O+eWrS7nOTkNv/M+KWGHyNTLGj2JwinnT6x9+vE+x/iYE9VqwnpvsZdt2nqL6w9A7dsGaGbleWfkE3tl57fmXp3vO/W/o0DOyI53dY/eWLwlCcNfDlHrB/oVsEdnbkaySwo3f9Jd2XfRUA+5sXLz5q2L5RObB/oNvX68T3yyCfLr/XdoLVl/yY9BGt6u/Ze+yLzZCH/SboS3P4zEBCfxHIalLu5V5g9xIUtSxYKGIHYeDbqCYlrU+gcyJpRROoK6asE8HXJQtS+IpmmcYpOqEXBC7pm2ETjHEA7EBadE+iqmA2Ps+Dn4WAPaJKzNTmppdEIbnjYW83oaLmigQACIF1LnDcB7MgPRrYT33DBEpsePwQsHOZ84mEWtFYNm1lNJa0MmHXq5V0hvOXNjmTuM4M6Gxy+Eoac3A9AmUFydyuBMAOpJxgQ6UwGz+fiGAB7NFVYjAbX+TBjUMedqHEPDpRKOeB4CyH6CyYErhOUHCxYJA6BOxyHUhelhKraGDn+H+RFe+nQw0T65tE/0n9KGBHQvcbklaxaV9sYiWW0yZkUtHADmQxpnfslI6+NGFB75XSA52B2HhaQPbu45zVDpD5CQJyqEqMAHa7hVRfGyILEj+LvBwN7FxEXNMpAehT+s0VaHTBhP5E0mYOw/mUCwNhE+vCAl+b7BbmhkPkcxPcFJK5uQqAHcClh+T0iAZneHpcHs5CwB5RJSaxAKPNgq9mBz3sWqNssQswprn1RXkOADjLCAIdgJOmg1k9HbyIsa4IPY6Z+BKbhgnOFe1kgLVEYMcrS/bBOuXxuTI4yr3+Ati1CYCRpNd0FLCf+GCOsMYiDpzVQU9zn1Kf7kwA2M8krQ3HVImRTUzTq93Ivx1UenRGN02Azk/jYRfEvpViDz3olIJxqEgMprwDVBfarBZ9/JNO2Wh7PewC2SMT7OJJp3+IM+yxYj093c+wW/+goH5q6fkA2FPUvv7c1h0E9vlz+uKzl/zOk06/UPPLl+dflG9/U7gNBuvGIMdzYL+9u7ulo9zhIZqIxxR7JLC/D7zrbzmwf6RkrgU8LXM+z2psi1jPdzBUR30UGP8BgwXWh0RZ/G0I2NE8s+mbw2lg89M+SwwUVNyaE7GjJJB6ZkCNAVuiyQwySweWslTud7KST/QULuDkVlmRU/URKH0CQwHsyOioss56ow4De0+Hkbxn0WnLNobsdwXvomvCGthVXHP6WGAXxp16Ujoe2El3KIAdKVwcRcxSfMbg6RrUs9Jlt65IJV0foeUHyYdr1gc+BsX7jgD2jYXl0oa6CD4I7FUbSiL4GGAXa06jb1t/Q9uNOTgjNl4ZrOohYE93oY+5c+cIYBdSW2CcfSewJ8rAjqALo86B/UKlk8xj90hg78/EFV1Dc4QXasG1tpnGGTiXzKXEy9ikjX3AXlQZOOOeic8PDJsPA7txuQZ2r7A5im6Xkw4j1cQK+gkp1Z0PpaHNUu5XTehucFUpB6Uhr2zIaBzYt6xSYw9qIvggsE88cJXjF52q6YwJAOZgxu88OouMVBSB1sCYNCySSTjQ1HZvh4/Avbmn5jUbvgBkwYHdkGmzAvrlIWDPrUBvsUR77Rhgz9VAT2x/28w8DuKwNLlc5kPItSOB3WTZkHRUsFYByAS1L5s/DbD/+X4d9j+Gn3S6nWHfdrELiWz4VjX2xz85Ccfdn2HfLusY/eCk2MMeK9YT1P0Me5N51/+BKXXWNNAa07UsBPYLxurXz88dfbUD7LfK3Ve2yvQuYPSvyO2I5RzYUV/YIQ7sd8+Vr9HA/hlZG+H7tYbMffOW6Q1aVSifv1ElzvMC2F+JIe4Ff9TQpn4ibSv3/vNb5nP5EAb2cF/miHnHje17gF1HMLw2YRzsMMdrTKJYmUX0JvpYSrqwUsZN8CZSH/oNNLhbYg0pptCNLpNBoJMLLDFXklDLxuDDwC6C64oWCew9vTuWF9DlvzEIYM/r0E9Jjwf29qBpE1gvX9WU8bgh7wN2o1WoTGsEvHQA7GS5tY5zlQjMLSMpNwc/lfAZWZWJV8A8uN6baJusu93vUjVN6CV5L7IhpyUNLmPwEcBe8UBfYfCxwN5xwGtHHrChvhlolgl+h2iZ5vQQsFcM6MloWDkO2JXOatHvOxxGjwd2xOpFCkncJD0EdqQwtQrGaI8lZrWeQg30WpfK1WHR4KtOV4N+30Ab+cyFooxYvwfYMcOtjcDpoCPGZ8GJ8h5g1y8K7WrRBLsuLDHFzT9wBH70tEl3qkswltlLZkJPE6uEFnbSTasYiil0083QOdd0cCeBJWYgbUzqNLigHgfsCRrcx+Bjq8Rkq821Pz6Z9wwTcLCwEi4YwzIYiWhgV5pgiL3oiLFPsZdOXO5h7/PkuZmPBHYNgV04Yuwcrjw9BtjlORCjooqL9YF47E72bfb3lLwAPYccfySwGzgBHDkcVwdSwTc6WD8NsPMMuzCxI/TulHUUdWKERIZ9C9oR1B+J7CJLH5Fix//uE3uI16nCwP7nuKxjrFhPSvcz7P3AvD7nwF7DSo6+pf+dAXsZWZ29zHeA/U65/fac/fnK3S//FKtKE+sM+y2WXxfAjgtSo4BdJMelLAI7BfON3iOw36jI9YLFkeBRCOj3gm84zAvJN+LgB3kH2D9t91XZUMhFuX3AbjQC4G2rfAc61VElkRX3CXPDdInboJBOUooH+STmtaj0YkMLkF+IHUVgtzcMne3y4Il2BLBnMxjsj7UQsON55o1UDf3qSwNO14lxZyY9GtgFipPvKOuorQhcyhzYrcrWutV6NrixZxLFdON0ZAA5SxbR3pK7IMAsszMNZ2+BEB5F0/uGN3MrHpzWjgD2kzIGZwrakcC+bIIVTWktk0zv3cQV3pSqDvVDwH5mQ4lXWz8G2JN1HVDfD+zpGhQVvAwLynzR6RQnAEYnGtgDDETPOghh2j17KaZhT/HonNP2HmDnnvIKpuPTDhQxePrQolPt1IRMEk+NuM817kI3gehtw4Bhu55nkO7LZ9Bss1Qzur+alyom1g1Yq3nKgd2cb+E4D26pRwC7eorBBgYfV9ZRU8oA5oVonnRIVI5dWYA9JXpJaljgRfC8Du69fLszwV4OGBzYBxgFZu9Qhj1pgINXUjkG2LUJwQ83r+KoHggxp8xJE3QcvH0ksNfwxECud+PmQMb4xgDyMwH7X9Z1HYWHPeyJ4bweLusotHnS0WOQHccQCq05pT8bcVzfeXLS70Ud9njRaaxYT1T3gb2LhI7AHjSpipaeZsn13n5gp0h+e6f8k/phvj1PBAUbb6m+PD//tsH3O0y7I7BjNZm9wK6yLZZ1xObn14FOENg/CGDHtaFih+j7SQTn0NL+cmt4jebOX76lo70KA3u4b1ZbA/veso7NRMDmI5nv8BpbNpZT7FM0IcVQWR8PCIFR1QHkQYXXkyH5JI8ZXARKyxzYvbG0ljLnwT3lALBj8LUI3gH2It3ZbgL6TbpwKpLEekF7NLALpbpgpI8EdiReTtmrrfIalw608CbUEdinljnKm4SURjVA8krmEdIJ9izp0L8ItMwGVWK2gPxZyebB4wPAjsF1HlwcHwXsbRf0y+hbNyVmawvsDejlgsR76RCwd3QO7MneEcCuXhIwm/6q3P9eYEez+jUOU7FhdRSw8+OBE8a4CHSpUCuMCcSg08gwYEefDN7b6R5gt0obYC/YHNifPQTsuEih2cZpI+5zpdyA4ocODBiSk+LMYrnvC8hg+rhtwLoczdAGW8y5riCw3wNy+ZQHN9uHgB1dKAbhBYWOA/aTZY3FO8K3hJUbzevI55wS0tekhgluBLDfW4qqdAMcVwwB7P6DwK5tAbsTAHv7qCox2tgj/IFr3AlDLgKVG6zJgX12JLB39wP7AoiCb7yfC9gprwsPe8gSE/3cJJ7u3nbE4M+GvB8jka8Xo6PQNx9ZiJ3jergMewzssWI9RYWA/X6G3UV+H1j6P84PAPs35cutwsrC0FQ7d8RQ4WB3Atg5qgeLTnmKPRLYhdflHQf2T9gUEhl2TIjLUgjY2c7cPfgXGXbhcP+kooc9CtiFB2YzVPZBS4zTCNh8qIWfpDS1oIPpf4rpKbRHz2rEt/yBbqZEsmtlA5ChhiNsUsCirONku62lyix4ph0CdhFMgBS03Qx7kWXYW1mRYcetWVE3XTVV1bSDwB4djJqD3j4W2NGBfhUAe2ENhs3gnxkopo/QqFK9Jl2j69u0idImJYMA6WhoUkeKF0JgFxPYDq5qB4EdwaLepMEt7QhgT3cp6sjRxy51Mr1X+/E6wTPsZCvDLpeigH3kQInbxI8A9tSAU67a+n5gH3bBx89yqZPjMuyIzqhCE+Zblz4p8j7aGQJ7weAZdqV3BLDPmlDUMHg/sG870E8JL9IYUHyNm1sshqqNIizaxFg4c5c2UVryrE8AFhrSfXcz5wDYe9K2no26NDijHQJ2VBaD+9phYFevfBMASL/CgwWJkkwwSVVVtWAGeQBcSDohpBsB7PZ23j05Z6FUig1NAezHZthrYGv4uUQDu0kWAWiv1pc/YD4elX7DuqBv+QxPaqBjwOjxwL4CMsM3Npg/D7AzR0xo0Wkow75JsQuFq8SI/5DWH5NexxdhYg+tOQ2l2AWxh8s6CmD/S/yk01ixnpgezLDbiNwu9bAfAvavLBJz6JzQn5/f/ZMJ4Xy3rGPwZKUvUcD+mqXOxeJT3HzcnE0sNkUWDwP7bvAnHEtIuGiyHNjFY0yj+77GJu6OBnYyCVaKjqUwsC+doNxfHyx6tNGEgeVVmrZNvC0SHxDE+halztyDwB6cpyqiFsS+igR2oSIRQyrdNWPn9VpKXqBj/YJ72NtNMJd4bSICwDw9EthLFg0O0blaFMB+Uup2/auHgb3tQiYE7GjV8PGGlom+xLWnfcO49C3b3CbxvIlYv/SgrOwFdqESGtwFsOtnkcAuNDXFkElxbE+hdVI6kaJ1hh+/0NUgGKdFzBZurEs0vWwDu95a5+0vFEaT3YPAjp9fT8Oh9gM7M1hEaVLEE3Dz+ncC+1UGi8QIpT2Yc+hGYB/2YZCgzfHgCGBPdfkSitRiL7CLhbudMLAnVkGKu0DInOJpFeyMflE1HX2bxIcWYn3DBze1F9iFrixwJ+I9IcVIYBdKWdDkwWoFj0Upmbe5nUS5z6YpAewJD4DUJDEOllg/qYI5j1yT6iTWrVwJrI5IvH9nhj1bBKvAIub7gL2G0xHAzjvZoF9JknyBRWKE5CJfvKP2Hg/sl0Cm+MYEW0I1AEo/B7D/AbX2sP8uXIedayvFHjLEcNwWzz36t7RdzX1HG1q/Z4lhc2TatrD/kTti6J//7Qx7IosbJSnHivU/ogcz7PqSblOW3jwI7H/jBvVvNFAUWEdh+UYB7PiQ068I7DzFTrUL7O+CPPgNrxKTwwqNqMABgyCt0grqagjYw8GYUxdoriGwI4O/RQ87CuvFcJ3wco6i7zt6SOZOmWhgR4DOemBNdoA90QR7ws2+bgO5HSgzdgGQxoR6OgL72ANnLIlJ7gP2vIXnEzw+2wfsAqYvs+JfmfvB4FXHGeIK12KNV4lJu0DOZOkRwE4CNMypAdUZ4M2OfXCS1KNsnAgDu+JzQ/uwy30yzFlenLDXAfKWuBYE9gQrJSNoZC+wdxxY24nqJlQfBPYzQwC7lkd/xL4i5iSffYDm7TPOJydYHQbLdox99ESIRPtSFFHBXVDS1tnqEe45BtgN/sGPrL3APtIhuq56tgRmiafy7dbxwC44WhhTNBWBHZeetm0E9sSKojhr6oeBHYfqMQO0+SCwpyl1D0PAjlh7gb8o8OkUCHO0pAngLRQa1xDYs5cYzOe8F9gnNXAnGx7vag8Be6MPzfE6dZ2XoiRXAMDsnoq2ltUCnxuYqzWwQ00MqYMx4WQ+i/jM8mAW+TBJLPGOafiTFtL9d2XY1SX/fUHRI4H9mQ0O65+5B+wnCwR2jZ5XzFfFZcpkzo7ajwf2MYDBtmdYLYbHgf/LAvtfA2JHXKcSa06jE+wC1yOedfroB50KCUf8tvgy1/CiU677Tzr9/f+Jh31mA0BKTnYJwKpBSF6OFevpSxLSIjLsuj07/3vT0i8PAzt1q9+hFYZXh8HlpaJajAB2fHPHgR2pPhLYpTe4YPSzeHDSJ47X2sc3og77q6ym3WBQCNhpMCN0jQbfcPi+4Z3lD+z1PcX5d5pGuR13inOpm743OdEXu75WaaJ9L7CTtprLECg9CwM7+tIzCSnlBc9C8vH5Sis9aF54raSkzZoAPMFMyWamSvLINVK7wL7ypjR46MEa0hl1O61UQ9Z2gL3sTRUa7AIUNpn5XkMNEqFnsoxLXE0Cp6wAOwxaVaZCNgLY02edlQ1uvXPGLb+b5g6wT51+taEqJRuQdg8Cu1Nadko1E8iZGgJ29KW7aa3hE5hmeROqassG3px6vYakpQZBoWa63xnJlF0WznIX2FsYPB7ABtJHBli9q0ZW2y3r6JUnkjbxAVpiJgSKV+qeAuzQn1aZ2krkqlNK0CqruM0IvWNRGNUSKwLlJCd1r8K4e8OzbVahZthIMpePCYsrje44AtiHC7DySa1iwF5gL7igX89w5JAqNkVzTckTKCrfB+zoerHyOUlNXTh5/E1EXylaoQkI7FLFhFpam9XgCGCXChbYvVTVgX1VYorL0dTXgfhyGNilmUNPqGVbBLoKt6nDQk55waORrtxBWtOSdW6JkVJNOsss/YTLzvUusKfcRUFjS183kN7IgLkoNBRtt6yjm6HBz+h5+1rQnYBROYkEduKUkpt2omatZlk5nQFwTneBPXkBpNZQVrhnVwmLEnuOWeiL3LtuljV5ScBpfB+wo4md+KmCAZHAnuuyXyfkPARlHV23oknqiICl8SqPJJOU6K21XdbUwTyTTgbwOGDHwCZAUdPSBIioNmUCOcv+DB72jSNGEHvEg5O2mD0M6/jyWFoXY/zqQU+M4PXfbFWJ+Z2wxFAxS8z/fB12G6iG8optrlMAF3KsWE9fuxn25xtgp6IvmGA/BOy3WM6RcjtD828M01GI7gLY8biyBvaviWhg/0gZmf4RwK6+eUHbbMcbDuxUohUG9u1gmdd4weiA+d/wxhrYkeGZkP3Vm01fTLHznvuAnYoAYIJ9B9gnzeBoPxF42q0xS4iSVIDzQNhRH49iEgDbdgSwX4vgQQPbPPPFNE0igAoZlP4v1sFigKojys9oPjGGFJSKtethqzzZ7uoNI4DdB6E2ThqEKrvAbkMgd3ZkHXYU+gRCwJ7wgV+DVwgIW18yhwg540tRgwvsz9Z1YAjbYUUA+3QdnF4DVJm1sXx6oQ9CNqvwbmHwFii3XVF+JqTtrs4oiiQucFrBMkPGX9gyMDZZBsAdWzxbx1kVJ5i759M4btEpBhPCgB3NN0JWaxOCX4cIrwafBHb9TmCXOya/7ciG2khMgwN74oJ/+QNgnxRBSM/vAPuzKUaSfRl2ITTOhIA9exlcAh9xsgBzzvLtMOBLUcX/VZfcbmIG0WYUsDvBnDdXqRX4NQzZ5wlcvPNYBFsCdhV+jUZhB0GT6fvIXYNAaJAPA7s2cQDlYLewGJzjNZhFvCISXNCFdBDYc/9i71x6UzeiAKy2qtTXsjs7BlU+EmYxgAwILNdGbADxBmFeCo9Y4iWxa3d3cxVVanQX97b/o7+l6/6bzpzxADEmScO9bUj9pQkMczy2x7ftl3OPx30QkAVfFYcRnGFXk4AYXNjTOr7Hq40HKWaSlPCPGJ+NYGGPlmHH4FFhHxFvrKH4pALI+j9f1vE7T9i/DlrWMWgV9s8D1omh8B/P1PV7JTG+dR2DSmKYsftXifmKZ9jpOX1zcSUxscx4PE7G5MdJApidZU42gOR7hVDYQ14J0g62EMw+w44viwbzdecPZvGHwr49Fva/mKnjiyiE4fzJPhDCju+EsKPkKyjsPn5By+brsFMwJU55+6vK/fyONtDSfcLuD2ZEb7H9Ezbl9/iejo/Cjsb+lvXzYPWN2Da6P4xfA286VamfDwwAaE9UIeyNyL4/MiBA2SpcsvDZSNEG6HxBbhs7iciLR/smt6y8cizsS50Huwejx3GVmc4VlksL7BXVcxG8vzc0Wyco7Jhi7yuS4J6wr54n7KKGPeMQEGu37IXdCBb26xSP1ZyMN68bfFaSQNkaAFgB41mYM5KiN17ty7rET1DcDhqt2Vw8ttfHwl5t8GBnJu24ypsEYMOEvXFP2LsiOLk3tpTxqLAHr1ouL70VZxLcjQ30lYJIjKP74D2ZHrmORYDXG03mhF3AIoYH19ts0mKqcGCjUiZc2BeAHKpkrmYRFPYj0h0NAEQ+PotC/riwi6kpAYWloHFNRg0v/pJYuNtIhbCJrEAdhd0Fgdb3CTtFHltAzO00aE37eBO4zbenMQnJ4NYIbounoGd59JQNqWa8YpOWawD21kTZ+ICPNqgeC3ukiMF4TIJoRicA7RX7IwkCY34QvJ8RZaMRFPZHiOc1QPBXOV8NOyaj23jMIykQNYHdRF/jASZNnNUOH8gwij5h7wcLewqz7ToBw6mCVpOOkcs8BcCFXb4xxO9bnKsFHExttEdYZw/INEDY87CjdFrYBRM8I5Lfn3FZI/+psH8vlnX033TKjJ36MPd1VHZqyr512IWriyz7+Rl2BEc7XRHzeUBJDIIVMczYv7vMJ53ObGDo14+HlgGW9CUN0KAvudksIoeEXD7SDmbl9Bu/8A0V9h9+X9Z+5x8qXifv9Qv7GcjSMbF3uXt7kN/9+kt0X3Wuvnvnc+jgYDHYu5gq+uiWqhSI6P+FBYhW+lQw+zy3zionB0t3l0n5VKeSWS4LV+p+tNZ42VXUB4Lj2Pk48cJymTkRvDEwUfk8Ht6/nFh3equY9FHIJWvd+MkTTNbuTZWqVJfrVjQ4+GrGg59EelbrVCPqx5kWNbKuZXYnIa96VUXdT1a2kJNOolTXivRE4t3eTJaeiZzojfF8n0O6sMwmZDHPmVpSvndY2Yj0ZKJplhcfXEv/nOgkm22pp87vetwZX0elHbFZ7eQf0igNzmLwk3ZLgxNR6Rmo8Uyt01VO919Vs8oDm8eSnfFk14qMa5gxeN6RSHINzFlw37qmHDRb62lvdZgXSdRqyfSuNeskpI9EfNxJ3D+jF3DT6cGTToWv+5+bhASvEoN+fX4R+2fiJx/Nn2Kn+HPsaOu+kphLXod9CMjpbHnM2xUKe1dGYR/KISGvhsMM+/0vJuwo5+KTg85PLeynQWGXQp5D7sYAo77tJVcrqvQhIS+GUR2GshTyL3M1ACsnXSrKJ+fwSaff7W86RY6fm7R/chL+w9nXm4v68zMz7Hwc/Dp5z6kQdn+CXSzriMb+UoW9ctLHCXC0rMe9kWcN1k8GLVmemwaAYVIAiGkpE9OcynnTrGM1zdQ0Q4sPuUykHZ6KK0LKUdiFprN/DjtDYb9IdmUwFUUKCfnviTcH45yacFm9Rci/RnSsT9PS1QbIULpYlE/O4ZNOGdTXEf8qMULYgzPsviXY8c2ZCzsivgz7Z/5l2MVNp0LZL+RJpwQcORjwY0z3nePdhxG5BPe4xhr2uAEwp4G0AQU5JOQSkXYIHRevKOyo6r4MuxJm2C8VNd2tNCzDMMqhsIe8BJQ+IGQYl0L+NeSad3enfcH/IVA+OSLDfiDs/ntOkYASdvrts+pdQcu5j07iy8Qc33MavKzjl5yDFDv6+svNsBM4ZexwhBEXfWkCoN/0KvSlLE8XNkB9sVikAMzFQkFhlzNo6jEToC+HhFwk0g6RSd9JuaUNhaHvS9jDkpiQkJCPRbpmAsXsX25lxiUSLdj8puG0dLkon5x9hv0r5MSyjlSOfTXs1J/9a8Sw1/PZl8TguMLXjx6cJFLsvhJ2sUoM+voLfXASgVPGDsdURd8YoMheZwAD2V/DzoVd3gAY6SJAXQ4JuUxO1rDv9Vy0du8+rrCHpashIf9jopFJaOv/PqqSuPC/1FA+NYcPTmIl7F95NexYEsPx18R8sXtwkkCo9YFsn5djF28Rf0UMcpxh39ewM156SUywsT8s7DXTXLHXFkBJDhR2ig5gAxjho09DLhVpBzdxZWfo/pr2F1LDHhISEhLyv0f5xIhVYjDD/t0DJTFHCfb7DzoVDzoSy7ycn2I/uukUv+9n2OlBcV/3G7t3z+l3LznDDpCS/Tws7Iiy3hgPCXsEx87IISEXSnCG3afn2NwLfJhhDwkJCQn5J1yosKOyc18/XIedIdZhR1CWfRUxArEm41nLOorNRY3NqVUdPbwEO1d21PUDYX/ZNeyMtOzjEWGPNXXc8qSwM7L4q0BIyKXiq2EP/vKl2pUwwx4SEhIS8g+4VGE/XIddCLsoYg9MsX+G374idvyBnG3t/hp2vjPh656y42FRDmvY0ddR2V94DTvAVvbzsLDHNaAYevFBYV8AAGnJISEXiiRQRTUM13PGvg7Ga7yEm05DQkJCQv73KJ8crGHHBydRsIad33TqW9bxvq4f2bp4Rc6rYvfddhq8TswXHJFg9xv715eQYZ/LRzws7AMAax3DzU8LexYYuhwScqFIe1RVUqUUQK9XoC0C94hKKgYwU2dxH5ELeYbPKNuzoR4J7HPNekt6mLUNlPYkcAYmiZNPMlpA+1oS5HWrnZAo07ZlrwKHauFQDxFPQbF1YlvlORejCAEYXalmA1KasahMCQKaY+njEs1FL+TP0wG5PDQK+2bCBYpVk55APBGJSqe5xmtjdqRXSjoxkZ8+zRj8PGK+baPdhy5QPA8UYy6CC2AtpWBEgLmULgN5owlMh7WLNgEA7Wnrcl6csJ9c1hGVXfi64KAg5vMDX+eajqJ9/g2nXsL+EP8dp8jxqo4Mz9df+E2nQb7+sLAbQHLsVTmdYccS9qQGUJFDQi4TyUcKCApPgLCLL/VSFPujUzol7H0NejHpIeQGgFYa9JWgzkgJbpSnCLtLAHo5qtYLAJgFhSsD2EaeKexKCuatTyDsWmo+T0aFsIvmJxH26N2Pd5e35Mh9YY9OCRj6YJ58irDilieJLvlQBel1IvdAXz85OAv6+Lk7WoOdfbKwqyMCxB4Ms69R2GMp2KHTdlo0tIT0OBct7P4a9uAUe3ANOxr3uc853S/GfsTnvoUd2VqTHPT1vbCLipiXXBIT6OsPCzuAga8pgLp8Qth1VmmTBICkHBJykTxd2HfGHgr7EfE66A+r7kwHF7c9W9idiSQV2i9e2EmxOdRgx1Lmhi6asVDY90Szqfx+4iNbqFcl5Fxhj2ygvZZeL/+dsKuJ1Hx0Kjq3BHN6GHydKo5ei7BHe0OOBaSPwm7Npz3277qlSo9yscJOjX1XEuPLsDM99j3qFEvK79fEnH3TKYJb7zP2Ht7+fKvE3FuHnYG+vk+xf/NShX0uB2OCn716awDFeLzaBgAzHizsedoVk+U5gJGWQ0IukacKe/iwIiHsgWwMWMvSA2RtnoM/X9iNkSRVtBcv7Ego7M9gtYB55OMIe2LIfk18vfwnwv448QroCcnHaxF2QU4HLU5f1Rw2YzYYI+kxLlLYv0Ff/+4J67CjsQesw+759fkcruV+Yh12PA4Udo/AkpivXm4N+7R5qqcPfvSY6LsBDmHiEijsIwAY0UbMBHDkkJBLJBT2jyLskTY8UMXe61cGBiw2lUrvintWbaiXtgmc1EK+UjRBn1cqlZE3y/Gl29ZT45wn7Ku1qw96aRR2zYBaTk2BbXjCnu657dJ2hVsm85W5xYdK4pWdlFO6vihHVInTnbcHzYQQ9knzoHdWZtvaRbptAbdtsd5UuSW2lWuVSrl1StjNYmc97hQtQKxUkVI3niHsv7x5F3t3e/fhF9Xb7a8f3r+//VXey8273+7oB1HRffv+7g3vjf365re3P7798ObNG29r9Zff7u5+w0YAmX6npdQcfdFl20eWw7bu9BM8ONnvXCdv6qWmuOCjTanRT2Ty6zjfb3dbb7tVWTpm1q9NB4Nea9lo9LBfqQ3r+qA/Unl3fpqYbeolMZfKOE8Zx73d5CtDC9rbSmWa4DvKbEttdxwTLkiPV29UcKxWp7Ktg7mglyx7FSD++YprgU6HavKhlN6wXbopqKK/P03Ex0PdwaP0c5VN6XZjkxTzPNs02sNeDgvj89OaU5q2xoP6lB5Xol+e8ZhCpYMnFaXB+rBGg5FJvrlKr4f6YBmTjonkG/WbwnW+pnjB5VG66uqDDgZHV5WGvlimJSS9Lpb0xk1X5dNauRmA5tDT78QlXzAjV1207dK8G2XzRoMdMFjwFIP9xLosuEiDcdMu3VFpu1Zxznu47YBtq2BsJk/Bc/Wu0bBt14tV3FYpV7Y6aPRfwnwGO33B6qQ/0J1mXMzz1NGL61PCHs/3M3JhrpfyaZzgeUmvz7Mqn4xyv6s0B3pxJs6XDuWu4+Up35ca6Tu6k49jF40d6tvIaKHP0xK/RsO6XR+Oo9LzUCdAGgftaB7IlL6UKxlXL0YSC91N88CVW7faiyzb0UUK+7eHq8Tcz7ALJ96VsAfedypc3ffzma6OP/31MEcVMWKRGHqMgeuwv+CSmNMofRMOIe5o3+kCw57kfcLu0pdrVrduAWwwcoalNCEhF0go7GcLO1I0IHNyjgYgaE/QBtvYIJ00bWwNEHj/Fx/rgDgTFHbdJkDZKCjsDa0x6erGwOTCPivxoXDTigaCPGv3vbbGs/9R3l83ubDnRe9Y5rECLLQvm/tekX8H0j0h7IuEhFTrwODNmv0MYb/98aeffqT8/BtO56+0wfjpV9UT+vf8g/e/YOut6OWxglsZxeoOGz9/wNYReaK7eCXMLD1YCxBtip5ZJpaOF2a4Quvg3boOzgy1skhw2oP+RmKKXYZGXzRmYWMbEKOMBtOhI+Ncp7ho4URgnpz3AiJuOm1t+Y7cCXYXGoDYvd19zGLCj+gRQMRNpzOHH0blSvRbQxxOK0tHzAaAWB1u1RV+GLifNX/PTtDo02uukRsMWjngsH6lzwOclYRUiTl0ADDaj1rQcTclUbvTJeaCB1fYUHk+1ACTt6M2IMSNs5YOgnoS7bZMsNUYcfVfAGLm2bHtg9sY7KPlBWt4iNd1QMhCYa39tnoBZ2O4v0C8iWgV1koQQMRNpwoPXgqr9q6wnuTa28bIxglhbxEj5fIjoSOVACENBXdLSN3CE+zhUEodh3JA6/BfsPmOrAw7CP5eM8DT7HRRVK5Jz0Oeg5E9bG/BoMcRM3Y7Al2iROeAkCFrXa6wHzzpVCTY98buK4lBW/chSlnOsHWE6/qxtn9+/OAkxP/cpJe/DvtziWeWhRx9ve5F5JCQ10ko7B9H2BM6DLAviHLK0Qm0B46TV5iv6wC6OzAAWE4u6zoNA8yG4zhdWXiuvVjYpH6Nwg5gOm0DyAyFvVMno42Rcrmwz+oA+nCgATCvXtOhND5UNcYE3iD60K3TbQsSd3DScGgsF/aKRvQF9maYVRV322Jqv7/r7T4u7HZBymXK+Z7iCbveX/YizxR25t93d9S936i0+eann9/efrj7+ceff5WEof90++H9z29/8ez97e177KWt327vfqIb395iAh59/e2HWzoUyn+AsBsEDFs3mLAvTWKnXDoFZMmFHUArlWizo/LfoUg7ZQNwYZ+4AFZqYQH000HCblpsc/qjn6NibBHbcQd0qKbqKblRaoimdF0p1c2dsHeHTl0Di16GbRJ9HcBMLWyATZw52g1tOvQoUdhXG2dgg9Gml6ypSEcUcCiTDVXw1p6xnJIBRl4IOzGA2LoWIOxKH0Ab0B1ZHe7rtOkMbVYnisKu2ewsLAOKV1JiAVzNqwa5wW0xWAcYxrmw444sXaMO7mdUAjrvdYC9sIvgDfN1dhhsqBQ7wZlNzIGbMoG4Kj2ovjPQwdDp6Vci6Osi2FFYs0mbjaJjanlJBBMWvKHBfq6mAAYG9/m/zcRsuOz6puiOlP222xbrjk9LJXsn7Oklu6BFx+LCHnGdhgkGnfZhFofulEo6Cjv3dbYjtw3QVljwAMBclABOCjvRgJhtk6Tocej0hNyhBVBXUdiBzZ1Nh2LNuAOgpRoEuLDLNebmxTqAFUFhJzrGG2ApVKPHAKReXFjPFvacca9mXe4R0OIo7AR/07U1MOiO1Crb0XxhXa6wf8N9nSJKYpAvkeAMu1/aRc05ct6ijv4SdpFiP14nBkvYUdnFqo4Hxu6tEvP9KxL2kJDXTyjs5ws7MiQwU6WT1CzoenOopggsc5gv1CfHNezphpd6H1daXNgHE0yAN+NM2EcLmNYhW0FhV10CnSuqbiXQV8c17OMOjtqxoELf5BZgVKNSosGEHXsxcGnDJnJcw77GXibdN5FHhX2YkJoms462tl8l5tnCzlz83dsf79JMwlkxDDYxaa7S7g8yVs4wYf/w848foszqsddfw/4b75Xvfnz7LljYgbBTV9YrqredBJ52G9wEF/Z2lUqtDfMJHaIPpBmTlC0XdnVq4Ky0imD1AoTd7OX6YNaieczPJ6crlZloCRYrFHYspV7r4E4CV4mZpaCSljg1A69V5IYLXcYbIz6bPKmGfbWA7dU+4e62JHVtgTMSH5DhNR2jm5H8zBo86mrGZ8WAxQRVnMn9mmhleQlaPtqje2dqaE3ZsUzBXqK3Q+oaZVvLe8IOJEXHyRWqkg8qjsRNoy/vhB2II4IzBgwSqOIo0q1mhs3kdQra3eMa9qQBDRbc5Mn5iQPtApvc0ejxGvZJCvQMixnNWFNpVlWedterj64SE6FRXRazmgmTvIG6IiH+VWImGugjelA1MIpsORkgjTQ9jdPCznPx0RHd2VVzjGbugjnmwo6/1DQwia4mANpxKVr1hF3RwJrhSWNynpCUugIyUCeg0RNJu6Ct2ZElMtJzwAtXFO+nJRsAtJ7EhJ006D6gripAerSvCGSMN+niFbtAYf+WP+hU1MTshP34Sadeih3V+UDWeXZd/DgPL7V+XBKzr4nxlbD7SmKYsb/wZR1DQkJCYf/Ewp7UYag8SdirNhRxGJfA6ljYpyZ2CxYArOp4UqIijsLe1wz6M4/C3tWZhFHmBiRP3nQqL2BADSqr85sZ+xpK4GFv4ljYRe8QGqvHhJ1ttiGAnC/sPLV+i1lzgXrHamCExwvk90zuUdN/enck7On3Xuybn398c0LYi9f+8+1DvcuFfRqlV2YOqREVxwYvYOnZKOyrhafJHQ2mAcJOR2gy358SJ7lXnDJzUhT2PB1Z2cAg+ZiwJ1wodVGuNcirWASzEQL+D4U9suHSmKby2xTCTk8mmIzOcumCyRzaeKGqJtyoVNj1njQGu0bfsfVsuiZs6cGNBjCM4F8K6FQJ8eO56gl7I3lClF0+KaP2gbCXCvtFbuieKEkTXFUSUCm1pkfCrlTYEVFmFgxp8KoNjvLUm06v69BQAup1wCw/KuyT+k7PHxX2q7y3fkzLgpIqxbd8lEj9tLBbVf9RJcCocGHXZTYbWHmVvsEXKd5AYc81vUonxQJbpcJON1HAuKHvWHe8xBLtZxCr75dxlFMAeDM8F/YbKcZkXiakicvZGhFJcInCLmpihK/7S2I4vgQ7OrS/JOb8DLv49j86yV/CjmAN+1EJ+8t/cFJIyN/snctv6kYUxjet2qpddjeO8WKOFLOwQQYULIoRG4J4BIh4i7dEAIldu6sqVVWkVnfR9j/uzBmP7RhzDWkqFclfC7nDnHnAjdQfp9+cSZQA+38M7CRrGCaNB3Z0plgDLseA/v0JsK9tWNIgsJc4MCsDGHcQ2HctgG1HAPuiDNaIT2Vh0v4U2M3FKjsa6VAzcV08FvfclcBu9tzeXRSwz7C3BK2Je4ZtNuso0cCeNcnuWPoYYEf2xqy5AHbl09/M4/IjB3Z8Fdnb87P/pYhcOtJ9ENgR7n/l9hhumflLiwR2oxmEo+Z6OxqVwWogsGPCUBtCO4+OmCc+w26MjNvoctMKU9eGg3oK7LU8Ujt7YoOZUn0+syN4sYfERLQnxuJxwJ6vCZMS97asUmhht1cmfQ+wm2PX6F6wjaG0xAxJpBC+7c1E8/PtOm6jpsO4w4G9gNTOn6bc0A+jCTpiDjjUD952XEvMkbjKl3VPziN3xGwU9NwELDErGWwO/KlGczSj7Ovj0aiLHB0C9hkLrvHgtg7tOVrYjUFGiwb2SXAbjH47YxZcCQTnGnwhRqXD+Aw7G9vOaxcBuzoGu5blmyyBZXJHTPcBv0UhsHcCuyqvXGCvEV/K83AzGtXAPgoP+0ic/tSL6Ihx+FT3C0Ai34CBC41KUDY5sBf505Cotl1EC7vRfdbIe0VTAJZ/cUDL0vk5GgHsdXJvGAei4O+ZdgRwGnKhmwV26YgJZ9hdYvcz7EjrJ4dOpXX9XxVjx8HycT7DLon9Cymf2AMe9iTDnijRDSoB9o8C9oYDR/USYD/a4OkxfQLsY8PeEV9bt0LcALIC2MnWgKkigP2gg6ehegLsqbFcqmVyRzsg25ltAeypjdcbAeypqtc7iS3raBcUrEljfQSwC//K7z9ipl1jrhcU5tIlmftIju505PgQsOMMgUOokcBe8iFMrduAksBenmIMYvVLCYSXe4XA3iyDp415CuyjCrK6oHaSlqd7BfP1jHIfw6DbiAP2qb8QemEUPNBqjxr0amDPtKGqor2lBHUX2PVHEil5YtFoTzWEaAc8jZYM07t7wep7m2fAaYEDdPpRZNYrfrCbWG9wUHTVAF/GmmQcqApXuA/sdj1weYGnVoWQh34JUFHAvgsG53nmGd9C90WLAPZlcBsbzt8iuKeJ0Klc6AJg1yo41upp8cDe6YInp0FSFrTE+0Bgnwd3NXI97Ft/mnwZUB6wbwj/CfYQDe4WBu0R2NUWeCrteV79ibP6I3vi0XRm4BaK2nuvOwU2V0C0YYM9QWAv8qchB/YDJ3tcqDzEhW4S2DmvcyGxc14PVIl562H3b006vTcJuf1jJCwx+ByZYkfxPUXcdPrNV16C/bsE2BMlujElwP5RwE5GhjGLB3Z0wmzWrjLKCbBnQd9F1GH3gb1nMYQXwL6yYSynqihhYFfGBtjt1aHuIJKvXWBPjRDYlY3fOzkBdqXq9lrQjQd20A+mhlXoyh8A7K8SximhjNd/+uPvn39m2XJhWv8RgV0iOY+JBnZ88c+fXb1GZ9idvV+VzgC7VT3UawIBHw0nAOw9XQC7emTAjs322lXhLgbYtSd35vb1wM4AtSUX6qd55IsjaoZMrgX2fBeOOGuj7AF7uXfe8tAXCw0ywgljyW28qCfATvIOrLRlDbB4y3MguKcKYEe+Ru2qY0+rKamUBbDfBYC9VJTBmTI4cqqFilBoWJtDfQwsJgzsyzfBmI62BL0/nwL7PLCNap935jFYmONphi3kjNf1Dej1GGBHHu8a4ptePLCXoSQ3WUyRjgM1nL6BwK4Gd9Vzq8Ss/OuX+GlctqsV4Ispw64GgN1xgb0hgN0BWy40TJ0AO6Fmy0CYn5L36EEHPUeC0vZgZBHYH4PATuhcLGTzT/kmgd0l9kCKPXTRKQPjUJEYTHn7qI7yT4v++5tO+WxnPewS2SMT7PKm06+TDHuiRLenBNg/DNj7ZRimLwD2ug4Zev7ipI1hTD4L7CgB7EMd8vTsxUl7C7LcSKBtGbBjcMUtzFHtoK8jO+O941Ngx96ByXs3lwA7l7Oq3JPc5oMsMZhhR9MLWmHoH6EMuywZ85cWaYnxc/Qoeq6sY8NjwwHU8uiBiQJ2Rq8LipZrBPaCwx0yUjHAPskKZNQerwf2hgXh1CRN9RgBGUN6JbAvB+5xh6nuWWKQIs+Jqi9tfiqX4sW6R4VInQJ7as12sXdT45kuVP1gF9ifSLSWLJhiZRkf2H26n7RgHJgqdRSnWmkjCtjNFmyV0FtIF0YGwJZedHHS3XRguGVhDsIkTzNxwC6Vw7EjGgfsqTa0gu+oBS1xNer5so5Hb40h6EUE90hgb4NFRXUYtMSMwLknUiFgl/6arQHgaORa4bs3BmGGB7BOgR2j82MbQGcL3SKwf/u2Dvs34ZtOgxn2oItdSmbDvWrsH3FzEs57PsMeLOsYfXFS4mFPlOgGdQ2wzyuVirRXf3zzF81rdv67ZoY1lfc044GdtkGfXwDsvTL6zQNSa+im8Xh+r1wG7ByJe3chYEezszTLVyjHNrbvHa6Ld9kULAT2pxLksbftAzt2oJ7YfkUvAjtS5WBQNc8BO6qokqEdDey93G4AvhbYjAZ2zt5Y4uV3ie3yeKmXU/ePlf6GVPLXDz/6wJ4L4TwqDtgLFvQEkkcBe6MFx46o9DJY4o9j6lJg31vwiCVHVtcDe2YUeSltXzjahfm5nb8I2OdVd42+YRfjgF2qoeM50l0WtvPPADvdG/pqCK0GgvMWsrNLgd0cwMjEQVHAPh9jr9SuBmOK9RuDwD71g9tmhBu/hI529LnE3la6K0GN29/bMOAL5XoesDfA6UcDu9SsBN1ZrIe9ikVipNSxKBSVXl8A7OrARfJ+FLCnq1DOsNbdCoE9d4Ty8iywS6XLUDLJ9bpvg70PvZaOAnYppQz27jaBXWTYpYkdoTdU1tGvEyMlM+wBaEdQ/5fILrP0ESl2/OctsYd4nSkM7N8mZR0TJbopXQvsv1CC+sDmfw/syn8O7LK+yyIXD+xmFxwXfzQqUH8EA7+eoiP/w5/T4oB9VgNn93YqrAgjY8Q3g7WNwF5pCfw5GowCEeexeuTBlsBOA8jz5PbWbQT2mCoxrjazs8A+VLUVhJvRwI6+dIqFXxDQNWFvcQuvyxKNlPrVYR4Q58VwzMijFOy9MMPed6CuYt2XCGDH+o0FNs2TKKySOuJlNWIbccA+tcT/PmmWrgd2tQ6l3ulCz11ZSIi+gFWIA3aJ9mhZ7xwRHi8D9kwLgT1d5GNRVDsFdsyqlyxMrIsajEUZHAPssmAjfbajgP1ugcAspkJgH83R/CKBneZlvRika/vgB0vN2gjsfs2X80JSr829H8R05Pp0Ipc8C+ydUSywY5bf3vibzC3cepWlS4B9BI7JfzpRwK5MwRjzlo7ArjXAyMqFzgJ7LvsuYKcqQFn++Y6K91jH9c8Au7a9ZWD/zqvrKD3sYU+M4PVwWUcp/6aj9yN7yE0TOnPKHr4Erp/cnPSVrMOeHDpNlOhG9X8Edtp527wVYFdqUJrHAzs5cAjWiDKtWTOCGoDxmKKeJ4YRNCWpcXsWA+yYju9W2FT7trXz6sEPO5q8MdXZKxoLRWAnVYNBKV2UsQ479k7vRS9OigHDuRi7F72M6i8B9mN/xQKthqZUz1hitiaZrJyyHWpGAvtPP1PKK6wrmCX/9XdKGbdzJMfEOyN2SrS//3h1beqvnMwR60WunSXdqfTEYCx9/e3PT3HAXmlDuZejbMtRwI4c/2Lyz2rglnd0mgrRMhunHwfsmQGUntK0YMH1wE72DtvWPdEmVafHm621SWlnDTCkBNU0YLtU4oEdvetWn6q8lqUaC+zPtdWO0tQQYE1FlcfS4wPRzKNTjAJ2lQV6mJ5hwUUevHaGccBOKiUoD82mAxHAjtUe9eEDofODc8CvTfZRpcsWePRcMaCWV9w3y4LrORZcd9aYjx9nKE0/oSUGtTSg+3xPomTWthXKj75ial09MqxWqVkDCexkZ4CFYyPKOtaybGyuZ0A7zhKDJhi7ekdoquiM+Vibl21MZeECYL+rMwZP0VQbooCdqGU2s5m33Drs6RoD6DSh6mN5EAZ23ttuUKIUDChTcq3wWgK5LWVgVyt31BwD2I1TYFfarT3FA8A2vVlgZ7wuPewhS0z0vUki3R10xODDJ+9/I5mvl7Oj0DcfWYhd4Hq4DHsC7IkS3aL+j8B+qxl2UtShfx8P7GnudzXYA8ozzyXD9ZQmBNPmorsVD+x3W28qt6PpeOVnlLHoNAwB7PmWiBXArm383olMM0tnS6D3EmCvp1h/mrIZLGCqLUkAhFFGU0GXji6b96IZAexMvDIMZscZuGPrp58EsHM4x5YswC6CZVodCV9UhfEG41y/xwG7VpTvNxLY1bU4OWcLYL8X0exJb5LYQ6dy5khgn2RBqtw8AXZl4S3Uc6vG8Aa6T6RphmtsxgJ7ughisNMkscDekAsJx4nStOU2IoGdtcD7zqH0ZbAdD+x3/A2ycDsS2LWpN9WB5+G9T7JU9Hww3i+c1mDBgMEc2CeOaID3LjsbDG4tI4CdBQMG99C7LhYCwwP2lBhrZQha3KU4Ts/l2NIi4tBpug5CArO1pdwk5sNzj2JsPLDLyi78A4kCdoRiJkNk2Ak1vYWigN1y12WN65Ur+eY/ZQCujCqJAHa+EO6kTshtAjs6YsKHTv0MezDFHrawS/npdXy8P70unqSJPXTmNJRil8QeLusogf275KbTRIluTP9HDzvtfLb5f/WwM/pogdU5eyLVL9WsDQW3loppgqL9ruEBO8mJwo829m6Nlg/sVaO08/zpyB08B45TDVV3qkLLkPUi5xznwZ5moWUi3eFXgWILVh2EHdGLR1JRdFozXGAnHdFb8I+kblnzDLAP9jmEk54g/jaOkNUEhez6REFg95r3Z4D9zz9+FFUcuZS/BHD/IV+gP/+ISC8KsGvYHbxM6fWPnySwE/pJ4PuPf93HATtJHWy+racDvhgGdnLHPmfDeVzBeCc+KQu49OouCtgzAth7Bh+sDnHm4tBwgd3xgR3xHOUz2yQA7IQ2uthnb5Z4NFZAWc3f92Rsfx7YvalyCx7J308MsONAsVBrKq8QqoltbCsEr0sKAfuyDbDS5J4zbnA27wI7+laipUzLYJSOC2g9nwI7oZO2mGrAe3NNHcswFvyYzkqXwE7ozg0ePSOe24Kxm4FTq3oI2MNFTB3xiTwUcKFsw9CHHoTrhgT29RsGV+XYXrCsY5qggnSPfE07gnCN2lT8peDXogWUmnHATpRGCf9OMuLFlP0G2Ik2sQyws3vQ+8K3khULdQsI7Av25AH7wxr3jE6nq0UnAF2/CHsJUHqPvAV2nQO7dsCFxBZvGdi/Rnke9i/DddiFgin2oCEGH+7zu+s7Bqu5n8in9TeWGL5HrqCF/RvhiGH/Jhn2RIluSqfAzmTRpErMiXjKOQbYyUEcGI0X7RRenlV6tnvWb06US+8wmbKptOjOzrTfCXbN+/mHN73z8MDY3mgPu93NZls6XK0oYH+lr58U6mEKNoJSPn3KeRujuU+vn9ml9vrpFYfHS230dxo5rweFzDawTkkf7/PLfq5cOvNEIe9VOv8ynSlyE7t+r9Gh5F1SzP4+deHY+12htw/+7txVXgrmpe8id02wluOemtHszMeeeSns7mWj0syLP58N7nvBymzam860CzfBggt+8H2m+fxALpQ2Z2PN2IWo3Nek2Z94kyuZ5uzihZbNxud2RdNEeYHyRIbvms3lmXja2S/w9/1fi+Yq/cU+dbY7tV80J7jQLQL79y6xI64zyTOn0Ql2iesRd53+64tOpaQjPihxzDV86FTo7U2nXyUe9kSJblaRwO4kwH4qzDjXPg/s6j/s3VFP2lAUB/CBcdmWfoNrLn3oTYSHdkYwQBgYX1giILAwdEYyJVG3xA/itx495dhyuQVj6WLT/w8l5cEmakz+Hs49Z6T6Q5E3Z4rtKLCL9+qko77jL2HneIAjJEbzHOsiF2TKuIddG8POid2wOCmS2fWwTk9J0zrfo7CxJ4bz+l5kSsw+t8Qs+C0xmMMOkEHCAHPY3+zx/OuhyJscBPbh3VXtwKkNVOdawA5VLi6v644395vjIYmDk+Nx1an89Te35oNMmb44iQL7Z9NYR9MU9qJhTswCP71BIRLaF7S5joaWGN++PiXG74ihvG59QUsMQLYgsAMC+1belSJuIyfVy/9FTpWPJppAEgcPy3Okx1Lkg0wbtcTwWEf90OlHiuv7QV5frjrd0+awc1aPHDxNpMA9MRs7YoqGlhhCHTF+Yrew6RQgixDYAYF9K0nHhN1OD30bu1XttYIz0/hHKCG71lYLzauqyAmZOqqwr2465bxOtE2npkWnnNqTN7EX+Dm4m15iZ5EaO6V1rSUGc9gBsguBHd5VYH+3DmdDpPU02KUZ0vpOONLL0/sUMnXRTadWeOiUrO9NCjcn0Ucg7Dfn/vOEFfbgPvSIPXPKgV0vsPNYR0rsCOwAWYPADgjsAJA1MnXRTafLxUlEnxJDinFz2LUR7HSRcLAj0SrsBX0MOx865ciOTacAGYfADgjsAJA1MnVcYY8Edv3MKTG0sIebTlm4/yjh6qRgTIzhzKlxrON+YLXEblmosANkDwI7ILADQNbI1IUV9k/EMNaRD52SYoBbYhjn6w/JcWBfnRNT1BYnhSV2rYWdp8RQXsfiJICMQWAHBHYAyBqZtujiJMvfELrsYaeWmIDeE7P3sjiJcbSOhO1kNXa+ZGFHDNMr7NHFST60xABkk2Fx0mRyisC+7tfJpBO36XTe2rov6U9HLYxmwsCZeRVHmN2r0Y1gjeP2yKO99qN259G8wJBvFatypM6GMV8rnV0F9uYP0aNvmRfH17pKe5lGYLfrtiOypt5Qg1PxwpurhXZPvELFK9ki3g39blrj3YwN7J+LFFS92NO8NXfLePbKuD264OuHvquU227E3a06GbV//jb/nAblQP9amFWmaqF5F7NCNnbn7Y3bfBLb2Keq9SDWDN3m2Su2n6ryWOSRTBlPiaEKu7WhJWatwL666JQXHfGYl4QK4YMV6TOssHOJnfK6ntiXZ04tVNgBsmY9sLsOKuwxunGBfVpWk8PNcWegVLl7OZXCoNRVd/I1gX3uKjWpC+HcK6WM0UNeqqfSGwO7PFK3wxQCe/no9varzYGdX6YS2O3nb8/ZGznyj71z6U3diAKw+lKfy+7sGC98JMxiABlQsFyM2AACzCPiLSBgiQASu3ZXVaqurtSoi97+486c8WDHmJCnmrT+2pA7HGZsQ9p+OT1zfFfY1QUB0xgtMw+RXZx5EvWGL1V+w8KebEK38WBhV9OL8aie17xzmhIAuykxUjXwGCROuD2NGVMpio0FnNIJ99UyBIg9GheignIDSv1Y2B/E+xN2VHbu68E+7AzRhx1BWQ5VxAhET8ZntXUU00WNzamujn4Nu7/rFHU9IOxxDXtMzDskFvaXEPZUC4z7VffaABfnPlvYB3NJKnffvLCTSnus+8MbmRu6GCZjYfdRC9mi/8Yn9sKMny3siR10ty91klfZ+kxC/jVh1zIGMIibwGFeB0qr7Am7Pig29yaQiiYdke4C3CvspTFjNznxRvc8l4+F/c2gvDrhTaf8RqfBvo6RKfbP8CtUxI4PyAtZOy6L8IMJX/eUHU+LEqxhR19HZf+P17B3CCnKMTH/OWJhf66wIzsTtrJ0DwUb+skXEXaTKkVdf/PCjsTC/gQ2a1gmXkbY02Ogavu2eYSwJwsmEMNddoG4Gh1PDDrMAow67K2YDhUm8WUTnLR0xMQCy62cFnbi3i+HO2jNYmF/UyivDtaw442TKFjDzjedhto63tX1I1sX35HnVbGHtp1G94n5gnMnwR7sEvM/yLCnAVano7ZekWNi3iOxsL+IsCe6cE8Ve39YH5mw3tXr/QvuWc2xUd2n8U0tF+sVC4xlvV6fqKIa1+0a2emlJ+ybrWuM+jkUdt2E5qWWBdv0hD3Xd7vV/QZnZor1ZYkvlcFPdl7LGsa6ltAkztWyO2qnhbDP24HodY3NtSt0bhnndlg0W+uIuXKzXq91Tgm7Veltp71KCZBStkJpmU8Q9o+//pn888Ptp4+i6uGPT3/99eEP2ReUP/++pU+oIvzhr9tfeTT5x69///7T759+/fVXb7b28e/b279xEEF+2OsozYGxvmLzEzfjrjEYpvmLM8PeLLNqVdsJIXy7qjNM54vbFD/u1b7VdRuydMz1sLkYjfqdG8fpY1xpjlvGaDjReLi4SF/vWlXxXirTImWa8g5TrI9L0N3X64s0P1B+X+2606TESdHzNZw6rtXp1fctsNb0IytcREhose6WwKBLtflSSn/cra7KmogPF+nUdGwM+vKR6Bd7zYGz6BRG1R4GU9sipa/4jlpeOYZTnHtWOmxvLrZ0qWYSXz1lP5NXeKB5cdHPVtud6ajVxuDFttIynF0eo8pNfeWAnqWXcJPyVr7eOUZ1OPOEfTgvOt1dmifUTahm2BI9rIOZZYGML2YD+ngpHZiPwShIR6QHxZxSf5qwK7X60gBrWa8XyxJDnQ1HRnZxgdfTr6+yYI7oJbQVUbdTHxmt1cYT9qVSc4zl5LBhhc4dtFPe8GIxMCpbFHax9MBo7TdC2JX2yKhci7kdNrcm5l7Sue40FvZX4v62jqjswtcFgYKYzwO+zjUdRfv5G069hH2Q8I5T5LirI8Pz9fe56TSZn06nmaR8hnPCTsCQY2LeI7GwP1vYkYoJ+ZPv0Qg4YtNpposD0mMSvjdB4P1XfGoAMpijsBs2AcpOQWF3dGd+ZZgjiwv7dZUvhVPrOgiKbDz0xjrP/qs83rK4sBdFdCrz1wowU1mz/KjIvwO5OiHs67SENFrA4MOm/QRh//DTzz//RPnlb3w7/6ADxs9/aJ7Q/8Wf+Osjjn4XUf5awQcZDf4WB798wtERRWK4+ElYBXqyJUD0BcpfjZQMEyhjVCeNhw0D+K7FeYUAhUT9H4kFhkydAOjMwqY2IGYtx8I9urIOlCzXMHwjME/Oo4CITaedPT+Qy9W47ABi9w/7mMUbfkQfZ/qbTq8H/DTqFyJeGuNyek0KMeUHZZdgYop7MgKKX6kzrwBD1I9v6VIjXGrI3HjND7RP0UEjsFSdnUUXeHTJohkDBM61xC9YFJNzYe9aQOk2+EEH/P2eZc2VRPWbZBV6uCo9lOYLu4tWHsVThX1DwMNcccnmT3Qz7HgGCIy8xEjVeVgfcmFvWXhBBS7ZPR40Mtzeu7isI4T9YhiY26FzS0Cx+hhM3vCgXca5iRafGwv7ayGEPbqGPTrFHl3DzqX9ufc59ZuxH/F5qLEj6zXJ8fecMg5NYt5hScy1DQxjJt9PLOwx/1ViYX8ZYU8bMMJYFLXswCDQHQ0GRcWzFMMdmQANVZIK7sAxwXIGg8GVLDzXXq9t0pqhsANYg64J5BqFvdcik5WZdbmwX7cAjPFIB2BevaVL6XypRpIJvEmMsduic8sSd3DiDHQALux1nRhrjOaZWFUOczG1PzxEr84KOzOIy3yNZmA9YTeGN/3EE4Wd+fftLXXvXzU6/PXnX37/8On2l59++UMShv7zh09//fL7R8/ef//wlxf9+PeH25/p5A8fMAGPvv77pw90qb/VaGE3CZi2YTJhv7GInXUdHcgNF3YAvVqlw57Gf4ci3awNwIQdpRBK2XUJYJiLEnarxKbTh+ElFeMSsQfuiC7V1jwlN6uOGEqzerVlHYT9ajxo6VCiH8M+4+mrlV3bADvmt4kVHQ7oWaKwb3aDkQ1ml35kmNsNUcalLLZU2es9UxpUTVRwLuzEBGIbeqSw6zZeggmVHDuPYrVV8oU9PaYxZ1w1rTYXdlyqZOjmkMu8xX6myQ6FnS9l0qXGF/SsbGKN3KwFZKnRdeuDkQGmQS9hmOC6zVfWsRYmzyZ2RyUsS9euiN2jr1i1nGKRuLkeeP6+McASl4CjUeLxwg7EMo1KOTLacQeOBSZ9J90p+jrQgdsFqCp00SK7BMIuYd/Bo+zZB+w6Otr9jAALlgAcDX1dzO0q7AMdAVjrKoAn7KkVAGm5I91csuPiXPZj19LQ1+nQcVsARoIdZwCgs7mxsL8WQtj9to4ovaEMO9Pj0K1OsaT8bk3MszedIjjbz9h7eMcLdYm504edgb7up9i/e2/CPgbktIsnxaGCwp7y4ziMhT3m/RIL+/OFHRkTuNZOBTGBe6VKiJYlcENFbtIFY35cw55zvNT7tN7hwj6aYwK8nWLCPlnDogWFOgq75hLoUQvaVMHYHNewT3u4aq8EdYW6whrMhiqlHSbsGMUX3tiwSxzXsG8xyqR7lTgr7OO01LaYdXR1v0vMk4Wdufifv/90m2MSzophcIhJc42GP8lYOcOE/dMvP31SmdVjNFzD/jePyrc//f5ntLADYZeubDdUJHtpvOwuuGkUdszq9m1YzukSQyDtJFMxFHZtYeK70qlE1S4viNW/HILVVIuYn88sNhpT8SqsNyjsaI1bA9x5ZJeY6yzUcxKnaeJnlVhxoct7a6Su5w+qYd+sYX/hJ9zdjqRtSzCYiCfIeEbXuMofC7teS/ZAL6pNcDJHXWLkppfTnxcLnrADYU/k8ldU0U1YzyUtb+PUBtGL9PXmUC1AtUynLMoaVqhANX9cw65OAQZs5U6tyYW9tKCX0QLnmr0J46R6pQMAITBODLO7NE7S0m62GNgdSlzpCcKOmHv5xNQ92jmSNqG7oUe6AXN5XMOuZgh0r9mH1G6jsGO2POHwvPhcB2NCP/EmsPJ0bQLEyUlyH4WdjQkYbO5Fu8aF3azTYztQYu9VQgebBumryZhdNUCLzp3Gwv5aiC4x6Os/PKAPOxp7RB92z6+fT7CX+4k+7HgeKOwekSUx37zdGvb6SR8nwNELHndWvnZYnIw6si/sl8sSgD5oyJSdVZULVWJa+F8qayrHxLw7YmF/IWHPGDBWHiTsDRsquIxLYHMs7AsLw4I1ADOceZWKOAr7UDfpYxGF/cpgEkZZmpA5uelUXsOIilnB4JsZhzpKYDCaDgu7Hx2Dszkn7GzajgDyfGHnqfUPmDUXaLesBkZ4vED+i8k9avrPfx4Je+4v77W//vLTryeEvTILX+8QWldc2Bcq/WSWkJ1QcXR4AUvfRmHfrD1N7umwiBB2ukKbWeiCDDKSQK1Bd8uFvajiLsZR5pywp12oXqFc61DUsAhmJwT8kcKe2EHphs2ogd4Wwk4vJpIpMfpSAewm/VP16kjYJ6NQ85ktQTlHlCGVbMwlo6k2CF2FCm2P/ikwSZ3Sp46FPT3wC9C5sLsqSjgV7XSWrrepguXubYCxFIHYc/oEYTer65GFpSjnhD019E59VoKRdiTsiTG+0QgX9qrMGlBijdNFEawFJu1LUNWk1B6flRItLuzK2O+Zz4W9y+ZuMXopPrlECQxNuliBxeYqrVjYXwfRhz3YJeZuhl04sV/CHrXvVLh66PGJro6P4XqYUEWM3ySGnmNkH/Y3XBJDYHAiAmHMhR+cHp5MHIQ9bQGnTwcOmEUWBk5bjol5d8TC/lxhF2QJSWsPEfaaBcaAYRPoJ4+EfWXeSdWvwWLCLA9g3EFh37QA1h0u7IsSGKMBxcCk/bGwpxfL7GikQzWNx22wU7jqCmFP97zoJkrYZxi1oDXhKpSYzTpytLBn09Jmb72MsKN7Y9acC7v859+0xuVnJuz4LHdvUc/+Sea5dLT7oLCj3P9++4HyF2bao4SdNAPDTnO1Ho1KYDRQ2PU+W28ITh4rYtpshc0YHbfRZUUrlK4JO+VY2Kt5tHb6QCdTEn22ss1tsUfQr9Q2dfFzwp6v8iIlVtuyTGAJu7lMa08R9vTYK3QvmGToCTv+IVrYu1Nm7QX805Gw523Ya3eFnawC5e2jDVb3mGTHhN3oe9bO1sMtqbvxaGRAqR0Wdt79VAsKO5aVaA2g8yfdUk9F9Zeu7VPCvunirwuPFfbLtOq1cm+lzwl7Yg1mNTsYsDKZ7uxI2OcGOFpQ2MmaXcIGrDYzcn+ukWYVMd1L/C2KC3uiC10tKOxkwObOcJtBagwE544ssNOsIsZgcy/bsbC/DkLYw3c6FQl239hDJTFo6yFEKcszbB3hun6s7Z8f3zgJCd836e33YSdwytjhCDMlYjkCYKz6dQJQE8Ke1AHs4mIEAA0m7DhjtF7Tx/W6LMfEvDtiYX8pYW9Qi1EeIux7Ew7UUkfCPibmRgoKu4EKMYAsF3ZpTWAqc2Hf6XBgqBwJe2JsAoIaUjehjOrmcGFPuIdohLAnKofo5GxbR7MgY08a4yWEndev/PEzZtpVWvWCYC5dmLmv5Fidjh4fEnZcIbAJNVLYrUJA5kxAhLCXpvga1OobC9CJEksU9mYJDrjpY2EfldHVubVLqaIOHLuAws7lbkE99ZywT/0DYS2MjLsdzVFDe7SwZxyoKCjXFtQ9YddrJ4W91fCs3TQKR8LeQBW/I+yseP2Qfh8raNsWLFHYp9zVr0y7yRok6cCxIoQ9r5Pl3baOQ/zOND1jGdNUG+vWE/sTwj4bgbnTHi3sgg5mx08LuzDyA8bVkbDPdDK629Zxid+BVeV3unDAbkgJA1q4QJ8Le0cH525bRxe/Y+JfCcwtNSTFAAPnTmNhfyVEDTv6OkWUxCBfIdEZ9rC0i5pz5JlNHcMl7Ai7s6ogeKdTdn5+V8eAsXtdYn58m8J+wtjhmIaITQEqMuUaYCSEvQ7gypQCgMGF3Z7LclzDHvN+iYX92cIuGBEye4iwuwTclUdGPhL2LOjcn8WwO7sr7D2DKjwX9qUJY7FUWQ4LuzwmYDrLXd1GJV95wp4YobDLrh+dHAm7XPGiBnTPCzvoO56iLJZeQNg/ChnXJI36+i+3f//6K82W86L1n1HYhZKz10QLOz75168eH6Mz7PZW8lCLBMxWZVevgrFFYbcDwt7Toedp2+Aah87Ko3BxRtjVtrey83hh71vQWnn0U+yVNzZQyHryWGHPd2GPqzZKB2Ev9Z4m7FtC6iFh9+yb74N28Zhlmwt7Nyjs6hZbqe/q60hhvyJkH+7DLoS9bLbKiR24KLjRwj4fA6mo0pOFPdkHvX5O2NMlsFYetcSRsKcJyYb7sPvCHphbTEgdG6p8AS7sc0JGoT7svrAnbNADcxWbC7t6FQv7K4HC/j2/0amoifGF/ehOp16KHdU5IOs8uy4enoeXWj8uifFrYkIl7KIkJmDsb7ytI4FoY79f2JuWtZEpHYCqEHYTzEsMOgAd9mCyQSzsMe+XWNhfTNj7JRimHiDsdR0y2ukbJ7mETO4VdoQL+1CHvHbyxklbA7Jz+l1do7APdS7skyoKe6ML2RmLjo+FHaODNIu6DxF2hr0sJ6Wc+0IlMZhhx6IXLIXRbkMZdtEy5pMaWRLj5+gR7VRbx4MpZrxNkOowStj7Niw07GGCwl6wWYWM4IywT7K8Kl6tPV7YGwYMQwfSEr0WATLUHins1wNvu8NUJ0Mh7DdPzLDrZBUSdr8OJZ2F7BzlWyf7I2GfL3krSG0aKexli1QihV1k2Be4BbuzjBT2xBKIm/THmqpqWljYT0a5/Jr7sxn2Kjjy6RsnzUswOinsCQdagbmJFs+wX96gsGNl+0lhVxwwAnOVqpdhb8bC/lqIDDsqu/D1cEkMEkqwo0OHS2KenWEXX2Lj6cmmjgjWsB+VsL/9GycRYGSPA6eFXaBsd6Yv7JcAehsZAbSZsNdkSizsMe+Xxwj7vFwui/Lqlx/+5ptJ5/WGGTqUnzI8L+yaA/r8AcLeK2G9eQClyqtphM9v5YcJO1PiXi4k7FjsLIrlsSPHpkqFHY/bZMctGCjsbQvyGHV8YccA0qbny6Mo7GiVg0ElfUrYkaIiDc1oYe/lNgPwWeAwWtiZe2OLlz+EtovtpYGcuthW+gH97NNPP/vCngvpPHJO2AsG9LiSRwl7owX7Du/0MrjGb/vEQ4V9a0BNk1AyHy3smVHkTWn7vKKdFz87+QcJ+7ziHaNPzOIzhb3cBVc5JeydvVec3yBmPSzs+NuiRoNKMSjsWzF50oW1ckLYJ61SW2tgifp1KUrYlR27kdKdenYg7ilhT7NoaJVUG6za2Rr2CjaJCcAq65uH68d/S5wQdqUCxiSw6pg3ikphFyD0eSNxSthTS2wSI0i5YLO5uV0s7K+EL+yiIiacYfeM3c+wo60fbToVpevPasaOk8XX6Qy7MPYvBb6xB2rY33qGHSAnhzgj7Mm2gTN9Yc9AgD0T9olMiYU95v3yWGH/TejSyw1fX9jlVxd2ZGFRET0n7GgKtif2qsZVfwQDv5+ijYpOyannhH1WBXtzdynsCCNew38zWJko7OUWbwezJ2iBNYvL/s4Uwq6N/QYbbS9aN1HYz3SJ8XBnJ4V9qKhLCA+jhR3r0jVs/IKCrvLyFq/xumjRqGl+d5hL1Hk+HTPyiIzRB2bY+zbUFez7EiHs2L+xQJdpExT2xB6svreydk7Ypwb/3ydN67HCjoZp9cIH4tuGE/zZGzAK54Xd6w5T4z5dunmmsM8rwrblyyNhv+wBFrQn6viikLBftyDbYc5fEkswB+/5to9eS1FzYWGfj80624ChZ90SRAi7UgQibN8X9vFDhF1TD90dje05Yb/sg7m8M0/b4FlzUkORpVcvjoRdLoDp+nNzC+8OSRYX9gs6t8KjqSNhl7fB88X3uc7OzIqF/ZVAYUdfZ6CxM18XXWKCwo74d006vm8SevvLwEti8DEyxY6wc4q40+m3Xx8S7D+8aWHfy2HuF/aUDhTTqPjCnocArux4vwTEwh7zfnmLwq517g7fi7DLVbDm54Vd2jEJViV5WjU8tx4AqSW0Q00MNWhNSoyd2Rlhx3R8t0yX2jrG5tAPftjRxB1T7a2sFi1vW2mFUCnVFiXsw47RaZJHcVF8wXCucgXjUWr1DxH2fX9pARgNVa5AtLCv09JkaZfM0DBS2H/5VdNYh3UZs+S//6Fp1NuZkmPinRq7Jql/3/KmMczP5Vsu+TzXTpPumqiJwddqHz/89ec5YS871AlzGj3lKGFHj79Js/dq4LV3tJuypGZcu39O2DMDqqYprWDA44Qd2dr0tJKSOqnYPTZsrdKa1lkBDL1rbBJYX8vnhR1r142+prBelsozhB1p6FCqyVKu2W2HhR17yNg3WqpNYKwcl8S4oK8ULdPCTafIFaFXLy6hrINVlKkUd4thYVeGkFXUfAkAiHks7Bc9ALvWZEw7EcKuFPqLEVj7fqF8JOzzrFFLy8pNCchaPduHfd6iSp6TtMTQroi6dTAaSZFTt2g4KclXxios7FgEY1Yu6NyiPWZLmWz/aCILKOxo7ubyUlLzxvJI2CWlCqZL5yq10potZYK1lZR13If9lQjdOIkS7hLjlbB/GW4SgylvX9URf7fo8+90ylY7WcMulD0ywS7udPrNG8+wLyMC9wr7CKC0TeJ0IewXdwtrHAD8Hgt7zPvlLQr7e82wS0Ud+snzwp4aEABCv6A0O1TJMNopNphVgYdb54X9Yn1Yygs07UP7GXnMg4RwYc+3cAhc2FXXj05EmllUtgSiDxH2eoLGUxpdwQBK9VoKiDBCqN9SaroYJvkwQtgprDMMZsepuOPol1+4sDM5x9GhATuGRVqdGb7oCiMm41p/nBN2tSiuN1LYlRUBimlyYU/yV9MHvSmd3XQqVo4U9kkWBKXmkbDLi8OBel7XGDbw1TkzAsY4fVbYU0Xgk6k2P1bYZy4IULNTNcLXsiKE/WIBGGSSfSTs2la8Gwdhn62B4Uz4ZG9l/UjYtbyJey+Lo2zzeteXQnQqIMBJYWHPgCAbIezgN0w6K+xq2fSu0HS9KD+2UWaDZIHwsBkh7Oq1mIvHztXYCEAIuzwVcyOEXdsc5maxnyPOje90+nrgptO7fdi/Dd/pNJhhD1axC0Q23O/G/gJ3TsJ1T2fYg20do2+c9MZr2KN8/X5hN4HgBlMlsOmUgMWDU8eZxMIe8x/gLdawa517h2+1hp3aRguMzskdqXlVDNShzuWnmPKuqd8lXNgZOd740cTomrR8Ya8Qa3OoT0crxhw4xRoq3lKFFhH9IudrwtaZZr3u0hn8VaDY4ntL52MeXR8sRZtWiSfsUodHC/6W1DUdnhD2wTaHTtizA+4luglyzPpE5sIuhskTwv7X7c+8iyND/sSF+1Y8of36Myo9b8CuYjh4M6WPt78IYZe0P7m+//wpeU7YpcTOZKfV3uGTYWGXLmoWELu2hPGGv1MGV8PKJkrYM1zYe4RNVoa4cnFIPGG3fWFHPRdY3J8nKOweWqOLMdO9xq2xBCik6p/3ZGzeL+yHpXIL9kq8njPCroWFPT0GAW8FKW95t5rsdUDYBZfYuREr01HYt76ws0Q4C5JK028sM6+Y/g+NemXgyqNyWNhZir1VlgT3CLsVEHb3IcKu1In3Liun5HAFTkoMtPkAGMTZivBOJyjsDHXSxSh+vjPTF3ac2/HmVqf8QyHM9BdgNfnSaZzLfwg7prkUwo7BRJbPbeHcZI/NtXug30j/R5RXx8+wiyJ2lN5QW0e/T4xAZNgD0o6i/kxlF1n6iBQ7/nXX2EO+TgkL+/dvta1jpK/fL+yiBUwWoCWEfQCwkCk5E0CJhT3mP8CxsFMMLe4Sc4RLAM4Iu7TjG0bPo3UKN1eKdjI86zep3z4ILTGlS6knLGba7wRD837+8k50Hp54Nhpdw252s9mWDo8mStg/ah//lDXJQ8ZBEPnPP3P+72+5Pz/iIBr1458fcfp5lEZ/c9/1Xsos07xKeMdVrm62c/mhK+On+TRS+ZvpTEy/3PR7jY4mPQk53d8mNOnZiOtvnNJbddafnjxQLt8sy/etnKIrJ6Ii1yUoLR55/g98ubyZ9pob+eFv5aTZn1yePGiu3Jt2HjZXzjRnd+Ze3jdX3TSb15eHUeZmJv1vUV4bIew/HPo6ihr2cE0M9/VwW0eBf6ej5yg7riEI7TmlXz5c14/unPS16MP+5jedLk9ELDgiI2I6QCWVwvSGlfKEPUEH47LSMwC6wZIYE0i7mZJjYt4dkcJux8J+DGacq/cLu9KFVkf6v1EBwQsJu/RWKdhQi/9J+NdQr2wgpXX7arKZxx/D/x7l1fFvnCRq2EMlMdH3TeLp7mBFDH755v0cRL5erI5g3XxkI3au6+E27G9Z2BftU5EhhDGSIrYChFcMorCzpcDDTASF3QBKW46JeXdIEcR92J/MppFJSv83/gfC3lmN87KWd8CeSjH/Gn7dSysvxfzPUV4bv0tMaNNpKMPup9gF4S4x4i+09eek1/FBFLGH9pyGUuzC2MNtHYWw//BG73R6GmVoQRDiTvygCwx7XvSEvS5TrkvAcOZyUNgnpVjYY94nsbDHxMJ+FlHETYqXUsy/h6bOFmNbN01nIsX8z1Fem6Cwf4Mcati/Cvdh5wRT7MGCGPzyHp/c3zHYzf0I39bvlMSwc2QES9i/5RUx9O83mWH/h72z+U3ciAK42qrq57E3E+DgJ8U5DCAHFCwvRlzA4tMgjAGFj1gCgsRt9xZVWkWVGvWw2f+4M288QIxpsoFIoZpfW3aHx4zBtOovb9+8eS20dLDI9p1edxOxDVfpefEsJpH8P5DCLpHC/ixx3CZMWC9HiUTyHoi/MSjsfwTGjrpOEXtOoxPsQtcjzjo9+KBTgaiI34Zvcw1vOuU8Pen0p3dfwy6RSKSwSza8Y2F/t5yPWtLWJZJ3Q/yNETXsoTbswtgjDk7acvawrOPDobYu1vjuP2tihK//sNUlRqTYf6Gwkph33IddIpFIYZdskMIukUhOm/gbEz44CYX9l6i2jlFd2L+P6BND4Q+v1PUnJTGhvo5RJTHM2MNdYlhFDPr677/+v0piJJL/P1LYJVLYJRLJqRF/a7AkRrR1DG86ZcZOfZj7Oio7NeVQH3bh6lsbTw9BTMfV9lfEfB9REoNgRQwz9t/f80mnEolECrtkjRR2iURy4sTfHMywPz3pVPh6+NwkJLJLTKiv40FbTvGRrxZOsVPCOXa09VBJzPvvwy6RSKSwS9ZIYZdIJCdO/M3ZPun0982mU2T33KTNyUn4N2dTby7qzw/MsPN18K+9e06FsIcT7KKtIxq7FHaJ5NSIODip2y1KYd9lkOtaz510qvZNb88r+Fnuzihy2ih1oSrRZMC5VgR5veCkFMrYKViLyKVaYqm9XGSg1NozN64eS9iNjlKzAClPFEq2DKHhWwh78iqpKqfGVR4axc0w5QOlUFNewEUqkVT2c43fjdlWjkysWjf40fwHct2HTEJ5I87mBb0iblStTgBIIX++rw+QRYjVw2gEVzmn4KX3fw09oBirPQfM7j0Rd0SMqSJ558K+VRLzExLuEiOEPTrDHmrBjr85sLEjEsqwfxduwy42nQplP5GTTiUSycuFnagyw76H8nPCniuAfREZiTUAtLLXi0cFE2W4ib9E2H0C0L2iaj0DgIkSQdyDVeKVwh7PwLT1BsKuZabTdFIIuxi+ibAnHz48nF6n9KfCnhwTMHRvmlae5xJn7iU550sVleNy0STAMOz3JeysS7u37Kh8FBsSAKvG33EFArzIyyVKGCSzq8jbPC/QoJVT9qBOCBDL6+eiz2eFQlcKu+AEhf23LWEP7zlFIkrYNyedCtYFLYcencTbxOzuOY1u6/gjZyvFjr4uM+wSyekhhf2Ywu4S4zo6MtHBx7kHC7s7UpSi8+6FnZSafQ3WzGPc0MXwXAr7hmQuk9/c+MQK6lUFOVTYE0twbpWjk6wBaG5zPtV770nY1YkODNJP4LCoAcUpBsJuuPnajQHEV5UQGAYrn7cg0p9HdYD/FPbLNphjhSKF/VlOUNhphv1nZE9bRyrHoRp26s87PWLYw+GIkhi+rvD1nYOTRIo9VMIuusSgr//PDk6SSP7/SGE/orB3LJjuEe+cBd3zowi7MVAUW3v3wo5IYX8FixlME8cR9lQff0w8NgMvSFyr6jsS9tjQAKL3V07g5AudDmcAXosOroZ2nL3htAHlVMSN0sFJ0w9GoBGPiJqg+dP/EPa4DU5KCvuLODFh/2PT1pG6Lq9hx5IYTrgm5of1wUkCodZbsn1Yjl38FglXxCC7GfZNDTtDlsRIJKeJFPYjCvuMkEWUwnR7tmfAbGnb3TPuWbW+Xl6l8KYW83bJBH1q2/YgGSj13Hf0zPAqEPbFra973UsUds2A2pWaAcuACV+q6zvl1QJnpvP2tMCXSsfQByoZXZ9VEuJNdaaO10wJYR81t6KTCptrlejcIs5tsWim0hJzYzXbrrT2CbtZat8O26UCIIVMiVI3XiHsf939c/7P/cPjX6Ku4e/HL1/u/45t/Oefrw/0iaQI3395uOPR87/vvn7+8Pnx7u4umK3+9fXh4SsOIsj22q14zdVnHTY/Me87uttL8Rene+3r9E293EwISV2WG71UNn97wa/bWdUdvxpTdpn0amPP67bmjUYX4/Fav657vYHKw/lxarKsl8W9jA/zlOFFcJm83S+As7LtcYpfKLsqO/7wfF2K7ep6w8a1Wm17VQdzZtt27ixC/PO2XwCdLtXkS8W7fad8U1RFvDdOXQz7uovvMkwsfdNw+qz+CjnLZXSrcZNmt10dEmIre0jZ7cTaxvOouMnBsqHPapfBSrelut5YZtUnwp4Y2+OWEqKVb3Yz9EZV3XoFb8DlbamsN246Kg/3KsVsyXHbFzyhbkA9zdPd1lxRRjMgs7NR5mmZS8sHq7vr1FkgPqv0ATCbyg7XXu8y3tsn7PGKPdVBm9p2PstXG/U8PTM+4/952ssMGJ5Nv4V4cLGU7en11SIQ9lK86emlgSJ5l8JOfR0z7L//R0nMToL96UGn4qAj0ebl8BT7zqZT/GeTYRcpdvT1sLEHe05/lxl2ieTUkMJ+PGGf6NCPRwU8EDgjtEEHB6TNHGZlgKDJrW2oA+KO8AvRLQKUZRyFvaE1Rh3d8Ewu7JMyXwqn2hoI8mzcC8babQxNgcfrJhf2vIgOY/y1Aiy0r5ibqMi/A+nsEfZZSkGqdWDwYc16hbDff/j48QPl09ckG/5NB4yPf6uB0H/hT3z5C0efRZS/VnAfQ4N/wMGnRxztkCe67wDFpCZWKwCijVHvKqSgG0Dpo1ipPKzr4E5QtEoEKCTqTyTGGDI0AqDN2ddpAWJUUFnbdGW81xlcie++xTw5jwIiNp22VvxC/gjDxQYgVne9j1nc8B26OHOz6XTiBnXnZyJe6ONyWkXZIWHz6+LCmFNHCm3cn/kfNTu3mHxHkjmY4sv5Uu4C34UDiDG92BL2FJXa1c63lOUTNQPAuGHvIphL/AsMg2HhK7wUu1Mlnktnqm6sWNKbZOJ05TK9lLol7FHefZGHwlhRJwaguEexX9hTBBCx6fRyzJ9w0ux6DgisbLA/lYe1Hhf2egFvbE6RvE9hR2Xnvr7dh50h+rAjKMuhihiB6Ml4UFtHMV3U2Ozr6iiEHRFHnaKub4Rd1rBLJCeIFPbjCbtPYKJGBSoZVyfgeK6bjzNf1wF03zMAqvS25ny3YYDZcF23ExOea81mFqlf87Y9YLqOAWSCwt6uk8GNkfG5sE/qAHrf0wCYV9/SpTS+VPWcCbxB9L5fp3OLCndw0nA1AC7stkb0GUazTLVL67mY2u+to53nhd0qKlfZSr4bD4Rd7827iVcKO/Pvhwfq3nfsXt59/PT5/vHh04dPfyvC0D/eP3759PmvwN4/33/BKB19vX/4SCff32MCHn398+M9XeprMlrYDQKGpRtM2OcmsTJ+QwMy58IOoJXLdNhW+c9QxMlYAFzYRz5AITMrAPQuo4TdLLDp9KF3RcW4QCzX9+hSTTVQcqPcEEPl2i7XzbWwd/puXYMC/RpWafR1ADMzswCWzFETN3To0neJwr5Yup4FhuO6LmZvQxRxKZMtVQx6zxTcsgFGXgg7MYBYuqZVInydXahvAZQuuK2C5pUaGgr7qAR+0dY1p5dQdqgaRm+zyDSY6/Z1gD5bqmgR0/MzJpCpuhb2hUeNPKlECDsquVEwYEYnT9ZzfRWFnYYcdnNmMUXNEvbmWstyI18h/cs5BP6+0MHknzgYNRK7H3cKekdpZYAQ0v9WYU/4bsMEg97nfg59HejAdwDqcfajgOs5QHTXdactXGfFvn7f09DuRwRoMGMBlE+vudFrOEVh3+7DLoRdFLFHpti/w39CRez4gBzJ2nFZhF9M+Hqg7Pi2KNs17OjrqOyyhl0iOUGksB9N2Ec6eHvDtQJ0gnuoZgjMrzBfqI92a9gvG0HqfWi3uLB7I0yANy+YsA9mMK5DzkZhV30C7TOqIWXQF7s17MM2rtouACvgvZqBUU0qqQYTdoziC+cWLBO7Ney3GGXSfZN4Vtj7KaVpAoDpaJsuMa8Wdubi/3z+8HDJJJwVw+AQk+YqDT/GsHKGCfvjpw+PSWb1GA3XsH/l0djDh8//RAs7EPbR47cLKpLtFH5sB/wUF3anSqXWgumILtED0jxnsoXCro4NvCutUlR18piY3asemLVkHvPz6THWSXXKMFtwYdeH9EI6+KPILjGTDNiXCqdmQKmFom7OmaIGa1xMRi+qYV/MYHW2Sbj7LUW9LYA7EE+Q/jVdo5NVwgypIY/QUrUme0sN8CasnGXC7s3ABQu/vahEe7oOK3F1D6bM4MG9pkvlQWPePBpjTU7KhXJWCPugDIadVCKEXbNjOTCWyVuoZ1mVVhYlPwNOB4UdlxzNWFI/sYTZebJjAgAhMEv0MjcphaFe+5n81u7QKCNvzaA+OO+CtdQg843CjsEbtHMkpYE+oN/pHIxSuIad95PRJ9hop8mFXbPp99tg+XfJOxT2P/jBSRSsYeebTkNtHZ/q+o6ti1+Rw6rYQ9tOo/vE/MB5kmDf7hIjM+wSyYkihf1owj41IJt8gbBXLSglgoz8YlfYxyaGBRkAZjijMhVxFPaeZtDHPAp7R2cSxq+d3rvpNDYDjypTTuebGXsaSuB2NLUr7CLah8biOWFn05YEkMOFnafW7zFrLlAfWA2M8HhB7AuTe9T0j//sCPvll+C1d58+3O0R9tJ1+PP2oN7hwj5OYuo1M6Bq2OAFLF0LhX0xCzS5rcE4QtjpCk3m+2PiphVBsgLOLRf2PF05vgQv/Zywp3wod1CuNcirWASzFAL+bcLOhLYwZzMq6OAo7PhhohhNg+4yVRNu6HWzOsu0I6KiyypNdYgoAWut2JNpl+pytmAsldYN6Dm0bxNK6uZuDKHQDoQ9Vweth6EdYbfmSpZVq2SJPtzMrbKnUNgzl6x4nZAStXjNZvUvWn/FUu5KBPv3nF6XodxamEYpVQBXPUjYL/JBBdKoAA11R9jjfQwjXNjrMbZfFsyaInmHwr63rSMqu/B1wVZBzNbJSejXPMt+jA2nPGG/TXjHKbLb1ZER+LrcdCqRnCBS2I8l7HEHnJbyAmGvmKC7DItA93xH2G+MJ4U1GTAXTCRd6LdQ2Bd1gFmLC/u4ALrnUnRM2u8Ke2o8zXiehpZSMbEER+k4QthT7SC6iBL2a4yaUB9w2UlcX7di0cKeSSmLlXkcYUf3xqw5F/bYP19pjctHJuz4LHdvUc/+GOO5dLT7bWFHuf/8cE/5gpn2KGEntW3VrN3MPK8AehWFXeuy9XrQyGJFTJOtsOij41YdVrRCcQxYxneFvZxFa6cPdDIl0WUrW4DS2SZam63cpC7+nLBny7xIidW2TBNYwm5MU+prhD3VDwrdcwbpBcKOv4li0gANr1vWoN/CnLrhD8Q9LOqA+fdrH8vfqwVtjdWM1aDeuWiyzZtVVqSy8DZLZVqotMNl3/N0KDS5sBsmGLbKV95eKs+EvYbWzh66OPfWpnMdMCso7AST+QMd+srCKYzVDpr8wNon7CkHr7rDdR0a6RU0EinrUGFPzMAoZ1yXlcnoqR1hbzlQVreFnbCMvppid1LyzoU9XMMenWKPrmFH4z70nNNNM/Ydvg81dmS9JjmbPaeMdZMYWRIjkZwcUtiPJexLDW5jLxH2lQFrKhc7wt4nxmL7Cwn+t+9Chgu7MiMwjDFhx2uu6cV3hD3RF5eq0zVsA4poLQ0u7Al/HY0Q9kRpHR0829bRyMWwJ41+DGHn9St/f8RMe5JWvSA8ly7MXCg5Vqdzjw8JO66w5j4WKexmbqsznwGIEPbCEF+DWj03oR3UOrsT/DLX+KldYfeK6Opo7SznqgHCja9NuL6Nwak+J+zDzYWwFiaG+xkNr6p+s7CnG1CKY9GPCXYg7HslsWOBAGthYjV2XdIYJoONznzmLSFL+ggbyJJp+njhAlmdz6kFK8XNUmyoXNY04Jhc2HGaf8mvu73UiuXVc9zVswZr/HLVNQERwq7Zwb/Qs9jE1IcXY6xbT6z2CPvIBWOlRgecPLAfL8xDS2JGDqyxOjvCPtKg8bStYwl/ZcU9kncs7EFbR5TeUIad6XHoqFMsKX9aE3PwplMEZ28y9gHB9UJdYp70YWegr29S7L9KYZdITgsp7EcS9rM6WCPlJcLuE/BvAtKxHWHPgLaI6MO+Efa2ThWeC/vUgL5YqhgLC3usT8BoTJe2hUp+Ewh7wkNhj/mb6GBH2GOlIKqD87ywg7ZMJbEeoHAEYf9LyLiqqNTXPz18vbuj2XJetP4RhV0oOXtNtLDjk1/uAv6KzrBbt0pAMk/AqJeWdhn0WxR2a0vY2xq0gx2D7gSHjZuA3Nkzwp5sBis3vl3YqaDWxYW6F+yVc4s3bxl8q7BnHVjhqtXCWtipoUZTNUEX153H2f7dHL+um+arOkP0a5PVqw9K/TXTW6Wok2XHJGSWnYJ/rmS3lmrHleStAUT3l/ZsI+yYYucZ8O2lhmFhV6vB3D6YeS7sPZzlgRtPG/VifAl9Oo7looW95QMpJfedc0pIX1UGBswOFPYCmDcBlcSusBPihvqwS2F/58L+K/r67y/ow47GHtGHPfDrw9nu5b6nDzu+DxT2gMiSmJ9lDbtEcnpIYT+SsOc1qF29SNhtDdLq/oOTfEIG/ynsCBf2ngZZde/BSbc6ZEbMGGYo7D2NC/ugjMJedSBzzaL9XWHHqJtiUf8lws6wpsVz5dI/UkkMZtix6AVLYdSHUIZdtIx5TO4piRE5ekTd19axqgSkg02QyV6UsHctGKvYHQaFPWdhhUyYaGEfZHhVfLLy7cJe1aEXupCaaNcJkJ76jcI+cYPtDkON9ISwz5VI0O5joevGaw0CWNE+mga7TTsFmKoRRyGVcsRx9Wmd3GAbx9J6KZxr1bCXuxB2Ok5boHeVHcLCnlhhg3Uq7kLYjSV+yjrMkhNTz52NoTHCPweJsG42nfTPN2M1mVTV9cFHgGVjAyC+iNLwK4S91YByLPrgJFHZLoX9pIT9t+0uMU8z7MKJ1yXskftOhauHHl/p6vgYrofZqYgRTWLoe4zswy5LYiSSE+RbhH1ULBZFefXxh39uzKT1dsM0HcZeMXxO2GNlMEfKi4S9XcB68y3iZVithd3G0poXCTtT4vZlSNix2FkUy2NHjkUZhb1d4D9S5HQU9qYJWYw2NsKOAaRJ328QdQaBVbpuKbVP2JF8XOkZ0cLevly4sGGMw2hhZ+6NLV7+Ftoutpdu5dTFttJ7NLDHDx83wn4Z1nnBfmHHm9LmSh4l7NU6rFq804s7wV9WiZcK+60OFTzmaPrtwp72Ig+l7fKKdr6FtJF9kbCPSsE1usTIPyfsgwwWqYepatBP4Dn+Vo2PqZKHuRyD7pn22LA0puSpGTaJEQzKfOtpPL8W9kwiOSTgXT8r7Isy9FWFXV8IOynhDSuAT63drKgdLFEfFKKEHRuznz2pZ+cdY3hOHpekxq/ZoqodyOwVwh4vgT7YEfba1s/mTkIK++kJ+9ZJpyLBvjH2UEkM2noIUcpygK0jXNd3tf373YOTkPC5SbIPu0RyunyrsP8pdOl4w7cX9tjbC/vYhH/ZO5eeVJIoAM8z81zOrmuaXvRJgEUhaSDQYWjCBoiAPELzigiSKJiw050bY0w0LvTOL56qU12ATTM4PiYwU58zalldp5vWe/Pd4+lTR4mtwi5NQRbPeDk8swvusp+ig4rOSBjbhP24CM70ZSjREUYec57Gx1hR2PNV0Q5mTtECS1kh+xe2FHazB7WYFHZvtmyjsG/pEuMxOd4o7B3dGIN/GCzsWJduYuMXFHRDlLd4jddli0bTXHaHSaPOi+WYkUcIzr4yw952oKxj35cAYcf+jSkW5oiisIfmkG17kc1twj6wxK9PKtl/Kuwomdnm+olaDdlIyDwHK7Vd2L3uMCXRxSV3vk3Yoxl+MGIaL1o29urs48ymPNOeboLdCdB6ClDM8/fVQ9w9NNJZhhpVxaOn+dyKsHMbpgXyCmHvDlHQpbDjz6sx4DsWDXv2Ba9mj8QLOYCzoJeEGyn5hV0wjUCxjn+eqlMh7I03Cnu4DXbhxa0zY3gHBNEO2GPx5agS9r0Q9p+FrzNkSQzyPRKcYfdLu6w5R97Z1NFfwo7wnVUlqzud8ut70dVRGrvXJeY3JewKxR6xi8Ju1l8O90DYTWYKQ227sCMXXIINjQyKlufWLtBSyFzuv1Ttm1qoVzveIuyYjm/kWahZzZrKZ1ahUzfljqnOjBjsUKEhBcqk1DzJYR92nB2ExSwGxQM6Q3GVMzHLrP41wj5vj9mB1qFBChAs7GcxrT92crZvGCjsV9emyTusE8yS39ybJvN2VHJMvN88mprx5UE0jeF+Th6E5ItcO0u6m7ImBo81726fHrcJe74GuWbCZJccJOzo8ecxfq9cr72jUyGacTBx2tuE/cBlaho1Uxb8M2FHZg67rLBm9AtOkw+rpzHTrJ8CyDaIFQpnI7Jd2LF23WqbOu9lqW8TdjNpQbaU1ozp3Clht5rC1DT1DpbEsLAu80tC2hG8OX6S/AeMHDS8po8HLFSGhYqdOh38DUbkVDeZ+q8KuzatsYjbhL1eYGaum8z5F8JOz3Tee716wIXa1c18DgBoQCF6ogngZCqcwXBd2ENjoPFQaI6Svi7s0VS76UJk3G4nt/Zhr1eZkic0M9RxJl4sCs5hWv5VlwV7ntZIy5orYd8HYf9FbHQqa2IWwr6+0yl7k9smrcq6yK7Ld+/DS62vl8Qsa2J8Jey+khhu7Kqto0Kxp+yisO9hhr2dg3L0tcIedSnu7gKQO15UyXCOol5TaDFd3S7sv58tQnkTFWfRfob0xCSlQtiTVXGsEHZjspztyzSzrGxZmX2NsJdDbD5qsggWMIojbUWEEVrBG1mKyGFYDAOEncE7w2B2nIk7jq6uhLBzOcfRogE7Tsu0Oho+55YsFmOs+23CbmTk6w0Udv2UAsO2hbCHxdEUIFLRtj50KiMHCns/DpJcZU3YycniRE3sGoOhRO5aFs1werGtwh7NgFjsVLRtwq6Rii3OK0SyJc8r0vnGICLGdjnopC7/eujCa7pIUl4oTMebM3k3Xgi7mYyw27FF2M2WXLsQdu8y5thiHbcgyrjxSv+iHfBYqSTSWRd2s58DpDoKEvY+SLpbhd04sL3LohNvVpzbyePtGFAxbSth3wthlzUx0tf9JTECX4IdHdpfEvMRGXZZxI7hNjZ1RLCGfa2EXW2cpFDsL7tYw27W/3a4izXsXUqPtc2g0S93VTI6wluzGU/yzXaDCmHnJETjRxtnz2h1KewFmp0u6tNHGKqUFaE6uhcqVaWyX+TwjPI4gzhUY2h3+E+BTFU8WzrsiVl8JBUxB0XqCbtWF7Op5SOpZ2y4QdjdWQKdsCmMv4YrZDdBgV3uEyHschjeIOxPD5eiiyOHPAvhfpBfMK8vUelFA3YDp1c3U7p7uJLCrpmPQt8vn8PbhJ0Jps0v6+gCv+gXdu13dp+pUxpDbyrulCXkrzANEvYDIexNyhfrHYyc6VBP2J2lsKOeS7LCn/so7B7mYQM49mSEj8ZSlNTi8rr7PfvvhT2xLC7nR+Lr2Sbs3KCL4rxneYwjzlsdeLOi72PuxAjyqAxYbXaHpIOaB16oeJLfyGaERypUKAr7cMKFHTcGhUKAsA+EsOeZsMuWkHSSol5bx2zXQgM3xGmreW0TofFGYUfMqYU3Z7rozP5PhT26CDV0QXyXZnL6IkJR2MWZGjiL3/2hbc+VsO++sMuKGH+G3TP2ZYYdbX3toVNZuv6uZuy4WP6/OcMujf07yQtjlzXsKsOuUOwh68LOsEzVJWYNnnLeJOyHDox17R9g1lPnLd3cOH3crvTJK0OFBiyUETxZH7Trq1PDdjL9YnboX7h1NriG3W7E49UI/GOChP3OvHski3tDcLAKeXxMGHJgJh7vcBCMcfd4h8u3ox+2p4a2mTThWwWdhmTXlNb5bEheG7lPtLcSTZ4PjuXy9LTdPKyb2psgsfYs9Oq1v+fPBzF53vA01Zyt/DiY+qwdk8OtJA7OU4tQiWQl/9a7kc5XkmENQWEvGcO2DNbPQe7oTXdGvqJBVPsYSL/S7qc3nimdbw7qmmI/hJ37OgeNnfu67BKzKuzIctek9X2T0Ns/BlESg+8DU+wIv6aAnU5/+mGRYP/1/yrsFnWIQrGXBAq7o4R9Hcw4F4OFPU5pzNT+rxRA8kHCru0qKQdK6k/CrsCFfWVoJB2gubOjVn86VN+k/wH6J+PbOInh7xLjlbB/528SgylvqeqClQ2P3r/TKY+2sYZdKntggl3udPrj/zjDnoUIUSj2Ei0A1Yf9nzI6HBHtf8v/QNjrp70kMZM1cAaaYkfwCTs28xE0kpriP4/+6eBDpy/7sP+0vtMp+rpUdokvu/6Vrxv7O3dOwribM+yI5+vBGyftZw17ODkYDA7C5D0oYVfsMUrYFUrYtxLrAUIzaU2xI0hhX2IcN3tWxLZrI03xn0f/dJYZdlnEjtK71tZR9omRyAz7irSjqL9T2WWWPiDFjm8vjd3n6wy/sP+yZ20dRw5wrGPyDpSwK/YYJewKJexb0fExYepU/se/SNk58pQJu+J/i/7ZSGH/ddHXUdaw+2tihK/72zpKljsdvUfZMYbE/8wpP6lE6Prazkk/yD7se/vQaQ8Ep2QDYd+p9DBZkk7gByns0ShZQQ6WY4ViB1HCrtgpYd9ZwsO6snWFYmfQP53lxkmyht1XEhO8b5JId69WxOD/S/N+DzJfL6MjWDcf2Ihd6Lq/DfsuC3t5o49TEERSHi8ij2p8nnbr7PNWNjusWGycnRFkWouwOWdACAr7n/xYGvcU/giPjGO0i2yRpIrUJgrFDqKEXaGEXaFQ7Bv6Z7PsEuN76NSXYV+m2CX+LjHyDW39Pel1maHHoBJu6+spdmns/raOUth/3dGdTim4JBjwY5+QBYPFF0OEpADmIDgnjCYFQY9wYafeMEsY0SoIKJf7GtgZAFDCrthJlLArlLArFIp9Q/9sVoX9R2RRw/69vw+7YCXF7iuIEbot9z16E6vd3NdY2vqLkhh+jZzVEvafREUM+28nM+wUNhk7rGFH5VyCAlin7TL7UOLCzqiVLiJCvQ+ATV5kLPahyYSdL5yf1MSIFLnHn/BD4U8u7BjXJQrFDqKEXaGEXaFQ7Bv6J4PC/ptn7KjrDPnMaXCCXep6wF6n797oVCIr4lcRj7n6HzoVvNzp9Iedr2GnsMnYYZ1DOTcAKPCPI4AuCrtIrdsA7PQWwJyPOgAWCnuWi34Jz5MEoCM2ShcBakLYnSFRKHYSJewKJewKhWLf0D8ZWcPua8MujT1g46QVZ/fLOr57r63LGF//bU2M9PVvV7rEyBT7TwxeErPDfdgpBBv73wt7JZud8o91gCIKu0M4E4ADcixLXNJZGkFhT/JRFMBCQ88QHFKA30lNlcModpiAjZPa7TwK+9v5Tz6c10+1HbHT6WbMXra74YiZA4zGMHDZMBY1tWDi0DjWJBkr14hpjJNGzpkGhqrLUBuJxqFQ37BWNz9K2O2WVnEAKY40RrIIvuGHC/vd0x+Mm0dtO18ubxPyZX+5vPc+u/3jIaFJjDQxF4evRr1/unl6lJ+JpZt5fLh5wmPuHm7+5mDjObA7TuLhDwZe31uIxkKGthnShGJL2zESsT/JxslQOUeplQk8IHpepQA0h7OBkduNnDvyAhWgVvd9Cw7BaWtvw0hCrvLq/WY3bpAbLQPDHsthB4eFDfeCvphJyIP/N+ifjH/jJBT2n4LaOgZ1Yf8moE8MQ7x7o66/KInx9XUMKonhxu7vEsMrYtDXf/15Z0tiGHGyxmZhl+izC1sK+ynhHLFD+GhOlmSBEsQGB/U9TBAXIMmFvUQUih1l3Q8psxQl7IEUtwl7KgflaOAM/4sgUux29KDJUBFO9dcI+4QCtNPMLM8AYKQFoHdhHnqjsOtxGNc/Qdgj8fH4wJDCLoefIOzG4/X10+uE/XZ5GHn440uAsBs4CBL2Z+bQtwS/fCWWbsa8v2QHG/xYtup5i7AHvqKHNwt7ogS15J4Je7gCjdnqHYid9Nxy0sTBcAIcOklra0RL4OGGtACizRwAWINNwm7+S8JutCDX3jQ36nTmUtjl8JXCbvQ7nVMl7B8JlsTIto7+h065sTMfFr6Oys5M2deHXbo6fhRv70Eux2ibK2K+CSiJQbAihhv7r7u80ykFJEF8bBH28JGFK6WwNwkHhb0sRpKszKGjsFM54ocdkRpAnygUO4oS9o8Udpfax8EzIwsmuPbdwu4ONS3f2Hlhp4WjXgQWnBNh6HIY/gRhR55fmWG/Wlhw4mkh7Pe39+R1wo6rtwg7woQd15KHNwg7cv1pwm4cxjtDbbd4KezmgeUpus5GegbAynRyYF8ECnvEzVTmNtCCuT4dawAEC7vEnMbnU+1tmLH4uP9uYUfq1B6/HG4XdolOlbB/JJhhf7nTqfR1/75JSGCXGF9fx3c9corvRTR/ip3hz7GjrftKYna/DzsFzpz4+Xthj0aAYVuFAGFnX0sRyWLjJCnsckQyABku7AmiUOwoStg/UNhbDow3iHfKgXb4Q4TdZmJQjuy8sCO7K+zXl1fXi0Ian3VvF3bGs/H6DPsVO+jxcveEfRd5Iezhtg3UmowbQsJHDhT7mpmkEI+uv9gB/vrKzNtQi2lr9LOQnRR8wv6xKGHfzh4Ku/fQ6a/Lh06R9X2Tljsn4X+CZb25rD9/Z4ZdxMG3jc+cSmH3J9hlW0c09p0W9jFZ4++FvQuQm4Vx+ZqwH3ETR/qDll/YI0CJoAcw48JOFIpdRQn7Bwr7GaVTU1un3Sl3bTi7KJfbvwu5qPSs4jxmaIx8plzIgjUul8t9Q1bjThpWfJD2hH06m1jddgKFPWJDJW3GwbFhJEK1J43ifIorDzLlcU6EOiBYQlCKW9ZZKSQvqjVudI9iUtiHRyuzoxJf6xTY2jyurfPZeKku15JKuVyqbxL2bKE5GzQLOUBy8QKjar9J2O+uHwm5f3h6vsNTm49fnh6+8M8R4/726enhmsirYkMc+YQd49wTTUS4fjTwk7svDxgKE99S2B9v0LrJ4z3jzvDCXn+5+ePy+foal6KwJ9hijIjCfvkohd2LLC/4DlfIS7i7v7y6ZAU0LMLlpSfsxuMzu+bEwkqvHx6u7zxhT9yLi06wm7Au7PJEj6YWSLTNvme18ohP15vleRGyZ+XFT920cxKLDnqW2yb82FmG0dY1JJY56sc6xeoi4z7s1KoXoykeEADJn9asWsY7OpriP4QtU6xkoY7Z6vIxHx13SiOx4qDcrIvajYuadVZJyBNlSv3E4cTqnoc1vVI+rUEkzq75PKoxNbeheMCO+f0EnIpmzMCeizx7rqltYtgDKxWQYXczCb28Juz6SfmIv4h0K8M4D3kqWMrkQ6VaY5Fxjx51G+NWqNQMaeuEk3xts/5irbXIuJNkr+FUC4cG/mktX8TB7rIXWNLF5LhoVccD8zXCTvJ4cMqUwj6JnTaKnVCwsJuhjmu5meim6pte1an2BnvcTUD/dFZ3OvU2TkL8XWKksAdn2H0t2PGTdzZ2RHwZ9q/9bdjlQ6dS2fdkp1O6wdf/XthtoGn+UQ/IsCcBGjgK2wBhn7A3uKYjEYCQEnbFTqOE/eOEfWRBL1BvuiBpDFGsGzigTS4tcxskR1GNM7AAcYf4DbEcCowLHYW9FqkNW5bdzQphHxVFKFxajoAkw8cdbxyZ4XfEEPPVrBD2jJwdEHGsBDOVpexyVubfgbY2CPtZTEMOq8ARw4rzBmHH8vLnm4UTp3kpCU9SE2nXyM2dMGIcMqM1fcKONn11Ldc889VhEYoPMK1uJp64CzOlvpaRMakufB6R1epMt58uxTwK+xMLaSyFndwuj33Ga0PM5z+eWfSnm5vH8MMVX+Nl9DlX14a4Oox7cyOE/RpLdWRKf03YyfPiRAEc1ABxKvxb4YCH/O60aa6HR0RKbDTCT2UNe4pmGxFgiJS82XIwUBWqh4FWXJBnQhmO48CeR/nokEZEqCqP3YrQueYd1OXXoXcoMKjryXCLZnsuLi/zP0GS2ghL1l2hwcdx+1TTy1zUzZYNKO6B4CK08gDWhb1+BnRCNPyEIWvY+9SuZvELeLgp6mki3eAi91APGLKGPSbX5lLipDgLooyn3gCJkxS/W0NoV98u7Lo8uKYLYacOxRPlg4SdVCjgbFILIFHwYu1xRl7/dGSGfUXY/c+cIgEl7MudTiWLgpb3bp0k2sSsP3Ma3Nbxe8FKih19facz7IG+/vfCLpu7xAGqfmFPUICkN7L8GfYTgEiCjzoAOaKEXbHTKGH/OGGfUBiZQROluGtRaHRdN6Nzr7IArEnXBuBZt9TErdmQrbmu2yLSc52zM4dWj0XbHsi6DRvoCIW9WaX9Uzs+EcI+qrJQvW4EgHv1jIWKiFCHYS7wNrV6kypbm9eEg9Oay44Vwl6OUOsMZ5NcswqLtZja7yxmW9uF3clr6WSJZWM9Ybc65+3Q24X96or58dMVF/bwE5PZ51smtdcmtxA+vH1+uBJSfIfDp6s/ru4DMuzo6UtzJw8y1BeDyTub5I5+LR05zRLol1LY777cssHlw+3t7b18YvSSz/NIzywCPrSKwu5FvrzlkZ+NhXLj11HYn2+vvtxf3jwLYU88yGu+9v41cfV0yy7kNcJObvmJWCB8jtVP6AIg605qEdTo2IXbdcBuuK5b0j1hpzZQx4qgsNdZPj23IuwAdrWbBVrm9zlfZQfGGwDBwh7rAURqvaKdPfLsPevWWOwLIezATstDzU126Bl0pyjmNp2jr3Pz7VkAvagQdryqnBWxy+ya3K4FtsWuuRxiak6dcxb+tNrNZJhZ1gtQzWsxFyhlo01MLeiGXinsQxfsAhEp9GLRWRF2AGq5OYC4yV9gDSAbL1IIFvboSbForQi7XNvla9PnAHaxEM+hsEcz7l/sndtPOkcYhntMj5e92+2yF/MlwsUiAQ1u6EK8oUY5GjlIQJGEH5h4V+9Mk8aYaLzQ/sedeWeHxd1FqIdW2nlaqcvszgJt04ev73zTaYjhVgvps0SWktVR1yMqs+XCPju5wsS1uJH4JIupqLCbB8LsdytEXsynYff4aGV37Glhf46gwv4tWNDWkctxKMPO/TnSI4Y/vJ4gEoN5la9HNk5SJfZQhF11iYGvf9iNk4ZmPAWKsKnGkkS7qdR+g9Bk/YmwI51OOwOrJno2hIQds7rbqdMMEW1pYdd8bLSwv5mwD2AKCzjw6NA2AMs49CnPraBB2UE0w56r+qX33l5dCntngAJ4LSWE/XhMJxXa3oOws5FDzZ+5pJQpO4lm2HtNzNr0aI//kh+Tu28b6aoQdozixE9FOk9EM+xTjArpPkssFfZu2qgViAhVWol7+GJhF/V0WyRHNrgccyW2IepcYKG3KC7bOf4oRlHovkLoJCzszO8EY99JF/5TnAyL/u0eCfWNKyg2rljaJQZ1c9wewi6q9gzCDsvG/c1rodZI2Kh0PIT96s/L6+tfrm/5Jepk1PDv8qKnJH+zDJXzFYT99vKXO3GjRzwVplSmzERY4Wk/mmGHsJPTHfCAyeFWpEvMtoNq+VaDMmn+3g+4befQeCVG2CGD4zTiLKKKPHVpPEBRvroJYUdiZbMBUzePCFafb1KxCW+nVh+5lmTbF3ZyWml+Qmk/lGFPnFF3w95PEpHj0EioenXCBTh7luRHC8g1ycHgCsLORdwd2pG2jhD2wg5/e2XKbqIFjNNK8UA9hH1Zl5i0g3dWr1K2JG40pqL4jM3JZkyGPVWbMlmF93pLhf3nGpIzqREVelLYxdDPF+TuRYXdSpJ3ym+7Tc445lMaUXKKHjzrtsbh39o4SUTYv/Uz7IjESMKZmC9nGycplFrPyfbrauzqVxBOxIBohT3IsAs+diTmpLZopE1hshtq7IwkjhCXsLBvZMknY0aE/dQlnzNTC7vmY6OF/c2EfejSlr1U2JFV2E34FflJVNhPChgGUthLDO5wkYCwt5Muf9yBsB9maVT37725cNGpOaZOnztZloYJ1M4h7POj6aiwq9Eul6Rlwi4uO3cIvIWwB/qde4A1w7ZvZVSF660EGo9Kuw0HDwk7PB5ZF8RXMNVN8LTIjHNL5tb8iOeXCTvui+cg7Da+DUhhz+Mbgf/qeAVd3O7++spE2Eb83P9xeckfIeym+hohpBtOj2vvV4nEbFwHN3o0IuwX6eJnAywS9taxAeKE/cwWFWA8MxnLga1srLAfdyDVADVz70QqeXJHCvtQTFWT124VaMj4lB0aJ4SEI2GOp3eZL+zlUuyi03SLm++kQoXRRZFoJH5tJTaT7tmpR11mxKDWnK4m7NMyuWfMiBf2jsnf0RGeSQzlwKC8orBXTZgyvLxeoYa1bNEpm0DyV1t0ytLC0CHsRUv+tRER9nxNBp8My6MiM8KkyuRZxppjvTOqSwwq7D8+E4mJFNifbnSqNjpSbV5eX2KPLDrFT1BhVyV2+HrY2P01pz9+1Ar7Yqx2geZxRsfB4IgExcGOEJAe0QGehbBz/BweWqx7VMAYhJ2T6mAwyU/Uwq752GhhfythtxrUqBtLhR3JlGxLUHToaCMi7Gfuk2BNhgpCmM0WdesQdq4tNK5LYT/xKNtpcbIo2keFPX0yzHQ6SSqncV8sfDtsKGFPN/3RSZyw9zFaoIqUPJbo9+tmrLCLquzkovBmwq4CLvDYP64FD6LSjuPfrsxgo6Qg9HIbFnYMX5tqEJfe+VM92vzZP265//7BH3HWMmGHNDOh+RB2yDmTwn4zN/O1zR75dfB5WLcQdi7p/DoIu/D5OxMejqAOKvXI1y8TdrwhdaPfMEk0wu7uTtgzwu60jYXC7u4YKK1ne0jEXCDZfQHp3veSM4onXLaLdMHmQ+Myj77vOucQdvgk61EWmsvV+BSJmDMD3p6stjjlJGUGfiRmGN8l5rjhNe2pLNd7NOLH1CrtUsZ6RtgnDXx7WEXYnQK5Q2bECzuq9GwTkw2qVN1AnmU1YXe64tpj+X8WrBE51S17obCbh+1upyO+OiwVdpw8wskXMsNe9aPtWRYW9hS/bTnDP+dOgbx0XITdaRyu8YLTf1DYoezS1+f7sAtUH3YAWY4mYkDQk/EVIXZ1eZCxCYhG2KHrwVan0PVA2D9whv2lpLY+lcS60/5RIm7Y2t4emIsYHGzlTY3mw6OF/a2E/TxJU3MVYb9wacavqYiwdx13YgRkKIv/3rYoI4XdGDvUM4Ww454z2lZE2BNddatKWiTaqQSjqEphT4xmo2Fhh9HMRo+XtnV0t030pMm+jbCjXK6K5DOuTSg1x9+lFOkTWxXNw8KuMjGmr8K3T6bil/z2+PDbnw+Xf6IivlzYMWsg7LaodkPYn8x8tyG+CtzfPIhYD1f3vBB2xGBsCDu+RdhBlRyPSKcvFXa8XwXyNCHME4eI3OqULRL25K+Lhb1wgr/Csvc9OjegqBD2HgU4e8rM5+rtXQvqXaALCLu8zVSEbCDu/DhVw8RYv6Eob+Iq+H2csJcK2Wmqhn2Q6kMRielQuS0m3VwYiel3yD1nqwm7oJVaIOzSn6V0p7PUQdX6YDVhl8KdliVue9MhkTU/sSPCDgP3CCwVdtxEnayEHWGXVJeKibCwWxWaUZgaYVjfQT1yZ52d3XpvootOsdHpfF/H2BL75/gJhdjxAN7I2jEtkDdTvu4rO14WZz7DDl+Hsn/gDLtGo9HC/s7C/nOFigNjubAjCTM689k0I8KeoeQkpg97IOzNLFd4KexDl7pqqpIZFnaz63B9G57vFaHkZ76wJzoQdnMUjB5HhN3c9Uez1Fgu7JQ8T9sQPO8thB05FyXsd1c+aJpoS4W/fDRVQGahsGP8ClbP5DkPaqp7mz99+fDbww238gdcu3Sn05Cw4+ZK2OdnRhAG+5ve8K8CDMJ+c/fHrQFhxyOLCrv9uFTYcfIfczeKkJefuJM5XiDsXnNFYS/4wv4rhP10tztjyI+njtB2xWaFRkjibBVpCGEvBMLOKRVp1z4uU1ecxJ0ze+bTlJqP0+OEfcstlxJncHPziEailO84zpAZJdcZLWrp6OzaxorC7nrkDhcIe/J8Ttg9asmu8CsK+8VM2GHsDQdx2/2osLOJWG/bPdvbhYM/L+ys7588FC8bwj7yi+leOiLsRXLPfNqJuJ2eKg5kvmesLda7gww7Nk7iIMMuF52G2jo+1fWIrau/gtel2EPLTuP7xHwpeVJgn+8S8x+tsGs0/320sL+RsO8k6SC/krDvJWmTLd44aeQ4x88KuwDCjjj6Flu4cdI0K1MH9pgLO04uwULKEPb9BmX6YrQbFXaMttJidLSKsAuKw9KGkRu9qbBDuVlo3LwVheZbvw+MvTASg9j69Qay4pH4O+Ill9cm3/H0N1z7d4UdNfE7CLty8LmgzuPlw8PD4x/c1SHsIKiwm+r14Mm4CjtbVGG/ZsZzMKtZdshpswXC/mkVYUd2HeHuxF5shn0/iXiLzyRD4zrUG09HhD1xTuUScjKyrdHINBTPCTsq7L1UjToDWWEXExGOtsjx9ZbZNmOGBGFzZ4SQWXQ0KuxeM10k79NyYR9UqMPQDf7vCzvITzMOUZVFhD3Vliex9ArCnuMn70DcZ8KewSQtKuYjkZgOFTeMZzEPxw5RcX1r7NY783xbRyi78nXFXCBmbuck+LWssr/FglNZsJ8nvOIURLs6Cnxf/8CLTjUazT8u7INSqaSy2Csd/m4bivr7HW7yQ/MFh8uE3SxTYWCsJOxND3lzhUyhXlgGgM9PzdWEXShxMxcSdqwsVWH5EhNGVYawNz35lWI7C2GvFWgLo9VA2DEAavz1ylEl7PmdVms3vUjYwY5ltN14YW/mJi0KOMHhMmFXSh4Giz1tX8jFMaRc8gjjBXj+6g7eHZ4KrRi5wYtS+G8vEXaU7C/xm3Lw4MKHBx6N/+0P3pgyLOxYoZpTGfYgIZN7mmGXGXgBnvJnuEH+fRnbSbVqOVej6uFLhP20Q+O+ENZWrLCXGjSyDEX9wp8FUh4VdsYzMsMdaDi6PLb6zwm7iRQ9OK54NTZFjBwZ9vwBkVdD3R/misT6XE8Y65wclPGBGn2mS4x96FAlvVTYE11qHCND9iJhB4MCZfu+sONUkOhQheFbyrywSw+PHFotmVU3j5SwU8Xv9pg1lLA7Hd/uL9AkZgkpjwppY12x3hsl7LEZ9tgS++IMO4z7tfucBs3YI3wRauwoek1K4OuBsKtEjI7EaDRrx7sK++/MAEsO313YzfcX9pMC1XKrCXu6MQvP2EyKYodaQT/FIhSdk7OXCXu/TMXJ06nQEUadI78ZnLkQ9lJFtoO5cLiXQ+ch++euEnbWDRps1PzRPReysqRLjM+ov1DY25Y9pPDhcmE374Kei4ZEVaftoDtMHt1ilN4i4RJkSFRh3cTJgEk5F4tb0cn9Jk7YIefPCTuUX9baA+fHydhgiX+p4GoeEnZkX+DfJpRcvUF+mkraX/6JcwNhV6kZ1VlGvYdFHDaUsLMDrt8vEXarDVNlPTdW2Ae7GOaYecPInZDbRiUdbh0WdjR4LGRp5Pc7n/VDYXacsLN9zCIDLu6eMRE7n448EsmYUhKB9klF/XN6nJ1TcmuHnLFlhIS9+4ywi1dDGXOZsOc/SZ2euC8X9kRLCTvjA+1A2PFsvTgn7B4kXpHwqMHUd/FiGmmXmbB7m5jPqao36MHp5ZtxMsHnvIBcRgv7YgJhD9o6QnpDFXahx6GtThEpf5qJefWiU4Crg4q9j3+/UJeYJ33YBfD1oMT+vRZ2jWa9+IjCzupPD9dA2BnXioGxXNjBuZBg2zB7ZfzXGjbu/Jpgs0wMN2jG63rV/hJhRzm+UeJTTavZiVqzSu06UzumFqemzU+FsBu7Du1Z7MRDH3aM9jbkKCbFCe2BfJVTOcqtfhVhvzgaFkRK1zZ3YyMxaNt9PCx6buhwmbBDue+ZwW6uH+C1d1emVOUr2Dk0lx/C3wH6yORNHGKEa3p4qj9u4d78UJSyIekRYYd3X2+whcKO7wb4DTPf8plzj3xmHPKMjFgh+miHhF29DDRev7blJHd5MSZmVqaOzZXu58I7f+ZM239z/o2ujAjT8kWaMREcaTOl6JQ5Nf+2sCPE7v2abnoEYY/JxPBh08gdNGoyu178xFK/OtS1osIOkyZfUrHqtNDOG3b6vNiOE3a0edwy/X6RGcvGskzH5cKOEHs3MdjF/pxhYf+5SVT89UDQq8cIu7V9dNKhwsXRdmkm7Ng56XyJsCPEnjxLT4v0AmGvlzNbzMh9cmZbIw0cKu7nZYX7nJxxgtWrFAi7NSans1VPsPDhz3vcwRMsUaWZsFO2zvpesKo01eXyLq9Nlcnppgxm/eq1jBBitLrPDHPbIY8Z64r13qguMfD1H1foww5jj+nD7vv1WxD0cl/Qhx2vA8LuExuJ+VZn2DWa9eMjCvsaVtiPPNpLrSrsqZbjb/Dg9WcpGUENU/TLJIcry4X95/FsKgwgJaPaz5hdDIo/IexbFf9cCLs9Ckb9a4+KKtkyN7qKsO8l+HiK8RmyxCmfGopSlYBzYCKlk1SHG/JwmbDbj9yKLy/h3TB0/+juBqNCyMWhqoWj86Lg0fQDMsK61Yg4E1PdIlYDOxfibEotVkCV1TMYjRf2PFI1SJzPzwzDvuWjGIwIu/0oz8WM6Oco4TOrUbzHoNnNFZ66M8WvsxvFCHvPk39/gybppy319Sgi7OkuKQonEWEX9g1PjhN2DONW8FnUqXHkNY2osOMZorLarGnbJXLE2e5erLD35QurHhtsyxWan2h3Mgen50eiybpHajAi7PVdUiR3YoR9kxQZJexihiQVe4ZhnZHCPYsIe/5IfhrJWGG3zoNrhxFhHxTFlUSYCVj+mo+SqI6LEfGBBMLOJg6GNw0gTxG1dNZXJwfCjqmdTqj5iyy8u2JUDMcJe5aIMF3bWFusd0b1YZ/vEvO0wq6cOIiwx607Va4eenyhq+MxnIeJJGJUkxj+GmP7sOtIjEazhnzEDDurP3v4ETPsHcfpG4uB0QfNmO12UprSji/57KjhSGEX5GTjRxejY6cSCPuuU5jM8umwYtTAOYW25U+1XXFUv8jBGP9N7mX8pO4mvgrsVGhYR+JAjmJJKmC9suMLu1GXo9vBktQxP1wg7K1pDhrQLCqfmusNLnH3jk0I++xwY5GwQ10VDEtMuaH+uQEXvoTP3uUCn+fgEKg+Mo+2kuQgIcPu/akeN1DpVruk/smeCHvQ9vzucibslxFhR3Vc/TabORcsIEXv9rCw4wVezvxcns25Vu86h+8gf2LtbPARQNgxyYMUejS2DHGakQpXDhx7MnKXC3uyJoTdayphlw1nPHK88x2qlowYzKnfj+ZUnpwkTmVq+MJeeyrsx1WiWfMWdlolgZvZ8oUdpwcMhkn/nyGrjdaPwL8WotlKB6GXOGEvhBPui4Xd3MZx4oIU7gWEfU8Ju1yfWXQoOTqA3IcJZB87j6Zd92xO2K2hiyHvZM7wk44QdnyOSSJRFXdwEbBPs2L4NHJo7hfEyZVNx2/r6HbwL3TXNhRsIk5Gep1ZGRI4jW0jQv4Mr0q8xPXFemeUsId3OlUF9sDYQ5EY2HoIFWV5ha0DqetRbf8iunESCO+b9N/tw67R/PeJCjsny3SXmAii5LxI2PeLNLSMvwGrb386tNjC4f7RwbG54lSJHp/Kjh+s947q80ODo638k9FB+MKlo/EZdreRyVSS9LfpGcuxb+5vTKYOcvf3N3YwyHLB4cpTrc67zMzyeM3BpfNHzLy/Yc/f6H7RjfKTo+a0jsHXY+ZFLH08WNSP5vDTvqWO7P5RL7HyfXObn7bTprGcTY+LLnt62+k0ZfwNmPE22D8bqRo1Ji+4ctBrbqdtIx7z9GA/v/JU4ZOZdfTM1fbk4OB0wTCrT0+OJuvbIuafzLDD1zkqEgO+BtEKe5y0q8w5eGVTx2iEHSX2aJ8YRNih7Kqr45yx+11iftLCrtGsEbHCXtTCHgUV53K8sGccJ72+WdDXsksvZ43bQP8PKDWw4+m/hn1YFK3Ha4fHk8G/75aDstjxVPNRsN4bCPsPcqNTlYkJhD2y06lfYoc6z8m6rK6rh9fhl9ajkZggExOKsD+NxMDYdVtHjWZNMWLQfdj/Lqf7p/+796yF/T+MtdOabrDJGPn2f5PBLkkqJeNfI/epfJBniaHIt2s+DNZ7A2EPQuzw9WgkBoQK7HDocCTmLSrsKsSO6RY2dQTIsEci7HrjJI1mfdHCrtHCrgmROCfgDFPGv4vdP+kWk67bOTb+JdSqWiKqWobmw2C9N4Gwq0RMuMLuG3tQYYetRxadquj6q5qx42L1s7jCroz9K0Vg7HMZdl1h12jWEC3sGi3smhA/N7G+0ftVR0CwNNQjTvIib2g+DtZ7A2GHrwtg7MLXgy4xgbCDYNek6L5J8Pa3QUZi8BhbYgfiNcXsdPrdN7MC+49a2DWaNUMLu0YLuyaKmRhoP51hW/2coflQWO9MaOMkTrhLjB9h/yrcJAYl70DVQbBa9PU7nYrZFmbYlbLHFtjVTqff6gq7RrN+aGHXaGHXaDTrhvXuYNHp0z7s30V3OoWvK2VXhKrrnwXd2N9i5yTMu7jCDnxfj984SWfYNZo1RAu7Rgu7RqNZN6x3J6iwqxA7pDfS1lH1iVGoCvuctEPUX6nsqkofU2LHH0+N/Ymvg7Cw/6DbOmo0a4UWdo0Wdo1Gs25Y740S9h9nfR1Vhj2ciZG+HtPWEQQ7Hb1G2TGHIrTmlP8ESF2P7Jz0jerDrhedav5i71x6UzfCMNyLelWX3XkKXviTQhYmyCQCiwJiQ1DCNeIahVyQKImUXdihShGKFJQFpL+4M+94MLFNSNPQntP6aU/KMBeb01Pp4evrmZDPlFDYQ0JhDwkJ+dyIbB334CSVYfdHYvznJjnl7tVEDH655v13UPV6tTpAbj5wI3ap695t2ENhDwn5HAk4OKnZzIfC7qd30MzhpNNXMLqZzpoR8iz3ej9wWj++a2jBJKh+pinSVrYe1zjn9WxuFLhUDUu9xm6CCrU1cyPGRwm7faId5wgUccr6fpE8zQ8X9gec248z/TfxfLc83N94vnt0Xk1/neFdoKeYsRy+uurj/H7+pF5h6is8ze7nGPMwu39lsL74df6g+UjOfuXg/t7Dbjyqa+thDSqeaJ8YyfgfbG1ntJQ1TSsdOGD3t7JJZGbRG0SyWc+2LrSQ/wiRbePuEuN56NRTYXdL7P4IO3DL6/j13vK6mq5C7Aph6/4SuzL2gG0dIew/hSedhoR8Zvj90DTCCvsaipuE/SBLpd1gN6oQxYqddiRQQ4p0FXmLsA9MomaKm+WQiALVI9Kh2+g7hT2SoMvaFoQ9lri83NNh6G5zG8KuP00m87cJ+9Qdxma/PgcIu45GkLAvuENPGd4eY+orGI93fLAuxvJZi83C7v9Es3cLe/KQKvufmbDvHFP9WnPR4+fdVmnfQKM/IIE5SGk+dg/JoRXVAthtZInICv+Xzn+GyLZZFfbvwTLD/o1vH3awUmL3BGKkbqtzj97F6m7uPlxbfxGJEfcoWI2w/yATMfzvsMIeEvJZEQr7Rwp7y7TPgnsuLBpg7t8W9lZfHBn/yQu7Wah2Y27zNwZDXzZ3tiDsYPHGCvt4acHJ+VLYH6eP7G3CjtkbhB1wYcdcNnuHsIPJ1oRdP0q0+9qnxUthN/YsR9EjOH+VyEq3s2TfBAp7rJU+vrXJLBj+7nidKBT2/xSRLQNh/xnGviywIxEjWF9gh677zzr1HHT6flQifhX5mKvvoVPw8qTT78IMe0jIZ0so7B8o7Cc5ulwj3gc5au58iLDbPU0rxT55YQefrrBP7sYTN0jjse6Nws5Z6G+vsI/5oKe7T0/YP0Ug7MtG0ybTGlzWpYRf5KjY04x9kxK7/g97iv99ZeRtqsQ1H70MZQaFUNj/Q0S2jpthdxMxrrH7D05acXavrOPH37V1tcaXr2ZilK9/vbJLzDcqEsMRkZhwH/aQkM+QUNg/UNiHpjkyND/Ndqlj0/CmVGr+IuXiuGsVb+PIF+fTpUKGrMtSqdTTVRp3ULcSpylH2EfXA6vTTELYYzYdp4wE5WxH2JPNQb14O8LMvXTpMiuX2mOIEBwmLGt4GFU3dXJZ71TjStj71ZXei0MxN1fgc/OYWxO9icOamsuOS6XD2jphzxQa16eNQpZANlHglO13CfvD5Imxx9l88YBLG0/P89mzeA30x+l8PpswdVe8iZZH2LGOKJdjhcmTjhcPzzMshcK3Evane1g3e3rkPOjOspPn+1/vFpMJpkLYk3wyVoSw3z25wo6V1Q0/YIa6hYfHu/EdD9DwFe7uHGHXnxb8npNLK53MZpMHR9iTj/Kmk5Mn5hd2daEnQwtkt5mwrErpQnTXGqXbImWGpeWfulH7PL572rVaTSbGXqc5zYgG4ulqL94ulpcV9367Ur65GGFAACx/VbEqaWf07oH4Q3hiyJl8qTM+u4Qvmmftwws5Y6/UqOHj924q1vAYnx/DD3vJo4HV+W1HixyXrioUS/B7/m1X42puU3FPHLx6TrljTb8m+1bW2bMNbR39LlkHmo94K52MlEJh/w8R2TLeg5Mg7D8EbesYtAv7V/59YtxYyzt1/UUkxruvoz8SI/jGu0uMSMTA13/6MYzEhIR8XoTC/lHCjthLN1BvOqSo9yHWdTTMhpCWW5sUVVk3PLUItMTgBFk5kzg3EQh7JVbpn1h2JyOF/aIol8LUUowUadFuO+3YNYMpyf5yRgp7WvWeMjlWgUrlYcbtVfV3Mk/WCPswroGjMglk8zj3DmFHvHxxv3Ti1OxXwfiZKbsG9w/SiNHkRmt4hB02PZ6oOQsmzFguJRooqxvJuXBhrtQTtTKK6tLngUqrc92e38l+CPucL6m7ws6m7tgF7g0Yi18XfPX5/f3Tzmws5jgVfcF4osu7w7r391LYJ4jqqJK+T9jZwr2Qn70KgdwxbxzlyEH922ma2S5GxA556wIvVYb9wMzUY8SRJXnjBLNzZSofBVpxQV0JMpxAw77dxZ8BMyaXKou1T2LmreYM6oj7iLRN4pitkQZOzEy3hekl8V+QonKByHqrhkFnCftKi5SEqBsnNkHcA8GkdVYeCvt/isi2QSRGbevofej0W+g6jF3oMYebsn8fdri6qrL//Qo7wGrrEzFfBURiABIxwth/Ck86DQn5HAmF/eOEfWASaps+DhMty6R6p9VKCxcWuVxr0LGJjnSuSoNWxaZMpdVqnTDlubnhMGeWz+S2PZRp1W0yLyDsjbLZu7ITAynsF2Uiq9uJEQmvvuZLxeRSRztC4G3T6g7KfG5ekw5uVlp8rBT2Usy0hujdF5pVWM5Fab+97D3ZLOy5vJbaP+TVWEfYrfZvzej7hX085n48Hwth35lzmV1MudRODCGsojldzMZSih/QnI9/HT8GVNjh6a65s5la6lkX8r5gwtEnypFTvIB+p4T94XnKG3ez6XT6qJ4YvRP9YqUFX2GKy0DY5cp3U7HyQl8qN96HsC+m4+fHu/uFFPbkTN3zxPk2MZ5P+Y28RdjZVFxocY/nWH1Eb8QflUElBo2O37Q6ObLrrVbrMOIIu2mTmbNiEPYar6dnV4SdyC53MmSWDN7Ml/nARJ0oWNjjXaJYpVu0M1XYu7huha99I4Wd+GXFUrcGHzqkzghibpu38HU+tdO1iLq7UthxV1krZpf4PbU6FtkWv+dSlKu5mfuNL39V7qTTZkGrFaic56VyMk3eWsfIok40FPb/AZGtgwr7y5NOla97z00CgbvEwNY/IMT+pfopV/OW2DneGjts3ROJCfdh3xJZs8JCQrZKKOwfKOx9mMIajrN0omvASJj0G3fiXp2svj/Dnqw4pffTUk0Ke6ePAnh1Vwh7b0jnZTooQdiNgUmNX7ikFMka+TPspw2s2shSib9IDck+0rV4RQg7ejHwtxzdRP0Z9mv0Cum+im4U9m5cq2aICFVaiX3ybmEX9XRdJEd2uBxzJdYh6lxgobcoLutJ/lP0otA9QejEK+zGVL7UZ9KFn8VgWPTdExLqOxMoNmZs3CUGdXNcHsIuqvYGhB2WjeuzqVBrJGxUOh7CPnkeT6e/Th/5FDUYNfxZSuwpyT+sobHFm4T9cfzrTFxogbe85IuUGImAysVZYIa9aZLZ7fOAycm+b5eYAxPV8v06JeL8sx9z205i45UgYWfHTtW+nxbhk2ubhn0U5St7EHYkVvbqMHXWJFh9qkG5BrydWmfItcTajrCT2YrzAfkjT4Y9ekXdHf0oRkSmSQOh6pVR6jeyrmK8tYZkg8yBFgr7/4DI1lk96fQn96FT4D83yT05CX9L3Ly5yp//zQq7XAd/vfLMKYTdV2BX2zrC2P9Pwp6LFdiWMcliXs5jsRoLCfkoQmH/QGG/tGlf3yjsyCoUok5FfuQX9vMMuoEU9rzB1ajIRRzC3o7Z/Gcawn5i0aDmXHvPJ+wKNqTOGXcyiy6jqJ1D2Fd74z5hV7Aul6RNwi6m3ZgEPkLYXf1OzmHNsO1HGVXheqtgcxk/0eHgHmGHx0+cRIwul3pw3xaZcW7J3JoXeH+TsOO6eA/CruPbgBT2FL4ROHfHK+jick/TCUPYRvx6uh+P+U8IO1NfI4R0w+kx9+ktkZidqXuhhebjKEe3v2hgnbC3ehoIEvYrnbt+Gu+MhrJj3woU9l4HUg1QM8+eSyWPpaWwX4qlqnLufoYuDb5kh4ZRIeFImOPtguEIezEf+NBpvMWdflSmzOA2RzQQL1vRvZh9dZGlLuZ6Uc+chsL+fyCybSDsLyMx3wHvLjFK2IMr7J4t2PHib27sCDwV9i+927Crh06Vsn/+J53u7J+enu7tsL8KbHqrBF+iRHTBQkI+ilDYP07YI3Wq17SNwo5kitUS5Exq7viE/cp+EaxJUEYIM2tRtwZh59pCw5oU9vMsWZ0Wx0LR3i/s8fPLRKcTo2Ic1z3ShSHVlbDHG07vKEjYz9CbobKUPCN6dlZjgcIuqrKj28yHCbsKuMBj76eCuai0o303Ye5BSW7o5dEr7OieMtWJqTNnqYXO371/5P57L35O2WZhhzQbQvMh7JBzQwr7w8rKU91Y8HnweVi3EHYu6XwehF34/IzBwxHUQaUe+fpNwo4PpC50h0X8EXa7MDJeEXazra0VdjutobRunSIRcyvWr91Cuo+ysSW5cy7bObo1VkPjMo9+ZJs3EHa7JH6vTslqysBM5QKJmCsN3h6rtDjFGCX6TiTmMniXmF4929CvZbk+SwPepla+QInIK8I+qotvD6Gw/x+IbBu3wu4Ku++ZU+CPsLsnnSqWgZa/eXQSXuGXwnduElARdslKiR2+/jlW2C9yJLDO2F8jFPaQ/wqhsH+UsN/E6Jq9RdhvbVpyuOsT9q5pjzSXBFkoGLYoIYVdG5p0yoSw45pL2hGfsEe76lLluEi0Ux6aXpHCHh0sewOEPVpY9vY2butoHzDsSWN9jLCjXK6K5EumDErNcU4pRfpEV0Vzr7CrTAxzVPjxxVJ8yt1ifvc8Hz+jIr5Z2LGqK+y6qHZD2F+sPNsRXwWeHuYi1sPVPSWEHTEYHcKObxG6WyXHT6TTNwo7Pq8CeRoP7NwkIrtybawT9tjhemHPnOOfsOyjLCGOvpuGsJ+Si1lSZr5Sb+9GoN4ZuoWwy8tci5ANxJ23d6tYGM9vKIp7mAW/DxL2fMa63q3iHKTapYjEdKjYFovurY3EnHXIvjFCYf9fENk6boX9e7BmW0cux54MOyIxS5Rff/ERqEgM1lW+7js4SZXYPRF2tUsMfP2zOzipS5Irtoad4Et5bHqXBYOOtcN2kgykfgkahUv43oOwu++GhLyPUNg/XNh/KVOur20WdiRhBlcOe8wn7AmKjQL2YXeFvWFxhRfCjiRMVy2VZ15hZ12T69vlTSkHJb9yhD3agbCzgdvb8wk7Kzi9FtU3CzvFbuI6BC/7EcKOnIsS9tnEAZsm6lLhxwumAjJrhR39E1i9IcfM1VJPOn97PL+bP3Arn2PuxpNOPcKOiythX10ZQRicb/ow49VzCPvD7B7h9oUqqfuEXV9sFHYMvl+5kI+U/B03E701wp5tvFHYM46wH0LYLwrdJZe8fW0KbVfslWmAJM5+ji4h7BlX2Dn5HBX0XpG6YtB+lqwrh4bUfAwPEvZ9u5iPXsHNWZMGopRvmibP1+Rtc7BuS0ezoGuhsP8viGyb1YOTRIT9eyfDjkiMxJuJ+Xp5cJJCqfWKbL8TzHVfAm8iBvgr7G6GXfBpR2JKa31cOUnswOHFyhcV0W92RGr8JJO5ZoKDTCbey+D5qswpb6cKWZPM3JUvVrPbzfLJsXSKMe+wdsZiV7xX5OBvxKjyiL/byGSil3xhu36AKUrYz3N8ZvGcvxpmTN6dqTDOvtg2wrpKspCQdYTC/g8KezpGx6k3CXspRnvG+oOTBqbZe1XYBRB2xNH3jbUHJ11bMnWgD7mwYzCEvVeEsB/VKXEmert+YUdvKy56B28RdkHuMr+jJQcfKuxQbsPTzx5FofnR2QdGXxuJQWx9uoOsuC/+jnjJeMr4iad3mPtXhR018RmEXTn4SlBnMZ7P54t77uoQduBW2JlzP5gbWGE31lXYp4b2GkakUTTJbBtrhP23twg7sutXYoloKTDDfhRDvMVhlKBhDeqNt33CHr2hYh45Gbmt0YBpiteEHRX2U15h7/RlhV0sRGjtk3mrAUPXDUNTRC/JHCBkttIbCvt/lciWUbvEoML+0yuRGF+B/eVBp0iw4AVc+wNK7L6HTvHLrbCrEjt83WvszjOnP32qFXaTWiwY8mKfu52nyzej3NOJGkxQJTraJ0mVsV6MJFlPrObCVh0p5h3WJbNC4KZDwOSXuCKKuRV/Jey7FZJwuc8RsBn3fJLkQmMPeQ/bF/Z+Pp9XWew3NX/XNUVte8093mTvaG4SdlakTF97k7A3ssibrxAp0u1S2EuI1rxJ2IUSN5IeYceTpSosnzeEURUh7I2s/EpxYEHYqxnaR2/FFXZ0gCq/X9mrhD2VbrUK8XXCDtIRrW0HC3sjOWqRyzmam4RdKbmPZyTapZCLNqRcsoDxArw/mcG7fUsxsSn7Mw4ivXuPsKNkP8Yr5eDuxPmcR+Pv7vnGlF5hxxOqSZVhdxMyyZcZdpmBF+AtZ4UH5N83cRBTTy0nq1Q5eY+wX3RoeMZbvVagsOfrNIhoitqtswqk3C/sBs/IXKah4djlsXX2mrAzpOhBr5ytGtfIpCPDnjomylZR94+lVWKd3GJ75IZMlPGB6g2F/b9KZOtA2KHs0tdX92EXqH3YAWTZn4gB7p6MfyPErqa7GRsXf4Qduu4edQpdd4X9E86wm7TO2MmHvav6knyaddUsmUSHHmGPDId85HCYZymbyLxtFPigGFOo2bFCtYJre4d1iTcHjS5UvfBb2yS6hbATFdPpMr4KKGFvEdk3jYEpLD49zBBVhlznG2Ji48YmPiYkZA3/urD/bmhgQ3Prws62L+znGaom3ybs8foyPKMbUhQ71HL3U8xB0TlJfZOwnxUpN3q5FHaEUWPkN4MrG8KeL8vtYG5NePlhRsr+ja2E3ei6G2xUnd6SDWHfdHCSZHC2VtjbEf2SvM3Nws5m7p6LmkRVp3V3d5jUXE3BromT1XH3qrDOMFgthTT8+FEIM+b6hR1y/pqwQ/llrd11fgzGAUv8SwVXc4+wI/sC/2ZQcvUB+TCVtB8/Y6wr7Co1o3aWUZ9hHSd1JewGl9/me4Q90sZejMapHSjs/QK6OSylaclzstuopMOtvcKODR4zFgrr2Dsm1lb1b5+wQ++xigy42CVtJE4+HWRJJGPyMQTaR2X157RnrSh5JE3mMKJ5hL0bCvt/lci28T90ioNOV/d1DCyxf4lfnhA7foAPsnYsC+TFlK87yo7b4qxm2OHrUPZPOMNu0jpjJz9HDKDAXmCcC6KOR9iZY9ModGfF3dRikGwFOixR/N4jMne8w7pEpqy0E4kwzD5RWQp71bmEvYNLYD6K6Gcmmallhv0XUy6QzBHtsZCQYD5XYTdqL5ufgbAbXCv62mZhBzdCgnWNnRYtx61bZB5GDff8pXLP0KLdytkGYUc5vp7nS11XrJF6ZpXaNUOdmJq7ZjofCmHXCiaVIsZ5Fvuwo/d0R/ZiUQxo9+VdXstebvVvEfbbpkjzWUc6KwRGYrBtd+8yl7U9zU3CDuV+MjTjYTqH184mTKryBHYOzeVN+DvAPjIphiZ6uKZ7l7p/hHvzpihlQ9J9wg7vnu4Ya4Ud3w3wCis/8pWTC74ymjwj83TPf+oeYVe3gY3Xp7pcZJYSfWJlZerJGW7ODe88J5nufDjnQhPNx3XxNm4YIjjSNpSiU+KC/WVhR4g9exhvZAnCHpCJ4d1MSx7XqzK7nvvN2D00qRvxCztMmpaavmdRpp3S9PhNru0XdrSpuM8wr02JiH6SJSLT5sKOEHs32i+QWdB8wv5Lgyh3eCw4rQUIe+Sged6hzG3zIK+F/BeIbB1k2HFwEgcZdvnQqWdbx5e67rN19U/w91LsnsdOg/eJ+VqiCuxeY//h06+wBxr768J+nMmMGKdGVFwr7DZRjwlOXpTY0VHDi5Zpxr3DuijaY9GOc4c5CLvFgEV07FyiQ3Smrnu+FPZzLMA5EyuEhKzhMxX2z7DC3sxSafetwr7bMolMExG5ZUpGUMUSZ0WS3eXNwv7LcLkUOpCSUdvPsC46xd8Q9v2yMxbCrg/cXmduM6eSLSu9bxH2UpT37xp8BYs4xQtNka8QMI8ZUjox1dyRzU3Cri+4FY/H8G4YutOaYYguhFw0VS0cOy8KFswJyAjrVj1iJJZ6RKwGdi7EmUktVkCV1TvoDRb2FFI1SJyvrgzDfuS96PQJu76QY7Ei9nOU8JVVLz6ju9nNBG/NmHi5vFCAsJ9m5b9fpE/ARUt9PfIJe7xLisy5T9iFfcOTA4Ud3bhUpiqr5mhhA0afsOMd4hKuAXZg88FitF0KFPYzeWOVnmbs20Lzo+1O4vjipik2Wc+S6vQJe61Ailg6QNj3SJHQQv4LRLbM69s6QtmVrytWAjErJyfBr2WV/SMeOEWtfp2tQ9eBf1dHgePrn/BDp9I8EszL68IOItc39ivCniLKMkmMTMYGFdARHTmm8A3rwuZRWS8xgRL2YwaOkWLHJbJEVZCGmkPYsUC7CkyyWUjIOj7PDLtRe7X5KWbYO6Z5pq0HRu+eqqS3Y9KU0o7kG826KYVdkJQbP9roHZplV9gLZma0zKfDilED52TaEWepg7Kp9ovsD8VL+zRB5TicBV8F0mW6rCFxIHvxSCowToumI+xaTfYeuI+kDnlzjbC3rpPwuEZO+dTK3uASu9RjEPZlc2edsENdFQYeMeWG+rwDFx7DZ2dJ1+c5aAK1j8xCV5LsJmSMJ2epxQ4q3Rg0QWRmVdjdbc9n46Wwj33Cjuq4erVcOek+QIq9273CjhscL/1cjuZM1adO4jvIs3p21v0tmDEsMpdCP01qPi4S0rKLrmOPBvZmYY9VhbDDtpWw87x4lszsTZoqgfVodu3sR3MhB8eIU77WHGGvvhT2XoWooKtPc1EhgZ3Yd4Qdw136lzH8GUKJvbinATXXIpIHoyolDxL2zGrCPRT2/yqRbaOEPTDDHlhiX59hh3H/3XNO3c3YfXzl2dhR7DUpga+7wq4SMZ90JIaTZB42CPtO1cLMV4R9DxYN6kLCleOwnlvSDxjWJfqFMQh7mgmUsI8YiGM8LmGSi7UUdotcTBYS8n78ws6xjHCXGB+i5LxO2I9ydBnR/gJG7eC3k4ixtvusedxjb1wqesqX0oM7a6fN2mpXv7mfetHb907c2BucYbfriUQ5Rn+ZU20z+sPTAzNUI/n09LByW0bSbb55qbezlZWNFO7ZnbraMtjTg/H6hZ7WXSg1ajauax/0+VhKxNKH/XX70Zz8dhRRLf2seRp983WTe78dxJm2mb0sZc+Nl5e9vt7V/gKGFvIfJbJ1XGHnxu5GYjwVdqHHnqNOESl/mYn52w+dAsx2K/YOzvU8u8S82IddAF93S+w/fsrCfsu8vC7suzHi2FbhpbAfrgp73vXyIlGc5WyQYUdEXSbxD1sv7GcM9InKrwp7LhT2kPezWdhzobD7QcW5GCzsCdOM/3/NoEDvJ3wG8E/27u2niSCMArh3Rfvo246DD05C+7BovKQQAoYnk5abRJESCkgiYML//2r37H7M7swsKuu2u3h+2hq1lPp2/HLmmyb7uIMbT2fm5e6aiVf3t3ZH5+OXEdFMtsQgr3f+YA87EntgD3uWrysr7HIv2cOOz4HAnglWYp40vMN+ogLKAzva46sXC/jyfGC/zAf2ntTO0V1RForvsH1w8MJ5WXlgP1AwMOY0+xbdQjVeAvsbY3hrEv0TUQD3sP+t48Hxf/dvZmC/xfTS14uFV+c/0G+fHSykSW3wqCjNZg97fktMccL+IGMr7KFzp5LVnecbZnU8u30YrxEjS2ImnzG4h73hlZhQXr8+sC9jLYtSGtn7QLL1hg3s+CXW+OMx1qNbcfrVGKnvOi8rD+woziCPf8K3wLebx59tb24OrwL70lXdfX/zuyIqwcBOYQzsVA4rGiE+6UWz9fLwaH+tu7z8bRQRzSKwuzedyoDdJnanEoO07pAqS4W0Dmlc92P7Pf/iJHDvTWrFHvZgXr8+sEsCf4N+ynl2bvTYFAL7Nym7bGAoLtAy/6kU1rjEzsvKA3u2o3ExNmY7+xaf0xSP4I/AjpeMjeniHZaSw7REYQzsFMbATuWwI3ElieurnxYiombSdZMOO/L6hFRi4CH4E/ZQaJfOOVRc6uhX2DFi9/fEoMKOyC5bHQtrHTFgf97IwH6iwlaMC3kYusas93qDHWPMSk/1Y2P2R+OlGIEd8/etYU9tJ7crve8N1oyJeypnZCavP3530UWZ3XlZeWA3e4vbRzG+BoEdH/HtRe/ihzFxHw36zbOPeIfl4fzxZcw97HQNBnYKYmCn31Hz435E1Fi6bgjsz9KLTnOdmEfg33Sajdjv4gnsWsc78lRNNlr3KzG2E+NU2IuVGCT2hq91PNpSJfaM6+2CAuRnwF5bpU5NageBPd3TsoUJeCr+oAouTabbV87LygN7bAC3LMm51tjO/vEVmPzrVZP5qYhKMLBTGAM7EbWbrhsCuy2xI6/7lRhwBuzI0G4lpvKEXR7e1UluhR3QYfcq7M2/OKmc3lsxefHpSGUkoq+NlxDY+/htfDJIk/NoNbuXdHEtDfpj5bjo4i/2e0q5LzvNdky+lvuPlrPAjnm+iffxv4bY7OAzbsT4HLsqsR6nVZ2Fdfzp8pEiugEGdmJgJ6LW0nWzgV0aMe6EPUvsdsKOtO4dOpXqeqVl7PhieZRP2CWxPxCFxC4d9gZP2G+q9/7sYzIeP/yCc58vBmeLKmQ0HKmQd7vDUd9/WRgC+6LSB8Oxci0OB1p55j8cHCqiKhjYiYGdiNpH104OnXYSctPpI7slxgZ2sLcm+fcmIbf/E1KJwXNoxA7JZwrcdDr3+GrA3rllgX3KENiJpisq8YqBnRjYiaihdM2ci5Mm3C0xWYX9gbskBiNvG9XBnhatftMp0npZh10ie3DALjedPrl9E/apYmCnWWC0JiKi1tG1w6HT4h72Of+mUzthz7fYhUzD7Tb2SmShI57LJ+x2rWP44qRWdtgbhYGdpo6BnYiI2kfXzk7YpcSO0OutdZQ9MUIm7AI7GCtdmgQypQ+M2PGjmNgLeR3cwP6skWsdW4KBnaaOgZ2IiNpH100Ce+dqr6N02N1OTJbX/bWOYG86qhLZ8R6ieOY0eVhpXPduTnose9hv6aHTKdOjUV8RTRMDOxERtY+unb04STrsfiXGvzcpG3fnGzF42ORdhczr5d0BvfngInaJ68U17AzsRG0UERERtYyum90S4x06tRP2/Ijdultgx+t4VBiv40lK7AIFHH/ELondX+uIwN5p6E2nRMTATkREt4WuWSGwP4GrDvtDbw875EbshUIMHtnzjfc75re5e2xaL1Riks+YyFfY59JGzOQnJ+xErRIRERG1jK4ZAvvz3KHTuQk5c1o+YEdc9+86rXzRqZBGfF56zNU7dArFm04fs8NO1FoRERFRy+ja2Q67bcTYxO5fnJTL7G5Yx1PVtC7vcffaTozk9fu5LTEyYp+bSCox3MNO1EIRERFRy+iauRcnIbDPhdY6hraw3/P3xNhayw3jeqES4+519CsxiYfulpikEYO83nnKSgxRu0REREQto+uGSoysdXQPnT5CXE/XOqITkyRlfw87srpM2atP2AHvVt6IuReoxAAaMUli7/CmU6I2ioiIiFpG1w4T9uJNp5LX3XuTwNsSI+5UL7HLgF12xLgjdijO2JHWnUoM97ATtVdERETUMrpmxZtOO/bQKfj3Jtmbk/AzZfvm0j+vOGHP3gc/ys+cIrB7A3ZZ64jEzsD+i727a20iiMI43sRE48s32HG8GrC9CEpUNCwWeqOiaEF8I2iLgvp5/MRmT/c4OTMbBdeFHfz/tGnqUtvLh8MzZ4DSVAAAFMYPTQK7rcRcEemWGDHdt4c9WcEub3oudhTJhH2SrmHXQ6ca2bnpFChcBQBAYfzQJLBflwl7DOzpmVORV9jjTadKsnaPRozdw36QnzntXuuYLWK/Knl9wYQdKE4FAEBh/ODihH0hutc6yqFTMRVtKybSfH3QnwZ2uydmml2cpCN2+SW1wh63xNxoJuxcnAQUpgIAoDB+YObipKbCvmg77FKJaSWdmEvx4qSWRuudsN1vxq5vRdqIEXbCbi9OalCJAcpUAQBQGD8w3RIjcb29OSkdsItswG4vOtWLjnTNS0+T+EdN5SNO2HXELnk9Hjs1HfYbTNiB0lQAABTGD00C+1a86XRnD3tD97ALCct5I0bEnYw9Suz67bFjE9kKu0gr7FdEuyXmBltigPJUAAAUxg9NAruO2Bty0anZ69g5Yp/IR1JilxfRO7WnHfb2lKuQXk5Dfi1d6zhPKzF02IECVQAAFMYPTAK7Vth1DbudsGsnRkxVltbFgejXYk+OnXbvibETdmESOxN2oFAVAACF8QOzE/a0wy6RXfO62inETHfyukRtLcb0PnCqlzFF9sRpEthnZg+75nUJ7NcJ7EBJKgAACuMHZm46zTvsYpaP2Ls77JK4+95zGpexZ6bJYseZWRNzOQZ2bcRQiQGKUwEAUBg/OL04Sdc6mkrM5d2ljjN71alUym0npvehUyHfHSf2rfbnJVtiZA+7iIn96k4l5hqBHShLBQBAYfzAki0x+R72WbqHXRJ7xx72Nl/3Zna579nD3vweYtaad1ViFv9vh/3s8PDUAUWqAAAojB+YHjrd+rUlJjl02rok9i1i16xuXv86q8trUofJGjE6YJcKe7aHvdgtMbfvbzabO7ddL89COHdAkSoAAArjB5ZtiVnEDvs8TeymEiNh3dIqS4+0LnQ/pHzOR+z5HvYkr5e8h/38ODRWH93fI7CjZBUAAIXxAzOBfbGllRhxUYnJJ+zKhPXYiem71DGvsOuMXe3cdCq6E3uJE/YP4cJnt8dt7/70KAns/qHbde+eA0asAgCgMH5gEtiTvN59b5KYtiP2ibyIuNbxQF/6aUfrv98SY/K6bnU0JXYZsI91wv5sbx5fhguHD1rmfz5/2Txfvj917l1df3Pibn1sH32tt2/X9Uvn3OnJuvnX1Wvn3FFdb/zJ4/DKASNWAQBQGD80CexxxG6XxIj0olPV9srTKXv/Cbt86MHTLK7nm9hNhf1ynLCPeA/7Mrx13UJqfRYfbkJrfcu9DmHlGkchHNtHx+07534sQ+u5c6chvDsMgcCOcasAACiMH5wGdl0Sk03Y510V9omtsUu+tvtdeqxh18guzFpHlW2JmdlKzKJJ7COesC/DvsQeMusj17q3DGH1+c2z7aenzq1DkCevmq/Mo0df6xBefv3smuhef3nx9PH2Swnsy+3fx88dMGIVAACF8QPLOuxaYddTpzuBXWS3JqmDNrf/E1qJkdfORozSBru9OUkH7DfGG9j3JPaQe+6ETNFP3NZ5CO+dO5HY7twqhKPkkXbYH8rwXZL+WgJ7CI8cMG4VAACF8YPLbzrVTsxczOZaiTFLYiQ/a1RX8bRo/5tOTVrPSzFmwJ5VYqQTM+I97MvQndh/H9hf1PV35yR5P3Hu40Un5qZ8YR9pYP9U12eusQ5LeRbOHDByFfCTvXtZjSKIwjhujxmNzrzBNL2RAhOlUbyMDuJINgredcAbGlTwBr6Mj+HStUsfzK6TPqk+U51ZpG3okv/PsRXbkCw/Dl+dAoDEFL2TQ6fetgh5XRO75vWowx4q7DoND9vYu9GFjmsd9pYJuxZivDqwVw7XOg51S0zpvMt5ZGNgF8XXb4uDVH7buSLP9527vvbKbom5eufe0tWBfZEDQzcDACAxRc9aKzFeVGFXIa9HjRjtn3c/daorIo+8O+kwr9edmK14reN08IHdXc0jGwP7+cdXSudJKr8nnZinrjSvbGC//2jhKhrYH+bA0M0AAEhM0TetxEwnmtelwy6BvWVLzCisdcyMcNNRl8hu2zSZYfew15oD9rHEdbMlZjrowP49j2wM7Ls7rrK4sudTeb0e5qpzn8wrE9hfyr8uX+3Ugf1yDgzdDACAxBS9C3vYNbHbwL51IBqw+082Mo0YzeqdSzFZXa4xFXnpzZstMW172OtKzJkQ2CdDDezv88imwC7x+/bX8/Lld/PKXeeKZxLN7SsN7L4uUz7zq2SWdWDfy4GhmwEAkJiid1qJ0YuTTptKjE3stsNuNcbrWZcDp/Vj7aLTkfwe+Y/txIixCHm9MvwJe1te3xzYF66US0sLGaPL1pibD91O/EoD+yPnnufeDoEdyZgBAJCYonftHfZTdkuML4srbbDbNezhwKnee3QsZpt7Ztk17HbCLnxeF81KzEAvTmrP65sDux4avaxl9NItS/cheiWB/VIua9jlB3vgCOxIxgwAgMQUfdPAPq00OuwVs4dd4nEYsJu43v2i01gWJ3b5jvGAXUhcD4E9gZtO3+ftbrnIJX2349ze7u79p865W7t55ZWrPIleyXnUR5/v+Pj+9O2NS/LffhDYkYYZAACJKXoXOuzb0ZYYu4e9fa2jkqG4PLpvdNSPdmJUqMTYi5Maex21EaMj9mFO2Pcf50d44dZdOa/vPrgDpW/U5JUvzrll26trrrLIn7uaP5L6hsCOJMwAAEhM0TsJ7H7ELnG9ceh0HAJ7WBJjOux2xq4xOzyOIQuhPcrrjQL7KBw6FZrXQ2IfdiXmaMULO2MvP74OLz86b/nuZh3Y/Tx+v/XVXiklmWelJPf7r+vA/j0Hhm4GAEBiit7ZLTFn4g67XRLTvofdR+yw17GTTDsxrY2YrKXEbjsxSdx0CoDADgD4XxR9C4dOt4VpxEhm37KHTjWumxH7icyeNc06pfXD5G9Du3zPaK+jNmK0EuOdkb2O0+3pZKCVGAAEdgDA/6LomVZippODAXvYEuPn1XVct5WYk41N7EKDtemfH1sI/vLHkWdOdcYuNK5rXg+L2P2h09X8HAAAAJCo1bzeErM9bXTYPdNhF7bDbtgV7F0ye8jqcYk9TNi1EmPWOnqNCbs3OUtgBwAAQMrm8ws+r3tSYW9M2MfCTNg1sUt6DmFd6FxcPt2uTtK/ZYGtxNQTdm2w2xG7VtgPSuwTAjsAAAAStlrZtY4S17US0+jEqMaA3R47rfcwdmUvTjKdGNNgV5LXt6IOuzf1JpMLcwI7AAAAkjWf14Fd4rqQwG7XxMSdmGZe12jdCNvdZuwa29eNguaEXfN69Tl9am1NDB12AAAAJC1UYjbcmyR1cRFtddQyjD687J+M2OW54apT0Syxm1On4eIkJuwAAABI2Gp9wq6VGDNg17geZHFkb5wZ7RTUNf7H9ybFcd3k9RDYtRQz8YdO56tzAAAAQKLmKxPY6xK7GG/osGdRZNegrbqndm3bBOGmU83rdWS3i9j1qlNvwqFTDMbvn7/OAQAAHGPCHjdivLoRM9YlMdGIXdg9MaJji12e8stO2FuPnWpe3wpXnVZ0wk4lBoPy5+JFEjsAAPjL3rnsyGoDYTiKkki5vAXL1MobXiSPwfNY8sKy5KVhxYoFFiyQeK00P1RMBc7gGdKJIvGfOTN9s40vXfV1dWG+kMOOAHtKieEU9rOUmLSrI+g58TpAm//ePuF0q1JKnHB6EmL/SezDzryevUtMb3Scav3w1Lm6UDeu+O/UGV1HbYb8Y2iirYfijZp1PcXR9PklGiKyrnj06NGjR4/uqAxjjGMYikf/R3Xankh3GSkxAHZoDbDvQuyQDLGnnBgZXccP/t+D9quUGI6w46D228Rgkxjo0ykx/aholTXFXWn9UdZ80BnvsLrSX2m51eGjudb6y7QYp+Ab3PovgLMPPD3Ta/AG2+zXfdP0Z0Wq5dUF6+MCkNM2fAK+J1qlxq6QcrMZThvw9JI57WDbPN8DPXr06D8QXEN5bYWbnZFyH1isVk+Vj8Gd+sbhUOWF3TxW0e6bSro8fj356n1RnK5pM4I3Rq8K7U1HOtS0Kc5HB4TahW85HePOzPn96z/BIXtlNxGW+YnNHYIpudHATv6+5HK9wIn8lTwSkTr8ozE3wv7bySYx5xkx4HUAtMyJ2cH2HYH68cMVo6ldSswhh30XY+cU9vWk08x92GdPSaPLe8N8y0L0DGXnIrrCQlQxfASL+hsNRPIfB3i7rxojKosQYS69PTZ+b8A+NT1Kz5506hNI3s/HhU0vVQXruoCLRJR7hE5Tkqysj99aRWF99fGJwaNnpnj06NGjf12GyFwZ4QoW1VxarM6zqQ4X3o+rFHbz0vQSxXSvpiR3gYO0aSreoDWkZC/h1BPrIw4Iur2aMUVJRgzQiMdsKWbq3DeNZDMJ3KLOTPieaC+dSfncI999hmCc+KxpCMpaSvkDflyurAaPeUFrnUXzV58tFJ1KZe3DzgH2n1//5IVOV0li3/h5j+sbX/+DF046XuhUXusU4gB74vXXz89iI/bf//jjciZIKLpMG/c2YNcM3nlc/n5gd8p0cVzeVVVrVP9Vp/BF0q9gZkcdKzYBh/fnfAHslwVc/IxxqUmo3dVT4YMzkT2J+Z/b6T+SZXv06NGjG3oTsJs9ZrbCYh25S9mx9nRWJ8qfVdkraTfzgb1iucsOTOO4sGRd/OOqt6On4RLYccCKOftc1dUxBhLSkpYJg9kL33LmmwaVBezzDsDjkFFgxHzQNjcmz8sTkR/HiJhWNsEAtxoxywqN5vnT/AGXy5WlMaCSAEpeyfHj+ugburzS6ck27JC8bJK8bhL4WQioLX5/ldUXpaC9PPFUnHO6hP4lsXNGjEiJudzWsfNkQ+QAribS7wT2EMqM5RPeAOxdCO6GRffLcevXuvbNvwrsiNhMsBPOVMI+OYWxDkT+AtivCrj4GWgOJFWV+y+6bF+U/rgINL+4K6QsYh6tWqzRo0ePHuXr/cDOhrNZoaUD+JkVzfuzF9ZcJ5UfALuosogwgqXHY58C9j4XyWhgnsKN25K0WQ2IbftLYK84Dk7qy/w4k9B+0Bp46rLGNEjfIn3T0NTM7pmkCqm2yJRC5bmK2xJ0lijkE8wR2E06ancf2M/fAWna1SxxAh+YtEOU0bwB2MtSAjvzuoiwy8smQTIdBuJUlhu0LgLspwnsDOycFANtu8RAcpeYrJNOa3x70jZDOZtuWQA03wb2W5qJ3A1gf4uqFWUbZbQww/kKXwT2cf+lRyOo2hCFbQaHLGCXBSSv5xP7gLoNoioBwfa4GycF03IwhZ0i386zPrTQEU04tifE/ujRoxt6G7AHorD9NYsR1pufqk+stU5l9AfALqp0RHbDIv8WYO+Ij7VBu/+sIlG5/e3zgB1gV36RH50nkqr63QR0a0Ne+hbpm8A5WcDekJQa3gLsFU98f5G0lAHskBUcdxfY5XLdVG9N6N0xdERxA5D6XcCObdgTsItd2H88htiRD4P/Sbvw+N1NHWUKu2T2pC3EzkKE/STE/usvlykxpUx36kmMdGMVkYoDbsZi9ET+NWHGVkTWBpk8ZhVVuttmtJ0q8vWMZ7QnUhYPW4u5Ncuzo7O2LDprO4Oi/PbHlLvgFVFVu+UR27axoir2RaGtWpqeBeLHitQ0b8DuRk9qCmvv6oqownkps7U9DsYqsma2k+hSFrDLtamt7qLHIWpL5NcWh1gtnW12HZcDhjIRz0927kavPnxDqh2vD15AdSRyeFi4BieBHfdPC0hezyf2kfDJ2tWkWtxL+N8RjWyOD4XsZv7Kv1uC9i8D9+jRo0c3dBvYkz8S1sttuDwud/pEn0IuxY0B3+wIKxsY2E+rbIlMIvA3AHtL7NVdpV4mOthYLn5oMtLPby7Mk/JIQhbuqjBW8RPG2jQ+liyPY5sL7IGogYP2pOyItkYbFk9qLZGyVnLDaG0rGFpIQGRqSPgW6Zv66iUB7LkfDmLh8oG9YVLprDXudSdYRb7GpAlGSlHqSVk4/tov+FNirOvCTEqDYEQlg13oxdZyISdSSTAkZ1k2MPGAn+q4XNO0V4c12RLN/AnkHSkxL2D/jVPY+UqnEEfYz/eI2eP6d+mqSfh1S2B1/JP6Hj9M68ccdt4mRgL7rxkpMUGmJTm//9JD7z5WBlITQYEfH09OtqmIzK5ku1vzmk0WJ0FbomFhy5Ggiad/xmpY5bH2twKV48cb0QVu2oNqU22D4sPgDLDectNKdCkT2A2lXMGJ/Fp9jKl/LW0youNpwBq1HwzjPzzPQn6z6nwqylEEaG/EtZrKHbDPNiXRyQKS1/OJvecENTe2HG/XyZQ2vHA6GZVPwF4fLQG//R89evTohm4Du/RHjIEVP6eLyFRhD3jRytCJg31bZXsB7LJKkC5j1juA3cFlioKKoFr6eYxGClsLd1VzV9YScedXanbEQx6wo4J219aA8ax3rkhyg91NUaSDbCE90EBUS99y5puma2Cf6aCyG10usJdEkRstHVGVuisYqfDopjxzDZpxTp8hIg2CEZXMBHm5kHmGnYAhMcuigQxUlst1U8XDJ4/Abd2froDdnMHOdYT9N+wSk3gdyA5aP7vQKbTH9bRLzP0IOxfmm5LXD+eccoydeV3kxCAl5rfrlJgIDJaD1u5y03TbRiK9YrE3bb0Q5qAnIq1bmYpsTavBqqjFr/f+WApO7RAUppIoYOVUodWKNmAntd7DMg7k8ZtsmBuPFasW1m2CXwob7UlpXcr31NiaaVu5Hvcs3ikT0TjPI5FnYMdhNggSiy5lAnukWpzeEpumQoLIHNZK1HKks4YJ2XX8rwHr0NlQYZRgNe34UcOhrkOC8Roa+KBoku8cjBvOkGdgnxUs9VkByev5xD6LkEYf2R4Ii20wb0kRk4PHD8+oFBt59OjRoxu6DezSH0mNi2/UKcKOG8evC+UjpNvgiSYB7LLKeRdhN58D9rJflbFziR8blwqSXzsZ/ubnh9XZWhzx3l2VRN4MBnn2DOxSnigzhx0nAvQY67ox08oglhSRj0ETWa0FNwhgpxNx/+H+mxGTJ3yL9E3ZwG5ICnRUxT4P2HHcjmNljjC06G4hGQnrpKpNv0sZj8ZEQIWGM59aEIyoxOmRKGpzXMjzAYbELIsGeMBzhOV6jLBXJ1/pjDeA/SLCzrx+fs7pDyIjZuVmGWTnKyfdTWJnTsfNg76XO7EzridiR4gdvJ5C7JcpMZjMnYbdSMI0MejxuQU1UXfMYW9Xi4SYtuGvA/FBl9MjYJRWk6Wo6vEsA3u3S7D2IMZpXQMdVpdaobMniiJVXWZr1ThAfNXG+XQVeY7irsA+oAo0pmSXMoAdBYI4vWLtherXRvrljmEMFR3nAZvWphyOjHCGzJelKMrIOW6C2DdgB69TfVpA8nqF3yqD2BuCxE5ZVXJPHb+olauD2EjJ9YaJhsYH2B89enRT94Fd+iNp+jyeqNmoSecqI94MXuXyd3VS51UCeTwnpIavbet4FWKfCPJjx77SreegKif9PF+P2hM54a7C+oRD97umOfs4U18Cu2pfanRFZNFWk1L/LZFqU0q1cJ9D2u+7oxMNIkUAD0jfIn1TNrA3J01hBPKAnZdWucyro9TdIBgJj0FVPe9PgKiXEnpbFSAYWckxh93WL0WPVwkYErMsGrjOYZfLlVWnI1F/B2us+7cAe7pu0iGFnYl9Q3Z51aQkzjYX6H0/L4ahnWld4jq0v9Ipn3UqdmLPiLBXIG0J7IE5a9RbEoRNk48sJQHs4jzGkcjgNdvDCh/G+6Vg260mq+G5ipwSg3vr33ldVmHES+YN2D3nyh2B3e1yaTy/BitZLyYguNfttl2BPaF5RUp26RrYO2PRE9a0LdPt7WuWqv9k7+xxXLehKIw0+QGygrQqo0qNNjLL4HoEqDAIqJRUqWIhQSoEqMqeEh7pDHVCv2c6hicJoIPE8zwe808076fry8tyWeze0iKTjnPA2Nnadz0K6H4d2I8stDshbwXZ+sk3JPgcCneORrIxsPdRZtrPv+8vYL906dJ/RALsYo+iRFfb7hxeRlvnsnzLJiGKG1SJZYLjoUgskKvLNvMmYOdGL2jhfkFGpqidpzndpqkUc7UdGbfnwT9GGldE0STnYS9KX9ctxPvTi05+FPOphBJrkxsTeMK+A+x9MrCXUU3GwtGYBuwMDan8xLDSXWGkv+SWJgRPNQdbjNPUYyCY1lELiYGdwq8FhuQqSwWJwM7pqr5dOy5x+vQe8/g9wI407L9qVkfPvyELuyaJCdtONSzm5Bt/+aRT0PrdOPa7edhDXsdw1OkvHtdTgN1/zGSsdSTntrvlDPAY8RsGn53S3/f8bODlGgEtkP/iC3O+Oc72PyLgx0CtJesr8oVbTqGhQjZbAHvHDxiBneFbhZ0/58bNv1DkxQ3ysxwT+LYMnO5sJlzg2qVHwD75xZG8Dq0H9aKJIUuqq5e1wBSWjvsBQ2JYg9YhuRTG9RVgX5Md5nzDI5c83tg99DkwvZXtGERHYC/FiyFuCktgv1kB9isk5tKlS/+WFNjVHun5bsV29rrCBy1ahOS4IDIKUYBdi3QFi3w2hn2YoSTHj6snRJcSEg/Xr9j5j3Mb1Vwh+HNq3TePMmrG5IOTDPZMoi6aY3i5ArCr+dSMN7E+wog0gy0R5aq2RW0TeSKFUVU1ftWnATtjyZt8wrVrWXGhjJRBtl8MErF715o0YQ7ALoXEwN6gTEQbKwwpzUkFScDO6arTHQJOyK0bGvmmGHbN6hi72D0Yax52dbGDrFPDYdLB/U4SdhJ7cLCfYtgjDzuB/eNxzo9BXeX5pgeYfQJ7FgE7J3FAQOufdfJlFXc+LDuwBzQbDmAfwgJp92ckQQL7EgH7QN9uuGHu/Au6E6XfydXU+3QPzVwOYM9Sgd2raW32ANj7JhzZdeo4B6yXWPGEr9aWG9Tzebnebu75kPT0oHfzaDWaP3nd4jo9jmG3GAasJQXnSxzDPl3AfunSpa+WArvaI7WT6xjIJTdVpSsWU59QS9PQ1DHgVzhGigTkFNOGdfMNedglqN7CVBKcOrHzAWcjczVOcrRixGgYrsQYdvV1I2gVDrfAj2o+FYVj2YxvNZYpB9W2PB/Dzozxos5iu2adBOy8I5pRJdCI100ZSU/eGjLpNNzzJAwp5G5aRw7opDCkNMcKUoFdpytV4/6ihyNfb93m7F3AzqyOjGEnrouHHRIPu/rYhdhf3HUqLnYV/esB2elhh0jsBHaExKRkiVmdfkTHMFOKrh3s7ZvA3teQCzk+yuMetKJGpPzHrX2FJSts3q5jYG9zw8B0s9Sb/Saw23oXN+yQoPO8Yc09mlut2CmC6R6aOT0N7AYHEz8A9sGPZtW7yhcvHceAIXcvmzfjnQ+kaatwSW66+qUnfbn/hqqYXJRWJpIeZoq3j1N9J0tMzQ+3kymmwN7Y8zIwXlliLl269ILeCOyMtDAnMrJb6W2IiTfkr5Jam18mq4ddi6TmDS1xbwB22ip65Zn0A8BXiZ0fTmOh5gpGt2t24FM5H5I+Z88C+6bwCcwgP6r5FHV5pDVcvIpu+Epti9omBfZ0H3tlywYhOKnAjl4t6LY9faGQKyPt84STcVFXHm4MSRhSyF1gZ/VGYUhpDhUkArtOV5UdRsQfSGtxDd4D7B+/f0aw/3w42H/CuUkhhl3861FWRwabB9r+x1Lgv3vO6d2YGCI7cF3SxPyl3z/K7LsaTVOZpp2t//ewCOOZIyit+Sawx0sHz5bYq3XDls1DuV8N+hhqiWHXBbLZa3f8DH4D2CluggmpPxt+eLfB/fU/vcAdpntopnkS2BGz/RDY0SM68KXj/vH8mbXDYNOBvZKApefTqj+XuD1lAevhb6mPykqN/9Q87KPJJSTGqxWn1JWH/dKlS+n6amCfTn5lV7VOIgzVsVOeYNeX3AfQJrBLkVBbbSHM4Q3AjsCMU4Ju7uUCxoqdH7mE98YMYq7KYUa/iqhSa/B3ycCuppu/V2BX8yka8kh9psCObohtUduUBuwskzLLnLlbwoFLrJN720xe8doxJFUZiTOQux0Mg8+N8fdTRQB2KeQ+sLOXCkNylaWCBGDndBVtVcsWiz1vyuytwK57ThHDfij41yUiJtpzGpAdDy+JJem+U1QZ8zp3naqDXYC9LB9+R1b1x55e4HpAU96GlfkjYMfzhVFqNfK5cFc4AzEQooYli+dgfuQRsM9YDIKrtn4I7KhxZADXnumKJ7qNnEke/zHd2cw6fxbYlywB2BlyY3E/IB3HgHHFwlCXycB+O919IyWNjvmaeHCpvkFEYE9RWaDkNTx2Z4N15P+5nQA/BnbjThGJGLL2Oun00qVLSfpKYCd8UzzMkTBOEVfcJ8QOWN1IzDWBXYuka4wHkr4F2OvghEaiQe/C4jOndt7njeHfibligMkSWY8KnXsO2Gku3GE7pwjYxXyKwMyUfmOLLvC2RGyL2KZEYKc1Xeu6bevBZmPboL45GdgRLr7XbHnEzeC7K4w0YsNuaDkt9OKfCLBLIXKwfJSHXWFIrrJUkADsMl314HSdhbbgxXhXSMyv2HMaZXUkr8cu9h/woOJ+UzL3K6ecQqT1k1CzArvuOkWiGO46ZZaYRx52HCW09VUdbl3b05wz5R4H3twB9tpZxebFZuUNFwILwpg5JHryiT8tCl+xZOHVdRvrIgb2Ll9ZyWoz6/luUWDHhpmNVfMWfMuwa7/BmmeGLBvMntax6PmB9dMdn9qlLKv8OWBvc2PmFGBfUdLsRyGTjnPAekSMW9xcpHvYG+y8cbtvW3KGtaNbUNY9Ytfi9Q0JwJ6am7YZ5UDTDYH8NX/lCgV2bRlW367ElXbZpUuXLn2h6MgYDjkF9nCOvttlYUPa0a/k4ChxOPvXitpl1hvNboeZm8ssllwBdi1y8osgDrOZHwL7yqbO6cBuDRbmLJtX8FrnDeuYOe83FTtPF+m8eKsl5qrecy6UzZEBrTuzqTv0HLD3MN0wKE6AvZmdms/1zHdzEeWIoVbfSHSisGpb1DalA3uVT8NBSrNPSJ9jSJ4A9o4eeYtEbDzuWxjJdxahqG6BoZyxTcxV6IYCuxZifQ/H+yedOoEhucpSAQf8e9LpOqOM0c91a6vjkErOnt7tGt+TJSY42H+5z+t6ahKhPcJ1UvaLiR1RCh7wXxQUExM7dN50ypgYBLE/jGHHqblD6T6prdLjbor9fyN0i0fdtzDgDxlwPRo8w33jjJ/+oT+WrJEJjP4O7LYgOZtQ9aTAzpAMbSbEI5d2tQdaoih3APtWsOongH3Me7t0CcCOyjkQ87njHLDQ2DkN2Dmot+nGXsXkvEVeAaXi+A0JwJ66c97Mahig9cTw1NR1TU6VIRMBdDnYL1269PVSD0R7D9jN6fVTSMZAYBf3F5Zsun3HhhZhU2DXIl0R/v0A2INWAnvy16JmN8mARRpop3ae/mvYTDFXFl1BTLkenOTyIJcG7NQUxoDAzizAyg1M+UjQF4VXCB54k9oWtU3pwF66nW8mI7YrHdg/2EIrkarCSH5wMbo0zksI9hFg10JQTXzSKUOTBYbkKksFHPDvSafrjCLIAZhD+B0qoaZHYLN2nWpNSutIYP8pZHU8FBzsEhJDfpaAmFT3eno0O0vXpI4U87AHB7sGsf+8E3sKsMMt3pHaqui0haLe/EAq3eKCL1oKVqkBE4VZXiaHfYz5/tK+ZOFV4zM7DX69cacFssY8CDvEmxmbLI0Au71xraSqAjR8xMoMBpNoD6nZCXEtscz6xri18OleltykA7vL56yNgH2KgH3k52DxvuxNOs4Bw15t3OsnAnvluvxThS7ovUH5xG8hdhae9gYC+/MW7iYTbJyOAZDVXKR4zktd1NmlS5cufbUU2J0Au1AyyXJoTqsoTuI8aTG6Ui/7eu+Y1Ph+kR8wtabN3gDsEK1IsYzw+pq6QBk2UzuPFtNmqrnC2o5Gqoe9fw7YRXUwSAD2YBGEG+hhp7YmVGmGuJ9osNoWtU3pwE6N9TI15oYQgmRgZ8wLr12LkcbmTWWkzDKHyzSHgUHfCewgmKiQuoiBnUedCgzJVZYKOOBJ047A3uyTgxG7/F2TCuyoPZZ57GH/mUliQOy7g/1H7DklrquLXbedgqzpFH+R1lkGHvEvEdJJEtfjPDEMidEg9t//KG32SLa/HcDezZloHPrR/8DjI2GPZ1DZb5bFbP3mMpF1BGbZxjCc3o7SZjw+kutn2brcl5+vDL4ZImf5WU3V0izFkCXJbqjb4pEdV439MCbX3GanXJFLGZU13B8fWzVc/JPeYA0sQKpmrDXMdKmaeyB8GrBzzK5wmEuXLv1P5E6r6FpE63vbl2qc0gzHmL1Tdq7bessgZImZ2a7IzjvYzNhc2bkf2LPXxapZl0i4IZarTA6Zqoyojq2nbVHb9KK2Ttx7SejekXprjrQyEp+0NYaaA8MnlBaSIIEhvcqs4EWVOrfTVT3Ggli2/OMIidEQdjk3icgenZpEkbJf8a7zzfyB8qJTk0JUTBQR44H9XhD777+VKcBrR/z4Imwq8irjgcdfK+a5LeEgSJbtqzn7F2U/+mqBFXibtqWrnlnMXN0uVZtwNzUs3R1VY3bpT/bOJTdxMAjCGsmjDKBAzMuvTRbZ+QA+AFfw2UbKylKWDqusvEAii9nmTvN3Mz0/NViKRraIndSHH4GWICCESuXq/gkhI2fvrMTR8Tz+GbrVvn59rUV7Xpvjz/o/r98cvdbugD3Jp7gW7SaEtvBYvaOD0lzkukViTLBjJEbAuY6o2f3cdD30gD5n+xx2cNiFi0yMMHGcHPZ4Vw5PGrnLSnUll7Wu/t2r9FJSdRqLQwghhHRwn5wcGx2fQLCPg8P+UbIxFOy9cCh2MSybZHrdbUF7hF1zKTiG3etrcMu7TWO3yTMefWl02ANoOoXFTs1iT7LCJUAGhnV+SgbjytRscSSEENIL9fAMMQr2waD5/iMFey9UTZklPsNuU9hbDXYxtSEUA6LdcudyVrrq9Uu5LrsX7Jhhx0Hs3mJ3722Rp8XwflGKZxl/9fQR37yXX9Il7XpSCCGEkC9H/TTCHM8YebHuUJ2WIS2eXbAn+aIcmjRfiMM+0VWTFE2wa88pLHQK65y6A1rsDvDYe2k9lRsAc2LQYveZGEH0ulns60Fa7IQQQgghhLxP1RRZMj0F2AWYwo4GO45hb1kySf4wud1nz6kcWvX6vxZ7gBa7ezd/MjGL+L5oDpTshBBCCCFkZFSHpriPxWBXh/1GsRExsG6SinankX2CXTZU7T1OYFe1bgd02OUfgEhMAHodBLt7TyrYZ1H8UDZOslOzE0IIIYSQ0VCJXC8e4sgS7A5NsN+YYIehjjjWEZtOMRjTg2jHqY5ybPPYYUyMRWLO207NYf8xjeIsLYqilF220iFnwR5mnXXWWWedddZZZ531odXTLI6mItet4xQjMRZhF2BIzMVYRx8778dfPwvEX8h12VtD7CDXhYlfPClM8myXvp19DOXpVsJHwjrrrLPOOuuss8466wOpl2/pLsuTUBdNwmWTwGEXOYx6vd1hV33d2WH/ZrtsLQ67vjKG2AO3gcUOgv1ksTvJvgqTOCeEEEIIIWRExEm4mqleR4fdR9i/W4JdOVfrZrFjiN1iMT057dbRCoBiVwIc7Ohj7BJiN4t9NptNlfV6JWw2mztlfjefz2/nt8pCtoUS/mUZLoHtcusOSrTVe+5s9+Vgd6PI1d1JH2KdddZZZ5313+ydy1YbMRBEs4CA8YHBL/7/U9NdUqmnomE1rIYqZGnMPeSAvbnutNvm5uYH5F9pg3Enjhba4pW55Fdl6UnzRD6Qz57H4xa5Z94i53P6Ot5yirC+Hms1I2bqYQ9jnvrX4etx/tBMR+5q63OFXabEaE8MwhJ7Gfs9Al+nsX/0vPcslctyqbTH+r+sn5hydyYpY25ubm5ubm5uflCeJ5am+SMOJvxypNs6fJ3C/ojc0tip65E0WS2wSwc7sj3TMTYJNZsXO4199RqgbJ1H9/Uqsbca+zOTvh5rDIqJP5G+TmN/3Gjss7KzxC5V9rxpvsYOXW837PWs4QIb75qbm5ubm5ubmx+Ew/wY3FVdp6uPiK7T2DNppBB2JHz9dn8LY4ey09dV2Cm+T8jcEqMdMX+wxeLXjwxjr9mO4uw6iR3Z/rDTv83XtcR+zj/8Porsn0zz9Sqyx2pdMa3IPrXH5AlR18i3zM3Nzc3Nzc3NfyVvms5bbiyuY1veY42khEZg67nQEFO6Hr7ejf0EYT8NX48FXUeGrw9j3xzCjq2yv389j7mHHcKuXTH4FXVOzPy209fzqikmXrQ8eht7rI+RrutLLuSSqz/EDIQ9NxyxSuGngPM0Nzc3Nzc3Nzc/NKcfti1XBWaJpG6uumG0IyYUNVw1ErbOjhgZETN3xMCE6esj04iYWMOvY+2vrY9jmsMuk9gZ6WKXD096ZYVd33c6dcWwxs7Q2i8L9o1c246j/tcj73//XJqbm5ubm5ubmx+K59WQwrxh1ywMbb2q65R16nrLPY1VO9jL2PGpSVlhRyDsIyXr81RHOjb3Xe3r4+z/7lRfx16+rnNi8MtzTMzLuinmPJSdPTFq7Ei3dWw9l2qP0XL79coD21B3nLy8mpubm5ubm5ub/wY+yXr549rYK13XWV5v4YSYamBvHTE607Eq7Ah9PRZb2DV067gSW98p7QhfELC+jr1CX5cSO7vY5bOTxmjHmhTDphgIO/vY40Znx7ZUoOnYv8tVL5irubm5ubm5ubn5Mflmlupa1/I6w4YYKbCzwh62DmE/I+yICWWvfphYqutPWmCPVSV2neuotr7f2fEyQMIp8PR1VfYxJeZZmmLm0Y6jxo63nkpbDIy9rH3R4EHv64K1mfq2ubm5ubm5ubn57+GQxTynvE+1ddX18vUMfb0aYl6ar1PZKewIq+uVqb7Oivh+Zx8/D1MXZ9cm9rmHfS6xI6eICHsq+xD2WJHPhzi7NLMvm9oOYa/npF9T4GvTmry5ubm5ubm5ufmh+AIONVwpIXWRpq6t66rrUl5PY4euI6sO9tPp+5mOKF1rEzucWaS9Jqbv72Hnj5e26yh2bIg4u4yJ0dGOL/B1NrFLV0xzdvg6u2JU2Wdn3zR3HGxSwn0GwNzc3Nzc3Nz8H3vntiM1DARRRtxnuEmb+f9fxV3JoadwdhEiDyhbFcdOKAmkDA9HrXI7/ivyERJLtpTogNe3+Dp5GMuv+6FJnogRrkPsyBIxQzOyDzEdFmXfhqbdw06RejtSYf9Aa0dV2Dk+CWR/IHZSMWL2Gdolb84Ot/M4A7y/xY8fP378+PHjxz+5b3zI+nWbam1Wp7xum007D7N0gX3AOoEYerB7IKZ5vbecNrGL1l1bV5cDM+waO01idpEdXu8UOwV2jjtl4+lNqRiFYp6osZfqU5X07Siya7S+sza5C+Jf/NHix48fP378+PHjn9/nT5sPxwI/WhbGeL3br2/ELlqXLMAuqcIu2SmnHYdxYvfqOsR+JKtLHJ+KphT7270+MR5jJxRDiV28fusDTxvZV/EBOxlTt/Vn75VfA37vBybW+PHjx48fP378+Kf24UNRuiaT0BKpStz19W7APrR2YL8WrnPG6VZgd17faH0McL15/TKdm0Tm/MgyO39TrZMsw+4h9ncWivF9p1VhH8Nj7BKhGKDd5IX2fX2nCyRv2xU/fvz48ePHjx//Nfgg+iyhZI3WRuvk17XZdNpvOsZDfv0B2N9PFfb9DHtNELuGruMkUtfNP+N9HcH1x12nlonZYjHwehN7ieaO1ycastMtBn3rdMxX3VZrd1b3N5YafesP4sePHz9+/Pjx45/KL2GaIEeRpCdhhJroXpp4/YUzTqF1ujqKg+H1luO65scYC/Mx1K7JtabofyP2/UzMFGP3jaeritdB9kd9m7R99hpRFEVRFEVR9LxIwGhGEHu3hpnbw3gHdvE6Tdgl9pwiw3UC7LpRV9YP33NKU8cJ1+F1PzsJwes7mRhtPL2tOfbSYoeeSp1l1+159m3V8xjwO9OstuLHjx8/fvz48eOf0P+mwaTLYX1GdXhdyP7EaUnacGoNYoTsn6mvlwjEdIGdHux2ctLU0NEL7MfnYnaRvYEdXNdNiZ0YuxH7w/lJpatEjd1yMSaQ3dXfXz8N16/R+1WZ48ePHz9+/Pjx45/S12x8zhv6IVqvge7QunhdtA6uS1+8wC59WIFdKub1no7osovs7Dc9tFEMJXZ6xUy8vtuLXfLDk4TsazP2mdh78+liVXan9vUDv6Sv06uW+PHjx48fP378+Kf3eZoFrusyWi8J1kmv+37TQesP+XWAXbIEu+04RZcZ1xusG7j/hdV9oYbftM5qjR27wF7DiN1K7F+8HzupGLrFqAMmyO7ZGLC9lj+Ru/9R/Pjx48ePHz9+/PP6+/pBXb1myXFd2NmHJV0Xi687sKu6Tn2dBLsDOy3YPcQOR8PqGpoOqK97nxhNyBrFeIm9C+zW2tFz7F/YeWpF9ob2u6QvSbjIJFznN9heIPlZ9sfx48ePHz9+/PjxT+WLAc0g/KJpUlFmV9eh9d+6w9zgdXCdFjEE2HcT7CD7xY45Bdlh6uN0Ya1LqrWlSv/M62/3952uIsVezC4NXrduMVZml/RJndZZNI8FcKfyzlyWVsz48ePHjx8/fvz45/WND5/RxpcSvD4QVNX1pdPrNw5M8h2nHzwRg1ZatybsRuzEYSxyflSMnUL7hde5SwyNHV9o7UiK/bP3YxevC9mpsV+N2e+P2Zh5K+o+wrNHVa+9dl/3+PHjx48fP378+GfyZyJkbQkjhZNE18egvK40TN1DN+vnyAmnHzc9i+tzC/Yxpgi7cPr4LjGehnERipkiMXW/r4vDkyixa+PppykWQ5V9qTF4XUPErquGUjEU2/Xyl/rWT/Hjx48fP378+PFP5e/pzgJFSgLLwky0lLo5zHZa0hhFq+w3JQ4j0SKGQExdc4J9LrDX4L4cCOuN7BO1E80B2J9vFGO9HUseiiEWU1o6GIPu1jlmnesaaoCPoiiKoiiKotIDH7IfEpGCQQtS4Zj0um83paMjwA6uW4XdW7BfNmB3AdS6jxP8T47dkR1aR7sp9v2Np1Zjp8h+RcuM7fctHzMmBLiPwRMPepbPzxY/fvz48ePHjx//lfirVUOTw/odVq/RrC5Zeh2B6wRiCm0Bdmh9JxIzk/p4IMbOfQC8W4MYLQgpndM5doC9S+zvSLFbjb1ucuxq72hR9sUK7Q7t5NqRXvyn4Pf50TGa/vlqiR8/fvz48ePHj38qXzMCFsFGTZA6PWFq7SQM2fVOr/d2UzrEeCCGCLufmtS0rsmhHarmPlTk43U7rWuivm459k6xS+w7BdmnInvxulfZkb6meJ2pFuH79KOYZqiPHz9+/Pjx48eP/yr8tdi7MSNC2jB5pY8jwH7rbo52vulnr68brhNgn5AdVna90dWHHR2K6xog+5RkRw+87qkYCuxdZOfMUzH7Jn0mfS5E25jlSdMmHmB3wkhEZnTTV7MxPn78+PHjx48fP/7J/ZJB+mMrmDFMok3H9ZLhOvF1axDjh5zOHR01nNPXucXb4a3Y5yq7Cv7IiF2yEruQHWKnuyPMTofHUu9AXa9Sc7sh+590jx8/fvz48ePHj/+qfNfCXSCJwHSLro8h9dmmXV8XrlNh946Oe4ecUlyfIzG6DtWlxzq56BJz2d13ith3CrJLILvV2OH1ukzrh21q12UVd83Lf/w/J/5P9s5l2WkgiKFlHoEQdvD/34pb9qEt2sDG2SSSxzOTe6ogJBvdRtMODw8PDw8PD7+en/s/fo5r1NzCYpZXr1syvz7zMDSIuVl5/TwPs3QgxoWxviwPs/j275Zdb4tTp61RYsex0yymT54SZle/GKTk/+7XScccxOcu366lf/TjxNP3+dXw8PDw8PDw8PCX4rKC0x+6vunqGMyjrt9RGNIw7tbLspaorlNfp8ZeQXD0weW19Vrw6myuE3addZj2custT7HPJ556e8dRZpdpr4tkzDpMfNb/04/w8PDw8PDw8PDwn/jH7t6IW/csjPv1+4ivz/4wBNgJxNCE/aQ9jC6tGk/pwk7e5jQSY6dO6/ZWMeuwVIz+1ccg+x3Dvo7So8bW5/HbuWVnt241tGFC9uJHeHh4eHh4eHj4y3Pzh3QL121SXf1g1x+juk4zR7Ps87zpwbEfdd4hRrKzp5e7drYI7bn6kxQ7lt1OnlqQfW8WY8dP8eyrapJt12TNYyReaPJXrKrGh4eHh4eHh4eHvw8HaXbRSdxS69YZpqrJdty0269z3rQNO6K+/he3TvuWNtWX+XREfJ21tb0Zf3iSZ9iPlv2m24PsWPZOsq83J1C5936PdGo30852iO+xt5rDw8PDw8PDw8NflHvqpS167TVRWd/iHFTWy4GiMqZy623XvQG7d2AnD2MihYJbx6pz7lRaLvbt89gpK6mYkWIf3dil+qciP3tqnl0fHb697l3fKLhrw0fe3wnitSs8PDw8PDw8PPyV+QNea3tF+UcJV4nLlGQ7qa3vdv23bnXJrvcDk/oRp399YpJL3tl8+uVavMx+eup0oU9MjXbsxNj75OmtLrl1a8lOmd2CMVj2h7ePwbVrPfp27bu7zMHMh4eHh4eHh4eHvwV3f/iQ2qzLVOIvycG07q3Orlt5Hbf+twq7bLHV17vGfm0kBi2280DMNO2o3jSGnQJ7XadBdj9+imfHtJseNewjd32bm/Dw8PDw8PDw8DfmXlbfcjCo3LrGLjPrnYaZlh2/jl3fBpoBdtZ+whG62LhzU2Y3kYmZoZjDM0/RSSqmbvR1Sr/+uHMn3769Hj7eXoWHh4eHh4eHh78Tb3/4HbGTrSx/qemQXL+X7Khp3Z2Gwa67W/f6+nJq1ymtE2B/gl1fLL9eQ8vBrO9vTjtOng7D/nk8Q6nPnk7Pfne3XrNV3NnTTebg3Flqqgt950V4eHh4eHh4ePir8VWFtgnmTr0PmGo9qmvrdaEbOtr1bhBzsOyeiNFk5fUurFsV/HLxh/N3uzDr2HXr7jieeYpjt7bs93V0NGa9ED3atZhjH+KrMuHsw8PDw8PDw8PD34e7KKlPUV3HrOPVRztHXSd2fR0zEDNFJfwp4o/WPM+dEqvXO2zLjqix49k/jXYxXxBtHq03+2lGhpQMK9v++a7w8PDw8PDw8PD35VR+twXdh1XX1Ha9Jtx6+/XuDrNNVNctEnPs6EgUpoa23Jdq6d0/D57SJgZVlodITI1+5unIsn/ZBoa9hmVjNPhUp3NnEHWvbbPw8PDw8PDw8PB35IgXQ0p1SPKfyHrDjPbrZ/0c+6FJNIhZh8l8OttLtXilXdNS4/zcKfo4auxY9u7I7lH2adqx7pTa/y/7ruaPw8PDw8PDw8PDX5Oz+6tIb7RTtyQMpv1mrWG6N0wNq67LrdeNFs1u1a3UrvlpWiiwk4fRS3Pre8Ieu65JosLuQXbphmYyRvcdzeOo6zaKoiiKoiiK/iOvqes2u25JGI151nQ2YJc8EYMhrjEr7B0xf65p5++qzdDsE9OdYjSQt2SXa9+epKT74NnXS6ML7RVrZ7eH3O/bjbwWzz48PDw8PDw8PPytuIy59u0fOwJD98aZhvEkzEzDzP4w62gNv0563XovPlULy2gU84HZusVYR/bj2VPTocaOZXfh2Hv9Osru2way/29HeHh4eHh4eHj4u3JpxF805C9dt7qQt3LksvQ6Hdjdrx9lTzfVi6dpYWGlkSTyXIyr7boF2evuKPs6UWZfpQ/MAu3TuLMzDTPPN4jCw8PDw8PDw8Nfnps/PLPqNYZuJpIg6JCGsQK71dat/3oJv14anRefov7VQLOGJkR5fRmtYiiwm2UfuRikIrsG4pPVqmvda97XupnFzdKHh4eHh4eHh4e/FTd/aP5xGPVZXN/MKU69buTPN9X0h18fIphCeF3TM7SM1bz67MeOlMJHPEOpLfvRsZNln8b9XPeezM3vK19cIe21wu/h4eHh4eG/2DujHaeBIAgqIebE//8w8cTFuDXWXYQUPyRV2DvrayTAeWlGvRN1dfW30mmfpz+s/TEVxq6yB7OeZ02h7Cxkf70PnUJFUrqp3hsKvOTQae22LcwE+2yy369mGadP1wu+qOtNTOZ7/vSd8KGpq6urq6urq6t/jI42bDrrsOoPuw58VdKCWZ8B9oyv1zLa68O0n8GF+wEV5hcordexZb9fEDNjsstea121YN1/5o+6urq6urq6uvpH6U0SHrKderr1JUfDYNWh4iL7b0sCEjEzwE4YphZ4ZYK9Rzr2NPZh1rcSkPGBnWWvBX5T27VHx523y/+LeOO1iIiIiMhnM/whT/TVV3odQZikmsuzv95flzQD7LWMrjb+mcb3yyETw2Y22DkhC+nWq8cebfb1bTS8LDw7jJfL11BRq/ADPD31S11dXV1dXV1d/ZP08IfTpsO/WDZWNEc5NjjZiK9XeRhfnHDSQxZPcuv8CQTYmRgzIXgfsZhssWc05vFSmn5z6donX134TOjFk3/fpWnWa92rq6urq6urq6u/lV7K8IfsD9n8Zg5x7MkwS5413R82zQB7e/aEWEoE2Nm/EEI43VyntFlnHnsSo2LSsxfLpNrsVX707enhRUREROQDwbfDYKFEWH2MhUnmadPg0g32gwHs9LrX8uoAO6XY/5kww+xzVEwzB8YwM+Yg0r7+wrVzLFVERERE5Cnwj1Uwl6OvTmf9ILseXOeJU8x6QigFo/56LixbZbBkXSMSg12vgmfPaTFraZZt5V0BoXZa7Wvhla83u83F56ZKXerq6urq6urq6h+l32/s+VrrDos+UzAEYRrSIVWPBsRs6ZK6YOePyaVEJOaM7zqNDX8rdn1AdmRieloMdv1ewrLTZz+Gl8y2W+98GAzj6c9qYccP65e6urq6urq6uvpb6ZjD6Q+76dseMrhxd+oDu14LZr376+3Wa338CjDrMSPmzD479cJ6OCrmkWZPclwMRJI9ZsewwvDswKeADPww9UVdXV1dXV1dXf2t9GHEeaQO5gHTWsKs41rHSdN52nTOX8ets9R9Fj2MPd16wsnTmYrJ86e02dO2c29DdZ7idz7tPz1MPYK6urq6urq6uvq76LUFdPjep29ufSRh6iYOA1eGrz8TYKe1jXGmnEDEYfDrc1LMwTj2cuvz+CnvIllYos/O01PmXURERERkGHXKLTLrVODQZYJdjzzMetXdtEmONPlJtv0yfPvw7NO3XxsMe8J4y1/TsROQGfPa84Aqm4m6urq6urq6uvqn6vdf7G/xbUj1COyYCVPXumlmb530ei3Dqs9vOGU5hTzmSjIGfg6y02kHDt5usImjqIx+pBCWwcK3e+/PYoPfCerq6urq6urq6m+rD3+4j6iz37n24yAMxFyYX8Orr/VeRhaGzjqb07iM/X6wY20m+PWEGHsmY8Z09hlrx7tXYVtPtd5lLDuyurq6urq6urr6p+uznw5p18uQUoFJh+HW2YRfnzPYccxV4MSJ7GvhYqzjemcipq4j0rPf9juyMckMuO9fOyswmKdY1NXV1dXV1dXVP0qnAj8a/KL886HJlaOmtfx42hR/zAx2ONOp53OHYzDrT4145N/cZJudB14j6yAt+/whC1uqurq6urq6urr6m+hLqxA6IEVHfQWrTmmuI75Of33zt8Ou9war/Niea9pJsOfTFtY5nu1Yy0yyz3BMf6NSVXa8y3sVEREREfl/8JO0h7NnPGE0OVy2BaublC3Gq4/RMKeTsx0vVMgOO549B8aQjBng1deVXHttec+rqIUXERERkW9J/5imEq/e8ADp1XM0zMjEQH9RUbS3TwazTi1osE+7zibcenyVUtVBvsIYsVPQeofw8GzU1dXV1dXV1dU/Vd/c4t4/1g5nzkoFUjDczYUSVncOdAynzMP55IBH+v91B5mNOT5/mtGY5MbKludd3Ajvzn730an/Ze/sdp0GYjAoL7z/M0PNjhzL6Y8QnEY9M213nQyIknPzsTgbvV6v1+v1+u/qc4A8pKrjCSvKOZ3F9bi7tj4fcUpaZ/pa2k41Oea50+ee5l+Maqy178uSnwlpvSauce0EyUH9iPZvoKNGr9fr9Xq9Xv89PPkQnzUi5/tJPQdWkxeQ1oMhcpibr++4Tj6urpi3EvkhwE9mbL9Np/xY7HL5nPqpnK7G4znLRLU96PV6vV6v1+s/0R9TIXMvZ1jP8Q7x53UXNjqvfFxPOf1a2lNW+UTbk32ymGjSz+EUrhdQDsZ1n/bnI8+PWa/X6/V6vV7/ET6ZEX2ymPfAzE6Gc3GdmUA7mteZ6RY/hvRLdLHfxsgP78HijtosG/MeVP6Nc7ioIiIiIiL/Dtqxe7c6ZYNWmMbsiWmN4m2d+21ETdGen8Q4WTnUDo9ze/YqeAZsu5qNcUqv1+v1er1erz9lYVZL6ztw8plRHbgdk1A7OmF494XttxDtoMZDh/2zzM5C+ylsz76PeB0uaZXn6PV6vV6v1+v1jRElby9ghX3CTZi/mVl9hF5Cer7ef7cptE72rPkXBmOx8pOv48bsVKdw/fZSO+E9j/7UnM+Lr9fr9Xq9Xq/Xn3vOVr5Me4dgrvz6KLLvNLxTe7x/lX38wXwtInvCPKmHn9aVeMSPUeyLftwYkniv1+v1er1er9dPv14ixr4wtX3KoLaFoYP97Q84vRPWGSOy4NueUw377Mz+JLT/GM3tnKLVnSPON88vW5S/WXq9Xq/X6/X6T/JpX8qHJR6SMXUsqhespsMhEu9QfIkdYlpa3x3svPabebDojmEmsv8VXPj+Px2zHz5rvV6v1+v1ev3n+RHC0zO8Bpk052B/wxyf7g5TK+xwO/n2tL7hi9REVgfqAU+KojsmJ4glIiIiIvJfiXFY+fQRrEsfbjStIi6R0u/sFhP71dp57q6x17yi33waRnYRERER+SqI6vkinzIPqmk9P+TfC7XBQG+m50vyiaLqCW0xObHOblYXERERkf9Fz5tBzTbrjDDjOlMl9b6j4424VG4nqHOQ7zwT8WRf9sWU7+rtp3eongRrl4yIiIiI/CXR52Aoz3brwXh/dZ2Zigh8wZgOvSsmqoralf0hq2d3rhWvdfgERbvqVZeH81Kv1+v1er1e/wEeXsiH01fspGr7OK54ACvTNw4FrSaXTO2RQ467qob25FCcwyWq6rCHzB5uZL19Xfkd7akXRq/X6/V6vV7/ff3MjxzkVBF9V8+hgYS8m0VPwtdrZAfot8pG5fZXoWsoh/l/EtVqRMlKfJ7R6/V6vV6v1+uH52S+yZc9f47TQFKvkldtkcgYFwzpQdG/Myfmwjr1OavVtcLOe61y5deWodfr9Xq9Xq/Xv+CpW2wfjO3WWwfJfvrQZTZbfym5w7xRtlp9XmIxATU/gbrkVCunrdPzXxwpll6v1+v1er3+O3mW0md+BDw8jesJIT1rQm/1rV/wztOZ03PgvQcy+6uBfW4gk+VClFp1rtfk+NDr9Xq9/hd7d7TbNgyDUVj0+z/0AM4HLEEnNYxhrePzN7Eof8MQazeMpya6rj/Tt/Leom94k5Mf5Ei1su7fmvT7uvU9cVD2l8vbknHNF/p3VrnbuOeu67qu67quP9pj9I8j0IksGvbqb3/lB66/T7SiroQTdaUcgupattiOTnbfdF3XdV3X9cf5hlxoz3sWzxWM7Xc2s7zPPnZeaOw/WXImq9Ggn2/at9dnZ1UTXdd1Xdd1/Zm+Xe7W50eTA9yErv72b+Je7XpNqnuPHesjK7Nsq3E9W2y6ruu6ruu6Xkm/klVV/tCpM+8N+u/8IMdT4YXXy+f/D7jWuS6UxhhjjDHG/GRWPkavnmPr1eMGX5P03W52rimLnOST7T6jabdxN8YYY4wxP5Y1Zyuf/S70uNme9d1uuc8dPXlke8x+/XTtLIXdujHGGGOM+T+ZPXnbtk7fmmWO+bjbjvXxu6ZU82SW/QprddIjk5rBWUx7eWOMMcYYcyHrcDb7T1L9aR7Se1PL/el774oZLzmy5uqZRvXykWMlaa5xcZ3XdV3XdV3X9ZPOH6Ls/WfrT1fvXzNxz7b8MMFQ70iocwimlOn7So5vWmJ98YIaa6bruq7ruq7rdWz9JWXrLxFORtvMnWFHTJ67+y+dkhfbY7joiDrZ1zTlm38TXdd1Xdd1Xb/k5Lj/HHu66V+Z98Q9m/XoVXsvwpksueuehrB0bbkiU8acRznAoOu6ruu6rj/K13Ay+svef9Ktjv60evWP2Brz/k1H9EcOLE6WnI32ge38GYo49iqyzoOu67qu67r+ID/VP06nI88Dxo12JnWb/T4f3niudacMSq6QJxtlGKjrLvvXt06MZz10Xdd1Xdf1R/k67Qz0n/tPa1s5ci7x/pvXK3XBHJn3NWBoy8ejKt489TGj67qu67qu6+999pe0qPhiMvvY+JD+fLTrc9KWgosvZJYlzuylh67ruq7ruq6fd2YRB/0pTHm3bzG9mODZLpZp/sRYvRxx6tB1Xdd1Xdf1f+LzFnsdxr3nz9sN0xp1ZhwYm1a73ufRlpz3QCV5Wtd1Xdd1Xdff+rx73usq65Dz+LwuncQ7CB58tE4tEPXu0ZarPB8MwdnY/zpd13Vd13X90b6aj/3YWIYa5M985j31b8NSVKJPIg6b+3jpswhd13Vd13X94R5f/Ise7IZ505gH44d37X/Yu6Oc1mEoiqLc+U+aDzgy1rUBtRW08dp6r3G8ihCEDxOFpJbD5e8w8VxnFMlsjUF8eeadc84555wf6+uLXIbn/XkZU0PqZR9jenP50lPN8+HsTT5ukLnQyiBeb5xzzjnn/Fz/HG3Wj/PF1vmfzWkn1n9ZfbdbzefHw2am34/nc2JsOeecc8751X3/9P14cFudvDJPy2/hOAb9lPs8NUOFM1XrT8g555xzzq/vNT9bv8ZkvN0sZn2S/dK3hrn7LjLVx9W9mudN/emp4y2cc8455/zKvrk6I6OTb/zy0KptxrHJZobsVf4Nnz+Mc84555xf3bMmzG6Ga7eK31XZNvhpM0/U3qfjyTnnnHPOr++Zz35bzP++sni//beYyut2IruZ4pxzzjnnZ/hdq06n2Xu1GfTWXjtPnHPOOef8cP9xIWqB/rUnP5qcc8455/wKXvOok2vX76xuOFT//3PBOeecc86fyGvv5dqXx1XTaytznHPOOeect9qdYTy59E/qB8qlNpxzzjnn/CN/UPrsFeecc84553rFinPOOeecH+WSJEmSJEmSJEmSJEmSJEmSJEmSJEmSJEnv7cEhAQAAAICg/6/dYAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Am3xVdmYGgC+AAAAAElFTkSuQmCC"/></pattern><filter id="a" x="0" y="0" width="758.6" height="364.319" filterUnits="userSpaceOnUse"><feOffset dy="3" input="SourceAlpha"/><feGaussianBlur stdDeviation="3" result="blur"/><feFlood flood-opacity=".161"/><feComposite operator="in" in2="blur"/><feComposite in="SourceGraphic"/></filter></defs><g transform="matrix(1, 0, 0, 1, 0, 0)" filter="url(#a)"><path data-name="Schnittmenge 11" d="M-6223.619,518.137a24.686,24.686,0,0,1-24.69-24.689,24.689,24.689,0,0,1,24.69-24.692h88.875a24.675,24.675,0,0,0,24.626-24.692,24.675,24.675,0,0,0-24.626-24.689h-19.78a24.689,24.689,0,0,1-24.689-24.692,24.687,24.687,0,0,1,24.689-24.69h59.274c13.713-.038,24.35-11.216,24.688-24.692a24.689,24.689,0,0,0-24.691-24.692H-6302.67a24.689,24.689,0,0,1-24.69-24.69,24.689,24.689,0,0,1,24.69-24.692h153.06c13.715-.038,24.351-11.213,24.689-24.692a24.687,24.687,0,0,0-24.689-24.69h-34.516a24.688,24.688,0,0,1-24.691-24.692c0-13.639,11.052-25.337,24.691-25.337l341.925.258a172.988,172.988,0,0,1,173.03,173.03,173.027,173.027,0,0,1-173.03,173.03Zm257.641-192.292V364.3a96.051,96.051,0,0,0,96.113,96.113,96.091,96.091,0,0,0,96.112-96.113v-38.46a96.133,96.133,0,0,0-96.112-96.113A96.093,96.093,0,0,0-5965.979,325.845Zm-420.589,192.292a23.225,23.225,0,0,1-23.2-23.2v-2.973a23.185,23.185,0,0,1,23.2-23.205h85.384a23.145,23.145,0,0,1,23.205,23.205v2.973a23.185,23.185,0,0,1-23.205,23.2Zm102.19-98.763a23.227,23.227,0,0,1-23.2-23.205V393.2a23.227,23.227,0,0,1,23.2-23.2h52.356a23.226,23.226,0,0,1,23.2,23.2v2.973a23.226,23.226,0,0,1-23.2,23.205Zm375.212-49.381a23.227,23.227,0,0,1-23.2-23.205v-2.973a23.225,23.225,0,0,1,23.2-23.205h72.136a23.227,23.227,0,0,1,23.2,23.205v2.973a23.229,23.229,0,0,1-23.2,23.205Zm-447.8-148.146a23.171,23.171,0,0,1-23.2-23.14v-3.039a23.227,23.227,0,0,1,23.2-23.205h95.34a23.173,23.173,0,0,1,23.14,23.205v3.039a23.117,23.117,0,0,1-23.14,23.14Z" transform="translate(6418.77 -165.82)" opacity=".999" fill="url(#b)"/></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" width="1000" height="1000">
+<!--
+/********************************************************************************
+ * Copyright (C) 2019 Ericsson and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+ ********************************************************************************/
+-->
+<!--Created with Method Draw - http://github.com/duopixel/Method-Draw/-->
+    <g>
+        <rect id="canvas_background" width="1002" height="1002" x="-1" y="-1" fill="none"/>
+        <g id="canvasGrid" width="100%" height="100%" x="0" y="0" display="none" overflow="visible">
+            <rect width="100%" height="100%" x="0" y="0" fill="url(#gridpattern)" stroke-width="0"/>
+        </g>
+    </g>
+    <g>
+        <ellipse id="svg_1" cx="500" cy="500" fill="#000000" stroke="#ffffff" stroke-width="0" rx="400" ry="400"/>
+        <g id="svg_11">
+            <g id="svg_5" fill="#FFFFFF">
+                <path id="svg_7" d="m654.970093,359.310364c75.099365,0 135.929932,63.007935 135.929932,140.794861c0,77.734314 -60.830566,140.7948 -135.929321,140.7948l-299.633667,0c-10.713898,0 -19.396729,-8.993652 -19.396729,-20.091003c0,-11.097412 8.682831,-20.091003 19.396729,-20.091003l69.817993,0c10.663147,0 19.345978,-8.993591 19.345978,-20.091003c0,-11.097412 -8.682831,-20.091064 -19.345978,-20.091064l-15.538177,0c-10.713379,0 -19.39621,-8.993591 -19.39621,-20.090942c0,-11.097351 8.682831,-20.091003 19.396729,-20.091003l46.563812,0c10.772278,-0.031067 19.127594,-9.125122 19.395203,-20.091034c0,-11.097351 -8.682831,-20.091003 -19.396729,-20.091003l-162.942596,0c-10.713898,0 -19.396729,-8.993652 -19.396729,-20.091003c0,-11.097382 8.682831,-20.091034 19.396729,-20.091034l120.241394,0c10.771759,-0.031036 19.127075,-9.125061 19.394653,-20.091003c0,-11.097351 -8.6828,-20.091003 -19.396729,-20.091003l-27.114746,0c-10.713928,0 -19.396759,-8.993591 -19.396759,-20.090973c0,-11.097412 8.682831,-20.616974 19.396759,-20.616974l268.608459,0.210388zm-21.731812,46.914124l0,0c-41.738525,0 -75.505005,35.02771 -75.505005,78.207642l0,31.293579c0,43.232483 33.766479,78.207642 75.505005,78.207642c41.687622,0 75.505005,-34.975159 75.505005,-78.207642l0,-31.293579c0,-43.179932 -33.817383,-78.207642 -75.505005,-78.207642l0,0zm25.794556,73.947479c10.053711,0 18.228882,8.467682 18.228882,18.881348l0,2.419342c0,10.413635 -8.175171,18.881348 -18.228882,18.881348l-56.66687,0c-10.053833,0 -18.22876,-8.467712 -18.22876,-18.881348l0,-2.419342c0,-10.413666 8.174927,-18.881348 18.22876,-18.881348l56.66687,0z"/>
+                <path id="svg_8" d="m294.404938,600.718018c10.104584,0 18.228851,8.415039 18.228851,18.881348l0,2.419312c0,10.413696 -8.124268,18.881348 -18.228851,18.881348l-67.076096,0c-10.053802,0 -18.228867,-8.467651 -18.228867,-18.881348l0,-2.419312c0,-10.466309 8.175064,-18.881348 18.228867,-18.881348l67.076096,0z"/>
+                <path id="svg_9" d="m325.480286,359.625946c10.053802,0 18.178101,8.467682 18.178101,18.881287l0,2.471924c0,10.413696 -8.124298,18.828766 -18.178101,18.828766l-74.895691,0c-10.053802,0 -18.228867,-8.41507 -18.228867,-18.828766l0,-2.471924c0,-10.413605 8.175064,-18.881287 18.228867,-18.881287l74.895691,0z"/>
+                <path id="svg_10" d="m348.736053,520.354004c10.053772,0 18.228821,8.467651 18.228821,18.881287l0,2.419373c0,10.413635 -8.175049,18.881287 -18.228821,18.881287l-41.129181,0c-10.053772,0 -18.228851,-8.467651 -18.228851,-18.881287l0,-2.419373c0,-10.413635 8.175079,-18.881287 18.228851,-18.881287l41.129181,0z"/>
+            </g>
+        </g>
+    </g>
+</svg>
diff --git a/site/static/icon/typescript.svg b/site/static/icon/typescript.svg
new file mode 100644
index 0000000000000..1233b3860b7d0
--- /dev/null
+++ b/site/static/icon/typescript.svg
@@ -0,0 +1 @@
+<svg fill="none" height="256" viewBox="0 0 256 256" width="256" xmlns="http://www.w3.org/2000/svg"><rect fill="#3178c6" height="256" rx="20" width="256"/><path clip-rule="evenodd" d="m150.518 200.475v27.62c4.492 2.302 9.805 4.028 15.938 5.179s12.597 1.726 19.393 1.726c6.622 0 12.914-.633 18.874-1.899s11.187-3.352 15.678-6.257c4.492-2.906 8.048-6.704 10.669-11.394 2.62-4.689 3.93-10.486 3.93-17.391 0-5.006-.749-9.394-2.246-13.163s-3.657-7.121-6.479-10.055c-2.821-2.935-6.205-5.567-10.149-7.898-3.945-2.33-8.394-4.531-13.347-6.602-3.628-1.497-6.881-2.949-9.761-4.359-2.879-1.41-5.327-2.848-7.342-4.316-2.016-1.467-3.571-3.021-4.665-4.661s-1.641-3.495-1.641-5.567c0-1.899.489-3.61 1.468-5.135s2.362-2.834 4.147-3.927c1.785-1.094 3.973-1.942 6.565-2.547 2.591-.604 5.471-.906 8.638-.906 2.304 0 4.737.173 7.299.518 2.563.345 5.14.877 7.732 1.597 2.591.719 5.11 1.625 7.558 2.719 2.447 1.093 4.708 2.359 6.781 3.797v-25.807c-4.204-1.611-8.797-2.805-13.778-3.582s-10.697-1.165-17.147-1.165c-6.565 0-12.784.705-18.658 2.115-5.874 1.409-11.043 3.61-15.506 6.602-4.463 2.993-7.99 6.805-10.582 11.437-2.591 4.632-3.887 10.17-3.887 16.615 0 8.228 2.375 15.248 7.127 21.06 4.751 5.811 11.963 10.731 21.638 14.759 3.801 1.554 7.343 3.078 10.625 4.575 3.283 1.496 6.119 3.049 8.509 4.66s4.276 3.366 5.658 5.265 2.073 4.057 2.073 6.474c0 1.783-.432 3.438-1.296 4.963-.863 1.524-2.174 2.848-3.93 3.97s-3.945 1.999-6.565 2.632-5.687.95-9.2.95c-5.989 0-11.92-1.05-17.794-3.151-5.875-2.1-11.317-5.25-16.327-9.451zm-46.036-68.733h35.518v-22.742h-99v22.742h35.3447v101.258h28.1373z" fill="#fff" fill-rule="evenodd"/></svg>
\ No newline at end of file
diff --git a/site/static/icon/ubuntu.svg b/site/static/icon/ubuntu.svg
index f217bc8d5dbf6..25b5db244d1d8 100644
--- a/site/static/icon/ubuntu.svg
+++ b/site/static/icon/ubuntu.svg
@@ -1,8 +1,8 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 100 100">
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 100 100" width="100px" height="100px">
 <circle fill="#f47421" cy="50" cx="50" r="45"/>
 <circle fill="none" stroke="#ffffff" stroke-width="8.55" cx="50" cy="50" r="21.825"/>
 <g id="friend"><circle fill="#f47421" cx="19.4" cy="50" r="8.4376"/>
 <path stroke="#f47421" stroke-width="3.2378" d="M67,50H77"/>
 <circle fill="#ffffff" cx="19.4" cy="50" r="6.00745"/></g>
 <use xlink:href="#friend" transform="rotate(120,50,50)"/>
-<use xlink:href="#friend" transform="rotate(240,50,50)"/></svg>
\ No newline at end of file
+<use xlink:href="#friend" transform="rotate(240,50,50)"/></svg>
diff --git a/site/static/icon/vault.svg b/site/static/icon/vault.svg
new file mode 100644
index 0000000000000..c90525cd770c3
--- /dev/null
+++ b/site/static/icon/vault.svg
@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="utf-8"?><!-- Uploaded to: SVG Repo, www.svgrepo.com, Generator: SVG Repo Mixer Tools -->
+<svg width="800px" height="800px" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg" fill="none"><path fill="#FFD814" d="M0 0l7.971 15.516L16 0H0zm6.732 6.16h-1.27V4.89h1.27v1.27zm0-1.906h-1.27V2.985h1.27v1.269zm1.904 3.81h-1.27v-1.27h1.27v1.27zm0-1.905h-1.27V4.89h1.27v1.27zm0-1.905h-1.27V2.985h1.27v1.269zm1.894 1.905H9.26V4.89h1.27v1.27zM9.26 4.254V2.985h1.27v1.269H9.26z"/></svg>
\ No newline at end of file
diff --git a/site/static/icon/webstorm.svg b/site/static/icon/webstorm.svg
index 58da53935306e..bda53e1b375b7 100644
--- a/site/static/icon/webstorm.svg
+++ b/site/static/icon/webstorm.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 70 70" xml:space="preserve" style="enable-background:new 0 0 70 70"><g><g><linearGradient id="SVGID_1_" x1="25.068" x2="43.183" y1="1.46" y2="66.675" gradientUnits="userSpaceOnUse"><stop offset=".285" style="stop-color:#00cdd7"/><stop offset=".941" style="stop-color:#2086d7"/></linearGradient><polygon style="fill:url(#SVGID_1_)" points="9.4 63.3 0 7.3 17.5 .1 28.6 6.7 38.8 1.2 60.1 9.4 48.1 70"/><linearGradient id="SVGID_2_" x1="30.72" x2="61.365" y1="9.734" y2="54.671" gradientUnits="userSpaceOnUse"><stop offset=".14" style="stop-color:#fff045"/><stop offset=".366" style="stop-color:#00cdd7"/></linearGradient><polygon style="fill:url(#SVGID_2_)" points="70 23.7 61 1.4 44.6 0 19.3 24.3 26.1 55.6 38.8 64.6 70 46 62.3 31.7"/><linearGradient id="SVGID_3_" x1="61.082" x2="65.106" y1="15.29" y2="29.544" gradientUnits="userSpaceOnUse"><stop offset=".285" style="stop-color:#00cdd7"/><stop offset=".941" style="stop-color:#2086d7"/></linearGradient><polygon style="fill:url(#SVGID_3_)" points="56 20.4 62.3 31.7 70 23.7 64.4 9.8"/></g><g><g><rect style="fill:#000" width="43.2" height="43.2" x="13.4" y="13.4"/><rect style="fill:#fff" width="16.2" height="2.7" x="17.5" y="48.5"/><path style="fill:#fff" d="M38.7,34.3l2.3-2.8c1.6,1.3,3.3,2.2,5.3,2.2c1.6,0,2.5-0.6,2.5-1.7v-0.1c0-1-0.6-1.5-3.6-2.3 c-3.6-0.9-5.8-1.9-5.8-5.5v-0.1c0-3.3,2.6-5.4,6.2-5.4c2.6,0,4.8,0.8,6.6,2.3l-2,3c-1.6-1.1-3.1-1.8-4.6-1.8 c-1.5,0-2.3,0.7-2.3,1.6v0.1c0,1.2,0.8,1.6,3.8,2.4c3.6,1,5.6,2.3,5.6,5.4v0.1c0,3.6-2.7,5.6-6.5,5.6 C43.5,37.2,40.8,36.2,38.7,34.3"/></g><polygon style="fill:#fff" points="35.2 19 32.5 29.4 29.5 19 26.5 19 23.4 29.4 20.7 19 16.6 19 21.7 36.9 25 36.9 28 26.5 30.9 36.9 34.3 36.9 39.4 19"/></g></g></svg>
\ No newline at end of file
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="Layer_1" x="0" y="0" version="1.1" viewBox="0 0 70 70" width="70px" height="70px" xml:space="preserve" style="enable-background:new 0 0 70 70"><g><g><linearGradient id="SVGID_1_" x1="25.068" x2="43.183" y1="1.46" y2="66.675" gradientUnits="userSpaceOnUse"><stop offset=".285" style="stop-color:#00cdd7"/><stop offset=".941" style="stop-color:#2086d7"/></linearGradient><polygon style="fill:url(#SVGID_1_)" points="9.4 63.3 0 7.3 17.5 .1 28.6 6.7 38.8 1.2 60.1 9.4 48.1 70"/><linearGradient id="SVGID_2_" x1="30.72" x2="61.365" y1="9.734" y2="54.671" gradientUnits="userSpaceOnUse"><stop offset=".14" style="stop-color:#fff045"/><stop offset=".366" style="stop-color:#00cdd7"/></linearGradient><polygon style="fill:url(#SVGID_2_)" points="70 23.7 61 1.4 44.6 0 19.3 24.3 26.1 55.6 38.8 64.6 70 46 62.3 31.7"/><linearGradient id="SVGID_3_" x1="61.082" x2="65.106" y1="15.29" y2="29.544" gradientUnits="userSpaceOnUse"><stop offset=".285" style="stop-color:#00cdd7"/><stop offset=".941" style="stop-color:#2086d7"/></linearGradient><polygon style="fill:url(#SVGID_3_)" points="56 20.4 62.3 31.7 70 23.7 64.4 9.8"/></g><g><g><rect style="fill:#000" width="43.2" height="43.2" x="13.4" y="13.4"/><rect style="fill:#fff" width="16.2" height="2.7" x="17.5" y="48.5"/><path style="fill:#fff" d="M38.7,34.3l2.3-2.8c1.6,1.3,3.3,2.2,5.3,2.2c1.6,0,2.5-0.6,2.5-1.7v-0.1c0-1-0.6-1.5-3.6-2.3 c-3.6-0.9-5.8-1.9-5.8-5.5v-0.1c0-3.3,2.6-5.4,6.2-5.4c2.6,0,4.8,0.8,6.6,2.3l-2,3c-1.6-1.1-3.1-1.8-4.6-1.8 c-1.5,0-2.3,0.7-2.3,1.6v0.1c0,1.2,0.8,1.6,3.8,2.4c3.6,1,5.6,2.3,5.6,5.4v0.1c0,3.6-2.7,5.6-6.5,5.6 C43.5,37.2,40.8,36.2,38.7,34.3"/></g><polygon style="fill:#fff" points="35.2 19 32.5 29.4 29.5 19 26.5 19 23.4 29.4 20.7 19 16.6 19 21.7 36.9 25 36.9 28 26.5 30.9 36.9 34.3 36.9 39.4 19"/></g></g></svg>
diff --git a/site/tsconfig.json b/site/tsconfig.json
index 836d01dd3536f..b04675aee3161 100644
--- a/site/tsconfig.json
+++ b/site/tsconfig.json
@@ -1,22 +1,22 @@
 {
   "compilerOptions": {
-    "downlevelIteration": true,
     "esModuleInterop": true,
     "forceConsistentCasingInFileNames": true,
     "incremental": true,
     "isolatedModules": true,
     "jsx": "react-jsx",
+    "jsxImportSource": "@emotion/react",
     "lib": ["dom", "dom.iterable", "esnext"],
-    "module": "commonjs",
+    "module": "esnext",
     "moduleResolution": "node",
-    "outDir": "./dist/",
+    "outDir": "build/",
     "resolveJsonModule": true,
     "skipLibCheck": true,
     "strict": true,
     "target": "es2020",
-    "baseUrl": "./src"
+    "baseUrl": "src/"
   },
   "include": ["**/*.ts", "**/*.tsx"],
-  "exclude": ["node_modules", "_jest"],
-  "types": ["node", "jest", "@testing-library/jest-dom"]
+  "exclude": ["node_modules/", "_jest"],
+  "types": ["@emotion/react", "@testing-library/jest-dom", "jest", "node"]
 }
diff --git a/site/vite.config.ts b/site/vite.config.ts
index 8ba6321d17d44..b0fa3e8be5168 100644
--- a/site/vite.config.ts
+++ b/site/vite.config.ts
@@ -1,22 +1,22 @@
-import react from "@vitejs/plugin-react"
-import path from "path"
-import { defineConfig, PluginOption } from "vite"
-import { visualizer } from "rollup-plugin-visualizer"
-import checker from "vite-plugin-checker"
+import react from "@vitejs/plugin-react";
+import path from "path";
+import { defineConfig, PluginOption } from "vite";
+import { visualizer } from "rollup-plugin-visualizer";
+import checker from "vite-plugin-checker";
 
 const plugins: PluginOption[] = [
   react(),
   checker({
     typescript: true,
   }),
-]
+];
 
 if (process.env.STATS !== undefined) {
   plugins.push(
     visualizer({
       filename: "./stats/index.html",
     }),
-  )
+  );
 }
 
 export default defineConfig({
@@ -53,13 +53,13 @@ export default defineConfig({
               proxyReq.setHeader(
                 "origin",
                 process.env.CODER_HOST || "http://localhost:3000",
-              )
+              );
             }
 
             socket.on("error", (error) => {
-              console.error(error)
-            })
-          })
+              console.error(error);
+            });
+          });
         },
       },
       "/swagger": {
@@ -82,4 +82,4 @@ export default defineConfig({
       xServices: path.resolve(__dirname, "./src/xServices"),
     },
   },
-})
+});
diff --git a/tailnet/conn.go b/tailnet/conn.go
index 089a83ff79ff9..358241108d147 100644
--- a/tailnet/conn.go
+++ b/tailnet/conn.go
@@ -2,12 +2,13 @@ package tailnet
 
 import (
 	"context"
+	"encoding/binary"
 	"errors"
 	"fmt"
-	"io"
 	"net"
 	"net/http"
 	"net/netip"
+	"os"
 	"reflect"
 	"strconv"
 	"sync"
@@ -19,14 +20,16 @@ import (
 	"golang.org/x/xerrors"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
-	"tailscale.com/hostinfo"
+	"tailscale.com/envknob"
 	"tailscale.com/ipn/ipnstate"
 	"tailscale.com/net/connstats"
 	"tailscale.com/net/dns"
+	"tailscale.com/net/netmon"
 	"tailscale.com/net/netns"
 	"tailscale.com/net/tsdial"
 	"tailscale.com/net/tstun"
 	"tailscale.com/tailcfg"
+	"tailscale.com/tsd"
 	"tailscale.com/types/ipproto"
 	"tailscale.com/types/key"
 	tslogger "tailscale.com/types/logger"
@@ -35,32 +38,63 @@ import (
 	"tailscale.com/wgengine"
 	"tailscale.com/wgengine/filter"
 	"tailscale.com/wgengine/magicsock"
-	"tailscale.com/wgengine/monitor"
 	"tailscale.com/wgengine/netstack"
 	"tailscale.com/wgengine/router"
 	"tailscale.com/wgengine/wgcfg/nmcfg"
 
 	"cdr.dev/slog"
-	"github.com/coder/coder/coderd/database"
-	"github.com/coder/coder/cryptorand"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/cryptorand"
 )
 
+var ErrConnClosed = xerrors.New("connection closed")
+
 const (
 	WorkspaceAgentSSHPort             = 1
 	WorkspaceAgentReconnectingPTYPort = 2
 	WorkspaceAgentSpeedtestPort       = 3
 )
 
+// EnvMagicsockDebugLogging enables super-verbose logging for the magicsock
+// internals. A logger must be supplied to the connection with the debug level
+// enabled.
+//
+// With this disabled, you still get a lot of output if you have a valid logger
+// with the debug level enabled.
+const EnvMagicsockDebugLogging = "CODER_MAGICSOCK_DEBUG_LOGGING"
+
 func init() {
 	// Globally disable network namespacing. All networking happens in
 	// userspace.
 	netns.SetEnabled(false)
+	// Tailscale, by default, "trims" the set of peers down to ones that we are
+	// "actively" communicating with in an effort to save memory. Since
+	// Tailscale removed keep-alives, it seems like open but idle connections
+	// (SSH, port-forward, etc) can get trimmed fairly easily, causing hangs for
+	// a few seconds while the connection is setup again.
+	//
+	// Note that Tailscale.com's use case is very different from ours: in their
+	// use case, users create one persistent tailnet per device, and it allows
+	// connections to every other thing in Tailscale that belongs to them.  The
+	// tailnet stays up as long as your laptop or phone is turned on.
+	//
+	// Our use case is different: for clients, it's a point-to-point connection
+	// to a single workspace, and lasts only as long as the connection.  For
+	// agents, it's connections to a small number of clients (CLI or Coderd)
+	// that are being actively used by the end user.
+	envknob.Setenv("TS_DEBUG_TRIM_WIREGUARD", "false")
 }
 
 type Options struct {
+	ID         uuid.UUID
 	Addresses  []netip.Prefix
 	DERPMap    *tailcfg.DERPMap
 	DERPHeader *http.Header
+	// DERPForceWebSockets determines whether websockets is always used for DERP
+	// connections, rather than trying `Upgrade: derp` first and potentially
+	// falling back. This is useful for misbehaving proxies that prevent
+	// fallback due to odd behavior, like Azure App Proxy.
+	DERPForceWebSockets bool
 
 	// BlockEndpoints specifies whether P2P endpoints are blocked.
 	// If so, only DERPs can establish connections.
@@ -69,6 +103,18 @@ type Options struct {
 	ListenPort     uint16
 }
 
+// NodeID creates a Tailscale NodeID from the last 8 bytes of a UUID. It ensures
+// the returned NodeID is always positive.
+func NodeID(uid uuid.UUID) tailcfg.NodeID {
+	id := int64(binary.BigEndian.Uint64(uid[8:]))
+
+	// ensure id is positive
+	y := id >> 63
+	id = (id ^ y) - y
+
+	return tailcfg.NodeID(id)
+}
+
 // NewConn constructs a new Wireguard server that will accept connections from the addresses provided.
 func NewConn(options *Options) (conn *Conn, err error) {
 	if options == nil {
@@ -117,19 +163,29 @@ func NewConn(options *Options) (conn *Conn, err error) {
 			Caps: []filter.CapMatch{},
 		}},
 	}
-	nodeID, err := cryptorand.Int63()
-	if err != nil {
-		return nil, xerrors.Errorf("generate node id: %w", err)
+
+	var nodeID tailcfg.NodeID
+
+	// If we're provided with a UUID, use it to populate our node ID.
+	if options.ID != uuid.Nil {
+		nodeID = NodeID(options.ID)
+	} else {
+		uid, err := cryptorand.Int63()
+		if err != nil {
+			return nil, xerrors.Errorf("generate node id: %w", err)
+		}
+		nodeID = tailcfg.NodeID(uid)
 	}
+
 	// This is used by functions below to identify the node via key
 	netMap.SelfNode = &tailcfg.Node{
-		ID:         tailcfg.NodeID(nodeID),
+		ID:         nodeID,
 		Key:        nodePublicKey,
 		Addresses:  options.Addresses,
 		AllowedIPs: options.Addresses,
 	}
 
-	wireguardMonitor, err := monitor.New(Logger(options.Logger.Named("net.wgmonitor")))
+	wireguardMonitor, err := netmon.New(Logger(options.Logger.Named("net.wgmonitor")))
 	if err != nil {
 		return nil, xerrors.Errorf("create wireguard link monitor: %w", err)
 	}
@@ -139,14 +195,15 @@ func NewConn(options *Options) (conn *Conn, err error) {
 		}
 	}()
 
-	IP()
 	dialer := &tsdial.Dialer{
 		Logf: Logger(options.Logger.Named("net.tsdial")),
 	}
+	sys := new(tsd.System)
 	wireguardEngine, err := wgengine.NewUserspaceEngine(Logger(options.Logger.Named("net.wgengine")), wgengine.Config{
-		LinkMonitor: wireguardMonitor,
-		Dialer:      dialer,
-		ListenPort:  options.ListenPort,
+		NetMon:       wireguardMonitor,
+		Dialer:       dialer,
+		ListenPort:   options.ListenPort,
+		SetSubsystem: sys.Set,
 	})
 	if err != nil {
 		return nil, xerrors.Errorf("create wgengine: %w", err)
@@ -161,20 +218,26 @@ func NewConn(options *Options) (conn *Conn, err error) {
 		return ok
 	}
 
-	// This is taken from Tailscale:
-	// https://github.com/tailscale/tailscale/blob/0f05b2c13ff0c305aa7a1655fa9c17ed969d65be/tsnet/tsnet.go#L247-L255
-	wireguardInternals, ok := wireguardEngine.(wgengine.InternalsGetter)
-	if !ok {
-		return nil, xerrors.Errorf("wireguard engine isn't the correct type %T", wireguardEngine)
-	}
-	tunDevice, magicConn, dnsManager, ok := wireguardInternals.GetInternals()
-	if !ok {
-		return nil, xerrors.New("get wireguard internals")
-	}
+	sys.Set(wireguardEngine)
+
+	magicConn := sys.MagicSock.Get()
+	magicConn.SetDERPForceWebsockets(options.DERPForceWebSockets)
 	if options.DERPHeader != nil {
 		magicConn.SetDERPHeader(options.DERPHeader.Clone())
 	}
 
+	if v, ok := os.LookupEnv(EnvMagicsockDebugLogging); ok {
+		vBool, err := strconv.ParseBool(v)
+		if err != nil {
+			options.Logger.Debug(context.Background(), fmt.Sprintf("magicsock debug logging disabled due to invalid value %s=%q, use true or false", EnvMagicsockDebugLogging, v))
+		} else {
+			magicConn.SetDebugLoggingEnabled(vBool)
+			options.Logger.Debug(context.Background(), fmt.Sprintf("magicsock debug logging set by %s=%t", EnvMagicsockDebugLogging, vBool))
+		}
+	} else {
+		options.Logger.Debug(context.Background(), fmt.Sprintf("magicsock debug logging disabled, use %s=true to enable", EnvMagicsockDebugLogging))
+	}
+
 	// Update the keys for the magic connection!
 	err = magicConn.SetPrivateKey(nodePrivateKey)
 	if err != nil {
@@ -184,11 +247,11 @@ func NewConn(options *Options) (conn *Conn, err error) {
 
 	netStack, err := netstack.Create(
 		Logger(options.Logger.Named("net.netstack")),
-		tunDevice,
+		sys.Tun.Get(),
 		wireguardEngine,
 		magicConn,
 		dialer,
-		dnsManager,
+		sys.DNSManager.Get(),
 	)
 	if err != nil {
 		return nil, xerrors.Errorf("create netstack: %w", err)
@@ -222,6 +285,7 @@ func NewConn(options *Options) (conn *Conn, err error) {
 	dialContext, dialCancel := context.WithCancel(context.Background())
 	server := &Conn{
 		blockEndpoints:           options.BlockEndpoints,
+		derpForceWebSockets:      options.DERPForceWebSockets,
 		dialContext:              dialContext,
 		dialCancel:               dialCancel,
 		closed:                   make(chan struct{}),
@@ -230,8 +294,8 @@ func NewConn(options *Options) (conn *Conn, err error) {
 		dialer:                   dialer,
 		listeners:                map[listenKey]*listener{},
 		peerMap:                  map[tailcfg.NodeID]*tailcfg.Node{},
-		lastDERPForcedWebsockets: map[int]string{},
-		tunDevice:                tunDevice,
+		lastDERPForcedWebSockets: map[int]string{},
+		tunDevice:                sys.Tun.Get(),
 		netMap:                   netMap,
 		netStack:                 netStack,
 		wireguardMonitor:         wireguardMonitor,
@@ -283,17 +347,16 @@ func NewConn(options *Options) (conn *Conn, err error) {
 	magicConn.SetDERPForcedWebsocketCallback(func(region int, reason string) {
 		server.logger.Debug(context.Background(), "derp forced websocket", slog.F("region", region), slog.F("reason", reason))
 		server.lastMutex.Lock()
-		if server.lastDERPForcedWebsockets[region] == reason {
+		if server.lastDERPForcedWebSockets[region] == reason {
 			server.lastMutex.Unlock()
 			return
 		}
-		server.lastDERPForcedWebsockets[region] = reason
+		server.lastDERPForcedWebSockets[region] = reason
 		server.lastMutex.Unlock()
 		server.sendNode()
 	})
 
-	netStack.ForwardTCPIn = server.forwardTCP
-	netStack.ForwardTCPSockOpts = server.forwardTCPSockOpts
+	netStack.GetTCPHandlerForFlow = server.forwardTCP
 
 	err = netStack.Start(nil)
 	if err != nil {
@@ -329,12 +392,13 @@ func IPFromUUID(uid uuid.UUID) netip.Addr {
 
 // Conn is an actively listening Wireguard connection.
 type Conn struct {
-	dialContext    context.Context
-	dialCancel     context.CancelFunc
-	mutex          sync.Mutex
-	closed         chan struct{}
-	logger         slog.Logger
-	blockEndpoints bool
+	dialContext         context.Context
+	dialCancel          context.CancelFunc
+	mutex               sync.Mutex
+	closed              chan struct{}
+	logger              slog.Logger
+	blockEndpoints      bool
+	derpForceWebSockets bool
 
 	dialer           *tsdial.Dialer
 	tunDevice        *tstun.Wrapper
@@ -342,7 +406,7 @@ type Conn struct {
 	netMap           *netmap.NetworkMap
 	netStack         *netstack.Impl
 	magicConn        *magicsock.Conn
-	wireguardMonitor *monitor.Mon
+	wireguardMonitor *netmon.Monitor
 	wireguardRouter  *router.Config
 	wireguardEngine  wgengine.Engine
 	listeners        map[listenKey]*listener
@@ -354,13 +418,17 @@ type Conn struct {
 	// so the values must be stored for retrieval later on.
 	lastStatus               time.Time
 	lastEndpoints            []tailcfg.Endpoint
-	lastDERPForcedWebsockets map[int]string
+	lastDERPForcedWebSockets map[int]string
 	lastNetInfo              *tailcfg.NetInfo
 	nodeCallback             func(node *Node)
 
 	trafficStats *connstats.Statistics
 }
 
+func (c *Conn) MagicsockSetDebugLoggingEnabled(enabled bool) {
+	c.magicConn.SetDebugLoggingEnabled(enabled)
+}
+
 func (c *Conn) SetAddresses(ips []netip.Prefix) error {
 	c.mutex.Lock()
 	defer c.mutex.Unlock()
@@ -403,6 +471,10 @@ func (c *Conn) SetDERPMap(derpMap *tailcfg.DERPMap) {
 	c.wireguardEngine.SetNetworkMap(&netMapCopy)
 }
 
+func (c *Conn) SetDERPForceWebSockets(v bool) {
+	c.magicConn.SetDERPForceWebsockets(v)
+}
+
 // SetBlockEndpoints sets whether or not to block P2P endpoints. This setting
 // will only apply to new peers.
 func (c *Conn) SetBlockEndpoints(blockEndpoints bool) {
@@ -424,6 +496,11 @@ func (c *Conn) SetDERPRegionDialer(dialer func(ctx context.Context, region *tail
 func (c *Conn) UpdateNodes(nodes []*Node, replacePeers bool) error {
 	c.mutex.Lock()
 	defer c.mutex.Unlock()
+
+	if c.isClosed() {
+		return ErrConnClosed
+	}
+
 	status := c.Status()
 	if replacePeers {
 		c.netMap.Peers = []*tailcfg.Node{}
@@ -445,6 +522,10 @@ func (c *Conn) UpdateNodes(nodes []*Node, replacePeers bool) error {
 		if time.Since(peerStatus.LastHandshake) < 5*time.Minute {
 			continue
 		}
+
+		c.logger.Debug(context.Background(), "removing peer, last handshake >5m ago",
+			slog.F("peer", peer.Key), slog.F("last_handshake", peerStatus.LastHandshake),
+		)
 		delete(c.peerMap, peer.ID)
 	}
 
@@ -466,10 +547,16 @@ func (c *Conn) UpdateNodes(nodes []*Node, replacePeers bool) error {
 			AllowedIPs: node.AllowedIPs,
 			Endpoints:  node.Endpoints,
 			DERP:       fmt.Sprintf("%s:%d", tailcfg.DerpMagicIP, node.PreferredDERP),
-			Hostinfo:   hostinfo.New().View(),
-			// Starting KeepAlive messages at the initialization
-			// of a connection cause it to hang for an unknown
-			// reason. TODO: @kylecarbs debug this!
+			Hostinfo:   (&tailcfg.Hostinfo{}).View(),
+			// Starting KeepAlive messages at the initialization of a connection
+			// causes a race condition. If we handshake before the peer has our
+			// node, we'll have wait for 5 seconds before trying again. Ideally,
+			// the first handshake starts when the user first initiates a
+			// connection to the peer. After a successful connection we enable
+			// keep alives to persist the connection and keep it from becoming
+			// idle. SSH connections don't send send packets while idle, so we
+			// use keep alives to avoid random hangs while we set up the
+			// connection again after inactivity.
 			KeepAlive: ok && peerStatus.Active,
 		}
 		if c.blockEndpoints {
@@ -494,6 +581,56 @@ func (c *Conn) UpdateNodes(nodes []*Node, replacePeers bool) error {
 	return nil
 }
 
+// PeerSelector is used to select a peer from within a Tailnet.
+type PeerSelector struct {
+	ID tailcfg.NodeID
+	IP netip.Prefix
+}
+
+func (c *Conn) RemovePeer(selector PeerSelector) (deleted bool, err error) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	if c.isClosed() {
+		return false, ErrConnClosed
+	}
+
+	deleted = false
+	for _, peer := range c.peerMap {
+		if peer.ID == selector.ID {
+			delete(c.peerMap, peer.ID)
+			deleted = true
+			break
+		}
+
+		for _, peerIP := range peer.Addresses {
+			if peerIP.Bits() == selector.IP.Bits() && peerIP.Addr().Compare(selector.IP.Addr()) == 0 {
+				delete(c.peerMap, peer.ID)
+				deleted = true
+				break
+			}
+		}
+	}
+	if !deleted {
+		return false, nil
+	}
+
+	c.netMap.Peers = make([]*tailcfg.Node, 0, len(c.peerMap))
+	for _, peer := range c.peerMap {
+		c.netMap.Peers = append(c.netMap.Peers, peer.Clone())
+	}
+
+	netMapCopy := *c.netMap
+	c.logger.Debug(context.Background(), "updating network map")
+	c.wireguardEngine.SetNetworkMap(&netMapCopy)
+	err = c.reconfig()
+	if err != nil {
+		return false, xerrors.Errorf("reconfig: %w", err)
+	}
+
+	return true, nil
+}
+
 func (c *Conn) reconfig() error {
 	cfg, err := nmcfg.WGCfg(c.netMap, Logger(c.logger.Named("net.wgconfig")), netmap.AllowSingleHosts, "")
 	if err != nil {
@@ -730,14 +867,22 @@ func (c *Conn) selfNode() *Node {
 	if c.lastNetInfo != nil {
 		preferredDERP = c.lastNetInfo.PreferredDERP
 		derpLatency = c.lastNetInfo.DERPLatency
-		for k, v := range c.lastDERPForcedWebsockets {
-			derpForcedWebsocket[k] = v
+
+		if c.derpForceWebSockets {
+			// We only need to store this for a single region, since this is
+			// mostly used for debugging purposes and doesn't actually have a
+			// code purpose.
+			derpForcedWebsocket[preferredDERP] = "DERP is configured to always fallback to WebSockets"
+		} else {
+			for k, v := range c.lastDERPForcedWebSockets {
+				derpForcedWebsocket[k] = v
+			}
 		}
 	}
 
 	node := &Node{
 		ID:                  c.netMap.SelfNode.ID,
-		AsOf:                database.Now(),
+		AsOf:                dbtime.Now(),
 		Key:                 c.netMap.SelfNode.Key,
 		Addresses:           c.netMap.SelfNode.Addresses,
 		AllowedIPs:          c.netMap.SelfNode.AllowedIPs,
@@ -776,7 +921,7 @@ func (c *Conn) Listen(network, addr string) (net.Listener, error) {
 	c.mutex.Lock()
 	if c.isClosed() {
 		c.mutex.Unlock()
-		return nil, xerrors.New("closed")
+		return nil, ErrConnClosed
 	}
 	if c.listeners == nil {
 		c.listeners = map[listenKey]*listener{}
@@ -798,68 +943,36 @@ func (c *Conn) DialContextUDP(ctx context.Context, ipp netip.AddrPort) (*gonet.U
 	return c.netStack.DialContextUDP(ctx, ipp)
 }
 
-func (c *Conn) forwardTCP(conn net.Conn, port uint16) {
+func (c *Conn) forwardTCP(src, dst netip.AddrPort) (handler func(net.Conn), opts []tcpip.SettableSocketOption, intercept bool) {
+	logger := c.logger.Named("tcp").With(slog.F("src", src.String()), slog.F("dst", dst.String()))
 	c.mutex.Lock()
-	ln, ok := c.listeners[listenKey{"tcp", "", fmt.Sprint(port)}]
+	ln, ok := c.listeners[listenKey{"tcp", "", fmt.Sprint(dst.Port())}]
 	c.mutex.Unlock()
 	if !ok {
-		c.forwardTCPToLocal(conn, port)
-		return
+		return nil, nil, false
 	}
-
-	t := time.NewTimer(time.Second)
-	defer t.Stop()
-	select {
-	case ln.conn <- conn:
-		return
-	case <-ln.closed:
-	case <-c.closed:
-	case <-t.C:
-	}
-	_ = conn.Close()
-}
-
-func (*Conn) forwardTCPSockOpts(port uint16) []tcpip.SettableSocketOption {
-	opts := []tcpip.SettableSocketOption{}
-
 	// See: https://github.com/tailscale/tailscale/blob/c7cea825aea39a00aca71ea02bab7266afc03e7c/wgengine/netstack/netstack.go#L888
-	if port == WorkspaceAgentSSHPort || port == 22 {
-		opt := tcpip.KeepaliveIdleOption(72*time.Hour + time.Minute) // Default ssh-max-timeout is 72h, so let's add some extra time.
+	if dst.Port() == WorkspaceAgentSSHPort || dst.Port() == 22 {
+		opt := tcpip.KeepaliveIdleOption(72 * time.Hour)
 		opts = append(opts, &opt)
 	}
 
-	return opts
-}
-
-func (c *Conn) forwardTCPToLocal(conn net.Conn, port uint16) {
-	defer conn.Close()
-	dialAddrStr := net.JoinHostPort("127.0.0.1", strconv.Itoa(int(port)))
-	var stdDialer net.Dialer
-	server, err := stdDialer.DialContext(c.dialContext, "tcp", dialAddrStr)
-	if err != nil {
-		c.logger.Debug(c.dialContext, "dial local port", slog.F("port", port), slog.Error(err))
-		return
-	}
-	defer server.Close()
-
-	connClosed := make(chan error, 2)
-	go func() {
-		_, err := io.Copy(server, conn)
-		connClosed <- err
-	}()
-	go func() {
-		_, err := io.Copy(conn, server)
-		connClosed <- err
-	}()
-	select {
-	case err = <-connClosed:
-	case <-c.closed:
-		return
-	}
-	if err != nil {
-		c.logger.Debug(c.dialContext, "proxy connection closed with error", slog.Error(err))
-	}
-	c.logger.Debug(c.dialContext, "forwarded connection closed", slog.F("local_addr", dialAddrStr))
+	return func(conn net.Conn) {
+		t := time.NewTimer(time.Second)
+		defer t.Stop()
+		select {
+		case ln.conn <- conn:
+			logger.Info(context.Background(), "accepted connection")
+			return
+		case <-ln.closed:
+			logger.Info(context.Background(), "listener closed; closing connection")
+		case <-c.closed:
+			logger.Info(context.Background(), "tailnet closed; closing connection")
+		case <-t.C:
+			logger.Info(context.Background(), "listener timed out accepting; closing connection")
+		}
+		_ = conn.Close()
+	}, opts, true
 }
 
 // SetConnStatsCallback sets a callback to be called after maxPeriod or
diff --git a/tailnet/conn_test.go b/tailnet/conn_test.go
index 99a88fabb2263..7554c94cec682 100644
--- a/tailnet/conn_test.go
+++ b/tailnet/conn_test.go
@@ -11,9 +11,9 @@ import (
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/tailnet"
-	"github.com/coder/coder/tailnet/tailnettest"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/tailnet/tailnettest"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
@@ -99,7 +99,7 @@ func TestTailnet(t *testing.T) {
 
 	t.Run("ForcesWebSockets", func(t *testing.T) {
 		t.Parallel()
-		ctx := testutil.Context(t, testutil.WaitLong)
+		ctx := testutil.Context(t, testutil.WaitMedium)
 
 		w1IP := tailnet.IP()
 		derpMap := tailnettest.RunDERPOnlyWebSockets(t)
diff --git a/tailnet/coordinator.go b/tailnet/coordinator.go
index d37ea5c290b5f..41a75f1fc5e78 100644
--- a/tailnet/coordinator.go
+++ b/tailnet/coordinator.go
@@ -21,6 +21,7 @@ import (
 	"tailscale.com/types/key"
 
 	"cdr.dev/slog"
+	"github.com/coder/coder/v2/coderd/util/slice"
 )
 
 // Coordinator exchanges nodes with agents to establish connections.
@@ -145,7 +146,7 @@ func (c *coordinator) ServeMultiAgent(id uuid.UUID) MultiAgentConn {
 		OnSubscribe:       c.core.clientSubscribeToAgent,
 		OnUnsubscribe:     c.core.clientUnsubscribeFromAgent,
 		OnNodeUpdate:      c.core.clientNodeUpdate,
-		OnRemove:          c.core.clientDisconnected,
+		OnRemove:          func(enq Queue) { c.core.clientDisconnected(enq.UniqueID()) },
 	}).Init()
 	c.core.addClient(id, m)
 	return m
@@ -190,8 +191,16 @@ type core struct {
 	legacyAgents map[uuid.UUID]struct{}
 }
 
+type QueueKind int
+
+const (
+	QueueKindClient QueueKind = 1 + iota
+	QueueKindAgent
+)
+
 type Queue interface {
 	UniqueID() uuid.UUID
+	Kind() QueueKind
 	Enqueue(n []*Node) error
 	Name() string
 	Stats() (start, lastWrite int64)
@@ -199,6 +208,7 @@ type Queue interface {
 	// CoordinatorClose is used by the coordinator when closing a Queue. It
 	// should skip removing itself from the coordinator.
 	CoordinatorClose() error
+	Done() <-chan struct{}
 	Close() error
 }
 
@@ -263,7 +273,7 @@ func (c *coordinator) ServeClient(conn net.Conn, id, agentID uuid.UUID) error {
 	logger := c.core.clientLogger(id, agentID)
 	logger.Debug(ctx, "coordinating client")
 
-	tc := NewTrackedConn(ctx, cancel, conn, id, logger, id.String(), 0)
+	tc := NewTrackedConn(ctx, cancel, conn, id, logger, id.String(), 0, QueueKindClient)
 	defer tc.Close()
 
 	c.core.addClient(id, tc)
@@ -508,7 +518,7 @@ func (c *core) initAndTrackAgent(ctx context.Context, cancel func(), conn net.Co
 		overwrites = oldAgentSocket.Overwrites() + 1
 		_ = oldAgentSocket.Close()
 	}
-	tc := NewTrackedConn(ctx, cancel, conn, unique, logger, name, overwrites)
+	tc := NewTrackedConn(ctx, cancel, conn, unique, logger, name, overwrites, QueueKindAgent)
 	c.agentNameCache.Add(id, name)
 
 	sockets, ok := c.agentToConnectionSockets[id]
@@ -683,14 +693,14 @@ func HTTPDebugFromLocal(
 				LastWriteAge: now.Sub(time.Unix(lastWrite, 0)).Round(time.Second),
 			})
 		}
-		slices.SortFunc(agent.Connections, func(a, b *HTMLClient) bool {
-			return a.Name < b.Name
+		slices.SortFunc(agent.Connections, func(a, b *HTMLClient) int {
+			return slice.Ascending(a.Name, b.Name)
 		})
 
 		data.Agents = append(data.Agents, agent)
 	}
-	slices.SortFunc(data.Agents, func(a, b *HTMLAgent) bool {
-		return a.Name < b.Name
+	slices.SortFunc(data.Agents, func(a, b *HTMLAgent) int {
+		return slice.Ascending(a.Name, b.Name)
 	})
 
 	for agentID, conns := range agentToConnectionSocketsMap {
@@ -719,14 +729,14 @@ func HTTPDebugFromLocal(
 				LastWriteAge: now.Sub(time.Unix(lastWrite, 0)).Round(time.Second),
 			})
 		}
-		slices.SortFunc(agent.Connections, func(a, b *HTMLClient) bool {
-			return a.Name < b.Name
+		slices.SortFunc(agent.Connections, func(a, b *HTMLClient) int {
+			return slice.Ascending(a.Name, b.Name)
 		})
 
 		data.MissingAgents = append(data.MissingAgents, agent)
 	}
-	slices.SortFunc(data.MissingAgents, func(a, b *HTMLAgent) bool {
-		return a.Name < b.Name
+	slices.SortFunc(data.MissingAgents, func(a, b *HTMLAgent) int {
+		return slice.Ascending(a.Name, b.Name)
 	})
 
 	for id, node := range nodesMap {
@@ -737,8 +747,8 @@ func HTTPDebugFromLocal(
 			Node: node,
 		})
 	}
-	slices.SortFunc(data.Nodes, func(a, b *HTMLNode) bool {
-		return a.Name+a.ID.String() < b.Name+b.ID.String()
+	slices.SortFunc(data.Nodes, func(a, b *HTMLNode) int {
+		return slice.Ascending(a.Name+a.ID.String(), b.Name+b.ID.String())
 	})
 
 	return data
diff --git a/tailnet/coordinator_test.go b/tailnet/coordinator_test.go
index 300a89ad5f9e0..1435af3688f5e 100644
--- a/tailnet/coordinator_test.go
+++ b/tailnet/coordinator_test.go
@@ -18,8 +18,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/tailnet"
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/tailnet"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestCoordinator(t *testing.T) {
diff --git a/tailnet/derpmap.go b/tailnet/derpmap.go
index aa79300801d71..817ef6a79dd78 100644
--- a/tailnet/derpmap.go
+++ b/tailnet/derpmap.go
@@ -13,11 +13,13 @@ import (
 	"tailscale.com/tailcfg"
 )
 
-func STUNNodes(regionID int, stunAddrs []string) ([]*tailcfg.DERPNode, error) {
-	nodes := []*tailcfg.DERPNode{}
+const DisableSTUN = "disable"
+
+func STUNRegions(baseRegionID int, stunAddrs []string) ([]*tailcfg.DERPRegion, error) {
+	regions := make([]*tailcfg.DERPRegion, 0, len(stunAddrs))
 	for index, stunAddr := range stunAddrs {
-		if stunAddr == "disable" {
-			return []*tailcfg.DERPNode{}, nil
+		if stunAddr == DisableSTUN {
+			return []*tailcfg.DERPRegion{}, nil
 		}
 
 		host, rawPort, err := net.SplitHostPort(stunAddr)
@@ -28,16 +30,24 @@ func STUNNodes(regionID int, stunAddrs []string) ([]*tailcfg.DERPNode, error) {
 		if err != nil {
 			return nil, xerrors.Errorf("parse port for %q: %w", stunAddr, err)
 		}
-		nodes = append([]*tailcfg.DERPNode{{
-			Name:     fmt.Sprintf("%dstun%d", regionID, index),
-			RegionID: regionID,
-			HostName: host,
-			STUNOnly: true,
-			STUNPort: port,
-		}}, nodes...)
+
+		regionID := baseRegionID + index + 1
+		regions = append(regions, &tailcfg.DERPRegion{
+			EmbeddedRelay: false,
+			RegionID:      regionID,
+			RegionCode:    fmt.Sprintf("coder_stun_%d", regionID),
+			RegionName:    fmt.Sprintf("Coder STUN %d", regionID),
+			Nodes: []*tailcfg.DERPNode{{
+				Name:     fmt.Sprintf("%dstun0", regionID),
+				RegionID: regionID,
+				HostName: host,
+				STUNOnly: true,
+				STUNPort: port,
+			}},
+		})
 	}
 
-	return nodes, nil
+	return regions, nil
 }
 
 // NewDERPMap constructs a DERPMap from a set of STUN addresses and optionally a remote
@@ -52,13 +62,17 @@ func NewDERPMap(ctx context.Context, region *tailcfg.DERPRegion, stunAddrs []str
 		stunAddrs = nil
 	}
 
+	// stunAddrs only applies when a default region is set. Each STUN node gets
+	// it's own region ID because netcheck will only try a single STUN server in
+	// each region before canceling the region's STUN check.
+	addRegions := []*tailcfg.DERPRegion{}
 	if region != nil {
-		stunNodes, err := STUNNodes(region.RegionID, stunAddrs)
+		addRegions = append(addRegions, region)
+		stunRegions, err := STUNRegions(region.RegionID, stunAddrs)
 		if err != nil {
-			return nil, xerrors.Errorf("construct stun nodes: %w", err)
+			return nil, xerrors.Errorf("create stun regions: %w", err)
 		}
-
-		region.Nodes = append(stunNodes, region.Nodes...)
+		addRegions = append(addRegions, stunRegions...)
 	}
 
 	derpMap := &tailcfg.DERPMap{
@@ -89,13 +103,18 @@ func NewDERPMap(ctx context.Context, region *tailcfg.DERPRegion, stunAddrs []str
 			return nil, xerrors.Errorf("unmarshal derpmap: %w", err)
 		}
 	}
-	if region != nil {
-		_, conflicts := derpMap.Regions[region.RegionID]
-		if conflicts {
-			return nil, xerrors.Errorf("the default region ID conflicts with a remote region from %q", remoteURL)
+
+	// Add our custom regions to the DERP map.
+	if len(addRegions) > 0 {
+		for _, region := range addRegions {
+			_, conflicts := derpMap.Regions[region.RegionID]
+			if conflicts {
+				return nil, xerrors.Errorf("a default region ID %d (%s - %q) conflicts with a remote region from %q", region.RegionID, region.RegionCode, region.RegionName, remoteURL)
+			}
+			derpMap.Regions[region.RegionID] = region
 		}
-		derpMap.Regions[region.RegionID] = region
 	}
+
 	// Remove all STUNPorts from DERPy nodes, and fully remove all STUNOnly
 	// nodes.
 	if disableSTUN {
diff --git a/tailnet/derpmap_test.go b/tailnet/derpmap_test.go
index bc5205cc45cf4..cdcea8e236c77 100644
--- a/tailnet/derpmap_test.go
+++ b/tailnet/derpmap_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"tailscale.com/tailcfg"
 
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/tailnet"
 )
 
 func TestNewDERPMap(t *testing.T) {
@@ -24,7 +24,9 @@ func TestNewDERPMap(t *testing.T) {
 			Nodes:    []*tailcfg.DERPNode{{}},
 		}, []string{"stun.google.com:2345"}, "", "", false)
 		require.NoError(t, err)
-		require.Len(t, derpMap.Regions[1].Nodes, 2)
+		require.Len(t, derpMap.Regions, 2)
+		require.Len(t, derpMap.Regions[1].Nodes, 1)
+		require.Len(t, derpMap.Regions[2].Nodes, 1)
 	})
 	t.Run("RemoteURL", func(t *testing.T) {
 		t.Parallel()
diff --git a/tailnet/multiagent.go b/tailnet/multiagent.go
index ee76e4b88d8aa..5c3412a595152 100644
--- a/tailnet/multiagent.go
+++ b/tailnet/multiagent.go
@@ -29,9 +29,12 @@ type MultiAgent struct {
 	OnSubscribe       func(enq Queue, agent uuid.UUID) (*Node, error)
 	OnUnsubscribe     func(enq Queue, agent uuid.UUID) error
 	OnNodeUpdate      func(id uuid.UUID, node *Node) error
-	OnRemove          func(id uuid.UUID)
+	OnRemove          func(enq Queue)
 
+	ctx       context.Context
+	ctxCancel func()
 	closed    bool
+
 	updates   chan []*Node
 	closeOnce sync.Once
 	start     int64
@@ -44,9 +47,14 @@ type MultiAgent struct {
 func (m *MultiAgent) Init() *MultiAgent {
 	m.updates = make(chan []*Node, 128)
 	m.start = time.Now().Unix()
+	m.ctx, m.ctxCancel = context.WithCancel(context.Background())
 	return m
 }
 
+func (*MultiAgent) Kind() QueueKind {
+	return QueueKindClient
+}
+
 func (m *MultiAgent) UniqueID() uuid.UUID {
 	return m.ID
 }
@@ -156,8 +164,13 @@ func (m *MultiAgent) CoordinatorClose() error {
 	return nil
 }
 
+func (m *MultiAgent) Done() <-chan struct{} {
+	return m.ctx.Done()
+}
+
 func (m *MultiAgent) Close() error {
 	_ = m.CoordinatorClose()
-	m.closeOnce.Do(func() { m.OnRemove(m.ID) })
+	m.ctxCancel()
+	m.closeOnce.Do(func() { m.OnRemove(m) })
 	return nil
 }
diff --git a/tailnet/proto/tailnet.pb.go b/tailnet/proto/tailnet.pb.go
new file mode 100644
index 0000000000000..c5318fa7df5d4
--- /dev/null
+++ b/tailnet/proto/tailnet.pb.go
@@ -0,0 +1,1295 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.30.0
+// 	protoc        v4.23.3
+// source: tailnet/proto/tailnet.proto
+
+package proto
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type CoordinateResponse_PeerUpdate_Kind int32
+
+const (
+	CoordinateResponse_PeerUpdate_KIND_UNSPECIFIED CoordinateResponse_PeerUpdate_Kind = 0
+	CoordinateResponse_PeerUpdate_NODE             CoordinateResponse_PeerUpdate_Kind = 1
+	CoordinateResponse_PeerUpdate_DISCONNECTED     CoordinateResponse_PeerUpdate_Kind = 2
+	CoordinateResponse_PeerUpdate_LOST             CoordinateResponse_PeerUpdate_Kind = 3
+)
+
+// Enum value maps for CoordinateResponse_PeerUpdate_Kind.
+var (
+	CoordinateResponse_PeerUpdate_Kind_name = map[int32]string{
+		0: "KIND_UNSPECIFIED",
+		1: "NODE",
+		2: "DISCONNECTED",
+		3: "LOST",
+	}
+	CoordinateResponse_PeerUpdate_Kind_value = map[string]int32{
+		"KIND_UNSPECIFIED": 0,
+		"NODE":             1,
+		"DISCONNECTED":     2,
+		"LOST":             3,
+	}
+)
+
+func (x CoordinateResponse_PeerUpdate_Kind) Enum() *CoordinateResponse_PeerUpdate_Kind {
+	p := new(CoordinateResponse_PeerUpdate_Kind)
+	*p = x
+	return p
+}
+
+func (x CoordinateResponse_PeerUpdate_Kind) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (CoordinateResponse_PeerUpdate_Kind) Descriptor() protoreflect.EnumDescriptor {
+	return file_tailnet_proto_tailnet_proto_enumTypes[0].Descriptor()
+}
+
+func (CoordinateResponse_PeerUpdate_Kind) Type() protoreflect.EnumType {
+	return &file_tailnet_proto_tailnet_proto_enumTypes[0]
+}
+
+func (x CoordinateResponse_PeerUpdate_Kind) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use CoordinateResponse_PeerUpdate_Kind.Descriptor instead.
+func (CoordinateResponse_PeerUpdate_Kind) EnumDescriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{4, 0, 0}
+}
+
+type DERPMap struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	HomeParams *DERPMap_HomeParams       `protobuf:"bytes,1,opt,name=home_params,json=homeParams,proto3" json:"home_params,omitempty"`
+	Regions    map[int32]*DERPMap_Region `protobuf:"bytes,2,rep,name=regions,proto3" json:"regions,omitempty" protobuf_key:"varint,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *DERPMap) Reset() {
+	*x = DERPMap{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tailnet_proto_tailnet_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DERPMap) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DERPMap) ProtoMessage() {}
+
+func (x *DERPMap) ProtoReflect() protoreflect.Message {
+	mi := &file_tailnet_proto_tailnet_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DERPMap.ProtoReflect.Descriptor instead.
+func (*DERPMap) Descriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *DERPMap) GetHomeParams() *DERPMap_HomeParams {
+	if x != nil {
+		return x.HomeParams
+	}
+	return nil
+}
+
+func (x *DERPMap) GetRegions() map[int32]*DERPMap_Region {
+	if x != nil {
+		return x.Regions
+	}
+	return nil
+}
+
+type StreamDERPMapsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *StreamDERPMapsRequest) Reset() {
+	*x = StreamDERPMapsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tailnet_proto_tailnet_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StreamDERPMapsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamDERPMapsRequest) ProtoMessage() {}
+
+func (x *StreamDERPMapsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_tailnet_proto_tailnet_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamDERPMapsRequest.ProtoReflect.Descriptor instead.
+func (*StreamDERPMapsRequest) Descriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{1}
+}
+
+// defined in tailnet/coordinator.go
+type Node struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id                  int64                  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	AsOf                *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=as_of,json=asOf,proto3" json:"as_of,omitempty"`
+	Key                 []byte                 `protobuf:"bytes,3,opt,name=key,proto3" json:"key,omitempty"`
+	Disco               string                 `protobuf:"bytes,4,opt,name=disco,proto3" json:"disco,omitempty"`
+	PreferredDerp       int32                  `protobuf:"varint,5,opt,name=preferred_derp,json=preferredDerp,proto3" json:"preferred_derp,omitempty"`
+	DerpLatency         map[string]float64     `protobuf:"bytes,6,rep,name=derp_latency,json=derpLatency,proto3" json:"derp_latency,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"fixed64,2,opt,name=value,proto3"`
+	DerpForcedWebsocket map[int32]string       `protobuf:"bytes,7,rep,name=derp_forced_websocket,json=derpForcedWebsocket,proto3" json:"derp_forced_websocket,omitempty" protobuf_key:"varint,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Addresses           []string               `protobuf:"bytes,8,rep,name=addresses,proto3" json:"addresses,omitempty"`
+	AllowedIps          []string               `protobuf:"bytes,9,rep,name=allowed_ips,json=allowedIps,proto3" json:"allowed_ips,omitempty"`
+	Endpoints           []string               `protobuf:"bytes,10,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
+}
+
+func (x *Node) Reset() {
+	*x = Node{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tailnet_proto_tailnet_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Node) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Node) ProtoMessage() {}
+
+func (x *Node) ProtoReflect() protoreflect.Message {
+	mi := &file_tailnet_proto_tailnet_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Node.ProtoReflect.Descriptor instead.
+func (*Node) Descriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *Node) GetId() int64 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+func (x *Node) GetAsOf() *timestamppb.Timestamp {
+	if x != nil {
+		return x.AsOf
+	}
+	return nil
+}
+
+func (x *Node) GetKey() []byte {
+	if x != nil {
+		return x.Key
+	}
+	return nil
+}
+
+func (x *Node) GetDisco() string {
+	if x != nil {
+		return x.Disco
+	}
+	return ""
+}
+
+func (x *Node) GetPreferredDerp() int32 {
+	if x != nil {
+		return x.PreferredDerp
+	}
+	return 0
+}
+
+func (x *Node) GetDerpLatency() map[string]float64 {
+	if x != nil {
+		return x.DerpLatency
+	}
+	return nil
+}
+
+func (x *Node) GetDerpForcedWebsocket() map[int32]string {
+	if x != nil {
+		return x.DerpForcedWebsocket
+	}
+	return nil
+}
+
+func (x *Node) GetAddresses() []string {
+	if x != nil {
+		return x.Addresses
+	}
+	return nil
+}
+
+func (x *Node) GetAllowedIps() []string {
+	if x != nil {
+		return x.AllowedIps
+	}
+	return nil
+}
+
+func (x *Node) GetEndpoints() []string {
+	if x != nil {
+		return x.Endpoints
+	}
+	return nil
+}
+
+type CoordinateRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	UpdateSelf   *CoordinateRequest_UpdateSelf `protobuf:"bytes,1,opt,name=update_self,json=updateSelf,proto3" json:"update_self,omitempty"`
+	Disconnect   *CoordinateRequest_Disconnect `protobuf:"bytes,2,opt,name=disconnect,proto3" json:"disconnect,omitempty"`
+	AddTunnel    *CoordinateRequest_Tunnel     `protobuf:"bytes,3,opt,name=add_tunnel,json=addTunnel,proto3" json:"add_tunnel,omitempty"`
+	RemoveTunnel *CoordinateRequest_Tunnel     `protobuf:"bytes,4,opt,name=remove_tunnel,json=removeTunnel,proto3" json:"remove_tunnel,omitempty"`
+}
+
+func (x *CoordinateRequest) Reset() {
+	*x = CoordinateRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tailnet_proto_tailnet_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CoordinateRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CoordinateRequest) ProtoMessage() {}
+
+func (x *CoordinateRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_tailnet_proto_tailnet_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CoordinateRequest.ProtoReflect.Descriptor instead.
+func (*CoordinateRequest) Descriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *CoordinateRequest) GetUpdateSelf() *CoordinateRequest_UpdateSelf {
+	if x != nil {
+		return x.UpdateSelf
+	}
+	return nil
+}
+
+func (x *CoordinateRequest) GetDisconnect() *CoordinateRequest_Disconnect {
+	if x != nil {
+		return x.Disconnect
+	}
+	return nil
+}
+
+func (x *CoordinateRequest) GetAddTunnel() *CoordinateRequest_Tunnel {
+	if x != nil {
+		return x.AddTunnel
+	}
+	return nil
+}
+
+func (x *CoordinateRequest) GetRemoveTunnel() *CoordinateRequest_Tunnel {
+	if x != nil {
+		return x.RemoveTunnel
+	}
+	return nil
+}
+
+type CoordinateResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PeerUpdates []*CoordinateResponse_PeerUpdate `protobuf:"bytes,1,rep,name=peer_updates,json=peerUpdates,proto3" json:"peer_updates,omitempty"`
+}
+
+func (x *CoordinateResponse) Reset() {
+	*x = CoordinateResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tailnet_proto_tailnet_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CoordinateResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CoordinateResponse) ProtoMessage() {}
+
+func (x *CoordinateResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_tailnet_proto_tailnet_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CoordinateResponse.ProtoReflect.Descriptor instead.
+func (*CoordinateResponse) Descriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *CoordinateResponse) GetPeerUpdates() []*CoordinateResponse_PeerUpdate {
+	if x != nil {
+		return x.PeerUpdates
+	}
+	return nil
+}
+
+type DERPMap_HomeParams struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	RegionScore map[int32]float64 `protobuf:"bytes,1,rep,name=region_score,json=regionScore,proto3" json:"region_score,omitempty" protobuf_key:"varint,1,opt,name=key,proto3" protobuf_val:"fixed64,2,opt,name=value,proto3"`
+}
+
+func (x *DERPMap_HomeParams) Reset() {
+	*x = DERPMap_HomeParams{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tailnet_proto_tailnet_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DERPMap_HomeParams) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DERPMap_HomeParams) ProtoMessage() {}
+
+func (x *DERPMap_HomeParams) ProtoReflect() protoreflect.Message {
+	mi := &file_tailnet_proto_tailnet_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DERPMap_HomeParams.ProtoReflect.Descriptor instead.
+func (*DERPMap_HomeParams) Descriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *DERPMap_HomeParams) GetRegionScore() map[int32]float64 {
+	if x != nil {
+		return x.RegionScore
+	}
+	return nil
+}
+
+type DERPMap_Region struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	RegionId      int32                  `protobuf:"varint,1,opt,name=region_id,json=regionId,proto3" json:"region_id,omitempty"`
+	EmbeddedRelay bool                   `protobuf:"varint,2,opt,name=embedded_relay,json=embeddedRelay,proto3" json:"embedded_relay,omitempty"`
+	RegionCode    string                 `protobuf:"bytes,3,opt,name=region_code,json=regionCode,proto3" json:"region_code,omitempty"`
+	RegionName    string                 `protobuf:"bytes,4,opt,name=region_name,json=regionName,proto3" json:"region_name,omitempty"`
+	Avoid         bool                   `protobuf:"varint,5,opt,name=avoid,proto3" json:"avoid,omitempty"`
+	Nodes         []*DERPMap_Region_Node `protobuf:"bytes,6,rep,name=nodes,proto3" json:"nodes,omitempty"`
+}
+
+func (x *DERPMap_Region) Reset() {
+	*x = DERPMap_Region{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tailnet_proto_tailnet_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DERPMap_Region) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DERPMap_Region) ProtoMessage() {}
+
+func (x *DERPMap_Region) ProtoReflect() protoreflect.Message {
+	mi := &file_tailnet_proto_tailnet_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DERPMap_Region.ProtoReflect.Descriptor instead.
+func (*DERPMap_Region) Descriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{0, 1}
+}
+
+func (x *DERPMap_Region) GetRegionId() int32 {
+	if x != nil {
+		return x.RegionId
+	}
+	return 0
+}
+
+func (x *DERPMap_Region) GetEmbeddedRelay() bool {
+	if x != nil {
+		return x.EmbeddedRelay
+	}
+	return false
+}
+
+func (x *DERPMap_Region) GetRegionCode() string {
+	if x != nil {
+		return x.RegionCode
+	}
+	return ""
+}
+
+func (x *DERPMap_Region) GetRegionName() string {
+	if x != nil {
+		return x.RegionName
+	}
+	return ""
+}
+
+func (x *DERPMap_Region) GetAvoid() bool {
+	if x != nil {
+		return x.Avoid
+	}
+	return false
+}
+
+func (x *DERPMap_Region) GetNodes() []*DERPMap_Region_Node {
+	if x != nil {
+		return x.Nodes
+	}
+	return nil
+}
+
+type DERPMap_Region_Node struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name             string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	RegionId         int32  `protobuf:"varint,2,opt,name=region_id,json=regionId,proto3" json:"region_id,omitempty"`
+	HostName         string `protobuf:"bytes,3,opt,name=host_name,json=hostName,proto3" json:"host_name,omitempty"`
+	CertName         string `protobuf:"bytes,4,opt,name=cert_name,json=certName,proto3" json:"cert_name,omitempty"`
+	Ipv4             string `protobuf:"bytes,5,opt,name=ipv4,proto3" json:"ipv4,omitempty"`
+	Ipv6             string `protobuf:"bytes,6,opt,name=ipv6,proto3" json:"ipv6,omitempty"`
+	StunPort         int32  `protobuf:"varint,7,opt,name=stun_port,json=stunPort,proto3" json:"stun_port,omitempty"`
+	StunOnly         bool   `protobuf:"varint,8,opt,name=stun_only,json=stunOnly,proto3" json:"stun_only,omitempty"`
+	DerpPort         int32  `protobuf:"varint,9,opt,name=derp_port,json=derpPort,proto3" json:"derp_port,omitempty"`
+	InsecureForTests bool   `protobuf:"varint,10,opt,name=insecure_for_tests,json=insecureForTests,proto3" json:"insecure_for_tests,omitempty"`
+	ForceHttp        bool   `protobuf:"varint,11,opt,name=force_http,json=forceHttp,proto3" json:"force_http,omitempty"`
+	StunTestIp       string `protobuf:"bytes,12,opt,name=stun_test_ip,json=stunTestIp,proto3" json:"stun_test_ip,omitempty"`
+	CanPort_80       bool   `protobuf:"varint,13,opt,name=can_port_80,json=canPort80,proto3" json:"can_port_80,omitempty"`
+}
+
+func (x *DERPMap_Region_Node) Reset() {
+	*x = DERPMap_Region_Node{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tailnet_proto_tailnet_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DERPMap_Region_Node) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DERPMap_Region_Node) ProtoMessage() {}
+
+func (x *DERPMap_Region_Node) ProtoReflect() protoreflect.Message {
+	mi := &file_tailnet_proto_tailnet_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DERPMap_Region_Node.ProtoReflect.Descriptor instead.
+func (*DERPMap_Region_Node) Descriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{0, 1, 0}
+}
+
+func (x *DERPMap_Region_Node) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *DERPMap_Region_Node) GetRegionId() int32 {
+	if x != nil {
+		return x.RegionId
+	}
+	return 0
+}
+
+func (x *DERPMap_Region_Node) GetHostName() string {
+	if x != nil {
+		return x.HostName
+	}
+	return ""
+}
+
+func (x *DERPMap_Region_Node) GetCertName() string {
+	if x != nil {
+		return x.CertName
+	}
+	return ""
+}
+
+func (x *DERPMap_Region_Node) GetIpv4() string {
+	if x != nil {
+		return x.Ipv4
+	}
+	return ""
+}
+
+func (x *DERPMap_Region_Node) GetIpv6() string {
+	if x != nil {
+		return x.Ipv6
+	}
+	return ""
+}
+
+func (x *DERPMap_Region_Node) GetStunPort() int32 {
+	if x != nil {
+		return x.StunPort
+	}
+	return 0
+}
+
+func (x *DERPMap_Region_Node) GetStunOnly() bool {
+	if x != nil {
+		return x.StunOnly
+	}
+	return false
+}
+
+func (x *DERPMap_Region_Node) GetDerpPort() int32 {
+	if x != nil {
+		return x.DerpPort
+	}
+	return 0
+}
+
+func (x *DERPMap_Region_Node) GetInsecureForTests() bool {
+	if x != nil {
+		return x.InsecureForTests
+	}
+	return false
+}
+
+func (x *DERPMap_Region_Node) GetForceHttp() bool {
+	if x != nil {
+		return x.ForceHttp
+	}
+	return false
+}
+
+func (x *DERPMap_Region_Node) GetStunTestIp() string {
+	if x != nil {
+		return x.StunTestIp
+	}
+	return ""
+}
+
+func (x *DERPMap_Region_Node) GetCanPort_80() bool {
+	if x != nil {
+		return x.CanPort_80
+	}
+	return false
+}
+
+type CoordinateRequest_UpdateSelf struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Node *Node `protobuf:"bytes,1,opt,name=node,proto3" json:"node,omitempty"`
+}
+
+func (x *CoordinateRequest_UpdateSelf) Reset() {
+	*x = CoordinateRequest_UpdateSelf{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tailnet_proto_tailnet_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CoordinateRequest_UpdateSelf) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CoordinateRequest_UpdateSelf) ProtoMessage() {}
+
+func (x *CoordinateRequest_UpdateSelf) ProtoReflect() protoreflect.Message {
+	mi := &file_tailnet_proto_tailnet_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CoordinateRequest_UpdateSelf.ProtoReflect.Descriptor instead.
+func (*CoordinateRequest_UpdateSelf) Descriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{3, 0}
+}
+
+func (x *CoordinateRequest_UpdateSelf) GetNode() *Node {
+	if x != nil {
+		return x.Node
+	}
+	return nil
+}
+
+type CoordinateRequest_Disconnect struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *CoordinateRequest_Disconnect) Reset() {
+	*x = CoordinateRequest_Disconnect{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tailnet_proto_tailnet_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CoordinateRequest_Disconnect) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CoordinateRequest_Disconnect) ProtoMessage() {}
+
+func (x *CoordinateRequest_Disconnect) ProtoReflect() protoreflect.Message {
+	mi := &file_tailnet_proto_tailnet_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CoordinateRequest_Disconnect.ProtoReflect.Descriptor instead.
+func (*CoordinateRequest_Disconnect) Descriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{3, 1}
+}
+
+type CoordinateRequest_Tunnel struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Uuid []byte `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+}
+
+func (x *CoordinateRequest_Tunnel) Reset() {
+	*x = CoordinateRequest_Tunnel{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tailnet_proto_tailnet_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CoordinateRequest_Tunnel) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CoordinateRequest_Tunnel) ProtoMessage() {}
+
+func (x *CoordinateRequest_Tunnel) ProtoReflect() protoreflect.Message {
+	mi := &file_tailnet_proto_tailnet_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CoordinateRequest_Tunnel.ProtoReflect.Descriptor instead.
+func (*CoordinateRequest_Tunnel) Descriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{3, 2}
+}
+
+func (x *CoordinateRequest_Tunnel) GetUuid() []byte {
+	if x != nil {
+		return x.Uuid
+	}
+	return nil
+}
+
+type CoordinateResponse_PeerUpdate struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Uuid   []byte                             `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	Node   *Node                              `protobuf:"bytes,2,opt,name=node,proto3" json:"node,omitempty"`
+	Kind   CoordinateResponse_PeerUpdate_Kind `protobuf:"varint,3,opt,name=kind,proto3,enum=coder.tailnet.v2.CoordinateResponse_PeerUpdate_Kind" json:"kind,omitempty"`
+	Reason string                             `protobuf:"bytes,4,opt,name=reason,proto3" json:"reason,omitempty"`
+}
+
+func (x *CoordinateResponse_PeerUpdate) Reset() {
+	*x = CoordinateResponse_PeerUpdate{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_tailnet_proto_tailnet_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CoordinateResponse_PeerUpdate) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CoordinateResponse_PeerUpdate) ProtoMessage() {}
+
+func (x *CoordinateResponse_PeerUpdate) ProtoReflect() protoreflect.Message {
+	mi := &file_tailnet_proto_tailnet_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CoordinateResponse_PeerUpdate.ProtoReflect.Descriptor instead.
+func (*CoordinateResponse_PeerUpdate) Descriptor() ([]byte, []int) {
+	return file_tailnet_proto_tailnet_proto_rawDescGZIP(), []int{4, 0}
+}
+
+func (x *CoordinateResponse_PeerUpdate) GetUuid() []byte {
+	if x != nil {
+		return x.Uuid
+	}
+	return nil
+}
+
+func (x *CoordinateResponse_PeerUpdate) GetNode() *Node {
+	if x != nil {
+		return x.Node
+	}
+	return nil
+}
+
+func (x *CoordinateResponse_PeerUpdate) GetKind() CoordinateResponse_PeerUpdate_Kind {
+	if x != nil {
+		return x.Kind
+	}
+	return CoordinateResponse_PeerUpdate_KIND_UNSPECIFIED
+}
+
+func (x *CoordinateResponse_PeerUpdate) GetReason() string {
+	if x != nil {
+		return x.Reason
+	}
+	return ""
+}
+
+var File_tailnet_proto_tailnet_proto protoreflect.FileDescriptor
+
+var file_tailnet_proto_tailnet_proto_rawDesc = []byte{
+	0x0a, 0x1b, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
+	0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x10, 0x63,
+	0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x1a,
+	0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x22, 0xff, 0x07, 0x0a, 0x07, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x12, 0x45, 0x0a, 0x0b,
+	0x68, 0x6f, 0x6d, 0x65, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x24, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65,
+	0x74, 0x2e, 0x76, 0x32, 0x2e, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x2e, 0x48, 0x6f, 0x6d,
+	0x65, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x52, 0x0a, 0x68, 0x6f, 0x6d, 0x65, 0x50, 0x61, 0x72,
+	0x61, 0x6d, 0x73, 0x12, 0x40, 0x0a, 0x07, 0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x2e,
+	0x52, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x07, 0x72, 0x65,
+	0x67, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0xa6, 0x01, 0x0a, 0x0a, 0x48, 0x6f, 0x6d, 0x65, 0x50, 0x61,
+	0x72, 0x61, 0x6d, 0x73, 0x12, 0x58, 0x0a, 0x0c, 0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x5f, 0x73,
+	0x63, 0x6f, 0x72, 0x65, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x63, 0x6f, 0x64,
+	0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x44, 0x45,
+	0x52, 0x50, 0x4d, 0x61, 0x70, 0x2e, 0x48, 0x6f, 0x6d, 0x65, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x73,
+	0x2e, 0x52, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x53, 0x63, 0x6f, 0x72, 0x65, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x0b, 0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x53, 0x63, 0x6f, 0x72, 0x65, 0x1a, 0x3e,
+	0x0a, 0x10, 0x52, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x53, 0x63, 0x6f, 0x72, 0x65, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52,
+	0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x01, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0xe3,
+	0x04, 0x0a, 0x06, 0x52, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x12, 0x1b, 0x0a, 0x09, 0x72, 0x65, 0x67,
+	0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x08, 0x72, 0x65,
+	0x67, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64,
+	0x65, 0x64, 0x5f, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d,
+	0x65, 0x6d, 0x62, 0x65, 0x64, 0x64, 0x65, 0x64, 0x52, 0x65, 0x6c, 0x61, 0x79, 0x12, 0x1f, 0x0a,
+	0x0b, 0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0a, 0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x1f,
+	0x0a, 0x0b, 0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0a, 0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x12,
+	0x14, 0x0a, 0x05, 0x61, 0x76, 0x6f, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05,
+	0x61, 0x76, 0x6f, 0x69, 0x64, 0x12, 0x3b, 0x0a, 0x05, 0x6e, 0x6f, 0x64, 0x65, 0x73, 0x18, 0x06,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69,
+	0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x2e,
+	0x52, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x2e, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x05, 0x6e, 0x6f, 0x64,
+	0x65, 0x73, 0x1a, 0xff, 0x02, 0x0a, 0x04, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x1b, 0x0a, 0x09, 0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x05, 0x52, 0x08, 0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09,
+	0x68, 0x6f, 0x73, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x68, 0x6f, 0x73, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x65, 0x72,
+	0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x65,
+	0x72, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70, 0x76, 0x34, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x69, 0x70, 0x76, 0x34, 0x12, 0x12, 0x0a, 0x04, 0x69, 0x70,
+	0x76, 0x36, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x69, 0x70, 0x76, 0x36, 0x12, 0x1b,
+	0x0a, 0x09, 0x73, 0x74, 0x75, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x08, 0x73, 0x74, 0x75, 0x6e, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x73,
+	0x74, 0x75, 0x6e, 0x5f, 0x6f, 0x6e, 0x6c, 0x79, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08,
+	0x73, 0x74, 0x75, 0x6e, 0x4f, 0x6e, 0x6c, 0x79, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65, 0x72, 0x70,
+	0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x08, 0x64, 0x65, 0x72,
+	0x70, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x2c, 0x0a, 0x12, 0x69, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72,
+	0x65, 0x5f, 0x66, 0x6f, 0x72, 0x5f, 0x74, 0x65, 0x73, 0x74, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x10, 0x69, 0x6e, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x46, 0x6f, 0x72, 0x54, 0x65,
+	0x73, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x5f, 0x68, 0x74, 0x74,
+	0x70, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x48, 0x74,
+	0x74, 0x70, 0x12, 0x20, 0x0a, 0x0c, 0x73, 0x74, 0x75, 0x6e, 0x5f, 0x74, 0x65, 0x73, 0x74, 0x5f,
+	0x69, 0x70, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x74, 0x75, 0x6e, 0x54, 0x65,
+	0x73, 0x74, 0x49, 0x70, 0x12, 0x1e, 0x0a, 0x0b, 0x63, 0x61, 0x6e, 0x5f, 0x70, 0x6f, 0x72, 0x74,
+	0x5f, 0x38, 0x30, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x61, 0x6e, 0x50, 0x6f,
+	0x72, 0x74, 0x38, 0x30, 0x1a, 0x5c, 0x0a, 0x0c, 0x52, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x73, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x36, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61,
+	0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70,
+	0x2e, 0x52, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
+	0x38, 0x01, 0x22, 0x17, 0x0a, 0x15, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x44, 0x45, 0x52, 0x50,
+	0x4d, 0x61, 0x70, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xac, 0x04, 0x0a, 0x04,
+	0x4e, 0x6f, 0x64, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x02, 0x69, 0x64, 0x12, 0x2f, 0x0a, 0x05, 0x61, 0x73, 0x5f, 0x6f, 0x66, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
+	0x04, 0x61, 0x73, 0x4f, 0x66, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x64, 0x69, 0x73, 0x63, 0x6f,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x12, 0x25, 0x0a,
+	0x0e, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x72, 0x65, 0x64, 0x5f, 0x64, 0x65, 0x72, 0x70, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0d, 0x70, 0x72, 0x65, 0x66, 0x65, 0x72, 0x72, 0x65, 0x64,
+	0x44, 0x65, 0x72, 0x70, 0x12, 0x4a, 0x0a, 0x0c, 0x64, 0x65, 0x72, 0x70, 0x5f, 0x6c, 0x61, 0x74,
+	0x65, 0x6e, 0x63, 0x79, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x63, 0x6f, 0x64,
+	0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x4e, 0x6f,
+	0x64, 0x65, 0x2e, 0x44, 0x65, 0x72, 0x70, 0x4c, 0x61, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x52, 0x0b, 0x64, 0x65, 0x72, 0x70, 0x4c, 0x61, 0x74, 0x65, 0x6e, 0x63, 0x79,
+	0x12, 0x63, 0x0a, 0x15, 0x64, 0x65, 0x72, 0x70, 0x5f, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x64, 0x5f,
+	0x77, 0x65, 0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x2f, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e,
+	0x76, 0x32, 0x2e, 0x4e, 0x6f, 0x64, 0x65, 0x2e, 0x44, 0x65, 0x72, 0x70, 0x46, 0x6f, 0x72, 0x63,
+	0x65, 0x64, 0x57, 0x65, 0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x52, 0x13, 0x64, 0x65, 0x72, 0x70, 0x46, 0x6f, 0x72, 0x63, 0x65, 0x64, 0x57, 0x65, 0x62, 0x73,
+	0x6f, 0x63, 0x6b, 0x65, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73,
+	0x65, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73,
+	0x73, 0x65, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x69,
+	0x70, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
+	0x64, 0x49, 0x70, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
+	0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x73, 0x1a, 0x3e, 0x0a, 0x10, 0x44, 0x65, 0x72, 0x70, 0x4c, 0x61, 0x74, 0x65, 0x6e, 0x63,
+	0x79, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x01, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
+	0x38, 0x01, 0x1a, 0x46, 0x0a, 0x18, 0x44, 0x65, 0x72, 0x70, 0x46, 0x6f, 0x72, 0x63, 0x65, 0x64,
+	0x57, 0x65, 0x62, 0x73, 0x6f, 0x63, 0x6b, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x6b, 0x65, 0x79,
+	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xb6, 0x03, 0x0a, 0x11, 0x43,
+	0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x4f, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x73, 0x65, 0x6c, 0x66, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61,
+	0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x53, 0x65, 0x6c, 0x66, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x6c,
+	0x66, 0x12, 0x4e, 0x0a, 0x0a, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61,
+	0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x44, 0x69, 0x73, 0x63, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x0a, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x12, 0x49, 0x0a, 0x0a, 0x61, 0x64, 0x64, 0x5f, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61,
+	0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65,
+	0x6c, 0x52, 0x09, 0x61, 0x64, 0x64, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x4f, 0x0a, 0x0d,
+	0x72, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x5f, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c,
+	0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x52,
+	0x0c, 0x72, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x38, 0x0a,
+	0x0a, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x65, 0x6c, 0x66, 0x12, 0x2a, 0x0a, 0x04, 0x6e,
+	0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x63, 0x6f, 0x64, 0x65,
+	0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x4e, 0x6f, 0x64,
+	0x65, 0x52, 0x04, 0x6e, 0x6f, 0x64, 0x65, 0x1a, 0x0c, 0x0a, 0x0a, 0x44, 0x69, 0x73, 0x63, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x1a, 0x1c, 0x0a, 0x06, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12,
+	0x12, 0x0a, 0x04, 0x75, 0x75, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x75,
+	0x75, 0x69, 0x64, 0x22, 0xdd, 0x02, 0x0a, 0x12, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61,
+	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x52, 0x0a, 0x0c, 0x70, 0x65,
+	0x65, 0x72, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x2f, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74,
+	0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x52, 0x0b, 0x70, 0x65, 0x65, 0x72, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x73, 0x1a, 0xf2,
+	0x01, 0x0a, 0x0a, 0x50, 0x65, 0x65, 0x72, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x12, 0x0a,
+	0x04, 0x75, 0x75, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x75, 0x75, 0x69,
+	0x64, 0x12, 0x2a, 0x0a, 0x04, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x16, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e,
+	0x76, 0x32, 0x2e, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x04, 0x6e, 0x6f, 0x64, 0x65, 0x12, 0x48, 0x0a,
+	0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x34, 0x2e, 0x63, 0x6f,
+	0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x43,
+	0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x2e, 0x4b, 0x69, 0x6e,
+	0x64, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f,
+	0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x22,
+	0x42, 0x0a, 0x04, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x14, 0x0a, 0x10, 0x4b, 0x49, 0x4e, 0x44, 0x5f,
+	0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x08, 0x0a,
+	0x04, 0x4e, 0x4f, 0x44, 0x45, 0x10, 0x01, 0x12, 0x10, 0x0a, 0x0c, 0x44, 0x49, 0x53, 0x43, 0x4f,
+	0x4e, 0x4e, 0x45, 0x43, 0x54, 0x45, 0x44, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x4c, 0x4f, 0x53,
+	0x54, 0x10, 0x03, 0x32, 0xc4, 0x01, 0x0a, 0x06, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x12, 0x56,
+	0x0a, 0x0e, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61, 0x70, 0x73,
+	0x12, 0x27, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74,
+	0x2e, 0x76, 0x32, 0x2e, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x44, 0x45, 0x52, 0x50, 0x4d, 0x61,
+	0x70, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x63, 0x6f, 0x64, 0x65,
+	0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x44, 0x45, 0x52,
+	0x50, 0x4d, 0x61, 0x70, 0x30, 0x01, 0x12, 0x62, 0x0a, 0x11, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69,
+	0x6e, 0x61, 0x74, 0x65, 0x54, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x12, 0x23, 0x2e, 0x63, 0x6f,
+	0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2e, 0x76, 0x32, 0x2e, 0x43,
+	0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x24, 0x2e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2e, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74,
+	0x2e, 0x76, 0x32, 0x2e, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x42, 0x29, 0x5a, 0x27, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x63,
+	0x6f, 0x64, 0x65, 0x72, 0x2f, 0x76, 0x32, 0x2f, 0x74, 0x61, 0x69, 0x6c, 0x6e, 0x65, 0x74, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_tailnet_proto_tailnet_proto_rawDescOnce sync.Once
+	file_tailnet_proto_tailnet_proto_rawDescData = file_tailnet_proto_tailnet_proto_rawDesc
+)
+
+func file_tailnet_proto_tailnet_proto_rawDescGZIP() []byte {
+	file_tailnet_proto_tailnet_proto_rawDescOnce.Do(func() {
+		file_tailnet_proto_tailnet_proto_rawDescData = protoimpl.X.CompressGZIP(file_tailnet_proto_tailnet_proto_rawDescData)
+	})
+	return file_tailnet_proto_tailnet_proto_rawDescData
+}
+
+var file_tailnet_proto_tailnet_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_tailnet_proto_tailnet_proto_msgTypes = make([]protoimpl.MessageInfo, 16)
+var file_tailnet_proto_tailnet_proto_goTypes = []interface{}{
+	(CoordinateResponse_PeerUpdate_Kind)(0), // 0: coder.tailnet.v2.CoordinateResponse.PeerUpdate.Kind
+	(*DERPMap)(nil),                         // 1: coder.tailnet.v2.DERPMap
+	(*StreamDERPMapsRequest)(nil),           // 2: coder.tailnet.v2.StreamDERPMapsRequest
+	(*Node)(nil),                            // 3: coder.tailnet.v2.Node
+	(*CoordinateRequest)(nil),               // 4: coder.tailnet.v2.CoordinateRequest
+	(*CoordinateResponse)(nil),              // 5: coder.tailnet.v2.CoordinateResponse
+	(*DERPMap_HomeParams)(nil),              // 6: coder.tailnet.v2.DERPMap.HomeParams
+	(*DERPMap_Region)(nil),                  // 7: coder.tailnet.v2.DERPMap.Region
+	nil,                                     // 8: coder.tailnet.v2.DERPMap.RegionsEntry
+	nil,                                     // 9: coder.tailnet.v2.DERPMap.HomeParams.RegionScoreEntry
+	(*DERPMap_Region_Node)(nil),             // 10: coder.tailnet.v2.DERPMap.Region.Node
+	nil,                                     // 11: coder.tailnet.v2.Node.DerpLatencyEntry
+	nil,                                     // 12: coder.tailnet.v2.Node.DerpForcedWebsocketEntry
+	(*CoordinateRequest_UpdateSelf)(nil),    // 13: coder.tailnet.v2.CoordinateRequest.UpdateSelf
+	(*CoordinateRequest_Disconnect)(nil),    // 14: coder.tailnet.v2.CoordinateRequest.Disconnect
+	(*CoordinateRequest_Tunnel)(nil),        // 15: coder.tailnet.v2.CoordinateRequest.Tunnel
+	(*CoordinateResponse_PeerUpdate)(nil),   // 16: coder.tailnet.v2.CoordinateResponse.PeerUpdate
+	(*timestamppb.Timestamp)(nil),           // 17: google.protobuf.Timestamp
+}
+var file_tailnet_proto_tailnet_proto_depIdxs = []int32{
+	6,  // 0: coder.tailnet.v2.DERPMap.home_params:type_name -> coder.tailnet.v2.DERPMap.HomeParams
+	8,  // 1: coder.tailnet.v2.DERPMap.regions:type_name -> coder.tailnet.v2.DERPMap.RegionsEntry
+	17, // 2: coder.tailnet.v2.Node.as_of:type_name -> google.protobuf.Timestamp
+	11, // 3: coder.tailnet.v2.Node.derp_latency:type_name -> coder.tailnet.v2.Node.DerpLatencyEntry
+	12, // 4: coder.tailnet.v2.Node.derp_forced_websocket:type_name -> coder.tailnet.v2.Node.DerpForcedWebsocketEntry
+	13, // 5: coder.tailnet.v2.CoordinateRequest.update_self:type_name -> coder.tailnet.v2.CoordinateRequest.UpdateSelf
+	14, // 6: coder.tailnet.v2.CoordinateRequest.disconnect:type_name -> coder.tailnet.v2.CoordinateRequest.Disconnect
+	15, // 7: coder.tailnet.v2.CoordinateRequest.add_tunnel:type_name -> coder.tailnet.v2.CoordinateRequest.Tunnel
+	15, // 8: coder.tailnet.v2.CoordinateRequest.remove_tunnel:type_name -> coder.tailnet.v2.CoordinateRequest.Tunnel
+	16, // 9: coder.tailnet.v2.CoordinateResponse.peer_updates:type_name -> coder.tailnet.v2.CoordinateResponse.PeerUpdate
+	9,  // 10: coder.tailnet.v2.DERPMap.HomeParams.region_score:type_name -> coder.tailnet.v2.DERPMap.HomeParams.RegionScoreEntry
+	10, // 11: coder.tailnet.v2.DERPMap.Region.nodes:type_name -> coder.tailnet.v2.DERPMap.Region.Node
+	7,  // 12: coder.tailnet.v2.DERPMap.RegionsEntry.value:type_name -> coder.tailnet.v2.DERPMap.Region
+	3,  // 13: coder.tailnet.v2.CoordinateRequest.UpdateSelf.node:type_name -> coder.tailnet.v2.Node
+	3,  // 14: coder.tailnet.v2.CoordinateResponse.PeerUpdate.node:type_name -> coder.tailnet.v2.Node
+	0,  // 15: coder.tailnet.v2.CoordinateResponse.PeerUpdate.kind:type_name -> coder.tailnet.v2.CoordinateResponse.PeerUpdate.Kind
+	2,  // 16: coder.tailnet.v2.Client.StreamDERPMaps:input_type -> coder.tailnet.v2.StreamDERPMapsRequest
+	4,  // 17: coder.tailnet.v2.Client.CoordinateTailnet:input_type -> coder.tailnet.v2.CoordinateRequest
+	1,  // 18: coder.tailnet.v2.Client.StreamDERPMaps:output_type -> coder.tailnet.v2.DERPMap
+	5,  // 19: coder.tailnet.v2.Client.CoordinateTailnet:output_type -> coder.tailnet.v2.CoordinateResponse
+	18, // [18:20] is the sub-list for method output_type
+	16, // [16:18] is the sub-list for method input_type
+	16, // [16:16] is the sub-list for extension type_name
+	16, // [16:16] is the sub-list for extension extendee
+	0,  // [0:16] is the sub-list for field type_name
+}
+
+func init() { file_tailnet_proto_tailnet_proto_init() }
+func file_tailnet_proto_tailnet_proto_init() {
+	if File_tailnet_proto_tailnet_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_tailnet_proto_tailnet_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DERPMap); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tailnet_proto_tailnet_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StreamDERPMapsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tailnet_proto_tailnet_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Node); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tailnet_proto_tailnet_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CoordinateRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tailnet_proto_tailnet_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CoordinateResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tailnet_proto_tailnet_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DERPMap_HomeParams); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tailnet_proto_tailnet_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DERPMap_Region); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tailnet_proto_tailnet_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DERPMap_Region_Node); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tailnet_proto_tailnet_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CoordinateRequest_UpdateSelf); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tailnet_proto_tailnet_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CoordinateRequest_Disconnect); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tailnet_proto_tailnet_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CoordinateRequest_Tunnel); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_tailnet_proto_tailnet_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CoordinateResponse_PeerUpdate); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_tailnet_proto_tailnet_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   16,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_tailnet_proto_tailnet_proto_goTypes,
+		DependencyIndexes: file_tailnet_proto_tailnet_proto_depIdxs,
+		EnumInfos:         file_tailnet_proto_tailnet_proto_enumTypes,
+		MessageInfos:      file_tailnet_proto_tailnet_proto_msgTypes,
+	}.Build()
+	File_tailnet_proto_tailnet_proto = out.File
+	file_tailnet_proto_tailnet_proto_rawDesc = nil
+	file_tailnet_proto_tailnet_proto_goTypes = nil
+	file_tailnet_proto_tailnet_proto_depIdxs = nil
+}
diff --git a/tailnet/proto/tailnet.proto b/tailnet/proto/tailnet.proto
new file mode 100644
index 0000000000000..8c3a1e1163916
--- /dev/null
+++ b/tailnet/proto/tailnet.proto
@@ -0,0 +1,94 @@
+syntax = "proto3";
+option go_package = "github.com/coder/coder/v2/tailnet/proto";
+
+package coder.tailnet.v2;
+
+import "google/protobuf/timestamp.proto";
+
+message DERPMap {
+	message HomeParams {
+		map<int32, double> region_score = 1;
+	}
+	HomeParams home_params = 1;
+
+	message Region {
+		int32 region_id = 1;
+		bool embedded_relay = 2;
+		string region_code = 3;
+		string region_name = 4;
+		bool avoid = 5;
+
+		message Node {
+			string name = 1;
+			int32 region_id = 2;
+			string host_name = 3;
+			string cert_name = 4;
+			string ipv4 = 5;
+			string ipv6 = 6;
+			int32 stun_port = 7;
+			bool stun_only = 8;
+			int32 derp_port = 9;
+			bool insecure_for_tests = 10;
+			bool force_http = 11;
+			string stun_test_ip = 12;
+			bool can_port_80 = 13;
+		}
+		repeated Node nodes = 6;
+	}
+	map<int32, Region> regions = 2;
+}
+
+message StreamDERPMapsRequest {}
+
+// defined in tailnet/coordinator.go
+message Node {
+	int64 id = 1;
+	google.protobuf.Timestamp as_of = 2;
+	bytes key = 3;
+	string disco = 4;
+	int32 preferred_derp = 5;
+	map<string, double> derp_latency = 6;
+	map<int32, string> derp_forced_websocket = 7;
+	repeated string addresses = 8;
+	repeated string allowed_ips = 9;
+	repeated string endpoints = 10;
+}
+
+message CoordinateRequest {
+	message UpdateSelf {
+		Node node = 1;
+	}
+	UpdateSelf update_self = 1;
+
+	message Disconnect {}
+	Disconnect disconnect = 2;
+
+	message Tunnel {
+		bytes uuid = 1;
+	}
+	Tunnel add_tunnel = 3;
+	Tunnel remove_tunnel = 4;
+}
+
+message CoordinateResponse {
+	message PeerUpdate {
+		bytes uuid = 1;
+		Node node = 2;
+
+		enum Kind {
+			KIND_UNSPECIFIED = 0;
+			NODE = 1;
+			DISCONNECTED = 2;
+			LOST = 3;
+		}
+		Kind kind = 3;
+
+		string reason = 4;
+	}
+	repeated PeerUpdate peer_updates = 1;
+}
+
+service Client {
+	rpc StreamDERPMaps(StreamDERPMapsRequest) returns (stream DERPMap);
+	rpc CoordinateTailnet(stream CoordinateRequest) returns (stream CoordinateResponse);
+}
diff --git a/tailnet/proto/tailnet_drpc.pb.go b/tailnet/proto/tailnet_drpc.pb.go
new file mode 100644
index 0000000000000..0e0476870426e
--- /dev/null
+++ b/tailnet/proto/tailnet_drpc.pb.go
@@ -0,0 +1,218 @@
+// Code generated by protoc-gen-go-drpc. DO NOT EDIT.
+// protoc-gen-go-drpc version: v0.0.33
+// source: tailnet/proto/tailnet.proto
+
+package proto
+
+import (
+	context "context"
+	errors "errors"
+	protojson "google.golang.org/protobuf/encoding/protojson"
+	proto "google.golang.org/protobuf/proto"
+	drpc "storj.io/drpc"
+	drpcerr "storj.io/drpc/drpcerr"
+)
+
+type drpcEncoding_File_tailnet_proto_tailnet_proto struct{}
+
+func (drpcEncoding_File_tailnet_proto_tailnet_proto) Marshal(msg drpc.Message) ([]byte, error) {
+	return proto.Marshal(msg.(proto.Message))
+}
+
+func (drpcEncoding_File_tailnet_proto_tailnet_proto) MarshalAppend(buf []byte, msg drpc.Message) ([]byte, error) {
+	return proto.MarshalOptions{}.MarshalAppend(buf, msg.(proto.Message))
+}
+
+func (drpcEncoding_File_tailnet_proto_tailnet_proto) Unmarshal(buf []byte, msg drpc.Message) error {
+	return proto.Unmarshal(buf, msg.(proto.Message))
+}
+
+func (drpcEncoding_File_tailnet_proto_tailnet_proto) JSONMarshal(msg drpc.Message) ([]byte, error) {
+	return protojson.Marshal(msg.(proto.Message))
+}
+
+func (drpcEncoding_File_tailnet_proto_tailnet_proto) JSONUnmarshal(buf []byte, msg drpc.Message) error {
+	return protojson.Unmarshal(buf, msg.(proto.Message))
+}
+
+type DRPCClientClient interface {
+	DRPCConn() drpc.Conn
+
+	StreamDERPMaps(ctx context.Context, in *StreamDERPMapsRequest) (DRPCClient_StreamDERPMapsClient, error)
+	CoordinateTailnet(ctx context.Context) (DRPCClient_CoordinateTailnetClient, error)
+}
+
+type drpcClientClient struct {
+	cc drpc.Conn
+}
+
+func NewDRPCClientClient(cc drpc.Conn) DRPCClientClient {
+	return &drpcClientClient{cc}
+}
+
+func (c *drpcClientClient) DRPCConn() drpc.Conn { return c.cc }
+
+func (c *drpcClientClient) StreamDERPMaps(ctx context.Context, in *StreamDERPMapsRequest) (DRPCClient_StreamDERPMapsClient, error) {
+	stream, err := c.cc.NewStream(ctx, "/coder.tailnet.v2.Client/StreamDERPMaps", drpcEncoding_File_tailnet_proto_tailnet_proto{})
+	if err != nil {
+		return nil, err
+	}
+	x := &drpcClient_StreamDERPMapsClient{stream}
+	if err := x.MsgSend(in, drpcEncoding_File_tailnet_proto_tailnet_proto{}); err != nil {
+		return nil, err
+	}
+	if err := x.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type DRPCClient_StreamDERPMapsClient interface {
+	drpc.Stream
+	Recv() (*DERPMap, error)
+}
+
+type drpcClient_StreamDERPMapsClient struct {
+	drpc.Stream
+}
+
+func (x *drpcClient_StreamDERPMapsClient) GetStream() drpc.Stream {
+	return x.Stream
+}
+
+func (x *drpcClient_StreamDERPMapsClient) Recv() (*DERPMap, error) {
+	m := new(DERPMap)
+	if err := x.MsgRecv(m, drpcEncoding_File_tailnet_proto_tailnet_proto{}); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (x *drpcClient_StreamDERPMapsClient) RecvMsg(m *DERPMap) error {
+	return x.MsgRecv(m, drpcEncoding_File_tailnet_proto_tailnet_proto{})
+}
+
+func (c *drpcClientClient) CoordinateTailnet(ctx context.Context) (DRPCClient_CoordinateTailnetClient, error) {
+	stream, err := c.cc.NewStream(ctx, "/coder.tailnet.v2.Client/CoordinateTailnet", drpcEncoding_File_tailnet_proto_tailnet_proto{})
+	if err != nil {
+		return nil, err
+	}
+	x := &drpcClient_CoordinateTailnetClient{stream}
+	return x, nil
+}
+
+type DRPCClient_CoordinateTailnetClient interface {
+	drpc.Stream
+	Send(*CoordinateRequest) error
+	Recv() (*CoordinateResponse, error)
+}
+
+type drpcClient_CoordinateTailnetClient struct {
+	drpc.Stream
+}
+
+func (x *drpcClient_CoordinateTailnetClient) GetStream() drpc.Stream {
+	return x.Stream
+}
+
+func (x *drpcClient_CoordinateTailnetClient) Send(m *CoordinateRequest) error {
+	return x.MsgSend(m, drpcEncoding_File_tailnet_proto_tailnet_proto{})
+}
+
+func (x *drpcClient_CoordinateTailnetClient) Recv() (*CoordinateResponse, error) {
+	m := new(CoordinateResponse)
+	if err := x.MsgRecv(m, drpcEncoding_File_tailnet_proto_tailnet_proto{}); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (x *drpcClient_CoordinateTailnetClient) RecvMsg(m *CoordinateResponse) error {
+	return x.MsgRecv(m, drpcEncoding_File_tailnet_proto_tailnet_proto{})
+}
+
+type DRPCClientServer interface {
+	StreamDERPMaps(*StreamDERPMapsRequest, DRPCClient_StreamDERPMapsStream) error
+	CoordinateTailnet(DRPCClient_CoordinateTailnetStream) error
+}
+
+type DRPCClientUnimplementedServer struct{}
+
+func (s *DRPCClientUnimplementedServer) StreamDERPMaps(*StreamDERPMapsRequest, DRPCClient_StreamDERPMapsStream) error {
+	return drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
+func (s *DRPCClientUnimplementedServer) CoordinateTailnet(DRPCClient_CoordinateTailnetStream) error {
+	return drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
+type DRPCClientDescription struct{}
+
+func (DRPCClientDescription) NumMethods() int { return 2 }
+
+func (DRPCClientDescription) Method(n int) (string, drpc.Encoding, drpc.Receiver, interface{}, bool) {
+	switch n {
+	case 0:
+		return "/coder.tailnet.v2.Client/StreamDERPMaps", drpcEncoding_File_tailnet_proto_tailnet_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return nil, srv.(DRPCClientServer).
+					StreamDERPMaps(
+						in1.(*StreamDERPMapsRequest),
+						&drpcClient_StreamDERPMapsStream{in2.(drpc.Stream)},
+					)
+			}, DRPCClientServer.StreamDERPMaps, true
+	case 1:
+		return "/coder.tailnet.v2.Client/CoordinateTailnet", drpcEncoding_File_tailnet_proto_tailnet_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return nil, srv.(DRPCClientServer).
+					CoordinateTailnet(
+						&drpcClient_CoordinateTailnetStream{in1.(drpc.Stream)},
+					)
+			}, DRPCClientServer.CoordinateTailnet, true
+	default:
+		return "", nil, nil, nil, false
+	}
+}
+
+func DRPCRegisterClient(mux drpc.Mux, impl DRPCClientServer) error {
+	return mux.Register(impl, DRPCClientDescription{})
+}
+
+type DRPCClient_StreamDERPMapsStream interface {
+	drpc.Stream
+	Send(*DERPMap) error
+}
+
+type drpcClient_StreamDERPMapsStream struct {
+	drpc.Stream
+}
+
+func (x *drpcClient_StreamDERPMapsStream) Send(m *DERPMap) error {
+	return x.MsgSend(m, drpcEncoding_File_tailnet_proto_tailnet_proto{})
+}
+
+type DRPCClient_CoordinateTailnetStream interface {
+	drpc.Stream
+	Send(*CoordinateResponse) error
+	Recv() (*CoordinateRequest, error)
+}
+
+type drpcClient_CoordinateTailnetStream struct {
+	drpc.Stream
+}
+
+func (x *drpcClient_CoordinateTailnetStream) Send(m *CoordinateResponse) error {
+	return x.MsgSend(m, drpcEncoding_File_tailnet_proto_tailnet_proto{})
+}
+
+func (x *drpcClient_CoordinateTailnetStream) Recv() (*CoordinateRequest, error) {
+	m := new(CoordinateRequest)
+	if err := x.MsgRecv(m, drpcEncoding_File_tailnet_proto_tailnet_proto{}); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (x *drpcClient_CoordinateTailnetStream) RecvMsg(m *CoordinateRequest) error {
+	return x.MsgRecv(m, drpcEncoding_File_tailnet_proto_tailnet_proto{})
+}
diff --git a/tailnet/tailnettest/multiagentmock.go b/tailnet/tailnettest/multiagentmock.go
index e6bde4f8c2367..7266060fc3788 100644
--- a/tailnet/tailnettest/multiagentmock.go
+++ b/tailnet/tailnettest/multiagentmock.go
@@ -1,5 +1,5 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/coder/coder/tailnet/tailnettest (interfaces: MultiAgentConn)
+// Source: github.com/coder/coder/v2/tailnet (interfaces: MultiAgentConn)
 
 // Package tailnettest is a generated GoMock package.
 package tailnettest
@@ -8,7 +8,7 @@ import (
 	context "context"
 	reflect "reflect"
 
-	tailnet "github.com/coder/coder/tailnet"
+	tailnet "github.com/coder/coder/v2/tailnet"
 	gomock "github.com/golang/mock/gomock"
 	uuid "github.com/google/uuid"
 )
@@ -64,20 +64,6 @@ func (mr *MockMultiAgentConnMockRecorder) Close() *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Close", reflect.TypeOf((*MockMultiAgentConn)(nil).Close))
 }
 
-// Enqueue mocks base method.
-func (m *MockMultiAgentConn) Enqueue(arg0 []*tailnet.Node) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Enqueue", arg0)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// Enqueue indicates an expected call of Enqueue.
-func (mr *MockMultiAgentConnMockRecorder) Enqueue(arg0 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Enqueue", reflect.TypeOf((*MockMultiAgentConn)(nil).Enqueue), arg0)
-}
-
 // IsClosed mocks base method.
 func (m *MockMultiAgentConn) IsClosed() bool {
 	m.ctrl.T.Helper()
diff --git a/tailnet/tailnettest/tailnettest.go b/tailnet/tailnettest/tailnettest.go
index 655568a341ccb..e9eb45ad96df9 100644
--- a/tailnet/tailnettest/tailnettest.go
+++ b/tailnet/tailnettest/tailnettest.go
@@ -18,10 +18,10 @@ import (
 	"tailscale.com/types/nettype"
 
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/coder/tailnet"
+	"github.com/coder/coder/v2/tailnet"
 )
 
-//go:generate mockgen -destination ./multiagentmock.go -package tailnettest github.com/coder/coder/tailnet MultiAgentConn
+//go:generate mockgen -destination ./multiagentmock.go -package tailnettest github.com/coder/coder/v2/tailnet MultiAgentConn
 
 // RunDERPAndSTUN creates a DERP mapping for tests.
 func RunDERPAndSTUN(t *testing.T) (*tailcfg.DERPMap, *derp.Server) {
@@ -77,7 +77,8 @@ func RunDERPOnlyWebSockets(t *testing.T) *tailcfg.DERPMap {
 	handler, closeFunc = tailnet.WithWebsocketSupport(d, handler)
 	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/derp" {
-			handler.ServeHTTP(w, r)
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte("hello"))
 			return
 		}
 		if r.Header.Get("Upgrade") != "websocket" {
diff --git a/tailnet/tailnettest/tailnettest_test.go b/tailnet/tailnettest/tailnettest_test.go
index fda818a1cebca..4d551de764d4a 100644
--- a/tailnet/tailnettest/tailnettest_test.go
+++ b/tailnet/tailnettest/tailnettest_test.go
@@ -5,7 +5,7 @@ import (
 
 	"go.uber.org/goleak"
 
-	"github.com/coder/coder/tailnet/tailnettest"
+	"github.com/coder/coder/v2/tailnet/tailnettest"
 )
 
 func TestMain(m *testing.M) {
diff --git a/tailnet/trackedconn.go b/tailnet/trackedconn.go
index 0ec19695ba29f..be464b2327921 100644
--- a/tailnet/trackedconn.go
+++ b/tailnet/trackedconn.go
@@ -20,6 +20,7 @@ const WriteTimeout = time.Second * 5
 type TrackedConn struct {
 	ctx      context.Context
 	cancel   func()
+	kind     QueueKind
 	conn     net.Conn
 	updates  chan []*Node
 	logger   slog.Logger
@@ -35,7 +36,14 @@ type TrackedConn struct {
 	overwrites int64
 }
 
-func NewTrackedConn(ctx context.Context, cancel func(), conn net.Conn, id uuid.UUID, logger slog.Logger, name string, overwrites int64) *TrackedConn {
+func NewTrackedConn(ctx context.Context, cancel func(),
+	conn net.Conn,
+	id uuid.UUID,
+	logger slog.Logger,
+	name string,
+	overwrites int64,
+	kind QueueKind,
+) *TrackedConn {
 	// buffer updates so they don't block, since we hold the
 	// coordinator mutex while queuing.  Node updates don't
 	// come quickly, so 512 should be plenty for all but
@@ -53,6 +61,7 @@ func NewTrackedConn(ctx context.Context, cancel func(), conn net.Conn, id uuid.U
 		lastWrite:  now,
 		name:       name,
 		overwrites: overwrites,
+		kind:       kind,
 	}
 }
 
@@ -70,6 +79,10 @@ func (t *TrackedConn) UniqueID() uuid.UUID {
 	return t.id
 }
 
+func (t *TrackedConn) Kind() QueueKind {
+	return t.kind
+}
+
 func (t *TrackedConn) Name() string {
 	return t.name
 }
@@ -86,6 +99,10 @@ func (t *TrackedConn) CoordinatorClose() error {
 	return t.Close()
 }
 
+func (t *TrackedConn) Done() <-chan struct{} {
+	return t.ctx.Done()
+}
+
 // Close the connection and cancel the context for reading node updates from the queue
 func (t *TrackedConn) Close() error {
 	t.cancel()
diff --git a/testutil/eventually_test.go b/testutil/eventually_test.go
index c3e8cabf7182d..e986c1c121e44 100644
--- a/testutil/eventually_test.go
+++ b/testutil/eventually_test.go
@@ -7,7 +7,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"go.uber.org/goleak"
 
-	"github.com/coder/coder/testutil"
+	"github.com/coder/coder/v2/testutil"
 )
 
 func TestMain(m *testing.M) {
diff --git a/testutil/pty.go b/testutil/pty.go
new file mode 100644
index 0000000000000..3ada3408a6b5e
--- /dev/null
+++ b/testutil/pty.go
@@ -0,0 +1,101 @@
+package testutil
+
+import (
+	"context"
+	"io"
+	"strings"
+	"testing"
+
+	"golang.org/x/xerrors"
+
+	"github.com/hinshun/vt10x"
+)
+
+// TerminalReader emulates a terminal and allows matching output.  It's important in cases where we
+// can get control sequences to parse them correctly, and keep the state of the terminal across the
+// lifespan of the PTY, since some control sequences are relative to the current cursor position.
+type TerminalReader struct {
+	t    *testing.T
+	r    io.Reader
+	term vt10x.Terminal
+}
+
+func NewTerminalReader(t *testing.T, r io.Reader) *TerminalReader {
+	return &TerminalReader{
+		t:    t,
+		r:    r,
+		term: vt10x.New(vt10x.WithSize(80, 80)),
+	}
+}
+
+// ReadUntilString emulates a terminal and reads one byte at a time until we
+// either see the string we want, or the context expires.  The PTY must be sized
+// to 80x80 or there could be unexpected results.
+func (tr *TerminalReader) ReadUntilString(ctx context.Context, want string) error {
+	return tr.ReadUntil(ctx, func(line string) bool {
+		return strings.TrimSpace(line) == want
+	})
+}
+
+// ReadUntil emulates a terminal and reads one byte at a time until the matcher
+// returns true or the context expires.  If the matcher is nil, read until EOF.
+// The PTY must be sized to 80x80 or there could be unexpected results.
+func (tr *TerminalReader) ReadUntil(ctx context.Context, matcher func(line string) bool) (retErr error) {
+	readBytes := make([]byte, 0)
+	readErrs := make(chan error, 1)
+	defer func() {
+		// Dump the terminal contents since they can be helpful for debugging, but
+		// trim empty lines since much of the terminal will usually be blank.
+		got := tr.term.String()
+		lines := strings.Split(got, "\n")
+		for i := range lines {
+			if strings.TrimSpace(lines[i]) != "" {
+				lines = lines[i:]
+				break
+			}
+		}
+		for i := len(lines) - 1; i >= 0; i-- {
+			if strings.TrimSpace(lines[i]) != "" {
+				lines = lines[:i+1]
+				break
+			}
+		}
+		gotTrimmed := strings.Join(lines, "\n")
+		tr.t.Logf("Terminal contents:\n%s", gotTrimmed)
+		// EOF is expected when matcher == nil
+		if retErr != nil && !(xerrors.Is(retErr, io.EOF) && matcher == nil) {
+			tr.t.Logf("Bytes Read: %q", string(readBytes))
+		}
+	}()
+	for {
+		b := make([]byte, 1)
+		go func() {
+			_, err := tr.r.Read(b)
+			readErrs <- err
+		}()
+		select {
+		case err := <-readErrs:
+			if err != nil {
+				return err
+			}
+			readBytes = append(readBytes, b...)
+			_, err = tr.term.Write(b)
+			if err != nil {
+				return err
+			}
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+		if matcher == nil {
+			// A nil matcher means to read until EOF.
+			continue
+		}
+		got := tr.term.String()
+		lines := strings.Split(got, "\n")
+		for _, line := range lines {
+			if matcher(line) {
+				return nil
+			}
+		}
+	}
+}